diff --git a/.gitattributes b/.gitattributes
index 25e3302a42b40..e032f59a3616d 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -9,3 +9,5 @@ docs/theme/js/theme.js linguist-vendored=false
 *_pb.ts linguist-generated
 *_pb.grpc-*.ts linguist-generated
 *_pb.client.ts linguist-generated
+
+*.golden -text
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 5d2098d1b0a99..f709ff96fa8e8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,8 +1,25 @@
 # Merge rules are governed by logic in the Workflow Bot. Protect the
 # .github/workflows directory (and the merge logic) using CODEOWNERS.
-/.github/workflows/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @tcsc @rosstimothy
-/build.assets/tooling/cmd/difftest/ @klizhentas @russjones @r0mant @zmb3
+/.github/workflows/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @doggydogworld @rosstimothy
+/.github/actions/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @doggydogworld @rosstimothy
+/build.assets/tooling/cmd/difftest/ @klizhentas @russjones @r0mant @zmb3 @rosstimothy
 
-# Owners for dependency updates in JS packages.
-/pnpm-lock.yaml @avatus @gzdunek @ravicious
-web/packages/teleterm/package.json @gzdunek @ravicious
+# Owners for JS dependency updates.
+/pnpm-lock.yaml @avatus @gzdunek @ravicious @zmb3 @r0mant
+/web/packages/teleterm/package.json @gzdunek @ravicious
+
+# Owners for Go dependency updates.
+/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/api/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/assets/aws/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/assets/backport/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/build.assets/tooling/go.mod @russjones @r0mant @zmb3 @rosstimothy @fheinecke @camscale @doggydogworld
+/integrations/terraform/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato
+/integrations/terraform-mwi/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato @strideynet
+/integrations/event-handler/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato
+
+# Owners for Rust dependency updates.
+/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini
+/tool/fdpass-teleport/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini
+/web/packages/shared/libs/ironrdp/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini @probakowski
+/lib/srv/desktop/rdp/rdpclient/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini @probakowski
diff --git a/.github/ISSUE_TEMPLATE/test-plan-docs.md b/.github/ISSUE_TEMPLATE/test-plan-docs.md
index 7182a1ffc4294..6ea9a66b54f7f 100644
--- a/.github/ISSUE_TEMPLATE/test-plan-docs.md
+++ b/.github/ISSUE_TEMPLATE/test-plan-docs.md
@@ -102,10 +102,10 @@ version of Teleport.
   and verify their accuracy while using the newly released major version of
   Teleport.
 
-  - [ ] General [installation page](../../docs/pages/installation.mdx): ensure
+  - [ ] General [installation page](../../docs/pages/installation/installation.mdx): ensure
     that installation methods support the new release candidate.
   - [ ] [Teleport Community
-    Edition](../../docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx) demo
+    Edition](../../docs/pages/get-started/deploy-community.mdx) demo
     guide.
   - [ ] [Teleport Enterprise (Cloud)](../../docs/pages/get-started.mdx) getting
     started guide.
diff --git a/.github/ISSUE_TEMPLATE/testplan.md b/.github/ISSUE_TEMPLATE/testplan.md
index 36fbdb83bf270..f28b95bf408f2 100644
--- a/.github/ISSUE_TEMPLATE/testplan.md
+++ b/.github/ISSUE_TEMPLATE/testplan.md
@@ -569,6 +569,10 @@ on the remote host. Note that the `--callback` URL must be able to resolve to th
 [Docs](https://goteleport.com/docs/agents/join-services-to-your-cluster/gcp/)
 - [ ] Join a Teleport node running in a GCP VM.
 
+### Oracle Node Joining
+[Docs](https://goteleport.com/docs/enroll-resources/agents/oracle/)
+- [ ] Join a Teleport node running in an OCI VM.
+
 ### Cloud Labels
 - [ ] Create an EC2 instance with [tags in instance metadata enabled](https://goteleport.com/docs/management/guides/ec2-tags/)
 and with tag `foo`: `bar`. Verify that a node running on the instance has label
@@ -740,6 +744,8 @@ tsh ssh node-that-requires-device-trust
     - [ ] K8s Access
     - [ ] App Access NOT enforced in global mode
     - [ ] Desktop Access NOT enforced in global mode
+  - [ ] device_trust.mode="required-for-humans" enforces enrolled devices for
+        humans, but bots (e.g. `tbot`) function on any device
   - [ ] Role-based authz enforces enrolled devices
         (device_trust.mode="optional" and role.spec.options.device_trust_mode="required")
     - [ ] SSH
@@ -1039,9 +1045,10 @@ tsh bench web sessions --max=5000 --web user ls
 - [ ] Verify [AWS console access](https://goteleport.com/docs/application-access/cloud-apis/aws-console/).
   - [ ] Can log into AWS web console through the web UI.
   - [ ] Can interact with AWS using `tsh` commands.
-    - [ ] `tsh aws`
-    - [ ] `tsh aws --endpoint-url` (this is a hidden flag)
-- [ ] Verify [Azure CLI access](https://goteleport.com/docs/application-access/cloud-apis/azure/) with `tsh apps login`.
+    - [ ] `tsh aws sts get-caller-identity`
+    - [ ] `tsh aws s3 ls`
+    - [ ] `tsh aws s3 cp ./file s3://<bucket>/test`
+- [ ] Verify [Azure CLI access](https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/azure/) with `tsh apps login`.
   - [ ] Can interact with Azure using `tsh az` commands.
   - [ ] Can interact with Azure using a combination of `tsh proxy az` and `az` commands.
 - [ ] Verify [GCP CLI access](https://goteleport.com/docs/application-access/cloud-apis/google-cloud/) with `tsh apps login`.
@@ -1086,6 +1093,7 @@ manualy testing.
   - [ ] Amazon Redshift Serverless.
     - [ ] Verify connection to external AWS account works with `assume_role_arn: ""` and `external_id: "<id>"`
   - [ ] Amazon ElastiCache.
+  - [ ] Amazon ElastiCache Serverless.
   - [ ] Amazon MemoryDB.
   - [ ] Amazon OpenSearch.
   - [ ] Amazon Dynamodb.
@@ -1124,6 +1132,7 @@ manualy testing.
   - [ ] Amazon Redshift.
   - [ ] Amazon Redshift Serverless.
   - [ ] Amazon ElastiCache.
+  - [ ] Amazon ElastiCache Serverless.
   - [ ] Amazon MemoryDB.
   - [ ] Amazon OpenSearch.
   - [ ] Amazon Dynamodb.
@@ -1184,6 +1193,7 @@ manualy testing.
       - [x] Can detect and register Redshift clusters. (covered by E2E test)
       - [x] Can detect and register Redshift serverless workgroups, and their VPC endpoints. (covered by E2E test)
       - [ ] Can detect and register ElastiCache Redis clusters.
+      - [ ] Can detect and register ElastiCache Serverless Redis/Valkey clusters.
       - [ ] Can detect and register MemoryDB clusters.
       - [ ] Can detect and register OpenSearch domains.
       - [ ] Can detect and register DocumentDB clusters.
@@ -1639,6 +1649,7 @@ Verify that SSH works, and that resumable SSH is not interrupted across a contro
   - [ ] New EC2 instances with matching AWS tags are discovered and added to the teleport cluster
     - [ ] Large numbers of EC2 instances (51+) are all successfully added to the cluster
   - [ ] Nodes that have been discovered do not have the install script run on the node multiple times
+  - [ ] EC2 instances can be discovered in multiple accounts
 
 ## Azure Discovery
 
diff --git a/.github/ISSUE_TEMPLATE/webtestplan.md b/.github/ISSUE_TEMPLATE/webtestplan.md
index 13e0822366107..65edd73cb0983 100644
--- a/.github/ISSUE_TEMPLATE/webtestplan.md
+++ b/.github/ISSUE_TEMPLATE/webtestplan.md
@@ -132,6 +132,8 @@ For each, test the invite, reset, and login flows
 - [ ] Verify that error message is shown if an invite/reset is expired/invalid
 - [ ] Verify that account is locked after several unsuccessful login attempts
 
+- [ ] Verify that after logging in, user is automatically redirected to the login page when the session expires.
+
 #### Auth Connectors
 
 For help with setting up auth connectors, check out the [Quick GitHub/SAML/OIDC Setup Tips]
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b8c8bf7719609..3ce9f5f22fe1c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,19 +1,16 @@
 version: 2
 updates:
   - package-ecosystem: gomod
-    directory: "/"
+    directory: '/'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     ignore:
-      # Breaks backwards compatibility
-      - dependency-name: github.com/gravitational/ttlmap
       # Must be kept in-sync with libbpf
       - dependency-name: github.com/aquasecurity/libbpfgo
       # Forked/replaced dependencies
       - dependency-name: github.com/alecthomas/kingpin/v2
-      - dependency-name: github.com/coreos/go-oidc
       - dependency-name: github.com/go-mysql-org/go-mysql
       - dependency-name: github.com/gogo/protobuf
       - dependency-name: github.com/julienschmidt/httprouter
@@ -25,44 +22,36 @@ updates:
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - zmb3
-      - hugoShaka
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/api"
+    directory: '/api'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     open-pull-requests-limit: 20
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - zmb3
-      - hugoShaka
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/assets/aws"
+    directory: '/assets/aws'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     ignore:
       # Forked/replaced dependencies
       - dependency-name: github.com/alecthomas/kingpin/v2
@@ -70,43 +59,36 @@ updates:
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - tcsc
-      - zmb3
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/assets/backport"
+    directory: '/assets/backport'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     open-pull-requests-limit: 20
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - zmb3
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/build.assets/tooling"
+    directory: '/build.assets/tooling'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     ignore:
       # Forked/replaced dependencies
       - dependency-name: github.com/alecthomas/kingpin/v2
@@ -114,23 +96,19 @@ updates:
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - fheinecke
-      - rosstimothy
-      - zmb3
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/integrations/terraform"
+    directory: '/integrations/terraform'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     ignore:
       # breaks compatibility
       - dependency-name: github.com/hashicorp/terraform-plugin-framework
@@ -140,136 +118,156 @@ updates:
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - hugoShaka
-      - tigrato
-      - marcoandredinis
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
   - package-ecosystem: gomod
-    directory: "/integrations/event-handler"
+    directory: '/integrations/terraform-mwi'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     open-pull-requests-limit: 20
     groups:
       go:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - hugoShaka
-      - tigrato
-      - marcoandredinis
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
 
+  - package-ecosystem: gomod
+    directory: '/integrations/event-handler'
+    schedule:
+      interval: monthly
+      day: 'sunday'
+      time: '09:00' # 9am UTC
+    open-pull-requests-limit: 20
+    groups:
+      go:
+        update-types:
+          - 'minor'
+          - 'patch'
+    labels:
+      - 'dependencies'
+      - 'go'
+      - 'no-changelog'
+
+  - package-ecosystem: cargo
+    directory: '/'
+    schedule:
+      interval: monthly
+      day: 'sunday'
+      time: '09:00' # 9am UTC
+    open-pull-requests-limit: 20
+    groups:
+      rust:
+        update-types:
+          - 'minor'
+          - 'patch'
+    labels:
+      - 'dependencies'
+      - 'rust'
+      - 'no-changelog'
+
+  - package-ecosystem: cargo
+    directory: '/lib/srv/desktop/rdp/rdpclient'
+    schedule:
+      interval: monthly
+      day: 'sunday'
+      time: '09:00' # 9am UTC
+    open-pull-requests-limit: 20
+    groups:
+      rust:
+        update-types:
+          - 'minor'
+          - 'patch'
+    labels:
+      - 'dependencies'
+      - 'rust'
+      - 'no-changelog'
 
   - package-ecosystem: cargo
-    directory: "/"
+    directory: '/tool/fdpass-teleport'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     open-pull-requests-limit: 20
     groups:
       rust:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - zmb3
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "rust"
-      - "no-changelog"
+      - 'dependencies'
+      - 'rust'
+      - 'no-changelog'
 
   - package-ecosystem: cargo
-    directory: "/lib/srv/desktop/rdp/rdpclient"
+    directory: '/web/packages/shared/libs/ironrdp/Cargo.toml'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     open-pull-requests-limit: 20
     groups:
       rust:
         update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - rosstimothy
-      - zmb3
+          - 'minor'
+          - 'patch'
     labels:
-      - "dependencies"
-      - "rust"
-      - "no-changelog"
+      - 'dependencies'
+      - 'rust'
+      - 'no-changelog'
 
   - package-ecosystem: npm
-    directory: "/"
+    directory: '/'
     schedule:
       interval: monthly
-      day: "sunday"
-      time: "09:00" # 9am UTC
+      day: 'sunday'
+      time: '09:00' # 9am UTC
     labels:
-      - "dependencies"
-      - "ui"
-      - "no-changelog"
+      - 'dependencies'
+      - 'ui'
+      - 'no-changelog'
     groups:
       electron:
         patterns:
-        - "electron*"
+          - 'electron*'
       ui:
         update-types:
-          - "minor"
-          - "patch"
+          - 'minor'
+          - 'patch'
         exclude-patterns:
-          - "electron*"
+          - 'electron*'
     open-pull-requests-limit: 20
-    reviewers:
-      - avatus
-      - kimlisa
-      - rudream
-      - bl-nero
-      - gzdunek
-      - ravicious
-      - ryanclark
   - package-ecosystem: github-actions
-    directory: "/.github/workflows"
+    directory: '/.github/workflows'
     schedule:
       interval: monthly
       day: monday
-      time: "09:00"
-      timezone: "America/Los_Angeles"
-    reviewers:
-      - fheinecke
-      - camscale
+      time: '09:00'
+      timezone: 'America/Los_Angeles'
     labels:
-      - "dependencies"
-      - "github-actions"
-      - "no-changelog"
+      - 'dependencies'
+      - 'github-actions'
+      - 'no-changelog'
 
   - package-ecosystem: github-actions
-    directory: "/.github/actions"
+    directory: '/.github/actions'
     schedule:
       interval: monthly
       day: monday
-      time: "09:00"
-      timezone: "America/Los_Angeles"
-    reviewers:
-      - fheinecke
-      - camscale
+      time: '09:00'
+      timezone: 'America/Los_Angeles'
     labels:
-      - "dependencies"
-      - "github-actions"
-      - "no-changelog"
+      - 'dependencies'
+      - 'github-actions'
+      - 'no-changelog'
diff --git a/.github/workflows/assign.yaml b/.github/workflows/assign.yaml
index b7f12e5b692a1..8769ace69f8d2 100644
--- a/.github/workflows/assign.yaml
+++ b/.github/workflows/assign.yaml
@@ -39,7 +39,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index c93de290739b5..80187158bb814 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -37,7 +37,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/bloat.yaml b/.github/workflows/bloat.yaml
index 40903ba901b20..2afdc35697080 100644
--- a/.github/workflows/bloat.yaml
+++ b/.github/workflows/bloat.yaml
@@ -16,7 +16,7 @@ on:
 jobs:
   bloat_check:
     name: Bloat Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-4core
     outputs:
       base_stats_file: ${{ steps.build_base.outputs.base_stats_file }}
       current_build_dir: ${{ steps.build_branch.outputs.build_dir }}
@@ -41,7 +41,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
 
       - name: Setup base cache
         uses: actions/cache/restore@v3
@@ -93,7 +93,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
 
       - name: Build Binaries
         id: build_branch
diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
index 49715b555888a..3a0410d0d000f 100644
--- a/.github/workflows/build-macos.yaml
+++ b/.github/workflows/build-macos.yaml
@@ -19,7 +19,7 @@ jobs:
   build:
     name: Build on Mac OS
     if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
-    runs-on: macos-13-xlarge
+    runs-on: macos-15-xlarge
 
     permissions:
       contents: read
@@ -66,7 +66,7 @@ jobs:
         run: |
           rustup override set ${{ env.RUST_VERSION }}
 
-      - name: Install wasm-pack
+      - name: Install wasm-deps
         run: make ensure-wasm-deps
 
       - name: Build
diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index a65b0c034b4d8..e3b57a48386ba 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -29,7 +29,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 22d46fb8769dc..44aaa7dae62d1 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -47,7 +47,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/cla-assistant.yaml b/.github/workflows/cla-assistant.yaml
index 626361f3bdae6..fb8e9bc8a60ee 100644
--- a/.github/workflows/cla-assistant.yaml
+++ b/.github/workflows/cla-assistant.yaml
@@ -7,6 +7,11 @@ on:
     types:
       - opened
       - synchronize # Run on any diff changes to the PR (e.g. code updates)
+  # merge_group will allow this workflow to be triggered when in merge queue.
+  # The job will end up being skipped due to conditionals below. This will be considered a "Success" 
+  # for the required check as the workflow was triggered but the job was skipped due to conditionals
+  # See: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+  merge_group:
 # explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
 permissions:
   actions: read
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 0d743abffb9e7..0000000000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: "CodeQL"
-
-on:
-  schedule:
-    - cron: '0 13 * * *' # At 1:00 PM UTC every day
-  pull_request:
-    paths:
-      - '.github/workflows/codeql.yml'
-  # merge_group is intentionally excluded, because we don't require this workflow
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-22.04-16core
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'go', 'javascript' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        cache: false
-        go-version-file: go.mod
-      if: ${{ matrix.language == 'go' }}
-
-    - name: Initialize the CodeQL tools for scanning
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        queries: security-extended
-      timeout-minutes: 5
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
-      timeout-minutes: 30
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"
-      timeout-minutes: 10
diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml
deleted file mode 100644
index 6e9a1e061b750..0000000000000
--- a/.github/workflows/dependency-review.yaml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: Dependency Review
-
-on:
-  pull_request:
-  merge_group:
-
-jobs:
-  dependency-review:
-    uses: gravitational/shared-workflows/.github/workflows/dependency-review.yaml@main
-    permissions:
-      contents: read
-      pull-requests: write
-    with:
-      base-ref: >
-        ${{ 
-          github.event_name == 'pull_request' && github.event.pull_request.base.sha ||
-          github.event_name == 'merge_group' && github.event.merge_group.base_sha ||
-          'Invalid reference (workflow bug)'
-        }}
-      # 'GHSA-6xf3-5hp7-xqqg' is a false positive. That's an old Teleport Vuln,
-      # but because of the replace, the dependency cannot find the correct
-      # Teleport version.
-      allow-ghsas: 'GHSA-6xf3-5hp7-xqqg'
-      # IronRDP uses MIT/Apache-2.0 but slashes are not recognized by dependency review action
-      #
-      # @swc/core@1.11.24 uses Apache-2.0, but LicenseRef-scancode-unknown-license-reference is also
-      # detected.
-      # https://www.npmjs.com/package/@swc/core/v/1.11.24?activeTab=code
-      # https://scancode-licensedb.aboutcode.org/unknown-license-reference.html
-      #
-      # cookie-signature@1.2.2 uses MIT, but LicenseRef-scancode-unknown-license-reference is also
-      # detected.
-      # https://www.npmjs.com/package/cookie-signature/v/1.2.2?activeTab=code
-      allow-dependencies-licenses: >-
-        pkg:cargo/ironrdp-cliprdr,
-        pkg:cargo/ironrdp-core,
-        pkg:cargo/ironrdp-async,
-        pkg:cargo/ironrdp-connector,
-        pkg:cargo/ironrdp-displaycontrol,
-        pkg:cargo/ironrdp-dvc,
-        pkg:cargo/ironrdp-error,
-        pkg:cargo/ironrdp-graphics,
-        pkg:cargo/ironrdp-pdu,
-        pkg:cargo/ironrdp-rdpdr,
-        pkg:cargo/ironrdp-rdpsnd,
-        pkg:cargo/ironrdp-session,
-        pkg:cargo/ironrdp-svc,
-        pkg:cargo/ironrdp-tokio,
-        pkg:cargo/ironrdp-tls,
-        pkg:cargo/asn1-rs,
-        pkg:cargo/asn1-rs-derive,
-        pkg:cargo/asn1-rs-impl,
-        pkg:cargo/curve25519-dalek-derive,
-        pkg:cargo/der-parser,
-        pkg:cargo/icu_collections,
-        pkg:cargo/icu_locid,
-        pkg:cargo/icu_locid_transform,
-        pkg:cargo/icu_locid_transform_data,
-        pkg:cargo/icu_normalizer,
-        pkg:cargo/icu_normalizer_data,
-        pkg:cargo/icu_properties,
-        pkg:cargo/icu_properties_data,
-        pkg:cargo/icu_provider,
-        pkg:cargo/icu_provider_macros,
-        pkg:cargo/litemap,
-        pkg:cargo/ring,
-        pkg:cargo/sspi,
-        pkg:cargo/tokio-boring,
-        pkg:cargo/tokio-rustls,
-        pkg:cargo/writeable,
-        pkg:cargo/yoke,
-        pkg:cargo/yoke-derive,
-        pkg:cargo/zerofrom,
-        pkg:cargo/zerofrom-derive,
-        pkg:cargo/zerovec,
-        pkg:cargo/zerovec-derive,
-        pkg:npm/cspell/dict-en-common-misspellings,
-        pkg:npm/swc/core,
-        pkg:npm/cookie-signature,
-        pkg:npm/prettier
diff --git a/.github/workflows/dismiss.yaml b/.github/workflows/dismiss.yaml
index b595a7c7411bb..63d93f95ce4b8 100644
--- a/.github/workflows/dismiss.yaml
+++ b/.github/workflows/dismiss.yaml
@@ -43,7 +43,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/doc-tests.yaml b/.github/workflows/doc-tests.yaml
index ba6fd1ca041b9..b4011d4c5c6a7 100644
--- a/.github/workflows/doc-tests.yaml
+++ b/.github/workflows/doc-tests.yaml
@@ -69,37 +69,32 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: shared-workflows
+          ref: 6f388765b8ce993721502083c74cb9af1fc5658f 
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version: 'stable'
+          cache-dependency-path: shared-workflows/bot/go.sum
 
       - name: Ensure docs changes include redirects
         env:
           TOKEN: ${{ steps.generate_token.outputs.token }}
           REVIEWERS: ${{ secrets.reviewers }}
         run: cd shared-workflows/bot && go run main.go -workflow=docpaths -token="${TOKEN}" -teleport-path="${GITHUB_WORKSPACE}/teleport" -reviewers="${REVIEWERS}"
-      # Cache node_modules. Unlike the example in the actions/cache repo, this
-      # caches the node_modules directory instead of the yarn cache. This is
-      # because yarn needs to build fresh packages even when it copies files
-      # from the yarn cache into node_modules.
-      # See:
-      # https://github.com/actions/cache/blob/main/examples.md#node---yarn
-      - uses: actions/cache@v4
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
+
+      - name: Install Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          path: '${{ github.workspace }}/docs/node_modules'
-          key: ${{ runner.os }}-yarn-${{ hashFiles(format('{0}/docs/yarn.lock', github.workspace)) }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
+          node-version: 22
+          cache: 'yarn'
+          cache-dependency-path: '${{ github.workspace }}/docs/yarn.lock'
 
       - name: Install docs site dependencies
         working-directory: docs
-        if: ${{ steps.yarn-cache.outputs.cache-hit != 'true' }}
         # Prevent occasional `yarn install` executions that run indefinitely
         timeout-minutes: 10
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - name: Prepare docs site configuration
         working-directory: docs
diff --git a/.github/workflows/docs-amplify.yaml b/.github/workflows/docs-amplify.yaml
index 6eff40996d143..e5f285093038a 100644
--- a/.github/workflows/docs-amplify.yaml
+++ b/.github/workflows/docs-amplify.yaml
@@ -23,8 +23,8 @@ jobs:
         role-to-assume: ${{ vars.IAM_ROLE }}
 
     - name: Create Amplify preview environment
-      uses: gravitational/shared-workflows/tools/amplify-preview@tools/amplify-preview/v0.0.1
-      continue-on-error: true
+      uses: gravitational/shared-workflows/tools/amplify-preview@664e788d45a7f56935cf63094b4fb52a41b12015 # tools/amplify-preview/v0.0.2
+      id: amplify_preview
       with:
         app_ids: ${{ vars.AMPLIFY_APP_IDS }}
         create_branches: "true"
@@ -37,6 +37,7 @@ jobs:
         ERR_TITLE: Teleport Docs preview build failed
         ERR_MESSAGE: >-
           Please refer to the following documentation for help: https://www.notion.so/goteleport/How-to-Amplify-deployments-162fdd3830be8096ba72efa1a49ee7bc?pvs=4
+          Execution info: ${{ steps.amplify_preview.outputs.amplify_app_id }} ${{ steps.amplify_preview.outputs.amplify_branch_name }} ${{ steps.amplify_preview.outputs.amplify_job_id }}
       run: |
         echo ::error title=$ERR_TITLE::$ERR_MESSAGE
         exit 1
diff --git a/.github/workflows/flaky-tests.yaml b/.github/workflows/flaky-tests.yaml
index b513fcf170e86..68be7043815d6 100644
--- a/.github/workflows/flaky-tests.yaml
+++ b/.github/workflows/flaky-tests.yaml
@@ -70,7 +70,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
 
       - name: Find excluded tests
         id: find_excluded
@@ -79,7 +79,7 @@ jobs:
       - name: Run base difftest
         uses: ./.github/actions/difftest
         with:
-          flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" -e "integrations/operator/**/*" -e "integrations/terraform/**/*" -e "integrations/event-handler/**/*" -e "tool/tsh/**/*" -e "integration/**/*" -e "build.assets/**/*" -e "lib/auth/webauthncli/**/*" -e "lib/auth/touchid/**/*" -e "api/**/*" -e "examples/teleport-usage/**/*" -e "integrations/access/**" -e "integrations/lib/**" -e "integrations/lib/backoff/backoff_test.go" -e "e2e/**/*"
+          flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" -e "integrations/operator/**/*" -e "integrations/terraform/**/*" -e "integrations/terraform-mwi/**/*" -e "integrations/event-handler/**/*" -e "tool/tsh/**/*" -e "integration/**/*" -e "build.assets/**/*" -e "lib/auth/webauthncli/**/*" -e "lib/auth/touchid/**/*" -e "api/**/*" -e "examples/teleport-usage/**/*" -e "integrations/access/**" -e "integrations/lib/**" -e "integrations/lib/backoff/backoff_test.go" -e "e2e/**/*"
           target: test-go-unit
 
       - name: Run touch-id difftest
diff --git a/.github/workflows/kube-integration-tests-non-root.yaml b/.github/workflows/kube-integration-tests-non-root.yaml
index 95efe75f701d8..b7b81729eeb4a 100644
--- a/.github/workflows/kube-integration-tests-non-root.yaml
+++ b/.github/workflows/kube-integration-tests-non-root.yaml
@@ -92,33 +92,13 @@ jobs:
 
       - name: Build Alpine image with webserver
         run: |
-
-          export SHORT_VERSION=${ALPINE_VERSION%.*}
-
-          # download the alpine image
-          # store the files in the fixtures/alpine directory
+          # create the alpine image in the fixtures/alpine directory
           # to avoid passing all the repository files to the docker build context.
           cd ./fixtures/alpine
-
-          # download alpine minirootfs and signature
-          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz
-          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.asc
-          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.sha256
-
-          # verify the checksum
-          sha256sum -c alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.sha256
-
-          # verify the signature
-          gpg --import  ./alpine-ncopa.at.alpinelinux.org.asc
-          gpg --verify ./alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.asc ./alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz
-
-          # build the webserver
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./webserver ./webserver.go
-
-          docker build -t alpine-webserver:v1 --build-arg=ALPINE_VERSION=$ALPINE_VERSION -f ./Dockerfile .
+          make SHORT_VERSION=${ALPINE_VERSION%.*} ALPINE_VERSION=${ALPINE_VERSION} build-image
 
           # load the image into the kind cluster
-          kind load docker-image alpine-webserver:v1
+          make load-image
 
           cd - 
 
diff --git a/.github/workflows/label.yaml b/.github/workflows/label.yaml
index b098f8132819b..cb41586fcfcad 100644
--- a/.github/workflows/label.yaml
+++ b/.github/workflows/label.yaml
@@ -39,7 +39,7 @@ jobs:
         with:
           repository: gravitational/shared-workflows
           path: .github/shared-workflows
-          ref: main
+          ref: 664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
       - name: Installing Go
         uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/lint-ui-bypass.yaml b/.github/workflows/lint-ui-bypass.yaml
deleted file mode 100644
index 8637f6ebd08d5..0000000000000
--- a/.github/workflows/lint-ui-bypass.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-# This workflow is required to ensure that required Github check passes even if
-# the actual "Lint UI" workflow skipped due to path filtering. Otherwise
-# it will stay forever pending.
-#
-# See "Handling skipped but required checks" for more info:
-#
-# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
-#
-# Note both workflows must have the same name.
-
-name: Lint UI
-run-name: Lint UI - ${{ github.run_id }} - @${{ github.actor }}
-
-on:
-  pull_request:
-    paths-ignore:
-      - 'web/**'
-      - 'gen/proto/js/**'
-      - 'gen/proto/ts/**'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - 'tsconfig.json'
-      - 'tsconfig.node.json'
-  merge_group:
-    paths-ignore:
-      - 'web/**'
-      - 'gen/proto/js/**'
-      - 'gen/proto/ts/**'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - 'tsconfig.json'
-      - 'tsconfig.node.json'
-
-jobs:
-  lint:
-    name: Prettier, ESLint, & TSC
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: none
-
-    steps:
-      - run: 'echo "No changes to verify"'
diff --git a/.github/workflows/lint-ui.yaml b/.github/workflows/lint-ui.yaml
deleted file mode 100644
index 50022e8e5026b..0000000000000
--- a/.github/workflows/lint-ui.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Lint UI
-run-name: Lint UI - ${{ github.run_id }} - @${{ github.actor }}
-
-on:
-  pull_request:
-    paths:
-      - 'web/**'
-      - 'gen/proto/js/**'
-      - 'gen/proto/ts/**'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - 'tsconfig.json'
-      - 'tsconfig.node.json'
-  merge_group:
-    paths:
-      - 'web/**'
-      - 'gen/proto/js/**'
-      - 'gen/proto/ts/**'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - 'tsconfig.json'
-      - 'tsconfig.node.json'
-
-jobs:
-  lint:
-    name: Prettier, ESLint, & TSC
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/gravitational/teleport-buildbox:teleport18
-    steps:
-      - name: Checkout OSS Teleport
-        uses: actions/checkout@v4
-
-      - name: Print Node version
-        run: |
-          node --version
-
-      - name: Install JS dependencies
-        run: |
-          pnpm install --frozen-lockfile
-
-      - name: Build WASM
-        run: pnpm build-wasm
-
-      - name: Run Type Check
-        run: pnpm type-check
-
-      - name: Run lint
-        run: pnpm lint
-
-      - name: Run Storybook smoke test
-        run: pnpm storybook-smoke-test
-
-      - name: Lint licenses
-        run: make lint-license
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 540fd1a522feb..949e70f4ce744 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -1,10 +1,10 @@
-name: Lint (Go)
-run-name: Lint (Go and Rust)
+name: Lint
 on:
   pull_request:
   merge_group:
 env:
   GOFLAGS: '-buildvcs=false'
+  GOEXPERIMENT: 'synctest'
 
 jobs:
   changes:
@@ -17,6 +17,7 @@ jobs:
       has_rust: ${{ steps.changes.outputs.has_rust }}
       has_proto: ${{ steps.changes.outputs.has_proto }}
       has_rfd: ${{ steps.changes.outputs.has_rfd }}
+      has_ui: ${{ steps.changes.outputs.has_ui }}
     steps:
       - name: Checkout
         if: ${{ github.event_name == 'merge_group' }}
@@ -68,9 +69,18 @@ jobs:
               # rendered doc changes
               - 'docs/pages/admin-guides/**'
               - 'docs/pages/enroll-resources/**'
-              - 'docs/pages/reference/operator-resources/**'
-              - 'docs/pages/reference/terraform-provider/**'
+              - 'docs/pages/reference/infrastructure-as-code/operator-resources/**'
+              - 'docs/pages/reference/infrastructure-as-code/terraform-provider/**'
               - 'examples/chart/teleport-cluster/charts/teleport-operator/operator-crds'
+            has_ui:
+              - '.github/workflows/lint.yaml'
+              - 'web/**'
+              - 'gen/proto/js/**'
+              - 'gen/proto/ts/**'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'tsconfig.json'
+              - 'tsconfig.node.json'
 
   lint-go:
     name: Lint (Go)
@@ -155,6 +165,9 @@ jobs:
       - name: Check if go generated files are up to date
         run: make go-generate-up-to-date
 
+      - name: Check if test symbols are included in binaries
+        run: make lint-test-symbols
+
   lint-rust:
     name: Lint (Rust)
     runs-on: ubuntu-22.04
@@ -229,6 +242,10 @@ jobs:
         # We have to add the current directory as a safe directory or else git commands will not work as expected.
         run: git config --global --add safe.directory $(realpath .) && make protos-up-to-date/host
 
+      - name: Check if resource reference docs are up to date
+        # We have to add the current directory as a safe directory or else git commands will not work as expected.
+        run: git config --global --add safe.directory $(realpath .) && make resource-docs-up-to-date
+
       - name: Check if Operator CRDs are up to date
         # We have to add the current directory as a safe directory or else git commands will not work as expected.
         run: git config --global --add safe.directory $(realpath .) && make crds-up-to-date
@@ -236,7 +253,12 @@ jobs:
       - name: Check if Terraform resources are up to date
         # We have to add the current directory as a safe directory or else git commands will not work as expected.
         # The protoc-gen-terraform version must match the version in integrations/terraform/Makefile
-        run: git config --global --add safe.directory $(realpath .) && go install github.com/gravitational/protoc-gen-terraform/v3@v3.0.2 && make terraform-resources-up-to-date
+        run: git config --global --add safe.directory $(realpath .) && go install github.com/gravitational/protoc-gen-terraform/v3@v3.0.3 && make terraform-resources-up-to-date
+
+      - name: Check if the Access Monitoring reference is up to date
+        # We have to add the current directory as a safe directory or else git commands will not work as expected.
+        # The protoc-gen-terraform version must match the version in integrations/terraform/Makefile
+        run: git config --global --add safe.directory $(realpath .) && make access-monitoring-reference-up-to-date
 
   lint-rfd:
     name: Lint (RFD)
@@ -248,7 +270,7 @@ jobs:
       contents: read
 
     container:
-      image: ghcr.io/gravitational/teleport-buildbox:teleport17
+      image: ghcr.io/gravitational/teleport-buildbox:teleport18
 
     steps:
       - name: Checkout
@@ -259,3 +281,54 @@ jobs:
 
       - name: Check spelling
         run: pnpm cspell -c ./rfd/cspell.json rfd
+
+  lint-ui:
+    name: Prettier, ESLint, & TSC
+    needs: changes
+    if: ${{ !startsWith(github.head_ref, 'dependabot/') && needs.changes.outputs.has_ui == 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    container:
+      image: ghcr.io/gravitational/teleport-buildbox:teleport18
+
+    steps:
+      - name: Checkout OSS Teleport
+        uses: actions/checkout@v4
+
+      - name: Print Node version
+        run: |
+          node --version
+
+      - name: Install JS dependencies
+        run: |
+          pnpm install --frozen-lockfile
+
+      - name: Install WASM deps
+        run: make ensure-wasm-deps
+
+      - name: Build WASM
+        run: pnpm build-wasm
+
+      - name: Run Type Check
+        run: pnpm type-check
+
+      - name: Run lint
+        run: pnpm lint
+
+      - name: Run Storybook smoke test
+        run: pnpm storybook-smoke-test
+
+      - name: Lint licenses
+        run: make lint-license
+
+      - name: Check icons
+        # We have to add the current directory as a safe directory or else git commands will not work as expected.
+        run: git config --global --add safe.directory $(realpath .) && make icons-up-to-date
+
+      - name: Check audit event reference docs
+        # We have to add the current directory as a safe directory or else git commands will not work as expected.
+        run: git config --global --add safe.directory $(realpath .) && make audit-event-reference-up-to-date
+
diff --git a/.github/workflows/terraform-lint.yaml b/.github/workflows/terraform-lint.yaml
index 090212fb1e629..0daa7025c5085 100644
--- a/.github/workflows/terraform-lint.yaml
+++ b/.github/workflows/terraform-lint.yaml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   terraform-lint:
-    uses: gravitational/shared-workflows/.github/workflows/terraform-lint.yaml@main
+    uses: gravitational/shared-workflows/.github/workflows/terraform-lint.yaml@664e788d45a7f56935cf63094b4fb52a41b12015 # workflows/v0.0.2
     with:
       # TODO: Fix Terraform linting issues and stop using force to pass the job.
       tflint_force: true
@@ -24,4 +24,3 @@ jobs:
       actions: read
       contents: read
       pull-requests: write
-      security-events: write
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
deleted file mode 100644
index 7b207844a5850..0000000000000
--- a/.github/workflows/trivy.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Trivy
-
-on:
-  pull_request:
-  merge_group:
-
-jobs:
-  trivy:
-    uses: gravitational/shared-workflows/.github/workflows/trivy.yaml@main
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
diff --git a/.github/workflows/unit-tests-integrations.yaml b/.github/workflows/unit-tests-integrations.yaml
index a8c901c5de347..60d0dd3cd55b6 100644
--- a/.github/workflows/unit-tests-integrations.yaml
+++ b/.github/workflows/unit-tests-integrations.yaml
@@ -70,6 +70,10 @@ jobs:
         run: make test-terraform-provider
         timeout-minutes: 15
 
+      - name: Run terraform provider OSS tests
+        run: make test-terraform-provider-mwi
+        timeout-minutes: 15
+
       - name: Run integrations event-handler tests
         run: make test-event-handler-integrations
         timeout-minutes: 10
diff --git a/.gitignore b/.gitignore
index ebec5a42720af..485adc0f6faa7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@ default.etcd
 out
 build
 !/web/packages/build
+/web/packages/shared/libs/ironrdp/pkg/**
 *.o
 *.a
 *.so
@@ -118,3 +119,7 @@ msgfile/
 
 # Dockerized builds generate .pnpm-store in the root, so ignore it
 .pnpm-store
+
+# Artifacts generated by gotestsum --jsonfile=unit-tests-foo.json --junitfile=unit-tests-foo.xml
+unit-tests*.xml
+unit-tests*.json
diff --git a/.golangci.yml b/.golangci.yml
index 143943ac7fb8d..67f0b78a5fab3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -94,7 +94,6 @@ linters:
             - '!**lib/services/compare.go'
             - '!**/lib/services/local/access_list.go'
             - '!**/lib/services/local/users.go'
-            - '!**/lib/services/server.go'
             - '!**/lib/services/user.go'
           deny:
             - pkg: github.com/google/go-cmp/cmp
@@ -113,6 +112,14 @@ linters:
           deny:
             - pkg: github.com/gravitational/teleport/integration
               desc: integration test should not be imported outside of intergation tests
+            - pkg: github.com/gravitational/teleport/lib/utils/mcptest
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/testcontainers/testcontainers-go
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/testcontainers/testcontainers-go/modules/postgres
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/testcontainers/testcontainers-go/modules/mysql
+              desc: testing packages should not be imported outside of _test.go files
         logging:
           deny:
             - pkg: github.com/sirupsen/logrus
@@ -159,12 +166,70 @@ linters:
               desc: use "github.com/gravitational/teleport/lib/msgraph" instead
             - pkg: github.com/cloudflare/cfssl
               desc: use "crypto" or "x/crypto" instead
+            - pkg: github.com/gogo/protobuf/jsonpb
+              desc: gogoproto jsonpb has inconsistent interactions with any
+                message that directly or indirectly makes use of
+                gogoproto.casttype, and will happily violate the protobuf json
+                encoding spec in those situations. It should only be used for
+                existing marshaling and unmarshaling that can't easily be
+                migrated away from jsonpb, but it should not be used by new
+                code. If you need to encode and decode a gogoproto-generated
+                message in protobuf json, use
+                google.golang.org/protobuf/encoding/protojson together with
+                google.golang.org/protobuf/protoadapt instead, or, better yet,
+                see if you can move the code generation for that message to the
+                modern protoc-gen-go.
         oidc:
           deny:
             - pkg: github.com/coreos/go-oidc
               desc: 'github.com/zitadel/oidc/v3 should be used instead'
             - pkg: github.com/zitadel/oidc$
               desc: 'github.com/zitadel/oidc/v3 should be used instead'
+        synctest:
+          deny:
+            - pkg: testing/synctest
+              desc: 'use "github.com/gravitational/teleport/lib/utils/testutils/synctest" instead'
+        test_packages:
+          files:
+            - '!$test'
+            - '!**/integrations/operator/controllers/resources/testlib/**.go'
+            - '!**/e/lib/aws/identitycenter/test/**'
+            - '!**/e/lib/devicetrust/testenv/**'
+            - '!**/e/lib/jamf/testenv/**'
+            - '!**/e/lib/intune/testenv/**'
+            - '!**/e/lib/idp/saml/testenv/**'
+            - '!**/e/lib/operatortest/**'
+            - '!**/e/tests/**'
+            - '!**/integration/db/fixture.go'
+            - '!**/integration/helpers/**'
+            - '!**/integrations/lib/testing/**'
+          deny:
+            - pkg: github.com/gravitational/teleport/e/lib/aws/identitycenter/test
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/e/lib/idp/operatortest
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/events/tests
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/teleterm/gatewaytest
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/utils/testutils
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/test
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/tool/teleport/testenv
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/srv/db/redis/testing
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/srv/db/spanner/testing
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/modules/modulestest
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest
+              desc: testing packages should not be imported outside of _test.go files
+            - pkg: github.com/gravitational/teleport/lib/auth/authtest
+              desc: testing packages should not be imported outside of _test.go files
         testify:
           files:
             - '!$test'
@@ -174,21 +239,14 @@ linters:
             - '!**/e/lib/idp/saml/testenv/**'
             - '!**/e/lib/operatortest/**'
             - '!**/e/tests/**'
-            - '!**/lib/automaticupgrades/basichttp/servermock.go'
             - '!**/lib/auth/helpers.go'
             - '!**/lib/auth/keystore/testhelpers.go'
-            - '!**/lib/auth/test/**'
             - '!**/lib/backend/test/**'
-            - '!**/lib/events/athena/test.go'
             - '!**/lib/events/test/**'
-            - '!**/lib/kube/proxy/utils_testing.go'
             - '!**/lib/services/suite/**'
-            - '!**/lib/srv/mock.go'
-            - '!**/lib/srv/db/redis/test.go'
-            - '!**/lib/tbot/workloadidentity/workloadattest/podman/test_server.go'
             - '!**/lib/tbot/workloadidentity/workloadattest/sigstore/sigstoretest/sigstoretest.go'
             - '!**/lib/teleterm/gatewaytest/**'
-            - '!**/lib/utils/testhelpers.go'
+            - '!**/lib/utils/mcptest/**'
             - '!**/lib/utils/testutils/**'
             - '!**/integration/appaccess/fixtures.go'
             - '!**/integration/appaccess/jwt.go'
@@ -212,7 +270,7 @@ linters:
             - '!**/integrations/lib/testing/integration/authhelper.go'
             - '!**/integrations/lib/testing/integration/suite.go'
             - '!**/integrations/operator/controllers/resources/testlib/**'
-            - '!**/tool/teleport/testenv/**'
+            - '!**/e/lib/intune/testenv/**'
           deny:
             - pkg: github.com/stretchr/testify
               desc: testify should not be imported outside of test code
@@ -226,6 +284,7 @@ linters:
             - '!**/e/lib/devicetrust/storage/storage.go'
             - '!**/e/lib/idp/saml/testenv/**'
             - '!**/e/lib/jamf/testenv/**'
+            - '!**/e/lib/intune/testenv/**'
             - '!**/e/lib/okta/api/oktaapitest/**'
             - '!**/e/lib/operatortest/**'
             - '!**/e/tests/**'
@@ -234,30 +293,23 @@ linters:
             - '!**/integrations/access/msteams/testlib/**'
             - '!**/integrations/access/slack/testlib/**'
             - '!**/integrations/operator/controllers/resources/testlib/**'
+            - '!**/lib/auth/authtest/**'
             - '!**/lib/auth/helpers.go'
             - '!**/lib/auth/keystore/testhelpers.go'
-            - '!**/lib/auth/test/**'
-            - '!**/lib/automaticupgrades/basichttp/servermock.go'
             - '!**/lib/backend/test/**'
             - '!**/lib/cryptosuites/precompute.go'
             - '!**/lib/cryptosuites/internal/rsa/rsa.go'
             - '!**/lib/events/test/**'
-            - '!**/lib/events/athena/test.go'
-            - '!**/lib/fixtures/**'
-            - '!**/lib/kube/proxy/utils_testing.go'
+            - '!**/lib/modules/modulestest/**'
             - '!**/lib/modules/test.go'
             - '!**/lib/service/service.go'
             - '!**/lib/services/local/users.go'
             - '!**/lib/services/suite/**'
-            - '!**/lib/srv/mock.go'
-            - '!**/lib/srv/db/redis/test.go'
-            - '!**/lib/tbot/workloadidentity/workloadattest/podman/test_server.go'
             - '!**/lib/tbot/workloadidentity/workloadattest/sigstore/sigstoretest/sigstoretest.go'
             - '!**/lib/teleterm/gatewaytest/**'
             - '!**/lib/utils/cli.go'
-            - '!**/lib/utils/testhelpers.go'
+            - '!**/lib/utils/mcptest/**'
             - '!**/lib/utils/testutils/**'
-            - '!**/tool/teleport/testenv/**'
           deny:
             - pkg: testing
               desc: testing should not be imported outside of tests
@@ -280,7 +332,7 @@ linters:
         - pattern: ^protojson\.Unmarshal$
           msg: use protojson.UnmarshalOptions and consider enabling DiscardUnknown
         - pattern: ^jsonpb\.(?:Unmarshal|UnmarshalString|UnmarshalNext)$
-          msg: use jsonpb.Unmarshaler and consider enabling AllowUnknownFields
+          msg: use protojson if possible, or use jsonpb.Unmarshaler and consider enabling AllowUnknownFields
     misspell:
       locale: US
     nolintlint:
diff --git a/.npmrc b/.npmrc
index 98799a6a4c549..70ef8264dad13 100644
--- a/.npmrc
+++ b/.npmrc
@@ -3,13 +3,3 @@
 update-notifier=false
 # ESLint editor integrations expect ESLint's binary to be in the root node_modules.
 public-hoist-pattern[]=eslint
-# pnpm v10.3.0+ ships with node-gyp@11.1.0. That version of node-gyp has a bug which prevents
-# node-pty, one of Connect deps, from being built on Windows (https://github.com/nodejs/node-gyp/issues/3126).
-#
-# To work around this, we install node-gyp@11.0.0 as a dev dep and then tell node-pty through the below
-# config option to use node-gyp from our node_modules rather than the one bundled with pnpm.
-#
-# During pnpm install, the script is executed from a directory such as
-# <repo root>/node_modules/.pnpm/node-pty@1.1.0-beta14/node_modules/node-pty
-# so we escape five directories and then give a path to node-gyp.js.
-node_gyp=../../../../../node_modules/node-gyp/bin/node-gyp.js
diff --git a/BUILD_macos.md b/BUILD_macos.md
index c1bfd6916f88e..301a0220912d8 100644
--- a/BUILD_macos.md
+++ b/BUILD_macos.md
@@ -81,8 +81,6 @@ PRs with corrections and updates are welcome!
   * `brew install node corepack`
   * `corepack enable pnpm`
   * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-  * The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required:
-    `curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh`
 
 ##### Local Tests Dependencies
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4db7fc04ce5f1..037fc667cc5a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,948 @@
 # Changelog
 
-## 18.0.0 (xx/xx/xx)
+## 18.6.2 (12/26/25)
+
+This is a private security release. Changelog will be publicly announced in a later version.
+
+## 18.6.1 (12/24/25)
+
+* Fixed an issue preventing text editors in the Web UI from allowing edits. [#62488](https://github.com/gravitational/teleport/pull/62488)
+* Acking a cluster alert no longer requires the create permission. [#62468](https://github.com/gravitational/teleport/pull/62468)
+* Fixed service health reason formatting for bot instances in the Web UI. [#62328](https://github.com/gravitational/teleport/pull/62328)
+* Fixed an issue causing a ref type of "any" to be added when editing GitHub or Gitlab join tokens in the Web UI. [#62487](https://github.com/gravitational/teleport/pull/62487)
+
+## 18.6.0 (12/22/25)
+
+### Identifier-first login enhancements
+Teleport now automatically passes the username to the identifier provider when performing Identifier-first login with OIDC or SAML IdPs.
+
+### GitHub Actions Kubernetes Wizard
+Teleport now ships with a new guided flow for setting up GitHub Actions workflows that connects to Teleport-protected Kubernetes clusters without secrets.
+
+### Other changes and improvements
+
+* Fixed unspecified proxy address breaking moderated SFTP when mixing IPv4 and IPv6. [#62296](https://github.com/gravitational/teleport/pull/62296)
+* Added full configuration file for `teleport-plugin-event-handler` helm chart. [#62280](https://github.com/gravitational/teleport/pull/62280)
+* Added full environment variable configuration for event handler CLI. [#62280](https://github.com/gravitational/teleport/pull/62280)
+* Added support for extraArgs/extraEnv/extraLabels patterns for `teleport-plugin-event-handler` helm chart. [#62266](https://github.com/gravitational/teleport/pull/62266)
+* Fixed issue where AltGr key combinations did not work correctly in remote desktop sessions. [#62198](https://github.com/gravitational/teleport/pull/62198)
+* Added `annotations` support for `teleport-plugin-event-handler` helm chart. [#62188](https://github.com/gravitational/teleport/pull/62188)
+* Added a new global configuration section auth_connection_config allowing users to configure the backoff behavior for Proxy and Agent instances connecting to the Auth Service. [#62139](https://github.com/gravitational/teleport/pull/62139)
+* Fixed a potential SSRF vulnerability in the Azure join method implementation. [#62406](https://github.com/gravitational/teleport/pull/62406)
+* Support for v8 roles has been added to the Terraform provider. [#62380](https://github.com/gravitational/teleport/pull/62380)
+* Added support for selecting Kube agents as Managed Updates v2 canaries. Important: the default update group is corrected to "default" from "stable/cloud". [#62211](https://github.com/gravitational/teleport/pull/62211)
+
+## 18.5.1 (12/12/25)
+
+* Fixed Teleport instances running the Auth Service sometimes not becoming ready during initialization. [#62194](https://github.com/gravitational/teleport/pull/62194)
+* Fixed an Auth Service bug causing the event handler to miss up to 1 event every 5 minutes when storing audit events in S3. [#62150](https://github.com/gravitational/teleport/pull/62150)
+* Fixed bug where event handler dies on malformed session events. [#62141](https://github.com/gravitational/teleport/pull/62141)
+* Updated event handler to ingest missing session recordings at twice the `concurrency` instead of only 10 sessions at a time. [#62141](https://github.com/gravitational/teleport/pull/62141)
+* Changed "tsh --mfa-mode=cross-platform" to favor security keys on current Windows versions. [#62134](https://github.com/gravitational/teleport/pull/62134)
+* Fixed "the client connection is closing" error happening under certain conditions in Teleport Connect when connecting to resources with per-session MFA enabled. [#62127](https://github.com/gravitational/teleport/pull/62127)
+* Improved detail of error messages for `identity` service in `tbot`. [#62120](https://github.com/gravitational/teleport/pull/62120)
+* Teleport Connect now supports expanding `~/` home-directory paths in the configuration file. [#62104](https://github.com/gravitational/teleport/pull/62104)
+* Added support for --format flag for `tsh request search`. [#62099](https://github.com/gravitational/teleport/pull/62099)
+* Fixed bug where event handler `types` filter is ignored for Teleport clients using Athena storage backend. [#62082](https://github.com/gravitational/teleport/pull/62082)
+* Fixed intermittent issues with VNet on Windows when other NRPT rules from GPOs are present under `HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`. [#62052](https://github.com/gravitational/teleport/pull/62052)
+* Added Terraform provider support for teleport_integration resources. [#62040](https://github.com/gravitational/teleport/pull/62040)
+* DiscoveryConfig resources can now be managed via the Teleport Terraform Provider. [#62034](https://github.com/gravitational/teleport/pull/62034)
+* Reduced memory consumption of the Application service. [#62014](https://github.com/gravitational/teleport/pull/62014)
+* Added support for listing application session recordings in `tsh recording ls` and the Web UI. [#62010](https://github.com/gravitational/teleport/pull/62010)
+* Fixed a Web UI issue where the copy button for the session ID did not work for non-interactive session recordings. [#62010](https://github.com/gravitational/teleport/pull/62010)
+* Prevented stuck `teleport-cluster` Helm chart rollouts in small Kubernetes clusters. Removed resource requests from configuration check hooks. [#62003](https://github.com/gravitational/teleport/pull/62003)
+* Fixed static keypair creation in `tbot keypair create` when the `--static-key-path` flag is used. [#61947](https://github.com/gravitational/teleport/pull/61947)
+* Re-enabled MySQL database health checks. MySQL health checks will now authenticate to the database as a user, rather than TCP dialing and closing the connection, to prevent MySQL from automatically blocking the Teleport database service instance host. The health check user name default is "teleport-healthchecker". [#61942](https://github.com/gravitational/teleport/pull/61942)
+* Added support for templating `secret_labels`, and the `{{.Labels}}` template variable, to tbot's `kubernetes/argo-cd` output. [#61876](https://github.com/gravitational/teleport/pull/61876)
+
+Enterprise:
+* Updated AWS Identity Center integration sign-in start URL format to support AWS GovCloud accounts.
+* Fix a potential race where Okta assignments may never be cleaned up if the Okta integration is down while the assignment expires.
+* Created a dedicated Access Automations feature page within the Web UI.
+* Entra ID directory reconciler now overwrites user accounts created by the referenced SAML Auth Connector.
+
+## 18.5.0 (12/04/25)
+
+### Kubernetes support for Relay Service
+The relay service now facilitates Kubernetes connections.
+
+### Shared state between tsh and Teleport Connect
+Teleport Connect and tsh now share the same local state. Logins from one app will automatically be reflected in the other.
+
+### SCIM PATCH support in SailPoint integration
+Teleport SCIM server now natively supports PATCH operations to improve reliability of bulk SCIM operations in integrations like SailPoint.
+
+### Other changes and improvements
+
+* Updated Go to 1.24.11. [#61953](https://github.com/gravitational/teleport/pull/61953)
+* Added support for discovering EC2 instances in all regions, without enumerating them. Requires access to `account.ListRegions` in the IAM Role assumed by the Discovery Service. [#61924](https://github.com/gravitational/teleport/pull/61924)
+* Fixed a bug where JWT-SVID timestamp claims would be represented using scientific notation. [#61921](https://github.com/gravitational/teleport/pull/61921)
+* Fixed "SSH cert not found" errors in Teleport Connect. [#61846](https://github.com/gravitational/teleport/pull/61846)
+* Added support for authenticating Azure resource discovery using Azure OIDC integrations. [#61830](https://github.com/gravitational/teleport/pull/61830)
+* Fixed a bug in Proxy recording mode where Teleport Node sessions would result in duplicate audit events with a different session ID. [#61246](https://github.com/gravitational/teleport/pull/61246)
+* Tuned teleport-cluster, teleport-kube-agent, and teleport-relay Helm charts to reduce the probability of Teleport exceeding its memory limits and being OOM-Killed. GOMEMLIMIT defaults to 90% of the configured memory limits.
+
+Enterprise:
+* Added support for AWS Account name and ID labels (`teleport.dev/account-id`, `teleport.dev/account-name`) on AWS Identity Center resources (`aws_ic_account_assignment` and `aws_ic_account`). These labels improve compatibility with Access Monitoring Rules, allowing users to more easily target and audit AWS IC accounts.
+* Updated the Access Automation Rules dialog to display rules in a paginated view.
+
+## 18.4.2 (12/01/25)
+
+* Fixed a bug causing high memory consumption in the Teleport Auth Service when clients were listing large resources. [#61849](https://github.com/gravitational/teleport/pull/61849)
+* Prevent data races when terminating interactive Kubernetes sessions. [#61818](https://github.com/gravitational/teleport/pull/61818)
+* Fixed `tsh db connect` failing to connect to databases using separate ports configuration (non-TLS routing mode). [#61812](https://github.com/gravitational/teleport/pull/61812)
+* Fixed a bug where Kubernetes App Discovery `poll_interval` is not set correctly. [#61791](https://github.com/gravitational/teleport/pull/61791)
+* Fixed an issue that caused a failed upload of an encrypted session recording to block other recordings from uploading. [#61774](https://github.com/gravitational/teleport/pull/61774)
+* Fixed relative path evaluation for SFTP in proxy recording mode. [#61760](https://github.com/gravitational/teleport/pull/61760)
+* Fixed `tsh kube ls` showing deleted clusters. [#61742](https://github.com/gravitational/teleport/pull/61742)
+* Fixed workload identity templating to support certain numeric values that previously gave a "expression did not evaluate to a string" error. [#61738](https://github.com/gravitational/teleport/pull/61738)
+* Added User Details view to Web UI. [#61737](https://github.com/gravitational/teleport/pull/61737)
+* Added --roles flag for tsh request search, allowing users to list all requestable roles. This flag is mutually exclusive with --kind. [#61699](https://github.com/gravitational/teleport/pull/61699)
+* Fixed EC2 SSM Document set up script used in Enroll New Resource. [#61673](https://github.com/gravitational/teleport/pull/61673)
+* Fixed AWS Console access when using AWS IAM Roles Anywhere or AWS OIDC integrations, when IP Pinning is enabled. [#61654](https://github.com/gravitational/teleport/pull/61654)
+* Fixed "invalid name syntax" connection error for PostgreSQL auto-provisioned users with email usernames. [#61631](https://github.com/gravitational/teleport/pull/61631)
+* Auth readiness tuned to wait for cache initialization. [#61620](https://github.com/gravitational/teleport/pull/61620)
+* Added ability to update existing Azure OIDC integration with `tctl`. [#61592](https://github.com/gravitational/teleport/pull/61592)
+
+Enterprise:
+* Added Entra directory sync metrics.
+* Improved the initial EntraID user and group synchronization time, reducing the time required for the first full sync.
+* Prevented Trivy from reporting false positives when scanning the Teleport binaries.
+
+## 18.4.1 (11/20/25)
+
+* Fixed a bug that prevented searching audit log events in the web UI when using Athena audit storage. [#61603](https://github.com/gravitational/teleport/pull/61603)
+* Prevented Trivy from reporting false positives when scanning the Teleport binaries. [#61539](https://github.com/gravitational/teleport/pull/61539)
+* Added support for `tsh logout --proxy` (or `TELEPORT_PROXY` set) to work without `--user` flag when one identity exists. [#61404](https://github.com/gravitational/teleport/pull/61404)
+* Fixed web upload/download failure behind load balancers when web listen address is unspecified. [#61393](https://github.com/gravitational/teleport/pull/61393)
+* Fixed corrupted private keys breaking tsh. [#61388](https://github.com/gravitational/teleport/pull/61388)
+* Resource names are now properly validated for AWS Roles Anywhere integration `Generate Command`. [#61385](https://github.com/gravitational/teleport/pull/61385)
+* Added caches to reduce Active Directory user SID lookups and TLS certificate requests. [#61317](https://github.com/gravitational/teleport/pull/61317)
+* GOAWAY errors received from Kubernetes API Servers configured with a non-zero --goaway-chance are now forward to clients to be retried. [#61256](https://github.com/gravitational/teleport/pull/61256)
+* Added support for creating and managing scoped tokens using `tctl scoped tokens add/ls/rm`. SSH nodes can now join a cluster within a particular scope by joining with a scoped token. [#60758](https://github.com/gravitational/teleport/pull/60758)
+
+Enterprise:
+* Removed sync of the model identifier from Intune to avoid mismatches between the identifier reported by Intune vs Teleport clients.
+* Added support for Jamf's /v2/computers-inventory API (addresses Jamf's deprecation of /v1/computers-inventory).
+* Updated the AWS Identity Center resource synchronizer to handle AWS Account name changes more gracefully.
+* Added audit events in response to SCIM provisioning requests.
+
+## 18.4.0 (11/13/25)
+
+### Streamable-HTTP and SSE support for MCP Zero-Trust Access
+MCP Zero-Trust Access users are now able to secure and audit connections to MCP servers that use HTTP-based transport protocols in addition to stdio.
+
+### Improved Bot Instances Dashboard
+The Bot Instances dashboard now provides a more intuitive interface for managing a fleet of Machine & Workload Identity bot instances. This includes improved filtering, sorting and searching capabilities, and a high-level overview of the versions of all bot instances in the cluster.
+
+### Updated Oracle Joining Support
+Oracle compute instances are no longer required to have additional IAM permissions granted to them in order to join. Oracle join tokens now also allow restricting which instances may leverage a token to join.
+
+### Other changes and improvements
+
+* Fixed an issue connections to MongoDB Atlas clusters fail if clusters use certs signed by Google Trust Services (GTS). [#61324](https://github.com/gravitational/teleport/pull/61324)
+* Improved reverse tunnel dialing recovery from default route changes by 1min on average. [#61319](https://github.com/gravitational/teleport/pull/61319)
+* Fixed an issue Postgres database cannot be accessed via Teleport Connect when per-session MFA is enabled and the role does not have wildcard `db_names`. [#61299](https://github.com/gravitational/teleport/pull/61299)
+* Improved conflict detection of application public address and Teleport cluster addresses. [#61290](https://github.com/gravitational/teleport/pull/61290)
+* Fixed AWS Roles Anywhere cli access when using per-session MFA. [#61273](https://github.com/gravitational/teleport/pull/61273)
+* Fixed rare error in the `authorized_keys` secret scanner when running the Teleport agent on MacOS. [#61268](https://github.com/gravitational/teleport/pull/61268)
+* Updated Go to v1.24.10. [#61212](https://github.com/gravitational/teleport/pull/61212)
+* Terraform: `teleport_bot` resource now supports import, and follows the standard resource structure. [#61201](https://github.com/gravitational/teleport/pull/61201)
+* Added support for tbot to teleport-update. [#61198](https://github.com/gravitational/teleport/pull/61198)
+* Instrumented tbot to better support teleport-update. [#61189](https://github.com/gravitational/teleport/pull/61189)
+* Improved error message of `tsh` when there is a certificate DNS SAN mismatch when connecting to Auth via Proxy. [#61186](https://github.com/gravitational/teleport/pull/61186)
+* Improved error handling during desktop sessions that encounter unknown/invalid smartcard commands. This prevents abrupt desktop session termination with a "PDU error" message when using certain applications. [#61180](https://github.com/gravitational/teleport/pull/61180)
+* Fixed an issue causing Access Automation Rules to evaluate incorrectly when users are granted traits via Access Lists. [#61169](https://github.com/gravitational/teleport/pull/61169)
+* Added support for tsh copying files between two hosts, i.e. `tsh scp alice@foo:/path/1.txt bob@bar:/path/2.txt`. [#61165](https://github.com/gravitational/teleport/pull/61165)
+* Added support for custom reason prompts for Access Requests, per requested role/resource (`role.spec.allow.request.reason.prompt`). [#61127](https://github.com/gravitational/teleport/pull/61127)
+* Fixed the webUI timeout time to respect the cluster's WebIdleTimeout configuration. [#61103](https://github.com/gravitational/teleport/pull/61103)
+* Added an option to restrict Oracle join tokens to specific instance IDs. [#61078](https://github.com/gravitational/teleport/pull/61078)
+* Stabilized tsh paths when run from agent installation. [#60873](https://github.com/gravitational/teleport/pull/60873)
+* Added advanced search and sorting to the bot instances list in the web UI. [#60761](https://github.com/gravitational/teleport/pull/60761)
+* Added filter and sort flags to `tctl bots instances ls`. [#60761](https://github.com/gravitational/teleport/pull/60761)
+* Added service health to the output `tctl bots instances ls` and `tctl bot instance show` commands. [#60761](https://github.com/gravitational/teleport/pull/60761)
+* Added a dashboard to visualize bot instances by their version compatibility. [#60761](https://github.com/gravitational/teleport/pull/60761)
+* Added bot instance service health to web UI. [#60761](https://github.com/gravitational/teleport/pull/60761)
+* Added new `env0` join method to support joining within Env0 workflows. [#60710](https://github.com/gravitational/teleport/pull/60710)
+* Added a new OCI join method that does not require IAM policies. [#60293](https://github.com/gravitational/teleport/pull/60293)
+
+## 18.3.2 (11/07/25)
+
+* Updated github.com/containerd/containerd dependency to fix https://github.com/advisories/GHSA-pwhc-rpq9-4c8w. [#61143](https://github.com/gravitational/teleport/pull/61143)
+* Fixed regression when connecting to non-AD desktops. [#61117](https://github.com/gravitational/teleport/pull/61117)
+* Fixed a bug causing `tsh` to stop waiting for access request approval and incorrectly report that the request had been deleted. [#61109](https://github.com/gravitational/teleport/pull/61109)
+* Fixed an issue where resources in Teleport Connect were not always refreshed correctly after re-logging in as a different user. [#61099](https://github.com/gravitational/teleport/pull/61099)
+
+Enterprise:
+* Added support for Amazon Bedrock to session recording summarizer (unavailable in Teleport Cloud). [#7463](https://github.com/gravitational/teleport.e/pull/7463)
+
+## 18.3.1 (11/04/25)
+
+**Warning:** This release includes a regression that prevents connection to non-AD desktops.
+The following workaround is available:
+- Upgrade Windows Desktop Service to 18.3.2
+
+* Fixed an issue MCP session end event is not being sent sometimes. [#61009](https://github.com/gravitational/teleport/pull/61009)
+* Teleport's Windows Desktop service can now discover the KDC server address via DNS. [#60988](https://github.com/gravitational/teleport/pull/60988)
+* Fixed Kubernetes metrics API unmarshaling errors causing kubectl top commands to fail in certain scenarios. [#60971](https://github.com/gravitational/teleport/pull/60971)
+* Fixed an issue which could lead to session recordings saved on disk being truncated. [#60964](https://github.com/gravitational/teleport/pull/60964)
+* Fixed a bug causing unencrypted session recordings to be deleted 24 hours after being created while using `node` and `proxy` recording modes. [#60948](https://github.com/gravitational/teleport/pull/60948)
+* Enabled summarization and metadata generation for encrypted session recordings, storing metadata and summaries in encrypted form. [#60945](https://github.com/gravitational/teleport/pull/60945)
+* Fixed a bug where encrypted sessions recordings could not be uploaded to S3. [#60895](https://github.com/gravitational/teleport/pull/60895)
+* Added "tsh mcp config/connect" support for custom headers for streamable-HTTP MCP servers. [#60843](https://github.com/gravitational/teleport/pull/60843)
+* Fixed the session recording player that was unable to play SSH sessions captured prior to v18.1.6. [#60832](https://github.com/gravitational/teleport/pull/60832)
+* Fixed an issue in the web UI where a bot with zero tokens would show a validation error. [#60760](https://github.com/gravitational/teleport/pull/60760)
+* Added the ability to set OIDC Integration credentials in the tctl AWS Identity Center plugin installer. [#60712](https://github.com/gravitational/teleport/pull/60712)
+* Kubernetes OIDC responses are now cached to improve performance and reliability when joining bots and nodes. [#60711](https://github.com/gravitational/teleport/pull/60711)
+* Fixed MongoDB topology monitoring connection leak in the Teleport Database Service. [#60692](https://github.com/gravitational/teleport/pull/60692)
+* Added support for topologySpreadConstraints to the teleport-kube-agent Helm chart. [#58012](https://github.com/gravitational/teleport/pull/58012)
+* The teleport-kube-agent Helm chart now tries to spread pods across hosts and zones. [#58012](https://github.com/gravitational/teleport/pull/58012)
+
+## 18.3.0 (10/28/25)
+
+### Web UI Workload ID
+
+Teleport's Web UI now lists all workload identity resources registered in the cluster.
 
-### Breaking changes
+### Relay Service
+
+Teleport now includes a new relay service that acts as a lightweight proxy service. This new service can receive connections from both SSH clients and agents.
 
-#### TLS Cipher Suites
+The relay service can be used to avoid routing SSH connections through the broader Teleport control plane, providing the ability to optimize network flows in large or complex deployments.
+
+### Multi-cluster Discovery
+
+Multiple Teleport clusters can now discover the same EC2 instances simultaneously through auto-discovery, with each cluster operating independently without interference.
+
+### Kubernetes Health Checks
+
+Teleport now continuously monitors the health of your registered Kubernetes clusters and displays their status directly in the web UI. When connecting to Kubernetes clusters, Teleport automatically routes you to healthy services, ensuring reliable access to your infrastructure.
+
+### ElastiCache Serverless
+
+Teleport Database Access now supports connecting to ElastiCache Serverless databases.
+
+### Other fixes and improvements
+
+* The browser window for SSO MFA is slightly taller in order to accommodate larger elements like QR codes. [#60703](https://github.com/gravitational/teleport/pull/60703)
+* Slack access plugin no longer crashes in the event access list is unsupported. [#60671](https://github.com/gravitational/teleport/pull/60671)
+* Okta-managed apps are now pinned correctly in the web UI. [#60667](https://github.com/gravitational/teleport/pull/60667)
+* Create and edit GitLab join tokens from the Web UI. [#60649](https://github.com/gravitational/teleport/pull/60649)
+* Teleport Connect now displays the profile name (instead of the cluster name) in the UI when referring to the profile; this affects only clusters where the cluster name was specifically set to something else than the proxy hostname during setup. [#60615](https://github.com/gravitational/teleport/pull/60615)
+* Fixed tsh scp failing on files that grow during transfer. [#60607](https://github.com/gravitational/teleport/pull/60607)
+* Allowed moderated session peers to perform file transfers. [#60604](https://github.com/gravitational/teleport/pull/60604)
+* Added support for regular expression conditions for AccessMonitoringRule. [#60598](https://github.com/gravitational/teleport/pull/60598)
+* Added support for SSE and streamable-HTTP MCP servers. [#60519](https://github.com/gravitational/teleport/pull/60519)
+* Added health checks for enrolled Kubernetes clusters. [#60492](https://github.com/gravitational/teleport/pull/60492)
+* MWI: `tbot`'s auto-generated service names are now simpler and easier to use in the `/readyz` endpoint. [#60458](https://github.com/gravitational/teleport/pull/60458)
+* Client tools managed updates stores OS and ARCH in the configuration. This ensures compatibility when `TELEPORT_HOME` directory is shared with a virtual instance running a different OS or architecture. [#60414](https://github.com/gravitational/teleport/pull/60414)
+* Added a Workload Identities page to the web UI to list workload identities. [#59479](https://github.com/gravitational/teleport/pull/59479)
+
+Enterprise:
+* Enabled Access Automation Rule schedule configuration within the WebUI.
+* Updated Entra ID plugin installation UI to support group filter configuration.
+
+## 18.2.10 (10/23/25)
+
+* Fixed a bug where listing members of an access list results in listing members of access lists which have names prefixed with the original access list name. This may lead to RBAC escalations. [#60587](https://github.com/gravitational/teleport/pull/60587)
+* Fixed a startup error `EADDRINUSE: address already in use` in Teleport Connect on macOS and Linux that could occur with long system usernames. [#60576](https://github.com/gravitational/teleport/pull/60576)
+* Fixed an issue where the eligibility reconsideration flow could continuously reset the Owner’s eligibility status when the Access List contains a dangling reference to a non-existent user. [#60575](https://github.com/gravitational/teleport/pull/60575)
+* Fixed Username AccessList name collision. [#60563](https://github.com/gravitational/teleport/pull/60563)
+* Playback speed can be changed in the new SSH/k8s recording player. [#60451](https://github.com/gravitational/teleport/pull/60451)
+* Adapts EC2 Server auto discovery to send the correct parameters when using the `AWS-RunShellScript` pre-defined SSM Document. [#60434](https://github.com/gravitational/teleport/pull/60434)
+* Updated tsh debug output to include tsh client version when --debug flag is set. [#60407](https://github.com/gravitational/teleport/pull/60407)
+* Updated LDAP dial timeout from 15 seconds to 30 seconds. [#60388](https://github.com/gravitational/teleport/pull/60388)
+* Fixed a bug that prevented using database role names longer than 30 chars for MySQL auto user provisioning. Now role names as long as 32 chars, which is the MySQL limit, can be used. [#60377](https://github.com/gravitational/teleport/pull/60377)
+* Fixed a bug in Proxy Recording Mode that causes SSH sessions in the WebUI to fail. [#60369](https://github.com/gravitational/teleport/pull/60369)
+* Added `extraEnv` and `extraArgs` to the teleport-operator helm chart. [#60357](https://github.com/gravitational/teleport/pull/60357)
+* Fixed issue with inherited roles interfering with auto role provisioning cleanup in Postgres. [#60345](https://github.com/gravitational/teleport/pull/60345)
+* Fixed malformed audit events breaking the audit log. [#60334](https://github.com/gravitational/teleport/pull/60334)
+* Enabled use of schedules within automatic review and notification access_monitoring_rules. [#60327](https://github.com/gravitational/teleport/pull/60327)
+* Fixed an issue that caused Kubernetes debug containers to fail with a “container not valid” error when launched by a user requiring moderated sessions. [#60302](https://github.com/gravitational/teleport/pull/60302)
+* Added `tbot start ssh-multiplexer` helper to start the SSH multiplexer service without a config file. [#60287](https://github.com/gravitational/teleport/pull/60287)
+* Fixed "The server-side graphics subsystem is in an error state" during connection initialization to Windows Desktop. [#60285](https://github.com/gravitational/teleport/pull/60285)
+* Fixed a bug where SSH host certificates are missing the `<hostname>.<clustername>` principal, breaking SSH access via third-party clients. [#60276](https://github.com/gravitational/teleport/pull/60276)
+* Reduces the memory usage when processing a session recording by ~80%. [#60275](https://github.com/gravitational/teleport/pull/60275)
+* Fixed AWS CLI access when using the AWS Roles Anywhere integration. [#60227](https://github.com/gravitational/teleport/pull/60227)
+* Fixed an issue in Teleport Connect where Ctrl+D would sometimes not close a terminal tab. [#60221](https://github.com/gravitational/teleport/pull/60221)
+* Updated error messages displayed by tsh ssh when access to hosts is denied and when attempting to connect to a host that is offline or not enrolled in the cluster. [#60215](https://github.com/gravitational/teleport/pull/60215)
+* Added editing bot description to the web UI. [#60212](https://github.com/gravitational/teleport/pull/60212)
+* Added support for PodSecurityContext to `tbot` helm chart. [#60206](https://github.com/gravitational/teleport/pull/60206)
+* MWI: Add `teleport_bot_instances` metric. [#60196](https://github.com/gravitational/teleport/pull/60196)
+* The `tbot` Workload API now logs errors encountered when handling requests. [#60193](https://github.com/gravitational/teleport/pull/60193)
+* Added explicit timeout to `tbot` when the Trust Bundle Cache is establishing an event watch. [#60182](https://github.com/gravitational/teleport/pull/60182)
+* Fixed a bug where OpenSSH EICE node connections would fail. [#60124](https://github.com/gravitational/teleport/pull/60124)
+* Updated Go to 1.24.9. [#60108](https://github.com/gravitational/teleport/pull/60108)
+* Fixed SFTP audit events breaking the audit log. [#60069](https://github.com/gravitational/teleport/pull/60069)
+* Fixed Access List owners permission inheritance when the nesting depth is one. (Members of an Access List configured as an Owner of another Access List). [#60056](https://github.com/gravitational/teleport/pull/60056)
+* Added support for loading bound keypair joining parameters from the environment. [#60031](https://github.com/gravitational/teleport/pull/60031)
+* Deleting an AWS OIDC integration will remove associated Teleport Discovery Configs and App servers that reference the integration. [#60018](https://github.com/gravitational/teleport/pull/60018)
+* Fixed selinux warning in teleport-update output and error during remove. [#59997](https://github.com/gravitational/teleport/pull/59997)
+* Fixed tsh scp getting stuck in symlink loops. [#59994](https://github.com/gravitational/teleport/pull/59994)
+* Fixed handling of local tsh scp targets that contain a colon. [#59981](https://github.com/gravitational/teleport/pull/59981)
+* Fixed EC2 auto discovery report of failed installations. [#59972](https://github.com/gravitational/teleport/pull/59972)
+* Fixed issue where temporarily unreachable app servers were permanently removed from session cache, causing persistent connection failures: `no application servers remaining to connect`. [#59956](https://github.com/gravitational/teleport/pull/59956)
+* Fixed the issue with automatic access requests for `tsh ssh` when `spec.allow.request.max_duration` is set on the requester role. [#59924](https://github.com/gravitational/teleport/pull/59924)
+* Fixes a bug with the check for a running Teleport process in the install-node.sh script. [#59887](https://github.com/gravitational/teleport/pull/59887)
+* Fixed handling SFTP file transfers when the SSH agent is enforced by SELinux. [#59874](https://github.com/gravitational/teleport/pull/59874)
+* Periods of inactivity in SSH session playback can now be skipped. [#59701](https://github.com/gravitational/teleport/pull/59701)
+
+Enterprise:
+* Oracle database local proxies started with `tsh proxy db` will now accept connections to any database name.
+
+## 18.2.9 (10/23/25)
+
+This is a follow up to the private security release. Changelog will be publicly announced on 10/24/25.
+
+In addition to the previous release it includes the following bug fixes:
+
+* Fixed crash of EC2 auto discovery when AWS credentials provided in to the Discovery Service are not valid. [#60046](https://github.com/gravitational/teleport/pull/60046)
+
+## 18.2.8 (10/20/25)
+
+This is a follow up to the private security release. Changelog will be publicly announced on 10/24/25.
+
+In addition to the previous release it includes the following bug fixes:
+
+* Fixed issue with access list ineligibility status reconciler blocking member updates.
+* Fixed issue with SSH host certificates missing the `<hostname>.<clustername>` principal, breaking SSH access via third-party clients.
+
+## 18.2.7 (10/09/25)
+
+This is a follow up to the private security release. Changelog will be publicly announced on 10/24/25.
+
+In addition to the previous release it includes the following bug fixes:
+
+* Fixed issue with automatic access requests for `tsh ssh` when `spec.allow.request.max_duration` is set on the requester role.
+
+## 18.2.6 (10/06/25)
+
+This is a follow up to the private security release. Changelog will be publicly announced on 10/24/25.
+
+## 18.2.5 (10/02/25)
+
+This is a private security release. Changelog will be publicly announced on 10/24/25.
+
+## 18.2.4 (10/01/25)
+
+* Fixed an issue where the new SSH/Kubernetes recording player would indefinitely show a loading spinner when seeking into a long period of inactivity. [#59816](https://github.com/gravitational/teleport/pull/59816)
+* MWI: Added support for customizing context names with a template in `kubernetes/v2` output. [#59739](https://github.com/gravitational/teleport/pull/59739)
+* Updated mongo-driver to v1.17.4 to include fixes for possible connection leaks that could affect Teleport Database Service instances. [#59732](https://github.com/gravitational/teleport/pull/59732)
+* Fixed excessive memory usage on Teleport Proxy Service instances when using the the Teleport Web UI MySQL REPL. [#59719](https://github.com/gravitational/teleport/pull/59719)
+* Added support for multiple agents in EC2, GCP and Azure Server auto discovery, allowing server access from different Teleport clusters. [#59688](https://github.com/gravitational/teleport/pull/59688)
+* Changed the event-handler plugin to skip over Windows desktop session recording events by default. [#59681](https://github.com/gravitational/teleport/pull/59681)
+* Fixed an issue that would cause trusted cluster resource updates to fail silently. [#58886](https://github.com/gravitational/teleport/pull/58886)
+
+## 18.2.3 (09/29/25)
+
+* Fixed auto-approvals in the Datadog Incident Management integration by updating the on-call API client. [#59668](https://github.com/gravitational/teleport/pull/59668)
+* Fixed auto-approvals in the Datadog Incident Management integration to ignore case sensitivity in user emails. [#59668](https://github.com/gravitational/teleport/pull/59668)
+* Database recordings now show the session summary if it is available. [#59634](https://github.com/gravitational/teleport/pull/59634)
+* Added automatic `@<project-id>.iam` suffix to GCP Postgres usernames (Teleport Connect). [#59629](https://github.com/gravitational/teleport/pull/59629)
+* Fixed `tsh play` not returning an error when playing a session fails. [#59625](https://github.com/gravitational/teleport/pull/59625)
+* Fixed an issue in Teleport Connect where clicking 'Restart' to apply an update could close the window without actually restarting the app. [#59592](https://github.com/gravitational/teleport/pull/59592)
+* Added automatic `@<project-id>.iam` suffix to GCP Postgres usernames (tsh, web UI). [#59590](https://github.com/gravitational/teleport/pull/59590)
+* Introduced `application-proxy` service to `tbot` for HTTP proxying to applications protected by Teleport. [#59587](https://github.com/gravitational/teleport/pull/59587)
+* MWI: Added support for customizing cluster names with a template to the `kubernetes/argo-cd` output. [#59575](https://github.com/gravitational/teleport/pull/59575)
+* Fixed persistence of `metadata.description` field for the Bot resource. [#59570](https://github.com/gravitational/teleport/pull/59570)
+* Fixed a crash in Teleport's Windows Desktop Service introduced in 18.2.0. Compaction of certain shared directory read/write audit events could result in a stack overflow error. [#59515](https://github.com/gravitational/teleport/pull/59515)
+* Added `tctl tokens configure-kube` helper command to easily trust Kubernetes clusters and allow secure repeatable joining. [#59497](https://github.com/gravitational/teleport/pull/59497)
+* Made the check for a running Teleport process in the install-node.sh script more robust. [#59496](https://github.com/gravitational/teleport/pull/59496)
+* Fixed `tctl edit` producing an error when trying to modify a Bot resource. [#59480](https://github.com/gravitational/teleport/pull/59480)
+* Added support for generating VSCode and Claude Code MCP servers configurations to the `tsh mcp config` and `tsh mcp db config` commands. [#59473](https://github.com/gravitational/teleport/pull/59473)
+* Fixed a bug where session IDs were tied to the client connection, resulting in issues when combined with multiplexed connection features (OpenSSH ControlPath/ControlMaster/ControlPersist). [#59472](https://github.com/gravitational/teleport/pull/59472)
+* Improved app access error messages in case of network error. [#59468](https://github.com/gravitational/teleport/pull/59468)
+* Fixed database IAM configurator potentially getting stuck and never recovering (#59290). [#59417](https://github.com/gravitational/teleport/pull/59417)
+* Added tbot copy-binaries command to simplify using tbot as a Kubernetes sidecar. [#59404](https://github.com/gravitational/teleport/pull/59404)
+* Fixed `tsh config` binary path after managed updates. [#59384](https://github.com/gravitational/teleport/pull/59384)
+* Updated Entra ID integration to support group filters. [#59378](https://github.com/gravitational/teleport/pull/59378)
+* Fixed regression allowing SAML apps to be included when filtering resources by 'Applications' in the Web UI. [#59327](https://github.com/gravitational/teleport/pull/59327)
+* Allow controlling the description of auto-discovered Kubernetes apps with an annotation. [#58817](https://github.com/gravitational/teleport/pull/58817)
+* Fixed an issue that prevented connecting to agents over peered tunnels when proxy peering was enabled. [#59556](https://github.com/gravitational/teleport/pull/59556)
+
+## 18.2.2 (09/19/25)
+
+* Fixed a regression in Teleport Connect for Windows that caused the executable to be unsigned. [#59302](https://github.com/gravitational/teleport/pull/59302)
+* Fixed an issue that prevented uploading encrypted recordings using the S3 session recording backend. [#59281](https://github.com/gravitational/teleport/pull/59281)
+* Fix issue preventing auto enrollment of EKS clusters when using the Web UI. [#59272](https://github.com/gravitational/teleport/pull/59272)
+* Terraform provider: Allow creating access lists without setting spec.grants. [#59217](https://github.com/gravitational/teleport/pull/59217)
+* Fixes a panic that occurs when creating a Bound Keypair join token with the `spec.onboarding` field unset. [#59178](https://github.com/gravitational/teleport/pull/59178)
+* Added desktop name for Windows Directory and Clipboard audit events. [#59146](https://github.com/gravitational/teleport/pull/59146)
+* Added the ability to update the AWS Identity Center SCIM token in `tctl`. [#59114](https://github.com/gravitational/teleport/pull/59114)
+* Added services to correctly choose Access Request roles in remote clusters. [#59062](https://github.com/gravitational/teleport/pull/59062)
+* Install script allows specifying a group for agent installation with managed updates V2 enabled. [#59059](https://github.com/gravitational/teleport/pull/59059)
+* Added support for ElastiCache Serverless for Redis OSS and Valkey database access. [#58891](https://github.com/gravitational/teleport/pull/58891)
+
+Enterprise:
+* Fixed an issue in the Entra ID integration where a user account with an unsupported username value could prevent other valid users and groups to be synced to Teleport. Such user accounts are now filtered.
+
+## 18.2.1 (09/12/25)
+
+* Fixed client tools managed updates sequential update. [#59086](https://github.com/gravitational/teleport/pull/59086)
+* Fixed headless login so that it supports both WebAuthn and SSO for MFA. [#59078](https://github.com/gravitational/teleport/pull/59078)
+* When selecting a login for an SSH server, Teleport Connect now shows only logins allowed by RBAC for that specific server rather than showing all logins which the user has access to. [#59067](https://github.com/gravitational/teleport/pull/59067)
+* Terraform Provider is now supported on Windows machines. [#59055](https://github.com/gravitational/teleport/pull/59055)
+* Enabled Oracle Cloud joining in Machine ID's `tbot` client. [#59040](https://github.com/gravitational/teleport/pull/59040)
+* Fixed a bug preventing users to create access lists with empty grants through Terraform. [#59032](https://github.com/gravitational/teleport/pull/59032)
+* Fixed a DynamoDB bug potentially causing event queries to return a different range of events. In the worst case scenario, this bug would block the event-handler. [#59029](https://github.com/gravitational/teleport/pull/59029)
+* Fixed an issue where SSH file copying attempts would be spuriously denied in proxy recording mode. [#59027](https://github.com/gravitational/teleport/pull/59027)
+* Updated Enroll Integration page design. [#58985](https://github.com/gravitational/teleport/pull/58985)
+* Teleport Connect now runs in the background by default on macOS and Windows. On Linux, this behavior can be enabled in the app configuration. [#58923](https://github.com/gravitational/teleport/pull/58923)
+* Added fdpass-teleport binary to install script for Teleport tar downloads. [#58919](https://github.com/gravitational/teleport/pull/58919)
+* Support multiple resource editing in `tctl edit` when editing collections. [#58902](https://github.com/gravitational/teleport/pull/58902)
+* Added support for browser window resizing to the Teleport Web UI database client terminal. [#58900](https://github.com/gravitational/teleport/pull/58900)
+* Fixed a bug that prevented root users from viewing session recordings when they were participants. [#58897](https://github.com/gravitational/teleport/pull/58897)
+* Added ability for user to select whether IC integration creates roles for all possible Account Assignments. [#58861](https://github.com/gravitational/teleport/pull/58861)
+* Updated Go to 1.24.7. [#58835](https://github.com/gravitational/teleport/pull/58835)
+* Populate `user_roles` and `user_traits` fields for SSH audit events. [#58804](https://github.com/gravitational/teleport/pull/58804)
+* Added support for wtmpdb as a user accounting backend to wtmp. [#58777](https://github.com/gravitational/teleport/pull/58777)
+* Prevents an application from being registered if its public address matches a Teleport cluster address. [#58766](https://github.com/gravitational/teleport/pull/58766)
+* Added a preset role `mcp-user` that has access to all MCP servers and their tools. [#58613](https://github.com/gravitational/teleport/pull/58613)
+
+Enterprise:
+* Fixed an issue where sometimes the session summary was marked as a success, even though the summary was empty (this was particularly visible using GPT 5).
+* Updated Enroll Integration page design.
+
+## 18.2.0 (09/04/25)
+
+### Encrypted session recordings
+
+Teleport now provides the ability to integrate with Hardware Security Modules (HSMs) in order to encrypt session recordings prior to uploading them to storage.
+
+### AI session summaries
+
+Teleport Identity Security users are now able to view AI-generated summaries for SSH, Kubernetes and database sessions.
+
+### Updated session recordings page
+
+Session recordings page in Teleport web UI are now updated with a new design that will include session thumbnails and ability to view session summaries for Identity Security users.
+
+### Teleport Connect Managed Updates
+
+Teleport Connect is now able to detect when application updates are available and automatically apply them on the next restart.
+
+### Teleport Device Trust Intune Support
+
+Teleport now includes a new hosted plugin for Microsoft's Intune suite, allowing trusted devices to be synchronized from the Intune inventory.
+
+### Terraform support for Access List members
+
+Users are now able to provision Access Lists and their members (including other nested Access Lists) with terraform.
+
+### Long-term access requests UX
+
+Teleport access requests creation dialog in web UI now better differentiate between short and long-term access requests.
+
+### Database web terminal for MySQL
+
+Teleport web UI now provides terminal interface for MySQL database access.
+
+### Database access for AlloyDB
+
+Teleport now supports database access for GCP AlloyDB databases.
+
+### Other changes and improvements
+
+* Improved observability by adding health check metrics for healthy, unhealthy, and unknown states. Database health checks can now be monitored with these metrics. [#58708](https://github.com/gravitational/teleport/pull/58708)
+* Removed AccessList review notification check from tsh login/status flow. [#58662](https://github.com/gravitational/teleport/pull/58662)
+* Lock, unlock and delete from the Bot Details page, as well as viewing lock status. [#58653](https://github.com/gravitational/teleport/pull/58653)
+* Fixed internal access list membership caching issue that caused high CPU usage when the total number of members exceeded 200. [#58614](https://github.com/gravitational/teleport/pull/58614)
+* Fixed internal cache issue that could cause crashes in AWS IC, Database, and App access flows. [#58611](https://github.com/gravitational/teleport/pull/58611)
+* Fixed panic in `tbot`'s `ssh-multiplexer` service. [#58595](https://github.com/gravitational/teleport/pull/58595)
+* Teleport now honours Entra ID OIDC groups overage claim. The OIDC connector spec in Teleport must be updated to request OIDC `profile` scope and the enterprise application in Entra ID must be granted with `User.ReadBasic.All` Graph API permission for this feature to work. By default, Teleport will query the Microsoft Graph API `graph.microsoft.com` endpoint and filter user's group membership of "security groups" group type. This behaviour can be updated by configuring `entra_id_groups_provider` configuration field, which is available in the OIDC connector configuration spec. [#58593](https://github.com/gravitational/teleport/pull/58593)
+* Enhanced session recordings RBAC to enforce recording access based on rules that reference creator’s roles, traits, and resource properties. [#58563](https://github.com/gravitational/teleport/pull/58563)
+* Added support for configure SCIM Plugin with OIDC or Github Teleport Connectors. [#58554](https://github.com/gravitational/teleport/pull/58554)
+* Added `user_agent` field to MySQL database session start audit events. [#58523](https://github.com/gravitational/teleport/pull/58523)
+* `tbot` now supports the configuration of a default namespace for kubeconfig files generated by the `kubernetes/v2` service. [#58494](https://github.com/gravitational/teleport/pull/58494)
+* Reduced audit log clutter by compacting contiguous shared directory read/write events into a single audit log event. [#58446](https://github.com/gravitational/teleport/pull/58446)
+* Session metadata now appears next to SSH sessions in the UI. [#58405](https://github.com/gravitational/teleport/pull/58405)
+* Refreshed the list session recordings UI with thumbnails, more filtering options and a card/list view. [#58390](https://github.com/gravitational/teleport/pull/58390)
+* Added thumbnail and metadata generation for session recordings. [#58360](https://github.com/gravitational/teleport/pull/58360)
+* Teleport Connect now supports managed updates. [#58260](https://github.com/gravitational/teleport/pull/58260)
+* Teleport Connect now brings focus back from the browser to itself after a successful SSO login. [#58260](https://github.com/gravitational/teleport/pull/58260)
+* Added support for GCP AlloyDB. [#58202](https://github.com/gravitational/teleport/pull/58202)
+* Added support for encrypting session recordings at rest across all recording modes. Encryption can be enabled statically by setting `auth_server.session_recording_config.enabled: yes` in the Teleport file configuration, or dynamically by editing the `session_recording_config` resource and setting `spec.encryption.enabled: yes`. [#57959](https://github.com/gravitational/teleport/pull/57959)
+* Added SSH SELinux module management to teleport-update. [#57660](https://github.com/gravitational/teleport/pull/57660)
+* Added Terraform support for Access List members. [#57058](https://github.com/gravitational/teleport/pull/57058)
+
+## 18.1.8 (08/29/25)
+
+* Fixed an issue introduced in v18.1.5 that caused desktop connection attempts to stall on the loading screen. [#58500](https://github.com/gravitational/teleport/pull/58500)
+* Support setting `"*"` in role `kubernetes_users`. [#58477](https://github.com/gravitational/teleport/pull/58477)
+* The following Helm charts now support obtaining the plugin credentials using tbot: `teleport-plugin-discord`, `teleport-plugin-email`, `teleport-plugin-jira`, `teleport-plugin-mattermost`, `teleport-plugin-msteams`, `teleport-plugin-pagerduty`, `teleport-plugin-event-handler`. [#58301](https://github.com/gravitational/teleport/pull/58301)
+
+## 18.1.7 (08/27/25)
+
+**Warning:** This release includes a regression that prevents connecting to Windows desktops via the Web UI.
+The following workarounds are available:
+- Downgrade proxy servers to 18.1.4
+- Use Teleport Connect instead of the web UI to access desktops
+- Set your preferred keyboard layout (under account settings) to something other than _system_.
+
+* Fixed an issue where VNet could not start because of "VNet is already running" error. [#58388](https://github.com/gravitational/teleport/pull/58388)
+* Fix MCP icon displaying as white/black blocks. [#58347](https://github.com/gravitational/teleport/pull/58347)
+* Fix crash when running 'teleport backend clone' on non-Linux platforms. [#58332](https://github.com/gravitational/teleport/pull/58332)
+* Disabled MySQL database health checks to avoid MySQL blocking the Teleport Database Service for too many connection errors. MySQL health checks can be re-enabled by setting max_connect_errors on MySQL to its maximum value and setting the environment variable TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS=1 on the Teleport Database Service instance. [#58331](https://github.com/gravitational/teleport/pull/58331)
+* Fixed incorrect scp exit status between OpenSSH clients and servers. [#58327](https://github.com/gravitational/teleport/pull/58327)
+* Fixed sftp readdir failing due to broken symlinks. [#58320](https://github.com/gravitational/teleport/pull/58320)
+* Added "MCP Servers" filter in resources view for Web UI and Teleport Connect. [#58309](https://github.com/gravitational/teleport/pull/58309)
+* Enable separate request_object_mode setting for MFA flow in OIDC connectors. [#58281](https://github.com/gravitational/teleport/pull/58281)
+* Allow a namespace to be specified for the `tbot` Kubernetes Secret destination. [#58203](https://github.com/gravitational/teleport/pull/58203)
+* MWI: `tbot` now supports managing Argo CD clusters via the `kubernetes/argo-cd` output service. [#58200](https://github.com/gravitational/teleport/pull/58200)
+* Fixed failure to close user accounting session. [#58163](https://github.com/gravitational/teleport/pull/58163)
+* Add paginated API ListDatabases, deprecate GetDatabases. [#58105](https://github.com/gravitational/teleport/pull/58105)
+* Prevent modifier keys from getting stuck during remote desktop sessions. [#58103](https://github.com/gravitational/teleport/pull/58103)
+* Fixed AWS app access signature verification for AWS requests that use an unsigned payload. [#58085](https://github.com/gravitational/teleport/pull/58085)
+* Windows desktop LDAP discovery now auto-populates the resource's description field. [#58082](https://github.com/gravitational/teleport/pull/58082)
+
+Enterprise:
+* For OIDC SSO, the IdP app/client configured for MFA checks is no longer expected to return claims that map to Teleport roles. Valid claim to role mappings are only required for login flows.
+* Fix SSO MFA method for applications when Teleport is the SAML identity provider and Per-Session MFA is enabled.
+* Added an optional session recording summarizer that uses OpenAI or a compatible API.
+
+## 18.1.6 (08/20/25)
+
+**Warning:** This release includes a regression that prevents connecting to Windows desktops via the Web UI.
+The following workarounds are available:
+- Downgrade proxy servers to 18.1.4
+- Use Teleport Connect instead of the web UI to access desktops
+- Set your preferred keyboard layout (under account settings) to something other than _system_.
+
+* Fixed an uncaught exception in Teleport Connect on Windows when closing the app while the `TELEPORT_TOOLS_VERSION` environment variable is set. [#58131](https://github.com/gravitational/teleport/pull/58131)
+* Fixed a Teleport Connect crash that occurred when assuming an access request while an application or database connection was active. [#58109](https://github.com/gravitational/teleport/pull/58109)
+* Enable Azure joining with VMSS. [#58094](https://github.com/gravitational/teleport/pull/58094)
+* Add support for JWT-Secured Authorization Requests to OIDC Connector. [#58063](https://github.com/gravitational/teleport/pull/58063)
+* Fixed an issue that could cause some hosts not to register dynamic Windows desktops. [#58061](https://github.com/gravitational/teleport/pull/58061)
+* TBot now emits a log message stating the current version on startup. [#58056](https://github.com/gravitational/teleport/pull/58056)
+* Improve error message when a User without any MFA devices enrolled attempts to access a resource that requires MFA. [#58042](https://github.com/gravitational/teleport/pull/58042)
+* Web assets are now pre-compressed with Brotli. [#58039](https://github.com/gravitational/teleport/pull/58039)
+* Add TELEPORT_UNSTABLE_GRPC_RECV_SIZE env var which can be set to overwrite client side max grpc message size. [#58029](https://github.com/gravitational/teleport/pull/58029)
+
+## 18.1.5 (08/18/25)
+
+**Warning:** This release includes a regression that prevents connecting to Windows desktops via the Web UI.
+The following workarounds are available:
+- Downgrade proxy servers to 18.1.4
+- Use Teleport Connect instead of the web UI to access desktops
+- Set your preferred keyboard layout (under account settings) to something other than _system_.
+
+* Fix AWS CLI access using AWS OIDC integration. [#57977](https://github.com/gravitational/teleport/pull/57977)
+* Fixed an issue that could cause revocation checks to fail in Windows environments. [#57880](https://github.com/gravitational/teleport/pull/57880)
+* Fixed the case where the auto-updated client tools did not use the intended version. [#57870](https://github.com/gravitational/teleport/pull/57870)
+* Bound Keypair Joining: Fix lock generation on sequence desync. [#57863](https://github.com/gravitational/teleport/pull/57863)
+* Fix database PKINIT issues caused missing CDP information in the certificate. [#57850](https://github.com/gravitational/teleport/pull/57850)
+* Fixed connection issues to Windows Desktop Services (v17 or earlier) in Teleport Connect. [#57842](https://github.com/gravitational/teleport/pull/57842)
+* The teleport-kube-agent Helm chart now supports kubernetes joining. `teleportClusterName` must be set to enable the feature. [#57824](https://github.com/gravitational/teleport/pull/57824)
+* Fixed the web UI's access request submission panel getting stuck when scrolling down the page. [#57797](https://github.com/gravitational/teleport/pull/57797)
+* Enroll new Kubernetes agents in Managed Updates. [#57784](https://github.com/gravitational/teleport/pull/57784)
+* Teleport now supports displaying more than 2k tokens. [#57772](https://github.com/gravitational/teleport/pull/57772)
+* Updated Go to 1.24.6. [#57764](https://github.com/gravitational/teleport/pull/57764)
+* Database MCP server now supports CockroachDB databases. [#57762](https://github.com/gravitational/teleport/pull/57762)
+* Added support for CockroachDB Web Access and interactive CockroachDB session playback. [#57762](https://github.com/gravitational/teleport/pull/57762)
+* Added the `--auth` flag to the `tctl plugins install scim` CLI command to support Bearer token and OAuth authentication methods. [#57759](https://github.com/gravitational/teleport/pull/57759)
+* Fix Alt+Click not being registered in remote desktop sessions. [#57757](https://github.com/gravitational/teleport/pull/57757)
+* Kubernetes Access: `kubectl port-forward` now exits cleanly when backend pods are removed. [#57738](https://github.com/gravitational/teleport/pull/57738)
+* Kubernetes Access: Fixed a bug when forwarding multiple ports to a single pod. [#57736](https://github.com/gravitational/teleport/pull/57736)
+* Fixed unlink-package during upgrade/downgrade. [#57720](https://github.com/gravitational/teleport/pull/57720)
+* Add new oidc joining mode for Kubernetes delegated joining to support providers that can be configured to provide public OIDC endpoints, like EKS, AKS, and GKE. [#57683](https://github.com/gravitational/teleport/pull/57683)
+* Teleport `event-handler` now accepts HTTP Status Code 204 from the recipient. This adds support for sending events to Grafana Alloy and newer Fluentd versions. [#57680](https://github.com/gravitational/teleport/pull/57680)
+* Enrich the windows.desktop.session.start audit event with additional certificate metadata. [#57676](https://github.com/gravitational/teleport/pull/57676)
+* Allow the use of ResourceGroupsTaggingApi for KMS Key deletion. [#57671](https://github.com/gravitational/teleport/pull/57671)
+* Added `--force` option to `tctl workload-identity x509-issuer-overrides sign-csrs` to allow displaying the output of partial failures, intended for use in clusters that make use of HSMs. [#57662](https://github.com/gravitational/teleport/pull/57662)
+* Tctl top can now display raw prometheus metrics. [#57632](https://github.com/gravitational/teleport/pull/57632)
+* Enable resource label conditions for notification routing rules. [#57616](https://github.com/gravitational/teleport/pull/57616)
+* Use the bot details page to view and edit bot configuration, and see active instances with their upgrade status. [#57542](https://github.com/gravitational/teleport/pull/57542)
+* Device Trust: added `required-for-humans` mode to allow bots to run on unenrolled devices, while enforcing checks for human users. [#57222](https://github.com/gravitational/teleport/pull/57222)
+* Add `TeleportDatabaseV3` support to the Teleport Kubernetes Operator. [#56948](https://github.com/gravitational/teleport/pull/56948)
+* Add `TeleportAppV3` support to the Teleport Kubernetes Operator. [#56948](https://github.com/gravitational/teleport/pull/56948)
+* Fix TELEPORT_SESSION and SSH_SESSION_ID environmental variables not matching in an SSH session. [#55272](https://github.com/gravitational/teleport/pull/55272)
+
+Enterprise:
+* Allow OIDC authentication to complete if email verification is not provided when the OIDC connecter is set to enforce verified email addresses.
+
+## 18.1.4 (08/06/25)
+
+* Fixed access denied error messages not being displayed in the Teleport web UI PostgreSQL client. [#57568](https://github.com/gravitational/teleport/pull/57568)
+* Fixed a bug in the default discovery script that can happen discovering instances whose PATH doesn't contain `/usr/local/bin`. [#57530](https://github.com/gravitational/teleport/pull/57530)
+
+## 18.1.3 (08/05/25)
+
+* Fixed a panic that may occur when fetching non-existent resources from the cache. [#57583](https://github.com/gravitational/teleport/pull/57583)
+* Added support for consuming arbitrary JSON OIDC claims using the JSONPath query language. [#57570](https://github.com/gravitational/teleport/pull/57570)
+* Made it easier to identify Windows desktop certificate issuance on the audit log page. [#57521](https://github.com/gravitational/teleport/pull/57521)
+* Fixed a race condition in the Terraform Provider potentially causing "does not exist" errors the following resources: `auth_preference`, `autoupdate_config`, `autoupdate_version`, `cluster_maintenance_config`, `cluster_network_config`, and `session_recording_config`. [#57518](https://github.com/gravitational/teleport/pull/57518)
+* Fixed a Terraform provider bug causing resource creation to be retried more times than the `MaxRetries` setting. [#57518](https://github.com/gravitational/teleport/pull/57518)
+* Fixed a Terraform provider bug happening when `autoupdate_version` or `autoupdate_config` have non-empty metadata. [#57516](https://github.com/gravitational/teleport/pull/57516)
+
+## 18.1.2 (08/05/25)
+
+* Fix a bug on Windows where a forwarded SSH agent would become dysfunctional after a single connection using the agent. [#57511](https://github.com/gravitational/teleport/pull/57511)
+* Fixed usage print for global `--help` flag. [#57451](https://github.com/gravitational/teleport/pull/57451)
+* Added Cursor and VSCode install buttons in MCP connect dialog in Web UI. [#57362](https://github.com/gravitational/teleport/pull/57362)
+* Added "Allowed Tools" to "tsh mcp ls" and show a warning if no tools allowed. [#57360](https://github.com/gravitational/teleport/pull/57360)
+* Tctl top respects local teleport config file. [#57354](https://github.com/gravitational/teleport/pull/57354)
+* Fixed an issue backfilling CRLs during startup for long-standing clusters. [#57321](https://github.com/gravitational/teleport/pull/57321)
+* Disable NLA in FIPS mode. [#57307](https://github.com/gravitational/teleport/pull/57307)
+* Added a configurable delay between receiving a termination signal and shutting down. [#57211](https://github.com/gravitational/teleport/pull/57211)
+
+Enterprise:
+* Slightly optimized access token refresh logic for Jamf integration when using API credentials.
+
+## 18.1.1 (07/29/25)
+
+* Fix CRL publication for Active Directory Windows desktop access. [#57264](https://github.com/gravitational/teleport/pull/57264)
+* Allow YubiKeys running 5.7.4+ firmware to be usable as PIV hardware keys. [#57216](https://github.com/gravitational/teleport/pull/57216)
+* Append headers to configuration files generated by teleport-update. [#56577](https://github.com/gravitational/teleport/pull/56577)
+
+Enterprise:
+* Fixed application crash that could occur when using GitHub personal access tokens that don't have an expiration date
+
+## 18.1.0 (07/25/25)
+
+### MCP server access
+
+Teleport now provides the ability to connect to stdio-based MCP servers with
+connection proxying and audit logging support.
+
+### MCP for database access
+
+Teleport now allows MCP clients such as Claude Desktop to execute queries in
+Teleport-protected databases.
+
+### VNet for SSH
+
+Teleport VNet adds native support for SSH, enabling any SSH client to connect to
+Teleport SSH servers with zero configuration. Advanced Teleport features like
+per-session MFA have first-class support for a seamless user experience.
+
+### Identifier-first login
+
+Teleport adds support for identifier-first login flows. When enabled, the
+initial login screen contains only a username prompt. Users are presented with
+the SSO connectors that apply to them after submitting their username.
+
+### Bound keypair joining for Machine ID
+
+The new bound keypair join method for Machine ID is a more secure and
+user-friendly alternative to token joining in both on-prem environments and
+cloud providers without a delegated join method. It allows for automatic
+self-recovery in case of expired client certificates and gives administrators
+new options to manage and automate bot joining.
+
+### Sailpoint SCIM integration
+
+Teleport now supports Sailpoint as a SCIM provider allowing administrators to
+synchronize Sailpoint entitlement groups with Teleport access lists.
+
+### LDAP server discovery for desktop access
+
+Teleport's `windows_desktop_service` can now locate the LDAP server via DNS as
+an alternative to providing the address in the configuration file.
+
+### Managed Updates canary support
+
+Managed Updates v2 now support performing canary updates. When canary updates
+are enabled for a group, Teleport will update a few agents first and confirm
+they come back healthy before updating the rest of the group.
+
+You can unable canary updates by setting `canary_count` in your
+`autoupdate_config`:
+
+```yaml
+kind: autoupdate_config
+spec:
+  agents:
+    mode: enabled
+    schedules:
+      regular:
+      - name: dev
+        days:
+        - Mon
+        - Tue
+        - Wed
+        - Thu
+        start_hour: 20
+        canary_count: 5
+    strategy: halt-on-error
+```
+
+Each group can have a maximum of 5 canaries, canaries are picked randomly among
+the connected agents.
+
+Canary update support is currently only support by Linux agents, Kubernetes
+support will be part of a future release.
+
+### Improved access requests UX
+
+Teleport's web UI makes a better distinction between just-in-time and long-term
+access request UX.
+
+### Other changes and improvements
+
+* Fixed a bug causing `tctl`/`tsh` to fail on read-only file systems. [#57147](https://github.com/gravitational/teleport/pull/57147)
+* The `teleport-distroless` container image now disables client tools updates by default (when using tsh/tctl, you will always use the version from the image). You can enable them back by unsetting the `TELEPORT_TOOLS_VERSION` environment variable. [#57147](https://github.com/gravitational/teleport/pull/57147)
+* Fixed a crash in Teleport Connect that could occur when copying large clipboard content during desktop sessions. [#57130](https://github.com/gravitational/teleport/pull/57130)
+* Audit log events for SPIFFE SVID issuances now include the name/label selector used by the client. [#57129](https://github.com/gravitational/teleport/pull/57129)
+* Fixed an issue with `tsh aws` failing for STS and other AWS services. [#57122](https://github.com/gravitational/teleport/pull/57122)
+* Fixed client tools managed updates downgrade to older version. [#57073](https://github.com/gravitational/teleport/pull/57073)
+* Removed unnecessary macOS entitlements from Teleport Connect subprocesses. [#57066](https://github.com/gravitational/teleport/pull/57066)
+* Machine and Workload ID: The `tbot` client will now discard expired identities if needed during renewal to allow automatic recovery without restarting the process. [#57060](https://github.com/gravitational/teleport/pull/57060)
+* Defined `access-plugin` preset role. [#57056](https://github.com/gravitational/teleport/pull/57056)
+* The `tctl top` command now supports the local unix sock debug endpoint. [#57025](https://github.com/gravitational/teleport/pull/57025)
+* Added `--listen` flag to `tsh proxy db` for setting local listener address. [#57005](https://github.com/gravitational/teleport/pull/57005)
+* Added multi-account support to teleport discovery bootstrap. [#56998](https://github.com/gravitational/teleport/pull/56998)
+* Added `TeleportRoleV8` support to the Teleport Kubernetes Operator. [#56946](https://github.com/gravitational/teleport/pull/56946)
+* Fixed a bug in the Teleport install scripts when running on macOS. The install scripts now error instead of trying to install non existing macOS FIPS binaries. [#56941](https://github.com/gravitational/teleport/pull/56941)
+* Fixed using relative path `TELEPORT_HOME` environment variable with client tools managed update. [#56933](https://github.com/gravitational/teleport/pull/56933)
+* Client tools managed updates support multi-cluster environments and track each version in the configuration file. [#56933](https://github.com/gravitational/teleport/pull/56933)
+* Fixed certificate revocation failures in Active Directory environments when Teleport is using HSM-backed key material. [#56924](https://github.com/gravitational/teleport/pull/56924)
+* Fixed database connect options dialog displaying wrong database username options. [#55560](https://github.com/gravitational/teleport/pull/55560)
+
+Enterprise:
+* Fixed SCIM user provisioning when a user already exists and is managed by the same connector as the SCIM integration.
+* Added enrolment for a generic SCIM Integration.
+
+## 18.0.2 (07/17/25)
+
+* Fix backward compatibility issue introduced in the 17.5.5 / 18.0.1 release related to Access List type, causing the `unknown access_list type "dynamic"` validation error. [#56892](https://github.com/gravitational/teleport/pull/56892)
+* Added support for glob-style matching to Spacelift join rules. [#56877](https://github.com/gravitational/teleport/pull/56877)
+* Improve PKINIT compatibility by always including CDP information in the certificate. [#56875](https://github.com/gravitational/teleport/pull/56875)
+* Update Application APIs to use pagination to avoid exceeding message size limitations. [#56727](https://github.com/gravitational/teleport/pull/56727)
+* MWI: tbot's `/readyz` endpoint is now representative of the bot's health. [#56719](https://github.com/gravitational/teleport/pull/56719)
+
+## 18.0.1 (07/15/25)
+
+* Fixed backward compatibility for Access List 'membershipRequires is missing' for older terraform providers. [#56742](https://github.com/gravitational/teleport/pull/56742)
+* Fixed VNet DNS configuration on Windows hosts joined to Active Directory domains. [#56738](https://github.com/gravitational/teleport/pull/56738)
+* Updated default client timeout and upload rate for Pyroscope. [#56730](https://github.com/gravitational/teleport/pull/56730)
+* Bot instances are now sortable by latest heartbeat time in the web UI. [#56696](https://github.com/gravitational/teleport/pull/56696)
+* Enabled automatic reviews of resource requests. [#56690](https://github.com/gravitational/teleport/pull/56690)
+* Updated Go to 1.24.5. [#56679](https://github.com/gravitational/teleport/pull/56679)
+* Fixed `tbot` SPIFFE Workload API failing to renew SPIFFE SVIDs. [#56662](https://github.com/gravitational/teleport/pull/56662)
+* Fixed some icons displaying as white/black blocks. [#56619](https://github.com/gravitational/teleport/pull/56619)
+* Fixed Teleport Cache ListUsers pagination. [#56613](https://github.com/gravitational/teleport/pull/56613)
+* Fixed duplicated `db_client` CA in `tctl status` and `tctl get cas` output. [#56563](https://github.com/gravitational/teleport/pull/56563)
+* Added cross-account support for EC2 discovery. [#56535](https://github.com/gravitational/teleport/pull/56535)
+* Terraform Provider: added support for skipping proxy certificate verification in development environments. [#56527](https://github.com/gravitational/teleport/pull/56527)
+* Added support for CRD in access requests. [#56496](https://github.com/gravitational/teleport/pull/56496)
+* Added `tctl autoupdate agents report` command. [#56495](https://github.com/gravitational/teleport/pull/56495)
+* Made VNet DNS available over IPv4. [#56477](https://github.com/gravitational/teleport/pull/56477)
+* Fixed missing Teleport Kube Operator permission in v18.0.0 causing the operator to fail. [#56466](https://github.com/gravitational/teleport/pull/56466)
+* Trait role templating is now supported in the `workload_identity_labels` field. [#56296](https://github.com/gravitational/teleport/pull/56296)
+* MWI: `tbot` no longer supports providing a proxy server address via `--auth-server` or `auth_server`, use `--proxy-server` or `proxy_server` instead. [#55818](https://github.com/gravitational/teleport/pull/55818)
+* UX: Forbid creating Access Requests to user_group resources when Okta bidirectional sync is disabled. [#55585](https://github.com/gravitational/teleport/pull/55585)
+* Teleport Connect: Added support for custom reason prompts. [#55557](https://github.com/gravitational/teleport/pull/55557)
+
+Enterprise:
+* Renamed Access Monitoring Rules to Access Automation Rules within the WebUI.
+* Prevent the lack of an `email_verified` OIDC claim from failing authentication when the OIDC connecter is set to enforce verified email addresses.
+* Fixed a email integration enrollment documentation link.
+* Fixed a regression in SAML IdP that caused service provider initiated login to fail if the request was made with `http-redirect` binding encoding and the user had an active session in Teleport.
+
+## 18.0.0 (07/03/25)
+
+Teleport 18 brings the following new features and improvements:
+
+* Identity Activity Center
+* Automatic access request reviews
+* Multi-session MFA for database access
+* RBAC and device trust for SAML applications
+* Database health checks
+* Kubernetes CRD
+
+### Description
+
+#### Identity Activity Center
+
+Teleport Identity Security, Identity Activity Center helps teams expose and
+eliminate hidden identity risk in your infrastructure.  By correlating user
+activity from multiple sources, it accelerates incident response to
+identity-based attacks. The first iteration will support integrations with AWS
+(CloudTrail), GitHub (Audit Log API), Okta (Audit API) and Teleport (Audit Log).
+
+#### Automatic access request reviews
+
+Teleport 18 includes built-in support for automatic access request reviews,
+eliminating the need to run separate access request plugins. Automatic reviews
+are enabled by setting up Access Monitoring Rules which define the conditions
+that must be satisfied in order for a request to be automatically approved or
+denied.
+
+For more information, refer to the [docs](docs/pages/identity-governance/access-requests/automatic-reviews.mdx).
+
+#### Multi-session MFA for database access
+
+Per-session MFA has been extended to support multi-session reuse, allowing a
+single MFA challenge to authorize multiple database connections using the new
+`tsh db exec` command. This command executes a query across multiple selected
+databases, making it user-friendly for ad-hoc user and script-friendly for
+automation.
+
+For more details, see the *database access examples* in the [per-session MFA
+guide](docs/pages/zero-trust-access/authentication/per-session-mfa.mdx).
+
+#### RBAC and device trust for SAML applications
+
+Access to SAML IdP service provider resources can now be controlled with
+resource labels. The resource labels are matched against `app_labels` defined in
+user roles. Additionally, SAML IdP sessions now enforce device trust.
+
+#### Database health checks
+
+In Teleport 18, the database service performs regular health checks for
+registered databases. Health status and any networking issues are reported in
+the Teleport web UI and reflected in `db_server` resources.
+
+In highly-available deployments with multiple database services, Teleport
+prioritizes healthy services when routing user connections. For more
+information, see the [database health checks
+guide](docs/pages/enroll-resources/database-access/guides/health-checks.mdx).
+
+#### Kubernetes CRD
+
+In Teleport 18, the `kubernetes_resources` control of [role version
+8](https://goteleport.com/docs/reference/resources/#role-versions) has been
+updated to support Kubernetes Custom Resource Definitions and the behavior of
+the `kind` and `namespace` fields has been updated to allow finer control. When
+the  `kind`: `namespace` is set, it  will now only refer to the Kubernetes
+namespace itself and not all resources within the namespace. The `kind` field
+now expects the plural version of the resource name (i.e. `pods` instead of
+`pod`) and a new field `api_group` has been added  which must match the apiGroup
+that the Kubernetes resource belongs to.
+
+##### Examples
+
+A role which allows access to the CronTab CRD.
+
+```yaml
+kind: role
+metadata:
+  name: kube-access-v8
+spec:
+  allow:
+    kubernetes_groups:
+    - '{{internal.kubernetes_groups}}'
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - api_group: stable.example.com
+      kind: crontabs
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+version: v8
+```
+
+Converting a v7 Role to a v8 Role. Note the addition of the now required
+`api_group` field and the change from **deployment** to **deployments** and from
+**persistentvolume** to **persistentvolumes** for the `kind` field.
+
+```yaml
+kind: role
+metadata:
+  name: kube-access-v7
+spec:
+  allow:
+    kubernetes_groups:
+    - '{{internal.kubernetes_groups}}'
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: deployment
+      name: '*'
+      namespace: default
+      verbs:
+      - '*'
+    - kind: persistentvolume
+      name: '*'
+      verbs:
+      - '*'
+  deny: {}
+version: v7
+```
+
+```yaml
+kind: role
+metadata:
+  name: kube-access-v8
+spec:
+  allow:
+    kubernetes_groups:
+    - '{{internal.kubernetes_groups}}'
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - api_group: apps
+      kind: deployments
+      name: '*'
+      namespace: default
+      verbs:
+      - '*'
+    - api_group: ''
+      kind: persistentvolumes
+      name: '*'
+      verbs:
+      - '*'
+  deny: {}
+version: v8
+```
+
+Granting access to all items within a namespace. Note that in v8 there are two
+entries, the first is for the namespace itself and the second is for all entries
+within the namespace.
+
+```yaml
+kind: role
+metadata:
+  name: kube-access-v7-ns
+spec:
+  allow:
+    kubernetes_groups:
+    - '{{internal.kubernetes_groups}}'
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: namespace
+      name: default
+      verbs:
+      - '*'
+  deny: {}
+version: v7
+```
+
+```yaml
+kind: role
+metadata:
+  name: kube-access-v8-ns
+spec:
+  allow:
+    kubernetes_groups:
+    - '{{internal.kubernetes_groups}}'
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - api_group: ''
+      kind: namespaces
+      name: default
+      verbs:
+      - '*'
+    - api_group: '*'
+      kind: '*'
+      name: '*'
+      namespace: default
+      verbs:
+      - '*'
+  deny: {}
+version: v8
+```
+
+For more information, refer to the [docs](docs/pages/enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources).
+
+### Breaking changes and deprecations
+
+#### TLS cipher suites
 
 TLS cipher suites with known security issues can no longer be manually
 configured in the Teleport YAML configuration file. If you do not explicitly
@@ -12,13 +950,13 @@ configure any of the listed TLS cipher suites, you are not affected by this
 change.
 
 Teleport 18 removes support for:
-- `tls-rsa-with-aes-128-cbc-sha`
-- `tls-rsa-with-aes-256-cbc-sha`
-- `tls-rsa-with-aes-128-cbc-sha256`
-- `tls-rsa-with-aes-128-gcm-sha256`
-- `tls-rsa-with-aes-256-gcm-sha384`
-- `tls-ecdhe-ecdsa-with-aes-128-cbc-sha256`
-- `tls-ecdhe-rsa-with-aes-128-cbc-sha256`
+* `tls-rsa-with-aes-128-cbc-sha`
+* `tls-rsa-with-aes-256-cbc-sha`
+* `tls-rsa-with-aes-128-cbc-sha256`
+* `tls-rsa-with-aes-128-gcm-sha256`
+* `tls-rsa-with-aes-256-gcm-sha384`
+* `tls-ecdhe-ecdsa-with-aes-128-cbc-sha256`
+* `tls-ecdhe-rsa-with-aes-128-cbc-sha256`
 
 #### Terraform provider role defaults
 
@@ -30,7 +968,7 @@ the Kubernetes Operator.
 This might change the default options of role where not every option was
 explicitly set. For example:
 
-```
+```hcl
 resource "teleport_role" "one-option-set" {
   version = "v7"
   metadata = {
@@ -54,6 +992,7 @@ role option differences, please review it and check that the default changes are
 acceptable. If they are not, you must set the options to `false`.
 
 Here's a plan example for the code above:
+
 ```
 # teleport_role.one-option-set will be updated in-place
 ~ resource "teleport_role" "one-option-set" {
@@ -75,27 +1014,50 @@ Here's a plan example for the code above:
 
 #### AWS endpoint URL mode removed
 
-The AWS endpoint URL mode (`--endpoint-url`) has been removed for `tsh proxy
-aws` and `tsh aws`. Users using this mode should use the default HTTPS Proxy
-mode from now on.
+The `tsh aws` and `tsh proxy aws` commands no longer support being used as
+custom service endpoints.  Instead, users should use them as `HTTPS_PROXY` proxy
+servers.
+
+For example, the following command will no longer work: `aws s3 ls
+--endpoint-url https://localhost:LOCAL_PROXY_PORT`.  To achieve a similar result
+with Teleport 18, run `HTTPS_PROXY=http://localhost:LOCAL_PROXY_PORT aws s3 ls`.
+
+#### TOTP for per-session MFA
+
+Starting with Teleport 18, `tsh` will no longer allow for using TOTP as a second
+factor for per-session MFA. TOTP continues to be accepted as a second factor for
+the initial login.
+
+#### Linux kernel 3.2 required
+
+On Linux, Teleport now requires Linux kernel version 3.2 or later.
 
 ### Other changes
 
-#### Configurable keyboard layouts for Windows desktop sessions
+#### PKCE support for OpenID Connect
+
+Teleport 18 includes support for Proof Key for Code Exchange (PKCE) in OpenID
+Connect flows. PKCE is a security enhancement that ensures that attackers who
+can intercept the authorization code will not be able to exchange it for an
+access token.
+
+To enable PKCE, set `pkce_mode: enabled` in your OIDC connector. Future versions
+of Teleport may enable PKCE by default.
 
-Teleport's Account Settings page now exposes an option to set your preferred
-keyboard layout for Windows desktop sessions.
+#### Cache improvements
 
-Note: in order for this setting to take affect, agent's running Teleport's
-`windows_desktop_service` must be upgraded to v18.0.0 or later.
+Teleport 18 ships with an improved cache implementation that stores resources
+directly instead of storing their JSON-encoded representation. In addition to
+performance gains, this new storage mechanism will also improve compatibility
+between older agents and newer versions of resources.
 
 #### Windows desktop discovery enhancements
 
 Teleport's LDAP-based discovery mechanism for Windows desktops now supports:
 
-- a configurable discovery interval
-- custom RDP ports
-- the ability to run multiple separate discovery configurations, allowing you to
+* a configurable discovery interval
+* custom RDP ports
+* the ability to run multiple separate discovery configurations, allowing you to
   configure finely-grained discovery policies without running multiple agents
 
 To update your configuration, move the `discovery` section to `discovery_configs`:
@@ -113,4932 +1075,49 @@ windows_desktop_service:
 +      rdp_port: 9989 # optional, defaults to 3389
 ```
 
-#### Legacy ALPN connection upgrade mode has been removed
-
-Teleport v15.1 added WebSocket upgrade support for Teleport proxies behind
-layer 7 load balancers and reverse proxies. The legacy ALPN upgrade mode using
-`alpn` or `alpn-ping` as upgrade types was left as a fallback until v17.
-Teleport v18 removes the legacy upgrade mode entirely including the use of
-environment variable `TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE`.
-
-## 16.0.0 (xx/xx/xx)
-
-### Breaking changes
-
-#### Opsgenie plugin annotations
-
-Opsgenie plugin users, role annotations must now contain
-`teleport.dev/notify-services` to receive notification on Opsgenie.
-`teleport.dev/schedules` is now the label used to determine auto approval flow.
-See [the Opsgenie plugin documentation](docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx)
-for setup instructions.
-
-#### Teleport Assist has been removed
-
-Teleport Assist chat has been removed from Teleport 16. `auth_service.assist` and `proxy_service.assist`
-options have been removed from the configuration. Teleport will not start if these options are present.
-
-During the migration from v15 to v16, the options mentioned above should be removed from the configuration.
-
-#### DynamoDB permission requirements have changed
-
-Teleport clusters using the dynamodb backend must now have the `dynamodb:ConditionCheckItem`
-permission. For a full list of all required permissions see the Teleport [Backend Reference](docs/pages/reference/backends.mdx#dynamodb).
-
-#### Disabling multi-factor authentication_type
-
-Support for disabling multi-factor authentication has been removed
-
-#### Machine ID and OpenSSH client config changes
-
-Users with custom `ssh_config` should modify their ProxyCommand to use the new,
-more performant, `tbot ssh-proxy-command`. See the
-[v16 upgrade guide](docs/pages/reference/machine-id/v16-upgrade-guide.mdx) for
-more details.
-
-#### Default keyboard shortcuts in Teleport Connect have been changed
-
-On Windows and Linux, some of the default shortcuts conflicted with the default bash or nano shortcuts
-(e.g. Ctrl + E, Ctrl + K).
-On those platforms, the default shortcuts have been changed to a combination of Ctrl + Shift + *.
-We also updated the shortcut to open a new terminal on macOS to Control + Shift + \`.
-See [configuration](docs/pages/connect-your-client/teleport-connect.mdx#configuration)
-for the current list of shortcuts.
-
-## 15.0.0 (xx/xx/24)
-
-### New features
-
-#### FIPS now supported on ARM64
-
-Teleport 15 now provides FIPS-compliant Linux builds on ARM64. Users will now
-be able to run Teleport in FedRAMP/FIPS mode on ARM64.
-
-#### Hardened AMIs now produced for ARM64
-
-Teleport 15 now provides hardened AWS AMIs on ARM64.
-
-#### Streaming session playback
-
-Prior to Teleport 15, `tsh play` and the web UI would download the entire
-session recording before starting playback. As a result, playback of large
-recordings could be slow to start, and may fail to play at all in the browser.
-
-In Teleport 15, session recordings are streamed from the Auth Service, allowing
-playback to start before the entire session is downloaded and unpacked.
-
-Additionally, `tsh play` now supports a `--speed` flag for adjusting the
-playback speed.
-
-#### Standalone Teleport Operator
-
-Prior to Teleport 15, the Teleport Kubernetes Operator had to run as a sidecar
-of the Teleport auth. It was not possible to use the operator in Teleport
-Enterprise (Cloud) or against a Teleport cluster not deployed with the
-`teleport-cluster` Helm chart.
-
-In Teleport 15, the Teleport Operator can reconcile resources in any Teleport
-cluster. Teleport Enterprise (Cloud) users can now use the operator to manage
-their resources.
-
-When deployed with the `teleport-cluster` chart, the operator now runs in a
-separate pod. This ensures that Teleport's availability won't be impacted if
-the operator becomes unready.
-
-See [the Standalone Operator guide](docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx)
-for installation instructions.
-
-#### Teleport Operator now supports roles v6 and v7
-
-Starting with Teleport 15, newly supported kinds will contain the resource version.
-For example: `TeleportRoleV6` and `TeleportRoleV7` kinds will allow users to
-create Teleport Roles v6 and v7.
-
-Existing kinds will remain unchanged in Teleport 15, but will be renamed in
-Teleport 16 for consistency.
-
-To migrate an existing Custom Resource (CR) `TeleportRole` to
-a `TeleportRoleV7`, you must:
-- upgrade Teleport and the operator to v15
-- annotate the exiting `TeleportRole` CR with `teleport.dev/keep: "true"`
-- delete the `TeleportRole` CR (it won't delete the role in Teleport thanks to the annotation)
-- create a new `TeleportRoleV7` CR with the same name
-
-### Breaking changes and deprecations
-
-#### RDP engine requires RemoteFX
-
-Teleport 15 includes a new RDP engine that leverages the RemoteFX codec for
-improved performance. Additional configuration may be required to enable
-RemoteFX on your Windows hosts.
-
-If you are using our authentication package for local users, the v15 installer
-will automatically enable RemoteFX for you.
-
-Alternatively, you can enable RemoteFX by updating the registry:
-
-```powershell
-Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services' -Name 'ColorDepth' -Type DWORD -Value 5
-Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services' -Name 'fEnableVirtualizedGraphics' -Type DWORD -Value 1
-```
-
-If you are using Teleport with Windows hosts that are part of an Active
-Directory environment, you should enable RemoteFX via group policy.
-
-Under Computer Configuration > Administrative Templates > Windows Components >
-Remote Desktop Services > Remote Desktop Session Host, enable:
-
-1. Remote Session Environment > RemoteFX for Windows Server 2008 R2 > Configure RemoteFX
-1. Remote Session Environment > Enable RemoteFX encoding for RemoteFX clients designed for Windows Server 2008 R2 SP1
-1. Remote Session Environment > Limit maximum color depth
-
-Detailed instructions are available in the
-[setup guide](docs/pages/enroll-resources/desktop-access/active-directory.mdx#enable-remotefx).
-A reboot may be required for these changes to take effect.
-
-#### `tsh ssh`
-
-When running a command on multiple nodes with `tsh ssh`, each line of output
-is now labeled with the hostname of the node it was written by. Users that
-rely on parsing the output from multiple nodes should pass the `--log-dir` flag
-to `tsh ssh`, which will create a directory where the separated output of each node
-will be written.
-
-#### `drop` host user creation mode
-
-The `drop` host user creation mode has been removed in Teleport 15. It is replaced
-by `insecure-drop`, which still creates temporary users but does not create a
-home directory. Users who need home directory creation should either wrap `useradd`/`userdel`
-or use PAM.
-
-#### Remove restricted sessions for SSH
-
-The restricted session feature for SSH has been deprecated since Teleport 14 and
-has been removed in Teleport 15. We recommend implementing network restrictions
-outside of Teleport (iptables, security groups, etc).
-
-#### Packages no longer published to legacy Debian and RPM repos
-
-`deb.releases.teleport.dev` and `rpm.releases.teleport.dev` were deprecated in
-Teleport 11. Beginning in Teleport 15, Debian and RPM packages will no longer be
-published to these repos. Teleport 14 and prior packages will continue to be
-published to these repos for the remainder of those releases' lifecycle.
-
-All users are recommended to switch to `apt.releases.teleport.dev` and
-`yum.releases.teleport.dev` repositories as described in installation
-[instructions](docs/pages/installation.mdx).
-
-The legacy package repos will be shut off in mid 2025 after Teleport 14
-has been out of support for many months.
-
-#### Container images
-
-Teleport 15 contains several breaking changes to improve the default security
-and usability of Teleport-provided container images.
-
-##### "Heavy" container images are discontinued
-
-In order to increase default security in 15+, Teleport will no longer publish
-[container images containing a shell and command line environment](https://github.com/gravitational/teleport/blob/branch/v14/build.assets/charts/Dockerfile)
-to Elastic Container Registry's [gravitational/teleport](https://gallery.ecr.aws/gravitational/teleport)
-image repo. Instead, all users should use the [distroless images](https://github.com/gravitational/teleport/blob/branch/v15/build.assets/charts/Dockerfile-distroless)
-introduced in Teleport 12. These images can be found at:
-
-* https://gallery.ecr.aws/gravitational/teleport-distroless
-* https://gallery.ecr.aws/gravitational/teleport-ent-distroless
-
-For users who need a shell in a Teleport container, a "debug" image is
-available which contains BusyBox, including a shell and many CLI tools. Find
-the debug images at:
-
-* https://gallery.ecr.aws/gravitational/teleport-distroless-debug
-* https://gallery.ecr.aws/gravitational/teleport-ent-distroless-debug
-
-Do not run debug container images in production environments.
-
-Heavy container images will continue to be published for Teleport 13 and 14
-throughout the remainder of these releases' lifecycle.
-
-##### Helm cluster chart FIPS mode changes
-
-The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode.
-
-Instead, you should use the following values file configuration:
-```
-enterpriseImage: public.ecr.aws/gravitational/teleport-ent-fips-distroless
-authentication:
-  localAuth: false
-```
-
-##### Multi-architecture Teleport Operator images
-
-Teleport Operator container images will no longer be published with architecture
-suffixes in their tags (for example: `14.2.1-amd64` and `14.2.1-arm`). Instead,
-only a single tag will be published with multi-platform support (e.g., `15.0.0`).
-If you use Teleport Operator images with an architecture suffix, remove the
-suffix and your client should automatically pull the platform-appropriate image.
-Individual architectures may be pulled with `docker pull --platform <arch>`.
-
-##### Quay.io registry
-
-The quay.io container registry was deprecated and Teleport 12 is the last
-version to publish images to quay.io. With Teleport 15's release, v12 is no
-longer supported and no new container images will be published to quay.io.
-
-For Teleport 8+, replacement container images can be found in [Teleport's public ECR registry](https://gallery.ecr.aws/gravitational).
-
-Users who wish to continue to use unsupported container images prior to
-Teleport 8 will need to download any quay.io images they depend on and mirror
-them elsewhere before July 2024. Following brownouts in May and June, Teleport
-will disable pulls from all Teleport quay.io repositories on Wednesday July 3,
-2024.
-
-#### Amazon AMIs
-
-Teleport 15 contains several breaking changes to improve the default security
-and usability of Teleport-provided Amazon AMIs.
-
-##### Hardened AMIs
-
-Teleport-provided Amazon Linux 2023 previously only supported x86_64/amd64.
-Starting with Teleport 15, arm64-based AMIs will be produced. However, the
-naming scheme for these AMIs has been changed to include the architecture.
-
-- Previous naming scheme: `teleport-oss-14.0.0-$TIMESTAMP`
-- New naming scheme: `teleport-oss-15.0.0-x86_64-$TIMESTAMP`
-
-##### Legacy Amazon Linux 2 AMIs
-
-Teleport-provided Amazon Linux 2 AMIs were deprecated, and Teleport 14 is the
-last version to produce such legacy AMIs. With Teleport 15's release, only
-the newer hardened Amazon Linux 2023 AMIs will be produced.
-
-The legacy AMIs will continue to be published for Teleport 13 and 14 throughout
-the remainder of these releases' lifecycle.
-
-#### `windows_desktop_service` no longer writes to the NTAuth store
-
-In Teleport 15, the process that periodically publishes Teleport's user CA to
-the Windows NTAuth store has been removed. It is not necessary for Teleport to
-perform this step since it must be done by an administrator at installation
-time. As a result, Teleport's service account can use more restrictive
-permissions.
+#### Customizable keyboard layouts for remote desktop sessions
 
-#### Example AWS cluster deployments updated
+The web UI's account settings page now includes an option for
+setting your desired keyboard layout for remote desktop sessions.
 
-The AWS terraform examples for Teleport clusters have been updated to use the
-newer hardened Amazon Linux 2023 AMIs. Additionally, the default architecture
-and instance type has been changed to ARM64/Graviton.
+This keyboard layout will be respected by agents running Teleport 18
+or later.
 
-As a result of this modernization, the legacy monitoring stack configuration
-used with the legacy AMIs has been removed.
+#### Faster user lookups on domain-joined Windows workstations
 
-#### `teleport-cluster` Helm chart changes
+Teleport 18 is built with Go 1.24, which includes an optimized user lookup
+implementation. As a result, the
+[workarounds](https://goteleport.com/docs/faq/#tsh-is-very-slow-on-windows-what-to-do)
+for avoiding slow lookups in tsh and Teleport Connect are no longer necessary.
 
-Due to the new separate operator deployment, the operator is deployed by a subchart.
-This causes the following breaking changes:
-- `installCRDs` has been replaced by `operator.installCRDs`
-- `teleportVersionOverride` does not set the operator version anymore, you must
-  use `operator.teleportVersionOverride` to override the operator version.
+#### Agent Managed Updates v2 enhancements
 
-Note: version overrides are dangerous and not recommended. Each chart version
-is designed to run a specific Teleport and operator version. If you want to
-deploy a specific Teleport version, use Helm's `--version X.Y.Z` instead.
+Managed Updates v2 can now track which version agents are running and use this
+information to progress the rollout. Only Linux agents are supported, agent
+reports for `teleport-kube-agent` will come in a future update. Reports are
+generated every minute and only count agents connected and stable for at least
+a minute.
 
-The operator now joins using a Kubernetes ServiceAccount token. To validate the
-token, the Teleport Auth Service must have access to the `TokenReview` API.
-The chart configures this for you since v12, unless you disabled `rbac` creation.
+You can now observe the agent managed update progress by using
+`tctl autoupdate agents status` and `tctl autoupdate agents report`.
 
-##### Helm cluster chart FIPS mode changes
+If the strategy is `halt-on-error`, the group will be marked as done and the
+rollout will continue only after at least 90% of the agents are updated.
 
-The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode.
-
-Instead, you should use the following values file configuration:
-
-```
-enterpriseImage: public.ecr.aws/gravitational/teleport-ent-fips-distroless
-authentication:
-  localAuth: false
+You can now manually trigger a group, mark it as done, or rollback an update
+with `tctl`:
 
+```shell
+autoupdate agents start-update [group1, group2, ...]
+autoupdate agents mark-done [group1, group2, ...]
+autoupdate agents rollback [group1, group2, ...]
 ```
 
-#### Resource version is now mandatory and immutable in the Terraform provider
-
-Starting with Teleport 15, each Terraform resource must have its version specified.
-Before version 15, Terraform was picking the latest version available on resource creation.
-This caused inconsistencies as new resources created with the same manifest as
-old resources were not exhibiting the same behavior.
-
-Resource version is now immutable. Changing a resource version will cause
-Terraform to delete and re-create the resource. This ensures the correct
-defaults are set.
-
-Existing resources will continue to work as Terraform already imported their
-version. However, new resources will require an explicit version.
-
-### Other changes
-
-#### Increased password length
-
-The minimum password length has been increased to 12 characters.
-
-#### Increased account lockout interval
-
-The account lockout interval has been increased to 30 minutes.
-
-## 14.0.0 (09/20/23)
-
-Teleport 14 brings the following new major features and improvements:
-
-- Access lists
-- Unified resource view
-- ClickHouse support for database access
-- Advanced audit log
-- Kubernetes apps auto-discovery
-- Extended Kubernetes per-resource RBAC
-- Oracle database access audit logging support
-- Enhanced PuTTY support
-- Support for TLS routing in Terraform deployment examples
-- Discord and ServiceNow hosted plugins
-- Limited passwordless access for local Windows users in Teleport Community
-  Edition
-- Machine ID: Kubernetes Secret destination
-
-In addition, this release includes several changes that affect existing
-functionality listed in the “Breaking changes” section below. Users are advised
-to review them before upgrading.
-
-### New features
-
-#### Advanced audit log
-
-Teleport 14 includes support for a new audit log powered by Amazon S3 and Athena
-that supports efficient searching, sorting, and filtering operations. Teleport
-Enterprise (Cloud) customers will have their audit log automatically migrated to
-this new backend.
-
-See the documentation [here](docs/pages/reference/backends.mdx#athena).
-
-#### Access lists
-
-Teleport 14 introduces foundational support for Access Lists, an extension to
-the short-lived Access Request system targeted towards longer-term access.
-Administrators can add users to Access Lists granting them long-term permissions
-within the cluster.
-
-As the feature is being developed, future Teleport releases will add support for
-periodic audit reviews and deeper integration of Access Lists with Okta.
-
-You can find existing Access Lists documentation [here](docs/pages/admin-guides/access-controls/access-lists/guide.mdx).
-
-#### Unified resources view
-
-The web UI in Teleport 14 has been updated to show all resources in a single
-unified view.
-
-This is the first step in a series of changes designed to support a
-customizable Teleport experience and make it easier to access the resources that
-are most important to you.
-
-#### Kubernetes apps auto-discovery
-
-Teleport 14 updates its auto-discovery capabilities with support for web
-applications in Kubernetes clusters. When connected to a Kubernetes cluster (or
-deployed as a Helm chart), the Teleport Discovery Service will automatically find
-and enroll web applications with your Teleport cluster.
-
-See documentation [here](docs/pages/enroll-resources/auto-discovery/kubernetes-applications/kubernetes-applications.mdx).
-
-#### Extended Kubernetes per-resource RBAC
-
-Teleport 14 extends resource-based Access Requests to support more Kubernetes
-resources than just pods, including custom resources, and verbs. Note that this
-feature requires role version `v7`.
-
-See Kubernetes resources documentation to see a full list of [supported
-resources](docs/pages/enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources).
-
-#### ClickHouse support for database access
-
-Teleport 14 adds database access support for ClickHouse HTTP and native (TCP)
-protocols. When using HTTP protocol, the user's query activity is captured in
-the Teleport audit log.
-
-See how to connect ClickHouse to Teleport
-[here](docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/clickhouse-self-hosted.mdx).
-
-#### Oracle database access audit logging support
-
-In Teleport 14, database access for Oracle integration is updated with query
-audit logging support.
-
-See documentation on how to configure it in the [Oracle guide](docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-self-hosted.mdx).
-
-#### Limited passwordless access for local Windows users in Teleport Community Edition
-
-In Teleport 14, access to Windows desktops with local Windows users has been
-extended to Community Edition. Teleport will permit users to register and
-connect to up to 5 desktops with local users without an enterprise license.
-
-For more information on using Teleport with local Windows users, see [docs](docs/pages/enroll-resources/desktop-access/getting-started.mdx).
-
-#### Discord and ServiceNow hosted plugins
-
-Teleport 14 includes support for hosted Discord and ServiceNow plugins. Teleport
-Enterprise (Cloud) users can configure Discord and ServiceNow integrations to
-receive Access Request notifications.
-
-Discord plugin is available now, ServiceNow is coming in 14.0.1.
-
-#### Enhanced PuTTY Support
-
-tsh on Windows now supports the `tsh puttyconfig` command, which can
-configure saved sessions inside the well-known PuTTY client to connect to
-Teleport-protected servers.
-
-For more information, see [docs](docs/pages/connect-your-client/putty-winscp.mdx).
-
-#### Support for TLS routing in Terraform deployment examples
-
-The ha-autoscale-cluster and starter-cluster Terraform deployment examples now
-support a `USE_TLS_ROUTING` variable to enable TLS routing inside the deployed
-Teleport cluster.
-
-#### Machine ID: Kubernetes Secret destination
-
-In Teleport 14, `tbot` can now be configured to write artifacts such as
-credentials and configuration files directly to a Kubernetes secret rather than
-a directory on the local file system.
-
-For more information, see [docs](docs/pages/reference/machine-id/configuration.mdx).
-
-### Breaking changes and deprecations
-
-Please familiarize yourself with the following potentially disruptive changes in
-Teleport 14 before upgrading.
-
-#### SSH node open dial no longer supported
-
-Teleport 14 no longer allows connecting to OpenSSH servers not registered with
-the cluster. Follow the updated agentless OpenSSH integration [guide](docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx)
-to register your OpenSSH nodes in the cluster’s inventory.
-
-You can set `TELEPORT_UNSTABLE_UNLISTED_AGENT_DIALING=yes` environment variable
-on Teleport proxy to temporarily re-enable the open dial functionality. The
-environment variable will be removed in Teleport 15.
-
-#### Proxy protocol default change
-
-Starting from version 14, Teleport will require users to explicitly enable or
-disable PROXY protocol in their `proxy_service`/`auth_service` configuration
-using `proxy_protocol: on|off` option.
-
-Users who run their proxies behind L4 load balancers with PROXY protocol
-enabled, should set `proxy_protocol: on`.  Users who don’t run Teleport behind
-PROXY protocol enabled load balancers, should disable `proxy_protocol: off`
-explicitly for security reasons.
-
-By default, Teleport will accept the PROXY line but will prevent connections
-with IP pinning enabled. IP pinning users will need to explicitly enable/disable
-proxy protocol like explained above.
-
-See more details in our [documentation](docs/pages/admin-guides/management/security/proxy-protocol.mdx).
-
-#### Legacy deb/rpm package repositories are deprecated
-
-Teleport 14 will be the last release published to the legacy package
-repositories at `deb.releases.teleport.dev` and `rpm.releases.teleport.dev`.
-Starting with Teleport 15, packages will only be published to the new
-repositories at `apt.releases.teleport.dev` and `yum.releases.teleport.dev`.
-
-All users are recommended to switch to `apt.releases.teleport.dev` and
-`yum.releases.teleport.dev` repositories as described in installation
-[instructions](docs/pages/installation.mdx).
-
-#### `Cf-Access-Token` header no longer included with requests to Teleport-protected applications
-
-Starting from Teleport 14, the `Cf-Access-Token` header containing the signed
-JWT token will no longer be included by default with all requests to
-Teleport-protected applications.
-All requests will still include `Teleport-JWT-Assertion` containing the JWT
-token.
-
-See documentation for details on how to inject the JWT token into any header
-using [header rewriting](docs/pages/enroll-resources/application-access/jwt/introduction.mdx#inject-jwt).
-
-#### tsh db CLI commands changes
-
-In Teleport 14 tsh db sub-commands will attempt to select a default value for
-`--db-user` or `--db-name` flags if they are not provided by the user by
-examining their allowed `db_users` and `db_names`.
-
-The flags `--cert-file` and `--key-file` for tsh proxy db command were also
-removed, in favor of the `--tunnel` flag that opens an authenticated local
-database proxy.
-
-#### MongoDB versions prior to 3.6 are no longer supported
-
-Teleport 14 includes an update to the MongoDB driver.
-
-Due to the MongoDB team dropping support for servers prior to version 3.6 (which
-reached EOL on April 30, 2021), Teleport also will no longer be able to support
-these old server versions.
-
-#### Symlinks for `~/.tsh/environment` no longer supported
-
-In order to strengthen the security in Teleport 14, file loading from home
-directories where the path includes a symlink is no longer allowed.  The most
-common use case for this is loading environment variables from the
-`~/.tsh/environment` file.  This will still work normally as long as the path
-includes no symlinks.
-
-#### Deprecated audit event
-
-Teleport 14 deprecates the `trusted_cluster_token.create` audit event, replacing
-it with a new `join_token.create` event. The new event is emitted when any join
-token is created, whether it be for trusted clusters or other Teleport services.
-
-Teleport 14 will emit both events when a trusted cluster join token is created.
-Starting in Teleport 15, the `trusted_cluster_token.create` event will no longer
-be emitted.
-
-### Other changes
-
-#### DynamoDB billing mode defaults to on-demand
-
-In Teleport 14, when creating new DynamoDB tables, Teleport will now create them
-with the billing mode set to `pay_per_request` instead of being set to provisioned
-mode.
-
-The old behavior can be restored by setting the `billing_mode` option in the
-storage configuration.
-
-#### Default role version is v7
-
-The default role version in Teleport 14 is `v7` which enables support for extended
-Kubernetes per-resource RBAC, and changes the `kubernetes_resources` default to
-wildcard for better getting started user experience.
-
-You can review role versions in the [documentation](docs/pages/reference/access-controls/roles.mdx).
-
-#### Stricter name validation for auto-discovered databases
-
-In Teleport 14, database discovery via `db_service` config enforces the same name
-validation as for databases created via tctl, static config, and
-`discovery_service`.
-
-As such, database names in AWS, GCP and Azure must start with a letter, contain
-only letters, digits, and hyphens and end with a letter or digit (no trailing
-hyphens).
-
-#### Access Request API changes
-
-Teleport 14 introduces a new and more secure API for submitting Access Requests.
-As a result, tsh users may be prompted to upgrade their clients before
-submitting an Access Request.
-
-#### Desktop discovery name change
-
-Desktops discovered via LDAP will have a short suffix appended to their name to
-ensure uniqueness. Users will notice duplicate desktops (with and without the
-suffix) for up to an hour after upgrading. Connectivity to desktops will not be
-affected, and the old record will naturally expire after 1 hour.
-
-#### Machine ID : New configuration schema
-
-Teleport 14 introduces a new configuration schema (v2) for Machine ID’s agent
-`tbot`.  The new schema is designed to be more explicit and more extensible:
-
-```yaml
-version: v2
-onboarding:
- token: gcp-bot
- join_method: gcp
-storage:
- type: memory
-auth_server: example.teleport.sh:443
-outputs:
- - type: identity
-   destination:
-     type: kubernetes_secret
-     name: my-secret
-​
- - type: kubernetes
-   kubernetes_cluster: my-cluster
-   destination:
-     type: directory
-     path: ./k8s
-​
- - type: database
-   service: my-postgres-service
-   database: postgres
-   username: postgres
-   destination:
-     type: directory
-     path: ./db
-​
- - type: application
-   app_name: my-app
-   destination:
-     type: directory
-     path: ./app
-```
-
-`tbot` will continue to support the v1 schema for several Teleport versions but it
-is recommended that you migrate to v2 as soon as possible to benefit from new
-Machine ID features.
-
-For more details and guidance on how to upgrade to v2, see [docs](https://github.com/gravitational/teleport/blob/branch/v14/docs/pages/reference/machine-id/v14-upgrade-guide.mdx).
-
-## 13.0.1 (05/xx/23)
-
-* Helm Charts
-  * Fixed issue with invite token being incorrectly overridden when it was manually created. [#26055](https://github.com/gravitational/teleport/pull/26055)
-
-### Breaking Changes
-
-Please familiarize yourself with the following potentially disruptive changes in
-Teleport 13 before upgrading.
-
-#### Teleport Kubernetes Agent helm chart
-
-When upgrading to Teleport 13, users of the Teleport Kubernetes Agent Helm chart
-that manually create their own Teleport token secret (`secretName=<secretName>` and no auth token provided)
-will need to set the following values:
-
-```yaml
-# Manages the join token secret creation and its name.
-joinTokenSecret:
-  # create controls whether the Helm chart should create and manage the join token
-  # secret.
-  # If false, the chart assumes that the secret with the configured name already exists at the
-  # installation namespace.
-  create: false
-  # Name of the Secret to store the teleport join token.
-  name: <secretName>
-```
-
-The Helm chart parameter `secretName` was deprecated in Teleport 13 in favor of
-`joinTokenSecret.name`. `joinTokenSecret.create` indicates whether the Helm
-chart should create and manage the join token secret. If `create` is set to
-`false`, the chart assumes that the secret with the configured name already
-exists at the installation namespace.
-
-## 13.0.0 (05/08/23)
-
-Teleport 13 brings the following marquee features and improvements:
-
-* (Preview) Automatic agent upgrades.
-* (Preview) TLS routing through ALB for accessing servers, Kubernetes clusters, and applications.
-* (Preview, Enterprise-only) Ability to import applications and groups from Okta.
-* (Preview) Teleport support for AWS OpenSearch.
-* (Preview) View and control access to OpenSSH nodes natively in Teleport.
-* Cross-cluster search for Teleport Connect.
-* Performance improvements for accessing Kubernetes clusters.
-* Universal binaries (including Apple Silicon) for macOS.
-* Simplified RDS onboarding flow in Access Management UI.
-* Light theme for Web UI.
-
-### (Preview) Automatic agent upgrades
-
-In Teleport 13 users can configure their Teleport agents deployed via apt/yum
-repositories or a Helm chart to be upgraded automatically.
-
-### (Preview) TLS routing through ALB accessing servers, Kubernetes clusters, and applications
-
-Teleport 13 adds single-port TLS routing mode support for servers, Kubernetes
-clusters, and applications for clusters deployed behind application layer load
-balancers such as AWS ALB.
-
-### (Preview, Enterprise-only) Ability to import applications and groups from Okta
-
-In Teleport 13  users can import apps and groups from Okta and use Teleport
-Access Requests for requesting short-term access to them. This feature is only
-available in the Teleport Enterprise edition.
-
-### (Preview) Teleport support for AWS OpenSearch
-
-Teleport users can now connect to AWS OpenSearch databases.
-
-### (Preview) View and control access to OpenSSH nodes natively in Teleport
-
-In Teleport 13 users will be able register OpenSSH nodes as a resource with the
-cluster.
-
-This will allow users to view the OpenSSH nodes in Web UI and using `tsh ls`
-and use RBAC to control access to them.
-
-See the updated [OpenSSH integration
-guide](docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx).
-
-### Cross-cluster search for Teleport Connect
-
-Teleport Connect now includes a new search experience, allowing you to search
-for and connect to resources across all logged-in clusters.
-
-### Performance improvements for accessing Kubernetes clusters
-
-In Teleport 13 we improved the way the Teleport Proxy Service handles Kubernetes
-credentials.
-
-Users will experience better performance when interacting with Kubernetes
-clusters using kubectl or via the API.
-
-### Universal binaries (including Apple Silicon) for macOS
-
-Teleport 13 binaries (including Teleport Connect) will have universal
-architecture and run natively on both Intel and ARM macOS systems.
-
-### Simplified RDS onboarding flow in Access Management UI
-
-When connecting an RDS database using Teleport 13 Access Management UI, users
-can connect their AWS account and select the RDS database to add instead of
-entering details manually.
-
-To try out the new flow, add an RDS database using the Resource Management UI
-in your cluster’s Web UI dashboard.
-
-### Light theme for Web UI
-
-Teleport's web UI includes an optional light theme.
-
-The light theme is enabled by default but can be changed back to the dark theme
-via the top-right corner user settings menu.
-
-### Windows desktop session recording export
-
-Session recordings for Windows desktop sessions can now be exported to video
-format for offline playback with the new tsh recordings export command.
-
-### SFTP in Moderated Sessions
-
-Teleport 13 adds the ability to transfer files in Moderated Sessions.
-This feature requires that both the session originator and the moderator
-have joined the session via the web UI.
-
-### Breaking changes
-
-Please familiarize yourself with the following potentially disruptive changes
-in Teleport 13 before upgrading.
-
-#### Default session join mode
-
-Teleport 13 defaults to observer (read-only) mode when joining SSH and Kubernetes
-sessions. Prior versions of Teleport would default to peer mode for SSH sessions
-and moderator mode for Kubernetes sessions. To override the default join mode,
-specify the --mode flag with tsh join.
-
-#### CA rotation deprecation
-
-Teleport 13 removes support for rotating all certificate authorities with
-`tctl auth rotate --type=all`. The `type` flag is now required, which ensures
-that only one CA is rotated at a time, increasing cluster stability during
-rotations.
-
-#### Join token API changes
-
-The default 30-minute expiry no longer applies to tokens created via YAML
-resource files. If you want to enforce an expiration, ensure this is set in the
-`metadata.expires` field. Tokens created using `tctl nodes add` and `tctl tokens add`
-will continue to have a default 30m expiry applied.
-
-Additionally, users of Teleport’s API module will note that the `CreateToken`
-and `UpsertToken` RPCs are now deprecated in favor of `CreateTokenV2` and
-`UpsertTokenV2`. The new V2 variants no longer have a default expiry, so be sure
-to set a TTL if you want your tokens to expire.
-
-The original RPCs are still supported in Teleport 13 and will be removed
-completely for Teleport 14.
-
-#### Enhanced user validation
-
-Teleport 13 will refuse to create or update users that reference non-existent
-roles. In some circumstances, older versions of Teleport would permit you to
-create users and assign them invalid roles. In Teleport 13 this is a hard error.
-
-#### Quay.io registry
-
-Quay.io registry was deprecated in Teleport 11 and starting with Teleport 13,
-Teleport container images are no longer being published to it.
-
-Users should use the [public ECR
-registry](https://gallery.ecr.aws/gravitational).
-
-#### Helm chart uses `distroless`-based container image by default
-
-Starting with Teleport 13, the Helm charts `teleport-cluster` and `teleport-kube-agent`
-are deploying distroless Teleport images by default. Those images are slimmer
-and more secure but contain less tooling (e.g. neither `bash` nor
-`apt` are available).
-
-The Debian-based images are deprecated and will be removed in Teleport 14.
-The chart image can be reverted back to the Debian-based images by setting:
-```yaml
-image: "public.ecr.aws/gravitational/teleport"
-```
-
-For debugging purposes, a "debug" image is available and contains BusyBox,
-which includes a shell and most common POSIX executables:
-`public.ecr.aws/gravitational/teleport-distroless-debug`.
-
-## 12.3.0 (05/01/23)
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Desktop Access
-  * Added support for automatic Windows user creation. [#25348](https://github.com/gravitational/teleport/pull/25348)
-* CLI
-  * Fixed MFA permission denied error from `tsh` for non-SSH protocols. [#25430](https://github.com/gravitational/teleport/pull/25430)
-* Terraform
-  * Fixed `AccessControlListNotSupported` error in HA terraform. [#25335](https://github.com/gravitational/teleport/pull/25335)
-* Device Trust
-  * Updated Device Trust audit events to have descriptive types. [#25320](https://github.com/gravitational/teleport/pull/25320)
-
-## 12.2.5 (04/28/23)
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Auth
-  * Fixed issue where Github SSO would fail if a user is a part of more than 30 teams. [#25098](https://github.com/gravitational/teleport/pull/25098)
-  * Fixed issue with `tsh login` with "required" hardware key policy returning "policy not met" error. [#24956](https://github.com/gravitational/teleport/pull/24956)
-  * Improved Device Trust logging and error reporting. [#24912](https://github.com/gravitational/teleport/pull/24912)
-  * Detect and warn about RPID changes when using WebAuthn. [#25289](https://github.com/gravitational/teleport/pull/25289)
-* Access Management
-  * Fixed issue with running install script on macOS for enterprise clusters. [#25076](https://github.com/gravitational/teleport/pull/25076)
-* Server Access
-  * Fixed issue with headless `tsh ssh` not working when used in `rsync -rsh`. [#25242](https://github.com/gravitational/teleport/pull/25242)
-  * Fixed issue with headless `tsh ssh` prompting users for MFA. [#25187](https://github.com/gravitational/teleport/pull/25187)
-  * Fixed issue with `tsh ssh` failing to connect over public address with per-session MFA. [#25223](https://github.com/gravitational/teleport/pull/25223)
-  * Fixed issue with `tsh scp` failing on some destination paths. [#24861](https://github.com/gravitational/teleport/pull/24861)
-  * Require explicit username in headless `tsh ssh`. [#25112](https://github.com/gravitational/teleport/pull/25112)
-  * Updated automatic user provisioning to sort sudoers lines by role name to ensure stable order. [#24792](https://github.com/gravitational/teleport/pull/24792)
-  * Updated `tsh` commands to recognize `SSH_` environment variables. [#24470](https://github.com/gravitational/teleport/pull/24470)
-* Database Access
-  * Fixed issue with `tsh db env` and `tsh db config` not recognizing separate MySQL listener. [#24827](https://github.com/gravitational/teleport/pull/24827)
-* Kubernetes Access
-  * Added `--set-context` flag to `tsh kube login` to allow overriding default context name. [#25253](https://github.com/gravitational/teleport/pull/25253)
-* IdP
-  * Fixed issue with SAML IdP not being disabled properly. [#25309](https://github.com/gravitational/teleport/pull/25309)
-* IP Pinning
-  * Fixed interoperability issues with load balancers with proxy protocol v2 enabled. [#25302](https://github.com/gravitational/teleport/pull/25302)
-* CLI
-  * Fixed issue with cluster alerts sometimes not showing up after `tsh login`. [#25300](https://github.com/gravitational/teleport/pull/25300)
-* AMIs
-  * Fixed issue with startup script failing to acquire lock from AWS metadata. [#25296](https://github.com/gravitational/teleport/pull/25296)
-* HSM
-  * Fixed issue with inadvertent deletion of active HSM keys when using YubiHSM2 SDK version 2023.1. [#25208](https://github.com/gravitational/teleport/pull/25208)
-* Performance & Scalability
-  * Improved performance of MFA ceremony. [#24804](https://github.com/gravitational/teleport/pull/24804)
-
-## 12.2.4 (04/18/23)
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Auto-discovery
-  * Added ability to specify discovery group for discovery services. [#24716](https://github.com/gravitational/teleport/pull/24716)
-* CLI
-  * Improved `tsh` performance on some Windows systems. [#24573](https://github.com/gravitational/teleport/pull/24573)
-  * Improved `teleport configure` error/warning reporting. [#24676](https://github.com/gravitational/teleport/pull/24676)
-  * Added `--raw` flag to `teleport version` command. [#24772](https://github.com/gravitational/teleport/pull/24772)
-* Configuration
-  * Prevent proxies from trying to join cluster over reverse tunnel. [#24668](https://github.com/gravitational/teleport/pull/24668)
-* Server Access
-  * Fixed issue with excessive audit logging when copying files over SFTP. [#24831](https://github.com/gravitational/teleport/pull/24831)
-  * Fixed issue with `tsh scp` not recognizing wildcard patterns. [#24831](https://github.com/gravitational/teleport/pull/24831)
-  * Fixed issue with `tsh scp` failing when max sessions is set to 1. [#24831](https://github.com/gravitational/teleport/pull/24831)
-  * Improved error reporting from `tsh scp` when file copying is disabled. [#24831](https://github.com/gravitational/teleport/pull/24831)
-* Kubernetes Access
-  * Fixed issue with `tctl auth sign` not respecting `kube_public_addr`. [#24516](https://github.com/gravitational/teleport/pull/24516)
-  * Fixed memory leak when using port forwarding. [#24763](https://github.com/gravitational/teleport/pull/24763)
-  * Reduced log spam when using port forwarding. [#24658](https://github.com/gravitational/teleport/pull/24658)
-* Database Access
-  * Updated `teleport db configure` to support more AWS databases. [#24494](https://github.com/gravitational/teleport/pull/24494)
-* Performance & Scalability
-  * Reduced thundering herd effect in large clusters. [#24719](https://github.com/gravitational/teleport/pull/24719)
-* Web UI
-  * Fixed issue with downloading files from leaf clusters when per-session MFA is enabled. [#24768](https://github.com/gravitational/teleport/pull/24768)
-
-## 12.2.3 (04/13/23)
-
-This release of Teleport contains multiple bug fixes.
-
-* CLI
-  * Fixed potential panic in `tsh ssh`. [#24490](https://github.com/gravitational/teleport/pull/24490)
-* Performance & Scalability
-  * Improved `tsh ssh` latency. [#24371](https://github.com/gravitational/teleport/pull/24371)
-* Kubernetes Access
-  * Fixed issue with moderator joining session on a cluster they don't have access to. [#23993](https://github.com/gravitational/teleport/pull/23993)
-* Security
-  * Added IP pinning support to SSO users. [#24541](https://github.com/gravitational/teleport/pull/24541)
-
-## 12.2.2 (04/12/23)
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Server Access
-  * Restored `MajorVersion` template variable for EC2 install scripts. [#24434](https://github.com/gravitational/teleport/pull/24434)
-  * Added `--mlock` flag to headless `tsh` mode to allow memory locking. [#24410](https://github.com/gravitational/teleport/pull/24410)
-  * Fixed issue with EC2 install script silently failing on errors. [#24034](https://github.com/gravitational/teleport/pull/24034)
-* Database Access
-  * Reduced log spam when AWS database engine name is not recognized. [#24413](https://github.com/gravitational/teleport/pull/24413)
-* Machine ID
-  * Improved post-renewal message by logging correct identity. [#24246](https://github.com/gravitational/teleport/pull/24246)
-* Kubernetes Access
-  * Fixed issue with incorrect status being returned on exec commands. [#24155](https://github.com/gravitational/teleport/pull/24155)
-* Proxy Peering
-  * Improved agent reconnect speed with proxy peering. [#24141](https://github.com/gravitational/teleport/pull/24141)
-* Helm Charts
-  * Fixed issue with `securityContext` and `nodeSelector` not being propagated to job hooks. [#24134](https://github.com/gravitational/teleport/pull/24134)
-  * Fixed issue with TLS routing being disabled after v12 upgrade when `proxyListenerMode` is empty. [#24426](https://github.com/gravitational/teleport/pull/24426)
-
-## 12.2.1 (04/04/23)
-
-This release of Teleport contains several new features and improvements.
-
-* Server Access
-  * Added support for headless SSO to `tsh ls`, `tsh ssh` and `tsh scp`. [#23360](https://github.com/gravitational/teleport/pull/23360)
-* Database Access
-  * Added support for connecting to Oracle databases. [#23892](https://github.com/gravitational/teleport/pull/23892)
-* Moderated Sessions
-  * Fixed issue with joining moderated sessions via Web UI. [#24018](https://github.com/gravitational/teleport/pull/24018)
-* Helm Charts
-  * Added support for `imagePullSecrets` to `teleport-cluster` chart. [#24017](https://github.com/gravitational/teleport/pull/24017)
-* Security
-  * Added IP pinning support to Kubernetes and database access. [#23418](https://github.com/gravitational/teleport/pull/23418)
-* Tooling
-  * Upgraded Go to `1.20.3`. [#24062](https://github.com/gravitational/teleport/pull/24062)
-
-## 12.1.5 (03/30/23)
-
-This release of Teleport contains 2 security fixes as well as multiple improvements and bug fixes.
-
-### [High] OS authorization bypass in SSH tunneling
-
-When establishing an SSH port forwarding connection, Teleport did not
-sufficiently validate the specified OS principal.
-
-This could allow an attacker in possession of valid cluster credentials to
-establish a TCP tunnel to a node using a non-existent Linux user.
-
-The connection attempt would show up in the audit log as a "port" audit event
-(code T3003I) and include Teleport username in the "user" field.
-
-### [High] Teleport authorization bypass in Kubernetes cluster access
-
-When authorizing a request to a Teleport-protected Kubernetes cluster, Teleport
-did not adequately validate the target Kubernetes cluster.
-
-This could allow an attacker in possession of valid Kubernetes agent credentials
-or a join token to trick Teleport into forwarding requests to a different
-Kubernetes cluster.
-
-Every Kubernetes request would show up in the audit log as a "kube.request"
-audit event (code T3009I) and include the Kubernetes cluster metadata.
-
-### Other improvements and fixes
-
-* AMIs
-  * Added support for configuring TLS routing mode in AMIs. [#23678](https://github.com/gravitational/teleport/pull/23678)
-* Application Access
-  * Added support for application access behind ALB. [#23054](https://github.com/gravitational/teleport/pull/23054)
-  * Fixed requests to Teleport-protected applications being redirected to leaf's public address in some cases. [#23220](https://github.com/gravitational/teleport/pull/23220)
-  * Reduced log noise. [#23365](https://github.com/gravitational/teleport/pull/23365)
-  * Added ability to specify command in AWS `tsh` proxy. [#23835](https://github.com/gravitational/teleport/pull/23835)
-* Bootstrap
-  * Added provision tokens support. [#23474](https://github.com/gravitational/teleport/pull/23474)
-* CLI
-  * Added `app_server` support to `tctl` resource commands. [#23136](https://github.com/gravitational/teleport/pull/23136)
-  * Display year in `tctl` commands output. [#23371](https://github.com/gravitational/teleport/pull/23371)
-  * Fixed issue with `tsh` reporting errors about missing webauthn.dll on Windows. [#23161](https://github.com/gravitational/teleport/pull/23161)
-  * Updated `tsh status` to not display internal logins. [#23411](https://github.com/gravitational/teleport/pull/23411)
-  * Added `--cluster` flag to `tsh kube sessions` command. [#23825](https://github.com/gravitational/teleport/pull/23825)
-  * Fixed issue with invalid TLS mode when creating database resources. [#23808](https://github.com/gravitational/teleport/pull/23808)
-* Database Access
-  * Added support for canceling in-progress PostgreSQL requests in database access. [#23467](https://github.com/gravitational/teleport/pull/23467)
-  * Fixed issue with query audit events always having `success: false` status. [#23274](https://github.com/gravitational/teleport/pull/23274)
-* Desktop Access
-  * Updated setup script to be idempotent. [#23176](https://github.com/gravitational/teleport/pull/23176)
-* Helm Charts
-  * Added ability to set resource limits and requests for pre-deployment jobs. [#23126](https://github.com/gravitational/teleport/pull/23126)
-* Infrastructure
-  * Introduced distroless Teleport container images. [#22814](https://github.com/gravitational/teleport/pull/22814)
-* Kubernetes Access
-  * Fixed issue with `tsh kube credentials` failing on remote clusters. [#23354](https://github.com/gravitational/teleport/pull/23354)
-  * Fixed issue with `tsh kube credentials` loading incorrect profile. [#23716](https://github.com/gravitational/teleport/pull/23716)
-* Machine ID
-  * Added ability to specify memory backend using CLI parameters. [#23495](https://github.com/gravitational/teleport/pull/23495)
-  * Added support for Azure delegated joining. [#23391](https://github.com/gravitational/teleport/pull/23391)
-  * Added support for Gitlab delegated joining. [#23191](https://github.com/gravitational/teleport/pull/23191)
-  * Added support for trusted clusters. [#23390](https://github.com/gravitational/teleport/pull/23390)
-  * Added FIPS support. [#23850](https://github.com/gravitational/teleport/pull/23850)
-* Proxy Peering
-  * Fixed proxy peering issues when running behind a load balancer. [#23506](https://github.com/gravitational/teleport/pull/23506)
-* Reverse Tunnels
-  * Fixed issue when joining leaf cluster over tunnel port with enabled proxy protocol. [#23487](https://github.com/gravitational/teleport/pull/23487)
-  * Fixed issue with joining agents over reverse tunnel port. [#23332](https://github.com/gravitational/teleport/pull/23332)
-* Performance & scalability
-  * Improved `tsh ls -R` performance in large clusters. [#23596](https://github.com/gravitational/teleport/pull/23596)
-  * Improved performance when setting session environment variables. [#23834](https://github.com/gravitational/teleport/pull/23834)
-* Server Access
-  * Fixed issue with successful SFTP transfers returning non-zero code. [#23729](https://github.com/gravitational/teleport/pull/23729)
-* SSO
-  * Fixed issue with Github Enterprise SSO not working with custom URLs. [#23568](https://github.com/gravitational/teleport/pull/23568)
-* Teleport Connect
-  * Added support for config customization. [#23197](https://github.com/gravitational/teleport/pull/23197)
-  * Fixed unresponsive terminal on Windows Server 2019. [#22996](https://github.com/gravitational/teleport/pull/22996)
-* Tooling
-  * Updated Electron to `22.3.2`. [#23048](https://github.com/gravitational/teleport/pull/23048)
-  * Updated Go to `1.20.2`. [#22997](https://github.com/gravitational/teleport/pull/22997)
-  * Updated Rust to `1.68.0`. [#23101](https://github.com/gravitational/teleport/pull/23101)
-* Web UI
-  * Added MFA support when copying files. [#23195](https://github.com/gravitational/teleport/pull/23195)
-  * Fixed "ambiguous node" error when downloading files. [#23152](https://github.com/gravitational/teleport/pull/23152)
-  * Fixed intermittent "client connection is closing" errors in web UI after logging in. [#23733](https://github.com/gravitational/teleport/pull/23733)
-
-## 12.1.1
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with Access Management's connection tester not working with per-session MFA. [#22918](https://github.com/gravitational/teleport/pull/22918), [#22943](https://github.com/gravitational/teleport/pull/22943)
-* Fixed Kubernetes access panic when using moderated sessions. [#22930](https://github.com/gravitational/teleport/pull/22930)
-* Fixed `tsh db config` reporting incorrect port in TLS routing mode. [#22889](https://github.com/gravitational/teleport/pull/22889)
-* Fixed issue with Teleport always performing OS group check even without auto user provisioning enabled. [#22805](https://github.com/gravitational/teleport/pull/22805)
-* Fixed issue with desktop access crashing on systems that consume many file descriptors. [#22798](https://github.com/gravitational/teleport/pull/22798)
-* Fixed issue with `teleport start --bootstrap` command failing on unexpected resource. [#22721](https://github.com/gravitational/teleport/pull/22721)
-* Fixed issue with install script not refreshing repository metadata before installing new version. [#22585](https://github.com/gravitational/teleport/pull/22585)
-* Added ability to export database CA in DER format via `tctl auth export`. [#22896](https://github.com/gravitational/teleport/pull/22896)
-* Reduced log spam from proxy multiplexer. [#22802](https://github.com/gravitational/teleport/pull/22802)
-* Updated EC2 auto-discovery install script to use enterprise binaries for enterprise clusters. [#22769](https://github.com/gravitational/teleport/pull/22769)
-* Upgraded Go to `v1.19.7`. [#22725](https://github.com/gravitational/teleport/pull/22725)
-* Improved idle connections handling. [#22908](https://github.com/gravitational/teleport/pull/22908), [#22893](https://github.com/gravitational/teleport/pull/22893)
-* Improved Kubernetes service labels validation upon startup. [#22777](https://github.com/gravitational/teleport/pull/22777)
-* Improved `tsh login` error reporting when proxy is not available. [#22763](https://github.com/gravitational/teleport/pull/22763)
-
-## 12.1.0
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Added ability for Teleport to function as SAML IdP (Enterprise edition only).
-* Downgraded Go to `v1.19.6` to resolve memory leak issues. [#22691](https://github.com/gravitational/teleport/pull/22691)
-* Fixed issue with `tsh scp` overriding copied file permissions without `-p` flag. [#22609](https://github.com/gravitational/teleport/pull/22609)
-* Improved performance of fetching remote clusters. [#22575](https://github.com/gravitational/teleport/pull/22575)
-
-## 12.0.5
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with `tsh` not respecting HTTPS_PROXY in some cases. [#22492](https://github.com/gravitational/teleport/pull/22492)
-* Fixed issue with config validation in Helm charts scratch mode. [#22423](https://github.com/gravitational/teleport/pull/22423)
-* Added IAM joining support for Azure VMs. [#22204](https://github.com/gravitational/teleport/pull/22204)
-* Added auto-discovery support for Azure VMs. [#22521](https://github.com/gravitational/teleport/pull/22521)
-* Added support for `ap-southeast-4` AWS region for IAM joining. [#22486](https://github.com/gravitational/teleport/pull/22486)
-* Added ability to specify web terminal scrollback length in proxy config. [#22422](https://github.com/gravitational/teleport/pull/22422)
-* Added support for PuTTY's `winadj` channel requests. [#22420](https://github.com/gravitational/teleport/pull/22420)
-* Added `--trace-profile` flag to `tsh` that allows generating runtime trace profiles. [#22406](https://github.com/gravitational/teleport/pull/22406)
-* Added enhanced session recording support for arm64 architectures. [#22550](https://github.com/gravitational/teleport/pull/22550)
-* Updated `tctl alert ack` to allow acknowledging alerts of any severity. [#22582](https://github.com/gravitational/teleport/pull/22582)
-* Updated Windows desktop access to display only applicable logins. [#22333](https://github.com/gravitational/teleport/pull/22333)
-* Improved Kubernetes access performance when using `kubectl`. [#22508](https://github.com/gravitational/teleport/pull/22508)
-* Improved Teleport Connect performance when connecting to large clusters. [#22316](https://github.com/gravitational/teleport/pull/22316)
-* Improved performance and scalability in large clusters. [#21495](https://github.com/gravitational/teleport/pull/21495)
-
-## 12.0.4
-
-This release of Teleport contains multiple security fixes, improvements and bug fixes.
-
-### Security fixes
-
-* Fixed issue with malicious SQL Server packet being able to cause proxy crash. [#21638](https://github.com/gravitational/teleport/pull/21638)
-* Fixed issue with session terminated after a short delay instead of being immediately paused when moderator leaves. [#21974](https://github.com/gravitational/teleport/pull/21974)
-
-### Other improvements and bug fixes
-
-* Fixed issue with orphaned child processes after session ends. [#22222](https://github.com/gravitational/teleport/pull/22222)
-* Fixed issue with not being able to see any pods with an active Access Request. [#22196](https://github.com/gravitational/teleport/pull/22196)
-* Fixed issue with remote cluster state not always being correctly updated. [#22088](https://github.com/gravitational/teleport/pull/22088)
-* Fixed heartbeat errors from the Database Service. [#22087](https://github.com/gravitational/teleport/pull/22087)
-* Fixed issue with applications temporarily disappearing during Application Service restart. [#21807](https://github.com/gravitational/teleport/pull/21807)
-* Fixed issue with some Helm values being accidentally shared between Auth Service and Proxy Service configs. [#21768](https://github.com/gravitational/teleport/pull/21768)
-* Fixed issues with desktop access flow in Access Management interface. [#21756](https://github.com/gravitational/teleport/pull/21756)
-* Fixed "access denied" errors in Teleport Connect on Windows. [#21720](https://github.com/gravitational/teleport/pull/21720)
-* Fixed issue with database GUI client connections requiring random taps when per-session MFA is enabled. [#21661](https://github.com/gravitational/teleport/pull/21661)
-* Fixed issue with moderated sessions not working on leaf clusters. [#21612](https://github.com/gravitational/teleport/pull/21612)
-* Fixed issue with missing `--request-id` flag in UI for Kubernetes login instructions. [#21445](https://github.com/gravitational/teleport/pull/21445)
-* Fixed issue connecting to AWS resources when using full IAM role ARNs. [#21251](https://github.com/gravitational/teleport/pull/21251)
-* Fixed issue with `local_auth: false` setting being ignored without explicitly setting `authentication_type`. [#22215](https://github.com/gravitational/teleport/pull/22215)
-* Added `tctl` resource commands for Device Trust. [#22157](https://github.com/gravitational/teleport/pull/22157)
-* Added support for assuming roles in `tsh proxy aws`. [#21990](https://github.com/gravitational/teleport/pull/21990)
-* Added early feedback for successful security key taps in `tsh`. [#21780](https://github.com/gravitational/teleport/pull/21780)
-* Added device lock support. [#21751](https://github.com/gravitational/teleport/pull/21751)
-* Added support for security contexts in `teleport-kube-agent` Helm chart. [#21535](https://github.com/gravitational/teleport/pull/21535)
-* Updated `tsh version` command to display client version only via `--client` flag. [#22167](https://github.com/gravitational/teleport/pull/22167)
-* Updated install script to use enterprise packages for enterprise clusters. [#22109](https://github.com/gravitational/teleport/pull/22109)
-* Updated install script to use deb/rpm repositories. [#22108](https://github.com/gravitational/teleport/pull/22108)
-* Updated proxy init container in Helm charts to use security context. [#22064](https://github.com/gravitational/teleport/pull/22064)
-* Updated `tsh` to include timestamps with debug logs. [#21996](https://github.com/gravitational/teleport/pull/21996)
-* Updated AWS access to fetch credentials with TTL matching user's certificate TTL. [#21994](https://github.com/gravitational/teleport/pull/21994)
-* Updated Go toolchain to `1.20.1`. [#21931](https://github.com/gravitational/teleport/pull/21931)
-* Updated `tsh kube login --all` to not require cluster name. [#21765](https://github.com/gravitational/teleport/pull/21765)
-* Updated `teleport db configure create` command to support more use-cases. [#21690](https://github.com/gravitational/teleport/pull/21690)
-* Improved performance in large clusters with etcd backend. [#21905](https://github.com/gravitational/teleport/pull/21905), [#21496](https://github.com/gravitational/teleport/pull/21496)
-
-## 12.0.2
-
-This release of Teleport contains a security fix as well as multiple improvements and bug fixes.
-
-### OpenSSL update
-
-* Updated OpenSSL to `1.1.1t`. [#21425](https://github.com/gravitational/teleport/pull/21425)
-
-### Other fixes and improvements
-
-* Fixed issue with Access Manager interface not accepting valid port numbers. [#21651](https://github.com/gravitational/teleport/pull/21651)
-* Fixed issue with some requests  to Teleport-protected applications failing after proxy restart. [#21615](https://github.com/gravitational/teleport/pull/21615)
-* Fixed issue with invalid role template namespaces leading to cluster lockouts. [#21573](https://github.com/gravitational/teleport/pull/21573)
-* Fixed issue with Teleport Connect failing to recognize logged in user sometimes. [#21467](https://github.com/gravitational/teleport/pull/21467)
-* Fixed issue with the back button not working in Web UI navigation. [#21236](https://github.com/gravitational/teleport/pull/21236)
-* Fixed issue with Web UI SSH player having scroll bars. [#20868](https://github.com/gravitational/teleport/pull/20868)
-* Added support for `tsh request search --kind=pod` command. [#21456](https://github.com/gravitational/teleport/pull/21456)
-* Updated `tsh db configure create` to require flag for dynamic resources matching. [#21395](https://github.com/gravitational/teleport/pull/21395)
-* Improved reconnect stability after Database Service restart. [#21635](https://github.com/gravitational/teleport/pull/21635)
-* Improved reconnect stability after Kubernetes service restart.[#21617](https://github.com/gravitational/teleport/pull/21617)
-* Improved `tsh ls -R` performance. [#21577](https://github.com/gravitational/teleport/pull/21577)
-* Improved `tsh scp` error message when no remote path is specified. [#21373](https://github.com/gravitational/teleport/pull/21373)
-* Improved error message when trying to rename resource. [#21179](https://github.com/gravitational/teleport/pull/21179)
-* Reduced CPU usage when using enhanced session recording. [#21437](https://github.com/gravitational/teleport/pull/21437)
-
-## 12.0.1
-
-Teleport 12 brings the following marquee features and improvements:
-
-- Device Trust (Preview, Enterprise only)
-- Passwordless Windows access for local users (Preview, Enterprise only)
-- Per-pod RBAC for Kubernetes access (Preview)
-- Azure and GCP CLI support for application access (Preview)
-- Support for more databases in database access:
-  - Amazon DynamoDB
-  - Amazon Redshift Serverless
-  - AWS RDS Proxy for PostgreSQL/MySQL
-  - Azure SQLServer Auto Discovery
-  - Azure Flexible Servers
-- Refactored Helm charts (Preview)
-- Dropped support for SHA1 in server access
-- Signed/notarized macOS binaries
-
-### Device Trust (Preview, Enterprise only)
-
-Teleport 12 includes a preview of our upcoming Device Trust feature, which
-allows administrators to require that Teleport access is performed from an
-authenticated and trusted device.
-
-This preview release requires macOS and a native client like tsh or Teleport
-Connect. These clients leverage the Secure Enclave on macOS to solve device
-challenges issued by the Teleport CA, proving their identity as a trusted
-device.
-
-Teleport features requiring the web UI (desktop access, application access) are
-not currently supported.
-
-### Passwordless Windows Access for Local Users (Preview, Enterprise only)
-
-Teleport 12 brings passwordless certificate-based authentication to Windows
-desktops in environments where Active Directory is not available. This feature
-requires the installation of a Teleport package on each Windows desktop.
-
-### Per-pod RBAC for Kubernetes access (Preview)
-
-Teleport 12 extends RBAC to support controlling access to individual pods in
-Kubernetes clusters. Pod RBAC integrates with existing Teleport RBAC features
-such as role templating and Access Requests.
-
-### Azure and GCP CLI support for application access (Preview)
-
-In Teleport 12 administrators can interact with Azure and GCP APIs through the
-Application Service using `tsh az` and `tsh gcloud` CLI commands, or using
-standard `az` and `gcloud` tools through the local application proxy.
-
-### Support for more databases in database access
-
-Database access in Teleport 12 brings a number of new integrations to AWS-hosted
-databases such as DynamoDB (now with audit log support), Redshift Serverless and
-RDS Proxy for PostgreSQL/MySQL.
-
-On Azure, database access adds SQLServer auto-discovery and support for Azure
-Flexible Server for PostgreSQL/MySQL.
-
-### Refactored Helm charts (Preview)
-
-The “teleport-cluster” Helm chart underwent significant refactoring in Teleport
-12 to provide better scalability and UX. Proxy and Auth are now separate
-deployments and the new “scratch” chart mode makes it easier to provide a custom
-Teleport config.
-
-### Dropped support for SHA1 in Teleport-protected servers
-
-Newer OpenSSH clients connecting to Teleport 12 clusters no longer need the
-“PubAcceptedKeyTypes” workaround to include the deprecated “sha” algorithm.
-
-### Signed/notarized macOS binaries
-
-Users who download Teleport 12 Darwin binaries would no longer get an untrusted
-software warning from macOS.
-
-### tctl edit
-
-tctl now supports an edit subcommand, allowing you to edit resources directly in
-your preferred text editor.
-
-### Breaking Changes
-
-Please familiarize yourself with the following potentially disruptive changes in
-Teleport 12 before upgrading.
-
-#### Helm charts
-
-The teleport-cluster Helm chart underwent significant changes in Teleport 12.
-
-Additionally, PSPs are removed from the chart when installing on Kubernetes 1.23
-and higher to account for the deprecation/removal of PSPs by Kubernetes.
-
-#### tctl auth export
-
-The tctl auth export command only exports the private key when passing the
---keys flag. Previously it would output the certificate and private key
-together.
-
-#### Desktop access
-
-Windows Desktop sessions disable the wallpaper by default, improving
-performance. To restore the previous behavior, add `show_desktop_wallpaper: true`
-to your windows_desktop_service config.
-
-## 11.3.2
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed regression issue with accessing SSO apps behind application access. [#21049](https://github.com/gravitational/teleport/pull/21049)
-* Fixed regression performance issue with `tsh scp`. [#20953](https://github.com/gravitational/teleport/pull/20953)
-* Fixed issue with `tsh proxy aws --endpoint-url` not working. [#20880](https://github.com/gravitational/teleport/pull/20880)
-* Fixed issue with MongoDB queries failing on large datasets. [#21113](https://github.com/gravitational/teleport/pull/21113)
-* Fixed issue with direct node dial from web UI. [#20928](https://github.com/gravitational/teleport/pull/20928)
-* Updated install scripts to download binaries from new CDN location. [#21057](https://github.com/gravitational/teleport/pull/21057)
-* Updated `tsh` to detect unplugged devices when using hardware-backed keys. [#20949](https://github.com/gravitational/teleport/pull/20949)
-* Updated Elasticsearch access to explicitly require `--db-user`. (#20695) [#20919](https://github.com/gravitational/teleport/pull/20919)
-* Updated Rust to 1.67.0. [#20883](https://github.com/gravitational/teleport/pull/20883)
-
-## 11.3.1
-
-This release of Teleport contains a security fix, as well as multiple improvements and bug fixes.
-
-### Moderated Sessions
-
-* Fixed issue with moderated sessions not being disconnected on Ctrl+C. [#20588](https://github.com/gravitational/teleport/pull/20588)
-
-### Other fixes and improvements
-
-* Fixed issue with node install script downloading OSS binaries in Enterprise edition. [#20816](https://github.com/gravitational/teleport/pull/20816)
-* Fixed a regression when renewing Kubernetes dynamic credentials that prevented multiple renewals. [#20788](https://github.com/gravitational/teleport/pull/20788)
-* Fixed issue with `tctl auth sign` not respecting Ctrl-C. [#20773](https://github.com/gravitational/teleport/pull/20773)
-* Fixed occasional key attestation error in `tsh login`. [#20712](https://github.com/gravitational/teleport/pull/20712)
-* Fixed issue with being able to create Access Requests with invalid cluster name. [#20674](https://github.com/gravitational/teleport/pull/20674)
-* Fixed issue with EC2 auto-discovery install script for RHEL instances. [#20604](https://github.com/gravitational/teleport/pull/20604)
-* Fixed issue connecting with Oracle MySQL client on Windows. [#20599](https://github.com/gravitational/teleport/pull/20599)
-* Fixed issue with using `tctl auth sign --format kubernetes` against remote Auth Service instances. [#20571](https://github.com/gravitational/teleport/pull/20571)
-* Fixed panic in Azure SQL Server access. [#20483](https://github.com/gravitational/teleport/pull/20483)
-* Added support for Moderated Sessions in the Web UI. [#20796](https://github.com/gravitational/teleport/pull/20796)
-* Added support for Login Rules for SSO users. [#20743](https://github.com/gravitational/teleport/pull/20743), [#20738](https://github.com/gravitational/teleport/pull/20738), [#20737](https://github.com/gravitational/teleport/pull/20737), [#20629](https://github.com/gravitational/teleport/pull/20629)
-* Added ability to acknowledge alerts. [#20692](https://github.com/gravitational/teleport/pull/20692)
-* Added `client_idle_timeout_message` support to Windows access. [#20617](https://github.com/gravitational/teleport/pull/20617)
-* Added PodMonitor support in `teleport-cluster` Helm chart. [#20564](https://github.com/gravitational/teleport/pull/20564)
-* Added support for passing raw config in `teleport-kube-agent` Helm chart. [#20449](https://github.com/gravitational/teleport/pull/20449)
-* Added nodeSelector field to `teleport-cluster` Helm chart. [#20441](https://github.com/gravitational/teleport/pull/20441)
-* Improved Kubernetes access stability for slow clients. [#20517](https://github.com/gravitational/teleport/pull/20517)
-* Updated `teleport-cluster` Helm chart to reload proxy certificate daily. [#20503](https://github.com/gravitational/teleport/pull/20503)
-
-## 11.2.3
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with `tsh login` defaulting to passwordless and ignoring the `--auth` and `--mfa-mode` flags. [#20474](https://github.com/gravitational/teleport/pull/20474)
-* Fixed regression issue with AWS console access via `tsh aws`. [#20437](https://github.com/gravitational/teleport/pull/20437)
-* Fixed issue connecting to MariaDB in non-TLS Routing mode. [#20409](https://github.com/gravitational/teleport/pull/20409)
-* Fixed the `*:*` selector in EC2 auto-discovery. [#20390](https://github.com/gravitational/teleport/pull/20390)
-* Improved handling of unknown events in the events search API. [#20329](https://github.com/gravitational/teleport/pull/20329)
-* Added support for multiple transformations in role templates. [#20296](https://github.com/gravitational/teleport/pull/20296)
-* Added the ability to update a Trusted Cluster's role mappings without recreating the cluster. [#20286](https://github.com/gravitational/teleport/pull/20286)
-* Added `dnsConfig` support to the `teleport-kube-agent` Helm chart. [#20107](https://github.com/gravitational/teleport/pull/20107)
-
-## 11.2.2
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue connecting to leaf cluster nodes via web UI with per-session MFA. [#20238](https://github.com/gravitational/teleport/pull/20238)
-* Fixed issue with `max_kubernetes_connections` leading to access denied errors. [#20174](https://github.com/gravitational/teleport/pull/20174)
-* Fixed issue with `kube-agent` Helm chart leaving state behind after `helm uninstall`. [#20169](https://github.com/gravitational/teleport/pull/20169)
-* Fixed X.509 issue after updating RDS database resource. [#20099](https://github.com/gravitational/teleport/pull/20099)
-* Fixed issue with some `tsh` HTTP requests missing extra headers. [#20071](https://github.com/gravitational/teleport/pull/20071)
-* Improved auto-discovery config validation. [#20288](https://github.com/gravitational/teleport/pull/20288)
-* Improved graceful shutdown stability. [#20225](https://github.com/gravitational/teleport/pull/20225)
-* Improved application access authentication flow. [#20165](https://github.com/gravitational/teleport/pull/20165)
-* Reduced auth load by ensure proxy uses cache for periodic operations. [#20153](https://github.com/gravitational/teleport/pull/20153)
-* Updated Rust to `1.66.1`. [#20201](https://github.com/gravitational/teleport/pull/20201)
-* Updated macOS binaries to be signed and notarized. [#20305](https://github.com/gravitational/teleport/pull/20305)
-
-## 11.2.1
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Added support for periodically reloading the proxy's TLS certificates [#20040](https://github.com/gravitational/teleport/pull/20040)
-* Improved desktop certificate generation by using the proper field for querying a user's SID [#20022](https://github.com/gravitational/teleport/pull/20022)
-* Updated the web UI to hide the trusted clusters screen for users who lack the appropriate role [#1494](https://github.com/gravitational/webapps/pull/1494/)
-* Fixed an issue resulting in an "invalid bearer token" message [#20102](https://github.com/gravitational/teleport/pull/#20102)
-* Fixed an issue preventing bots from using IAM joining [#20011](https://github.com/gravitational/teleport/pull/20011)
-* Fixed an issue where Machine ID Certificates did not respect the provided TTL when using IAM joining [#20001](https://github.com/gravitational/teleport/pull/20001)
-* Updated to Go 1.19.5 [#20084](https://github.com/gravitational/teleport/pull/20084)
-
-## 11.2.0
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-### Machine ID GitHub Actions
-
-In addition, we're happy to announce a set of GitHub Actions that you can use in
-your workflows to assist with accessing Teleport Resources in your CI/CD pipelines.
-
-Visit the individual repositories to find out more and see usage examples:
-
-- https://github.com/teleport-actions/setup
-- https://github.com/teleport-actions/auth
-- https://github.com/teleport-actions/auth-k8s
-
-For a more in-depth guide, see our
-[documentation](./docs/pages/enroll-resources/machine-id/deployment/github-actions.mdx) for using
-Teleport with GitHub Actions.
-
-### Secure certificate mapping for desktop access
-
-Later this year, Windows will begin requiring a stronger mapping from a certificate
-to an Active Directory user. In anticipation of this change, Teleport 11.2.0 is compliant
-with the new requirements.
-
-*Warning:* This feature requires that Teleport's own service account also uses a strong
-mapping. In order to support this requirement, you must now set a new Security Identifier
-(`sid`) field in the LDAP configuration for your Windows Desktop Services. You can find
-the SID for your service account by running the following PowerShell snippet
-(replace `svc-teleport` with the name of the service account you are using):
-
-```
-Get-AdUser -Identity svc-teleport | Select SID
-```
-
-### Other improvements and bugfixes
-
-* Added an improved database joining flow in the web UI [#1487](https://github.com/gravitational/webapps/pull/1487)
-* Added support for secure certificate mapping for Windows desktop certificates [#19737](https://github.com/gravitational/teleport/pull/19737)
-* Fixed an issue with desktop directory sharing where large files could be corrupted [#1472](https://github.com/gravitational/webapps/pull/1472)
-* Fixed an issue where desktop access users may see a an error after ending a session [#1470](https://github.com/gravitational/webapps/pull/1470)
-* Fixed an issue preventing database agents from joining due to improperly formatted YAML [#19958](https://github.com/gravitational/teleport/pull/19958)
-* Updated the web UI to use session storage instead of local storage for Teleport's bearer token [#1470](https://github.com/gravitational/webapps/pull/1470)
-* Added rate limiting to SAML/OIDC routes [#19950](https://github.com/gravitational/teleport/pull/19950)
-* Fixed an issue connecting to leaf cluster desktops via reverse tunnel [#19945](https://github.com/gravitational/teleport/pull/19945)
-* Fixed a backwards compatibility issue with database access in 11.1.4 [#19940](https://github.com/gravitational/teleport/pull/19940)
-* Fixed an issue where Access Requests for Kubernetes clusters used improperly cached credentials [#19912](https://github.com/gravitational/teleport/pull/19912)
-* Added support for CentOS 7 in ARM64 builds [#19895](https://github.com/gravitational/teleport/pull/19895)
-* Added rate limiting to unauthenticated routes [#19869](https://github.com/gravitational/teleport/pull/19869)
-* Add suggested reviewers and requestable roles to Teleport Connect Access Requests [#19846](https://github.com/gravitational/teleport/pull/19846)
-* Fixed an issue listing all nodes with `tsh` [#19821](https://github.com/gravitational/teleport/pull/19821)
-* Made `gcp.credentialSecretName` optional in the Teleport Cluster Helm chart [#19803](https://github.com/gravitational/teleport/pull/19803)
-* Fixed an issue preventing audit events that exceed the maximum size limit from being logged [#19736](https://github.com/gravitational/teleport/pull/19736)
-* Fixed an issue preventing some users from being able to play desktop recordings [#19709](https://github.com/gravitational/teleport/pull/19709)
-* Added validation of AWS Account IDs when adding databases (#19638) [#19702](https://github.com/gravitational/teleport/pull/19702)
-* Added a new audit event for DynamoDB requests via application access [#19667](https://github.com/gravitational/teleport/pull/19667)
-* Added the ability to export `tsh` traces even when the Auth Service is not configured for tracing [#19583](https://github.com/gravitational/teleport/pull/19583)
-* Added support for linking Teleport Connect's embedded `tsh` binary for use outside of Teleport Connect [#1488](https://github.com/gravitational/webapps/pull/1488)
-
-## 11.1.4
-
-This release of Teleport contains multiple security fixes, improvements and bug fixes.
-
-*Note:* This release of Teleport contains an issue that affects backwards compatibility
-with database access agents. If you are a database access user we recommend skipping
-straight to version 11.2.0.
-
-### [Critical] RBAC bypass in SSH TCP tunneling
-
-When establishing a direct-tcpip channel, Teleport did not sufficiently validate
-RBAC.
-
-This could allow an attacker in possession of valid cluster credentials to
-establish a TCP tunnel to a node they didn’t have access to.
-
-The connection attempt would show up in the audit log as a “port” audit event
-(code T3003I) and include Teleport username in the “user” field.
-
-### [High] Application access session hijack
-
-When accepting application Access Requests, Teleport did not sufficiently
-validate client credentials.
-
-This could allow an attacker in possession of a valid active application session
-ID to issue requests to this application impersonating the session owner for a
-limited time window.
-
-Presence of multiple “cert.create” audit events (code TC000I) with the same app
-session ID in the “route_to_app.session_id” field may indicate the attempt to
-impersonate an existing user’s application session.
-
-### [Medium] SSH IP pinning bypass
-
-When issuing a user certificate, Teleport did not check for the presence of IP
-restrictions in the client’s credentials.
-
-This could allow an attacker in possession of valid client credentials with IP
-restrictions to reissue credentials without IP restrictions.
-
-Presence of a “cert.create” audit event (code TC000I) without corresponding
-“user.login” audit event (codes T1000I or T1101I) for users with IP restricted
-roles may indicate an issuance of a certificate without IP restrictions.
-
-### [Low] Web API session caching
-
-After logging out via the web UI, a user’s session could remain cached in
-Teleport’s proxy, allowing continued access to resources for a limited time
-window.
-
-### Other improvements and bugfixes
-
-* Fixed issue with noisy-square distortions in desktop access. [#19545](https://github.com/gravitational/teleport/pull/19545)
-* Fixed issue with LDAP search pagination in desktop access. [#19533](https://github.com/gravitational/teleport/pull/19533)
-* Fixed issue with SSH sessions inheriting OOM score of the parent process. [#19521](https://github.com/gravitational/teleport/pull/19521)
-* Fixed issue with ambiguous host resolution in web UI. [#19513](https://github.com/gravitational/teleport/pull/19513)
-* Fixed issue with using desktop access with Windows 10. [#19504](https://github.com/gravitational/teleport/pull/19504)
-* Fixed issue with `session.start` events being overwritten by `session.exec` events. [#19497](https://github.com/gravitational/teleport/pull/19497)
-* Fixed issue with `tsh login --format kubernetes` not setting SNI info. [#19433](https://github.com/gravitational/teleport/pull/19433)
-* Fixed issue with WebSockets not working via app access if the upstream web server is using HTTP/2. [#19423](https://github.com/gravitational/teleport/pull/19423)
-* Fixed TLS routing in insecure mode. [#19410](https://github.com/gravitational/teleport/pull/19410)
-* Fixed issue with connecting to ElastiCache 7.0.4 in database access. [#19400](https://github.com/gravitational/teleport/pull/19400)
-* Fixed issue with SAML connector validation calling descriptor URL prior to authz checks. [#19317](https://github.com/gravitational/teleport/pull/19317)
-* Fixed issue with database access complaining about "redis" engine not being registered. [#19251](https://github.com/gravitational/teleport/pull/19251)
-* Fixed issue with `disconnect_expired_cert` and `require_session_mfa` settings conflicting with each other. [#19178](https://github.com/gravitational/teleport/pull/19178)
-* Fixed startup failure when MongoDB URI is not resolvable. [#18984](https://github.com/gravitational/teleport/pull/18984)
-* Added resource names for Access Requests in Teleport Connect. [#19549](https://github.com/gravitational/teleport/pull/19549)
-* Added support for Github Enterprise join method. [#19518](https://github.com/gravitational/teleport/pull/19518)
-* Added the ability to supply Access Request TTLs. [#19385](https://github.com/gravitational/teleport/pull/19385)
-* Added new `instance.join` and `bot.join` audit events. [#19343](https://github.com/gravitational/teleport/pull/19343)
-* Added support for port-forward over websocket protocol in Kubernetes access. [#19181](https://github.com/gravitational/teleport/pull/19181)
-* Reduced latency of `tsh ls -R`. [#19482](https://github.com/gravitational/teleport/pull/19482)
-* Updated desktop access config script to disable password prompt. [#19427](https://github.com/gravitational/teleport/pull/19427)
-* Updated Go to 1.19.4. [#19127](https://github.com/gravitational/teleport/pull/19127)
-* Improved performance when converting traits to roles. [#19170](https://github.com/gravitational/teleport/pull/19170)
-* Improved handling of expired database certificates in Teleport Connect. [#19096](https://github.com/gravitational/teleport/pull/19096)
-
-## 11.1.2
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with EC2 discovery failing to install Teleport on older Ubuntu instances. [#18965](https://github.com/gravitational/teleport/pull/18965)
-* Fixed issue with log spam when cleaning up groups for automatically created Linux users. [#18990](https://github.com/gravitational/teleport/pull/18990)
-* Fixed issue with `tctl windows_desktops ls` not producing results in JSON and YAML formats. [#19016](https://github.com/gravitational/teleport/pull/19016)
-* Fixed issue with web SSH sessions in proxy recording mode. [#19021](https://github.com/gravitational/teleport/pull/19021)
-* Improved handling of corrupted session recordings. [#19040](https://github.com/gravitational/teleport/pull/19040)
-
-## 11.1.1
-
-This release of Teleport contains a security fix as well as multiple improvements and bug fixes.
-
-### Insecure TOTP MFA seed removal
-
-Fixed issue where an attacker with physical access to user's computer and raw
-access to the filesystem could potentially recover the seed QR code.
-
-[#18917](https://github.com/gravitational/teleport/pull/18917)
-
-### Other improvements and fixes
-
-* Fixed issue with Teleport Connect not working on macOS. [#18921](https://github.com/gravitational/teleport/pull/18921)
-* Added support for Cloud HSM on Google Cloud. [#18835](https://github.com/gravitational/teleport/pull/18835)
-* Added `server_hostname` to `session.*` audit events. [#18832](https://github.com/gravitational/teleport/pull/18832)
-* Added ability to specify roles when making Access Requests in web UI. [#18868](https://github.com/gravitational/teleport/pull/18868)
-* Improved error reporting from etcd backend. [#18822](https://github.com/gravitational/teleport/pull/18822)
-* Improved failed session recording upload logs to include upload and session IDs. [#18872](https://github.com/gravitational/teleport/pull/18872)
-
-## 11.1.0
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Added support for self-hosted Github Enterprise SSO connectors in Teleport Enterprise edition. [#18521](https://github.com/gravitational/teleport/pull/18521), [#18687](https://github.com/gravitational/teleport/pull/18687)
-* Added audit events for DynamoDB via AWS CLI access. [#18035](https://github.com/gravitational/teleport/pull/18035)
-* Added auth connectors support in Kubernetes Operator. [#18350](https://github.com/gravitational/teleport/pull/18350)
-* Added audit events for desktop access directory sharing. [#18398](https://github.com/gravitational/teleport/pull/18398)
-* Added trusted clusters support for desktop access. [#18666](https://github.com/gravitational/teleport/pull/18666)
-* Added support for `user.spec` syntax in moderated session filters. [#18455](https://github.com/gravitational/teleport/pull/18455)
-* Added support for GKE auto-discovery to Kubernetes access. [#18396](https://github.com/gravitational/teleport/pull/18396)
-* Added FIPS support to desktop access. [#18743](https://github.com/gravitational/teleport/pull/18743)
-* Added `teleport discovery bootstrap` command. [#18641](https://github.com/gravitational/teleport/pull/18641)
-* Added `windows_desktops` as the correct resource for `tctl` commands. [#18816](https://github.com/gravitational/teleport/pull/18816)
-* Updated `tsh db ls` JSON and YAML output to include allowed users. [#18543](https://github.com/gravitational/teleport/pull/18543)
-* Updated `tctl auth sign --format kubernetes` to allow merging multiple clusters in the same kubeconfig. [#18525](https://github.com/gravitational/teleport/pull/18525)
-* Improved web UI SSH performance. [#18797](https://github.com/gravitational/teleport/pull/18797), [#18839](https://github.com/gravitational/teleport/pull/18839)
-* Improved `tsh play` output in JSON and YAML formats. [#18825](https://github.com/gravitational/teleport/pull/18825)
-* Fixed issue with RDS auto-discovery failing to start in some cases. [#18590](https://github.com/gravitational/teleport/pull/18590)
-* Fixed "cannot read properties of null" error when trying to add a new server using web UI. [webapps#1356](https://github.com/gravitational/webapps/pull/1356)
-* Fixed issue with applications list pagination in web UI. [#18601](https://github.com/gravitational/teleport/pull/18601)
-* Fixed issue with MongoDB commands sometimes failing through database access. [#18738](https://github.com/gravitational/teleport/pull/18738)
-* Fixed issue with automatically imported cloud labels not being used in RBAC in App Access. [#18642](https://github.com/gravitational/teleport/pull/18642)
-* Fixed issue with Kubernetes sessions lingering after all participants have disconnected. [#18684](https://github.com/gravitational/teleport/pull/18684)
-* Fixed issue with Auth Service being down affecting ability to establish new non-moderated SSH sessions. [#18441](https://github.com/gravitational/teleport/pull/18441)
-* Fixed issue with launching SSH sessions when SELinux is enabled. [#18810](https://github.com/gravitational/teleport/pull/18810)
-* Fixed issue with not being able to create SAML connectors with templated role names. [#18766](https://github.com/gravitational/teleport/pull/18766)
-
-## 11.0.3
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with validation of U2F devices. [#17876](https://github.com/gravitational/teleport/pull/17876)
-* Fixed `tsh ssh -J` not being able to connect to leaf cluster nodes. [#18268](https://github.com/gravitational/teleport/pull/18268)
-* Fixed issue with failed database connection when client requests GSS encryption. [#17811](https://github.com/gravitational/teleport/pull/17811)
-* Fixed issue with setting Teleport version to v10 in Helm charts resulting in invalid config. [#18008](https://github.com/gravitational/teleport/pull/18008)
-* Fixed issue with Teleport Kubernetes resource name conflicting with builtin resources. [#17717](https://github.com/gravitational/teleport/pull/17717)
-* Fixed issue with invalid MS Teams plugin systemd service file. [#18028](https://github.com/gravitational/teleport/pull/18028)
-* Fixed issue with failing to connect to OpenSSH 7.x servers. [#18248](https://github.com/gravitational/teleport/pull/18248)
-* Fixed issue with extra trailing question mark in application Access Requests. [#17955](https://github.com/gravitational/teleport/pull/17955)
-* Fixed issue with application access websocket requests sometimes failing in Chrome. [#18002](https://github.com/gravitational/teleport/pull/18002)
-* Fixed issue with multiple `tbot`'s concurrently using the same output directory. [#17999](https://github.com/gravitational/teleport/pull/17999)
-* Fixed issue with `tbot` failing to parse version on some kernels. [#18298](https://github.com/gravitational/teleport/pull/18298)
-* Fixed panic when v9 node runs against v11 Auth Service. [#18383](https://github.com/gravitational/teleport/pull/18383)
-* Fixed issue with Kubernetes proxy caching client credentials between sessions. [#18109](https://github.com/gravitational/teleport/pull/18109)
-* Fixed issue with agents not being able to reconnect to proxies in some cases. [#18149](https://github.com/gravitational/teleport/pull/18149)
-* Fixed issue with remote tunnel connections not being closed properly. [#18224](https://github.com/gravitational/teleport/pull/18224)
-* Added CircleCI support to Machine ID. [#17996](https://github.com/gravitational/teleport/pull/17996)
-* Added support for `arm` and `arm64` Docker images for Teleport and Operator. [#18222](https://github.com/gravitational/teleport/pull/18222)
-* Added PostgreSQL and MySQL RDS Proxy support to database access. [#18045](https://github.com/gravitational/teleport/pull/18045)
-* Improved database access denied error messages. [#17856](https://github.com/gravitational/teleport/pull/17856)
-* Improved desktop access errors in case of locked sessions. [#17549](https://github.com/gravitational/teleport/pull/17549)
-* Improved web UI handling of private key policy errors. [#17991](https://github.com/gravitational/teleport/pull/17991)
-* Improved memory usage in clusters with large numbers of active sessions. [#18051](https://github.com/gravitational/teleport/pull/18051)
-* Updated `tsh proxy ssh` to support `HTTPS_PROXY`. [#18295](https://github.com/gravitational/teleport/pull/18295)
-* Updated Azure hosted databases to fetch the new CA. [#18172](https://github.com/gravitational/teleport/pull/18172)
-* Updated `tsh kube login` to support providing default user, group and namespace. [#18185](https://github.com/gravitational/teleport/pull/18185)
-* Updated web UI session listing to include active sessions of all types. [#18229](https://github.com/gravitational/teleport/pull/18229)
-* Updated user locking to terminate in progress TCP application access connections. [#18187](https://github.com/gravitational/teleport/pull/18187)
-* Updated `teleport configure` command to produce v2 config when Auth Service is provided. [#17914](https://github.com/gravitational/teleport/pull/17914)
-* Updated all systemd service files to set max open files limit. [#17961](https://github.com/gravitational/teleport/pull/17961)
-
-## 11.0.1
-
-This release of Teleport contains a security fix and multiple bug fixes.
-
-### Block SFTP in Moderated Sessions
-
-Teleport did not block SFTP protocol in Moderated Sessions.
-
-[#17727](https://github.com/gravitational/teleport/pull/17727)
-
-### Other fixes
-
-* Fixed issue with agent forwarding not working for auto-created users. [#17586](https://github.com/gravitational/teleport/pull/17586)
-* Fixed "traits missing" error in application access. [#17737](https://github.com/gravitational/teleport/pull/17737)
-* Fixed connection leak issue in IAM joining. [#17737](https://github.com/gravitational/teleport/pull/17737)
-* Fixed panic in "tsh db ls". [#17780](https://github.com/gravitational/teleport/pull/17780)
-* Fixed issue with "tsh mfa add" not displaying OTP QR code image on Windows. [#17703](https://github.com/gravitational/teleport/pull/17703)
-* Fixed issue with `tctl rm windows_desktop/<name>` removing all desktops. [#17732](https://github.com/gravitational/teleport/pull/17732)
-* Fixed issue connecting to Redis 7.0 in cluster mode. [#17849](https://github.com/gravitational/teleport/pull/17849)
-* Fixed "failed to open user account database" error after exiting SSH session. [#17825](https://github.com/gravitational/teleport/pull/17825)
-* Improved `tctl` UX when using hardware-backed private keys. [#17681](https://github.com/gravitational/teleport/pull/17681)
-* Improved `tsh mfa add` error reporting. [#17580](https://github.com/gravitational/teleport/pull/17580)
-
-## 11.0.0
-
-Teleport 11 brings the following new major features and improvements:
-
-- Hardware-backed private keys support for server access (Enterprise only).
-- Replacement of obsolete SCP protocol with SFTP for server access.
-- Removal of persistent storage requirement for Helm charts.
-- Automatic discovery and enrollment of EKS/AKS clusters for Kubernetes access.
-- Richer Azure integrations for server and database access.
-- Cassandra and Scylla support for database access, including Amazon Keyspaces.
-- GitHub Actions and Terraform support for Machine ID.
-- Access Requests and file upload/download support for Teleport Connect.
-
-### Hardware-backed private keys (Enterprise Only)
-
-Teleport 11 clients (such as tsh or Connect) support storing their private key
-material on Yubikey devices instead of filesystem which helps prevent
-credentials exfiltration attacks.
-
-See how to enable it in the
-[documentation](docs/pages/admin-guides/access-controls/guides/hardware-key-support.mdx):
-
-Hardware-backed private keys is an enterprise only feature, and is currently
-supported for server access only.
-
-### SFTP protocol
-
-Teleport 11 adds server-side support for SFTP protocol which many IDEs such as
-VSCode or JetBrains PyCharm, GoLand and others use for browsing, copying, and
-editing files on remote systems.
-
-The following guides explain how to use IDEs to connect to a remote machine via
-Teleport:
-
-- [VS Code](./docs/pages/enroll-resources/server-access/guides/vscode.mdx)
-- [JetBrains](./docs/pages/enroll-resources/server-access/guides/jetbrains-sftp.mdx)
-
-In addition, Teleport 11 clients will use SFTP protocol for file transfer under
-the hood instead of the obsolete scp protocol. Server-side scp is still
-supported so existing clients aren’t affected.
-
-### Helm charts persistent storage
-
-In Teleport 11 users no longer need to use persistent storage when deploying
-Helm charts. When running on Kubernetes, Teleport services will now store their
-identities in Kubernetes Secrets which removes the need for using persistent
-storage or static join tokens.
-
-For existing deployments, this change involves migration from Deployment to
-StatefulSet which is performed automatically during Helm upgrade to Teleport 11.
-
-### EKS/AKS discovery
-
-Teleport 11 adds support for automatic discovery and enrollment of AWS Elastic
-Kubernetes Service (EKS) and Azure Kubernetes Service (AKS) clusters.
-
-### Azure integrations
-
-Teleport 11 improves Azure support in multiple areas.
-
-Teleport agents running on Azure VMs will now automatically import Azure tags to
-label resources.
-
-Teleport database access now supports auto-discovery for Azure-hosted PostgreSQL
-and MySQL databases. See the [Azure
-guide](docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx) for more
-details.
-
-In addition, Teleport database access will now use Azure AD managed identity
-authentication for Azure-hosted SQL Server databases.
-
-### Cassandra/ScyllaDB
-
-Teleport 11 adds support for Cassandra and ScyllaDB databases in Database
-Access. This includes support for Amazon Keyspaces.
-
-### Machine ID
-
-Teleport 11 adds support for secret-less joining of Machine ID agents in GitHub
-Actions workflows. See the guide for more details: TODO
-
-We have also released a GitHub Action for setting up the Teleport binaries
-within a GitHub workflow environment. More details regarding this can be found
-at the Teleport GitHub Actions repository:
-
-https://github.com/gravitational/teleport-actions
-
-In addition, the Teleport Terraform plugin now supports the creation of Machine
-ID Bots and Bot Tokens.
-
-### tsh MFA on Windows
-
-tsh 11 adds support for MFA and passwordless logins via Windows Hello and
-FIDO2 devices.
-
-### Teleport Connect
-
-Teleport Connect has added support for Access Requests and file upload/download.
-
-### Breaking Changes
-
-Please familiarize yourself with the following potentially disruptive changes in
-Teleport 11 before upgrading.
-
-#### Removed Github external SSO
-
-Beginning in Teleport 11, GitHub SAML SSO will only be available in our
-Enterprise Edition. GitHub SSO without SAML will continue to work with OSS
-Teleport.
-
-To keep using GitHub SSO with Teleport Community Edition, SAML SSO needs to be disabled
-for your GitHub organization. Teleport Community Edition users can continue to use GitHub SSO
-if using a Github Free or Team GitHub Plan.
-
-#### Changed Terraform OIDC connector redirect_url type to array
-
-In Teleport Plugins 11, `redirect_url` property in OIDC connectors created via
-a Terraform module expects an array:
-
-```
-redirect_url = [ "http://example.com" ]
-```
-
-#### Deprecated Quay.io registry
-
-Starting with Teleport 11, Quay.io as a container registry has been deprecated.
-Customers should use the new AWS ECR registry to pull [Teleport Docker
-images](./docs/pages/installation.mdx#docker).
-
-Quay.io registry support will be removed in a future release.
-
-#### Deprecated old deb/rpm repositories
-
-In Teleport 11, old deb/rpm repositories (deb.releases.teleport.dev and
-rpm.releases.teleport.dev) have been deprecated. Customers should use the new
-repositories (apt.releases.teleport.dev and yum.releases.teleport.dev) to
-[install Teleport](docs/pages/installation.mdx#linux).
-
-Support for our old deb/rpm repositories will be removed in a future release.
-
-#### Changed teleport-kube-agent Helm chart to StatefulSet
-
-Teleport 11 agents will now store their identities in Kubernetes Secrets when
-deployed via a Helm chart which eliminates the need for using persistent storage
-or static join tokens. Due to this change, Teleport agents are now always
-deployed as part of StatefulSet regardless of whether persistent storage is
-enabled or not.
-
-Existing agents that were deployed as Kubernetes Deployments (i.e. without
-persistent storage) will be automatically converted to StatefulSets during
-Teleport 11 Helm upgrade.
-
-#### Removed PostgreSQL backend
-
-The preview PostgreSQL backend was deleted due to performance and scalability
-concerns.
-
-#### Removed desktop access support for 32-bit ARM and 386 architectures
-
-32-bit support for desktop access on ARM and 386 architectures has been removed
-due to performance issues on these devices.
-
-This also reduces the binary size for these builds, making them slightly more
-convenient for smaller resource-constrained devices.
-
-## 10.0.0
-
-Teleport 10 is a major release that brings the following new features.
-
-Platform:
-
-* Passwordless (Preview)
-* Resource Access Requests (Preview)
-* Proxy Peering (Preview)
-
-Server access:
-
-* IP-Based Restrictions (Preview)
-* Automatic User Provisioning (Preview)
-
-Database access:
-
-* Audit Logging for Microsoft SQL Server database access
-* Snowflake database access (Preview)
-* ElastiCache/MemoryDB database access (Preview)
-
-Teleport Connect:
-
-* Teleport Connect for server and database access (Preview)
-
-Machine ID:
-
-* Machine ID database access support (Preview)
-
-### Passwordless (Preview)
-
-Teleport 10 introduces passwordless support to your clusters. To use passwordless
-users may register a security key with resident credentials or use a built-in
-authenticator, like Touch ID.
-
-See the [documentation](docs/pages/admin-guides/access-controls/guides/passwordless.mdx).
-
-### Resource Access Requests (Preview)
-
-Teleport 10 expands just-in-time Access Requests to allow for requesting access
-to specific resources. This lets you grant users the least privileged access
-needed for their workflows.
-
-Just-in-time Access Requests are only available in Teleport Enterprise Edition.
-
-### Proxy Peering (Preview)
-
-Proxy peering enables Teleport deployments to scale without an increase in load
-from the number of agent connections. This is accomplished by allowing Proxy
-Services to tunnel client connections to the desired agent through a neighboring
-proxy and decoupling the number of agent connections from the number of Proxies.
-
-Proxy peering can be enabled with the following configurations:
-
-```yaml
-auth_service:
-  tunnel_strategy:
-    type: proxy_peering
-    agent_connection_count: 1
-```
-
-```yaml
-proxy_service:
-  peer_listen_addr: 0.0.0.0:3021
-```
-
-Network connectivity between proxy servers to the `peer_listen_addr` is required
-for this feature to work.
-
-Proxy peering is only available in Teleport Enterprise Edition.
-
-### IP-Based Restrictions (Preview)
-
-Teleport 10 introduces a new role option to pin the source IP in SSH
-certificates. When enabled, the source IP that was used to request certificates
-is embedded in the certificate, and SSH servers will reject connection attempts
-from other IPs. This protects against attacks where valid credentials are
-exfiltrated from disk and copied out into other environments.
-
-IP-based restrictions are only available in Teleport Enterprise Edition.
-
-### Automatic User Provisioning (Preview)
-
-Teleport 10 can be configured to automatically create Linux host users upon
-login without having to use Teleport's PAM integration. Users can be added to specific
-Linux groups and assigned appropriate “sudoer” privileges.
-
-To learn more about configuring automatic user provisioning read the
-[documentation](docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx).
-
-### Audit Logging for Microsoft SQL Server database access
-
-Teleport 9 introduced a preview of database access support for Microsoft SQL
-Server which didn’t include audit logging of user queries. Teleport 10 captures
-users' queries and prepared statements and sends them to the audit log, similarly
-to other supported database protocols.
-
-Teleport database access for SQL Server remains in Preview mode with more UX
-improvements coming in future releases.
-
-Refer to [the guide](docs/pages/enroll-resources/database-access/enroll-aws-databases/sql-server-ad.mdx) to set
-up access to a SQL Server with Active Directory authentication.
-
-### Snowflake database access (Preview)
-
-Teleport 10 brings support for Snowflake to database access. Administrators can
-set up access to Snowflake databases through Teleport for their users with
-standard database access features like role-based access control and audit
-logging, including query activity.
-
-Connect your Snowflake database to Teleport following the
-[documentation](docs/pages/enroll-resources/database-access/enroll-managed-databases/snowflake.mdx).
-
-### Elasticache/MemoryDB database access (Preview)
-
-Teleport 9 added Redis protocol support to database access. Teleport 10 improves
-this integration by adding native support for AWS-hosted Elasticache and
-MemoryDB, including auto-discovery and automatic credential management in some
-deployment configurations.
-
-Learn more about it in the [documentation](
-docs/pages/enroll-resources/database-access/enroll-aws-databases/redis-aws.mdx).
-
-### Teleport Connect for server and database access (Preview)
-
-Teleport Connect is a graphical macOS application that simplifies access to your
-Teleport resources. Teleport Connect 10 supports server access and database access.
-Other protocols and Windows support are coming in a future release.
-
-Get Teleport Connect installer from the macOS tab on the downloads page:
-https://goteleport.com/download/.
-
-### Machine ID database access support (Preview)
-
-In Teleport 10 we’ve added database access support to Machine ID. Applications
-can use Machine ID to access databases protected by Teleport.
-
-You can find Machine ID guide for database access in the
-[documentation](docs/pages/enroll-resources/machine-id/access-guides/databases.mdx).
-
-### Breaking changes
-
-Please familiarize yourself with the following potentially disruptive changes in
-Teleport 10 before upgrading.
-
-#### Auth Service version check
-
-Teleport 10 agents will now refuse to start if they detect that the Auth Service
-is more than one major version behind them. You can use the `--skip-version-check` flag to
-bypass the version check.
-
-Take a look at component compatibility guarantees in the
-[documentation](docs/pages/upgrading/upgrading.mdx).
-
-#### HTTP_PROXY for reverse tunnels
-
-Reverse tunnel connections will now respect `HTTP_PROXY` environment variables.
-This may result in reverse tunnel agents not being able to re-establish
-connections if the HTTP proxy is set in their environment and does not allow
-connections to the Teleport Proxy Service.
-
-Refer to the
-[documentation](docs/pages/reference/networking.mdx#http-connect-proxies)
-for more details.
-
-#### New APT repos
-
-With Teleport 10 we’ve migrated to new APT repositories that now support
-multiple release channels, Teleport versions and OS distributions. The new
-repositories have been backfilled with Teleport versions starting from 6.2.31
-and we recommend upgrading to them. The old repositories will be maintained for
-the foreseeable future.
-
-See the [installation
-instructions](docs/pages/enroll-resources/server-access/getting-started.mdx#step-14-install-teleport-on-your-linux-host).
-
-#### Removed “tctl access ls”
-
-The `tctl access ls` command that returned information about user server access
-within the cluster was removed. Please use a previous `tctl` version if you’d like
-to keep using it.
-
-#### Relaxed session join permissions
-
-In previous versions of Teleport users needed full access to a Node/Kubernetes
-pod in order to join a session. Teleport 10 relaxes this requirement. Joining
-sessions remains deny-by-default but now only `join_sessions` statements are
-checked for session join RBAC.
-
-See the [Moderated Sessions
-guide](docs/pages/admin-guides/access-controls/guides/joining-sessions.mdx) for more
-details.
-
-#### GitHub connectors
-
-The GitHub authentication connector’s `teams_to_logins` field is deprecated in favor of the new
-`teams_to_roles` field. The old field will be removed in a future release.
-
-#### Teleport FIPS AWS endpoints
-
-Teleport 10 will now automatically use FIPS endpoints for AWS S3 and DynamoDB
-when started with the `--fips` flag. You can use the `use_fips_endpoint=false`
-connection endpoint option to use regular endpoints for Teleport in FIPS mode,
-for example:
-
-```
-s3://bucket/path?region=us-east-1&use_fips_endpoint=false
-```
-
-See the [S3/DynamoDB backend
-documentation](docs/pages/reference/backends.mdx) for more information.
-
-## 9.3.9
-
-This release of Teleport contains a security fix, as well as multiple improvements and bug fixes.
-
-### Auth bypass in Moderated Sessions
-
-When checking a user’s roles prior to starting a session, Teleport may have
-incorrectly allowed a session to proceed without moderation depending on the
-order roles are received from the backend.
-
-### Other improvements and fixes
-
-* Fixed issue with per-session MFA swallowing key presses. [#13822](https://github.com/gravitational/teleport/pull/13822)
-* Fixed issue with `tsh db ls -R` now showing allowed users. [#13626](https://github.com/gravitational/teleport/pull/13626)
-* Fixed vertical and horizontal scroll in desktop access. [#13905](https://github.com/gravitational/teleport/pull/13905)
-* Fixed issue with invalid query filters forcing `tsh` relogin. [#13747](https://github.com/gravitational/teleport/pull/13747)
-* Fixed issue with TLS routing and proxy jump. [#13928](https://github.com/gravitational/teleport/pull/13928)
-* Fixed issue with MongoDB connections timing out in certain scenarios. [#13859](https://github.com/gravitational/teleport/pull/13859)
-* Fixed issue with Machine ID certificate renewal with empty requested roles. [#13893](https://github.com/gravitational/teleport/pull/13893)
-* Fixed issue with Windows desktops not being labeled with LDAP attribute labels. [#13681](https://github.com/gravitational/teleport/pull/13681)
-* Fixed issue with desktop access streaming not being terminated properly. [#14024](https://github.com/gravitational/teleport/pull/14024)
-* Added ability to use FIPS endpoints for S3 and DynamoDB using `use_fips_endpoint` connection option. [#13703](https://github.com/gravitational/teleport/pull/13703)
-* Added ability to specify CA pin as a file path in the config. [#13089](https://github.com/gravitational/teleport/pull/13089)
-* Improved reconnect reliability after root proxy restart. [#13967](https://github.com/gravitational/teleport/pull/13967)
-* Improved error messages for failed auth client connections. [#13835](https://github.com/gravitational/teleport/pull/13835)
-
-## 9.3.7
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with startup delay caused by AWS EC2 check. [#13167](https://github.com/gravitational/teleport/pull/13167)
-* Added `tsh ls -R` that displays resources across all clusters and profiles. [#13313](https://github.com/gravitational/teleport/pull/13313)
-* Fixed issue with `tsh` not correctly reporting "address in use" error during port forwarding. [#13679](https://github.com/gravitational/teleport/pull/13679)
-* Fixed two potential panics. [#13590](https://github.com/gravitational/teleport/pull/13590), [#13655](https://github.com/gravitational/teleport/pull/13655)
-* Fixed issue with enhanced session recording not working on recent Ubuntu versions. [#13650](https://github.com/gravitational/teleport/pull/13650)
-* Fixed issue with CA rotation when Database Service does not contain any databases. [#13517](https://github.com/gravitational/teleport/pull/13517)
-* Fixed issue with desktop access connection failing with "invalid channel name rdpsnd" error. [#13450](https://github.com/gravitational/teleport/issues/13450)
-* Fixed issue with invalid Teleport config when enabling IMDSv2 in Terraform config. [#13537](https://github.com/gravitational/teleport/pull/13537)
-
-## 9.3.6
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Added Unicode clipboard support to desktop access. [#13391](https://github.com/gravitational/teleport/pull/13391)
-* Fixed backwards compatibility issue with fetch Access Requests from older servers. [#13490](https://github.com/gravitational/teleport/pull/13490)
-* Fixed issue with requests to Teleport-protected apps periodically failing with 500 errors. [#13469](https://github.com/gravitational/teleport/pull/13469)
-* Fixed issues with pagination when displaying applications. [#13451](https://github.com/gravitational/teleport/pull/13451)
-* Fixed file descriptor leak in Machine ID. [#13386](https://github.com/gravitational/teleport/pull/13386)
-
-## 9.3.5
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed backwards compatibility issue with fetching Access Requests from older servers. [#13428](https://github.com/gravitational/teleport/pull/13428)
-* Fixed issue with using Microsoft SQL Server Management Studio with database access. [#13337](https://github.com/gravitational/teleport/pull/13337)
-* Added support for `tsh proxy ssh -J` to improve interoperability with OpenSSH clients. [#13311](https://github.com/gravitational/teleport/pull/13311)
-* Added ability to provide security context in Helm charts. [#13286](https://github.com/gravitational/teleport/pull/13286)
-* Added Application and database access support to reference AWS Terraform deployment. [#13383](https://github.com/gravitational/teleport/pull/13383)
-* Improved reliability of dialing the Auth Service through the Proxy Service. [#13399](https://github.com/gravitational/teleport/pull/13399)
-* Improved `kubectl exec` auditing by logging access denied attempts. [#12831](https://github.com/gravitational/teleport/pull/12831), [#13400](https://github.com/gravitational/teleport/pull/13400)
-
-## 9.3.4
-
-This release of Teleport contains multiple security, bug fixes and improvements.
-
-### Escalation attack in agent forwarding
-
-When setting up agent forwarding on the node, Teleport did not handle unix socket creation in a secure manner.
-
-This could have given a potential attacker an opportunity to get Teleport to change arbitrary file permissions to the attacker’s user.
-
-### WebSockets CSRF
-
-When handling websocket requests, Teleport did not verify that the provided Bearer token was generated for the correct user.
-
-This could have allowed a malicious low privileged Teleport user to use a social engineering attack to gain higher privileged access on the same Teleport cluster.
-
-### Denial of service in Access Requests
-
-When accepting an Access Request, Teleport did not enforce the maximum request reason size.
-
-This could allow a malicious actor to mount a DoS attack by creating an Access Request with a very large request reason.
-
-### Auth bypass in moderated sessions
-
-When initializing a moderated session, Teleport did not discard participant’s input prior to the moderator joining.
-
-This could prevent a moderator from being able to interrupt a malicious command executed by a participant.
-
-### Other fixes
-
-* Fixed issue with stdin hijacking when per-session MFA is enabled. [#13212](https://github.com/gravitational/teleport/pull/13212)
-* Added support for automatic tags import when running on AWS EC2. [#12593](https://github.com/gravitational/teleport/pull/12593)
-* Added ability to use multiple redirect URLs in OIDC connectors. [#13046](https://github.com/gravitational/teleport/pull/13046)
-* Fixed issue with ANSI escape sequences being broken when using `tsh` on Windows. [#13221](https://github.com/gravitational/teleport/pull/13221)
-* Fixed issue with `tsh ssh` printing extra error upon exit if last command was unsuccessful. [#12903](https://github.com/gravitational/teleport/pull/12903)
-* Added support for Proxy Protocol v2 in MySQL proxy. [#12993](https://github.com/gravitational/teleport/pull/12993)
-* Upgraded to Go `v1.17.11`. [#13104](https://github.com/gravitational/teleport/pull/13104)
-* Added Windows desktops labeling based on their LDAP attributes. [#13238](https://github.com/gravitational/teleport/pull/13238)
-* Improved performance when listing resources for users with many roles. [#13263](https://github.com/gravitational/teleport/pull/13263)
-
-## 9.3.2
-
-This release of Teleport contains two bug fixes.
-
-* Fixed issue with Machine ID's `tsh` version check. [#13037](https://github.com/gravitational/teleport/pull/13037)
-* Fixed AWS related log spam in database agent when not running on AWS. [#12984](https://github.com/gravitational/teleport/pull/12984)
-
-## 9.3.0
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with `tctl` not taking `TELEPORT_HOME` environment variable into account. [#12738](https://github.com/gravitational/teleport/pull/12738)
-* Fixed issue with Redis `AUTH` command not always authenticating the user in database access. [#12754](https://github.com/gravitational/teleport/pull/12754)
-* Fixed issue with Teleport not starting with deprecated U2F configuration. [#12826](https://github.com/gravitational/teleport/pull/12826)
-* Fixed issue with `tsh db ls` not showing allowed users for leaf clusters. [#12853](https://github.com/gravitational/teleport/pull/12853)
-* Fixed issue with `teleport configure` failing when given non-existent data directory. [#12806](https://github.com/gravitational/teleport/pull/12806)
-* Fixed issue with `tctl` not outputting debug logs. [#12920](https://github.com/gravitational/teleport/pull/12920)
-* Fixed issue with Kubernetes access not working when using default CA pool. [#12874](https://github.com/gravitational/teleport/pull/12874)
-* Fixed issue with Machine ID not working in TLS routing mode. [#12990](https://github.com/gravitational/teleport/pull/12990)
-* Improved connection performance in large clusters. [#12832](https://github.com/gravitational/teleport/pull/12832)
-* Improved memory usage in large clusters. [#12724](https://github.com/gravitational/teleport/pull/12724)
-
-### Breaking Changes
-
-Teleport 9.3.0 reduces the minimum GLIBC requirement to 2.18 and enforces more
-secure cipher suites for desktop access.
-
-As a result of these changes, desktop access users with desktops running Windows
-Server 2012R2 will need to perform [additional
-configuration](docs/pages/enroll-resources/desktop-access/getting-started.mdx) to force Windows
-to use compatible cipher suites.
-
-Windows desktops running Windows Server 2016 and newer will continue to operate
-normally - no additional configuration is required.
-
-## 9.2.4
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed compatibility issue with agents connected to older Auth Service instances. [#12728](https://github.com/gravitational/teleport/pull/12728)
-* Fixed issue with TLS routing endpoint advertising preference for `http/1.1` over `h2`. [#12749](https://github.com/gravitational/teleport/pull/12749)
-* Implemented multiple proxy restart stability improvements. [#12632](https://github.com/gravitational/teleport/pull/12632), [#12488](https://github.com/gravitational/teleport/pull/12488), [#12689](https://github.com/gravitational/teleport/pull/12689)
-* Improved compatibility with PuTTY. [#12662](https://github.com/gravitational/teleport/pull/12662)
-* Added support for global tsh config file `/etc/tsh.yaml`. [#12626](https://github.com/gravitational/teleport/pull/12626)
-* Added `tbot configure` command. [#12576](https://github.com/gravitational/teleport/pull/12576)
-* Fixed issue with desktop access not working in Teleport Enterprise (Cloud). [#12781](https://github.com/gravitational/teleport/pull/12781)
-* Improved Web UI performance in large clusters. [#12637](https://github.com/gravitational/teleport/pull/12637)
-* Fixed issue with running MySQL stored procedures via database access. [#12734](https://github.com/gravitational/teleport/pull/12734)
-
-## 9.2.3
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with `HTTP_PROXY` being inadvertently respected in reverse tunnel connections. [#12335](https://github.com/gravitational/teleport/pull/12335)
-* Added `--format` flag to `tctl token add` command. [#12588](https://github.com/gravitational/teleport/pull/12588)
-* Fixed backwards compatibility issues with session upload. [#12535](https://github.com/gravitational/teleport/pull/12535)
-* Added support for persistency in custom mode in Helm charts. [#12218](https://github.com/gravitational/teleport/pull/12218)
-* Fixed issue with PostgreSQL backend not respecting username from certificate. [#12553](https://github.com/gravitational/teleport/pull/12553)
-* Fixed issues with `kubectl cp` and `kubectl exec` not working through Kubernetes access. [#12541](https://github.com/gravitational/teleport/pull/12541)
-* Fixed issues with dynamic registration logic for cloud databases. [#12451](https://github.com/gravitational/teleport/pull/12451)
-* Fixed issue with automatic Add Application script failing to join the cluster. [#12539](https://github.com/gravitational/teleport/pull/12539)
-* Fixed issue with `tctl` crashing when PAM is enabled. [#12572](https://github.com/gravitational/teleport/pull/12572)
-* Added support for setting priority class and extra labels in Helm charts. [#12568](https://github.com/gravitational/teleport/pull/12568)
-* Fixed issue with App Access JWT tokens not including `iat` claim. [#12589](https://github.com/gravitational/teleport/pull/12589)
-* Added ability to inject App Access JWT tokens in rewritten headers. [#12589](https://github.com/gravitational/teleport/pull/12589)
-* Desktop access automatically adds a `teleport.dev/ou` label for desktops discovered via LDAP. [#12502](https://github.com/gravitational/teleport/pull/12502)
-* Updated Machine ID to generates identity files compatible with `tctl` and `tsh`. [#12500](https://github.com/gravitational/teleport/pull/12500)
-* Updated internal build infrastructure to Go 1.17.10. [#12607](https://github.com/gravitational/teleport/pull/12607)
-* Improved proxy memory usage in clusters with large number of nodes. [#12573](https://github.com/gravitational/teleport/pull/12573)
-
-## 9.2.1
-
-This release of Teleport contains an improvement and several bug fixes.
-
-* Updated `tctl rm` command to support removing tokens. [#12439](https://github.com/gravitational/teleport/pull/12439)
-* Fixed issue with Teleport failing to start when using DynamoDB backend in pay-per-request mode. [#12461](https://github.com/gravitational/teleport/pull/12461)
-* Fixed issue with Kubernetes port forwarding not working. [#12468](https://github.com/gravitational/teleport/pull/12468)
-* Fixed issue with IAM policy limit when using database auto-discovery on Kubernetes. [#12457](https://github.com/gravitational/teleport/pull/12457)
-
-## 9.2.0
-
-This release of Teleport contains multiple improvements, security and bug fixes.
-
-* Fixed issue with U2F facets not being properly validated. [#12208](https://github.com/gravitational/teleport/pull/12208)
-* Hardened SQLite permissions. [#12360](https://github.com/gravitational/teleport/pull/12360)
-* Fixed issue with OIDC callback not checking `email_verified` claim. [#12360](https://github.com/gravitational/teleport/pull/12360)
-* Added `max_kubernetes_connections` role option for limiting simultaneous Kubernetes connections. [#12360](https://github.com/gravitational/teleport/pull/12360)
-* Fixed issue with Teleport failing to start with pay-per-request DynamoDB mode. [#12360](https://github.com/gravitational/teleport/pull/12360)
-* Reduced Machine ID verbosity in case of missing secure symlink kernel support. [#12423](https://github.com/gravitational/teleport/pull/12423)
-* Fixed `tsh proxy db` tunnel mode not working for CockroachDB connections. [#12400](https://github.com/gravitational/teleport/pull/12400)
-* Added support for database access certificates in Machine ID. [#12195](https://github.com/gravitational/teleport/pull/12195)
-* Improved shutdown/restart stability in certain scenarios. [#12393](https://github.com/gravitational/teleport/pull/12393)
-* Added support for clickable labels in web UI. [#12422](https://github.com/gravitational/teleport/pull/12422)
-
-## 9.1.3
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with some MySQL clients not being able to connect to MySQL 8.0 servers. [#12340](https://github.com/gravitational/teleport/pull/12340)
-* Fixed multiple conditions that could lead to SSH sessions freezing. [#12286](https://github.com/gravitational/teleport/pull/12286)
-* Fixed issue with `tsh db ls` failing for leaf clusters. [#12320](https://github.com/gravitational/teleport/pull/12320)
-* Fixed a scenario in which Teleport's internal cache could potentially become unhealthy. [#12251](https://github.com/gravitational/teleport/pull/12251), [#12002](https://github.com/gravitational/teleport/pull/12002)
-* Improved performance when opening new application access sessions. [#12300](https://github.com/gravitational/teleport/pull/12300)
-* Added flags to the `teleport configure` command. [#12267](https://github.com/gravitational/teleport/pull/12267)
-* Improved CA rotation stability. [#12333](https://github.com/gravitational/teleport/pull/12333)
-* Fixed issue with `mongosh` certificate verification when using TLS routing. [#12363](https://github.com/gravitational/teleport/pull/12363)
-
-## 9.1.2
-
-This release of Teleport contains two bug fixes.
-
-* Fixed issue with Teleport pods not becoming ready on Kubernetes. [#12243](https://github.com/gravitational/teleport/pull/12243)
-* Fixed issue with Teleport processes crashing upon restart after failed host UUID generation. [#12222](https://github.com/gravitational/teleport/pull/12222)
-
-## 9.1.1
-
-This release of Teleport contains multiple bug fixes and improvements.
-
-* Fixed regression issue where reverse tunnel connections inadvertently started respecting `HTTP_PROXY`. [#12035](https://github.com/gravitational/teleport/pull/12035)
-* Fixed potential deadlock in SSH server. [#12122](https://github.com/gravitational/teleport/pull/12122)
-* Fixed issue with Kubernetes service not reporting its readiness. [#12152](https://github.com/gravitational/teleport/pull/12152)
-* Fixed issue with JumpCloud identity provider. [#11936](https://github.com/gravitational/teleport/pull/11936)
-* Fixed issue with deleting many records from Firestore backend. [#12177](https://github.com/gravitational/teleport/pull/12177)
-
-## 9.1.0
-
-Teleport 9.1 is a minor release that brings several new features, security and bug fixes.
-
-### Security
-
-Teleport build infrastructure was updated to use Go v1.17.9 to fix CVE-2022-24675, CVE-2022-28327 and CVE-2022-27536.
-
-### SQL backend (preview)
-
-Teleport users can now use PostgreSQL or CockroachDB for storing Auth Service data.
-
-See the [documentation](docs/pages/reference/backends.mdx) for more information.
-
-### Server-side filtering and pagination
-
-Searching and filtering resources is now handled on the server, improving the
-efficiency of queries with `tsh`, `tctl`, or the web UI.
-
-The web UI loads resources faster by leveraging server-side pagination.
-Additionally, the web UI supports bookmarking searches by including the query in
-the URL.
-
-### Other improvements and fixes
-
-* Fixed issue with stdin being ignored after refreshing expired credentials. [#11847](https://github.com/gravitational/teleport/pull/11847)
-* Fixed issue with `tsh` requiring host login when using identity files for some commands. [#11793](https://github.com/gravitational/teleport/pull/11793)
-* Added support for calling proxy over plain HTTP in insecure mode. [#11403](https://github.com/gravitational/teleport/pull/11403)
-* Fixed multiple issues that could lead to sessions output freezing. [#11853](https://github.com/gravitational/teleport/pull/11853)
-* Added optional gRPC client/server latency metrics. [#11773](https://github.com/gravitational/teleport/pull/11773)
-* Fixed issue with connecting to self-hosted databases in TLS insecure mode. [#11758](https://github.com/gravitational/teleport/pull/11758)
-* Improved error message when incorrect auth connector name is used. [#11884](https://github.com/gravitational/teleport/pull/11884)
-* Implemented multiple moderated session stability improvements. [#11803](https://github.com/gravitational/teleport/pull/11803), [#11890](https://github.com/gravitational/teleport/pull/11890)
-* Added authenticated tunnel mode to `tsh proxy db` command. [#11808](https://github.com/gravitational/teleport/pull/11808)
-* Fixed issue with application sessions not being deleted upon web logout. [#11956](https://github.com/gravitational/teleport/pull/11956)
-* Improved MySQL audit logging to include support for additional commands. [#11949](https://github.com/gravitational/teleport/pull/11949)
-* Improved reliability of Teleport services restart. [#11795](https://github.com/gravitational/teleport/pull/11795)
-* Fixed issue with Okta OIDC auth connector not working. [#11718](https://github.com/gravitational/teleport/pull/11718)
-* Added support for `json` and `yaml` formatting to all `tsh` commands. [#12050](https://github.com/gravitational/teleport/pull/12050)
-* Added support for setting `kubernetes_users`, `kubernetes_groups`, `db_names`, `db_users` and `aws_role_arns` traits when creating users. [#12133](https://github.com/gravitational/teleport/pull/12133)
-* Fixed potential CA rotation panic. [#12004](https://github.com/gravitational/teleport/pull/12004)
-* Updated `tsh db ls` to display allowed database usernames. [#11942](https://github.com/gravitational/teleport/pull/11942)
-* Fixed goroutine leak in OIDC client. [#12078](https://github.com/gravitational/teleport/pull/12078)
-
-## 9.0.4
-
-This release of Teleport contains multiple improvements and fixes.
-
-* Fixed issue with `:` not being allowed in label keys. [#11563](https://github.com/gravitational/teleport/pull/11563)
-* Fixed potential panic in Kubernetes access. [#11614](https://github.com/gravitational/teleport/pull/11614)
-* Added `teleport_connect_to_node_attempts_total` Prometheus metric. [#11629](https://github.com/gravitational/teleport/pull/11629)
-* Multiple CA rotation stability improvements. [#11658](https://github.com/gravitational/teleport/pull/11658)
-* Fixed console player Ctrl-C and Ctrl-D functionality. [#11559](https://github.com/gravitational/teleport/pull/11559)
-* Improved logging in case of node with existing state joining an new cluster. [#11751](https://github.com/gravitational/teleport/pull/11751)
-* Added preview of PostgreSQL/CockroachDB backend. [#11667](https://github.com/gravitational/teleport/pull/11667)
-* Fixed compatibility issues with CA loading between old and new tsh versions. [#11663](https://github.com/gravitational/teleport/pull/11663)
-* Fixed loggers not respecting JSON configuration. [#11655](https://github.com/gravitational/teleport/pull/11655)
-* Added support for Proxy Protocol v2. [#11722](https://github.com/gravitational/teleport/pull/11722)
-* Fixed a number of tsh player stability issues. [#11491](https://github.com/gravitational/teleport/pull/11491)
-* Improved network utilization caused by session uploader. [#11698](https://github.com/gravitational/teleport/pull/11698)
-* Improved remote clusters inventory bookkeeping. [#11707](https://github.com/gravitational/teleport/pull/11707)
-
-## 9.0.3
-
-This release of Teleport contains multiple fixes.
-
-* Fixed issue with `tctl` ignoring `TELEPORT_HOME` environment variable. [#11561](https://github.com/gravitational/teleport/pull/11561)
-* Fixed multiple moderated sessions stability issues. [#11494](https://github.com/gravitational/teleport/pull/11494)
-* Fixed issue with `tsh version` exiting with error when tsh config file is not present. [#11571](https://github.com/gravitational/teleport/pull/11571)
-* Fixed issue with `tsh` not respecting proxy hosts. [#11496](https://github.com/gravitational/teleport/pull/11496)
-* Fixed issue with Kubernetes forwarder taking HTTP proxies into account. [#11462](https://github.com/gravitational/teleport/pull/11462)
-* Fixed issue with stale DynamoDB Auth Service instances disrupting agent reconnect attempts. [#11598](https://github.com/gravitational/teleport/pull/11598)
-
-## 9.0.2
-
-This release of Teleport contains multiple features, improvements and bug fixes.
-
-* Added support for per-user `tsh` configuration preferences. [#10336](https://github.com/gravitational/teleport/pull/10336)
-* Added support for role bootstrapping in OSS. [#11175](https://github.com/gravitational/teleport/pull/11175)
-* Added `HTTP_PROXY` support to tsh. [#10209](https://github.com/gravitational/teleport/pull/10209)
-* Improved error messages `tsh` and `tctl` show to include usage information on invalid command line invocation. [#11174](https://github.com/gravitational/teleport/pull/11174)
-* Improved `tctl <resource> ls` output to make it consistent across all resources. [#9519](https://github.com/gravitational/teleport/pull/9519)
-* Fixed multiple issues with CA rotation, graceful restart, and stability. [#10706](https://github.com/gravitational/teleport/pull/10706) [#11074](https://github.com/gravitational/teleport/pull/11074) [#11283](https://github.com/gravitational/teleport/pull/11283)
-* Fixed issue where MOTD was not always shown. [#10735](https://github.com/gravitational/teleport/pull/10735)
-* Fixed an issue where certificate extension not being included in `tctl auth sign`. [#10949](https://github.com/gravitational/teleport/pull/10949)
-* Fixed a panic that could occur in the Web UI. [#11389](https://github.com/gravitational/teleport/pull/11389)
-
-## 9.0.1
-
-This release of Teleport contains multiple improvements and bug fixes.
-
-* Fixed issue with Ctrl-C freezing sessions. [#11188](https://github.com/gravitational/teleport/pull/11188)
-* Improved handling of unknown audit events. [#11064](https://github.com/gravitational/teleport/pull/11064)
-* Improved calculation of public addresses for dynamically registered apps. [#11139](https://github.com/gravitational/teleport/pull/11139)
-* Fixed `tsh aws ecr` returning 500 errors. [#11108](https://github.com/gravitational/teleport/pull/11108)
-* Fixed issue with deleting certain users. [#11131](https://github.com/gravitational/teleport/pull/11131)
-* Fixed issue with Machine ID not detecting token in file config. [#11206](https://github.com/gravitational/teleport/pull/11206)
-
-## 9.0.0
-
-Teleport 9.0 is a major release that brings:
-
-- Teleport desktop access GA
-- Teleport Machine ID Preview
-- Various additions to Teleport database access
-- Moderated Sessions for server and Kubernetes access
-
-Desktop access adds support for clipboard sharing, session recording, and
-per-session MFA.
-
-Teleport Machine ID Preview extends identity-based access to machines. It's the
-easiest way to issue, renew, and manage SSH and X.509 certificates for service
-accounts, microservices, CI/CD automation and all other forms of
-machine-to-machine access.
-
-Database access brings self-hosted Redis support, RDS MariaDB (10.6 and higher)
-support, auto-discovery for Redshift clusters, and auto-IAM configuration
-improvements to GA. Additionally, this release also brings Microsoft SQL Server
-with AD authentication to Preview.
-
-Moderated Sessions enables the creation of sessions where a moderator has to
-be present. This feature can be selectively enabled for specific sessions via
-RBAC and can be used in conjunction with per-session MFA.
-
-### Desktop access
-
-#### Clipboard Support
-
-Desktop access now supports copying and pasting text between your local
-workstation and a remote Windows Desktop. This feature requires a Chromium-based
-browser and can be disabled via RBAC.
-
-#### Session Recording
-
-Desktop sessions are now recorded and stored alongside SSH sessions, and can be
-viewed in Teleport's web interface. Desktop session recordings are fully
-compatible with the RBAC for sessions feature introduced in Teleport 8.1.
-
-#### Per-session MFA
-
-Per-session MFA settings now apply to desktop sessions. This allows cluster
-administrators to require an additional MFA "tap" prior to opening a desktop
-session. This feature requires a WebAuthn device.
-
-### Machine ID (Preview)
-
-Machine ID allows the creation of machine / bot / service account users who can
-automatically issue, renew, and manage SSH and X.509 certificates to facilitate
-machine-to-machine access.
-
-Machine ID is a service that programmatically issues and renews short-lived
-certificates to any service account (e.g., a CI/CD server) by retrieving
-credentials from the Teleport Auth Service. This enables fine-grained role-based
-access controls and audit.
-
-Some of the things you can do with Machine ID:
-
-- Machines can retrieve short-lived SSH certificates for CI/CD pipelines.
-- Machines can retrieve short-lived X.509 certificates for use with databases or
-  applications.
-- Configure role-based access controls and locking for machines.
-- Capture access events in the audit log.
-
-[Machine ID getting started guide](docs/pages/enroll-resources/machine-id/getting-started.mdx)
-
-### Database access
-
-#### Redis
-
-You can now use database access to connect to a self-hosted Redis instance or
-Redis cluster and view Redis commands in the Teleport audit log. We will be
-adding support for Amazon Elasticache in the coming weeks.
-
-[Self-hosted Redis
-guide](docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis.mdx)
-
-#### SQL Server (Preview)
-
-Teleport 9 includes a preview release of Microsoft SQL Server with Active
-Directory authentication support for database access. Audit logging of query
-activity is not included in the preview release and will be implemented in a
-later 9.x release.
-
-[SQL Server guide](docs/pages/enroll-resources/database-access/enroll-aws-databases/sql-server-ad.mdx)
-
-#### RDS MariaDB
-
-Teleport 9 updates MariaDB support with auto-discovery and connection to AWS RDS
-MariaDB databases using IAM authentication. The minimum MariaDB version that
-supports IAM authentication is 10.6.
-
-[Updated RDS guide](docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx)
-
-#### Other Improvements
-
-In addition, Teleport 9 expands auto-discovery to support Redshift databases and
-2 new commands which simplify the database access getting started experience:
-"teleport db configure create", which generates Database Service configuration,
-and "teleport db configure bootstrap", which configures IAM permissions for the
-Database Service when running on AWS.
-
-CLI commands reference:
-- [`teleport db configure
-  create`](docs/pages/reference/agent-services/database-access-reference/cli.mdx)
-- [`teleport db configure bootstrap`](docs/pages/reference/agent-services/database-access-reference/cli.mdx)
-
-### Moderated Sessions
-
-With Moderated Sessions, Teleport administrators can define policies that allow
-users to invite other users to participate in SSH or Kubernetes sessions as
-observers, moderators or peers.
-
-[Moderated Sessions guide](docs/pages/admin-guides/access-controls/guides/joining-sessions.mdx)
-
-### Breaking Changes
-
-#### CentOS 6
-
-CentOS 6 support was deprecated in Teleport 8 and has now been removed.
-
-#### Desktop access
-
-desktop access now authenticates to LDAP using X.509 client certificates.
-Support for the `password_file` configuration option has been removed.
-
-## 8.0.0
-
-Teleport 8.0 is a major release of Teleport that contains new features, improvements, and bug fixes.
-
-### New Features
-
-#### Windows desktop access Preview
-
-Teleport 8.0 includes a preview of the Windows desktop access feature, allowing
-users passwordless login to Windows Desktops via any modern web browser.
-
-Teleport users can connect to Active Directory enrolled Windows hosts running
-Windows 10, Windows Server 2012 R2 and newer Windows versions.
-
-To try this feature yourself, check out our
-[Getting Started Guide](docs/pages/enroll-resources/desktop-access/getting-started.mdx).
-
-Review the desktop access design in:
-
-- [RFD #33](https://github.com/gravitational/teleport/blob/master/rfd/0033-desktop-access.md)
-- [RFD #34](https://github.com/gravitational/teleport/blob/master/rfd/0034-desktop-access-windows.md)
-- [RFD #35](https://github.com/gravitational/teleport/blob/master/rfd/0035-desktop-access-windows-authn.md)
-- [RFD #37](https://github.com/gravitational/teleport/blob/master/rfd/0037-desktop-access-protocol.md)
-
-#### TLS Routing
-
-In TLS routing mode all client connections are wrapped in TLS and multiplexed on
-a single Teleport proxy port.
-
-TLS routing can be enabled by including the following Auth Service configuration:
-
-```yaml
-auth_service:
-  proxy_listener_mode: multiplex
-  ...
-```
-
-and setting proxy configuration version to `v2` to prevent legacy listeners from
-being created:
-
-```yaml
-version: v2
-proxy_service:
-  ...
-```
-
-#### AWS CLI
-
-Teleport application access extends AWS console support to CLI . Users are able
-to log into their AWS console using `tsh apps login` and use `tsh aws` commands
-to interact with AWS APIs.
-
-See more info in the
-[documentation](docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx).
-
-#### Application and Database Dynamic Registration
-
-With dynamic registration users are able to manage applications and databases
-without needing to update static YAML configuration or restart application or
-database agents.
-
-See dynamic registration guides for
-[apps](docs/pages/enroll-resources/application-access/guides/dynamic-registration.mdx)
-and
-[databases](docs/pages/enroll-resources/database-access/guides/dynamic-registration.mdx).
-
-#### RDS Automatic Discovery
-
-With RDS auto discovery Teleport database agents can automatically discover RDS
-instances and Aurora clusters in an AWS account.
-
-See updated
-[RDS guide](docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx) for
-more information.
-
-#### WebAuthn
-
-WebAuthn support enables Teleport users to use modern multi-factor options,
-including Apple FaceID and TouchID.
-
-In addition, the Teleport Web UI includes new multi-factor management tools,
-enabling users to configure and update their multi-factor devices via their
-web browser.
-
-Lastly, our UI becomes more secure by requiring an additional multi-factor
-confirmation for certain privileged actions (editing roles for multi-factor
-confirmation, for example).
-
-### Improvements
-
-* Added support for [CockroachDB](https://www.cockroachlabs.com) to Database
-  Access. [#8505](https://github.com/gravitational/teleport/pull/8505)
-* Reduced network utilization on large clusters during login.
-  [#8471](https://github.com/gravitational/teleport/pull/8471)
-* Added metrics and added the ability for `tctl top` to show network utilization
-  for resource propagation.
-  [#8338](https://github.com/gravitational/teleport/pull/8338)
-  [#8603](https://github.com/gravitational/teleport/pull/8603)
-  [#8491](https://github.com/gravitational/teleport/pull/8491)
-* Added support for account recovery and cancellation.
-  [#6769](https://github.com/gravitational/teleport/pull/6769)
-* Added per-session MFA support to database access.
-  [#8270](https://github.com/gravitational/teleport/pull/8270)
-* Added support for profile specific `kubeconfig`.
-  [#7840](https://github.com/gravitational/teleport/pull/7840)
-
-### Fixes
-
-* Fixed issues with web applications that utilized
-  [EventSource](https://developer.mozilla.org/en-US/docs/Web/API/EventSource)
-  with application access.
-  [#8359](https://github.com/gravitational/teleport/pull/8359)
-* Fixed issue were interactive sessions would always return exit code 0.
-  [#8081](https://github.com/gravitational/teleport/pull/8081)
-* Fixed issue where JWT signer was omitted from bootstrap logic.
-  [#8119](https://github.com/gravitational/teleport/pull/8119)
-
-### Breaking Changes
-
-#### CentOS 6
-
-CentOS 6 support will be deprecated in Teleport 8 and removed in Teleport 9.
-
-Teleport 8 will continue to receive security patches for about 9 months after
-which it will be EOL. Users are encouraged to upgrade to CentOS 7 in that time
-frame.
-
-#### Updated  dependencies
-
-New run time dependencies have been added to Teleport 8 due to the inclusion of
-Rust in the build chain. Teleport 8 requires `libgcc_s.so` and `libm.so` be
-installed on systems running Teleport.
-
-Users of [distroless](https://github.com/GoogleContainerTools/distroless)
-container images are encouraged to use the
-[gcr.io/distroless/cc-debian11](https://github.com/GoogleContainerTools/distroless/blob/main/examples/rust/Dockerfile)
-image to run Teleport.
-
-```
-FROM gcr.io/distroless/cc-debian11
-```
-
-Alpine users are recommended to install the `libgcc` package in addition to any
-glibc compatibility layer they have already been using.
-
-```
-apk --update --no-cache add libgcc
-```
-
-#### Database access Certificates
-
-With the `GODEBUG=x509ignoreCN=0` flag removed in Go 1.17, database access users
-will no longer be able to connect to databases that include their hostname in
-the `CommonName` field of the presented certificate. Users are recommended to
-update their database certificates to include hostname in the
-`Subject Alternative Name` extension instead.
-
-Subscribe to Github issue
-[#7636](https://github.com/gravitational/teleport/issues/7636) which will add
-ability to control level of TLS verification as a workaround.
-
-#### Role Changes
-
-New clusters will no longer have the default `admin` role, it has been replaced
-with 3 smaller scoped roles: `access`, `auditor`, and `editor`.
-
-## 7.0.0
-
-Teleport 7.0 is a major release of Teleport that contains new features, improvements, and bug fixes.
-
-### New Features
-
-#### MongoDB
-
-Added support for [MongoDB](https://www.mongodb.com) to Teleport database access. [#6600](https://github.com/gravitational/teleport/issues/6600).
-
-View the [database access with MongoDB](docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx) for more details.
-
-#### Cloud SQL MySQL
-
-Added support for [GCP Cloud SQL MySQL](https://cloud.google.com/sql/docs/mysql) to Teleport database access. [#7302](https://github.com/gravitational/teleport/pull/7302)
-
-View the Cloud SQL MySQL [guide](docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/mysql-cloudsql.mdx) for more details.
-
-#### AWS Console
-
-Added support for [AWS Console](https://aws.amazon.com/console) to Teleport application access. [#7590](https://github.com/gravitational/teleport/pull/7590)
-
-Teleport application access can now automatically sign users into the AWS Management Console using [Identity federation](https://aws.amazon.com/identity/federation). View AWS Management Console [guide](docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx) for more details.
-
-#### Restricted Sessions
-
-Added the ability to block network traffic (IPv4 and IPv6) on a per-SSH session basis. Implemented using BPF tooling which required kernel 5.8 or above. [#7099](https://github.com/gravitational/teleport/pull/7099)
-
-#### Enhanced Session Recording
-
-Updated Enhanced Session Recording to no longer require the installation of external compilers like `bcc-tools`. Implemented using BPF tooling which required kernel 5.8 or above. [#6027](https://github.com/gravitational/teleport/pull/6027)
-
-### Improvements
-
-* Added the ability to terminate database access certificates when the certificate expires. [#5476](https://github.com/gravitational/teleport/issues/5476)
-* Added additional FedRAMP compliance controls, such as custom disconnect and MOTD messages. [#6091](https://github.com/gravitational/teleport/issues/6091) [#7396](https://github.com/gravitational/teleport/pull/7396)
-* Added the ability to export Audit Log and session recordings using the Teleport API. [#6731](https://github.com/gravitational/teleport/pull/6731) [#7360](https://github.com/gravitational/teleport/pull/7360)
-* Added the ability to partially configure a cluster. [#5857](https://github.com/gravitational/teleport/issues/5857) [RFD #28](https://github.com/gravitational/teleport/blob/master/rfd/0028-cluster-config-resources.md)
-* Added the ability to disable port forwarding on a per-host basis. [#6989](https://github.com/gravitational/teleport/pull/6989)
-* Added ability to configure `tsh` home directory. [#7035](https://github.com/gravitational/teleport/pull/7035/files)
-* Added ability to generate OpenSSH client configuration snippets using `tsh config`. [#7437](https://github.com/gravitational/teleport/pull/7437)
-* Added default-port detection to `tsh` [#6374](https://github.com/gravitational/teleport/pull/6374)
-* Improved performance of the Web UI for users with many roles. [#7588](https://github.com/gravitational/teleport/pull/7588)
-
-### Fixes
-
-* Fixed a memory leak that could affect etcd users. [#7631](https://github.com/gravitational/teleport/pull/7631)
-* Fixed an issue where `tsh login` could fail if the user had multiple public addresses defined on the proxy. [#7368](https://github.com/gravitational/teleport/pull/7368)
-
-### Breaking Changes
-
-#### Enhanced Session Recording
-
-Enhanced Session Recording has been updated to use CO-RE BPF executables. This means that you no longer have to install `bcc-tools`, but comes with a higher minimum kernel version of 5.8 and above. [#6027](https://github.com/gravitational/teleport/pull/6027)
-
-#### Kubernetes access
-
-Kubernetes access will no longer automatically register a cluster named after the Teleport cluster if the proxy is running within a Kubernetes cluster. Users wishing to retain this functionality now have to explicitly set `kube_cluster_name`. [#6786](https://github.com/gravitational/teleport/pull/6786)
-
-#### `tsh`
-
-`tsh login` has been updated to no longer change the current Kubernetes context. While `tsh login` will write credentials to `kubeconfig` it will only update your context if `tsh login --kube-cluster` or `tsh kube login <kubeCluster>` is used. [#6045](https://github.com/gravitational/teleport/issues/6045)
-
-## 6.2
-
-Teleport 6.2 contains new features, improvements, and bug fixes.
-
-**Note:** the DynamoDB indexing change described below may cause rate-limiting
-errors from AWS APIs and is slow on large deployments (1000+ existing audit
-events). The next patch release, v6.2.1, will improve the migration performance.
-If you run a large DynamoDB-based cluster, we advise you to wait for v6.2.1
-before upgrading.
-
-### New Features
-
-#### Added Amazon Redshift Support
-
-Added support for [Amazon Redshift](https://aws.amazon.com/redshift) to Teleport database access.[#6479](https://github.com/gravitational/teleport/pull/6479).
-
-View the [database access with Redshift on AWS guide](docs/pages/enroll-resources/database-access/enroll-aws-databases/postgres-redshift.mdx) for more details.
-
-### Improvements
-
-* Added pass-through header support for Teleport application access. [#6601](https://github.com/gravitational/teleport/pull/6601)
-* Added ability to propagate claim information from root to leaf clusters. [#6540](https://github.com/gravitational/teleport/pull/6540)
-* Added Proxy Protocol for MySQL database access. [#6594](https://github.com/gravitational/teleport/pull/6594)
-* Added prepared statement support for Postgres database access. [#6303](https://github.com/gravitational/teleport/pull/6303)
-* Added `GetSessionEventsRequest` RPC endpoint for Audit Log pagination. [RFD 19](https://github.com/gravitational/teleport/blob/master/rfd/0019-event-iteration-api.md) [#6731](https://github.com/gravitational/teleport/pull/6731)
-* Changed DynamoDB indexing strategy for events. [RFD 24](https://github.com/gravitational/teleport/blob/master/rfd/0024-dynamo-event-overflow.md) [#6583](https://github.com/gravitational/teleport/pull/6583)
-
-### Fixes
-
-* Fixed multiple per-session MFA issues. [#6542](https://github.com/gravitational/teleport/pull/6542) [#6567](https://github.com/gravitational/teleport/pull/6567) [#6625](https://github.com/gravitational/teleport/pull/6625) [#6779](https://github.com/gravitational/teleport/pull/6779) [#6948](https://github.com/gravitational/teleport/pull/6948)
-* Fixed etcd JWT renewal issue. [#6905](https://github.com/gravitational/teleport/pull/6905)
-* Fixed issue where `kubectl exec` sessions were not being recorded when the target pod was killed. [#6068](https://github.com/gravitational/teleport/pull/6068)
-* Fixed an issue that prevented Teleport from starting on ARMv7 systems. [#6711](https://github.com/gravitational/teleport/pull/6711).
-* Fixed issue that caused Access Requests to inconsistently allow elevated Kubernetes access. [#6492](https://github.com/gravitational/teleport/pull/6492)
-* Fixed an issue that could cause `session.end` events not to be emitted. [#6756](https://github.com/gravitational/teleport/pull/6756)
-* Fixed an issue with PAM variable interpolation. [#6558](https://github.com/gravitational/teleport/pull/6558)
-
-### Breaking Changes
-
-#### Agent Forwarding
-
-Teleport 6.2 brings a potentially backward incompatible change with `tsh` agent forwarding.
-
-Prior to Teleport 6.2, `tsh ssh -A` would create an in-memory SSH agent from your `~/.tsh` directory and forward that agent to the target host.
-
-Starting in Teleport 6.2 `tsh ssh -A` by default now forwards your system SSH agent (available at `$SSH_AUTH_SOCK`). Users wishing to retain the prior behavior can use `tsh ssh -o "ForwardAgent local"`.
-
-For more details see [RFD 22](https://github.com/gravitational/teleport/blob/master/rfd/0022-ssh-agent-forwarding.md) and implementation in [#6525](https://github.com/gravitational/teleport/pull/6525).
-
-#### DynamoDB Indexing Change
-
-DynamoDB users should note that the events backend indexing strategy has
-changed and a data migration will be triggered after upgrade. For optimal
-performance perform this migration with only one Auth Service instance online. It may
-take some time and progress will be periodically written to the Auth Service
-log. During this migration, only events that have been migrated will appear in
-the Web UI. After completion, all events will be available.
-
-For more details see [RFD 24](https://github.com/gravitational/teleport/blob/master/rfd/0024-dynamo-event-overflow.md) and implementation in [#6583](https://github.com/gravitational/teleport/pull/6583).
-
-## 6.1.5
-
-This release of Teleport contains multiple bug fixes.
-
-* Added additional Prometheus Metrics. [#6511](https://github.com/gravitational/teleport/pull/6511)
-* Updated the TLS handshake timeout to 5 seconds to avoid timeout issues on large clusters. [#6692](https://github.com/gravitational/teleport/pull/6692)
-* Fixed issue that caused non-interactive SSH output to show up in logs. [#6683](https://github.com/gravitational/teleport/pull/6683)
-* Fixed two issues that could cause Teleport to panic upon startup. [#6431](https://github.com/gravitational/teleport/pull/6431) [#5712](https://github.com/gravitational/teleport/pull/5712)
-
-## 6.1.3
-
-This release of Teleport contains a bug fix.
-
-* Added support for PROXY protocol to database access (MySQL). [#6517](https://github.com/gravitational/teleport/issues/6517)
-
-## 6.1.2
-
-This release of Teleport contains a new feature.
-
-* Added log formatting and support to enable timestamps for logs. [#5898](https://github.com/gravitational/teleport/pull/5898)
-
-## 6.1.1
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue where DEB builds were not published to the [Teleport DEB repository](https://deb.releases.teleport.dev/).
-
-## 6.1.0
-
-Teleport 6.1 contains multiple new features, improvements, and bug fixes.
-
-### New Features
-
-#### U2F for Kubernetes and SSH sessions
-
-Added support for U2F authentication on every SSH and Kubernetes "connection" (a single `tsh ssh` or `kubectl` call). This is an advanced security feature that protects users against compromises of their on-disk Teleport certificates. Per-session MFA can be enforced cluster-wide or only for some specific roles.
-
-For more details see [Per-Session
-MFA](docs/pages/admin-guides/access-controls/guides/per-session-mfa.mdx) documentation or
-[RFD
-14](https://github.com/gravitational/teleport/blob/master/rfd/0014-session-2FA.md)
-and [RFD
-15](https://github.com/gravitational/teleport/blob/master/rfd/0015-2fa-management.md)
-for technical details.
-
-#### Dual Authorization Workflows
-
-Added ability to request multiple users to review and approve Access Requests.
-
-See [#5071](https://github.com/gravitational/teleport/pull/5071) for technical details.
-
-### Improvements
-
-* Added the ability to propagate SSO claims to PAM modules. [#6158](https://github.com/gravitational/teleport/pull/6158)
-* Added support for cluster routing to reduce latency to leaf clusters. [RFD 21](https://github.com/gravitational/teleport/blob/master/rfd/0021-cluster-routing.md)
-* Added support for Google Cloud SQL to database access. [#6090](https://github.com/gravitational/teleport/pull/6090)
-* Added support CLI credential issuance for application access. [#5918](https://github.com/gravitational/teleport/pull/5918)
-* Added support for Encrypted SAML Assertions. [#5598](https://github.com/gravitational/teleport/pull/5598)
-* Added support for user impersonation. [#6073](https://github.com/gravitational/teleport/pull/6073)
-
-### Fixes
-
-* Fixed interoperability issues with `gpg-agent`. [RFD 18](http://github.com/gravitational/teleport/blob/master/rfd/0018-agent-loading.md)
-* Fixed websocket support in application access. [#6028](https://github.com/gravitational/teleport/pull/6028)
-* Fixed file argument issues with `tsh play`. [#1580](https://github.com/gravitational/teleport/issues/1580)
-* Fixed `utmp` regressions that caused issues in LXC containers. [#6256](https://github.com/gravitational/teleport/pull/6256)
-
-## 6.0.3
-
-This release of Teleport contains a bug fix.
-
-* Fixed a issue that caused high network on deployments with many leaf Trusted Clusters. [#6263](https://github.com/gravitational/teleport/pull/6263)
-
-## 6.0.2
-
-This release of Teleport contains bug fixes and adds new default roles.
-
-* Fixed an issue with proxy web endpoint resetting connection when run with `--insecure-no-tls` flag. [#5923](https://github.com/gravitational/teleport/pull/5923)
-* Introduced role presets: `auditor`, `editor` and `access`. [#5968](https://github.com/gravitational/teleport/pull/5968)
-* Added ability to inline `google_service_account` field into Google Workspace OIDC connector. [#5563](http://github.com/gravitational/teleport/pull/5563)
-
-## 6.0.1
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed issue that caused ACME default configuration to fail with `TLS-ALPN-01` challenge. [#5839](https://github.com/gravitational/teleport/pull/5839)
-* Fixed regression in ADFS integration. [#5880](https://github.com/gravitational/teleport/pull/5880)
-
-## 6.0.0
-
-Teleport 6.0 is a major release with new features, functionality, and bug fixes.
-
-We have implemented [database access](./docs/pages/enroll-resources/database-access/database-access.mdx),
-open sourced role-based access control (RBAC), and added official API and a Go client library.
-
-Users can review the [6.0 milestone](https://github.com/gravitational/teleport/milestone/33?closed=1) on Github for more details.
-
-### New Features
-
-#### Database access
-
-Review the database access design in [RFD #11](https://github.com/gravitational/teleport/blob/master/rfd/0011-database-access.md).
-
-With database access users can connect to PostgreSQL and MySQL databases using short-lived certificates, configure SSO authentication and role-based access controls for databases, and capture SQL query activity in the audit log.
-
-##### Getting Started
-
-Configure database access following the [Getting Started](./docs/pages/enroll-resources/database-access/getting-started.mdx/) guide.
-
-##### Guides
-
-* [AWS RDS/Aurora
-  PostgreSQL](./docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx)
-* [AWS RDS/Aurora MySQL](./docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx)
-* [Self-hosted PostgreSQL](./docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/postgres-self-hosted.mdx)
-* [Self-hosted MySQL](./docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mysql-self-hosted.mdx)
-* [GUI clients](docs/pages/connect-your-client/gui-clients.mdx)
-
-##### Resources
-
-To learn more about configuring role-based access control for database access, check out the [RBAC](./docs/pages/enroll-resources/database-access/database-access.mdx) section.
-
-[Architecture](./docs/pages/enroll-resources/database-access/database-access.mdx) provides a more in-depth look at database access internals such as networking and security.
-
-See [Reference](docs/pages/reference/agent-services/database-access-reference/database-access-reference.mdx) for an overview of database access related configuration and CLI commands.
-
-Finally, check out [Frequently Asked Questions](docs/pages/enroll-resources/database-access/faq.mdx).
-
-#### OSS RBAC
-
-Open source RBAC support was introduced in [RFD #7](https://github.com/gravitational/teleport/blob/master/rfd/0007-rbac-oss.md).
-
-RBAC support gives OSS administrators more granular access controls to servers and other resources with a cluster (like session recording access). An example of an RBAC policy could be: "admins can do anything, developers must never touch production servers and interns can only SSH into staging servers as guests"
-
-In addition, some Access Workflow Plugins will now become available to open source users.
-
-* Access Workflows Golang SDK and API
-* Slack
-* Gitlab
-* Mattermost
-* JIRA Plugin
-* PagerDuty Plugin
-
-#### Client libraries and API
-
-API and Client Libraries support was introduced in [RFD #10](https://github.com/gravitational/teleport/blob/master/rfd/0010-api.md).
-
-The new API and client library reduces the dependencies needed to use the Teleport API as well as making it easier to use. An example of using the new API is below.
-
-```go
-// Create a client connected to the Auth server with an exported identity file.
-clt, err := client.NewClient(client.Config{
-  Addrs: []string{"auth.example.com:3025"},
-  Credentials: []client.Credentials{
-    client.LoadIdentityFile("identity.pem"),
-  },
-})
-if err != nil {
-  log.Fatalf("Failed to create client: %v.", err)
-}
-defer clt.Close()
-
-// Create a Access Request.
-accessRequest, err := types.NewAccessRequest(uuid.New(), "access-admin", "admin")
-if err != nil {
-  log.Fatalf("Failed to build access request: %v.", err)
-}
-if err = clt.CreateAccessRequest(ctx, accessRequest); err != nil {
-  log.Fatalf("Failed to create access request: %v.", err)
-}
-```
-
-### Improvements
-
-* Added `utmp`/`wtmp` support for SSH in [#5491](https://github.com/gravitational/teleport/pull/5491).
-* Added the ability to set a Kubernetes specific public address in [#5611](https://github.com/gravitational/teleport/pull/5611).
-* Added Proxy Protocol support to Kubernetes access in [#5299](https://github.com/gravitational/teleport/pull/5299).
-* Added ACME ([Let's Encrypt](https://letsencrypt.org/)) support to make getting and using TLS certificates easier. [#5177](https://github.com/gravitational/teleport/issues/5177).
-* Added the ability to manage local users to the Web UI in [#2945](https://github.com/gravitational/teleport/issues/2945).
-* Added the ability to preserve timestamps when using `tsh scp` in [#2889](https://github.com/gravitational/teleport/issues/2889).
-
-### Fixes
-
-* Fixed authentication failure when logging in via CLI with Access Workflows after removing `.tsh` directory in [#5323](https://github.com/gravitational/teleport/pull/5323).
-* Fixed `tsh login` failure when `--proxy` differs from actual proxy public address in [#5380](https://github.com/gravitational/teleport/pull/5380).
-* Fixed session playback issues in [#2945](https://github.com/gravitational/teleport/issues/2945).
-* Fixed several UX issues in [#5559](https://github.com/gravitational/teleport/issues/5559), [#5568](https://github.com/gravitational/teleport/issues/5568), [#4965](https://github.com/gravitational/teleport/issues/4965), and [#5057](https://github.com/gravitational/teleport/pull/5057).
-
-### Upgrade Notes
-
-Please follow our [standard upgrade procedure](docs/pages/admin-guides/management/admin/admin.mdx) to upgrade your cluster.
-
-Note, for clusters using GitHub SSO and Trusted Clusters, when upgrading SSO users will lose connectivity to leaf clusters. Local users will not be affected.
-
-To restore connectivity to leaf clusters for SSO users, leaf admins should update the `trusted_cluster` role mapping resource like below.
-
-```yaml
-kind: trusted_cluster
-version: v2
-metadata:
-   name: "zztop-oss"
-spec:
-   enabled: true
-   token: "bar"
-   web_proxy_addr: 172.10.1.1:3080
-   tunnel_addr: 172.10.1.1:3024
-   role_map:
-   - remote: "admin"
-     local: ['admin']
-   - remote: "^(github-.*)$"
-     local: ['admin']
-```
-
-## 5.1.0
-
-This release of Teleport adds a new feature.
-
-* Support for creating and assuming Access Workflow requests from within the Web UI (first step toward full Workflow UI support: [#4937](https://github.com/gravitational/teleport/issues/4937)).
-
-## 5.0.2
-
-This release of Teleport contains a security fix.
-
-* Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): [#5119](https://github.com/gravitational/teleport/pull/5119).
-
-Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 5.0.2 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
-
-
-## 5.0.1
-
-This release of Teleport contains multiple bug fixes.
-
-* Always set expiry times on server resource in heartbeats [#5008](https://github.com/gravitational/teleport/pull/5008)
-* Fixes streaming k8s responses (`kubectl logs -f`, `kubectl run -it`, etc) [#5009](https://github.com/gravitational/teleport/pull/5009)
-* Multiple fixes for the k8s forwarder [#5038](https://github.com/gravitational/teleport/pull/5038)
-
-## 5.0.0
-
-Teleport 5.0 is a major release with new features, functionality, and bug fixes. Users can review [5.0 closed issues](https://github.com/gravitational/teleport/milestone/39?closed=1) on Github for details of all items.
-
-#### New Features
-
-Teleport 5.0 introduces two distinct features: Teleport application access and significant Kubernetes access improvements - multi-cluster support.
-
-##### Teleport application access
-
-Teleport can now be used to provide secure access to web applications. This new feature was built with the express intention of securing internal apps which might have once lived on a VPN or had an authorization and authentication mechanism with little to no audit trail. application access works with everything from dashboards to single page Javascript applications (SPA).
-
-Application access uses mutually authenticated reverse tunnels to establish a secure connection with the Teleport unified Access Platform which can then becomes the single ingress point for all traffic to an internal application.
-
-Adding an application follows the same UX as adding SSH servers or Kubernetes clusters, starting with creating a static or dynamic invite token.
-
-```bash
-$ tctl tokens add --type=app
-```
-
-Then simply start Teleport with a few new flags.
-
-```sh
-$ teleport start --roles=app --token=xyz --auth-server=proxy.example.com:3080 \
-    --app-name="example-app" \
-    --app-uri="http://localhost:8080"
-```
-
-This command will start an app server that proxies the application "example-app" running at `http://localhost:8080` at the public address `https://example-app.example.com`.
-
-Applications can also be configured using the new `app_service` section in `teleport.yaml`.
-
-```yaml
-app_service:
-   # Teleport application access is enabled.
-   enabled: yes
-   # We've added a default sample app that will check
-   # that Teleport application access is working
-   # and output JWT tokens.
-   # https://dumper.teleport.example.com:3080/
-   debug_app: true
-   apps:
-   # application access can be used to proxy any HTTP endpoint.
-   # Note: Name can't include any spaces and should be DNS-compatible A-Za-z0-9-._
-   - name: "internal-dashboard"
-     uri: "http://10.0.1.27:8000"
-     # By default Teleport will make this application
-     # available on a sub-domain of your Teleport proxy's hostname
-     # internal-dashboard.teleport.example.com
-     # - thus the importance of setting up wildcard DNS.
-     # If you want, it's possible to set up a custom public url.
-     # DNS records should point to the proxy server.
-     # internal-dashboard.teleport.example.com
-     # Example Public URL for the internal-dashboard app.
-     # public_addr: "internal-dashboard.acme.com"
-     # Optional labels
-     # Labels can be combined with RBAC rules to provide access.
-     labels:
-       customer: "acme"
-       env: "production"
-     # Optional dynamic labels
-     commands:
-     - name: "os"
-       command: ["/usr/bin/uname"]
-       period: "5s"
-     # A proxy can support multiple applications. application access
-     # can also be deployed with a Teleport node.
-     - name: "arris"
-       uri: "http://localhost:3001"
-       public_addr: "arris.example.com"
-```
-
-Application access requires two additional changes. DNS must be updated to point the application domain to the proxy and the proxy must be loaded with a TLS certificate for the domain. Wildcard DNS and TLS certificates can be used to simplify deployment.
-
-```yaml
-# When adding the app_service certificates are required to provide a TLS
-# connection. The certificates are managed by the proxy_service
-proxy_service:
-  # We've extended support for https certs. Teleport can now load multiple
-  # TLS certificates. In the below example we've obtained a wildcard cert
-  # that'll be used for proxying the applications.
-  # The correct certificate is selected based on the hostname in the HTTPS
-  # request using SNI.
-  https_keypairs:
-  - key_file: /etc/letsencrypt/live/teleport.example.com/privkey.pem
-    cert_file: /etc/letsencrypt/live/teleport.example.com/fullchain.pem
-  - key_file: /etc/letsencrypt/live/*.teleport.example.com/privkey.pem
-    cert_file: /etc/letsencrypt/live/*.teleport.example.com/fullchain.pem
-```
-
-You can learn more in [Introduction to Enrolling Applications](./docs/pages/enroll-resources/application-access/introduction.mdx).
-
-##### Teleport Kubernetes access
-
-Teleport 5.0 also introduces two highly requested features for Kubernetes.
-
-* The ability to connect multiple Kubernetes Clusters to the Teleport Access Platform, greatly reducing operational complexity.
-* Complete Kubernetes audit log capture [#4526](https://github.com/gravitational/teleport/pull/4526), going beyond the existing `kubectl exec` capture.
-
-For a full overview please review the [Kubernetes RFD](https://github.com/gravitational/teleport/blob/master/rfd/0005-kubernetes-service.md).
-
-To support these changes, we've introduced a new service. This moves Teleport Kubernetes configuration from the `proxy_service` into its own dedicated `kubernetes_service` section.
-
-When adding the new Kubernetes service, a new type of join token is required.
-
-```bash
-tctl tokens add --type=kube
-```
-
-Example configuration for the new `kubernetes_service`:
-
-```yaml
-# ...
-kubernetes_service:
-   enabled: yes
-   listen_addr: 0.0.0.0:3027
-   kubeconfig_file: /secrets/kubeconfig
-```
-
-Note: a Kubernetes port still needs to be configured in the `proxy_service` via `kube_listen_addr`.
-
-#### New "tsh kube" commands
-
-`tsh kube` commands are used to query registered clusters and switch `kubeconfig` context:
-
-```sh
-$ tsh login --proxy=proxy.example.com --user=awly
-
-# list all registered clusters
-$ tsh kube ls
-Cluster Name       Status
--------------      ------
-a.k8s.example.com  online
-b.k8s.example.com  online
-c.k8s.example.com  online
-
-# on login, kubeconfig is pointed at the first cluster (alphabetically)
-$ kubectl config current-context
-proxy.example.com-a.k8s.example.com
-
-# but all clusters are populated as contexts
-$ kubectl config get-contexts
-CURRENT   NAME                     CLUSTER             AUTHINFO
-*         proxy.example.com-a.k8s.example.com   proxy.example.com   proxy.example.com-a.k8s.example.com
-          proxy.example.com-b.k8s.example.com   proxy.example.com   proxy.example.com-b.k8s.example.com
-          proxy.example.com-c.k8s.example.com   proxy.example.com   proxy.example.com-c.k8s.example.com
-
-# switch between different clusters:
-$ tsh kube login c.k8s.example.com
-
-# the traditional way is also supported:
-$ kubectl config use-context proxy.example.com-c.k8s.example.com
-
-# check current cluster
-$ kubectl config current-context
-proxy.example.com-c.k8s.example.com
-```
-
-Other Kubernetes changes:
-
-* Support k8s clusters behind firewall/NAT using a single Teleport cluster [#3667](https://github.com/gravitational/teleport/issues/3667)
-* Support multiple k8s clusters with a single Teleport proxy instance [#3952](https://github.com/gravitational/teleport/issues/3952)
-
-##### Additional User and Token Resource
-
-We've added two new RBAC resources; these provide the ability to limit token creation and to list and modify Teleport users:
-
-```yaml
-- resources: [user]
-  verbs: [list,create,read,update,delete]
-- resources: [token]
-  verbs: [list,create,read,update,delete]
-```
-
-Learn more about [Teleport's RBAC Resources](docs/pages/admin-guides/access-controls/access-controls.mdx)
-
-##### Cluster Labels
-
-Teleport 5.0 also adds the ability to set labels on Trusted Clusters. The labels are set when creating a trusted cluster invite token. This lets teams use the same RBAC controls used on nodes to approve or deny access to clusters. This can be especially useful for MSPs that connect hundreds of customers' clusters - when combined with access workflows, cluster access can be delegated. Learn more by reviewing our [Truster Cluster Setup & RBAC Docs](docs/pages/admin-guides/management/admin/trustedclusters.mdx)
-
-Creating a trusted cluster join token for a production environment:
-
-```bash
-$ tctl tokens add --type=trusted_cluster --labels=env=prod
-```
-
-```yaml
-kind: role
-#...
-  deny:
-    # cluster labels control what clusters user can connect to. The wildcard ('*')
-    # means any cluster. By default, deny rules are empty to preserve backwards
-    # compatibility
-    cluster_labels:
-      'env': 'prod'
-```
-
-##### Teleport UI Updates
-
-Teleport 5.0 also iterates on the UI Refresh from 4.3. We've moved the cluster list into our sidebar and have added an Application launcher. For customers moving from 4.4 to 5.0, you'll notice that we have moved session recordings back to their own dedicated section.
-
-Other updates:
-
-* We now provide local user management via `https://[cluster-url]/web/users`, providing the ability to edit, reset and delete local users.
-* Teleport Node & App Install scripts. This is currently an Enterprise-only feature that provides customers with an 'auto-magic' installer script. Enterprise customers can enable this feature by modifying the 'token' resource. See note above.
-* We've added a Waiting Room for customers using Access Workflows. [Docs](docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx)
-
-##### Signed RPM and Releases
-
-Starting with Teleport 5.0, we now provide an RPM repo for stable releases of Teleport. We've also started signing our RPMs to provide assurance that you're always using an official build of Teleport.
-
-See https://rpm.releases.teleport.dev/ for more details.
-
-#### Improvements
-
-* Added `--format=json` playback option for `tsh play`. For example `tsh play --format=json ~/play/0c0b81ed-91a9-4a2a-8d7c-7495891a6ca0.tar | jq '.event` can be used to show all events within an a local archive. [#4578](https://github.com/gravitational/teleport/issues/4578)
-* Added support for continuous backups and auto scaling for DynamoDB. [#4780](https://github.com/gravitational/teleport/issues/4780)
-* Added a Linux ARM64/ARMv8 (64-bit) Release. [#3383](https://github.com/gravitational/teleport/issues/3383)
-* Added `https_keypairs` field which replaces `https_key_file` and `https_cert_file`. This allows administrators to load multiple HTTPS certs for Teleport application access. Teleport 5.0 is backwards compatible with the old format, but we recommend updating your configuration to use `https_keypairs`.
-
-Enterprise Only:
-
-* `tctl` can load credentials from `~/.tsh` [#4678](https://github.com/gravitational/teleport/pull/4678)
-* Teams can require a user submitted reason when using Access Workflows [#4573](https://github.com/gravitational/teleport/pull/4573#issuecomment-720777443)
-
-#### Fixes
-
-* Updated `tctl` to always format resources as lists in JSON/YAML. [#4281](https://github.com/gravitational/teleport/pull/4281)
-* Updated `tsh status` to now print Kubernetes status. [#4348](https://github.com/gravitational/teleport/pull/4348)
-* Fixed intermittent issues with `loginuid.so`. [#3245](https://github.com/gravitational/teleport/issues/3245)
-* Reduced `access denied to Proxy` log spam. [#2920](https://github.com/gravitational/teleport/issues/2920)
-* Various AMI fixes: paths are now consistent with other Teleport packages and configuration files will not be overwritten on reboot.
-
-#### Documentation
-
-We've added an [API Guide](docs/pages/admin-guides/api/api.mdx) to simply developing applications against Teleport.
-
-#### Upgrade Notes
-
-Please follow our [standard upgrade procedure](docs/pages/upgrading/upgrading.mdx).
-
-* Optional: Consider updating `https_key_file` & `https_cert_file` to our new `https_keypairs:` format.
-* Optional: Consider migrating Kubernetes access from `proxy_service` to `kubernetes_service` after the upgrade.
-
-### 4.4.6
-
-This release of teleport contains a security fix and a bug fix.
-
-* Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): [#5120](https://github.com/gravitational/teleport/pull/5120).
-
-Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 4.4.6 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
-
-* Fix an issue where `tsh login` would fail with an `AccessDenied` error if
-the user was perviously logged into a leaf cluster. [#5105](https://github.com/gravitational/teleport/pull/5105)
-
-### 4.4.5
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue where a slow or unresponsive Teleport Auth Service instance could hang client connections in async recording mode. [#4696](https://github.com/gravitational/teleport/pull/4696)
-
-### 4.4.4
-
-This release of Teleport adds enhancements to the Access Workflows API.
-
-* Support for creating limited roles that trigger Access Requests
-on login, allowing users to be configured such that no nodes can
-be accessed without externally granted roles.
-
-* Teleport UI support for automatically generating Access Requests and
-assuming new roles upon approval (Access Requests were previously
-only available in `tsh`).
-
-* New `claims_to_roles` mapping that can use claims from external
-identity providers to determine which roles a user can request.
-
-* Various minor API improvements to help make requests easier to
-manage and audit, including support for human-readable
-request/approve/deny reasons and structured annotations.
-
-### 4.4.2
-
-This release of Teleport adds support for a new build architecture.
-
-* Added automatic arm64 builds of Teleport to the download portal.
-
-### 4.4.1
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue where defining multiple logging configurations would cause Teleport to crash. [#4598](https://github.com/gravitational/teleport/issues/4598)
-
-### 4.4.0
-
-This is a major Teleport release with a focus on new features, functionality, and bug fixes. It’s a substantial release and users can review [4.4 closed issues](https://github.com/gravitational/teleport/milestone/40?closed=1) on Github for details of all items.
-
-#### New Features
-
-##### Concurrent Session Control
-
-This addition to Teleport helps customers obtain AC-10 control. We now provide two new optional configuration values: `max_connections` and `max_sessions`.
-
-###### `max_connections`
-
-This value is the total number of concurrent sessions within a cluster to nodes running Teleport. This value is applied at a per user level. If you set `max_connections` to `1`, a `tsh` user would only be able to `tsh ssh` into one node at a time.
-
-###### `max_sessions` per connection
-
-This value limits the total number of session channels which can be established across a single SSH connection (typically used for interactive terminals or remote exec operations). This is for cases where nodes have Teleport set up, but a user is using OpenSSH to connect to them. It is essentially equivalent to the `MaxSessions` configuration value accepted by `sshd`.
-
-```yaml
-spec:
-  options:
-    # Optional: Required to be set for AC-10 Compliance
-    max_connections: 2
-    # Optional: To match OpenSSH behavior set to 10
-    max_sessions: 10
-```
-
-###### `session_control_timeout`
-
-A new `session_control_timeout` configuration value has been added to the `auth_service` configuration block of the Teleport config file. It's unlikely that you'll need to modify this.
-
-```yaml
-auth_service:
-  session_control_timeout: 2m # default
-# ...
-```
-
-#### Session Streaming Improvements
-
-Teleport 4.4 includes a complete refactoring of our event system. This resolved a few customer bug reports such as [#3800: Events overwritten in DynamoDB](https://github.com/gravitational/teleport/issues/3800) and [#3182: Teleport consuming all disk space with multipart uploads](https://github.com/gravitational/teleport/issues/3182).
-
-Along with foundational improvements, 4.4 includes two new experimental `session_recording` options: `node-sync` and `proxy-sync`.
-NOTE: These experimental modes require all Teleport Auth Service instances, Proxy Service instances, and nodes to be running Teleport 4.4.
-
-```yaml
-# This section configures the Auth Service:
-auth_service:
-    # Optional setting for configuring session recording. Possible values are:
-    #     "node"  : sessions will be recorded on the node level (the default)
-    #     "proxy" : recording on the proxy level, see "recording proxy mode" section.
-    #     "off"   : session recording is turned off
-    #
-    #     EXPERIMENTAL *-sync modes: proxy and node send logs directly to S3 or other
-    #     storage without storing the records on disk at all. This mode will kill a
-    #     connection if network connectivity is lost.
-    #     NOTE: These experimental modes require all Teleport Auth Service instances,
-    #     Proxy Service instances, and nodes to be running Teleport 4.4.
-    #
-    #     "node-sync" : sessions recording will be streamed from node -> auth -> storage
-    #     "proxy-sync : sessions recording will be streamed from proxy -> auth -> storage
-    #
-    session_recording: "node-sync"
-```
-
-#### Improvements
-
-* Added session streaming. [#4045](https://github.com/gravitational/teleport/pull/4045)
-* Added concurrent session control. [#4138](https://github.com/gravitational/teleport/pull/4138)
-* Added ability to specify leaf cluster when generating `kubeconfig` via `tctl auth sign`. [#4446](https://github.com/gravitational/teleport/pull/4446)
-* Added output options (like JSON) for `tsh ls`. [#4390](https://github.com/gravitational/teleport/pull/4390)
-* Added node ID to heartbeat debug log [#4291](https://github.com/gravitational/teleport/pull/4291)
-* Added the option to trigger `pam_authenticate` on login [#3966](https://github.com/gravitational/teleport/pull/3966)
-
-#### Fixes
-
-* Fixed issue that caused some idle `kubectl exec` sessions to terminate. [#4377](https://github.com/gravitational/teleport/pull/4377)
-* Fixed symlink issued when using `tsh` on Windows. [#4347](https://github.com/gravitational/teleport/pull/4347)
-* Fixed `tctl top` so it runs without the debug flag and on dark terminals. [#4282](https://github.com/gravitational/teleport/pull/4282) [#4231](https://github.com/gravitational/teleport/pull/4231)
-* Fixed issue that caused DynamoDB not to respect HTTP CONNECT proxies. [#4271](https://github.com/gravitational/teleport/pull/4271)
-* Fixed `/readyz` endpoint to recover much quicker. [#4223](https://github.com/gravitational/teleport/pull/4223)
-
-#### Documentation
-
-* Updated Google Workspace documentation to add clarification on supported account types. [#4394](https://github.com/gravitational/teleport/pull/4394)
-* Updated IoT instructions on necessary ports. [#4398](https://github.com/gravitational/teleport/pull/4398)
-* Updated Trusted Cluster documentation on how to remove trust from root and leaf clusters. [#4358](https://github.com/gravitational/teleport/pull/4358)
-* Updated the PAM documentation with PAM authentication usage information. [#4352](https://github.com/gravitational/teleport/pull/4352)
-
-#### Upgrade Notes
-
-Please follow our [standard upgrade
-procedure](docs/pages/upgrading/upgrading.mdx).
-
-## 4.3.9
-
-This release of Teleport contains a security fix.
-
-* Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): [#5122](https://github.com/gravitational/teleport/pull/5122).
-
-Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 4.3.9 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
-
-## 4.3.8
-
-This release of Teleport adds support for a new build architecture.
-
-* Added automatic arm64 builds of Teleport to the download portal.
-
-## 4.3.7
-
-This release of Teleport contains a security fix and a bug fix.
-
-* Mitigated [CVE-2020-15216](https://nvd.nist.gov/vuln/detail/CVE-2020-15216) by updating github.com/russellhaering/goxmldsig.
-
-### Details
-A vulnerability was discovered in the `github.com/russellhaering/goxmldsig` library which is used by Teleport to validate the
-signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
-bypass XML signature validation and pass off an altered file as a signed one.
-
-### Actions
-The `goxmldsig` library has been updated upstream and Teleport 4.3.7 includes the fix. Any Enterprise SSO users using Okta,
-Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 4.3.7 and restart Teleport.
-
-If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
-
-* Fixed an issue where DynamoDB connections made by Teleport would not respect the `HTTP_PROXY` or `HTTPS_PROXY` environment variables. [#4271](https://github.com/gravitational/teleport/pull/4271)
-
-## 4.3.6
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed an issue with prefix migration that could lead to loss of cluster state. [#4299](https://github.com/gravitational/teleport/pull/4299) [#4345](https://github.com/gravitational/teleport/pull/4345)
-* Fixed an issue that caused excessively slow loading of the UI on large clusters. [#4326](https://github.com/gravitational/teleport/pull/4326)
-* Updated `/readyz` endpoint to recover faster after node goes into degraded state. [#4223](https://github.com/gravitational/teleport/pull/4223)
-* Added node UUID to debug logs to allow correlation between TCP connections and nodes. [#4291](https://github.com/gravitational/teleport/pull/4291)
-
-## 4.3.5
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue that caused Teleport Docker images to be built incorrectly. [#4201](https://github.com/gravitational/teleport/pull/4201)
-
-## 4.3.4
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed issue that caused intermittent login failures when using PAM modules like `pam_loginuid.so` and `pam_selinux.so`. [#4133](https://github.com/gravitational/teleport/pull/4133)
-* Fixed issue that required users to manually verify a certificate when exporting an identity file. [#4003](https://github.com/gravitational/teleport/pull/4003)
-* Fixed issue that prevented local user creation using Firestore. [#4160](https://github.com/gravitational/teleport/pull/4160)
-* Fixed issue that could cause `tsh` to panic when using a PEM file. [#4189](https://github.com/gravitational/teleport/pull/4189)
-
-## 4.3.2
-
-This release of Teleport contains multiple bug fixes.
-
-* Reverted base OS in container images to Ubuntu. [#4054](https://github.com/gravitational/teleport/issues/4054)
-* Fixed an issue that prevented changing the path for the Audit Log. [#3771](https://github.com/gravitational/teleport/issues/3771)
-* Fixed an issue that allowed servers with invalid labels to be added to the cluster. [#4034](https://github.com/gravitational/teleport/issues/4034)
-* Fixed an issue that caused Cloud Firestore to panic on startup. [#4041](https://github.com/gravitational/teleport/pull/4041)
-* Fixed an error that would cause Teleport to fail to load with the error "list of proxies empty". [#4005](https://github.com/gravitational/teleport/issues/4005)
-* Fixed an issue that would prevent playback of Kubernetes session [#4055](https://github.com/gravitational/teleport/issues/4055)
-* Fixed regressions in the UI. [#4013](https://github.com/gravitational/teleport/issues/4013) [#4012](https://github.com/gravitational/teleport/issues/4012)  [#4035](https://github.com/gravitational/teleport/issues/4035)  [#4051](https://github.com/gravitational/teleport/issues/4051)  [#4044](https://github.com/gravitational/teleport/issues/4044)
-
-## 4.3.0
-
-This is a major Teleport release with a focus on new features, functionality, and bug fixes. It’s a substantial release and users can review [4.3 closed issues](https://github.com/gravitational/teleport/milestone/37?closed=1) on Github for details of all items.
-
-#### New Features
-
-##### Web UI
-
-Teleport 4.3 includes a completely redesigned Web UI. The new Web UI expands the management functionality of a Teleport cluster and the user experience of using Teleport. Teleport's new terminal provides a jumping-off point to access nodes and nodes on other clusters via the web.
-
-Teleport's Web UI now exposes Teleport’s Audit log, letting auditors and administrators view Teleport access events, SSH events, recording session, and enhanced session recording all in one view.
-
-##### Teleport Plugins
-
-Teleport 4.3 introduces four new plugins that work out of the box with [Approval Workflow](docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx). These plugins allow you to automatically support role escalation with commonly used third party services. The built-in plugins are listed below.
-
-*   [PagerDuty](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx)
-*   [Jira](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx)
-*   [Slack](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx)
-*   [Mattermost](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx)
-
-#### Improvements
-
-*   Added the ability for local users to reset their own passwords. [#2387](https://github.com/gravitational/teleport/pull/3287)
-*   Added user impersonation (`kube_users)` support to Kubernetes Proxy. [#3369](https://github.com/gravitational/teleport/issues/3369)
-*   Added support for third party S3-compatible storage for sessions. [#3057](https://github.com/gravitational/teleport/pull/3057)
-*   Added support for GCP backend data stores. [#3766](https://github.com/gravitational/teleport/pull/3766)  [#3014](https://github.com/gravitational/teleport/pull/3014)
-*   Added support for X11 forwarding to OpenSSH servers. [#3401](https://github.com/gravitational/teleport/issues/3401)
-*   Added support for auth plugins in proxy `kubeconfig`. [#3655](https://github.com/gravitational/teleport/pull/3655)
-*   Added support for OpenSSH-like escape sequence. [#3752](https://github.com/gravitational/teleport/pull/3752)
-*   Added `--browser` flag to `tsh`. [#3737](https://github.com/gravitational/teleport/pull/3737)
-*   Updated `teleport configure` output to be more useful out of the box. [#3429](https://github.com/gravitational/teleport/pull/3429)
-*   Updated ability to only show SSO on the login page. [#2789](https://github.com/gravitational/teleport/issues/2789)
-*   Updated help and support section in Web UI. [#3531](https://github.com/gravitational/teleport/issues/3531)
-*   Updated default SSH signing algorithm to SHA-512 for new clusters. [#3777](https://github.com/gravitational/teleport/pull/3777)
-*   Standardized audit event fields.
-
-#### Fixes
-
-*   Fixed removing existing user definitions in kubeconfig. [#3209](https://github.com/gravitational/teleport/issues/3749)
-*   Fixed an issue where port forwarding could fail in certain circumstances. [#3749](https://github.com/gravitational/teleport/issues/3749)
-*   Fixed temporary role grants issue when forwarding Kubernetes requests. [#3624](https://github.com/gravitational/teleport/pull/3624)
-*   Fixed an issue that prevented copy/paste in the web termination. [#92](https://github.com/gravitational/webapps/issues/92)
-*   Fixed an issue where the proxy did not test Kubernetes permissions at startup. [#3812](https://github.com/gravitational/teleport/pull/3812)
-*   Fixed `tsh` and `gpg-agent` integration. [#3169](https://github.com/gravitational/teleport/issues/3169)
-*   Fixed Vulnerabilities in Teleport Docker Image [https://quay.io/repository/gravitational/teleport?tab=tags](https://quay.io/repository/gravitational/teleport?tab=tags)
-
-#### Upgrade Notes
-
-Always follow the [recommended upgrade
-procedure](docs/pages/upgrading/upgrading.mdx) to upgrade to this version.
-
-##### New Signing Algorithm
-
-If you’re upgrading an existing version of Teleport, you may want to consider rotating CA to SHA-256 or SHA-512 for RSA SSH certificate signatures. The previous default was SHA-1, which is now considered to be weak against brute-force attacks. SHA-1 certificate signatures are also [no longer accepted](https://www.openssh.com/releasenotes.html) by OpenSSH versions 8.2 and above. All new Teleport clusters will default to SHA-512 based signatures. To upgrade an existing cluster, set the following in your `teleport.yaml`:
-
-```
-teleport:
-    ca_signature_algo: "rsa-sha2-512"
-```
-
-Rotate the cluster CA, following [these
-docs](docs/pages/admin-guides/management/operations/ca-rotation.mdx).
-
-##### Web UI
-
-Due to the number of changes included in the redesigned Web UI, some URLs and functionality have shifted. Refer to the following ticket for more details. [#3580](https://github.com/gravitational/teleport/issues/3580)
-
-##### RBAC for Audit Log and Recorded Sessions
-
-Teleport 4.3 has made the audit log accessible via the Web UI. Enterprise customers
-can limit access by changing the options on the new `event` resource.
-
-```yaml
-# list and read audit log, including audit events and recorded sessions
-- resources: [event]
-  verbs: [list, read]
-```
-
-##### Kubernetes Permissions
-
-The minimum set of Kubernetes permissions that need to be granted to Teleport
-proxies has been updated. If you use the Kubernetes integration, please make
-sure that the ClusterRole used by the proxy has [sufficient
-permissions](./docs/pages/enroll-resources/kubernetes-access/controls.mdx).
-
-##### Path prefix for etcd
-
-The [etcd backend](docs/pages/reference/backends.mdx#etcd) now correctly uses
-the “prefix” config value when storing data. Upgrading from 4.2 to 4.3 will
-migrate the data as needed at startup. Make sure you follow our Teleport
-[upgrade guidance](docs/pages/upgrading/upgrading.mdx).
-
-**Note: If you use an etcd backend with a non-default prefix and need to downgrade from 4.3 to 4.2, you should [backup Teleport data and restore it](docs/pages/admin-guides/management/operations/backup-restore.mdx) into the downgraded cluster.**
-
-## 4.2.12
-
-This release of Teleport contains a security fix.
-
-* Mitigated [CVE-2020-15216](https://nvd.nist.gov/vuln/detail/CVE-2020-15216) by updating github.com/russellhaering/goxmldsig.
-
-### Details
-A vulnerability was discovered in the `github.com/russellhaering/goxmldsig` library which is used by Teleport to validate the
-signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
-bypass XML signature validation and pass off an altered file as a signed one.
-
-### Actions
-The `goxmldsig` library has been updated upstream and Teleport 4.2.12 includes the fix. Any Enterprise SSO users using Okta,
-Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 4.2.12 and restart Teleport.
-
-If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
-
-## 4.2.11
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed an issue that prevented upload of session archives to NFS volumes. [#3780](https://github.com/gravitational/teleport/pull/3780)
-* Fixed an issue with port forwarding that prevented TCP connections from being closed correctly. [#3801](https://github.com/gravitational/teleport/pull/3801)
-* Fixed an issue in `tsh` that would cause connections to the Auth Service to fail on large clusters. [#3872](https://github.com/gravitational/teleport/pull/3872)
-* Fixed an issue that prevented the use of Write-Only roles with S3 and GCS. [#3810](https://github.com/gravitational/teleport/pull/3810)
-
-## 4.2.10
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed an issue that caused Teleport environment variables not to be available in PAM modules. [#3725](https://github.com/gravitational/teleport/pull/3725)
-* Fixed an issue with `tsh login <clusterName>` not working correctly with Kubernetes clusters. [#3693](https://github.com/gravitational/teleport/issues/3693)
-
-## 4.2.9
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed an issue where double `tsh login` would be required to login to a leaf cluster. [#3639](https://github.com/gravitational/teleport/pull/3639)
-* Fixed an issue that was preventing connection reuse. [#3613](https://github.com/gravitational/teleport/pull/3613)
-* Fixed an issue that could cause `tsh ls` to return stale results. [#3536](https://github.com/gravitational/teleport/pull/3536)
-
-## 4.2.8
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed issue where `^C` would not terminate `tsh`. [#3456](https://github.com/gravitational/teleport/pull/3456)
-* Fixed an issue where enhanced session recording could cause Teleport to panic. [#3506](https://github.com/gravitational/teleport/pull/3506)
-
-## 4.2.7
-
-As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
-
-### Details
-
-Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
-
-Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
-
-Command line programs like `tsh` (or `ssh`) are not affected by this vulnerability.
-
-### Actions
-
-To mitigate this issue, upgrade and restart all Teleport proxy processes.
-
-## 4.2.6
-
-This release of Teleport contains a bug fix.
-
-* Fixed a regression in reissuing certificate that could cause nodes to not start. [#3449](https://github.com/gravitational/teleport/pull/3449)
-
-## 4.2.5
-
-This release of Teleport contains multiple bug fixes.
-
-* Added support for custom OIDC prompts. [#3409](https://github.com/gravitational/teleport/pull/3409)
-* Added support for `kubernetes_users` in roles. [#3409](https://github.com/gravitational/teleport/pull/3404)
-* Added support for extended variable interpolation. [#3409](https://github.com/gravitational/teleport/pull/3404)
-* Added SameSite attribute to CSRF cookie. [#3441](https://github.com/gravitational/teleport/pull/3441)
-
-## 4.2.4
-
-This release of Teleport contains bug fixes.
-
-* Fixed issue where Teleport could connect to the wrong node and added support to connect via UUID. [#2396](https://github.com/gravitational/teleport/issues/2396)
-* Fixed issue where `tsh login` would fail to output identity when using the `--out` parameter. [#3339](https://github.com/gravitational/teleport/issues/3339)
-
-## 4.2.3
-
-This release of Teleport contains bug and security fixes.
-
-* Mitigated [CVE-2020-9283](https://groups.google.com/forum/#!msg/golang-announce/3L45YRc91SY/ywEPcKLnGQAJ) by updating golang.org/x/crypto.
-* Fixed PAM integration to support user creation upon login. [#3317](https://github.com/gravitational/teleport/pull/3317) [#3346](//github.com/gravitational/teleport/pull/3346)
-* Improved Teleport performance on large IoT clusters. [#3227](https://github.com/gravitational/teleport/issues/3227)
-* Added support for PluginData to Teleport plugins. [#3286](https://github.com/gravitational/teleport/issues/3286) [#3298](https://github.com/gravitational/teleport/issues/3298)
-
-## 4.2.2
-
-This release of Teleport contains bug fixes and improvements.
-
-* Fixed a regression in role mapping between trusted clusters. [#3252](https://github.com/gravitational/teleport/issues/3252)
-* Improved variety of issues with Enhanced Session Recording including support for more operating systems and install from packages. [#3279](https://github.com/gravitational/teleport/pull/3279)
-
-## 4.2.1
-
-This release of Teleport contains bug fixes and minor usability improvements.
-
-* New build command for client-only (`tsh`) .pkg builds. [#3159](https://github.com/gravitational/teleport/pull/3159)
-* Added support for etcd password auth. [#3234](https://github.com/gravitational/teleport/pull/3234)
-* Added third-party s3 support. [#3234](https://github.com/gravitational/teleport/pull/3234)
-* Fixed an issue where access-request event system fails when cache is enabled. [#3223](https://github.com/gravitational/teleport/pull/3223)
-* Fixed cgroup resolution so enhanced session recording works on Debian based distributions. [#3215](https://github.com/gravitational/teleport/pull/3215)
-
-## 4.2.0
-
-This is a minor Teleport release with a focus on new features and bug fixes.
-
-### Improvements
-
-* Alpha: Enhanced Session Recording lets you know what's really happening during a Teleport Session. [#2948](https://github.com/gravitational/teleport/issues/2948)
-* Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. [Read the docs](docs/pages/admin-guides/access-controls/access-requests/access-requests.mdx). [#3006](https://github.com/gravitational/teleport/issues/3006)
-* Beta: Teleport provides HA Support using Firestore and Google Cloud Storage using Google Cloud Platform. [Read the docs](docs/pages/admin-guides/deploy-a-cluster/deployments/gcp.mdx). [#2821](https://github.com/gravitational/teleport/pull/2821)
-* Remote tctl execution is now possible. [Read the docs](./docs/pages/reference/cli/tctl.mdx). [#1525](https://github.com/gravitational/teleport/issues/1525) [#2991](https://github.com/gravitational/teleport/issues/2991)
-
-### Fixes
-
-* Fixed issue in socks4 when rendering remote address [#3110](https://github.com/gravitational/teleport/issues/3110)
-
-### Documentation
-
-* Adopting root/leaf terminology for trusted clusters. [Trusted cluster documentation](docs/pages/admin-guides/management/admin/trustedclusters.mdx).
-* Documented Teleport FedRAMP & FIPS Support. [FedRAMP & FIPS documentation](docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx).
-
-## 4.1.11
-
-This release of Teleport contains a security fix.
-
-* Mitigated [CVE-2020-15216](https://nvd.nist.gov/vuln/detail/CVE-2020-15216) by updating github.com/russellhaering/goxmldsig.
-
-### Details
-A vulnerability was discovered in the `github.com/russellhaering/goxmldsig` library which is used by Teleport to validate the
-signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
-bypass XML signature validation and pass off an altered file as a signed one.
-
-### Actions
-The `goxmldsig` library has been updated upstream and Teleport 4.1.11 includes the fix. Any Enterprise SSO users using Okta,
-Active Directory, OneLogin or custom SAML connectors should upgrade their Auth Service to version 4.1.11 and restart Teleport.
-
-If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
-
-## 4.1.10
-
-As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
-
-### Details
-
-Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
-
-Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
-
-Command line programs like `tsh` (or `ssh`) are not affected by this vulnerability.
-
-### Actions
-
-To mitigate this issue, upgrade and restart all Teleport proxy processes.
-
-## 4.1.9
-
-This release of Teleport contains a security fix.
-
-* Mitigated [CVE-2020-9283](https://groups.google.com/forum/#!msg/golang-announce/3L45YRc91SY/ywEPcKLnGQAJ) by updating golang.org/x/crypto.
-
-## 4.1.8
-
-This release of Teleport contains a bug fix.
-
-* Fixed a regression in role mapping between trusted clusters. [#3252](https://github.com/gravitational/teleport/issues/3252)
-
-## 4.1.7
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue where the port forwarding option in a role was ignored. [#3208](https://github.com/gravitational/teleport/pull/3208)
-
-## 4.1.6
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue that caused Teleport not to start with certain OIDC claims. [#3053](https://github.com/gravitational/teleport/issues/3053)
-
-## 4.1.5
-
-This release of Teleport adds support for an older version of Linux.
-
-* Added RHEL/CentOS 6.x builds to the build pipeline. [#3175](https://github.com/gravitational/teleport/pull/3175)
-
-## 4.1.4
-
-This release of Teleport contains a bug fix.
-
-* Fixed GSuite integration by adding support for service accounts. [#3122](https://github.com/gravitational/teleport/pull/3122)
-
-## 4.1.3
-
-This release of Teleport contains multiple bug fixes.
-
-* Removed `TLS_RSA_WITH_AES_128_GCM_SHA{256,384}` from default ciphersuites due to compatibility issues with HTTP2.
-* Fixed issues with `local_auth` for FIPS builds. [#3100](https://github.com/gravitational/teleport/pull/3100)
-* Upgraded Go runtime to 1.13.2 to mitigate [CVE-2019-16276](https://github.com/golang/go/issues/34540) and [CVE-2019-17596](https://github.com/golang/go/issues/34960).
-
-## 4.1.2
-
-This release of Teleport contains improvements to the build code.
-
-* Added support for building Docker images using the FIPS-compliant version of Teleport. The first of these images is quay.io/gravitational/teleport-ent:4.1.2-fips
-* In future, these images will be automatically built for use by Teleport Enterprise customers.
-
-## 4.1.1
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue with multi-cluster EKS when the Teleport proxy runs outside EKS. [#3070](https://github.com/gravitational/teleport/pull/3070)
-
-## 4.1.0
-
-This is a major Teleport release with a focus on stability and bug fixes.
-
-### Improvements
-
-* Support for IPv6. [#2124](https://github.com/gravitational/teleport/issues/2124)
-* Kubernetes support does not require SNI. [#2766](https://github.com/gravitational/teleport/issues/2766)
-* Support use of a path for `auth_token` in `teleport.yaml`. [#2515](https://github.com/gravitational/teleport/issues/2515)
-* Implement ProxyJump compatibility. [#2543](https://github.com/gravitational/teleport/issues/2543)
-* Audit logs should show roles. [#2823](https://github.com/gravitational/teleport/issues/2823)
-* Allow `tsh` to go background and without executing remote command. [#2297](https://github.com/gravitational/teleport/issues/2297)
-* Provide a high level tool to backup and restore the cluster state. [#2480](https://github.com/gravitational/teleport/issues/2480)
-* Investigate nodes using stale list when connecting to proxies (discovery protocol). [#2832](https://github.com/gravitational/teleport/issues/2832)
-
-### Fixes
-
-* Proxy can hang due to invalid OIDC connector. [#2690](https://github.com/gravitational/teleport/issues/2690)
-* Proper `-D` flag parsing. [#2663](https://github.com/gravitational/teleport/issues/2663)
-* `tsh` status does not show correct cluster name. [#2671](https://github.com/gravitational/teleport/issues/2671)
-* Teleport truncates MOTD with PAM. [#2477](https://github.com/gravitational/teleport/issues/2477)
-* Miscellaneous fixes around error handling and reporting.
-
-## 4.0.16
-
-As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
-
-### Details
-
-Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
-
-Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
-
-Command line programs like `tsh` (or `ssh`) are not affected by this vulnerability.
-
-### Actions
-
-To mitigate this issue, upgrade and restart all Teleport proxy processes.
-
-## 4.0.15
-
-This release of Teleport contains a security fix.
-
-* Mitigated [CVE-2020-9283](https://groups.google.com/forum/#!msg/golang-announce/3L45YRc91SY/ywEPcKLnGQAJ) by updating golang.org/x/crypto.
-
-## 4.0.14
-
-This release of Teleport contains a bug fix.
-
-* Fixed a regression in role mapping between trusted clusters. [#3252](https://github.com/gravitational/teleport/issues/3252)
-
-## 4.1.13
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue where the port forwarding option in a role was ignored. [#3208](https://github.com/gravitational/teleport/pull/3208)
-
-## 4.0.12
-
-This release of Teleport contains a bug fix.
-
-* Fixed an issue that caused Teleport not to start with certain OIDC claims. [#3053](https://github.com/gravitational/teleport/issues/3053)
-
-## 4.0.11
-
-This release of Teleport adds support for an older version of Linux.
-
-* Added RHEL/CentOS 6.x builds to the build pipeline. [#3175](https://github.com/gravitational/teleport/pull/3175)
-
-## 4.0.10
-
-This release of Teleport contains a bug fix.
-
-* Fixed a goroutine leak that occurred whenever a leaf cluster disconnected from the root cluster. [#3037](https://github.com/gravitational/teleport/pull/3037)
-
-## 4.0.9
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue where Web UI could not connect to older nodes within a cluster. [#2993](https://github.com/gravitational/teleport/pull/2993)
-
-## 4.0.8
-
-This release of Teleport contains two bug fixes.
-
-### Description
-
-* Fixed issue where new versions of `tsh` could not connect to older clusters. [#2969](https://github.com/gravitational/teleport/pull/2969)
-* Fixed trait encoding to be more robust. [#2970](https://github.com/gravitational/teleport/pull/2970)
-
-## 4.0.6
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue introduced in 4.0.5 that broke session recording when using the recording proxy. [#2957](https://github.com/gravitational/teleport/pull/2957)
-
-## 4.0.4
-
-This release of Teleport contains a bug fix.
-
-* Fixed a memory leak in the cache module. [#2892](https://github.com/gravitational/teleport/pull/2892)
-
-## 4.0.3
-
-* Reduced keep-alive interval to improve interoperability with popular load balancers. [#2845](https://github.com/gravitational/teleport/issues/2845)
-* Fixed issue where non-RSA certificates were rejected when not in FIPS mode. [#2805](https://github.com/gravitational/teleport/pull/2879)
-
-## 4.0.2
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed an issue that caused active sessions not to be shown. [#2801](https://github.com/gravitational/teleport/issues/2801)
-* Fixed further issues with host certificate principal generation. [#2812](https://github.com/gravitational/teleport/pull/2812)
-* Fixed issue where fetching CA would sometimes return not found. [#2805](https://github.com/gravitational/teleport/pull/2805)
-
-## 4.0.1
-
-This release of Teleport contains multiple bug fixes.
-
-* Fixed issue that caused processes to be spawned with an incorrect GID. [#2791](https://github.com/gravitational/teleport/pull/2791)
-* Fixed host certificate principal generation to only include hosts or IP addresses. [#2790](https://github.com/gravitational/teleport/pull/2790)
-* Fixed issue preventing `tsh` 4.0 from connection to 3.2 clusters. [#2784](https://github.com/gravitational/teleport/pull/2784)
-
-## 4.0.0
-
-This is a major Teleport release which introduces support for Teleport Internet of Things (IoT). In addition to this new feature this release includes usability, performance, and bug fixes listed below.
-
-### New Features
-
-#### Teleport for IoT
-
-With Teleport 4.0, nodes gain the ability to use reverse tunnels to dial back to a Teleport cluster to bypass firewall restrictions. This allows connections even to nodes that a cluster does not have direct network access to. Customers that have been using Trusted Clusters to achieve this can now utilize a unified interface to access all nodes within their infrastructure.
-
-#### FedRamp Compliance
-
-With this release of Teleport, we have built out the foundation to help Teleport Enterprise customers build and meet the requirements in a FedRAMP System Security Plan (SSP). This includes a FIPS 140-2 friendly build of Teleport Enterprise as well as a variety of improvements to aid in complying with security controls even in FedRAMP High environments.
-
-### Improvements
-
-* Teleport now support 10,000 remote connections to a single Teleport cluster. [Using our recommend hardware setup.](docs/pages/admin-guides/management/operations/scaling.mdx)
-* Added ability to delete node using `tctl rm`. [#2685](https://github.com/gravitational/teleport/pull/2685)
-* Output of `tsh ls` is now sorted by node name. [#2534](https://github.com/gravitational/teleport/pull/2534)
-
-### Bug Fixes
-
-* Switched to `xdg-open` to open a browser window on Linux. [#2536](https://github.com/gravitational/teleport/pull/2536)
-* Increased SSO callback timeout to 180 seconds. [#2533](https://github.com/gravitational/teleport/pull/2533)
-* Set permissions on TTY similar to OpenSSH. [#2508](https://github.com/gravitational/teleport/pull/2508)
-
-The lists of improvements and bug fixes above mention only the significant changes, please take a look at the complete list on Github for more.
-
-### Upgrading
-
-Teleport 4.0 is backwards compatible with Teleport 3.2 and later. [Follow the recommended upgrade procedure to upgrade to this version.](docs/pages/upgrading/upgrading.mdx)
-
-Note that due to substantial changes between Teleport 3.2 and 4.0, we recommend creating a backup of the backend datastore (DynamoDB, etcd, or dir) before upgrading a cluster to Teleport 4.0 to allow downgrades.
-
-#### Notes on compatibility
-
-Teleport has always validated host certificates when a client connects to a server, however prior to Teleport 4.0, Teleport did not validate the host the user requests a connection to is in the list of principals on the certificate. To avoid issues during the upgrade, make sure the hosts you connect to have the appropriate address set in `public_addr` in `teleport.yaml` before upgrading.
-
-## 3.2.15
-
-This release of Teleport contains a bug fix.
-
-* Fixed a regression in role mapping between trusted clusters. [#3252](https://github.com/gravitational/teleport/issues/3252)
-
-## 3.2.14
-
-This release of Teleport contains a bug fix and a feature.
-
-* Restore `CreateWebSession` method used by some integrations. [#3076](https://github.com/gravitational/teleport/pull/3076)
-* Add Docker registry and Helm repository support to `tsh login`. [#3045](https://github.com/gravitational/teleport/pull/3045)
-
-## 3.2.13
-
-This release of Teleport contains a bug fix.
-
-### Description
-
-* Fixed issue with TLS certificate not included in identity exported by `tctl auth sign`. [#3001](https://github.com/gravitational/teleport/pull/3001)
-
-## 3.2.12
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue where Web UI could not connect to older nodes within a cluster. [#2993](https://github.com/gravitational/teleport/pull/2993)
-
-## 3.2.11
-
-This release of Teleport contains two bug fixes.
-
-* Fixed issue where new versions of `tsh` could not connect to older clusters. [#2969](https://github.com/gravitational/teleport/pull/2969)
-* Fixed trait encoding to be more robust. [#2970](https://github.com/gravitational/teleport/pull/2970)
-
-## 3.2.9
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue introduced in 3.2.8 that broke session recording when using the recording proxy. [#2957](https://github.com/gravitational/teleport/pull/2957)
-
-## 3.2.4
-
-This release of Teleport contains multiple bug fixes.
-
-* Read cluster name from `TELEPORT_SITE` environment variable in `tsh`. [#2675](https://github.com/gravitational/teleport/pull/2675)
-* Multiple improvements around logging in and saving `tsh` profiles. [#2657](https://github.com/gravitational/teleport/pull/2657)
-
-## 3.2.2
-
-This release of Teleport contains a bug fix.
-
-#### Changes
-
-* Fixed issue with `--bind-addr` implementation. [#2650](https://github.com/gravitational/teleport/pull/2650)
-
-## 3.2.1
-
-This release of Teleport contains a new feature.
-
-#### Changes
-
-* Added `--bind-addr` to force `tsh` to bind to a specific port during SSO login. [#2620](https://github.com/gravitational/teleport/issues/2620)
-
-## 3.2
-
-This version brings support for Amazon's managed Kubernetes offering (EKS).
-
-Starting with this release, Teleport proxy uses [the impersonation API](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) instead of the [CSR API](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#requesting-a-certificate).
-
-## 3.1.14
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue where Web UI could not connect to older nodes within a cluster. [#2993](https://github.com/gravitational/teleport/pull/2993)
-
-## 3.1.13
-
-This release of Teleport contains two bug fixes.
-
-* Fixed issue where new versions of `tsh` could not connect to older clusters. [#2969](https://github.com/gravitational/teleport/pull/2969)
-* Fixed trait encoding to be more robust. [#2970](https://github.com/gravitational/teleport/pull/2970)
-
-## 3.1.11
-
-This release of Teleport contains a bug fix.
-
-* Fixed issue introduced in 3.1.10 that broke session recording when using the recording proxy. [#2957](https://github.com/gravitational/teleport/pull/2957)
-
-## 3.1.8
-
-This release of Teleport contains a bug fix.
-
-#### Changes
-
-* Fixed issue where SSO users TTL was set incorrectly. [#2564](https://github.com/gravitational/teleport/pull/2564)
-
-## 3.1.7
-
-This release of Teleport contains a bug fix.
-
-#### Changes
-
-* Fixed issue where `tctl users ls` output contained duplicates. [#2569](https://github.com/gravitational/teleport/issues/2569) [#2107](https://github.com/gravitational/teleport/issues/2107)
-
-## 3.1.6
-
-This release of Teleport contains bug fixes, security fixes, and user experience improvements.
-
-#### Changes
-
-* Use `xdg-open` instead of `sensible-browser` to open links on Linux. [#2454](https://github.com/gravitational/teleport/issues/2454)
-* Increased SSO callback timeout to 180 seconds. [#2483](https://github.com/gravitational/teleport/issues/2483)
-* Improved Teleport error messages when it fails to start. [#2525](https://github.com/gravitational/teleport/issues/2525)
-* Sort `tsh ls` output by node name. [#2511](https://github.com/gravitational/teleport/issues/2511)
-* Support different regions for S3 (sessions) and DynamoDB (audit log). [#2007](https://github.com/gravitational/teleport/issues/2007)
-* Fixed syslog output even when Teleport is in debug mode. [#2550](https://github.com/gravitational/teleport/issues/2550)
-* Fixed audit log naming conventions. [#2388](https://github.com/gravitational/teleport/issues/2388)
-* Fixed issue where `~/.tsh/profile` was deleted upon logout. [#2546](https://github.com/gravitational/teleport/issues/2546)
-* Fixed output of `tctl get` to be compatible with `tctl create`. [#2479](https://github.com/gravitational/teleport/issues/2479)
-* Fixed issue where multiple file upload with `scp` did not work correctly. [#2094](https://github.com/gravitational/teleport/issues/2094)
-* Correctly set permissions TTY. [#2540](https://github.com/gravitational/teleport/issues/2540)
-* Mitigated scp issues when connected to malicious server [#2539](https://github.com/gravitational/teleport/issues/2539)
-
-## 3.1.5
-
-Teleport 3.1.5 contains a bug fix and security fix.
-
-#### Bug fixes
-
-* Fixed issue where certificate authorities were not fetched during every login. [#2526](https://github.com/gravitational/teleport/pull/2526)
-* Upgraded Go to 1.11.5 to mitigate [CVE-2019-6486](https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw): CPU denial of service in P-521 and P-384 elliptic curve implementation.
-
-## 3.1.4
-
-Teleport 3.1.4 contains one new feature and two bug fixes.
-
-#### New Feature
-
-* Added support for GSuite as a SSO provider. [#2455](https://github.com/gravitational/teleport/issues/2455)
-
-#### Bug fixes
-
-* Fixed issue where Kubernetes groups were not being passed to remote clusters. [#2484](https://github.com/gravitational/teleport/pull/2484)
-* Fixed issue where the client was pulling incorrect CA for trusted clusters. [#2487](https://github.com/gravitational/teleport/pull/2487)
-
-## 3.1.3
-
-Teleport 3.1.3 contains two security fixes.
-
-#### Bugfixes
-
-* Updated xterm.js to mitigate a [RCE in xterm.js](https://github.com/xtermjs/xterm.js/releases/tag/3.10.1).
-* Mitigate potential timing attacks during bearer token authentication. [#2482](https://github.com/gravitational/teleport/pull/2482)
-* Fixed `x509: certificate signed by unknown authority` error when connecting to DynamoDB within Gravitational publish Docker image. [#2473](https://github.com/gravitational/teleport/pull/2473)
-
-## 3.1.2
-
-Teleport 3.1.2 contains a security fix. We strongly encourage anyone running Teleport 3.1.1 to upgrade.
-
-#### Bugfixes
-
-* Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal Auth Service API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
-
-## 3.1.1
-
-Teleport 3.1.1 contains a security fix. We strongly encourage anyone running Teleport 3.1.0 to upgrade.
-
-* Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: [CPU denial of service in chain validation](https://golang.org/issue/29233) Go. For customers using the RHEL5.x compatible release of Teleport, we've backported this fix to Go 1.9.7, before releasing RHEL 5.x compatible binaries.
-
-## 3.1
-
-This is a major Teleport release with a focus on backwards compatibility, stability, and bug fixes. Some of the improvements:
-
-* Added support for regular expressions in RBAC label keys and values. [#2161](https://github.com/gravitational/teleport/issues/2161)
-* Added support for configurable server side keepalives. [#2334](https://github.com/gravitational/teleport/issues/2334)
-* Added support for some `-o` to improve OpenSSH interoperability. [#2330](https://github.com/gravitational/teleport/issues/2330)
-* Added i386 binaries as well as binaries built with older version of Go to support legacy systems. [#2277](https://github.com/gravitational/teleport/issues/2277)
-* Added SOCKS5 support to `tsh`. [#1693](https://github.com/gravitational/teleport/issues/1693)
-* Improved UX and security for nodes joining a cluster. [#2294](https://github.com/gravitational/teleport/issues/2294)
-* Improved Kubernetes UX. [#2291](https://github.com/gravitational/teleport/issues/2291) [#2258](https://github.com/gravitational/teleport/issues/2258) [#2304](https://github.com/gravitational/teleport/issues/2304)
-* Fixed bug that did not allow copy and paste of texts over 128 in the Web UI. [#2313](https://github.com/gravitational/teleport/issues/2313)
-* Fixes issues with `scp` when using the Web UI. [#2300](https://github.com/gravitational/teleport/issues/2300)
-
-## 3.0.5
-
-Teleport 3.0.5 contains a security fix.
-
-#### Bug fixes
-
-* Upgraded Go to 1.11.5 to mitigate [CVE-2019-6486](https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw): CPU denial of service in P-521 and P-384 elliptic curve implementation.
-
-## 3.0.4
-
-Teleport 3.0.4 contains two security fixes.
-
-#### Bugfixes
-
-* Updated xterm.js to mitigate a [RCE in xterm.js](https://github.com/xtermjs/xterm.js/releases/tag/3.10.1).
-* Mitigate potential timing attacks during bearer token authentication. [#2482](https://github.com/gravitational/teleport/pull/2482)
-
-## 3.0.3
-
-Teleport 3.0.3 contains a security fix. We strongly encourage anyone running Teleport 3.0.2 to upgrade.
-
-#### Bugfixes
-
-* Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal Auth Service API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
-
-## 3.0.2
-
-Teleport 3.0.2 contains a security fix. We strongly encourage anyone running Teleport 3.0.1 to upgrade.
-
-* Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: [CPU denial of service in chain validation](https://golang.org/issue/29233) Go. For customers using the RHEL5.x compatible release of Teleport, we've backported this fix to Go 1.9.7, before releasing RHEL 5.x compatible binaries.
-
-## 3.0.1
-
-This release of Teleport contains the following bug fix:
-
-* Fix regression that marked ADFS claims as invalid. [#2293](https://github.com/gravitational/teleport/pull/2293)
-
-## 3.0
-
-This is a major Teleport release which introduces support for Kubernetes
-clusters. In addition to this new feature this release includes several
-usability and performance improvements listed below.
-
-#### Kubernetes Support
-
-* `tsh login` can retrieve and install certificates for both Kubernetes and SSH
-  at the same time.
-* Full audit log support for `kubectl` commands, including recording of the sessions
-  if `kubectl exec` command was interactive.
-* Unified (AKA "single pane of glass") RBAC for both SSH and Kubernetes permissions.
-
-#### Improvements
-
-* Teleport administrators can now fine-tune the enabled ciphersuites [#1999](https://github.com/gravitational/teleport/issues/1999)
-* Improved user experience linking trusted clusters together [#1971](https://github.com/gravitational/teleport/issues/1971)
-* All Teleport components (proxy, auth and nodes) now support `public_addr`
-  setting which allows them to be hosted behind NAT/Load Balancers. [#1793](https://github.com/gravitational/teleport/issues/1793)
-* We have documented the previously undocumented monitoring endpoints [#2103](https://github.com/gravitational/teleport/issues/2103)
-* The `etcd` back-end has been updated to implement 3.3+ protocol. See the upgrading notes below.
-* Listing nodes via `tsh ls` or the web UI no longer shows nodes that the currently logged in user has no access to. [#1954](https://github.com/gravitational/teleport/issues/1954)
-* It is now possible to build `tsh` client on Windows. Note: only `tsh login` command is implemented. [#1996](https://github.com/gravitational/teleport/pull/1996).
-* `-i` flag to `tsh login` is now guarantees to be non-interactive. [#2221](https://github.com/gravitational/teleport/issues/2221)
-
-#### Bugfixes
-
-* Removed the bogus error message "access denied to perform action create on user" [#2132](https://github.com/gravitational/teleport/issues/2132)
-* `scp` implementation in "recording proxy" mode did not work correctly. [#2176](https://github.com/gravitational/teleport/issues/2176)
-* Removed the limit of 8 trusted clusters with SSO. [#2192](https://github.com/gravitational/teleport/issues/2192)
-* `tsh ls` now works correctly when executed on a remote/trusted cluster [#2204](https://github.com/gravitational/teleport/milestone/24?closed=1)
-
-The lists of improvements and bug fixes above mention only the significant
-changes, please take a look at [the complete list](https://github.com/gravitational/teleport/milestone/24?closed=1)
-on Github for more.
-
-#### Upgrading to 3.0
-
-Follow the [recommended upgrade
-procedure](docs/pages/upgrading/upgrading.mdx) to upgrade to this
-version.
-
-**WARNING:** if you are using Teleport with the etcd back-end, make sure your
-`etcd` version is 3.3 or newer prior to upgrading to Teleport 3.0.
-
-## 2.7.9
-
-Teleport 2.7.9 contains a security fix.
-
-#### Bug fixes
-
-* Upgraded Go to 1.11.5 to mitigate [CVE-2019-6486](https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw): CPU denial of service in P-521 and P-384 elliptic curve implementation.
-
-## 2.7.8
-
-Teleport 2.7.8 contains two security fixes.
-
-#### Bugfixes
-
-* Updated xterm.js to mitigate a [RCE in xterm.js](https://github.com/xtermjs/xterm.js/releases/tag/3.10.1).
-* Mitigate potential timing attacks during bearer token authentication. [#2482](https://github.com/gravitational/teleport/pull/2482)
-
-## 2.7.7
-
-Teleport 2.7.7 contains two security fixes. We strongly encourage anyone running Teleport 2.7.6 to upgrade.
-
-#### Bugfixes
-
-* Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal Auth Service API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
-* Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: CPU denial of service in chain validation Go.
-
-## 2.7.6
-
-This release of Teleport contains the following bug fix:
-
-* Fix regression that marked ADFS claims as invalid. [#2293](https://github.com/gravitational/teleport/pull/2293)
-
-## 2.7.5
-
-This release of Teleport contains the following bug fix:
-
-* Teleport Auth Service instances do not delete temporary files named `/tmp/multipart-` [#2250](https://github.com/gravitational/teleport/issues/2250)
-
-## 2.7.4
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Fixed issues with `client_idle_timeout`. [#2166](https://github.com/gravitational/teleport/issues/2166)
-* Added support for scalar and list values for `node_labels` in roles. [#2136](https://github.com/gravitational/teleport/issues/2136)
-* Improved font support on Ubuntu.
-
-## 2.7.3
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Fixed issue that cause `failed executing request: user agent missing` missing error when upgrading from 2.6.
-
-## 2.7.2
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Fixed issue in Teleport 2.7.2 where rollback to Go 1.9.7 was not complete for `linux-amd64` binaries.
-
-## 2.7.1
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Rollback to Go 1.9.7 for users with custom CA running into `x509: certificate signed by unknown authority`.
-
-## 2.7.0
-
-The primary goal of 2.7.0 release was to address the community feedback and improve the performance and flexibility when running Teleport clusters with large number of nodes.
-
-#### New Features
-
-* The Web UI now includes `scp` (secure copy) functionality. This allows Windows users and other users of the Web UI to upload/download files into SSH nodes using a web browser.
-* Fine-grained control over forceful session termination has been added [#1935](https://github.com/gravitational/teleport/issues/1935). It is now possible to:
-  * Forcefully disconnect idle clients (no client activity) after a specified timeout.
-  * Forcefully disconnect clients when their certificates expire in the middle of an active SSH session.
-
-#### Performance Improvements
-
-* Performance of SSH login commands have been improved on large clusters (thousands of nodes). [#2061](https://github.com/gravitational/teleport/issues/2061)
-* DynamoDB storage back-end performance has been improved. [#2021](https://github.com/gravitational/teleport/issues/2021)
-* Performance of session recording via a proxy has been improved [#1966](https://github.com/gravitational/teleport/issues/1966)
-* Connections between trusted clusters are managed better [#2023](https://github.com/gravitational/teleport/issues/2023)
-
-#### Bug Fixes
-
-As always, this release contains several bug fixes. The full list can be seen [here](https://github.com/gravitational/teleport/milestone/25?closed=1). Here are some notable ones:
-
-* It is now possible to issue certificates with a long TTL via admin's `auth sign` tool. Previously they were limited to 30 hours for undocumented reason. [1745](https://github.com/gravitational/teleport/issues/1745)
-* Dynamic label values were shown as empty strings. [2056](https://github.com/gravitational/teleport/issues/2056)
-
-#### Upgrading
-
-Follow the [recommended upgrade
-procedure](docs/pages/upgrading/upgrading.mdx) to upgrade to this
-version.
-
-## 2.6.9
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Fixed issue in Teleport 2.6.8 where rollback to Go 1.9.7 was not complete for `linux-amd64` binaries.
-
-## 2.6.8
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Rollback to Go 1.9.7 for users with custom CA running into `x509: certificate signed by unknown authority`.
-
-## 2.6.7
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Resolved dynamic label regression. [#2056](https://github.com/gravitational/teleport/issues/2056)
-
-## 2.6.5
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Remote clusters no longer try to re-connect to proxies that have been permanently removed. [#2023](https://github.com/gravitational/teleport/issues/2023)
-* Speed up login on systems with many users. [#2021](https://github.com/gravitational/teleport/issues/2021)
-* Improve overall performance of the etcd backend. [#2030](https://github.com/gravitational/teleport/issues/2030)
-* Role login validation now applies after variables have been substituted. [#2022](https://github.com/gravitational/teleport/issues/2022)
-
-## 2.6.3
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Remote clusters no longer try to re-connect to proxies that have been permanently removed. [#2023](https://github.com/gravitational/teleport/issues/2023)
-* Speed up login on systems with many users. [#2021](https://github.com/gravitational/teleport/issues/2021)
-* Improve overall performance of the etcd backend. [#2030](https://github.com/gravitational/teleport/issues/2030)
-* Role login validation now applies after variables have been substituted. [#2022](https://github.com/gravitational/teleport/issues/2022)
-
-## 2.6.2
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Reduced go routine usage by the forwarding proxy. [#1966](https://github.com/gravitational/teleport/issues/1966)
-* Teleport no longer sends full version in the SSH handshake. [#970](https://github.com/gravitational/teleport/issues/970)
-* Force flag works correctly for Trusted Clusters. [#1871](https://github.com/gravitational/teleport/issues/1871)
-* Allow manual creation of Certificate Authorities. [#2001](https://github.com/gravitational/teleport/pull/2001)
-* Include Teleport username in port forwarding events. [#2004](https://github.com/gravitational/teleport/pull/2004)
-* Allow `tctl auth sign` to create user certificate with arbitrary TTL values. [#1745](https://github.com/gravitational/teleport/issues/1745)
-* Upgrade to Go 1.10.3. [#2008](https://github.com/gravitational/teleport/pull/2008)
-
-## 2.6.1
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Use ciphers, KEX, and MAC algorithms from Teleport configuration in reverse tunnel server. [#1984](https://github.com/gravitational/teleport/pull/1984)
-* Update path sanitizer it allow `@`. [#1985](https://github.com/gravitational/teleport/pull/1985)
-
-## 2.6.0
-
-This release of Teleport brings new features, significant performance and
-usability improvements as well usual bugfixes.
-
-During this release cycle, the Teleport source code has been audited for
-security vulnerabilities by Cure53 and this release (2.6.0) contains patches
-for the discovered problems.
-
-#### New Features
-
-* Support for DynamoDB for storing the audit log events. [#1755](https://github.com/gravitational/teleport/issues/1755)
-* Support for Amazon S3 for storing the recorded SSH sessions. [#1755](https://github.com/gravitational/teleport/issues/1755)
-* Support for rotating certificate authorities (CA rotation). [#1899] (https://github.com/gravitational/teleport/pull/1899)
-* Integration with Linux PAM (pluggable authentication modules) subsystem. [#742](https://github.com/gravitational/teleport/issues/742) and [#1766](https://github.com/gravitational/teleport/issues/1766)
-* The new CLI command `tsh status` shows users which Teleport clusters they are authenticated with. [#1628](https://github.com/gravitational/teleport/issues/1628)
-
-Additionally, Teleport 2.6.0 has been submitted to the AWS marketplace. Soon
-AWS users will be able to create properly configured, secure and highly
-available Teleport clusters with ease.
-
-#### Configuration Changes
-
-* Role templates (depreciated in Teleport 2.3) were fully removed. We recommend
-  migrating to role variables which are documented [here](docs/pages/admin-guides/access-controls/guides/role-templates.mdx)
-
-* Resource names (like roles, connectors, trusted clusters) can no longer
-  contain unicode or other special characters. Update the names of all user
-  created resources to only include characters, hyphens, and dots.
-
-* `advertise_ip` has been deprecated and replaced with `public_addr` setting. See [#1803](https://github.com/gravitational/teleport/issues/1803)
-  The existing configuration files will still work, but we advise Teleport
-  administrators to update it to reflect the new format.
-
-* Teleport no longer uses `boltdb` back-end for storing cluster state _by
-  default_.  The new default is called `dir` and it uses JSON files
-  stored in `/var/lib/teleport/backend`. This change applies to brand new
-  Teleport installations, the existing clusters will continue to use `boltdb`.
-
-* The default set of enabled cryptographic primitives has been
-  updated to reflect the latest state of SSH and TLS security. [#1856](https://github.com/gravitational/teleport/issues/1856).
-
-#### Bug Fixes
-
-The list of most visible bug fixes in this release:
-
-* `tsh` now properly handles Ctrl+C [#1882](https://github.com/gravitational/teleport/issues/1882)
-* High CPU utilization on ARM platforms during daemon start-up. [#1886](https://github.com/gravitational/teleport/issues/1886)
-* Terminal window size can get out of sync on AWS. [#1874](https://github.com/gravitational/teleport/issues/1874)
-* Some CLI commands print errors twice. [#1889](https://github.com/gravitational/teleport/issues/1889)
-* SSH session playback can be interrupted for long sessions. [#1774](https://github.com/gravitational/teleport/issues/1774)
-* Processing `HUP` UNIX signal is unreliable when `teleport` daemon runs under `systemd`. [#1844](https://github.com/gravitational/teleport/issues/1844)
-
-You can see the full list of 2.6.0 changes [here](https://github.com/gravitational/teleport/milestone/22?closed=1).
-
-#### Upgrading
-
-Follow the [recommended upgrade
-procedure](docs/pages/upgrading/upgrading.mdx) to upgrade to this
-version.
-
-## 2.5.7
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Allow creation of users from `tctl create`. [#1949](https://github.com/gravitational/teleport/pull/1949)
-
-## 2.5.6
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Improvements to Teleport HUP signal handling for more reliable reload.  [#1844](https://github.com/gravitational/teleport/issues/1844)
-* Restore output format of `tctl nodes add --format=json`. [#1846](https://github.com/gravitational/teleport/issues/1846)
-
-## 2.5.5
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Allow creation of multiple sessions per connection (fixes Ansible issues with the recording proxy). [#1811](https://github.com/gravitational/teleport/issues/1811)
-
-## 2.5.4
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Only reset SIGINT handler if it has not been set to ignore. [#1814](https://github.com/gravitational/teleport/pull/1814)
-* Improvement of user-visible errors. [#1798](https://github.com/gravitational/teleport/issues/1798) [#1779](https://github.com/gravitational/teleport/issues/1779)
-
-## 2.5.3
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Fix logging, collect status of forked processes. [#1785](https://github.com/gravitational/teleport/issues/1785) [#1776](https://github.com/gravitational/teleport/issues/1776)
-* Turn off proxy support when no-tls is used. [#1800](https://github.com/gravitational/teleport/issues/1800)
-* Correct the signup URL. [#1777](https://github.com/gravitational/teleport/issues/1777)
-* Fix GitHub team pagination issues. [#1734](https://github.com/gravitational/teleport/issues/1734)
-* Increase global dial timeout to 30 seconds. [#1760](https://github.com/gravitational/teleport/issues/1760)
-* Reuse existing singing key. [#1713](https://github.com/gravitational/teleport/issues/1713)
-* Don't panic on channel failures. [#1808](https://github.com/gravitational/teleport/pull/1808)
-
-## 2.5.2
-
-This release of Teleport includes bug fixes and regression fixes.
-
-#### Bug Fixes
-
-* Run session migration in the background. [#1784](https://github.com/gravitational/teleport/pull/1784)
-* Include node name in regenerated host certificates. [#1786](https://github.com/gravitational/teleport/issues/1786)
-
-## 2.5.1
-
-This release of Teleport fixes a regression in Teleport binaries.
-
-#### Bug Fixes
-
-* Binaries for macOS have been rebuilt to resolve "certificate signed by a unknown authority" issue.
-
-## 2.5.0
-
-This is a major release of Teleport. Its goal is to make cloud-native
-deployments easier. Numerous AWS users have contributed feedback to this
-release, which includes:
-
-#### New Features
-
-* Auth servers in highly available (HA) configuration can share the same `/var/lib/teleport`
-  data directory when it's hosted on NFS (or AWS EFS).
-  [#1351](https://github.com/gravitational/teleport/issues/1351)
-
-* There is now an AWS reference deployment in `examples/aws` directory.  It
-  uses Terraform and demonstrates how to deploy large Teleport clusters on AWS
-  using best practices like auto-scaling groups, security groups, secrets
-  management, load balancers, etc.
-
-* The Teleport daemon now implements built-in connection draining which allows
-  zero-downtime upgrades.  [See
-  documentation](docs/pages/upgrading/upgrading.mdx).
-
-* Dynamic join tokens for new nodes can now be explicitly set via `tctl node add --token`.
-  This allows Teleport admins to use an external mechanism for generating
-  cluster invitation tokens.
-  [#1615](https://github.com/gravitational/teleport/pull/1615)
-
-* Teleport now correctly manages certificates for accessing proxies behind a
-  load balancer with the same domain name. The new configuration parameter
-  `public_addr` must be used for this.
-  [#1174](https://github.com/gravitational/teleport/issues/1174).
-
-#### Improvements
-
-* Switching to a new TLS-based Auth Service API improves performance of large clusters.
-  [#1528](https://github.com/gravitational/teleport/issues/1528)
-
-* Session recordings are now compressed by default using gzip. This reduces storage
-  requirements by up to 80% in our real-world tests.
-  [#1579](https://github.com/gravitational/teleport/issues/1528)
-
-* More user-friendly authentication errors in Teleport audit log helps Teleport admins
-  troubleshoot configuration errors when integrating with SAML/OIDC providers.
-  [#1554](https://github.com/gravitational/teleport/issues/1554),
-  [#1553](https://github.com/gravitational/teleport/issues/1553),
-  [#1599](https://github.com/gravitational/teleport/issues/1599)
-
-* `tsh` client will now report if a server's API is no longer compatible.
-
-#### Bug Fixes
-
-* `tsh logout` will now correctly log out from all active Teleport sessions. This is useful
-  for users who're connected to multiple Teleport clusters at the same time.
-  [#1541](https://github.com/gravitational/teleport/issues/1541)
-
-* When parsing YAML, Teleport now supports `--` list item separator to create
-  multiple resources with a single `tctl create` command.
-  [#1663](https://github.com/gravitational/teleport/issues/1663)
-
-* Fixed a panic in the Web UI backend [#1558](https://github.com/gravitational/teleport/issues/1558)
-
-#### Behavior Changes
-
-Certain components of Teleport behave differently in version 2.5. It is important to
-note that these changes are not breaking Teleport functionality. They improve
-Teleport behavior on large clusters deployed on highly dynamic cloud
-environments such as AWS. This includes:
-
-* Session list in the Web UI is now limited to 1,000 sessions.
-* The audit log and recorded session storage has been moved from `/var/lib/teleport/log`
-  to `/var/lib/teleport/log/<auth-server-id>`. This is related to [#1351](https://github.com/gravitational/teleport/issues/1351)
-  described above.
-* When connecting a trusted cluster users can no longer pick an arbitrary name for them.
-  Their own (local) names will be used, i.e. the `cluster_name` setting now defines how
-  the cluster is seen from the outside.
-  [#1543](https://github.com/gravitational/teleport/issues/1543)
-
-## 2.4.7
-
-This release of Teleport contains a bugfix.
-
-#### Bug Fixes
-
-* Only reset SIGINT handler if it has not been set to ignore. [#1814](https://github.com/gravitational/teleport/pull/1814)
-
-## 2.4.6
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Increase global dial timeout to 30 seconds. [#1760](https://github.com/gravitational/teleport/issues/1760)
-* Don't panic on channel failures. [#1808](https://github.com/gravitational/teleport/pull/1808)
-
-## 2.4.5
-
-This release of Teleport fixes a regression in Teleport binaries.
-
-#### Bug Fixes
-
-* Binaries for macOS have been rebuilt to resolve "certificate signed by a unknown authority" issue.
-
-## 2.4.4
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Resolved `tsh logout` regression. [#1541](https://github.com/gravitational/teleport/issues/1541)
-* Binaries for supported platforms all built with Go 1.9.2.
-
-## 2.4.3
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Resolved "access denied" regression in Trusted Clusters. [#1733](https://github.com/gravitational/teleport/issues/1733)
-* Key written with wrong username to `~/.tsh`. [#1749](https://github.com/gravitational/teleport/issues/1749)
-* Resolved Trusted Clusters toggling regression. [#1751](https://github.com/gravitational/teleport/issues/1751)
-
-## 2.4.2
-
-This release of Teleport focuses on bugfixes.
-
-#### Bug Fixes
-
-* Wait for copy to complete before propagating exit-status. [#1646](https://github.com/gravitational/teleport/issues/1646)
-* Don't discard initial bytes in HTTP CONNECT tunnel. [#1659](https://github.com/gravitational/teleport/issues/1659)
-* Pass caching key generator to services and use cache in recording proxy. [#1639](https://github.com/gravitational/teleport/issues/1639)
-* Only display "Change Password" in UI for local users. [#1669](https://github.com/gravitational/teleport/issues/1669)
-* Update Signup URL. [#1643](https://github.com/gravitational/teleport/issues/1643)
-* Improved Teleport version reporting. [#1538](https://github.com/gravitational/teleport/issues/1538)
-* Fixed regressions in terminal size handling and Trusted Clusters introduced in 2.4.1. [#1674](https://github.com/gravitational/teleport/issues/1674) [#1692](https://github.com/gravitational/teleport/issues/1692)
-
-## 2.4.1
-
-This release is focused on fixing a few regressions in Teleport as well as
-adding a new feature.
-
-#### New Features
-
-* Exposed the `--compat` flag to Web UI users. [#1542](https://github.com/gravitational/teleport/issues/1542)
-
-#### Bug Fixes
-
-* Wrap lines correctly on initial login. [#1087](https://github.com/gravitational/teleport/issues/1087)
-* Accept port numbers larger than `32767`: [#1576](https://github.com/gravitational/teleport/issues/1576)
-* Don't show the `Join` button when using the recording proxy. [#1421](https://github.com/gravitational/teleport/issues/1421)
-* Don't double record sessions when using the recording proxy and Teleport nodes. [#1582](https://github.com/gravitational/teleport/issues/1582)
-* Fixed regressions in `tsh login` and `tsh logout`. [#1611](https://github.com/gravitational/teleport/issues/1611) [#1541](https://github.com/gravitational/teleport/issues/1541)
-
-## 2.4.0
-
-This release adds two major new features and a few improvements and bugfixes.
-
-#### New Features
-
-* New Commercial Teleport Editions: "Pro" and "Business" allow users to
-  purchase a Teleport subscription without signing contracts.
-* Teleport now supports SSH session recording even for nodes running OpenSSH [#1327](https://github.com/gravitational/teleport/issues/1327)
-  This feature is called "recording proxy mode".
-* Users of open source edition of Teleport can now authenticate against Github [#1445](https://github.com/gravitational/teleport/issues/1445)
-* The Web UI now supports persistent URLs to Teleport nodes which can be
-  integrated into 3rd party web apps. [#1511](https://github.com/gravitational/teleport/issues/1511)
-* Session recording can now be turned off [#1430](https://github.com/gravitational/teleport/pull/1430)
-
-#### Deprecated Features
-
-* Teleport client `tsh` no longer supports being an SSH agent. We recommend
-  using build-in SSH agents for MacOS and Linux, like `ssh-agent` from
-  `openssh-client` package.
-
-#### Bug Fixes
-
-There have been numerous small usability and performance improvements, but some
-notable fixed bugs are listed below:
-
-* Resource (file descriptor) leak [#1433](https://github.com/gravitational/teleport/issues/1433)
-* Correct handling of the terminal type [#1402](https://github.com/gravitational/teleport/issues/1402)
-* Crash on startup [#1395](https://github.com/gravitational/teleport/issues/1395)
-
-## 2.3.5
-
-This release is focused on fixing a few regressions in configuration and UI/UX.
-
-#### Improvements
-
-* Updated documentation to accurately reflect 2.3 changes
-* Web UI can use introspection so users can skip explicitly specifying SSH port [#1410](https://github.com/gravitational/teleport/issues/1410)
-
-#### Bug fixes
-
-* Fixed issue of MFA users getting prematurely locked out [#1347](https://github.com/gravitational/teleport/issues/1347)
-* UI (regression) when invite link is expired, nothing is shown to the user  [#1400](https://github.com/gravitational/teleport/issues/1400)
-* OIDC regression with some providers [#1371](https://github.com/gravitational/teleport/issues/1371)
-* Legacy configuration for trusted clusters regression: [#1381](https://github.com/gravitational/teleport/issues/1381)
-* Dynamic tokens for adding nodes: "access denied" [#1348](https://github.com/gravitational/teleport/issues/1348)
-
-## 2.3.1
-
-#### Bug fixes
-
-* Added CSRF protection to login endpoint. [#1356](https://github.com/gravitational/teleport/issues/1356)
-* Proxy subsystem handling is more robust. [#1336](https://github.com/gravitational/teleport/issues/1336)
-
-## 2.3
-
-This release focus was to increase Teleport user experience in the following areas:
-
-* Easier configuration via `tctl` resource commands.
-* Improved documentation, with expanded 'examples' directory.
-* Improved CLI interface.
-* Web UI improvements.
-
-#### Improvements
-
-* Web UI: users can connect to OpenSSH servers using the Web UI.
-* Web UI now supports arbitrary SSH logins, in addition to role-defined ones, for better compatibility with OpenSSH.
-* CLI: trusted clusters can now be managed on the fly without having to edit Teleport configuration. [#1137](https://github.com/gravitational/teleport/issues/1137)
-* CLI: `tsh login` supports exporting a user identity into a file to be used later with OpenSSH.
-* `tsh agent` command has been deprecated: users are expected to use native SSH Agents on their platforms.
-
-#### Teleport Enterprise
-
-* More granular RBAC rules [#1092](https://github.com/gravitational/teleport/issues/1092)
-* Role definitions now support templates. [#1120](https://github.com/gravitational/teleport/issues/1120)
-* Authentication: Teleport now supports multiple OIDC/SAML endpoints.
-* Configuration: local authentication is always enabled as a fallback if a SAML/OIDC endpoints go offline.
-* Configuration: SAML/OIDC endpoints can be created on the fly using `tctl` and without having to edit configuration file or restart Teleport.
-* Web UI: it is now easier to turn a trusted cluster on/off [#1199](https://github.com/gravitational/teleport/issues/1199).
-
-#### Bug Fixes
-
-* Proper handling of `ENV_SUPATH` from `login.defs` [#1004](https://github.com/gravitational/teleport/pull/1004)
-* Reverse tunnels would periodically lose connectivity. [#1156](https://github.com/gravitational/teleport/issues/1156)
-* `tsh` now stores user identities in a format compatible with OpenSSH. [1171](https://github.com/gravitational/teleport/issues/1171).
-
-## 2.2.7
-
-#### Bug fixes
-
-* Updated YAML parsing library. [#1226](https://github.com/gravitational/teleport/pull/1226)
-
-## 2.2.6
-
-#### Bug fixes
-
-* Fixed issue with SSH dial potentially hanging indefinitely. [#1153](https://github.com/gravitational/teleport/issues/1153)
-
-## 2.2.5
-
-#### Bug fixes
-
-* Fixed issue where node did not have correct permissions. [#1151](https://github.com/gravitational/teleport/issues/1151)
-
-## 2.2.4
-
-#### Bug fixes
-
-* Fixed issue with remote tunnel timeouts. [#1140](https://github.com/gravitational/teleport/issues/1140).
-
-## 2.2.3
-
-### Bug fixes
-
-* Fixed issue with Trusted Clusters where a clusters could lose its signing keys. [#1050](https://github.com/gravitational/teleport/issues/1050).
-* Fixed SAML signing certificate export in Enterprise. [#1109](https://github.com/gravitational/teleport/issues/1109).
-
-## 2.2.2
-
-### Bug fixes
-
-* Fixed an issue where in certain situations `tctl ls` would not work. [#1102](https://github.com/gravitational/teleport/issues/1102).
-
-## 2.2.1
-
-### Improvements
-
-* Added `--compat=oldssh` to both `tsh` and `tctl` that can be used to request certificates in the legacy format (no roles in extensions). [#1083](https://github.com/gravitational/teleport/issues/1083)
-
-### Bugfixes
-
-* Fixed multiple regressions when using SAML with dynamic roles. [#1080](https://github.com/gravitational/teleport/issues/1080)
-
-## 2.2.0
-
-### Features
-
-* HTTP CONNECT tunneling for Trusted Clusters. [#860](https://github.com/gravitational/teleport/issues/860)
-* Long lived certificates and identity export which can be used for automation. [#1033](https://github.com/gravitational/teleport/issues/1033)
-* New terminal for Web UI. [#933](https://github.com/gravitational/teleport/issues/933)
-* Read user environment files. [#1014](https://github.com/gravitational/teleport/issues/1014)
-* Improvements to Auth Service resiliency and availability. [#1071](https://github.com/gravitational/teleport/issues/1071)
-* Server side configuration of support ciphers, key exchange (KEX) algorithms, and MAC algorithms. [#1062](https://github.com/gravitational/teleport/issues/1062)
-* Renaming `tsh` to `ssh` or making a symlink `tsh -> ssh` removes the need to type `tsh ssh`, making it compatible with familiar `ssh user@host`. [#929](https://github.com/gravitational/teleport/issues/929)
-
-### Enterprise Features
-
-* SAML 2.0. [#1070](https://github.com/gravitational/teleport/issues/1070)
-* Role mapping for Trusted Clusters. [#983](https://github.com/gravitational/teleport/issues/983)
-* ACR parsing for OIDC identity providers. [#901](https://github.com/gravitational/teleport/issues/901)
-
-### Improvements
-
-* Improvements to OpenSSH interoperability.
-  * Certificate export format changes to match OpenSSH. [#1068](https://github.com/gravitational/teleport/issues/1068)
-  * CA export format changes to match OpenSSH. [#918](https://github.com/gravitational/teleport/issues/918)
-  * Improvements to `scp` implementation to fix incompatibility issues. [#1048](https://github.com/gravitational/teleport/issues/1048)
-  * OpenSSH keep alive messages are now processed correctly. [#963](https://github.com/gravitational/teleport/issues/963)
-* `tsh` profile is now always read. [#1047](https://github.com/gravitational/teleport/issues/1047)
-* Correct signal handling when Teleport is launched using sysvinit. [#981](https://github.com/gravitational/teleport/issues/981)
-* Role templates now automatically fill out default values when omitted. [#912](https://github.com/gravitational/teleport/issues/912)
-
-## 2.0.6
-
-### Bugfixes
-
-* Fixed regression in TLP-01-009.
-
-## 2.0.5
-
-Teleport 2.0.5 contains a variety of security fixes. We strongly encourage anyone running Teleport 2.0.0 and above to upgrade to 2.0.5.
-
-The most pressing issues (a phishing attack which can potentially be used to extract plaintext credentials and an attack where an already authenticated user can escalate privileges) can be resolved by upgrading the web proxy. However, however all nodes need to be upgraded to mitigate all vulnerabilities.
-
-### Bugfixes
-
-* Patch for TLP-01-001 and TLP-01-003: Check redirect.
-* Patch for TLP-01-004: Always check is namespace is valid.
-* Patch for TLP-01-005: Check user principal when joining session.
-* Patch for TLP-01-006 and TLP-01-007: Validate Session ID.
-* Patch for TLP-01-008: Use a fake hash for password authentication if user does not exist.
-* Patch for TLP-01-009: Command injection in scp.
-
-## 2.0.4
-
-### Bugfixes
-
-* Roles created in the Web UI now have `node` resource. [#949](https://github.com/gravitational/teleport/pull/949)
-
-## 2.0.3
-
-### Bugfixes
-
-* Execute commands using user's shell.  [#943](https://github.com/gravitational/teleport/pull/943)
-* Allow users to read their own roles. [#941](https://github.com/gravitational/teleport/pull/941)
-* Fix User CA import. [#919](https://github.com/gravitational/teleport/pull/919)
-* Role template defaults. [#916](https://github.com/gravitational/teleport/pull/916)
-* Skip UserInfo if not provided. [#915](https://github.com/gravitational/teleport/pull/915)
-
-## 2.0.2
-
-### Bugfixes
-
-* Agent socket had wrong permissions. [#936](https://github.com/gravitational/teleport/pull/936)
-
-## 2.0.1
-
-### Features
-
-* Introduced Dynamic Roles. [#897](https://github.com/gravitational/teleport/pull/897)
-
-### Improvements
-
-* Improved OpenSSH interoperability. [#902](https://github.com/gravitational/teleport/pull/902), [#911](https://github.com/gravitational/teleport/pull/911)
-* Enhanced OIDC Functionality. [#882](https://github.com/gravitational/teleport/pull/882)
-
-### Bugfixes
-
-* Fixed Regressions. [#874](https://github.com/gravitational/teleport/pull/874), [#876](https://github.com/gravitational/teleport/pull/876), [#883](https://github.com/gravitational/teleport/pull/883), [#892](https://github.com/gravitational/teleport/pull/892), and [#906](https://github.com/gravitational/teleport/pull/906)
-
-## 2.0
-
-This is a major new release of Teleport.
-
-### Features
-
-* Native support for DynamoDB back-end for storing cluster state.
-* It is now possible to turn off 2nd factor authentication.
-* 2nd factor now uses TOTP. #522
-* New framework for implementing secret storage plug-ins.
-* Audit log format has been finalized and documented.
-* Experimental file-based secret storage back-end.
-* SSH agent forwarding.
-
-### Improvements
-
-* Friendlier CLI error messages.
-* `tsh login` is now compatible with SSH agents.
-
-### Enterprise Features
-
-* Role-based access control (RBAC)
-* Dynamic configuration: ability to manage roles and trusted clusters at runtime.
-
-Full list of Github issues:
-https://github.com/gravitational/teleport/milestone/8
-
-## 1.3.2
-
-v1.3.2 is a maintenance release which fixes a Web UI issue when in some cases
-static web assets like custom fonts would not load properly.
-
-### Bugfixes
-
-* Issue #687 - broken web assets on some browsers.
-
-## 1.3.1
-
-v1.3.1 is a maintenance release which fixes a few issues found in 1.3
-
-### Bugfixes
-
-* Teleport session recorder can skip characters.
-* U2F was enabled by default in "demo mode" if `teleport.yaml` file was missing.
-
-### Improvements
-
-* U2F documentation has been improved
-
-## 1.3
-
-This release includes several major new features and it's recommended for production use.
-
-### Features
-
-* Support for hardware U2F keys for 2nd factor authentication.
-* CLI client profiles: `tsh` can now remember its `--proxy` setting.
-* tctl auth sign command to allow administrators to generate user session keys
-* Web UI is now served directly from the executable. There is no more need for web
-  assets in `/usr/local/share/teleport`
-
-### Bugfixes
-
-* Multiple Auth Service instances in config doesn't work if the last on is not reachable. #593
-* `tsh scp -r` does not handle directory upload properly #606
-
-## 1.2
-
-This is a maintenance release and it's a drop-in replacement for previous versions.
-
-### Changes
-
-* Usability bugfixes as can be seen here
-* Updated documentation
-* Added examples directory with sample configuration and systemd unit file.
-
-## 1.1.0
-
-This is a maintenance release meant to be a drop-in upgrade of previous versions.
-
-### Changes
-
-* User experience improvements: nicer error messages
-* Better compatibility with ssh command: `-t` flag can be used to force allocation of TTY
-
-## 1.0.5
-
-This release was recommended for production with one reservation: time-limited
-certificates did not work correctly in this release due to #529
-
-* Improvements in performance and usability of the Web UI
-* Smaller binary sizes thanks to Golang v1.7
-
-### Bugfixes
-
-* Wrong url to register new users. #497
-* Logged in users inherit Teleport supplemental groups bug security. #507
-* Joining a session running on a trusted cluster does not work. #504
-
-## 1.0.4
-
-This release only includes the addition of the ability to specify non-standard
-HTTPS port for Teleport proxy for `tsh --proxy` flag.
-
-## 1.0.3
-
-This release only includes one major bugfix #486 plus minor changes not exposed
-to Teleport Community Edition users.
-
-### Bugfixes
-
-* Guessing `advertise_ip` chooses IPv6 address space. #486
+#### Legacy ALPN connection upgrade mode has been removed
 
-## 1.0
+Teleport v15.1 added WebSocket upgrade support for Teleport proxies behind layer
+7 load balancers and reverse proxies. The legacy ALPN upgrade mode using `alpn`
+or `alpn-ping` as upgrade types was left as a fallback until v17.
 
-The first official release of Teleport!
+Teleport v18 removes the legacy upgrade mode entirely including the use of the
+`TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE` environment variable.
diff --git a/Makefile b/Makefile
index f2bbf07f43168..b58272a8cd477 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=18.0.0-dev
+VERSION=18.6.1
 
 DOCKER_IMAGE ?= teleport
 
@@ -36,6 +36,9 @@ TELEPORT_DEBUG ?= false
 GITTAG=v$(VERSION)
 CGOFLAG ?= CGO_ENABLED=1
 KUSTOMIZE_NO_DYNAMIC_PLUGIN ?= kustomize_disable_go_plugin_support
+KUBECTL_VERSION := $(shell go list -m -f '{{.Version}}' k8s.io/kubectl | sed 's/v0/v1/')
+KUBECTL_SETVERSION := -X k8s.io/component-base/version.gitVersion=$(KUBECTL_VERSION)
+
 # RELEASE_DIR is where the release artifacts (tarballs, pacakges, etc) are put. It
 # should be an absolute directory as it is used by e/Makefile too, from the e/ directory.
 RELEASE_DIR := $(CURDIR)/$(BUILDDIR)/artifacts
@@ -46,14 +49,14 @@ GO_LDFLAGS ?= -w -s $(KUBECTL_SETVERSION)
 # When TELEPORT_DEBUG is true, set flags to produce
 # debugger-friendly builds.
 ifeq ("$(TELEPORT_DEBUG)","true")
-BUILDFLAGS ?= $(ADDFLAGS) -gcflags=all="-N -l"
-BUILDFLAGS_TBOT ?= $(ADDFLAGS) -gcflags=all="-N -l"
-BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -gcflags=all="-N -l"
+BUILDFLAGS ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false
+BUILDFLAGS_TBOT ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false
+BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false
 else
-BUILDFLAGS ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildmode=pie
-BUILDFLAGS_TBOT ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath
+BUILDFLAGS ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildmode=pie -buildvcs=false
+BUILDFLAGS_TBOT ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildvcs=false
 # teleport-update builds with disabled cgo, buildmode=pie is not required.
-BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath
+BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildvcs=false
 endif
 
 GO_ENV_OS := $(shell go env GOOS)
@@ -64,6 +67,8 @@ ARCH ?= $(GO_ENV_ARCH)
 
 FIPS ?=
 RELEASE = teleport-$(GITTAG)-$(OS)-$(ARCH)-bin
+RELEASE_TOOLS = teleport-tools-$(GITTAG)-$(OS)-$(ARCH)-bin
+RELEASE_UPDATE = teleport-update-$(GITTAG)-$(OS)-$(ARCH)-bin
 
 # If we're building inside the cross-compiling buildbox, include the
 # cross compilation definitions so we select the correct compilers and
@@ -129,6 +134,7 @@ CARGO_TARGET_linux_386 := i686-unknown-linux-gnu
 CARGO_TARGET_linux_amd64 := x86_64-unknown-linux-gnu
 
 CARGO_TARGET := --target=$(RUST_TARGET_ARCH)
+CARGO_WASM_TARGET := wasm32-unknown-unknown
 
 # If set to 1, Windows RDP client is not built.
 RDPCLIENT_SKIP_BUILD ?= 0
@@ -248,6 +254,7 @@ BINS_darwin = teleport tctl tsh tbot fdpass-teleport
 BINS_windows = tsh tctl
 BINS = $(or $(BINS_$(OS)),$(BINS_default))
 BINARIES = $(addprefix $(BUILDDIR)/,$(BINS))
+UPDATE_BINARIES = $(addprefix $(BUILDDIR)/,teleport-update)
 
 # Joins elements of the list in arg 2 with the given separator.
 #   1. Element separator.
@@ -314,10 +321,10 @@ ifneq ("$(ARCH)","amd64")
 $(error "Building for windows requires ARCH=amd64")
 endif
 CGOFLAG = CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc CXX=x86_64-w64-mingw32-g++
-BUILDFLAGS = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildmode=pie
-BUILDFLAGS_TBOT = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath
+BUILDFLAGS = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildmode=pie -buildvcs=false
+BUILDFLAGS_TBOT = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildvcs=false
 # teleport-update builds with disabled cgo, buildmode=pie is not required.
-BUILDFLAGS_TELEPORT_UPDATE = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath
+BUILDFLAGS_TELEPORT_UPDATE = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildvcs=false
 endif
 
 ifeq ("$(OS)","darwin")
@@ -362,7 +369,7 @@ ifeq ("$(GITHUB_REPOSITORY_OWNER)","gravitational")
 # TELEPORT_LDFLAGS and TOOLS_LDFLAGS if appended will overwrite the previous LDFLAGS set in the BUILDFLAGS.
 # This is done here to prevent any changes to the (BUI)LDFLAGS passed to the other binaries
 TELEPORT_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'
-TOOLS_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'
+TOOLS_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) $(KUBECTL_SETVERSION) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'
 endif
 
 # By making these 3 targets below (tsh, tctl and teleport) PHONY we are solving
@@ -387,8 +394,6 @@ $(BUILDDIR)/teleport: ensure-webassets bpf-bytecode rdpclient
 # NOTE: Any changes to the `tsh` build here must be copied to `build.assets/windows/build.ps1`
 # until we can use this Makefile for native Windows builds.
 .PHONY: $(BUILDDIR)/tsh
-$(BUILDDIR)/tsh: KUBECTL_VERSION ?= $(shell go run ./build.assets/kubectl-version/main.go)
-$(BUILDDIR)/tsh: KUBECTL_SETVERSION ?= -X k8s.io/component-base/version.gitVersion=$(KUBECTL_VERSION)
 $(BUILDDIR)/tsh:
 	@if [[ "$(OS)" != "windows" && -z "$(LIBFIDO2_BUILD_TAG)" ]]; then \
 		echo 'Warning: Building tsh without libfido2. Install libfido2 to have access to MFA.' >&2; \
@@ -484,6 +489,26 @@ ifeq ("$(with_rdpclient)", "yes")
 		cargo build -p rdp-client $(if $(FIPS),--features=fips) --release --locked $(CARGO_TARGET)
 endif
 
+define ironrdp_package_json
+{
+  "name": "ironrdp",
+  "version": "0.1.0",
+  "module": "ironrdp.js",
+  "types": "ironrdp.d.ts",
+  "files": ["ironrdp_bg.wasm","ironrdp.js","ironrdp.d.ts"],
+  "sideEffects": ["./snippets/*"]
+}
+endef
+export ironrdp_package_json
+
+.PHONY: build-ironrdp-wasm
+build-ironrdp-wasm: ironrdp = web/packages/shared/libs/ironrdp
+build-ironrdp-wasm: ensure-wasm-deps
+	cargo build --package ironrdp --lib --target $(CARGO_WASM_TARGET) --release
+	wasm-opt target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -o target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -O
+	wasm-bindgen target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm --out-dir $(ironrdp)/pkg --typescript --target web
+	printenv ironrdp_package_json > $(ironrdp)/pkg/package.json
+
 # Build libfido2 and dependencies for MacOS. Uses exported C_ARCH variable defined earlier.
 .PHONY: build-fido2
 build-fido2:
@@ -535,7 +560,7 @@ endif
 	rm -f *.zip
 	rm -f gitref.go
 	rm -rf build.assets/tooling/bin
-	# Clean up wasm-pack build artifacts
+	# Clean up wasm build artifacts
 	rm -rf web/packages/shared/libs/ironrdp/pkg/
 
 .PHONY: clean-ui
@@ -620,18 +645,37 @@ build-archive: | $(RELEASE_DIR)
 	rm -rf teleport
 	@echo "---> Created $(RELEASE).tar.gz."
 
+.PHONY: build-update-archive
+build-update-archive: | $(RELEASE_DIR)
+	@echo "---> Creating OSS update release archive."
+	mkdir -p teleport
+	cp -rf $(UPDATE_BINARIES) \
+		CHANGELOG.md \
+		build.assets/LICENSE-community \
+		teleport/
+	echo $(GITTAG) > teleport/VERSION
+	tar $(TAR_FLAGS) -c teleport | gzip -n > $(RELEASE_UPDATE).tar.gz
+	cp $(RELEASE_UPDATE).tar.gz $(RELEASE_DIR)
+	# linux-amd64 generates a centos7-compatible archive. Make a copy with the -centos7 label,
+	# for the releases page. We should probably drop that at some point.
+	$(if $(filter linux-amd64,$(OS)-$(ARCH)), \
+		cp $(RELEASE_UPDATE).tar.gz $(RELEASE_DIR)/$(subst amd64,amd64-centos7,$(RELEASE_UPDATE)).tar.gz \
+	)
+	rm -rf teleport
+	@echo "---> Created $(RELEASE_UPDATE).tar.gz."
+
 #
 # make release-unix - Produces binary release tarballs for both OSS and
 # Enterprise editions, containing teleport, tctl, tbot and tsh.
 #
 .PHONY: release-unix
-release-unix: clean full build-archive
+release-unix: clean full build-archive build-update-archive
 	@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi
 
 # release-unix-preserving-webassets cleans just the build and not the UI
 # allowing webassets to be built in a prior step before building the release.
 .PHONY: release-unix-preserving-webassets
-release-unix-preserving-webassets: clean-build full build-archive
+release-unix-preserving-webassets: clean-build full build-archive build-update-archive
 	@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi
 
 include darwin-signing.mk
@@ -774,13 +818,16 @@ release-connect: | $(RELEASE_DIR)
 	pnpm build-term
 	pnpm package-term -c.extraMetadata.version=$(VERSION) --$(ELECTRON_BUILDER_ARCH)
 	# Only copy proper builds with tsh.app to $(RELEASE_DIR)
-	# Drop -universal "arch" from dmg name when copying to $(RELEASE_DIR)
+	# Drop -universal "arch" from dmg and zip name when copying to $(RELEASE_DIR)
 	if [ -n "$$CONNECT_TSH_APP_PATH" ]; then \
-		TARGET_NAME="Teleport Connect-$(VERSION)-$(ARCH).dmg"; \
+		DMG_TARGET_NAME="Teleport Connect-$(VERSION)-$(ARCH).dmg"; \
+		ZIP_TARGET_NAME="Teleport Connect-$(VERSION)-$(ARCH)-mac.zip"; \
 		if [ "$(ARCH)" = 'universal' ]; then \
-			TARGET_NAME="$${TARGET_NAME/-universal/}"; \
+			DMG_TARGET_NAME="$${DMG_TARGET_NAME/-universal/}"; \
+			ZIP_TARGET_NAME="$${ZIP_TARGET_NAME/-universal/}"; \
 		fi; \
-		cp web/packages/teleterm/build/release/"Teleport Connect-$(VERSION)-$(ELECTRON_BUILDER_ARCH).dmg" "$(RELEASE_DIR)/$${TARGET_NAME}"; \
+		cp web/packages/teleterm/build/release/"Teleport Connect-$(VERSION)-$(ELECTRON_BUILDER_ARCH).dmg" "$(RELEASE_DIR)/$${DMG_TARGET_NAME}"; \
+		cp web/packages/teleterm/build/release/"Teleport Connect-$(VERSION)-$(ELECTRON_BUILDER_ARCH)-mac.zip" "$(RELEASE_DIR)/$${ZIP_TARGET_NAME}"; \
 	fi
 
 #
@@ -830,6 +877,17 @@ ensure-gotestsum:
 	go install gotest.tools/gotestsum@latest
 endif
 
+#
+# Install goda to lint testing symbols
+#
+.PHONY: ensure-goda
+ensure-goda:
+# Install goda if it's not already installed
+ ifeq (, $(shell command -v goda))
+	go install github.com/loov/goda@latest
+endif
+
+
 DIFF_TEST := $(TOOLINGDIR)/bin/difftest
 $(DIFF_TEST): $(wildcard $(TOOLINGDIR)/cmd/difftest/*.go)
 	cd $(TOOLINGDIR) && go build -o "$@" ./cmd/difftest
@@ -867,6 +925,7 @@ helmunit/installed:
 test-helm: helmunit/installed
 	helm unittest -3 --with-subchart=false examples/chart/teleport-cluster
 	helm unittest -3 --with-subchart=false examples/chart/teleport-kube-agent
+	helm unittest -3 --with-subchart=false examples/chart/teleport-relay
 	helm unittest -3 --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator
 	helm unittest -3 --with-subchart=false examples/chart/access/*
 	helm unittest -3 --with-subchart=false examples/chart/event-handler
@@ -876,6 +935,7 @@ test-helm: helmunit/installed
 test-helm-update-snapshots: helmunit/installed
 	helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster
 	helm unittest -3 -u --with-subchart=false examples/chart/teleport-kube-agent
+	helm unittest -3 -u --with-subchart=false examples/chart/teleport-relay
 	helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator
 	helm unittest -3 -u --with-subchart=false examples/chart/access/*
 	helm unittest -3 -u --with-subchart=false examples/chart/event-handler
@@ -916,20 +976,19 @@ test-go-prepare: ensure-webassets bpf-bytecode $(TEST_LOG_DIR) ensure-gotestsum
 
 # Runs base unit tests
 .PHONY: test-go-unit
+test-go-unit: rdpclient
 test-go-unit: FLAGS ?= -race -shuffle on
 test-go-unit: SUBJECT ?= $(shell go list ./... | grep -vE 'teleport/(e2e|integration|tool/tsh|integrations/operator|integrations/access|integrations/lib)')
 test-go-unit:
-	$(CGOFLAG) GOEXPERIMENT=synctest go test -cover -json -tags "enablesynctest $(PAM_TAG) $(FIPS_TAG) $(BPF_TAG) $(LIBFIDO2_TEST_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(VNETDAEMON_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/unit.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG) GOEXPERIMENT=synctest go test -json -tags "enablesynctest $(PAM_TAG) $(RDPCLIENT_TAG) $(FIPS_TAG) $(BPF_TAG) $(LIBFIDO2_TEST_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(VNETDAEMON_TAG) $(ADDTAGS)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests.xml --jsonfile $(TEST_LOG_DIR)/unit-tests.json --raw-command -- cat
 
 # Runs tbot unit tests
 .PHONY: test-go-unit-tbot
 test-go-unit-tbot: FLAGS ?= -race -shuffle on
 test-go-unit-tbot:
-	$(CGOFLAG) go test -cover -json $(FLAGS) $(ADDFLAGS) ./tool/tbot/... ./lib/tbot/... \
-		| tee $(TEST_LOG_DIR)/unit.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG) go test -json $(FLAGS) $(ADDFLAGS) ./tool/tbot/... ./lib/tbot/... \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-tbot.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-tbot.json --raw-command -- cat
 
 # Make sure untagged touchid code build/tests.
 .PHONY: test-go-touch-id
@@ -937,9 +996,8 @@ test-go-touch-id: FLAGS ?= -race -shuffle on
 test-go-touch-id: SUBJECT ?= ./lib/auth/touchid/...
 test-go-touch-id:
 ifneq ("$(TOUCHID_TAG)", "")
-	$(CGOFLAG) go test -cover -json $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/unit.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG) go test -json $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-touchid.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-touchid.json --raw-command -- cat
 endif
 
 # Runs benchmarks once to make sure they pass.
@@ -967,9 +1025,8 @@ test-go-vnet-daemon: FLAGS ?= -race -shuffle on
 test-go-vnet-daemon: SUBJECT ?= ./lib/vnet/daemon/...
 test-go-vnet-daemon:
 ifneq ("$(VNETDAEMON_TAG)", "")
-	$(CGOFLAG) go test -cover -json $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/unit.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG) go test -json $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-vnet.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-vnet.json --raw-command -- cat
 endif
 
 # Runs ci tsh tests
@@ -977,17 +1034,15 @@ endif
 test-go-tsh: FLAGS ?= -race -shuffle on
 test-go-tsh: SUBJECT ?= github.com/gravitational/teleport/tool/tsh/...
 test-go-tsh:
-	$(CGOFLAG_TSH) go test -cover -json -tags "$(PAM_TAG) $(FIPS_TAG) $(LIBFIDO2_TEST_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(VNETDAEMON_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/unit.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG_TSH) go test -json -tags "$(PAM_TAG) $(FIPS_TAG) $(LIBFIDO2_TEST_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(VNETDAEMON_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-tsh.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-tsh.json --raw-command -- cat
 
 # Chaos tests have high concurrency, run without race detector and have TestChaos prefix.
 .PHONY: test-go-chaos
 test-go-chaos: CHAOS_FOLDERS = $(shell find . -type f -name '*chaos*.go' | xargs dirname | uniq)
 test-go-chaos:
-	$(CGOFLAG) go test -cover -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" -test.run=TestChaos $(CHAOS_FOLDERS) \
-		| tee $(TEST_LOG_DIR)/chaos.json \
-		| gotestsum --raw-command -- cat
+	$(CGOFLAG) go test -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" -test.run=TestChaos $(CHAOS_FOLDERS) \
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-chaos.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-chaos.json --raw-command -- cat
 
 #
 # Runs all Go tests except integration, end-to-end, and chaos, called by CI/CD.
@@ -999,8 +1054,7 @@ test-go-root: FLAGS ?= -race -shuffle on
 test-go-root: PACKAGES = $(shell go list $(ADDFLAGS) ./... | grep -v -e e2e -e integration -e integrations/operator)
 test-go-root: $(VERSRC)
 	$(CGOFLAG) go test -json -run "$(UNIT_ROOT_REGEX)" -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" $(PACKAGES) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/unit-root.json \
-		| gotestsum --raw-command -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-root.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-root.json --raw-command -- cat
 
 #
 # Runs Go tests on the api module. These have to be run separately as the package name is different.
@@ -1011,8 +1065,7 @@ test-api: FLAGS ?= -race -shuffle on
 test-api: SUBJECT ?= $(shell cd api && go list ./...)
 test-api:
 	cd api && $(CGOFLAG) go test -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/api.json \
-		| gotestsum --raw-command -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-api.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-api.json --raw-command -- cat
 
 #
 # Runs Teleport Operator tests.
@@ -1028,6 +1081,12 @@ test-operator:
 test-terraform-provider:
 	make -C integrations test-terraform-provider
 #
+# Runs Teleport MWI Terraform provider tests.
+#
+.PHONY: test-terraform-provider-mwi
+test-terraform-provider-mwi:
+	make -C integrations test-terraform-provider-mwi
+#
 # Runs Go tests on the integrations/kube-agent-updater module. These have to be run separately as the package name is different.
 #
 .PHONY: test-kube-agent-updater
@@ -1036,8 +1095,7 @@ test-kube-agent-updater: FLAGS ?= -race -shuffle on
 test-kube-agent-updater: SUBJECT ?= $(shell cd integrations/kube-agent-updater && go list ./...)
 test-kube-agent-updater:
 	cd integrations/kube-agent-updater && $(CGOFLAG) go test -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/kube-agent-updater.json \
-		| gotestsum --raw-command --format=testname -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-kube-agent-updater.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-kube-agent-updater.json --raw-command -- cat
 
 .PHONY: test-access-integrations
 test-access-integrations:
@@ -1060,8 +1118,7 @@ test-teleport-usage: FLAGS ?= -race -shuffle on
 test-teleport-usage: SUBJECT ?= $(shell cd examples/teleport-usage && go list ./...)
 test-teleport-usage:
 	cd examples/teleport-usage && $(CGOFLAG) go test -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
-		| tee $(TEST_LOG_DIR)/teleport-usage.json \
-		| gotestsum --raw-command -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-teleport-usage.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-teleport-usage.json --raw-command -- cat
 
 #
 # Flaky test detection. Usually run from CI nightly, overriding these default parameters
@@ -1073,9 +1130,10 @@ FLAKY_RUNS ?= 3
 FLAKY_TIMEOUT ?= 1h
 FLAKY_TOP_N ?= 20
 FLAKY_SUMMARY_FILE ?= /tmp/flaky-report.txt
+test-go-flaky: rdpclient
 test-go-flaky: FLAGS ?= -race -shuffle on
 test-go-flaky: SUBJECT ?= $(shell go list ./... | grep -v -e e2e -e integration -e tool/tsh -e integrations/operator -e integrations/access -e integrations/lib )
-test-go-flaky: GO_BUILD_TAGS ?= $(PAM_TAG) $(FIPS_TAG) $(BPF_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(LIBFIDO2_TEST_TAG) $(VNETDAEMON_TAG)
+test-go-flaky: GO_BUILD_TAGS ?= $(PAM_TAG) $(FIPS_TAG) $(RDPCLIENT_TAG) $(BPF_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG) $(LIBFIDO2_TEST_TAG) $(VNETDAEMON_TAG)
 test-go-flaky: RENDER_FLAGS ?= -report-by flakiness -summary-file $(FLAKY_SUMMARY_FILE) -top $(FLAKY_TOP_N)
 test-go-flaky: test-go-prepare $(RENDER_TESTS) $(RERUN)
 	$(CGOFLAG) $(RERUN) -n $(FLAKY_RUNS) -t $(FLAKY_TIMEOUT) \
@@ -1122,8 +1180,7 @@ integration: PACKAGES = $(shell go list ./... | grep 'integration\([^s]\|$$\)' |
 integration:  $(TEST_LOG_DIR) ensure-gotestsum
 	@echo KUBECONFIG is: $(KUBECONFIG), TEST_KUBE: $(TEST_KUBE)
 	$(CGOFLAG) go test -timeout 30m -json -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" $(PACKAGES) $(FLAGS) \
-		| tee $(TEST_LOG_DIR)/integration.json \
-		| gotestsum --raw-command --format=testname -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-integration.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-integration.json --raw-command -- cat
 
 #
 # Integration tests that run Kubernetes tests in order to complete successfully
@@ -1132,12 +1189,11 @@ integration:  $(TEST_LOG_DIR) ensure-gotestsum
 INTEGRATION_KUBE_REGEX := TestKube.*
 .PHONY: integration-kube
 integration-kube: FLAGS ?= -v -race
-integration-kube: PACKAGES = $(shell go list ./... | grep 'integration\([^s]\|$$\)')
+integration-kube: PACKAGES = $(shell go list ./... | grep 'integration\([^s]\|$$\)' | grep -v 'integration/autoupdate')
 integration-kube: $(TEST_LOG_DIR) ensure-gotestsum
 	@echo KUBECONFIG is: $(KUBECONFIG), TEST_KUBE: $(TEST_KUBE)
 	$(CGOFLAG) go test -json -run "$(INTEGRATION_KUBE_REGEX)" $(PACKAGES) $(FLAGS) \
-		| tee $(TEST_LOG_DIR)/integration-kube.json \
-		| gotestsum --raw-command --format=testname -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-integration-kube.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-integration-kube.json --raw-command -- cat
 
 #
 # Integration tests which need to be run as root in order to complete successfully
@@ -1149,8 +1205,7 @@ integration-root: FLAGS ?= -v -race
 integration-root: PACKAGES = $(shell go list ./... | grep 'integration\([^s]\|$$\)')
 integration-root: $(TEST_LOG_DIR) ensure-gotestsum
 	$(CGOFLAG) go test -json -run "$(INTEGRATION_ROOT_REGEX)" $(PACKAGES) $(FLAGS) \
-		| tee $(TEST_LOG_DIR)/integration-root.json \
-		| gotestsum --raw-command --format=testname -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-integration-root.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-integration-root.json --raw-command -- cat
 
 
 .PHONY: e2e-aws
@@ -1159,8 +1214,7 @@ e2e-aws: PACKAGES = $(shell go list ./... | grep 'e2e/aws')
 e2e-aws: $(TEST_LOG_DIR) ensure-gotestsum
 	@echo TEST_KUBE: $(TEST_KUBE) TEST_AWS_DB: $(TEST_AWS_DB)
 	$(CGOFLAG) go test -json $(PACKAGES) $(FLAGS) $(ADDFLAGS)\
-		| tee $(TEST_LOG_DIR)/e2e-aws.json \
-		| gotestsum --raw-command --format=testname -- cat
+		| gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-e2e-aws.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-e2e-aws.json --raw-command -- cat
 
 #
 # Lint the source code.
@@ -1179,6 +1233,27 @@ lint-no-actions: lint-sh lint-license
 .PHONY: lint-tools
 lint-tools: lint-build-tooling lint-backport
 
+
+#
+# Checks that testing symbols and the testify library is not included in binaries.
+#
+#
+.PHONY: lint-test-symbols
+lint-test-symbols: ensure-goda
+	@testing_count=`goda tree "reach(github.com/gravitational/teleport/tool/...:all, testing)" | tee /dev/stderr | wc -l | tr -d ' '`; \
+	if [ "$$testing_count" -gt 0 ]; then \
+		echo ""; \
+		echo "FAIL: \"testing\" is included in binaries"; \
+	fi; \
+	testify_count=`goda tree "reach(github.com/gravitational/teleport/tool/...:all, github.com/stretchr/testify/...)" | tee /dev/stderr | wc -l | tr -d ' '`; \
+	if [ "$$testify_count" -gt 0 ]; then \
+		echo ""; \
+		echo "FAIL: \"github.com/stretchr/testify\" is included in binaries"; \
+	fi; \
+	if [ "$$testing_count" -gt 0 ] || [ "$$testify_count" -gt 0 ]; then \
+		exit 1; \
+	fi
+
 #
 # Runs the clippy linter and rustfmt on our rust modules
 # (a no-op if cargo and rustc are not installed)
@@ -1269,7 +1344,7 @@ lint-helm:
 		if [ "$${CI}" = "true" ]; then echo "This is a failure when running in CI." && exit 1; fi; \
 		exit 0; \
 	fi; \
-	for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \
+	for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-relay ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \
 		if [ -d $${CHART}/.lint ]; then \
 			for VALUES in $${CHART}/.lint/*.yaml; do \
 				export HELM_TEMP=$$(mktemp); \
@@ -1278,6 +1353,7 @@ lint-helm:
 				helm lint --quiet --strict $${CHART} -f $${VALUES} || exit 1; \
 				helm template test $${CHART} -f $${VALUES} 1>$${HELM_TEMP} || exit 1; \
 				yamllint -c examples/chart/.lint-config.yaml $${HELM_TEMP} || { cat -en $${HELM_TEMP}; exit 1; }; \
+				echo; \
 			done \
 		else \
 			export HELM_TEMP=$$(mktemp); \
@@ -1505,27 +1581,38 @@ enter/arm:
 
 BUF := buf
 
+#
+# Install buf to lint, format and generate code from protobuf files.
+#
+.PHONY: ensure-buf
+ensure-buf: NEED_VERSION = $(shell $(MAKE) --no-print-directory -s -C build.assets print-buf-version)
+ensure-buf:
+# Install buf if it's not already installed.
+ifeq (, $(shell command -v $(BUF)))
+	go install github.com/bufbuild/buf/cmd/buf@$(NEED_VERSION)
+endif
+
 # protos/all runs build, lint and format on all protos.
 # Use `make grpc` to regenerate protos inside buildbox.
 .PHONY: protos/all
 protos/all: protos/build protos/lint protos/format
 
 .PHONY: protos/build
-protos/build: buf/installed
+protos/build: ensure-buf
 	$(BUF) build
 
 .PHONY: protos/format
-protos/format: buf/installed
+protos/format: ensure-buf
 	$(BUF) format -w
 
 .PHONY: protos/lint
-protos/lint: buf/installed
+protos/lint: ensure-buf
 	$(BUF) lint
 	$(BUF) lint --config=buf-legacy.yaml api/proto
 
 .PHONY: protos/breaking
 protos/breaking: BASE=origin/master
-protos/breaking: buf/installed
+protos/breaking: ensure-buf
 	@echo Checking compatibility against BASE=$(BASE)
 	buf breaking . --against '.git#branch=$(BASE)'
 
@@ -1535,13 +1622,6 @@ lint-protos: protos/lint
 .PHONY: lint-breaking
 lint-breaking: protos/breaking
 
-.PHONY: buf/installed
-buf/installed:
-	@if ! type -p $(BUF) >/dev/null; then \
-		echo 'Buf is required to build/format/lint protos. Follow https://docs.buf.build/installation.'; \
-		exit 1; \
-	fi
-
 GODERIVE := $(TOOLINGDIR)/bin/goderive
 # derive will generate derived functions for our API.
 # we need to build goderive first otherwise it will not be able to resolve dependencies
@@ -1549,7 +1629,7 @@ GODERIVE := $(TOOLINGDIR)/bin/goderive
 .PHONY: derive
 derive:
 	cd $(TOOLINGDIR) && go build -o $(GODERIVE) ./cmd/goderive/main.go
-	$(GODERIVE) ./api/types ./api/types/discoveryconfig
+	$(GODERIVE) ./api/types ./api/types/discoveryconfig ./api/types/accesslist ./api/types/userloginstate
 
 # derive-up-to-date checks if the generated derived functions are up to date.
 .PHONY: derive-up-to-date
@@ -1625,6 +1705,15 @@ terraform-resources-up-to-date: must-start-clean/host
 		exit 1; \
 	fi
 
+# icons-up-to-date checks if icons were pre-processed before being added to the repo.
+.PHONY: icons-up-to-date
+icons-up-to-date: must-start-clean/host
+	pnpm process-icons
+	@if ! git diff --quiet; then \
+		./build.assets/please-run.sh "icons (see web/packages/design/src/Icon/README.md)" "pnpm process-icons"; \
+		exit 1; \
+	fi
+
 # go-generate will execute `go generate` and generate go code.
 .PHONY: go-generate
 go-generate:
@@ -1687,6 +1776,8 @@ endif
 .PHONY: pkg
 pkg: TELEPORT_PKG_UNSIGNED = $(BUILDDIR)/teleport-$(VERSION).unsigned.pkg
 pkg: TELEPORT_PKG_SIGNED = $(RELEASE_DIR)/teleport-$(VERSION).pkg
+pkg: TELEPORT_TOOLS_PKG_UNSIGNED = $(BUILDDIR)/teleport-tools-$(VERSION).unsigned.pkg
+pkg: TELEPORT_TOOLS_PKG_SIGNED = $(RELEASE_DIR)/teleport-tools-$(VERSION).pkg
 pkg: | $(RELEASE_DIR)
 	mkdir -p $(BUILDDIR)/
 
@@ -1709,6 +1800,10 @@ pkg: | $(RELEASE_DIR)
 	productbuild --package $(BUILDDIR)/tsh*.pkg --package $(BUILDDIR)/tctl*.pkg --package $(BUILDDIR)/teleport-bin*.pkg $(TELEPORT_PKG_UNSIGNED)
 	$(NOTARIZE_TELEPORT_PKG)
 
+	@echo Combining tsh-$(VERSION).pkg and tctl-$(VERSION).pkg into teleport-tools-$(VERSION).pkg
+	productbuild --package $(BUILDDIR)/tsh*.pkg --package $(BUILDDIR)/tctl*.pkg $(TELEPORT_TOOLS_PKG_UNSIGNED)
+	$(NOTARIZE_TELEPORT_TOOLS_PKG)
+
 	if [ -f e/Makefile ]; then $(MAKE) -C e pkg; fi
 
 # build .rpm
@@ -1795,29 +1890,18 @@ ensure-js-deps:
 ifeq ($(WEBASSETS_SKIP_BUILD),1)
 ensure-wasm-deps:
 else
-ensure-wasm-deps: ensure-wasm-pack ensure-wasm-bindgen
-
-# Get the version of wasm-bindgen from cargo, as that is what wasm-pack is
-# going to do when it checks for the right version. The buildboxes do not
-# have jq installed (yet), so have a hacky awk version on standby.
-CARGO_GET_VERSION_JQ = cargo metadata --locked --format-version=1 | jq -r 'first(.packages[] | select(.name? == "$(1)") | .version)'
-CARGO_GET_VERSION_AWK = awk -F '[ ="]+' '/^name = "$(1)"$$/ {inpkg = 1} inpkg && $$1 == "version" {print $$2; exit}' Cargo.lock
+ensure-wasm-deps: ensure-wasm-bindgen ensure-wasm-opt rustup-install-wasm-toolchain
 
-BIN_JQ = $(shell which jq 2>/dev/null)
-CARGO_GET_VERSION = $(if $(BIN_JQ),$(CARGO_GET_VERSION_JQ),$(CARGO_GET_VERSION_AWK))
+WASM_BINDGEN_VERSION = $(shell awk ' \
+  $$1 == "name" && $$3 == "\"wasm-bindgen\"" { in_pkg=1; next } \
+  in_pkg && $$1 == "version" { gsub(/"/, "", $$3); print $$3; exit } \
+' Cargo.lock)
 
-ensure-wasm-pack: NEED_VERSION = $(shell $(MAKE) --no-print-directory -s -C build.assets print-wasm-pack-version)
-ensure-wasm-pack: INSTALLED_VERSION = $(word 2,$(shell wasm-pack --version 2>/dev/null))
-ensure-wasm-pack:
-	$(if $(filter-out $(INSTALLED_VERSION),$(NEED_VERSION)),\
-		cargo install wasm-pack --force --locked --version "$(NEED_VERSION)", \
-		@echo wasm-pack up-to-date: $(INSTALLED_VERSION) \
-	)
+.PHONY: print-wasm-bindgen-version
+print-wasm-bindgen-version:
+	@echo $(WASM_BINDGEN_VERSION)
 
-# TODO: Use CARGO_GET_VERSION_AWK instead of hardcoded version
-#       On 386 Arch, calling the variable produces a malformed command that fails the build.
-#ensure-wasm-bindgen: NEED_VERSION = $(shell $(call CARGO_GET_VERSION,wasm-bindgen))
-ensure-wasm-bindgen: NEED_VERSION = 0.2.99
+ensure-wasm-bindgen: NEED_VERSION = $(WASM_BINDGEN_VERSION)
 ensure-wasm-bindgen: INSTALLED_VERSION = $(word 2,$(shell wasm-bindgen --version 2>/dev/null))
 ensure-wasm-bindgen:
 ifneq ($(CI)$(FORCE),)
@@ -1834,6 +1918,11 @@ else
 endif
 endif
 
+.PHONY: ensure-wasm-opt
+ensure-wasm-opt: WASM_OPT_VERSION := $(shell $(MAKE) --no-print-directory -C build.assets print-wasm-opt-version)
+ensure-wasm-opt:
+	cargo install --locked wasm-opt@$(WASM_OPT_VERSION)
+
 .PHONY: build-ui
 build-ui: ensure-js-deps ensure-wasm-deps
 	@[ "${WEBASSETS_SKIP_BUILD}" -eq 1 ] || pnpm build-ui-oss
@@ -1859,6 +1948,10 @@ rustup-set-version:
 rustup-install-target-toolchain: rustup-set-version
 	rustup target add $(RUST_TARGET_ARCH)
 
+.PHONY: rustup-install-wasm-toolchain
+rustup-install-wasm-toolchain: rustup-set-version
+	rustup target add $(CARGO_WASM_TARGET)
+
 # changelog generates PR changelog between the provided base tag and the tip of
 # the specified branch.
 #
@@ -1909,3 +2002,54 @@ dump-preset-roles:
 .PHONY: test-e2e
 test-e2e: ensure-webassets
 	(cd e2e && pnpm install) && $(CGOFLAG) go test -tags=webassets_embed ./e2e/web_e2e_test.go
+
+.PHONY: cli-docs-tsh
+cli-docs-tsh:
+	# Not executing go run since we don't want to redirect linker warnings
+	# along with the docs page content.
+	go build -o $(BUILDDIR)/tshdocs -tags docs ./tool/tsh && \
+	$(BUILDDIR)/tshdocs help 2>docs/pages/reference/cli/tsh.mdx && \
+	rm $(BUILDDIR)/tshdocs
+
+# audit-event-reference generates audit event reference docs using the Web UI
+# source.
+.PHONY: audit-event-reference
+audit-event-reference:
+	pnpm run -C ./web/packages/teleport event-reference
+
+# audit-event-reference-up-to-date ensures the audit event reference
+# documentation reflects the Web UI source.
+.PHONY: audit-event-reference-up-to-date
+audit-event-reference-up-to-date: must-start-clean/host audit-event-reference
+	@if ! git diff --quiet; then \
+		./build.assets/please-run.sh "audit event reference docs" "make audit-event-reference"; \
+		exit 1; \
+	fi
+
+.PHONY: access-monitoring-reference
+access-monitoring-reference:
+	cd ./build.assets/tooling/cmd/gen-athena-docs && go run main.go > ../../../../docs/pages/includes/access-monitoring-events.mdx
+
+.PHONY: access-monitoring-reference-up-to-date
+access-monitoring-reference-up-to-date: access-monitoring-reference
+	@if ! git diff --quiet; then \
+		./build.assets/please-run.sh "Access Monitoring event reference docs" "make access-monitoring-reference"; \
+		exit 1; \
+	fi
+
+.PHONY: gen-docs
+gen-docs: gen-resource-docs audit-event-reference
+	$(MAKE) -C integrations/terraform docs
+	$(MAKE) -C integrations/operator crd-docs
+	$(MAKE) -C examples/chart render-chart-ref
+
+.PHONY: gen-resource-docs
+gen-resource-docs:
+	cd build.assets/tooling/cmd/resource-ref-generator && go run . -config config.yaml
+
+.PHONY: resource-docs-up-to-date
+resource-docs-up-to-date: must-start-clean/host gen-resource-docs
+	@if ! git diff --quiet; then \
+		./build.assets/please-run.sh "tctl resource reference docs" "make gen-resource-docs"; \
+		exit 1; \
+	fi
diff --git a/README.md b/README.md
index 65fb31b8bc666..2e25df3f8b028 100644
--- a/README.md
+++ b/README.md
@@ -121,7 +121,7 @@ If your intention is to build and deploy for use in a production infrastructure
 a released tag should be used.  The default branch, `master`, is the current
 development branch for an upcoming major version.  Get the latest release tags
 listed at https://goteleport.com/download/ and then use that tag in the `git clone`.
-For example `git clone https://github.com/gravitational/teleport.git -b v16.0.0` gets release v16.0.0.
+For example `git clone https://github.com/gravitational/teleport.git -b v18.0.0` gets release v18.0.0.
 
 ### Dockerized Build
 
diff --git a/api/client/accesslist/accesslist.go b/api/client/accesslist/accesslist.go
index 62c8a200696a4..54c518603a483 100644
--- a/api/client/accesslist/accesslist.go
+++ b/api/client/accesslist/accesslist.go
@@ -61,7 +61,10 @@ func (c *Client) GetAccessLists(ctx context.Context) ([]*accesslist.AccessList,
 }
 
 // ListAccessLists returns a paginated list of access lists.
+// TODO (avatus): DELETE IN 21.0.0
 func (c *Client) ListAccessLists(ctx context.Context, pageSize int, nextToken string) ([]*accesslist.AccessList, string, error) {
+	//nolint:staticcheck // SA1019. ListAccessLists is deprecated but will
+	// continue be supported for backward compatibility.
 	resp, err := c.grpcClient.ListAccessLists(ctx, &accesslistv1.ListAccessListsRequest{
 		PageSize:  int32(pageSize),
 		NextToken: nextToken,
@@ -82,6 +85,24 @@ func (c *Client) ListAccessLists(ctx context.Context, pageSize int, nextToken st
 	return accessLists, resp.GetNextToken(), nil
 }
 
+// ListAccessListsV2 returns a filtered and sorted paginated list of access lists.
+func (c *Client) ListAccessListsV2(ctx context.Context, req *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error) {
+	resp, err := c.grpcClient.ListAccessListsV2(ctx, req)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	accessLists := make([]*accesslist.AccessList, len(resp.AccessLists))
+	for i, accessList := range resp.AccessLists {
+		accessLists[i], err = conv.FromProto(accessList, conv.WithOwnersIneligibleStatusField(accessList.GetSpec().GetOwners()))
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return accessLists, resp.GetNextPageToken(), nil
+}
+
 // GetAccessList returns the specified access list resource.
 func (c *Client) GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error) {
 	resp, err := c.grpcClient.GetAccessList(ctx, &accesslistv1.GetAccessListRequest{
@@ -219,7 +240,7 @@ func (c *Client) ListAllAccessListMembers(ctx context.Context, pageSize int, pag
 }
 
 // GetAccessListMember returns the specified access list member resource.
-func (c *Client) GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error) {
+func (c *Client) GetAccessListMember(ctx context.Context, accessList, memberName string) (*accesslist.AccessListMember, error) {
 	resp, err := c.grpcClient.GetAccessListMember(ctx, &accesslistv1.GetAccessListMemberRequest{
 		AccessList: accessList,
 		MemberName: memberName,
@@ -232,6 +253,21 @@ func (c *Client) GetAccessListMember(ctx context.Context, accessList string, mem
 	return member, trace.Wrap(err)
 }
 
+// GetStaticAccessListMember returns the specified access_list_member resource. If returns error if
+// the target access_list is not of type static.
+func (c *Client) GetStaticAccessListMember(ctx context.Context, accessList, memberName string) (*accesslist.AccessListMember, error) {
+	resp, err := c.grpcClient.GetStaticAccessListMember(ctx, &accesslistv1.GetStaticAccessListMemberRequest{
+		AccessList: accessList,
+		MemberName: memberName,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	member, err := conv.FromMemberProto(resp.Member, conv.WithMemberIneligibleStatusField(resp.Member))
+	return member, trace.Wrap(err)
+}
+
 // GetAccessListOwners returns a list of all owners in an Access List, including those inherited from nested Access Lists.
 //
 // Returned Owners are not validated for ownership requirements – use `IsAccessListOwner` for validation.
@@ -264,6 +300,19 @@ func (c *Client) UpsertAccessListMember(ctx context.Context, member *accesslist.
 	return responseMember, trace.Wrap(err)
 }
 
+// UpsertStaticAccessListMember creates or updates an access_list_member resource. It returns error
+// and does nothing if the target access_list is not of type static.
+func (c *Client) UpsertStaticAccessListMember(ctx context.Context, member *accesslist.AccessListMember) (*accesslist.AccessListMember, error) {
+	resp, err := c.grpcClient.UpsertStaticAccessListMember(ctx, &accesslistv1.UpsertStaticAccessListMemberRequest{
+		Member: conv.ToMemberProto(member),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	m, err := conv.FromMemberProto(resp.Member, conv.WithMemberIneligibleStatusField(resp.Member))
+	return m, trace.Wrap(err)
+}
+
 // UpdateAccessListMember updates an access list member resource using a conditional update.
 func (c *Client) UpdateAccessListMember(ctx context.Context, member *accesslist.AccessListMember) (*accesslist.AccessListMember, error) {
 	resp, err := c.grpcClient.UpdateAccessListMember(ctx, &accesslistv1.UpdateAccessListMemberRequest{
@@ -276,8 +325,18 @@ func (c *Client) UpdateAccessListMember(ctx context.Context, member *accesslist.
 	return responseMember, trace.Wrap(err)
 }
 
+// DeleteStaticAccessListMember hard deletes the specified access_list_member. It returns error and
+// does nothing if the target access_list is not of static type.
+func (c *Client) DeleteStaticAccessListMember(ctx context.Context, accessList, memberName string) error {
+	_, err := c.grpcClient.DeleteStaticAccessListMember(ctx, &accesslistv1.DeleteStaticAccessListMemberRequest{
+		AccessList: accessList,
+		MemberName: memberName,
+	})
+	return trace.Wrap(err)
+}
+
 // DeleteAccessListMember hard deletes the specified access list member resource.
-func (c *Client) DeleteAccessListMember(ctx context.Context, accessList string, memberName string) error {
+func (c *Client) DeleteAccessListMember(ctx context.Context, accessList, memberName string) error {
 	_, err := c.grpcClient.DeleteAccessListMember(ctx, &accesslistv1.DeleteAccessListMemberRequest{
 		AccessList: accessList,
 		MemberName: memberName,
@@ -415,3 +474,22 @@ func (c *Client) GetSuggestedAccessLists(ctx context.Context, accessRequestID st
 
 	return accessLists, nil
 }
+
+// ListUserAccessLists returns a paginated list of all access lists where the
+// user is explicitly an owner or member.
+func (c *Client) ListUserAccessLists(ctx context.Context, req *accesslistv1.ListUserAccessListsRequest) ([]*accesslist.AccessList, string, error) {
+	resp, err := c.grpcClient.ListUserAccessLists(ctx, req)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	accessLists := make([]*accesslist.AccessList, len(resp.AccessLists))
+	for i, accessList := range resp.AccessLists {
+		accessLists[i], err = conv.FromProto(accessList, conv.WithOwnersIneligibleStatusField(accessList.GetSpec().GetOwners()))
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return accessLists, resp.GetNextPageToken(), nil
+}
diff --git a/api/client/client.go b/api/client/client.go
index afa1104cda9bc..cb99f34ba6215 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -24,6 +24,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"iter"
 	"log/slog"
 	"net"
 	"slices"
@@ -58,6 +59,7 @@ import (
 	"github.com/gravitational/teleport/api/client/okta"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/scim"
+	scopedaccess "github.com/gravitational/teleport/api/client/scopes/access"
 	"github.com/gravitational/teleport/api/client/secreport"
 	statichostuserclient "github.com/gravitational/teleport/api/client/statichostuser"
 	"github.com/gravitational/teleport/api/client/userloginstate"
@@ -79,8 +81,8 @@ import (
 	externalauditstoragev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1"
 	gitserverpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
-	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
@@ -89,11 +91,15 @@ import (
 	oktapb "github.com/gravitational/teleport/api/gen/proto/go/teleport/okta/v1"
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	presencepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
-	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingencryptionv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	recordingmetadatav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
 	resourceusagepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/resourceusage/v1"
 	samlidppb "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
 	secreportsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
 	stableunixusersv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/stableunixusers/v1"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	userloginstatev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
@@ -110,6 +116,8 @@ import (
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	grpcutils "github.com/gravitational/teleport/api/utils/grpc"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 )
 
@@ -127,6 +135,8 @@ type AuthServiceClient struct {
 	auditlogpb.AuditLogServiceClient
 	userpreferencespb.UserPreferencesServiceClient
 	notificationsv1pb.NotificationServiceClient
+	recordingencryptionv1pb.RecordingEncryptionServiceClient
+	joiningv1.ScopedJoiningServiceClient
 }
 
 // Client is a gRPC Client that connects to a Teleport Auth server either
@@ -146,8 +156,8 @@ type Client struct {
 	conn *grpc.ClientConn
 	// grpc is the gRPC client specification for the auth server.
 	grpc AuthServiceClient
-	// JoinServiceClient is a client for the JoinService, which runs on both the
-	// auth and proxy.
+	// JoinServiceClient is a client for the legacy JoinService, which
+	// runs on both the auth and proxy.
 	*JoinServiceClient
 	// closedFlag is set to indicate that the connection is closed.
 	// It's a pointer to allow the Client struct to be copied.
@@ -500,23 +510,24 @@ func (c *Client) dialGRPC(ctx context.Context, addr string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
 	var dialOpts []grpc.DialOption
 	dialOpts = append(dialOpts, grpc.WithContextDialer(c.grpcDialer()))
 	dialOpts = append(dialOpts,
+		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 		grpc.WithChainUnaryInterceptor(
-			otelUnaryClientInterceptor(),
 			metadata.UnaryClientInterceptor,
 			interceptors.GRPCClientUnaryErrorInterceptor,
 			interceptors.WithMFAUnaryInterceptor(c.PerformMFACeremony),
 			breaker.UnaryClientInterceptor(cb),
 		),
 		grpc.WithChainStreamInterceptor(
-			otelStreamClientInterceptor(),
 			metadata.StreamClientInterceptor,
 			interceptors.GRPCClientStreamErrorInterceptor,
 			breaker.StreamClientInterceptor(cb),
 		),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(grpcutils.MaxClientRecvMsgSize()),
+		),
 	)
 	// Only set transportCredentials if tlsConfig is set. This makes it possible
 	// to explicitly provide grpc.WithTransportCredentials(insecure.NewCredentials())
@@ -534,35 +545,18 @@ func (c *Client) dialGRPC(ctx context.Context, addr string) error {
 
 	c.conn = conn
 	c.grpc = AuthServiceClient{
-		AuthServiceClient:            proto.NewAuthServiceClient(c.conn),
-		AuditLogServiceClient:        auditlogpb.NewAuditLogServiceClient(c.conn),
-		UserPreferencesServiceClient: userpreferencespb.NewUserPreferencesServiceClient(c.conn),
-		NotificationServiceClient:    notificationsv1pb.NewNotificationServiceClient(c.conn),
+		AuthServiceClient:                proto.NewAuthServiceClient(c.conn),
+		AuditLogServiceClient:            auditlogpb.NewAuditLogServiceClient(c.conn),
+		UserPreferencesServiceClient:     userpreferencespb.NewUserPreferencesServiceClient(c.conn),
+		NotificationServiceClient:        notificationsv1pb.NewNotificationServiceClient(c.conn),
+		RecordingEncryptionServiceClient: recordingencryptionv1pb.NewRecordingEncryptionServiceClient(c.conn),
+		ScopedJoiningServiceClient:       joiningv1.NewScopedJoiningServiceClient(c.conn),
 	}
 	c.JoinServiceClient = NewJoinServiceClient(proto.NewJoinServiceClient(c.conn))
 
 	return nil
 }
 
-// We wrap the creation of the otelgrpc interceptors in a sync.Once - this is
-// because each time this is called, they create a new underlying metric. If
-// something (e.g tbot) is repeatedly creating new clients and closing them,
-// then this leads to a memory leak since the underlying metric is not cleaned
-// up.
-// See https://github.com/gravitational/teleport/issues/30759
-// See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4226
-var otelStreamClientInterceptor = sync.OnceValue(func() grpc.StreamClientInterceptor {
-	//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-	// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-	return otelgrpc.StreamClientInterceptor()
-})
-
-var otelUnaryClientInterceptor = sync.OnceValue(func() grpc.UnaryClientInterceptor {
-	//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-	// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-	return otelgrpc.UnaryClientInterceptor()
-})
-
 // ConfigureALPN configures ALPN SNI cluster routing information in TLS settings allowing for
 // allowing to dial auth service through Teleport Proxy directly without using SSH Tunnels.
 func ConfigureALPN(tlsConfig *tls.Config, clusterName string) *tls.Config {
@@ -831,6 +825,12 @@ func (c *Client) UpsertDeviceResource(ctx context.Context, res *types.DeviceV1)
 	return types.DeviceToResource(upserted), nil
 }
 
+// ScopedAccessServiceClient returns an unadorned Scoped Access Service client, using the underlying
+// Auth gRPC connection.
+func (c *Client) ScopedAccessServiceClient() *scopedaccess.Client {
+	return scopedaccess.NewClient(scopedaccessv1.NewScopedAccessServiceClient(c.conn))
+}
+
 // LoginRuleClient returns an unadorned Login Rule client, using the underlying
 // Auth gRPC connection.
 // Clients connecting to non-Enterprise clusters, or older Teleport versions,
@@ -934,6 +934,29 @@ func (c *Client) VnetConfigServiceClient() vnet.VnetConfigServiceClient {
 	return vnet.NewVnetConfigServiceClient(c.conn)
 }
 
+// JoinV1Client returns an unadorned gRPC client for the new Join service.
+func (c *Client) JoinV1Client() joinv1.JoinServiceClient {
+	return joinv1.NewJoinServiceClient(c.conn)
+}
+
+// SummarizerServiceClient returns an unadorned client for the session
+// recording summarizer service.
+func (c *Client) SummarizerServiceClient() summarizerv1.SummarizerServiceClient {
+	return summarizerv1.NewSummarizerServiceClient(c.conn)
+}
+
+// RecordingMetadataServiceClient returns an unadorned client for the session
+// recording metadata service.
+func (c *Client) RecordingMetadataServiceClient() recordingmetadatav1.RecordingMetadataServiceClient {
+	return recordingmetadatav1.NewRecordingMetadataServiceClient(c.conn)
+}
+
+// RecordingEncryptionServiceClient returns an unadorned client for the session
+// recording encryption service.
+func (c *Client) RecordingEncryptionServiceClient() recordingencryptionv1pb.RecordingEncryptionServiceClient {
+	return recordingencryptionv1pb.NewRecordingEncryptionServiceClient(c.conn)
+}
+
 // GetVnetConfig returns the singleton VnetConfig resource.
 func (c *Client) GetVnetConfig(ctx context.Context) (*vnet.VnetConfig, error) {
 	return c.VnetConfigServiceClient().GetVnetConfig(ctx, &vnet.GetVnetConfigRequest{})
@@ -1036,25 +1059,29 @@ func (c *Client) GetCurrentUserRoles(ctx context.Context) ([]types.Role, error)
 // GetUsers returns all currently registered users.
 // withSecrets controls whether authentication details are returned.
 func (c *Client) GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error) {
-	req := userspb.ListUsersRequest{
-		WithSecrets: withSecrets,
-	}
+	userstream := clientutils.Resources(
+		ctx,
+		func(ctx context.Context, limit int, token string) ([]*types.UserV2, string, error) {
+			rsp, err := c.ListUsers(ctx, &userspb.ListUsersRequest{
+				WithSecrets: withSecrets,
+				PageToken:   token,
+				PageSize:    int32(limit),
+			})
+
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			return rsp.Users, rsp.NextPageToken, nil
+		})
 
 	var out []types.User
-	for {
-		rsp, err := c.ListUsers(ctx, &req)
+	for user, err := range userstream {
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		for _, user := range rsp.Users {
-			out = append(out, user)
-		}
-
-		req.PageToken = rsp.NextPageToken
-		if req.PageToken == "" {
-			break
-		}
+		out = append(out, user)
 	}
 
 	return out, nil
@@ -1171,6 +1198,24 @@ func (c *Client) CreateResetPasswordToken(ctx context.Context, req *proto.Create
 	return token, nil
 }
 
+func (c *Client) ListResetPasswordTokens(ctx context.Context, pageSize int, pageToken string) ([]types.UserToken, string, error) {
+	req := &proto.ListResetPasswordTokenRequest{
+		PageSize:  int32(pageSize),
+		PageToken: pageToken,
+	}
+	resp, err := c.grpc.ListResetPasswordTokens(ctx, req)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	// Convert concrete type []*types.UserTokenV3 to interface type []types.UserToken
+	tokens := make([]types.UserToken, len(resp.UserTokens))
+	for i, token := range resp.UserTokens {
+		tokens[i] = token
+	}
+	return tokens, resp.NextPageToken, nil
+}
+
 // GetAccessRequests retrieves a list of all access requests matching the provided filter.
 func (c *Client) GetAccessRequests(ctx context.Context, filter types.AccessRequestFilter) ([]types.AccessRequest, error) {
 	requests, err := c.ListAllAccessRequests(ctx, &proto.ListAccessRequestsRequest{
@@ -1340,6 +1385,15 @@ func (c *Client) GetAccessCapabilities(ctx context.Context, req types.AccessCapa
 	return caps, nil
 }
 
+// GetRemoteAccessCapabilities requests the access capabilities of a user.
+func (c *Client) GetRemoteAccessCapabilities(ctx context.Context, req types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error) {
+	caps, err := c.grpc.GetRemoteAccessCapabilities(ctx, &req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return caps, nil
+}
+
 // GetPluginData loads all plugin data matching the supplied filter.
 func (c *Client) GetPluginData(ctx context.Context, filter types.PluginDataFilter) ([]types.PluginData, error) {
 	seq, err := c.grpc.GetPluginData(ctx, &filter)
@@ -1393,6 +1447,25 @@ func (c *Client) GetSemaphores(ctx context.Context, filter types.SemaphoreFilter
 	return sems, nil
 }
 
+// ListSemaphores returns a page of semaphores matching supplied filter.
+func (c *Client) ListSemaphores(ctx context.Context, limit int, start string, filter *types.SemaphoreFilter) ([]types.Semaphore, string, error) {
+	resp, err := c.grpc.ListSemaphores(ctx, &proto.ListSemaphoresRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+		Filter:    filter,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	sems := make([]types.Semaphore, 0, len(resp.Semaphores))
+	for _, s := range resp.Semaphores {
+		sems = append(sems, s)
+	}
+
+	return sems, resp.NextPageToken, nil
+}
+
 // DeleteSemaphore deletes a semaphore matching the supplied filter.
 func (c *Client) DeleteSemaphore(ctx context.Context, filter types.SemaphoreFilter) error {
 	_, err := c.grpc.DeleteSemaphore(ctx, &filter)
@@ -1526,6 +1599,27 @@ func (c *Client) GetSnowflakeSessions(ctx context.Context) ([]types.WebSession,
 	return out, nil
 }
 
+// ListSnowflakeSessions returns a page of Snowflake web sessions.
+func (c *Client) ListSnowflakeSessions(ctx context.Context, limit int, start string) ([]types.WebSession, string, error) {
+	resp, err := c.grpc.ListSnowflakeSessions(ctx, &proto.ListSnowflakeSessionsRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	sessions := make([]types.WebSession, len(resp.Sessions))
+	for i := range resp.Sessions {
+		sessions[i] = resp.Sessions[i]
+	}
+	return sessions, resp.NextPageToken, nil
+}
+
+// RangeSnowflakeSessions returns Snowflake web sessions within the range [start, end).
+func (c *Client) RangeSnowflakeSessions(ctx context.Context, start, end string) iter.Seq2[types.WebSession, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListSnowflakeSessions, types.WebSession.GetName)
+}
+
 // CreateAppSession creates an application web session. Application web
 // sessions represent a browser session the client holds.
 func (c *Client) CreateAppSession(ctx context.Context, req *proto.CreateAppSessionRequest) (types.WebSession, error) {
@@ -1770,6 +1864,16 @@ func (c *Client) ListRoles(ctx context.Context, req *proto.ListRolesRequest) (*p
 	return rsp, nil
 }
 
+// ListRequestableRoles is a paginated requestable role getter.
+func (c *Client) ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error) {
+	rsp, err := c.grpc.ListRequestableRoles(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return rsp, nil
+}
+
 // CreateRole creates a new role.
 func (c *Client) CreateRole(ctx context.Context, role types.Role) (types.Role, error) {
 	r, ok := role.(*types.RoleV6)
@@ -1878,6 +1982,39 @@ func (c *Client) GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]typ
 	return oidcConnectors, nil
 }
 
+// ListOIDCConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (c *Client) ListOIDCConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.OIDCConnector, string, error) {
+	resp, err := c.grpc.ListOIDCConnectors(ctx, &proto.ListOIDCConnectorsRequest{
+		PageSize:    int32(limit),
+		PageToken:   start,
+		WithSecrets: withSecrets,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	oidcConnectors := make([]types.OIDCConnector, len(resp.Connectors))
+	for i, oidcConnector := range resp.Connectors {
+		oidcConnectors[i] = oidcConnector
+	}
+	return oidcConnectors, resp.NextPageToken, nil
+}
+
+// RangeOIDCConnectors returns valid registered connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (c *Client) RangeOIDCConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.OIDCConnector, error] {
+	return clientutils.RangeResources(
+		ctx,
+		start,
+		end,
+		func(ctx context.Context, limit int, start string) ([]types.OIDCConnector, string, error) {
+			return c.ListOIDCConnectors(ctx, limit, start, withSecrets)
+		},
+		types.OIDCConnector.GetName,
+	)
+}
+
 // CreateOIDCConnector creates an OIDC connector.
 func (c *Client) CreateOIDCConnector(ctx context.Context, connector types.OIDCConnector) (types.OIDCConnector, error) {
 	oidcConnector, ok := connector.(*types.OIDCConnectorV3)
@@ -1991,6 +2128,43 @@ func (c *Client) GetSAMLConnectorsWithValidationOptions(ctx context.Context, wit
 	return samlConnectors, nil
 }
 
+// ListSAMLConnectorsWithOptions returns a page of valid registered SAML connectors.
+// withSecrets adds or removes client secret from return results.
+func (c *Client) ListSAMLConnectorsWithOptions(ctx context.Context, limit int, start string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, string, error) {
+	var options types.SAMLConnectorValidationOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	resp, err := c.grpc.ListSAMLConnectors(ctx, &proto.ListSAMLConnectorsRequest{
+		PageSize:     int32(limit),
+		PageToken:    start,
+		WithSecrets:  withSecrets,
+		NoFollowUrls: options.NoFollowURLs,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	samlConnectors := make([]types.SAMLConnector, len(resp.Connectors))
+	for i, samlConnector := range resp.Connectors {
+		samlConnectors[i] = samlConnector
+	}
+	return samlConnectors, resp.NextPageToken, nil
+}
+
+// RangeSAMLConnectorsWithOptions returns valid registered SAML connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (c *Client) RangeSAMLConnectorsWithOptions(ctx context.Context, start, end string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) iter.Seq2[types.SAMLConnector, error] {
+	return clientutils.RangeResources(
+		ctx,
+		start,
+		end,
+		func(ctx context.Context, pageSize int, pageToken string) ([]types.SAMLConnector, string, error) {
+			return c.ListSAMLConnectorsWithOptions(ctx, pageSize, pageToken, withSecrets, opts...)
+		},
+		types.SAMLConnector.GetName)
+}
+
 // CreateSAMLConnector creates a SAML connector.
 func (c *Client) CreateSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error) {
 	samlConnectorV2, ok := connector.(*types.SAMLConnectorV2)
@@ -2077,6 +2251,39 @@ func (c *Client) GetGithubConnectors(ctx context.Context, withSecrets bool) ([]t
 	return githubConnectors, nil
 }
 
+// ListGithubConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (c *Client) ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error) {
+	resp, err := c.grpc.ListGithubConnectors(ctx, &proto.ListGithubConnectorsRequest{
+		PageSize:    int32(limit),
+		PageToken:   start,
+		WithSecrets: withSecrets,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	githubConnectors := make([]types.GithubConnector, 0, len(resp.Connectors))
+	for _, githubConnector := range resp.Connectors {
+		githubConnectors = append(githubConnectors, githubConnector)
+	}
+	return githubConnectors, resp.NextPageToken, nil
+}
+
+// RangeGithubConnectors returns valid registered connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (c *Client) RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error] {
+	return clientutils.RangeResources(
+		ctx,
+		start,
+		end,
+		func(ctx context.Context, limit int, start string) ([]types.GithubConnector, string, error) {
+			return c.ListGithubConnectors(ctx, limit, start, withSecrets)
+		},
+		types.GithubConnector.GetName,
+	)
+}
+
 // CreateGithubConnector creates a Github connector.
 func (c *Client) CreateGithubConnector(ctx context.Context, connector types.GithubConnector) (types.GithubConnector, error) {
 	githubConnector, ok := connector.(*types.GithubConnectorV3)
@@ -2234,6 +2441,27 @@ func (c *Client) GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster
 	return trustedClusters, nil
 }
 
+// ListTrustedClusters returns a page of Trusted Cluster resources.
+func (c *Client) ListTrustedClusters(ctx context.Context, limit int, start string) ([]types.TrustedCluster, string, error) {
+	resp, err := c.TrustClient().ListTrustedClusters(ctx, &trustpb.ListTrustedClustersRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	tcs := make([]types.TrustedCluster, len(resp.TrustedClusters))
+	for i := range resp.TrustedClusters {
+		tcs[i] = resp.TrustedClusters[i]
+	}
+	return tcs, resp.NextPageToken, nil
+}
+
+// RangeTrustedClusters returns Trusted Cluster resources within the range [start, end).
+func (c *Client) RangeTrustedClusters(ctx context.Context, start, end string) iter.Seq2[types.TrustedCluster, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListTrustedClusters, types.TrustedCluster.GetName)
+}
+
 // UpsertTrustedCluster creates or updates a Trusted Cluster.
 //
 // Deprecated: Use [Client.UpsertTrustedClusterV2] instead.
@@ -2313,8 +2541,10 @@ func (c *Client) GetToken(ctx context.Context, name string) (types.ProvisionToke
 }
 
 // GetTokens returns a list of active provision tokens for nodes and users.
+// Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+// TODO(hugoShaka): DELETE IN 19.0.0
 func (c *Client) GetTokens(ctx context.Context) ([]types.ProvisionToken, error) {
-	resp, err := c.grpc.GetTokens(ctx, &emptypb.Empty{})
+	resp, err := c.grpc.GetTokens(ctx, &emptypb.Empty{}) //nolint:staticcheck // Provides backward compatibility, will be removed later.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2326,6 +2556,37 @@ func (c *Client) GetTokens(ctx context.Context) ([]types.ProvisionToken, error)
 	return tokens, nil
 }
 
+// GetStaticTokens returns the cluster static tokens.
+func (c *Client) GetStaticTokens(ctx context.Context) (types.StaticTokens, error) {
+	tokens, err := c.grpc.GetStaticTokens(ctx, &emptypb.Empty{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return tokens, nil
+}
+
+// ListProvisionTokens retrieves a paginated list of provision tokens.
+func (c *Client) ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error) {
+	resp, err := c.grpc.ListProvisionTokens(ctx, &proto.ListProvisionTokensRequest{
+		Limit:         int32(pageSize),
+		StartKey:      pageToken,
+		FilterRoles:   anyRoles.StringSlice(),
+		FilterBotName: botName,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	// Convert concrete type []*types.ProvisionTokenV2 to interface type []types.ProvisionToken
+	tokens := make([]types.ProvisionToken, len(resp.Tokens))
+	for i, token := range resp.Tokens {
+		tokens[i] = token
+	}
+
+	return tokens, resp.NextKey, nil
+}
+
 // UpsertToken creates or updates a provision token.
 func (c *Client) UpsertToken(ctx context.Context, token types.ProvisionToken) error {
 	tokenV2, ok := token.(*types.ProvisionTokenV2)
@@ -2476,6 +2737,65 @@ func (c *Client) StreamSessionEvents(ctx context.Context, sessionID string, star
 	return ch, e
 }
 
+// UploadEncryptedRecording streams encrypted recording parts to the auth
+// server to be saved in long term storage.
+func (c *Client) UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+	createRes, err := c.grpc.CreateUpload(ctx, &recordingencryptionv1pb.CreateUploadRequest{
+		SessionId: sessionID,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	next, stop := iter.Pull2(parts)
+	defer stop()
+
+	part, err, ok := next()
+	if err != nil {
+		return trace.Wrap(err)
+	} else if !ok {
+		return trace.BadParameter("unexpected empty upload")
+	}
+
+	var uploadedParts []*recordingencryptionv1pb.Part
+	// S3 requires that part numbers start at 1, so we do that by default regardless of which uploader is
+	// configured for the auth service
+	var partNumber int64 = 1
+	for {
+		nextPart, err, hasNext := next()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		uploadRes, err := c.grpc.UploadPart(ctx, &recordingencryptionv1pb.UploadPartRequest{
+			Upload:     createRes.Upload,
+			PartNumber: partNumber,
+			Part:       part,
+			IsLast:     !hasNext,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		uploadedParts = append(uploadedParts, uploadRes.Part)
+
+		if !hasNext {
+			break
+		}
+
+		part = nextPart
+		partNumber++
+	}
+
+	if _, err := c.grpc.CompleteUpload(ctx, &recordingencryptionv1pb.CompleteUploadRequest{
+		Upload: createRes.Upload,
+		Parts:  uploadedParts,
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
 // SearchEvents allows searching for events with a full pagination support.
 func (c *Client) SearchEvents(ctx context.Context, fromUTC, toUTC time.Time, namespace string, eventTypes []string, limit int, order types.EventOrder, startKey string) ([]events.AuditEvent, string, error) {
 	request := &proto.GetEventsRequest{
@@ -2656,6 +2976,14 @@ func (c *Client) DynamicDesktopClient() *dynamicwindows.Client {
 	return dynamicwindows.NewClient(dynamicwindowsv1.NewDynamicWindowsServiceClient(c.conn))
 }
 
+func (c *Client) ListDynamicWindowsDesktops(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error) {
+	return c.DynamicDesktopClient().ListDynamicWindowsDesktops(ctx, pageSize, pageToken)
+}
+
+func (c *Client) GetDynamicWindowsDesktop(ctx context.Context, name string) (types.DynamicWindowsDesktop, error) {
+	return c.DynamicDesktopClient().GetDynamicWindowsDesktop(ctx, name)
+}
+
 // ClusterConfigClient returns an unadorned Cluster Configuration client, using the underlying
 // Auth gRPC connection.
 func (c *Client) ClusterConfigClient() clusterconfigpb.ClusterConfigServiceClient {
@@ -2982,6 +3310,35 @@ func (c *Client) ListAutoUpdateAgentReports(ctx context.Context, pageSize int, p
 	return resp.GetAutoupdateAgentReports(), resp.GetNextKey(), nil
 }
 
+// UpsertAutoUpdateAgentReport upserts an AutoUpdateAgentReport resource.
+func (c *Client) UpsertAutoUpdateAgentReport(ctx context.Context, report *autoupdatev1pb.AutoUpdateAgentReport) (*autoupdatev1pb.AutoUpdateAgentReport, error) {
+	client := autoupdatev1pb.NewAutoUpdateServiceClient(c.conn)
+	resp, err := client.UpsertAutoUpdateAgentReport(ctx, &autoupdatev1pb.UpsertAutoUpdateAgentReportRequest{
+		AutoupdateAgentReport: report,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp, nil
+}
+
+// GetAutoUpdateBotInstanceReport gets the singleton auto-update bot report.
+func (c *Client) GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdatev1pb.AutoUpdateBotInstanceReport, error) {
+	client := autoupdatev1pb.NewAutoUpdateServiceClient(c.conn)
+	resp, err := client.GetAutoUpdateBotInstanceReport(ctx, &autoupdatev1pb.GetAutoUpdateBotInstanceReportRequest{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp, nil
+}
+
+// DeleteAutoUpdateBotInstanceReport deletes the singleton auto-update bot instance report.
+func (c *Client) DeleteAutoUpdateBotInstanceReport(ctx context.Context) error {
+	client := autoupdatev1pb.NewAutoUpdateServiceClient(c.conn)
+	_, err := client.DeleteAutoUpdateBotInstanceReport(ctx, &autoupdatev1pb.DeleteAutoUpdateBotInstanceReportRequest{})
+	return trace.Wrap(err)
+}
+
 // GetClusterAccessGraphConfig retrieves the Cluster Access Graph configuration from Auth server.
 func (c *Client) GetClusterAccessGraphConfig(ctx context.Context) (*clusterconfigpb.AccessGraphConfig, error) {
 	rsp, err := c.ClusterConfigClient().GetClusterAccessGraphConfig(ctx, &clusterconfigpb.GetClusterAccessGraphConfigRequest{})
@@ -2991,7 +3348,7 @@ func (c *Client) GetClusterAccessGraphConfig(ctx context.Context) (*clusterconfi
 	return rsp.AccessGraph, nil
 }
 
-// GetInstaller gets all installer script resources
+// GetInstallers gets all installer script resources
 func (c *Client) GetInstallers(ctx context.Context) ([]types.Installer, error) {
 	resp, err := c.grpc.GetInstallers(ctx, &emptypb.Empty{})
 	if err != nil {
@@ -3004,6 +3361,29 @@ func (c *Client) GetInstallers(ctx context.Context) ([]types.Installer, error) {
 	return installers, nil
 }
 
+// ListInstallers returns a page of installer script resources.
+func (c *Client) ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error) {
+	resp, err := c.grpc.ListInstallers(ctx, &proto.ListInstallersRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	installers := make([]types.Installer, len(resp.Installers))
+	for i, inst := range resp.Installers {
+		installers[i] = inst
+	}
+
+	return installers, resp.NextPageToken, nil
+}
+
+// RangeInstallers returns installer script resources within the range [start, end).
+func (c *Client) RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListInstallers, types.Installer.GetName)
+}
+
 // GetUIConfig gets the configuration for the UI served by the proxy service
 func (c *Client) GetUIConfig(ctx context.Context) (types.UIConfig, error) {
 	resp, err := c.grpc.GetUIConfig(ctx, &emptypb.Empty{})
@@ -3088,6 +3468,41 @@ func (c *Client) GetLocks(ctx context.Context, inForceOnly bool, targets ...type
 	return locks, nil
 }
 
+// ListLocks returns a page of locks matching a filter
+func (c *Client) ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error) {
+	resp, err := c.grpc.ListLocks(
+		ctx,
+		&proto.ListLocksRequest{
+			PageSize:  int32(limit),
+			PageToken: startKey,
+			Filter:    filter,
+		},
+	)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	locks := make([]types.Lock, 0, len(resp.Locks))
+	for _, lock := range resp.Locks {
+		locks = append(locks, lock)
+	}
+	return locks, resp.NextPageToken, nil
+
+}
+
+// RangeLocks returns locks within the range [start, end) matching a filter
+func (c *Client) RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error] {
+	return clientutils.RangeResources(
+		ctx,
+		start,
+		end,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return c.ListLocks(ctx, limit, start, filter)
+		},
+		types.Lock.GetName,
+	)
+}
+
 // UpsertLock upserts a lock.
 func (c *Client) UpsertLock(ctx context.Context, lock types.Lock) error {
 	lockV2, ok := lock.(*types.LockV2)
@@ -3219,6 +3634,35 @@ func (c *Client) GetApps(ctx context.Context) ([]types.Application, error) {
 	return apps, nil
 }
 
+// ListApps returns a page of application resources.
+//
+// Note that application resources here refers to "dynamically-added"
+// applications such as applications created by `tctl create`, or the CreateApp
+// API. Applications defined in the `app_service.apps` section of the service
+// YAML configuration are not collected in this API.
+//
+// For a page of registered applications that are served by an application
+// service, use ListResources instead.
+func (c *Client) ListApps(ctx context.Context, limit int, start string) ([]types.Application, string, error) {
+	resp, err := c.grpc.ListApps(ctx, &proto.ListAppsRequest{
+		Limit:    int32(limit),
+		StartKey: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	apps := make([]types.Application, 0, len(resp.Applications))
+	for _, app := range resp.Applications {
+		apps = append(apps, app)
+	}
+	return apps, resp.NextKey, nil
+}
+
+// Apps returns application resources within the range [start, end).
+func (c *Client) Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListApps, types.Application.GetName)
+}
+
 // DeleteApp deletes specified application resource.
 func (c *Client) DeleteApp(ctx context.Context, name string) error {
 	_, err := c.grpc.DeleteApp(ctx, &types.ResourceRequest{Name: name})
@@ -3231,6 +3675,38 @@ func (c *Client) DeleteAllApps(ctx context.Context) error {
 	return trace.Wrap(err)
 }
 
+// ListAuthServers returns a paginated list of auth servers registered in the cluster.
+func (c *Client) ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	resp, err := c.PresenceServiceClient().ListAuthServers(ctx, &presencepb.ListAuthServersRequest{
+		PageSize:  int32(pageSize),
+		PageToken: pageToken,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	servers := make([]types.Server, 0, len(resp.Servers))
+	for _, server := range resp.Servers {
+		servers = append(servers, server)
+	}
+	return servers, resp.NextPageToken, nil
+}
+
+// ListProxyServers returns a paginated list of proxy servers registered in the cluster.
+func (c *Client) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	resp, err := c.PresenceServiceClient().ListProxyServers(ctx, &presencepb.ListProxyServersRequest{
+		PageSize:  int32(pageSize),
+		PageToken: pageToken,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	servers := make([]types.Server, 0, len(resp.Servers))
+	for _, server := range resp.Servers {
+		servers = append(servers, server)
+	}
+	return servers, resp.NextPageToken, nil
+}
+
 // CreateKubernetesCluster creates a new kubernetes cluster resource.
 func (c *Client) CreateKubernetesCluster(ctx context.Context, cluster types.KubeCluster) error {
 	kubeClusterV3, ok := cluster.(*types.KubernetesClusterV3)
@@ -3276,6 +3752,27 @@ func (c *Client) GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster
 	return clusters, nil
 }
 
+// ListKubernetesClusters returns a page of registered kubernetes clusters.
+func (c *Client) ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error) {
+	resp, err := c.grpc.ListKubernetesClusters(ctx, &proto.ListKubernetesClustersRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	kubeClusters := make([]types.KubeCluster, len(resp.KubernetesClusters))
+	for i := range resp.KubernetesClusters {
+		kubeClusters[i] = resp.KubernetesClusters[i]
+	}
+	return kubeClusters, resp.NextPageToken, nil
+}
+
+// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+func (c *Client) RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListKubernetesClusters, types.KubeCluster.GetName)
+}
+
 // DeleteKubernetesCluster deletes specified kubernetes cluster resource.
 func (c *Client) DeleteKubernetesCluster(ctx context.Context, name string) error {
 	_, err := c.grpc.DeleteKubernetesCluster(ctx, &types.ResourceRequest{Name: name})
@@ -3392,6 +3889,34 @@ func (c *Client) GetDatabases(ctx context.Context) ([]types.Database, error) {
 	return databases, nil
 }
 
+// ListDatabases returns a page of database resources.
+//
+// Note that database resources here refers to "dynamically-added" databases
+// such as databases created by `tctl create`, the discovery service, or the
+// CreateDatabase API. Databases discovered by the database agent (legacy
+// discovery flow using `database_service.aws/database_service.azure`) and
+// static databases defined in the `database_service.databases` section of the
+// service YAML configuration are not collected in this API.
+func (c *Client) ListDatabases(ctx context.Context, limit int, start string) ([]types.Database, string, error) {
+	resp, err := c.grpc.ListDatabases(ctx, &proto.ListDatabasesRequest{
+		PageSize:  int32(limit),
+		PageToken: start,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	databases := make([]types.Database, len(resp.Databases))
+	for i := range resp.Databases {
+		databases[i] = resp.Databases[i]
+	}
+	return databases, resp.NextPageToken, nil
+}
+
+// RangeDatabases returns database resources within the range [start, end).
+func (c *Client) RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListDatabases, types.Database.GetName)
+}
+
 // DeleteDatabase deletes specified database resource.
 func (c *Client) DeleteDatabase(ctx context.Context, name string) error {
 	_, err := c.grpc.DeleteDatabase(ctx, &types.ResourceRequest{Name: name})
@@ -3472,6 +3997,57 @@ func (c *Client) GetDatabaseObjects(ctx context.Context) ([]*dbobjectv1.Database
 	return out, nil
 }
 
+// ListWindowsDesktops returns a page of registered Windows desktop hosts.
+func (c *Client) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	resp, err := c.grpc.ListWindowsDesktops(ctx, &proto.ListWindowsDesktopsRequest{
+		Limit:                int32(req.Limit),
+		StartKey:             req.StartKey,
+		Labels:               req.Labels,
+		PredicateExpression:  req.PredicateExpression,
+		SearchKeywords:       req.SearchKeywords,
+		WindowsDesktopFilter: req.WindowsDesktopFilter,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	out := &types.ListWindowsDesktopsResponse{
+		Desktops: make([]types.WindowsDesktop, 0, len(resp.Desktops)),
+		NextKey:  resp.NextKey,
+	}
+
+	for _, d := range resp.Desktops {
+		out.Desktops = append(out.Desktops, d)
+	}
+
+	return out, nil
+}
+
+// ListWindowsDesktopServices returns a page of Windows desktop services.
+func (c *Client) ListWindowsDesktopServices(ctx context.Context, req types.ListWindowsDesktopServicesRequest) (*types.ListWindowsDesktopServicesResponse, error) {
+	resp, err := c.grpc.ListResources(ctx, &proto.ListResourcesRequest{
+		Limit:               int32(req.Limit),
+		StartKey:            req.StartKey,
+		Labels:              req.Labels,
+		PredicateExpression: req.PredicateExpression,
+		SearchKeywords:      req.SearchKeywords,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	out := &types.ListWindowsDesktopServicesResponse{
+		DesktopServices: make([]types.WindowsDesktopService, 0, len(resp.Resources)),
+		NextKey:         resp.NextKey,
+	}
+
+	for _, r := range resp.Resources {
+		out.DesktopServices = append(out.DesktopServices, r.GetWindowsDesktopService())
+	}
+
+	return out, nil
+}
+
 // GetWindowsDesktopServices returns all registered windows desktop services.
 func (c *Client) GetWindowsDesktopServices(ctx context.Context) ([]types.WindowsDesktopService, error) {
 	resp, err := c.grpc.GetWindowsDesktopServices(ctx, &emptypb.Empty{})
@@ -3527,6 +4103,42 @@ func (c *Client) DeleteAllWindowsDesktopServices(ctx context.Context) error {
 	return nil
 }
 
+// GetRelayServer returns the relay server heartbeat with a given name.
+func (c *Client) GetRelayServer(ctx context.Context, name string) (*presencepb.RelayServer, error) {
+	req := &presencepb.GetRelayServerRequest{
+		Name: name,
+	}
+	resp, err := c.PresenceServiceClient().GetRelayServer(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.GetRelayServer(), nil
+}
+
+// ListRelayServers returns a paginated list of relay server heartbeats.
+func (c *Client) ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencepb.RelayServer, nextPageToken string, _ error) {
+	req := &presencepb.ListRelayServersRequest{
+		PageSize:  int64(pageSize),
+		PageToken: pageToken,
+	}
+
+	resp, err := c.PresenceServiceClient().ListRelayServers(ctx, req)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return resp.GetRelays(), resp.GetNextPageToken(), nil
+}
+
+// DeleteRelayServer deletes a relay server heartbeat by name.
+func (c *Client) DeleteRelayServer(ctx context.Context, name string) error {
+	req := &presencepb.DeleteRelayServerRequest{
+		Name: name,
+	}
+	_, err := c.PresenceServiceClient().DeleteRelayServer(ctx, req)
+	return trace.Wrap(err)
+}
+
 func (c *Client) GetDesktopBootstrapScript(ctx context.Context) (string, error) {
 	resp, err := c.grpc.GetDesktopBootstrapScript(ctx, &emptypb.Empty{})
 	if err != nil {
@@ -4011,7 +4623,7 @@ func GetResourcePage[T types.ResourceWithLabels](ctx context.Context, clt GetRes
 				resource = respResource.GetGitServer()
 			default:
 				out.Resources = nil
-				return out, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
+				return out, trace.NotImplemented("resource type %q does not support pagination", req.ResourceType)
 			}
 
 			t, ok := resource.(T)
@@ -5192,18 +5804,6 @@ func (c *Client) GetRemoteClusters(ctx context.Context) ([]types.RemoteCluster,
 	}
 }
 
-// IdentityCenterClient returns Identity Center service client using an underlying
-// gRPC connection.
-func (c *Client) IdentityCenterClient() identitycenterv1.IdentityCenterServiceClient {
-	return identitycenterv1.NewIdentityCenterServiceClient(c.conn)
-}
-
-// ProvisioningServiceClient returns provisioning service client using
-// an underlying gRPC connection.
-func (c *Client) ProvisioningServiceClient() provisioningv1.ProvisioningServiceClient {
-	return provisioningv1.NewProvisioningServiceClient(c.conn)
-}
-
 // IntegrationsClient returns integrations client.
 func (c *Client) IntegrationsClient() integrationpb.IntegrationServiceClient {
 	return c.integrationsClient()
@@ -5296,3 +5896,25 @@ func (c *Client) DeleteHealthCheckConfig(ctx context.Context, name string) error
 	)
 	return trace.Wrap(err)
 }
+
+// ListScopedTokens fetches pages of scoped tokens.
+func (c *Client) ListScopedTokens(ctx context.Context, req *joiningv1.ListScopedTokensRequest) (*joiningv1.ListScopedTokensResponse, error) {
+	res, err := c.grpc.ListScopedTokens(ctx, req)
+	return res, trace.Wrap(err)
+}
+
+// DeleteScopedToken deletes an existing scoped token.
+func (c *Client) DeleteScopedToken(ctx context.Context, name string) error {
+	_, err := c.grpc.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+		Name: name,
+	})
+	return trace.Wrap(err)
+}
+
+// CreateScopedToken creates a new scoped token.
+func (c *Client) CreateScopedToken(ctx context.Context, token *joiningv1.ScopedToken) (*joiningv1.ScopedToken, error) {
+	res, err := c.grpc.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		Token: token,
+	})
+	return res.GetToken(), trace.Wrap(err)
+}
diff --git a/api/client/client_test.go b/api/client/client_test.go
index ce1a9c510fd55..c43a08dfeade5 100644
--- a/api/client/client_test.go
+++ b/api/client/client_test.go
@@ -18,6 +18,7 @@ package client
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"net"
@@ -28,6 +29,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -35,6 +37,7 @@ import (
 	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
@@ -65,7 +68,7 @@ func (s *pingService) userAgentFromLastCall() string {
 func TestNew(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv := startMockServer(t, &pingService{})
+	srv := startMockServer(t, mockServices{auth: &pingService{}})
 
 	tests := []struct {
 		desc         string
@@ -130,7 +133,7 @@ func TestNewDialBackground(t *testing.T) {
 	require.NoError(t, err)
 	addr := l.Addr().String()
 	ping := &pingService{}
-	srv := newMockServer(t, addr, ping)
+	srv := newMockServer(t, addr, mockServices{auth: ping})
 
 	// Create client before the server is listening.
 	cfg := srv.clientCfg()
@@ -167,7 +170,7 @@ func TestWaitForConnectionReady(t *testing.T) {
 	l, err := net.Listen("tcp", "localhost:")
 	require.NoError(t, err)
 	addr := l.Addr().String()
-	srv := newMockServer(t, addr, &proto.UnimplementedAuthServiceServer{})
+	srv := newMockServer(t, addr, mockServices{auth: &proto.UnimplementedAuthServiceServer{}})
 
 	// Create client before the server is listening.
 	cfg := srv.clientCfg()
@@ -440,7 +443,7 @@ func testResources[T types.ResourceWithLabels](resourceType, namespace string) (
 func TestListResources(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv := startMockServer(t, &listResourcesService{})
+	srv := startMockServer(t, mockServices{auth: &listResourcesService{}})
 
 	testCases := map[string]struct {
 		resourceType   string
@@ -546,7 +549,7 @@ func testGetResources[T types.ResourceWithLabels](t *testing.T, clt *Client, kin
 func TestGetResources(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv := startMockServer(t, &listResourcesService{})
+	srv := startMockServer(t, mockServices{auth: &listResourcesService{}})
 
 	// Create client
 	clt, err := New(ctx, srv.clientCfg())
@@ -586,7 +589,7 @@ func TestGetResources(t *testing.T) {
 func TestGetResourcesWithFilters(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv := startMockServer(t, &listResourcesService{})
+	srv := startMockServer(t, mockServices{auth: &listResourcesService{}})
 
 	// Create client
 	clt, err := New(ctx, srv.clientCfg())
@@ -699,3 +702,99 @@ func TestGetUnifiedResourcesWithLogins(t *testing.T) {
 		}
 	}
 }
+
+func TestUploadEncryptedRecording(t *testing.T) {
+	ctx := context.Background()
+
+	recordingEncryptionService := &uploadRecordingService{
+		uploads: make(map[string][]*recordingencryptionv1.Part),
+	}
+	srv := startMockServer(t, mockServices{recordingEncryption: recordingEncryptionService})
+	parts := [][]byte{
+		[]byte("123"),
+		[]byte("456"),
+		[]byte("789"),
+	}
+	partIter := func(yield func([]byte, error) bool) {
+		for _, part := range parts {
+			if part == nil {
+				if !yield(nil, errors.New("invalid part")) {
+					return
+				}
+			} else {
+				if !yield(part, nil) {
+					return
+				}
+			}
+		}
+	}
+
+	clt, err := New(ctx, srv.clientCfg())
+	require.NoError(t, err)
+
+	sessionID, err := uuid.NewV7()
+	require.NoError(t, err)
+	err = clt.UploadEncryptedRecording(ctx, sessionID.String(), partIter)
+	require.NoError(t, err)
+
+	uploaded := recordingEncryptionService.uploads[sessionID.String()]
+	require.Len(t, uploaded, len(parts))
+	for idx, part := range uploaded {
+		// uploaded part numbers should increment starting with 1
+		require.Equal(t, int64(idx+1), part.PartNumber)
+	}
+}
+
+type uploadRecordingService struct {
+	recordingencryptionv1.UnimplementedRecordingEncryptionServiceServer
+
+	uploads map[string][]*recordingencryptionv1.Part
+}
+
+func (s *uploadRecordingService) CreateUpload(ctx context.Context, req *recordingencryptionv1.CreateUploadRequest) (*recordingencryptionv1.CreateUploadResponse, error) {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	s.uploads[req.SessionId] = []*recordingencryptionv1.Part{}
+	return &recordingencryptionv1.CreateUploadResponse{
+		Upload: &recordingencryptionv1.Upload{
+			UploadId:  id.String(),
+			SessionId: req.SessionId,
+		},
+	}, nil
+}
+
+func (s *uploadRecordingService) UploadPart(ctx context.Context, req *recordingencryptionv1.UploadPartRequest) (*recordingencryptionv1.UploadPartResponse, error) {
+	sessionID := req.GetUpload().GetSessionId()
+	parts, ok := s.uploads[sessionID]
+	if !ok {
+		return nil, trace.Errorf("no upload found for %s", sessionID)
+	}
+	part := &recordingencryptionv1.Part{
+		PartNumber: req.PartNumber,
+	}
+	s.uploads[sessionID] = append(parts, part)
+	return &recordingencryptionv1.UploadPartResponse{
+		Part: part,
+	}, nil
+}
+
+func (s *uploadRecordingService) CompleteUpload(ctx context.Context, req *recordingencryptionv1.CompleteUploadRequest) (*recordingencryptionv1.CompleteUploadResponse, error) {
+	sessionID := req.GetUpload().GetSessionId()
+	parts, ok := s.uploads[sessionID]
+	if !ok {
+		return nil, trace.Errorf("no upload found for %s", sessionID)
+	}
+	if len(parts) != len(req.GetParts()) {
+		return nil, errors.New("parts reported as uploaded is not the ")
+	}
+	for _, part := range req.GetParts() {
+		uploaded := parts[part.PartNumber-1]
+		if uploaded.PartNumber != part.PartNumber {
+			return nil, fmt.Errorf("expected part %d in place of %d", part.PartNumber, uploaded.PartNumber)
+		}
+	}
+	return nil, nil
+}
diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 90f27468764c8..1e53174795be6 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -383,7 +383,7 @@ func newTLSRoutingWithConnUpgradeDialer(ssh ssh.ClientConfig, params connectPara
 // sshConnect upgrades the underling connection to ssh and connects to the Auth service.
 func sshConnect(ctx context.Context, conn net.Conn, ssh ssh.ClientConfig, dialTimeout time.Duration, addr string) (net.Conn, error) {
 	ssh.Timeout = dialTimeout
-	sconn, err := tracessh.NewClientConnWithDeadline(ctx, conn, addr, &ssh)
+	sconn, err := tracessh.NewClientWithTimeout(ctx, conn, addr, &ssh)
 	if err != nil {
 		return nil, trace.NewAggregate(err, conn.Close())
 	}
diff --git a/api/client/events.go b/api/client/events.go
index fe09adae2a78a..7aec7fcca9e29 100644
--- a/api/client/events.go
+++ b/api/client/events.go
@@ -28,7 +28,10 @@ import (
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
@@ -127,6 +130,18 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
 		out.Resource = &proto.Event_AutoUpdateAgentReport{
 			AutoUpdateAgentReport: r.UnwrapT(),
 		}
+	case types.Resource153UnwrapperT[*autoupdate.AutoUpdateBotInstanceReport]:
+		out.Resource = &proto.Event_AutoUpdateBotInstanceReport{
+			AutoUpdateBotInstanceReport: r.UnwrapT(),
+		}
+	case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]:
+		out.Resource = &proto.Event_ScopedRole{
+			ScopedRole: r.UnwrapT(),
+		}
+	case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]:
+		out.Resource = &proto.Event_ScopedRoleAssignment{
+			ScopedRoleAssignment: r.UnwrapT(),
+		}
 	case types.Resource153UnwrapperT[*identitycenterv1.Account]:
 		out.Resource = &proto.Event_IdentityCenterAccount{
 			IdentityCenterAccount: r.UnwrapT(),
@@ -147,10 +162,18 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
 		out.Resource = &proto.Event_WorkloadIdentityX509Revocation{
 			WorkloadIdentityX509Revocation: r.UnwrapT(),
 		}
+	case types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]:
+		out.Resource = &proto.Event_RecordingEncryption{
+			RecordingEncryption: r.UnwrapT(),
+		}
 	case types.Resource153UnwrapperT[*healthcheckconfigv1.HealthCheckConfig]:
 		out.Resource = &proto.Event_HealthCheckConfig{
 			HealthCheckConfig: r.UnwrapT(),
 		}
+	case types.Resource153UnwrapperT[*presencev1.RelayServer]:
+		out.Resource = &proto.Event_RelayServer{
+			RelayServer: r.UnwrapT(),
+		}
 	case *types.ResourceHeader:
 		out.Resource = &proto.Event_ResourceHeader{
 			ResourceHeader: r,
@@ -356,6 +379,11 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
 		out.Resource = &proto.Event_PluginStaticCredentials{
 			PluginStaticCredentials: r,
 		}
+	case *types.PluginV1:
+		out.Resource = &proto.Event_Plugin{
+			Plugin: r,
+		}
+
 	default:
 		return nil, trace.BadParameter("resource type %T is not supported", in.Resource)
 	}
@@ -610,6 +638,15 @@ func EventFromGRPC(in *proto.Event) (*types.Event, error) {
 	} else if r := in.GetAutoUpdateAgentReport(); r != nil {
 		out.Resource = types.Resource153ToLegacy(r)
 		return &out, nil
+	} else if r := in.GetAutoUpdateBotInstanceReport(); r != nil {
+		out.Resource = types.Resource153ToLegacy(r)
+		return &out, nil
+	} else if r := in.GetScopedRole(); r != nil {
+		out.Resource = types.Resource153ToLegacy(r)
+		return &out, nil
+	} else if r := in.GetScopedRoleAssignment(); r != nil {
+		out.Resource = types.Resource153ToLegacy(r)
+		return &out, nil
 	} else if r := in.GetUserTask(); r != nil {
 		out.Resource = types.Resource153ToLegacy(r)
 		return &out, nil
@@ -637,6 +674,15 @@ func EventFromGRPC(in *proto.Event) (*types.Event, error) {
 	} else if r := in.GetHealthCheckConfig(); r != nil {
 		out.Resource = types.Resource153ToLegacy(r)
 		return &out, nil
+	} else if r := in.GetRelayServer(); r != nil {
+		out.Resource = types.ProtoResource153ToLegacy(r)
+		return &out, nil
+	} else if r := in.GetPlugin(); r != nil {
+		out.Resource = r
+		return &out, nil
+	} else if r := in.GetRecordingEncryption(); r != nil {
+		out.Resource = types.ProtoResource153ToLegacy(r)
+		return &out, nil
 	} else {
 		return nil, trace.BadParameter("received unsupported resource %T", in.Resource)
 	}
diff --git a/api/client/inventory.go b/api/client/inventory.go
index 1232a50c36df8..88bad22c1fdcf 100644
--- a/api/client/inventory.go
+++ b/api/client/inventory.go
@@ -343,6 +343,10 @@ func (i *downstreamICS) runSendLoop(stream proto.AuthService_InventoryControlStr
 				oneOf.Msg = &proto.UpstreamInventoryOneOf_Goodbye{
 					Goodbye: msg,
 				}
+			case *proto.UpstreamInventoryStopHeartbeat:
+				oneOf.Msg = &proto.UpstreamInventoryOneOf_StopHeartbeat{
+					StopHeartbeat: msg,
+				}
 			default:
 				sendMsg.errC <- trace.BadParameter("cannot send unexpected upstream msg type: %T", msg)
 				continue
@@ -484,6 +488,8 @@ func (i *upstreamICS) runRecvLoop(stream proto.AuthService_InventoryControlStrea
 			msg = oneOf.GetAgentMetadata()
 		case oneOf.GetGoodbye() != nil:
 			msg = oneOf.GetGoodbye()
+		case oneOf.GetStopHeartbeat() != nil:
+			msg = oneOf.GetStopHeartbeat()
 		default:
 			slog.WarnContext(stream.Context(), "received unknown upstream message", "message", oneOf)
 			continue
diff --git a/api/client/mock_server_test.go b/api/client/mock_server_test.go
index e4113a22ffe48..1aaa55a95f49a 100644
--- a/api/client/mock_server_test.go
+++ b/api/client/mock_server_test.go
@@ -26,6 +26,7 @@ import (
 	"google.golang.org/grpc/credentials"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
 	"github.com/gravitational/teleport/api/testhelpers/mtls"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 )
@@ -37,7 +38,12 @@ type mockServer struct {
 	mtlsConfig *mtls.Config
 }
 
-func newMockServer(t *testing.T, addr string, service proto.AuthServiceServer) *mockServer {
+type mockServices struct {
+	auth                proto.AuthServiceServer
+	recordingEncryption recordingencryptionv1.RecordingEncryptionServiceServer
+}
+
+func newMockServer(t *testing.T, addr string, services mockServices) *mockServer {
 	t.Helper()
 	m := &mockServer{
 		addr:       addr,
@@ -50,15 +56,21 @@ func newMockServer(t *testing.T, addr string, service proto.AuthServiceServer) *
 		grpc.StreamInterceptor(interceptors.GRPCServerStreamErrorInterceptor),
 	)
 
-	proto.RegisterAuthServiceServer(m.grpc, service)
+	if services.auth != nil {
+		proto.RegisterAuthServiceServer(m.grpc, services.auth)
+	}
+
+	if services.recordingEncryption != nil {
+		recordingencryptionv1.RegisterRecordingEncryptionServiceServer(m.grpc, services.recordingEncryption)
+	}
 	return m
 }
 
 // startMockServer starts a new mock server. Parallel tests cannot use the same addr.
-func startMockServer(t *testing.T, service proto.AuthServiceServer) *mockServer {
+func startMockServer(t *testing.T, services mockServices) *mockServer {
 	l, err := net.Listen("tcp", "localhost:")
 	require.NoError(t, err)
-	srv := newMockServer(t, l.Addr().String(), service)
+	srv := newMockServer(t, l.Addr().String(), services)
 	srv.serve(t, l)
 	return srv
 }
diff --git a/api/client/proto/authservice.pb.go b/api/client/proto/authservice.pb.go
index b61231948dc15..249aa365ffd9b 100644
--- a/api/client/proto/authservice.pb.go
+++ b/api/client/proto/authservice.pb.go
@@ -335,6 +335,10 @@ const (
 	// tunnel. Requests from this requester allows reuse of the MFA session
 	// response but TTL is limited to single use TTL.
 	UserCertsRequest_TSH_DB_EXEC UserCertsRequest_Requester = 5
+	// TSH_APP_AWS_CREDENTIALPROCESS is set when tsh provides access to an AWS App which uses client side credentials.
+	// When using per-session MFA, this ensures the TTL of the certificate (and thus the AWS session) is the same as the Teleport identity session.
+	// AWS credentials should not be written to disk when this requester is used, but may be exported as env variables through stdout.
+	UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS UserCertsRequest_Requester = 6
 )
 
 var UserCertsRequest_Requester_name = map[int32]string{
@@ -344,6 +348,7 @@ var UserCertsRequest_Requester_name = map[int32]string{
 	3: "TSH_KUBE_LOCAL_PROXY_HEADLESS",
 	4: "TSH_APP_LOCAL_PROXY",
 	5: "TSH_DB_EXEC",
+	6: "TSH_APP_AWS_CREDENTIALPROCESS",
 }
 
 var UserCertsRequest_Requester_value = map[string]int32{
@@ -353,6 +358,7 @@ var UserCertsRequest_Requester_value = map[string]int32{
 	"TSH_KUBE_LOCAL_PROXY_HEADLESS": 3,
 	"TSH_APP_LOCAL_PROXY":           4,
 	"TSH_DB_EXEC":                   5,
+	"TSH_APP_AWS_CREDENTIALPROCESS": 6,
 }
 
 func (x UserCertsRequest_Requester) String() string {
@@ -423,7 +429,7 @@ func (x DatabaseCertRequest_Requester) String() string {
 }
 
 func (DatabaseCertRequest_Requester) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{76, 0}
+	return fileDescriptor_0ffcffcda38ae159, []int{82, 0}
 }
 
 // Extensions are the extensions to add to the certificate.
@@ -451,7 +457,7 @@ func (x DatabaseCertRequest_Extensions) String() string {
 }
 
 func (DatabaseCertRequest_Extensions) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{76, 1}
+	return fileDescriptor_0ffcffcda38ae159, []int{82, 1}
 }
 
 // Watch specifies watch parameters
@@ -1560,6 +1566,131 @@ func (m *ChangePasswordRequest) GetWebauthn() *webauthn.CredentialAssertionRespo
 	return nil
 }
 
+type ListSemaphoresRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// filter encodes semaphore filtering params.
+	Filter               *types.SemaphoreFilter `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
+	XXX_unrecognized     []byte                 `json:"-"`
+	XXX_sizecache        int32                  `json:"-"`
+}
+
+func (m *ListSemaphoresRequest) Reset()         { *m = ListSemaphoresRequest{} }
+func (m *ListSemaphoresRequest) String() string { return proto.CompactTextString(m) }
+func (*ListSemaphoresRequest) ProtoMessage()    {}
+func (*ListSemaphoresRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{11}
+}
+func (m *ListSemaphoresRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSemaphoresRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSemaphoresRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSemaphoresRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSemaphoresRequest.Merge(m, src)
+}
+func (m *ListSemaphoresRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSemaphoresRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSemaphoresRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSemaphoresRequest proto.InternalMessageInfo
+
+func (m *ListSemaphoresRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListSemaphoresRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+func (m *ListSemaphoresRequest) GetFilter() *types.SemaphoreFilter {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+type ListSemaphoresResponse struct {
+	// a list of semaphores.
+	Semaphores []*types.SemaphoreV3 `protobuf:"bytes,1,rep,name=semaphores,proto3" json:"semaphores,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListSemaphoresResponse) Reset()         { *m = ListSemaphoresResponse{} }
+func (m *ListSemaphoresResponse) String() string { return proto.CompactTextString(m) }
+func (*ListSemaphoresResponse) ProtoMessage()    {}
+func (*ListSemaphoresResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{12}
+}
+func (m *ListSemaphoresResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSemaphoresResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSemaphoresResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSemaphoresResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSemaphoresResponse.Merge(m, src)
+}
+func (m *ListSemaphoresResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSemaphoresResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSemaphoresResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSemaphoresResponse proto.InternalMessageInfo
+
+func (m *ListSemaphoresResponse) GetSemaphores() []*types.SemaphoreV3 {
+	if m != nil {
+		return m.Semaphores
+	}
+	return nil
+}
+
+func (m *ListSemaphoresResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // PluginDataSeq is a sequence of plugin data.
 type PluginDataSeq struct {
 	PluginData           []*types.PluginDataV3 `protobuf:"bytes,1,rep,name=PluginData,proto3" json:"plugin_data"`
@@ -1572,7 +1703,7 @@ func (m *PluginDataSeq) Reset()         { *m = PluginDataSeq{} }
 func (m *PluginDataSeq) String() string { return proto.CompactTextString(m) }
 func (*PluginDataSeq) ProtoMessage()    {}
 func (*PluginDataSeq) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{11}
+	return fileDescriptor_0ffcffcda38ae159, []int{13}
 }
 func (m *PluginDataSeq) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1640,7 +1771,7 @@ func (m *RequestStateSetter) Reset()         { *m = RequestStateSetter{} }
 func (m *RequestStateSetter) String() string { return proto.CompactTextString(m) }
 func (*RequestStateSetter) ProtoMessage()    {}
 func (*RequestStateSetter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{12}
+	return fileDescriptor_0ffcffcda38ae159, []int{14}
 }
 func (m *RequestStateSetter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1723,7 +1854,7 @@ func (m *RequestID) Reset()         { *m = RequestID{} }
 func (m *RequestID) String() string { return proto.CompactTextString(m) }
 func (*RequestID) ProtoMessage()    {}
 func (*RequestID) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{13}
+	return fileDescriptor_0ffcffcda38ae159, []int{15}
 }
 func (m *RequestID) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1771,7 +1902,7 @@ func (m *GetResetPasswordTokenRequest) Reset()         { *m = GetResetPasswordTo
 func (m *GetResetPasswordTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*GetResetPasswordTokenRequest) ProtoMessage()    {}
 func (*GetResetPasswordTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{14}
+	return fileDescriptor_0ffcffcda38ae159, []int{16}
 }
 func (m *GetResetPasswordTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1824,7 +1955,7 @@ func (m *CreateResetPasswordTokenRequest) Reset()         { *m = CreateResetPass
 func (m *CreateResetPasswordTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateResetPasswordTokenRequest) ProtoMessage()    {}
 func (*CreateResetPasswordTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{15}
+	return fileDescriptor_0ffcffcda38ae159, []int{17}
 }
 func (m *CreateResetPasswordTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1874,6 +2005,124 @@ func (m *CreateResetPasswordTokenRequest) GetTTL() Duration {
 	return 0
 }
 
+// ListResetPasswordTokenRequest is a request for a page of user tokens.
+type ListResetPasswordTokenRequest struct {
+	// PageSize is the maximum amount of resources to retrieve.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// StartKey is used to start listing resources from a specific spot. It
+	// should be set to the previous NextKey value if using pagination, or
+	// left empty.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListResetPasswordTokenRequest) Reset()         { *m = ListResetPasswordTokenRequest{} }
+func (m *ListResetPasswordTokenRequest) String() string { return proto.CompactTextString(m) }
+func (*ListResetPasswordTokenRequest) ProtoMessage()    {}
+func (*ListResetPasswordTokenRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{18}
+}
+func (m *ListResetPasswordTokenRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListResetPasswordTokenRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListResetPasswordTokenRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListResetPasswordTokenRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListResetPasswordTokenRequest.Merge(m, src)
+}
+func (m *ListResetPasswordTokenRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListResetPasswordTokenRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListResetPasswordTokenRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListResetPasswordTokenRequest proto.InternalMessageInfo
+
+func (m *ListResetPasswordTokenRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListResetPasswordTokenRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+// ListResetPasswordTokenResponse contains a page of user tokens.
+type ListResetPasswordTokenResponse struct {
+	// UserTokens is a list of user tokens.
+	UserTokens []*types.UserTokenV3 `protobuf:"bytes,1,rep,name=user_tokens,json=userTokens,proto3" json:"user_tokens,omitempty"`
+	// NextKey is the key for the next page of user tokens.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListResetPasswordTokenResponse) Reset()         { *m = ListResetPasswordTokenResponse{} }
+func (m *ListResetPasswordTokenResponse) String() string { return proto.CompactTextString(m) }
+func (*ListResetPasswordTokenResponse) ProtoMessage()    {}
+func (*ListResetPasswordTokenResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{19}
+}
+func (m *ListResetPasswordTokenResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListResetPasswordTokenResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListResetPasswordTokenResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListResetPasswordTokenResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListResetPasswordTokenResponse.Merge(m, src)
+}
+func (m *ListResetPasswordTokenResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListResetPasswordTokenResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListResetPasswordTokenResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListResetPasswordTokenResponse proto.InternalMessageInfo
+
+func (m *ListResetPasswordTokenResponse) GetUserTokens() []*types.UserTokenV3 {
+	if m != nil {
+		return m.UserTokens
+	}
+	return nil
+}
+
+func (m *ListResetPasswordTokenResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // RenewableCertsRequest is a request to generate a first set of renewable
 // certificates from a bot join token.
 type RenewableCertsRequest struct {
@@ -1890,7 +2139,7 @@ func (m *RenewableCertsRequest) Reset()         { *m = RenewableCertsRequest{} }
 func (m *RenewableCertsRequest) String() string { return proto.CompactTextString(m) }
 func (*RenewableCertsRequest) ProtoMessage()    {}
 func (*RenewableCertsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{16}
+	return fileDescriptor_0ffcffcda38ae159, []int{20}
 }
 func (m *RenewableCertsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1944,7 +2193,7 @@ func (m *PingRequest) Reset()         { *m = PingRequest{} }
 func (m *PingRequest) String() string { return proto.CompactTextString(m) }
 func (*PingRequest) ProtoMessage()    {}
 func (*PingRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{17}
+	return fileDescriptor_0ffcffcda38ae159, []int{21}
 }
 func (m *PingRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2004,7 +2253,7 @@ func (m *PingResponse) Reset()         { *m = PingResponse{} }
 func (m *PingResponse) String() string { return proto.CompactTextString(m) }
 func (*PingResponse) ProtoMessage()    {}
 func (*PingResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{18}
+	return fileDescriptor_0ffcffcda38ae159, []int{22}
 }
 func (m *PingResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2191,7 +2440,9 @@ type Features struct {
 	// *Access* to the feature is gated on the `AccessMonitoring` entitlement.
 	AccessMonitoringConfigured bool `protobuf:"varint,36,opt,name=AccessMonitoringConfigured,proto3" json:"AccessMonitoringConfigured,omitempty"`
 	// AccessGraphDemoMode enables the ability to opt-in to a demo mode of Access Graph with limited features.
-	AccessGraphDemoMode  bool     `protobuf:"varint,38,opt,name=AccessGraphDemoMode,proto3" json:"access_graph_demo_mode,omitempty"`
+	AccessGraphDemoMode bool `protobuf:"varint,38,opt,name=AccessGraphDemoMode,proto3" json:"access_graph_demo_mode,omitempty"`
+	// ClientIPRestrictions allows Cloud users to setup a client IP allowlist
+	ClientIPRestrictions bool     `protobuf:"varint,39,opt,name=ClientIPRestrictions,proto3" json:"client_ip_restrictions,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -2201,7 +2452,7 @@ func (m *Features) Reset()         { *m = Features{} }
 func (m *Features) String() string { return proto.CompactTextString(m) }
 func (*Features) ProtoMessage()    {}
 func (*Features) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{19}
+	return fileDescriptor_0ffcffcda38ae159, []int{23}
 }
 func (m *Features) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2468,6 +2719,13 @@ func (m *Features) GetAccessGraphDemoMode() bool {
 	return false
 }
 
+func (m *Features) GetClientIPRestrictions() bool {
+	if m != nil {
+		return m.ClientIPRestrictions
+	}
+	return false
+}
+
 // EntitlementInfo is the state and limits of a particular entitlement
 type EntitlementInfo struct {
 	// enabled indicates the feature is 'on' if true
@@ -2483,7 +2741,7 @@ func (m *EntitlementInfo) Reset()         { *m = EntitlementInfo{} }
 func (m *EntitlementInfo) String() string { return proto.CompactTextString(m) }
 func (*EntitlementInfo) ProtoMessage()    {}
 func (*EntitlementInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{20}
+	return fileDescriptor_0ffcffcda38ae159, []int{24}
 }
 func (m *EntitlementInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2550,7 +2808,7 @@ func (m *DeviceTrustFeature) Reset()         { *m = DeviceTrustFeature{} }
 func (m *DeviceTrustFeature) String() string { return proto.CompactTextString(m) }
 func (*DeviceTrustFeature) ProtoMessage()    {}
 func (*DeviceTrustFeature) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{21}
+	return fileDescriptor_0ffcffcda38ae159, []int{25}
 }
 func (m *DeviceTrustFeature) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2609,7 +2867,7 @@ func (m *AccessRequestsFeature) Reset()         { *m = AccessRequestsFeature{} }
 func (m *AccessRequestsFeature) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestsFeature) ProtoMessage()    {}
 func (*AccessRequestsFeature) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{22}
+	return fileDescriptor_0ffcffcda38ae159, []int{26}
 }
 func (m *AccessRequestsFeature) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2660,7 +2918,7 @@ func (m *AccessListFeature) Reset()         { *m = AccessListFeature{} }
 func (m *AccessListFeature) String() string { return proto.CompactTextString(m) }
 func (*AccessListFeature) ProtoMessage()    {}
 func (*AccessListFeature) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{23}
+	return fileDescriptor_0ffcffcda38ae159, []int{27}
 }
 func (m *AccessListFeature) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2712,7 +2970,7 @@ func (m *AccessMonitoringFeature) Reset()         { *m = AccessMonitoringFeature
 func (m *AccessMonitoringFeature) String() string { return proto.CompactTextString(m) }
 func (*AccessMonitoringFeature) ProtoMessage()    {}
 func (*AccessMonitoringFeature) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{24}
+	return fileDescriptor_0ffcffcda38ae159, []int{28}
 }
 func (m *AccessMonitoringFeature) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2768,7 +3026,7 @@ func (m *PolicyFeature) Reset()         { *m = PolicyFeature{} }
 func (m *PolicyFeature) String() string { return proto.CompactTextString(m) }
 func (*PolicyFeature) ProtoMessage()    {}
 func (*PolicyFeature) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{25}
+	return fileDescriptor_0ffcffcda38ae159, []int{29}
 }
 func (m *PolicyFeature) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2817,7 +3075,7 @@ func (m *DeleteUserRequest) Reset()         { *m = DeleteUserRequest{} }
 func (m *DeleteUserRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteUserRequest) ProtoMessage()    {}
 func (*DeleteUserRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{26}
+	return fileDescriptor_0ffcffcda38ae159, []int{30}
 }
 func (m *DeleteUserRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2865,7 +3123,7 @@ func (m *Semaphores) Reset()         { *m = Semaphores{} }
 func (m *Semaphores) String() string { return proto.CompactTextString(m) }
 func (*Semaphores) ProtoMessage()    {}
 func (*Semaphores) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{27}
+	return fileDescriptor_0ffcffcda38ae159, []int{31}
 }
 func (m *Semaphores) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2922,7 +3180,7 @@ func (m *AuditStreamRequest) Reset()         { *m = AuditStreamRequest{} }
 func (m *AuditStreamRequest) String() string { return proto.CompactTextString(m) }
 func (*AuditStreamRequest) ProtoMessage()    {}
 func (*AuditStreamRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{28}
+	return fileDescriptor_0ffcffcda38ae159, []int{32}
 }
 func (m *AuditStreamRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3047,7 +3305,7 @@ func (m *AuditStreamStatus) Reset()         { *m = AuditStreamStatus{} }
 func (m *AuditStreamStatus) String() string { return proto.CompactTextString(m) }
 func (*AuditStreamStatus) ProtoMessage()    {}
 func (*AuditStreamStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{29}
+	return fileDescriptor_0ffcffcda38ae159, []int{33}
 }
 func (m *AuditStreamStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3095,7 +3353,7 @@ func (m *CreateStream) Reset()         { *m = CreateStream{} }
 func (m *CreateStream) String() string { return proto.CompactTextString(m) }
 func (*CreateStream) ProtoMessage()    {}
 func (*CreateStream) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{30}
+	return fileDescriptor_0ffcffcda38ae159, []int{34}
 }
 func (m *CreateStream) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3146,7 +3404,7 @@ func (m *ResumeStream) Reset()         { *m = ResumeStream{} }
 func (m *ResumeStream) String() string { return proto.CompactTextString(m) }
 func (*ResumeStream) ProtoMessage()    {}
 func (*ResumeStream) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{31}
+	return fileDescriptor_0ffcffcda38ae159, []int{35}
 }
 func (m *ResumeStream) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3201,7 +3459,7 @@ func (m *CompleteStream) Reset()         { *m = CompleteStream{} }
 func (m *CompleteStream) String() string { return proto.CompactTextString(m) }
 func (*CompleteStream) ProtoMessage()    {}
 func (*CompleteStream) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{32}
+	return fileDescriptor_0ffcffcda38ae159, []int{36}
 }
 func (m *CompleteStream) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3241,7 +3499,7 @@ func (m *FlushAndCloseStream) Reset()         { *m = FlushAndCloseStream{} }
 func (m *FlushAndCloseStream) String() string { return proto.CompactTextString(m) }
 func (*FlushAndCloseStream) ProtoMessage()    {}
 func (*FlushAndCloseStream) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{33}
+	return fileDescriptor_0ffcffcda38ae159, []int{37}
 }
 func (m *FlushAndCloseStream) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3283,7 +3541,7 @@ func (m *UpsertApplicationServerRequest) Reset()         { *m = UpsertApplicatio
 func (m *UpsertApplicationServerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertApplicationServerRequest) ProtoMessage()    {}
 func (*UpsertApplicationServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{34}
+	return fileDescriptor_0ffcffcda38ae159, []int{38}
 }
 func (m *UpsertApplicationServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3336,7 +3594,7 @@ func (m *DeleteApplicationServerRequest) Reset()         { *m = DeleteApplicatio
 func (m *DeleteApplicationServerRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteApplicationServerRequest) ProtoMessage()    {}
 func (*DeleteApplicationServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{35}
+	return fileDescriptor_0ffcffcda38ae159, []int{39}
 }
 func (m *DeleteApplicationServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3399,7 +3657,7 @@ func (m *DeleteAllApplicationServersRequest) Reset()         { *m = DeleteAllApp
 func (m *DeleteAllApplicationServersRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteAllApplicationServersRequest) ProtoMessage()    {}
 func (*DeleteAllApplicationServersRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{36}
+	return fileDescriptor_0ffcffcda38ae159, []int{40}
 }
 func (m *DeleteAllApplicationServersRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3457,7 +3715,7 @@ func (m *GenerateAppTokenRequest) Reset()         { *m = GenerateAppTokenRequest
 func (m *GenerateAppTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*GenerateAppTokenRequest) ProtoMessage()    {}
 func (*GenerateAppTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{37}
+	return fileDescriptor_0ffcffcda38ae159, []int{41}
 }
 func (m *GenerateAppTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3533,7 +3791,7 @@ func (m *GenerateAppTokenResponse) Reset()         { *m = GenerateAppTokenRespon
 func (m *GenerateAppTokenResponse) String() string { return proto.CompactTextString(m) }
 func (*GenerateAppTokenResponse) ProtoMessage()    {}
 func (*GenerateAppTokenResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{38}
+	return fileDescriptor_0ffcffcda38ae159, []int{42}
 }
 func (m *GenerateAppTokenResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3582,7 +3840,7 @@ func (m *GetAppSessionRequest) Reset()         { *m = GetAppSessionRequest{} }
 func (m *GetAppSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*GetAppSessionRequest) ProtoMessage()    {}
 func (*GetAppSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{39}
+	return fileDescriptor_0ffcffcda38ae159, []int{43}
 }
 func (m *GetAppSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3631,7 +3889,7 @@ func (m *GetAppSessionResponse) Reset()         { *m = GetAppSessionResponse{} }
 func (m *GetAppSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*GetAppSessionResponse) ProtoMessage()    {}
 func (*GetAppSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{40}
+	return fileDescriptor_0ffcffcda38ae159, []int{44}
 }
 func (m *GetAppSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3689,7 +3947,7 @@ func (m *ListAppSessionsRequest) Reset()         { *m = ListAppSessionsRequest{}
 func (m *ListAppSessionsRequest) String() string { return proto.CompactTextString(m) }
 func (*ListAppSessionsRequest) ProtoMessage()    {}
 func (*ListAppSessionsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{41}
+	return fileDescriptor_0ffcffcda38ae159, []int{45}
 }
 func (m *ListAppSessionsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3755,7 +4013,7 @@ func (m *ListAppSessionsResponse) Reset()         { *m = ListAppSessionsResponse
 func (m *ListAppSessionsResponse) String() string { return proto.CompactTextString(m) }
 func (*ListAppSessionsResponse) ProtoMessage()    {}
 func (*ListAppSessionsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{42}
+	return fileDescriptor_0ffcffcda38ae159, []int{46}
 }
 func (m *ListAppSessionsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3811,7 +4069,7 @@ func (m *GetSnowflakeSessionsResponse) Reset()         { *m = GetSnowflakeSessio
 func (m *GetSnowflakeSessionsResponse) String() string { return proto.CompactTextString(m) }
 func (*GetSnowflakeSessionsResponse) ProtoMessage()    {}
 func (*GetSnowflakeSessionsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{43}
+	return fileDescriptor_0ffcffcda38ae159, []int{47}
 }
 func (m *GetSnowflakeSessionsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3869,7 +4127,7 @@ func (m *ListSAMLIdPSessionsRequest) Reset()         { *m = ListSAMLIdPSessionsR
 func (m *ListSAMLIdPSessionsRequest) String() string { return proto.CompactTextString(m) }
 func (*ListSAMLIdPSessionsRequest) ProtoMessage()    {}
 func (*ListSAMLIdPSessionsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{44}
+	return fileDescriptor_0ffcffcda38ae159, []int{48}
 }
 func (m *ListSAMLIdPSessionsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3935,7 +4193,7 @@ func (m *ListSAMLIdPSessionsResponse) Reset()         { *m = ListSAMLIdPSessions
 func (m *ListSAMLIdPSessionsResponse) String() string { return proto.CompactTextString(m) }
 func (*ListSAMLIdPSessionsResponse) ProtoMessage()    {}
 func (*ListSAMLIdPSessionsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{45}
+	return fileDescriptor_0ffcffcda38ae159, []int{49}
 }
 func (m *ListSAMLIdPSessionsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4011,7 +4269,7 @@ func (m *CreateAppSessionRequest) Reset()         { *m = CreateAppSessionRequest
 func (m *CreateAppSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateAppSessionRequest) ProtoMessage()    {}
 func (*CreateAppSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{46}
+	return fileDescriptor_0ffcffcda38ae159, []int{50}
 }
 func (m *CreateAppSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4123,7 +4381,7 @@ func (m *CreateAppSessionResponse) Reset()         { *m = CreateAppSessionRespon
 func (m *CreateAppSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*CreateAppSessionResponse) ProtoMessage()    {}
 func (*CreateAppSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{47}
+	return fileDescriptor_0ffcffcda38ae159, []int{51}
 }
 func (m *CreateAppSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4176,7 +4434,7 @@ func (m *CreateSnowflakeSessionRequest) Reset()         { *m = CreateSnowflakeSe
 func (m *CreateSnowflakeSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSnowflakeSessionRequest) ProtoMessage()    {}
 func (*CreateSnowflakeSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{48}
+	return fileDescriptor_0ffcffcda38ae159, []int{52}
 }
 func (m *CreateSnowflakeSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4238,7 +4496,7 @@ func (m *CreateSnowflakeSessionResponse) Reset()         { *m = CreateSnowflakeS
 func (m *CreateSnowflakeSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*CreateSnowflakeSessionResponse) ProtoMessage()    {}
 func (*CreateSnowflakeSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{49}
+	return fileDescriptor_0ffcffcda38ae159, []int{53}
 }
 func (m *CreateSnowflakeSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4291,7 +4549,7 @@ func (m *CreateSAMLIdPSessionRequest) Reset()         { *m = CreateSAMLIdPSessio
 func (m *CreateSAMLIdPSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSAMLIdPSessionRequest) ProtoMessage()    {}
 func (*CreateSAMLIdPSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{50}
+	return fileDescriptor_0ffcffcda38ae159, []int{54}
 }
 func (m *CreateSAMLIdPSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4353,7 +4611,7 @@ func (m *CreateSAMLIdPSessionResponse) Reset()         { *m = CreateSAMLIdPSessi
 func (m *CreateSAMLIdPSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*CreateSAMLIdPSessionResponse) ProtoMessage()    {}
 func (*CreateSAMLIdPSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{51}
+	return fileDescriptor_0ffcffcda38ae159, []int{55}
 }
 func (m *CreateSAMLIdPSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4402,7 +4660,7 @@ func (m *GetSnowflakeSessionRequest) Reset()         { *m = GetSnowflakeSessionR
 func (m *GetSnowflakeSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSnowflakeSessionRequest) ProtoMessage()    {}
 func (*GetSnowflakeSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{52}
+	return fileDescriptor_0ffcffcda38ae159, []int{56}
 }
 func (m *GetSnowflakeSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4451,7 +4709,7 @@ func (m *GetSnowflakeSessionResponse) Reset()         { *m = GetSnowflakeSession
 func (m *GetSnowflakeSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*GetSnowflakeSessionResponse) ProtoMessage()    {}
 func (*GetSnowflakeSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{53}
+	return fileDescriptor_0ffcffcda38ae159, []int{57}
 }
 func (m *GetSnowflakeSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4500,7 +4758,7 @@ func (m *GetSAMLIdPSessionRequest) Reset()         { *m = GetSAMLIdPSessionReque
 func (m *GetSAMLIdPSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSAMLIdPSessionRequest) ProtoMessage()    {}
 func (*GetSAMLIdPSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{54}
+	return fileDescriptor_0ffcffcda38ae159, []int{58}
 }
 func (m *GetSAMLIdPSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4549,7 +4807,7 @@ func (m *GetSAMLIdPSessionResponse) Reset()         { *m = GetSAMLIdPSessionResp
 func (m *GetSAMLIdPSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*GetSAMLIdPSessionResponse) ProtoMessage()    {}
 func (*GetSAMLIdPSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{55}
+	return fileDescriptor_0ffcffcda38ae159, []int{59}
 }
 func (m *GetSAMLIdPSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4597,7 +4855,7 @@ func (m *DeleteAppSessionRequest) Reset()         { *m = DeleteAppSessionRequest
 func (m *DeleteAppSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteAppSessionRequest) ProtoMessage()    {}
 func (*DeleteAppSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{56}
+	return fileDescriptor_0ffcffcda38ae159, []int{60}
 }
 func (m *DeleteAppSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4645,7 +4903,7 @@ func (m *DeleteSnowflakeSessionRequest) Reset()         { *m = DeleteSnowflakeSe
 func (m *DeleteSnowflakeSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteSnowflakeSessionRequest) ProtoMessage()    {}
 func (*DeleteSnowflakeSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{57}
+	return fileDescriptor_0ffcffcda38ae159, []int{61}
 }
 func (m *DeleteSnowflakeSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4693,7 +4951,7 @@ func (m *DeleteSAMLIdPSessionRequest) Reset()         { *m = DeleteSAMLIdPSessio
 func (m *DeleteSAMLIdPSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteSAMLIdPSessionRequest) ProtoMessage()    {}
 func (*DeleteSAMLIdPSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{58}
+	return fileDescriptor_0ffcffcda38ae159, []int{62}
 }
 func (m *DeleteSAMLIdPSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4742,7 +5000,7 @@ func (m *DeleteUserAppSessionsRequest) Reset()         { *m = DeleteUserAppSessi
 func (m *DeleteUserAppSessionsRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteUserAppSessionsRequest) ProtoMessage()    {}
 func (*DeleteUserAppSessionsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{59}
+	return fileDescriptor_0ffcffcda38ae159, []int{63}
 }
 func (m *DeleteUserAppSessionsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4791,7 +5049,7 @@ func (m *DeleteUserSAMLIdPSessionsRequest) Reset()         { *m = DeleteUserSAML
 func (m *DeleteUserSAMLIdPSessionsRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteUserSAMLIdPSessionsRequest) ProtoMessage()    {}
 func (*DeleteUserSAMLIdPSessionsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{60}
+	return fileDescriptor_0ffcffcda38ae159, []int{64}
 }
 func (m *DeleteUserSAMLIdPSessionsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4840,7 +5098,7 @@ func (m *GetWebSessionResponse) Reset()         { *m = GetWebSessionResponse{} }
 func (m *GetWebSessionResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWebSessionResponse) ProtoMessage()    {}
 func (*GetWebSessionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{61}
+	return fileDescriptor_0ffcffcda38ae159, []int{65}
 }
 func (m *GetWebSessionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4889,7 +5147,7 @@ func (m *GetWebSessionsResponse) Reset()         { *m = GetWebSessionsResponse{}
 func (m *GetWebSessionsResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWebSessionsResponse) ProtoMessage()    {}
 func (*GetWebSessionsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{62}
+	return fileDescriptor_0ffcffcda38ae159, []int{66}
 }
 func (m *GetWebSessionsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4938,7 +5196,7 @@ func (m *GetWebTokenResponse) Reset()         { *m = GetWebTokenResponse{} }
 func (m *GetWebTokenResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWebTokenResponse) ProtoMessage()    {}
 func (*GetWebTokenResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{63}
+	return fileDescriptor_0ffcffcda38ae159, []int{67}
 }
 func (m *GetWebTokenResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4987,7 +5245,7 @@ func (m *GetWebTokensResponse) Reset()         { *m = GetWebTokensResponse{} }
 func (m *GetWebTokensResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWebTokensResponse) ProtoMessage()    {}
 func (*GetWebTokensResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{64}
+	return fileDescriptor_0ffcffcda38ae159, []int{68}
 }
 func (m *GetWebTokensResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5023,6 +5281,124 @@ func (m *GetWebTokensResponse) GetTokens() []*types.WebTokenV3 {
 	return nil
 }
 
+// ListWebTokensRequest contains all the requested web tokens.
+type ListWebTokensRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListWebTokensRequest) Reset()         { *m = ListWebTokensRequest{} }
+func (m *ListWebTokensRequest) String() string { return proto.CompactTextString(m) }
+func (*ListWebTokensRequest) ProtoMessage()    {}
+func (*ListWebTokensRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{69}
+}
+func (m *ListWebTokensRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListWebTokensRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListWebTokensRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListWebTokensRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListWebTokensRequest.Merge(m, src)
+}
+func (m *ListWebTokensRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListWebTokensRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListWebTokensRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListWebTokensRequest proto.InternalMessageInfo
+
+func (m *ListWebTokensRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListWebTokensRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+// ListWebTokensResponse contains all the requested web tokens.
+type ListWebTokensResponse struct {
+	// Tokens is a list of web tokens.
+	Tokens []*types.WebTokenV3 `protobuf:"bytes,1,rep,name=tokens,proto3" json:"tokens,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListWebTokensResponse) Reset()         { *m = ListWebTokensResponse{} }
+func (m *ListWebTokensResponse) String() string { return proto.CompactTextString(m) }
+func (*ListWebTokensResponse) ProtoMessage()    {}
+func (*ListWebTokensResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{70}
+}
+func (m *ListWebTokensResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListWebTokensResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListWebTokensResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListWebTokensResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListWebTokensResponse.Merge(m, src)
+}
+func (m *ListWebTokensResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListWebTokensResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListWebTokensResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListWebTokensResponse proto.InternalMessageInfo
+
+func (m *ListWebTokensResponse) GetTokens() []*types.WebTokenV3 {
+	if m != nil {
+		return m.Tokens
+	}
+	return nil
+}
+
+func (m *ListWebTokensResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // UpsertKubernetesServerRequest are the parameters used to add or update a
 // kubernetes server.
 type UpsertKubernetesServerRequest struct {
@@ -5036,7 +5412,7 @@ func (m *UpsertKubernetesServerRequest) Reset()         { *m = UpsertKubernetesS
 func (m *UpsertKubernetesServerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertKubernetesServerRequest) ProtoMessage()    {}
 func (*UpsertKubernetesServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{65}
+	return fileDescriptor_0ffcffcda38ae159, []int{71}
 }
 func (m *UpsertKubernetesServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5087,7 +5463,7 @@ func (m *DeleteKubernetesServerRequest) Reset()         { *m = DeleteKubernetesS
 func (m *DeleteKubernetesServerRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteKubernetesServerRequest) ProtoMessage()    {}
 func (*DeleteKubernetesServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{66}
+	return fileDescriptor_0ffcffcda38ae159, []int{72}
 }
 func (m *DeleteKubernetesServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5141,7 +5517,7 @@ func (m *DeleteAllKubernetesServersRequest) Reset()         { *m = DeleteAllKube
 func (m *DeleteAllKubernetesServersRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteAllKubernetesServersRequest) ProtoMessage()    {}
 func (*DeleteAllKubernetesServersRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{67}
+	return fileDescriptor_0ffcffcda38ae159, []int{73}
 }
 func (m *DeleteAllKubernetesServersRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5183,7 +5559,7 @@ func (m *UpsertDatabaseServerRequest) Reset()         { *m = UpsertDatabaseServe
 func (m *UpsertDatabaseServerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertDatabaseServerRequest) ProtoMessage()    {}
 func (*UpsertDatabaseServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{68}
+	return fileDescriptor_0ffcffcda38ae159, []int{74}
 }
 func (m *UpsertDatabaseServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5236,7 +5612,7 @@ func (m *DeleteDatabaseServerRequest) Reset()         { *m = DeleteDatabaseServe
 func (m *DeleteDatabaseServerRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteDatabaseServerRequest) ProtoMessage()    {}
 func (*DeleteDatabaseServerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{69}
+	return fileDescriptor_0ffcffcda38ae159, []int{75}
 }
 func (m *DeleteDatabaseServerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5299,7 +5675,7 @@ func (m *DeleteAllDatabaseServersRequest) Reset()         { *m = DeleteAllDataba
 func (m *DeleteAllDatabaseServersRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteAllDatabaseServersRequest) ProtoMessage()    {}
 func (*DeleteAllDatabaseServersRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{70}
+	return fileDescriptor_0ffcffcda38ae159, []int{76}
 }
 func (m *DeleteAllDatabaseServersRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5348,7 +5724,7 @@ func (m *DatabaseServiceV1List) Reset()         { *m = DatabaseServiceV1List{} }
 func (m *DatabaseServiceV1List) String() string { return proto.CompactTextString(m) }
 func (*DatabaseServiceV1List) ProtoMessage()    {}
 func (*DatabaseServiceV1List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{71}
+	return fileDescriptor_0ffcffcda38ae159, []int{77}
 }
 func (m *DatabaseServiceV1List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5397,7 +5773,7 @@ func (m *UpsertDatabaseServiceRequest) Reset()         { *m = UpsertDatabaseServ
 func (m *UpsertDatabaseServiceRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertDatabaseServiceRequest) ProtoMessage()    {}
 func (*UpsertDatabaseServiceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{72}
+	return fileDescriptor_0ffcffcda38ae159, []int{78}
 }
 func (m *UpsertDatabaseServiceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5444,7 +5820,7 @@ func (m *DeleteAllDatabaseServicesRequest) Reset()         { *m = DeleteAllDatab
 func (m *DeleteAllDatabaseServicesRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteAllDatabaseServicesRequest) ProtoMessage()    {}
 func (*DeleteAllDatabaseServicesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{73}
+	return fileDescriptor_0ffcffcda38ae159, []int{79}
 }
 func (m *DeleteAllDatabaseServicesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5489,7 +5865,7 @@ func (m *DatabaseCSRRequest) Reset()         { *m = DatabaseCSRRequest{} }
 func (m *DatabaseCSRRequest) String() string { return proto.CompactTextString(m) }
 func (*DatabaseCSRRequest) ProtoMessage()    {}
 func (*DatabaseCSRRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{74}
+	return fileDescriptor_0ffcffcda38ae159, []int{80}
 }
 func (m *DatabaseCSRRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5547,7 +5923,7 @@ func (m *DatabaseCSRResponse) Reset()         { *m = DatabaseCSRResponse{} }
 func (m *DatabaseCSRResponse) String() string { return proto.CompactTextString(m) }
 func (*DatabaseCSRResponse) ProtoMessage()    {}
 func (*DatabaseCSRResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{75}
+	return fileDescriptor_0ffcffcda38ae159, []int{81}
 }
 func (m *DatabaseCSRResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5607,7 +5983,10 @@ type DatabaseCertRequest struct {
 	// CertificateExtensions identifies which extensions, if any, should be added to the certificate.
 	CertificateExtensions DatabaseCertRequest_Extensions `protobuf:"varint,6,opt,name=CertificateExtensions,proto3,enum=proto.DatabaseCertRequest_Extensions" json:"certificate_extensions"`
 	// CRLEndpoint is a certificate revocation list distribution point. Required for Windows smartcard certs.
-	CRLEndpoint          string   `protobuf:"bytes,7,opt,name=CRLEndpoint,proto3" json:"crl_endpoint"`
+	// DEPRECATED: use CRLDomain instead.
+	CRLEndpoint string `protobuf:"bytes,7,opt,name=CRLEndpoint,proto3" json:"crl_endpoint"` // Deprecated: Do not use.
+	// CRLDomain is the Active Directory domain where CRLs are published.
+	CRLDomain            string   `protobuf:"bytes,8,opt,name=CRLDomain,proto3" json:"crl_domain"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -5617,7 +5996,7 @@ func (m *DatabaseCertRequest) Reset()         { *m = DatabaseCertRequest{} }
 func (m *DatabaseCertRequest) String() string { return proto.CompactTextString(m) }
 func (*DatabaseCertRequest) ProtoMessage()    {}
 func (*DatabaseCertRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{76}
+	return fileDescriptor_0ffcffcda38ae159, []int{82}
 }
 func (m *DatabaseCertRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5689,6 +6068,7 @@ func (m *DatabaseCertRequest) GetCertificateExtensions() DatabaseCertRequest_Ext
 	return DatabaseCertRequest_NORMAL
 }
 
+// Deprecated: Do not use.
 func (m *DatabaseCertRequest) GetCRLEndpoint() string {
 	if m != nil {
 		return m.CRLEndpoint
@@ -5696,6 +6076,13 @@ func (m *DatabaseCertRequest) GetCRLEndpoint() string {
 	return ""
 }
 
+func (m *DatabaseCertRequest) GetCRLDomain() string {
+	if m != nil {
+		return m.CRLDomain
+	}
+	return ""
+}
+
 // DatabaseCertResponse contains the signed certificate.
 type DatabaseCertResponse struct {
 	// Cert is the signed certificate.
@@ -5711,7 +6098,7 @@ func (m *DatabaseCertResponse) Reset()         { *m = DatabaseCertResponse{} }
 func (m *DatabaseCertResponse) String() string { return proto.CompactTextString(m) }
 func (*DatabaseCertResponse) ProtoMessage()    {}
 func (*DatabaseCertResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{77}
+	return fileDescriptor_0ffcffcda38ae159, []int{83}
 }
 func (m *DatabaseCertResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5767,7 +6154,7 @@ func (m *SnowflakeJWTRequest) Reset()         { *m = SnowflakeJWTRequest{} }
 func (m *SnowflakeJWTRequest) String() string { return proto.CompactTextString(m) }
 func (*SnowflakeJWTRequest) ProtoMessage()    {}
 func (*SnowflakeJWTRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{78}
+	return fileDescriptor_0ffcffcda38ae159, []int{84}
 }
 func (m *SnowflakeJWTRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5822,7 +6209,7 @@ func (m *SnowflakeJWTResponse) Reset()         { *m = SnowflakeJWTResponse{} }
 func (m *SnowflakeJWTResponse) String() string { return proto.CompactTextString(m) }
 func (*SnowflakeJWTResponse) ProtoMessage()    {}
 func (*SnowflakeJWTResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{79}
+	return fileDescriptor_0ffcffcda38ae159, []int{85}
 }
 func (m *SnowflakeJWTResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5871,7 +6258,7 @@ func (m *GetRoleRequest) Reset()         { *m = GetRoleRequest{} }
 func (m *GetRoleRequest) String() string { return proto.CompactTextString(m) }
 func (*GetRoleRequest) ProtoMessage()    {}
 func (*GetRoleRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{80}
+	return fileDescriptor_0ffcffcda38ae159, []int{86}
 }
 func (m *GetRoleRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5920,7 +6307,7 @@ func (m *GetRolesResponse) Reset()         { *m = GetRolesResponse{} }
 func (m *GetRolesResponse) String() string { return proto.CompactTextString(m) }
 func (*GetRolesResponse) ProtoMessage()    {}
 func (*GetRolesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{81}
+	return fileDescriptor_0ffcffcda38ae159, []int{87}
 }
 func (m *GetRolesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5975,7 +6362,7 @@ func (m *ListRolesRequest) Reset()         { *m = ListRolesRequest{} }
 func (m *ListRolesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListRolesRequest) ProtoMessage()    {}
 func (*ListRolesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{82}
+	return fileDescriptor_0ffcffcda38ae159, []int{88}
 }
 func (m *ListRolesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6040,7 +6427,7 @@ func (m *ListRolesResponse) Reset()         { *m = ListRolesResponse{} }
 func (m *ListRolesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListRolesResponse) ProtoMessage()    {}
 func (*ListRolesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{83}
+	return fileDescriptor_0ffcffcda38ae159, []int{89}
 }
 func (m *ListRolesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6096,7 +6483,7 @@ func (m *CreateRoleRequest) Reset()         { *m = CreateRoleRequest{} }
 func (m *CreateRoleRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateRoleRequest) ProtoMessage()    {}
 func (*CreateRoleRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{84}
+	return fileDescriptor_0ffcffcda38ae159, []int{90}
 }
 func (m *CreateRoleRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6145,7 +6532,7 @@ func (m *UpdateRoleRequest) Reset()         { *m = UpdateRoleRequest{} }
 func (m *UpdateRoleRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateRoleRequest) ProtoMessage()    {}
 func (*UpdateRoleRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{85}
+	return fileDescriptor_0ffcffcda38ae159, []int{91}
 }
 func (m *UpdateRoleRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6194,7 +6581,7 @@ func (m *UpsertRoleRequest) Reset()         { *m = UpsertRoleRequest{} }
 func (m *UpsertRoleRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertRoleRequest) ProtoMessage()    {}
 func (*UpsertRoleRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{86}
+	return fileDescriptor_0ffcffcda38ae159, []int{92}
 }
 func (m *UpsertRoleRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6243,7 +6630,7 @@ func (m *DeleteRoleRequest) Reset()         { *m = DeleteRoleRequest{} }
 func (m *DeleteRoleRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteRoleRequest) ProtoMessage()    {}
 func (*DeleteRoleRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{87}
+	return fileDescriptor_0ffcffcda38ae159, []int{93}
 }
 func (m *DeleteRoleRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6312,7 +6699,7 @@ func (m *MFAAuthenticateChallenge) Reset()         { *m = MFAAuthenticateChallen
 func (m *MFAAuthenticateChallenge) String() string { return proto.CompactTextString(m) }
 func (*MFAAuthenticateChallenge) ProtoMessage()    {}
 func (*MFAAuthenticateChallenge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{88}
+	return fileDescriptor_0ffcffcda38ae159, []int{94}
 }
 func (m *MFAAuthenticateChallenge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6386,7 +6773,7 @@ func (m *MFAAuthenticateResponse) Reset()         { *m = MFAAuthenticateResponse
 func (m *MFAAuthenticateResponse) String() string { return proto.CompactTextString(m) }
 func (*MFAAuthenticateResponse) ProtoMessage()    {}
 func (*MFAAuthenticateResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{89}
+	return fileDescriptor_0ffcffcda38ae159, []int{95}
 }
 func (m *MFAAuthenticateResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6483,7 +6870,7 @@ func (m *TOTPChallenge) Reset()         { *m = TOTPChallenge{} }
 func (m *TOTPChallenge) String() string { return proto.CompactTextString(m) }
 func (*TOTPChallenge) ProtoMessage()    {}
 func (*TOTPChallenge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{90}
+	return fileDescriptor_0ffcffcda38ae159, []int{96}
 }
 func (m *TOTPChallenge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6524,7 +6911,7 @@ func (m *TOTPResponse) Reset()         { *m = TOTPResponse{} }
 func (m *TOTPResponse) String() string { return proto.CompactTextString(m) }
 func (*TOTPResponse) ProtoMessage()    {}
 func (*TOTPResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{91}
+	return fileDescriptor_0ffcffcda38ae159, []int{97}
 }
 func (m *TOTPResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6577,7 +6964,7 @@ func (m *SSOChallenge) Reset()         { *m = SSOChallenge{} }
 func (m *SSOChallenge) String() string { return proto.CompactTextString(m) }
 func (*SSOChallenge) ProtoMessage()    {}
 func (*SSOChallenge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{92}
+	return fileDescriptor_0ffcffcda38ae159, []int{98}
 }
 func (m *SSOChallenge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6642,7 +7029,7 @@ func (m *SSOResponse) Reset()         { *m = SSOResponse{} }
 func (m *SSOResponse) String() string { return proto.CompactTextString(m) }
 func (*SSOResponse) ProtoMessage()    {}
 func (*SSOResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{93}
+	return fileDescriptor_0ffcffcda38ae159, []int{99}
 }
 func (m *SSOResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6702,7 +7089,7 @@ func (m *MFARegisterChallenge) Reset()         { *m = MFARegisterChallenge{} }
 func (m *MFARegisterChallenge) String() string { return proto.CompactTextString(m) }
 func (*MFARegisterChallenge) ProtoMessage()    {}
 func (*MFARegisterChallenge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{94}
+	return fileDescriptor_0ffcffcda38ae159, []int{100}
 }
 func (m *MFARegisterChallenge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6791,7 +7178,7 @@ func (m *MFARegisterResponse) Reset()         { *m = MFARegisterResponse{} }
 func (m *MFARegisterResponse) String() string { return proto.CompactTextString(m) }
 func (*MFARegisterResponse) ProtoMessage()    {}
 func (*MFARegisterResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{95}
+	return fileDescriptor_0ffcffcda38ae159, []int{101}
 }
 func (m *MFARegisterResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6894,7 +7281,7 @@ func (m *TOTPRegisterChallenge) Reset()         { *m = TOTPRegisterChallenge{} }
 func (m *TOTPRegisterChallenge) String() string { return proto.CompactTextString(m) }
 func (*TOTPRegisterChallenge) ProtoMessage()    {}
 func (*TOTPRegisterChallenge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{96}
+	return fileDescriptor_0ffcffcda38ae159, []int{102}
 }
 func (m *TOTPRegisterChallenge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6993,7 +7380,7 @@ func (m *TOTPRegisterResponse) Reset()         { *m = TOTPRegisterResponse{} }
 func (m *TOTPRegisterResponse) String() string { return proto.CompactTextString(m) }
 func (*TOTPRegisterResponse) ProtoMessage()    {}
 func (*TOTPRegisterResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{97}
+	return fileDescriptor_0ffcffcda38ae159, []int{103}
 }
 func (m *TOTPRegisterResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7047,7 +7434,7 @@ func (m *AddMFADeviceRequest) Reset()         { *m = AddMFADeviceRequest{} }
 func (m *AddMFADeviceRequest) String() string { return proto.CompactTextString(m) }
 func (*AddMFADeviceRequest) ProtoMessage()    {}
 func (*AddMFADeviceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{98}
+	return fileDescriptor_0ffcffcda38ae159, []int{104}
 }
 func (m *AddMFADeviceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7087,7 +7474,7 @@ func (m *AddMFADeviceResponse) Reset()         { *m = AddMFADeviceResponse{} }
 func (m *AddMFADeviceResponse) String() string { return proto.CompactTextString(m) }
 func (*AddMFADeviceResponse) ProtoMessage()    {}
 func (*AddMFADeviceResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{99}
+	return fileDescriptor_0ffcffcda38ae159, []int{105}
 }
 func (m *AddMFADeviceResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7127,7 +7514,7 @@ func (m *DeleteMFADeviceRequest) Reset()         { *m = DeleteMFADeviceRequest{}
 func (m *DeleteMFADeviceRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteMFADeviceRequest) ProtoMessage()    {}
 func (*DeleteMFADeviceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{100}
+	return fileDescriptor_0ffcffcda38ae159, []int{106}
 }
 func (m *DeleteMFADeviceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7167,7 +7554,7 @@ func (m *DeleteMFADeviceResponse) Reset()         { *m = DeleteMFADeviceResponse
 func (m *DeleteMFADeviceResponse) String() string { return proto.CompactTextString(m) }
 func (*DeleteMFADeviceResponse) ProtoMessage()    {}
 func (*DeleteMFADeviceResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{101}
+	return fileDescriptor_0ffcffcda38ae159, []int{107}
 }
 func (m *DeleteMFADeviceResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7222,7 +7609,7 @@ func (m *DeleteMFADeviceSyncRequest) Reset()         { *m = DeleteMFADeviceSyncR
 func (m *DeleteMFADeviceSyncRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteMFADeviceSyncRequest) ProtoMessage()    {}
 func (*DeleteMFADeviceSyncRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{102}
+	return fileDescriptor_0ffcffcda38ae159, []int{108}
 }
 func (m *DeleteMFADeviceSyncRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7302,7 +7689,7 @@ func (m *AddMFADeviceSyncRequest) Reset()         { *m = AddMFADeviceSyncRequest
 func (m *AddMFADeviceSyncRequest) String() string { return proto.CompactTextString(m) }
 func (*AddMFADeviceSyncRequest) ProtoMessage()    {}
 func (*AddMFADeviceSyncRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{103}
+	return fileDescriptor_0ffcffcda38ae159, []int{109}
 }
 func (m *AddMFADeviceSyncRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7378,7 +7765,7 @@ func (m *AddMFADeviceSyncResponse) Reset()         { *m = AddMFADeviceSyncRespon
 func (m *AddMFADeviceSyncResponse) String() string { return proto.CompactTextString(m) }
 func (*AddMFADeviceSyncResponse) ProtoMessage()    {}
 func (*AddMFADeviceSyncResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{104}
+	return fileDescriptor_0ffcffcda38ae159, []int{110}
 }
 func (m *AddMFADeviceSyncResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7433,7 +7820,7 @@ func (m *GetMFADevicesRequest) Reset()         { *m = GetMFADevicesRequest{} }
 func (m *GetMFADevicesRequest) String() string { return proto.CompactTextString(m) }
 func (*GetMFADevicesRequest) ProtoMessage()    {}
 func (*GetMFADevicesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{105}
+	return fileDescriptor_0ffcffcda38ae159, []int{111}
 }
 func (m *GetMFADevicesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7481,7 +7868,7 @@ func (m *GetMFADevicesResponse) Reset()         { *m = GetMFADevicesResponse{} }
 func (m *GetMFADevicesResponse) String() string { return proto.CompactTextString(m) }
 func (*GetMFADevicesResponse) ProtoMessage()    {}
 func (*GetMFADevicesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{106}
+	return fileDescriptor_0ffcffcda38ae159, []int{112}
 }
 func (m *GetMFADevicesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7528,7 +7915,7 @@ func (m *UserSingleUseCertsRequest) Reset()         { *m = UserSingleUseCertsReq
 func (m *UserSingleUseCertsRequest) String() string { return proto.CompactTextString(m) }
 func (*UserSingleUseCertsRequest) ProtoMessage()    {}
 func (*UserSingleUseCertsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{107}
+	return fileDescriptor_0ffcffcda38ae159, []int{113}
 }
 func (m *UserSingleUseCertsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7568,7 +7955,7 @@ func (m *UserSingleUseCertsResponse) Reset()         { *m = UserSingleUseCertsRe
 func (m *UserSingleUseCertsResponse) String() string { return proto.CompactTextString(m) }
 func (*UserSingleUseCertsResponse) ProtoMessage()    {}
 func (*UserSingleUseCertsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{108}
+	return fileDescriptor_0ffcffcda38ae159, []int{114}
 }
 func (m *UserSingleUseCertsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7617,7 +8004,7 @@ func (m *IsMFARequiredRequest) Reset()         { *m = IsMFARequiredRequest{} }
 func (m *IsMFARequiredRequest) String() string { return proto.CompactTextString(m) }
 func (*IsMFARequiredRequest) ProtoMessage()    {}
 func (*IsMFARequiredRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{109}
+	return fileDescriptor_0ffcffcda38ae159, []int{115}
 }
 func (m *IsMFARequiredRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7755,7 +8142,7 @@ func (m *StreamSessionEventsRequest) Reset()         { *m = StreamSessionEventsR
 func (m *StreamSessionEventsRequest) String() string { return proto.CompactTextString(m) }
 func (*StreamSessionEventsRequest) ProtoMessage()    {}
 func (*StreamSessionEventsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{110}
+	return fileDescriptor_0ffcffcda38ae159, []int{116}
 }
 func (m *StreamSessionEventsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7813,7 +8200,7 @@ func (m *NodeLogin) Reset()         { *m = NodeLogin{} }
 func (m *NodeLogin) String() string { return proto.CompactTextString(m) }
 func (*NodeLogin) ProtoMessage()    {}
 func (*NodeLogin) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{111}
+	return fileDescriptor_0ffcffcda38ae159, []int{117}
 }
 func (m *NodeLogin) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7867,7 +8254,7 @@ func (m *AdminAction) Reset()         { *m = AdminAction{} }
 func (m *AdminAction) String() string { return proto.CompactTextString(m) }
 func (*AdminAction) ProtoMessage()    {}
 func (*AdminAction) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{112}
+	return fileDescriptor_0ffcffcda38ae159, []int{118}
 }
 func (m *AdminAction) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7912,7 +8299,7 @@ func (m *IsMFARequiredResponse) Reset()         { *m = IsMFARequiredResponse{} }
 func (m *IsMFARequiredResponse) String() string { return proto.CompactTextString(m) }
 func (*IsMFARequiredResponse) ProtoMessage()    {}
 func (*IsMFARequiredResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{113}
+	return fileDescriptor_0ffcffcda38ae159, []int{119}
 }
 func (m *IsMFARequiredResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7972,7 +8359,9 @@ type GetEventsRequest struct {
 	StartKey string `protobuf:"bytes,6,opt,name=StartKey,proto3" json:"StartKey,omitempty"`
 	// Order specifies an ascending or descending order of events.
 	// A value of 0 means a descending order and a value of 1 means an ascending order.
-	Order                Order    `protobuf:"varint,7,opt,name=Order,proto3,enum=proto.Order" json:"Order,omitempty"`
+	Order Order `protobuf:"varint,7,opt,name=Order,proto3,enum=proto.Order" json:"Order,omitempty"`
+	// Search is an optional search term to filter events by (case-insensitive substring match).
+	Search               string   `protobuf:"bytes,8,opt,name=Search,proto3" json:"Search,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -7982,7 +8371,7 @@ func (m *GetEventsRequest) Reset()         { *m = GetEventsRequest{} }
 func (m *GetEventsRequest) String() string { return proto.CompactTextString(m) }
 func (*GetEventsRequest) ProtoMessage()    {}
 func (*GetEventsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{114}
+	return fileDescriptor_0ffcffcda38ae159, []int{120}
 }
 func (m *GetEventsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8060,6 +8449,13 @@ func (m *GetEventsRequest) GetOrder() Order {
 	return Order_DESCENDING
 }
 
+func (m *GetEventsRequest) GetSearch() string {
+	if m != nil {
+		return m.Search
+	}
+	return ""
+}
+
 type GetSessionEventsRequest struct {
 	// StartDate is the oldest date of returned events
 	StartDate time.Time `protobuf:"bytes,1,opt,name=StartDate,proto3,stdtime" json:"StartDate"`
@@ -8083,7 +8479,7 @@ func (m *GetSessionEventsRequest) Reset()         { *m = GetSessionEventsRequest
 func (m *GetSessionEventsRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSessionEventsRequest) ProtoMessage()    {}
 func (*GetSessionEventsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{115}
+	return fileDescriptor_0ffcffcda38ae159, []int{121}
 }
 func (m *GetSessionEventsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8163,7 +8559,7 @@ func (m *Events) Reset()         { *m = Events{} }
 func (m *Events) String() string { return proto.CompactTextString(m) }
 func (*Events) ProtoMessage()    {}
 func (*Events) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{116}
+	return fileDescriptor_0ffcffcda38ae159, []int{122}
 }
 func (m *Events) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8221,7 +8617,7 @@ func (m *GetLocksRequest) Reset()         { *m = GetLocksRequest{} }
 func (m *GetLocksRequest) String() string { return proto.CompactTextString(m) }
 func (*GetLocksRequest) ProtoMessage()    {}
 func (*GetLocksRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{117}
+	return fileDescriptor_0ffcffcda38ae159, []int{123}
 }
 func (m *GetLocksRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8276,7 +8672,7 @@ func (m *GetLocksResponse) Reset()         { *m = GetLocksResponse{} }
 func (m *GetLocksResponse) String() string { return proto.CompactTextString(m) }
 func (*GetLocksResponse) ProtoMessage()    {}
 func (*GetLocksResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{118}
+	return fileDescriptor_0ffcffcda38ae159, []int{124}
 }
 func (m *GetLocksResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8312,6 +8708,133 @@ func (m *GetLocksResponse) GetLocks() []*types.LockV2 {
 	return nil
 }
 
+// ListLocksRequest is a request for a page of locks.
+type ListLocksRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// Filter specifies lock specific filters.
+	Filter               *types.LockFilter `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *ListLocksRequest) Reset()         { *m = ListLocksRequest{} }
+func (m *ListLocksRequest) String() string { return proto.CompactTextString(m) }
+func (*ListLocksRequest) ProtoMessage()    {}
+func (*ListLocksRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{125}
+}
+func (m *ListLocksRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListLocksRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListLocksRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListLocksRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListLocksRequest.Merge(m, src)
+}
+func (m *ListLocksRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListLocksRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListLocksRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListLocksRequest proto.InternalMessageInfo
+
+func (m *ListLocksRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListLocksRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+func (m *ListLocksRequest) GetFilter() *types.LockFilter {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+// ListLocksResponse contains a page of registered applications.
+type ListLocksResponse struct {
+	// Locks is a list of locks.
+	Locks []*types.LockV2 `protobuf:"bytes,1,rep,name=locks,proto3" json:"locks,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListLocksResponse) Reset()         { *m = ListLocksResponse{} }
+func (m *ListLocksResponse) String() string { return proto.CompactTextString(m) }
+func (*ListLocksResponse) ProtoMessage()    {}
+func (*ListLocksResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{126}
+}
+func (m *ListLocksResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListLocksResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListLocksResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListLocksResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListLocksResponse.Merge(m, src)
+}
+func (m *ListLocksResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListLocksResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListLocksResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListLocksResponse proto.InternalMessageInfo
+
+func (m *ListLocksResponse) GetLocks() []*types.LockV2 {
+	if m != nil {
+		return m.Locks
+	}
+	return nil
+}
+
+func (m *ListLocksResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 type GetLockRequest struct {
 	// Name is the name of the lock to get.
 	Name                 string   `protobuf:"bytes,1,opt,name=Name,proto3" json:"Name,omitempty"`
@@ -8324,7 +8847,7 @@ func (m *GetLockRequest) Reset()         { *m = GetLockRequest{} }
 func (m *GetLockRequest) String() string { return proto.CompactTextString(m) }
 func (*GetLockRequest) ProtoMessage()    {}
 func (*GetLockRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{119}
+	return fileDescriptor_0ffcffcda38ae159, []int{127}
 }
 func (m *GetLockRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8372,7 +8895,7 @@ func (m *DeleteLockRequest) Reset()         { *m = DeleteLockRequest{} }
 func (m *DeleteLockRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteLockRequest) ProtoMessage()    {}
 func (*DeleteLockRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{120}
+	return fileDescriptor_0ffcffcda38ae159, []int{128}
 }
 func (m *DeleteLockRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8422,7 +8945,7 @@ func (m *ReplaceRemoteLocksRequest) Reset()         { *m = ReplaceRemoteLocksReq
 func (m *ReplaceRemoteLocksRequest) String() string { return proto.CompactTextString(m) }
 func (*ReplaceRemoteLocksRequest) ProtoMessage()    {}
 func (*ReplaceRemoteLocksRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{121}
+	return fileDescriptor_0ffcffcda38ae159, []int{129}
 }
 func (m *ReplaceRemoteLocksRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8465,6 +8988,240 @@ func (m *ReplaceRemoteLocksRequest) GetLocks() []*types.LockV2 {
 	return nil
 }
 
+// ListAppsRequest is a request for a page of registered applications.
+type ListAppsRequest struct {
+	// Limit is the maximum amount of resources to retrieve.
+	Limit int32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	// StartKey is used to start listing resources from a specific spot. It
+	// should be set to the previous NextKey value if using pagination, or
+	// left empty.
+	StartKey             string   `protobuf:"bytes,2,opt,name=start_key,json=startKey,proto3" json:"start_key,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListAppsRequest) Reset()         { *m = ListAppsRequest{} }
+func (m *ListAppsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListAppsRequest) ProtoMessage()    {}
+func (*ListAppsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{130}
+}
+func (m *ListAppsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListAppsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListAppsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListAppsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListAppsRequest.Merge(m, src)
+}
+func (m *ListAppsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListAppsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListAppsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListAppsRequest proto.InternalMessageInfo
+
+func (m *ListAppsRequest) GetLimit() int32 {
+	if m != nil {
+		return m.Limit
+	}
+	return 0
+}
+
+func (m *ListAppsRequest) GetStartKey() string {
+	if m != nil {
+		return m.StartKey
+	}
+	return ""
+}
+
+// ListAppsResponse contains a page of registered applications.
+type ListAppsResponse struct {
+	// Applictaions is a list of applications.
+	Applications []*types.AppV3 `protobuf:"bytes,1,rep,name=applications,proto3" json:"applications,omitempty"`
+	// NextKey is the key for the next page of applications.
+	NextKey              string   `protobuf:"bytes,2,opt,name=next_key,json=nextKey,proto3" json:"next_key,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListAppsResponse) Reset()         { *m = ListAppsResponse{} }
+func (m *ListAppsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListAppsResponse) ProtoMessage()    {}
+func (*ListAppsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{131}
+}
+func (m *ListAppsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListAppsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListAppsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListAppsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListAppsResponse.Merge(m, src)
+}
+func (m *ListAppsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListAppsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListAppsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListAppsResponse proto.InternalMessageInfo
+
+func (m *ListAppsResponse) GetApplications() []*types.AppV3 {
+	if m != nil {
+		return m.Applications
+	}
+	return nil
+}
+
+func (m *ListAppsResponse) GetNextKey() string {
+	if m != nil {
+		return m.NextKey
+	}
+	return ""
+}
+
+type ListDatabasesRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListDatabasesRequest) Reset()         { *m = ListDatabasesRequest{} }
+func (m *ListDatabasesRequest) String() string { return proto.CompactTextString(m) }
+func (*ListDatabasesRequest) ProtoMessage()    {}
+func (*ListDatabasesRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{132}
+}
+func (m *ListDatabasesRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListDatabasesRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListDatabasesRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListDatabasesRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListDatabasesRequest.Merge(m, src)
+}
+func (m *ListDatabasesRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListDatabasesRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListDatabasesRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListDatabasesRequest proto.InternalMessageInfo
+
+func (m *ListDatabasesRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListDatabasesRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+type ListDatabasesResponse struct {
+	// a list of databases.
+	Databases []*types.DatabaseV3 `protobuf:"bytes,1,rep,name=databases,proto3" json:"databases,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListDatabasesResponse) Reset()         { *m = ListDatabasesResponse{} }
+func (m *ListDatabasesResponse) String() string { return proto.CompactTextString(m) }
+func (*ListDatabasesResponse) ProtoMessage()    {}
+func (*ListDatabasesResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{133}
+}
+func (m *ListDatabasesResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListDatabasesResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListDatabasesResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListDatabasesResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListDatabasesResponse.Merge(m, src)
+}
+func (m *ListDatabasesResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListDatabasesResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListDatabasesResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListDatabasesResponse proto.InternalMessageInfo
+
+func (m *ListDatabasesResponse) GetDatabases() []*types.DatabaseV3 {
+	if m != nil {
+		return m.Databases
+	}
+	return nil
+}
+
+func (m *ListDatabasesResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // GetWindowsDesktopServicesResponse contains all registered Windows desktop services.
 type GetWindowsDesktopServicesResponse struct {
 	// Services is a list of Windows desktop services.
@@ -8478,7 +9235,7 @@ func (m *GetWindowsDesktopServicesResponse) Reset()         { *m = GetWindowsDes
 func (m *GetWindowsDesktopServicesResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWindowsDesktopServicesResponse) ProtoMessage()    {}
 func (*GetWindowsDesktopServicesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{122}
+	return fileDescriptor_0ffcffcda38ae159, []int{134}
 }
 func (m *GetWindowsDesktopServicesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8527,7 +9284,7 @@ func (m *GetWindowsDesktopServiceRequest) Reset()         { *m = GetWindowsDeskt
 func (m *GetWindowsDesktopServiceRequest) String() string { return proto.CompactTextString(m) }
 func (*GetWindowsDesktopServiceRequest) ProtoMessage()    {}
 func (*GetWindowsDesktopServiceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{123}
+	return fileDescriptor_0ffcffcda38ae159, []int{135}
 }
 func (m *GetWindowsDesktopServiceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8576,7 +9333,7 @@ func (m *GetWindowsDesktopServiceResponse) Reset()         { *m = GetWindowsDesk
 func (m *GetWindowsDesktopServiceResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWindowsDesktopServiceResponse) ProtoMessage()    {}
 func (*GetWindowsDesktopServiceResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{124}
+	return fileDescriptor_0ffcffcda38ae159, []int{136}
 }
 func (m *GetWindowsDesktopServiceResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8625,7 +9382,7 @@ func (m *DeleteWindowsDesktopServiceRequest) Reset()         { *m = DeleteWindow
 func (m *DeleteWindowsDesktopServiceRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWindowsDesktopServiceRequest) ProtoMessage()    {}
 func (*DeleteWindowsDesktopServiceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{125}
+	return fileDescriptor_0ffcffcda38ae159, []int{137}
 }
 func (m *DeleteWindowsDesktopServiceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8661,6 +9418,160 @@ func (m *DeleteWindowsDesktopServiceRequest) GetName() string {
 	return ""
 }
 
+// ListWindowsDesktopsRequest is a request for a page of registered Windows desktop hosts.
+type ListWindowsDesktopsRequest struct {
+	// Limit is the maximum amount of resources to retrieve.
+	Limit int32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	// StartKey is used to start listing resources from a specific spot. It
+	// should be set to the previous NextKey value if using pagination, or
+	// left empty.
+	StartKey string `protobuf:"bytes,2,opt,name=start_key,json=startKey,proto3" json:"start_key,omitempty"`
+	// Labels is a label-based matcher if non-empty.
+	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// PredicateExpression defines boolean conditions that will be matched against the resource.
+	PredicateExpression string `protobuf:"bytes,4,opt,name=predicate_expression,json=predicateExpression,proto3" json:"predicate_expression,omitempty"`
+	// SearchKeywords is a list of search keywords to match against resource field values.
+	SearchKeywords []string `protobuf:"bytes,5,rep,name=search_keywords,json=searchKeywords,proto3" json:"search_keywords,omitempty"`
+	// WindowsDesktopFilter specifies windows desktop specific filters.
+	WindowsDesktopFilter types.WindowsDesktopFilter `protobuf:"bytes,6,opt,name=windows_desktop_filter,json=windowsDesktopFilter,proto3" json:"windows_desktop_filter,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+	XXX_unrecognized     []byte                     `json:"-"`
+	XXX_sizecache        int32                      `json:"-"`
+}
+
+func (m *ListWindowsDesktopsRequest) Reset()         { *m = ListWindowsDesktopsRequest{} }
+func (m *ListWindowsDesktopsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListWindowsDesktopsRequest) ProtoMessage()    {}
+func (*ListWindowsDesktopsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{138}
+}
+func (m *ListWindowsDesktopsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListWindowsDesktopsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListWindowsDesktopsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListWindowsDesktopsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListWindowsDesktopsRequest.Merge(m, src)
+}
+func (m *ListWindowsDesktopsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListWindowsDesktopsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListWindowsDesktopsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListWindowsDesktopsRequest proto.InternalMessageInfo
+
+func (m *ListWindowsDesktopsRequest) GetLimit() int32 {
+	if m != nil {
+		return m.Limit
+	}
+	return 0
+}
+
+func (m *ListWindowsDesktopsRequest) GetStartKey() string {
+	if m != nil {
+		return m.StartKey
+	}
+	return ""
+}
+
+func (m *ListWindowsDesktopsRequest) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *ListWindowsDesktopsRequest) GetPredicateExpression() string {
+	if m != nil {
+		return m.PredicateExpression
+	}
+	return ""
+}
+
+func (m *ListWindowsDesktopsRequest) GetSearchKeywords() []string {
+	if m != nil {
+		return m.SearchKeywords
+	}
+	return nil
+}
+
+func (m *ListWindowsDesktopsRequest) GetWindowsDesktopFilter() types.WindowsDesktopFilter {
+	if m != nil {
+		return m.WindowsDesktopFilter
+	}
+	return types.WindowsDesktopFilter{}
+}
+
+// ListWindowsDesktopsResponse contains a page of registered Windows desktop hosts.
+type ListWindowsDesktopsResponse struct {
+	// Desktops is a list of Windows desktop hosts.
+	Desktops []*types.WindowsDesktopV3 `protobuf:"bytes,1,rep,name=desktops,proto3" json:"desktops,omitempty"`
+	// NextKey is the key for the next page of desktops.
+	NextKey              string   `protobuf:"bytes,2,opt,name=next_key,json=nextKey,proto3" json:"next_key,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListWindowsDesktopsResponse) Reset()         { *m = ListWindowsDesktopsResponse{} }
+func (m *ListWindowsDesktopsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListWindowsDesktopsResponse) ProtoMessage()    {}
+func (*ListWindowsDesktopsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{139}
+}
+func (m *ListWindowsDesktopsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListWindowsDesktopsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListWindowsDesktopsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListWindowsDesktopsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListWindowsDesktopsResponse.Merge(m, src)
+}
+func (m *ListWindowsDesktopsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListWindowsDesktopsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListWindowsDesktopsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListWindowsDesktopsResponse proto.InternalMessageInfo
+
+func (m *ListWindowsDesktopsResponse) GetDesktops() []*types.WindowsDesktopV3 {
+	if m != nil {
+		return m.Desktops
+	}
+	return nil
+}
+
+func (m *ListWindowsDesktopsResponse) GetNextKey() string {
+	if m != nil {
+		return m.NextKey
+	}
+	return ""
+}
+
 // GetWindowsDesktopsResponse contains all registered Windows desktop hosts.
 type GetWindowsDesktopsResponse struct {
 	// Servers is a list of Windows desktop hosts.
@@ -8674,7 +9585,7 @@ func (m *GetWindowsDesktopsResponse) Reset()         { *m = GetWindowsDesktopsRe
 func (m *GetWindowsDesktopsResponse) String() string { return proto.CompactTextString(m) }
 func (*GetWindowsDesktopsResponse) ProtoMessage()    {}
 func (*GetWindowsDesktopsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{126}
+	return fileDescriptor_0ffcffcda38ae159, []int{140}
 }
 func (m *GetWindowsDesktopsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8727,7 +9638,7 @@ func (m *DeleteWindowsDesktopRequest) Reset()         { *m = DeleteWindowsDeskto
 func (m *DeleteWindowsDesktopRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWindowsDesktopRequest) ProtoMessage()    {}
 func (*DeleteWindowsDesktopRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{127}
+	return fileDescriptor_0ffcffcda38ae159, []int{141}
 }
 func (m *DeleteWindowsDesktopRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8776,9 +9687,12 @@ type WindowsDesktopCertRequest struct {
 	// CSR is the request to sign in PEM format.
 	CSR []byte `protobuf:"bytes,1,opt,name=CSR,proto3" json:"CSR,omitempty"`
 	// CRLEndpoint is the address of the CRL for this certificate.
-	CRLEndpoint string `protobuf:"bytes,2,opt,name=CRLEndpoint,proto3" json:"CRLEndpoint,omitempty"`
+	// DEPRECATED: use CRLDomain instead.
+	CRLEndpoint string `protobuf:"bytes,2,opt,name=CRLEndpoint,proto3" json:"CRLEndpoint,omitempty"` // Deprecated: Do not use.
 	// TTL is the certificate validity period.
-	TTL                  Duration `protobuf:"varint,3,opt,name=TTL,proto3,casttype=Duration" json:"TTL,omitempty"`
+	TTL Duration `protobuf:"varint,3,opt,name=TTL,proto3,casttype=Duration" json:"TTL,omitempty"`
+	// CRLDomain is the Active Directory domain where CRLs are published.
+	CRLDomain            string   `protobuf:"bytes,4,opt,name=CRLDomain,proto3" json:"CRLDomain,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -8788,7 +9702,7 @@ func (m *WindowsDesktopCertRequest) Reset()         { *m = WindowsDesktopCertReq
 func (m *WindowsDesktopCertRequest) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopCertRequest) ProtoMessage()    {}
 func (*WindowsDesktopCertRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{128}
+	return fileDescriptor_0ffcffcda38ae159, []int{142}
 }
 func (m *WindowsDesktopCertRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8824,6 +9738,7 @@ func (m *WindowsDesktopCertRequest) GetCSR() []byte {
 	return nil
 }
 
+// Deprecated: Do not use.
 func (m *WindowsDesktopCertRequest) GetCRLEndpoint() string {
 	if m != nil {
 		return m.CRLEndpoint
@@ -8838,6 +9753,13 @@ func (m *WindowsDesktopCertRequest) GetTTL() Duration {
 	return 0
 }
 
+func (m *WindowsDesktopCertRequest) GetCRLDomain() string {
+	if m != nil {
+		return m.CRLDomain
+	}
+	return ""
+}
+
 // WindowsDesktopCertResponse contains the signed Windows RDP certificate.
 type WindowsDesktopCertResponse struct {
 	// Cert is the signed certificate in PEM format.
@@ -8851,7 +9773,7 @@ func (m *WindowsDesktopCertResponse) Reset()         { *m = WindowsDesktopCertRe
 func (m *WindowsDesktopCertResponse) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopCertResponse) ProtoMessage()    {}
 func (*WindowsDesktopCertResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{129}
+	return fileDescriptor_0ffcffcda38ae159, []int{143}
 }
 func (m *WindowsDesktopCertResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8900,7 +9822,7 @@ func (m *DesktopBootstrapScriptResponse) Reset()         { *m = DesktopBootstrap
 func (m *DesktopBootstrapScriptResponse) String() string { return proto.CompactTextString(m) }
 func (*DesktopBootstrapScriptResponse) ProtoMessage()    {}
 func (*DesktopBootstrapScriptResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{130}
+	return fileDescriptor_0ffcffcda38ae159, []int{144}
 }
 func (m *DesktopBootstrapScriptResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8951,7 +9873,7 @@ func (m *ListSAMLIdPServiceProvidersRequest) Reset()         { *m = ListSAMLIdPS
 func (m *ListSAMLIdPServiceProvidersRequest) String() string { return proto.CompactTextString(m) }
 func (*ListSAMLIdPServiceProvidersRequest) ProtoMessage()    {}
 func (*ListSAMLIdPServiceProvidersRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{131}
+	return fileDescriptor_0ffcffcda38ae159, []int{145}
 }
 func (m *ListSAMLIdPServiceProvidersRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9011,7 +9933,7 @@ func (m *ListSAMLIdPServiceProvidersResponse) Reset()         { *m = ListSAMLIdP
 func (m *ListSAMLIdPServiceProvidersResponse) String() string { return proto.CompactTextString(m) }
 func (*ListSAMLIdPServiceProvidersResponse) ProtoMessage()    {}
 func (*ListSAMLIdPServiceProvidersResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{132}
+	return fileDescriptor_0ffcffcda38ae159, []int{146}
 }
 func (m *ListSAMLIdPServiceProvidersResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9074,7 +9996,7 @@ func (m *GetSAMLIdPServiceProviderRequest) Reset()         { *m = GetSAMLIdPServ
 func (m *GetSAMLIdPServiceProviderRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSAMLIdPServiceProviderRequest) ProtoMessage()    {}
 func (*GetSAMLIdPServiceProviderRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{133}
+	return fileDescriptor_0ffcffcda38ae159, []int{147}
 }
 func (m *GetSAMLIdPServiceProviderRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9123,7 +10045,7 @@ func (m *DeleteSAMLIdPServiceProviderRequest) Reset()         { *m = DeleteSAMLI
 func (m *DeleteSAMLIdPServiceProviderRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteSAMLIdPServiceProviderRequest) ProtoMessage()    {}
 func (*DeleteSAMLIdPServiceProviderRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{134}
+	return fileDescriptor_0ffcffcda38ae159, []int{148}
 }
 func (m *DeleteSAMLIdPServiceProviderRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9174,7 +10096,7 @@ func (m *ListUserGroupsRequest) Reset()         { *m = ListUserGroupsRequest{} }
 func (m *ListUserGroupsRequest) String() string { return proto.CompactTextString(m) }
 func (*ListUserGroupsRequest) ProtoMessage()    {}
 func (*ListUserGroupsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{135}
+	return fileDescriptor_0ffcffcda38ae159, []int{149}
 }
 func (m *ListUserGroupsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9234,7 +10156,7 @@ func (m *ListUserGroupsResponse) Reset()         { *m = ListUserGroupsResponse{}
 func (m *ListUserGroupsResponse) String() string { return proto.CompactTextString(m) }
 func (*ListUserGroupsResponse) ProtoMessage()    {}
 func (*ListUserGroupsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{136}
+	return fileDescriptor_0ffcffcda38ae159, []int{150}
 }
 func (m *ListUserGroupsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9297,7 +10219,7 @@ func (m *GetUserGroupRequest) Reset()         { *m = GetUserGroupRequest{} }
 func (m *GetUserGroupRequest) String() string { return proto.CompactTextString(m) }
 func (*GetUserGroupRequest) ProtoMessage()    {}
 func (*GetUserGroupRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{137}
+	return fileDescriptor_0ffcffcda38ae159, []int{151}
 }
 func (m *GetUserGroupRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9346,7 +10268,7 @@ func (m *DeleteUserGroupRequest) Reset()         { *m = DeleteUserGroupRequest{}
 func (m *DeleteUserGroupRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteUserGroupRequest) ProtoMessage()    {}
 func (*DeleteUserGroupRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{138}
+	return fileDescriptor_0ffcffcda38ae159, []int{152}
 }
 func (m *DeleteUserGroupRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9395,7 +10317,7 @@ func (m *CertAuthorityRequest) Reset()         { *m = CertAuthorityRequest{} }
 func (m *CertAuthorityRequest) String() string { return proto.CompactTextString(m) }
 func (*CertAuthorityRequest) ProtoMessage()    {}
 func (*CertAuthorityRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{139}
+	return fileDescriptor_0ffcffcda38ae159, []int{153}
 }
 func (m *CertAuthorityRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9444,7 +10366,7 @@ func (m *CRL) Reset()         { *m = CRL{} }
 func (m *CRL) String() string { return proto.CompactTextString(m) }
 func (*CRL) ProtoMessage()    {}
 func (*CRL) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{140}
+	return fileDescriptor_0ffcffcda38ae159, []int{154}
 }
 func (m *CRL) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9514,7 +10436,7 @@ func (m *ChangeUserAuthenticationRequest) Reset()         { *m = ChangeUserAuthe
 func (m *ChangeUserAuthenticationRequest) String() string { return proto.CompactTextString(m) }
 func (*ChangeUserAuthenticationRequest) ProtoMessage()    {}
 func (*ChangeUserAuthenticationRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{141}
+	return fileDescriptor_0ffcffcda38ae159, []int{155}
 }
 func (m *ChangeUserAuthenticationRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9600,7 +10522,7 @@ func (m *ChangeUserAuthenticationResponse) Reset()         { *m = ChangeUserAuth
 func (m *ChangeUserAuthenticationResponse) String() string { return proto.CompactTextString(m) }
 func (*ChangeUserAuthenticationResponse) ProtoMessage()    {}
 func (*ChangeUserAuthenticationResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{142}
+	return fileDescriptor_0ffcffcda38ae159, []int{156}
 }
 func (m *ChangeUserAuthenticationResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9673,7 +10595,7 @@ func (m *StartAccountRecoveryRequest) Reset()         { *m = StartAccountRecover
 func (m *StartAccountRecoveryRequest) String() string { return proto.CompactTextString(m) }
 func (*StartAccountRecoveryRequest) ProtoMessage()    {}
 func (*StartAccountRecoveryRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{143}
+	return fileDescriptor_0ffcffcda38ae159, []int{157}
 }
 func (m *StartAccountRecoveryRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9748,7 +10670,7 @@ func (m *VerifyAccountRecoveryRequest) Reset()         { *m = VerifyAccountRecov
 func (m *VerifyAccountRecoveryRequest) String() string { return proto.CompactTextString(m) }
 func (*VerifyAccountRecoveryRequest) ProtoMessage()    {}
 func (*VerifyAccountRecoveryRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{144}
+	return fileDescriptor_0ffcffcda38ae159, []int{158}
 }
 func (m *VerifyAccountRecoveryRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9863,7 +10785,7 @@ func (m *CompleteAccountRecoveryRequest) Reset()         { *m = CompleteAccountR
 func (m *CompleteAccountRecoveryRequest) String() string { return proto.CompactTextString(m) }
 func (*CompleteAccountRecoveryRequest) ProtoMessage()    {}
 func (*CompleteAccountRecoveryRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{145}
+	return fileDescriptor_0ffcffcda38ae159, []int{159}
 }
 func (m *CompleteAccountRecoveryRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9969,7 +10891,7 @@ func (m *RecoveryCodes) Reset()         { *m = RecoveryCodes{} }
 func (m *RecoveryCodes) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodes) ProtoMessage()    {}
 func (*RecoveryCodes) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{146}
+	return fileDescriptor_0ffcffcda38ae159, []int{160}
 }
 func (m *RecoveryCodes) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10032,7 +10954,7 @@ func (m *CreateAccountRecoveryCodesRequest) Reset()         { *m = CreateAccount
 func (m *CreateAccountRecoveryCodesRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateAccountRecoveryCodesRequest) ProtoMessage()    {}
 func (*CreateAccountRecoveryCodesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{147}
+	return fileDescriptor_0ffcffcda38ae159, []int{161}
 }
 func (m *CreateAccountRecoveryCodesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10083,7 +11005,7 @@ func (m *GetAccountRecoveryTokenRequest) Reset()         { *m = GetAccountRecove
 func (m *GetAccountRecoveryTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*GetAccountRecoveryTokenRequest) ProtoMessage()    {}
 func (*GetAccountRecoveryTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{148}
+	return fileDescriptor_0ffcffcda38ae159, []int{162}
 }
 func (m *GetAccountRecoveryTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10131,7 +11053,7 @@ func (m *GetAccountRecoveryCodesRequest) Reset()         { *m = GetAccountRecove
 func (m *GetAccountRecoveryCodesRequest) String() string { return proto.CompactTextString(m) }
 func (*GetAccountRecoveryCodesRequest) ProtoMessage()    {}
 func (*GetAccountRecoveryCodesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{149}
+	return fileDescriptor_0ffcffcda38ae159, []int{163}
 }
 func (m *GetAccountRecoveryCodesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10173,7 +11095,7 @@ func (m *UserCredentials) Reset()         { *m = UserCredentials{} }
 func (m *UserCredentials) String() string { return proto.CompactTextString(m) }
 func (*UserCredentials) ProtoMessage()    {}
 func (*UserCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{150}
+	return fileDescriptor_0ffcffcda38ae159, []int{164}
 }
 func (m *UserCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10227,7 +11149,7 @@ func (m *ContextUser) Reset()         { *m = ContextUser{} }
 func (m *ContextUser) String() string { return proto.CompactTextString(m) }
 func (*ContextUser) ProtoMessage()    {}
 func (*ContextUser) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{151}
+	return fileDescriptor_0ffcffcda38ae159, []int{165}
 }
 func (m *ContextUser) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10267,7 +11189,7 @@ func (m *Passwordless) Reset()         { *m = Passwordless{} }
 func (m *Passwordless) String() string { return proto.CompactTextString(m) }
 func (*Passwordless) ProtoMessage()    {}
 func (*Passwordless) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{152}
+	return fileDescriptor_0ffcffcda38ae159, []int{166}
 }
 func (m *Passwordless) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10337,7 +11259,7 @@ func (m *CreateAuthenticateChallengeRequest) Reset()         { *m = CreateAuthen
 func (m *CreateAuthenticateChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateAuthenticateChallengeRequest) ProtoMessage()    {}
 func (*CreateAuthenticateChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{153}
+	return fileDescriptor_0ffcffcda38ae159, []int{167}
 }
 func (m *CreateAuthenticateChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10485,7 +11407,7 @@ func (m *CreatePrivilegeTokenRequest) Reset()         { *m = CreatePrivilegeToke
 func (m *CreatePrivilegeTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*CreatePrivilegeTokenRequest) ProtoMessage()    {}
 func (*CreatePrivilegeTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{154}
+	return fileDescriptor_0ffcffcda38ae159, []int{168}
 }
 func (m *CreatePrivilegeTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10554,7 +11476,7 @@ func (m *CreateRegisterChallengeRequest) Reset()         { *m = CreateRegisterCh
 func (m *CreateRegisterChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateRegisterChallengeRequest) ProtoMessage()    {}
 func (*CreateRegisterChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{155}
+	return fileDescriptor_0ffcffcda38ae159, []int{169}
 }
 func (m *CreateRegisterChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10631,7 +11553,7 @@ func (m *IdentityCenterAccount) Reset()         { *m = IdentityCenterAccount{} }
 func (m *IdentityCenterAccount) String() string { return proto.CompactTextString(m) }
 func (*IdentityCenterAccount) ProtoMessage()    {}
 func (*IdentityCenterAccount) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{156}
+	return fileDescriptor_0ffcffcda38ae159, []int{170}
 }
 func (m *IdentityCenterAccount) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10704,7 +11626,7 @@ func (m *IdentityCenterPermissionSet) Reset()         { *m = IdentityCenterPermi
 func (m *IdentityCenterPermissionSet) String() string { return proto.CompactTextString(m) }
 func (*IdentityCenterPermissionSet) ProtoMessage()    {}
 func (*IdentityCenterPermissionSet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{157}
+	return fileDescriptor_0ffcffcda38ae159, []int{171}
 }
 func (m *IdentityCenterPermissionSet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10776,7 +11698,7 @@ func (m *IdentityCenterAccountAssignment) Reset()         { *m = IdentityCenterA
 func (m *IdentityCenterAccountAssignment) String() string { return proto.CompactTextString(m) }
 func (*IdentityCenterAccountAssignment) ProtoMessage()    {}
 func (*IdentityCenterAccountAssignment) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{158}
+	return fileDescriptor_0ffcffcda38ae159, []int{172}
 }
 func (m *IdentityCenterAccountAssignment) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10854,6 +11776,122 @@ func (m *IdentityCenterAccountAssignment) GetPermissionSet() *IdentityCenterPerm
 	return nil
 }
 
+type ListInstallersRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListInstallersRequest) Reset()         { *m = ListInstallersRequest{} }
+func (m *ListInstallersRequest) String() string { return proto.CompactTextString(m) }
+func (*ListInstallersRequest) ProtoMessage()    {}
+func (*ListInstallersRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{173}
+}
+func (m *ListInstallersRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListInstallersRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListInstallersRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListInstallersRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListInstallersRequest.Merge(m, src)
+}
+func (m *ListInstallersRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListInstallersRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListInstallersRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListInstallersRequest proto.InternalMessageInfo
+
+func (m *ListInstallersRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListInstallersRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+type ListInstallersResponse struct {
+	// Installers is a list of installer resources.
+	Installers []*types.InstallerV1 `protobuf:"bytes,1,rep,name=installers,proto3" json:"installers,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListInstallersResponse) Reset()         { *m = ListInstallersResponse{} }
+func (m *ListInstallersResponse) String() string { return proto.CompactTextString(m) }
+func (*ListInstallersResponse) ProtoMessage()    {}
+func (*ListInstallersResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{174}
+}
+func (m *ListInstallersResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListInstallersResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListInstallersResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListInstallersResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListInstallersResponse.Merge(m, src)
+}
+func (m *ListInstallersResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListInstallersResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListInstallersResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListInstallersResponse proto.InternalMessageInfo
+
+func (m *ListInstallersResponse) GetInstallers() []*types.InstallerV1 {
+	if m != nil {
+		return m.Installers
+	}
+	return nil
+}
+
+func (m *ListInstallersResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // PaginatedResource represents one of the supported resources.
 type PaginatedResource struct {
 	// Resource is the resource itself.
@@ -10886,7 +11924,7 @@ func (m *PaginatedResource) Reset()         { *m = PaginatedResource{} }
 func (m *PaginatedResource) String() string { return proto.CompactTextString(m) }
 func (*PaginatedResource) ProtoMessage()    {}
 func (*PaginatedResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{159}
+	return fileDescriptor_0ffcffcda38ae159, []int{175}
 }
 func (m *PaginatedResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11138,7 +12176,7 @@ func (m *ListUnifiedResourcesRequest) Reset()         { *m = ListUnifiedResource
 func (m *ListUnifiedResourcesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListUnifiedResourcesRequest) ProtoMessage()    {}
 func (*ListUnifiedResourcesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{160}
+	return fileDescriptor_0ffcffcda38ae159, []int{176}
 }
 func (m *ListUnifiedResourcesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11275,7 +12313,7 @@ func (m *ListUnifiedResourcesResponse) Reset()         { *m = ListUnifiedResourc
 func (m *ListUnifiedResourcesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListUnifiedResourcesResponse) ProtoMessage()    {}
 func (*ListUnifiedResourcesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{161}
+	return fileDescriptor_0ffcffcda38ae159, []int{177}
 }
 func (m *ListUnifiedResourcesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11371,7 +12409,7 @@ func (m *ListResourcesRequest) Reset()         { *m = ListResourcesRequest{} }
 func (m *ListResourcesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesRequest) ProtoMessage()    {}
 func (*ListResourcesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{162}
+	return fileDescriptor_0ffcffcda38ae159, []int{178}
 }
 func (m *ListResourcesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11522,7 +12560,7 @@ func (m *ResolveSSHTargetRequest) Reset()         { *m = ResolveSSHTargetRequest
 func (m *ResolveSSHTargetRequest) String() string { return proto.CompactTextString(m) }
 func (*ResolveSSHTargetRequest) ProtoMessage()    {}
 func (*ResolveSSHTargetRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{163}
+	return fileDescriptor_0ffcffcda38ae159, []int{179}
 }
 func (m *ResolveSSHTargetRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11599,7 +12637,7 @@ func (m *ResolveSSHTargetResponse) Reset()         { *m = ResolveSSHTargetRespon
 func (m *ResolveSSHTargetResponse) String() string { return proto.CompactTextString(m) }
 func (*ResolveSSHTargetResponse) ProtoMessage()    {}
 func (*ResolveSSHTargetResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{164}
+	return fileDescriptor_0ffcffcda38ae159, []int{180}
 }
 func (m *ResolveSSHTargetResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11651,7 +12689,7 @@ func (m *GetSSHTargetsRequest) Reset()         { *m = GetSSHTargetsRequest{} }
 func (m *GetSSHTargetsRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSSHTargetsRequest) ProtoMessage()    {}
 func (*GetSSHTargetsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{165}
+	return fileDescriptor_0ffcffcda38ae159, []int{181}
 }
 func (m *GetSSHTargetsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11707,7 +12745,7 @@ func (m *GetSSHTargetsResponse) Reset()         { *m = GetSSHTargetsResponse{} }
 func (m *GetSSHTargetsResponse) String() string { return proto.CompactTextString(m) }
 func (*GetSSHTargetsResponse) ProtoMessage()    {}
 func (*GetSSHTargetsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{166}
+	return fileDescriptor_0ffcffcda38ae159, []int{182}
 }
 func (m *GetSSHTargetsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11762,7 +12800,7 @@ func (m *ListResourcesResponse) Reset()         { *m = ListResourcesResponse{} }
 func (m *ListResourcesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesResponse) ProtoMessage()    {}
 func (*ListResourcesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{167}
+	return fileDescriptor_0ffcffcda38ae159, []int{183}
 }
 func (m *ListResourcesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11827,7 +12865,7 @@ func (m *CreateSessionTrackerRequest) Reset()         { *m = CreateSessionTracke
 func (m *CreateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSessionTrackerRequest) ProtoMessage()    {}
 func (*CreateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{168}
+	return fileDescriptor_0ffcffcda38ae159, []int{184}
 }
 func (m *CreateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11876,7 +12914,7 @@ func (m *GetSessionTrackerRequest) Reset()         { *m = GetSessionTrackerReque
 func (m *GetSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSessionTrackerRequest) ProtoMessage()    {}
 func (*GetSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{169}
+	return fileDescriptor_0ffcffcda38ae159, []int{185}
 }
 func (m *GetSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11925,7 +12963,7 @@ func (m *RemoveSessionTrackerRequest) Reset()         { *m = RemoveSessionTracke
 func (m *RemoveSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*RemoveSessionTrackerRequest) ProtoMessage()    {}
 func (*RemoveSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{170}
+	return fileDescriptor_0ffcffcda38ae159, []int{186}
 }
 func (m *RemoveSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11973,7 +13011,7 @@ func (m *SessionTrackerUpdateState) Reset()         { *m = SessionTrackerUpdateS
 func (m *SessionTrackerUpdateState) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerUpdateState) ProtoMessage()    {}
 func (*SessionTrackerUpdateState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{171}
+	return fileDescriptor_0ffcffcda38ae159, []int{187}
 }
 func (m *SessionTrackerUpdateState) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12021,7 +13059,7 @@ func (m *SessionTrackerAddParticipant) Reset()         { *m = SessionTrackerAddP
 func (m *SessionTrackerAddParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerAddParticipant) ProtoMessage()    {}
 func (*SessionTrackerAddParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{172}
+	return fileDescriptor_0ffcffcda38ae159, []int{188}
 }
 func (m *SessionTrackerAddParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12069,7 +13107,7 @@ func (m *SessionTrackerRemoveParticipant) Reset()         { *m = SessionTrackerR
 func (m *SessionTrackerRemoveParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerRemoveParticipant) ProtoMessage()    {}
 func (*SessionTrackerRemoveParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{173}
+	return fileDescriptor_0ffcffcda38ae159, []int{189}
 }
 func (m *SessionTrackerRemoveParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12118,7 +13156,7 @@ func (m *SessionTrackerUpdateExpiry) Reset()         { *m = SessionTrackerUpdate
 func (m *SessionTrackerUpdateExpiry) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerUpdateExpiry) ProtoMessage()    {}
 func (*SessionTrackerUpdateExpiry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{174}
+	return fileDescriptor_0ffcffcda38ae159, []int{190}
 }
 func (m *SessionTrackerUpdateExpiry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12173,7 +13211,7 @@ func (m *UpdateSessionTrackerRequest) Reset()         { *m = UpdateSessionTracke
 func (m *UpdateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateSessionTrackerRequest) ProtoMessage()    {}
 func (*UpdateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{175}
+	return fileDescriptor_0ffcffcda38ae159, []int{191}
 }
 func (m *UpdateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12297,7 +13335,7 @@ func (m *PresenceMFAChallengeRequest) Reset()         { *m = PresenceMFAChalleng
 func (m *PresenceMFAChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeRequest) ProtoMessage()    {}
 func (*PresenceMFAChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{176}
+	return fileDescriptor_0ffcffcda38ae159, []int{192}
 }
 func (m *PresenceMFAChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12362,7 +13400,7 @@ func (m *PresenceMFAChallengeSend) Reset()         { *m = PresenceMFAChallengeSe
 func (m *PresenceMFAChallengeSend) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeSend) ProtoMessage()    {}
 func (*PresenceMFAChallengeSend) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{177}
+	return fileDescriptor_0ffcffcda38ae159, []int{193}
 }
 func (m *PresenceMFAChallengeSend) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12449,7 +13487,7 @@ func (m *GetDomainNameResponse) Reset()         { *m = GetDomainNameResponse{} }
 func (m *GetDomainNameResponse) String() string { return proto.CompactTextString(m) }
 func (*GetDomainNameResponse) ProtoMessage()    {}
 func (*GetDomainNameResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{178}
+	return fileDescriptor_0ffcffcda38ae159, []int{194}
 }
 func (m *GetDomainNameResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12498,7 +13536,7 @@ func (m *GetClusterCACertResponse) Reset()         { *m = GetClusterCACertRespon
 func (m *GetClusterCACertResponse) String() string { return proto.CompactTextString(m) }
 func (*GetClusterCACertResponse) ProtoMessage()    {}
 func (*GetClusterCACertResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{179}
+	return fileDescriptor_0ffcffcda38ae159, []int{195}
 }
 func (m *GetClusterCACertResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12546,7 +13584,7 @@ func (m *GetLicenseResponse) Reset()         { *m = GetLicenseResponse{} }
 func (m *GetLicenseResponse) String() string { return proto.CompactTextString(m) }
 func (*GetLicenseResponse) ProtoMessage()    {}
 func (*GetLicenseResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{180}
+	return fileDescriptor_0ffcffcda38ae159, []int{196}
 }
 func (m *GetLicenseResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12594,7 +13632,7 @@ func (m *ListReleasesResponse) Reset()         { *m = ListReleasesResponse{} }
 func (m *ListReleasesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListReleasesResponse) ProtoMessage()    {}
 func (*ListReleasesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{181}
+	return fileDescriptor_0ffcffcda38ae159, []int{197}
 }
 func (m *ListReleasesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12643,7 +13681,7 @@ func (m *GetOIDCAuthRequestRequest) Reset()         { *m = GetOIDCAuthRequestReq
 func (m *GetOIDCAuthRequestRequest) String() string { return proto.CompactTextString(m) }
 func (*GetOIDCAuthRequestRequest) ProtoMessage()    {}
 func (*GetOIDCAuthRequestRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{182}
+	return fileDescriptor_0ffcffcda38ae159, []int{198}
 }
 func (m *GetOIDCAuthRequestRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12692,7 +13730,7 @@ func (m *GetSAMLAuthRequestRequest) Reset()         { *m = GetSAMLAuthRequestReq
 func (m *GetSAMLAuthRequestRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSAMLAuthRequestRequest) ProtoMessage()    {}
 func (*GetSAMLAuthRequestRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{183}
+	return fileDescriptor_0ffcffcda38ae159, []int{199}
 }
 func (m *GetSAMLAuthRequestRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12741,7 +13779,7 @@ func (m *GetGithubAuthRequestRequest) Reset()         { *m = GetGithubAuthReques
 func (m *GetGithubAuthRequestRequest) String() string { return proto.CompactTextString(m) }
 func (*GetGithubAuthRequestRequest) ProtoMessage()    {}
 func (*GetGithubAuthRequestRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{184}
+	return fileDescriptor_0ffcffcda38ae159, []int{200}
 }
 func (m *GetGithubAuthRequestRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12777,6 +13815,131 @@ func (m *GetGithubAuthRequestRequest) GetStateToken() string {
 	return ""
 }
 
+type ListOIDCConnectorsRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// WithSecrets specifies whether to load associated secrets.
+	WithSecrets          bool     `protobuf:"varint,3,opt,name=with_secrets,json=withSecrets,proto3" json:"with_secrets,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListOIDCConnectorsRequest) Reset()         { *m = ListOIDCConnectorsRequest{} }
+func (m *ListOIDCConnectorsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListOIDCConnectorsRequest) ProtoMessage()    {}
+func (*ListOIDCConnectorsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{201}
+}
+func (m *ListOIDCConnectorsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListOIDCConnectorsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListOIDCConnectorsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListOIDCConnectorsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListOIDCConnectorsRequest.Merge(m, src)
+}
+func (m *ListOIDCConnectorsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListOIDCConnectorsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListOIDCConnectorsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListOIDCConnectorsRequest proto.InternalMessageInfo
+
+func (m *ListOIDCConnectorsRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListOIDCConnectorsRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+func (m *ListOIDCConnectorsRequest) GetWithSecrets() bool {
+	if m != nil {
+		return m.WithSecrets
+	}
+	return false
+}
+
+type ListOIDCConnectorsResponse struct {
+	// Connectors is a list of OIDC connectors.
+	Connectors []*types.OIDCConnectorV3 `protobuf:"bytes,1,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListOIDCConnectorsResponse) Reset()         { *m = ListOIDCConnectorsResponse{} }
+func (m *ListOIDCConnectorsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListOIDCConnectorsResponse) ProtoMessage()    {}
+func (*ListOIDCConnectorsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{202}
+}
+func (m *ListOIDCConnectorsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListOIDCConnectorsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListOIDCConnectorsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListOIDCConnectorsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListOIDCConnectorsResponse.Merge(m, src)
+}
+func (m *ListOIDCConnectorsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListOIDCConnectorsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListOIDCConnectorsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListOIDCConnectorsResponse proto.InternalMessageInfo
+
+func (m *ListOIDCConnectorsResponse) GetConnectors() []*types.OIDCConnectorV3 {
+	if m != nil {
+		return m.Connectors
+	}
+	return nil
+}
+
+func (m *ListOIDCConnectorsResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // CreateOIDCConnectorRequest is a request for CreateOIDCConnector.
 type CreateOIDCConnectorRequest struct {
 	// Connector to be created.
@@ -12790,7 +13953,7 @@ func (m *CreateOIDCConnectorRequest) Reset()         { *m = CreateOIDCConnectorR
 func (m *CreateOIDCConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateOIDCConnectorRequest) ProtoMessage()    {}
 func (*CreateOIDCConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{185}
+	return fileDescriptor_0ffcffcda38ae159, []int{203}
 }
 func (m *CreateOIDCConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12839,7 +14002,7 @@ func (m *UpdateOIDCConnectorRequest) Reset()         { *m = UpdateOIDCConnectorR
 func (m *UpdateOIDCConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateOIDCConnectorRequest) ProtoMessage()    {}
 func (*UpdateOIDCConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{186}
+	return fileDescriptor_0ffcffcda38ae159, []int{204}
 }
 func (m *UpdateOIDCConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12888,7 +14051,7 @@ func (m *UpsertOIDCConnectorRequest) Reset()         { *m = UpsertOIDCConnectorR
 func (m *UpsertOIDCConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertOIDCConnectorRequest) ProtoMessage()    {}
 func (*UpsertOIDCConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{187}
+	return fileDescriptor_0ffcffcda38ae159, []int{205}
 }
 func (m *UpsertOIDCConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12937,7 +14100,7 @@ func (m *CreateSAMLConnectorRequest) Reset()         { *m = CreateSAMLConnectorR
 func (m *CreateSAMLConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSAMLConnectorRequest) ProtoMessage()    {}
 func (*CreateSAMLConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{188}
+	return fileDescriptor_0ffcffcda38ae159, []int{206}
 }
 func (m *CreateSAMLConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12986,7 +14149,7 @@ func (m *UpdateSAMLConnectorRequest) Reset()         { *m = UpdateSAMLConnectorR
 func (m *UpdateSAMLConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateSAMLConnectorRequest) ProtoMessage()    {}
 func (*UpdateSAMLConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{189}
+	return fileDescriptor_0ffcffcda38ae159, []int{207}
 }
 func (m *UpdateSAMLConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13035,7 +14198,7 @@ func (m *UpsertSAMLConnectorRequest) Reset()         { *m = UpsertSAMLConnectorR
 func (m *UpsertSAMLConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertSAMLConnectorRequest) ProtoMessage()    {}
 func (*UpsertSAMLConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{190}
+	return fileDescriptor_0ffcffcda38ae159, []int{208}
 }
 func (m *UpsertSAMLConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13071,6 +14234,266 @@ func (m *UpsertSAMLConnectorRequest) GetConnector() *types.SAMLConnectorV2 {
 	return nil
 }
 
+type ListSAMLConnectorsRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// WithSecrets specifies whether to load associated secrets.
+	WithSecrets bool `protobuf:"varint,3,opt,name=with_secrets,json=withSecrets,proto3" json:"with_secrets,omitempty"`
+	// NoFollowURLs specifies whether to skip following URLs when
+	// validating SAML connector resources.
+	NoFollowUrls         bool     `protobuf:"varint,4,opt,name=no_follow_urls,json=noFollowUrls,proto3" json:"no_follow_urls,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListSAMLConnectorsRequest) Reset()         { *m = ListSAMLConnectorsRequest{} }
+func (m *ListSAMLConnectorsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListSAMLConnectorsRequest) ProtoMessage()    {}
+func (*ListSAMLConnectorsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{209}
+}
+func (m *ListSAMLConnectorsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSAMLConnectorsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSAMLConnectorsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSAMLConnectorsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSAMLConnectorsRequest.Merge(m, src)
+}
+func (m *ListSAMLConnectorsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSAMLConnectorsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSAMLConnectorsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSAMLConnectorsRequest proto.InternalMessageInfo
+
+func (m *ListSAMLConnectorsRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListSAMLConnectorsRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+func (m *ListSAMLConnectorsRequest) GetWithSecrets() bool {
+	if m != nil {
+		return m.WithSecrets
+	}
+	return false
+}
+
+func (m *ListSAMLConnectorsRequest) GetNoFollowUrls() bool {
+	if m != nil {
+		return m.NoFollowUrls
+	}
+	return false
+}
+
+type ListSAMLConnectorsResponse struct {
+	// Connectors is a list of SAML connectors.
+	Connectors []*types.SAMLConnectorV2 `protobuf:"bytes,1,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListSAMLConnectorsResponse) Reset()         { *m = ListSAMLConnectorsResponse{} }
+func (m *ListSAMLConnectorsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListSAMLConnectorsResponse) ProtoMessage()    {}
+func (*ListSAMLConnectorsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{210}
+}
+func (m *ListSAMLConnectorsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSAMLConnectorsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSAMLConnectorsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSAMLConnectorsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSAMLConnectorsResponse.Merge(m, src)
+}
+func (m *ListSAMLConnectorsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSAMLConnectorsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSAMLConnectorsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSAMLConnectorsResponse proto.InternalMessageInfo
+
+func (m *ListSAMLConnectorsResponse) GetConnectors() []*types.SAMLConnectorV2 {
+	if m != nil {
+		return m.Connectors
+	}
+	return nil
+}
+
+func (m *ListSAMLConnectorsResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
+type ListGithubConnectorsRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// WithSecrets specifies whether to load associated secrets.
+	WithSecrets          bool     `protobuf:"varint,3,opt,name=with_secrets,json=withSecrets,proto3" json:"with_secrets,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListGithubConnectorsRequest) Reset()         { *m = ListGithubConnectorsRequest{} }
+func (m *ListGithubConnectorsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListGithubConnectorsRequest) ProtoMessage()    {}
+func (*ListGithubConnectorsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{211}
+}
+func (m *ListGithubConnectorsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListGithubConnectorsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListGithubConnectorsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListGithubConnectorsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListGithubConnectorsRequest.Merge(m, src)
+}
+func (m *ListGithubConnectorsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListGithubConnectorsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListGithubConnectorsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListGithubConnectorsRequest proto.InternalMessageInfo
+
+func (m *ListGithubConnectorsRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListGithubConnectorsRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+func (m *ListGithubConnectorsRequest) GetWithSecrets() bool {
+	if m != nil {
+		return m.WithSecrets
+	}
+	return false
+}
+
+type ListGithubConnectorsResponse struct {
+	// Connectors is a list of Github connectors.
+	Connectors []*types.GithubConnectorV3 `protobuf:"bytes,1,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListGithubConnectorsResponse) Reset()         { *m = ListGithubConnectorsResponse{} }
+func (m *ListGithubConnectorsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListGithubConnectorsResponse) ProtoMessage()    {}
+func (*ListGithubConnectorsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{212}
+}
+func (m *ListGithubConnectorsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListGithubConnectorsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListGithubConnectorsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListGithubConnectorsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListGithubConnectorsResponse.Merge(m, src)
+}
+func (m *ListGithubConnectorsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListGithubConnectorsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListGithubConnectorsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListGithubConnectorsResponse proto.InternalMessageInfo
+
+func (m *ListGithubConnectorsResponse) GetConnectors() []*types.GithubConnectorV3 {
+	if m != nil {
+		return m.Connectors
+	}
+	return nil
+}
+
+func (m *ListGithubConnectorsResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 // CreateGithubConnectorRequest is a request for CreateGithubConnector.
 type CreateGithubConnectorRequest struct {
 	// Connector to be created.
@@ -13084,7 +14507,7 @@ func (m *CreateGithubConnectorRequest) Reset()         { *m = CreateGithubConnec
 func (m *CreateGithubConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateGithubConnectorRequest) ProtoMessage()    {}
 func (*CreateGithubConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{191}
+	return fileDescriptor_0ffcffcda38ae159, []int{213}
 }
 func (m *CreateGithubConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13133,7 +14556,7 @@ func (m *UpdateGithubConnectorRequest) Reset()         { *m = UpdateGithubConnec
 func (m *UpdateGithubConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateGithubConnectorRequest) ProtoMessage()    {}
 func (*UpdateGithubConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{192}
+	return fileDescriptor_0ffcffcda38ae159, []int{214}
 }
 func (m *UpdateGithubConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13182,7 +14605,7 @@ func (m *UpsertGithubConnectorRequest) Reset()         { *m = UpsertGithubConnec
 func (m *UpsertGithubConnectorRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertGithubConnectorRequest) ProtoMessage()    {}
 func (*UpsertGithubConnectorRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{193}
+	return fileDescriptor_0ffcffcda38ae159, []int{215}
 }
 func (m *UpsertGithubConnectorRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13233,7 +14656,7 @@ func (m *GetSSODiagnosticInfoRequest) Reset()         { *m = GetSSODiagnosticInf
 func (m *GetSSODiagnosticInfoRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSSODiagnosticInfoRequest) ProtoMessage()    {}
 func (*GetSSODiagnosticInfoRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{194}
+	return fileDescriptor_0ffcffcda38ae159, []int{216}
 }
 func (m *GetSSODiagnosticInfoRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13299,7 +14722,7 @@ func (m *SystemRoleAssertion) Reset()         { *m = SystemRoleAssertion{} }
 func (m *SystemRoleAssertion) String() string { return proto.CompactTextString(m) }
 func (*SystemRoleAssertion) ProtoMessage()    {}
 func (*SystemRoleAssertion) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{195}
+	return fileDescriptor_0ffcffcda38ae159, []int{217}
 }
 func (m *SystemRoleAssertion) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13369,7 +14792,7 @@ func (m *SystemRoleAssertionSet) Reset()         { *m = SystemRoleAssertionSet{}
 func (m *SystemRoleAssertionSet) String() string { return proto.CompactTextString(m) }
 func (*SystemRoleAssertionSet) ProtoMessage()    {}
 func (*SystemRoleAssertionSet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{196}
+	return fileDescriptor_0ffcffcda38ae159, []int{218}
 }
 func (m *SystemRoleAssertionSet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13432,7 +14855,7 @@ func (m *InventoryConnectedServiceCountsRequest) Reset() {
 func (m *InventoryConnectedServiceCountsRequest) String() string { return proto.CompactTextString(m) }
 func (*InventoryConnectedServiceCountsRequest) ProtoMessage()    {}
 func (*InventoryConnectedServiceCountsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{197}
+	return fileDescriptor_0ffcffcda38ae159, []int{219}
 }
 func (m *InventoryConnectedServiceCountsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13474,7 +14897,7 @@ func (m *InventoryConnectedServiceCounts) Reset()         { *m = InventoryConnec
 func (m *InventoryConnectedServiceCounts) String() string { return proto.CompactTextString(m) }
 func (*InventoryConnectedServiceCounts) ProtoMessage()    {}
 func (*InventoryConnectedServiceCounts) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{198}
+	return fileDescriptor_0ffcffcda38ae159, []int{220}
 }
 func (m *InventoryConnectedServiceCounts) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13528,7 +14951,7 @@ func (m *InventoryPingRequest) Reset()         { *m = InventoryPingRequest{} }
 func (m *InventoryPingRequest) String() string { return proto.CompactTextString(m) }
 func (*InventoryPingRequest) ProtoMessage()    {}
 func (*InventoryPingRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{199}
+	return fileDescriptor_0ffcffcda38ae159, []int{221}
 }
 func (m *InventoryPingRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13585,7 +15008,7 @@ func (m *InventoryPingResponse) Reset()         { *m = InventoryPingResponse{} }
 func (m *InventoryPingResponse) String() string { return proto.CompactTextString(m) }
 func (*InventoryPingResponse) ProtoMessage()    {}
 func (*InventoryPingResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{200}
+	return fileDescriptor_0ffcffcda38ae159, []int{222}
 }
 func (m *InventoryPingResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13634,7 +15057,7 @@ func (m *GetClusterAlertsResponse) Reset()         { *m = GetClusterAlertsRespon
 func (m *GetClusterAlertsResponse) String() string { return proto.CompactTextString(m) }
 func (*GetClusterAlertsResponse) ProtoMessage()    {}
 func (*GetClusterAlertsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{201}
+	return fileDescriptor_0ffcffcda38ae159, []int{223}
 }
 func (m *GetClusterAlertsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13681,7 +15104,7 @@ func (m *GetAlertAcksRequest) Reset()         { *m = GetAlertAcksRequest{} }
 func (m *GetAlertAcksRequest) String() string { return proto.CompactTextString(m) }
 func (*GetAlertAcksRequest) ProtoMessage()    {}
 func (*GetAlertAcksRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{202}
+	return fileDescriptor_0ffcffcda38ae159, []int{224}
 }
 func (m *GetAlertAcksRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13723,7 +15146,7 @@ func (m *GetAlertAcksResponse) Reset()         { *m = GetAlertAcksResponse{} }
 func (m *GetAlertAcksResponse) String() string { return proto.CompactTextString(m) }
 func (*GetAlertAcksResponse) ProtoMessage()    {}
 func (*GetAlertAcksResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{203}
+	return fileDescriptor_0ffcffcda38ae159, []int{225}
 }
 func (m *GetAlertAcksResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13773,7 +15196,7 @@ func (m *ClearAlertAcksRequest) Reset()         { *m = ClearAlertAcksRequest{} }
 func (m *ClearAlertAcksRequest) String() string { return proto.CompactTextString(m) }
 func (*ClearAlertAcksRequest) ProtoMessage()    {}
 func (*ClearAlertAcksRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{204}
+	return fileDescriptor_0ffcffcda38ae159, []int{226}
 }
 func (m *ClearAlertAcksRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13822,7 +15245,7 @@ func (m *UpsertClusterAlertRequest) Reset()         { *m = UpsertClusterAlertReq
 func (m *UpsertClusterAlertRequest) String() string { return proto.CompactTextString(m) }
 func (*UpsertClusterAlertRequest) ProtoMessage()    {}
 func (*UpsertClusterAlertRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{205}
+	return fileDescriptor_0ffcffcda38ae159, []int{227}
 }
 func (m *UpsertClusterAlertRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13871,7 +15294,7 @@ func (m *GetConnectionDiagnosticRequest) Reset()         { *m = GetConnectionDia
 func (m *GetConnectionDiagnosticRequest) String() string { return proto.CompactTextString(m) }
 func (*GetConnectionDiagnosticRequest) ProtoMessage()    {}
 func (*GetConnectionDiagnosticRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{206}
+	return fileDescriptor_0ffcffcda38ae159, []int{228}
 }
 func (m *GetConnectionDiagnosticRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13922,7 +15345,7 @@ func (m *AppendDiagnosticTraceRequest) Reset()         { *m = AppendDiagnosticTr
 func (m *AppendDiagnosticTraceRequest) String() string { return proto.CompactTextString(m) }
 func (*AppendDiagnosticTraceRequest) ProtoMessage()    {}
 func (*AppendDiagnosticTraceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{207}
+	return fileDescriptor_0ffcffcda38ae159, []int{229}
 }
 func (m *AppendDiagnosticTraceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13977,7 +15400,7 @@ func (m *SubmitUsageEventRequest) Reset()         { *m = SubmitUsageEventRequest
 func (m *SubmitUsageEventRequest) String() string { return proto.CompactTextString(m) }
 func (*SubmitUsageEventRequest) ProtoMessage()    {}
 func (*SubmitUsageEventRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{208}
+	return fileDescriptor_0ffcffcda38ae159, []int{230}
 }
 func (m *SubmitUsageEventRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14024,7 +15447,7 @@ func (m *GetLicenseRequest) Reset()         { *m = GetLicenseRequest{} }
 func (m *GetLicenseRequest) String() string { return proto.CompactTextString(m) }
 func (*GetLicenseRequest) ProtoMessage()    {}
 func (*GetLicenseRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{209}
+	return fileDescriptor_0ffcffcda38ae159, []int{231}
 }
 func (m *GetLicenseRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14064,7 +15487,7 @@ func (m *ListReleasesRequest) Reset()         { *m = ListReleasesRequest{} }
 func (m *ListReleasesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListReleasesRequest) ProtoMessage()    {}
 func (*ListReleasesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{210}
+	return fileDescriptor_0ffcffcda38ae159, []int{232}
 }
 func (m *ListReleasesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14108,7 +15531,7 @@ func (m *CreateTokenV2Request) Reset()         { *m = CreateTokenV2Request{} }
 func (m *CreateTokenV2Request) String() string { return proto.CompactTextString(m) }
 func (*CreateTokenV2Request) ProtoMessage()    {}
 func (*CreateTokenV2Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{211}
+	return fileDescriptor_0ffcffcda38ae159, []int{233}
 }
 func (m *CreateTokenV2Request) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14185,7 +15608,7 @@ func (m *UpsertTokenV2Request) Reset()         { *m = UpsertTokenV2Request{} }
 func (m *UpsertTokenV2Request) String() string { return proto.CompactTextString(m) }
 func (*UpsertTokenV2Request) ProtoMessage()    {}
 func (*UpsertTokenV2Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{212}
+	return fileDescriptor_0ffcffcda38ae159, []int{234}
 }
 func (m *UpsertTokenV2Request) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14260,7 +15683,7 @@ func (m *GetHeadlessAuthenticationRequest) Reset()         { *m = GetHeadlessAut
 func (m *GetHeadlessAuthenticationRequest) String() string { return proto.CompactTextString(m) }
 func (*GetHeadlessAuthenticationRequest) ProtoMessage()    {}
 func (*GetHeadlessAuthenticationRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{213}
+	return fileDescriptor_0ffcffcda38ae159, []int{235}
 }
 func (m *GetHeadlessAuthenticationRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14318,7 +15741,7 @@ func (m *UpdateHeadlessAuthenticationStateRequest) Reset() {
 func (m *UpdateHeadlessAuthenticationStateRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateHeadlessAuthenticationStateRequest) ProtoMessage()    {}
 func (*UpdateHeadlessAuthenticationStateRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{214}
+	return fileDescriptor_0ffcffcda38ae159, []int{236}
 }
 func (m *UpdateHeadlessAuthenticationStateRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14384,7 +15807,7 @@ func (m *ExportUpgradeWindowsRequest) Reset()         { *m = ExportUpgradeWindow
 func (m *ExportUpgradeWindowsRequest) String() string { return proto.CompactTextString(m) }
 func (*ExportUpgradeWindowsRequest) ProtoMessage()    {}
 func (*ExportUpgradeWindowsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{215}
+	return fileDescriptor_0ffcffcda38ae159, []int{237}
 }
 func (m *ExportUpgradeWindowsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14450,7 +15873,7 @@ func (m *ExportUpgradeWindowsResponse) Reset()         { *m = ExportUpgradeWindo
 func (m *ExportUpgradeWindowsResponse) String() string { return proto.CompactTextString(m) }
 func (*ExportUpgradeWindowsResponse) ProtoMessage()    {}
 func (*ExportUpgradeWindowsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{216}
+	return fileDescriptor_0ffcffcda38ae159, []int{238}
 }
 func (m *ExportUpgradeWindowsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14525,7 +15948,7 @@ func (m *ListAccessRequestsRequest) Reset()         { *m = ListAccessRequestsReq
 func (m *ListAccessRequestsRequest) String() string { return proto.CompactTextString(m) }
 func (*ListAccessRequestsRequest) ProtoMessage()    {}
 func (*ListAccessRequestsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{217}
+	return fileDescriptor_0ffcffcda38ae159, []int{239}
 }
 func (m *ListAccessRequestsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14604,7 +16027,7 @@ func (m *ListAccessRequestsResponse) Reset()         { *m = ListAccessRequestsRe
 func (m *ListAccessRequestsResponse) String() string { return proto.CompactTextString(m) }
 func (*ListAccessRequestsResponse) ProtoMessage()    {}
 func (*ListAccessRequestsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{218}
+	return fileDescriptor_0ffcffcda38ae159, []int{240}
 }
 func (m *ListAccessRequestsResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14660,7 +16083,7 @@ func (m *AccessRequestAllowedPromotionRequest) Reset()         { *m = AccessRequ
 func (m *AccessRequestAllowedPromotionRequest) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestAllowedPromotionRequest) ProtoMessage()    {}
 func (*AccessRequestAllowedPromotionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{219}
+	return fileDescriptor_0ffcffcda38ae159, []int{241}
 }
 func (m *AccessRequestAllowedPromotionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14709,7 +16132,7 @@ func (m *AccessRequestAllowedPromotionResponse) Reset()         { *m = AccessReq
 func (m *AccessRequestAllowedPromotionResponse) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestAllowedPromotionResponse) ProtoMessage()    {}
 func (*AccessRequestAllowedPromotionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0ffcffcda38ae159, []int{220}
+	return fileDescriptor_0ffcffcda38ae159, []int{242}
 }
 func (m *AccessRequestAllowedPromotionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14745,6 +16168,377 @@ func (m *AccessRequestAllowedPromotionResponse) GetAllowedPromotions() *types.Ac
 	return nil
 }
 
+// ListProvisionTokensRequest is used to retrieve a paginated list of provision tokens.
+type ListProvisionTokensRequest struct {
+	// Limit is the maximum amount of items per page.
+	Limit int32 `protobuf:"varint,1,opt,name=Limit,proto3" json:"Limit,omitempty"`
+	// StartKey is used to resume a query in order to enable pagination.
+	// If the previous response had NextKey set then this should be
+	// set to its value. Otherwise leave empty.
+	StartKey string `protobuf:"bytes,2,opt,name=StartKey,proto3" json:"StartKey,omitempty"`
+	// FilterRoles allows filtering for tokens with the provided roles. Tokens
+	// with ANY of the provided roles are returned.
+	FilterRoles []string `protobuf:"bytes,3,rep,name=FilterRoles,proto3" json:"FilterRoles,omitempty"`
+	// FilterBotName allows filtering for tokens associated with the
+	// named bot. In addition, only items with a role of Bot are returned.
+	FilterBotName        string   `protobuf:"bytes,4,opt,name=FilterBotName,proto3" json:"FilterBotName,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListProvisionTokensRequest) Reset()         { *m = ListProvisionTokensRequest{} }
+func (m *ListProvisionTokensRequest) String() string { return proto.CompactTextString(m) }
+func (*ListProvisionTokensRequest) ProtoMessage()    {}
+func (*ListProvisionTokensRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{243}
+}
+func (m *ListProvisionTokensRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListProvisionTokensRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListProvisionTokensRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListProvisionTokensRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListProvisionTokensRequest.Merge(m, src)
+}
+func (m *ListProvisionTokensRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListProvisionTokensRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListProvisionTokensRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListProvisionTokensRequest proto.InternalMessageInfo
+
+func (m *ListProvisionTokensRequest) GetLimit() int32 {
+	if m != nil {
+		return m.Limit
+	}
+	return 0
+}
+
+func (m *ListProvisionTokensRequest) GetStartKey() string {
+	if m != nil {
+		return m.StartKey
+	}
+	return ""
+}
+
+func (m *ListProvisionTokensRequest) GetFilterRoles() []string {
+	if m != nil {
+		return m.FilterRoles
+	}
+	return nil
+}
+
+func (m *ListProvisionTokensRequest) GetFilterBotName() string {
+	if m != nil {
+		return m.FilterBotName
+	}
+	return ""
+}
+
+// ListProvisionTokensResponse is used to retrieve a paginated list of provision tokens.
+type ListProvisionTokensResponse struct {
+	// Tokens is the list of tokens.
+	Tokens []*types.ProvisionTokenV2 `protobuf:"bytes,1,rep,name=Tokens,proto3" json:"Tokens,omitempty"`
+	// NextKey is used to resume a query in order to enable pagination.
+	// Leave empty to start at the beginning.
+	NextKey              string   `protobuf:"bytes,2,opt,name=NextKey,proto3" json:"NextKey,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListProvisionTokensResponse) Reset()         { *m = ListProvisionTokensResponse{} }
+func (m *ListProvisionTokensResponse) String() string { return proto.CompactTextString(m) }
+func (*ListProvisionTokensResponse) ProtoMessage()    {}
+func (*ListProvisionTokensResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{244}
+}
+func (m *ListProvisionTokensResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListProvisionTokensResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListProvisionTokensResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListProvisionTokensResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListProvisionTokensResponse.Merge(m, src)
+}
+func (m *ListProvisionTokensResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListProvisionTokensResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListProvisionTokensResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListProvisionTokensResponse proto.InternalMessageInfo
+
+func (m *ListProvisionTokensResponse) GetTokens() []*types.ProvisionTokenV2 {
+	if m != nil {
+		return m.Tokens
+	}
+	return nil
+}
+
+func (m *ListProvisionTokensResponse) GetNextKey() string {
+	if m != nil {
+		return m.NextKey
+	}
+	return ""
+}
+
+type ListKubernetesClustersRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListKubernetesClustersRequest) Reset()         { *m = ListKubernetesClustersRequest{} }
+func (m *ListKubernetesClustersRequest) String() string { return proto.CompactTextString(m) }
+func (*ListKubernetesClustersRequest) ProtoMessage()    {}
+func (*ListKubernetesClustersRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{245}
+}
+func (m *ListKubernetesClustersRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListKubernetesClustersRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListKubernetesClustersRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListKubernetesClustersRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListKubernetesClustersRequest.Merge(m, src)
+}
+func (m *ListKubernetesClustersRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListKubernetesClustersRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListKubernetesClustersRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListKubernetesClustersRequest proto.InternalMessageInfo
+
+func (m *ListKubernetesClustersRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListKubernetesClustersRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+type ListKubernetesClustersResponse struct {
+	// KubernetesClusters is a list of kubernetes cluster resources.
+	KubernetesClusters []*types.KubernetesClusterV3 `protobuf:"bytes,1,rep,name=kubernetes_clusters,json=kubernetesClusters,proto3" json:"kubernetes_clusters,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListKubernetesClustersResponse) Reset()         { *m = ListKubernetesClustersResponse{} }
+func (m *ListKubernetesClustersResponse) String() string { return proto.CompactTextString(m) }
+func (*ListKubernetesClustersResponse) ProtoMessage()    {}
+func (*ListKubernetesClustersResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{246}
+}
+func (m *ListKubernetesClustersResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListKubernetesClustersResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListKubernetesClustersResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListKubernetesClustersResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListKubernetesClustersResponse.Merge(m, src)
+}
+func (m *ListKubernetesClustersResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListKubernetesClustersResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListKubernetesClustersResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListKubernetesClustersResponse proto.InternalMessageInfo
+
+func (m *ListKubernetesClustersResponse) GetKubernetesClusters() []*types.KubernetesClusterV3 {
+	if m != nil {
+		return m.KubernetesClusters
+	}
+	return nil
+}
+
+func (m *ListKubernetesClustersResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
+type ListSnowflakeSessionsRequest struct {
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken            string   `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListSnowflakeSessionsRequest) Reset()         { *m = ListSnowflakeSessionsRequest{} }
+func (m *ListSnowflakeSessionsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListSnowflakeSessionsRequest) ProtoMessage()    {}
+func (*ListSnowflakeSessionsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{247}
+}
+func (m *ListSnowflakeSessionsRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSnowflakeSessionsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSnowflakeSessionsRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSnowflakeSessionsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSnowflakeSessionsRequest.Merge(m, src)
+}
+func (m *ListSnowflakeSessionsRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSnowflakeSessionsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSnowflakeSessionsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSnowflakeSessionsRequest proto.InternalMessageInfo
+
+func (m *ListSnowflakeSessionsRequest) GetPageSize() int32 {
+	if m != nil {
+		return m.PageSize
+	}
+	return 0
+}
+
+func (m *ListSnowflakeSessionsRequest) GetPageToken() string {
+	if m != nil {
+		return m.PageToken
+	}
+	return ""
+}
+
+type ListSnowflakeSessionsResponse struct {
+	// Sessions is a list of Snowflake web sessions.
+	Sessions []*types.WebSessionV2 `protobuf:"bytes,1,rep,name=sessions,proto3" json:"sessions,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken        string   `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListSnowflakeSessionsResponse) Reset()         { *m = ListSnowflakeSessionsResponse{} }
+func (m *ListSnowflakeSessionsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListSnowflakeSessionsResponse) ProtoMessage()    {}
+func (*ListSnowflakeSessionsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_0ffcffcda38ae159, []int{248}
+}
+func (m *ListSnowflakeSessionsResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ListSnowflakeSessionsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ListSnowflakeSessionsResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ListSnowflakeSessionsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListSnowflakeSessionsResponse.Merge(m, src)
+}
+func (m *ListSnowflakeSessionsResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *ListSnowflakeSessionsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListSnowflakeSessionsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListSnowflakeSessionsResponse proto.InternalMessageInfo
+
+func (m *ListSnowflakeSessionsResponse) GetSessions() []*types.WebSessionV2 {
+	if m != nil {
+		return m.Sessions
+	}
+	return nil
+}
+
+func (m *ListSnowflakeSessionsResponse) GetNextPageToken() string {
+	if m != nil {
+		return m.NextPageToken
+	}
+	return ""
+}
+
 func init() {
 	proto.RegisterEnum("proto.ProductType", ProductType_name, ProductType_value)
 	proto.RegisterEnum("proto.SupportType", SupportType_name, SupportType_value)
@@ -14769,11 +16563,15 @@ func init() {
 	proto.RegisterType((*GetUserRequest)(nil), "proto.GetUserRequest")
 	proto.RegisterType((*GetUsersRequest)(nil), "proto.GetUsersRequest")
 	proto.RegisterType((*ChangePasswordRequest)(nil), "proto.ChangePasswordRequest")
+	proto.RegisterType((*ListSemaphoresRequest)(nil), "proto.ListSemaphoresRequest")
+	proto.RegisterType((*ListSemaphoresResponse)(nil), "proto.ListSemaphoresResponse")
 	proto.RegisterType((*PluginDataSeq)(nil), "proto.PluginDataSeq")
 	proto.RegisterType((*RequestStateSetter)(nil), "proto.RequestStateSetter")
 	proto.RegisterType((*RequestID)(nil), "proto.RequestID")
 	proto.RegisterType((*GetResetPasswordTokenRequest)(nil), "proto.GetResetPasswordTokenRequest")
 	proto.RegisterType((*CreateResetPasswordTokenRequest)(nil), "proto.CreateResetPasswordTokenRequest")
+	proto.RegisterType((*ListResetPasswordTokenRequest)(nil), "proto.ListResetPasswordTokenRequest")
+	proto.RegisterType((*ListResetPasswordTokenResponse)(nil), "proto.ListResetPasswordTokenResponse")
 	proto.RegisterType((*RenewableCertsRequest)(nil), "proto.RenewableCertsRequest")
 	proto.RegisterType((*PingRequest)(nil), "proto.PingRequest")
 	proto.RegisterType((*PingResponse)(nil), "proto.PingResponse")
@@ -14825,6 +16623,8 @@ func init() {
 	proto.RegisterType((*GetWebSessionsResponse)(nil), "proto.GetWebSessionsResponse")
 	proto.RegisterType((*GetWebTokenResponse)(nil), "proto.GetWebTokenResponse")
 	proto.RegisterType((*GetWebTokensResponse)(nil), "proto.GetWebTokensResponse")
+	proto.RegisterType((*ListWebTokensRequest)(nil), "proto.ListWebTokensRequest")
+	proto.RegisterType((*ListWebTokensResponse)(nil), "proto.ListWebTokensResponse")
 	proto.RegisterType((*UpsertKubernetesServerRequest)(nil), "proto.UpsertKubernetesServerRequest")
 	proto.RegisterType((*DeleteKubernetesServerRequest)(nil), "proto.DeleteKubernetesServerRequest")
 	proto.RegisterType((*DeleteAllKubernetesServersRequest)(nil), "proto.DeleteAllKubernetesServersRequest")
@@ -14879,13 +16679,22 @@ func init() {
 	proto.RegisterType((*Events)(nil), "proto.Events")
 	proto.RegisterType((*GetLocksRequest)(nil), "proto.GetLocksRequest")
 	proto.RegisterType((*GetLocksResponse)(nil), "proto.GetLocksResponse")
+	proto.RegisterType((*ListLocksRequest)(nil), "proto.ListLocksRequest")
+	proto.RegisterType((*ListLocksResponse)(nil), "proto.ListLocksResponse")
 	proto.RegisterType((*GetLockRequest)(nil), "proto.GetLockRequest")
 	proto.RegisterType((*DeleteLockRequest)(nil), "proto.DeleteLockRequest")
 	proto.RegisterType((*ReplaceRemoteLocksRequest)(nil), "proto.ReplaceRemoteLocksRequest")
+	proto.RegisterType((*ListAppsRequest)(nil), "proto.ListAppsRequest")
+	proto.RegisterType((*ListAppsResponse)(nil), "proto.ListAppsResponse")
+	proto.RegisterType((*ListDatabasesRequest)(nil), "proto.ListDatabasesRequest")
+	proto.RegisterType((*ListDatabasesResponse)(nil), "proto.ListDatabasesResponse")
 	proto.RegisterType((*GetWindowsDesktopServicesResponse)(nil), "proto.GetWindowsDesktopServicesResponse")
 	proto.RegisterType((*GetWindowsDesktopServiceRequest)(nil), "proto.GetWindowsDesktopServiceRequest")
 	proto.RegisterType((*GetWindowsDesktopServiceResponse)(nil), "proto.GetWindowsDesktopServiceResponse")
 	proto.RegisterType((*DeleteWindowsDesktopServiceRequest)(nil), "proto.DeleteWindowsDesktopServiceRequest")
+	proto.RegisterType((*ListWindowsDesktopsRequest)(nil), "proto.ListWindowsDesktopsRequest")
+	proto.RegisterMapType((map[string]string)(nil), "proto.ListWindowsDesktopsRequest.LabelsEntry")
+	proto.RegisterType((*ListWindowsDesktopsResponse)(nil), "proto.ListWindowsDesktopsResponse")
 	proto.RegisterType((*GetWindowsDesktopsResponse)(nil), "proto.GetWindowsDesktopsResponse")
 	proto.RegisterType((*DeleteWindowsDesktopRequest)(nil), "proto.DeleteWindowsDesktopRequest")
 	proto.RegisterType((*WindowsDesktopCertRequest)(nil), "proto.WindowsDesktopCertRequest")
@@ -14919,6 +16728,8 @@ func init() {
 	proto.RegisterType((*IdentityCenterAccount)(nil), "proto.IdentityCenterAccount")
 	proto.RegisterType((*IdentityCenterPermissionSet)(nil), "proto.IdentityCenterPermissionSet")
 	proto.RegisterType((*IdentityCenterAccountAssignment)(nil), "proto.IdentityCenterAccountAssignment")
+	proto.RegisterType((*ListInstallersRequest)(nil), "proto.ListInstallersRequest")
+	proto.RegisterType((*ListInstallersResponse)(nil), "proto.ListInstallersResponse")
 	proto.RegisterType((*PaginatedResource)(nil), "proto.PaginatedResource")
 	proto.RegisterType((*ListUnifiedResourcesRequest)(nil), "proto.ListUnifiedResourcesRequest")
 	proto.RegisterMapType((map[string]string)(nil), "proto.ListUnifiedResourcesRequest.LabelsEntry")
@@ -14948,12 +16759,18 @@ func init() {
 	proto.RegisterType((*GetOIDCAuthRequestRequest)(nil), "proto.GetOIDCAuthRequestRequest")
 	proto.RegisterType((*GetSAMLAuthRequestRequest)(nil), "proto.GetSAMLAuthRequestRequest")
 	proto.RegisterType((*GetGithubAuthRequestRequest)(nil), "proto.GetGithubAuthRequestRequest")
+	proto.RegisterType((*ListOIDCConnectorsRequest)(nil), "proto.ListOIDCConnectorsRequest")
+	proto.RegisterType((*ListOIDCConnectorsResponse)(nil), "proto.ListOIDCConnectorsResponse")
 	proto.RegisterType((*CreateOIDCConnectorRequest)(nil), "proto.CreateOIDCConnectorRequest")
 	proto.RegisterType((*UpdateOIDCConnectorRequest)(nil), "proto.UpdateOIDCConnectorRequest")
 	proto.RegisterType((*UpsertOIDCConnectorRequest)(nil), "proto.UpsertOIDCConnectorRequest")
 	proto.RegisterType((*CreateSAMLConnectorRequest)(nil), "proto.CreateSAMLConnectorRequest")
 	proto.RegisterType((*UpdateSAMLConnectorRequest)(nil), "proto.UpdateSAMLConnectorRequest")
 	proto.RegisterType((*UpsertSAMLConnectorRequest)(nil), "proto.UpsertSAMLConnectorRequest")
+	proto.RegisterType((*ListSAMLConnectorsRequest)(nil), "proto.ListSAMLConnectorsRequest")
+	proto.RegisterType((*ListSAMLConnectorsResponse)(nil), "proto.ListSAMLConnectorsResponse")
+	proto.RegisterType((*ListGithubConnectorsRequest)(nil), "proto.ListGithubConnectorsRequest")
+	proto.RegisterType((*ListGithubConnectorsResponse)(nil), "proto.ListGithubConnectorsResponse")
 	proto.RegisterType((*CreateGithubConnectorRequest)(nil), "proto.CreateGithubConnectorRequest")
 	proto.RegisterType((*UpdateGithubConnectorRequest)(nil), "proto.UpdateGithubConnectorRequest")
 	proto.RegisterType((*UpsertGithubConnectorRequest)(nil), "proto.UpsertGithubConnectorRequest")
@@ -14985,6 +16802,12 @@ func init() {
 	proto.RegisterType((*ListAccessRequestsResponse)(nil), "proto.ListAccessRequestsResponse")
 	proto.RegisterType((*AccessRequestAllowedPromotionRequest)(nil), "proto.AccessRequestAllowedPromotionRequest")
 	proto.RegisterType((*AccessRequestAllowedPromotionResponse)(nil), "proto.AccessRequestAllowedPromotionResponse")
+	proto.RegisterType((*ListProvisionTokensRequest)(nil), "proto.ListProvisionTokensRequest")
+	proto.RegisterType((*ListProvisionTokensResponse)(nil), "proto.ListProvisionTokensResponse")
+	proto.RegisterType((*ListKubernetesClustersRequest)(nil), "proto.ListKubernetesClustersRequest")
+	proto.RegisterType((*ListKubernetesClustersResponse)(nil), "proto.ListKubernetesClustersResponse")
+	proto.RegisterType((*ListSnowflakeSessionsRequest)(nil), "proto.ListSnowflakeSessionsRequest")
+	proto.RegisterType((*ListSnowflakeSessionsResponse)(nil), "proto.ListSnowflakeSessionsResponse")
 }
 
 func init() {
@@ -14992,924 +16815,988 @@ func init() {
 }
 
 var fileDescriptor_0ffcffcda38ae159 = []byte{
-	// 14666 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0xbd, 0x5b, 0x6c, 0x5c, 0x49,
-	0x96, 0x20, 0xa6, 0xe4, 0x9b, 0x87, 0xaf, 0x54, 0x90, 0x14, 0xa9, 0xd4, 0x23, 0xa5, 0xab, 0x92,
-	0x4a, 0x55, 0x5d, 0xad, 0x07, 0x55, 0x5d, 0x5d, 0x8f, 0xae, 0xaa, 0xce, 0x24, 0x29, 0x91, 0x12,
-	0x1f, 0x59, 0x37, 0x49, 0xaa, 0x5e, 0xd3, 0xd9, 0x57, 0x99, 0x21, 0xf2, 0x8e, 0x92, 0x79, 0xb3,
-	0xef, 0xbd, 0x29, 0x95, 0x7a, 0xdc, 0x63, 0xcc, 0x8c, 0x1f, 0xf3, 0x63, 0x7b, 0x0c, 0xd8, 0xc6,
-	0x18, 0x63, 0xd8, 0xb0, 0x3d, 0xfe, 0x31, 0x6c, 0xc0, 0x3f, 0xc6, 0x7c, 0xcd, 0x02, 0xfb, 0xb5,
-	0xbd, 0x83, 0x5d, 0xec, 0x02, 0x8b, 0xf9, 0xd9, 0x0f, 0xce, 0x6e, 0x03, 0xf3, 0x43, 0xec, 0x7e,
-	0x0c, 0x16, 0xbb, 0xc0, 0xf6, 0x62, 0x80, 0x45, 0x9c, 0x78, 0xdc, 0x88, 0xfb, 0x4a, 0x52, 0xa5,
-	0xea, 0xd9, 0x1f, 0x89, 0x19, 0x71, 0xce, 0x89, 0xe7, 0x3d, 0x71, 0xce, 0x89, 0x13, 0xe7, 0xc0,
-	0xad, 0x90, 0xb6, 0x69, 0xd7, 0xf3, 0xc3, 0xdb, 0x6d, 0xba, 0xef, 0x34, 0x5f, 0xde, 0x6e, 0xb6,
-	0x5d, 0xda, 0x09, 0x6f, 0x77, 0x7d, 0x2f, 0xf4, 0x6e, 0x3b, 0xbd, 0xf0, 0x20, 0xa0, 0xfe, 0x73,
-	0xb7, 0x49, 0x6f, 0x61, 0x09, 0x19, 0xc6, 0xff, 0x4a, 0x73, 0xfb, 0xde, 0xbe, 0xc7, 0x61, 0xd8,
-	0x5f, 0xbc, 0xb2, 0x74, 0x61, 0xdf, 0xf3, 0xf6, 0xdb, 0x94, 0x23, 0x3f, 0xe9, 0x3d, 0xbd, 0x4d,
-	0x0f, 0xbb, 0xe1, 0x4b, 0x51, 0x59, 0x8e, 0x57, 0x86, 0xee, 0x21, 0x0d, 0x42, 0xe7, 0xb0, 0x2b,
-	0x00, 0xde, 0x52, 0x5d, 0x71, 0xc2, 0x90, 0xd5, 0x84, 0xae, 0xd7, 0xb9, 0xfd, 0xfc, 0xae, 0xfe,
-	0x53, 0x80, 0xde, 0xcc, 0xed, 0x75, 0x93, 0xfa, 0x61, 0x70, 0x22, 0x48, 0xfa, 0x9c, 0x76, 0x42,
-	0x01, 0xf9, 0x4e, 0x2e, 0xa4, 0xdb, 0x61, 0xa0, 0x9e, 0xff, 0x32, 0xd1, 0x59, 0x01, 0x1d, 0xbe,
-	0xec, 0xd2, 0x80, 0x13, 0x94, 0xff, 0x09, 0xd0, 0xab, 0xe9, 0xa0, 0xf8, 0xaf, 0x00, 0xf9, 0x7e,
-	0x3a, 0xc8, 0x0b, 0xfa, 0x84, 0xad, 0x40, 0x47, 0xfd, 0xd1, 0x07, 0xdc, 0x77, 0xba, 0x5d, 0xea,
-	0x47, 0x7f, 0x08, 0xf0, 0xf3, 0x0a, 0xfc, 0xf0, 0xa9, 0xc3, 0x26, 0xf4, 0xf0, 0xa9, 0x93, 0x18,
-	0x46, 0x2f, 0x70, 0xf6, 0xa9, 0xe8, 0xfe, 0xf3, 0xbb, 0xfa, 0x4f, 0x0e, 0x6a, 0xfd, 0x6f, 0x05,
-	0x18, 0x7e, 0xec, 0x84, 0xcd, 0x03, 0xf2, 0x29, 0x0c, 0x3f, 0x72, 0x3b, 0xad, 0x60, 0xb1, 0x70,
-	0x65, 0xf0, 0xe6, 0xc4, 0x52, 0xf1, 0x16, 0x1f, 0x0a, 0x56, 0xb2, 0x8a, 0xea, 0xc2, 0x2f, 0x8f,
-	0xca, 0x67, 0x8e, 0x8f, 0xca, 0x33, 0xcf, 0x18, 0xd8, 0x3b, 0xde, 0xa1, 0x1b, 0xe2, 0x4e, 0xb0,
-	0x39, 0x1e, 0xd9, 0x85, 0xd9, 0x4a, 0xbb, 0xed, 0xbd, 0xa8, 0x39, 0x7e, 0xe8, 0x3a, 0xed, 0x7a,
-	0xaf, 0xd9, 0xa4, 0x41, 0xb0, 0x38, 0x70, 0xa5, 0x70, 0x73, 0xac, 0x7a, 0xed, 0xf8, 0xa8, 0x5c,
-	0x76, 0x58, 0x75, 0xa3, 0xcb, 0xeb, 0x1b, 0x01, 0x07, 0xd0, 0x08, 0xa5, 0xe1, 0x5b, 0x7f, 0x31,
-	0x02, 0xc5, 0x35, 0x2f, 0x08, 0x97, 0xd9, 0xfa, 0xdb, 0xf4, 0x67, 0x3d, 0x1a, 0x84, 0xe4, 0x1a,
-	0x8c, 0xb0, 0xb2, 0xf5, 0x95, 0xc5, 0xc2, 0x95, 0xc2, 0xcd, 0xf1, 0xea, 0xc4, 0xf1, 0x51, 0x79,
-	0xf4, 0xc0, 0x0b, 0xc2, 0x86, 0xdb, 0xb2, 0x45, 0x15, 0x79, 0x0b, 0xc6, 0xb6, 0xbc, 0x16, 0xdd,
-	0x72, 0x0e, 0x29, 0xf6, 0x62, 0xbc, 0x3a, 0x75, 0x7c, 0x54, 0x1e, 0xef, 0x78, 0x2d, 0xda, 0xe8,
-	0x38, 0x87, 0xd4, 0x56, 0xd5, 0x64, 0x0f, 0x86, 0x6c, 0xaf, 0x4d, 0x17, 0x07, 0x11, 0xac, 0x7a,
-	0x7c, 0x54, 0x1e, 0xf2, 0xbd, 0x36, 0xfd, 0xf5, 0x51, 0xf9, 0xbd, 0x7d, 0x37, 0x3c, 0xe8, 0x3d,
-	0xb9, 0xd5, 0xf4, 0x0e, 0x6f, 0xef, 0xfb, 0xce, 0x73, 0x97, 0x6f, 0x59, 0xa7, 0x7d, 0x3b, 0xda,
-	0xd8, 0x5d, 0x57, 0xac, 0x7b, 0xfd, 0x65, 0x10, 0xd2, 0x43, 0x46, 0xc9, 0x46, 0x7a, 0xe4, 0x31,
-	0xcc, 0x55, 0x5a, 0x2d, 0x97, 0x63, 0xd4, 0x7c, 0xb7, 0xd3, 0x74, 0xbb, 0x4e, 0x3b, 0x58, 0x1c,
-	0xba, 0x32, 0x78, 0x73, 0x5c, 0x4c, 0x8a, 0xaa, 0x6f, 0x74, 0x15, 0x80, 0x36, 0x29, 0xa9, 0x04,
-	0xc8, 0x3d, 0x18, 0x5b, 0xd9, 0xaa, 0xb3, 0xbe, 0x07, 0x8b, 0xc3, 0x48, 0x6c, 0xe1, 0xf8, 0xa8,
-	0x3c, 0xdb, 0xea, 0x04, 0x38, 0x34, 0x9d, 0x80, 0x02, 0x24, 0xef, 0xc1, 0x64, 0xad, 0xf7, 0xa4,
-	0xed, 0x36, 0x77, 0x36, 0xea, 0x8f, 0xe8, 0xcb, 0xc5, 0x91, 0x2b, 0x85, 0x9b, 0x93, 0x55, 0x72,
-	0x7c, 0x54, 0x9e, 0xee, 0x62, 0x79, 0x23, 0x6c, 0x07, 0x8d, 0x67, 0xf4, 0xa5, 0x6d, 0xc0, 0x45,
-	0x78, 0xf5, 0xfa, 0x1a, 0xc3, 0x1b, 0x4d, 0xe0, 0x05, 0xc1, 0x81, 0x8e, 0xc7, 0xe1, 0xc8, 0x6d,
-	0x00, 0x9b, 0x1e, 0x7a, 0x21, 0xad, 0xb4, 0x5a, 0xfe, 0xe2, 0x18, 0xce, 0xed, 0xcc, 0xf1, 0x51,
-	0x79, 0xc2, 0xc7, 0xd2, 0x86, 0xd3, 0x6a, 0xf9, 0xb6, 0x06, 0x42, 0x96, 0x61, 0xcc, 0xf6, 0xf8,
-	0x04, 0x2f, 0x8e, 0x5f, 0x29, 0xdc, 0x9c, 0x58, 0x9a, 0x11, 0xdb, 0x50, 0x16, 0x57, 0xcf, 0x1d,
-	0x1f, 0x95, 0x89, 0x2f, 0x7e, 0xe9, 0xa3, 0x94, 0x10, 0xa4, 0x0c, 0xa3, 0x5b, 0xde, 0xb2, 0xd3,
-	0x3c, 0xa0, 0x8b, 0x80, 0x7b, 0x6f, 0xf8, 0xf8, 0xa8, 0x5c, 0xf8, 0xbe, 0x2d, 0x4b, 0xc9, 0x73,
-	0x98, 0x88, 0x16, 0x2a, 0x58, 0x9c, 0xc0, 0xe9, 0xdb, 0x39, 0x3e, 0x2a, 0x9f, 0x0b, 0xb0, 0xb8,
-	0xc1, 0x96, 0x5e, 0x9b, 0xc1, 0x6f, 0xb1, 0x0b, 0xf4, 0x86, 0xc8, 0xd7, 0x30, 0x1f, 0xfd, 0xac,
-	0x04, 0x01, 0xf5, 0x19, 0x8d, 0xf5, 0x95, 0xc5, 0x29, 0x9c, 0x99, 0x1b, 0xc7, 0x47, 0x65, 0x4b,
-	0xeb, 0x41, 0xc3, 0x91, 0x20, 0x0d, 0xb7, 0xa5, 0x8d, 0x34, 0x9d, 0xc8, 0xc3, 0xa1, 0xb1, 0xc9,
-	0xe2, 0x94, 0x7d, 0x69, 0xb7, 0x13, 0x84, 0xce, 0x93, 0x36, 0x4d, 0x05, 0xb2, 0xfe, 0xb6, 0x00,
-	0x64, 0xbb, 0x4b, 0x3b, 0xf5, 0xfa, 0x1a, 0xfb, 0x9e, 0xe4, 0xe7, 0xf4, 0x0e, 0x8c, 0xf3, 0x85,
-	0x63, 0xab, 0x3b, 0x80, 0xab, 0x3b, 0x7d, 0x7c, 0x54, 0x06, 0xb1, 0xba, 0x6c, 0x65, 0x23, 0x00,
-	0x72, 0x1d, 0x06, 0x77, 0x76, 0x36, 0xf0, 0x5b, 0x19, 0xac, 0xce, 0x1e, 0x1f, 0x95, 0x07, 0xc3,
-	0xb0, 0xfd, 0xeb, 0xa3, 0xf2, 0xd8, 0x4a, 0xcf, 0xc7, 0x69, 0xb1, 0x59, 0x3d, 0xb9, 0x0e, 0xa3,
-	0xcb, 0xed, 0x5e, 0x10, 0x52, 0x7f, 0x71, 0x28, 0xfa, 0x48, 0x9b, 0xbc, 0xc8, 0x96, 0x75, 0xe4,
-	0x7b, 0x30, 0xb4, 0x1b, 0x50, 0x7f, 0x71, 0x18, 0xd7, 0x7b, 0x4a, 0xac, 0x37, 0x2b, 0xda, 0x5b,
-	0xaa, 0x8e, 0xb1, 0x2f, 0xb1, 0x17, 0x50, 0xdf, 0x46, 0x20, 0x72, 0x0b, 0x86, 0xf9, 0xa2, 0x8d,
-	0x20, 0x93, 0x9a, 0x52, 0xbb, 0xa3, 0x4d, 0xf7, 0xde, 0xab, 0x8e, 0x1f, 0x1f, 0x95, 0x87, 0x71,
-	0xf1, 0x6c, 0x0e, 0xf6, 0x70, 0x68, 0xac, 0x50, 0x1c, 0xb0, 0xc7, 0x18, 0x2e, 0xfb, 0x2c, 0xac,
-	0xef, 0xc1, 0x84, 0x36, 0x7c, 0x72, 0x11, 0x86, 0xd8, 0xff, 0xc8, 0x44, 0x26, 0x79, 0x63, 0xec,
-	0x98, 0xb1, 0xb1, 0xd4, 0xfa, 0x7f, 0x66, 0xa1, 0xc8, 0x30, 0x0d, 0xce, 0x73, 0x13, 0x14, 0x35,
-	0xc1, 0x54, 0x26, 0x8f, 0x8f, 0xca, 0x63, 0x3d, 0x51, 0x16, 0xb5, 0x45, 0xea, 0x30, 0xba, 0xfa,
-	0x4d, 0xd7, 0xf5, 0x69, 0x80, 0x53, 0x35, 0xb1, 0x54, 0xba, 0xc5, 0x0f, 0xcb, 0x5b, 0xf2, 0xb0,
-	0xbc, 0xb5, 0x23, 0x0f, 0xcb, 0xea, 0x25, 0xc1, 0x5c, 0xcf, 0x52, 0x8e, 0x12, 0xad, 0xf7, 0x1f,
-	0xfd, 0x55, 0xb9, 0x60, 0x4b, 0x4a, 0xe4, 0x1d, 0x18, 0xb9, 0xef, 0xf9, 0x87, 0x4e, 0x28, 0xe6,
-	0x74, 0xee, 0xf8, 0xa8, 0x5c, 0x7c, 0x8a, 0x25, 0xda, 0x16, 0x11, 0x30, 0xe4, 0x3e, 0x4c, 0xdb,
-	0x5e, 0x2f, 0xa4, 0x3b, 0x9e, 0x5c, 0x89, 0x61, 0xc4, 0xba, 0x7c, 0x7c, 0x54, 0x2e, 0xf9, 0xac,
-	0xa6, 0x11, 0x7a, 0x0d, 0xb1, 0x24, 0x1a, 0x7e, 0x0c, 0x8b, 0xac, 0xc2, 0x74, 0x05, 0xb9, 0xb1,
-	0x98, 0x05, 0x3e, 0xff, 0xe3, 0xd5, 0x4b, 0xc7, 0x47, 0xe5, 0xf3, 0x0e, 0xd6, 0x34, 0x7c, 0x51,
-	0xa5, 0x93, 0x31, 0x91, 0xc8, 0x16, 0x9c, 0x7d, 0xd4, 0x7b, 0x42, 0xfd, 0x0e, 0x0d, 0x69, 0x20,
-	0x7b, 0x34, 0x8a, 0x3d, 0xba, 0x72, 0x7c, 0x54, 0xbe, 0xf8, 0x4c, 0x55, 0xa6, 0xf4, 0x29, 0x89,
-	0x4a, 0x28, 0xcc, 0x88, 0x8e, 0xae, 0x38, 0xa1, 0xf3, 0xc4, 0x09, 0x28, 0x32, 0x99, 0x89, 0xa5,
-	0x73, 0x7c, 0x8a, 0x6f, 0xc5, 0x6a, 0xab, 0xd7, 0xc4, 0x2c, 0x5f, 0x50, 0x63, 0x6f, 0x89, 0x2a,
-	0xad, 0xa1, 0x38, 0x4d, 0xc6, 0x6b, 0xd5, 0x39, 0x32, 0x8e, 0xbd, 0x45, 0x5e, 0xab, 0xce, 0x11,
-	0x9d, 0x0b, 0xa9, 0x13, 0x65, 0x03, 0x86, 0x77, 0xd9, 0x69, 0x8b, 0x3c, 0x68, 0x7a, 0xe9, 0xaa,
-	0xe8, 0x51, 0x7c, 0x3f, 0xdd, 0x62, 0x3f, 0x10, 0x10, 0xbf, 0xa4, 0x19, 0x3c, 0xa1, 0xf5, 0xb3,
-	0x15, 0xeb, 0xc8, 0x67, 0x00, 0xa2, 0x57, 0x95, 0x6e, 0x77, 0x71, 0x02, 0x07, 0x79, 0xd6, 0x1c,
-	0x64, 0xa5, 0xdb, 0xad, 0x5e, 0x16, 0xe3, 0x3b, 0xa7, 0xc6, 0xe7, 0x74, 0xbb, 0x1a, 0x35, 0x8d,
-	0x08, 0xf9, 0x14, 0x26, 0x91, 0x45, 0xc9, 0x15, 0x9d, 0xc4, 0x15, 0xbd, 0x70, 0x7c, 0x54, 0x5e,
-	0x40, 0xee, 0x93, 0xb2, 0x9e, 0x06, 0x02, 0xf9, 0x5d, 0x98, 0x17, 0xe4, 0x1e, 0xbb, 0x9d, 0x96,
-	0xf7, 0x22, 0x58, 0xa1, 0xc1, 0xb3, 0xd0, 0xeb, 0x22, 0x3b, 0x9b, 0x58, 0xba, 0x68, 0x76, 0xcf,
-	0x84, 0xa9, 0xbe, 0x2d, 0x7a, 0x6a, 0xa9, 0x9e, 0xbe, 0xe0, 0x00, 0x8d, 0x16, 0x87, 0xd0, 0x19,
-	0x5e, 0x2a, 0x09, 0xb2, 0x0e, 0x33, 0xbb, 0x01, 0x35, 0xc6, 0x30, 0x8d, 0xfc, 0xbe, 0xcc, 0x56,
-	0xb8, 0x17, 0xd0, 0x46, 0xd6, 0x38, 0xe2, 0x78, 0xc4, 0x06, 0xb2, 0xe2, 0x7b, 0xdd, 0xd8, 0x1e,
-	0x9f, 0xc1, 0x19, 0xb1, 0x8e, 0x8f, 0xca, 0x97, 0x5b, 0xbe, 0xd7, 0x6d, 0x64, 0x6f, 0xf4, 0x14,
-	0x6c, 0xf2, 0x13, 0x38, 0xb7, 0xec, 0x75, 0x3a, 0xb4, 0xc9, 0x38, 0xe2, 0x8a, 0xeb, 0xec, 0x77,
-	0xbc, 0x20, 0x74, 0x9b, 0xeb, 0x2b, 0x8b, 0xc5, 0x88, 0xdd, 0x37, 0x15, 0x44, 0xa3, 0xa5, 0x40,
-	0x4c, 0x76, 0x9f, 0x41, 0x85, 0x7c, 0x05, 0x53, 0xa2, 0x2d, 0xea, 0xe3, 0xd6, 0x3c, 0x9b, 0xbf,
-	0xd1, 0x14, 0x30, 0x3f, 0xb8, 0x7d, 0xf9, 0x93, 0x8b, 0x42, 0x26, 0x2d, 0xf2, 0x35, 0x4c, 0x6c,
-	0xde, 0xaf, 0xd8, 0x34, 0xe8, 0x7a, 0x9d, 0x80, 0x2e, 0x12, 0x5c, 0xd1, 0xcb, 0x82, 0xf4, 0xe6,
-	0xfd, 0x4a, 0xa5, 0x17, 0x1e, 0xd0, 0x4e, 0xe8, 0x36, 0x9d, 0x90, 0x4a, 0xa8, 0x6a, 0x89, 0xed,
-	0xbc, 0xc3, 0xa7, 0x4e, 0xc3, 0x17, 0x25, 0xda, 0x28, 0x74, 0x72, 0xa4, 0x04, 0x63, 0xf5, 0xfa,
-	0xda, 0x86, 0xb7, 0xef, 0x76, 0x16, 0x67, 0xd9, 0x64, 0xd8, 0xea, 0x37, 0xd9, 0x81, 0xd1, 0x5a,
-	0xcf, 0xef, 0x7a, 0x01, 0x5d, 0x9c, 0xc7, 0x01, 0x5d, 0xcb, 0xfb, 0x72, 0x04, 0x68, 0x75, 0x9e,
-	0xb1, 0xce, 0x2e, 0xff, 0xa1, 0xb5, 0x2a, 0x49, 0x91, 0x1f, 0xc3, 0x64, 0xbd, 0xbe, 0x16, 0x9d,
-	0x71, 0xe7, 0x90, 0xe1, 0x5f, 0x3c, 0x3e, 0x2a, 0x2f, 0x32, 0xd1, 0x25, 0x3a, 0xe7, 0xf4, 0xdd,
-	0xae, 0x63, 0x30, 0x0a, 0x3b, 0x1b, 0xf5, 0x88, 0xc2, 0x42, 0x44, 0x81, 0x09, 0x4d, 0xe9, 0x14,
-	0x74, 0x0c, 0xf2, 0xff, 0x16, 0xe0, 0x8a, 0x4e, 0xb2, 0x12, 0x29, 0x40, 0xf5, 0xd0, 0x09, 0xe9,
-	0x21, 0xed, 0x84, 0x8b, 0xe7, 0x71, 0xa6, 0xbf, 0xaf, 0x14, 0xb8, 0x5b, 0xba, 0x9a, 0xf4, 0xfc,
-	0xee, 0xad, 0x34, 0xa4, 0xea, 0xd2, 0xf1, 0x51, 0xf9, 0x96, 0x39, 0x8e, 0x86, 0x86, 0xd7, 0x08,
-	0x24, 0xa4, 0xd6, 0xb7, 0xbe, 0x5d, 0xc1, 0xfe, 0xea, 0x03, 0x48, 0xed, 0x6f, 0xe9, 0x95, 0xfb,
-	0x6b, 0xce, 0x5a, 0xff, 0xfe, 0xf6, 0xeb, 0x0a, 0x69, 0xc2, 0x05, 0x9b, 0xba, 0x41, 0xd0, 0x63,
-	0xe2, 0x0f, 0xfb, 0xbc, 0xd7, 0x0f, 0x99, 0xba, 0xe4, 0x75, 0xb8, 0x3c, 0x79, 0x01, 0x79, 0xc3,
-	0xd5, 0xe3, 0xa3, 0xf2, 0x25, 0x5f, 0x81, 0x71, 0x16, 0xe1, 0xea, 0x80, 0x76, 0x1e, 0x15, 0xeb,
-	0x73, 0x18, 0x57, 0x1c, 0x9b, 0x8c, 0xc2, 0x60, 0xa5, 0xdd, 0x2e, 0x9e, 0x61, 0x7f, 0xd4, 0xeb,
-	0x6b, 0xc5, 0x02, 0x99, 0x06, 0x88, 0x8e, 0xa9, 0xe2, 0x00, 0x99, 0x84, 0x31, 0x79, 0x8c, 0x14,
-	0x07, 0x11, 0xbe, 0xdb, 0x2d, 0x0e, 0x11, 0x02, 0xd3, 0x26, 0x33, 0x2b, 0x0e, 0x5b, 0xff, 0x47,
-	0x01, 0xc6, 0xd5, 0x47, 0x48, 0x66, 0x60, 0x62, 0x77, 0xab, 0x5e, 0x5b, 0x5d, 0x5e, 0xbf, 0xbf,
-	0xbe, 0xba, 0x52, 0x3c, 0x43, 0x2e, 0xc1, 0xf9, 0x9d, 0xfa, 0x5a, 0x63, 0xa5, 0xda, 0xd8, 0xd8,
-	0x5e, 0xae, 0x6c, 0x34, 0x6a, 0xf6, 0xf6, 0xe7, 0x5f, 0x34, 0x76, 0x76, 0xb7, 0xb6, 0x56, 0x37,
-	0x8a, 0x05, 0xb2, 0x08, 0x73, 0xac, 0xfa, 0xd1, 0x6e, 0x75, 0x55, 0x07, 0x28, 0x0e, 0x90, 0xab,
-	0x70, 0x29, 0xad, 0xa6, 0xb1, 0xb6, 0x5a, 0x59, 0xd9, 0x58, 0xad, 0xd7, 0x8b, 0x83, 0x64, 0x01,
-	0x66, 0x19, 0x48, 0xa5, 0x56, 0x33, 0x70, 0x87, 0x58, 0x2f, 0x44, 0xa3, 0xab, 0x9f, 0xaf, 0x2e,
-	0x17, 0x87, 0xad, 0x36, 0x4c, 0x68, 0x9f, 0x1d, 0xb9, 0x08, 0x8b, 0xcb, 0xab, 0xf6, 0x4e, 0xa3,
-	0xb6, 0x6b, 0xd7, 0xb6, 0xeb, 0xab, 0x0d, 0xb3, 0xcb, 0xf1, 0xda, 0x8d, 0xed, 0x07, 0xeb, 0x5b,
-	0x0d, 0x56, 0x54, 0x2f, 0x16, 0x58, 0xbf, 0x8c, 0xda, 0xfa, 0xfa, 0xd6, 0x83, 0x8d, 0xd5, 0xc6,
-	0x6e, 0x7d, 0x55, 0x80, 0x0c, 0x70, 0xe9, 0xed, 0xe1, 0xd0, 0xd8, 0x5c, 0x71, 0x5e, 0x93, 0x3f,
-	0xed, 0xf9, 0xd4, 0xbd, 0x62, 0xfd, 0xfe, 0x40, 0x42, 0x1c, 0x20, 0x4b, 0x30, 0x51, 0xe7, 0x96,
-	0x0e, 0x64, 0x91, 0x5c, 0x59, 0x2c, 0x1e, 0x1f, 0x95, 0x27, 0x85, 0x01, 0x84, 0x73, 0x3f, 0x1d,
-	0x88, 0x49, 0x78, 0x35, 0xc6, 0x71, 0x9a, 0x5e, 0x5b, 0x97, 0xf0, 0xba, 0xa2, 0xcc, 0x56, 0xb5,
-	0x64, 0x49, 0x93, 0x05, 0xb9, 0xe6, 0x88, 0xda, 0x89, 0x94, 0x05, 0x75, 0xb9, 0x40, 0x49, 0x85,
-	0x4b, 0xd1, 0x8e, 0x10, 0x22, 0x1c, 0xe2, 0xa4, 0xc8, 0x21, 0x0a, 0x8e, 0xbc, 0x25, 0xa5, 0x5e,
-	0xae, 0xe9, 0xa1, 0xa0, 0x10, 0xd3, 0x51, 0x84, 0xc0, 0x6b, 0xf5, 0x32, 0x0e, 0x65, 0xf2, 0x51,
-	0x7c, 0xcb, 0x89, 0xc9, 0x40, 0x62, 0xb1, 0xb3, 0xd7, 0x8e, 0x81, 0x92, 0x32, 0x0c, 0x73, 0x6e,
-	0xcd, 0xe7, 0x03, 0xe5, 0xec, 0x36, 0x2b, 0xb0, 0x79, 0xb9, 0xf5, 0x8f, 0x86, 0x74, 0x01, 0x85,
-	0xc9, 0xd5, 0xda, 0x7c, 0xa3, 0x5c, 0x8d, 0xf3, 0x8c, 0xa5, 0x4c, 0x2d, 0xe4, 0x8b, 0x89, 0x6a,
-	0xe1, 0x60, 0xa4, 0x16, 0x0a, 0x76, 0xc0, 0xd5, 0xc2, 0x08, 0x84, 0xad, 0xa2, 0x10, 0xf9, 0x90,
-	0xea, 0x50, 0xb4, 0x8a, 0x42, 0x4c, 0x14, 0xab, 0xa8, 0x01, 0x91, 0x0f, 0x01, 0x2a, 0x8f, 0xeb,
-	0xa8, 0xff, 0xd8, 0x5b, 0x42, 0xec, 0xc5, 0x03, 0xca, 0x79, 0x11, 0x08, 0xf5, 0xca, 0xd7, 0xf5,
-	0x47, 0x0d, 0x9a, 0x54, 0x61, 0xaa, 0xf2, 0xf3, 0x9e, 0x4f, 0xd7, 0x5b, 0xec, 0x8c, 0x0b, 0xb9,
-	0xa2, 0x3c, 0xce, 0x99, 0xbd, 0xc3, 0x2a, 0x1a, 0xae, 0xa8, 0xd1, 0x08, 0x98, 0x28, 0x64, 0x1b,
-	0xce, 0x3e, 0x58, 0xae, 0x89, 0x7d, 0x55, 0x69, 0x36, 0xbd, 0x5e, 0x27, 0x14, 0xb2, 0x2e, 0xf2,
-	0xa0, 0xfd, 0x66, 0xb7, 0x21, 0xf7, 0xa0, 0xc3, 0xab, 0x75, 0x61, 0x37, 0x81, 0x4b, 0xae, 0xc1,
-	0xe0, 0xae, 0xbd, 0x2e, 0xb4, 0xe8, 0xb3, 0xc7, 0x47, 0xe5, 0xa9, 0x9e, 0xef, 0x6a, 0x28, 0xac,
-	0x96, 0x7c, 0x00, 0xb0, 0xe3, 0xf8, 0xfb, 0x34, 0xac, 0x79, 0x7e, 0x88, 0xc2, 0xea, 0x54, 0xf5,
-	0xfc, 0xf1, 0x51, 0x79, 0x3e, 0xc4, 0xd2, 0x06, 0x63, 0xd1, 0xfa, 0xa0, 0x23, 0x60, 0xf2, 0x12,
-	0xca, 0x95, 0xc7, 0xf5, 0x65, 0x9f, 0xe2, 0x08, 0x9c, 0x76, 0xcd, 0xf7, 0x98, 0x3c, 0x13, 0x15,
-	0x04, 0x28, 0xca, 0x8e, 0x57, 0x6f, 0x1f, 0x1f, 0x95, 0xbf, 0xc7, 0x66, 0xb1, 0xa9, 0xaa, 0xba,
-	0x1c, 0x56, 0x2b, 0xd1, 0xb7, 0x66, 0x3f, 0xba, 0x0f, 0x87, 0xc6, 0x06, 0x8a, 0x83, 0xf6, 0x78,
-	0x9d, 0x06, 0x01, 0x57, 0x53, 0xdb, 0x30, 0xfd, 0x80, 0x86, 0xec, 0x9b, 0x91, 0x6a, 0x57, 0xfe,
-	0x8e, 0xfa, 0x11, 0x4c, 0x3c, 0x76, 0xc3, 0x83, 0x3a, 0x6d, 0xfa, 0x34, 0x94, 0x26, 0x27, 0x5c,
-	0xed, 0x17, 0x6e, 0x78, 0xd0, 0x08, 0x78, 0xb9, 0x2e, 0x8e, 0x68, 0xe0, 0xd6, 0x2a, 0xcc, 0x88,
-	0xd6, 0x94, 0x96, 0xb7, 0x64, 0x12, 0x2c, 0x20, 0x41, 0xdc, 0x71, 0x3a, 0x41, 0x93, 0xcc, 0xff,
-	0x3f, 0x00, 0xf3, 0xcb, 0x07, 0x4e, 0x67, 0x9f, 0xd6, 0x9c, 0x20, 0x78, 0xe1, 0xf9, 0x2d, 0xad,
-	0xf3, 0xa8, 0xe2, 0x26, 0x3a, 0x8f, 0x3a, 0xed, 0x12, 0x4c, 0x6c, 0xb7, 0x5b, 0x12, 0x47, 0xa8,
-	0xdf, 0xd8, 0x96, 0xd7, 0x6e, 0x35, 0xba, 0x92, 0x96, 0x0e, 0xc4, 0x70, 0xb6, 0xe8, 0x0b, 0x85,
-	0x33, 0x18, 0xe1, 0x74, 0xe8, 0x0b, 0x0d, 0x47, 0x03, 0x22, 0xab, 0x70, 0xb6, 0x4e, 0x9b, 0x5e,
-	0xa7, 0x75, 0xdf, 0x69, 0x86, 0x9e, 0xbf, 0xe3, 0x3d, 0xa3, 0x1d, 0xf1, 0x2d, 0xa1, 0x3e, 0x13,
-	0x60, 0x65, 0xe3, 0x29, 0xd6, 0x36, 0x42, 0x56, 0x6d, 0x27, 0x31, 0xc8, 0x36, 0x8c, 0x3d, 0x16,
-	0x86, 0x4b, 0xa1, 0xb3, 0x5f, 0xbf, 0xa5, 0x2c, 0x99, 0xd1, 0xaa, 0x2a, 0xab, 0x83, 0x12, 0x0f,
-	0x91, 0x8b, 0x4a, 0x48, 0x5b, 0x11, 0xb1, 0x76, 0x61, 0xaa, 0xd6, 0xee, 0xed, 0xbb, 0x1d, 0xc6,
-	0xef, 0xea, 0xf4, 0x67, 0x64, 0x05, 0x20, 0x2a, 0x10, 0xe6, 0xc8, 0x59, 0xa1, 0xe9, 0x47, 0x15,
-	0x7b, 0xf7, 0x04, 0xd3, 0xc0, 0x12, 0x54, 0xe4, 0x6c, 0x0d, 0xcf, 0xfa, 0xf7, 0x83, 0x40, 0xc4,
-	0x02, 0xa0, 0x8c, 0x50, 0xa7, 0x21, 0x3b, 0x58, 0xcf, 0xc1, 0x80, 0xb2, 0x1a, 0x8e, 0x1c, 0x1f,
-	0x95, 0x07, 0xdc, 0x96, 0x3d, 0xb0, 0xbe, 0x42, 0xde, 0x85, 0x61, 0x04, 0xc3, 0xf9, 0x9f, 0x56,
-	0xed, 0xe9, 0x14, 0x38, 0xdf, 0xc3, 0x03, 0xc7, 0xe6, 0xc0, 0xe4, 0x07, 0x30, 0xbe, 0x42, 0xdb,
-	0x74, 0xdf, 0x09, 0x3d, 0xc9, 0xc9, 0xb8, 0x1d, 0x4e, 0x16, 0x6a, 0x7b, 0x2e, 0x82, 0x64, 0x5a,
-	0xbc, 0x4d, 0x9d, 0xc0, 0xeb, 0xe8, 0x5a, 0xbc, 0x8f, 0x25, 0xba, 0x16, 0xcf, 0x61, 0xc8, 0xff,
-	0x58, 0x80, 0x89, 0x4a, 0xa7, 0x23, 0xec, 0x5b, 0x81, 0x98, 0xf5, 0xf9, 0x5b, 0xca, 0x20, 0xbc,
-	0xe1, 0x3c, 0xa1, 0xed, 0x3d, 0xa7, 0xdd, 0xa3, 0x41, 0xf5, 0x6b, 0xa6, 0x58, 0xfd, 0xf3, 0xa3,
-	0xf2, 0x47, 0xa7, 0xb0, 0x58, 0x45, 0xa6, 0xe5, 0x1d, 0xdf, 0x71, 0xc3, 0x80, 0x31, 0x0c, 0x27,
-	0x6a, 0x50, 0xff, 0x6e, 0xb4, 0x7e, 0x44, 0xc7, 0xd2, 0x48, 0xbf, 0x63, 0x89, 0x1c, 0xc2, 0x4c,
-	0x25, 0x08, 0x7a, 0x87, 0xb4, 0x1e, 0x3a, 0x7e, 0xb8, 0xe3, 0x1e, 0x52, 0xe4, 0x85, 0xf9, 0x36,
-	0x91, 0x37, 0x7f, 0x79, 0x54, 0x2e, 0x30, 0x5d, 0xce, 0x41, 0x54, 0x76, 0xd4, 0xfb, 0x61, 0x23,
-	0x74, 0xf5, 0x93, 0x15, 0xad, 0x23, 0x71, 0xda, 0xd6, 0x35, 0x25, 0x4a, 0xad, 0xaf, 0x64, 0xad,
-	0xb8, 0xb5, 0x0c, 0x17, 0x1f, 0xd0, 0xd0, 0xa6, 0x01, 0x0d, 0xe5, 0x37, 0x82, 0x3b, 0x3c, 0xb2,
-	0x31, 0x8f, 0xe2, 0x6f, 0x85, 0x8c, 0xcb, 0xcf, 0xbf, 0x0b, 0x59, 0x63, 0xfd, 0x17, 0x05, 0x28,
-	0x2f, 0xfb, 0x94, 0xab, 0x41, 0x19, 0x84, 0xf2, 0x79, 0xd7, 0x45, 0x18, 0xda, 0x79, 0xd9, 0x95,
-	0xc6, 0x24, 0xac, 0x65, 0x8b, 0x62, 0x63, 0xe9, 0x09, 0x6d, 0x6d, 0xd6, 0x53, 0x98, 0xb7, 0x69,
-	0x87, 0xbe, 0x60, 0x42, 0xab, 0x61, 0xae, 0x2a, 0xc3, 0x30, 0xff, 0xd0, 0x13, 0x43, 0xe0, 0xe5,
-	0xa7, 0x33, 0xfd, 0x59, 0x53, 0x30, 0x51, 0x73, 0x3b, 0xfb, 0x82, 0xba, 0xf5, 0xd7, 0x43, 0x30,
-	0xc9, 0x7f, 0x0b, 0xcd, 0x2e, 0x76, 0x52, 0x17, 0x4e, 0x72, 0x52, 0xbf, 0x0f, 0x53, 0xec, 0xa8,
-	0xa3, 0xfe, 0x1e, 0xf5, 0x19, 0xff, 0x17, 0x33, 0x81, 0x5a, 0x6a, 0x80, 0x15, 0x8d, 0xe7, 0xbc,
-	0xc6, 0x36, 0x01, 0xc9, 0x06, 0x4c, 0xf3, 0x82, 0xfb, 0xd4, 0x09, 0x7b, 0x91, 0xa1, 0x6d, 0x46,
-	0xa8, 0x8c, 0xb2, 0x98, 0x6f, 0x4d, 0x41, 0xeb, 0xa9, 0x28, 0xb4, 0x63, 0xb8, 0xe4, 0x53, 0x98,
-	0xa9, 0xf9, 0xde, 0x37, 0x2f, 0x35, 0xd9, 0x84, 0x7f, 0x9d, 0x5c, 0xb9, 0x64, 0x55, 0x0d, 0x5d,
-	0x42, 0x89, 0x43, 0x93, 0xb7, 0x60, 0x6c, 0x3d, 0xa8, 0x7a, 0xbe, 0xdb, 0xd9, 0xc7, 0x6f, 0x74,
-	0x8c, 0xdf, 0x37, 0xb8, 0x41, 0xe3, 0x09, 0x16, 0xda, 0xaa, 0x3a, 0x66, 0x19, 0x1f, 0xed, 0x6f,
-	0x19, 0xbf, 0x03, 0xb0, 0xe1, 0x39, 0xad, 0x4a, 0xbb, 0xbd, 0x5c, 0x09, 0x50, 0x08, 0x10, 0xe7,
-	0x51, 0xdb, 0x73, 0x5a, 0x0d, 0xa7, 0xdd, 0x6e, 0x34, 0x9d, 0xc0, 0xd6, 0x60, 0xc8, 0x97, 0x70,
-	0x3e, 0x70, 0xf7, 0x3b, 0x38, 0xb8, 0x86, 0xd3, 0xde, 0xf7, 0x7c, 0x37, 0x3c, 0x38, 0x6c, 0x04,
-	0x3d, 0x37, 0xe4, 0x66, 0xac, 0xe9, 0xa5, 0xcb, 0x82, 0xc9, 0xd5, 0x25, 0x5c, 0x45, 0x82, 0xd5,
-	0x19, 0x94, 0xbd, 0x10, 0xa4, 0x57, 0x90, 0xc7, 0x30, 0xb5, 0xe1, 0x36, 0x69, 0x27, 0xa0, 0x68,
-	0x97, 0x7c, 0x89, 0x92, 0x41, 0xfe, 0xc7, 0xcc, 0x26, 0x71, 0xaa, 0xad, 0x23, 0xe1, 0xa7, 0x6b,
-	0xd2, 0x79, 0x38, 0x34, 0x36, 0x52, 0x1c, 0xb5, 0x67, 0x44, 0xe1, 0x63, 0xc7, 0xef, 0xb8, 0x9d,
-	0xfd, 0xc0, 0xfa, 0x3f, 0x09, 0x8c, 0xa9, 0x75, 0xba, 0xa5, 0xeb, 0x58, 0xe2, 0x68, 0xc6, 0x2d,
-	0x1b, 0x99, 0x0f, 0x6d, 0x0d, 0x82, 0x9c, 0x47, 0xad, 0x4b, 0x08, 0x05, 0xa3, 0xec, 0x13, 0x72,
-	0xba, 0x5d, 0x9b, 0x95, 0x31, 0xd6, 0xb0, 0x52, 0xc5, 0x4d, 0x33, 0xc6, 0x59, 0x43, 0xeb, 0x89,
-	0x3d, 0xb0, 0x52, 0x65, 0xdf, 0xe4, 0xf6, 0xfa, 0xca, 0x32, 0xae, 0xff, 0x18, 0xff, 0x26, 0x3d,
-	0xb7, 0xd5, 0xb4, 0xb1, 0x94, 0xd5, 0xd6, 0x2b, 0x9b, 0x1b, 0x62, 0x8d, 0xb1, 0x36, 0x70, 0x0e,
-	0xdb, 0x36, 0x96, 0x32, 0x41, 0x9b, 0x5b, 0x82, 0x96, 0xbd, 0x4e, 0xe8, 0x7b, 0xed, 0x00, 0xa5,
-	0xc7, 0x31, 0xbe, 0x07, 0x85, 0x09, 0xa9, 0x29, 0xaa, 0xec, 0x18, 0x28, 0x79, 0x0c, 0x0b, 0x95,
-	0xd6, 0x73, 0xa7, 0xd3, 0xa4, 0x2d, 0x5e, 0xf3, 0xd8, 0xf3, 0x9f, 0x3d, 0x6d, 0x7b, 0x2f, 0x02,
-	0xdc, 0x24, 0x63, 0xc2, 0xe2, 0x2a, 0x40, 0xa4, 0x45, 0xea, 0x85, 0x04, 0xb2, 0xb3, 0xb0, 0x19,
-	0x1f, 0x58, 0x6e, 0x7b, 0xbd, 0x96, 0xd8, 0x3a, 0xc8, 0x07, 0x9a, 0xac, 0xc0, 0xe6, 0xe5, 0x6c,
-	0x96, 0xd6, 0xea, 0x9b, 0xb8, 0x31, 0xc4, 0x2c, 0x1d, 0x04, 0x87, 0x36, 0x2b, 0x23, 0xd7, 0x61,
-	0x54, 0xea, 0x0c, 0xfc, 0x42, 0x05, 0x0d, 0xf9, 0x52, 0x57, 0x90, 0x75, 0xec, 0x3b, 0xb6, 0x69,
-	0xd3, 0x7b, 0x4e, 0xfd, 0x97, 0xcb, 0x5e, 0x8b, 0x4a, 0x6b, 0x9c, 0xb0, 0x36, 0xf1, 0x8a, 0x46,
-	0x93, 0xd5, 0xd8, 0x26, 0x20, 0x6b, 0x80, 0x1f, 0xdc, 0xc1, 0xe2, 0x4c, 0xd4, 0x00, 0x3f, 0xd8,
-	0x03, 0x5b, 0xd6, 0x91, 0x15, 0x38, 0x5b, 0xe9, 0x85, 0xde, 0xa1, 0x13, 0xba, 0xcd, 0xdd, 0xee,
-	0xbe, 0xef, 0xb0, 0x46, 0x8a, 0x88, 0x80, 0x3a, 0x94, 0x23, 0x2b, 0x1b, 0x3d, 0x51, 0x6b, 0x27,
-	0x11, 0xc8, 0x7b, 0x30, 0xb9, 0x1e, 0x70, 0x8b, 0xab, 0x13, 0xd0, 0x16, 0x9a, 0xcd, 0x44, 0x2f,
-	0xdd, 0xa0, 0x81, 0xf6, 0xd7, 0x06, 0xd3, 0xba, 0x5a, 0xb6, 0x01, 0x47, 0x2c, 0x18, 0xa9, 0x04,
-	0x81, 0x1b, 0x84, 0x68, 0x0d, 0x1b, 0xab, 0xc2, 0xf1, 0x51, 0x79, 0xc4, 0xc1, 0x12, 0x5b, 0xd4,
-	0x90, 0xc7, 0x30, 0xb1, 0x42, 0x99, 0xd0, 0xbe, 0xe3, 0xf7, 0x82, 0x10, 0x6d, 0x5b, 0x13, 0x4b,
-	0xe7, 0x05, 0x37, 0xd2, 0x6a, 0xc4, 0x5e, 0xe6, 0x22, 0x6a, 0x0b, 0xcb, 0x1b, 0x21, 0xab, 0xd0,
-	0x8f, 0x5a, 0x0d, 0x9e, 0x69, 0x24, 0x02, 0x67, 0xcd, 0x6d, 0x31, 0xfe, 0x32, 0x87, 0x7d, 0x40,
-	0x8d, 0x44, 0x30, 0xb4, 0xc6, 0x01, 0xd6, 0xe8, 0x1a, 0x89, 0x81, 0x42, 0x9a, 0x09, 0x23, 0xfe,
-	0xbc, 0x61, 0xa8, 0x35, 0x2b, 0x65, 0x17, 0x4f, 0x69, 0xe2, 0xff, 0x11, 0x4c, 0x2c, 0xf7, 0x82,
-	0xd0, 0x3b, 0xdc, 0x39, 0xa0, 0x87, 0x14, 0xed, 0x6c, 0x42, 0xef, 0x6a, 0x62, 0x71, 0x23, 0x64,
-	0xe5, 0xfa, 0x30, 0x35, 0x70, 0xf2, 0x19, 0x10, 0xa9, 0x40, 0x3d, 0x60, 0xfb, 0xa3, 0xc3, 0xf6,
-	0x32, 0x9a, 0xda, 0x84, 0xe5, 0x46, 0xea, 0x5d, 0x8d, 0x7d, 0x55, 0xad, 0x9b, 0x61, 0x93, 0xc8,
-	0xac, 0x43, 0xbc, 0x8b, 0x0f, 0x7c, 0xa7, 0x7b, 0xb0, 0xb8, 0x18, 0xa9, 0x06, 0x62, 0x50, 0xfb,
-	0xac, 0xdc, 0x10, 0x71, 0x22, 0x70, 0x52, 0x07, 0xe0, 0x3f, 0x37, 0xd8, 0xc2, 0x73, 0xe3, 0xdc,
-	0xa2, 0x31, 0x5f, 0xac, 0x42, 0xce, 0x15, 0x6a, 0x5a, 0x82, 0x6c, 0xdb, 0x35, 0x56, 0x53, 0x23,
-	0x43, 0x9e, 0x41, 0x91, 0xff, 0xda, 0xf4, 0x3a, 0x6e, 0xc8, 0xcf, 0x8b, 0x92, 0x61, 0x61, 0x8d,
-	0x57, 0xcb, 0x06, 0xd0, 0xb2, 0x2d, 0x1a, 0x38, 0x54, 0xb5, 0x5a, 0x33, 0x09, 0xc2, 0xa4, 0x06,
-	0x13, 0x35, 0xdf, 0x6b, 0xf5, 0x9a, 0x21, 0x4a, 0x19, 0x17, 0x90, 0xf1, 0x13, 0xd1, 0x8e, 0x56,
-	0xc3, 0xe7, 0xa4, 0xcb, 0x0b, 0x1a, 0xec, 0x5c, 0xd0, 0xe7, 0x44, 0x03, 0x24, 0x55, 0x18, 0xa9,
-	0x79, 0x6d, 0xb7, 0xf9, 0x72, 0xf1, 0x22, 0x76, 0x7a, 0x4e, 0x12, 0xc3, 0x42, 0xd9, 0x55, 0x14,
-	0x69, 0xbb, 0x58, 0xa4, 0x8b, 0xb4, 0x1c, 0x88, 0x54, 0x60, 0xea, 0x33, 0xb6, 0x61, 0x5c, 0xaf,
-	0xd3, 0x71, 0x5c, 0x9f, 0x2e, 0x5e, 0xc2, 0x75, 0xc1, 0xdb, 0x87, 0x9f, 0xe9, 0x15, 0xfa, 0x76,
-	0x36, 0x30, 0xc8, 0x3a, 0xcc, 0xac, 0x07, 0xf5, 0xd0, 0x77, 0xbb, 0x74, 0xd3, 0xe9, 0x38, 0xfb,
-	0xb4, 0xb5, 0x78, 0x39, 0x32, 0xff, 0xbb, 0x41, 0x23, 0xc0, 0xba, 0xc6, 0x21, 0xaf, 0xd4, 0xcd,
-	0xff, 0x31, 0x3c, 0xf2, 0x39, 0xcc, 0xad, 0x7e, 0x13, 0xb2, 0x1d, 0xd3, 0xae, 0xf4, 0x5a, 0x6e,
-	0x58, 0x0f, 0x3d, 0xdf, 0xd9, 0xa7, 0x8b, 0x65, 0xa4, 0xf7, 0xc6, 0xf1, 0x51, 0xf9, 0x0a, 0x15,
-	0xf5, 0x0d, 0x87, 0x01, 0x34, 0x02, 0x0e, 0xa1, 0x5f, 0xd3, 0xa7, 0x51, 0x60, 0xb3, 0x5f, 0xef,
-	0x75, 0x99, 0xb4, 0x8d, 0xb3, 0x7f, 0xc5, 0x98, 0x7d, 0xad, 0x86, 0xcf, 0x7e, 0xc0, 0x0b, 0x12,
-	0xb3, 0xaf, 0x01, 0x12, 0x1b, 0xc8, 0x43, 0xcf, 0xed, 0x54, 0x9a, 0xa1, 0xfb, 0x9c, 0x0a, 0x8d,
-	0x39, 0x58, 0xbc, 0x8a, 0x3d, 0xc5, 0xab, 0x8a, 0xdf, 0xf6, 0xdc, 0x4e, 0xc3, 0xc1, 0xea, 0x46,
-	0x20, 0xea, 0xf5, 0x6f, 0x24, 0x89, 0x4d, 0x7e, 0x02, 0xe7, 0x36, 0xbd, 0x27, 0x6e, 0x9b, 0x72,
-	0x96, 0xc3, 0xa7, 0x05, 0xcd, 0xbb, 0x16, 0xd2, 0xc5, 0xab, 0x8a, 0x43, 0x84, 0x68, 0x08, 0x6e,
-	0x75, 0xa8, 0x60, 0xf4, 0xab, 0x8a, 0x74, 0x2a, 0x64, 0x15, 0x26, 0xf1, 0xbb, 0x6c, 0xe3, 0xcf,
-	0x60, 0xf1, 0x1a, 0xaa, 0x74, 0x57, 0x63, 0x52, 0xda, 0xad, 0x55, 0x0d, 0x66, 0xb5, 0x13, 0xfa,
-	0x2f, 0x6d, 0x03, 0x8d, 0x7c, 0x02, 0xa5, 0xf8, 0xf6, 0x5e, 0xf6, 0x3a, 0x4f, 0xdd, 0xfd, 0x9e,
-	0x4f, 0x5b, 0x8b, 0x6f, 0xb0, 0xae, 0xda, 0x39, 0x10, 0x64, 0x0f, 0x66, 0xb5, 0x6f, 0x7b, 0x85,
-	0x1e, 0x7a, 0x9b, 0x5e, 0x8b, 0x2e, 0xde, 0x88, 0x56, 0x59, 0x67, 0x09, 0x8d, 0x16, 0x3d, 0xf4,
-	0x1a, 0x87, 0x5e, 0x8b, 0x1a, 0x1e, 0x2a, 0x49, 0x02, 0xa5, 0xc7, 0x70, 0x36, 0xd1, 0x75, 0x52,
-	0x84, 0xc1, 0x67, 0xf4, 0x25, 0x97, 0x80, 0x6d, 0xf6, 0x27, 0x79, 0x07, 0x86, 0x9f, 0x33, 0x1d,
-	0x0d, 0x25, 0x91, 0xe8, 0x8e, 0x52, 0x43, 0x5d, 0xef, 0x3c, 0xf5, 0x6c, 0x0e, 0xf4, 0xe1, 0xc0,
-	0xfb, 0x85, 0x87, 0x43, 0x63, 0x13, 0xc5, 0x49, 0x7e, 0xb1, 0xff, 0x70, 0x68, 0x6c, 0xaa, 0x38,
-	0xfd, 0x70, 0x68, 0xec, 0x7a, 0xf1, 0x86, 0x3d, 0x8f, 0x47, 0x76, 0xa5, 0xe3, 0x75, 0x5e, 0x1e,
-	0xba, 0x3f, 0x47, 0x35, 0x80, 0x09, 0xe7, 0x15, 0x98, 0x89, 0x11, 0x23, 0x8b, 0x30, 0x4a, 0x3b,
-	0x4c, 0x29, 0x68, 0x71, 0x41, 0xc9, 0x96, 0x3f, 0xc9, 0x1c, 0x0c, 0xb7, 0xdd, 0x43, 0x37, 0xc4,
-	0xde, 0x0c, 0xdb, 0xfc, 0x87, 0xf5, 0xc7, 0x05, 0x20, 0xc9, 0x73, 0x8a, 0xdc, 0x8e, 0x91, 0xe1,
-	0x22, 0xb1, 0x28, 0xd2, 0xef, 0x5b, 0x24, 0xf5, 0xcf, 0x60, 0x96, 0x6f, 0x14, 0x79, 0xa2, 0x6a,
-	0x6d, 0x71, 0x4e, 0x9e, 0x52, 0xad, 0xdb, 0xbf, 0x44, 0x35, 0x9e, 0xbf, 0x1b, 0xd8, 0xb5, 0x1e,
-	0xcc, 0xa7, 0x9e, 0x50, 0x64, 0x13, 0xe6, 0x0f, 0xbd, 0x4e, 0x78, 0xd0, 0x7e, 0x29, 0x0f, 0x28,
-	0xd1, 0x5a, 0x01, 0x5b, 0x43, 0xa6, 0x9c, 0x0a, 0x60, 0xcf, 0x8a, 0x62, 0x41, 0x11, 0xdb, 0x11,
-	0xc6, 0x28, 0x39, 0x12, 0xcb, 0x86, 0xb3, 0x09, 0x46, 0x4f, 0x3e, 0x86, 0xc9, 0x26, 0x2a, 0x7d,
-	0x46, 0x4b, 0xfc, 0x98, 0xd3, 0xca, 0xf5, 0x6f, 0x98, 0x97, 0xf3, 0xa1, 0xfc, 0x5f, 0x05, 0x58,
-	0xc8, 0x60, 0xf1, 0xa7, 0x9f, 0xea, 0x2f, 0xe0, 0xdc, 0xa1, 0xf3, 0x4d, 0xc3, 0x47, 0x9d, 0xbe,
-	0xe1, 0x3b, 0x9d, 0xd8, 0x6c, 0xe3, 0xc6, 0x4e, 0x87, 0xd0, 0x37, 0xf6, 0xa1, 0xf3, 0x8d, 0x8d,
-	0x00, 0x36, 0xab, 0xe7, 0xfd, 0xfc, 0x31, 0x4c, 0x19, 0x4c, 0xfd, 0xd4, 0x9d, 0xb3, 0xee, 0xc2,
-	0xd9, 0x15, 0xda, 0xa6, 0x21, 0x3d, 0xb1, 0x2d, 0xcf, 0xaa, 0x01, 0xd4, 0xe9, 0xa1, 0xd3, 0x3d,
-	0xf0, 0x98, 0xb0, 0x5f, 0xd5, 0x7f, 0x09, 0x5b, 0x10, 0x91, 0x6a, 0x8b, 0xac, 0xd8, 0xbb, 0xc7,
-	0x15, 0x80, 0x40, 0x41, 0xda, 0x1a, 0x96, 0xf5, 0x8f, 0x07, 0x80, 0x08, 0xae, 0xec, 0x53, 0xe7,
-	0x50, 0x76, 0xe3, 0x03, 0x98, 0xe4, 0x9a, 0x3b, 0x2f, 0xc6, 0xee, 0x4c, 0x2c, 0xcd, 0x8a, 0xcf,
-	0x52, 0xaf, 0x5a, 0x3b, 0x63, 0x1b, 0xa0, 0x0c, 0xd5, 0xa6, 0xdc, 0xe4, 0x80, 0xa8, 0x03, 0x06,
-	0xaa, 0x5e, 0xc5, 0x50, 0xf5, 0xdf, 0xe4, 0x53, 0x98, 0x5e, 0xf6, 0x0e, 0xbb, 0x6c, 0x4e, 0x04,
-	0xf2, 0xa0, 0x30, 0xe7, 0x88, 0x76, 0x8d, 0xca, 0xb5, 0x33, 0x76, 0x0c, 0x9c, 0x6c, 0xc1, 0xec,
-	0xfd, 0x76, 0x2f, 0x38, 0xa8, 0x74, 0x5a, 0xcb, 0x6d, 0x2f, 0x90, 0x54, 0x86, 0x84, 0x06, 0x26,
-	0x78, 0x6a, 0x12, 0x62, 0xed, 0x8c, 0x9d, 0x86, 0x48, 0xae, 0xc3, 0xf0, 0xea, 0x73, 0xc6, 0xeb,
-	0xa5, 0x03, 0x8e, 0xf0, 0x0f, 0xdc, 0xee, 0xd0, 0xed, 0xa7, 0x6b, 0x67, 0x6c, 0x5e, 0x5b, 0x1d,
-	0x87, 0x51, 0xa9, 0xf5, 0xdf, 0x66, 0x72, 0xb8, 0x9a, 0xce, 0x7a, 0xe8, 0x84, 0xbd, 0x80, 0x94,
-	0x60, 0x6c, 0xb7, 0xcb, 0x94, 0x51, 0x69, 0x2e, 0xb1, 0xd5, 0x6f, 0xeb, 0x1d, 0x73, 0xa6, 0xc9,
-	0x45, 0x88, 0x6c, 0xbd, 0x02, 0x58, 0x33, 0xfe, 0xae, 0x99, 0x93, 0x9b, 0x0f, 0x6d, 0xb4, 0x3b,
-	0x10, 0x6b, 0xb7, 0x18, 0x9f, 0x6b, 0x6b, 0x3e, 0x75, 0xf2, 0xac, 0xcf, 0xe1, 0xf2, 0x6e, 0x37,
-	0xa0, 0x7e, 0x58, 0xe9, 0x76, 0xdb, 0x6e, 0x93, 0x5f, 0x2c, 0xa2, 0x75, 0x40, 0x6e, 0x96, 0xf7,
-	0x60, 0x84, 0x17, 0x88, 0x6d, 0x22, 0xf7, 0x60, 0xa5, 0xdb, 0x15, 0x36, 0x89, 0x7b, 0x5c, 0x23,
-	0xe0, 0x56, 0x06, 0x5b, 0x40, 0x5b, 0x7f, 0x54, 0x80, 0xcb, 0xfc, 0x0b, 0xc8, 0x24, 0xfd, 0x3d,
-	0x18, 0x47, 0xf7, 0xbc, 0xae, 0xd3, 0x94, 0xdf, 0x04, 0xf7, 0x53, 0x94, 0x85, 0x76, 0x54, 0xaf,
-	0x39, 0x3e, 0x0e, 0x64, 0x3b, 0x3e, 0xca, 0x0f, 0x6c, 0x30, 0xf5, 0x03, 0xfb, 0x0c, 0x2c, 0xd1,
-	0xa3, 0x76, 0x3b, 0xd1, 0xa9, 0xe0, 0x55, 0x7a, 0x65, 0xfd, 0xeb, 0x01, 0x58, 0x78, 0x40, 0x3b,
-	0xd4, 0x77, 0x70, 0x9c, 0x86, 0xf5, 0x4b, 0x77, 0x98, 0x2a, 0xe4, 0x3a, 0x4c, 0x95, 0xa5, 0x3d,
-	0x71, 0x00, 0xed, 0x89, 0x09, 0x6f, 0x2e, 0xa6, 0xa3, 0xee, 0xda, 0xeb, 0x62, 0x58, 0xa8, 0xa3,
-	0xf6, 0x7c, 0x97, 0x5f, 0x7c, 0xac, 0x47, 0xce, 0x56, 0x43, 0x7d, 0x6d, 0x11, 0xb3, 0xc2, 0xf9,
-	0x64, 0x54, 0x38, 0x5b, 0x99, 0x2e, 0x56, 0x5b, 0x30, 0xc2, 0xcd, 0xa0, 0x78, 0xdd, 0x36, 0xb1,
-	0xf4, 0xb6, 0xf8, 0xa6, 0x32, 0x06, 0x28, 0x6c, 0xa6, 0x78, 0xea, 0xf3, 0x2d, 0x10, 0x62, 0x81,
-	0x2d, 0xa8, 0x94, 0x3e, 0x83, 0x09, 0x0d, 0xe4, 0x24, 0x82, 0x81, 0x32, 0xc7, 0x32, 0x31, 0xb5,
-	0xb3, 0xcf, 0x2d, 0xbb, 0x9a, 0x60, 0x60, 0x7d, 0x04, 0x8b, 0xc9, 0xde, 0x08, 0x13, 0x5c, 0x3f,
-	0x8b, 0x9f, 0xb5, 0x02, 0x73, 0x0f, 0x68, 0x88, 0x1b, 0x17, 0x3f, 0x22, 0xcd, 0x09, 0x30, 0xf6,
-	0x9d, 0x49, 0xae, 0x8a, 0x85, 0x6c, 0x83, 0x69, 0x5f, 0x69, 0x1d, 0xe6, 0x63, 0x54, 0x44, 0xfb,
-	0x1f, 0xc2, 0xa8, 0x28, 0x52, 0x1c, 0x55, 0x78, 0x12, 0xd3, 0x27, 0xa2, 0x62, 0x6f, 0x89, 0xef,
-	0x5b, 0x41, 0xd9, 0x96, 0x08, 0xd6, 0x01, 0x9c, 0x63, 0xc7, 0x6c, 0x44, 0x55, 0x6d, 0xc7, 0x0b,
-	0x30, 0xde, 0x65, 0x82, 0x42, 0xe0, 0xfe, 0x9c, 0x6f, 0xa3, 0x61, 0x7b, 0x8c, 0x15, 0xd4, 0xdd,
-	0x9f, 0x53, 0x72, 0x09, 0x00, 0x2b, 0x71, 0x98, 0x82, 0x0b, 0x20, 0x38, 0x37, 0x71, 0x12, 0x40,
-	0x17, 0x42, 0xbe, 0x6f, 0x6c, 0xfc, 0xdb, 0xf2, 0x61, 0x21, 0xd1, 0x92, 0x18, 0xc0, 0x6d, 0x18,
-	0x93, 0x72, 0x73, 0xec, 0xf2, 0x41, 0x1f, 0x81, 0xad, 0x80, 0xc8, 0x0d, 0x98, 0xe9, 0xd0, 0x6f,
-	0xc2, 0x46, 0xa2, 0x0f, 0x53, 0xac, 0xb8, 0x26, 0xfb, 0x61, 0xfd, 0x16, 0x1a, 0x9c, 0xeb, 0x1d,
-	0xef, 0xc5, 0xd3, 0xb6, 0xf3, 0x8c, 0x26, 0x1a, 0xfe, 0x18, 0xc6, 0xea, 0xfd, 0x1b, 0xe6, 0x9f,
-	0x8f, 0x6c, 0xdc, 0x56, 0x28, 0x56, 0x1b, 0x4a, 0x6c, 0x48, 0xf5, 0xca, 0xe6, 0xc6, 0x7a, 0xab,
-	0xf6, 0x5d, 0x4f, 0xe0, 0x73, 0xb8, 0x90, 0xda, 0xda, 0x77, 0x3d, 0x89, 0x7f, 0x3e, 0x04, 0x0b,
-	0xfc, 0x30, 0x49, 0xee, 0xe0, 0x93, 0xb3, 0x9a, 0xdf, 0xc8, 0x15, 0xf4, 0x9d, 0x94, 0x2b, 0x68,
-	0x44, 0xd1, 0xaf, 0xa0, 0x8d, 0x8b, 0xe7, 0xf7, 0xd3, 0x2f, 0x9e, 0xd1, 0x38, 0x65, 0x5e, 0x3c,
-	0xc7, 0xaf, 0x9b, 0x57, 0xb3, 0xaf, 0x9b, 0xf1, 0x42, 0x2a, 0xe5, 0xba, 0x39, 0xed, 0x92, 0x39,
-	0xe6, 0xf7, 0x35, 0xf6, 0x7a, 0xfd, 0xbe, 0x6e, 0xc0, 0x68, 0xa5, 0xdb, 0xd5, 0xfc, 0x28, 0x71,
-	0x79, 0x9c, 0x6e, 0x97, 0x4f, 0x9e, 0xac, 0x94, 0x7c, 0x1e, 0x52, 0xf8, 0xfc, 0x07, 0x00, 0xcb,
-	0xf8, 0x82, 0x03, 0x17, 0x6e, 0x02, 0x21, 0x50, 0xc2, 0xe7, 0xef, 0x3a, 0x70, 0xe1, 0x74, 0xb3,
-	0x4b, 0x04, 0xcc, 0x05, 0x7b, 0x6b, 0x0f, 0x16, 0x93, 0xdb, 0xe7, 0x35, 0xb0, 0xae, 0x3f, 0x2b,
-	0xc0, 0x25, 0x21, 0xe4, 0xc4, 0x3e, 0xf0, 0xd3, 0xef, 0xce, 0x1f, 0xc0, 0xa4, 0xc0, 0xdd, 0x89,
-	0x3e, 0x04, 0x7e, 0xe7, 0x2f, 0x99, 0x31, 0xe7, 0xe8, 0x06, 0x18, 0xf9, 0x01, 0x8c, 0xe1, 0x1f,
-	0xd1, 0x85, 0x11, 0x9b, 0x99, 0x71, 0x04, 0x6d, 0xc4, 0xaf, 0x8d, 0x14, 0xa8, 0xf5, 0x35, 0x5c,
-	0xce, 0xea, 0xf8, 0x6b, 0x98, 0x97, 0xbf, 0x5f, 0x80, 0x0b, 0x82, 0xbc, 0xc1, 0x2a, 0x5e, 0xe9,
-	0xd4, 0x39, 0x85, 0xf7, 0xf5, 0x43, 0x98, 0x60, 0x0d, 0xca, 0x7e, 0x0f, 0x8a, 0xa3, 0x55, 0x68,
-	0x0e, 0x51, 0xcd, 0x8a, 0x13, 0x3a, 0xc2, 0x23, 0xc8, 0x39, 0x6c, 0x4b, 0x8b, 0x89, 0xad, 0x23,
-	0x5b, 0x5f, 0xc2, 0xc5, 0xf4, 0x21, 0xbc, 0x86, 0xf9, 0x79, 0x08, 0xa5, 0x94, 0x43, 0xe1, 0xd5,
-	0xce, 0xe4, 0x2f, 0xe0, 0x42, 0x2a, 0xad, 0xd7, 0xd0, 0xcd, 0x35, 0x26, 0x71, 0x84, 0xaf, 0x61,
-	0x09, 0xad, 0xc7, 0x70, 0x3e, 0x85, 0xd2, 0x6b, 0xe8, 0xe2, 0x03, 0x58, 0x50, 0x92, 0xf6, 0xb7,
-	0xea, 0xe1, 0x26, 0x5c, 0xe2, 0x84, 0x5e, 0xcf, 0xaa, 0x3c, 0x82, 0x0b, 0x82, 0xdc, 0x6b, 0x98,
-	0xbd, 0x35, 0xb8, 0x18, 0x29, 0xd4, 0x29, 0x72, 0xd2, 0x89, 0x99, 0x8c, 0xb5, 0x01, 0x57, 0x22,
-	0x4a, 0x19, 0x42, 0xc3, 0xc9, 0xa9, 0x71, 0x71, 0x30, 0x5a, 0xa5, 0xd7, 0xb2, 0xa2, 0x8f, 0xe1,
-	0x9c, 0x41, 0xf4, 0xb5, 0x89, 0x4a, 0xeb, 0x30, 0xcb, 0x09, 0x9b, 0xa2, 0xf3, 0x92, 0x2e, 0x3a,
-	0x4f, 0x2c, 0x9d, 0x8d, 0x48, 0x62, 0xf1, 0xde, 0xbd, 0x14, 0x69, 0x7a, 0x13, 0xa5, 0x69, 0x09,
-	0x12, 0xf5, 0xf0, 0x07, 0x30, 0xc2, 0x4b, 0x44, 0xff, 0x52, 0x88, 0x71, 0x65, 0x81, 0xa3, 0x09,
-	0x60, 0xeb, 0x27, 0x70, 0x89, 0x6b, 0xa2, 0xd1, 0x05, 0xa6, 0xa9, 0x2d, 0x7e, 0x1c, 0x53, 0x44,
-	0xcf, 0x0b, 0xba, 0x71, 0xf8, 0x0c, 0x7d, 0xf4, 0x89, 0xdc, 0xdb, 0x59, 0xf4, 0x4f, 0xf4, 0xb2,
-	0x4e, 0x2a, 0x98, 0x03, 0xa9, 0x0a, 0xe6, 0x35, 0xb8, 0xaa, 0x14, 0xcc, 0x78, 0x33, 0x72, 0x6b,
-	0x59, 0x5f, 0xc2, 0x05, 0x3e, 0x50, 0xe9, 0xe5, 0x68, 0x76, 0xe3, 0xa3, 0xd8, 0x30, 0x17, 0xc4,
-	0x30, 0x4d, 0xe8, 0x8c, 0x41, 0xfe, 0x37, 0x05, 0xf9, 0xc9, 0xa5, 0x13, 0xff, 0x4d, 0x6b, 0xdc,
-	0x5b, 0x50, 0x56, 0x13, 0x62, 0xf6, 0xe8, 0xd5, 0xd4, 0xed, 0x4d, 0x98, 0xd7, 0xc9, 0xb8, 0x4d,
-	0xba, 0x77, 0x17, 0x6f, 0x96, 0xde, 0x65, 0x9f, 0x05, 0x16, 0xc8, 0x6d, 0xb7, 0x98, 0x32, 0x6f,
-	0x08, 0x6f, 0x2b, 0x48, 0xab, 0x01, 0x17, 0x93, 0x4b, 0xe1, 0x36, 0xe5, 0xf3, 0x08, 0xf2, 0x29,
-	0xfb, 0x84, 0xb1, 0x44, 0x2c, 0x46, 0x26, 0x51, 0xf9, 0x1d, 0x73, 0x74, 0x89, 0x65, 0x59, 0x92,
-	0xd5, 0xc4, 0xc6, 0xcf, 0x5a, 0x97, 0xfb, 0xe1, 0x17, 0x40, 0x64, 0xd5, 0x72, 0xdd, 0x96, 0x4d,
-	0x9f, 0x87, 0xc1, 0xe5, 0xba, 0x2d, 0xde, 0x67, 0xa1, 0x24, 0xd8, 0x0c, 0x7c, 0x9b, 0x95, 0xc5,
-	0x25, 0xf2, 0x81, 0x13, 0x48, 0xe4, 0x0f, 0x87, 0xc6, 0x06, 0x8b, 0x43, 0x36, 0xa9, 0xbb, 0xfb,
-	0x9d, 0xc7, 0x6e, 0x78, 0xa0, 0x1a, 0xac, 0x58, 0x5f, 0xc1, 0xac, 0xd1, 0xbc, 0xf8, 0x8a, 0x73,
-	0x1f, 0x88, 0x31, 0x79, 0x76, 0xb9, 0x82, 0xee, 0x36, 0x68, 0xb2, 0x98, 0xe4, 0xfc, 0xa6, 0xe9,
-	0x34, 0xf0, 0xad, 0xb2, 0x2d, 0x2b, 0xad, 0x3f, 0x1d, 0xd2, 0xa8, 0x6b, 0xcf, 0xee, 0x72, 0x46,
-	0x77, 0x17, 0x80, 0xef, 0x10, 0x6d, 0x70, 0x4c, 0x00, 0x9c, 0x10, 0x5e, 0x2c, 0x9c, 0x25, 0xdb,
-	0x1a, 0xd0, 0x49, 0x9f, 0xe5, 0x09, 0x97, 0x68, 0x8e, 0x24, 0x5f, 0xa2, 0x2a, 0x97, 0x68, 0x41,
-	0x3a, 0xb0, 0x75, 0x20, 0xf2, 0x93, 0xf8, 0x5b, 0x93, 0x61, 0xbc, 0xc8, 0x7a, 0x43, 0xde, 0x6c,
-	0x27, 0xc7, 0x76, 0xba, 0xe7, 0x26, 0x2f, 0x60, 0x9e, 0xe1, 0xba, 0x4f, 0x51, 0xb1, 0x58, 0xfd,
-	0x26, 0xa4, 0x1d, 0xce, 0xdb, 0x47, 0xb0, 0x9d, 0xeb, 0x39, 0xed, 0x44, 0xc0, 0xc2, 0xfe, 0x1e,
-	0xd1, 0x69, 0x50, 0x55, 0x67, 0xa7, 0xd3, 0xc7, 0x4d, 0x64, 0x6f, 0xac, 0x76, 0x5a, 0x5d, 0xcf,
-	0x55, 0x0a, 0x13, 0xdf, 0x44, 0x7e, 0xbb, 0x41, 0x45, 0xb9, 0xad, 0x03, 0x59, 0x37, 0x72, 0xfd,
-	0xf4, 0xc7, 0x60, 0x68, 0x67, 0x79, 0x67, 0xa3, 0x58, 0xb0, 0x6e, 0x03, 0x68, 0x2d, 0x01, 0x8c,
-	0x6c, 0x6d, 0xdb, 0x9b, 0x95, 0x8d, 0xe2, 0x19, 0x32, 0x0f, 0x67, 0x1f, 0xaf, 0x6f, 0xad, 0x6c,
-	0x3f, 0xae, 0x37, 0xea, 0x9b, 0x15, 0x7b, 0x67, 0xb9, 0x62, 0xaf, 0x14, 0x0b, 0xd6, 0xd7, 0x30,
-	0x67, 0x8e, 0xf0, 0xb5, 0x6e, 0xc2, 0x10, 0x66, 0x95, 0x3c, 0xf3, 0xf0, 0xf1, 0x8e, 0xe6, 0xe9,
-	0x2a, 0x94, 0xbf, 0xb8, 0xc7, 0x96, 0x50, 0x13, 0xc5, 0x67, 0xa4, 0x01, 0x91, 0xb7, 0xb8, 0x58,
-	0x10, 0x7f, 0x58, 0xcd, 0xc4, 0x82, 0x46, 0x24, 0x17, 0x20, 0xeb, 0xfb, 0x21, 0xcc, 0x99, 0xad,
-	0x9e, 0xd4, 0x4a, 0xf5, 0x06, 0xba, 0x00, 0x6b, 0xaf, 0xb4, 0x08, 0xd1, 0xaf, 0x0d, 0x04, 0x67,
-	0xfd, 0x21, 0x14, 0x05, 0x54, 0x74, 0xf2, 0x5e, 0x93, 0x66, 0xc4, 0x42, 0xca, 0x1b, 0x51, 0xe9,
-	0x27, 0xef, 0x41, 0x91, 0x71, 0x4c, 0x81, 0xc9, 0x1b, 0x98, 0x83, 0xe1, 0x8d, 0xe8, 0x3a, 0xc7,
-	0xe6, 0x3f, 0xf0, 0xb1, 0x52, 0xe8, 0xf8, 0xa1, 0xf4, 0x8f, 0x1b, 0xb7, 0xd5, 0x6f, 0xf2, 0x16,
-	0x8c, 0xdc, 0x77, 0xdb, 0xa1, 0x30, 0x8d, 0x44, 0x87, 0x3c, 0x23, 0xcb, 0x2b, 0x6c, 0x01, 0x60,
-	0xd9, 0x70, 0x56, 0x6b, 0xf0, 0x14, 0x5d, 0x25, 0x8b, 0x30, 0xba, 0x45, 0xbf, 0xd1, 0xda, 0x97,
-	0x3f, 0xad, 0xf7, 0xe0, 0xac, 0xf0, 0x3d, 0xd4, 0xa6, 0xe9, 0xaa, 0x78, 0xca, 0x5e, 0x30, 0xde,
-	0xd3, 0x0a, 0x92, 0x58, 0xc5, 0xf0, 0x76, 0xbb, 0xad, 0x57, 0xc4, 0x63, 0x07, 0xc5, 0x29, 0xf1,
-	0xde, 0x94, 0xb7, 0x40, 0xfd, 0x96, 0xf3, 0xbf, 0x1a, 0x80, 0xc5, 0x98, 0x95, 0x61, 0xf9, 0xc0,
-	0x69, 0xb7, 0x69, 0x67, 0x9f, 0x92, 0x9b, 0x30, 0xb4, 0xb3, 0xbd, 0x53, 0x13, 0x56, 0x52, 0xe9,
-	0x75, 0xc0, 0x8a, 0x14, 0x8c, 0x8d, 0x10, 0xe4, 0x11, 0x9c, 0x95, 0xde, 0xc5, 0xaa, 0x4a, 0xac,
-	0xd0, 0xa5, 0x7c, 0x5f, 0xe5, 0x24, 0x1e, 0x79, 0x57, 0x98, 0x44, 0x7e, 0xd6, 0x73, 0x7d, 0xda,
-	0x42, 0xcb, 0x4f, 0x74, 0x85, 0xaf, 0xd5, 0xd8, 0x3a, 0x18, 0xf9, 0x21, 0x4c, 0xd6, 0xeb, 0xdb,
-	0x51, 0xeb, 0xc3, 0xc6, 0x0d, 0x91, 0x5e, 0x65, 0x1b, 0x80, 0xfc, 0xcd, 0x8b, 0xf5, 0xe7, 0x05,
-	0x58, 0xc8, 0x30, 0xb7, 0x90, 0xb7, 0x8c, 0x79, 0x98, 0xd5, 0xe6, 0x41, 0x82, 0xac, 0x9d, 0x11,
-	0x13, 0xb1, 0xac, 0xf9, 0x6a, 0x0f, 0x9e, 0xc2, 0x57, 0x7b, 0xed, 0x4c, 0xe4, 0x9f, 0x4d, 0x6e,
-	0xc0, 0x60, 0xbd, 0xbe, 0x2d, 0xcc, 0xea, 0x24, 0x1a, 0x81, 0x06, 0xcc, 0x00, 0xaa, 0x00, 0x63,
-	0xb2, 0xc8, 0x9a, 0x81, 0x29, 0x63, 0x61, 0x2c, 0x0b, 0x26, 0xf5, 0x1e, 0xb2, 0xd5, 0x5f, 0xf6,
-	0x5a, 0x6a, 0xf5, 0xd9, 0xdf, 0xd6, 0x2f, 0xcc, 0x39, 0x23, 0x97, 0x00, 0xe4, 0x7d, 0xad, 0xdb,
-	0x92, 0x37, 0x3f, 0xa2, 0x64, 0xbd, 0x45, 0xae, 0xc2, 0xa4, 0x4f, 0x5b, 0xae, 0x4f, 0x9b, 0x61,
-	0xa3, 0xe7, 0x8b, 0xb7, 0x3a, 0xf6, 0x84, 0x2c, 0xdb, 0xf5, 0xdb, 0xe4, 0x7b, 0x30, 0xc2, 0x2f,
-	0x92, 0xc5, 0xe8, 0xa5, 0x92, 0x50, 0xaf, 0x6f, 0x6f, 0xde, 0xaf, 0xf0, 0x8b, 0x6e, 0x5b, 0x80,
-	0x58, 0x55, 0x98, 0xd0, 0x46, 0xd5, 0xaf, 0xf5, 0x39, 0x18, 0xd6, 0xad, 0x94, 0xfc, 0x87, 0xf5,
-	0xdf, 0x17, 0x60, 0x0e, 0xb7, 0xc1, 0xbe, 0xcb, 0x8e, 0x87, 0x68, 0x2c, 0x4b, 0xc6, 0xa2, 0x5d,
-	0x34, 0x16, 0x2d, 0x06, 0xab, 0x56, 0xef, 0xc3, 0xc4, 0xea, 0x5d, 0x4c, 0x5b, 0x3d, 0x64, 0x01,
-	0xae, 0xd7, 0xd1, 0x17, 0x4d, 0xbf, 0xae, 0xfb, 0xe3, 0x02, 0xcc, 0x6a, 0x7d, 0x52, 0x03, 0xbc,
-	0x6b, 0x74, 0xe9, 0x42, 0x4a, 0x97, 0x12, 0xfb, 0xa9, 0x9a, 0xe8, 0xd1, 0x1b, 0x79, 0x3d, 0x4a,
-	0xdb, 0x4e, 0xc6, 0x36, 0xf9, 0xeb, 0x02, 0xcc, 0xa7, 0xce, 0x01, 0x39, 0xc7, 0xe4, 0xff, 0xa6,
-	0x4f, 0x43, 0x31, 0xf3, 0xe2, 0x17, 0x2b, 0x5f, 0x0f, 0x82, 0x1e, 0xf5, 0xc5, 0xbc, 0x8b, 0x5f,
-	0xe4, 0x0d, 0x98, 0xaa, 0x51, 0xdf, 0xf5, 0x5a, 0xfc, 0xc1, 0x02, 0xf7, 0x04, 0x9e, 0xb2, 0xcd,
-	0x42, 0x72, 0x11, 0xc6, 0x95, 0x27, 0x2b, 0xb7, 0xe1, 0xda, 0x51, 0x01, 0xa3, 0xbd, 0xe2, 0xee,
-	0xf3, 0x8b, 0x1f, 0x86, 0x2c, 0x7e, 0x31, 0x06, 0x2c, 0x2d, 0xaa, 0x23, 0x9c, 0x01, 0x4b, 0x73,
-	0xe9, 0x39, 0x18, 0xf9, 0xcc, 0xc6, 0x7d, 0x8c, 0x21, 0x31, 0x6c, 0xf1, 0x8b, 0x4c, 0xa3, 0xcb,
-	0x39, 0x3e, 0xd5, 0x41, 0x57, 0xf3, 0x0f, 0x61, 0x2e, 0x6d, 0x5e, 0xd3, 0xbe, 0x02, 0x81, 0x3b,
-	0xa0, 0x70, 0xbf, 0x84, 0xd9, 0x4a, 0xab, 0x15, 0x6d, 0x57, 0xbe, 0xaa, 0xea, 0x6d, 0xdc, 0x40,
-	0x71, 0x50, 0x88, 0xb5, 0x43, 0xeb, 0x1d, 0x37, 0xb4, 0x67, 0x57, 0xbf, 0x71, 0x83, 0xd0, 0xed,
-	0xec, 0x6b, 0x86, 0x57, 0xfb, 0xdc, 0x16, 0x7d, 0x91, 0xb2, 0x05, 0x98, 0xc4, 0x61, 0xd2, 0xe6,
-	0xe5, 0x29, 0xc4, 0xe7, 0x34, 0xb2, 0x11, 0xeb, 0x5a, 0x30, 0xe9, 0x46, 0x15, 0x83, 0x95, 0xe6,
-	0x33, 0xeb, 0x87, 0x70, 0x8e, 0xb3, 0xfd, 0xbc, 0xce, 0x8b, 0x6e, 0xeb, 0x76, 0x62, 0xeb, 0x7d,
-	0x69, 0xc9, 0xc9, 0xed, 0x99, 0x3d, 0x69, 0xf4, 0x05, 0x9b, 0xfc, 0x57, 0x05, 0x28, 0xc5, 0x50,
-	0xeb, 0x2f, 0x3b, 0x4d, 0x79, 0xe6, 0xdc, 0x88, 0xbb, 0xf4, 0xa3, 0xac, 0xc4, 0x0d, 0xa4, 0x6e,
-	0x4b, 0x79, 0xf5, 0x93, 0xdb, 0x00, 0x1c, 0x59, 0x13, 0x71, 0xf0, 0x7a, 0x40, 0x78, 0x3f, 0xa1,
-	0x90, 0xa3, 0x81, 0x90, 0x1e, 0xa4, 0xcd, 0xbb, 0xf8, 0x46, 0xfa, 0xd9, 0xcf, 0x31, 0x0c, 0x0c,
-	0x15, 0xe8, 0x8d, 0x0c, 0x43, 0x7a, 0x1a, 0x7d, 0xeb, 0xbf, 0x1d, 0x84, 0x05, 0x7d, 0x01, 0x5f,
-	0x65, 0xac, 0x35, 0x98, 0x58, 0xf6, 0x3a, 0x21, 0xfd, 0x26, 0xd4, 0xc2, 0x70, 0x10, 0xe5, 0x8d,
-	0xa0, 0x6a, 0x84, 0x78, 0xcd, 0x0b, 0x1a, 0x4c, 0xd6, 0x33, 0xbc, 0x38, 0x23, 0x40, 0xb2, 0x0c,
-	0x53, 0x5b, 0xf4, 0x45, 0x62, 0x02, 0xd1, 0x93, 0xb4, 0x43, 0x5f, 0x34, 0xb4, 0x49, 0xd4, 0xdd,
-	0xfb, 0x0c, 0x1c, 0xf2, 0x04, 0xa6, 0xe5, 0xe6, 0x32, 0x26, 0xb3, 0xa4, 0x9f, 0xbc, 0xe6, 0x76,
-	0xe6, 0x61, 0x2d, 0x58, 0x0b, 0x19, 0x73, 0x18, 0xa3, 0xc8, 0x86, 0xce, 0x5b, 0xe4, 0x91, 0x1a,
-	0xcc, 0xa3, 0x5d, 0xab, 0x31, 0xfc, 0x74, 0xe3, 0x11, 0x1a, 0x74, 0x12, 0x56, 0x0d, 0x16, 0x93,
-	0xeb, 0x21, 0x5a, 0x7b, 0x17, 0x46, 0x78, 0xa9, 0x10, 0x95, 0x64, 0x84, 0x25, 0x05, 0xcd, 0x6d,
-	0x19, 0x2d, 0x71, 0x2a, 0xf1, 0x32, 0x6b, 0x0d, 0xed, 0x4b, 0x0a, 0x46, 0x09, 0xab, 0x77, 0xe2,
-	0xcb, 0x8b, 0x2e, 0xd0, 0x72, 0x79, 0x75, 0x5f, 0x1c, 0xf9, 0x54, 0x65, 0x19, 0x4d, 0x74, 0x3a,
-	0x25, 0xd1, 0xb1, 0xb7, 0x61, 0x54, 0x14, 0xc5, 0x62, 0x3f, 0x45, 0x9f, 0x9f, 0x04, 0xb0, 0x3e,
-	0x84, 0xf3, 0x68, 0x2f, 0x74, 0x3b, 0xfb, 0x6d, 0xba, 0x1b, 0x18, 0x8f, 0x4d, 0xfa, 0x7d, 0xd6,
-	0x3f, 0x82, 0x52, 0x1a, 0x6e, 0xdf, 0x2f, 0x9b, 0x47, 0x63, 0xf9, 0xcb, 0x01, 0x98, 0x5b, 0x0f,
-	0x74, 0x81, 0x4b, 0xcc, 0xc4, 0xad, 0xb4, 0xa8, 0x22, 0x38, 0x27, 0x6b, 0x67, 0xd2, 0xa2, 0x86,
-	0xbc, 0xab, 0xbd, 0xc0, 0x1d, 0xc8, 0x0b, 0x17, 0xc2, 0x8e, 0x2d, 0xf5, 0x06, 0xf7, 0x06, 0x0c,
-	0x6d, 0x31, 0x56, 0x3d, 0x28, 0xd6, 0x8e, 0x63, 0xb0, 0x22, 0x7c, 0x01, 0xcb, 0x8e, 0x48, 0xf6,
-	0x83, 0xdc, 0x4f, 0xbc, 0xb3, 0x1d, 0xea, 0x1f, 0x0e, 0x63, 0xed, 0x4c, 0xe2, 0xc9, 0xed, 0x7b,
-	0x30, 0x51, 0x69, 0x1d, 0x72, 0x57, 0x4d, 0xaf, 0x13, 0xfb, 0x2c, 0xb5, 0x9a, 0xb5, 0x33, 0xb6,
-	0x0e, 0x48, 0xae, 0xf3, 0xd7, 0x0e, 0x23, 0x19, 0x21, 0x42, 0x98, 0xb0, 0x56, 0xe9, 0x76, 0xab,
-	0x63, 0x30, 0xc2, 0xdf, 0x7e, 0x5a, 0x5f, 0x42, 0x49, 0x38, 0xf2, 0x70, 0xeb, 0x28, 0xba, 0xfb,
-	0x04, 0x91, 0xaf, 0x56, 0x9e, 0xf3, 0xcd, 0x65, 0x00, 0xd4, 0x85, 0xd6, 0x3b, 0x2d, 0xfa, 0x8d,
-	0xf0, 0x24, 0xd4, 0x4a, 0xac, 0x1f, 0xc0, 0xb8, 0x9a, 0x21, 0x14, 0xf8, 0xb5, 0xc3, 0x0e, 0x67,
-	0x6b, 0xce, 0x78, 0x58, 0x2c, 0x5f, 0x13, 0x9f, 0x37, 0xc6, 0x2e, 0x82, 0xf8, 0x70, 0x0d, 0xc1,
-	0x85, 0xf9, 0xd8, 0x26, 0x88, 0x62, 0x4a, 0x28, 0x19, 0x9d, 0xbb, 0x3a, 0xaa, 0xdf, 0x71, 0x11,
-	0x7e, 0xe0, 0x44, 0x22, 0xbc, 0xf5, 0x7f, 0x0f, 0xa0, 0x72, 0x99, 0x98, 0x8f, 0x98, 0x9d, 0x4e,
-	0xb7, 0x15, 0x56, 0x61, 0x1c, 0x47, 0xbf, 0x22, 0x1f, 0x12, 0xe6, 0xfb, 0xa1, 0x8c, 0xfd, 0xf2,
-	0xa8, 0x7c, 0x06, 0x9d, 0x4f, 0x22, 0x34, 0xf2, 0x09, 0x8c, 0xae, 0x76, 0x5a, 0x48, 0x61, 0xf0,
-	0x14, 0x14, 0x24, 0x12, 0x5b, 0x13, 0xec, 0xf2, 0x0e, 0xfb, 0x84, 0xb9, 0x79, 0xc7, 0xd6, 0x4a,
-	0x22, 0x2d, 0x77, 0x38, 0x4b, 0xcb, 0x1d, 0x89, 0x69, 0xb9, 0x16, 0x0c, 0x6f, 0xfb, 0x2d, 0x11,
-	0xaa, 0x67, 0x7a, 0x69, 0x52, 0x4c, 0x1c, 0x96, 0xd9, 0xbc, 0xca, 0xfa, 0x37, 0x05, 0x58, 0x78,
-	0x40, 0xc3, 0xd4, 0x3d, 0x64, 0xcc, 0x4a, 0xe1, 0x5b, 0xcf, 0xca, 0xc0, 0xab, 0xcc, 0x8a, 0x1a,
-	0xf5, 0x60, 0xd6, 0xa8, 0x87, 0xb2, 0x46, 0x3d, 0x9c, 0x3d, 0xea, 0x07, 0x30, 0xc2, 0x87, 0xca,
-	0x34, 0xf9, 0xf5, 0x90, 0x1e, 0x46, 0x9a, 0xbc, 0xee, 0x45, 0x67, 0xf3, 0x3a, 0x26, 0x48, 0x6e,
-	0x38, 0x81, 0xae, 0xc9, 0x8b, 0x9f, 0xd6, 0x4f, 0xf1, 0x09, 0xf2, 0x86, 0xd7, 0x7c, 0xa6, 0x59,
-	0x84, 0x47, 0xf9, 0x17, 0x1a, 0xbf, 0x41, 0x60, 0x50, 0xbc, 0xc6, 0x96, 0x10, 0xe4, 0x0a, 0x4c,
-	0xac, 0x77, 0xee, 0x7b, 0x7e, 0x93, 0x6e, 0x77, 0xda, 0x9c, 0xfa, 0x98, 0xad, 0x17, 0x09, 0x4b,
-	0x89, 0x68, 0x21, 0x32, 0x3f, 0x60, 0x41, 0xcc, 0xfc, 0xc0, 0xca, 0xf6, 0x96, 0x6c, 0x5e, 0x27,
-	0x0c, 0x31, 0xec, 0xef, 0x3c, 0xcd, 0x5d, 0xa9, 0xf8, 0xfd, 0x00, 0x9f, 0xc0, 0x79, 0x9b, 0x76,
-	0xdb, 0x0e, 0x93, 0xe9, 0x0e, 0x3d, 0x0e, 0xaf, 0xc6, 0x7c, 0x25, 0xe5, 0xf9, 0xa0, 0xe9, 0x53,
-	0xa1, 0xba, 0x3c, 0x90, 0xd3, 0xe5, 0x43, 0xb8, 0xfa, 0x80, 0x86, 0x26, 0x43, 0x8d, 0xec, 0xcd,
-	0x62, 0xf0, 0x6b, 0x30, 0x16, 0x98, 0xb6, 0x72, 0xf9, 0x1c, 0x2e, 0x15, 0x71, 0xef, 0x9e, 0xbc,
-	0x4d, 0x12, 0x74, 0xd4, 0x5f, 0xd6, 0xa7, 0x50, 0xce, 0x6a, 0xee, 0x64, 0x2e, 0xaf, 0x2e, 0x5c,
-	0xc9, 0x26, 0x20, 0xba, 0xbb, 0x0a, 0xd2, 0xae, 0x2e, 0x3e, 0xa1, 0x7e, 0xbd, 0x35, 0x4d, 0xf1,
-	0xe2, 0x0f, 0xab, 0x2a, 0x9d, 0xff, 0xbe, 0x45, 0x77, 0x1b, 0x78, 0x65, 0x6d, 0x12, 0x88, 0xe6,
-	0xb5, 0x02, 0x63, 0xb2, 0x4c, 0xcc, 0xeb, 0x42, 0x6a, 0x4f, 0xe5, 0x84, 0xb6, 0x24, 0x01, 0x85,
-	0x66, 0xfd, 0x54, 0x5e, 0xdf, 0x98, 0x18, 0x27, 0x7b, 0x4f, 0x7b, 0x92, 0xfb, 0x1a, 0xcb, 0x83,
-	0xf3, 0x26, 0x6d, 0xdd, 0x2c, 0x5f, 0xd4, 0xcc, 0xf2, 0xdc, 0x1a, 0x7f, 0xc5, 0x34, 0x13, 0x0b,
-	0x4b, 0x83, 0x56, 0x44, 0x2e, 0xeb, 0xc6, 0xf7, 0xc9, 0xe4, 0x03, 0xdd, 0x3b, 0x50, 0x4a, 0x6b,
-	0x50, 0xd3, 0x03, 0x95, 0x85, 0x57, 0xc8, 0x3b, 0x2b, 0x70, 0x59, 0x06, 0xcb, 0xf2, 0xbc, 0x30,
-	0x08, 0x7d, 0xa7, 0x5b, 0x6f, 0xfa, 0x6e, 0x37, 0xc2, 0xb2, 0x60, 0x84, 0x97, 0x88, 0x99, 0xe0,
-	0x57, 0x61, 0x1c, 0x46, 0xd4, 0x58, 0xbf, 0x57, 0x00, 0xcb, 0xf0, 0xd3, 0xc2, 0x75, 0xae, 0xf9,
-	0xde, 0x73, 0xb7, 0xa5, 0x5d, 0x3f, 0xbd, 0x65, 0x98, 0x3e, 0xf9, 0x5b, 0xc5, 0xb8, 0x8b, 0xb8,
-	0xe0, 0x99, 0x77, 0x62, 0xe6, 0x48, 0x2e, 0x78, 0xa2, 0xef, 0x96, 0x19, 0xfd, 0x48, 0x99, 0x29,
-	0xff, 0x5d, 0x01, 0xae, 0xe5, 0xf6, 0x41, 0x8c, 0xe7, 0x09, 0x14, 0xe3, 0x75, 0x62, 0x07, 0x95,
-	0x35, 0xbf, 0x8d, 0x24, 0x85, 0xbd, 0xbb, 0xdc, 0x0f, 0x5d, 0xfa, 0x37, 0x75, 0x15, 0xe5, 0x04,
-	0xbd, 0xd3, 0xf7, 0x1e, 0x43, 0x6a, 0x78, 0xa1, 0xd3, 0x5e, 0x46, 0x03, 0xc0, 0x60, 0xf4, 0xa6,
-	0x20, 0x64, 0xa5, 0x8d, 0x78, 0xe4, 0x0e, 0x0d, 0xd8, 0xfa, 0x31, 0x7e, 0xd7, 0xe9, 0x9d, 0x3e,
-	0xd9, 0xa7, 0xb6, 0x0c, 0xd7, 0x62, 0xbe, 0x03, 0xaf, 0x40, 0x24, 0x84, 0x79, 0x36, 0xfd, 0x4c,
-	0xf6, 0x7e, 0xe0, 0x7b, 0xbd, 0xee, 0x6f, 0x66, 0xd5, 0xff, 0xa2, 0xc0, 0x9d, 0x39, 0xf5, 0x66,
-	0xc5, 0x42, 0x2f, 0x03, 0x44, 0xa5, 0x31, 0xa7, 0x7e, 0x55, 0xb1, 0x77, 0x97, 0xab, 0xdc, 0x78,
-	0xab, 0xb0, 0xcf, 0x09, 0x68, 0x68, 0xbf, 0xd9, 0x95, 0xbc, 0x87, 0x0e, 0x03, 0xaa, 0xf5, 0x93,
-	0xcd, 0xfb, 0x7b, 0xd2, 0xfe, 0x71, 0x4a, 0xbc, 0x03, 0x98, 0x63, 0x1c, 0xa0, 0xd2, 0x0b, 0x0f,
-	0x3c, 0xdf, 0x0d, 0xe5, 0xf3, 0x14, 0x52, 0x13, 0x91, 0x02, 0x38, 0xd6, 0x8f, 0x7e, 0x7d, 0x54,
-	0x7e, 0xff, 0x34, 0x61, 0x49, 0x25, 0xcd, 0x1d, 0x15, 0x5d, 0xc0, 0x5a, 0x80, 0xc1, 0x65, 0x7b,
-	0x03, 0x19, 0x9e, 0xbd, 0xa1, 0x18, 0x9e, 0xbd, 0x61, 0xfd, 0xcd, 0x00, 0x94, 0x79, 0x2c, 0x13,
-	0xf4, 0x33, 0x89, 0xac, 0x16, 0x9a, 0xe3, 0xca, 0x49, 0x0d, 0x0c, 0xb1, 0x58, 0x25, 0x03, 0x27,
-	0x89, 0x55, 0xf2, 0x3b, 0x90, 0x61, 0xb2, 0x3a, 0x81, 0x15, 0xe0, 0xcd, 0xe3, 0xa3, 0xf2, 0xb5,
-	0xc8, 0x0a, 0xc0, 0x6b, 0xd3, 0xcc, 0x01, 0x19, 0x4d, 0x24, 0xed, 0x17, 0x43, 0xaf, 0x60, 0xbf,
-	0xb8, 0x03, 0xa3, 0xa8, 0xcc, 0xac, 0xd7, 0x84, 0xe7, 0x27, 0x6e, 0x4f, 0x0c, 0x9a, 0xd4, 0x70,
-	0xf5, 0xe8, 0x86, 0x12, 0xcc, 0xfa, 0x9f, 0x06, 0xe0, 0x4a, 0xf6, 0x9c, 0x8b, 0xbe, 0xad, 0x00,
-	0x44, 0x1e, 0x2e, 0x79, 0x1e, 0x35, 0xf8, 0xed, 0xbc, 0xa0, 0x4f, 0x94, 0x47, 0x9b, 0x86, 0xc7,
-	0x64, 0x1f, 0xf9, 0x02, 0x3b, 0x76, 0x9d, 0x62, 0x3c, 0xcc, 0x16, 0xc1, 0x76, 0x45, 0x91, 0x11,
-	0x6c, 0x57, 0x94, 0x91, 0x27, 0xb0, 0x50, 0xf3, 0xdd, 0xe7, 0x4e, 0x48, 0x1f, 0xd1, 0x97, 0xfc,
-	0xb1, 0xd0, 0xaa, 0x78, 0x21, 0xc4, 0x9f, 0xd5, 0xdf, 0x3c, 0x3e, 0x2a, 0xbf, 0xd1, 0xe5, 0x20,
-	0x18, 0xe8, 0x8d, 0xbf, 0x09, 0x6d, 0x24, 0x1f, 0x0d, 0x65, 0x11, 0xb2, 0xfe, 0x61, 0x01, 0x2e,
-	0xa0, 0x58, 0x2e, 0xcc, 0xae, 0xb2, 0xf1, 0x57, 0x72, 0xac, 0xd4, 0x07, 0x28, 0xf6, 0x22, 0x3a,
-	0x56, 0x1a, 0x2f, 0xd4, 0x6d, 0x03, 0x8c, 0xac, 0xc3, 0x84, 0xf8, 0x8d, 0xdf, 0xdf, 0x20, 0x2a,
-	0x04, 0xf3, 0x1a, 0xc3, 0xc2, 0xad, 0xce, 0x4d, 0x45, 0xb8, 0xb1, 0x05, 0x31, 0x7c, 0xc8, 0x69,
-	0xeb, 0xb8, 0xd6, 0xaf, 0x06, 0xe0, 0xe2, 0x1e, 0xf5, 0xdd, 0xa7, 0x2f, 0x33, 0x06, 0xb3, 0x0d,
-	0x73, 0xb2, 0x88, 0xc7, 0x33, 0x31, 0x3e, 0x31, 0x1e, 0x9e, 0x53, 0x76, 0x55, 0x04, 0x44, 0x91,
-	0x5f, 0x5c, 0x2a, 0xe2, 0x29, 0x5c, 0x26, 0xdf, 0x85, 0xb1, 0x58, 0x44, 0x21, 0x5c, 0x7f, 0xf9,
-	0x85, 0x46, 0x4b, 0xb5, 0x76, 0xc6, 0x56, 0x90, 0xe4, 0x0f, 0xb2, 0xaf, 0xaa, 0x84, 0xe9, 0xa3,
-	0x9f, 0xfd, 0x13, 0x3f, 0x58, 0xf6, 0xb1, 0x3a, 0x5a, 0x6d, 0xca, 0x07, 0xbb, 0x76, 0xc6, 0xce,
-	0x6a, 0xa9, 0x3a, 0x01, 0xe3, 0x15, 0xbc, 0xb7, 0x63, 0x9a, 0xfb, 0xbf, 0x1d, 0x80, 0xcb, 0xf2,
-	0xe1, 0x4f, 0xc6, 0x34, 0x7f, 0x0e, 0x0b, 0xb2, 0xa8, 0xd2, 0x65, 0x02, 0x03, 0x6d, 0x99, 0x33,
-	0xcd, 0x43, 0xe4, 0xca, 0x99, 0x76, 0x04, 0x4c, 0x34, 0xd9, 0x59, 0xe8, 0xaf, 0xc7, 0xfa, 0xf9,
-	0x49, 0x5a, 0x7c, 0x27, 0xb4, 0x42, 0xea, 0x3c, 0xd3, 0x98, 0x1a, 0x83, 0x7f, 0xb6, 0x12, 0xd6,
-	0xd3, 0xa1, 0x6f, 0x6b, 0x3d, 0x5d, 0x3b, 0x13, 0xb7, 0x9f, 0x56, 0xa7, 0x61, 0x72, 0x8b, 0xbe,
-	0x88, 0xe6, 0xfd, 0xbf, 0x2c, 0xc4, 0x42, 0x40, 0x30, 0x09, 0x83, 0xc7, 0x82, 0x28, 0x44, 0x21,
-	0x82, 0x30, 0x04, 0x84, 0x2e, 0x61, 0x70, 0xd0, 0x75, 0x18, 0xe5, 0x97, 0xd9, 0xad, 0x13, 0x68,
-	0xf8, 0xea, 0x05, 0x0f, 0x7f, 0x56, 0xd9, 0xe2, 0xca, 0xbe, 0xc0, 0xb7, 0x1e, 0xc1, 0x55, 0xe1,
-	0xe3, 0x6d, 0x2e, 0x3e, 0x36, 0x74, 0xca, 0xe3, 0xcb, 0x72, 0xe0, 0xf2, 0x03, 0x1a, 0x67, 0x3d,
-	0xc6, 0x0b, 0xa7, 0x4f, 0x61, 0xc6, 0x28, 0x57, 0x14, 0x51, 0x2a, 0x55, 0x7b, 0x48, 0x91, 0x8e,
-	0x43, 0x5b, 0x57, 0xd2, 0x9a, 0xd0, 0x3b, 0x6b, 0x51, 0x8c, 0x75, 0xeb, 0x6b, 0x41, 0xd3, 0x4e,
-	0xc1, 0xf5, 0x6e, 0x6a, 0xdf, 0x35, 0xe7, 0x78, 0x3c, 0xa0, 0xa1, 0x3c, 0x79, 0x55, 0xad, 0x35,
-	0x65, 0xdc, 0x05, 0x58, 0xd3, 0x30, 0x29, 0xab, 0xda, 0x34, 0x08, 0xac, 0xff, 0x75, 0x04, 0x2c,
-	0x31, 0xb1, 0x69, 0x37, 0xf4, 0x72, 0x3e, 0x9e, 0x24, 0x3a, 0x2b, 0x0e, 0xaa, 0x73, 0x7a, 0x28,
-	0xd7, 0xa8, 0x96, 0xef, 0x3c, 0x94, 0xf3, 0x52, 0x03, 0xc8, 0xad, 0x9d, 0xb1, 0x13, 0xa3, 0xff,
-	0x2a, 0x83, 0x4d, 0xf2, 0x8f, 0xed, 0xfa, 0xf1, 0x51, 0xf9, 0x6a, 0x06, 0x9b, 0x34, 0xe8, 0xa6,
-	0xb3, 0x4c, 0xdb, 0xbc, 0x12, 0x19, 0x7c, 0x95, 0x2b, 0x11, 0xf6, 0x45, 0xea, 0x97, 0x22, 0xbb,
-	0xe6, 0x5c, 0x8a, 0xef, 0x51, 0xde, 0xde, 0xeb, 0x55, 0x22, 0x12, 0x83, 0x56, 0x62, 0x50, 0x35,
-	0xc8, 0x10, 0x17, 0x8a, 0x9a, 0xcd, 0x72, 0xf9, 0x80, 0x36, 0x9f, 0x09, 0x5b, 0xb1, 0xbc, 0xd0,
-	0x4d, 0xb3, 0x99, 0xf3, 0x70, 0xdb, 0xfc, 0x3b, 0xe7, 0x15, 0x8d, 0x26, 0x43, 0xd5, 0x23, 0x49,
-	0xc4, 0xc9, 0x92, 0x9f, 0xc3, 0xac, 0x5a, 0xea, 0x98, 0x8b, 0xd6, 0xc4, 0xd2, 0x1b, 0x51, 0x04,
-	0xd8, 0xc3, 0xa7, 0xce, 0xad, 0xe7, 0x77, 0x6f, 0xa5, 0xc0, 0xf2, 0x00, 0x05, 0x4d, 0x59, 0xa1,
-	0xf9, 0x67, 0xe9, 0x17, 0x5d, 0x29, 0x88, 0xe4, 0x0b, 0x98, 0xab, 0xd7, 0xb7, 0xf9, 0x63, 0x0e,
-	0x5b, 0x5e, 0xf0, 0xdb, 0x1b, 0xc2, 0x61, 0x0b, 0x97, 0x3b, 0x08, 0xbc, 0x86, 0x78, 0x04, 0xa2,
-	0xbb, 0x05, 0xe8, 0x21, 0x1a, 0xd2, 0x48, 0x90, 0x4f, 0x61, 0x12, 0x03, 0x39, 0x55, 0x5a, 0x2d,
-	0x9f, 0x2d, 0xcc, 0x58, 0x74, 0xd0, 0xf2, 0x98, 0x4f, 0x0e, 0xaf, 0xd0, 0xe3, 0xfa, 0xea, 0x08,
-	0xfa, 0x55, 0xfb, 0xff, 0xa0, 0x1e, 0x3b, 0x30, 0x59, 0xc6, 0x6d, 0x53, 0xf1, 0x6a, 0x49, 0x7e,
-	0x19, 0x19, 0xd7, 0x84, 0x85, 0xef, 0xf8, 0x9a, 0xf0, 0xff, 0x1b, 0x90, 0x4f, 0x3c, 0x92, 0x37,
-	0xb5, 0xa7, 0xbe, 0x2d, 0x4c, 0x1d, 0xc1, 0x89, 0x0e, 0xfa, 0xd4, 0xce, 0x91, 0xaa, 0xbc, 0x6b,
-	0x55, 0x51, 0xd0, 0xa6, 0xd5, 0xbd, 0x45, 0x54, 0x61, 0x5c, 0xbf, 0xa2, 0x58, 0xa5, 0x61, 0xc5,
-	0x2f, 0xf2, 0x06, 0xbf, 0xfd, 0x45, 0xde, 0x2f, 0x60, 0x5e, 0xbe, 0xad, 0x5a, 0xa6, 0x9d, 0x90,
-	0xfa, 0xf2, 0xca, 0x7f, 0x3a, 0x8a, 0x26, 0x87, 0x71, 0x03, 0x8b, 0x30, 0x58, 0xb1, 0xb7, 0x84,
-	0x49, 0x88, 0xfd, 0x49, 0xae, 0x98, 0x1e, 0x75, 0xfc, 0xd1, 0x9c, 0xe1, 0x3f, 0x77, 0x85, 0x75,
-	0x97, 0x1b, 0x6a, 0x5c, 0x19, 0x03, 0xd0, 0xd6, 0x8b, 0xac, 0x65, 0xb8, 0x60, 0x36, 0x5f, 0xa3,
-	0xfe, 0xa1, 0x8b, 0xc2, 0x7b, 0x9d, 0x86, 0xb2, 0xd1, 0x42, 0xd4, 0x28, 0xd1, 0x3d, 0xb2, 0x85,
-	0x1e, 0xf9, 0x1f, 0x06, 0xa0, 0x9c, 0x3a, 0x88, 0x4a, 0x10, 0xb8, 0xfb, 0x1d, 0x0c, 0xcd, 0x71,
-	0x11, 0x86, 0x1e, 0xb9, 0x9d, 0x96, 0xae, 0x89, 0x3e, 0x73, 0x3b, 0x2d, 0x1b, 0x4b, 0x99, 0x12,
-	0x53, 0xef, 0x3d, 0x41, 0x00, 0x4d, 0xc7, 0x0e, 0x7a, 0x4f, 0x1a, 0x0c, 0x48, 0x57, 0x62, 0x04,
-	0x18, 0xb9, 0x0e, 0xa3, 0x32, 0x8c, 0xdb, 0x60, 0x64, 0x7e, 0x93, 0xf1, 0xdb, 0x64, 0x1d, 0xf9,
-	0x18, 0xc6, 0x36, 0x69, 0xe8, 0xb4, 0x9c, 0xd0, 0x11, 0x7b, 0x47, 0x26, 0xfa, 0x90, 0xc5, 0xd5,
-	0xa2, 0x38, 0xe2, 0xc7, 0x0e, 0x45, 0x89, 0xad, 0x50, 0x70, 0x02, 0xdd, 0xa0, 0xdb, 0x76, 0x5e,
-	0x2a, 0x6f, 0x54, 0x36, 0x81, 0x51, 0x11, 0x79, 0xcf, 0xf4, 0xd9, 0x88, 0xee, 0xdf, 0x52, 0x27,
-	0x24, 0xf2, 0xe8, 0x58, 0x43, 0x3f, 0x92, 0x68, 0xaa, 0x45, 0x98, 0x42, 0x2b, 0x15, 0xdb, 0x80,
-	0xb4, 0x4d, 0x44, 0xeb, 0xef, 0x01, 0x9c, 0xad, 0x39, 0xfb, 0x6e, 0x87, 0x89, 0x24, 0x36, 0x0d,
-	0xbc, 0x9e, 0xdf, 0xa4, 0xa4, 0x02, 0xd3, 0xa6, 0x07, 0x78, 0x1f, 0xff, 0x76, 0x26, 0x75, 0x99,
-	0x65, 0x64, 0x09, 0xc6, 0xd5, 0xab, 0x73, 0x21, 0x2a, 0xa5, 0xbc, 0x46, 0x5f, 0x3b, 0x63, 0x47,
-	0x60, 0xe4, 0x03, 0xe3, 0xf6, 0x72, 0x46, 0x05, 0x50, 0x40, 0xd8, 0x25, 0xee, 0xa2, 0xdb, 0x31,
-	0x42, 0x9d, 0xa8, 0x0b, 0xcd, 0x9f, 0x26, 0x2e, 0x34, 0x87, 0x8d, 0x1e, 0x27, 0xac, 0xba, 0x28,
-	0xe9, 0x66, 0x46, 0xf3, 0x4f, 0xb9, 0xea, 0xfc, 0x12, 0x26, 0x1e, 0xf5, 0x9e, 0x50, 0x79, 0x75,
-	0x3b, 0x22, 0xa4, 0xbf, 0xf8, 0xbb, 0x06, 0x51, 0xbf, 0x77, 0x8f, 0x7f, 0xc5, 0xcf, 0x7a, 0x4f,
-	0x68, 0x32, 0x4d, 0x04, 0x3b, 0x76, 0x35, 0x62, 0xe4, 0x00, 0x8a, 0xf1, 0x27, 0x08, 0x62, 0x49,
-	0x73, 0x1e, 0x4e, 0x60, 0x04, 0x21, 0x2d, 0x19, 0x05, 0x77, 0x8c, 0x36, 0x1a, 0x49, 0x50, 0x25,
-	0xbf, 0x80, 0xf9, 0x54, 0x9b, 0xba, 0x7a, 0x44, 0x99, 0x6f, 0xae, 0xc7, 0x33, 0x2c, 0x36, 0x6b,
-	0xf2, 0xc5, 0xa6, 0xd1, 0x72, 0x7a, 0x2b, 0xa4, 0x05, 0x33, 0x31, 0xd7, 0x7a, 0x91, 0x41, 0x27,
-	0xdb, 0x59, 0x1f, 0xc5, 0x2e, 0x19, 0x78, 0x3a, 0xb5, 0xad, 0x38, 0x49, 0xb2, 0x01, 0xe3, 0xca,
-	0x98, 0x25, 0x82, 0xfe, 0xa5, 0x19, 0xee, 0x16, 0x8f, 0x8f, 0xca, 0x73, 0x91, 0xe1, 0xce, 0xa0,
-	0x19, 0x11, 0x20, 0xbf, 0x5f, 0x80, 0x73, 0xe9, 0x86, 0xcd, 0xc5, 0x49, 0xa4, 0xdd, 0xd7, 0xee,
-	0x8b, 0xaa, 0x23, 0x3e, 0xdc, 0x73, 0x5b, 0xd1, 0x03, 0x57, 0x69, 0x00, 0x36, 0xda, 0xcd, 0x68,
-	0x89, 0xdc, 0x01, 0xd8, 0x77, 0x43, 0xb1, 0xc6, 0x18, 0x7f, 0x2e, 0xf9, 0x81, 0xb0, 0x6e, 0xef,
-	0xbb, 0xa1, 0x58, 0xe9, 0x3f, 0x2d, 0xf4, 0xe5, 0xab, 0x18, 0x96, 0x6e, 0x62, 0xe9, 0x46, 0x1e,
-	0xd3, 0x89, 0xa0, 0xab, 0x77, 0x8e, 0x8f, 0xca, 0xef, 0xa8, 0xd8, 0x66, 0x4d, 0x84, 0x92, 0xcf,
-	0x74, 0x1b, 0x8e, 0x82, 0x33, 0xc6, 0xd3, 0x97, 0xb5, 0xbf, 0x03, 0x23, 0x68, 0x5a, 0x0a, 0x16,
-	0xa7, 0x50, 0xf9, 0xc2, 0x88, 0x5c, 0x68, 0x80, 0xd2, 0x65, 0x19, 0x01, 0x43, 0xd6, 0x98, 0x12,
-	0x83, 0xe2, 0x9e, 0x54, 0x3a, 0x44, 0xfc, 0x3e, 0xa1, 0x08, 0xf3, 0x2a, 0x19, 0x40, 0xc7, 0x48,
-	0x97, 0x62, 0xa2, 0x55, 0x01, 0xc6, 0x7c, 0xc1, 0xee, 0x1e, 0x0e, 0x8d, 0x0d, 0x15, 0x87, 0x79,
-	0x1c, 0x23, 0xfe, 0x5d, 0xca, 0x8b, 0xa6, 0xab, 0x8a, 0x37, 0x6d, 0xfb, 0xe9, 0x0b, 0x63, 0xfd,
-	0xe1, 0x18, 0x7f, 0x62, 0xbe, 0xdb, 0x71, 0x9f, 0xba, 0x11, 0x0b, 0xd5, 0xad, 0xd7, 0x51, 0xc2,
-	0x32, 0xa1, 0x5b, 0x66, 0xa4, 0x26, 0x53, 0x86, 0xee, 0x81, 0xbe, 0x86, 0xee, 0x7b, 0xda, 0x95,
-	0xb0, 0x16, 0xd0, 0x97, 0xeb, 0x10, 0xa6, 0x61, 0x39, 0xba, 0x2b, 0xfe, 0x1a, 0x46, 0x30, 0x06,
-	0x2f, 0xbf, 0x6f, 0x9f, 0x58, 0xba, 0x25, 0xd6, 0x3d, 0xa7, 0xfb, 0x3c, 0x68, 0xaf, 0x08, 0x1b,
-	0xc1, 0x97, 0x06, 0x0b, 0x8c, 0xa5, 0xc1, 0x12, 0xb2, 0x03, 0xb3, 0x35, 0x26, 0xd2, 0xf2, 0xb7,
-	0x0b, 0x5d, 0x5f, 0x18, 0xff, 0xb8, 0x59, 0x11, 0x45, 0xea, 0xae, 0xac, 0x6e, 0x50, 0x55, 0xaf,
-	0x0b, 0x85, 0x29, 0xe8, 0x64, 0x15, 0xa6, 0xeb, 0xd4, 0xf1, 0x9b, 0x07, 0x8f, 0xe8, 0x4b, 0xa6,
-	0x4e, 0x18, 0x39, 0x7d, 0x02, 0xac, 0x61, 0xe3, 0xc5, 0x2a, 0xdd, 0x87, 0xca, 0x44, 0x22, 0x3f,
-	0x86, 0x91, 0xba, 0xe7, 0x87, 0xd5, 0x97, 0x82, 0xad, 0xca, 0x1b, 0x59, 0x5e, 0x58, 0x3d, 0x2f,
-	0xf3, 0x1a, 0x05, 0x9e, 0x1f, 0x36, 0x9e, 0x18, 0xb1, 0xe0, 0x38, 0x08, 0x79, 0x09, 0x73, 0x26,
-	0x4b, 0x13, 0x2e, 0xf5, 0x63, 0x42, 0x8d, 0x49, 0xe3, 0x9b, 0x1c, 0xa4, 0x7a, 0x53, 0x50, 0xbf,
-	0x12, 0x67, 0x9c, 0x4f, 0xb1, 0x5e, 0x97, 0xfd, 0xd3, 0xf0, 0xc9, 0x26, 0x26, 0x78, 0xe2, 0x23,
-	0xaa, 0x04, 0xdc, 0x15, 0x7f, 0x3c, 0x8a, 0x36, 0xd8, 0x43, 0xb6, 0x88, 0x33, 0xe1, 0x04, 0xf1,
-	0xac, 0x60, 0x76, 0x02, 0x95, 0xd4, 0xe0, 0xec, 0x6e, 0x40, 0x6b, 0x3e, 0x7d, 0xee, 0xd2, 0x17,
-	0x92, 0x1e, 0x44, 0xa1, 0xd9, 0x18, 0xbd, 0x2e, 0xaf, 0x4d, 0x23, 0x98, 0x44, 0x26, 0x1f, 0x00,
-	0xd4, 0xdc, 0x4e, 0x87, 0xb6, 0xf0, 0x5a, 0x7f, 0x02, 0x49, 0xe1, 0x95, 0x45, 0x17, 0x4b, 0x1b,
-	0x5e, 0xa7, 0xad, 0x4f, 0xa9, 0x06, 0x4c, 0xaa, 0x30, 0xb5, 0xde, 0x69, 0xb6, 0x7b, 0xc2, 0xfd,
-	0x26, 0x40, 0x96, 0x2a, 0x42, 0x46, 0xba, 0xbc, 0xa2, 0x91, 0xe0, 0x06, 0x26, 0x0a, 0x79, 0x04,
-	0x44, 0x14, 0x88, 0x5d, 0xeb, 0x3c, 0x69, 0x53, 0xc1, 0x17, 0x50, 0x43, 0x92, 0x84, 0x70, 0xbb,
-	0x1b, 0x91, 0x18, 0x13, 0x68, 0xa5, 0x0f, 0x60, 0x42, 0xdb, 0xf3, 0x29, 0x71, 0x50, 0xe6, 0xf4,
-	0x38, 0x28, 0xe3, 0x7a, 0xbc, 0x93, 0xff, 0xbd, 0x00, 0x17, 0xd3, 0xbf, 0x25, 0xa1, 0x44, 0x6c,
-	0xc3, 0xb8, 0x2a, 0x54, 0x2f, 0xdf, 0xa4, 0x6a, 0x1d, 0x93, 0xc1, 0xf8, 0x07, 0x2d, 0x59, 0x94,
-	0x3e, 0xfa, 0x88, 0xc6, 0x2b, 0xdc, 0x77, 0xfd, 0xd7, 0x63, 0x30, 0x87, 0x2f, 0x3c, 0xe2, 0x7c,
-	0xea, 0x53, 0x8c, 0x67, 0x84, 0x65, 0xda, 0xf5, 0x8d, 0xb0, 0xe4, 0xf2, 0xf2, 0x78, 0xc4, 0x3f,
-	0x03, 0x81, 0xfc, 0x40, 0xf7, 0x39, 0x1a, 0xd0, 0x12, 0x50, 0xc9, 0x42, 0x7d, 0x08, 0x91, 0x33,
-	0xd2, 0x5b, 0x86, 0xcb, 0xcb, 0x89, 0x99, 0xde, 0xd0, 0x49, 0x99, 0xde, 0xae, 0x62, 0x7a, 0x3c,
-	0x4e, 0xce, 0x9b, 0x1a, 0xd3, 0x7b, 0xfd, 0xdc, 0x6e, 0xe4, 0x75, 0x73, 0xbb, 0xd1, 0x6f, 0xc7,
-	0xed, 0xc6, 0x5e, 0x91, 0xdb, 0xdd, 0x87, 0xe9, 0x2d, 0x4a, 0x5b, 0xda, 0x45, 0xe4, 0x78, 0x74,
-	0xcc, 0x76, 0x28, 0x9a, 0x98, 0xd3, 0x6e, 0x23, 0x63, 0x58, 0x99, 0x5c, 0x13, 0xfe, 0x6e, 0xb8,
-	0xe6, 0xc4, 0x6b, 0xe6, 0x9a, 0x93, 0xdf, 0x86, 0x6b, 0x26, 0x58, 0xdf, 0xd4, 0xa9, 0x59, 0xdf,
-	0xb7, 0xe1, 0x56, 0xff, 0xcb, 0x00, 0x2c, 0xb0, 0x0f, 0xa0, 0xfd, 0x9c, 0xd6, 0xeb, 0x6b, 0xc2,
-	0x55, 0x2b, 0x72, 0x89, 0x3a, 0xf0, 0x02, 0xf9, 0xaa, 0x01, 0xff, 0x66, 0x65, 0x5d, 0xcf, 0x97,
-	0x6e, 0x25, 0xf8, 0x37, 0xa9, 0xc2, 0x08, 0xff, 0x42, 0x16, 0x07, 0x8d, 0x20, 0x54, 0x19, 0x74,
-	0xf5, 0xef, 0xcb, 0x16, 0x98, 0xe4, 0x2e, 0xcc, 0xa5, 0x7d, 0x2a, 0xc2, 0xde, 0x30, 0xdb, 0x4d,
-	0xf9, 0x4c, 0xde, 0x84, 0x99, 0xd8, 0xc7, 0xc0, 0x73, 0xce, 0xd8, 0xd3, 0x81, 0xf1, 0x21, 0x7c,
-	0x9b, 0xe9, 0x59, 0x86, 0xc5, 0xe4, 0x28, 0x04, 0x1f, 0x7f, 0x13, 0xc4, 0x5b, 0x6e, 0xa1, 0x16,
-	0xc7, 0x05, 0x71, 0x5b, 0x54, 0x5b, 0x9f, 0xa0, 0x5b, 0xb4, 0x22, 0x10, 0x68, 0xf3, 0xbb, 0xa6,
-	0xcd, 0xef, 0x9a, 0x98, 0xdf, 0x9a, 0x36, 0xbf, 0xec, 0x6f, 0xab, 0x8a, 0xce, 0xd0, 0x3a, 0xbe,
-	0x7a, 0x5d, 0x35, 0x2a, 0x9e, 0x66, 0x8b, 0x73, 0x24, 0xd1, 0x05, 0x59, 0x6f, 0xfd, 0x65, 0x81,
-	0x3b, 0x56, 0xfc, 0xa7, 0x78, 0x1c, 0x7d, 0x1b, 0x67, 0x87, 0x3f, 0x88, 0x42, 0xb6, 0x88, 0xf0,
-	0x32, 0xbe, 0xd3, 0x7c, 0x16, 0x79, 0x9b, 0xfc, 0x84, 0xf1, 0x52, 0xbd, 0x42, 0x68, 0x4d, 0x0b,
-	0x6a, 0xa6, 0xf4, 0xca, 0xbd, 0xbb, 0x92, 0xc9, 0x8a, 0xc8, 0x35, 0xbc, 0xd8, 0x64, 0xb2, 0x3a,
-	0x02, 0xfa, 0xfb, 0xce, 0x58, 0x36, 0x8f, 0x38, 0x92, 0xda, 0x83, 0xf7, 0x92, 0x31, 0x33, 0x50,
-	0xe5, 0x8c, 0x62, 0x66, 0xe8, 0xd3, 0x18, 0x45, 0xcf, 0xd8, 0x85, 0x0b, 0x36, 0x3d, 0xf4, 0x9e,
-	0xd3, 0xd7, 0x4b, 0xf6, 0x2b, 0x38, 0x6f, 0x12, 0xe4, 0xaf, 0x2b, 0x79, 0x8a, 0x90, 0x4f, 0xd2,
-	0x13, 0x8b, 0x08, 0x04, 0x9e, 0x58, 0x84, 0xe7, 0x27, 0x60, 0x7f, 0xea, 0x67, 0x33, 0xd6, 0x59,
-	0x1e, 0x5c, 0x34, 0x89, 0x57, 0x5a, 0x2d, 0x4c, 0x91, 0xdc, 0x74, 0xbb, 0x4e, 0x27, 0x24, 0xdb,
-	0x30, 0xa1, 0xfd, 0x8c, 0x19, 0x84, 0xb4, 0x1a, 0x21, 0x37, 0x46, 0x05, 0x46, 0x7c, 0xe7, 0xa8,
-	0xd8, 0xa2, 0x50, 0x8e, 0x4f, 0x0f, 0x9b, 0x32, 0xbd, 0xcd, 0x2a, 0x4c, 0x69, 0x3f, 0xd5, 0xb5,
-	0x0b, 0x32, 0x58, 0xad, 0x05, 0x73, 0xc2, 0x4c, 0x14, 0xab, 0x09, 0xa5, 0xb4, 0x49, 0xe3, 0x89,
-	0x00, 0xc8, 0x6a, 0x14, 0xcf, 0xaf, 0xbf, 0xc7, 0xf0, 0x4c, 0x56, 0x2c, 0x3f, 0xeb, 0xbf, 0x1b,
-	0x82, 0x0b, 0x62, 0x31, 0x5e, 0xe7, 0x8a, 0x93, 0x9f, 0xc2, 0x84, 0xb6, 0xc6, 0x62, 0xd2, 0xaf,
-	0xc8, 0xb7, 0x91, 0x59, 0x7b, 0x81, 0x1b, 0xae, 0x7a, 0x58, 0xd0, 0x88, 0x2d, 0xf7, 0xda, 0x19,
-	0x5b, 0x27, 0x49, 0xda, 0x30, 0x6d, 0x2e, 0xb4, 0xb0, 0xdd, 0x5d, 0x4b, 0x6d, 0xc4, 0x04, 0x95,
-	0x59, 0x02, 0x5a, 0x8d, 0xd4, 0xe5, 0x5e, 0x3b, 0x63, 0xc7, 0x68, 0x93, 0x6f, 0xe0, 0x6c, 0x62,
-	0x95, 0x85, 0x61, 0xf6, 0x46, 0x6a, 0x83, 0x09, 0x68, 0x7e, 0xa5, 0xe4, 0x63, 0x71, 0x66, 0xb3,
-	0xc9, 0x46, 0x48, 0x0b, 0x26, 0xf5, 0x85, 0x17, 0xc6, 0xc5, 0xab, 0x39, 0x53, 0xc9, 0x01, 0xb9,
-	0x00, 0x2d, 0xe6, 0x12, 0xd7, 0xfe, 0xa5, 0x79, 0x4d, 0x66, 0x00, 0x8f, 0xc1, 0x08, 0xff, 0x6d,
-	0xfd, 0x4d, 0x01, 0x2e, 0xd4, 0x7c, 0x1a, 0xd0, 0x4e, 0x93, 0x1a, 0xaf, 0x4c, 0xbe, 0xe5, 0x8e,
-	0xc8, 0xba, 0xa1, 0x1a, 0x78, 0xfd, 0x37, 0x54, 0x83, 0xa7, 0xbc, 0xa1, 0xb2, 0xfe, 0x41, 0x01,
-	0x16, 0xd3, 0xc6, 0x5c, 0xa7, 0x9d, 0x16, 0xa9, 0x41, 0x31, 0x3e, 0x09, 0xe2, 0x93, 0xb3, 0x54,
-	0x94, 0xf8, 0xcc, 0xe9, 0x5a, 0x3b, 0x63, 0x27, 0xb0, 0xc9, 0x16, 0x9c, 0xd5, 0xca, 0xc4, 0x0d,
-	0xd1, 0xc0, 0x49, 0x6e, 0x88, 0xd8, 0x16, 0x49, 0xa0, 0xea, 0x17, 0x6c, 0x6b, 0x78, 0x6c, 0xaf,
-	0x78, 0x87, 0x8e, 0xdb, 0x61, 0x9a, 0x8e, 0x16, 0x6f, 0x10, 0xa2, 0x52, 0xb1, 0x6e, 0xfc, 0xca,
-	0x08, 0x4b, 0xe5, 0x8b, 0x3d, 0x05, 0x62, 0xfd, 0x08, 0x8f, 0x17, 0x61, 0x26, 0xe6, 0x31, 0x12,
-	0x14, 0xb1, 0x2b, 0x30, 0xbc, 0xb3, 0x51, 0x5f, 0xae, 0x88, 0x88, 0x0b, 0x3c, 0x4e, 0x4f, 0x3b,
-	0x68, 0x34, 0x1d, 0x9b, 0x57, 0x58, 0x1f, 0x01, 0x79, 0x40, 0x43, 0x91, 0xa6, 0x44, 0xe1, 0x5d,
-	0x87, 0x51, 0x51, 0x24, 0x30, 0xf1, 0xf2, 0x43, 0x24, 0x3d, 0xb1, 0x65, 0x9d, 0x55, 0x93, 0x8a,
-	0x62, 0x9b, 0x3a, 0x81, 0x26, 0x35, 0xbc, 0x0f, 0x63, 0xbe, 0x28, 0x13, 0x42, 0xc3, 0xb4, 0xca,
-	0x42, 0x85, 0xc5, 0xfc, 0x52, 0x4e, 0xc2, 0xd8, 0xea, 0x2f, 0x6b, 0x03, 0x63, 0x6a, 0x6d, 0xaf,
-	0xaf, 0x2c, 0xb3, 0x59, 0x15, 0x93, 0x25, 0x97, 0xe3, 0x36, 0x3e, 0xd2, 0x09, 0xa9, 0x1e, 0x6f,
-	0x01, 0xa7, 0x06, 0x39, 0x90, 0x88, 0x24, 0xa7, 0x81, 0x58, 0xf7, 0x54, 0x84, 0xae, 0x14, 0x6a,
-	0x59, 0xd9, 0x94, 0xb6, 0x30, 0xf6, 0xd8, 0x03, 0xf4, 0x47, 0x7c, 0x1d, 0x9d, 0x70, 0xa0, 0xc4,
-	0x65, 0x10, 0x36, 0x2a, 0x91, 0x02, 0xd7, 0x53, 0x7c, 0x7b, 0x19, 0xc6, 0x55, 0x99, 0x72, 0x2e,
-	0xe0, 0x73, 0x65, 0xc0, 0xef, 0xdd, 0xe3, 0xa1, 0x29, 0x9a, 0x8a, 0x40, 0x84, 0xc7, 0x9a, 0xe0,
-	0x4c, 0xe1, 0x3b, 0x6e, 0x22, 0xa0, 0x7e, 0xf8, 0x9d, 0x36, 0x11, 0x05, 0xa7, 0x3b, 0x4d, 0x13,
-	0x06, 0xfc, 0xde, 0xd2, 0x49, 0x26, 0xea, 0x3b, 0x6e, 0x82, 0x4d, 0xd4, 0x77, 0xd7, 0x04, 0x95,
-	0x51, 0xfc, 0xf8, 0x26, 0x4d, 0x34, 0xb2, 0x9a, 0x6c, 0x44, 0xde, 0x9d, 0xc4, 0x30, 0x72, 0xd7,
-	0x83, 0xc2, 0x45, 0x3e, 0x59, 0xbf, 0x81, 0x66, 0xd8, 0x84, 0x7d, 0xb7, 0xcd, 0xfc, 0xcf, 0x05,
-	0x1e, 0x53, 0xb0, 0xbe, 0xad, 0x25, 0x9f, 0xee, 0x3c, 0xf5, 0x34, 0xdf, 0x27, 0xed, 0x6b, 0xd7,
-	0xae, 0x92, 0xd1, 0xf7, 0xc9, 0xe9, 0x85, 0x07, 0x2a, 0xe6, 0x3e, 0xde, 0x2b, 0xc7, 0xa1, 0xc9,
-	0x07, 0x30, 0xa5, 0x15, 0x29, 0x51, 0x92, 0x67, 0x4b, 0xd2, 0xd1, 0xdd, 0x96, 0x6d, 0x42, 0x5a,
-	0x7f, 0x5b, 0x80, 0xd9, 0xfa, 0xcb, 0x20, 0xa4, 0x87, 0x18, 0x3f, 0x55, 0x06, 0xb1, 0x40, 0x6b,
-	0x16, 0xaa, 0x68, 0x8a, 0x51, 0x89, 0xfc, 0x86, 0x18, 0xde, 0xc8, 0x38, 0xc0, 0x15, 0x20, 0xe6,
-	0x89, 0x91, 0x14, 0x54, 0x2f, 0x78, 0x9e, 0x18, 0x59, 0x6c, 0xa2, 0xea, 0xe0, 0x24, 0x00, 0x88,
-	0x7a, 0x22, 0x0e, 0xe8, 0x3a, 0x93, 0xb7, 0x03, 0x2c, 0x45, 0xa3, 0x45, 0x84, 0xfb, 0xeb, 0xa3,
-	0xf2, 0x7b, 0xa7, 0xf1, 0xdc, 0x8e, 0x48, 0xdb, 0x5a, 0x33, 0xd6, 0x1f, 0x0c, 0xc0, 0xb9, 0x94,
-	0xf1, 0xd7, 0x69, 0xf8, 0x77, 0x31, 0x05, 0xcf, 0x61, 0x22, 0xea, 0x0c, 0x37, 0x5b, 0x8c, 0x57,
-	0x77, 0x30, 0xad, 0x49, 0x34, 0x07, 0xc1, 0x6b, 0x99, 0x04, 0xbd, 0x21, 0xeb, 0x26, 0xdc, 0x58,
-	0xef, 0x3c, 0xa7, 0x9d, 0xd0, 0xf3, 0x5f, 0x8a, 0x7d, 0x4b, 0x5b, 0xe2, 0x2e, 0x09, 0xf5, 0x59,
-	0xe5, 0x44, 0xf7, 0x7b, 0x03, 0x50, 0xee, 0x03, 0x4a, 0xfe, 0xa4, 0xc0, 0xb3, 0xd1, 0xa9, 0x12,
-	0x71, 0x12, 0x7f, 0x20, 0x6f, 0xf2, 0xf2, 0xf1, 0x6f, 0x19, 0xbf, 0xb8, 0xb9, 0xf3, 0xc3, 0xdf,
-	0xff, 0xab, 0x57, 0x1e, 0xa9, 0xd9, 0x97, 0xd2, 0x8f, 0x81, 0x24, 0x1b, 0xe8, 0x67, 0x7c, 0x19,
-	0xd2, 0x8d, 0x2f, 0x7b, 0x30, 0xa7, 0x86, 0xa0, 0x65, 0xf2, 0xc3, 0x97, 0x90, 0xc6, 0x86, 0xd1,
-	0xf6, 0x85, 0x05, 0x20, 0x12, 0x94, 0x6d, 0x78, 0xfb, 0x22, 0x8f, 0xda, 0xc0, 0x62, 0xc1, 0xd6,
-	0x4a, 0xad, 0xfb, 0x30, 0x1f, 0xa3, 0x2b, 0x84, 0x9a, 0xef, 0x83, 0x7a, 0x09, 0x85, 0x84, 0x07,
-	0xab, 0x67, 0x7f, 0x7d, 0x54, 0x9e, 0x0a, 0xdd, 0x43, 0x7a, 0x2b, 0x0a, 0x46, 0x2b, 0xff, 0xb2,
-	0x36, 0x75, 0xb1, 0xac, 0xd2, 0xd6, 0x5f, 0x88, 0x93, 0xbb, 0x30, 0xc2, 0x4b, 0x62, 0x21, 0x1f,
-	0x75, 0xe8, 0xea, 0xd0, 0x2f, 0x8f, 0xca, 0x67, 0x6c, 0x01, 0x68, 0xcd, 0xe3, 0xbb, 0x0d, 0xfc,
-	0x51, 0x89, 0xde, 0x19, 0x5a, 0xbb, 0x3c, 0x04, 0x7a, 0x54, 0xac, 0xc2, 0x4a, 0x0e, 0x55, 0xa2,
-	0xf7, 0x90, 0xd2, 0x88, 0x2a, 0xe1, 0x3a, 0xde, 0x8b, 0x36, 0x6d, 0xf1, 0x9c, 0x36, 0xd5, 0x49,
-	0x61, 0x44, 0x1d, 0x72, 0x18, 0x01, 0x44, 0xb3, 0x3e, 0x85, 0xf9, 0xe5, 0x36, 0x75, 0xfc, 0x78,
-	0x7b, 0x18, 0xf8, 0x98, 0x95, 0x99, 0xde, 0x55, 0x0e, 0x2b, 0x42, 0xef, 0x2a, 0x51, 0xc9, 0xe4,
-	0x38, 0xce, 0xd4, 0xf5, 0x21, 0x45, 0x22, 0xd4, 0x30, 0xfe, 0x8e, 0x79, 0xfd, 0xa7, 0x8c, 0x9e,
-	0xc3, 0x59, 0x9f, 0xa0, 0x5b, 0xa9, 0xd8, 0xa8, 0xae, 0xd7, 0x89, 0x38, 0xf8, 0xc9, 0xde, 0xa1,
-	0xfc, 0xe7, 0x70, 0xb1, 0xd2, 0xed, 0xd2, 0x4e, 0x2b, 0x42, 0x64, 0x8a, 0xd8, 0xc9, 0x5e, 0x09,
-	0x92, 0x0a, 0x0c, 0x23, 0xb4, 0x52, 0x8e, 0x45, 0x77, 0x53, 0xba, 0x83, 0x70, 0x22, 0x06, 0x18,
-	0x36, 0xc0, 0x31, 0xad, 0x16, 0x2c, 0xd4, 0x7b, 0x4f, 0x0e, 0x5d, 0x9e, 0x6e, 0x1d, 0x5f, 0xda,
-	0xca, 0xb6, 0xd7, 0x65, 0xd6, 0x0a, 0x3e, 0x19, 0x37, 0x23, 0xf7, 0x43, 0x74, 0xeb, 0x12, 0xaf,
-	0x6f, 0x9f, 0xdf, 0xbd, 0x15, 0xa1, 0xe2, 0x53, 0x5c, 0xde, 0x0a, 0x56, 0x8b, 0xcc, 0x16, 0xd6,
-	0x2c, 0x9c, 0xd5, 0x65, 0x79, 0xbe, 0x43, 0xe6, 0x61, 0xd6, 0x94, 0xd1, 0x79, 0xf1, 0xd7, 0x30,
-	0xc7, 0x65, 0x08, 0x1e, 0xc3, 0x73, 0x29, 0x0a, 0x57, 0x39, 0xb0, 0xb7, 0x14, 0x73, 0xe5, 0xc1,
-	0x8b, 0x6c, 0x15, 0x9d, 0x79, 0x6f, 0x89, 0x3f, 0x0d, 0x78, 0xbe, 0x64, 0xa8, 0xa9, 0x03, 0x7b,
-	0x4b, 0xd5, 0x51, 0x11, 0x0b, 0x8d, 0x51, 0xe7, 0xcb, 0xff, 0x9d, 0x50, 0x5f, 0xc2, 0xd7, 0x68,
-	0x6b, 0xd4, 0x41, 0xcf, 0xd1, 0xf4, 0x37, 0x3d, 0xd3, 0x30, 0xa0, 0x82, 0x1d, 0x0d, 0xb8, 0x2d,
-	0xeb, 0xcf, 0x0a, 0x70, 0x93, 0x4b, 0x33, 0xe9, 0x78, 0x28, 0xb0, 0x67, 0x20, 0x93, 0xf7, 0x81,
-	0x27, 0xcb, 0x15, 0x96, 0x2f, 0x4b, 0xf4, 0x3c, 0x8f, 0x12, 0x47, 0x20, 0x15, 0x98, 0xd4, 0xfd,
-	0x1b, 0x4f, 0x16, 0x47, 0xc5, 0x9e, 0x38, 0x7c, 0xea, 0x28, 0x9f, 0xc7, 0x67, 0x70, 0x61, 0xf5,
-	0x1b, 0xb6, 0x21, 0x44, 0xe2, 0x3f, 0x71, 0x93, 0x11, 0xbd, 0x19, 0x99, 0xd9, 0x11, 0x3b, 0x46,
-	0xfa, 0xab, 0xf1, 0x8e, 0xc7, 0x8b, 0x89, 0x05, 0x93, 0x82, 0x84, 0x1f, 0x39, 0xc2, 0xd9, 0x46,
-	0x99, 0xf5, 0xcf, 0x0a, 0x70, 0x31, 0xbd, 0x35, 0xc1, 0x58, 0xd6, 0xe1, 0xec, 0xb2, 0xd3, 0xf1,
-	0x3a, 0x6e, 0xd3, 0x69, 0xd7, 0x9b, 0x07, 0xb4, 0xd5, 0x53, 0x11, 0xd3, 0x14, 0x97, 0xd9, 0xa7,
-	0x1d, 0x89, 0x2e, 0x41, 0xec, 0x24, 0x16, 0x79, 0x0f, 0xce, 0xa1, 0x83, 0x13, 0xe7, 0xbd, 0x6d,
-	0xea, 0x2b, 0x7a, 0xbc, 0x67, 0x19, 0xb5, 0xe4, 0x8e, 0x14, 0x96, 0x5a, 0xbb, 0x1d, 0x37, 0x54,
-	0x48, 0xdc, 0x3d, 0x31, 0xad, 0xca, 0xfa, 0x27, 0x05, 0x38, 0x8f, 0x49, 0x12, 0x8c, 0xb4, 0x4b,
-	0x51, 0xe0, 0x40, 0x19, 0xfb, 0xae, 0x60, 0x38, 0x6c, 0x19, 0xd0, 0x66, 0x10, 0x3c, 0xf2, 0x0e,
-	0x0c, 0xd5, 0xa5, 0x25, 0x7e, 0x3a, 0x96, 0x48, 0x4f, 0x66, 0x5a, 0xf6, 0xfc, 0xd0, 0x46, 0x28,
-	0x72, 0x19, 0x60, 0x85, 0x06, 0x4d, 0xda, 0xc1, 0x8c, 0x87, 0xf8, 0x9c, 0xc8, 0xd6, 0x4a, 0xa2,
-	0x37, 0xfd, 0x43, 0x59, 0x6f, 0xfa, 0x87, 0xcd, 0x37, 0xfd, 0xd6, 0x73, 0x9e, 0x22, 0x21, 0x3e,
-	0x20, 0xb1, 0x48, 0x9f, 0x24, 0x12, 0x24, 0xf2, 0x73, 0xe0, 0x5c, 0xda, 0xc8, 0xf6, 0xee, 0x25,
-	0x72, 0x1f, 0x66, 0x07, 0xea, 0xab, 0xc1, 0x1b, 0x06, 0x6c, 0xa5, 0xdd, 0xf6, 0x5e, 0xd0, 0x56,
-	0xcd, 0xf7, 0x0e, 0xbd, 0xd0, 0x08, 0x11, 0x2f, 0x32, 0x84, 0x46, 0xe2, 0xb0, 0xd8, 0x95, 0xb1,
-	0x62, 0xeb, 0x3f, 0x83, 0xeb, 0x7d, 0x28, 0x8a, 0x41, 0xd5, 0xe1, 0xac, 0x13, 0xab, 0x93, 0x26,
-	0xd5, 0xeb, 0x69, 0xe3, 0x8a, 0x13, 0x0a, 0xec, 0x24, 0xfe, 0xdb, 0x3b, 0x46, 0x52, 0x41, 0xb2,
-	0x08, 0x73, 0x35, 0x7b, 0x7b, 0x65, 0x77, 0x79, 0xa7, 0xb1, 0xf3, 0x45, 0x6d, 0xb5, 0xb1, 0xbb,
-	0xf5, 0x68, 0x6b, 0xfb, 0xf1, 0x16, 0x8f, 0x74, 0x69, 0xd4, 0xec, 0xac, 0x56, 0x36, 0x8b, 0x05,
-	0x32, 0x07, 0x45, 0xa3, 0x78, 0x75, 0xb7, 0x5a, 0x1c, 0x78, 0xfb, 0x6b, 0x23, 0x59, 0x1e, 0xb9,
-	0x08, 0x8b, 0xf5, 0xdd, 0x5a, 0x6d, 0xdb, 0x56, 0x54, 0xf5, 0x38, 0x9b, 0xf3, 0x70, 0xd6, 0xa8,
-	0xbd, 0x6f, 0xaf, 0xae, 0x16, 0x0b, 0xac, 0x2b, 0x46, 0x71, 0xcd, 0x5e, 0xdd, 0x5c, 0xdf, 0xdd,
-	0x2c, 0x0e, 0xbc, 0xdd, 0xd0, 0xfd, 0x8c, 0xc9, 0x05, 0x58, 0x58, 0x59, 0xdd, 0x5b, 0x5f, 0x5e,
-	0x4d, 0xa3, 0x3d, 0x07, 0x45, 0xbd, 0x72, 0x67, 0x7b, 0xa7, 0xc6, 0x49, 0xeb, 0xa5, 0x8f, 0x57,
-	0xab, 0x95, 0xdd, 0x9d, 0xb5, 0xad, 0xe2, 0xa0, 0x35, 0x34, 0x36, 0x50, 0x1c, 0x78, 0xfb, 0xa7,
-	0x86, 0x13, 0x32, 0xeb, 0xbe, 0x00, 0xdf, 0xad, 0x57, 0x1e, 0x64, 0x37, 0xc1, 0x6b, 0x37, 0xef,
-	0x57, 0x8a, 0x05, 0x72, 0x09, 0xce, 0x1b, 0xa5, 0xb5, 0x4a, 0xbd, 0xfe, 0x78, 0xdb, 0x5e, 0xd9,
-	0x58, 0xad, 0xd7, 0x8b, 0x03, 0x6f, 0xef, 0x19, 0x71, 0x4c, 0x58, 0x0b, 0x9b, 0xf7, 0x2b, 0x0d,
-	0x7b, 0xf5, 0xb3, 0xdd, 0x75, 0x7b, 0x75, 0x25, 0xd9, 0x82, 0x51, 0xfb, 0xc5, 0x6a, 0xbd, 0x58,
-	0x20, 0xb3, 0x30, 0x63, 0x94, 0x6e, 0x6d, 0x17, 0x07, 0xde, 0xbe, 0x21, 0x42, 0x5d, 0x90, 0x69,
-	0x80, 0x95, 0xd5, 0xfa, 0xf2, 0xea, 0xd6, 0xca, 0xfa, 0xd6, 0x83, 0xe2, 0x19, 0x32, 0x05, 0xe3,
-	0x15, 0xf5, 0xb3, 0xf0, 0x76, 0x55, 0xe6, 0x42, 0xd3, 0xbe, 0x55, 0x32, 0x01, 0xa3, 0x2b, 0xab,
-	0xf7, 0x2b, 0xbb, 0x1b, 0x3b, 0xc5, 0x33, 0xec, 0xc7, 0xb2, 0xbd, 0x5a, 0xd9, 0x59, 0x5d, 0x29,
-	0x16, 0xc8, 0x38, 0x0c, 0xd7, 0x77, 0x2a, 0x3b, 0xab, 0xc5, 0x01, 0x32, 0x06, 0x43, 0xbb, 0xf5,
-	0x55, 0xbb, 0x38, 0xb8, 0xf4, 0xab, 0x3f, 0x29, 0xc0, 0x04, 0x63, 0xdf, 0xd2, 0xa5, 0xf0, 0x6b,
-	0x38, 0xa7, 0x0b, 0xd5, 0x8c, 0x6d, 0x89, 0xc4, 0x4f, 0x97, 0xe4, 0x73, 0x91, 0x6e, 0x80, 0x05,
-	0x0a, 0x0c, 0x4f, 0xf2, 0x52, 0x59, 0xfa, 0x77, 0x7b, 0x2f, 0x3a, 0x69, 0x00, 0x37, 0x0b, 0x77,
-	0x0a, 0xc4, 0x46, 0x43, 0x9d, 0xaa, 0x10, 0xc9, 0xaa, 0x2e, 0xc5, 0xa5, 0x79, 0x5e, 0x2e, 0x86,
-	0x55, 0xca, 0xa8, 0xae, 0xf7, 0x0e, 0x0f, 0x1d, 0xff, 0x25, 0xf9, 0x1d, 0xb0, 0x74, 0x9a, 0x19,
-	0x9a, 0xc4, 0xf7, 0x4f, 0xa6, 0x31, 0xc8, 0x36, 0x6f, 0x9c, 0x0c, 0x9c, 0x3c, 0x84, 0x29, 0x26,
-	0x5f, 0x2b, 0x30, 0x72, 0x21, 0x8e, 0xa8, 0x89, 0xf5, 0xa5, 0x8b, 0xe9, 0x95, 0x2a, 0x36, 0xfb,
-	0x24, 0x0e, 0x24, 0x08, 0x9d, 0x4e, 0x93, 0x06, 0x44, 0x3e, 0x69, 0x94, 0x25, 0x9c, 0x6b, 0x97,
-	0xce, 0xc6, 0x8a, 0xf7, 0xee, 0xde, 0x29, 0x90, 0x3a, 0xc6, 0x13, 0x31, 0x04, 0x75, 0x22, 0x7d,
-	0x5c, 0x93, 0x12, 0x3c, 0xef, 0x4d, 0x59, 0x65, 0x52, 0xca, 0x90, 0xf0, 0xb7, 0x80, 0x24, 0xe5,
-	0x5f, 0x72, 0x25, 0xda, 0x07, 0xe9, 0xa2, 0x71, 0xe9, 0x5c, 0xe2, 0x72, 0x68, 0x95, 0x49, 0x40,
-	0x64, 0x15, 0xa6, 0xc5, 0x7b, 0x25, 0x21, 0x91, 0x93, 0x3c, 0x99, 0x3e, 0x93, 0xcc, 0x03, 0x9c,
-	0x27, 0x25, 0xd5, 0x93, 0x52, 0x34, 0x8e, 0xb8, 0xa8, 0x5f, 0xba, 0x90, 0x5a, 0x27, 0xc6, 0x77,
-	0x1f, 0xa6, 0x4d, 0x05, 0x81, 0xc8, 0x05, 0x4a, 0xd5, 0x1b, 0x32, 0x3b, 0xd4, 0x80, 0x85, 0x4d,
-	0xc7, 0xed, 0x84, 0x8e, 0xdb, 0x11, 0x37, 0x10, 0xd2, 0x46, 0x4f, 0xca, 0x39, 0x46, 0xfb, 0x3a,
-	0xed, 0xb4, 0xd4, 0x22, 0x64, 0xc5, 0x59, 0xc5, 0xcf, 0xa6, 0x2e, 0xe5, 0x5c, 0xf3, 0x02, 0x86,
-	0x58, 0x66, 0x76, 0xbc, 0xb4, 0x3b, 0xb5, 0x52, 0xd6, 0x35, 0x30, 0xd9, 0x44, 0x41, 0x3b, 0x46,
-	0x51, 0xdb, 0x13, 0xa7, 0x26, 0xb7, 0x88, 0xaf, 0xe6, 0xb4, 0x54, 0xa6, 0xa2, 0x32, 0x20, 0x19,
-	0x13, 0x97, 0x49, 0xec, 0x4e, 0x81, 0x7c, 0x8d, 0x5f, 0x75, 0x2a, 0xb9, 0xc7, 0x6e, 0x78, 0x20,
-	0x24, 0x98, 0x0b, 0xa9, 0x04, 0xc4, 0x87, 0x92, 0x43, 0xdd, 0x86, 0xb9, 0xb4, 0x9b, 0x67, 0x35,
-	0xa1, 0x39, 0xd7, 0xd2, 0x99, 0xbb, 0xc0, 0x66, 0xea, 0x42, 0x2b, 0x7b, 0x91, 0x72, 0x2e, 0x3e,
-	0x33, 0x69, 0xfe, 0x08, 0xa6, 0xd9, 0x2e, 0x79, 0x44, 0x69, 0xb7, 0xd2, 0x76, 0x9f, 0xd3, 0x80,
-	0xc8, 0x60, 0x70, 0xaa, 0x28, 0x0b, 0xf7, 0x66, 0x81, 0x7c, 0x0f, 0x26, 0x1e, 0x3b, 0x61, 0xf3,
-	0x40, 0x04, 0x45, 0x92, 0x31, 0x93, 0xb0, 0xac, 0x24, 0x7f, 0x61, 0xe5, 0x9d, 0x02, 0xf9, 0x18,
-	0x46, 0x1f, 0xd0, 0x10, 0xdf, 0x18, 0x5c, 0x55, 0xf7, 0x1c, 0xdc, 0xe1, 0x61, 0xbd, 0xa3, 0xdc,
-	0xd8, 0x64, 0x87, 0xe3, 0x6e, 0x18, 0xe4, 0x36, 0x00, 0x67, 0x08, 0x48, 0x21, 0x5e, 0x5d, 0x4a,
-	0x74, 0x9b, 0x3c, 0x60, 0x02, 0x40, 0x9b, 0x86, 0xf4, 0xa4, 0x4d, 0x66, 0xcd, 0xd1, 0x06, 0x4c,
-	0xab, 0x70, 0xf6, 0x5b, 0xf8, 0x76, 0xd5, 0x8a, 0x11, 0x0b, 0x4e, 0x41, 0xed, 0x43, 0xf6, 0x55,
-	0xf0, 0x5c, 0x6e, 0xf8, 0xc8, 0x11, 0x39, 0xe9, 0x82, 0xfe, 0x52, 0x52, 0x67, 0xa1, 0x72, 0x12,
-	0x39, 0x98, 0x86, 0xbb, 0xe6, 0x05, 0xa1, 0x89, 0xab, 0x4a, 0xd2, 0x71, 0x7f, 0x1b, 0x4a, 0x7a,
-	0xbb, 0x66, 0x54, 0xbe, 0x88, 0xe7, 0x66, 0x05, 0xfb, 0x2b, 0x5d, 0xcd, 0x81, 0x10, 0x3a, 0xd8,
-	0xe0, 0x1f, 0x0e, 0x14, 0x90, 0x9d, 0xac, 0xc0, 0xac, 0x6c, 0x6b, 0xbb, 0x4b, 0x3b, 0xf5, 0xfa,
-	0x1a, 0x86, 0x2e, 0x97, 0x99, 0xd1, 0xb5, 0x32, 0x49, 0x9d, 0x24, 0xab, 0xd8, 0xd1, 0x67, 0x3c,
-	0x66, 0x24, 0x79, 0x4f, 0x1c, 0xa3, 0xa3, 0x2f, 0x35, 0x5c, 0xdc, 0x23, 0x6e, 0x18, 0x32, 0x04,
-	0xf8, 0xbd, 0x25, 0x92, 0xa3, 0xc4, 0x94, 0x32, 0xd4, 0x80, 0x3b, 0x05, 0xf2, 0x05, 0x90, 0xa4,
-	0x5a, 0xa1, 0xa6, 0x30, 0x53, 0x85, 0x52, 0x53, 0x98, 0xa3, 0x93, 0x3c, 0x80, 0x79, 0xf5, 0x94,
-	0x59, 0x6b, 0x75, 0x89, 0x64, 0xf4, 0x26, 0xab, 0x97, 0xe4, 0x53, 0x98, 0x15, 0x9b, 0x56, 0xaf,
-	0x20, 0x45, 0xc5, 0x7f, 0x84, 0x66, 0x91, 0xb9, 0x4f, 0x1f, 0xc2, 0x7c, 0x3d, 0x36, 0x63, 0xdc,
-	0x53, 0xe1, 0xbc, 0x49, 0x02, 0x0b, 0xeb, 0x34, 0xe4, 0x53, 0x96, 0x4e, 0xeb, 0x11, 0x10, 0x6e,
-	0xd8, 0x91, 0xe4, 0x9e, 0xbb, 0xf4, 0x05, 0xb9, 0x14, 0xeb, 0x3a, 0x2b, 0x44, 0x30, 0x64, 0x60,
-	0x99, 0x23, 0xdb, 0xe1, 0x99, 0x08, 0xb1, 0x74, 0xd9, 0xe9, 0x3a, 0x4f, 0xdc, 0xb6, 0x1b, 0xba,
-	0x94, 0x2d, 0x80, 0x8e, 0xa0, 0x57, 0xc9, 0x05, 0x38, 0x9f, 0x09, 0x41, 0x7e, 0x17, 0x63, 0x88,
-	0xe5, 0xab, 0x46, 0xe4, 0x7b, 0x69, 0x1a, 0x6c, 0x86, 0x72, 0x57, 0x7a, 0xe7, 0x64, 0xc0, 0x4a,
-	0x19, 0x9d, 0x7a, 0x40, 0xc3, 0x5a, 0xbb, 0xb7, 0xef, 0x62, 0x8e, 0x2a, 0xa2, 0x0c, 0x3f, 0xaa,
-	0x48, 0xec, 0x4b, 0x95, 0x7f, 0x5d, 0x55, 0xd4, 0xe9, 0xcf, 0xc8, 0x3a, 0x14, 0x39, 0xff, 0xd7,
-	0x48, 0x5c, 0x4a, 0x90, 0x10, 0x20, 0x8e, 0xef, 0x1c, 0x06, 0x99, 0xab, 0x75, 0x1b, 0x86, 0x98,
-	0xd8, 0x48, 0x54, 0xd6, 0x78, 0x4d, 0xc0, 0x9c, 0x35, 0xca, 0x54, 0x5c, 0x55, 0xb6, 0x22, 0x36,
-	0x0d, 0x68, 0x28, 0x1f, 0x2b, 0xf3, 0x0c, 0x65, 0xd7, 0xa2, 0xc3, 0x3e, 0x59, 0x1b, 0x7d, 0xfa,
-	0xb1, 0xc0, 0x1a, 0x7b, 0xf7, 0x88, 0xca, 0xda, 0x96, 0x42, 0xf4, 0x86, 0x21, 0x93, 0x9c, 0x8e,
-	0xee, 0xbb, 0x78, 0x06, 0xe1, 0x03, 0xed, 0xf9, 0xa8, 0x6f, 0x5a, 0xb2, 0xe2, 0xd2, 0x94, 0x86,
-	0xb5, 0xb7, 0x84, 0x2c, 0x8d, 0x1d, 0x92, 0x4c, 0x84, 0xed, 0xf9, 0x3e, 0xed, 0x70, 0xe4, 0x2c,
-	0x79, 0x23, 0x0d, 0xfb, 0x13, 0x64, 0x3d, 0x1a, 0x36, 0x77, 0x5a, 0xed, 0x47, 0x82, 0x47, 0xd4,
-	0xbf, 0x53, 0x20, 0xef, 0xc3, 0x98, 0xe8, 0x23, 0x43, 0x32, 0x3a, 0x1d, 0xe4, 0xf4, 0x1a, 0x31,
-	0x81, 0x4f, 0x12, 0xf6, 0xd9, 0x84, 0xc9, 0x5a, 0x7d, 0xde, 0xe7, 0xf7, 0xd9, 0x61, 0xdb, 0x7a,
-	0x15, 0xcc, 0x65, 0x79, 0xea, 0x22, 0xe6, 0xa2, 0x7a, 0x93, 0x1b, 0x4b, 0x0a, 0x9d, 0x4f, 0x84,
-	0xc9, 0xcd, 0x18, 0x19, 0x47, 0x05, 0xb8, 0x50, 0x72, 0xb3, 0x51, 0xdc, 0xef, 0xac, 0x5d, 0x87,
-	0x62, 0xa5, 0x89, 0x27, 0x81, 0x4a, 0x0f, 0xad, 0x94, 0x96, 0x78, 0x85, 0xa4, 0x35, 0x1f, 0xcf,
-	0x36, 0xbd, 0x41, 0x1d, 0x0c, 0x1f, 0xb8, 0xa0, 0x44, 0x8b, 0x58, 0x55, 0x3a, 0x46, 0x8e, 0x92,
-	0x32, 0xb7, 0xcc, 0xd4, 0xaa, 0xf6, 0xb7, 0x23, 0xf3, 0x21, 0x32, 0x0c, 0x2d, 0x75, 0xf6, 0xb9,
-	0x38, 0xbe, 0x52, 0xe7, 0xa4, 0x6f, 0x95, 0x02, 0xad, 0xc0, 0x8c, 0x08, 0x33, 0xa6, 0xa6, 0x25,
-	0x0b, 0x3b, 0xab, 0xf9, 0x1f, 0xc2, 0xf4, 0x2a, 0x63, 0xe8, 0xbd, 0x96, 0xcb, 0x43, 0xa6, 0x12,
-	0x33, 0x06, 0x66, 0x26, 0xe2, 0x9a, 0x4c, 0x62, 0xa1, 0xe5, 0x94, 0x56, 0x67, 0x4a, 0x32, 0x6d,
-	0x77, 0x69, 0x4e, 0x92, 0xd5, 0xd3, 0x4f, 0x0b, 0x5d, 0x7f, 0x21, 0x23, 0x8b, 0x33, 0xb9, 0x6e,
-	0xa8, 0x90, 0x59, 0xa9, 0x98, 0x53, 0x84, 0xc6, 0xcf, 0xb5, 0xa4, 0x72, 0x19, 0x34, 0xf3, 0xd3,
-	0x3b, 0x67, 0x8e, 0x5b, 0x05, 0x39, 0x4c, 0x4d, 0xc3, 0x4c, 0xde, 0x32, 0xa9, 0xe7, 0xa4, 0x6a,
-	0xce, 0x6c, 0x01, 0x55, 0x74, 0x33, 0x4b, 0x30, 0xb9, 0x9c, 0x9f, 0xcc, 0x58, 0x53, 0xd1, 0x33,
-	0xd2, 0x0b, 0x3f, 0xc4, 0x6d, 0x16, 0x65, 0x9e, 0x23, 0xba, 0xc2, 0x1b, 0x4f, 0xbc, 0xa7, 0x84,
-	0xb0, 0xf4, 0x54, 0xc1, 0x35, 0x98, 0x89, 0x25, 0xe1, 0x55, 0x96, 0x99, 0xf4, 0x34, 0xc0, 0xa5,
-	0xcb, 0x59, 0xd5, 0xca, 0xda, 0x59, 0x8c, 0x67, 0xf7, 0x54, 0x43, 0xce, 0xc8, 0x1a, 0xab, 0x86,
-	0x9c, 0x99, 0x16, 0xf4, 0x21, 0x14, 0xe3, 0x89, 0x05, 0x15, 0xd1, 0x8c, 0x8c, 0x83, 0x99, 0x6b,
-	0x72, 0x1f, 0xe6, 0xf4, 0x15, 0x55, 0xe3, 0xce, 0xe2, 0xfe, 0x59, 0x74, 0x76, 0x60, 0x3e, 0x35,
-	0x0f, 0xa0, 0x3a, 0x62, 0xf3, 0xb2, 0x04, 0x66, 0x52, 0xa5, 0x70, 0x2e, 0x3d, 0x15, 0x28, 0x79,
-	0xc3, 0x54, 0xfc, 0xd3, 0x13, 0x23, 0x96, 0xae, 0xf7, 0x81, 0x12, 0x13, 0xfa, 0x35, 0x9e, 0x80,
-	0x89, 0x36, 0xae, 0x6a, 0xa6, 0x80, 0x8c, 0x06, 0xac, 0x3c, 0x10, 0xb5, 0x07, 0xe6, 0xd2, 0xd2,
-	0x2c, 0x67, 0x4e, 0xf1, 0xb5, 0x6c, 0x9a, 0xd1, 0xc6, 0xda, 0x93, 0xb1, 0xfc, 0x32, 0x67, 0x26,
-	0x37, 0x65, 0x64, 0x8e, 0x2e, 0x59, 0x52, 0xfb, 0xe1, 0xe4, 0x5d, 0xce, 0xa2, 0xd6, 0x52, 0x66,
-	0x1b, 0x23, 0x9f, 0x63, 0xdc, 0x6c, 0x93, 0x96, 0x87, 0x52, 0x4d, 0x43, 0x5e, 0xa6, 0x53, 0x7e,
-	0x1a, 0x7f, 0xc5, 0xed, 0x38, 0x66, 0x13, 0xba, 0x1d, 0x27, 0x95, 0xfe, 0x95, 0x6c, 0x00, 0x9d,
-	0xb8, 0xc3, 0x2f, 0x5e, 0x63, 0x09, 0x29, 0x89, 0xae, 0x2a, 0xa5, 0x27, 0xab, 0x54, 0x7b, 0x23,
-	0x27, 0x2d, 0x35, 0x6f, 0xe2, 0xb1, 0xfc, 0x06, 0x33, 0x66, 0x29, 0x27, 0x5b, 0x67, 0xbe, 0x98,
-	0xb2, 0x0d, 0x8b, 0xd1, 0x62, 0xc6, 0x06, 0x70, 0xca, 0xa5, 0x94, 0x93, 0x71, 0x3e, 0x33, 0x47,
-	0x27, 0x79, 0x33, 0xf1, 0xa5, 0x67, 0x4c, 0x4c, 0x6e, 0x13, 0x9c, 0x9f, 0x6b, 0xb1, 0x01, 0x2f,
-	0x44, 0x46, 0x5c, 0x3d, 0x9d, 0x67, 0x82, 0x9f, 0xa7, 0xe4, 0xfa, 0xdc, 0x40, 0xb9, 0x58, 0xcb,
-	0xd7, 0x99, 0x39, 0xea, 0x4b, 0x69, 0x74, 0x62, 0xcb, 0x54, 0x85, 0xb3, 0xfc, 0x88, 0x3f, 0x09,
-	0xc1, 0xb4, 0x18, 0x88, 0x77, 0x0a, 0x11, 0xeb, 0xd6, 0x06, 0x28, 0x05, 0xbe, 0x78, 0xc5, 0x69,
-	0x58, 0xf7, 0x49, 0xba, 0x94, 0x45, 0x67, 0x05, 0x26, 0xb4, 0x8c, 0xa1, 0xe4, 0xbc, 0x31, 0xdf,
-	0xc6, 0x61, 0x5c, 0x32, 0x66, 0xc9, 0x3c, 0x87, 0x97, 0xd1, 0x26, 0xad, 0xf2, 0x8e, 0x66, 0xf6,
-	0xe2, 0x42, 0x92, 0x86, 0x61, 0x8f, 0x56, 0xb3, 0xc0, 0x7b, 0x73, 0x31, 0x3e, 0x39, 0x46, 0x87,
-	0xb2, 0x87, 0x44, 0xf4, 0xa9, 0xe9, 0xd3, 0xa5, 0x6c, 0x41, 0x78, 0x56, 0xa4, 0x25, 0xc3, 0xc8,
-	0xe0, 0x32, 0x84, 0xc7, 0x39, 0x65, 0x5c, 0xd3, 0x4a, 0xd1, 0xd2, 0x91, 0x4e, 0xa6, 0x06, 0xe7,
-	0xd2, 0x53, 0xa8, 0x2a, 0x56, 0x9d, 0x9b, 0x61, 0x35, 0x45, 0x08, 0x54, 0xcc, 0x3f, 0x93, 0x62,
-	0x6e, 0x4e, 0xd5, 0xcc, 0x9e, 0xfe, 0x44, 0x63, 0xfe, 0x89, 0x44, 0xa9, 0xe4, 0x66, 0x5c, 0x02,
-	0xcc, 0xca, 0xa5, 0x9a, 0x73, 0xb8, 0xcc, 0xa5, 0xe5, 0x58, 0xd5, 0x0c, 0xc4, 0x99, 0x09, 0x58,
-	0x53, 0x66, 0xc1, 0x96, 0xfb, 0x3f, 0x83, 0x5a, 0x4e, 0xc6, 0xd5, 0xcc, 0x1e, 0x7e, 0xa9, 0x71,
-	0xcc, 0x58, 0x66, 0x54, 0xa5, 0xd7, 0xf7, 0x49, 0x9d, 0x9a, 0x49, 0x7b, 0x0b, 0xe6, 0x53, 0xd3,
-	0x9a, 0x2a, 0x11, 0x29, 0x2f, 0xe9, 0x69, 0xaa, 0xfd, 0x78, 0x3e, 0x39, 0x44, 0x46, 0xef, 0x5c,
-	0xcc, 0xfa, 0xdb, 0xaf, 0x63, 0x5f, 0x4b, 0xae, 0x9e, 0x92, 0x0e, 0x35, 0xc6, 0xd5, 0xb3, 0x13,
-	0xa6, 0xe6, 0xe8, 0x53, 0x33, 0x75, 0x77, 0xbf, 0xa3, 0x65, 0x33, 0x55, 0xda, 0x54, 0x32, 0xc1,
-	0xaa, 0x62, 0x31, 0x69, 0xc9, 0x4f, 0xb7, 0x99, 0x20, 0xc5, 0xd5, 0x00, 0x3d, 0x2f, 0x25, 0x29,
-	0x65, 0xa7, 0xe3, 0x54, 0xec, 0x26, 0x35, 0x91, 0xa5, 0x46, 0x50, 0x4f, 0x0a, 0xa9, 0x08, 0xa6,
-	0xe4, 0xa7, 0x54, 0x04, 0x53, 0xb3, 0x48, 0xde, 0x46, 0xf3, 0x8d, 0xed, 0xb5, 0xa9, 0x6e, 0xbe,
-	0xd1, 0xb2, 0x0c, 0xc6, 0xac, 0x27, 0xe4, 0x13, 0x18, 0x57, 0x59, 0x18, 0x95, 0xa1, 0x3c, 0x9e,
-	0x08, 0xb2, 0xb4, 0x98, 0xac, 0x50, 0x59, 0x9d, 0x21, 0xca, 0xb8, 0xa8, 0xac, 0x19, 0x89, 0x24,
-	0x8c, 0xf1, 0x66, 0x7f, 0x20, 0xcd, 0x27, 0x06, 0x5a, 0x22, 0x07, 0x63, 0x1c, 0xed, 0x87, 0x30,
-	0x19, 0xe5, 0x5b, 0xdc, 0x5b, 0xd2, 0x10, 0x63, 0x49, 0x18, 0xe3, 0x88, 0xef, 0xcb, 0xbb, 0x11,
-	0x6c, 0xcf, 0xac, 0xcc, 0x17, 0x07, 0x3e, 0x91, 0xe6, 0x1a, 0xa3, 0xa7, 0x89, 0xec, 0x8d, 0x39,
-	0xcc, 0x77, 0x52, 0x4f, 0x80, 0xa4, 0x96, 0x36, 0x25, 0x85, 0x99, 0x5a, 0xda, 0xb4, 0x14, 0x64,
-	0xd1, 0xdd, 0xc1, 0x17, 0xd2, 0x36, 0x11, 0x11, 0xbd, 0x64, 0x74, 0x2b, 0x41, 0xf7, 0x72, 0x56,
-	0x75, 0x9c, 0x74, 0x1d, 0x8a, 0xf1, 0x6c, 0x4d, 0x4a, 0xb1, 0xcb, 0x48, 0xab, 0xa5, 0xb4, 0xc5,
-	0xcc, 0x34, 0x4f, 0x35, 0x69, 0x68, 0x37, 0xe9, 0x5e, 0x4d, 0xef, 0x94, 0x4e, 0x3a, 0xdb, 0xf2,
-	0x3e, 0x65, 0x24, 0x6e, 0xd2, 0x55, 0xee, 0x44, 0x62, 0x28, 0x5d, 0x44, 0x4b, 0xc9, 0xf5, 0xe4,
-	0xca, 0xa7, 0xbd, 0xe9, 0x39, 0x36, 0xdf, 0x32, 0x75, 0xe1, 0x9c, 0x28, 0x9f, 0x7d, 0xef, 0x91,
-	0xc9, 0x6f, 0xc1, 0x42, 0x46, 0xd0, 0x41, 0x72, 0x3d, 0x66, 0xb2, 0x4d, 0x0f, 0x4a, 0xa8, 0x36,
-	0x48, 0x6a, 0x46, 0xc5, 0x4d, 0x74, 0x40, 0x30, 0xde, 0xc9, 0x24, 0x2e, 0xf5, 0x1e, 0xbb, 0xe1,
-	0x01, 0x4f, 0x1c, 0xa8, 0xb1, 0xcd, 0xd4, 0x07, 0x36, 0xa4, 0x8e, 0x4a, 0x8d, 0x51, 0x9a, 0x72,
-	0xaf, 0x97, 0x42, 0xb0, 0x94, 0x4e, 0x10, 0xf3, 0x71, 0xd7, 0x60, 0x36, 0xe5, 0x11, 0x93, 0xda,
-	0x0b, 0xd9, 0x0f, 0x9c, 0x32, 0xbb, 0x59, 0x93, 0x32, 0x52, 0x3a, 0xc5, 0xec, 0xf7, 0x4c, 0x99,
-	0x14, 0x1f, 0x32, 0x8a, 0x89, 0x27, 0x4a, 0x24, 0x03, 0x3c, 0x9f, 0x7b, 0xd8, 0xf2, 0xc8, 0x35,
-	0xb1, 0x96, 0xb4, 0xfe, 0x65, 0x3d, 0x86, 0xca, 0xec, 0xdf, 0xaa, 0xfc, 0x9e, 0xd2, 0xfb, 0x77,
-	0xd2, 0x43, 0x57, 0x5d, 0xa4, 0xc5, 0x5e, 0xc9, 0x19, 0x03, 0xd5, 0xca, 0x4b, 0x19, 0xe5, 0x64,
-	0x0b, 0x3d, 0x8a, 0xe2, 0xa5, 0x9a, 0x76, 0x9b, 0xfe, 0x0c, 0x2f, 0x93, 0x1e, 0xdf, 0xc7, 0xc6,
-	0x33, 0xa6, 0xd3, 0xec, 0xe3, 0xd8, 0xfb, 0x27, 0xb1, 0x8f, 0x8d, 0xd2, 0xd3, 0xed, 0xe3, 0x18,
-	0x41, 0x73, 0x1f, 0xc7, 0xbb, 0x19, 0x37, 0x19, 0x64, 0xae, 0x6a, 0xbc, 0x9b, 0x6a, 0x1f, 0xa7,
-	0x53, 0xcc, 0x7e, 0x6e, 0x96, 0x49, 0x51, 0xed, 0x63, 0x93, 0x62, 0x06, 0xf8, 0x09, 0xf7, 0x71,
-	0xbc, 0x11, 0x73, 0x1f, 0x9f, 0xaa, 0x7f, 0x6a, 0x1f, 0xa7, 0xf7, 0xef, 0xd4, 0xfb, 0x38, 0xf6,
-	0x3e, 0xd3, 0x18, 0x68, 0xda, 0x3e, 0x8e, 0xc3, 0xf3, 0x7d, 0x1c, 0x2f, 0x8d, 0x59, 0x69, 0x72,
-	0xf6, 0x71, 0x1c, 0xf3, 0x33, 0xa4, 0x17, 0x7b, 0x5b, 0x76, 0x92, 0x9d, 0x9c, 0xf9, 0x2c, 0x8d,
-	0x3c, 0x46, 0x3b, 0x61, 0xac, 0xfc, 0x64, 0xbb, 0xf9, 0x62, 0x16, 0x51, 0xdc, 0xcf, 0x7b, 0x72,
-	0x12, 0xe3, 0xdd, 0x35, 0x8d, 0x60, 0xe9, 0x4f, 0xeb, 0x72, 0x3a, 0xbc, 0xc7, 0xf6, 0x4d, 0x2b,
-	0x87, 0x6e, 0xde, 0xcb, 0xc0, 0x1c, 0xba, 0x4a, 0x95, 0x89, 0xd3, 0xcd, 0x44, 0xc9, 0xdf, 0xdf,
-	0x9f, 0xcb, 0x9b, 0x92, 0x38, 0xde, 0x52, 0x4c, 0x39, 0x3a, 0x75, 0x4f, 0x95, 0x92, 0x14, 0xef,
-	0xe9, 0x69, 0xf7, 0xf9, 0xa6, 0x94, 0x1e, 0x12, 0x4f, 0x8a, 0x63, 0x83, 0xd6, 0xf7, 0x7a, 0x66,
-	0x0d, 0xd9, 0x41, 0xa3, 0x70, 0xb2, 0x5c, 0x33, 0x28, 0x67, 0xbd, 0x5d, 0xee, 0x4b, 0x35, 0xf1,
-	0x38, 0x52, 0xa7, 0x9a, 0xf5, 0x72, 0x52, 0x51, 0x4d, 0x62, 0x7f, 0x8a, 0x66, 0x34, 0xf1, 0xfc,
-	0xaa, 0xf3, 0xd4, 0xeb, 0x6f, 0xf5, 0x8a, 0x60, 0xd1, 0xd9, 0xec, 0x47, 0xe2, 0x2a, 0x50, 0x16,
-	0x66, 0x4e, 0x7e, 0x1a, 0x3e, 0xf9, 0x14, 0x8a, 0x82, 0xbd, 0x45, 0x04, 0xd2, 0x00, 0x33, 0x97,
-	0xae, 0x2a, 0x8d, 0x6e, 0x27, 0xe8, 0xc1, 0x49, 0x8c, 0x6d, 0x27, 0x99, 0x89, 0x6c, 0xcb, 0x14,
-	0x3b, 0x0e, 0x77, 0xfc, 0x5e, 0x10, 0xd2, 0x56, 0xd2, 0xa2, 0x64, 0x76, 0x46, 0xba, 0x58, 0x98,
-	0xe0, 0x7b, 0x4b, 0x64, 0x1d, 0x79, 0x9b, 0x59, 0x9c, 0x67, 0x72, 0x4b, 0x27, 0x83, 0xac, 0x67,
-	0x53, 0xbd, 0xf1, 0x31, 0xfb, 0x94, 0xd5, 0x76, 0x66, 0xa7, 0xe4, 0xcd, 0xb8, 0x98, 0xa7, 0x13,
-	0x0e, 0x31, 0x6b, 0x9e, 0x3e, 0x42, 0xa7, 0x02, 0x6e, 0x03, 0xec, 0x37, 0x3d, 0xf1, 0xa7, 0x47,
-	0xe4, 0xc7, 0x30, 0x2e, 0x91, 0xfb, 0xcf, 0x4a, 0x1c, 0x1b, 0x67, 0x65, 0x05, 0xa6, 0x8c, 0x77,
-	0x55, 0x4a, 0xc5, 0x49, 0x7b, 0x6d, 0x95, 0xb3, 0xd8, 0x53, 0xc6, 0xfb, 0x29, 0x45, 0x25, 0xed,
-	0x55, 0x55, 0x26, 0x95, 0x8f, 0x61, 0x42, 0x4c, 0x69, 0xee, 0x6c, 0x64, 0x1b, 0xdd, 0xe6, 0x35,
-	0xff, 0xe6, 0x5e, 0xcb, 0x0d, 0x97, 0xbd, 0xce, 0x53, 0x77, 0xbf, 0xef, 0xc4, 0x24, 0x51, 0xf6,
-	0x96, 0xc8, 0x57, 0x98, 0x6b, 0x4f, 0x66, 0x40, 0xa4, 0xe1, 0x0b, 0xcf, 0x7f, 0xe6, 0x76, 0xf6,
-	0xfb, 0x90, 0xbc, 0x62, 0x92, 0x8c, 0xe3, 0xc9, 0xcd, 0xf3, 0x15, 0x94, 0xea, 0xd9, 0xc4, 0xfb,
-	0x12, 0xc9, 0x3f, 0x63, 0xea, 0x70, 0x11, 0x7d, 0x71, 0x4e, 0xdb, 0xf7, 0x5c, 0xa2, 0x5f, 0xf0,
-	0xd0, 0x14, 0xd2, 0x60, 0xdf, 0xf4, 0xfc, 0x56, 0x7f, 0x8a, 0x65, 0xd3, 0x2d, 0x37, 0x86, 0x26,
-	0x27, 0xe3, 0x0b, 0x38, 0x5f, 0xcf, 0x24, 0xdd, 0x8f, 0x44, 0x3f, 0x71, 0xf2, 0x02, 0x4e, 0xc5,
-	0x29, 0xfb, 0x9d, 0x4b, 0x73, 0x1d, 0x19, 0x1b, 0x3b, 0x8c, 0x6a, 0x3e, 0x7d, 0x4a, 0x7d, 0x74,
-	0xfe, 0xee, 0xe7, 0xf6, 0x6c, 0x82, 0xcb, 0x91, 0xaf, 0xc3, 0xd9, 0x7a, 0x82, 0x54, 0x16, 0x4a,
-	0xbf, 0xdb, 0xa4, 0x59, 0x1c, 0xe9, 0x09, 0xfb, 0xd5, 0xc7, 0xe7, 0x68, 0xe2, 0x01, 0x0d, 0x77,
-	0xd7, 0xfb, 0xcc, 0x92, 0x7c, 0x9d, 0x20, 0x01, 0xf7, 0xee, 0x32, 0xcc, 0xba, 0x86, 0x99, 0x84,
-	0xc8, 0xfc, 0x78, 0x7f, 0x2c, 0x2f, 0x44, 0xfa, 0x36, 0x9b, 0x45, 0xe1, 0x1e, 0xf2, 0x42, 0xe1,
-	0x00, 0xbd, 0x10, 0xc9, 0x01, 0x46, 0x4a, 0xdc, 0xd2, 0x94, 0xee, 0x0b, 0x1d, 0x90, 0x0a, 0xd7,
-	0x01, 0xf5, 0xe4, 0xb9, 0x9a, 0xa7, 0x46, 0x6a, 0x56, 0xdd, 0x38, 0x09, 0x6e, 0x0a, 0xdd, 0xf0,
-	0x9a, 0xcf, 0x74, 0x53, 0xa8, 0x96, 0x8d, 0xb5, 0x64, 0xe6, 0x4a, 0x15, 0x1c, 0x1f, 0x13, 0xa6,
-	0xea, 0x6e, 0x64, 0x7a, 0x3e, 0xd6, 0xd2, 0x42, 0xa2, 0x5c, 0x98, 0x91, 0xee, 0x49, 0x03, 0x23,
-	0x36, 0x68, 0x52, 0xce, 0x9c, 0x1a, 0x65, 0x5b, 0x44, 0x24, 0xd3, 0xb6, 0xa8, 0x77, 0x34, 0xdb,
-	0xa0, 0x4f, 0x92, 0xa9, 0x63, 0x95, 0xc6, 0x92, 0x99, 0x55, 0x36, 0xc7, 0x1b, 0x6c, 0x36, 0x25,
-	0xf3, 0xb5, 0xd2, 0xf1, 0xb2, 0xb3, 0x62, 0x97, 0x4c, 0xd7, 0xa6, 0x3b, 0x05, 0xb2, 0x05, 0xe7,
-	0x1e, 0xd0, 0x50, 0xf0, 0x38, 0x9b, 0x06, 0xa1, 0xef, 0x36, 0xc3, 0xdc, 0xdb, 0x41, 0xa9, 0xa0,
-	0xa4, 0xe0, 0xec, 0xbd, 0xcb, 0xe8, 0xd5, 0xd3, 0xe9, 0xe5, 0xe2, 0xe5, 0x38, 0xdc, 0x8a, 0x2b,
-	0x87, 0xd3, 0x74, 0x31, 0x7b, 0x8b, 0x8f, 0x72, 0x7f, 0x9e, 0x6c, 0xd4, 0x62, 0x94, 0x90, 0x40,
-	0xa8, 0x5c, 0xb7, 0x60, 0x84, 0x23, 0x65, 0x1e, 0xa8, 0x93, 0x3a, 0x0e, 0xb9, 0x0b, 0xe3, 0xca,
-	0x21, 0x87, 0x18, 0x55, 0x99, 0xfd, 0xba, 0x0b, 0xe3, 0x5c, 0xbf, 0x3a, 0x39, 0xca, 0x47, 0x30,
-	0xae, 0x3c, 0x78, 0x4e, 0x7d, 0xd2, 0x7f, 0x0a, 0x53, 0xba, 0x2f, 0xcf, 0xe9, 0x27, 0xf2, 0x63,
-	0xbc, 0xc3, 0x95, 0x57, 0x25, 0xd9, 0xf8, 0xf3, 0xb1, 0x10, 0xfe, 0x62, 0x4a, 0x39, 0x83, 0x54,
-	0x19, 0xea, 0xb3, 0xba, 0x7f, 0x36, 0x81, 0x4d, 0x3e, 0x92, 0xef, 0xa2, 0x14, 0x72, 0x12, 0x28,
-	0x67, 0xce, 0xa6, 0xf9, 0x34, 0xbf, 0x0a, 0xb2, 0x62, 0xb0, 0x7d, 0xbb, 0x7d, 0x92, 0xbb, 0xe6,
-	0xfe, 0x53, 0x97, 0x45, 0x65, 0x1b, 0xa5, 0xb4, 0x44, 0x72, 0x89, 0x6c, 0x42, 0x97, 0xb3, 0xf3,
-	0x51, 0xe0, 0x62, 0x3c, 0x44, 0x55, 0x30, 0x51, 0x9b, 0x39, 0xbc, 0x9c, 0xfc, 0x16, 0x91, 0xee,
-	0x9b, 0x24, 0x97, 0x83, 0x96, 0xa7, 0x4a, 0xf3, 0x05, 0x7b, 0x3d, 0xe4, 0xd6, 0xa5, 0x4b, 0xe4,
-	0xc9, 0x07, 0x9b, 0xdd, 0xb3, 0x0b, 0x29, 0xb7, 0xdb, 0x7d, 0xd7, 0x22, 0x8b, 0xdc, 0x6f, 0xa1,
-	0x74, 0x98, 0x9e, 0xf7, 0x3b, 0x93, 0xd8, 0x4d, 0xcd, 0x41, 0x22, 0x3f, 0x63, 0xf8, 0x33, 0x7c,
-	0x70, 0x96, 0x9e, 0x7e, 0xe3, 0x46, 0x1f, 0x2a, 0x72, 0x26, 0xde, 0xec, 0x0b, 0xa7, 0xee, 0x4a,
-	0x2f, 0xf0, 0x13, 0x36, 0xbd, 0xbd, 0x3e, 0xe9, 0x44, 0x52, 0xae, 0xaf, 0x33, 0x92, 0x6a, 0x4b,
-	0x82, 0xa6, 0xbf, 0x69, 0xee, 0x18, 0xb2, 0xa6, 0xff, 0x33, 0x28, 0x47, 0x5e, 0x20, 0xa7, 0x5b,
-	0x84, 0x6c, 0x37, 0x47, 0x92, 0x4c, 0x35, 0x4e, 0xf2, 0xa2, 0x5b, 0x97, 0xae, 0x66, 0xcd, 0xb0,
-	0xfe, 0xa8, 0x46, 0xb8, 0xc9, 0xc5, 0x12, 0xd1, 0x64, 0xa5, 0xb4, 0xc9, 0x31, 0xc6, 0x8a, 0x17,
-	0x78, 0xaf, 0x85, 0x50, 0x72, 0xb5, 0x4f, 0x4f, 0x48, 0x39, 0x69, 0xc4, 0x08, 0x59, 0x39, 0xcb,
-	0xdb, 0xff, 0xfe, 0x71, 0x31, 0x63, 0x5d, 0x4f, 0xbf, 0xa0, 0x4e, 0xf4, 0xea, 0x2c, 0x99, 0x0f,
-	0x5d, 0xc9, 0x72, 0x99, 0xb9, 0xd9, 0xd5, 0xea, 0xe6, 0x24, 0x53, 0x5f, 0x66, 0x9f, 0x29, 0x6f,
-	0xc2, 0x48, 0xa3, 0xbc, 0x6c, 0x6f, 0x44, 0x66, 0x85, 0x94, 0xfc, 0xca, 0x25, 0x90, 0x95, 0xf6,
-	0x06, 0xf9, 0x12, 0x59, 0x49, 0x7a, 0x02, 0xf6, 0xcc, 0x41, 0x47, 0x1e, 0xe1, 0xb9, 0x79, 0xdb,
-	0xeb, 0x32, 0x62, 0x5f, 0x5a, 0x2c, 0x1c, 0xf5, 0x48, 0x27, 0xad, 0x32, 0x47, 0x73, 0xa9, 0xcb,
-	0x18, 0x7d, 0xaf, 0x93, 0x68, 0x03, 0x16, 0x32, 0x22, 0x08, 0xa9, 0x2b, 0xdc, 0xfc, 0x08, 0x43,
-	0xa5, 0xfc, 0x86, 0xc9, 0x57, 0x30, 0x9f, 0x1a, 0x62, 0x48, 0x99, 0xa1, 0xf3, 0x02, 0x10, 0xf5,
-	0x23, 0xfe, 0x0c, 0x16, 0xb3, 0xf2, 0x29, 0x47, 0x8f, 0x86, 0xf2, 0x93, 0x5c, 0x2b, 0x7e, 0xdd,
-	0x37, 0x31, 0xf3, 0x16, 0xcc, 0xa5, 0xe5, 0x28, 0x56, 0x1f, 0x5e, 0x4e, 0x02, 0xe3, 0xd4, 0x97,
-	0x49, 0x35, 0x98, 0x4f, 0xcd, 0x13, 0xac, 0x66, 0x26, 0x2f, 0x8b, 0x70, 0x2a, 0xc5, 0xcf, 0x61,
-	0x21, 0x23, 0x29, 0x6e, 0x74, 0x1f, 0x9f, 0x9b, 0x34, 0x37, 0xc7, 0xa1, 0xa9, 0x94, 0x9d, 0x6f,
-	0x55, 0xf9, 0xb1, 0xf5, 0x4d, 0xc9, 0x5a, 0x4a, 0x4d, 0x42, 0x4d, 0x76, 0x70, 0x13, 0xa6, 0x25,
-	0x60, 0xd5, 0x37, 0x61, 0x4e, 0x82, 0xd6, 0x8c, 0x17, 0x65, 0x0b, 0x19, 0x39, 0x57, 0x73, 0xa8,
-	0x9e, 0xa0, 0xb7, 0x5b, 0xf2, 0x6c, 0x31, 0x33, 0x40, 0xc6, 0x5c, 0xb0, 0x53, 0xd3, 0x43, 0xa6,
-	0xf6, 0x53, 0x8b, 0xd1, 0xd0, 0x6e, 0xe7, 0x88, 0x58, 0x44, 0x0f, 0xd2, 0xc0, 0x20, 0xd1, 0x92,
-	0x3f, 0xa5, 0xe3, 0xe6, 0x71, 0xeb, 0x04, 0x32, 0x0a, 0xb5, 0x1f, 0xc2, 0x64, 0x5d, 0x6f, 0x3c,
-	0xa5, 0x91, 0xcc, 0x4d, 0xa1, 0xde, 0x14, 0xf5, 0xef, 0x7b, 0x8e, 0x43, 0xa8, 0x3a, 0x78, 0x4e,
-	0x34, 0x8a, 0x4c, 0xff, 0x19, 0x23, 0x4c, 0xbf, 0x3a, 0x05, 0xd2, 0x32, 0x95, 0x28, 0xff, 0x99,
-	0xf4, 0xc8, 0xfe, 0x0d, 0x1e, 0xbb, 0x37, 0x9e, 0x88, 0x86, 0x58, 0xfd, 0x33, 0x3e, 0x29, 0x0f,
-	0xfb, 0xdc, 0x4c, 0x36, 0xdc, 0xd9, 0x27, 0x4a, 0x4c, 0xa0, 0x3b, 0xfb, 0x24, 0xd2, 0x1d, 0xe8,
-	0xce, 0x3e, 0x29, 0xb9, 0x0c, 0xea, 0x50, 0x8c, 0x67, 0x5a, 0x50, 0x66, 0xa5, 0x8c, 0x44, 0x12,
-	0xca, 0xad, 0x27, 0x33, 0x45, 0xc3, 0x2a, 0x76, 0x30, 0x8a, 0xa4, 0x9c, 0x63, 0xe1, 0x50, 0x7d,
-	0x4b, 0x09, 0xd8, 0xfc, 0x48, 0x8f, 0x1f, 0xc2, 0xe3, 0x2f, 0xe7, 0x18, 0x70, 0xe3, 0x71, 0x43,
-	0x62, 0x01, 0x9b, 0xef, 0x43, 0x91, 0x87, 0xa2, 0x8c, 0x42, 0x27, 0x46, 0x4e, 0x85, 0xc9, 0x08,
-	0x99, 0x39, 0x3b, 0xa5, 0x18, 0x0f, 0x38, 0xa7, 0x26, 0x2c, 0x23, 0x12, 0x5d, 0xce, 0xfe, 0x87,
-	0x28, 0xac, 0x9c, 0xb2, 0x76, 0x25, 0x22, 0xcd, 0x95, 0xce, 0xa7, 0xd4, 0x28, 0x39, 0x75, 0x52,
-	0x0f, 0x42, 0xa7, 0x86, 0x94, 0x12, 0x99, 0xae, 0x74, 0x21, 0xb5, 0x4e, 0x10, 0x0a, 0x79, 0x26,
-	0xb5, 0xf4, 0x44, 0x6b, 0xd1, 0x5b, 0xb3, 0x1c, 0x18, 0xd9, 0xcc, 0xdb, 0x27, 0x01, 0x15, 0xad,
-	0x52, 0x15, 0x47, 0x3a, 0x25, 0xed, 0xde, 0x9b, 0x29, 0xcf, 0x41, 0x0c, 0x88, 0x68, 0x43, 0xe6,
-	0xe7, 0x00, 0x24, 0x8f, 0x65, 0x5c, 0xdf, 0x8c, 0x96, 0xfa, 0x11, 0xc8, 0x5c, 0xc1, 0xc7, 0x32,
-	0x92, 0xef, 0xeb, 0x26, 0xfc, 0x04, 0x2e, 0xc6, 0xde, 0x98, 0x98, 0x84, 0xdf, 0x4e, 0x7f, 0x88,
-	0x92, 0x3a, 0x3d, 0xd9, 0x8a, 0xc0, 0x95, 0xe4, 0x5b, 0x94, 0xd8, 0xba, 0x9f, 0x96, 0x91, 0x6e,
-	0xc2, 0x34, 0xf2, 0x2e, 0x99, 0xc0, 0x31, 0x0a, 0x5f, 0x63, 0x16, 0xc7, 0xe3, 0x28, 0xc5, 0x6b,
-	0xd5, 0x13, 0xf7, 0x49, 0xf1, 0x6e, 0x99, 0xa7, 0x83, 0x2c, 0x99, 0x8f, 0x99, 0xb1, 0x30, 0xed,
-	0x68, 0x14, 0x59, 0x26, 0xc9, 0xc7, 0x30, 0x13, 0x3d, 0x67, 0xe6, 0x24, 0x52, 0xc0, 0x72, 0xac,
-	0x6f, 0x33, 0xd1, 0x9b, 0xe6, 0xd3, 0xa3, 0xaf, 0xc9, 0xf3, 0x2d, 0x42, 0xbf, 0x94, 0x78, 0x91,
-	0x63, 0x8c, 0xe1, 0x24, 0xc7, 0x9c, 0x36, 0xb7, 0xa7, 0x5d, 0x9d, 0x26, 0x7e, 0x6e, 0xe9, 0xd1,
-	0x15, 0xf5, 0xcf, 0x2d, 0x37, 0x02, 0xa4, 0x92, 0xa9, 0x33, 0xe8, 0x6c, 0xc2, 0x35, 0x8c, 0xe6,
-	0x52, 0xe3, 0x31, 0xf8, 0xd2, 0xa1, 0xb2, 0xfb, 0x1e, 0x8f, 0x01, 0xd3, 0x86, 0xab, 0x7d, 0xc3,
-	0x4b, 0x92, 0xdb, 0x86, 0xf3, 0x4c, 0xff, 0x40, 0x94, 0x39, 0xea, 0xcc, 0x5c, 0x5a, 0x94, 0x46,
-	0x75, 0x78, 0xe7, 0x04, 0x8c, 0x54, 0x87, 0x77, 0x6e, 0x98, 0xc7, 0xcf, 0x31, 0x58, 0xb6, 0x38,
-	0xa3, 0x30, 0x42, 0x13, 0xed, 0x38, 0x9d, 0x26, 0xed, 0x73, 0x97, 0x74, 0xd5, 0xbc, 0x69, 0x4d,
-	0x20, 0xa2, 0xa2, 0x74, 0x59, 0xa8, 0x77, 0x59, 0xc4, 0xfb, 0x13, 0xc9, 0x71, 0xda, 0xbe, 0xcc,
-	0x37, 0xe0, 0xa9, 0x7b, 0x9e, 0x51, 0x5e, 0x5d, 0xf9, 0xe5, 0xbf, 0xbc, 0x5c, 0xf8, 0xe5, 0xaf,
-	0x2e, 0x17, 0xfe, 0xe9, 0xaf, 0x2e, 0x17, 0xfe, 0xc5, 0xaf, 0x2e, 0x17, 0xbe, 0x5c, 0x3a, 0x59,
-	0x04, 0x64, 0x9e, 0x1f, 0xe3, 0x36, 0x27, 0x37, 0x82, 0xff, 0xdd, 0xfb, 0x8f, 0x01, 0x00, 0x00,
-	0xff, 0xff, 0x8e, 0xf9, 0x1e, 0xc7, 0xcf, 0xe2, 0x00, 0x00,
+	// 15691 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0xbd, 0x59, 0x6c, 0x5c, 0x49,
+	0x96, 0x18, 0xaa, 0xe4, 0x9a, 0x3c, 0xc9, 0x25, 0x15, 0x24, 0xc5, 0x14, 0x29, 0x29, 0xa5, 0xab,
+	0x92, 0x4a, 0x55, 0x5d, 0xad, 0x85, 0xaa, 0xaa, 0xae, 0xa5, 0xab, 0xaa, 0x33, 0x93, 0x29, 0x91,
+	0x12, 0x97, 0xac, 0x9b, 0x24, 0x55, 0xdb, 0x74, 0xf6, 0x55, 0x66, 0x88, 0xbc, 0xa3, 0xcc, 0x7b,
+	0xb3, 0xef, 0xbd, 0x29, 0x95, 0x7a, 0xa6, 0xe7, 0xbd, 0x99, 0x7e, 0xcb, 0xfc, 0xbc, 0xf7, 0x66,
+	0x80, 0x37, 0x83, 0x79, 0x78, 0x86, 0x17, 0xc0, 0x86, 0x01, 0x1b, 0x06, 0xfc, 0x63, 0xcc, 0xd7,
+	0x18, 0xb0, 0x01, 0xc3, 0xed, 0x81, 0x8d, 0x31, 0x60, 0xcf, 0x8f, 0x3f, 0x38, 0x76, 0x03, 0xf3,
+	0x43, 0xd8, 0x1f, 0x03, 0xc3, 0x06, 0xdc, 0xc6, 0x00, 0x46, 0xac, 0x37, 0xe2, 0x2e, 0x99, 0x49,
+	0x89, 0x55, 0xe3, 0x1f, 0x89, 0x19, 0x71, 0xce, 0x89, 0xb8, 0xb1, 0x9c, 0x38, 0x71, 0xb6, 0x80,
+	0x9b, 0x01, 0x6e, 0xe3, 0xae, 0xeb, 0x05, 0xb7, 0xda, 0xf8, 0xc0, 0x6a, 0xbe, 0xb8, 0xd5, 0x6c,
+	0xdb, 0xd8, 0x09, 0x6e, 0x75, 0x3d, 0x37, 0x70, 0x6f, 0x59, 0xbd, 0xe0, 0xd0, 0xc7, 0xde, 0x33,
+	0xbb, 0x89, 0x6f, 0xd2, 0x12, 0x34, 0x4e, 0xff, 0x5b, 0x5e, 0x38, 0x70, 0x0f, 0x5c, 0x06, 0x43,
+	0xfe, 0x62, 0x95, 0xcb, 0x2b, 0x07, 0xae, 0x7b, 0xd0, 0xc6, 0x0c, 0xf9, 0x71, 0xef, 0xc9, 0x2d,
+	0xdc, 0xe9, 0x06, 0x2f, 0x78, 0x65, 0x31, 0x5a, 0x19, 0xd8, 0x1d, 0xec, 0x07, 0x56, 0xa7, 0xcb,
+	0x01, 0xde, 0x90, 0x5d, 0xb1, 0x82, 0x80, 0xd4, 0x04, 0xb6, 0xeb, 0xdc, 0x7a, 0x76, 0x47, 0xfd,
+	0xc9, 0x41, 0x6f, 0xf4, 0xed, 0x75, 0x13, 0x7b, 0x81, 0x3f, 0x14, 0x24, 0x7e, 0x86, 0x9d, 0x80,
+	0x43, 0xbe, 0xd5, 0x17, 0xd2, 0x76, 0x08, 0xa8, 0xeb, 0x89, 0xaf, 0x79, 0xbb, 0x2f, 0xb4, 0x87,
+	0x7f, 0xdc, 0x23, 0x5d, 0x7e, 0xdc, 0xc6, 0x0d, 0xcf, 0x6d, 0x63, 0x3f, 0xf6, 0x89, 0x1c, 0x2b,
+	0x78, 0xd1, 0xc5, 0x3e, 0xeb, 0x86, 0xf8, 0x8f, 0x83, 0x5e, 0x49, 0x06, 0xa5, 0xff, 0x72, 0x90,
+	0xef, 0x26, 0x83, 0x3c, 0xc7, 0x8f, 0xc9, 0xbc, 0x39, 0xf2, 0x8f, 0x01, 0xe0, 0x9e, 0xd5, 0xed,
+	0x62, 0x2f, 0xfc, 0x83, 0x83, 0x9f, 0x97, 0xe0, 0x9d, 0x27, 0x16, 0x99, 0x86, 0xce, 0x13, 0x2b,
+	0xf6, 0x19, 0x3d, 0xdf, 0x3a, 0xc0, 0xbc, 0xfb, 0xcf, 0xee, 0xa8, 0x3f, 0x19, 0xa8, 0xf1, 0x37,
+	0x32, 0x30, 0xfe, 0xc8, 0x0a, 0x9a, 0x87, 0xe8, 0x13, 0x18, 0x7f, 0x68, 0x3b, 0x2d, 0xbf, 0x90,
+	0xb9, 0x3c, 0x7a, 0x23, 0xb7, 0x9a, 0xbf, 0xc9, 0x3e, 0x85, 0x56, 0x92, 0x8a, 0xf2, 0xd2, 0xcf,
+	0x8f, 0x8a, 0x67, 0x8e, 0x8f, 0x8a, 0x73, 0x4f, 0x09, 0xd8, 0x5b, 0x6e, 0xc7, 0x0e, 0xe8, 0xfa,
+	0x31, 0x19, 0x1e, 0xda, 0x83, 0xf9, 0x52, 0xbb, 0xed, 0x3e, 0xaf, 0x59, 0x5e, 0x60, 0x5b, 0xed,
+	0x7a, 0xaf, 0xd9, 0xc4, 0xbe, 0x5f, 0x18, 0xb9, 0x9c, 0xb9, 0x91, 0x2d, 0x5f, 0x3d, 0x3e, 0x2a,
+	0x16, 0x2d, 0x52, 0xdd, 0xe8, 0xb2, 0xfa, 0x86, 0xcf, 0x00, 0x14, 0x42, 0x49, 0xf8, 0xc6, 0x1f,
+	0x4f, 0x40, 0x7e, 0xdd, 0xf5, 0x83, 0x0a, 0x59, 0x35, 0x26, 0x9b, 0x38, 0x74, 0x15, 0x26, 0x48,
+	0xd9, 0xc6, 0x5a, 0x21, 0x73, 0x39, 0x73, 0x63, 0xaa, 0x9c, 0x3b, 0x3e, 0x2a, 0x4e, 0x1e, 0xba,
+	0x7e, 0xd0, 0xb0, 0x5b, 0x26, 0xaf, 0x42, 0x6f, 0x40, 0x76, 0xdb, 0x6d, 0xe1, 0x6d, 0xab, 0x83,
+	0x69, 0x2f, 0xa6, 0xca, 0x33, 0xc7, 0x47, 0xc5, 0x29, 0xc7, 0x6d, 0xe1, 0x86, 0x63, 0x75, 0xb0,
+	0x29, 0xab, 0xd1, 0x3e, 0x8c, 0x99, 0x6e, 0x1b, 0x17, 0x46, 0x29, 0x58, 0xf9, 0xf8, 0xa8, 0x38,
+	0x46, 0xd6, 0xc5, 0x2f, 0x8f, 0x8a, 0xef, 0x1e, 0xd8, 0xc1, 0x61, 0xef, 0xf1, 0xcd, 0xa6, 0xdb,
+	0xb9, 0x75, 0xe0, 0x59, 0xcf, 0x6c, 0xb6, 0xd0, 0xad, 0xf6, 0xad, 0x70, 0x3b, 0x74, 0x6d, 0x3e,
+	0xef, 0xf5, 0x17, 0x7e, 0x80, 0x3b, 0x84, 0x92, 0x49, 0xe9, 0xa1, 0x47, 0xb0, 0x50, 0x6a, 0xb5,
+	0x6c, 0x86, 0x51, 0xf3, 0x6c, 0xa7, 0x69, 0x77, 0xad, 0xb6, 0x5f, 0x18, 0xbb, 0x3c, 0x7a, 0x63,
+	0x8a, 0x0f, 0x8a, 0xac, 0x6f, 0x74, 0x25, 0x80, 0x32, 0x28, 0x89, 0x04, 0xd0, 0x5d, 0xc8, 0xae,
+	0x6d, 0xd7, 0x49, 0xdf, 0xfd, 0xc2, 0x38, 0x25, 0xb6, 0x74, 0x7c, 0x54, 0x9c, 0x6f, 0x39, 0x3e,
+	0xfd, 0x34, 0x95, 0x80, 0x04, 0x44, 0xef, 0xc2, 0x74, 0xad, 0xf7, 0xb8, 0x6d, 0x37, 0x77, 0x37,
+	0xeb, 0x0f, 0xf1, 0x8b, 0xc2, 0xc4, 0xe5, 0xcc, 0x8d, 0xe9, 0x32, 0x3a, 0x3e, 0x2a, 0xce, 0x76,
+	0x69, 0x79, 0x23, 0x68, 0xfb, 0x8d, 0xa7, 0xf8, 0x85, 0xa9, 0xc1, 0x85, 0x78, 0xf5, 0xfa, 0x3a,
+	0xc1, 0x9b, 0x8c, 0xe1, 0xf9, 0xfe, 0xa1, 0x8a, 0xc7, 0xe0, 0xd0, 0x2d, 0x00, 0x13, 0x77, 0xdc,
+	0x00, 0x97, 0x5a, 0x2d, 0xaf, 0x90, 0xa5, 0x63, 0x3b, 0x77, 0x7c, 0x54, 0xcc, 0x79, 0xb4, 0xb4,
+	0x61, 0xb5, 0x5a, 0x9e, 0xa9, 0x80, 0xa0, 0x0a, 0x64, 0x4d, 0x97, 0x0d, 0x70, 0x61, 0xea, 0x72,
+	0xe6, 0x46, 0x6e, 0x75, 0x8e, 0x2f, 0x43, 0x51, 0x5c, 0x3e, 0x77, 0x7c, 0x54, 0x44, 0x1e, 0xff,
+	0xa5, 0x7e, 0xa5, 0x80, 0x40, 0x45, 0x98, 0xdc, 0x76, 0x2b, 0x56, 0xf3, 0x10, 0x17, 0x80, 0xae,
+	0xbd, 0xf1, 0xe3, 0xa3, 0x62, 0xe6, 0xbb, 0xa6, 0x28, 0x45, 0xcf, 0x20, 0x17, 0x4e, 0x94, 0x5f,
+	0xc8, 0xd1, 0xe1, 0xdb, 0x3d, 0x3e, 0x2a, 0x9e, 0xf3, 0x69, 0x31, 0x63, 0x09, 0x21, 0xed, 0x57,
+	0x58, 0x05, 0x6a, 0x43, 0xe8, 0x2b, 0x58, 0x0c, 0x7f, 0x96, 0x7c, 0x1f, 0x7b, 0x84, 0xc6, 0xc6,
+	0x5a, 0x61, 0x86, 0x8e, 0xcc, 0xf5, 0xe3, 0xa3, 0xa2, 0xa1, 0xf4, 0xa0, 0x61, 0x09, 0x90, 0x86,
+	0xdd, 0x52, 0xbe, 0x34, 0x99, 0xc8, 0x83, 0xb1, 0xec, 0x74, 0x7e, 0xc6, 0xbc, 0xb8, 0xe7, 0x30,
+	0xbe, 0x96, 0x08, 0x64, 0xfc, 0x65, 0x06, 0xd0, 0x4e, 0x17, 0x3b, 0xf5, 0xfa, 0x3a, 0xd9, 0x4f,
+	0x62, 0x3b, 0xbd, 0x05, 0x53, 0x6c, 0xe2, 0xc8, 0xec, 0x8e, 0xd0, 0xd9, 0x9d, 0x3d, 0x3e, 0x2a,
+	0x02, 0x9f, 0x5d, 0x32, 0xb3, 0x21, 0x00, 0xba, 0x06, 0xa3, 0xbb, 0xbb, 0x9b, 0x74, 0xaf, 0x8c,
+	0x96, 0xe7, 0x8f, 0x8f, 0x8a, 0xa3, 0x41, 0xd0, 0xfe, 0xe5, 0x51, 0x31, 0xbb, 0xd6, 0xf3, 0xe8,
+	0xb0, 0x98, 0xa4, 0x1e, 0x5d, 0x83, 0xc9, 0x4a, 0xbb, 0xe7, 0x07, 0xd8, 0x2b, 0x8c, 0x85, 0x9b,
+	0xb4, 0xc9, 0x8a, 0x4c, 0x51, 0x87, 0xbe, 0x03, 0x63, 0x7b, 0x3e, 0xf6, 0x0a, 0xe3, 0x74, 0xbe,
+	0x67, 0xf8, 0x7c, 0x93, 0xa2, 0xfd, 0xd5, 0x72, 0x96, 0xec, 0xc4, 0x9e, 0x8f, 0x3d, 0x93, 0x02,
+	0xa1, 0x9b, 0x30, 0xce, 0x26, 0x6d, 0x82, 0x32, 0xa9, 0x19, 0xb9, 0x3a, 0xda, 0x78, 0xff, 0xdd,
+	0xf2, 0xd4, 0xf1, 0x51, 0x71, 0x9c, 0x4e, 0x9e, 0xc9, 0xc0, 0x1e, 0x8c, 0x65, 0x33, 0xf9, 0x11,
+	0x33, 0x4b, 0x70, 0xc9, 0xb6, 0x30, 0xbe, 0x03, 0x39, 0xe5, 0xf3, 0xd1, 0x05, 0x18, 0x23, 0xff,
+	0x53, 0x26, 0x32, 0xcd, 0x1a, 0x23, 0x87, 0x93, 0x49, 0x4b, 0x8d, 0x3f, 0x99, 0x87, 0x3c, 0xc1,
+	0xd4, 0x38, 0xcf, 0x0d, 0x90, 0xd4, 0x38, 0x53, 0x99, 0x3e, 0x3e, 0x2a, 0x66, 0x7b, 0xbc, 0x2c,
+	0x6c, 0x0b, 0xd5, 0x61, 0xb2, 0xfa, 0x75, 0xd7, 0xf6, 0xb0, 0x4f, 0x87, 0x2a, 0xb7, 0xba, 0x7c,
+	0x93, 0x1d, 0xb1, 0x37, 0xc5, 0x11, 0x7b, 0x73, 0x57, 0x1c, 0xb1, 0xe5, 0x8b, 0x9c, 0xb9, 0x9e,
+	0xc5, 0x0c, 0x25, 0x9c, 0xef, 0xdf, 0xf9, 0xb3, 0x62, 0xc6, 0x14, 0x94, 0xd0, 0x5b, 0x30, 0x71,
+	0xcf, 0xf5, 0x3a, 0x56, 0xc0, 0xc7, 0x74, 0xe1, 0xf8, 0xa8, 0x98, 0x7f, 0x42, 0x4b, 0x94, 0x25,
+	0xc2, 0x61, 0xd0, 0x3d, 0x98, 0x35, 0xdd, 0x5e, 0x80, 0x77, 0x5d, 0x31, 0x13, 0xe3, 0x14, 0xeb,
+	0xd2, 0xf1, 0x51, 0x71, 0xd9, 0x23, 0x35, 0x8d, 0xc0, 0x6d, 0xf0, 0x29, 0x51, 0xf0, 0x23, 0x58,
+	0xa8, 0x0a, 0xb3, 0x25, 0xca, 0x8d, 0xf9, 0x28, 0xb0, 0xf1, 0x9f, 0x2a, 0x5f, 0x3c, 0x3e, 0x2a,
+	0x9e, 0xb7, 0x68, 0x4d, 0x83, 0x9f, 0xa9, 0x2a, 0xe7, 0x89, 0x20, 0xa1, 0x6d, 0x38, 0xfb, 0xb0,
+	0xf7, 0x18, 0x7b, 0x0e, 0x0e, 0xb0, 0x2f, 0x7a, 0x34, 0x49, 0x7b, 0x74, 0xf9, 0xf8, 0xa8, 0x78,
+	0xe1, 0xa9, 0xac, 0x4c, 0xe8, 0x53, 0x1c, 0x15, 0x61, 0x98, 0xe3, 0x1d, 0x5d, 0xb3, 0x02, 0xeb,
+	0xb1, 0xe5, 0x63, 0xca, 0x64, 0x72, 0xab, 0xe7, 0xd8, 0x10, 0xdf, 0x8c, 0xd4, 0x96, 0xaf, 0xf2,
+	0x51, 0x5e, 0x91, 0xdf, 0xde, 0xe2, 0x55, 0x4a, 0x43, 0x51, 0x9a, 0x84, 0xd7, 0xca, 0x73, 0x64,
+	0x8a, 0xf6, 0x96, 0xf2, 0x5a, 0x79, 0x8e, 0xa8, 0x5c, 0x48, 0x9e, 0x28, 0x9b, 0x30, 0xbe, 0x47,
+	0x4e, 0x5b, 0xca, 0x83, 0x66, 0x57, 0xaf, 0xf0, 0x1e, 0x45, 0xd7, 0xd3, 0x4d, 0xf2, 0x83, 0x02,
+	0xd2, 0x9d, 0x34, 0x47, 0x4f, 0x68, 0xf5, 0x6c, 0xa5, 0x75, 0xe8, 0x53, 0x00, 0xde, 0xab, 0x52,
+	0xb7, 0x5b, 0xc8, 0xd1, 0x8f, 0x3c, 0xab, 0x7f, 0x64, 0xa9, 0xdb, 0x2d, 0x5f, 0xe2, 0xdf, 0x77,
+	0x4e, 0x7e, 0x9f, 0xd5, 0xed, 0x2a, 0xd4, 0x14, 0x22, 0xe8, 0x13, 0x98, 0xa6, 0x2c, 0x4a, 0xcc,
+	0xe8, 0x34, 0x9d, 0xd1, 0x95, 0xe3, 0xa3, 0xe2, 0x12, 0xe5, 0x3e, 0x09, 0xf3, 0xa9, 0x21, 0xa0,
+	0xdf, 0x80, 0x45, 0x4e, 0xee, 0x91, 0xed, 0xb4, 0xdc, 0xe7, 0xfe, 0x1a, 0xf6, 0x9f, 0x06, 0x6e,
+	0x97, 0xb2, 0xb3, 0xdc, 0xea, 0x05, 0xbd, 0x7b, 0x3a, 0x4c, 0xf9, 0x4d, 0xde, 0x53, 0x43, 0xf6,
+	0xf4, 0x39, 0x03, 0x68, 0xb4, 0x18, 0x84, 0xca, 0xf0, 0x12, 0x49, 0xa0, 0x0d, 0x98, 0xdb, 0xf3,
+	0xb1, 0xf6, 0x0d, 0xb3, 0x94, 0xdf, 0x17, 0xc9, 0x0c, 0xf7, 0x7c, 0x26, 0xda, 0x25, 0x7d, 0x47,
+	0x14, 0x0f, 0x99, 0x80, 0xd6, 0x3c, 0xb7, 0x1b, 0x59, 0xe3, 0x73, 0x74, 0x44, 0x8c, 0xe3, 0xa3,
+	0xe2, 0xa5, 0x96, 0xe7, 0x76, 0x1b, 0xe9, 0x0b, 0x3d, 0x01, 0x1b, 0xfd, 0x10, 0xce, 0x55, 0x5c,
+	0xc7, 0xc1, 0x4d, 0xc2, 0x11, 0xd7, 0x6c, 0xeb, 0xc0, 0x71, 0xfd, 0xc0, 0x6e, 0x6e, 0xac, 0x15,
+	0xf2, 0x21, 0xbb, 0x6f, 0x4a, 0x88, 0x46, 0x4b, 0x82, 0xe8, 0xec, 0x3e, 0x85, 0x0a, 0xfa, 0x12,
+	0x66, 0x78, 0x5b, 0xd8, 0xa3, 0x4b, 0xf3, 0x6c, 0xff, 0x85, 0x26, 0x81, 0xd9, 0xc1, 0xed, 0x89,
+	0x9f, 0x4c, 0x14, 0xd2, 0x69, 0xa1, 0xaf, 0x20, 0xb7, 0x75, 0xaf, 0x64, 0x62, 0xbf, 0xeb, 0x3a,
+	0x3e, 0x2e, 0x20, 0x3a, 0xa3, 0x97, 0x38, 0xe9, 0xad, 0x7b, 0xa5, 0x52, 0x2f, 0x38, 0xc4, 0x4e,
+	0x60, 0x37, 0xad, 0x00, 0x0b, 0xa8, 0xf2, 0x32, 0x59, 0x79, 0x9d, 0x27, 0x56, 0xc3, 0xe3, 0x25,
+	0xca, 0x57, 0xa8, 0xe4, 0xd0, 0x32, 0x64, 0xeb, 0xf5, 0xf5, 0x4d, 0xf7, 0xc0, 0x76, 0x0a, 0xf3,
+	0x64, 0x30, 0x4c, 0xf9, 0x1b, 0xed, 0xc2, 0x64, 0xad, 0xe7, 0x75, 0x5d, 0x1f, 0x17, 0x16, 0xe9,
+	0x07, 0x5d, 0xed, 0xb7, 0x73, 0x38, 0x68, 0x79, 0x91, 0xb0, 0xce, 0x2e, 0xfb, 0xa1, 0xb4, 0x2a,
+	0x48, 0xa1, 0x1f, 0xc0, 0x74, 0xbd, 0xbe, 0x1e, 0x9e, 0x71, 0xe7, 0x28, 0xc3, 0xbf, 0x70, 0x7c,
+	0x54, 0x2c, 0x10, 0xd1, 0x25, 0x3c, 0xe7, 0xd4, 0xd5, 0xae, 0x62, 0x10, 0x0a, 0xbb, 0x9b, 0xf5,
+	0x90, 0xc2, 0x52, 0x48, 0x81, 0x08, 0x4d, 0xc9, 0x14, 0x54, 0x0c, 0xf4, 0x0f, 0x32, 0x70, 0x59,
+	0x25, 0x59, 0x0a, 0xaf, 0x4d, 0xf5, 0xc0, 0x0a, 0x70, 0x07, 0x3b, 0x41, 0xe1, 0x3c, 0x1d, 0xe9,
+	0xef, 0xca, 0x6b, 0xdf, 0x4d, 0xf5, 0x72, 0xf5, 0xec, 0xce, 0xcd, 0x24, 0xa4, 0xf2, 0xea, 0xf1,
+	0x51, 0xf1, 0xa6, 0xfe, 0x1d, 0x0d, 0x05, 0xaf, 0xe1, 0x0b, 0x48, 0xa5, 0x6f, 0x03, 0xbb, 0x42,
+	0xfb, 0xab, 0x7e, 0x40, 0x62, 0x7f, 0x97, 0x5f, 0xba, 0xbf, 0xfa, 0xa8, 0x0d, 0xee, 0xef, 0xa0,
+	0xae, 0xa0, 0x26, 0xac, 0x98, 0xd8, 0xf6, 0xfd, 0x1e, 0x11, 0x7f, 0xc8, 0xf6, 0xde, 0xe8, 0x90,
+	0xeb, 0x92, 0xeb, 0x30, 0x79, 0x72, 0x85, 0xf2, 0x86, 0x2b, 0xc7, 0x47, 0xc5, 0x8b, 0x9e, 0x04,
+	0x63, 0x2c, 0xc2, 0x56, 0x01, 0xcd, 0x7e, 0x54, 0x8c, 0xcf, 0x60, 0x4a, 0x72, 0x6c, 0x34, 0x09,
+	0xa3, 0xa5, 0x76, 0x3b, 0x7f, 0x86, 0xfc, 0x51, 0xaf, 0xaf, 0xe7, 0x33, 0x68, 0x16, 0x20, 0x3c,
+	0xa6, 0xf2, 0x23, 0x68, 0x1a, 0xb2, 0xe2, 0x18, 0xc9, 0x8f, 0x52, 0xf8, 0x6e, 0x37, 0x3f, 0x86,
+	0x10, 0xcc, 0xea, 0xcc, 0x2c, 0x3f, 0x6e, 0xfc, 0xb3, 0x0c, 0x4c, 0xc9, 0x4d, 0x88, 0xe6, 0x20,
+	0xb7, 0xb7, 0x5d, 0xaf, 0x55, 0x2b, 0x1b, 0xf7, 0x36, 0xaa, 0x6b, 0xf9, 0x33, 0xe8, 0x22, 0x9c,
+	0xdf, 0xad, 0xaf, 0x37, 0xd6, 0xca, 0x8d, 0xcd, 0x9d, 0x4a, 0x69, 0xb3, 0x51, 0x33, 0x77, 0x3e,
+	0xfb, 0xbc, 0xb1, 0xbb, 0xb7, 0xbd, 0x5d, 0xdd, 0xcc, 0x67, 0x50, 0x01, 0x16, 0x48, 0xf5, 0xc3,
+	0xbd, 0x72, 0x55, 0x05, 0xc8, 0x8f, 0xa0, 0x2b, 0x70, 0x31, 0xa9, 0xa6, 0xb1, 0x5e, 0x2d, 0xad,
+	0x6d, 0x56, 0xeb, 0xf5, 0xfc, 0x28, 0x5a, 0x82, 0x79, 0x02, 0x52, 0xaa, 0xd5, 0x34, 0xdc, 0x31,
+	0xd2, 0x0b, 0xde, 0x68, 0xf5, 0xb3, 0x6a, 0x25, 0x3f, 0x2e, 0x88, 0x11, 0xc8, 0xd2, 0xa3, 0x7a,
+	0xa3, 0x62, 0x56, 0xd7, 0xaa, 0xdb, 0xbb, 0x1b, 0xa5, 0xcd, 0x9a, 0xb9, 0x53, 0x21, 0xc4, 0x26,
+	0x8c, 0x36, 0xe4, 0x94, 0x9d, 0x89, 0x2e, 0x40, 0xa1, 0x52, 0x35, 0x77, 0x1b, 0xb5, 0x3d, 0xb3,
+	0xb6, 0x53, 0xaf, 0x36, 0xf4, 0xaf, 0x8a, 0xd6, 0x6e, 0xee, 0xdc, 0xdf, 0xd8, 0x6e, 0x90, 0xa2,
+	0x7a, 0x3e, 0x43, 0x5a, 0xd3, 0x6a, 0xeb, 0x1b, 0xdb, 0xf7, 0x37, 0xab, 0x8d, 0xbd, 0x7a, 0x95,
+	0x83, 0x8c, 0x30, 0x01, 0xef, 0xc1, 0x58, 0x76, 0x21, 0xbf, 0xa8, 0x88, 0xa8, 0xe6, 0x62, 0xe2,
+	0x72, 0x32, 0x7e, 0x6b, 0x24, 0x26, 0x31, 0xa0, 0x55, 0xc8, 0xd5, 0x99, 0x0a, 0x85, 0x72, 0x51,
+	0x76, 0x9f, 0xcc, 0x1f, 0x1f, 0x15, 0xa7, 0xb9, 0x66, 0x85, 0x31, 0x48, 0x15, 0x88, 0x08, 0x81,
+	0x35, 0xc2, 0x94, 0x9a, 0x6e, 0x5b, 0x15, 0x02, 0xbb, 0xbc, 0xcc, 0x94, 0xb5, 0x68, 0x55, 0x11,
+	0x17, 0xd9, 0xe5, 0x92, 0x5e, 0x60, 0x84, 0xb8, 0xa8, 0x8a, 0x0e, 0x52, 0x70, 0x5c, 0x0d, 0x17,
+	0x0d, 0x97, 0xf2, 0x28, 0x4e, 0x82, 0xa8, 0x22, 0xe1, 0xd0, 0x1b, 0x42, 0x30, 0x66, 0x97, 0x41,
+	0x2a, 0x4b, 0x44, 0xae, 0x31, 0x5c, 0x26, 0x36, 0x7a, 0x29, 0xe7, 0x36, 0xfa, 0x30, 0xba, 0x2a,
+	0xf9, 0x60, 0x50, 0x62, 0x91, 0xe3, 0xd9, 0x8c, 0x80, 0xa2, 0x22, 0x8c, 0x33, 0x86, 0xce, 0xc6,
+	0x83, 0x8a, 0xe2, 0x6d, 0x52, 0x60, 0xb2, 0x72, 0xe3, 0x5f, 0x8e, 0xa9, 0x32, 0x0c, 0x11, 0xbd,
+	0x95, 0xf1, 0xa6, 0xa2, 0x37, 0x1d, 0x67, 0x5a, 0x4a, 0x6e, 0x8e, 0x6c, 0x32, 0xe9, 0xcd, 0x71,
+	0x34, 0xbc, 0x39, 0x72, 0x8e, 0xc1, 0x6e, 0x8e, 0x21, 0x08, 0x99, 0x45, 0x2e, 0x15, 0x52, 0xaa,
+	0x63, 0xe1, 0x2c, 0x72, 0x49, 0x92, 0xcf, 0xa2, 0x02, 0x84, 0x3e, 0x00, 0x28, 0x3d, 0xaa, 0xd3,
+	0x2b, 0x92, 0xb9, 0xcd, 0x25, 0x63, 0x7a, 0x86, 0x59, 0xcf, 0x7d, 0x7e, 0x03, 0xf3, 0xd4, 0x2b,
+	0xa6, 0x02, 0x8d, 0xca, 0x30, 0x53, 0xfa, 0x49, 0xcf, 0xc3, 0x1b, 0x2d, 0x72, 0x0c, 0x06, 0xec,
+	0x2e, 0x3d, 0xc5, 0xce, 0x03, 0x8b, 0x54, 0x34, 0x6c, 0x5e, 0xa3, 0x10, 0xd0, 0x51, 0xd0, 0x0e,
+	0x9c, 0xbd, 0x5f, 0xa9, 0xf1, 0x75, 0x55, 0x6a, 0x36, 0xdd, 0x9e, 0x13, 0x70, 0x71, 0x98, 0xb2,
+	0xa9, 0x83, 0x66, 0xb7, 0x21, 0xd6, 0xa0, 0xc5, 0xaa, 0x55, 0x79, 0x38, 0x86, 0x8b, 0xae, 0xc2,
+	0xe8, 0x9e, 0xb9, 0xc1, 0x2f, 0xda, 0x67, 0x8f, 0x8f, 0x8a, 0x33, 0x3d, 0xcf, 0x56, 0x50, 0x48,
+	0x2d, 0x7a, 0x1f, 0x60, 0xd7, 0xf2, 0x0e, 0x70, 0x50, 0x73, 0xbd, 0x80, 0xca, 0xb3, 0x33, 0xe5,
+	0xf3, 0xc7, 0x47, 0xc5, 0xc5, 0x80, 0x96, 0x36, 0x08, 0x17, 0x57, 0x3f, 0x3a, 0x04, 0x46, 0x2f,
+	0xa0, 0x58, 0x7a, 0x54, 0xaf, 0x78, 0x98, 0x7e, 0x81, 0xd5, 0xae, 0x79, 0x2e, 0x11, 0x79, 0xc2,
+	0x02, 0x9f, 0x4a, 0xbb, 0x53, 0xe5, 0x5b, 0xc7, 0x47, 0xc5, 0xef, 0x90, 0x51, 0x6c, 0xca, 0xaa,
+	0x2e, 0x83, 0x55, 0x4a, 0xd4, 0xa5, 0x39, 0x88, 0xee, 0x83, 0xb1, 0xec, 0x48, 0x7e, 0xd4, 0x9c,
+	0xaa, 0x63, 0xdf, 0x67, 0x37, 0xd9, 0x36, 0xcc, 0xde, 0xc7, 0x01, 0xd9, 0x33, 0xe2, 0x66, 0xd6,
+	0x7f, 0x45, 0x7d, 0x1f, 0x72, 0x8f, 0xec, 0xe0, 0xb0, 0x8e, 0x9b, 0x1e, 0x0e, 0x84, 0x56, 0x8a,
+	0xce, 0xf6, 0x73, 0x3b, 0x38, 0x6c, 0xf8, 0xac, 0x5c, 0x95, 0x58, 0x14, 0x70, 0xa3, 0x0a, 0x73,
+	0xbc, 0x35, 0x79, 0x11, 0x5c, 0xd5, 0x09, 0x66, 0x28, 0x41, 0xba, 0xe2, 0x54, 0x82, 0x3a, 0x99,
+	0x7f, 0x34, 0x02, 0x8b, 0x95, 0x43, 0xcb, 0x39, 0xc0, 0x35, 0xcb, 0xf7, 0x9f, 0xbb, 0x5e, 0x4b,
+	0xe9, 0x3c, 0xbd, 0x05, 0xc7, 0x3a, 0x4f, 0xaf, 0xbd, 0xab, 0x90, 0xdb, 0x69, 0xb7, 0x04, 0x0e,
+	0xbf, 0xa1, 0xd3, 0xb6, 0xdc, 0x76, 0xab, 0xd1, 0x15, 0xb4, 0x54, 0x20, 0x82, 0xb3, 0x8d, 0x9f,
+	0x4b, 0x9c, 0xd1, 0x10, 0xc7, 0xc1, 0xcf, 0x15, 0x1c, 0x05, 0x08, 0x55, 0xe1, 0x6c, 0x1d, 0x37,
+	0x5d, 0xa7, 0x75, 0xcf, 0x6a, 0x06, 0xae, 0xb7, 0xeb, 0x3e, 0xc5, 0x0e, 0xdf, 0x4b, 0xf4, 0xca,
+	0xe3, 0xd3, 0xca, 0xc6, 0x13, 0x5a, 0xdb, 0x08, 0x48, 0xb5, 0x19, 0xc7, 0x40, 0x3b, 0x90, 0x7d,
+	0xc4, 0x75, 0x9b, 0xfc, 0x5a, 0x7f, 0xed, 0xa6, 0x54, 0x76, 0x86, 0xb3, 0x2a, 0x15, 0x13, 0x52,
+	0x82, 0xa4, 0x5c, 0x54, 0x40, 0x9a, 0x92, 0x88, 0xf1, 0xb3, 0x0c, 0x2c, 0x6e, 0xda, 0x7e, 0x50,
+	0xc7, 0x1d, 0xab, 0x7b, 0xe8, 0x7a, 0x58, 0xce, 0xc2, 0x0a, 0x4c, 0x75, 0xad, 0x03, 0xdc, 0xf0,
+	0xed, 0x9f, 0xb0, 0x99, 0x1f, 0x37, 0xb3, 0xa4, 0xa0, 0x6e, 0xff, 0x04, 0xa3, 0x8b, 0x00, 0xb4,
+	0x92, 0x76, 0x94, 0x31, 0x26, 0x93, 0x82, 0xb3, 0x6e, 0xde, 0x84, 0x89, 0x27, 0x76, 0x9b, 0xdc,
+	0x41, 0x47, 0xf9, 0xad, 0x91, 0xeb, 0x6f, 0x44, 0x2b, 0xf7, 0x68, 0xad, 0xc9, 0xa1, 0x8c, 0x00,
+	0xce, 0x45, 0x3b, 0xc1, 0x05, 0xda, 0x55, 0x00, 0x5f, 0x96, 0x72, 0x05, 0x2a, 0x8a, 0x52, 0xdb,
+	0xbf, 0x6b, 0x2a, 0x50, 0xe8, 0x3a, 0xcc, 0x39, 0xf8, 0xeb, 0xa0, 0x11, 0xeb, 0xe1, 0x0c, 0x29,
+	0xae, 0x89, 0x5e, 0x1a, 0x7b, 0x30, 0x53, 0x6b, 0xf7, 0x0e, 0x6c, 0x87, 0xf0, 0xfa, 0x3a, 0xfe,
+	0x31, 0x5a, 0x03, 0x08, 0x0b, 0x78, 0x63, 0xf3, 0xbc, 0xb1, 0xb0, 0x62, 0xff, 0x2e, 0x67, 0x98,
+	0xb4, 0x84, 0xde, 0x73, 0x4d, 0x05, 0xcf, 0xf8, 0x6f, 0xa3, 0x80, 0xf8, 0x20, 0x52, 0x11, 0xaa,
+	0x8e, 0x03, 0x22, 0x77, 0x9c, 0x83, 0x11, 0xa9, 0x54, 0x9d, 0x38, 0x3e, 0x2a, 0x8e, 0xd8, 0x2d,
+	0x73, 0x64, 0x63, 0x0d, 0xbd, 0x0d, 0xe3, 0x14, 0x8c, 0xf6, 0x71, 0x56, 0xb6, 0xa7, 0x52, 0x60,
+	0x3c, 0x9f, 0x1e, 0xb6, 0x26, 0x03, 0x46, 0xef, 0xc0, 0xd4, 0x1a, 0x6e, 0xe3, 0x03, 0x2b, 0x70,
+	0x05, 0x17, 0x67, 0x6a, 0x4a, 0x51, 0xa8, 0xec, 0xb7, 0x10, 0x12, 0xbd, 0x05, 0x13, 0x26, 0xb6,
+	0x7c, 0xd7, 0x51, 0x95, 0x1c, 0x1e, 0x2d, 0x51, 0x95, 0x1c, 0x0c, 0x06, 0xfd, 0x5e, 0x06, 0x72,
+	0x25, 0xc7, 0xe1, 0xea, 0x3f, 0x9f, 0xaf, 0xb8, 0xc5, 0x9b, 0x52, 0x5f, 0xbe, 0x69, 0x3d, 0xc6,
+	0xed, 0x7d, 0xab, 0xdd, 0xc3, 0x7e, 0xf9, 0x2b, 0x72, 0xef, 0xfc, 0x77, 0x47, 0xc5, 0x0f, 0x4f,
+	0xa0, 0xd0, 0x0b, 0x35, 0xef, 0xbb, 0x9e, 0x65, 0x07, 0x3e, 0x61, 0x96, 0x56, 0xd8, 0xa0, 0xca,
+	0x33, 0x94, 0x7e, 0x84, 0x47, 0xf2, 0xc4, 0xa0, 0x23, 0x19, 0x75, 0x60, 0xae, 0xe4, 0xfb, 0xbd,
+	0x0e, 0xae, 0x07, 0x96, 0x17, 0xec, 0xda, 0x1d, 0x4c, 0xcf, 0x81, 0xfe, 0x2a, 0xa3, 0xd7, 0x7f,
+	0x7e, 0x54, 0xcc, 0x90, 0xab, 0xae, 0x45, 0x51, 0x89, 0x98, 0xe3, 0x05, 0x8d, 0xc0, 0x56, 0xa5,
+	0x0a, 0xaa, 0x3c, 0x8a, 0xd2, 0x36, 0xae, 0x4a, 0x49, 0x73, 0x63, 0x2d, 0x6d, 0xc6, 0x8d, 0x0a,
+	0x5c, 0xb8, 0x8f, 0x03, 0x13, 0xfb, 0x38, 0x10, 0xfc, 0x81, 0x2e, 0xc8, 0x50, 0x05, 0x3f, 0x49,
+	0x7f, 0x4b, 0x64, 0x3a, 0xfd, 0x8c, 0x27, 0x88, 0x1a, 0xe3, 0x7f, 0xcb, 0x40, 0xb1, 0xe2, 0x61,
+	0x76, 0x4b, 0x4c, 0x21, 0xd4, 0x9f, 0x6f, 0x5f, 0x80, 0xb1, 0xdd, 0x17, 0x5d, 0xa1, 0x6b, 0xa3,
+	0xb5, 0x64, 0x52, 0x4c, 0x5a, 0x3a, 0xa4, 0x2a, 0xd2, 0xf8, 0x12, 0x2e, 0x92, 0x9d, 0x9b, 0xde,
+	0x87, 0x57, 0x60, 0x23, 0xc6, 0x4f, 0xe1, 0x52, 0x1a, 0x71, 0xce, 0x1e, 0xee, 0x42, 0x8e, 0x08,
+	0x7c, 0x8c, 0x40, 0x94, 0x3f, 0x10, 0x06, 0x4f, 0xc1, 0x09, 0x7f, 0xe8, 0x89, 0x1f, 0xc3, 0xf3,
+	0x87, 0x27, 0xb0, 0x68, 0x62, 0x07, 0x3f, 0x27, 0xf7, 0x15, 0x4d, 0x53, 0x59, 0x84, 0x71, 0xc6,
+	0xc0, 0x63, 0xd3, 0xc3, 0xca, 0x4f, 0xa6, 0xf5, 0x35, 0x66, 0x20, 0x57, 0xb3, 0x9d, 0x03, 0x4e,
+	0xdd, 0xf8, 0xf3, 0x31, 0x98, 0x66, 0xbf, 0x25, 0x0f, 0xd4, 0x24, 0xb0, 0xcc, 0x30, 0x12, 0xd8,
+	0x7b, 0x30, 0x43, 0x44, 0x18, 0xec, 0xed, 0x63, 0x8f, 0x9c, 0xeb, 0x7c, 0x96, 0xa9, 0x82, 0xc2,
+	0xa7, 0x15, 0x8d, 0x67, 0xac, 0xc6, 0xd4, 0x01, 0xd1, 0x26, 0xcc, 0xb2, 0x82, 0x7b, 0xd8, 0x0a,
+	0x7a, 0xa1, 0x8e, 0x75, 0x8e, 0x6b, 0x0b, 0x44, 0x31, 0xdb, 0x76, 0x9c, 0xd6, 0x13, 0x5e, 0x68,
+	0x46, 0x70, 0xd1, 0x27, 0x30, 0x57, 0xf3, 0xdc, 0xaf, 0x5f, 0x28, 0x32, 0x27, 0xe3, 0x3c, 0x4c,
+	0xaf, 0x40, 0xaa, 0x1a, 0xaa, 0xe4, 0x19, 0x85, 0x46, 0x6f, 0x40, 0x76, 0xc3, 0x2f, 0xbb, 0x9e,
+	0xed, 0x1c, 0x50, 0xfe, 0x93, 0x65, 0xa6, 0x26, 0xdb, 0x6f, 0x3c, 0xa6, 0x85, 0xa6, 0xac, 0x8e,
+	0x18, 0x45, 0x26, 0x07, 0x1b, 0x45, 0x6e, 0x03, 0x6c, 0xba, 0x56, 0xab, 0xd4, 0x6e, 0x57, 0x4a,
+	0x3e, 0x15, 0xee, 0xb8, 0x9c, 0xd1, 0x76, 0xad, 0x56, 0xc3, 0x6a, 0xb7, 0x1b, 0x4d, 0xcb, 0x37,
+	0x15, 0x18, 0xf4, 0x05, 0x9c, 0xf7, 0xed, 0x03, 0x87, 0x7e, 0x5c, 0xc3, 0x6a, 0x1f, 0xb8, 0x9e,
+	0x1d, 0x1c, 0x76, 0x1a, 0x7e, 0xcf, 0x0e, 0x98, 0x06, 0x73, 0x76, 0xf5, 0x92, 0x38, 0x9d, 0x04,
+	0x5c, 0x49, 0x80, 0xd5, 0x09, 0x94, 0xb9, 0xe4, 0x27, 0x57, 0xa0, 0x47, 0x30, 0xb3, 0x69, 0x37,
+	0xb1, 0xe3, 0x63, 0xaa, 0x92, 0x7e, 0x41, 0x25, 0xbe, 0xfe, 0x8c, 0x8a, 0x0c, 0xe2, 0x4c, 0x5b,
+	0x45, 0xa2, 0x6c, 0x49, 0xa7, 0xf3, 0x60, 0x2c, 0x3b, 0x91, 0x9f, 0x34, 0xe7, 0x78, 0xe1, 0x23,
+	0xcb, 0x73, 0x6c, 0xe7, 0xc0, 0x37, 0xfe, 0x12, 0x41, 0x56, 0xce, 0xd3, 0x4d, 0xf5, 0x7a, 0xcd,
+	0x45, 0x2e, 0xba, 0x64, 0x43, 0xcd, 0xb1, 0xa9, 0x40, 0xa0, 0xf3, 0xf4, 0xc2, 0xcd, 0x85, 0xbd,
+	0x49, 0xc2, 0x1e, 0xac, 0x6e, 0xd7, 0x24, 0x65, 0x84, 0xed, 0xad, 0x95, 0xe9, 0xa2, 0xc9, 0x32,
+	0xb6, 0xd7, 0x7a, 0x6c, 0x8e, 0xac, 0x95, 0x09, 0xbf, 0xd9, 0xd9, 0x58, 0xab, 0xd0, 0xf9, 0xcf,
+	0x32, 0x7e, 0xe3, 0xda, 0xad, 0xa6, 0x49, 0x4b, 0x49, 0x6d, 0xbd, 0xb4, 0xb5, 0xc9, 0xe7, 0x98,
+	0xd6, 0xfa, 0x56, 0xa7, 0x6d, 0xd2, 0x52, 0x72, 0x81, 0x62, 0x4a, 0xc0, 0x8a, 0xeb, 0x04, 0x9e,
+	0xdb, 0xf6, 0xe9, 0xad, 0x20, 0xcb, 0xd6, 0x20, 0xd7, 0x1e, 0x36, 0x79, 0x95, 0x19, 0x01, 0x45,
+	0x8f, 0x60, 0xa9, 0xd4, 0x7a, 0x66, 0x39, 0x4d, 0xdc, 0x62, 0x35, 0x8f, 0x5c, 0xef, 0xe9, 0x93,
+	0xb6, 0xfb, 0xdc, 0xa7, 0x8b, 0x24, 0xcb, 0x95, 0xed, 0x1c, 0x44, 0x28, 0x23, 0x9f, 0x0b, 0x20,
+	0x33, 0x0d, 0x9b, 0xf0, 0x81, 0x4a, 0xdb, 0xed, 0xb5, 0xf8, 0xd2, 0xa1, 0x7c, 0xa0, 0x49, 0x0a,
+	0x4c, 0x56, 0x4e, 0x46, 0x69, 0xbd, 0xbe, 0x45, 0x17, 0x06, 0x1f, 0xa5, 0x43, 0xbf, 0x63, 0x92,
+	0x32, 0x74, 0x0d, 0x26, 0xc5, 0x5d, 0x90, 0xd9, 0xd2, 0xa8, 0x0d, 0x47, 0xdc, 0x01, 0x45, 0x1d,
+	0xd9, 0xc7, 0x26, 0x6e, 0xba, 0xcf, 0xb0, 0xf7, 0xa2, 0xe2, 0xb6, 0xb0, 0x50, 0xc4, 0x72, 0x45,
+	0x23, 0xab, 0x68, 0x34, 0x49, 0x8d, 0xa9, 0x03, 0x92, 0x06, 0x98, 0x50, 0xe2, 0x17, 0xe6, 0xc2,
+	0x06, 0x98, 0xd0, 0xe2, 0x9b, 0xa2, 0x0e, 0xad, 0xc1, 0xd9, 0x52, 0x2f, 0x70, 0x3b, 0x56, 0x60,
+	0x37, 0xf7, 0xba, 0x07, 0x9e, 0x45, 0x1a, 0xc9, 0x53, 0x04, 0x7a, 0x37, 0xb6, 0x44, 0x65, 0xa3,
+	0xc7, 0x6b, 0xcd, 0x38, 0x02, 0x7a, 0x17, 0xa6, 0x37, 0x7c, 0xa6, 0x6c, 0xb7, 0x7c, 0xdc, 0xa2,
+	0x1a, 0x53, 0xde, 0x4b, 0xdb, 0x6f, 0x50, 0xd5, 0x7b, 0x83, 0xdc, 0xa6, 0x5b, 0xa6, 0x06, 0x87,
+	0x0c, 0x98, 0x28, 0xf9, 0xbe, 0xed, 0x07, 0x54, 0x11, 0x9a, 0x2d, 0xc3, 0xf1, 0x51, 0x71, 0xc2,
+	0xa2, 0x25, 0x26, 0xaf, 0x41, 0x8f, 0x20, 0xb7, 0x86, 0xc9, 0x65, 0x6c, 0xd7, 0xeb, 0xf9, 0x01,
+	0x55, 0x6b, 0xe6, 0x56, 0xcf, 0x73, 0x6e, 0xa4, 0xd4, 0xf0, 0xb5, 0xcc, 0xae, 0x1e, 0x2d, 0x5a,
+	0xde, 0x08, 0x48, 0x85, 0x2a, 0x46, 0x28, 0xf0, 0xe4, 0xa6, 0xc9, 0x71, 0xd6, 0xed, 0x16, 0xe1,
+	0x2f, 0x0b, 0xb4, 0x0f, 0xf4, 0xa6, 0xc9, 0x19, 0x5a, 0xe3, 0x90, 0xd6, 0xa8, 0x37, 0x4d, 0x0d,
+	0x05, 0x35, 0x63, 0xf6, 0x9b, 0x45, 0x4d, 0x47, 0xaf, 0x57, 0x8a, 0x2e, 0x9e, 0xd0, 0xba, 0xf3,
+	0x7d, 0xc8, 0x55, 0x7a, 0x7e, 0xe0, 0x76, 0x76, 0x0f, 0x71, 0x07, 0x53, 0x15, 0x2b, 0xbf, 0x4f,
+	0x37, 0x69, 0x71, 0x23, 0x20, 0xe5, 0xea, 0x67, 0x2a, 0xe0, 0xe8, 0x53, 0x40, 0xe2, 0x62, 0x7c,
+	0x9f, 0xac, 0x0f, 0x87, 0xac, 0x65, 0xaa, 0x65, 0xe5, 0x4a, 0x3b, 0x71, 0x9f, 0x6e, 0x1c, 0xc8,
+	0x6a, 0x55, 0x03, 0x1f, 0x47, 0x26, 0x1d, 0x62, 0x5d, 0xbc, 0xef, 0x59, 0xdd, 0xc3, 0x42, 0x21,
+	0xbc, 0xf2, 0xf1, 0x8f, 0x3a, 0x20, 0xe5, 0x9a, 0xf8, 0x16, 0x82, 0xa3, 0x3a, 0x00, 0xfb, 0x49,
+	0x0e, 0x77, 0xae, 0x97, 0x2d, 0x68, 0xe3, 0x45, 0x2a, 0xc4, 0x58, 0xd1, 0x1b, 0x34, 0x27, 0xdb,
+	0xb6, 0xb5, 0xd9, 0x54, 0xc8, 0xa0, 0xa7, 0x90, 0x67, 0xbf, 0xb6, 0x5c, 0xc7, 0x0e, 0xd8, 0x79,
+	0xb1, 0xac, 0x29, 0xd7, 0xa3, 0xd5, 0xa2, 0x01, 0x6a, 0xd4, 0xe0, 0x0d, 0x74, 0x64, 0xad, 0xd2,
+	0x4c, 0x8c, 0x30, 0xaa, 0x41, 0xae, 0xe6, 0xb9, 0xad, 0x5e, 0x33, 0xa0, 0x12, 0xd4, 0x0a, 0x65,
+	0xfc, 0x88, 0xb7, 0xa3, 0xd4, 0xb0, 0x31, 0xe9, 0xb2, 0x82, 0x06, 0x39, 0x17, 0xd4, 0x31, 0x51,
+	0x00, 0x51, 0x19, 0x26, 0x6a, 0x6e, 0xdb, 0x6e, 0xbe, 0x28, 0x5c, 0xa0, 0x9d, 0x5e, 0x10, 0xc4,
+	0x68, 0xa1, 0xe8, 0x2a, 0x15, 0xd7, 0xbb, 0xb4, 0x48, 0x15, 0xd7, 0x19, 0x10, 0x2a, 0xc1, 0xcc,
+	0xa7, 0x64, 0xc1, 0xd8, 0xae, 0xe3, 0x58, 0xb6, 0x87, 0x0b, 0x17, 0xe9, 0xbc, 0x50, 0xc3, 0xd3,
+	0x8f, 0xd5, 0x0a, 0x75, 0x39, 0x6b, 0x18, 0x68, 0x03, 0xe6, 0x36, 0xfc, 0x7a, 0xe0, 0xd9, 0x5d,
+	0xbc, 0x65, 0x39, 0xd6, 0x01, 0x6e, 0x15, 0x2e, 0x85, 0x96, 0x1f, 0xdb, 0x6f, 0xf8, 0xb4, 0xae,
+	0xd1, 0x61, 0x95, 0xaa, 0xe5, 0x27, 0x82, 0x87, 0x3e, 0x83, 0x85, 0xea, 0xd7, 0x01, 0x59, 0x31,
+	0xed, 0x52, 0xaf, 0x65, 0x07, 0xf5, 0xc0, 0xf5, 0xac, 0x03, 0x5c, 0x28, 0x52, 0x7a, 0xaf, 0x1d,
+	0x1f, 0x15, 0x2f, 0x63, 0x5e, 0xdf, 0xb0, 0x08, 0x40, 0xc3, 0x67, 0x10, 0xaa, 0x87, 0x46, 0x12,
+	0x05, 0x32, 0xfa, 0xf5, 0x5e, 0x97, 0xdc, 0x24, 0xe8, 0xe8, 0x5f, 0xd6, 0x46, 0x5f, 0xa9, 0x61,
+	0xa3, 0xef, 0xb3, 0x82, 0xd8, 0xe8, 0x2b, 0x80, 0xc8, 0x04, 0xf4, 0xc0, 0xb5, 0x9d, 0x52, 0x33,
+	0xb0, 0x9f, 0x61, 0xae, 0x09, 0xf1, 0x0b, 0x57, 0x68, 0x4f, 0xa9, 0x95, 0xea, 0x57, 0x5d, 0xdb,
+	0x69, 0x58, 0xb4, 0xba, 0xe1, 0xf3, 0x7a, 0x75, 0x8f, 0xc4, 0xb1, 0xd1, 0x0f, 0xe1, 0xdc, 0x96,
+	0xfb, 0xd8, 0x6e, 0x63, 0xc6, 0x72, 0xd8, 0xb0, 0x50, 0xcd, 0xbe, 0x41, 0xe9, 0x52, 0x2b, 0x55,
+	0x87, 0x42, 0x34, 0x38, 0xb7, 0xea, 0x48, 0x18, 0xd5, 0x4a, 0x95, 0x4c, 0x05, 0x55, 0x61, 0x9a,
+	0xee, 0xcb, 0x36, 0xfd, 0xe9, 0x17, 0xae, 0x52, 0xd9, 0xf7, 0x4a, 0x44, 0x4a, 0xbb, 0x59, 0x55,
+	0x60, 0xaa, 0x4e, 0xe0, 0xbd, 0x30, 0x35, 0x34, 0xf4, 0x31, 0x2c, 0x47, 0x97, 0x77, 0xc5, 0x75,
+	0x9e, 0xd8, 0x07, 0x3d, 0x0f, 0xb7, 0x0a, 0xaf, 0x91, 0xae, 0x9a, 0x7d, 0x20, 0xd0, 0x3e, 0xcc,
+	0x2b, 0x7b, 0x7b, 0x0d, 0x77, 0xdc, 0x2d, 0xb7, 0x85, 0x0b, 0xd7, 0xc3, 0x59, 0x56, 0x59, 0x42,
+	0xa3, 0x85, 0x3b, 0x6e, 0xa3, 0xe3, 0xb6, 0xb0, 0xe6, 0x9c, 0x14, 0x27, 0x40, 0x96, 0x4f, 0x85,
+	0x3a, 0x96, 0x6d, 0xd4, 0x4c, 0x4c, 0x56, 0x5d, 0x93, 0xdd, 0x41, 0x5f, 0x0f, 0x09, 0x33, 0xc7,
+	0xb3, 0x86, 0xdd, 0x6d, 0x78, 0x0a, 0x84, 0xba, 0x7c, 0x92, 0x28, 0x2c, 0x3f, 0x82, 0xb3, 0xb1,
+	0x41, 0x41, 0x79, 0x18, 0x7d, 0x8a, 0x5f, 0x30, 0xd9, 0xda, 0x24, 0x7f, 0xa2, 0xb7, 0x60, 0xfc,
+	0x19, 0xb9, 0xd9, 0x52, 0x19, 0x27, 0x34, 0x7c, 0x2b, 0xa8, 0x1b, 0xce, 0x13, 0xd7, 0x64, 0x40,
+	0x1f, 0x8c, 0xbc, 0x97, 0x79, 0x30, 0x96, 0xcd, 0xe5, 0xa7, 0x99, 0xb7, 0xc8, 0x83, 0xb1, 0xec,
+	0x4c, 0x7e, 0xf6, 0xc1, 0x58, 0xf6, 0x5a, 0xfe, 0xba, 0xb9, 0x48, 0x85, 0x81, 0x92, 0xe3, 0x3a,
+	0x2f, 0x3a, 0xf6, 0x4f, 0xe8, 0xe5, 0x89, 0x88, 0xfd, 0x25, 0x98, 0x8b, 0x10, 0x43, 0x05, 0x98,
+	0xc4, 0x0e, 0xb9, 0x6e, 0xb4, 0x98, 0x08, 0x66, 0x8a, 0x9f, 0x68, 0x01, 0xc6, 0xdb, 0x76, 0xc7,
+	0x0e, 0x68, 0x6f, 0xc6, 0x4d, 0xf6, 0xc3, 0xf8, 0x83, 0x0c, 0xa0, 0xf8, 0x09, 0x88, 0x6e, 0x45,
+	0xc8, 0x30, 0x61, 0x9b, 0x17, 0xa9, 0x46, 0x3c, 0x41, 0xfd, 0x53, 0x98, 0x67, 0x4b, 0x50, 0x9c,
+	0xd5, 0x4a, 0x5b, 0xec, 0x8c, 0x48, 0xa8, 0x56, 0x35, 0xa6, 0xbc, 0x9a, 0x9e, 0xec, 0x9b, 0xb4,
+	0x6b, 0x3d, 0x58, 0x4c, 0x3c, 0xfb, 0xd0, 0x16, 0x2c, 0x76, 0x5c, 0x27, 0x38, 0x6c, 0xbf, 0x10,
+	0x47, 0x1f, 0x6f, 0x8d, 0x5e, 0x0e, 0x19, 0xbb, 0x4f, 0x04, 0x30, 0xe7, 0x79, 0x31, 0xa7, 0x48,
+	0xdb, 0xe1, 0xea, 0x4b, 0xf1, 0x25, 0x86, 0x09, 0x67, 0x63, 0x47, 0x08, 0xfa, 0x08, 0xa6, 0x9b,
+	0xf4, 0xaa, 0xac, 0xb5, 0xc4, 0x0e, 0x50, 0xa5, 0x5c, 0xe5, 0x0e, 0xac, 0x9c, 0x7d, 0xca, 0xdf,
+	0xc9, 0xc0, 0x52, 0xca, 0xe1, 0x71, 0xf2, 0xa1, 0xfe, 0x1c, 0xce, 0x75, 0xac, 0xaf, 0x1b, 0x1e,
+	0xd5, 0x84, 0x34, 0x3c, 0xcb, 0x89, 0x8c, 0x36, 0x5d, 0xd9, 0xc9, 0x10, 0xea, 0x96, 0xe9, 0x58,
+	0x5f, 0x9b, 0x14, 0xc0, 0x24, 0xf5, 0xac, 0x9f, 0x3f, 0x80, 0x19, 0xed, 0xb8, 0x38, 0x71, 0xe7,
+	0x8c, 0x3b, 0x70, 0x76, 0x0d, 0xb7, 0x71, 0x80, 0x87, 0xd6, 0xfe, 0x1a, 0x35, 0x80, 0x50, 0x6d,
+	0x87, 0xca, 0xea, 0xaf, 0x74, 0x75, 0x1d, 0xbb, 0x5a, 0x84, 0x2a, 0x3b, 0x53, 0xc1, 0x32, 0xfe,
+	0xd5, 0x08, 0x20, 0xce, 0xef, 0x3d, 0x6c, 0x75, 0x44, 0x37, 0xde, 0x87, 0x69, 0xa6, 0xef, 0x60,
+	0xc5, 0xb4, 0x3b, 0xb9, 0xd5, 0x79, 0xbe, 0x2d, 0xd5, 0xaa, 0xf5, 0x33, 0xa6, 0x06, 0x4a, 0x50,
+	0x4d, 0xcc, 0x14, 0x35, 0x14, 0x75, 0x44, 0x43, 0x55, 0xab, 0x08, 0xaa, 0xfa, 0x1b, 0x7d, 0x02,
+	0xb3, 0x15, 0xb7, 0xd3, 0x25, 0x63, 0xc2, 0x91, 0x47, 0xb9, 0x12, 0x8c, 0xb7, 0xab, 0x55, 0xae,
+	0x9f, 0x31, 0x23, 0xe0, 0x68, 0x1b, 0xe6, 0xef, 0xb5, 0x7b, 0xfe, 0x61, 0xc9, 0x69, 0x55, 0xda,
+	0xae, 0x2f, 0xa8, 0x8c, 0xf1, 0xbb, 0x1d, 0xe7, 0xd6, 0x71, 0x88, 0xf5, 0x33, 0x66, 0x12, 0x22,
+	0xba, 0x06, 0xe3, 0xd5, 0x67, 0xe4, 0x14, 0x11, 0x5e, 0x5d, 0xdc, 0xe9, 0x74, 0xc7, 0xc1, 0x3b,
+	0x4f, 0xd6, 0xcf, 0x98, 0xac, 0xb6, 0x3c, 0x05, 0x93, 0x42, 0x9f, 0x70, 0x8b, 0x48, 0xf8, 0x72,
+	0x38, 0xeb, 0x81, 0x15, 0xf4, 0x7c, 0xb4, 0x0c, 0xd9, 0xbd, 0x2e, 0xb9, 0xe6, 0x0a, 0x25, 0x93,
+	0x29, 0x7f, 0x1b, 0x6f, 0xe9, 0x23, 0x8d, 0x2e, 0x40, 0x68, 0x1d, 0xe0, 0xc0, 0x8a, 0xb9, 0x60,
+	0x5d, 0x1f, 0xdc, 0xfe, 0xd0, 0x5a, 0xbb, 0x23, 0x91, 0x76, 0xf3, 0xd1, 0xb1, 0x36, 0x16, 0x13,
+	0x07, 0xcf, 0xf8, 0x0c, 0x2e, 0xed, 0x75, 0x7d, 0xec, 0x05, 0xa5, 0x6e, 0xb7, 0x6d, 0x37, 0x99,
+	0xb5, 0x9a, 0xea, 0x1d, 0xc4, 0x62, 0x79, 0x17, 0x26, 0x58, 0x01, 0x5f, 0x26, 0x62, 0x0d, 0x96,
+	0xba, 0x5d, 0xae, 0xed, 0xb8, 0xcb, 0xee, 0x1a, 0x4c, 0x7f, 0x61, 0x72, 0x68, 0xe3, 0x77, 0x32,
+	0x70, 0x89, 0xed, 0x80, 0x54, 0xd2, 0xdf, 0x81, 0x29, 0xea, 0xf3, 0xd9, 0xb5, 0x9a, 0x62, 0x4f,
+	0x30, 0xe7, 0x57, 0x51, 0x68, 0x86, 0xf5, 0x8a, 0x37, 0xed, 0x48, 0xba, 0x37, 0xad, 0xd8, 0x60,
+	0xa3, 0x89, 0x1b, 0xec, 0x53, 0x30, 0x78, 0x8f, 0xda, 0xed, 0x58, 0xa7, 0xfc, 0x97, 0xe9, 0x95,
+	0xf1, 0x9f, 0x46, 0x60, 0xe9, 0x3e, 0x76, 0xb0, 0x67, 0xd1, 0xef, 0xd4, 0xf4, 0x75, 0xaa, 0x17,
+	0x5e, 0xa6, 0xaf, 0x17, 0x5e, 0x51, 0x68, 0x61, 0x47, 0xa8, 0x16, 0x36, 0xe6, 0x22, 0x48, 0x6e,
+	0xbf, 0x7b, 0xe6, 0x06, 0xff, 0x2c, 0x7a, 0xfb, 0xed, 0x79, 0x36, 0x33, 0x95, 0x6d, 0x84, 0x1e,
+	0x7c, 0x63, 0x03, 0xb5, 0x1c, 0xf3, 0xdc, 0xa3, 0x69, 0x92, 0x7b, 0xf0, 0xe9, 0x7e, 0x7b, 0xdb,
+	0x30, 0xc1, 0x94, 0xc7, 0xd4, 0x40, 0x9b, 0x5b, 0x7d, 0x93, 0xef, 0xa9, 0x94, 0x0f, 0xe4, 0x9a,
+	0x66, 0x7a, 0xea, 0xb3, 0x25, 0x10, 0xd0, 0x02, 0x93, 0x53, 0x59, 0xfe, 0x14, 0x72, 0x0a, 0xc8,
+	0x30, 0x82, 0x81, 0x54, 0x62, 0x13, 0x01, 0xd8, 0x39, 0x60, 0xfa, 0x70, 0x45, 0x30, 0x30, 0x3e,
+	0x84, 0x42, 0xbc, 0x37, 0x5c, 0xb9, 0x37, 0x48, 0x97, 0x68, 0xac, 0xc1, 0xc2, 0x7d, 0x1c, 0xd0,
+	0x85, 0x4b, 0x37, 0x91, 0xe2, 0x59, 0x1a, 0xd9, 0x67, 0x82, 0xab, 0xd2, 0x42, 0xb2, 0xc0, 0x94,
+	0x5d, 0x5a, 0x87, 0xc5, 0x08, 0x15, 0xde, 0xfe, 0x07, 0x30, 0xc9, 0x8b, 0x24, 0x47, 0xe5, 0xee,
+	0xe9, 0xf8, 0x31, 0xaf, 0xd8, 0x5f, 0x65, 0xeb, 0x96, 0x53, 0x36, 0x05, 0x82, 0x71, 0xc8, 0xcc,
+	0x36, 0x21, 0xd5, 0x53, 0x31, 0x1e, 0x21, 0xa0, 0x7e, 0xa9, 0x6c, 0xdd, 0x98, 0xf4, 0x6f, 0xc3,
+	0x83, 0xa5, 0x58, 0x4b, 0xfc, 0x03, 0x6e, 0x41, 0x56, 0x48, 0xe4, 0x11, 0x93, 0x8d, 0xfa, 0x05,
+	0xa6, 0x04, 0x1a, 0x5a, 0xfd, 0xfb, 0x2b, 0x54, 0x4d, 0x5f, 0x77, 0xdc, 0xe7, 0x4f, 0xda, 0xd6,
+	0x53, 0x1c, 0x6b, 0xf8, 0x23, 0xc8, 0xd6, 0x07, 0x37, 0xcc, 0xb6, 0x8f, 0x68, 0xdc, 0x94, 0x28,
+	0x46, 0x1b, 0x96, 0xa9, 0xcd, 0xab, 0xb4, 0xb5, 0xb9, 0xd1, 0xaa, 0x7d, 0xd3, 0x03, 0xf8, 0x0c,
+	0x56, 0x12, 0x5b, 0xfb, 0xa6, 0x07, 0xf1, 0x8f, 0xc6, 0x60, 0x89, 0x1d, 0x26, 0xf1, 0x15, 0x3c,
+	0x3c, 0xab, 0xf9, 0x56, 0x9c, 0x16, 0x6e, 0x27, 0x38, 0x2d, 0x50, 0x14, 0xd5, 0x69, 0x41, 0x73,
+	0x55, 0x78, 0x2f, 0xd9, 0x55, 0x81, 0xaa, 0xbd, 0x74, 0x57, 0x85, 0xa8, 0x83, 0x42, 0x35, 0xdd,
+	0x41, 0x81, 0x9a, 0xf1, 0x12, 0x1c, 0x14, 0x92, 0xdc, 0x12, 0x22, 0xce, 0x84, 0xd9, 0xd3, 0x75,
+	0x26, 0xbc, 0x0e, 0x93, 0xa5, 0x6e, 0x57, 0x71, 0xce, 0xa5, 0xd3, 0x63, 0x75, 0xbb, 0x6c, 0xf0,
+	0x44, 0xa5, 0xe0, 0xf3, 0x90, 0xc0, 0xe7, 0xdf, 0x07, 0x60, 0x77, 0x30, 0x3a, 0x71, 0x39, 0x0a,
+	0x41, 0x25, 0x7c, 0x7e, 0x77, 0x23, 0x13, 0xa7, 0x2a, 0x74, 0x42, 0x60, 0x26, 0xd8, 0x1b, 0xfb,
+	0x50, 0x88, 0x2f, 0x9f, 0x53, 0x60, 0x5d, 0x7f, 0x98, 0x81, 0x8b, 0x5c, 0xc8, 0x89, 0x6c, 0xf0,
+	0x93, 0xaf, 0xce, 0x77, 0x60, 0x9a, 0xe3, 0xee, 0x86, 0x1b, 0x81, 0x79, 0x89, 0x08, 0x66, 0xcc,
+	0x38, 0xba, 0x06, 0x86, 0xde, 0x81, 0x2c, 0xfd, 0x23, 0x34, 0xb3, 0x91, 0x91, 0x99, 0xa2, 0xa0,
+	0x8d, 0xa8, 0xb1, 0x4d, 0x82, 0x1a, 0x5f, 0xc1, 0xa5, 0xb4, 0x8e, 0x9f, 0xc2, 0xb8, 0xfc, 0x93,
+	0x0c, 0xac, 0x70, 0xf2, 0x1a, 0xab, 0x78, 0xa9, 0x53, 0xe7, 0x04, 0x2e, 0xfd, 0x0f, 0x20, 0x47,
+	0x1a, 0x14, 0xfd, 0x8e, 0xb8, 0x0d, 0x84, 0x35, 0x6b, 0x56, 0x60, 0x71, 0x1f, 0x32, 0xab, 0xd3,
+	0x16, 0xba, 0x18, 0x53, 0x45, 0x36, 0xbe, 0x80, 0x0b, 0xc9, 0x9f, 0x70, 0x0a, 0xe3, 0xf3, 0x00,
+	0x96, 0x13, 0x0e, 0x85, 0x97, 0x3b, 0x93, 0x3f, 0x87, 0x95, 0x44, 0x5a, 0xa7, 0xd0, 0xcd, 0x75,
+	0x22, 0x71, 0x04, 0xa7, 0x30, 0x85, 0xc6, 0x23, 0x38, 0x9f, 0x40, 0xe9, 0x14, 0xba, 0x78, 0x1f,
+	0x96, 0xa4, 0xa4, 0xfd, 0x4a, 0x3d, 0xdc, 0x82, 0x8b, 0x8c, 0xd0, 0xe9, 0xcc, 0xca, 0x43, 0x58,
+	0xe1, 0xe4, 0x4e, 0x61, 0xf4, 0xd6, 0xe1, 0x42, 0x78, 0xa1, 0x4e, 0x90, 0x93, 0x86, 0x66, 0x32,
+	0xc6, 0x26, 0x5c, 0x0e, 0x29, 0xa5, 0x08, 0x0d, 0xc3, 0x53, 0x63, 0xe2, 0x60, 0x38, 0x4b, 0xa7,
+	0x32, 0xa3, 0x8f, 0xe0, 0x9c, 0x46, 0xf4, 0xd4, 0x44, 0xa5, 0x0d, 0x98, 0x67, 0x84, 0x75, 0xd1,
+	0x79, 0x55, 0x15, 0x9d, 0x73, 0xab, 0x67, 0x43, 0x92, 0xdc, 0xea, 0x9f, 0x20, 0x4d, 0x6f, 0x51,
+	0x69, 0x5a, 0x80, 0x84, 0x3d, 0x7c, 0x07, 0x26, 0x76, 0x55, 0x1f, 0x82, 0x04, 0x62, 0xec, 0xb2,
+	0xc0, 0xd0, 0x38, 0xb0, 0x61, 0xc2, 0x02, 0x11, 0xab, 0x14, 0x7a, 0xaf, 0xee, 0xf5, 0xf0, 0xab,
+	0xcc, 0x23, 0x2b, 0xde, 0xc7, 0x37, 0x60, 0x22, 0xe8, 0xdf, 0x47, 0x93, 0x03, 0x0c, 0x2d, 0x9e,
+	0xfd, 0x10, 0x2e, 0xb2, 0x9b, 0x74, 0x68, 0xda, 0xd5, 0x6f, 0xbb, 0x1f, 0x45, 0x2e, 0xd2, 0xe7,
+	0x79, 0x9b, 0x51, 0xf8, 0x94, 0xfb, 0xf4, 0x63, 0xb1, 0x37, 0xd3, 0xe8, 0x0f, 0x15, 0x6e, 0x2a,
+	0x2e, 0xc8, 0x23, 0x89, 0x17, 0xe4, 0xab, 0x70, 0x45, 0x5e, 0x90, 0xa3, 0xcd, 0x88, 0x09, 0x31,
+	0xbe, 0x80, 0x15, 0xf6, 0xa1, 0xc2, 0xaf, 0x57, 0xef, 0xc6, 0x87, 0x91, 0xcf, 0x5c, 0xe2, 0x9f,
+	0xa9, 0x43, 0xa7, 0x7c, 0xe4, 0xff, 0x95, 0x11, 0x2c, 0x23, 0x99, 0xf8, 0xb7, 0xad, 0x31, 0xd8,
+	0x86, 0xa2, 0x1c, 0x10, 0xbd, 0x47, 0x2f, 0xa7, 0x2e, 0xd8, 0x82, 0x45, 0x95, 0x8c, 0xdd, 0xc4,
+	0xfb, 0x77, 0xa8, 0xcd, 0xed, 0x6d, 0xb2, 0xad, 0x69, 0x81, 0x58, 0x92, 0x85, 0x84, 0x71, 0xa3,
+	0xf0, 0xa6, 0x84, 0x34, 0x1a, 0x70, 0x21, 0x3e, 0x15, 0x76, 0x53, 0xc4, 0x0c, 0xa1, 0x4f, 0x08,
+	0x0b, 0xa2, 0x25, 0x7c, 0x32, 0x52, 0x89, 0x0a, 0x3e, 0xc4, 0xd0, 0x05, 0x96, 0x61, 0x08, 0x56,
+	0x19, 0xf9, 0x7e, 0xd2, 0xba, 0x58, 0x0f, 0x3f, 0x05, 0x24, 0xaa, 0x2a, 0x75, 0x53, 0x34, 0x7d,
+	0x1e, 0x46, 0x2b, 0x75, 0x93, 0x07, 0x2d, 0x52, 0x49, 0xb6, 0xe9, 0x7b, 0x26, 0x29, 0x8b, 0xde,
+	0x28, 0x46, 0x86, 0xb8, 0x51, 0x3c, 0x18, 0xcb, 0x8e, 0xe6, 0xc7, 0x4c, 0x54, 0xb7, 0x0f, 0x9c,
+	0x47, 0x76, 0x70, 0x28, 0x1b, 0x2c, 0x19, 0x5f, 0xc2, 0xbc, 0xd6, 0x3c, 0xdf, 0xe1, 0x7d, 0xa3,
+	0x26, 0x89, 0x3c, 0x5e, 0x29, 0x51, 0x47, 0x24, 0xaa, 0x72, 0x99, 0x66, 0xfc, 0xb2, 0x69, 0x35,
+	0x68, 0xd8, 0xbf, 0x29, 0x2a, 0x8d, 0x7f, 0x3b, 0xa6, 0x50, 0x57, 0x62, 0x51, 0xfb, 0x7c, 0xdd,
+	0x1d, 0x00, 0xb6, 0x42, 0x94, 0x8f, 0x23, 0x02, 0x6c, 0x8e, 0xfb, 0xf7, 0xb0, 0x23, 0xc5, 0x54,
+	0x80, 0x86, 0x8d, 0x55, 0xe5, 0x41, 0x00, 0x0c, 0x49, 0x84, 0x67, 0xcb, 0x20, 0x00, 0x4e, 0xda,
+	0x37, 0x55, 0x20, 0xf4, 0xc3, 0x68, 0x00, 0xd6, 0x38, 0x35, 0xf1, 0xbd, 0x26, 0x6c, 0xfe, 0xf1,
+	0x6f, 0x3b, 0x59, 0x0c, 0xd6, 0x73, 0x58, 0x24, 0xb8, 0xf6, 0x13, 0x7a, 0x31, 0xaa, 0x7e, 0x1d,
+	0x60, 0x87, 0x9d, 0x4d, 0x13, 0xb4, 0x9d, 0x6b, 0x7d, 0xda, 0x09, 0x81, 0xb9, 0xfd, 0x20, 0xa4,
+	0xd3, 0xc0, 0xb2, 0xce, 0x4c, 0xa6, 0x8f, 0xde, 0x86, 0x5c, 0xc5, 0xdc, 0xac, 0x3a, 0xad, 0xae,
+	0x6b, 0xcb, 0x0b, 0x1f, 0xa2, 0x8b, 0xc8, 0x6b, 0x37, 0xb0, 0x28, 0xcf, 0x98, 0x2a, 0x18, 0x11,
+	0x39, 0x2a, 0xe6, 0xe6, 0x9a, 0xdb, 0xb1, 0x6c, 0x87, 0xbb, 0xa0, 0x53, 0x91, 0x83, 0xe0, 0xb4,
+	0x68, 0xa9, 0x19, 0x02, 0x18, 0xd7, 0xfb, 0x06, 0xbb, 0x64, 0x61, 0x6c, 0xb7, 0xb2, 0xbb, 0x99,
+	0xcf, 0x18, 0xb7, 0x00, 0x94, 0x9e, 0x01, 0x4c, 0x6c, 0xef, 0x98, 0x5b, 0xa5, 0xcd, 0xfc, 0x19,
+	0xb4, 0x08, 0x67, 0x1f, 0x6d, 0x6c, 0xaf, 0xed, 0x3c, 0xaa, 0x37, 0xea, 0x5b, 0x25, 0x73, 0xb7,
+	0x52, 0x32, 0xd7, 0xf2, 0x19, 0xe3, 0x2b, 0x58, 0xd0, 0x47, 0xe4, 0x54, 0x17, 0x6d, 0x00, 0xf3,
+	0x52, 0x7e, 0x7b, 0xf0, 0x68, 0x57, 0xf1, 0x05, 0xe7, 0x97, 0xdd, 0xa8, 0xef, 0x1b, 0xbf, 0x16,
+	0xf3, 0x6d, 0xa7, 0x00, 0xa1, 0x37, 0x98, 0x18, 0x14, 0xcd, 0x4e, 0x40, 0x1d, 0x05, 0x43, 0x39,
+	0x88, 0xb2, 0xca, 0xef, 0xc1, 0x82, 0xde, 0xea, 0xb0, 0x5a, 0xb9, 0xd7, 0xa8, 0x93, 0xbc, 0x12,
+	0xea, 0x88, 0x90, 0x6a, 0x26, 0xe1, 0x9c, 0xf8, 0x7b, 0x90, 0xe7, 0x50, 0xe1, 0x29, 0x7e, 0x55,
+	0xa8, 0x4d, 0x33, 0x09, 0x81, 0xd6, 0x22, 0x92, 0xc4, 0x85, 0x3c, 0xf5, 0x7c, 0x64, 0x98, 0xac,
+	0x81, 0x05, 0x18, 0xdf, 0x0c, 0xcd, 0x57, 0x26, 0xfb, 0x41, 0x23, 0xfe, 0x02, 0xcb, 0x0b, 0x84,
+	0xa7, 0xe1, 0x94, 0x29, 0x7f, 0x13, 0x81, 0xe1, 0x9e, 0xea, 0x86, 0x7d, 0x56, 0x69, 0x4b, 0x78,
+	0x60, 0xb3, 0xff, 0x0d, 0x13, 0xce, 0x2a, 0x0d, 0x9e, 0xa0, 0xab, 0xa8, 0x00, 0x93, 0xdb, 0xf8,
+	0x6b, 0xa5, 0x7d, 0xf1, 0xd3, 0x78, 0x17, 0xce, 0x72, 0x0f, 0x55, 0x65, 0x98, 0xae, 0xf0, 0x7c,
+	0x10, 0x19, 0x2d, 0x28, 0x9d, 0x93, 0xa4, 0x55, 0x04, 0x6f, 0xaf, 0xdb, 0x7a, 0x49, 0x3c, 0x72,
+	0xb0, 0x9c, 0x10, 0xef, 0x75, 0x61, 0xf5, 0x1a, 0x34, 0x9d, 0xff, 0xc7, 0x08, 0x14, 0x22, 0x5a,
+	0x95, 0xca, 0xa1, 0xd5, 0x6e, 0x63, 0xe7, 0x00, 0xa3, 0x1b, 0x30, 0xb6, 0xbb, 0xb3, 0x5b, 0xe3,
+	0x5a, 0x61, 0xe1, 0xbf, 0x41, 0x8a, 0x24, 0x8c, 0x49, 0x21, 0xd0, 0x43, 0x38, 0x2b, 0xfc, 0xef,
+	0x65, 0x15, 0x9f, 0xa1, 0x8b, 0xfd, 0xbd, 0xf9, 0xe3, 0x78, 0x84, 0xa5, 0x50, 0x9d, 0xcd, 0x8f,
+	0x7b, 0xb6, 0x87, 0x5b, 0x54, 0xd3, 0x15, 0x3a, 0x43, 0x28, 0x35, 0xa6, 0x0a, 0x86, 0xbe, 0x07,
+	0xd3, 0xf5, 0xfa, 0x4e, 0xd8, 0xfa, 0xb8, 0x66, 0x11, 0x53, 0xab, 0x4c, 0x0d, 0x90, 0x45, 0x85,
+	0x19, 0x7f, 0x94, 0x81, 0xa5, 0x14, 0xf5, 0x12, 0x7a, 0x43, 0x1b, 0x87, 0x79, 0x65, 0x1c, 0x04,
+	0xc8, 0xfa, 0x19, 0x3e, 0x10, 0x15, 0x25, 0x9a, 0x61, 0xf4, 0x04, 0xd1, 0x0c, 0xeb, 0x67, 0xc2,
+	0x08, 0x06, 0x74, 0x1d, 0x46, 0xeb, 0xf5, 0x1d, 0x6e, 0x46, 0x40, 0xe1, 0x17, 0x28, 0xc0, 0x04,
+	0xa0, 0x0c, 0x90, 0x15, 0x45, 0xc6, 0x1c, 0xcc, 0x68, 0x13, 0x63, 0x18, 0x30, 0xad, 0xf6, 0x90,
+	0xcc, 0x7e, 0xc5, 0x6d, 0xc9, 0xd9, 0x27, 0x7f, 0x1b, 0x3f, 0xd5, 0xc7, 0x8c, 0x88, 0xf1, 0xc2,
+	0x3e, 0x6d, 0xb7, 0x84, 0xa5, 0x8b, 0x97, 0x6c, 0xb4, 0xd0, 0x15, 0x98, 0xf6, 0x70, 0xcb, 0xf6,
+	0x70, 0x33, 0x68, 0xf4, 0x3c, 0x1e, 0xcd, 0x66, 0xe6, 0x44, 0xd9, 0x9e, 0xd7, 0x46, 0xdf, 0x81,
+	0x09, 0x66, 0x38, 0xe7, 0x5f, 0x2f, 0x2e, 0x45, 0xf5, 0xfa, 0xce, 0xd6, 0xbd, 0x12, 0x33, 0xec,
+	0x9b, 0x1c, 0xc4, 0x28, 0x43, 0x4e, 0xf9, 0xaa, 0x41, 0xad, 0x2f, 0xc0, 0xb8, 0x2a, 0xf6, 0xb3,
+	0x1f, 0xc6, 0xef, 0x66, 0x60, 0x81, 0x2e, 0x83, 0x03, 0x9b, 0x1c, 0x0f, 0xe1, 0xb7, 0xac, 0x6a,
+	0x93, 0x76, 0x41, 0x9b, 0xb4, 0x08, 0xac, 0x9c, 0xbd, 0x0f, 0x62, 0xb3, 0x77, 0x21, 0x69, 0xf6,
+	0x28, 0x0b, 0xb0, 0x5d, 0x47, 0x9d, 0x34, 0xd5, 0x3c, 0xf9, 0x07, 0x19, 0x98, 0x57, 0xfa, 0x24,
+	0x3f, 0xf0, 0x8e, 0xd6, 0xa5, 0x95, 0x84, 0x2e, 0xc5, 0xd6, 0x53, 0x39, 0xd6, 0xa3, 0xd7, 0xfa,
+	0xf5, 0x28, 0x69, 0x39, 0x69, 0xcb, 0xe4, 0xcf, 0x33, 0xb0, 0x98, 0x38, 0x06, 0xe8, 0x1c, 0xb9,
+	0x2f, 0x34, 0x3d, 0x1c, 0xf0, 0x91, 0xe7, 0xbf, 0x48, 0xf9, 0x86, 0xef, 0xf7, 0xb0, 0xc7, 0xc7,
+	0x9d, 0xff, 0x42, 0xaf, 0xc1, 0x4c, 0x0d, 0x7b, 0xb6, 0xdb, 0x62, 0x21, 0x3d, 0xcc, 0xa7, 0x7a,
+	0xc6, 0xd4, 0x0b, 0xd1, 0x05, 0x98, 0x92, 0x3e, 0xc1, 0x4c, 0x67, 0x6d, 0x86, 0x05, 0x84, 0xf6,
+	0x9a, 0x7d, 0xc0, 0x0c, 0x5d, 0x04, 0x99, 0xff, 0x22, 0x0c, 0x58, 0x68, 0x90, 0x27, 0x18, 0x03,
+	0x16, 0xea, 0xe1, 0x73, 0x30, 0xf1, 0xa9, 0x49, 0xd7, 0x31, 0xcd, 0x2b, 0x63, 0xf2, 0x5f, 0x68,
+	0x96, 0x06, 0x26, 0x50, 0x49, 0x82, 0x06, 0x24, 0x7c, 0x00, 0x0b, 0x49, 0xe3, 0x9a, 0xb4, 0x0b,
+	0x38, 0xee, 0x88, 0xc4, 0xfd, 0x02, 0xe6, 0x4b, 0xad, 0x56, 0xb8, 0x5c, 0xd9, 0xac, 0xca, 0xe8,
+	0xd1, 0x91, 0xfc, 0x28, 0x17, 0x83, 0xc7, 0x36, 0x1c, 0x3b, 0x30, 0xe7, 0xab, 0x5f, 0xdb, 0x7e,
+	0x60, 0x3b, 0x07, 0x8a, 0xa2, 0xd9, 0x3c, 0xb7, 0x8d, 0x9f, 0x27, 0x2c, 0x01, 0x22, 0x71, 0xe8,
+	0xb4, 0x59, 0x79, 0x02, 0xf1, 0x05, 0x85, 0x6c, 0xc8, 0xba, 0x96, 0x74, 0xba, 0x61, 0xc5, 0x68,
+	0xa9, 0xf9, 0xd4, 0xf8, 0x1e, 0x9c, 0x63, 0x6c, 0xbf, 0x5f, 0xe7, 0x79, 0xb7, 0x55, 0xbd, 0xb8,
+	0xf1, 0x9e, 0xd0, 0x5c, 0xf5, 0xed, 0x99, 0x39, 0xad, 0xf5, 0x85, 0x36, 0xf9, 0x1f, 0x33, 0xb0,
+	0x1c, 0x41, 0xad, 0xbf, 0x70, 0x9a, 0xe2, 0xcc, 0xb9, 0x1e, 0x0d, 0xfc, 0xa0, 0xb2, 0x12, 0x53,
+	0x08, 0xdb, 0x2d, 0x19, 0xfb, 0x81, 0x6e, 0x01, 0x30, 0x64, 0x45, 0xc4, 0xa1, 0xe6, 0x10, 0xee,
+	0x47, 0x46, 0x85, 0x1c, 0x05, 0x04, 0xf5, 0x20, 0x69, 0xdc, 0xf9, 0x1e, 0x19, 0x64, 0x2f, 0xa0,
+	0xb9, 0x94, 0x30, 0x47, 0x6f, 0xa4, 0x18, 0x0e, 0x92, 0xe8, 0x1b, 0xff, 0xf7, 0x28, 0x2c, 0xa9,
+	0x13, 0xf8, 0x32, 0xdf, 0x5a, 0x83, 0x5c, 0xc5, 0x75, 0x02, 0xfc, 0x75, 0xa0, 0xe4, 0xb2, 0x41,
+	0xd2, 0xfb, 0x42, 0xd6, 0x70, 0x71, 0x9c, 0x15, 0x34, 0x88, 0xac, 0xa7, 0xf9, 0xc3, 0x86, 0x80,
+	0xa8, 0x02, 0x33, 0xdb, 0xf8, 0x79, 0x6c, 0x00, 0xa9, 0x4f, 0xae, 0x83, 0x9f, 0x37, 0x94, 0x41,
+	0x54, 0x1d, 0x25, 0x35, 0x1c, 0xf4, 0x18, 0x66, 0xc5, 0xe2, 0xd2, 0x06, 0x73, 0x59, 0x3d, 0x79,
+	0xf5, 0xe5, 0xcc, 0x72, 0xc3, 0x90, 0x16, 0x52, 0xc6, 0x30, 0x42, 0x91, 0x7c, 0x3a, 0x6b, 0x91,
+	0xa5, 0x3b, 0xd1, 0x8f, 0x76, 0xa5, 0x46, 0xf3, 0x78, 0x8e, 0xa6, 0x39, 0x51, 0x49, 0x18, 0x35,
+	0x28, 0xc4, 0xe7, 0x83, 0xb7, 0xf6, 0x36, 0x4c, 0xb0, 0x52, 0x2e, 0x2a, 0x89, 0x34, 0x65, 0x12,
+	0x9a, 0xe9, 0x3e, 0x5a, 0xfc, 0x54, 0x62, 0x65, 0xc6, 0x3a, 0xd5, 0xa7, 0x49, 0x18, 0x29, 0xac,
+	0xde, 0x8e, 0x4e, 0x2f, 0x75, 0x26, 0x17, 0xd3, 0xab, 0xfa, 0x1e, 0x89, 0x80, 0xa6, 0x0a, 0x55,
+	0x49, 0xaa, 0x94, 0x78, 0xc7, 0xde, 0x84, 0x49, 0x5e, 0x14, 0x49, 0xa0, 0x16, 0x6e, 0x3f, 0x01,
+	0x60, 0x7c, 0x00, 0xe7, 0xa9, 0x7e, 0xd4, 0x76, 0x0e, 0xda, 0x78, 0xcf, 0xd7, 0xc2, 0x76, 0x06,
+	0x6d, 0xeb, 0xef, 0xc3, 0x72, 0x12, 0xee, 0xc0, 0x9d, 0xcd, 0x52, 0x1a, 0xfd, 0xe9, 0x08, 0x2c,
+	0x6c, 0xf8, 0xaa, 0xc0, 0xc5, 0x47, 0xe2, 0x66, 0x52, 0x6a, 0x1e, 0x3a, 0x26, 0xeb, 0x67, 0x92,
+	0x52, 0xef, 0xbc, 0xad, 0xc4, 0xa8, 0x8f, 0xf4, 0xcb, 0xb9, 0x43, 0x8e, 0x2d, 0x19, 0xa5, 0x7e,
+	0x1d, 0xc6, 0xb6, 0x09, 0xab, 0x1e, 0xe5, 0x73, 0xc7, 0x30, 0x48, 0x11, 0x8d, 0x11, 0x27, 0x47,
+	0x24, 0xf9, 0x81, 0xee, 0xc5, 0x22, 0xd1, 0xc7, 0x06, 0xe7, 0x94, 0x59, 0x3f, 0x13, 0x0b, 0x4a,
+	0x7f, 0x17, 0x72, 0xa5, 0x56, 0x87, 0x39, 0xbd, 0xba, 0x4e, 0x64, 0x5b, 0x2a, 0x35, 0xeb, 0x67,
+	0x4c, 0x15, 0x10, 0x5d, 0x63, 0x71, 0x23, 0x13, 0x29, 0x79, 0x76, 0x88, 0xb0, 0x56, 0xea, 0x76,
+	0xcb, 0x59, 0x98, 0x60, 0xd1, 0xd1, 0xc6, 0x17, 0xb0, 0xcc, 0x1d, 0x97, 0x98, 0x36, 0x98, 0xba,
+	0x37, 0xf9, 0xa1, 0x6f, 0x5a, 0x3f, 0x67, 0xa3, 0x4b, 0x00, 0xf4, 0x2e, 0xb4, 0xe1, 0xb4, 0xf0,
+	0xd7, 0xdc, 0x73, 0x52, 0x29, 0x31, 0xde, 0x81, 0x29, 0x39, 0x42, 0x54, 0xe0, 0x57, 0x0e, 0x3b,
+	0x3a, 0x5a, 0x0b, 0x5a, 0xe8, 0xbd, 0x88, 0xb7, 0x3f, 0xaf, 0x7d, 0x3b, 0xcf, 0x84, 0xc5, 0x6e,
+	0x08, 0x36, 0x2c, 0x46, 0x16, 0x41, 0x98, 0x98, 0x45, 0xca, 0xe8, 0xcc, 0xb5, 0x53, 0xfe, 0x8e,
+	0x8a, 0xf0, 0x23, 0x43, 0x89, 0xf0, 0xc6, 0x3f, 0x1d, 0xa1, 0x97, 0xcb, 0xd8, 0x78, 0x44, 0xf4,
+	0x7a, 0xaa, 0x6e, 0xb1, 0x0c, 0x53, 0xf4, 0xeb, 0xd7, 0x44, 0xb8, 0x69, 0x7f, 0xbf, 0x9b, 0xec,
+	0xcf, 0x8f, 0x8a, 0x67, 0xa8, 0xb3, 0x4d, 0x88, 0x86, 0x3e, 0x86, 0xc9, 0xaa, 0xd3, 0xa2, 0x14,
+	0x46, 0x4f, 0x40, 0x41, 0x20, 0x91, 0x39, 0xa1, 0x5d, 0xde, 0x25, 0x5b, 0x98, 0xa9, 0x83, 0x4c,
+	0xa5, 0x24, 0xbc, 0xe5, 0x8e, 0xa7, 0xdd, 0x72, 0x27, 0x22, 0xb7, 0x5c, 0x03, 0xc6, 0x77, 0xbc,
+	0x16, 0xcf, 0x77, 0x35, 0xbb, 0x3a, 0xcd, 0x07, 0x8e, 0x96, 0x99, 0xac, 0x8a, 0xc9, 0x6b, 0x96,
+	0xd7, 0x3c, 0xe4, 0x52, 0x0f, 0xff, 0x65, 0xfc, 0xe7, 0x0c, 0x2c, 0xdd, 0xc7, 0x41, 0xe2, 0xda,
+	0xd2, 0x46, 0x2b, 0xf3, 0xca, 0xa3, 0x35, 0xf2, 0x32, 0xa3, 0x25, 0x47, 0x63, 0x34, 0x6d, 0x34,
+	0xc6, 0xd2, 0x46, 0x63, 0x3c, 0x75, 0x34, 0x8c, 0xfb, 0x30, 0xc1, 0x3e, 0x95, 0xdc, 0xf0, 0x37,
+	0x02, 0xdc, 0x09, 0x6f, 0xf8, 0xaa, 0x37, 0xa1, 0xc9, 0xea, 0x88, 0x80, 0xb9, 0x69, 0xf9, 0xea,
+	0x0d, 0x9f, 0xff, 0x34, 0x7e, 0x44, 0x83, 0xf7, 0x37, 0xdd, 0xe6, 0x53, 0x45, 0xb3, 0x3c, 0xc9,
+	0x76, 0x6e, 0xd4, 0x4a, 0x41, 0xa0, 0x58, 0x8d, 0x29, 0x20, 0xd0, 0x65, 0xc8, 0x6d, 0x38, 0xf7,
+	0x5c, 0xaf, 0x89, 0x77, 0x9c, 0x36, 0xa3, 0x9e, 0x35, 0xd5, 0x22, 0xae, 0x41, 0xe1, 0x2d, 0x84,
+	0x6a, 0x09, 0x5a, 0x10, 0x51, 0x4b, 0x90, 0xb2, 0xfd, 0x55, 0x93, 0xd5, 0x19, 0x2f, 0x98, 0x06,
+	0x45, 0xeb, 0xdb, 0xab, 0x38, 0xd5, 0xbc, 0x11, 0x09, 0x69, 0x57, 0x3f, 0x2b, 0x12, 0xcd, 0xfe,
+	0x23, 0xa6, 0x4b, 0x89, 0x75, 0xba, 0xdd, 0xa7, 0xd3, 0xb4, 0x6e, 0x68, 0xb3, 0x0d, 0xd3, 0x3e,
+	0x11, 0xdc, 0x7e, 0xea, 0x0a, 0xa9, 0xd7, 0x18, 0x04, 0xf8, 0x18, 0xce, 0x9b, 0xb8, 0xdb, 0xb6,
+	0x88, 0x20, 0xdb, 0x71, 0x19, 0xbc, 0x1c, 0xb4, 0xcb, 0x09, 0xd1, 0xa7, 0xba, 0xe3, 0x8c, 0x9c,
+	0x8f, 0x91, 0x3e, 0xf3, 0xb1, 0x06, 0x73, 0xdc, 0x83, 0x4b, 0x55, 0x68, 0xb5, 0x55, 0x85, 0x16,
+	0xfd, 0x41, 0x26, 0x89, 0xc5, 0x5b, 0x3f, 0x0d, 0x35, 0x5a, 0x3e, 0x5f, 0xdd, 0x46, 0x83, 0xcd,
+	0x2a, 0xa3, 0xc2, 0x47, 0xf6, 0x36, 0x4c, 0x5b, 0xa1, 0x5f, 0xa4, 0x18, 0xe0, 0xe9, 0xd0, 0xe3,
+	0x73, 0xff, 0xae, 0xa9, 0x41, 0xa0, 0xf3, 0x90, 0xa5, 0xc3, 0x1c, 0xb6, 0x30, 0xe9, 0x70, 0x9d,
+	0x15, 0x37, 0xe8, 0x89, 0x73, 0xf5, 0x54, 0x0c, 0x7a, 0x5d, 0x66, 0xd0, 0x53, 0x68, 0x4a, 0xaf,
+	0xab, 0x29, 0x91, 0x7a, 0x26, 0xba, 0x5b, 0x04, 0xf0, 0xfe, 0x5d, 0x33, 0x84, 0x19, 0x7a, 0x7d,
+	0x74, 0xe0, 0xca, 0x7d, 0x1c, 0xe8, 0x47, 0x76, 0x68, 0x01, 0xe1, 0xad, 0xaf, 0x43, 0xd6, 0xd7,
+	0xad, 0x37, 0x22, 0x74, 0x35, 0x11, 0x71, 0xff, 0xae, 0xb0, 0xcf, 0x72, 0x3a, 0xf2, 0x2f, 0xe3,
+	0x13, 0x28, 0xa6, 0x35, 0x37, 0x9c, 0x13, 0xb9, 0x0d, 0x97, 0xd3, 0x09, 0xf0, 0xee, 0x56, 0x41,
+	0x58, 0x7a, 0x38, 0x33, 0x1e, 0xd4, 0x5b, 0xdd, 0x38, 0xc4, 0xff, 0x30, 0xca, 0xc2, 0x9d, 0xf6,
+	0x15, 0xba, 0xfb, 0xf7, 0x46, 0x99, 0xef, 0x9e, 0x4e, 0xe2, 0x15, 0xd6, 0x35, 0xaa, 0xc2, 0x44,
+	0xdb, 0x7a, 0x8c, 0xdb, 0x7e, 0x61, 0x94, 0xce, 0xc4, 0x77, 0x39, 0xdb, 0x4e, 0x6f, 0x85, 0xe5,
+	0x5e, 0xe0, 0x21, 0x3d, 0x1c, 0x19, 0xdd, 0x81, 0x85, 0xae, 0x87, 0x5b, 0xc2, 0x1c, 0xd1, 0xf5,
+	0xb8, 0x29, 0x9f, 0x1d, 0x12, 0xf3, 0xb2, 0xae, 0x2a, 0xab, 0xd0, 0xeb, 0x30, 0xe7, 0xd3, 0xb3,
+	0x90, 0xf4, 0xeb, 0xb9, 0xeb, 0xb5, 0x78, 0xa2, 0x23, 0x73, 0x96, 0x15, 0x3f, 0xe4, 0xa5, 0xe8,
+	0xd7, 0xe0, 0x5c, 0x24, 0x53, 0x51, 0x83, 0x33, 0xc4, 0x09, 0xae, 0xa1, 0x49, 0x9a, 0x0e, 0xc6,
+	0x1a, 0xcb, 0x37, 0xb8, 0x0b, 0xef, 0xe5, 0x64, 0x12, 0x6a, 0xcc, 0xce, 0xf3, 0x04, 0xfc, 0xe5,
+	0xf7, 0x21, 0xa7, 0x7c, 0x6f, 0x82, 0x53, 0xee, 0x82, 0xea, 0x94, 0x3b, 0xa5, 0x3a, 0xdf, 0x76,
+	0x98, 0xe7, 0x63, 0x6c, 0x14, 0x65, 0x06, 0x81, 0x2c, 0xef, 0x8b, 0xd8, 0x05, 0x4b, 0x89, 0x1f,
+	0xb2, 0x7f, 0xd7, 0x94, 0x80, 0xfd, 0x18, 0x48, 0x83, 0x3a, 0x08, 0xa5, 0xb5, 0x56, 0x82, 0xec,
+	0xda, 0x70, 0xad, 0xb1, 0xcd, 0x26, 0x5a, 0x34, 0x25, 0x9a, 0xf1, 0x23, 0x61, 0x6c, 0xd6, 0x31,
+	0x86, 0xcb, 0xf9, 0x30, 0x8c, 0x75, 0xd9, 0xf8, 0xdd, 0x0c, 0x9c, 0xd7, 0x89, 0xab, 0x56, 0xc4,
+	0xbc, 0x62, 0x45, 0x64, 0xc6, 0xc3, 0xd7, 0x74, 0xab, 0x16, 0xa3, 0x3c, 0x12, 0xb5, 0x62, 0x5d,
+	0x52, 0xed, 0x85, 0xd3, 0x71, 0x43, 0xe1, 0x05, 0xd5, 0xca, 0xc5, 0x95, 0x5f, 0xa1, 0x55, 0xeb,
+	0x36, 0x2c, 0x27, 0x75, 0x49, 0x51, 0x54, 0x49, 0x13, 0x14, 0xbf, 0x90, 0xad, 0xc1, 0x25, 0x91,
+	0x12, 0xd3, 0x75, 0x03, 0x3f, 0xf0, 0xac, 0x6e, 0xbd, 0xe9, 0xd9, 0xdd, 0x10, 0xcb, 0x80, 0x09,
+	0x56, 0xc2, 0x07, 0x8b, 0xd9, 0xf6, 0x19, 0x0c, 0xaf, 0x31, 0x7e, 0x33, 0x03, 0x86, 0xe6, 0x38,
+	0x4b, 0xd9, 0x44, 0xcd, 0x73, 0x9f, 0xd9, 0x2d, 0xc5, 0x9e, 0xfe, 0x86, 0x66, 0x9b, 0x61, 0x61,
+	0xe9, 0xd1, 0x98, 0x1d, 0x2e, 0xbc, 0xdd, 0x8e, 0xd8, 0x4b, 0xd8, 0xcd, 0x58, 0x2c, 0x27, 0xf5,
+	0x66, 0x2c, 0xec, 0x28, 0xff, 0x35, 0x03, 0x57, 0xfb, 0xf6, 0x81, 0x7f, 0xcf, 0x63, 0xc8, 0x47,
+	0xeb, 0xf8, 0x22, 0x2b, 0x2a, 0x8e, 0x74, 0x71, 0x0a, 0xfb, 0x77, 0x58, 0x60, 0x90, 0x70, 0x38,
+	0xed, 0x4a, 0xca, 0x31, 0x7a, 0x27, 0xef, 0x3d, 0xcd, 0x8a, 0xe5, 0x06, 0x56, 0xbb, 0x42, 0x35,
+	0x94, 0xa3, 0x61, 0x90, 0x57, 0x40, 0x4a, 0x1b, 0xd1, 0xe4, 0x5b, 0x0a, 0xb0, 0xf1, 0x03, 0x7a,
+	0x2c, 0x24, 0x77, 0x7a, 0x38, 0x4e, 0x5d, 0x81, 0xab, 0x11, 0x67, 0xae, 0x97, 0x20, 0x12, 0xb0,
+	0xf3, 0x7b, 0xcf, 0xc7, 0xde, 0x7d, 0xcf, 0xed, 0x75, 0xbf, 0x9d, 0x59, 0xff, 0xe3, 0x0c, 0xf3,
+	0xae, 0x57, 0x9b, 0xe5, 0x13, 0x5d, 0x01, 0x08, 0x4b, 0x13, 0x92, 0x9e, 0xd0, 0x8a, 0xfd, 0x3b,
+	0x4c, 0x27, 0x48, 0xcd, 0x9e, 0x07, 0x8c, 0x80, 0x82, 0xf6, 0xed, 0xce, 0xe4, 0x5d, 0xea, 0xc1,
+	0x25, 0x5b, 0x1f, 0x6e, 0xdc, 0xdf, 0x15, 0x0a, 0xda, 0x13, 0xe2, 0x1d, 0xc2, 0x02, 0xe1, 0x00,
+	0xa5, 0x5e, 0x70, 0xe8, 0x7a, 0x76, 0x20, 0xe2, 0x05, 0x51, 0x8d, 0x27, 0xbc, 0x61, 0x58, 0xdf,
+	0xff, 0xe5, 0x51, 0xf1, 0xbd, 0x93, 0x24, 0x1f, 0x17, 0x34, 0x77, 0x65, 0x92, 0x1c, 0x63, 0x09,
+	0x46, 0x2b, 0xe6, 0x26, 0x65, 0x89, 0xe6, 0xa6, 0x64, 0x89, 0xe6, 0xa6, 0xf1, 0x17, 0x23, 0x50,
+	0x64, 0xe9, 0xc8, 0xa8, 0xe3, 0x5f, 0xa8, 0x56, 0x55, 0x3c, 0x09, 0x87, 0xd5, 0x80, 0x46, 0xd2,
+	0x8d, 0x8d, 0x0c, 0x93, 0x6e, 0xec, 0xd7, 0x20, 0x45, 0xa7, 0x3e, 0x84, 0x9a, 0xf2, 0xf5, 0xe3,
+	0xa3, 0xe2, 0xd5, 0x50, 0x4d, 0xc9, 0x6a, 0x93, 0xf4, 0x95, 0x29, 0x4d, 0xc4, 0x15, 0xac, 0x63,
+	0x2f, 0xa1, 0x60, 0xbd, 0x0d, 0x93, 0x54, 0xdb, 0xb2, 0x51, 0xe3, 0xae, 0xf8, 0x74, 0x79, 0xd2,
+	0xbc, 0x87, 0x0d, 0x5b, 0xcd, 0x61, 0x2c, 0xc0, 0x8c, 0xdf, 0x1f, 0x81, 0xcb, 0xe9, 0x63, 0xce,
+	0xfb, 0xb6, 0x06, 0x10, 0xba, 0x1c, 0xf6, 0x73, 0x71, 0xa4, 0x7b, 0xe7, 0x39, 0x7e, 0x2c, 0x5d,
+	0x8c, 0x15, 0x3c, 0x22, 0x3a, 0x8b, 0x64, 0x1b, 0x11, 0x7b, 0xaf, 0x96, 0x83, 0x83, 0xa7, 0xd4,
+	0xe7, 0x45, 0x5a, 0x4a, 0x7d, 0x5e, 0x86, 0x1e, 0xc3, 0x52, 0xcd, 0xb3, 0x9f, 0x59, 0x01, 0x7e,
+	0x88, 0x5f, 0xb0, 0xe8, 0xcd, 0x2a, 0x0f, 0xd9, 0x64, 0x19, 0x54, 0x6e, 0x1c, 0x1f, 0x15, 0x5f,
+	0xeb, 0x32, 0x10, 0x9a, 0xce, 0x95, 0x85, 0xff, 0x37, 0xe2, 0x51, 0x9c, 0x69, 0x84, 0x8c, 0x7f,
+	0x91, 0x81, 0x15, 0xaa, 0x1f, 0xe0, 0x76, 0x21, 0xd1, 0xf8, 0x4b, 0x79, 0xba, 0xab, 0x1f, 0xc8,
+	0xd7, 0x22, 0xf5, 0x74, 0xd7, 0x92, 0x91, 0x98, 0x1a, 0x18, 0xda, 0x80, 0x1c, 0xff, 0x4d, 0xf7,
+	0xdf, 0x28, 0xd5, 0x4c, 0x2c, 0x46, 0xb3, 0x34, 0x31, 0x5d, 0x36, 0x5d, 0xd8, 0x9c, 0x18, 0x8d,
+	0xd9, 0x37, 0x55, 0x5c, 0xe3, 0x17, 0x23, 0x70, 0x61, 0x1f, 0x7b, 0xf6, 0x93, 0x17, 0x29, 0x1f,
+	0xb3, 0x03, 0x0b, 0xa2, 0x88, 0xa5, 0xe5, 0xd2, 0xb6, 0x18, 0x4b, 0xc2, 0x2d, 0xba, 0xca, 0xf3,
+	0x7a, 0x89, 0x1d, 0x97, 0x88, 0x78, 0x02, 0x1f, 0xf6, 0xb7, 0x21, 0x1b, 0x49, 0x0a, 0x48, 0xe7,
+	0x5f, 0xec, 0xd0, 0x70, 0xaa, 0xd6, 0xcf, 0x98, 0x12, 0x12, 0xfd, 0x2c, 0xdd, 0x96, 0xce, 0x75,
+	0xb3, 0x83, 0x0c, 0x34, 0x74, 0xc3, 0x92, 0xcd, 0x6a, 0x29, 0xb5, 0x09, 0x1b, 0x76, 0xfd, 0x8c,
+	0x99, 0xd6, 0x52, 0x39, 0x07, 0x53, 0x25, 0xea, 0x58, 0xe0, 0xe1, 0x96, 0xf1, 0x5f, 0x46, 0xe0,
+	0x92, 0x88, 0xc4, 0x4c, 0x19, 0xe6, 0xcf, 0x60, 0x49, 0x14, 0x95, 0xba, 0x44, 0x60, 0xc0, 0x2d,
+	0x7d, 0xa4, 0x59, 0x22, 0x7c, 0x31, 0xd2, 0x16, 0x87, 0x09, 0x07, 0x3b, 0x0d, 0xfd, 0x74, 0xcc,
+	0x33, 0x1f, 0x27, 0xa5, 0x68, 0xa4, 0x66, 0x12, 0x95, 0x67, 0x6a, 0x43, 0xa3, 0xf1, 0xcf, 0x56,
+	0xcc, 0xbc, 0x33, 0xf6, 0xaa, 0xe6, 0x9d, 0xf5, 0x33, 0x51, 0x03, 0x4f, 0x79, 0x16, 0xa6, 0xb7,
+	0xf1, 0xf3, 0x70, 0xdc, 0xff, 0xf7, 0x4c, 0x24, 0xdb, 0x0f, 0x91, 0x30, 0x58, 0xda, 0x9f, 0x4c,
+	0x98, 0xe9, 0x8e, 0x66, 0xfb, 0x51, 0x25, 0x0c, 0x06, 0xba, 0x01, 0x93, 0xcc, 0xdb, 0xa6, 0x35,
+	0x84, 0xaa, 0x51, 0x86, 0x54, 0xb2, 0x38, 0xf7, 0x16, 0xd3, 0x3a, 0x72, 0x7c, 0xe3, 0x21, 0x5c,
+	0xe1, 0x41, 0x37, 0xfa, 0xe4, 0xd3, 0x86, 0x4e, 0x78, 0x7c, 0x19, 0x16, 0x5c, 0xba, 0x8f, 0xa3,
+	0xac, 0x47, 0x0b, 0x39, 0xfd, 0x04, 0xe6, 0xb4, 0x72, 0x49, 0x91, 0x4a, 0xa5, 0x72, 0x0d, 0x49,
+	0xd2, 0x51, 0x68, 0xe3, 0x72, 0x52, 0x13, 0x6a, 0x67, 0x0d, 0x4c, 0x33, 0xda, 0x7b, 0x4a, 0xde,
+	0xd3, 0x13, 0x70, 0xbd, 0x1b, 0xca, 0xbe, 0x66, 0x1c, 0x8f, 0xe5, 0x24, 0x16, 0x27, 0xaf, 0xac,
+	0x35, 0x66, 0x34, 0x63, 0xa5, 0x31, 0x0b, 0xd3, 0xa2, 0xaa, 0x8d, 0x7d, 0xdf, 0xf8, 0xeb, 0x13,
+	0x60, 0xf0, 0x81, 0x4d, 0x72, 0x21, 0x12, 0xe3, 0xf1, 0x38, 0xd6, 0x59, 0x7e, 0x50, 0x9d, 0x53,
+	0x13, 0xb6, 0x87, 0xb5, 0x6c, 0xe5, 0x51, 0x39, 0x2f, 0x31, 0x07, 0xec, 0xfa, 0x19, 0x33, 0xf6,
+	0xf5, 0x5f, 0xa6, 0xb0, 0x49, 0xb6, 0xd9, 0xae, 0x1d, 0x1f, 0x15, 0xaf, 0xa4, 0xb0, 0x49, 0x8d,
+	0x6e, 0x32, 0xcb, 0x34, 0x75, 0x9b, 0xed, 0xe8, 0xcb, 0xd8, 0x6c, 0xc9, 0x8e, 0x54, 0xad, 0xb6,
+	0x7b, 0xfa, 0x58, 0xf2, 0xfd, 0x28, 0xdc, 0x8b, 0xd4, 0x2a, 0x9e, 0x74, 0x47, 0x29, 0xd1, 0xa8,
+	0x6a, 0x64, 0x90, 0x0d, 0x79, 0xc5, 0xa8, 0x52, 0x39, 0xc4, 0xcd, 0xa7, 0xdc, 0x98, 0x25, 0x3c,
+	0x4e, 0x92, 0x8c, 0x7a, 0xec, 0x51, 0x0d, 0xb6, 0xcf, 0x59, 0x45, 0xa3, 0x49, 0x50, 0xd5, 0xa4,
+	0x41, 0x51, 0xb2, 0xe8, 0x27, 0x30, 0x2f, 0xa7, 0x3a, 0xe2, 0x73, 0x9a, 0x5b, 0x7d, 0x2d, 0xcc,
+	0xf3, 0xde, 0x79, 0x62, 0xdd, 0x7c, 0x76, 0xe7, 0x66, 0x02, 0x2c, 0xcb, 0x45, 0xd3, 0x14, 0x15,
+	0x8a, 0xc3, 0xa9, 0x6a, 0x89, 0x4f, 0x40, 0x44, 0x9f, 0xc3, 0x42, 0xbd, 0xbe, 0xc3, 0xa2, 0xeb,
+	0x4c, 0xe1, 0x81, 0x64, 0x6e, 0x72, 0x0f, 0x54, 0x3a, 0xdd, 0xbe, 0xef, 0x36, 0x78, 0x54, 0x9e,
+	0xea, 0xb7, 0xa4, 0xaa, 0x66, 0x92, 0x48, 0xa0, 0x4f, 0x60, 0x9a, 0xe6, 0xec, 0x2b, 0xb5, 0x5a,
+	0x1e, 0x99, 0x98, 0x6c, 0x78, 0xd0, 0xb2, 0xf4, 0x7e, 0x16, 0xab, 0x50, 0xb3, 0xf7, 0xab, 0x08,
+	0xaa, 0x2f, 0xd0, 0xff, 0x2b, 0xa3, 0xcf, 0x88, 0x2c, 0x63, 0xb7, 0x31, 0x57, 0x68, 0x8a, 0x9d,
+	0x91, 0xe2, 0xc7, 0x90, 0xf9, 0x86, 0xfd, 0x18, 0xfe, 0xe1, 0x88, 0x88, 0xb9, 0x8b, 0xbb, 0x92,
+	0x9c, 0xd8, 0x9d, 0x21, 0xf1, 0x0b, 0x86, 0x3a, 0xe8, 0x13, 0x3b, 0x87, 0xca, 0xc2, 0x19, 0x44,
+	0x26, 0xf3, 0x9c, 0x95, 0x86, 0xd5, 0xb0, 0x42, 0xf3, 0x0f, 0xa1, 0x62, 0x95, 0x82, 0x15, 0xf5,
+	0x34, 0x18, 0x7d, 0x75, 0x4f, 0x83, 0x9f, 0xc2, 0xa2, 0x08, 0x76, 0xad, 0x60, 0x27, 0xc0, 0x9e,
+	0xf0, 0x49, 0x9a, 0x0d, 0x93, 0xa2, 0xd2, 0xf4, 0xb7, 0x79, 0x18, 0x2d, 0x99, 0xdb, 0x5c, 0x8b,
+	0x46, 0xfe, 0x44, 0x97, 0x75, 0x97, 0x5f, 0x16, 0xc5, 0xac, 0x39, 0xf8, 0x5e, 0x26, 0xdd, 0x65,
+	0x8a, 0x9a, 0x50, 0xbb, 0xa9, 0x16, 0x19, 0x15, 0x58, 0xd1, 0x9b, 0xaf, 0x61, 0xaf, 0x63, 0x53,
+	0xe1, 0xbd, 0x8e, 0x03, 0xd1, 0x68, 0x26, 0x6c, 0x14, 0xa9, 0x21, 0x26, 0xfc, 0x1e, 0xf9, 0xdf,
+	0x47, 0xa0, 0x98, 0xf8, 0x11, 0x25, 0xdf, 0xb7, 0x0f, 0x1c, 0x9a, 0x85, 0xe9, 0x02, 0x8c, 0x3d,
+	0xb4, 0x9d, 0x96, 0x7a, 0x13, 0x7d, 0x6a, 0x3b, 0x2d, 0x93, 0x96, 0x92, 0x4b, 0x4c, 0xbd, 0xf7,
+	0x98, 0x02, 0x28, 0x77, 0x6c, 0xbf, 0xf7, 0xb8, 0x41, 0x80, 0xd4, 0x4b, 0x0c, 0x07, 0x43, 0xd7,
+	0x60, 0x52, 0x64, 0xec, 0x1c, 0x0d, 0x35, 0x74, 0x22, 0x55, 0xa7, 0xa8, 0x43, 0x1f, 0x41, 0x76,
+	0x0b, 0x07, 0x56, 0xcb, 0x0a, 0x2c, 0xbe, 0x76, 0xc4, 0x73, 0x5e, 0xa2, 0xb8, 0x9c, 0xe7, 0x47,
+	0x7c, 0xb6, 0xc3, 0x4b, 0x4c, 0x89, 0x42, 0x07, 0xd0, 0xf6, 0xbb, 0x6d, 0xeb, 0x85, 0x74, 0xaf,
+	0x27, 0x03, 0x18, 0x16, 0xa1, 0x77, 0x75, 0xa7, 0xb2, 0xd0, 0x41, 0x20, 0x71, 0x40, 0x42, 0x97,
+	0xb3, 0x75, 0xea, 0xe8, 0x16, 0x0e, 0x35, 0xcf, 0xb6, 0x6b, 0x24, 0x62, 0x6b, 0x90, 0xa6, 0x8e,
+	0x68, 0xd4, 0x99, 0xd6, 0x65, 0xc3, 0xf1, 0x03, 0xb2, 0xd7, 0xbc, 0x53, 0x31, 0xc5, 0xf0, 0x44,
+	0xd3, 0x2a, 0xd1, 0x30, 0xd1, 0xb4, 0x2d, 0x4b, 0x23, 0x3a, 0x15, 0x09, 0xbe, 0x7f, 0xc7, 0x54,
+	0xa0, 0x86, 0x36, 0xc7, 0xfc, 0x63, 0x80, 0xb3, 0x35, 0xeb, 0xc0, 0x76, 0x88, 0x74, 0x65, 0x62,
+	0xdf, 0xed, 0x79, 0x4d, 0x8c, 0x4a, 0x30, 0xab, 0x47, 0xe7, 0x0c, 0x88, 0x3d, 0x22, 0x02, 0xa4,
+	0x5e, 0x86, 0x56, 0x61, 0x4a, 0x66, 0x34, 0xe1, 0x52, 0x5f, 0x42, 0xa6, 0x93, 0xf5, 0x33, 0x66,
+	0x08, 0x86, 0xde, 0xd7, 0x3c, 0x45, 0xe6, 0x64, 0x72, 0x1e, 0x0a, 0xbb, 0xca, 0xc2, 0x27, 0x1c,
+	0x2d, 0x41, 0x97, 0x74, 0x1e, 0xf9, 0x51, 0xcc, 0x79, 0x64, 0x5c, 0xeb, 0x71, 0x4c, 0x87, 0x4d,
+	0x85, 0xf6, 0xd4, 0xe7, 0x87, 0x12, 0xdc, 0x4a, 0xbe, 0x80, 0xdc, 0xc3, 0xde, 0x63, 0x2c, 0xdc,
+	0x64, 0x26, 0xb8, 0x20, 0x1b, 0x8d, 0x39, 0xe3, 0xf5, 0xfb, 0x77, 0x19, 0x43, 0x7a, 0xda, 0x7b,
+	0x8c, 0xe3, 0xef, 0x5a, 0x11, 0x09, 0x42, 0x21, 0x86, 0x0e, 0x21, 0x1f, 0x0d, 0x0f, 0xe3, 0xab,
+	0xb3, 0x4f, 0x50, 0x1b, 0xcd, 0x7b, 0xa7, 0xbc, 0x9e, 0xc5, 0x82, 0x56, 0xb4, 0x46, 0x62, 0x54,
+	0xd1, 0x4f, 0x61, 0x31, 0xd1, 0xba, 0x24, 0x03, 0xf4, 0xfb, 0x1b, 0xae, 0xe8, 0x71, 0x1c, 0x35,
+	0x94, 0x70, 0xe5, 0xac, 0xd6, 0x72, 0x72, 0x2b, 0xa8, 0x05, 0x73, 0x91, 0xb0, 0x27, 0xfe, 0xe4,
+	0x5f, 0x7a, 0x20, 0x15, 0x95, 0x20, 0x85, 0x9d, 0x31, 0xb1, 0xad, 0x28, 0x49, 0xb4, 0x09, 0x53,
+	0x52, 0x2f, 0xc7, 0x53, 0xd5, 0x26, 0xe9, 0x20, 0x0b, 0xc7, 0x47, 0xc5, 0x85, 0x50, 0x07, 0xa9,
+	0xd1, 0x0c, 0x09, 0xa0, 0xdf, 0xca, 0xc0, 0xb9, 0x64, 0x1d, 0x6d, 0x61, 0x9a, 0xd2, 0x1e, 0xa8,
+	0xc2, 0xa6, 0xb7, 0x60, 0x1a, 0x14, 0x6e, 0xb7, 0xc2, 0xe4, 0x09, 0x42, 0x97, 0xad, 0xb5, 0x9b,
+	0xd2, 0x12, 0xba, 0x0d, 0x70, 0x60, 0x07, 0x7c, 0x8e, 0x69, 0xd6, 0xd4, 0xf8, 0x06, 0x21, 0xdd,
+	0x3e, 0xb0, 0x03, 0x3e, 0xd3, 0x7f, 0x3b, 0x33, 0xf0, 0x88, 0xa0, 0xc9, 0x54, 0x73, 0xab, 0xd7,
+	0xfb, 0xf1, 0xcf, 0x10, 0xba, 0x7c, 0xfb, 0xf8, 0xa8, 0xf8, 0x96, 0xcc, 0xc8, 0xd9, 0xa4, 0x50,
+	0x22, 0x05, 0x44, 0xc3, 0x92, 0x70, 0xda, 0xf7, 0x0c, 0x3c, 0xa5, 0xde, 0x82, 0x09, 0xaa, 0x25,
+	0xf3, 0x0b, 0x33, 0xf4, 0x1e, 0x49, 0xf3, 0x48, 0x52, 0x5d, 0x9a, 0x2a, 0x96, 0x71, 0x18, 0xb4,
+	0x4e, 0xee, 0x63, 0x54, 0x72, 0x15, 0x3c, 0x97, 0x67, 0x9d, 0xe5, 0x77, 0x7a, 0x56, 0x25, 0x92,
+	0xb3, 0x69, 0xef, 0xbb, 0xe9, 0x68, 0x65, 0x80, 0xac, 0xc7, 0xd9, 0xdd, 0x83, 0xb1, 0xec, 0x58,
+	0x7e, 0x9c, 0xe5, 0xc8, 0x63, 0xfb, 0x52, 0x98, 0x5c, 0xaf, 0x48, 0xde, 0xb4, 0xe3, 0x25, 0x4f,
+	0x8c, 0xf1, 0xdb, 0x59, 0x66, 0xc4, 0xdb, 0x73, 0xec, 0x27, 0x76, 0xc8, 0x42, 0x55, 0x45, 0x7c,
+	0xf8, 0xc2, 0x2a, 0xbf, 0x26, 0xa7, 0xbc, 0xa5, 0x2a, 0x75, 0xf6, 0x23, 0x03, 0x75, 0xf6, 0x77,
+	0x15, 0x37, 0x1b, 0x25, 0xc5, 0xbe, 0xb4, 0xe2, 0xaa, 0x0a, 0x3d, 0xe9, 0x7f, 0xf3, 0x15, 0x4c,
+	0x30, 0x4b, 0x25, 0xf5, 0x6d, 0xca, 0xad, 0xde, 0x54, 0x2c, 0xb9, 0x29, 0xdd, 0x57, 0x4d, 0xb9,
+	0x7c, 0x6a, 0x68, 0x81, 0x36, 0x35, 0xcc, 0xc0, 0xbb, 0x0b, 0xf3, 0xb5, 0xb8, 0x11, 0x97, 0x6b,
+	0x48, 0xe9, 0xed, 0x20, 0xc9, 0xfe, 0xab, 0xca, 0xb7, 0x09, 0xe8, 0xa8, 0x0a, 0xb3, 0x75, 0xcd,
+	0xd8, 0xab, 0x3e, 0x42, 0x18, 0xb1, 0x0e, 0xab, 0xfe, 0xaa, 0x3a, 0x12, 0xfa, 0x01, 0x4c, 0xd4,
+	0x5d, 0x2f, 0x28, 0xbf, 0xe0, 0x6c, 0x55, 0x38, 0x82, 0xb0, 0xc2, 0xf2, 0x79, 0xf1, 0x10, 0xa3,
+	0xef, 0x7a, 0x41, 0xe3, 0xb1, 0x96, 0xc1, 0x94, 0x81, 0xa0, 0x17, 0xb0, 0x90, 0x64, 0x3e, 0xe6,
+	0x7c, 0xf3, 0xb4, 0x2c, 0xcc, 0x49, 0xf8, 0x68, 0x8b, 0xbe, 0x48, 0xc9, 0xbe, 0xa8, 0xe4, 0xb3,
+	0xb0, 0xa7, 0xa9, 0x30, 0x47, 0x6e, 0x8f, 0xb2, 0x45, 0x3a, 0x12, 0x96, 0x1f, 0x7d, 0xc6, 0xd4,
+	0x8c, 0xa1, 0xa2, 0x1a, 0x9c, 0xdd, 0xf3, 0x71, 0xcd, 0xc3, 0xcf, 0x6c, 0xfc, 0x5c, 0xd0, 0x83,
+	0x30, 0xa1, 0x28, 0xa1, 0xd7, 0x65, 0xb5, 0x49, 0x04, 0xe3, 0xc8, 0xe8, 0x7d, 0x80, 0x9a, 0xed,
+	0x38, 0xb8, 0x45, 0x5d, 0xa5, 0x72, 0x94, 0x14, 0xb5, 0xbe, 0x74, 0x69, 0x69, 0xc3, 0x75, 0xda,
+	0xea, 0x90, 0x2a, 0xc0, 0xa8, 0x0c, 0x33, 0x1b, 0x4e, 0xb3, 0xdd, 0xe3, 0xae, 0x8e, 0x3e, 0x65,
+	0xa9, 0x3c, 0xd1, 0xb1, 0xcd, 0x2a, 0x1a, 0x31, 0x6e, 0xa0, 0xa3, 0xa0, 0x87, 0x80, 0x78, 0x81,
+	0x19, 0x3e, 0xf1, 0xcc, 0xf9, 0x02, 0xbd, 0xec, 0x09, 0x42, 0x74, 0xb9, 0x6b, 0xf9, 0x83, 0x63,
+	0x68, 0xaf, 0x62, 0xce, 0xff, 0x5b, 0x19, 0xb8, 0x90, 0xbc, 0x97, 0xb8, 0x20, 0xb7, 0x03, 0x53,
+	0xb2, 0x50, 0x46, 0x25, 0x0b, 0x2d, 0x41, 0x44, 0x06, 0x63, 0x1b, 0x5a, 0xb0, 0x28, 0xf5, 0xeb,
+	0x43, 0x1a, 0x2f, 0x61, 0xba, 0xfb, 0x3f, 0xb3, 0xcc, 0x8b, 0x28, 0xc6, 0xa7, 0x3e, 0xa1, 0xb9,
+	0xf2, 0x68, 0x99, 0x62, 0x89, 0xe2, 0x4a, 0x69, 0x56, 0x1e, 0xcd, 0x53, 0xab, 0x21, 0xa0, 0x77,
+	0x54, 0xff, 0xce, 0x11, 0xe5, 0xc5, 0x4c, 0x51, 0xa8, 0x7e, 0x42, 0xe8, 0xf8, 0xf9, 0x86, 0xe6,
+	0x46, 0x38, 0x34, 0xd3, 0x1b, 0x1b, 0x96, 0xe9, 0xed, 0x49, 0xa6, 0xc7, 0x72, 0xb0, 0xbd, 0xae,
+	0x30, 0xbd, 0xd3, 0xe7, 0x76, 0x13, 0xa7, 0xcd, 0xed, 0x26, 0x5f, 0x8d, 0xdb, 0x65, 0x5f, 0x92,
+	0xdb, 0xdd, 0x83, 0xd9, 0x6d, 0x8c, 0x5b, 0x8a, 0x4d, 0x75, 0x2a, 0x3c, 0x66, 0x1d, 0x4c, 0xb5,
+	0xe5, 0x49, 0x86, 0xd5, 0x08, 0x56, 0x2a, 0xd7, 0x84, 0xbf, 0x1a, 0xae, 0x99, 0x3b, 0x65, 0xae,
+	0x39, 0xfd, 0x2a, 0x5c, 0x33, 0xc6, 0xfa, 0x66, 0x4e, 0xcc, 0xfa, 0x5e, 0x85, 0x5b, 0xfd, 0xb5,
+	0x11, 0x58, 0x22, 0x1b, 0xa0, 0xfd, 0x0c, 0xd7, 0xeb, 0xeb, 0xdc, 0xfd, 0x35, 0xf4, 0xc4, 0x3c,
+	0x74, 0x7d, 0x11, 0x41, 0x46, 0xff, 0x26, 0x65, 0x5d, 0xd7, 0x0b, 0x84, 0x1a, 0x82, 0xfc, 0x8d,
+	0xca, 0x11, 0xdf, 0xb0, 0x37, 0xc3, 0xbc, 0xa5, 0x49, 0x74, 0xbf, 0x6d, 0xc7, 0xb0, 0x57, 0x19,
+	0x9e, 0x0a, 0x14, 0xe2, 0x5f, 0xc1, 0xf9, 0xf8, 0xeb, 0xc0, 0xf3, 0x6c, 0xf0, 0x6b, 0x71, 0x54,
+	0x10, 0x37, 0x79, 0xb5, 0xf1, 0x31, 0x0d, 0x41, 0x91, 0x04, 0x7c, 0x65, 0x7c, 0xd7, 0x95, 0xf1,
+	0x5d, 0xe7, 0xe3, 0x5b, 0x53, 0xc6, 0x97, 0xfc, 0x6d, 0x94, 0x69, 0xe0, 0x89, 0x8a, 0x2f, 0x23,
+	0x59, 0x27, 0x79, 0xda, 0x0c, 0x7e, 0x8e, 0xc4, 0xba, 0x20, 0xea, 0x8d, 0x3f, 0xe5, 0xcf, 0x68,
+	0xfd, 0xcf, 0x78, 0x1c, 0xbd, 0x8a, 0xdf, 0xc6, 0xcf, 0xc2, 0x74, 0x60, 0x3c, 0x75, 0x99, 0x67,
+	0x35, 0x9f, 0x86, 0x8e, 0x33, 0x3f, 0x24, 0xbc, 0x54, 0xad, 0xe0, 0xb7, 0xa6, 0x25, 0x39, 0x52,
+	0x6a, 0xe5, 0xfe, 0x1d, 0xc1, 0x64, 0x79, 0x56, 0x34, 0x56, 0xac, 0x33, 0x59, 0x15, 0x81, 0xc6,
+	0x56, 0xcc, 0x19, 0x26, 0xcb, 0x66, 0x95, 0xd8, 0x83, 0x77, 0xe3, 0xf9, 0x98, 0xe8, 0x95, 0x33,
+	0xcc, 0xc7, 0xa4, 0x0e, 0x63, 0x98, 0x99, 0x69, 0x0f, 0x56, 0x4c, 0xdc, 0x71, 0x9f, 0xe1, 0xd3,
+	0x25, 0xfb, 0x25, 0x9c, 0xd7, 0x09, 0xb2, 0x48, 0x76, 0xf6, 0x68, 0xd7, 0xc7, 0xc9, 0x4f, 0x7d,
+	0x71, 0x04, 0xf6, 0xd4, 0x17, 0x7b, 0x55, 0x87, 0xfc, 0xa9, 0x9e, 0xcd, 0xb4, 0xce, 0x70, 0xe1,
+	0x82, 0x4e, 0xbc, 0xd4, 0x6a, 0xd5, 0x2c, 0x2f, 0xb0, 0x9b, 0x76, 0xd7, 0x72, 0x02, 0xb4, 0x03,
+	0x39, 0xe5, 0x67, 0x44, 0x21, 0xa4, 0xd4, 0x70, 0xb9, 0x31, 0x2c, 0xd0, 0x5e, 0x25, 0x08, 0x8b,
+	0x0d, 0x0c, 0xc5, 0xe8, 0xf0, 0x90, 0x21, 0x53, 0xdb, 0x2c, 0xc3, 0x8c, 0xf2, 0x53, 0x5a, 0x90,
+	0x28, 0x83, 0x55, 0x5a, 0xd0, 0x07, 0x4c, 0x47, 0x31, 0x9a, 0xb0, 0x9c, 0x34, 0x68, 0xec, 0xf9,
+	0x1a, 0x54, 0x0d, 0x73, 0xc5, 0x0e, 0x8e, 0xc2, 0x98, 0x4b, 0xcb, 0x13, 0x6b, 0xfc, 0x3f, 0x63,
+	0xb0, 0xc2, 0x27, 0xe3, 0x34, 0x67, 0x1c, 0xfd, 0x08, 0x72, 0xca, 0x1c, 0xf3, 0x41, 0xbf, 0x2c,
+	0xe2, 0xd0, 0xd3, 0xd6, 0x02, 0x53, 0x5c, 0xf5, 0x68, 0x41, 0x23, 0x32, 0xdd, 0xeb, 0x67, 0x4c,
+	0x95, 0x24, 0x6a, 0xc3, 0xac, 0x3e, 0xd1, 0x5c, 0x77, 0x77, 0x35, 0xb1, 0x11, 0x1d, 0x54, 0xbc,
+	0x6d, 0xd3, 0x6a, 0x24, 0x4e, 0xf7, 0xfa, 0x19, 0x33, 0x42, 0x1b, 0x7d, 0x0d, 0x67, 0x63, 0xb3,
+	0xcc, 0x75, 0xcc, 0xd7, 0x13, 0x1b, 0x8c, 0x41, 0x33, 0xeb, 0x98, 0x47, 0x8b, 0x53, 0x9b, 0x8d,
+	0x37, 0x82, 0x5a, 0x30, 0xad, 0x4e, 0x3c, 0x57, 0x2e, 0x5e, 0xe9, 0x33, 0x94, 0x0c, 0x90, 0x09,
+	0xd0, 0x7c, 0x2c, 0xe9, 0xdc, 0xbf, 0xd0, 0x2d, 0x7e, 0x1a, 0x70, 0x16, 0x26, 0xd8, 0x6f, 0xe3,
+	0x2f, 0x32, 0xb0, 0x52, 0xf3, 0xb0, 0x8f, 0x9d, 0x26, 0xd6, 0x22, 0xfa, 0x5e, 0x71, 0x45, 0xa4,
+	0x19, 0xdb, 0x46, 0x4e, 0xdf, 0xd8, 0x36, 0x7a, 0x42, 0x63, 0x9b, 0xf1, 0xcf, 0x33, 0x50, 0x48,
+	0xfa, 0xe6, 0x3a, 0x76, 0x5a, 0xa8, 0x06, 0xf9, 0xe8, 0x20, 0xf0, 0x2d, 0x67, 0xc8, 0xb7, 0x4d,
+	0x52, 0x87, 0x6b, 0xfd, 0x8c, 0x19, 0xc3, 0x46, 0xdb, 0x70, 0x56, 0x29, 0xe3, 0xc6, 0xae, 0x91,
+	0x61, 0x8c, 0x5d, 0x64, 0x89, 0xc4, 0x50, 0x55, 0x5b, 0xe1, 0x3a, 0x3d, 0xb6, 0x99, 0x7b, 0x30,
+	0xb9, 0xe9, 0x28, 0x51, 0x15, 0x10, 0x96, 0xf2, 0x79, 0x63, 0xd6, 0x2f, 0x5a, 0x2a, 0xa2, 0xa3,
+	0x25, 0x88, 0xf1, 0x7d, 0x7a, 0xbc, 0x70, 0x35, 0x31, 0xcb, 0x47, 0x23, 0x89, 0x5d, 0x86, 0xf1,
+	0xdd, 0xcd, 0x7a, 0xa5, 0xc4, 0xb3, 0xdb, 0xb0, 0x1c, 0x70, 0x6d, 0xbf, 0xd1, 0xb4, 0x4c, 0x56,
+	0x61, 0x7c, 0x08, 0xe8, 0x3e, 0x0e, 0xf8, 0xe3, 0x5a, 0x12, 0xef, 0x1a, 0x4c, 0xf2, 0x22, 0x8e,
+	0x49, 0xed, 0x38, 0xfc, 0xa9, 0x2e, 0x53, 0xd4, 0x19, 0x35, 0x71, 0x51, 0x6c, 0x63, 0x2d, 0x32,
+	0xe4, 0x3d, 0xc8, 0x7a, 0xbc, 0x8c, 0x0b, 0x0d, 0xb3, 0xf2, 0x5d, 0x48, 0x5a, 0xcc, 0xec, 0x8b,
+	0x02, 0xc6, 0x94, 0x7f, 0x19, 0x9b, 0x34, 0x5f, 0xe3, 0xce, 0xc6, 0x5a, 0x85, 0x8c, 0x2a, 0x1f,
+	0x2c, 0x31, 0x1d, 0xb7, 0x68, 0x40, 0x64, 0x80, 0xd5, 0xdc, 0x36, 0x74, 0x68, 0x28, 0x07, 0xe2,
+	0x59, 0x4a, 0x15, 0x10, 0xe3, 0xae, 0xcc, 0xfe, 0x98, 0x40, 0x2d, 0xed, 0x7d, 0xc3, 0x6d, 0x9a,
+	0xd7, 0xf2, 0x3e, 0x75, 0xad, 0x3c, 0x8d, 0x4e, 0xfc, 0x04, 0xce, 0x93, 0x41, 0x22, 0xdf, 0xc4,
+	0x5f, 0xec, 0x77, 0x4f, 0xc5, 0x1a, 0x84, 0xae, 0x80, 0xf6, 0xa2, 0x2c, 0xf3, 0xb8, 0x33, 0x73,
+	0xcf, 0x95, 0x77, 0x65, 0x7f, 0x9d, 0x45, 0x7a, 0x44, 0xdb, 0xe6, 0xd3, 0xf4, 0x2e, 0x40, 0x53,
+	0x96, 0xf2, 0x89, 0x12, 0x49, 0x4b, 0x35, 0x94, 0xfd, 0xbb, 0xa6, 0x02, 0x39, 0xb4, 0xe1, 0xc8,
+	0x82, 0x65, 0x26, 0x7d, 0x69, 0xc4, 0xc4, 0xa7, 0x57, 0x60, 0x4a, 0x96, 0x49, 0x0f, 0x91, 0xc4,
+	0xc6, 0x59, 0x02, 0x24, 0xd9, 0x01, 0x33, 0xc4, 0x23, 0x4d, 0x30, 0x76, 0xf8, 0x0d, 0x37, 0xe1,
+	0x63, 0x2f, 0xf8, 0x46, 0x9b, 0x08, 0x53, 0xbe, 0x9e, 0xa4, 0x09, 0x0d, 0x7e, 0x7f, 0x75, 0x98,
+	0x81, 0xfa, 0x86, 0x9b, 0x20, 0x03, 0xf5, 0xcd, 0x35, 0xf1, 0x37, 0x33, 0x6c, 0x33, 0x69, 0x18,
+	0xdf, 0xd2, 0x66, 0x42, 0xaf, 0xc1, 0xac, 0xe3, 0x36, 0x9e, 0xb8, 0xed, 0xb6, 0xfb, 0x9c, 0x1c,
+	0x77, 0xcc, 0x8b, 0x27, 0x6b, 0x4e, 0x3b, 0xee, 0x3d, 0x5a, 0xb8, 0xe7, 0xb5, 0xe5, 0x96, 0x8b,
+	0xf6, 0x70, 0x88, 0x2d, 0x17, 0x19, 0x86, 0x97, 0xda, 0x72, 0xbf, 0xce, 0x2c, 0x0d, 0x8c, 0x7b,
+	0x7d, 0xeb, 0xec, 0xe6, 0x7f, 0xe5, 0xda, 0xcd, 0x78, 0xf3, 0xf2, 0x60, 0x88, 0x7f, 0xbe, 0x30,
+	0xeb, 0x45, 0x90, 0x5e, 0x92, 0xe7, 0x60, 0x91, 0x3d, 0x39, 0x42, 0x4e, 0x8c, 0x40, 0x35, 0xbe,
+	0x0c, 0x53, 0x3b, 0xd0, 0x67, 0x21, 0x62, 0xb8, 0xc0, 0xb6, 0xd3, 0xb7, 0xd0, 0x0c, 0xd9, 0x52,
+	0xdf, 0x6c, 0x33, 0xff, 0x5f, 0x86, 0xe5, 0x72, 0xae, 0xef, 0xac, 0xd9, 0xd6, 0x81, 0xe3, 0xfa,
+	0x81, 0xdd, 0xa4, 0xcf, 0x43, 0x85, 0x2e, 0x8e, 0xca, 0x49, 0xa8, 0x78, 0x8c, 0x50, 0x17, 0x47,
+	0xab, 0x17, 0x1c, 0xca, 0xb7, 0x8e, 0xa8, 0xfb, 0x48, 0x14, 0x1a, 0xbd, 0x0f, 0x33, 0x4a, 0x91,
+	0xbc, 0x66, 0xb1, 0xf7, 0x2f, 0x55, 0x74, 0xbb, 0x65, 0xea, 0x90, 0xc6, 0x5f, 0x66, 0x60, 0xbe,
+	0xfe, 0xc2, 0x0f, 0x70, 0x87, 0xe6, 0xad, 0x17, 0xc9, 0xb4, 0xa8, 0xa6, 0x97, 0xaa, 0x2f, 0xe4,
+	0x21, 0xce, 0x5f, 0x22, 0xa7, 0x69, 0x19, 0x35, 0xe1, 0x56, 0x02, 0xd2, 0x97, 0xff, 0x04, 0x05,
+	0xd9, 0x0b, 0xf6, 0xf2, 0x9f, 0x28, 0xd6, 0x51, 0x55, 0x70, 0xe4, 0x03, 0x84, 0x3d, 0xe1, 0xc2,
+	0x6b, 0x9d, 0xdc, 0x45, 0x7d, 0x5a, 0x4a, 0x15, 0x7a, 0x21, 0xee, 0x2f, 0x8f, 0x8a, 0xef, 0x9e,
+	0x24, 0x40, 0x23, 0x24, 0x6d, 0x2a, 0xcd, 0x18, 0x3f, 0x1b, 0x81, 0x73, 0x09, 0xdf, 0x5f, 0xc7,
+	0xc1, 0x5f, 0xc5, 0x10, 0x3c, 0x83, 0x5c, 0xd8, 0x19, 0xa6, 0xd2, 0x9b, 0x2a, 0xef, 0xd2, 0x87,
+	0xea, 0xc2, 0x31, 0xf0, 0x4f, 0x65, 0x10, 0xd4, 0x86, 0x8c, 0x1b, 0x70, 0x7d, 0xc3, 0x79, 0x86,
+	0x9d, 0xc0, 0xf5, 0x5e, 0xf0, 0x75, 0x8b, 0x5b, 0xdc, 0xce, 0x4a, 0x75, 0x3d, 0xd2, 0x57, 0xf6,
+	0x37, 0x47, 0xa0, 0x38, 0x00, 0x14, 0xfd, 0xff, 0x19, 0xf6, 0xbe, 0xb0, 0x2c, 0xe1, 0xac, 0xe8,
+	0x7d, 0x61, 0xe5, 0xee, 0x8f, 0x7f, 0x53, 0xfb, 0xc5, 0x4c, 0x01, 0x1f, 0xfc, 0xd6, 0x9f, 0xbd,
+	0xf4, 0x97, 0xea, 0x7d, 0x59, 0xfe, 0x01, 0xa0, 0x78, 0x03, 0x83, 0x14, 0x93, 0x63, 0xaa, 0x62,
+	0x72, 0x1f, 0x16, 0xe4, 0x27, 0x28, 0x6f, 0x33, 0xd3, 0xcc, 0x0b, 0xda, 0x82, 0x51, 0xd6, 0x85,
+	0x01, 0xc0, 0x9f, 0x9c, 0xdd, 0x74, 0x0f, 0xf8, 0xcb, 0xb8, 0x23, 0x85, 0x8c, 0xa9, 0x94, 0x1a,
+	0xf7, 0x60, 0x31, 0x42, 0x97, 0xf3, 0xf5, 0xef, 0x82, 0x0c, 0x87, 0xa4, 0x84, 0x47, 0xcb, 0x67,
+	0x7f, 0x79, 0x54, 0x9c, 0x09, 0xec, 0x0e, 0xbe, 0x19, 0x3e, 0x02, 0x20, 0xfe, 0x32, 0xb6, 0xd4,
+	0x2b, 0x4b, 0xa9, 0xad, 0x66, 0xaa, 0x41, 0x77, 0x60, 0x82, 0x95, 0x44, 0x52, 0x6d, 0xab, 0xd0,
+	0xe5, 0xb1, 0x9f, 0x1f, 0x15, 0xcf, 0x98, 0x1c, 0xd0, 0x58, 0xa4, 0xe1, 0x59, 0xf4, 0x47, 0x29,
+	0x0c, 0xfd, 0x37, 0xf6, 0xd8, 0xd3, 0x33, 0x61, 0xb1, 0x4c, 0xe7, 0x3d, 0x56, 0x0a, 0x53, 0x19,
+	0x08, 0x03, 0x83, 0x80, 0x73, 0xdc, 0xe7, 0x6d, 0xdc, 0x62, 0xaf, 0x14, 0x96, 0xa7, 0xb9, 0x81,
+	0x61, 0xcc, 0x22, 0x04, 0x28, 0x9a, 0xf1, 0x09, 0x2c, 0x56, 0xda, 0xd8, 0xf2, 0xa2, 0xed, 0xd1,
+	0x07, 0x27, 0x48, 0x99, 0xee, 0x44, 0x69, 0x91, 0x22, 0xea, 0x44, 0xc9, 0x2b, 0xc9, 0x1d, 0x87,
+	0x31, 0x75, 0xf5, 0x93, 0xc2, 0xeb, 0xc5, 0x38, 0xfd, 0x1d, 0x09, 0xee, 0x49, 0xf8, 0x7a, 0x06,
+	0x67, 0x7c, 0x4c, 0xbd, 0xc7, 0xf9, 0x42, 0xb5, 0x5d, 0x27, 0xe4, 0xe0, 0xc3, 0x85, 0x9b, 0xfd,
+	0x2f, 0x70, 0xa1, 0xd4, 0xed, 0x62, 0xa7, 0x15, 0x22, 0xee, 0x7a, 0xd6, 0x90, 0xb1, 0xe4, 0xa8,
+	0x04, 0xe3, 0x14, 0x5a, 0x2a, 0x8e, 0x78, 0x77, 0x13, 0xba, 0x43, 0xe1, 0x78, 0x2e, 0x52, 0xda,
+	0x00, 0xc3, 0x34, 0x5a, 0xb0, 0x54, 0xef, 0x3d, 0xee, 0xd8, 0x01, 0x75, 0xbd, 0xa4, 0x99, 0x3d,
+	0x44, 0xdb, 0x1b, 0xe2, 0xb5, 0x30, 0x36, 0x18, 0x37, 0x42, 0x2f, 0x63, 0xea, 0xbd, 0xc9, 0xb3,
+	0x7d, 0x3c, 0xbb, 0x73, 0x33, 0x44, 0xa5, 0xa9, 0x3f, 0x58, 0x2b, 0xb4, 0x9a, 0xbf, 0x28, 0x66,
+	0xcc, 0xc3, 0x59, 0xf5, 0x9e, 0xcb, 0x56, 0xc8, 0x22, 0xcc, 0xeb, 0xf7, 0x57, 0x56, 0xfc, 0x15,
+	0x2c, 0x30, 0x19, 0x82, 0xe5, 0x25, 0x5f, 0x0d, 0xd3, 0x6c, 0x8f, 0xec, 0xaf, 0x46, 0xdc, 0xdc,
+	0xa8, 0x93, 0x87, 0x7c, 0x15, 0x63, 0x7f, 0x95, 0x45, 0x00, 0x3d, 0x5b, 0xd5, 0x54, 0x38, 0x23,
+	0xfb, 0xab, 0xe5, 0x49, 0x9e, 0x93, 0x95, 0x50, 0x67, 0xd3, 0xff, 0x8d, 0x50, 0x5f, 0xa5, 0x41,
+	0xa7, 0xeb, 0xd8, 0xa2, 0x0e, 0xe2, 0xc9, 0xa1, 0x7b, 0xb3, 0x30, 0x22, 0x93, 0x2e, 0x8e, 0xd8,
+	0x2d, 0xe3, 0x0f, 0x33, 0x70, 0x83, 0x49, 0x33, 0xc9, 0x78, 0xf4, 0x32, 0x9b, 0x82, 0x8c, 0xde,
+	0x83, 0x71, 0x5f, 0xd1, 0x0a, 0x1b, 0xbc, 0xe7, 0xfd, 0x28, 0x31, 0x04, 0x54, 0x82, 0x69, 0xd5,
+	0x8d, 0x79, 0xb8, 0x7c, 0x6e, 0x66, 0xae, 0xf3, 0xc4, 0x92, 0xae, 0xcd, 0x4f, 0x61, 0xa5, 0xfa,
+	0x35, 0x59, 0x10, 0xfc, 0x29, 0x67, 0x6e, 0xe5, 0x0b, 0x43, 0xc3, 0xe6, 0x76, 0xf9, 0x8a, 0x11,
+	0x6e, 0xa9, 0xac, 0xe3, 0xd1, 0x62, 0x64, 0xc0, 0x34, 0x27, 0xe1, 0x85, 0xfe, 0xae, 0xa6, 0x56,
+	0x66, 0xfc, 0x9b, 0x0c, 0x5c, 0x48, 0x6e, 0x8d, 0x33, 0x96, 0x0d, 0x38, 0x5b, 0xb1, 0x1c, 0xd7,
+	0xb1, 0x9b, 0x56, 0xbb, 0xde, 0x3c, 0xc4, 0xad, 0x9e, 0xcc, 0xdc, 0x2a, 0xb9, 0xcc, 0x01, 0x76,
+	0x04, 0xba, 0x00, 0x31, 0xe3, 0x58, 0xe8, 0x5d, 0x38, 0x47, 0x9d, 0xff, 0x18, 0xef, 0x6d, 0x63,
+	0x4f, 0xd2, 0x63, 0x3d, 0x4b, 0xa9, 0x45, 0xb7, 0x85, 0xb0, 0xd4, 0xda, 0x73, 0xec, 0x40, 0x22,
+	0x31, 0x2f, 0xe4, 0xa4, 0x2a, 0xe3, 0x4f, 0xf8, 0x95, 0x4a, 0x7f, 0xee, 0x32, 0x4c, 0x60, 0x2c,
+	0x72, 0xf0, 0x66, 0x34, 0x67, 0x46, 0x0d, 0x5a, 0x4f, 0xc6, 0x8b, 0xde, 0x82, 0xb1, 0xba, 0xb0,
+	0x52, 0xcd, 0x46, 0x9e, 0x46, 0xe6, 0x18, 0xa4, 0xde, 0xa4, 0x50, 0xe8, 0x12, 0xc0, 0x1a, 0xf6,
+	0x9b, 0xd8, 0xa1, 0x6f, 0x58, 0xb3, 0x4b, 0x85, 0x52, 0x12, 0xe6, 0x10, 0x1a, 0x4b, 0xcb, 0x21,
+	0x34, 0xae, 0xe7, 0x10, 0x32, 0x9e, 0xb1, 0x1b, 0x58, 0xf4, 0x83, 0xf8, 0x24, 0x7d, 0x1c, 0x7b,
+	0xf2, 0x5a, 0xbf, 0x85, 0x69, 0x95, 0xfb, 0x77, 0x63, 0xaf, 0x59, 0xa7, 0x27, 0x0c, 0xae, 0xc1,
+	0x6b, 0x1a, 0x6c, 0x89, 0xdc, 0x09, 0x71, 0xab, 0xe6, 0xb9, 0x1d, 0x37, 0xd0, 0x9e, 0xe6, 0xe1,
+	0x6f, 0xbe, 0x87, 0xe2, 0x30, 0x5f, 0x95, 0x91, 0x62, 0xe3, 0xd7, 0xe1, 0xda, 0x00, 0x8a, 0xfc,
+	0xa3, 0xea, 0x70, 0xd6, 0x8a, 0xd4, 0x09, 0x73, 0xc3, 0xb5, 0xa4, 0xef, 0x8a, 0x12, 0xf2, 0xcd,
+	0x38, 0xbe, 0xf1, 0xfb, 0x19, 0x36, 0x90, 0x3a, 0x13, 0x7a, 0x85, 0x84, 0xce, 0x97, 0x21, 0xc7,
+	0x97, 0x4a, 0x28, 0x3c, 0x9a, 0x6a, 0x11, 0x7a, 0x0d, 0x66, 0xb8, 0x69, 0xdf, 0x0d, 0xc2, 0xd8,
+	0x5b, 0x53, 0x2f, 0x34, 0x0e, 0xd9, 0x25, 0x37, 0xd6, 0x2f, 0xa9, 0x41, 0xd5, 0x1f, 0xc3, 0x48,
+	0x63, 0xa6, 0xe2, 0x19, 0x8c, 0x3e, 0x53, 0xfa, 0x25, 0x5c, 0x24, 0x2d, 0xc5, 0x5c, 0x77, 0x4f,
+	0xc5, 0x9b, 0xfb, 0xf7, 0x32, 0x70, 0x29, 0x8d, 0x3a, 0xff, 0x94, 0x87, 0x30, 0xaf, 0x78, 0xef,
+	0x72, 0x1f, 0x61, 0xf1, 0x5d, 0x7d, 0x1c, 0x8b, 0x4d, 0xf4, 0x34, 0x46, 0x74, 0xe8, 0x2b, 0xf4,
+	0x17, 0xec, 0x12, 0x9f, 0xf0, 0x74, 0xdc, 0xab, 0x7f, 0xf3, 0xd7, 0x6c, 0x40, 0xd3, 0x9f, 0xa5,
+	0xfb, 0xa6, 0x9e, 0x72, 0x7b, 0x73, 0x57, 0x7b, 0xf4, 0x1c, 0x15, 0x60, 0xa1, 0x66, 0xee, 0xac,
+	0xed, 0x55, 0x76, 0x1b, 0xbb, 0x9f, 0xd7, 0xaa, 0x8d, 0xbd, 0xed, 0x87, 0xdb, 0x3b, 0x8f, 0xb6,
+	0x59, 0xfe, 0x78, 0xad, 0x66, 0xb7, 0x5a, 0xda, 0xca, 0x67, 0xd0, 0x02, 0xe4, 0xb5, 0xe2, 0xea,
+	0x5e, 0x39, 0x3f, 0xf2, 0xe6, 0x57, 0xda, 0x63, 0xde, 0xe8, 0x02, 0x14, 0xea, 0x7b, 0xb5, 0xda,
+	0x8e, 0x29, 0xa9, 0xaa, 0xd9, 0xeb, 0x17, 0xe1, 0xac, 0x56, 0x7b, 0xcf, 0xac, 0x56, 0xf3, 0x19,
+	0xd2, 0x15, 0xad, 0xb8, 0x66, 0x56, 0xb7, 0x36, 0xf6, 0xb6, 0xf2, 0x23, 0x6f, 0x36, 0xd4, 0xe0,
+	0x18, 0xb4, 0x02, 0x4b, 0x6b, 0xd5, 0xfd, 0x8d, 0x4a, 0x35, 0x89, 0xf6, 0x02, 0xe4, 0xd5, 0xca,
+	0xdd, 0x9d, 0xdd, 0x1a, 0x23, 0xad, 0x96, 0x3e, 0xaa, 0x96, 0x4b, 0x7b, 0xbb, 0xeb, 0xdb, 0xf9,
+	0x51, 0x63, 0x2c, 0x3b, 0x92, 0x1f, 0x79, 0xf3, 0x47, 0x5a, 0xe4, 0x0c, 0xe9, 0x3e, 0x07, 0xdf,
+	0xab, 0x97, 0xee, 0xa7, 0x37, 0xc1, 0x6a, 0xb7, 0xee, 0x95, 0xf2, 0x19, 0x74, 0x11, 0xce, 0x6b,
+	0xa5, 0xb5, 0x52, 0xbd, 0xfe, 0x68, 0xc7, 0x5c, 0xdb, 0xac, 0xd6, 0xeb, 0xf9, 0x91, 0x37, 0xf7,
+	0xb5, 0xec, 0x80, 0xa4, 0x85, 0xad, 0x7b, 0xa5, 0x86, 0x59, 0xfd, 0x74, 0x6f, 0xc3, 0xac, 0xae,
+	0xc5, 0x5b, 0xd0, 0x6a, 0x3f, 0xaf, 0xd6, 0xf3, 0x19, 0x34, 0x0f, 0x73, 0x5a, 0xe9, 0xf6, 0x4e,
+	0x7e, 0xe4, 0xcd, 0xeb, 0x3c, 0x51, 0x1c, 0x9a, 0x05, 0x58, 0xab, 0xd6, 0x2b, 0xd5, 0xed, 0xb5,
+	0x8d, 0xed, 0xfb, 0xf9, 0x33, 0x68, 0x06, 0xa6, 0x4a, 0xf2, 0x67, 0xe6, 0xcd, 0xb2, 0x78, 0x51,
+	0x59, 0x39, 0x79, 0x50, 0x0e, 0x26, 0xd7, 0xaa, 0xf7, 0x4a, 0x7b, 0x9b, 0xbb, 0xf9, 0x33, 0xe4,
+	0x47, 0xc5, 0xac, 0x96, 0x76, 0xab, 0x6b, 0xf9, 0x0c, 0x9a, 0x82, 0xf1, 0xfa, 0x6e, 0x69, 0xb7,
+	0x9a, 0x1f, 0x41, 0x59, 0x18, 0xdb, 0xab, 0x57, 0xcd, 0xfc, 0xe8, 0xea, 0xdf, 0xff, 0xbb, 0x19,
+	0xc8, 0x11, 0x61, 0x44, 0x38, 0x8f, 0x7f, 0x05, 0xe7, 0xd4, 0x2b, 0x22, 0x39, 0x84, 0xf9, 0xf3,
+	0xb1, 0x17, 0x45, 0x8c, 0x63, 0xd7, 0xa7, 0x05, 0x12, 0x8c, 0xca, 0xa5, 0xcb, 0x45, 0x11, 0x94,
+	0xe4, 0x3e, 0x77, 0x92, 0x00, 0x6e, 0x64, 0x6e, 0x67, 0x90, 0x49, 0x4d, 0x32, 0xb2, 0x82, 0x3f,
+	0x79, 0x7b, 0x31, 0x7a, 0x37, 0x65, 0xe5, 0xfc, 0xb3, 0x96, 0x53, 0xaa, 0xeb, 0xbd, 0x4e, 0xc7,
+	0xf2, 0x5e, 0xa0, 0x5f, 0x03, 0x43, 0xa5, 0x99, 0x72, 0x2f, 0xfe, 0xee, 0x70, 0xf7, 0x5f, 0xd1,
+	0xe6, 0xf5, 0xe1, 0xc0, 0xd1, 0x03, 0x98, 0x21, 0xb7, 0x45, 0x09, 0x86, 0x56, 0xa2, 0x88, 0xca,
+	0x25, 0x75, 0xf9, 0x42, 0x72, 0xa5, 0x7c, 0xe1, 0x69, 0x9a, 0x7e, 0x88, 0x1f, 0x58, 0x4e, 0x13,
+	0xfb, 0x68, 0x51, 0x0d, 0x72, 0x71, 0x9a, 0xfc, 0x61, 0x80, 0xe5, 0xb3, 0x91, 0xe2, 0xfd, 0x3b,
+	0xb7, 0x33, 0xa8, 0x4e, 0xb3, 0xf1, 0x69, 0xd7, 0x4e, 0x24, 0xa2, 0x19, 0xe2, 0xf7, 0x51, 0xd6,
+	0x9b, 0xa2, 0x7c, 0x8f, 0x35, 0xe5, 0xbe, 0xba, 0x0d, 0x28, 0x7e, 0x9b, 0x43, 0x97, 0xc3, 0x75,
+	0x90, 0x7c, 0xd1, 0x5b, 0x3e, 0x17, 0x73, 0x03, 0xa8, 0x12, 0x79, 0x1e, 0x55, 0x61, 0x96, 0x07,
+	0xd9, 0xf2, 0xfb, 0x25, 0xea, 0x77, 0x43, 0x4d, 0x25, 0x73, 0x9f, 0x8e, 0x93, 0xbc, 0xa3, 0xa2,
+	0xe5, 0xf0, 0x3b, 0xa2, 0x17, 0xd7, 0xe5, 0x95, 0xc4, 0x3a, 0xfe, 0x7d, 0xf7, 0x60, 0x56, 0xbf,
+	0xee, 0x22, 0x31, 0x41, 0x89, 0xb7, 0xe0, 0xd4, 0x0e, 0x35, 0x60, 0x69, 0xcb, 0xb2, 0x9d, 0xc0,
+	0xb2, 0x1d, 0xce, 0xc6, 0x85, 0x35, 0x16, 0x15, 0xfb, 0x98, 0x67, 0xeb, 0xd8, 0x69, 0xc9, 0x49,
+	0x48, 0x7b, 0xbd, 0x80, 0x6e, 0x9b, 0xba, 0xb8, 0xb5, 0xe9, 0xa6, 0x76, 0x64, 0xe8, 0x6f, 0x6c,
+	0x27, 0x79, 0x4f, 0x2c, 0xa7, 0x39, 0xfc, 0xa0, 0x2d, 0x7a, 0x6d, 0x8c, 0x50, 0x54, 0xd6, 0xc4,
+	0x89, 0xc9, 0x15, 0x68, 0xa8, 0x77, 0x60, 0x47, 0x3d, 0x77, 0x7c, 0x94, 0x32, 0x70, 0xa9, 0xc4,
+	0x6e, 0x67, 0xd0, 0x57, 0x74, 0x57, 0x27, 0x92, 0x7b, 0x64, 0x07, 0x87, 0x5c, 0x1e, 0x5f, 0x49,
+	0x24, 0xc0, 0x37, 0x4a, 0x1f, 0xea, 0x26, 0x2c, 0x24, 0xf9, 0x18, 0xc9, 0x01, 0xed, 0xe3, 0x80,
+	0x94, 0xba, 0x0a, 0x4c, 0x72, 0xf9, 0x6d, 0xa5, 0x4f, 0x52, 0x1f, 0x17, 0x97, 0x54, 0x9a, 0xdf,
+	0x87, 0x59, 0xb2, 0x4a, 0x1e, 0x62, 0xdc, 0x2d, 0xb5, 0xed, 0x67, 0xd8, 0x47, 0x22, 0xc5, 0xb2,
+	0x2c, 0x4a, 0xc3, 0xbd, 0x91, 0x41, 0xdf, 0x81, 0xdc, 0x23, 0x2b, 0x68, 0x1e, 0xf2, 0x94, 0xa2,
+	0x22, 0xe3, 0x28, 0x2d, 0x5b, 0x16, 0xbf, 0x68, 0xe5, 0xed, 0x0c, 0xfa, 0x08, 0x26, 0xef, 0xe3,
+	0x80, 0x46, 0x93, 0x5d, 0x91, 0x16, 0x6d, 0xe6, 0xda, 0xb6, 0xe1, 0x48, 0x87, 0x65, 0xd1, 0xe1,
+	0xa8, 0xc3, 0x1d, 0xba, 0x05, 0xc0, 0x18, 0x02, 0xa5, 0x10, 0xad, 0x5e, 0x8e, 0x75, 0x1b, 0xdd,
+	0x27, 0x02, 0x40, 0x1b, 0x07, 0x78, 0xd8, 0x26, 0xd3, 0xc6, 0x68, 0x13, 0x66, 0xe5, 0xa3, 0x52,
+	0xdb, 0x34, 0xe1, 0x82, 0x11, 0x21, 0xe6, 0x9f, 0x80, 0xda, 0x07, 0x64, 0x57, 0xb0, 0x17, 0xa1,
+	0x69, 0x64, 0x3e, 0xe5, 0xa4, 0x4b, 0x6a, 0x78, 0xbf, 0xca, 0x42, 0xc5, 0x20, 0x32, 0x30, 0x05,
+	0x77, 0xdd, 0xf5, 0x03, 0x1d, 0x57, 0x96, 0x24, 0xe3, 0xfe, 0x2a, 0x2c, 0xab, 0xed, 0xea, 0xb9,
+	0xae, 0x43, 0x9e, 0x9b, 0x96, 0x42, 0x7b, 0xf9, 0x4a, 0x1f, 0x08, 0xae, 0x51, 0x18, 0xfd, 0xed,
+	0x91, 0x0c, 0x65, 0x27, 0x6b, 0x30, 0x2f, 0xda, 0xda, 0xe9, 0x62, 0xa7, 0x5e, 0x5f, 0xa7, 0x0f,
+	0x02, 0x9d, 0x17, 0x19, 0x69, 0xc3, 0x32, 0x41, 0x1d, 0xc5, 0xab, 0xc8, 0xd1, 0xa7, 0x45, 0xe0,
+	0xa3, 0x7e, 0x71, 0xf9, 0xe1, 0xd1, 0x97, 0x98, 0x84, 0xf9, 0x21, 0x53, 0x73, 0x6a, 0xd7, 0xd1,
+	0xfd, 0x55, 0xd4, 0xe7, 0x4a, 0xbe, 0x9c, 0x72, 0xa9, 0xbd, 0x9d, 0x41, 0x9f, 0x03, 0x8a, 0x5f,
+	0x92, 0xe5, 0x10, 0xa6, 0x2a, 0x04, 0xe4, 0x10, 0xf6, 0xb9, 0x61, 0xdf, 0x87, 0x45, 0x99, 0x7f,
+	0x43, 0x69, 0x75, 0x15, 0xa5, 0xf4, 0x26, 0xad, 0x97, 0xe8, 0x13, 0x98, 0xe7, 0x8b, 0x56, 0xad,
+	0x40, 0x79, 0xc9, 0x7f, 0xf8, 0x3d, 0x39, 0x75, 0x9d, 0x3e, 0x80, 0xc5, 0x7a, 0x64, 0xc4, 0x98,
+	0x4f, 0xda, 0x79, 0x9d, 0x04, 0x2d, 0xac, 0xe3, 0x80, 0x0d, 0x59, 0x32, 0xad, 0x87, 0x80, 0x98,
+	0x9a, 0x52, 0x90, 0x7b, 0x66, 0xe3, 0xe7, 0xe8, 0x62, 0xa4, 0xeb, 0xa4, 0x90, 0x82, 0x51, 0x06,
+	0x96, 0xfa, 0x65, 0xbb, 0xec, 0x3d, 0x73, 0x5a, 0x5a, 0xb1, 0xba, 0xd6, 0x63, 0xbb, 0x6d, 0x07,
+	0x36, 0x26, 0x13, 0xa0, 0x22, 0xa8, 0x55, 0x62, 0x02, 0xce, 0xa7, 0x42, 0xa0, 0x27, 0xd4, 0x8a,
+	0xc7, 0x92, 0xe0, 0x26, 0x54, 0x5f, 0x97, 0x3b, 0x3e, 0x19, 0x20, 0x14, 0x79, 0xfa, 0xc3, 0xa1,
+	0xdf, 0xa0, 0xf9, 0x59, 0xfb, 0x2b, 0x14, 0xd0, 0x77, 0x92, 0xf4, 0x3e, 0x29, 0x2a, 0x91, 0xe5,
+	0xb7, 0x86, 0x03, 0x96, 0x2a, 0x9c, 0x99, 0xfb, 0x38, 0xa8, 0xb5, 0x7b, 0x07, 0x36, 0x7d, 0x51,
+	0x17, 0xc9, 0x1b, 0xbe, 0x2c, 0xe2, 0xeb, 0x5f, 0xe4, 0xb5, 0x0a, 0x2b, 0xea, 0xf8, 0xc7, 0x68,
+	0x03, 0xf2, 0xec, 0x9c, 0x51, 0x48, 0x5c, 0x8c, 0x91, 0xe0, 0x20, 0x96, 0x67, 0x75, 0xfc, 0xd4,
+	0x55, 0x71, 0x0b, 0xc6, 0x88, 0x78, 0x8a, 0xc4, 0xde, 0x57, 0x05, 0xd9, 0x79, 0xad, 0x4c, 0xbe,
+	0x8a, 0xb0, 0x48, 0xe7, 0xc8, 0xc7, 0x81, 0xc8, 0xe4, 0xc1, 0xcc, 0xeb, 0x57, 0x43, 0xa1, 0x22,
+	0x5e, 0x1b, 0xb2, 0x98, 0x48, 0xd6, 0xa9, 0xfd, 0xbb, 0x48, 0xbe, 0x31, 0x9d, 0x40, 0xf4, 0xba,
+	0x26, 0xfb, 0x9c, 0x8c, 0xee, 0x13, 0xf6, 0x68, 0x7d, 0x1c, 0xc9, 0x47, 0xaf, 0xe9, 0x01, 0x32,
+	0x29, 0x44, 0xaf, 0x0d, 0x80, 0x92, 0x2f, 0x37, 0x4c, 0xf2, 0xe4, 0x7a, 0x68, 0x31, 0x1c, 0x03,
+	0xf2, 0x5b, 0x10, 0x9a, 0x51, 0x7a, 0xb7, 0xbf, 0x4a, 0x59, 0x34, 0x39, 0xf4, 0x89, 0x48, 0xde,
+	0xf3, 0x3c, 0xec, 0x30, 0xe4, 0x34, 0xf9, 0x29, 0x09, 0xfb, 0x63, 0xca, 0x4a, 0x15, 0x6c, 0xa6,
+	0x7e, 0x1a, 0x44, 0x82, 0xbd, 0xbb, 0x75, 0x3b, 0x83, 0xde, 0x83, 0x2c, 0xef, 0x23, 0x41, 0xd2,
+	0x3a, 0xed, 0xf7, 0xe9, 0x35, 0xc5, 0x04, 0x36, 0x19, 0xb4, 0xcf, 0x3a, 0x4c, 0xda, 0x2a, 0x63,
+	0x7d, 0x7e, 0x8f, 0x08, 0x0f, 0xad, 0x97, 0xc1, 0xac, 0x08, 0x29, 0x82, 0x62, 0x16, 0x64, 0x62,
+	0x0c, 0x51, 0x34, 0xe0, 0xb8, 0x67, 0x44, 0xc8, 0x3d, 0x80, 0xa6, 0xa7, 0x93, 0x59, 0xa6, 0xe4,
+	0x3d, 0x40, 0x2b, 0x1e, 0x24, 0x3b, 0x6c, 0x40, 0xbe, 0xd4, 0xa4, 0x27, 0x5b, 0x1d, 0x77, 0xac,
+	0xee, 0xa1, 0xeb, 0x61, 0x79, 0x09, 0x8b, 0x56, 0x08, 0x5a, 0x8b, 0x52, 0x52, 0xe2, 0x15, 0x9b,
+	0xd8, 0xa2, 0x29, 0xa0, 0x97, 0xa4, 0xa8, 0x14, 0xa9, 0x4a, 0xc6, 0xe8, 0x73, 0xe9, 0x5a, 0xa8,
+	0x90, 0x6b, 0x62, 0xfb, 0xd5, 0xc8, 0x7c, 0x40, 0x19, 0x93, 0x04, 0xf6, 0xe5, 0x89, 0x27, 0x8b,
+	0xe4, 0xf5, 0x54, 0x78, 0x05, 0x4b, 0xd0, 0x2d, 0x98, 0xa5, 0x9a, 0xb1, 0xb0, 0xe4, 0x82, 0xb2,
+	0x7f, 0xc2, 0xe2, 0xe8, 0x85, 0x3f, 0x5a, 0x2b, 0x53, 0xf5, 0xce, 0xf1, 0xd4, 0xa1, 0x72, 0x94,
+	0xd3, 0x3a, 0x93, 0xf6, 0x35, 0xdf, 0x83, 0xd9, 0x2a, 0x39, 0xef, 0x7a, 0x2d, 0x9b, 0xbd, 0xd3,
+	0x80, 0xf4, 0x04, 0xfb, 0xa9, 0x88, 0xeb, 0xe2, 0xe5, 0x3c, 0x8a, 0xca, 0x35, 0x23, 0xe2, 0xc8,
+	0x55, 0xca, 0xc4, 0xa7, 0x2c, 0x08, 0xb2, 0xfc, 0xa9, 0x0c, 0xaa, 0xb9, 0xe0, 0xaa, 0x90, 0x25,
+	0x26, 0x30, 0x97, 0xc2, 0x04, 0xe8, 0x3c, 0x76, 0xfd, 0x9a, 0x76, 0xc3, 0x8e, 0xd5, 0x0b, 0xda,
+	0x71, 0x99, 0xfa, 0x33, 0xe5, 0xe5, 0xee, 0x14, 0x9a, 0x29, 0xf5, 0x83, 0x96, 0xb6, 0xcc, 0x6d,
+	0x5c, 0x6a, 0xb7, 0x63, 0xc8, 0x3e, 0x7a, 0x43, 0xa7, 0x9e, 0x04, 0x33, 0xa8, 0x05, 0xaa, 0xc1,
+	0x60, 0x42, 0x69, 0xa9, 0xdb, 0x65, 0x3c, 0xfe, 0x92, 0xe4, 0x3f, 0x7a, 0x45, 0x5c, 0x83, 0x11,
+	0xad, 0xe7, 0x4b, 0xe5, 0x01, 0x5d, 0xb5, 0xe1, 0xf3, 0xde, 0x48, 0xd5, 0x07, 0x44, 0x5f, 0x37,
+	0x97, 0x32, 0x6a, 0xa4, 0x52, 0x1e, 0x6f, 0x22, 0x4f, 0xbe, 0xd0, 0xec, 0x22, 0x75, 0xa1, 0xc6,
+	0xdf, 0x10, 0x5f, 0xbe, 0x94, 0x56, 0x2d, 0x4d, 0x1b, 0x79, 0xbe, 0x98, 0xc2, 0x0e, 0x5e, 0xd2,
+	0x8e, 0xb5, 0x78, 0x1f, 0x8b, 0xa9, 0xf5, 0xf2, 0x93, 0xf3, 0xd1, 0xd7, 0xdb, 0x25, 0xd1, 0x94,
+	0x67, 0xdd, 0x53, 0xe7, 0xe4, 0x1e, 0x2c, 0xa8, 0x33, 0x2a, 0xbf, 0x3b, 0xed, 0x30, 0x49, 0xa3,
+	0xb3, 0x0b, 0x8b, 0x89, 0x8f, 0xad, 0x4b, 0xc9, 0xa0, 0xdf, 0x53, 0xec, 0xa9, 0x54, 0x31, 0x9c,
+	0xe3, 0x8a, 0x8f, 0x88, 0xca, 0x5d, 0x1e, 0xe2, 0xc9, 0xd5, 0xd1, 0x43, 0x3c, 0x0d, 0x8a, 0x0f,
+	0xe8, 0x57, 0xf4, 0x40, 0x8d, 0xb5, 0x71, 0x45, 0xd1, 0x94, 0xa4, 0x34, 0x60, 0xf4, 0x03, 0x91,
+	0x6b, 0x60, 0x21, 0xa1, 0x3a, 0x7d, 0x88, 0xaf, 0xa6, 0xd3, 0x54, 0xf3, 0x4d, 0x2f, 0x26, 0x9a,
+	0x22, 0xe4, 0x78, 0xf7, 0x33, 0x82, 0x2c, 0xbf, 0xd6, 0x1f, 0x88, 0xb7, 0xb1, 0x2f, 0x72, 0x00,
+	0xa7, 0x8e, 0x7e, 0xdf, 0xb7, 0xff, 0xfb, 0x5c, 0xe7, 0x97, 0xe5, 0x9a, 0x1b, 0x7e, 0x58, 0xd2,
+	0xa8, 0xb5, 0xa4, 0xe6, 0x4c, 0x7b, 0x98, 0x3f, 0xaa, 0x39, 0xd3, 0x2a, 0x45, 0x0f, 0xaf, 0xf6,
+	0x85, 0x51, 0x2e, 0xd5, 0xe8, 0x4b, 0xa6, 0x4a, 0xd3, 0x9b, 0x50, 0x55, 0x69, 0x89, 0xf4, 0x2f,
+	0xa7, 0x03, 0xa8, 0xc4, 0x2d, 0xe6, 0xc9, 0xa1, 0x83, 0xf8, 0x48, 0xbd, 0xad, 0x46, 0xea, 0xa2,
+	0xeb, 0x2f, 0x11, 0x44, 0x6d, 0xe2, 0x91, 0xd8, 0xe7, 0x29, 0xa3, 0x94, 0x54, 0x39, 0x94, 0x64,
+	0xb5, 0x03, 0x85, 0x70, 0x32, 0x23, 0x1f, 0x70, 0xc2, 0xa9, 0x14, 0x83, 0x71, 0x3e, 0xe4, 0x15,
+	0x51, 0x8a, 0xaf, 0xc7, 0xb8, 0x49, 0xca, 0xc0, 0xf4, 0x6d, 0x82, 0x9d, 0x19, 0x4a, 0x4e, 0xe1,
+	0x95, 0x50, 0x8f, 0x1e, 0x96, 0x26, 0x9c, 0x19, 0x6a, 0x25, 0xdf, 0x24, 0x9b, 0x54, 0x94, 0x0f,
+	0x2b, 0xd2, 0xbf, 0xfa, 0x62, 0x12, 0x9d, 0xc8, 0x34, 0x95, 0xe1, 0x2c, 0x13, 0x23, 0x86, 0x21,
+	0x98, 0x64, 0x5b, 0xbc, 0x9d, 0x09, 0x8f, 0x07, 0xe5, 0x03, 0x85, 0x8c, 0x1a, 0xad, 0x38, 0xc9,
+	0xf1, 0x30, 0x4c, 0x97, 0xd2, 0xe8, 0xac, 0x41, 0x8e, 0x7d, 0x36, 0x3b, 0xf5, 0xcf, 0x6b, 0xe3,
+	0xad, 0x1d, 0xf8, 0xcb, 0xda, 0x28, 0xe9, 0x67, 0x7d, 0x85, 0x9a, 0x05, 0x44, 0x71, 0x7a, 0x2f,
+	0x56, 0xe2, 0x34, 0x7c, 0x55, 0x60, 0xa0, 0x6f, 0x52, 0x48, 0x2a, 0x2b, 0xea, 0x7b, 0x1f, 0x21,
+	0xb8, 0x3e, 0xf9, 0x91, 0xca, 0xd0, 0xbc, 0x20, 0x47, 0x94, 0x7d, 0xd9, 0x85, 0xe8, 0x40, 0x6b,
+	0x1f, 0x97, 0x3e, 0x3c, 0x48, 0x1d, 0xe6, 0x01, 0x9f, 0x97, 0x7e, 0x0f, 0x98, 0xe7, 0x6f, 0x37,
+	0x53, 0xdd, 0x87, 0xc8, 0xbd, 0x75, 0x4e, 0xd3, 0x88, 0x48, 0x2b, 0x7b, 0x2a, 0x99, 0x1a, 0x9c,
+	0x63, 0x62, 0x69, 0x2c, 0xb7, 0xd6, 0x6b, 0x9a, 0xd4, 0x1a, 0xad, 0x4e, 0x17, 0x5a, 0xe5, 0x41,
+	0x92, 0x4a, 0x31, 0xb9, 0x7a, 0xd0, 0xb0, 0xfd, 0x50, 0x39, 0x48, 0xa2, 0xb8, 0x3e, 0xba, 0x11,
+	0x95, 0x58, 0x63, 0x20, 0x83, 0x0f, 0x2a, 0xee, 0xec, 0x16, 0x49, 0xfd, 0x66, 0x68, 0xe3, 0xa0,
+	0x57, 0xa6, 0x8f, 0x82, 0x29, 0xf6, 0x52, 0x0a, 0xb5, 0xa4, 0xca, 0x41, 0x3d, 0xfc, 0x42, 0xe1,
+	0xbe, 0x3a, 0xa6, 0x2f, 0xd5, 0x27, 0x69, 0x00, 0x83, 0x68, 0x6f, 0xc3, 0x62, 0xfc, 0x03, 0xed,
+	0x26, 0x96, 0x22, 0x46, 0x62, 0x6d, 0xfa, 0xf7, 0xdf, 0x17, 0x22, 0x62, 0x94, 0xde, 0xb9, 0x88,
+	0x32, 0x7f, 0x50, 0xc7, 0xbe, 0x12, 0x27, 0x44, 0xe4, 0x9b, 0xec, 0x26, 0x8e, 0x9e, 0x10, 0x09,
+	0x10, 0x83, 0xa8, 0xaf, 0xc3, 0x5c, 0xdd, 0x3e, 0x70, 0xe4, 0x73, 0xfb, 0x75, 0x53, 0xde, 0xfe,
+	0x94, 0xb2, 0x28, 0xbb, 0xd2, 0xaa, 0x64, 0xfa, 0x81, 0x05, 0x71, 0x6d, 0x51, 0x1f, 0xef, 0x47,
+	0x31, 0x1c, 0x45, 0x0d, 0xbf, 0x92, 0x58, 0x17, 0x27, 0xa8, 0xbe, 0x9c, 0x2f, 0x09, 0x26, 0x3c,
+	0xe2, 0x2f, 0x09, 0x26, 0x3e, 0xb5, 0x7f, 0x8b, 0x6a, 0xaf, 0x4c, 0xb7, 0x8d, 0x55, 0xed, 0x95,
+	0xf2, 0x14, 0x7b, 0x44, 0x79, 0x84, 0x3e, 0x86, 0x29, 0xf9, 0x54, 0xbd, 0xb4, 0x7b, 0x44, 0x5f,
+	0xcb, 0x5f, 0x2e, 0xc4, 0x2b, 0x78, 0x83, 0x0d, 0x11, 0x73, 0x29, 0xf3, 0x11, 0x31, 0x52, 0x86,
+	0xa6, 0x6d, 0xd3, 0x2b, 0xa3, 0xc2, 0x5a, 0x32, 0x0c, 0x6f, 0xe0, 0x1d, 0xa1, 0xa1, 0xa2, 0x1f,
+	0x55, 0xd0, 0x35, 0x88, 0xe9, 0xdf, 0xf5, 0x8e, 0x50, 0x4f, 0x69, 0x68, 0xb1, 0x97, 0xf0, 0xa3,
+	0x68, 0xdf, 0x83, 0xe9, 0xf0, 0xd5, 0xfb, 0xfd, 0x55, 0x05, 0x31, 0xf2, 0x14, 0x7e, 0x14, 0xf1,
+	0x3d, 0x61, 0x4b, 0xa3, 0xed, 0xe9, 0x95, 0xfd, 0x65, 0x97, 0x8f, 0x85, 0x3a, 0x4c, 0xeb, 0x69,
+	0xec, 0x0d, 0xfd, 0x3e, 0xdc, 0x7d, 0x5a, 0x7d, 0x86, 0x56, 0xae, 0x9d, 0x84, 0x87, 0xa4, 0xe5,
+	0xda, 0x49, 0x7a, 0x08, 0x3a, 0xb4, 0x35, 0x7d, 0x2e, 0x94, 0x35, 0x21, 0xd1, 0x8b, 0x5a, 0xb7,
+	0x62, 0x74, 0x2f, 0xa5, 0x55, 0x47, 0x49, 0xd7, 0x21, 0x1f, 0x7d, 0x33, 0x57, 0xde, 0x74, 0x53,
+	0x1e, 0x37, 0x96, 0xd7, 0xe7, 0xd4, 0xc7, 0x76, 0x6b, 0xc2, 0x30, 0xa3, 0xd3, 0xbd, 0x92, 0xdc,
+	0x29, 0x95, 0x74, 0xba, 0xa5, 0x66, 0x46, 0x7b, 0x3e, 0x57, 0xd5, 0x41, 0xc4, 0x9e, 0xe7, 0x55,
+	0xe5, 0xc9, 0x84, 0x17, 0x77, 0x6d, 0x91, 0xf4, 0x23, 0xd1, 0x57, 0x40, 0xaa, 0x61, 0x06, 0xa7,
+	0x32, 0x1f, 0xe8, 0x77, 0x80, 0x7e, 0x05, 0x96, 0x52, 0x32, 0x2b, 0xa3, 0x6b, 0x11, 0xd5, 0x7b,
+	0x72, 0xe6, 0x65, 0xb9, 0x40, 0x12, 0xdf, 0xb5, 0xdf, 0xa2, 0x0e, 0x2b, 0x5a, 0x1c, 0x69, 0xcc,
+	0x08, 0xfc, 0x28, 0x8c, 0xbf, 0x0b, 0x07, 0x39, 0x31, 0x00, 0x15, 0xd5, 0xe9, 0x0d, 0x4c, 0x0f,
+	0x06, 0x8e, 0xdb, 0x81, 0x13, 0x08, 0x2e, 0x27, 0x13, 0x24, 0x6c, 0x44, 0x18, 0x12, 0x23, 0x54,
+	0x55, 0x43, 0x62, 0x62, 0xe4, 0xb3, 0x66, 0x48, 0x4c, 0x89, 0x4f, 0xae, 0xc1, 0x7c, 0x42, 0xfc,
+	0xb0, 0x5c, 0x66, 0xe9, 0xb1, 0xc5, 0xa9, 0x23, 0x50, 0x13, 0xf2, 0x5d, 0x32, 0xc5, 0xf4, 0x50,
+	0xe2, 0x54, 0x8a, 0x0f, 0x08, 0xc5, 0x58, 0x74, 0x30, 0x4a, 0x01, 0xef, 0xcf, 0x98, 0x4c, 0x21,
+	0x2e, 0xe8, 0x58, 0xab, 0x4a, 0xff, 0xd2, 0xe2, 0x90, 0x53, 0xfb, 0x57, 0x15, 0x5b, 0x35, 0xb9,
+	0x7f, 0xc3, 0x0a, 0x0c, 0xd2, 0xa6, 0x1b, 0x09, 0xcd, 0xd7, 0x3e, 0x54, 0x29, 0x5f, 0x4e, 0x29,
+	0x47, 0xdb, 0xd4, 0xb9, 0x2d, 0x5a, 0xaa, 0xdc, 0xf2, 0x93, 0x63, 0xff, 0x53, 0xe9, 0xb1, 0x2d,
+	0xa2, 0x85, 0xce, 0x9e, 0x64, 0x8b, 0x44, 0x62, 0x6e, 0xf9, 0x16, 0xd1, 0x83, 0x77, 0x4f, 0xb4,
+	0x45, 0x22, 0x04, 0xd5, 0x2d, 0x12, 0xa1, 0x7a, 0x39, 0xa2, 0x78, 0xe8, 0xbf, 0x45, 0x52, 0xe2,
+	0x89, 0xe5, 0x16, 0x89, 0x8e, 0x40, 0x54, 0x2b, 0x93, 0xba, 0x60, 0xa2, 0x23, 0x20, 0xb7, 0x48,
+	0x32, 0xc5, 0xf4, 0x20, 0xf2, 0x54, 0x8a, 0x72, 0x8b, 0xe8, 0x14, 0x53, 0xc0, 0x87, 0xdc, 0x22,
+	0xd1, 0x46, 0xf4, 0x2d, 0x72, 0xa2, 0xfe, 0xc9, 0x2d, 0x92, 0xdc, 0xbf, 0x13, 0x6f, 0x91, 0x48,
+	0xbe, 0x09, 0xed, 0x43, 0x93, 0xb6, 0x48, 0x14, 0x9e, 0x6d, 0x91, 0x68, 0x69, 0x44, 0x11, 0xd6,
+	0x67, 0x8b, 0x44, 0x31, 0x3f, 0xa5, 0xf4, 0x22, 0xf1, 0xc0, 0xc3, 0x6c, 0x92, 0xd4, 0x50, 0x62,
+	0xf4, 0x88, 0xaa, 0x7b, 0xa3, 0x61, 0xde, 0x43, 0x6d, 0x94, 0x0b, 0x69, 0x44, 0xe9, 0x56, 0xe1,
+	0xd2, 0x6d, 0x02, 0xe5, 0x70, 0x2b, 0xa4, 0x04, 0xb7, 0x6b, 0xd2, 0x6d, 0x6a, 0x04, 0xfa, 0xbe,
+	0x98, 0xa5, 0xe8, 0x78, 0xe8, 0x8a, 0xcc, 0xe4, 0x78, 0xeb, 0x3e, 0x23, 0xb2, 0x4f, 0x16, 0x66,
+	0xab, 0x0f, 0xdd, 0x7e, 0xe1, 0xe2, 0x7d, 0xe8, 0xca, 0x2b, 0x64, 0x94, 0x6e, 0x2a, 0x4a, 0xff,
+	0x0d, 0xf4, 0x99, 0xb0, 0xa8, 0x45, 0xf1, 0x56, 0x23, 0x97, 0xd2, 0x13, 0xf7, 0x54, 0x5e, 0x4e,
+	0xa3, 0x3d, 0x3d, 0xe9, 0x46, 0xda, 0x12, 0x42, 0x55, 0x2c, 0x07, 0x4b, 0xe4, 0xa3, 0xd5, 0xcd,
+	0x94, 0x5a, 0x83, 0x76, 0xa9, 0xf1, 0x20, 0x5e, 0xae, 0x18, 0x1e, 0xd2, 0x92, 0xbd, 0x0c, 0xa4,
+	0x1a, 0x8b, 0x98, 0x57, 0xa9, 0xa6, 0x85, 0xd3, 0x4b, 0xaa, 0x71, 0xec, 0x4f, 0xa8, 0x2a, 0x94,
+	0xc7, 0xe4, 0x3a, 0x4f, 0xdc, 0xc1, 0x9a, 0xcb, 0x10, 0x96, 0xfa, 0x6c, 0x7e, 0x9f, 0x5b, 0xa0,
+	0x45, 0x61, 0xea, 0xe0, 0x27, 0xe1, 0xa3, 0x4f, 0x20, 0xcf, 0xf9, 0x67, 0x48, 0x20, 0x09, 0x30,
+	0x75, 0xea, 0xca, 0x42, 0x71, 0x3a, 0x44, 0x0f, 0x86, 0x51, 0x98, 0x0e, 0x33, 0x12, 0xe9, 0x1a,
+	0x41, 0x72, 0x94, 0xef, 0x7a, 0x3d, 0x3f, 0xc0, 0xad, 0xb8, 0x26, 0x4f, 0xef, 0x8c, 0xf0, 0x20,
+	0xd2, 0xc1, 0xf7, 0x57, 0xd1, 0x06, 0x65, 0x9e, 0x7a, 0x71, 0x3f, 0xb5, 0x69, 0x32, 0x19, 0xca,
+	0xdb, 0xb6, 0x64, 0xe0, 0xa7, 0xde, 0xa7, 0xb4, 0xb6, 0x53, 0x3b, 0x25, 0x1c, 0x32, 0xf8, 0x38,
+	0x0d, 0xf9, 0x89, 0x69, 0xe3, 0xf4, 0x21, 0xf5, 0x65, 0x61, 0xba, 0xd7, 0x41, 0xc3, 0x13, 0x0d,
+	0xa1, 0x42, 0x55, 0x98, 0x12, 0xc8, 0x83, 0x47, 0x25, 0x8a, 0x4d, 0x46, 0x85, 0x7d, 0xcb, 0x0f,
+	0xe8, 0x4b, 0xfc, 0xf5, 0xc0, 0x0a, 0xec, 0xe6, 0x00, 0x62, 0xd2, 0x25, 0x43, 0x01, 0xde, 0x5f,
+	0x45, 0x5f, 0x31, 0x03, 0x50, 0x24, 0x26, 0x4c, 0x33, 0x00, 0x25, 0xc7, 0xb1, 0x69, 0x06, 0xa0,
+	0xb4, 0x90, 0xb2, 0x35, 0x98, 0xd1, 0x22, 0x82, 0xe5, 0xf5, 0x34, 0x29, 0x4e, 0xb8, 0xcf, 0x8a,
+	0x9c, 0xd1, 0x22, 0x7f, 0x25, 0x95, 0xa4, 0x78, 0xe0, 0x54, 0x2a, 0x1f, 0x41, 0x8e, 0xcf, 0x7b,
+	0xdf, 0x29, 0x4b, 0xd7, 0xc8, 0x2e, 0x2a, 0xb1, 0x0c, 0xbd, 0x96, 0x1d, 0x54, 0x5c, 0xe7, 0x89,
+	0x7d, 0x30, 0x70, 0xf6, 0xe2, 0x28, 0xfb, 0xab, 0xe8, 0x4b, 0xfa, 0x5e, 0xb4, 0x78, 0x4e, 0x1f,
+	0x07, 0xcf, 0x5d, 0xef, 0xa9, 0xed, 0x1c, 0x0c, 0x20, 0x79, 0x59, 0x27, 0x19, 0xc5, 0x13, 0x2b,
+	0xfc, 0x4b, 0x58, 0xae, 0xa7, 0x13, 0x1f, 0x48, 0xa4, 0xff, 0x41, 0x58, 0x87, 0x0b, 0xd4, 0x29,
+	0xed, 0xa4, 0x7d, 0xef, 0x4b, 0xf4, 0x73, 0x96, 0x70, 0x4c, 0x58, 0x86, 0x9a, 0xae, 0xd7, 0x1a,
+	0x4c, 0xb1, 0xa8, 0xbb, 0xe0, 0x47, 0xd0, 0xc4, 0x60, 0x7c, 0x0e, 0xe7, 0xeb, 0xa9, 0xa4, 0x07,
+	0x91, 0x18, 0x24, 0x54, 0xaf, 0xd0, 0xa1, 0x38, 0x61, 0xbf, 0xfb, 0xd2, 0xdc, 0xa0, 0xdc, 0x97,
+	0x9c, 0x98, 0x35, 0x0f, 0x3f, 0xc1, 0x1e, 0x0d, 0xf4, 0x18, 0x14, 0xe2, 0xa0, 0x83, 0x8b, 0x2f,
+	0xdf, 0x80, 0xb3, 0xf5, 0x18, 0xa9, 0x34, 0x94, 0x41, 0x66, 0xcb, 0x79, 0xfa, 0xa5, 0x43, 0xf6,
+	0x6b, 0x80, 0x3f, 0x5e, 0xee, 0x3e, 0x0e, 0xf6, 0x36, 0x06, 0x8c, 0x92, 0x88, 0x44, 0x12, 0x80,
+	0xfb, 0x77, 0x08, 0x66, 0x5d, 0xc1, 0x8c, 0x43, 0xa4, 0x6e, 0xde, 0x1f, 0x08, 0x6b, 0xd9, 0xc0,
+	0x66, 0xd3, 0x28, 0xdc, 0xa5, 0x0c, 0x9b, 0x07, 0x3b, 0x2c, 0x85, 0xc2, 0x0a, 0x2b, 0x09, 0x75,
+	0xad, 0x4a, 0xdc, 0x83, 0x8f, 0x4a, 0xec, 0x92, 0xcd, 0x96, 0x07, 0x2f, 0xbb, 0x14, 0x0b, 0x82,
+	0xe9, 0x4b, 0x82, 0xe9, 0xc9, 0x37, 0xdd, 0xe6, 0x53, 0x55, 0x4f, 0x4e, 0x7e, 0x47, 0xf5, 0xbb,
+	0xa4, 0x6c, 0x7f, 0x95, 0x1f, 0x4b, 0xe4, 0x87, 0xe6, 0x62, 0x49, 0x0b, 0xc2, 0x63, 0x29, 0x5a,
+	0x2e, 0x3d, 0x84, 0xa9, 0x92, 0x9d, 0x61, 0xab, 0x4a, 0x76, 0x0d, 0xbd, 0x10, 0xaf, 0x90, 0xcf,
+	0xea, 0x73, 0xe5, 0x32, 0xed, 0xb0, 0xde, 0xb3, 0xd4, 0xa1, 0x95, 0x7a, 0x65, 0x8a, 0xa4, 0xeb,
+	0x95, 0xd5, 0x0f, 0x4d, 0xb7, 0x16, 0x21, 0x13, 0x77, 0xdb, 0x34, 0xfe, 0xa2, 0xe3, 0x32, 0x9c,
+	0x50, 0x4d, 0x10, 0xaf, 0x1a, 0xec, 0x69, 0x39, 0xcf, 0x1d, 0xea, 0xb4, 0x89, 0x93, 0x19, 0x49,
+	0xe3, 0x75, 0xe1, 0x54, 0xa8, 0x7e, 0x7e, 0xb7, 0x33, 0x68, 0x1b, 0xce, 0xdd, 0xc7, 0x01, 0xe7,
+	0x91, 0x26, 0xf6, 0x03, 0xcf, 0x6e, 0x06, 0x7d, 0xcd, 0xd8, 0xe2, 0x9a, 0x97, 0x80, 0xb3, 0xff,
+	0x36, 0xa1, 0x57, 0x4f, 0xa6, 0xd7, 0x17, 0xaf, 0x8f, 0x73, 0x3e, 0xb7, 0x67, 0x9d, 0xa4, 0x8b,
+	0xe9, 0x5b, 0x64, 0x92, 0x39, 0xb7, 0xa5, 0xa3, 0xe6, 0xc3, 0x67, 0xaa, 0xf8, 0xc5, 0xf5, 0x43,
+	0xc8, 0x72, 0x0f, 0xb6, 0x70, 0xb9, 0x8a, 0x82, 0xe8, 0x72, 0x0d, 0xcb, 0xf9, 0x72, 0xbb, 0x09,
+	0x13, 0xac, 0xc5, 0xd4, 0xd3, 0x7c, 0x5a, 0x6d, 0x10, 0xdd, 0x81, 0x29, 0xe9, 0xda, 0x86, 0xb4,
+	0xaa, 0xd4, 0x8f, 0xba, 0x03, 0x53, 0xec, 0x06, 0x3a, 0x3c, 0xca, 0x87, 0x30, 0x25, 0x7d, 0xe1,
+	0x4e, 0x2c, 0x66, 0x7c, 0x02, 0x33, 0xaa, 0x57, 0xdc, 0xc9, 0x67, 0xe1, 0x23, 0xea, 0xa9, 0x20,
+	0x8c, 0x78, 0x83, 0xe5, 0x41, 0x01, 0xc9, 0xe7, 0x83, 0xfb, 0x28, 0x84, 0xf8, 0xaa, 0x8f, 0x82,
+	0x2c, 0x4d, 0xf2, 0x51, 0x50, 0x2a, 0x65, 0xd6, 0xba, 0x9c, 0xd2, 0x95, 0xd4, 0xa1, 0x38, 0x1b,
+	0xeb, 0x09, 0xfa, 0x50, 0x04, 0x73, 0x4a, 0xe4, 0x38, 0x50, 0x9f, 0xf1, 0x9f, 0x65, 0x53, 0xf6,
+	0x32, 0xc8, 0xf2, 0xa4, 0x18, 0xd8, 0xed, 0x61, 0x3c, 0x2a, 0x06, 0x4f, 0x43, 0x1a, 0x95, 0x1d,
+	0x2a, 0x6e, 0xc6, 0x53, 0x1c, 0xa4, 0x12, 0xba, 0x94, 0x9e, 0xd5, 0x80, 0x4e, 0x2c, 0x66, 0x6f,
+	0xe0, 0x25, 0x50, 0x54, 0x5d, 0xf2, 0x52, 0x33, 0x36, 0x68, 0x51, 0x09, 0x7d, 0x32, 0x2f, 0x3c,
+	0xa0, 0xf7, 0xfb, 0x18, 0x40, 0xea, 0x28, 0xf6, 0x49, 0xc6, 0x10, 0x2a, 0x34, 0xe2, 0xe4, 0xfa,
+	0xa0, 0xf5, 0xd3, 0x8f, 0xb0, 0x75, 0x71, 0x3a, 0xe4, 0x36, 0x84, 0x3f, 0xf4, 0xf0, 0x1f, 0x9b,
+	0xde, 0xb3, 0x95, 0x04, 0x57, 0x91, 0x81, 0x53, 0x9e, 0x46, 0xee, 0x57, 0xa8, 0x34, 0x9d, 0xf8,
+	0x4a, 0x5c, 0x3a, 0xb1, 0x1b, 0x8a, 0xe7, 0x52, 0x22, 0xa6, 0x9c, 0xe2, 0xa7, 0x34, 0x18, 0x37,
+	0xf9, 0x11, 0xba, 0xeb, 0x03, 0xa8, 0x88, 0x91, 0x78, 0x7d, 0x20, 0x9c, 0x74, 0x3c, 0x58, 0x61,
+	0x12, 0x45, 0x72, 0x7b, 0x03, 0x1e, 0xd5, 0x4b, 0xf0, 0x05, 0x91, 0xce, 0xe6, 0xc9, 0x04, 0x75,
+	0x67, 0xf3, 0xbe, 0xdf, 0x90, 0x36, 0xfc, 0x9f, 0x42, 0x31, 0x74, 0xa9, 0x3a, 0xd9, 0x24, 0xa4,
+	0xfb, 0x38, 0xa3, 0xd8, 0x48, 0xf9, 0xa8, 0xdf, 0x1b, 0x2f, 0xcb, 0x57, 0xd2, 0x46, 0xd8, 0x57,
+	0x9d, 0x8f, 0xa9, 0x73, 0x59, 0x84, 0xac, 0x7a, 0xf7, 0x8f, 0xa1, 0xc6, 0xef, 0xfe, 0x69, 0xd4,
+	0xef, 0x0b, 0xef, 0xd8, 0xc8, 0x63, 0x8f, 0x69, 0xcf, 0x46, 0xf6, 0x31, 0x10, 0xf0, 0xd8, 0xe7,
+	0x53, 0x21, 0x14, 0x5f, 0x4b, 0x27, 0x27, 0x24, 0xfd, 0xa9, 0x22, 0x84, 0x8c, 0x3e, 0x8b, 0x67,
+	0xb0, 0x25, 0xbf, 0x90, 0xb2, 0x6a, 0x4e, 0xbe, 0x5c, 0xac, 0x30, 0xde, 0x57, 0x27, 0x55, 0x51,
+	0x73, 0x2c, 0xc4, 0xab, 0xa2, 0x06, 0xb4, 0x24, 0x08, 0xe9, 0x10, 0x59, 0x10, 0x4d, 0x90, 0x72,
+	0x72, 0x31, 0x74, 0x3d, 0x3b, 0x78, 0x51, 0x31, 0x37, 0x43, 0x25, 0x8f, 0x5a, 0x21, 0x68, 0x83,
+	0xa8, 0x34, 0x37, 0xd1, 0x17, 0x94, 0x51, 0x71, 0xf2, 0x65, 0xd7, 0x0d, 0xfc, 0xc0, 0xb3, 0xba,
+	0x75, 0xfa, 0x9e, 0x6f, 0xea, 0x47, 0x87, 0xc1, 0x26, 0x49, 0x68, 0x8a, 0xef, 0x3b, 0xcf, 0x0d,
+	0x9d, 0x94, 0x53, 0x4f, 0x86, 0x2d, 0x26, 0x55, 0xf6, 0xb9, 0x47, 0xd6, 0x45, 0x36, 0xe8, 0xd3,
+	0x24, 0xda, 0x80, 0xa5, 0x94, 0x4c, 0x84, 0xd2, 0x19, 0xa2, 0x7f, 0xa6, 0xc2, 0xe5, 0xfe, 0x0d,
+	0xa3, 0x2f, 0x61, 0x31, 0x31, 0x55, 0xa1, 0xb4, 0x5c, 0xf4, 0x4b, 0x64, 0x38, 0x88, 0xf8, 0x53,
+	0x28, 0xb0, 0x40, 0x36, 0x1a, 0x60, 0xa1, 0x65, 0xad, 0x0b, 0xc3, 0x28, 0x53, 0x00, 0xa2, 0xa7,
+	0x41, 0x3a, 0x9c, 0x4c, 0x1a, 0xb2, 0x40, 0xb3, 0x62, 0x45, 0x1e, 0xfd, 0x97, 0x1b, 0x2f, 0xa9,
+	0xb2, 0x5f, 0xac, 0x66, 0x0d, 0x16, 0xf7, 0xb1, 0x67, 0x3f, 0x79, 0x11, 0x25, 0x28, 0x46, 0x26,
+	0xb1, 0xb6, 0x1f, 0xc5, 0xcf, 0x60, 0xa9, 0xe2, 0x76, 0xba, 0x3c, 0xfa, 0x5a, 0xa3, 0x29, 0x3d,
+	0x5b, 0x92, 0xeb, 0x07, 0xfb, 0x1e, 0x2e, 0xcb, 0xf0, 0x70, 0x15, 0xaf, 0x42, 0xd3, 0x12, 0xdc,
+	0xd0, 0xbd, 0x73, 0x12, 0x40, 0xc2, 0xa8, 0x31, 0x71, 0x31, 0x56, 0xf1, 0x77, 0xe9, 0x22, 0x8c,
+	0xe0, 0x31, 0x4d, 0xa9, 0xb2, 0x08, 0x93, 0xea, 0xfb, 0xc7, 0xd8, 0x26, 0x50, 0x65, 0x0d, 0xa6,
+	0x53, 0x1d, 0xa2, 0xb7, 0xdb, 0xe2, 0x6c, 0xd1, 0x1f, 0x8c, 0x8f, 0x44, 0x5e, 0x24, 0xbe, 0x26,
+	0x9f, 0xd8, 0x4f, 0x25, 0x3b, 0x4e, 0xbb, 0xdd, 0x47, 0x80, 0x4b, 0x78, 0x1a, 0x9a, 0xdc, 0xd8,
+	0x54, 0xdc, 0x7e, 0xdc, 0x3a, 0x86, 0xcc, 0xed, 0x1b, 0xb3, 0xfa, 0xeb, 0xd4, 0x5a, 0x04, 0x63,
+	0xec, 0x25, 0x6c, 0x2d, 0x82, 0x31, 0xe1, 0x49, 0xeb, 0x0f, 0x60, 0xba, 0xae, 0x7e, 0x4b, 0x42,
+	0x9f, 0x53, 0xd7, 0x98, 0x8c, 0x7e, 0x1c, 0x3c, 0x14, 0x7d, 0x5c, 0xc1, 0xe5, 0x39, 0x36, 0xd4,
+	0xa0, 0xa4, 0x3a, 0xb6, 0x69, 0x2f, 0x6b, 0x69, 0xf7, 0xd0, 0xe8, 0xe3, 0x82, 0xda, 0x3d, 0x34,
+	0xfe, 0x18, 0x17, 0x37, 0x8e, 0x47, 0xdf, 0x8e, 0xd4, 0x8c, 0xe3, 0x29, 0x8f, 0xb4, 0x6a, 0xc6,
+	0xf1, 0xd4, 0xc7, 0x27, 0x99, 0x17, 0x5e, 0xf8, 0x96, 0x98, 0xea, 0x85, 0x17, 0x7b, 0xa1, 0x4c,
+	0xf5, 0xc2, 0x4b, 0x78, 0x7e, 0xac, 0x0e, 0xf9, 0xe8, 0xe3, 0x68, 0x52, 0x67, 0x98, 0xf2, 0xf6,
+	0x9b, 0xf4, 0xb7, 0x4b, 0x7d, 0x55, 0xad, 0x4a, 0x3b, 0x18, 0x3e, 0x7e, 0xd2, 0x47, 0xfd, 0x24,
+	0xfb, 0x96, 0xf0, 0xc6, 0xca, 0x43, 0x35, 0x11, 0x14, 0x7b, 0x32, 0xa5, 0x8f, 0x76, 0x3e, 0x9a,
+	0x00, 0x2a, 0xf2, 0xc6, 0xca, 0x3d, 0xc8, 0xb3, 0x0c, 0xd9, 0x61, 0x46, 0xe7, 0xd0, 0x9d, 0x38,
+	0x9e, 0xb8, 0xbb, 0xcf, 0x4a, 0xc9, 0x47, 0xf3, 0xe0, 0xca, 0x01, 0x4b, 0x49, 0x90, 0xdb, 0x67,
+	0xfd, 0x43, 0x98, 0xed, 0x56, 0xaa, 0x22, 0x63, 0x09, 0x70, 0x97, 0xcf, 0x27, 0xd4, 0x48, 0xb1,
+	0x77, 0x5a, 0xcd, 0x8d, 0x2b, 0x3f, 0x29, 0x21, 0x61, 0xee, 0xf2, 0x4a, 0x62, 0x1d, 0x27, 0x14,
+	0xb0, 0x6c, 0x8d, 0xc9, 0x6f, 0x23, 0x87, 0x51, 0xb1, 0x7d, 0x60, 0x44, 0x33, 0x6f, 0x0e, 0x03,
+	0xca, 0x5b, 0xc5, 0xf2, 0xe9, 0x97, 0x84, 0x97, 0xb2, 0x5f, 0x4f, 0x08, 0x2a, 0xd3, 0x20, 0xa2,
+	0xa9, 0x30, 0xd2, 0x9e, 0xed, 0x46, 0x8f, 0xc4, 0x73, 0x03, 0x29, 0x2d, 0x0d, 0x22, 0x90, 0x3a,
+	0x83, 0x8f, 0xc4, 0x03, 0x03, 0xa7, 0x4d, 0xf8, 0x31, 0x5c, 0x88, 0x44, 0xaa, 0xe9, 0x84, 0xdf,
+	0x4c, 0x0e, 0x67, 0x4b, 0x1c, 0x9e, 0xf4, 0x7b, 0xc5, 0xe5, 0x78, 0x44, 0x5b, 0x64, 0xde, 0x4f,
+	0xca, 0x48, 0xf9, 0xe9, 0x22, 0xdf, 0x5c, 0xd7, 0x4f, 0x97, 0xb0, 0x38, 0xe9, 0x74, 0x51, 0x6b,
+	0xa5, 0x85, 0x60, 0x9a, 0x27, 0x6c, 0x60, 0x2f, 0xb8, 0x2f, 0xeb, 0x59, 0x1c, 0x68, 0x61, 0xd2,
+	0x49, 0xcb, 0x1f, 0x86, 0x47, 0x1f, 0xc1, 0x5c, 0x98, 0xc7, 0x81, 0x91, 0x48, 0x00, 0xeb, 0xa3,
+	0xdd, 0x9c, 0x0b, 0x93, 0x39, 0x9c, 0x1c, 0x7d, 0x5d, 0x9c, 0x6f, 0x21, 0xfa, 0xc5, 0x58, 0x5c,
+	0x9f, 0xf6, 0x0d, 0xc3, 0x1c, 0x73, 0xca, 0xd8, 0x9e, 0x74, 0x76, 0x9a, 0x74, 0xbb, 0x25, 0x27,
+	0x7d, 0x56, 0xb7, 0x5b, 0xdf, 0xc4, 0xd4, 0x52, 0x44, 0x4f, 0xa1, 0xb3, 0x05, 0x57, 0x69, 0x5a,
+	0xae, 0x1a, 0x4b, 0x0d, 0x9c, 0x0c, 0x95, 0xde, 0xf7, 0x68, 0x32, 0xaf, 0x36, 0x5c, 0x19, 0x98,
+	0xf5, 0x1a, 0xdd, 0xd2, 0xdc, 0xb7, 0x06, 0xe7, 0xc7, 0xee, 0x73, 0x3b, 0x5a, 0x48, 0x4a, 0x1e,
+	0x2d, 0x0f, 0xef, 0x3e, 0x79, 0xac, 0xe5, 0xe1, 0xdd, 0x37, 0xfb, 0xf4, 0x67, 0x34, 0xfb, 0x0f,
+	0x3f, 0xa3, 0x68, 0xaa, 0x3d, 0xec, 0x58, 0x4e, 0x13, 0x0f, 0x30, 0x14, 0x5e, 0xd1, 0xcd, 0xe8,
+	0x31, 0x44, 0x7a, 0xef, 0xba, 0xc4, 0x6f, 0x8b, 0x69, 0xc4, 0x07, 0x13, 0xe9, 0x13, 0x4d, 0x71,
+	0x89, 0x2d, 0xc0, 0x13, 0xf7, 0x3c, 0xa5, 0xbc, 0xbc, 0xf6, 0xf3, 0xff, 0x70, 0x29, 0xf3, 0xf3,
+	0x5f, 0x5c, 0xca, 0xfc, 0xeb, 0x5f, 0x5c, 0xca, 0xfc, 0xfb, 0x5f, 0x5c, 0xca, 0x7c, 0xb1, 0x3a,
+	0xdc, 0xc3, 0x0c, 0xec, 0x49, 0xbb, 0x5b, 0x8c, 0xdc, 0x04, 0xfd, 0xef, 0xee, 0xff, 0x08, 0x00,
+	0x00, 0xff, 0xff, 0x38, 0xcc, 0x42, 0xa3, 0x69, 0xf7, 0x00, 0x00,
 }
 
 func (m *Watch) Marshal() (dAtA []byte, err error) {
@@ -16781,6 +18668,105 @@ func (m *ChangePasswordRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ListSemaphoresRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSemaphoresRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSemaphoresRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Filter != nil {
+		{
+			size, err := m.Filter.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListSemaphoresResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSemaphoresResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSemaphoresResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Semaphores) > 0 {
+		for iNdEx := len(m.Semaphores) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Semaphores[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *PluginDataSeq) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -16847,12 +18833,12 @@ func (m *RequestStateSetter) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.AssumeStartTime != nil {
-		n11, err11 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
-		if err11 != nil {
-			return 0, err11
+		n12, err12 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
+		if err12 != nil {
+			return 0, err12
 		}
-		i -= n11
-		i = encodeVarintAuthservice(dAtA, i, uint64(n11))
+		i -= n12
+		i = encodeVarintAuthservice(dAtA, i, uint64(n12))
 		i--
 		dAtA[i] = 0x3a
 	}
@@ -17018,6 +19004,93 @@ func (m *CreateResetPasswordTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int
 	return len(dAtA) - i, nil
 }
 
+func (m *ListResetPasswordTokenRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListResetPasswordTokenRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListResetPasswordTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListResetPasswordTokenResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListResetPasswordTokenResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListResetPasswordTokenResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.UserTokens) > 0 {
+		for iNdEx := len(m.UserTokens) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.UserTokens[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *RenewableCertsRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -17111,12 +19184,12 @@ func (m *PingResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.LicenseExpiry != nil {
-		n13, err13 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LicenseExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LicenseExpiry):])
-		if err13 != nil {
-			return 0, err13
+		n14, err14 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LicenseExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LicenseExpiry):])
+		if err14 != nil {
+			return 0, err14
 		}
-		i -= n13
-		i = encodeVarintAuthservice(dAtA, i, uint64(n13))
+		i -= n14
+		i = encodeVarintAuthservice(dAtA, i, uint64(n14))
 		i--
 		dAtA[i] = 0x52
 	}
@@ -17212,6 +19285,18 @@ func (m *Features) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ClientIPRestrictions {
+		i--
+		if m.ClientIPRestrictions {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xb8
+	}
 	if m.AccessGraphDemoMode {
 		i--
 		if m.AccessGraphDemoMode {
@@ -18389,12 +20474,12 @@ func (m *GenerateAppTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 			dAtA[i] = 0x2a
 		}
 	}
-	n28, err28 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err28 != nil {
-		return 0, err28
+	n29, err29 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err29 != nil {
+		return 0, err29
 	}
-	i -= n28
-	i = encodeVarintAuthservice(dAtA, i, uint64(n28))
+	i -= n29
+	i = encodeVarintAuthservice(dAtA, i, uint64(n29))
 	i--
 	dAtA[i] = 0x22
 	if len(m.URI) > 0 {
@@ -19553,6 +21638,93 @@ func (m *GetWebTokensResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ListWebTokensRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListWebTokensRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListWebTokensRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListWebTokensResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListWebTokensResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListWebTokensResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Tokens) > 0 {
+		for iNdEx := len(m.Tokens) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Tokens[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *UpsertKubernetesServerRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -19996,6 +22168,13 @@ func (m *DatabaseCertRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.CRLDomain) > 0 {
+		i -= len(m.CRLDomain)
+		copy(dAtA[i:], m.CRLDomain)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.CRLDomain)))
+		i--
+		dAtA[i] = 0x42
+	}
 	if len(m.CRLEndpoint) > 0 {
 		i -= len(m.CRLEndpoint)
 		copy(dAtA[i:], m.CRLEndpoint)
@@ -21812,6 +23991,13 @@ func (m *GetEventsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Search) > 0 {
+		i -= len(m.Search)
+		copy(dAtA[i:], m.Search)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.Search)))
+		i--
+		dAtA[i] = 0x42
+	}
 	if m.Order != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.Order))
 		i--
@@ -21838,21 +24024,21 @@ func (m *GetEventsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x22
 		}
 	}
-	n66, err66 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
-	if err66 != nil {
-		return 0, err66
-	}
-	i -= n66
-	i = encodeVarintAuthservice(dAtA, i, uint64(n66))
-	i--
-	dAtA[i] = 0x1a
-	n67, err67 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	n67, err67 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
 	if err67 != nil {
 		return 0, err67
 	}
 	i -= n67
 	i = encodeVarintAuthservice(dAtA, i, uint64(n67))
 	i--
+	dAtA[i] = 0x1a
+	n68, err68 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	if err68 != nil {
+		return 0, err68
+	}
+	i -= n68
+	i = encodeVarintAuthservice(dAtA, i, uint64(n68))
+	i--
 	dAtA[i] = 0x12
 	if len(m.Namespace) > 0 {
 		i -= len(m.Namespace)
@@ -21905,21 +24091,21 @@ func (m *GetSessionEventsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x18
 	}
-	n68, err68 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
-	if err68 != nil {
-		return 0, err68
-	}
-	i -= n68
-	i = encodeVarintAuthservice(dAtA, i, uint64(n68))
-	i--
-	dAtA[i] = 0x12
-	n69, err69 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	n69, err69 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
 	if err69 != nil {
 		return 0, err69
 	}
 	i -= n69
 	i = encodeVarintAuthservice(dAtA, i, uint64(n69))
 	i--
+	dAtA[i] = 0x12
+	n70, err70 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	if err70 != nil {
+		return 0, err70
+	}
+	i -= n70
+	i = encodeVarintAuthservice(dAtA, i, uint64(n70))
+	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
@@ -22064,6 +24250,105 @@ func (m *GetLocksResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ListLocksRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListLocksRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListLocksRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Filter != nil {
+		{
+			size, err := m.Filter.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListLocksResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListLocksResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListLocksResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Locks) > 0 {
+		for iNdEx := len(m.Locks) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Locks[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *GetLockRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -22180,6 +24465,180 @@ func (m *ReplaceRemoteLocksRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
+func (m *ListAppsRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListAppsRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListAppsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.StartKey) > 0 {
+		i -= len(m.StartKey)
+		copy(dAtA[i:], m.StartKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.StartKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Limit != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.Limit))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListAppsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListAppsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListAppsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextKey) > 0 {
+		i -= len(m.NextKey)
+		copy(dAtA[i:], m.NextKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Applications) > 0 {
+		for iNdEx := len(m.Applications) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Applications[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListDatabasesRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListDatabasesRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListDatabasesRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListDatabasesResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListDatabasesResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListDatabasesResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Databases) > 0 {
+		for iNdEx := len(m.Databases) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Databases[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *GetWindowsDesktopServicesResponse) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -22328,6 +24787,138 @@ func (m *DeleteWindowsDesktopServiceRequest) MarshalToSizedBuffer(dAtA []byte) (
 	return len(dAtA) - i, nil
 }
 
+func (m *ListWindowsDesktopsRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListWindowsDesktopsRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListWindowsDesktopsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.WindowsDesktopFilter.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintAuthservice(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	if len(m.SearchKeywords) > 0 {
+		for iNdEx := len(m.SearchKeywords) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SearchKeywords[iNdEx])
+			copy(dAtA[i:], m.SearchKeywords[iNdEx])
+			i = encodeVarintAuthservice(dAtA, i, uint64(len(m.SearchKeywords[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.PredicateExpression) > 0 {
+		i -= len(m.PredicateExpression)
+		copy(dAtA[i:], m.PredicateExpression)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PredicateExpression)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Labels) > 0 {
+		for k := range m.Labels {
+			v := m.Labels[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintAuthservice(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintAuthservice(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintAuthservice(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.StartKey) > 0 {
+		i -= len(m.StartKey)
+		copy(dAtA[i:], m.StartKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.StartKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Limit != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.Limit))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListWindowsDesktopsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListWindowsDesktopsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListWindowsDesktopsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextKey) > 0 {
+		i -= len(m.NextKey)
+		copy(dAtA[i:], m.NextKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Desktops) > 0 {
+		for iNdEx := len(m.Desktops) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Desktops[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *GetWindowsDesktopsResponse) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -22434,6 +25025,13 @@ func (m *WindowsDesktopCertRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.CRLDomain) > 0 {
+		i -= len(m.CRLDomain)
+		copy(dAtA[i:], m.CRLDomain)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.CRLDomain)))
+		i--
+		dAtA[i] = 0x22
+	}
 	if m.TTL != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.TTL))
 		i--
@@ -23284,12 +25882,12 @@ func (m *RecoveryCodes) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n76, err76 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err76 != nil {
-		return 0, err76
+	n79, err79 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err79 != nil {
+		return 0, err79
 	}
-	i -= n76
-	i = encodeVarintAuthservice(dAtA, i, uint64(n76))
+	i -= n79
+	i = encodeVarintAuthservice(dAtA, i, uint64(n79))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Codes) > 0 {
@@ -23925,6 +26523,93 @@ func (m *IdentityCenterAccountAssignment) MarshalToSizedBuffer(dAtA []byte) (int
 	return len(dAtA) - i, nil
 }
 
+func (m *ListInstallersRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListInstallersRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListInstallersRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListInstallersResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListInstallersResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListInstallersResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Installers) > 0 {
+		for iNdEx := len(m.Installers) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Installers[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *PaginatedResource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -25070,12 +27755,12 @@ func (m *SessionTrackerUpdateExpiry) MarshalToSizedBuffer(dAtA []byte) (int, err
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.Expires != nil {
-		n106, err106 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err106 != nil {
-			return 0, err106
+		n109, err109 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err109 != nil {
+			return 0, err109
 		}
-		i -= n106
-		i = encodeVarintAuthservice(dAtA, i, uint64(n106))
+		i -= n109
+		i = encodeVarintAuthservice(dAtA, i, uint64(n109))
 		i--
 		dAtA[i] = 0xa
 	}
@@ -25580,7 +28265,7 @@ func (m *GetGithubAuthRequestRequest) MarshalToSizedBuffer(dAtA []byte) (int, er
 	return len(dAtA) - i, nil
 }
 
-func (m *CreateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
+func (m *ListOIDCConnectorsRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25590,12 +28275,12 @@ func (m *CreateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *CreateOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *ListOIDCConnectorsRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *CreateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ListOIDCConnectorsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25604,22 +28289,32 @@ func (m *CreateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Connector != nil {
-		{
-			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+	if m.WithSecrets {
+		i--
+		if m.WithSecrets {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
 		}
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x18
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *UpdateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
+func (m *ListOIDCConnectorsResponse) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25629,12 +28324,12 @@ func (m *UpdateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UpdateOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *ListOIDCConnectorsResponse) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UpdateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ListOIDCConnectorsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25643,22 +28338,31 @@ func (m *UpdateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Connector != nil {
-		{
-			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Connectors) > 0 {
+		for iNdEx := len(m.Connectors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Connectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
 			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
 		}
-		i--
-		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *UpsertOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
+func (m *CreateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25668,12 +28372,90 @@ func (m *UpsertOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UpsertOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *CreateOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UpsertOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *CreateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Connector != nil {
+		{
+			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UpdateOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpdateOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UpdateOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Connector != nil {
+		{
+			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UpsertOIDCConnectorRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpsertOIDCConnectorRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UpsertOIDCConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25814,6 +28596,210 @@ func (m *UpsertSAMLConnectorRequest) MarshalToSizedBuffer(dAtA []byte) (int, err
 	return len(dAtA) - i, nil
 }
 
+func (m *ListSAMLConnectorsRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSAMLConnectorsRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSAMLConnectorsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.NoFollowUrls {
+		i--
+		if m.NoFollowUrls {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.WithSecrets {
+		i--
+		if m.WithSecrets {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListSAMLConnectorsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSAMLConnectorsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSAMLConnectorsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Connectors) > 0 {
+		for iNdEx := len(m.Connectors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Connectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListGithubConnectorsRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListGithubConnectorsRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListGithubConnectorsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.WithSecrets {
+		i--
+		if m.WithSecrets {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListGithubConnectorsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListGithubConnectorsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListGithubConnectorsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Connectors) > 0 {
+		for iNdEx := len(m.Connectors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Connectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CreateGithubConnectorRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -27050,6 +30036,283 @@ func (m *AccessRequestAllowedPromotionResponse) MarshalToSizedBuffer(dAtA []byte
 	return len(dAtA) - i, nil
 }
 
+func (m *ListProvisionTokensRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListProvisionTokensRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListProvisionTokensRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.FilterBotName) > 0 {
+		i -= len(m.FilterBotName)
+		copy(dAtA[i:], m.FilterBotName)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.FilterBotName)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.FilterRoles) > 0 {
+		for iNdEx := len(m.FilterRoles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.FilterRoles[iNdEx])
+			copy(dAtA[i:], m.FilterRoles[iNdEx])
+			i = encodeVarintAuthservice(dAtA, i, uint64(len(m.FilterRoles[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.StartKey) > 0 {
+		i -= len(m.StartKey)
+		copy(dAtA[i:], m.StartKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.StartKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Limit != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.Limit))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListProvisionTokensResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListProvisionTokensResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListProvisionTokensResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextKey) > 0 {
+		i -= len(m.NextKey)
+		copy(dAtA[i:], m.NextKey)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Tokens) > 0 {
+		for iNdEx := len(m.Tokens) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Tokens[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListKubernetesClustersRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListKubernetesClustersRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListKubernetesClustersRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListKubernetesClustersResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListKubernetesClustersResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListKubernetesClustersResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.KubernetesClusters) > 0 {
+		for iNdEx := len(m.KubernetesClusters) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.KubernetesClusters[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListSnowflakeSessionsRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSnowflakeSessionsRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSnowflakeSessionsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PageToken) > 0 {
+		i -= len(m.PageToken)
+		copy(dAtA[i:], m.PageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.PageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PageSize != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.PageSize))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListSnowflakeSessionsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListSnowflakeSessionsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListSnowflakeSessionsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NextPageToken) > 0 {
+		i -= len(m.NextPageToken)
+		copy(dAtA[i:], m.NextPageToken)
+		i = encodeVarintAuthservice(dAtA, i, uint64(len(m.NextPageToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Sessions) > 0 {
+		for iNdEx := len(m.Sessions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Sessions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintAuthservice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func encodeVarintAuthservice(dAtA []byte, offset int, v uint64) int {
 	offset -= sovAuthservice(v)
 	base := offset
@@ -27464,6 +30727,51 @@ func (m *ChangePasswordRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListSemaphoresRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.Filter != nil {
+		l = m.Filter.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListSemaphoresResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Semaphores) > 0 {
+		for _, e := range m.Semaphores {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *PluginDataSeq) Size() (n int) {
 	if m == nil {
 		return 0
@@ -27576,6 +30884,47 @@ func (m *CreateResetPasswordTokenRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListResetPasswordTokenRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListResetPasswordTokenResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.UserTokens) > 0 {
+		for _, e := range m.UserTokens {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *RenewableCertsRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -27777,6 +31126,9 @@ func (m *Features) Size() (n int) {
 	if m.AccessGraphDemoMode {
 		n += 3
 	}
+	if m.ClientIPRestrictions {
+		n += 3
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -28679,6 +32031,47 @@ func (m *GetWebTokensResponse) Size() (n int) {
 	return n
 }
 
+func (m *ListWebTokensRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListWebTokensResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Tokens) > 0 {
+		for _, e := range m.Tokens {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *UpsertKubernetesServerRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -28904,6 +32297,10 @@ func (m *DatabaseCertRequest) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAuthservice(uint64(l))
 	}
+	l = len(m.CRLDomain)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -29762,6 +33159,10 @@ func (m *GetEventsRequest) Size() (n int) {
 	if m.Order != 0 {
 		n += 1 + sovAuthservice(uint64(m.Order))
 	}
+	l = len(m.Search)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -29855,6 +33256,51 @@ func (m *GetLocksResponse) Size() (n int) {
 	return n
 }
 
+func (m *ListLocksRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.Filter != nil {
+		l = m.Filter.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListLocksResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Locks) > 0 {
+		for _, e := range m.Locks {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *GetLockRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -29909,6 +33355,88 @@ func (m *ReplaceRemoteLocksRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListAppsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Limit != 0 {
+		n += 1 + sovAuthservice(uint64(m.Limit))
+	}
+	l = len(m.StartKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListAppsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Applications) > 0 {
+		for _, e := range m.Applications {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListDatabasesRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListDatabasesResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Databases) > 0 {
+		for _, e := range m.Databases {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *GetWindowsDesktopServicesResponse) Size() (n int) {
 	if m == nil {
 		return 0
@@ -29975,6 +33503,67 @@ func (m *DeleteWindowsDesktopServiceRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListWindowsDesktopsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Limit != 0 {
+		n += 1 + sovAuthservice(uint64(m.Limit))
+	}
+	l = len(m.StartKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovAuthservice(uint64(len(k))) + 1 + len(v) + sovAuthservice(uint64(len(v)))
+			n += mapEntrySize + 1 + sovAuthservice(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.PredicateExpression)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if len(m.SearchKeywords) > 0 {
+		for _, s := range m.SearchKeywords {
+			l = len(s)
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = m.WindowsDesktopFilter.Size()
+	n += 1 + l + sovAuthservice(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListWindowsDesktopsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Desktops) > 0 {
+		for _, e := range m.Desktops {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *GetWindowsDesktopsResponse) Size() (n int) {
 	if m == nil {
 		return 0
@@ -30030,6 +33619,10 @@ func (m *WindowsDesktopCertRequest) Size() (n int) {
 	if m.TTL != 0 {
 		n += 1 + sovAuthservice(uint64(m.TTL))
 	}
+	l = len(m.CRLDomain)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -30737,6 +34330,47 @@ func (m *IdentityCenterAccountAssignment) Size() (n int) {
 	return n
 }
 
+func (m *ListInstallersRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListInstallersResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Installers) > 0 {
+		for _, e := range m.Installers {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *PaginatedResource) Size() (n int) {
 	if m == nil {
 		return 0
@@ -31522,6 +35156,50 @@ func (m *GetGithubAuthRequestRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListOIDCConnectorsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.WithSecrets {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListOIDCConnectorsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Connectors) > 0 {
+		for _, e := range m.Connectors {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *CreateOIDCConnectorRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -31618,6 +35296,97 @@ func (m *UpsertSAMLConnectorRequest) Size() (n int) {
 	return n
 }
 
+func (m *ListSAMLConnectorsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.WithSecrets {
+		n += 2
+	}
+	if m.NoFollowUrls {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListSAMLConnectorsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Connectors) > 0 {
+		for _, e := range m.Connectors {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListGithubConnectorsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.WithSecrets {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListGithubConnectorsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Connectors) > 0 {
+		for _, e := range m.Connectors {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *CreateGithubConnectorRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -32176,6 +35945,139 @@ func (m *AccessRequestAllowedPromotionResponse) Size() (n int) {
 	return n
 }
 
+func (m *ListProvisionTokensRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Limit != 0 {
+		n += 1 + sovAuthservice(uint64(m.Limit))
+	}
+	l = len(m.StartKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if len(m.FilterRoles) > 0 {
+		for _, s := range m.FilterRoles {
+			l = len(s)
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.FilterBotName)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListProvisionTokensResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Tokens) > 0 {
+		for _, e := range m.Tokens {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextKey)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListKubernetesClustersRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListKubernetesClustersResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.KubernetesClusters) > 0 {
+		for _, e := range m.KubernetesClusters {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListSnowflakeSessionsRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PageSize != 0 {
+		n += 1 + sovAuthservice(uint64(m.PageSize))
+	}
+	l = len(m.PageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ListSnowflakeSessionsResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Sessions) > 0 {
+		for _, e := range m.Sessions {
+			l = e.Size()
+			n += 1 + l + sovAuthservice(uint64(l))
+		}
+	}
+	l = len(m.NextPageToken)
+	if l > 0 {
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func sovAuthservice(x uint64) (n int) {
 	return (math_bits.Len64(x|1) + 6) / 7
 }
@@ -34830,7 +38732,7 @@ func (m *ChangePasswordRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PluginDataSeq) Unmarshal(dAtA []byte) error {
+func (m *ListSemaphoresRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -34853,15 +38755,270 @@ func (m *PluginDataSeq) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PluginDataSeq: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSemaphoresRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginDataSeq: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSemaphoresRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Filter == nil {
+				m.Filter = &types.SemaphoreFilter{}
+			}
+			if err := m.Filter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListSemaphoresResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListSemaphoresResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListSemaphoresResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Semaphores", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Semaphores = append(m.Semaphores, &types.SemaphoreV3{})
+			if err := m.Semaphores[len(m.Semaphores)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginDataSeq) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginDataSeq: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginDataSeq: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -35482,7 +39639,7 @@ func (m *CreateResetPasswordTokenRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
+func (m *ListResetPasswordTokenRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -35505,17 +39662,17 @@ func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RenewableCertsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListResetPasswordTokenRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RenewableCertsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListResetPasswordTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Token", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
 			}
-			var stringLen uint64
+			m.PageSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -35525,29 +39682,16 @@ func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.PageSize |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Token = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -35557,25 +39701,23 @@ func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.PublicKey == nil {
-				m.PublicKey = []byte{}
-			}
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -35599,7 +39741,7 @@ func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PingRequest) Unmarshal(dAtA []byte) error {
+func (m *ListResetPasswordTokenResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -35622,10 +39764,244 @@ func (m *PingRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PingRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListResetPasswordTokenResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListResetPasswordTokenResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTokens", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserTokens = append(m.UserTokens, &types.UserTokenV3{})
+			if err := m.UserTokens[len(m.UserTokens)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RenewableCertsRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RenewableCertsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RenewableCertsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Token", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Token = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PublicKey == nil {
+				m.PublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PingRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PingRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		default:
@@ -36868,6 +41244,26 @@ func (m *Features) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.AccessGraphDemoMode = bool(v != 0)
+		case 39:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientIPRestrictions", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ClientIPRestrictions = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -41634,7 +46030,7 @@ func (m *GetWebTokensResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertKubernetesServerRequest) Unmarshal(dAtA []byte) error {
+func (m *ListWebTokensRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -41657,17 +46053,36 @@ func (m *UpsertKubernetesServerRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertKubernetesServerRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListWebTokensRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertKubernetesServerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListWebTokensRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Server", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -41677,27 +46092,23 @@ func (m *UpsertKubernetesServerRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Server == nil {
-				m.Server = &types.KubernetesServerV3{}
-			}
-			if err := m.Server.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -41721,7 +46132,7 @@ func (m *UpsertKubernetesServerRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteKubernetesServerRequest) Unmarshal(dAtA []byte) error {
+func (m *ListWebTokensResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -41744,15 +46155,219 @@ func (m *DeleteKubernetesServerRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteKubernetesServerRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListWebTokensResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteKubernetesServerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListWebTokensResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tokens", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Tokens = append(m.Tokens, &types.WebTokenV3{})
+			if err := m.Tokens[len(m.Tokens)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpsertKubernetesServerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpsertKubernetesServerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpsertKubernetesServerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Server", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Server == nil {
+				m.Server = &types.KubernetesServerV3{}
+			}
+			if err := m.Server.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteKubernetesServerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteKubernetesServerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteKubernetesServerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -42877,96 +47492,11 @@ func (m *DatabaseCertRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.CRLEndpoint = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DatabaseCertResponse) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseCertResponse: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseCertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Cert", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Cert = append(m.Cert[:0], dAtA[iNdEx:postIndex]...)
-			if m.Cert == nil {
-				m.Cert = []byte{}
-			}
-			iNdEx = postIndex
-		case 2:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CACerts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CRLDomain", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -42976,23 +47506,140 @@ func (m *DatabaseCertResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CACerts = append(m.CACerts, make([]byte, postIndex-iNdEx))
-			copy(m.CACerts[len(m.CACerts)-1], dAtA[iNdEx:postIndex])
+			m.CRLDomain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DatabaseCertResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DatabaseCertResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DatabaseCertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cert", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Cert = append(m.Cert[:0], dAtA[iNdEx:postIndex]...)
+			if m.Cert == nil {
+				m.Cert = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CACerts", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CACerts = append(m.CACerts, make([]byte, postIndex-iNdEx))
+			copy(m.CACerts[len(m.CACerts)-1], dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -47118,6 +51765,38 @@ func (m *GetEventsRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Search", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Search = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -47634,7 +52313,7 @@ func (m *GetLocksResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetLockRequest) Unmarshal(dAtA []byte) error {
+func (m *ListLocksRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -47657,15 +52336,34 @@ func (m *GetLockRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetLockRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListLocksRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetLockRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListLocksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -47693,7 +52391,43 @@ func (m *GetLockRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Filter == nil {
+				m.Filter = &types.LockFilter{}
+			}
+			if err := m.Filter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -47717,7 +52451,7 @@ func (m *GetLockRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteLockRequest) Unmarshal(dAtA []byte) error {
+func (m *ListLocksResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -47740,15 +52474,49 @@ func (m *DeleteLockRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteLockRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListLocksResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteLockRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListLocksResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Locks", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Locks = append(m.Locks, &types.LockV2{})
+			if err := m.Locks[len(m.Locks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -47776,7 +52544,7 @@ func (m *DeleteLockRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -47800,7 +52568,7 @@ func (m *DeleteLockRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ReplaceRemoteLocksRequest) Unmarshal(dAtA []byte) error {
+func (m *GetLockRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -47823,15 +52591,15 @@ func (m *ReplaceRemoteLocksRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ReplaceRemoteLocksRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetLockRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ReplaceRemoteLocksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetLockRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -47859,41 +52627,7 @@ func (m *ReplaceRemoteLocksRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Locks", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Locks = append(m.Locks, &types.LockV2{})
-			if err := m.Locks[len(m.Locks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -47917,7 +52651,7 @@ func (m *ReplaceRemoteLocksRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetWindowsDesktopServicesResponse) Unmarshal(dAtA []byte) error {
+func (m *DeleteLockRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -47940,17 +52674,17 @@ func (m *GetWindowsDesktopServicesResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetWindowsDesktopServicesResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeleteLockRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetWindowsDesktopServicesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeleteLockRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Services", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -47960,25 +52694,23 @@ func (m *GetWindowsDesktopServicesResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Services = append(m.Services, &types.WindowsDesktopServiceV3{})
-			if err := m.Services[len(m.Services)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -48002,7 +52734,7 @@ func (m *GetWindowsDesktopServicesResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
+func (m *ReplaceRemoteLocksRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48025,15 +52757,15 @@ func (m *GetWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetWindowsDesktopServiceRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ReplaceRemoteLocksRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetWindowsDesktopServiceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ReplaceRemoteLocksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48061,62 +52793,11 @@ func (m *GetWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GetWindowsDesktopServiceResponse) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GetWindowsDesktopServiceResponse: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetWindowsDesktopServiceResponse: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Locks", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -48143,10 +52824,8 @@ func (m *GetWindowsDesktopServiceResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Service == nil {
-				m.Service = &types.WindowsDesktopServiceV3{}
-			}
-			if err := m.Service.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Locks = append(m.Locks, &types.LockV2{})
+			if err := m.Locks[len(m.Locks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -48172,7 +52851,7 @@ func (m *GetWindowsDesktopServiceResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
+func (m *ListAppsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48195,15 +52874,34 @@ func (m *DeleteWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteWindowsDesktopServiceRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListAppsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteWindowsDesktopServiceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListAppsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48231,7 +52929,7 @@ func (m *DeleteWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.StartKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -48255,7 +52953,7 @@ func (m *DeleteWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
+func (m *ListAppsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48278,15 +52976,15 @@ func (m *GetWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetWindowsDesktopsResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListAppsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetWindowsDesktopsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListAppsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Desktops", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Applications", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -48313,11 +53011,43 @@ func (m *GetWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Desktops = append(m.Desktops, &types.WindowsDesktopV3{})
-			if err := m.Desktops[len(m.Desktops)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Applications = append(m.Applications, &types.AppV3{})
+			if err := m.Applications[len(m.Applications)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -48340,7 +53070,7 @@ func (m *GetWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
+func (m *ListDatabasesRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48363,17 +53093,17 @@ func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteWindowsDesktopRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListDatabasesRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteWindowsDesktopRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListDatabasesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
 			}
-			var stringLen uint64
+			m.PageSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -48383,27 +53113,14 @@ func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.PageSize |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Name = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48431,7 +53148,7 @@ func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.HostID = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -48455,7 +53172,7 @@ func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
+func (m *ListDatabasesResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48478,17 +53195,17 @@ func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WindowsDesktopCertRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListDatabasesResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WindowsDesktopCertRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListDatabasesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CSR", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Databases", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -48498,29 +53215,29 @@ func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CSR = append(m.CSR[:0], dAtA[iNdEx:postIndex]...)
-			if m.CSR == nil {
-				m.CSR = []byte{}
+			m.Databases = append(m.Databases, &types.DatabaseV3{})
+			if err := m.Databases[len(m.Databases)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CRLEndpoint", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48548,27 +53265,8 @@ func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CRLEndpoint = string(dAtA[iNdEx:postIndex])
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TTL", wireType)
-			}
-			m.TTL = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TTL |= Duration(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -48591,7 +53289,7 @@ func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WindowsDesktopCertResponse) Unmarshal(dAtA []byte) error {
+func (m *GetWindowsDesktopServicesResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48614,17 +53312,17 @@ func (m *WindowsDesktopCertResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WindowsDesktopCertResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetWindowsDesktopServicesResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WindowsDesktopCertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetWindowsDesktopServicesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Cert", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Services", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -48634,24 +53332,24 @@ func (m *WindowsDesktopCertResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Cert = append(m.Cert[:0], dAtA[iNdEx:postIndex]...)
-			if m.Cert == nil {
-				m.Cert = []byte{}
+			m.Services = append(m.Services, &types.WindowsDesktopServiceV3{})
+			if err := m.Services[len(m.Services)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
 		default:
@@ -48676,7 +53374,7 @@ func (m *WindowsDesktopCertResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DesktopBootstrapScriptResponse) Unmarshal(dAtA []byte) error {
+func (m *GetWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48699,15 +53397,15 @@ func (m *DesktopBootstrapScriptResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopBootstrapScriptResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetWindowsDesktopServiceRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopBootstrapScriptResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetWindowsDesktopServiceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Script", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48735,7 +53433,7 @@ func (m *DesktopBootstrapScriptResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Script = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -48759,7 +53457,7 @@ func (m *DesktopBootstrapScriptResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
+func (m *GetWindowsDesktopServiceResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48782,17 +53480,17 @@ func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetWindowsDesktopServiceResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetWindowsDesktopServiceResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
 			}
-			m.Limit = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -48802,14 +53500,82 @@ func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Limit |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 2:
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Service == nil {
+				m.Service = &types.WindowsDesktopServiceV3{}
+			}
+			if err := m.Service.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteWindowsDesktopServiceRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteWindowsDesktopServiceRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteWindowsDesktopServiceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48837,7 +53603,7 @@ func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -48861,7 +53627,7 @@ func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
+func (m *ListWindowsDesktopsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -48884,15 +53650,66 @@ func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListWindowsDesktopsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListWindowsDesktopsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviders", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StartKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -48919,14 +53736,107 @@ func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServiceProviders = append(m.ServiceProviders, &types.SAMLIdPServiceProviderV1{})
-			if err := m.ServiceProviders[len(m.ServiceProviders)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowAuthservice
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipAuthservice(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.Labels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -48954,13 +53864,13 @@ func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
 			}
-			m.TotalCount = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -48970,11 +53880,57 @@ func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.TotalCount |= int32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -48997,7 +53953,7 @@ func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
+func (m *ListWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49020,15 +53976,49 @@ func (m *GetSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetSAMLIdPServiceProviderRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListWindowsDesktopsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSAMLIdPServiceProviderRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListWindowsDesktopsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Desktops", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Desktops = append(m.Desktops, &types.WindowsDesktopV3{})
+			if err := m.Desktops[len(m.Desktops)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49056,7 +54046,7 @@ func (m *GetSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49080,7 +54070,7 @@ func (m *GetSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
+func (m *GetWindowsDesktopsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49103,17 +54093,17 @@ func (m *DeleteSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteSAMLIdPServiceProviderRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetWindowsDesktopsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteSAMLIdPServiceProviderRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetWindowsDesktopsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Desktops", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49123,23 +54113,25 @@ func (m *DeleteSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Desktops = append(m.Desktops, &types.WindowsDesktopV3{})
+			if err := m.Desktops[len(m.Desktops)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49163,7 +54155,7 @@ func (m *DeleteSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
+func (m *DeleteWindowsDesktopRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49186,17 +54178,17 @@ func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListUserGroupsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeleteWindowsDesktopRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListUserGroupsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeleteWindowsDesktopRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			m.Limit = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49206,14 +54198,27 @@ func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Limit |= int32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49241,7 +54246,7 @@ func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.HostID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49265,7 +54270,7 @@ func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
+func (m *WindowsDesktopCertRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49288,17 +54293,17 @@ func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListUserGroupsResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: WindowsDesktopCertRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListUserGroupsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WindowsDesktopCertRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserGroups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CSR", wireType)
 			}
-			var msglen int
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49308,29 +54313,29 @@ func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UserGroups = append(m.UserGroups, &types.UserGroupV1{})
-			if err := m.UserGroups[len(m.UserGroups)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.CSR = append(m.CSR[:0], dAtA[iNdEx:postIndex]...)
+			if m.CSR == nil {
+				m.CSR = []byte{}
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CRLEndpoint", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49358,13 +54363,13 @@ func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.CRLEndpoint = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TTL", wireType)
 			}
-			m.TotalCount = 0
+			m.TTL = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49374,11 +54379,43 @@ func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.TotalCount |= int32(b&0x7F) << shift
+				m.TTL |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CRLDomain", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CRLDomain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -49401,7 +54438,7 @@ func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetUserGroupRequest) Unmarshal(dAtA []byte) error {
+func (m *WindowsDesktopCertResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49424,17 +54461,17 @@ func (m *GetUserGroupRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetUserGroupRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: WindowsDesktopCertResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetUserGroupRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WindowsDesktopCertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Cert", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49444,24 +54481,26 @@ func (m *GetUserGroupRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
+			m.Cert = append(m.Cert[:0], dAtA[iNdEx:postIndex]...)
+			if m.Cert == nil {
+				m.Cert = []byte{}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -49484,7 +54523,7 @@ func (m *GetUserGroupRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeleteUserGroupRequest) Unmarshal(dAtA []byte) error {
+func (m *DesktopBootstrapScriptResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49507,15 +54546,15 @@ func (m *DeleteUserGroupRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeleteUserGroupRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: DesktopBootstrapScriptResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeleteUserGroupRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DesktopBootstrapScriptResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Script", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49543,7 +54582,7 @@ func (m *DeleteUserGroupRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Script = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49567,7 +54606,7 @@ func (m *DeleteUserGroupRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertAuthorityRequest) Unmarshal(dAtA []byte) error {
+func (m *ListSAMLIdPServiceProvidersRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49590,15 +54629,34 @@ func (m *CertAuthorityRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertAuthorityRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertAuthorityRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49626,7 +54684,7 @@ func (m *CertAuthorityRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Type = github_com_gravitational_teleport_api_types.CertAuthType(dAtA[iNdEx:postIndex])
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49650,7 +54708,7 @@ func (m *CertAuthorityRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CRL) Unmarshal(dAtA []byte) error {
+func (m *ListSAMLIdPServiceProvidersResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49673,17 +54731,17 @@ func (m *CRL) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CRL: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CRL: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSAMLIdPServiceProvidersResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CRL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviders", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49693,26 +54751,77 @@ func (m *CRL) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CRL = append(m.CRL[:0], dAtA[iNdEx:postIndex]...)
-			if m.CRL == nil {
-				m.CRL = []byte{}
+			m.ServiceProviders = append(m.ServiceProviders, &types.SAMLIdPServiceProviderV1{})
+			if err := m.ServiceProviders[len(m.ServiceProviders)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
+			}
+			m.TotalCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TotalCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -49735,7 +54844,7 @@ func (m *CRL) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
+func (m *GetSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49758,15 +54867,15 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ChangeUserAuthenticationRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetSAMLIdPServiceProviderRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ChangeUserAuthenticationRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetSAMLIdPServiceProviderRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49794,47 +54903,64 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TokenID = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewPassword", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if byteLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteSAMLIdPServiceProviderRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NewPassword = append(m.NewPassword[:0], dAtA[iNdEx:postIndex]...)
-			if m.NewPassword == nil {
-				m.NewPassword = []byte{}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 3:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteSAMLIdPServiceProviderRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteSAMLIdPServiceProviderRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewMFARegisterResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49844,33 +54970,80 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NewMFARegisterResponse == nil {
-				m.NewMFARegisterResponse = &MFARegisterResponse{}
-			}
-			if err := m.NewMFARegisterResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewDeviceName", wireType)
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			var stringLen uint64
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListUserGroupsRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListUserGroupsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListUserGroupsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -49880,27 +55053,14 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.Limit |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.NewDeviceName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LoginIP", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49928,7 +55088,7 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.LoginIP = string(dAtA[iNdEx:postIndex])
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49952,7 +55112,7 @@ func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
+func (m *ListUserGroupsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49975,15 +55135,15 @@ func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ChangeUserAuthenticationResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListUserGroupsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ChangeUserAuthenticationResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListUserGroupsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WebSession", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserGroups", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -50010,18 +55170,16 @@ func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.WebSession == nil {
-				m.WebSession = &types.WebSessionV2{}
-			}
-			if err := m.WebSession.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.UserGroups = append(m.UserGroups, &types.UserGroupV1{})
+			if err := m.UserGroups[len(m.UserGroups)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Recovery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50031,33 +55189,29 @@ func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Recovery == nil {
-				m.Recovery = &RecoveryCodes{}
-			}
-			if err := m.Recovery.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicyEnabled", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
 			}
-			var v int
+			m.TotalCount = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50067,12 +55221,11 @@ func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				m.TotalCount |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.PrivateKeyPolicyEnabled = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -50095,7 +55248,7 @@ func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StartAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
+func (m *GetUserGroupRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50118,15 +55271,15 @@ func (m *StartAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StartAccountRecoveryRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetUserGroupRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StartAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetUserGroupRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50154,61 +55307,8 @@ func (m *StartAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCode", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.RecoveryCode = append(m.RecoveryCode[:0], dAtA[iNdEx:postIndex]...)
-			if m.RecoveryCode == nil {
-				m.RecoveryCode = []byte{}
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoverType", wireType)
-			}
-			m.RecoverType = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.RecoverType |= types.UserTokenUsage(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -50231,7 +55331,7 @@ func (m *StartAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
+func (m *DeleteUserGroupRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50254,15 +55354,15 @@ func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: VerifyAccountRecoveryRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeleteUserGroupRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: VerifyAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeleteUserGroupRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryStartTokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50290,11 +55390,62 @@ func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RecoveryStartTokenID = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertAuthorityRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertAuthorityRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertAuthorityRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50322,46 +55473,64 @@ func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			m.Type = github_com_gravitational_teleport_api_types.CertAuthType(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if byteLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CRL) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			v := make([]byte, postIndex-iNdEx)
-			copy(v, dAtA[iNdEx:postIndex])
-			m.AuthnCred = &VerifyAccountRecoveryRequest_Password{v}
-			iNdEx = postIndex
-		case 4:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CRL: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CRL: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFAAuthenticateResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CRL", wireType)
 			}
-			var msglen int
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50371,26 +55540,25 @@ func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MFAAuthenticateResponse{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.CRL = append(m.CRL[:0], dAtA[iNdEx:postIndex]...)
+			if m.CRL == nil {
+				m.CRL = []byte{}
 			}
-			m.AuthnCred = &VerifyAccountRecoveryRequest_MFAAuthenticateResponse{v}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -50414,7 +55582,7 @@ func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
+func (m *ChangeUserAuthenticationRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50437,15 +55605,15 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CompleteAccountRecoveryRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ChangeUserAuthenticationRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CompleteAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ChangeUserAuthenticationRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryApprovedTokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50473,13 +55641,13 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RecoveryApprovedTokenID = string(dAtA[iNdEx:postIndex])
+			m.TokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewDeviceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewPassword", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50489,29 +55657,31 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NewDeviceName = string(dAtA[iNdEx:postIndex])
+			m.NewPassword = append(m.NewPassword[:0], dAtA[iNdEx:postIndex]...)
+			if m.NewPassword == nil {
+				m.NewPassword = []byte{}
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewPassword", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewMFARegisterResponse", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50521,30 +55691,33 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := make([]byte, postIndex-iNdEx)
-			copy(v, dAtA[iNdEx:postIndex])
-			m.NewAuthnCred = &CompleteAccountRecoveryRequest_NewPassword{v}
+			if m.NewMFARegisterResponse == nil {
+				m.NewMFARegisterResponse = &MFARegisterResponse{}
+			}
+			if err := m.NewMFARegisterResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NewMFAResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewDeviceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50554,26 +55727,55 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MFARegisterResponse{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.NewDeviceName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LoginIP", wireType)
 			}
-			m.NewAuthnCred = &CompleteAccountRecoveryRequest_NewMFAResponse{v}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LoginIP = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -50597,7 +55799,7 @@ func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
+func (m *ChangeUserAuthenticationResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50620,17 +55822,17 @@ func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RecoveryCodes: wiretype end group for non-group")
+			return fmt.Errorf("proto: ChangeUserAuthenticationResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RecoveryCodes: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ChangeUserAuthenticationResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Codes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WebSession", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50640,27 +55842,31 @@ func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Codes = append(m.Codes, string(dAtA[iNdEx:postIndex]))
+			if m.WebSession == nil {
+				m.WebSession = &types.WebSessionV2{}
+			}
+			if err := m.WebSession.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Created", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Recovery", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -50687,10 +55893,33 @@ func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Created, dAtA[iNdEx:postIndex]); err != nil {
+			if m.Recovery == nil {
+				m.Recovery = &RecoveryCodes{}
+			}
+			if err := m.Recovery.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicyEnabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.PrivateKeyPolicyEnabled = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -50713,7 +55942,7 @@ func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
+func (m *StartAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50736,15 +55965,15 @@ func (m *CreateAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateAccountRecoveryCodesRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: StartAccountRecoveryRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateAccountRecoveryCodesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: StartAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50772,64 +56001,13 @@ func (m *CreateAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TokenID = string(dAtA[iNdEx:postIndex])
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GetAccountRecoveryTokenRequest) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GetAccountRecoveryTokenRequest: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetAccountRecoveryTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryTokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCode", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -50839,75 +56017,45 @@ func (m *GetAccountRecoveryTokenRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RecoveryTokenID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GetAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
+			m.RecoveryCode = append(m.RecoveryCode[:0], dAtA[iNdEx:postIndex]...)
+			if m.RecoveryCode == nil {
+				m.RecoveryCode = []byte{}
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoverType", wireType)
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.RecoverType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.RecoverType |= types.UserTokenUsage(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GetAccountRecoveryCodesRequest: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetAccountRecoveryCodesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -50930,7 +56078,7 @@ func (m *GetAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserCredentials) Unmarshal(dAtA []byte) error {
+func (m *VerifyAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -50953,15 +56101,15 @@ func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserCredentials: wiretype end group for non-group")
+			return fmt.Errorf("proto: VerifyAccountRecoveryRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserCredentials: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VerifyAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryStartTokenID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50989,13 +56137,13 @@ func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			m.RecoveryStartTokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51005,128 +56153,92 @@ func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Password = append(m.Password[:0], dAtA[iNdEx:postIndex]...)
-			if m.Password == nil {
-				m.Password = []byte{}
-			}
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			if byteLen < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ContextUser) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			v := make([]byte, postIndex-iNdEx)
+			copy(v, dAtA[iNdEx:postIndex])
+			m.AuthnCred = &VerifyAccountRecoveryRequest_Password{v}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MFAAuthenticateResponse", wireType)
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ContextUser: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ContextUser: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Passwordless) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			v := &MFAAuthenticateResponse{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Passwordless: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Passwordless: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
+			m.AuthnCred = &VerifyAccountRecoveryRequest_MFAAuthenticateResponse{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -51149,7 +56261,7 @@ func (m *Passwordless) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
+func (m *CompleteAccountRecoveryRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -51172,17 +56284,17 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CompleteAccountRecoveryRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CompleteAccountRecoveryRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserCredentials", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryApprovedTokenID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51192,30 +56304,27 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserCredentials{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Request = &CreateAuthenticateChallengeRequest_UserCredentials{v}
+			m.RecoveryApprovedTokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryStartTokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewDeviceName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -51243,13 +56352,13 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Request = &CreateAuthenticateChallengeRequest_RecoveryStartTokenID{string(dAtA[iNdEx:postIndex])}
+			m.NewDeviceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContextUser", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewPassword", wireType)
 			}
-			var msglen int
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51259,30 +56368,28 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ContextUser{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Request = &CreateAuthenticateChallengeRequest_ContextUser{v}
+			v := make([]byte, postIndex-iNdEx)
+			copy(v, dAtA[iNdEx:postIndex])
+			m.NewAuthnCred = &CompleteAccountRecoveryRequest_NewPassword{v}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Passwordless", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NewMFAResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -51309,87 +56416,66 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &Passwordless{}
+			v := &MFARegisterResponse{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Request = &CreateAuthenticateChallengeRequest_Passwordless{v}
+			m.NewAuthnCred = &CompleteAccountRecoveryRequest_NewMFAResponse{v}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFARequiredCheck", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MFARequiredCheck == nil {
-				m.MFARequiredCheck = &IsMFARequiredRequest{}
-			}
-			if err := m.MFARequiredCheck.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeExtensions", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RecoveryCodes) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ChallengeExtensions == nil {
-				m.ChallengeExtensions = &v11.ChallengeExtensions{}
-			}
-			if err := m.ChallengeExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 7:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RecoveryCodes: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RecoveryCodes: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SSOClientRedirectURL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Codes", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -51417,13 +56503,13 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SSOClientRedirectURL = string(dAtA[iNdEx:postIndex])
+			m.Codes = append(m.Codes, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProxyAddress", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Created", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51433,23 +56519,24 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ProxyAddress = string(dAtA[iNdEx:postIndex])
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Created, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -51473,7 +56560,7 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreatePrivilegeTokenRequest) Unmarshal(dAtA []byte) error {
+func (m *CreateAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -51496,17 +56583,17 @@ func (m *CreatePrivilegeTokenRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateAccountRecoveryCodesRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateAccountRecoveryCodesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExistingMFAResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51516,27 +56603,23 @@ func (m *CreatePrivilegeTokenRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ExistingMFAResponse == nil {
-				m.ExistingMFAResponse = &MFAAuthenticateResponse{}
-			}
-			if err := m.ExistingMFAResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.TokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -51560,7 +56643,7 @@ func (m *CreatePrivilegeTokenRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
+func (m *GetAccountRecoveryTokenRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -51583,15 +56666,15 @@ func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateRegisterChallengeRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetAccountRecoveryTokenRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetAccountRecoveryTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryTokenID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -51619,82 +56702,59 @@ func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TokenID = string(dAtA[iNdEx:postIndex])
+			m.RecoveryTokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceType", wireType)
-			}
-			m.DeviceType = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DeviceType |= DeviceType(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
-			}
-			m.DeviceUsage = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExistingMFAResponse", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ExistingMFAResponse == nil {
-				m.ExistingMFAResponse = &MFAAuthenticateResponse{}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetAccountRecoveryCodesRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
 			}
-			if err := m.ExistingMFAResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
 			}
-			iNdEx = postIndex
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetAccountRecoveryCodesRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetAccountRecoveryCodesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -51717,7 +56777,7 @@ func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
+func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -51740,15 +56800,15 @@ func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: IdentityCenterAccount: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserCredentials: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IdentityCenterAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserCredentials: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -51776,13 +56836,13 @@ func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ID = string(dAtA[iNdEx:postIndex])
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -51792,87 +56852,25 @@ func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ARN = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccountName", wireType)
+			m.Password = append(m.Password[:0], dAtA[iNdEx:postIndex]...)
+			if m.Password == nil {
+				m.Password = []byte{}
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.AccountName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Description = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -51896,7 +56894,7 @@ func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *IdentityCenterPermissionSet) Unmarshal(dAtA []byte) error {
+func (m *ContextUser) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -51919,76 +56917,63 @@ func (m *IdentityCenterPermissionSet) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: IdentityCenterPermissionSet: wiretype end group for non-group")
+			return fmt.Errorf("proto: ContextUser: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IdentityCenterPermissionSet: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ContextUser: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ARN = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Passwordless) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Passwordless: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Passwordless: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -52011,7 +56996,7 @@ func (m *IdentityCenterPermissionSet) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
+func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52034,17 +57019,17 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: IdentityCenterAccountAssignment: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IdentityCenterAccountAssignment: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserCredentials", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52054,27 +57039,30 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			v := &UserCredentials{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Request = &CreateAuthenticateChallengeRequest_UserCredentials{v}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryStartTokenID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52102,13 +57090,13 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubKind = string(dAtA[iNdEx:postIndex])
+			m.Request = &CreateAuthenticateChallengeRequest_RecoveryStartTokenID{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ContextUser", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52118,27 +57106,30 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Version = string(dAtA[iNdEx:postIndex])
+			v := &ContextUser{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Request = &CreateAuthenticateChallengeRequest_ContextUser{v}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Passwordless", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -52165,15 +57156,17 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &Passwordless{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Request = &CreateAuthenticateChallengeRequest_Passwordless{v}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DisplayName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFARequiredCheck", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52183,27 +57176,31 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DisplayName = string(dAtA[iNdEx:postIndex])
+			if m.MFARequiredCheck == nil {
+				m.MFARequiredCheck = &IsMFARequiredRequest{}
+			}
+			if err := m.MFARequiredCheck.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Account", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeExtensions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -52230,18 +57227,18 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Account == nil {
-				m.Account = &IdentityCenterAccount{}
+			if m.ChallengeExtensions == nil {
+				m.ChallengeExtensions = &v11.ChallengeExtensions{}
 			}
-			if err := m.Account.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ChallengeExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PermissionSet", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SSOClientRedirectURL", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52251,27 +57248,55 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.PermissionSet == nil {
-				m.PermissionSet = &IdentityCenterPermissionSet{}
+			m.SSOClientRedirectURL = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProxyAddress", wireType)
 			}
-			if err := m.PermissionSet.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProxyAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -52295,7 +57320,7 @@ func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
+func (m *CreatePrivilegeTokenRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52318,15 +57343,15 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PaginatedResource: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PaginatedResource: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseServer", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExistingMFAResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -52353,17 +57378,69 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.DatabaseServerV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.ExistingMFAResponse == nil {
+				m.ExistingMFAResponse = &MFAAuthenticateResponse{}
+			}
+			if err := m.ExistingMFAResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Resource = &PaginatedResource_DatabaseServer{v}
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateRegisterChallengeRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppServer", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52373,32 +57450,29 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.AppServerV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_AppServer{v}
+			m.TokenID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Node", wireType)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceType", wireType)
 			}
-			var msglen int
+			m.DeviceType = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52408,32 +57482,16 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.DeviceType |= DeviceType(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &types.ServerV2{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_Node{v}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktop", wireType)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
 			}
-			var msglen int
+			m.DeviceUsage = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52443,30 +57501,14 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &types.WindowsDesktopV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_WindowsDesktop{v}
-			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeCluster", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExistingMFAResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -52493,17 +57535,69 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.KubernetesClusterV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.ExistingMFAResponse == nil {
+				m.ExistingMFAResponse = &MFAAuthenticateResponse{}
+			}
+			if err := m.ExistingMFAResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Resource = &PaginatedResource_KubeCluster{v}
 			iNdEx = postIndex
-		case 7:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IdentityCenterAccount) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IdentityCenterAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IdentityCenterAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesServer", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52513,32 +57607,29 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.KubernetesServerV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_KubernetesServer{v}
+			m.ID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52548,32 +57639,29 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.WindowsDesktopServiceV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_WindowsDesktopService{v}
+			m.ARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseService", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccountName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52583,32 +57671,29 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.DatabaseServiceV1{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_DatabaseService{v}
+			m.AccountName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 10:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserGroup", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52618,65 +57703,78 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.UserGroupV1{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_UserGroup{v}
+			m.Description = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 12:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProvider", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IdentityCenterPermissionSet) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.SAMLIdPServiceProviderV1{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Resource = &PaginatedResource_SAMLIdPServiceProvider{v}
-			iNdEx = postIndex
-		case 13:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IdentityCenterPermissionSet: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IdentityCenterPermissionSet: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Logins", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52704,68 +57802,13 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Logins = append(m.Logins, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 14:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequiresRequest", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.RequiresRequest = bool(v != 0)
-		case 15:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GitServer", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &types.ServerV2{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_GitServer{v}
+			m.ARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 16:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IdentityCenterAccountAssignment", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52775,26 +57818,23 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &IdentityCenterAccountAssignment{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_IdentityCenterAccountAssignment{v}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -52818,7 +57858,7 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
+func (m *IdentityCenterAccountAssignment) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52841,15 +57881,15 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListUnifiedResourcesRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: IdentityCenterAccountAssignment: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListUnifiedResourcesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: IdentityCenterAccountAssignment: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kinds", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52877,30 +57917,11 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kinds = append(m.Kinds, string(dAtA[iNdEx:postIndex]))
+			m.Kind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
-			}
-			m.Limit = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Limit |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52928,13 +57949,13 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StartKey = string(dAtA[iNdEx:postIndex])
+			m.SubKind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -52944,124 +57965,29 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Labels == nil {
-				m.Labels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowAuthservice
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipAuthservice(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.Labels[mapkey] = mapvalue
+			m.Version = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53071,27 +57997,28 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DisplayName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53119,11 +58046,11 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			m.DisplayName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SortBy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Account", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53150,13 +58077,16 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SortBy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Account == nil {
+				m.Account = &IdentityCenterAccount{}
+			}
+			if err := m.Account.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 8:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PermissionSet", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53183,110 +58113,13 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.PermissionSet == nil {
+				m.PermissionSet = &IdentityCenterPermissionSet{}
+			}
+			if err := m.PermissionSet.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UseSearchAsRoles", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.UseSearchAsRoles = bool(v != 0)
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UsePreviewAsRoles", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.UsePreviewAsRoles = bool(v != 0)
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PinnedOnly", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.PinnedOnly = bool(v != 0)
-		case 12:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IncludeLogins", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.IncludeLogins = bool(v != 0)
-		case 14:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IncludeRequestable", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.IncludeRequestable = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -53309,7 +58142,7 @@ func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
+func (m *ListInstallersRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -53332,17 +58165,17 @@ func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListUnifiedResourcesResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListInstallersRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListUnifiedResourcesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListInstallersRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
 			}
-			var msglen int
+			m.PageSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53352,29 +58185,14 @@ func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.PageSize |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Resources = append(m.Resources, &PaginatedResource{})
-			if err := m.Resources[len(m.Resources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53402,7 +58220,7 @@ func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -53426,7 +58244,7 @@ func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
+func (m *ListInstallersResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -53449,17 +58267,17 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListResourcesRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListInstallersResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListResourcesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListInstallersResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Installers", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53469,27 +58287,29 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceType = string(dAtA[iNdEx:postIndex])
+			m.Installers = append(m.Installers, &types.InstallerV1{})
+			if err := m.Installers[len(m.Installers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53517,13 +58337,64 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Namespace = string(dAtA[iNdEx:postIndex])
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			m.Limit = 0
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PaginatedResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PaginatedResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseServer", wireType)
+			}
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53533,16 +58404,32 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Limit |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 4:
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.DatabaseServerV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_DatabaseServer{v}
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppServer", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53552,27 +58439,30 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StartKey = string(dAtA[iNdEx:postIndex])
+			v := &types.AppServerV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_AppServer{v}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Node", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53599,109 +58489,52 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Labels == nil {
-				m.Labels = make(map[string]string)
+			v := &types.ServerV2{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowAuthservice
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			m.Resource = &PaginatedResource_Node{v}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktop", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipAuthservice(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.Labels[mapkey] = mapvalue
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.WindowsDesktopV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_WindowsDesktop{v}
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeCluster", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53711,29 +58544,32 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
+			v := &types.KubernetesClusterV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_KubeCluster{v}
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesServer", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53743,27 +58579,30 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			v := &types.KubernetesServerV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_KubernetesServer{v}
 			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SortBy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53790,15 +58629,17 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SortBy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &types.WindowsDesktopServiceV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Resource = &PaginatedResource_WindowsDesktopService{v}
 			iNdEx = postIndex
 		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NeedTotalCount", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseService", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53808,15 +58649,30 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.NeedTotalCount = bool(v != 0)
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.DatabaseServiceV1{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_DatabaseService{v}
+			iNdEx = postIndex
 		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserGroup", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53843,15 +58699,17 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &types.UserGroupV1{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Resource = &PaginatedResource_UserGroup{v}
 			iNdEx = postIndex
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UseSearchAsRoles", wireType)
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProvider", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53861,17 +58719,32 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.UseSearchAsRoles = bool(v != 0)
-		case 12:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UsePreviewAsRoles", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
 			}
-			var v int
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.SAMLIdPServiceProviderV1{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_SAMLIdPServiceProvider{v}
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Logins", wireType)
+			}
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -53881,15 +58754,27 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.UsePreviewAsRoles = bool(v != 0)
-		case 13:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Logins = append(m.Logins, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 14:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IncludeLogins", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequiresRequest", wireType)
 			}
 			var v int
 			for shift := uint(0); ; shift += 7 {
@@ -53906,7 +58791,77 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-			m.IncludeLogins = bool(v != 0)
+			m.RequiresRequest = bool(v != 0)
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GitServer", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.ServerV2{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_GitServer{v}
+			iNdEx = postIndex
+		case 16:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IdentityCenterAccountAssignment", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &IdentityCenterAccountAssignment{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_IdentityCenterAccountAssignment{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -53929,7 +58884,7 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
+func (m *ListUnifiedResourcesRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -53952,15 +58907,15 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ResolveSSHTargetRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListUnifiedResourcesRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ResolveSSHTargetRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListUnifiedResourcesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Kinds", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53988,11 +58943,30 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Host = string(dAtA[iNdEx:postIndex])
+			m.Kinds = append(m.Kinds, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54020,9 +58994,9 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Port = string(dAtA[iNdEx:postIndex])
+			m.StartKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
 			}
@@ -54149,7 +59123,7 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.Labels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
 			}
@@ -54181,7 +59155,7 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 6:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
 			}
@@ -54213,29 +59187,1797 @@ func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortBy", wireType)
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SortBy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UseSearchAsRoles", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UseSearchAsRoles = bool(v != 0)
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UsePreviewAsRoles", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UsePreviewAsRoles = bool(v != 0)
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PinnedOnly", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.PinnedOnly = bool(v != 0)
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeLogins", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IncludeLogins = bool(v != 0)
+		case 14:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeRequestable", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IncludeRequestable = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListUnifiedResourcesResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListUnifiedResourcesResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListUnifiedResourcesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resources = append(m.Resources, &PaginatedResource{})
+			if err := m.Resources[len(m.Resources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListResourcesRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListResourcesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StartKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowAuthservice
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipAuthservice(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortBy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SortBy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NeedTotalCount", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.NeedTotalCount = bool(v != 0)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UseSearchAsRoles", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UseSearchAsRoles = bool(v != 0)
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UsePreviewAsRoles", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UsePreviewAsRoles = bool(v != 0)
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeLogins", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IncludeLogins = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ResolveSSHTargetRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResolveSSHTargetRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResolveSSHTargetRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Host = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Port = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowAuthservice
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipAuthservice(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ResolveSSHTargetResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResolveSSHTargetResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResolveSSHTargetResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Server", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Server == nil {
+				m.Server = &types.ServerV2{}
+			}
+			if err := m.Server.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetSSHTargetsRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetSSHTargetsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetSSHTargetsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Host = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Port = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetSSHTargetsResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetSSHTargetsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetSSHTargetsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Servers", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Servers = append(m.Servers, &types.ServerV2{})
+			if err := m.Servers[len(m.Servers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListResourcesResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListResourcesResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListResourcesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resources = append(m.Resources, &PaginatedResource{})
+			if err := m.Resources[len(m.Resources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
+			}
+			m.TotalCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TotalCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateSessionTrackerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionTracker", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SessionTracker == nil {
+				m.SessionTracker = &types.SessionTrackerV1{}
+			}
+			if err := m.SessionTracker.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetSessionTrackerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RemoveSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RemoveSessionTrackerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RemoveSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
 	return nil
 }
-func (m *ResolveSSHTargetResponse) Unmarshal(dAtA []byte) error {
+func (m *SessionTrackerUpdateState) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54258,15 +61000,255 @@ func (m *ResolveSSHTargetResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ResolveSSHTargetResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionTrackerUpdateState: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ResolveSSHTargetResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionTrackerUpdateState: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
+			}
+			m.State = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.State |= types.SessionState(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionTrackerAddParticipant) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionTrackerAddParticipant: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionTrackerAddParticipant: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Participant", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Participant == nil {
+				m.Participant = &types.Participant{}
+			}
+			if err := m.Participant.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionTrackerRemoveParticipant) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionTrackerRemoveParticipant: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionTrackerRemoveParticipant: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParticipantID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ParticipantID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionTrackerUpdateExpiry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionTrackerUpdateExpiry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionTrackerUpdateExpiry: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Server", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54293,12 +61275,235 @@ func (m *ResolveSSHTargetResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Server == nil {
-				m.Server = &types.ServerV2{}
+			if m.Expires == nil {
+				m.Expires = new(time.Time)
 			}
-			if err := m.Server.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.Expires, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpdateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpdateSessionTrackerRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpdateSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdateState", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SessionTrackerUpdateState{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Update = &UpdateSessionTrackerRequest_UpdateState{v}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AddParticipant", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SessionTrackerAddParticipant{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Update = &UpdateSessionTrackerRequest_AddParticipant{v}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemoveParticipant", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SessionTrackerRemoveParticipant{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Update = &UpdateSessionTrackerRequest_RemoveParticipant{v}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdateExpiry", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SessionTrackerUpdateExpiry{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Update = &UpdateSessionTrackerRequest_UpdateExpiry{v}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54322,7 +61527,7 @@ func (m *ResolveSSHTargetResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetSSHTargetsRequest) Unmarshal(dAtA []byte) error {
+func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54345,15 +61550,15 @@ func (m *GetSSHTargetsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetSSHTargetsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: PresenceMFAChallengeRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSSHTargetsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PresenceMFAChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54381,11 +61586,11 @@ func (m *GetSSHTargetsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Host = string(dAtA[iNdEx:postIndex])
+			m.SessionID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SSOClientRedirectURL", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54413,64 +61618,13 @@ func (m *GetSSHTargetsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Port = string(dAtA[iNdEx:postIndex])
+			m.SSOClientRedirectURL = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GetSSHTargetsResponse) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GetSSHTargetsResponse: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSSHTargetsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Servers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ProxyAddress", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -54480,25 +61634,23 @@ func (m *GetSSHTargetsResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Servers = append(m.Servers, &types.ServerV2{})
-			if err := m.Servers[len(m.Servers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ProxyAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54522,7 +61674,7 @@ func (m *GetSSHTargetsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListResourcesResponse) Unmarshal(dAtA []byte) error {
+func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54545,15 +61697,15 @@ func (m *ListResourcesResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListResourcesResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: PresenceMFAChallengeSend: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListResourcesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PresenceMFAChallengeSend: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54580,116 +61732,15 @@ func (m *ListResourcesResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Resources = append(m.Resources, &PaginatedResource{})
-			if err := m.Resources[len(m.Resources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &PresenceMFAChallengeRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Request = &PresenceMFAChallengeSend_ChallengeRequest{v}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
-			}
-			m.TotalCount = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TotalCount |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CreateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CreateSessionTrackerRequest: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 15:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionTracker", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54716,12 +61767,11 @@ func (m *CreateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.SessionTracker == nil {
-				m.SessionTracker = &types.SessionTrackerV1{}
-			}
-			if err := m.SessionTracker.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MFAAuthenticateResponse{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Request = &PresenceMFAChallengeSend_ChallengeResponse{v}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54745,7 +61795,7 @@ func (m *CreateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+func (m *GetDomainNameResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54768,15 +61818,15 @@ func (m *GetSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetSessionTrackerRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetDomainNameResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetDomainNameResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DomainName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54804,7 +61854,7 @@ func (m *GetSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
+			m.DomainName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54828,7 +61878,7 @@ func (m *GetSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RemoveSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+func (m *GetClusterCACertResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54851,17 +61901,17 @@ func (m *RemoveSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RemoveSessionTrackerRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetClusterCACertResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RemoveSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetClusterCACertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TLSCA", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -54871,23 +61921,25 @@ func (m *RemoveSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
+			m.TLSCA = append(m.TLSCA[:0], dAtA[iNdEx:postIndex]...)
+			if m.TLSCA == nil {
+				m.TLSCA = []byte{}
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54911,7 +61963,7 @@ func (m *RemoveSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionTrackerUpdateState) Unmarshal(dAtA []byte) error {
+func (m *GetLicenseResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54934,17 +61986,17 @@ func (m *SessionTrackerUpdateState) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionTrackerUpdateState: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetLicenseResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionTrackerUpdateState: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetLicenseResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field License", wireType)
 			}
-			m.State = 0
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -54954,11 +62006,26 @@ func (m *SessionTrackerUpdateState) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.State |= types.SessionState(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if byteLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.License = append(m.License[:0], dAtA[iNdEx:postIndex]...)
+			if m.License == nil {
+				m.License = []byte{}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -54981,7 +62048,7 @@ func (m *SessionTrackerUpdateState) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionTrackerAddParticipant) Unmarshal(dAtA []byte) error {
+func (m *ListReleasesResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55004,15 +62071,15 @@ func (m *SessionTrackerAddParticipant) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionTrackerAddParticipant: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListReleasesResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionTrackerAddParticipant: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListReleasesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 2:
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Participant", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Releases", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55039,10 +62106,8 @@ func (m *SessionTrackerAddParticipant) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Participant == nil {
-				m.Participant = &types.Participant{}
-			}
-			if err := m.Participant.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Releases = append(m.Releases, &types.Release{})
+			if err := m.Releases[len(m.Releases)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -55068,7 +62133,7 @@ func (m *SessionTrackerAddParticipant) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionTrackerRemoveParticipant) Unmarshal(dAtA []byte) error {
+func (m *GetOIDCAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55091,15 +62156,15 @@ func (m *SessionTrackerRemoveParticipant) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionTrackerRemoveParticipant: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetOIDCAuthRequestRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionTrackerRemoveParticipant: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetOIDCAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 2:
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ParticipantID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55127,7 +62192,7 @@ func (m *SessionTrackerRemoveParticipant) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ParticipantID = string(dAtA[iNdEx:postIndex])
+			m.StateToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -55151,7 +62216,7 @@ func (m *SessionTrackerRemoveParticipant) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionTrackerUpdateExpiry) Unmarshal(dAtA []byte) error {
+func (m *GetSAMLAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55174,17 +62239,17 @@ func (m *SessionTrackerUpdateExpiry) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionTrackerUpdateExpiry: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetSAMLAuthRequestRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionTrackerUpdateExpiry: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetSAMLAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55194,27 +62259,23 @@ func (m *SessionTrackerUpdateExpiry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Expires == nil {
-				m.Expires = new(time.Time)
-			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.Expires, dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -55238,7 +62299,7 @@ func (m *SessionTrackerUpdateExpiry) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpdateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
+func (m *GetGithubAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55261,15 +62322,15 @@ func (m *UpdateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpdateSessionTrackerRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetGithubAuthRequestRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpdateSessionTrackerRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetGithubAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55297,147 +62358,7 @@ func (m *UpdateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdateState", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &SessionTrackerUpdateState{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Update = &UpdateSessionTrackerRequest_UpdateState{v}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AddParticipant", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &SessionTrackerAddParticipant{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Update = &UpdateSessionTrackerRequest_AddParticipant{v}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RemoveParticipant", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &SessionTrackerRemoveParticipant{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Update = &UpdateSessionTrackerRequest_RemoveParticipant{v}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdateExpiry", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &SessionTrackerUpdateExpiry{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Update = &UpdateSessionTrackerRequest_UpdateExpiry{v}
+			m.StateToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -55461,7 +62382,7 @@ func (m *UpdateSessionTrackerRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
+func (m *ListOIDCConnectorsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55484,17 +62405,17 @@ func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PresenceMFAChallengeRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListOIDCConnectorsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PresenceMFAChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListOIDCConnectorsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
 			}
-			var stringLen uint64
+			m.PageSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55504,27 +62425,14 @@ func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.PageSize |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SSOClientRedirectURL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55552,13 +62460,13 @@ func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SSOClientRedirectURL = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProxyAddress", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WithSecrets", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55568,24 +62476,12 @@ func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ProxyAddress = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
+			m.WithSecrets = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -55608,7 +62504,7 @@ func (m *PresenceMFAChallengeRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
+func (m *ListOIDCConnectorsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55631,15 +62527,15 @@ func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PresenceMFAChallengeSend: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListOIDCConnectorsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PresenceMFAChallengeSend: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListOIDCConnectorsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connectors", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55666,17 +62562,16 @@ func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PresenceMFAChallengeRequest{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Connectors = append(m.Connectors, &types.OIDCConnectorV3{})
+			if err := m.Connectors[len(m.Connectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Request = &PresenceMFAChallengeSend_ChallengeRequest{v}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55686,26 +62581,23 @@ func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MFAAuthenticateResponse{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Request = &PresenceMFAChallengeSend_ChallengeResponse{v}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -55729,7 +62621,7 @@ func (m *PresenceMFAChallengeSend) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetDomainNameResponse) Unmarshal(dAtA []byte) error {
+func (m *CreateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55752,17 +62644,17 @@ func (m *GetDomainNameResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetDomainNameResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateOIDCConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetDomainNameResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DomainName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55772,23 +62664,27 @@ func (m *GetDomainNameResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DomainName = string(dAtA[iNdEx:postIndex])
+			if m.Connector == nil {
+				m.Connector = &types.OIDCConnectorV3{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -55812,7 +62708,7 @@ func (m *GetDomainNameResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetClusterCACertResponse) Unmarshal(dAtA []byte) error {
+func (m *UpdateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55835,17 +62731,17 @@ func (m *GetClusterCACertResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetClusterCACertResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpdateOIDCConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetClusterCACertResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpdateOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TLSCA", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55855,24 +62751,26 @@ func (m *GetClusterCACertResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TLSCA = append(m.TLSCA[:0], dAtA[iNdEx:postIndex]...)
-			if m.TLSCA == nil {
-				m.TLSCA = []byte{}
+			if m.Connector == nil {
+				m.Connector = &types.OIDCConnectorV3{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
 		default:
@@ -55897,7 +62795,7 @@ func (m *GetClusterCACertResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetLicenseResponse) Unmarshal(dAtA []byte) error {
+func (m *UpsertOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55920,17 +62818,17 @@ func (m *GetLicenseResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetLicenseResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpsertOIDCConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetLicenseResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpsertOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field License", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -55940,24 +62838,26 @@ func (m *GetLicenseResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.License = append(m.License[:0], dAtA[iNdEx:postIndex]...)
-			if m.License == nil {
-				m.License = []byte{}
+			if m.Connector == nil {
+				m.Connector = &types.OIDCConnectorV3{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
 		default:
@@ -55982,7 +62882,7 @@ func (m *GetLicenseResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListReleasesResponse) Unmarshal(dAtA []byte) error {
+func (m *CreateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56005,15 +62905,15 @@ func (m *ListReleasesResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListReleasesResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateSAMLConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListReleasesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Releases", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56040,8 +62940,10 @@ func (m *ListReleasesResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Releases = append(m.Releases, &types.Release{})
-			if err := m.Releases[len(m.Releases)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Connector == nil {
+				m.Connector = &types.SAMLConnectorV2{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -56067,7 +62969,7 @@ func (m *ListReleasesResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetOIDCAuthRequestRequest) Unmarshal(dAtA []byte) error {
+func (m *UpdateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56090,17 +62992,17 @@ func (m *GetOIDCAuthRequestRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetOIDCAuthRequestRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpdateSAMLConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetOIDCAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpdateSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -56110,23 +63012,27 @@ func (m *GetOIDCAuthRequestRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StateToken = string(dAtA[iNdEx:postIndex])
+			if m.Connector == nil {
+				m.Connector = &types.SAMLConnectorV2{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -56150,7 +63056,7 @@ func (m *GetOIDCAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetSAMLAuthRequestRequest) Unmarshal(dAtA []byte) error {
+func (m *UpsertSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56173,17 +63079,17 @@ func (m *GetSAMLAuthRequestRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetSAMLAuthRequestRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpsertSAMLConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSAMLAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpsertSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -56193,23 +63099,27 @@ func (m *GetSAMLAuthRequestRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ID = string(dAtA[iNdEx:postIndex])
+			if m.Connector == nil {
+				m.Connector = &types.SAMLConnectorV2{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -56233,7 +63143,7 @@ func (m *GetSAMLAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetGithubAuthRequestRequest) Unmarshal(dAtA []byte) error {
+func (m *ListSAMLConnectorsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56256,15 +63166,34 @@ func (m *GetGithubAuthRequestRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetGithubAuthRequestRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSAMLConnectorsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetGithubAuthRequestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSAMLConnectorsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -56292,8 +63221,48 @@ func (m *GetGithubAuthRequestRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StateToken = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WithSecrets", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.WithSecrets = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NoFollowUrls", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.NoFollowUrls = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -56316,7 +63285,7 @@ func (m *GetGithubAuthRequestRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *ListSAMLConnectorsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56339,15 +63308,15 @@ func (m *CreateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateOIDCConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSAMLConnectorsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSAMLConnectorsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connectors", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56374,69 +63343,16 @@ func (m *CreateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.OIDCConnectorV3{}
-			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Connectors = append(m.Connectors, &types.SAMLConnectorV2{})
+			if err := m.Connectors[len(m.Connectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *UpdateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: UpdateOIDCConnectorRequest: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpdateOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -56446,27 +63362,23 @@ func (m *UpdateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.OIDCConnectorV3{}
-			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -56490,7 +63402,7 @@ func (m *UpdateOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *ListGithubConnectorsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56513,17 +63425,36 @@ func (m *UpsertOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertOIDCConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListGithubConnectorsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertOIDCConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListGithubConnectorsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -56533,28 +63464,44 @@ func (m *UpsertOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.OIDCConnectorV3{}
+			m.PageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WithSecrets", wireType)
 			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
+			m.WithSecrets = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -56577,7 +63524,7 @@ func (m *UpsertOIDCConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *ListGithubConnectorsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56600,15 +63547,15 @@ func (m *CreateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateSAMLConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListGithubConnectorsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListGithubConnectorsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connectors", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56635,13 +63582,43 @@ func (m *CreateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.SAMLConnectorV2{}
-			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Connectors = append(m.Connectors, &types.GithubConnectorV3{})
+			if err := m.Connectors[len(m.Connectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -56664,7 +63641,7 @@ func (m *CreateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpdateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *CreateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56687,10 +63664,10 @@ func (m *UpdateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpdateSAMLConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateGithubConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpdateSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56723,7 +63700,7 @@ func (m *UpdateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.Connector == nil {
-				m.Connector = &types.SAMLConnectorV2{}
+				m.Connector = &types.GithubConnectorV3{}
 			}
 			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -56751,7 +63728,7 @@ func (m *UpdateSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *UpdateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56774,10 +63751,10 @@ func (m *UpsertSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertSAMLConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpdateGithubConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertSAMLConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpdateGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56810,7 +63787,7 @@ func (m *UpsertSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.Connector == nil {
-				m.Connector = &types.SAMLConnectorV2{}
+				m.Connector = &types.GithubConnectorV3{}
 			}
 			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -56838,7 +63815,7 @@ func (m *UpsertSAMLConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *UpsertGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56861,10 +63838,10 @@ func (m *CreateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateGithubConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpsertGithubConnectorRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpsertGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56925,7 +63902,7 @@ func (m *CreateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpdateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56948,17 +63925,17 @@ func (m *UpdateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpdateGithubConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetSSODiagnosticInfoRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpdateGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetSSODiagnosticInfoRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthRequestKind", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -56968,27 +63945,55 @@ func (m *UpdateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.GithubConnectorV3{}
+			m.AuthRequestKind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthRequestID", wireType)
 			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.AuthRequestID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57012,7 +64017,7 @@ func (m *UpdateGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertGithubConnectorRequest) Unmarshal(dAtA []byte) error {
+func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57035,17 +64040,17 @@ func (m *UpsertGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertGithubConnectorRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: SystemRoleAssertion: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertGithubConnectorRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SystemRoleAssertion: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57055,27 +64060,87 @@ func (m *UpsertGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types.GithubConnectorV3{}
+			m.ServerID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AssertionID", wireType)
 			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AssertionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemRole", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.SystemRole = github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57099,7 +64164,7 @@ func (m *UpsertGithubConnectorRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
+func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57122,15 +64187,15 @@ func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetSSODiagnosticInfoRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: SystemRoleAssertionSet: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetSSODiagnosticInfoRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SystemRoleAssertionSet: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuthRequestKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57158,11 +64223,11 @@ func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AuthRequestKind = string(dAtA[iNdEx:postIndex])
+			m.ServerID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuthRequestID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AssertionID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57190,7 +64255,39 @@ func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AuthRequestID = string(dAtA[iNdEx:postIndex])
+			m.AssertionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemRoles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SystemRoles = append(m.SystemRoles, github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57214,7 +64311,7 @@ func (m *GetSSODiagnosticInfoRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
+func (m *InventoryConnectedServiceCountsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57237,17 +64334,68 @@ func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SystemRoleAssertion: wiretype end group for non-group")
+			return fmt.Errorf("proto: InventoryConnectedServiceCountsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SystemRoleAssertion: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: InventoryConnectedServiceCountsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InventoryConnectedServiceCounts) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: InventoryConnectedServiceCounts: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: InventoryConnectedServiceCounts: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceCounts", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57257,27 +64405,159 @@ func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
+			if m.ServiceCounts == nil {
+				m.ServiceCounts = make(map[github_com_gravitational_teleport_api_types.SystemRole]uint64)
+			}
+			var mapkey github_com_gravitational_teleport_api_types.SystemRole
+			var mapvalue uint64
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowAuthservice
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowAuthservice
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipAuthservice(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthAuthservice
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.ServiceCounts[github_com_gravitational_teleport_api_types.SystemRole(mapkey)] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InventoryPingRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: InventoryPingRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: InventoryPingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AssertionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57305,13 +64585,13 @@ func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AssertionID = string(dAtA[iNdEx:postIndex])
+			m.ServerID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SystemRole", wireType)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ControlLog", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57321,24 +64601,12 @@ func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SystemRole = github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
+			m.ControlLog = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -57361,7 +64629,7 @@ func (m *SystemRoleAssertion) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
+func (m *InventoryPingResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57384,17 +64652,17 @@ func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SystemRoleAssertionSet: wiretype end group for non-group")
+			return fmt.Errorf("proto: InventoryPingResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SystemRoleAssertionSet: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: InventoryPingResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Duration", wireType)
 			}
-			var stringLen uint64
+			m.Duration = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57404,61 +64672,67 @@ func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.Duration |= time.Duration(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AssertionID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetClusterAlertsResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AssertionID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetClusterAlertsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetClusterAlertsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SystemRoles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Alerts", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57468,23 +64742,25 @@ func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SystemRoles = append(m.SystemRoles, github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex]))
+			m.Alerts = append(m.Alerts, types.ClusterAlert{})
+			if err := m.Alerts[len(m.Alerts)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57508,7 +64784,7 @@ func (m *SystemRoleAssertionSet) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *InventoryConnectedServiceCountsRequest) Unmarshal(dAtA []byte) error {
+func (m *GetAlertAcksRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57531,10 +64807,10 @@ func (m *InventoryConnectedServiceCountsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: InventoryConnectedServiceCountsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetAlertAcksRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: InventoryConnectedServiceCountsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetAlertAcksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		default:
@@ -57559,7 +64835,7 @@ func (m *InventoryConnectedServiceCountsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *InventoryConnectedServiceCounts) Unmarshal(dAtA []byte) error {
+func (m *GetAlertAcksResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57582,15 +64858,15 @@ func (m *InventoryConnectedServiceCounts) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: InventoryConnectedServiceCounts: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetAlertAcksResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: InventoryConnectedServiceCounts: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetAlertAcksResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceCounts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Acks", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57617,89 +64893,10 @@ func (m *InventoryConnectedServiceCounts) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ServiceCounts == nil {
-				m.ServiceCounts = make(map[github_com_gravitational_teleport_api_types.SystemRole]uint64)
-			}
-			var mapkey github_com_gravitational_teleport_api_types.SystemRole
-			var mapvalue uint64
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowAuthservice
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAuthservice
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipAuthservice(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthAuthservice
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			m.Acks = append(m.Acks, types.AlertAcknowledgement{})
+			if err := m.Acks[len(m.Acks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.ServiceCounts[github_com_gravitational_teleport_api_types.SystemRole(mapkey)] = mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57723,7 +64920,7 @@ func (m *InventoryConnectedServiceCounts) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *InventoryPingRequest) Unmarshal(dAtA []byte) error {
+func (m *ClearAlertAcksRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57746,15 +64943,15 @@ func (m *InventoryPingRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: InventoryPingRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClearAlertAcksRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: InventoryPingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClearAlertAcksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AlertID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57782,28 +64979,8 @@ func (m *InventoryPingRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerID = string(dAtA[iNdEx:postIndex])
+			m.AlertID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ControlLog", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.ControlLog = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -57826,7 +65003,7 @@ func (m *InventoryPingRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *InventoryPingResponse) Unmarshal(dAtA []byte) error {
+func (m *UpsertClusterAlertRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57849,17 +65026,17 @@ func (m *InventoryPingResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: InventoryPingResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpsertClusterAlertRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: InventoryPingResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpsertClusterAlertRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Duration", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Alert", wireType)
 			}
-			m.Duration = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57869,11 +65046,25 @@ func (m *InventoryPingResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Duration |= time.Duration(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Alert.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -57896,7 +65087,7 @@ func (m *InventoryPingResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetClusterAlertsResponse) Unmarshal(dAtA []byte) error {
+func (m *GetConnectionDiagnosticRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57919,17 +65110,17 @@ func (m *GetClusterAlertsResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetClusterAlertsResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetConnectionDiagnosticRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetClusterAlertsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetConnectionDiagnosticRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Alerts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -57939,25 +65130,23 @@ func (m *GetClusterAlertsResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Alerts = append(m.Alerts, types.ClusterAlert{})
-			if err := m.Alerts[len(m.Alerts)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -57981,7 +65170,7 @@ func (m *GetClusterAlertsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetAlertAcksRequest) Unmarshal(dAtA []byte) error {
+func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58004,12 +65193,80 @@ func (m *GetAlertAcksRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetAlertAcksRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppendDiagnosticTraceRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetAlertAcksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppendDiagnosticTraceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Trace", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Trace == nil {
+				m.Trace = &types.ConnectionDiagnosticTrace{}
+			}
+			if err := m.Trace.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -58032,7 +65289,7 @@ func (m *GetAlertAcksRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetAlertAcksResponse) Unmarshal(dAtA []byte) error {
+func (m *SubmitUsageEventRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58055,15 +65312,15 @@ func (m *GetAlertAcksResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetAlertAcksResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: SubmitUsageEventRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetAlertAcksResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SubmitUsageEventRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Acks", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Event", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58090,11 +65347,115 @@ func (m *GetAlertAcksResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Acks = append(m.Acks, types.AlertAcknowledgement{})
-			if err := m.Acks[len(m.Acks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Event == nil {
+				m.Event = &v12.UsageEventOneOf{}
+			}
+			if err := m.Event.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetLicenseRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetLicenseRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetLicenseRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			iNdEx = postIndex
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListReleasesRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListReleasesRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListReleasesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -58117,7 +65478,7 @@ func (m *GetAlertAcksResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ClearAlertAcksRequest) Unmarshal(dAtA []byte) error {
+func (m *CreateTokenV2Request) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58140,17 +65501,17 @@ func (m *ClearAlertAcksRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ClearAlertAcksRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CreateTokenV2Request: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ClearAlertAcksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CreateTokenV2Request: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AlertID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field V2", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -58160,23 +65521,26 @@ func (m *ClearAlertAcksRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AlertID = string(dAtA[iNdEx:postIndex])
+			v := &types.ProvisionTokenV2{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Token = &CreateTokenV2Request_V2{v}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58200,7 +65564,7 @@ func (m *ClearAlertAcksRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertClusterAlertRequest) Unmarshal(dAtA []byte) error {
+func (m *UpsertTokenV2Request) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58223,15 +65587,15 @@ func (m *UpsertClusterAlertRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertClusterAlertRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpsertTokenV2Request: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertClusterAlertRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpsertTokenV2Request: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Alert", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field V2", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58258,9 +65622,11 @@ func (m *UpsertClusterAlertRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Alert.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &types.ProvisionTokenV2{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Token = &UpsertTokenV2Request_V2{v}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58284,7 +65650,7 @@ func (m *UpsertClusterAlertRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetConnectionDiagnosticRequest) Unmarshal(dAtA []byte) error {
+func (m *GetHeadlessAuthenticationRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58307,15 +65673,15 @@ func (m *GetConnectionDiagnosticRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetConnectionDiagnosticRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: GetHeadlessAuthenticationRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetConnectionDiagnosticRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GetHeadlessAuthenticationRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58343,7 +65709,7 @@ func (m *GetConnectionDiagnosticRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Id = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58367,7 +65733,7 @@ func (m *GetConnectionDiagnosticRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
+func (m *UpdateHeadlessAuthenticationStateRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58390,15 +65756,15 @@ func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppendDiagnosticTraceRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpdateHeadlessAuthenticationStateRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppendDiagnosticTraceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpdateHeadlessAuthenticationStateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58426,11 +65792,30 @@ func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Id = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
+			}
+			m.State = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.State |= types.HeadlessAuthenticationState(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Trace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MfaResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58457,10 +65842,10 @@ func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Trace == nil {
-				m.Trace = &types.ConnectionDiagnosticTrace{}
+			if m.MfaResponse == nil {
+				m.MfaResponse = &MFAAuthenticateResponse{}
 			}
-			if err := m.Trace.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.MfaResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -58486,7 +65871,7 @@ func (m *AppendDiagnosticTraceRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SubmitUsageEventRequest) Unmarshal(dAtA []byte) error {
+func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58509,17 +65894,17 @@ func (m *SubmitUsageEventRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SubmitUsageEventRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ExportUpgradeWindowsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SubmitUsageEventRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ExportUpgradeWindowsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Event", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TeleportVersion", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -58529,27 +65914,55 @@ func (m *SubmitUsageEventRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthAuthservice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Event == nil {
-				m.Event = &v12.UsageEventOneOf{}
+			m.TeleportVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgraderKind", wireType)
 			}
-			if err := m.Event.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.UpgraderKind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58573,7 +65986,7 @@ func (m *SubmitUsageEventRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetLicenseRequest) Unmarshal(dAtA []byte) error {
+func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58596,63 +66009,112 @@ func (m *GetLicenseRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetLicenseRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ExportUpgradeWindowsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetLicenseRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ExportUpgradeWindowsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanonicalSchedule", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthAuthservice
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ListReleasesRequest) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
+			if m.CanonicalSchedule == nil {
+				m.CanonicalSchedule = &types.AgentUpgradeSchedule{}
 			}
-			if iNdEx >= l {
+			if err := m.CanonicalSchedule.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeControllerSchedule", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.KubeControllerSchedule = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemdUnitSchedule", wireType)
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ListReleasesRequest: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListReleasesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SystemdUnitSchedule = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -58675,7 +66137,7 @@ func (m *ListReleasesRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateTokenV2Request) Unmarshal(dAtA []byte) error {
+func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58698,15 +66160,15 @@ func (m *CreateTokenV2Request) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateTokenV2Request: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListAccessRequestsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateTokenV2Request: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListAccessRequestsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field V2", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58733,11 +66195,102 @@ func (m *CreateTokenV2Request) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.ProvisionTokenV2{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Filter == nil {
+				m.Filter = &types.AccessRequestFilter{}
+			}
+			if err := m.Filter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Token = &CreateTokenV2Request_V2{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Sort", wireType)
+			}
+			m.Sort = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Sort |= AccessRequestSort(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Descending", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Descending = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StartKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58761,7 +66314,7 @@ func (m *CreateTokenV2Request) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpsertTokenV2Request) Unmarshal(dAtA []byte) error {
+func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58784,15 +66337,15 @@ func (m *UpsertTokenV2Request) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpsertTokenV2Request: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListAccessRequestsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpsertTokenV2Request: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListAccessRequestsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field V2", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58819,11 +66372,42 @@ func (m *UpsertTokenV2Request) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &types.ProvisionTokenV2{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.AccessRequests = append(m.AccessRequests, &types.AccessRequestV3{})
+			if err := m.AccessRequests[len(m.AccessRequests)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Token = &UpsertTokenV2Request_V2{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58847,7 +66431,7 @@ func (m *UpsertTokenV2Request) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GetHeadlessAuthenticationRequest) Unmarshal(dAtA []byte) error {
+func (m *AccessRequestAllowedPromotionRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58870,15 +66454,15 @@ func (m *GetHeadlessAuthenticationRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GetHeadlessAuthenticationRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessRequestAllowedPromotionRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GetHeadlessAuthenticationRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessRequestAllowedPromotionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58906,7 +66490,7 @@ func (m *GetHeadlessAuthenticationRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Id = string(dAtA[iNdEx:postIndex])
+			m.AccessRequestID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -58930,7 +66514,7 @@ func (m *GetHeadlessAuthenticationRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpdateHeadlessAuthenticationStateRequest) Unmarshal(dAtA []byte) error {
+func (m *AccessRequestAllowedPromotionResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58953,66 +66537,15 @@ func (m *UpdateHeadlessAuthenticationStateRequest) Unmarshal(dAtA []byte) error
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpdateHeadlessAuthenticationStateRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessRequestAllowedPromotionResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpdateHeadlessAuthenticationStateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessRequestAllowedPromotionResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Id = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
-			}
-			m.State = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.State |= types.HeadlessAuthenticationState(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MfaResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowedPromotions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59039,10 +66572,10 @@ func (m *UpdateHeadlessAuthenticationStateRequest) Unmarshal(dAtA []byte) error
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MfaResponse == nil {
-				m.MfaResponse = &MFAAuthenticateResponse{}
+			if m.AllowedPromotions == nil {
+				m.AllowedPromotions = &types.AccessRequestAllowedPromotions{}
 			}
-			if err := m.MfaResponse.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AllowedPromotions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -59068,7 +66601,7 @@ func (m *UpdateHeadlessAuthenticationStateRequest) Unmarshal(dAtA []byte) error
 	}
 	return nil
 }
-func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
+func (m *ListProvisionTokensRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59091,15 +66624,34 @@ func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExportUpgradeWindowsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListProvisionTokensRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExportUpgradeWindowsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListProvisionTokensRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TeleportVersion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59127,11 +66679,11 @@ func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TeleportVersion = string(dAtA[iNdEx:postIndex])
+			m.StartKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpgraderKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FilterRoles", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59159,7 +66711,39 @@ func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpgraderKind = string(dAtA[iNdEx:postIndex])
+			m.FilterRoles = append(m.FilterRoles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FilterBotName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FilterBotName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59183,7 +66767,7 @@ func (m *ExportUpgradeWindowsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
+func (m *ListProvisionTokensResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59206,15 +66790,15 @@ func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExportUpgradeWindowsResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListProvisionTokensResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExportUpgradeWindowsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListProvisionTokensResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CanonicalSchedule", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tokens", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59241,48 +66825,14 @@ func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.CanonicalSchedule == nil {
-				m.CanonicalSchedule = &types.AgentUpgradeSchedule{}
-			}
-			if err := m.CanonicalSchedule.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Tokens = append(m.Tokens, &types.ProvisionTokenV2{})
+			if err := m.Tokens[len(m.Tokens)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeControllerSchedule", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.KubeControllerSchedule = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SystemdUnitSchedule", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59310,7 +66860,7 @@ func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SystemdUnitSchedule = string(dAtA[iNdEx:postIndex])
+			m.NextKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59334,7 +66884,7 @@ func (m *ExportUpgradeWindowsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
+func (m *ListKubernetesClustersRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59357,92 +66907,17 @@ func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListAccessRequestsRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListKubernetesClustersRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListAccessRequestsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListKubernetesClustersRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.Filter == nil {
-				m.Filter = &types.AccessRequestFilter{}
-			}
-			if err := m.Filter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Sort", wireType)
-			}
-			m.Sort = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Sort |= AccessRequestSort(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Descending", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.Descending = bool(v != 0)
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
 			}
-			m.Limit = 0
+			m.PageSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAuthservice
@@ -59452,14 +66927,14 @@ func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Limit |= int32(b&0x7F) << shift
+				m.PageSize |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59487,7 +66962,7 @@ func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StartKey = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59511,7 +66986,7 @@ func (m *ListAccessRequestsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
+func (m *ListKubernetesClustersResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59534,15 +67009,15 @@ func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ListAccessRequestsResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListKubernetesClustersResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ListAccessRequestsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListKubernetesClustersResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusters", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59569,14 +67044,14 @@ func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessRequests = append(m.AccessRequests, &types.AccessRequestV3{})
-			if err := m.AccessRequests[len(m.AccessRequests)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.KubernetesClusters = append(m.KubernetesClusters, &types.KubernetesClusterV3{})
+			if err := m.KubernetesClusters[len(m.KubernetesClusters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NextKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59604,7 +67079,7 @@ func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NextKey = string(dAtA[iNdEx:postIndex])
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59628,7 +67103,7 @@ func (m *ListAccessRequestsResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessRequestAllowedPromotionRequest) Unmarshal(dAtA []byte) error {
+func (m *ListSnowflakeSessionsRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59651,15 +67126,34 @@ func (m *AccessRequestAllowedPromotionRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestAllowedPromotionRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSnowflakeSessionsRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestAllowedPromotionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSnowflakeSessionsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PageSize", wireType)
+			}
+			m.PageSize = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PageSize |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PageToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59687,7 +67181,7 @@ func (m *AccessRequestAllowedPromotionRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessRequestID = string(dAtA[iNdEx:postIndex])
+			m.PageToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59711,7 +67205,7 @@ func (m *AccessRequestAllowedPromotionRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessRequestAllowedPromotionResponse) Unmarshal(dAtA []byte) error {
+func (m *ListSnowflakeSessionsResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59734,15 +67228,15 @@ func (m *AccessRequestAllowedPromotionResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestAllowedPromotionResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: ListSnowflakeSessionsResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestAllowedPromotionResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ListSnowflakeSessionsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllowedPromotions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Sessions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59769,13 +67263,43 @@ func (m *AccessRequestAllowedPromotionResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AllowedPromotions == nil {
-				m.AllowedPromotions = &types.AccessRequestAllowedPromotions{}
-			}
-			if err := m.AllowedPromotions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Sessions = append(m.Sessions, &types.WebSessionV2{})
+			if err := m.Sessions[len(m.Sessions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NextPageToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NextPageToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
diff --git a/api/client/proto/authservice_grpc.pb.go b/api/client/proto/authservice_grpc.pb.go
index 5df6237d0ce0b..39ff81a69d2cb 100644
--- a/api/client/proto/authservice_grpc.pb.go
+++ b/api/client/proto/authservice_grpc.pb.go
@@ -71,12 +71,14 @@ const (
 	AuthService_SetAccessRequestState_FullMethodName               = "/proto.AuthService/SetAccessRequestState"
 	AuthService_SubmitAccessReview_FullMethodName                  = "/proto.AuthService/SubmitAccessReview"
 	AuthService_GetAccessCapabilities_FullMethodName               = "/proto.AuthService/GetAccessCapabilities"
+	AuthService_GetRemoteAccessCapabilities_FullMethodName         = "/proto.AuthService/GetRemoteAccessCapabilities"
 	AuthService_GetAccessRequestAllowedPromotions_FullMethodName   = "/proto.AuthService/GetAccessRequestAllowedPromotions"
 	AuthService_GetPluginData_FullMethodName                       = "/proto.AuthService/GetPluginData"
 	AuthService_UpdatePluginData_FullMethodName                    = "/proto.AuthService/UpdatePluginData"
 	AuthService_Ping_FullMethodName                                = "/proto.AuthService/Ping"
 	AuthService_GetResetPasswordToken_FullMethodName               = "/proto.AuthService/GetResetPasswordToken"
 	AuthService_CreateResetPasswordToken_FullMethodName            = "/proto.AuthService/CreateResetPasswordToken"
+	AuthService_ListResetPasswordTokens_FullMethodName             = "/proto.AuthService/ListResetPasswordTokens"
 	AuthService_GetUser_FullMethodName                             = "/proto.AuthService/GetUser"
 	AuthService_GetCurrentUser_FullMethodName                      = "/proto.AuthService/GetCurrentUser"
 	AuthService_GetCurrentUserRoles_FullMethodName                 = "/proto.AuthService/GetCurrentUserRoles"
@@ -89,6 +91,7 @@ const (
 	AuthService_KeepAliveSemaphoreLease_FullMethodName             = "/proto.AuthService/KeepAliveSemaphoreLease"
 	AuthService_CancelSemaphoreLease_FullMethodName                = "/proto.AuthService/CancelSemaphoreLease"
 	AuthService_GetSemaphores_FullMethodName                       = "/proto.AuthService/GetSemaphores"
+	AuthService_ListSemaphores_FullMethodName                      = "/proto.AuthService/ListSemaphores"
 	AuthService_DeleteSemaphore_FullMethodName                     = "/proto.AuthService/DeleteSemaphore"
 	AuthService_EmitAuditEvent_FullMethodName                      = "/proto.AuthService/EmitAuditEvent"
 	AuthService_CreateAuditStream_FullMethodName                   = "/proto.AuthService/CreateAuditStream"
@@ -105,6 +108,7 @@ const (
 	AuthService_CreateSnowflakeSession_FullMethodName              = "/proto.AuthService/CreateSnowflakeSession"
 	AuthService_GetSnowflakeSession_FullMethodName                 = "/proto.AuthService/GetSnowflakeSession"
 	AuthService_GetSnowflakeSessions_FullMethodName                = "/proto.AuthService/GetSnowflakeSessions"
+	AuthService_ListSnowflakeSessions_FullMethodName               = "/proto.AuthService/ListSnowflakeSessions"
 	AuthService_DeleteSnowflakeSession_FullMethodName              = "/proto.AuthService/DeleteSnowflakeSession"
 	AuthService_DeleteAllSnowflakeSessions_FullMethodName          = "/proto.AuthService/DeleteAllSnowflakeSessions"
 	AuthService_CreateSAMLIdPSession_FullMethodName                = "/proto.AuthService/CreateSAMLIdPSession"
@@ -120,6 +124,7 @@ const (
 	AuthService_DeleteAllWebSessions_FullMethodName                = "/proto.AuthService/DeleteAllWebSessions"
 	AuthService_GetWebToken_FullMethodName                         = "/proto.AuthService/GetWebToken"
 	AuthService_GetWebTokens_FullMethodName                        = "/proto.AuthService/GetWebTokens"
+	AuthService_ListWebTokens_FullMethodName                       = "/proto.AuthService/ListWebTokens"
 	AuthService_DeleteWebToken_FullMethodName                      = "/proto.AuthService/DeleteWebToken"
 	AuthService_DeleteAllWebTokens_FullMethodName                  = "/proto.AuthService/DeleteAllWebTokens"
 	AuthService_UpdateRemoteCluster_FullMethodName                 = "/proto.AuthService/UpdateRemoteCluster"
@@ -137,6 +142,7 @@ const (
 	AuthService_GenerateSnowflakeJWT_FullMethodName                = "/proto.AuthService/GenerateSnowflakeJWT"
 	AuthService_GetRole_FullMethodName                             = "/proto.AuthService/GetRole"
 	AuthService_ListRoles_FullMethodName                           = "/proto.AuthService/ListRoles"
+	AuthService_ListRequestableRoles_FullMethodName                = "/proto.AuthService/ListRequestableRoles"
 	AuthService_CreateRole_FullMethodName                          = "/proto.AuthService/CreateRole"
 	AuthService_UpdateRole_FullMethodName                          = "/proto.AuthService/UpdateRole"
 	AuthService_UpsertRoleV2_FullMethodName                        = "/proto.AuthService/UpsertRoleV2"
@@ -151,6 +157,7 @@ const (
 	AuthService_CreateRegisterChallenge_FullMethodName             = "/proto.AuthService/CreateRegisterChallenge"
 	AuthService_GetOIDCConnector_FullMethodName                    = "/proto.AuthService/GetOIDCConnector"
 	AuthService_GetOIDCConnectors_FullMethodName                   = "/proto.AuthService/GetOIDCConnectors"
+	AuthService_ListOIDCConnectors_FullMethodName                  = "/proto.AuthService/ListOIDCConnectors"
 	AuthService_CreateOIDCConnector_FullMethodName                 = "/proto.AuthService/CreateOIDCConnector"
 	AuthService_UpdateOIDCConnector_FullMethodName                 = "/proto.AuthService/UpdateOIDCConnector"
 	AuthService_UpsertOIDCConnector_FullMethodName                 = "/proto.AuthService/UpsertOIDCConnector"
@@ -160,6 +167,7 @@ const (
 	AuthService_GetOIDCAuthRequest_FullMethodName                  = "/proto.AuthService/GetOIDCAuthRequest"
 	AuthService_GetSAMLConnector_FullMethodName                    = "/proto.AuthService/GetSAMLConnector"
 	AuthService_GetSAMLConnectors_FullMethodName                   = "/proto.AuthService/GetSAMLConnectors"
+	AuthService_ListSAMLConnectors_FullMethodName                  = "/proto.AuthService/ListSAMLConnectors"
 	AuthService_CreateSAMLConnector_FullMethodName                 = "/proto.AuthService/CreateSAMLConnector"
 	AuthService_UpdateSAMLConnector_FullMethodName                 = "/proto.AuthService/UpdateSAMLConnector"
 	AuthService_UpsertSAMLConnector_FullMethodName                 = "/proto.AuthService/UpsertSAMLConnector"
@@ -169,6 +177,7 @@ const (
 	AuthService_GetSAMLAuthRequest_FullMethodName                  = "/proto.AuthService/GetSAMLAuthRequest"
 	AuthService_GetGithubConnector_FullMethodName                  = "/proto.AuthService/GetGithubConnector"
 	AuthService_GetGithubConnectors_FullMethodName                 = "/proto.AuthService/GetGithubConnectors"
+	AuthService_ListGithubConnectors_FullMethodName                = "/proto.AuthService/ListGithubConnectors"
 	AuthService_CreateGithubConnector_FullMethodName               = "/proto.AuthService/CreateGithubConnector"
 	AuthService_UpdateGithubConnector_FullMethodName               = "/proto.AuthService/UpdateGithubConnector"
 	AuthService_UpsertGithubConnector_FullMethodName               = "/proto.AuthService/UpsertGithubConnector"
@@ -188,6 +197,8 @@ const (
 	AuthService_DeleteTrustedCluster_FullMethodName                = "/proto.AuthService/DeleteTrustedCluster"
 	AuthService_GetToken_FullMethodName                            = "/proto.AuthService/GetToken"
 	AuthService_GetTokens_FullMethodName                           = "/proto.AuthService/GetTokens"
+	AuthService_GetStaticTokens_FullMethodName                     = "/proto.AuthService/GetStaticTokens"
+	AuthService_ListProvisionTokens_FullMethodName                 = "/proto.AuthService/ListProvisionTokens"
 	AuthService_CreateTokenV2_FullMethodName                       = "/proto.AuthService/CreateTokenV2"
 	AuthService_UpsertTokenV2_FullMethodName                       = "/proto.AuthService/UpsertTokenV2"
 	AuthService_DeleteToken_FullMethodName                         = "/proto.AuthService/DeleteToken"
@@ -208,6 +219,7 @@ const (
 	AuthService_GetSessionEvents_FullMethodName                    = "/proto.AuthService/GetSessionEvents"
 	AuthService_GetLock_FullMethodName                             = "/proto.AuthService/GetLock"
 	AuthService_GetLocks_FullMethodName                            = "/proto.AuthService/GetLocks"
+	AuthService_ListLocks_FullMethodName                           = "/proto.AuthService/ListLocks"
 	AuthService_UpsertLock_FullMethodName                          = "/proto.AuthService/UpsertLock"
 	AuthService_DeleteLock_FullMethodName                          = "/proto.AuthService/DeleteLock"
 	AuthService_ReplaceRemoteLocks_FullMethodName                  = "/proto.AuthService/ReplaceRemoteLocks"
@@ -216,18 +228,21 @@ const (
 	AuthService_SetNetworkRestrictions_FullMethodName              = "/proto.AuthService/SetNetworkRestrictions"
 	AuthService_DeleteNetworkRestrictions_FullMethodName           = "/proto.AuthService/DeleteNetworkRestrictions"
 	AuthService_GetApps_FullMethodName                             = "/proto.AuthService/GetApps"
+	AuthService_ListApps_FullMethodName                            = "/proto.AuthService/ListApps"
 	AuthService_GetApp_FullMethodName                              = "/proto.AuthService/GetApp"
 	AuthService_CreateApp_FullMethodName                           = "/proto.AuthService/CreateApp"
 	AuthService_UpdateApp_FullMethodName                           = "/proto.AuthService/UpdateApp"
 	AuthService_DeleteApp_FullMethodName                           = "/proto.AuthService/DeleteApp"
 	AuthService_DeleteAllApps_FullMethodName                       = "/proto.AuthService/DeleteAllApps"
 	AuthService_GetDatabases_FullMethodName                        = "/proto.AuthService/GetDatabases"
+	AuthService_ListDatabases_FullMethodName                       = "/proto.AuthService/ListDatabases"
 	AuthService_GetDatabase_FullMethodName                         = "/proto.AuthService/GetDatabase"
 	AuthService_CreateDatabase_FullMethodName                      = "/proto.AuthService/CreateDatabase"
 	AuthService_UpdateDatabase_FullMethodName                      = "/proto.AuthService/UpdateDatabase"
 	AuthService_DeleteDatabase_FullMethodName                      = "/proto.AuthService/DeleteDatabase"
 	AuthService_DeleteAllDatabases_FullMethodName                  = "/proto.AuthService/DeleteAllDatabases"
 	AuthService_GetKubernetesClusters_FullMethodName               = "/proto.AuthService/GetKubernetesClusters"
+	AuthService_ListKubernetesClusters_FullMethodName              = "/proto.AuthService/ListKubernetesClusters"
 	AuthService_GetKubernetesCluster_FullMethodName                = "/proto.AuthService/GetKubernetesCluster"
 	AuthService_CreateKubernetesCluster_FullMethodName             = "/proto.AuthService/CreateKubernetesCluster"
 	AuthService_UpdateKubernetesCluster_FullMethodName             = "/proto.AuthService/UpdateKubernetesCluster"
@@ -239,6 +254,7 @@ const (
 	AuthService_DeleteWindowsDesktopService_FullMethodName         = "/proto.AuthService/DeleteWindowsDesktopService"
 	AuthService_DeleteAllWindowsDesktopServices_FullMethodName     = "/proto.AuthService/DeleteAllWindowsDesktopServices"
 	AuthService_GetWindowsDesktops_FullMethodName                  = "/proto.AuthService/GetWindowsDesktops"
+	AuthService_ListWindowsDesktops_FullMethodName                 = "/proto.AuthService/ListWindowsDesktops"
 	AuthService_CreateWindowsDesktop_FullMethodName                = "/proto.AuthService/CreateWindowsDesktop"
 	AuthService_UpdateWindowsDesktop_FullMethodName                = "/proto.AuthService/UpdateWindowsDesktop"
 	AuthService_UpsertWindowsDesktop_FullMethodName                = "/proto.AuthService/UpsertWindowsDesktop"
@@ -261,6 +277,7 @@ const (
 	AuthService_CreatePrivilegeToken_FullMethodName                = "/proto.AuthService/CreatePrivilegeToken"
 	AuthService_GetInstaller_FullMethodName                        = "/proto.AuthService/GetInstaller"
 	AuthService_GetInstallers_FullMethodName                       = "/proto.AuthService/GetInstallers"
+	AuthService_ListInstallers_FullMethodName                      = "/proto.AuthService/ListInstallers"
 	AuthService_SetInstaller_FullMethodName                        = "/proto.AuthService/SetInstaller"
 	AuthService_DeleteInstaller_FullMethodName                     = "/proto.AuthService/DeleteInstaller"
 	AuthService_DeleteAllInstallers_FullMethodName                 = "/proto.AuthService/DeleteAllInstallers"
@@ -376,6 +393,8 @@ type AuthServiceClient interface {
 	SubmitAccessReview(ctx context.Context, in *types.AccessReviewSubmission, opts ...grpc.CallOption) (*types.AccessRequestV3, error)
 	// GetAccessCapabilities requests the access capabilities of a user.
 	GetAccessCapabilities(ctx context.Context, in *types.AccessCapabilitiesRequest, opts ...grpc.CallOption) (*types.AccessCapabilities, error)
+	// GetRemoteAccessCapabilities requests the access capabilities for a user from a remote cluster
+	GetRemoteAccessCapabilities(ctx context.Context, in *types.RemoteAccessCapabilitiesRequest, opts ...grpc.CallOption) (*types.RemoteAccessCapabilities, error)
 	// GetAccessRequestAllowedPromotions returns a list of allowed promotions from an access request to an access list.
 	GetAccessRequestAllowedPromotions(ctx context.Context, in *AccessRequestAllowedPromotionRequest, opts ...grpc.CallOption) (*AccessRequestAllowedPromotionResponse, error)
 	// GetPluginData gets all plugin data matching the supplied filter.
@@ -393,6 +412,8 @@ type AuthServiceClient interface {
 	//
 	// Only local users may be reset.
 	CreateResetPasswordToken(ctx context.Context, in *CreateResetPasswordTokenRequest, opts ...grpc.CallOption) (*types.UserTokenV3, error)
+	// ListResetPasswordTokens returns a page of user tokens.
+	ListResetPasswordTokens(ctx context.Context, in *ListResetPasswordTokenRequest, opts ...grpc.CallOption) (*ListResetPasswordTokenResponse, error)
 	// Deprecated: Do not use.
 	// GetUser gets a user resource by name.
 	//
@@ -438,6 +459,8 @@ type AuthServiceClient interface {
 	CancelSemaphoreLease(ctx context.Context, in *types.SemaphoreLease, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetSemaphores returns a list of all semaphores matching the supplied filter.
 	GetSemaphores(ctx context.Context, in *types.SemaphoreFilter, opts ...grpc.CallOption) (*Semaphores, error)
+	// ListSemaphores returns a page of all semaphores matching the supplied filter.
+	ListSemaphores(ctx context.Context, in *ListSemaphoresRequest, opts ...grpc.CallOption) (*ListSemaphoresResponse, error)
 	// DeleteSemaphore deletes a semaphore matching the supplied filter.
 	DeleteSemaphore(ctx context.Context, in *types.SemaphoreFilter, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// EmitAuditEvent emits audit event
@@ -472,6 +495,8 @@ type AuthServiceClient interface {
 	GetSnowflakeSession(ctx context.Context, in *GetSnowflakeSessionRequest, opts ...grpc.CallOption) (*GetSnowflakeSessionResponse, error)
 	// GetSnowflakeSessions gets all Snowflake web sessions.
 	GetSnowflakeSessions(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetSnowflakeSessionsResponse, error)
+	// ListSnowflakeSessions returns a page of Snowflake web sessions.
+	ListSnowflakeSessions(ctx context.Context, in *ListSnowflakeSessionsRequest, opts ...grpc.CallOption) (*ListSnowflakeSessionsResponse, error)
 	// DeleteSnowflakeSession removes a Snowflake web session.
 	DeleteSnowflakeSession(ctx context.Context, in *DeleteSnowflakeSessionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// DeleteAllSnowflakeSessions removes all Snowflake web sessions.
@@ -509,6 +534,8 @@ type AuthServiceClient interface {
 	GetWebToken(ctx context.Context, in *types.GetWebTokenRequest, opts ...grpc.CallOption) (*GetWebTokenResponse, error)
 	// GetWebTokens gets all web tokens.
 	GetWebTokens(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetWebTokensResponse, error)
+	// ListWebTokens returns a page of web tokens.
+	ListWebTokens(ctx context.Context, in *ListWebTokensRequest, opts ...grpc.CallOption) (*ListWebTokensResponse, error)
 	// DeleteWebToken deletes a web token.
 	DeleteWebToken(ctx context.Context, in *types.DeleteWebTokenRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// DeleteAllWebTokens deletes all web tokens.
@@ -547,6 +574,8 @@ type AuthServiceClient interface {
 	GetRole(ctx context.Context, in *GetRoleRequest, opts ...grpc.CallOption) (*types.RoleV6, error)
 	// ListRoles is a paginated role getter.
 	ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error)
+	// ListRequestableRoles is a paginated requestable role getter.
+	ListRequestableRoles(ctx context.Context, in *ListRequestableRolesRequest, opts ...grpc.CallOption) (*ListRequestableRolesResponse, error)
 	// CreateRole creates a new role.
 	CreateRole(ctx context.Context, in *CreateRoleRequest, opts ...grpc.CallOption) (*types.RoleV6, error)
 	// UpdateRole updates an existing role.
@@ -617,6 +646,8 @@ type AuthServiceClient interface {
 	GetOIDCConnector(ctx context.Context, in *types.ResourceWithSecretsRequest, opts ...grpc.CallOption) (*types.OIDCConnectorV3, error)
 	// GetOIDCConnectors gets all current OIDC connector resources.
 	GetOIDCConnectors(ctx context.Context, in *types.ResourcesWithSecretsRequest, opts ...grpc.CallOption) (*types.OIDCConnectorV3List, error)
+	// ListOIDCConnectors returns a page of current OIDC connector resources.
+	ListOIDCConnectors(ctx context.Context, in *ListOIDCConnectorsRequest, opts ...grpc.CallOption) (*ListOIDCConnectorsResponse, error)
 	// UpsertOIDCConnector creates a new OIDC connector in the backend.
 	CreateOIDCConnector(ctx context.Context, in *CreateOIDCConnectorRequest, opts ...grpc.CallOption) (*types.OIDCConnectorV3, error)
 	// UpsertOIDCConnector updates an existing OIDC connector in the backend.
@@ -638,6 +669,8 @@ type AuthServiceClient interface {
 	GetSAMLConnector(ctx context.Context, in *types.ResourceWithSecretsRequest, opts ...grpc.CallOption) (*types.SAMLConnectorV2, error)
 	// GetSAMLConnectors gets all current SAML connector resources.
 	GetSAMLConnectors(ctx context.Context, in *types.ResourcesWithSecretsRequest, opts ...grpc.CallOption) (*types.SAMLConnectorV2List, error)
+	// ListSAMLConnectors returns a page of current SAML connector resources.
+	ListSAMLConnectors(ctx context.Context, in *ListSAMLConnectorsRequest, opts ...grpc.CallOption) (*ListSAMLConnectorsResponse, error)
 	// CreateSAMLConnector creates a new SAML connector in the backend.
 	CreateSAMLConnector(ctx context.Context, in *CreateSAMLConnectorRequest, opts ...grpc.CallOption) (*types.SAMLConnectorV2, error)
 	// UpdateSAMLConnector updates an existing SAML connector in the backend.
@@ -659,6 +692,8 @@ type AuthServiceClient interface {
 	GetGithubConnector(ctx context.Context, in *types.ResourceWithSecretsRequest, opts ...grpc.CallOption) (*types.GithubConnectorV3, error)
 	// GetGithubConnectors gets all current Github connector resources.
 	GetGithubConnectors(ctx context.Context, in *types.ResourcesWithSecretsRequest, opts ...grpc.CallOption) (*types.GithubConnectorV3List, error)
+	// ListGithubConnectors returns a page of current Github connector resources.
+	ListGithubConnectors(ctx context.Context, in *ListGithubConnectorsRequest, opts ...grpc.CallOption) (*ListGithubConnectorsResponse, error)
 	// CreateGithubConnector creates a new Github connector in the backend.
 	CreateGithubConnector(ctx context.Context, in *CreateGithubConnectorRequest, opts ...grpc.CallOption) (*types.GithubConnectorV3, error)
 	// UpdateGithubConnector updates an existing Github connector in the backend.
@@ -701,8 +736,15 @@ type AuthServiceClient interface {
 	DeleteTrustedCluster(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetToken retrieves a token described by the given request.
 	GetToken(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.ProvisionTokenV2, error)
+	// Deprecated: Do not use.
 	// GetToken retrieves all tokens.
+	// Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+	// TODO(hugoShaka): DELETE IN 21.0.0
 	GetTokens(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.ProvisionTokenV2List, error)
+	// GetStaticTokens retrieves all static tokens.
+	GetStaticTokens(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.StaticTokensV2, error)
+	// ListToken retrieves a paginated list of filtered provision tokens.
+	ListProvisionTokens(ctx context.Context, in *ListProvisionTokensRequest, opts ...grpc.CallOption) (*ListProvisionTokensResponse, error)
 	// CreateTokenV2 creates a token in a backend.
 	CreateTokenV2(ctx context.Context, in *CreateTokenV2Request, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// UpsertTokenV2 upserts a token in a backend.
@@ -761,6 +803,8 @@ type AuthServiceClient interface {
 	GetLock(ctx context.Context, in *GetLockRequest, opts ...grpc.CallOption) (*types.LockV2, error)
 	// GetLocks gets all/in-force locks that match at least one of the targets when specified.
 	GetLocks(ctx context.Context, in *GetLocksRequest, opts ...grpc.CallOption) (*GetLocksResponse, error)
+	// ListLocks returns a page of locks matching a filter.
+	ListLocks(ctx context.Context, in *ListLocksRequest, opts ...grpc.CallOption) (*ListLocksResponse, error)
 	// UpsertLock upserts a lock.
 	UpsertLock(ctx context.Context, in *types.LockV2, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// DeleteLock deletes a lock.
@@ -777,6 +821,8 @@ type AuthServiceClient interface {
 	DeleteNetworkRestrictions(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetApps returns all registered applications.
 	GetApps(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.AppV3List, error)
+	// ListApps returns a page of registered applications.
+	ListApps(ctx context.Context, in *ListAppsRequest, opts ...grpc.CallOption) (*ListAppsResponse, error)
 	// GetApp returns an application by name.
 	GetApp(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.AppV3, error)
 	// CreateApp creates a new application resource.
@@ -789,6 +835,8 @@ type AuthServiceClient interface {
 	DeleteAllApps(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetDatabases returns all registered databases.
 	GetDatabases(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.DatabaseV3List, error)
+	// ListDatabases returns a page of registered databases.
+	ListDatabases(ctx context.Context, in *ListDatabasesRequest, opts ...grpc.CallOption) (*ListDatabasesResponse, error)
 	// GetDatabase returns a database by name.
 	GetDatabase(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.DatabaseV3, error)
 	// CreateDatabase creates a new database resource.
@@ -801,6 +849,8 @@ type AuthServiceClient interface {
 	DeleteAllDatabases(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetKubernetesClusters returns all registered kubernetes clusters.
 	GetKubernetesClusters(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.KubernetesClusterV3List, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, in *ListKubernetesClustersRequest, opts ...grpc.CallOption) (*ListKubernetesClustersResponse, error)
 	// GetKubernetesCluster returns a kubernetes cluster by name.
 	GetKubernetesCluster(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.KubernetesClusterV3, error)
 	// CreateKubernetesCluster creates a new kubernetes cluster resource.
@@ -823,6 +873,8 @@ type AuthServiceClient interface {
 	DeleteAllWindowsDesktopServices(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetWindowsDesktops returns all registered Windows desktop hosts matching the supplied filter.
 	GetWindowsDesktops(ctx context.Context, in *types.WindowsDesktopFilter, opts ...grpc.CallOption) (*GetWindowsDesktopsResponse, error)
+	// ListWindowsDesktops returns a page of registered Windows desktop hosts.
+	ListWindowsDesktops(ctx context.Context, in *ListWindowsDesktopsRequest, opts ...grpc.CallOption) (*ListWindowsDesktopsResponse, error)
 	// CreateWindowsDesktop registers a new Windows desktop host.
 	CreateWindowsDesktop(ctx context.Context, in *types.WindowsDesktopV3, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// UpdateWindowsDesktop updates an existing Windows desktop host.
@@ -920,6 +972,8 @@ type AuthServiceClient interface {
 	GetInstaller(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.InstallerV1, error)
 	// GetInstallers retrieves all of installer script resources.
 	GetInstallers(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.InstallerV1List, error)
+	// ListInstallers returns a page of installer script resources.
+	ListInstallers(ctx context.Context, in *ListInstallersRequest, opts ...grpc.CallOption) (*ListInstallersResponse, error)
 	// SetInstaller sets the installer script resource
 	SetInstaller(ctx context.Context, in *types.InstallerV1, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// DeleteInstaller removes the specified installer script resource
@@ -1411,6 +1465,16 @@ func (c *authServiceClient) GetAccessCapabilities(ctx context.Context, in *types
 	return out, nil
 }
 
+func (c *authServiceClient) GetRemoteAccessCapabilities(ctx context.Context, in *types.RemoteAccessCapabilitiesRequest, opts ...grpc.CallOption) (*types.RemoteAccessCapabilities, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(types.RemoteAccessCapabilities)
+	err := c.cc.Invoke(ctx, AuthService_GetRemoteAccessCapabilities_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) GetAccessRequestAllowedPromotions(ctx context.Context, in *AccessRequestAllowedPromotionRequest, opts ...grpc.CallOption) (*AccessRequestAllowedPromotionResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessRequestAllowedPromotionResponse)
@@ -1471,6 +1535,16 @@ func (c *authServiceClient) CreateResetPasswordToken(ctx context.Context, in *Cr
 	return out, nil
 }
 
+func (c *authServiceClient) ListResetPasswordTokens(ctx context.Context, in *ListResetPasswordTokenRequest, opts ...grpc.CallOption) (*ListResetPasswordTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListResetPasswordTokenResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListResetPasswordTokens_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // Deprecated: Do not use.
 func (c *authServiceClient) GetUser(ctx context.Context, in *GetUserRequest, opts ...grpc.CallOption) (*types.UserV2, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
@@ -1615,6 +1689,16 @@ func (c *authServiceClient) GetSemaphores(ctx context.Context, in *types.Semapho
 	return out, nil
 }
 
+func (c *authServiceClient) ListSemaphores(ctx context.Context, in *ListSemaphoresRequest, opts ...grpc.CallOption) (*ListSemaphoresResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListSemaphoresResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListSemaphores_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) DeleteSemaphore(ctx context.Context, in *types.SemaphoreFilter, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -1778,6 +1862,16 @@ func (c *authServiceClient) GetSnowflakeSessions(ctx context.Context, in *emptyp
 	return out, nil
 }
 
+func (c *authServiceClient) ListSnowflakeSessions(ctx context.Context, in *ListSnowflakeSessionsRequest, opts ...grpc.CallOption) (*ListSnowflakeSessionsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListSnowflakeSessionsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListSnowflakeSessions_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) DeleteSnowflakeSession(ctx context.Context, in *DeleteSnowflakeSessionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -1944,6 +2038,16 @@ func (c *authServiceClient) GetWebTokens(ctx context.Context, in *emptypb.Empty,
 	return out, nil
 }
 
+func (c *authServiceClient) ListWebTokens(ctx context.Context, in *ListWebTokensRequest, opts ...grpc.CallOption) (*ListWebTokensResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListWebTokensResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListWebTokens_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) DeleteWebToken(ctx context.Context, in *types.DeleteWebTokenRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -2114,6 +2218,16 @@ func (c *authServiceClient) ListRoles(ctx context.Context, in *ListRolesRequest,
 	return out, nil
 }
 
+func (c *authServiceClient) ListRequestableRoles(ctx context.Context, in *ListRequestableRolesRequest, opts ...grpc.CallOption) (*ListRequestableRolesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRequestableRolesResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListRequestableRoles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateRole(ctx context.Context, in *CreateRoleRequest, opts ...grpc.CallOption) (*types.RoleV6, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.RoleV6)
@@ -2263,6 +2377,16 @@ func (c *authServiceClient) GetOIDCConnectors(ctx context.Context, in *types.Res
 	return out, nil
 }
 
+func (c *authServiceClient) ListOIDCConnectors(ctx context.Context, in *ListOIDCConnectorsRequest, opts ...grpc.CallOption) (*ListOIDCConnectorsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListOIDCConnectorsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListOIDCConnectors_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateOIDCConnector(ctx context.Context, in *CreateOIDCConnectorRequest, opts ...grpc.CallOption) (*types.OIDCConnectorV3, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OIDCConnectorV3)
@@ -2354,6 +2478,16 @@ func (c *authServiceClient) GetSAMLConnectors(ctx context.Context, in *types.Res
 	return out, nil
 }
 
+func (c *authServiceClient) ListSAMLConnectors(ctx context.Context, in *ListSAMLConnectorsRequest, opts ...grpc.CallOption) (*ListSAMLConnectorsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListSAMLConnectorsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListSAMLConnectors_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateSAMLConnector(ctx context.Context, in *CreateSAMLConnectorRequest, opts ...grpc.CallOption) (*types.SAMLConnectorV2, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.SAMLConnectorV2)
@@ -2445,6 +2579,16 @@ func (c *authServiceClient) GetGithubConnectors(ctx context.Context, in *types.R
 	return out, nil
 }
 
+func (c *authServiceClient) ListGithubConnectors(ctx context.Context, in *ListGithubConnectorsRequest, opts ...grpc.CallOption) (*ListGithubConnectorsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListGithubConnectorsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListGithubConnectors_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateGithubConnector(ctx context.Context, in *CreateGithubConnectorRequest, opts ...grpc.CallOption) (*types.GithubConnectorV3, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.GithubConnectorV3)
@@ -2636,6 +2780,7 @@ func (c *authServiceClient) GetToken(ctx context.Context, in *types.ResourceRequ
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *authServiceClient) GetTokens(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.ProvisionTokenV2List, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ProvisionTokenV2List)
@@ -2646,6 +2791,26 @@ func (c *authServiceClient) GetTokens(ctx context.Context, in *emptypb.Empty, op
 	return out, nil
 }
 
+func (c *authServiceClient) GetStaticTokens(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*types.StaticTokensV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(types.StaticTokensV2)
+	err := c.cc.Invoke(ctx, AuthService_GetStaticTokens_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) ListProvisionTokens(ctx context.Context, in *ListProvisionTokensRequest, opts ...grpc.CallOption) (*ListProvisionTokensResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListProvisionTokensResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListProvisionTokens_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateTokenV2(ctx context.Context, in *CreateTokenV2Request, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -2855,6 +3020,16 @@ func (c *authServiceClient) GetLocks(ctx context.Context, in *GetLocksRequest, o
 	return out, nil
 }
 
+func (c *authServiceClient) ListLocks(ctx context.Context, in *ListLocksRequest, opts ...grpc.CallOption) (*ListLocksResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListLocksResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListLocks_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) UpsertLock(ctx context.Context, in *types.LockV2, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -2944,6 +3119,16 @@ func (c *authServiceClient) GetApps(ctx context.Context, in *emptypb.Empty, opts
 	return out, nil
 }
 
+func (c *authServiceClient) ListApps(ctx context.Context, in *ListAppsRequest, opts ...grpc.CallOption) (*ListAppsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAppsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListApps_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) GetApp(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.AppV3, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.AppV3)
@@ -3004,6 +3189,16 @@ func (c *authServiceClient) GetDatabases(ctx context.Context, in *emptypb.Empty,
 	return out, nil
 }
 
+func (c *authServiceClient) ListDatabases(ctx context.Context, in *ListDatabasesRequest, opts ...grpc.CallOption) (*ListDatabasesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListDatabasesResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListDatabases_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) GetDatabase(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.DatabaseV3, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.DatabaseV3)
@@ -3064,6 +3259,16 @@ func (c *authServiceClient) GetKubernetesClusters(ctx context.Context, in *empty
 	return out, nil
 }
 
+func (c *authServiceClient) ListKubernetesClusters(ctx context.Context, in *ListKubernetesClustersRequest, opts ...grpc.CallOption) (*ListKubernetesClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListKubernetesClustersResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListKubernetesClusters_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) GetKubernetesCluster(ctx context.Context, in *types.ResourceRequest, opts ...grpc.CallOption) (*types.KubernetesClusterV3, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.KubernetesClusterV3)
@@ -3174,6 +3379,16 @@ func (c *authServiceClient) GetWindowsDesktops(ctx context.Context, in *types.Wi
 	return out, nil
 }
 
+func (c *authServiceClient) ListWindowsDesktops(ctx context.Context, in *ListWindowsDesktopsRequest, opts ...grpc.CallOption) (*ListWindowsDesktopsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListWindowsDesktopsResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListWindowsDesktops_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) CreateWindowsDesktop(ctx context.Context, in *types.WindowsDesktopV3, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -3394,6 +3609,16 @@ func (c *authServiceClient) GetInstallers(ctx context.Context, in *emptypb.Empty
 	return out, nil
 }
 
+func (c *authServiceClient) ListInstallers(ctx context.Context, in *ListInstallersRequest, opts ...grpc.CallOption) (*ListInstallersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListInstallersResponse)
+	err := c.cc.Invoke(ctx, AuthService_ListInstallers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) SetInstaller(ctx context.Context, in *types.InstallerV1, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -3804,6 +4029,8 @@ type AuthServiceServer interface {
 	SubmitAccessReview(context.Context, *types.AccessReviewSubmission) (*types.AccessRequestV3, error)
 	// GetAccessCapabilities requests the access capabilities of a user.
 	GetAccessCapabilities(context.Context, *types.AccessCapabilitiesRequest) (*types.AccessCapabilities, error)
+	// GetRemoteAccessCapabilities requests the access capabilities for a user from a remote cluster
+	GetRemoteAccessCapabilities(context.Context, *types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error)
 	// GetAccessRequestAllowedPromotions returns a list of allowed promotions from an access request to an access list.
 	GetAccessRequestAllowedPromotions(context.Context, *AccessRequestAllowedPromotionRequest) (*AccessRequestAllowedPromotionResponse, error)
 	// GetPluginData gets all plugin data matching the supplied filter.
@@ -3821,6 +4048,8 @@ type AuthServiceServer interface {
 	//
 	// Only local users may be reset.
 	CreateResetPasswordToken(context.Context, *CreateResetPasswordTokenRequest) (*types.UserTokenV3, error)
+	// ListResetPasswordTokens returns a page of user tokens.
+	ListResetPasswordTokens(context.Context, *ListResetPasswordTokenRequest) (*ListResetPasswordTokenResponse, error)
 	// Deprecated: Do not use.
 	// GetUser gets a user resource by name.
 	//
@@ -3866,6 +4095,8 @@ type AuthServiceServer interface {
 	CancelSemaphoreLease(context.Context, *types.SemaphoreLease) (*emptypb.Empty, error)
 	// GetSemaphores returns a list of all semaphores matching the supplied filter.
 	GetSemaphores(context.Context, *types.SemaphoreFilter) (*Semaphores, error)
+	// ListSemaphores returns a page of all semaphores matching the supplied filter.
+	ListSemaphores(context.Context, *ListSemaphoresRequest) (*ListSemaphoresResponse, error)
 	// DeleteSemaphore deletes a semaphore matching the supplied filter.
 	DeleteSemaphore(context.Context, *types.SemaphoreFilter) (*emptypb.Empty, error)
 	// EmitAuditEvent emits audit event
@@ -3900,6 +4131,8 @@ type AuthServiceServer interface {
 	GetSnowflakeSession(context.Context, *GetSnowflakeSessionRequest) (*GetSnowflakeSessionResponse, error)
 	// GetSnowflakeSessions gets all Snowflake web sessions.
 	GetSnowflakeSessions(context.Context, *emptypb.Empty) (*GetSnowflakeSessionsResponse, error)
+	// ListSnowflakeSessions returns a page of Snowflake web sessions.
+	ListSnowflakeSessions(context.Context, *ListSnowflakeSessionsRequest) (*ListSnowflakeSessionsResponse, error)
 	// DeleteSnowflakeSession removes a Snowflake web session.
 	DeleteSnowflakeSession(context.Context, *DeleteSnowflakeSessionRequest) (*emptypb.Empty, error)
 	// DeleteAllSnowflakeSessions removes all Snowflake web sessions.
@@ -3937,6 +4170,8 @@ type AuthServiceServer interface {
 	GetWebToken(context.Context, *types.GetWebTokenRequest) (*GetWebTokenResponse, error)
 	// GetWebTokens gets all web tokens.
 	GetWebTokens(context.Context, *emptypb.Empty) (*GetWebTokensResponse, error)
+	// ListWebTokens returns a page of web tokens.
+	ListWebTokens(context.Context, *ListWebTokensRequest) (*ListWebTokensResponse, error)
 	// DeleteWebToken deletes a web token.
 	DeleteWebToken(context.Context, *types.DeleteWebTokenRequest) (*emptypb.Empty, error)
 	// DeleteAllWebTokens deletes all web tokens.
@@ -3975,6 +4210,8 @@ type AuthServiceServer interface {
 	GetRole(context.Context, *GetRoleRequest) (*types.RoleV6, error)
 	// ListRoles is a paginated role getter.
 	ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error)
+	// ListRequestableRoles is a paginated requestable role getter.
+	ListRequestableRoles(context.Context, *ListRequestableRolesRequest) (*ListRequestableRolesResponse, error)
 	// CreateRole creates a new role.
 	CreateRole(context.Context, *CreateRoleRequest) (*types.RoleV6, error)
 	// UpdateRole updates an existing role.
@@ -4045,6 +4282,8 @@ type AuthServiceServer interface {
 	GetOIDCConnector(context.Context, *types.ResourceWithSecretsRequest) (*types.OIDCConnectorV3, error)
 	// GetOIDCConnectors gets all current OIDC connector resources.
 	GetOIDCConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.OIDCConnectorV3List, error)
+	// ListOIDCConnectors returns a page of current OIDC connector resources.
+	ListOIDCConnectors(context.Context, *ListOIDCConnectorsRequest) (*ListOIDCConnectorsResponse, error)
 	// UpsertOIDCConnector creates a new OIDC connector in the backend.
 	CreateOIDCConnector(context.Context, *CreateOIDCConnectorRequest) (*types.OIDCConnectorV3, error)
 	// UpsertOIDCConnector updates an existing OIDC connector in the backend.
@@ -4066,6 +4305,8 @@ type AuthServiceServer interface {
 	GetSAMLConnector(context.Context, *types.ResourceWithSecretsRequest) (*types.SAMLConnectorV2, error)
 	// GetSAMLConnectors gets all current SAML connector resources.
 	GetSAMLConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.SAMLConnectorV2List, error)
+	// ListSAMLConnectors returns a page of current SAML connector resources.
+	ListSAMLConnectors(context.Context, *ListSAMLConnectorsRequest) (*ListSAMLConnectorsResponse, error)
 	// CreateSAMLConnector creates a new SAML connector in the backend.
 	CreateSAMLConnector(context.Context, *CreateSAMLConnectorRequest) (*types.SAMLConnectorV2, error)
 	// UpdateSAMLConnector updates an existing SAML connector in the backend.
@@ -4087,6 +4328,8 @@ type AuthServiceServer interface {
 	GetGithubConnector(context.Context, *types.ResourceWithSecretsRequest) (*types.GithubConnectorV3, error)
 	// GetGithubConnectors gets all current Github connector resources.
 	GetGithubConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.GithubConnectorV3List, error)
+	// ListGithubConnectors returns a page of current Github connector resources.
+	ListGithubConnectors(context.Context, *ListGithubConnectorsRequest) (*ListGithubConnectorsResponse, error)
 	// CreateGithubConnector creates a new Github connector in the backend.
 	CreateGithubConnector(context.Context, *CreateGithubConnectorRequest) (*types.GithubConnectorV3, error)
 	// UpdateGithubConnector updates an existing Github connector in the backend.
@@ -4129,8 +4372,15 @@ type AuthServiceServer interface {
 	DeleteTrustedCluster(context.Context, *types.ResourceRequest) (*emptypb.Empty, error)
 	// GetToken retrieves a token described by the given request.
 	GetToken(context.Context, *types.ResourceRequest) (*types.ProvisionTokenV2, error)
+	// Deprecated: Do not use.
 	// GetToken retrieves all tokens.
+	// Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+	// TODO(hugoShaka): DELETE IN 21.0.0
 	GetTokens(context.Context, *emptypb.Empty) (*types.ProvisionTokenV2List, error)
+	// GetStaticTokens retrieves all static tokens.
+	GetStaticTokens(context.Context, *emptypb.Empty) (*types.StaticTokensV2, error)
+	// ListToken retrieves a paginated list of filtered provision tokens.
+	ListProvisionTokens(context.Context, *ListProvisionTokensRequest) (*ListProvisionTokensResponse, error)
 	// CreateTokenV2 creates a token in a backend.
 	CreateTokenV2(context.Context, *CreateTokenV2Request) (*emptypb.Empty, error)
 	// UpsertTokenV2 upserts a token in a backend.
@@ -4189,6 +4439,8 @@ type AuthServiceServer interface {
 	GetLock(context.Context, *GetLockRequest) (*types.LockV2, error)
 	// GetLocks gets all/in-force locks that match at least one of the targets when specified.
 	GetLocks(context.Context, *GetLocksRequest) (*GetLocksResponse, error)
+	// ListLocks returns a page of locks matching a filter.
+	ListLocks(context.Context, *ListLocksRequest) (*ListLocksResponse, error)
 	// UpsertLock upserts a lock.
 	UpsertLock(context.Context, *types.LockV2) (*emptypb.Empty, error)
 	// DeleteLock deletes a lock.
@@ -4205,6 +4457,8 @@ type AuthServiceServer interface {
 	DeleteNetworkRestrictions(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	// GetApps returns all registered applications.
 	GetApps(context.Context, *emptypb.Empty) (*types.AppV3List, error)
+	// ListApps returns a page of registered applications.
+	ListApps(context.Context, *ListAppsRequest) (*ListAppsResponse, error)
 	// GetApp returns an application by name.
 	GetApp(context.Context, *types.ResourceRequest) (*types.AppV3, error)
 	// CreateApp creates a new application resource.
@@ -4217,6 +4471,8 @@ type AuthServiceServer interface {
 	DeleteAllApps(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	// GetDatabases returns all registered databases.
 	GetDatabases(context.Context, *emptypb.Empty) (*types.DatabaseV3List, error)
+	// ListDatabases returns a page of registered databases.
+	ListDatabases(context.Context, *ListDatabasesRequest) (*ListDatabasesResponse, error)
 	// GetDatabase returns a database by name.
 	GetDatabase(context.Context, *types.ResourceRequest) (*types.DatabaseV3, error)
 	// CreateDatabase creates a new database resource.
@@ -4229,6 +4485,8 @@ type AuthServiceServer interface {
 	DeleteAllDatabases(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	// GetKubernetesClusters returns all registered kubernetes clusters.
 	GetKubernetesClusters(context.Context, *emptypb.Empty) (*types.KubernetesClusterV3List, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(context.Context, *ListKubernetesClustersRequest) (*ListKubernetesClustersResponse, error)
 	// GetKubernetesCluster returns a kubernetes cluster by name.
 	GetKubernetesCluster(context.Context, *types.ResourceRequest) (*types.KubernetesClusterV3, error)
 	// CreateKubernetesCluster creates a new kubernetes cluster resource.
@@ -4251,6 +4509,8 @@ type AuthServiceServer interface {
 	DeleteAllWindowsDesktopServices(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	// GetWindowsDesktops returns all registered Windows desktop hosts matching the supplied filter.
 	GetWindowsDesktops(context.Context, *types.WindowsDesktopFilter) (*GetWindowsDesktopsResponse, error)
+	// ListWindowsDesktops returns a page of registered Windows desktop hosts.
+	ListWindowsDesktops(context.Context, *ListWindowsDesktopsRequest) (*ListWindowsDesktopsResponse, error)
 	// CreateWindowsDesktop registers a new Windows desktop host.
 	CreateWindowsDesktop(context.Context, *types.WindowsDesktopV3) (*emptypb.Empty, error)
 	// UpdateWindowsDesktop updates an existing Windows desktop host.
@@ -4348,6 +4608,8 @@ type AuthServiceServer interface {
 	GetInstaller(context.Context, *types.ResourceRequest) (*types.InstallerV1, error)
 	// GetInstallers retrieves all of installer script resources.
 	GetInstallers(context.Context, *emptypb.Empty) (*types.InstallerV1List, error)
+	// ListInstallers returns a page of installer script resources.
+	ListInstallers(context.Context, *ListInstallersRequest) (*ListInstallersResponse, error)
 	// SetInstaller sets the installer script resource
 	SetInstaller(context.Context, *types.InstallerV1) (*emptypb.Empty, error)
 	// DeleteInstaller removes the specified installer script resource
@@ -4535,6 +4797,9 @@ func (UnimplementedAuthServiceServer) SubmitAccessReview(context.Context, *types
 func (UnimplementedAuthServiceServer) GetAccessCapabilities(context.Context, *types.AccessCapabilitiesRequest) (*types.AccessCapabilities, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAccessCapabilities not implemented")
 }
+func (UnimplementedAuthServiceServer) GetRemoteAccessCapabilities(context.Context, *types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetRemoteAccessCapabilities not implemented")
+}
 func (UnimplementedAuthServiceServer) GetAccessRequestAllowedPromotions(context.Context, *AccessRequestAllowedPromotionRequest) (*AccessRequestAllowedPromotionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAccessRequestAllowedPromotions not implemented")
 }
@@ -4553,6 +4818,9 @@ func (UnimplementedAuthServiceServer) GetResetPasswordToken(context.Context, *Ge
 func (UnimplementedAuthServiceServer) CreateResetPasswordToken(context.Context, *CreateResetPasswordTokenRequest) (*types.UserTokenV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateResetPasswordToken not implemented")
 }
+func (UnimplementedAuthServiceServer) ListResetPasswordTokens(context.Context, *ListResetPasswordTokenRequest) (*ListResetPasswordTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListResetPasswordTokens not implemented")
+}
 func (UnimplementedAuthServiceServer) GetUser(context.Context, *GetUserRequest) (*types.UserV2, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetUser not implemented")
 }
@@ -4589,6 +4857,9 @@ func (UnimplementedAuthServiceServer) CancelSemaphoreLease(context.Context, *typ
 func (UnimplementedAuthServiceServer) GetSemaphores(context.Context, *types.SemaphoreFilter) (*Semaphores, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSemaphores not implemented")
 }
+func (UnimplementedAuthServiceServer) ListSemaphores(context.Context, *ListSemaphoresRequest) (*ListSemaphoresResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListSemaphores not implemented")
+}
 func (UnimplementedAuthServiceServer) DeleteSemaphore(context.Context, *types.SemaphoreFilter) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteSemaphore not implemented")
 }
@@ -4637,6 +4908,9 @@ func (UnimplementedAuthServiceServer) GetSnowflakeSession(context.Context, *GetS
 func (UnimplementedAuthServiceServer) GetSnowflakeSessions(context.Context, *emptypb.Empty) (*GetSnowflakeSessionsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSnowflakeSessions not implemented")
 }
+func (UnimplementedAuthServiceServer) ListSnowflakeSessions(context.Context, *ListSnowflakeSessionsRequest) (*ListSnowflakeSessionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListSnowflakeSessions not implemented")
+}
 func (UnimplementedAuthServiceServer) DeleteSnowflakeSession(context.Context, *DeleteSnowflakeSessionRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteSnowflakeSession not implemented")
 }
@@ -4682,6 +4956,9 @@ func (UnimplementedAuthServiceServer) GetWebToken(context.Context, *types.GetWeb
 func (UnimplementedAuthServiceServer) GetWebTokens(context.Context, *emptypb.Empty) (*GetWebTokensResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetWebTokens not implemented")
 }
+func (UnimplementedAuthServiceServer) ListWebTokens(context.Context, *ListWebTokensRequest) (*ListWebTokensResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListWebTokens not implemented")
+}
 func (UnimplementedAuthServiceServer) DeleteWebToken(context.Context, *types.DeleteWebTokenRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteWebToken not implemented")
 }
@@ -4733,6 +5010,9 @@ func (UnimplementedAuthServiceServer) GetRole(context.Context, *GetRoleRequest)
 func (UnimplementedAuthServiceServer) ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListRoles not implemented")
 }
+func (UnimplementedAuthServiceServer) ListRequestableRoles(context.Context, *ListRequestableRolesRequest) (*ListRequestableRolesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListRequestableRoles not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateRole(context.Context, *CreateRoleRequest) (*types.RoleV6, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateRole not implemented")
 }
@@ -4775,6 +5055,9 @@ func (UnimplementedAuthServiceServer) GetOIDCConnector(context.Context, *types.R
 func (UnimplementedAuthServiceServer) GetOIDCConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.OIDCConnectorV3List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetOIDCConnectors not implemented")
 }
+func (UnimplementedAuthServiceServer) ListOIDCConnectors(context.Context, *ListOIDCConnectorsRequest) (*ListOIDCConnectorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListOIDCConnectors not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateOIDCConnector(context.Context, *CreateOIDCConnectorRequest) (*types.OIDCConnectorV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateOIDCConnector not implemented")
 }
@@ -4802,6 +5085,9 @@ func (UnimplementedAuthServiceServer) GetSAMLConnector(context.Context, *types.R
 func (UnimplementedAuthServiceServer) GetSAMLConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.SAMLConnectorV2List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSAMLConnectors not implemented")
 }
+func (UnimplementedAuthServiceServer) ListSAMLConnectors(context.Context, *ListSAMLConnectorsRequest) (*ListSAMLConnectorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListSAMLConnectors not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateSAMLConnector(context.Context, *CreateSAMLConnectorRequest) (*types.SAMLConnectorV2, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateSAMLConnector not implemented")
 }
@@ -4829,6 +5115,9 @@ func (UnimplementedAuthServiceServer) GetGithubConnector(context.Context, *types
 func (UnimplementedAuthServiceServer) GetGithubConnectors(context.Context, *types.ResourcesWithSecretsRequest) (*types.GithubConnectorV3List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetGithubConnectors not implemented")
 }
+func (UnimplementedAuthServiceServer) ListGithubConnectors(context.Context, *ListGithubConnectorsRequest) (*ListGithubConnectorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListGithubConnectors not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateGithubConnector(context.Context, *CreateGithubConnectorRequest) (*types.GithubConnectorV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateGithubConnector not implemented")
 }
@@ -4886,6 +5175,12 @@ func (UnimplementedAuthServiceServer) GetToken(context.Context, *types.ResourceR
 func (UnimplementedAuthServiceServer) GetTokens(context.Context, *emptypb.Empty) (*types.ProvisionTokenV2List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetTokens not implemented")
 }
+func (UnimplementedAuthServiceServer) GetStaticTokens(context.Context, *emptypb.Empty) (*types.StaticTokensV2, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetStaticTokens not implemented")
+}
+func (UnimplementedAuthServiceServer) ListProvisionTokens(context.Context, *ListProvisionTokensRequest) (*ListProvisionTokensResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListProvisionTokens not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateTokenV2(context.Context, *CreateTokenV2Request) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateTokenV2 not implemented")
 }
@@ -4946,6 +5241,9 @@ func (UnimplementedAuthServiceServer) GetLock(context.Context, *GetLockRequest)
 func (UnimplementedAuthServiceServer) GetLocks(context.Context, *GetLocksRequest) (*GetLocksResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetLocks not implemented")
 }
+func (UnimplementedAuthServiceServer) ListLocks(context.Context, *ListLocksRequest) (*ListLocksResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListLocks not implemented")
+}
 func (UnimplementedAuthServiceServer) UpsertLock(context.Context, *types.LockV2) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpsertLock not implemented")
 }
@@ -4970,6 +5268,9 @@ func (UnimplementedAuthServiceServer) DeleteNetworkRestrictions(context.Context,
 func (UnimplementedAuthServiceServer) GetApps(context.Context, *emptypb.Empty) (*types.AppV3List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetApps not implemented")
 }
+func (UnimplementedAuthServiceServer) ListApps(context.Context, *ListAppsRequest) (*ListAppsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListApps not implemented")
+}
 func (UnimplementedAuthServiceServer) GetApp(context.Context, *types.ResourceRequest) (*types.AppV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetApp not implemented")
 }
@@ -4988,6 +5289,9 @@ func (UnimplementedAuthServiceServer) DeleteAllApps(context.Context, *emptypb.Em
 func (UnimplementedAuthServiceServer) GetDatabases(context.Context, *emptypb.Empty) (*types.DatabaseV3List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetDatabases not implemented")
 }
+func (UnimplementedAuthServiceServer) ListDatabases(context.Context, *ListDatabasesRequest) (*ListDatabasesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListDatabases not implemented")
+}
 func (UnimplementedAuthServiceServer) GetDatabase(context.Context, *types.ResourceRequest) (*types.DatabaseV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetDatabase not implemented")
 }
@@ -5006,6 +5310,9 @@ func (UnimplementedAuthServiceServer) DeleteAllDatabases(context.Context, *empty
 func (UnimplementedAuthServiceServer) GetKubernetesClusters(context.Context, *emptypb.Empty) (*types.KubernetesClusterV3List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetKubernetesClusters not implemented")
 }
+func (UnimplementedAuthServiceServer) ListKubernetesClusters(context.Context, *ListKubernetesClustersRequest) (*ListKubernetesClustersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListKubernetesClusters not implemented")
+}
 func (UnimplementedAuthServiceServer) GetKubernetesCluster(context.Context, *types.ResourceRequest) (*types.KubernetesClusterV3, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetKubernetesCluster not implemented")
 }
@@ -5039,6 +5346,9 @@ func (UnimplementedAuthServiceServer) DeleteAllWindowsDesktopServices(context.Co
 func (UnimplementedAuthServiceServer) GetWindowsDesktops(context.Context, *types.WindowsDesktopFilter) (*GetWindowsDesktopsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetWindowsDesktops not implemented")
 }
+func (UnimplementedAuthServiceServer) ListWindowsDesktops(context.Context, *ListWindowsDesktopsRequest) (*ListWindowsDesktopsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListWindowsDesktops not implemented")
+}
 func (UnimplementedAuthServiceServer) CreateWindowsDesktop(context.Context, *types.WindowsDesktopV3) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateWindowsDesktop not implemented")
 }
@@ -5105,6 +5415,9 @@ func (UnimplementedAuthServiceServer) GetInstaller(context.Context, *types.Resou
 func (UnimplementedAuthServiceServer) GetInstallers(context.Context, *emptypb.Empty) (*types.InstallerV1List, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetInstallers not implemented")
 }
+func (UnimplementedAuthServiceServer) ListInstallers(context.Context, *ListInstallersRequest) (*ListInstallersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListInstallers not implemented")
+}
 func (UnimplementedAuthServiceServer) SetInstaller(context.Context, *types.InstallerV1) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SetInstaller not implemented")
 }
@@ -5772,6 +6085,24 @@ func _AuthService_GetAccessCapabilities_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_GetRemoteAccessCapabilities_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(types.RemoteAccessCapabilitiesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetRemoteAccessCapabilities(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetRemoteAccessCapabilities_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetRemoteAccessCapabilities(ctx, req.(*types.RemoteAccessCapabilitiesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_GetAccessRequestAllowedPromotions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(AccessRequestAllowedPromotionRequest)
 	if err := dec(in); err != nil {
@@ -5880,6 +6211,24 @@ func _AuthService_CreateResetPasswordToken_Handler(srv interface{}, ctx context.
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListResetPasswordTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListResetPasswordTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListResetPasswordTokens(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListResetPasswordTokens_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListResetPasswordTokens(ctx, req.(*ListResetPasswordTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_GetUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetUserRequest)
 	if err := dec(in); err != nil {
@@ -6082,6 +6431,24 @@ func _AuthService_GetSemaphores_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListSemaphores_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListSemaphoresRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListSemaphores(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListSemaphores_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListSemaphores(ctx, req.(*ListSemaphoresRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_DeleteSemaphore_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.SemaphoreFilter)
 	if err := dec(in); err != nil {
@@ -6359,6 +6726,24 @@ func _AuthService_GetSnowflakeSessions_Handler(srv interface{}, ctx context.Cont
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListSnowflakeSessions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListSnowflakeSessionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListSnowflakeSessions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListSnowflakeSessions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListSnowflakeSessions(ctx, req.(*ListSnowflakeSessionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_DeleteSnowflakeSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DeleteSnowflakeSessionRequest)
 	if err := dec(in); err != nil {
@@ -6622,6 +7007,24 @@ func _AuthService_GetWebTokens_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListWebTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListWebTokensRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListWebTokens(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListWebTokens_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListWebTokens(ctx, req.(*ListWebTokensRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_DeleteWebToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.DeleteWebTokenRequest)
 	if err := dec(in); err != nil {
@@ -6928,6 +7331,24 @@ func _AuthService_ListRoles_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListRequestableRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRequestableRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListRequestableRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListRequestableRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListRequestableRoles(ctx, req.(*ListRequestableRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateRoleRequest)
 	if err := dec(in); err != nil {
@@ -7158,6 +7579,24 @@ func _AuthService_GetOIDCConnectors_Handler(srv interface{}, ctx context.Context
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListOIDCConnectors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListOIDCConnectorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListOIDCConnectors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListOIDCConnectors_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListOIDCConnectors(ctx, req.(*ListOIDCConnectorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateOIDCConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateOIDCConnectorRequest)
 	if err := dec(in); err != nil {
@@ -7320,6 +7759,24 @@ func _AuthService_GetSAMLConnectors_Handler(srv interface{}, ctx context.Context
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListSAMLConnectors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListSAMLConnectorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListSAMLConnectors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListSAMLConnectors_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListSAMLConnectors(ctx, req.(*ListSAMLConnectorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateSAMLConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateSAMLConnectorRequest)
 	if err := dec(in); err != nil {
@@ -7482,6 +7939,24 @@ func _AuthService_GetGithubConnectors_Handler(srv interface{}, ctx context.Conte
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListGithubConnectors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListGithubConnectorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListGithubConnectors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListGithubConnectors_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListGithubConnectors(ctx, req.(*ListGithubConnectorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateGithubConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateGithubConnectorRequest)
 	if err := dec(in); err != nil {
@@ -7817,6 +8292,42 @@ func _AuthService_GetTokens_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_GetStaticTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetStaticTokens(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetStaticTokens_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetStaticTokens(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_ListProvisionTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListProvisionTokensRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListProvisionTokens(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListProvisionTokens_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListProvisionTokens(ctx, req.(*ListProvisionTokensRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateTokenV2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateTokenV2Request)
 	if err := dec(in); err != nil {
@@ -8177,6 +8688,24 @@ func _AuthService_GetLocks_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListLocks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListLocksRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListLocks(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListLocks_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListLocks(ctx, req.(*ListLocksRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_UpsertLock_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.LockV2)
 	if err := dec(in); err != nil {
@@ -8314,6 +8843,24 @@ func _AuthService_GetApps_Handler(srv interface{}, ctx context.Context, dec func
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListApps_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAppsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListApps(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListApps_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListApps(ctx, req.(*ListAppsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_GetApp_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.ResourceRequest)
 	if err := dec(in); err != nil {
@@ -8422,6 +8969,24 @@ func _AuthService_GetDatabases_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListDatabases_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListDatabasesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListDatabases(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListDatabases_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListDatabases(ctx, req.(*ListDatabasesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_GetDatabase_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.ResourceRequest)
 	if err := dec(in); err != nil {
@@ -8530,6 +9095,24 @@ func _AuthService_GetKubernetesClusters_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListKubernetesClusters_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListKubernetesClustersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListKubernetesClusters(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListKubernetesClusters_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListKubernetesClusters(ctx, req.(*ListKubernetesClustersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_GetKubernetesCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.ResourceRequest)
 	if err := dec(in); err != nil {
@@ -8728,6 +9311,24 @@ func _AuthService_GetWindowsDesktops_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListWindowsDesktops_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListWindowsDesktopsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListWindowsDesktops(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListWindowsDesktops_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListWindowsDesktops(ctx, req.(*ListWindowsDesktopsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_CreateWindowsDesktop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.WindowsDesktopV3)
 	if err := dec(in); err != nil {
@@ -9124,6 +9725,24 @@ func _AuthService_GetInstallers_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_ListInstallers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListInstallersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ListInstallers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ListInstallers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ListInstallers(ctx, req.(*ListInstallersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_SetInstaller_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(types.InstallerV1)
 	if err := dec(in); err != nil {
@@ -9804,6 +10423,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetAccessCapabilities",
 			Handler:    _AuthService_GetAccessCapabilities_Handler,
 		},
+		{
+			MethodName: "GetRemoteAccessCapabilities",
+			Handler:    _AuthService_GetRemoteAccessCapabilities_Handler,
+		},
 		{
 			MethodName: "GetAccessRequestAllowedPromotions",
 			Handler:    _AuthService_GetAccessRequestAllowedPromotions_Handler,
@@ -9828,6 +10451,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "CreateResetPasswordToken",
 			Handler:    _AuthService_CreateResetPasswordToken_Handler,
 		},
+		{
+			MethodName: "ListResetPasswordTokens",
+			Handler:    _AuthService_ListResetPasswordTokens_Handler,
+		},
 		{
 			MethodName: "GetUser",
 			Handler:    _AuthService_GetUser_Handler,
@@ -9868,6 +10495,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetSemaphores",
 			Handler:    _AuthService_GetSemaphores_Handler,
 		},
+		{
+			MethodName: "ListSemaphores",
+			Handler:    _AuthService_ListSemaphores_Handler,
+		},
 		{
 			MethodName: "DeleteSemaphore",
 			Handler:    _AuthService_DeleteSemaphore_Handler,
@@ -9928,6 +10559,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetSnowflakeSessions",
 			Handler:    _AuthService_GetSnowflakeSessions_Handler,
 		},
+		{
+			MethodName: "ListSnowflakeSessions",
+			Handler:    _AuthService_ListSnowflakeSessions_Handler,
+		},
 		{
 			MethodName: "DeleteSnowflakeSession",
 			Handler:    _AuthService_DeleteSnowflakeSession_Handler,
@@ -9984,6 +10619,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetWebTokens",
 			Handler:    _AuthService_GetWebTokens_Handler,
 		},
+		{
+			MethodName: "ListWebTokens",
+			Handler:    _AuthService_ListWebTokens_Handler,
+		},
 		{
 			MethodName: "DeleteWebToken",
 			Handler:    _AuthService_DeleteWebToken_Handler,
@@ -10052,6 +10691,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListRoles",
 			Handler:    _AuthService_ListRoles_Handler,
 		},
+		{
+			MethodName: "ListRequestableRoles",
+			Handler:    _AuthService_ListRequestableRoles_Handler,
+		},
 		{
 			MethodName: "CreateRole",
 			Handler:    _AuthService_CreateRole_Handler,
@@ -10100,6 +10743,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetOIDCConnectors",
 			Handler:    _AuthService_GetOIDCConnectors_Handler,
 		},
+		{
+			MethodName: "ListOIDCConnectors",
+			Handler:    _AuthService_ListOIDCConnectors_Handler,
+		},
 		{
 			MethodName: "CreateOIDCConnector",
 			Handler:    _AuthService_CreateOIDCConnector_Handler,
@@ -10136,6 +10783,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetSAMLConnectors",
 			Handler:    _AuthService_GetSAMLConnectors_Handler,
 		},
+		{
+			MethodName: "ListSAMLConnectors",
+			Handler:    _AuthService_ListSAMLConnectors_Handler,
+		},
 		{
 			MethodName: "CreateSAMLConnector",
 			Handler:    _AuthService_CreateSAMLConnector_Handler,
@@ -10172,6 +10823,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetGithubConnectors",
 			Handler:    _AuthService_GetGithubConnectors_Handler,
 		},
+		{
+			MethodName: "ListGithubConnectors",
+			Handler:    _AuthService_ListGithubConnectors_Handler,
+		},
 		{
 			MethodName: "CreateGithubConnector",
 			Handler:    _AuthService_CreateGithubConnector_Handler,
@@ -10244,6 +10899,14 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetTokens",
 			Handler:    _AuthService_GetTokens_Handler,
 		},
+		{
+			MethodName: "GetStaticTokens",
+			Handler:    _AuthService_GetStaticTokens_Handler,
+		},
+		{
+			MethodName: "ListProvisionTokens",
+			Handler:    _AuthService_ListProvisionTokens_Handler,
+		},
 		{
 			MethodName: "CreateTokenV2",
 			Handler:    _AuthService_CreateTokenV2_Handler,
@@ -10324,6 +10987,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetLocks",
 			Handler:    _AuthService_GetLocks_Handler,
 		},
+		{
+			MethodName: "ListLocks",
+			Handler:    _AuthService_ListLocks_Handler,
+		},
 		{
 			MethodName: "UpsertLock",
 			Handler:    _AuthService_UpsertLock_Handler,
@@ -10352,6 +11019,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetApps",
 			Handler:    _AuthService_GetApps_Handler,
 		},
+		{
+			MethodName: "ListApps",
+			Handler:    _AuthService_ListApps_Handler,
+		},
 		{
 			MethodName: "GetApp",
 			Handler:    _AuthService_GetApp_Handler,
@@ -10376,6 +11047,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetDatabases",
 			Handler:    _AuthService_GetDatabases_Handler,
 		},
+		{
+			MethodName: "ListDatabases",
+			Handler:    _AuthService_ListDatabases_Handler,
+		},
 		{
 			MethodName: "GetDatabase",
 			Handler:    _AuthService_GetDatabase_Handler,
@@ -10400,6 +11075,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetKubernetesClusters",
 			Handler:    _AuthService_GetKubernetesClusters_Handler,
 		},
+		{
+			MethodName: "ListKubernetesClusters",
+			Handler:    _AuthService_ListKubernetesClusters_Handler,
+		},
 		{
 			MethodName: "GetKubernetesCluster",
 			Handler:    _AuthService_GetKubernetesCluster_Handler,
@@ -10444,6 +11123,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetWindowsDesktops",
 			Handler:    _AuthService_GetWindowsDesktops_Handler,
 		},
+		{
+			MethodName: "ListWindowsDesktops",
+			Handler:    _AuthService_ListWindowsDesktops_Handler,
+		},
 		{
 			MethodName: "CreateWindowsDesktop",
 			Handler:    _AuthService_CreateWindowsDesktop_Handler,
@@ -10532,6 +11215,10 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInstallers",
 			Handler:    _AuthService_GetInstallers_Handler,
 		},
+		{
+			MethodName: "ListInstallers",
+			Handler:    _AuthService_ListInstallers_Handler,
+		},
 		{
 			MethodName: "SetInstaller",
 			Handler:    _AuthService_SetInstaller_Handler,
diff --git a/api/client/proto/event.pb.go b/api/client/proto/event.pb.go
index 9fc303584626d..72daa606cac6d 100644
--- a/api/client/proto/event.pb.go
+++ b/api/client/proto/event.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/legacy/client/proto/event.proto
 
@@ -33,7 +33,10 @@ import (
 	v15 "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	v19 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	v16 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	v118 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	v113 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	v119 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	v117 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	v13 "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
 	v11 "github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1"
 	v2 "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
@@ -191,6 +194,12 @@ type Event struct {
 	//	*Event_WorkloadIdentityX509Revocation
 	//	*Event_HealthCheckConfig
 	//	*Event_AutoUpdateAgentReport
+	//	*Event_ScopedRole
+	//	*Event_ScopedRoleAssignment
+	//	*Event_RelayServer
+	//	*Event_RecordingEncryption
+	//	*Event_Plugin
+	//	*Event_AutoUpdateBotInstanceReport
 	Resource      isEvent_Resource `protobuf_oneof:"Resource"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -906,6 +915,60 @@ func (x *Event) GetAutoUpdateAgentReport() *v111.AutoUpdateAgentReport {
 	return nil
 }
 
+func (x *Event) GetScopedRole() *v117.ScopedRole {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_ScopedRole); ok {
+			return x.ScopedRole
+		}
+	}
+	return nil
+}
+
+func (x *Event) GetScopedRoleAssignment() *v117.ScopedRoleAssignment {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_ScopedRoleAssignment); ok {
+			return x.ScopedRoleAssignment
+		}
+	}
+	return nil
+}
+
+func (x *Event) GetRelayServer() *v118.RelayServer {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_RelayServer); ok {
+			return x.RelayServer
+		}
+	}
+	return nil
+}
+
+func (x *Event) GetRecordingEncryption() *v119.RecordingEncryption {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_RecordingEncryption); ok {
+			return x.RecordingEncryption
+		}
+	}
+	return nil
+}
+
+func (x *Event) GetPlugin() *types.PluginV1 {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_Plugin); ok {
+			return x.Plugin
+		}
+	}
+	return nil
+}
+
+func (x *Event) GetAutoUpdateBotInstanceReport() *v111.AutoUpdateBotInstanceReport {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_AutoUpdateBotInstanceReport); ok {
+			return x.AutoUpdateBotInstanceReport
+		}
+	}
+	return nil
+}
+
 type isEvent_Resource interface {
 	isEvent_Resource()
 }
@@ -1286,6 +1349,35 @@ type Event_AutoUpdateAgentReport struct {
 	AutoUpdateAgentReport *v111.AutoUpdateAgentReport `protobuf:"bytes,79,opt,name=AutoUpdateAgentReport,proto3,oneof"`
 }
 
+type Event_ScopedRole struct {
+	// ScopedRole is a role that descibes scoped privileges.
+	ScopedRole *v117.ScopedRole `protobuf:"bytes,80,opt,name=ScopedRole,proto3,oneof"`
+}
+
+type Event_ScopedRoleAssignment struct {
+	// ScopedRoleAssignment is an assignment of one or more scoped roles to a user.
+	ScopedRoleAssignment *v117.ScopedRoleAssignment `protobuf:"bytes,81,opt,name=ScopedRoleAssignment,proto3,oneof"`
+}
+
+type Event_RelayServer struct {
+	RelayServer *v118.RelayServer `protobuf:"bytes,82,opt,name=relay_server,json=relayServer,proto3,oneof"`
+}
+
+type Event_RecordingEncryption struct {
+	// RecordingEncryption is a resource for controlling session recording encryption.
+	RecordingEncryption *v119.RecordingEncryption `protobuf:"bytes,83,opt,name=RecordingEncryption,proto3,oneof"`
+}
+
+type Event_Plugin struct {
+	// PluginV1 is a resource for Teleport plugins.
+	Plugin *types.PluginV1 `protobuf:"bytes,84,opt,name=plugin,proto3,oneof"`
+}
+
+type Event_AutoUpdateBotInstanceReport struct {
+	// AutoUpdateAgentReport is a resource for counting connected bot instances.
+	AutoUpdateBotInstanceReport *v111.AutoUpdateBotInstanceReport `protobuf:"bytes,85,opt,name=AutoUpdateBotInstanceReport,proto3,oneof"`
+}
+
 func (*Event_ResourceHeader) isEvent_Resource() {}
 
 func (*Event_CertAuthority) isEvent_Resource() {}
@@ -1434,11 +1526,23 @@ func (*Event_HealthCheckConfig) isEvent_Resource() {}
 
 func (*Event_AutoUpdateAgentReport) isEvent_Resource() {}
 
+func (*Event_ScopedRole) isEvent_Resource() {}
+
+func (*Event_ScopedRoleAssignment) isEvent_Resource() {}
+
+func (*Event_RelayServer) isEvent_Resource() {}
+
+func (*Event_RecordingEncryption) isEvent_Resource() {}
+
+func (*Event_Plugin) isEvent_Resource() {}
+
+func (*Event_AutoUpdateBotInstanceReport) isEvent_Resource() {}
+
 var File_teleport_legacy_client_proto_event_proto protoreflect.FileDescriptor
 
 const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\n" +
-	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a-teleport/notifications/v1/notifications.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xdd,\n" +
+	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a-teleport/notifications/v1/notifications.proto\x1a'teleport/presence/v1/relay_server.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xe30\n" +
 	"\x05Event\x12$\n" +
 	"\x04Type\x18\x01 \x01(\x0e2\x10.proto.OperationR\x04Type\x12?\n" +
 	"\x0eResourceHeader\x18\x02 \x01(\v2\x15.types.ResourceHeaderH\x00R\x0eResourceHeader\x12>\n" +
@@ -1525,7 +1629,15 @@ const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\x10WorkloadIdentity\x18L \x01(\v2..teleport.workloadidentity.v1.WorkloadIdentityH\x00R\x10WorkloadIdentity\x12\x86\x01\n" +
 	"\x1eWorkloadIdentityX509Revocation\x18M \x01(\v2<.teleport.workloadidentity.v1.WorkloadIdentityX509RevocationH\x00R\x1eWorkloadIdentityX509Revocation\x12`\n" +
 	"\x11HealthCheckConfig\x18N \x01(\v20.teleport.healthcheckconfig.v1.HealthCheckConfigH\x00R\x11HealthCheckConfig\x12e\n" +
-	"\x15AutoUpdateAgentReport\x18O \x01(\v2-.teleport.autoupdate.v1.AutoUpdateAgentReportH\x00R\x15AutoUpdateAgentReportB\n" +
+	"\x15AutoUpdateAgentReport\x18O \x01(\v2-.teleport.autoupdate.v1.AutoUpdateAgentReportH\x00R\x15AutoUpdateAgentReport\x12G\n" +
+	"\n" +
+	"ScopedRole\x18P \x01(\v2%.teleport.scopes.access.v1.ScopedRoleH\x00R\n" +
+	"ScopedRole\x12e\n" +
+	"\x14ScopedRoleAssignment\x18Q \x01(\v2/.teleport.scopes.access.v1.ScopedRoleAssignmentH\x00R\x14ScopedRoleAssignment\x12F\n" +
+	"\frelay_server\x18R \x01(\v2!.teleport.presence.v1.RelayServerH\x00R\vrelayServer\x12h\n" +
+	"\x13RecordingEncryption\x18S \x01(\v24.teleport.recordingencryption.v1.RecordingEncryptionH\x00R\x13RecordingEncryption\x12)\n" +
+	"\x06plugin\x18T \x01(\v2\x0f.types.PluginV1H\x00R\x06plugin\x12w\n" +
+	"\x1bAutoUpdateBotInstanceReport\x18U \x01(\v23.teleport.autoupdate.v1.AutoUpdateBotInstanceReportH\x00R\x1bAutoUpdateBotInstanceReportB\n" +
 	"\n" +
 	"\bResourceJ\x04\b\a\x10\bJ\x04\b1\x102J\x04\b?\x10@J\x04\bD\x10ER\x12ExternalCloudAuditR\x0eStaticHostUserR\x13AutoUpdateAgentPlan**\n" +
 	"\tOperation\x12\b\n" +
@@ -1622,6 +1734,12 @@ var file_teleport_legacy_client_proto_event_proto_goTypes = []any{
 	(*v115.WorkloadIdentityX509Revocation)(nil), // 70: teleport.workloadidentity.v1.WorkloadIdentityX509Revocation
 	(*v116.HealthCheckConfig)(nil),              // 71: teleport.healthcheckconfig.v1.HealthCheckConfig
 	(*v111.AutoUpdateAgentReport)(nil),          // 72: teleport.autoupdate.v1.AutoUpdateAgentReport
+	(*v117.ScopedRole)(nil),                     // 73: teleport.scopes.access.v1.ScopedRole
+	(*v117.ScopedRoleAssignment)(nil),           // 74: teleport.scopes.access.v1.ScopedRoleAssignment
+	(*v118.RelayServer)(nil),                    // 75: teleport.presence.v1.RelayServer
+	(*v119.RecordingEncryption)(nil),            // 76: teleport.recordingencryption.v1.RecordingEncryption
+	(*types.PluginV1)(nil),                      // 77: types.PluginV1
+	(*v111.AutoUpdateBotInstanceReport)(nil),    // 78: teleport.autoupdate.v1.AutoUpdateBotInstanceReport
 }
 var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	0,  // 0: proto.Event.Type:type_name -> proto.Operation
@@ -1699,11 +1817,17 @@ var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	70, // 72: proto.Event.WorkloadIdentityX509Revocation:type_name -> teleport.workloadidentity.v1.WorkloadIdentityX509Revocation
 	71, // 73: proto.Event.HealthCheckConfig:type_name -> teleport.healthcheckconfig.v1.HealthCheckConfig
 	72, // 74: proto.Event.AutoUpdateAgentReport:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	75, // [75:75] is the sub-list for method output_type
-	75, // [75:75] is the sub-list for method input_type
-	75, // [75:75] is the sub-list for extension type_name
-	75, // [75:75] is the sub-list for extension extendee
-	0,  // [0:75] is the sub-list for field type_name
+	73, // 75: proto.Event.ScopedRole:type_name -> teleport.scopes.access.v1.ScopedRole
+	74, // 76: proto.Event.ScopedRoleAssignment:type_name -> teleport.scopes.access.v1.ScopedRoleAssignment
+	75, // 77: proto.Event.relay_server:type_name -> teleport.presence.v1.RelayServer
+	76, // 78: proto.Event.RecordingEncryption:type_name -> teleport.recordingencryption.v1.RecordingEncryption
+	77, // 79: proto.Event.plugin:type_name -> types.PluginV1
+	78, // 80: proto.Event.AutoUpdateBotInstanceReport:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReport
+	81, // [81:81] is the sub-list for method output_type
+	81, // [81:81] is the sub-list for method input_type
+	81, // [81:81] is the sub-list for extension type_name
+	81, // [81:81] is the sub-list for extension extendee
+	0,  // [0:81] is the sub-list for field type_name
 }
 
 func init() { file_teleport_legacy_client_proto_event_proto_init() }
@@ -1786,6 +1910,12 @@ func file_teleport_legacy_client_proto_event_proto_init() {
 		(*Event_WorkloadIdentityX509Revocation)(nil),
 		(*Event_HealthCheckConfig)(nil),
 		(*Event_AutoUpdateAgentReport)(nil),
+		(*Event_ScopedRole)(nil),
+		(*Event_ScopedRoleAssignment)(nil),
+		(*Event_RelayServer)(nil),
+		(*Event_RecordingEncryption)(nil),
+		(*Event_Plugin)(nil),
+		(*Event_AutoUpdateBotInstanceReport)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
diff --git a/api/client/proto/inventory.pb.go b/api/client/proto/inventory.pb.go
index 7d12f39db8776..bdb21927db455 100644
--- a/api/client/proto/inventory.pb.go
+++ b/api/client/proto/inventory.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/legacy/client/proto/inventory.proto
 
@@ -24,6 +24,7 @@
 package proto
 
 import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	types "github.com/gravitational/teleport/api/types"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
@@ -93,6 +94,54 @@ func (LabelUpdateKind) EnumDescriptor() ([]byte, []int) {
 	return file_teleport_legacy_client_proto_inventory_proto_rawDescGZIP(), []int{0}
 }
 
+// StopHeartbeatKind is the type of heartbeat to stop.
+type StopHeartbeatKind int32
+
+const (
+	StopHeartbeatKind_STOP_HEARTBEAT_KIND_UNSPECIFIED StopHeartbeatKind = 0
+	// STOP_HEARTBEAT_KIND_DATABASE_SERVER means stop a database server heartbeat.
+	StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER StopHeartbeatKind = 1
+)
+
+// Enum value maps for StopHeartbeatKind.
+var (
+	StopHeartbeatKind_name = map[int32]string{
+		0: "STOP_HEARTBEAT_KIND_UNSPECIFIED",
+		1: "STOP_HEARTBEAT_KIND_DATABASE_SERVER",
+	}
+	StopHeartbeatKind_value = map[string]int32{
+		"STOP_HEARTBEAT_KIND_UNSPECIFIED":     0,
+		"STOP_HEARTBEAT_KIND_DATABASE_SERVER": 1,
+	}
+)
+
+func (x StopHeartbeatKind) Enum() *StopHeartbeatKind {
+	p := new(StopHeartbeatKind)
+	*p = x
+	return p
+}
+
+func (x StopHeartbeatKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (StopHeartbeatKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_legacy_client_proto_inventory_proto_enumTypes[1].Descriptor()
+}
+
+func (StopHeartbeatKind) Type() protoreflect.EnumType {
+	return &file_teleport_legacy_client_proto_inventory_proto_enumTypes[1]
+}
+
+func (x StopHeartbeatKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use StopHeartbeatKind.Descriptor instead.
+func (StopHeartbeatKind) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_inventory_proto_rawDescGZIP(), []int{1}
+}
+
 // UpstreamInventoryOneOf is the upstream message for the inventory control stream,
 // sent from teleport instances to the auth server.
 type UpstreamInventoryOneOf struct {
@@ -106,6 +155,7 @@ type UpstreamInventoryOneOf struct {
 	//	*UpstreamInventoryOneOf_Pong
 	//	*UpstreamInventoryOneOf_AgentMetadata
 	//	*UpstreamInventoryOneOf_Goodbye
+	//	*UpstreamInventoryOneOf_StopHeartbeat
 	Msg           isUpstreamInventoryOneOf_Msg `protobuf_oneof:"Msg"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -193,6 +243,15 @@ func (x *UpstreamInventoryOneOf) GetGoodbye() *UpstreamInventoryGoodbye {
 	return nil
 }
 
+func (x *UpstreamInventoryOneOf) GetStopHeartbeat() *UpstreamInventoryStopHeartbeat {
+	if x != nil {
+		if x, ok := x.Msg.(*UpstreamInventoryOneOf_StopHeartbeat); ok {
+			return x.StopHeartbeat
+		}
+	}
+	return nil
+}
+
 type isUpstreamInventoryOneOf_Msg interface {
 	isUpstreamInventoryOneOf_Msg()
 }
@@ -222,6 +281,12 @@ type UpstreamInventoryOneOf_Goodbye struct {
 	Goodbye *UpstreamInventoryGoodbye `protobuf:"bytes,5,opt,name=Goodbye,proto3,oneof"`
 }
 
+type UpstreamInventoryOneOf_StopHeartbeat struct {
+	// UpstreamInventoryStopHeartbeat informs the upstream service that a
+	// heartbeat is stopping.
+	StopHeartbeat *UpstreamInventoryStopHeartbeat `protobuf:"bytes,6,opt,name=stop_heartbeat,json=stopHeartbeat,proto3,oneof"`
+}
+
 func (*UpstreamInventoryOneOf_Hello) isUpstreamInventoryOneOf_Msg() {}
 
 func (*UpstreamInventoryOneOf_Heartbeat) isUpstreamInventoryOneOf_Msg() {}
@@ -232,6 +297,8 @@ func (*UpstreamInventoryOneOf_AgentMetadata) isUpstreamInventoryOneOf_Msg() {}
 
 func (*UpstreamInventoryOneOf_Goodbye) isUpstreamInventoryOneOf_Msg() {}
 
+func (*UpstreamInventoryOneOf_StopHeartbeat) isUpstreamInventoryOneOf_Msg() {}
+
 // DownstreamInventoryOneOf is the downstream message for the inventory control stream,
 // sent from auth servers to teleport instances.
 type DownstreamInventoryOneOf struct {
@@ -461,7 +528,10 @@ type UpstreamInventoryHello struct {
 	// ExternalUpgraderVersion identifies the external upgrader version. Empty if no upgrader is defined.
 	ExternalUpgraderVersion string `protobuf:"bytes,6,opt,name=ExternalUpgraderVersion,proto3" json:"ExternalUpgraderVersion,omitempty"`
 	// UpdaterInfo is used by Teleport to send information about how the Teleport updater is doing.
-	UpdaterInfo   *types.UpdaterV2Info `protobuf:"bytes,8,opt,name=UpdaterInfo,proto3" json:"UpdaterInfo,omitempty"`
+	UpdaterInfo *types.UpdaterV2Info `protobuf:"bytes,8,opt,name=UpdaterInfo,proto3" json:"UpdaterInfo,omitempty"`
+	// The advertized scope of the instance. An instance's scope can not change once assigned, so future
+	// heartbeats must include a scope value matching the one declared in the hello message.
+	Scope         string `protobuf:"bytes,9,opt,name=scope,proto3" json:"scope,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -545,6 +615,13 @@ func (x *UpstreamInventoryHello) GetUpdaterInfo() *types.UpdaterV2Info {
 	return nil
 }
 
+func (x *UpstreamInventoryHello) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
 // UpstreamInventoryAgentMetadata is the message sent up the inventory control stream containing
 // metadata about the instance.
 type UpstreamInventoryAgentMetadata struct {
@@ -855,8 +932,10 @@ type InventoryHeartbeat struct {
 	DatabaseServer *types.DatabaseServerV3 `protobuf:"bytes,3,opt,name=DatabaseServer,proto3" json:"DatabaseServer,omitempty"`
 	// KubeServer is a complete kube server spec to be heartbeated.
 	KubernetesServer *types.KubernetesServerV3 `protobuf:"bytes,4,opt,name=KubernetesServer,proto3" json:"KubernetesServer,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	// A relay_server to be heartbeated.
+	RelayServer   *v1.RelayServer `protobuf:"bytes,5,opt,name=relay_server,json=relayServer,proto3" json:"relay_server,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InventoryHeartbeat) Reset() {
@@ -917,6 +996,13 @@ func (x *InventoryHeartbeat) GetKubernetesServer() *types.KubernetesServerV3 {
 	return nil
 }
 
+func (x *InventoryHeartbeat) GetRelayServer() *v1.RelayServer {
+	if x != nil {
+		return x.RelayServer
+	}
+	return nil
+}
+
 // UpstreamInventoryGoodbye informs the upstream service that instance
 // is terminating
 type UpstreamInventoryGoodbye struct {
@@ -1105,6 +1191,62 @@ func (x *InventoryStatusSummary) GetServiceCounts() map[string]uint32 {
 	return nil
 }
 
+// UpstreamInventoryStopHeartbeat informs the upstream service that the
+// heartbeat is stopping.
+type UpstreamInventoryStopHeartbeat struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the kind of heartbeat to stop.
+	Kind StopHeartbeatKind `protobuf:"varint,1,opt,name=kind,proto3,enum=proto.StopHeartbeatKind" json:"kind,omitempty"`
+	// Name is the name of the heatbeat to stop.
+	Name          string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpstreamInventoryStopHeartbeat) Reset() {
+	*x = UpstreamInventoryStopHeartbeat{}
+	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpstreamInventoryStopHeartbeat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpstreamInventoryStopHeartbeat) ProtoMessage() {}
+
+func (x *UpstreamInventoryStopHeartbeat) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpstreamInventoryStopHeartbeat.ProtoReflect.Descriptor instead.
+func (*UpstreamInventoryStopHeartbeat) Descriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_inventory_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *UpstreamInventoryStopHeartbeat) GetKind() StopHeartbeatKind {
+	if x != nil {
+		return x.Kind
+	}
+	return StopHeartbeatKind_STOP_HEARTBEAT_KIND_UNSPECIFIED
+}
+
+func (x *UpstreamInventoryStopHeartbeat) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 // SupportedCapabilities indicate which features of the ICS that
 // the connect auth server supports. This allows agents to determine
 // how they should interact with the auth server to maintain compatibility.
@@ -1146,13 +1288,17 @@ type DownstreamInventoryHello_SupportedCapabilities struct {
 	KubernetesHeartbeats bool `protobuf:"varint,17,opt,name=KubernetesHeartbeats,proto3" json:"KubernetesHeartbeats,omitempty"`
 	// KubernetesCleanup indicates the ICS supports deleting kubernetes clusters when UpstreamInventoryGoodbye.DeleteResources is set.
 	KubernetesCleanup bool `protobuf:"varint,18,opt,name=KubernetesCleanup,proto3" json:"KubernetesCleanup,omitempty"`
-	unknownFields     protoimpl.UnknownFields
-	sizeCache         protoimpl.SizeCache
+	// Indicates that the ICS supports heartbeating relay_server entries as well as deleting them on disconnect if UpstreamInventoryGoodbye.DeleteResources is set.
+	RelayServerHeartbeatsCleanup bool `protobuf:"varint,19,opt,name=relay_server_heartbeats_cleanup,json=relayServerHeartbeatsCleanup,proto3" json:"relay_server_heartbeats_cleanup,omitempty"`
+	// DatabaseHeartbeatGracefulStop indicates the ICS supports stopping an individual database heartbeat.
+	DatabaseHeartbeatGracefulStop bool `protobuf:"varint,20,opt,name=database_heartbeat_graceful_stop,json=databaseHeartbeatGracefulStop,proto3" json:"database_heartbeat_graceful_stop,omitempty"`
+	unknownFields                 protoimpl.UnknownFields
+	sizeCache                     protoimpl.SizeCache
 }
 
 func (x *DownstreamInventoryHello_SupportedCapabilities) Reset() {
 	*x = DownstreamInventoryHello_SupportedCapabilities{}
-	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[13]
+	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1164,7 +1310,7 @@ func (x *DownstreamInventoryHello_SupportedCapabilities) String() string {
 func (*DownstreamInventoryHello_SupportedCapabilities) ProtoMessage() {}
 
 func (x *DownstreamInventoryHello_SupportedCapabilities) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[13]
+	mi := &file_teleport_legacy_client_proto_inventory_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1306,17 +1452,32 @@ func (x *DownstreamInventoryHello_SupportedCapabilities) GetKubernetesCleanup()
 	return false
 }
 
+func (x *DownstreamInventoryHello_SupportedCapabilities) GetRelayServerHeartbeatsCleanup() bool {
+	if x != nil {
+		return x.RelayServerHeartbeatsCleanup
+	}
+	return false
+}
+
+func (x *DownstreamInventoryHello_SupportedCapabilities) GetDatabaseHeartbeatGracefulStop() bool {
+	if x != nil {
+		return x.DatabaseHeartbeatGracefulStop
+	}
+	return false
+}
+
 var File_teleport_legacy_client_proto_inventory_proto protoreflect.FileDescriptor
 
 const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\n" +
-	",teleport/legacy/client/proto/inventory.proto\x12\x05proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a!teleport/legacy/types/types.proto\"\xd1\x02\n" +
+	",teleport/legacy/client/proto/inventory.proto\x12\x05proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a!teleport/legacy/types/types.proto\x1a'teleport/presence/v1/relay_server.proto\"\xa1\x03\n" +
 	"\x16UpstreamInventoryOneOf\x125\n" +
 	"\x05Hello\x18\x01 \x01(\v2\x1d.proto.UpstreamInventoryHelloH\x00R\x05Hello\x129\n" +
 	"\tHeartbeat\x18\x02 \x01(\v2\x19.proto.InventoryHeartbeatH\x00R\tHeartbeat\x122\n" +
 	"\x04Pong\x18\x03 \x01(\v2\x1c.proto.UpstreamInventoryPongH\x00R\x04Pong\x12M\n" +
 	"\rAgentMetadata\x18\x04 \x01(\v2%.proto.UpstreamInventoryAgentMetadataH\x00R\rAgentMetadata\x12;\n" +
-	"\aGoodbye\x18\x05 \x01(\v2\x1f.proto.UpstreamInventoryGoodbyeH\x00R\aGoodbyeB\x05\n" +
+	"\aGoodbye\x18\x05 \x01(\v2\x1f.proto.UpstreamInventoryGoodbyeH\x00R\aGoodbye\x12N\n" +
+	"\x0estop_heartbeat\x18\x06 \x01(\v2%.proto.UpstreamInventoryStopHeartbeatH\x00R\rstopHeartbeatB\x05\n" +
 	"\x03Msg\"\xde\x01\n" +
 	"\x18DownstreamInventoryOneOf\x127\n" +
 	"\x05Hello\x18\x01 \x01(\v2\x1f.proto.DownstreamInventoryHelloH\x00R\x05Hello\x124\n" +
@@ -1327,7 +1488,7 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\x02ID\x18\x01 \x01(\x04R\x02ID\"e\n" +
 	"\x15UpstreamInventoryPong\x12\x0e\n" +
 	"\x02ID\x18\x01 \x01(\x04R\x02ID\x12<\n" +
-	"\vSystemClock\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\vSystemClock\"\xb9\x02\n" +
+	"\vSystemClock\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\vSystemClock\"\xcf\x02\n" +
 	"\x16UpstreamInventoryHello\x12\x18\n" +
 	"\aVersion\x18\x01 \x01(\tR\aVersion\x12\x1a\n" +
 	"\bServerID\x18\x02 \x01(\tR\bServerID\x12\x1a\n" +
@@ -1335,7 +1496,8 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\bHostname\x18\x04 \x01(\tR\bHostname\x12*\n" +
 	"\x10ExternalUpgrader\x18\x05 \x01(\tR\x10ExternalUpgrader\x128\n" +
 	"\x17ExternalUpgraderVersion\x18\x06 \x01(\tR\x17ExternalUpgraderVersion\x126\n" +
-	"\vUpdaterInfo\x18\b \x01(\v2\x14.types.UpdaterV2InfoR\vUpdaterInfoJ\x04\b\a\x10\bR\rUpdaterV2Info\"\xd4\x02\n" +
+	"\vUpdaterInfo\x18\b \x01(\v2\x14.types.UpdaterV2InfoR\vUpdaterInfo\x12\x14\n" +
+	"\x05scope\x18\t \x01(\tR\x05scopeJ\x04\b\a\x10\bR\rUpdaterV2Info\"\xd4\x02\n" +
 	"\x1eUpstreamInventoryAgentMetadata\x12\x0e\n" +
 	"\x02OS\x18\x01 \x01(\tR\x02OS\x12\x1c\n" +
 	"\tOSVersion\x18\x02 \x01(\tR\tOSVersion\x12*\n" +
@@ -1344,11 +1506,11 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\x0eInstallMethods\x18\x05 \x03(\tR\x0eInstallMethods\x12*\n" +
 	"\x10ContainerRuntime\x18\x06 \x01(\tR\x10ContainerRuntime\x124\n" +
 	"\x15ContainerOrchestrator\x18\a \x01(\tR\x15ContainerOrchestrator\x12*\n" +
-	"\x10CloudEnvironment\x18\b \x01(\tR\x10CloudEnvironment\"\x9f\b\n" +
+	"\x10CloudEnvironment\x18\b \x01(\tR\x10CloudEnvironment\"\xaf\t\n" +
 	"\x18DownstreamInventoryHello\x12\x18\n" +
 	"\aVersion\x18\x01 \x01(\tR\aVersion\x12\x1a\n" +
 	"\bServerID\x18\x02 \x01(\tR\bServerID\x12Y\n" +
-	"\fCapabilities\x18\x03 \x01(\v25.proto.DownstreamInventoryHello.SupportedCapabilitiesR\fCapabilities\x1a\xf1\x06\n" +
+	"\fCapabilities\x18\x03 \x01(\v25.proto.DownstreamInventoryHello.SupportedCapabilitiesR\fCapabilities\x1a\x81\b\n" +
 	"\x15SupportedCapabilities\x12(\n" +
 	"\x0fProxyHeartbeats\x18\x01 \x01(\bR\x0fProxyHeartbeats\x12\"\n" +
 	"\fProxyCleanup\x18\x02 \x01(\bR\fProxyCleanup\x12&\n" +
@@ -1370,7 +1532,9 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\x1fWindowsDesktopServiceHeartbeats\x18\x0f \x01(\bR\x1fWindowsDesktopServiceHeartbeats\x12B\n" +
 	"\x1cWindowsDesktopServiceCleanup\x18\x10 \x01(\bR\x1cWindowsDesktopServiceCleanup\x122\n" +
 	"\x14KubernetesHeartbeats\x18\x11 \x01(\bR\x14KubernetesHeartbeats\x12,\n" +
-	"\x11KubernetesCleanup\x18\x12 \x01(\bR\x11KubernetesCleanup\"\xea\x01\n" +
+	"\x11KubernetesCleanup\x18\x12 \x01(\bR\x11KubernetesCleanup\x12E\n" +
+	"\x1frelay_server_heartbeats_cleanup\x18\x13 \x01(\bR\x1crelayServerHeartbeatsCleanup\x12G\n" +
+	" database_heartbeat_graceful_stop\x18\x14 \x01(\bR\x1ddatabaseHeartbeatGracefulStop\"\xea\x01\n" +
 	"\x1cInventoryUpdateLabelsRequest\x12\x1a\n" +
 	"\bServerID\x18\x01 \x01(\tR\bServerID\x12*\n" +
 	"\x04Kind\x18\x02 \x01(\x0e2\x16.proto.LabelUpdateKindR\x04Kind\x12G\n" +
@@ -1383,12 +1547,13 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\x06Labels\x18\x02 \x03(\v22.proto.DownstreamInventoryUpdateLabels.LabelsEntryR\x06Labels\x1a9\n" +
 	"\vLabelsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xfd\x01\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc3\x02\n" +
 	"\x12InventoryHeartbeat\x12-\n" +
 	"\tSSHServer\x18\x01 \x01(\v2\x0f.types.ServerV2R\tSSHServer\x120\n" +
 	"\tAppServer\x18\x02 \x01(\v2\x12.types.AppServerV3R\tAppServer\x12?\n" +
 	"\x0eDatabaseServer\x18\x03 \x01(\v2\x17.types.DatabaseServerV3R\x0eDatabaseServer\x12E\n" +
-	"\x10KubernetesServer\x18\x04 \x01(\v2\x19.types.KubernetesServerV3R\x10KubernetesServer\"d\n" +
+	"\x10KubernetesServer\x18\x04 \x01(\v2\x19.types.KubernetesServerV3R\x10KubernetesServer\x12D\n" +
+	"\frelay_server\x18\x05 \x01(\v2!.teleport.presence.v1.RelayServerR\vrelayServer\"d\n" +
 	"\x18UpstreamInventoryGoodbye\x12(\n" +
 	"\x0fDeleteResources\x18\x01 \x01(\bR\x0fDeleteResources\x12\x1e\n" +
 	"\n" +
@@ -1410,10 +1575,16 @@ const file_teleport_legacy_client_proto_inventory_proto_rawDesc = "" +
 	"\x05value\x18\x02 \x01(\rR\x05value:\x028\x01\x1a@\n" +
 	"\x12ServiceCountsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\rR\x05value:\x028\x01*:\n" +
+	"\x05value\x18\x02 \x01(\rR\x05value:\x028\x01\"b\n" +
+	"\x1eUpstreamInventoryStopHeartbeat\x12,\n" +
+	"\x04kind\x18\x01 \x01(\x0e2\x18.proto.StopHeartbeatKindR\x04kind\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name*:\n" +
 	"\x0fLabelUpdateKind\x12\r\n" +
 	"\tSSHServer\x10\x00\x12\x18\n" +
-	"\x14SSHServerCloudLabels\x10\x01B4Z2github.com/gravitational/teleport/api/client/protob\x06proto3"
+	"\x14SSHServerCloudLabels\x10\x01*a\n" +
+	"\x11StopHeartbeatKind\x12#\n" +
+	"\x1fSTOP_HEARTBEAT_KIND_UNSPECIFIED\x10\x00\x12'\n" +
+	"#STOP_HEARTBEAT_KIND_DATABASE_SERVER\x10\x01B4Z2github.com/gravitational/teleport/api/client/protob\x06proto3"
 
 var (
 	file_teleport_legacy_client_proto_inventory_proto_rawDescOnce sync.Once
@@ -1427,65 +1598,71 @@ func file_teleport_legacy_client_proto_inventory_proto_rawDescGZIP() []byte {
 	return file_teleport_legacy_client_proto_inventory_proto_rawDescData
 }
 
-var file_teleport_legacy_client_proto_inventory_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_teleport_legacy_client_proto_inventory_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_teleport_legacy_client_proto_inventory_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_teleport_legacy_client_proto_inventory_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
 var file_teleport_legacy_client_proto_inventory_proto_goTypes = []any{
 	(LabelUpdateKind)(0),                                   // 0: proto.LabelUpdateKind
-	(*UpstreamInventoryOneOf)(nil),                         // 1: proto.UpstreamInventoryOneOf
-	(*DownstreamInventoryOneOf)(nil),                       // 2: proto.DownstreamInventoryOneOf
-	(*DownstreamInventoryPing)(nil),                        // 3: proto.DownstreamInventoryPing
-	(*UpstreamInventoryPong)(nil),                          // 4: proto.UpstreamInventoryPong
-	(*UpstreamInventoryHello)(nil),                         // 5: proto.UpstreamInventoryHello
-	(*UpstreamInventoryAgentMetadata)(nil),                 // 6: proto.UpstreamInventoryAgentMetadata
-	(*DownstreamInventoryHello)(nil),                       // 7: proto.DownstreamInventoryHello
-	(*InventoryUpdateLabelsRequest)(nil),                   // 8: proto.InventoryUpdateLabelsRequest
-	(*DownstreamInventoryUpdateLabels)(nil),                // 9: proto.DownstreamInventoryUpdateLabels
-	(*InventoryHeartbeat)(nil),                             // 10: proto.InventoryHeartbeat
-	(*UpstreamInventoryGoodbye)(nil),                       // 11: proto.UpstreamInventoryGoodbye
-	(*InventoryStatusRequest)(nil),                         // 12: proto.InventoryStatusRequest
-	(*InventoryStatusSummary)(nil),                         // 13: proto.InventoryStatusSummary
-	(*DownstreamInventoryHello_SupportedCapabilities)(nil), // 14: proto.DownstreamInventoryHello.SupportedCapabilities
-	nil,                              // 15: proto.InventoryUpdateLabelsRequest.LabelsEntry
-	nil,                              // 16: proto.DownstreamInventoryUpdateLabels.LabelsEntry
-	nil,                              // 17: proto.InventoryStatusSummary.VersionCountsEntry
-	nil,                              // 18: proto.InventoryStatusSummary.UpgraderCountsEntry
-	nil,                              // 19: proto.InventoryStatusSummary.ServiceCountsEntry
-	(*timestamppb.Timestamp)(nil),    // 20: google.protobuf.Timestamp
-	(*types.UpdaterV2Info)(nil),      // 21: types.UpdaterV2Info
-	(*types.ServerV2)(nil),           // 22: types.ServerV2
-	(*types.AppServerV3)(nil),        // 23: types.AppServerV3
-	(*types.DatabaseServerV3)(nil),   // 24: types.DatabaseServerV3
-	(*types.KubernetesServerV3)(nil), // 25: types.KubernetesServerV3
+	(StopHeartbeatKind)(0),                                 // 1: proto.StopHeartbeatKind
+	(*UpstreamInventoryOneOf)(nil),                         // 2: proto.UpstreamInventoryOneOf
+	(*DownstreamInventoryOneOf)(nil),                       // 3: proto.DownstreamInventoryOneOf
+	(*DownstreamInventoryPing)(nil),                        // 4: proto.DownstreamInventoryPing
+	(*UpstreamInventoryPong)(nil),                          // 5: proto.UpstreamInventoryPong
+	(*UpstreamInventoryHello)(nil),                         // 6: proto.UpstreamInventoryHello
+	(*UpstreamInventoryAgentMetadata)(nil),                 // 7: proto.UpstreamInventoryAgentMetadata
+	(*DownstreamInventoryHello)(nil),                       // 8: proto.DownstreamInventoryHello
+	(*InventoryUpdateLabelsRequest)(nil),                   // 9: proto.InventoryUpdateLabelsRequest
+	(*DownstreamInventoryUpdateLabels)(nil),                // 10: proto.DownstreamInventoryUpdateLabels
+	(*InventoryHeartbeat)(nil),                             // 11: proto.InventoryHeartbeat
+	(*UpstreamInventoryGoodbye)(nil),                       // 12: proto.UpstreamInventoryGoodbye
+	(*InventoryStatusRequest)(nil),                         // 13: proto.InventoryStatusRequest
+	(*InventoryStatusSummary)(nil),                         // 14: proto.InventoryStatusSummary
+	(*UpstreamInventoryStopHeartbeat)(nil),                 // 15: proto.UpstreamInventoryStopHeartbeat
+	(*DownstreamInventoryHello_SupportedCapabilities)(nil), // 16: proto.DownstreamInventoryHello.SupportedCapabilities
+	nil,                              // 17: proto.InventoryUpdateLabelsRequest.LabelsEntry
+	nil,                              // 18: proto.DownstreamInventoryUpdateLabels.LabelsEntry
+	nil,                              // 19: proto.InventoryStatusSummary.VersionCountsEntry
+	nil,                              // 20: proto.InventoryStatusSummary.UpgraderCountsEntry
+	nil,                              // 21: proto.InventoryStatusSummary.ServiceCountsEntry
+	(*timestamppb.Timestamp)(nil),    // 22: google.protobuf.Timestamp
+	(*types.UpdaterV2Info)(nil),      // 23: types.UpdaterV2Info
+	(*types.ServerV2)(nil),           // 24: types.ServerV2
+	(*types.AppServerV3)(nil),        // 25: types.AppServerV3
+	(*types.DatabaseServerV3)(nil),   // 26: types.DatabaseServerV3
+	(*types.KubernetesServerV3)(nil), // 27: types.KubernetesServerV3
+	(*v1.RelayServer)(nil),           // 28: teleport.presence.v1.RelayServer
 }
 var file_teleport_legacy_client_proto_inventory_proto_depIdxs = []int32{
-	5,  // 0: proto.UpstreamInventoryOneOf.Hello:type_name -> proto.UpstreamInventoryHello
-	10, // 1: proto.UpstreamInventoryOneOf.Heartbeat:type_name -> proto.InventoryHeartbeat
-	4,  // 2: proto.UpstreamInventoryOneOf.Pong:type_name -> proto.UpstreamInventoryPong
-	6,  // 3: proto.UpstreamInventoryOneOf.AgentMetadata:type_name -> proto.UpstreamInventoryAgentMetadata
-	11, // 4: proto.UpstreamInventoryOneOf.Goodbye:type_name -> proto.UpstreamInventoryGoodbye
-	7,  // 5: proto.DownstreamInventoryOneOf.Hello:type_name -> proto.DownstreamInventoryHello
-	3,  // 6: proto.DownstreamInventoryOneOf.Ping:type_name -> proto.DownstreamInventoryPing
-	9,  // 7: proto.DownstreamInventoryOneOf.UpdateLabels:type_name -> proto.DownstreamInventoryUpdateLabels
-	20, // 8: proto.UpstreamInventoryPong.SystemClock:type_name -> google.protobuf.Timestamp
-	21, // 9: proto.UpstreamInventoryHello.UpdaterInfo:type_name -> types.UpdaterV2Info
-	14, // 10: proto.DownstreamInventoryHello.Capabilities:type_name -> proto.DownstreamInventoryHello.SupportedCapabilities
-	0,  // 11: proto.InventoryUpdateLabelsRequest.Kind:type_name -> proto.LabelUpdateKind
-	15, // 12: proto.InventoryUpdateLabelsRequest.Labels:type_name -> proto.InventoryUpdateLabelsRequest.LabelsEntry
-	0,  // 13: proto.DownstreamInventoryUpdateLabels.Kind:type_name -> proto.LabelUpdateKind
-	16, // 14: proto.DownstreamInventoryUpdateLabels.Labels:type_name -> proto.DownstreamInventoryUpdateLabels.LabelsEntry
-	22, // 15: proto.InventoryHeartbeat.SSHServer:type_name -> types.ServerV2
-	23, // 16: proto.InventoryHeartbeat.AppServer:type_name -> types.AppServerV3
-	24, // 17: proto.InventoryHeartbeat.DatabaseServer:type_name -> types.DatabaseServerV3
-	25, // 18: proto.InventoryHeartbeat.KubernetesServer:type_name -> types.KubernetesServerV3
-	5,  // 19: proto.InventoryStatusSummary.Connected:type_name -> proto.UpstreamInventoryHello
-	17, // 20: proto.InventoryStatusSummary.VersionCounts:type_name -> proto.InventoryStatusSummary.VersionCountsEntry
-	18, // 21: proto.InventoryStatusSummary.UpgraderCounts:type_name -> proto.InventoryStatusSummary.UpgraderCountsEntry
-	19, // 22: proto.InventoryStatusSummary.ServiceCounts:type_name -> proto.InventoryStatusSummary.ServiceCountsEntry
-	23, // [23:23] is the sub-list for method output_type
-	23, // [23:23] is the sub-list for method input_type
-	23, // [23:23] is the sub-list for extension type_name
-	23, // [23:23] is the sub-list for extension extendee
-	0,  // [0:23] is the sub-list for field type_name
+	6,  // 0: proto.UpstreamInventoryOneOf.Hello:type_name -> proto.UpstreamInventoryHello
+	11, // 1: proto.UpstreamInventoryOneOf.Heartbeat:type_name -> proto.InventoryHeartbeat
+	5,  // 2: proto.UpstreamInventoryOneOf.Pong:type_name -> proto.UpstreamInventoryPong
+	7,  // 3: proto.UpstreamInventoryOneOf.AgentMetadata:type_name -> proto.UpstreamInventoryAgentMetadata
+	12, // 4: proto.UpstreamInventoryOneOf.Goodbye:type_name -> proto.UpstreamInventoryGoodbye
+	15, // 5: proto.UpstreamInventoryOneOf.stop_heartbeat:type_name -> proto.UpstreamInventoryStopHeartbeat
+	8,  // 6: proto.DownstreamInventoryOneOf.Hello:type_name -> proto.DownstreamInventoryHello
+	4,  // 7: proto.DownstreamInventoryOneOf.Ping:type_name -> proto.DownstreamInventoryPing
+	10, // 8: proto.DownstreamInventoryOneOf.UpdateLabels:type_name -> proto.DownstreamInventoryUpdateLabels
+	22, // 9: proto.UpstreamInventoryPong.SystemClock:type_name -> google.protobuf.Timestamp
+	23, // 10: proto.UpstreamInventoryHello.UpdaterInfo:type_name -> types.UpdaterV2Info
+	16, // 11: proto.DownstreamInventoryHello.Capabilities:type_name -> proto.DownstreamInventoryHello.SupportedCapabilities
+	0,  // 12: proto.InventoryUpdateLabelsRequest.Kind:type_name -> proto.LabelUpdateKind
+	17, // 13: proto.InventoryUpdateLabelsRequest.Labels:type_name -> proto.InventoryUpdateLabelsRequest.LabelsEntry
+	0,  // 14: proto.DownstreamInventoryUpdateLabels.Kind:type_name -> proto.LabelUpdateKind
+	18, // 15: proto.DownstreamInventoryUpdateLabels.Labels:type_name -> proto.DownstreamInventoryUpdateLabels.LabelsEntry
+	24, // 16: proto.InventoryHeartbeat.SSHServer:type_name -> types.ServerV2
+	25, // 17: proto.InventoryHeartbeat.AppServer:type_name -> types.AppServerV3
+	26, // 18: proto.InventoryHeartbeat.DatabaseServer:type_name -> types.DatabaseServerV3
+	27, // 19: proto.InventoryHeartbeat.KubernetesServer:type_name -> types.KubernetesServerV3
+	28, // 20: proto.InventoryHeartbeat.relay_server:type_name -> teleport.presence.v1.RelayServer
+	6,  // 21: proto.InventoryStatusSummary.Connected:type_name -> proto.UpstreamInventoryHello
+	19, // 22: proto.InventoryStatusSummary.VersionCounts:type_name -> proto.InventoryStatusSummary.VersionCountsEntry
+	20, // 23: proto.InventoryStatusSummary.UpgraderCounts:type_name -> proto.InventoryStatusSummary.UpgraderCountsEntry
+	21, // 24: proto.InventoryStatusSummary.ServiceCounts:type_name -> proto.InventoryStatusSummary.ServiceCountsEntry
+	1,  // 25: proto.UpstreamInventoryStopHeartbeat.kind:type_name -> proto.StopHeartbeatKind
+	26, // [26:26] is the sub-list for method output_type
+	26, // [26:26] is the sub-list for method input_type
+	26, // [26:26] is the sub-list for extension type_name
+	26, // [26:26] is the sub-list for extension extendee
+	0,  // [0:26] is the sub-list for field type_name
 }
 
 func init() { file_teleport_legacy_client_proto_inventory_proto_init() }
@@ -1499,6 +1676,7 @@ func file_teleport_legacy_client_proto_inventory_proto_init() {
 		(*UpstreamInventoryOneOf_Pong)(nil),
 		(*UpstreamInventoryOneOf_AgentMetadata)(nil),
 		(*UpstreamInventoryOneOf_Goodbye)(nil),
+		(*UpstreamInventoryOneOf_StopHeartbeat)(nil),
 	}
 	file_teleport_legacy_client_proto_inventory_proto_msgTypes[1].OneofWrappers = []any{
 		(*DownstreamInventoryOneOf_Hello)(nil),
@@ -1510,8 +1688,8 @@ func file_teleport_legacy_client_proto_inventory_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_legacy_client_proto_inventory_proto_rawDesc), len(file_teleport_legacy_client_proto_inventory_proto_rawDesc)),
-			NumEnums:      1,
-			NumMessages:   19,
+			NumEnums:      2,
+			NumMessages:   20,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/client/proto/joinservice.pb.go b/api/client/proto/joinservice.pb.go
index f52c07e44d945..0dadaf7ecfc10 100644
--- a/api/client/proto/joinservice.pb.go
+++ b/api/client/proto/joinservice.pb.go
@@ -1443,9 +1443,11 @@ func (m *RegisterUsingBoundKeypairCertificates) GetPublicKey() string {
 // RegisterUsingBoundKeypairRotationRequest is the response sent by the server
 // when a keypair rotation is required.
 type RegisterUsingBoundKeypairRotationRequest struct {
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	// The signature algorithm suite in use by the cluster.
+	SignatureAlgorithmSuite types.SignatureAlgorithmSuite `protobuf:"varint,1,opt,name=signature_algorithm_suite,json=signatureAlgorithmSuite,proto3,enum=types.SignatureAlgorithmSuite" json:"signature_algorithm_suite,omitempty"`
+	XXX_NoUnkeyedLiteral    struct{}                      `json:"-"`
+	XXX_unrecognized        []byte                        `json:"-"`
+	XXX_sizecache           int32                         `json:"-"`
 }
 
 func (m *RegisterUsingBoundKeypairRotationRequest) Reset() {
@@ -1483,6 +1485,13 @@ func (m *RegisterUsingBoundKeypairRotationRequest) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_RegisterUsingBoundKeypairRotationRequest proto.InternalMessageInfo
 
+func (m *RegisterUsingBoundKeypairRotationRequest) GetSignatureAlgorithmSuite() types.SignatureAlgorithmSuite {
+	if m != nil {
+		return m.SignatureAlgorithmSuite
+	}
+	return types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_UNSPECIFIED
+}
+
 // RegisterUsingBoundKeypairMethodResponse is a response sent by the server
 // during the bound-keypair joining process. Multiple requests and responses are
 // expected to be exchanged during one join process.
@@ -1623,86 +1632,88 @@ func init() {
 }
 
 var fileDescriptor_d7e760ce923b836e = []byte{
-	// 1254 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x58, 0x4b, 0x6f, 0xdb, 0xc6,
-	0x13, 0x17, 0xe5, 0xd8, 0x89, 0x46, 0xca, 0x43, 0x9b, 0x20, 0x7f, 0x59, 0x88, 0x5f, 0xfc, 0x3b,
-	0xb1, 0x9c, 0x36, 0x92, 0xab, 0x5e, 0x8a, 0x9c, 0xea, 0x17, 0x20, 0xc7, 0x75, 0x6b, 0x30, 0x29,
-	0x8a, 0xf6, 0x42, 0xac, 0xa8, 0xad, 0xbc, 0x11, 0x43, 0xb2, 0xbb, 0x2b, 0x03, 0xea, 0xb9, 0x97,
-	0x7e, 0x80, 0x9c, 0xfb, 0x09, 0x0a, 0xf4, 0xd0, 0x73, 0xcf, 0x3d, 0x14, 0x45, 0x6f, 0xbd, 0x16,
-	0xfe, 0x0e, 0xbd, 0x17, 0xdc, 0x5d, 0x4a, 0x24, 0x45, 0x4a, 0x32, 0x90, 0xf6, 0x62, 0x99, 0x33,
-	0xb3, 0xbf, 0x79, 0xcf, 0x2c, 0x09, 0x4d, 0x41, 0x5c, 0x12, 0xf8, 0x4c, 0xb4, 0x5c, 0xd2, 0xc7,
-	0xce, 0xa8, 0xe5, 0xb8, 0x94, 0x78, 0xa2, 0x15, 0x30, 0x5f, 0xf8, 0xad, 0xd7, 0x3e, 0xf5, 0x38,
-	0x61, 0x97, 0xd4, 0x21, 0x4d, 0x49, 0x41, 0xcb, 0xf2, 0xa7, 0xde, 0x98, 0x79, 0xcc, 0x21, 0x4c,
-	0x70, 0x75, 0xa0, 0xbe, 0x95, 0x96, 0x14, 0xa3, 0x80, 0x70, 0xf5, 0x57, 0x89, 0x98, 0x3f, 0x1b,
-	0xb0, 0x66, 0x91, 0x3e, 0xe5, 0x82, 0xb0, 0xcf, 0x39, 0xf5, 0xfa, 0x27, 0xfb, 0x67, 0x67, 0x44,
-	0x5c, 0xf8, 0x3d, 0x8b, 0x7c, 0x33, 0x24, 0x5c, 0x20, 0x0c, 0x8f, 0x98, 0x16, 0xb0, 0x87, 0xa1,
-	0x84, 0x2d, 0xfc, 0x01, 0xf1, 0x6c, 0xa6, 0xf8, 0x35, 0x63, 0xd3, 0x68, 0x94, 0xdb, 0x9b, 0x4d,
-	0x85, 0x9a, 0xc0, 0x7a, 0x15, 0x0a, 0x6a, 0x1c, 0x6b, 0x95, 0xe5, 0xb1, 0xd0, 0x1e, 0x3c, 0xe0,
-	0x82, 0xdb, 0xb4, 0x47, 0x3c, 0x41, 0xc5, 0x68, 0x0c, 0x5d, 0xdc, 0x34, 0x1a, 0x15, 0x0b, 0x71,
-	0xc1, 0x4f, 0x34, 0x4b, 0x9f, 0x30, 0xbb, 0xb0, 0x9e, 0x67, 0x35, 0x0f, 0x7c, 0x8f, 0x13, 0xf4,
-	0x08, 0x4a, 0xce, 0x05, 0x76, 0x5d, 0xe2, 0xf5, 0x89, 0xb4, 0xb1, 0x64, 0x4d, 0x08, 0xc8, 0x84,
-	0x65, 0x19, 0x28, 0xa9, 0xa2, 0xdc, 0xae, 0xa8, 0x68, 0x34, 0x0f, 0x43, 0x9a, 0xa5, 0x58, 0xe6,
-	0x6f, 0x06, 0x6c, 0x24, 0x94, 0xec, 0x7f, 0x3b, 0x64, 0xe4, 0x3f, 0x0f, 0xce, 0xff, 0xe1, 0x36,
-	0x16, 0x82, 0x70, 0x41, 0x7a, 0x76, 0x0f, 0x0b, 0xac, 0xa3, 0x52, 0x89, 0x88, 0x47, 0x58, 0x60,
-	0xb4, 0x05, 0x15, 0xec, 0x38, 0x84, 0x73, 0xa5, 0xbf, 0xb6, 0x24, 0x1d, 0x2e, 0x2b, 0x9a, 0x84,
-	0x33, 0x7b, 0xb0, 0x99, 0xef, 0xcd, 0x3b, 0x0b, 0xda, 0x31, 0xec, 0x24, 0xbd, 0x3c, 0xd7, 0x89,
-	0x39, 0x8c, 0x60, 0xc6, 0xca, 0xea, 0x70, 0x8b, 0xfb, 0xee, 0x50, 0x50, 0xdf, 0x93, 0xba, 0x2a,
-	0xd6, 0xf8, 0xd9, 0xfc, 0xdb, 0x80, 0xed, 0x6c, 0x9c, 0x13, 0x8f, 0x0a, 0x8a, 0xdd, 0x28, 0x3a,
-	0x87, 0x50, 0x09, 0x1b, 0xe5, 0xda, 0x01, 0x2f, 0x87, 0xa7, 0x22, 0x90, 0x55, 0xb8, 0x49, 0x06,
-	0x76, 0xe8, 0x80, 0x0a, 0x6e, 0xa7, 0x60, 0xad, 0x90, 0x41, 0xe8, 0x17, 0xfa, 0x1f, 0xac, 0x90,
-	0x81, 0x3d, 0x20, 0x23, 0x19, 0xd2, 0x90, 0xb3, 0x4c, 0x06, 0xa7, 0x64, 0x84, 0x3e, 0x05, 0xa4,
-	0x32, 0x80, 0x43, 0x83, 0xed, 0x00, 0x33, 0xfc, 0x86, 0xd7, 0x6e, 0x48, 0xf5, 0x1b, 0x3a, 0x32,
-	0xaf, 0xce, 0xcf, 0xf6, 0x27, 0x32, 0xe7, 0xa1, 0x08, 0x11, 0x84, 0x71, 0xab, 0x8a, 0x53, 0x64,
-	0x7e, 0x70, 0x03, 0x8a, 0x64, 0x60, 0xfe, 0x9e, 0x6e, 0xc7, 0xb1, 0xdf, 0x91, 0xad, 0xfb, 0x70,
-	0x83, 0x7a, 0x34, 0x72, 0xf4, 0x3d, 0xad, 0x69, 0x91, 0x58, 0x75, 0x0a, 0x96, 0x3c, 0x8a, 0x6c,
-	0x40, 0xe3, 0xa4, 0xda, 0x4c, 0xa7, 0x43, 0x27, 0xb5, 0x39, 0x13, 0x70, 0x2a, 0x89, 0x9d, 0x82,
-	0x55, 0x75, 0xd2, 0xc4, 0x83, 0x12, 0xdc, 0x0c, 0xf0, 0xc8, 0xf5, 0x71, 0xcf, 0xfc, 0xc1, 0x48,
-	0x75, 0x6a, 0xcc, 0x21, 0x5d, 0x07, 0x9f, 0x40, 0x35, 0x6e, 0x4e, 0x3c, 0x8f, 0x6b, 0x93, 0x40,
-	0x1e, 0x7b, 0x0e, 0x1b, 0x05, 0x82, 0xf4, 0x0e, 0x19, 0x91, 0xc3, 0x00, 0xbb, 0x9d, 0x82, 0x75,
-	0x2f, 0xa6, 0x5c, 0xc5, 0x67, 0x7b, 0x46, 0x91, 0x86, 0xd9, 0x93, 0xcc, 0xb8, 0x85, 0x3f, 0x1a,
-	0x50, 0xcb, 0x4b, 0x14, 0x7a, 0x08, 0x2b, 0xc1, 0xb0, 0xeb, 0x52, 0x47, 0x57, 0xa8, 0x7e, 0x42,
-	0x1b, 0x50, 0x76, 0x18, 0xc1, 0x82, 0xc4, 0x5b, 0x12, 0x14, 0x49, 0x36, 0xe4, 0x33, 0x40, 0x5a,
-	0x20, 0x96, 0x6a, 0x55, 0x43, 0x56, 0x55, 0x71, 0x62, 0x1a, 0xd1, 0x2e, 0xdc, 0xd3, 0xe2, 0x9c,
-	0xf6, 0x3d, 0x2c, 0x86, 0x8c, 0xc8, 0x5a, 0xaa, 0x58, 0x77, 0x15, 0xfd, 0x65, 0x44, 0x36, 0xbf,
-	0x84, 0x87, 0xd9, 0xe1, 0x40, 0x3b, 0x10, 0x0a, 0xeb, 0x27, 0xbb, 0xeb, 0xfa, 0x5d, 0x6d, 0xf5,
-	0x9d, 0x09, 0xf9, 0xc0, 0xf5, 0xbb, 0xa1, 0x57, 0x9c, 0x38, 0x8c, 0x44, 0x13, 0x56, 0x3f, 0x99,
-	0x3f, 0x15, 0xe1, 0xfe, 0x67, 0x0c, 0x3b, 0xae, 0x54, 0x47, 0x62, 0x35, 0x77, 0xf3, 0x82, 0xe0,
-	0x1e, 0x61, 0xbc, 0x66, 0x6c, 0x2e, 0x35, 0xca, 0xed, 0x1d, 0x1d, 0xd5, 0x0c, 0xe1, 0x66, 0x47,
-	0x49, 0x1e, 0x7b, 0x82, 0x8d, 0xac, 0xe8, 0x1c, 0xfa, 0x02, 0xee, 0xea, 0x80, 0xdb, 0x11, 0x54,
-	0x51, 0x42, 0x35, 0x67, 0x40, 0x9d, 0xab, 0x13, 0x09, 0xc4, 0x3b, 0x41, 0x82, 0x58, 0x7f, 0x0e,
-	0x95, 0x38, 0x1f, 0xdd, 0x83, 0xa5, 0xb0, 0x5b, 0xd5, 0xf0, 0x0a, 0xff, 0x45, 0x0f, 0x60, 0xf9,
-	0x12, 0xbb, 0x43, 0x55, 0xe1, 0x25, 0x4b, 0x3d, 0x3c, 0x2f, 0x7e, 0x64, 0xd4, 0xf7, 0xe1, 0x7e,
-	0x86, 0x8a, 0xeb, 0x40, 0x98, 0x7f, 0x1a, 0xa9, 0xb1, 0xaa, 0xfc, 0x48, 0xf6, 0xac, 0xf3, 0x6e,
-	0xb6, 0x44, 0xa7, 0x30, 0x6b, 0x4f, 0x1c, 0xc2, 0x1d, 0x5f, 0xea, 0x4e, 0xac, 0xcf, 0x72, 0xbb,
-	0x9e, 0x1f, 0xe0, 0x4e, 0xc1, 0xba, 0xad, 0xce, 0x68, 0x42, 0xd8, 0x17, 0xfa, 0xb4, 0x39, 0x84,
-	0xad, 0x19, 0x8e, 0xe9, 0xde, 0x5d, 0x9f, 0x5a, 0x18, 0x9d, 0x42, 0x7c, 0x65, 0x2c, 0xd6, 0x8d,
-	0x00, 0xb7, 0xa2, 0x31, 0x14, 0x4e, 0xc0, 0xe4, 0x06, 0x39, 0xf0, 0x87, 0x5e, 0xef, 0x94, 0x8c,
-	0x02, 0x4c, 0xd9, 0xbf, 0x31, 0xfc, 0x9b, 0x70, 0x9f, 0x2a, 0x58, 0x5b, 0x82, 0xc5, 0x3a, 0xa3,
-	0x64, 0x55, 0x35, 0xeb, 0x85, 0x4f, 0xbd, 0x97, 0x92, 0x11, 0xca, 0x07, 0x8c, 0x5c, 0x52, 0x7f,
-	0xc8, 0xf5, 0x01, 0x81, 0x05, 0x89, 0x5a, 0x3b, 0x62, 0xc9, 0x03, 0x21, 0xc3, 0xec, 0xc0, 0xd3,
-	0x5c, 0x7f, 0xae, 0xb7, 0x14, 0x5f, 0xc0, 0x6e, 0x2e, 0x92, 0xe5, 0xab, 0x49, 0x32, 0x06, 0x5a,
-	0x03, 0x50, 0xb3, 0xca, 0x9e, 0xd4, 0x72, 0x49, 0x51, 0x4e, 0xc9, 0xc8, 0xfc, 0xa5, 0x08, 0x4f,
-	0x72, 0xc1, 0x92, 0xd5, 0x7b, 0x94, 0xd8, 0x38, 0x99, 0x0b, 0x22, 0x3f, 0x47, 0xe3, 0xa5, 0xd3,
-	0x9d, 0xb1, 0x74, 0x3e, 0x98, 0x87, 0xb9, 0xd8, 0xde, 0x41, 0x36, 0x54, 0x99, 0x8e, 0xc3, 0x44,
-	0xc5, 0x92, 0x54, 0xb1, 0x37, 0x4f, 0x45, 0x3a, 0x80, 0xe1, 0x72, 0x61, 0x29, 0x5a, 0x7c, 0x6d,
-	0x60, 0x30, 0xe7, 0x9b, 0x3b, 0x27, 0x0b, 0xc9, 0xfb, 0x56, 0x31, 0x75, 0xdf, 0x32, 0xbf, 0x37,
-	0xe0, 0x71, 0xbe, 0x0e, 0xc2, 0x04, 0xfd, 0x9a, 0x3a, 0x58, 0x10, 0x3e, 0xb9, 0x99, 0x19, 0xb9,
-	0x37, 0xb3, 0xd0, 0x94, 0x58, 0xb9, 0xaa, 0xc1, 0x5f, 0x7a, 0x1d, 0x95, 0x69, 0xca, 0xd2, 0xa5,
-	0x74, 0xbd, 0x3c, 0x85, 0xc6, 0x02, 0xa1, 0x53, 0x93, 0xe3, 0x6d, 0x71, 0x46, 0x0b, 0xa7, 0x06,
-	0xc8, 0x49, 0x7a, 0x80, 0x94, 0xdb, 0xbb, 0x0b, 0x57, 0x43, 0x72, 0xd6, 0x1c, 0x25, 0x67, 0xcd,
-	0xfb, 0x73, 0x61, 0x62, 0x11, 0x1c, 0xcf, 0x22, 0x74, 0x06, 0xb7, 0xa2, 0xb4, 0xeb, 0xd2, 0x69,
-	0x2d, 0x5e, 0x3a, 0x51, 0xc9, 0x8f, 0x21, 0xe2, 0xa3, 0xad, 0xfd, 0x76, 0x19, 0xca, 0x6a, 0x90,
-	0xc8, 0xb7, 0x3a, 0x44, 0xe1, 0x61, 0xf6, 0x4b, 0x0c, 0xda, 0xce, 0x52, 0x99, 0x7e, 0x33, 0xab,
-	0x3f, 0x9e, 0x23, 0xa5, 0xd4, 0x36, 0x8c, 0x3d, 0x03, 0xf9, 0x50, 0xcb, 0xbb, 0xfc, 0xa3, 0x27,
-	0x59, 0x30, 0xd3, 0xef, 0x3a, 0xf5, 0x9d, 0xb9, 0x72, 0x31, 0x85, 0x69, 0xdf, 0xc6, 0xd7, 0xbe,
-	0x6c, 0xdf, 0xd2, 0xd7, 0xdc, 0x6c, 0xdf, 0xa6, 0xee, 0x8e, 0x52, 0x15, 0x83, 0xd5, 0xdc, 0x45,
-	0x85, 0x32, 0x8d, 0xce, 0xd8, 0xd1, 0xf5, 0xc6, 0x7c, 0xc1, 0x98, 0xce, 0xef, 0xd2, 0xef, 0x86,
-	0xd3, 0x25, 0x8e, 0x9e, 0xcd, 0xab, 0x9b, 0xa4, 0x01, 0xcd, 0x45, 0xc5, 0x63, 0x66, 0x1c, 0x01,
-	0x9a, 0xde, 0x72, 0x68, 0xee, 0x02, 0xac, 0x27, 0x06, 0xc4, 0xc1, 0xc7, 0xbf, 0x5e, 0xad, 0x1b,
-	0x7f, 0x5c, 0xad, 0x1b, 0x7f, 0x5d, 0xad, 0x1b, 0x5f, 0xb5, 0xfb, 0x54, 0x5c, 0x0c, 0xbb, 0x4d,
-	0xc7, 0x7f, 0xd3, 0xea, 0x33, 0x7c, 0x49, 0x55, 0x25, 0x63, 0xb7, 0x35, 0xfe, 0x9a, 0x80, 0x03,
-	0x9a, 0xf8, 0xe8, 0xd0, 0x5d, 0x91, 0x3f, 0x1f, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0x72, 0x17,
-	0x9a, 0x35, 0xd2, 0x10, 0x00, 0x00,
+	// 1294 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x58, 0xcf, 0x8f, 0xd3, 0xc6,
+	0x17, 0x8f, 0xb3, 0xec, 0x42, 0x5e, 0xc2, 0xc2, 0x0e, 0x08, 0x76, 0x23, 0x08, 0x8b, 0xbf, 0xc0,
+	0x86, 0x6f, 0x4b, 0x42, 0xd3, 0x4b, 0xc5, 0xa9, 0xd9, 0x5d, 0xa4, 0x2c, 0x74, 0xdb, 0x95, 0xa1,
+	0xaa, 0xca, 0xc5, 0x9a, 0x38, 0xd3, 0xec, 0x10, 0x63, 0xbb, 0x33, 0xe3, 0x95, 0xd2, 0x73, 0x55,
+	0xa9, 0x7f, 0x00, 0xe7, 0xfe, 0x05, 0x95, 0x7a, 0xe8, 0xb9, 0xe7, 0x1e, 0xaa, 0xaa, 0xb7, 0x5e,
+	0x2b, 0xfe, 0x87, 0xde, 0x2b, 0xcf, 0x8c, 0x1d, 0xdb, 0xb1, 0x93, 0x20, 0xd1, 0x5e, 0x58, 0xfc,
+	0xde, 0x9b, 0xcf, 0xfb, 0xfd, 0xde, 0x4c, 0xa0, 0x23, 0x88, 0x4b, 0x02, 0x9f, 0x89, 0xae, 0x4b,
+	0xc6, 0xd8, 0x99, 0x76, 0x1d, 0x97, 0x12, 0x4f, 0x74, 0x03, 0xe6, 0x0b, 0xbf, 0xfb, 0xd2, 0xa7,
+	0x1e, 0x27, 0xec, 0x8c, 0x3a, 0xa4, 0x23, 0x29, 0x68, 0x5d, 0xfe, 0x69, 0xb6, 0x17, 0x1e, 0x73,
+	0x08, 0x13, 0x5c, 0x1d, 0x68, 0xde, 0xce, 0x4b, 0x8a, 0x69, 0x40, 0xb8, 0xfa, 0x57, 0x89, 0x98,
+	0x3f, 0x1b, 0x70, 0xd3, 0x22, 0x63, 0xca, 0x05, 0x61, 0x9f, 0x73, 0xea, 0x8d, 0x8f, 0xfa, 0xc7,
+	0xc7, 0x44, 0x9c, 0xfa, 0x23, 0x8b, 0x7c, 0x1d, 0x12, 0x2e, 0x10, 0x86, 0x1b, 0x4c, 0x0b, 0xd8,
+	0x61, 0x24, 0x61, 0x0b, 0x7f, 0x42, 0x3c, 0x9b, 0x29, 0xfe, 0xb6, 0xb1, 0x6b, 0xb4, 0xeb, 0xbd,
+	0xdd, 0x8e, 0x42, 0xcd, 0x60, 0x3d, 0x8f, 0x04, 0x35, 0x8e, 0xb5, 0xc3, 0xca, 0x58, 0xe8, 0x21,
+	0x5c, 0xe5, 0x82, 0xdb, 0x74, 0x44, 0x3c, 0x41, 0xc5, 0x34, 0x81, 0xae, 0xee, 0x1a, 0xed, 0x86,
+	0x85, 0xb8, 0xe0, 0x47, 0x9a, 0xa5, 0x4f, 0x98, 0x43, 0x68, 0x95, 0x59, 0xcd, 0x03, 0xdf, 0xe3,
+	0x04, 0xdd, 0x80, 0x9a, 0x73, 0x8a, 0x5d, 0x97, 0x78, 0x63, 0x22, 0x6d, 0xac, 0x59, 0x33, 0x02,
+	0x32, 0x61, 0x5d, 0x06, 0x4a, 0xaa, 0xa8, 0xf7, 0x1a, 0x2a, 0x1a, 0x9d, 0x83, 0x88, 0x66, 0x29,
+	0x96, 0xf9, 0x9b, 0x01, 0xb7, 0x32, 0x4a, 0xfa, 0xdf, 0x84, 0x8c, 0xfc, 0xe7, 0xc1, 0xf9, 0x1f,
+	0x5c, 0xc4, 0x42, 0x10, 0x2e, 0xc8, 0xc8, 0x1e, 0x61, 0x81, 0x75, 0x54, 0x1a, 0x31, 0xf1, 0x10,
+	0x0b, 0x8c, 0x6e, 0x43, 0x03, 0x3b, 0x0e, 0xe1, 0x5c, 0xe9, 0xdf, 0x5e, 0x93, 0x0e, 0xd7, 0x15,
+	0x4d, 0xc2, 0x99, 0x23, 0xd8, 0x2d, 0xf7, 0xe6, 0x9d, 0x05, 0xed, 0x31, 0xec, 0x65, 0xbd, 0x3c,
+	0xd1, 0x89, 0x39, 0x88, 0x61, 0x12, 0x65, 0x4d, 0xb8, 0xc0, 0x7d, 0x37, 0x14, 0xd4, 0xf7, 0xa4,
+	0xae, 0x86, 0x95, 0x7c, 0x9b, 0x7f, 0x1b, 0x70, 0xa7, 0x18, 0xe7, 0xc8, 0xa3, 0x82, 0x62, 0x37,
+	0x8e, 0xce, 0x01, 0x34, 0xa2, 0x46, 0x79, 0xeb, 0x80, 0xd7, 0xa3, 0x53, 0x31, 0xc8, 0x0e, 0x9c,
+	0x27, 0x13, 0x3b, 0x72, 0x40, 0x05, 0x77, 0x50, 0xb1, 0x36, 0xc8, 0x24, 0xf2, 0x0b, 0x5d, 0x87,
+	0x0d, 0x32, 0xb1, 0x27, 0x64, 0x2a, 0x43, 0x1a, 0x71, 0xd6, 0xc9, 0xe4, 0x29, 0x99, 0xa2, 0x4f,
+	0x01, 0xa9, 0x0c, 0xe0, 0xc8, 0x60, 0x3b, 0xc0, 0x0c, 0xbf, 0xe2, 0xdb, 0xe7, 0xa4, 0xfa, 0x5b,
+	0x3a, 0x32, 0xcf, 0x4f, 0x8e, 0xfb, 0x33, 0x99, 0x93, 0x48, 0x84, 0x08, 0xc2, 0xb8, 0xb5, 0x85,
+	0x73, 0x64, 0xbe, 0x7f, 0x0e, 0xaa, 0x64, 0x62, 0xfe, 0x9e, 0x6f, 0xc7, 0xc4, 0xef, 0xd8, 0xd6,
+	0x3e, 0x9c, 0xa3, 0x1e, 0x8d, 0x1d, 0x7d, 0x4f, 0x6b, 0x5a, 0x25, 0x56, 0x83, 0x8a, 0x25, 0x8f,
+	0x22, 0x1b, 0x50, 0x92, 0x54, 0x9b, 0xe9, 0x74, 0xe8, 0xa4, 0x76, 0x16, 0x02, 0xce, 0x25, 0x71,
+	0x50, 0xb1, 0xb6, 0x9c, 0x3c, 0x71, 0xbf, 0x06, 0xe7, 0x03, 0x3c, 0x75, 0x7d, 0x3c, 0x32, 0x7f,
+	0x30, 0x72, 0x9d, 0x9a, 0x72, 0x48, 0xd7, 0xc1, 0x27, 0xb0, 0x95, 0x36, 0x27, 0x9d, 0xc7, 0x9b,
+	0xb3, 0x40, 0x3e, 0xf6, 0x1c, 0x36, 0x0d, 0x04, 0x19, 0x1d, 0x30, 0x22, 0x87, 0x01, 0x76, 0x07,
+	0x15, 0xeb, 0x72, 0x4a, 0xb9, 0x8a, 0xcf, 0x9d, 0x05, 0x45, 0x1a, 0x65, 0x4f, 0x32, 0xd3, 0x16,
+	0xfe, 0x68, 0xc0, 0x76, 0x59, 0xa2, 0xd0, 0x35, 0xd8, 0x08, 0xc2, 0xa1, 0x4b, 0x1d, 0x5d, 0xa1,
+	0xfa, 0x0b, 0xdd, 0x82, 0xba, 0xc3, 0x08, 0x16, 0x24, 0xdd, 0x92, 0xa0, 0x48, 0xb2, 0x21, 0x1f,
+	0x00, 0xd2, 0x02, 0xa9, 0x54, 0xab, 0x1a, 0xb2, 0xb6, 0x14, 0x27, 0xa5, 0x11, 0xdd, 0x87, 0xcb,
+	0x5a, 0x9c, 0xd3, 0xb1, 0x87, 0x45, 0xc8, 0x88, 0xac, 0xa5, 0x86, 0x75, 0x49, 0xd1, 0x9f, 0xc5,
+	0x64, 0xf3, 0x4b, 0xb8, 0x56, 0x1c, 0x0e, 0xb4, 0x07, 0x91, 0xb0, 0xfe, 0xb2, 0x87, 0xae, 0x3f,
+	0xd4, 0x56, 0x6f, 0xce, 0xc8, 0xfb, 0xae, 0x3f, 0x8c, 0xbc, 0xe2, 0xc4, 0x61, 0x24, 0x9e, 0xb0,
+	0xfa, 0xcb, 0xfc, 0xa9, 0x0a, 0x57, 0x3e, 0x63, 0xd8, 0x71, 0xa5, 0x3a, 0x92, 0xaa, 0xb9, 0xf3,
+	0xa7, 0x04, 0x8f, 0x08, 0xe3, 0xdb, 0xc6, 0xee, 0x5a, 0xbb, 0xde, 0xdb, 0xd3, 0x51, 0x2d, 0x10,
+	0xee, 0x0c, 0x94, 0xe4, 0x63, 0x4f, 0xb0, 0xa9, 0x15, 0x9f, 0x43, 0x5f, 0xc0, 0x25, 0x1d, 0x70,
+	0x3b, 0x86, 0xaa, 0x4a, 0xa8, 0xce, 0x02, 0xa8, 0x13, 0x75, 0x22, 0x83, 0xb8, 0x19, 0x64, 0x88,
+	0xcd, 0x47, 0xd0, 0x48, 0xf3, 0xd1, 0x65, 0x58, 0x8b, 0xba, 0x55, 0x0d, 0xaf, 0xe8, 0xbf, 0xe8,
+	0x2a, 0xac, 0x9f, 0x61, 0x37, 0x54, 0x15, 0x5e, 0xb3, 0xd4, 0xc7, 0xa3, 0xea, 0x47, 0x46, 0xb3,
+	0x0f, 0x57, 0x0a, 0x54, 0xbc, 0x0d, 0x84, 0xf9, 0xa7, 0x91, 0x1b, 0xab, 0xca, 0x8f, 0x6c, 0xcf,
+	0x3a, 0xef, 0x66, 0x4b, 0x0c, 0x2a, 0x8b, 0xf6, 0xc4, 0x01, 0x6c, 0xfa, 0x52, 0x77, 0x66, 0x7d,
+	0xd6, 0x7b, 0xcd, 0xf2, 0x00, 0x0f, 0x2a, 0xd6, 0x45, 0x75, 0x46, 0x13, 0xa2, 0xbe, 0xd0, 0xa7,
+	0xcd, 0x10, 0x6e, 0x2f, 0x70, 0x4c, 0xf7, 0x6e, 0x6b, 0x6e, 0x61, 0x0c, 0x2a, 0xe9, 0x95, 0xb1,
+	0x5a, 0x37, 0x02, 0x5c, 0x88, 0xc7, 0x50, 0x34, 0x01, 0xb3, 0x1b, 0x64, 0xdf, 0x0f, 0xbd, 0xd1,
+	0x53, 0x32, 0x0d, 0x30, 0x65, 0xff, 0xc6, 0xf0, 0xef, 0xc0, 0x15, 0xaa, 0x60, 0x6d, 0x09, 0x96,
+	0xea, 0x8c, 0x9a, 0xb5, 0xa5, 0x59, 0x4f, 0x7c, 0xea, 0x3d, 0x93, 0x8c, 0x48, 0x3e, 0x60, 0xe4,
+	0x8c, 0xfa, 0x21, 0xd7, 0x07, 0x04, 0x16, 0x24, 0x6e, 0xed, 0x98, 0x25, 0x0f, 0x44, 0x0c, 0x73,
+	0x00, 0xff, 0x2f, 0xf5, 0xe7, 0xed, 0x96, 0xe2, 0x13, 0xb8, 0x5f, 0x8a, 0x64, 0xf9, 0x6a, 0x92,
+	0x24, 0x40, 0x37, 0x01, 0xd4, 0xac, 0xb2, 0x67, 0xb5, 0x5c, 0x53, 0x94, 0xa7, 0x64, 0x6a, 0xfe,
+	0x52, 0x85, 0x7b, 0xa5, 0x60, 0xd9, 0xea, 0x3d, 0xcc, 0x6c, 0x9c, 0xc2, 0x05, 0x51, 0x9e, 0xa3,
+	0x64, 0xe9, 0x0c, 0x17, 0x2c, 0x9d, 0x0f, 0x96, 0x61, 0xae, 0xb6, 0x77, 0x90, 0x0d, 0x5b, 0x4c,
+	0xc7, 0x61, 0xa6, 0x62, 0x4d, 0xaa, 0x78, 0xb8, 0x4c, 0x45, 0x3e, 0x80, 0xd1, 0x72, 0x61, 0x39,
+	0x5a, 0x7a, 0x6d, 0x60, 0x30, 0x97, 0x9b, 0xbb, 0x24, 0x0b, 0xd9, 0xfb, 0x56, 0x35, 0x77, 0xdf,
+	0x32, 0xbf, 0x37, 0xe0, 0x6e, 0xb9, 0x0e, 0xc2, 0x04, 0xfd, 0x8a, 0x3a, 0x58, 0x10, 0x3e, 0xbb,
+	0x99, 0x19, 0xa5, 0x37, 0xb3, 0xc8, 0x94, 0x54, 0xb9, 0xaa, 0xc1, 0x5f, 0x7b, 0x19, 0x97, 0x69,
+	0xce, 0xd2, 0xb5, 0x7c, 0xbd, 0x7c, 0x67, 0x40, 0x7b, 0x85, 0xd8, 0xa9, 0x8a, 0x79, 0x01, 0x3b,
+	0xc9, 0x1a, 0xb3, 0xb1, 0x3b, 0xf6, 0x19, 0x15, 0xa7, 0xaf, 0x6c, 0x1e, 0x52, 0xa1, 0xa6, 0xc4,
+	0x66, 0xaf, 0xa5, 0x9b, 0x34, 0xd9, 0x6b, 0xfd, 0x58, 0xec, 0x59, 0x24, 0x65, 0x5d, 0xe7, 0xc5,
+	0x0c, 0xf3, 0x75, 0x75, 0xc1, 0x7c, 0xc8, 0x4d, 0xa7, 0xa3, 0xfc, 0x74, 0xaa, 0xf7, 0xee, 0xaf,
+	0x5c, 0x6a, 0xd9, 0x41, 0x76, 0x98, 0x1d, 0x64, 0xef, 0x2f, 0x85, 0x49, 0xa5, 0x27, 0x19, 0x74,
+	0xe8, 0x18, 0x2e, 0xc4, 0x35, 0xa5, 0xeb, 0xb2, 0xbb, 0x7a, 0x5d, 0xc6, 0xfd, 0x94, 0x40, 0xa4,
+	0xe7, 0x66, 0xef, 0xf5, 0x3a, 0xd4, 0xd5, 0x94, 0x92, 0x4f, 0x46, 0x44, 0xe1, 0x5a, 0xf1, 0x0b,
+	0x09, 0xdd, 0x29, 0x52, 0x99, 0x7f, 0xf6, 0x35, 0xef, 0x2e, 0x91, 0x52, 0x6a, 0xdb, 0xc6, 0x43,
+	0x03, 0xf9, 0xb0, 0x5d, 0xf6, 0xb2, 0x40, 0xf7, 0x8a, 0x60, 0xe6, 0x1f, 0x52, 0xcd, 0xbd, 0xa5,
+	0x72, 0x29, 0x85, 0x79, 0xdf, 0x92, 0x3b, 0x65, 0xb1, 0x6f, 0xf9, 0x3b, 0x74, 0xb1, 0x6f, 0x73,
+	0x17, 0x53, 0xa9, 0x8a, 0xc1, 0x4e, 0xe9, 0x16, 0x44, 0x85, 0x46, 0x17, 0x5c, 0x00, 0x9a, 0xed,
+	0xe5, 0x82, 0x29, 0x9d, 0xdf, 0xe6, 0x1f, 0x9e, 0xf3, 0x25, 0x8e, 0x1e, 0x2c, 0xab, 0x9b, 0xac,
+	0x01, 0x9d, 0x55, 0xc5, 0x53, 0x66, 0x1c, 0x02, 0x9a, 0x5f, 0xa1, 0x68, 0xe9, 0x76, 0x6d, 0x66,
+	0xa6, 0xcf, 0xfe, 0xc7, 0xbf, 0xbe, 0x69, 0x19, 0x7f, 0xbc, 0x69, 0x19, 0x7f, 0xbd, 0x69, 0x19,
+	0x2f, 0x7a, 0x63, 0x2a, 0x4e, 0xc3, 0x61, 0xc7, 0xf1, 0x5f, 0x75, 0xc7, 0x0c, 0x9f, 0x51, 0x55,
+	0xc9, 0xd8, 0xed, 0x26, 0x3f, 0x55, 0xe0, 0x80, 0x66, 0x7e, 0xd1, 0x18, 0x6e, 0xc8, 0x3f, 0x1f,
+	0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0x83, 0x41, 0x97, 0x10, 0x2f, 0x11, 0x00, 0x00,
 }
 
 func (m *RegisterUsingIAMMethodRequest) Marshal() (dAtA []byte, err error) {
@@ -2826,6 +2837,11 @@ func (m *RegisterUsingBoundKeypairRotationRequest) MarshalToSizedBuffer(dAtA []b
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.SignatureAlgorithmSuite != 0 {
+		i = encodeVarintJoinservice(dAtA, i, uint64(m.SignatureAlgorithmSuite))
+		i--
+		dAtA[i] = 0x8
+	}
 	return len(dAtA) - i, nil
 }
 
@@ -3473,6 +3489,9 @@ func (m *RegisterUsingBoundKeypairRotationRequest) Size() (n int) {
 	}
 	var l int
 	_ = l
+	if m.SignatureAlgorithmSuite != 0 {
+		n += 1 + sovJoinservice(uint64(m.SignatureAlgorithmSuite))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -6189,6 +6208,25 @@ func (m *RegisterUsingBoundKeypairRotationRequest) Unmarshal(dAtA []byte) error
 			return fmt.Errorf("proto: RegisterUsingBoundKeypairRotationRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SignatureAlgorithmSuite", wireType)
+			}
+			m.SignatureAlgorithmSuite = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowJoinservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SignatureAlgorithmSuite |= types.SignatureAlgorithmSuite(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipJoinservice(dAtA[iNdEx:])
diff --git a/api/client/proto/requestable_roles.pb.go b/api/client/proto/requestable_roles.pb.go
new file mode 100644
index 0000000000000..81efc640662b1
--- /dev/null
+++ b/api/client/proto/requestable_roles.pb.go
@@ -0,0 +1,329 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/legacy/client/proto/requestable_roles.proto
+
+// buf:lint:ignore PACKAGE_DIRECTORY_MATCH
+// buf:lint:ignore PACKAGE_VERSION_SUFFIX
+
+package proto
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ListRequestableRolesRequest is the request message for AuthService.ListRequestableRoles
+type ListRequestableRolesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// page_size is the maximum number of requestable roles to return per page.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// page_token is the next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// filter is the filtering options for the returned roles.
+	Filter        *ListRequestableRolesRequest_Filter `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRequestableRolesRequest) Reset() {
+	*x = ListRequestableRolesRequest{}
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRequestableRolesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRequestableRolesRequest) ProtoMessage() {}
+
+func (x *ListRequestableRolesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRequestableRolesRequest.ProtoReflect.Descriptor instead.
+func (*ListRequestableRolesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_requestable_roles_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ListRequestableRolesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListRequestableRolesRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListRequestableRolesRequest) GetFilter() *ListRequestableRolesRequest_Filter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// ListRequestableRolesResponse is the response message for AuthService.ListRequestableRoles
+type ListRequestableRolesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// roles is the requestable roles.
+	Roles []*ListRequestableRolesResponse_RequestableRole `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	// next_page_token is the next page token. If there are no more results, it will be empty.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRequestableRolesResponse) Reset() {
+	*x = ListRequestableRolesResponse{}
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRequestableRolesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRequestableRolesResponse) ProtoMessage() {}
+
+func (x *ListRequestableRolesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRequestableRolesResponse.ProtoReflect.Descriptor instead.
+func (*ListRequestableRolesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_requestable_roles_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ListRequestableRolesResponse) GetRoles() []*ListRequestableRolesResponse_RequestableRole {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *ListRequestableRolesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// Filter is the type for the filtering options for the returned roles.
+type ListRequestableRolesRequest_Filter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// a list of search keywords to match against resource field values, if specified
+	SearchKeywords []string `protobuf:"bytes,1,rep,name=search_keywords,json=searchKeywords,proto3" json:"search_keywords,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *ListRequestableRolesRequest_Filter) Reset() {
+	*x = ListRequestableRolesRequest_Filter{}
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRequestableRolesRequest_Filter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRequestableRolesRequest_Filter) ProtoMessage() {}
+
+func (x *ListRequestableRolesRequest_Filter) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRequestableRolesRequest_Filter.ProtoReflect.Descriptor instead.
+func (*ListRequestableRolesRequest_Filter) Descriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_requestable_roles_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *ListRequestableRolesRequest_Filter) GetSearchKeywords() []string {
+	if x != nil {
+		return x.SearchKeywords
+	}
+	return nil
+}
+
+// RequestableRole is the type of a requestable role, containing only its name and description.
+type ListRequestableRolesResponse_RequestableRole struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRequestableRolesResponse_RequestableRole) Reset() {
+	*x = ListRequestableRolesResponse_RequestableRole{}
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRequestableRolesResponse_RequestableRole) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRequestableRolesResponse_RequestableRole) ProtoMessage() {}
+
+func (x *ListRequestableRolesResponse_RequestableRole) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRequestableRolesResponse_RequestableRole.ProtoReflect.Descriptor instead.
+func (*ListRequestableRolesResponse_RequestableRole) Descriptor() ([]byte, []int) {
+	return file_teleport_legacy_client_proto_requestable_roles_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *ListRequestableRolesResponse_RequestableRole) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ListRequestableRolesResponse_RequestableRole) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+var File_teleport_legacy_client_proto_requestable_roles_proto protoreflect.FileDescriptor
+
+const file_teleport_legacy_client_proto_requestable_roles_proto_rawDesc = "" +
+	"\n" +
+	"4teleport/legacy/client/proto/requestable_roles.proto\x12\x05proto\"\xcf\x01\n" +
+	"\x1bListRequestableRolesRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12A\n" +
+	"\x06filter\x18\x03 \x01(\v2).proto.ListRequestableRolesRequest.FilterR\x06filter\x1a1\n" +
+	"\x06Filter\x12'\n" +
+	"\x0fsearch_keywords\x18\x01 \x03(\tR\x0esearchKeywords\"\xda\x01\n" +
+	"\x1cListRequestableRolesResponse\x12I\n" +
+	"\x05roles\x18\x01 \x03(\v23.proto.ListRequestableRolesResponse.RequestableRoleR\x05roles\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\x1aG\n" +
+	"\x0fRequestableRole\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescriptionB4Z2github.com/gravitational/teleport/api/client/protob\x06proto3"
+
+var (
+	file_teleport_legacy_client_proto_requestable_roles_proto_rawDescOnce sync.Once
+	file_teleport_legacy_client_proto_requestable_roles_proto_rawDescData []byte
+)
+
+func file_teleport_legacy_client_proto_requestable_roles_proto_rawDescGZIP() []byte {
+	file_teleport_legacy_client_proto_requestable_roles_proto_rawDescOnce.Do(func() {
+		file_teleport_legacy_client_proto_requestable_roles_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_legacy_client_proto_requestable_roles_proto_rawDesc), len(file_teleport_legacy_client_proto_requestable_roles_proto_rawDesc)))
+	})
+	return file_teleport_legacy_client_proto_requestable_roles_proto_rawDescData
+}
+
+var file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_legacy_client_proto_requestable_roles_proto_goTypes = []any{
+	(*ListRequestableRolesRequest)(nil),                  // 0: proto.ListRequestableRolesRequest
+	(*ListRequestableRolesResponse)(nil),                 // 1: proto.ListRequestableRolesResponse
+	(*ListRequestableRolesRequest_Filter)(nil),           // 2: proto.ListRequestableRolesRequest.Filter
+	(*ListRequestableRolesResponse_RequestableRole)(nil), // 3: proto.ListRequestableRolesResponse.RequestableRole
+}
+var file_teleport_legacy_client_proto_requestable_roles_proto_depIdxs = []int32{
+	2, // 0: proto.ListRequestableRolesRequest.filter:type_name -> proto.ListRequestableRolesRequest.Filter
+	3, // 1: proto.ListRequestableRolesResponse.roles:type_name -> proto.ListRequestableRolesResponse.RequestableRole
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_legacy_client_proto_requestable_roles_proto_init() }
+func file_teleport_legacy_client_proto_requestable_roles_proto_init() {
+	if File_teleport_legacy_client_proto_requestable_roles_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_legacy_client_proto_requestable_roles_proto_rawDesc), len(file_teleport_legacy_client_proto_requestable_roles_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_legacy_client_proto_requestable_roles_proto_goTypes,
+		DependencyIndexes: file_teleport_legacy_client_proto_requestable_roles_proto_depIdxs,
+		MessageInfos:      file_teleport_legacy_client_proto_requestable_roles_proto_msgTypes,
+	}.Build()
+	File_teleport_legacy_client_proto_requestable_roles_proto = out.File
+	file_teleport_legacy_client_proto_requestable_roles_proto_goTypes = nil
+	file_teleport_legacy_client_proto_requestable_roles_proto_depIdxs = nil
+}
diff --git a/api/client/proto/types.go b/api/client/proto/types.go
index 9f074aad7078c..75537847f9725 100644
--- a/api/client/proto/types.go
+++ b/api/client/proto/types.go
@@ -107,6 +107,8 @@ func (a *UpstreamInventoryAgentMetadata) sealedUpstreamInventoryMessage() {}
 
 func (h *UpstreamInventoryGoodbye) sealedUpstreamInventoryMessage() {}
 
+func (h *UpstreamInventoryStopHeartbeat) sealedUpstreamInventoryMessage() {}
+
 // DownstreamInventoryMessage is a sealed interface representing the possible
 // downstream messages of the inventory controls stream after initial hello.
 type DownstreamInventoryMessage interface {
diff --git a/api/client/proxy/client.go b/api/client/proxy/client.go
index 8413e99293ebf..3c2650dec0e4b 100644
--- a/api/client/proxy/client.go
+++ b/api/client/proxy/client.go
@@ -15,6 +15,7 @@
 package proxy
 
 import (
+	"cmp"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -38,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/defaults"
 	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
 	"github.com/gravitational/teleport/api/metadata"
+	grpcutils "github.com/gravitational/teleport/api/utils/grpc"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 )
 
@@ -46,6 +48,8 @@ import (
 type ClientConfig struct {
 	// ProxyAddress is the address of the Proxy server.
 	ProxyAddress string
+	// RelayAddress is the address of the relay in use, if any.
+	RelayAddress string
 	// TLSRoutingEnabled indicates if the cluster is using TLS Routing.
 	TLSRoutingEnabled bool
 	// TLSConfigFunc produces the [tls.Config] required for mTLS connections to a specific cluster.
@@ -75,9 +79,15 @@ type ClientConfig struct {
 	PROXYHeaderGetter client.PROXYHeaderGetter
 
 	// The below items are intended to be used by tests to connect without mTLS.
-	// The gRPC transport credentials to use when establishing the connection to proxy.
+
+	// creds returns gRPC transport credentials to use with the proxy sshgrpc
+	// server.
 	creds func(cluster string) (credentials.TransportCredentials, error)
-	// The client credentials to use when establishing the connection to auth.
+	// relayCreds returns gRPC transport credentials to use with the relay
+	// transport server.
+	relayCreds func() (credentials.TransportCredentials, error)
+	// clientCreds returns the api client credentials to use when establishing
+	// the connection to auth.
 	clientCreds func(cluster string) (client.Credentials, error)
 }
 
@@ -137,6 +147,20 @@ func (c *ClientConfig) CheckAndSetDefaults(ctx context.Context) error {
 				}
 			}
 
+			return credentials.NewTLS(tlsCfg), nil
+		}
+		c.relayCreds = func() (credentials.TransportCredentials, error) {
+			const localCluster = ""
+			tlsCfg, err := c.TLSConfigFunc(localCluster)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			// the [credentials.NewTLS] transport credentials will take care of SNI
+			// and ALPN
+			tlsCfg.NextProtos = nil
+			tlsCfg.ServerName = ""
+
 			return credentials.NewTLS(tlsCfg), nil
 		}
 	} else {
@@ -146,6 +170,9 @@ func (c *ClientConfig) CheckAndSetDefaults(ctx context.Context) error {
 		c.creds = func(cluster string) (credentials.TransportCredentials, error) {
 			return insecure.NewCredentials(), nil
 		}
+		c.relayCreds = func() (credentials.TransportCredentials, error) {
+			return insecure.NewCredentials(), nil
+		}
 	}
 
 	return nil
@@ -184,6 +211,12 @@ type Client struct {
 	// clusterName as determined by inspecting the certificate presented by
 	// the Proxy during the connection handshake.
 	clusterName *clusterName
+
+	// relayGrpcConn, if set, is the gRPC client to the relay transport server.
+	relayGrpcConn *grpc.ClientConn
+	// relayTransport, if set, is a [transportv1.Client] for the relay transport
+	// service. Should be used over the standard one, if set.
+	relayTransport *transportv1.Client
 }
 
 // protocolProxySSHGRPC is TLS ALPN protocol value used to indicate gRPC
@@ -291,7 +324,8 @@ func newGRPCClient(ctx context.Context, cfg *ClientConfig) (_ *Client, err error
 
 	c := &clusterName{}
 
-	creds, err := cfg.creds("")
+	const localCluster = ""
+	creds, err := cfg.creds(localCluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -300,26 +334,24 @@ func newGRPCClient(ctx context.Context, cfg *ClientConfig) (_ *Client, err error
 		dialCtx,
 		cfg.ProxyAddress,
 		append([]grpc.DialOption{
+			grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 			grpc.WithContextDialer(newDialerForGRPCClient(ctx, cfg)),
 			grpc.WithTransportCredentials(&clusterCredentials{TransportCredentials: creds, clusterName: c}),
 			grpc.WithChainUnaryInterceptor(
 				append(cfg.UnaryInterceptors,
-					//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-					// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-					otelgrpc.UnaryClientInterceptor(),
 					metadata.UnaryClientInterceptor,
 					interceptors.GRPCClientUnaryErrorInterceptor,
 				)...,
 			),
 			grpc.WithChainStreamInterceptor(
 				append(cfg.StreamInterceptors,
-					//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-					// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-					otelgrpc.StreamClientInterceptor(),
 					metadata.StreamClientInterceptor,
 					interceptors.GRPCClientStreamErrorInterceptor,
 				)...,
 			),
+			grpc.WithDefaultCallOptions(
+				grpc.MaxCallRecvMsgSize(grpcutils.MaxClientRecvMsgSize()),
+			),
 		}, cfg.DialOpts...)...,
 	)
 	if err != nil {
@@ -337,11 +369,47 @@ func newGRPCClient(ctx context.Context, cfg *ClientConfig) (_ *Client, err error
 		return nil, trace.Wrap(err)
 	}
 
+	var relayGrpcConn *grpc.ClientConn
+	var relayTransport *transportv1.Client
+	if cfg.RelayAddress != "" {
+		relayCreds, err := cfg.relayCreds()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		cc, err := grpc.NewClient(cfg.RelayAddress,
+			grpc.WithTransportCredentials(relayCreds),
+			grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
+			grpc.WithChainUnaryInterceptor(
+				metadata.UnaryClientInterceptor,
+				interceptors.GRPCClientUnaryErrorInterceptor,
+			),
+			grpc.WithChainStreamInterceptor(
+				metadata.StreamClientInterceptor,
+				interceptors.GRPCClientStreamErrorInterceptor,
+			),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		r, err := transportv1.NewClient(transportv1pb.NewTransportServiceClient(cc))
+		if err != nil {
+			_ = cc.Close()
+			return nil, trace.Wrap(err)
+		}
+
+		relayGrpcConn = cc
+		relayTransport = r
+	}
+
 	return &Client{
 		cfg:         cfg,
 		grpcConn:    conn,
 		transport:   transport,
 		clusterName: c,
+
+		relayGrpcConn:  relayGrpcConn,
+		relayTransport: relayTransport,
 	}, nil
 }
 
@@ -362,6 +430,9 @@ func (c *Client) ClusterName() string {
 
 // Close attempts to close both the gRPC and SSH connections.
 func (c *Client) Close() error {
+	if c.relayGrpcConn != nil {
+		return trace.NewAggregate(c.relayGrpcConn.Close(), c.grpcConn.Close())
+	}
 	return trace.Wrap(c.grpcConn.Close())
 }
 
@@ -429,9 +500,13 @@ func (c *Client) ClientConfig(ctx context.Context, cluster string) (client.Confi
 // DialHost establishes a connection to the `target` in cluster named `cluster`. If a keyring
 // is provided it will only be forwarded if proxy recording mode is enabled in the cluster.
 func (c *Client) DialHost(ctx context.Context, target, cluster string, keyring agent.ExtendedAgent) (net.Conn, ClusterDetails, error) {
-	conn, details, err := c.transport.DialHost(ctx, target, cluster, nil, keyring)
+	conn, details, err := cmp.Or(c.relayTransport, c.transport).DialHost(ctx, target, cluster, nil, keyring)
 	if err != nil {
-		return nil, ClusterDetails{}, trace.ConnectionProblem(err, "failed connecting to host %s: %v", target, err)
+		host := target
+		if h, _, err := net.SplitHostPort(target); err == nil {
+			host = h
+		}
+		return nil, ClusterDetails{}, trace.ConnectionProblem(err, "failed connecting to host %s: %v", host, err)
 	}
 
 	return conn, ClusterDetails{FIPS: details.FipsEnabled}, nil
@@ -439,7 +514,7 @@ func (c *Client) DialHost(ctx context.Context, target, cluster string, keyring a
 
 // ClusterDetails retrieves cluster information as seen by the Proxy.
 func (c *Client) ClusterDetails(ctx context.Context) (ClusterDetails, error) {
-	details, err := c.transport.ClusterDetails(ctx)
+	details, err := cmp.Or(c.relayTransport, c.transport).ClusterDetails(ctx)
 	if err != nil {
 		return ClusterDetails{}, trace.Wrap(err)
 	}
@@ -463,7 +538,7 @@ func (c *Client) Ping(ctx context.Context) error {
 	// TODO(tross): Update to call Ping when it is added to the transport service.
 	// For now we don't really care what method is used we just want to measure
 	// how long it takes to get a reply.
-	_, _ = c.transport.ClusterDetails(ctx)
+	_, _ = cmp.Or(c.relayTransport, c.transport).ClusterDetails(ctx)
 	return nil
 }
 
diff --git a/api/client/proxy/transport/transportv1/client.go b/api/client/proxy/transport/transportv1/client.go
index 92d92fb59ebc3..eff9c30d485c4 100644
--- a/api/client/proxy/transport/transportv1/client.go
+++ b/api/client/proxy/transport/transportv1/client.go
@@ -245,7 +245,7 @@ func (c *Client) DialHost(ctx context.Context, hostport, cluster string, src net
 	stream, err := c.clt.ProxySSH(ctx)
 	if err != nil {
 		cancel()
-		return nil, nil, trace.Wrap(err, "unable to establish proxy stream")
+		return nil, nil, trace.Wrap(err, "opening proxy stream")
 	}
 
 	if err := stream.Send(&transportv1pb.ProxySSHRequest{DialTarget: &transportv1pb.TargetHost{
@@ -253,13 +253,13 @@ func (c *Client) DialHost(ctx context.Context, hostport, cluster string, src net
 		Cluster:  cluster,
 	}}); err != nil {
 		cancel()
-		return nil, nil, trace.Wrap(err, "failed to send dial target request")
+		return nil, nil, trace.Wrap(err, "sending dial target request")
 	}
 
 	resp, err := stream.Recv()
 	if err != nil {
 		cancel()
-		return nil, nil, trace.Wrap(err, "failed to receive cluster details response")
+		return nil, nil, trace.Wrap(err)
 	}
 
 	// create streams for ssh and agent protocol
diff --git a/api/client/proxy/transport/transportv1/client_test.go b/api/client/proxy/transport/transportv1/client_test.go
index 6cc7d8b835ba4..b69cdafaa0983 100644
--- a/api/client/proxy/transport/transportv1/client_test.go
+++ b/api/client/proxy/transport/transportv1/client_test.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"
@@ -269,13 +270,16 @@ func TestClient_DialHost(t *testing.T) {
 					return trail.ToGRPC(trace.Wrap(err))
 				}
 
-				// wait for the first ssh frame
+				// wait for the client to write some data
 				req, err = server.Recv()
 				if err != nil {
+					if errors.Is(err, io.EOF) {
+						return nil
+					}
 					return trail.ToGRPC(trace.Wrap(err))
 				}
 
-				// write too much data to terminate the stream
+				// echo the received payload back to the client
 				switch f := req.Frame.(type) {
 				case *transportv1pb.ProxySSHRequest_Ssh:
 					if err := server.Send(&transportv1pb.ProxySSHResponse{
@@ -287,7 +291,11 @@ func TestClient_DialHost(t *testing.T) {
 				case *transportv1pb.ProxySSHRequest_Agent:
 					return trail.ToGRPC(trace.BadParameter("test expects first frame to be ssh. got an agent frame"))
 				}
-				return nil
+
+				// wait for the client to reply again before exiting the handler
+				// to ensure that the client processed the echo.
+				_, err = server.Recv()
+				return trail.ToGRPC(trace.Wrap(err))
 			case req.DialTarget.Cluster == "forward":
 				// send the initial cluster details
 				if err := server.Send(&transportv1pb.ProxySSHResponse{Details: &transportv1pb.ClusterDetails{FipsEnabled: true}}); err != nil && !errors.Is(err, io.EOF) {
@@ -322,48 +330,53 @@ func TestClient_DialHost(t *testing.T) {
 					return trail.ToGRPC(trace.Wrap(err, "failed constructing ssh agent streamer"))
 				}
 
-				// read in agent frames
-				go func() {
-					for {
-						req, err := server.Recv()
-						if err != nil {
-							if errors.Is(err, io.EOF) {
-								return
-							}
+				// process agent frames
+				var eg errgroup.Group
+				eg.Go(func() error {
+					// create an agent that will communicate over the agent frames
+					// and list the keys from the client
+					clt := agent.NewClient(agentStreamRW)
+					keys, err := clt.List()
+					if err != nil {
+						return trail.ToGRPC(trace.Wrap(err))
+					}
 
-							return
-						}
+					if len(keys) != 1 {
+						return trail.ToGRPC(fmt.Errorf("expected to receive 1 key. got %v", len(keys)))
+					}
 
-						switch frame := req.Frame.(type) {
-						case *transportv1pb.ProxySSHRequest_Agent:
-							agentStream.incomingC <- frame.Agent.Payload
-						default:
-							continue
-						}
+					// send the key blob back via an ssh frame to alert the
+					// test that we finished listing keys
+					if err := server.Send(&transportv1pb.ProxySSHResponse{
+						Details: nil,
+						Frame:   &transportv1pb.ProxySSHResponse_Ssh{Ssh: &transportv1pb.Frame{Payload: keys[0].Blob}},
+					}); err != nil && !errors.Is(err, io.EOF) {
+						return trail.ToGRPC(trace.Wrap(err))
 					}
-				}()
 
-				// create an agent that will communicate over the agent frames
-				// and list the keys from the client
-				clt := agent.NewClient(agentStreamRW)
-				keys, err := clt.List()
-				if err != nil {
-					return trail.ToGRPC(trace.Wrap(err))
-				}
+					return nil
+				})
 
-				if len(keys) != 1 {
-					return trail.ToGRPC(fmt.Errorf("expected to receive 1 key. got %v", len(keys)))
-				}
+				for {
+					req, err := server.Recv()
+					switch {
+					case errors.Is(err, io.EOF):
+						if err := eg.Wait(); err != nil {
+							return trail.ToGRPC(trace.Wrap(err))
+						}
 
-				// send the key blob back via an ssh frame to alert the
-				// test that we finished listing keys
-				if err := server.Send(&transportv1pb.ProxySSHResponse{
-					Details: nil,
-					Frame:   &transportv1pb.ProxySSHResponse_Ssh{Ssh: &transportv1pb.Frame{Payload: keys[0].Blob}},
-				}); err != nil && !errors.Is(err, io.EOF) {
-					return trail.ToGRPC(trace.Wrap(err))
+						return nil
+					case err != nil:
+						return trace.Wrap(err)
+					}
+
+					switch frame := req.Frame.(type) {
+					case *transportv1pb.ProxySSHRequest_Agent:
+						agentStream.incomingC <- frame.Agent.Payload
+					default:
+						continue
+					}
 				}
-				return nil
 			default:
 				return trail.ToGRPC(trace.BadParameter("invalid cluster"))
 			}
@@ -425,17 +438,23 @@ func TestClient_DialHost(t *testing.T) {
 				require.NoError(t, err)
 				require.NotNil(t, conn)
 
+				// Write the message and expect it is echoed back.
 				msg := []byte("hello")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
 				require.Len(t, msg, n)
-
 				out := make([]byte, n)
 				n, err = conn.Read(out)
 				require.NoError(t, err)
 				require.Len(t, msg, n)
 				require.Equal(t, msg, out)
 
+				// Write the same message again to trigger the server to shut down.
+				n, err = conn.Write(msg)
+				require.NoError(t, err)
+				require.Len(t, msg, n)
+
+				// Expect subsequent reads result in an EOF.
 				n, err = conn.Read(out)
 				require.ErrorIs(t, err, io.EOF)
 				require.Zero(t, n)
@@ -473,7 +492,7 @@ func TestClient_DialHost(t *testing.T) {
 
 				// the server performs a remote list of keys
 				// via ssh frames. to prevent the test from terminating
-				// before it can complete it will write the blob of the
+				// before it can complete, it will write the blob of the
 				// listed key back on the ssh frame. verify that the key
 				// it received matches the one from out local keyring.
 				out = make([]byte, len(keys[0].Blob))
diff --git a/api/client/scim/scim.go b/api/client/scim/scim.go
index a0126d93499da..d587b79998a1c 100644
--- a/api/client/scim/scim.go
+++ b/api/client/scim/scim.go
@@ -83,3 +83,12 @@ func (c *Client) DeleteSCIMResource(ctx context.Context, req *scimpb.DeleteSCIMR
 	}
 	return res, nil
 }
+
+// PatchSCIMResource handles a request to patch a resource.
+func (c *Client) PatchSCIMResource(ctx context.Context, request *scimpb.PatchSCIMResourceRequest) (*scimpb.Resource, error) {
+	resp, err := c.grpcClient.PatchSCIMResource(ctx, request)
+	if err != nil {
+		return nil, trace.Wrap(err, "handling SCIM patch request")
+	}
+	return resp, nil
+}
diff --git a/api/client/scopes/access/client.go b/api/client/scopes/access/client.go
new file mode 100644
index 0000000000000..fa87499636f40
--- /dev/null
+++ b/api/client/scopes/access/client.go
@@ -0,0 +1,79 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package access
+
+import (
+	"context"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+)
+
+// Client is a scoped access client that conforms to the following lib/services interfaces:
+// * services.ScopedAccess
+type Client struct {
+	grpcClient scopedaccessv1.ScopedAccessServiceClient
+}
+
+// NewClient creates a new Access List client.
+func NewClient(grpcClient scopedaccessv1.ScopedAccessServiceClient) *Client {
+	return &Client{
+		grpcClient: grpcClient,
+	}
+}
+
+// GetScopedRole gets a scoped role by name.
+func (c *Client) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	return c.grpcClient.GetScopedRole(ctx, req)
+}
+
+// ListScopedRoles returns a paginated list of scoped roles.
+func (c *Client) ListScopedRoles(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	return c.grpcClient.ListScopedRoles(ctx, req)
+}
+
+// CreateScopedRole creates a new scoped role.
+func (c *Client) CreateScopedRole(ctx context.Context, req *scopedaccessv1.CreateScopedRoleRequest) (*scopedaccessv1.CreateScopedRoleResponse, error) {
+	return c.grpcClient.CreateScopedRole(ctx, req)
+}
+
+// UpdateScopedRole updates a scoped role.
+func (c *Client) UpdateScopedRole(ctx context.Context, req *scopedaccessv1.UpdateScopedRoleRequest) (*scopedaccessv1.UpdateScopedRoleResponse, error) {
+	return c.grpcClient.UpdateScopedRole(ctx, req)
+}
+
+// DeleteScopedRole deletes a scoped role.
+func (c *Client) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleRequest) (*scopedaccessv1.DeleteScopedRoleResponse, error) {
+	return c.grpcClient.DeleteScopedRole(ctx, req)
+}
+
+// GetScopedRoleAssignment gets a scoped role assignment by name.
+func (c *Client) GetScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error) {
+	return c.grpcClient.GetScopedRoleAssignment(ctx, req)
+}
+
+// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+func (c *Client) ListScopedRoleAssignments(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	return c.grpcClient.ListScopedRoleAssignments(ctx, req)
+}
+
+// CreateScopedRoleAssignment creates a new scoped role assignment.
+func (c *Client) CreateScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.CreateScopedRoleAssignmentRequest) (*scopedaccessv1.CreateScopedRoleAssignmentResponse, error) {
+	return c.grpcClient.CreateScopedRoleAssignment(ctx, req)
+}
+
+// DeleteScopedRoleAssignment deletes a scoped role assignment.
+func (c *Client) DeleteScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleAssignmentRequest) (*scopedaccessv1.DeleteScopedRoleAssignmentResponse, error) {
+	return c.grpcClient.DeleteScopedRoleAssignment(ctx, req)
+}
diff --git a/api/client/sessions.go b/api/client/sessions.go
index 6d835204a522f..8bad70f749cc9 100644
--- a/api/client/sessions.go
+++ b/api/client/sessions.go
@@ -20,11 +20,14 @@ import (
 	"context"
 	"errors"
 	"io"
+	"iter"
 
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/types/known/emptypb"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 )
 
 // GetWebSession returns the web session for the specified request.
@@ -119,29 +122,18 @@ type webSessions struct {
 	c *Client
 }
 
-// GetWebToken returns the web token for the specified request.
-// Implements ReadAccessPoint
+// GetWebToken returns the web token for the specified request
 func (c *Client) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
-	return c.WebTokens().Get(ctx, req)
-}
-
-// WebTokens returns the web tokens controller
-func (c *Client) WebTokens() types.WebTokenInterface {
-	return &webTokens{c: c}
-}
-
-// Get returns the web token for the specified request
-func (r *webTokens) Get(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
-	resp, err := r.c.grpc.GetWebToken(ctx, &req)
+	resp, err := c.grpc.GetWebToken(ctx, &req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return resp.Token, nil
 }
 
-// List returns the list of all web tokens
-func (r *webTokens) List(ctx context.Context) ([]types.WebToken, error) {
-	resp, err := r.c.grpc.GetWebTokens(ctx, &emptypb.Empty{})
+// GetWebTokens returns the list of all web tokens
+func (c *Client) GetWebTokens(ctx context.Context) ([]types.WebToken, error) {
+	resp, err := c.grpc.GetWebTokens(ctx, &emptypb.Empty{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -152,29 +144,82 @@ func (r *webTokens) List(ctx context.Context) ([]types.WebToken, error) {
 	return out, nil
 }
 
-// Upsert not implemented: can only be called locally.
-func (r *webTokens) Upsert(ctx context.Context, token types.WebToken) error {
+// ListWebTokens returns a page of web tokens
+func (c *Client) ListWebTokens(ctx context.Context, limit int, start string) ([]types.WebToken, string, error) {
+	resp, err := c.grpc.ListWebTokens(ctx, &proto.ListWebTokensRequest{
+		PageToken: start,
+		PageSize:  int32(limit),
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	tokens := make([]types.WebToken, 0, len(resp.Tokens))
+	for _, token := range resp.Tokens {
+		tokens = append(tokens, token)
+	}
+
+	return tokens, resp.NextPageToken, nil
+}
+
+// RangeWebTokens returns web tokens within the range [start, end).
+func (c *Client) RangeWebTokens(ctx context.Context, start, end string) iter.Seq2[types.WebToken, error] {
+	return clientutils.RangeResources(ctx, start, end, c.ListWebTokens, types.WebToken.GetName)
+}
+
+// UpsertWebToken not implemented: can only be called locally.
+func (c *Client) UpsertWebToken(ctx context.Context, token types.WebToken) error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
-// Delete deletes the web token specified with the request
-func (r *webTokens) Delete(ctx context.Context, req types.DeleteWebTokenRequest) error {
-	_, err := r.c.grpc.DeleteWebToken(ctx, &req)
+// DeleteWebToken deletes the web token specified with the request
+func (c *Client) DeleteWebToken(ctx context.Context, req types.DeleteWebTokenRequest) error {
+	_, err := c.grpc.DeleteWebToken(ctx, &req)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
-// DeleteAll deletes all web tokens
-func (r *webTokens) DeleteAll(ctx context.Context) error {
-	_, err := r.c.grpc.DeleteAllWebTokens(ctx, &emptypb.Empty{})
+// DeleteAllWebTokens deletes all web tokens
+func (c *Client) DeleteAllWebTokens(ctx context.Context) error {
+	_, err := c.grpc.DeleteAllWebTokens(ctx, &emptypb.Empty{})
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
+// WebTokens returns the web tokens controller
+func (c *Client) WebTokens() types.WebTokenInterface {
+	return &webTokens{c: c}
+}
+
+// Get returns the web token for the specified request
+func (r *webTokens) Get(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
+	return r.c.GetWebToken(ctx, req)
+}
+
+// List returns the list of all web tokens
+func (r *webTokens) List(ctx context.Context) ([]types.WebToken, error) {
+	return clientutils.CollectWithFallback(ctx, r.c.ListWebTokens, r.c.GetWebTokens)
+}
+
+// Upsert not implemented: can only be called locally.
+func (r *webTokens) Upsert(ctx context.Context, token types.WebToken) error {
+	return r.c.UpsertWebToken(ctx, token)
+}
+
+// Delete deletes the web token specified with the request
+func (r *webTokens) Delete(ctx context.Context, req types.DeleteWebTokenRequest) error {
+	return r.c.DeleteWebToken(ctx, req)
+}
+
+// DeleteAll deletes all web tokens
+func (r *webTokens) DeleteAll(ctx context.Context) error {
+	return r.c.DeleteAllWebTokens(ctx)
+}
+
 type webTokens struct {
 	c *Client
 }
diff --git a/api/client/userloginstate/userloginstate.go b/api/client/userloginstate/userloginstate.go
index fc328d5d7e3fc..f52ba39b22bb4 100644
--- a/api/client/userloginstate/userloginstate.go
+++ b/api/client/userloginstate/userloginstate.go
@@ -94,3 +94,23 @@ func (c *Client) DeleteAllUserLoginStates(ctx context.Context) error {
 	_, err := c.grpcClient.DeleteAllUserLoginStates(ctx, &userloginstatev1.DeleteAllUserLoginStatesRequest{})
 	return trace.Wrap(err)
 }
+
+// ListUserLoginStates returns a paginated list of user login state resources.
+func (c *Client) ListUserLoginStates(ctx context.Context, pageSize int, nextToken string) ([]*userloginstate.UserLoginState, string, error) {
+	resp, err := c.grpcClient.ListUserLoginStates(ctx, &userloginstatev1.ListUserLoginStatesRequest{
+		PageSize:  int32(pageSize),
+		PageToken: nextToken,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	out := make([]*userloginstate.UserLoginState, 0, len(resp.UserLoginStates))
+	for _, v := range resp.UserLoginStates {
+		item, err := conv.FromProto(v)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		out = append(out, item)
+	}
+	return out, resp.GetNextPageToken(), nil
+}
diff --git a/api/client/userloginstate/userloginstate_test.go b/api/client/userloginstate/userloginstate_test.go
index 7b9d0830e4835..0ed4164346acd 100644
--- a/api/client/userloginstate/userloginstate_test.go
+++ b/api/client/userloginstate/userloginstate_test.go
@@ -19,6 +19,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
@@ -29,6 +30,7 @@ import (
 	"github.com/gravitational/teleport/api/types/trait"
 	"github.com/gravitational/teleport/api/types/userloginstate"
 	conv "github.com/gravitational/teleport/api/types/userloginstate/convert/v1"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 )
 
 type mockClient struct {
@@ -74,7 +76,31 @@ func (m *mockClient) DeleteAllUserLoginStates(_ context.Context, in *userloginst
 	return nil, nil
 }
 
-func TestGetUserLoginStates(t *testing.T) {
+func (m *mockClient) ListUserLoginStates(ctx context.Context, in *userloginstatev1.ListUserLoginStatesRequest, opts ...grpc.CallOption) (*userloginstatev1.ListUserLoginStatesResponse, error) {
+	if in.PageSize != 1 {
+		return nil, trace.BadParameter("unsupported page size, expected 1, got %d", in.PageSize)
+	}
+	switch in.PageToken {
+	case "", "uls1":
+		return &userloginstatev1.ListUserLoginStatesResponse{
+			UserLoginStates: []*userloginstatev1.UserLoginState{newUserLoginStateProto(m.t, "uls1")},
+			NextPageToken:   "uls2",
+		}, nil
+	case "uls2":
+		return &userloginstatev1.ListUserLoginStatesResponse{
+			UserLoginStates: []*userloginstatev1.UserLoginState{newUserLoginStateProto(m.t, "uls2")},
+			NextPageToken:   "uls3",
+		}, nil
+	case "uls3":
+		return &userloginstatev1.ListUserLoginStatesResponse{
+			UserLoginStates: []*userloginstatev1.UserLoginState{newUserLoginStateProto(m.t, "uls3")},
+			NextPageToken:   "",
+		}, nil
+	}
+	return nil, trace.BadParameter("unsupported page token")
+}
+
+func TestGetListUserLoginStates(t *testing.T) {
 	t.Parallel()
 	mockClient := &mockClient{t: t}
 	client := NewClient(mockClient)
@@ -89,6 +115,20 @@ func TestGetUserLoginStates(t *testing.T) {
 		newUserLoginState(t, "uls2"),
 		newUserLoginState(t, "uls3"),
 	}, states))
+
+	t.Run("test list user login state with pagination", func(t *testing.T) {
+		var items []*userloginstate.UserLoginState
+		for item, err := range clientutils.ResourcesWithPageSize(context.Background(), client.ListUserLoginStates, 1) {
+			require.NoError(t, err)
+			items = append(items, item)
+		}
+
+		require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{
+			newUserLoginState(t, "uls1"),
+			newUserLoginState(t, "uls2"),
+			newUserLoginState(t, "uls3"),
+		}, items))
+	})
 }
 
 func TestGetUserLoginState(t *testing.T) {
diff --git a/api/client/webclient/webconfig.go b/api/client/webclient/webconfig.go
index 432995a7f2c96..e1de70d3859d5 100644
--- a/api/client/webclient/webconfig.go
+++ b/api/client/webclient/webconfig.go
@@ -26,13 +26,13 @@ const (
 	WebConfigAuthProviderOIDCType = "oidc"
 	// WebConfigAuthProviderOIDCURL is OIDC webapi endpoint.
 	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
-	WebConfigAuthProviderOIDCURL = "/v1/webapi/oidc/login/web?connector_id=:providerName&redirect_url=:redirect"
+	WebConfigAuthProviderOIDCURL = "/v1/webapi/oidc/login/web?connector_id=:providerName&login_hint=:loginHint?&redirect_url=:redirect"
 
 	// WebConfigAuthProviderSAMLType is SAML provider type
 	WebConfigAuthProviderSAMLType = "saml"
 	// WebConfigAuthProviderSAMLURL is SAML webapi endpoint.
 	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
-	WebConfigAuthProviderSAMLURL = "/v1/webapi/saml/sso?connector_id=:providerName&redirect_url=:redirect"
+	WebConfigAuthProviderSAMLURL = "/v1/webapi/saml/sso?connector_id=:providerName&login_hint=:loginHint?&redirect_url=:redirect"
 
 	// WebConfigAuthProviderGitHubType is GitHub provider type
 	WebConfigAuthProviderGitHubType = "github"
@@ -82,6 +82,9 @@ type WebConfig struct {
 	// PlayableDatabaseProtocols is a list of database protocols which session
 	// recordings can be played.
 	PlayableDatabaseProtocols []string `json:"playable_db_protocols"`
+	// SessionSummarizerEnabled indicates whether the session recording
+	// summarizer is configured.
+	SessionSummarizerEnabled bool `json:"sessionSummarizerEnabled,omitempty"`
 	// entitlements define a customer’s access to a specific features
 	Entitlements map[string]EntitlementInfo `json:"entitlements,omitempty"`
 
@@ -205,4 +208,6 @@ type WebConfigAuthSettings struct {
 	PrivateKeyPolicy keys.PrivateKeyPolicy `json:"privateKeyPolicy,omitempty"`
 	// MOTD is message of the day. MOTD is displayed to users before login.
 	MOTD string `json:"motd"`
+	// IdentifierFirstLoginEnabled is whether identifier-first login is enabled, this will be true if one or more auth connectors has a `user_matchers` field set.
+	IdentifierFirstLoginEnabled bool `json:"identifierFirstLoginEnabled,omitempty"`
 }
diff --git a/api/constants/constants.go b/api/constants/constants.go
index 918af99028fd2..22267566a4480 100644
--- a/api/constants/constants.go
+++ b/api/constants/constants.go
@@ -198,6 +198,20 @@ const (
 	OIDCPKCEModeDisabled OIDCPKCEMode = "disabled"
 )
 
+// OIDCRequestObjectMode represents the Request Object Mode of an OIDC Connector.
+type OIDCRequestObjectMode string
+
+const (
+	// OIDCRequestObjectModeUnknown indicates an unknown or uninitialized state of the request object mode.
+	OIDCRequestObjectModeUnknown OIDCRequestObjectMode = ""
+	// OIDCRequestObjectModeNone indicates that request objects should not be used. Parameters should be encoded
+	// into the URI of the authorization request.
+	OIDCRequestObjectModeNone OIDCRequestObjectMode = "none"
+	// OIDCRequestObjectModeSigned indicates that a signed (unencrypted) request object should be encoded into
+	// the URI of the authorization request.
+	OIDCRequestObjectModeSigned OIDCRequestObjectMode = "signed"
+)
+
 // SecondFactorType is the type of 2FA authentication.
 type SecondFactorType string
 
@@ -294,6 +308,10 @@ const (
 	// DeviceTrustModeRequired enforces the presence of device extensions for
 	// sensitive endpoints.
 	DeviceTrustModeRequired DeviceTrustMode = "required"
+	// DeviceTrustModeRequiredForHumans enforces the presence of device
+	// extensions for sensitive endpoints if the user is human. In this mode,
+	// bots are exempt from device trust checks.
+	DeviceTrustModeRequiredForHumans DeviceTrustMode = "required-for-humans"
 )
 
 const (
@@ -417,6 +435,13 @@ const (
 	// TraitGitHubOrgs is the name of the variable to specify the GitHub
 	// organizations for GitHub integration.
 	TraitGitHubOrgs = "github_orgs"
+	// TraitMCPTools is the name of the variable to specify the MCP tools for
+	// MCP servers.
+	TraitMCPTools = "mcp_tools"
+
+	// TraitDefaultRelayAddr is the trait used to specify the default relay
+	// address passed to clients at login time.
+	TraitDefaultRelayAddr = "default_relay_addr"
 )
 
 const (
@@ -527,6 +552,8 @@ const (
 	EnvVarTerraformIdentityFile = "TF_TELEPORT_IDENTITY_FILE"
 	// EnvVarTerraformIdentityFileBase64 is the environment variable containing the base64-encoded identity file used by the Terraform provider.
 	EnvVarTerraformIdentityFileBase64 = "TF_TELEPORT_IDENTITY_FILE_BASE64"
+	// EnvVarTerraformInsecure is the environment variable used to control whether the Terraform provider will skip verifying the proxy server's TLS certificate.
+	EnvVarTerraformInsecure = "TF_TELEPORT_INSECURE"
 	// EnvVarTerraformRetryBaseDuration is the environment variable configuring the base duration between two Terraform provider retries.
 	EnvVarTerraformRetryBaseDuration = "TF_TELEPORT_RETRY_BASE_DURATION"
 	// EnvVarTerraformRetryCapDuration is the environment variable configuring the maximum duration between two Terraform provider retries.
@@ -556,3 +583,7 @@ const MaxPIVPINCacheTTL = time.Hour
 // routine running in every auth server. Any report older than this period should
 // be considered stale.
 const AutoUpdateAgentReportPeriod = time.Minute
+
+// AutoUpdateBotInstanceReportPeriod is the period of the autoupdate bot instance
+// reporting routine.
+const AutoUpdateBotInstanceReportPeriod = time.Minute
diff --git a/api/fixtures/fixtures.go b/api/fixtures/fixtures.go
index 573e4d3c9f651..d888c4377e1ab 100644
--- a/api/fixtures/fixtures.go
+++ b/api/fixtures/fixtures.go
@@ -14,6 +14,10 @@
 
 package fixtures
 
+import (
+	"time"
+)
+
 const (
 	TLSCACertPEM = `-----BEGIN CERTIFICATE-----
 MIIDKjCCAhKgAwIBAgIQJtJDJZZBkg/afM8d2ZJCTjANBgkqhkiG9w0BAQsFADBA
@@ -62,3 +66,10 @@ LJxgC1GdoEz2ilXW802H9QrdKf9GPqxwi2TVzfO6pzWkdZcmbItu+QCCFz+co+r8
 +ki49FmlfbR5YVPN+8X40aLQB4xDkCHwRwTkrigzWQhIOv8NAhDA
 -----END RSA PRIVATE KEY-----`
 )
+
+var (
+	// TLSCACertNotBefore is the "Not before" date of TLSCACertPEM.
+	TLSCACertNotBefore = time.Date(2017, time.May, 9, 19, 40, 36, 0, time.UTC)
+	// TLSCACertNotAfter is the "Not after" date of TLSCACertPEM.
+	TLSCACertNotAfter = time.Date(2027, time.May, 7, 19, 40, 36, 0, time.UTC)
+)
diff --git a/api/gen/proto/go/teleport/accessgraph/v1/authorized_key.pb.go b/api/gen/proto/go/teleport/accessgraph/v1/authorized_key.pb.go
index dae73d25abf70..a0c910968da01 100644
--- a/api/gen/proto/go/teleport/accessgraph/v1/authorized_key.pb.go
+++ b/api/gen/proto/go/teleport/accessgraph/v1/authorized_key.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/authorized_key.proto
 
diff --git a/api/gen/proto/go/teleport/accessgraph/v1/private_key.pb.go b/api/gen/proto/go/teleport/accessgraph/v1/private_key.pb.go
index a38ec50649f19..deb2fdc5ea0e2 100644
--- a/api/gen/proto/go/teleport/accessgraph/v1/private_key.pb.go
+++ b/api/gen/proto/go/teleport/accessgraph/v1/private_key.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/private_key.proto
 
diff --git a/api/gen/proto/go/teleport/accessgraph/v1/secrets_service.pb.go b/api/gen/proto/go/teleport/accessgraph/v1/secrets_service.pb.go
index f9d3acbbf7f7a..fcef88b7667cf 100644
--- a/api/gen/proto/go/teleport/accessgraph/v1/secrets_service.pb.go
+++ b/api/gen/proto/go/teleport/accessgraph/v1/secrets_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/secrets_service.proto
 
diff --git a/api/gen/proto/go/teleport/accesslist/v1/accesslist.pb.go b/api/gen/proto/go/teleport/accesslist/v1/accesslist.pb.go
index 5bb613f074455..8c5906e946529 100644
--- a/api/gen/proto/go/teleport/accesslist/v1/accesslist.pb.go
+++ b/api/gen/proto/go/teleport/accesslist/v1/accesslist.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist.proto
 
@@ -411,7 +411,11 @@ type AccessListSpec struct {
 	// title is a plaintext short description of the Access List.
 	Title string `protobuf:"bytes,8,opt,name=title,proto3" json:"title,omitempty"`
 	// owner_grants describes the access granted by owners to this Access List.
-	OwnerGrants   *AccessListGrants `protobuf:"bytes,11,opt,name=owner_grants,json=ownerGrants,proto3" json:"owner_grants,omitempty"`
+	OwnerGrants *AccessListGrants `protobuf:"bytes,11,opt,name=owner_grants,json=ownerGrants,proto3" json:"owner_grants,omitempty"`
+	// type can be an empty string which denotes a regular Access List, "scim" which represents
+	// an Access List created from SCIM group or "static" for Access Lists managed by IaC
+	// tools.
+	Type          string `protobuf:"bytes,12,opt,name=type,proto3" json:"type,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -502,6 +506,13 @@ func (x *AccessListSpec) GetOwnerGrants() *AccessListGrants {
 	return nil
 }
 
+func (x *AccessListSpec) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
 // AccessListOwner is an owner of an Access List.
 type AccessListOwner struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1298,6 +1309,61 @@ func (x *CurrentUserAssignments) GetMembershipType() AccessListUserAssignmentTyp
 	return AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
 }
 
+// UserAssignments describes the requested user's ownership and membership assignment types in the access list.
+type UserAssignments struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ownership_type represents the requested user's ownership type (explicit, inherited, or none) in the access list.
+	OwnershipType AccessListUserAssignmentType `protobuf:"varint,1,opt,name=ownership_type,json=ownershipType,proto3,enum=teleport.accesslist.v1.AccessListUserAssignmentType" json:"ownership_type,omitempty"`
+	// membership_type represents the requested user's membership type (explicit, inherited, or none) in the access list.
+	MembershipType AccessListUserAssignmentType `protobuf:"varint,2,opt,name=membership_type,json=membershipType,proto3,enum=teleport.accesslist.v1.AccessListUserAssignmentType" json:"membership_type,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *UserAssignments) Reset() {
+	*x = UserAssignments{}
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UserAssignments) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserAssignments) ProtoMessage() {}
+
+func (x *UserAssignments) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserAssignments.ProtoReflect.Descriptor instead.
+func (*UserAssignments) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *UserAssignments) GetOwnershipType() AccessListUserAssignmentType {
+	if x != nil {
+		return x.OwnershipType
+	}
+	return AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
+}
+
+func (x *UserAssignments) GetMembershipType() AccessListUserAssignmentType {
+	if x != nil {
+		return x.MembershipType
+	}
+	return AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
+}
+
 // AccessListStatus contains dynamic fields calculated during retrieval.
 type AccessListStatus struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1311,13 +1377,15 @@ type AccessListStatus struct {
 	MemberOf []string `protobuf:"bytes,4,rep,name=member_of,json=memberOf,proto3" json:"member_of,omitempty"`
 	// current_user_assignments describes the current user's ownership and membership status in the access list.
 	CurrentUserAssignments *CurrentUserAssignments `protobuf:"bytes,5,opt,name=current_user_assignments,json=currentUserAssignments,proto3" json:"current_user_assignments,omitempty"`
-	unknownFields          protoimpl.UnknownFields
-	sizeCache              protoimpl.SizeCache
+	// user_assignments describes the requested user's ownership and membership assignment types in the access list.
+	UserAssignments *UserAssignments `protobuf:"bytes,6,opt,name=user_assignments,json=userAssignments,proto3" json:"user_assignments,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *AccessListStatus) Reset() {
 	*x = AccessListStatus{}
-	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[14]
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1329,7 +1397,7 @@ func (x *AccessListStatus) String() string {
 func (*AccessListStatus) ProtoMessage() {}
 
 func (x *AccessListStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[14]
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1342,7 +1410,7 @@ func (x *AccessListStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListStatus.ProtoReflect.Descriptor instead.
 func (*AccessListStatus) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{14}
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *AccessListStatus) GetMemberCount() uint32 {
@@ -1380,6 +1448,13 @@ func (x *AccessListStatus) GetCurrentUserAssignments() *CurrentUserAssignments {
 	return nil
 }
 
+func (x *AccessListStatus) GetUserAssignments() *UserAssignments {
+	if x != nil {
+		return x.UserAssignments
+	}
+	return nil
+}
+
 var File_teleport_accesslist_v1_accesslist_proto protoreflect.FileDescriptor
 
 const file_teleport_accesslist_v1_accesslist_proto_rawDesc = "" +
@@ -1389,7 +1464,7 @@ const file_teleport_accesslist_v1_accesslist_proto_rawDesc = "" +
 	"AccessList\x12:\n" +
 	"\x06header\x18\x01 \x01(\v2\".teleport.header.v1.ResourceHeaderR\x06header\x12:\n" +
 	"\x04spec\x18\x02 \x01(\v2&.teleport.accesslist.v1.AccessListSpecR\x04spec\x12@\n" +
-	"\x06status\x18\x03 \x01(\v2(.teleport.accesslist.v1.AccessListStatusR\x06status\"\xc1\x04\n" +
+	"\x06status\x18\x03 \x01(\v2(.teleport.accesslist.v1.AccessListStatusR\x06status\"\xd5\x04\n" +
 	"\x0eAccessListSpec\x12 \n" +
 	"\vdescription\x18\x01 \x01(\tR\vdescription\x12?\n" +
 	"\x06owners\x18\x02 \x03(\v2'.teleport.accesslist.v1.AccessListOwnerR\x06owners\x12=\n" +
@@ -1398,7 +1473,8 @@ const file_teleport_accesslist_v1_accesslist_proto_rawDesc = "" +
 	"\x12ownership_requires\x18\x05 \x01(\v2*.teleport.accesslist.v1.AccessListRequiresR\x11ownershipRequires\x12@\n" +
 	"\x06grants\x18\x06 \x01(\v2(.teleport.accesslist.v1.AccessListGrantsR\x06grants\x12\x14\n" +
 	"\x05title\x18\b \x01(\tR\x05title\x12K\n" +
-	"\fowner_grants\x18\v \x01(\v2(.teleport.accesslist.v1.AccessListGrantsR\vownerGrantsJ\x04\b\a\x10\bJ\x04\b\t\x10\n" +
+	"\fowner_grants\x18\v \x01(\v2(.teleport.accesslist.v1.AccessListGrantsR\vownerGrants\x12\x12\n" +
+	"\x04type\x18\f \x01(\tR\x04typeJ\x04\b\a\x10\bJ\x04\b\t\x10\n" +
 	"J\x04\b\n" +
 	"\x10\vR\amembersR\n" +
 	"membershipR\townership\"\xef\x01\n" +
@@ -1460,13 +1536,17 @@ const file_teleport_accesslist_v1_accesslist_proto_rawDesc = "" +
 	"\x1breview_day_of_month_changed\x18\x05 \x01(\x0e2(.teleport.accesslist.v1.ReviewDayOfMonthR\x17reviewDayOfMonthChangedJ\x04\b\x01\x10\x02R\x11frequency_changed\"\xd4\x01\n" +
 	"\x16CurrentUserAssignments\x12[\n" +
 	"\x0eownership_type\x18\x01 \x01(\x0e24.teleport.accesslist.v1.AccessListUserAssignmentTypeR\rownershipType\x12]\n" +
-	"\x0fmembership_type\x18\x02 \x01(\x0e24.teleport.accesslist.v1.AccessListUserAssignmentTypeR\x0emembershipType\"\xb4\x02\n" +
+	"\x0fmembership_type\x18\x02 \x01(\x0e24.teleport.accesslist.v1.AccessListUserAssignmentTypeR\x0emembershipType\"\xcd\x01\n" +
+	"\x0fUserAssignments\x12[\n" +
+	"\x0eownership_type\x18\x01 \x01(\x0e24.teleport.accesslist.v1.AccessListUserAssignmentTypeR\rownershipType\x12]\n" +
+	"\x0fmembership_type\x18\x02 \x01(\x0e24.teleport.accesslist.v1.AccessListUserAssignmentTypeR\x0emembershipType\"\x88\x03\n" +
 	"\x10AccessListStatus\x12&\n" +
 	"\fmember_count\x18\x01 \x01(\rH\x00R\vmemberCount\x88\x01\x01\x12/\n" +
 	"\x11member_list_count\x18\x02 \x01(\rH\x01R\x0fmemberListCount\x88\x01\x01\x12\x19\n" +
 	"\bowner_of\x18\x03 \x03(\tR\aownerOf\x12\x1b\n" +
 	"\tmember_of\x18\x04 \x03(\tR\bmemberOf\x12h\n" +
-	"\x18current_user_assignments\x18\x05 \x01(\v2..teleport.accesslist.v1.CurrentUserAssignmentsR\x16currentUserAssignmentsB\x0f\n" +
+	"\x18current_user_assignments\x18\x05 \x01(\v2..teleport.accesslist.v1.CurrentUserAssignmentsR\x16currentUserAssignments\x12R\n" +
+	"\x10user_assignments\x18\x06 \x01(\v2'.teleport.accesslist.v1.UserAssignmentsR\x0fuserAssignmentsB\x0f\n" +
 	"\r_member_countB\x14\n" +
 	"\x12_member_list_count*\xb6\x01\n" +
 	"\x0fReviewFrequency\x12 \n" +
@@ -1508,7 +1588,7 @@ func file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP() []byte {
 }
 
 var file_teleport_accesslist_v1_accesslist_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_teleport_accesslist_v1_accesslist_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_teleport_accesslist_v1_accesslist_proto_msgTypes = make([]protoimpl.MessageInfo, 16)
 var file_teleport_accesslist_v1_accesslist_proto_goTypes = []any{
 	(ReviewFrequency)(0),              // 0: teleport.accesslist.v1.ReviewFrequency
 	(ReviewDayOfMonth)(0),             // 1: teleport.accesslist.v1.ReviewDayOfMonth
@@ -1529,16 +1609,17 @@ var file_teleport_accesslist_v1_accesslist_proto_goTypes = []any{
 	(*ReviewSpec)(nil),                // 16: teleport.accesslist.v1.ReviewSpec
 	(*ReviewChanges)(nil),             // 17: teleport.accesslist.v1.ReviewChanges
 	(*CurrentUserAssignments)(nil),    // 18: teleport.accesslist.v1.CurrentUserAssignments
-	(*AccessListStatus)(nil),          // 19: teleport.accesslist.v1.AccessListStatus
-	(*v1.ResourceHeader)(nil),         // 20: teleport.header.v1.ResourceHeader
-	(*timestamppb.Timestamp)(nil),     // 21: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),       // 22: google.protobuf.Duration
-	(*v11.Trait)(nil),                 // 23: teleport.trait.v1.Trait
+	(*UserAssignments)(nil),           // 19: teleport.accesslist.v1.UserAssignments
+	(*AccessListStatus)(nil),          // 20: teleport.accesslist.v1.AccessListStatus
+	(*v1.ResourceHeader)(nil),         // 21: teleport.header.v1.ResourceHeader
+	(*timestamppb.Timestamp)(nil),     // 22: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),       // 23: google.protobuf.Duration
+	(*v11.Trait)(nil),                 // 24: teleport.trait.v1.Trait
 }
 var file_teleport_accesslist_v1_accesslist_proto_depIdxs = []int32{
-	20, // 0: teleport.accesslist.v1.AccessList.header:type_name -> teleport.header.v1.ResourceHeader
+	21, // 0: teleport.accesslist.v1.AccessList.header:type_name -> teleport.header.v1.ResourceHeader
 	6,  // 1: teleport.accesslist.v1.AccessList.spec:type_name -> teleport.accesslist.v1.AccessListSpec
-	19, // 2: teleport.accesslist.v1.AccessList.status:type_name -> teleport.accesslist.v1.AccessListStatus
+	20, // 2: teleport.accesslist.v1.AccessList.status:type_name -> teleport.accesslist.v1.AccessListStatus
 	7,  // 3: teleport.accesslist.v1.AccessListSpec.owners:type_name -> teleport.accesslist.v1.AccessListOwner
 	8,  // 4: teleport.accesslist.v1.AccessListSpec.audit:type_name -> teleport.accesslist.v1.AccessListAudit
 	11, // 5: teleport.accesslist.v1.AccessListSpec.membership_requires:type_name -> teleport.accesslist.v1.AccessListRequires
@@ -1547,35 +1628,38 @@ var file_teleport_accesslist_v1_accesslist_proto_depIdxs = []int32{
 	12, // 8: teleport.accesslist.v1.AccessListSpec.owner_grants:type_name -> teleport.accesslist.v1.AccessListGrants
 	3,  // 9: teleport.accesslist.v1.AccessListOwner.ineligible_status:type_name -> teleport.accesslist.v1.IneligibleStatus
 	2,  // 10: teleport.accesslist.v1.AccessListOwner.membership_kind:type_name -> teleport.accesslist.v1.MembershipKind
-	21, // 11: teleport.accesslist.v1.AccessListAudit.next_audit_date:type_name -> google.protobuf.Timestamp
+	22, // 11: teleport.accesslist.v1.AccessListAudit.next_audit_date:type_name -> google.protobuf.Timestamp
 	9,  // 12: teleport.accesslist.v1.AccessListAudit.recurrence:type_name -> teleport.accesslist.v1.Recurrence
 	10, // 13: teleport.accesslist.v1.AccessListAudit.notifications:type_name -> teleport.accesslist.v1.Notifications
 	0,  // 14: teleport.accesslist.v1.Recurrence.frequency:type_name -> teleport.accesslist.v1.ReviewFrequency
 	1,  // 15: teleport.accesslist.v1.Recurrence.day_of_month:type_name -> teleport.accesslist.v1.ReviewDayOfMonth
-	22, // 16: teleport.accesslist.v1.Notifications.start:type_name -> google.protobuf.Duration
-	23, // 17: teleport.accesslist.v1.AccessListRequires.traits:type_name -> teleport.trait.v1.Trait
-	23, // 18: teleport.accesslist.v1.AccessListGrants.traits:type_name -> teleport.trait.v1.Trait
-	20, // 19: teleport.accesslist.v1.Member.header:type_name -> teleport.header.v1.ResourceHeader
+	23, // 16: teleport.accesslist.v1.Notifications.start:type_name -> google.protobuf.Duration
+	24, // 17: teleport.accesslist.v1.AccessListRequires.traits:type_name -> teleport.trait.v1.Trait
+	24, // 18: teleport.accesslist.v1.AccessListGrants.traits:type_name -> teleport.trait.v1.Trait
+	21, // 19: teleport.accesslist.v1.Member.header:type_name -> teleport.header.v1.ResourceHeader
 	14, // 20: teleport.accesslist.v1.Member.spec:type_name -> teleport.accesslist.v1.MemberSpec
-	21, // 21: teleport.accesslist.v1.MemberSpec.joined:type_name -> google.protobuf.Timestamp
-	21, // 22: teleport.accesslist.v1.MemberSpec.expires:type_name -> google.protobuf.Timestamp
+	22, // 21: teleport.accesslist.v1.MemberSpec.joined:type_name -> google.protobuf.Timestamp
+	22, // 22: teleport.accesslist.v1.MemberSpec.expires:type_name -> google.protobuf.Timestamp
 	3,  // 23: teleport.accesslist.v1.MemberSpec.ineligible_status:type_name -> teleport.accesslist.v1.IneligibleStatus
 	2,  // 24: teleport.accesslist.v1.MemberSpec.membership_kind:type_name -> teleport.accesslist.v1.MembershipKind
-	20, // 25: teleport.accesslist.v1.Review.header:type_name -> teleport.header.v1.ResourceHeader
+	21, // 25: teleport.accesslist.v1.Review.header:type_name -> teleport.header.v1.ResourceHeader
 	16, // 26: teleport.accesslist.v1.Review.spec:type_name -> teleport.accesslist.v1.ReviewSpec
-	21, // 27: teleport.accesslist.v1.ReviewSpec.review_date:type_name -> google.protobuf.Timestamp
+	22, // 27: teleport.accesslist.v1.ReviewSpec.review_date:type_name -> google.protobuf.Timestamp
 	17, // 28: teleport.accesslist.v1.ReviewSpec.changes:type_name -> teleport.accesslist.v1.ReviewChanges
 	11, // 29: teleport.accesslist.v1.ReviewChanges.membership_requirements_changed:type_name -> teleport.accesslist.v1.AccessListRequires
 	0,  // 30: teleport.accesslist.v1.ReviewChanges.review_frequency_changed:type_name -> teleport.accesslist.v1.ReviewFrequency
 	1,  // 31: teleport.accesslist.v1.ReviewChanges.review_day_of_month_changed:type_name -> teleport.accesslist.v1.ReviewDayOfMonth
 	4,  // 32: teleport.accesslist.v1.CurrentUserAssignments.ownership_type:type_name -> teleport.accesslist.v1.AccessListUserAssignmentType
 	4,  // 33: teleport.accesslist.v1.CurrentUserAssignments.membership_type:type_name -> teleport.accesslist.v1.AccessListUserAssignmentType
-	18, // 34: teleport.accesslist.v1.AccessListStatus.current_user_assignments:type_name -> teleport.accesslist.v1.CurrentUserAssignments
-	35, // [35:35] is the sub-list for method output_type
-	35, // [35:35] is the sub-list for method input_type
-	35, // [35:35] is the sub-list for extension type_name
-	35, // [35:35] is the sub-list for extension extendee
-	0,  // [0:35] is the sub-list for field type_name
+	4,  // 34: teleport.accesslist.v1.UserAssignments.ownership_type:type_name -> teleport.accesslist.v1.AccessListUserAssignmentType
+	4,  // 35: teleport.accesslist.v1.UserAssignments.membership_type:type_name -> teleport.accesslist.v1.AccessListUserAssignmentType
+	18, // 36: teleport.accesslist.v1.AccessListStatus.current_user_assignments:type_name -> teleport.accesslist.v1.CurrentUserAssignments
+	19, // 37: teleport.accesslist.v1.AccessListStatus.user_assignments:type_name -> teleport.accesslist.v1.UserAssignments
+	38, // [38:38] is the sub-list for method output_type
+	38, // [38:38] is the sub-list for method input_type
+	38, // [38:38] is the sub-list for extension type_name
+	38, // [38:38] is the sub-list for extension extendee
+	0,  // [0:38] is the sub-list for field type_name
 }
 
 func init() { file_teleport_accesslist_v1_accesslist_proto_init() }
@@ -1583,14 +1667,14 @@ func file_teleport_accesslist_v1_accesslist_proto_init() {
 	if File_teleport_accesslist_v1_accesslist_proto != nil {
 		return
 	}
-	file_teleport_accesslist_v1_accesslist_proto_msgTypes[14].OneofWrappers = []any{}
+	file_teleport_accesslist_v1_accesslist_proto_msgTypes[15].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_accesslist_v1_accesslist_proto_rawDesc), len(file_teleport_accesslist_v1_accesslist_proto_rawDesc)),
 			NumEnums:      5,
-			NumMessages:   15,
+			NumMessages:   16,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service.pb.go b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service.pb.go
index 97894b571bf44..2b79fee1ecb43 100644
--- a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service.pb.go
+++ b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist_service.proto
 
@@ -231,6 +231,207 @@ func (x *ListAccessListsResponse) GetNextToken() string {
 	return ""
 }
 
+// ListAccessListsV2Request is the request for getting filtered and sorted paginated access lists.
+type ListAccessListsV2Request struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// page_size is the size of the page to request.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// page_token is the token to begin the next page with.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// sort_by specifies the sort order for the results.
+	SortBy *types.SortBy `protobuf:"bytes,3,opt,name=sort_by,json=sortBy,proto3" json:"sort_by,omitempty"`
+	// filter is a collection of fields to filter access lists.
+	Filter        *AccessListsFilter `protobuf:"bytes,4,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAccessListsV2Request) Reset() {
+	*x = ListAccessListsV2Request{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAccessListsV2Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAccessListsV2Request) ProtoMessage() {}
+
+func (x *ListAccessListsV2Request) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAccessListsV2Request.ProtoReflect.Descriptor instead.
+func (*ListAccessListsV2Request) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListAccessListsV2Request) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListAccessListsV2Request) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListAccessListsV2Request) GetSortBy() *types.SortBy {
+	if x != nil {
+		return x.SortBy
+	}
+	return nil
+}
+
+func (x *ListAccessListsV2Request) GetFilter() *AccessListsFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// AccessListsFilter is used to collect filter options for listing access lists.
+type AccessListsFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// search is a search term to filter access lists by name.
+	Search string `protobuf:"bytes,1,opt,name=search,proto3" json:"search,omitempty"`
+	// owners indicates returned access lists should be owned by one of the provider owners
+	Owners []string `protobuf:"bytes,2,rep,name=owners,proto3" json:"owners,omitempty"`
+	// roles indicates returned access lists should great one of the provider roles
+	Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
+	// origin is origin of the resource
+	Origin        string `protobuf:"bytes,4,opt,name=origin,proto3" json:"origin,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AccessListsFilter) Reset() {
+	*x = AccessListsFilter{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AccessListsFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListsFilter) ProtoMessage() {}
+
+func (x *AccessListsFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListsFilter.ProtoReflect.Descriptor instead.
+func (*AccessListsFilter) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *AccessListsFilter) GetSearch() string {
+	if x != nil {
+		return x.Search
+	}
+	return ""
+}
+
+func (x *AccessListsFilter) GetOwners() []string {
+	if x != nil {
+		return x.Owners
+	}
+	return nil
+}
+
+func (x *AccessListsFilter) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *AccessListsFilter) GetOrigin() string {
+	if x != nil {
+		return x.Origin
+	}
+	return ""
+}
+
+// ListAccessListsV2Response is the response for getting paginated access lists.
+type ListAccessListsV2Response struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// access_lists is the list of access lists.
+	AccessLists []*AccessList `protobuf:"bytes,1,rep,name=access_lists,json=accessLists,proto3" json:"access_lists,omitempty"`
+	// next_page_token is the next page token.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAccessListsV2Response) Reset() {
+	*x = ListAccessListsV2Response{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAccessListsV2Response) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAccessListsV2Response) ProtoMessage() {}
+
+func (x *ListAccessListsV2Response) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAccessListsV2Response.ProtoReflect.Descriptor instead.
+func (*ListAccessListsV2Response) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ListAccessListsV2Response) GetAccessLists() []*AccessList {
+	if x != nil {
+		return x.AccessLists
+	}
+	return nil
+}
+
+func (x *ListAccessListsV2Response) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 // GetInheritedGrantsRequest is the request for getting inherited grants.
 type GetInheritedGrantsRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -242,7 +443,7 @@ type GetInheritedGrantsRequest struct {
 
 func (x *GetInheritedGrantsRequest) Reset() {
 	*x = GetInheritedGrantsRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[4]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -254,7 +455,7 @@ func (x *GetInheritedGrantsRequest) String() string {
 func (*GetInheritedGrantsRequest) ProtoMessage() {}
 
 func (x *GetInheritedGrantsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[4]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -267,7 +468,7 @@ func (x *GetInheritedGrantsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetInheritedGrantsRequest.ProtoReflect.Descriptor instead.
 func (*GetInheritedGrantsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{4}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *GetInheritedGrantsRequest) GetAccessListId() string {
@@ -288,7 +489,7 @@ type GetInheritedGrantsResponse struct {
 
 func (x *GetInheritedGrantsResponse) Reset() {
 	*x = GetInheritedGrantsResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[5]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -300,7 +501,7 @@ func (x *GetInheritedGrantsResponse) String() string {
 func (*GetInheritedGrantsResponse) ProtoMessage() {}
 
 func (x *GetInheritedGrantsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[5]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -313,7 +514,7 @@ func (x *GetInheritedGrantsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetInheritedGrantsResponse.ProtoReflect.Descriptor instead.
 func (*GetInheritedGrantsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{5}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *GetInheritedGrantsResponse) GetGrants() *AccessListGrants {
@@ -334,7 +535,7 @@ type GetAccessListRequest struct {
 
 func (x *GetAccessListRequest) Reset() {
 	*x = GetAccessListRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[6]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -346,7 +547,7 @@ func (x *GetAccessListRequest) String() string {
 func (*GetAccessListRequest) ProtoMessage() {}
 
 func (x *GetAccessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[6]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -359,7 +560,7 @@ func (x *GetAccessListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessListRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{6}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *GetAccessListRequest) GetName() string {
@@ -380,7 +581,7 @@ type UpsertAccessListRequest struct {
 
 func (x *UpsertAccessListRequest) Reset() {
 	*x = UpsertAccessListRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[7]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -392,7 +593,7 @@ func (x *UpsertAccessListRequest) String() string {
 func (*UpsertAccessListRequest) ProtoMessage() {}
 
 func (x *UpsertAccessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[7]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -405,7 +606,7 @@ func (x *UpsertAccessListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpsertAccessListRequest.ProtoReflect.Descriptor instead.
 func (*UpsertAccessListRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{7}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *UpsertAccessListRequest) GetAccessList() *AccessList {
@@ -426,7 +627,7 @@ type UpdateAccessListRequest struct {
 
 func (x *UpdateAccessListRequest) Reset() {
 	*x = UpdateAccessListRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[8]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -438,7 +639,7 @@ func (x *UpdateAccessListRequest) String() string {
 func (*UpdateAccessListRequest) ProtoMessage() {}
 
 func (x *UpdateAccessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[8]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -451,7 +652,7 @@ func (x *UpdateAccessListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateAccessListRequest.ProtoReflect.Descriptor instead.
 func (*UpdateAccessListRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{8}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *UpdateAccessListRequest) GetAccessList() *AccessList {
@@ -472,7 +673,7 @@ type DeleteAccessListRequest struct {
 
 func (x *DeleteAccessListRequest) Reset() {
 	*x = DeleteAccessListRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[9]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -484,7 +685,7 @@ func (x *DeleteAccessListRequest) String() string {
 func (*DeleteAccessListRequest) ProtoMessage() {}
 
 func (x *DeleteAccessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[9]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -497,7 +698,7 @@ func (x *DeleteAccessListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteAccessListRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAccessListRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{9}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *DeleteAccessListRequest) GetName() string {
@@ -516,7 +717,7 @@ type DeleteAllAccessListsRequest struct {
 
 func (x *DeleteAllAccessListsRequest) Reset() {
 	*x = DeleteAllAccessListsRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[10]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -528,7 +729,7 @@ func (x *DeleteAllAccessListsRequest) String() string {
 func (*DeleteAllAccessListsRequest) ProtoMessage() {}
 
 func (x *DeleteAllAccessListsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[10]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -541,7 +742,7 @@ func (x *DeleteAllAccessListsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteAllAccessListsRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAllAccessListsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{10}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{13}
 }
 
 // GetAccessListsToReviewRequest is the request for getting access lists that
@@ -554,7 +755,7 @@ type GetAccessListsToReviewRequest struct {
 
 func (x *GetAccessListsToReviewRequest) Reset() {
 	*x = GetAccessListsToReviewRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[11]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -566,7 +767,7 @@ func (x *GetAccessListsToReviewRequest) String() string {
 func (*GetAccessListsToReviewRequest) ProtoMessage() {}
 
 func (x *GetAccessListsToReviewRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[11]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -579,7 +780,7 @@ func (x *GetAccessListsToReviewRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListsToReviewRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessListsToReviewRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{11}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{14}
 }
 
 // GetAccessListsToReviewResponse is the response for getting access lists that
@@ -593,7 +794,7 @@ type GetAccessListsToReviewResponse struct {
 
 func (x *GetAccessListsToReviewResponse) Reset() {
 	*x = GetAccessListsToReviewResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[12]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -605,7 +806,7 @@ func (x *GetAccessListsToReviewResponse) String() string {
 func (*GetAccessListsToReviewResponse) ProtoMessage() {}
 
 func (x *GetAccessListsToReviewResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[12]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -618,7 +819,7 @@ func (x *GetAccessListsToReviewResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListsToReviewResponse.ProtoReflect.Descriptor instead.
 func (*GetAccessListsToReviewResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{12}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *GetAccessListsToReviewResponse) GetAccessLists() []*AccessList {
@@ -640,7 +841,7 @@ type CountAccessListMembersRequest struct {
 
 func (x *CountAccessListMembersRequest) Reset() {
 	*x = CountAccessListMembersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[13]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -652,7 +853,7 @@ func (x *CountAccessListMembersRequest) String() string {
 func (*CountAccessListMembersRequest) ProtoMessage() {}
 
 func (x *CountAccessListMembersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[13]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -665,7 +866,7 @@ func (x *CountAccessListMembersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CountAccessListMembersRequest.ProtoReflect.Descriptor instead.
 func (*CountAccessListMembersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{13}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *CountAccessListMembersRequest) GetAccessListName() string {
@@ -689,7 +890,7 @@ type CountAccessListMembersResponse struct {
 
 func (x *CountAccessListMembersResponse) Reset() {
 	*x = CountAccessListMembersResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[14]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -701,7 +902,7 @@ func (x *CountAccessListMembersResponse) String() string {
 func (*CountAccessListMembersResponse) ProtoMessage() {}
 
 func (x *CountAccessListMembersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[14]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -714,7 +915,7 @@ func (x *CountAccessListMembersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CountAccessListMembersResponse.ProtoReflect.Descriptor instead.
 func (*CountAccessListMembersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{14}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *CountAccessListMembersResponse) GetCount() uint32 {
@@ -747,7 +948,7 @@ type ListAccessListMembersRequest struct {
 
 func (x *ListAccessListMembersRequest) Reset() {
 	*x = ListAccessListMembersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[15]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -759,7 +960,7 @@ func (x *ListAccessListMembersRequest) String() string {
 func (*ListAccessListMembersRequest) ProtoMessage() {}
 
 func (x *ListAccessListMembersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[15]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -772,7 +973,7 @@ func (x *ListAccessListMembersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAccessListMembersRequest.ProtoReflect.Descriptor instead.
 func (*ListAccessListMembersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{15}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ListAccessListMembersRequest) GetPageSize() int32 {
@@ -810,7 +1011,7 @@ type ListAccessListMembersResponse struct {
 
 func (x *ListAccessListMembersResponse) Reset() {
 	*x = ListAccessListMembersResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[16]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -822,7 +1023,7 @@ func (x *ListAccessListMembersResponse) String() string {
 func (*ListAccessListMembersResponse) ProtoMessage() {}
 
 func (x *ListAccessListMembersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[16]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -835,7 +1036,7 @@ func (x *ListAccessListMembersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAccessListMembersResponse.ProtoReflect.Descriptor instead.
 func (*ListAccessListMembersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{16}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *ListAccessListMembersResponse) GetMembers() []*Member {
@@ -866,7 +1067,7 @@ type ListAllAccessListMembersRequest struct {
 
 func (x *ListAllAccessListMembersRequest) Reset() {
 	*x = ListAllAccessListMembersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[17]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -878,7 +1079,7 @@ func (x *ListAllAccessListMembersRequest) String() string {
 func (*ListAllAccessListMembersRequest) ProtoMessage() {}
 
 func (x *ListAllAccessListMembersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[17]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -891,7 +1092,7 @@ func (x *ListAllAccessListMembersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAllAccessListMembersRequest.ProtoReflect.Descriptor instead.
 func (*ListAllAccessListMembersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{17}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ListAllAccessListMembersRequest) GetPageSize() int32 {
@@ -922,7 +1123,7 @@ type ListAllAccessListMembersResponse struct {
 
 func (x *ListAllAccessListMembersResponse) Reset() {
 	*x = ListAllAccessListMembersResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[18]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -934,7 +1135,7 @@ func (x *ListAllAccessListMembersResponse) String() string {
 func (*ListAllAccessListMembersResponse) ProtoMessage() {}
 
 func (x *ListAllAccessListMembersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[18]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -947,7 +1148,7 @@ func (x *ListAllAccessListMembersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAllAccessListMembersResponse.ProtoReflect.Descriptor instead.
 func (*ListAllAccessListMembersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{18}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *ListAllAccessListMembersResponse) GetMembers() []*Member {
@@ -978,7 +1179,7 @@ type UpsertAccessListWithMembersRequest struct {
 
 func (x *UpsertAccessListWithMembersRequest) Reset() {
 	*x = UpsertAccessListWithMembersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[19]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -990,7 +1191,7 @@ func (x *UpsertAccessListWithMembersRequest) String() string {
 func (*UpsertAccessListWithMembersRequest) ProtoMessage() {}
 
 func (x *UpsertAccessListWithMembersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[19]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1003,7 +1204,7 @@ func (x *UpsertAccessListWithMembersRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UpsertAccessListWithMembersRequest.ProtoReflect.Descriptor instead.
 func (*UpsertAccessListWithMembersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{19}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *UpsertAccessListWithMembersRequest) GetAccessList() *AccessList {
@@ -1034,7 +1235,7 @@ type UpsertAccessListWithMembersResponse struct {
 
 func (x *UpsertAccessListWithMembersResponse) Reset() {
 	*x = UpsertAccessListWithMembersResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[20]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1046,7 +1247,7 @@ func (x *UpsertAccessListWithMembersResponse) String() string {
 func (*UpsertAccessListWithMembersResponse) ProtoMessage() {}
 
 func (x *UpsertAccessListWithMembersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[20]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1059,7 +1260,7 @@ func (x *UpsertAccessListWithMembersResponse) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use UpsertAccessListWithMembersResponse.ProtoReflect.Descriptor instead.
 func (*UpsertAccessListWithMembersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{20}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *UpsertAccessListWithMembersResponse) GetAccessList() *AccessList {
@@ -1076,8 +1277,7 @@ func (x *UpsertAccessListWithMembersResponse) GetMembers() []*Member {
 	return nil
 }
 
-// GetAccessListMemberRequest is the request for retrieving an access list
-// member.
+// GetAccessListMemberRequest is the request for retrieving an access_list_member.
 type GetAccessListMemberRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// access_list is the name of the access list that the member belongs to.
@@ -1090,7 +1290,7 @@ type GetAccessListMemberRequest struct {
 
 func (x *GetAccessListMemberRequest) Reset() {
 	*x = GetAccessListMemberRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[21]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1102,7 +1302,7 @@ func (x *GetAccessListMemberRequest) String() string {
 func (*GetAccessListMemberRequest) ProtoMessage() {}
 
 func (x *GetAccessListMemberRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[21]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1115,7 +1315,7 @@ func (x *GetAccessListMemberRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListMemberRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessListMemberRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{21}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *GetAccessListMemberRequest) GetAccessList() string {
@@ -1132,6 +1332,109 @@ func (x *GetAccessListMemberRequest) GetMemberName() string {
 	return ""
 }
 
+// GetStaticAccessListMemberRequest is the request for retrieving an access_list_member of a static
+// type access_list.
+type GetStaticAccessListMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// access_list is the name of the access_list that the member belongs to.
+	AccessList string `protobuf:"bytes,1,opt,name=access_list,json=accessList,proto3" json:"access_list,omitempty"`
+	// member_name is the name of the user that belongs to the access_list.
+	MemberName    string `protobuf:"bytes,2,opt,name=member_name,json=memberName,proto3" json:"member_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetStaticAccessListMemberRequest) Reset() {
+	*x = GetStaticAccessListMemberRequest{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetStaticAccessListMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetStaticAccessListMemberRequest) ProtoMessage() {}
+
+func (x *GetStaticAccessListMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetStaticAccessListMemberRequest.ProtoReflect.Descriptor instead.
+func (*GetStaticAccessListMemberRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *GetStaticAccessListMemberRequest) GetAccessList() string {
+	if x != nil {
+		return x.AccessList
+	}
+	return ""
+}
+
+func (x *GetStaticAccessListMemberRequest) GetMemberName() string {
+	if x != nil {
+		return x.MemberName
+	}
+	return ""
+}
+
+// GetStaticAccessListMemberResponse is the response containing the access_list_member of the
+// target access_list of static type.
+type GetStaticAccessListMemberResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// member of the target static access_list.
+	Member        *Member `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetStaticAccessListMemberResponse) Reset() {
+	*x = GetStaticAccessListMemberResponse{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetStaticAccessListMemberResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetStaticAccessListMemberResponse) ProtoMessage() {}
+
+func (x *GetStaticAccessListMemberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetStaticAccessListMemberResponse.ProtoReflect.Descriptor instead.
+func (*GetStaticAccessListMemberResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *GetStaticAccessListMemberResponse) GetMember() *Member {
+	if x != nil {
+		return x.Member
+	}
+	return nil
+}
+
 // GetAccessListOwnersRequest is the request for getting a list of all owners
 // in an Access List, including those inherited from nested Access Lists.
 type GetAccessListOwnersRequest struct {
@@ -1144,7 +1447,7 @@ type GetAccessListOwnersRequest struct {
 
 func (x *GetAccessListOwnersRequest) Reset() {
 	*x = GetAccessListOwnersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[22]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1156,7 +1459,7 @@ func (x *GetAccessListOwnersRequest) String() string {
 func (*GetAccessListOwnersRequest) ProtoMessage() {}
 
 func (x *GetAccessListOwnersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[22]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1169,7 +1472,7 @@ func (x *GetAccessListOwnersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListOwnersRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessListOwnersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{22}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *GetAccessListOwnersRequest) GetAccessList() string {
@@ -1192,7 +1495,7 @@ type GetAccessListOwnersResponse struct {
 
 func (x *GetAccessListOwnersResponse) Reset() {
 	*x = GetAccessListOwnersResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[23]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1204,7 +1507,7 @@ func (x *GetAccessListOwnersResponse) String() string {
 func (*GetAccessListOwnersResponse) ProtoMessage() {}
 
 func (x *GetAccessListOwnersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[23]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1217,7 +1520,7 @@ func (x *GetAccessListOwnersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessListOwnersResponse.ProtoReflect.Descriptor instead.
 func (*GetAccessListOwnersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{23}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *GetAccessListOwnersResponse) GetOwners() []*AccessListOwner {
@@ -1227,31 +1530,125 @@ func (x *GetAccessListOwnersResponse) GetOwners() []*AccessListOwner {
 	return nil
 }
 
-// UpsertAccessListMemberRequest is the request for upserting an access list
-// member.
-type UpsertAccessListMemberRequest struct {
+// UpsertAccessListMemberRequest is the request for upserting an access list
+// member.
+type UpsertAccessListMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// member is the access list member to upsert.
+	Member        *Member `protobuf:"bytes,4,opt,name=member,proto3" json:"member,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertAccessListMemberRequest) Reset() {
+	*x = UpsertAccessListMemberRequest{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertAccessListMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertAccessListMemberRequest) ProtoMessage() {}
+
+func (x *UpsertAccessListMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertAccessListMemberRequest.ProtoReflect.Descriptor instead.
+func (*UpsertAccessListMemberRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *UpsertAccessListMemberRequest) GetMember() *Member {
+	if x != nil {
+		return x.Member
+	}
+	return nil
+}
+
+// UpsertStaticAccessListMemberRequest is the request for upserting an access_list_member to an
+// access_list of type static.
+type UpsertStaticAccessListMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// member is the access_list_member to upsert.
+	Member        *Member `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertStaticAccessListMemberRequest) Reset() {
+	*x = UpsertStaticAccessListMemberRequest{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertStaticAccessListMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertStaticAccessListMemberRequest) ProtoMessage() {}
+
+func (x *UpsertStaticAccessListMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertStaticAccessListMemberRequest.ProtoReflect.Descriptor instead.
+func (*UpsertStaticAccessListMemberRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *UpsertStaticAccessListMemberRequest) GetMember() *Member {
+	if x != nil {
+		return x.Member
+	}
+	return nil
+}
+
+// UpsertStaticAccessListMemberResponse is the response of upserting an access_list_member to an
+// static_access of type static.
+type UpsertStaticAccessListMemberResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// member is the access list member to upsert.
-	Member        *Member `protobuf:"bytes,4,opt,name=member,proto3" json:"member,omitempty"`
+	// member is the upserted access_list_member.
+	Member        *Member `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *UpsertAccessListMemberRequest) Reset() {
-	*x = UpsertAccessListMemberRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[24]
+func (x *UpsertStaticAccessListMemberResponse) Reset() {
+	*x = UpsertStaticAccessListMemberResponse{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *UpsertAccessListMemberRequest) String() string {
+func (x *UpsertStaticAccessListMemberResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*UpsertAccessListMemberRequest) ProtoMessage() {}
+func (*UpsertStaticAccessListMemberResponse) ProtoMessage() {}
 
-func (x *UpsertAccessListMemberRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[24]
+func (x *UpsertStaticAccessListMemberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1262,12 +1659,12 @@ func (x *UpsertAccessListMemberRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use UpsertAccessListMemberRequest.ProtoReflect.Descriptor instead.
-func (*UpsertAccessListMemberRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{24}
+// Deprecated: Use UpsertStaticAccessListMemberResponse.ProtoReflect.Descriptor instead.
+func (*UpsertStaticAccessListMemberResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{31}
 }
 
-func (x *UpsertAccessListMemberRequest) GetMember() *Member {
+func (x *UpsertStaticAccessListMemberResponse) GetMember() *Member {
 	if x != nil {
 		return x.Member
 	}
@@ -1286,7 +1683,7 @@ type UpdateAccessListMemberRequest struct {
 
 func (x *UpdateAccessListMemberRequest) Reset() {
 	*x = UpdateAccessListMemberRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[25]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1298,7 +1695,7 @@ func (x *UpdateAccessListMemberRequest) String() string {
 func (*UpdateAccessListMemberRequest) ProtoMessage() {}
 
 func (x *UpdateAccessListMemberRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[25]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1311,7 +1708,7 @@ func (x *UpdateAccessListMemberRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateAccessListMemberRequest.ProtoReflect.Descriptor instead.
 func (*UpdateAccessListMemberRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{25}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *UpdateAccessListMemberRequest) GetMember() *Member {
@@ -1335,7 +1732,7 @@ type DeleteAccessListMemberRequest struct {
 
 func (x *DeleteAccessListMemberRequest) Reset() {
 	*x = DeleteAccessListMemberRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[26]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1347,7 +1744,7 @@ func (x *DeleteAccessListMemberRequest) String() string {
 func (*DeleteAccessListMemberRequest) ProtoMessage() {}
 
 func (x *DeleteAccessListMemberRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[26]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1360,7 +1757,7 @@ func (x *DeleteAccessListMemberRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteAccessListMemberRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAccessListMemberRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{26}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *DeleteAccessListMemberRequest) GetAccessList() string {
@@ -1377,6 +1774,100 @@ func (x *DeleteAccessListMemberRequest) GetMemberName() string {
 	return ""
 }
 
+// DeleteStaticAccessListMemberRequest is the request for deleting an access_list_member from an
+// access_list of type static.
+type DeleteStaticAccessListMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// access_list is the name of access list.
+	AccessList string `protobuf:"bytes,1,opt,name=access_list,json=accessList,proto3" json:"access_list,omitempty"`
+	// member_name is the name of the user to delete.
+	MemberName    string `protobuf:"bytes,2,opt,name=member_name,json=memberName,proto3" json:"member_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteStaticAccessListMemberRequest) Reset() {
+	*x = DeleteStaticAccessListMemberRequest{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteStaticAccessListMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteStaticAccessListMemberRequest) ProtoMessage() {}
+
+func (x *DeleteStaticAccessListMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteStaticAccessListMemberRequest.ProtoReflect.Descriptor instead.
+func (*DeleteStaticAccessListMemberRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *DeleteStaticAccessListMemberRequest) GetAccessList() string {
+	if x != nil {
+		return x.AccessList
+	}
+	return ""
+}
+
+func (x *DeleteStaticAccessListMemberRequest) GetMemberName() string {
+	if x != nil {
+		return x.MemberName
+	}
+	return ""
+}
+
+// DeleteStaticAccessListMemberResponse is the response of deleting an access_list_member from an
+// access_list of type static.
+type DeleteStaticAccessListMemberResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteStaticAccessListMemberResponse) Reset() {
+	*x = DeleteStaticAccessListMemberResponse{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteStaticAccessListMemberResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteStaticAccessListMemberResponse) ProtoMessage() {}
+
+func (x *DeleteStaticAccessListMemberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteStaticAccessListMemberResponse.ProtoReflect.Descriptor instead.
+func (*DeleteStaticAccessListMemberResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{35}
+}
+
 // DeleteAllAccessListMembersForAccessListRequest is the request for deleting
 // all members from an access list.
 type DeleteAllAccessListMembersForAccessListRequest struct {
@@ -1389,7 +1880,7 @@ type DeleteAllAccessListMembersForAccessListRequest struct {
 
 func (x *DeleteAllAccessListMembersForAccessListRequest) Reset() {
 	*x = DeleteAllAccessListMembersForAccessListRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[27]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1401,7 +1892,7 @@ func (x *DeleteAllAccessListMembersForAccessListRequest) String() string {
 func (*DeleteAllAccessListMembersForAccessListRequest) ProtoMessage() {}
 
 func (x *DeleteAllAccessListMembersForAccessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[27]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1414,7 +1905,7 @@ func (x *DeleteAllAccessListMembersForAccessListRequest) ProtoReflect() protoref
 
 // Deprecated: Use DeleteAllAccessListMembersForAccessListRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAllAccessListMembersForAccessListRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{27}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *DeleteAllAccessListMembersForAccessListRequest) GetAccessList() string {
@@ -1434,7 +1925,7 @@ type DeleteAllAccessListMembersRequest struct {
 
 func (x *DeleteAllAccessListMembersRequest) Reset() {
 	*x = DeleteAllAccessListMembersRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[28]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1446,7 +1937,7 @@ func (x *DeleteAllAccessListMembersRequest) String() string {
 func (*DeleteAllAccessListMembersRequest) ProtoMessage() {}
 
 func (x *DeleteAllAccessListMembersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[28]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1459,7 +1950,7 @@ func (x *DeleteAllAccessListMembersRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use DeleteAllAccessListMembersRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAllAccessListMembersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{28}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{37}
 }
 
 // ListAccessListReviewsRequest is the request for getting paginated access list
@@ -1478,7 +1969,7 @@ type ListAccessListReviewsRequest struct {
 
 func (x *ListAccessListReviewsRequest) Reset() {
 	*x = ListAccessListReviewsRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[29]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1490,7 +1981,7 @@ func (x *ListAccessListReviewsRequest) String() string {
 func (*ListAccessListReviewsRequest) ProtoMessage() {}
 
 func (x *ListAccessListReviewsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[29]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1503,7 +1994,7 @@ func (x *ListAccessListReviewsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAccessListReviewsRequest.ProtoReflect.Descriptor instead.
 func (*ListAccessListReviewsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{29}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *ListAccessListReviewsRequest) GetAccessList() string {
@@ -1541,7 +2032,7 @@ type ListAccessListReviewsResponse struct {
 
 func (x *ListAccessListReviewsResponse) Reset() {
 	*x = ListAccessListReviewsResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[30]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1553,7 +2044,7 @@ func (x *ListAccessListReviewsResponse) String() string {
 func (*ListAccessListReviewsResponse) ProtoMessage() {}
 
 func (x *ListAccessListReviewsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[30]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1566,7 +2057,7 @@ func (x *ListAccessListReviewsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAccessListReviewsResponse.ProtoReflect.Descriptor instead.
 func (*ListAccessListReviewsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{30}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ListAccessListReviewsResponse) GetReviews() []*Review {
@@ -1597,7 +2088,7 @@ type ListAllAccessListReviewsRequest struct {
 
 func (x *ListAllAccessListReviewsRequest) Reset() {
 	*x = ListAllAccessListReviewsRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[31]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1609,7 +2100,7 @@ func (x *ListAllAccessListReviewsRequest) String() string {
 func (*ListAllAccessListReviewsRequest) ProtoMessage() {}
 
 func (x *ListAllAccessListReviewsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[31]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1622,7 +2113,7 @@ func (x *ListAllAccessListReviewsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAllAccessListReviewsRequest.ProtoReflect.Descriptor instead.
 func (*ListAllAccessListReviewsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{31}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *ListAllAccessListReviewsRequest) GetPageSize() int32 {
@@ -1653,7 +2144,7 @@ type ListAllAccessListReviewsResponse struct {
 
 func (x *ListAllAccessListReviewsResponse) Reset() {
 	*x = ListAllAccessListReviewsResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[32]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1665,7 +2156,7 @@ func (x *ListAllAccessListReviewsResponse) String() string {
 func (*ListAllAccessListReviewsResponse) ProtoMessage() {}
 
 func (x *ListAllAccessListReviewsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[32]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1678,7 +2169,7 @@ func (x *ListAllAccessListReviewsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAllAccessListReviewsResponse.ProtoReflect.Descriptor instead.
 func (*ListAllAccessListReviewsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{32}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ListAllAccessListReviewsResponse) GetReviews() []*Review {
@@ -1707,7 +2198,7 @@ type CreateAccessListReviewRequest struct {
 
 func (x *CreateAccessListReviewRequest) Reset() {
 	*x = CreateAccessListReviewRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[33]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1719,7 +2210,7 @@ func (x *CreateAccessListReviewRequest) String() string {
 func (*CreateAccessListReviewRequest) ProtoMessage() {}
 
 func (x *CreateAccessListReviewRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[33]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1732,7 +2223,7 @@ func (x *CreateAccessListReviewRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateAccessListReviewRequest.ProtoReflect.Descriptor instead.
 func (*CreateAccessListReviewRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{33}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *CreateAccessListReviewRequest) GetReview() *Review {
@@ -1756,7 +2247,7 @@ type CreateAccessListReviewResponse struct {
 
 func (x *CreateAccessListReviewResponse) Reset() {
 	*x = CreateAccessListReviewResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[34]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1768,7 +2259,7 @@ func (x *CreateAccessListReviewResponse) String() string {
 func (*CreateAccessListReviewResponse) ProtoMessage() {}
 
 func (x *CreateAccessListReviewResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[34]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1781,7 +2272,7 @@ func (x *CreateAccessListReviewResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateAccessListReviewResponse.ProtoReflect.Descriptor instead.
 func (*CreateAccessListReviewResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{34}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *CreateAccessListReviewResponse) GetReviewName() string {
@@ -1812,7 +2303,7 @@ type DeleteAccessListReviewRequest struct {
 
 func (x *DeleteAccessListReviewRequest) Reset() {
 	*x = DeleteAccessListReviewRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[35]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1824,7 +2315,7 @@ func (x *DeleteAccessListReviewRequest) String() string {
 func (*DeleteAccessListReviewRequest) ProtoMessage() {}
 
 func (x *DeleteAccessListReviewRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[35]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1837,7 +2328,7 @@ func (x *DeleteAccessListReviewRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteAccessListReviewRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAccessListReviewRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{35}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *DeleteAccessListReviewRequest) GetReviewName() string {
@@ -1870,7 +2361,7 @@ type AccessRequestPromoteRequest struct {
 
 func (x *AccessRequestPromoteRequest) Reset() {
 	*x = AccessRequestPromoteRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[36]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1882,7 +2373,7 @@ func (x *AccessRequestPromoteRequest) String() string {
 func (*AccessRequestPromoteRequest) ProtoMessage() {}
 
 func (x *AccessRequestPromoteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[36]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1895,7 +2386,7 @@ func (x *AccessRequestPromoteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessRequestPromoteRequest.ProtoReflect.Descriptor instead.
 func (*AccessRequestPromoteRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{36}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *AccessRequestPromoteRequest) GetRequestId() string {
@@ -1931,7 +2422,7 @@ type AccessRequestPromoteResponse struct {
 
 func (x *AccessRequestPromoteResponse) Reset() {
 	*x = AccessRequestPromoteResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[37]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1943,7 +2434,7 @@ func (x *AccessRequestPromoteResponse) String() string {
 func (*AccessRequestPromoteResponse) ProtoMessage() {}
 
 func (x *AccessRequestPromoteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[37]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1956,7 +2447,7 @@ func (x *AccessRequestPromoteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessRequestPromoteResponse.ProtoReflect.Descriptor instead.
 func (*AccessRequestPromoteResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{37}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *AccessRequestPromoteResponse) GetAccessRequest() *types.AccessRequestV3 {
@@ -1978,7 +2469,7 @@ type GetSuggestedAccessListsRequest struct {
 
 func (x *GetSuggestedAccessListsRequest) Reset() {
 	*x = GetSuggestedAccessListsRequest{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[38]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1990,7 +2481,7 @@ func (x *GetSuggestedAccessListsRequest) String() string {
 func (*GetSuggestedAccessListsRequest) ProtoMessage() {}
 
 func (x *GetSuggestedAccessListsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[38]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2003,7 +2494,7 @@ func (x *GetSuggestedAccessListsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSuggestedAccessListsRequest.ProtoReflect.Descriptor instead.
 func (*GetSuggestedAccessListsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{38}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *GetSuggestedAccessListsRequest) GetAccessRequestId() string {
@@ -2025,7 +2516,7 @@ type GetSuggestedAccessListsResponse struct {
 
 func (x *GetSuggestedAccessListsResponse) Reset() {
 	*x = GetSuggestedAccessListsResponse{}
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[39]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2037,7 +2528,7 @@ func (x *GetSuggestedAccessListsResponse) String() string {
 func (*GetSuggestedAccessListsResponse) ProtoMessage() {}
 
 func (x *GetSuggestedAccessListsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[39]
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2050,7 +2541,7 @@ func (x *GetSuggestedAccessListsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSuggestedAccessListsResponse.ProtoReflect.Descriptor instead.
 func (*GetSuggestedAccessListsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{39}
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *GetSuggestedAccessListsResponse) GetAccessLists() []*AccessList {
@@ -2060,6 +2551,136 @@ func (x *GetSuggestedAccessListsResponse) GetAccessLists() []*AccessList {
 	return nil
 }
 
+// ListUserAccessListsRequest is the request for getting access lists where the
+// user is an owner or member.
+type ListUserAccessListsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// username is the name of the user to get access lists for.
+	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	// page_size is the size of the page to request.
+	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// page_token is the page token.
+	PageToken     string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserAccessListsRequest) Reset() {
+	*x = ListUserAccessListsRequest{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[49]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserAccessListsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserAccessListsRequest) ProtoMessage() {}
+
+func (x *ListUserAccessListsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[49]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserAccessListsRequest.ProtoReflect.Descriptor instead.
+func (*ListUserAccessListsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *ListUserAccessListsRequest) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *ListUserAccessListsRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListUserAccessListsRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListUserAccessListsResponse is the response for getting access lists where the
+// user is an owner or member.
+type ListUserAccessListsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// access_lists are the access lists where the user is a member or owner.
+	AccessLists []*AccessList `protobuf:"bytes,1,rep,name=access_lists,json=accessLists,proto3" json:"access_lists,omitempty"`
+	// next_page_token is the next page token.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	// total_count is the total number of access lists in all pages.
+	TotalCount    int32 `protobuf:"varint,3,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserAccessListsResponse) Reset() {
+	*x = ListUserAccessListsResponse{}
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[50]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserAccessListsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserAccessListsResponse) ProtoMessage() {}
+
+func (x *ListUserAccessListsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_service_proto_msgTypes[50]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserAccessListsResponse.ProtoReflect.Descriptor instead.
+func (*ListUserAccessListsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *ListUserAccessListsResponse) GetAccessLists() []*AccessList {
+	if x != nil {
+		return x.AccessLists
+	}
+	return nil
+}
+
+func (x *ListUserAccessListsResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+func (x *ListUserAccessListsResponse) GetTotalCount() int32 {
+	if x != nil {
+		return x.TotalCount
+	}
+	return 0
+}
+
 var File_teleport_accesslist_v1_accesslist_service_proto protoreflect.FileDescriptor
 
 const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
@@ -2075,7 +2696,21 @@ const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
 	"\x17ListAccessListsResponse\x12E\n" +
 	"\faccess_lists\x18\x01 \x03(\v2\".teleport.accesslist.v1.AccessListR\vaccessLists\x12\x1d\n" +
 	"\n" +
-	"next_token\x18\x02 \x01(\tR\tnextToken\"A\n" +
+	"next_token\x18\x02 \x01(\tR\tnextToken\"\xc1\x01\n" +
+	"\x18ListAccessListsV2Request\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12&\n" +
+	"\asort_by\x18\x03 \x01(\v2\r.types.SortByR\x06sortBy\x12A\n" +
+	"\x06filter\x18\x04 \x01(\v2).teleport.accesslist.v1.AccessListsFilterR\x06filter\"q\n" +
+	"\x11AccessListsFilter\x12\x16\n" +
+	"\x06search\x18\x01 \x01(\tR\x06search\x12\x16\n" +
+	"\x06owners\x18\x02 \x03(\tR\x06owners\x12\x14\n" +
+	"\x05roles\x18\x03 \x03(\tR\x05roles\x12\x16\n" +
+	"\x06origin\x18\x04 \x01(\tR\x06origin\"\x8a\x01\n" +
+	"\x19ListAccessListsV2Response\x12E\n" +
+	"\faccess_lists\x18\x01 \x03(\v2\".teleport.accesslist.v1.AccessListR\vaccessLists\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"A\n" +
 	"\x19GetInheritedGrantsRequest\x12$\n" +
 	"\x0eaccess_list_id\x18\x01 \x01(\tR\faccessListId\"^\n" +
 	"\x1aGetInheritedGrantsResponse\x12@\n" +
@@ -2128,21 +2763,38 @@ const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
 	"\vaccess_list\x18\x01 \x01(\tR\n" +
 	"accessList\x12\x1f\n" +
 	"\vmember_name\x18\x02 \x01(\tR\n" +
-	"memberName\"=\n" +
+	"memberName\"d\n" +
+	" GetStaticAccessListMemberRequest\x12\x1f\n" +
+	"\vaccess_list\x18\x01 \x01(\tR\n" +
+	"accessList\x12\x1f\n" +
+	"\vmember_name\x18\x02 \x01(\tR\n" +
+	"memberName\"[\n" +
+	"!GetStaticAccessListMemberResponse\x126\n" +
+	"\x06member\x18\x01 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06member\"=\n" +
 	"\x1aGetAccessListOwnersRequest\x12\x1f\n" +
 	"\vaccess_list\x18\x01 \x01(\tR\n" +
 	"accessList\"^\n" +
 	"\x1bGetAccessListOwnersResponse\x12?\n" +
 	"\x06owners\x18\x01 \x03(\v2'.teleport.accesslist.v1.AccessListOwnerR\x06owners\"\x84\x01\n" +
 	"\x1dUpsertAccessListMemberRequest\x126\n" +
-	"\x06member\x18\x04 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06memberJ\x04\b\x01\x10\x02J\x04\b\x02\x10\x03J\x04\b\x03\x10\x04R\vaccess_listR\x04nameR\x06reason\"W\n" +
+	"\x06member\x18\x04 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06memberJ\x04\b\x01\x10\x02J\x04\b\x02\x10\x03J\x04\b\x03\x10\x04R\vaccess_listR\x04nameR\x06reason\"]\n" +
+	"#UpsertStaticAccessListMemberRequest\x126\n" +
+	"\x06member\x18\x01 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06member\"^\n" +
+	"$UpsertStaticAccessListMemberResponse\x126\n" +
+	"\x06member\x18\x01 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06member\"W\n" +
 	"\x1dUpdateAccessListMemberRequest\x126\n" +
 	"\x06member\x18\x01 \x01(\v2\x1e.teleport.accesslist.v1.MemberR\x06member\"m\n" +
 	"\x1dDeleteAccessListMemberRequest\x12\x1f\n" +
 	"\vaccess_list\x18\x01 \x01(\tR\n" +
 	"accessList\x12\x1f\n" +
 	"\vmember_name\x18\x03 \x01(\tR\n" +
-	"memberNameJ\x04\b\x02\x10\x03R\x04name\"Q\n" +
+	"memberNameJ\x04\b\x02\x10\x03R\x04name\"g\n" +
+	"#DeleteStaticAccessListMemberRequest\x12\x1f\n" +
+	"\vaccess_list\x18\x01 \x01(\tR\n" +
+	"accessList\x12\x1f\n" +
+	"\vmember_name\x18\x02 \x01(\tR\n" +
+	"memberName\"&\n" +
+	"$DeleteStaticAccessListMemberResponse\"Q\n" +
 	".DeleteAllAccessListMembersForAccessListRequest\x12\x1f\n" +
 	"\vaccess_list\x18\x01 \x01(\tR\n" +
 	"accessList\"6\n" +
@@ -2185,10 +2837,21 @@ const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
 	"\x1eGetSuggestedAccessListsRequest\x12*\n" +
 	"\x11access_request_id\x18\x01 \x01(\tR\x0faccessRequestId\"h\n" +
 	"\x1fGetSuggestedAccessListsResponse\x12E\n" +
-	"\faccess_lists\x18\x01 \x03(\v2\".teleport.accesslist.v1.AccessListR\vaccessLists2\xfe\x18\n" +
+	"\faccess_lists\x18\x01 \x03(\v2\".teleport.accesslist.v1.AccessListR\vaccessLists\"t\n" +
+	"\x1aListUserAccessListsRequest\x12\x1a\n" +
+	"\busername\x18\x01 \x01(\tR\busername\x12\x1b\n" +
+	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x03 \x01(\tR\tpageToken\"\xad\x01\n" +
+	"\x1bListUserAccessListsResponse\x12E\n" +
+	"\faccess_lists\x18\x01 \x03(\v2\".teleport.accesslist.v1.AccessListR\vaccessLists\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\x12\x1f\n" +
+	"\vtotal_count\x18\x03 \x01(\x05R\n" +
+	"totalCount2\xc8\x1e\n" +
 	"\x11AccessListService\x12o\n" +
-	"\x0eGetAccessLists\x12-.teleport.accesslist.v1.GetAccessListsRequest\x1a..teleport.accesslist.v1.GetAccessListsResponse\x12r\n" +
-	"\x0fListAccessLists\x12..teleport.accesslist.v1.ListAccessListsRequest\x1a/.teleport.accesslist.v1.ListAccessListsResponse\x12a\n" +
+	"\x0eGetAccessLists\x12-.teleport.accesslist.v1.GetAccessListsRequest\x1a..teleport.accesslist.v1.GetAccessListsResponse\x12w\n" +
+	"\x0fListAccessLists\x12..teleport.accesslist.v1.ListAccessListsRequest\x1a/.teleport.accesslist.v1.ListAccessListsResponse\"\x03\x88\x02\x01\x12x\n" +
+	"\x11ListAccessListsV2\x120.teleport.accesslist.v1.ListAccessListsV2Request\x1a1.teleport.accesslist.v1.ListAccessListsV2Response\x12a\n" +
 	"\rGetAccessList\x12,.teleport.accesslist.v1.GetAccessListRequest\x1a\".teleport.accesslist.v1.AccessList\x12g\n" +
 	"\x10UpsertAccessList\x12/.teleport.accesslist.v1.UpsertAccessListRequest\x1a\".teleport.accesslist.v1.AccessList\x12g\n" +
 	"\x10UpdateAccessList\x12/.teleport.accesslist.v1.UpdateAccessListRequest\x1a\".teleport.accesslist.v1.AccessList\x12[\n" +
@@ -2198,11 +2861,14 @@ const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
 	"\x16CountAccessListMembers\x125.teleport.accesslist.v1.CountAccessListMembersRequest\x1a6.teleport.accesslist.v1.CountAccessListMembersResponse\x12\x84\x01\n" +
 	"\x15ListAccessListMembers\x124.teleport.accesslist.v1.ListAccessListMembersRequest\x1a5.teleport.accesslist.v1.ListAccessListMembersResponse\x12\x8d\x01\n" +
 	"\x18ListAllAccessListMembers\x127.teleport.accesslist.v1.ListAllAccessListMembersRequest\x1a8.teleport.accesslist.v1.ListAllAccessListMembersResponse\x12i\n" +
-	"\x13GetAccessListMember\x122.teleport.accesslist.v1.GetAccessListMemberRequest\x1a\x1e.teleport.accesslist.v1.Member\x12~\n" +
+	"\x13GetAccessListMember\x122.teleport.accesslist.v1.GetAccessListMemberRequest\x1a\x1e.teleport.accesslist.v1.Member\x12\x90\x01\n" +
+	"\x19GetStaticAccessListMember\x128.teleport.accesslist.v1.GetStaticAccessListMemberRequest\x1a9.teleport.accesslist.v1.GetStaticAccessListMemberResponse\x12~\n" +
 	"\x13GetAccessListOwners\x122.teleport.accesslist.v1.GetAccessListOwnersRequest\x1a3.teleport.accesslist.v1.GetAccessListOwnersResponse\x12o\n" +
-	"\x16UpsertAccessListMember\x125.teleport.accesslist.v1.UpsertAccessListMemberRequest\x1a\x1e.teleport.accesslist.v1.Member\x12o\n" +
+	"\x16UpsertAccessListMember\x125.teleport.accesslist.v1.UpsertAccessListMemberRequest\x1a\x1e.teleport.accesslist.v1.Member\x12\x99\x01\n" +
+	"\x1cUpsertStaticAccessListMember\x12;.teleport.accesslist.v1.UpsertStaticAccessListMemberRequest\x1a<.teleport.accesslist.v1.UpsertStaticAccessListMemberResponse\x12o\n" +
 	"\x16UpdateAccessListMember\x125.teleport.accesslist.v1.UpdateAccessListMemberRequest\x1a\x1e.teleport.accesslist.v1.Member\x12g\n" +
-	"\x16DeleteAccessListMember\x125.teleport.accesslist.v1.DeleteAccessListMemberRequest\x1a\x16.google.protobuf.Empty\x12\x89\x01\n" +
+	"\x16DeleteAccessListMember\x125.teleport.accesslist.v1.DeleteAccessListMemberRequest\x1a\x16.google.protobuf.Empty\x12\x99\x01\n" +
+	"\x1cDeleteStaticAccessListMember\x12;.teleport.accesslist.v1.DeleteStaticAccessListMemberRequest\x1a<.teleport.accesslist.v1.DeleteStaticAccessListMemberResponse\x12\x89\x01\n" +
 	"'DeleteAllAccessListMembersForAccessList\x12F.teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest\x1a\x16.google.protobuf.Empty\x12o\n" +
 	"\x1aDeleteAllAccessListMembers\x129.teleport.accesslist.v1.DeleteAllAccessListMembersRequest\x1a\x16.google.protobuf.Empty\x12\x96\x01\n" +
 	"\x1bUpsertAccessListWithMembers\x12:.teleport.accesslist.v1.UpsertAccessListWithMembersRequest\x1a;.teleport.accesslist.v1.UpsertAccessListWithMembersResponse\x12\x84\x01\n" +
@@ -2212,7 +2878,8 @@ const file_teleport_accesslist_v1_accesslist_service_proto_rawDesc = "" +
 	"\x16DeleteAccessListReview\x125.teleport.accesslist.v1.DeleteAccessListReviewRequest\x1a\x16.google.protobuf.Empty\x12\x81\x01\n" +
 	"\x14AccessRequestPromote\x123.teleport.accesslist.v1.AccessRequestPromoteRequest\x1a4.teleport.accesslist.v1.AccessRequestPromoteResponse\x12\x8a\x01\n" +
 	"\x17GetSuggestedAccessLists\x126.teleport.accesslist.v1.GetSuggestedAccessListsRequest\x1a7.teleport.accesslist.v1.GetSuggestedAccessListsResponse\x12{\n" +
-	"\x12GetInheritedGrants\x121.teleport.accesslist.v1.GetInheritedGrantsRequest\x1a2.teleport.accesslist.v1.GetInheritedGrantsResponseBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1;accesslistv1b\x06proto3"
+	"\x12GetInheritedGrants\x121.teleport.accesslist.v1.GetInheritedGrantsRequest\x1a2.teleport.accesslist.v1.GetInheritedGrantsResponse\x12~\n" +
+	"\x13ListUserAccessLists\x122.teleport.accesslist.v1.ListUserAccessListsRequest\x1a3.teleport.accesslist.v1.ListUserAccessListsResponseBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1;accesslistv1b\x06proto3"
 
 var (
 	file_teleport_accesslist_v1_accesslist_service_proto_rawDescOnce sync.Once
@@ -2226,136 +2893,165 @@ func file_teleport_accesslist_v1_accesslist_service_proto_rawDescGZIP() []byte {
 	return file_teleport_accesslist_v1_accesslist_service_proto_rawDescData
 }
 
-var file_teleport_accesslist_v1_accesslist_service_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
+var file_teleport_accesslist_v1_accesslist_service_proto_msgTypes = make([]protoimpl.MessageInfo, 51)
 var file_teleport_accesslist_v1_accesslist_service_proto_goTypes = []any{
 	(*GetAccessListsRequest)(nil),                          // 0: teleport.accesslist.v1.GetAccessListsRequest
 	(*GetAccessListsResponse)(nil),                         // 1: teleport.accesslist.v1.GetAccessListsResponse
 	(*ListAccessListsRequest)(nil),                         // 2: teleport.accesslist.v1.ListAccessListsRequest
 	(*ListAccessListsResponse)(nil),                        // 3: teleport.accesslist.v1.ListAccessListsResponse
-	(*GetInheritedGrantsRequest)(nil),                      // 4: teleport.accesslist.v1.GetInheritedGrantsRequest
-	(*GetInheritedGrantsResponse)(nil),                     // 5: teleport.accesslist.v1.GetInheritedGrantsResponse
-	(*GetAccessListRequest)(nil),                           // 6: teleport.accesslist.v1.GetAccessListRequest
-	(*UpsertAccessListRequest)(nil),                        // 7: teleport.accesslist.v1.UpsertAccessListRequest
-	(*UpdateAccessListRequest)(nil),                        // 8: teleport.accesslist.v1.UpdateAccessListRequest
-	(*DeleteAccessListRequest)(nil),                        // 9: teleport.accesslist.v1.DeleteAccessListRequest
-	(*DeleteAllAccessListsRequest)(nil),                    // 10: teleport.accesslist.v1.DeleteAllAccessListsRequest
-	(*GetAccessListsToReviewRequest)(nil),                  // 11: teleport.accesslist.v1.GetAccessListsToReviewRequest
-	(*GetAccessListsToReviewResponse)(nil),                 // 12: teleport.accesslist.v1.GetAccessListsToReviewResponse
-	(*CountAccessListMembersRequest)(nil),                  // 13: teleport.accesslist.v1.CountAccessListMembersRequest
-	(*CountAccessListMembersResponse)(nil),                 // 14: teleport.accesslist.v1.CountAccessListMembersResponse
-	(*ListAccessListMembersRequest)(nil),                   // 15: teleport.accesslist.v1.ListAccessListMembersRequest
-	(*ListAccessListMembersResponse)(nil),                  // 16: teleport.accesslist.v1.ListAccessListMembersResponse
-	(*ListAllAccessListMembersRequest)(nil),                // 17: teleport.accesslist.v1.ListAllAccessListMembersRequest
-	(*ListAllAccessListMembersResponse)(nil),               // 18: teleport.accesslist.v1.ListAllAccessListMembersResponse
-	(*UpsertAccessListWithMembersRequest)(nil),             // 19: teleport.accesslist.v1.UpsertAccessListWithMembersRequest
-	(*UpsertAccessListWithMembersResponse)(nil),            // 20: teleport.accesslist.v1.UpsertAccessListWithMembersResponse
-	(*GetAccessListMemberRequest)(nil),                     // 21: teleport.accesslist.v1.GetAccessListMemberRequest
-	(*GetAccessListOwnersRequest)(nil),                     // 22: teleport.accesslist.v1.GetAccessListOwnersRequest
-	(*GetAccessListOwnersResponse)(nil),                    // 23: teleport.accesslist.v1.GetAccessListOwnersResponse
-	(*UpsertAccessListMemberRequest)(nil),                  // 24: teleport.accesslist.v1.UpsertAccessListMemberRequest
-	(*UpdateAccessListMemberRequest)(nil),                  // 25: teleport.accesslist.v1.UpdateAccessListMemberRequest
-	(*DeleteAccessListMemberRequest)(nil),                  // 26: teleport.accesslist.v1.DeleteAccessListMemberRequest
-	(*DeleteAllAccessListMembersForAccessListRequest)(nil), // 27: teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
-	(*DeleteAllAccessListMembersRequest)(nil),              // 28: teleport.accesslist.v1.DeleteAllAccessListMembersRequest
-	(*ListAccessListReviewsRequest)(nil),                   // 29: teleport.accesslist.v1.ListAccessListReviewsRequest
-	(*ListAccessListReviewsResponse)(nil),                  // 30: teleport.accesslist.v1.ListAccessListReviewsResponse
-	(*ListAllAccessListReviewsRequest)(nil),                // 31: teleport.accesslist.v1.ListAllAccessListReviewsRequest
-	(*ListAllAccessListReviewsResponse)(nil),               // 32: teleport.accesslist.v1.ListAllAccessListReviewsResponse
-	(*CreateAccessListReviewRequest)(nil),                  // 33: teleport.accesslist.v1.CreateAccessListReviewRequest
-	(*CreateAccessListReviewResponse)(nil),                 // 34: teleport.accesslist.v1.CreateAccessListReviewResponse
-	(*DeleteAccessListReviewRequest)(nil),                  // 35: teleport.accesslist.v1.DeleteAccessListReviewRequest
-	(*AccessRequestPromoteRequest)(nil),                    // 36: teleport.accesslist.v1.AccessRequestPromoteRequest
-	(*AccessRequestPromoteResponse)(nil),                   // 37: teleport.accesslist.v1.AccessRequestPromoteResponse
-	(*GetSuggestedAccessListsRequest)(nil),                 // 38: teleport.accesslist.v1.GetSuggestedAccessListsRequest
-	(*GetSuggestedAccessListsResponse)(nil),                // 39: teleport.accesslist.v1.GetSuggestedAccessListsResponse
-	(*AccessList)(nil),                                     // 40: teleport.accesslist.v1.AccessList
-	(*AccessListGrants)(nil),                               // 41: teleport.accesslist.v1.AccessListGrants
-	(*Member)(nil),                                         // 42: teleport.accesslist.v1.Member
-	(*AccessListOwner)(nil),                                // 43: teleport.accesslist.v1.AccessListOwner
-	(*Review)(nil),                                         // 44: teleport.accesslist.v1.Review
-	(*timestamppb.Timestamp)(nil),                          // 45: google.protobuf.Timestamp
-	(*types.AccessRequestV3)(nil),                          // 46: types.AccessRequestV3
-	(*emptypb.Empty)(nil),                                  // 47: google.protobuf.Empty
+	(*ListAccessListsV2Request)(nil),                       // 4: teleport.accesslist.v1.ListAccessListsV2Request
+	(*AccessListsFilter)(nil),                              // 5: teleport.accesslist.v1.AccessListsFilter
+	(*ListAccessListsV2Response)(nil),                      // 6: teleport.accesslist.v1.ListAccessListsV2Response
+	(*GetInheritedGrantsRequest)(nil),                      // 7: teleport.accesslist.v1.GetInheritedGrantsRequest
+	(*GetInheritedGrantsResponse)(nil),                     // 8: teleport.accesslist.v1.GetInheritedGrantsResponse
+	(*GetAccessListRequest)(nil),                           // 9: teleport.accesslist.v1.GetAccessListRequest
+	(*UpsertAccessListRequest)(nil),                        // 10: teleport.accesslist.v1.UpsertAccessListRequest
+	(*UpdateAccessListRequest)(nil),                        // 11: teleport.accesslist.v1.UpdateAccessListRequest
+	(*DeleteAccessListRequest)(nil),                        // 12: teleport.accesslist.v1.DeleteAccessListRequest
+	(*DeleteAllAccessListsRequest)(nil),                    // 13: teleport.accesslist.v1.DeleteAllAccessListsRequest
+	(*GetAccessListsToReviewRequest)(nil),                  // 14: teleport.accesslist.v1.GetAccessListsToReviewRequest
+	(*GetAccessListsToReviewResponse)(nil),                 // 15: teleport.accesslist.v1.GetAccessListsToReviewResponse
+	(*CountAccessListMembersRequest)(nil),                  // 16: teleport.accesslist.v1.CountAccessListMembersRequest
+	(*CountAccessListMembersResponse)(nil),                 // 17: teleport.accesslist.v1.CountAccessListMembersResponse
+	(*ListAccessListMembersRequest)(nil),                   // 18: teleport.accesslist.v1.ListAccessListMembersRequest
+	(*ListAccessListMembersResponse)(nil),                  // 19: teleport.accesslist.v1.ListAccessListMembersResponse
+	(*ListAllAccessListMembersRequest)(nil),                // 20: teleport.accesslist.v1.ListAllAccessListMembersRequest
+	(*ListAllAccessListMembersResponse)(nil),               // 21: teleport.accesslist.v1.ListAllAccessListMembersResponse
+	(*UpsertAccessListWithMembersRequest)(nil),             // 22: teleport.accesslist.v1.UpsertAccessListWithMembersRequest
+	(*UpsertAccessListWithMembersResponse)(nil),            // 23: teleport.accesslist.v1.UpsertAccessListWithMembersResponse
+	(*GetAccessListMemberRequest)(nil),                     // 24: teleport.accesslist.v1.GetAccessListMemberRequest
+	(*GetStaticAccessListMemberRequest)(nil),               // 25: teleport.accesslist.v1.GetStaticAccessListMemberRequest
+	(*GetStaticAccessListMemberResponse)(nil),              // 26: teleport.accesslist.v1.GetStaticAccessListMemberResponse
+	(*GetAccessListOwnersRequest)(nil),                     // 27: teleport.accesslist.v1.GetAccessListOwnersRequest
+	(*GetAccessListOwnersResponse)(nil),                    // 28: teleport.accesslist.v1.GetAccessListOwnersResponse
+	(*UpsertAccessListMemberRequest)(nil),                  // 29: teleport.accesslist.v1.UpsertAccessListMemberRequest
+	(*UpsertStaticAccessListMemberRequest)(nil),            // 30: teleport.accesslist.v1.UpsertStaticAccessListMemberRequest
+	(*UpsertStaticAccessListMemberResponse)(nil),           // 31: teleport.accesslist.v1.UpsertStaticAccessListMemberResponse
+	(*UpdateAccessListMemberRequest)(nil),                  // 32: teleport.accesslist.v1.UpdateAccessListMemberRequest
+	(*DeleteAccessListMemberRequest)(nil),                  // 33: teleport.accesslist.v1.DeleteAccessListMemberRequest
+	(*DeleteStaticAccessListMemberRequest)(nil),            // 34: teleport.accesslist.v1.DeleteStaticAccessListMemberRequest
+	(*DeleteStaticAccessListMemberResponse)(nil),           // 35: teleport.accesslist.v1.DeleteStaticAccessListMemberResponse
+	(*DeleteAllAccessListMembersForAccessListRequest)(nil), // 36: teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
+	(*DeleteAllAccessListMembersRequest)(nil),              // 37: teleport.accesslist.v1.DeleteAllAccessListMembersRequest
+	(*ListAccessListReviewsRequest)(nil),                   // 38: teleport.accesslist.v1.ListAccessListReviewsRequest
+	(*ListAccessListReviewsResponse)(nil),                  // 39: teleport.accesslist.v1.ListAccessListReviewsResponse
+	(*ListAllAccessListReviewsRequest)(nil),                // 40: teleport.accesslist.v1.ListAllAccessListReviewsRequest
+	(*ListAllAccessListReviewsResponse)(nil),               // 41: teleport.accesslist.v1.ListAllAccessListReviewsResponse
+	(*CreateAccessListReviewRequest)(nil),                  // 42: teleport.accesslist.v1.CreateAccessListReviewRequest
+	(*CreateAccessListReviewResponse)(nil),                 // 43: teleport.accesslist.v1.CreateAccessListReviewResponse
+	(*DeleteAccessListReviewRequest)(nil),                  // 44: teleport.accesslist.v1.DeleteAccessListReviewRequest
+	(*AccessRequestPromoteRequest)(nil),                    // 45: teleport.accesslist.v1.AccessRequestPromoteRequest
+	(*AccessRequestPromoteResponse)(nil),                   // 46: teleport.accesslist.v1.AccessRequestPromoteResponse
+	(*GetSuggestedAccessListsRequest)(nil),                 // 47: teleport.accesslist.v1.GetSuggestedAccessListsRequest
+	(*GetSuggestedAccessListsResponse)(nil),                // 48: teleport.accesslist.v1.GetSuggestedAccessListsResponse
+	(*ListUserAccessListsRequest)(nil),                     // 49: teleport.accesslist.v1.ListUserAccessListsRequest
+	(*ListUserAccessListsResponse)(nil),                    // 50: teleport.accesslist.v1.ListUserAccessListsResponse
+	(*AccessList)(nil),                                     // 51: teleport.accesslist.v1.AccessList
+	(*types.SortBy)(nil),                                   // 52: types.SortBy
+	(*AccessListGrants)(nil),                               // 53: teleport.accesslist.v1.AccessListGrants
+	(*Member)(nil),                                         // 54: teleport.accesslist.v1.Member
+	(*AccessListOwner)(nil),                                // 55: teleport.accesslist.v1.AccessListOwner
+	(*Review)(nil),                                         // 56: teleport.accesslist.v1.Review
+	(*timestamppb.Timestamp)(nil),                          // 57: google.protobuf.Timestamp
+	(*types.AccessRequestV3)(nil),                          // 58: types.AccessRequestV3
+	(*emptypb.Empty)(nil),                                  // 59: google.protobuf.Empty
 }
 var file_teleport_accesslist_v1_accesslist_service_proto_depIdxs = []int32{
-	40, // 0: teleport.accesslist.v1.GetAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
-	40, // 1: teleport.accesslist.v1.ListAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
-	41, // 2: teleport.accesslist.v1.GetInheritedGrantsResponse.grants:type_name -> teleport.accesslist.v1.AccessListGrants
-	40, // 3: teleport.accesslist.v1.UpsertAccessListRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
-	40, // 4: teleport.accesslist.v1.UpdateAccessListRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
-	40, // 5: teleport.accesslist.v1.GetAccessListsToReviewResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
-	42, // 6: teleport.accesslist.v1.ListAccessListMembersResponse.members:type_name -> teleport.accesslist.v1.Member
-	42, // 7: teleport.accesslist.v1.ListAllAccessListMembersResponse.members:type_name -> teleport.accesslist.v1.Member
-	40, // 8: teleport.accesslist.v1.UpsertAccessListWithMembersRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
-	42, // 9: teleport.accesslist.v1.UpsertAccessListWithMembersRequest.members:type_name -> teleport.accesslist.v1.Member
-	40, // 10: teleport.accesslist.v1.UpsertAccessListWithMembersResponse.access_list:type_name -> teleport.accesslist.v1.AccessList
-	42, // 11: teleport.accesslist.v1.UpsertAccessListWithMembersResponse.members:type_name -> teleport.accesslist.v1.Member
-	43, // 12: teleport.accesslist.v1.GetAccessListOwnersResponse.owners:type_name -> teleport.accesslist.v1.AccessListOwner
-	42, // 13: teleport.accesslist.v1.UpsertAccessListMemberRequest.member:type_name -> teleport.accesslist.v1.Member
-	42, // 14: teleport.accesslist.v1.UpdateAccessListMemberRequest.member:type_name -> teleport.accesslist.v1.Member
-	44, // 15: teleport.accesslist.v1.ListAccessListReviewsResponse.reviews:type_name -> teleport.accesslist.v1.Review
-	44, // 16: teleport.accesslist.v1.ListAllAccessListReviewsResponse.reviews:type_name -> teleport.accesslist.v1.Review
-	44, // 17: teleport.accesslist.v1.CreateAccessListReviewRequest.review:type_name -> teleport.accesslist.v1.Review
-	45, // 18: teleport.accesslist.v1.CreateAccessListReviewResponse.next_audit_date:type_name -> google.protobuf.Timestamp
-	46, // 19: teleport.accesslist.v1.AccessRequestPromoteResponse.access_request:type_name -> types.AccessRequestV3
-	40, // 20: teleport.accesslist.v1.GetSuggestedAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
-	0,  // 21: teleport.accesslist.v1.AccessListService.GetAccessLists:input_type -> teleport.accesslist.v1.GetAccessListsRequest
-	2,  // 22: teleport.accesslist.v1.AccessListService.ListAccessLists:input_type -> teleport.accesslist.v1.ListAccessListsRequest
-	6,  // 23: teleport.accesslist.v1.AccessListService.GetAccessList:input_type -> teleport.accesslist.v1.GetAccessListRequest
-	7,  // 24: teleport.accesslist.v1.AccessListService.UpsertAccessList:input_type -> teleport.accesslist.v1.UpsertAccessListRequest
-	8,  // 25: teleport.accesslist.v1.AccessListService.UpdateAccessList:input_type -> teleport.accesslist.v1.UpdateAccessListRequest
-	9,  // 26: teleport.accesslist.v1.AccessListService.DeleteAccessList:input_type -> teleport.accesslist.v1.DeleteAccessListRequest
-	10, // 27: teleport.accesslist.v1.AccessListService.DeleteAllAccessLists:input_type -> teleport.accesslist.v1.DeleteAllAccessListsRequest
-	11, // 28: teleport.accesslist.v1.AccessListService.GetAccessListsToReview:input_type -> teleport.accesslist.v1.GetAccessListsToReviewRequest
-	13, // 29: teleport.accesslist.v1.AccessListService.CountAccessListMembers:input_type -> teleport.accesslist.v1.CountAccessListMembersRequest
-	15, // 30: teleport.accesslist.v1.AccessListService.ListAccessListMembers:input_type -> teleport.accesslist.v1.ListAccessListMembersRequest
-	17, // 31: teleport.accesslist.v1.AccessListService.ListAllAccessListMembers:input_type -> teleport.accesslist.v1.ListAllAccessListMembersRequest
-	21, // 32: teleport.accesslist.v1.AccessListService.GetAccessListMember:input_type -> teleport.accesslist.v1.GetAccessListMemberRequest
-	22, // 33: teleport.accesslist.v1.AccessListService.GetAccessListOwners:input_type -> teleport.accesslist.v1.GetAccessListOwnersRequest
-	24, // 34: teleport.accesslist.v1.AccessListService.UpsertAccessListMember:input_type -> teleport.accesslist.v1.UpsertAccessListMemberRequest
-	25, // 35: teleport.accesslist.v1.AccessListService.UpdateAccessListMember:input_type -> teleport.accesslist.v1.UpdateAccessListMemberRequest
-	26, // 36: teleport.accesslist.v1.AccessListService.DeleteAccessListMember:input_type -> teleport.accesslist.v1.DeleteAccessListMemberRequest
-	27, // 37: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembersForAccessList:input_type -> teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
-	28, // 38: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembers:input_type -> teleport.accesslist.v1.DeleteAllAccessListMembersRequest
-	19, // 39: teleport.accesslist.v1.AccessListService.UpsertAccessListWithMembers:input_type -> teleport.accesslist.v1.UpsertAccessListWithMembersRequest
-	29, // 40: teleport.accesslist.v1.AccessListService.ListAccessListReviews:input_type -> teleport.accesslist.v1.ListAccessListReviewsRequest
-	31, // 41: teleport.accesslist.v1.AccessListService.ListAllAccessListReviews:input_type -> teleport.accesslist.v1.ListAllAccessListReviewsRequest
-	33, // 42: teleport.accesslist.v1.AccessListService.CreateAccessListReview:input_type -> teleport.accesslist.v1.CreateAccessListReviewRequest
-	35, // 43: teleport.accesslist.v1.AccessListService.DeleteAccessListReview:input_type -> teleport.accesslist.v1.DeleteAccessListReviewRequest
-	36, // 44: teleport.accesslist.v1.AccessListService.AccessRequestPromote:input_type -> teleport.accesslist.v1.AccessRequestPromoteRequest
-	38, // 45: teleport.accesslist.v1.AccessListService.GetSuggestedAccessLists:input_type -> teleport.accesslist.v1.GetSuggestedAccessListsRequest
-	4,  // 46: teleport.accesslist.v1.AccessListService.GetInheritedGrants:input_type -> teleport.accesslist.v1.GetInheritedGrantsRequest
-	1,  // 47: teleport.accesslist.v1.AccessListService.GetAccessLists:output_type -> teleport.accesslist.v1.GetAccessListsResponse
-	3,  // 48: teleport.accesslist.v1.AccessListService.ListAccessLists:output_type -> teleport.accesslist.v1.ListAccessListsResponse
-	40, // 49: teleport.accesslist.v1.AccessListService.GetAccessList:output_type -> teleport.accesslist.v1.AccessList
-	40, // 50: teleport.accesslist.v1.AccessListService.UpsertAccessList:output_type -> teleport.accesslist.v1.AccessList
-	40, // 51: teleport.accesslist.v1.AccessListService.UpdateAccessList:output_type -> teleport.accesslist.v1.AccessList
-	47, // 52: teleport.accesslist.v1.AccessListService.DeleteAccessList:output_type -> google.protobuf.Empty
-	47, // 53: teleport.accesslist.v1.AccessListService.DeleteAllAccessLists:output_type -> google.protobuf.Empty
-	12, // 54: teleport.accesslist.v1.AccessListService.GetAccessListsToReview:output_type -> teleport.accesslist.v1.GetAccessListsToReviewResponse
-	14, // 55: teleport.accesslist.v1.AccessListService.CountAccessListMembers:output_type -> teleport.accesslist.v1.CountAccessListMembersResponse
-	16, // 56: teleport.accesslist.v1.AccessListService.ListAccessListMembers:output_type -> teleport.accesslist.v1.ListAccessListMembersResponse
-	18, // 57: teleport.accesslist.v1.AccessListService.ListAllAccessListMembers:output_type -> teleport.accesslist.v1.ListAllAccessListMembersResponse
-	42, // 58: teleport.accesslist.v1.AccessListService.GetAccessListMember:output_type -> teleport.accesslist.v1.Member
-	23, // 59: teleport.accesslist.v1.AccessListService.GetAccessListOwners:output_type -> teleport.accesslist.v1.GetAccessListOwnersResponse
-	42, // 60: teleport.accesslist.v1.AccessListService.UpsertAccessListMember:output_type -> teleport.accesslist.v1.Member
-	42, // 61: teleport.accesslist.v1.AccessListService.UpdateAccessListMember:output_type -> teleport.accesslist.v1.Member
-	47, // 62: teleport.accesslist.v1.AccessListService.DeleteAccessListMember:output_type -> google.protobuf.Empty
-	47, // 63: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembersForAccessList:output_type -> google.protobuf.Empty
-	47, // 64: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembers:output_type -> google.protobuf.Empty
-	20, // 65: teleport.accesslist.v1.AccessListService.UpsertAccessListWithMembers:output_type -> teleport.accesslist.v1.UpsertAccessListWithMembersResponse
-	30, // 66: teleport.accesslist.v1.AccessListService.ListAccessListReviews:output_type -> teleport.accesslist.v1.ListAccessListReviewsResponse
-	32, // 67: teleport.accesslist.v1.AccessListService.ListAllAccessListReviews:output_type -> teleport.accesslist.v1.ListAllAccessListReviewsResponse
-	34, // 68: teleport.accesslist.v1.AccessListService.CreateAccessListReview:output_type -> teleport.accesslist.v1.CreateAccessListReviewResponse
-	47, // 69: teleport.accesslist.v1.AccessListService.DeleteAccessListReview:output_type -> google.protobuf.Empty
-	37, // 70: teleport.accesslist.v1.AccessListService.AccessRequestPromote:output_type -> teleport.accesslist.v1.AccessRequestPromoteResponse
-	39, // 71: teleport.accesslist.v1.AccessListService.GetSuggestedAccessLists:output_type -> teleport.accesslist.v1.GetSuggestedAccessListsResponse
-	5,  // 72: teleport.accesslist.v1.AccessListService.GetInheritedGrants:output_type -> teleport.accesslist.v1.GetInheritedGrantsResponse
-	47, // [47:73] is the sub-list for method output_type
-	21, // [21:47] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	21, // [21:21] is the sub-list for extension extendee
-	0,  // [0:21] is the sub-list for field type_name
+	51, // 0: teleport.accesslist.v1.GetAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	51, // 1: teleport.accesslist.v1.ListAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	52, // 2: teleport.accesslist.v1.ListAccessListsV2Request.sort_by:type_name -> types.SortBy
+	5,  // 3: teleport.accesslist.v1.ListAccessListsV2Request.filter:type_name -> teleport.accesslist.v1.AccessListsFilter
+	51, // 4: teleport.accesslist.v1.ListAccessListsV2Response.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	53, // 5: teleport.accesslist.v1.GetInheritedGrantsResponse.grants:type_name -> teleport.accesslist.v1.AccessListGrants
+	51, // 6: teleport.accesslist.v1.UpsertAccessListRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
+	51, // 7: teleport.accesslist.v1.UpdateAccessListRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
+	51, // 8: teleport.accesslist.v1.GetAccessListsToReviewResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	54, // 9: teleport.accesslist.v1.ListAccessListMembersResponse.members:type_name -> teleport.accesslist.v1.Member
+	54, // 10: teleport.accesslist.v1.ListAllAccessListMembersResponse.members:type_name -> teleport.accesslist.v1.Member
+	51, // 11: teleport.accesslist.v1.UpsertAccessListWithMembersRequest.access_list:type_name -> teleport.accesslist.v1.AccessList
+	54, // 12: teleport.accesslist.v1.UpsertAccessListWithMembersRequest.members:type_name -> teleport.accesslist.v1.Member
+	51, // 13: teleport.accesslist.v1.UpsertAccessListWithMembersResponse.access_list:type_name -> teleport.accesslist.v1.AccessList
+	54, // 14: teleport.accesslist.v1.UpsertAccessListWithMembersResponse.members:type_name -> teleport.accesslist.v1.Member
+	54, // 15: teleport.accesslist.v1.GetStaticAccessListMemberResponse.member:type_name -> teleport.accesslist.v1.Member
+	55, // 16: teleport.accesslist.v1.GetAccessListOwnersResponse.owners:type_name -> teleport.accesslist.v1.AccessListOwner
+	54, // 17: teleport.accesslist.v1.UpsertAccessListMemberRequest.member:type_name -> teleport.accesslist.v1.Member
+	54, // 18: teleport.accesslist.v1.UpsertStaticAccessListMemberRequest.member:type_name -> teleport.accesslist.v1.Member
+	54, // 19: teleport.accesslist.v1.UpsertStaticAccessListMemberResponse.member:type_name -> teleport.accesslist.v1.Member
+	54, // 20: teleport.accesslist.v1.UpdateAccessListMemberRequest.member:type_name -> teleport.accesslist.v1.Member
+	56, // 21: teleport.accesslist.v1.ListAccessListReviewsResponse.reviews:type_name -> teleport.accesslist.v1.Review
+	56, // 22: teleport.accesslist.v1.ListAllAccessListReviewsResponse.reviews:type_name -> teleport.accesslist.v1.Review
+	56, // 23: teleport.accesslist.v1.CreateAccessListReviewRequest.review:type_name -> teleport.accesslist.v1.Review
+	57, // 24: teleport.accesslist.v1.CreateAccessListReviewResponse.next_audit_date:type_name -> google.protobuf.Timestamp
+	58, // 25: teleport.accesslist.v1.AccessRequestPromoteResponse.access_request:type_name -> types.AccessRequestV3
+	51, // 26: teleport.accesslist.v1.GetSuggestedAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	51, // 27: teleport.accesslist.v1.ListUserAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	0,  // 28: teleport.accesslist.v1.AccessListService.GetAccessLists:input_type -> teleport.accesslist.v1.GetAccessListsRequest
+	2,  // 29: teleport.accesslist.v1.AccessListService.ListAccessLists:input_type -> teleport.accesslist.v1.ListAccessListsRequest
+	4,  // 30: teleport.accesslist.v1.AccessListService.ListAccessListsV2:input_type -> teleport.accesslist.v1.ListAccessListsV2Request
+	9,  // 31: teleport.accesslist.v1.AccessListService.GetAccessList:input_type -> teleport.accesslist.v1.GetAccessListRequest
+	10, // 32: teleport.accesslist.v1.AccessListService.UpsertAccessList:input_type -> teleport.accesslist.v1.UpsertAccessListRequest
+	11, // 33: teleport.accesslist.v1.AccessListService.UpdateAccessList:input_type -> teleport.accesslist.v1.UpdateAccessListRequest
+	12, // 34: teleport.accesslist.v1.AccessListService.DeleteAccessList:input_type -> teleport.accesslist.v1.DeleteAccessListRequest
+	13, // 35: teleport.accesslist.v1.AccessListService.DeleteAllAccessLists:input_type -> teleport.accesslist.v1.DeleteAllAccessListsRequest
+	14, // 36: teleport.accesslist.v1.AccessListService.GetAccessListsToReview:input_type -> teleport.accesslist.v1.GetAccessListsToReviewRequest
+	16, // 37: teleport.accesslist.v1.AccessListService.CountAccessListMembers:input_type -> teleport.accesslist.v1.CountAccessListMembersRequest
+	18, // 38: teleport.accesslist.v1.AccessListService.ListAccessListMembers:input_type -> teleport.accesslist.v1.ListAccessListMembersRequest
+	20, // 39: teleport.accesslist.v1.AccessListService.ListAllAccessListMembers:input_type -> teleport.accesslist.v1.ListAllAccessListMembersRequest
+	24, // 40: teleport.accesslist.v1.AccessListService.GetAccessListMember:input_type -> teleport.accesslist.v1.GetAccessListMemberRequest
+	25, // 41: teleport.accesslist.v1.AccessListService.GetStaticAccessListMember:input_type -> teleport.accesslist.v1.GetStaticAccessListMemberRequest
+	27, // 42: teleport.accesslist.v1.AccessListService.GetAccessListOwners:input_type -> teleport.accesslist.v1.GetAccessListOwnersRequest
+	29, // 43: teleport.accesslist.v1.AccessListService.UpsertAccessListMember:input_type -> teleport.accesslist.v1.UpsertAccessListMemberRequest
+	30, // 44: teleport.accesslist.v1.AccessListService.UpsertStaticAccessListMember:input_type -> teleport.accesslist.v1.UpsertStaticAccessListMemberRequest
+	32, // 45: teleport.accesslist.v1.AccessListService.UpdateAccessListMember:input_type -> teleport.accesslist.v1.UpdateAccessListMemberRequest
+	33, // 46: teleport.accesslist.v1.AccessListService.DeleteAccessListMember:input_type -> teleport.accesslist.v1.DeleteAccessListMemberRequest
+	34, // 47: teleport.accesslist.v1.AccessListService.DeleteStaticAccessListMember:input_type -> teleport.accesslist.v1.DeleteStaticAccessListMemberRequest
+	36, // 48: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembersForAccessList:input_type -> teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
+	37, // 49: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembers:input_type -> teleport.accesslist.v1.DeleteAllAccessListMembersRequest
+	22, // 50: teleport.accesslist.v1.AccessListService.UpsertAccessListWithMembers:input_type -> teleport.accesslist.v1.UpsertAccessListWithMembersRequest
+	38, // 51: teleport.accesslist.v1.AccessListService.ListAccessListReviews:input_type -> teleport.accesslist.v1.ListAccessListReviewsRequest
+	40, // 52: teleport.accesslist.v1.AccessListService.ListAllAccessListReviews:input_type -> teleport.accesslist.v1.ListAllAccessListReviewsRequest
+	42, // 53: teleport.accesslist.v1.AccessListService.CreateAccessListReview:input_type -> teleport.accesslist.v1.CreateAccessListReviewRequest
+	44, // 54: teleport.accesslist.v1.AccessListService.DeleteAccessListReview:input_type -> teleport.accesslist.v1.DeleteAccessListReviewRequest
+	45, // 55: teleport.accesslist.v1.AccessListService.AccessRequestPromote:input_type -> teleport.accesslist.v1.AccessRequestPromoteRequest
+	47, // 56: teleport.accesslist.v1.AccessListService.GetSuggestedAccessLists:input_type -> teleport.accesslist.v1.GetSuggestedAccessListsRequest
+	7,  // 57: teleport.accesslist.v1.AccessListService.GetInheritedGrants:input_type -> teleport.accesslist.v1.GetInheritedGrantsRequest
+	49, // 58: teleport.accesslist.v1.AccessListService.ListUserAccessLists:input_type -> teleport.accesslist.v1.ListUserAccessListsRequest
+	1,  // 59: teleport.accesslist.v1.AccessListService.GetAccessLists:output_type -> teleport.accesslist.v1.GetAccessListsResponse
+	3,  // 60: teleport.accesslist.v1.AccessListService.ListAccessLists:output_type -> teleport.accesslist.v1.ListAccessListsResponse
+	6,  // 61: teleport.accesslist.v1.AccessListService.ListAccessListsV2:output_type -> teleport.accesslist.v1.ListAccessListsV2Response
+	51, // 62: teleport.accesslist.v1.AccessListService.GetAccessList:output_type -> teleport.accesslist.v1.AccessList
+	51, // 63: teleport.accesslist.v1.AccessListService.UpsertAccessList:output_type -> teleport.accesslist.v1.AccessList
+	51, // 64: teleport.accesslist.v1.AccessListService.UpdateAccessList:output_type -> teleport.accesslist.v1.AccessList
+	59, // 65: teleport.accesslist.v1.AccessListService.DeleteAccessList:output_type -> google.protobuf.Empty
+	59, // 66: teleport.accesslist.v1.AccessListService.DeleteAllAccessLists:output_type -> google.protobuf.Empty
+	15, // 67: teleport.accesslist.v1.AccessListService.GetAccessListsToReview:output_type -> teleport.accesslist.v1.GetAccessListsToReviewResponse
+	17, // 68: teleport.accesslist.v1.AccessListService.CountAccessListMembers:output_type -> teleport.accesslist.v1.CountAccessListMembersResponse
+	19, // 69: teleport.accesslist.v1.AccessListService.ListAccessListMembers:output_type -> teleport.accesslist.v1.ListAccessListMembersResponse
+	21, // 70: teleport.accesslist.v1.AccessListService.ListAllAccessListMembers:output_type -> teleport.accesslist.v1.ListAllAccessListMembersResponse
+	54, // 71: teleport.accesslist.v1.AccessListService.GetAccessListMember:output_type -> teleport.accesslist.v1.Member
+	26, // 72: teleport.accesslist.v1.AccessListService.GetStaticAccessListMember:output_type -> teleport.accesslist.v1.GetStaticAccessListMemberResponse
+	28, // 73: teleport.accesslist.v1.AccessListService.GetAccessListOwners:output_type -> teleport.accesslist.v1.GetAccessListOwnersResponse
+	54, // 74: teleport.accesslist.v1.AccessListService.UpsertAccessListMember:output_type -> teleport.accesslist.v1.Member
+	31, // 75: teleport.accesslist.v1.AccessListService.UpsertStaticAccessListMember:output_type -> teleport.accesslist.v1.UpsertStaticAccessListMemberResponse
+	54, // 76: teleport.accesslist.v1.AccessListService.UpdateAccessListMember:output_type -> teleport.accesslist.v1.Member
+	59, // 77: teleport.accesslist.v1.AccessListService.DeleteAccessListMember:output_type -> google.protobuf.Empty
+	35, // 78: teleport.accesslist.v1.AccessListService.DeleteStaticAccessListMember:output_type -> teleport.accesslist.v1.DeleteStaticAccessListMemberResponse
+	59, // 79: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembersForAccessList:output_type -> google.protobuf.Empty
+	59, // 80: teleport.accesslist.v1.AccessListService.DeleteAllAccessListMembers:output_type -> google.protobuf.Empty
+	23, // 81: teleport.accesslist.v1.AccessListService.UpsertAccessListWithMembers:output_type -> teleport.accesslist.v1.UpsertAccessListWithMembersResponse
+	39, // 82: teleport.accesslist.v1.AccessListService.ListAccessListReviews:output_type -> teleport.accesslist.v1.ListAccessListReviewsResponse
+	41, // 83: teleport.accesslist.v1.AccessListService.ListAllAccessListReviews:output_type -> teleport.accesslist.v1.ListAllAccessListReviewsResponse
+	43, // 84: teleport.accesslist.v1.AccessListService.CreateAccessListReview:output_type -> teleport.accesslist.v1.CreateAccessListReviewResponse
+	59, // 85: teleport.accesslist.v1.AccessListService.DeleteAccessListReview:output_type -> google.protobuf.Empty
+	46, // 86: teleport.accesslist.v1.AccessListService.AccessRequestPromote:output_type -> teleport.accesslist.v1.AccessRequestPromoteResponse
+	48, // 87: teleport.accesslist.v1.AccessListService.GetSuggestedAccessLists:output_type -> teleport.accesslist.v1.GetSuggestedAccessListsResponse
+	8,  // 88: teleport.accesslist.v1.AccessListService.GetInheritedGrants:output_type -> teleport.accesslist.v1.GetInheritedGrantsResponse
+	50, // 89: teleport.accesslist.v1.AccessListService.ListUserAccessLists:output_type -> teleport.accesslist.v1.ListUserAccessListsResponse
+	59, // [59:90] is the sub-list for method output_type
+	28, // [28:59] is the sub-list for method input_type
+	28, // [28:28] is the sub-list for extension type_name
+	28, // [28:28] is the sub-list for extension extendee
+	0,  // [0:28] is the sub-list for field type_name
 }
 
 func init() { file_teleport_accesslist_v1_accesslist_service_proto_init() }
@@ -2370,7 +3066,7 @@ func file_teleport_accesslist_v1_accesslist_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_accesslist_v1_accesslist_service_proto_rawDesc), len(file_teleport_accesslist_v1_accesslist_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   40,
+			NumMessages:   51,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
index 3bdae0029e54f..7e16340b3d4a1 100644
--- a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
@@ -36,6 +36,7 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	AccessListService_GetAccessLists_FullMethodName                          = "/teleport.accesslist.v1.AccessListService/GetAccessLists"
 	AccessListService_ListAccessLists_FullMethodName                         = "/teleport.accesslist.v1.AccessListService/ListAccessLists"
+	AccessListService_ListAccessListsV2_FullMethodName                       = "/teleport.accesslist.v1.AccessListService/ListAccessListsV2"
 	AccessListService_GetAccessList_FullMethodName                           = "/teleport.accesslist.v1.AccessListService/GetAccessList"
 	AccessListService_UpsertAccessList_FullMethodName                        = "/teleport.accesslist.v1.AccessListService/UpsertAccessList"
 	AccessListService_UpdateAccessList_FullMethodName                        = "/teleport.accesslist.v1.AccessListService/UpdateAccessList"
@@ -46,10 +47,13 @@ const (
 	AccessListService_ListAccessListMembers_FullMethodName                   = "/teleport.accesslist.v1.AccessListService/ListAccessListMembers"
 	AccessListService_ListAllAccessListMembers_FullMethodName                = "/teleport.accesslist.v1.AccessListService/ListAllAccessListMembers"
 	AccessListService_GetAccessListMember_FullMethodName                     = "/teleport.accesslist.v1.AccessListService/GetAccessListMember"
+	AccessListService_GetStaticAccessListMember_FullMethodName               = "/teleport.accesslist.v1.AccessListService/GetStaticAccessListMember"
 	AccessListService_GetAccessListOwners_FullMethodName                     = "/teleport.accesslist.v1.AccessListService/GetAccessListOwners"
 	AccessListService_UpsertAccessListMember_FullMethodName                  = "/teleport.accesslist.v1.AccessListService/UpsertAccessListMember"
+	AccessListService_UpsertStaticAccessListMember_FullMethodName            = "/teleport.accesslist.v1.AccessListService/UpsertStaticAccessListMember"
 	AccessListService_UpdateAccessListMember_FullMethodName                  = "/teleport.accesslist.v1.AccessListService/UpdateAccessListMember"
 	AccessListService_DeleteAccessListMember_FullMethodName                  = "/teleport.accesslist.v1.AccessListService/DeleteAccessListMember"
+	AccessListService_DeleteStaticAccessListMember_FullMethodName            = "/teleport.accesslist.v1.AccessListService/DeleteStaticAccessListMember"
 	AccessListService_DeleteAllAccessListMembersForAccessList_FullMethodName = "/teleport.accesslist.v1.AccessListService/DeleteAllAccessListMembersForAccessList"
 	AccessListService_DeleteAllAccessListMembers_FullMethodName              = "/teleport.accesslist.v1.AccessListService/DeleteAllAccessListMembers"
 	AccessListService_UpsertAccessListWithMembers_FullMethodName             = "/teleport.accesslist.v1.AccessListService/UpsertAccessListWithMembers"
@@ -60,6 +64,7 @@ const (
 	AccessListService_AccessRequestPromote_FullMethodName                    = "/teleport.accesslist.v1.AccessListService/AccessRequestPromote"
 	AccessListService_GetSuggestedAccessLists_FullMethodName                 = "/teleport.accesslist.v1.AccessListService/GetSuggestedAccessLists"
 	AccessListService_GetInheritedGrants_FullMethodName                      = "/teleport.accesslist.v1.AccessListService/GetInheritedGrants"
+	AccessListService_ListUserAccessLists_FullMethodName                     = "/teleport.accesslist.v1.AccessListService/ListUserAccessLists"
 )
 
 // AccessListServiceClient is the client API for AccessListService service.
@@ -70,8 +75,12 @@ const (
 type AccessListServiceClient interface {
 	// GetAccessLists returns a list of all access lists.
 	GetAccessLists(ctx context.Context, in *GetAccessListsRequest, opts ...grpc.CallOption) (*GetAccessListsResponse, error)
+	// Deprecated: Do not use.
 	// ListAccessLists returns a paginated list of all access lists.
+	// Deprecated: Use ListAccessListsV2 instead.
 	ListAccessLists(ctx context.Context, in *ListAccessListsRequest, opts ...grpc.CallOption) (*ListAccessListsResponse, error)
+	// ListAccessListsV2 returns a paginated, filtered, and sorted list of all access lists.
+	ListAccessListsV2(ctx context.Context, in *ListAccessListsV2Request, opts ...grpc.CallOption) (*ListAccessListsV2Response, error)
 	// GetAccessList returns the specified access list resource.
 	GetAccessList(ctx context.Context, in *GetAccessListRequest, opts ...grpc.CallOption) (*AccessList, error)
 	// UpsertAccessList creates or updates an access list resource.
@@ -95,16 +104,28 @@ type AccessListServiceClient interface {
 	ListAllAccessListMembers(ctx context.Context, in *ListAllAccessListMembersRequest, opts ...grpc.CallOption) (*ListAllAccessListMembersResponse, error)
 	// GetAccessListMember returns the specified access list member resource.
 	GetAccessListMember(ctx context.Context, in *GetAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error)
+	// GetStaticAccessListMember returns the specified access_list_member resource. If returns error
+	// if the target access_list is not of type static.  This API is there for the IaC tools to
+	// prevent them from making changes to members of dynamic access lists.
+	GetStaticAccessListMember(ctx context.Context, in *GetStaticAccessListMemberRequest, opts ...grpc.CallOption) (*GetStaticAccessListMemberResponse, error)
 	// GetAccessListOwners returns a list of all owners in an Access List,
 	// including those inherited from nested Access Lists.
 	GetAccessListOwners(ctx context.Context, in *GetAccessListOwnersRequest, opts ...grpc.CallOption) (*GetAccessListOwnersResponse, error)
 	// UpsertAccessListMember creates or updates an access list member resource.
 	UpsertAccessListMember(ctx context.Context, in *UpsertAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error)
+	// UpsertStaticAccessListMember creates or updates an access_list_member resource. It returns
+	// error and does nothing if the target access_list is not of type static. This API is there for
+	// the IaC tools to prevent them from making changes to members of dynamic access lists.
+	UpsertStaticAccessListMember(ctx context.Context, in *UpsertStaticAccessListMemberRequest, opts ...grpc.CallOption) (*UpsertStaticAccessListMemberResponse, error)
 	// UpdateAccessListMember conditionally updates an access list member resource.
 	UpdateAccessListMember(ctx context.Context, in *UpdateAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error)
 	// DeleteAccessListMember hard deletes the specified access list member
 	// resource.
 	DeleteAccessListMember(ctx context.Context, in *DeleteAccessListMemberRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// DeleteStaticAccessListMember hard deletes the specified access_list_member. It returns error
+	// and does nothing if the target access_list is not of static type. This API is there for the
+	// IaC tools to prevent them from making changes to members of dynamic access lists.
+	DeleteStaticAccessListMember(ctx context.Context, in *DeleteStaticAccessListMemberRequest, opts ...grpc.CallOption) (*DeleteStaticAccessListMemberResponse, error)
 	// DeleteAllAccessListMembers hard deletes all access list members for an
 	// access list.
 	DeleteAllAccessListMembersForAccessList(ctx context.Context, in *DeleteAllAccessListMembersForAccessListRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -132,6 +153,9 @@ type AccessListServiceClient interface {
 	GetSuggestedAccessLists(ctx context.Context, in *GetSuggestedAccessListsRequest, opts ...grpc.CallOption) (*GetSuggestedAccessListsResponse, error)
 	// GetInheritedGrants returns the inherited grants for an access list.
 	GetInheritedGrants(ctx context.Context, in *GetInheritedGrantsRequest, opts ...grpc.CallOption) (*GetInheritedGrantsResponse, error)
+	// ListUserAccessLists returns a paginated list of all access lists where the
+	// user is an owner or member.
+	ListUserAccessLists(ctx context.Context, in *ListUserAccessListsRequest, opts ...grpc.CallOption) (*ListUserAccessListsResponse, error)
 }
 
 type accessListServiceClient struct {
@@ -152,6 +176,7 @@ func (c *accessListServiceClient) GetAccessLists(ctx context.Context, in *GetAcc
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *accessListServiceClient) ListAccessLists(ctx context.Context, in *ListAccessListsRequest, opts ...grpc.CallOption) (*ListAccessListsResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessListsResponse)
@@ -162,6 +187,16 @@ func (c *accessListServiceClient) ListAccessLists(ctx context.Context, in *ListA
 	return out, nil
 }
 
+func (c *accessListServiceClient) ListAccessListsV2(ctx context.Context, in *ListAccessListsV2Request, opts ...grpc.CallOption) (*ListAccessListsV2Response, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAccessListsV2Response)
+	err := c.cc.Invoke(ctx, AccessListService_ListAccessListsV2_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *accessListServiceClient) GetAccessList(ctx context.Context, in *GetAccessListRequest, opts ...grpc.CallOption) (*AccessList, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessList)
@@ -262,6 +297,16 @@ func (c *accessListServiceClient) GetAccessListMember(ctx context.Context, in *G
 	return out, nil
 }
 
+func (c *accessListServiceClient) GetStaticAccessListMember(ctx context.Context, in *GetStaticAccessListMemberRequest, opts ...grpc.CallOption) (*GetStaticAccessListMemberResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetStaticAccessListMemberResponse)
+	err := c.cc.Invoke(ctx, AccessListService_GetStaticAccessListMember_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *accessListServiceClient) GetAccessListOwners(ctx context.Context, in *GetAccessListOwnersRequest, opts ...grpc.CallOption) (*GetAccessListOwnersResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAccessListOwnersResponse)
@@ -282,6 +327,16 @@ func (c *accessListServiceClient) UpsertAccessListMember(ctx context.Context, in
 	return out, nil
 }
 
+func (c *accessListServiceClient) UpsertStaticAccessListMember(ctx context.Context, in *UpsertStaticAccessListMemberRequest, opts ...grpc.CallOption) (*UpsertStaticAccessListMemberResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpsertStaticAccessListMemberResponse)
+	err := c.cc.Invoke(ctx, AccessListService_UpsertStaticAccessListMember_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *accessListServiceClient) UpdateAccessListMember(ctx context.Context, in *UpdateAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Member)
@@ -302,6 +357,16 @@ func (c *accessListServiceClient) DeleteAccessListMember(ctx context.Context, in
 	return out, nil
 }
 
+func (c *accessListServiceClient) DeleteStaticAccessListMember(ctx context.Context, in *DeleteStaticAccessListMemberRequest, opts ...grpc.CallOption) (*DeleteStaticAccessListMemberResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteStaticAccessListMemberResponse)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteStaticAccessListMember_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *accessListServiceClient) DeleteAllAccessListMembersForAccessList(ctx context.Context, in *DeleteAllAccessListMembersForAccessListRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -402,6 +467,16 @@ func (c *accessListServiceClient) GetInheritedGrants(ctx context.Context, in *Ge
 	return out, nil
 }
 
+func (c *accessListServiceClient) ListUserAccessLists(ctx context.Context, in *ListUserAccessListsRequest, opts ...grpc.CallOption) (*ListUserAccessListsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListUserAccessListsResponse)
+	err := c.cc.Invoke(ctx, AccessListService_ListUserAccessLists_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AccessListServiceServer is the server API for AccessListService service.
 // All implementations must embed UnimplementedAccessListServiceServer
 // for forward compatibility.
@@ -410,8 +485,12 @@ func (c *accessListServiceClient) GetInheritedGrants(ctx context.Context, in *Ge
 type AccessListServiceServer interface {
 	// GetAccessLists returns a list of all access lists.
 	GetAccessLists(context.Context, *GetAccessListsRequest) (*GetAccessListsResponse, error)
+	// Deprecated: Do not use.
 	// ListAccessLists returns a paginated list of all access lists.
+	// Deprecated: Use ListAccessListsV2 instead.
 	ListAccessLists(context.Context, *ListAccessListsRequest) (*ListAccessListsResponse, error)
+	// ListAccessListsV2 returns a paginated, filtered, and sorted list of all access lists.
+	ListAccessListsV2(context.Context, *ListAccessListsV2Request) (*ListAccessListsV2Response, error)
 	// GetAccessList returns the specified access list resource.
 	GetAccessList(context.Context, *GetAccessListRequest) (*AccessList, error)
 	// UpsertAccessList creates or updates an access list resource.
@@ -435,16 +514,28 @@ type AccessListServiceServer interface {
 	ListAllAccessListMembers(context.Context, *ListAllAccessListMembersRequest) (*ListAllAccessListMembersResponse, error)
 	// GetAccessListMember returns the specified access list member resource.
 	GetAccessListMember(context.Context, *GetAccessListMemberRequest) (*Member, error)
+	// GetStaticAccessListMember returns the specified access_list_member resource. If returns error
+	// if the target access_list is not of type static.  This API is there for the IaC tools to
+	// prevent them from making changes to members of dynamic access lists.
+	GetStaticAccessListMember(context.Context, *GetStaticAccessListMemberRequest) (*GetStaticAccessListMemberResponse, error)
 	// GetAccessListOwners returns a list of all owners in an Access List,
 	// including those inherited from nested Access Lists.
 	GetAccessListOwners(context.Context, *GetAccessListOwnersRequest) (*GetAccessListOwnersResponse, error)
 	// UpsertAccessListMember creates or updates an access list member resource.
 	UpsertAccessListMember(context.Context, *UpsertAccessListMemberRequest) (*Member, error)
+	// UpsertStaticAccessListMember creates or updates an access_list_member resource. It returns
+	// error and does nothing if the target access_list is not of type static. This API is there for
+	// the IaC tools to prevent them from making changes to members of dynamic access lists.
+	UpsertStaticAccessListMember(context.Context, *UpsertStaticAccessListMemberRequest) (*UpsertStaticAccessListMemberResponse, error)
 	// UpdateAccessListMember conditionally updates an access list member resource.
 	UpdateAccessListMember(context.Context, *UpdateAccessListMemberRequest) (*Member, error)
 	// DeleteAccessListMember hard deletes the specified access list member
 	// resource.
 	DeleteAccessListMember(context.Context, *DeleteAccessListMemberRequest) (*emptypb.Empty, error)
+	// DeleteStaticAccessListMember hard deletes the specified access_list_member. It returns error
+	// and does nothing if the target access_list is not of static type. This API is there for the
+	// IaC tools to prevent them from making changes to members of dynamic access lists.
+	DeleteStaticAccessListMember(context.Context, *DeleteStaticAccessListMemberRequest) (*DeleteStaticAccessListMemberResponse, error)
 	// DeleteAllAccessListMembers hard deletes all access list members for an
 	// access list.
 	DeleteAllAccessListMembersForAccessList(context.Context, *DeleteAllAccessListMembersForAccessListRequest) (*emptypb.Empty, error)
@@ -472,6 +563,9 @@ type AccessListServiceServer interface {
 	GetSuggestedAccessLists(context.Context, *GetSuggestedAccessListsRequest) (*GetSuggestedAccessListsResponse, error)
 	// GetInheritedGrants returns the inherited grants for an access list.
 	GetInheritedGrants(context.Context, *GetInheritedGrantsRequest) (*GetInheritedGrantsResponse, error)
+	// ListUserAccessLists returns a paginated list of all access lists where the
+	// user is an owner or member.
+	ListUserAccessLists(context.Context, *ListUserAccessListsRequest) (*ListUserAccessListsResponse, error)
 	mustEmbedUnimplementedAccessListServiceServer()
 }
 
@@ -488,6 +582,9 @@ func (UnimplementedAccessListServiceServer) GetAccessLists(context.Context, *Get
 func (UnimplementedAccessListServiceServer) ListAccessLists(context.Context, *ListAccessListsRequest) (*ListAccessListsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListAccessLists not implemented")
 }
+func (UnimplementedAccessListServiceServer) ListAccessListsV2(context.Context, *ListAccessListsV2Request) (*ListAccessListsV2Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListAccessListsV2 not implemented")
+}
 func (UnimplementedAccessListServiceServer) GetAccessList(context.Context, *GetAccessListRequest) (*AccessList, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAccessList not implemented")
 }
@@ -518,18 +615,27 @@ func (UnimplementedAccessListServiceServer) ListAllAccessListMembers(context.Con
 func (UnimplementedAccessListServiceServer) GetAccessListMember(context.Context, *GetAccessListMemberRequest) (*Member, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAccessListMember not implemented")
 }
+func (UnimplementedAccessListServiceServer) GetStaticAccessListMember(context.Context, *GetStaticAccessListMemberRequest) (*GetStaticAccessListMemberResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetStaticAccessListMember not implemented")
+}
 func (UnimplementedAccessListServiceServer) GetAccessListOwners(context.Context, *GetAccessListOwnersRequest) (*GetAccessListOwnersResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAccessListOwners not implemented")
 }
 func (UnimplementedAccessListServiceServer) UpsertAccessListMember(context.Context, *UpsertAccessListMemberRequest) (*Member, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpsertAccessListMember not implemented")
 }
+func (UnimplementedAccessListServiceServer) UpsertStaticAccessListMember(context.Context, *UpsertStaticAccessListMemberRequest) (*UpsertStaticAccessListMemberResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertStaticAccessListMember not implemented")
+}
 func (UnimplementedAccessListServiceServer) UpdateAccessListMember(context.Context, *UpdateAccessListMemberRequest) (*Member, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateAccessListMember not implemented")
 }
 func (UnimplementedAccessListServiceServer) DeleteAccessListMember(context.Context, *DeleteAccessListMemberRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteAccessListMember not implemented")
 }
+func (UnimplementedAccessListServiceServer) DeleteStaticAccessListMember(context.Context, *DeleteStaticAccessListMemberRequest) (*DeleteStaticAccessListMemberResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteStaticAccessListMember not implemented")
+}
 func (UnimplementedAccessListServiceServer) DeleteAllAccessListMembersForAccessList(context.Context, *DeleteAllAccessListMembersForAccessListRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllAccessListMembersForAccessList not implemented")
 }
@@ -560,6 +666,9 @@ func (UnimplementedAccessListServiceServer) GetSuggestedAccessLists(context.Cont
 func (UnimplementedAccessListServiceServer) GetInheritedGrants(context.Context, *GetInheritedGrantsRequest) (*GetInheritedGrantsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetInheritedGrants not implemented")
 }
+func (UnimplementedAccessListServiceServer) ListUserAccessLists(context.Context, *ListUserAccessListsRequest) (*ListUserAccessListsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListUserAccessLists not implemented")
+}
 func (UnimplementedAccessListServiceServer) mustEmbedUnimplementedAccessListServiceServer() {}
 func (UnimplementedAccessListServiceServer) testEmbeddedByValue()                           {}
 
@@ -617,6 +726,24 @@ func _AccessListService_ListAccessLists_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccessListService_ListAccessListsV2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAccessListsV2Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccessListServiceServer).ListAccessListsV2(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AccessListService_ListAccessListsV2_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccessListServiceServer).ListAccessListsV2(ctx, req.(*ListAccessListsV2Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AccessListService_GetAccessList_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetAccessListRequest)
 	if err := dec(in); err != nil {
@@ -797,6 +924,24 @@ func _AccessListService_GetAccessListMember_Handler(srv interface{}, ctx context
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccessListService_GetStaticAccessListMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetStaticAccessListMemberRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccessListServiceServer).GetStaticAccessListMember(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AccessListService_GetStaticAccessListMember_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccessListServiceServer).GetStaticAccessListMember(ctx, req.(*GetStaticAccessListMemberRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AccessListService_GetAccessListOwners_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetAccessListOwnersRequest)
 	if err := dec(in); err != nil {
@@ -833,6 +978,24 @@ func _AccessListService_UpsertAccessListMember_Handler(srv interface{}, ctx cont
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccessListService_UpsertStaticAccessListMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertStaticAccessListMemberRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccessListServiceServer).UpsertStaticAccessListMember(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AccessListService_UpsertStaticAccessListMember_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccessListServiceServer).UpsertStaticAccessListMember(ctx, req.(*UpsertStaticAccessListMemberRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AccessListService_UpdateAccessListMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(UpdateAccessListMemberRequest)
 	if err := dec(in); err != nil {
@@ -869,6 +1032,24 @@ func _AccessListService_DeleteAccessListMember_Handler(srv interface{}, ctx cont
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccessListService_DeleteStaticAccessListMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteStaticAccessListMemberRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccessListServiceServer).DeleteStaticAccessListMember(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AccessListService_DeleteStaticAccessListMember_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccessListServiceServer).DeleteStaticAccessListMember(ctx, req.(*DeleteStaticAccessListMemberRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AccessListService_DeleteAllAccessListMembersForAccessList_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DeleteAllAccessListMembersForAccessListRequest)
 	if err := dec(in); err != nil {
@@ -1049,6 +1230,24 @@ func _AccessListService_GetInheritedGrants_Handler(srv interface{}, ctx context.
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccessListService_ListUserAccessLists_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListUserAccessListsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccessListServiceServer).ListUserAccessLists(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AccessListService_ListUserAccessLists_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccessListServiceServer).ListUserAccessLists(ctx, req.(*ListUserAccessListsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AccessListService_ServiceDesc is the grpc.ServiceDesc for AccessListService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1064,6 +1263,10 @@ var AccessListService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListAccessLists",
 			Handler:    _AccessListService_ListAccessLists_Handler,
 		},
+		{
+			MethodName: "ListAccessListsV2",
+			Handler:    _AccessListService_ListAccessListsV2_Handler,
+		},
 		{
 			MethodName: "GetAccessList",
 			Handler:    _AccessListService_GetAccessList_Handler,
@@ -1104,6 +1307,10 @@ var AccessListService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetAccessListMember",
 			Handler:    _AccessListService_GetAccessListMember_Handler,
 		},
+		{
+			MethodName: "GetStaticAccessListMember",
+			Handler:    _AccessListService_GetStaticAccessListMember_Handler,
+		},
 		{
 			MethodName: "GetAccessListOwners",
 			Handler:    _AccessListService_GetAccessListOwners_Handler,
@@ -1112,6 +1319,10 @@ var AccessListService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "UpsertAccessListMember",
 			Handler:    _AccessListService_UpsertAccessListMember_Handler,
 		},
+		{
+			MethodName: "UpsertStaticAccessListMember",
+			Handler:    _AccessListService_UpsertStaticAccessListMember_Handler,
+		},
 		{
 			MethodName: "UpdateAccessListMember",
 			Handler:    _AccessListService_UpdateAccessListMember_Handler,
@@ -1120,6 +1331,10 @@ var AccessListService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteAccessListMember",
 			Handler:    _AccessListService_DeleteAccessListMember_Handler,
 		},
+		{
+			MethodName: "DeleteStaticAccessListMember",
+			Handler:    _AccessListService_DeleteStaticAccessListMember_Handler,
+		},
 		{
 			MethodName: "DeleteAllAccessListMembersForAccessList",
 			Handler:    _AccessListService_DeleteAllAccessListMembersForAccessList_Handler,
@@ -1160,6 +1375,10 @@ var AccessListService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInheritedGrants",
 			Handler:    _AccessListService_GetInheritedGrants_Handler,
 		},
+		{
+			MethodName: "ListUserAccessLists",
+			Handler:    _AccessListService_ListUserAccessLists_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/accesslist/v1/accesslist_service.proto",
diff --git a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules.pb.go b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules.pb.go
index 7d57946e156da..1b443c434790c 100644
--- a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules.pb.go
+++ b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules.proto
 
@@ -135,17 +135,22 @@ type AccessMonitoringRuleSpec struct {
 	// Separate plugins may be used if both notifications and automatic_reviews is
 	// set.
 	Notification *Notification `protobuf:"bytes,4,opt,name=notification,proto3" json:"notification,omitempty"`
-	// automatic_review defines automatic review configurations for access requests.
+	// automatic_review defines automatic review configurations for Access Requests.
 	// Both notification and automatic_review may be set within the same
 	// access_monitoring_rule. If both fields are set, the rule will trigger
 	// both notifications and automatic reviews for the same set of access events.
 	// Separate plugins may be used if both notifications and automatic_reviews is
 	// set.
 	AutomaticReview *AutomaticReview `protobuf:"bytes,6,opt,name=automatic_review,json=automaticReview,proto3" json:"automatic_review,omitempty"`
-	// desired_state defines the desired state of the subject. For access request
+	// desired_state defines the desired state of the subject. For Access Request
 	// subjects, the desired_state may be set to `reviewed` to indicate that the
-	// access request should be automatically reviewed.
-	DesiredState  string `protobuf:"bytes,7,opt,name=desired_state,json=desiredState,proto3" json:"desired_state,omitempty"`
+	// Access Request should be automatically reviewed.
+	DesiredState string `protobuf:"bytes,7,opt,name=desired_state,json=desiredState,proto3" json:"desired_state,omitempty"`
+	// schedules specifies a map of schedules that can be used to configure the
+	// access monitoring rule conditions.
+	//
+	// Available in Teleport v18.2.8 or higher.
+	Schedules     map[string]*Schedule `protobuf:"bytes,8,rep,name=schedules,proto3" json:"schedules,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -222,6 +227,13 @@ func (x *AccessMonitoringRuleSpec) GetDesiredState() string {
 	return ""
 }
 
+func (x *AccessMonitoringRuleSpec) GetSchedules() map[string]*Schedule {
+	if x != nil {
+		return x.Schedules
+	}
+	return nil
+}
+
 // Notification contains configurations for plugin notification rules.
 type Notification struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -334,6 +346,112 @@ func (x *AutomaticReview) GetDecision() string {
 	return ""
 }
 
+// Schedule specifies a schedule that can be used to configure rule conditions.
+type Schedule struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// TimeSchedule specifies an in-line schedule.
+	Time          *TimeSchedule `protobuf:"bytes,1,opt,name=time,proto3" json:"time,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Schedule) Reset() {
+	*x = Schedule{}
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Schedule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Schedule) ProtoMessage() {}
+
+func (x *Schedule) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Schedule.ProtoReflect.Descriptor instead.
+func (*Schedule) Descriptor() ([]byte, []int) {
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Schedule) GetTime() *TimeSchedule {
+	if x != nil {
+		return x.Time
+	}
+	return nil
+}
+
+// TimeSchedule specifies an in-line schedule.
+type TimeSchedule struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Shifts contains a set of shifts that make up the schedule.
+	Shifts []*TimeSchedule_Shift `protobuf:"bytes,1,rep,name=shifts,proto3" json:"shifts,omitempty"`
+	// Timezone specifies the schedule timezone. This field is optional and defaults
+	// to "UTC". Accepted values use timezone locations as defined in the IANA
+	// Time Zone Database, such as "America/Los_Angeles", "Europe/Lisbon", or
+	// "Asia/Singapore".
+	//
+	// See https://data.iana.org/time-zones/tzdb/zone1970.tab for a list of supported values.
+	Timezone      string `protobuf:"bytes,2,opt,name=timezone,proto3" json:"timezone,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TimeSchedule) Reset() {
+	*x = TimeSchedule{}
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TimeSchedule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TimeSchedule) ProtoMessage() {}
+
+func (x *TimeSchedule) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TimeSchedule.ProtoReflect.Descriptor instead.
+func (*TimeSchedule) Descriptor() ([]byte, []int) {
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *TimeSchedule) GetShifts() []*TimeSchedule_Shift {
+	if x != nil {
+		return x.Shifts
+	}
+	return nil
+}
+
+func (x *TimeSchedule) GetTimezone() string {
+	if x != nil {
+		return x.Timezone
+	}
+	return ""
+}
+
 // CreateAccessMonitoringRuleRequest is the request for CreateAccessMonitoringRule.
 type CreateAccessMonitoringRuleRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -345,7 +463,7 @@ type CreateAccessMonitoringRuleRequest struct {
 
 func (x *CreateAccessMonitoringRuleRequest) Reset() {
 	*x = CreateAccessMonitoringRuleRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[4]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -357,7 +475,7 @@ func (x *CreateAccessMonitoringRuleRequest) String() string {
 func (*CreateAccessMonitoringRuleRequest) ProtoMessage() {}
 
 func (x *CreateAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[4]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -370,7 +488,7 @@ func (x *CreateAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use CreateAccessMonitoringRuleRequest.ProtoReflect.Descriptor instead.
 func (*CreateAccessMonitoringRuleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{4}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CreateAccessMonitoringRuleRequest) GetRule() *AccessMonitoringRule {
@@ -391,7 +509,7 @@ type UpdateAccessMonitoringRuleRequest struct {
 
 func (x *UpdateAccessMonitoringRuleRequest) Reset() {
 	*x = UpdateAccessMonitoringRuleRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[5]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -403,7 +521,7 @@ func (x *UpdateAccessMonitoringRuleRequest) String() string {
 func (*UpdateAccessMonitoringRuleRequest) ProtoMessage() {}
 
 func (x *UpdateAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[5]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -416,7 +534,7 @@ func (x *UpdateAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UpdateAccessMonitoringRuleRequest.ProtoReflect.Descriptor instead.
 func (*UpdateAccessMonitoringRuleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{5}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *UpdateAccessMonitoringRuleRequest) GetRule() *AccessMonitoringRule {
@@ -437,7 +555,7 @@ type UpsertAccessMonitoringRuleRequest struct {
 
 func (x *UpsertAccessMonitoringRuleRequest) Reset() {
 	*x = UpsertAccessMonitoringRuleRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[6]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -449,7 +567,7 @@ func (x *UpsertAccessMonitoringRuleRequest) String() string {
 func (*UpsertAccessMonitoringRuleRequest) ProtoMessage() {}
 
 func (x *UpsertAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[6]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -462,7 +580,7 @@ func (x *UpsertAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UpsertAccessMonitoringRuleRequest.ProtoReflect.Descriptor instead.
 func (*UpsertAccessMonitoringRuleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{6}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *UpsertAccessMonitoringRuleRequest) GetRule() *AccessMonitoringRule {
@@ -483,7 +601,7 @@ type GetAccessMonitoringRuleRequest struct {
 
 func (x *GetAccessMonitoringRuleRequest) Reset() {
 	*x = GetAccessMonitoringRuleRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[7]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -495,7 +613,7 @@ func (x *GetAccessMonitoringRuleRequest) String() string {
 func (*GetAccessMonitoringRuleRequest) ProtoMessage() {}
 
 func (x *GetAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[7]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -508,7 +626,7 @@ func (x *GetAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessMonitoringRuleRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessMonitoringRuleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{7}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *GetAccessMonitoringRuleRequest) GetName() string {
@@ -529,7 +647,7 @@ type DeleteAccessMonitoringRuleRequest struct {
 
 func (x *DeleteAccessMonitoringRuleRequest) Reset() {
 	*x = DeleteAccessMonitoringRuleRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[8]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -541,7 +659,7 @@ func (x *DeleteAccessMonitoringRuleRequest) String() string {
 func (*DeleteAccessMonitoringRuleRequest) ProtoMessage() {}
 
 func (x *DeleteAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[8]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -554,7 +672,7 @@ func (x *DeleteAccessMonitoringRuleRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use DeleteAccessMonitoringRuleRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAccessMonitoringRuleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{8}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *DeleteAccessMonitoringRuleRequest) GetName() string {
@@ -578,7 +696,7 @@ type ListAccessMonitoringRulesRequest struct {
 
 func (x *ListAccessMonitoringRulesRequest) Reset() {
 	*x = ListAccessMonitoringRulesRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[9]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -590,7 +708,7 @@ func (x *ListAccessMonitoringRulesRequest) String() string {
 func (*ListAccessMonitoringRulesRequest) ProtoMessage() {}
 
 func (x *ListAccessMonitoringRulesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[9]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -603,7 +721,7 @@ func (x *ListAccessMonitoringRulesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListAccessMonitoringRulesRequest.ProtoReflect.Descriptor instead.
 func (*ListAccessMonitoringRulesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{9}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ListAccessMonitoringRulesRequest) GetPageSize() int64 {
@@ -641,7 +759,7 @@ type ListAccessMonitoringRulesWithFilterRequest struct {
 
 func (x *ListAccessMonitoringRulesWithFilterRequest) Reset() {
 	*x = ListAccessMonitoringRulesWithFilterRequest{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[10]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -653,7 +771,7 @@ func (x *ListAccessMonitoringRulesWithFilterRequest) String() string {
 func (*ListAccessMonitoringRulesWithFilterRequest) ProtoMessage() {}
 
 func (x *ListAccessMonitoringRulesWithFilterRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[10]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -666,7 +784,7 @@ func (x *ListAccessMonitoringRulesWithFilterRequest) ProtoReflect() protoreflect
 
 // Deprecated: Use ListAccessMonitoringRulesWithFilterRequest.ProtoReflect.Descriptor instead.
 func (*ListAccessMonitoringRulesWithFilterRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{10}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ListAccessMonitoringRulesWithFilterRequest) GetPageSize() int64 {
@@ -718,7 +836,7 @@ type ListAccessMonitoringRulesResponse struct {
 
 func (x *ListAccessMonitoringRulesResponse) Reset() {
 	*x = ListAccessMonitoringRulesResponse{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[11]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -730,7 +848,7 @@ func (x *ListAccessMonitoringRulesResponse) String() string {
 func (*ListAccessMonitoringRulesResponse) ProtoMessage() {}
 
 func (x *ListAccessMonitoringRulesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[11]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -743,7 +861,7 @@ func (x *ListAccessMonitoringRulesResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ListAccessMonitoringRulesResponse.ProtoReflect.Descriptor instead.
 func (*ListAccessMonitoringRulesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{11}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *ListAccessMonitoringRulesResponse) GetRules() []*AccessMonitoringRule {
@@ -774,7 +892,7 @@ type ListAccessMonitoringRulesWithFilterResponse struct {
 
 func (x *ListAccessMonitoringRulesWithFilterResponse) Reset() {
 	*x = ListAccessMonitoringRulesWithFilterResponse{}
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[12]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -786,7 +904,7 @@ func (x *ListAccessMonitoringRulesWithFilterResponse) String() string {
 func (*ListAccessMonitoringRulesWithFilterResponse) ProtoMessage() {}
 
 func (x *ListAccessMonitoringRulesWithFilterResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[12]
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -799,7 +917,7 @@ func (x *ListAccessMonitoringRulesWithFilterResponse) ProtoReflect() protoreflec
 
 // Deprecated: Use ListAccessMonitoringRulesWithFilterResponse.ProtoReflect.Descriptor instead.
 func (*ListAccessMonitoringRulesWithFilterResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{12}
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *ListAccessMonitoringRulesWithFilterResponse) GetRules() []*AccessMonitoringRule {
@@ -816,6 +934,70 @@ func (x *ListAccessMonitoringRulesWithFilterResponse) GetNextPageToken() string
 	return ""
 }
 
+// Shift contains the weekday, start time, and end time of a shift.
+type TimeSchedule_Shift struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Weekday specifies the day of the week, e.g., "Sunday", "Monday", "Tuesday".
+	Weekday string `protobuf:"bytes,1,opt,name=weekday,proto3" json:"weekday,omitempty"`
+	// Start specifies the start time in the format HH:MM, e.g., "12:30".
+	Start string `protobuf:"bytes,2,opt,name=start,proto3" json:"start,omitempty"`
+	// End specifies the end time in the format HH:MM, e.g., "12:30".
+	End           string `protobuf:"bytes,3,opt,name=end,proto3" json:"end,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TimeSchedule_Shift) Reset() {
+	*x = TimeSchedule_Shift{}
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TimeSchedule_Shift) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TimeSchedule_Shift) ProtoMessage() {}
+
+func (x *TimeSchedule_Shift) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TimeSchedule_Shift.ProtoReflect.Descriptor instead.
+func (*TimeSchedule_Shift) Descriptor() ([]byte, []int) {
+	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescGZIP(), []int{5, 0}
+}
+
+func (x *TimeSchedule_Shift) GetWeekday() string {
+	if x != nil {
+		return x.Weekday
+	}
+	return ""
+}
+
+func (x *TimeSchedule_Shift) GetStart() string {
+	if x != nil {
+		return x.Start
+	}
+	return ""
+}
+
+func (x *TimeSchedule_Shift) GetEnd() string {
+	if x != nil {
+		return x.End
+	}
+	return ""
+}
+
 var File_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto protoreflect.FileDescriptor
 
 const file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDesc = "" +
@@ -826,14 +1008,18 @@ const file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDe
 	"\x04kind\x18\x02 \x01(\tR\x04kind\x12\x19\n" +
 	"\bsub_kind\x18\x03 \x01(\tR\asubKind\x12\x18\n" +
 	"\aversion\x18\x04 \x01(\tR\aversion\x12O\n" +
-	"\x04spec\x18\x05 \x01(\v2;.teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpecR\x04spec\"\xdf\x02\n" +
+	"\x04spec\x18\x05 \x01(\v2;.teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpecR\x04spec\"\xb4\x04\n" +
 	"\x18AccessMonitoringRuleSpec\x12\x1a\n" +
 	"\bsubjects\x18\x01 \x03(\tR\bsubjects\x12\x16\n" +
 	"\x06states\x18\x02 \x03(\tR\x06states\x12\x1c\n" +
 	"\tcondition\x18\x03 \x01(\tR\tcondition\x12S\n" +
 	"\fnotification\x18\x04 \x01(\v2/.teleport.accessmonitoringrules.v1.NotificationR\fnotification\x12]\n" +
 	"\x10automatic_review\x18\x06 \x01(\v22.teleport.accessmonitoringrules.v1.AutomaticReviewR\x0fautomaticReview\x12#\n" +
-	"\rdesired_state\x18\a \x01(\tR\fdesiredStateJ\x04\b\x05\x10\x06R\x12automatic_approval\"B\n" +
+	"\rdesired_state\x18\a \x01(\tR\fdesiredState\x12h\n" +
+	"\tschedules\x18\b \x03(\v2J.teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.SchedulesEntryR\tschedules\x1ai\n" +
+	"\x0eSchedulesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12A\n" +
+	"\x05value\x18\x02 \x01(\v2+.teleport.accessmonitoringrules.v1.ScheduleR\x05value:\x028\x01J\x04\b\x05\x10\x06R\x12automatic_approval\"B\n" +
 	"\fNotification\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n" +
 	"\n" +
@@ -841,7 +1027,16 @@ const file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDe
 	"recipients\"O\n" +
 	"\x0fAutomaticReview\x12 \n" +
 	"\vintegration\x18\x01 \x01(\tR\vintegration\x12\x1a\n" +
-	"\bdecision\x18\x02 \x01(\tR\bdecision\"p\n" +
+	"\bdecision\x18\x02 \x01(\tR\bdecision\"O\n" +
+	"\bSchedule\x12C\n" +
+	"\x04time\x18\x01 \x01(\v2/.teleport.accessmonitoringrules.v1.TimeScheduleR\x04time\"\xc4\x01\n" +
+	"\fTimeSchedule\x12M\n" +
+	"\x06shifts\x18\x01 \x03(\v25.teleport.accessmonitoringrules.v1.TimeSchedule.ShiftR\x06shifts\x12\x1a\n" +
+	"\btimezone\x18\x02 \x01(\tR\btimezone\x1aI\n" +
+	"\x05Shift\x12\x18\n" +
+	"\aweekday\x18\x01 \x01(\tR\aweekday\x12\x14\n" +
+	"\x05start\x18\x02 \x01(\tR\x05start\x12\x10\n" +
+	"\x03end\x18\x03 \x01(\tR\x03end\"p\n" +
 	"!CreateAccessMonitoringRuleRequest\x12K\n" +
 	"\x04rule\x18\x01 \x01(\v27.teleport.accessmonitoringrules.v1.AccessMonitoringRuleR\x04rule\"p\n" +
 	"!UpdateAccessMonitoringRuleRequest\x12K\n" +
@@ -882,38 +1077,46 @@ func file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDes
 	return file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDescData
 }
 
-var file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
 var file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_goTypes = []any{
 	(*AccessMonitoringRule)(nil),                        // 0: teleport.accessmonitoringrules.v1.AccessMonitoringRule
 	(*AccessMonitoringRuleSpec)(nil),                    // 1: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec
 	(*Notification)(nil),                                // 2: teleport.accessmonitoringrules.v1.Notification
 	(*AutomaticReview)(nil),                             // 3: teleport.accessmonitoringrules.v1.AutomaticReview
-	(*CreateAccessMonitoringRuleRequest)(nil),           // 4: teleport.accessmonitoringrules.v1.CreateAccessMonitoringRuleRequest
-	(*UpdateAccessMonitoringRuleRequest)(nil),           // 5: teleport.accessmonitoringrules.v1.UpdateAccessMonitoringRuleRequest
-	(*UpsertAccessMonitoringRuleRequest)(nil),           // 6: teleport.accessmonitoringrules.v1.UpsertAccessMonitoringRuleRequest
-	(*GetAccessMonitoringRuleRequest)(nil),              // 7: teleport.accessmonitoringrules.v1.GetAccessMonitoringRuleRequest
-	(*DeleteAccessMonitoringRuleRequest)(nil),           // 8: teleport.accessmonitoringrules.v1.DeleteAccessMonitoringRuleRequest
-	(*ListAccessMonitoringRulesRequest)(nil),            // 9: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesRequest
-	(*ListAccessMonitoringRulesWithFilterRequest)(nil),  // 10: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterRequest
-	(*ListAccessMonitoringRulesResponse)(nil),           // 11: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesResponse
-	(*ListAccessMonitoringRulesWithFilterResponse)(nil), // 12: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterResponse
-	(*v1.Metadata)(nil),                                 // 13: teleport.header.v1.Metadata
+	(*Schedule)(nil),                                    // 4: teleport.accessmonitoringrules.v1.Schedule
+	(*TimeSchedule)(nil),                                // 5: teleport.accessmonitoringrules.v1.TimeSchedule
+	(*CreateAccessMonitoringRuleRequest)(nil),           // 6: teleport.accessmonitoringrules.v1.CreateAccessMonitoringRuleRequest
+	(*UpdateAccessMonitoringRuleRequest)(nil),           // 7: teleport.accessmonitoringrules.v1.UpdateAccessMonitoringRuleRequest
+	(*UpsertAccessMonitoringRuleRequest)(nil),           // 8: teleport.accessmonitoringrules.v1.UpsertAccessMonitoringRuleRequest
+	(*GetAccessMonitoringRuleRequest)(nil),              // 9: teleport.accessmonitoringrules.v1.GetAccessMonitoringRuleRequest
+	(*DeleteAccessMonitoringRuleRequest)(nil),           // 10: teleport.accessmonitoringrules.v1.DeleteAccessMonitoringRuleRequest
+	(*ListAccessMonitoringRulesRequest)(nil),            // 11: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesRequest
+	(*ListAccessMonitoringRulesWithFilterRequest)(nil),  // 12: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterRequest
+	(*ListAccessMonitoringRulesResponse)(nil),           // 13: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesResponse
+	(*ListAccessMonitoringRulesWithFilterResponse)(nil), // 14: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterResponse
+	nil,                        // 15: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.SchedulesEntry
+	(*TimeSchedule_Shift)(nil), // 16: teleport.accessmonitoringrules.v1.TimeSchedule.Shift
+	(*v1.Metadata)(nil),        // 17: teleport.header.v1.Metadata
 }
 var file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_depIdxs = []int32{
-	13, // 0: teleport.accessmonitoringrules.v1.AccessMonitoringRule.metadata:type_name -> teleport.header.v1.Metadata
+	17, // 0: teleport.accessmonitoringrules.v1.AccessMonitoringRule.metadata:type_name -> teleport.header.v1.Metadata
 	1,  // 1: teleport.accessmonitoringrules.v1.AccessMonitoringRule.spec:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec
 	2,  // 2: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.notification:type_name -> teleport.accessmonitoringrules.v1.Notification
 	3,  // 3: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.automatic_review:type_name -> teleport.accessmonitoringrules.v1.AutomaticReview
-	0,  // 4: teleport.accessmonitoringrules.v1.CreateAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
-	0,  // 5: teleport.accessmonitoringrules.v1.UpdateAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
-	0,  // 6: teleport.accessmonitoringrules.v1.UpsertAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
-	0,  // 7: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesResponse.rules:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
-	0,  // 8: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterResponse.rules:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
-	9,  // [9:9] is the sub-list for method output_type
-	9,  // [9:9] is the sub-list for method input_type
-	9,  // [9:9] is the sub-list for extension type_name
-	9,  // [9:9] is the sub-list for extension extendee
-	0,  // [0:9] is the sub-list for field type_name
+	15, // 4: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.schedules:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.SchedulesEntry
+	5,  // 5: teleport.accessmonitoringrules.v1.Schedule.time:type_name -> teleport.accessmonitoringrules.v1.TimeSchedule
+	16, // 6: teleport.accessmonitoringrules.v1.TimeSchedule.shifts:type_name -> teleport.accessmonitoringrules.v1.TimeSchedule.Shift
+	0,  // 7: teleport.accessmonitoringrules.v1.CreateAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
+	0,  // 8: teleport.accessmonitoringrules.v1.UpdateAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
+	0,  // 9: teleport.accessmonitoringrules.v1.UpsertAccessMonitoringRuleRequest.rule:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
+	0,  // 10: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesResponse.rules:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
+	0,  // 11: teleport.accessmonitoringrules.v1.ListAccessMonitoringRulesWithFilterResponse.rules:type_name -> teleport.accessmonitoringrules.v1.AccessMonitoringRule
+	4,  // 12: teleport.accessmonitoringrules.v1.AccessMonitoringRuleSpec.SchedulesEntry.value:type_name -> teleport.accessmonitoringrules.v1.Schedule
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_init() }
@@ -927,7 +1130,7 @@ func file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_init()
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDesc), len(file_teleport_accessmonitoringrules_v1_access_monitoring_rules_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   13,
+			NumMessages:   17,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service.pb.go b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service.pb.go
index 4366fe2636b09..78f130a5eb6b0 100644
--- a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service.pb.go
+++ b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules_service.proto
 
diff --git a/api/gen/proto/go/teleport/auditlog/v1/auditlog.pb.go b/api/gen/proto/go/teleport/auditlog/v1/auditlog.pb.go
index deeacaf1a7172..95675762e0d3e 100644
--- a/api/gen/proto/go/teleport/auditlog/v1/auditlog.pb.go
+++ b/api/gen/proto/go/teleport/auditlog/v1/auditlog.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/auditlog/v1/auditlog.proto
 
diff --git a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate.pb.go b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate.pb.go
index cb963a7017a38..4781f38268b8a 100644
--- a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate.pb.go
+++ b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate.proto
 
@@ -55,6 +55,9 @@ const (
 	// AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK represents that the group has been rolled back.
 	// New agents should run v1, existing agents should update to v1.
 	AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK AutoUpdateAgentGroupState = 4
+	// AUTO_UPDATE_AGENT_GROUP_STATE_CANARY represents that the group is updating a few canary nodes, but that most nodes
+	// have not started updating yet.
+	AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY AutoUpdateAgentGroupState = 5
 )
 
 // Enum value maps for AutoUpdateAgentGroupState.
@@ -65,6 +68,7 @@ var (
 		2: "AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE",
 		3: "AUTO_UPDATE_AGENT_GROUP_STATE_DONE",
 		4: "AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK",
+		5: "AUTO_UPDATE_AGENT_GROUP_STATE_CANARY",
 	}
 	AutoUpdateAgentGroupState_value = map[string]int32{
 		"AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED": 0,
@@ -72,6 +76,7 @@ var (
 		"AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE":      2,
 		"AUTO_UPDATE_AGENT_GROUP_STATE_DONE":        3,
 		"AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK":  4,
+		"AUTO_UPDATE_AGENT_GROUP_STATE_CANARY":      5,
 	}
 )
 
@@ -476,7 +481,11 @@ type AgentAutoUpdateGroup struct {
 	StartHour int32 `protobuf:"varint,3,opt,name=start_hour,json=startHour,proto3" json:"start_hour,omitempty"`
 	// wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure".
 	// This field must be positive.
-	WaitHours     int32 `protobuf:"varint,5,opt,name=wait_hours,json=waitHours,proto3" json:"wait_hours,omitempty"`
+	WaitHours int32 `protobuf:"varint,5,opt,name=wait_hours,json=waitHours,proto3" json:"wait_hours,omitempty"`
+	// canary_count is the number of canary agents that will be updated before the whole group is updated.
+	// when set to 0, the group does not enter the canary phase. This number is capped to 5.
+	// This number must always be lower than the total number of agents in the group, else the rollout will be stuck.
+	CanaryCount   int32 `protobuf:"varint,6,opt,name=canary_count,json=canaryCount,proto3" json:"canary_count,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -539,6 +548,13 @@ func (x *AgentAutoUpdateGroup) GetWaitHours() int32 {
 	return 0
 }
 
+func (x *AgentAutoUpdateGroup) GetCanaryCount() int32 {
+	if x != nil {
+		return x.CanaryCount
+	}
+	return 0
+}
+
 // AutoUpdateVersion is a resource singleton with version required for
 // tools autoupdate.
 type AutoUpdateVersion struct {
@@ -720,9 +736,9 @@ func (x *AutoUpdateVersionSpecTools) GetTargetVersion() string {
 // AutoUpdateVersionSpecAgents is the spec for the autoupdate version.
 type AutoUpdateVersionSpecAgents struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// start_version is the version to update from.
+	// start_version is the version used for newly installed agents before their update window.
 	StartVersion string `protobuf:"bytes,1,opt,name=start_version,json=startVersion,proto3" json:"start_version,omitempty"`
-	// target_version is the version to update to.
+	// target_version is the version that all agents will update to during their update window.
 	TargetVersion string `protobuf:"bytes,2,opt,name=target_version,json=targetVersion,proto3" json:"target_version,omitempty"`
 	// schedule to use for the rollout
 	Schedule string `protobuf:"bytes,3,opt,name=schedule,proto3" json:"schedule,omitempty"`
@@ -882,9 +898,9 @@ func (x *AutoUpdateAgentRollout) GetStatus() *AutoUpdateAgentRolloutStatus {
 // AutoUpdateVersionSpecAgents.
 type AutoUpdateAgentRolloutSpec struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// start_version is the version to update from.
+	// start_version is the version used for newly installed agents before their update window.
 	StartVersion string `protobuf:"bytes,1,opt,name=start_version,json=startVersion,proto3" json:"start_version,omitempty"`
-	// target_version is the version to update to.
+	// target_version is the version that all agents will update to during their update window.
 	TargetVersion string `protobuf:"bytes,2,opt,name=target_version,json=targetVersion,proto3" json:"target_version,omitempty"`
 	// schedule to use for the rollout. Supported values are "regular" and "immediate".
 	// - "regular" follows the regular group schedule
@@ -1105,6 +1121,12 @@ type AutoUpdateAgentRolloutStatusGroup struct {
 	// to the done state if:
 	// - the ratio present_count/initial_count is above 0.9 (no more than 10% of the nodes dropped during update)
 	UpToDateCount uint64 `protobuf:"varint,12,opt,name=up_to_date_count,json=upToDateCount,proto3" json:"up_to_date_count,omitempty"`
+	// canary_count represents how many canaries this group should have to leave the AUTO_UPDATE_AGENT_GROUP_STATE_CANARY
+	// state.
+	CanaryCount uint64 `protobuf:"varint,13,opt,name=canary_count,json=canaryCount,proto3" json:"canary_count,omitempty"`
+	// canaries is the list of canary agents that should be updated.
+	// This list is empty until we enter the AUTO_UPDATE_AGENT_GROUP_STATE_CANARY state.
+	Canaries      []*Canary `protobuf:"bytes,14,rep,name=canaries,proto3" json:"canaries,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1216,6 +1238,20 @@ func (x *AutoUpdateAgentRolloutStatusGroup) GetUpToDateCount() uint64 {
 	return 0
 }
 
+func (x *AutoUpdateAgentRolloutStatusGroup) GetCanaryCount() uint64 {
+	if x != nil {
+		return x.CanaryCount
+	}
+	return 0
+}
+
+func (x *AutoUpdateAgentRolloutStatusGroup) GetCanaries() []*Canary {
+	if x != nil {
+		return x.Canaries
+	}
+	return nil
+}
+
 // AutoUpdateAgentReport is a report generated by each Teleport Auth service.
 // The report tracks per group and per version how many agents are running.
 // The report is used to track which version agents are running.
@@ -1504,6 +1540,314 @@ func (x *AutoUpdateAgentReportSpecOmitted) GetReason() string {
 	return ""
 }
 
+// AutoUpdateBotInstanceReport is a report generated by an elected instance of the
+// Teleport Auth service. The report tracks per group and per version how many
+// instances of tbot are running.
+type AutoUpdateBotInstanceReport struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The kind of resource represented. This is always `autoupdate_bot_instance_report`.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// Differentiates variations of the same kind. All resources should contain
+	// one, even if it is never populated.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// The version of the resource being represented.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Common metadata that all resources share.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Contents of the report.
+	Spec          *AutoUpdateBotInstanceReportSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoUpdateBotInstanceReport) Reset() {
+	*x = AutoUpdateBotInstanceReport{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoUpdateBotInstanceReport) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoUpdateBotInstanceReport) ProtoMessage() {}
+
+func (x *AutoUpdateBotInstanceReport) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoUpdateBotInstanceReport.ProtoReflect.Descriptor instead.
+func (*AutoUpdateBotInstanceReport) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *AutoUpdateBotInstanceReport) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *AutoUpdateBotInstanceReport) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *AutoUpdateBotInstanceReport) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *AutoUpdateBotInstanceReport) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *AutoUpdateBotInstanceReport) GetSpec() *AutoUpdateBotInstanceReportSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// AutoUpdateBotInstanceReportSpec holds the contents of an AutoUpdateBotInstanceReport.
+type AutoUpdateBotInstanceReportSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp is when the report was generated.
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Bot counts aggregated by update group.
+	Groups        map[string]*AutoUpdateBotInstanceReportSpecGroup `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoUpdateBotInstanceReportSpec) Reset() {
+	*x = AutoUpdateBotInstanceReportSpec{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoUpdateBotInstanceReportSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoUpdateBotInstanceReportSpec) ProtoMessage() {}
+
+func (x *AutoUpdateBotInstanceReportSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoUpdateBotInstanceReportSpec.ProtoReflect.Descriptor instead.
+func (*AutoUpdateBotInstanceReportSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *AutoUpdateBotInstanceReportSpec) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *AutoUpdateBotInstanceReportSpec) GetGroups() map[string]*AutoUpdateBotInstanceReportSpecGroup {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+// AutoUpdateBotInstanceReportSpecGroup holds an update group's bot counts.
+type AutoUpdateBotInstanceReportSpecGroup struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Bot counts aggregated by version.
+	Versions      map[string]*AutoUpdateBotInstanceReportSpecGroupVersion `protobuf:"bytes,1,rep,name=versions,proto3" json:"versions,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroup) Reset() {
+	*x = AutoUpdateBotInstanceReportSpecGroup{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroup) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoUpdateBotInstanceReportSpecGroup) ProtoMessage() {}
+
+func (x *AutoUpdateBotInstanceReportSpecGroup) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[21]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoUpdateBotInstanceReportSpecGroup.ProtoReflect.Descriptor instead.
+func (*AutoUpdateBotInstanceReportSpecGroup) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroup) GetVersions() map[string]*AutoUpdateBotInstanceReportSpecGroupVersion {
+	if x != nil {
+		return x.Versions
+	}
+	return nil
+}
+
+// AutoUpdateBotInstanceReportSpecGroupVersion holds a version's bot count.
+type AutoUpdateBotInstanceReportSpecGroupVersion struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Count of bot instances running this version.
+	Count         int32 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroupVersion) Reset() {
+	*x = AutoUpdateBotInstanceReportSpecGroupVersion{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroupVersion) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoUpdateBotInstanceReportSpecGroupVersion) ProtoMessage() {}
+
+func (x *AutoUpdateBotInstanceReportSpecGroupVersion) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoUpdateBotInstanceReportSpecGroupVersion.ProtoReflect.Descriptor instead.
+func (*AutoUpdateBotInstanceReportSpecGroupVersion) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *AutoUpdateBotInstanceReportSpecGroupVersion) GetCount() int32 {
+	if x != nil {
+		return x.Count
+	}
+	return 0
+}
+
+// Canary describes a node that is acting as a canary and being updated before other nodes in its group.
+type Canary struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// updater_id is reported by the agent in its control stream Hello. This allows us to uniquely identify an updater so
+	// the proxy can modulate its answer when the request comes from this specific updater.
+	UpdaterId string `protobuf:"bytes,1,opt,name=updater_id,json=updaterId,proto3" json:"updater_id,omitempty"`
+	// host_id is the node Host ID, reported by the agent in its control stream Hello.
+	HostId string `protobuf:"bytes,2,opt,name=host_id,json=hostId,proto3" json:"host_id,omitempty"`
+	// hostname is the server hostname reported by the agent in its control stream Hello.
+	// This is purely for debugging purposes: if the agent drops, we won't be able to query the inventory to know which
+	// agent it was.
+	Hostname string `protobuf:"bytes,3,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// success represents if the agent successfully connected back, running the target version.
+	Success       bool `protobuf:"varint,4,opt,name=success,proto3" json:"success,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Canary) Reset() {
+	*x = Canary{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Canary) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Canary) ProtoMessage() {}
+
+func (x *Canary) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Canary.ProtoReflect.Descriptor instead.
+func (*Canary) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *Canary) GetUpdaterId() string {
+	if x != nil {
+		return x.UpdaterId
+	}
+	return ""
+}
+
+func (x *Canary) GetHostId() string {
+	if x != nil {
+		return x.HostId
+	}
+	return ""
+}
+
+func (x *Canary) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *Canary) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
 var File_teleport_autoupdate_v1_autoupdate_proto protoreflect.FileDescriptor
 
 const file_teleport_autoupdate_v1_autoupdate_proto_rawDesc = "" +
@@ -1526,14 +1870,15 @@ const file_teleport_autoupdate_v1_autoupdate_proto_rawDesc = "" +
 	"\x1bmaintenance_window_duration\x18\x03 \x01(\v2\x19.google.protobuf.DurationR\x19maintenanceWindowDuration\x12N\n" +
 	"\tschedules\x18\x06 \x01(\v20.teleport.autoupdate.v1.AgentAutoUpdateSchedulesR\tschedulesJ\x04\b\x05\x10\x06R\x0fagent_schedules\"b\n" +
 	"\x18AgentAutoUpdateSchedules\x12F\n" +
-	"\aregular\x18\x01 \x03(\v2,.teleport.autoupdate.v1.AgentAutoUpdateGroupR\aregular\"\x8d\x01\n" +
+	"\aregular\x18\x01 \x03(\v2,.teleport.autoupdate.v1.AgentAutoUpdateGroupR\aregular\"\xb0\x01\n" +
 	"\x14AgentAutoUpdateGroup\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
 	"\x04days\x18\x02 \x03(\tR\x04days\x12\x1d\n" +
 	"\n" +
 	"start_hour\x18\x03 \x01(\x05R\tstartHour\x12\x1d\n" +
 	"\n" +
-	"wait_hours\x18\x05 \x01(\x05R\twaitHoursJ\x04\b\x04\x10\x05R\twait_days\"\xd9\x01\n" +
+	"wait_hours\x18\x05 \x01(\x05R\twaitHours\x12!\n" +
+	"\fcanary_count\x18\x06 \x01(\x05R\vcanaryCountJ\x04\b\x04\x10\x05R\twait_days\"\xd9\x01\n" +
 	"\x11AutoUpdateVersion\x12\x12\n" +
 	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
 	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
@@ -1569,7 +1914,7 @@ const file_teleport_autoupdate_v1_autoupdate_proto_rawDesc = "" +
 	"\x05state\x18\x02 \x01(\x0e23.teleport.autoupdate.v1.AutoUpdateAgentRolloutStateR\x05state\x129\n" +
 	"\n" +
 	"start_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\tstartTime\x12?\n" +
-	"\rtime_override\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\ftimeOverride\"\xb3\x04\n" +
+	"\rtime_override\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\ftimeOverride\"\x92\x05\n" +
 	"!AutoUpdateAgentRolloutStatusGroup\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x129\n" +
 	"\n" +
@@ -1584,7 +1929,9 @@ const file_teleport_autoupdate_v1_autoupdate_proto_rawDesc = "" +
 	"\rinitial_count\x18\n" +
 	" \x01(\x04R\finitialCount\x12#\n" +
 	"\rpresent_count\x18\v \x01(\x04R\fpresentCount\x12'\n" +
-	"\x10up_to_date_count\x18\f \x01(\x04R\rupToDateCountJ\x04\b\b\x10\tR\x10config_wait_days\"\xe1\x01\n" +
+	"\x10up_to_date_count\x18\f \x01(\x04R\rupToDateCount\x12!\n" +
+	"\fcanary_count\x18\r \x01(\x04R\vcanaryCount\x12:\n" +
+	"\bcanaries\x18\x0e \x03(\v2\x1e.teleport.autoupdate.v1.CanaryR\bcanariesJ\x04\b\b\x10\tR\x10config_wait_days\"\xe1\x01\n" +
 	"\x15AutoUpdateAgentReport\x12\x12\n" +
 	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
 	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
@@ -1607,13 +1954,39 @@ const file_teleport_autoupdate_v1_autoupdate_proto_rawDesc = "" +
 	"\x05count\x18\x01 \x01(\x05R\x05count\"P\n" +
 	" AutoUpdateAgentReportSpecOmitted\x12\x14\n" +
 	"\x05count\x18\x01 \x01(\x03R\x05count\x12\x16\n" +
-	"\x06reason\x18\x02 \x01(\tR\x06reason*\xf7\x01\n" +
+	"\x06reason\x18\x02 \x01(\tR\x06reason\"\xed\x01\n" +
+	"\x1bAutoUpdateBotInstanceReport\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12K\n" +
+	"\x04spec\x18\x05 \x01(\v27.teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecR\x04spec\"\xb1\x02\n" +
+	"\x1fAutoUpdateBotInstanceReportSpec\x128\n" +
+	"\ttimestamp\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12[\n" +
+	"\x06groups\x18\x02 \x03(\v2C.teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.GroupsEntryR\x06groups\x1aw\n" +
+	"\vGroupsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12R\n" +
+	"\x05value\x18\x02 \x01(\v2<.teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroupR\x05value:\x028\x01\"\x91\x02\n" +
+	"$AutoUpdateBotInstanceReportSpecGroup\x12f\n" +
+	"\bversions\x18\x01 \x03(\v2J.teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup.VersionsEntryR\bversions\x1a\x80\x01\n" +
+	"\rVersionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12Y\n" +
+	"\x05value\x18\x02 \x01(\v2C.teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroupVersionR\x05value:\x028\x01\"C\n" +
+	"+AutoUpdateBotInstanceReportSpecGroupVersion\x12\x14\n" +
+	"\x05count\x18\x01 \x01(\x05R\x05count\"v\n" +
+	"\x06Canary\x12\x1d\n" +
+	"\n" +
+	"updater_id\x18\x01 \x01(\tR\tupdaterId\x12\x17\n" +
+	"\ahost_id\x18\x02 \x01(\tR\x06hostId\x12\x1a\n" +
+	"\bhostname\x18\x03 \x01(\tR\bhostname\x12\x18\n" +
+	"\asuccess\x18\x04 \x01(\bR\asuccess*\xa1\x02\n" +
 	"\x19AutoUpdateAgentGroupState\x12-\n" +
 	")AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED\x10\x00\x12+\n" +
 	"'AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED\x10\x01\x12(\n" +
 	"$AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE\x10\x02\x12&\n" +
 	"\"AUTO_UPDATE_AGENT_GROUP_STATE_DONE\x10\x03\x12,\n" +
-	"(AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK\x10\x04*\x83\x02\n" +
+	"(AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK\x10\x04\x12(\n" +
+	"$AUTO_UPDATE_AGENT_GROUP_STATE_CANARY\x10\x05*\x83\x02\n" +
 	"\x1bAutoUpdateAgentRolloutState\x12/\n" +
 	"+AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSPECIFIED\x10\x00\x12-\n" +
 	")AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED\x10\x01\x12*\n" +
@@ -1634,71 +2007,86 @@ func file_teleport_autoupdate_v1_autoupdate_proto_rawDescGZIP() []byte {
 }
 
 var file_teleport_autoupdate_v1_autoupdate_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_teleport_autoupdate_v1_autoupdate_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
+var file_teleport_autoupdate_v1_autoupdate_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
 var file_teleport_autoupdate_v1_autoupdate_proto_goTypes = []any{
-	(AutoUpdateAgentGroupState)(0),                // 0: teleport.autoupdate.v1.AutoUpdateAgentGroupState
-	(AutoUpdateAgentRolloutState)(0),              // 1: teleport.autoupdate.v1.AutoUpdateAgentRolloutState
-	(*AutoUpdateConfig)(nil),                      // 2: teleport.autoupdate.v1.AutoUpdateConfig
-	(*AutoUpdateConfigSpec)(nil),                  // 3: teleport.autoupdate.v1.AutoUpdateConfigSpec
-	(*AutoUpdateConfigSpecTools)(nil),             // 4: teleport.autoupdate.v1.AutoUpdateConfigSpecTools
-	(*AutoUpdateConfigSpecAgents)(nil),            // 5: teleport.autoupdate.v1.AutoUpdateConfigSpecAgents
-	(*AgentAutoUpdateSchedules)(nil),              // 6: teleport.autoupdate.v1.AgentAutoUpdateSchedules
-	(*AgentAutoUpdateGroup)(nil),                  // 7: teleport.autoupdate.v1.AgentAutoUpdateGroup
-	(*AutoUpdateVersion)(nil),                     // 8: teleport.autoupdate.v1.AutoUpdateVersion
-	(*AutoUpdateVersionSpec)(nil),                 // 9: teleport.autoupdate.v1.AutoUpdateVersionSpec
-	(*AutoUpdateVersionSpecTools)(nil),            // 10: teleport.autoupdate.v1.AutoUpdateVersionSpecTools
-	(*AutoUpdateVersionSpecAgents)(nil),           // 11: teleport.autoupdate.v1.AutoUpdateVersionSpecAgents
-	(*AutoUpdateAgentRollout)(nil),                // 12: teleport.autoupdate.v1.AutoUpdateAgentRollout
-	(*AutoUpdateAgentRolloutSpec)(nil),            // 13: teleport.autoupdate.v1.AutoUpdateAgentRolloutSpec
-	(*AutoUpdateAgentRolloutStatus)(nil),          // 14: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus
-	(*AutoUpdateAgentRolloutStatusGroup)(nil),     // 15: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup
-	(*AutoUpdateAgentReport)(nil),                 // 16: teleport.autoupdate.v1.AutoUpdateAgentReport
-	(*AutoUpdateAgentReportSpec)(nil),             // 17: teleport.autoupdate.v1.AutoUpdateAgentReportSpec
-	(*AutoUpdateAgentReportSpecGroup)(nil),        // 18: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup
-	(*AutoUpdateAgentReportSpecGroupVersion)(nil), // 19: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroupVersion
-	(*AutoUpdateAgentReportSpecOmitted)(nil),      // 20: teleport.autoupdate.v1.AutoUpdateAgentReportSpecOmitted
-	nil,                                           // 21: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry
-	nil,                                           // 22: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry
-	(*v1.Metadata)(nil),                           // 23: teleport.header.v1.Metadata
-	(*durationpb.Duration)(nil),                   // 24: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),                 // 25: google.protobuf.Timestamp
+	(AutoUpdateAgentGroupState)(0),                      // 0: teleport.autoupdate.v1.AutoUpdateAgentGroupState
+	(AutoUpdateAgentRolloutState)(0),                    // 1: teleport.autoupdate.v1.AutoUpdateAgentRolloutState
+	(*AutoUpdateConfig)(nil),                            // 2: teleport.autoupdate.v1.AutoUpdateConfig
+	(*AutoUpdateConfigSpec)(nil),                        // 3: teleport.autoupdate.v1.AutoUpdateConfigSpec
+	(*AutoUpdateConfigSpecTools)(nil),                   // 4: teleport.autoupdate.v1.AutoUpdateConfigSpecTools
+	(*AutoUpdateConfigSpecAgents)(nil),                  // 5: teleport.autoupdate.v1.AutoUpdateConfigSpecAgents
+	(*AgentAutoUpdateSchedules)(nil),                    // 6: teleport.autoupdate.v1.AgentAutoUpdateSchedules
+	(*AgentAutoUpdateGroup)(nil),                        // 7: teleport.autoupdate.v1.AgentAutoUpdateGroup
+	(*AutoUpdateVersion)(nil),                           // 8: teleport.autoupdate.v1.AutoUpdateVersion
+	(*AutoUpdateVersionSpec)(nil),                       // 9: teleport.autoupdate.v1.AutoUpdateVersionSpec
+	(*AutoUpdateVersionSpecTools)(nil),                  // 10: teleport.autoupdate.v1.AutoUpdateVersionSpecTools
+	(*AutoUpdateVersionSpecAgents)(nil),                 // 11: teleport.autoupdate.v1.AutoUpdateVersionSpecAgents
+	(*AutoUpdateAgentRollout)(nil),                      // 12: teleport.autoupdate.v1.AutoUpdateAgentRollout
+	(*AutoUpdateAgentRolloutSpec)(nil),                  // 13: teleport.autoupdate.v1.AutoUpdateAgentRolloutSpec
+	(*AutoUpdateAgentRolloutStatus)(nil),                // 14: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus
+	(*AutoUpdateAgentRolloutStatusGroup)(nil),           // 15: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup
+	(*AutoUpdateAgentReport)(nil),                       // 16: teleport.autoupdate.v1.AutoUpdateAgentReport
+	(*AutoUpdateAgentReportSpec)(nil),                   // 17: teleport.autoupdate.v1.AutoUpdateAgentReportSpec
+	(*AutoUpdateAgentReportSpecGroup)(nil),              // 18: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup
+	(*AutoUpdateAgentReportSpecGroupVersion)(nil),       // 19: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroupVersion
+	(*AutoUpdateAgentReportSpecOmitted)(nil),            // 20: teleport.autoupdate.v1.AutoUpdateAgentReportSpecOmitted
+	(*AutoUpdateBotInstanceReport)(nil),                 // 21: teleport.autoupdate.v1.AutoUpdateBotInstanceReport
+	(*AutoUpdateBotInstanceReportSpec)(nil),             // 22: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec
+	(*AutoUpdateBotInstanceReportSpecGroup)(nil),        // 23: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup
+	(*AutoUpdateBotInstanceReportSpecGroupVersion)(nil), // 24: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroupVersion
+	(*Canary)(nil),                                      // 25: teleport.autoupdate.v1.Canary
+	nil,                                                 // 26: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry
+	nil,                                                 // 27: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry
+	nil,                                                 // 28: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.GroupsEntry
+	nil,                                                 // 29: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup.VersionsEntry
+	(*v1.Metadata)(nil),                                 // 30: teleport.header.v1.Metadata
+	(*durationpb.Duration)(nil),                         // 31: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),                       // 32: google.protobuf.Timestamp
 }
 var file_teleport_autoupdate_v1_autoupdate_proto_depIdxs = []int32{
-	23, // 0: teleport.autoupdate.v1.AutoUpdateConfig.metadata:type_name -> teleport.header.v1.Metadata
+	30, // 0: teleport.autoupdate.v1.AutoUpdateConfig.metadata:type_name -> teleport.header.v1.Metadata
 	3,  // 1: teleport.autoupdate.v1.AutoUpdateConfig.spec:type_name -> teleport.autoupdate.v1.AutoUpdateConfigSpec
 	4,  // 2: teleport.autoupdate.v1.AutoUpdateConfigSpec.tools:type_name -> teleport.autoupdate.v1.AutoUpdateConfigSpecTools
 	5,  // 3: teleport.autoupdate.v1.AutoUpdateConfigSpec.agents:type_name -> teleport.autoupdate.v1.AutoUpdateConfigSpecAgents
-	24, // 4: teleport.autoupdate.v1.AutoUpdateConfigSpecAgents.maintenance_window_duration:type_name -> google.protobuf.Duration
+	31, // 4: teleport.autoupdate.v1.AutoUpdateConfigSpecAgents.maintenance_window_duration:type_name -> google.protobuf.Duration
 	6,  // 5: teleport.autoupdate.v1.AutoUpdateConfigSpecAgents.schedules:type_name -> teleport.autoupdate.v1.AgentAutoUpdateSchedules
 	7,  // 6: teleport.autoupdate.v1.AgentAutoUpdateSchedules.regular:type_name -> teleport.autoupdate.v1.AgentAutoUpdateGroup
-	23, // 7: teleport.autoupdate.v1.AutoUpdateVersion.metadata:type_name -> teleport.header.v1.Metadata
+	30, // 7: teleport.autoupdate.v1.AutoUpdateVersion.metadata:type_name -> teleport.header.v1.Metadata
 	9,  // 8: teleport.autoupdate.v1.AutoUpdateVersion.spec:type_name -> teleport.autoupdate.v1.AutoUpdateVersionSpec
 	10, // 9: teleport.autoupdate.v1.AutoUpdateVersionSpec.tools:type_name -> teleport.autoupdate.v1.AutoUpdateVersionSpecTools
 	11, // 10: teleport.autoupdate.v1.AutoUpdateVersionSpec.agents:type_name -> teleport.autoupdate.v1.AutoUpdateVersionSpecAgents
-	23, // 11: teleport.autoupdate.v1.AutoUpdateAgentRollout.metadata:type_name -> teleport.header.v1.Metadata
+	30, // 11: teleport.autoupdate.v1.AutoUpdateAgentRollout.metadata:type_name -> teleport.header.v1.Metadata
 	13, // 12: teleport.autoupdate.v1.AutoUpdateAgentRollout.spec:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRolloutSpec
 	14, // 13: teleport.autoupdate.v1.AutoUpdateAgentRollout.status:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus
-	24, // 14: teleport.autoupdate.v1.AutoUpdateAgentRolloutSpec.maintenance_window_duration:type_name -> google.protobuf.Duration
+	31, // 14: teleport.autoupdate.v1.AutoUpdateAgentRolloutSpec.maintenance_window_duration:type_name -> google.protobuf.Duration
 	15, // 15: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.groups:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup
 	1,  // 16: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.state:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRolloutState
-	25, // 17: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.start_time:type_name -> google.protobuf.Timestamp
-	25, // 18: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.time_override:type_name -> google.protobuf.Timestamp
-	25, // 19: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.start_time:type_name -> google.protobuf.Timestamp
+	32, // 17: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.start_time:type_name -> google.protobuf.Timestamp
+	32, // 18: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatus.time_override:type_name -> google.protobuf.Timestamp
+	32, // 19: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.start_time:type_name -> google.protobuf.Timestamp
 	0,  // 20: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.state:type_name -> teleport.autoupdate.v1.AutoUpdateAgentGroupState
-	25, // 21: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.last_update_time:type_name -> google.protobuf.Timestamp
-	23, // 22: teleport.autoupdate.v1.AutoUpdateAgentReport.metadata:type_name -> teleport.header.v1.Metadata
-	17, // 23: teleport.autoupdate.v1.AutoUpdateAgentReport.spec:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpec
-	25, // 24: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.timestamp:type_name -> google.protobuf.Timestamp
-	21, // 25: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.groups:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry
-	20, // 26: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.omitted:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecOmitted
-	22, // 27: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.versions:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry
-	18, // 28: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup
-	19, // 29: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroupVersion
-	30, // [30:30] is the sub-list for method output_type
-	30, // [30:30] is the sub-list for method input_type
-	30, // [30:30] is the sub-list for extension type_name
-	30, // [30:30] is the sub-list for extension extendee
-	0,  // [0:30] is the sub-list for field type_name
+	32, // 21: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.last_update_time:type_name -> google.protobuf.Timestamp
+	25, // 22: teleport.autoupdate.v1.AutoUpdateAgentRolloutStatusGroup.canaries:type_name -> teleport.autoupdate.v1.Canary
+	30, // 23: teleport.autoupdate.v1.AutoUpdateAgentReport.metadata:type_name -> teleport.header.v1.Metadata
+	17, // 24: teleport.autoupdate.v1.AutoUpdateAgentReport.spec:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpec
+	32, // 25: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.timestamp:type_name -> google.protobuf.Timestamp
+	26, // 26: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.groups:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry
+	20, // 27: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.omitted:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecOmitted
+	27, // 28: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.versions:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry
+	30, // 29: teleport.autoupdate.v1.AutoUpdateBotInstanceReport.metadata:type_name -> teleport.header.v1.Metadata
+	22, // 30: teleport.autoupdate.v1.AutoUpdateBotInstanceReport.spec:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec
+	32, // 31: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.timestamp:type_name -> google.protobuf.Timestamp
+	28, // 32: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.groups:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.GroupsEntry
+	29, // 33: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup.versions:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup.VersionsEntry
+	18, // 34: teleport.autoupdate.v1.AutoUpdateAgentReportSpec.GroupsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup
+	19, // 35: teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroup.VersionsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReportSpecGroupVersion
+	23, // 36: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpec.GroupsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup
+	24, // 37: teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroup.VersionsEntry.value:type_name -> teleport.autoupdate.v1.AutoUpdateBotInstanceReportSpecGroupVersion
+	38, // [38:38] is the sub-list for method output_type
+	38, // [38:38] is the sub-list for method input_type
+	38, // [38:38] is the sub-list for extension type_name
+	38, // [38:38] is the sub-list for extension extendee
+	0,  // [0:38] is the sub-list for field type_name
 }
 
 func init() { file_teleport_autoupdate_v1_autoupdate_proto_init() }
@@ -1712,7 +2100,7 @@ func file_teleport_autoupdate_v1_autoupdate_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_autoupdate_v1_autoupdate_proto_rawDesc), len(file_teleport_autoupdate_v1_autoupdate_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   21,
+			NumMessages:   28,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service.pb.go b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service.pb.go
index cc4e56af6df32..61578cf222afe 100644
--- a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service.pb.go
+++ b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate_service.proto
 
@@ -1173,6 +1173,80 @@ func (x *DeleteAutoUpdateAgentReportRequest) GetName() string {
 	return ""
 }
 
+// Request for GetAutoUpdateBotInstanceReport.
+type GetAutoUpdateBotInstanceReportRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetAutoUpdateBotInstanceReportRequest) Reset() {
+	*x = GetAutoUpdateBotInstanceReportRequest{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetAutoUpdateBotInstanceReportRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAutoUpdateBotInstanceReportRequest) ProtoMessage() {}
+
+func (x *GetAutoUpdateBotInstanceReportRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAutoUpdateBotInstanceReportRequest.ProtoReflect.Descriptor instead.
+func (*GetAutoUpdateBotInstanceReportRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_service_proto_rawDescGZIP(), []int{25}
+}
+
+// Request for DeleteAutoUpdateBotInstanceReport.
+type DeleteAutoUpdateBotInstanceReportRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteAutoUpdateBotInstanceReportRequest) Reset() {
+	*x = DeleteAutoUpdateBotInstanceReportRequest{}
+	mi := &file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAutoUpdateBotInstanceReportRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAutoUpdateBotInstanceReportRequest) ProtoMessage() {}
+
+func (x *DeleteAutoUpdateBotInstanceReportRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAutoUpdateBotInstanceReportRequest.ProtoReflect.Descriptor instead.
+func (*DeleteAutoUpdateBotInstanceReportRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_autoupdate_v1_autoupdate_service_proto_rawDescGZIP(), []int{26}
+}
+
 var File_teleport_autoupdate_v1_autoupdate_service_proto protoreflect.FileDescriptor
 
 const file_teleport_autoupdate_v1_autoupdate_service_proto_rawDesc = "" +
@@ -1228,7 +1302,9 @@ const file_teleport_autoupdate_v1_autoupdate_service_proto_rawDesc = "" +
 	"\"UpsertAutoUpdateAgentReportRequest\x12e\n" +
 	"\x17autoupdate_agent_report\x18\x01 \x01(\v2-.teleport.autoupdate.v1.AutoUpdateAgentReportR\x15autoupdateAgentReport\"8\n" +
 	"\"DeleteAutoUpdateAgentReportRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name2\xb7\x18\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"'\n" +
+	"%GetAutoUpdateBotInstanceReportRequest\"*\n" +
+	"(DeleteAutoUpdateBotInstanceReportRequest2\xcd\x1a\n" +
 	"\x11AutoUpdateService\x12s\n" +
 	"\x13GetAutoUpdateConfig\x122.teleport.autoupdate.v1.GetAutoUpdateConfigRequest\x1a(.teleport.autoupdate.v1.AutoUpdateConfig\x12y\n" +
 	"\x16CreateAutoUpdateConfig\x125.teleport.autoupdate.v1.CreateAutoUpdateConfigRequest\x1a(.teleport.autoupdate.v1.AutoUpdateConfig\x12y\n" +
@@ -1253,7 +1329,9 @@ const file_teleport_autoupdate_v1_autoupdate_service_proto_rawDesc = "" +
 	"\x1bCreateAutoUpdateAgentReport\x12:.teleport.autoupdate.v1.CreateAutoUpdateAgentReportRequest\x1a-.teleport.autoupdate.v1.AutoUpdateAgentReport\x12\x88\x01\n" +
 	"\x1bUpdateAutoUpdateAgentReport\x12:.teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest\x1a-.teleport.autoupdate.v1.AutoUpdateAgentReport\x12\x88\x01\n" +
 	"\x1bUpsertAutoUpdateAgentReport\x12:.teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest\x1a-.teleport.autoupdate.v1.AutoUpdateAgentReport\x12q\n" +
-	"\x1bDeleteAutoUpdateAgentReport\x12:.teleport.autoupdate.v1.DeleteAutoUpdateAgentReportRequest\x1a\x16.google.protobuf.EmptyBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1;autoupdateb\x06proto3"
+	"\x1bDeleteAutoUpdateAgentReport\x12:.teleport.autoupdate.v1.DeleteAutoUpdateAgentReportRequest\x1a\x16.google.protobuf.Empty\x12\x94\x01\n" +
+	"\x1eGetAutoUpdateBotInstanceReport\x12=.teleport.autoupdate.v1.GetAutoUpdateBotInstanceReportRequest\x1a3.teleport.autoupdate.v1.AutoUpdateBotInstanceReport\x12}\n" +
+	"!DeleteAutoUpdateBotInstanceReport\x12@.teleport.autoupdate.v1.DeleteAutoUpdateBotInstanceReportRequest\x1a\x16.google.protobuf.EmptyBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1;autoupdateb\x06proto3"
 
 var (
 	file_teleport_autoupdate_v1_autoupdate_service_proto_rawDescOnce sync.Once
@@ -1267,55 +1345,58 @@ func file_teleport_autoupdate_v1_autoupdate_service_proto_rawDescGZIP() []byte {
 	return file_teleport_autoupdate_v1_autoupdate_service_proto_rawDescData
 }
 
-var file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_teleport_autoupdate_v1_autoupdate_service_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
 var file_teleport_autoupdate_v1_autoupdate_service_proto_goTypes = []any{
-	(*GetAutoUpdateConfigRequest)(nil),          // 0: teleport.autoupdate.v1.GetAutoUpdateConfigRequest
-	(*CreateAutoUpdateConfigRequest)(nil),       // 1: teleport.autoupdate.v1.CreateAutoUpdateConfigRequest
-	(*UpdateAutoUpdateConfigRequest)(nil),       // 2: teleport.autoupdate.v1.UpdateAutoUpdateConfigRequest
-	(*UpsertAutoUpdateConfigRequest)(nil),       // 3: teleport.autoupdate.v1.UpsertAutoUpdateConfigRequest
-	(*DeleteAutoUpdateConfigRequest)(nil),       // 4: teleport.autoupdate.v1.DeleteAutoUpdateConfigRequest
-	(*GetAutoUpdateVersionRequest)(nil),         // 5: teleport.autoupdate.v1.GetAutoUpdateVersionRequest
-	(*CreateAutoUpdateVersionRequest)(nil),      // 6: teleport.autoupdate.v1.CreateAutoUpdateVersionRequest
-	(*UpdateAutoUpdateVersionRequest)(nil),      // 7: teleport.autoupdate.v1.UpdateAutoUpdateVersionRequest
-	(*UpsertAutoUpdateVersionRequest)(nil),      // 8: teleport.autoupdate.v1.UpsertAutoUpdateVersionRequest
-	(*DeleteAutoUpdateVersionRequest)(nil),      // 9: teleport.autoupdate.v1.DeleteAutoUpdateVersionRequest
-	(*GetAutoUpdateAgentRolloutRequest)(nil),    // 10: teleport.autoupdate.v1.GetAutoUpdateAgentRolloutRequest
-	(*CreateAutoUpdateAgentRolloutRequest)(nil), // 11: teleport.autoupdate.v1.CreateAutoUpdateAgentRolloutRequest
-	(*UpdateAutoUpdateAgentRolloutRequest)(nil), // 12: teleport.autoupdate.v1.UpdateAutoUpdateAgentRolloutRequest
-	(*UpsertAutoUpdateAgentRolloutRequest)(nil), // 13: teleport.autoupdate.v1.UpsertAutoUpdateAgentRolloutRequest
-	(*DeleteAutoUpdateAgentRolloutRequest)(nil), // 14: teleport.autoupdate.v1.DeleteAutoUpdateAgentRolloutRequest
-	(*TriggerAutoUpdateAgentGroupRequest)(nil),  // 15: teleport.autoupdate.v1.TriggerAutoUpdateAgentGroupRequest
-	(*ForceAutoUpdateAgentGroupRequest)(nil),    // 16: teleport.autoupdate.v1.ForceAutoUpdateAgentGroupRequest
-	(*RollbackAutoUpdateAgentGroupRequest)(nil), // 17: teleport.autoupdate.v1.RollbackAutoUpdateAgentGroupRequest
-	(*ListAutoUpdateAgentReportsRequest)(nil),   // 18: teleport.autoupdate.v1.ListAutoUpdateAgentReportsRequest
-	(*ListAutoUpdateAgentReportsResponse)(nil),  // 19: teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse
-	(*GetAutoUpdateAgentReportRequest)(nil),     // 20: teleport.autoupdate.v1.GetAutoUpdateAgentReportRequest
-	(*CreateAutoUpdateAgentReportRequest)(nil),  // 21: teleport.autoupdate.v1.CreateAutoUpdateAgentReportRequest
-	(*UpdateAutoUpdateAgentReportRequest)(nil),  // 22: teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest
-	(*UpsertAutoUpdateAgentReportRequest)(nil),  // 23: teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest
-	(*DeleteAutoUpdateAgentReportRequest)(nil),  // 24: teleport.autoupdate.v1.DeleteAutoUpdateAgentReportRequest
-	(*AutoUpdateConfig)(nil),                    // 25: teleport.autoupdate.v1.AutoUpdateConfig
-	(*AutoUpdateVersion)(nil),                   // 26: teleport.autoupdate.v1.AutoUpdateVersion
-	(*AutoUpdateAgentRollout)(nil),              // 27: teleport.autoupdate.v1.AutoUpdateAgentRollout
-	(AutoUpdateAgentGroupState)(0),              // 28: teleport.autoupdate.v1.AutoUpdateAgentGroupState
-	(*AutoUpdateAgentReport)(nil),               // 29: teleport.autoupdate.v1.AutoUpdateAgentReport
-	(*emptypb.Empty)(nil),                       // 30: google.protobuf.Empty
+	(*GetAutoUpdateConfigRequest)(nil),               // 0: teleport.autoupdate.v1.GetAutoUpdateConfigRequest
+	(*CreateAutoUpdateConfigRequest)(nil),            // 1: teleport.autoupdate.v1.CreateAutoUpdateConfigRequest
+	(*UpdateAutoUpdateConfigRequest)(nil),            // 2: teleport.autoupdate.v1.UpdateAutoUpdateConfigRequest
+	(*UpsertAutoUpdateConfigRequest)(nil),            // 3: teleport.autoupdate.v1.UpsertAutoUpdateConfigRequest
+	(*DeleteAutoUpdateConfigRequest)(nil),            // 4: teleport.autoupdate.v1.DeleteAutoUpdateConfigRequest
+	(*GetAutoUpdateVersionRequest)(nil),              // 5: teleport.autoupdate.v1.GetAutoUpdateVersionRequest
+	(*CreateAutoUpdateVersionRequest)(nil),           // 6: teleport.autoupdate.v1.CreateAutoUpdateVersionRequest
+	(*UpdateAutoUpdateVersionRequest)(nil),           // 7: teleport.autoupdate.v1.UpdateAutoUpdateVersionRequest
+	(*UpsertAutoUpdateVersionRequest)(nil),           // 8: teleport.autoupdate.v1.UpsertAutoUpdateVersionRequest
+	(*DeleteAutoUpdateVersionRequest)(nil),           // 9: teleport.autoupdate.v1.DeleteAutoUpdateVersionRequest
+	(*GetAutoUpdateAgentRolloutRequest)(nil),         // 10: teleport.autoupdate.v1.GetAutoUpdateAgentRolloutRequest
+	(*CreateAutoUpdateAgentRolloutRequest)(nil),      // 11: teleport.autoupdate.v1.CreateAutoUpdateAgentRolloutRequest
+	(*UpdateAutoUpdateAgentRolloutRequest)(nil),      // 12: teleport.autoupdate.v1.UpdateAutoUpdateAgentRolloutRequest
+	(*UpsertAutoUpdateAgentRolloutRequest)(nil),      // 13: teleport.autoupdate.v1.UpsertAutoUpdateAgentRolloutRequest
+	(*DeleteAutoUpdateAgentRolloutRequest)(nil),      // 14: teleport.autoupdate.v1.DeleteAutoUpdateAgentRolloutRequest
+	(*TriggerAutoUpdateAgentGroupRequest)(nil),       // 15: teleport.autoupdate.v1.TriggerAutoUpdateAgentGroupRequest
+	(*ForceAutoUpdateAgentGroupRequest)(nil),         // 16: teleport.autoupdate.v1.ForceAutoUpdateAgentGroupRequest
+	(*RollbackAutoUpdateAgentGroupRequest)(nil),      // 17: teleport.autoupdate.v1.RollbackAutoUpdateAgentGroupRequest
+	(*ListAutoUpdateAgentReportsRequest)(nil),        // 18: teleport.autoupdate.v1.ListAutoUpdateAgentReportsRequest
+	(*ListAutoUpdateAgentReportsResponse)(nil),       // 19: teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse
+	(*GetAutoUpdateAgentReportRequest)(nil),          // 20: teleport.autoupdate.v1.GetAutoUpdateAgentReportRequest
+	(*CreateAutoUpdateAgentReportRequest)(nil),       // 21: teleport.autoupdate.v1.CreateAutoUpdateAgentReportRequest
+	(*UpdateAutoUpdateAgentReportRequest)(nil),       // 22: teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest
+	(*UpsertAutoUpdateAgentReportRequest)(nil),       // 23: teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest
+	(*DeleteAutoUpdateAgentReportRequest)(nil),       // 24: teleport.autoupdate.v1.DeleteAutoUpdateAgentReportRequest
+	(*GetAutoUpdateBotInstanceReportRequest)(nil),    // 25: teleport.autoupdate.v1.GetAutoUpdateBotInstanceReportRequest
+	(*DeleteAutoUpdateBotInstanceReportRequest)(nil), // 26: teleport.autoupdate.v1.DeleteAutoUpdateBotInstanceReportRequest
+	(*AutoUpdateConfig)(nil),                         // 27: teleport.autoupdate.v1.AutoUpdateConfig
+	(*AutoUpdateVersion)(nil),                        // 28: teleport.autoupdate.v1.AutoUpdateVersion
+	(*AutoUpdateAgentRollout)(nil),                   // 29: teleport.autoupdate.v1.AutoUpdateAgentRollout
+	(AutoUpdateAgentGroupState)(0),                   // 30: teleport.autoupdate.v1.AutoUpdateAgentGroupState
+	(*AutoUpdateAgentReport)(nil),                    // 31: teleport.autoupdate.v1.AutoUpdateAgentReport
+	(*emptypb.Empty)(nil),                            // 32: google.protobuf.Empty
+	(*AutoUpdateBotInstanceReport)(nil),              // 33: teleport.autoupdate.v1.AutoUpdateBotInstanceReport
 }
 var file_teleport_autoupdate_v1_autoupdate_service_proto_depIdxs = []int32{
-	25, // 0: teleport.autoupdate.v1.CreateAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
-	25, // 1: teleport.autoupdate.v1.UpdateAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
-	25, // 2: teleport.autoupdate.v1.UpsertAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
-	26, // 3: teleport.autoupdate.v1.CreateAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
-	26, // 4: teleport.autoupdate.v1.UpdateAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
-	26, // 5: teleport.autoupdate.v1.UpsertAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
-	27, // 6: teleport.autoupdate.v1.CreateAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 7: teleport.autoupdate.v1.UpdateAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 8: teleport.autoupdate.v1.UpsertAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	28, // 9: teleport.autoupdate.v1.TriggerAutoUpdateAgentGroupRequest.desired_state:type_name -> teleport.autoupdate.v1.AutoUpdateAgentGroupState
-	29, // 10: teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse.autoupdate_agent_reports:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 11: teleport.autoupdate.v1.CreateAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 12: teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 13: teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	27, // 0: teleport.autoupdate.v1.CreateAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
+	27, // 1: teleport.autoupdate.v1.UpdateAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
+	27, // 2: teleport.autoupdate.v1.UpsertAutoUpdateConfigRequest.config:type_name -> teleport.autoupdate.v1.AutoUpdateConfig
+	28, // 3: teleport.autoupdate.v1.CreateAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
+	28, // 4: teleport.autoupdate.v1.UpdateAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
+	28, // 5: teleport.autoupdate.v1.UpsertAutoUpdateVersionRequest.version:type_name -> teleport.autoupdate.v1.AutoUpdateVersion
+	29, // 6: teleport.autoupdate.v1.CreateAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 7: teleport.autoupdate.v1.UpdateAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 8: teleport.autoupdate.v1.UpsertAutoUpdateAgentRolloutRequest.rollout:type_name -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	30, // 9: teleport.autoupdate.v1.TriggerAutoUpdateAgentGroupRequest.desired_state:type_name -> teleport.autoupdate.v1.AutoUpdateAgentGroupState
+	31, // 10: teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse.autoupdate_agent_reports:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 11: teleport.autoupdate.v1.CreateAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 12: teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 13: teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest.autoupdate_agent_report:type_name -> teleport.autoupdate.v1.AutoUpdateAgentReport
 	0,  // 14: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateConfig:input_type -> teleport.autoupdate.v1.GetAutoUpdateConfigRequest
 	1,  // 15: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateConfig:input_type -> teleport.autoupdate.v1.CreateAutoUpdateConfigRequest
 	2,  // 16: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateConfig:input_type -> teleport.autoupdate.v1.UpdateAutoUpdateConfigRequest
@@ -1340,32 +1421,36 @@ var file_teleport_autoupdate_v1_autoupdate_service_proto_depIdxs = []int32{
 	22, // 35: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateAgentReport:input_type -> teleport.autoupdate.v1.UpdateAutoUpdateAgentReportRequest
 	23, // 36: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateAgentReport:input_type -> teleport.autoupdate.v1.UpsertAutoUpdateAgentReportRequest
 	24, // 37: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateAgentReport:input_type -> teleport.autoupdate.v1.DeleteAutoUpdateAgentReportRequest
-	25, // 38: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
-	25, // 39: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
-	25, // 40: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
-	25, // 41: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
-	30, // 42: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateConfig:output_type -> google.protobuf.Empty
-	26, // 43: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
-	26, // 44: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
-	26, // 45: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
-	26, // 46: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
-	30, // 47: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateVersion:output_type -> google.protobuf.Empty
-	27, // 48: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 49: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 50: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 51: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	30, // 52: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateAgentRollout:output_type -> google.protobuf.Empty
-	27, // 53: teleport.autoupdate.v1.AutoUpdateService.TriggerAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 54: teleport.autoupdate.v1.AutoUpdateService.ForceAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	27, // 55: teleport.autoupdate.v1.AutoUpdateService.RollbackAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
-	19, // 56: teleport.autoupdate.v1.AutoUpdateService.ListAutoUpdateAgentReports:output_type -> teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse
-	29, // 57: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 58: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 59: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	29, // 60: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
-	30, // 61: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateAgentReport:output_type -> google.protobuf.Empty
-	38, // [38:62] is the sub-list for method output_type
-	14, // [14:38] is the sub-list for method input_type
+	25, // 38: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateBotInstanceReport:input_type -> teleport.autoupdate.v1.GetAutoUpdateBotInstanceReportRequest
+	26, // 39: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateBotInstanceReport:input_type -> teleport.autoupdate.v1.DeleteAutoUpdateBotInstanceReportRequest
+	27, // 40: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
+	27, // 41: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
+	27, // 42: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
+	27, // 43: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateConfig:output_type -> teleport.autoupdate.v1.AutoUpdateConfig
+	32, // 44: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateConfig:output_type -> google.protobuf.Empty
+	28, // 45: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
+	28, // 46: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
+	28, // 47: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
+	28, // 48: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateVersion:output_type -> teleport.autoupdate.v1.AutoUpdateVersion
+	32, // 49: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateVersion:output_type -> google.protobuf.Empty
+	29, // 50: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 51: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 52: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 53: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateAgentRollout:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	32, // 54: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateAgentRollout:output_type -> google.protobuf.Empty
+	29, // 55: teleport.autoupdate.v1.AutoUpdateService.TriggerAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 56: teleport.autoupdate.v1.AutoUpdateService.ForceAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	29, // 57: teleport.autoupdate.v1.AutoUpdateService.RollbackAutoUpdateAgentGroup:output_type -> teleport.autoupdate.v1.AutoUpdateAgentRollout
+	19, // 58: teleport.autoupdate.v1.AutoUpdateService.ListAutoUpdateAgentReports:output_type -> teleport.autoupdate.v1.ListAutoUpdateAgentReportsResponse
+	31, // 59: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 60: teleport.autoupdate.v1.AutoUpdateService.CreateAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 61: teleport.autoupdate.v1.AutoUpdateService.UpdateAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	31, // 62: teleport.autoupdate.v1.AutoUpdateService.UpsertAutoUpdateAgentReport:output_type -> teleport.autoupdate.v1.AutoUpdateAgentReport
+	32, // 63: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateAgentReport:output_type -> google.protobuf.Empty
+	33, // 64: teleport.autoupdate.v1.AutoUpdateService.GetAutoUpdateBotInstanceReport:output_type -> teleport.autoupdate.v1.AutoUpdateBotInstanceReport
+	32, // 65: teleport.autoupdate.v1.AutoUpdateService.DeleteAutoUpdateBotInstanceReport:output_type -> google.protobuf.Empty
+	40, // [40:66] is the sub-list for method output_type
+	14, // [14:40] is the sub-list for method input_type
 	14, // [14:14] is the sub-list for extension type_name
 	14, // [14:14] is the sub-list for extension extendee
 	0,  // [0:14] is the sub-list for field type_name
@@ -1383,7 +1468,7 @@ func file_teleport_autoupdate_v1_autoupdate_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_autoupdate_v1_autoupdate_service_proto_rawDesc), len(file_teleport_autoupdate_v1_autoupdate_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   25,
+			NumMessages:   27,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service_grpc.pb.go b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service_grpc.pb.go
index 7ca9d489f208a..94ac9ed1f28fe 100644
--- a/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_service_grpc.pb.go
@@ -34,30 +34,32 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	AutoUpdateService_GetAutoUpdateConfig_FullMethodName          = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateConfig"
-	AutoUpdateService_CreateAutoUpdateConfig_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateConfig"
-	AutoUpdateService_UpdateAutoUpdateConfig_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateConfig"
-	AutoUpdateService_UpsertAutoUpdateConfig_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateConfig"
-	AutoUpdateService_DeleteAutoUpdateConfig_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateConfig"
-	AutoUpdateService_GetAutoUpdateVersion_FullMethodName         = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateVersion"
-	AutoUpdateService_CreateAutoUpdateVersion_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateVersion"
-	AutoUpdateService_UpdateAutoUpdateVersion_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateVersion"
-	AutoUpdateService_UpsertAutoUpdateVersion_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateVersion"
-	AutoUpdateService_DeleteAutoUpdateVersion_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateVersion"
-	AutoUpdateService_GetAutoUpdateAgentRollout_FullMethodName    = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateAgentRollout"
-	AutoUpdateService_CreateAutoUpdateAgentRollout_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateAgentRollout"
-	AutoUpdateService_UpdateAutoUpdateAgentRollout_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateAgentRollout"
-	AutoUpdateService_UpsertAutoUpdateAgentRollout_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateAgentRollout"
-	AutoUpdateService_DeleteAutoUpdateAgentRollout_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateAgentRollout"
-	AutoUpdateService_TriggerAutoUpdateAgentGroup_FullMethodName  = "/teleport.autoupdate.v1.AutoUpdateService/TriggerAutoUpdateAgentGroup"
-	AutoUpdateService_ForceAutoUpdateAgentGroup_FullMethodName    = "/teleport.autoupdate.v1.AutoUpdateService/ForceAutoUpdateAgentGroup"
-	AutoUpdateService_RollbackAutoUpdateAgentGroup_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/RollbackAutoUpdateAgentGroup"
-	AutoUpdateService_ListAutoUpdateAgentReports_FullMethodName   = "/teleport.autoupdate.v1.AutoUpdateService/ListAutoUpdateAgentReports"
-	AutoUpdateService_GetAutoUpdateAgentReport_FullMethodName     = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateAgentReport"
-	AutoUpdateService_CreateAutoUpdateAgentReport_FullMethodName  = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateAgentReport"
-	AutoUpdateService_UpdateAutoUpdateAgentReport_FullMethodName  = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateAgentReport"
-	AutoUpdateService_UpsertAutoUpdateAgentReport_FullMethodName  = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateAgentReport"
-	AutoUpdateService_DeleteAutoUpdateAgentReport_FullMethodName  = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateAgentReport"
+	AutoUpdateService_GetAutoUpdateConfig_FullMethodName               = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateConfig"
+	AutoUpdateService_CreateAutoUpdateConfig_FullMethodName            = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateConfig"
+	AutoUpdateService_UpdateAutoUpdateConfig_FullMethodName            = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateConfig"
+	AutoUpdateService_UpsertAutoUpdateConfig_FullMethodName            = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateConfig"
+	AutoUpdateService_DeleteAutoUpdateConfig_FullMethodName            = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateConfig"
+	AutoUpdateService_GetAutoUpdateVersion_FullMethodName              = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateVersion"
+	AutoUpdateService_CreateAutoUpdateVersion_FullMethodName           = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateVersion"
+	AutoUpdateService_UpdateAutoUpdateVersion_FullMethodName           = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateVersion"
+	AutoUpdateService_UpsertAutoUpdateVersion_FullMethodName           = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateVersion"
+	AutoUpdateService_DeleteAutoUpdateVersion_FullMethodName           = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateVersion"
+	AutoUpdateService_GetAutoUpdateAgentRollout_FullMethodName         = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateAgentRollout"
+	AutoUpdateService_CreateAutoUpdateAgentRollout_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateAgentRollout"
+	AutoUpdateService_UpdateAutoUpdateAgentRollout_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateAgentRollout"
+	AutoUpdateService_UpsertAutoUpdateAgentRollout_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateAgentRollout"
+	AutoUpdateService_DeleteAutoUpdateAgentRollout_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateAgentRollout"
+	AutoUpdateService_TriggerAutoUpdateAgentGroup_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/TriggerAutoUpdateAgentGroup"
+	AutoUpdateService_ForceAutoUpdateAgentGroup_FullMethodName         = "/teleport.autoupdate.v1.AutoUpdateService/ForceAutoUpdateAgentGroup"
+	AutoUpdateService_RollbackAutoUpdateAgentGroup_FullMethodName      = "/teleport.autoupdate.v1.AutoUpdateService/RollbackAutoUpdateAgentGroup"
+	AutoUpdateService_ListAutoUpdateAgentReports_FullMethodName        = "/teleport.autoupdate.v1.AutoUpdateService/ListAutoUpdateAgentReports"
+	AutoUpdateService_GetAutoUpdateAgentReport_FullMethodName          = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateAgentReport"
+	AutoUpdateService_CreateAutoUpdateAgentReport_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/CreateAutoUpdateAgentReport"
+	AutoUpdateService_UpdateAutoUpdateAgentReport_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/UpdateAutoUpdateAgentReport"
+	AutoUpdateService_UpsertAutoUpdateAgentReport_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/UpsertAutoUpdateAgentReport"
+	AutoUpdateService_DeleteAutoUpdateAgentReport_FullMethodName       = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateAgentReport"
+	AutoUpdateService_GetAutoUpdateBotInstanceReport_FullMethodName    = "/teleport.autoupdate.v1.AutoUpdateService/GetAutoUpdateBotInstanceReport"
+	AutoUpdateService_DeleteAutoUpdateBotInstanceReport_FullMethodName = "/teleport.autoupdate.v1.AutoUpdateService/DeleteAutoUpdateBotInstanceReport"
 )
 
 // AutoUpdateServiceClient is the client API for AutoUpdateService service.
@@ -116,6 +118,10 @@ type AutoUpdateServiceClient interface {
 	UpsertAutoUpdateAgentReport(ctx context.Context, in *UpsertAutoUpdateAgentReportRequest, opts ...grpc.CallOption) (*AutoUpdateAgentReport, error)
 	// DeleteAutoUpdateAgentReport removes the specified AutoUpdateAgentReport resource.
 	DeleteAutoUpdateAgentReport(ctx context.Context, in *DeleteAutoUpdateAgentReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// GetAutoUpdateBotInstanceReport returns the singleton AutoUpdateBotInstanceReport resource.
+	GetAutoUpdateBotInstanceReport(ctx context.Context, in *GetAutoUpdateBotInstanceReportRequest, opts ...grpc.CallOption) (*AutoUpdateBotInstanceReport, error)
+	// DeleteAutoUpdateBotInstanceReport removes the singleton AutoUpdateBotInstanceReport resource.
+	DeleteAutoUpdateBotInstanceReport(ctx context.Context, in *DeleteAutoUpdateBotInstanceReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 }
 
 type autoUpdateServiceClient struct {
@@ -366,6 +372,26 @@ func (c *autoUpdateServiceClient) DeleteAutoUpdateAgentReport(ctx context.Contex
 	return out, nil
 }
 
+func (c *autoUpdateServiceClient) GetAutoUpdateBotInstanceReport(ctx context.Context, in *GetAutoUpdateBotInstanceReportRequest, opts ...grpc.CallOption) (*AutoUpdateBotInstanceReport, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AutoUpdateBotInstanceReport)
+	err := c.cc.Invoke(ctx, AutoUpdateService_GetAutoUpdateBotInstanceReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *autoUpdateServiceClient) DeleteAutoUpdateBotInstanceReport(ctx context.Context, in *DeleteAutoUpdateBotInstanceReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, AutoUpdateService_DeleteAutoUpdateBotInstanceReport_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AutoUpdateServiceServer is the server API for AutoUpdateService service.
 // All implementations must embed UnimplementedAutoUpdateServiceServer
 // for forward compatibility.
@@ -422,6 +448,10 @@ type AutoUpdateServiceServer interface {
 	UpsertAutoUpdateAgentReport(context.Context, *UpsertAutoUpdateAgentReportRequest) (*AutoUpdateAgentReport, error)
 	// DeleteAutoUpdateAgentReport removes the specified AutoUpdateAgentReport resource.
 	DeleteAutoUpdateAgentReport(context.Context, *DeleteAutoUpdateAgentReportRequest) (*emptypb.Empty, error)
+	// GetAutoUpdateBotInstanceReport returns the singleton AutoUpdateBotInstanceReport resource.
+	GetAutoUpdateBotInstanceReport(context.Context, *GetAutoUpdateBotInstanceReportRequest) (*AutoUpdateBotInstanceReport, error)
+	// DeleteAutoUpdateBotInstanceReport removes the singleton AutoUpdateBotInstanceReport resource.
+	DeleteAutoUpdateBotInstanceReport(context.Context, *DeleteAutoUpdateBotInstanceReportRequest) (*emptypb.Empty, error)
 	mustEmbedUnimplementedAutoUpdateServiceServer()
 }
 
@@ -504,6 +534,12 @@ func (UnimplementedAutoUpdateServiceServer) UpsertAutoUpdateAgentReport(context.
 func (UnimplementedAutoUpdateServiceServer) DeleteAutoUpdateAgentReport(context.Context, *DeleteAutoUpdateAgentReportRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteAutoUpdateAgentReport not implemented")
 }
+func (UnimplementedAutoUpdateServiceServer) GetAutoUpdateBotInstanceReport(context.Context, *GetAutoUpdateBotInstanceReportRequest) (*AutoUpdateBotInstanceReport, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetAutoUpdateBotInstanceReport not implemented")
+}
+func (UnimplementedAutoUpdateServiceServer) DeleteAutoUpdateBotInstanceReport(context.Context, *DeleteAutoUpdateBotInstanceReportRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteAutoUpdateBotInstanceReport not implemented")
+}
 func (UnimplementedAutoUpdateServiceServer) mustEmbedUnimplementedAutoUpdateServiceServer() {}
 func (UnimplementedAutoUpdateServiceServer) testEmbeddedByValue()                           {}
 
@@ -957,6 +993,42 @@ func _AutoUpdateService_DeleteAutoUpdateAgentReport_Handler(srv interface{}, ctx
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AutoUpdateService_GetAutoUpdateBotInstanceReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetAutoUpdateBotInstanceReportRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AutoUpdateServiceServer).GetAutoUpdateBotInstanceReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AutoUpdateService_GetAutoUpdateBotInstanceReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AutoUpdateServiceServer).GetAutoUpdateBotInstanceReport(ctx, req.(*GetAutoUpdateBotInstanceReportRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AutoUpdateService_DeleteAutoUpdateBotInstanceReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteAutoUpdateBotInstanceReportRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AutoUpdateServiceServer).DeleteAutoUpdateBotInstanceReport(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AutoUpdateService_DeleteAutoUpdateBotInstanceReport_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AutoUpdateServiceServer).DeleteAutoUpdateBotInstanceReport(ctx, req.(*DeleteAutoUpdateBotInstanceReportRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AutoUpdateService_ServiceDesc is the grpc.ServiceDesc for AutoUpdateService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1060,6 +1132,14 @@ var AutoUpdateService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteAutoUpdateAgentReport",
 			Handler:    _AutoUpdateService_DeleteAutoUpdateAgentReport_Handler,
 		},
+		{
+			MethodName: "GetAutoUpdateBotInstanceReport",
+			Handler:    _AutoUpdateService_GetAutoUpdateBotInstanceReport_Handler,
+		},
+		{
+			MethodName: "DeleteAutoUpdateBotInstanceReport",
+			Handler:    _AutoUpdateService_DeleteAutoUpdateBotInstanceReport_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/autoupdate/v1/autoupdate_service.proto",
diff --git a/api/gen/proto/go/teleport/backendinfo/v1/backendinfo.pb.go b/api/gen/proto/go/teleport/backendinfo/v1/backendinfo.pb.go
index 74a2ceb4d3e65..c687584b3278e 100644
--- a/api/gen/proto/go/teleport/backendinfo/v1/backendinfo.pb.go
+++ b/api/gen/proto/go/teleport/backendinfo/v1/backendinfo.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/backendinfo/v1/backendinfo.proto
 
diff --git a/api/gen/proto/go/teleport/clusterconfig/v1/access_graph.pb.go b/api/gen/proto/go/teleport/clusterconfig/v1/access_graph.pb.go
index 2da20d74a5402..f3bac24badb93 100644
--- a/api/gen/proto/go/teleport/clusterconfig/v1/access_graph.pb.go
+++ b/api/gen/proto/go/teleport/clusterconfig/v1/access_graph.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph.proto
 
diff --git a/api/gen/proto/go/teleport/clusterconfig/v1/access_graph_settings.pb.go b/api/gen/proto/go/teleport/clusterconfig/v1/access_graph_settings.pb.go
index 863d63d278e23..fa5afc39663b7 100644
--- a/api/gen/proto/go/teleport/clusterconfig/v1/access_graph_settings.pb.go
+++ b/api/gen/proto/go/teleport/clusterconfig/v1/access_graph_settings.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph_settings.proto
 
diff --git a/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service.pb.go b/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service.pb.go
index c9eddf30917cf..a6a1fc908c448 100644
--- a/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service.pb.go
+++ b/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/clusterconfig_service.proto
 
diff --git a/api/gen/proto/go/teleport/componentfeatures/v1/component_features.pb.go b/api/gen/proto/go/teleport/componentfeatures/v1/component_features.pb.go
new file mode 100644
index 0000000000000..6edea26358322
--- /dev/null
+++ b/api/gen/proto/go/teleport/componentfeatures/v1/component_features.pb.go
@@ -0,0 +1,414 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: teleport/componentfeatures/v1/component_features.proto
+
+package componentfeaturesv1
+
+import (
+	fmt "fmt"
+	proto "github.com/gogo/protobuf/proto"
+	io "io"
+	math "math"
+	math_bits "math/bits"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
+
+// ComponentFeatureID is an identifier for a specific feature supported by a Teleport component.
+type ComponentFeatureID int32
+
+const (
+	ComponentFeatureID_COMPONENT_FEATURE_ID_UNSPECIFIED ComponentFeatureID = 0
+	// ResourceConstraintsV1 indicates support for Resource Constraints and ResourceAccessIDs, as defined in RFD 228.
+	ComponentFeatureID_COMPONENT_FEATURE_ID_RESOURCE_CONSTRAINTS_V1 ComponentFeatureID = 1
+)
+
+var ComponentFeatureID_name = map[int32]string{
+	0: "COMPONENT_FEATURE_ID_UNSPECIFIED",
+	1: "COMPONENT_FEATURE_ID_RESOURCE_CONSTRAINTS_V1",
+}
+
+var ComponentFeatureID_value = map[string]int32{
+	"COMPONENT_FEATURE_ID_UNSPECIFIED":             0,
+	"COMPONENT_FEATURE_ID_RESOURCE_CONSTRAINTS_V1": 1,
+}
+
+func (x ComponentFeatureID) String() string {
+	return proto.EnumName(ComponentFeatureID_name, int32(x))
+}
+
+func (ComponentFeatureID) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_a4949687356da643, []int{0}
+}
+
+// ComponentFeatures represents a set of features supported by a given Teleport component.
+type ComponentFeatures struct {
+	// features is a list of supported feature identifiers.
+	Features             []ComponentFeatureID `protobuf:"varint,1,rep,packed,name=features,proto3,enum=teleport.componentfeatures.v1.ComponentFeatureID" json:"features,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
+	XXX_unrecognized     []byte               `json:"-"`
+	XXX_sizecache        int32                `json:"-"`
+}
+
+func (m *ComponentFeatures) Reset()         { *m = ComponentFeatures{} }
+func (m *ComponentFeatures) String() string { return proto.CompactTextString(m) }
+func (*ComponentFeatures) ProtoMessage()    {}
+func (*ComponentFeatures) Descriptor() ([]byte, []int) {
+	return fileDescriptor_a4949687356da643, []int{0}
+}
+func (m *ComponentFeatures) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ComponentFeatures) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ComponentFeatures.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ComponentFeatures) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ComponentFeatures.Merge(m, src)
+}
+func (m *ComponentFeatures) XXX_Size() int {
+	return m.Size()
+}
+func (m *ComponentFeatures) XXX_DiscardUnknown() {
+	xxx_messageInfo_ComponentFeatures.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ComponentFeatures proto.InternalMessageInfo
+
+func (m *ComponentFeatures) GetFeatures() []ComponentFeatureID {
+	if m != nil {
+		return m.Features
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterEnum("teleport.componentfeatures.v1.ComponentFeatureID", ComponentFeatureID_name, ComponentFeatureID_value)
+	proto.RegisterType((*ComponentFeatures)(nil), "teleport.componentfeatures.v1.ComponentFeatures")
+}
+
+func init() {
+	proto.RegisterFile("teleport/componentfeatures/v1/component_features.proto", fileDescriptor_a4949687356da643)
+}
+
+var fileDescriptor_a4949687356da643 = []byte{
+	// 256 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x32, 0x2b, 0x49, 0xcd, 0x49,
+	0x2d, 0xc8, 0x2f, 0x2a, 0xd1, 0x4f, 0xce, 0xcf, 0x2d, 0xc8, 0xcf, 0x4b, 0xcd, 0x2b, 0x49, 0x4b,
+	0x4d, 0x2c, 0x29, 0x2d, 0x4a, 0x2d, 0xd6, 0x2f, 0x33, 0x44, 0x08, 0xc6, 0xc3, 0x44, 0xf5, 0x0a,
+	0x8a, 0xf2, 0x4b, 0xf2, 0x85, 0x64, 0x61, 0xfa, 0xf4, 0x30, 0xf4, 0xe9, 0x95, 0x19, 0x2a, 0x25,
+	0x71, 0x09, 0x3a, 0xc3, 0xc4, 0xdd, 0xa0, 0xe2, 0x42, 0xbe, 0x5c, 0x1c, 0x30, 0x35, 0x12, 0x8c,
+	0x0a, 0xcc, 0x1a, 0x7c, 0x46, 0x86, 0x7a, 0x78, 0x8d, 0xd1, 0x43, 0x37, 0xc3, 0xd3, 0x25, 0x08,
+	0x6e, 0x84, 0x56, 0x0e, 0x97, 0x10, 0xa6, 0xbc, 0x90, 0x0a, 0x97, 0x82, 0xb3, 0xbf, 0x6f, 0x80,
+	0xbf, 0x9f, 0xab, 0x5f, 0x48, 0xbc, 0x9b, 0xab, 0x63, 0x48, 0x68, 0x90, 0x6b, 0xbc, 0xa7, 0x4b,
+	0x7c, 0xa8, 0x5f, 0x70, 0x80, 0xab, 0xb3, 0xa7, 0x9b, 0xa7, 0xab, 0x8b, 0x00, 0x83, 0x90, 0x01,
+	0x97, 0x0e, 0x56, 0x55, 0x41, 0xae, 0xc1, 0xfe, 0xa1, 0x41, 0xce, 0xae, 0xf1, 0xce, 0xfe, 0x7e,
+	0xc1, 0x21, 0x41, 0x8e, 0x9e, 0x7e, 0x21, 0xc1, 0xf1, 0x61, 0x86, 0x02, 0x8c, 0x4e, 0x45, 0x27,
+	0x1e, 0xc9, 0x31, 0x5e, 0x78, 0x24, 0xc7, 0xf8, 0xe0, 0x91, 0x1c, 0x63, 0x54, 0x4a, 0x7a, 0x66,
+	0x49, 0x46, 0x69, 0x12, 0xc8, 0xd5, 0xfa, 0xe9, 0x45, 0x89, 0x65, 0x99, 0x25, 0x89, 0x25, 0x99,
+	0xf9, 0x79, 0x89, 0x39, 0xfa, 0xf0, 0xf0, 0x4c, 0x2c, 0xc8, 0xd4, 0x4f, 0x4f, 0xcd, 0xd3, 0x07,
+	0x87, 0x97, 0x7e, 0x7a, 0xbe, 0x3e, 0xde, 0x90, 0xb6, 0xc6, 0x10, 0x2c, 0x33, 0x4c, 0x62, 0x03,
+	0xeb, 0x35, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0x72, 0x26, 0xf7, 0x8d, 0xa5, 0x01, 0x00, 0x00,
+}
+
+func (m *ComponentFeatures) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ComponentFeatures) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ComponentFeatures) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Features) > 0 {
+		dAtA2 := make([]byte, len(m.Features)*10)
+		var j1 int
+		for _, num := range m.Features {
+			for num >= 1<<7 {
+				dAtA2[j1] = uint8(uint64(num)&0x7f | 0x80)
+				num >>= 7
+				j1++
+			}
+			dAtA2[j1] = uint8(num)
+			j1++
+		}
+		i -= j1
+		copy(dAtA[i:], dAtA2[:j1])
+		i = encodeVarintComponentFeatures(dAtA, i, uint64(j1))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintComponentFeatures(dAtA []byte, offset int, v uint64) int {
+	offset -= sovComponentFeatures(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *ComponentFeatures) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Features) > 0 {
+		l = 0
+		for _, e := range m.Features {
+			l += sovComponentFeatures(uint64(e))
+		}
+		n += 1 + sovComponentFeatures(uint64(l)) + l
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func sovComponentFeatures(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozComponentFeatures(x uint64) (n int) {
+	return sovComponentFeatures(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *ComponentFeatures) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowComponentFeatures
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ComponentFeatures: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ComponentFeatures: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType == 0 {
+				var v ComponentFeatureID
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowComponentFeatures
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					v |= ComponentFeatureID(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				m.Features = append(m.Features, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowComponentFeatures
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return ErrInvalidLengthComponentFeatures
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return ErrInvalidLengthComponentFeatures
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				if elementCount != 0 && len(m.Features) == 0 {
+					m.Features = make([]ComponentFeatureID, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v ComponentFeatureID
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowComponentFeatures
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						v |= ComponentFeatureID(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					m.Features = append(m.Features, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipComponentFeatures(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthComponentFeatures
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipComponentFeatures(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowComponentFeatures
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowComponentFeatures
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowComponentFeatures
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthComponentFeatures
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupComponentFeatures
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthComponentFeatures
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthComponentFeatures        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowComponentFeatures          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupComponentFeatures = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel.pb.go b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel.pb.go
index 1173000d5f2bd..09e2c5e80cde1 100644
--- a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel.pb.go
+++ b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel.proto
 
diff --git a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service.pb.go b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service.pb.go
index 32e4e17577669..a3c95bd63d232 100644
--- a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service.pb.go
+++ b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel_service.proto
 
diff --git a/api/gen/proto/go/teleport/dbobject/v1/dbobject.pb.go b/api/gen/proto/go/teleport/dbobject/v1/dbobject.pb.go
index ddde1670feb0a..a70c6b5169ab2 100644
--- a/api/gen/proto/go/teleport/dbobject/v1/dbobject.pb.go
+++ b/api/gen/proto/go/teleport/dbobject/v1/dbobject.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject.proto
 
diff --git a/api/gen/proto/go/teleport/dbobject/v1/dbobject_service.pb.go b/api/gen/proto/go/teleport/dbobject/v1/dbobject_service.pb.go
index 7e3e511a9e1b0..f66439f480d2f 100644
--- a/api/gen/proto/go/teleport/dbobject/v1/dbobject_service.pb.go
+++ b/api/gen/proto/go/teleport/dbobject/v1/dbobject_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject_service.proto
 
diff --git a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule.pb.go b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule.pb.go
index 824babbc7101b..301cc3b123060 100644
--- a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule.pb.go
+++ b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule.proto
 
diff --git a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service.pb.go b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service.pb.go
index 162dfa6ba1b11..432360fd976b5 100644
--- a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service.pb.go
+++ b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule_service.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/database_access.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/database_access.pb.go
index d300d7c286d9e..7ce6301001792 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/database_access.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/database_access.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/database_access.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go
index 0154e1697a5ee..43e4a6c4e5aed 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/decision_service.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/denial_metadata.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/denial_metadata.pb.go
index 73ed6a281d03f..00add5e2b6b12 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/denial_metadata.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/denial_metadata.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/denial_metadata.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/enforcement_feature.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/enforcement_feature.pb.go
index cc064e315501c..d990dced49ab7 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/enforcement_feature.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/enforcement_feature.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/enforcement_feature.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/permit_metadata.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/permit_metadata.pb.go
index e5a24022e1a7b..a6af9f4e0bb8c 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/permit_metadata.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/permit_metadata.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/permit_metadata.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/request_metadata.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/request_metadata.pb.go
index 5f7896b6ba042..e125aadff9d06 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/request_metadata.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/request_metadata.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/request_metadata.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/resource.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/resource.pb.go
index c8df27c64b175..fe214de27cc86 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/resource.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/resource.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/resource.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_access.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_access.pb.go
index afe7acf4332c7..48653c61c8a40 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_access.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_access.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_access.proto
 
@@ -583,7 +583,13 @@ type LockTarget struct {
 	// Requires Teleport Enterprise.
 	Device string `protobuf:"bytes,7,opt,name=device,proto3" json:"device,omitempty"`
 	// ServerID is the host id of the Teleport instance.
-	ServerId      string `protobuf:"bytes,8,opt,name=server_id,json=serverId,proto3" json:"server_id,omitempty"`
+	ServerId string `protobuf:"bytes,8,opt,name=server_id,json=serverId,proto3" json:"server_id,omitempty"`
+	// BotInstanceID is the bot instance ID if this is a bot identity.
+	BotInstanceId string `protobuf:"bytes,9,opt,name=bot_instance_id,json=botInstanceId,proto3" json:"bot_instance_id,omitempty"`
+	// JoinToken is the name of the join token used when this identity originally
+	// joined. This only applies to bot identities, and cannot be used to target
+	// bots that joined via the `token` join method.
+	JoinToken     string `protobuf:"bytes,10,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -674,6 +680,20 @@ func (x *LockTarget) GetServerId() string {
 	return ""
 }
 
+func (x *LockTarget) GetBotInstanceId() string {
+	if x != nil {
+		return x.BotInstanceId
+	}
+	return ""
+}
+
+func (x *LockTarget) GetJoinToken() string {
+	if x != nil {
+		return x.JoinToken
+	}
+	return ""
+}
+
 // HostUsersInfo keeps information about groups and sudoers entries
 // for a particular host user
 type HostUsersInfo struct {
@@ -794,7 +814,7 @@ const file_teleport_decision_v1alpha1_ssh_access_proto_rawDesc = "" +
 	"\fmapped_roles\x18\x17 \x03(\tR\vmappedRoles\x12Q\n" +
 	"\x0fhost_users_info\x18\x18 \x01(\v2).teleport.decision.v1alpha1.HostUsersInfoR\rhostUsersInfoJ\x04\b\x02\x10\x03J\x04\b\x04\x10\x05J\x04\b\a\x10\bJ\x04\b\f\x10\rJ\x04\b\r\x10\x0eJ\x04\b\x0f\x10\x10J\x04\b\x10\x10\x11J\x04\b\x11\x10\x12\"Y\n" +
 	"\x0fSSHAccessDenial\x12F\n" +
-	"\bmetadata\x18\x01 \x01(\v2*.teleport.decision.v1alpha1.DenialMetadataR\bmetadata\"\xee\x01\n" +
+	"\bmetadata\x18\x01 \x01(\v2*.teleport.decision.v1alpha1.DenialMetadataR\bmetadata\"\xb5\x02\n" +
 	"\n" +
 	"LockTarget\x12\x12\n" +
 	"\x04user\x18\x01 \x01(\tR\x04user\x12\x12\n" +
@@ -805,7 +825,11 @@ const file_teleport_decision_v1alpha1_ssh_access_proto_rawDesc = "" +
 	"\x0fwindows_desktop\x18\x05 \x01(\tR\x0ewindowsDesktop\x12%\n" +
 	"\x0eaccess_request\x18\x06 \x01(\tR\raccessRequest\x12\x16\n" +
 	"\x06device\x18\a \x01(\tR\x06device\x12\x1b\n" +
-	"\tserver_id\x18\b \x01(\tR\bserverId\"\x9f\x01\n" +
+	"\tserver_id\x18\b \x01(\tR\bserverId\x12&\n" +
+	"\x0fbot_instance_id\x18\t \x01(\tR\rbotInstanceId\x12\x1d\n" +
+	"\n" +
+	"join_token\x18\n" +
+	" \x01(\tR\tjoinToken\"\x9f\x01\n" +
 	"\rHostUsersInfo\x12\x16\n" +
 	"\x06groups\x18\x01 \x03(\tR\x06groups\x12<\n" +
 	"\x04mode\x18\x02 \x01(\x0e2(.teleport.decision.v1alpha1.HostUserModeR\x04mode\x12\x10\n" +
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_identity.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_identity.pb.go
index e18ccb4fc744d..2769d5fa8b2d2 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_identity.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_identity.pb.go
@@ -14,13 +14,14 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_identity.proto
 
 package decisionpb
 
 import (
+	v11 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/trait/v1"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
@@ -283,8 +284,16 @@ type SSHIdentity struct {
 	// GitHubUsername indicates the GitHub username identified by the GitHub
 	// connector.
 	GithubUsername string `protobuf:"bytes,33,opt,name=github_username,json=githubUsername,proto3" json:"github_username,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// JoinToken is the name of the join token used for bot joining. It is unset
+	// for other identity types, or for bots using the `token` join method.
+	JoinToken string `protobuf:"bytes,34,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
+	// ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+	// set, the Roles field must not be set.
+	ScopePin *v11.Pin `protobuf:"bytes,35,opt,name=scope_pin,json=scopePin,proto3" json:"scope_pin,omitempty"`
+	// The scope associated with a host identity.
+	AgentScope    string `protobuf:"bytes,36,opt,name=agent_scope,json=agentScope,proto3" json:"agent_scope,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SSHIdentity) Reset() {
@@ -548,6 +557,27 @@ func (x *SSHIdentity) GetGithubUsername() string {
 	return ""
 }
 
+func (x *SSHIdentity) GetJoinToken() string {
+	if x != nil {
+		return x.JoinToken
+	}
+	return ""
+}
+
+func (x *SSHIdentity) GetScopePin() *v11.Pin {
+	if x != nil {
+		return x.ScopePin
+	}
+	return nil
+}
+
+func (x *SSHIdentity) GetAgentScope() string {
+	if x != nil {
+		return x.AgentScope
+	}
+	return ""
+}
+
 // CertExtension represents a key/value for a certificate extension. This type must
 // be kept up to date with types.CertExtension.
 type CertExtension struct {
@@ -630,10 +660,10 @@ var File_teleport_decision_v1alpha1_ssh_identity_proto protoreflect.FileDescript
 
 const file_teleport_decision_v1alpha1_ssh_identity_proto_rawDesc = "" +
 	"\n" +
-	"-teleport/decision/v1alpha1/ssh_identity.proto\x12\x1ateleport.decision.v1alpha1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a-teleport/decision/v1alpha1/tls_identity.proto\x1a\x1dteleport/trait/v1/trait.proto\"X\n" +
+	"-teleport/decision/v1alpha1/ssh_identity.proto\x12\x1ateleport.decision.v1alpha1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a-teleport/decision/v1alpha1/tls_identity.proto\x1a\x1fteleport/scopes/v1/scopes.proto\x1a\x1dteleport/trait/v1/trait.proto\"X\n" +
 	"\fSSHAuthority\x12!\n" +
 	"\fcluster_name\x18\x01 \x01(\tR\vclusterName\x12%\n" +
-	"\x0eauthority_type\x18\x02 \x01(\tR\rauthorityType\"\x9a\v\n" +
+	"\x0eauthority_type\x18\x02 \x01(\tR\rauthorityType\"\x90\f\n" +
 	"\vSSHIdentity\x12\x1f\n" +
 	"\vvalid_after\x18\x01 \x01(\x04R\n" +
 	"validAfter\x12!\n" +
@@ -674,7 +704,12 @@ const file_teleport_decision_v1alpha1_ssh_identity_proto_rawDesc = "" +
 	"\x10device_asset_tag\x18\x1e \x01(\tR\x0edeviceAssetTag\x120\n" +
 	"\x14device_credential_id\x18\x1f \x01(\tR\x12deviceCredentialId\x12$\n" +
 	"\x0egithub_user_id\x18  \x01(\tR\fgithubUserId\x12'\n" +
-	"\x0fgithub_username\x18! \x01(\tR\x0egithubUsername\"\xbf\x01\n" +
+	"\x0fgithub_username\x18! \x01(\tR\x0egithubUsername\x12\x1d\n" +
+	"\n" +
+	"join_token\x18\" \x01(\tR\tjoinToken\x124\n" +
+	"\tscope_pin\x18# \x01(\v2\x17.teleport.scopes.v1.PinR\bscopePin\x12\x1f\n" +
+	"\vagent_scope\x18$ \x01(\tR\n" +
+	"agentScope\"\xbf\x01\n" +
 	"\rCertExtension\x12A\n" +
 	"\x04type\x18\x01 \x01(\x0e2-.teleport.decision.v1alpha1.CertExtensionTypeR\x04type\x12A\n" +
 	"\x04mode\x18\x02 \x01(\x0e2-.teleport.decision.v1alpha1.CertExtensionModeR\x04mode\x12\x12\n" +
@@ -710,19 +745,21 @@ var file_teleport_decision_v1alpha1_ssh_identity_proto_goTypes = []any{
 	(*v1.Trait)(nil),              // 5: teleport.trait.v1.Trait
 	(*timestamppb.Timestamp)(nil), // 6: google.protobuf.Timestamp
 	(*ResourceId)(nil),            // 7: teleport.decision.v1alpha1.ResourceId
+	(*v11.Pin)(nil),               // 8: teleport.scopes.v1.Pin
 }
 var file_teleport_decision_v1alpha1_ssh_identity_proto_depIdxs = []int32{
 	5, // 0: teleport.decision.v1alpha1.SSHIdentity.traits:type_name -> teleport.trait.v1.Trait
 	6, // 1: teleport.decision.v1alpha1.SSHIdentity.previous_identity_expires:type_name -> google.protobuf.Timestamp
 	4, // 2: teleport.decision.v1alpha1.SSHIdentity.certificate_extensions:type_name -> teleport.decision.v1alpha1.CertExtension
 	7, // 3: teleport.decision.v1alpha1.SSHIdentity.allowed_resource_ids:type_name -> teleport.decision.v1alpha1.ResourceId
-	1, // 4: teleport.decision.v1alpha1.CertExtension.type:type_name -> teleport.decision.v1alpha1.CertExtensionType
-	0, // 5: teleport.decision.v1alpha1.CertExtension.mode:type_name -> teleport.decision.v1alpha1.CertExtensionMode
-	6, // [6:6] is the sub-list for method output_type
-	6, // [6:6] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension type_name
-	6, // [6:6] is the sub-list for extension extendee
-	0, // [0:6] is the sub-list for field type_name
+	8, // 4: teleport.decision.v1alpha1.SSHIdentity.scope_pin:type_name -> teleport.scopes.v1.Pin
+	1, // 5: teleport.decision.v1alpha1.CertExtension.type:type_name -> teleport.decision.v1alpha1.CertExtensionType
+	0, // 6: teleport.decision.v1alpha1.CertExtension.mode:type_name -> teleport.decision.v1alpha1.CertExtensionMode
+	7, // [7:7] is the sub-list for method output_type
+	7, // [7:7] is the sub-list for method input_type
+	7, // [7:7] is the sub-list for extension type_name
+	7, // [7:7] is the sub-list for extension extendee
+	0, // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_teleport_decision_v1alpha1_ssh_identity_proto_init() }
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_join.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_join.pb.go
index e3e11957b1859..d3b4c3707dadc 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/ssh_join.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/ssh_join.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_join.proto
 
diff --git a/api/gen/proto/go/teleport/decision/v1alpha1/tls_identity.pb.go b/api/gen/proto/go/teleport/decision/v1alpha1/tls_identity.pb.go
index 17d3b9f19a789..c62b8691044e2 100644
--- a/api/gen/proto/go/teleport/decision/v1alpha1/tls_identity.pb.go
+++ b/api/gen/proto/go/teleport/decision/v1alpha1/tls_identity.pb.go
@@ -14,13 +14,14 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/tls_identity.proto
 
 package decisionpb
 
 import (
+	v11 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/trait/v1"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
@@ -131,7 +132,14 @@ type TLSIdentity struct {
 	// DeviceExtensions holds device-aware extensions for the identity.
 	DeviceExtensions *DeviceExtensions `protobuf:"bytes,34,opt,name=device_extensions,json=deviceExtensions,proto3" json:"device_extensions,omitempty"`
 	// UserType indicates if the User was created by an SSO Provider or locally.
-	UserType      string `protobuf:"bytes,35,opt,name=user_type,json=userType,proto3" json:"user_type,omitempty"`
+	UserType string `protobuf:"bytes,35,opt,name=user_type,json=userType,proto3" json:"user_type,omitempty"`
+	// JoinToken is the name of the join token used when a bot joins; it does not
+	// apply to other identity types, or to bots using the traditional `token`
+	// join method.
+	JoinToken string `protobuf:"bytes,36,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
+	// ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+	// set, the Roles field must not be set.
+	ScopePin      *v11.Pin `protobuf:"bytes,37,opt,name=scope_pin,json=scopePin,proto3" json:"scope_pin,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -411,6 +419,20 @@ func (x *TLSIdentity) GetUserType() string {
 	return ""
 }
 
+func (x *TLSIdentity) GetJoinToken() string {
+	if x != nil {
+		return x.JoinToken
+	}
+	return ""
+}
+
+func (x *TLSIdentity) GetScopePin() *v11.Pin {
+	if x != nil {
+		return x.ScopePin
+	}
+	return nil
+}
+
 // RouteToApp holds routing information for applications.
 type RouteToApp struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -785,7 +807,7 @@ var File_teleport_decision_v1alpha1_tls_identity_proto protoreflect.FileDescript
 
 const file_teleport_decision_v1alpha1_tls_identity_proto_rawDesc = "" +
 	"\n" +
-	"-teleport/decision/v1alpha1/tls_identity.proto\x12\x1ateleport.decision.v1alpha1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1dteleport/trait/v1/trait.proto\"\xb6\f\n" +
+	"-teleport/decision/v1alpha1/tls_identity.proto\x12\x1ateleport.decision.v1alpha1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1fteleport/scopes/v1/scopes.proto\x1a\x1dteleport/trait/v1/trait.proto\"\x8b\r\n" +
 	"\vTLSIdentity\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12\"\n" +
 	"\fimpersonator\x18\x02 \x01(\tR\fimpersonator\x12\x16\n" +
@@ -827,7 +849,10 @@ const file_teleport_decision_v1alpha1_tls_identity_proto_rawDesc = "" +
 	"\x12private_key_policy\x18  \x01(\tR\x10privateKeyPolicy\x128\n" +
 	"\x18connection_diagnostic_id\x18! \x01(\tR\x16connectionDiagnosticId\x12Y\n" +
 	"\x11device_extensions\x18\" \x01(\v2,.teleport.decision.v1alpha1.DeviceExtensionsR\x10deviceExtensions\x12\x1b\n" +
-	"\tuser_type\x18# \x01(\tR\buserType\"\xfb\x02\n" +
+	"\tuser_type\x18# \x01(\tR\buserType\x12\x1d\n" +
+	"\n" +
+	"join_token\x18$ \x01(\tR\tjoinToken\x124\n" +
+	"\tscope_pin\x18% \x01(\v2\x17.teleport.scopes.v1.PinR\bscopePin\"\xfb\x02\n" +
 	"\n" +
 	"RouteToApp\x12\x1d\n" +
 	"\n" +
@@ -883,6 +908,7 @@ var file_teleport_decision_v1alpha1_tls_identity_proto_goTypes = []any{
 	(*DeviceExtensions)(nil),      // 4: teleport.decision.v1alpha1.DeviceExtensions
 	(*timestamppb.Timestamp)(nil), // 5: google.protobuf.Timestamp
 	(*v1.Trait)(nil),              // 6: teleport.trait.v1.Trait
+	(*v11.Pin)(nil),               // 7: teleport.scopes.v1.Pin
 }
 var file_teleport_decision_v1alpha1_tls_identity_proto_depIdxs = []int32{
 	5, // 0: teleport.decision.v1alpha1.TLSIdentity.expires:type_name -> google.protobuf.Timestamp
@@ -892,11 +918,12 @@ var file_teleport_decision_v1alpha1_tls_identity_proto_depIdxs = []int32{
 	5, // 4: teleport.decision.v1alpha1.TLSIdentity.previous_identity_expires:type_name -> google.protobuf.Timestamp
 	3, // 5: teleport.decision.v1alpha1.TLSIdentity.allowed_resource_ids:type_name -> teleport.decision.v1alpha1.ResourceId
 	4, // 6: teleport.decision.v1alpha1.TLSIdentity.device_extensions:type_name -> teleport.decision.v1alpha1.DeviceExtensions
-	7, // [7:7] is the sub-list for method output_type
-	7, // [7:7] is the sub-list for method input_type
-	7, // [7:7] is the sub-list for extension type_name
-	7, // [7:7] is the sub-list for extension extendee
-	0, // [0:7] is the sub-list for field type_name
+	7, // 7: teleport.decision.v1alpha1.TLSIdentity.scope_pin:type_name -> teleport.scopes.v1.Pin
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_teleport_decision_v1alpha1_tls_identity_proto_init() }
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/assert.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/assert.pb.go
index 9270eeeb8a283..f7bdde38bba00 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/assert.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/assert.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/assert.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/authenticate_challenge.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/authenticate_challenge.pb.go
index a47f45fcf4962..6d4ced0b2cd75 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/authenticate_challenge.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/authenticate_challenge.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/authenticate_challenge.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device.pb.go
index 5cc79c6aa89fe..e4aaae7252d74 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
index 854accb8f7948..8d3b9dcad9eff 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_collected_data.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_confirmation_token.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_confirmation_token.pb.go
index 3b13881886de5..d2767483b8386 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_confirmation_token.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_confirmation_token.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_confirmation_token.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_enroll_token.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_enroll_token.pb.go
index 713cb363701be..75b7cf0b65a07 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_enroll_token.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_enroll_token.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_enroll_token.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
index 5c670ece8dd01..cb6c2ba029c8d 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_profile.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_source.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_source.pb.go
index 5e80e96a00d73..5599da55a51db 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_source.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_source.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_source.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_web_token.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_web_token.pb.go
index 770085f40baa9..825f70a2aeead 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_web_token.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_web_token.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_web_token.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
index 7be523d4582b3..763906d0f8ca0 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/devicetrust_service.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/os_type.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/os_type.pb.go
index fe032bac221e4..130a707e7577f 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/os_type.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/os_type.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/os_type.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go
index 0abc17890ae8f..a16ca14f2f84a 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/tpm.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/usage.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/usage.pb.go
index 03bf57e6c23f3..69c1da08ef4a3 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/usage.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/usage.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/usage.proto
 
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/user_certificates.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/user_certificates.pb.go
index 26eef4bb4cc9f..715acb3bd3590 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/user_certificates.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/user_certificates.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/user_certificates.proto
 
diff --git a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig.pb.go b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig.pb.go
index d2fe7eb49522e..ffff6129ffeb5 100644
--- a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig.pb.go
+++ b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/discoveryconfig/v1/discoveryconfig.proto
 
diff --git a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service.pb.go b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service.pb.go
index d7c8bb0eb5281..cc7bdae175b03 100644
--- a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service.pb.go
+++ b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/discoveryconfig/v1/discoveryconfig_service.proto
 
diff --git a/api/gen/proto/go/teleport/dynamicwindows/v1/dynamicwindows_service.pb.go b/api/gen/proto/go/teleport/dynamicwindows/v1/dynamicwindows_service.pb.go
index 275788654b629..5edba7e6e6385 100644
--- a/api/gen/proto/go/teleport/dynamicwindows/v1/dynamicwindows_service.pb.go
+++ b/api/gen/proto/go/teleport/dynamicwindows/v1/dynamicwindows_service.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/dynamicwindows/v1/dynamicwindows_service.proto
 
diff --git a/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go b/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go
index cc28555af57c6..70651a648498f 100644
--- a/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go
+++ b/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/embedding/v1/embedding.proto
 
diff --git a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage.pb.go b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage.pb.go
index ce1b23ac0b651..8931edb6c885a 100644
--- a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage.pb.go
+++ b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/externalauditstorage/v1/externalauditstorage.proto
 
diff --git a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service.pb.go b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service.pb.go
index 761d99d9427ef..90c7b90da4f54 100644
--- a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service.pb.go
+++ b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/externalauditstorage/v1/externalauditstorage_service.proto
 
diff --git a/api/gen/proto/go/teleport/gitserver/v1/git_server_service.pb.go b/api/gen/proto/go/teleport/gitserver/v1/git_server_service.pb.go
index 980d3465450e2..cda6c07a39ee5 100644
--- a/api/gen/proto/go/teleport/gitserver/v1/git_server_service.pb.go
+++ b/api/gen/proto/go/teleport/gitserver/v1/git_server_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/gitserver/v1/git_server_service.proto
 
diff --git a/api/gen/proto/go/teleport/hardwarekeyagent/v1/hardwarekeyagent_service.pb.go b/api/gen/proto/go/teleport/hardwarekeyagent/v1/hardwarekeyagent_service.pb.go
index 685578fda3ba1..5167983b9f115 100644
--- a/api/gen/proto/go/teleport/hardwarekeyagent/v1/hardwarekeyagent_service.pb.go
+++ b/api/gen/proto/go/teleport/hardwarekeyagent/v1/hardwarekeyagent_service.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/hardwarekeyagent/v1/hardwarekeyagent_service.proto
 
diff --git a/api/gen/proto/go/teleport/header/v1/metadata.pb.go b/api/gen/proto/go/teleport/header/v1/metadata.pb.go
index eba193282c680..bd181322c9f57 100644
--- a/api/gen/proto/go/teleport/header/v1/metadata.pb.go
+++ b/api/gen/proto/go/teleport/header/v1/metadata.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/header/v1/metadata.proto
 
diff --git a/api/gen/proto/go/teleport/header/v1/resourceheader.pb.go b/api/gen/proto/go/teleport/header/v1/resourceheader.pb.go
index 5367f48cde949..808ffb909c807 100644
--- a/api/gen/proto/go/teleport/header/v1/resourceheader.pb.go
+++ b/api/gen/proto/go/teleport/header/v1/resourceheader.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/header/v1/resourceheader.proto
 
diff --git a/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config.pb.go b/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config.pb.go
index a947bd74945c8..33a1c4ebdcd44 100644
--- a/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config.pb.go
+++ b/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/healthcheckconfig/v1/health_check_config.proto
 
@@ -216,8 +216,17 @@ type Matcher struct {
 	// empty value is ignored. The match result is logically ANDed with DBLabels,
 	// if both are non-empty.
 	DbLabelsExpression string `protobuf:"bytes,2,opt,name=db_labels_expression,json=dbLabelsExpression,proto3" json:"db_labels_expression,omitempty"`
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+	// KubernetesLabels matches Kubernetes labels. An empty value is ignored. The match
+	// result is logically ANDed with KubernetesLabelsExpression, if both are non-empty.
+	KubernetesLabels []*v11.Label `protobuf:"bytes,3,rep,name=kubernetes_labels,json=kubernetesLabels,proto3" json:"kubernetes_labels,omitempty"`
+	// KubernetesLabelsExpression is a label predicate expression to match Kubernetes. An
+	// empty value is ignored. The match result is logically ANDed with KubernetesLabels,
+	// if both are non-empty.
+	KubernetesLabelsExpression string `protobuf:"bytes,4,opt,name=kubernetes_labels_expression,json=kubernetesLabelsExpression,proto3" json:"kubernetes_labels_expression,omitempty"`
+	// Disabled disables matches for all labels and expressions.
+	Disabled      bool `protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Matcher) Reset() {
@@ -264,6 +273,27 @@ func (x *Matcher) GetDbLabelsExpression() string {
 	return ""
 }
 
+func (x *Matcher) GetKubernetesLabels() []*v11.Label {
+	if x != nil {
+		return x.KubernetesLabels
+	}
+	return nil
+}
+
+func (x *Matcher) GetKubernetesLabelsExpression() string {
+	if x != nil {
+		return x.KubernetesLabelsExpression
+	}
+	return ""
+}
+
+func (x *Matcher) GetDisabled() bool {
+	if x != nil {
+		return x.Disabled
+	}
+	return false
+}
+
 var File_teleport_healthcheckconfig_v1_health_check_config_proto protoreflect.FileDescriptor
 
 const file_teleport_healthcheckconfig_v1_health_check_config_proto_rawDesc = "" +
@@ -280,10 +310,13 @@ const file_teleport_healthcheckconfig_v1_health_check_config_proto_rawDesc = ""
 	"\atimeout\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\atimeout\x125\n" +
 	"\binterval\x18\x03 \x01(\v2\x19.google.protobuf.DurationR\binterval\x12+\n" +
 	"\x11healthy_threshold\x18\x04 \x01(\rR\x10healthyThreshold\x12/\n" +
-	"\x13unhealthy_threshold\x18\x05 \x01(\rR\x12unhealthyThreshold\"r\n" +
+	"\x13unhealthy_threshold\x18\x05 \x01(\rR\x12unhealthyThreshold\"\x97\x02\n" +
 	"\aMatcher\x125\n" +
 	"\tdb_labels\x18\x01 \x03(\v2\x18.teleport.label.v1.LabelR\bdbLabels\x120\n" +
-	"\x14db_labels_expression\x18\x02 \x01(\tR\x12dbLabelsExpressionBfZdgithub.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1;healthcheckconfigv1b\x06proto3"
+	"\x14db_labels_expression\x18\x02 \x01(\tR\x12dbLabelsExpression\x12E\n" +
+	"\x11kubernetes_labels\x18\x03 \x03(\v2\x18.teleport.label.v1.LabelR\x10kubernetesLabels\x12@\n" +
+	"\x1ckubernetes_labels_expression\x18\x04 \x01(\tR\x1akubernetesLabelsExpression\x12\x1a\n" +
+	"\bdisabled\x18\x05 \x01(\bR\bdisabledBfZdgithub.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1;healthcheckconfigv1b\x06proto3"
 
 var (
 	file_teleport_healthcheckconfig_v1_health_check_config_proto_rawDescOnce sync.Once
@@ -313,11 +346,12 @@ var file_teleport_healthcheckconfig_v1_health_check_config_proto_depIdxs = []int
 	4, // 3: teleport.healthcheckconfig.v1.HealthCheckConfigSpec.timeout:type_name -> google.protobuf.Duration
 	4, // 4: teleport.healthcheckconfig.v1.HealthCheckConfigSpec.interval:type_name -> google.protobuf.Duration
 	5, // 5: teleport.healthcheckconfig.v1.Matcher.db_labels:type_name -> teleport.label.v1.Label
-	6, // [6:6] is the sub-list for method output_type
-	6, // [6:6] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension type_name
-	6, // [6:6] is the sub-list for extension extendee
-	0, // [0:6] is the sub-list for field type_name
+	5, // 6: teleport.healthcheckconfig.v1.Matcher.kubernetes_labels:type_name -> teleport.label.v1.Label
+	7, // [7:7] is the sub-list for method output_type
+	7, // [7:7] is the sub-list for method input_type
+	7, // [7:7] is the sub-list for extension type_name
+	7, // [7:7] is the sub-list for extension extendee
+	0, // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_teleport_healthcheckconfig_v1_health_check_config_proto_init() }
diff --git a/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config_service.pb.go b/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config_service.pb.go
index 9acd34767a6ef..db6c0af5845af 100644
--- a/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config_service.pb.go
+++ b/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/healthcheckconfig/v1/health_check_config_service.proto
 
diff --git a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter.pb.go b/api/gen/proto/go/teleport/identitycenter/v1/identitycenter.pb.go
index dc348468246d8..e993559e841ef 100644
--- a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter.pb.go
+++ b/api/gen/proto/go/teleport/identitycenter/v1/identitycenter.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/identitycenter/v1/identitycenter.proto
 
diff --git a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service.pb.go b/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service.pb.go
deleted file mode 100644
index 0f4a252cbfd6d..0000000000000
--- a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service.pb.go
+++ /dev/null
@@ -1,260 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/identitycenter/v1/identitycenter_service.proto
-
-package identitycenterv1
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// DeleteAllIdentityCenterAccountsRequest is a request to delete all Identity Center imported accounts.
-type DeleteAllIdentityCenterAccountsRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteAllIdentityCenterAccountsRequest) Reset() {
-	*x = DeleteAllIdentityCenterAccountsRequest{}
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteAllIdentityCenterAccountsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteAllIdentityCenterAccountsRequest) ProtoMessage() {}
-
-func (x *DeleteAllIdentityCenterAccountsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteAllIdentityCenterAccountsRequest.ProtoReflect.Descriptor instead.
-func (*DeleteAllIdentityCenterAccountsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescGZIP(), []int{0}
-}
-
-// DeleteAllAccountAssignmentsRequest is a request to delete all Identity Center account assignments.
-type DeleteAllAccountAssignmentsRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteAllAccountAssignmentsRequest) Reset() {
-	*x = DeleteAllAccountAssignmentsRequest{}
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteAllAccountAssignmentsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteAllAccountAssignmentsRequest) ProtoMessage() {}
-
-func (x *DeleteAllAccountAssignmentsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteAllAccountAssignmentsRequest.ProtoReflect.Descriptor instead.
-func (*DeleteAllAccountAssignmentsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescGZIP(), []int{1}
-}
-
-// DeleteAllPrincipalAssignmentsRequest is a request to delete all Identity Center principal assignments.
-type DeleteAllPrincipalAssignmentsRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteAllPrincipalAssignmentsRequest) Reset() {
-	*x = DeleteAllPrincipalAssignmentsRequest{}
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[2]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteAllPrincipalAssignmentsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteAllPrincipalAssignmentsRequest) ProtoMessage() {}
-
-func (x *DeleteAllPrincipalAssignmentsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[2]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteAllPrincipalAssignmentsRequest.ProtoReflect.Descriptor instead.
-func (*DeleteAllPrincipalAssignmentsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescGZIP(), []int{2}
-}
-
-// DeleteAllPermissionSetsRequest is a request to delete all Identity Center permission sets.
-type DeleteAllPermissionSetsRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteAllPermissionSetsRequest) Reset() {
-	*x = DeleteAllPermissionSetsRequest{}
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[3]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteAllPermissionSetsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteAllPermissionSetsRequest) ProtoMessage() {}
-
-func (x *DeleteAllPermissionSetsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes[3]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteAllPermissionSetsRequest.ProtoReflect.Descriptor instead.
-func (*DeleteAllPermissionSetsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescGZIP(), []int{3}
-}
-
-var File_teleport_identitycenter_v1_identitycenter_service_proto protoreflect.FileDescriptor
-
-const file_teleport_identitycenter_v1_identitycenter_service_proto_rawDesc = "" +
-	"\n" +
-	"7teleport/identitycenter/v1/identitycenter_service.proto\x12\x1ateleport.identitycenter.v1\x1a\x1bgoogle/protobuf/empty.proto\"(\n" +
-	"&DeleteAllIdentityCenterAccountsRequest\"$\n" +
-	"\"DeleteAllAccountAssignmentsRequest\"&\n" +
-	"$DeleteAllPrincipalAssignmentsRequest\" \n" +
-	"\x1eDeleteAllPermissionSetsRequest2\xf7\x03\n" +
-	"\x15IdentityCenterService\x12}\n" +
-	"\x1fDeleteAllIdentityCenterAccounts\x12B.teleport.identitycenter.v1.DeleteAllIdentityCenterAccountsRequest\x1a\x16.google.protobuf.Empty\x12u\n" +
-	"\x1bDeleteAllAccountAssignments\x12>.teleport.identitycenter.v1.DeleteAllAccountAssignmentsRequest\x1a\x16.google.protobuf.Empty\x12y\n" +
-	"\x1dDeleteAllPrincipalAssignments\x12@.teleport.identitycenter.v1.DeleteAllPrincipalAssignmentsRequest\x1a\x16.google.protobuf.Empty\x12m\n" +
-	"\x17DeleteAllPermissionSets\x12:.teleport.identitycenter.v1.DeleteAllPermissionSetsRequest\x1a\x16.google.protobuf.EmptyB`Z^github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1;identitycenterv1b\x06proto3"
-
-var (
-	file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescOnce sync.Once
-	file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescData []byte
-)
-
-func file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescGZIP() []byte {
-	file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescOnce.Do(func() {
-		file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_identitycenter_v1_identitycenter_service_proto_rawDesc), len(file_teleport_identitycenter_v1_identitycenter_service_proto_rawDesc)))
-	})
-	return file_teleport_identitycenter_v1_identitycenter_service_proto_rawDescData
-}
-
-var file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
-var file_teleport_identitycenter_v1_identitycenter_service_proto_goTypes = []any{
-	(*DeleteAllIdentityCenterAccountsRequest)(nil), // 0: teleport.identitycenter.v1.DeleteAllIdentityCenterAccountsRequest
-	(*DeleteAllAccountAssignmentsRequest)(nil),     // 1: teleport.identitycenter.v1.DeleteAllAccountAssignmentsRequest
-	(*DeleteAllPrincipalAssignmentsRequest)(nil),   // 2: teleport.identitycenter.v1.DeleteAllPrincipalAssignmentsRequest
-	(*DeleteAllPermissionSetsRequest)(nil),         // 3: teleport.identitycenter.v1.DeleteAllPermissionSetsRequest
-	(*emptypb.Empty)(nil),                          // 4: google.protobuf.Empty
-}
-var file_teleport_identitycenter_v1_identitycenter_service_proto_depIdxs = []int32{
-	0, // 0: teleport.identitycenter.v1.IdentityCenterService.DeleteAllIdentityCenterAccounts:input_type -> teleport.identitycenter.v1.DeleteAllIdentityCenterAccountsRequest
-	1, // 1: teleport.identitycenter.v1.IdentityCenterService.DeleteAllAccountAssignments:input_type -> teleport.identitycenter.v1.DeleteAllAccountAssignmentsRequest
-	2, // 2: teleport.identitycenter.v1.IdentityCenterService.DeleteAllPrincipalAssignments:input_type -> teleport.identitycenter.v1.DeleteAllPrincipalAssignmentsRequest
-	3, // 3: teleport.identitycenter.v1.IdentityCenterService.DeleteAllPermissionSets:input_type -> teleport.identitycenter.v1.DeleteAllPermissionSetsRequest
-	4, // 4: teleport.identitycenter.v1.IdentityCenterService.DeleteAllIdentityCenterAccounts:output_type -> google.protobuf.Empty
-	4, // 5: teleport.identitycenter.v1.IdentityCenterService.DeleteAllAccountAssignments:output_type -> google.protobuf.Empty
-	4, // 6: teleport.identitycenter.v1.IdentityCenterService.DeleteAllPrincipalAssignments:output_type -> google.protobuf.Empty
-	4, // 7: teleport.identitycenter.v1.IdentityCenterService.DeleteAllPermissionSets:output_type -> google.protobuf.Empty
-	4, // [4:8] is the sub-list for method output_type
-	0, // [0:4] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_teleport_identitycenter_v1_identitycenter_service_proto_init() }
-func file_teleport_identitycenter_v1_identitycenter_service_proto_init() {
-	if File_teleport_identitycenter_v1_identitycenter_service_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_identitycenter_v1_identitycenter_service_proto_rawDesc), len(file_teleport_identitycenter_v1_identitycenter_service_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   4,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_teleport_identitycenter_v1_identitycenter_service_proto_goTypes,
-		DependencyIndexes: file_teleport_identitycenter_v1_identitycenter_service_proto_depIdxs,
-		MessageInfos:      file_teleport_identitycenter_v1_identitycenter_service_proto_msgTypes,
-	}.Build()
-	File_teleport_identitycenter_v1_identitycenter_service_proto = out.File
-	file_teleport_identitycenter_v1_identitycenter_service_proto_goTypes = nil
-	file_teleport_identitycenter_v1_identitycenter_service_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service_grpc.pb.go b/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service_grpc.pb.go
deleted file mode 100644
index de6e1b076ca42..0000000000000
--- a/api/gen/proto/go/teleport/identitycenter/v1/identitycenter_service_grpc.pb.go
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             (unknown)
-// source: teleport/identitycenter/v1/identitycenter_service.proto
-
-package identitycenterv1
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	IdentityCenterService_DeleteAllIdentityCenterAccounts_FullMethodName = "/teleport.identitycenter.v1.IdentityCenterService/DeleteAllIdentityCenterAccounts"
-	IdentityCenterService_DeleteAllAccountAssignments_FullMethodName     = "/teleport.identitycenter.v1.IdentityCenterService/DeleteAllAccountAssignments"
-	IdentityCenterService_DeleteAllPrincipalAssignments_FullMethodName   = "/teleport.identitycenter.v1.IdentityCenterService/DeleteAllPrincipalAssignments"
-	IdentityCenterService_DeleteAllPermissionSets_FullMethodName         = "/teleport.identitycenter.v1.IdentityCenterService/DeleteAllPermissionSets"
-)
-
-// IdentityCenterServiceClient is the client API for IdentityCenterService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// IdentityCenterService provides methods to manage Identity Center
-// resources.
-type IdentityCenterServiceClient interface {
-	// DeleteAllIdentityCenterAccounts deletes all Identity Center accounts.
-	DeleteAllIdentityCenterAccounts(ctx context.Context, in *DeleteAllIdentityCenterAccountsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	// DeleteAllAccountAssignments deletes all Identity Center Account assignments.
-	DeleteAllAccountAssignments(ctx context.Context, in *DeleteAllAccountAssignmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	// DeleteAllPrincipalAssignments deletes all Identity Center principal assignments.
-	DeleteAllPrincipalAssignments(ctx context.Context, in *DeleteAllPrincipalAssignmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	// DeleteAllPermissionSets deletes all Identity Center permission sets.
-	DeleteAllPermissionSets(ctx context.Context, in *DeleteAllPermissionSetsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-}
-
-type identityCenterServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewIdentityCenterServiceClient(cc grpc.ClientConnInterface) IdentityCenterServiceClient {
-	return &identityCenterServiceClient{cc}
-}
-
-func (c *identityCenterServiceClient) DeleteAllIdentityCenterAccounts(ctx context.Context, in *DeleteAllIdentityCenterAccountsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IdentityCenterService_DeleteAllIdentityCenterAccounts_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *identityCenterServiceClient) DeleteAllAccountAssignments(ctx context.Context, in *DeleteAllAccountAssignmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IdentityCenterService_DeleteAllAccountAssignments_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *identityCenterServiceClient) DeleteAllPrincipalAssignments(ctx context.Context, in *DeleteAllPrincipalAssignmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IdentityCenterService_DeleteAllPrincipalAssignments_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *identityCenterServiceClient) DeleteAllPermissionSets(ctx context.Context, in *DeleteAllPermissionSetsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IdentityCenterService_DeleteAllPermissionSets_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// IdentityCenterServiceServer is the server API for IdentityCenterService service.
-// All implementations must embed UnimplementedIdentityCenterServiceServer
-// for forward compatibility.
-//
-// IdentityCenterService provides methods to manage Identity Center
-// resources.
-type IdentityCenterServiceServer interface {
-	// DeleteAllIdentityCenterAccounts deletes all Identity Center accounts.
-	DeleteAllIdentityCenterAccounts(context.Context, *DeleteAllIdentityCenterAccountsRequest) (*emptypb.Empty, error)
-	// DeleteAllAccountAssignments deletes all Identity Center Account assignments.
-	DeleteAllAccountAssignments(context.Context, *DeleteAllAccountAssignmentsRequest) (*emptypb.Empty, error)
-	// DeleteAllPrincipalAssignments deletes all Identity Center principal assignments.
-	DeleteAllPrincipalAssignments(context.Context, *DeleteAllPrincipalAssignmentsRequest) (*emptypb.Empty, error)
-	// DeleteAllPermissionSets deletes all Identity Center permission sets.
-	DeleteAllPermissionSets(context.Context, *DeleteAllPermissionSetsRequest) (*emptypb.Empty, error)
-	mustEmbedUnimplementedIdentityCenterServiceServer()
-}
-
-// UnimplementedIdentityCenterServiceServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedIdentityCenterServiceServer struct{}
-
-func (UnimplementedIdentityCenterServiceServer) DeleteAllIdentityCenterAccounts(context.Context, *DeleteAllIdentityCenterAccountsRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllIdentityCenterAccounts not implemented")
-}
-func (UnimplementedIdentityCenterServiceServer) DeleteAllAccountAssignments(context.Context, *DeleteAllAccountAssignmentsRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllAccountAssignments not implemented")
-}
-func (UnimplementedIdentityCenterServiceServer) DeleteAllPrincipalAssignments(context.Context, *DeleteAllPrincipalAssignmentsRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllPrincipalAssignments not implemented")
-}
-func (UnimplementedIdentityCenterServiceServer) DeleteAllPermissionSets(context.Context, *DeleteAllPermissionSetsRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllPermissionSets not implemented")
-}
-func (UnimplementedIdentityCenterServiceServer) mustEmbedUnimplementedIdentityCenterServiceServer() {}
-func (UnimplementedIdentityCenterServiceServer) testEmbeddedByValue()                               {}
-
-// UnsafeIdentityCenterServiceServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to IdentityCenterServiceServer will
-// result in compilation errors.
-type UnsafeIdentityCenterServiceServer interface {
-	mustEmbedUnimplementedIdentityCenterServiceServer()
-}
-
-func RegisterIdentityCenterServiceServer(s grpc.ServiceRegistrar, srv IdentityCenterServiceServer) {
-	// If the following call pancis, it indicates UnimplementedIdentityCenterServiceServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&IdentityCenterService_ServiceDesc, srv)
-}
-
-func _IdentityCenterService_DeleteAllIdentityCenterAccounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteAllIdentityCenterAccountsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(IdentityCenterServiceServer).DeleteAllIdentityCenterAccounts(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: IdentityCenterService_DeleteAllIdentityCenterAccounts_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(IdentityCenterServiceServer).DeleteAllIdentityCenterAccounts(ctx, req.(*DeleteAllIdentityCenterAccountsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _IdentityCenterService_DeleteAllAccountAssignments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteAllAccountAssignmentsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(IdentityCenterServiceServer).DeleteAllAccountAssignments(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: IdentityCenterService_DeleteAllAccountAssignments_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(IdentityCenterServiceServer).DeleteAllAccountAssignments(ctx, req.(*DeleteAllAccountAssignmentsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _IdentityCenterService_DeleteAllPrincipalAssignments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteAllPrincipalAssignmentsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(IdentityCenterServiceServer).DeleteAllPrincipalAssignments(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: IdentityCenterService_DeleteAllPrincipalAssignments_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(IdentityCenterServiceServer).DeleteAllPrincipalAssignments(ctx, req.(*DeleteAllPrincipalAssignmentsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _IdentityCenterService_DeleteAllPermissionSets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteAllPermissionSetsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(IdentityCenterServiceServer).DeleteAllPermissionSets(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: IdentityCenterService_DeleteAllPermissionSets_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(IdentityCenterServiceServer).DeleteAllPermissionSets(ctx, req.(*DeleteAllPermissionSetsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// IdentityCenterService_ServiceDesc is the grpc.ServiceDesc for IdentityCenterService service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var IdentityCenterService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "teleport.identitycenter.v1.IdentityCenterService",
-	HandlerType: (*IdentityCenterServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "DeleteAllIdentityCenterAccounts",
-			Handler:    _IdentityCenterService_DeleteAllIdentityCenterAccounts_Handler,
-		},
-		{
-			MethodName: "DeleteAllAccountAssignments",
-			Handler:    _IdentityCenterService_DeleteAllAccountAssignments_Handler,
-		},
-		{
-			MethodName: "DeleteAllPrincipalAssignments",
-			Handler:    _IdentityCenterService_DeleteAllPrincipalAssignments_Handler,
-		},
-		{
-			MethodName: "DeleteAllPermissionSets",
-			Handler:    _IdentityCenterService_DeleteAllPermissionSets_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "teleport/identitycenter/v1/identitycenter_service.proto",
-}
diff --git a/api/gen/proto/go/teleport/integration/v1/awsoidc_service.pb.go b/api/gen/proto/go/teleport/integration/v1/awsoidc_service.pb.go
index f7c51564607a7..4b8c526cdcf80 100644
--- a/api/gen/proto/go/teleport/integration/v1/awsoidc_service.pb.go
+++ b/api/gen/proto/go/teleport/integration/v1/awsoidc_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/integration/v1/awsoidc_service.proto
 
diff --git a/api/gen/proto/go/teleport/integration/v1/awsra_service.pb.go b/api/gen/proto/go/teleport/integration/v1/awsra_service.pb.go
new file mode 100644
index 0000000000000..107496ed43dc3
--- /dev/null
+++ b/api/gen/proto/go/teleport/integration/v1/awsra_service.pb.go
@@ -0,0 +1,598 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/integration/v1/awsra_service.proto
+
+package integrationv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AWSRolesAnywherePingRequest is a request for doing an health check against the configured integration.
+type AWSRolesAnywherePingRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Mode:
+	//
+	//	*AWSRolesAnywherePingRequest_Integration
+	//	*AWSRolesAnywherePingRequest_Custom
+	Mode          isAWSRolesAnywherePingRequest_Mode `protobuf_oneof:"mode"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AWSRolesAnywherePingRequest) Reset() {
+	*x = AWSRolesAnywherePingRequest{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AWSRolesAnywherePingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AWSRolesAnywherePingRequest) ProtoMessage() {}
+
+func (x *AWSRolesAnywherePingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AWSRolesAnywherePingRequest.ProtoReflect.Descriptor instead.
+func (*AWSRolesAnywherePingRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AWSRolesAnywherePingRequest) GetMode() isAWSRolesAnywherePingRequest_Mode {
+	if x != nil {
+		return x.Mode
+	}
+	return nil
+}
+
+func (x *AWSRolesAnywherePingRequest) GetIntegration() string {
+	if x != nil {
+		if x, ok := x.Mode.(*AWSRolesAnywherePingRequest_Integration); ok {
+			return x.Integration
+		}
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingRequest) GetCustom() *AWSRolesAnywherePingRequestWithoutIntegration {
+	if x != nil {
+		if x, ok := x.Mode.(*AWSRolesAnywherePingRequest_Custom); ok {
+			return x.Custom
+		}
+	}
+	return nil
+}
+
+type isAWSRolesAnywherePingRequest_Mode interface {
+	isAWSRolesAnywherePingRequest_Mode()
+}
+
+type AWSRolesAnywherePingRequest_Integration struct {
+	// Use an integration to perform the Ping operation.
+	Integration string `protobuf:"bytes,1,opt,name=integration,proto3,oneof"`
+}
+
+type AWSRolesAnywherePingRequest_Custom struct {
+	// Use a Trust Anchor, Profile and Role to perform the Ping operation.
+	// This is useful when the integration is not configured.
+	Custom *AWSRolesAnywherePingRequestWithoutIntegration `protobuf:"bytes,2,opt,name=custom,proto3,oneof"`
+}
+
+func (*AWSRolesAnywherePingRequest_Integration) isAWSRolesAnywherePingRequest_Mode() {}
+
+func (*AWSRolesAnywherePingRequest_Custom) isAWSRolesAnywherePingRequest_Mode() {}
+
+// Identifies the Trust Anchor, Profile and Role to use for the Ping operation.
+type AWSRolesAnywherePingRequestWithoutIntegration struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The AWS Roles Anywhere Trust Anchor ARN to be used when generating the token.
+	TrustAnchorArn string `protobuf:"bytes,1,opt,name=trust_anchor_arn,json=trustAnchorArn,proto3" json:"trust_anchor_arn,omitempty"`
+	// The AWS Roles Anywhere Profile ARN to be used when generating the token.
+	ProfileArn string `protobuf:"bytes,3,opt,name=profile_arn,json=profileArn,proto3" json:"profile_arn,omitempty"`
+	// The AWS Role ARN to be used when generating the token.
+	RoleArn       string `protobuf:"bytes,4,opt,name=role_arn,json=roleArn,proto3" json:"role_arn,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) Reset() {
+	*x = AWSRolesAnywherePingRequestWithoutIntegration{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AWSRolesAnywherePingRequestWithoutIntegration) ProtoMessage() {}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AWSRolesAnywherePingRequestWithoutIntegration.ProtoReflect.Descriptor instead.
+func (*AWSRolesAnywherePingRequestWithoutIntegration) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) GetTrustAnchorArn() string {
+	if x != nil {
+		return x.TrustAnchorArn
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) GetProfileArn() string {
+	if x != nil {
+		return x.ProfileArn
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingRequestWithoutIntegration) GetRoleArn() string {
+	if x != nil {
+		return x.RoleArn
+	}
+	return ""
+}
+
+// AWSRolesAnywherePingResponse contains the response for the Ping operation.
+type AWSRolesAnywherePingResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The AWS account ID number of the account that owns or contains the calling entity.
+	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	// The AWS ARN associated with the calling entity.
+	Arn string `protobuf:"bytes,2,opt,name=arn,proto3" json:"arn,omitempty"`
+	// The unique identifier of the calling entity.
+	UserId string `protobuf:"bytes,3,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	// The number of AWS Roles Anywhere Profiles that are active and have at least one associated Role.
+	ProfileCount  int32 `protobuf:"varint,4,opt,name=profile_count,json=profileCount,proto3" json:"profile_count,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AWSRolesAnywherePingResponse) Reset() {
+	*x = AWSRolesAnywherePingResponse{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AWSRolesAnywherePingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AWSRolesAnywherePingResponse) ProtoMessage() {}
+
+func (x *AWSRolesAnywherePingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AWSRolesAnywherePingResponse.ProtoReflect.Descriptor instead.
+func (*AWSRolesAnywherePingResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *AWSRolesAnywherePingResponse) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingResponse) GetArn() string {
+	if x != nil {
+		return x.Arn
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingResponse) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *AWSRolesAnywherePingResponse) GetProfileCount() int32 {
+	if x != nil {
+		return x.ProfileCount
+	}
+	return 0
+}
+
+// ListRolesAnywhereProfilesRequest is a request to list AWS Roles Anywhere Profiles.
+type ListRolesAnywhereProfilesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Integration is the AWS Roles Anywhere Integration name.
+	Integration string `protobuf:"bytes,1,opt,name=integration,proto3" json:"integration,omitempty"`
+	// page_size is the max size of the page to request.
+	// Depending on the filters, the actual number of profiles returned may be less than this value.
+	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// next_page_token is the page token.
+	NextPageToken string `protobuf:"bytes,3,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	// ProfileNameFilters is a list of filters applied to the profile name.
+	// Only matching profiles will be returned.
+	// If empty, no filtering is applied.
+	//
+	// Filters can be globs, for example:
+	//
+	//	profile*
+	//	*name*
+	//
+	// Or regexes if they're prefixed and suffixed with ^ and $, for example:
+	//
+	//	^profile.*$
+	//	^.*name.*$
+	ProfileNameFilters []string `protobuf:"bytes,4,rep,name=profile_name_filters,json=profileNameFilters,proto3" json:"profile_name_filters,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *ListRolesAnywhereProfilesRequest) Reset() {
+	*x = ListRolesAnywhereProfilesRequest{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRolesAnywhereProfilesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesAnywhereProfilesRequest) ProtoMessage() {}
+
+func (x *ListRolesAnywhereProfilesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesAnywhereProfilesRequest.ProtoReflect.Descriptor instead.
+func (*ListRolesAnywhereProfilesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListRolesAnywhereProfilesRequest) GetIntegration() string {
+	if x != nil {
+		return x.Integration
+	}
+	return ""
+}
+
+func (x *ListRolesAnywhereProfilesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListRolesAnywhereProfilesRequest) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+func (x *ListRolesAnywhereProfilesRequest) GetProfileNameFilters() []string {
+	if x != nil {
+		return x.ProfileNameFilters
+	}
+	return nil
+}
+
+// ListRolesAnywhereProfilesResponse contains the response for the ListRolesAnywhereProfiles operation.
+type ListRolesAnywhereProfilesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Profiles is a list of AWS Roles Anywhere Profiles.
+	Profiles []*RolesAnywhereProfile `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
+	// NextPageToken is used to paginate the results.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRolesAnywhereProfilesResponse) Reset() {
+	*x = ListRolesAnywhereProfilesResponse{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRolesAnywhereProfilesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesAnywhereProfilesResponse) ProtoMessage() {}
+
+func (x *ListRolesAnywhereProfilesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesAnywhereProfilesResponse.ProtoReflect.Descriptor instead.
+func (*ListRolesAnywhereProfilesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListRolesAnywhereProfilesResponse) GetProfiles() []*RolesAnywhereProfile {
+	if x != nil {
+		return x.Profiles
+	}
+	return nil
+}
+
+func (x *ListRolesAnywhereProfilesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// RolesAnywhereProfile represents an AWS Roles Anywhere Profile.
+type RolesAnywhereProfile struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The AWS Roles Anywhere Profile ARN.
+	Arn string `protobuf:"bytes,1,opt,name=arn,proto3" json:"arn,omitempty"`
+	// Whether the AWS Roles Anywhere Profile is enabled.
+	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// The name of the AWS Roles Anywhere Profile.
+	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	// Whether the profile accepts role session names.
+	AcceptRoleSessionName bool `protobuf:"varint,4,opt,name=accept_role_session_name,json=acceptRoleSessionName,proto3" json:"accept_role_session_name,omitempty"`
+	// The tags associated with the AWS Roles Anywhere Profile.
+	Tags map[string]string `protobuf:"bytes,5,rep,name=tags,proto3" json:"tags,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// The roles accessible from this AWS Roles Anywhere Profile.
+	Roles         []string `protobuf:"bytes,6,rep,name=roles,proto3" json:"roles,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RolesAnywhereProfile) Reset() {
+	*x = RolesAnywhereProfile{}
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RolesAnywhereProfile) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RolesAnywhereProfile) ProtoMessage() {}
+
+func (x *RolesAnywhereProfile) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_integration_v1_awsra_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RolesAnywhereProfile.ProtoReflect.Descriptor instead.
+func (*RolesAnywhereProfile) Descriptor() ([]byte, []int) {
+	return file_teleport_integration_v1_awsra_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *RolesAnywhereProfile) GetArn() string {
+	if x != nil {
+		return x.Arn
+	}
+	return ""
+}
+
+func (x *RolesAnywhereProfile) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *RolesAnywhereProfile) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RolesAnywhereProfile) GetAcceptRoleSessionName() bool {
+	if x != nil {
+		return x.AcceptRoleSessionName
+	}
+	return false
+}
+
+func (x *RolesAnywhereProfile) GetTags() map[string]string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *RolesAnywhereProfile) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+var File_teleport_integration_v1_awsra_service_proto protoreflect.FileDescriptor
+
+const file_teleport_integration_v1_awsra_service_proto_rawDesc = "" +
+	"\n" +
+	"+teleport/integration/v1/awsra_service.proto\x12\x17teleport.integration.v1\"\xab\x01\n" +
+	"\x1bAWSRolesAnywherePingRequest\x12\"\n" +
+	"\vintegration\x18\x01 \x01(\tH\x00R\vintegration\x12`\n" +
+	"\x06custom\x18\x02 \x01(\v2F.teleport.integration.v1.AWSRolesAnywherePingRequestWithoutIntegrationH\x00R\x06customB\x06\n" +
+	"\x04mode\"\x95\x01\n" +
+	"-AWSRolesAnywherePingRequestWithoutIntegration\x12(\n" +
+	"\x10trust_anchor_arn\x18\x01 \x01(\tR\x0etrustAnchorArn\x12\x1f\n" +
+	"\vprofile_arn\x18\x03 \x01(\tR\n" +
+	"profileArn\x12\x19\n" +
+	"\brole_arn\x18\x04 \x01(\tR\aroleArn\"\x8d\x01\n" +
+	"\x1cAWSRolesAnywherePingResponse\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x01 \x01(\tR\taccountId\x12\x10\n" +
+	"\x03arn\x18\x02 \x01(\tR\x03arn\x12\x17\n" +
+	"\auser_id\x18\x03 \x01(\tR\x06userId\x12#\n" +
+	"\rprofile_count\x18\x04 \x01(\x05R\fprofileCount\"\xbb\x01\n" +
+	" ListRolesAnywhereProfilesRequest\x12 \n" +
+	"\vintegration\x18\x01 \x01(\tR\vintegration\x12\x1b\n" +
+	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12&\n" +
+	"\x0fnext_page_token\x18\x03 \x01(\tR\rnextPageToken\x120\n" +
+	"\x14profile_name_filters\x18\x04 \x03(\tR\x12profileNameFilters\"\x96\x01\n" +
+	"!ListRolesAnywhereProfilesResponse\x12I\n" +
+	"\bprofiles\x18\x01 \x03(\v2-.teleport.integration.v1.RolesAnywhereProfileR\bprofiles\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xab\x02\n" +
+	"\x14RolesAnywhereProfile\x12\x10\n" +
+	"\x03arn\x18\x01 \x01(\tR\x03arn\x12\x18\n" +
+	"\aenabled\x18\x02 \x01(\bR\aenabled\x12\x12\n" +
+	"\x04name\x18\x03 \x01(\tR\x04name\x127\n" +
+	"\x18accept_role_session_name\x18\x04 \x01(\bR\x15acceptRoleSessionName\x12K\n" +
+	"\x04tags\x18\x05 \x03(\v27.teleport.integration.v1.RolesAnywhereProfile.TagsEntryR\x04tags\x12\x14\n" +
+	"\x05roles\x18\x06 \x03(\tR\x05roles\x1a7\n" +
+	"\tTagsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x012\xb4\x02\n" +
+	"\x17AWSRolesAnywhereService\x12\x83\x01\n" +
+	"\x14AWSRolesAnywherePing\x124.teleport.integration.v1.AWSRolesAnywherePingRequest\x1a5.teleport.integration.v1.AWSRolesAnywherePingResponse\x12\x92\x01\n" +
+	"\x19ListRolesAnywhereProfiles\x129.teleport.integration.v1.ListRolesAnywhereProfilesRequest\x1a:.teleport.integration.v1.ListRolesAnywhereProfilesResponseBZZXgithub.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1;integrationv1b\x06proto3"
+
+var (
+	file_teleport_integration_v1_awsra_service_proto_rawDescOnce sync.Once
+	file_teleport_integration_v1_awsra_service_proto_rawDescData []byte
+)
+
+func file_teleport_integration_v1_awsra_service_proto_rawDescGZIP() []byte {
+	file_teleport_integration_v1_awsra_service_proto_rawDescOnce.Do(func() {
+		file_teleport_integration_v1_awsra_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_integration_v1_awsra_service_proto_rawDesc), len(file_teleport_integration_v1_awsra_service_proto_rawDesc)))
+	})
+	return file_teleport_integration_v1_awsra_service_proto_rawDescData
+}
+
+var file_teleport_integration_v1_awsra_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_teleport_integration_v1_awsra_service_proto_goTypes = []any{
+	(*AWSRolesAnywherePingRequest)(nil),                   // 0: teleport.integration.v1.AWSRolesAnywherePingRequest
+	(*AWSRolesAnywherePingRequestWithoutIntegration)(nil), // 1: teleport.integration.v1.AWSRolesAnywherePingRequestWithoutIntegration
+	(*AWSRolesAnywherePingResponse)(nil),                  // 2: teleport.integration.v1.AWSRolesAnywherePingResponse
+	(*ListRolesAnywhereProfilesRequest)(nil),              // 3: teleport.integration.v1.ListRolesAnywhereProfilesRequest
+	(*ListRolesAnywhereProfilesResponse)(nil),             // 4: teleport.integration.v1.ListRolesAnywhereProfilesResponse
+	(*RolesAnywhereProfile)(nil),                          // 5: teleport.integration.v1.RolesAnywhereProfile
+	nil,                                                   // 6: teleport.integration.v1.RolesAnywhereProfile.TagsEntry
+}
+var file_teleport_integration_v1_awsra_service_proto_depIdxs = []int32{
+	1, // 0: teleport.integration.v1.AWSRolesAnywherePingRequest.custom:type_name -> teleport.integration.v1.AWSRolesAnywherePingRequestWithoutIntegration
+	5, // 1: teleport.integration.v1.ListRolesAnywhereProfilesResponse.profiles:type_name -> teleport.integration.v1.RolesAnywhereProfile
+	6, // 2: teleport.integration.v1.RolesAnywhereProfile.tags:type_name -> teleport.integration.v1.RolesAnywhereProfile.TagsEntry
+	0, // 3: teleport.integration.v1.AWSRolesAnywhereService.AWSRolesAnywherePing:input_type -> teleport.integration.v1.AWSRolesAnywherePingRequest
+	3, // 4: teleport.integration.v1.AWSRolesAnywhereService.ListRolesAnywhereProfiles:input_type -> teleport.integration.v1.ListRolesAnywhereProfilesRequest
+	2, // 5: teleport.integration.v1.AWSRolesAnywhereService.AWSRolesAnywherePing:output_type -> teleport.integration.v1.AWSRolesAnywherePingResponse
+	4, // 6: teleport.integration.v1.AWSRolesAnywhereService.ListRolesAnywhereProfiles:output_type -> teleport.integration.v1.ListRolesAnywhereProfilesResponse
+	5, // [5:7] is the sub-list for method output_type
+	3, // [3:5] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_integration_v1_awsra_service_proto_init() }
+func file_teleport_integration_v1_awsra_service_proto_init() {
+	if File_teleport_integration_v1_awsra_service_proto != nil {
+		return
+	}
+	file_teleport_integration_v1_awsra_service_proto_msgTypes[0].OneofWrappers = []any{
+		(*AWSRolesAnywherePingRequest_Integration)(nil),
+		(*AWSRolesAnywherePingRequest_Custom)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_integration_v1_awsra_service_proto_rawDesc), len(file_teleport_integration_v1_awsra_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_integration_v1_awsra_service_proto_goTypes,
+		DependencyIndexes: file_teleport_integration_v1_awsra_service_proto_depIdxs,
+		MessageInfos:      file_teleport_integration_v1_awsra_service_proto_msgTypes,
+	}.Build()
+	File_teleport_integration_v1_awsra_service_proto = out.File
+	file_teleport_integration_v1_awsra_service_proto_goTypes = nil
+	file_teleport_integration_v1_awsra_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/integration/v1/awsra_service_grpc.pb.go b/api/gen/proto/go/teleport/integration/v1/awsra_service_grpc.pb.go
new file mode 100644
index 0000000000000..33b51e617e34a
--- /dev/null
+++ b/api/gen/proto/go/teleport/integration/v1/awsra_service_grpc.pb.go
@@ -0,0 +1,202 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/integration/v1/awsra_service.proto
+
+package integrationv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AWSRolesAnywhereService_AWSRolesAnywherePing_FullMethodName      = "/teleport.integration.v1.AWSRolesAnywhereService/AWSRolesAnywherePing"
+	AWSRolesAnywhereService_ListRolesAnywhereProfiles_FullMethodName = "/teleport.integration.v1.AWSRolesAnywhereService/ListRolesAnywhereProfiles"
+)
+
+// AWSRolesAnywhereServiceClient is the client API for AWSRolesAnywhereService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AWSRolesAnywhereService provides access to AWS APIs using the AWS Roles Anywhere Integration.
+type AWSRolesAnywhereServiceClient interface {
+	// AWSRolesAnywherePing does an health check for the integration.
+	// Returns the caller identity and the number of AWS Roles Anywhere Profiles that are active.
+	// It uses the following APIs:
+	// https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+	AWSRolesAnywherePing(ctx context.Context, in *AWSRolesAnywherePingRequest, opts ...grpc.CallOption) (*AWSRolesAnywherePingResponse, error)
+	// ListRolesAnywhereProfiles lists the AWS Roles Anywhere Profiles that are configured in the integration.
+	// It uses the following API:
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html
+	//
+	// The number of profiles returned is always between 0 and page_size.
+	// If the number of elements is 0, then there are no more profiles to return and the next page token is empty.
+	ListRolesAnywhereProfiles(ctx context.Context, in *ListRolesAnywhereProfilesRequest, opts ...grpc.CallOption) (*ListRolesAnywhereProfilesResponse, error)
+}
+
+type aWSRolesAnywhereServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAWSRolesAnywhereServiceClient(cc grpc.ClientConnInterface) AWSRolesAnywhereServiceClient {
+	return &aWSRolesAnywhereServiceClient{cc}
+}
+
+func (c *aWSRolesAnywhereServiceClient) AWSRolesAnywherePing(ctx context.Context, in *AWSRolesAnywherePingRequest, opts ...grpc.CallOption) (*AWSRolesAnywherePingResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AWSRolesAnywherePingResponse)
+	err := c.cc.Invoke(ctx, AWSRolesAnywhereService_AWSRolesAnywherePing_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *aWSRolesAnywhereServiceClient) ListRolesAnywhereProfiles(ctx context.Context, in *ListRolesAnywhereProfilesRequest, opts ...grpc.CallOption) (*ListRolesAnywhereProfilesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRolesAnywhereProfilesResponse)
+	err := c.cc.Invoke(ctx, AWSRolesAnywhereService_ListRolesAnywhereProfiles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AWSRolesAnywhereServiceServer is the server API for AWSRolesAnywhereService service.
+// All implementations must embed UnimplementedAWSRolesAnywhereServiceServer
+// for forward compatibility.
+//
+// AWSRolesAnywhereService provides access to AWS APIs using the AWS Roles Anywhere Integration.
+type AWSRolesAnywhereServiceServer interface {
+	// AWSRolesAnywherePing does an health check for the integration.
+	// Returns the caller identity and the number of AWS Roles Anywhere Profiles that are active.
+	// It uses the following APIs:
+	// https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+	AWSRolesAnywherePing(context.Context, *AWSRolesAnywherePingRequest) (*AWSRolesAnywherePingResponse, error)
+	// ListRolesAnywhereProfiles lists the AWS Roles Anywhere Profiles that are configured in the integration.
+	// It uses the following API:
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+	// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html
+	//
+	// The number of profiles returned is always between 0 and page_size.
+	// If the number of elements is 0, then there are no more profiles to return and the next page token is empty.
+	ListRolesAnywhereProfiles(context.Context, *ListRolesAnywhereProfilesRequest) (*ListRolesAnywhereProfilesResponse, error)
+	mustEmbedUnimplementedAWSRolesAnywhereServiceServer()
+}
+
+// UnimplementedAWSRolesAnywhereServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAWSRolesAnywhereServiceServer struct{}
+
+func (UnimplementedAWSRolesAnywhereServiceServer) AWSRolesAnywherePing(context.Context, *AWSRolesAnywherePingRequest) (*AWSRolesAnywherePingResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AWSRolesAnywherePing not implemented")
+}
+func (UnimplementedAWSRolesAnywhereServiceServer) ListRolesAnywhereProfiles(context.Context, *ListRolesAnywhereProfilesRequest) (*ListRolesAnywhereProfilesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListRolesAnywhereProfiles not implemented")
+}
+func (UnimplementedAWSRolesAnywhereServiceServer) mustEmbedUnimplementedAWSRolesAnywhereServiceServer() {
+}
+func (UnimplementedAWSRolesAnywhereServiceServer) testEmbeddedByValue() {}
+
+// UnsafeAWSRolesAnywhereServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AWSRolesAnywhereServiceServer will
+// result in compilation errors.
+type UnsafeAWSRolesAnywhereServiceServer interface {
+	mustEmbedUnimplementedAWSRolesAnywhereServiceServer()
+}
+
+func RegisterAWSRolesAnywhereServiceServer(s grpc.ServiceRegistrar, srv AWSRolesAnywhereServiceServer) {
+	// If the following call pancis, it indicates UnimplementedAWSRolesAnywhereServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&AWSRolesAnywhereService_ServiceDesc, srv)
+}
+
+func _AWSRolesAnywhereService_AWSRolesAnywherePing_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AWSRolesAnywherePingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AWSRolesAnywhereServiceServer).AWSRolesAnywherePing(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AWSRolesAnywhereService_AWSRolesAnywherePing_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AWSRolesAnywhereServiceServer).AWSRolesAnywherePing(ctx, req.(*AWSRolesAnywherePingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AWSRolesAnywhereService_ListRolesAnywhereProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRolesAnywhereProfilesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AWSRolesAnywhereServiceServer).ListRolesAnywhereProfiles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AWSRolesAnywhereService_ListRolesAnywhereProfiles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AWSRolesAnywhereServiceServer).ListRolesAnywhereProfiles(ctx, req.(*ListRolesAnywhereProfilesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AWSRolesAnywhereService_ServiceDesc is the grpc.ServiceDesc for AWSRolesAnywhereService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AWSRolesAnywhereService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.integration.v1.AWSRolesAnywhereService",
+	HandlerType: (*AWSRolesAnywhereServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "AWSRolesAnywherePing",
+			Handler:    _AWSRolesAnywhereService_AWSRolesAnywherePing_Handler,
+		},
+		{
+			MethodName: "ListRolesAnywhereProfiles",
+			Handler:    _AWSRolesAnywhereService_ListRolesAnywhereProfiles_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/integration/v1/awsra_service.proto",
+}
diff --git a/api/gen/proto/go/teleport/integration/v1/integration_service.pb.go b/api/gen/proto/go/teleport/integration/v1/integration_service.pb.go
index 843103fa56089..3aca8ba6ad8fa 100644
--- a/api/gen/proto/go/teleport/integration/v1/integration_service.pb.go
+++ b/api/gen/proto/go/teleport/integration/v1/integration_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/integration/v1/integration_service.proto
 
diff --git a/api/gen/proto/go/teleport/join/v1/joinservice.pb.go b/api/gen/proto/go/teleport/join/v1/joinservice.pb.go
new file mode 100644
index 0000000000000..143a26cb1a3f5
--- /dev/null
+++ b/api/gen/proto/go/teleport/join/v1/joinservice.pb.go
@@ -0,0 +1,3185 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/join/v1/joinservice.proto
+
+package joinv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Reason is the reason the client is giving up.
+type GivingUp_Reason int32
+
+const (
+	// REASON_UNSPECIFIED is an unspecified reason.
+	GivingUp_REASON_UNSPECIFIED GivingUp_Reason = 0
+	// REASON_UNSUPPORTED_JOIN_METHOD means the client does not support the
+	// join method sent by the server.
+	GivingUp_REASON_UNSUPPORTED_JOIN_METHOD GivingUp_Reason = 1
+	// REASON_UNSUPPORTED_MESSAGE_TYPE means the client can not handle a
+	// message type sent by the server.
+	GivingUp_REASON_UNSUPPORTED_MESSAGE_TYPE GivingUp_Reason = 2
+	// REASON_CHALLENGE_SOLUTION_FAILED means the client failed to solve a
+	// challenge sent by the server.
+	GivingUp_REASON_CHALLENGE_SOLUTION_FAILED GivingUp_Reason = 3
+)
+
+// Enum value maps for GivingUp_Reason.
+var (
+	GivingUp_Reason_name = map[int32]string{
+		0: "REASON_UNSPECIFIED",
+		1: "REASON_UNSUPPORTED_JOIN_METHOD",
+		2: "REASON_UNSUPPORTED_MESSAGE_TYPE",
+		3: "REASON_CHALLENGE_SOLUTION_FAILED",
+	}
+	GivingUp_Reason_value = map[string]int32{
+		"REASON_UNSPECIFIED":               0,
+		"REASON_UNSUPPORTED_JOIN_METHOD":   1,
+		"REASON_UNSUPPORTED_MESSAGE_TYPE":  2,
+		"REASON_CHALLENGE_SOLUTION_FAILED": 3,
+	}
+)
+
+func (x GivingUp_Reason) Enum() *GivingUp_Reason {
+	p := new(GivingUp_Reason)
+	*p = x
+	return p
+}
+
+func (x GivingUp_Reason) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GivingUp_Reason) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_join_v1_joinservice_proto_enumTypes[0].Descriptor()
+}
+
+func (GivingUp_Reason) Type() protoreflect.EnumType {
+	return &file_teleport_join_v1_joinservice_proto_enumTypes[0]
+}
+
+func (x GivingUp_Reason) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use GivingUp_Reason.Descriptor instead.
+func (GivingUp_Reason) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{27, 0}
+}
+
+// ClientInit is the first message sent from the client during the join process, it
+// holds parameters common to all join methods.
+type ClientInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// JoinMethod is the name of the join method that the client is configured to use.
+	// This parameter is optional, the client can leave it empty to allow the
+	// server to determine the join method based on the provision token named by
+	// TokenName, it will be sent to the client in the ServerInit message.
+	JoinMethod *string `protobuf:"bytes,1,opt,name=join_method,json=joinMethod,proto3,oneof" json:"join_method,omitempty"`
+	// TokenName is the name of the join token.
+	// This is a secret if using the token join method, otherwise it is a
+	// non-secret name of a provision token resource.
+	TokenName string `protobuf:"bytes,2,opt,name=token_name,json=tokenName,proto3" json:"token_name,omitempty"`
+	// SystemRole is the system role requested, e.g. Proxy, Node, Instance, Bot.
+	SystemRole string `protobuf:"bytes,3,opt,name=system_role,json=systemRole,proto3" json:"system_role,omitempty"`
+	// ForwardedByProxy will be set to true when the message is forwarded by the
+	// Proxy service. When this is set the Auth service must ignore any
+	// any credentials authenticating the request, except for the purpose of
+	// accepting ProxySuppliedParams.
+	ForwardedByProxy        bool                            `protobuf:"varint,4,opt,name=forwarded_by_proxy,json=forwardedByProxy,proto3" json:"forwarded_by_proxy,omitempty"`
+	ProxySuppliedParameters *ClientInit_ProxySuppliedParams `protobuf:"bytes,5,opt,name=proxy_supplied_parameters,json=proxySuppliedParameters,proto3,oneof" json:"proxy_supplied_parameters,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *ClientInit) Reset() {
+	*x = ClientInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientInit) ProtoMessage() {}
+
+func (x *ClientInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientInit.ProtoReflect.Descriptor instead.
+func (*ClientInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ClientInit) GetJoinMethod() string {
+	if x != nil && x.JoinMethod != nil {
+		return *x.JoinMethod
+	}
+	return ""
+}
+
+func (x *ClientInit) GetTokenName() string {
+	if x != nil {
+		return x.TokenName
+	}
+	return ""
+}
+
+func (x *ClientInit) GetSystemRole() string {
+	if x != nil {
+		return x.SystemRole
+	}
+	return ""
+}
+
+func (x *ClientInit) GetForwardedByProxy() bool {
+	if x != nil {
+		return x.ForwardedByProxy
+	}
+	return false
+}
+
+func (x *ClientInit) GetProxySuppliedParameters() *ClientInit_ProxySuppliedParams {
+	if x != nil {
+		return x.ProxySuppliedParameters
+	}
+	return nil
+}
+
+// PublicKeys holds public keys sent by the client requested subject keys for
+// issued certificates.
+type PublicKeys struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PublicTlsKey is the public key requested for the subject of the x509 certificate.
+	// It must be encoded in PKIX, ASN.1 DER form.
+	PublicTlsKey []byte `protobuf:"bytes,1,opt,name=public_tls_key,json=publicTlsKey,proto3" json:"public_tls_key,omitempty"`
+	// PublicSshKey is the public key requested for the subject of the SSH certificate.
+	// It must be encoded in SSH wire format.
+	PublicSshKey  []byte `protobuf:"bytes,2,opt,name=public_ssh_key,json=publicSshKey,proto3" json:"public_ssh_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PublicKeys) Reset() {
+	*x = PublicKeys{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PublicKeys) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PublicKeys) ProtoMessage() {}
+
+func (x *PublicKeys) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PublicKeys.ProtoReflect.Descriptor instead.
+func (*PublicKeys) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PublicKeys) GetPublicTlsKey() []byte {
+	if x != nil {
+		return x.PublicTlsKey
+	}
+	return nil
+}
+
+func (x *PublicKeys) GetPublicSshKey() []byte {
+	if x != nil {
+		return x.PublicSshKey
+	}
+	return nil
+}
+
+// HostParams holds parameters required for host joining.
+type HostParams struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PublicKeys holds the host public keys.
+	PublicKeys *PublicKeys `protobuf:"bytes,1,opt,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
+	// HostName is the user-friendly node name for the host. This comes from
+	// teleport.nodename in the service configuration and defaults to the
+	// hostname. It is encoded as a valid principal in issued certificates.
+	HostName string `protobuf:"bytes,2,opt,name=host_name,json=hostName,proto3" json:"host_name,omitempty"`
+	// AdditionalPrincipals is a list of additional principals requested.
+	AdditionalPrincipals []string `protobuf:"bytes,3,rep,name=additional_principals,json=additionalPrincipals,proto3" json:"additional_principals,omitempty"`
+	// DnsNames is a list of DNS names requested for inclusion in the x509 certificate.
+	DnsNames      []string `protobuf:"bytes,4,rep,name=dns_names,json=dnsNames,proto3" json:"dns_names,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HostParams) Reset() {
+	*x = HostParams{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HostParams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HostParams) ProtoMessage() {}
+
+func (x *HostParams) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HostParams.ProtoReflect.Descriptor instead.
+func (*HostParams) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *HostParams) GetPublicKeys() *PublicKeys {
+	if x != nil {
+		return x.PublicKeys
+	}
+	return nil
+}
+
+func (x *HostParams) GetHostName() string {
+	if x != nil {
+		return x.HostName
+	}
+	return ""
+}
+
+func (x *HostParams) GetAdditionalPrincipals() []string {
+	if x != nil {
+		return x.AdditionalPrincipals
+	}
+	return nil
+}
+
+func (x *HostParams) GetDnsNames() []string {
+	if x != nil {
+		return x.DnsNames
+	}
+	return nil
+}
+
+// BotParams holds parameters required for bot joining.
+type BotParams struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PublicKeys holds the bot public keys.
+	PublicKeys *PublicKeys `protobuf:"bytes,1,opt,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
+	// Expires is a desired time of the expiry of the returned certificates.
+	Expires       *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expires,proto3,oneof" json:"expires,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BotParams) Reset() {
+	*x = BotParams{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BotParams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotParams) ProtoMessage() {}
+
+func (x *BotParams) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotParams.ProtoReflect.Descriptor instead.
+func (*BotParams) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *BotParams) GetPublicKeys() *PublicKeys {
+	if x != nil {
+		return x.PublicKeys
+	}
+	return nil
+}
+
+func (x *BotParams) GetExpires() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expires
+	}
+	return nil
+}
+
+// ClientParams holds either host or bot join parameters.
+type ClientParams struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*ClientParams_HostParams
+	//	*ClientParams_BotParams
+	Payload       isClientParams_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClientParams) Reset() {
+	*x = ClientParams{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientParams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientParams) ProtoMessage() {}
+
+func (x *ClientParams) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientParams.ProtoReflect.Descriptor instead.
+func (*ClientParams) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ClientParams) GetPayload() isClientParams_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *ClientParams) GetHostParams() *HostParams {
+	if x != nil {
+		if x, ok := x.Payload.(*ClientParams_HostParams); ok {
+			return x.HostParams
+		}
+	}
+	return nil
+}
+
+func (x *ClientParams) GetBotParams() *BotParams {
+	if x != nil {
+		if x, ok := x.Payload.(*ClientParams_BotParams); ok {
+			return x.BotParams
+		}
+	}
+	return nil
+}
+
+type isClientParams_Payload interface {
+	isClientParams_Payload()
+}
+
+type ClientParams_HostParams struct {
+	HostParams *HostParams `protobuf:"bytes,1,opt,name=host_params,json=hostParams,proto3,oneof"`
+}
+
+type ClientParams_BotParams struct {
+	BotParams *BotParams `protobuf:"bytes,2,opt,name=bot_params,json=botParams,proto3,oneof"`
+}
+
+func (*ClientParams_HostParams) isClientParams_Payload() {}
+
+func (*ClientParams_BotParams) isClientParams_Payload() {}
+
+// TokenInit is sent by the client in response to the ServerInit message for
+// the Token join method.
+//
+// The Token method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: TokenInit
+// 4. server->client: Result
+type TokenInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams  *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TokenInit) Reset() {
+	*x = TokenInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TokenInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TokenInit) ProtoMessage() {}
+
+func (x *TokenInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TokenInit.ProtoReflect.Descriptor instead.
+func (*TokenInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *TokenInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+// OIDCInit holds the OIDC identity token used for all OIDC-based join methods.
+//
+// The join flow for all OIDC-based join methods is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: OIDCInit
+// 4. server->client: Result
+type OIDCInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	// IdToken is the OIDC identity token.
+	IdToken       []byte `protobuf:"bytes,2,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OIDCInit) Reset() {
+	*x = OIDCInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OIDCInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OIDCInit) ProtoMessage() {}
+
+func (x *OIDCInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OIDCInit.ProtoReflect.Descriptor instead.
+func (*OIDCInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *OIDCInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+func (x *OIDCInit) GetIdToken() []byte {
+	if x != nil {
+		return x.IdToken
+	}
+	return nil
+}
+
+// BoundKeypairInit is sent from the client in response to the ServerInit
+// message for the bound keypair join method.
+// The server is expected to respond with a BoundKeypairChallenge.
+//
+// The bound keypair method join flow is:
+//  1. client->server: ClientInit
+//  2. server->client: ServerInit
+//  3. client->server: BoundKeypairInit
+//  4. server->client: BoundKeypairChallenge
+//  5. client->server: BoundKeypairChallengeSolution
+//     (optional additional steps if keypair rotation is required)
+//     server->client: BoundKeypairRotationRequest
+//     client->server: BoundKeypairRotationResponse
+//     server->client: BoundKeypairChallenge
+//     client->server: BoundKeypairChallengeSolution
+//  6. server->client: Result containing BoundKeypairResult
+type BoundKeypairInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	// If set, attempts to bind a new keypair using an initial join secret.
+	// Any value set here will be ignored if a keypair is already bound.
+	InitialJoinSecret string `protobuf:"bytes,2,opt,name=initial_join_secret,json=initialJoinSecret,proto3" json:"initial_join_secret,omitempty"`
+	// A document signed by Auth containing join state parameters from the
+	// previous join attempt. Not required on initial join; required on all
+	// subsequent joins.
+	PreviousJoinState []byte `protobuf:"bytes,3,opt,name=previous_join_state,json=previousJoinState,proto3" json:"previous_join_state,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *BoundKeypairInit) Reset() {
+	*x = BoundKeypairInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairInit) ProtoMessage() {}
+
+func (x *BoundKeypairInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairInit.ProtoReflect.Descriptor instead.
+func (*BoundKeypairInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *BoundKeypairInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+func (x *BoundKeypairInit) GetInitialJoinSecret() string {
+	if x != nil {
+		return x.InitialJoinSecret
+	}
+	return ""
+}
+
+func (x *BoundKeypairInit) GetPreviousJoinState() []byte {
+	if x != nil {
+		return x.PreviousJoinState
+	}
+	return nil
+}
+
+// BoundKeypairChallenge is a challenge issued by the server that joining
+// clients are expected to complete.
+// The client is expected to respond with a BoundKeypairChallengeSolution.
+type BoundKeypairChallenge struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The desired public key corresponding to the private key that should be used
+	// to sign this challenge, in SSH authorized keys format.
+	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	// A challenge to sign with the requested public key. During keypair rotation,
+	// a second challenge will be provided to verify the new keypair before certs
+	// are returned.
+	Challenge     string `protobuf:"bytes,2,opt,name=challenge,proto3" json:"challenge,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BoundKeypairChallenge) Reset() {
+	*x = BoundKeypairChallenge{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairChallenge) ProtoMessage() {}
+
+func (x *BoundKeypairChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairChallenge.ProtoReflect.Descriptor instead.
+func (*BoundKeypairChallenge) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *BoundKeypairChallenge) GetPublicKey() []byte {
+	if x != nil {
+		return x.PublicKey
+	}
+	return nil
+}
+
+func (x *BoundKeypairChallenge) GetChallenge() string {
+	if x != nil {
+		return x.Challenge
+	}
+	return ""
+}
+
+// BoundKeypairChallengeSolution is sent from the client in response to the
+// BoundKeypairChallenge.
+// The server is expected to respond with either a Result or a
+// BoundKeypairRotationRequest.
+type BoundKeypairChallengeSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A solution to a challenge from the server. This generated by signing the
+	// challenge as a JWT using the keypair associated with the requested public
+	// key.
+	Solution      []byte `protobuf:"bytes,1,opt,name=solution,proto3" json:"solution,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BoundKeypairChallengeSolution) Reset() {
+	*x = BoundKeypairChallengeSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairChallengeSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairChallengeSolution) ProtoMessage() {}
+
+func (x *BoundKeypairChallengeSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairChallengeSolution.ProtoReflect.Descriptor instead.
+func (*BoundKeypairChallengeSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *BoundKeypairChallengeSolution) GetSolution() []byte {
+	if x != nil {
+		return x.Solution
+	}
+	return nil
+}
+
+// BoundKeypairRotationRequest is sent by the server in response to a
+// BoundKeypairChallenge when a keypair rotation is required. It acts like an
+// additional challenge, the client is expected to respond with a
+// BoundKeypairRotationResponse.
+type BoundKeypairRotationRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The signature algorithm suite in use by the cluster.
+	SignatureAlgorithmSuite string `protobuf:"bytes,1,opt,name=signature_algorithm_suite,json=signatureAlgorithmSuite,proto3" json:"signature_algorithm_suite,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *BoundKeypairRotationRequest) Reset() {
+	*x = BoundKeypairRotationRequest{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairRotationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairRotationRequest) ProtoMessage() {}
+
+func (x *BoundKeypairRotationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairRotationRequest.ProtoReflect.Descriptor instead.
+func (*BoundKeypairRotationRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *BoundKeypairRotationRequest) GetSignatureAlgorithmSuite() string {
+	if x != nil {
+		return x.SignatureAlgorithmSuite
+	}
+	return ""
+}
+
+// BoundKeypairRotationResponse is sent by the client in response to a
+// BoundKeypairRotationRequest from the server.
+// The server is expected to respond with an additional BoundKeypairChallenge
+// for the new key.
+type BoundKeypairRotationResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The public key to be registered with auth. Clients should expect a
+	// subsequent challenge against this public key to be sent. This is encoded in
+	// SSH authorized keys format.
+	PublicKey     []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BoundKeypairRotationResponse) Reset() {
+	*x = BoundKeypairRotationResponse{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairRotationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairRotationResponse) ProtoMessage() {}
+
+func (x *BoundKeypairRotationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairRotationResponse.ProtoReflect.Descriptor instead.
+func (*BoundKeypairRotationResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *BoundKeypairRotationResponse) GetPublicKey() []byte {
+	if x != nil {
+		return x.PublicKey
+	}
+	return nil
+}
+
+// BoundKeypairResult holds additional result parameters relevant to the bound
+// keypair join method.
+type BoundKeypairResult struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A signed join state document to be provided on the next join attempt.
+	JoinState []byte `protobuf:"bytes,2,opt,name=join_state,json=joinState,proto3" json:"join_state,omitempty"`
+	// The public key registered with Auth at the end of the joining ceremony.
+	// After a successful keypair rotation, this should reflect the newly
+	// registered public key. This is encoded in SSH authorized keys format.
+	PublicKey     []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BoundKeypairResult) Reset() {
+	*x = BoundKeypairResult{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BoundKeypairResult) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoundKeypairResult) ProtoMessage() {}
+
+func (x *BoundKeypairResult) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoundKeypairResult.ProtoReflect.Descriptor instead.
+func (*BoundKeypairResult) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *BoundKeypairResult) GetJoinState() []byte {
+	if x != nil {
+		return x.JoinState
+	}
+	return nil
+}
+
+func (x *BoundKeypairResult) GetPublicKey() []byte {
+	if x != nil {
+		return x.PublicKey
+	}
+	return nil
+}
+
+// IAMInit is sent from the client in response to the ServerInit message for
+// the IAM join method.
+//
+// The IAM method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: IAMInit
+// 4. server->client: IAMChallenge
+// 5. client->server: IAMChallengeSolution
+// 6. server->client: Result
+type IAMInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams  *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IAMInit) Reset() {
+	*x = IAMInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IAMInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IAMInit) ProtoMessage() {}
+
+func (x *IAMInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IAMInit.ProtoReflect.Descriptor instead.
+func (*IAMInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *IAMInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+// IAMChallenge is from the server in response to the IAMInit message from the client.
+// The client is expected to respond with a IAMChallengeSolution.
+type IAMChallenge struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Challenge is a a crypto-random string that should be included by the
+	// client in the IAMChallengeSolution message.
+	Challenge     string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IAMChallenge) Reset() {
+	*x = IAMChallenge{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IAMChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IAMChallenge) ProtoMessage() {}
+
+func (x *IAMChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IAMChallenge.ProtoReflect.Descriptor instead.
+func (*IAMChallenge) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *IAMChallenge) GetChallenge() string {
+	if x != nil {
+		return x.Challenge
+	}
+	return ""
+}
+
+// IAMChallengeSolution must be sent from the client in response to the
+// IAMChallenge message.
+type IAMChallengeSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// STSIdentityRequest is a signed sts:GetCallerIdentity API request used
+	// to prove the AWS identity of a joining node. It must include the
+	// challenge string as a signed header.
+	StsIdentityRequest []byte `protobuf:"bytes,1,opt,name=sts_identity_request,json=stsIdentityRequest,proto3" json:"sts_identity_request,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *IAMChallengeSolution) Reset() {
+	*x = IAMChallengeSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IAMChallengeSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IAMChallengeSolution) ProtoMessage() {}
+
+func (x *IAMChallengeSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IAMChallengeSolution.ProtoReflect.Descriptor instead.
+func (*IAMChallengeSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *IAMChallengeSolution) GetStsIdentityRequest() []byte {
+	if x != nil {
+		return x.StsIdentityRequest
+	}
+	return nil
+}
+
+// EC2Init is sent from the client in response to the ServerInit message for
+// the EC2 join method.
+//
+// The EC2 method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: EC2Init
+// 4. server->client: Result
+type EC2Init struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	// Document is a signed EC2 Instance Identity Document used to prove the
+	// identity of a joining EC2 instance.
+	Document      []byte `protobuf:"bytes,2,opt,name=document,proto3" json:"document,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *EC2Init) Reset() {
+	*x = EC2Init{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *EC2Init) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EC2Init) ProtoMessage() {}
+
+func (x *EC2Init) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EC2Init.ProtoReflect.Descriptor instead.
+func (*EC2Init) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *EC2Init) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+func (x *EC2Init) GetDocument() []byte {
+	if x != nil {
+		return x.Document
+	}
+	return nil
+}
+
+// OracleInit is sent from the client in response to the ServerInit message for
+// the Oracle join method.
+//
+// The Oracle method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: OracleInit
+// 4. client<-server: OracleChallenge
+// 5. client->server: OracleChallengeSolution
+// 6. client<-server: Result
+type OracleInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams  *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OracleInit) Reset() {
+	*x = OracleInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OracleInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OracleInit) ProtoMessage() {}
+
+func (x *OracleInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OracleInit.ProtoReflect.Descriptor instead.
+func (*OracleInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *OracleInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+// OracleChallenge is sent from the server in response to the OracleInit message from the client.
+// The client is expected to respond with a OracleChallengeSolution.
+type OracleChallenge struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Challenge is a a crypto-random string that should be included by the
+	// client in the OracleChallengeSolution message.
+	Challenge     string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OracleChallenge) Reset() {
+	*x = OracleChallenge{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OracleChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OracleChallenge) ProtoMessage() {}
+
+func (x *OracleChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OracleChallenge.ProtoReflect.Descriptor instead.
+func (*OracleChallenge) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *OracleChallenge) GetChallenge() string {
+	if x != nil {
+		return x.Challenge
+	}
+	return ""
+}
+
+// OracleChallengeSolution must be sent from the client in response to the
+// OracleChallenge message.
+type OracleChallengeSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
+	Cert []byte `protobuf:"bytes,1,opt,name=cert,proto3" json:"cert,omitempty"`
+	// Intermediate encodes the intermediate CAs that issued the instance
+	// identity certificate, in PEM format.
+	Intermediate []byte `protobuf:"bytes,2,opt,name=intermediate,proto3" json:"intermediate,omitempty"`
+	// Signature is a signature over the challenge, signed by the private key
+	// matching the instance identity certificate.
+	Signature []byte `protobuf:"bytes,3,opt,name=signature,proto3" json:"signature,omitempty"`
+	// SignedRootCaReq is a signed request to the Oracle API for retreiving the
+	// root CAs that issued the instance identity certificate.
+	SignedRootCaReq []byte `protobuf:"bytes,4,opt,name=signed_root_ca_req,json=signedRootCaReq,proto3" json:"signed_root_ca_req,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *OracleChallengeSolution) Reset() {
+	*x = OracleChallengeSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OracleChallengeSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OracleChallengeSolution) ProtoMessage() {}
+
+func (x *OracleChallengeSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OracleChallengeSolution.ProtoReflect.Descriptor instead.
+func (*OracleChallengeSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *OracleChallengeSolution) GetCert() []byte {
+	if x != nil {
+		return x.Cert
+	}
+	return nil
+}
+
+func (x *OracleChallengeSolution) GetIntermediate() []byte {
+	if x != nil {
+		return x.Intermediate
+	}
+	return nil
+}
+
+func (x *OracleChallengeSolution) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
+func (x *OracleChallengeSolution) GetSignedRootCaReq() []byte {
+	if x != nil {
+		return x.SignedRootCaReq
+	}
+	return nil
+}
+
+// TPMInit is the message sent from the client in response to the ServerInit
+// message for the TPM join flow.
+// The server is expected to respond with a TPMEncryptedCredential message.
+//
+// The TPM method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: TPMInit
+// 4. client<-server: TPMEncryptedCredential
+// 5. client->server: TPMSolution
+// 6. client<-server: Result
+type TPMInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	// The encoded TPMT_PUBLIC structure containing the attestation public key
+	// and signing parameters.
+	Public []byte `protobuf:"bytes,2,opt,name=public,proto3" json:"public,omitempty"`
+	// The properties of the attestation key, encoded as a TPMS_CREATION_DATA
+	// structure.
+	CreateData []byte `protobuf:"bytes,3,opt,name=create_data,json=createData,proto3" json:"create_data,omitempty"`
+	// An assertion as to the details of the key, encoded as a TPMS_ATTEST
+	// structure.
+	CreateAttestation []byte `protobuf:"bytes,4,opt,name=create_attestation,json=createAttestation,proto3" json:"create_attestation,omitempty"`
+	// A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
+	CreateSignature []byte `protobuf:"bytes,5,opt,name=create_signature,json=createSignature,proto3" json:"create_signature,omitempty"`
+	// Types that are valid to be assigned to Ek:
+	//
+	//	*TPMInit_EkCert
+	//	*TPMInit_EkKey
+	Ek            isTPMInit_Ek `protobuf_oneof:"ek"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TPMInit) Reset() {
+	*x = TPMInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TPMInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMInit) ProtoMessage() {}
+
+func (x *TPMInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMInit.ProtoReflect.Descriptor instead.
+func (*TPMInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *TPMInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+func (x *TPMInit) GetPublic() []byte {
+	if x != nil {
+		return x.Public
+	}
+	return nil
+}
+
+func (x *TPMInit) GetCreateData() []byte {
+	if x != nil {
+		return x.CreateData
+	}
+	return nil
+}
+
+func (x *TPMInit) GetCreateAttestation() []byte {
+	if x != nil {
+		return x.CreateAttestation
+	}
+	return nil
+}
+
+func (x *TPMInit) GetCreateSignature() []byte {
+	if x != nil {
+		return x.CreateSignature
+	}
+	return nil
+}
+
+func (x *TPMInit) GetEk() isTPMInit_Ek {
+	if x != nil {
+		return x.Ek
+	}
+	return nil
+}
+
+func (x *TPMInit) GetEkCert() []byte {
+	if x != nil {
+		if x, ok := x.Ek.(*TPMInit_EkCert); ok {
+			return x.EkCert
+		}
+	}
+	return nil
+}
+
+func (x *TPMInit) GetEkKey() []byte {
+	if x != nil {
+		if x, ok := x.Ek.(*TPMInit_EkKey); ok {
+			return x.EkKey
+		}
+	}
+	return nil
+}
+
+type isTPMInit_Ek interface {
+	isTPMInit_Ek()
+}
+
+type TPMInit_EkCert struct {
+	// The device's endorsement certificate in X509, ASN.1 DER form. This
+	// certificate contains the public key of the endorsement key. This is
+	// preferred to ek_key.
+	EkCert []byte `protobuf:"bytes,6,opt,name=ek_cert,json=ekCert,proto3,oneof"`
+}
+
+type TPMInit_EkKey struct {
+	// The device's public endorsement key in PKIX, ASN.1 DER form. This is
+	// used when a TPM does not contain any endorsement certificates.
+	EkKey []byte `protobuf:"bytes,7,opt,name=ek_key,json=ekKey,proto3,oneof"`
+}
+
+func (*TPMInit_EkCert) isTPMInit_Ek() {}
+
+func (*TPMInit_EkKey) isTPMInit_Ek() {}
+
+// TPMEncryptedCredential is the message sent from the server in response to the
+// TPMInit message.
+// The client is expected to respond with a TPMSolution message.
+type TPMEncryptedCredential struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The `credential_blob` parameter to be used with the `ActivateCredential`
+	// command. This is used with the decrypted value of `secret` in a
+	// cryptographic process to decrypt the solution.
+	CredentialBlob []byte `protobuf:"bytes,1,opt,name=credential_blob,json=credentialBlob,proto3" json:"credential_blob,omitempty"`
+	// The `secret` parameter to be used with `ActivateCredential`. This is a
+	// seed which can be decrypted with the EK. The decrypted seed is then used
+	// when decrypting `credential_blob`.
+	Secret        []byte `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TPMEncryptedCredential) Reset() {
+	*x = TPMEncryptedCredential{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TPMEncryptedCredential) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMEncryptedCredential) ProtoMessage() {}
+
+func (x *TPMEncryptedCredential) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMEncryptedCredential.ProtoReflect.Descriptor instead.
+func (*TPMEncryptedCredential) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *TPMEncryptedCredential) GetCredentialBlob() []byte {
+	if x != nil {
+		return x.CredentialBlob
+	}
+	return nil
+}
+
+func (x *TPMEncryptedCredential) GetSecret() []byte {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// TPMSolution is the message sent from the client in response to the
+// TPMEncryptedCredential message. The server is expected to respond with a
+// Result message.
+type TPMSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The client's solution to TPMEncryptedCredential using ActivateCredential.
+	Solution      []byte `protobuf:"bytes,1,opt,name=solution,proto3" json:"solution,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TPMSolution) Reset() {
+	*x = TPMSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TPMSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMSolution) ProtoMessage() {}
+
+func (x *TPMSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMSolution.ProtoReflect.Descriptor instead.
+func (*TPMSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *TPMSolution) GetSolution() []byte {
+	if x != nil {
+		return x.Solution
+	}
+	return nil
+}
+
+// AzureInit is sent from the client in response to the ServerInit message for
+// the Azure join method.
+//
+// The Azure method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: AzureInit
+// 4. client<-server: AzureChallenge
+// 5. client->server: AzureChallengeSolution
+// 6. client<-server: Result
+type AzureInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams  *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AzureInit) Reset() {
+	*x = AzureInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AzureInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AzureInit) ProtoMessage() {}
+
+func (x *AzureInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AzureInit.ProtoReflect.Descriptor instead.
+func (*AzureInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *AzureInit) GetClientParams() *ClientParams {
+	if x != nil {
+		return x.ClientParams
+	}
+	return nil
+}
+
+// AzureChallenge is sent from the server in response to the AzureInit message from the client.
+// The client is expected to respond with a AzureChallengeSolution.
+type AzureChallenge struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Challenge is a a crypto-random string that should be included by the
+	// client in the challenge response message.
+	Challenge     string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AzureChallenge) Reset() {
+	*x = AzureChallenge{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AzureChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AzureChallenge) ProtoMessage() {}
+
+func (x *AzureChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AzureChallenge.ProtoReflect.Descriptor instead.
+func (*AzureChallenge) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *AzureChallenge) GetChallenge() string {
+	if x != nil {
+		return x.Challenge
+	}
+	return ""
+}
+
+// AzureChallengeSolution must be sent from the client in response to the
+// AzureChallenge message.
+type AzureChallengeSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// AttestedData is a signed JSON document from an Azure VM's attested data
+	// metadata endpoint used to prove the identity of a joining node. It must
+	// include the challenge string as the nonce.
+	AttestedData []byte `protobuf:"bytes,1,opt,name=attested_data,json=attestedData,proto3" json:"attested_data,omitempty"`
+	// Intermediate encodes the intermediate CAs that issued the leaf certificate
+	// used to sign the attested data document, in x509 DER format.
+	Intermediate []byte `protobuf:"bytes,2,opt,name=intermediate,proto3" json:"intermediate,omitempty"`
+	// AccessToken is a JWT signed by Azure, used to prove the identity of a
+	// joining node.
+	AccessToken   string `protobuf:"bytes,3,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AzureChallengeSolution) Reset() {
+	*x = AzureChallengeSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AzureChallengeSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AzureChallengeSolution) ProtoMessage() {}
+
+func (x *AzureChallengeSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AzureChallengeSolution.ProtoReflect.Descriptor instead.
+func (*AzureChallengeSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *AzureChallengeSolution) GetAttestedData() []byte {
+	if x != nil {
+		return x.AttestedData
+	}
+	return nil
+}
+
+func (x *AzureChallengeSolution) GetIntermediate() []byte {
+	if x != nil {
+		return x.Intermediate
+	}
+	return nil
+}
+
+func (x *AzureChallengeSolution) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+// ChallengeSolution holds a solution to a challenge issued by the server.
+type ChallengeSolution struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*ChallengeSolution_BoundKeypairChallengeSolution
+	//	*ChallengeSolution_BoundKeypairRotationResponse
+	//	*ChallengeSolution_IamChallengeSolution
+	//	*ChallengeSolution_OracleChallengeSolution
+	//	*ChallengeSolution_TpmSolution
+	//	*ChallengeSolution_AzureChallengeSolution
+	Payload       isChallengeSolution_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ChallengeSolution) Reset() {
+	*x = ChallengeSolution{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ChallengeSolution) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChallengeSolution) ProtoMessage() {}
+
+func (x *ChallengeSolution) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChallengeSolution.ProtoReflect.Descriptor instead.
+func (*ChallengeSolution) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *ChallengeSolution) GetPayload() isChallengeSolution_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetBoundKeypairChallengeSolution() *BoundKeypairChallengeSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_BoundKeypairChallengeSolution); ok {
+			return x.BoundKeypairChallengeSolution
+		}
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetBoundKeypairRotationResponse() *BoundKeypairRotationResponse {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_BoundKeypairRotationResponse); ok {
+			return x.BoundKeypairRotationResponse
+		}
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetIamChallengeSolution() *IAMChallengeSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_IamChallengeSolution); ok {
+			return x.IamChallengeSolution
+		}
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetOracleChallengeSolution() *OracleChallengeSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_OracleChallengeSolution); ok {
+			return x.OracleChallengeSolution
+		}
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetTpmSolution() *TPMSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_TpmSolution); ok {
+			return x.TpmSolution
+		}
+	}
+	return nil
+}
+
+func (x *ChallengeSolution) GetAzureChallengeSolution() *AzureChallengeSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*ChallengeSolution_AzureChallengeSolution); ok {
+			return x.AzureChallengeSolution
+		}
+	}
+	return nil
+}
+
+type isChallengeSolution_Payload interface {
+	isChallengeSolution_Payload()
+}
+
+type ChallengeSolution_BoundKeypairChallengeSolution struct {
+	BoundKeypairChallengeSolution *BoundKeypairChallengeSolution `protobuf:"bytes,1,opt,name=bound_keypair_challenge_solution,json=boundKeypairChallengeSolution,proto3,oneof"`
+}
+
+type ChallengeSolution_BoundKeypairRotationResponse struct {
+	BoundKeypairRotationResponse *BoundKeypairRotationResponse `protobuf:"bytes,2,opt,name=bound_keypair_rotation_response,json=boundKeypairRotationResponse,proto3,oneof"`
+}
+
+type ChallengeSolution_IamChallengeSolution struct {
+	IamChallengeSolution *IAMChallengeSolution `protobuf:"bytes,3,opt,name=iam_challenge_solution,json=iamChallengeSolution,proto3,oneof"`
+}
+
+type ChallengeSolution_OracleChallengeSolution struct {
+	OracleChallengeSolution *OracleChallengeSolution `protobuf:"bytes,4,opt,name=oracle_challenge_solution,json=oracleChallengeSolution,proto3,oneof"`
+}
+
+type ChallengeSolution_TpmSolution struct {
+	TpmSolution *TPMSolution `protobuf:"bytes,5,opt,name=tpm_solution,json=tpmSolution,proto3,oneof"`
+}
+
+type ChallengeSolution_AzureChallengeSolution struct {
+	AzureChallengeSolution *AzureChallengeSolution `protobuf:"bytes,6,opt,name=azure_challenge_solution,json=azureChallengeSolution,proto3,oneof"`
+}
+
+func (*ChallengeSolution_BoundKeypairChallengeSolution) isChallengeSolution_Payload() {}
+
+func (*ChallengeSolution_BoundKeypairRotationResponse) isChallengeSolution_Payload() {}
+
+func (*ChallengeSolution_IamChallengeSolution) isChallengeSolution_Payload() {}
+
+func (*ChallengeSolution_OracleChallengeSolution) isChallengeSolution_Payload() {}
+
+func (*ChallengeSolution_TpmSolution) isChallengeSolution_Payload() {}
+
+func (*ChallengeSolution_AzureChallengeSolution) isChallengeSolution_Payload() {}
+
+// GivingUp should be sent by clients that fail to complete the join flow so
+// that the Auth service can log an informative error message.
+type GivingUp struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Reason is the reason the client is giving up.
+	Reason GivingUp_Reason `protobuf:"varint,1,opt,name=reason,proto3,enum=teleport.join.v1.GivingUp_Reason" json:"reason,omitempty"`
+	// Msg is an error message related to the failure.
+	Msg           string `protobuf:"bytes,2,opt,name=msg,proto3" json:"msg,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GivingUp) Reset() {
+	*x = GivingUp{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GivingUp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GivingUp) ProtoMessage() {}
+
+func (x *GivingUp) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GivingUp.ProtoReflect.Descriptor instead.
+func (*GivingUp) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *GivingUp) GetReason() GivingUp_Reason {
+	if x != nil {
+		return x.Reason
+	}
+	return GivingUp_REASON_UNSPECIFIED
+}
+
+func (x *GivingUp) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+// JoinRequest is the message type sent from the joining client to the server.
+type JoinRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*JoinRequest_ClientInit
+	//	*JoinRequest_TokenInit
+	//	*JoinRequest_BoundKeypairInit
+	//	*JoinRequest_Solution
+	//	*JoinRequest_IamInit
+	//	*JoinRequest_GivingUp
+	//	*JoinRequest_Ec2Init
+	//	*JoinRequest_OidcInit
+	//	*JoinRequest_OracleInit
+	//	*JoinRequest_TpmInit
+	//	*JoinRequest_AzureInit
+	Payload       isJoinRequest_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *JoinRequest) Reset() {
+	*x = JoinRequest{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *JoinRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*JoinRequest) ProtoMessage() {}
+
+func (x *JoinRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use JoinRequest.ProtoReflect.Descriptor instead.
+func (*JoinRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *JoinRequest) GetPayload() isJoinRequest_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetClientInit() *ClientInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_ClientInit); ok {
+			return x.ClientInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetTokenInit() *TokenInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_TokenInit); ok {
+			return x.TokenInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetBoundKeypairInit() *BoundKeypairInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_BoundKeypairInit); ok {
+			return x.BoundKeypairInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetSolution() *ChallengeSolution {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_Solution); ok {
+			return x.Solution
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetIamInit() *IAMInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_IamInit); ok {
+			return x.IamInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetGivingUp() *GivingUp {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_GivingUp); ok {
+			return x.GivingUp
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetEc2Init() *EC2Init {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_Ec2Init); ok {
+			return x.Ec2Init
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetOidcInit() *OIDCInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_OidcInit); ok {
+			return x.OidcInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetOracleInit() *OracleInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_OracleInit); ok {
+			return x.OracleInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetTpmInit() *TPMInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_TpmInit); ok {
+			return x.TpmInit
+		}
+	}
+	return nil
+}
+
+func (x *JoinRequest) GetAzureInit() *AzureInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinRequest_AzureInit); ok {
+			return x.AzureInit
+		}
+	}
+	return nil
+}
+
+type isJoinRequest_Payload interface {
+	isJoinRequest_Payload()
+}
+
+type JoinRequest_ClientInit struct {
+	ClientInit *ClientInit `protobuf:"bytes,1,opt,name=client_init,json=clientInit,proto3,oneof"`
+}
+
+type JoinRequest_TokenInit struct {
+	TokenInit *TokenInit `protobuf:"bytes,2,opt,name=token_init,json=tokenInit,proto3,oneof"`
+}
+
+type JoinRequest_BoundKeypairInit struct {
+	BoundKeypairInit *BoundKeypairInit `protobuf:"bytes,3,opt,name=bound_keypair_init,json=boundKeypairInit,proto3,oneof"`
+}
+
+type JoinRequest_Solution struct {
+	Solution *ChallengeSolution `protobuf:"bytes,4,opt,name=solution,proto3,oneof"`
+}
+
+type JoinRequest_IamInit struct {
+	IamInit *IAMInit `protobuf:"bytes,5,opt,name=iam_init,json=iamInit,proto3,oneof"`
+}
+
+type JoinRequest_GivingUp struct {
+	GivingUp *GivingUp `protobuf:"bytes,6,opt,name=giving_up,json=givingUp,proto3,oneof"`
+}
+
+type JoinRequest_Ec2Init struct {
+	Ec2Init *EC2Init `protobuf:"bytes,7,opt,name=ec2_init,json=ec2Init,proto3,oneof"`
+}
+
+type JoinRequest_OidcInit struct {
+	OidcInit *OIDCInit `protobuf:"bytes,8,opt,name=oidc_init,json=oidcInit,proto3,oneof"`
+}
+
+type JoinRequest_OracleInit struct {
+	OracleInit *OracleInit `protobuf:"bytes,9,opt,name=oracle_init,json=oracleInit,proto3,oneof"`
+}
+
+type JoinRequest_TpmInit struct {
+	TpmInit *TPMInit `protobuf:"bytes,10,opt,name=tpm_init,json=tpmInit,proto3,oneof"`
+}
+
+type JoinRequest_AzureInit struct {
+	AzureInit *AzureInit `protobuf:"bytes,11,opt,name=azure_init,json=azureInit,proto3,oneof"`
+}
+
+func (*JoinRequest_ClientInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_TokenInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_BoundKeypairInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_Solution) isJoinRequest_Payload() {}
+
+func (*JoinRequest_IamInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_GivingUp) isJoinRequest_Payload() {}
+
+func (*JoinRequest_Ec2Init) isJoinRequest_Payload() {}
+
+func (*JoinRequest_OidcInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_OracleInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_TpmInit) isJoinRequest_Payload() {}
+
+func (*JoinRequest_AzureInit) isJoinRequest_Payload() {}
+
+// ServerInit is the first message sent from the server in response to the
+// ClientInit message.
+type ServerInit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// JoinMethod is the name of the selected join method.
+	JoinMethod string `protobuf:"bytes,1,opt,name=join_method,json=joinMethod,proto3" json:"join_method,omitempty"`
+	// SignatureAlgorithmSuite is the name of the signature algorithm suite
+	// currently configured for the cluster.
+	SignatureAlgorithmSuite string `protobuf:"bytes,2,opt,name=signature_algorithm_suite,json=signatureAlgorithmSuite,proto3" json:"signature_algorithm_suite,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *ServerInit) Reset() {
+	*x = ServerInit{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ServerInit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerInit) ProtoMessage() {}
+
+func (x *ServerInit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerInit.ProtoReflect.Descriptor instead.
+func (*ServerInit) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *ServerInit) GetJoinMethod() string {
+	if x != nil {
+		return x.JoinMethod
+	}
+	return ""
+}
+
+func (x *ServerInit) GetSignatureAlgorithmSuite() string {
+	if x != nil {
+		return x.SignatureAlgorithmSuite
+	}
+	return ""
+}
+
+// Challenge is a challenge message sent from the server that the client must solve.
+type Challenge struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*Challenge_BoundKeypairChallenge
+	//	*Challenge_BoundKeypairRotationRequest
+	//	*Challenge_IamChallenge
+	//	*Challenge_OracleChallenge
+	//	*Challenge_TpmEncryptedCredential
+	//	*Challenge_AzureChallenge
+	Payload       isChallenge_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Challenge) Reset() {
+	*x = Challenge{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Challenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Challenge) ProtoMessage() {}
+
+func (x *Challenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Challenge.ProtoReflect.Descriptor instead.
+func (*Challenge) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *Challenge) GetPayload() isChallenge_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *Challenge) GetBoundKeypairChallenge() *BoundKeypairChallenge {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_BoundKeypairChallenge); ok {
+			return x.BoundKeypairChallenge
+		}
+	}
+	return nil
+}
+
+func (x *Challenge) GetBoundKeypairRotationRequest() *BoundKeypairRotationRequest {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_BoundKeypairRotationRequest); ok {
+			return x.BoundKeypairRotationRequest
+		}
+	}
+	return nil
+}
+
+func (x *Challenge) GetIamChallenge() *IAMChallenge {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_IamChallenge); ok {
+			return x.IamChallenge
+		}
+	}
+	return nil
+}
+
+func (x *Challenge) GetOracleChallenge() *OracleChallenge {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_OracleChallenge); ok {
+			return x.OracleChallenge
+		}
+	}
+	return nil
+}
+
+func (x *Challenge) GetTpmEncryptedCredential() *TPMEncryptedCredential {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_TpmEncryptedCredential); ok {
+			return x.TpmEncryptedCredential
+		}
+	}
+	return nil
+}
+
+func (x *Challenge) GetAzureChallenge() *AzureChallenge {
+	if x != nil {
+		if x, ok := x.Payload.(*Challenge_AzureChallenge); ok {
+			return x.AzureChallenge
+		}
+	}
+	return nil
+}
+
+type isChallenge_Payload interface {
+	isChallenge_Payload()
+}
+
+type Challenge_BoundKeypairChallenge struct {
+	BoundKeypairChallenge *BoundKeypairChallenge `protobuf:"bytes,1,opt,name=bound_keypair_challenge,json=boundKeypairChallenge,proto3,oneof"`
+}
+
+type Challenge_BoundKeypairRotationRequest struct {
+	BoundKeypairRotationRequest *BoundKeypairRotationRequest `protobuf:"bytes,2,opt,name=bound_keypair_rotation_request,json=boundKeypairRotationRequest,proto3,oneof"`
+}
+
+type Challenge_IamChallenge struct {
+	IamChallenge *IAMChallenge `protobuf:"bytes,3,opt,name=iam_challenge,json=iamChallenge,proto3,oneof"`
+}
+
+type Challenge_OracleChallenge struct {
+	OracleChallenge *OracleChallenge `protobuf:"bytes,4,opt,name=oracle_challenge,json=oracleChallenge,proto3,oneof"`
+}
+
+type Challenge_TpmEncryptedCredential struct {
+	TpmEncryptedCredential *TPMEncryptedCredential `protobuf:"bytes,5,opt,name=tpm_encrypted_credential,json=tpmEncryptedCredential,proto3,oneof"`
+}
+
+type Challenge_AzureChallenge struct {
+	AzureChallenge *AzureChallenge `protobuf:"bytes,6,opt,name=azure_challenge,json=azureChallenge,proto3,oneof"`
+}
+
+func (*Challenge_BoundKeypairChallenge) isChallenge_Payload() {}
+
+func (*Challenge_BoundKeypairRotationRequest) isChallenge_Payload() {}
+
+func (*Challenge_IamChallenge) isChallenge_Payload() {}
+
+func (*Challenge_OracleChallenge) isChallenge_Payload() {}
+
+func (*Challenge_TpmEncryptedCredential) isChallenge_Payload() {}
+
+func (*Challenge_AzureChallenge) isChallenge_Payload() {}
+
+// Result is the final message sent from the cluster back to the client, it
+// contains the result of the joining process including the assigned host ID
+// and issued certificates.
+type Result struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*Result_HostResult
+	//	*Result_BotResult
+	Payload       isResult_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Result) Reset() {
+	*x = Result{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Result) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Result) ProtoMessage() {}
+
+func (x *Result) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Result.ProtoReflect.Descriptor instead.
+func (*Result) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *Result) GetPayload() isResult_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *Result) GetHostResult() *HostResult {
+	if x != nil {
+		if x, ok := x.Payload.(*Result_HostResult); ok {
+			return x.HostResult
+		}
+	}
+	return nil
+}
+
+func (x *Result) GetBotResult() *BotResult {
+	if x != nil {
+		if x, ok := x.Payload.(*Result_BotResult); ok {
+			return x.BotResult
+		}
+	}
+	return nil
+}
+
+type isResult_Payload interface {
+	isResult_Payload()
+}
+
+type Result_HostResult struct {
+	HostResult *HostResult `protobuf:"bytes,1,opt,name=host_result,json=hostResult,proto3,oneof"`
+}
+
+type Result_BotResult struct {
+	BotResult *BotResult `protobuf:"bytes,2,opt,name=bot_result,json=botResult,proto3,oneof"`
+}
+
+func (*Result_HostResult) isResult_Payload() {}
+
+func (*Result_BotResult) isResult_Payload() {}
+
+// Certificates holds issued certificates and cluster CAs.
+type Certificates struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// TlsCert is an X.509 certificate encoded in ASN.1 DER form.
+	TlsCert []byte `protobuf:"bytes,1,opt,name=tls_cert,json=tlsCert,proto3" json:"tls_cert,omitempty"`
+	// TlsCaCerts is a list of TLS certificate authorities that the client should trust.
+	// Each certificate is encoding in ASN.1 DER form.
+	TlsCaCerts [][]byte `protobuf:"bytes,2,rep,name=tls_ca_certs,json=tlsCaCerts,proto3" json:"tls_ca_certs,omitempty"`
+	// SshCert is an SSH certificate encoded in SSH wire format.
+	SshCert []byte `protobuf:"bytes,3,opt,name=ssh_cert,json=sshCert,proto3" json:"ssh_cert,omitempty"`
+	// SshCaKey is a list of SSH certificate authority public keys that the client should trust.
+	// Each CA key is encoded in SSH wire format.
+	SshCaKeys     [][]byte `protobuf:"bytes,4,rep,name=ssh_ca_keys,json=sshCaKeys,proto3" json:"ssh_ca_keys,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Certificates) Reset() {
+	*x = Certificates{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Certificates) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Certificates) ProtoMessage() {}
+
+func (x *Certificates) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Certificates.ProtoReflect.Descriptor instead.
+func (*Certificates) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *Certificates) GetTlsCert() []byte {
+	if x != nil {
+		return x.TlsCert
+	}
+	return nil
+}
+
+func (x *Certificates) GetTlsCaCerts() [][]byte {
+	if x != nil {
+		return x.TlsCaCerts
+	}
+	return nil
+}
+
+func (x *Certificates) GetSshCert() []byte {
+	if x != nil {
+		return x.SshCert
+	}
+	return nil
+}
+
+func (x *Certificates) GetSshCaKeys() [][]byte {
+	if x != nil {
+		return x.SshCaKeys
+	}
+	return nil
+}
+
+// HostResult holds results for host joining.
+type HostResult struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Certificates holds issued certificates and cluster CAs.
+	Certificates *Certificates `protobuf:"bytes,1,opt,name=certificates,proto3" json:"certificates,omitempty"`
+	// HostId is the unique ID assigned to the host.
+	HostId        string `protobuf:"bytes,2,opt,name=host_id,json=hostId,proto3" json:"host_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HostResult) Reset() {
+	*x = HostResult{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HostResult) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HostResult) ProtoMessage() {}
+
+func (x *HostResult) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HostResult.ProtoReflect.Descriptor instead.
+func (*HostResult) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *HostResult) GetCertificates() *Certificates {
+	if x != nil {
+		return x.Certificates
+	}
+	return nil
+}
+
+func (x *HostResult) GetHostId() string {
+	if x != nil {
+		return x.HostId
+	}
+	return ""
+}
+
+// HostResult holds results for bot joining.
+type BotResult struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Certificates holds issued certificates and cluster CAs.
+	Certificates *Certificates `protobuf:"bytes,1,opt,name=certificates,proto3" json:"certificates,omitempty"`
+	// BoundKeypairResult holds extra result parameters relevant to the bound keypair join method.
+	BoundKeypairResult *BoundKeypairResult `protobuf:"bytes,2,opt,name=bound_keypair_result,json=boundKeypairResult,proto3,oneof" json:"bound_keypair_result,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *BotResult) Reset() {
+	*x = BotResult{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BotResult) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotResult) ProtoMessage() {}
+
+func (x *BotResult) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotResult.ProtoReflect.Descriptor instead.
+func (*BotResult) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *BotResult) GetCertificates() *Certificates {
+	if x != nil {
+		return x.Certificates
+	}
+	return nil
+}
+
+func (x *BotResult) GetBoundKeypairResult() *BoundKeypairResult {
+	if x != nil {
+		return x.BoundKeypairResult
+	}
+	return nil
+}
+
+// JoinResponse is the message type sent from the server to the joining client.
+type JoinResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*JoinResponse_Init
+	//	*JoinResponse_Challenge
+	//	*JoinResponse_Result
+	Payload       isJoinResponse_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *JoinResponse) Reset() {
+	*x = JoinResponse{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *JoinResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*JoinResponse) ProtoMessage() {}
+
+func (x *JoinResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use JoinResponse.ProtoReflect.Descriptor instead.
+func (*JoinResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *JoinResponse) GetPayload() isJoinResponse_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *JoinResponse) GetInit() *ServerInit {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinResponse_Init); ok {
+			return x.Init
+		}
+	}
+	return nil
+}
+
+func (x *JoinResponse) GetChallenge() *Challenge {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinResponse_Challenge); ok {
+			return x.Challenge
+		}
+	}
+	return nil
+}
+
+func (x *JoinResponse) GetResult() *Result {
+	if x != nil {
+		if x, ok := x.Payload.(*JoinResponse_Result); ok {
+			return x.Result
+		}
+	}
+	return nil
+}
+
+type isJoinResponse_Payload interface {
+	isJoinResponse_Payload()
+}
+
+type JoinResponse_Init struct {
+	// Init is the initial message sent from the server in response to the
+	// ClientInit message. It specifies the join method used by the provision token.
+	Init *ServerInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
+}
+
+type JoinResponse_Challenge struct {
+	// Challenge is a challenge issued by the server that the client must solve
+	// in order to complete the join flow. The challenge type depends on the join method.
+	// Each method may issue zero or more challenges that the client must solve.
+	Challenge *Challenge `protobuf:"bytes,2,opt,name=challenge,proto3,oneof"`
+}
+
+type JoinResponse_Result struct {
+	// Result is the result of the join flow, it is the final message sent from
+	// the cluster when the join flow is successful.
+	// For the token join method, it is sent immediately in response to the ClientInit request.
+	Result *Result `protobuf:"bytes,3,opt,name=result,proto3,oneof"`
+}
+
+func (*JoinResponse_Init) isJoinResponse_Payload() {}
+
+func (*JoinResponse_Challenge) isJoinResponse_Payload() {}
+
+func (*JoinResponse_Result) isJoinResponse_Payload() {}
+
+// ProxySuppliedParams holds parameters set by the Proxy when nodes join
+// via the proxy address. They must only be trusted if the incoming join
+// request is authenticated as the Proxy.
+type ClientInit_ProxySuppliedParams struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// RemoteAddr is the remote address of the host requesting a host certificate.
+	// It replaces 0.0.0.0 in the list of additional principals.
+	RemoteAddr string `protobuf:"bytes,1,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"`
+	// ClientVersion is the Teleport version of the client attempting to join.
+	ClientVersion string `protobuf:"bytes,2,opt,name=client_version,json=clientVersion,proto3" json:"client_version,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClientInit_ProxySuppliedParams) Reset() {
+	*x = ClientInit_ProxySuppliedParams{}
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientInit_ProxySuppliedParams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientInit_ProxySuppliedParams) ProtoMessage() {}
+
+func (x *ClientInit_ProxySuppliedParams) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_join_v1_joinservice_proto_msgTypes[36]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientInit_ProxySuppliedParams.ProtoReflect.Descriptor instead.
+func (*ClientInit_ProxySuppliedParams) Descriptor() ([]byte, []int) {
+	return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *ClientInit_ProxySuppliedParams) GetRemoteAddr() string {
+	if x != nil {
+		return x.RemoteAddr
+	}
+	return ""
+}
+
+func (x *ClientInit_ProxySuppliedParams) GetClientVersion() string {
+	if x != nil {
+		return x.ClientVersion
+	}
+	return ""
+}
+
+var File_teleport_join_v1_joinservice_proto protoreflect.FileDescriptor
+
+const file_teleport_join_v1_joinservice_proto_rawDesc = "" +
+	"\n" +
+	"\"teleport/join/v1/joinservice.proto\x12\x10teleport.join.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\xa0\x03\n" +
+	"\n" +
+	"ClientInit\x12$\n" +
+	"\vjoin_method\x18\x01 \x01(\tH\x00R\n" +
+	"joinMethod\x88\x01\x01\x12\x1d\n" +
+	"\n" +
+	"token_name\x18\x02 \x01(\tR\ttokenName\x12\x1f\n" +
+	"\vsystem_role\x18\x03 \x01(\tR\n" +
+	"systemRole\x12,\n" +
+	"\x12forwarded_by_proxy\x18\x04 \x01(\bR\x10forwardedByProxy\x12q\n" +
+	"\x19proxy_supplied_parameters\x18\x05 \x01(\v20.teleport.join.v1.ClientInit.ProxySuppliedParamsH\x01R\x17proxySuppliedParameters\x88\x01\x01\x1a]\n" +
+	"\x13ProxySuppliedParams\x12\x1f\n" +
+	"\vremote_addr\x18\x01 \x01(\tR\n" +
+	"remoteAddr\x12%\n" +
+	"\x0eclient_version\x18\x02 \x01(\tR\rclientVersionB\x0e\n" +
+	"\f_join_methodB\x1c\n" +
+	"\x1a_proxy_supplied_parameters\"X\n" +
+	"\n" +
+	"PublicKeys\x12$\n" +
+	"\x0epublic_tls_key\x18\x01 \x01(\fR\fpublicTlsKey\x12$\n" +
+	"\x0epublic_ssh_key\x18\x02 \x01(\fR\fpublicSshKey\"\xba\x01\n" +
+	"\n" +
+	"HostParams\x12=\n" +
+	"\vpublic_keys\x18\x01 \x01(\v2\x1c.teleport.join.v1.PublicKeysR\n" +
+	"publicKeys\x12\x1b\n" +
+	"\thost_name\x18\x02 \x01(\tR\bhostName\x123\n" +
+	"\x15additional_principals\x18\x03 \x03(\tR\x14additionalPrincipals\x12\x1b\n" +
+	"\tdns_names\x18\x04 \x03(\tR\bdnsNames\"\x91\x01\n" +
+	"\tBotParams\x12=\n" +
+	"\vpublic_keys\x18\x01 \x01(\v2\x1c.teleport.join.v1.PublicKeysR\n" +
+	"publicKeys\x129\n" +
+	"\aexpires\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampH\x00R\aexpires\x88\x01\x01B\n" +
+	"\n" +
+	"\b_expires\"\x98\x01\n" +
+	"\fClientParams\x12?\n" +
+	"\vhost_params\x18\x01 \x01(\v2\x1c.teleport.join.v1.HostParamsH\x00R\n" +
+	"hostParams\x12<\n" +
+	"\n" +
+	"bot_params\x18\x02 \x01(\v2\x1b.teleport.join.v1.BotParamsH\x00R\tbotParamsB\t\n" +
+	"\apayload\"P\n" +
+	"\tTokenInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\"j\n" +
+	"\bOIDCInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\x12\x19\n" +
+	"\bid_token\x18\x02 \x01(\fR\aidToken\"\xb7\x01\n" +
+	"\x10BoundKeypairInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\x12.\n" +
+	"\x13initial_join_secret\x18\x02 \x01(\tR\x11initialJoinSecret\x12.\n" +
+	"\x13previous_join_state\x18\x03 \x01(\fR\x11previousJoinState\"T\n" +
+	"\x15BoundKeypairChallenge\x12\x1d\n" +
+	"\n" +
+	"public_key\x18\x01 \x01(\fR\tpublicKey\x12\x1c\n" +
+	"\tchallenge\x18\x02 \x01(\tR\tchallenge\";\n" +
+	"\x1dBoundKeypairChallengeSolution\x12\x1a\n" +
+	"\bsolution\x18\x01 \x01(\fR\bsolution\"Y\n" +
+	"\x1bBoundKeypairRotationRequest\x12:\n" +
+	"\x19signature_algorithm_suite\x18\x01 \x01(\tR\x17signatureAlgorithmSuite\"=\n" +
+	"\x1cBoundKeypairRotationResponse\x12\x1d\n" +
+	"\n" +
+	"public_key\x18\x01 \x01(\fR\tpublicKey\"R\n" +
+	"\x12BoundKeypairResult\x12\x1d\n" +
+	"\n" +
+	"join_state\x18\x02 \x01(\fR\tjoinState\x12\x1d\n" +
+	"\n" +
+	"public_key\x18\x03 \x01(\fR\tpublicKey\"N\n" +
+	"\aIAMInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\",\n" +
+	"\fIAMChallenge\x12\x1c\n" +
+	"\tchallenge\x18\x01 \x01(\tR\tchallenge\"H\n" +
+	"\x14IAMChallengeSolution\x120\n" +
+	"\x14sts_identity_request\x18\x01 \x01(\fR\x12stsIdentityRequest\"j\n" +
+	"\aEC2Init\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\x12\x1a\n" +
+	"\bdocument\x18\x02 \x01(\fR\bdocument\"Q\n" +
+	"\n" +
+	"OracleInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\"/\n" +
+	"\x0fOracleChallenge\x12\x1c\n" +
+	"\tchallenge\x18\x01 \x01(\tR\tchallenge\"\x9c\x01\n" +
+	"\x17OracleChallengeSolution\x12\x12\n" +
+	"\x04cert\x18\x01 \x01(\fR\x04cert\x12\"\n" +
+	"\fintermediate\x18\x02 \x01(\fR\fintermediate\x12\x1c\n" +
+	"\tsignature\x18\x03 \x01(\fR\tsignature\x12+\n" +
+	"\x12signed_root_ca_req\x18\x04 \x01(\fR\x0fsignedRootCaReq\"\x9b\x02\n" +
+	"\aTPMInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\x12\x16\n" +
+	"\x06public\x18\x02 \x01(\fR\x06public\x12\x1f\n" +
+	"\vcreate_data\x18\x03 \x01(\fR\n" +
+	"createData\x12-\n" +
+	"\x12create_attestation\x18\x04 \x01(\fR\x11createAttestation\x12)\n" +
+	"\x10create_signature\x18\x05 \x01(\fR\x0fcreateSignature\x12\x19\n" +
+	"\aek_cert\x18\x06 \x01(\fH\x00R\x06ekCert\x12\x17\n" +
+	"\x06ek_key\x18\a \x01(\fH\x00R\x05ekKeyB\x04\n" +
+	"\x02ek\"Y\n" +
+	"\x16TPMEncryptedCredential\x12'\n" +
+	"\x0fcredential_blob\x18\x01 \x01(\fR\x0ecredentialBlob\x12\x16\n" +
+	"\x06secret\x18\x02 \x01(\fR\x06secret\")\n" +
+	"\vTPMSolution\x12\x1a\n" +
+	"\bsolution\x18\x01 \x01(\fR\bsolution\"P\n" +
+	"\tAzureInit\x12C\n" +
+	"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\".\n" +
+	"\x0eAzureChallenge\x12\x1c\n" +
+	"\tchallenge\x18\x01 \x01(\tR\tchallenge\"\x84\x01\n" +
+	"\x16AzureChallengeSolution\x12#\n" +
+	"\rattested_data\x18\x01 \x01(\fR\fattestedData\x12\"\n" +
+	"\fintermediate\x18\x02 \x01(\fR\fintermediate\x12!\n" +
+	"\faccess_token\x18\x03 \x01(\tR\vaccessToken\"\x86\x05\n" +
+	"\x11ChallengeSolution\x12z\n" +
+	" bound_keypair_challenge_solution\x18\x01 \x01(\v2/.teleport.join.v1.BoundKeypairChallengeSolutionH\x00R\x1dboundKeypairChallengeSolution\x12w\n" +
+	"\x1fbound_keypair_rotation_response\x18\x02 \x01(\v2..teleport.join.v1.BoundKeypairRotationResponseH\x00R\x1cboundKeypairRotationResponse\x12^\n" +
+	"\x16iam_challenge_solution\x18\x03 \x01(\v2&.teleport.join.v1.IAMChallengeSolutionH\x00R\x14iamChallengeSolution\x12g\n" +
+	"\x19oracle_challenge_solution\x18\x04 \x01(\v2).teleport.join.v1.OracleChallengeSolutionH\x00R\x17oracleChallengeSolution\x12B\n" +
+	"\ftpm_solution\x18\x05 \x01(\v2\x1d.teleport.join.v1.TPMSolutionH\x00R\vtpmSolution\x12d\n" +
+	"\x18azure_challenge_solution\x18\x06 \x01(\v2(.teleport.join.v1.AzureChallengeSolutionH\x00R\x16azureChallengeSolutionB\t\n" +
+	"\apayload\"\xe9\x01\n" +
+	"\bGivingUp\x129\n" +
+	"\x06reason\x18\x01 \x01(\x0e2!.teleport.join.v1.GivingUp.ReasonR\x06reason\x12\x10\n" +
+	"\x03msg\x18\x02 \x01(\tR\x03msg\"\x8f\x01\n" +
+	"\x06Reason\x12\x16\n" +
+	"\x12REASON_UNSPECIFIED\x10\x00\x12\"\n" +
+	"\x1eREASON_UNSUPPORTED_JOIN_METHOD\x10\x01\x12#\n" +
+	"\x1fREASON_UNSUPPORTED_MESSAGE_TYPE\x10\x02\x12$\n" +
+	" REASON_CHALLENGE_SOLUTION_FAILED\x10\x03\"\xcb\x05\n" +
+	"\vJoinRequest\x12?\n" +
+	"\vclient_init\x18\x01 \x01(\v2\x1c.teleport.join.v1.ClientInitH\x00R\n" +
+	"clientInit\x12<\n" +
+	"\n" +
+	"token_init\x18\x02 \x01(\v2\x1b.teleport.join.v1.TokenInitH\x00R\ttokenInit\x12R\n" +
+	"\x12bound_keypair_init\x18\x03 \x01(\v2\".teleport.join.v1.BoundKeypairInitH\x00R\x10boundKeypairInit\x12A\n" +
+	"\bsolution\x18\x04 \x01(\v2#.teleport.join.v1.ChallengeSolutionH\x00R\bsolution\x126\n" +
+	"\biam_init\x18\x05 \x01(\v2\x19.teleport.join.v1.IAMInitH\x00R\aiamInit\x129\n" +
+	"\tgiving_up\x18\x06 \x01(\v2\x1a.teleport.join.v1.GivingUpH\x00R\bgivingUp\x126\n" +
+	"\bec2_init\x18\a \x01(\v2\x19.teleport.join.v1.EC2InitH\x00R\aec2Init\x129\n" +
+	"\toidc_init\x18\b \x01(\v2\x1a.teleport.join.v1.OIDCInitH\x00R\boidcInit\x12?\n" +
+	"\voracle_init\x18\t \x01(\v2\x1c.teleport.join.v1.OracleInitH\x00R\n" +
+	"oracleInit\x126\n" +
+	"\btpm_init\x18\n" +
+	" \x01(\v2\x19.teleport.join.v1.TPMInitH\x00R\atpmInit\x12<\n" +
+	"\n" +
+	"azure_init\x18\v \x01(\v2\x1b.teleport.join.v1.AzureInitH\x00R\tazureInitB\t\n" +
+	"\apayload\"i\n" +
+	"\n" +
+	"ServerInit\x12\x1f\n" +
+	"\vjoin_method\x18\x01 \x01(\tR\n" +
+	"joinMethod\x12:\n" +
+	"\x19signature_algorithm_suite\x18\x02 \x01(\tR\x17signatureAlgorithmSuite\"\xb9\x04\n" +
+	"\tChallenge\x12a\n" +
+	"\x17bound_keypair_challenge\x18\x01 \x01(\v2'.teleport.join.v1.BoundKeypairChallengeH\x00R\x15boundKeypairChallenge\x12t\n" +
+	"\x1ebound_keypair_rotation_request\x18\x02 \x01(\v2-.teleport.join.v1.BoundKeypairRotationRequestH\x00R\x1bboundKeypairRotationRequest\x12E\n" +
+	"\riam_challenge\x18\x03 \x01(\v2\x1e.teleport.join.v1.IAMChallengeH\x00R\fiamChallenge\x12N\n" +
+	"\x10oracle_challenge\x18\x04 \x01(\v2!.teleport.join.v1.OracleChallengeH\x00R\x0foracleChallenge\x12d\n" +
+	"\x18tpm_encrypted_credential\x18\x05 \x01(\v2(.teleport.join.v1.TPMEncryptedCredentialH\x00R\x16tpmEncryptedCredential\x12K\n" +
+	"\x0fazure_challenge\x18\x06 \x01(\v2 .teleport.join.v1.AzureChallengeH\x00R\x0eazureChallengeB\t\n" +
+	"\apayload\"\x92\x01\n" +
+	"\x06Result\x12?\n" +
+	"\vhost_result\x18\x01 \x01(\v2\x1c.teleport.join.v1.HostResultH\x00R\n" +
+	"hostResult\x12<\n" +
+	"\n" +
+	"bot_result\x18\x02 \x01(\v2\x1b.teleport.join.v1.BotResultH\x00R\tbotResultB\t\n" +
+	"\apayload\"\x86\x01\n" +
+	"\fCertificates\x12\x19\n" +
+	"\btls_cert\x18\x01 \x01(\fR\atlsCert\x12 \n" +
+	"\ftls_ca_certs\x18\x02 \x03(\fR\n" +
+	"tlsCaCerts\x12\x19\n" +
+	"\bssh_cert\x18\x03 \x01(\fR\asshCert\x12\x1e\n" +
+	"\vssh_ca_keys\x18\x04 \x03(\fR\tsshCaKeys\"i\n" +
+	"\n" +
+	"HostResult\x12B\n" +
+	"\fcertificates\x18\x01 \x01(\v2\x1e.teleport.join.v1.CertificatesR\fcertificates\x12\x17\n" +
+	"\ahost_id\x18\x02 \x01(\tR\x06hostId\"\xc5\x01\n" +
+	"\tBotResult\x12B\n" +
+	"\fcertificates\x18\x01 \x01(\v2\x1e.teleport.join.v1.CertificatesR\fcertificates\x12[\n" +
+	"\x14bound_keypair_result\x18\x02 \x01(\v2$.teleport.join.v1.BoundKeypairResultH\x00R\x12boundKeypairResult\x88\x01\x01B\x17\n" +
+	"\x15_bound_keypair_result\"\xbe\x01\n" +
+	"\fJoinResponse\x122\n" +
+	"\x04init\x18\x01 \x01(\v2\x1c.teleport.join.v1.ServerInitH\x00R\x04init\x12;\n" +
+	"\tchallenge\x18\x02 \x01(\v2\x1b.teleport.join.v1.ChallengeH\x00R\tchallenge\x122\n" +
+	"\x06result\x18\x03 \x01(\v2\x18.teleport.join.v1.ResultH\x00R\x06resultB\t\n" +
+	"\apayload2X\n" +
+	"\vJoinService\x12I\n" +
+	"\x04Join\x12\x1d.teleport.join.v1.JoinRequest\x1a\x1e.teleport.join.v1.JoinResponse(\x010\x01BLZJgithub.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1;joinv1b\x06proto3"
+
+var (
+	file_teleport_join_v1_joinservice_proto_rawDescOnce sync.Once
+	file_teleport_join_v1_joinservice_proto_rawDescData []byte
+)
+
+func file_teleport_join_v1_joinservice_proto_rawDescGZIP() []byte {
+	file_teleport_join_v1_joinservice_proto_rawDescOnce.Do(func() {
+		file_teleport_join_v1_joinservice_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_join_v1_joinservice_proto_rawDesc), len(file_teleport_join_v1_joinservice_proto_rawDesc)))
+	})
+	return file_teleport_join_v1_joinservice_proto_rawDescData
+}
+
+var file_teleport_join_v1_joinservice_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_join_v1_joinservice_proto_msgTypes = make([]protoimpl.MessageInfo, 37)
+var file_teleport_join_v1_joinservice_proto_goTypes = []any{
+	(GivingUp_Reason)(0),                   // 0: teleport.join.v1.GivingUp.Reason
+	(*ClientInit)(nil),                     // 1: teleport.join.v1.ClientInit
+	(*PublicKeys)(nil),                     // 2: teleport.join.v1.PublicKeys
+	(*HostParams)(nil),                     // 3: teleport.join.v1.HostParams
+	(*BotParams)(nil),                      // 4: teleport.join.v1.BotParams
+	(*ClientParams)(nil),                   // 5: teleport.join.v1.ClientParams
+	(*TokenInit)(nil),                      // 6: teleport.join.v1.TokenInit
+	(*OIDCInit)(nil),                       // 7: teleport.join.v1.OIDCInit
+	(*BoundKeypairInit)(nil),               // 8: teleport.join.v1.BoundKeypairInit
+	(*BoundKeypairChallenge)(nil),          // 9: teleport.join.v1.BoundKeypairChallenge
+	(*BoundKeypairChallengeSolution)(nil),  // 10: teleport.join.v1.BoundKeypairChallengeSolution
+	(*BoundKeypairRotationRequest)(nil),    // 11: teleport.join.v1.BoundKeypairRotationRequest
+	(*BoundKeypairRotationResponse)(nil),   // 12: teleport.join.v1.BoundKeypairRotationResponse
+	(*BoundKeypairResult)(nil),             // 13: teleport.join.v1.BoundKeypairResult
+	(*IAMInit)(nil),                        // 14: teleport.join.v1.IAMInit
+	(*IAMChallenge)(nil),                   // 15: teleport.join.v1.IAMChallenge
+	(*IAMChallengeSolution)(nil),           // 16: teleport.join.v1.IAMChallengeSolution
+	(*EC2Init)(nil),                        // 17: teleport.join.v1.EC2Init
+	(*OracleInit)(nil),                     // 18: teleport.join.v1.OracleInit
+	(*OracleChallenge)(nil),                // 19: teleport.join.v1.OracleChallenge
+	(*OracleChallengeSolution)(nil),        // 20: teleport.join.v1.OracleChallengeSolution
+	(*TPMInit)(nil),                        // 21: teleport.join.v1.TPMInit
+	(*TPMEncryptedCredential)(nil),         // 22: teleport.join.v1.TPMEncryptedCredential
+	(*TPMSolution)(nil),                    // 23: teleport.join.v1.TPMSolution
+	(*AzureInit)(nil),                      // 24: teleport.join.v1.AzureInit
+	(*AzureChallenge)(nil),                 // 25: teleport.join.v1.AzureChallenge
+	(*AzureChallengeSolution)(nil),         // 26: teleport.join.v1.AzureChallengeSolution
+	(*ChallengeSolution)(nil),              // 27: teleport.join.v1.ChallengeSolution
+	(*GivingUp)(nil),                       // 28: teleport.join.v1.GivingUp
+	(*JoinRequest)(nil),                    // 29: teleport.join.v1.JoinRequest
+	(*ServerInit)(nil),                     // 30: teleport.join.v1.ServerInit
+	(*Challenge)(nil),                      // 31: teleport.join.v1.Challenge
+	(*Result)(nil),                         // 32: teleport.join.v1.Result
+	(*Certificates)(nil),                   // 33: teleport.join.v1.Certificates
+	(*HostResult)(nil),                     // 34: teleport.join.v1.HostResult
+	(*BotResult)(nil),                      // 35: teleport.join.v1.BotResult
+	(*JoinResponse)(nil),                   // 36: teleport.join.v1.JoinResponse
+	(*ClientInit_ProxySuppliedParams)(nil), // 37: teleport.join.v1.ClientInit.ProxySuppliedParams
+	(*timestamppb.Timestamp)(nil),          // 38: google.protobuf.Timestamp
+}
+var file_teleport_join_v1_joinservice_proto_depIdxs = []int32{
+	37, // 0: teleport.join.v1.ClientInit.proxy_supplied_parameters:type_name -> teleport.join.v1.ClientInit.ProxySuppliedParams
+	2,  // 1: teleport.join.v1.HostParams.public_keys:type_name -> teleport.join.v1.PublicKeys
+	2,  // 2: teleport.join.v1.BotParams.public_keys:type_name -> teleport.join.v1.PublicKeys
+	38, // 3: teleport.join.v1.BotParams.expires:type_name -> google.protobuf.Timestamp
+	3,  // 4: teleport.join.v1.ClientParams.host_params:type_name -> teleport.join.v1.HostParams
+	4,  // 5: teleport.join.v1.ClientParams.bot_params:type_name -> teleport.join.v1.BotParams
+	5,  // 6: teleport.join.v1.TokenInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 7: teleport.join.v1.OIDCInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 8: teleport.join.v1.BoundKeypairInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 9: teleport.join.v1.IAMInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 10: teleport.join.v1.EC2Init.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 11: teleport.join.v1.OracleInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 12: teleport.join.v1.TPMInit.client_params:type_name -> teleport.join.v1.ClientParams
+	5,  // 13: teleport.join.v1.AzureInit.client_params:type_name -> teleport.join.v1.ClientParams
+	10, // 14: teleport.join.v1.ChallengeSolution.bound_keypair_challenge_solution:type_name -> teleport.join.v1.BoundKeypairChallengeSolution
+	12, // 15: teleport.join.v1.ChallengeSolution.bound_keypair_rotation_response:type_name -> teleport.join.v1.BoundKeypairRotationResponse
+	16, // 16: teleport.join.v1.ChallengeSolution.iam_challenge_solution:type_name -> teleport.join.v1.IAMChallengeSolution
+	20, // 17: teleport.join.v1.ChallengeSolution.oracle_challenge_solution:type_name -> teleport.join.v1.OracleChallengeSolution
+	23, // 18: teleport.join.v1.ChallengeSolution.tpm_solution:type_name -> teleport.join.v1.TPMSolution
+	26, // 19: teleport.join.v1.ChallengeSolution.azure_challenge_solution:type_name -> teleport.join.v1.AzureChallengeSolution
+	0,  // 20: teleport.join.v1.GivingUp.reason:type_name -> teleport.join.v1.GivingUp.Reason
+	1,  // 21: teleport.join.v1.JoinRequest.client_init:type_name -> teleport.join.v1.ClientInit
+	6,  // 22: teleport.join.v1.JoinRequest.token_init:type_name -> teleport.join.v1.TokenInit
+	8,  // 23: teleport.join.v1.JoinRequest.bound_keypair_init:type_name -> teleport.join.v1.BoundKeypairInit
+	27, // 24: teleport.join.v1.JoinRequest.solution:type_name -> teleport.join.v1.ChallengeSolution
+	14, // 25: teleport.join.v1.JoinRequest.iam_init:type_name -> teleport.join.v1.IAMInit
+	28, // 26: teleport.join.v1.JoinRequest.giving_up:type_name -> teleport.join.v1.GivingUp
+	17, // 27: teleport.join.v1.JoinRequest.ec2_init:type_name -> teleport.join.v1.EC2Init
+	7,  // 28: teleport.join.v1.JoinRequest.oidc_init:type_name -> teleport.join.v1.OIDCInit
+	18, // 29: teleport.join.v1.JoinRequest.oracle_init:type_name -> teleport.join.v1.OracleInit
+	21, // 30: teleport.join.v1.JoinRequest.tpm_init:type_name -> teleport.join.v1.TPMInit
+	24, // 31: teleport.join.v1.JoinRequest.azure_init:type_name -> teleport.join.v1.AzureInit
+	9,  // 32: teleport.join.v1.Challenge.bound_keypair_challenge:type_name -> teleport.join.v1.BoundKeypairChallenge
+	11, // 33: teleport.join.v1.Challenge.bound_keypair_rotation_request:type_name -> teleport.join.v1.BoundKeypairRotationRequest
+	15, // 34: teleport.join.v1.Challenge.iam_challenge:type_name -> teleport.join.v1.IAMChallenge
+	19, // 35: teleport.join.v1.Challenge.oracle_challenge:type_name -> teleport.join.v1.OracleChallenge
+	22, // 36: teleport.join.v1.Challenge.tpm_encrypted_credential:type_name -> teleport.join.v1.TPMEncryptedCredential
+	25, // 37: teleport.join.v1.Challenge.azure_challenge:type_name -> teleport.join.v1.AzureChallenge
+	34, // 38: teleport.join.v1.Result.host_result:type_name -> teleport.join.v1.HostResult
+	35, // 39: teleport.join.v1.Result.bot_result:type_name -> teleport.join.v1.BotResult
+	33, // 40: teleport.join.v1.HostResult.certificates:type_name -> teleport.join.v1.Certificates
+	33, // 41: teleport.join.v1.BotResult.certificates:type_name -> teleport.join.v1.Certificates
+	13, // 42: teleport.join.v1.BotResult.bound_keypair_result:type_name -> teleport.join.v1.BoundKeypairResult
+	30, // 43: teleport.join.v1.JoinResponse.init:type_name -> teleport.join.v1.ServerInit
+	31, // 44: teleport.join.v1.JoinResponse.challenge:type_name -> teleport.join.v1.Challenge
+	32, // 45: teleport.join.v1.JoinResponse.result:type_name -> teleport.join.v1.Result
+	29, // 46: teleport.join.v1.JoinService.Join:input_type -> teleport.join.v1.JoinRequest
+	36, // 47: teleport.join.v1.JoinService.Join:output_type -> teleport.join.v1.JoinResponse
+	47, // [47:48] is the sub-list for method output_type
+	46, // [46:47] is the sub-list for method input_type
+	46, // [46:46] is the sub-list for extension type_name
+	46, // [46:46] is the sub-list for extension extendee
+	0,  // [0:46] is the sub-list for field type_name
+}
+
+func init() { file_teleport_join_v1_joinservice_proto_init() }
+func file_teleport_join_v1_joinservice_proto_init() {
+	if File_teleport_join_v1_joinservice_proto != nil {
+		return
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[0].OneofWrappers = []any{}
+	file_teleport_join_v1_joinservice_proto_msgTypes[3].OneofWrappers = []any{}
+	file_teleport_join_v1_joinservice_proto_msgTypes[4].OneofWrappers = []any{
+		(*ClientParams_HostParams)(nil),
+		(*ClientParams_BotParams)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[20].OneofWrappers = []any{
+		(*TPMInit_EkCert)(nil),
+		(*TPMInit_EkKey)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[26].OneofWrappers = []any{
+		(*ChallengeSolution_BoundKeypairChallengeSolution)(nil),
+		(*ChallengeSolution_BoundKeypairRotationResponse)(nil),
+		(*ChallengeSolution_IamChallengeSolution)(nil),
+		(*ChallengeSolution_OracleChallengeSolution)(nil),
+		(*ChallengeSolution_TpmSolution)(nil),
+		(*ChallengeSolution_AzureChallengeSolution)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[28].OneofWrappers = []any{
+		(*JoinRequest_ClientInit)(nil),
+		(*JoinRequest_TokenInit)(nil),
+		(*JoinRequest_BoundKeypairInit)(nil),
+		(*JoinRequest_Solution)(nil),
+		(*JoinRequest_IamInit)(nil),
+		(*JoinRequest_GivingUp)(nil),
+		(*JoinRequest_Ec2Init)(nil),
+		(*JoinRequest_OidcInit)(nil),
+		(*JoinRequest_OracleInit)(nil),
+		(*JoinRequest_TpmInit)(nil),
+		(*JoinRequest_AzureInit)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[30].OneofWrappers = []any{
+		(*Challenge_BoundKeypairChallenge)(nil),
+		(*Challenge_BoundKeypairRotationRequest)(nil),
+		(*Challenge_IamChallenge)(nil),
+		(*Challenge_OracleChallenge)(nil),
+		(*Challenge_TpmEncryptedCredential)(nil),
+		(*Challenge_AzureChallenge)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[31].OneofWrappers = []any{
+		(*Result_HostResult)(nil),
+		(*Result_BotResult)(nil),
+	}
+	file_teleport_join_v1_joinservice_proto_msgTypes[34].OneofWrappers = []any{}
+	file_teleport_join_v1_joinservice_proto_msgTypes[35].OneofWrappers = []any{
+		(*JoinResponse_Init)(nil),
+		(*JoinResponse_Challenge)(nil),
+		(*JoinResponse_Result)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_join_v1_joinservice_proto_rawDesc), len(file_teleport_join_v1_joinservice_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   37,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_join_v1_joinservice_proto_goTypes,
+		DependencyIndexes: file_teleport_join_v1_joinservice_proto_depIdxs,
+		EnumInfos:         file_teleport_join_v1_joinservice_proto_enumTypes,
+		MessageInfos:      file_teleport_join_v1_joinservice_proto_msgTypes,
+	}.Build()
+	File_teleport_join_v1_joinservice_proto = out.File
+	file_teleport_join_v1_joinservice_proto_goTypes = nil
+	file_teleport_join_v1_joinservice_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/join/v1/joinservice_grpc.pb.go b/api/gen/proto/go/teleport/join/v1/joinservice_grpc.pb.go
new file mode 100644
index 0000000000000..269a4f2238c72
--- /dev/null
+++ b/api/gen/proto/go/teleport/join/v1/joinservice_grpc.pb.go
@@ -0,0 +1,193 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/join/v1/joinservice.proto
+
+package joinv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	JoinService_Join_FullMethodName = "/teleport.join.v1.JoinService/Join"
+)
+
+// JoinServiceClient is the client API for JoinService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// JoinService provides methods which allow Teleport nodes, proxies, and other
+// services to "join" the Teleport cluster by completing a supported join flow
+// in order to receive signed certificates issued by the cluster.
+//
+// It may be used in multiple cases:
+//   - Teleport agents joining the cluster on their first start to receive their
+//     initial certificates. These requests do not use mTLS and the client
+//     authenticates itself using only the join flow and is assigned a new host
+//     ID.
+//   - Teleport agents that need certificates authenticated for an additional
+//     system role allowed by a new provision token. These requests must be
+//     authenticated with mTLS using their existing certificates so that the
+//     existing host ID can be maintained.
+//   - MachineID bots fetching their initial certificates.
+//   - MachineID bots refreshing their certificates.
+//
+// It is implemented on both the Auth and Proxy servers to serve the needs of
+//   - clients connecting to the proxy address for their initial join when they are
+//     unauthenticated and unable to directly dial the auth service.
+//   - clients connecting to the auth address for their initial join.
+//   - clients refreshing existing certificates that are able to make an
+//     authenticates dial to the auth service via proxy TLS routing.
+type JoinServiceClient interface {
+	// Join is a bidirectional streaming RPC that implements all join methods.
+	// The client does not need to know the join method ahead of time, all it
+	// needs is the token name.
+	//
+	// The client must send an ClientInit message on the JoinRequest stream to
+	// initiate the join flow.
+	//
+	// The server will reply with a ServerInit message, and subsequent messages
+	// on the stream will depend on the join method.
+	Join(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[JoinRequest, JoinResponse], error)
+}
+
+type joinServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewJoinServiceClient(cc grpc.ClientConnInterface) JoinServiceClient {
+	return &joinServiceClient{cc}
+}
+
+func (c *joinServiceClient) Join(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[JoinRequest, JoinResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &JoinService_ServiceDesc.Streams[0], JoinService_Join_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[JoinRequest, JoinResponse]{ClientStream: stream}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type JoinService_JoinClient = grpc.BidiStreamingClient[JoinRequest, JoinResponse]
+
+// JoinServiceServer is the server API for JoinService service.
+// All implementations must embed UnimplementedJoinServiceServer
+// for forward compatibility.
+//
+// JoinService provides methods which allow Teleport nodes, proxies, and other
+// services to "join" the Teleport cluster by completing a supported join flow
+// in order to receive signed certificates issued by the cluster.
+//
+// It may be used in multiple cases:
+//   - Teleport agents joining the cluster on their first start to receive their
+//     initial certificates. These requests do not use mTLS and the client
+//     authenticates itself using only the join flow and is assigned a new host
+//     ID.
+//   - Teleport agents that need certificates authenticated for an additional
+//     system role allowed by a new provision token. These requests must be
+//     authenticated with mTLS using their existing certificates so that the
+//     existing host ID can be maintained.
+//   - MachineID bots fetching their initial certificates.
+//   - MachineID bots refreshing their certificates.
+//
+// It is implemented on both the Auth and Proxy servers to serve the needs of
+//   - clients connecting to the proxy address for their initial join when they are
+//     unauthenticated and unable to directly dial the auth service.
+//   - clients connecting to the auth address for their initial join.
+//   - clients refreshing existing certificates that are able to make an
+//     authenticates dial to the auth service via proxy TLS routing.
+type JoinServiceServer interface {
+	// Join is a bidirectional streaming RPC that implements all join methods.
+	// The client does not need to know the join method ahead of time, all it
+	// needs is the token name.
+	//
+	// The client must send an ClientInit message on the JoinRequest stream to
+	// initiate the join flow.
+	//
+	// The server will reply with a ServerInit message, and subsequent messages
+	// on the stream will depend on the join method.
+	Join(grpc.BidiStreamingServer[JoinRequest, JoinResponse]) error
+	mustEmbedUnimplementedJoinServiceServer()
+}
+
+// UnimplementedJoinServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedJoinServiceServer struct{}
+
+func (UnimplementedJoinServiceServer) Join(grpc.BidiStreamingServer[JoinRequest, JoinResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method Join not implemented")
+}
+func (UnimplementedJoinServiceServer) mustEmbedUnimplementedJoinServiceServer() {}
+func (UnimplementedJoinServiceServer) testEmbeddedByValue()                     {}
+
+// UnsafeJoinServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to JoinServiceServer will
+// result in compilation errors.
+type UnsafeJoinServiceServer interface {
+	mustEmbedUnimplementedJoinServiceServer()
+}
+
+func RegisterJoinServiceServer(s grpc.ServiceRegistrar, srv JoinServiceServer) {
+	// If the following call pancis, it indicates UnimplementedJoinServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&JoinService_ServiceDesc, srv)
+}
+
+func _JoinService_Join_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(JoinServiceServer).Join(&grpc.GenericServerStream[JoinRequest, JoinResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type JoinService_JoinServer = grpc.BidiStreamingServer[JoinRequest, JoinResponse]
+
+// JoinService_ServiceDesc is the grpc.ServiceDesc for JoinService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var JoinService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.join.v1.JoinService",
+	HandlerType: (*JoinServiceServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Join",
+			Handler:       _JoinService_Join_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "teleport/join/v1/joinservice.proto",
+}
diff --git a/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go b/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go
index c63eaa47f5d5b..ff4530261576a 100644
--- a/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go
+++ b/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/kube/v1/kube_service.proto
 
diff --git a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer.pb.go b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer.pb.go
index b34182742c88c..2fc544432548a 100644
--- a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer.pb.go
+++ b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto
 
diff --git a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.pb.go b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.pb.go
index f148fecfa18be..8c09ba729686c 100644
--- a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.pb.go
+++ b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.proto
 
diff --git a/api/gen/proto/go/teleport/label/v1/label.pb.go b/api/gen/proto/go/teleport/label/v1/label.pb.go
index e17f86ebc0a9e..560b873b09c9f 100644
--- a/api/gen/proto/go/teleport/label/v1/label.pb.go
+++ b/api/gen/proto/go/teleport/label/v1/label.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/label/v1/label.proto
 
diff --git a/api/gen/proto/go/teleport/loginrule/v1/loginrule.pb.go b/api/gen/proto/go/teleport/loginrule/v1/loginrule.pb.go
index c1f166b26eeed..af76207b01cd0 100644
--- a/api/gen/proto/go/teleport/loginrule/v1/loginrule.pb.go
+++ b/api/gen/proto/go/teleport/loginrule/v1/loginrule.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/loginrule/v1/loginrule.proto
 
diff --git a/api/gen/proto/go/teleport/loginrule/v1/loginrule_service.pb.go b/api/gen/proto/go/teleport/loginrule/v1/loginrule_service.pb.go
index c421329831f98..9f6e110815925 100644
--- a/api/gen/proto/go/teleport/loginrule/v1/loginrule_service.pb.go
+++ b/api/gen/proto/go/teleport/loginrule/v1/loginrule_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/loginrule/v1/loginrule_service.proto
 
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot.pb.go
index a94abffbf6924..c8b6e42d99a73 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/bot.proto
 
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot_instance.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot_instance.pb.go
index 89c5a3e57f289..1cc8a9b9b58be 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot_instance.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot_instance.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/bot_instance.proto
 
@@ -23,6 +23,7 @@ package machineidv1
 import (
 	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	v11 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	types "github.com/gravitational/teleport/api/types"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	durationpb "google.golang.org/protobuf/types/known/durationpb"
@@ -40,6 +41,126 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// BotKind identifies whether the bot is the tbot binary or embedded in another
+// component.
+type BotKind int32
+
+const (
+	// The enum zero-value, it means no kind was included.
+	BotKind_BOT_KIND_UNSPECIFIED BotKind = 0
+	// Means the bot is running the tbot binary.
+	BotKind_BOT_KIND_TBOT BotKind = 1
+	// Means the bot is running inside one of our Terraform providers.
+	BotKind_BOT_KIND_TERRAFORM_PROVIDER BotKind = 2
+	// Means the bot is running inside the Teleport Kubernetes operator.
+	BotKind_BOT_KIND_KUBERNETES_OPERATOR BotKind = 3
+	// Means the bot is running inside tctl (e.g. `tctl terraform env`)
+	BotKind_BOT_KIND_TCTL BotKind = 4
+)
+
+// Enum value maps for BotKind.
+var (
+	BotKind_name = map[int32]string{
+		0: "BOT_KIND_UNSPECIFIED",
+		1: "BOT_KIND_TBOT",
+		2: "BOT_KIND_TERRAFORM_PROVIDER",
+		3: "BOT_KIND_KUBERNETES_OPERATOR",
+		4: "BOT_KIND_TCTL",
+	}
+	BotKind_value = map[string]int32{
+		"BOT_KIND_UNSPECIFIED":         0,
+		"BOT_KIND_TBOT":                1,
+		"BOT_KIND_TERRAFORM_PROVIDER":  2,
+		"BOT_KIND_KUBERNETES_OPERATOR": 3,
+		"BOT_KIND_TCTL":                4,
+	}
+)
+
+func (x BotKind) Enum() *BotKind {
+	p := new(BotKind)
+	*p = x
+	return p
+}
+
+func (x BotKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (BotKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_machineid_v1_bot_instance_proto_enumTypes[0].Descriptor()
+}
+
+func (BotKind) Type() protoreflect.EnumType {
+	return &file_teleport_machineid_v1_bot_instance_proto_enumTypes[0]
+}
+
+func (x BotKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use BotKind.Descriptor instead.
+func (BotKind) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_proto_rawDescGZIP(), []int{0}
+}
+
+// BotInstanceHealthStatus describes the healthiness of a `tbot` service.
+type BotInstanceHealthStatus int32
+
+const (
+	// The enum zero-value, it means no status was included.
+	BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED BotInstanceHealthStatus = 0
+	// Means the service is still "starting up" and hasn't reported its status.
+	BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING BotInstanceHealthStatus = 1
+	// Means the service is healthy and ready to serve traffic, or it has
+	// recently succeeded in generating an output.
+	BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY BotInstanceHealthStatus = 2
+	// Means the service is failing to serve traffic or generate output.
+	BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY BotInstanceHealthStatus = 3
+)
+
+// Enum value maps for BotInstanceHealthStatus.
+var (
+	BotInstanceHealthStatus_name = map[int32]string{
+		0: "BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED",
+		1: "BOT_INSTANCE_HEALTH_STATUS_INITIALIZING",
+		2: "BOT_INSTANCE_HEALTH_STATUS_HEALTHY",
+		3: "BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY",
+	}
+	BotInstanceHealthStatus_value = map[string]int32{
+		"BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED":  0,
+		"BOT_INSTANCE_HEALTH_STATUS_INITIALIZING": 1,
+		"BOT_INSTANCE_HEALTH_STATUS_HEALTHY":      2,
+		"BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY":    3,
+	}
+)
+
+func (x BotInstanceHealthStatus) Enum() *BotInstanceHealthStatus {
+	p := new(BotInstanceHealthStatus)
+	*p = x
+	return p
+}
+
+func (x BotInstanceHealthStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (BotInstanceHealthStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_machineid_v1_bot_instance_proto_enumTypes[1].Descriptor()
+}
+
+func (BotInstanceHealthStatus) Type() protoreflect.EnumType {
+	return &file_teleport_machineid_v1_bot_instance_proto_enumTypes[1]
+}
+
+func (x BotInstanceHealthStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use BotInstanceHealthStatus.Descriptor instead.
+func (BotInstanceHealthStatus) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_proto_rawDescGZIP(), []int{1}
+}
+
 // A BotInstance
 type BotInstance struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -224,7 +345,17 @@ type BotInstanceStatusHeartbeat struct {
 	// runtime.GOARCH.
 	Architecture string `protobuf:"bytes,8,opt,name=architecture,proto3" json:"architecture,omitempty"`
 	// The OS of the host that `tbot` is running on, determined by runtime.GOOS.
-	Os            string `protobuf:"bytes,9,opt,name=os,proto3" json:"os,omitempty"`
+	Os string `protobuf:"bytes,9,opt,name=os,proto3" json:"os,omitempty"`
+	// Identifies the external updater process.
+	ExternalUpdater string `protobuf:"bytes,10,opt,name=external_updater,json=externalUpdater,proto3" json:"external_updater,omitempty"`
+	// Identifies the external updated version. Empty if no updater is configured.
+	ExternalUpdaterVersion string `protobuf:"bytes,11,opt,name=external_updater_version,json=externalUpdaterVersion,proto3" json:"external_updater_version,omitempty"`
+	// Information provided by the external updater, including the update group
+	// and updater status.
+	UpdaterInfo *types.UpdaterV2Info `protobuf:"bytes,12,opt,name=updater_info,json=updaterInfo,proto3" json:"updater_info,omitempty"`
+	// Identifies whether the bot is running in the tbot binary or embedded in
+	// another component.
+	Kind          BotKind `protobuf:"varint,13,opt,name=kind,proto3,enum=teleport.machineid.v1.BotKind" json:"kind,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -322,6 +453,34 @@ func (x *BotInstanceStatusHeartbeat) GetOs() string {
 	return ""
 }
 
+func (x *BotInstanceStatusHeartbeat) GetExternalUpdater() string {
+	if x != nil {
+		return x.ExternalUpdater
+	}
+	return ""
+}
+
+func (x *BotInstanceStatusHeartbeat) GetExternalUpdaterVersion() string {
+	if x != nil {
+		return x.ExternalUpdaterVersion
+	}
+	return ""
+}
+
+func (x *BotInstanceStatusHeartbeat) GetUpdaterInfo() *types.UpdaterV2Info {
+	if x != nil {
+		return x.UpdaterInfo
+	}
+	return nil
+}
+
+func (x *BotInstanceStatusHeartbeat) GetKind() BotKind {
+	if x != nil {
+		return x.Kind
+	}
+	return BotKind_BOT_KIND_UNSPECIFIED
+}
+
 // BotInstanceStatusAuthentication contains information about a join or renewal.
 // Ths information is entirely sourced by the Auth Server and can be trusted.
 type BotInstanceStatusAuthentication struct {
@@ -447,8 +606,10 @@ type BotInstanceStatus struct {
 	InitialHeartbeat *BotInstanceStatusHeartbeat `protobuf:"bytes,3,opt,name=initial_heartbeat,json=initialHeartbeat,proto3" json:"initial_heartbeat,omitempty"`
 	// The N most recent heartbeats for this bot instance.
 	LatestHeartbeats []*BotInstanceStatusHeartbeat `protobuf:"bytes,4,rep,name=latest_heartbeats,json=latestHeartbeats,proto3" json:"latest_heartbeats,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	// The health of the services/output `tbot` is running.
+	ServiceHealth []*BotInstanceServiceHealth `protobuf:"bytes,5,rep,name=service_health,json=serviceHealth,proto3" json:"service_health,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *BotInstanceStatus) Reset() {
@@ -509,11 +670,147 @@ func (x *BotInstanceStatus) GetLatestHeartbeats() []*BotInstanceStatusHeartbeat
 	return nil
 }
 
+func (x *BotInstanceStatus) GetServiceHealth() []*BotInstanceServiceHealth {
+	if x != nil {
+		return x.ServiceHealth
+	}
+	return nil
+}
+
+// BotInstanceServiceHealth is a snapshot of a `tbot` service's health.
+type BotInstanceServiceHealth struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Service identifies the service.
+	Service *BotInstanceServiceIdentifier `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+	// Status describes the service's healthiness.
+	Status BotInstanceHealthStatus `protobuf:"varint,2,opt,name=status,proto3,enum=teleport.machineid.v1.BotInstanceHealthStatus" json:"status,omitempty"`
+	// Reason is a human-readable explanation for the service's status. It might
+	// include an error message.
+	Reason *string `protobuf:"bytes,3,opt,name=reason,proto3,oneof" json:"reason,omitempty"`
+	// UpdatedAt is the time at which the service's health last changed.
+	UpdatedAt     *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BotInstanceServiceHealth) Reset() {
+	*x = BotInstanceServiceHealth{}
+	mi := &file_teleport_machineid_v1_bot_instance_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BotInstanceServiceHealth) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotInstanceServiceHealth) ProtoMessage() {}
+
+func (x *BotInstanceServiceHealth) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_machineid_v1_bot_instance_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotInstanceServiceHealth.ProtoReflect.Descriptor instead.
+func (*BotInstanceServiceHealth) Descriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *BotInstanceServiceHealth) GetService() *BotInstanceServiceIdentifier {
+	if x != nil {
+		return x.Service
+	}
+	return nil
+}
+
+func (x *BotInstanceServiceHealth) GetStatus() BotInstanceHealthStatus {
+	if x != nil {
+		return x.Status
+	}
+	return BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED
+}
+
+func (x *BotInstanceServiceHealth) GetReason() string {
+	if x != nil && x.Reason != nil {
+		return *x.Reason
+	}
+	return ""
+}
+
+func (x *BotInstanceServiceHealth) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+// BotInstanceServiceIdentifier uniquely identifies a `tbot` service.
+type BotInstanceServiceIdentifier struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Type of service (e.g. database-tunnel, ssh-multiplexer).
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Name of the service, either given by the user or auto-generated.
+	Name          string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BotInstanceServiceIdentifier) Reset() {
+	*x = BotInstanceServiceIdentifier{}
+	mi := &file_teleport_machineid_v1_bot_instance_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BotInstanceServiceIdentifier) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotInstanceServiceIdentifier) ProtoMessage() {}
+
+func (x *BotInstanceServiceIdentifier) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_machineid_v1_bot_instance_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotInstanceServiceIdentifier.ProtoReflect.Descriptor instead.
+func (*BotInstanceServiceIdentifier) Descriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *BotInstanceServiceIdentifier) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *BotInstanceServiceIdentifier) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 var File_teleport_machineid_v1_bot_instance_proto protoreflect.FileDescriptor
 
 const file_teleport_machineid_v1_bot_instance_proto_rawDesc = "" +
 	"\n" +
-	"(teleport/machineid/v1/bot_instance.proto\x12\x15teleport.machineid.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a!teleport/header/v1/metadata.proto\x1a-teleport/workloadidentity/v1/join_attrs.proto\"\x8e\x02\n" +
+	"(teleport/machineid/v1/bot_instance.proto\x12\x15teleport.machineid.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a!teleport/header/v1/metadata.proto\x1a!teleport/legacy/types/types.proto\x1a-teleport/workloadidentity/v1/join_attrs.proto\"\x8e\x02\n" +
 	"\vBotInstance\x12\x12\n" +
 	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
 	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
@@ -525,7 +822,7 @@ const file_teleport_machineid_v1_bot_instance_proto_rawDesc = "" +
 	"\bbot_name\x18\x01 \x01(\tR\abotName\x12\x1f\n" +
 	"\vinstance_id\x18\x02 \x01(\tR\n" +
 	"instanceId\x120\n" +
-	"\x14previous_instance_id\x18\x04 \x01(\tR\x12previousInstanceIdJ\x04\b\x03\x10\x04R\x03ttl\"\xd1\x02\n" +
+	"\x14previous_instance_id\x18\x04 \x01(\tR\x12previousInstanceIdJ\x04\b\x03\x10\x04R\x03ttl\"\xa3\x04\n" +
 	"\x1aBotInstanceStatusHeartbeat\x12;\n" +
 	"\vrecorded_at\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
 	"recordedAt\x12\x1d\n" +
@@ -538,7 +835,12 @@ const file_teleport_machineid_v1_bot_instance_proto_rawDesc = "" +
 	"joinMethod\x12\x19\n" +
 	"\bone_shot\x18\a \x01(\bR\aoneShot\x12\"\n" +
 	"\farchitecture\x18\b \x01(\tR\farchitecture\x12\x0e\n" +
-	"\x02os\x18\t \x01(\tR\x02os\"\xf7\x02\n" +
+	"\x02os\x18\t \x01(\tR\x02os\x12)\n" +
+	"\x10external_updater\x18\n" +
+	" \x01(\tR\x0fexternalUpdater\x128\n" +
+	"\x18external_updater_version\x18\v \x01(\tR\x16externalUpdaterVersion\x127\n" +
+	"\fupdater_info\x18\f \x01(\v2\x14.types.UpdaterV2InfoR\vupdaterInfo\x122\n" +
+	"\x04kind\x18\r \x01(\x0e2\x1e.teleport.machineid.v1.BotKindR\x04kind\"\xf7\x02\n" +
 	"\x1fBotInstanceStatusAuthentication\x12E\n" +
 	"\x10authenticated_at\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x0fauthenticatedAt\x12\x1f\n" +
 	"\vjoin_method\x18\x02 \x01(\tR\n" +
@@ -552,12 +854,34 @@ const file_teleport_machineid_v1_bot_instance_proto_rawDesc = "" +
 	"\n" +
 	"public_key\x18\x06 \x01(\fR\tpublicKey\x12F\n" +
 	"\n" +
-	"join_attrs\x18\b \x01(\v2'.teleport.workloadidentity.v1.JoinAttrsR\tjoinAttrsJ\x04\b\a\x10\bR\vfingerprint\"\xb1\x03\n" +
+	"join_attrs\x18\b \x01(\v2'.teleport.workloadidentity.v1.JoinAttrsR\tjoinAttrsJ\x04\b\a\x10\bR\vfingerprint\"\x89\x04\n" +
 	"\x11BotInstanceStatus\x12m\n" +
 	"\x16initial_authentication\x18\x01 \x01(\v26.teleport.machineid.v1.BotInstanceStatusAuthenticationR\x15initialAuthentication\x12m\n" +
 	"\x16latest_authentications\x18\x02 \x03(\v26.teleport.machineid.v1.BotInstanceStatusAuthenticationR\x15latestAuthentications\x12^\n" +
 	"\x11initial_heartbeat\x18\x03 \x01(\v21.teleport.machineid.v1.BotInstanceStatusHeartbeatR\x10initialHeartbeat\x12^\n" +
-	"\x11latest_heartbeats\x18\x04 \x03(\v21.teleport.machineid.v1.BotInstanceStatusHeartbeatR\x10latestHeartbeatsBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1;machineidv1b\x06proto3"
+	"\x11latest_heartbeats\x18\x04 \x03(\v21.teleport.machineid.v1.BotInstanceStatusHeartbeatR\x10latestHeartbeats\x12V\n" +
+	"\x0eservice_health\x18\x05 \x03(\v2/.teleport.machineid.v1.BotInstanceServiceHealthR\rserviceHealth\"\x94\x02\n" +
+	"\x18BotInstanceServiceHealth\x12M\n" +
+	"\aservice\x18\x01 \x01(\v23.teleport.machineid.v1.BotInstanceServiceIdentifierR\aservice\x12F\n" +
+	"\x06status\x18\x02 \x01(\x0e2..teleport.machineid.v1.BotInstanceHealthStatusR\x06status\x12\x1b\n" +
+	"\x06reason\x18\x03 \x01(\tH\x00R\x06reason\x88\x01\x01\x129\n" +
+	"\n" +
+	"updated_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\tupdatedAtB\t\n" +
+	"\a_reason\"F\n" +
+	"\x1cBotInstanceServiceIdentifier\x12\x12\n" +
+	"\x04type\x18\x01 \x01(\tR\x04type\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name*\x8c\x01\n" +
+	"\aBotKind\x12\x18\n" +
+	"\x14BOT_KIND_UNSPECIFIED\x10\x00\x12\x11\n" +
+	"\rBOT_KIND_TBOT\x10\x01\x12\x1f\n" +
+	"\x1bBOT_KIND_TERRAFORM_PROVIDER\x10\x02\x12 \n" +
+	"\x1cBOT_KIND_KUBERNETES_OPERATOR\x10\x03\x12\x11\n" +
+	"\rBOT_KIND_TCTL\x10\x04*\xc4\x01\n" +
+	"\x17BotInstanceHealthStatus\x12*\n" +
+	"&BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED\x10\x00\x12+\n" +
+	"'BOT_INSTANCE_HEALTH_STATUS_INITIALIZING\x10\x01\x12&\n" +
+	"\"BOT_INSTANCE_HEALTH_STATUS_HEALTHY\x10\x02\x12(\n" +
+	"$BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY\x10\x03BVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1;machineidv1b\x06proto3"
 
 var (
 	file_teleport_machineid_v1_bot_instance_proto_rawDescOnce sync.Once
@@ -571,37 +895,49 @@ func file_teleport_machineid_v1_bot_instance_proto_rawDescGZIP() []byte {
 	return file_teleport_machineid_v1_bot_instance_proto_rawDescData
 }
 
-var file_teleport_machineid_v1_bot_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_teleport_machineid_v1_bot_instance_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_teleport_machineid_v1_bot_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
 var file_teleport_machineid_v1_bot_instance_proto_goTypes = []any{
-	(*BotInstance)(nil),                     // 0: teleport.machineid.v1.BotInstance
-	(*BotInstanceSpec)(nil),                 // 1: teleport.machineid.v1.BotInstanceSpec
-	(*BotInstanceStatusHeartbeat)(nil),      // 2: teleport.machineid.v1.BotInstanceStatusHeartbeat
-	(*BotInstanceStatusAuthentication)(nil), // 3: teleport.machineid.v1.BotInstanceStatusAuthentication
-	(*BotInstanceStatus)(nil),               // 4: teleport.machineid.v1.BotInstanceStatus
-	(*v1.Metadata)(nil),                     // 5: teleport.header.v1.Metadata
-	(*timestamppb.Timestamp)(nil),           // 6: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),             // 7: google.protobuf.Duration
-	(*structpb.Struct)(nil),                 // 8: google.protobuf.Struct
-	(*v11.JoinAttrs)(nil),                   // 9: teleport.workloadidentity.v1.JoinAttrs
+	(BotKind)(0),                            // 0: teleport.machineid.v1.BotKind
+	(BotInstanceHealthStatus)(0),            // 1: teleport.machineid.v1.BotInstanceHealthStatus
+	(*BotInstance)(nil),                     // 2: teleport.machineid.v1.BotInstance
+	(*BotInstanceSpec)(nil),                 // 3: teleport.machineid.v1.BotInstanceSpec
+	(*BotInstanceStatusHeartbeat)(nil),      // 4: teleport.machineid.v1.BotInstanceStatusHeartbeat
+	(*BotInstanceStatusAuthentication)(nil), // 5: teleport.machineid.v1.BotInstanceStatusAuthentication
+	(*BotInstanceStatus)(nil),               // 6: teleport.machineid.v1.BotInstanceStatus
+	(*BotInstanceServiceHealth)(nil),        // 7: teleport.machineid.v1.BotInstanceServiceHealth
+	(*BotInstanceServiceIdentifier)(nil),    // 8: teleport.machineid.v1.BotInstanceServiceIdentifier
+	(*v1.Metadata)(nil),                     // 9: teleport.header.v1.Metadata
+	(*timestamppb.Timestamp)(nil),           // 10: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),             // 11: google.protobuf.Duration
+	(*types.UpdaterV2Info)(nil),             // 12: types.UpdaterV2Info
+	(*structpb.Struct)(nil),                 // 13: google.protobuf.Struct
+	(*v11.JoinAttrs)(nil),                   // 14: teleport.workloadidentity.v1.JoinAttrs
 }
 var file_teleport_machineid_v1_bot_instance_proto_depIdxs = []int32{
-	5,  // 0: teleport.machineid.v1.BotInstance.metadata:type_name -> teleport.header.v1.Metadata
-	1,  // 1: teleport.machineid.v1.BotInstance.spec:type_name -> teleport.machineid.v1.BotInstanceSpec
-	4,  // 2: teleport.machineid.v1.BotInstance.status:type_name -> teleport.machineid.v1.BotInstanceStatus
-	6,  // 3: teleport.machineid.v1.BotInstanceStatusHeartbeat.recorded_at:type_name -> google.protobuf.Timestamp
-	7,  // 4: teleport.machineid.v1.BotInstanceStatusHeartbeat.uptime:type_name -> google.protobuf.Duration
-	6,  // 5: teleport.machineid.v1.BotInstanceStatusAuthentication.authenticated_at:type_name -> google.protobuf.Timestamp
-	8,  // 6: teleport.machineid.v1.BotInstanceStatusAuthentication.metadata:type_name -> google.protobuf.Struct
-	9,  // 7: teleport.machineid.v1.BotInstanceStatusAuthentication.join_attrs:type_name -> teleport.workloadidentity.v1.JoinAttrs
-	3,  // 8: teleport.machineid.v1.BotInstanceStatus.initial_authentication:type_name -> teleport.machineid.v1.BotInstanceStatusAuthentication
-	3,  // 9: teleport.machineid.v1.BotInstanceStatus.latest_authentications:type_name -> teleport.machineid.v1.BotInstanceStatusAuthentication
-	2,  // 10: teleport.machineid.v1.BotInstanceStatus.initial_heartbeat:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
-	2,  // 11: teleport.machineid.v1.BotInstanceStatus.latest_heartbeats:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	9,  // 0: teleport.machineid.v1.BotInstance.metadata:type_name -> teleport.header.v1.Metadata
+	3,  // 1: teleport.machineid.v1.BotInstance.spec:type_name -> teleport.machineid.v1.BotInstanceSpec
+	6,  // 2: teleport.machineid.v1.BotInstance.status:type_name -> teleport.machineid.v1.BotInstanceStatus
+	10, // 3: teleport.machineid.v1.BotInstanceStatusHeartbeat.recorded_at:type_name -> google.protobuf.Timestamp
+	11, // 4: teleport.machineid.v1.BotInstanceStatusHeartbeat.uptime:type_name -> google.protobuf.Duration
+	12, // 5: teleport.machineid.v1.BotInstanceStatusHeartbeat.updater_info:type_name -> types.UpdaterV2Info
+	0,  // 6: teleport.machineid.v1.BotInstanceStatusHeartbeat.kind:type_name -> teleport.machineid.v1.BotKind
+	10, // 7: teleport.machineid.v1.BotInstanceStatusAuthentication.authenticated_at:type_name -> google.protobuf.Timestamp
+	13, // 8: teleport.machineid.v1.BotInstanceStatusAuthentication.metadata:type_name -> google.protobuf.Struct
+	14, // 9: teleport.machineid.v1.BotInstanceStatusAuthentication.join_attrs:type_name -> teleport.workloadidentity.v1.JoinAttrs
+	5,  // 10: teleport.machineid.v1.BotInstanceStatus.initial_authentication:type_name -> teleport.machineid.v1.BotInstanceStatusAuthentication
+	5,  // 11: teleport.machineid.v1.BotInstanceStatus.latest_authentications:type_name -> teleport.machineid.v1.BotInstanceStatusAuthentication
+	4,  // 12: teleport.machineid.v1.BotInstanceStatus.initial_heartbeat:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
+	4,  // 13: teleport.machineid.v1.BotInstanceStatus.latest_heartbeats:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
+	7,  // 14: teleport.machineid.v1.BotInstanceStatus.service_health:type_name -> teleport.machineid.v1.BotInstanceServiceHealth
+	8,  // 15: teleport.machineid.v1.BotInstanceServiceHealth.service:type_name -> teleport.machineid.v1.BotInstanceServiceIdentifier
+	1,  // 16: teleport.machineid.v1.BotInstanceServiceHealth.status:type_name -> teleport.machineid.v1.BotInstanceHealthStatus
+	10, // 17: teleport.machineid.v1.BotInstanceServiceHealth.updated_at:type_name -> google.protobuf.Timestamp
+	18, // [18:18] is the sub-list for method output_type
+	18, // [18:18] is the sub-list for method input_type
+	18, // [18:18] is the sub-list for extension type_name
+	18, // [18:18] is the sub-list for extension extendee
+	0,  // [0:18] is the sub-list for field type_name
 }
 
 func init() { file_teleport_machineid_v1_bot_instance_proto_init() }
@@ -609,18 +945,20 @@ func file_teleport_machineid_v1_bot_instance_proto_init() {
 	if File_teleport_machineid_v1_bot_instance_proto != nil {
 		return
 	}
+	file_teleport_machineid_v1_bot_instance_proto_msgTypes[5].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_machineid_v1_bot_instance_proto_rawDesc), len(file_teleport_machineid_v1_bot_instance_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   5,
+			NumEnums:      2,
+			NumMessages:   7,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
 		GoTypes:           file_teleport_machineid_v1_bot_instance_proto_goTypes,
 		DependencyIndexes: file_teleport_machineid_v1_bot_instance_proto_depIdxs,
+		EnumInfos:         file_teleport_machineid_v1_bot_instance_proto_enumTypes,
 		MessageInfos:      file_teleport_machineid_v1_bot_instance_proto_msgTypes,
 	}.Build()
 	File_teleport_machineid_v1_bot_instance_proto = out.File
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot_instance_service.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot_instance_service.pb.go
index 3bef9f97a0f17..d9d09bb87e4f1 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot_instance_service.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot_instance_service.pb.go
@@ -14,13 +14,14 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/bot_instance_service.proto
 
 package machineidv1
 
 import (
+	types "github.com/gravitational/teleport/api/types"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
@@ -108,8 +109,10 @@ type ListBotInstancesRequest struct {
 	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
 	// A search term used to filter the results. If non-empty, it's used to match against supported fields.
 	FilterSearchTerm string `protobuf:"bytes,4,opt,name=filter_search_term,json=filterSearchTerm,proto3" json:"filter_search_term,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	// The sort config to use for the results. If empty, the default sort field and order is used.
+	Sort          *types.SortBy `protobuf:"bytes,5,opt,name=sort,proto3" json:"sort,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListBotInstancesRequest) Reset() {
@@ -170,6 +173,102 @@ func (x *ListBotInstancesRequest) GetFilterSearchTerm() string {
 	return ""
 }
 
+func (x *ListBotInstancesRequest) GetSort() *types.SortBy {
+	if x != nil {
+		return x.Sort
+	}
+	return nil
+}
+
+// Request for ListBotInstancesV2.
+//
+// Follows the pagination semantics of
+// https://cloud.google.com/apis/design/standard_methods#list
+type ListBotInstancesV2Request struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The page_token value returned from a previous ListBotInstancesV2 request,
+	// if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// The sort field to use for the results. If empty, the default sort field is
+	// used.
+	SortField string `protobuf:"bytes,3,opt,name=sort_field,json=sortField,proto3" json:"sort_field,omitempty"`
+	// The sort order to use for the results. If empty, the default sort order is
+	// used.
+	SortDesc bool `protobuf:"varint,4,opt,name=sort_desc,json=sortDesc,proto3" json:"sort_desc,omitempty"`
+	// Fields used to filter the results
+	Filter        *ListBotInstancesV2Request_Filters `protobuf:"bytes,5,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListBotInstancesV2Request) Reset() {
+	*x = ListBotInstancesV2Request{}
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListBotInstancesV2Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListBotInstancesV2Request) ProtoMessage() {}
+
+func (x *ListBotInstancesV2Request) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListBotInstancesV2Request.ProtoReflect.Descriptor instead.
+func (*ListBotInstancesV2Request) Descriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListBotInstancesV2Request) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListBotInstancesV2Request) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListBotInstancesV2Request) GetSortField() string {
+	if x != nil {
+		return x.SortField
+	}
+	return ""
+}
+
+func (x *ListBotInstancesV2Request) GetSortDesc() bool {
+	if x != nil {
+		return x.SortDesc
+	}
+	return false
+}
+
+func (x *ListBotInstancesV2Request) GetFilter() *ListBotInstancesV2Request_Filters {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
 // Response for ListBotInstances.
 type ListBotInstancesResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -184,7 +283,7 @@ type ListBotInstancesResponse struct {
 
 func (x *ListBotInstancesResponse) Reset() {
 	*x = ListBotInstancesResponse{}
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[2]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -196,7 +295,7 @@ func (x *ListBotInstancesResponse) String() string {
 func (*ListBotInstancesResponse) ProtoMessage() {}
 
 func (x *ListBotInstancesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[2]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -209,7 +308,7 @@ func (x *ListBotInstancesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListBotInstancesResponse.ProtoReflect.Descriptor instead.
 func (*ListBotInstancesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{2}
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ListBotInstancesResponse) GetBotInstances() []*BotInstance {
@@ -239,7 +338,7 @@ type DeleteBotInstanceRequest struct {
 
 func (x *DeleteBotInstanceRequest) Reset() {
 	*x = DeleteBotInstanceRequest{}
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[3]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -251,7 +350,7 @@ func (x *DeleteBotInstanceRequest) String() string {
 func (*DeleteBotInstanceRequest) ProtoMessage() {}
 
 func (x *DeleteBotInstanceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[3]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -264,7 +363,7 @@ func (x *DeleteBotInstanceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteBotInstanceRequest.ProtoReflect.Descriptor instead.
 func (*DeleteBotInstanceRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{3}
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *DeleteBotInstanceRequest) GetBotName() string {
@@ -285,14 +384,16 @@ func (x *DeleteBotInstanceRequest) GetInstanceId() string {
 type SubmitHeartbeatRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The heartbeat data to submit.
-	Heartbeat     *BotInstanceStatusHeartbeat `protobuf:"bytes,1,opt,name=heartbeat,proto3" json:"heartbeat,omitempty"`
+	Heartbeat *BotInstanceStatusHeartbeat `protobuf:"bytes,1,opt,name=heartbeat,proto3" json:"heartbeat,omitempty"`
+	// The health of the services/output `tbot` is running.
+	ServiceHealth []*BotInstanceServiceHealth `protobuf:"bytes,2,rep,name=service_health,json=serviceHealth,proto3" json:"service_health,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SubmitHeartbeatRequest) Reset() {
 	*x = SubmitHeartbeatRequest{}
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[4]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -304,7 +405,7 @@ func (x *SubmitHeartbeatRequest) String() string {
 func (*SubmitHeartbeatRequest) ProtoMessage() {}
 
 func (x *SubmitHeartbeatRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[4]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -317,7 +418,7 @@ func (x *SubmitHeartbeatRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitHeartbeatRequest.ProtoReflect.Descriptor instead.
 func (*SubmitHeartbeatRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{4}
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *SubmitHeartbeatRequest) GetHeartbeat() *BotInstanceStatusHeartbeat {
@@ -327,6 +428,13 @@ func (x *SubmitHeartbeatRequest) GetHeartbeat() *BotInstanceStatusHeartbeat {
 	return nil
 }
 
+func (x *SubmitHeartbeatRequest) GetServiceHealth() []*BotInstanceServiceHealth {
+	if x != nil {
+		return x.ServiceHealth
+	}
+	return nil
+}
+
 // The response for SubmitHeartbeat.
 type SubmitHeartbeatResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -336,7 +444,7 @@ type SubmitHeartbeatResponse struct {
 
 func (x *SubmitHeartbeatResponse) Reset() {
 	*x = SubmitHeartbeatResponse{}
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[5]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -348,7 +456,7 @@ func (x *SubmitHeartbeatResponse) String() string {
 func (*SubmitHeartbeatResponse) ProtoMessage() {}
 
 func (x *SubmitHeartbeatResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[5]
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -361,37 +469,119 @@ func (x *SubmitHeartbeatResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitHeartbeatResponse.ProtoReflect.Descriptor instead.
 func (*SubmitHeartbeatResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{5}
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{6}
+}
+
+// Filters contains fields to be used to filter the results.
+type ListBotInstancesV2Request_Filters struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The name of the Bot to list BotInstances for. If non-empty, only
+	// BotInstances for that bot will be listed.
+	BotName string `protobuf:"bytes,1,opt,name=bot_name,json=botName,proto3" json:"bot_name,omitempty"`
+	// A search term used to filter the results. If non-empty, it's used to
+	// match against supported fields.
+	SearchTerm string `protobuf:"bytes,2,opt,name=search_term,json=searchTerm,proto3" json:"search_term,omitempty"`
+	// A Teleport predicate language query used to filter the results.
+	Query         string `protobuf:"bytes,3,opt,name=query,proto3" json:"query,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListBotInstancesV2Request_Filters) Reset() {
+	*x = ListBotInstancesV2Request_Filters{}
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListBotInstancesV2Request_Filters) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListBotInstancesV2Request_Filters) ProtoMessage() {}
+
+func (x *ListBotInstancesV2Request_Filters) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_machineid_v1_bot_instance_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListBotInstancesV2Request_Filters.ProtoReflect.Descriptor instead.
+func (*ListBotInstancesV2Request_Filters) Descriptor() ([]byte, []int) {
+	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP(), []int{2, 0}
+}
+
+func (x *ListBotInstancesV2Request_Filters) GetBotName() string {
+	if x != nil {
+		return x.BotName
+	}
+	return ""
+}
+
+func (x *ListBotInstancesV2Request_Filters) GetSearchTerm() string {
+	if x != nil {
+		return x.SearchTerm
+	}
+	return ""
+}
+
+func (x *ListBotInstancesV2Request_Filters) GetQuery() string {
+	if x != nil {
+		return x.Query
+	}
+	return ""
 }
 
 var File_teleport_machineid_v1_bot_instance_service_proto protoreflect.FileDescriptor
 
 const file_teleport_machineid_v1_bot_instance_service_proto_rawDesc = "" +
 	"\n" +
-	"0teleport/machineid/v1/bot_instance_service.proto\x12\x15teleport.machineid.v1\x1a\x1bgoogle/protobuf/empty.proto\x1a(teleport/machineid/v1/bot_instance.proto\"S\n" +
+	"0teleport/machineid/v1/bot_instance_service.proto\x12\x15teleport.machineid.v1\x1a\x1bgoogle/protobuf/empty.proto\x1a!teleport/legacy/types/types.proto\x1a(teleport/machineid/v1/bot_instance.proto\"S\n" +
 	"\x15GetBotInstanceRequest\x12\x19\n" +
 	"\bbot_name\x18\x01 \x01(\tR\abotName\x12\x1f\n" +
 	"\vinstance_id\x18\x02 \x01(\tR\n" +
-	"instanceId\"\xab\x01\n" +
+	"instanceId\"\xce\x01\n" +
 	"\x17ListBotInstancesRequest\x12&\n" +
 	"\x0ffilter_bot_name\x18\x01 \x01(\tR\rfilterBotName\x12\x1b\n" +
 	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
 	"\n" +
 	"page_token\x18\x03 \x01(\tR\tpageToken\x12,\n" +
-	"\x12filter_search_term\x18\x04 \x01(\tR\x10filterSearchTerm\"\x8b\x01\n" +
+	"\x12filter_search_term\x18\x04 \x01(\tR\x10filterSearchTerm\x12!\n" +
+	"\x04sort\x18\x05 \x01(\v2\r.types.SortByR\x04sort\"\xc2\x02\n" +
+	"\x19ListBotInstancesV2Request\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12\x1d\n" +
+	"\n" +
+	"sort_field\x18\x03 \x01(\tR\tsortField\x12\x1b\n" +
+	"\tsort_desc\x18\x04 \x01(\bR\bsortDesc\x12P\n" +
+	"\x06filter\x18\x05 \x01(\v28.teleport.machineid.v1.ListBotInstancesV2Request.FiltersR\x06filter\x1a[\n" +
+	"\aFilters\x12\x19\n" +
+	"\bbot_name\x18\x01 \x01(\tR\abotName\x12\x1f\n" +
+	"\vsearch_term\x18\x02 \x01(\tR\n" +
+	"searchTerm\x12\x14\n" +
+	"\x05query\x18\x03 \x01(\tR\x05query\"\x8b\x01\n" +
 	"\x18ListBotInstancesResponse\x12G\n" +
 	"\rbot_instances\x18\x01 \x03(\v2\".teleport.machineid.v1.BotInstanceR\fbotInstances\x12&\n" +
 	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"V\n" +
 	"\x18DeleteBotInstanceRequest\x12\x19\n" +
 	"\bbot_name\x18\x01 \x01(\tR\abotName\x12\x1f\n" +
 	"\vinstance_id\x18\x02 \x01(\tR\n" +
-	"instanceId\"i\n" +
+	"instanceId\"\xc1\x01\n" +
 	"\x16SubmitHeartbeatRequest\x12O\n" +
-	"\theartbeat\x18\x01 \x01(\v21.teleport.machineid.v1.BotInstanceStatusHeartbeatR\theartbeat\"\x19\n" +
-	"\x17SubmitHeartbeatResponse2\xbd\x03\n" +
+	"\theartbeat\x18\x01 \x01(\v21.teleport.machineid.v1.BotInstanceStatusHeartbeatR\theartbeat\x12V\n" +
+	"\x0eservice_health\x18\x02 \x03(\v2/.teleport.machineid.v1.BotInstanceServiceHealthR\rserviceHealth\"\x19\n" +
+	"\x17SubmitHeartbeatResponse2\xbb\x04\n" +
 	"\x12BotInstanceService\x12b\n" +
-	"\x0eGetBotInstance\x12,.teleport.machineid.v1.GetBotInstanceRequest\x1a\".teleport.machineid.v1.BotInstance\x12s\n" +
-	"\x10ListBotInstances\x12..teleport.machineid.v1.ListBotInstancesRequest\x1a/.teleport.machineid.v1.ListBotInstancesResponse\x12\\\n" +
+	"\x0eGetBotInstance\x12,.teleport.machineid.v1.GetBotInstanceRequest\x1a\".teleport.machineid.v1.BotInstance\x12x\n" +
+	"\x10ListBotInstances\x12..teleport.machineid.v1.ListBotInstancesRequest\x1a/.teleport.machineid.v1.ListBotInstancesResponse\"\x03\x88\x02\x01\x12w\n" +
+	"\x12ListBotInstancesV2\x120.teleport.machineid.v1.ListBotInstancesV2Request\x1a/.teleport.machineid.v1.ListBotInstancesResponse\x12\\\n" +
 	"\x11DeleteBotInstance\x12/.teleport.machineid.v1.DeleteBotInstanceRequest\x1a\x16.google.protobuf.Empty\x12p\n" +
 	"\x0fSubmitHeartbeat\x12-.teleport.machineid.v1.SubmitHeartbeatRequest\x1a..teleport.machineid.v1.SubmitHeartbeatResponseBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1;machineidv1b\x06proto3"
 
@@ -407,34 +597,43 @@ func file_teleport_machineid_v1_bot_instance_service_proto_rawDescGZIP() []byte
 	return file_teleport_machineid_v1_bot_instance_service_proto_rawDescData
 }
 
-var file_teleport_machineid_v1_bot_instance_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_teleport_machineid_v1_bot_instance_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_teleport_machineid_v1_bot_instance_service_proto_goTypes = []any{
-	(*GetBotInstanceRequest)(nil),      // 0: teleport.machineid.v1.GetBotInstanceRequest
-	(*ListBotInstancesRequest)(nil),    // 1: teleport.machineid.v1.ListBotInstancesRequest
-	(*ListBotInstancesResponse)(nil),   // 2: teleport.machineid.v1.ListBotInstancesResponse
-	(*DeleteBotInstanceRequest)(nil),   // 3: teleport.machineid.v1.DeleteBotInstanceRequest
-	(*SubmitHeartbeatRequest)(nil),     // 4: teleport.machineid.v1.SubmitHeartbeatRequest
-	(*SubmitHeartbeatResponse)(nil),    // 5: teleport.machineid.v1.SubmitHeartbeatResponse
-	(*BotInstance)(nil),                // 6: teleport.machineid.v1.BotInstance
-	(*BotInstanceStatusHeartbeat)(nil), // 7: teleport.machineid.v1.BotInstanceStatusHeartbeat
-	(*emptypb.Empty)(nil),              // 8: google.protobuf.Empty
+	(*GetBotInstanceRequest)(nil),             // 0: teleport.machineid.v1.GetBotInstanceRequest
+	(*ListBotInstancesRequest)(nil),           // 1: teleport.machineid.v1.ListBotInstancesRequest
+	(*ListBotInstancesV2Request)(nil),         // 2: teleport.machineid.v1.ListBotInstancesV2Request
+	(*ListBotInstancesResponse)(nil),          // 3: teleport.machineid.v1.ListBotInstancesResponse
+	(*DeleteBotInstanceRequest)(nil),          // 4: teleport.machineid.v1.DeleteBotInstanceRequest
+	(*SubmitHeartbeatRequest)(nil),            // 5: teleport.machineid.v1.SubmitHeartbeatRequest
+	(*SubmitHeartbeatResponse)(nil),           // 6: teleport.machineid.v1.SubmitHeartbeatResponse
+	(*ListBotInstancesV2Request_Filters)(nil), // 7: teleport.machineid.v1.ListBotInstancesV2Request.Filters
+	(*types.SortBy)(nil),                      // 8: types.SortBy
+	(*BotInstance)(nil),                       // 9: teleport.machineid.v1.BotInstance
+	(*BotInstanceStatusHeartbeat)(nil),        // 10: teleport.machineid.v1.BotInstanceStatusHeartbeat
+	(*BotInstanceServiceHealth)(nil),          // 11: teleport.machineid.v1.BotInstanceServiceHealth
+	(*emptypb.Empty)(nil),                     // 12: google.protobuf.Empty
 }
 var file_teleport_machineid_v1_bot_instance_service_proto_depIdxs = []int32{
-	6, // 0: teleport.machineid.v1.ListBotInstancesResponse.bot_instances:type_name -> teleport.machineid.v1.BotInstance
-	7, // 1: teleport.machineid.v1.SubmitHeartbeatRequest.heartbeat:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
-	0, // 2: teleport.machineid.v1.BotInstanceService.GetBotInstance:input_type -> teleport.machineid.v1.GetBotInstanceRequest
-	1, // 3: teleport.machineid.v1.BotInstanceService.ListBotInstances:input_type -> teleport.machineid.v1.ListBotInstancesRequest
-	3, // 4: teleport.machineid.v1.BotInstanceService.DeleteBotInstance:input_type -> teleport.machineid.v1.DeleteBotInstanceRequest
-	4, // 5: teleport.machineid.v1.BotInstanceService.SubmitHeartbeat:input_type -> teleport.machineid.v1.SubmitHeartbeatRequest
-	6, // 6: teleport.machineid.v1.BotInstanceService.GetBotInstance:output_type -> teleport.machineid.v1.BotInstance
-	2, // 7: teleport.machineid.v1.BotInstanceService.ListBotInstances:output_type -> teleport.machineid.v1.ListBotInstancesResponse
-	8, // 8: teleport.machineid.v1.BotInstanceService.DeleteBotInstance:output_type -> google.protobuf.Empty
-	5, // 9: teleport.machineid.v1.BotInstanceService.SubmitHeartbeat:output_type -> teleport.machineid.v1.SubmitHeartbeatResponse
-	6, // [6:10] is the sub-list for method output_type
-	2, // [2:6] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	8,  // 0: teleport.machineid.v1.ListBotInstancesRequest.sort:type_name -> types.SortBy
+	7,  // 1: teleport.machineid.v1.ListBotInstancesV2Request.filter:type_name -> teleport.machineid.v1.ListBotInstancesV2Request.Filters
+	9,  // 2: teleport.machineid.v1.ListBotInstancesResponse.bot_instances:type_name -> teleport.machineid.v1.BotInstance
+	10, // 3: teleport.machineid.v1.SubmitHeartbeatRequest.heartbeat:type_name -> teleport.machineid.v1.BotInstanceStatusHeartbeat
+	11, // 4: teleport.machineid.v1.SubmitHeartbeatRequest.service_health:type_name -> teleport.machineid.v1.BotInstanceServiceHealth
+	0,  // 5: teleport.machineid.v1.BotInstanceService.GetBotInstance:input_type -> teleport.machineid.v1.GetBotInstanceRequest
+	1,  // 6: teleport.machineid.v1.BotInstanceService.ListBotInstances:input_type -> teleport.machineid.v1.ListBotInstancesRequest
+	2,  // 7: teleport.machineid.v1.BotInstanceService.ListBotInstancesV2:input_type -> teleport.machineid.v1.ListBotInstancesV2Request
+	4,  // 8: teleport.machineid.v1.BotInstanceService.DeleteBotInstance:input_type -> teleport.machineid.v1.DeleteBotInstanceRequest
+	5,  // 9: teleport.machineid.v1.BotInstanceService.SubmitHeartbeat:input_type -> teleport.machineid.v1.SubmitHeartbeatRequest
+	9,  // 10: teleport.machineid.v1.BotInstanceService.GetBotInstance:output_type -> teleport.machineid.v1.BotInstance
+	3,  // 11: teleport.machineid.v1.BotInstanceService.ListBotInstances:output_type -> teleport.machineid.v1.ListBotInstancesResponse
+	3,  // 12: teleport.machineid.v1.BotInstanceService.ListBotInstancesV2:output_type -> teleport.machineid.v1.ListBotInstancesResponse
+	12, // 13: teleport.machineid.v1.BotInstanceService.DeleteBotInstance:output_type -> google.protobuf.Empty
+	6,  // 14: teleport.machineid.v1.BotInstanceService.SubmitHeartbeat:output_type -> teleport.machineid.v1.SubmitHeartbeatResponse
+	10, // [10:15] is the sub-list for method output_type
+	5,  // [5:10] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_teleport_machineid_v1_bot_instance_service_proto_init() }
@@ -449,7 +648,7 @@ func file_teleport_machineid_v1_bot_instance_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_machineid_v1_bot_instance_service_proto_rawDesc), len(file_teleport_machineid_v1_bot_instance_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot_instance_service_grpc.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot_instance_service_grpc.pb.go
index 766dda1c5d9a5..3637522d47a33 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot_instance_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot_instance_service_grpc.pb.go
@@ -34,10 +34,11 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	BotInstanceService_GetBotInstance_FullMethodName    = "/teleport.machineid.v1.BotInstanceService/GetBotInstance"
-	BotInstanceService_ListBotInstances_FullMethodName  = "/teleport.machineid.v1.BotInstanceService/ListBotInstances"
-	BotInstanceService_DeleteBotInstance_FullMethodName = "/teleport.machineid.v1.BotInstanceService/DeleteBotInstance"
-	BotInstanceService_SubmitHeartbeat_FullMethodName   = "/teleport.machineid.v1.BotInstanceService/SubmitHeartbeat"
+	BotInstanceService_GetBotInstance_FullMethodName     = "/teleport.machineid.v1.BotInstanceService/GetBotInstance"
+	BotInstanceService_ListBotInstances_FullMethodName   = "/teleport.machineid.v1.BotInstanceService/ListBotInstances"
+	BotInstanceService_ListBotInstancesV2_FullMethodName = "/teleport.machineid.v1.BotInstanceService/ListBotInstancesV2"
+	BotInstanceService_DeleteBotInstance_FullMethodName  = "/teleport.machineid.v1.BotInstanceService/DeleteBotInstance"
+	BotInstanceService_SubmitHeartbeat_FullMethodName    = "/teleport.machineid.v1.BotInstanceService/SubmitHeartbeat"
 )
 
 // BotInstanceServiceClient is the client API for BotInstanceService service.
@@ -48,8 +49,12 @@ const (
 type BotInstanceServiceClient interface {
 	// GetBotInstance returns the specified BotInstance resource.
 	GetBotInstance(ctx context.Context, in *GetBotInstanceRequest, opts ...grpc.CallOption) (*BotInstance, error)
+	// Deprecated: Do not use.
 	// ListBotInstances returns a page of BotInstance resources.
+	// Deprecated: Use ListBotInstancesV2 instead
 	ListBotInstances(ctx context.Context, in *ListBotInstancesRequest, opts ...grpc.CallOption) (*ListBotInstancesResponse, error)
+	// ListBotInstancesV2 returns a page of BotInstance resources.
+	ListBotInstancesV2(ctx context.Context, in *ListBotInstancesV2Request, opts ...grpc.CallOption) (*ListBotInstancesResponse, error)
 	// DeleteBotInstance hard deletes the specified BotInstance resource.
 	DeleteBotInstance(ctx context.Context, in *DeleteBotInstanceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// SubmitHeartbeat submits a heartbeat for a BotInstance.
@@ -74,6 +79,7 @@ func (c *botInstanceServiceClient) GetBotInstance(ctx context.Context, in *GetBo
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *botInstanceServiceClient) ListBotInstances(ctx context.Context, in *ListBotInstancesRequest, opts ...grpc.CallOption) (*ListBotInstancesResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListBotInstancesResponse)
@@ -84,6 +90,16 @@ func (c *botInstanceServiceClient) ListBotInstances(ctx context.Context, in *Lis
 	return out, nil
 }
 
+func (c *botInstanceServiceClient) ListBotInstancesV2(ctx context.Context, in *ListBotInstancesV2Request, opts ...grpc.CallOption) (*ListBotInstancesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListBotInstancesResponse)
+	err := c.cc.Invoke(ctx, BotInstanceService_ListBotInstancesV2_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *botInstanceServiceClient) DeleteBotInstance(ctx context.Context, in *DeleteBotInstanceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
@@ -112,8 +128,12 @@ func (c *botInstanceServiceClient) SubmitHeartbeat(ctx context.Context, in *Subm
 type BotInstanceServiceServer interface {
 	// GetBotInstance returns the specified BotInstance resource.
 	GetBotInstance(context.Context, *GetBotInstanceRequest) (*BotInstance, error)
+	// Deprecated: Do not use.
 	// ListBotInstances returns a page of BotInstance resources.
+	// Deprecated: Use ListBotInstancesV2 instead
 	ListBotInstances(context.Context, *ListBotInstancesRequest) (*ListBotInstancesResponse, error)
+	// ListBotInstancesV2 returns a page of BotInstance resources.
+	ListBotInstancesV2(context.Context, *ListBotInstancesV2Request) (*ListBotInstancesResponse, error)
 	// DeleteBotInstance hard deletes the specified BotInstance resource.
 	DeleteBotInstance(context.Context, *DeleteBotInstanceRequest) (*emptypb.Empty, error)
 	// SubmitHeartbeat submits a heartbeat for a BotInstance.
@@ -134,6 +154,9 @@ func (UnimplementedBotInstanceServiceServer) GetBotInstance(context.Context, *Ge
 func (UnimplementedBotInstanceServiceServer) ListBotInstances(context.Context, *ListBotInstancesRequest) (*ListBotInstancesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListBotInstances not implemented")
 }
+func (UnimplementedBotInstanceServiceServer) ListBotInstancesV2(context.Context, *ListBotInstancesV2Request) (*ListBotInstancesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListBotInstancesV2 not implemented")
+}
 func (UnimplementedBotInstanceServiceServer) DeleteBotInstance(context.Context, *DeleteBotInstanceRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteBotInstance not implemented")
 }
@@ -197,6 +220,24 @@ func _BotInstanceService_ListBotInstances_Handler(srv interface{}, ctx context.C
 	return interceptor(ctx, in, info, handler)
 }
 
+func _BotInstanceService_ListBotInstancesV2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListBotInstancesV2Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BotInstanceServiceServer).ListBotInstancesV2(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BotInstanceService_ListBotInstancesV2_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BotInstanceServiceServer).ListBotInstancesV2(ctx, req.(*ListBotInstancesV2Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _BotInstanceService_DeleteBotInstance_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DeleteBotInstanceRequest)
 	if err := dec(in); err != nil {
@@ -248,6 +289,10 @@ var BotInstanceService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListBotInstances",
 			Handler:    _BotInstanceService_ListBotInstances_Handler,
 		},
+		{
+			MethodName: "ListBotInstancesV2",
+			Handler:    _BotInstanceService_ListBotInstancesV2_Handler,
+		},
 		{
 			MethodName: "DeleteBotInstance",
 			Handler:    _BotInstanceService_DeleteBotInstance_Handler,
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot_service.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot_service.pb.go
index f63c1d4461a51..91c8491303e00 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot_service.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/bot_service.proto
 
diff --git a/api/gen/proto/go/teleport/machineid/v1/federation.pb.go b/api/gen/proto/go/teleport/machineid/v1/federation.pb.go
index 0bd5c235c8580..09c80c3f77708 100644
--- a/api/gen/proto/go/teleport/machineid/v1/federation.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/federation.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/federation.proto
 
diff --git a/api/gen/proto/go/teleport/machineid/v1/federation_service.pb.go b/api/gen/proto/go/teleport/machineid/v1/federation_service.pb.go
index 011253f902388..397dc2360a0a3 100644
--- a/api/gen/proto/go/teleport/machineid/v1/federation_service.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/federation_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/federation_service.proto
 
diff --git a/api/gen/proto/go/teleport/machineid/v1/workload_identity_service.pb.go b/api/gen/proto/go/teleport/machineid/v1/workload_identity_service.pb.go
index 2a8f8f5b2e53b..f8b0dd9633fdb 100644
--- a/api/gen/proto/go/teleport/machineid/v1/workload_identity_service.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/workload_identity_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/machineid/v1/workload_identity_service.proto
 
diff --git a/api/gen/proto/go/teleport/notifications/v1/notifications.pb.go b/api/gen/proto/go/teleport/notifications/v1/notifications.pb.go
index d7b07c6f91a41..ff694fc700aa0 100644
--- a/api/gen/proto/go/teleport/notifications/v1/notifications.pb.go
+++ b/api/gen/proto/go/teleport/notifications/v1/notifications.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/notifications/v1/notifications.proto
 
diff --git a/api/gen/proto/go/teleport/notifications/v1/notifications_service.pb.go b/api/gen/proto/go/teleport/notifications/v1/notifications_service.pb.go
index d989e1d33f8b2..1d47da38979bd 100644
--- a/api/gen/proto/go/teleport/notifications/v1/notifications_service.pb.go
+++ b/api/gen/proto/go/teleport/notifications/v1/notifications_service.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/notifications/v1/notifications_service.proto
 
diff --git a/api/gen/proto/go/teleport/okta/v1/okta_service.pb.go b/api/gen/proto/go/teleport/okta/v1/okta_service.pb.go
index b64a4a3c0ce39..8f5a03d65a556 100644
--- a/api/gen/proto/go/teleport/okta/v1/okta_service.pb.go
+++ b/api/gen/proto/go/teleport/okta/v1/okta_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/okta/v1/okta_service.proto
 
@@ -287,8 +287,13 @@ type CreateIntegrationRequest struct {
 	EnableSystemLogExport bool `protobuf:"varint,11,opt,name=enable_system_log_export,json=enableSystemLogExport,proto3" json:"enable_system_log_export,omitempty"`
 	// Whether to assign the builtin okta-requester role to all Okta synced users.
 	DisableAssignDefaultRoles bool `protobuf:"varint,12,opt,name=disable_assign_default_roles,json=disableAssignDefaultRoles,proto3" json:"disable_assign_default_roles,omitempty"`
-	unknownFields             protoimpl.UnknownFields
-	sizeCache                 protoimpl.SizeCache
+	// TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+	// groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+	// bidirectional sync is enabled. It will be rounded down to the nearest second The default value
+	// is 1800 (30 minutes).
+	TimeBetweenImports *durationpb.Duration `protobuf:"bytes,13,opt,name=time_between_imports,json=timeBetweenImports,proto3" json:"time_between_imports,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *CreateIntegrationRequest) Reset() {
@@ -405,6 +410,13 @@ func (x *CreateIntegrationRequest) GetDisableAssignDefaultRoles() bool {
 	return false
 }
 
+func (x *CreateIntegrationRequest) GetTimeBetweenImports() *durationpb.Duration {
+	if x != nil {
+		return x.TimeBetweenImports
+	}
+	return nil
+}
+
 // UpdateIntegrationRequest is the request message for updating an existing Okta integration.
 type UpdateIntegrationRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -428,8 +440,13 @@ type UpdateIntegrationRequest struct {
 	EnableSystemLogExport bool `protobuf:"varint,11,opt,name=enable_system_log_export,json=enableSystemLogExport,proto3" json:"enable_system_log_export,omitempty"`
 	// Whether to assign the builtin okta-requester role to all Okta synced users.
 	DisableAssignDefaultRoles bool `protobuf:"varint,12,opt,name=disable_assign_default_roles,json=disableAssignDefaultRoles,proto3" json:"disable_assign_default_roles,omitempty"`
-	unknownFields             protoimpl.UnknownFields
-	sizeCache                 protoimpl.SizeCache
+	// TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+	// groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+	// bidirectional sync is enabled. It will be rounded down to the nearest second. The default
+	// value is 1800 (30 minutes).
+	TimeBetweenImports *durationpb.Duration `protobuf:"bytes,13,opt,name=time_between_imports,json=timeBetweenImports,proto3" json:"time_between_imports,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *UpdateIntegrationRequest) Reset() {
@@ -525,6 +542,13 @@ func (x *UpdateIntegrationRequest) GetDisableAssignDefaultRoles() bool {
 	return false
 }
 
+func (x *UpdateIntegrationRequest) GetTimeBetweenImports() *durationpb.Duration {
+	if x != nil {
+		return x.TimeBetweenImports
+	}
+	return nil
+}
+
 // AccessListSettings contains the settings for access list synchronization.
 type AccessListSettings struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1808,7 +1832,7 @@ const file_teleport_okta_v1_okta_service_proto_rawDesc = "" +
 	"\x06groups\x18\x01 \x03(\v2).teleport.okta.v1.GetGroupsResponse.GroupR\x06groups\x1a=\n" +
 	"\x05Group\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
-	"\vdescription\x18\x02 \x01(\tR\vdescription\"\xb1\x05\n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescription\"\xfe\x05\n" +
 	"\x18CreateIntegrationRequest\x122\n" +
 	"\x15okta_organization_url\x18\x01 \x01(\tR\x13oktaOrganizationUrl\x12M\n" +
 	"\x0fapi_credentials\x18\x02 \x01(\v2$.teleport.okta.v1.OktaAPICredentialsR\x0eapiCredentials\x12\x1d\n" +
@@ -1823,7 +1847,8 @@ const file_teleport_okta_v1_okta_service_proto_rawDesc = "" +
 	"\x19enable_bidirectional_sync\x18\n" +
 	" \x01(\bR\x17enableBidirectionalSync\x127\n" +
 	"\x18enable_system_log_export\x18\v \x01(\bR\x15enableSystemLogExport\x12?\n" +
-	"\x1cdisable_assign_default_roles\x18\f \x01(\bR\x19disableAssignDefaultRoles\"\xd9\x04\n" +
+	"\x1cdisable_assign_default_roles\x18\f \x01(\bR\x19disableAssignDefaultRoles\x12K\n" +
+	"\x14time_between_imports\x18\r \x01(\v2\x19.google.protobuf.DurationR\x12timeBetweenImports\"\xa6\x05\n" +
 	"\x18UpdateIntegrationRequest\x12M\n" +
 	"\x0fapi_credentials\x18\x02 \x01(\v2$.teleport.okta.v1.OktaAPICredentialsR\x0eapiCredentials\x12\x1d\n" +
 	"\n" +
@@ -1835,7 +1860,8 @@ const file_teleport_okta_v1_okta_service_proto_rawDesc = "" +
 	"\x19enable_bidirectional_sync\x18\n" +
 	" \x01(\bR\x17enableBidirectionalSync\x127\n" +
 	"\x18enable_system_log_export\x18\v \x01(\bR\x15enableSystemLogExport\x12?\n" +
-	"\x1cdisable_assign_default_roles\x18\f \x01(\bR\x19disableAssignDefaultRolesJ\x04\b\b\x10\tJ\x04\b\t\x10\n" +
+	"\x1cdisable_assign_default_roles\x18\f \x01(\bR\x19disableAssignDefaultRoles\x12K\n" +
+	"\x14time_between_imports\x18\r \x01(\v2\x19.google.protobuf.DurationR\x12timeBetweenImportsJ\x04\b\b\x10\tJ\x04\b\t\x10\n" +
 	"R\x0freuse_connectorR\x10sso_metadata_url\"\x7f\n" +
 	"\x12AccessListSettings\x12#\n" +
 	"\rgroup_filters\x18\x02 \x03(\tR\fgroupFilters\x12\x1f\n" +
@@ -1967,11 +1993,11 @@ var file_teleport_okta_v1_okta_service_proto_goTypes = []any{
 	(*DeleteAllOktaAssignmentsRequest)(nil),              // 27: teleport.okta.v1.DeleteAllOktaAssignmentsRequest
 	(*GetAppsResponse_App)(nil),                          // 28: teleport.okta.v1.GetAppsResponse.App
 	(*GetGroupsResponse_Group)(nil),                      // 29: teleport.okta.v1.GetGroupsResponse.Group
-	(*types.PluginV1)(nil),                               // 30: types.PluginV1
-	(*types.OktaImportRuleV1)(nil),                       // 31: types.OktaImportRuleV1
-	(*types.OktaAssignmentV1)(nil),                       // 32: types.OktaAssignmentV1
-	(types.OktaAssignmentSpecV1_OktaAssignmentStatus)(0), // 33: types.OktaAssignmentSpecV1.OktaAssignmentStatus
-	(*durationpb.Duration)(nil),                          // 34: google.protobuf.Duration
+	(*durationpb.Duration)(nil),                          // 30: google.protobuf.Duration
+	(*types.PluginV1)(nil),                               // 31: types.PluginV1
+	(*types.OktaImportRuleV1)(nil),                       // 32: types.OktaImportRuleV1
+	(*types.OktaAssignmentV1)(nil),                       // 33: types.OktaAssignmentV1
+	(types.OktaAssignmentSpecV1_OktaAssignmentStatus)(0), // 34: types.OktaAssignmentSpecV1.OktaAssignmentStatus
 	(*emptypb.Empty)(nil),                                // 35: google.protobuf.Empty
 }
 var file_teleport_okta_v1_okta_service_proto_depIdxs = []int32{
@@ -1981,62 +2007,64 @@ var file_teleport_okta_v1_okta_service_proto_depIdxs = []int32{
 	29, // 3: teleport.okta.v1.GetGroupsResponse.groups:type_name -> teleport.okta.v1.GetGroupsResponse.Group
 	7,  // 4: teleport.okta.v1.CreateIntegrationRequest.api_credentials:type_name -> teleport.okta.v1.OktaAPICredentials
 	6,  // 5: teleport.okta.v1.CreateIntegrationRequest.access_list_settings:type_name -> teleport.okta.v1.AccessListSettings
-	7,  // 6: teleport.okta.v1.UpdateIntegrationRequest.api_credentials:type_name -> teleport.okta.v1.OktaAPICredentials
-	6,  // 7: teleport.okta.v1.UpdateIntegrationRequest.access_list_settings:type_name -> teleport.okta.v1.AccessListSettings
-	30, // 8: teleport.okta.v1.CreateIntegrationResponse.plugin:type_name -> types.PluginV1
-	10, // 9: teleport.okta.v1.CreateIntegrationResponse.connector_info:type_name -> teleport.okta.v1.ConnectorInfo
-	30, // 10: teleport.okta.v1.UpdateIntegrationResponse.plugin:type_name -> types.PluginV1
-	10, // 11: teleport.okta.v1.UpdateIntegrationResponse.connector_info:type_name -> teleport.okta.v1.ConnectorInfo
-	7,  // 12: teleport.okta.v1.ValidateClientCredentialsRequest.api_credentials:type_name -> teleport.okta.v1.OktaAPICredentials
-	31, // 13: teleport.okta.v1.ListOktaImportRulesResponse.import_rules:type_name -> types.OktaImportRuleV1
-	31, // 14: teleport.okta.v1.CreateOktaImportRuleRequest.import_rule:type_name -> types.OktaImportRuleV1
-	31, // 15: teleport.okta.v1.UpdateOktaImportRuleRequest.import_rule:type_name -> types.OktaImportRuleV1
-	32, // 16: teleport.okta.v1.ListOktaAssignmentsResponse.assignments:type_name -> types.OktaAssignmentV1
-	32, // 17: teleport.okta.v1.CreateOktaAssignmentRequest.assignment:type_name -> types.OktaAssignmentV1
-	32, // 18: teleport.okta.v1.UpdateOktaAssignmentRequest.assignment:type_name -> types.OktaAssignmentV1
-	33, // 19: teleport.okta.v1.UpdateOktaAssignmentStatusRequest.status:type_name -> types.OktaAssignmentSpecV1.OktaAssignmentStatus
-	34, // 20: teleport.okta.v1.UpdateOktaAssignmentStatusRequest.time_has_passed:type_name -> google.protobuf.Duration
-	13, // 21: teleport.okta.v1.OktaService.ListOktaImportRules:input_type -> teleport.okta.v1.ListOktaImportRulesRequest
-	15, // 22: teleport.okta.v1.OktaService.GetOktaImportRule:input_type -> teleport.okta.v1.GetOktaImportRuleRequest
-	16, // 23: teleport.okta.v1.OktaService.CreateOktaImportRule:input_type -> teleport.okta.v1.CreateOktaImportRuleRequest
-	17, // 24: teleport.okta.v1.OktaService.UpdateOktaImportRule:input_type -> teleport.okta.v1.UpdateOktaImportRuleRequest
-	18, // 25: teleport.okta.v1.OktaService.DeleteOktaImportRule:input_type -> teleport.okta.v1.DeleteOktaImportRuleRequest
-	19, // 26: teleport.okta.v1.OktaService.DeleteAllOktaImportRules:input_type -> teleport.okta.v1.DeleteAllOktaImportRulesRequest
-	20, // 27: teleport.okta.v1.OktaService.ListOktaAssignments:input_type -> teleport.okta.v1.ListOktaAssignmentsRequest
-	22, // 28: teleport.okta.v1.OktaService.GetOktaAssignment:input_type -> teleport.okta.v1.GetOktaAssignmentRequest
-	23, // 29: teleport.okta.v1.OktaService.CreateOktaAssignment:input_type -> teleport.okta.v1.CreateOktaAssignmentRequest
-	24, // 30: teleport.okta.v1.OktaService.UpdateOktaAssignment:input_type -> teleport.okta.v1.UpdateOktaAssignmentRequest
-	25, // 31: teleport.okta.v1.OktaService.UpdateOktaAssignmentStatus:input_type -> teleport.okta.v1.UpdateOktaAssignmentStatusRequest
-	26, // 32: teleport.okta.v1.OktaService.DeleteOktaAssignment:input_type -> teleport.okta.v1.DeleteOktaAssignmentRequest
-	27, // 33: teleport.okta.v1.OktaService.DeleteAllOktaAssignments:input_type -> teleport.okta.v1.DeleteAllOktaAssignmentsRequest
-	11, // 34: teleport.okta.v1.OktaService.ValidateClientCredentials:input_type -> teleport.okta.v1.ValidateClientCredentialsRequest
-	4,  // 35: teleport.okta.v1.OktaService.CreateIntegration:input_type -> teleport.okta.v1.CreateIntegrationRequest
-	5,  // 36: teleport.okta.v1.OktaService.UpdateIntegration:input_type -> teleport.okta.v1.UpdateIntegrationRequest
-	0,  // 37: teleport.okta.v1.OktaService.GetApps:input_type -> teleport.okta.v1.GetAppsRequest
-	2,  // 38: teleport.okta.v1.OktaService.GetGroups:input_type -> teleport.okta.v1.GetGroupsRequest
-	14, // 39: teleport.okta.v1.OktaService.ListOktaImportRules:output_type -> teleport.okta.v1.ListOktaImportRulesResponse
-	31, // 40: teleport.okta.v1.OktaService.GetOktaImportRule:output_type -> types.OktaImportRuleV1
-	31, // 41: teleport.okta.v1.OktaService.CreateOktaImportRule:output_type -> types.OktaImportRuleV1
-	31, // 42: teleport.okta.v1.OktaService.UpdateOktaImportRule:output_type -> types.OktaImportRuleV1
-	35, // 43: teleport.okta.v1.OktaService.DeleteOktaImportRule:output_type -> google.protobuf.Empty
-	35, // 44: teleport.okta.v1.OktaService.DeleteAllOktaImportRules:output_type -> google.protobuf.Empty
-	21, // 45: teleport.okta.v1.OktaService.ListOktaAssignments:output_type -> teleport.okta.v1.ListOktaAssignmentsResponse
-	32, // 46: teleport.okta.v1.OktaService.GetOktaAssignment:output_type -> types.OktaAssignmentV1
-	32, // 47: teleport.okta.v1.OktaService.CreateOktaAssignment:output_type -> types.OktaAssignmentV1
-	32, // 48: teleport.okta.v1.OktaService.UpdateOktaAssignment:output_type -> types.OktaAssignmentV1
-	35, // 49: teleport.okta.v1.OktaService.UpdateOktaAssignmentStatus:output_type -> google.protobuf.Empty
-	35, // 50: teleport.okta.v1.OktaService.DeleteOktaAssignment:output_type -> google.protobuf.Empty
-	35, // 51: teleport.okta.v1.OktaService.DeleteAllOktaAssignments:output_type -> google.protobuf.Empty
-	12, // 52: teleport.okta.v1.OktaService.ValidateClientCredentials:output_type -> teleport.okta.v1.ValidateClientCredentialsResponse
-	8,  // 53: teleport.okta.v1.OktaService.CreateIntegration:output_type -> teleport.okta.v1.CreateIntegrationResponse
-	9,  // 54: teleport.okta.v1.OktaService.UpdateIntegration:output_type -> teleport.okta.v1.UpdateIntegrationResponse
-	1,  // 55: teleport.okta.v1.OktaService.GetApps:output_type -> teleport.okta.v1.GetAppsResponse
-	3,  // 56: teleport.okta.v1.OktaService.GetGroups:output_type -> teleport.okta.v1.GetGroupsResponse
-	39, // [39:57] is the sub-list for method output_type
-	21, // [21:39] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	21, // [21:21] is the sub-list for extension extendee
-	0,  // [0:21] is the sub-list for field type_name
+	30, // 6: teleport.okta.v1.CreateIntegrationRequest.time_between_imports:type_name -> google.protobuf.Duration
+	7,  // 7: teleport.okta.v1.UpdateIntegrationRequest.api_credentials:type_name -> teleport.okta.v1.OktaAPICredentials
+	6,  // 8: teleport.okta.v1.UpdateIntegrationRequest.access_list_settings:type_name -> teleport.okta.v1.AccessListSettings
+	30, // 9: teleport.okta.v1.UpdateIntegrationRequest.time_between_imports:type_name -> google.protobuf.Duration
+	31, // 10: teleport.okta.v1.CreateIntegrationResponse.plugin:type_name -> types.PluginV1
+	10, // 11: teleport.okta.v1.CreateIntegrationResponse.connector_info:type_name -> teleport.okta.v1.ConnectorInfo
+	31, // 12: teleport.okta.v1.UpdateIntegrationResponse.plugin:type_name -> types.PluginV1
+	10, // 13: teleport.okta.v1.UpdateIntegrationResponse.connector_info:type_name -> teleport.okta.v1.ConnectorInfo
+	7,  // 14: teleport.okta.v1.ValidateClientCredentialsRequest.api_credentials:type_name -> teleport.okta.v1.OktaAPICredentials
+	32, // 15: teleport.okta.v1.ListOktaImportRulesResponse.import_rules:type_name -> types.OktaImportRuleV1
+	32, // 16: teleport.okta.v1.CreateOktaImportRuleRequest.import_rule:type_name -> types.OktaImportRuleV1
+	32, // 17: teleport.okta.v1.UpdateOktaImportRuleRequest.import_rule:type_name -> types.OktaImportRuleV1
+	33, // 18: teleport.okta.v1.ListOktaAssignmentsResponse.assignments:type_name -> types.OktaAssignmentV1
+	33, // 19: teleport.okta.v1.CreateOktaAssignmentRequest.assignment:type_name -> types.OktaAssignmentV1
+	33, // 20: teleport.okta.v1.UpdateOktaAssignmentRequest.assignment:type_name -> types.OktaAssignmentV1
+	34, // 21: teleport.okta.v1.UpdateOktaAssignmentStatusRequest.status:type_name -> types.OktaAssignmentSpecV1.OktaAssignmentStatus
+	30, // 22: teleport.okta.v1.UpdateOktaAssignmentStatusRequest.time_has_passed:type_name -> google.protobuf.Duration
+	13, // 23: teleport.okta.v1.OktaService.ListOktaImportRules:input_type -> teleport.okta.v1.ListOktaImportRulesRequest
+	15, // 24: teleport.okta.v1.OktaService.GetOktaImportRule:input_type -> teleport.okta.v1.GetOktaImportRuleRequest
+	16, // 25: teleport.okta.v1.OktaService.CreateOktaImportRule:input_type -> teleport.okta.v1.CreateOktaImportRuleRequest
+	17, // 26: teleport.okta.v1.OktaService.UpdateOktaImportRule:input_type -> teleport.okta.v1.UpdateOktaImportRuleRequest
+	18, // 27: teleport.okta.v1.OktaService.DeleteOktaImportRule:input_type -> teleport.okta.v1.DeleteOktaImportRuleRequest
+	19, // 28: teleport.okta.v1.OktaService.DeleteAllOktaImportRules:input_type -> teleport.okta.v1.DeleteAllOktaImportRulesRequest
+	20, // 29: teleport.okta.v1.OktaService.ListOktaAssignments:input_type -> teleport.okta.v1.ListOktaAssignmentsRequest
+	22, // 30: teleport.okta.v1.OktaService.GetOktaAssignment:input_type -> teleport.okta.v1.GetOktaAssignmentRequest
+	23, // 31: teleport.okta.v1.OktaService.CreateOktaAssignment:input_type -> teleport.okta.v1.CreateOktaAssignmentRequest
+	24, // 32: teleport.okta.v1.OktaService.UpdateOktaAssignment:input_type -> teleport.okta.v1.UpdateOktaAssignmentRequest
+	25, // 33: teleport.okta.v1.OktaService.UpdateOktaAssignmentStatus:input_type -> teleport.okta.v1.UpdateOktaAssignmentStatusRequest
+	26, // 34: teleport.okta.v1.OktaService.DeleteOktaAssignment:input_type -> teleport.okta.v1.DeleteOktaAssignmentRequest
+	27, // 35: teleport.okta.v1.OktaService.DeleteAllOktaAssignments:input_type -> teleport.okta.v1.DeleteAllOktaAssignmentsRequest
+	11, // 36: teleport.okta.v1.OktaService.ValidateClientCredentials:input_type -> teleport.okta.v1.ValidateClientCredentialsRequest
+	4,  // 37: teleport.okta.v1.OktaService.CreateIntegration:input_type -> teleport.okta.v1.CreateIntegrationRequest
+	5,  // 38: teleport.okta.v1.OktaService.UpdateIntegration:input_type -> teleport.okta.v1.UpdateIntegrationRequest
+	0,  // 39: teleport.okta.v1.OktaService.GetApps:input_type -> teleport.okta.v1.GetAppsRequest
+	2,  // 40: teleport.okta.v1.OktaService.GetGroups:input_type -> teleport.okta.v1.GetGroupsRequest
+	14, // 41: teleport.okta.v1.OktaService.ListOktaImportRules:output_type -> teleport.okta.v1.ListOktaImportRulesResponse
+	32, // 42: teleport.okta.v1.OktaService.GetOktaImportRule:output_type -> types.OktaImportRuleV1
+	32, // 43: teleport.okta.v1.OktaService.CreateOktaImportRule:output_type -> types.OktaImportRuleV1
+	32, // 44: teleport.okta.v1.OktaService.UpdateOktaImportRule:output_type -> types.OktaImportRuleV1
+	35, // 45: teleport.okta.v1.OktaService.DeleteOktaImportRule:output_type -> google.protobuf.Empty
+	35, // 46: teleport.okta.v1.OktaService.DeleteAllOktaImportRules:output_type -> google.protobuf.Empty
+	21, // 47: teleport.okta.v1.OktaService.ListOktaAssignments:output_type -> teleport.okta.v1.ListOktaAssignmentsResponse
+	33, // 48: teleport.okta.v1.OktaService.GetOktaAssignment:output_type -> types.OktaAssignmentV1
+	33, // 49: teleport.okta.v1.OktaService.CreateOktaAssignment:output_type -> types.OktaAssignmentV1
+	33, // 50: teleport.okta.v1.OktaService.UpdateOktaAssignment:output_type -> types.OktaAssignmentV1
+	35, // 51: teleport.okta.v1.OktaService.UpdateOktaAssignmentStatus:output_type -> google.protobuf.Empty
+	35, // 52: teleport.okta.v1.OktaService.DeleteOktaAssignment:output_type -> google.protobuf.Empty
+	35, // 53: teleport.okta.v1.OktaService.DeleteAllOktaAssignments:output_type -> google.protobuf.Empty
+	12, // 54: teleport.okta.v1.OktaService.ValidateClientCredentials:output_type -> teleport.okta.v1.ValidateClientCredentialsResponse
+	8,  // 55: teleport.okta.v1.OktaService.CreateIntegration:output_type -> teleport.okta.v1.CreateIntegrationResponse
+	9,  // 56: teleport.okta.v1.OktaService.UpdateIntegration:output_type -> teleport.okta.v1.UpdateIntegrationResponse
+	1,  // 57: teleport.okta.v1.OktaService.GetApps:output_type -> teleport.okta.v1.GetAppsResponse
+	3,  // 58: teleport.okta.v1.OktaService.GetGroups:output_type -> teleport.okta.v1.GetGroupsResponse
+	41, // [41:59] is the sub-list for method output_type
+	23, // [23:41] is the sub-list for method input_type
+	23, // [23:23] is the sub-list for extension type_name
+	23, // [23:23] is the sub-list for extension extendee
+	0,  // [0:23] is the sub-list for field type_name
 }
 
 func init() { file_teleport_okta_v1_okta_service_proto_init() }
diff --git a/api/gen/proto/go/teleport/plugins/v1/plugin_service.pb.go b/api/gen/proto/go/teleport/plugins/v1/plugin_service.pb.go
index 733750db186b2..d80f7cb549458 100644
--- a/api/gen/proto/go/teleport/plugins/v1/plugin_service.pb.go
+++ b/api/gen/proto/go/teleport/plugins/v1/plugin_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/plugins/v1/plugin_service.proto
 
@@ -702,6 +702,197 @@ func (x *SearchPluginStaticCredentialsRequest) GetLabels() map[string]string {
 	return nil
 }
 
+// CredentialQuery is a set of values to match when searching for credentials
+type CredentialQuery struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Labels        map[string]string      `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CredentialQuery) Reset() {
+	*x = CredentialQuery{}
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CredentialQuery) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CredentialQuery) ProtoMessage() {}
+
+func (x *CredentialQuery) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CredentialQuery.ProtoReflect.Descriptor instead.
+func (*CredentialQuery) Descriptor() ([]byte, []int) {
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *CredentialQuery) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+// UpdatePluginStaticCredentialsRequest holds information for updating a plugin
+// static credential. The service will attempt to find the credential to update
+// based on the supplied plugin name and labels.
+type UpdatePluginStaticCredentialsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Target:
+	//
+	//	*UpdatePluginStaticCredentialsRequest_Name
+	//	*UpdatePluginStaticCredentialsRequest_Query
+	Target isUpdatePluginStaticCredentialsRequest_Target `protobuf_oneof:"target"`
+	// Credential is the payload containing the updated credential. Only the spec
+	// is allowed to be updated via this interface.
+	Credential    *types.PluginStaticCredentialsSpecV1 `protobuf:"bytes,3,opt,name=credential,proto3" json:"credential,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) Reset() {
+	*x = UpdatePluginStaticCredentialsRequest{}
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePluginStaticCredentialsRequest) ProtoMessage() {}
+
+func (x *UpdatePluginStaticCredentialsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePluginStaticCredentialsRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePluginStaticCredentialsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) GetTarget() isUpdatePluginStaticCredentialsRequest_Target {
+	if x != nil {
+		return x.Target
+	}
+	return nil
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) GetName() string {
+	if x != nil {
+		if x, ok := x.Target.(*UpdatePluginStaticCredentialsRequest_Name); ok {
+			return x.Name
+		}
+	}
+	return ""
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) GetQuery() *CredentialQuery {
+	if x != nil {
+		if x, ok := x.Target.(*UpdatePluginStaticCredentialsRequest_Query); ok {
+			return x.Query
+		}
+	}
+	return nil
+}
+
+func (x *UpdatePluginStaticCredentialsRequest) GetCredential() *types.PluginStaticCredentialsSpecV1 {
+	if x != nil {
+		return x.Credential
+	}
+	return nil
+}
+
+type isUpdatePluginStaticCredentialsRequest_Target interface {
+	isUpdatePluginStaticCredentialsRequest_Target()
+}
+
+type UpdatePluginStaticCredentialsRequest_Name struct {
+	// Name is the name of the plugin static credentials resource that we're
+	// targeting
+	Name string `protobuf:"bytes,1,opt,name=name,proto3,oneof"`
+}
+
+type UpdatePluginStaticCredentialsRequest_Query struct {
+	// Query is the search query that a credential must match in order to be
+	// updated. The update will only proceed if exactly one credential matches
+	// the search query.
+	Query *CredentialQuery `protobuf:"bytes,2,opt,name=query,proto3,oneof"`
+}
+
+func (*UpdatePluginStaticCredentialsRequest_Name) isUpdatePluginStaticCredentialsRequest_Target() {}
+
+func (*UpdatePluginStaticCredentialsRequest_Query) isUpdatePluginStaticCredentialsRequest_Target() {}
+
+// UpdatePluginStaticCredentialsResponse holds the updated credential returned
+// from UpdatePluginStaticCredentials
+type UpdatePluginStaticCredentialsResponse struct {
+	state         protoimpl.MessageState           `protogen:"open.v1"`
+	Credential    *types.PluginStaticCredentialsV1 `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePluginStaticCredentialsResponse) Reset() {
+	*x = UpdatePluginStaticCredentialsResponse{}
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePluginStaticCredentialsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePluginStaticCredentialsResponse) ProtoMessage() {}
+
+func (x *UpdatePluginStaticCredentialsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePluginStaticCredentialsResponse.ProtoReflect.Descriptor instead.
+func (*UpdatePluginStaticCredentialsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *UpdatePluginStaticCredentialsResponse) GetCredential() *types.PluginStaticCredentialsV1 {
+	if x != nil {
+		return x.Credential
+	}
+	return nil
+}
+
 // SearchPluginStaticCredentialsResponse is the response type for
 // SearchPluginStaticCredentials
 type SearchPluginStaticCredentialsResponse struct {
@@ -714,7 +905,7 @@ type SearchPluginStaticCredentialsResponse struct {
 
 func (x *SearchPluginStaticCredentialsResponse) Reset() {
 	*x = SearchPluginStaticCredentialsResponse{}
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[12]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -726,7 +917,7 @@ func (x *SearchPluginStaticCredentialsResponse) String() string {
 func (*SearchPluginStaticCredentialsResponse) ProtoMessage() {}
 
 func (x *SearchPluginStaticCredentialsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[12]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -739,7 +930,7 @@ func (x *SearchPluginStaticCredentialsResponse) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use SearchPluginStaticCredentialsResponse.ProtoReflect.Descriptor instead.
 func (*SearchPluginStaticCredentialsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{12}
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *SearchPluginStaticCredentialsResponse) GetCredentials() []*types.PluginStaticCredentialsV1 {
@@ -762,7 +953,7 @@ type NeedsCleanupRequest struct {
 
 func (x *NeedsCleanupRequest) Reset() {
 	*x = NeedsCleanupRequest{}
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[13]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -774,7 +965,7 @@ func (x *NeedsCleanupRequest) String() string {
 func (*NeedsCleanupRequest) ProtoMessage() {}
 
 func (x *NeedsCleanupRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[13]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -787,7 +978,7 @@ func (x *NeedsCleanupRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NeedsCleanupRequest.ProtoReflect.Descriptor instead.
 func (*NeedsCleanupRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{13}
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *NeedsCleanupRequest) GetType() string {
@@ -812,7 +1003,7 @@ type NeedsCleanupResponse struct {
 
 func (x *NeedsCleanupResponse) Reset() {
 	*x = NeedsCleanupResponse{}
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[14]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -824,7 +1015,7 @@ func (x *NeedsCleanupResponse) String() string {
 func (*NeedsCleanupResponse) ProtoMessage() {}
 
 func (x *NeedsCleanupResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[14]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -837,7 +1028,7 @@ func (x *NeedsCleanupResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NeedsCleanupResponse.ProtoReflect.Descriptor instead.
 func (*NeedsCleanupResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{14}
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *NeedsCleanupResponse) GetNeedsCleanup() bool {
@@ -874,7 +1065,7 @@ type CleanupRequest struct {
 
 func (x *CleanupRequest) Reset() {
 	*x = CleanupRequest{}
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[15]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -886,7 +1077,7 @@ func (x *CleanupRequest) String() string {
 func (*CleanupRequest) ProtoMessage() {}
 
 func (x *CleanupRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[15]
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -899,7 +1090,7 @@ func (x *CleanupRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CleanupRequest.ProtoReflect.Descriptor instead.
 func (*CleanupRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{15}
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *CleanupRequest) GetType() string {
@@ -909,6 +1100,143 @@ func (x *CleanupRequest) GetType() string {
 	return ""
 }
 
+// CreatePluginOauthTokenRequest is the request type for creating an OAuth token for a plugin.
+type CreatePluginOauthTokenRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// plugin_name is the name of the plugin for which the OAuth token is requested.
+	PluginName string `protobuf:"bytes,1,opt,name=plugin_name,json=pluginName,proto3" json:"plugin_name,omitempty"`
+	// client_id is the OAuth client identifier issued to the plugin.
+	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	// client_secret is the secret associated with the client_id.
+	ClientSecret string `protobuf:"bytes,3,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	// grant_type is the OAuth 2.0 grant type being used. Currently, only "client_credentials" is supported.
+	GrantType     string `protobuf:"bytes,4,opt,name=grant_type,json=grantType,proto3" json:"grant_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePluginOauthTokenRequest) Reset() {
+	*x = CreatePluginOauthTokenRequest{}
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePluginOauthTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePluginOauthTokenRequest) ProtoMessage() {}
+
+func (x *CreatePluginOauthTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePluginOauthTokenRequest.ProtoReflect.Descriptor instead.
+func (*CreatePluginOauthTokenRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *CreatePluginOauthTokenRequest) GetPluginName() string {
+	if x != nil {
+		return x.PluginName
+	}
+	return ""
+}
+
+func (x *CreatePluginOauthTokenRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *CreatePluginOauthTokenRequest) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+func (x *CreatePluginOauthTokenRequest) GetGrantType() string {
+	if x != nil {
+		return x.GrantType
+	}
+	return ""
+}
+
+// CreatePluginOauthTokenResponse is the response type for a successful OAuth token creation.
+type CreatePluginOauthTokenResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// access_token is the generated token issued to the plugin.
+	AccessToken string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	// token_type describes the type of the token issued
+	TokenType string `protobuf:"bytes,2,opt,name=token_type,json=tokenType,proto3" json:"token_type,omitempty"`
+	// expires_in is the number of seconds until the token expires.
+	ExpiresIn     int64 `protobuf:"varint,3,opt,name=expires_in,json=expiresIn,proto3" json:"expires_in,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePluginOauthTokenResponse) Reset() {
+	*x = CreatePluginOauthTokenResponse{}
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePluginOauthTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePluginOauthTokenResponse) ProtoMessage() {}
+
+func (x *CreatePluginOauthTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_plugins_v1_plugin_service_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePluginOauthTokenResponse.ProtoReflect.Descriptor instead.
+func (*CreatePluginOauthTokenResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *CreatePluginOauthTokenResponse) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+func (x *CreatePluginOauthTokenResponse) GetTokenType() string {
+	if x != nil {
+		return x.TokenType
+	}
+	return ""
+}
+
+func (x *CreatePluginOauthTokenResponse) GetExpiresIn() int64 {
+	if x != nil {
+		return x.ExpiresIn
+	}
+	return 0
+}
+
 var File_teleport_plugins_v1_plugin_service_proto protoreflect.FileDescriptor
 
 const file_teleport_plugins_v1_plugin_service_proto_rawDesc = "" +
@@ -954,7 +1282,23 @@ const file_teleport_plugins_v1_plugin_service_proto_rawDesc = "" +
 	"\x06labels\x18\x01 \x03(\v2E.teleport.plugins.v1.SearchPluginStaticCredentialsRequest.LabelsEntryR\x06labels\x1a9\n" +
 	"\vLabelsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"k\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x96\x01\n" +
+	"\x0fCredentialQuery\x12H\n" +
+	"\x06labels\x18\x01 \x03(\v20.teleport.plugins.v1.CredentialQuery.LabelsEntryR\x06labels\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xca\x01\n" +
+	"$UpdatePluginStaticCredentialsRequest\x12\x14\n" +
+	"\x04name\x18\x01 \x01(\tH\x00R\x04name\x12<\n" +
+	"\x05query\x18\x02 \x01(\v2$.teleport.plugins.v1.CredentialQueryH\x00R\x05query\x12D\n" +
+	"\n" +
+	"credential\x18\x03 \x01(\v2$.types.PluginStaticCredentialsSpecV1R\n" +
+	"credentialB\b\n" +
+	"\x06target\"i\n" +
+	"%UpdatePluginStaticCredentialsResponse\x12@\n" +
+	"\n" +
+	"credential\x18\x01 \x01(\v2 .types.PluginStaticCredentialsV1R\n" +
+	"credential\"k\n" +
 	"%SearchPluginStaticCredentialsResponse\x12B\n" +
 	"\vcredentials\x18\x01 \x03(\v2 .types.PluginStaticCredentialsV1R\vcredentials\")\n" +
 	"\x13NeedsCleanupRequest\x12\x12\n" +
@@ -964,7 +1308,21 @@ const file_teleport_plugins_v1_plugin_service_proto_rawDesc = "" +
 	"\x14resources_to_cleanup\x18\x02 \x03(\v2\x11.types.ResourceIDR\x12resourcesToCleanup\x12#\n" +
 	"\rplugin_active\x18\x03 \x01(\bR\fpluginActive\"$\n" +
 	"\x0eCleanupRequest\x12\x12\n" +
-	"\x04type\x18\x01 \x01(\tR\x04type2\xac\b\n" +
+	"\x04type\x18\x01 \x01(\tR\x04type\"\xa1\x01\n" +
+	"\x1dCreatePluginOauthTokenRequest\x12\x1f\n" +
+	"\vplugin_name\x18\x01 \x01(\tR\n" +
+	"pluginName\x12\x1b\n" +
+	"\tclient_id\x18\x02 \x01(\tR\bclientId\x12#\n" +
+	"\rclient_secret\x18\x03 \x01(\tR\fclientSecret\x12\x1d\n" +
+	"\n" +
+	"grant_type\x18\x04 \x01(\tR\tgrantType\"\x81\x01\n" +
+	"\x1eCreatePluginOauthTokenResponse\x12!\n" +
+	"\faccess_token\x18\x01 \x01(\tR\vaccessToken\x12\x1d\n" +
+	"\n" +
+	"token_type\x18\x02 \x01(\tR\ttokenType\x12\x1d\n" +
+	"\n" +
+	"expires_in\x18\x03 \x01(\x03R\texpiresIn2\xc9\n" +
+	"\n" +
 	"\rPluginService\x12P\n" +
 	"\fCreatePlugin\x12(.teleport.plugins.v1.CreatePluginRequest\x1a\x16.google.protobuf.Empty\x12C\n" +
 	"\tGetPlugin\x12%.teleport.plugins.v1.GetPluginRequest\x1a\x0f.types.PluginV1\x12I\n" +
@@ -974,9 +1332,11 @@ const file_teleport_plugins_v1_plugin_service_proto_rawDesc = "" +
 	"\x14SetPluginCredentials\x120.teleport.plugins.v1.SetPluginCredentialsRequest\x1a\x16.google.protobuf.Empty\x12V\n" +
 	"\x0fSetPluginStatus\x12+.teleport.plugins.v1.SetPluginStatusRequest\x1a\x16.google.protobuf.Empty\x12\x84\x01\n" +
 	"\x17GetAvailablePluginTypes\x123.teleport.plugins.v1.GetAvailablePluginTypesRequest\x1a4.teleport.plugins.v1.GetAvailablePluginTypesResponse\x12\x96\x01\n" +
-	"\x1dSearchPluginStaticCredentials\x129.teleport.plugins.v1.SearchPluginStaticCredentialsRequest\x1a:.teleport.plugins.v1.SearchPluginStaticCredentialsResponse\x12c\n" +
+	"\x1dSearchPluginStaticCredentials\x129.teleport.plugins.v1.SearchPluginStaticCredentialsRequest\x1a:.teleport.plugins.v1.SearchPluginStaticCredentialsResponse\x12\x96\x01\n" +
+	"\x1dUpdatePluginStaticCredentials\x129.teleport.plugins.v1.UpdatePluginStaticCredentialsRequest\x1a:.teleport.plugins.v1.UpdatePluginStaticCredentialsResponse\x12c\n" +
 	"\fNeedsCleanup\x12(.teleport.plugins.v1.NeedsCleanupRequest\x1a).teleport.plugins.v1.NeedsCleanupResponse\x12F\n" +
-	"\aCleanup\x12#.teleport.plugins.v1.CleanupRequest\x1a\x16.google.protobuf.EmptyBRZPgithub.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1;pluginsv1b\x06proto3"
+	"\aCleanup\x12#.teleport.plugins.v1.CleanupRequest\x1a\x16.google.protobuf.Empty\x12\x81\x01\n" +
+	"\x16CreatePluginOauthToken\x122.teleport.plugins.v1.CreatePluginOauthTokenRequest\x1a3.teleport.plugins.v1.CreatePluginOauthTokenResponseBRZPgithub.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1;pluginsv1b\x06proto3"
 
 var (
 	file_teleport_plugins_v1_plugin_service_proto_rawDescOnce sync.Once
@@ -990,7 +1350,7 @@ func file_teleport_plugins_v1_plugin_service_proto_rawDescGZIP() []byte {
 	return file_teleport_plugins_v1_plugin_service_proto_rawDescData
 }
 
-var file_teleport_plugins_v1_plugin_service_proto_msgTypes = make([]protoimpl.MessageInfo, 18)
+var file_teleport_plugins_v1_plugin_service_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_teleport_plugins_v1_plugin_service_proto_goTypes = []any{
 	(*PluginType)(nil),                            // 0: teleport.plugins.v1.PluginType
 	(*CreatePluginRequest)(nil),                   // 1: teleport.plugins.v1.CreatePluginRequest
@@ -1004,61 +1364,76 @@ var file_teleport_plugins_v1_plugin_service_proto_goTypes = []any{
 	(*GetAvailablePluginTypesRequest)(nil),        // 9: teleport.plugins.v1.GetAvailablePluginTypesRequest
 	(*GetAvailablePluginTypesResponse)(nil),       // 10: teleport.plugins.v1.GetAvailablePluginTypesResponse
 	(*SearchPluginStaticCredentialsRequest)(nil),  // 11: teleport.plugins.v1.SearchPluginStaticCredentialsRequest
-	(*SearchPluginStaticCredentialsResponse)(nil), // 12: teleport.plugins.v1.SearchPluginStaticCredentialsResponse
-	(*NeedsCleanupRequest)(nil),                   // 13: teleport.plugins.v1.NeedsCleanupRequest
-	(*NeedsCleanupResponse)(nil),                  // 14: teleport.plugins.v1.NeedsCleanupResponse
-	(*CleanupRequest)(nil),                        // 15: teleport.plugins.v1.CleanupRequest
-	nil,                                           // 16: teleport.plugins.v1.CreatePluginRequest.CredentialLabelsEntry
-	nil,                                           // 17: teleport.plugins.v1.SearchPluginStaticCredentialsRequest.LabelsEntry
-	(*types.PluginV1)(nil),                        // 18: types.PluginV1
-	(*types.PluginBootstrapCredentialsV1)(nil),    // 19: types.PluginBootstrapCredentialsV1
-	(*types.PluginStaticCredentialsV1)(nil),       // 20: types.PluginStaticCredentialsV1
-	(*types.PluginCredentialsV1)(nil),             // 21: types.PluginCredentialsV1
-	(*types.PluginStatusV1)(nil),                  // 22: types.PluginStatusV1
-	(*types.ResourceID)(nil),                      // 23: types.ResourceID
-	(*emptypb.Empty)(nil),                         // 24: google.protobuf.Empty
+	(*CredentialQuery)(nil),                       // 12: teleport.plugins.v1.CredentialQuery
+	(*UpdatePluginStaticCredentialsRequest)(nil),  // 13: teleport.plugins.v1.UpdatePluginStaticCredentialsRequest
+	(*UpdatePluginStaticCredentialsResponse)(nil), // 14: teleport.plugins.v1.UpdatePluginStaticCredentialsResponse
+	(*SearchPluginStaticCredentialsResponse)(nil), // 15: teleport.plugins.v1.SearchPluginStaticCredentialsResponse
+	(*NeedsCleanupRequest)(nil),                   // 16: teleport.plugins.v1.NeedsCleanupRequest
+	(*NeedsCleanupResponse)(nil),                  // 17: teleport.plugins.v1.NeedsCleanupResponse
+	(*CleanupRequest)(nil),                        // 18: teleport.plugins.v1.CleanupRequest
+	(*CreatePluginOauthTokenRequest)(nil),         // 19: teleport.plugins.v1.CreatePluginOauthTokenRequest
+	(*CreatePluginOauthTokenResponse)(nil),        // 20: teleport.plugins.v1.CreatePluginOauthTokenResponse
+	nil,                                           // 21: teleport.plugins.v1.CreatePluginRequest.CredentialLabelsEntry
+	nil,                                           // 22: teleport.plugins.v1.SearchPluginStaticCredentialsRequest.LabelsEntry
+	nil,                                           // 23: teleport.plugins.v1.CredentialQuery.LabelsEntry
+	(*types.PluginV1)(nil),                        // 24: types.PluginV1
+	(*types.PluginBootstrapCredentialsV1)(nil),    // 25: types.PluginBootstrapCredentialsV1
+	(*types.PluginStaticCredentialsV1)(nil),       // 26: types.PluginStaticCredentialsV1
+	(*types.PluginCredentialsV1)(nil),             // 27: types.PluginCredentialsV1
+	(*types.PluginStatusV1)(nil),                  // 28: types.PluginStatusV1
+	(*types.PluginStaticCredentialsSpecV1)(nil),   // 29: types.PluginStaticCredentialsSpecV1
+	(*types.ResourceID)(nil),                      // 30: types.ResourceID
+	(*emptypb.Empty)(nil),                         // 31: google.protobuf.Empty
 }
 var file_teleport_plugins_v1_plugin_service_proto_depIdxs = []int32{
-	18, // 0: teleport.plugins.v1.CreatePluginRequest.plugin:type_name -> types.PluginV1
-	19, // 1: teleport.plugins.v1.CreatePluginRequest.bootstrap_credentials:type_name -> types.PluginBootstrapCredentialsV1
-	20, // 2: teleport.plugins.v1.CreatePluginRequest.static_credentials:type_name -> types.PluginStaticCredentialsV1
-	20, // 3: teleport.plugins.v1.CreatePluginRequest.static_credentials_list:type_name -> types.PluginStaticCredentialsV1
-	16, // 4: teleport.plugins.v1.CreatePluginRequest.credential_labels:type_name -> teleport.plugins.v1.CreatePluginRequest.CredentialLabelsEntry
-	18, // 5: teleport.plugins.v1.UpdatePluginRequest.plugin:type_name -> types.PluginV1
-	18, // 6: teleport.plugins.v1.ListPluginsResponse.plugins:type_name -> types.PluginV1
-	21, // 7: teleport.plugins.v1.SetPluginCredentialsRequest.credentials:type_name -> types.PluginCredentialsV1
-	22, // 8: teleport.plugins.v1.SetPluginStatusRequest.status:type_name -> types.PluginStatusV1
+	24, // 0: teleport.plugins.v1.CreatePluginRequest.plugin:type_name -> types.PluginV1
+	25, // 1: teleport.plugins.v1.CreatePluginRequest.bootstrap_credentials:type_name -> types.PluginBootstrapCredentialsV1
+	26, // 2: teleport.plugins.v1.CreatePluginRequest.static_credentials:type_name -> types.PluginStaticCredentialsV1
+	26, // 3: teleport.plugins.v1.CreatePluginRequest.static_credentials_list:type_name -> types.PluginStaticCredentialsV1
+	21, // 4: teleport.plugins.v1.CreatePluginRequest.credential_labels:type_name -> teleport.plugins.v1.CreatePluginRequest.CredentialLabelsEntry
+	24, // 5: teleport.plugins.v1.UpdatePluginRequest.plugin:type_name -> types.PluginV1
+	24, // 6: teleport.plugins.v1.ListPluginsResponse.plugins:type_name -> types.PluginV1
+	27, // 7: teleport.plugins.v1.SetPluginCredentialsRequest.credentials:type_name -> types.PluginCredentialsV1
+	28, // 8: teleport.plugins.v1.SetPluginStatusRequest.status:type_name -> types.PluginStatusV1
 	0,  // 9: teleport.plugins.v1.GetAvailablePluginTypesResponse.plugin_types:type_name -> teleport.plugins.v1.PluginType
-	17, // 10: teleport.plugins.v1.SearchPluginStaticCredentialsRequest.labels:type_name -> teleport.plugins.v1.SearchPluginStaticCredentialsRequest.LabelsEntry
-	20, // 11: teleport.plugins.v1.SearchPluginStaticCredentialsResponse.credentials:type_name -> types.PluginStaticCredentialsV1
-	23, // 12: teleport.plugins.v1.NeedsCleanupResponse.resources_to_cleanup:type_name -> types.ResourceID
-	1,  // 13: teleport.plugins.v1.PluginService.CreatePlugin:input_type -> teleport.plugins.v1.CreatePluginRequest
-	2,  // 14: teleport.plugins.v1.PluginService.GetPlugin:input_type -> teleport.plugins.v1.GetPluginRequest
-	3,  // 15: teleport.plugins.v1.PluginService.UpdatePlugin:input_type -> teleport.plugins.v1.UpdatePluginRequest
-	6,  // 16: teleport.plugins.v1.PluginService.DeletePlugin:input_type -> teleport.plugins.v1.DeletePluginRequest
-	4,  // 17: teleport.plugins.v1.PluginService.ListPlugins:input_type -> teleport.plugins.v1.ListPluginsRequest
-	7,  // 18: teleport.plugins.v1.PluginService.SetPluginCredentials:input_type -> teleport.plugins.v1.SetPluginCredentialsRequest
-	8,  // 19: teleport.plugins.v1.PluginService.SetPluginStatus:input_type -> teleport.plugins.v1.SetPluginStatusRequest
-	9,  // 20: teleport.plugins.v1.PluginService.GetAvailablePluginTypes:input_type -> teleport.plugins.v1.GetAvailablePluginTypesRequest
-	11, // 21: teleport.plugins.v1.PluginService.SearchPluginStaticCredentials:input_type -> teleport.plugins.v1.SearchPluginStaticCredentialsRequest
-	13, // 22: teleport.plugins.v1.PluginService.NeedsCleanup:input_type -> teleport.plugins.v1.NeedsCleanupRequest
-	15, // 23: teleport.plugins.v1.PluginService.Cleanup:input_type -> teleport.plugins.v1.CleanupRequest
-	24, // 24: teleport.plugins.v1.PluginService.CreatePlugin:output_type -> google.protobuf.Empty
-	18, // 25: teleport.plugins.v1.PluginService.GetPlugin:output_type -> types.PluginV1
-	18, // 26: teleport.plugins.v1.PluginService.UpdatePlugin:output_type -> types.PluginV1
-	24, // 27: teleport.plugins.v1.PluginService.DeletePlugin:output_type -> google.protobuf.Empty
-	5,  // 28: teleport.plugins.v1.PluginService.ListPlugins:output_type -> teleport.plugins.v1.ListPluginsResponse
-	24, // 29: teleport.plugins.v1.PluginService.SetPluginCredentials:output_type -> google.protobuf.Empty
-	24, // 30: teleport.plugins.v1.PluginService.SetPluginStatus:output_type -> google.protobuf.Empty
-	10, // 31: teleport.plugins.v1.PluginService.GetAvailablePluginTypes:output_type -> teleport.plugins.v1.GetAvailablePluginTypesResponse
-	12, // 32: teleport.plugins.v1.PluginService.SearchPluginStaticCredentials:output_type -> teleport.plugins.v1.SearchPluginStaticCredentialsResponse
-	14, // 33: teleport.plugins.v1.PluginService.NeedsCleanup:output_type -> teleport.plugins.v1.NeedsCleanupResponse
-	24, // 34: teleport.plugins.v1.PluginService.Cleanup:output_type -> google.protobuf.Empty
-	24, // [24:35] is the sub-list for method output_type
-	13, // [13:24] is the sub-list for method input_type
-	13, // [13:13] is the sub-list for extension type_name
-	13, // [13:13] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	22, // 10: teleport.plugins.v1.SearchPluginStaticCredentialsRequest.labels:type_name -> teleport.plugins.v1.SearchPluginStaticCredentialsRequest.LabelsEntry
+	23, // 11: teleport.plugins.v1.CredentialQuery.labels:type_name -> teleport.plugins.v1.CredentialQuery.LabelsEntry
+	12, // 12: teleport.plugins.v1.UpdatePluginStaticCredentialsRequest.query:type_name -> teleport.plugins.v1.CredentialQuery
+	29, // 13: teleport.plugins.v1.UpdatePluginStaticCredentialsRequest.credential:type_name -> types.PluginStaticCredentialsSpecV1
+	26, // 14: teleport.plugins.v1.UpdatePluginStaticCredentialsResponse.credential:type_name -> types.PluginStaticCredentialsV1
+	26, // 15: teleport.plugins.v1.SearchPluginStaticCredentialsResponse.credentials:type_name -> types.PluginStaticCredentialsV1
+	30, // 16: teleport.plugins.v1.NeedsCleanupResponse.resources_to_cleanup:type_name -> types.ResourceID
+	1,  // 17: teleport.plugins.v1.PluginService.CreatePlugin:input_type -> teleport.plugins.v1.CreatePluginRequest
+	2,  // 18: teleport.plugins.v1.PluginService.GetPlugin:input_type -> teleport.plugins.v1.GetPluginRequest
+	3,  // 19: teleport.plugins.v1.PluginService.UpdatePlugin:input_type -> teleport.plugins.v1.UpdatePluginRequest
+	6,  // 20: teleport.plugins.v1.PluginService.DeletePlugin:input_type -> teleport.plugins.v1.DeletePluginRequest
+	4,  // 21: teleport.plugins.v1.PluginService.ListPlugins:input_type -> teleport.plugins.v1.ListPluginsRequest
+	7,  // 22: teleport.plugins.v1.PluginService.SetPluginCredentials:input_type -> teleport.plugins.v1.SetPluginCredentialsRequest
+	8,  // 23: teleport.plugins.v1.PluginService.SetPluginStatus:input_type -> teleport.plugins.v1.SetPluginStatusRequest
+	9,  // 24: teleport.plugins.v1.PluginService.GetAvailablePluginTypes:input_type -> teleport.plugins.v1.GetAvailablePluginTypesRequest
+	11, // 25: teleport.plugins.v1.PluginService.SearchPluginStaticCredentials:input_type -> teleport.plugins.v1.SearchPluginStaticCredentialsRequest
+	13, // 26: teleport.plugins.v1.PluginService.UpdatePluginStaticCredentials:input_type -> teleport.plugins.v1.UpdatePluginStaticCredentialsRequest
+	16, // 27: teleport.plugins.v1.PluginService.NeedsCleanup:input_type -> teleport.plugins.v1.NeedsCleanupRequest
+	18, // 28: teleport.plugins.v1.PluginService.Cleanup:input_type -> teleport.plugins.v1.CleanupRequest
+	19, // 29: teleport.plugins.v1.PluginService.CreatePluginOauthToken:input_type -> teleport.plugins.v1.CreatePluginOauthTokenRequest
+	31, // 30: teleport.plugins.v1.PluginService.CreatePlugin:output_type -> google.protobuf.Empty
+	24, // 31: teleport.plugins.v1.PluginService.GetPlugin:output_type -> types.PluginV1
+	24, // 32: teleport.plugins.v1.PluginService.UpdatePlugin:output_type -> types.PluginV1
+	31, // 33: teleport.plugins.v1.PluginService.DeletePlugin:output_type -> google.protobuf.Empty
+	5,  // 34: teleport.plugins.v1.PluginService.ListPlugins:output_type -> teleport.plugins.v1.ListPluginsResponse
+	31, // 35: teleport.plugins.v1.PluginService.SetPluginCredentials:output_type -> google.protobuf.Empty
+	31, // 36: teleport.plugins.v1.PluginService.SetPluginStatus:output_type -> google.protobuf.Empty
+	10, // 37: teleport.plugins.v1.PluginService.GetAvailablePluginTypes:output_type -> teleport.plugins.v1.GetAvailablePluginTypesResponse
+	15, // 38: teleport.plugins.v1.PluginService.SearchPluginStaticCredentials:output_type -> teleport.plugins.v1.SearchPluginStaticCredentialsResponse
+	14, // 39: teleport.plugins.v1.PluginService.UpdatePluginStaticCredentials:output_type -> teleport.plugins.v1.UpdatePluginStaticCredentialsResponse
+	17, // 40: teleport.plugins.v1.PluginService.NeedsCleanup:output_type -> teleport.plugins.v1.NeedsCleanupResponse
+	31, // 41: teleport.plugins.v1.PluginService.Cleanup:output_type -> google.protobuf.Empty
+	20, // 42: teleport.plugins.v1.PluginService.CreatePluginOauthToken:output_type -> teleport.plugins.v1.CreatePluginOauthTokenResponse
+	30, // [30:43] is the sub-list for method output_type
+	17, // [17:30] is the sub-list for method input_type
+	17, // [17:17] is the sub-list for extension type_name
+	17, // [17:17] is the sub-list for extension extendee
+	0,  // [0:17] is the sub-list for field type_name
 }
 
 func init() { file_teleport_plugins_v1_plugin_service_proto_init() }
@@ -1066,13 +1441,17 @@ func file_teleport_plugins_v1_plugin_service_proto_init() {
 	if File_teleport_plugins_v1_plugin_service_proto != nil {
 		return
 	}
+	file_teleport_plugins_v1_plugin_service_proto_msgTypes[13].OneofWrappers = []any{
+		(*UpdatePluginStaticCredentialsRequest_Name)(nil),
+		(*UpdatePluginStaticCredentialsRequest_Query)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_plugins_v1_plugin_service_proto_rawDesc), len(file_teleport_plugins_v1_plugin_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   18,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go b/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
index 1af0d3e7dfcc7..e31865eab4afa 100644
--- a/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
@@ -44,8 +44,10 @@ const (
 	PluginService_SetPluginStatus_FullMethodName               = "/teleport.plugins.v1.PluginService/SetPluginStatus"
 	PluginService_GetAvailablePluginTypes_FullMethodName       = "/teleport.plugins.v1.PluginService/GetAvailablePluginTypes"
 	PluginService_SearchPluginStaticCredentials_FullMethodName = "/teleport.plugins.v1.PluginService/SearchPluginStaticCredentials"
+	PluginService_UpdatePluginStaticCredentials_FullMethodName = "/teleport.plugins.v1.PluginService/UpdatePluginStaticCredentials"
 	PluginService_NeedsCleanup_FullMethodName                  = "/teleport.plugins.v1.PluginService/NeedsCleanup"
 	PluginService_Cleanup_FullMethodName                       = "/teleport.plugins.v1.PluginService/Cleanup"
+	PluginService_CreatePluginOauthToken_FullMethodName        = "/teleport.plugins.v1.PluginService/CreatePluginOauthToken"
 )
 
 // PluginServiceClient is the client API for PluginService service.
@@ -75,11 +77,18 @@ type PluginServiceClient interface {
 	// for. Only accessible by RoleAdmin and, in the case of Teleport Assist,
 	// RoleProxy.
 	SearchPluginStaticCredentials(ctx context.Context, in *SearchPluginStaticCredentialsRequest, opts ...grpc.CallOption) (*SearchPluginStaticCredentialsResponse, error)
+	// UpdatePluginStaticCredentials
+	UpdatePluginStaticCredentials(ctx context.Context, in *UpdatePluginStaticCredentialsRequest, opts ...grpc.CallOption) (*UpdatePluginStaticCredentialsResponse, error)
 	// NeedsCleanup will indicate whether a plugin of the given type needs cleanup
 	// before it can be created.
 	NeedsCleanup(ctx context.Context, in *NeedsCleanupRequest, opts ...grpc.CallOption) (*NeedsCleanupResponse, error)
 	// Cleanup will clean up the resources for the given plugin type.
 	Cleanup(ctx context.Context, in *CleanupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// CreatePluginOauthToken issues a short-lived OAuth access token for the specified plugin.
+	//
+	// This endpoint supports the OAuth 2.0 "client_credentials" grant type, where the plugin
+	// authenticates using its client ID and client secret
+	CreatePluginOauthToken(ctx context.Context, in *CreatePluginOauthTokenRequest, opts ...grpc.CallOption) (*CreatePluginOauthTokenResponse, error)
 }
 
 type pluginServiceClient struct {
@@ -180,6 +189,16 @@ func (c *pluginServiceClient) SearchPluginStaticCredentials(ctx context.Context,
 	return out, nil
 }
 
+func (c *pluginServiceClient) UpdatePluginStaticCredentials(ctx context.Context, in *UpdatePluginStaticCredentialsRequest, opts ...grpc.CallOption) (*UpdatePluginStaticCredentialsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdatePluginStaticCredentialsResponse)
+	err := c.cc.Invoke(ctx, PluginService_UpdatePluginStaticCredentials_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *pluginServiceClient) NeedsCleanup(ctx context.Context, in *NeedsCleanupRequest, opts ...grpc.CallOption) (*NeedsCleanupResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NeedsCleanupResponse)
@@ -200,6 +219,16 @@ func (c *pluginServiceClient) Cleanup(ctx context.Context, in *CleanupRequest, o
 	return out, nil
 }
 
+func (c *pluginServiceClient) CreatePluginOauthToken(ctx context.Context, in *CreatePluginOauthTokenRequest, opts ...grpc.CallOption) (*CreatePluginOauthTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreatePluginOauthTokenResponse)
+	err := c.cc.Invoke(ctx, PluginService_CreatePluginOauthToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // PluginServiceServer is the server API for PluginService service.
 // All implementations must embed UnimplementedPluginServiceServer
 // for forward compatibility.
@@ -227,11 +256,18 @@ type PluginServiceServer interface {
 	// for. Only accessible by RoleAdmin and, in the case of Teleport Assist,
 	// RoleProxy.
 	SearchPluginStaticCredentials(context.Context, *SearchPluginStaticCredentialsRequest) (*SearchPluginStaticCredentialsResponse, error)
+	// UpdatePluginStaticCredentials
+	UpdatePluginStaticCredentials(context.Context, *UpdatePluginStaticCredentialsRequest) (*UpdatePluginStaticCredentialsResponse, error)
 	// NeedsCleanup will indicate whether a plugin of the given type needs cleanup
 	// before it can be created.
 	NeedsCleanup(context.Context, *NeedsCleanupRequest) (*NeedsCleanupResponse, error)
 	// Cleanup will clean up the resources for the given plugin type.
 	Cleanup(context.Context, *CleanupRequest) (*emptypb.Empty, error)
+	// CreatePluginOauthToken issues a short-lived OAuth access token for the specified plugin.
+	//
+	// This endpoint supports the OAuth 2.0 "client_credentials" grant type, where the plugin
+	// authenticates using its client ID and client secret
+	CreatePluginOauthToken(context.Context, *CreatePluginOauthTokenRequest) (*CreatePluginOauthTokenResponse, error)
 	mustEmbedUnimplementedPluginServiceServer()
 }
 
@@ -269,12 +305,18 @@ func (UnimplementedPluginServiceServer) GetAvailablePluginTypes(context.Context,
 func (UnimplementedPluginServiceServer) SearchPluginStaticCredentials(context.Context, *SearchPluginStaticCredentialsRequest) (*SearchPluginStaticCredentialsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SearchPluginStaticCredentials not implemented")
 }
+func (UnimplementedPluginServiceServer) UpdatePluginStaticCredentials(context.Context, *UpdatePluginStaticCredentialsRequest) (*UpdatePluginStaticCredentialsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdatePluginStaticCredentials not implemented")
+}
 func (UnimplementedPluginServiceServer) NeedsCleanup(context.Context, *NeedsCleanupRequest) (*NeedsCleanupResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method NeedsCleanup not implemented")
 }
 func (UnimplementedPluginServiceServer) Cleanup(context.Context, *CleanupRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Cleanup not implemented")
 }
+func (UnimplementedPluginServiceServer) CreatePluginOauthToken(context.Context, *CreatePluginOauthTokenRequest) (*CreatePluginOauthTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreatePluginOauthToken not implemented")
+}
 func (UnimplementedPluginServiceServer) mustEmbedUnimplementedPluginServiceServer() {}
 func (UnimplementedPluginServiceServer) testEmbeddedByValue()                       {}
 
@@ -458,6 +500,24 @@ func _PluginService_SearchPluginStaticCredentials_Handler(srv interface{}, ctx c
 	return interceptor(ctx, in, info, handler)
 }
 
+func _PluginService_UpdatePluginStaticCredentials_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdatePluginStaticCredentialsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PluginServiceServer).UpdatePluginStaticCredentials(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PluginService_UpdatePluginStaticCredentials_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PluginServiceServer).UpdatePluginStaticCredentials(ctx, req.(*UpdatePluginStaticCredentialsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _PluginService_NeedsCleanup_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(NeedsCleanupRequest)
 	if err := dec(in); err != nil {
@@ -494,6 +554,24 @@ func _PluginService_Cleanup_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _PluginService_CreatePluginOauthToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreatePluginOauthTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PluginServiceServer).CreatePluginOauthToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PluginService_CreatePluginOauthToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PluginServiceServer).CreatePluginOauthToken(ctx, req.(*CreatePluginOauthTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // PluginService_ServiceDesc is the grpc.ServiceDesc for PluginService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -537,6 +615,10 @@ var PluginService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "SearchPluginStaticCredentials",
 			Handler:    _PluginService_SearchPluginStaticCredentials_Handler,
 		},
+		{
+			MethodName: "UpdatePluginStaticCredentials",
+			Handler:    _PluginService_UpdatePluginStaticCredentials_Handler,
+		},
 		{
 			MethodName: "NeedsCleanup",
 			Handler:    _PluginService_NeedsCleanup_Handler,
@@ -545,6 +627,10 @@ var PluginService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Cleanup",
 			Handler:    _PluginService_Cleanup_Handler,
 		},
+		{
+			MethodName: "CreatePluginOauthToken",
+			Handler:    _PluginService_CreatePluginOauthToken_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/plugins/v1/plugin_service.proto",
diff --git a/api/gen/proto/go/teleport/presence/v1/relay_server.pb.go b/api/gen/proto/go/teleport/presence/v1/relay_server.pb.go
new file mode 100644
index 0000000000000..fc8c37877d8a4
--- /dev/null
+++ b/api/gen/proto/go/teleport/presence/v1/relay_server.pb.go
@@ -0,0 +1,297 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/presence/v1/relay_server.proto
+
+package presencev1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// A heartbeat for a relay service; this message serves as both the type used in
+// the v1 service and as the canonical v1 storage format (in protojson).
+type RelayServer struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// fixed string, "relay_server".
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// fixed string, "".
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// fixed string, "v1".
+	Version  string            `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata *v1.Metadata      `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec     *RelayServer_Spec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	// The advertized scope of the server. A server's scope can not change once assigned, so
+	// heartbeats must include a scope value matching the one declared in the hello message.
+	Scope         string `protobuf:"bytes,6,opt,name=scope,proto3" json:"scope,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RelayServer) Reset() {
+	*x = RelayServer{}
+	mi := &file_teleport_presence_v1_relay_server_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RelayServer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RelayServer) ProtoMessage() {}
+
+func (x *RelayServer) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_relay_server_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RelayServer.ProtoReflect.Descriptor instead.
+func (*RelayServer) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_relay_server_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RelayServer) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *RelayServer) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *RelayServer) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *RelayServer) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *RelayServer) GetSpec() *RelayServer_Spec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *RelayServer) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+// resource spec
+type RelayServer_Spec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// host IDs of Proxy Service instances that this server is available on
+	// through a reverse tunnel
+	ProxyIds []string `protobuf:"bytes,1,rep,name=proxy_ids,json=proxyIds,proto3" json:"proxy_ids,omitempty"`
+	// configured hostname (or nodename) of the machine, for troubleshooting and
+	// debugging
+	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// the name of the Relay group this server belongs to
+	RelayGroup string `protobuf:"bytes,3,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// address and port that this server is reachable at by other Relay Service
+	// instance of the same group
+	PeerAddr string `protobuf:"bytes,4,opt,name=peer_addr,json=peerAddr,proto3" json:"peer_addr,omitempty"`
+	// random string chosen for the duration of the process, for troubleshooting
+	// and debugging
+	Nonce string `protobuf:"bytes,5,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// set after the Teleport instance has received a termination signal (but
+	// hasn't necessarily began shutting down)
+	Terminating   bool `protobuf:"varint,6,opt,name=terminating,proto3" json:"terminating,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RelayServer_Spec) Reset() {
+	*x = RelayServer_Spec{}
+	mi := &file_teleport_presence_v1_relay_server_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RelayServer_Spec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RelayServer_Spec) ProtoMessage() {}
+
+func (x *RelayServer_Spec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_relay_server_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RelayServer_Spec.ProtoReflect.Descriptor instead.
+func (*RelayServer_Spec) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_relay_server_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *RelayServer_Spec) GetProxyIds() []string {
+	if x != nil {
+		return x.ProxyIds
+	}
+	return nil
+}
+
+func (x *RelayServer_Spec) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *RelayServer_Spec) GetRelayGroup() string {
+	if x != nil {
+		return x.RelayGroup
+	}
+	return ""
+}
+
+func (x *RelayServer_Spec) GetPeerAddr() string {
+	if x != nil {
+		return x.PeerAddr
+	}
+	return ""
+}
+
+func (x *RelayServer_Spec) GetNonce() string {
+	if x != nil {
+		return x.Nonce
+	}
+	return ""
+}
+
+func (x *RelayServer_Spec) GetTerminating() bool {
+	if x != nil {
+		return x.Terminating
+	}
+	return false
+}
+
+var File_teleport_presence_v1_relay_server_proto protoreflect.FileDescriptor
+
+const file_teleport_presence_v1_relay_server_proto_rawDesc = "" +
+	"\n" +
+	"'teleport/presence/v1/relay_server.proto\x12\x14teleport.presence.v1\x1a!teleport/header/v1/metadata.proto\"\x9a\x03\n" +
+	"\vRelayServer\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12:\n" +
+	"\x04spec\x18\x05 \x01(\v2&.teleport.presence.v1.RelayServer.SpecR\x04spec\x12\x14\n" +
+	"\x05scope\x18\x06 \x01(\tR\x05scope\x1a\xb5\x01\n" +
+	"\x04Spec\x12\x1b\n" +
+	"\tproxy_ids\x18\x01 \x03(\tR\bproxyIds\x12\x1a\n" +
+	"\bhostname\x18\x02 \x01(\tR\bhostname\x12\x1f\n" +
+	"\vrelay_group\x18\x03 \x01(\tR\n" +
+	"relayGroup\x12\x1b\n" +
+	"\tpeer_addr\x18\x04 \x01(\tR\bpeerAddr\x12\x14\n" +
+	"\x05nonce\x18\x05 \x01(\tR\x05nonce\x12 \n" +
+	"\vterminating\x18\x06 \x01(\bR\vterminatingBTZRgithub.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1;presencev1b\x06proto3"
+
+var (
+	file_teleport_presence_v1_relay_server_proto_rawDescOnce sync.Once
+	file_teleport_presence_v1_relay_server_proto_rawDescData []byte
+)
+
+func file_teleport_presence_v1_relay_server_proto_rawDescGZIP() []byte {
+	file_teleport_presence_v1_relay_server_proto_rawDescOnce.Do(func() {
+		file_teleport_presence_v1_relay_server_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_presence_v1_relay_server_proto_rawDesc), len(file_teleport_presence_v1_relay_server_proto_rawDesc)))
+	})
+	return file_teleport_presence_v1_relay_server_proto_rawDescData
+}
+
+var file_teleport_presence_v1_relay_server_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_presence_v1_relay_server_proto_goTypes = []any{
+	(*RelayServer)(nil),      // 0: teleport.presence.v1.RelayServer
+	(*RelayServer_Spec)(nil), // 1: teleport.presence.v1.RelayServer.Spec
+	(*v1.Metadata)(nil),      // 2: teleport.header.v1.Metadata
+}
+var file_teleport_presence_v1_relay_server_proto_depIdxs = []int32{
+	2, // 0: teleport.presence.v1.RelayServer.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.presence.v1.RelayServer.spec:type_name -> teleport.presence.v1.RelayServer.Spec
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_presence_v1_relay_server_proto_init() }
+func file_teleport_presence_v1_relay_server_proto_init() {
+	if File_teleport_presence_v1_relay_server_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_presence_v1_relay_server_proto_rawDesc), len(file_teleport_presence_v1_relay_server_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_presence_v1_relay_server_proto_goTypes,
+		DependencyIndexes: file_teleport_presence_v1_relay_server_proto_depIdxs,
+		MessageInfos:      file_teleport_presence_v1_relay_server_proto_msgTypes,
+	}.Build()
+	File_teleport_presence_v1_relay_server_proto = out.File
+	file_teleport_presence_v1_relay_server_proto_goTypes = nil
+	file_teleport_presence_v1_relay_server_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/presence/v1/service.pb.go b/api/gen/proto/go/teleport/presence/v1/service.pb.go
index 0bf6e894f5374..2cef7822e3061 100644
--- a/api/gen/proto/go/teleport/presence/v1/service.pb.go
+++ b/api/gen/proto/go/teleport/presence/v1/service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/presence/v1/service.proto
 
@@ -504,11 +504,519 @@ func (x *DeleteReverseTunnelRequest) GetName() string {
 	return ""
 }
 
+// Request message for the PresenceService.GetRelayServer rpc.
+type GetRelayServerRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRelayServerRequest) Reset() {
+	*x = GetRelayServerRequest{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRelayServerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRelayServerRequest) ProtoMessage() {}
+
+func (x *GetRelayServerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRelayServerRequest.ProtoReflect.Descriptor instead.
+func (*GetRelayServerRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *GetRelayServerRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// Response message for the PresenceService.GetRelayServer rpc.
+type GetRelayServerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RelayServer   *RelayServer           `protobuf:"bytes,1,opt,name=relay_server,json=relayServer,proto3" json:"relay_server,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRelayServerResponse) Reset() {
+	*x = GetRelayServerResponse{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRelayServerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRelayServerResponse) ProtoMessage() {}
+
+func (x *GetRelayServerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRelayServerResponse.ProtoReflect.Descriptor instead.
+func (*GetRelayServerResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *GetRelayServerResponse) GetRelayServer() *RelayServer {
+	if x != nil {
+		return x.RelayServer
+	}
+	return nil
+}
+
+// Request message for the PresenceService.ListRelayServers rpc.
+type ListRelayServersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return. The service may return fewer than
+	// this value. If unspecified, the service will use a sensible default.
+	PageSize int64 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// A pagination token returned from a previous request. If empty, the request
+	// will return the first page.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRelayServersRequest) Reset() {
+	*x = ListRelayServersRequest{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRelayServersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRelayServersRequest) ProtoMessage() {}
+
+func (x *ListRelayServersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRelayServersRequest.ProtoReflect.Descriptor instead.
+func (*ListRelayServersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ListRelayServersRequest) GetPageSize() int64 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListRelayServersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// Response message for the PresenceService.ListRelayServers rpc.
+type ListRelayServersResponse struct {
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Relays []*RelayServer         `protobuf:"bytes,1,rep,name=relays,proto3" json:"relays,omitempty"`
+	// A token that can be sent as the page_token to retrieve the next page. If
+	// this field is empty, there are no more pages.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRelayServersResponse) Reset() {
+	*x = ListRelayServersResponse{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRelayServersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRelayServersResponse) ProtoMessage() {}
+
+func (x *ListRelayServersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRelayServersResponse.ProtoReflect.Descriptor instead.
+func (*ListRelayServersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *ListRelayServersResponse) GetRelays() []*RelayServer {
+	if x != nil {
+		return x.Relays
+	}
+	return nil
+}
+
+func (x *ListRelayServersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// Request message for the PresenceService.DeleteRelayServer rpc.
+type DeleteRelayServerRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRelayServerRequest) Reset() {
+	*x = DeleteRelayServerRequest{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRelayServerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRelayServerRequest) ProtoMessage() {}
+
+func (x *DeleteRelayServerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRelayServerRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRelayServerRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *DeleteRelayServerRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// Response message for the PresenceService.DeleteRelayServer rpc.
+type DeleteRelayServerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRelayServerResponse) Reset() {
+	*x = DeleteRelayServerResponse{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRelayServerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRelayServerResponse) ProtoMessage() {}
+
+func (x *DeleteRelayServerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRelayServerResponse.ProtoReflect.Descriptor instead.
+func (*DeleteRelayServerResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{14}
+}
+
+// Request message for the PresenceService.ListAuthServers rpc.
+type ListAuthServersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuthServersRequest) Reset() {
+	*x = ListAuthServersRequest{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuthServersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthServersRequest) ProtoMessage() {}
+
+func (x *ListAuthServersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthServersRequest.ProtoReflect.Descriptor instead.
+func (*ListAuthServersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *ListAuthServersRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListAuthServersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// Response message for the PresenceService.ListAuthServers rpc.
+type ListAuthServersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A list of auth server resources.
+	Servers []*types.ServerV2 `protobuf:"bytes,1,rep,name=servers,proto3" json:"servers,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuthServersResponse) Reset() {
+	*x = ListAuthServersResponse{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuthServersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthServersResponse) ProtoMessage() {}
+
+func (x *ListAuthServersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthServersResponse.ProtoReflect.Descriptor instead.
+func (*ListAuthServersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *ListAuthServersResponse) GetServers() []*types.ServerV2 {
+	if x != nil {
+		return x.Servers
+	}
+	return nil
+}
+
+func (x *ListAuthServersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// Request message for the PresenceService.ListProxyServers rpc.
+type ListProxyServersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListProxyServersRequest) Reset() {
+	*x = ListProxyServersRequest{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListProxyServersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListProxyServersRequest) ProtoMessage() {}
+
+func (x *ListProxyServersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListProxyServersRequest.ProtoReflect.Descriptor instead.
+func (*ListProxyServersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *ListProxyServersRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListProxyServersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// Response message for the PresenceService.ListProxyServers rpc.
+type ListProxyServersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A list of proxy server resources.
+	Servers []*types.ServerV2 `protobuf:"bytes,1,rep,name=servers,proto3" json:"servers,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListProxyServersResponse) Reset() {
+	*x = ListProxyServersResponse{}
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListProxyServersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListProxyServersResponse) ProtoMessage() {}
+
+func (x *ListProxyServersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_presence_v1_service_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListProxyServersResponse.ProtoReflect.Descriptor instead.
+func (*ListProxyServersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_presence_v1_service_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *ListProxyServersResponse) GetServers() []*types.ServerV2 {
+	if x != nil {
+		return x.Servers
+	}
+	return nil
+}
+
+func (x *ListProxyServersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 var File_teleport_presence_v1_service_proto protoreflect.FileDescriptor
 
 const file_teleport_presence_v1_service_proto_rawDesc = "" +
 	"\n" +
-	"\"teleport/presence/v1/service.proto\x12\x14teleport.presence.v1\x1a\x1bgoogle/protobuf/empty.proto\x1a google/protobuf/field_mask.proto\x1a!teleport/legacy/types/types.proto\"-\n" +
+	"\"teleport/presence/v1/service.proto\x12\x14teleport.presence.v1\x1a\x1bgoogle/protobuf/empty.proto\x1a google/protobuf/field_mask.proto\x1a!teleport/legacy/types/types.proto\x1a'teleport/presence/v1/relay_server.proto\"-\n" +
 	"\x17GetRemoteClusterRequest\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\"W\n" +
 	"\x19ListRemoteClustersRequest\x12\x1b\n" +
@@ -534,7 +1042,36 @@ const file_teleport_presence_v1_service_proto_rawDesc = "" +
 	"\x1aUpsertReverseTunnelRequest\x12=\n" +
 	"\x0ereverse_tunnel\x18\x01 \x01(\v2\x16.types.ReverseTunnelV2R\rreverseTunnel\"0\n" +
 	"\x1aDeleteReverseTunnelRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name2\xe2\x05\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"+\n" +
+	"\x15GetRelayServerRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"^\n" +
+	"\x16GetRelayServerResponse\x12D\n" +
+	"\frelay_server\x18\x01 \x01(\v2!.teleport.presence.v1.RelayServerR\vrelayServer\"U\n" +
+	"\x17ListRelayServersRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x03R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"}\n" +
+	"\x18ListRelayServersResponse\x129\n" +
+	"\x06relays\x18\x01 \x03(\v2!.teleport.presence.v1.RelayServerR\x06relays\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\".\n" +
+	"\x18DeleteRelayServerRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1b\n" +
+	"\x19DeleteRelayServerResponse\"T\n" +
+	"\x16ListAuthServersRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"l\n" +
+	"\x17ListAuthServersResponse\x12)\n" +
+	"\aservers\x18\x01 \x03(\v2\x0f.types.ServerV2R\aservers\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"U\n" +
+	"\x17ListProxyServersRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"m\n" +
+	"\x18ListProxyServersResponse\x12)\n" +
+	"\aservers\x18\x01 \x03(\v2\x0f.types.ServerV2R\aservers\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\x9b\n" +
+	"\n" +
 	"\x0fPresenceService\x12Y\n" +
 	"\x10GetRemoteCluster\x12-.teleport.presence.v1.GetRemoteClusterRequest\x1a\x16.types.RemoteClusterV3\x12w\n" +
 	"\x12ListRemoteClusters\x12/.teleport.presence.v1.ListRemoteClustersRequest\x1a0.teleport.presence.v1.ListRemoteClustersResponse\x12_\n" +
@@ -542,7 +1079,12 @@ const file_teleport_presence_v1_service_proto_rawDesc = "" +
 	"\x13DeleteRemoteCluster\x120.teleport.presence.v1.DeleteRemoteClusterRequest\x1a\x16.google.protobuf.Empty\x12w\n" +
 	"\x12ListReverseTunnels\x12/.teleport.presence.v1.ListReverseTunnelsRequest\x1a0.teleport.presence.v1.ListReverseTunnelsResponse\x12_\n" +
 	"\x13UpsertReverseTunnel\x120.teleport.presence.v1.UpsertReverseTunnelRequest\x1a\x16.types.ReverseTunnelV2\x12_\n" +
-	"\x13DeleteReverseTunnel\x120.teleport.presence.v1.DeleteReverseTunnelRequest\x1a\x16.google.protobuf.EmptyBTZRgithub.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1;presencev1b\x06proto3"
+	"\x13DeleteReverseTunnel\x120.teleport.presence.v1.DeleteReverseTunnelRequest\x1a\x16.google.protobuf.Empty\x12k\n" +
+	"\x0eGetRelayServer\x12+.teleport.presence.v1.GetRelayServerRequest\x1a,.teleport.presence.v1.GetRelayServerResponse\x12q\n" +
+	"\x10ListRelayServers\x12-.teleport.presence.v1.ListRelayServersRequest\x1a..teleport.presence.v1.ListRelayServersResponse\x12t\n" +
+	"\x11DeleteRelayServer\x12..teleport.presence.v1.DeleteRelayServerRequest\x1a/.teleport.presence.v1.DeleteRelayServerResponse\x12n\n" +
+	"\x0fListAuthServers\x12,.teleport.presence.v1.ListAuthServersRequest\x1a-.teleport.presence.v1.ListAuthServersResponse\x12q\n" +
+	"\x10ListProxyServers\x12-.teleport.presence.v1.ListProxyServersRequest\x1a..teleport.presence.v1.ListProxyServersResponseBTZRgithub.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1;presencev1b\x06proto3"
 
 var (
 	file_teleport_presence_v1_service_proto_rawDescOnce sync.Once
@@ -556,7 +1098,7 @@ func file_teleport_presence_v1_service_proto_rawDescGZIP() []byte {
 	return file_teleport_presence_v1_service_proto_rawDescData
 }
 
-var file_teleport_presence_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_teleport_presence_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
 var file_teleport_presence_v1_service_proto_goTypes = []any{
 	(*GetRemoteClusterRequest)(nil),    // 0: teleport.presence.v1.GetRemoteClusterRequest
 	(*ListRemoteClustersRequest)(nil),  // 1: teleport.presence.v1.ListRemoteClustersRequest
@@ -567,36 +1109,62 @@ var file_teleport_presence_v1_service_proto_goTypes = []any{
 	(*ListReverseTunnelsResponse)(nil), // 6: teleport.presence.v1.ListReverseTunnelsResponse
 	(*UpsertReverseTunnelRequest)(nil), // 7: teleport.presence.v1.UpsertReverseTunnelRequest
 	(*DeleteReverseTunnelRequest)(nil), // 8: teleport.presence.v1.DeleteReverseTunnelRequest
-	(*types.RemoteClusterV3)(nil),      // 9: types.RemoteClusterV3
-	(*fieldmaskpb.FieldMask)(nil),      // 10: google.protobuf.FieldMask
-	(*types.ReverseTunnelV2)(nil),      // 11: types.ReverseTunnelV2
-	(*emptypb.Empty)(nil),              // 12: google.protobuf.Empty
+	(*GetRelayServerRequest)(nil),      // 9: teleport.presence.v1.GetRelayServerRequest
+	(*GetRelayServerResponse)(nil),     // 10: teleport.presence.v1.GetRelayServerResponse
+	(*ListRelayServersRequest)(nil),    // 11: teleport.presence.v1.ListRelayServersRequest
+	(*ListRelayServersResponse)(nil),   // 12: teleport.presence.v1.ListRelayServersResponse
+	(*DeleteRelayServerRequest)(nil),   // 13: teleport.presence.v1.DeleteRelayServerRequest
+	(*DeleteRelayServerResponse)(nil),  // 14: teleport.presence.v1.DeleteRelayServerResponse
+	(*ListAuthServersRequest)(nil),     // 15: teleport.presence.v1.ListAuthServersRequest
+	(*ListAuthServersResponse)(nil),    // 16: teleport.presence.v1.ListAuthServersResponse
+	(*ListProxyServersRequest)(nil),    // 17: teleport.presence.v1.ListProxyServersRequest
+	(*ListProxyServersResponse)(nil),   // 18: teleport.presence.v1.ListProxyServersResponse
+	(*types.RemoteClusterV3)(nil),      // 19: types.RemoteClusterV3
+	(*fieldmaskpb.FieldMask)(nil),      // 20: google.protobuf.FieldMask
+	(*types.ReverseTunnelV2)(nil),      // 21: types.ReverseTunnelV2
+	(*RelayServer)(nil),                // 22: teleport.presence.v1.RelayServer
+	(*types.ServerV2)(nil),             // 23: types.ServerV2
+	(*emptypb.Empty)(nil),              // 24: google.protobuf.Empty
 }
 var file_teleport_presence_v1_service_proto_depIdxs = []int32{
-	9,  // 0: teleport.presence.v1.ListRemoteClustersResponse.remote_clusters:type_name -> types.RemoteClusterV3
-	9,  // 1: teleport.presence.v1.UpdateRemoteClusterRequest.remote_cluster:type_name -> types.RemoteClusterV3
-	10, // 2: teleport.presence.v1.UpdateRemoteClusterRequest.update_mask:type_name -> google.protobuf.FieldMask
-	11, // 3: teleport.presence.v1.ListReverseTunnelsResponse.reverse_tunnels:type_name -> types.ReverseTunnelV2
-	11, // 4: teleport.presence.v1.UpsertReverseTunnelRequest.reverse_tunnel:type_name -> types.ReverseTunnelV2
-	0,  // 5: teleport.presence.v1.PresenceService.GetRemoteCluster:input_type -> teleport.presence.v1.GetRemoteClusterRequest
-	1,  // 6: teleport.presence.v1.PresenceService.ListRemoteClusters:input_type -> teleport.presence.v1.ListRemoteClustersRequest
-	3,  // 7: teleport.presence.v1.PresenceService.UpdateRemoteCluster:input_type -> teleport.presence.v1.UpdateRemoteClusterRequest
-	4,  // 8: teleport.presence.v1.PresenceService.DeleteRemoteCluster:input_type -> teleport.presence.v1.DeleteRemoteClusterRequest
-	5,  // 9: teleport.presence.v1.PresenceService.ListReverseTunnels:input_type -> teleport.presence.v1.ListReverseTunnelsRequest
-	7,  // 10: teleport.presence.v1.PresenceService.UpsertReverseTunnel:input_type -> teleport.presence.v1.UpsertReverseTunnelRequest
-	8,  // 11: teleport.presence.v1.PresenceService.DeleteReverseTunnel:input_type -> teleport.presence.v1.DeleteReverseTunnelRequest
-	9,  // 12: teleport.presence.v1.PresenceService.GetRemoteCluster:output_type -> types.RemoteClusterV3
-	2,  // 13: teleport.presence.v1.PresenceService.ListRemoteClusters:output_type -> teleport.presence.v1.ListRemoteClustersResponse
-	9,  // 14: teleport.presence.v1.PresenceService.UpdateRemoteCluster:output_type -> types.RemoteClusterV3
-	12, // 15: teleport.presence.v1.PresenceService.DeleteRemoteCluster:output_type -> google.protobuf.Empty
-	6,  // 16: teleport.presence.v1.PresenceService.ListReverseTunnels:output_type -> teleport.presence.v1.ListReverseTunnelsResponse
-	11, // 17: teleport.presence.v1.PresenceService.UpsertReverseTunnel:output_type -> types.ReverseTunnelV2
-	12, // 18: teleport.presence.v1.PresenceService.DeleteReverseTunnel:output_type -> google.protobuf.Empty
-	12, // [12:19] is the sub-list for method output_type
-	5,  // [5:12] is the sub-list for method input_type
-	5,  // [5:5] is the sub-list for extension type_name
-	5,  // [5:5] is the sub-list for extension extendee
-	0,  // [0:5] is the sub-list for field type_name
+	19, // 0: teleport.presence.v1.ListRemoteClustersResponse.remote_clusters:type_name -> types.RemoteClusterV3
+	19, // 1: teleport.presence.v1.UpdateRemoteClusterRequest.remote_cluster:type_name -> types.RemoteClusterV3
+	20, // 2: teleport.presence.v1.UpdateRemoteClusterRequest.update_mask:type_name -> google.protobuf.FieldMask
+	21, // 3: teleport.presence.v1.ListReverseTunnelsResponse.reverse_tunnels:type_name -> types.ReverseTunnelV2
+	21, // 4: teleport.presence.v1.UpsertReverseTunnelRequest.reverse_tunnel:type_name -> types.ReverseTunnelV2
+	22, // 5: teleport.presence.v1.GetRelayServerResponse.relay_server:type_name -> teleport.presence.v1.RelayServer
+	22, // 6: teleport.presence.v1.ListRelayServersResponse.relays:type_name -> teleport.presence.v1.RelayServer
+	23, // 7: teleport.presence.v1.ListAuthServersResponse.servers:type_name -> types.ServerV2
+	23, // 8: teleport.presence.v1.ListProxyServersResponse.servers:type_name -> types.ServerV2
+	0,  // 9: teleport.presence.v1.PresenceService.GetRemoteCluster:input_type -> teleport.presence.v1.GetRemoteClusterRequest
+	1,  // 10: teleport.presence.v1.PresenceService.ListRemoteClusters:input_type -> teleport.presence.v1.ListRemoteClustersRequest
+	3,  // 11: teleport.presence.v1.PresenceService.UpdateRemoteCluster:input_type -> teleport.presence.v1.UpdateRemoteClusterRequest
+	4,  // 12: teleport.presence.v1.PresenceService.DeleteRemoteCluster:input_type -> teleport.presence.v1.DeleteRemoteClusterRequest
+	5,  // 13: teleport.presence.v1.PresenceService.ListReverseTunnels:input_type -> teleport.presence.v1.ListReverseTunnelsRequest
+	7,  // 14: teleport.presence.v1.PresenceService.UpsertReverseTunnel:input_type -> teleport.presence.v1.UpsertReverseTunnelRequest
+	8,  // 15: teleport.presence.v1.PresenceService.DeleteReverseTunnel:input_type -> teleport.presence.v1.DeleteReverseTunnelRequest
+	9,  // 16: teleport.presence.v1.PresenceService.GetRelayServer:input_type -> teleport.presence.v1.GetRelayServerRequest
+	11, // 17: teleport.presence.v1.PresenceService.ListRelayServers:input_type -> teleport.presence.v1.ListRelayServersRequest
+	13, // 18: teleport.presence.v1.PresenceService.DeleteRelayServer:input_type -> teleport.presence.v1.DeleteRelayServerRequest
+	15, // 19: teleport.presence.v1.PresenceService.ListAuthServers:input_type -> teleport.presence.v1.ListAuthServersRequest
+	17, // 20: teleport.presence.v1.PresenceService.ListProxyServers:input_type -> teleport.presence.v1.ListProxyServersRequest
+	19, // 21: teleport.presence.v1.PresenceService.GetRemoteCluster:output_type -> types.RemoteClusterV3
+	2,  // 22: teleport.presence.v1.PresenceService.ListRemoteClusters:output_type -> teleport.presence.v1.ListRemoteClustersResponse
+	19, // 23: teleport.presence.v1.PresenceService.UpdateRemoteCluster:output_type -> types.RemoteClusterV3
+	24, // 24: teleport.presence.v1.PresenceService.DeleteRemoteCluster:output_type -> google.protobuf.Empty
+	6,  // 25: teleport.presence.v1.PresenceService.ListReverseTunnels:output_type -> teleport.presence.v1.ListReverseTunnelsResponse
+	21, // 26: teleport.presence.v1.PresenceService.UpsertReverseTunnel:output_type -> types.ReverseTunnelV2
+	24, // 27: teleport.presence.v1.PresenceService.DeleteReverseTunnel:output_type -> google.protobuf.Empty
+	10, // 28: teleport.presence.v1.PresenceService.GetRelayServer:output_type -> teleport.presence.v1.GetRelayServerResponse
+	12, // 29: teleport.presence.v1.PresenceService.ListRelayServers:output_type -> teleport.presence.v1.ListRelayServersResponse
+	14, // 30: teleport.presence.v1.PresenceService.DeleteRelayServer:output_type -> teleport.presence.v1.DeleteRelayServerResponse
+	16, // 31: teleport.presence.v1.PresenceService.ListAuthServers:output_type -> teleport.presence.v1.ListAuthServersResponse
+	18, // 32: teleport.presence.v1.PresenceService.ListProxyServers:output_type -> teleport.presence.v1.ListProxyServersResponse
+	21, // [21:33] is the sub-list for method output_type
+	9,  // [9:21] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_teleport_presence_v1_service_proto_init() }
@@ -604,13 +1172,14 @@ func file_teleport_presence_v1_service_proto_init() {
 	if File_teleport_presence_v1_service_proto != nil {
 		return
 	}
+	file_teleport_presence_v1_relay_server_proto_init()
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_presence_v1_service_proto_rawDesc), len(file_teleport_presence_v1_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   9,
+			NumMessages:   19,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
index ac6ead13f60db..fa595702a3f14 100644
--- a/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
@@ -42,6 +42,11 @@ const (
 	PresenceService_ListReverseTunnels_FullMethodName  = "/teleport.presence.v1.PresenceService/ListReverseTunnels"
 	PresenceService_UpsertReverseTunnel_FullMethodName = "/teleport.presence.v1.PresenceService/UpsertReverseTunnel"
 	PresenceService_DeleteReverseTunnel_FullMethodName = "/teleport.presence.v1.PresenceService/DeleteReverseTunnel"
+	PresenceService_GetRelayServer_FullMethodName      = "/teleport.presence.v1.PresenceService/GetRelayServer"
+	PresenceService_ListRelayServers_FullMethodName    = "/teleport.presence.v1.PresenceService/ListRelayServers"
+	PresenceService_DeleteRelayServer_FullMethodName   = "/teleport.presence.v1.PresenceService/DeleteRelayServer"
+	PresenceService_ListAuthServers_FullMethodName     = "/teleport.presence.v1.PresenceService/ListAuthServers"
+	PresenceService_ListProxyServers_FullMethodName    = "/teleport.presence.v1.PresenceService/ListProxyServers"
 )
 
 // PresenceServiceClient is the client API for PresenceService service.
@@ -64,6 +69,16 @@ type PresenceServiceClient interface {
 	UpsertReverseTunnel(ctx context.Context, in *UpsertReverseTunnelRequest, opts ...grpc.CallOption) (*types.ReverseTunnelV2, error)
 	// DeleteReverseTunnel removes an existing ReverseTunnel by name.
 	DeleteReverseTunnel(ctx context.Context, in *DeleteReverseTunnelRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// GetRelayServer returns a single relay_server by name.
+	GetRelayServer(ctx context.Context, in *GetRelayServerRequest, opts ...grpc.CallOption) (*GetRelayServerResponse, error)
+	// ListRelayServers returns a page of relay_server resources.
+	ListRelayServers(ctx context.Context, in *ListRelayServersRequest, opts ...grpc.CallOption) (*ListRelayServersResponse, error)
+	// DeleteRelayServer deletes a relay_server resource by name.
+	DeleteRelayServer(ctx context.Context, in *DeleteRelayServerRequest, opts ...grpc.CallOption) (*DeleteRelayServerResponse, error)
+	// ListAuthServers returns a page of Auth servers.
+	ListAuthServers(ctx context.Context, in *ListAuthServersRequest, opts ...grpc.CallOption) (*ListAuthServersResponse, error)
+	// ListProxyServers returns a page of Proxy servers.
+	ListProxyServers(ctx context.Context, in *ListProxyServersRequest, opts ...grpc.CallOption) (*ListProxyServersResponse, error)
 }
 
 type presenceServiceClient struct {
@@ -144,6 +159,56 @@ func (c *presenceServiceClient) DeleteReverseTunnel(ctx context.Context, in *Del
 	return out, nil
 }
 
+func (c *presenceServiceClient) GetRelayServer(ctx context.Context, in *GetRelayServerRequest, opts ...grpc.CallOption) (*GetRelayServerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetRelayServerResponse)
+	err := c.cc.Invoke(ctx, PresenceService_GetRelayServer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *presenceServiceClient) ListRelayServers(ctx context.Context, in *ListRelayServersRequest, opts ...grpc.CallOption) (*ListRelayServersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRelayServersResponse)
+	err := c.cc.Invoke(ctx, PresenceService_ListRelayServers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *presenceServiceClient) DeleteRelayServer(ctx context.Context, in *DeleteRelayServerRequest, opts ...grpc.CallOption) (*DeleteRelayServerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteRelayServerResponse)
+	err := c.cc.Invoke(ctx, PresenceService_DeleteRelayServer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *presenceServiceClient) ListAuthServers(ctx context.Context, in *ListAuthServersRequest, opts ...grpc.CallOption) (*ListAuthServersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAuthServersResponse)
+	err := c.cc.Invoke(ctx, PresenceService_ListAuthServers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *presenceServiceClient) ListProxyServers(ctx context.Context, in *ListProxyServersRequest, opts ...grpc.CallOption) (*ListProxyServersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListProxyServersResponse)
+	err := c.cc.Invoke(ctx, PresenceService_ListProxyServers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // PresenceServiceServer is the server API for PresenceService service.
 // All implementations must embed UnimplementedPresenceServiceServer
 // for forward compatibility.
@@ -164,6 +229,16 @@ type PresenceServiceServer interface {
 	UpsertReverseTunnel(context.Context, *UpsertReverseTunnelRequest) (*types.ReverseTunnelV2, error)
 	// DeleteReverseTunnel removes an existing ReverseTunnel by name.
 	DeleteReverseTunnel(context.Context, *DeleteReverseTunnelRequest) (*emptypb.Empty, error)
+	// GetRelayServer returns a single relay_server by name.
+	GetRelayServer(context.Context, *GetRelayServerRequest) (*GetRelayServerResponse, error)
+	// ListRelayServers returns a page of relay_server resources.
+	ListRelayServers(context.Context, *ListRelayServersRequest) (*ListRelayServersResponse, error)
+	// DeleteRelayServer deletes a relay_server resource by name.
+	DeleteRelayServer(context.Context, *DeleteRelayServerRequest) (*DeleteRelayServerResponse, error)
+	// ListAuthServers returns a page of Auth servers.
+	ListAuthServers(context.Context, *ListAuthServersRequest) (*ListAuthServersResponse, error)
+	// ListProxyServers returns a page of Proxy servers.
+	ListProxyServers(context.Context, *ListProxyServersRequest) (*ListProxyServersResponse, error)
 	mustEmbedUnimplementedPresenceServiceServer()
 }
 
@@ -195,6 +270,21 @@ func (UnimplementedPresenceServiceServer) UpsertReverseTunnel(context.Context, *
 func (UnimplementedPresenceServiceServer) DeleteReverseTunnel(context.Context, *DeleteReverseTunnelRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteReverseTunnel not implemented")
 }
+func (UnimplementedPresenceServiceServer) GetRelayServer(context.Context, *GetRelayServerRequest) (*GetRelayServerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetRelayServer not implemented")
+}
+func (UnimplementedPresenceServiceServer) ListRelayServers(context.Context, *ListRelayServersRequest) (*ListRelayServersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListRelayServers not implemented")
+}
+func (UnimplementedPresenceServiceServer) DeleteRelayServer(context.Context, *DeleteRelayServerRequest) (*DeleteRelayServerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteRelayServer not implemented")
+}
+func (UnimplementedPresenceServiceServer) ListAuthServers(context.Context, *ListAuthServersRequest) (*ListAuthServersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListAuthServers not implemented")
+}
+func (UnimplementedPresenceServiceServer) ListProxyServers(context.Context, *ListProxyServersRequest) (*ListProxyServersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListProxyServers not implemented")
+}
 func (UnimplementedPresenceServiceServer) mustEmbedUnimplementedPresenceServiceServer() {}
 func (UnimplementedPresenceServiceServer) testEmbeddedByValue()                         {}
 
@@ -342,6 +432,96 @@ func _PresenceService_DeleteReverseTunnel_Handler(srv interface{}, ctx context.C
 	return interceptor(ctx, in, info, handler)
 }
 
+func _PresenceService_GetRelayServer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRelayServerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PresenceServiceServer).GetRelayServer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PresenceService_GetRelayServer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PresenceServiceServer).GetRelayServer(ctx, req.(*GetRelayServerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PresenceService_ListRelayServers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRelayServersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PresenceServiceServer).ListRelayServers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PresenceService_ListRelayServers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PresenceServiceServer).ListRelayServers(ctx, req.(*ListRelayServersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PresenceService_DeleteRelayServer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRelayServerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PresenceServiceServer).DeleteRelayServer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PresenceService_DeleteRelayServer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PresenceServiceServer).DeleteRelayServer(ctx, req.(*DeleteRelayServerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PresenceService_ListAuthServers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAuthServersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PresenceServiceServer).ListAuthServers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PresenceService_ListAuthServers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PresenceServiceServer).ListAuthServers(ctx, req.(*ListAuthServersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PresenceService_ListProxyServers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListProxyServersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PresenceServiceServer).ListProxyServers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PresenceService_ListProxyServers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PresenceServiceServer).ListProxyServers(ctx, req.(*ListProxyServersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // PresenceService_ServiceDesc is the grpc.ServiceDesc for PresenceService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -377,6 +557,26 @@ var PresenceService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteReverseTunnel",
 			Handler:    _PresenceService_DeleteReverseTunnel_Handler,
 		},
+		{
+			MethodName: "GetRelayServer",
+			Handler:    _PresenceService_GetRelayServer_Handler,
+		},
+		{
+			MethodName: "ListRelayServers",
+			Handler:    _PresenceService_ListRelayServers_Handler,
+		},
+		{
+			MethodName: "DeleteRelayServer",
+			Handler:    _PresenceService_DeleteRelayServer_Handler,
+		},
+		{
+			MethodName: "ListAuthServers",
+			Handler:    _PresenceService_ListAuthServers_Handler,
+		},
+		{
+			MethodName: "ListProxyServers",
+			Handler:    _PresenceService_ListProxyServers_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/presence/v1/service.proto",
diff --git a/api/gen/proto/go/teleport/provisioning/v1/provisioning.pb.go b/api/gen/proto/go/teleport/provisioning/v1/provisioning.pb.go
index f1dbdafe083c3..263e6d8ee4cdb 100644
--- a/api/gen/proto/go/teleport/provisioning/v1/provisioning.pb.go
+++ b/api/gen/proto/go/teleport/provisioning/v1/provisioning.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/provisioning/v1/provisioning.proto
 
diff --git a/api/gen/proto/go/teleport/provisioning/v1/provisioning_service.pb.go b/api/gen/proto/go/teleport/provisioning/v1/provisioning_service.pb.go
deleted file mode 100644
index 6e3ae761fb8c1..0000000000000
--- a/api/gen/proto/go/teleport/provisioning/v1/provisioning_service.pb.go
+++ /dev/null
@@ -1,145 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/provisioning/v1/provisioning_service.proto
-
-package provisioningv1
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// DeleteDownstreamProvisioningStatesRequest is a request to delete all provisioning states for
-// a given DownstreamId.
-type DeleteDownstreamProvisioningStatesRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// DownstreamId identifies the downstream service that this state applies to.
-	DownstreamId  string `protobuf:"bytes,1,opt,name=downstream_id,json=downstreamId,proto3" json:"downstream_id,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteDownstreamProvisioningStatesRequest) Reset() {
-	*x = DeleteDownstreamProvisioningStatesRequest{}
-	mi := &file_teleport_provisioning_v1_provisioning_service_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteDownstreamProvisioningStatesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteDownstreamProvisioningStatesRequest) ProtoMessage() {}
-
-func (x *DeleteDownstreamProvisioningStatesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_provisioning_v1_provisioning_service_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteDownstreamProvisioningStatesRequest.ProtoReflect.Descriptor instead.
-func (*DeleteDownstreamProvisioningStatesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_provisioning_v1_provisioning_service_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *DeleteDownstreamProvisioningStatesRequest) GetDownstreamId() string {
-	if x != nil {
-		return x.DownstreamId
-	}
-	return ""
-}
-
-var File_teleport_provisioning_v1_provisioning_service_proto protoreflect.FileDescriptor
-
-const file_teleport_provisioning_v1_provisioning_service_proto_rawDesc = "" +
-	"\n" +
-	"3teleport/provisioning/v1/provisioning_service.proto\x12\x18teleport.provisioning.v1\x1a\x1bgoogle/protobuf/empty.proto\"P\n" +
-	")DeleteDownstreamProvisioningStatesRequest\x12#\n" +
-	"\rdownstream_id\x18\x01 \x01(\tR\fdownstreamId2\x99\x01\n" +
-	"\x13ProvisioningService\x12\x81\x01\n" +
-	"\"DeleteDownstreamProvisioningStates\x12C.teleport.provisioning.v1.DeleteDownstreamProvisioningStatesRequest\x1a\x16.google.protobuf.EmptyB\\ZZgithub.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1;provisioningv1b\x06proto3"
-
-var (
-	file_teleport_provisioning_v1_provisioning_service_proto_rawDescOnce sync.Once
-	file_teleport_provisioning_v1_provisioning_service_proto_rawDescData []byte
-)
-
-func file_teleport_provisioning_v1_provisioning_service_proto_rawDescGZIP() []byte {
-	file_teleport_provisioning_v1_provisioning_service_proto_rawDescOnce.Do(func() {
-		file_teleport_provisioning_v1_provisioning_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_provisioning_v1_provisioning_service_proto_rawDesc), len(file_teleport_provisioning_v1_provisioning_service_proto_rawDesc)))
-	})
-	return file_teleport_provisioning_v1_provisioning_service_proto_rawDescData
-}
-
-var file_teleport_provisioning_v1_provisioning_service_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_teleport_provisioning_v1_provisioning_service_proto_goTypes = []any{
-	(*DeleteDownstreamProvisioningStatesRequest)(nil), // 0: teleport.provisioning.v1.DeleteDownstreamProvisioningStatesRequest
-	(*emptypb.Empty)(nil),                             // 1: google.protobuf.Empty
-}
-var file_teleport_provisioning_v1_provisioning_service_proto_depIdxs = []int32{
-	0, // 0: teleport.provisioning.v1.ProvisioningService.DeleteDownstreamProvisioningStates:input_type -> teleport.provisioning.v1.DeleteDownstreamProvisioningStatesRequest
-	1, // 1: teleport.provisioning.v1.ProvisioningService.DeleteDownstreamProvisioningStates:output_type -> google.protobuf.Empty
-	1, // [1:2] is the sub-list for method output_type
-	0, // [0:1] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_teleport_provisioning_v1_provisioning_service_proto_init() }
-func file_teleport_provisioning_v1_provisioning_service_proto_init() {
-	if File_teleport_provisioning_v1_provisioning_service_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_provisioning_v1_provisioning_service_proto_rawDesc), len(file_teleport_provisioning_v1_provisioning_service_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   1,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_teleport_provisioning_v1_provisioning_service_proto_goTypes,
-		DependencyIndexes: file_teleport_provisioning_v1_provisioning_service_proto_depIdxs,
-		MessageInfos:      file_teleport_provisioning_v1_provisioning_service_proto_msgTypes,
-	}.Build()
-	File_teleport_provisioning_v1_provisioning_service_proto = out.File
-	file_teleport_provisioning_v1_provisioning_service_proto_goTypes = nil
-	file_teleport_provisioning_v1_provisioning_service_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/provisioning/v1/provisioning_service_grpc.pb.go b/api/gen/proto/go/teleport/provisioning/v1/provisioning_service_grpc.pb.go
deleted file mode 100644
index fdfe2a7bde4f4..0000000000000
--- a/api/gen/proto/go/teleport/provisioning/v1/provisioning_service_grpc.pb.go
+++ /dev/null
@@ -1,142 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             (unknown)
-// source: teleport/provisioning/v1/provisioning_service.proto
-
-package provisioningv1
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	ProvisioningService_DeleteDownstreamProvisioningStates_FullMethodName = "/teleport.provisioning.v1.ProvisioningService/DeleteDownstreamProvisioningStates"
-)
-
-// ProvisioningServiceClient is the client API for ProvisioningService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// ProvisioningService provides methods to manage Provisioning resources.
-type ProvisioningServiceClient interface {
-	// DeleteDownstreamProvisioningStates deletes all Identity Center provisioning state for a given downstream.
-	DeleteDownstreamProvisioningStates(ctx context.Context, in *DeleteDownstreamProvisioningStatesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-}
-
-type provisioningServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewProvisioningServiceClient(cc grpc.ClientConnInterface) ProvisioningServiceClient {
-	return &provisioningServiceClient{cc}
-}
-
-func (c *provisioningServiceClient) DeleteDownstreamProvisioningStates(ctx context.Context, in *DeleteDownstreamProvisioningStatesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, ProvisioningService_DeleteDownstreamProvisioningStates_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// ProvisioningServiceServer is the server API for ProvisioningService service.
-// All implementations must embed UnimplementedProvisioningServiceServer
-// for forward compatibility.
-//
-// ProvisioningService provides methods to manage Provisioning resources.
-type ProvisioningServiceServer interface {
-	// DeleteDownstreamProvisioningStates deletes all Identity Center provisioning state for a given downstream.
-	DeleteDownstreamProvisioningStates(context.Context, *DeleteDownstreamProvisioningStatesRequest) (*emptypb.Empty, error)
-	mustEmbedUnimplementedProvisioningServiceServer()
-}
-
-// UnimplementedProvisioningServiceServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedProvisioningServiceServer struct{}
-
-func (UnimplementedProvisioningServiceServer) DeleteDownstreamProvisioningStates(context.Context, *DeleteDownstreamProvisioningStatesRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteDownstreamProvisioningStates not implemented")
-}
-func (UnimplementedProvisioningServiceServer) mustEmbedUnimplementedProvisioningServiceServer() {}
-func (UnimplementedProvisioningServiceServer) testEmbeddedByValue()                             {}
-
-// UnsafeProvisioningServiceServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to ProvisioningServiceServer will
-// result in compilation errors.
-type UnsafeProvisioningServiceServer interface {
-	mustEmbedUnimplementedProvisioningServiceServer()
-}
-
-func RegisterProvisioningServiceServer(s grpc.ServiceRegistrar, srv ProvisioningServiceServer) {
-	// If the following call pancis, it indicates UnimplementedProvisioningServiceServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&ProvisioningService_ServiceDesc, srv)
-}
-
-func _ProvisioningService_DeleteDownstreamProvisioningStates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteDownstreamProvisioningStatesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProvisioningServiceServer).DeleteDownstreamProvisioningStates(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ProvisioningService_DeleteDownstreamProvisioningStates_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProvisioningServiceServer).DeleteDownstreamProvisioningStates(ctx, req.(*DeleteDownstreamProvisioningStatesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// ProvisioningService_ServiceDesc is the grpc.ServiceDesc for ProvisioningService service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var ProvisioningService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "teleport.provisioning.v1.ProvisioningService",
-	HandlerType: (*ProvisioningServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "DeleteDownstreamProvisioningStates",
-			Handler:    _ProvisioningService_DeleteDownstreamProvisioningStates_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "teleport/provisioning/v1/provisioning_service.proto",
-}
diff --git a/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption.pb.go b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption.pb.go
new file mode 100644
index 0000000000000..02b63f6fd9556
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption.pb.go
@@ -0,0 +1,598 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/recordingencryption/v1/recording_encryption.proto
+
+package recordingencryptionv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	types "github.com/gravitational/teleport/api/types"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The possible states a KeyPair can be in.
+type KeyPairState int32
+
+const (
+	// Unspecified value
+	KeyPairState_KEY_PAIR_STATE_UNSPECIFIED KeyPairState = 0
+	// Represents an active key.
+	KeyPairState_KEY_PAIR_STATE_ACTIVE KeyPairState = 1
+	// Represents a key in the process of being rotated.
+	KeyPairState_KEY_PAIR_STATE_ROTATING KeyPairState = 2
+	// Represents a key being rotated in that is inaccessible to at least one
+	// auth server.
+	KeyPairState_KEY_PAIR_STATE_INACCESSIBLE KeyPairState = 3
+)
+
+// Enum value maps for KeyPairState.
+var (
+	KeyPairState_name = map[int32]string{
+		0: "KEY_PAIR_STATE_UNSPECIFIED",
+		1: "KEY_PAIR_STATE_ACTIVE",
+		2: "KEY_PAIR_STATE_ROTATING",
+		3: "KEY_PAIR_STATE_INACCESSIBLE",
+	}
+	KeyPairState_value = map[string]int32{
+		"KEY_PAIR_STATE_UNSPECIFIED":  0,
+		"KEY_PAIR_STATE_ACTIVE":       1,
+		"KEY_PAIR_STATE_ROTATING":     2,
+		"KEY_PAIR_STATE_INACCESSIBLE": 3,
+	}
+)
+
+func (x KeyPairState) Enum() *KeyPairState {
+	p := new(KeyPairState)
+	*p = x
+	return p
+}
+
+func (x KeyPairState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (KeyPairState) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_enumTypes[0].Descriptor()
+}
+
+func (KeyPairState) Type() protoreflect.EnumType {
+	return &file_teleport_recordingencryption_v1_recording_encryption_proto_enumTypes[0]
+}
+
+func (x KeyPairState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use KeyPairState.Descriptor instead.
+func (KeyPairState) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{0}
+}
+
+// A key pair used with age to wrap and unwrap file keys for session recording encryption.
+type KeyPair struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A key pair used with age to wrap and unwrap file keys for session recording encryption.
+	KeyPair *types.EncryptionKeyPair `protobuf:"bytes,1,opt,name=key_pair,json=keyPair,proto3" json:"key_pair,omitempty"`
+	// The current state of the key pair.
+	State         KeyPairState `protobuf:"varint,2,opt,name=state,proto3,enum=teleport.recordingencryption.v1.KeyPairState" json:"state,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KeyPair) Reset() {
+	*x = KeyPair{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KeyPair) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KeyPair) ProtoMessage() {}
+
+func (x *KeyPair) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KeyPair.ProtoReflect.Descriptor instead.
+func (*KeyPair) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *KeyPair) GetKeyPair() *types.EncryptionKeyPair {
+	if x != nil {
+		return x.KeyPair
+	}
+	return nil
+}
+
+func (x *KeyPair) GetState() KeyPairState {
+	if x != nil {
+		return x.State
+	}
+	return KeyPairState_KEY_PAIR_STATE_UNSPECIFIED
+}
+
+// RecordingEncryptionSpec contains the active key set for encrypted session recording.
+type RecordingEncryptionSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A list of active key pairs used for session recording encryption. The unique set of
+	// active public keys are used as recipients during age encryption. This allows any
+	// active private key to be used during decryption which guards against recordings being
+	// inaccessible to auth servers waiting for key rotation.
+	ActiveKeyPairs []*KeyPair `protobuf:"bytes,2,rep,name=active_key_pairs,json=activeKeyPairs,proto3" json:"active_key_pairs,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *RecordingEncryptionSpec) Reset() {
+	*x = RecordingEncryptionSpec{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RecordingEncryptionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordingEncryptionSpec) ProtoMessage() {}
+
+func (x *RecordingEncryptionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordingEncryptionSpec.ProtoReflect.Descriptor instead.
+func (*RecordingEncryptionSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RecordingEncryptionSpec) GetActiveKeyPairs() []*KeyPair {
+	if x != nil {
+		return x.ActiveKeyPairs
+	}
+	return nil
+}
+
+// RecordingEncryptionStatus contains the status of the RecordingEncryption resource.
+type RecordingEncryptionStatus struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RecordingEncryptionStatus) Reset() {
+	*x = RecordingEncryptionStatus{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RecordingEncryptionStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordingEncryptionStatus) ProtoMessage() {}
+
+func (x *RecordingEncryptionStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordingEncryptionStatus.ProtoReflect.Descriptor instead.
+func (*RecordingEncryptionStatus) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{2}
+}
+
+// RecordingEncryption contains cluster state for encrypted session recordings.
+type RecordingEncryption struct {
+	state         protoimpl.MessageState     `protogen:"open.v1"`
+	Kind          string                     `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	SubKind       string                     `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	Version       string                     `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata      *v1.Metadata               `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec          *RecordingEncryptionSpec   `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	Status        *RecordingEncryptionStatus `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RecordingEncryption) Reset() {
+	*x = RecordingEncryption{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RecordingEncryption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordingEncryption) ProtoMessage() {}
+
+func (x *RecordingEncryption) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordingEncryption.ProtoReflect.Descriptor instead.
+func (*RecordingEncryption) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *RecordingEncryption) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *RecordingEncryption) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *RecordingEncryption) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *RecordingEncryption) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *RecordingEncryption) GetSpec() *RecordingEncryptionSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *RecordingEncryption) GetStatus() *RecordingEncryptionStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// A rotated key pair previously used with age to wrap and unwrap file keys for session recording
+// encryption.
+type RotatedKeySpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The rotated key pair previously used with age to wrap and unwrap file keys for session recording
+	// encryption.
+	EncryptionKeyPair *types.EncryptionKeyPair `protobuf:"bytes,2,opt,name=encryption_key_pair,json=encryptionKeyPair,proto3" json:"encryption_key_pair,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *RotatedKeySpec) Reset() {
+	*x = RotatedKeySpec{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotatedKeySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotatedKeySpec) ProtoMessage() {}
+
+func (x *RotatedKeySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotatedKeySpec.ProtoReflect.Descriptor instead.
+func (*RotatedKeySpec) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *RotatedKeySpec) GetEncryptionKeyPair() *types.EncryptionKeyPair {
+	if x != nil {
+		return x.EncryptionKeyPair
+	}
+	return nil
+}
+
+// The empty status of a RotatedKey.
+type RotatedKeyStatus struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotatedKeyStatus) Reset() {
+	*x = RotatedKeyStatus{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotatedKeyStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotatedKeyStatus) ProtoMessage() {}
+
+func (x *RotatedKeyStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotatedKeyStatus.ProtoReflect.Descriptor instead.
+func (*RotatedKeyStatus) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{5}
+}
+
+// A previously rotated encryption key for session recordings kept for future replay. The metadata.name
+// is expected to be the fingerprint of the public key contained in the spec, which is a hex encoded
+// SHA256 hash of its PKIX form.
+type RotatedKey struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Kind          string                 `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	SubKind       string                 `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	Version       string                 `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata      *v1.Metadata           `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec          *RotatedKeySpec        `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	Status        *RotatedKeyStatus      `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotatedKey) Reset() {
+	*x = RotatedKey{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotatedKey) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotatedKey) ProtoMessage() {}
+
+func (x *RotatedKey) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotatedKey.ProtoReflect.Descriptor instead.
+func (*RotatedKey) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RotatedKey) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *RotatedKey) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *RotatedKey) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *RotatedKey) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *RotatedKey) GetSpec() *RotatedKeySpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *RotatedKey) GetStatus() *RotatedKeyStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+var File_teleport_recordingencryption_v1_recording_encryption_proto protoreflect.FileDescriptor
+
+const file_teleport_recordingencryption_v1_recording_encryption_proto_rawDesc = "" +
+	"\n" +
+	":teleport/recordingencryption/v1/recording_encryption.proto\x12\x1fteleport.recordingencryption.v1\x1a!teleport/header/v1/metadata.proto\x1a!teleport/legacy/types/types.proto\"\x83\x01\n" +
+	"\aKeyPair\x123\n" +
+	"\bkey_pair\x18\x01 \x01(\v2\x18.types.EncryptionKeyPairR\akeyPair\x12C\n" +
+	"\x05state\x18\x02 \x01(\x0e2-.teleport.recordingencryption.v1.KeyPairStateR\x05state\"\x80\x01\n" +
+	"\x17RecordingEncryptionSpec\x12R\n" +
+	"\x10active_key_pairs\x18\x02 \x03(\v2(.teleport.recordingencryption.v1.KeyPairR\x0eactiveKeyPairsJ\x04\b\x01\x10\x02R\vactive_keys\"\x1b\n" +
+	"\x19RecordingEncryptionStatus\"\xba\x02\n" +
+	"\x13RecordingEncryption\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12L\n" +
+	"\x04spec\x18\x05 \x01(\v28.teleport.recordingencryption.v1.RecordingEncryptionSpecR\x04spec\x12R\n" +
+	"\x06status\x18\x06 \x01(\v2:.teleport.recordingencryption.v1.RecordingEncryptionStatusR\x06status\"Z\n" +
+	"\x0eRotatedKeySpec\x12H\n" +
+	"\x13encryption_key_pair\x18\x02 \x01(\v2\x18.types.EncryptionKeyPairR\x11encryptionKeyPair\"\x12\n" +
+	"\x10RotatedKeyStatus\"\x9f\x02\n" +
+	"\n" +
+	"RotatedKey\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12C\n" +
+	"\x04spec\x18\x05 \x01(\v2/.teleport.recordingencryption.v1.RotatedKeySpecR\x04spec\x12I\n" +
+	"\x06status\x18\x06 \x01(\v21.teleport.recordingencryption.v1.RotatedKeyStatusR\x06status*\x87\x01\n" +
+	"\fKeyPairState\x12\x1e\n" +
+	"\x1aKEY_PAIR_STATE_UNSPECIFIED\x10\x00\x12\x19\n" +
+	"\x15KEY_PAIR_STATE_ACTIVE\x10\x01\x12\x1b\n" +
+	"\x17KEY_PAIR_STATE_ROTATING\x10\x02\x12\x1f\n" +
+	"\x1bKEY_PAIR_STATE_INACCESSIBLE\x10\x03BjZhgithub.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1;recordingencryptionv1b\x06proto3"
+
+var (
+	file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescOnce sync.Once
+	file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescData []byte
+)
+
+func file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescGZIP() []byte {
+	file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescOnce.Do(func() {
+		file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_recordingencryption_v1_recording_encryption_proto_rawDesc), len(file_teleport_recordingencryption_v1_recording_encryption_proto_rawDesc)))
+	})
+	return file_teleport_recordingencryption_v1_recording_encryption_proto_rawDescData
+}
+
+var file_teleport_recordingencryption_v1_recording_encryption_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_teleport_recordingencryption_v1_recording_encryption_proto_goTypes = []any{
+	(KeyPairState)(0),                 // 0: teleport.recordingencryption.v1.KeyPairState
+	(*KeyPair)(nil),                   // 1: teleport.recordingencryption.v1.KeyPair
+	(*RecordingEncryptionSpec)(nil),   // 2: teleport.recordingencryption.v1.RecordingEncryptionSpec
+	(*RecordingEncryptionStatus)(nil), // 3: teleport.recordingencryption.v1.RecordingEncryptionStatus
+	(*RecordingEncryption)(nil),       // 4: teleport.recordingencryption.v1.RecordingEncryption
+	(*RotatedKeySpec)(nil),            // 5: teleport.recordingencryption.v1.RotatedKeySpec
+	(*RotatedKeyStatus)(nil),          // 6: teleport.recordingencryption.v1.RotatedKeyStatus
+	(*RotatedKey)(nil),                // 7: teleport.recordingencryption.v1.RotatedKey
+	(*types.EncryptionKeyPair)(nil),   // 8: types.EncryptionKeyPair
+	(*v1.Metadata)(nil),               // 9: teleport.header.v1.Metadata
+}
+var file_teleport_recordingencryption_v1_recording_encryption_proto_depIdxs = []int32{
+	8,  // 0: teleport.recordingencryption.v1.KeyPair.key_pair:type_name -> types.EncryptionKeyPair
+	0,  // 1: teleport.recordingencryption.v1.KeyPair.state:type_name -> teleport.recordingencryption.v1.KeyPairState
+	1,  // 2: teleport.recordingencryption.v1.RecordingEncryptionSpec.active_key_pairs:type_name -> teleport.recordingencryption.v1.KeyPair
+	9,  // 3: teleport.recordingencryption.v1.RecordingEncryption.metadata:type_name -> teleport.header.v1.Metadata
+	2,  // 4: teleport.recordingencryption.v1.RecordingEncryption.spec:type_name -> teleport.recordingencryption.v1.RecordingEncryptionSpec
+	3,  // 5: teleport.recordingencryption.v1.RecordingEncryption.status:type_name -> teleport.recordingencryption.v1.RecordingEncryptionStatus
+	8,  // 6: teleport.recordingencryption.v1.RotatedKeySpec.encryption_key_pair:type_name -> types.EncryptionKeyPair
+	9,  // 7: teleport.recordingencryption.v1.RotatedKey.metadata:type_name -> teleport.header.v1.Metadata
+	5,  // 8: teleport.recordingencryption.v1.RotatedKey.spec:type_name -> teleport.recordingencryption.v1.RotatedKeySpec
+	6,  // 9: teleport.recordingencryption.v1.RotatedKey.status:type_name -> teleport.recordingencryption.v1.RotatedKeyStatus
+	10, // [10:10] is the sub-list for method output_type
+	10, // [10:10] is the sub-list for method input_type
+	10, // [10:10] is the sub-list for extension type_name
+	10, // [10:10] is the sub-list for extension extendee
+	0,  // [0:10] is the sub-list for field type_name
+}
+
+func init() { file_teleport_recordingencryption_v1_recording_encryption_proto_init() }
+func file_teleport_recordingencryption_v1_recording_encryption_proto_init() {
+	if File_teleport_recordingencryption_v1_recording_encryption_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_recordingencryption_v1_recording_encryption_proto_rawDesc), len(file_teleport_recordingencryption_v1_recording_encryption_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_recordingencryption_v1_recording_encryption_proto_goTypes,
+		DependencyIndexes: file_teleport_recordingencryption_v1_recording_encryption_proto_depIdxs,
+		EnumInfos:         file_teleport_recordingencryption_v1_recording_encryption_proto_enumTypes,
+		MessageInfos:      file_teleport_recordingencryption_v1_recording_encryption_proto_msgTypes,
+	}.Build()
+	File_teleport_recordingencryption_v1_recording_encryption_proto = out.File
+	file_teleport_recordingencryption_v1_recording_encryption_proto_goTypes = nil
+	file_teleport_recordingencryption_v1_recording_encryption_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service.pb.go b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service.pb.go
new file mode 100644
index 0000000000000..a86889f0002de
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service.pb.go
@@ -0,0 +1,990 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/recordingencryption/v1/recording_encryption_service.proto
+
+package recordingencryptionv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The handle to an upload for an encrypted session.
+type Upload struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The primary identifier for an Upload.
+	UploadId string `protobuf:"bytes,1,opt,name=upload_id,json=uploadId,proto3" json:"upload_id,omitempty"`
+	// The session ID an upload is tied to.
+	SessionId string `protobuf:"bytes,2,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	// The time that an upload was created at.
+	InitiatedAt   *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=initiated_at,json=initiatedAt,proto3" json:"initiated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Upload) Reset() {
+	*x = Upload{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Upload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Upload) ProtoMessage() {}
+
+func (x *Upload) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Upload.ProtoReflect.Descriptor instead.
+func (*Upload) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Upload) GetUploadId() string {
+	if x != nil {
+		return x.UploadId
+	}
+	return ""
+}
+
+func (x *Upload) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *Upload) GetInitiatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.InitiatedAt
+	}
+	return nil
+}
+
+// The request to start a multipart upload for a specific session recording.
+type CreateUploadRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The session ID associated with the recording being uploaded.
+	SessionId     string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateUploadRequest) Reset() {
+	*x = CreateUploadRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateUploadRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateUploadRequest) ProtoMessage() {}
+
+func (x *CreateUploadRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateUploadRequest.ProtoReflect.Descriptor instead.
+func (*CreateUploadRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateUploadRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+// The resulting Upload message for a created Upload.
+type CreateUploadResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The handle for the created Upload.
+	Upload        *Upload `protobuf:"bytes,1,opt,name=upload,proto3" json:"upload,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateUploadResponse) Reset() {
+	*x = CreateUploadResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateUploadResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateUploadResponse) ProtoMessage() {}
+
+func (x *CreateUploadResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateUploadResponse.ProtoReflect.Descriptor instead.
+func (*CreateUploadResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CreateUploadResponse) GetUpload() *Upload {
+	if x != nil {
+		return x.Upload
+	}
+	return nil
+}
+
+// The request to upload a single part in a multipart upload.
+type UploadPartRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The handle to the in-progress upload that should be uploaded to.
+	Upload *Upload `protobuf:"bytes,1,opt,name=upload,proto3" json:"upload,omitempty"`
+	// The ordered index applied to the part.
+	PartNumber int64 `protobuf:"varint,2,opt,name=part_number,json=partNumber,proto3" json:"part_number,omitempty"`
+	// The encrypted part of session recording data being uploaded.
+	Part []byte `protobuf:"bytes,3,opt,name=part,proto3" json:"part,omitempty"`
+	// Whether this is the last upload part in the upload.
+	IsLast        bool `protobuf:"varint,4,opt,name=is_last,json=isLast,proto3" json:"is_last,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UploadPartRequest) Reset() {
+	*x = UploadPartRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UploadPartRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UploadPartRequest) ProtoMessage() {}
+
+func (x *UploadPartRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UploadPartRequest.ProtoReflect.Descriptor instead.
+func (*UploadPartRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UploadPartRequest) GetUpload() *Upload {
+	if x != nil {
+		return x.Upload
+	}
+	return nil
+}
+
+func (x *UploadPartRequest) GetPartNumber() int64 {
+	if x != nil {
+		return x.PartNumber
+	}
+	return 0
+}
+
+func (x *UploadPartRequest) GetPart() []byte {
+	if x != nil {
+		return x.Part
+	}
+	return nil
+}
+
+func (x *UploadPartRequest) GetIsLast() bool {
+	if x != nil {
+		return x.IsLast
+	}
+	return false
+}
+
+// The resulting metadata about an uploaded part.
+type Part struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The ordered index applied to the part.
+	PartNumber int64 `protobuf:"varint,1,opt,name=part_number,json=partNumber,proto3" json:"part_number,omitempty"`
+	// The part e-tag value relevant to some storage backends.
+	Etag          string `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Part) Reset() {
+	*x = Part{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Part) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Part) ProtoMessage() {}
+
+func (x *Part) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Part.ProtoReflect.Descriptor instead.
+func (*Part) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Part) GetPartNumber() int64 {
+	if x != nil {
+		return x.PartNumber
+	}
+	return 0
+}
+
+func (x *Part) GetEtag() string {
+	if x != nil {
+		return x.Etag
+	}
+	return ""
+}
+
+// A successfully uploaded Part to be included in the final CompleteUpload request.
+type UploadPartResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The resulting part metadata about an uploaded part.
+	Part          *Part `protobuf:"bytes,1,opt,name=part,proto3" json:"part,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UploadPartResponse) Reset() {
+	*x = UploadPartResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UploadPartResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UploadPartResponse) ProtoMessage() {}
+
+func (x *UploadPartResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UploadPartResponse.ProtoReflect.Descriptor instead.
+func (*UploadPartResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UploadPartResponse) GetPart() *Part {
+	if x != nil {
+		return x.Part
+	}
+	return nil
+}
+
+// The request to complete an upload. The included part numbers must match the parts successfully
+// uploaded up until this point.
+type CompleteUploadRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The handle to an upload to complete.
+	Upload *Upload `protobuf:"bytes,1,opt,name=upload,proto3" json:"upload,omitempty"`
+	// The parts expected to be successfully uploaded.
+	Parts         []*Part `protobuf:"bytes,2,rep,name=parts,proto3" json:"parts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CompleteUploadRequest) Reset() {
+	*x = CompleteUploadRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CompleteUploadRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CompleteUploadRequest) ProtoMessage() {}
+
+func (x *CompleteUploadRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CompleteUploadRequest.ProtoReflect.Descriptor instead.
+func (*CompleteUploadRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *CompleteUploadRequest) GetUpload() *Upload {
+	if x != nil {
+		return x.Upload
+	}
+	return nil
+}
+
+func (x *CompleteUploadRequest) GetParts() []*Part {
+	if x != nil {
+		return x.Parts
+	}
+	return nil
+}
+
+// The body of a CompleteUpload request.
+type CompleteUploadResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CompleteUploadResponse) Reset() {
+	*x = CompleteUploadResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CompleteUploadResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CompleteUploadResponse) ProtoMessage() {}
+
+func (x *CompleteUploadResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CompleteUploadResponse.ProtoReflect.Descriptor instead.
+func (*CompleteUploadResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{7}
+}
+
+// The body of a RotateKey request.
+type RotateKeyRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotateKeyRequest) Reset() {
+	*x = RotateKeyRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotateKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotateKeyRequest) ProtoMessage() {}
+
+func (x *RotateKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotateKeyRequest.ProtoReflect.Descriptor instead.
+func (*RotateKeyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{8}
+}
+
+// The return value of a RotateKey request.
+type RotateKeyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotateKeyResponse) Reset() {
+	*x = RotateKeyResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotateKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotateKeyResponse) ProtoMessage() {}
+
+func (x *RotateKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotateKeyResponse.ProtoReflect.Descriptor instead.
+func (*RotateKeyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{9}
+}
+
+// The body of a GetRotationState request.
+type GetRotationStateRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	PageSize      int32                  `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	PageToken     string                 `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRotationStateRequest) Reset() {
+	*x = GetRotationStateRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRotationStateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRotationStateRequest) ProtoMessage() {}
+
+func (x *GetRotationStateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRotationStateRequest.ProtoReflect.Descriptor instead.
+func (*GetRotationStateRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *GetRotationStateRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *GetRotationStateRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// A public key fingerprint coupled with its current state.
+type FingerprintWithState struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// A fingerprint identifying the public key of a KeyPair.
+	Fingerprint string `protobuf:"bytes,1,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
+	// The state associated with the identified KeyPair.
+	State         KeyPairState `protobuf:"varint,2,opt,name=state,proto3,enum=teleport.recordingencryption.v1.KeyPairState" json:"state,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FingerprintWithState) Reset() {
+	*x = FingerprintWithState{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FingerprintWithState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FingerprintWithState) ProtoMessage() {}
+
+func (x *FingerprintWithState) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FingerprintWithState.ProtoReflect.Descriptor instead.
+func (*FingerprintWithState) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *FingerprintWithState) GetFingerprint() string {
+	if x != nil {
+		return x.Fingerprint
+	}
+	return ""
+}
+
+func (x *FingerprintWithState) GetState() KeyPairState {
+	if x != nil {
+		return x.State
+	}
+	return KeyPairState_KEY_PAIR_STATE_UNSPECIFIED
+}
+
+// The current state of all active encryption key pairs.
+type GetRotationStateResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NextPageToken string                 `protobuf:"bytes,1,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	// The state of all active encryption key pairs.
+	KeyPairStates []*FingerprintWithState `protobuf:"bytes,2,rep,name=key_pair_states,json=keyPairStates,proto3" json:"key_pair_states,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRotationStateResponse) Reset() {
+	*x = GetRotationStateResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRotationStateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRotationStateResponse) ProtoMessage() {}
+
+func (x *GetRotationStateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRotationStateResponse.ProtoReflect.Descriptor instead.
+func (*GetRotationStateResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *GetRotationStateResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+func (x *GetRotationStateResponse) GetKeyPairStates() []*FingerprintWithState {
+	if x != nil {
+		return x.KeyPairStates
+	}
+	return nil
+}
+
+// The body of a CompleteRotation request.
+type CompleteRotationRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CompleteRotationRequest) Reset() {
+	*x = CompleteRotationRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CompleteRotationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CompleteRotationRequest) ProtoMessage() {}
+
+func (x *CompleteRotationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CompleteRotationRequest.ProtoReflect.Descriptor instead.
+func (*CompleteRotationRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{13}
+}
+
+// The return value of a CompleteRotation request.
+type CompleteRotationResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CompleteRotationResponse) Reset() {
+	*x = CompleteRotationResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CompleteRotationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CompleteRotationResponse) ProtoMessage() {}
+
+func (x *CompleteRotationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CompleteRotationResponse.ProtoReflect.Descriptor instead.
+func (*CompleteRotationResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{14}
+}
+
+// The body of a RollbackRotation request.
+type RollbackRotationRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RollbackRotationRequest) Reset() {
+	*x = RollbackRotationRequest{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RollbackRotationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RollbackRotationRequest) ProtoMessage() {}
+
+func (x *RollbackRotationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RollbackRotationRequest.ProtoReflect.Descriptor instead.
+func (*RollbackRotationRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{15}
+}
+
+// The return value of a RollbackRotation request
+type RollbackRotationResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RollbackRotationResponse) Reset() {
+	*x = RollbackRotationResponse{}
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RollbackRotationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RollbackRotationResponse) ProtoMessage() {}
+
+func (x *RollbackRotationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RollbackRotationResponse.ProtoReflect.Descriptor instead.
+func (*RollbackRotationResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP(), []int{16}
+}
+
+var File_teleport_recordingencryption_v1_recording_encryption_service_proto protoreflect.FileDescriptor
+
+const file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDesc = "" +
+	"\n" +
+	"Bteleport/recordingencryption/v1/recording_encryption_service.proto\x12\x1fteleport.recordingencryption.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\"\x83\x01\n" +
+	"\x06Upload\x12\x1b\n" +
+	"\tupload_id\x18\x01 \x01(\tR\buploadId\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x02 \x01(\tR\tsessionId\x12=\n" +
+	"\finitiated_at\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\vinitiatedAt\"4\n" +
+	"\x13CreateUploadRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\"W\n" +
+	"\x14CreateUploadResponse\x12?\n" +
+	"\x06upload\x18\x01 \x01(\v2'.teleport.recordingencryption.v1.UploadR\x06upload\"\xa2\x01\n" +
+	"\x11UploadPartRequest\x12?\n" +
+	"\x06upload\x18\x01 \x01(\v2'.teleport.recordingencryption.v1.UploadR\x06upload\x12\x1f\n" +
+	"\vpart_number\x18\x02 \x01(\x03R\n" +
+	"partNumber\x12\x12\n" +
+	"\x04part\x18\x03 \x01(\fR\x04part\x12\x17\n" +
+	"\ais_last\x18\x04 \x01(\bR\x06isLast\";\n" +
+	"\x04Part\x12\x1f\n" +
+	"\vpart_number\x18\x01 \x01(\x03R\n" +
+	"partNumber\x12\x12\n" +
+	"\x04etag\x18\x02 \x01(\tR\x04etag\"O\n" +
+	"\x12UploadPartResponse\x129\n" +
+	"\x04part\x18\x01 \x01(\v2%.teleport.recordingencryption.v1.PartR\x04part\"\x95\x01\n" +
+	"\x15CompleteUploadRequest\x12?\n" +
+	"\x06upload\x18\x01 \x01(\v2'.teleport.recordingencryption.v1.UploadR\x06upload\x12;\n" +
+	"\x05parts\x18\x02 \x03(\v2%.teleport.recordingencryption.v1.PartR\x05parts\"\x18\n" +
+	"\x16CompleteUploadResponse\"\x12\n" +
+	"\x10RotateKeyRequest\"\x13\n" +
+	"\x11RotateKeyResponse\"U\n" +
+	"\x17GetRotationStateRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"}\n" +
+	"\x14FingerprintWithState\x12 \n" +
+	"\vfingerprint\x18\x01 \x01(\tR\vfingerprint\x12C\n" +
+	"\x05state\x18\x02 \x01(\x0e2-.teleport.recordingencryption.v1.KeyPairStateR\x05state\"\xa1\x01\n" +
+	"\x18GetRotationStateResponse\x12&\n" +
+	"\x0fnext_page_token\x18\x01 \x01(\tR\rnextPageToken\x12]\n" +
+	"\x0fkey_pair_states\x18\x02 \x03(\v25.teleport.recordingencryption.v1.FingerprintWithStateR\rkeyPairStates\"\x19\n" +
+	"\x17CompleteRotationRequest\"\x1a\n" +
+	"\x18CompleteRotationResponse\"\x19\n" +
+	"\x17RollbackRotationRequest\"\x1a\n" +
+	"\x18RollbackRotationResponse2\xa6\a\n" +
+	"\x1aRecordingEncryptionService\x12{\n" +
+	"\fCreateUpload\x124.teleport.recordingencryption.v1.CreateUploadRequest\x1a5.teleport.recordingencryption.v1.CreateUploadResponse\x12u\n" +
+	"\n" +
+	"UploadPart\x122.teleport.recordingencryption.v1.UploadPartRequest\x1a3.teleport.recordingencryption.v1.UploadPartResponse\x12\x81\x01\n" +
+	"\x0eCompleteUpload\x126.teleport.recordingencryption.v1.CompleteUploadRequest\x1a7.teleport.recordingencryption.v1.CompleteUploadResponse\x12r\n" +
+	"\tRotateKey\x121.teleport.recordingencryption.v1.RotateKeyRequest\x1a2.teleport.recordingencryption.v1.RotateKeyResponse\x12\x87\x01\n" +
+	"\x10GetRotationState\x128.teleport.recordingencryption.v1.GetRotationStateRequest\x1a9.teleport.recordingencryption.v1.GetRotationStateResponse\x12\x87\x01\n" +
+	"\x10CompleteRotation\x128.teleport.recordingencryption.v1.CompleteRotationRequest\x1a9.teleport.recordingencryption.v1.CompleteRotationResponse\x12\x87\x01\n" +
+	"\x10RollbackRotation\x128.teleport.recordingencryption.v1.RollbackRotationRequest\x1a9.teleport.recordingencryption.v1.RollbackRotationResponseBjZhgithub.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1;recordingencryptionv1b\x06proto3"
+
+var (
+	file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescOnce sync.Once
+	file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescData []byte
+)
+
+func file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescGZIP() []byte {
+	file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescOnce.Do(func() {
+		file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDesc), len(file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDesc)))
+	})
+	return file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDescData
+}
+
+var file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
+var file_teleport_recordingencryption_v1_recording_encryption_service_proto_goTypes = []any{
+	(*Upload)(nil),                   // 0: teleport.recordingencryption.v1.Upload
+	(*CreateUploadRequest)(nil),      // 1: teleport.recordingencryption.v1.CreateUploadRequest
+	(*CreateUploadResponse)(nil),     // 2: teleport.recordingencryption.v1.CreateUploadResponse
+	(*UploadPartRequest)(nil),        // 3: teleport.recordingencryption.v1.UploadPartRequest
+	(*Part)(nil),                     // 4: teleport.recordingencryption.v1.Part
+	(*UploadPartResponse)(nil),       // 5: teleport.recordingencryption.v1.UploadPartResponse
+	(*CompleteUploadRequest)(nil),    // 6: teleport.recordingencryption.v1.CompleteUploadRequest
+	(*CompleteUploadResponse)(nil),   // 7: teleport.recordingencryption.v1.CompleteUploadResponse
+	(*RotateKeyRequest)(nil),         // 8: teleport.recordingencryption.v1.RotateKeyRequest
+	(*RotateKeyResponse)(nil),        // 9: teleport.recordingencryption.v1.RotateKeyResponse
+	(*GetRotationStateRequest)(nil),  // 10: teleport.recordingencryption.v1.GetRotationStateRequest
+	(*FingerprintWithState)(nil),     // 11: teleport.recordingencryption.v1.FingerprintWithState
+	(*GetRotationStateResponse)(nil), // 12: teleport.recordingencryption.v1.GetRotationStateResponse
+	(*CompleteRotationRequest)(nil),  // 13: teleport.recordingencryption.v1.CompleteRotationRequest
+	(*CompleteRotationResponse)(nil), // 14: teleport.recordingencryption.v1.CompleteRotationResponse
+	(*RollbackRotationRequest)(nil),  // 15: teleport.recordingencryption.v1.RollbackRotationRequest
+	(*RollbackRotationResponse)(nil), // 16: teleport.recordingencryption.v1.RollbackRotationResponse
+	(*timestamppb.Timestamp)(nil),    // 17: google.protobuf.Timestamp
+	(KeyPairState)(0),                // 18: teleport.recordingencryption.v1.KeyPairState
+}
+var file_teleport_recordingencryption_v1_recording_encryption_service_proto_depIdxs = []int32{
+	17, // 0: teleport.recordingencryption.v1.Upload.initiated_at:type_name -> google.protobuf.Timestamp
+	0,  // 1: teleport.recordingencryption.v1.CreateUploadResponse.upload:type_name -> teleport.recordingencryption.v1.Upload
+	0,  // 2: teleport.recordingencryption.v1.UploadPartRequest.upload:type_name -> teleport.recordingencryption.v1.Upload
+	4,  // 3: teleport.recordingencryption.v1.UploadPartResponse.part:type_name -> teleport.recordingencryption.v1.Part
+	0,  // 4: teleport.recordingencryption.v1.CompleteUploadRequest.upload:type_name -> teleport.recordingencryption.v1.Upload
+	4,  // 5: teleport.recordingencryption.v1.CompleteUploadRequest.parts:type_name -> teleport.recordingencryption.v1.Part
+	18, // 6: teleport.recordingencryption.v1.FingerprintWithState.state:type_name -> teleport.recordingencryption.v1.KeyPairState
+	11, // 7: teleport.recordingencryption.v1.GetRotationStateResponse.key_pair_states:type_name -> teleport.recordingencryption.v1.FingerprintWithState
+	1,  // 8: teleport.recordingencryption.v1.RecordingEncryptionService.CreateUpload:input_type -> teleport.recordingencryption.v1.CreateUploadRequest
+	3,  // 9: teleport.recordingencryption.v1.RecordingEncryptionService.UploadPart:input_type -> teleport.recordingencryption.v1.UploadPartRequest
+	6,  // 10: teleport.recordingencryption.v1.RecordingEncryptionService.CompleteUpload:input_type -> teleport.recordingencryption.v1.CompleteUploadRequest
+	8,  // 11: teleport.recordingencryption.v1.RecordingEncryptionService.RotateKey:input_type -> teleport.recordingencryption.v1.RotateKeyRequest
+	10, // 12: teleport.recordingencryption.v1.RecordingEncryptionService.GetRotationState:input_type -> teleport.recordingencryption.v1.GetRotationStateRequest
+	13, // 13: teleport.recordingencryption.v1.RecordingEncryptionService.CompleteRotation:input_type -> teleport.recordingencryption.v1.CompleteRotationRequest
+	15, // 14: teleport.recordingencryption.v1.RecordingEncryptionService.RollbackRotation:input_type -> teleport.recordingencryption.v1.RollbackRotationRequest
+	2,  // 15: teleport.recordingencryption.v1.RecordingEncryptionService.CreateUpload:output_type -> teleport.recordingencryption.v1.CreateUploadResponse
+	5,  // 16: teleport.recordingencryption.v1.RecordingEncryptionService.UploadPart:output_type -> teleport.recordingencryption.v1.UploadPartResponse
+	7,  // 17: teleport.recordingencryption.v1.RecordingEncryptionService.CompleteUpload:output_type -> teleport.recordingencryption.v1.CompleteUploadResponse
+	9,  // 18: teleport.recordingencryption.v1.RecordingEncryptionService.RotateKey:output_type -> teleport.recordingencryption.v1.RotateKeyResponse
+	12, // 19: teleport.recordingencryption.v1.RecordingEncryptionService.GetRotationState:output_type -> teleport.recordingencryption.v1.GetRotationStateResponse
+	14, // 20: teleport.recordingencryption.v1.RecordingEncryptionService.CompleteRotation:output_type -> teleport.recordingencryption.v1.CompleteRotationResponse
+	16, // 21: teleport.recordingencryption.v1.RecordingEncryptionService.RollbackRotation:output_type -> teleport.recordingencryption.v1.RollbackRotationResponse
+	15, // [15:22] is the sub-list for method output_type
+	8,  // [8:15] is the sub-list for method input_type
+	8,  // [8:8] is the sub-list for extension type_name
+	8,  // [8:8] is the sub-list for extension extendee
+	0,  // [0:8] is the sub-list for field type_name
+}
+
+func init() { file_teleport_recordingencryption_v1_recording_encryption_service_proto_init() }
+func file_teleport_recordingencryption_v1_recording_encryption_service_proto_init() {
+	if File_teleport_recordingencryption_v1_recording_encryption_service_proto != nil {
+		return
+	}
+	file_teleport_recordingencryption_v1_recording_encryption_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDesc), len(file_teleport_recordingencryption_v1_recording_encryption_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   17,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_recordingencryption_v1_recording_encryption_service_proto_goTypes,
+		DependencyIndexes: file_teleport_recordingencryption_v1_recording_encryption_service_proto_depIdxs,
+		MessageInfos:      file_teleport_recordingencryption_v1_recording_encryption_service_proto_msgTypes,
+	}.Build()
+	File_teleport_recordingencryption_v1_recording_encryption_service_proto = out.File
+	file_teleport_recordingencryption_v1_recording_encryption_service_proto_goTypes = nil
+	file_teleport_recordingencryption_v1_recording_encryption_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service_grpc.pb.go b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service_grpc.pb.go
new file mode 100644
index 0000000000000..2227d21eea726
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingencryption/v1/recording_encryption_service_grpc.pb.go
@@ -0,0 +1,384 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/recordingencryption/v1/recording_encryption_service.proto
+
+package recordingencryptionv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	RecordingEncryptionService_CreateUpload_FullMethodName     = "/teleport.recordingencryption.v1.RecordingEncryptionService/CreateUpload"
+	RecordingEncryptionService_UploadPart_FullMethodName       = "/teleport.recordingencryption.v1.RecordingEncryptionService/UploadPart"
+	RecordingEncryptionService_CompleteUpload_FullMethodName   = "/teleport.recordingencryption.v1.RecordingEncryptionService/CompleteUpload"
+	RecordingEncryptionService_RotateKey_FullMethodName        = "/teleport.recordingencryption.v1.RecordingEncryptionService/RotateKey"
+	RecordingEncryptionService_GetRotationState_FullMethodName = "/teleport.recordingencryption.v1.RecordingEncryptionService/GetRotationState"
+	RecordingEncryptionService_CompleteRotation_FullMethodName = "/teleport.recordingencryption.v1.RecordingEncryptionService/CompleteRotation"
+	RecordingEncryptionService_RollbackRotation_FullMethodName = "/teleport.recordingencryption.v1.RecordingEncryptionService/RollbackRotation"
+)
+
+// RecordingEncryptionServiceClient is the client API for RecordingEncryptionService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// RecordingEncryption provides methods to manage cluster encryption configuration resources.
+type RecordingEncryptionServiceClient interface {
+	// CreateUpload begins a multipart upload for an encrypted recording. The
+	// returned upload ID should be used while uploading parts.
+	CreateUpload(ctx context.Context, in *CreateUploadRequest, opts ...grpc.CallOption) (*CreateUploadResponse, error)
+	// UploadPart uploads a part to the given upload ID.
+	UploadPart(ctx context.Context, in *UploadPartRequest, opts ...grpc.CallOption) (*UploadPartResponse, error)
+	// CompleteUploadRequest marks a multipart upload as complete.
+	CompleteUpload(ctx context.Context, in *CompleteUploadRequest, opts ...grpc.CallOption) (*CompleteUploadResponse, error)
+	// RotateKey rotates the key pair used for encrypting session recording data.
+	RotateKey(ctx context.Context, in *RotateKeyRequest, opts ...grpc.CallOption) (*RotateKeyResponse, error)
+	// GetRotationState returns whether or not a rotation is in progress.
+	GetRotationState(ctx context.Context, in *GetRotationStateRequest, opts ...grpc.CallOption) (*GetRotationStateResponse, error)
+	// CompleteRotation moves rotated keys out of the active set.
+	CompleteRotation(ctx context.Context, in *CompleteRotationRequest, opts ...grpc.CallOption) (*CompleteRotationResponse, error)
+	// RollbackRotation removes active keys and reverts rotating keys back to being active.
+	RollbackRotation(ctx context.Context, in *RollbackRotationRequest, opts ...grpc.CallOption) (*RollbackRotationResponse, error)
+}
+
+type recordingEncryptionServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewRecordingEncryptionServiceClient(cc grpc.ClientConnInterface) RecordingEncryptionServiceClient {
+	return &recordingEncryptionServiceClient{cc}
+}
+
+func (c *recordingEncryptionServiceClient) CreateUpload(ctx context.Context, in *CreateUploadRequest, opts ...grpc.CallOption) (*CreateUploadResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateUploadResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_CreateUpload_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) UploadPart(ctx context.Context, in *UploadPartRequest, opts ...grpc.CallOption) (*UploadPartResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UploadPartResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_UploadPart_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) CompleteUpload(ctx context.Context, in *CompleteUploadRequest, opts ...grpc.CallOption) (*CompleteUploadResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CompleteUploadResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_CompleteUpload_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) RotateKey(ctx context.Context, in *RotateKeyRequest, opts ...grpc.CallOption) (*RotateKeyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RotateKeyResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_RotateKey_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) GetRotationState(ctx context.Context, in *GetRotationStateRequest, opts ...grpc.CallOption) (*GetRotationStateResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetRotationStateResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_GetRotationState_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) CompleteRotation(ctx context.Context, in *CompleteRotationRequest, opts ...grpc.CallOption) (*CompleteRotationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CompleteRotationResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_CompleteRotation_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingEncryptionServiceClient) RollbackRotation(ctx context.Context, in *RollbackRotationRequest, opts ...grpc.CallOption) (*RollbackRotationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RollbackRotationResponse)
+	err := c.cc.Invoke(ctx, RecordingEncryptionService_RollbackRotation_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// RecordingEncryptionServiceServer is the server API for RecordingEncryptionService service.
+// All implementations must embed UnimplementedRecordingEncryptionServiceServer
+// for forward compatibility.
+//
+// RecordingEncryption provides methods to manage cluster encryption configuration resources.
+type RecordingEncryptionServiceServer interface {
+	// CreateUpload begins a multipart upload for an encrypted recording. The
+	// returned upload ID should be used while uploading parts.
+	CreateUpload(context.Context, *CreateUploadRequest) (*CreateUploadResponse, error)
+	// UploadPart uploads a part to the given upload ID.
+	UploadPart(context.Context, *UploadPartRequest) (*UploadPartResponse, error)
+	// CompleteUploadRequest marks a multipart upload as complete.
+	CompleteUpload(context.Context, *CompleteUploadRequest) (*CompleteUploadResponse, error)
+	// RotateKey rotates the key pair used for encrypting session recording data.
+	RotateKey(context.Context, *RotateKeyRequest) (*RotateKeyResponse, error)
+	// GetRotationState returns whether or not a rotation is in progress.
+	GetRotationState(context.Context, *GetRotationStateRequest) (*GetRotationStateResponse, error)
+	// CompleteRotation moves rotated keys out of the active set.
+	CompleteRotation(context.Context, *CompleteRotationRequest) (*CompleteRotationResponse, error)
+	// RollbackRotation removes active keys and reverts rotating keys back to being active.
+	RollbackRotation(context.Context, *RollbackRotationRequest) (*RollbackRotationResponse, error)
+	mustEmbedUnimplementedRecordingEncryptionServiceServer()
+}
+
+// UnimplementedRecordingEncryptionServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRecordingEncryptionServiceServer struct{}
+
+func (UnimplementedRecordingEncryptionServiceServer) CreateUpload(context.Context, *CreateUploadRequest) (*CreateUploadResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateUpload not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) UploadPart(context.Context, *UploadPartRequest) (*UploadPartResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UploadPart not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) CompleteUpload(context.Context, *CompleteUploadRequest) (*CompleteUploadResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CompleteUpload not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) RotateKey(context.Context, *RotateKeyRequest) (*RotateKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RotateKey not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) GetRotationState(context.Context, *GetRotationStateRequest) (*GetRotationStateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetRotationState not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) CompleteRotation(context.Context, *CompleteRotationRequest) (*CompleteRotationResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CompleteRotation not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) RollbackRotation(context.Context, *RollbackRotationRequest) (*RollbackRotationResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RollbackRotation not implemented")
+}
+func (UnimplementedRecordingEncryptionServiceServer) mustEmbedUnimplementedRecordingEncryptionServiceServer() {
+}
+func (UnimplementedRecordingEncryptionServiceServer) testEmbeddedByValue() {}
+
+// UnsafeRecordingEncryptionServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RecordingEncryptionServiceServer will
+// result in compilation errors.
+type UnsafeRecordingEncryptionServiceServer interface {
+	mustEmbedUnimplementedRecordingEncryptionServiceServer()
+}
+
+func RegisterRecordingEncryptionServiceServer(s grpc.ServiceRegistrar, srv RecordingEncryptionServiceServer) {
+	// If the following call pancis, it indicates UnimplementedRecordingEncryptionServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RecordingEncryptionService_ServiceDesc, srv)
+}
+
+func _RecordingEncryptionService_CreateUpload_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateUploadRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).CreateUpload(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_CreateUpload_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).CreateUpload(ctx, req.(*CreateUploadRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_UploadPart_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UploadPartRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).UploadPart(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_UploadPart_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).UploadPart(ctx, req.(*UploadPartRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_CompleteUpload_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CompleteUploadRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).CompleteUpload(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_CompleteUpload_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).CompleteUpload(ctx, req.(*CompleteUploadRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_RotateKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RotateKeyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).RotateKey(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_RotateKey_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).RotateKey(ctx, req.(*RotateKeyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_GetRotationState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRotationStateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).GetRotationState(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_GetRotationState_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).GetRotationState(ctx, req.(*GetRotationStateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_CompleteRotation_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CompleteRotationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).CompleteRotation(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_CompleteRotation_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).CompleteRotation(ctx, req.(*CompleteRotationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingEncryptionService_RollbackRotation_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RollbackRotationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingEncryptionServiceServer).RollbackRotation(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingEncryptionService_RollbackRotation_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingEncryptionServiceServer).RollbackRotation(ctx, req.(*RollbackRotationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RecordingEncryptionService_ServiceDesc is the grpc.ServiceDesc for RecordingEncryptionService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RecordingEncryptionService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.recordingencryption.v1.RecordingEncryptionService",
+	HandlerType: (*RecordingEncryptionServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CreateUpload",
+			Handler:    _RecordingEncryptionService_CreateUpload_Handler,
+		},
+		{
+			MethodName: "UploadPart",
+			Handler:    _RecordingEncryptionService_UploadPart_Handler,
+		},
+		{
+			MethodName: "CompleteUpload",
+			Handler:    _RecordingEncryptionService_CompleteUpload_Handler,
+		},
+		{
+			MethodName: "RotateKey",
+			Handler:    _RecordingEncryptionService_RotateKey_Handler,
+		},
+		{
+			MethodName: "GetRotationState",
+			Handler:    _RecordingEncryptionService_GetRotationState_Handler,
+		},
+		{
+			MethodName: "CompleteRotation",
+			Handler:    _RecordingEncryptionService_CompleteRotation_Handler,
+		},
+		{
+			MethodName: "RollbackRotation",
+			Handler:    _RecordingEncryptionService_RollbackRotation_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/recordingencryption/v1/recording_encryption_service.proto",
+}
diff --git a/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata.pb.go b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata.pb.go
new file mode 100644
index 0000000000000..41a032264509a
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata.pb.go
@@ -0,0 +1,712 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// SessionRecordingEvent is an event that occurred during a session recording.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/recordingmetadata/v1/recordingmetadata.proto
+
+package recordingmetadatav1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// SessionRecordingType is the type of session recording.
+type SessionRecordingType int32
+
+const (
+	// SessionRecordingTypeUnspecified is the default value for session recording type.
+	SessionRecordingType_SESSION_RECORDING_TYPE_UNSPECIFIED SessionRecordingType = 0
+	// SessionRecordingTypeSsh is an interactive SSH session recording.
+	SessionRecordingType_SESSION_RECORDING_TYPE_SSH SessionRecordingType = 1
+	// SessionRecordingTypeKubernetes is an interactive Kubernetes session recording.
+	SessionRecordingType_SESSION_RECORDING_TYPE_KUBERNETES SessionRecordingType = 2
+)
+
+// Enum value maps for SessionRecordingType.
+var (
+	SessionRecordingType_name = map[int32]string{
+		0: "SESSION_RECORDING_TYPE_UNSPECIFIED",
+		1: "SESSION_RECORDING_TYPE_SSH",
+		2: "SESSION_RECORDING_TYPE_KUBERNETES",
+	}
+	SessionRecordingType_value = map[string]int32{
+		"SESSION_RECORDING_TYPE_UNSPECIFIED": 0,
+		"SESSION_RECORDING_TYPE_SSH":         1,
+		"SESSION_RECORDING_TYPE_KUBERNETES":  2,
+	}
+)
+
+func (x SessionRecordingType) Enum() *SessionRecordingType {
+	p := new(SessionRecordingType)
+	*p = x
+	return p
+}
+
+func (x SessionRecordingType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SessionRecordingType) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_enumTypes[0].Descriptor()
+}
+
+func (SessionRecordingType) Type() protoreflect.EnumType {
+	return &file_teleport_recordingmetadata_v1_recordingmetadata_proto_enumTypes[0]
+}
+
+func (x SessionRecordingType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SessionRecordingType.Descriptor instead.
+func (SessionRecordingType) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{0}
+}
+
+// SessionRecordingEvent represents an event that occurred during a session recording.
+type SessionRecordingEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// StartOffset is the start time of the event, relative to the start of the session.
+	StartOffset *durationpb.Duration `protobuf:"bytes,1,opt,name=start_offset,json=startOffset,proto3" json:"start_offset,omitempty"`
+	// EndOffset is the end time of the event, relative to the start of the session.
+	EndOffset *durationpb.Duration `protobuf:"bytes,2,opt,name=end_offset,json=endOffset,proto3" json:"end_offset,omitempty"`
+	// Types that are valid to be assigned to Event:
+	//
+	//	*SessionRecordingEvent_Inactivity
+	//	*SessionRecordingEvent_Join
+	//	*SessionRecordingEvent_Resize
+	Event         isSessionRecordingEvent_Event `protobuf_oneof:"event"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingEvent) Reset() {
+	*x = SessionRecordingEvent{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingEvent) ProtoMessage() {}
+
+func (x *SessionRecordingEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingEvent.ProtoReflect.Descriptor instead.
+func (*SessionRecordingEvent) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *SessionRecordingEvent) GetStartOffset() *durationpb.Duration {
+	if x != nil {
+		return x.StartOffset
+	}
+	return nil
+}
+
+func (x *SessionRecordingEvent) GetEndOffset() *durationpb.Duration {
+	if x != nil {
+		return x.EndOffset
+	}
+	return nil
+}
+
+func (x *SessionRecordingEvent) GetEvent() isSessionRecordingEvent_Event {
+	if x != nil {
+		return x.Event
+	}
+	return nil
+}
+
+func (x *SessionRecordingEvent) GetInactivity() *SessionRecordingInactivityEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SessionRecordingEvent_Inactivity); ok {
+			return x.Inactivity
+		}
+	}
+	return nil
+}
+
+func (x *SessionRecordingEvent) GetJoin() *SessionRecordingJoinEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SessionRecordingEvent_Join); ok {
+			return x.Join
+		}
+	}
+	return nil
+}
+
+func (x *SessionRecordingEvent) GetResize() *SessionRecordingResizeEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SessionRecordingEvent_Resize); ok {
+			return x.Resize
+		}
+	}
+	return nil
+}
+
+type isSessionRecordingEvent_Event interface {
+	isSessionRecordingEvent_Event()
+}
+
+type SessionRecordingEvent_Inactivity struct {
+	// Inactivity is an event that indicates inactivity during the session.
+	Inactivity *SessionRecordingInactivityEvent `protobuf:"bytes,3,opt,name=inactivity,proto3,oneof"`
+}
+
+type SessionRecordingEvent_Join struct {
+	// Join is an event that indicates a user joined the session.
+	Join *SessionRecordingJoinEvent `protobuf:"bytes,4,opt,name=join,proto3,oneof"`
+}
+
+type SessionRecordingEvent_Resize struct {
+	// Resize is an event that indicates the terminal was resized.
+	Resize *SessionRecordingResizeEvent `protobuf:"bytes,5,opt,name=resize,proto3,oneof"`
+}
+
+func (*SessionRecordingEvent_Inactivity) isSessionRecordingEvent_Event() {}
+
+func (*SessionRecordingEvent_Join) isSessionRecordingEvent_Event() {}
+
+func (*SessionRecordingEvent_Resize) isSessionRecordingEvent_Event() {}
+
+// SessionRecordingInactivityEvent is an event that indicates inactivity during the session.
+type SessionRecordingInactivityEvent struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingInactivityEvent) Reset() {
+	*x = SessionRecordingInactivityEvent{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingInactivityEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingInactivityEvent) ProtoMessage() {}
+
+func (x *SessionRecordingInactivityEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingInactivityEvent.ProtoReflect.Descriptor instead.
+func (*SessionRecordingInactivityEvent) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{1}
+}
+
+// SessionRecordingJoinEvent is an event that indicates a user joined the session.
+type SessionRecordingJoinEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// User is the name of the user who joined the session.
+	User          string `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingJoinEvent) Reset() {
+	*x = SessionRecordingJoinEvent{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingJoinEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingJoinEvent) ProtoMessage() {}
+
+func (x *SessionRecordingJoinEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingJoinEvent.ProtoReflect.Descriptor instead.
+func (*SessionRecordingJoinEvent) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *SessionRecordingJoinEvent) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+// SessionRecordingResizeEvent is an event that indicates the terminal was resized.
+type SessionRecordingResizeEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Cols is the number of columns in the terminal.
+	Cols int32 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"`
+	// Rows is the number of rows in the terminal.
+	Rows          int32 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingResizeEvent) Reset() {
+	*x = SessionRecordingResizeEvent{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingResizeEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingResizeEvent) ProtoMessage() {}
+
+func (x *SessionRecordingResizeEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingResizeEvent.ProtoReflect.Descriptor instead.
+func (*SessionRecordingResizeEvent) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *SessionRecordingResizeEvent) GetCols() int32 {
+	if x != nil {
+		return x.Cols
+	}
+	return 0
+}
+
+func (x *SessionRecordingResizeEvent) GetRows() int32 {
+	if x != nil {
+		return x.Rows
+	}
+	return 0
+}
+
+// SessionRecordingMetadata contains metadata for a session recording.
+type SessionRecordingMetadata struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Duration is the duration of the session recording.
+	Duration *durationpb.Duration `protobuf:"bytes,1,opt,name=duration,proto3" json:"duration,omitempty"`
+	// Events is the events that occurred during the session.
+	Events []*SessionRecordingEvent `protobuf:"bytes,2,rep,name=events,proto3" json:"events,omitempty"`
+	// StartCols is the number of columns in the terminal at the start of the session.
+	StartCols int32 `protobuf:"varint,3,opt,name=start_cols,json=startCols,proto3" json:"start_cols,omitempty"`
+	// StartRows is the number of rows in the terminal at the start of the session.
+	StartRows int32 `protobuf:"varint,4,opt,name=start_rows,json=startRows,proto3" json:"start_rows,omitempty"`
+	// StartTime is the start time of the session recording.
+	StartTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	// EndTime is the end time of the session recording.
+	EndTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	// ClusterName is the name of the cluster where the session recording took place.
+	ClusterName string `protobuf:"bytes,7,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
+	// User is the user whose session is being recorded.
+	User string `protobuf:"bytes,8,opt,name=user,proto3" json:"user,omitempty"`
+	// ResourceName is the name of the resource that was connected to.
+	ResourceName string `protobuf:"bytes,9,opt,name=resource_name,json=resourceName,proto3" json:"resource_name,omitempty"`
+	// Type is the type of session recording.
+	Type          SessionRecordingType `protobuf:"varint,10,opt,name=type,proto3,enum=teleport.recordingmetadata.v1.SessionRecordingType" json:"type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingMetadata) Reset() {
+	*x = SessionRecordingMetadata{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingMetadata) ProtoMessage() {}
+
+func (x *SessionRecordingMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingMetadata.ProtoReflect.Descriptor instead.
+func (*SessionRecordingMetadata) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *SessionRecordingMetadata) GetDuration() *durationpb.Duration {
+	if x != nil {
+		return x.Duration
+	}
+	return nil
+}
+
+func (x *SessionRecordingMetadata) GetEvents() []*SessionRecordingEvent {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+func (x *SessionRecordingMetadata) GetStartCols() int32 {
+	if x != nil {
+		return x.StartCols
+	}
+	return 0
+}
+
+func (x *SessionRecordingMetadata) GetStartRows() int32 {
+	if x != nil {
+		return x.StartRows
+	}
+	return 0
+}
+
+func (x *SessionRecordingMetadata) GetStartTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.StartTime
+	}
+	return nil
+}
+
+func (x *SessionRecordingMetadata) GetEndTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.EndTime
+	}
+	return nil
+}
+
+func (x *SessionRecordingMetadata) GetClusterName() string {
+	if x != nil {
+		return x.ClusterName
+	}
+	return ""
+}
+
+func (x *SessionRecordingMetadata) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *SessionRecordingMetadata) GetResourceName() string {
+	if x != nil {
+		return x.ResourceName
+	}
+	return ""
+}
+
+func (x *SessionRecordingMetadata) GetType() SessionRecordingType {
+	if x != nil {
+		return x.Type
+	}
+	return SessionRecordingType_SESSION_RECORDING_TYPE_UNSPECIFIED
+}
+
+// SessionRecordingThumbnail is a thumbnail of a session recording.
+type SessionRecordingThumbnail struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SVG is the SVG image of the thumbnail.
+	Svg []byte `protobuf:"bytes,1,opt,name=svg,proto3" json:"svg,omitempty"`
+	// Cols is the number of columns in the terminal.
+	Cols int32 `protobuf:"varint,2,opt,name=cols,proto3" json:"cols,omitempty"`
+	// Rows is the number of rows in the terminal.
+	Rows int32 `protobuf:"varint,3,opt,name=rows,proto3" json:"rows,omitempty"`
+	// CursorX is the X coordinate of the cursor.
+	CursorX int32 `protobuf:"varint,4,opt,name=cursor_x,json=cursorX,proto3" json:"cursor_x,omitempty"`
+	// CursorY is the Y coordinate of the cursor.
+	CursorY int32 `protobuf:"varint,5,opt,name=cursor_y,json=cursorY,proto3" json:"cursor_y,omitempty"`
+	// StartOffset is the start time of the thumbnail, relative to the start of the session.
+	StartOffset *durationpb.Duration `protobuf:"bytes,6,opt,name=start_offset,json=startOffset,proto3" json:"start_offset,omitempty"`
+	// EndOffset is the end time of the thumbnail, relative to the start of the session.
+	EndOffset *durationpb.Duration `protobuf:"bytes,7,opt,name=end_offset,json=endOffset,proto3" json:"end_offset,omitempty"`
+	// CursorVisible indicates whether the cursor is visible.
+	CursorVisible bool `protobuf:"varint,8,opt,name=cursor_visible,json=cursorVisible,proto3" json:"cursor_visible,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionRecordingThumbnail) Reset() {
+	*x = SessionRecordingThumbnail{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionRecordingThumbnail) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionRecordingThumbnail) ProtoMessage() {}
+
+func (x *SessionRecordingThumbnail) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionRecordingThumbnail.ProtoReflect.Descriptor instead.
+func (*SessionRecordingThumbnail) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *SessionRecordingThumbnail) GetSvg() []byte {
+	if x != nil {
+		return x.Svg
+	}
+	return nil
+}
+
+func (x *SessionRecordingThumbnail) GetCols() int32 {
+	if x != nil {
+		return x.Cols
+	}
+	return 0
+}
+
+func (x *SessionRecordingThumbnail) GetRows() int32 {
+	if x != nil {
+		return x.Rows
+	}
+	return 0
+}
+
+func (x *SessionRecordingThumbnail) GetCursorX() int32 {
+	if x != nil {
+		return x.CursorX
+	}
+	return 0
+}
+
+func (x *SessionRecordingThumbnail) GetCursorY() int32 {
+	if x != nil {
+		return x.CursorY
+	}
+	return 0
+}
+
+func (x *SessionRecordingThumbnail) GetStartOffset() *durationpb.Duration {
+	if x != nil {
+		return x.StartOffset
+	}
+	return nil
+}
+
+func (x *SessionRecordingThumbnail) GetEndOffset() *durationpb.Duration {
+	if x != nil {
+		return x.EndOffset
+	}
+	return nil
+}
+
+func (x *SessionRecordingThumbnail) GetCursorVisible() bool {
+	if x != nil {
+		return x.CursorVisible
+	}
+	return false
+}
+
+var File_teleport_recordingmetadata_v1_recordingmetadata_proto protoreflect.FileDescriptor
+
+const file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDesc = "" +
+	"\n" +
+	"5teleport/recordingmetadata/v1/recordingmetadata.proto\x12\x1dteleport.recordingmetadata.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xa0\x03\n" +
+	"\x15SessionRecordingEvent\x12<\n" +
+	"\fstart_offset\x18\x01 \x01(\v2\x19.google.protobuf.DurationR\vstartOffset\x128\n" +
+	"\n" +
+	"end_offset\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\tendOffset\x12`\n" +
+	"\n" +
+	"inactivity\x18\x03 \x01(\v2>.teleport.recordingmetadata.v1.SessionRecordingInactivityEventH\x00R\n" +
+	"inactivity\x12N\n" +
+	"\x04join\x18\x04 \x01(\v28.teleport.recordingmetadata.v1.SessionRecordingJoinEventH\x00R\x04join\x12T\n" +
+	"\x06resize\x18\x05 \x01(\v2:.teleport.recordingmetadata.v1.SessionRecordingResizeEventH\x00R\x06resizeB\a\n" +
+	"\x05event\"!\n" +
+	"\x1fSessionRecordingInactivityEvent\"/\n" +
+	"\x19SessionRecordingJoinEvent\x12\x12\n" +
+	"\x04user\x18\x01 \x01(\tR\x04user\"E\n" +
+	"\x1bSessionRecordingResizeEvent\x12\x12\n" +
+	"\x04cols\x18\x01 \x01(\x05R\x04cols\x12\x12\n" +
+	"\x04rows\x18\x02 \x01(\x05R\x04rows\"\xf4\x03\n" +
+	"\x18SessionRecordingMetadata\x125\n" +
+	"\bduration\x18\x01 \x01(\v2\x19.google.protobuf.DurationR\bduration\x12L\n" +
+	"\x06events\x18\x02 \x03(\v24.teleport.recordingmetadata.v1.SessionRecordingEventR\x06events\x12\x1d\n" +
+	"\n" +
+	"start_cols\x18\x03 \x01(\x05R\tstartCols\x12\x1d\n" +
+	"\n" +
+	"start_rows\x18\x04 \x01(\x05R\tstartRows\x129\n" +
+	"\n" +
+	"start_time\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\tstartTime\x125\n" +
+	"\bend_time\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\aendTime\x12!\n" +
+	"\fcluster_name\x18\a \x01(\tR\vclusterName\x12\x12\n" +
+	"\x04user\x18\b \x01(\tR\x04user\x12#\n" +
+	"\rresource_name\x18\t \x01(\tR\fresourceName\x12G\n" +
+	"\x04type\x18\n" +
+	" \x01(\x0e23.teleport.recordingmetadata.v1.SessionRecordingTypeR\x04type\"\xaa\x02\n" +
+	"\x19SessionRecordingThumbnail\x12\x10\n" +
+	"\x03svg\x18\x01 \x01(\fR\x03svg\x12\x12\n" +
+	"\x04cols\x18\x02 \x01(\x05R\x04cols\x12\x12\n" +
+	"\x04rows\x18\x03 \x01(\x05R\x04rows\x12\x19\n" +
+	"\bcursor_x\x18\x04 \x01(\x05R\acursorX\x12\x19\n" +
+	"\bcursor_y\x18\x05 \x01(\x05R\acursorY\x12<\n" +
+	"\fstart_offset\x18\x06 \x01(\v2\x19.google.protobuf.DurationR\vstartOffset\x128\n" +
+	"\n" +
+	"end_offset\x18\a \x01(\v2\x19.google.protobuf.DurationR\tendOffset\x12%\n" +
+	"\x0ecursor_visible\x18\b \x01(\bR\rcursorVisible*\x85\x01\n" +
+	"\x14SessionRecordingType\x12&\n" +
+	"\"SESSION_RECORDING_TYPE_UNSPECIFIED\x10\x00\x12\x1e\n" +
+	"\x1aSESSION_RECORDING_TYPE_SSH\x10\x01\x12%\n" +
+	"!SESSION_RECORDING_TYPE_KUBERNETES\x10\x02BfZdgithub.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1;recordingmetadatav1b\x06proto3"
+
+var (
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescOnce sync.Once
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescData []byte
+)
+
+func file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescGZIP() []byte {
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescOnce.Do(func() {
+		file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDesc), len(file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDesc)))
+	})
+	return file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDescData
+}
+
+var file_teleport_recordingmetadata_v1_recordingmetadata_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_teleport_recordingmetadata_v1_recordingmetadata_proto_goTypes = []any{
+	(SessionRecordingType)(0),               // 0: teleport.recordingmetadata.v1.SessionRecordingType
+	(*SessionRecordingEvent)(nil),           // 1: teleport.recordingmetadata.v1.SessionRecordingEvent
+	(*SessionRecordingInactivityEvent)(nil), // 2: teleport.recordingmetadata.v1.SessionRecordingInactivityEvent
+	(*SessionRecordingJoinEvent)(nil),       // 3: teleport.recordingmetadata.v1.SessionRecordingJoinEvent
+	(*SessionRecordingResizeEvent)(nil),     // 4: teleport.recordingmetadata.v1.SessionRecordingResizeEvent
+	(*SessionRecordingMetadata)(nil),        // 5: teleport.recordingmetadata.v1.SessionRecordingMetadata
+	(*SessionRecordingThumbnail)(nil),       // 6: teleport.recordingmetadata.v1.SessionRecordingThumbnail
+	(*durationpb.Duration)(nil),             // 7: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),           // 8: google.protobuf.Timestamp
+}
+var file_teleport_recordingmetadata_v1_recordingmetadata_proto_depIdxs = []int32{
+	7,  // 0: teleport.recordingmetadata.v1.SessionRecordingEvent.start_offset:type_name -> google.protobuf.Duration
+	7,  // 1: teleport.recordingmetadata.v1.SessionRecordingEvent.end_offset:type_name -> google.protobuf.Duration
+	2,  // 2: teleport.recordingmetadata.v1.SessionRecordingEvent.inactivity:type_name -> teleport.recordingmetadata.v1.SessionRecordingInactivityEvent
+	3,  // 3: teleport.recordingmetadata.v1.SessionRecordingEvent.join:type_name -> teleport.recordingmetadata.v1.SessionRecordingJoinEvent
+	4,  // 4: teleport.recordingmetadata.v1.SessionRecordingEvent.resize:type_name -> teleport.recordingmetadata.v1.SessionRecordingResizeEvent
+	7,  // 5: teleport.recordingmetadata.v1.SessionRecordingMetadata.duration:type_name -> google.protobuf.Duration
+	1,  // 6: teleport.recordingmetadata.v1.SessionRecordingMetadata.events:type_name -> teleport.recordingmetadata.v1.SessionRecordingEvent
+	8,  // 7: teleport.recordingmetadata.v1.SessionRecordingMetadata.start_time:type_name -> google.protobuf.Timestamp
+	8,  // 8: teleport.recordingmetadata.v1.SessionRecordingMetadata.end_time:type_name -> google.protobuf.Timestamp
+	0,  // 9: teleport.recordingmetadata.v1.SessionRecordingMetadata.type:type_name -> teleport.recordingmetadata.v1.SessionRecordingType
+	7,  // 10: teleport.recordingmetadata.v1.SessionRecordingThumbnail.start_offset:type_name -> google.protobuf.Duration
+	7,  // 11: teleport.recordingmetadata.v1.SessionRecordingThumbnail.end_offset:type_name -> google.protobuf.Duration
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
+}
+
+func init() { file_teleport_recordingmetadata_v1_recordingmetadata_proto_init() }
+func file_teleport_recordingmetadata_v1_recordingmetadata_proto_init() {
+	if File_teleport_recordingmetadata_v1_recordingmetadata_proto != nil {
+		return
+	}
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes[0].OneofWrappers = []any{
+		(*SessionRecordingEvent_Inactivity)(nil),
+		(*SessionRecordingEvent_Join)(nil),
+		(*SessionRecordingEvent_Resize)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDesc), len(file_teleport_recordingmetadata_v1_recordingmetadata_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_recordingmetadata_v1_recordingmetadata_proto_goTypes,
+		DependencyIndexes: file_teleport_recordingmetadata_v1_recordingmetadata_proto_depIdxs,
+		EnumInfos:         file_teleport_recordingmetadata_v1_recordingmetadata_proto_enumTypes,
+		MessageInfos:      file_teleport_recordingmetadata_v1_recordingmetadata_proto_msgTypes,
+	}.Build()
+	File_teleport_recordingmetadata_v1_recordingmetadata_proto = out.File
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_goTypes = nil
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service.pb.go b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service.pb.go
new file mode 100644
index 0000000000000..d4cc668e6ca15
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service.pb.go
@@ -0,0 +1,346 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/recordingmetadata/v1/recordingmetadata_service.proto
+
+package recordingmetadatav1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// GetMetadataResponseChunk is a chunked response for retrieving a session's metadata.
+// It can contain either metadata or a frame from the session recording.
+type GetMetadataResponseChunk struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Chunk:
+	//
+	//	*GetMetadataResponseChunk_Metadata
+	//	*GetMetadataResponseChunk_Frame
+	Chunk         isGetMetadataResponseChunk_Chunk `protobuf_oneof:"chunk"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetMetadataResponseChunk) Reset() {
+	*x = GetMetadataResponseChunk{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetMetadataResponseChunk) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMetadataResponseChunk) ProtoMessage() {}
+
+func (x *GetMetadataResponseChunk) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadataResponseChunk.ProtoReflect.Descriptor instead.
+func (*GetMetadataResponseChunk) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetMetadataResponseChunk) GetChunk() isGetMetadataResponseChunk_Chunk {
+	if x != nil {
+		return x.Chunk
+	}
+	return nil
+}
+
+func (x *GetMetadataResponseChunk) GetMetadata() *SessionRecordingMetadata {
+	if x != nil {
+		if x, ok := x.Chunk.(*GetMetadataResponseChunk_Metadata); ok {
+			return x.Metadata
+		}
+	}
+	return nil
+}
+
+func (x *GetMetadataResponseChunk) GetFrame() *SessionRecordingThumbnail {
+	if x != nil {
+		if x, ok := x.Chunk.(*GetMetadataResponseChunk_Frame); ok {
+			return x.Frame
+		}
+	}
+	return nil
+}
+
+type isGetMetadataResponseChunk_Chunk interface {
+	isGetMetadataResponseChunk_Chunk()
+}
+
+type GetMetadataResponseChunk_Metadata struct {
+	// Metadata contains the metadata of the session recording.
+	Metadata *SessionRecordingMetadata `protobuf:"bytes,1,opt,name=metadata,proto3,oneof"`
+}
+
+type GetMetadataResponseChunk_Frame struct {
+	// Frame contains a frame from the session recording.
+	Frame *SessionRecordingThumbnail `protobuf:"bytes,2,opt,name=frame,proto3,oneof"`
+}
+
+func (*GetMetadataResponseChunk_Metadata) isGetMetadataResponseChunk_Chunk() {}
+
+func (*GetMetadataResponseChunk_Frame) isGetMetadataResponseChunk_Chunk() {}
+
+// GetThumbnailRequest is a request for a session's thumbnail.
+type GetThumbnailRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SessionId is the ID of the session whose thumbnail is being requested.
+	SessionId     string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetThumbnailRequest) Reset() {
+	*x = GetThumbnailRequest{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetThumbnailRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetThumbnailRequest) ProtoMessage() {}
+
+func (x *GetThumbnailRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetThumbnailRequest.ProtoReflect.Descriptor instead.
+func (*GetThumbnailRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetThumbnailRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+// GetThumbnailResponse is a response for retrieving a session's thumbnail.
+type GetThumbnailResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Thumbnail is the thumbnail for the session.
+	Thumbnail     *SessionRecordingThumbnail `protobuf:"bytes,1,opt,name=thumbnail,proto3" json:"thumbnail,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetThumbnailResponse) Reset() {
+	*x = GetThumbnailResponse{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetThumbnailResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetThumbnailResponse) ProtoMessage() {}
+
+func (x *GetThumbnailResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetThumbnailResponse.ProtoReflect.Descriptor instead.
+func (*GetThumbnailResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetThumbnailResponse) GetThumbnail() *SessionRecordingThumbnail {
+	if x != nil {
+		return x.Thumbnail
+	}
+	return nil
+}
+
+// GetMetadataRequest is a request for retrieving a session's metadata.
+type GetMetadataRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SessionId is the ID of the session whose metadata is being requested.
+	SessionId     string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetMetadataRequest) Reset() {
+	*x = GetMetadataRequest{}
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetMetadataRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMetadataRequest) ProtoMessage() {}
+
+func (x *GetMetadataRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadataRequest.ProtoReflect.Descriptor instead.
+func (*GetMetadataRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetMetadataRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+var File_teleport_recordingmetadata_v1_recordingmetadata_service_proto protoreflect.FileDescriptor
+
+const file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDesc = "" +
+	"\n" +
+	"=teleport/recordingmetadata/v1/recordingmetadata_service.proto\x12\x1dteleport.recordingmetadata.v1\x1a5teleport/recordingmetadata/v1/recordingmetadata.proto\"\xcc\x01\n" +
+	"\x18GetMetadataResponseChunk\x12U\n" +
+	"\bmetadata\x18\x01 \x01(\v27.teleport.recordingmetadata.v1.SessionRecordingMetadataH\x00R\bmetadata\x12P\n" +
+	"\x05frame\x18\x02 \x01(\v28.teleport.recordingmetadata.v1.SessionRecordingThumbnailH\x00R\x05frameB\a\n" +
+	"\x05chunk\"4\n" +
+	"\x13GetThumbnailRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\"n\n" +
+	"\x14GetThumbnailResponse\x12V\n" +
+	"\tthumbnail\x18\x01 \x01(\v28.teleport.recordingmetadata.v1.SessionRecordingThumbnailR\tthumbnail\"3\n" +
+	"\x12GetMetadataRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId2\x90\x02\n" +
+	"\x18RecordingMetadataService\x12w\n" +
+	"\fGetThumbnail\x122.teleport.recordingmetadata.v1.GetThumbnailRequest\x1a3.teleport.recordingmetadata.v1.GetThumbnailResponse\x12{\n" +
+	"\vGetMetadata\x121.teleport.recordingmetadata.v1.GetMetadataRequest\x1a7.teleport.recordingmetadata.v1.GetMetadataResponseChunk0\x01BfZdgithub.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1;recordingmetadatav1b\x06proto3"
+
+var (
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescOnce sync.Once
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescData []byte
+)
+
+func file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescGZIP() []byte {
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescOnce.Do(func() {
+		file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDesc), len(file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDesc)))
+	})
+	return file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDescData
+}
+
+var file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_goTypes = []any{
+	(*GetMetadataResponseChunk)(nil),  // 0: teleport.recordingmetadata.v1.GetMetadataResponseChunk
+	(*GetThumbnailRequest)(nil),       // 1: teleport.recordingmetadata.v1.GetThumbnailRequest
+	(*GetThumbnailResponse)(nil),      // 2: teleport.recordingmetadata.v1.GetThumbnailResponse
+	(*GetMetadataRequest)(nil),        // 3: teleport.recordingmetadata.v1.GetMetadataRequest
+	(*SessionRecordingMetadata)(nil),  // 4: teleport.recordingmetadata.v1.SessionRecordingMetadata
+	(*SessionRecordingThumbnail)(nil), // 5: teleport.recordingmetadata.v1.SessionRecordingThumbnail
+}
+var file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_depIdxs = []int32{
+	4, // 0: teleport.recordingmetadata.v1.GetMetadataResponseChunk.metadata:type_name -> teleport.recordingmetadata.v1.SessionRecordingMetadata
+	5, // 1: teleport.recordingmetadata.v1.GetMetadataResponseChunk.frame:type_name -> teleport.recordingmetadata.v1.SessionRecordingThumbnail
+	5, // 2: teleport.recordingmetadata.v1.GetThumbnailResponse.thumbnail:type_name -> teleport.recordingmetadata.v1.SessionRecordingThumbnail
+	1, // 3: teleport.recordingmetadata.v1.RecordingMetadataService.GetThumbnail:input_type -> teleport.recordingmetadata.v1.GetThumbnailRequest
+	3, // 4: teleport.recordingmetadata.v1.RecordingMetadataService.GetMetadata:input_type -> teleport.recordingmetadata.v1.GetMetadataRequest
+	2, // 5: teleport.recordingmetadata.v1.RecordingMetadataService.GetThumbnail:output_type -> teleport.recordingmetadata.v1.GetThumbnailResponse
+	0, // 6: teleport.recordingmetadata.v1.RecordingMetadataService.GetMetadata:output_type -> teleport.recordingmetadata.v1.GetMetadataResponseChunk
+	5, // [5:7] is the sub-list for method output_type
+	3, // [3:5] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_init() }
+func file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_init() {
+	if File_teleport_recordingmetadata_v1_recordingmetadata_service_proto != nil {
+		return
+	}
+	file_teleport_recordingmetadata_v1_recordingmetadata_proto_init()
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes[0].OneofWrappers = []any{
+		(*GetMetadataResponseChunk_Metadata)(nil),
+		(*GetMetadataResponseChunk_Frame)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDesc), len(file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_goTypes,
+		DependencyIndexes: file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_depIdxs,
+		MessageInfos:      file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_msgTypes,
+	}.Build()
+	File_teleport_recordingmetadata_v1_recordingmetadata_service_proto = out.File
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_goTypes = nil
+	file_teleport_recordingmetadata_v1_recordingmetadata_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service_grpc.pb.go b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service_grpc.pb.go
new file mode 100644
index 0000000000000..4eca5cc2b0119
--- /dev/null
+++ b/api/gen/proto/go/teleport/recordingmetadata/v1/recordingmetadata_service_grpc.pb.go
@@ -0,0 +1,186 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/recordingmetadata/v1/recordingmetadata_service.proto
+
+package recordingmetadatav1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	RecordingMetadataService_GetThumbnail_FullMethodName = "/teleport.recordingmetadata.v1.RecordingMetadataService/GetThumbnail"
+	RecordingMetadataService_GetMetadata_FullMethodName  = "/teleport.recordingmetadata.v1.RecordingMetadataService/GetMetadata"
+)
+
+// RecordingMetadataServiceClient is the client API for RecordingMetadataService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// RecordingMetadataService provides methods to retrieve metadata and thumbnails for a session recording.
+type RecordingMetadataServiceClient interface {
+	// GetThumbnail retrieves the thumbnail for a session recording.
+	GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error)
+	// GetMetadata retrieves the metadata for a session recording.
+	GetMetadata(ctx context.Context, in *GetMetadataRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[GetMetadataResponseChunk], error)
+}
+
+type recordingMetadataServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewRecordingMetadataServiceClient(cc grpc.ClientConnInterface) RecordingMetadataServiceClient {
+	return &recordingMetadataServiceClient{cc}
+}
+
+func (c *recordingMetadataServiceClient) GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetThumbnailResponse)
+	err := c.cc.Invoke(ctx, RecordingMetadataService_GetThumbnail_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *recordingMetadataServiceClient) GetMetadata(ctx context.Context, in *GetMetadataRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[GetMetadataResponseChunk], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RecordingMetadataService_ServiceDesc.Streams[0], RecordingMetadataService_GetMetadata_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[GetMetadataRequest, GetMetadataResponseChunk]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RecordingMetadataService_GetMetadataClient = grpc.ServerStreamingClient[GetMetadataResponseChunk]
+
+// RecordingMetadataServiceServer is the server API for RecordingMetadataService service.
+// All implementations must embed UnimplementedRecordingMetadataServiceServer
+// for forward compatibility.
+//
+// RecordingMetadataService provides methods to retrieve metadata and thumbnails for a session recording.
+type RecordingMetadataServiceServer interface {
+	// GetThumbnail retrieves the thumbnail for a session recording.
+	GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error)
+	// GetMetadata retrieves the metadata for a session recording.
+	GetMetadata(*GetMetadataRequest, grpc.ServerStreamingServer[GetMetadataResponseChunk]) error
+	mustEmbedUnimplementedRecordingMetadataServiceServer()
+}
+
+// UnimplementedRecordingMetadataServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRecordingMetadataServiceServer struct{}
+
+func (UnimplementedRecordingMetadataServiceServer) GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetThumbnail not implemented")
+}
+func (UnimplementedRecordingMetadataServiceServer) GetMetadata(*GetMetadataRequest, grpc.ServerStreamingServer[GetMetadataResponseChunk]) error {
+	return status.Errorf(codes.Unimplemented, "method GetMetadata not implemented")
+}
+func (UnimplementedRecordingMetadataServiceServer) mustEmbedUnimplementedRecordingMetadataServiceServer() {
+}
+func (UnimplementedRecordingMetadataServiceServer) testEmbeddedByValue() {}
+
+// UnsafeRecordingMetadataServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RecordingMetadataServiceServer will
+// result in compilation errors.
+type UnsafeRecordingMetadataServiceServer interface {
+	mustEmbedUnimplementedRecordingMetadataServiceServer()
+}
+
+func RegisterRecordingMetadataServiceServer(s grpc.ServiceRegistrar, srv RecordingMetadataServiceServer) {
+	// If the following call pancis, it indicates UnimplementedRecordingMetadataServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RecordingMetadataService_ServiceDesc, srv)
+}
+
+func _RecordingMetadataService_GetThumbnail_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetThumbnailRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RecordingMetadataServiceServer).GetThumbnail(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RecordingMetadataService_GetThumbnail_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RecordingMetadataServiceServer).GetThumbnail(ctx, req.(*GetThumbnailRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RecordingMetadataService_GetMetadata_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(GetMetadataRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RecordingMetadataServiceServer).GetMetadata(m, &grpc.GenericServerStream[GetMetadataRequest, GetMetadataResponseChunk]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RecordingMetadataService_GetMetadataServer = grpc.ServerStreamingServer[GetMetadataResponseChunk]
+
+// RecordingMetadataService_ServiceDesc is the grpc.ServiceDesc for RecordingMetadataService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RecordingMetadataService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.recordingmetadata.v1.RecordingMetadataService",
+	HandlerType: (*RecordingMetadataServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetThumbnail",
+			Handler:    _RecordingMetadataService_GetThumbnail_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "GetMetadata",
+			Handler:       _RecordingMetadataService_GetMetadata_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "teleport/recordingmetadata/v1/recordingmetadata_service.proto",
+}
diff --git a/api/gen/proto/go/teleport/resourceusage/v1/access_requests.pb.go b/api/gen/proto/go/teleport/resourceusage/v1/access_requests.pb.go
index 774eb42c4f98e..9058f4c48707e 100644
--- a/api/gen/proto/go/teleport/resourceusage/v1/access_requests.pb.go
+++ b/api/gen/proto/go/teleport/resourceusage/v1/access_requests.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/resourceusage/v1/access_requests.proto
 
diff --git a/api/gen/proto/go/teleport/resourceusage/v1/account_usage_type.pb.go b/api/gen/proto/go/teleport/resourceusage/v1/account_usage_type.pb.go
index 7320449eef464..5188f973f0a4e 100644
--- a/api/gen/proto/go/teleport/resourceusage/v1/account_usage_type.pb.go
+++ b/api/gen/proto/go/teleport/resourceusage/v1/account_usage_type.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/resourceusage/v1/account_usage_type.proto
 
diff --git a/api/gen/proto/go/teleport/resourceusage/v1/device_trust.pb.go b/api/gen/proto/go/teleport/resourceusage/v1/device_trust.pb.go
index 3b2597a17a285..3dc67394263af 100644
--- a/api/gen/proto/go/teleport/resourceusage/v1/device_trust.pb.go
+++ b/api/gen/proto/go/teleport/resourceusage/v1/device_trust.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/resourceusage/v1/device_trust.proto
 
diff --git a/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service.pb.go b/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service.pb.go
index b129ae503aabc..533bf40df6fae 100644
--- a/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service.pb.go
+++ b/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/resourceusage/v1/resourceusage_service.proto
 
diff --git a/api/gen/proto/go/teleport/samlidp/v1/samlidp.pb.go b/api/gen/proto/go/teleport/samlidp/v1/samlidp.pb.go
index 26048cfd87fbc..787928b3fffa6 100644
--- a/api/gen/proto/go/teleport/samlidp/v1/samlidp.pb.go
+++ b/api/gen/proto/go/teleport/samlidp/v1/samlidp.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/samlidp/v1/samlidp.proto
 
diff --git a/api/gen/proto/go/teleport/scim/v1/scim_service.pb.go b/api/gen/proto/go/teleport/scim/v1/scim_service.pb.go
index 4c5a7baf3ee59..beed64c062fc5 100644
--- a/api/gen/proto/go/teleport/scim/v1/scim_service.pb.go
+++ b/api/gen/proto/go/teleport/scim/v1/scim_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/scim/v1/scim_service.proto
 
@@ -41,7 +41,7 @@ const (
 // ListSCIMResourcesRequest represents a request to fetch multiple resources
 type ListSCIMResourcesRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// Target describes the set of requested by the client, vy integration and
+	// Target describes the set of requested by the client, by integration and
 	// resource type.
 	Target *RequestTarget `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
 	// Page is an optional request to retrieve a page of results. Returns all
@@ -262,7 +262,7 @@ func (x *UpdateSCIMResourceRequest) GetResource() *Resource {
 	return nil
 }
 
-// DeleteSCIMResourceRequest describes a request to delete a SCIM-mamanged
+// DeleteSCIMResourceRequest describes a request to delete a SCIM-mananged
 // resource
 type DeleteSCIMResourceRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -671,6 +671,67 @@ func (x *Page) GetCount() uint64 {
 	return 0
 }
 
+// PatchSCIMResourceRequest describes a SCIM PATCH operation as per RFC 7644
+// Section 3.5.2. The PATCH operation allows modifying a resource with a set of
+// change operations, enabling partial updates without replacing the entire
+// resource.
+//
+// See https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2
+type PatchSCIMResourceRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Target identifies the resource to patch
+	Target *RequestTarget `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
+	// Payload is the SCIM PATCH Request payload containing the Operations array
+	// and schemas as defined in RFC 7644 Section 3.5.2.
+	Payload       *structpb.Struct `protobuf:"bytes,2,opt,name=payload,proto3" json:"payload,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PatchSCIMResourceRequest) Reset() {
+	*x = PatchSCIMResourceRequest{}
+	mi := &file_teleport_scim_v1_scim_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PatchSCIMResourceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PatchSCIMResourceRequest) ProtoMessage() {}
+
+func (x *PatchSCIMResourceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scim_v1_scim_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PatchSCIMResourceRequest.ProtoReflect.Descriptor instead.
+func (*PatchSCIMResourceRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scim_v1_scim_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *PatchSCIMResourceRequest) GetTarget() *RequestTarget {
+	if x != nil {
+		return x.Target
+	}
+	return nil
+}
+
+func (x *PatchSCIMResourceRequest) GetPayload() *structpb.Struct {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
 var File_teleport_scim_v1_scim_service_proto protoreflect.FileDescriptor
 
 const file_teleport_scim_v1_scim_service_proto_rawDesc = "" +
@@ -720,13 +781,17 @@ const file_teleport_scim_v1_scim_service_proto_rawDesc = "" +
 	"\x04Page\x12\x1f\n" +
 	"\vstart_index\x18\x01 \x01(\x04R\n" +
 	"startIndex\x12\x14\n" +
-	"\x05count\x18\x02 \x01(\x04R\x05count2\xe0\x03\n" +
+	"\x05count\x18\x02 \x01(\x04R\x05count\"\x86\x01\n" +
+	"\x18PatchSCIMResourceRequest\x127\n" +
+	"\x06target\x18\x01 \x01(\v2\x1f.teleport.scim.v1.RequestTargetR\x06target\x121\n" +
+	"\apayload\x18\x02 \x01(\v2\x17.google.protobuf.StructR\apayload2\xbd\x04\n" +
 	"\vSCIMService\x12_\n" +
 	"\x11ListSCIMResources\x12*.teleport.scim.v1.ListSCIMResourcesRequest\x1a\x1e.teleport.scim.v1.ResourceList\x12W\n" +
 	"\x0fGetSCIMResource\x12(.teleport.scim.v1.GetSCIMResourceRequest\x1a\x1a.teleport.scim.v1.Resource\x12]\n" +
 	"\x12CreateSCIMResource\x12+.teleport.scim.v1.CreateSCIMResourceRequest\x1a\x1a.teleport.scim.v1.Resource\x12]\n" +
 	"\x12UpdateSCIMResource\x12+.teleport.scim.v1.UpdateSCIMResourceRequest\x1a\x1a.teleport.scim.v1.Resource\x12Y\n" +
-	"\x12DeleteSCIMResource\x12+.teleport.scim.v1.DeleteSCIMResourceRequest\x1a\x16.google.protobuf.EmptyBLZJgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scim/v1;scimv1b\x06proto3"
+	"\x12DeleteSCIMResource\x12+.teleport.scim.v1.DeleteSCIMResourceRequest\x1a\x16.google.protobuf.Empty\x12[\n" +
+	"\x11PatchSCIMResource\x12*.teleport.scim.v1.PatchSCIMResourceRequest\x1a\x1a.teleport.scim.v1.ResourceBLZJgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scim/v1;scimv1b\x06proto3"
 
 var (
 	file_teleport_scim_v1_scim_service_proto_rawDescOnce sync.Once
@@ -740,7 +805,7 @@ func file_teleport_scim_v1_scim_service_proto_rawDescGZIP() []byte {
 	return file_teleport_scim_v1_scim_service_proto_rawDescData
 }
 
-var file_teleport_scim_v1_scim_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_teleport_scim_v1_scim_service_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_teleport_scim_v1_scim_service_proto_goTypes = []any{
 	(*ListSCIMResourcesRequest)(nil),  // 0: teleport.scim.v1.ListSCIMResourcesRequest
 	(*GetSCIMResourceRequest)(nil),    // 1: teleport.scim.v1.GetSCIMResourceRequest
@@ -752,9 +817,10 @@ var file_teleport_scim_v1_scim_service_proto_goTypes = []any{
 	(*ResourceList)(nil),              // 7: teleport.scim.v1.ResourceList
 	(*RequestTarget)(nil),             // 8: teleport.scim.v1.RequestTarget
 	(*Page)(nil),                      // 9: teleport.scim.v1.Page
-	(*structpb.Struct)(nil),           // 10: google.protobuf.Struct
-	(*timestamppb.Timestamp)(nil),     // 11: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),             // 12: google.protobuf.Empty
+	(*PatchSCIMResourceRequest)(nil),  // 10: teleport.scim.v1.PatchSCIMResourceRequest
+	(*structpb.Struct)(nil),           // 11: google.protobuf.Struct
+	(*timestamppb.Timestamp)(nil),     // 12: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),             // 13: google.protobuf.Empty
 }
 var file_teleport_scim_v1_scim_service_proto_depIdxs = []int32{
 	8,  // 0: teleport.scim.v1.ListSCIMResourcesRequest.target:type_name -> teleport.scim.v1.RequestTarget
@@ -766,25 +832,29 @@ var file_teleport_scim_v1_scim_service_proto_depIdxs = []int32{
 	5,  // 6: teleport.scim.v1.UpdateSCIMResourceRequest.resource:type_name -> teleport.scim.v1.Resource
 	8,  // 7: teleport.scim.v1.DeleteSCIMResourceRequest.target:type_name -> teleport.scim.v1.RequestTarget
 	6,  // 8: teleport.scim.v1.Resource.meta:type_name -> teleport.scim.v1.Meta
-	10, // 9: teleport.scim.v1.Resource.attributes:type_name -> google.protobuf.Struct
-	11, // 10: teleport.scim.v1.Meta.created:type_name -> google.protobuf.Timestamp
-	11, // 11: teleport.scim.v1.Meta.modified:type_name -> google.protobuf.Timestamp
+	11, // 9: teleport.scim.v1.Resource.attributes:type_name -> google.protobuf.Struct
+	12, // 10: teleport.scim.v1.Meta.created:type_name -> google.protobuf.Timestamp
+	12, // 11: teleport.scim.v1.Meta.modified:type_name -> google.protobuf.Timestamp
 	5,  // 12: teleport.scim.v1.ResourceList.resources:type_name -> teleport.scim.v1.Resource
-	0,  // 13: teleport.scim.v1.SCIMService.ListSCIMResources:input_type -> teleport.scim.v1.ListSCIMResourcesRequest
-	1,  // 14: teleport.scim.v1.SCIMService.GetSCIMResource:input_type -> teleport.scim.v1.GetSCIMResourceRequest
-	2,  // 15: teleport.scim.v1.SCIMService.CreateSCIMResource:input_type -> teleport.scim.v1.CreateSCIMResourceRequest
-	3,  // 16: teleport.scim.v1.SCIMService.UpdateSCIMResource:input_type -> teleport.scim.v1.UpdateSCIMResourceRequest
-	4,  // 17: teleport.scim.v1.SCIMService.DeleteSCIMResource:input_type -> teleport.scim.v1.DeleteSCIMResourceRequest
-	7,  // 18: teleport.scim.v1.SCIMService.ListSCIMResources:output_type -> teleport.scim.v1.ResourceList
-	5,  // 19: teleport.scim.v1.SCIMService.GetSCIMResource:output_type -> teleport.scim.v1.Resource
-	5,  // 20: teleport.scim.v1.SCIMService.CreateSCIMResource:output_type -> teleport.scim.v1.Resource
-	5,  // 21: teleport.scim.v1.SCIMService.UpdateSCIMResource:output_type -> teleport.scim.v1.Resource
-	12, // 22: teleport.scim.v1.SCIMService.DeleteSCIMResource:output_type -> google.protobuf.Empty
-	18, // [18:23] is the sub-list for method output_type
-	13, // [13:18] is the sub-list for method input_type
-	13, // [13:13] is the sub-list for extension type_name
-	13, // [13:13] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	8,  // 13: teleport.scim.v1.PatchSCIMResourceRequest.target:type_name -> teleport.scim.v1.RequestTarget
+	11, // 14: teleport.scim.v1.PatchSCIMResourceRequest.payload:type_name -> google.protobuf.Struct
+	0,  // 15: teleport.scim.v1.SCIMService.ListSCIMResources:input_type -> teleport.scim.v1.ListSCIMResourcesRequest
+	1,  // 16: teleport.scim.v1.SCIMService.GetSCIMResource:input_type -> teleport.scim.v1.GetSCIMResourceRequest
+	2,  // 17: teleport.scim.v1.SCIMService.CreateSCIMResource:input_type -> teleport.scim.v1.CreateSCIMResourceRequest
+	3,  // 18: teleport.scim.v1.SCIMService.UpdateSCIMResource:input_type -> teleport.scim.v1.UpdateSCIMResourceRequest
+	4,  // 19: teleport.scim.v1.SCIMService.DeleteSCIMResource:input_type -> teleport.scim.v1.DeleteSCIMResourceRequest
+	10, // 20: teleport.scim.v1.SCIMService.PatchSCIMResource:input_type -> teleport.scim.v1.PatchSCIMResourceRequest
+	7,  // 21: teleport.scim.v1.SCIMService.ListSCIMResources:output_type -> teleport.scim.v1.ResourceList
+	5,  // 22: teleport.scim.v1.SCIMService.GetSCIMResource:output_type -> teleport.scim.v1.Resource
+	5,  // 23: teleport.scim.v1.SCIMService.CreateSCIMResource:output_type -> teleport.scim.v1.Resource
+	5,  // 24: teleport.scim.v1.SCIMService.UpdateSCIMResource:output_type -> teleport.scim.v1.Resource
+	13, // 25: teleport.scim.v1.SCIMService.DeleteSCIMResource:output_type -> google.protobuf.Empty
+	5,  // 26: teleport.scim.v1.SCIMService.PatchSCIMResource:output_type -> teleport.scim.v1.Resource
+	21, // [21:27] is the sub-list for method output_type
+	15, // [15:21] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_teleport_scim_v1_scim_service_proto_init() }
@@ -798,7 +868,7 @@ func file_teleport_scim_v1_scim_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scim_v1_scim_service_proto_rawDesc), len(file_teleport_scim_v1_scim_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   10,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go b/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
index f851b4bfeab8b..87431b2dfb804 100644
--- a/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
@@ -39,6 +39,7 @@ const (
 	SCIMService_CreateSCIMResource_FullMethodName = "/teleport.scim.v1.SCIMService/CreateSCIMResource"
 	SCIMService_UpdateSCIMResource_FullMethodName = "/teleport.scim.v1.SCIMService/UpdateSCIMResource"
 	SCIMService_DeleteSCIMResource_FullMethodName = "/teleport.scim.v1.SCIMService/DeleteSCIMResource"
+	SCIMService_PatchSCIMResource_FullMethodName  = "/teleport.scim.v1.SCIMService/PatchSCIMResource"
 )
 
 // SCIMServiceClient is the client API for SCIMService service.
@@ -59,6 +60,11 @@ type SCIMServiceClient interface {
 	UpdateSCIMResource(ctx context.Context, in *UpdateSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error)
 	// DeleteSCIMResource deletes a SCIM-managed resource
 	DeleteSCIMResource(ctx context.Context, in *DeleteSCIMResourceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// PatchSCIMResource handles a request to patch a resource as per RFC 7644
+	// Section 3.5.2.
+	//
+	// See https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2
+	PatchSCIMResource(ctx context.Context, in *PatchSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error)
 }
 
 type sCIMServiceClient struct {
@@ -119,6 +125,16 @@ func (c *sCIMServiceClient) DeleteSCIMResource(ctx context.Context, in *DeleteSC
 	return out, nil
 }
 
+func (c *sCIMServiceClient) PatchSCIMResource(ctx context.Context, in *PatchSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Resource)
+	err := c.cc.Invoke(ctx, SCIMService_PatchSCIMResource_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // SCIMServiceServer is the server API for SCIMService service.
 // All implementations must embed UnimplementedSCIMServiceServer
 // for forward compatibility.
@@ -137,6 +153,11 @@ type SCIMServiceServer interface {
 	UpdateSCIMResource(context.Context, *UpdateSCIMResourceRequest) (*Resource, error)
 	// DeleteSCIMResource deletes a SCIM-managed resource
 	DeleteSCIMResource(context.Context, *DeleteSCIMResourceRequest) (*emptypb.Empty, error)
+	// PatchSCIMResource handles a request to patch a resource as per RFC 7644
+	// Section 3.5.2.
+	//
+	// See https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2
+	PatchSCIMResource(context.Context, *PatchSCIMResourceRequest) (*Resource, error)
 	mustEmbedUnimplementedSCIMServiceServer()
 }
 
@@ -162,6 +183,9 @@ func (UnimplementedSCIMServiceServer) UpdateSCIMResource(context.Context, *Updat
 func (UnimplementedSCIMServiceServer) DeleteSCIMResource(context.Context, *DeleteSCIMResourceRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteSCIMResource not implemented")
 }
+func (UnimplementedSCIMServiceServer) PatchSCIMResource(context.Context, *PatchSCIMResourceRequest) (*Resource, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method PatchSCIMResource not implemented")
+}
 func (UnimplementedSCIMServiceServer) mustEmbedUnimplementedSCIMServiceServer() {}
 func (UnimplementedSCIMServiceServer) testEmbeddedByValue()                     {}
 
@@ -273,6 +297,24 @@ func _SCIMService_DeleteSCIMResource_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SCIMService_PatchSCIMResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PatchSCIMResourceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SCIMServiceServer).PatchSCIMResource(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SCIMService_PatchSCIMResource_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SCIMServiceServer).PatchSCIMResource(ctx, req.(*PatchSCIMResourceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // SCIMService_ServiceDesc is the grpc.ServiceDesc for SCIMService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -300,6 +342,10 @@ var SCIMService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteSCIMResource",
 			Handler:    _SCIMService_DeleteSCIMResource_Handler,
 		},
+		{
+			MethodName: "PatchSCIMResource",
+			Handler:    _SCIMService_PatchSCIMResource_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/scim/v1/scim_service.proto",
diff --git a/api/gen/proto/go/teleport/scopedrole/v1/assignment.pb.go b/api/gen/proto/go/teleport/scopedrole/v1/assignment.pb.go
deleted file mode 100644
index 9b9574a2abb4c..0000000000000
--- a/api/gen/proto/go/teleport/scopedrole/v1/assignment.pb.go
+++ /dev/null
@@ -1,316 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/scopedrole/v1/assignment.proto
-
-package scopedrole
-
-import (
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// ScopedRoleAssignment is a role assignment whose resource and permissions are scoped. A scoped role assignment
-// assigns roles to users at scopes. One assignment may contain multiple roles at multiple scopes. Most assignments
-// are stored at random IDs, but some assignments created by teleport may have special static names that are
-// reserved for teleport's internal use (e.g. for managing the set of subassignments generated by a connector).
-type ScopedRoleAssignment struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Kind is the resource kind.
-	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
-	// SubKind is the resource sub-kind.
-	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
-	// Version is the resource version.
-	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
-	// Metadata contains the resource metadata.
-	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	// Scope is the scope of the role assignment resource.
-	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
-	// Spec is the role assignment specification.
-	Spec          *ScopedRoleAssignmentSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ScopedRoleAssignment) Reset() {
-	*x = ScopedRoleAssignment{}
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedRoleAssignment) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedRoleAssignment) ProtoMessage() {}
-
-func (x *ScopedRoleAssignment) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedRoleAssignment.ProtoReflect.Descriptor instead.
-func (*ScopedRoleAssignment) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_assignment_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *ScopedRoleAssignment) GetKind() string {
-	if x != nil {
-		return x.Kind
-	}
-	return ""
-}
-
-func (x *ScopedRoleAssignment) GetSubKind() string {
-	if x != nil {
-		return x.SubKind
-	}
-	return ""
-}
-
-func (x *ScopedRoleAssignment) GetVersion() string {
-	if x != nil {
-		return x.Version
-	}
-	return ""
-}
-
-func (x *ScopedRoleAssignment) GetMetadata() *v1.Metadata {
-	if x != nil {
-		return x.Metadata
-	}
-	return nil
-}
-
-func (x *ScopedRoleAssignment) GetScope() string {
-	if x != nil {
-		return x.Scope
-	}
-	return ""
-}
-
-func (x *ScopedRoleAssignment) GetSpec() *ScopedRoleAssignmentSpec {
-	if x != nil {
-		return x.Spec
-	}
-	return nil
-}
-
-// ScopedRoleAssignmentSpec is the specification of a scoped role.
-type ScopedRoleAssignmentSpec struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// User is the user to whom all contained assignments apply.
-	User string `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
-	// Assignments is a list of individual role @ scope assignments.
-	Assignments   []*Assignment `protobuf:"bytes,2,rep,name=assignments,proto3" json:"assignments,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ScopedRoleAssignmentSpec) Reset() {
-	*x = ScopedRoleAssignmentSpec{}
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedRoleAssignmentSpec) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedRoleAssignmentSpec) ProtoMessage() {}
-
-func (x *ScopedRoleAssignmentSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedRoleAssignmentSpec.ProtoReflect.Descriptor instead.
-func (*ScopedRoleAssignmentSpec) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_assignment_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *ScopedRoleAssignmentSpec) GetUser() string {
-	if x != nil {
-		return x.User
-	}
-	return ""
-}
-
-func (x *ScopedRoleAssignmentSpec) GetAssignments() []*Assignment {
-	if x != nil {
-		return x.Assignments
-	}
-	return nil
-}
-
-// Assignment is a role/scope pair that defines an individual assignment.
-type Assignment struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Roles is the name of the role that is assigned by this assignment.
-	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	// Scope is the scope to which the role is assigned. This must be a member/child
-	// of the scope of the [ScopedRoleAssignment] in which this assignment is contained.
-	Scope         string `protobuf:"bytes,2,opt,name=scope,proto3" json:"scope,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *Assignment) Reset() {
-	*x = Assignment{}
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[2]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *Assignment) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Assignment) ProtoMessage() {}
-
-func (x *Assignment) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_assignment_proto_msgTypes[2]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Assignment.ProtoReflect.Descriptor instead.
-func (*Assignment) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_assignment_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *Assignment) GetRole() string {
-	if x != nil {
-		return x.Role
-	}
-	return ""
-}
-
-func (x *Assignment) GetScope() string {
-	if x != nil {
-		return x.Scope
-	}
-	return ""
-}
-
-var File_teleport_scopedrole_v1_assignment_proto protoreflect.FileDescriptor
-
-const file_teleport_scopedrole_v1_assignment_proto_rawDesc = "" +
-	"\n" +
-	"'teleport/scopedrole/v1/assignment.proto\x12\x16teleport.scopedrole.v1\x1a!teleport/header/v1/metadata.proto\"\xf5\x01\n" +
-	"\x14ScopedRoleAssignment\x12\x12\n" +
-	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
-	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
-	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
-	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
-	"\x05scope\x18\x05 \x01(\tR\x05scope\x12D\n" +
-	"\x04spec\x18\x06 \x01(\v20.teleport.scopedrole.v1.ScopedRoleAssignmentSpecR\x04spec\"t\n" +
-	"\x18ScopedRoleAssignmentSpec\x12\x12\n" +
-	"\x04user\x18\x01 \x01(\tR\x04user\x12D\n" +
-	"\vassignments\x18\x02 \x03(\v2\".teleport.scopedrole.v1.AssignmentR\vassignments\"6\n" +
-	"\n" +
-	"Assignment\x12\x12\n" +
-	"\x04role\x18\x01 \x01(\tR\x04role\x12\x14\n" +
-	"\x05scope\x18\x02 \x01(\tR\x05scopeBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedroleb\x06proto3"
-
-var (
-	file_teleport_scopedrole_v1_assignment_proto_rawDescOnce sync.Once
-	file_teleport_scopedrole_v1_assignment_proto_rawDescData []byte
-)
-
-func file_teleport_scopedrole_v1_assignment_proto_rawDescGZIP() []byte {
-	file_teleport_scopedrole_v1_assignment_proto_rawDescOnce.Do(func() {
-		file_teleport_scopedrole_v1_assignment_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_assignment_proto_rawDesc), len(file_teleport_scopedrole_v1_assignment_proto_rawDesc)))
-	})
-	return file_teleport_scopedrole_v1_assignment_proto_rawDescData
-}
-
-var file_teleport_scopedrole_v1_assignment_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
-var file_teleport_scopedrole_v1_assignment_proto_goTypes = []any{
-	(*ScopedRoleAssignment)(nil),     // 0: teleport.scopedrole.v1.ScopedRoleAssignment
-	(*ScopedRoleAssignmentSpec)(nil), // 1: teleport.scopedrole.v1.ScopedRoleAssignmentSpec
-	(*Assignment)(nil),               // 2: teleport.scopedrole.v1.Assignment
-	(*v1.Metadata)(nil),              // 3: teleport.header.v1.Metadata
-}
-var file_teleport_scopedrole_v1_assignment_proto_depIdxs = []int32{
-	3, // 0: teleport.scopedrole.v1.ScopedRoleAssignment.metadata:type_name -> teleport.header.v1.Metadata
-	1, // 1: teleport.scopedrole.v1.ScopedRoleAssignment.spec:type_name -> teleport.scopedrole.v1.ScopedRoleAssignmentSpec
-	2, // 2: teleport.scopedrole.v1.ScopedRoleAssignmentSpec.assignments:type_name -> teleport.scopedrole.v1.Assignment
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
-}
-
-func init() { file_teleport_scopedrole_v1_assignment_proto_init() }
-func file_teleport_scopedrole_v1_assignment_proto_init() {
-	if File_teleport_scopedrole_v1_assignment_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_assignment_proto_rawDesc), len(file_teleport_scopedrole_v1_assignment_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   3,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_teleport_scopedrole_v1_assignment_proto_goTypes,
-		DependencyIndexes: file_teleport_scopedrole_v1_assignment_proto_depIdxs,
-		MessageInfos:      file_teleport_scopedrole_v1_assignment_proto_msgTypes,
-	}.Build()
-	File_teleport_scopedrole_v1_assignment_proto = out.File
-	file_teleport_scopedrole_v1_assignment_proto_goTypes = nil
-	file_teleport_scopedrole_v1_assignment_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/scopedrole/v1/role.pb.go b/api/gen/proto/go/teleport/scopedrole/v1/role.pb.go
deleted file mode 100644
index 297ab88dd6faa..0000000000000
--- a/api/gen/proto/go/teleport/scopedrole/v1/role.pb.go
+++ /dev/null
@@ -1,244 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/scopedrole/v1/role.proto
-
-package scopedrole
-
-import (
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// ScopedRole is a role whose resource and permissions are scoped. Scoped roles implement a subset of role
-// features tailored to the usecases of scoped access and scoped access administration. Scoped roles may be
-// assigned to the same user multiple times at various scopes. Scoped roles do not contain deny rules.
-type ScopedRole struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Kind is the resource kind.
-	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
-	// SubKind is the resource sub-kind.
-	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
-	// Version is the resource version.
-	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
-	// Metadata contains the resource metadata.
-	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	// Scope is the scope of the role resource.
-	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
-	// Spec is the role specification.
-	Spec          *ScopedRoleSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ScopedRole) Reset() {
-	*x = ScopedRole{}
-	mi := &file_teleport_scopedrole_v1_role_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedRole) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedRole) ProtoMessage() {}
-
-func (x *ScopedRole) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_role_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedRole.ProtoReflect.Descriptor instead.
-func (*ScopedRole) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_role_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *ScopedRole) GetKind() string {
-	if x != nil {
-		return x.Kind
-	}
-	return ""
-}
-
-func (x *ScopedRole) GetSubKind() string {
-	if x != nil {
-		return x.SubKind
-	}
-	return ""
-}
-
-func (x *ScopedRole) GetVersion() string {
-	if x != nil {
-		return x.Version
-	}
-	return ""
-}
-
-func (x *ScopedRole) GetMetadata() *v1.Metadata {
-	if x != nil {
-		return x.Metadata
-	}
-	return nil
-}
-
-func (x *ScopedRole) GetScope() string {
-	if x != nil {
-		return x.Scope
-	}
-	return ""
-}
-
-func (x *ScopedRole) GetSpec() *ScopedRoleSpec {
-	if x != nil {
-		return x.Spec
-	}
-	return nil
-}
-
-// ScopedRoleSpec is the specification of a scoped role.
-type ScopedRoleSpec struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// AssignableScopes is a list of scopes to which this role can be assigned.
-	AssignableScopes []string `protobuf:"bytes,1,rep,name=assignable_scopes,json=assignableScopes,proto3" json:"assignable_scopes,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
-}
-
-func (x *ScopedRoleSpec) Reset() {
-	*x = ScopedRoleSpec{}
-	mi := &file_teleport_scopedrole_v1_role_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedRoleSpec) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedRoleSpec) ProtoMessage() {}
-
-func (x *ScopedRoleSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_role_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedRoleSpec.ProtoReflect.Descriptor instead.
-func (*ScopedRoleSpec) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_role_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *ScopedRoleSpec) GetAssignableScopes() []string {
-	if x != nil {
-		return x.AssignableScopes
-	}
-	return nil
-}
-
-var File_teleport_scopedrole_v1_role_proto protoreflect.FileDescriptor
-
-const file_teleport_scopedrole_v1_role_proto_rawDesc = "" +
-	"\n" +
-	"!teleport/scopedrole/v1/role.proto\x12\x16teleport.scopedrole.v1\x1a!teleport/header/v1/metadata.proto\"\xe1\x01\n" +
-	"\n" +
-	"ScopedRole\x12\x12\n" +
-	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
-	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
-	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
-	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
-	"\x05scope\x18\x05 \x01(\tR\x05scope\x12:\n" +
-	"\x04spec\x18\x06 \x01(\v2&.teleport.scopedrole.v1.ScopedRoleSpecR\x04spec\"=\n" +
-	"\x0eScopedRoleSpec\x12+\n" +
-	"\x11assignable_scopes\x18\x01 \x03(\tR\x10assignableScopesBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedroleb\x06proto3"
-
-var (
-	file_teleport_scopedrole_v1_role_proto_rawDescOnce sync.Once
-	file_teleport_scopedrole_v1_role_proto_rawDescData []byte
-)
-
-func file_teleport_scopedrole_v1_role_proto_rawDescGZIP() []byte {
-	file_teleport_scopedrole_v1_role_proto_rawDescOnce.Do(func() {
-		file_teleport_scopedrole_v1_role_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_role_proto_rawDesc), len(file_teleport_scopedrole_v1_role_proto_rawDesc)))
-	})
-	return file_teleport_scopedrole_v1_role_proto_rawDescData
-}
-
-var file_teleport_scopedrole_v1_role_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_teleport_scopedrole_v1_role_proto_goTypes = []any{
-	(*ScopedRole)(nil),     // 0: teleport.scopedrole.v1.ScopedRole
-	(*ScopedRoleSpec)(nil), // 1: teleport.scopedrole.v1.ScopedRoleSpec
-	(*v1.Metadata)(nil),    // 2: teleport.header.v1.Metadata
-}
-var file_teleport_scopedrole_v1_role_proto_depIdxs = []int32{
-	2, // 0: teleport.scopedrole.v1.ScopedRole.metadata:type_name -> teleport.header.v1.Metadata
-	1, // 1: teleport.scopedrole.v1.ScopedRole.spec:type_name -> teleport.scopedrole.v1.ScopedRoleSpec
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
-}
-
-func init() { file_teleport_scopedrole_v1_role_proto_init() }
-func file_teleport_scopedrole_v1_role_proto_init() {
-	if File_teleport_scopedrole_v1_role_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_role_proto_rawDesc), len(file_teleport_scopedrole_v1_role_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   2,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_teleport_scopedrole_v1_role_proto_goTypes,
-		DependencyIndexes: file_teleport_scopedrole_v1_role_proto_depIdxs,
-		MessageInfos:      file_teleport_scopedrole_v1_role_proto_msgTypes,
-	}.Build()
-	File_teleport_scopedrole_v1_role_proto = out.File
-	file_teleport_scopedrole_v1_role_proto_goTypes = nil
-	file_teleport_scopedrole_v1_role_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/scopedrole/v1/service.pb.go b/api/gen/proto/go/teleport/scopedrole/v1/service.pb.go
deleted file mode 100644
index 3645f2406e055..0000000000000
--- a/api/gen/proto/go/teleport/scopedrole/v1/service.pb.go
+++ /dev/null
@@ -1,1143 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/scopedrole/v1/service.proto
-
-package scopedrole
-
-import (
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// GetScopedRoleRequest is the request to get a scoped role.
-type GetScopedRoleRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped role.
-	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedRoleRequest) Reset() {
-	*x = GetScopedRoleRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedRoleRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedRoleRequest) ProtoMessage() {}
-
-func (x *GetScopedRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedRoleRequest.ProtoReflect.Descriptor instead.
-func (*GetScopedRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *GetScopedRoleRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-// GetScopedRoleResponse is the response to get a scoped role.
-type GetScopedRoleResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Role is the scoped role.
-	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedRoleResponse) Reset() {
-	*x = GetScopedRoleResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedRoleResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedRoleResponse) ProtoMessage() {}
-
-func (x *GetScopedRoleResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedRoleResponse.ProtoReflect.Descriptor instead.
-func (*GetScopedRoleResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *GetScopedRoleResponse) GetRole() *ScopedRole {
-	if x != nil {
-		return x.Role
-	}
-	return nil
-}
-
-// ListScopedRolesRequest is the request to list scoped roles.
-type ListScopedRolesRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// PageSize is the maximum number of results to return.
-	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
-	// PageToken is the pagination cursor used to start from where a previous request left off.
-	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
-	// ResourceScope filters roles by their resource scope if specified.
-	ResourceScope *v1.Filter `protobuf:"bytes,3,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
-	// AssignableScope filters roles by their assignable scope if specified.
-	AssignableScope *v1.Filter `protobuf:"bytes,4,opt,name=assignable_scope,json=assignableScope,proto3" json:"assignable_scope,omitempty"`
-	unknownFields   protoimpl.UnknownFields
-	sizeCache       protoimpl.SizeCache
-}
-
-func (x *ListScopedRolesRequest) Reset() {
-	*x = ListScopedRolesRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[2]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedRolesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedRolesRequest) ProtoMessage() {}
-
-func (x *ListScopedRolesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[2]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedRolesRequest.ProtoReflect.Descriptor instead.
-func (*ListScopedRolesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *ListScopedRolesRequest) GetPageSize() int32 {
-	if x != nil {
-		return x.PageSize
-	}
-	return 0
-}
-
-func (x *ListScopedRolesRequest) GetPageToken() string {
-	if x != nil {
-		return x.PageToken
-	}
-	return ""
-}
-
-func (x *ListScopedRolesRequest) GetResourceScope() *v1.Filter {
-	if x != nil {
-		return x.ResourceScope
-	}
-	return nil
-}
-
-func (x *ListScopedRolesRequest) GetAssignableScope() *v1.Filter {
-	if x != nil {
-		return x.AssignableScope
-	}
-	return nil
-}
-
-// ListScopedRolesResponse is the response to list scoped roles.
-type ListScopedRolesResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Roles is the list of scoped roles.
-	Roles []*ScopedRole `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
-	// NextPageToken is a pagination cursor usable to fetch the next page of results.
-	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListScopedRolesResponse) Reset() {
-	*x = ListScopedRolesResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[3]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedRolesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedRolesResponse) ProtoMessage() {}
-
-func (x *ListScopedRolesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[3]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedRolesResponse.ProtoReflect.Descriptor instead.
-func (*ListScopedRolesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *ListScopedRolesResponse) GetRoles() []*ScopedRole {
-	if x != nil {
-		return x.Roles
-	}
-	return nil
-}
-
-func (x *ListScopedRolesResponse) GetNextPageToken() string {
-	if x != nil {
-		return x.NextPageToken
-	}
-	return ""
-}
-
-// CreateScopedRoleRequest is the request to create a scoped role.
-type CreateScopedRoleRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Role is the scoped role to create.
-	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedRoleRequest) Reset() {
-	*x = CreateScopedRoleRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[4]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedRoleRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedRoleRequest) ProtoMessage() {}
-
-func (x *CreateScopedRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[4]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedRoleRequest.ProtoReflect.Descriptor instead.
-func (*CreateScopedRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *CreateScopedRoleRequest) GetRole() *ScopedRole {
-	if x != nil {
-		return x.Role
-	}
-	return nil
-}
-
-// CreateScopedRoleResponse is the response to create a scoped role.
-type CreateScopedRoleResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Role is the scoped role that was created.
-	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedRoleResponse) Reset() {
-	*x = CreateScopedRoleResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[5]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedRoleResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedRoleResponse) ProtoMessage() {}
-
-func (x *CreateScopedRoleResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[5]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedRoleResponse.ProtoReflect.Descriptor instead.
-func (*CreateScopedRoleResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *CreateScopedRoleResponse) GetRole() *ScopedRole {
-	if x != nil {
-		return x.Role
-	}
-	return nil
-}
-
-// UpdateScopedRoleRequest is the request to update a scoped role.
-type UpdateScopedRoleRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Role is the scoped role to update.
-	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *UpdateScopedRoleRequest) Reset() {
-	*x = UpdateScopedRoleRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[6]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *UpdateScopedRoleRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateScopedRoleRequest) ProtoMessage() {}
-
-func (x *UpdateScopedRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[6]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateScopedRoleRequest.ProtoReflect.Descriptor instead.
-func (*UpdateScopedRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *UpdateScopedRoleRequest) GetRole() *ScopedRole {
-	if x != nil {
-		return x.Role
-	}
-	return nil
-}
-
-// UpdateScopedRoleResponse is the response to update a scoped role.
-type UpdateScopedRoleResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Role is the post-update scoped role.
-	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *UpdateScopedRoleResponse) Reset() {
-	*x = UpdateScopedRoleResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[7]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *UpdateScopedRoleResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateScopedRoleResponse) ProtoMessage() {}
-
-func (x *UpdateScopedRoleResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[7]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateScopedRoleResponse.ProtoReflect.Descriptor instead.
-func (*UpdateScopedRoleResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *UpdateScopedRoleResponse) GetRole() *ScopedRole {
-	if x != nil {
-		return x.Role
-	}
-	return nil
-}
-
-// DeleteScopedRoleRequest is the request to delete a scoped role.
-type DeleteScopedRoleRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped role to delete.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	// Revision asserts the revision of the scoped role to delete (optional).
-	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedRoleRequest) Reset() {
-	*x = DeleteScopedRoleRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[8]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedRoleRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedRoleRequest) ProtoMessage() {}
-
-func (x *DeleteScopedRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[8]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedRoleRequest.ProtoReflect.Descriptor instead.
-func (*DeleteScopedRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *DeleteScopedRoleRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-func (x *DeleteScopedRoleRequest) GetRevision() string {
-	if x != nil {
-		return x.Revision
-	}
-	return ""
-}
-
-// DeleteScopedRoleResponse is the response to delete a scoped role.
-type DeleteScopedRoleResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedRoleResponse) Reset() {
-	*x = DeleteScopedRoleResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[9]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedRoleResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedRoleResponse) ProtoMessage() {}
-
-func (x *DeleteScopedRoleResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[9]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedRoleResponse.ProtoReflect.Descriptor instead.
-func (*DeleteScopedRoleResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{9}
-}
-
-// GetScopedRoleAssignmentRequest is the request to get a scoped role assignment.
-type GetScopedRoleAssignmentRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped role assignment.
-	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedRoleAssignmentRequest) Reset() {
-	*x = GetScopedRoleAssignmentRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[10]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedRoleAssignmentRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedRoleAssignmentRequest) ProtoMessage() {}
-
-func (x *GetScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[10]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
-func (*GetScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{10}
-}
-
-func (x *GetScopedRoleAssignmentRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-// GetScopedRoleAssignmentResponse is the response to get a scoped role assignment.
-type GetScopedRoleAssignmentResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Assignment is the scoped role assignment.
-	Assignment    *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedRoleAssignmentResponse) Reset() {
-	*x = GetScopedRoleAssignmentResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[11]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedRoleAssignmentResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedRoleAssignmentResponse) ProtoMessage() {}
-
-func (x *GetScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[11]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
-func (*GetScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{11}
-}
-
-func (x *GetScopedRoleAssignmentResponse) GetAssignment() *ScopedRoleAssignment {
-	if x != nil {
-		return x.Assignment
-	}
-	return nil
-}
-
-// ListScopedRoleAssignmentsRequest is the request to list scoped role assignments.
-type ListScopedRoleAssignmentsRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// PageSize is the maximum number of results to return.
-	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
-	// PageToken is the pagination cursor used to start from where a previous request left off.
-	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
-	// ResourceScope filters assignments by their resource scope if specified.
-	ResourceScope *v1.Filter `protobuf:"bytes,3,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
-	// AssignedScope filters assignments by the scopes they assign to if specified (note: matches assignment
-	// resources with 1 or more maching scopes, not all scopes within the assignment will necessarily match).
-	AssignedScope *v1.Filter `protobuf:"bytes,4,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
-	// User optionally limits the list to assignments for a specific user.
-	User string `protobuf:"bytes,5,opt,name=user,proto3" json:"user,omitempty"`
-	// Role optionally limits the list to assignments for a specific role.
-	Role          string `protobuf:"bytes,6,opt,name=role,proto3" json:"role,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListScopedRoleAssignmentsRequest) Reset() {
-	*x = ListScopedRoleAssignmentsRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[12]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedRoleAssignmentsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedRoleAssignmentsRequest) ProtoMessage() {}
-
-func (x *ListScopedRoleAssignmentsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[12]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedRoleAssignmentsRequest.ProtoReflect.Descriptor instead.
-func (*ListScopedRoleAssignmentsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{12}
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetPageSize() int32 {
-	if x != nil {
-		return x.PageSize
-	}
-	return 0
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetPageToken() string {
-	if x != nil {
-		return x.PageToken
-	}
-	return ""
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetResourceScope() *v1.Filter {
-	if x != nil {
-		return x.ResourceScope
-	}
-	return nil
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetAssignedScope() *v1.Filter {
-	if x != nil {
-		return x.AssignedScope
-	}
-	return nil
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetUser() string {
-	if x != nil {
-		return x.User
-	}
-	return ""
-}
-
-func (x *ListScopedRoleAssignmentsRequest) GetRole() string {
-	if x != nil {
-		return x.Role
-	}
-	return ""
-}
-
-// ListScopedRoleAssignmentsResponse is the response to list scoped role assignments.
-type ListScopedRoleAssignmentsResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Assignments is the list of scoped role assignments.
-	Assignments []*ScopedRoleAssignment `protobuf:"bytes,1,rep,name=assignments,proto3" json:"assignments,omitempty"`
-	// NextPageToken is a pagination cursor usable to fetch the next page of results.
-	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListScopedRoleAssignmentsResponse) Reset() {
-	*x = ListScopedRoleAssignmentsResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[13]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedRoleAssignmentsResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedRoleAssignmentsResponse) ProtoMessage() {}
-
-func (x *ListScopedRoleAssignmentsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[13]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedRoleAssignmentsResponse.ProtoReflect.Descriptor instead.
-func (*ListScopedRoleAssignmentsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{13}
-}
-
-func (x *ListScopedRoleAssignmentsResponse) GetAssignments() []*ScopedRoleAssignment {
-	if x != nil {
-		return x.Assignments
-	}
-	return nil
-}
-
-func (x *ListScopedRoleAssignmentsResponse) GetNextPageToken() string {
-	if x != nil {
-		return x.NextPageToken
-	}
-	return ""
-}
-
-// CreateScopedRoleAssignmentRequest is the request to create a scoped role assignment.
-type CreateScopedRoleAssignmentRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Assignment is the scoped role assignment to create.
-	Assignment *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
-	// RoleRevisions asserts the revisions of the roles assigned by the assignments (optional).
-	RoleRevisions map[string]string `protobuf:"bytes,2,rep,name=role_revisions,json=roleRevisions,proto3" json:"role_revisions,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedRoleAssignmentRequest) Reset() {
-	*x = CreateScopedRoleAssignmentRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[14]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedRoleAssignmentRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedRoleAssignmentRequest) ProtoMessage() {}
-
-func (x *CreateScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[14]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
-func (*CreateScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{14}
-}
-
-func (x *CreateScopedRoleAssignmentRequest) GetAssignment() *ScopedRoleAssignment {
-	if x != nil {
-		return x.Assignment
-	}
-	return nil
-}
-
-func (x *CreateScopedRoleAssignmentRequest) GetRoleRevisions() map[string]string {
-	if x != nil {
-		return x.RoleRevisions
-	}
-	return nil
-}
-
-// CreateScopedRoleAssignmentResponse is the response to create a scoped role assignment.
-type CreateScopedRoleAssignmentResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Assignment is the scoped role assignment that was created.
-	Assignment    *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedRoleAssignmentResponse) Reset() {
-	*x = CreateScopedRoleAssignmentResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[15]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedRoleAssignmentResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedRoleAssignmentResponse) ProtoMessage() {}
-
-func (x *CreateScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[15]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
-func (*CreateScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{15}
-}
-
-func (x *CreateScopedRoleAssignmentResponse) GetAssignment() *ScopedRoleAssignment {
-	if x != nil {
-		return x.Assignment
-	}
-	return nil
-}
-
-// DeleteScopedRoleAssignmentRequest is the request to delete a scoped role assignment.
-type DeleteScopedRoleAssignmentRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped role assignment to delete.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	// Revision asserts the revision of the scoped role assignment to delete (optional).
-	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedRoleAssignmentRequest) Reset() {
-	*x = DeleteScopedRoleAssignmentRequest{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[16]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedRoleAssignmentRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedRoleAssignmentRequest) ProtoMessage() {}
-
-func (x *DeleteScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[16]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
-func (*DeleteScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{16}
-}
-
-func (x *DeleteScopedRoleAssignmentRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-func (x *DeleteScopedRoleAssignmentRequest) GetRevision() string {
-	if x != nil {
-		return x.Revision
-	}
-	return ""
-}
-
-// DeleteScopedRoleAssignmentResponse is the response to delete a scoped role assignment.
-type DeleteScopedRoleAssignmentResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedRoleAssignmentResponse) Reset() {
-	*x = DeleteScopedRoleAssignmentResponse{}
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[17]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedRoleAssignmentResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedRoleAssignmentResponse) ProtoMessage() {}
-
-func (x *DeleteScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedrole_v1_service_proto_msgTypes[17]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
-func (*DeleteScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedrole_v1_service_proto_rawDescGZIP(), []int{17}
-}
-
-var File_teleport_scopedrole_v1_service_proto protoreflect.FileDescriptor
-
-const file_teleport_scopedrole_v1_service_proto_rawDesc = "" +
-	"\n" +
-	"$teleport/scopedrole/v1/service.proto\x12\x16teleport.scopedrole.v1\x1a'teleport/scopedrole/v1/assignment.proto\x1a!teleport/scopedrole/v1/role.proto\x1a\x1fteleport/scopes/v1/scopes.proto\"*\n" +
-	"\x14GetScopedRoleRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\"O\n" +
-	"\x15GetScopedRoleResponse\x126\n" +
-	"\x04role\x18\x01 \x01(\v2\".teleport.scopedrole.v1.ScopedRoleR\x04role\"\xde\x01\n" +
-	"\x16ListScopedRolesRequest\x12\x1b\n" +
-	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
-	"\n" +
-	"page_token\x18\x02 \x01(\tR\tpageToken\x12A\n" +
-	"\x0eresource_scope\x18\x03 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12E\n" +
-	"\x10assignable_scope\x18\x04 \x01(\v2\x1a.teleport.scopes.v1.FilterR\x0fassignableScope\"{\n" +
-	"\x17ListScopedRolesResponse\x128\n" +
-	"\x05roles\x18\x01 \x03(\v2\".teleport.scopedrole.v1.ScopedRoleR\x05roles\x12&\n" +
-	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"Q\n" +
-	"\x17CreateScopedRoleRequest\x126\n" +
-	"\x04role\x18\x01 \x01(\v2\".teleport.scopedrole.v1.ScopedRoleR\x04role\"R\n" +
-	"\x18CreateScopedRoleResponse\x126\n" +
-	"\x04role\x18\x01 \x01(\v2\".teleport.scopedrole.v1.ScopedRoleR\x04role\"Q\n" +
-	"\x17UpdateScopedRoleRequest\x126\n" +
-	"\x04role\x18\x01 \x01(\v2\".teleport.scopedrole.v1.ScopedRoleR\x04role\"R\n" +
-	"\x18UpdateScopedRoleResponse\x126\n" +
-	"\x04role\x18\x01 \x01(\v2\".teleport.scopedrole.v1.ScopedRoleR\x04role\"I\n" +
-	"\x17DeleteScopedRoleRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
-	"\brevision\x18\x02 \x01(\tR\brevision\"\x1a\n" +
-	"\x18DeleteScopedRoleResponse\"4\n" +
-	"\x1eGetScopedRoleAssignmentRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\"o\n" +
-	"\x1fGetScopedRoleAssignmentResponse\x12L\n" +
-	"\n" +
-	"assignment\x18\x01 \x01(\v2,.teleport.scopedrole.v1.ScopedRoleAssignmentR\n" +
-	"assignment\"\x8c\x02\n" +
-	" ListScopedRoleAssignmentsRequest\x12\x1b\n" +
-	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
-	"\n" +
-	"page_token\x18\x02 \x01(\tR\tpageToken\x12A\n" +
-	"\x0eresource_scope\x18\x03 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12A\n" +
-	"\x0eassigned_scope\x18\x04 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rassignedScope\x12\x12\n" +
-	"\x04user\x18\x05 \x01(\tR\x04user\x12\x12\n" +
-	"\x04role\x18\x06 \x01(\tR\x04role\"\x9b\x01\n" +
-	"!ListScopedRoleAssignmentsResponse\x12N\n" +
-	"\vassignments\x18\x01 \x03(\v2,.teleport.scopedrole.v1.ScopedRoleAssignmentR\vassignments\x12&\n" +
-	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xa8\x02\n" +
-	"!CreateScopedRoleAssignmentRequest\x12L\n" +
-	"\n" +
-	"assignment\x18\x01 \x01(\v2,.teleport.scopedrole.v1.ScopedRoleAssignmentR\n" +
-	"assignment\x12s\n" +
-	"\x0erole_revisions\x18\x02 \x03(\v2L.teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntryR\rroleRevisions\x1a@\n" +
-	"\x12RoleRevisionsEntry\x12\x10\n" +
-	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"r\n" +
-	"\"CreateScopedRoleAssignmentResponse\x12L\n" +
-	"\n" +
-	"assignment\x18\x01 \x01(\v2,.teleport.scopedrole.v1.ScopedRoleAssignmentR\n" +
-	"assignment\"S\n" +
-	"!DeleteScopedRoleAssignmentRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
-	"\brevision\x18\x02 \x01(\tR\brevision\"$\n" +
-	"\"DeleteScopedRoleAssignmentResponse2\xa6\t\n" +
-	"\x11ScopedRoleService\x12l\n" +
-	"\rGetScopedRole\x12,.teleport.scopedrole.v1.GetScopedRoleRequest\x1a-.teleport.scopedrole.v1.GetScopedRoleResponse\x12r\n" +
-	"\x0fListScopedRoles\x12..teleport.scopedrole.v1.ListScopedRolesRequest\x1a/.teleport.scopedrole.v1.ListScopedRolesResponse\x12u\n" +
-	"\x10CreateScopedRole\x12/.teleport.scopedrole.v1.CreateScopedRoleRequest\x1a0.teleport.scopedrole.v1.CreateScopedRoleResponse\x12u\n" +
-	"\x10UpdateScopedRole\x12/.teleport.scopedrole.v1.UpdateScopedRoleRequest\x1a0.teleport.scopedrole.v1.UpdateScopedRoleResponse\x12u\n" +
-	"\x10DeleteScopedRole\x12/.teleport.scopedrole.v1.DeleteScopedRoleRequest\x1a0.teleport.scopedrole.v1.DeleteScopedRoleResponse\x12\x8a\x01\n" +
-	"\x17GetScopedRoleAssignment\x126.teleport.scopedrole.v1.GetScopedRoleAssignmentRequest\x1a7.teleport.scopedrole.v1.GetScopedRoleAssignmentResponse\x12\x90\x01\n" +
-	"\x19ListScopedRoleAssignments\x128.teleport.scopedrole.v1.ListScopedRoleAssignmentsRequest\x1a9.teleport.scopedrole.v1.ListScopedRoleAssignmentsResponse\x12\x93\x01\n" +
-	"\x1aCreateScopedRoleAssignment\x129.teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest\x1a:.teleport.scopedrole.v1.CreateScopedRoleAssignmentResponse\x12\x93\x01\n" +
-	"\x1aDeleteScopedRoleAssignment\x129.teleport.scopedrole.v1.DeleteScopedRoleAssignmentRequest\x1a:.teleport.scopedrole.v1.DeleteScopedRoleAssignmentResponseBVZTgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedroleb\x06proto3"
-
-var (
-	file_teleport_scopedrole_v1_service_proto_rawDescOnce sync.Once
-	file_teleport_scopedrole_v1_service_proto_rawDescData []byte
-)
-
-func file_teleport_scopedrole_v1_service_proto_rawDescGZIP() []byte {
-	file_teleport_scopedrole_v1_service_proto_rawDescOnce.Do(func() {
-		file_teleport_scopedrole_v1_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_service_proto_rawDesc), len(file_teleport_scopedrole_v1_service_proto_rawDesc)))
-	})
-	return file_teleport_scopedrole_v1_service_proto_rawDescData
-}
-
-var file_teleport_scopedrole_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
-var file_teleport_scopedrole_v1_service_proto_goTypes = []any{
-	(*GetScopedRoleRequest)(nil),               // 0: teleport.scopedrole.v1.GetScopedRoleRequest
-	(*GetScopedRoleResponse)(nil),              // 1: teleport.scopedrole.v1.GetScopedRoleResponse
-	(*ListScopedRolesRequest)(nil),             // 2: teleport.scopedrole.v1.ListScopedRolesRequest
-	(*ListScopedRolesResponse)(nil),            // 3: teleport.scopedrole.v1.ListScopedRolesResponse
-	(*CreateScopedRoleRequest)(nil),            // 4: teleport.scopedrole.v1.CreateScopedRoleRequest
-	(*CreateScopedRoleResponse)(nil),           // 5: teleport.scopedrole.v1.CreateScopedRoleResponse
-	(*UpdateScopedRoleRequest)(nil),            // 6: teleport.scopedrole.v1.UpdateScopedRoleRequest
-	(*UpdateScopedRoleResponse)(nil),           // 7: teleport.scopedrole.v1.UpdateScopedRoleResponse
-	(*DeleteScopedRoleRequest)(nil),            // 8: teleport.scopedrole.v1.DeleteScopedRoleRequest
-	(*DeleteScopedRoleResponse)(nil),           // 9: teleport.scopedrole.v1.DeleteScopedRoleResponse
-	(*GetScopedRoleAssignmentRequest)(nil),     // 10: teleport.scopedrole.v1.GetScopedRoleAssignmentRequest
-	(*GetScopedRoleAssignmentResponse)(nil),    // 11: teleport.scopedrole.v1.GetScopedRoleAssignmentResponse
-	(*ListScopedRoleAssignmentsRequest)(nil),   // 12: teleport.scopedrole.v1.ListScopedRoleAssignmentsRequest
-	(*ListScopedRoleAssignmentsResponse)(nil),  // 13: teleport.scopedrole.v1.ListScopedRoleAssignmentsResponse
-	(*CreateScopedRoleAssignmentRequest)(nil),  // 14: teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest
-	(*CreateScopedRoleAssignmentResponse)(nil), // 15: teleport.scopedrole.v1.CreateScopedRoleAssignmentResponse
-	(*DeleteScopedRoleAssignmentRequest)(nil),  // 16: teleport.scopedrole.v1.DeleteScopedRoleAssignmentRequest
-	(*DeleteScopedRoleAssignmentResponse)(nil), // 17: teleport.scopedrole.v1.DeleteScopedRoleAssignmentResponse
-	nil,                          // 18: teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntry
-	(*ScopedRole)(nil),           // 19: teleport.scopedrole.v1.ScopedRole
-	(*v1.Filter)(nil),            // 20: teleport.scopes.v1.Filter
-	(*ScopedRoleAssignment)(nil), // 21: teleport.scopedrole.v1.ScopedRoleAssignment
-}
-var file_teleport_scopedrole_v1_service_proto_depIdxs = []int32{
-	19, // 0: teleport.scopedrole.v1.GetScopedRoleResponse.role:type_name -> teleport.scopedrole.v1.ScopedRole
-	20, // 1: teleport.scopedrole.v1.ListScopedRolesRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
-	20, // 2: teleport.scopedrole.v1.ListScopedRolesRequest.assignable_scope:type_name -> teleport.scopes.v1.Filter
-	19, // 3: teleport.scopedrole.v1.ListScopedRolesResponse.roles:type_name -> teleport.scopedrole.v1.ScopedRole
-	19, // 4: teleport.scopedrole.v1.CreateScopedRoleRequest.role:type_name -> teleport.scopedrole.v1.ScopedRole
-	19, // 5: teleport.scopedrole.v1.CreateScopedRoleResponse.role:type_name -> teleport.scopedrole.v1.ScopedRole
-	19, // 6: teleport.scopedrole.v1.UpdateScopedRoleRequest.role:type_name -> teleport.scopedrole.v1.ScopedRole
-	19, // 7: teleport.scopedrole.v1.UpdateScopedRoleResponse.role:type_name -> teleport.scopedrole.v1.ScopedRole
-	21, // 8: teleport.scopedrole.v1.GetScopedRoleAssignmentResponse.assignment:type_name -> teleport.scopedrole.v1.ScopedRoleAssignment
-	20, // 9: teleport.scopedrole.v1.ListScopedRoleAssignmentsRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
-	20, // 10: teleport.scopedrole.v1.ListScopedRoleAssignmentsRequest.assigned_scope:type_name -> teleport.scopes.v1.Filter
-	21, // 11: teleport.scopedrole.v1.ListScopedRoleAssignmentsResponse.assignments:type_name -> teleport.scopedrole.v1.ScopedRoleAssignment
-	21, // 12: teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest.assignment:type_name -> teleport.scopedrole.v1.ScopedRoleAssignment
-	18, // 13: teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest.role_revisions:type_name -> teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntry
-	21, // 14: teleport.scopedrole.v1.CreateScopedRoleAssignmentResponse.assignment:type_name -> teleport.scopedrole.v1.ScopedRoleAssignment
-	0,  // 15: teleport.scopedrole.v1.ScopedRoleService.GetScopedRole:input_type -> teleport.scopedrole.v1.GetScopedRoleRequest
-	2,  // 16: teleport.scopedrole.v1.ScopedRoleService.ListScopedRoles:input_type -> teleport.scopedrole.v1.ListScopedRolesRequest
-	4,  // 17: teleport.scopedrole.v1.ScopedRoleService.CreateScopedRole:input_type -> teleport.scopedrole.v1.CreateScopedRoleRequest
-	6,  // 18: teleport.scopedrole.v1.ScopedRoleService.UpdateScopedRole:input_type -> teleport.scopedrole.v1.UpdateScopedRoleRequest
-	8,  // 19: teleport.scopedrole.v1.ScopedRoleService.DeleteScopedRole:input_type -> teleport.scopedrole.v1.DeleteScopedRoleRequest
-	10, // 20: teleport.scopedrole.v1.ScopedRoleService.GetScopedRoleAssignment:input_type -> teleport.scopedrole.v1.GetScopedRoleAssignmentRequest
-	12, // 21: teleport.scopedrole.v1.ScopedRoleService.ListScopedRoleAssignments:input_type -> teleport.scopedrole.v1.ListScopedRoleAssignmentsRequest
-	14, // 22: teleport.scopedrole.v1.ScopedRoleService.CreateScopedRoleAssignment:input_type -> teleport.scopedrole.v1.CreateScopedRoleAssignmentRequest
-	16, // 23: teleport.scopedrole.v1.ScopedRoleService.DeleteScopedRoleAssignment:input_type -> teleport.scopedrole.v1.DeleteScopedRoleAssignmentRequest
-	1,  // 24: teleport.scopedrole.v1.ScopedRoleService.GetScopedRole:output_type -> teleport.scopedrole.v1.GetScopedRoleResponse
-	3,  // 25: teleport.scopedrole.v1.ScopedRoleService.ListScopedRoles:output_type -> teleport.scopedrole.v1.ListScopedRolesResponse
-	5,  // 26: teleport.scopedrole.v1.ScopedRoleService.CreateScopedRole:output_type -> teleport.scopedrole.v1.CreateScopedRoleResponse
-	7,  // 27: teleport.scopedrole.v1.ScopedRoleService.UpdateScopedRole:output_type -> teleport.scopedrole.v1.UpdateScopedRoleResponse
-	9,  // 28: teleport.scopedrole.v1.ScopedRoleService.DeleteScopedRole:output_type -> teleport.scopedrole.v1.DeleteScopedRoleResponse
-	11, // 29: teleport.scopedrole.v1.ScopedRoleService.GetScopedRoleAssignment:output_type -> teleport.scopedrole.v1.GetScopedRoleAssignmentResponse
-	13, // 30: teleport.scopedrole.v1.ScopedRoleService.ListScopedRoleAssignments:output_type -> teleport.scopedrole.v1.ListScopedRoleAssignmentsResponse
-	15, // 31: teleport.scopedrole.v1.ScopedRoleService.CreateScopedRoleAssignment:output_type -> teleport.scopedrole.v1.CreateScopedRoleAssignmentResponse
-	17, // 32: teleport.scopedrole.v1.ScopedRoleService.DeleteScopedRoleAssignment:output_type -> teleport.scopedrole.v1.DeleteScopedRoleAssignmentResponse
-	24, // [24:33] is the sub-list for method output_type
-	15, // [15:24] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
-}
-
-func init() { file_teleport_scopedrole_v1_service_proto_init() }
-func file_teleport_scopedrole_v1_service_proto_init() {
-	if File_teleport_scopedrole_v1_service_proto != nil {
-		return
-	}
-	file_teleport_scopedrole_v1_assignment_proto_init()
-	file_teleport_scopedrole_v1_role_proto_init()
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopedrole_v1_service_proto_rawDesc), len(file_teleport_scopedrole_v1_service_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   19,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_teleport_scopedrole_v1_service_proto_goTypes,
-		DependencyIndexes: file_teleport_scopedrole_v1_service_proto_depIdxs,
-		MessageInfos:      file_teleport_scopedrole_v1_service_proto_msgTypes,
-	}.Build()
-	File_teleport_scopedrole_v1_service_proto = out.File
-	file_teleport_scopedrole_v1_service_proto_goTypes = nil
-	file_teleport_scopedrole_v1_service_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/scopedrole/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/scopedrole/v1/service_grpc.pb.go
deleted file mode 100644
index 40053f67c0b7f..0000000000000
--- a/api/gen/proto/go/teleport/scopedrole/v1/service_grpc.pb.go
+++ /dev/null
@@ -1,461 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             (unknown)
-// source: teleport/scopedrole/v1/service.proto
-
-package scopedrole
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	ScopedRoleService_GetScopedRole_FullMethodName              = "/teleport.scopedrole.v1.ScopedRoleService/GetScopedRole"
-	ScopedRoleService_ListScopedRoles_FullMethodName            = "/teleport.scopedrole.v1.ScopedRoleService/ListScopedRoles"
-	ScopedRoleService_CreateScopedRole_FullMethodName           = "/teleport.scopedrole.v1.ScopedRoleService/CreateScopedRole"
-	ScopedRoleService_UpdateScopedRole_FullMethodName           = "/teleport.scopedrole.v1.ScopedRoleService/UpdateScopedRole"
-	ScopedRoleService_DeleteScopedRole_FullMethodName           = "/teleport.scopedrole.v1.ScopedRoleService/DeleteScopedRole"
-	ScopedRoleService_GetScopedRoleAssignment_FullMethodName    = "/teleport.scopedrole.v1.ScopedRoleService/GetScopedRoleAssignment"
-	ScopedRoleService_ListScopedRoleAssignments_FullMethodName  = "/teleport.scopedrole.v1.ScopedRoleService/ListScopedRoleAssignments"
-	ScopedRoleService_CreateScopedRoleAssignment_FullMethodName = "/teleport.scopedrole.v1.ScopedRoleService/CreateScopedRoleAssignment"
-	ScopedRoleService_DeleteScopedRoleAssignment_FullMethodName = "/teleport.scopedrole.v1.ScopedRoleService/DeleteScopedRoleAssignment"
-)
-
-// ScopedRoleServiceClient is the client API for ScopedRoleService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// ScopedRoleService provides an API for managing scoped role resources and their assignments.
-type ScopedRoleServiceClient interface {
-	// GetScopedRole gets a scoped role by name.
-	GetScopedRole(ctx context.Context, in *GetScopedRoleRequest, opts ...grpc.CallOption) (*GetScopedRoleResponse, error)
-	// ListScopedRoles returns a paginated list of scoped roles.
-	ListScopedRoles(ctx context.Context, in *ListScopedRolesRequest, opts ...grpc.CallOption) (*ListScopedRolesResponse, error)
-	// CreateScopedRole creates a new scoped role.
-	CreateScopedRole(ctx context.Context, in *CreateScopedRoleRequest, opts ...grpc.CallOption) (*CreateScopedRoleResponse, error)
-	// UpdateScopedRole updates a scoped role.
-	UpdateScopedRole(ctx context.Context, in *UpdateScopedRoleRequest, opts ...grpc.CallOption) (*UpdateScopedRoleResponse, error)
-	// DeleteScopedRole deletes a scoped role.
-	DeleteScopedRole(ctx context.Context, in *DeleteScopedRoleRequest, opts ...grpc.CallOption) (*DeleteScopedRoleResponse, error)
-	// GetScopedRoleAssignment gets a scoped role assignment by name.
-	GetScopedRoleAssignment(ctx context.Context, in *GetScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*GetScopedRoleAssignmentResponse, error)
-	// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
-	ListScopedRoleAssignments(ctx context.Context, in *ListScopedRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListScopedRoleAssignmentsResponse, error)
-	// CreateScopedRoleAssignment creates a new scoped role assignment.
-	CreateScopedRoleAssignment(ctx context.Context, in *CreateScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*CreateScopedRoleAssignmentResponse, error)
-	// DeleteScopedRoleAssignment deletes a scoped role assignment.
-	DeleteScopedRoleAssignment(ctx context.Context, in *DeleteScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*DeleteScopedRoleAssignmentResponse, error)
-}
-
-type scopedRoleServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewScopedRoleServiceClient(cc grpc.ClientConnInterface) ScopedRoleServiceClient {
-	return &scopedRoleServiceClient{cc}
-}
-
-func (c *scopedRoleServiceClient) GetScopedRole(ctx context.Context, in *GetScopedRoleRequest, opts ...grpc.CallOption) (*GetScopedRoleResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(GetScopedRoleResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_GetScopedRole_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) ListScopedRoles(ctx context.Context, in *ListScopedRolesRequest, opts ...grpc.CallOption) (*ListScopedRolesResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListScopedRolesResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_ListScopedRoles_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) CreateScopedRole(ctx context.Context, in *CreateScopedRoleRequest, opts ...grpc.CallOption) (*CreateScopedRoleResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(CreateScopedRoleResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_CreateScopedRole_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) UpdateScopedRole(ctx context.Context, in *UpdateScopedRoleRequest, opts ...grpc.CallOption) (*UpdateScopedRoleResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(UpdateScopedRoleResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_UpdateScopedRole_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) DeleteScopedRole(ctx context.Context, in *DeleteScopedRoleRequest, opts ...grpc.CallOption) (*DeleteScopedRoleResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(DeleteScopedRoleResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_DeleteScopedRole_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) GetScopedRoleAssignment(ctx context.Context, in *GetScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*GetScopedRoleAssignmentResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(GetScopedRoleAssignmentResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_GetScopedRoleAssignment_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) ListScopedRoleAssignments(ctx context.Context, in *ListScopedRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListScopedRoleAssignmentsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListScopedRoleAssignmentsResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_ListScopedRoleAssignments_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) CreateScopedRoleAssignment(ctx context.Context, in *CreateScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*CreateScopedRoleAssignmentResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(CreateScopedRoleAssignmentResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_CreateScopedRoleAssignment_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedRoleServiceClient) DeleteScopedRoleAssignment(ctx context.Context, in *DeleteScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*DeleteScopedRoleAssignmentResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(DeleteScopedRoleAssignmentResponse)
-	err := c.cc.Invoke(ctx, ScopedRoleService_DeleteScopedRoleAssignment_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// ScopedRoleServiceServer is the server API for ScopedRoleService service.
-// All implementations must embed UnimplementedScopedRoleServiceServer
-// for forward compatibility.
-//
-// ScopedRoleService provides an API for managing scoped role resources and their assignments.
-type ScopedRoleServiceServer interface {
-	// GetScopedRole gets a scoped role by name.
-	GetScopedRole(context.Context, *GetScopedRoleRequest) (*GetScopedRoleResponse, error)
-	// ListScopedRoles returns a paginated list of scoped roles.
-	ListScopedRoles(context.Context, *ListScopedRolesRequest) (*ListScopedRolesResponse, error)
-	// CreateScopedRole creates a new scoped role.
-	CreateScopedRole(context.Context, *CreateScopedRoleRequest) (*CreateScopedRoleResponse, error)
-	// UpdateScopedRole updates a scoped role.
-	UpdateScopedRole(context.Context, *UpdateScopedRoleRequest) (*UpdateScopedRoleResponse, error)
-	// DeleteScopedRole deletes a scoped role.
-	DeleteScopedRole(context.Context, *DeleteScopedRoleRequest) (*DeleteScopedRoleResponse, error)
-	// GetScopedRoleAssignment gets a scoped role assignment by name.
-	GetScopedRoleAssignment(context.Context, *GetScopedRoleAssignmentRequest) (*GetScopedRoleAssignmentResponse, error)
-	// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
-	ListScopedRoleAssignments(context.Context, *ListScopedRoleAssignmentsRequest) (*ListScopedRoleAssignmentsResponse, error)
-	// CreateScopedRoleAssignment creates a new scoped role assignment.
-	CreateScopedRoleAssignment(context.Context, *CreateScopedRoleAssignmentRequest) (*CreateScopedRoleAssignmentResponse, error)
-	// DeleteScopedRoleAssignment deletes a scoped role assignment.
-	DeleteScopedRoleAssignment(context.Context, *DeleteScopedRoleAssignmentRequest) (*DeleteScopedRoleAssignmentResponse, error)
-	mustEmbedUnimplementedScopedRoleServiceServer()
-}
-
-// UnimplementedScopedRoleServiceServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedScopedRoleServiceServer struct{}
-
-func (UnimplementedScopedRoleServiceServer) GetScopedRole(context.Context, *GetScopedRoleRequest) (*GetScopedRoleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetScopedRole not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) ListScopedRoles(context.Context, *ListScopedRolesRequest) (*ListScopedRolesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListScopedRoles not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) CreateScopedRole(context.Context, *CreateScopedRoleRequest) (*CreateScopedRoleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedRole not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) UpdateScopedRole(context.Context, *UpdateScopedRoleRequest) (*UpdateScopedRoleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdateScopedRole not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) DeleteScopedRole(context.Context, *DeleteScopedRoleRequest) (*DeleteScopedRoleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedRole not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) GetScopedRoleAssignment(context.Context, *GetScopedRoleAssignmentRequest) (*GetScopedRoleAssignmentResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetScopedRoleAssignment not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) ListScopedRoleAssignments(context.Context, *ListScopedRoleAssignmentsRequest) (*ListScopedRoleAssignmentsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListScopedRoleAssignments not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) CreateScopedRoleAssignment(context.Context, *CreateScopedRoleAssignmentRequest) (*CreateScopedRoleAssignmentResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedRoleAssignment not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) DeleteScopedRoleAssignment(context.Context, *DeleteScopedRoleAssignmentRequest) (*DeleteScopedRoleAssignmentResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedRoleAssignment not implemented")
-}
-func (UnimplementedScopedRoleServiceServer) mustEmbedUnimplementedScopedRoleServiceServer() {}
-func (UnimplementedScopedRoleServiceServer) testEmbeddedByValue()                           {}
-
-// UnsafeScopedRoleServiceServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to ScopedRoleServiceServer will
-// result in compilation errors.
-type UnsafeScopedRoleServiceServer interface {
-	mustEmbedUnimplementedScopedRoleServiceServer()
-}
-
-func RegisterScopedRoleServiceServer(s grpc.ServiceRegistrar, srv ScopedRoleServiceServer) {
-	// If the following call pancis, it indicates UnimplementedScopedRoleServiceServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&ScopedRoleService_ServiceDesc, srv)
-}
-
-func _ScopedRoleService_GetScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetScopedRoleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).GetScopedRole(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_GetScopedRole_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).GetScopedRole(ctx, req.(*GetScopedRoleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_ListScopedRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListScopedRolesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).ListScopedRoles(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_ListScopedRoles_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).ListScopedRoles(ctx, req.(*ListScopedRolesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_CreateScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(CreateScopedRoleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).CreateScopedRole(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_CreateScopedRole_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).CreateScopedRole(ctx, req.(*CreateScopedRoleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_UpdateScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UpdateScopedRoleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).UpdateScopedRole(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_UpdateScopedRole_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).UpdateScopedRole(ctx, req.(*UpdateScopedRoleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_DeleteScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteScopedRoleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).DeleteScopedRole(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_DeleteScopedRole_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).DeleteScopedRole(ctx, req.(*DeleteScopedRoleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_GetScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetScopedRoleAssignmentRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).GetScopedRoleAssignment(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_GetScopedRoleAssignment_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).GetScopedRoleAssignment(ctx, req.(*GetScopedRoleAssignmentRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_ListScopedRoleAssignments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListScopedRoleAssignmentsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).ListScopedRoleAssignments(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_ListScopedRoleAssignments_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).ListScopedRoleAssignments(ctx, req.(*ListScopedRoleAssignmentsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_CreateScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(CreateScopedRoleAssignmentRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).CreateScopedRoleAssignment(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_CreateScopedRoleAssignment_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).CreateScopedRoleAssignment(ctx, req.(*CreateScopedRoleAssignmentRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedRoleService_DeleteScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteScopedRoleAssignmentRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedRoleServiceServer).DeleteScopedRoleAssignment(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedRoleService_DeleteScopedRoleAssignment_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedRoleServiceServer).DeleteScopedRoleAssignment(ctx, req.(*DeleteScopedRoleAssignmentRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// ScopedRoleService_ServiceDesc is the grpc.ServiceDesc for ScopedRoleService service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var ScopedRoleService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "teleport.scopedrole.v1.ScopedRoleService",
-	HandlerType: (*ScopedRoleServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "GetScopedRole",
-			Handler:    _ScopedRoleService_GetScopedRole_Handler,
-		},
-		{
-			MethodName: "ListScopedRoles",
-			Handler:    _ScopedRoleService_ListScopedRoles_Handler,
-		},
-		{
-			MethodName: "CreateScopedRole",
-			Handler:    _ScopedRoleService_CreateScopedRole_Handler,
-		},
-		{
-			MethodName: "UpdateScopedRole",
-			Handler:    _ScopedRoleService_UpdateScopedRole_Handler,
-		},
-		{
-			MethodName: "DeleteScopedRole",
-			Handler:    _ScopedRoleService_DeleteScopedRole_Handler,
-		},
-		{
-			MethodName: "GetScopedRoleAssignment",
-			Handler:    _ScopedRoleService_GetScopedRoleAssignment_Handler,
-		},
-		{
-			MethodName: "ListScopedRoleAssignments",
-			Handler:    _ScopedRoleService_ListScopedRoleAssignments_Handler,
-		},
-		{
-			MethodName: "CreateScopedRoleAssignment",
-			Handler:    _ScopedRoleService_CreateScopedRoleAssignment_Handler,
-		},
-		{
-			MethodName: "DeleteScopedRoleAssignment",
-			Handler:    _ScopedRoleService_DeleteScopedRoleAssignment_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "teleport/scopedrole/v1/service.proto",
-}
diff --git a/api/gen/proto/go/teleport/scopedtoken/v1/service.pb.go b/api/gen/proto/go/teleport/scopedtoken/v1/service.pb.go
deleted file mode 100644
index 2f36dd7ccb1a4..0000000000000
--- a/api/gen/proto/go/teleport/scopedtoken/v1/service.pb.go
+++ /dev/null
@@ -1,647 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/scopedtoken/v1/service.proto
-
-package scopedtoken
-
-import (
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// GetScopedTokenRequest is the request to get a scoped token.
-type GetScopedTokenRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped token.
-	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedTokenRequest) Reset() {
-	*x = GetScopedTokenRequest{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedTokenRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedTokenRequest) ProtoMessage() {}
-
-func (x *GetScopedTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedTokenRequest.ProtoReflect.Descriptor instead.
-func (*GetScopedTokenRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *GetScopedTokenRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-// GetScopedTokenResponse is the response to get a scoped token.
-type GetScopedTokenResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Token is the scoped token.
-	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetScopedTokenResponse) Reset() {
-	*x = GetScopedTokenResponse{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetScopedTokenResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetScopedTokenResponse) ProtoMessage() {}
-
-func (x *GetScopedTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetScopedTokenResponse.ProtoReflect.Descriptor instead.
-func (*GetScopedTokenResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *GetScopedTokenResponse) GetToken() *ScopedToken {
-	if x != nil {
-		return x.Token
-	}
-	return nil
-}
-
-// ListScopedTokensRequest is the request to list scoped tokens.
-type ListScopedTokensRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// ResourceScope filters tokens by their resource scope if specified.
-	ResourceScope *v1.Filter `protobuf:"bytes,1,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
-	// AssignedScope filters tokens by their assigned scope if specified.
-	AssignedScope *v1.Filter `protobuf:"bytes,2,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
-	// Cursor is the pagination cursor.
-	Cursor string `protobuf:"bytes,3,opt,name=cursor,proto3" json:"cursor,omitempty"`
-	// Limit is the maximum number of results to return.
-	Limit         uint32 `protobuf:"varint,4,opt,name=limit,proto3" json:"limit,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListScopedTokensRequest) Reset() {
-	*x = ListScopedTokensRequest{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[2]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedTokensRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedTokensRequest) ProtoMessage() {}
-
-func (x *ListScopedTokensRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[2]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedTokensRequest.ProtoReflect.Descriptor instead.
-func (*ListScopedTokensRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *ListScopedTokensRequest) GetResourceScope() *v1.Filter {
-	if x != nil {
-		return x.ResourceScope
-	}
-	return nil
-}
-
-func (x *ListScopedTokensRequest) GetAssignedScope() *v1.Filter {
-	if x != nil {
-		return x.AssignedScope
-	}
-	return nil
-}
-
-func (x *ListScopedTokensRequest) GetCursor() string {
-	if x != nil {
-		return x.Cursor
-	}
-	return ""
-}
-
-func (x *ListScopedTokensRequest) GetLimit() uint32 {
-	if x != nil {
-		return x.Limit
-	}
-	return 0
-}
-
-// ListScopedTokensResponse is the response to list scoped tokens.
-type ListScopedTokensResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Tokens is the list of scoped tokens.
-	Tokens []*ScopedToken `protobuf:"bytes,1,rep,name=tokens,proto3" json:"tokens,omitempty"`
-	// Cursor is the pagination cursor.
-	Cursor        string `protobuf:"bytes,2,opt,name=cursor,proto3" json:"cursor,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListScopedTokensResponse) Reset() {
-	*x = ListScopedTokensResponse{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[3]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ListScopedTokensResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListScopedTokensResponse) ProtoMessage() {}
-
-func (x *ListScopedTokensResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[3]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListScopedTokensResponse.ProtoReflect.Descriptor instead.
-func (*ListScopedTokensResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *ListScopedTokensResponse) GetTokens() []*ScopedToken {
-	if x != nil {
-		return x.Tokens
-	}
-	return nil
-}
-
-func (x *ListScopedTokensResponse) GetCursor() string {
-	if x != nil {
-		return x.Cursor
-	}
-	return ""
-}
-
-// CreateScopedTokenRequest is the request to create a scoped token.
-type CreateScopedTokenRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Token is the scoped token to create.
-	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedTokenRequest) Reset() {
-	*x = CreateScopedTokenRequest{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[4]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedTokenRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedTokenRequest) ProtoMessage() {}
-
-func (x *CreateScopedTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[4]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedTokenRequest.ProtoReflect.Descriptor instead.
-func (*CreateScopedTokenRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *CreateScopedTokenRequest) GetToken() *ScopedToken {
-	if x != nil {
-		return x.Token
-	}
-	return nil
-}
-
-// CreateScopedTokenResponse is the response to create a scoped token.
-type CreateScopedTokenResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Token is the scoped token that was created.
-	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *CreateScopedTokenResponse) Reset() {
-	*x = CreateScopedTokenResponse{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[5]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *CreateScopedTokenResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CreateScopedTokenResponse) ProtoMessage() {}
-
-func (x *CreateScopedTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[5]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CreateScopedTokenResponse.ProtoReflect.Descriptor instead.
-func (*CreateScopedTokenResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *CreateScopedTokenResponse) GetToken() *ScopedToken {
-	if x != nil {
-		return x.Token
-	}
-	return nil
-}
-
-// UpdateScopedTokenRequest is the request to update a scoped token.
-type UpdateScopedTokenRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Token is the scoped token to update.
-	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *UpdateScopedTokenRequest) Reset() {
-	*x = UpdateScopedTokenRequest{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[6]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *UpdateScopedTokenRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateScopedTokenRequest) ProtoMessage() {}
-
-func (x *UpdateScopedTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[6]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateScopedTokenRequest.ProtoReflect.Descriptor instead.
-func (*UpdateScopedTokenRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *UpdateScopedTokenRequest) GetToken() *ScopedToken {
-	if x != nil {
-		return x.Token
-	}
-	return nil
-}
-
-// UpdateScopedTokenResponse is the response to update a scoped token.
-type UpdateScopedTokenResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Token is the post-update scoped token.
-	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *UpdateScopedTokenResponse) Reset() {
-	*x = UpdateScopedTokenResponse{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[7]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *UpdateScopedTokenResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateScopedTokenResponse) ProtoMessage() {}
-
-func (x *UpdateScopedTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[7]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateScopedTokenResponse.ProtoReflect.Descriptor instead.
-func (*UpdateScopedTokenResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *UpdateScopedTokenResponse) GetToken() *ScopedToken {
-	if x != nil {
-		return x.Token
-	}
-	return nil
-}
-
-// DeleteScopedTokenRequest is the request to delete a scoped token.
-type DeleteScopedTokenRequest struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Name is the name of the scoped token to delete.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	// Revision asserts the revision of the scoped token to delete (optional).
-	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedTokenRequest) Reset() {
-	*x = DeleteScopedTokenRequest{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[8]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedTokenRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedTokenRequest) ProtoMessage() {}
-
-func (x *DeleteScopedTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[8]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedTokenRequest.ProtoReflect.Descriptor instead.
-func (*DeleteScopedTokenRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *DeleteScopedTokenRequest) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-func (x *DeleteScopedTokenRequest) GetRevision() string {
-	if x != nil {
-		return x.Revision
-	}
-	return ""
-}
-
-// DeleteScopedTokenResponse is the response to delete a scoped token.
-type DeleteScopedTokenResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DeleteScopedTokenResponse) Reset() {
-	*x = DeleteScopedTokenResponse{}
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[9]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DeleteScopedTokenResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteScopedTokenResponse) ProtoMessage() {}
-
-func (x *DeleteScopedTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_service_proto_msgTypes[9]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteScopedTokenResponse.ProtoReflect.Descriptor instead.
-func (*DeleteScopedTokenResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_service_proto_rawDescGZIP(), []int{9}
-}
-
-var File_teleport_scopedtoken_v1_service_proto protoreflect.FileDescriptor
-
-const file_teleport_scopedtoken_v1_service_proto_rawDesc = "" +
-	"\n" +
-	"%teleport/scopedtoken/v1/service.proto\x12\x17teleport.scopedtoken.v1\x1a#teleport/scopedtoken/v1/token.proto\x1a\x1fteleport/scopes/v1/scopes.proto\"+\n" +
-	"\x15GetScopedTokenRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\"T\n" +
-	"\x16GetScopedTokenResponse\x12:\n" +
-	"\x05token\x18\x01 \x01(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x05token\"\xcd\x01\n" +
-	"\x17ListScopedTokensRequest\x12A\n" +
-	"\x0eresource_scope\x18\x01 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12A\n" +
-	"\x0eassigned_scope\x18\x02 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rassignedScope\x12\x16\n" +
-	"\x06cursor\x18\x03 \x01(\tR\x06cursor\x12\x14\n" +
-	"\x05limit\x18\x04 \x01(\rR\x05limit\"p\n" +
-	"\x18ListScopedTokensResponse\x12<\n" +
-	"\x06tokens\x18\x01 \x03(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x06tokens\x12\x16\n" +
-	"\x06cursor\x18\x02 \x01(\tR\x06cursor\"V\n" +
-	"\x18CreateScopedTokenRequest\x12:\n" +
-	"\x05token\x18\x01 \x01(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x05token\"W\n" +
-	"\x19CreateScopedTokenResponse\x12:\n" +
-	"\x05token\x18\x01 \x01(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x05token\"V\n" +
-	"\x18UpdateScopedTokenRequest\x12:\n" +
-	"\x05token\x18\x01 \x01(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x05token\"W\n" +
-	"\x19UpdateScopedTokenResponse\x12:\n" +
-	"\x05token\x18\x01 \x01(\v2$.teleport.scopedtoken.v1.ScopedTokenR\x05token\"J\n" +
-	"\x18DeleteScopedTokenRequest\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
-	"\brevision\x18\x02 \x01(\tR\brevision\"\x1b\n" +
-	"\x19DeleteScopedTokenResponse2\xf4\x04\n" +
-	"\x12ScopedTokenService\x12q\n" +
-	"\x0eGetScopedToken\x12..teleport.scopedtoken.v1.GetScopedTokenRequest\x1a/.teleport.scopedtoken.v1.GetScopedTokenResponse\x12w\n" +
-	"\x10ListScopedTokens\x120.teleport.scopedtoken.v1.ListScopedTokensRequest\x1a1.teleport.scopedtoken.v1.ListScopedTokensResponse\x12z\n" +
-	"\x11CreateScopedToken\x121.teleport.scopedtoken.v1.CreateScopedTokenRequest\x1a2.teleport.scopedtoken.v1.CreateScopedTokenResponse\x12z\n" +
-	"\x11UpdateScopedToken\x121.teleport.scopedtoken.v1.UpdateScopedTokenRequest\x1a2.teleport.scopedtoken.v1.UpdateScopedTokenResponse\x12z\n" +
-	"\x11DeleteScopedToken\x121.teleport.scopedtoken.v1.DeleteScopedTokenRequest\x1a2.teleport.scopedtoken.v1.DeleteScopedTokenResponseBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopedtoken/v1;scopedtokenb\x06proto3"
-
-var (
-	file_teleport_scopedtoken_v1_service_proto_rawDescOnce sync.Once
-	file_teleport_scopedtoken_v1_service_proto_rawDescData []byte
-)
-
-func file_teleport_scopedtoken_v1_service_proto_rawDescGZIP() []byte {
-	file_teleport_scopedtoken_v1_service_proto_rawDescOnce.Do(func() {
-		file_teleport_scopedtoken_v1_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopedtoken_v1_service_proto_rawDesc), len(file_teleport_scopedtoken_v1_service_proto_rawDesc)))
-	})
-	return file_teleport_scopedtoken_v1_service_proto_rawDescData
-}
-
-var file_teleport_scopedtoken_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
-var file_teleport_scopedtoken_v1_service_proto_goTypes = []any{
-	(*GetScopedTokenRequest)(nil),     // 0: teleport.scopedtoken.v1.GetScopedTokenRequest
-	(*GetScopedTokenResponse)(nil),    // 1: teleport.scopedtoken.v1.GetScopedTokenResponse
-	(*ListScopedTokensRequest)(nil),   // 2: teleport.scopedtoken.v1.ListScopedTokensRequest
-	(*ListScopedTokensResponse)(nil),  // 3: teleport.scopedtoken.v1.ListScopedTokensResponse
-	(*CreateScopedTokenRequest)(nil),  // 4: teleport.scopedtoken.v1.CreateScopedTokenRequest
-	(*CreateScopedTokenResponse)(nil), // 5: teleport.scopedtoken.v1.CreateScopedTokenResponse
-	(*UpdateScopedTokenRequest)(nil),  // 6: teleport.scopedtoken.v1.UpdateScopedTokenRequest
-	(*UpdateScopedTokenResponse)(nil), // 7: teleport.scopedtoken.v1.UpdateScopedTokenResponse
-	(*DeleteScopedTokenRequest)(nil),  // 8: teleport.scopedtoken.v1.DeleteScopedTokenRequest
-	(*DeleteScopedTokenResponse)(nil), // 9: teleport.scopedtoken.v1.DeleteScopedTokenResponse
-	(*ScopedToken)(nil),               // 10: teleport.scopedtoken.v1.ScopedToken
-	(*v1.Filter)(nil),                 // 11: teleport.scopes.v1.Filter
-}
-var file_teleport_scopedtoken_v1_service_proto_depIdxs = []int32{
-	10, // 0: teleport.scopedtoken.v1.GetScopedTokenResponse.token:type_name -> teleport.scopedtoken.v1.ScopedToken
-	11, // 1: teleport.scopedtoken.v1.ListScopedTokensRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
-	11, // 2: teleport.scopedtoken.v1.ListScopedTokensRequest.assigned_scope:type_name -> teleport.scopes.v1.Filter
-	10, // 3: teleport.scopedtoken.v1.ListScopedTokensResponse.tokens:type_name -> teleport.scopedtoken.v1.ScopedToken
-	10, // 4: teleport.scopedtoken.v1.CreateScopedTokenRequest.token:type_name -> teleport.scopedtoken.v1.ScopedToken
-	10, // 5: teleport.scopedtoken.v1.CreateScopedTokenResponse.token:type_name -> teleport.scopedtoken.v1.ScopedToken
-	10, // 6: teleport.scopedtoken.v1.UpdateScopedTokenRequest.token:type_name -> teleport.scopedtoken.v1.ScopedToken
-	10, // 7: teleport.scopedtoken.v1.UpdateScopedTokenResponse.token:type_name -> teleport.scopedtoken.v1.ScopedToken
-	0,  // 8: teleport.scopedtoken.v1.ScopedTokenService.GetScopedToken:input_type -> teleport.scopedtoken.v1.GetScopedTokenRequest
-	2,  // 9: teleport.scopedtoken.v1.ScopedTokenService.ListScopedTokens:input_type -> teleport.scopedtoken.v1.ListScopedTokensRequest
-	4,  // 10: teleport.scopedtoken.v1.ScopedTokenService.CreateScopedToken:input_type -> teleport.scopedtoken.v1.CreateScopedTokenRequest
-	6,  // 11: teleport.scopedtoken.v1.ScopedTokenService.UpdateScopedToken:input_type -> teleport.scopedtoken.v1.UpdateScopedTokenRequest
-	8,  // 12: teleport.scopedtoken.v1.ScopedTokenService.DeleteScopedToken:input_type -> teleport.scopedtoken.v1.DeleteScopedTokenRequest
-	1,  // 13: teleport.scopedtoken.v1.ScopedTokenService.GetScopedToken:output_type -> teleport.scopedtoken.v1.GetScopedTokenResponse
-	3,  // 14: teleport.scopedtoken.v1.ScopedTokenService.ListScopedTokens:output_type -> teleport.scopedtoken.v1.ListScopedTokensResponse
-	5,  // 15: teleport.scopedtoken.v1.ScopedTokenService.CreateScopedToken:output_type -> teleport.scopedtoken.v1.CreateScopedTokenResponse
-	7,  // 16: teleport.scopedtoken.v1.ScopedTokenService.UpdateScopedToken:output_type -> teleport.scopedtoken.v1.UpdateScopedTokenResponse
-	9,  // 17: teleport.scopedtoken.v1.ScopedTokenService.DeleteScopedToken:output_type -> teleport.scopedtoken.v1.DeleteScopedTokenResponse
-	13, // [13:18] is the sub-list for method output_type
-	8,  // [8:13] is the sub-list for method input_type
-	8,  // [8:8] is the sub-list for extension type_name
-	8,  // [8:8] is the sub-list for extension extendee
-	0,  // [0:8] is the sub-list for field type_name
-}
-
-func init() { file_teleport_scopedtoken_v1_service_proto_init() }
-func file_teleport_scopedtoken_v1_service_proto_init() {
-	if File_teleport_scopedtoken_v1_service_proto != nil {
-		return
-	}
-	file_teleport_scopedtoken_v1_token_proto_init()
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopedtoken_v1_service_proto_rawDesc), len(file_teleport_scopedtoken_v1_service_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   10,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_teleport_scopedtoken_v1_service_proto_goTypes,
-		DependencyIndexes: file_teleport_scopedtoken_v1_service_proto_depIdxs,
-		MessageInfos:      file_teleport_scopedtoken_v1_service_proto_msgTypes,
-	}.Build()
-	File_teleport_scopedtoken_v1_service_proto = out.File
-	file_teleport_scopedtoken_v1_service_proto_goTypes = nil
-	file_teleport_scopedtoken_v1_service_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/scopedtoken/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/scopedtoken/v1/service_grpc.pb.go
deleted file mode 100644
index 93d0abc2deccf..0000000000000
--- a/api/gen/proto/go/teleport/scopedtoken/v1/service_grpc.pb.go
+++ /dev/null
@@ -1,301 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             (unknown)
-// source: teleport/scopedtoken/v1/service.proto
-
-package scopedtoken
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
-
-const (
-	ScopedTokenService_GetScopedToken_FullMethodName    = "/teleport.scopedtoken.v1.ScopedTokenService/GetScopedToken"
-	ScopedTokenService_ListScopedTokens_FullMethodName  = "/teleport.scopedtoken.v1.ScopedTokenService/ListScopedTokens"
-	ScopedTokenService_CreateScopedToken_FullMethodName = "/teleport.scopedtoken.v1.ScopedTokenService/CreateScopedToken"
-	ScopedTokenService_UpdateScopedToken_FullMethodName = "/teleport.scopedtoken.v1.ScopedTokenService/UpdateScopedToken"
-	ScopedTokenService_DeleteScopedToken_FullMethodName = "/teleport.scopedtoken.v1.ScopedTokenService/DeleteScopedToken"
-)
-
-// ScopedTokenServiceClient is the client API for ScopedTokenService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// ScopedTokenService provides an API for managing scoped token resources and their assignments.
-type ScopedTokenServiceClient interface {
-	// GetScopedToken gets a scoped token by name.
-	GetScopedToken(ctx context.Context, in *GetScopedTokenRequest, opts ...grpc.CallOption) (*GetScopedTokenResponse, error)
-	// ListScopedTokens returns a paginated list of scoped tokens.
-	ListScopedTokens(ctx context.Context, in *ListScopedTokensRequest, opts ...grpc.CallOption) (*ListScopedTokensResponse, error)
-	// CreateScopedToken creates a new scoped token.
-	CreateScopedToken(ctx context.Context, in *CreateScopedTokenRequest, opts ...grpc.CallOption) (*CreateScopedTokenResponse, error)
-	// UpdateScopedToken updates a scoped token.
-	UpdateScopedToken(ctx context.Context, in *UpdateScopedTokenRequest, opts ...grpc.CallOption) (*UpdateScopedTokenResponse, error)
-	// DeleteScopedToken deletes a scoped token.
-	DeleteScopedToken(ctx context.Context, in *DeleteScopedTokenRequest, opts ...grpc.CallOption) (*DeleteScopedTokenResponse, error)
-}
-
-type scopedTokenServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewScopedTokenServiceClient(cc grpc.ClientConnInterface) ScopedTokenServiceClient {
-	return &scopedTokenServiceClient{cc}
-}
-
-func (c *scopedTokenServiceClient) GetScopedToken(ctx context.Context, in *GetScopedTokenRequest, opts ...grpc.CallOption) (*GetScopedTokenResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(GetScopedTokenResponse)
-	err := c.cc.Invoke(ctx, ScopedTokenService_GetScopedToken_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedTokenServiceClient) ListScopedTokens(ctx context.Context, in *ListScopedTokensRequest, opts ...grpc.CallOption) (*ListScopedTokensResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListScopedTokensResponse)
-	err := c.cc.Invoke(ctx, ScopedTokenService_ListScopedTokens_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedTokenServiceClient) CreateScopedToken(ctx context.Context, in *CreateScopedTokenRequest, opts ...grpc.CallOption) (*CreateScopedTokenResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(CreateScopedTokenResponse)
-	err := c.cc.Invoke(ctx, ScopedTokenService_CreateScopedToken_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedTokenServiceClient) UpdateScopedToken(ctx context.Context, in *UpdateScopedTokenRequest, opts ...grpc.CallOption) (*UpdateScopedTokenResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(UpdateScopedTokenResponse)
-	err := c.cc.Invoke(ctx, ScopedTokenService_UpdateScopedToken_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *scopedTokenServiceClient) DeleteScopedToken(ctx context.Context, in *DeleteScopedTokenRequest, opts ...grpc.CallOption) (*DeleteScopedTokenResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(DeleteScopedTokenResponse)
-	err := c.cc.Invoke(ctx, ScopedTokenService_DeleteScopedToken_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// ScopedTokenServiceServer is the server API for ScopedTokenService service.
-// All implementations must embed UnimplementedScopedTokenServiceServer
-// for forward compatibility.
-//
-// ScopedTokenService provides an API for managing scoped token resources and their assignments.
-type ScopedTokenServiceServer interface {
-	// GetScopedToken gets a scoped token by name.
-	GetScopedToken(context.Context, *GetScopedTokenRequest) (*GetScopedTokenResponse, error)
-	// ListScopedTokens returns a paginated list of scoped tokens.
-	ListScopedTokens(context.Context, *ListScopedTokensRequest) (*ListScopedTokensResponse, error)
-	// CreateScopedToken creates a new scoped token.
-	CreateScopedToken(context.Context, *CreateScopedTokenRequest) (*CreateScopedTokenResponse, error)
-	// UpdateScopedToken updates a scoped token.
-	UpdateScopedToken(context.Context, *UpdateScopedTokenRequest) (*UpdateScopedTokenResponse, error)
-	// DeleteScopedToken deletes a scoped token.
-	DeleteScopedToken(context.Context, *DeleteScopedTokenRequest) (*DeleteScopedTokenResponse, error)
-	mustEmbedUnimplementedScopedTokenServiceServer()
-}
-
-// UnimplementedScopedTokenServiceServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedScopedTokenServiceServer struct{}
-
-func (UnimplementedScopedTokenServiceServer) GetScopedToken(context.Context, *GetScopedTokenRequest) (*GetScopedTokenResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetScopedToken not implemented")
-}
-func (UnimplementedScopedTokenServiceServer) ListScopedTokens(context.Context, *ListScopedTokensRequest) (*ListScopedTokensResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListScopedTokens not implemented")
-}
-func (UnimplementedScopedTokenServiceServer) CreateScopedToken(context.Context, *CreateScopedTokenRequest) (*CreateScopedTokenResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedToken not implemented")
-}
-func (UnimplementedScopedTokenServiceServer) UpdateScopedToken(context.Context, *UpdateScopedTokenRequest) (*UpdateScopedTokenResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdateScopedToken not implemented")
-}
-func (UnimplementedScopedTokenServiceServer) DeleteScopedToken(context.Context, *DeleteScopedTokenRequest) (*DeleteScopedTokenResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedToken not implemented")
-}
-func (UnimplementedScopedTokenServiceServer) mustEmbedUnimplementedScopedTokenServiceServer() {}
-func (UnimplementedScopedTokenServiceServer) testEmbeddedByValue()                            {}
-
-// UnsafeScopedTokenServiceServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to ScopedTokenServiceServer will
-// result in compilation errors.
-type UnsafeScopedTokenServiceServer interface {
-	mustEmbedUnimplementedScopedTokenServiceServer()
-}
-
-func RegisterScopedTokenServiceServer(s grpc.ServiceRegistrar, srv ScopedTokenServiceServer) {
-	// If the following call pancis, it indicates UnimplementedScopedTokenServiceServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
-	s.RegisterService(&ScopedTokenService_ServiceDesc, srv)
-}
-
-func _ScopedTokenService_GetScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetScopedTokenRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedTokenServiceServer).GetScopedToken(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedTokenService_GetScopedToken_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedTokenServiceServer).GetScopedToken(ctx, req.(*GetScopedTokenRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedTokenService_ListScopedTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListScopedTokensRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedTokenServiceServer).ListScopedTokens(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedTokenService_ListScopedTokens_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedTokenServiceServer).ListScopedTokens(ctx, req.(*ListScopedTokensRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedTokenService_CreateScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(CreateScopedTokenRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedTokenServiceServer).CreateScopedToken(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedTokenService_CreateScopedToken_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedTokenServiceServer).CreateScopedToken(ctx, req.(*CreateScopedTokenRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedTokenService_UpdateScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UpdateScopedTokenRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedTokenServiceServer).UpdateScopedToken(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedTokenService_UpdateScopedToken_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedTokenServiceServer).UpdateScopedToken(ctx, req.(*UpdateScopedTokenRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ScopedTokenService_DeleteScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteScopedTokenRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ScopedTokenServiceServer).DeleteScopedToken(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: ScopedTokenService_DeleteScopedToken_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ScopedTokenServiceServer).DeleteScopedToken(ctx, req.(*DeleteScopedTokenRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// ScopedTokenService_ServiceDesc is the grpc.ServiceDesc for ScopedTokenService service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var ScopedTokenService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "teleport.scopedtoken.v1.ScopedTokenService",
-	HandlerType: (*ScopedTokenServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "GetScopedToken",
-			Handler:    _ScopedTokenService_GetScopedToken_Handler,
-		},
-		{
-			MethodName: "ListScopedTokens",
-			Handler:    _ScopedTokenService_ListScopedTokens_Handler,
-		},
-		{
-			MethodName: "CreateScopedToken",
-			Handler:    _ScopedTokenService_CreateScopedToken_Handler,
-		},
-		{
-			MethodName: "UpdateScopedToken",
-			Handler:    _ScopedTokenService_UpdateScopedToken_Handler,
-		},
-		{
-			MethodName: "DeleteScopedToken",
-			Handler:    _ScopedTokenService_DeleteScopedToken_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "teleport/scopedtoken/v1/service.proto",
-}
diff --git a/api/gen/proto/go/teleport/scopedtoken/v1/token.pb.go b/api/gen/proto/go/teleport/scopedtoken/v1/token.pb.go
deleted file mode 100644
index 4653888a0340d..0000000000000
--- a/api/gen/proto/go/teleport/scopedtoken/v1/token.pb.go
+++ /dev/null
@@ -1,244 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        (unknown)
-// source: teleport/scopedtoken/v1/token.proto
-
-package scopedtoken
-
-import (
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// ScopedToken is a token whose resource and permissions are scoped. Scoped tokens are used for the provisioning
-// of teleport agents locked to specific scopes. Scoped tokens implement a subset of the functionality of standard
-// provisioning tokens, specifically tailored to the usecase of limited admins/users provisioning resources within
-// sub-scopes over which they have been granted elevated privileges.
-type ScopedToken struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Kind is the resource kind.
-	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
-	// SubKind is the resource sub-kind.
-	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
-	// Version is the resource version.
-	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
-	// Metadata contains the resource metadata.
-	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	// Scope is the scope of the token resource.
-	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
-	// Spec is the token specification.
-	Spec          *ScopedTokenSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ScopedToken) Reset() {
-	*x = ScopedToken{}
-	mi := &file_teleport_scopedtoken_v1_token_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedToken) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedToken) ProtoMessage() {}
-
-func (x *ScopedToken) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_token_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedToken.ProtoReflect.Descriptor instead.
-func (*ScopedToken) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_token_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *ScopedToken) GetKind() string {
-	if x != nil {
-		return x.Kind
-	}
-	return ""
-}
-
-func (x *ScopedToken) GetSubKind() string {
-	if x != nil {
-		return x.SubKind
-	}
-	return ""
-}
-
-func (x *ScopedToken) GetVersion() string {
-	if x != nil {
-		return x.Version
-	}
-	return ""
-}
-
-func (x *ScopedToken) GetMetadata() *v1.Metadata {
-	if x != nil {
-		return x.Metadata
-	}
-	return nil
-}
-
-func (x *ScopedToken) GetScope() string {
-	if x != nil {
-		return x.Scope
-	}
-	return ""
-}
-
-func (x *ScopedToken) GetSpec() *ScopedTokenSpec {
-	if x != nil {
-		return x.Spec
-	}
-	return nil
-}
-
-// ScopedTokenSpec is the specification of a scoped token.
-type ScopedTokenSpec struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// AssignedScope is the scope to which this token is assigned.
-	AssignedScope string `protobuf:"bytes,1,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ScopedTokenSpec) Reset() {
-	*x = ScopedTokenSpec{}
-	mi := &file_teleport_scopedtoken_v1_token_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *ScopedTokenSpec) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ScopedTokenSpec) ProtoMessage() {}
-
-func (x *ScopedTokenSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopedtoken_v1_token_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ScopedTokenSpec.ProtoReflect.Descriptor instead.
-func (*ScopedTokenSpec) Descriptor() ([]byte, []int) {
-	return file_teleport_scopedtoken_v1_token_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *ScopedTokenSpec) GetAssignedScope() string {
-	if x != nil {
-		return x.AssignedScope
-	}
-	return ""
-}
-
-var File_teleport_scopedtoken_v1_token_proto protoreflect.FileDescriptor
-
-const file_teleport_scopedtoken_v1_token_proto_rawDesc = "" +
-	"\n" +
-	"#teleport/scopedtoken/v1/token.proto\x12\x17teleport.scopedtoken.v1\x1a!teleport/header/v1/metadata.proto\"\xe4\x01\n" +
-	"\vScopedToken\x12\x12\n" +
-	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
-	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
-	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
-	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
-	"\x05scope\x18\x05 \x01(\tR\x05scope\x12<\n" +
-	"\x04spec\x18\x06 \x01(\v2(.teleport.scopedtoken.v1.ScopedTokenSpecR\x04spec\"8\n" +
-	"\x0fScopedTokenSpec\x12%\n" +
-	"\x0eassigned_scope\x18\x01 \x01(\tR\rassignedScopeBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopedtoken/v1;scopedtokenb\x06proto3"
-
-var (
-	file_teleport_scopedtoken_v1_token_proto_rawDescOnce sync.Once
-	file_teleport_scopedtoken_v1_token_proto_rawDescData []byte
-)
-
-func file_teleport_scopedtoken_v1_token_proto_rawDescGZIP() []byte {
-	file_teleport_scopedtoken_v1_token_proto_rawDescOnce.Do(func() {
-		file_teleport_scopedtoken_v1_token_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopedtoken_v1_token_proto_rawDesc), len(file_teleport_scopedtoken_v1_token_proto_rawDesc)))
-	})
-	return file_teleport_scopedtoken_v1_token_proto_rawDescData
-}
-
-var file_teleport_scopedtoken_v1_token_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_teleport_scopedtoken_v1_token_proto_goTypes = []any{
-	(*ScopedToken)(nil),     // 0: teleport.scopedtoken.v1.ScopedToken
-	(*ScopedTokenSpec)(nil), // 1: teleport.scopedtoken.v1.ScopedTokenSpec
-	(*v1.Metadata)(nil),     // 2: teleport.header.v1.Metadata
-}
-var file_teleport_scopedtoken_v1_token_proto_depIdxs = []int32{
-	2, // 0: teleport.scopedtoken.v1.ScopedToken.metadata:type_name -> teleport.header.v1.Metadata
-	1, // 1: teleport.scopedtoken.v1.ScopedToken.spec:type_name -> teleport.scopedtoken.v1.ScopedTokenSpec
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
-}
-
-func init() { file_teleport_scopedtoken_v1_token_proto_init() }
-func file_teleport_scopedtoken_v1_token_proto_init() {
-	if File_teleport_scopedtoken_v1_token_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopedtoken_v1_token_proto_rawDesc), len(file_teleport_scopedtoken_v1_token_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   2,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_teleport_scopedtoken_v1_token_proto_goTypes,
-		DependencyIndexes: file_teleport_scopedtoken_v1_token_proto_depIdxs,
-		MessageInfos:      file_teleport_scopedtoken_v1_token_proto_msgTypes,
-	}.Build()
-	File_teleport_scopedtoken_v1_token_proto = out.File
-	file_teleport_scopedtoken_v1_token_proto_goTypes = nil
-	file_teleport_scopedtoken_v1_token_proto_depIdxs = nil
-}
diff --git a/api/gen/proto/go/teleport/scopes/access/v1/assignment.pb.go b/api/gen/proto/go/teleport/scopes/access/v1/assignment.pb.go
new file mode 100644
index 0000000000000..93f955ac0c836
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/access/v1/assignment.pb.go
@@ -0,0 +1,316 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/scopes/access/v1/assignment.proto
+
+package accessv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ScopedRoleAssignment is a role assignment whose resource and permissions are scoped. A scoped role assignment
+// assigns roles to users at scopes. One assignment may contain multiple roles at multiple scopes. Most assignments
+// are stored at random IDs, but some assignments created by teleport may have special static names that are
+// reserved for teleport's internal use (e.g. for managing the set of subassignments generated by a connector).
+type ScopedRoleAssignment struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Metadata contains the resource metadata.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Scope is the scope of the role assignment resource.
+	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
+	// Spec is the role assignment specification.
+	Spec          *ScopedRoleAssignmentSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRoleAssignment) Reset() {
+	*x = ScopedRoleAssignment{}
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRoleAssignment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRoleAssignment) ProtoMessage() {}
+
+func (x *ScopedRoleAssignment) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRoleAssignment.ProtoReflect.Descriptor instead.
+func (*ScopedRoleAssignment) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_assignment_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ScopedRoleAssignment) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *ScopedRoleAssignment) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *ScopedRoleAssignment) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *ScopedRoleAssignment) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ScopedRoleAssignment) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+func (x *ScopedRoleAssignment) GetSpec() *ScopedRoleAssignmentSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// ScopedRoleAssignmentSpec is the specification of a scoped role.
+type ScopedRoleAssignmentSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// User is the user to whom all contained assignments apply.
+	User string `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	// Assignments is a list of individual role @ scope assignments.
+	Assignments   []*Assignment `protobuf:"bytes,2,rep,name=assignments,proto3" json:"assignments,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRoleAssignmentSpec) Reset() {
+	*x = ScopedRoleAssignmentSpec{}
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRoleAssignmentSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRoleAssignmentSpec) ProtoMessage() {}
+
+func (x *ScopedRoleAssignmentSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRoleAssignmentSpec.ProtoReflect.Descriptor instead.
+func (*ScopedRoleAssignmentSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_assignment_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ScopedRoleAssignmentSpec) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *ScopedRoleAssignmentSpec) GetAssignments() []*Assignment {
+	if x != nil {
+		return x.Assignments
+	}
+	return nil
+}
+
+// Assignment is a role/scope pair that defines an individual assignment.
+type Assignment struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Roles is the name of the role that is assigned by this assignment.
+	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	// Scope is the scope to which the role is assigned. This must be a member/child
+	// of the scope of the [ScopedRoleAssignment] in which this assignment is contained.
+	Scope         string `protobuf:"bytes,2,opt,name=scope,proto3" json:"scope,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Assignment) Reset() {
+	*x = Assignment{}
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Assignment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Assignment) ProtoMessage() {}
+
+func (x *Assignment) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_assignment_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Assignment.ProtoReflect.Descriptor instead.
+func (*Assignment) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_assignment_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Assignment) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+func (x *Assignment) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+var File_teleport_scopes_access_v1_assignment_proto protoreflect.FileDescriptor
+
+const file_teleport_scopes_access_v1_assignment_proto_rawDesc = "" +
+	"\n" +
+	"*teleport/scopes/access/v1/assignment.proto\x12\x19teleport.scopes.access.v1\x1a!teleport/header/v1/metadata.proto\"\xf8\x01\n" +
+	"\x14ScopedRoleAssignment\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
+	"\x05scope\x18\x05 \x01(\tR\x05scope\x12G\n" +
+	"\x04spec\x18\x06 \x01(\v23.teleport.scopes.access.v1.ScopedRoleAssignmentSpecR\x04spec\"w\n" +
+	"\x18ScopedRoleAssignmentSpec\x12\x12\n" +
+	"\x04user\x18\x01 \x01(\tR\x04user\x12G\n" +
+	"\vassignments\x18\x02 \x03(\v2%.teleport.scopes.access.v1.AssignmentR\vassignments\"6\n" +
+	"\n" +
+	"Assignment\x12\x12\n" +
+	"\x04role\x18\x01 \x01(\tR\x04role\x12\x14\n" +
+	"\x05scope\x18\x02 \x01(\tR\x05scopeBWZUgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1b\x06proto3"
+
+var (
+	file_teleport_scopes_access_v1_assignment_proto_rawDescOnce sync.Once
+	file_teleport_scopes_access_v1_assignment_proto_rawDescData []byte
+)
+
+func file_teleport_scopes_access_v1_assignment_proto_rawDescGZIP() []byte {
+	file_teleport_scopes_access_v1_assignment_proto_rawDescOnce.Do(func() {
+		file_teleport_scopes_access_v1_assignment_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_assignment_proto_rawDesc), len(file_teleport_scopes_access_v1_assignment_proto_rawDesc)))
+	})
+	return file_teleport_scopes_access_v1_assignment_proto_rawDescData
+}
+
+var file_teleport_scopes_access_v1_assignment_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_teleport_scopes_access_v1_assignment_proto_goTypes = []any{
+	(*ScopedRoleAssignment)(nil),     // 0: teleport.scopes.access.v1.ScopedRoleAssignment
+	(*ScopedRoleAssignmentSpec)(nil), // 1: teleport.scopes.access.v1.ScopedRoleAssignmentSpec
+	(*Assignment)(nil),               // 2: teleport.scopes.access.v1.Assignment
+	(*v1.Metadata)(nil),              // 3: teleport.header.v1.Metadata
+}
+var file_teleport_scopes_access_v1_assignment_proto_depIdxs = []int32{
+	3, // 0: teleport.scopes.access.v1.ScopedRoleAssignment.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.scopes.access.v1.ScopedRoleAssignment.spec:type_name -> teleport.scopes.access.v1.ScopedRoleAssignmentSpec
+	2, // 2: teleport.scopes.access.v1.ScopedRoleAssignmentSpec.assignments:type_name -> teleport.scopes.access.v1.Assignment
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_scopes_access_v1_assignment_proto_init() }
+func file_teleport_scopes_access_v1_assignment_proto_init() {
+	if File_teleport_scopes_access_v1_assignment_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_assignment_proto_rawDesc), len(file_teleport_scopes_access_v1_assignment_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_scopes_access_v1_assignment_proto_goTypes,
+		DependencyIndexes: file_teleport_scopes_access_v1_assignment_proto_depIdxs,
+		MessageInfos:      file_teleport_scopes_access_v1_assignment_proto_msgTypes,
+	}.Build()
+	File_teleport_scopes_access_v1_assignment_proto = out.File
+	file_teleport_scopes_access_v1_assignment_proto_goTypes = nil
+	file_teleport_scopes_access_v1_assignment_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/scopes/access/v1/role.pb.go b/api/gen/proto/go/teleport/scopes/access/v1/role.pb.go
new file mode 100644
index 0000000000000..fa486ffae32c3
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/access/v1/role.pb.go
@@ -0,0 +1,391 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/scopes/access/v1/role.proto
+
+package accessv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	v11 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ScopedRole is a role whose resource and permissions are scoped. Scoped roles implement a subset of role
+// features tailored to the usecases of scoped access and scoped access administration. Scoped roles may be
+// assigned to the same user multiple times at various scopes. Scoped roles do not contain deny rules.
+type ScopedRole struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Metadata contains the resource metadata.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Scope is the scope of the role resource.
+	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
+	// Spec is the role specification.
+	Spec          *ScopedRoleSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRole) Reset() {
+	*x = ScopedRole{}
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRole) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRole) ProtoMessage() {}
+
+func (x *ScopedRole) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRole.ProtoReflect.Descriptor instead.
+func (*ScopedRole) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_role_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ScopedRole) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *ScopedRole) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *ScopedRole) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *ScopedRole) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ScopedRole) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+func (x *ScopedRole) GetSpec() *ScopedRoleSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// ScopedRoleSpec is the specification of a scoped role.
+type ScopedRoleSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// AssignableScopes is a list of scopes to which this role can be assigned.
+	AssignableScopes []string `protobuf:"bytes,1,rep,name=assignable_scopes,json=assignableScopes,proto3" json:"assignable_scopes,omitempty"`
+	// Allow specifies the permissions granted by this role.
+	Allow         *ScopedRoleConditions `protobuf:"bytes,2,opt,name=allow,proto3" json:"allow,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRoleSpec) Reset() {
+	*x = ScopedRoleSpec{}
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRoleSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRoleSpec) ProtoMessage() {}
+
+func (x *ScopedRoleSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRoleSpec.ProtoReflect.Descriptor instead.
+func (*ScopedRoleSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_role_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ScopedRoleSpec) GetAssignableScopes() []string {
+	if x != nil {
+		return x.AssignableScopes
+	}
+	return nil
+}
+
+func (x *ScopedRoleSpec) GetAllow() *ScopedRoleConditions {
+	if x != nil {
+		return x.Allow
+	}
+	return nil
+}
+
+// ScopedRoleConditions describes a role's allow block.
+type ScopedRoleConditions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Rules describe basic resource:verb permissions.
+	Rules []*ScopedRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
+	// Logins is the list of host logins this role allows.
+	Logins []string `protobuf:"bytes,2,rep,name=logins,proto3" json:"logins,omitempty"`
+	// NodeLabels is a map of node labels (used to dynamically grant access to
+	// nodes).
+	NodeLabels    []*v11.Label `protobuf:"bytes,3,rep,name=node_labels,json=nodeLabels,proto3" json:"node_labels,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRoleConditions) Reset() {
+	*x = ScopedRoleConditions{}
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRoleConditions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRoleConditions) ProtoMessage() {}
+
+func (x *ScopedRoleConditions) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRoleConditions.ProtoReflect.Descriptor instead.
+func (*ScopedRoleConditions) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_role_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ScopedRoleConditions) GetRules() []*ScopedRule {
+	if x != nil {
+		return x.Rules
+	}
+	return nil
+}
+
+func (x *ScopedRoleConditions) GetLogins() []string {
+	if x != nil {
+		return x.Logins
+	}
+	return nil
+}
+
+func (x *ScopedRoleConditions) GetNodeLabels() []*v11.Label {
+	if x != nil {
+		return x.NodeLabels
+	}
+	return nil
+}
+
+// Rule maps resources to verbs. This is the underlying type used to describe
+// permissions like 'node:read' or 'role:create'.
+type ScopedRule struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Resources is a list of resource kinds (e.g. 'scoped_token') that the below verbs apply to.
+	Resources []string `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
+	// Verbs is the list of action verbs (e.g. 'read') that apply to the above resources.
+	Verbs         []string `protobuf:"bytes,2,rep,name=verbs,proto3" json:"verbs,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedRule) Reset() {
+	*x = ScopedRule{}
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedRule) ProtoMessage() {}
+
+func (x *ScopedRule) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_role_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedRule.ProtoReflect.Descriptor instead.
+func (*ScopedRule) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_role_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ScopedRule) GetResources() []string {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *ScopedRule) GetVerbs() []string {
+	if x != nil {
+		return x.Verbs
+	}
+	return nil
+}
+
+var File_teleport_scopes_access_v1_role_proto protoreflect.FileDescriptor
+
+const file_teleport_scopes_access_v1_role_proto_rawDesc = "" +
+	"\n" +
+	"$teleport/scopes/access/v1/role.proto\x12\x19teleport.scopes.access.v1\x1a!teleport/header/v1/metadata.proto\x1a\x1dteleport/label/v1/label.proto\"\xe4\x01\n" +
+	"\n" +
+	"ScopedRole\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
+	"\x05scope\x18\x05 \x01(\tR\x05scope\x12=\n" +
+	"\x04spec\x18\x06 \x01(\v2).teleport.scopes.access.v1.ScopedRoleSpecR\x04spec\"\x84\x01\n" +
+	"\x0eScopedRoleSpec\x12+\n" +
+	"\x11assignable_scopes\x18\x01 \x03(\tR\x10assignableScopes\x12E\n" +
+	"\x05allow\x18\x02 \x01(\v2/.teleport.scopes.access.v1.ScopedRoleConditionsR\x05allow\"\xa6\x01\n" +
+	"\x14ScopedRoleConditions\x12;\n" +
+	"\x05rules\x18\x01 \x03(\v2%.teleport.scopes.access.v1.ScopedRuleR\x05rules\x12\x16\n" +
+	"\x06logins\x18\x02 \x03(\tR\x06logins\x129\n" +
+	"\vnode_labels\x18\x03 \x03(\v2\x18.teleport.label.v1.LabelR\n" +
+	"nodeLabels\"@\n" +
+	"\n" +
+	"ScopedRule\x12\x1c\n" +
+	"\tresources\x18\x01 \x03(\tR\tresources\x12\x14\n" +
+	"\x05verbs\x18\x02 \x03(\tR\x05verbsBWZUgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1b\x06proto3"
+
+var (
+	file_teleport_scopes_access_v1_role_proto_rawDescOnce sync.Once
+	file_teleport_scopes_access_v1_role_proto_rawDescData []byte
+)
+
+func file_teleport_scopes_access_v1_role_proto_rawDescGZIP() []byte {
+	file_teleport_scopes_access_v1_role_proto_rawDescOnce.Do(func() {
+		file_teleport_scopes_access_v1_role_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_role_proto_rawDesc), len(file_teleport_scopes_access_v1_role_proto_rawDesc)))
+	})
+	return file_teleport_scopes_access_v1_role_proto_rawDescData
+}
+
+var file_teleport_scopes_access_v1_role_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_scopes_access_v1_role_proto_goTypes = []any{
+	(*ScopedRole)(nil),           // 0: teleport.scopes.access.v1.ScopedRole
+	(*ScopedRoleSpec)(nil),       // 1: teleport.scopes.access.v1.ScopedRoleSpec
+	(*ScopedRoleConditions)(nil), // 2: teleport.scopes.access.v1.ScopedRoleConditions
+	(*ScopedRule)(nil),           // 3: teleport.scopes.access.v1.ScopedRule
+	(*v1.Metadata)(nil),          // 4: teleport.header.v1.Metadata
+	(*v11.Label)(nil),            // 5: teleport.label.v1.Label
+}
+var file_teleport_scopes_access_v1_role_proto_depIdxs = []int32{
+	4, // 0: teleport.scopes.access.v1.ScopedRole.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.scopes.access.v1.ScopedRole.spec:type_name -> teleport.scopes.access.v1.ScopedRoleSpec
+	2, // 2: teleport.scopes.access.v1.ScopedRoleSpec.allow:type_name -> teleport.scopes.access.v1.ScopedRoleConditions
+	3, // 3: teleport.scopes.access.v1.ScopedRoleConditions.rules:type_name -> teleport.scopes.access.v1.ScopedRule
+	5, // 4: teleport.scopes.access.v1.ScopedRoleConditions.node_labels:type_name -> teleport.label.v1.Label
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_teleport_scopes_access_v1_role_proto_init() }
+func file_teleport_scopes_access_v1_role_proto_init() {
+	if File_teleport_scopes_access_v1_role_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_role_proto_rawDesc), len(file_teleport_scopes_access_v1_role_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_scopes_access_v1_role_proto_goTypes,
+		DependencyIndexes: file_teleport_scopes_access_v1_role_proto_depIdxs,
+		MessageInfos:      file_teleport_scopes_access_v1_role_proto_msgTypes,
+	}.Build()
+	File_teleport_scopes_access_v1_role_proto = out.File
+	file_teleport_scopes_access_v1_role_proto_goTypes = nil
+	file_teleport_scopes_access_v1_role_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/scopes/access/v1/service.pb.go b/api/gen/proto/go/teleport/scopes/access/v1/service.pb.go
new file mode 100644
index 0000000000000..dd17b632b40e7
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/access/v1/service.pb.go
@@ -0,0 +1,1156 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/scopes/access/v1/service.proto
+
+package accessv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// GetScopedRoleRequest is the request to get a scoped role.
+type GetScopedRoleRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped role.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedRoleRequest) Reset() {
+	*x = GetScopedRoleRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedRoleRequest) ProtoMessage() {}
+
+func (x *GetScopedRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedRoleRequest.ProtoReflect.Descriptor instead.
+func (*GetScopedRoleRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetScopedRoleRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetScopedRoleResponse is the response to get a scoped role.
+type GetScopedRoleResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Role is the scoped role.
+	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedRoleResponse) Reset() {
+	*x = GetScopedRoleResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedRoleResponse) ProtoMessage() {}
+
+func (x *GetScopedRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedRoleResponse.ProtoReflect.Descriptor instead.
+func (*GetScopedRoleResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetScopedRoleResponse) GetRole() *ScopedRole {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+// ListScopedRolesRequest is the request to list scoped roles.
+type ListScopedRolesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PageSize is the maximum number of results to return.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// PageToken is the pagination cursor used to start from where a previous request left off.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// ResourceScope filters roles by their resource scope if specified.
+	ResourceScope *v1.Filter `protobuf:"bytes,3,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
+	// AssignableScope filters roles by their assignable scope if specified.
+	AssignableScope *v1.Filter `protobuf:"bytes,4,opt,name=assignable_scope,json=assignableScope,proto3" json:"assignable_scope,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *ListScopedRolesRequest) Reset() {
+	*x = ListScopedRolesRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedRolesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedRolesRequest) ProtoMessage() {}
+
+func (x *ListScopedRolesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedRolesRequest.ProtoReflect.Descriptor instead.
+func (*ListScopedRolesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListScopedRolesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListScopedRolesRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListScopedRolesRequest) GetResourceScope() *v1.Filter {
+	if x != nil {
+		return x.ResourceScope
+	}
+	return nil
+}
+
+func (x *ListScopedRolesRequest) GetAssignableScope() *v1.Filter {
+	if x != nil {
+		return x.AssignableScope
+	}
+	return nil
+}
+
+// ListScopedRolesResponse is the response to list scoped roles.
+type ListScopedRolesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Roles is the list of scoped roles.
+	Roles []*ScopedRole `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	// NextPageToken is a pagination cursor usable to fetch the next page of results.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListScopedRolesResponse) Reset() {
+	*x = ListScopedRolesResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedRolesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedRolesResponse) ProtoMessage() {}
+
+func (x *ListScopedRolesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedRolesResponse.ProtoReflect.Descriptor instead.
+func (*ListScopedRolesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListScopedRolesResponse) GetRoles() []*ScopedRole {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *ListScopedRolesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// CreateScopedRoleRequest is the request to create a scoped role.
+type CreateScopedRoleRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Role is the scoped role to create.
+	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedRoleRequest) Reset() {
+	*x = CreateScopedRoleRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedRoleRequest) ProtoMessage() {}
+
+func (x *CreateScopedRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedRoleRequest.ProtoReflect.Descriptor instead.
+func (*CreateScopedRoleRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CreateScopedRoleRequest) GetRole() *ScopedRole {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+// CreateScopedRoleResponse is the response to create a scoped role.
+type CreateScopedRoleResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Role is the scoped role that was created.
+	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedRoleResponse) Reset() {
+	*x = CreateScopedRoleResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedRoleResponse) ProtoMessage() {}
+
+func (x *CreateScopedRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedRoleResponse.ProtoReflect.Descriptor instead.
+func (*CreateScopedRoleResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *CreateScopedRoleResponse) GetRole() *ScopedRole {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+// UpdateScopedRoleRequest is the request to update a scoped role.
+type UpdateScopedRoleRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Role is the scoped role to update.
+	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateScopedRoleRequest) Reset() {
+	*x = UpdateScopedRoleRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateScopedRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateScopedRoleRequest) ProtoMessage() {}
+
+func (x *UpdateScopedRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateScopedRoleRequest.ProtoReflect.Descriptor instead.
+func (*UpdateScopedRoleRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpdateScopedRoleRequest) GetRole() *ScopedRole {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+// UpdateScopedRoleResponse is the response to update a scoped role.
+type UpdateScopedRoleResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Role is the post-update scoped role.
+	Role          *ScopedRole `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateScopedRoleResponse) Reset() {
+	*x = UpdateScopedRoleResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateScopedRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateScopedRoleResponse) ProtoMessage() {}
+
+func (x *UpdateScopedRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateScopedRoleResponse.ProtoReflect.Descriptor instead.
+func (*UpdateScopedRoleResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateScopedRoleResponse) GetRole() *ScopedRole {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+// DeleteScopedRoleRequest is the request to delete a scoped role.
+type DeleteScopedRoleRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped role to delete.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Revision asserts the revision of the scoped role to delete (optional).
+	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedRoleRequest) Reset() {
+	*x = DeleteScopedRoleRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedRoleRequest) ProtoMessage() {}
+
+func (x *DeleteScopedRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedRoleRequest.ProtoReflect.Descriptor instead.
+func (*DeleteScopedRoleRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *DeleteScopedRoleRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *DeleteScopedRoleRequest) GetRevision() string {
+	if x != nil {
+		return x.Revision
+	}
+	return ""
+}
+
+// DeleteScopedRoleResponse is the response to delete a scoped role.
+type DeleteScopedRoleResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedRoleResponse) Reset() {
+	*x = DeleteScopedRoleResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedRoleResponse) ProtoMessage() {}
+
+func (x *DeleteScopedRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedRoleResponse.ProtoReflect.Descriptor instead.
+func (*DeleteScopedRoleResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{9}
+}
+
+// GetScopedRoleAssignmentRequest is the request to get a scoped role assignment.
+type GetScopedRoleAssignmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped role assignment.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedRoleAssignmentRequest) Reset() {
+	*x = GetScopedRoleAssignmentRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedRoleAssignmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedRoleAssignmentRequest) ProtoMessage() {}
+
+func (x *GetScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
+func (*GetScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *GetScopedRoleAssignmentRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetScopedRoleAssignmentResponse is the response to get a scoped role assignment.
+type GetScopedRoleAssignmentResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Assignment is the scoped role assignment.
+	Assignment    *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedRoleAssignmentResponse) Reset() {
+	*x = GetScopedRoleAssignmentResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedRoleAssignmentResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedRoleAssignmentResponse) ProtoMessage() {}
+
+func (x *GetScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
+func (*GetScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *GetScopedRoleAssignmentResponse) GetAssignment() *ScopedRoleAssignment {
+	if x != nil {
+		return x.Assignment
+	}
+	return nil
+}
+
+// ListScopedRoleAssignmentsRequest is the request to list scoped role assignments.
+type ListScopedRoleAssignmentsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PageSize is the maximum number of results to return.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// PageToken is the pagination cursor used to start from where a previous request left off.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// ResourceScope filters assignments by their resource scope if specified.
+	ResourceScope *v1.Filter `protobuf:"bytes,3,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
+	// AssignedScope filters assignments by the scopes they assign to if specified (note: matches assignment
+	// resources with 1 or more maching scopes, not all scopes within the assignment will necessarily match).
+	AssignedScope *v1.Filter `protobuf:"bytes,4,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
+	// User optionally limits the list to assignments for a specific user.
+	User string `protobuf:"bytes,5,opt,name=user,proto3" json:"user,omitempty"`
+	// Role optionally limits the list to assignments for a specific role.
+	Role string `protobuf:"bytes,6,opt,name=role,proto3" json:"role,omitempty"`
+	// AllCallerAssignments, if set to true, overrides the default behavior in favor of returning all
+	// assignments that apply to the caller, including those assigned in parent/orthogonal scopes. This flag
+	// is specifically used to support users discovering where they have been granted privileges across scopes,
+	// and is not intended for general use.
+	AllCallerAssignments bool `protobuf:"varint,7,opt,name=all_caller_assignments,json=allCallerAssignments,proto3" json:"all_caller_assignments,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
+}
+
+func (x *ListScopedRoleAssignmentsRequest) Reset() {
+	*x = ListScopedRoleAssignmentsRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedRoleAssignmentsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedRoleAssignmentsRequest) ProtoMessage() {}
+
+func (x *ListScopedRoleAssignmentsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedRoleAssignmentsRequest.ProtoReflect.Descriptor instead.
+func (*ListScopedRoleAssignmentsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetResourceScope() *v1.Filter {
+	if x != nil {
+		return x.ResourceScope
+	}
+	return nil
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetAssignedScope() *v1.Filter {
+	if x != nil {
+		return x.AssignedScope
+	}
+	return nil
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+func (x *ListScopedRoleAssignmentsRequest) GetAllCallerAssignments() bool {
+	if x != nil {
+		return x.AllCallerAssignments
+	}
+	return false
+}
+
+// ListScopedRoleAssignmentsResponse is the response to list scoped role assignments.
+type ListScopedRoleAssignmentsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Assignments is the list of scoped role assignments.
+	Assignments []*ScopedRoleAssignment `protobuf:"bytes,1,rep,name=assignments,proto3" json:"assignments,omitempty"`
+	// NextPageToken is a pagination cursor usable to fetch the next page of results.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListScopedRoleAssignmentsResponse) Reset() {
+	*x = ListScopedRoleAssignmentsResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedRoleAssignmentsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedRoleAssignmentsResponse) ProtoMessage() {}
+
+func (x *ListScopedRoleAssignmentsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedRoleAssignmentsResponse.ProtoReflect.Descriptor instead.
+func (*ListScopedRoleAssignmentsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *ListScopedRoleAssignmentsResponse) GetAssignments() []*ScopedRoleAssignment {
+	if x != nil {
+		return x.Assignments
+	}
+	return nil
+}
+
+func (x *ListScopedRoleAssignmentsResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// CreateScopedRoleAssignmentRequest is the request to create a scoped role assignment.
+type CreateScopedRoleAssignmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Assignment is the scoped role assignment to create.
+	Assignment *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
+	// RoleRevisions asserts the revisions of the roles assigned by the assignments (optional).
+	RoleRevisions map[string]string `protobuf:"bytes,2,rep,name=role_revisions,json=roleRevisions,proto3" json:"role_revisions,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedRoleAssignmentRequest) Reset() {
+	*x = CreateScopedRoleAssignmentRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedRoleAssignmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedRoleAssignmentRequest) ProtoMessage() {}
+
+func (x *CreateScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
+func (*CreateScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *CreateScopedRoleAssignmentRequest) GetAssignment() *ScopedRoleAssignment {
+	if x != nil {
+		return x.Assignment
+	}
+	return nil
+}
+
+func (x *CreateScopedRoleAssignmentRequest) GetRoleRevisions() map[string]string {
+	if x != nil {
+		return x.RoleRevisions
+	}
+	return nil
+}
+
+// CreateScopedRoleAssignmentResponse is the response to create a scoped role assignment.
+type CreateScopedRoleAssignmentResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Assignment is the scoped role assignment that was created.
+	Assignment    *ScopedRoleAssignment `protobuf:"bytes,1,opt,name=assignment,proto3" json:"assignment,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedRoleAssignmentResponse) Reset() {
+	*x = CreateScopedRoleAssignmentResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedRoleAssignmentResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedRoleAssignmentResponse) ProtoMessage() {}
+
+func (x *CreateScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
+func (*CreateScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *CreateScopedRoleAssignmentResponse) GetAssignment() *ScopedRoleAssignment {
+	if x != nil {
+		return x.Assignment
+	}
+	return nil
+}
+
+// DeleteScopedRoleAssignmentRequest is the request to delete a scoped role assignment.
+type DeleteScopedRoleAssignmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped role assignment to delete.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Revision asserts the revision of the scoped role assignment to delete (optional).
+	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedRoleAssignmentRequest) Reset() {
+	*x = DeleteScopedRoleAssignmentRequest{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedRoleAssignmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedRoleAssignmentRequest) ProtoMessage() {}
+
+func (x *DeleteScopedRoleAssignmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedRoleAssignmentRequest.ProtoReflect.Descriptor instead.
+func (*DeleteScopedRoleAssignmentRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *DeleteScopedRoleAssignmentRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *DeleteScopedRoleAssignmentRequest) GetRevision() string {
+	if x != nil {
+		return x.Revision
+	}
+	return ""
+}
+
+// DeleteScopedRoleAssignmentResponse is the response to delete a scoped role assignment.
+type DeleteScopedRoleAssignmentResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedRoleAssignmentResponse) Reset() {
+	*x = DeleteScopedRoleAssignmentResponse{}
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedRoleAssignmentResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedRoleAssignmentResponse) ProtoMessage() {}
+
+func (x *DeleteScopedRoleAssignmentResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_access_v1_service_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedRoleAssignmentResponse.ProtoReflect.Descriptor instead.
+func (*DeleteScopedRoleAssignmentResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_access_v1_service_proto_rawDescGZIP(), []int{17}
+}
+
+var File_teleport_scopes_access_v1_service_proto protoreflect.FileDescriptor
+
+const file_teleport_scopes_access_v1_service_proto_rawDesc = "" +
+	"\n" +
+	"'teleport/scopes/access/v1/service.proto\x12\x19teleport.scopes.access.v1\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a\x1fteleport/scopes/v1/scopes.proto\"*\n" +
+	"\x14GetScopedRoleRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"R\n" +
+	"\x15GetScopedRoleResponse\x129\n" +
+	"\x04role\x18\x01 \x01(\v2%.teleport.scopes.access.v1.ScopedRoleR\x04role\"\xde\x01\n" +
+	"\x16ListScopedRolesRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12A\n" +
+	"\x0eresource_scope\x18\x03 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12E\n" +
+	"\x10assignable_scope\x18\x04 \x01(\v2\x1a.teleport.scopes.v1.FilterR\x0fassignableScope\"~\n" +
+	"\x17ListScopedRolesResponse\x12;\n" +
+	"\x05roles\x18\x01 \x03(\v2%.teleport.scopes.access.v1.ScopedRoleR\x05roles\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"T\n" +
+	"\x17CreateScopedRoleRequest\x129\n" +
+	"\x04role\x18\x01 \x01(\v2%.teleport.scopes.access.v1.ScopedRoleR\x04role\"U\n" +
+	"\x18CreateScopedRoleResponse\x129\n" +
+	"\x04role\x18\x01 \x01(\v2%.teleport.scopes.access.v1.ScopedRoleR\x04role\"T\n" +
+	"\x17UpdateScopedRoleRequest\x129\n" +
+	"\x04role\x18\x01 \x01(\v2%.teleport.scopes.access.v1.ScopedRoleR\x04role\"U\n" +
+	"\x18UpdateScopedRoleResponse\x129\n" +
+	"\x04role\x18\x01 \x01(\v2%.teleport.scopes.access.v1.ScopedRoleR\x04role\"I\n" +
+	"\x17DeleteScopedRoleRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
+	"\brevision\x18\x02 \x01(\tR\brevision\"\x1a\n" +
+	"\x18DeleteScopedRoleResponse\"4\n" +
+	"\x1eGetScopedRoleAssignmentRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"r\n" +
+	"\x1fGetScopedRoleAssignmentResponse\x12O\n" +
+	"\n" +
+	"assignment\x18\x01 \x01(\v2/.teleport.scopes.access.v1.ScopedRoleAssignmentR\n" +
+	"assignment\"\xc2\x02\n" +
+	" ListScopedRoleAssignmentsRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12A\n" +
+	"\x0eresource_scope\x18\x03 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12A\n" +
+	"\x0eassigned_scope\x18\x04 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rassignedScope\x12\x12\n" +
+	"\x04user\x18\x05 \x01(\tR\x04user\x12\x12\n" +
+	"\x04role\x18\x06 \x01(\tR\x04role\x124\n" +
+	"\x16all_caller_assignments\x18\a \x01(\bR\x14allCallerAssignments\"\x9e\x01\n" +
+	"!ListScopedRoleAssignmentsResponse\x12Q\n" +
+	"\vassignments\x18\x01 \x03(\v2/.teleport.scopes.access.v1.ScopedRoleAssignmentR\vassignments\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xae\x02\n" +
+	"!CreateScopedRoleAssignmentRequest\x12O\n" +
+	"\n" +
+	"assignment\x18\x01 \x01(\v2/.teleport.scopes.access.v1.ScopedRoleAssignmentR\n" +
+	"assignment\x12v\n" +
+	"\x0erole_revisions\x18\x02 \x03(\v2O.teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntryR\rroleRevisions\x1a@\n" +
+	"\x12RoleRevisionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"u\n" +
+	"\"CreateScopedRoleAssignmentResponse\x12O\n" +
+	"\n" +
+	"assignment\x18\x01 \x01(\v2/.teleport.scopes.access.v1.ScopedRoleAssignmentR\n" +
+	"assignment\"S\n" +
+	"!DeleteScopedRoleAssignmentRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
+	"\brevision\x18\x02 \x01(\tR\brevision\"$\n" +
+	"\"DeleteScopedRoleAssignmentResponse2\xde\t\n" +
+	"\x13ScopedAccessService\x12r\n" +
+	"\rGetScopedRole\x12/.teleport.scopes.access.v1.GetScopedRoleRequest\x1a0.teleport.scopes.access.v1.GetScopedRoleResponse\x12x\n" +
+	"\x0fListScopedRoles\x121.teleport.scopes.access.v1.ListScopedRolesRequest\x1a2.teleport.scopes.access.v1.ListScopedRolesResponse\x12{\n" +
+	"\x10CreateScopedRole\x122.teleport.scopes.access.v1.CreateScopedRoleRequest\x1a3.teleport.scopes.access.v1.CreateScopedRoleResponse\x12{\n" +
+	"\x10UpdateScopedRole\x122.teleport.scopes.access.v1.UpdateScopedRoleRequest\x1a3.teleport.scopes.access.v1.UpdateScopedRoleResponse\x12{\n" +
+	"\x10DeleteScopedRole\x122.teleport.scopes.access.v1.DeleteScopedRoleRequest\x1a3.teleport.scopes.access.v1.DeleteScopedRoleResponse\x12\x90\x01\n" +
+	"\x17GetScopedRoleAssignment\x129.teleport.scopes.access.v1.GetScopedRoleAssignmentRequest\x1a:.teleport.scopes.access.v1.GetScopedRoleAssignmentResponse\x12\x96\x01\n" +
+	"\x19ListScopedRoleAssignments\x12;.teleport.scopes.access.v1.ListScopedRoleAssignmentsRequest\x1a<.teleport.scopes.access.v1.ListScopedRoleAssignmentsResponse\x12\x99\x01\n" +
+	"\x1aCreateScopedRoleAssignment\x12<.teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest\x1a=.teleport.scopes.access.v1.CreateScopedRoleAssignmentResponse\x12\x99\x01\n" +
+	"\x1aDeleteScopedRoleAssignment\x12<.teleport.scopes.access.v1.DeleteScopedRoleAssignmentRequest\x1a=.teleport.scopes.access.v1.DeleteScopedRoleAssignmentResponseBWZUgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1b\x06proto3"
+
+var (
+	file_teleport_scopes_access_v1_service_proto_rawDescOnce sync.Once
+	file_teleport_scopes_access_v1_service_proto_rawDescData []byte
+)
+
+func file_teleport_scopes_access_v1_service_proto_rawDescGZIP() []byte {
+	file_teleport_scopes_access_v1_service_proto_rawDescOnce.Do(func() {
+		file_teleport_scopes_access_v1_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_service_proto_rawDesc), len(file_teleport_scopes_access_v1_service_proto_rawDesc)))
+	})
+	return file_teleport_scopes_access_v1_service_proto_rawDescData
+}
+
+var file_teleport_scopes_access_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_teleport_scopes_access_v1_service_proto_goTypes = []any{
+	(*GetScopedRoleRequest)(nil),               // 0: teleport.scopes.access.v1.GetScopedRoleRequest
+	(*GetScopedRoleResponse)(nil),              // 1: teleport.scopes.access.v1.GetScopedRoleResponse
+	(*ListScopedRolesRequest)(nil),             // 2: teleport.scopes.access.v1.ListScopedRolesRequest
+	(*ListScopedRolesResponse)(nil),            // 3: teleport.scopes.access.v1.ListScopedRolesResponse
+	(*CreateScopedRoleRequest)(nil),            // 4: teleport.scopes.access.v1.CreateScopedRoleRequest
+	(*CreateScopedRoleResponse)(nil),           // 5: teleport.scopes.access.v1.CreateScopedRoleResponse
+	(*UpdateScopedRoleRequest)(nil),            // 6: teleport.scopes.access.v1.UpdateScopedRoleRequest
+	(*UpdateScopedRoleResponse)(nil),           // 7: teleport.scopes.access.v1.UpdateScopedRoleResponse
+	(*DeleteScopedRoleRequest)(nil),            // 8: teleport.scopes.access.v1.DeleteScopedRoleRequest
+	(*DeleteScopedRoleResponse)(nil),           // 9: teleport.scopes.access.v1.DeleteScopedRoleResponse
+	(*GetScopedRoleAssignmentRequest)(nil),     // 10: teleport.scopes.access.v1.GetScopedRoleAssignmentRequest
+	(*GetScopedRoleAssignmentResponse)(nil),    // 11: teleport.scopes.access.v1.GetScopedRoleAssignmentResponse
+	(*ListScopedRoleAssignmentsRequest)(nil),   // 12: teleport.scopes.access.v1.ListScopedRoleAssignmentsRequest
+	(*ListScopedRoleAssignmentsResponse)(nil),  // 13: teleport.scopes.access.v1.ListScopedRoleAssignmentsResponse
+	(*CreateScopedRoleAssignmentRequest)(nil),  // 14: teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest
+	(*CreateScopedRoleAssignmentResponse)(nil), // 15: teleport.scopes.access.v1.CreateScopedRoleAssignmentResponse
+	(*DeleteScopedRoleAssignmentRequest)(nil),  // 16: teleport.scopes.access.v1.DeleteScopedRoleAssignmentRequest
+	(*DeleteScopedRoleAssignmentResponse)(nil), // 17: teleport.scopes.access.v1.DeleteScopedRoleAssignmentResponse
+	nil,                          // 18: teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntry
+	(*ScopedRole)(nil),           // 19: teleport.scopes.access.v1.ScopedRole
+	(*v1.Filter)(nil),            // 20: teleport.scopes.v1.Filter
+	(*ScopedRoleAssignment)(nil), // 21: teleport.scopes.access.v1.ScopedRoleAssignment
+}
+var file_teleport_scopes_access_v1_service_proto_depIdxs = []int32{
+	19, // 0: teleport.scopes.access.v1.GetScopedRoleResponse.role:type_name -> teleport.scopes.access.v1.ScopedRole
+	20, // 1: teleport.scopes.access.v1.ListScopedRolesRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
+	20, // 2: teleport.scopes.access.v1.ListScopedRolesRequest.assignable_scope:type_name -> teleport.scopes.v1.Filter
+	19, // 3: teleport.scopes.access.v1.ListScopedRolesResponse.roles:type_name -> teleport.scopes.access.v1.ScopedRole
+	19, // 4: teleport.scopes.access.v1.CreateScopedRoleRequest.role:type_name -> teleport.scopes.access.v1.ScopedRole
+	19, // 5: teleport.scopes.access.v1.CreateScopedRoleResponse.role:type_name -> teleport.scopes.access.v1.ScopedRole
+	19, // 6: teleport.scopes.access.v1.UpdateScopedRoleRequest.role:type_name -> teleport.scopes.access.v1.ScopedRole
+	19, // 7: teleport.scopes.access.v1.UpdateScopedRoleResponse.role:type_name -> teleport.scopes.access.v1.ScopedRole
+	21, // 8: teleport.scopes.access.v1.GetScopedRoleAssignmentResponse.assignment:type_name -> teleport.scopes.access.v1.ScopedRoleAssignment
+	20, // 9: teleport.scopes.access.v1.ListScopedRoleAssignmentsRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
+	20, // 10: teleport.scopes.access.v1.ListScopedRoleAssignmentsRequest.assigned_scope:type_name -> teleport.scopes.v1.Filter
+	21, // 11: teleport.scopes.access.v1.ListScopedRoleAssignmentsResponse.assignments:type_name -> teleport.scopes.access.v1.ScopedRoleAssignment
+	21, // 12: teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest.assignment:type_name -> teleport.scopes.access.v1.ScopedRoleAssignment
+	18, // 13: teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest.role_revisions:type_name -> teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest.RoleRevisionsEntry
+	21, // 14: teleport.scopes.access.v1.CreateScopedRoleAssignmentResponse.assignment:type_name -> teleport.scopes.access.v1.ScopedRoleAssignment
+	0,  // 15: teleport.scopes.access.v1.ScopedAccessService.GetScopedRole:input_type -> teleport.scopes.access.v1.GetScopedRoleRequest
+	2,  // 16: teleport.scopes.access.v1.ScopedAccessService.ListScopedRoles:input_type -> teleport.scopes.access.v1.ListScopedRolesRequest
+	4,  // 17: teleport.scopes.access.v1.ScopedAccessService.CreateScopedRole:input_type -> teleport.scopes.access.v1.CreateScopedRoleRequest
+	6,  // 18: teleport.scopes.access.v1.ScopedAccessService.UpdateScopedRole:input_type -> teleport.scopes.access.v1.UpdateScopedRoleRequest
+	8,  // 19: teleport.scopes.access.v1.ScopedAccessService.DeleteScopedRole:input_type -> teleport.scopes.access.v1.DeleteScopedRoleRequest
+	10, // 20: teleport.scopes.access.v1.ScopedAccessService.GetScopedRoleAssignment:input_type -> teleport.scopes.access.v1.GetScopedRoleAssignmentRequest
+	12, // 21: teleport.scopes.access.v1.ScopedAccessService.ListScopedRoleAssignments:input_type -> teleport.scopes.access.v1.ListScopedRoleAssignmentsRequest
+	14, // 22: teleport.scopes.access.v1.ScopedAccessService.CreateScopedRoleAssignment:input_type -> teleport.scopes.access.v1.CreateScopedRoleAssignmentRequest
+	16, // 23: teleport.scopes.access.v1.ScopedAccessService.DeleteScopedRoleAssignment:input_type -> teleport.scopes.access.v1.DeleteScopedRoleAssignmentRequest
+	1,  // 24: teleport.scopes.access.v1.ScopedAccessService.GetScopedRole:output_type -> teleport.scopes.access.v1.GetScopedRoleResponse
+	3,  // 25: teleport.scopes.access.v1.ScopedAccessService.ListScopedRoles:output_type -> teleport.scopes.access.v1.ListScopedRolesResponse
+	5,  // 26: teleport.scopes.access.v1.ScopedAccessService.CreateScopedRole:output_type -> teleport.scopes.access.v1.CreateScopedRoleResponse
+	7,  // 27: teleport.scopes.access.v1.ScopedAccessService.UpdateScopedRole:output_type -> teleport.scopes.access.v1.UpdateScopedRoleResponse
+	9,  // 28: teleport.scopes.access.v1.ScopedAccessService.DeleteScopedRole:output_type -> teleport.scopes.access.v1.DeleteScopedRoleResponse
+	11, // 29: teleport.scopes.access.v1.ScopedAccessService.GetScopedRoleAssignment:output_type -> teleport.scopes.access.v1.GetScopedRoleAssignmentResponse
+	13, // 30: teleport.scopes.access.v1.ScopedAccessService.ListScopedRoleAssignments:output_type -> teleport.scopes.access.v1.ListScopedRoleAssignmentsResponse
+	15, // 31: teleport.scopes.access.v1.ScopedAccessService.CreateScopedRoleAssignment:output_type -> teleport.scopes.access.v1.CreateScopedRoleAssignmentResponse
+	17, // 32: teleport.scopes.access.v1.ScopedAccessService.DeleteScopedRoleAssignment:output_type -> teleport.scopes.access.v1.DeleteScopedRoleAssignmentResponse
+	24, // [24:33] is the sub-list for method output_type
+	15, // [15:24] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
+}
+
+func init() { file_teleport_scopes_access_v1_service_proto_init() }
+func file_teleport_scopes_access_v1_service_proto_init() {
+	if File_teleport_scopes_access_v1_service_proto != nil {
+		return
+	}
+	file_teleport_scopes_access_v1_assignment_proto_init()
+	file_teleport_scopes_access_v1_role_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_access_v1_service_proto_rawDesc), len(file_teleport_scopes_access_v1_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   19,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_scopes_access_v1_service_proto_goTypes,
+		DependencyIndexes: file_teleport_scopes_access_v1_service_proto_depIdxs,
+		MessageInfos:      file_teleport_scopes_access_v1_service_proto_msgTypes,
+	}.Build()
+	File_teleport_scopes_access_v1_service_proto = out.File
+	file_teleport_scopes_access_v1_service_proto_goTypes = nil
+	file_teleport_scopes_access_v1_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/scopes/access/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/scopes/access/v1/service_grpc.pb.go
new file mode 100644
index 0000000000000..b19f8b1e0839d
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/access/v1/service_grpc.pb.go
@@ -0,0 +1,465 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/scopes/access/v1/service.proto
+
+package accessv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ScopedAccessService_GetScopedRole_FullMethodName              = "/teleport.scopes.access.v1.ScopedAccessService/GetScopedRole"
+	ScopedAccessService_ListScopedRoles_FullMethodName            = "/teleport.scopes.access.v1.ScopedAccessService/ListScopedRoles"
+	ScopedAccessService_CreateScopedRole_FullMethodName           = "/teleport.scopes.access.v1.ScopedAccessService/CreateScopedRole"
+	ScopedAccessService_UpdateScopedRole_FullMethodName           = "/teleport.scopes.access.v1.ScopedAccessService/UpdateScopedRole"
+	ScopedAccessService_DeleteScopedRole_FullMethodName           = "/teleport.scopes.access.v1.ScopedAccessService/DeleteScopedRole"
+	ScopedAccessService_GetScopedRoleAssignment_FullMethodName    = "/teleport.scopes.access.v1.ScopedAccessService/GetScopedRoleAssignment"
+	ScopedAccessService_ListScopedRoleAssignments_FullMethodName  = "/teleport.scopes.access.v1.ScopedAccessService/ListScopedRoleAssignments"
+	ScopedAccessService_CreateScopedRoleAssignment_FullMethodName = "/teleport.scopes.access.v1.ScopedAccessService/CreateScopedRoleAssignment"
+	ScopedAccessService_DeleteScopedRoleAssignment_FullMethodName = "/teleport.scopes.access.v1.ScopedAccessService/DeleteScopedRoleAssignment"
+)
+
+// ScopedAccessServiceClient is the client API for ScopedAccessService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ScopedAccessService provides an API for managing scoped access-control resources.
+type ScopedAccessServiceClient interface {
+	// GetScopedRole gets a scoped role by name.
+	GetScopedRole(ctx context.Context, in *GetScopedRoleRequest, opts ...grpc.CallOption) (*GetScopedRoleResponse, error)
+	// ListScopedRoles returns a paginated list of scoped roles.
+	ListScopedRoles(ctx context.Context, in *ListScopedRolesRequest, opts ...grpc.CallOption) (*ListScopedRolesResponse, error)
+	// CreateScopedRole creates a new scoped role.
+	CreateScopedRole(ctx context.Context, in *CreateScopedRoleRequest, opts ...grpc.CallOption) (*CreateScopedRoleResponse, error)
+	// UpdateScopedRole updates a scoped role.
+	UpdateScopedRole(ctx context.Context, in *UpdateScopedRoleRequest, opts ...grpc.CallOption) (*UpdateScopedRoleResponse, error)
+	// DeleteScopedRole deletes a scoped role. Note that scoped role deletion is always
+	// conditional. Scoped roles cannot be deleted if referenced by any existing assignment
+	// and deletes may fail due to concurrent modification.
+	DeleteScopedRole(ctx context.Context, in *DeleteScopedRoleRequest, opts ...grpc.CallOption) (*DeleteScopedRoleResponse, error)
+	// GetScopedRoleAssignment gets a scoped role assignment by name.
+	GetScopedRoleAssignment(ctx context.Context, in *GetScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*GetScopedRoleAssignmentResponse, error)
+	// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+	ListScopedRoleAssignments(ctx context.Context, in *ListScopedRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListScopedRoleAssignmentsResponse, error)
+	// CreateScopedRoleAssignment creates a new scoped role assignment.
+	CreateScopedRoleAssignment(ctx context.Context, in *CreateScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*CreateScopedRoleAssignmentResponse, error)
+	// DeleteScopedRoleAssignment deletes a scoped role assignment.
+	DeleteScopedRoleAssignment(ctx context.Context, in *DeleteScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*DeleteScopedRoleAssignmentResponse, error)
+}
+
+type scopedAccessServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewScopedAccessServiceClient(cc grpc.ClientConnInterface) ScopedAccessServiceClient {
+	return &scopedAccessServiceClient{cc}
+}
+
+func (c *scopedAccessServiceClient) GetScopedRole(ctx context.Context, in *GetScopedRoleRequest, opts ...grpc.CallOption) (*GetScopedRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetScopedRoleResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_GetScopedRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) ListScopedRoles(ctx context.Context, in *ListScopedRolesRequest, opts ...grpc.CallOption) (*ListScopedRolesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListScopedRolesResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_ListScopedRoles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) CreateScopedRole(ctx context.Context, in *CreateScopedRoleRequest, opts ...grpc.CallOption) (*CreateScopedRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateScopedRoleResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_CreateScopedRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) UpdateScopedRole(ctx context.Context, in *UpdateScopedRoleRequest, opts ...grpc.CallOption) (*UpdateScopedRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateScopedRoleResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_UpdateScopedRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) DeleteScopedRole(ctx context.Context, in *DeleteScopedRoleRequest, opts ...grpc.CallOption) (*DeleteScopedRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteScopedRoleResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_DeleteScopedRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) GetScopedRoleAssignment(ctx context.Context, in *GetScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*GetScopedRoleAssignmentResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetScopedRoleAssignmentResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_GetScopedRoleAssignment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) ListScopedRoleAssignments(ctx context.Context, in *ListScopedRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListScopedRoleAssignmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListScopedRoleAssignmentsResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_ListScopedRoleAssignments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) CreateScopedRoleAssignment(ctx context.Context, in *CreateScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*CreateScopedRoleAssignmentResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateScopedRoleAssignmentResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_CreateScopedRoleAssignment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedAccessServiceClient) DeleteScopedRoleAssignment(ctx context.Context, in *DeleteScopedRoleAssignmentRequest, opts ...grpc.CallOption) (*DeleteScopedRoleAssignmentResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteScopedRoleAssignmentResponse)
+	err := c.cc.Invoke(ctx, ScopedAccessService_DeleteScopedRoleAssignment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ScopedAccessServiceServer is the server API for ScopedAccessService service.
+// All implementations must embed UnimplementedScopedAccessServiceServer
+// for forward compatibility.
+//
+// ScopedAccessService provides an API for managing scoped access-control resources.
+type ScopedAccessServiceServer interface {
+	// GetScopedRole gets a scoped role by name.
+	GetScopedRole(context.Context, *GetScopedRoleRequest) (*GetScopedRoleResponse, error)
+	// ListScopedRoles returns a paginated list of scoped roles.
+	ListScopedRoles(context.Context, *ListScopedRolesRequest) (*ListScopedRolesResponse, error)
+	// CreateScopedRole creates a new scoped role.
+	CreateScopedRole(context.Context, *CreateScopedRoleRequest) (*CreateScopedRoleResponse, error)
+	// UpdateScopedRole updates a scoped role.
+	UpdateScopedRole(context.Context, *UpdateScopedRoleRequest) (*UpdateScopedRoleResponse, error)
+	// DeleteScopedRole deletes a scoped role. Note that scoped role deletion is always
+	// conditional. Scoped roles cannot be deleted if referenced by any existing assignment
+	// and deletes may fail due to concurrent modification.
+	DeleteScopedRole(context.Context, *DeleteScopedRoleRequest) (*DeleteScopedRoleResponse, error)
+	// GetScopedRoleAssignment gets a scoped role assignment by name.
+	GetScopedRoleAssignment(context.Context, *GetScopedRoleAssignmentRequest) (*GetScopedRoleAssignmentResponse, error)
+	// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+	ListScopedRoleAssignments(context.Context, *ListScopedRoleAssignmentsRequest) (*ListScopedRoleAssignmentsResponse, error)
+	// CreateScopedRoleAssignment creates a new scoped role assignment.
+	CreateScopedRoleAssignment(context.Context, *CreateScopedRoleAssignmentRequest) (*CreateScopedRoleAssignmentResponse, error)
+	// DeleteScopedRoleAssignment deletes a scoped role assignment.
+	DeleteScopedRoleAssignment(context.Context, *DeleteScopedRoleAssignmentRequest) (*DeleteScopedRoleAssignmentResponse, error)
+	mustEmbedUnimplementedScopedAccessServiceServer()
+}
+
+// UnimplementedScopedAccessServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedScopedAccessServiceServer struct{}
+
+func (UnimplementedScopedAccessServiceServer) GetScopedRole(context.Context, *GetScopedRoleRequest) (*GetScopedRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetScopedRole not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) ListScopedRoles(context.Context, *ListScopedRolesRequest) (*ListScopedRolesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListScopedRoles not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) CreateScopedRole(context.Context, *CreateScopedRoleRequest) (*CreateScopedRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedRole not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) UpdateScopedRole(context.Context, *UpdateScopedRoleRequest) (*UpdateScopedRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateScopedRole not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) DeleteScopedRole(context.Context, *DeleteScopedRoleRequest) (*DeleteScopedRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedRole not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) GetScopedRoleAssignment(context.Context, *GetScopedRoleAssignmentRequest) (*GetScopedRoleAssignmentResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetScopedRoleAssignment not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) ListScopedRoleAssignments(context.Context, *ListScopedRoleAssignmentsRequest) (*ListScopedRoleAssignmentsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListScopedRoleAssignments not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) CreateScopedRoleAssignment(context.Context, *CreateScopedRoleAssignmentRequest) (*CreateScopedRoleAssignmentResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedRoleAssignment not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) DeleteScopedRoleAssignment(context.Context, *DeleteScopedRoleAssignmentRequest) (*DeleteScopedRoleAssignmentResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedRoleAssignment not implemented")
+}
+func (UnimplementedScopedAccessServiceServer) mustEmbedUnimplementedScopedAccessServiceServer() {}
+func (UnimplementedScopedAccessServiceServer) testEmbeddedByValue()                             {}
+
+// UnsafeScopedAccessServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ScopedAccessServiceServer will
+// result in compilation errors.
+type UnsafeScopedAccessServiceServer interface {
+	mustEmbedUnimplementedScopedAccessServiceServer()
+}
+
+func RegisterScopedAccessServiceServer(s grpc.ServiceRegistrar, srv ScopedAccessServiceServer) {
+	// If the following call pancis, it indicates UnimplementedScopedAccessServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ScopedAccessService_ServiceDesc, srv)
+}
+
+func _ScopedAccessService_GetScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetScopedRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).GetScopedRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_GetScopedRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).GetScopedRole(ctx, req.(*GetScopedRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_ListScopedRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListScopedRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).ListScopedRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_ListScopedRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).ListScopedRoles(ctx, req.(*ListScopedRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_CreateScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateScopedRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).CreateScopedRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_CreateScopedRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).CreateScopedRole(ctx, req.(*CreateScopedRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_UpdateScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateScopedRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).UpdateScopedRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_UpdateScopedRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).UpdateScopedRole(ctx, req.(*UpdateScopedRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_DeleteScopedRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteScopedRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).DeleteScopedRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_DeleteScopedRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).DeleteScopedRole(ctx, req.(*DeleteScopedRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_GetScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetScopedRoleAssignmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).GetScopedRoleAssignment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_GetScopedRoleAssignment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).GetScopedRoleAssignment(ctx, req.(*GetScopedRoleAssignmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_ListScopedRoleAssignments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListScopedRoleAssignmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).ListScopedRoleAssignments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_ListScopedRoleAssignments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).ListScopedRoleAssignments(ctx, req.(*ListScopedRoleAssignmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_CreateScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateScopedRoleAssignmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).CreateScopedRoleAssignment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_CreateScopedRoleAssignment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).CreateScopedRoleAssignment(ctx, req.(*CreateScopedRoleAssignmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedAccessService_DeleteScopedRoleAssignment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteScopedRoleAssignmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedAccessServiceServer).DeleteScopedRoleAssignment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedAccessService_DeleteScopedRoleAssignment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedAccessServiceServer).DeleteScopedRoleAssignment(ctx, req.(*DeleteScopedRoleAssignmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ScopedAccessService_ServiceDesc is the grpc.ServiceDesc for ScopedAccessService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ScopedAccessService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.scopes.access.v1.ScopedAccessService",
+	HandlerType: (*ScopedAccessServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetScopedRole",
+			Handler:    _ScopedAccessService_GetScopedRole_Handler,
+		},
+		{
+			MethodName: "ListScopedRoles",
+			Handler:    _ScopedAccessService_ListScopedRoles_Handler,
+		},
+		{
+			MethodName: "CreateScopedRole",
+			Handler:    _ScopedAccessService_CreateScopedRole_Handler,
+		},
+		{
+			MethodName: "UpdateScopedRole",
+			Handler:    _ScopedAccessService_UpdateScopedRole_Handler,
+		},
+		{
+			MethodName: "DeleteScopedRole",
+			Handler:    _ScopedAccessService_DeleteScopedRole_Handler,
+		},
+		{
+			MethodName: "GetScopedRoleAssignment",
+			Handler:    _ScopedAccessService_GetScopedRoleAssignment_Handler,
+		},
+		{
+			MethodName: "ListScopedRoleAssignments",
+			Handler:    _ScopedAccessService_ListScopedRoleAssignments_Handler,
+		},
+		{
+			MethodName: "CreateScopedRoleAssignment",
+			Handler:    _ScopedAccessService_CreateScopedRoleAssignment_Handler,
+		},
+		{
+			MethodName: "DeleteScopedRoleAssignment",
+			Handler:    _ScopedAccessService_DeleteScopedRoleAssignment_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/scopes/access/v1/service.proto",
+}
diff --git a/api/gen/proto/go/teleport/scopes/joining/v1/service.pb.go b/api/gen/proto/go/teleport/scopes/joining/v1/service.pb.go
new file mode 100644
index 0000000000000..5b7dd39dba977
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/joining/v1/service.pb.go
@@ -0,0 +1,672 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/scopes/joining/v1/service.proto
+
+package joiningv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// GetScopedTokenRequest is the request to get a scoped token.
+type GetScopedTokenRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped token.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedTokenRequest) Reset() {
+	*x = GetScopedTokenRequest{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedTokenRequest) ProtoMessage() {}
+
+func (x *GetScopedTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedTokenRequest.ProtoReflect.Descriptor instead.
+func (*GetScopedTokenRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetScopedTokenRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetScopedTokenResponse is the response to get a scoped token.
+type GetScopedTokenResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Token is the scoped token.
+	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetScopedTokenResponse) Reset() {
+	*x = GetScopedTokenResponse{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetScopedTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetScopedTokenResponse) ProtoMessage() {}
+
+func (x *GetScopedTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetScopedTokenResponse.ProtoReflect.Descriptor instead.
+func (*GetScopedTokenResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetScopedTokenResponse) GetToken() *ScopedToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+// ListScopedTokensRequest is the request to list scoped tokens.
+type ListScopedTokensRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter tokens by their resource scope.
+	ResourceScope *v1.Filter `protobuf:"bytes,1,opt,name=resource_scope,json=resourceScope,proto3" json:"resource_scope,omitempty"`
+	// Filter tokens by their assigned scope.
+	AssignedScope *v1.Filter `protobuf:"bytes,2,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
+	// The pagination cursor.
+	Cursor string `protobuf:"bytes,3,opt,name=cursor,proto3" json:"cursor,omitempty"`
+	// The maximum number of results to return.
+	Limit uint32 `protobuf:"varint,4,opt,name=limit,proto3" json:"limit,omitempty"`
+	// Filter tokens that apply at least one of the provided roles.
+	Roles []string `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
+	// Filter tokens that match all provided labels.
+	Labels        map[string]string `protobuf:"bytes,6,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListScopedTokensRequest) Reset() {
+	*x = ListScopedTokensRequest{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedTokensRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedTokensRequest) ProtoMessage() {}
+
+func (x *ListScopedTokensRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedTokensRequest.ProtoReflect.Descriptor instead.
+func (*ListScopedTokensRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListScopedTokensRequest) GetResourceScope() *v1.Filter {
+	if x != nil {
+		return x.ResourceScope
+	}
+	return nil
+}
+
+func (x *ListScopedTokensRequest) GetAssignedScope() *v1.Filter {
+	if x != nil {
+		return x.AssignedScope
+	}
+	return nil
+}
+
+func (x *ListScopedTokensRequest) GetCursor() string {
+	if x != nil {
+		return x.Cursor
+	}
+	return ""
+}
+
+func (x *ListScopedTokensRequest) GetLimit() uint32 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *ListScopedTokensRequest) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *ListScopedTokensRequest) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+// ListScopedTokensResponse is the response to list scoped tokens.
+type ListScopedTokensResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Tokens is the list of scoped tokens.
+	Tokens []*ScopedToken `protobuf:"bytes,1,rep,name=tokens,proto3" json:"tokens,omitempty"`
+	// Cursor is the pagination cursor.
+	Cursor        string `protobuf:"bytes,2,opt,name=cursor,proto3" json:"cursor,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListScopedTokensResponse) Reset() {
+	*x = ListScopedTokensResponse{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListScopedTokensResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListScopedTokensResponse) ProtoMessage() {}
+
+func (x *ListScopedTokensResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListScopedTokensResponse.ProtoReflect.Descriptor instead.
+func (*ListScopedTokensResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListScopedTokensResponse) GetTokens() []*ScopedToken {
+	if x != nil {
+		return x.Tokens
+	}
+	return nil
+}
+
+func (x *ListScopedTokensResponse) GetCursor() string {
+	if x != nil {
+		return x.Cursor
+	}
+	return ""
+}
+
+// CreateScopedTokenRequest is the request to create a scoped token.
+type CreateScopedTokenRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Token is the scoped token to create.
+	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedTokenRequest) Reset() {
+	*x = CreateScopedTokenRequest{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedTokenRequest) ProtoMessage() {}
+
+func (x *CreateScopedTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedTokenRequest.ProtoReflect.Descriptor instead.
+func (*CreateScopedTokenRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CreateScopedTokenRequest) GetToken() *ScopedToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+// CreateScopedTokenResponse is the response to create a scoped token.
+type CreateScopedTokenResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Token is the scoped token that was created.
+	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateScopedTokenResponse) Reset() {
+	*x = CreateScopedTokenResponse{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateScopedTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateScopedTokenResponse) ProtoMessage() {}
+
+func (x *CreateScopedTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateScopedTokenResponse.ProtoReflect.Descriptor instead.
+func (*CreateScopedTokenResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *CreateScopedTokenResponse) GetToken() *ScopedToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+// UpdateScopedTokenRequest is the request to update a scoped token.
+type UpdateScopedTokenRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Token is the scoped token to update.
+	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateScopedTokenRequest) Reset() {
+	*x = UpdateScopedTokenRequest{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateScopedTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateScopedTokenRequest) ProtoMessage() {}
+
+func (x *UpdateScopedTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateScopedTokenRequest.ProtoReflect.Descriptor instead.
+func (*UpdateScopedTokenRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpdateScopedTokenRequest) GetToken() *ScopedToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+// UpdateScopedTokenResponse is the response to update a scoped token.
+type UpdateScopedTokenResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Token is the post-update scoped token.
+	Token         *ScopedToken `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateScopedTokenResponse) Reset() {
+	*x = UpdateScopedTokenResponse{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateScopedTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateScopedTokenResponse) ProtoMessage() {}
+
+func (x *UpdateScopedTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateScopedTokenResponse.ProtoReflect.Descriptor instead.
+func (*UpdateScopedTokenResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateScopedTokenResponse) GetToken() *ScopedToken {
+	if x != nil {
+		return x.Token
+	}
+	return nil
+}
+
+// DeleteScopedTokenRequest is the request to delete a scoped token.
+type DeleteScopedTokenRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the name of the scoped token to delete.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Revision asserts the revision of the scoped token to delete (optional).
+	Revision      string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedTokenRequest) Reset() {
+	*x = DeleteScopedTokenRequest{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedTokenRequest) ProtoMessage() {}
+
+func (x *DeleteScopedTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedTokenRequest.ProtoReflect.Descriptor instead.
+func (*DeleteScopedTokenRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *DeleteScopedTokenRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *DeleteScopedTokenRequest) GetRevision() string {
+	if x != nil {
+		return x.Revision
+	}
+	return ""
+}
+
+// DeleteScopedTokenResponse is the response to delete a scoped token.
+type DeleteScopedTokenResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteScopedTokenResponse) Reset() {
+	*x = DeleteScopedTokenResponse{}
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteScopedTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteScopedTokenResponse) ProtoMessage() {}
+
+func (x *DeleteScopedTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteScopedTokenResponse.ProtoReflect.Descriptor instead.
+func (*DeleteScopedTokenResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_service_proto_rawDescGZIP(), []int{9}
+}
+
+var File_teleport_scopes_joining_v1_service_proto protoreflect.FileDescriptor
+
+const file_teleport_scopes_joining_v1_service_proto_rawDesc = "" +
+	"\n" +
+	"(teleport/scopes/joining/v1/service.proto\x12\x1ateleport.scopes.joining.v1\x1a&teleport/scopes/joining/v1/token.proto\x1a\x1fteleport/scopes/v1/scopes.proto\"+\n" +
+	"\x15GetScopedTokenRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"W\n" +
+	"\x16GetScopedTokenResponse\x12=\n" +
+	"\x05token\x18\x01 \x01(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x05token\"\xf7\x02\n" +
+	"\x17ListScopedTokensRequest\x12A\n" +
+	"\x0eresource_scope\x18\x01 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rresourceScope\x12A\n" +
+	"\x0eassigned_scope\x18\x02 \x01(\v2\x1a.teleport.scopes.v1.FilterR\rassignedScope\x12\x16\n" +
+	"\x06cursor\x18\x03 \x01(\tR\x06cursor\x12\x14\n" +
+	"\x05limit\x18\x04 \x01(\rR\x05limit\x12\x14\n" +
+	"\x05roles\x18\x05 \x03(\tR\x05roles\x12W\n" +
+	"\x06labels\x18\x06 \x03(\v2?.teleport.scopes.joining.v1.ListScopedTokensRequest.LabelsEntryR\x06labels\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"s\n" +
+	"\x18ListScopedTokensResponse\x12?\n" +
+	"\x06tokens\x18\x01 \x03(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x06tokens\x12\x16\n" +
+	"\x06cursor\x18\x02 \x01(\tR\x06cursor\"Y\n" +
+	"\x18CreateScopedTokenRequest\x12=\n" +
+	"\x05token\x18\x01 \x01(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x05token\"Z\n" +
+	"\x19CreateScopedTokenResponse\x12=\n" +
+	"\x05token\x18\x01 \x01(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x05token\"Y\n" +
+	"\x18UpdateScopedTokenRequest\x12=\n" +
+	"\x05token\x18\x01 \x01(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x05token\"Z\n" +
+	"\x19UpdateScopedTokenResponse\x12=\n" +
+	"\x05token\x18\x01 \x01(\v2'.teleport.scopes.joining.v1.ScopedTokenR\x05token\"J\n" +
+	"\x18DeleteScopedTokenRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" +
+	"\brevision\x18\x02 \x01(\tR\brevision\"\x1b\n" +
+	"\x19DeleteScopedTokenResponse2\x97\x05\n" +
+	"\x14ScopedJoiningService\x12w\n" +
+	"\x0eGetScopedToken\x121.teleport.scopes.joining.v1.GetScopedTokenRequest\x1a2.teleport.scopes.joining.v1.GetScopedTokenResponse\x12}\n" +
+	"\x10ListScopedTokens\x123.teleport.scopes.joining.v1.ListScopedTokensRequest\x1a4.teleport.scopes.joining.v1.ListScopedTokensResponse\x12\x80\x01\n" +
+	"\x11CreateScopedToken\x124.teleport.scopes.joining.v1.CreateScopedTokenRequest\x1a5.teleport.scopes.joining.v1.CreateScopedTokenResponse\x12\x80\x01\n" +
+	"\x11UpdateScopedToken\x124.teleport.scopes.joining.v1.UpdateScopedTokenRequest\x1a5.teleport.scopes.joining.v1.UpdateScopedTokenResponse\x12\x80\x01\n" +
+	"\x11DeleteScopedToken\x124.teleport.scopes.joining.v1.DeleteScopedTokenRequest\x1a5.teleport.scopes.joining.v1.DeleteScopedTokenResponseBYZWgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1;joiningv1b\x06proto3"
+
+var (
+	file_teleport_scopes_joining_v1_service_proto_rawDescOnce sync.Once
+	file_teleport_scopes_joining_v1_service_proto_rawDescData []byte
+)
+
+func file_teleport_scopes_joining_v1_service_proto_rawDescGZIP() []byte {
+	file_teleport_scopes_joining_v1_service_proto_rawDescOnce.Do(func() {
+		file_teleport_scopes_joining_v1_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopes_joining_v1_service_proto_rawDesc), len(file_teleport_scopes_joining_v1_service_proto_rawDesc)))
+	})
+	return file_teleport_scopes_joining_v1_service_proto_rawDescData
+}
+
+var file_teleport_scopes_joining_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_teleport_scopes_joining_v1_service_proto_goTypes = []any{
+	(*GetScopedTokenRequest)(nil),     // 0: teleport.scopes.joining.v1.GetScopedTokenRequest
+	(*GetScopedTokenResponse)(nil),    // 1: teleport.scopes.joining.v1.GetScopedTokenResponse
+	(*ListScopedTokensRequest)(nil),   // 2: teleport.scopes.joining.v1.ListScopedTokensRequest
+	(*ListScopedTokensResponse)(nil),  // 3: teleport.scopes.joining.v1.ListScopedTokensResponse
+	(*CreateScopedTokenRequest)(nil),  // 4: teleport.scopes.joining.v1.CreateScopedTokenRequest
+	(*CreateScopedTokenResponse)(nil), // 5: teleport.scopes.joining.v1.CreateScopedTokenResponse
+	(*UpdateScopedTokenRequest)(nil),  // 6: teleport.scopes.joining.v1.UpdateScopedTokenRequest
+	(*UpdateScopedTokenResponse)(nil), // 7: teleport.scopes.joining.v1.UpdateScopedTokenResponse
+	(*DeleteScopedTokenRequest)(nil),  // 8: teleport.scopes.joining.v1.DeleteScopedTokenRequest
+	(*DeleteScopedTokenResponse)(nil), // 9: teleport.scopes.joining.v1.DeleteScopedTokenResponse
+	nil,                               // 10: teleport.scopes.joining.v1.ListScopedTokensRequest.LabelsEntry
+	(*ScopedToken)(nil),               // 11: teleport.scopes.joining.v1.ScopedToken
+	(*v1.Filter)(nil),                 // 12: teleport.scopes.v1.Filter
+}
+var file_teleport_scopes_joining_v1_service_proto_depIdxs = []int32{
+	11, // 0: teleport.scopes.joining.v1.GetScopedTokenResponse.token:type_name -> teleport.scopes.joining.v1.ScopedToken
+	12, // 1: teleport.scopes.joining.v1.ListScopedTokensRequest.resource_scope:type_name -> teleport.scopes.v1.Filter
+	12, // 2: teleport.scopes.joining.v1.ListScopedTokensRequest.assigned_scope:type_name -> teleport.scopes.v1.Filter
+	10, // 3: teleport.scopes.joining.v1.ListScopedTokensRequest.labels:type_name -> teleport.scopes.joining.v1.ListScopedTokensRequest.LabelsEntry
+	11, // 4: teleport.scopes.joining.v1.ListScopedTokensResponse.tokens:type_name -> teleport.scopes.joining.v1.ScopedToken
+	11, // 5: teleport.scopes.joining.v1.CreateScopedTokenRequest.token:type_name -> teleport.scopes.joining.v1.ScopedToken
+	11, // 6: teleport.scopes.joining.v1.CreateScopedTokenResponse.token:type_name -> teleport.scopes.joining.v1.ScopedToken
+	11, // 7: teleport.scopes.joining.v1.UpdateScopedTokenRequest.token:type_name -> teleport.scopes.joining.v1.ScopedToken
+	11, // 8: teleport.scopes.joining.v1.UpdateScopedTokenResponse.token:type_name -> teleport.scopes.joining.v1.ScopedToken
+	0,  // 9: teleport.scopes.joining.v1.ScopedJoiningService.GetScopedToken:input_type -> teleport.scopes.joining.v1.GetScopedTokenRequest
+	2,  // 10: teleport.scopes.joining.v1.ScopedJoiningService.ListScopedTokens:input_type -> teleport.scopes.joining.v1.ListScopedTokensRequest
+	4,  // 11: teleport.scopes.joining.v1.ScopedJoiningService.CreateScopedToken:input_type -> teleport.scopes.joining.v1.CreateScopedTokenRequest
+	6,  // 12: teleport.scopes.joining.v1.ScopedJoiningService.UpdateScopedToken:input_type -> teleport.scopes.joining.v1.UpdateScopedTokenRequest
+	8,  // 13: teleport.scopes.joining.v1.ScopedJoiningService.DeleteScopedToken:input_type -> teleport.scopes.joining.v1.DeleteScopedTokenRequest
+	1,  // 14: teleport.scopes.joining.v1.ScopedJoiningService.GetScopedToken:output_type -> teleport.scopes.joining.v1.GetScopedTokenResponse
+	3,  // 15: teleport.scopes.joining.v1.ScopedJoiningService.ListScopedTokens:output_type -> teleport.scopes.joining.v1.ListScopedTokensResponse
+	5,  // 16: teleport.scopes.joining.v1.ScopedJoiningService.CreateScopedToken:output_type -> teleport.scopes.joining.v1.CreateScopedTokenResponse
+	7,  // 17: teleport.scopes.joining.v1.ScopedJoiningService.UpdateScopedToken:output_type -> teleport.scopes.joining.v1.UpdateScopedTokenResponse
+	9,  // 18: teleport.scopes.joining.v1.ScopedJoiningService.DeleteScopedToken:output_type -> teleport.scopes.joining.v1.DeleteScopedTokenResponse
+	14, // [14:19] is the sub-list for method output_type
+	9,  // [9:14] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
+}
+
+func init() { file_teleport_scopes_joining_v1_service_proto_init() }
+func file_teleport_scopes_joining_v1_service_proto_init() {
+	if File_teleport_scopes_joining_v1_service_proto != nil {
+		return
+	}
+	file_teleport_scopes_joining_v1_token_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_joining_v1_service_proto_rawDesc), len(file_teleport_scopes_joining_v1_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   11,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_scopes_joining_v1_service_proto_goTypes,
+		DependencyIndexes: file_teleport_scopes_joining_v1_service_proto_depIdxs,
+		MessageInfos:      file_teleport_scopes_joining_v1_service_proto_msgTypes,
+	}.Build()
+	File_teleport_scopes_joining_v1_service_proto = out.File
+	file_teleport_scopes_joining_v1_service_proto_goTypes = nil
+	file_teleport_scopes_joining_v1_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/scopes/joining/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/scopes/joining/v1/service_grpc.pb.go
new file mode 100644
index 0000000000000..849955fe78df2
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/joining/v1/service_grpc.pb.go
@@ -0,0 +1,301 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/scopes/joining/v1/service.proto
+
+package joiningv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ScopedJoiningService_GetScopedToken_FullMethodName    = "/teleport.scopes.joining.v1.ScopedJoiningService/GetScopedToken"
+	ScopedJoiningService_ListScopedTokens_FullMethodName  = "/teleport.scopes.joining.v1.ScopedJoiningService/ListScopedTokens"
+	ScopedJoiningService_CreateScopedToken_FullMethodName = "/teleport.scopes.joining.v1.ScopedJoiningService/CreateScopedToken"
+	ScopedJoiningService_UpdateScopedToken_FullMethodName = "/teleport.scopes.joining.v1.ScopedJoiningService/UpdateScopedToken"
+	ScopedJoiningService_DeleteScopedToken_FullMethodName = "/teleport.scopes.joining.v1.ScopedJoiningService/DeleteScopedToken"
+)
+
+// ScopedJoiningServiceClient is the client API for ScopedJoiningService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ScopedJoiningService provides an API for managing scoped cluster joining resources.
+type ScopedJoiningServiceClient interface {
+	// GetScopedToken gets a scoped token by name.
+	GetScopedToken(ctx context.Context, in *GetScopedTokenRequest, opts ...grpc.CallOption) (*GetScopedTokenResponse, error)
+	// ListScopedTokens returns a paginated list of scoped tokens.
+	ListScopedTokens(ctx context.Context, in *ListScopedTokensRequest, opts ...grpc.CallOption) (*ListScopedTokensResponse, error)
+	// CreateScopedToken creates a new scoped token.
+	CreateScopedToken(ctx context.Context, in *CreateScopedTokenRequest, opts ...grpc.CallOption) (*CreateScopedTokenResponse, error)
+	// UpdateScopedToken updates a scoped token.
+	UpdateScopedToken(ctx context.Context, in *UpdateScopedTokenRequest, opts ...grpc.CallOption) (*UpdateScopedTokenResponse, error)
+	// DeleteScopedToken deletes a scoped token.
+	DeleteScopedToken(ctx context.Context, in *DeleteScopedTokenRequest, opts ...grpc.CallOption) (*DeleteScopedTokenResponse, error)
+}
+
+type scopedJoiningServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewScopedJoiningServiceClient(cc grpc.ClientConnInterface) ScopedJoiningServiceClient {
+	return &scopedJoiningServiceClient{cc}
+}
+
+func (c *scopedJoiningServiceClient) GetScopedToken(ctx context.Context, in *GetScopedTokenRequest, opts ...grpc.CallOption) (*GetScopedTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetScopedTokenResponse)
+	err := c.cc.Invoke(ctx, ScopedJoiningService_GetScopedToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedJoiningServiceClient) ListScopedTokens(ctx context.Context, in *ListScopedTokensRequest, opts ...grpc.CallOption) (*ListScopedTokensResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListScopedTokensResponse)
+	err := c.cc.Invoke(ctx, ScopedJoiningService_ListScopedTokens_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedJoiningServiceClient) CreateScopedToken(ctx context.Context, in *CreateScopedTokenRequest, opts ...grpc.CallOption) (*CreateScopedTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateScopedTokenResponse)
+	err := c.cc.Invoke(ctx, ScopedJoiningService_CreateScopedToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedJoiningServiceClient) UpdateScopedToken(ctx context.Context, in *UpdateScopedTokenRequest, opts ...grpc.CallOption) (*UpdateScopedTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateScopedTokenResponse)
+	err := c.cc.Invoke(ctx, ScopedJoiningService_UpdateScopedToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *scopedJoiningServiceClient) DeleteScopedToken(ctx context.Context, in *DeleteScopedTokenRequest, opts ...grpc.CallOption) (*DeleteScopedTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteScopedTokenResponse)
+	err := c.cc.Invoke(ctx, ScopedJoiningService_DeleteScopedToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ScopedJoiningServiceServer is the server API for ScopedJoiningService service.
+// All implementations must embed UnimplementedScopedJoiningServiceServer
+// for forward compatibility.
+//
+// ScopedJoiningService provides an API for managing scoped cluster joining resources.
+type ScopedJoiningServiceServer interface {
+	// GetScopedToken gets a scoped token by name.
+	GetScopedToken(context.Context, *GetScopedTokenRequest) (*GetScopedTokenResponse, error)
+	// ListScopedTokens returns a paginated list of scoped tokens.
+	ListScopedTokens(context.Context, *ListScopedTokensRequest) (*ListScopedTokensResponse, error)
+	// CreateScopedToken creates a new scoped token.
+	CreateScopedToken(context.Context, *CreateScopedTokenRequest) (*CreateScopedTokenResponse, error)
+	// UpdateScopedToken updates a scoped token.
+	UpdateScopedToken(context.Context, *UpdateScopedTokenRequest) (*UpdateScopedTokenResponse, error)
+	// DeleteScopedToken deletes a scoped token.
+	DeleteScopedToken(context.Context, *DeleteScopedTokenRequest) (*DeleteScopedTokenResponse, error)
+	mustEmbedUnimplementedScopedJoiningServiceServer()
+}
+
+// UnimplementedScopedJoiningServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedScopedJoiningServiceServer struct{}
+
+func (UnimplementedScopedJoiningServiceServer) GetScopedToken(context.Context, *GetScopedTokenRequest) (*GetScopedTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetScopedToken not implemented")
+}
+func (UnimplementedScopedJoiningServiceServer) ListScopedTokens(context.Context, *ListScopedTokensRequest) (*ListScopedTokensResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListScopedTokens not implemented")
+}
+func (UnimplementedScopedJoiningServiceServer) CreateScopedToken(context.Context, *CreateScopedTokenRequest) (*CreateScopedTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateScopedToken not implemented")
+}
+func (UnimplementedScopedJoiningServiceServer) UpdateScopedToken(context.Context, *UpdateScopedTokenRequest) (*UpdateScopedTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateScopedToken not implemented")
+}
+func (UnimplementedScopedJoiningServiceServer) DeleteScopedToken(context.Context, *DeleteScopedTokenRequest) (*DeleteScopedTokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteScopedToken not implemented")
+}
+func (UnimplementedScopedJoiningServiceServer) mustEmbedUnimplementedScopedJoiningServiceServer() {}
+func (UnimplementedScopedJoiningServiceServer) testEmbeddedByValue()                              {}
+
+// UnsafeScopedJoiningServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ScopedJoiningServiceServer will
+// result in compilation errors.
+type UnsafeScopedJoiningServiceServer interface {
+	mustEmbedUnimplementedScopedJoiningServiceServer()
+}
+
+func RegisterScopedJoiningServiceServer(s grpc.ServiceRegistrar, srv ScopedJoiningServiceServer) {
+	// If the following call pancis, it indicates UnimplementedScopedJoiningServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ScopedJoiningService_ServiceDesc, srv)
+}
+
+func _ScopedJoiningService_GetScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetScopedTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedJoiningServiceServer).GetScopedToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedJoiningService_GetScopedToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedJoiningServiceServer).GetScopedToken(ctx, req.(*GetScopedTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedJoiningService_ListScopedTokens_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListScopedTokensRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedJoiningServiceServer).ListScopedTokens(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedJoiningService_ListScopedTokens_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedJoiningServiceServer).ListScopedTokens(ctx, req.(*ListScopedTokensRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedJoiningService_CreateScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateScopedTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedJoiningServiceServer).CreateScopedToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedJoiningService_CreateScopedToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedJoiningServiceServer).CreateScopedToken(ctx, req.(*CreateScopedTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedJoiningService_UpdateScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateScopedTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedJoiningServiceServer).UpdateScopedToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedJoiningService_UpdateScopedToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedJoiningServiceServer).UpdateScopedToken(ctx, req.(*UpdateScopedTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ScopedJoiningService_DeleteScopedToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteScopedTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ScopedJoiningServiceServer).DeleteScopedToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ScopedJoiningService_DeleteScopedToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ScopedJoiningServiceServer).DeleteScopedToken(ctx, req.(*DeleteScopedTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ScopedJoiningService_ServiceDesc is the grpc.ServiceDesc for ScopedJoiningService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ScopedJoiningService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.scopes.joining.v1.ScopedJoiningService",
+	HandlerType: (*ScopedJoiningServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetScopedToken",
+			Handler:    _ScopedJoiningService_GetScopedToken_Handler,
+		},
+		{
+			MethodName: "ListScopedTokens",
+			Handler:    _ScopedJoiningService_ListScopedTokens_Handler,
+		},
+		{
+			MethodName: "CreateScopedToken",
+			Handler:    _ScopedJoiningService_CreateScopedToken_Handler,
+		},
+		{
+			MethodName: "UpdateScopedToken",
+			Handler:    _ScopedJoiningService_UpdateScopedToken_Handler,
+		},
+		{
+			MethodName: "DeleteScopedToken",
+			Handler:    _ScopedJoiningService_DeleteScopedToken_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/scopes/joining/v1/service.proto",
+}
diff --git a/api/gen/proto/go/teleport/scopes/joining/v1/token.pb.go b/api/gen/proto/go/teleport/scopes/joining/v1/token.pb.go
new file mode 100644
index 0000000000000..36b81a5d9d411
--- /dev/null
+++ b/api/gen/proto/go/teleport/scopes/joining/v1/token.pb.go
@@ -0,0 +1,268 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/scopes/joining/v1/token.proto
+
+package joiningv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ScopedToken is a token whose resource and permissions are scoped. Scoped tokens are used for the provisioning
+// of teleport agents locked to specific scopes. Scoped tokens implement a subset of the functionality of standard
+// provisioning tokens, specifically tailored to the usecase of limited admins/users provisioning resources within
+// sub-scopes over which they have been granted elevated privileges.
+type ScopedToken struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Metadata contains the resource metadata.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Scope is the scope of the token resource.
+	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
+	// Spec is the token specification.
+	Spec          *ScopedTokenSpec `protobuf:"bytes,6,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedToken) Reset() {
+	*x = ScopedToken{}
+	mi := &file_teleport_scopes_joining_v1_token_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedToken) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedToken) ProtoMessage() {}
+
+func (x *ScopedToken) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_token_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedToken.ProtoReflect.Descriptor instead.
+func (*ScopedToken) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_token_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ScopedToken) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *ScopedToken) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *ScopedToken) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *ScopedToken) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ScopedToken) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+func (x *ScopedToken) GetSpec() *ScopedTokenSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// ScopedTokenSpec is the specification of a scoped token.
+type ScopedTokenSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The scope to which this token is assigned.
+	AssignedScope string `protobuf:"bytes,1,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
+	// The list of roles associated with the token. They will be converted
+	// to metadata in the SSH and X509 certificates issued to the user of the
+	// token.
+	Roles []string `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
+	// The joining method required in order to use this token.
+	// Supported joining methods for scoped tokens only include 'token'.
+	JoinMethod    string `protobuf:"bytes,3,opt,name=join_method,json=joinMethod,proto3" json:"join_method,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ScopedTokenSpec) Reset() {
+	*x = ScopedTokenSpec{}
+	mi := &file_teleport_scopes_joining_v1_token_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ScopedTokenSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopedTokenSpec) ProtoMessage() {}
+
+func (x *ScopedTokenSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_joining_v1_token_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopedTokenSpec.ProtoReflect.Descriptor instead.
+func (*ScopedTokenSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_joining_v1_token_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ScopedTokenSpec) GetAssignedScope() string {
+	if x != nil {
+		return x.AssignedScope
+	}
+	return ""
+}
+
+func (x *ScopedTokenSpec) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *ScopedTokenSpec) GetJoinMethod() string {
+	if x != nil {
+		return x.JoinMethod
+	}
+	return ""
+}
+
+var File_teleport_scopes_joining_v1_token_proto protoreflect.FileDescriptor
+
+const file_teleport_scopes_joining_v1_token_proto_rawDesc = "" +
+	"\n" +
+	"&teleport/scopes/joining/v1/token.proto\x12\x1ateleport.scopes.joining.v1\x1a!teleport/header/v1/metadata.proto\"\xe7\x01\n" +
+	"\vScopedToken\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12\x14\n" +
+	"\x05scope\x18\x05 \x01(\tR\x05scope\x12?\n" +
+	"\x04spec\x18\x06 \x01(\v2+.teleport.scopes.joining.v1.ScopedTokenSpecR\x04spec\"o\n" +
+	"\x0fScopedTokenSpec\x12%\n" +
+	"\x0eassigned_scope\x18\x01 \x01(\tR\rassignedScope\x12\x14\n" +
+	"\x05roles\x18\x02 \x03(\tR\x05roles\x12\x1f\n" +
+	"\vjoin_method\x18\x03 \x01(\tR\n" +
+	"joinMethodBYZWgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1;joiningv1b\x06proto3"
+
+var (
+	file_teleport_scopes_joining_v1_token_proto_rawDescOnce sync.Once
+	file_teleport_scopes_joining_v1_token_proto_rawDescData []byte
+)
+
+func file_teleport_scopes_joining_v1_token_proto_rawDescGZIP() []byte {
+	file_teleport_scopes_joining_v1_token_proto_rawDescOnce.Do(func() {
+		file_teleport_scopes_joining_v1_token_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_scopes_joining_v1_token_proto_rawDesc), len(file_teleport_scopes_joining_v1_token_proto_rawDesc)))
+	})
+	return file_teleport_scopes_joining_v1_token_proto_rawDescData
+}
+
+var file_teleport_scopes_joining_v1_token_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_scopes_joining_v1_token_proto_goTypes = []any{
+	(*ScopedToken)(nil),     // 0: teleport.scopes.joining.v1.ScopedToken
+	(*ScopedTokenSpec)(nil), // 1: teleport.scopes.joining.v1.ScopedTokenSpec
+	(*v1.Metadata)(nil),     // 2: teleport.header.v1.Metadata
+}
+var file_teleport_scopes_joining_v1_token_proto_depIdxs = []int32{
+	2, // 0: teleport.scopes.joining.v1.ScopedToken.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.scopes.joining.v1.ScopedToken.spec:type_name -> teleport.scopes.joining.v1.ScopedTokenSpec
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_scopes_joining_v1_token_proto_init() }
+func file_teleport_scopes_joining_v1_token_proto_init() {
+	if File_teleport_scopes_joining_v1_token_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_joining_v1_token_proto_rawDesc), len(file_teleport_scopes_joining_v1_token_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_scopes_joining_v1_token_proto_goTypes,
+		DependencyIndexes: file_teleport_scopes_joining_v1_token_proto_depIdxs,
+		MessageInfos:      file_teleport_scopes_joining_v1_token_proto_msgTypes,
+	}.Build()
+	File_teleport_scopes_joining_v1_token_proto = out.File
+	file_teleport_scopes_joining_v1_token_proto_goTypes = nil
+	file_teleport_scopes_joining_v1_token_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/scopes/v1/scopes.pb.go b/api/gen/proto/go/teleport/scopes/v1/scopes.pb.go
index e4f8eed01a2e7..3817734456fb4 100644
--- a/api/gen/proto/go/teleport/scopes/v1/scopes.pb.go
+++ b/api/gen/proto/go/teleport/scopes/v1/scopes.pb.go
@@ -14,11 +14,11 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/scopes/v1/scopes.proto
 
-package scopes
+package scopesv1
 
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
@@ -96,6 +96,112 @@ func (Mode) EnumDescriptor() ([]byte, []int) {
 	return file_teleport_scopes_v1_scopes_proto_rawDescGZIP(), []int{0}
 }
 
+// Pin is a marker that identifies a certificate/identity as being "pinned" to a target scope, and encodes relevant
+// information for access-control evaluation at that scope.
+type Pin struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// scope is the target scope that this pin is associated with. This is the scope that the certificate/identity is
+	// pinned to. Any resources in parent/orthogonal scopes are not necessarily subject to the privileges/policies
+	// conveyed by this pin.
+	Scope string `protobuf:"bytes,1,opt,name=scope,proto3" json:"scope,omitempty"`
+	// assignments encodes the scoped role assignments relevant to access-control decisions about the pinned identity. This may
+	// include assignments to parents of the pinned scope as well as assignments to equivalent/child scopes. Effectively, this
+	// means all assignments that are not orthogonal to the pinned scope.
+	Assignments   map[string]*PinnedAssignments `protobuf:"bytes,2,rep,name=assignments,proto3" json:"assignments,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Pin) Reset() {
+	*x = Pin{}
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Pin) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Pin) ProtoMessage() {}
+
+func (x *Pin) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Pin.ProtoReflect.Descriptor instead.
+func (*Pin) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_v1_scopes_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Pin) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+func (x *Pin) GetAssignments() map[string]*PinnedAssignments {
+	if x != nil {
+		return x.Assignments
+	}
+	return nil
+}
+
+// PinnedAssignments is a collection of scoped role assignments that are relevant to the pinned identity at the target scope.
+type PinnedAssignments struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// roles is a list of scoped roles that are assigned to the pinned identity at the target scope.
+	Roles         []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PinnedAssignments) Reset() {
+	*x = PinnedAssignments{}
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PinnedAssignments) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PinnedAssignments) ProtoMessage() {}
+
+func (x *PinnedAssignments) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PinnedAssignments.ProtoReflect.Descriptor instead.
+func (*PinnedAssignments) Descriptor() ([]byte, []int) {
+	return file_teleport_scopes_v1_scopes_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PinnedAssignments) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
 // Filter is a query parameter that matches other scopes based on a specified scope and mode. Used for
 // filtering resources that are subject to or policies that apply to a given scope.
 type Filter struct {
@@ -110,7 +216,7 @@ type Filter struct {
 
 func (x *Filter) Reset() {
 	*x = Filter{}
-	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[0]
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -122,7 +228,7 @@ func (x *Filter) String() string {
 func (*Filter) ProtoMessage() {}
 
 func (x *Filter) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[0]
+	mi := &file_teleport_scopes_v1_scopes_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -135,7 +241,7 @@ func (x *Filter) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Filter.ProtoReflect.Descriptor instead.
 func (*Filter) Descriptor() ([]byte, []int) {
-	return file_teleport_scopes_v1_scopes_proto_rawDescGZIP(), []int{0}
+	return file_teleport_scopes_v1_scopes_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *Filter) GetScope() string {
@@ -156,14 +262,22 @@ var File_teleport_scopes_v1_scopes_proto protoreflect.FileDescriptor
 
 const file_teleport_scopes_v1_scopes_proto_rawDesc = "" +
 	"\n" +
-	"\x1fteleport/scopes/v1/scopes.proto\x12\x12teleport.scopes.v1\"L\n" +
+	"\x1fteleport/scopes/v1/scopes.proto\x12\x12teleport.scopes.v1\"\xce\x01\n" +
+	"\x03Pin\x12\x14\n" +
+	"\x05scope\x18\x01 \x01(\tR\x05scope\x12J\n" +
+	"\vassignments\x18\x02 \x03(\v2(.teleport.scopes.v1.Pin.AssignmentsEntryR\vassignments\x1ae\n" +
+	"\x10AssignmentsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12;\n" +
+	"\x05value\x18\x02 \x01(\v2%.teleport.scopes.v1.PinnedAssignmentsR\x05value:\x028\x01\")\n" +
+	"\x11PinnedAssignments\x12\x14\n" +
+	"\x05roles\x18\x01 \x03(\tR\x05roles\"L\n" +
 	"\x06Filter\x12\x14\n" +
 	"\x05scope\x18\x01 \x01(\tR\x05scope\x12,\n" +
 	"\x04mode\x18\x02 \x01(\x0e2\x18.teleport.scopes.v1.ModeR\x04mode*h\n" +
 	"\x04Mode\x12\x14\n" +
 	"\x10MODE_UNSPECIFIED\x10\x00\x12#\n" +
 	"\x1fMODE_RESOURCES_SUBJECT_TO_SCOPE\x10\x01\x12%\n" +
-	"!MODE_POLICIES_APPLICABLE_TO_SCOPE\x10\x02BNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1;scopesb\x06proto3"
+	"!MODE_POLICIES_APPLICABLE_TO_SCOPE\x10\x02BPZNgithub.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1;scopesv1b\x06proto3"
 
 var (
 	file_teleport_scopes_v1_scopes_proto_rawDescOnce sync.Once
@@ -178,18 +292,23 @@ func file_teleport_scopes_v1_scopes_proto_rawDescGZIP() []byte {
 }
 
 var file_teleport_scopes_v1_scopes_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_teleport_scopes_v1_scopes_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_scopes_v1_scopes_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
 var file_teleport_scopes_v1_scopes_proto_goTypes = []any{
-	(Mode)(0),      // 0: teleport.scopes.v1.Mode
-	(*Filter)(nil), // 1: teleport.scopes.v1.Filter
+	(Mode)(0),                 // 0: teleport.scopes.v1.Mode
+	(*Pin)(nil),               // 1: teleport.scopes.v1.Pin
+	(*PinnedAssignments)(nil), // 2: teleport.scopes.v1.PinnedAssignments
+	(*Filter)(nil),            // 3: teleport.scopes.v1.Filter
+	nil,                       // 4: teleport.scopes.v1.Pin.AssignmentsEntry
 }
 var file_teleport_scopes_v1_scopes_proto_depIdxs = []int32{
-	0, // 0: teleport.scopes.v1.Filter.mode:type_name -> teleport.scopes.v1.Mode
-	1, // [1:1] is the sub-list for method output_type
-	1, // [1:1] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
+	4, // 0: teleport.scopes.v1.Pin.assignments:type_name -> teleport.scopes.v1.Pin.AssignmentsEntry
+	0, // 1: teleport.scopes.v1.Filter.mode:type_name -> teleport.scopes.v1.Mode
+	2, // 2: teleport.scopes.v1.Pin.AssignmentsEntry.value:type_name -> teleport.scopes.v1.PinnedAssignments
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_teleport_scopes_v1_scopes_proto_init() }
@@ -203,7 +322,7 @@ func file_teleport_scopes_v1_scopes_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_scopes_v1_scopes_proto_rawDesc), len(file_teleport_scopes_v1_scopes_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   1,
+			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/gen/proto/go/teleport/secreports/v1/secreports.pb.go b/api/gen/proto/go/teleport/secreports/v1/secreports.pb.go
index bd16277f62a43..49eaef4aea78f 100644
--- a/api/gen/proto/go/teleport/secreports/v1/secreports.pb.go
+++ b/api/gen/proto/go/teleport/secreports/v1/secreports.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/secreports/v1/secreports.proto
 
diff --git a/api/gen/proto/go/teleport/secreports/v1/secreports_service.pb.go b/api/gen/proto/go/teleport/secreports/v1/secreports_service.pb.go
index 71c805f8f2a25..c254839265d3f 100644
--- a/api/gen/proto/go/teleport/secreports/v1/secreports_service.pb.go
+++ b/api/gen/proto/go/teleport/secreports/v1/secreports_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/secreports/v1/secreports_service.proto
 
diff --git a/api/gen/proto/go/teleport/stableunixusers/v1/stableunixusers.pb.go b/api/gen/proto/go/teleport/stableunixusers/v1/stableunixusers.pb.go
index 608b0e2beb212..857c19d93b120 100644
--- a/api/gen/proto/go/teleport/stableunixusers/v1/stableunixusers.pb.go
+++ b/api/gen/proto/go/teleport/stableunixusers/v1/stableunixusers.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/stableunixusers/v1/stableunixusers.proto
 
diff --git a/api/gen/proto/go/teleport/summarizer/v1/summarizer.pb.go b/api/gen/proto/go/teleport/summarizer/v1/summarizer.pb.go
new file mode 100644
index 0000000000000..56686b7b0a6ad
--- /dev/null
+++ b/api/gen/proto/go/teleport/summarizer/v1/summarizer.pb.go
@@ -0,0 +1,1724 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/summarizer/v1/summarizer.proto
+
+package summarizerv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// SummaryState is the state of the summarization process.
+type SummaryState int32
+
+const (
+	SummaryState_SUMMARY_STATE_UNSPECIFIED SummaryState = 0
+	SummaryState_SUMMARY_STATE_PENDING     SummaryState = 1
+	SummaryState_SUMMARY_STATE_SUCCESS     SummaryState = 2
+	SummaryState_SUMMARY_STATE_ERROR       SummaryState = 3
+)
+
+// Enum value maps for SummaryState.
+var (
+	SummaryState_name = map[int32]string{
+		0: "SUMMARY_STATE_UNSPECIFIED",
+		1: "SUMMARY_STATE_PENDING",
+		2: "SUMMARY_STATE_SUCCESS",
+		3: "SUMMARY_STATE_ERROR",
+	}
+	SummaryState_value = map[string]int32{
+		"SUMMARY_STATE_UNSPECIFIED": 0,
+		"SUMMARY_STATE_PENDING":     1,
+		"SUMMARY_STATE_SUCCESS":     2,
+		"SUMMARY_STATE_ERROR":       3,
+	}
+)
+
+func (x SummaryState) Enum() *SummaryState {
+	p := new(SummaryState)
+	*p = x
+	return p
+}
+
+func (x SummaryState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SummaryState) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_summarizer_v1_summarizer_proto_enumTypes[0].Descriptor()
+}
+
+func (SummaryState) Type() protoreflect.EnumType {
+	return &file_teleport_summarizer_v1_summarizer_proto_enumTypes[0]
+}
+
+func (x SummaryState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SummaryState.Descriptor instead.
+func (SummaryState) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{0}
+}
+
+// CommandCategory represents the category of a command.
+type CommandCategory int32
+
+const (
+	// CommandCategoryUnspecified is the default value and indicates that the command
+	// category is not specified.
+	CommandCategory_COMMAND_CATEGORY_UNSPECIFIED CommandCategory = 0
+	// CommandCategoryFileOperation indicates that the command is related to file
+	// operations, such as copying, moving, or deleting files.
+	CommandCategory_COMMAND_CATEGORY_FILE_OPERATION CommandCategory = 1
+	// CommandCategoryNetwork indicates that the command is related to network
+	// operations, such as connecting to a remote host or transferring data.
+	CommandCategory_COMMAND_CATEGORY_NETWORK CommandCategory = 2
+	// CommandCategoryProcess indicates that the command is related to process
+	// management, such as starting or stopping processes.
+	CommandCategory_COMMAND_CATEGORY_PROCESS CommandCategory = 3
+	// CommandCategorySystemConfig indicates that the command is related to system
+	// configuration, such as changing system settings or installing software.
+	CommandCategory_COMMAND_CATEGORY_SYSTEM_CONFIG CommandCategory = 4
+	// CommandCategoryDataAccess indicates that the command is related to data access,
+	// such as querying databases or reading data files.
+	CommandCategory_COMMAND_CATEGORY_DATA_ACCESS CommandCategory = 5
+	// CommandCategoryAuthentication indicates that the command is related to
+	// authentication, such as logging in or changing user credentials.
+	CommandCategory_COMMAND_CATEGORY_AUTHENTICATION CommandCategory = 6
+	// CommandCategoryOther indicates that the command does not fit into any of the
+	// other categories.
+	CommandCategory_COMMAND_CATEGORY_OTHER CommandCategory = 7
+)
+
+// Enum value maps for CommandCategory.
+var (
+	CommandCategory_name = map[int32]string{
+		0: "COMMAND_CATEGORY_UNSPECIFIED",
+		1: "COMMAND_CATEGORY_FILE_OPERATION",
+		2: "COMMAND_CATEGORY_NETWORK",
+		3: "COMMAND_CATEGORY_PROCESS",
+		4: "COMMAND_CATEGORY_SYSTEM_CONFIG",
+		5: "COMMAND_CATEGORY_DATA_ACCESS",
+		6: "COMMAND_CATEGORY_AUTHENTICATION",
+		7: "COMMAND_CATEGORY_OTHER",
+	}
+	CommandCategory_value = map[string]int32{
+		"COMMAND_CATEGORY_UNSPECIFIED":    0,
+		"COMMAND_CATEGORY_FILE_OPERATION": 1,
+		"COMMAND_CATEGORY_NETWORK":        2,
+		"COMMAND_CATEGORY_PROCESS":        3,
+		"COMMAND_CATEGORY_SYSTEM_CONFIG":  4,
+		"COMMAND_CATEGORY_DATA_ACCESS":    5,
+		"COMMAND_CATEGORY_AUTHENTICATION": 6,
+		"COMMAND_CATEGORY_OTHER":          7,
+	}
+)
+
+func (x CommandCategory) Enum() *CommandCategory {
+	p := new(CommandCategory)
+	*p = x
+	return p
+}
+
+func (x CommandCategory) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CommandCategory) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_summarizer_v1_summarizer_proto_enumTypes[1].Descriptor()
+}
+
+func (CommandCategory) Type() protoreflect.EnumType {
+	return &file_teleport_summarizer_v1_summarizer_proto_enumTypes[1]
+}
+
+func (x CommandCategory) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CommandCategory.Descriptor instead.
+func (CommandCategory) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{1}
+}
+
+// RiskLevel represents the risk level associated with a command.
+type RiskLevel int32
+
+const (
+	// RiskLevelUnspecified is the default value and indicates that the risk level
+	// is not specified.
+	RiskLevel_RISK_LEVEL_UNSPECIFIED RiskLevel = 0
+	// RiskLevelLow indicates that the command has a low risk level.
+	RiskLevel_RISK_LEVEL_LOW RiskLevel = 1
+	// RiskLevelMedium indicates that the command has a medium risk level.
+	RiskLevel_RISK_LEVEL_MEDIUM RiskLevel = 2
+	// RiskLevelHigh indicates that the command has a high risk level.
+	RiskLevel_RISK_LEVEL_HIGH RiskLevel = 3
+	// RiskLevelCritical indicates that the command has a critical risk level.
+	RiskLevel_RISK_LEVEL_CRITICAL RiskLevel = 4
+)
+
+// Enum value maps for RiskLevel.
+var (
+	RiskLevel_name = map[int32]string{
+		0: "RISK_LEVEL_UNSPECIFIED",
+		1: "RISK_LEVEL_LOW",
+		2: "RISK_LEVEL_MEDIUM",
+		3: "RISK_LEVEL_HIGH",
+		4: "RISK_LEVEL_CRITICAL",
+	}
+	RiskLevel_value = map[string]int32{
+		"RISK_LEVEL_UNSPECIFIED": 0,
+		"RISK_LEVEL_LOW":         1,
+		"RISK_LEVEL_MEDIUM":      2,
+		"RISK_LEVEL_HIGH":        3,
+		"RISK_LEVEL_CRITICAL":    4,
+	}
+)
+
+func (x RiskLevel) Enum() *RiskLevel {
+	p := new(RiskLevel)
+	*p = x
+	return p
+}
+
+func (x RiskLevel) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RiskLevel) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_summarizer_v1_summarizer_proto_enumTypes[2].Descriptor()
+}
+
+func (RiskLevel) Type() protoreflect.EnumType {
+	return &file_teleport_summarizer_v1_summarizer_proto_enumTypes[2]
+}
+
+func (x RiskLevel) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RiskLevel.Descriptor instead.
+func (RiskLevel) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{2}
+}
+
+// ThreatCategory represents the category of a detected threat.
+type ThreatCategory int32
+
+const (
+	// ThreatCategoryUnspecified is the default value and indicates that the threat
+	// category is not specified.
+	ThreatCategory_THREAT_CATEGORY_UNSPECIFIED ThreatCategory = 0
+	// ThreatCategoryReconnaissance indicates that the threat is related to reconnaissance
+	// activities, such as scanning or probing the system.
+	ThreatCategory_THREAT_CATEGORY_RECONNAISSANCE ThreatCategory = 1
+	// ThreatCategoryExecution indicates that the threat is related to execution activities,
+	// such as running malicious code.
+	ThreatCategory_THREAT_CATEGORY_EXECUTION ThreatCategory = 2
+	// ThreatCategoryPersistence indicates that the threat is related to persistence
+	// activities, such as installing backdoors.
+	ThreatCategory_THREAT_CATEGORY_PERSISTENCE ThreatCategory = 3
+	// ThreatCategoryPrivilegeEscalation indicates that the threat is related to privilege
+	// escalation activities, such as exploiting vulnerabilities to gain higher privileges.
+	ThreatCategory_THREAT_CATEGORY_PRIVILEGE_ESCALATION ThreatCategory = 4
+	// ThreatCategoryDefenseEvasion indicates that the threat is related to defense evasion
+	// activities, such as disabling security software.
+	ThreatCategory_THREAT_CATEGORY_DEFENSE_EVASION ThreatCategory = 5
+	// ThreatCategoryCredentialAccess indicates that the threat is related to credential
+	// access activities, such as stealing passwords.
+	ThreatCategory_THREAT_CATEGORY_CREDENTIAL_ACCESS ThreatCategory = 6
+	// ThreatCategoryDiscovery indicates that the threat is related to discovery activities,
+	// such as gathering information about the system.
+	ThreatCategory_THREAT_CATEGORY_DISCOVERY ThreatCategory = 7
+	// ThreatCategoryLateralMovement indicates that the threat is related to lateral movement
+	// activities, such as moving laterally within the network.
+	ThreatCategory_THREAT_CATEGORY_LATERAL_MOVEMENT ThreatCategory = 8
+	// ThreatCategoryCollection indicates that the threat is related to collection activities,
+	// such as collecting sensitive data.
+	ThreatCategory_THREAT_CATEGORY_COLLECTION ThreatCategory = 9
+	// ThreatCategoryExfiltration indicates that the threat is related to exfiltration
+	// activities, such as stealing data from the system.
+	ThreatCategory_THREAT_CATEGORY_EXFILTRATION ThreatCategory = 10
+	// ThreatCategoryImpact indicates that the threat is related to impact activities,
+	// such as disrupting system operations.
+	ThreatCategory_THREAT_CATEGORY_IMPACT ThreatCategory = 11
+	// ThreatCategoryNone indicates that there is no threat detected.
+	ThreatCategory_THREAT_CATEGORY_NONE ThreatCategory = 12
+)
+
+// Enum value maps for ThreatCategory.
+var (
+	ThreatCategory_name = map[int32]string{
+		0:  "THREAT_CATEGORY_UNSPECIFIED",
+		1:  "THREAT_CATEGORY_RECONNAISSANCE",
+		2:  "THREAT_CATEGORY_EXECUTION",
+		3:  "THREAT_CATEGORY_PERSISTENCE",
+		4:  "THREAT_CATEGORY_PRIVILEGE_ESCALATION",
+		5:  "THREAT_CATEGORY_DEFENSE_EVASION",
+		6:  "THREAT_CATEGORY_CREDENTIAL_ACCESS",
+		7:  "THREAT_CATEGORY_DISCOVERY",
+		8:  "THREAT_CATEGORY_LATERAL_MOVEMENT",
+		9:  "THREAT_CATEGORY_COLLECTION",
+		10: "THREAT_CATEGORY_EXFILTRATION",
+		11: "THREAT_CATEGORY_IMPACT",
+		12: "THREAT_CATEGORY_NONE",
+	}
+	ThreatCategory_value = map[string]int32{
+		"THREAT_CATEGORY_UNSPECIFIED":          0,
+		"THREAT_CATEGORY_RECONNAISSANCE":       1,
+		"THREAT_CATEGORY_EXECUTION":            2,
+		"THREAT_CATEGORY_PERSISTENCE":          3,
+		"THREAT_CATEGORY_PRIVILEGE_ESCALATION": 4,
+		"THREAT_CATEGORY_DEFENSE_EVASION":      5,
+		"THREAT_CATEGORY_CREDENTIAL_ACCESS":    6,
+		"THREAT_CATEGORY_DISCOVERY":            7,
+		"THREAT_CATEGORY_LATERAL_MOVEMENT":     8,
+		"THREAT_CATEGORY_COLLECTION":           9,
+		"THREAT_CATEGORY_EXFILTRATION":         10,
+		"THREAT_CATEGORY_IMPACT":               11,
+		"THREAT_CATEGORY_NONE":                 12,
+	}
+)
+
+func (x ThreatCategory) Enum() *ThreatCategory {
+	p := new(ThreatCategory)
+	*p = x
+	return p
+}
+
+func (x ThreatCategory) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ThreatCategory) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_summarizer_v1_summarizer_proto_enumTypes[3].Descriptor()
+}
+
+func (ThreatCategory) Type() protoreflect.EnumType {
+	return &file_teleport_summarizer_v1_summarizer_proto_enumTypes[3]
+}
+
+func (x ThreatCategory) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ThreatCategory.Descriptor instead.
+func (ThreatCategory) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{3}
+}
+
+// InferenceModel resource specifies a session summarization inference model
+// configuration. It tells Teleport how to use a specific provider and model to
+// summarize sessions.
+type InferenceModel struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind. Should always be set to "inference_model".
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind. Should be empty.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version. Should be set to "v1".
+	Version       string              `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata      *v1.Metadata        `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec          *InferenceModelSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InferenceModel) Reset() {
+	*x = InferenceModel{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferenceModel) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferenceModel) ProtoMessage() {}
+
+func (x *InferenceModel) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferenceModel.ProtoReflect.Descriptor instead.
+func (*InferenceModel) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *InferenceModel) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *InferenceModel) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *InferenceModel) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *InferenceModel) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *InferenceModel) GetSpec() *InferenceModelSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// InferenceModelSpec specifies the inference provider and provider-specific
+// parameters.
+type InferenceModelSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Provider:
+	//
+	//	*InferenceModelSpec_Openai
+	//	*InferenceModelSpec_Bedrock
+	Provider isInferenceModelSpec_Provider `protobuf_oneof:"provider"`
+	// MaxSessionLengthBytes is the maximum session length that can be sent to
+	// inference provider. Currently, it's determined by the size of model's
+	// context window; future versions of Teleport will allow summarizing larger
+	// sessions by splitting them.
+	//
+	// Inference providers will reject requests that are larger than given
+	// model's context window. Since context windows are usually sized in tokens,
+	// this value is an approximation. Assuming 2 bytes per input token should be
+	// safe.
+	//
+	// Currently, Teleport will outright reject sessions larger than this limit;
+	// future versions will split sessions in chunks, treating this size as a
+	// maximum.
+	//
+	// If unset or set to 0, defaults to 1MB.
+	MaxSessionLengthBytes int64 `protobuf:"varint,2,opt,name=max_session_length_bytes,json=maxSessionLengthBytes,proto3" json:"max_session_length_bytes,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
+}
+
+func (x *InferenceModelSpec) Reset() {
+	*x = InferenceModelSpec{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferenceModelSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferenceModelSpec) ProtoMessage() {}
+
+func (x *InferenceModelSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferenceModelSpec.ProtoReflect.Descriptor instead.
+func (*InferenceModelSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *InferenceModelSpec) GetProvider() isInferenceModelSpec_Provider {
+	if x != nil {
+		return x.Provider
+	}
+	return nil
+}
+
+func (x *InferenceModelSpec) GetOpenai() *OpenAIProvider {
+	if x != nil {
+		if x, ok := x.Provider.(*InferenceModelSpec_Openai); ok {
+			return x.Openai
+		}
+	}
+	return nil
+}
+
+func (x *InferenceModelSpec) GetBedrock() *BedrockProvider {
+	if x != nil {
+		if x, ok := x.Provider.(*InferenceModelSpec_Bedrock); ok {
+			return x.Bedrock
+		}
+	}
+	return nil
+}
+
+func (x *InferenceModelSpec) GetMaxSessionLengthBytes() int64 {
+	if x != nil {
+		return x.MaxSessionLengthBytes
+	}
+	return 0
+}
+
+type isInferenceModelSpec_Provider interface {
+	isInferenceModelSpec_Provider()
+}
+
+type InferenceModelSpec_Openai struct {
+	// Openai indicates that this model uses OpenAI as the inference provider
+	// and specifies OpenAI-specific parameters.
+	Openai *OpenAIProvider `protobuf:"bytes,1,opt,name=openai,proto3,oneof"`
+}
+
+type InferenceModelSpec_Bedrock struct {
+	// Bedrock indicates that this model uses Amazon Bedrock as the inference
+	// provider and specifies Bedrock-specific parameters.
+	Bedrock *BedrockProvider `protobuf:"bytes,3,opt,name=bedrock,proto3,oneof"`
+}
+
+func (*InferenceModelSpec_Openai) isInferenceModelSpec_Provider() {}
+
+func (*InferenceModelSpec_Bedrock) isInferenceModelSpec_Provider() {}
+
+// OpenAIProvider specifies OpenAI-specific parameters. It can be used to
+// configure OpenAI or an OpenAI-compatible API, such as LiteLLM.
+type OpenAIProvider struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// OpenaiModelId specifies the model ID, as understood by the OpenAI API.
+	OpenaiModelId string `protobuf:"bytes,1,opt,name=openai_model_id,json=openaiModelId,proto3" json:"openai_model_id,omitempty"`
+	// Temperature controls the randomness of the model's output.
+	Temperature float64 `protobuf:"fixed64,2,opt,name=temperature,proto3" json:"temperature,omitempty"`
+	// ApiKeySecretRef is a reference to an InferenceSecret that contains the
+	// OpenAI API key.
+	ApiKeySecretRef string `protobuf:"bytes,3,opt,name=api_key_secret_ref,json=apiKeySecretRef,proto3" json:"api_key_secret_ref,omitempty"`
+	// BaseUrl is the OpenAI API base URL. Optional, defaults to the public
+	// OpenAI API URL. May be used to point to a custom OpenAI-compatible API,
+	// such as LiteLLM. In such case, the `api_key_secret_ref` must point to a
+	// secret that contains the API key for that custom API.
+	BaseUrl       string `protobuf:"bytes,4,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OpenAIProvider) Reset() {
+	*x = OpenAIProvider{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OpenAIProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OpenAIProvider) ProtoMessage() {}
+
+func (x *OpenAIProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OpenAIProvider.ProtoReflect.Descriptor instead.
+func (*OpenAIProvider) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *OpenAIProvider) GetOpenaiModelId() string {
+	if x != nil {
+		return x.OpenaiModelId
+	}
+	return ""
+}
+
+func (x *OpenAIProvider) GetTemperature() float64 {
+	if x != nil {
+		return x.Temperature
+	}
+	return 0
+}
+
+func (x *OpenAIProvider) GetApiKeySecretRef() string {
+	if x != nil {
+		return x.ApiKeySecretRef
+	}
+	return ""
+}
+
+func (x *OpenAIProvider) GetBaseUrl() string {
+	if x != nil {
+		return x.BaseUrl
+	}
+	return ""
+}
+
+// BedrockProvider specifies parameters specific to Amazon Bedrock.
+type BedrockProvider struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Region is the AWS region which will be used for inference.
+	Region string `protobuf:"bytes,1,opt,name=region,proto3" json:"region,omitempty"`
+	// BedrockModelId specifies a model ID or an inference profile as understood
+	// by the Bedrock API.
+	BedrockModelId string `protobuf:"bytes,2,opt,name=bedrock_model_id,json=bedrockModelId,proto3" json:"bedrock_model_id,omitempty"`
+	// Temperature controls the randomness of the model's output.
+	Temperature float32 `protobuf:"fixed32,3,opt,name=temperature,proto3" json:"temperature,omitempty"`
+	// Integration is the AWS OIDC Integration name. If unset, Teleport will use
+	// AWS credentials available on the auth server machine; otherwise, it will
+	// use the specified OIDC integration for assuming appropriate role.
+	Integration   string `protobuf:"bytes,4,opt,name=integration,proto3" json:"integration,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BedrockProvider) Reset() {
+	*x = BedrockProvider{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BedrockProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BedrockProvider) ProtoMessage() {}
+
+func (x *BedrockProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BedrockProvider.ProtoReflect.Descriptor instead.
+func (*BedrockProvider) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *BedrockProvider) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *BedrockProvider) GetBedrockModelId() string {
+	if x != nil {
+		return x.BedrockModelId
+	}
+	return ""
+}
+
+func (x *BedrockProvider) GetTemperature() float32 {
+	if x != nil {
+		return x.Temperature
+	}
+	return 0
+}
+
+func (x *BedrockProvider) GetIntegration() string {
+	if x != nil {
+		return x.Integration
+	}
+	return ""
+}
+
+// InferenceSecret resource stores session summarization inference provider
+// secrets, such as API keys. They need to be referenced by appropriate
+// provider configuration inside `InferenceModelSpec`.
+type InferenceSecret struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind. Should always be set to "inference_secret".
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind. Should be empty.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version. Should be set to "v1".
+	Version  string       `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Spec contains the secret value. Once set, it can only be read by Teleport
+	// itself; it will not be returned in API responses.
+	Spec          *InferenceSecretSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InferenceSecret) Reset() {
+	*x = InferenceSecret{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferenceSecret) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferenceSecret) ProtoMessage() {}
+
+func (x *InferenceSecret) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferenceSecret.ProtoReflect.Descriptor instead.
+func (*InferenceSecret) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *InferenceSecret) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *InferenceSecret) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *InferenceSecret) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *InferenceSecret) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *InferenceSecret) GetSpec() *InferenceSecretSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// InferenceSecretSpec defines the secret value for the inference model.
+type InferenceSecretSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Value is the secret value, such as an API key.
+	Value         string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InferenceSecretSpec) Reset() {
+	*x = InferenceSecretSpec{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferenceSecretSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferenceSecretSpec) ProtoMessage() {}
+
+func (x *InferenceSecretSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferenceSecretSpec.ProtoReflect.Descriptor instead.
+func (*InferenceSecretSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *InferenceSecretSpec) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+// InferencePolicy resource maps sessions to summarization models.
+type InferencePolicy struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kind is the resource kind. Should always be set to "inference_policy".
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the resource sub-kind. Should be empty.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the resource version. Should be set to "v1".
+	Version       string               `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Metadata      *v1.Metadata         `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec          *InferencePolicySpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InferencePolicy) Reset() {
+	*x = InferencePolicy{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferencePolicy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferencePolicy) ProtoMessage() {}
+
+func (x *InferencePolicy) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferencePolicy.ProtoReflect.Descriptor instead.
+func (*InferencePolicy) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *InferencePolicy) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *InferencePolicy) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *InferencePolicy) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *InferencePolicy) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *InferencePolicy) GetSpec() *InferencePolicySpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// InferencePolicySpec maps sessions to summarization models using a filter.
+type InferencePolicySpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kinds are session kinds matched by this policy, e.g., "ssh", "k8s", "db"
+	Kinds []string `protobuf:"bytes,1,rep,name=kinds,proto3" json:"kinds,omitempty"`
+	// Model is the name of the `InferenceModel` resource to be used for
+	// summarization.
+	Model string `protobuf:"bytes,2,opt,name=model,proto3" json:"model,omitempty"`
+	// Filter is an optional filter expression using Teleport Predicate Language
+	// to select sessions for summarization. If it's empty, all sessions that
+	// match the list of kinds will be summarized using this model.
+	Filter        string `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InferencePolicySpec) Reset() {
+	*x = InferencePolicySpec{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InferencePolicySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InferencePolicySpec) ProtoMessage() {}
+
+func (x *InferencePolicySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InferencePolicySpec.ProtoReflect.Descriptor instead.
+func (*InferencePolicySpec) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *InferencePolicySpec) GetKinds() []string {
+	if x != nil {
+		return x.Kinds
+	}
+	return nil
+}
+
+func (x *InferencePolicySpec) GetModel() string {
+	if x != nil {
+		return x.Model
+	}
+	return ""
+}
+
+func (x *InferencePolicySpec) GetFilter() string {
+	if x != nil {
+		return x.Filter
+	}
+	return ""
+}
+
+// Summary represents a summary of a session recording. This format is used to
+// store the summaries in the session storage and return it with gRPC.
+type Summary struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// sessionId is an ID of the session whose recording got summarized.
+	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	// State is the state of the summarization process.
+	State SummaryState `protobuf:"varint,2,opt,name=state,proto3,enum=teleport.summarizer.v1.SummaryState" json:"state,omitempty"`
+	// InferenceStartedAt is the time when the summarization process started.
+	InferenceStartedAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=inference_started_at,json=inferenceStartedAt,proto3" json:"inference_started_at,omitempty"`
+	// InferenceFinishedAt is the time when the summarization process finished.
+	InferenceFinishedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=inference_finished_at,json=inferenceFinishedAt,proto3" json:"inference_finished_at,omitempty"`
+	// Content is the main text content of the summary, stored in Markdown
+	// format. Available if the state is SUMMARY_STATE_SUCCESS.
+	Content string `protobuf:"bytes,5,opt,name=content,proto3" json:"content,omitempty"`
+	// ModelName is the name of the `InferenceModel` resource that was used to
+	// generate this summary.
+	ModelName string `protobuf:"bytes,6,opt,name=model_name,json=modelName,proto3" json:"model_name,omitempty"`
+	// SessionEndEvent is the event that ended the summarized session. Session
+	// end events carry the most complete set of data that Teleport has about a
+	// given session. Used for checking access based on RBAC rule "where"
+	// filters.
+	//
+	// The event is stored in an unstructured form, as storing an instance of
+	// events.OneOf posed a number of technical challenges with JSON
+	// serialization as a subcomponent of this message. These challenges stem
+	// from the fact that audit events have gogoproto extensions.
+	SessionEndEvent *structpb.Struct `protobuf:"bytes,7,opt,name=session_end_event,json=sessionEndEvent,proto3" json:"session_end_event,omitempty"`
+	// ErrorMessage is an error message if the summarization failed. Available if
+	// the state is SUMMARY_STATE_ERROR.
+	ErrorMessage string `protobuf:"bytes,8,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+	// EnhancedSummary contains structured data extracted from the session.
+	EnhancedSummary *EnhancedSummary `protobuf:"bytes,9,opt,name=enhanced_summary,json=enhancedSummary,proto3" json:"enhanced_summary,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *Summary) Reset() {
+	*x = Summary{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Summary) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Summary) ProtoMessage() {}
+
+func (x *Summary) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Summary.ProtoReflect.Descriptor instead.
+func (*Summary) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *Summary) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *Summary) GetState() SummaryState {
+	if x != nil {
+		return x.State
+	}
+	return SummaryState_SUMMARY_STATE_UNSPECIFIED
+}
+
+func (x *Summary) GetInferenceStartedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.InferenceStartedAt
+	}
+	return nil
+}
+
+func (x *Summary) GetInferenceFinishedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.InferenceFinishedAt
+	}
+	return nil
+}
+
+func (x *Summary) GetContent() string {
+	if x != nil {
+		return x.Content
+	}
+	return ""
+}
+
+func (x *Summary) GetModelName() string {
+	if x != nil {
+		return x.ModelName
+	}
+	return ""
+}
+
+func (x *Summary) GetSessionEndEvent() *structpb.Struct {
+	if x != nil {
+		return x.SessionEndEvent
+	}
+	return nil
+}
+
+func (x *Summary) GetErrorMessage() string {
+	if x != nil {
+		return x.ErrorMessage
+	}
+	return ""
+}
+
+func (x *Summary) GetEnhancedSummary() *EnhancedSummary {
+	if x != nil {
+		return x.EnhancedSummary
+	}
+	return nil
+}
+
+// CommandAnalysis represents a summary of a single command executed during a
+// session.
+type CommandAnalysis struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Command is the command that was executed.
+	Command string `protobuf:"bytes,1,opt,name=command,proto3" json:"command,omitempty"`
+	// Category is the category of the command.
+	Category CommandCategory `protobuf:"varint,2,opt,name=category,proto3,enum=teleport.summarizer.v1.CommandCategory" json:"category,omitempty"`
+	// Success indicates whether the command executed successfully.
+	Success bool `protobuf:"varint,3,opt,name=success,proto3" json:"success,omitempty"`
+	// RiskLevel is the risk level associated with the command.
+	RiskLevel RiskLevel `protobuf:"varint,4,opt,name=risk_level,json=riskLevel,proto3,enum=teleport.summarizer.v1.RiskLevel" json:"risk_level,omitempty"`
+	// RiskScore is a numerical score representing the risk associated with the command.
+	RiskScore int32 `protobuf:"varint,5,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"`
+	// ThreatCategory is the category of any detected threat associated with the command.
+	ThreatCategory ThreatCategory `protobuf:"varint,6,opt,name=threat_category,json=threatCategory,proto3,enum=teleport.summarizer.v1.ThreatCategory" json:"threat_category,omitempty"`
+	// TimelineTitle is a brief title for the command's entry in the session timeline.
+	TimelineTitle string `protobuf:"bytes,7,opt,name=timeline_title,json=timelineTitle,proto3" json:"timeline_title,omitempty"`
+	// TimelineSubtitle is a more detailed subtitle for the command's entry in the session timeline.
+	TimelineSubtitle string `protobuf:"bytes,8,opt,name=timeline_subtitle,json=timelineSubtitle,proto3" json:"timeline_subtitle,omitempty"`
+	// ShortDescription is a concise description of the command and its purpose.
+	ShortDescription string `protobuf:"bytes,9,opt,name=short_description,json=shortDescription,proto3" json:"short_description,omitempty"`
+	// DetailedDescription is an in-depth explanation of the command, its function,
+	// and any relevant context.
+	DetailedDescription string `protobuf:"bytes,10,opt,name=detailed_description,json=detailedDescription,proto3" json:"detailed_description,omitempty"`
+	// ErrorMessages contains any error messages produced during the execution of the command.
+	ErrorMessages []string `protobuf:"bytes,11,rep,name=error_messages,json=errorMessages,proto3" json:"error_messages,omitempty"`
+	// SuspiciousFlags contains any suspicious flags or indicators associated with the command.
+	SuspiciousFlags []string `protobuf:"bytes,12,rep,name=suspicious_flags,json=suspiciousFlags,proto3" json:"suspicious_flags,omitempty"`
+	// SensitiveItems contains any sensitive items accessed or modified by the command.
+	SensitiveItems []string `protobuf:"bytes,13,rep,name=sensitive_items,json=sensitiveItems,proto3" json:"sensitive_items,omitempty"`
+	// SuspiciousPatterns contains any suspicious patterns detected in relation to the command.
+	SuspiciousPatterns []string `protobuf:"bytes,14,rep,name=suspicious_patterns,json=suspiciousPatterns,proto3" json:"suspicious_patterns,omitempty"`
+	// IOCs contains any indicators of compromise associated with the command.
+	Iocs []string `protobuf:"bytes,15,rep,name=iocs,proto3" json:"iocs,omitempty"`
+	// MitreAttackIDs contains any MITRE ATT&CK IDs relevant to the command.
+	MitreAttackIds []string `protobuf:"bytes,16,rep,name=mitre_attack_ids,json=mitreAttackIds,proto3" json:"mitre_attack_ids,omitempty"`
+	// HasSensitiveData indicates whether the command involved access to or modification of sensitive data.
+	HasSensitiveData bool `protobuf:"varint,17,opt,name=has_sensitive_data,json=hasSensitiveData,proto3" json:"has_sensitive_data,omitempty"`
+	// PrivilegeEscalation indicates whether the command involved privilege escalation.
+	PrivilegeEscalation bool `protobuf:"varint,18,opt,name=privilege_escalation,json=privilegeEscalation,proto3" json:"privilege_escalation,omitempty"`
+	// DataExfiltration indicates whether the command involved data exfiltration.
+	DataExfiltration bool `protobuf:"varint,19,opt,name=data_exfiltration,json=dataExfiltration,proto3" json:"data_exfiltration,omitempty"`
+	// Persistence indicates whether the command involved persistence mechanisms.
+	Persistence bool `protobuf:"varint,20,opt,name=persistence,proto3" json:"persistence,omitempty"`
+	// StartOffset is the start time of the command, relative to the start of the session.
+	StartOffset *durationpb.Duration `protobuf:"bytes,21,opt,name=start_offset,json=startOffset,proto3" json:"start_offset,omitempty"`
+	// EndOffset is the end time of the command, relative to the start of the session.
+	EndOffset     *durationpb.Duration `protobuf:"bytes,22,opt,name=end_offset,json=endOffset,proto3" json:"end_offset,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CommandAnalysis) Reset() {
+	*x = CommandAnalysis{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CommandAnalysis) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CommandAnalysis) ProtoMessage() {}
+
+func (x *CommandAnalysis) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CommandAnalysis.ProtoReflect.Descriptor instead.
+func (*CommandAnalysis) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *CommandAnalysis) GetCommand() string {
+	if x != nil {
+		return x.Command
+	}
+	return ""
+}
+
+func (x *CommandAnalysis) GetCategory() CommandCategory {
+	if x != nil {
+		return x.Category
+	}
+	return CommandCategory_COMMAND_CATEGORY_UNSPECIFIED
+}
+
+func (x *CommandAnalysis) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *CommandAnalysis) GetRiskLevel() RiskLevel {
+	if x != nil {
+		return x.RiskLevel
+	}
+	return RiskLevel_RISK_LEVEL_UNSPECIFIED
+}
+
+func (x *CommandAnalysis) GetRiskScore() int32 {
+	if x != nil {
+		return x.RiskScore
+	}
+	return 0
+}
+
+func (x *CommandAnalysis) GetThreatCategory() ThreatCategory {
+	if x != nil {
+		return x.ThreatCategory
+	}
+	return ThreatCategory_THREAT_CATEGORY_UNSPECIFIED
+}
+
+func (x *CommandAnalysis) GetTimelineTitle() string {
+	if x != nil {
+		return x.TimelineTitle
+	}
+	return ""
+}
+
+func (x *CommandAnalysis) GetTimelineSubtitle() string {
+	if x != nil {
+		return x.TimelineSubtitle
+	}
+	return ""
+}
+
+func (x *CommandAnalysis) GetShortDescription() string {
+	if x != nil {
+		return x.ShortDescription
+	}
+	return ""
+}
+
+func (x *CommandAnalysis) GetDetailedDescription() string {
+	if x != nil {
+		return x.DetailedDescription
+	}
+	return ""
+}
+
+func (x *CommandAnalysis) GetErrorMessages() []string {
+	if x != nil {
+		return x.ErrorMessages
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetSuspiciousFlags() []string {
+	if x != nil {
+		return x.SuspiciousFlags
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetSensitiveItems() []string {
+	if x != nil {
+		return x.SensitiveItems
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetSuspiciousPatterns() []string {
+	if x != nil {
+		return x.SuspiciousPatterns
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetIocs() []string {
+	if x != nil {
+		return x.Iocs
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetMitreAttackIds() []string {
+	if x != nil {
+		return x.MitreAttackIds
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetHasSensitiveData() bool {
+	if x != nil {
+		return x.HasSensitiveData
+	}
+	return false
+}
+
+func (x *CommandAnalysis) GetPrivilegeEscalation() bool {
+	if x != nil {
+		return x.PrivilegeEscalation
+	}
+	return false
+}
+
+func (x *CommandAnalysis) GetDataExfiltration() bool {
+	if x != nil {
+		return x.DataExfiltration
+	}
+	return false
+}
+
+func (x *CommandAnalysis) GetPersistence() bool {
+	if x != nil {
+		return x.Persistence
+	}
+	return false
+}
+
+func (x *CommandAnalysis) GetStartOffset() *durationpb.Duration {
+	if x != nil {
+		return x.StartOffset
+	}
+	return nil
+}
+
+func (x *CommandAnalysis) GetEndOffset() *durationpb.Duration {
+	if x != nil {
+		return x.EndOffset
+	}
+	return nil
+}
+
+// SecurityRecommendation represents a security recommendation related to a command
+type SecurityRecommendation struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Title is a brief title for the security recommendation.
+	Title string `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
+	// Description is a detailed description of the security recommendation.
+	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	// Severity indicates the severity level of the recommendation.
+	Severity      RiskLevel `protobuf:"varint,3,opt,name=severity,proto3,enum=teleport.summarizer.v1.RiskLevel" json:"severity,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SecurityRecommendation) Reset() {
+	*x = SecurityRecommendation{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SecurityRecommendation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SecurityRecommendation) ProtoMessage() {}
+
+func (x *SecurityRecommendation) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SecurityRecommendation.ProtoReflect.Descriptor instead.
+func (*SecurityRecommendation) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *SecurityRecommendation) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *SecurityRecommendation) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *SecurityRecommendation) GetSeverity() RiskLevel {
+	if x != nil {
+		return x.Severity
+	}
+	return RiskLevel_RISK_LEVEL_UNSPECIFIED
+}
+
+// EnhancedSummary represents an enhanced summary of a session recording,
+// with structured data extracted from the session.
+type EnhancedSummary struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ShortDescription is a concise description of the session.
+	ShortDescription string `protobuf:"bytes,1,opt,name=short_description,json=shortDescription,proto3" json:"short_description,omitempty"`
+	// DetailedDescription is an in-depth explanation of the session.
+	DetailedDescription string `protobuf:"bytes,2,opt,name=detailed_description,json=detailedDescription,proto3" json:"detailed_description,omitempty"`
+	// RiskLevel is the overall risk level associated with the session.
+	RiskLevel RiskLevel `protobuf:"varint,3,opt,name=risk_level,json=riskLevel,proto3,enum=teleport.summarizer.v1.RiskLevel" json:"risk_level,omitempty"`
+	// SuspiciousActivities is a list of suspicious activities detected during the session.
+	SuspiciousActivities []string `protobuf:"bytes,4,rep,name=suspicious_activities,json=suspiciousActivities,proto3" json:"suspicious_activities,omitempty"`
+	// CompromiseIndicators indicates whether any indicators of compromise were detected during the session.
+	CompromiseIndicators bool `protobuf:"varint,5,opt,name=compromise_indicators,json=compromiseIndicators,proto3" json:"compromise_indicators,omitempty"`
+	// NotableCommandIndexes is a list of indexes of commands that are considered notable.
+	NotableCommandIndexes []int32 `protobuf:"varint,6,rep,packed,name=notable_command_indexes,json=notableCommandIndexes,proto3" json:"notable_command_indexes,omitempty"`
+	// Commands is a list of command summaries extracted from the session.
+	Commands      []*CommandAnalysis `protobuf:"bytes,7,rep,name=commands,proto3" json:"commands,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *EnhancedSummary) Reset() {
+	*x = EnhancedSummary{}
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *EnhancedSummary) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnhancedSummary) ProtoMessage() {}
+
+func (x *EnhancedSummary) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnhancedSummary.ProtoReflect.Descriptor instead.
+func (*EnhancedSummary) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *EnhancedSummary) GetShortDescription() string {
+	if x != nil {
+		return x.ShortDescription
+	}
+	return ""
+}
+
+func (x *EnhancedSummary) GetDetailedDescription() string {
+	if x != nil {
+		return x.DetailedDescription
+	}
+	return ""
+}
+
+func (x *EnhancedSummary) GetRiskLevel() RiskLevel {
+	if x != nil {
+		return x.RiskLevel
+	}
+	return RiskLevel_RISK_LEVEL_UNSPECIFIED
+}
+
+func (x *EnhancedSummary) GetSuspiciousActivities() []string {
+	if x != nil {
+		return x.SuspiciousActivities
+	}
+	return nil
+}
+
+func (x *EnhancedSummary) GetCompromiseIndicators() bool {
+	if x != nil {
+		return x.CompromiseIndicators
+	}
+	return false
+}
+
+func (x *EnhancedSummary) GetNotableCommandIndexes() []int32 {
+	if x != nil {
+		return x.NotableCommandIndexes
+	}
+	return nil
+}
+
+func (x *EnhancedSummary) GetCommands() []*CommandAnalysis {
+	if x != nil {
+		return x.Commands
+	}
+	return nil
+}
+
+var File_teleport_summarizer_v1_summarizer_proto protoreflect.FileDescriptor
+
+const file_teleport_summarizer_v1_summarizer_proto_rawDesc = "" +
+	"\n" +
+	"'teleport/summarizer/v1/summarizer.proto\x12\x16teleport.summarizer.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a!teleport/header/v1/metadata.proto\"\xd3\x01\n" +
+	"\x0eInferenceModel\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12>\n" +
+	"\x04spec\x18\x05 \x01(\v2*.teleport.summarizer.v1.InferenceModelSpecR\x04spec\"\xe0\x01\n" +
+	"\x12InferenceModelSpec\x12@\n" +
+	"\x06openai\x18\x01 \x01(\v2&.teleport.summarizer.v1.OpenAIProviderH\x00R\x06openai\x12C\n" +
+	"\abedrock\x18\x03 \x01(\v2'.teleport.summarizer.v1.BedrockProviderH\x00R\abedrock\x127\n" +
+	"\x18max_session_length_bytes\x18\x02 \x01(\x03R\x15maxSessionLengthBytesB\n" +
+	"\n" +
+	"\bprovider\"\xa2\x01\n" +
+	"\x0eOpenAIProvider\x12&\n" +
+	"\x0fopenai_model_id\x18\x01 \x01(\tR\ropenaiModelId\x12 \n" +
+	"\vtemperature\x18\x02 \x01(\x01R\vtemperature\x12+\n" +
+	"\x12api_key_secret_ref\x18\x03 \x01(\tR\x0fapiKeySecretRef\x12\x19\n" +
+	"\bbase_url\x18\x04 \x01(\tR\abaseUrl\"\x97\x01\n" +
+	"\x0fBedrockProvider\x12\x16\n" +
+	"\x06region\x18\x01 \x01(\tR\x06region\x12(\n" +
+	"\x10bedrock_model_id\x18\x02 \x01(\tR\x0ebedrockModelId\x12 \n" +
+	"\vtemperature\x18\x03 \x01(\x02R\vtemperature\x12 \n" +
+	"\vintegration\x18\x04 \x01(\tR\vintegration\"\xd5\x01\n" +
+	"\x0fInferenceSecret\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12?\n" +
+	"\x04spec\x18\x05 \x01(\v2+.teleport.summarizer.v1.InferenceSecretSpecR\x04spec\"+\n" +
+	"\x13InferenceSecretSpec\x12\x14\n" +
+	"\x05value\x18\x01 \x01(\tR\x05value\"\xd5\x01\n" +
+	"\x0fInferencePolicy\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12?\n" +
+	"\x04spec\x18\x05 \x01(\v2+.teleport.summarizer.v1.InferencePolicySpecR\x04spec\"Y\n" +
+	"\x13InferencePolicySpec\x12\x14\n" +
+	"\x05kinds\x18\x01 \x03(\tR\x05kinds\x12\x14\n" +
+	"\x05model\x18\x02 \x01(\tR\x05model\x12\x16\n" +
+	"\x06filter\x18\x03 \x01(\tR\x06filter\"\xf9\x03\n" +
+	"\aSummary\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x12:\n" +
+	"\x05state\x18\x02 \x01(\x0e2$.teleport.summarizer.v1.SummaryStateR\x05state\x12L\n" +
+	"\x14inference_started_at\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\x12inferenceStartedAt\x12N\n" +
+	"\x15inference_finished_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\x13inferenceFinishedAt\x12\x18\n" +
+	"\acontent\x18\x05 \x01(\tR\acontent\x12\x1d\n" +
+	"\n" +
+	"model_name\x18\x06 \x01(\tR\tmodelName\x12C\n" +
+	"\x11session_end_event\x18\a \x01(\v2\x17.google.protobuf.StructR\x0fsessionEndEvent\x12#\n" +
+	"\rerror_message\x18\b \x01(\tR\ferrorMessage\x12R\n" +
+	"\x10enhanced_summary\x18\t \x01(\v2'.teleport.summarizer.v1.EnhancedSummaryR\x0fenhancedSummary\"\x82\b\n" +
+	"\x0fCommandAnalysis\x12\x18\n" +
+	"\acommand\x18\x01 \x01(\tR\acommand\x12C\n" +
+	"\bcategory\x18\x02 \x01(\x0e2'.teleport.summarizer.v1.CommandCategoryR\bcategory\x12\x18\n" +
+	"\asuccess\x18\x03 \x01(\bR\asuccess\x12@\n" +
+	"\n" +
+	"risk_level\x18\x04 \x01(\x0e2!.teleport.summarizer.v1.RiskLevelR\triskLevel\x12\x1d\n" +
+	"\n" +
+	"risk_score\x18\x05 \x01(\x05R\triskScore\x12O\n" +
+	"\x0fthreat_category\x18\x06 \x01(\x0e2&.teleport.summarizer.v1.ThreatCategoryR\x0ethreatCategory\x12%\n" +
+	"\x0etimeline_title\x18\a \x01(\tR\rtimelineTitle\x12+\n" +
+	"\x11timeline_subtitle\x18\b \x01(\tR\x10timelineSubtitle\x12+\n" +
+	"\x11short_description\x18\t \x01(\tR\x10shortDescription\x121\n" +
+	"\x14detailed_description\x18\n" +
+	" \x01(\tR\x13detailedDescription\x12%\n" +
+	"\x0eerror_messages\x18\v \x03(\tR\rerrorMessages\x12)\n" +
+	"\x10suspicious_flags\x18\f \x03(\tR\x0fsuspiciousFlags\x12'\n" +
+	"\x0fsensitive_items\x18\r \x03(\tR\x0esensitiveItems\x12/\n" +
+	"\x13suspicious_patterns\x18\x0e \x03(\tR\x12suspiciousPatterns\x12\x12\n" +
+	"\x04iocs\x18\x0f \x03(\tR\x04iocs\x12(\n" +
+	"\x10mitre_attack_ids\x18\x10 \x03(\tR\x0emitreAttackIds\x12,\n" +
+	"\x12has_sensitive_data\x18\x11 \x01(\bR\x10hasSensitiveData\x121\n" +
+	"\x14privilege_escalation\x18\x12 \x01(\bR\x13privilegeEscalation\x12+\n" +
+	"\x11data_exfiltration\x18\x13 \x01(\bR\x10dataExfiltration\x12 \n" +
+	"\vpersistence\x18\x14 \x01(\bR\vpersistence\x12<\n" +
+	"\fstart_offset\x18\x15 \x01(\v2\x19.google.protobuf.DurationR\vstartOffset\x128\n" +
+	"\n" +
+	"end_offset\x18\x16 \x01(\v2\x19.google.protobuf.DurationR\tendOffset\"\x8f\x01\n" +
+	"\x16SecurityRecommendation\x12\x14\n" +
+	"\x05title\x18\x01 \x01(\tR\x05title\x12 \n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescription\x12=\n" +
+	"\bseverity\x18\x03 \x01(\x0e2!.teleport.summarizer.v1.RiskLevelR\bseverity\"\x9a\x03\n" +
+	"\x0fEnhancedSummary\x12+\n" +
+	"\x11short_description\x18\x01 \x01(\tR\x10shortDescription\x121\n" +
+	"\x14detailed_description\x18\x02 \x01(\tR\x13detailedDescription\x12@\n" +
+	"\n" +
+	"risk_level\x18\x03 \x01(\x0e2!.teleport.summarizer.v1.RiskLevelR\triskLevel\x123\n" +
+	"\x15suspicious_activities\x18\x04 \x03(\tR\x14suspiciousActivities\x123\n" +
+	"\x15compromise_indicators\x18\x05 \x01(\bR\x14compromiseIndicators\x126\n" +
+	"\x17notable_command_indexes\x18\x06 \x03(\x05R\x15notableCommandIndexes\x12C\n" +
+	"\bcommands\x18\a \x03(\v2'.teleport.summarizer.v1.CommandAnalysisR\bcommands*|\n" +
+	"\fSummaryState\x12\x1d\n" +
+	"\x19SUMMARY_STATE_UNSPECIFIED\x10\x00\x12\x19\n" +
+	"\x15SUMMARY_STATE_PENDING\x10\x01\x12\x19\n" +
+	"\x15SUMMARY_STATE_SUCCESS\x10\x02\x12\x17\n" +
+	"\x13SUMMARY_STATE_ERROR\x10\x03*\x9b\x02\n" +
+	"\x0fCommandCategory\x12 \n" +
+	"\x1cCOMMAND_CATEGORY_UNSPECIFIED\x10\x00\x12#\n" +
+	"\x1fCOMMAND_CATEGORY_FILE_OPERATION\x10\x01\x12\x1c\n" +
+	"\x18COMMAND_CATEGORY_NETWORK\x10\x02\x12\x1c\n" +
+	"\x18COMMAND_CATEGORY_PROCESS\x10\x03\x12\"\n" +
+	"\x1eCOMMAND_CATEGORY_SYSTEM_CONFIG\x10\x04\x12 \n" +
+	"\x1cCOMMAND_CATEGORY_DATA_ACCESS\x10\x05\x12#\n" +
+	"\x1fCOMMAND_CATEGORY_AUTHENTICATION\x10\x06\x12\x1a\n" +
+	"\x16COMMAND_CATEGORY_OTHER\x10\a*\x80\x01\n" +
+	"\tRiskLevel\x12\x1a\n" +
+	"\x16RISK_LEVEL_UNSPECIFIED\x10\x00\x12\x12\n" +
+	"\x0eRISK_LEVEL_LOW\x10\x01\x12\x15\n" +
+	"\x11RISK_LEVEL_MEDIUM\x10\x02\x12\x13\n" +
+	"\x0fRISK_LEVEL_HIGH\x10\x03\x12\x17\n" +
+	"\x13RISK_LEVEL_CRITICAL\x10\x04*\xc8\x03\n" +
+	"\x0eThreatCategory\x12\x1f\n" +
+	"\x1bTHREAT_CATEGORY_UNSPECIFIED\x10\x00\x12\"\n" +
+	"\x1eTHREAT_CATEGORY_RECONNAISSANCE\x10\x01\x12\x1d\n" +
+	"\x19THREAT_CATEGORY_EXECUTION\x10\x02\x12\x1f\n" +
+	"\x1bTHREAT_CATEGORY_PERSISTENCE\x10\x03\x12(\n" +
+	"$THREAT_CATEGORY_PRIVILEGE_ESCALATION\x10\x04\x12#\n" +
+	"\x1fTHREAT_CATEGORY_DEFENSE_EVASION\x10\x05\x12%\n" +
+	"!THREAT_CATEGORY_CREDENTIAL_ACCESS\x10\x06\x12\x1d\n" +
+	"\x19THREAT_CATEGORY_DISCOVERY\x10\a\x12$\n" +
+	" THREAT_CATEGORY_LATERAL_MOVEMENT\x10\b\x12\x1e\n" +
+	"\x1aTHREAT_CATEGORY_COLLECTION\x10\t\x12 \n" +
+	"\x1cTHREAT_CATEGORY_EXFILTRATION\x10\n" +
+	"\x12\x1a\n" +
+	"\x16THREAT_CATEGORY_IMPACT\x10\v\x12\x18\n" +
+	"\x14THREAT_CATEGORY_NONE\x10\fBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1;summarizerv1b\x06proto3"
+
+var (
+	file_teleport_summarizer_v1_summarizer_proto_rawDescOnce sync.Once
+	file_teleport_summarizer_v1_summarizer_proto_rawDescData []byte
+)
+
+func file_teleport_summarizer_v1_summarizer_proto_rawDescGZIP() []byte {
+	file_teleport_summarizer_v1_summarizer_proto_rawDescOnce.Do(func() {
+		file_teleport_summarizer_v1_summarizer_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_summarizer_v1_summarizer_proto_rawDesc), len(file_teleport_summarizer_v1_summarizer_proto_rawDesc)))
+	})
+	return file_teleport_summarizer_v1_summarizer_proto_rawDescData
+}
+
+var file_teleport_summarizer_v1_summarizer_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
+var file_teleport_summarizer_v1_summarizer_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_teleport_summarizer_v1_summarizer_proto_goTypes = []any{
+	(SummaryState)(0),              // 0: teleport.summarizer.v1.SummaryState
+	(CommandCategory)(0),           // 1: teleport.summarizer.v1.CommandCategory
+	(RiskLevel)(0),                 // 2: teleport.summarizer.v1.RiskLevel
+	(ThreatCategory)(0),            // 3: teleport.summarizer.v1.ThreatCategory
+	(*InferenceModel)(nil),         // 4: teleport.summarizer.v1.InferenceModel
+	(*InferenceModelSpec)(nil),     // 5: teleport.summarizer.v1.InferenceModelSpec
+	(*OpenAIProvider)(nil),         // 6: teleport.summarizer.v1.OpenAIProvider
+	(*BedrockProvider)(nil),        // 7: teleport.summarizer.v1.BedrockProvider
+	(*InferenceSecret)(nil),        // 8: teleport.summarizer.v1.InferenceSecret
+	(*InferenceSecretSpec)(nil),    // 9: teleport.summarizer.v1.InferenceSecretSpec
+	(*InferencePolicy)(nil),        // 10: teleport.summarizer.v1.InferencePolicy
+	(*InferencePolicySpec)(nil),    // 11: teleport.summarizer.v1.InferencePolicySpec
+	(*Summary)(nil),                // 12: teleport.summarizer.v1.Summary
+	(*CommandAnalysis)(nil),        // 13: teleport.summarizer.v1.CommandAnalysis
+	(*SecurityRecommendation)(nil), // 14: teleport.summarizer.v1.SecurityRecommendation
+	(*EnhancedSummary)(nil),        // 15: teleport.summarizer.v1.EnhancedSummary
+	(*v1.Metadata)(nil),            // 16: teleport.header.v1.Metadata
+	(*timestamppb.Timestamp)(nil),  // 17: google.protobuf.Timestamp
+	(*structpb.Struct)(nil),        // 18: google.protobuf.Struct
+	(*durationpb.Duration)(nil),    // 19: google.protobuf.Duration
+}
+var file_teleport_summarizer_v1_summarizer_proto_depIdxs = []int32{
+	16, // 0: teleport.summarizer.v1.InferenceModel.metadata:type_name -> teleport.header.v1.Metadata
+	5,  // 1: teleport.summarizer.v1.InferenceModel.spec:type_name -> teleport.summarizer.v1.InferenceModelSpec
+	6,  // 2: teleport.summarizer.v1.InferenceModelSpec.openai:type_name -> teleport.summarizer.v1.OpenAIProvider
+	7,  // 3: teleport.summarizer.v1.InferenceModelSpec.bedrock:type_name -> teleport.summarizer.v1.BedrockProvider
+	16, // 4: teleport.summarizer.v1.InferenceSecret.metadata:type_name -> teleport.header.v1.Metadata
+	9,  // 5: teleport.summarizer.v1.InferenceSecret.spec:type_name -> teleport.summarizer.v1.InferenceSecretSpec
+	16, // 6: teleport.summarizer.v1.InferencePolicy.metadata:type_name -> teleport.header.v1.Metadata
+	11, // 7: teleport.summarizer.v1.InferencePolicy.spec:type_name -> teleport.summarizer.v1.InferencePolicySpec
+	0,  // 8: teleport.summarizer.v1.Summary.state:type_name -> teleport.summarizer.v1.SummaryState
+	17, // 9: teleport.summarizer.v1.Summary.inference_started_at:type_name -> google.protobuf.Timestamp
+	17, // 10: teleport.summarizer.v1.Summary.inference_finished_at:type_name -> google.protobuf.Timestamp
+	18, // 11: teleport.summarizer.v1.Summary.session_end_event:type_name -> google.protobuf.Struct
+	15, // 12: teleport.summarizer.v1.Summary.enhanced_summary:type_name -> teleport.summarizer.v1.EnhancedSummary
+	1,  // 13: teleport.summarizer.v1.CommandAnalysis.category:type_name -> teleport.summarizer.v1.CommandCategory
+	2,  // 14: teleport.summarizer.v1.CommandAnalysis.risk_level:type_name -> teleport.summarizer.v1.RiskLevel
+	3,  // 15: teleport.summarizer.v1.CommandAnalysis.threat_category:type_name -> teleport.summarizer.v1.ThreatCategory
+	19, // 16: teleport.summarizer.v1.CommandAnalysis.start_offset:type_name -> google.protobuf.Duration
+	19, // 17: teleport.summarizer.v1.CommandAnalysis.end_offset:type_name -> google.protobuf.Duration
+	2,  // 18: teleport.summarizer.v1.SecurityRecommendation.severity:type_name -> teleport.summarizer.v1.RiskLevel
+	2,  // 19: teleport.summarizer.v1.EnhancedSummary.risk_level:type_name -> teleport.summarizer.v1.RiskLevel
+	13, // 20: teleport.summarizer.v1.EnhancedSummary.commands:type_name -> teleport.summarizer.v1.CommandAnalysis
+	21, // [21:21] is the sub-list for method output_type
+	21, // [21:21] is the sub-list for method input_type
+	21, // [21:21] is the sub-list for extension type_name
+	21, // [21:21] is the sub-list for extension extendee
+	0,  // [0:21] is the sub-list for field type_name
+}
+
+func init() { file_teleport_summarizer_v1_summarizer_proto_init() }
+func file_teleport_summarizer_v1_summarizer_proto_init() {
+	if File_teleport_summarizer_v1_summarizer_proto != nil {
+		return
+	}
+	file_teleport_summarizer_v1_summarizer_proto_msgTypes[1].OneofWrappers = []any{
+		(*InferenceModelSpec_Openai)(nil),
+		(*InferenceModelSpec_Bedrock)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_summarizer_v1_summarizer_proto_rawDesc), len(file_teleport_summarizer_v1_summarizer_proto_rawDesc)),
+			NumEnums:      4,
+			NumMessages:   12,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_summarizer_v1_summarizer_proto_goTypes,
+		DependencyIndexes: file_teleport_summarizer_v1_summarizer_proto_depIdxs,
+		EnumInfos:         file_teleport_summarizer_v1_summarizer_proto_enumTypes,
+		MessageInfos:      file_teleport_summarizer_v1_summarizer_proto_msgTypes,
+	}.Build()
+	File_teleport_summarizer_v1_summarizer_proto = out.File
+	file_teleport_summarizer_v1_summarizer_proto_goTypes = nil
+	file_teleport_summarizer_v1_summarizer_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/summarizer/v1/summarizer_service.pb.go b/api/gen/proto/go/teleport/summarizer/v1/summarizer_service.pb.go
new file mode 100644
index 0000000000000..c982978a0fd1d
--- /dev/null
+++ b/api/gen/proto/go/teleport/summarizer/v1/summarizer_service.pb.go
@@ -0,0 +1,2185 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/summarizer/v1/summarizer_service.proto
+
+package summarizerv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// CreateInferenceModelRequest is a request for creating an InferenceModel.
+type CreateInferenceModelRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// InferenceModel is the InferenceModel resource to create.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferenceModelRequest) Reset() {
+	*x = CreateInferenceModelRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferenceModelRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferenceModelRequest) ProtoMessage() {}
+
+func (x *CreateInferenceModelRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferenceModelRequest.ProtoReflect.Descriptor instead.
+func (*CreateInferenceModelRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateInferenceModelRequest) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// CreateInferenceModelResponse is a response to creating an InferenceModel.
+type CreateInferenceModelResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource that was created.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferenceModelResponse) Reset() {
+	*x = CreateInferenceModelResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferenceModelResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferenceModelResponse) ProtoMessage() {}
+
+func (x *CreateInferenceModelResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferenceModelResponse.ProtoReflect.Descriptor instead.
+func (*CreateInferenceModelResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateInferenceModelResponse) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// GetInferenceModelRequest is a request for retrieving an InferenceModel.
+type GetInferenceModelRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferenceModel to retrieve.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferenceModelRequest) Reset() {
+	*x = GetInferenceModelRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferenceModelRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferenceModelRequest) ProtoMessage() {}
+
+func (x *GetInferenceModelRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferenceModelRequest.ProtoReflect.Descriptor instead.
+func (*GetInferenceModelRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetInferenceModelRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetInferenceModelResponse is a response to retrieving an InferenceModel.
+type GetInferenceModelResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource that was retrieved.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferenceModelResponse) Reset() {
+	*x = GetInferenceModelResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferenceModelResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferenceModelResponse) ProtoMessage() {}
+
+func (x *GetInferenceModelResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferenceModelResponse.ProtoReflect.Descriptor instead.
+func (*GetInferenceModelResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetInferenceModelResponse) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// UpdateInferenceModelRequest is a request for updating an InferenceModel.
+type UpdateInferenceModelRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource to update.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferenceModelRequest) Reset() {
+	*x = UpdateInferenceModelRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferenceModelRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferenceModelRequest) ProtoMessage() {}
+
+func (x *UpdateInferenceModelRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferenceModelRequest.ProtoReflect.Descriptor instead.
+func (*UpdateInferenceModelRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *UpdateInferenceModelRequest) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// UpdateInferenceModelResponse is a response to updating an InferenceModel.
+type UpdateInferenceModelResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource that was updated.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferenceModelResponse) Reset() {
+	*x = UpdateInferenceModelResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferenceModelResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferenceModelResponse) ProtoMessage() {}
+
+func (x *UpdateInferenceModelResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferenceModelResponse.ProtoReflect.Descriptor instead.
+func (*UpdateInferenceModelResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpdateInferenceModelResponse) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// UpsertInferenceModelRequest is a request for creating or updating a
+// InferenceModel.
+type UpsertInferenceModelRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource to create or update.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferenceModelRequest) Reset() {
+	*x = UpsertInferenceModelRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferenceModelRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferenceModelRequest) ProtoMessage() {}
+
+func (x *UpsertInferenceModelRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferenceModelRequest.ProtoReflect.Descriptor instead.
+func (*UpsertInferenceModelRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpsertInferenceModelRequest) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// UpsertInferenceModelResponse is a response to creating or updating an
+// InferenceModel.
+type UpsertInferenceModelResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Model is the InferenceModel resource that was created or updated.
+	Model         *InferenceModel `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferenceModelResponse) Reset() {
+	*x = UpsertInferenceModelResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferenceModelResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferenceModelResponse) ProtoMessage() {}
+
+func (x *UpsertInferenceModelResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferenceModelResponse.ProtoReflect.Descriptor instead.
+func (*UpsertInferenceModelResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpsertInferenceModelResponse) GetModel() *InferenceModel {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// DeleteInferenceModelRequest is a request for deleting an InferenceModel.
+type DeleteInferenceModelRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferenceModel to delete.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferenceModelRequest) Reset() {
+	*x = DeleteInferenceModelRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferenceModelRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferenceModelRequest) ProtoMessage() {}
+
+func (x *DeleteInferenceModelRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferenceModelRequest.ProtoReflect.Descriptor instead.
+func (*DeleteInferenceModelRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *DeleteInferenceModelRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// DeleteInferenceModelResponse is a response to deleting an InferenceModel.
+type DeleteInferenceModelResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferenceModelResponse) Reset() {
+	*x = DeleteInferenceModelResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferenceModelResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferenceModelResponse) ProtoMessage() {}
+
+func (x *DeleteInferenceModelResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferenceModelResponse.ProtoReflect.Descriptor instead.
+func (*DeleteInferenceModelResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{9}
+}
+
+// ListInferenceModelsRequest is a request for listing InferenceModels.
+type ListInferenceModelsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PageSize is the maximum number of items to return. The server may use a
+	// different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// PageToken is the next_page_token value returned from a previous List
+	// request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferenceModelsRequest) Reset() {
+	*x = ListInferenceModelsRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferenceModelsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferenceModelsRequest) ProtoMessage() {}
+
+func (x *ListInferenceModelsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferenceModelsRequest.ProtoReflect.Descriptor instead.
+func (*ListInferenceModelsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ListInferenceModelsRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListInferenceModelsRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListInferenceModelsResponse is the response for listing InferenceModels.
+type ListInferenceModelsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Models is the page of InferenceModels that matched the request.
+	Models []*InferenceModel `protobuf:"bytes,1,rep,name=models,proto3" json:"models,omitempty"`
+	// NextPageToken is the token to retrieve the next page of results, or empty
+	// if there are no more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferenceModelsResponse) Reset() {
+	*x = ListInferenceModelsResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferenceModelsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferenceModelsResponse) ProtoMessage() {}
+
+func (x *ListInferenceModelsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferenceModelsResponse.ProtoReflect.Descriptor instead.
+func (*ListInferenceModelsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ListInferenceModelsResponse) GetModels() []*InferenceModel {
+	if x != nil {
+		return x.Models
+	}
+	return nil
+}
+
+func (x *ListInferenceModelsResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// CreateInferenceSecretRequest is a request for creating an InferenceSecret.
+type CreateInferenceSecretRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// InferenceSecret is the InferenceSecret resource
+	// to create.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferenceSecretRequest) Reset() {
+	*x = CreateInferenceSecretRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferenceSecretRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferenceSecretRequest) ProtoMessage() {}
+
+func (x *CreateInferenceSecretRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferenceSecretRequest.ProtoReflect.Descriptor instead.
+func (*CreateInferenceSecretRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *CreateInferenceSecretRequest) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// CreateInferenceSecretResponse is a response to creating an InferenceSecret.
+type CreateInferenceSecretResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource that was created.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferenceSecretResponse) Reset() {
+	*x = CreateInferenceSecretResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferenceSecretResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferenceSecretResponse) ProtoMessage() {}
+
+func (x *CreateInferenceSecretResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferenceSecretResponse.ProtoReflect.Descriptor instead.
+func (*CreateInferenceSecretResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *CreateInferenceSecretResponse) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// GetInferenceSecretRequest is a request for retrieving an InferenceSecret.
+type GetInferenceSecretRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferenceSecret to retrieve.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferenceSecretRequest) Reset() {
+	*x = GetInferenceSecretRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferenceSecretRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferenceSecretRequest) ProtoMessage() {}
+
+func (x *GetInferenceSecretRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferenceSecretRequest.ProtoReflect.Descriptor instead.
+func (*GetInferenceSecretRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *GetInferenceSecretRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetInferenceSecretResponse is a response to retrieving an InferenceSecret.
+type GetInferenceSecretResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource that was retrieved.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferenceSecretResponse) Reset() {
+	*x = GetInferenceSecretResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferenceSecretResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferenceSecretResponse) ProtoMessage() {}
+
+func (x *GetInferenceSecretResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferenceSecretResponse.ProtoReflect.Descriptor instead.
+func (*GetInferenceSecretResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *GetInferenceSecretResponse) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// UpdateInferenceSecretRequest is a request for updating an InferenceSecret.
+type UpdateInferenceSecretRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource to update.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferenceSecretRequest) Reset() {
+	*x = UpdateInferenceSecretRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferenceSecretRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferenceSecretRequest) ProtoMessage() {}
+
+func (x *UpdateInferenceSecretRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferenceSecretRequest.ProtoReflect.Descriptor instead.
+func (*UpdateInferenceSecretRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *UpdateInferenceSecretRequest) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// UpdateInferenceSecretResponse is a response to updating an InferenceSecret.
+type UpdateInferenceSecretResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource that was updated.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferenceSecretResponse) Reset() {
+	*x = UpdateInferenceSecretResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferenceSecretResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferenceSecretResponse) ProtoMessage() {}
+
+func (x *UpdateInferenceSecretResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferenceSecretResponse.ProtoReflect.Descriptor instead.
+func (*UpdateInferenceSecretResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *UpdateInferenceSecretResponse) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// UpsertInferenceSecretRequest is a request for creating or updating an
+// InferenceSecret.
+type UpsertInferenceSecretRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource to create or update.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferenceSecretRequest) Reset() {
+	*x = UpsertInferenceSecretRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferenceSecretRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferenceSecretRequest) ProtoMessage() {}
+
+func (x *UpsertInferenceSecretRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferenceSecretRequest.ProtoReflect.Descriptor instead.
+func (*UpsertInferenceSecretRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *UpsertInferenceSecretRequest) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// UpsertInferenceSecretResponse is a response to creating or updating an
+// InferenceSecret.
+type UpsertInferenceSecretResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secret is the InferenceSecret resource that was created or updated.
+	Secret        *InferenceSecret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferenceSecretResponse) Reset() {
+	*x = UpsertInferenceSecretResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferenceSecretResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferenceSecretResponse) ProtoMessage() {}
+
+func (x *UpsertInferenceSecretResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferenceSecretResponse.ProtoReflect.Descriptor instead.
+func (*UpsertInferenceSecretResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *UpsertInferenceSecretResponse) GetSecret() *InferenceSecret {
+	if x != nil {
+		return x.Secret
+	}
+	return nil
+}
+
+// DeleteInferenceSecretRequest is a request for deleting an InferenceSecret.
+type DeleteInferenceSecretRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferenceSecret to delete.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferenceSecretRequest) Reset() {
+	*x = DeleteInferenceSecretRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferenceSecretRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferenceSecretRequest) ProtoMessage() {}
+
+func (x *DeleteInferenceSecretRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferenceSecretRequest.ProtoReflect.Descriptor instead.
+func (*DeleteInferenceSecretRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *DeleteInferenceSecretRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// DeleteInferenceSecretResponse is a response to deleting an InferenceSecret.
+type DeleteInferenceSecretResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferenceSecretResponse) Reset() {
+	*x = DeleteInferenceSecretResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferenceSecretResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferenceSecretResponse) ProtoMessage() {}
+
+func (x *DeleteInferenceSecretResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[21]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferenceSecretResponse.ProtoReflect.Descriptor instead.
+func (*DeleteInferenceSecretResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{21}
+}
+
+// ListInferenceSecretsRequest is a request for listing InferenceSecrets.
+type ListInferenceSecretsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PageSize is the maximum number of items to return. The server may use a
+	// different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// PageToken is the next_page_token value returned from a previous List
+	// request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferenceSecretsRequest) Reset() {
+	*x = ListInferenceSecretsRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferenceSecretsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferenceSecretsRequest) ProtoMessage() {}
+
+func (x *ListInferenceSecretsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferenceSecretsRequest.ProtoReflect.Descriptor instead.
+func (*ListInferenceSecretsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *ListInferenceSecretsRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListInferenceSecretsRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListInferenceSecretsResponse is the response for listing InferenceSecrets.
+type ListInferenceSecretsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Secrets is the page of InferenceSecrets that matched the
+	// request.
+	Secrets []*InferenceSecret `protobuf:"bytes,1,rep,name=secrets,proto3" json:"secrets,omitempty"`
+	// NextPageToken is the token to retrieve the next page of results, or empty
+	// if there are no more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferenceSecretsResponse) Reset() {
+	*x = ListInferenceSecretsResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferenceSecretsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferenceSecretsResponse) ProtoMessage() {}
+
+func (x *ListInferenceSecretsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferenceSecretsResponse.ProtoReflect.Descriptor instead.
+func (*ListInferenceSecretsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *ListInferenceSecretsResponse) GetSecrets() []*InferenceSecret {
+	if x != nil {
+		return x.Secrets
+	}
+	return nil
+}
+
+func (x *ListInferenceSecretsResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// CreateInferencePolicyRequest is a request for creating an InferencePolicy.
+type CreateInferencePolicyRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// InferencePolicy is the InferencePolicy resource to create.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferencePolicyRequest) Reset() {
+	*x = CreateInferencePolicyRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferencePolicyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferencePolicyRequest) ProtoMessage() {}
+
+func (x *CreateInferencePolicyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferencePolicyRequest.ProtoReflect.Descriptor instead.
+func (*CreateInferencePolicyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *CreateInferencePolicyRequest) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// CreateInferencePolicyResponse is a response to creating an InferencePolicy.
+type CreateInferencePolicyResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource that was created.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateInferencePolicyResponse) Reset() {
+	*x = CreateInferencePolicyResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateInferencePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateInferencePolicyResponse) ProtoMessage() {}
+
+func (x *CreateInferencePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateInferencePolicyResponse.ProtoReflect.Descriptor instead.
+func (*CreateInferencePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *CreateInferencePolicyResponse) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// GetInferencePolicyRequest is a request for retrieving an InferencePolicy.
+type GetInferencePolicyRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferencePolicy to retrieve.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferencePolicyRequest) Reset() {
+	*x = GetInferencePolicyRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferencePolicyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferencePolicyRequest) ProtoMessage() {}
+
+func (x *GetInferencePolicyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferencePolicyRequest.ProtoReflect.Descriptor instead.
+func (*GetInferencePolicyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *GetInferencePolicyRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// GetInferencePolicyResponse is a response to retrieving an InferencePolicy.
+type GetInferencePolicyResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource that was retrieved.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetInferencePolicyResponse) Reset() {
+	*x = GetInferencePolicyResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetInferencePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetInferencePolicyResponse) ProtoMessage() {}
+
+func (x *GetInferencePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetInferencePolicyResponse.ProtoReflect.Descriptor instead.
+func (*GetInferencePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *GetInferencePolicyResponse) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// UpdateInferencePolicyRequest is a request for updating an InferencePolicy.
+type UpdateInferencePolicyRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource to update.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferencePolicyRequest) Reset() {
+	*x = UpdateInferencePolicyRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferencePolicyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferencePolicyRequest) ProtoMessage() {}
+
+func (x *UpdateInferencePolicyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferencePolicyRequest.ProtoReflect.Descriptor instead.
+func (*UpdateInferencePolicyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *UpdateInferencePolicyRequest) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// UpdateInferencePolicyResponse is a response to updating an InferencePolicy.
+type UpdateInferencePolicyResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource that was updated.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateInferencePolicyResponse) Reset() {
+	*x = UpdateInferencePolicyResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateInferencePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateInferencePolicyResponse) ProtoMessage() {}
+
+func (x *UpdateInferencePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateInferencePolicyResponse.ProtoReflect.Descriptor instead.
+func (*UpdateInferencePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *UpdateInferencePolicyResponse) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// UpsertInferencePolicyRequest is a request for creating or updating an
+// InferencePolicy.
+type UpsertInferencePolicyRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource to create or update.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferencePolicyRequest) Reset() {
+	*x = UpsertInferencePolicyRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferencePolicyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferencePolicyRequest) ProtoMessage() {}
+
+func (x *UpsertInferencePolicyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferencePolicyRequest.ProtoReflect.Descriptor instead.
+func (*UpsertInferencePolicyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *UpsertInferencePolicyRequest) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// UpsertInferencePolicyResponse is a response to creating or updating an
+// InferencePolicy.
+type UpsertInferencePolicyResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policy is the InferencePolicy resource that was created or updated.
+	Policy        *InferencePolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertInferencePolicyResponse) Reset() {
+	*x = UpsertInferencePolicyResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertInferencePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertInferencePolicyResponse) ProtoMessage() {}
+
+func (x *UpsertInferencePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertInferencePolicyResponse.ProtoReflect.Descriptor instead.
+func (*UpsertInferencePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *UpsertInferencePolicyResponse) GetPolicy() *InferencePolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+// DeleteInferencePolicyRequest is a request for deleting an InferencePolicy.
+type DeleteInferencePolicyRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name is the resource name of the InferencePolicy to delete.
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferencePolicyRequest) Reset() {
+	*x = DeleteInferencePolicyRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferencePolicyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferencePolicyRequest) ProtoMessage() {}
+
+func (x *DeleteInferencePolicyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferencePolicyRequest.ProtoReflect.Descriptor instead.
+func (*DeleteInferencePolicyRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *DeleteInferencePolicyRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// DeleteInferencePolicyResponse is a response to deleting an InferencePolicy.
+type DeleteInferencePolicyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteInferencePolicyResponse) Reset() {
+	*x = DeleteInferencePolicyResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteInferencePolicyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteInferencePolicyResponse) ProtoMessage() {}
+
+func (x *DeleteInferencePolicyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteInferencePolicyResponse.ProtoReflect.Descriptor instead.
+func (*DeleteInferencePolicyResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{33}
+}
+
+// ListInferencePoliciesRequest is a request for listing InferencePolicies.
+type ListInferencePoliciesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PageSize is the maximum number of items to return. The server may use a
+	// different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// PageToken is the next_page_token value returned from a previous List
+	// request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferencePoliciesRequest) Reset() {
+	*x = ListInferencePoliciesRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferencePoliciesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferencePoliciesRequest) ProtoMessage() {}
+
+func (x *ListInferencePoliciesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferencePoliciesRequest.ProtoReflect.Descriptor instead.
+func (*ListInferencePoliciesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *ListInferencePoliciesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListInferencePoliciesRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListInferencePoliciesResponse is the response for listing InferencePolicies.
+type ListInferencePoliciesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Policies is the page of InferencePolicies that matched the
+	// request.
+	Policies []*InferencePolicy `protobuf:"bytes,1,rep,name=policies,proto3" json:"policies,omitempty"`
+	// NextPageToken is the token to retrieve the next page of results, or empty
+	// if there are no more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListInferencePoliciesResponse) Reset() {
+	*x = ListInferencePoliciesResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListInferencePoliciesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListInferencePoliciesResponse) ProtoMessage() {}
+
+func (x *ListInferencePoliciesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListInferencePoliciesResponse.ProtoReflect.Descriptor instead.
+func (*ListInferencePoliciesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *ListInferencePoliciesResponse) GetPolicies() []*InferencePolicy {
+	if x != nil {
+		return x.Policies
+	}
+	return nil
+}
+
+func (x *ListInferencePoliciesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// GetSummaryRequest is a request for retrieving a session recording summary.
+type GetSummaryRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SessionId is the ID of the session whose summary is being requested.
+	SessionId     string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSummaryRequest) Reset() {
+	*x = GetSummaryRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSummaryRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSummaryRequest) ProtoMessage() {}
+
+func (x *GetSummaryRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[36]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSummaryRequest.ProtoReflect.Descriptor instead.
+func (*GetSummaryRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *GetSummaryRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+// GetSummaryResponse is a response to retrieving a session recording summary.
+type GetSummaryResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Summary is the session recording summary.
+	Summary       *Summary `protobuf:"bytes,1,opt,name=summary,proto3" json:"summary,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSummaryResponse) Reset() {
+	*x = GetSummaryResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSummaryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSummaryResponse) ProtoMessage() {}
+
+func (x *GetSummaryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSummaryResponse.ProtoReflect.Descriptor instead.
+func (*GetSummaryResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *GetSummaryResponse) GetSummary() *Summary {
+	if x != nil {
+		return x.Summary
+	}
+	return nil
+}
+
+// IsEnabledRequest is a request to tell if the summarizer is enabled.
+type IsEnabledRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IsEnabledRequest) Reset() {
+	*x = IsEnabledRequest{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IsEnabledRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IsEnabledRequest) ProtoMessage() {}
+
+func (x *IsEnabledRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[38]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IsEnabledRequest.ProtoReflect.Descriptor instead.
+func (*IsEnabledRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{38}
+}
+
+// IsEnabledResponse is a response that tells if the summarizer is enabled.
+type IsEnabledResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Enabled tells if the summarizer is enabled by the license and configured.
+	// (Note that this doesn't tell anything about actual correctness of the
+	// configuration or presence of recording summaries.)
+	Enabled       bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IsEnabledResponse) Reset() {
+	*x = IsEnabledResponse{}
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IsEnabledResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IsEnabledResponse) ProtoMessage() {}
+
+func (x *IsEnabledResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_summarizer_v1_summarizer_service_proto_msgTypes[39]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IsEnabledResponse.ProtoReflect.Descriptor instead.
+func (*IsEnabledResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *IsEnabledResponse) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+var File_teleport_summarizer_v1_summarizer_service_proto protoreflect.FileDescriptor
+
+const file_teleport_summarizer_v1_summarizer_service_proto_rawDesc = "" +
+	"\n" +
+	"/teleport/summarizer/v1/summarizer_service.proto\x12\x16teleport.summarizer.v1\x1a'teleport/summarizer/v1/summarizer.proto\"[\n" +
+	"\x1bCreateInferenceModelRequest\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"\\\n" +
+	"\x1cCreateInferenceModelResponse\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\".\n" +
+	"\x18GetInferenceModelRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"Y\n" +
+	"\x19GetInferenceModelResponse\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"[\n" +
+	"\x1bUpdateInferenceModelRequest\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"\\\n" +
+	"\x1cUpdateInferenceModelResponse\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"[\n" +
+	"\x1bUpsertInferenceModelRequest\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"\\\n" +
+	"\x1cUpsertInferenceModelResponse\x12<\n" +
+	"\x05model\x18\x01 \x01(\v2&.teleport.summarizer.v1.InferenceModelR\x05model\"1\n" +
+	"\x1bDeleteInferenceModelRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1e\n" +
+	"\x1cDeleteInferenceModelResponse\"X\n" +
+	"\x1aListInferenceModelsRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\x85\x01\n" +
+	"\x1bListInferenceModelsResponse\x12>\n" +
+	"\x06models\x18\x01 \x03(\v2&.teleport.summarizer.v1.InferenceModelR\x06models\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"_\n" +
+	"\x1cCreateInferenceSecretRequest\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"`\n" +
+	"\x1dCreateInferenceSecretResponse\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"/\n" +
+	"\x19GetInferenceSecretRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"]\n" +
+	"\x1aGetInferenceSecretResponse\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"_\n" +
+	"\x1cUpdateInferenceSecretRequest\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"`\n" +
+	"\x1dUpdateInferenceSecretResponse\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"_\n" +
+	"\x1cUpsertInferenceSecretRequest\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"`\n" +
+	"\x1dUpsertInferenceSecretResponse\x12?\n" +
+	"\x06secret\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferenceSecretR\x06secret\"2\n" +
+	"\x1cDeleteInferenceSecretRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1f\n" +
+	"\x1dDeleteInferenceSecretResponse\"Y\n" +
+	"\x1bListInferenceSecretsRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\x89\x01\n" +
+	"\x1cListInferenceSecretsResponse\x12A\n" +
+	"\asecrets\x18\x01 \x03(\v2'.teleport.summarizer.v1.InferenceSecretR\asecrets\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"_\n" +
+	"\x1cCreateInferencePolicyRequest\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"`\n" +
+	"\x1dCreateInferencePolicyResponse\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"/\n" +
+	"\x19GetInferencePolicyRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"]\n" +
+	"\x1aGetInferencePolicyResponse\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"_\n" +
+	"\x1cUpdateInferencePolicyRequest\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"`\n" +
+	"\x1dUpdateInferencePolicyResponse\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"_\n" +
+	"\x1cUpsertInferencePolicyRequest\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"`\n" +
+	"\x1dUpsertInferencePolicyResponse\x12?\n" +
+	"\x06policy\x18\x01 \x01(\v2'.teleport.summarizer.v1.InferencePolicyR\x06policy\"2\n" +
+	"\x1cDeleteInferencePolicyRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1f\n" +
+	"\x1dDeleteInferencePolicyResponse\"Z\n" +
+	"\x1cListInferencePoliciesRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\x8c\x01\n" +
+	"\x1dListInferencePoliciesResponse\x12C\n" +
+	"\bpolicies\x18\x01 \x03(\v2'.teleport.summarizer.v1.InferencePolicyR\bpolicies\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"2\n" +
+	"\x11GetSummaryRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\"O\n" +
+	"\x12GetSummaryResponse\x129\n" +
+	"\asummary\x18\x01 \x01(\v2\x1f.teleport.summarizer.v1.SummaryR\asummary\"\x12\n" +
+	"\x10IsEnabledRequest\"-\n" +
+	"\x11IsEnabledResponse\x12\x18\n" +
+	"\aenabled\x18\x01 \x01(\bR\aenabled2\xa1\x14\n" +
+	"\x11SummarizerService\x12\x81\x01\n" +
+	"\x14CreateInferenceModel\x123.teleport.summarizer.v1.CreateInferenceModelRequest\x1a4.teleport.summarizer.v1.CreateInferenceModelResponse\x12x\n" +
+	"\x11GetInferenceModel\x120.teleport.summarizer.v1.GetInferenceModelRequest\x1a1.teleport.summarizer.v1.GetInferenceModelResponse\x12\x81\x01\n" +
+	"\x14UpdateInferenceModel\x123.teleport.summarizer.v1.UpdateInferenceModelRequest\x1a4.teleport.summarizer.v1.UpdateInferenceModelResponse\x12\x81\x01\n" +
+	"\x14UpsertInferenceModel\x123.teleport.summarizer.v1.UpsertInferenceModelRequest\x1a4.teleport.summarizer.v1.UpsertInferenceModelResponse\x12\x81\x01\n" +
+	"\x14DeleteInferenceModel\x123.teleport.summarizer.v1.DeleteInferenceModelRequest\x1a4.teleport.summarizer.v1.DeleteInferenceModelResponse\x12~\n" +
+	"\x13ListInferenceModels\x122.teleport.summarizer.v1.ListInferenceModelsRequest\x1a3.teleport.summarizer.v1.ListInferenceModelsResponse\x12\x84\x01\n" +
+	"\x15CreateInferenceSecret\x124.teleport.summarizer.v1.CreateInferenceSecretRequest\x1a5.teleport.summarizer.v1.CreateInferenceSecretResponse\x12{\n" +
+	"\x12GetInferenceSecret\x121.teleport.summarizer.v1.GetInferenceSecretRequest\x1a2.teleport.summarizer.v1.GetInferenceSecretResponse\x12\x84\x01\n" +
+	"\x15UpdateInferenceSecret\x124.teleport.summarizer.v1.UpdateInferenceSecretRequest\x1a5.teleport.summarizer.v1.UpdateInferenceSecretResponse\x12\x84\x01\n" +
+	"\x15UpsertInferenceSecret\x124.teleport.summarizer.v1.UpsertInferenceSecretRequest\x1a5.teleport.summarizer.v1.UpsertInferenceSecretResponse\x12\x84\x01\n" +
+	"\x15DeleteInferenceSecret\x124.teleport.summarizer.v1.DeleteInferenceSecretRequest\x1a5.teleport.summarizer.v1.DeleteInferenceSecretResponse\x12\x81\x01\n" +
+	"\x14ListInferenceSecrets\x123.teleport.summarizer.v1.ListInferenceSecretsRequest\x1a4.teleport.summarizer.v1.ListInferenceSecretsResponse\x12\x84\x01\n" +
+	"\x15CreateInferencePolicy\x124.teleport.summarizer.v1.CreateInferencePolicyRequest\x1a5.teleport.summarizer.v1.CreateInferencePolicyResponse\x12{\n" +
+	"\x12GetInferencePolicy\x121.teleport.summarizer.v1.GetInferencePolicyRequest\x1a2.teleport.summarizer.v1.GetInferencePolicyResponse\x12\x84\x01\n" +
+	"\x15UpdateInferencePolicy\x124.teleport.summarizer.v1.UpdateInferencePolicyRequest\x1a5.teleport.summarizer.v1.UpdateInferencePolicyResponse\x12\x84\x01\n" +
+	"\x15UpsertInferencePolicy\x124.teleport.summarizer.v1.UpsertInferencePolicyRequest\x1a5.teleport.summarizer.v1.UpsertInferencePolicyResponse\x12\x84\x01\n" +
+	"\x15DeleteInferencePolicy\x124.teleport.summarizer.v1.DeleteInferencePolicyRequest\x1a5.teleport.summarizer.v1.DeleteInferencePolicyResponse\x12\x84\x01\n" +
+	"\x15ListInferencePolicies\x124.teleport.summarizer.v1.ListInferencePoliciesRequest\x1a5.teleport.summarizer.v1.ListInferencePoliciesResponse\x12c\n" +
+	"\n" +
+	"GetSummary\x12).teleport.summarizer.v1.GetSummaryRequest\x1a*.teleport.summarizer.v1.GetSummaryResponse\x12`\n" +
+	"\tIsEnabled\x12(.teleport.summarizer.v1.IsEnabledRequest\x1a).teleport.summarizer.v1.IsEnabledResponseBXZVgithub.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1;summarizerv1b\x06proto3"
+
+var (
+	file_teleport_summarizer_v1_summarizer_service_proto_rawDescOnce sync.Once
+	file_teleport_summarizer_v1_summarizer_service_proto_rawDescData []byte
+)
+
+func file_teleport_summarizer_v1_summarizer_service_proto_rawDescGZIP() []byte {
+	file_teleport_summarizer_v1_summarizer_service_proto_rawDescOnce.Do(func() {
+		file_teleport_summarizer_v1_summarizer_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_summarizer_v1_summarizer_service_proto_rawDesc), len(file_teleport_summarizer_v1_summarizer_service_proto_rawDesc)))
+	})
+	return file_teleport_summarizer_v1_summarizer_service_proto_rawDescData
+}
+
+var file_teleport_summarizer_v1_summarizer_service_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
+var file_teleport_summarizer_v1_summarizer_service_proto_goTypes = []any{
+	(*CreateInferenceModelRequest)(nil),   // 0: teleport.summarizer.v1.CreateInferenceModelRequest
+	(*CreateInferenceModelResponse)(nil),  // 1: teleport.summarizer.v1.CreateInferenceModelResponse
+	(*GetInferenceModelRequest)(nil),      // 2: teleport.summarizer.v1.GetInferenceModelRequest
+	(*GetInferenceModelResponse)(nil),     // 3: teleport.summarizer.v1.GetInferenceModelResponse
+	(*UpdateInferenceModelRequest)(nil),   // 4: teleport.summarizer.v1.UpdateInferenceModelRequest
+	(*UpdateInferenceModelResponse)(nil),  // 5: teleport.summarizer.v1.UpdateInferenceModelResponse
+	(*UpsertInferenceModelRequest)(nil),   // 6: teleport.summarizer.v1.UpsertInferenceModelRequest
+	(*UpsertInferenceModelResponse)(nil),  // 7: teleport.summarizer.v1.UpsertInferenceModelResponse
+	(*DeleteInferenceModelRequest)(nil),   // 8: teleport.summarizer.v1.DeleteInferenceModelRequest
+	(*DeleteInferenceModelResponse)(nil),  // 9: teleport.summarizer.v1.DeleteInferenceModelResponse
+	(*ListInferenceModelsRequest)(nil),    // 10: teleport.summarizer.v1.ListInferenceModelsRequest
+	(*ListInferenceModelsResponse)(nil),   // 11: teleport.summarizer.v1.ListInferenceModelsResponse
+	(*CreateInferenceSecretRequest)(nil),  // 12: teleport.summarizer.v1.CreateInferenceSecretRequest
+	(*CreateInferenceSecretResponse)(nil), // 13: teleport.summarizer.v1.CreateInferenceSecretResponse
+	(*GetInferenceSecretRequest)(nil),     // 14: teleport.summarizer.v1.GetInferenceSecretRequest
+	(*GetInferenceSecretResponse)(nil),    // 15: teleport.summarizer.v1.GetInferenceSecretResponse
+	(*UpdateInferenceSecretRequest)(nil),  // 16: teleport.summarizer.v1.UpdateInferenceSecretRequest
+	(*UpdateInferenceSecretResponse)(nil), // 17: teleport.summarizer.v1.UpdateInferenceSecretResponse
+	(*UpsertInferenceSecretRequest)(nil),  // 18: teleport.summarizer.v1.UpsertInferenceSecretRequest
+	(*UpsertInferenceSecretResponse)(nil), // 19: teleport.summarizer.v1.UpsertInferenceSecretResponse
+	(*DeleteInferenceSecretRequest)(nil),  // 20: teleport.summarizer.v1.DeleteInferenceSecretRequest
+	(*DeleteInferenceSecretResponse)(nil), // 21: teleport.summarizer.v1.DeleteInferenceSecretResponse
+	(*ListInferenceSecretsRequest)(nil),   // 22: teleport.summarizer.v1.ListInferenceSecretsRequest
+	(*ListInferenceSecretsResponse)(nil),  // 23: teleport.summarizer.v1.ListInferenceSecretsResponse
+	(*CreateInferencePolicyRequest)(nil),  // 24: teleport.summarizer.v1.CreateInferencePolicyRequest
+	(*CreateInferencePolicyResponse)(nil), // 25: teleport.summarizer.v1.CreateInferencePolicyResponse
+	(*GetInferencePolicyRequest)(nil),     // 26: teleport.summarizer.v1.GetInferencePolicyRequest
+	(*GetInferencePolicyResponse)(nil),    // 27: teleport.summarizer.v1.GetInferencePolicyResponse
+	(*UpdateInferencePolicyRequest)(nil),  // 28: teleport.summarizer.v1.UpdateInferencePolicyRequest
+	(*UpdateInferencePolicyResponse)(nil), // 29: teleport.summarizer.v1.UpdateInferencePolicyResponse
+	(*UpsertInferencePolicyRequest)(nil),  // 30: teleport.summarizer.v1.UpsertInferencePolicyRequest
+	(*UpsertInferencePolicyResponse)(nil), // 31: teleport.summarizer.v1.UpsertInferencePolicyResponse
+	(*DeleteInferencePolicyRequest)(nil),  // 32: teleport.summarizer.v1.DeleteInferencePolicyRequest
+	(*DeleteInferencePolicyResponse)(nil), // 33: teleport.summarizer.v1.DeleteInferencePolicyResponse
+	(*ListInferencePoliciesRequest)(nil),  // 34: teleport.summarizer.v1.ListInferencePoliciesRequest
+	(*ListInferencePoliciesResponse)(nil), // 35: teleport.summarizer.v1.ListInferencePoliciesResponse
+	(*GetSummaryRequest)(nil),             // 36: teleport.summarizer.v1.GetSummaryRequest
+	(*GetSummaryResponse)(nil),            // 37: teleport.summarizer.v1.GetSummaryResponse
+	(*IsEnabledRequest)(nil),              // 38: teleport.summarizer.v1.IsEnabledRequest
+	(*IsEnabledResponse)(nil),             // 39: teleport.summarizer.v1.IsEnabledResponse
+	(*InferenceModel)(nil),                // 40: teleport.summarizer.v1.InferenceModel
+	(*InferenceSecret)(nil),               // 41: teleport.summarizer.v1.InferenceSecret
+	(*InferencePolicy)(nil),               // 42: teleport.summarizer.v1.InferencePolicy
+	(*Summary)(nil),                       // 43: teleport.summarizer.v1.Summary
+}
+var file_teleport_summarizer_v1_summarizer_service_proto_depIdxs = []int32{
+	40, // 0: teleport.summarizer.v1.CreateInferenceModelRequest.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 1: teleport.summarizer.v1.CreateInferenceModelResponse.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 2: teleport.summarizer.v1.GetInferenceModelResponse.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 3: teleport.summarizer.v1.UpdateInferenceModelRequest.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 4: teleport.summarizer.v1.UpdateInferenceModelResponse.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 5: teleport.summarizer.v1.UpsertInferenceModelRequest.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 6: teleport.summarizer.v1.UpsertInferenceModelResponse.model:type_name -> teleport.summarizer.v1.InferenceModel
+	40, // 7: teleport.summarizer.v1.ListInferenceModelsResponse.models:type_name -> teleport.summarizer.v1.InferenceModel
+	41, // 8: teleport.summarizer.v1.CreateInferenceSecretRequest.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 9: teleport.summarizer.v1.CreateInferenceSecretResponse.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 10: teleport.summarizer.v1.GetInferenceSecretResponse.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 11: teleport.summarizer.v1.UpdateInferenceSecretRequest.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 12: teleport.summarizer.v1.UpdateInferenceSecretResponse.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 13: teleport.summarizer.v1.UpsertInferenceSecretRequest.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 14: teleport.summarizer.v1.UpsertInferenceSecretResponse.secret:type_name -> teleport.summarizer.v1.InferenceSecret
+	41, // 15: teleport.summarizer.v1.ListInferenceSecretsResponse.secrets:type_name -> teleport.summarizer.v1.InferenceSecret
+	42, // 16: teleport.summarizer.v1.CreateInferencePolicyRequest.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 17: teleport.summarizer.v1.CreateInferencePolicyResponse.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 18: teleport.summarizer.v1.GetInferencePolicyResponse.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 19: teleport.summarizer.v1.UpdateInferencePolicyRequest.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 20: teleport.summarizer.v1.UpdateInferencePolicyResponse.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 21: teleport.summarizer.v1.UpsertInferencePolicyRequest.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 22: teleport.summarizer.v1.UpsertInferencePolicyResponse.policy:type_name -> teleport.summarizer.v1.InferencePolicy
+	42, // 23: teleport.summarizer.v1.ListInferencePoliciesResponse.policies:type_name -> teleport.summarizer.v1.InferencePolicy
+	43, // 24: teleport.summarizer.v1.GetSummaryResponse.summary:type_name -> teleport.summarizer.v1.Summary
+	0,  // 25: teleport.summarizer.v1.SummarizerService.CreateInferenceModel:input_type -> teleport.summarizer.v1.CreateInferenceModelRequest
+	2,  // 26: teleport.summarizer.v1.SummarizerService.GetInferenceModel:input_type -> teleport.summarizer.v1.GetInferenceModelRequest
+	4,  // 27: teleport.summarizer.v1.SummarizerService.UpdateInferenceModel:input_type -> teleport.summarizer.v1.UpdateInferenceModelRequest
+	6,  // 28: teleport.summarizer.v1.SummarizerService.UpsertInferenceModel:input_type -> teleport.summarizer.v1.UpsertInferenceModelRequest
+	8,  // 29: teleport.summarizer.v1.SummarizerService.DeleteInferenceModel:input_type -> teleport.summarizer.v1.DeleteInferenceModelRequest
+	10, // 30: teleport.summarizer.v1.SummarizerService.ListInferenceModels:input_type -> teleport.summarizer.v1.ListInferenceModelsRequest
+	12, // 31: teleport.summarizer.v1.SummarizerService.CreateInferenceSecret:input_type -> teleport.summarizer.v1.CreateInferenceSecretRequest
+	14, // 32: teleport.summarizer.v1.SummarizerService.GetInferenceSecret:input_type -> teleport.summarizer.v1.GetInferenceSecretRequest
+	16, // 33: teleport.summarizer.v1.SummarizerService.UpdateInferenceSecret:input_type -> teleport.summarizer.v1.UpdateInferenceSecretRequest
+	18, // 34: teleport.summarizer.v1.SummarizerService.UpsertInferenceSecret:input_type -> teleport.summarizer.v1.UpsertInferenceSecretRequest
+	20, // 35: teleport.summarizer.v1.SummarizerService.DeleteInferenceSecret:input_type -> teleport.summarizer.v1.DeleteInferenceSecretRequest
+	22, // 36: teleport.summarizer.v1.SummarizerService.ListInferenceSecrets:input_type -> teleport.summarizer.v1.ListInferenceSecretsRequest
+	24, // 37: teleport.summarizer.v1.SummarizerService.CreateInferencePolicy:input_type -> teleport.summarizer.v1.CreateInferencePolicyRequest
+	26, // 38: teleport.summarizer.v1.SummarizerService.GetInferencePolicy:input_type -> teleport.summarizer.v1.GetInferencePolicyRequest
+	28, // 39: teleport.summarizer.v1.SummarizerService.UpdateInferencePolicy:input_type -> teleport.summarizer.v1.UpdateInferencePolicyRequest
+	30, // 40: teleport.summarizer.v1.SummarizerService.UpsertInferencePolicy:input_type -> teleport.summarizer.v1.UpsertInferencePolicyRequest
+	32, // 41: teleport.summarizer.v1.SummarizerService.DeleteInferencePolicy:input_type -> teleport.summarizer.v1.DeleteInferencePolicyRequest
+	34, // 42: teleport.summarizer.v1.SummarizerService.ListInferencePolicies:input_type -> teleport.summarizer.v1.ListInferencePoliciesRequest
+	36, // 43: teleport.summarizer.v1.SummarizerService.GetSummary:input_type -> teleport.summarizer.v1.GetSummaryRequest
+	38, // 44: teleport.summarizer.v1.SummarizerService.IsEnabled:input_type -> teleport.summarizer.v1.IsEnabledRequest
+	1,  // 45: teleport.summarizer.v1.SummarizerService.CreateInferenceModel:output_type -> teleport.summarizer.v1.CreateInferenceModelResponse
+	3,  // 46: teleport.summarizer.v1.SummarizerService.GetInferenceModel:output_type -> teleport.summarizer.v1.GetInferenceModelResponse
+	5,  // 47: teleport.summarizer.v1.SummarizerService.UpdateInferenceModel:output_type -> teleport.summarizer.v1.UpdateInferenceModelResponse
+	7,  // 48: teleport.summarizer.v1.SummarizerService.UpsertInferenceModel:output_type -> teleport.summarizer.v1.UpsertInferenceModelResponse
+	9,  // 49: teleport.summarizer.v1.SummarizerService.DeleteInferenceModel:output_type -> teleport.summarizer.v1.DeleteInferenceModelResponse
+	11, // 50: teleport.summarizer.v1.SummarizerService.ListInferenceModels:output_type -> teleport.summarizer.v1.ListInferenceModelsResponse
+	13, // 51: teleport.summarizer.v1.SummarizerService.CreateInferenceSecret:output_type -> teleport.summarizer.v1.CreateInferenceSecretResponse
+	15, // 52: teleport.summarizer.v1.SummarizerService.GetInferenceSecret:output_type -> teleport.summarizer.v1.GetInferenceSecretResponse
+	17, // 53: teleport.summarizer.v1.SummarizerService.UpdateInferenceSecret:output_type -> teleport.summarizer.v1.UpdateInferenceSecretResponse
+	19, // 54: teleport.summarizer.v1.SummarizerService.UpsertInferenceSecret:output_type -> teleport.summarizer.v1.UpsertInferenceSecretResponse
+	21, // 55: teleport.summarizer.v1.SummarizerService.DeleteInferenceSecret:output_type -> teleport.summarizer.v1.DeleteInferenceSecretResponse
+	23, // 56: teleport.summarizer.v1.SummarizerService.ListInferenceSecrets:output_type -> teleport.summarizer.v1.ListInferenceSecretsResponse
+	25, // 57: teleport.summarizer.v1.SummarizerService.CreateInferencePolicy:output_type -> teleport.summarizer.v1.CreateInferencePolicyResponse
+	27, // 58: teleport.summarizer.v1.SummarizerService.GetInferencePolicy:output_type -> teleport.summarizer.v1.GetInferencePolicyResponse
+	29, // 59: teleport.summarizer.v1.SummarizerService.UpdateInferencePolicy:output_type -> teleport.summarizer.v1.UpdateInferencePolicyResponse
+	31, // 60: teleport.summarizer.v1.SummarizerService.UpsertInferencePolicy:output_type -> teleport.summarizer.v1.UpsertInferencePolicyResponse
+	33, // 61: teleport.summarizer.v1.SummarizerService.DeleteInferencePolicy:output_type -> teleport.summarizer.v1.DeleteInferencePolicyResponse
+	35, // 62: teleport.summarizer.v1.SummarizerService.ListInferencePolicies:output_type -> teleport.summarizer.v1.ListInferencePoliciesResponse
+	37, // 63: teleport.summarizer.v1.SummarizerService.GetSummary:output_type -> teleport.summarizer.v1.GetSummaryResponse
+	39, // 64: teleport.summarizer.v1.SummarizerService.IsEnabled:output_type -> teleport.summarizer.v1.IsEnabledResponse
+	45, // [45:65] is the sub-list for method output_type
+	25, // [25:45] is the sub-list for method input_type
+	25, // [25:25] is the sub-list for extension type_name
+	25, // [25:25] is the sub-list for extension extendee
+	0,  // [0:25] is the sub-list for field type_name
+}
+
+func init() { file_teleport_summarizer_v1_summarizer_service_proto_init() }
+func file_teleport_summarizer_v1_summarizer_service_proto_init() {
+	if File_teleport_summarizer_v1_summarizer_service_proto != nil {
+		return
+	}
+	file_teleport_summarizer_v1_summarizer_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_summarizer_v1_summarizer_service_proto_rawDesc), len(file_teleport_summarizer_v1_summarizer_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   40,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_summarizer_v1_summarizer_service_proto_goTypes,
+		DependencyIndexes: file_teleport_summarizer_v1_summarizer_service_proto_depIdxs,
+		MessageInfos:      file_teleport_summarizer_v1_summarizer_service_proto_msgTypes,
+	}.Build()
+	File_teleport_summarizer_v1_summarizer_service_proto = out.File
+	file_teleport_summarizer_v1_summarizer_service_proto_goTypes = nil
+	file_teleport_summarizer_v1_summarizer_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/summarizer/v1/summarizer_service_grpc.pb.go b/api/gen/proto/go/teleport/summarizer/v1/summarizer_service_grpc.pb.go
new file mode 100644
index 0000000000000..9077f15e439ed
--- /dev/null
+++ b/api/gen/proto/go/teleport/summarizer/v1/summarizer_service_grpc.pb.go
@@ -0,0 +1,917 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/summarizer/v1/summarizer_service.proto
+
+package summarizerv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	SummarizerService_CreateInferenceModel_FullMethodName  = "/teleport.summarizer.v1.SummarizerService/CreateInferenceModel"
+	SummarizerService_GetInferenceModel_FullMethodName     = "/teleport.summarizer.v1.SummarizerService/GetInferenceModel"
+	SummarizerService_UpdateInferenceModel_FullMethodName  = "/teleport.summarizer.v1.SummarizerService/UpdateInferenceModel"
+	SummarizerService_UpsertInferenceModel_FullMethodName  = "/teleport.summarizer.v1.SummarizerService/UpsertInferenceModel"
+	SummarizerService_DeleteInferenceModel_FullMethodName  = "/teleport.summarizer.v1.SummarizerService/DeleteInferenceModel"
+	SummarizerService_ListInferenceModels_FullMethodName   = "/teleport.summarizer.v1.SummarizerService/ListInferenceModels"
+	SummarizerService_CreateInferenceSecret_FullMethodName = "/teleport.summarizer.v1.SummarizerService/CreateInferenceSecret"
+	SummarizerService_GetInferenceSecret_FullMethodName    = "/teleport.summarizer.v1.SummarizerService/GetInferenceSecret"
+	SummarizerService_UpdateInferenceSecret_FullMethodName = "/teleport.summarizer.v1.SummarizerService/UpdateInferenceSecret"
+	SummarizerService_UpsertInferenceSecret_FullMethodName = "/teleport.summarizer.v1.SummarizerService/UpsertInferenceSecret"
+	SummarizerService_DeleteInferenceSecret_FullMethodName = "/teleport.summarizer.v1.SummarizerService/DeleteInferenceSecret"
+	SummarizerService_ListInferenceSecrets_FullMethodName  = "/teleport.summarizer.v1.SummarizerService/ListInferenceSecrets"
+	SummarizerService_CreateInferencePolicy_FullMethodName = "/teleport.summarizer.v1.SummarizerService/CreateInferencePolicy"
+	SummarizerService_GetInferencePolicy_FullMethodName    = "/teleport.summarizer.v1.SummarizerService/GetInferencePolicy"
+	SummarizerService_UpdateInferencePolicy_FullMethodName = "/teleport.summarizer.v1.SummarizerService/UpdateInferencePolicy"
+	SummarizerService_UpsertInferencePolicy_FullMethodName = "/teleport.summarizer.v1.SummarizerService/UpsertInferencePolicy"
+	SummarizerService_DeleteInferencePolicy_FullMethodName = "/teleport.summarizer.v1.SummarizerService/DeleteInferencePolicy"
+	SummarizerService_ListInferencePolicies_FullMethodName = "/teleport.summarizer.v1.SummarizerService/ListInferencePolicies"
+	SummarizerService_GetSummary_FullMethodName            = "/teleport.summarizer.v1.SummarizerService/GetSummary"
+	SummarizerService_IsEnabled_FullMethodName             = "/teleport.summarizer.v1.SummarizerService/IsEnabled"
+)
+
+// SummarizerServiceClient is the client API for SummarizerService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SummarizerService is the service for managing summarization inference
+// models, secrets, and policies. These objects configures the session
+// recording summarizer.
+type SummarizerServiceClient interface {
+	// CreateInferenceModel creates a new InferenceModel.
+	CreateInferenceModel(ctx context.Context, in *CreateInferenceModelRequest, opts ...grpc.CallOption) (*CreateInferenceModelResponse, error)
+	// GetInferenceModel retrieves an existing InferenceModel by name.
+	GetInferenceModel(ctx context.Context, in *GetInferenceModelRequest, opts ...grpc.CallOption) (*GetInferenceModelResponse, error)
+	// UpdateInferenceModel updates an existing InferenceModel.
+	UpdateInferenceModel(ctx context.Context, in *UpdateInferenceModelRequest, opts ...grpc.CallOption) (*UpdateInferenceModelResponse, error)
+	// UpsertInferenceModel creates a new InferenceModel or updates an existing
+	// one.
+	UpsertInferenceModel(ctx context.Context, in *UpsertInferenceModelRequest, opts ...grpc.CallOption) (*UpsertInferenceModelResponse, error)
+	// DeleteInferenceModel deletes an existing InferenceModel by name.
+	DeleteInferenceModel(ctx context.Context, in *DeleteInferenceModelRequest, opts ...grpc.CallOption) (*DeleteInferenceModelResponse, error)
+	// ListInferenceModels lists all InferenceModels that match the request.
+	ListInferenceModels(ctx context.Context, in *ListInferenceModelsRequest, opts ...grpc.CallOption) (*ListInferenceModelsResponse, error)
+	// CreateInferenceSecret creates a new InferenceSecret.
+	CreateInferenceSecret(ctx context.Context, in *CreateInferenceSecretRequest, opts ...grpc.CallOption) (*CreateInferenceSecretResponse, error)
+	// GetInferenceSecret retrieves an existing InferenceSecret by name.
+	GetInferenceSecret(ctx context.Context, in *GetInferenceSecretRequest, opts ...grpc.CallOption) (*GetInferenceSecretResponse, error)
+	// UpdateInferenceSecret updates an existing InferenceSecret.
+	UpdateInferenceSecret(ctx context.Context, in *UpdateInferenceSecretRequest, opts ...grpc.CallOption) (*UpdateInferenceSecretResponse, error)
+	// UpsertInferenceSecret creates a new InferenceSecret or updates an existing
+	// one.
+	UpsertInferenceSecret(ctx context.Context, in *UpsertInferenceSecretRequest, opts ...grpc.CallOption) (*UpsertInferenceSecretResponse, error)
+	// DeleteInferenceSecret deletes an existing InferenceSecret by name.
+	DeleteInferenceSecret(ctx context.Context, in *DeleteInferenceSecretRequest, opts ...grpc.CallOption) (*DeleteInferenceSecretResponse, error)
+	// ListInferenceSecrets lists all InferenceSecrets that match the request.
+	ListInferenceSecrets(ctx context.Context, in *ListInferenceSecretsRequest, opts ...grpc.CallOption) (*ListInferenceSecretsResponse, error)
+	// CreateInferencePolicy creates a new InferencePolicy.
+	CreateInferencePolicy(ctx context.Context, in *CreateInferencePolicyRequest, opts ...grpc.CallOption) (*CreateInferencePolicyResponse, error)
+	// GetInferencePolicy retrieves an existing InferencePolicy by name.
+	GetInferencePolicy(ctx context.Context, in *GetInferencePolicyRequest, opts ...grpc.CallOption) (*GetInferencePolicyResponse, error)
+	// UpdateInferencePolicy updates an existing InferencePolicy.
+	UpdateInferencePolicy(ctx context.Context, in *UpdateInferencePolicyRequest, opts ...grpc.CallOption) (*UpdateInferencePolicyResponse, error)
+	// UpsertInferencePolicy creates a new InferencePolicy or updates an existing
+	// one.
+	UpsertInferencePolicy(ctx context.Context, in *UpsertInferencePolicyRequest, opts ...grpc.CallOption) (*UpsertInferencePolicyResponse, error)
+	// DeleteInferencePolicy deletes an existing InferencePolicy by name.
+	DeleteInferencePolicy(ctx context.Context, in *DeleteInferencePolicyRequest, opts ...grpc.CallOption) (*DeleteInferencePolicyResponse, error)
+	// ListInferencePolicies lists all InferencePolicies that match the request.
+	ListInferencePolicies(ctx context.Context, in *ListInferencePoliciesRequest, opts ...grpc.CallOption) (*ListInferencePoliciesResponse, error)
+	// GetSummary retrieves the inference result for a session, which
+	// contains the session summary.
+	GetSummary(ctx context.Context, in *GetSummaryRequest, opts ...grpc.CallOption) (*GetSummaryResponse, error)
+	// IsEnabled tells if the summarizer is enabled by the license and
+	// configured. (Note that this doesn't tell anything about actual correctness
+	// of the configuration or presence of recording summaries.)
+	IsEnabled(ctx context.Context, in *IsEnabledRequest, opts ...grpc.CallOption) (*IsEnabledResponse, error)
+}
+
+type summarizerServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewSummarizerServiceClient(cc grpc.ClientConnInterface) SummarizerServiceClient {
+	return &summarizerServiceClient{cc}
+}
+
+func (c *summarizerServiceClient) CreateInferenceModel(ctx context.Context, in *CreateInferenceModelRequest, opts ...grpc.CallOption) (*CreateInferenceModelResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateInferenceModelResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_CreateInferenceModel_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) GetInferenceModel(ctx context.Context, in *GetInferenceModelRequest, opts ...grpc.CallOption) (*GetInferenceModelResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetInferenceModelResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_GetInferenceModel_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpdateInferenceModel(ctx context.Context, in *UpdateInferenceModelRequest, opts ...grpc.CallOption) (*UpdateInferenceModelResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateInferenceModelResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpdateInferenceModel_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpsertInferenceModel(ctx context.Context, in *UpsertInferenceModelRequest, opts ...grpc.CallOption) (*UpsertInferenceModelResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpsertInferenceModelResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpsertInferenceModel_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) DeleteInferenceModel(ctx context.Context, in *DeleteInferenceModelRequest, opts ...grpc.CallOption) (*DeleteInferenceModelResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteInferenceModelResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_DeleteInferenceModel_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) ListInferenceModels(ctx context.Context, in *ListInferenceModelsRequest, opts ...grpc.CallOption) (*ListInferenceModelsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListInferenceModelsResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_ListInferenceModels_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) CreateInferenceSecret(ctx context.Context, in *CreateInferenceSecretRequest, opts ...grpc.CallOption) (*CreateInferenceSecretResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateInferenceSecretResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_CreateInferenceSecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) GetInferenceSecret(ctx context.Context, in *GetInferenceSecretRequest, opts ...grpc.CallOption) (*GetInferenceSecretResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetInferenceSecretResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_GetInferenceSecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpdateInferenceSecret(ctx context.Context, in *UpdateInferenceSecretRequest, opts ...grpc.CallOption) (*UpdateInferenceSecretResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateInferenceSecretResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpdateInferenceSecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpsertInferenceSecret(ctx context.Context, in *UpsertInferenceSecretRequest, opts ...grpc.CallOption) (*UpsertInferenceSecretResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpsertInferenceSecretResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpsertInferenceSecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) DeleteInferenceSecret(ctx context.Context, in *DeleteInferenceSecretRequest, opts ...grpc.CallOption) (*DeleteInferenceSecretResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteInferenceSecretResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_DeleteInferenceSecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) ListInferenceSecrets(ctx context.Context, in *ListInferenceSecretsRequest, opts ...grpc.CallOption) (*ListInferenceSecretsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListInferenceSecretsResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_ListInferenceSecrets_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) CreateInferencePolicy(ctx context.Context, in *CreateInferencePolicyRequest, opts ...grpc.CallOption) (*CreateInferencePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateInferencePolicyResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_CreateInferencePolicy_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) GetInferencePolicy(ctx context.Context, in *GetInferencePolicyRequest, opts ...grpc.CallOption) (*GetInferencePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetInferencePolicyResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_GetInferencePolicy_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpdateInferencePolicy(ctx context.Context, in *UpdateInferencePolicyRequest, opts ...grpc.CallOption) (*UpdateInferencePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateInferencePolicyResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpdateInferencePolicy_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) UpsertInferencePolicy(ctx context.Context, in *UpsertInferencePolicyRequest, opts ...grpc.CallOption) (*UpsertInferencePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpsertInferencePolicyResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_UpsertInferencePolicy_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) DeleteInferencePolicy(ctx context.Context, in *DeleteInferencePolicyRequest, opts ...grpc.CallOption) (*DeleteInferencePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteInferencePolicyResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_DeleteInferencePolicy_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) ListInferencePolicies(ctx context.Context, in *ListInferencePoliciesRequest, opts ...grpc.CallOption) (*ListInferencePoliciesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListInferencePoliciesResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_ListInferencePolicies_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) GetSummary(ctx context.Context, in *GetSummaryRequest, opts ...grpc.CallOption) (*GetSummaryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetSummaryResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_GetSummary_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *summarizerServiceClient) IsEnabled(ctx context.Context, in *IsEnabledRequest, opts ...grpc.CallOption) (*IsEnabledResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(IsEnabledResponse)
+	err := c.cc.Invoke(ctx, SummarizerService_IsEnabled_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// SummarizerServiceServer is the server API for SummarizerService service.
+// All implementations must embed UnimplementedSummarizerServiceServer
+// for forward compatibility.
+//
+// SummarizerService is the service for managing summarization inference
+// models, secrets, and policies. These objects configures the session
+// recording summarizer.
+type SummarizerServiceServer interface {
+	// CreateInferenceModel creates a new InferenceModel.
+	CreateInferenceModel(context.Context, *CreateInferenceModelRequest) (*CreateInferenceModelResponse, error)
+	// GetInferenceModel retrieves an existing InferenceModel by name.
+	GetInferenceModel(context.Context, *GetInferenceModelRequest) (*GetInferenceModelResponse, error)
+	// UpdateInferenceModel updates an existing InferenceModel.
+	UpdateInferenceModel(context.Context, *UpdateInferenceModelRequest) (*UpdateInferenceModelResponse, error)
+	// UpsertInferenceModel creates a new InferenceModel or updates an existing
+	// one.
+	UpsertInferenceModel(context.Context, *UpsertInferenceModelRequest) (*UpsertInferenceModelResponse, error)
+	// DeleteInferenceModel deletes an existing InferenceModel by name.
+	DeleteInferenceModel(context.Context, *DeleteInferenceModelRequest) (*DeleteInferenceModelResponse, error)
+	// ListInferenceModels lists all InferenceModels that match the request.
+	ListInferenceModels(context.Context, *ListInferenceModelsRequest) (*ListInferenceModelsResponse, error)
+	// CreateInferenceSecret creates a new InferenceSecret.
+	CreateInferenceSecret(context.Context, *CreateInferenceSecretRequest) (*CreateInferenceSecretResponse, error)
+	// GetInferenceSecret retrieves an existing InferenceSecret by name.
+	GetInferenceSecret(context.Context, *GetInferenceSecretRequest) (*GetInferenceSecretResponse, error)
+	// UpdateInferenceSecret updates an existing InferenceSecret.
+	UpdateInferenceSecret(context.Context, *UpdateInferenceSecretRequest) (*UpdateInferenceSecretResponse, error)
+	// UpsertInferenceSecret creates a new InferenceSecret or updates an existing
+	// one.
+	UpsertInferenceSecret(context.Context, *UpsertInferenceSecretRequest) (*UpsertInferenceSecretResponse, error)
+	// DeleteInferenceSecret deletes an existing InferenceSecret by name.
+	DeleteInferenceSecret(context.Context, *DeleteInferenceSecretRequest) (*DeleteInferenceSecretResponse, error)
+	// ListInferenceSecrets lists all InferenceSecrets that match the request.
+	ListInferenceSecrets(context.Context, *ListInferenceSecretsRequest) (*ListInferenceSecretsResponse, error)
+	// CreateInferencePolicy creates a new InferencePolicy.
+	CreateInferencePolicy(context.Context, *CreateInferencePolicyRequest) (*CreateInferencePolicyResponse, error)
+	// GetInferencePolicy retrieves an existing InferencePolicy by name.
+	GetInferencePolicy(context.Context, *GetInferencePolicyRequest) (*GetInferencePolicyResponse, error)
+	// UpdateInferencePolicy updates an existing InferencePolicy.
+	UpdateInferencePolicy(context.Context, *UpdateInferencePolicyRequest) (*UpdateInferencePolicyResponse, error)
+	// UpsertInferencePolicy creates a new InferencePolicy or updates an existing
+	// one.
+	UpsertInferencePolicy(context.Context, *UpsertInferencePolicyRequest) (*UpsertInferencePolicyResponse, error)
+	// DeleteInferencePolicy deletes an existing InferencePolicy by name.
+	DeleteInferencePolicy(context.Context, *DeleteInferencePolicyRequest) (*DeleteInferencePolicyResponse, error)
+	// ListInferencePolicies lists all InferencePolicies that match the request.
+	ListInferencePolicies(context.Context, *ListInferencePoliciesRequest) (*ListInferencePoliciesResponse, error)
+	// GetSummary retrieves the inference result for a session, which
+	// contains the session summary.
+	GetSummary(context.Context, *GetSummaryRequest) (*GetSummaryResponse, error)
+	// IsEnabled tells if the summarizer is enabled by the license and
+	// configured. (Note that this doesn't tell anything about actual correctness
+	// of the configuration or presence of recording summaries.)
+	IsEnabled(context.Context, *IsEnabledRequest) (*IsEnabledResponse, error)
+	mustEmbedUnimplementedSummarizerServiceServer()
+}
+
+// UnimplementedSummarizerServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSummarizerServiceServer struct{}
+
+func (UnimplementedSummarizerServiceServer) CreateInferenceModel(context.Context, *CreateInferenceModelRequest) (*CreateInferenceModelResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateInferenceModel not implemented")
+}
+func (UnimplementedSummarizerServiceServer) GetInferenceModel(context.Context, *GetInferenceModelRequest) (*GetInferenceModelResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetInferenceModel not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpdateInferenceModel(context.Context, *UpdateInferenceModelRequest) (*UpdateInferenceModelResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateInferenceModel not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpsertInferenceModel(context.Context, *UpsertInferenceModelRequest) (*UpsertInferenceModelResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertInferenceModel not implemented")
+}
+func (UnimplementedSummarizerServiceServer) DeleteInferenceModel(context.Context, *DeleteInferenceModelRequest) (*DeleteInferenceModelResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteInferenceModel not implemented")
+}
+func (UnimplementedSummarizerServiceServer) ListInferenceModels(context.Context, *ListInferenceModelsRequest) (*ListInferenceModelsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListInferenceModels not implemented")
+}
+func (UnimplementedSummarizerServiceServer) CreateInferenceSecret(context.Context, *CreateInferenceSecretRequest) (*CreateInferenceSecretResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateInferenceSecret not implemented")
+}
+func (UnimplementedSummarizerServiceServer) GetInferenceSecret(context.Context, *GetInferenceSecretRequest) (*GetInferenceSecretResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetInferenceSecret not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpdateInferenceSecret(context.Context, *UpdateInferenceSecretRequest) (*UpdateInferenceSecretResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateInferenceSecret not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpsertInferenceSecret(context.Context, *UpsertInferenceSecretRequest) (*UpsertInferenceSecretResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertInferenceSecret not implemented")
+}
+func (UnimplementedSummarizerServiceServer) DeleteInferenceSecret(context.Context, *DeleteInferenceSecretRequest) (*DeleteInferenceSecretResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteInferenceSecret not implemented")
+}
+func (UnimplementedSummarizerServiceServer) ListInferenceSecrets(context.Context, *ListInferenceSecretsRequest) (*ListInferenceSecretsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListInferenceSecrets not implemented")
+}
+func (UnimplementedSummarizerServiceServer) CreateInferencePolicy(context.Context, *CreateInferencePolicyRequest) (*CreateInferencePolicyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateInferencePolicy not implemented")
+}
+func (UnimplementedSummarizerServiceServer) GetInferencePolicy(context.Context, *GetInferencePolicyRequest) (*GetInferencePolicyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetInferencePolicy not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpdateInferencePolicy(context.Context, *UpdateInferencePolicyRequest) (*UpdateInferencePolicyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateInferencePolicy not implemented")
+}
+func (UnimplementedSummarizerServiceServer) UpsertInferencePolicy(context.Context, *UpsertInferencePolicyRequest) (*UpsertInferencePolicyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertInferencePolicy not implemented")
+}
+func (UnimplementedSummarizerServiceServer) DeleteInferencePolicy(context.Context, *DeleteInferencePolicyRequest) (*DeleteInferencePolicyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteInferencePolicy not implemented")
+}
+func (UnimplementedSummarizerServiceServer) ListInferencePolicies(context.Context, *ListInferencePoliciesRequest) (*ListInferencePoliciesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListInferencePolicies not implemented")
+}
+func (UnimplementedSummarizerServiceServer) GetSummary(context.Context, *GetSummaryRequest) (*GetSummaryResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetSummary not implemented")
+}
+func (UnimplementedSummarizerServiceServer) IsEnabled(context.Context, *IsEnabledRequest) (*IsEnabledResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method IsEnabled not implemented")
+}
+func (UnimplementedSummarizerServiceServer) mustEmbedUnimplementedSummarizerServiceServer() {}
+func (UnimplementedSummarizerServiceServer) testEmbeddedByValue()                           {}
+
+// UnsafeSummarizerServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to SummarizerServiceServer will
+// result in compilation errors.
+type UnsafeSummarizerServiceServer interface {
+	mustEmbedUnimplementedSummarizerServiceServer()
+}
+
+func RegisterSummarizerServiceServer(s grpc.ServiceRegistrar, srv SummarizerServiceServer) {
+	// If the following call pancis, it indicates UnimplementedSummarizerServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&SummarizerService_ServiceDesc, srv)
+}
+
+func _SummarizerService_CreateInferenceModel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateInferenceModelRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).CreateInferenceModel(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_CreateInferenceModel_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).CreateInferenceModel(ctx, req.(*CreateInferenceModelRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_GetInferenceModel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInferenceModelRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).GetInferenceModel(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_GetInferenceModel_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).GetInferenceModel(ctx, req.(*GetInferenceModelRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpdateInferenceModel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateInferenceModelRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpdateInferenceModel(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpdateInferenceModel_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpdateInferenceModel(ctx, req.(*UpdateInferenceModelRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpsertInferenceModel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertInferenceModelRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpsertInferenceModel(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpsertInferenceModel_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpsertInferenceModel(ctx, req.(*UpsertInferenceModelRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_DeleteInferenceModel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteInferenceModelRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).DeleteInferenceModel(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_DeleteInferenceModel_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).DeleteInferenceModel(ctx, req.(*DeleteInferenceModelRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_ListInferenceModels_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListInferenceModelsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).ListInferenceModels(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_ListInferenceModels_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).ListInferenceModels(ctx, req.(*ListInferenceModelsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_CreateInferenceSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateInferenceSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).CreateInferenceSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_CreateInferenceSecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).CreateInferenceSecret(ctx, req.(*CreateInferenceSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_GetInferenceSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInferenceSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).GetInferenceSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_GetInferenceSecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).GetInferenceSecret(ctx, req.(*GetInferenceSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpdateInferenceSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateInferenceSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpdateInferenceSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpdateInferenceSecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpdateInferenceSecret(ctx, req.(*UpdateInferenceSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpsertInferenceSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertInferenceSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpsertInferenceSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpsertInferenceSecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpsertInferenceSecret(ctx, req.(*UpsertInferenceSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_DeleteInferenceSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteInferenceSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).DeleteInferenceSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_DeleteInferenceSecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).DeleteInferenceSecret(ctx, req.(*DeleteInferenceSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_ListInferenceSecrets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListInferenceSecretsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).ListInferenceSecrets(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_ListInferenceSecrets_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).ListInferenceSecrets(ctx, req.(*ListInferenceSecretsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_CreateInferencePolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateInferencePolicyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).CreateInferencePolicy(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_CreateInferencePolicy_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).CreateInferencePolicy(ctx, req.(*CreateInferencePolicyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_GetInferencePolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInferencePolicyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).GetInferencePolicy(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_GetInferencePolicy_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).GetInferencePolicy(ctx, req.(*GetInferencePolicyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpdateInferencePolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateInferencePolicyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpdateInferencePolicy(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpdateInferencePolicy_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpdateInferencePolicy(ctx, req.(*UpdateInferencePolicyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_UpsertInferencePolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertInferencePolicyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).UpsertInferencePolicy(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_UpsertInferencePolicy_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).UpsertInferencePolicy(ctx, req.(*UpsertInferencePolicyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_DeleteInferencePolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteInferencePolicyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).DeleteInferencePolicy(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_DeleteInferencePolicy_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).DeleteInferencePolicy(ctx, req.(*DeleteInferencePolicyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_ListInferencePolicies_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListInferencePoliciesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).ListInferencePolicies(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_ListInferencePolicies_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).ListInferencePolicies(ctx, req.(*ListInferencePoliciesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_GetSummary_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetSummaryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).GetSummary(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_GetSummary_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).GetSummary(ctx, req.(*GetSummaryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SummarizerService_IsEnabled_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(IsEnabledRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SummarizerServiceServer).IsEnabled(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SummarizerService_IsEnabled_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SummarizerServiceServer).IsEnabled(ctx, req.(*IsEnabledRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// SummarizerService_ServiceDesc is the grpc.ServiceDesc for SummarizerService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var SummarizerService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.summarizer.v1.SummarizerService",
+	HandlerType: (*SummarizerServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CreateInferenceModel",
+			Handler:    _SummarizerService_CreateInferenceModel_Handler,
+		},
+		{
+			MethodName: "GetInferenceModel",
+			Handler:    _SummarizerService_GetInferenceModel_Handler,
+		},
+		{
+			MethodName: "UpdateInferenceModel",
+			Handler:    _SummarizerService_UpdateInferenceModel_Handler,
+		},
+		{
+			MethodName: "UpsertInferenceModel",
+			Handler:    _SummarizerService_UpsertInferenceModel_Handler,
+		},
+		{
+			MethodName: "DeleteInferenceModel",
+			Handler:    _SummarizerService_DeleteInferenceModel_Handler,
+		},
+		{
+			MethodName: "ListInferenceModels",
+			Handler:    _SummarizerService_ListInferenceModels_Handler,
+		},
+		{
+			MethodName: "CreateInferenceSecret",
+			Handler:    _SummarizerService_CreateInferenceSecret_Handler,
+		},
+		{
+			MethodName: "GetInferenceSecret",
+			Handler:    _SummarizerService_GetInferenceSecret_Handler,
+		},
+		{
+			MethodName: "UpdateInferenceSecret",
+			Handler:    _SummarizerService_UpdateInferenceSecret_Handler,
+		},
+		{
+			MethodName: "UpsertInferenceSecret",
+			Handler:    _SummarizerService_UpsertInferenceSecret_Handler,
+		},
+		{
+			MethodName: "DeleteInferenceSecret",
+			Handler:    _SummarizerService_DeleteInferenceSecret_Handler,
+		},
+		{
+			MethodName: "ListInferenceSecrets",
+			Handler:    _SummarizerService_ListInferenceSecrets_Handler,
+		},
+		{
+			MethodName: "CreateInferencePolicy",
+			Handler:    _SummarizerService_CreateInferencePolicy_Handler,
+		},
+		{
+			MethodName: "GetInferencePolicy",
+			Handler:    _SummarizerService_GetInferencePolicy_Handler,
+		},
+		{
+			MethodName: "UpdateInferencePolicy",
+			Handler:    _SummarizerService_UpdateInferencePolicy_Handler,
+		},
+		{
+			MethodName: "UpsertInferencePolicy",
+			Handler:    _SummarizerService_UpsertInferencePolicy_Handler,
+		},
+		{
+			MethodName: "DeleteInferencePolicy",
+			Handler:    _SummarizerService_DeleteInferencePolicy_Handler,
+		},
+		{
+			MethodName: "ListInferencePolicies",
+			Handler:    _SummarizerService_ListInferencePolicies_Handler,
+		},
+		{
+			MethodName: "GetSummary",
+			Handler:    _SummarizerService_GetSummary_Handler,
+		},
+		{
+			MethodName: "IsEnabled",
+			Handler:    _SummarizerService_IsEnabled_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/summarizer/v1/summarizer_service.proto",
+}
diff --git a/api/gen/proto/go/teleport/trait/v1/trait.pb.go b/api/gen/proto/go/teleport/trait/v1/trait.pb.go
index fcd84f5888aa4..e5ab47a14420b 100644
--- a/api/gen/proto/go/teleport/trait/v1/trait.pb.go
+++ b/api/gen/proto/go/teleport/trait/v1/trait.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/trait/v1/trait.proto
 
diff --git a/api/gen/proto/go/teleport/transport/v1/transport_service.pb.go b/api/gen/proto/go/teleport/transport/v1/transport_service.pb.go
index a37fae786ad9d..d4975335ccbb1 100644
--- a/api/gen/proto/go/teleport/transport/v1/transport_service.pb.go
+++ b/api/gen/proto/go/teleport/transport/v1/transport_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/transport/v1/transport_service.proto
 
diff --git a/api/gen/proto/go/teleport/trust/v1/trust_service.pb.go b/api/gen/proto/go/teleport/trust/v1/trust_service.pb.go
index 6589f97278328..90d2cd5e77d26 100644
--- a/api/gen/proto/go/teleport/trust/v1/trust_service.pb.go
+++ b/api/gen/proto/go/teleport/trust/v1/trust_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/trust/v1/trust_service.proto
 
@@ -865,6 +865,118 @@ func (x *GenerateHostCertResponse) GetSshCertificate() []byte {
 	return nil
 }
 
+// ListTrustedClustersRequest is the request for ListTrustedClusters.
+type ListTrustedClustersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListTrustedClustersRequest) Reset() {
+	*x = ListTrustedClustersRequest{}
+	mi := &file_teleport_trust_v1_trust_service_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListTrustedClustersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListTrustedClustersRequest) ProtoMessage() {}
+
+func (x *ListTrustedClustersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_trust_v1_trust_service_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListTrustedClustersRequest.ProtoReflect.Descriptor instead.
+func (*ListTrustedClustersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_trust_v1_trust_service_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *ListTrustedClustersRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListTrustedClustersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListTrustedClustersResponse is the response for ListTrustedClusters.
+type ListTrustedClustersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// TrustedClusters is a list of Trusted Cluster resources.
+	TrustedClusters []*types.TrustedClusterV2 `protobuf:"bytes,1,rep,name=trusted_clusters,json=trustedClusters,proto3" json:"trusted_clusters,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListTrustedClustersResponse) Reset() {
+	*x = ListTrustedClustersResponse{}
+	mi := &file_teleport_trust_v1_trust_service_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListTrustedClustersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListTrustedClustersResponse) ProtoMessage() {}
+
+func (x *ListTrustedClustersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_trust_v1_trust_service_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListTrustedClustersResponse.ProtoReflect.Descriptor instead.
+func (*ListTrustedClustersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_trust_v1_trust_service_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *ListTrustedClustersResponse) GetTrustedClusters() []*types.TrustedClusterV2 {
+	if x != nil {
+		return x.TrustedClusters
+	}
+	return nil
+}
+
+func (x *ListTrustedClustersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 var File_teleport_trust_v1_trust_service_proto protoreflect.FileDescriptor
 
 const file_teleport_trust_v1_trust_service_proto_rawDesc = "" +
@@ -917,7 +1029,14 @@ const file_teleport_trust_v1_trust_service_proto_rawDesc = "" +
 	"\x04role\x18\x06 \x01(\tR\x04role\x12+\n" +
 	"\x03ttl\x18\a \x01(\v2\x19.google.protobuf.DurationR\x03ttl\"C\n" +
 	"\x18GenerateHostCertResponse\x12'\n" +
-	"\x0fssh_certificate\x18\x01 \x01(\fR\x0esshCertificate2\xaa\b\n" +
+	"\x0fssh_certificate\x18\x01 \x01(\fR\x0esshCertificate\"X\n" +
+	"\x1aListTrustedClustersRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\x89\x01\n" +
+	"\x1bListTrustedClustersResponse\x12B\n" +
+	"\x10trusted_clusters\x18\x01 \x03(\v2\x17.types.TrustedClusterV2R\x0ftrustedClusters\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\xa0\t\n" +
 	"\fTrustService\x12V\n" +
 	"\x10GetCertAuthority\x12*.teleport.trust.v1.GetCertAuthorityRequest\x1a\x16.types.CertAuthorityV2\x12q\n" +
 	"\x12GetCertAuthorities\x12,.teleport.trust.v1.GetCertAuthoritiesRequest\x1a-.teleport.trust.v1.GetCertAuthoritiesResponse\x12\\\n" +
@@ -928,7 +1047,8 @@ const file_teleport_trust_v1_trust_service_proto_rawDesc = "" +
 	"\x10GenerateHostCert\x12*.teleport.trust.v1.GenerateHostCertRequest\x1a+.teleport.trust.v1.GenerateHostCertResponse\x12_\n" +
 	"\x14UpsertTrustedCluster\x12..teleport.trust.v1.UpsertTrustedClusterRequest\x1a\x17.types.TrustedClusterV2\x12_\n" +
 	"\x14CreateTrustedCluster\x12..teleport.trust.v1.CreateTrustedClusterRequest\x1a\x17.types.TrustedClusterV2\x12_\n" +
-	"\x14UpdateTrustedCluster\x12..teleport.trust.v1.UpdateTrustedClusterRequest\x1a\x17.types.TrustedClusterV2BNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1;trustv1b\x06proto3"
+	"\x14UpdateTrustedCluster\x12..teleport.trust.v1.UpdateTrustedClusterRequest\x1a\x17.types.TrustedClusterV2\x12t\n" +
+	"\x13ListTrustedClusters\x12-.teleport.trust.v1.ListTrustedClustersRequest\x1a..teleport.trust.v1.ListTrustedClustersResponseBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1;trustv1b\x06proto3"
 
 var (
 	file_teleport_trust_v1_trust_service_proto_rawDescOnce sync.Once
@@ -942,7 +1062,7 @@ func file_teleport_trust_v1_trust_service_proto_rawDescGZIP() []byte {
 	return file_teleport_trust_v1_trust_service_proto_rawDescData
 }
 
-var file_teleport_trust_v1_trust_service_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_teleport_trust_v1_trust_service_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
 var file_teleport_trust_v1_trust_service_proto_goTypes = []any{
 	(*UpsertTrustedClusterRequest)(nil),         // 0: teleport.trust.v1.UpsertTrustedClusterRequest
 	(*CreateTrustedClusterRequest)(nil),         // 1: teleport.trust.v1.CreateTrustedClusterRequest
@@ -959,50 +1079,55 @@ var file_teleport_trust_v1_trust_service_proto_goTypes = []any{
 	(*RotateExternalCertAuthorityResponse)(nil), // 12: teleport.trust.v1.RotateExternalCertAuthorityResponse
 	(*GenerateHostCertRequest)(nil),             // 13: teleport.trust.v1.GenerateHostCertRequest
 	(*GenerateHostCertResponse)(nil),            // 14: teleport.trust.v1.GenerateHostCertResponse
-	(*types.TrustedClusterV2)(nil),              // 15: types.TrustedClusterV2
-	(*types.CertAuthorityV2)(nil),               // 16: types.CertAuthorityV2
-	(*durationpb.Duration)(nil),                 // 17: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),               // 18: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),                       // 19: google.protobuf.Empty
+	(*ListTrustedClustersRequest)(nil),          // 15: teleport.trust.v1.ListTrustedClustersRequest
+	(*ListTrustedClustersResponse)(nil),         // 16: teleport.trust.v1.ListTrustedClustersResponse
+	(*types.TrustedClusterV2)(nil),              // 17: types.TrustedClusterV2
+	(*types.CertAuthorityV2)(nil),               // 18: types.CertAuthorityV2
+	(*durationpb.Duration)(nil),                 // 19: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),               // 20: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),                       // 21: google.protobuf.Empty
 }
 var file_teleport_trust_v1_trust_service_proto_depIdxs = []int32{
-	15, // 0: teleport.trust.v1.UpsertTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
-	15, // 1: teleport.trust.v1.CreateTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
-	15, // 2: teleport.trust.v1.UpdateTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
-	16, // 3: teleport.trust.v1.GetCertAuthoritiesResponse.cert_authorities_v2:type_name -> types.CertAuthorityV2
-	16, // 4: teleport.trust.v1.UpsertCertAuthorityRequest.cert_authority:type_name -> types.CertAuthorityV2
-	17, // 5: teleport.trust.v1.RotateCertAuthorityRequest.grace_period:type_name -> google.protobuf.Duration
+	17, // 0: teleport.trust.v1.UpsertTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
+	17, // 1: teleport.trust.v1.CreateTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
+	17, // 2: teleport.trust.v1.UpdateTrustedClusterRequest.trusted_cluster:type_name -> types.TrustedClusterV2
+	18, // 3: teleport.trust.v1.GetCertAuthoritiesResponse.cert_authorities_v2:type_name -> types.CertAuthorityV2
+	18, // 4: teleport.trust.v1.UpsertCertAuthorityRequest.cert_authority:type_name -> types.CertAuthorityV2
+	19, // 5: teleport.trust.v1.RotateCertAuthorityRequest.grace_period:type_name -> google.protobuf.Duration
 	9,  // 6: teleport.trust.v1.RotateCertAuthorityRequest.schedule:type_name -> teleport.trust.v1.RotationSchedule
-	18, // 7: teleport.trust.v1.RotationSchedule.update_clients:type_name -> google.protobuf.Timestamp
-	18, // 8: teleport.trust.v1.RotationSchedule.update_servers:type_name -> google.protobuf.Timestamp
-	18, // 9: teleport.trust.v1.RotationSchedule.standby:type_name -> google.protobuf.Timestamp
-	16, // 10: teleport.trust.v1.RotateExternalCertAuthorityRequest.cert_authority:type_name -> types.CertAuthorityV2
-	17, // 11: teleport.trust.v1.GenerateHostCertRequest.ttl:type_name -> google.protobuf.Duration
-	3,  // 12: teleport.trust.v1.TrustService.GetCertAuthority:input_type -> teleport.trust.v1.GetCertAuthorityRequest
-	4,  // 13: teleport.trust.v1.TrustService.GetCertAuthorities:input_type -> teleport.trust.v1.GetCertAuthoritiesRequest
-	6,  // 14: teleport.trust.v1.TrustService.DeleteCertAuthority:input_type -> teleport.trust.v1.DeleteCertAuthorityRequest
-	7,  // 15: teleport.trust.v1.TrustService.UpsertCertAuthority:input_type -> teleport.trust.v1.UpsertCertAuthorityRequest
-	8,  // 16: teleport.trust.v1.TrustService.RotateCertAuthority:input_type -> teleport.trust.v1.RotateCertAuthorityRequest
-	11, // 17: teleport.trust.v1.TrustService.RotateExternalCertAuthority:input_type -> teleport.trust.v1.RotateExternalCertAuthorityRequest
-	13, // 18: teleport.trust.v1.TrustService.GenerateHostCert:input_type -> teleport.trust.v1.GenerateHostCertRequest
-	0,  // 19: teleport.trust.v1.TrustService.UpsertTrustedCluster:input_type -> teleport.trust.v1.UpsertTrustedClusterRequest
-	1,  // 20: teleport.trust.v1.TrustService.CreateTrustedCluster:input_type -> teleport.trust.v1.CreateTrustedClusterRequest
-	2,  // 21: teleport.trust.v1.TrustService.UpdateTrustedCluster:input_type -> teleport.trust.v1.UpdateTrustedClusterRequest
-	16, // 22: teleport.trust.v1.TrustService.GetCertAuthority:output_type -> types.CertAuthorityV2
-	5,  // 23: teleport.trust.v1.TrustService.GetCertAuthorities:output_type -> teleport.trust.v1.GetCertAuthoritiesResponse
-	19, // 24: teleport.trust.v1.TrustService.DeleteCertAuthority:output_type -> google.protobuf.Empty
-	16, // 25: teleport.trust.v1.TrustService.UpsertCertAuthority:output_type -> types.CertAuthorityV2
-	10, // 26: teleport.trust.v1.TrustService.RotateCertAuthority:output_type -> teleport.trust.v1.RotateCertAuthorityResponse
-	12, // 27: teleport.trust.v1.TrustService.RotateExternalCertAuthority:output_type -> teleport.trust.v1.RotateExternalCertAuthorityResponse
-	14, // 28: teleport.trust.v1.TrustService.GenerateHostCert:output_type -> teleport.trust.v1.GenerateHostCertResponse
-	15, // 29: teleport.trust.v1.TrustService.UpsertTrustedCluster:output_type -> types.TrustedClusterV2
-	15, // 30: teleport.trust.v1.TrustService.CreateTrustedCluster:output_type -> types.TrustedClusterV2
-	15, // 31: teleport.trust.v1.TrustService.UpdateTrustedCluster:output_type -> types.TrustedClusterV2
-	22, // [22:32] is the sub-list for method output_type
-	12, // [12:22] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	20, // 7: teleport.trust.v1.RotationSchedule.update_clients:type_name -> google.protobuf.Timestamp
+	20, // 8: teleport.trust.v1.RotationSchedule.update_servers:type_name -> google.protobuf.Timestamp
+	20, // 9: teleport.trust.v1.RotationSchedule.standby:type_name -> google.protobuf.Timestamp
+	18, // 10: teleport.trust.v1.RotateExternalCertAuthorityRequest.cert_authority:type_name -> types.CertAuthorityV2
+	19, // 11: teleport.trust.v1.GenerateHostCertRequest.ttl:type_name -> google.protobuf.Duration
+	17, // 12: teleport.trust.v1.ListTrustedClustersResponse.trusted_clusters:type_name -> types.TrustedClusterV2
+	3,  // 13: teleport.trust.v1.TrustService.GetCertAuthority:input_type -> teleport.trust.v1.GetCertAuthorityRequest
+	4,  // 14: teleport.trust.v1.TrustService.GetCertAuthorities:input_type -> teleport.trust.v1.GetCertAuthoritiesRequest
+	6,  // 15: teleport.trust.v1.TrustService.DeleteCertAuthority:input_type -> teleport.trust.v1.DeleteCertAuthorityRequest
+	7,  // 16: teleport.trust.v1.TrustService.UpsertCertAuthority:input_type -> teleport.trust.v1.UpsertCertAuthorityRequest
+	8,  // 17: teleport.trust.v1.TrustService.RotateCertAuthority:input_type -> teleport.trust.v1.RotateCertAuthorityRequest
+	11, // 18: teleport.trust.v1.TrustService.RotateExternalCertAuthority:input_type -> teleport.trust.v1.RotateExternalCertAuthorityRequest
+	13, // 19: teleport.trust.v1.TrustService.GenerateHostCert:input_type -> teleport.trust.v1.GenerateHostCertRequest
+	0,  // 20: teleport.trust.v1.TrustService.UpsertTrustedCluster:input_type -> teleport.trust.v1.UpsertTrustedClusterRequest
+	1,  // 21: teleport.trust.v1.TrustService.CreateTrustedCluster:input_type -> teleport.trust.v1.CreateTrustedClusterRequest
+	2,  // 22: teleport.trust.v1.TrustService.UpdateTrustedCluster:input_type -> teleport.trust.v1.UpdateTrustedClusterRequest
+	15, // 23: teleport.trust.v1.TrustService.ListTrustedClusters:input_type -> teleport.trust.v1.ListTrustedClustersRequest
+	18, // 24: teleport.trust.v1.TrustService.GetCertAuthority:output_type -> types.CertAuthorityV2
+	5,  // 25: teleport.trust.v1.TrustService.GetCertAuthorities:output_type -> teleport.trust.v1.GetCertAuthoritiesResponse
+	21, // 26: teleport.trust.v1.TrustService.DeleteCertAuthority:output_type -> google.protobuf.Empty
+	18, // 27: teleport.trust.v1.TrustService.UpsertCertAuthority:output_type -> types.CertAuthorityV2
+	10, // 28: teleport.trust.v1.TrustService.RotateCertAuthority:output_type -> teleport.trust.v1.RotateCertAuthorityResponse
+	12, // 29: teleport.trust.v1.TrustService.RotateExternalCertAuthority:output_type -> teleport.trust.v1.RotateExternalCertAuthorityResponse
+	14, // 30: teleport.trust.v1.TrustService.GenerateHostCert:output_type -> teleport.trust.v1.GenerateHostCertResponse
+	17, // 31: teleport.trust.v1.TrustService.UpsertTrustedCluster:output_type -> types.TrustedClusterV2
+	17, // 32: teleport.trust.v1.TrustService.CreateTrustedCluster:output_type -> types.TrustedClusterV2
+	17, // 33: teleport.trust.v1.TrustService.UpdateTrustedCluster:output_type -> types.TrustedClusterV2
+	16, // 34: teleport.trust.v1.TrustService.ListTrustedClusters:output_type -> teleport.trust.v1.ListTrustedClustersResponse
+	24, // [24:35] is the sub-list for method output_type
+	13, // [13:24] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_teleport_trust_v1_trust_service_proto_init() }
@@ -1016,7 +1141,7 @@ func file_teleport_trust_v1_trust_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_trust_v1_trust_service_proto_rawDesc), len(file_teleport_trust_v1_trust_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   15,
+			NumMessages:   17,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go b/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
index 4cdc57fe369e1..4fac904c3ee24 100644
--- a/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
@@ -45,6 +45,7 @@ const (
 	TrustService_UpsertTrustedCluster_FullMethodName        = "/teleport.trust.v1.TrustService/UpsertTrustedCluster"
 	TrustService_CreateTrustedCluster_FullMethodName        = "/teleport.trust.v1.TrustService/CreateTrustedCluster"
 	TrustService_UpdateTrustedCluster_FullMethodName        = "/teleport.trust.v1.TrustService/UpdateTrustedCluster"
+	TrustService_ListTrustedClusters_FullMethodName         = "/teleport.trust.v1.TrustService/ListTrustedClusters"
 )
 
 // TrustServiceClient is the client API for TrustService service.
@@ -74,6 +75,8 @@ type TrustServiceClient interface {
 	CreateTrustedCluster(ctx context.Context, in *CreateTrustedClusterRequest, opts ...grpc.CallOption) (*types.TrustedClusterV2, error)
 	// UpdateTrustedCluster updates a Trusted Cluster in a backend.
 	UpdateTrustedCluster(ctx context.Context, in *UpdateTrustedClusterRequest, opts ...grpc.CallOption) (*types.TrustedClusterV2, error)
+	// ListTrustedClusters returns a page of current Trusted Cluster resources.
+	ListTrustedClusters(ctx context.Context, in *ListTrustedClustersRequest, opts ...grpc.CallOption) (*ListTrustedClustersResponse, error)
 }
 
 type trustServiceClient struct {
@@ -184,6 +187,16 @@ func (c *trustServiceClient) UpdateTrustedCluster(ctx context.Context, in *Updat
 	return out, nil
 }
 
+func (c *trustServiceClient) ListTrustedClusters(ctx context.Context, in *ListTrustedClustersRequest, opts ...grpc.CallOption) (*ListTrustedClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListTrustedClustersResponse)
+	err := c.cc.Invoke(ctx, TrustService_ListTrustedClusters_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // TrustServiceServer is the server API for TrustService service.
 // All implementations must embed UnimplementedTrustServiceServer
 // for forward compatibility.
@@ -211,6 +224,8 @@ type TrustServiceServer interface {
 	CreateTrustedCluster(context.Context, *CreateTrustedClusterRequest) (*types.TrustedClusterV2, error)
 	// UpdateTrustedCluster updates a Trusted Cluster in a backend.
 	UpdateTrustedCluster(context.Context, *UpdateTrustedClusterRequest) (*types.TrustedClusterV2, error)
+	// ListTrustedClusters returns a page of current Trusted Cluster resources.
+	ListTrustedClusters(context.Context, *ListTrustedClustersRequest) (*ListTrustedClustersResponse, error)
 	mustEmbedUnimplementedTrustServiceServer()
 }
 
@@ -251,6 +266,9 @@ func (UnimplementedTrustServiceServer) CreateTrustedCluster(context.Context, *Cr
 func (UnimplementedTrustServiceServer) UpdateTrustedCluster(context.Context, *UpdateTrustedClusterRequest) (*types.TrustedClusterV2, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateTrustedCluster not implemented")
 }
+func (UnimplementedTrustServiceServer) ListTrustedClusters(context.Context, *ListTrustedClustersRequest) (*ListTrustedClustersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListTrustedClusters not implemented")
+}
 func (UnimplementedTrustServiceServer) mustEmbedUnimplementedTrustServiceServer() {}
 func (UnimplementedTrustServiceServer) testEmbeddedByValue()                      {}
 
@@ -452,6 +470,24 @@ func _TrustService_UpdateTrustedCluster_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _TrustService_ListTrustedClusters_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListTrustedClustersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TrustServiceServer).ListTrustedClusters(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TrustService_ListTrustedClusters_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TrustServiceServer).ListTrustedClusters(ctx, req.(*ListTrustedClustersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // TrustService_ServiceDesc is the grpc.ServiceDesc for TrustService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -499,6 +535,10 @@ var TrustService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "UpdateTrustedCluster",
 			Handler:    _TrustService_UpdateTrustedCluster_Handler,
 		},
+		{
+			MethodName: "ListTrustedClusters",
+			Handler:    _TrustService_ListTrustedClusters_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/trust/v1/trust_service.proto",
diff --git a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate.pb.go b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate.pb.go
index c36150430b225..de57e3543dd0f 100644
--- a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate.pb.go
+++ b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userloginstate/v1/userloginstate.proto
 
@@ -95,22 +95,54 @@ func (x *UserLoginState) GetSpec() *Spec {
 // Spec is the specification for a user login state.
 type Spec struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// roles are the user roles attached to the user.
+	// roles are the user roles attached to the user. Basically, [roles] = [original_roles] +
+	// [access_list_roles].
 	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
-	// traits are the traits attached to the user.
+	// traits are the traits attached to the user. Basically, [roles] = [original_traits] +
+	// [access_list_traits].
 	Traits []*v11.Trait `protobuf:"bytes,2,rep,name=traits,proto3" json:"traits,omitempty"`
 	// user_type is the type of user this state represents.
 	UserType string `protobuf:"bytes,3,opt,name=user_type,json=userType,proto3" json:"user_type,omitempty"`
-	// original_roles are the user roles that are part of the user's static definition. These roles are
-	// not affected by access granted by access lists and are obtained prior to granting access list access.
+	// original_roles are the user roles that are part of the user's static definition. These roles
+	// are not affected by access granted by access lists and are obtained prior to granting access
+	// list access. Basically, [original_roles] = [roles] - [access_list_roles].
 	OriginalRoles []string `protobuf:"bytes,4,rep,name=original_roles,json=originalRoles,proto3" json:"original_roles,omitempty"`
-	// original_traits are the user traits that are part of the user's static definition. These traits are
-	// not affected by access granted by access lists and are obtained prior to granting access list access.
+	// original_traits are the user traits that are part of the user's static definition. These
+	// traits are not affected by access granted by access lists and are obtained prior to granting
+	// access list access. Basically, [original_traits] = [traits] - [access_list_traits].
 	OriginalTraits []*v11.Trait `protobuf:"bytes,5,rep,name=original_traits,json=originalTraits,proto3" json:"original_traits,omitempty"`
 	// GitHubIdentity is the external identity attached to this user state.
 	GitHubIdentity *ExternalIdentity `protobuf:"bytes,6,opt,name=git_hub_identity,json=gitHubIdentity,proto3" json:"git_hub_identity,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// saml_identities are the identities created from the SAML connectors used to log in by this
+	// user name. They are useful for RBAC calculation when there is a user with same username form
+	// multiple SSO connectors, i.e. having multiple SSO indentities.
+	//
+	// NOTE: There is no mechanism to clean those identities. If the the user is deleted, the
+	// user_login_state and it's saml_identities will not be deleted. Or even if the user still
+	// exists, but it's SAML identity expires it isn't cleared from the user_login_state. This means
+	// the information stored here can be used only as long as there is a background sync running and
+	// making sure the user's info is up-to-date. E.g. Okta assignment creator is using this
+	// information, but it is running only when Okta user sync is active and periodically updates the
+	// user which in turn updates the user_login_state.
+	//
+	// NOTE2: This field isn't currently used. It's introduced so we can resolve the
+	// https://github.com/gravitational/teleport.e/issues/6723 issue in stages.
+	// The STAGE 1 is to introduce this field and give enough time to get existing Teleport
+	// installations to get updated and populate this field.
+	// The STAGE 2 is in the v19 release (or maybe even v20) to deploy the actual fix PR
+	// (https://github.com/gravitational/teleport.e/pull/7168) reading this field and calculating
+	// access to Okta resources. See more details in the description of the fix PR.
+	//
+	// TODO(kopiczko) v19: consider proceeding with the STAGE 2 described above.
+	SamlIdentities []*ExternalIdentity `protobuf:"bytes,7,rep,name=saml_identities,json=samlIdentities,proto3" json:"saml_identities,omitempty"`
+	// access_list_roles are roles granted to this user by the Access Lists
+	// membership/ownership.  Basically, [access_list_roles] = [roles] - [original_roles].
+	AccessListRoles []string `protobuf:"bytes,8,rep,name=access_list_roles,json=accessListRoles,proto3" json:"access_list_roles,omitempty"`
+	// access_list_traits are traits granted to this user by the Access Lists membership/ownership.
+	// Basically, [access_list_traits] = [traits] - [original_traits].
+	AccessListTraits []*v11.Trait `protobuf:"bytes,9,rep,name=access_list_traits,json=accessListTraits,proto3" json:"access_list_traits,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *Spec) Reset() {
@@ -185,14 +217,41 @@ func (x *Spec) GetGitHubIdentity() *ExternalIdentity {
 	return nil
 }
 
+func (x *Spec) GetSamlIdentities() []*ExternalIdentity {
+	if x != nil {
+		return x.SamlIdentities
+	}
+	return nil
+}
+
+func (x *Spec) GetAccessListRoles() []string {
+	if x != nil {
+		return x.AccessListRoles
+	}
+	return nil
+}
+
+func (x *Spec) GetAccessListTraits() []*v11.Trait {
+	if x != nil {
+		return x.AccessListTraits
+	}
+	return nil
+}
+
 // ExternalIdentity defines an external identity attached to this user state.
 type ExternalIdentity struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// UserId is the unique identifier of the external identity such as GitHub user
+	// UserID is the unique identifier of the external identity such as GitHub user
 	// ID.
 	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
 	// Username is the username of the external identity.
-	Username      string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	Username string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	// ConnectorID is the connector this identity was created with. It's empty for the local user.
+	ConnectorId string `protobuf:"bytes,3,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	// GrantedRoles specific for this identity. E.g.: from connector attributes mapping.
+	GrantedRoles []string `protobuf:"bytes,4,rep,name=granted_roles,json=grantedRoles,proto3" json:"granted_roles,omitempty"`
+	// GrantedTraits specific for this identity. E.g.: from connector roles attributes mapping.
+	GrantedTraits []*v11.Trait `protobuf:"bytes,5,rep,name=granted_traits,json=grantedTraits,proto3" json:"granted_traits,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -241,6 +300,27 @@ func (x *ExternalIdentity) GetUsername() string {
 	return ""
 }
 
+func (x *ExternalIdentity) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+func (x *ExternalIdentity) GetGrantedRoles() []string {
+	if x != nil {
+		return x.GrantedRoles
+	}
+	return nil
+}
+
+func (x *ExternalIdentity) GetGrantedTraits() []*v11.Trait {
+	if x != nil {
+		return x.GrantedTraits
+	}
+	return nil
+}
+
 var File_teleport_userloginstate_v1_userloginstate_proto protoreflect.FileDescriptor
 
 const file_teleport_userloginstate_v1_userloginstate_proto_rawDesc = "" +
@@ -248,17 +328,23 @@ const file_teleport_userloginstate_v1_userloginstate_proto_rawDesc = "" +
 	"/teleport/userloginstate/v1/userloginstate.proto\x12\x1ateleport.userloginstate.v1\x1a'teleport/header/v1/resourceheader.proto\x1a\x1dteleport/trait/v1/trait.proto\"\x82\x01\n" +
 	"\x0eUserLoginState\x12:\n" +
 	"\x06header\x18\x01 \x01(\v2\".teleport.header.v1.ResourceHeaderR\x06header\x124\n" +
-	"\x04spec\x18\x02 \x01(\v2 .teleport.userloginstate.v1.SpecR\x04spec\"\xad\x02\n" +
+	"\x04spec\x18\x02 \x01(\v2 .teleport.userloginstate.v1.SpecR\x04spec\"\xf8\x03\n" +
 	"\x04Spec\x12\x14\n" +
 	"\x05roles\x18\x01 \x03(\tR\x05roles\x120\n" +
 	"\x06traits\x18\x02 \x03(\v2\x18.teleport.trait.v1.TraitR\x06traits\x12\x1b\n" +
 	"\tuser_type\x18\x03 \x01(\tR\buserType\x12%\n" +
 	"\x0eoriginal_roles\x18\x04 \x03(\tR\roriginalRoles\x12A\n" +
 	"\x0foriginal_traits\x18\x05 \x03(\v2\x18.teleport.trait.v1.TraitR\x0eoriginalTraits\x12V\n" +
-	"\x10git_hub_identity\x18\x06 \x01(\v2,.teleport.userloginstate.v1.ExternalIdentityR\x0egitHubIdentity\"G\n" +
+	"\x10git_hub_identity\x18\x06 \x01(\v2,.teleport.userloginstate.v1.ExternalIdentityR\x0egitHubIdentity\x12U\n" +
+	"\x0fsaml_identities\x18\a \x03(\v2,.teleport.userloginstate.v1.ExternalIdentityR\x0esamlIdentities\x12*\n" +
+	"\x11access_list_roles\x18\b \x03(\tR\x0faccessListRoles\x12F\n" +
+	"\x12access_list_traits\x18\t \x03(\v2\x18.teleport.trait.v1.TraitR\x10accessListTraits\"\xd0\x01\n" +
 	"\x10ExternalIdentity\x12\x17\n" +
 	"\auser_id\x18\x01 \x01(\tR\x06userId\x12\x1a\n" +
-	"\busername\x18\x02 \x01(\tR\busernameB`Z^github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1;userloginstatev1b\x06proto3"
+	"\busername\x18\x02 \x01(\tR\busername\x12!\n" +
+	"\fconnector_id\x18\x03 \x01(\tR\vconnectorId\x12#\n" +
+	"\rgranted_roles\x18\x04 \x03(\tR\fgrantedRoles\x12?\n" +
+	"\x0egranted_traits\x18\x05 \x03(\v2\x18.teleport.trait.v1.TraitR\rgrantedTraitsB`Z^github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1;userloginstatev1b\x06proto3"
 
 var (
 	file_teleport_userloginstate_v1_userloginstate_proto_rawDescOnce sync.Once
@@ -286,11 +372,14 @@ var file_teleport_userloginstate_v1_userloginstate_proto_depIdxs = []int32{
 	4, // 2: teleport.userloginstate.v1.Spec.traits:type_name -> teleport.trait.v1.Trait
 	4, // 3: teleport.userloginstate.v1.Spec.original_traits:type_name -> teleport.trait.v1.Trait
 	2, // 4: teleport.userloginstate.v1.Spec.git_hub_identity:type_name -> teleport.userloginstate.v1.ExternalIdentity
-	5, // [5:5] is the sub-list for method output_type
-	5, // [5:5] is the sub-list for method input_type
-	5, // [5:5] is the sub-list for extension type_name
-	5, // [5:5] is the sub-list for extension extendee
-	0, // [0:5] is the sub-list for field type_name
+	2, // 5: teleport.userloginstate.v1.Spec.saml_identities:type_name -> teleport.userloginstate.v1.ExternalIdentity
+	4, // 6: teleport.userloginstate.v1.Spec.access_list_traits:type_name -> teleport.trait.v1.Trait
+	4, // 7: teleport.userloginstate.v1.ExternalIdentity.granted_traits:type_name -> teleport.trait.v1.Trait
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_teleport_userloginstate_v1_userloginstate_proto_init() }
diff --git a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service.pb.go b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service.pb.go
index fbe19a0f0d065..58fd0bcb10478 100644
--- a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service.pb.go
+++ b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userloginstate/v1/userloginstate_service.proto
 
@@ -294,6 +294,116 @@ func (*DeleteAllUserLoginStatesRequest) Descriptor() ([]byte, []int) {
 	return file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescGZIP(), []int{5}
 }
 
+// ListUserLoginStatesRequest is the request for listing user login states with pagination.
+type ListUserLoginStatesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// page_size is the maximum number of user login states to return.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// page_token is the token for the next page of results.
+	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserLoginStatesRequest) Reset() {
+	*x = ListUserLoginStatesRequest{}
+	mi := &file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserLoginStatesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserLoginStatesRequest) ProtoMessage() {}
+
+func (x *ListUserLoginStatesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserLoginStatesRequest.ProtoReflect.Descriptor instead.
+func (*ListUserLoginStatesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ListUserLoginStatesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListUserLoginStatesRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// ListUserLoginStatesResponse is the response for listing user login states with pagination.
+type ListUserLoginStatesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// user_login_states is the list of user login states.
+	UserLoginStates []*UserLoginState `protobuf:"bytes,1,rep,name=user_login_states,json=userLoginStates,proto3" json:"user_login_states,omitempty"`
+	// next_page_token is the token for the next page of results.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserLoginStatesResponse) Reset() {
+	*x = ListUserLoginStatesResponse{}
+	mi := &file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserLoginStatesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserLoginStatesResponse) ProtoMessage() {}
+
+func (x *ListUserLoginStatesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserLoginStatesResponse.ProtoReflect.Descriptor instead.
+func (*ListUserLoginStatesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *ListUserLoginStatesResponse) GetUserLoginStates() []*UserLoginState {
+	if x != nil {
+		return x.UserLoginStates
+	}
+	return nil
+}
+
+func (x *ListUserLoginStatesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 var File_teleport_userloginstate_v1_userloginstate_service_proto protoreflect.FileDescriptor
 
 const file_teleport_userloginstate_v1_userloginstate_service_proto_rawDesc = "" +
@@ -308,13 +418,21 @@ const file_teleport_userloginstate_v1_userloginstate_service_proto_rawDesc = ""
 	"\x10user_login_state\x18\x01 \x01(\v2*.teleport.userloginstate.v1.UserLoginStateR\x0euserLoginState\"1\n" +
 	"\x1bDeleteUserLoginStateRequest\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\"!\n" +
-	"\x1fDeleteAllUserLoginStatesRequest2\xeb\x04\n" +
+	"\x1fDeleteAllUserLoginStatesRequest\"X\n" +
+	"\x1aListUserLoginStatesRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\x9d\x01\n" +
+	"\x1bListUserLoginStatesResponse\x12V\n" +
+	"\x11user_login_states\x18\x01 \x03(\v2*.teleport.userloginstate.v1.UserLoginStateR\x0fuserLoginStates\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\xf4\x05\n" +
 	"\x15UserLoginStateService\x12\x83\x01\n" +
 	"\x12GetUserLoginStates\x125.teleport.userloginstate.v1.GetUserLoginStatesRequest\x1a6.teleport.userloginstate.v1.GetUserLoginStatesResponse\x12u\n" +
 	"\x11GetUserLoginState\x124.teleport.userloginstate.v1.GetUserLoginStateRequest\x1a*.teleport.userloginstate.v1.UserLoginState\x12{\n" +
 	"\x14UpsertUserLoginState\x127.teleport.userloginstate.v1.UpsertUserLoginStateRequest\x1a*.teleport.userloginstate.v1.UserLoginState\x12g\n" +
 	"\x14DeleteUserLoginState\x127.teleport.userloginstate.v1.DeleteUserLoginStateRequest\x1a\x16.google.protobuf.Empty\x12o\n" +
-	"\x18DeleteAllUserLoginStates\x12;.teleport.userloginstate.v1.DeleteAllUserLoginStatesRequest\x1a\x16.google.protobuf.EmptyB`Z^github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1;userloginstatev1b\x06proto3"
+	"\x18DeleteAllUserLoginStates\x12;.teleport.userloginstate.v1.DeleteAllUserLoginStatesRequest\x1a\x16.google.protobuf.Empty\x12\x86\x01\n" +
+	"\x13ListUserLoginStates\x126.teleport.userloginstate.v1.ListUserLoginStatesRequest\x1a7.teleport.userloginstate.v1.ListUserLoginStatesResponseB`Z^github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1;userloginstatev1b\x06proto3"
 
 var (
 	file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescOnce sync.Once
@@ -328,7 +446,7 @@ func file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescGZIP()
 	return file_teleport_userloginstate_v1_userloginstate_service_proto_rawDescData
 }
 
-var file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_teleport_userloginstate_v1_userloginstate_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_teleport_userloginstate_v1_userloginstate_service_proto_goTypes = []any{
 	(*GetUserLoginStatesRequest)(nil),       // 0: teleport.userloginstate.v1.GetUserLoginStatesRequest
 	(*GetUserLoginStatesResponse)(nil),      // 1: teleport.userloginstate.v1.GetUserLoginStatesResponse
@@ -336,27 +454,32 @@ var file_teleport_userloginstate_v1_userloginstate_service_proto_goTypes = []any
 	(*UpsertUserLoginStateRequest)(nil),     // 3: teleport.userloginstate.v1.UpsertUserLoginStateRequest
 	(*DeleteUserLoginStateRequest)(nil),     // 4: teleport.userloginstate.v1.DeleteUserLoginStateRequest
 	(*DeleteAllUserLoginStatesRequest)(nil), // 5: teleport.userloginstate.v1.DeleteAllUserLoginStatesRequest
-	(*UserLoginState)(nil),                  // 6: teleport.userloginstate.v1.UserLoginState
-	(*emptypb.Empty)(nil),                   // 7: google.protobuf.Empty
+	(*ListUserLoginStatesRequest)(nil),      // 6: teleport.userloginstate.v1.ListUserLoginStatesRequest
+	(*ListUserLoginStatesResponse)(nil),     // 7: teleport.userloginstate.v1.ListUserLoginStatesResponse
+	(*UserLoginState)(nil),                  // 8: teleport.userloginstate.v1.UserLoginState
+	(*emptypb.Empty)(nil),                   // 9: google.protobuf.Empty
 }
 var file_teleport_userloginstate_v1_userloginstate_service_proto_depIdxs = []int32{
-	6, // 0: teleport.userloginstate.v1.GetUserLoginStatesResponse.user_login_states:type_name -> teleport.userloginstate.v1.UserLoginState
-	6, // 1: teleport.userloginstate.v1.UpsertUserLoginStateRequest.user_login_state:type_name -> teleport.userloginstate.v1.UserLoginState
-	0, // 2: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginStates:input_type -> teleport.userloginstate.v1.GetUserLoginStatesRequest
-	2, // 3: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginState:input_type -> teleport.userloginstate.v1.GetUserLoginStateRequest
-	3, // 4: teleport.userloginstate.v1.UserLoginStateService.UpsertUserLoginState:input_type -> teleport.userloginstate.v1.UpsertUserLoginStateRequest
-	4, // 5: teleport.userloginstate.v1.UserLoginStateService.DeleteUserLoginState:input_type -> teleport.userloginstate.v1.DeleteUserLoginStateRequest
-	5, // 6: teleport.userloginstate.v1.UserLoginStateService.DeleteAllUserLoginStates:input_type -> teleport.userloginstate.v1.DeleteAllUserLoginStatesRequest
-	1, // 7: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginStates:output_type -> teleport.userloginstate.v1.GetUserLoginStatesResponse
-	6, // 8: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginState:output_type -> teleport.userloginstate.v1.UserLoginState
-	6, // 9: teleport.userloginstate.v1.UserLoginStateService.UpsertUserLoginState:output_type -> teleport.userloginstate.v1.UserLoginState
-	7, // 10: teleport.userloginstate.v1.UserLoginStateService.DeleteUserLoginState:output_type -> google.protobuf.Empty
-	7, // 11: teleport.userloginstate.v1.UserLoginStateService.DeleteAllUserLoginStates:output_type -> google.protobuf.Empty
-	7, // [7:12] is the sub-list for method output_type
-	2, // [2:7] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	8, // 0: teleport.userloginstate.v1.GetUserLoginStatesResponse.user_login_states:type_name -> teleport.userloginstate.v1.UserLoginState
+	8, // 1: teleport.userloginstate.v1.UpsertUserLoginStateRequest.user_login_state:type_name -> teleport.userloginstate.v1.UserLoginState
+	8, // 2: teleport.userloginstate.v1.ListUserLoginStatesResponse.user_login_states:type_name -> teleport.userloginstate.v1.UserLoginState
+	0, // 3: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginStates:input_type -> teleport.userloginstate.v1.GetUserLoginStatesRequest
+	2, // 4: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginState:input_type -> teleport.userloginstate.v1.GetUserLoginStateRequest
+	3, // 5: teleport.userloginstate.v1.UserLoginStateService.UpsertUserLoginState:input_type -> teleport.userloginstate.v1.UpsertUserLoginStateRequest
+	4, // 6: teleport.userloginstate.v1.UserLoginStateService.DeleteUserLoginState:input_type -> teleport.userloginstate.v1.DeleteUserLoginStateRequest
+	5, // 7: teleport.userloginstate.v1.UserLoginStateService.DeleteAllUserLoginStates:input_type -> teleport.userloginstate.v1.DeleteAllUserLoginStatesRequest
+	6, // 8: teleport.userloginstate.v1.UserLoginStateService.ListUserLoginStates:input_type -> teleport.userloginstate.v1.ListUserLoginStatesRequest
+	1, // 9: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginStates:output_type -> teleport.userloginstate.v1.GetUserLoginStatesResponse
+	8, // 10: teleport.userloginstate.v1.UserLoginStateService.GetUserLoginState:output_type -> teleport.userloginstate.v1.UserLoginState
+	8, // 11: teleport.userloginstate.v1.UserLoginStateService.UpsertUserLoginState:output_type -> teleport.userloginstate.v1.UserLoginState
+	9, // 12: teleport.userloginstate.v1.UserLoginStateService.DeleteUserLoginState:output_type -> google.protobuf.Empty
+	9, // 13: teleport.userloginstate.v1.UserLoginStateService.DeleteAllUserLoginStates:output_type -> google.protobuf.Empty
+	7, // 14: teleport.userloginstate.v1.UserLoginStateService.ListUserLoginStates:output_type -> teleport.userloginstate.v1.ListUserLoginStatesResponse
+	9, // [9:15] is the sub-list for method output_type
+	3, // [3:9] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_teleport_userloginstate_v1_userloginstate_service_proto_init() }
@@ -371,7 +494,7 @@ func file_teleport_userloginstate_v1_userloginstate_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_userloginstate_v1_userloginstate_service_proto_rawDesc), len(file_teleport_userloginstate_v1_userloginstate_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
index 8258f7d85f09b..7821a4bd3130c 100644
--- a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
@@ -39,6 +39,7 @@ const (
 	UserLoginStateService_UpsertUserLoginState_FullMethodName     = "/teleport.userloginstate.v1.UserLoginStateService/UpsertUserLoginState"
 	UserLoginStateService_DeleteUserLoginState_FullMethodName     = "/teleport.userloginstate.v1.UserLoginStateService/DeleteUserLoginState"
 	UserLoginStateService_DeleteAllUserLoginStates_FullMethodName = "/teleport.userloginstate.v1.UserLoginStateService/DeleteAllUserLoginStates"
+	UserLoginStateService_ListUserLoginStates_FullMethodName      = "/teleport.userloginstate.v1.UserLoginStateService/ListUserLoginStates"
 )
 
 // UserLoginStateServiceClient is the client API for UserLoginStateService service.
@@ -48,6 +49,7 @@ const (
 // UserLoginStateService provides CRUD methods for user login state resources.
 type UserLoginStateServiceClient interface {
 	// GetUserLoginStates returns a list of all user login states.
+	// Deprecated: Use ListUserLoginStates instead.
 	GetUserLoginStates(ctx context.Context, in *GetUserLoginStatesRequest, opts ...grpc.CallOption) (*GetUserLoginStatesResponse, error)
 	// GetUserLoginState returns the specified user login state resource.
 	GetUserLoginState(ctx context.Context, in *GetUserLoginStateRequest, opts ...grpc.CallOption) (*UserLoginState, error)
@@ -57,6 +59,8 @@ type UserLoginStateServiceClient interface {
 	DeleteUserLoginState(ctx context.Context, in *DeleteUserLoginStateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// DeleteAllUserLoginStates hard deletes all user login states.
 	DeleteAllUserLoginStates(ctx context.Context, in *DeleteAllUserLoginStatesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// ListUserLoginStates lists all user login states allowing for pagination.
+	ListUserLoginStates(ctx context.Context, in *ListUserLoginStatesRequest, opts ...grpc.CallOption) (*ListUserLoginStatesResponse, error)
 }
 
 type userLoginStateServiceClient struct {
@@ -117,6 +121,16 @@ func (c *userLoginStateServiceClient) DeleteAllUserLoginStates(ctx context.Conte
 	return out, nil
 }
 
+func (c *userLoginStateServiceClient) ListUserLoginStates(ctx context.Context, in *ListUserLoginStatesRequest, opts ...grpc.CallOption) (*ListUserLoginStatesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListUserLoginStatesResponse)
+	err := c.cc.Invoke(ctx, UserLoginStateService_ListUserLoginStates_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // UserLoginStateServiceServer is the server API for UserLoginStateService service.
 // All implementations must embed UnimplementedUserLoginStateServiceServer
 // for forward compatibility.
@@ -124,6 +138,7 @@ func (c *userLoginStateServiceClient) DeleteAllUserLoginStates(ctx context.Conte
 // UserLoginStateService provides CRUD methods for user login state resources.
 type UserLoginStateServiceServer interface {
 	// GetUserLoginStates returns a list of all user login states.
+	// Deprecated: Use ListUserLoginStates instead.
 	GetUserLoginStates(context.Context, *GetUserLoginStatesRequest) (*GetUserLoginStatesResponse, error)
 	// GetUserLoginState returns the specified user login state resource.
 	GetUserLoginState(context.Context, *GetUserLoginStateRequest) (*UserLoginState, error)
@@ -133,6 +148,8 @@ type UserLoginStateServiceServer interface {
 	DeleteUserLoginState(context.Context, *DeleteUserLoginStateRequest) (*emptypb.Empty, error)
 	// DeleteAllUserLoginStates hard deletes all user login states.
 	DeleteAllUserLoginStates(context.Context, *DeleteAllUserLoginStatesRequest) (*emptypb.Empty, error)
+	// ListUserLoginStates lists all user login states allowing for pagination.
+	ListUserLoginStates(context.Context, *ListUserLoginStatesRequest) (*ListUserLoginStatesResponse, error)
 	mustEmbedUnimplementedUserLoginStateServiceServer()
 }
 
@@ -158,6 +175,9 @@ func (UnimplementedUserLoginStateServiceServer) DeleteUserLoginState(context.Con
 func (UnimplementedUserLoginStateServiceServer) DeleteAllUserLoginStates(context.Context, *DeleteAllUserLoginStatesRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteAllUserLoginStates not implemented")
 }
+func (UnimplementedUserLoginStateServiceServer) ListUserLoginStates(context.Context, *ListUserLoginStatesRequest) (*ListUserLoginStatesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListUserLoginStates not implemented")
+}
 func (UnimplementedUserLoginStateServiceServer) mustEmbedUnimplementedUserLoginStateServiceServer() {}
 func (UnimplementedUserLoginStateServiceServer) testEmbeddedByValue()                               {}
 
@@ -269,6 +289,24 @@ func _UserLoginStateService_DeleteAllUserLoginStates_Handler(srv interface{}, ct
 	return interceptor(ctx, in, info, handler)
 }
 
+func _UserLoginStateService_ListUserLoginStates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListUserLoginStatesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserLoginStateServiceServer).ListUserLoginStates(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserLoginStateService_ListUserLoginStates_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserLoginStateServiceServer).ListUserLoginStates(ctx, req.(*ListUserLoginStatesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // UserLoginStateService_ServiceDesc is the grpc.ServiceDesc for UserLoginStateService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -296,6 +334,10 @@ var UserLoginStateService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteAllUserLoginStates",
 			Handler:    _UserLoginStateService_DeleteAllUserLoginStates_Handler,
 		},
+		{
+			MethodName: "ListUserLoginStates",
+			Handler:    _UserLoginStateService_ListUserLoginStates_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/userloginstate/v1/userloginstate_service.proto",
diff --git a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
index 92af7aeccb23b..e1b2cc8f159c6 100644
--- a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
+++ b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userprovisioning/v2/statichostuser.proto
 
diff --git a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser_service.pb.go b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser_service.pb.go
index 9b0468c6077d4..31108fb5b7607 100644
--- a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser_service.pb.go
+++ b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userprovisioning/v2/statichostuser_service.proto
 
diff --git a/api/gen/proto/go/teleport/users/v1/users_service.pb.go b/api/gen/proto/go/teleport/users/v1/users_service.pb.go
index daf57063ad614..499a634461624 100644
--- a/api/gen/proto/go/teleport/users/v1/users_service.pb.go
+++ b/api/gen/proto/go/teleport/users/v1/users_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/users/v1/users_service.proto
 
diff --git a/api/gen/proto/go/teleport/usertasks/v1/user_tasks.pb.go b/api/gen/proto/go/teleport/usertasks/v1/user_tasks.pb.go
index c1f127ffa1a8a..7785888ea64c6 100644
--- a/api/gen/proto/go/teleport/usertasks/v1/user_tasks.pb.go
+++ b/api/gen/proto/go/teleport/usertasks/v1/user_tasks.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/usertasks/v1/user_tasks.proto
 
diff --git a/api/gen/proto/go/teleport/usertasks/v1/user_tasks_service.pb.go b/api/gen/proto/go/teleport/usertasks/v1/user_tasks_service.pb.go
index 877021278caef..faa3096a05f05 100644
--- a/api/gen/proto/go/teleport/usertasks/v1/user_tasks_service.pb.go
+++ b/api/gen/proto/go/teleport/usertasks/v1/user_tasks_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/usertasks/v1/user_tasks_service.proto
 
diff --git a/api/gen/proto/go/teleport/vnet/v1/vnet_config.pb.go b/api/gen/proto/go/teleport/vnet/v1/vnet_config.pb.go
index 13ba70217da19..52fbe32ff0a4e 100644
--- a/api/gen/proto/go/teleport/vnet/v1/vnet_config.pb.go
+++ b/api/gen/proto/go/teleport/vnet/v1/vnet_config.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/vnet/v1/vnet_config.proto
 
diff --git a/api/gen/proto/go/teleport/vnet/v1/vnet_config_service.pb.go b/api/gen/proto/go/teleport/vnet/v1/vnet_config_service.pb.go
index 3e92203f78e82..e4f35c78ca2e4 100644
--- a/api/gen/proto/go/teleport/vnet/v1/vnet_config_service.pb.go
+++ b/api/gen/proto/go/teleport/vnet/v1/vnet_config_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/vnet/v1/vnet_config_service.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/attrs.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/attrs.pb.go
index 40fc920806d44..368d21cdcd5cf 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/attrs.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/attrs.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/attrs.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/issuance_service.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/issuance_service.pb.go
index 14ffe10e8f6c2..c54e76b8ce608 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/issuance_service.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/issuance_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/issuance_service.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/join_attrs.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/join_attrs.pb.go
index 1a9b1978765f5..1d52ebfbf83a2 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/join_attrs.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/join_attrs.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/join_attrs.proto
 
@@ -66,7 +66,9 @@ type JoinAttrs struct {
 	// Attributes that are specific to the Oracle (`oracle`) join method.
 	Oracle *JoinAttrsOracle `protobuf:"bytes,13,opt,name=oracle,proto3" json:"oracle,omitempty"`
 	// Attributes that are specific to the Azure Devops (`azure_devops`) join method.
-	AzureDevops   *JoinAttrsAzureDevops `protobuf:"bytes,14,opt,name=azure_devops,json=azureDevops,proto3" json:"azure_devops,omitempty"`
+	AzureDevops *JoinAttrsAzureDevops `protobuf:"bytes,14,opt,name=azure_devops,json=azureDevops,proto3" json:"azure_devops,omitempty"`
+	// Attributes that are specific to the Env0 (`env0`) join method.
+	Env0          *JoinAttrsEnv0 `protobuf:"bytes,15,opt,name=env0,proto3" json:"env0,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -199,6 +201,13 @@ func (x *JoinAttrs) GetAzureDevops() *JoinAttrsAzureDevops {
 	return nil
 }
 
+func (x *JoinAttrs) GetEnv0() *JoinAttrsEnv0 {
+	if x != nil {
+		return x.Env0
+	}
+	return nil
+}
+
 // The collection of attributes that result from the join process but are not
 // specific to any particular join method.
 type JoinAttrsMeta struct {
@@ -1717,11 +1726,176 @@ func (x *JoinAttrsAzureDevopsPipeline) GetRunId() string {
 	return ""
 }
 
+// Attributes that are specific to the Env0 (`env0`) join method.
+type JoinAttrsEnv0 struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The `sub` claim of an Env0 OIDC token.
+	Sub string `protobuf:"bytes,1,opt,name=sub,proto3" json:"sub,omitempty"`
+	// The unique organization identifier, corresponding to `organizationId` in an
+	// Env0 OIDC token.
+	OrganizationId string `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
+	// The unique project identifier, corresponding to `projectId` in an Env0 OIDC
+	// token.
+	ProjectId string `protobuf:"bytes,3,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
+	// The name of the project under which the job was run corresponding to
+	// `projectName` in an Env0 OIDC token.
+	ProjectName string `protobuf:"bytes,4,opt,name=project_name,json=projectName,proto3" json:"project_name,omitempty"`
+	// The unique identifier of the Env0 template, corresponding to `templateId`
+	// in an Env0 OIDC token.
+	TemplateId string `protobuf:"bytes,5,opt,name=template_id,json=templateId,proto3" json:"template_id,omitempty"`
+	// The name of the Env0 template, corresponding to `templateName` in an Env0
+	// OIDC token.
+	TemplateName string `protobuf:"bytes,6,opt,name=template_name,json=templateName,proto3" json:"template_name,omitempty"`
+	// The unique identifier of the Env0 environment, corresponding to
+	// `environmentId` in an Env0 OIDC token.
+	EnvironmentId string `protobuf:"bytes,7,opt,name=environment_id,json=environmentId,proto3" json:"environment_id,omitempty"`
+	// The name of the Env0 environment, corresponding to `environmentName` in an
+	// Env0 OIDC token.
+	EnvironmentName string `protobuf:"bytes,8,opt,name=environment_name,json=environmentName,proto3" json:"environment_name,omitempty"`
+	// The name of the Env0 workspace, corresponding to `workspaceName` in an Env0
+	// OIDC token.
+	WorkspaceName string `protobuf:"bytes,9,opt,name=workspace_name,json=workspaceName,proto3" json:"workspace_name,omitempty"`
+	// A unique ID for this deployment, corresponding to `deploymentLogId` in an
+	// Env0 OIDC token.
+	DeploymentLogId string `protobuf:"bytes,10,opt,name=deployment_log_id,json=deploymentLogId,proto3" json:"deployment_log_id,omitempty"`
+	// The env0 deployment type, such as "deploy", "destroy", etc. Corresponds to
+	// `deploymentType` in an Env0 OIDC token.
+	DeploymentType string `protobuf:"bytes,11,opt,name=deployment_type,json=deploymentType,proto3" json:"deployment_type,omitempty"`
+	// The email of the person that triggered the deployment, corresponding to
+	// `deployerEmail` in an Env0 OIDC token.
+	DeployerEmail string `protobuf:"bytes,12,opt,name=deployer_email,json=deployerEmail,proto3" json:"deployer_email,omitempty"`
+	// A custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.
+	Env0Tag       string `protobuf:"bytes,13,opt,name=env0_tag,json=env0Tag,proto3" json:"env0_tag,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *JoinAttrsEnv0) Reset() {
+	*x = JoinAttrsEnv0{}
+	mi := &file_teleport_workloadidentity_v1_join_attrs_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *JoinAttrsEnv0) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*JoinAttrsEnv0) ProtoMessage() {}
+
+func (x *JoinAttrsEnv0) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_workloadidentity_v1_join_attrs_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use JoinAttrsEnv0.ProtoReflect.Descriptor instead.
+func (*JoinAttrsEnv0) Descriptor() ([]byte, []int) {
+	return file_teleport_workloadidentity_v1_join_attrs_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *JoinAttrsEnv0) GetSub() string {
+	if x != nil {
+		return x.Sub
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetOrganizationId() string {
+	if x != nil {
+		return x.OrganizationId
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetProjectId() string {
+	if x != nil {
+		return x.ProjectId
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetProjectName() string {
+	if x != nil {
+		return x.ProjectName
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetTemplateId() string {
+	if x != nil {
+		return x.TemplateId
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetTemplateName() string {
+	if x != nil {
+		return x.TemplateName
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetEnvironmentId() string {
+	if x != nil {
+		return x.EnvironmentId
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetEnvironmentName() string {
+	if x != nil {
+		return x.EnvironmentName
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetWorkspaceName() string {
+	if x != nil {
+		return x.WorkspaceName
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetDeploymentLogId() string {
+	if x != nil {
+		return x.DeploymentLogId
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetDeploymentType() string {
+	if x != nil {
+		return x.DeploymentType
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetDeployerEmail() string {
+	if x != nil {
+		return x.DeployerEmail
+	}
+	return ""
+}
+
+func (x *JoinAttrsEnv0) GetEnv0Tag() string {
+	if x != nil {
+		return x.Env0Tag
+	}
+	return ""
+}
+
 var File_teleport_workloadidentity_v1_join_attrs_proto protoreflect.FileDescriptor
 
 const file_teleport_workloadidentity_v1_join_attrs_proto_rawDesc = "" +
 	"\n" +
-	"-teleport/workloadidentity/v1/join_attrs.proto\x12\x1cteleport.workloadidentity.v1\"\x99\b\n" +
+	"-teleport/workloadidentity/v1/join_attrs.proto\x12\x1cteleport.workloadidentity.v1\"\xda\b\n" +
 	"\tJoinAttrs\x12?\n" +
 	"\x04meta\x18\x01 \x01(\v2+.teleport.workloadidentity.v1.JoinAttrsMetaR\x04meta\x12E\n" +
 	"\x06gitlab\x18\x02 \x01(\v2-.teleport.workloadidentity.v1.JoinAttrsGitLabR\x06gitlab\x12E\n" +
@@ -1739,7 +1913,8 @@ const file_teleport_workloadidentity_v1_join_attrs_proto_rawDesc = "" +
 	"kubernetes\x18\f \x01(\v21.teleport.workloadidentity.v1.JoinAttrsKubernetesR\n" +
 	"kubernetes\x12E\n" +
 	"\x06oracle\x18\r \x01(\v2-.teleport.workloadidentity.v1.JoinAttrsOracleR\x06oracle\x12U\n" +
-	"\fazure_devops\x18\x0e \x01(\v22.teleport.workloadidentity.v1.JoinAttrsAzureDevopsR\vazureDevops\"X\n" +
+	"\fazure_devops\x18\x0e \x01(\v22.teleport.workloadidentity.v1.JoinAttrsAzureDevopsR\vazureDevops\x12?\n" +
+	"\x04env0\x18\x0f \x01(\v2+.teleport.workloadidentity.v1.JoinAttrsEnv0R\x04env0\"X\n" +
 	"\rJoinAttrsMeta\x12&\n" +
 	"\x0fjoin_token_name\x18\x01 \x01(\tR\rjoinTokenName\x12\x1f\n" +
 	"\vjoin_method\x18\x02 \x01(\tR\n" +
@@ -1862,7 +2037,24 @@ const file_teleport_workloadidentity_v1_join_attrs_proto_rawDesc = "" +
 	"\x12repository_version\x18\t \x01(\tR\x11repositoryVersion\x12%\n" +
 	"\x0erepository_ref\x18\n" +
 	" \x01(\tR\rrepositoryRef\x12\x15\n" +
-	"\x06run_id\x18\v \x01(\tR\x05runIdBdZbgithub.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1;workloadidentityv1b\x06proto3"
+	"\x06run_id\x18\v \x01(\tR\x05runId\"\xe2\x03\n" +
+	"\rJoinAttrsEnv0\x12\x10\n" +
+	"\x03sub\x18\x01 \x01(\tR\x03sub\x12'\n" +
+	"\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x1d\n" +
+	"\n" +
+	"project_id\x18\x03 \x01(\tR\tprojectId\x12!\n" +
+	"\fproject_name\x18\x04 \x01(\tR\vprojectName\x12\x1f\n" +
+	"\vtemplate_id\x18\x05 \x01(\tR\n" +
+	"templateId\x12#\n" +
+	"\rtemplate_name\x18\x06 \x01(\tR\ftemplateName\x12%\n" +
+	"\x0eenvironment_id\x18\a \x01(\tR\renvironmentId\x12)\n" +
+	"\x10environment_name\x18\b \x01(\tR\x0fenvironmentName\x12%\n" +
+	"\x0eworkspace_name\x18\t \x01(\tR\rworkspaceName\x12*\n" +
+	"\x11deployment_log_id\x18\n" +
+	" \x01(\tR\x0fdeploymentLogId\x12'\n" +
+	"\x0fdeployment_type\x18\v \x01(\tR\x0edeploymentType\x12%\n" +
+	"\x0edeployer_email\x18\f \x01(\tR\rdeployerEmail\x12\x19\n" +
+	"\benv0_tag\x18\r \x01(\tR\aenv0TagBdZbgithub.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1;workloadidentityv1b\x06proto3"
 
 var (
 	file_teleport_workloadidentity_v1_join_attrs_proto_rawDescOnce sync.Once
@@ -1876,7 +2068,7 @@ func file_teleport_workloadidentity_v1_join_attrs_proto_rawDescGZIP() []byte {
 	return file_teleport_workloadidentity_v1_join_attrs_proto_rawDescData
 }
 
-var file_teleport_workloadidentity_v1_join_attrs_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_teleport_workloadidentity_v1_join_attrs_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
 var file_teleport_workloadidentity_v1_join_attrs_proto_goTypes = []any{
 	(*JoinAttrs)(nil),                         // 0: teleport.workloadidentity.v1.JoinAttrs
 	(*JoinAttrsMeta)(nil),                     // 1: teleport.workloadidentity.v1.JoinAttrsMeta
@@ -1897,6 +2089,7 @@ var file_teleport_workloadidentity_v1_join_attrs_proto_goTypes = []any{
 	(*JoinAttrsOracle)(nil),                   // 16: teleport.workloadidentity.v1.JoinAttrsOracle
 	(*JoinAttrsAzureDevops)(nil),              // 17: teleport.workloadidentity.v1.JoinAttrsAzureDevops
 	(*JoinAttrsAzureDevopsPipeline)(nil),      // 18: teleport.workloadidentity.v1.JoinAttrsAzureDevopsPipeline
+	(*JoinAttrsEnv0)(nil),                     // 19: teleport.workloadidentity.v1.JoinAttrsEnv0
 }
 var file_teleport_workloadidentity_v1_join_attrs_proto_depIdxs = []int32{
 	1,  // 0: teleport.workloadidentity.v1.JoinAttrs.meta:type_name -> teleport.workloadidentity.v1.JoinAttrsMeta
@@ -1913,15 +2106,16 @@ var file_teleport_workloadidentity_v1_join_attrs_proto_depIdxs = []int32{
 	15, // 11: teleport.workloadidentity.v1.JoinAttrs.kubernetes:type_name -> teleport.workloadidentity.v1.JoinAttrsKubernetes
 	16, // 12: teleport.workloadidentity.v1.JoinAttrs.oracle:type_name -> teleport.workloadidentity.v1.JoinAttrsOracle
 	17, // 13: teleport.workloadidentity.v1.JoinAttrs.azure_devops:type_name -> teleport.workloadidentity.v1.JoinAttrsAzureDevops
-	11, // 14: teleport.workloadidentity.v1.JoinAttrsGCP.gce:type_name -> teleport.workloadidentity.v1.JoinAttrsGCPGCE
-	14, // 15: teleport.workloadidentity.v1.JoinAttrsKubernetes.service_account:type_name -> teleport.workloadidentity.v1.JoinAttrsKubernetesServiceAccount
-	13, // 16: teleport.workloadidentity.v1.JoinAttrsKubernetes.pod:type_name -> teleport.workloadidentity.v1.JoinAttrsKubernetesPod
-	18, // 17: teleport.workloadidentity.v1.JoinAttrsAzureDevops.pipeline:type_name -> teleport.workloadidentity.v1.JoinAttrsAzureDevopsPipeline
-	18, // [18:18] is the sub-list for method output_type
-	18, // [18:18] is the sub-list for method input_type
-	18, // [18:18] is the sub-list for extension type_name
-	18, // [18:18] is the sub-list for extension extendee
-	0,  // [0:18] is the sub-list for field type_name
+	19, // 14: teleport.workloadidentity.v1.JoinAttrs.env0:type_name -> teleport.workloadidentity.v1.JoinAttrsEnv0
+	11, // 15: teleport.workloadidentity.v1.JoinAttrsGCP.gce:type_name -> teleport.workloadidentity.v1.JoinAttrsGCPGCE
+	14, // 16: teleport.workloadidentity.v1.JoinAttrsKubernetes.service_account:type_name -> teleport.workloadidentity.v1.JoinAttrsKubernetesServiceAccount
+	13, // 17: teleport.workloadidentity.v1.JoinAttrsKubernetes.pod:type_name -> teleport.workloadidentity.v1.JoinAttrsKubernetesPod
+	18, // 18: teleport.workloadidentity.v1.JoinAttrsAzureDevops.pipeline:type_name -> teleport.workloadidentity.v1.JoinAttrsAzureDevopsPipeline
+	19, // [19:19] is the sub-list for method output_type
+	19, // [19:19] is the sub-list for method input_type
+	19, // [19:19] is the sub-list for extension type_name
+	19, // [19:19] is the sub-list for extension extendee
+	0,  // [0:19] is the sub-list for field type_name
 }
 
 func init() { file_teleport_workloadidentity_v1_join_attrs_proto_init() }
@@ -1935,7 +2129,7 @@ func file_teleport_workloadidentity_v1_join_attrs_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_workloadidentity_v1_join_attrs_proto_rawDesc), len(file_teleport_workloadidentity_v1_join_attrs_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   19,
+			NumMessages:   20,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/resource.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/resource.pb.go
index fbb9d23983ea8..4d1396aa98b87 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/resource.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/resource.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/resource.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/resource_service.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/resource_service.pb.go
index 9d080a5b7e61c..334455226ba38 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/resource_service.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/resource_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/resource_service.proto
 
@@ -322,6 +322,89 @@ func (x *ListWorkloadIdentitiesRequest) GetPageToken() string {
 	return ""
 }
 
+// The request for ListWorkloadIdentitiesV2.
+type ListWorkloadIdentitiesV2Request struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The page_token value returned from a previous ListWorkloadIdentities request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// The sort field to use for the results. If empty, the default sort field is used.
+	SortField string `protobuf:"bytes,3,opt,name=sort_field,json=sortField,proto3" json:"sort_field,omitempty"`
+	// The sort order to use for the results. If empty, the default sort order is used.
+	SortDesc bool `protobuf:"varint,4,opt,name=sort_desc,json=sortDesc,proto3" json:"sort_desc,omitempty"`
+	// A search term used to filter the results. If non-empty, it's used to match against supported fields.
+	FilterSearchTerm string `protobuf:"bytes,5,opt,name=filter_search_term,json=filterSearchTerm,proto3" json:"filter_search_term,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *ListWorkloadIdentitiesV2Request) Reset() {
+	*x = ListWorkloadIdentitiesV2Request{}
+	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListWorkloadIdentitiesV2Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListWorkloadIdentitiesV2Request) ProtoMessage() {}
+
+func (x *ListWorkloadIdentitiesV2Request) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListWorkloadIdentitiesV2Request.ProtoReflect.Descriptor instead.
+func (*ListWorkloadIdentitiesV2Request) Descriptor() ([]byte, []int) {
+	return file_teleport_workloadidentity_v1_resource_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ListWorkloadIdentitiesV2Request) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListWorkloadIdentitiesV2Request) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListWorkloadIdentitiesV2Request) GetSortField() string {
+	if x != nil {
+		return x.SortField
+	}
+	return ""
+}
+
+func (x *ListWorkloadIdentitiesV2Request) GetSortDesc() bool {
+	if x != nil {
+		return x.SortDesc
+	}
+	return false
+}
+
+func (x *ListWorkloadIdentitiesV2Request) GetFilterSearchTerm() string {
+	if x != nil {
+		return x.FilterSearchTerm
+	}
+	return ""
+}
+
 // The response for ListWorkloadIdentities.
 type ListWorkloadIdentitiesResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -336,7 +419,7 @@ type ListWorkloadIdentitiesResponse struct {
 
 func (x *ListWorkloadIdentitiesResponse) Reset() {
 	*x = ListWorkloadIdentitiesResponse{}
-	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[6]
+	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -348,7 +431,7 @@ func (x *ListWorkloadIdentitiesResponse) String() string {
 func (*ListWorkloadIdentitiesResponse) ProtoMessage() {}
 
 func (x *ListWorkloadIdentitiesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[6]
+	mi := &file_teleport_workloadidentity_v1_resource_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -361,7 +444,7 @@ func (x *ListWorkloadIdentitiesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListWorkloadIdentitiesResponse.ProtoReflect.Descriptor instead.
 func (*ListWorkloadIdentitiesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_workloadidentity_v1_resource_service_proto_rawDescGZIP(), []int{6}
+	return file_teleport_workloadidentity_v1_resource_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ListWorkloadIdentitiesResponse) GetWorkloadIdentities() []*WorkloadIdentity {
@@ -396,17 +479,26 @@ const file_teleport_workloadidentity_v1_resource_service_proto_rawDesc = "" +
 	"\x1dListWorkloadIdentitiesRequest\x12\x1b\n" +
 	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
 	"\n" +
-	"page_token\x18\x02 \x01(\tR\tpageToken\"\xa9\x01\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\"\xc7\x01\n" +
+	"\x1fListWorkloadIdentitiesV2Request\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12\x1d\n" +
+	"\n" +
+	"sort_field\x18\x03 \x01(\tR\tsortField\x12\x1b\n" +
+	"\tsort_desc\x18\x04 \x01(\bR\bsortDesc\x12,\n" +
+	"\x12filter_search_term\x18\x05 \x01(\tR\x10filterSearchTerm\"\xa9\x01\n" +
 	"\x1eListWorkloadIdentitiesResponse\x12_\n" +
 	"\x13workload_identities\x18\x01 \x03(\v2..teleport.workloadidentity.v1.WorkloadIdentityR\x12workloadIdentities\x12&\n" +
-	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\xbf\x06\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\xd9\a\n" +
 	"\x1fWorkloadIdentityResourceService\x12\x85\x01\n" +
 	"\x16CreateWorkloadIdentity\x12;.teleport.workloadidentity.v1.CreateWorkloadIdentityRequest\x1a..teleport.workloadidentity.v1.WorkloadIdentity\x12\x85\x01\n" +
 	"\x16UpdateWorkloadIdentity\x12;.teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest\x1a..teleport.workloadidentity.v1.WorkloadIdentity\x12\x85\x01\n" +
 	"\x16UpsertWorkloadIdentity\x12;.teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest\x1a..teleport.workloadidentity.v1.WorkloadIdentity\x12\x7f\n" +
 	"\x13GetWorkloadIdentity\x128.teleport.workloadidentity.v1.GetWorkloadIdentityRequest\x1a..teleport.workloadidentity.v1.WorkloadIdentity\x12m\n" +
 	"\x16DeleteWorkloadIdentity\x12;.teleport.workloadidentity.v1.DeleteWorkloadIdentityRequest\x1a\x16.google.protobuf.Empty\x12\x93\x01\n" +
-	"\x16ListWorkloadIdentities\x12;.teleport.workloadidentity.v1.ListWorkloadIdentitiesRequest\x1a<.teleport.workloadidentity.v1.ListWorkloadIdentitiesResponseBdZbgithub.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1;workloadidentityv1b\x06proto3"
+	"\x16ListWorkloadIdentities\x12;.teleport.workloadidentity.v1.ListWorkloadIdentitiesRequest\x1a<.teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse\x12\x97\x01\n" +
+	"\x18ListWorkloadIdentitiesV2\x12=.teleport.workloadidentity.v1.ListWorkloadIdentitiesV2Request\x1a<.teleport.workloadidentity.v1.ListWorkloadIdentitiesResponseBdZbgithub.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1;workloadidentityv1b\x06proto3"
 
 var (
 	file_teleport_workloadidentity_v1_resource_service_proto_rawDescOnce sync.Once
@@ -420,37 +512,40 @@ func file_teleport_workloadidentity_v1_resource_service_proto_rawDescGZIP() []by
 	return file_teleport_workloadidentity_v1_resource_service_proto_rawDescData
 }
 
-var file_teleport_workloadidentity_v1_resource_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_teleport_workloadidentity_v1_resource_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_teleport_workloadidentity_v1_resource_service_proto_goTypes = []any{
-	(*CreateWorkloadIdentityRequest)(nil),  // 0: teleport.workloadidentity.v1.CreateWorkloadIdentityRequest
-	(*UpdateWorkloadIdentityRequest)(nil),  // 1: teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest
-	(*UpsertWorkloadIdentityRequest)(nil),  // 2: teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest
-	(*GetWorkloadIdentityRequest)(nil),     // 3: teleport.workloadidentity.v1.GetWorkloadIdentityRequest
-	(*DeleteWorkloadIdentityRequest)(nil),  // 4: teleport.workloadidentity.v1.DeleteWorkloadIdentityRequest
-	(*ListWorkloadIdentitiesRequest)(nil),  // 5: teleport.workloadidentity.v1.ListWorkloadIdentitiesRequest
-	(*ListWorkloadIdentitiesResponse)(nil), // 6: teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse
-	(*WorkloadIdentity)(nil),               // 7: teleport.workloadidentity.v1.WorkloadIdentity
-	(*emptypb.Empty)(nil),                  // 8: google.protobuf.Empty
+	(*CreateWorkloadIdentityRequest)(nil),   // 0: teleport.workloadidentity.v1.CreateWorkloadIdentityRequest
+	(*UpdateWorkloadIdentityRequest)(nil),   // 1: teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest
+	(*UpsertWorkloadIdentityRequest)(nil),   // 2: teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest
+	(*GetWorkloadIdentityRequest)(nil),      // 3: teleport.workloadidentity.v1.GetWorkloadIdentityRequest
+	(*DeleteWorkloadIdentityRequest)(nil),   // 4: teleport.workloadidentity.v1.DeleteWorkloadIdentityRequest
+	(*ListWorkloadIdentitiesRequest)(nil),   // 5: teleport.workloadidentity.v1.ListWorkloadIdentitiesRequest
+	(*ListWorkloadIdentitiesV2Request)(nil), // 6: teleport.workloadidentity.v1.ListWorkloadIdentitiesV2Request
+	(*ListWorkloadIdentitiesResponse)(nil),  // 7: teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse
+	(*WorkloadIdentity)(nil),                // 8: teleport.workloadidentity.v1.WorkloadIdentity
+	(*emptypb.Empty)(nil),                   // 9: google.protobuf.Empty
 }
 var file_teleport_workloadidentity_v1_resource_service_proto_depIdxs = []int32{
-	7,  // 0: teleport.workloadidentity.v1.CreateWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 1: teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 2: teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 3: teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse.workload_identities:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 0: teleport.workloadidentity.v1.CreateWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 1: teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 2: teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest.workload_identity:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 3: teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse.workload_identities:type_name -> teleport.workloadidentity.v1.WorkloadIdentity
 	0,  // 4: teleport.workloadidentity.v1.WorkloadIdentityResourceService.CreateWorkloadIdentity:input_type -> teleport.workloadidentity.v1.CreateWorkloadIdentityRequest
 	1,  // 5: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpdateWorkloadIdentity:input_type -> teleport.workloadidentity.v1.UpdateWorkloadIdentityRequest
 	2,  // 6: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpsertWorkloadIdentity:input_type -> teleport.workloadidentity.v1.UpsertWorkloadIdentityRequest
 	3,  // 7: teleport.workloadidentity.v1.WorkloadIdentityResourceService.GetWorkloadIdentity:input_type -> teleport.workloadidentity.v1.GetWorkloadIdentityRequest
 	4,  // 8: teleport.workloadidentity.v1.WorkloadIdentityResourceService.DeleteWorkloadIdentity:input_type -> teleport.workloadidentity.v1.DeleteWorkloadIdentityRequest
 	5,  // 9: teleport.workloadidentity.v1.WorkloadIdentityResourceService.ListWorkloadIdentities:input_type -> teleport.workloadidentity.v1.ListWorkloadIdentitiesRequest
-	7,  // 10: teleport.workloadidentity.v1.WorkloadIdentityResourceService.CreateWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 11: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpdateWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 12: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpsertWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
-	7,  // 13: teleport.workloadidentity.v1.WorkloadIdentityResourceService.GetWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
-	8,  // 14: teleport.workloadidentity.v1.WorkloadIdentityResourceService.DeleteWorkloadIdentity:output_type -> google.protobuf.Empty
-	6,  // 15: teleport.workloadidentity.v1.WorkloadIdentityResourceService.ListWorkloadIdentities:output_type -> teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse
-	10, // [10:16] is the sub-list for method output_type
-	4,  // [4:10] is the sub-list for method input_type
+	6,  // 10: teleport.workloadidentity.v1.WorkloadIdentityResourceService.ListWorkloadIdentitiesV2:input_type -> teleport.workloadidentity.v1.ListWorkloadIdentitiesV2Request
+	8,  // 11: teleport.workloadidentity.v1.WorkloadIdentityResourceService.CreateWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 12: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpdateWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 13: teleport.workloadidentity.v1.WorkloadIdentityResourceService.UpsertWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
+	8,  // 14: teleport.workloadidentity.v1.WorkloadIdentityResourceService.GetWorkloadIdentity:output_type -> teleport.workloadidentity.v1.WorkloadIdentity
+	9,  // 15: teleport.workloadidentity.v1.WorkloadIdentityResourceService.DeleteWorkloadIdentity:output_type -> google.protobuf.Empty
+	7,  // 16: teleport.workloadidentity.v1.WorkloadIdentityResourceService.ListWorkloadIdentities:output_type -> teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse
+	7,  // 17: teleport.workloadidentity.v1.WorkloadIdentityResourceService.ListWorkloadIdentitiesV2:output_type -> teleport.workloadidentity.v1.ListWorkloadIdentitiesResponse
+	11, // [11:18] is the sub-list for method output_type
+	4,  // [4:11] is the sub-list for method input_type
 	4,  // [4:4] is the sub-list for extension type_name
 	4,  // [4:4] is the sub-list for extension extendee
 	0,  // [0:4] is the sub-list for field type_name
@@ -468,7 +563,7 @@ func file_teleport_workloadidentity_v1_resource_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_workloadidentity_v1_resource_service_proto_rawDesc), len(file_teleport_workloadidentity_v1_resource_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   7,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/resource_service_grpc.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/resource_service_grpc.pb.go
index aea5810b7f29a..b5a5b450eb248 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/resource_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/resource_service_grpc.pb.go
@@ -34,12 +34,13 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	WorkloadIdentityResourceService_CreateWorkloadIdentity_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/CreateWorkloadIdentity"
-	WorkloadIdentityResourceService_UpdateWorkloadIdentity_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/UpdateWorkloadIdentity"
-	WorkloadIdentityResourceService_UpsertWorkloadIdentity_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/UpsertWorkloadIdentity"
-	WorkloadIdentityResourceService_GetWorkloadIdentity_FullMethodName    = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/GetWorkloadIdentity"
-	WorkloadIdentityResourceService_DeleteWorkloadIdentity_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/DeleteWorkloadIdentity"
-	WorkloadIdentityResourceService_ListWorkloadIdentities_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/ListWorkloadIdentities"
+	WorkloadIdentityResourceService_CreateWorkloadIdentity_FullMethodName   = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/CreateWorkloadIdentity"
+	WorkloadIdentityResourceService_UpdateWorkloadIdentity_FullMethodName   = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/UpdateWorkloadIdentity"
+	WorkloadIdentityResourceService_UpsertWorkloadIdentity_FullMethodName   = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/UpsertWorkloadIdentity"
+	WorkloadIdentityResourceService_GetWorkloadIdentity_FullMethodName      = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/GetWorkloadIdentity"
+	WorkloadIdentityResourceService_DeleteWorkloadIdentity_FullMethodName   = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/DeleteWorkloadIdentity"
+	WorkloadIdentityResourceService_ListWorkloadIdentities_FullMethodName   = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/ListWorkloadIdentities"
+	WorkloadIdentityResourceService_ListWorkloadIdentitiesV2_FullMethodName = "/teleport.workloadidentity.v1.WorkloadIdentityResourceService/ListWorkloadIdentitiesV2"
 )
 
 // WorkloadIdentityResourceServiceClient is the client API for WorkloadIdentityResourceService service.
@@ -69,6 +70,10 @@ type WorkloadIdentityResourceServiceClient interface {
 	// ListWorkloadIdentities of all workload identities, pagination semantics are
 	// applied.
 	ListWorkloadIdentities(ctx context.Context, in *ListWorkloadIdentitiesRequest, opts ...grpc.CallOption) (*ListWorkloadIdentitiesResponse, error)
+	// ListWorkloadIdentities of all workload identities, pagination semantics are
+	// applied. Sorting by name or spiffe id is supported, and results can be
+	// filtered using a search term
+	ListWorkloadIdentitiesV2(ctx context.Context, in *ListWorkloadIdentitiesV2Request, opts ...grpc.CallOption) (*ListWorkloadIdentitiesResponse, error)
 }
 
 type workloadIdentityResourceServiceClient struct {
@@ -139,6 +144,16 @@ func (c *workloadIdentityResourceServiceClient) ListWorkloadIdentities(ctx conte
 	return out, nil
 }
 
+func (c *workloadIdentityResourceServiceClient) ListWorkloadIdentitiesV2(ctx context.Context, in *ListWorkloadIdentitiesV2Request, opts ...grpc.CallOption) (*ListWorkloadIdentitiesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListWorkloadIdentitiesResponse)
+	err := c.cc.Invoke(ctx, WorkloadIdentityResourceService_ListWorkloadIdentitiesV2_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // WorkloadIdentityResourceServiceServer is the server API for WorkloadIdentityResourceService service.
 // All implementations must embed UnimplementedWorkloadIdentityResourceServiceServer
 // for forward compatibility.
@@ -166,6 +181,10 @@ type WorkloadIdentityResourceServiceServer interface {
 	// ListWorkloadIdentities of all workload identities, pagination semantics are
 	// applied.
 	ListWorkloadIdentities(context.Context, *ListWorkloadIdentitiesRequest) (*ListWorkloadIdentitiesResponse, error)
+	// ListWorkloadIdentities of all workload identities, pagination semantics are
+	// applied. Sorting by name or spiffe id is supported, and results can be
+	// filtered using a search term
+	ListWorkloadIdentitiesV2(context.Context, *ListWorkloadIdentitiesV2Request) (*ListWorkloadIdentitiesResponse, error)
 	mustEmbedUnimplementedWorkloadIdentityResourceServiceServer()
 }
 
@@ -194,6 +213,9 @@ func (UnimplementedWorkloadIdentityResourceServiceServer) DeleteWorkloadIdentity
 func (UnimplementedWorkloadIdentityResourceServiceServer) ListWorkloadIdentities(context.Context, *ListWorkloadIdentitiesRequest) (*ListWorkloadIdentitiesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListWorkloadIdentities not implemented")
 }
+func (UnimplementedWorkloadIdentityResourceServiceServer) ListWorkloadIdentitiesV2(context.Context, *ListWorkloadIdentitiesV2Request) (*ListWorkloadIdentitiesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListWorkloadIdentitiesV2 not implemented")
+}
 func (UnimplementedWorkloadIdentityResourceServiceServer) mustEmbedUnimplementedWorkloadIdentityResourceServiceServer() {
 }
 func (UnimplementedWorkloadIdentityResourceServiceServer) testEmbeddedByValue() {}
@@ -324,6 +346,24 @@ func _WorkloadIdentityResourceService_ListWorkloadIdentities_Handler(srv interfa
 	return interceptor(ctx, in, info, handler)
 }
 
+func _WorkloadIdentityResourceService_ListWorkloadIdentitiesV2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListWorkloadIdentitiesV2Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(WorkloadIdentityResourceServiceServer).ListWorkloadIdentitiesV2(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: WorkloadIdentityResourceService_ListWorkloadIdentitiesV2_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(WorkloadIdentityResourceServiceServer).ListWorkloadIdentitiesV2(ctx, req.(*ListWorkloadIdentitiesV2Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // WorkloadIdentityResourceService_ServiceDesc is the grpc.ServiceDesc for WorkloadIdentityResourceService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -355,6 +395,10 @@ var WorkloadIdentityResourceService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListWorkloadIdentities",
 			Handler:    _WorkloadIdentityResourceService_ListWorkloadIdentities_Handler,
 		},
+		{
+			MethodName: "ListWorkloadIdentitiesV2",
+			Handler:    _WorkloadIdentityResourceService_ListWorkloadIdentitiesV2_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/workloadidentity/v1/resource_service.proto",
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/revocation_resource.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/revocation_resource.pb.go
index d9735654b835e..261c3645e5e3e 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/revocation_resource.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/revocation_resource.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/revocation_resource.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/revocation_service.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/revocation_service.pb.go
index 8c049d2cbb0c1..499f04aa8fc70 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/revocation_service.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/revocation_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/revocation_service.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore.pb.go
index 3f56a003df20b..625f626cd4e64 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/sigstore.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_resource.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_resource.pb.go
index ce6ac39250656..11496aa972015 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_resource.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_resource.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/sigstore_policy_resource.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_service.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_service.pb.go
index 261c369bf45fd..cdd1ab555e18f 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_service.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/sigstore_policy_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/sigstore_policy_service.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides.pb.go
index 8e8a984e13416..70bc70727aec2 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/x509_overrides.proto
 
diff --git a/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides_service.pb.go b/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides_service.pb.go
index 32538c7fe3730..c4800091a054d 100644
--- a/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides_service.pb.go
+++ b/api/gen/proto/go/teleport/workloadidentity/v1/x509_overrides_service.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/workloadidentity/v1/x509_overrides_service.proto
 
diff --git a/api/gen/proto/go/usageevents/v1/usageevents.pb.go b/api/gen/proto/go/usageevents/v1/usageevents.pb.go
index ce2cd98cfa988..48d71b07f38e9 100644
--- a/api/gen/proto/go/usageevents/v1/usageevents.pb.go
+++ b/api/gen/proto/go/usageevents/v1/usageevents.pb.go
@@ -69,6 +69,9 @@ const (
 	DiscoverResource_DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD            DiscoverResource = 39
 	DiscoverResource_DISCOVER_RESOURCE_KUBERNETES_EKS                        DiscoverResource = 40
 	DiscoverResource_DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE               DiscoverResource = 41
+	DiscoverResource_DISCOVER_RESOURCE_MCP_STDIO                             DiscoverResource = 42
+	DiscoverResource_DISCOVER_RESOURCE_MCP_SSE                               DiscoverResource = 43
+	DiscoverResource_DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP                   DiscoverResource = 44
 )
 
 var DiscoverResource_name = map[int32]string{
@@ -114,6 +117,9 @@ var DiscoverResource_name = map[int32]string{
 	39: "DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD",
 	40: "DISCOVER_RESOURCE_KUBERNETES_EKS",
 	41: "DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE",
+	42: "DISCOVER_RESOURCE_MCP_STDIO",
+	43: "DISCOVER_RESOURCE_MCP_SSE",
+	44: "DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP",
 }
 
 var DiscoverResource_value = map[string]int32{
@@ -159,6 +165,9 @@ var DiscoverResource_value = map[string]int32{
 	"DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD":            39,
 	"DISCOVER_RESOURCE_KUBERNETES_EKS":                        40,
 	"DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE":               41,
+	"DISCOVER_RESOURCE_MCP_STDIO":                             42,
+	"DISCOVER_RESOURCE_MCP_SSE":                               43,
+	"DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP":                   44,
 }
 
 func (x DiscoverResource) String() string {
@@ -288,34 +297,36 @@ func (CTA) EnumDescriptor() ([]byte, []int) {
 type IntegrationEnrollKind int32
 
 const (
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_UNSPECIFIED                 IntegrationEnrollKind = 0
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SLACK                       IntegrationEnrollKind = 1
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_OIDC                    IntegrationEnrollKind = 2
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_PAGERDUTY                   IntegrationEnrollKind = 3
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_EMAIL                       IntegrationEnrollKind = 4
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JIRA                        IntegrationEnrollKind = 5
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DISCORD                     IntegrationEnrollKind = 6
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MATTERMOST                  IntegrationEnrollKind = 7
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MS_TEAMS                    IntegrationEnrollKind = 8
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OPSGENIE                    IntegrationEnrollKind = 9
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OKTA                        IntegrationEnrollKind = 10
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JAMF                        IntegrationEnrollKind = 11
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID                  IntegrationEnrollKind = 12
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS   IntegrationEnrollKind = 13
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI         IntegrationEnrollKind = 14
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB           IntegrationEnrollKind = 15
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS          IntegrationEnrollKind = 16
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE          IntegrationEnrollKind = 17
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SERVICENOW                  IntegrationEnrollKind = 18
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_ENTRA_ID                    IntegrationEnrollKind = 19
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT IntegrationEnrollKind = 20
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS              IntegrationEnrollKind = 21
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP              IntegrationEnrollKind = 22
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE            IntegrationEnrollKind = 23
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT        IntegrationEnrollKind = 24
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES       IntegrationEnrollKind = 25
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER         IntegrationEnrollKind = 26
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS          IntegrationEnrollKind = 27
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_UNSPECIFIED                          IntegrationEnrollKind = 0
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SLACK                                IntegrationEnrollKind = 1
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_OIDC                             IntegrationEnrollKind = 2
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_PAGERDUTY                            IntegrationEnrollKind = 3
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_EMAIL                                IntegrationEnrollKind = 4
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JIRA                                 IntegrationEnrollKind = 5
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DISCORD                              IntegrationEnrollKind = 6
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MATTERMOST                           IntegrationEnrollKind = 7
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MS_TEAMS                             IntegrationEnrollKind = 8
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OPSGENIE                             IntegrationEnrollKind = 9
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OKTA                                 IntegrationEnrollKind = 10
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JAMF                                 IntegrationEnrollKind = 11
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID                           IntegrationEnrollKind = 12
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS            IntegrationEnrollKind = 13
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI                  IntegrationEnrollKind = 14
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB                    IntegrationEnrollKind = 15
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS                   IntegrationEnrollKind = 16
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE                   IntegrationEnrollKind = 17
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SERVICENOW                           IntegrationEnrollKind = 18
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_ENTRA_ID                             IntegrationEnrollKind = 19
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT          IntegrationEnrollKind = 20
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS                       IntegrationEnrollKind = 21
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP                       IntegrationEnrollKind = 22
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE                     IntegrationEnrollKind = 23
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT                 IntegrationEnrollKind = 24
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES                IntegrationEnrollKind = 25
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER                  IntegrationEnrollKind = 26
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS                   IntegrationEnrollKind = 27
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD                    IntegrationEnrollKind = 28
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES IntegrationEnrollKind = 29
 )
 
 var IntegrationEnrollKind_name = map[int32]string{
@@ -347,37 +358,41 @@ var IntegrationEnrollKind_name = map[int32]string{
 	25: "INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES",
 	26: "INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER",
 	27: "INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS",
+	28: "INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD",
+	29: "INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES",
 }
 
 var IntegrationEnrollKind_value = map[string]int32{
-	"INTEGRATION_ENROLL_KIND_UNSPECIFIED":                 0,
-	"INTEGRATION_ENROLL_KIND_SLACK":                       1,
-	"INTEGRATION_ENROLL_KIND_AWS_OIDC":                    2,
-	"INTEGRATION_ENROLL_KIND_PAGERDUTY":                   3,
-	"INTEGRATION_ENROLL_KIND_EMAIL":                       4,
-	"INTEGRATION_ENROLL_KIND_JIRA":                        5,
-	"INTEGRATION_ENROLL_KIND_DISCORD":                     6,
-	"INTEGRATION_ENROLL_KIND_MATTERMOST":                  7,
-	"INTEGRATION_ENROLL_KIND_MS_TEAMS":                    8,
-	"INTEGRATION_ENROLL_KIND_OPSGENIE":                    9,
-	"INTEGRATION_ENROLL_KIND_OKTA":                        10,
-	"INTEGRATION_ENROLL_KIND_JAMF":                        11,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID":                  12,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS":   13,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI":         14,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB":           15,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS":          16,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE":          17,
-	"INTEGRATION_ENROLL_KIND_SERVICENOW":                  18,
-	"INTEGRATION_ENROLL_KIND_ENTRA_ID":                    19,
-	"INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT": 20,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS":              21,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP":              22,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE":            23,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT":        24,
-	"INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES":       25,
-	"INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER":         26,
-	"INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS":          27,
+	"INTEGRATION_ENROLL_KIND_UNSPECIFIED":                          0,
+	"INTEGRATION_ENROLL_KIND_SLACK":                                1,
+	"INTEGRATION_ENROLL_KIND_AWS_OIDC":                             2,
+	"INTEGRATION_ENROLL_KIND_PAGERDUTY":                            3,
+	"INTEGRATION_ENROLL_KIND_EMAIL":                                4,
+	"INTEGRATION_ENROLL_KIND_JIRA":                                 5,
+	"INTEGRATION_ENROLL_KIND_DISCORD":                              6,
+	"INTEGRATION_ENROLL_KIND_MATTERMOST":                           7,
+	"INTEGRATION_ENROLL_KIND_MS_TEAMS":                             8,
+	"INTEGRATION_ENROLL_KIND_OPSGENIE":                             9,
+	"INTEGRATION_ENROLL_KIND_OKTA":                                 10,
+	"INTEGRATION_ENROLL_KIND_JAMF":                                 11,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID":                           12,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS":            13,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI":                  14,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB":                    15,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS":                   16,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE":                   17,
+	"INTEGRATION_ENROLL_KIND_SERVICENOW":                           18,
+	"INTEGRATION_ENROLL_KIND_ENTRA_ID":                             19,
+	"INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT":          20,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS":                       21,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP":                       22,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE":                     23,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT":                 24,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES":                25,
+	"INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER":                  26,
+	"INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS":                   27,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD":                    28,
+	"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES": 29,
 }
 
 func (x IntegrationEnrollKind) String() string {
@@ -404,18 +419,27 @@ const (
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER  IntegrationEnrollStep = 6
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT IntegrationEnrollStep = 7
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE        IntegrationEnrollStep = 8
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB   IntegrationEnrollStep = 9
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS IntegrationEnrollStep = 10
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW   IntegrationEnrollStep = 11
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME          IntegrationEnrollStep = 12
 )
 
 var IntegrationEnrollStep_name = map[int32]string{
-	0: "INTEGRATION_ENROLL_STEP_UNSPECIFIED",
-	1: "INTEGRATION_ENROLL_STEP_AWSIC_CONNECT_OIDC",
-	2: "INTEGRATION_ENROLL_STEP_AWSIC_SET_ACCESSLIST_DEFAULT_OWNER",
-	3: "INTEGRATION_ENROLL_STEP_AWSIC_UPLOAD_AWS_SAML_SP_METADATA",
-	4: "INTEGRATION_ENROLL_STEP_AWSIC_TEST_SCIM_CONNECTION",
-	5: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_INTEGRATION",
-	6: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER",
-	7: "INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT",
-	8: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE",
+	0:  "INTEGRATION_ENROLL_STEP_UNSPECIFIED",
+	1:  "INTEGRATION_ENROLL_STEP_AWSIC_CONNECT_OIDC",
+	2:  "INTEGRATION_ENROLL_STEP_AWSIC_SET_ACCESSLIST_DEFAULT_OWNER",
+	3:  "INTEGRATION_ENROLL_STEP_AWSIC_UPLOAD_AWS_SAML_SP_METADATA",
+	4:  "INTEGRATION_ENROLL_STEP_AWSIC_TEST_SCIM_CONNECTION",
+	5:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_INTEGRATION",
+	6:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER",
+	7:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT",
+	8:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE",
+	9:  "INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB",
+	10: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS",
+	11: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW",
+	12: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME",
 }
 
 var IntegrationEnrollStep_value = map[string]int32{
@@ -428,6 +452,10 @@ var IntegrationEnrollStep_value = map[string]int32{
 	"INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER":         6,
 	"INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT":        7,
 	"INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE":               8,
+	"INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB":           9,
+	"INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS":         10,
+	"INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW":           11,
+	"INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME":                  12,
 }
 
 func (x IntegrationEnrollStep) String() string {
@@ -480,6 +508,131 @@ func (IntegrationEnrollStatusCode) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_94cf2ca1c69fd564, []int{5}
 }
 
+// IntegrationEnrollSection identifies a section the user opened or expanded in
+// an integration setup wizard.
+type IntegrationEnrollSection int32
+
+const (
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_UNSPECIFIED IntegrationEnrollSection = 0
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS         IntegrationEnrollSection = 1
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER         IntegrationEnrollSection = 2
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS     IntegrationEnrollSection = 3
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER IntegrationEnrollSection = 4
+)
+
+var IntegrationEnrollSection_name = map[int32]string{
+	0: "INTEGRATION_ENROLL_SECTION_UNSPECIFIED",
+	1: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS",
+	2: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER",
+	3: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS",
+	4: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER",
+}
+
+var IntegrationEnrollSection_value = map[string]int32{
+	"INTEGRATION_ENROLL_SECTION_UNSPECIFIED":                               0,
+	"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS":         1,
+	"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER":         2,
+	"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS":     3,
+	"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER": 4,
+}
+
+func (x IntegrationEnrollSection) String() string {
+	return proto.EnumName(IntegrationEnrollSection_name, int32(x))
+}
+
+func (IntegrationEnrollSection) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{6}
+}
+
+// IntegrationEnrollField identifies a field the user completed in an integration
+// setup wizard.
+type IntegrationEnrollField int32
+
+const (
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_UNSPECIFIED IntegrationEnrollField = 0
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL         IntegrationEnrollField = 1
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH                 IntegrationEnrollField = 2
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW               IntegrationEnrollField = 3
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT            IntegrationEnrollField = 4
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF                    IntegrationEnrollField = 5
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG        IntegrationEnrollField = 6
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS IntegrationEnrollField = 7
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS             IntegrationEnrollField = 8
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS             IntegrationEnrollField = 9
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS              IntegrationEnrollField = 10
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES     IntegrationEnrollField = 11
+)
+
+var IntegrationEnrollField_name = map[int32]string{
+	0:  "INTEGRATION_ENROLL_FIELD_UNSPECIFIED",
+	1:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL",
+	2:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH",
+	3:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW",
+	4:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT",
+	5:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF",
+	6:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG",
+	7:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS",
+	8:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS",
+	9:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS",
+	10: "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS",
+	11: "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES",
+}
+
+var IntegrationEnrollField_value = map[string]int32{
+	"INTEGRATION_ENROLL_FIELD_UNSPECIFIED":                             0,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL":         1,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH":                 2,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW":               3,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT":            4,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF":                    5,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG":        6,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS": 7,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS":             8,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS":             9,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS":              10,
+	"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES":     11,
+}
+
+func (x IntegrationEnrollField) String() string {
+	return proto.EnumName(IntegrationEnrollField_name, int32(x))
+}
+
+func (IntegrationEnrollField) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{7}
+}
+
+// IntegrationEnrollCodeType identifies the type of code that was copied in an
+// integration setup wizard.
+type IntegrationEnrollCodeType int32
+
+const (
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED         IntegrationEnrollCodeType = 0
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM           IntegrationEnrollCodeType = 1
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML IntegrationEnrollCodeType = 2
+)
+
+var IntegrationEnrollCodeType_name = map[int32]string{
+	0: "INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED",
+	1: "INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM",
+	2: "INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML",
+}
+
+var IntegrationEnrollCodeType_value = map[string]int32{
+	"INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED":         0,
+	"INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM":           1,
+	"INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML": 2,
+}
+
+func (x IntegrationEnrollCodeType) String() string {
+	return proto.EnumName(IntegrationEnrollCodeType_name, int32(x))
+}
+
+func (IntegrationEnrollCodeType) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{8}
+}
+
 // Feature is name of Teleport feature
 type Feature int32
 
@@ -503,7 +656,7 @@ func (x Feature) String() string {
 }
 
 func (Feature) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{6}
+	return fileDescriptor_94cf2ca1c69fd564, []int{9}
 }
 
 // FeatureRecommendationStatus is feature recommendation status.
@@ -534,7 +687,7 @@ func (x FeatureRecommendationStatus) String() string {
 }
 
 func (FeatureRecommendationStatus) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{7}
+	return fileDescriptor_94cf2ca1c69fd564, []int{10}
 }
 
 // DeployMethod describes the method used to deploy a service.
@@ -4211,6 +4364,278 @@ func (m *UIIntegrationEnrollStepEvent) GetStatus() *IntegrationEnrollStepStatus
 	return nil
 }
 
+// UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+// a section (e.g. "Advanced Options") in an integration setup wizard.
+type UIIntegrationEnrollSectionOpenEvent struct {
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the section was opened.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=teleport.usageevents.v1.IntegrationEnrollStep" json:"step,omitempty"`
+	// Section that was opened.
+	Section              IntegrationEnrollSection `protobuf:"varint,3,opt,name=section,proto3,enum=teleport.usageevents.v1.IntegrationEnrollSection" json:"section,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                 `json:"-"`
+	XXX_unrecognized     []byte                   `json:"-"`
+	XXX_sizecache        int32                    `json:"-"`
+}
+
+func (m *UIIntegrationEnrollSectionOpenEvent) Reset()         { *m = UIIntegrationEnrollSectionOpenEvent{} }
+func (m *UIIntegrationEnrollSectionOpenEvent) String() string { return proto.CompactTextString(m) }
+func (*UIIntegrationEnrollSectionOpenEvent) ProtoMessage()    {}
+func (*UIIntegrationEnrollSectionOpenEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{59}
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UIIntegrationEnrollSectionOpenEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UIIntegrationEnrollSectionOpenEvent.Merge(m, src)
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_UIIntegrationEnrollSectionOpenEvent.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UIIntegrationEnrollSectionOpenEvent proto.InternalMessageInfo
+
+func (m *UIIntegrationEnrollSectionOpenEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if m != nil {
+		return m.Metadata
+	}
+	return nil
+}
+
+func (m *UIIntegrationEnrollSectionOpenEvent) GetStep() IntegrationEnrollStep {
+	if m != nil {
+		return m.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (m *UIIntegrationEnrollSectionOpenEvent) GetSection() IntegrationEnrollSection {
+	if m != nil {
+		return m.Section
+	}
+	return IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_UNSPECIFIED
+}
+
+// UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+// field in an integration setup wizard.
+type UIIntegrationEnrollFieldCompleteEvent struct {
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the field was completed.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=teleport.usageevents.v1.IntegrationEnrollStep" json:"step,omitempty"`
+	// Field that was completed.
+	Field                IntegrationEnrollField `protobuf:"varint,3,opt,name=field,proto3,enum=teleport.usageevents.v1.IntegrationEnrollField" json:"field,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
+	XXX_unrecognized     []byte                 `json:"-"`
+	XXX_sizecache        int32                  `json:"-"`
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) Reset()         { *m = UIIntegrationEnrollFieldCompleteEvent{} }
+func (m *UIIntegrationEnrollFieldCompleteEvent) String() string { return proto.CompactTextString(m) }
+func (*UIIntegrationEnrollFieldCompleteEvent) ProtoMessage()    {}
+func (*UIIntegrationEnrollFieldCompleteEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{60}
+}
+func (m *UIIntegrationEnrollFieldCompleteEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UIIntegrationEnrollFieldCompleteEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UIIntegrationEnrollFieldCompleteEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UIIntegrationEnrollFieldCompleteEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UIIntegrationEnrollFieldCompleteEvent.Merge(m, src)
+}
+func (m *UIIntegrationEnrollFieldCompleteEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *UIIntegrationEnrollFieldCompleteEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_UIIntegrationEnrollFieldCompleteEvent.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UIIntegrationEnrollFieldCompleteEvent proto.InternalMessageInfo
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if m != nil {
+		return m.Metadata
+	}
+	return nil
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) GetStep() IntegrationEnrollStep {
+	if m != nil {
+		return m.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) GetField() IntegrationEnrollField {
+	if m != nil {
+		return m.Field
+	}
+	return IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_UNSPECIFIED
+}
+
+// UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+// IaC (e.g. Terraform) code in an integration setup wizard.
+type UIIntegrationEnrollCodeCopyEvent struct {
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the code was copied.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=teleport.usageevents.v1.IntegrationEnrollStep" json:"step,omitempty"`
+	// Type of code that was copied.
+	Type                 IntegrationEnrollCodeType `protobuf:"varint,3,opt,name=type,proto3,enum=teleport.usageevents.v1.IntegrationEnrollCodeType" json:"type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                  `json:"-"`
+	XXX_unrecognized     []byte                    `json:"-"`
+	XXX_sizecache        int32                     `json:"-"`
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) Reset()         { *m = UIIntegrationEnrollCodeCopyEvent{} }
+func (m *UIIntegrationEnrollCodeCopyEvent) String() string { return proto.CompactTextString(m) }
+func (*UIIntegrationEnrollCodeCopyEvent) ProtoMessage()    {}
+func (*UIIntegrationEnrollCodeCopyEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{61}
+}
+func (m *UIIntegrationEnrollCodeCopyEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UIIntegrationEnrollCodeCopyEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UIIntegrationEnrollCodeCopyEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UIIntegrationEnrollCodeCopyEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UIIntegrationEnrollCodeCopyEvent.Merge(m, src)
+}
+func (m *UIIntegrationEnrollCodeCopyEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *UIIntegrationEnrollCodeCopyEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_UIIntegrationEnrollCodeCopyEvent.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UIIntegrationEnrollCodeCopyEvent proto.InternalMessageInfo
+
+func (m *UIIntegrationEnrollCodeCopyEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if m != nil {
+		return m.Metadata
+	}
+	return nil
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) GetStep() IntegrationEnrollStep {
+	if m != nil {
+		return m.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) GetType() IntegrationEnrollCodeType {
+	if m != nil {
+		return m.Type
+	}
+	return IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED
+}
+
+// UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+// documentation, etc. in an integration setup wizard.
+type UIIntegrationEnrollLinkClickEvent struct {
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the link was clicked.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=teleport.usageevents.v1.IntegrationEnrollStep" json:"step,omitempty"`
+	// Link that was clicked.
+	Link                 string   `protobuf:"bytes,3,opt,name=link,proto3" json:"link,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) Reset()         { *m = UIIntegrationEnrollLinkClickEvent{} }
+func (m *UIIntegrationEnrollLinkClickEvent) String() string { return proto.CompactTextString(m) }
+func (*UIIntegrationEnrollLinkClickEvent) ProtoMessage()    {}
+func (*UIIntegrationEnrollLinkClickEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{62}
+}
+func (m *UIIntegrationEnrollLinkClickEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UIIntegrationEnrollLinkClickEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UIIntegrationEnrollLinkClickEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UIIntegrationEnrollLinkClickEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UIIntegrationEnrollLinkClickEvent.Merge(m, src)
+}
+func (m *UIIntegrationEnrollLinkClickEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *UIIntegrationEnrollLinkClickEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_UIIntegrationEnrollLinkClickEvent.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UIIntegrationEnrollLinkClickEvent proto.InternalMessageInfo
+
+func (m *UIIntegrationEnrollLinkClickEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if m != nil {
+		return m.Metadata
+	}
+	return nil
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) GetStep() IntegrationEnrollStep {
+	if m != nil {
+		return m.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) GetLink() string {
+	if m != nil {
+		return m.Link
+	}
+	return ""
+}
+
 // ResourceCreateEvent is emitted when a resource is created.
 type ResourceCreateEvent struct {
 	// resource_type is the type of resource ("node", "node.openssh", "db", "k8s", "app").
@@ -4231,7 +4656,7 @@ func (m *ResourceCreateEvent) Reset()         { *m = ResourceCreateEvent{} }
 func (m *ResourceCreateEvent) String() string { return proto.CompactTextString(m) }
 func (*ResourceCreateEvent) ProtoMessage()    {}
 func (*ResourceCreateEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{59}
+	return fileDescriptor_94cf2ca1c69fd564, []int{63}
 }
 func (m *ResourceCreateEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4303,7 +4728,7 @@ func (m *DiscoveredDatabaseMetadata) Reset()         { *m = DiscoveredDatabaseMe
 func (m *DiscoveredDatabaseMetadata) String() string { return proto.CompactTextString(m) }
 func (*DiscoveredDatabaseMetadata) ProtoMessage()    {}
 func (*DiscoveredDatabaseMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{60}
+	return fileDescriptor_94cf2ca1c69fd564, []int{64}
 }
 func (m *DiscoveredDatabaseMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4373,7 +4798,7 @@ func (m *FeatureRecommendationEvent) Reset()         { *m = FeatureRecommendatio
 func (m *FeatureRecommendationEvent) String() string { return proto.CompactTextString(m) }
 func (*FeatureRecommendationEvent) ProtoMessage()    {}
 func (*FeatureRecommendationEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{61}
+	return fileDescriptor_94cf2ca1c69fd564, []int{65}
 }
 func (m *FeatureRecommendationEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4443,7 +4868,7 @@ func (m *TAGExecuteQueryEvent) Reset()         { *m = TAGExecuteQueryEvent{} }
 func (m *TAGExecuteQueryEvent) String() string { return proto.CompactTextString(m) }
 func (*TAGExecuteQueryEvent) ProtoMessage()    {}
 func (*TAGExecuteQueryEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{62}
+	return fileDescriptor_94cf2ca1c69fd564, []int{66}
 }
 func (m *TAGExecuteQueryEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4527,7 +4952,7 @@ func (m *AccessGraphAWSScanEvent) Reset()         { *m = AccessGraphAWSScanEvent
 func (m *AccessGraphAWSScanEvent) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphAWSScanEvent) ProtoMessage()    {}
 func (*AccessGraphAWSScanEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{63}
+	return fileDescriptor_94cf2ca1c69fd564, []int{67}
 }
 func (m *AccessGraphAWSScanEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4648,7 +5073,7 @@ func (m *UIAccessGraphCrownJewelDiffViewEvent) Reset()         { *m = UIAccessGr
 func (m *UIAccessGraphCrownJewelDiffViewEvent) String() string { return proto.CompactTextString(m) }
 func (*UIAccessGraphCrownJewelDiffViewEvent) ProtoMessage()    {}
 func (*UIAccessGraphCrownJewelDiffViewEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{64}
+	return fileDescriptor_94cf2ca1c69fd564, []int{68}
 }
 func (m *UIAccessGraphCrownJewelDiffViewEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4706,7 +5131,7 @@ func (m *SecurityReportGetResultEvent) Reset()         { *m = SecurityReportGetR
 func (m *SecurityReportGetResultEvent) String() string { return proto.CompactTextString(m) }
 func (*SecurityReportGetResultEvent) ProtoMessage()    {}
 func (*SecurityReportGetResultEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{65}
+	return fileDescriptor_94cf2ca1c69fd564, []int{69}
 }
 func (m *SecurityReportGetResultEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4767,7 +5192,7 @@ func (m *DiscoveryFetchEvent) Reset()         { *m = DiscoveryFetchEvent{} }
 func (m *DiscoveryFetchEvent) String() string { return proto.CompactTextString(m) }
 func (*DiscoveryFetchEvent) ProtoMessage()    {}
 func (*DiscoveryFetchEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{66}
+	return fileDescriptor_94cf2ca1c69fd564, []int{70}
 }
 func (m *DiscoveryFetchEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4846,7 +5271,7 @@ func (m *UserTaskStateEvent) Reset()         { *m = UserTaskStateEvent{} }
 func (m *UserTaskStateEvent) String() string { return proto.CompactTextString(m) }
 func (*UserTaskStateEvent) ProtoMessage()    {}
 func (*UserTaskStateEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{67}
+	return fileDescriptor_94cf2ca1c69fd564, []int{71}
 }
 func (m *UserTaskStateEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4968,6 +5393,10 @@ type UsageEventOneOf struct {
 	//	*UsageEventOneOf_UiAccessGraphCrownJewelDiffView
 	//	*UsageEventOneOf_UserTaskStateEvent
 	//	*UsageEventOneOf_UiIntegrationEnrollStepEvent
+	//	*UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent
+	//	*UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent
+	//	*UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent
+	//	*UsageEventOneOf_UiIntegrationEnrollLinkClickEvent
 	Event                isUsageEventOneOf_Event `protobuf_oneof:"event"`
 	XXX_NoUnkeyedLiteral struct{}                `json:"-"`
 	XXX_unrecognized     []byte                  `json:"-"`
@@ -4978,7 +5407,7 @@ func (m *UsageEventOneOf) Reset()         { *m = UsageEventOneOf{} }
 func (m *UsageEventOneOf) String() string { return proto.CompactTextString(m) }
 func (*UsageEventOneOf) ProtoMessage()    {}
 func (*UsageEventOneOf) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{68}
+	return fileDescriptor_94cf2ca1c69fd564, []int{72}
 }
 func (m *UsageEventOneOf) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5193,6 +5622,18 @@ type UsageEventOneOf_UserTaskStateEvent struct {
 type UsageEventOneOf_UiIntegrationEnrollStepEvent struct {
 	UiIntegrationEnrollStepEvent *UIIntegrationEnrollStepEvent `protobuf:"bytes,61,opt,name=ui_integration_enroll_step_event,json=uiIntegrationEnrollStepEvent,proto3,oneof" json:"ui_integration_enroll_step_event,omitempty"`
 }
+type UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent struct {
+	UiIntegrationEnrollSectionOpenEvent *UIIntegrationEnrollSectionOpenEvent `protobuf:"bytes,62,opt,name=ui_integration_enroll_section_open_event,json=uiIntegrationEnrollSectionOpenEvent,proto3,oneof" json:"ui_integration_enroll_section_open_event,omitempty"`
+}
+type UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent struct {
+	UiIntegrationEnrollFieldCompleteEvent *UIIntegrationEnrollFieldCompleteEvent `protobuf:"bytes,63,opt,name=ui_integration_enroll_field_complete_event,json=uiIntegrationEnrollFieldCompleteEvent,proto3,oneof" json:"ui_integration_enroll_field_complete_event,omitempty"`
+}
+type UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent struct {
+	UiIntegrationEnrollCodeCopyEvent *UIIntegrationEnrollCodeCopyEvent `protobuf:"bytes,64,opt,name=ui_integration_enroll_code_copy_event,json=uiIntegrationEnrollCodeCopyEvent,proto3,oneof" json:"ui_integration_enroll_code_copy_event,omitempty"`
+}
+type UsageEventOneOf_UiIntegrationEnrollLinkClickEvent struct {
+	UiIntegrationEnrollLinkClickEvent *UIIntegrationEnrollLinkClickEvent `protobuf:"bytes,65,opt,name=ui_integration_enroll_link_click_event,json=uiIntegrationEnrollLinkClickEvent,proto3,oneof" json:"ui_integration_enroll_link_click_event,omitempty"`
+}
 
 func (*UsageEventOneOf_UiBannerClick) isUsageEventOneOf_Event()                                     {}
 func (*UsageEventOneOf_UiOnboardCompleteGoToDashboardClick) isUsageEventOneOf_Event()               {}
@@ -5254,6 +5695,10 @@ func (*UsageEventOneOf_AccessGraphAwsScanEvent) isUsageEventOneOf_Event()
 func (*UsageEventOneOf_UiAccessGraphCrownJewelDiffView) isUsageEventOneOf_Event()                   {}
 func (*UsageEventOneOf_UserTaskStateEvent) isUsageEventOneOf_Event()                                {}
 func (*UsageEventOneOf_UiIntegrationEnrollStepEvent) isUsageEventOneOf_Event()                      {}
+func (*UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent) isUsageEventOneOf_Event()               {}
+func (*UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent) isUsageEventOneOf_Event()             {}
+func (*UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent) isUsageEventOneOf_Event()                  {}
+func (*UsageEventOneOf_UiIntegrationEnrollLinkClickEvent) isUsageEventOneOf_Event()                 {}
 
 func (m *UsageEventOneOf) GetEvent() isUsageEventOneOf_Event {
 	if m != nil {
@@ -5682,6 +6127,34 @@ func (m *UsageEventOneOf) GetUiIntegrationEnrollStepEvent() *UIIntegrationEnroll
 	return nil
 }
 
+func (m *UsageEventOneOf) GetUiIntegrationEnrollSectionOpenEvent() *UIIntegrationEnrollSectionOpenEvent {
+	if x, ok := m.GetEvent().(*UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent); ok {
+		return x.UiIntegrationEnrollSectionOpenEvent
+	}
+	return nil
+}
+
+func (m *UsageEventOneOf) GetUiIntegrationEnrollFieldCompleteEvent() *UIIntegrationEnrollFieldCompleteEvent {
+	if x, ok := m.GetEvent().(*UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent); ok {
+		return x.UiIntegrationEnrollFieldCompleteEvent
+	}
+	return nil
+}
+
+func (m *UsageEventOneOf) GetUiIntegrationEnrollCodeCopyEvent() *UIIntegrationEnrollCodeCopyEvent {
+	if x, ok := m.GetEvent().(*UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent); ok {
+		return x.UiIntegrationEnrollCodeCopyEvent
+	}
+	return nil
+}
+
+func (m *UsageEventOneOf) GetUiIntegrationEnrollLinkClickEvent() *UIIntegrationEnrollLinkClickEvent {
+	if x, ok := m.GetEvent().(*UsageEventOneOf_UiIntegrationEnrollLinkClickEvent); ok {
+		return x.UiIntegrationEnrollLinkClickEvent
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*UsageEventOneOf) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -5745,6 +6218,10 @@ func (*UsageEventOneOf) XXX_OneofWrappers() []interface{} {
 		(*UsageEventOneOf_UiAccessGraphCrownJewelDiffView)(nil),
 		(*UsageEventOneOf_UserTaskStateEvent)(nil),
 		(*UsageEventOneOf_UiIntegrationEnrollStepEvent)(nil),
+		(*UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent)(nil),
+		(*UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent)(nil),
+		(*UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent)(nil),
+		(*UsageEventOneOf_UiIntegrationEnrollLinkClickEvent)(nil),
 	}
 }
 
@@ -5755,6 +6232,9 @@ func init() {
 	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollKind", IntegrationEnrollKind_name, IntegrationEnrollKind_value)
 	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollStep", IntegrationEnrollStep_name, IntegrationEnrollStep_value)
 	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollStatusCode", IntegrationEnrollStatusCode_name, IntegrationEnrollStatusCode_value)
+	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollSection", IntegrationEnrollSection_name, IntegrationEnrollSection_value)
+	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollField", IntegrationEnrollField_name, IntegrationEnrollField_value)
+	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollCodeType", IntegrationEnrollCodeType_name, IntegrationEnrollCodeType_value)
 	proto.RegisterEnum("teleport.usageevents.v1.Feature", Feature_name, Feature_value)
 	proto.RegisterEnum("teleport.usageevents.v1.FeatureRecommendationStatus", FeatureRecommendationStatus_name, FeatureRecommendationStatus_value)
 	proto.RegisterEnum("teleport.usageevents.v1.UIDiscoverDeployServiceEvent_DeployMethod", UIDiscoverDeployServiceEvent_DeployMethod_name, UIDiscoverDeployServiceEvent_DeployMethod_value)
@@ -5819,6 +6299,10 @@ func init() {
 	proto.RegisterType((*UIIntegrationEnrollCompleteEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollCompleteEvent")
 	proto.RegisterType((*IntegrationEnrollStepStatus)(nil), "teleport.usageevents.v1.IntegrationEnrollStepStatus")
 	proto.RegisterType((*UIIntegrationEnrollStepEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollStepEvent")
+	proto.RegisterType((*UIIntegrationEnrollSectionOpenEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollSectionOpenEvent")
+	proto.RegisterType((*UIIntegrationEnrollFieldCompleteEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollFieldCompleteEvent")
+	proto.RegisterType((*UIIntegrationEnrollCodeCopyEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollCodeCopyEvent")
+	proto.RegisterType((*UIIntegrationEnrollLinkClickEvent)(nil), "teleport.usageevents.v1.UIIntegrationEnrollLinkClickEvent")
 	proto.RegisterType((*ResourceCreateEvent)(nil), "teleport.usageevents.v1.ResourceCreateEvent")
 	proto.RegisterType((*DiscoveredDatabaseMetadata)(nil), "teleport.usageevents.v1.DiscoveredDatabaseMetadata")
 	proto.RegisterType((*FeatureRecommendationEvent)(nil), "teleport.usageevents.v1.FeatureRecommendationEvent")
@@ -5836,376 +6320,413 @@ func init() {
 }
 
 var fileDescriptor_94cf2ca1c69fd564 = []byte{
-	// 5894 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe4, 0x7d, 0x5b, 0x6c, 0x1b, 0xcb,
-	0x79, 0x3f, 0x97, 0x92, 0x6c, 0x69, 0x6c, 0xcb, 0xeb, 0xb5, 0x2d, 0x53, 0x92, 0xe5, 0x0b, 0x7d,
-	0xd7, 0x39, 0x47, 0x3e, 0xd6, 0x71, 0x72, 0x7c, 0x2e, 0xc9, 0xf9, 0xaf, 0x96, 0x2b, 0x71, 0x2d,
-	0x92, 0xcb, 0x33, 0xbb, 0xb4, 0xa3, 0x13, 0x04, 0xf3, 0x5f, 0x71, 0x47, 0xd2, 0x56, 0x24, 0x97,
-	0xd9, 0x5d, 0x4a, 0x47, 0x28, 0x82, 0xa4, 0x4d, 0x1b, 0x14, 0x4d, 0xd2, 0xb4, 0x40, 0x11, 0x14,
-	0x08, 0xd0, 0x0b, 0x7a, 0x41, 0x1f, 0x0a, 0xf4, 0xa9, 0xc8, 0x53, 0x81, 0x16, 0x68, 0x81, 0x3e,
-	0xf4, 0xa1, 0x40, 0x1f, 0xfb, 0x52, 0xe4, 0xa9, 0x6f, 0x79, 0x6a, 0x81, 0x36, 0x2d, 0x5a, 0xcc,
-	0x65, 0x97, 0x4b, 0x72, 0xc9, 0x5d, 0x9f, 0xfa, 0x34, 0x80, 0xfd, 0xa6, 0x9d, 0xf9, 0x2e, 0xbf,
-	0x99, 0xf9, 0xe6, 0x9b, 0x6f, 0x66, 0xbe, 0xa1, 0xc0, 0x83, 0x00, 0xb7, 0x70, 0xd7, 0xf5, 0x82,
-	0x87, 0x3d, 0xdf, 0xda, 0xc7, 0xf8, 0x08, 0x77, 0x02, 0xff, 0xe1, 0xd1, 0xa3, 0xf8, 0xe7, 0x5a,
-	0xd7, 0x73, 0x03, 0x57, 0xba, 0x12, 0x92, 0xae, 0xc5, 0xeb, 0x8e, 0x1e, 0x2d, 0xdd, 0x8b, 0x64,
-	0x58, 0xcd, 0x26, 0xf6, 0xfd, 0x96, 0xe3, 0x07, 0x44, 0x44, 0xff, 0x8b, 0x49, 0x28, 0xae, 0x02,
-	0xa9, 0xa1, 0x6d, 0x58, 0x9d, 0x0e, 0xf6, 0x94, 0x96, 0xd3, 0x3c, 0x54, 0x89, 0x08, 0xe9, 0x12,
-	0x98, 0xb1, 0x5a, 0xd8, 0x0b, 0x0a, 0xc2, 0x0d, 0xe1, 0xfe, 0x1c, 0x64, 0x1f, 0xc5, 0x4d, 0x70,
-	0xbf, 0xa1, 0xe9, 0x9d, 0x5d, 0xd7, 0xf2, 0x6c, 0xc5, 0x6d, 0x77, 0x5b, 0x38, 0xc0, 0x5b, 0xae,
-	0xe9, 0x96, 0x2c, 0xff, 0x80, 0x15, 0xf6, 0x25, 0x2c, 0x81, 0xd9, 0x9e, 0x8f, 0xbd, 0x8e, 0xd5,
-	0xc6, 0x5c, 0x48, 0xf4, 0x5d, 0xbc, 0x03, 0x6e, 0x45, 0x72, 0x64, 0xdb, 0xde, 0x74, 0x3c, 0x3f,
-	0x80, 0xd8, 0x77, 0x7b, 0x5e, 0x13, 0xf7, 0x45, 0x14, 0x57, 0x63, 0xea, 0x86, 0xc9, 0x2a, 0x56,
-	0x10, 0x07, 0x5c, 0xfc, 0x08, 0xdc, 0x8c, 0x68, 0x0d, 0x1c, 0x28, 0x1e, 0xb6, 0x71, 0x27, 0x70,
-	0xac, 0x96, 0xd1, 0xdb, 0x6d, 0x3b, 0x41, 0x3a, 0xa6, 0xb8, 0x80, 0x8f, 0x7b, 0xd8, 0x0f, 0x1c,
-	0xb7, 0xd3, 0xb1, 0x1c, 0x0f, 0x67, 0x15, 0xf0, 0x0d, 0x70, 0x27, 0x12, 0x00, 0xf1, 0xbe, 0xe3,
-	0x13, 0x80, 0x07, 0x56, 0xab, 0x85, 0x3b, 0xfb, 0x59, 0x85, 0x48, 0x8b, 0x60, 0xb6, 0xbd, 0x67,
-	0xa1, 0xe0, 0xa4, 0x8b, 0x0b, 0x79, 0x5a, 0x77, 0xba, 0xbd, 0x67, 0x99, 0x27, 0x5d, 0x2c, 0xad,
-	0x00, 0xd0, 0x72, 0xf7, 0x9d, 0x0e, 0xda, 0x6b, 0xb9, 0xc7, 0x85, 0x29, 0x5a, 0x39, 0x47, 0x4b,
-	0x36, 0x5b, 0xee, 0x31, 0xc3, 0x0f, 0x71, 0xd3, 0x3d, 0xc2, 0xde, 0x89, 0xe2, 0xda, 0xd8, 0x57,
-	0xdc, 0x4e, 0xe0, 0x74, 0x7a, 0x38, 0xe3, 0xa0, 0x7c, 0x00, 0x56, 0x46, 0x04, 0x74, 0x4f, 0x32,
-	0x32, 0x7f, 0x08, 0xae, 0x0d, 0x31, 0xd7, 0x3d, 0xa7, 0x13, 0x64, 0xe4, 0x2e, 0x02, 0xb1, 0xe4,
-	0xf8, 0x94, 0xb9, 0x8a, 0x03, 0xcb, 0xb6, 0x02, 0x4b, 0x9a, 0x07, 0x79, 0xc7, 0xe6, 0x94, 0x79,
-	0xc7, 0x2e, 0x5a, 0xa0, 0x10, 0xd2, 0x84, 0x36, 0x10, 0xd1, 0xaa, 0x60, 0xd6, 0xe3, 0x65, 0x94,
-	0x63, 0x7e, 0xfd, 0xc1, 0xda, 0x98, 0x89, 0xb1, 0x36, 0x2c, 0x04, 0x46, 0xac, 0xc5, 0x43, 0x20,
-	0x85, 0xb5, 0x46, 0x80, 0xbb, 0x46, 0x60, 0x05, 0x3d, 0x5f, 0xfa, 0x08, 0x9c, 0xf2, 0xe9, 0x5f,
-	0x5c, 0xf4, 0xbd, 0x54, 0xd1, 0x8c, 0x11, 0x72, 0x36, 0x32, 0x97, 0xb0, 0xe7, 0xb9, 0x1e, 0x1f,
-	0x50, 0xf6, 0x51, 0xfc, 0x23, 0x01, 0x2c, 0x34, 0xb4, 0x18, 0x8b, 0x17, 0x60, 0x9b, 0x75, 0x95,
-	0x0a, 0x66, 0xdb, 0xbc, 0x69, 0x54, 0xe7, 0x99, 0x0c, 0xcd, 0x09, 0xfb, 0x02, 0x46, 0xac, 0x92,
-	0x12, 0x01, 0xcf, 0x53, 0x21, 0x6f, 0x64, 0x00, 0x1e, 0xb6, 0x3a, 0x04, 0x5f, 0xfc, 0x2f, 0x01,
-	0xdc, 0xe8, 0xc3, 0x0c, 0x3b, 0xcd, 0xc0, 0x2d, 0xdc, 0x24, 0x33, 0xe4, 0xa5, 0x02, 0xae, 0xc6,
-	0x86, 0x91, 0x41, 0x7e, 0x94, 0x79, 0x18, 0xfb, 0xe2, 0x42, 0x11, 0xb1, 0xf6, 0x4f, 0x7d, 0xf6,
-	0xf6, 0xff, 0x6a, 0x9e, 0x38, 0xa1, 0x90, 0x40, 0xeb, 0x04, 0x78, 0xdf, 0xb3, 0x48, 0xcb, 0xe5,
-	0xe7, 0x86, 0xae, 0x95, 0x14, 0xc5, 0xed, 0x74, 0x70, 0x33, 0x78, 0xe5, 0xfb, 0xe1, 0xc7, 0xf9,
-	0xb8, 0x1d, 0x94, 0xac, 0xc0, 0xda, 0xb5, 0x7c, 0x0c, 0x4b, 0x86, 0xda, 0xf1, 0xdc, 0x56, 0xeb,
-	0x55, 0x6f, 0xbf, 0xf4, 0x04, 0x14, 0x7c, 0x6a, 0xf4, 0xd8, 0x46, 0xa1, 0x64, 0x1f, 0x35, 0xdd,
-	0x5e, 0x27, 0x28, 0x4c, 0xdf, 0x10, 0xee, 0x4f, 0xc1, 0x85, 0xb0, 0x3e, 0x84, 0xe2, 0x2b, 0xa4,
-	0xb6, 0xf8, 0xef, 0x02, 0xb8, 0xda, 0xef, 0xb9, 0xed, 0xde, 0x2e, 0x56, 0xb7, 0x5f, 0x93, 0x5e,
-	0x2b, 0x3e, 0x05, 0x85, 0x86, 0xa6, 0x58, 0xad, 0x96, 0xe9, 0xca, 0xd4, 0x5f, 0xc4, 0x16, 0x84,
-	0x35, 0x30, 0xd5, 0xe4, 0x2d, 0x9e, 0x5f, 0xbf, 0x3a, 0x56, 0xba, 0x62, 0xca, 0x90, 0x10, 0x16,
-	0xbf, 0x3f, 0x13, 0xef, 0xc7, 0x12, 0xee, 0xb6, 0xdc, 0x13, 0x03, 0x7b, 0x47, 0x4e, 0x13, 0xbf,
-	0xf2, 0xd6, 0xb7, 0x0f, 0xce, 0xd9, 0xb4, 0xc1, 0xa8, 0x8d, 0x83, 0x03, 0xd7, 0xa6, 0x26, 0x37,
-	0xbf, 0xbe, 0x31, 0x56, 0xd6, 0xa4, 0x8e, 0x5a, 0x63, 0x45, 0x55, 0x2a, 0x09, 0x9e, 0xb5, 0x63,
-	0x5f, 0x92, 0x05, 0xce, 0x70, 0x45, 0x34, 0x04, 0x99, 0xa1, 0x6a, 0xfe, 0xdf, 0xff, 0x46, 0x0d,
-	0x89, 0x5d, 0x20, 0xb0, 0xa3, 0xbf, 0x8b, 0x08, 0x9c, 0x8d, 0x03, 0x90, 0x56, 0xc0, 0x62, 0x49,
-	0xad, 0x57, 0xf4, 0x1d, 0x54, 0x55, 0xcd, 0xb2, 0x5e, 0x42, 0x8d, 0x9a, 0x51, 0x57, 0x15, 0x6d,
-	0x53, 0x53, 0x4b, 0x62, 0x4e, 0x5a, 0x00, 0xd2, 0x60, 0xb5, 0xdc, 0x30, 0x75, 0x51, 0x90, 0x0a,
-	0xe0, 0xd2, 0x60, 0x79, 0x55, 0xae, 0x35, 0xe4, 0x8a, 0x98, 0x2f, 0x62, 0x00, 0xfa, 0xaa, 0xa5,
-	0x65, 0x70, 0x85, 0xd3, 0x99, 0x3b, 0x75, 0x75, 0x48, 0xf8, 0x35, 0xb0, 0x14, 0xaf, 0xd4, 0x6a,
-	0x86, 0x29, 0x57, 0x2a, 0xc8, 0x50, 0xa0, 0x56, 0x37, 0x45, 0x41, 0x5a, 0x02, 0x0b, 0xf1, 0x7a,
-	0xb9, 0x2a, 0x7f, 0xa2, 0xd7, 0x90, 0xaa, 0x18, 0x62, 0xbe, 0xf8, 0xa3, 0x69, 0x70, 0xbb, 0xdf,
-	0x7e, 0xc5, 0xc3, 0x56, 0x80, 0xc3, 0xaf, 0x13, 0xc5, 0xed, 0xec, 0x39, 0xfb, 0xaf, 0xbc, 0x5d,
-	0xba, 0xe0, 0x5c, 0x93, 0xb6, 0x74, 0xd0, 0x2e, 0x9f, 0x66, 0x30, 0x98, 0xf1, 0x1d, 0xb6, 0xc6,
-	0xfe, 0x0e, 0xed, 0xb3, 0x19, 0xfb, 0x2a, 0xfe, 0x89, 0x00, 0xce, 0xc6, 0xab, 0x89, 0xf5, 0x28,
-	0x7a, 0x6d, 0x53, 0xdb, 0x4a, 0xb6, 0x9e, 0x91, 0x6a, 0xf9, 0xb9, 0x81, 0x54, 0x65, 0x1d, 0x19,
-	0x46, 0x55, 0x14, 0xc8, 0xf8, 0x27, 0x57, 0xab, 0x9a, 0xa2, 0x8a, 0xf9, 0x64, 0x76, 0x58, 0x32,
-	0xa8, 0x09, 0x4c, 0x49, 0x8b, 0xe0, 0x72, 0x02, 0xfb, 0xb6, 0x21, 0x4e, 0x17, 0xff, 0x53, 0x00,
-	0xd7, 0x13, 0xd6, 0x4b, 0xbe, 0x2f, 0x78, 0xe5, 0x1d, 0xff, 0x2f, 0xe5, 0xe3, 0x93, 0x23, 0x6c,
-	0x3e, 0x1b, 0xb9, 0x9e, 0x87, 0xab, 0x66, 0xc5, 0x78, 0xe5, 0xfb, 0xe0, 0x37, 0xf2, 0xe0, 0x51,
-	0xdc, 0x41, 0xfa, 0x87, 0x81, 0xdb, 0x25, 0xcb, 0xe0, 0x11, 0x2e, 0x39, 0x1e, 0x6e, 0x06, 0xae,
-	0x77, 0x62, 0xba, 0x6e, 0xcb, 0xd7, 0x3a, 0x7e, 0x60, 0xbd, 0x06, 0xd1, 0xc0, 0x77, 0xf3, 0x60,
-	0x2d, 0xad, 0x43, 0x22, 0x13, 0x79, 0xe5, 0x7b, 0xe3, 0xcf, 0xf2, 0xe0, 0x6e, 0xbf, 0x37, 0xe4,
-	0x5e, 0xe0, 0x86, 0x7f, 0xc7, 0x42, 0xc8, 0x57, 0x7e, 0x05, 0xb9, 0x07, 0xce, 0x27, 0x87, 0xd3,
-	0xf3, 0xde, 0x60, 0x18, 0xfd, 0xad, 0x3c, 0xb8, 0xd5, 0xef, 0x2e, 0x55, 0x59, 0xa7, 0xb3, 0xa6,
-	0xf3, 0x3a, 0xed, 0x45, 0xff, 0x4d, 0x00, 0x8b, 0xc3, 0x11, 0x17, 0x59, 0xa8, 0x5e, 0xb3, 0x86,
-	0xb3, 0xc8, 0xa1, 0xe6, 0xda, 0xaf, 0xbe, 0x8f, 0xf8, 0x99, 0x00, 0xae, 0x0d, 0x37, 0x5c, 0xee,
-	0x76, 0x49, 0x98, 0xfd, 0x1a, 0x04, 0x11, 0xdf, 0xc9, 0x83, 0x07, 0x13, 0x82, 0x08, 0x4d, 0xae,
-	0xd6, 0xdd, 0x96, 0xd3, 0x3c, 0x79, 0xe5, 0x3b, 0xe2, 0xbf, 0x05, 0x50, 0xec, 0x77, 0x44, 0xdd,
-	0x73, 0x3a, 0x4d, 0xa7, 0x6b, 0xb5, 0xfc, 0xd7, 0x67, 0xb1, 0xfc, 0x0f, 0x01, 0xac, 0xf4, 0x7b,
-	0xc0, 0xc4, 0x7e, 0xc0, 0x0f, 0xde, 0x5e, 0x07, 0xbf, 0xff, 0xaf, 0x02, 0x28, 0xc4, 0xbc, 0x00,
-	0xbf, 0x78, 0xb1, 0x5f, 0xf9, 0x76, 0x2f, 0x13, 0xaf, 0xcf, 0xbd, 0x3d, 0x3e, 0x86, 0x6e, 0x2b,
-	0x7e, 0x39, 0xf4, 0xf7, 0xd4, 0x22, 0x06, 0x6a, 0x0d, 0xeb, 0x28, 0x7e, 0xd9, 0x71, 0x0b, 0x9c,
-	0x23, 0x11, 0x82, 0x6d, 0x79, 0x36, 0xea, 0xf9, 0x98, 0x5d, 0x26, 0xcc, 0xc2, 0xb3, 0x61, 0x61,
-	0xc3, 0xc7, 0xb6, 0xb4, 0x0c, 0xe6, 0x4e, 0xac, 0x76, 0x8b, 0x11, 0xe4, 0x29, 0xc1, 0x2c, 0x29,
-	0xa0, 0x95, 0x77, 0xc1, 0xf9, 0xb6, 0x6b, 0x63, 0x74, 0x7c, 0x80, 0x3b, 0xc8, 0xb7, 0x8e, 0xb0,
-	0xcd, 0xef, 0x5d, 0xce, 0x91, 0xe2, 0xe7, 0x07, 0xb8, 0x43, 0x54, 0xda, 0x92, 0x0c, 0x56, 0xf6,
-	0x1c, 0xdc, 0xb2, 0x7d, 0x74, 0xec, 0x04, 0x07, 0xa8, 0xe9, 0x76, 0x8e, 0xb0, 0xe7, 0x3b, 0x6e,
-	0x07, 0xd1, 0xb3, 0x7e, 0xbf, 0x30, 0x7d, 0x63, 0xea, 0xfe, 0x1c, 0x5c, 0x62, 0x44, 0xcf, 0x9d,
-	0xe0, 0x40, 0x89, 0x48, 0x54, 0x4a, 0x51, 0xbc, 0x49, 0xb6, 0x8b, 0x83, 0x6d, 0x25, 0xc1, 0x4d,
-	0x2b, 0xd6, 0xe2, 0x37, 0xc1, 0xea, 0x10, 0xc9, 0x33, 0x07, 0x1f, 0x97, 0xdc, 0x66, 0xaf, 0x8d,
-	0x3b, 0x81, 0x35, 0x78, 0xbc, 0x56, 0xfc, 0x0b, 0x01, 0x5c, 0x96, 0x7d, 0xdf, 0x21, 0x33, 0x85,
-	0x1a, 0x4c, 0x34, 0x53, 0xee, 0x81, 0xf3, 0x1c, 0x21, 0xe5, 0x41, 0xd1, 0x35, 0xcb, 0x7c, 0xbc,
-	0x58, 0xb3, 0xa5, 0x9b, 0xe0, 0x6c, 0xe0, 0x06, 0x56, 0x0b, 0x05, 0xee, 0x21, 0xee, 0xb0, 0x6b,
-	0x84, 0x29, 0x78, 0x86, 0x96, 0x99, 0xb4, 0x88, 0xf4, 0x71, 0xd7, 0x73, 0xdb, 0xdd, 0x20, 0xa4,
-	0x99, 0xa2, 0x34, 0x67, 0x59, 0x21, 0x27, 0x7a, 0x03, 0x5c, 0x68, 0x46, 0x18, 0x42, 0x42, 0x16,
-	0xe5, 0x89, 0xfd, 0x0a, 0x46, 0x5c, 0xfc, 0x47, 0x01, 0x5c, 0x62, 0xb8, 0xd5, 0x4f, 0x71, 0xb3,
-	0xf7, 0x19, 0x60, 0xaf, 0x00, 0xd0, 0x21, 0xa3, 0xc6, 0xa2, 0x49, 0x06, 0x7a, 0x8e, 0x94, 0xd0,
-	0x40, 0x72, 0xa4, 0x55, 0x53, 0x19, 0x5a, 0x35, 0x9d, 0xb5, 0x55, 0x33, 0x63, 0x5a, 0xf5, 0x04,
-	0x2c, 0xb1, 0x46, 0xd5, 0xf0, 0xb1, 0x12, 0x83, 0x1b, 0xdd, 0x8d, 0x35, 0xad, 0x00, 0xef, 0xbb,
-	0xde, 0x49, 0x78, 0x37, 0x16, 0x7e, 0x17, 0xff, 0x5c, 0x00, 0x17, 0x19, 0xab, 0x4c, 0xaf, 0x6e,
-	0x21, 0xfe, 0x7a, 0x0f, 0xfb, 0xd4, 0xba, 0xc3, 0xd9, 0xc6, 0xce, 0xea, 0x18, 0xe3, 0xd9, 0xb0,
-	0x90, 0x1e, 0x7e, 0xfd, 0x5c, 0x46, 0xf0, 0x47, 0x02, 0x38, 0x1b, 0x22, 0x26, 0xc5, 0xd2, 0x02,
-	0x38, 0x65, 0xd1, 0xbf, 0x38, 0x46, 0xfe, 0xf5, 0xf3, 0x41, 0x77, 0x1b, 0x48, 0xac, 0x23, 0x2b,
-	0x8e, 0x1f, 0x8c, 0xbd, 0x6d, 0xfc, 0x26, 0x28, 0xc4, 0xa9, 0xda, 0xbb, 0xb1, 0x9b, 0x49, 0x09,
-	0x4c, 0xc7, 0x6e, 0x31, 0xe9, 0xdf, 0x92, 0x0e, 0xce, 0xb7, 0x29, 0x95, 0x7f, 0xe0, 0x74, 0xd1,
-	0xa1, 0xd3, 0x61, 0xce, 0x64, 0x7e, 0xfd, 0x6e, 0xdf, 0xf1, 0xc5, 0xae, 0xde, 0x8f, 0x1e, 0xad,
-	0x55, 0x23, 0xf2, 0x6d, 0xa7, 0x63, 0xc3, 0xf9, 0xf6, 0xc0, 0x77, 0xf1, 0xab, 0x40, 0xec, 0x03,
-	0x60, 0x93, 0x5e, 0xda, 0x1a, 0x71, 0xf5, 0xe3, 0xdd, 0xea, 0x68, 0x1b, 0xfb, 0xce, 0x7e, 0x50,
-	0x78, 0xa3, 0x6b, 0x7f, 0x7e, 0xc2, 0x4b, 0x98, 0x2c, 0x55, 0x2f, 0x4f, 0xf8, 0x5f, 0x0a, 0x60,
-	0x61, 0x78, 0x60, 0x5e, 0x72, 0xef, 0x48, 0x9f, 0x84, 0x63, 0x89, 0x22, 0x79, 0x69, 0x2b, 0xe2,
-	0x38, 0x5b, 0x09, 0x87, 0xb5, 0x3a, 0x09, 0xff, 0x4b, 0x1e, 0x80, 0xff, 0x73, 0xfc, 0x2f, 0x79,
-	0x8c, 0x3f, 0x57, 0xfc, 0xbf, 0x97, 0x8f, 0xe3, 0xdf, 0xf2, 0xac, 0x4e, 0xe0, 0x9b, 0x6e, 0xc3,
-	0xc7, 0x9e, 0xb4, 0x06, 0x2e, 0xd2, 0x15, 0x03, 0x79, 0x6e, 0x0b, 0xfb, 0x68, 0x9f, 0xd4, 0xf1,
-	0xa0, 0x61, 0x06, 0x5e, 0xa0, 0x55, 0x64, 0xcd, 0xf5, 0xb7, 0x58, 0x05, 0x59, 0xf4, 0x19, 0xbd,
-	0xd3, 0x39, 0xc0, 0x9e, 0x43, 0x2f, 0x06, 0x07, 0x38, 0xa7, 0x28, 0xe7, 0x12, 0x25, 0xd2, 0x42,
-	0x9a, 0x01, 0x11, 0x6f, 0x83, 0x4b, 0x4c, 0x44, 0xe0, 0x59, 0x4e, 0xd0, 0xe7, 0xcc, 0x53, 0x4e,
-	0x89, 0xd6, 0x99, 0xb4, 0x2a, 0xe4, 0x50, 0xc0, 0xb5, 0x61, 0xa5, 0x43, 0xbc, 0xd3, 0x94, 0x77,
-	0x79, 0x50, 0xeb, 0xa0, 0x90, 0x65, 0x30, 0xd7, 0xf3, 0xb1, 0x87, 0xa8, 0x17, 0x9b, 0xe9, 0xe7,
-	0x62, 0xd4, 0xac, 0x36, 0x2e, 0xfe, 0x70, 0x2a, 0xde, 0x43, 0x10, 0x1f, 0x39, 0xf8, 0xf8, 0x65,
-	0xcf, 0xb0, 0x27, 0x60, 0xd1, 0xb6, 0x4e, 0x7c, 0xd4, 0xb5, 0xfc, 0x00, 0x75, 0xf0, 0xa7, 0x01,
-	0xb2, 0x7a, 0xb6, 0x13, 0x20, 0x32, 0x0f, 0x78, 0xe3, 0x2f, 0x13, 0x82, 0xba, 0x45, 0x16, 0xcc,
-	0x4f, 0x03, 0x99, 0xd4, 0x96, 0x08, 0x84, 0x4d, 0x70, 0x3d, 0xe6, 0x67, 0x3d, 0xfc, 0xf5, 0x9e,
-	0xe3, 0x61, 0x12, 0xfe, 0xf8, 0xa8, 0x79, 0x60, 0x75, 0xf6, 0x79, 0xb7, 0xcf, 0xc2, 0x95, 0x3e,
-	0x19, 0x8c, 0x51, 0x29, 0x8c, 0x48, 0x7a, 0x02, 0x0a, 0x1e, 0x6d, 0x1a, 0xda, 0x23, 0x42, 0x70,
-	0xa7, 0x79, 0x12, 0x09, 0x98, 0xa6, 0x02, 0x16, 0x58, 0xfd, 0x66, 0x58, 0x1d, 0x72, 0x7e, 0x08,
-	0x96, 0x39, 0xa7, 0x6d, 0x9d, 0x20, 0x77, 0x0f, 0xb5, 0xdd, 0x0e, 0x89, 0xf9, 0x38, 0xf3, 0x0c,
-	0x65, 0xbe, 0xc2, 0x48, 0x4a, 0xd6, 0x89, 0xbe, 0x57, 0x25, 0xf5, 0x21, 0xf7, 0x7b, 0x60, 0xb1,
-	0xd3, 0xa3, 0xb6, 0xed, 0xee, 0x21, 0x0f, 0xb7, 0xdd, 0x23, 0x6c, 0x23, 0x0e, 0xb5, 0x70, 0x8a,
-	0xb6, 0x7c, 0x81, 0x11, 0xe8, 0x7b, 0x90, 0x55, 0xf3, 0x85, 0xa2, 0xf8, 0xdb, 0xc2, 0xe8, 0xc0,
-	0xbc, 0xec, 0xa9, 0xf7, 0x08, 0x5c, 0x66, 0xab, 0x14, 0x22, 0xcb, 0x14, 0xe2, 0x0d, 0x75, 0x6c,
-	0x9e, 0xba, 0x22, 0x59, 0x43, 0xfa, 0x35, 0xbb, 0xf8, 0x3d, 0x01, 0x2c, 0xc6, 0xd2, 0x22, 0xd8,
-	0xc5, 0xf6, 0xb8, 0x75, 0x55, 0xda, 0x00, 0xd3, 0xb1, 0xc5, 0x71, 0x6d, 0x2c, 0xca, 0x11, 0x89,
-	0x74, 0x91, 0xa4, 0xbc, 0x83, 0xe6, 0x3b, 0x35, 0x64, 0xbe, 0x2e, 0xd9, 0x15, 0x8c, 0x70, 0xd3,
-	0xf4, 0x1a, 0x16, 0x6b, 0xd5, 0x46, 0xfa, 0x6a, 0x3d, 0x3b, 0x8a, 0x84, 0x15, 0xc9, 0x03, 0x37,
-	0x12, 0x14, 0x86, 0x9b, 0xb4, 0xcf, 0x47, 0xe7, 0x37, 0xc0, 0x72, 0x42, 0x13, 0xa3, 0x8c, 0xa5,
-	0x32, 0x98, 0x6e, 0xba, 0x76, 0x98, 0x0a, 0xf5, 0x38, 0xbb, 0x2a, 0xc6, 0xaf, 0xb8, 0x36, 0x86,
-	0x54, 0xc2, 0x98, 0xd4, 0xa5, 0x6f, 0xe5, 0xc1, 0xd5, 0xc4, 0x4e, 0xc6, 0xdd, 0xcf, 0xa5, 0xbd,
-	0xc4, 0x6a, 0xfc, 0x00, 0x77, 0x5f, 0xdc, 0x6a, 0x08, 0x24, 0x48, 0x79, 0xa5, 0xca, 0xd0, 0x8e,
-	0xf4, 0xf1, 0x8b, 0x49, 0x19, 0xda, 0x9a, 0xfe, 0x93, 0x00, 0x2e, 0x46, 0x19, 0x8b, 0xd4, 0x3b,
-	0x46, 0x7b, 0xce, 0xf4, 0xa8, 0x3c, 0x76, 0xe6, 0x8d, 0x5c, 0xcf, 0xd9, 0x77, 0x3a, 0xbc, 0x7f,
-	0xa3, 0x33, 0x6f, 0x9d, 0x96, 0x4a, 0x77, 0xc0, 0x7c, 0xb3, 0xe5, 0xf6, 0x6c, 0xd4, 0xf5, 0xdc,
-	0x23, 0xc7, 0xc6, 0x5e, 0xb8, 0xfd, 0xa4, 0xa5, 0x75, 0x5e, 0x28, 0xe9, 0x60, 0xd6, 0xe6, 0x87,
-	0x63, 0xd4, 0x79, 0x9d, 0x59, 0x7f, 0x27, 0x75, 0xbb, 0x8d, 0xed, 0xf0, 0x3c, 0xad, 0xdf, 0xdf,
-	0xa1, 0x90, 0xe2, 0x33, 0xb0, 0x34, 0x9e, 0x4e, 0xba, 0x02, 0x4e, 0xdb, 0xbb, 0xf1, 0xd6, 0x9d,
-	0xb2, 0x77, 0x69, 0xbb, 0xae, 0x83, 0x33, 0xf6, 0x2e, 0xa2, 0x69, 0xa5, 0x4d, 0xb7, 0xc5, 0xdb,
-	0x04, 0xec, 0xdd, 0x3a, 0x2f, 0x29, 0xfe, 0x54, 0x00, 0x4b, 0x9b, 0xd8, 0x0a, 0x7a, 0x1e, 0x86,
-	0xb8, 0xe9, 0xb6, 0xdb, 0xb8, 0x63, 0xc7, 0xb6, 0x41, 0x03, 0x13, 0x5b, 0x18, 0x9c, 0xd8, 0xd2,
-	0xfb, 0xe0, 0xf4, 0x1e, 0x63, 0xe5, 0x66, 0x70, 0x63, 0x6c, 0x1b, 0x43, 0x15, 0x21, 0x83, 0xf4,
-	0x29, 0x58, 0xe1, 0x7f, 0x22, 0x6f, 0x40, 0x2f, 0x8a, 0x99, 0xc4, 0xa4, 0x99, 0x92, 0x08, 0x9a,
-	0x9b, 0xc4, 0xf2, 0xde, 0xf8, 0xca, 0xe2, 0x31, 0xb8, 0x64, 0xca, 0x5b, 0x6c, 0x27, 0x8b, 0x3f,
-	0xee, 0x61, 0x8f, 0x1f, 0x56, 0x5e, 0x07, 0x6c, 0x9b, 0x83, 0xc8, 0xbe, 0x94, 0x65, 0x16, 0x4e,
-	0x41, 0x40, 0x8b, 0x6a, 0xa4, 0xa4, 0x4f, 0x80, 0xed, 0x7d, 0x1c, 0x6e, 0x8d, 0x18, 0x81, 0x4a,
-	0x4a, 0xc8, 0x2e, 0xd7, 0xf1, 0x91, 0xdf, 0xa3, 0x1e, 0x99, 0x2f, 0x7a, 0x73, 0x8e, 0x6f, 0xb0,
-	0x82, 0xe2, 0xbf, 0x4c, 0x81, 0x2b, 0xcc, 0xd5, 0x6f, 0x79, 0x56, 0xf7, 0x40, 0x7e, 0x6e, 0x18,
-	0x4d, 0xab, 0x13, 0x66, 0xde, 0x5c, 0xe4, 0xb2, 0x9b, 0xeb, 0xc8, 0xe1, 0xd7, 0x28, 0x0c, 0xc4,
-	0x34, 0xbc, 0xc0, 0x74, 0x34, 0xa3, 0xfb, 0x95, 0x18, 0x16, 0x32, 0x18, 0x0c, 0xcb, 0x34, 0xc7,
-	0x42, 0x22, 0x27, 0xbf, 0xbf, 0x91, 0xdb, 0xf7, 0xdc, 0x5e, 0x97, 0xa1, 0x99, 0xe6, 0x1b, 0xb9,
-	0x2d, 0x5a, 0xd4, 0x97, 0x41, 0x63, 0x24, 0x6a, 0xa6, 0xa1, 0x0c, 0x1a, 0x12, 0x11, 0x5b, 0x67,
-	0x04, 0x5d, 0xb7, 0xe5, 0x34, 0x1d, 0xcc, 0xf6, 0xd2, 0xd3, 0xf0, 0x1c, 0x2d, 0xad, 0xf3, 0x42,
-	0xe9, 0x4d, 0x20, 0x71, 0xec, 0x87, 0x3e, 0x6a, 0xb6, 0x7a, 0x7e, 0x10, 0xae, 0x9c, 0xd3, 0x50,
-	0x64, 0xd0, 0x0f, 0x7d, 0x85, 0x97, 0xf7, 0x5b, 0xea, 0xd9, 0x7e, 0xac, 0xa5, 0xa7, 0x63, 0x2d,
-	0x85, 0xb6, 0xdf, 0x6f, 0xe9, 0x7d, 0xc0, 0x64, 0x20, 0xff, 0x1d, 0xb4, 0xdb, 0x6b, 0x1e, 0xe2,
-	0xc0, 0x2f, 0xcc, 0x52, 0x62, 0x06, 0xce, 0x78, 0x67, 0x83, 0x95, 0x92, 0xd0, 0x8d, 0x53, 0x5a,
-	0xed, 0x56, 0x34, 0x3f, 0xfd, 0xc2, 0x1c, 0xa5, 0x66, 0x18, 0x0d, 0xab, 0xdd, 0x0a, 0x27, 0x69,
-	0x8c, 0xc3, 0x75, 0xec, 0x66, 0x8c, 0x03, 0xc4, 0x38, 0x74, 0xc7, 0x6e, 0xf6, 0x39, 0xa2, 0x2e,
-	0xb1, 0x9a, 0x34, 0x9c, 0xf3, 0x0b, 0x67, 0x62, 0x5d, 0x22, 0xf3, 0xc2, 0xe2, 0x0f, 0x05, 0x70,
-	0xbb, 0xa1, 0xc5, 0x06, 0x5b, 0xf1, 0xdc, 0xe3, 0xce, 0x53, 0x7c, 0x8c, 0x5b, 0x25, 0x67, 0x6f,
-	0xef, 0x99, 0x83, 0x8f, 0xd9, 0xb8, 0x3f, 0x01, 0x05, 0x6b, 0x6f, 0x6f, 0x30, 0x87, 0x0d, 0xc5,
-	0xd2, 0x66, 0xe7, 0xe0, 0x42, 0x58, 0x1f, 0x25, 0x7a, 0xb2, 0xe3, 0xbc, 0xc7, 0x60, 0x61, 0x94,
-	0x33, 0x96, 0xa4, 0x7c, 0x69, 0x98, 0x8f, 0x66, 0xfa, 0x6c, 0x82, 0xab, 0x06, 0x6e, 0xf6, 0x3c,
-	0x27, 0x38, 0x81, 0x74, 0x5a, 0x6d, 0xe1, 0x00, 0x62, 0xbf, 0xd7, 0xe2, 0x4b, 0x71, 0xd2, 0x46,
-	0x5a, 0x02, 0xd3, 0x24, 0xf2, 0xe3, 0x51, 0x20, 0xfd, 0xbb, 0x68, 0x81, 0x8b, 0x51, 0x9e, 0xc8,
-	0x26, 0x0e, 0x9a, 0x07, 0x8c, 0x7d, 0xd4, 0x3b, 0x0a, 0x49, 0xde, 0x71, 0xc4, 0x25, 0xe7, 0x47,
-	0x5d, 0x72, 0xf1, 0x07, 0x02, 0x90, 0x88, 0x2d, 0x9b, 0x96, 0x7f, 0x48, 0xa6, 0x2e, 0x8e, 0x3c,
-	0x52, 0x60, 0xf9, 0x87, 0x71, 0x67, 0x37, 0x4b, 0x0a, 0xc2, 0x84, 0x6c, 0xc7, 0xf7, 0x7b, 0x03,
-	0x52, 0xe7, 0x68, 0x09, 0xad, 0xbe, 0x04, 0x66, 0x88, 0x77, 0x09, 0x43, 0x14, 0xf6, 0x41, 0x7c,
-	0x7f, 0x64, 0x87, 0xb1, 0xfb, 0xce, 0x19, 0x38, 0x1f, 0x15, 0xb3, 0xfb, 0xce, 0xbf, 0xfd, 0x00,
-	0x9c, 0x6f, 0x10, 0x2f, 0x44, 0x91, 0xe8, 0x1d, 0xac, 0xef, 0x49, 0x0d, 0x70, 0xbe, 0xe7, 0xa0,
-	0x5d, 0x9a, 0xac, 0x8f, 0x9a, 0x2d, 0xa7, 0x79, 0x98, 0x1a, 0xee, 0x8d, 0xe6, 0xf6, 0x97, 0x73,
-	0xf0, 0x5c, 0xcf, 0x89, 0x95, 0x4a, 0x3f, 0x12, 0xc0, 0x83, 0x9e, 0x83, 0x5c, 0x96, 0xbb, 0x8e,
-	0xf8, 0x91, 0x09, 0x46, 0xfb, 0x2e, 0x0a, 0x5c, 0x64, 0x87, 0xc9, 0xfd, 0x5c, 0x23, 0x5b, 0x3e,
-	0xe5, 0x09, 0x1a, 0xb3, 0xbd, 0x10, 0x28, 0xe7, 0xe0, 0xad, 0x9e, 0x93, 0x4a, 0x2b, 0x7d, 0x57,
-	0x00, 0xb7, 0x62, 0xe8, 0x2c, 0xdb, 0x46, 0x7b, 0x8e, 0x47, 0xa3, 0x53, 0x3e, 0xaa, 0x0c, 0x17,
-	0x5b, 0xf9, 0x3e, 0x4c, 0xc7, 0x35, 0xfe, 0xc5, 0x41, 0x39, 0x07, 0xaf, 0x45, 0x90, 0x12, 0xc9,
-	0x86, 0xfb, 0x2a, 0x01, 0x4d, 0xcb, 0x0a, 0xa2, 0xd1, 0x99, 0xc9, 0xda, 0x57, 0x29, 0xcf, 0x1b,
-	0x06, 0xfa, 0x6a, 0x3c, 0xad, 0xf4, 0x2b, 0x02, 0xb8, 0x11, 0x43, 0xe7, 0xe3, 0x00, 0x35, 0xa3,
-	0x97, 0x10, 0xc8, 0xa7, 0x8f, 0x10, 0xa8, 0xb3, 0x3c, 0xb3, 0xfe, 0x7e, 0x3a, 0xa8, 0x71, 0xef,
-	0x28, 0xca, 0x39, 0x78, 0x35, 0x42, 0x93, 0x40, 0x24, 0xfd, 0xa6, 0x00, 0x6e, 0xc7, 0x60, 0x78,
-	0x3c, 0xeb, 0x89, 0x6c, 0x92, 0xd8, 0x73, 0x88, 0x10, 0xca, 0x69, 0x0a, 0xe5, 0xcb, 0xe9, 0x50,
-	0x26, 0x3d, 0xa8, 0x28, 0xe7, 0xe0, 0x8d, 0x08, 0xce, 0x18, 0xc2, 0xb0, 0x67, 0x3c, 0xfe, 0x44,
-	0x01, 0x91, 0xf0, 0x96, 0x4c, 0x40, 0xf6, 0x44, 0x82, 0x0f, 0xd7, 0x6c, 0x6a, 0xcf, 0xa4, 0x3c,
-	0xb0, 0x60, 0x3d, 0x33, 0x9e, 0x48, 0xfa, 0x14, 0x5c, 0x4d, 0x42, 0xd1, 0x3d, 0xe1, 0x08, 0xe6,
-	0x28, 0x82, 0x2f, 0x66, 0x47, 0x10, 0x7f, 0xa1, 0x51, 0xce, 0xc1, 0xc2, 0x88, 0x76, 0x4e, 0x20,
-	0xfd, 0x22, 0x58, 0x19, 0xd5, 0xdc, 0xf5, 0x9c, 0x4e, 0xc0, 0x55, 0x03, 0xaa, 0xfa, 0xdd, 0xac,
-	0xaa, 0x87, 0xde, 0x77, 0x94, 0x73, 0x70, 0x71, 0x48, 0x77, 0x9f, 0x42, 0x6a, 0x81, 0xc5, 0x9e,
-	0x83, 0x6c, 0xee, 0xc4, 0x49, 0xd4, 0xe5, 0x91, 0xa5, 0x84, 0x0a, 0xa7, 0x8b, 0xda, 0x99, 0xf5,
-	0x87, 0x19, 0x72, 0x06, 0xe3, 0xaf, 0x24, 0xca, 0x39, 0xb8, 0xd0, 0x73, 0x12, 0xdf, 0x4f, 0x7c,
-	0x97, 0x99, 0x5f, 0xa4, 0xae, 0xbf, 0xd6, 0x85, 0xa9, 0x22, 0x5c, 0xf3, 0x59, 0xaa, 0xf9, 0xbd,
-	0x0c, 0x9a, 0x93, 0x1f, 0x3e, 0x30, 0xcb, 0x4b, 0x79, 0x1c, 0xf1, 0x4d, 0x6a, 0x78, 0x11, 0x18,
-	0x9e, 0x5e, 0xeb, 0xb3, 0x4c, 0x59, 0x0e, 0xe4, 0x1c, 0x05, 0xf2, 0x85, 0xcf, 0x94, 0x67, 0xcb,
-	0x6c, 0x6e, 0x42, 0x5e, 0xf4, 0xaf, 0x31, 0x07, 0xda, 0x47, 0xc0, 0x03, 0xfa, 0xfe, 0xbc, 0x64,
-	0x20, 0xe6, 0x29, 0x88, 0x27, 0x59, 0x40, 0x24, 0xa5, 0x33, 0x96, 0x73, 0xf0, 0x7a, 0x0c, 0x47,
-	0x62, 0xc6, 0xe3, 0xef, 0x30, 0xef, 0x39, 0x0a, 0xa5, 0x19, 0xde, 0x64, 0xa3, 0x76, 0xd0, 0xf2,
-	0x39, 0xa0, 0xf3, 0x14, 0xd0, 0x97, 0x5e, 0x00, 0xd0, 0x68, 0x82, 0x61, 0x39, 0x07, 0x6f, 0x8f,
-	0xa2, 0xea, 0xd3, 0x05, 0x2d, 0x9e, 0x63, 0xf5, 0xd7, 0x02, 0x78, 0x32, 0x38, 0x4e, 0x34, 0x3d,
-	0x0d, 0x59, 0x34, 0x3f, 0x0d, 0xd9, 0x61, 0x82, 0x1a, 0x0a, 0x5c, 0xb7, 0xc5, 0x83, 0xc9, 0x56,
-	0x8b, 0x23, 0x15, 0x29, 0xd2, 0xa7, 0x99, 0xc6, 0x2f, 0x53, 0x1a, 0x60, 0x39, 0x07, 0x1f, 0xc5,
-	0x07, 0x35, 0x5b, 0xee, 0xe0, 0x8f, 0x05, 0xf0, 0x38, 0x53, 0x1b, 0xfa, 0xdd, 0xcd, 0xf0, 0x5f,
-	0xa0, 0xf8, 0xb7, 0x3e, 0x33, 0xfe, 0xc1, 0x44, 0x84, 0x72, 0x0e, 0xae, 0xa5, 0x81, 0x1f, 0x4a,
-	0x5d, 0xf8, 0x5d, 0x01, 0xbc, 0x11, 0x47, 0x6e, 0xf5, 0x48, 0xe4, 0x11, 0xed, 0x41, 0x63, 0x4f,
-	0x2e, 0x18, 0x60, 0x89, 0x02, 0xfe, 0x28, 0x03, 0xe0, 0x49, 0x89, 0x75, 0xe5, 0x1c, 0xbc, 0xdb,
-	0x07, 0x3a, 0x31, 0x05, 0xef, 0x4f, 0x05, 0xf0, 0x30, 0xc5, 0x72, 0x1d, 0xab, 0xcd, 0x36, 0x2f,
-	0x27, 0x1c, 0xe4, 0x45, 0x0a, 0x72, 0xe3, 0xb3, 0xd8, 0xef, 0x60, 0x6e, 0x4b, 0x39, 0x07, 0x1f,
-	0x4c, 0x30, 0x62, 0xcd, 0x6a, 0xc7, 0x13, 0x61, 0x7e, 0x4b, 0x00, 0x77, 0xe3, 0x50, 0xbb, 0x51,
-	0xbe, 0xc8, 0xc8, 0xb8, 0x5f, 0xa2, 0x08, 0x3f, 0xc8, 0x80, 0x70, 0x5c, 0xd2, 0x49, 0x39, 0x07,
-	0x8b, 0x7d, 0x68, 0x63, 0x53, 0x53, 0x7e, 0x59, 0x00, 0x37, 0xe3, 0x98, 0x02, 0xec, 0x07, 0x04,
-	0x4d, 0x67, 0xc0, 0x1f, 0x5f, 0x4e, 0x5d, 0xfd, 0x26, 0x64, 0x80, 0x94, 0x73, 0x70, 0xa5, 0x8f,
-	0x24, 0x29, 0x45, 0xc4, 0x03, 0xcb, 0x71, 0x0c, 0x61, 0x9c, 0x1b, 0xae, 0x43, 0x0b, 0x29, 0x97,
-	0x0c, 0xe3, 0x52, 0x30, 0xd8, 0xb2, 0x3b, 0x26, 0x3d, 0xa3, 0x05, 0x0a, 0x3d, 0x87, 0x04, 0x61,
-	0x56, 0x80, 0x51, 0x07, 0x1f, 0xd3, 0xfd, 0x2f, 0x5f, 0x71, 0xaf, 0xa4, 0x1c, 0x8d, 0x8d, 0x4d,
-	0x7e, 0x28, 0xe7, 0xe0, 0xa5, 0x9e, 0x33, 0x5a, 0x29, 0x9d, 0xd0, 0x45, 0x7e, 0x58, 0x9b, 0x6f,
-	0x1d, 0x85, 0x2a, 0x0b, 0xa9, 0x3d, 0x3c, 0x21, 0xa3, 0x82, 0x35, 0x34, 0x99, 0x40, 0xfa, 0x26,
-	0xb8, 0x9e, 0xd4, 0x50, 0x9a, 0xc4, 0xc0, 0x95, 0x2f, 0xa6, 0x2e, 0x30, 0x13, 0x13, 0x20, 0xca,
-	0x39, 0xb8, 0x34, 0xdc, 0xea, 0x3e, 0x89, 0xf4, 0x07, 0xcc, 0x85, 0x0c, 0x23, 0x60, 0x47, 0xf5,
-	0xf1, 0x24, 0x09, 0x8e, 0x66, 0x89, 0xa2, 0x51, 0xb2, 0xa2, 0x99, 0x90, 0x6b, 0x51, 0xce, 0xc1,
-	0x3b, 0x43, 0xc0, 0x92, 0xa9, 0xa5, 0x3f, 0x16, 0xc0, 0x5a, 0xdc, 0x04, 0x9d, 0xfe, 0x51, 0x23,
-	0xb2, 0x8e, 0x7d, 0x76, 0x34, 0xc0, 0xa7, 0x05, 0xb7, 0xca, 0xe5, 0xd4, 0x2d, 0x44, 0xb6, 0xc7,
-	0x89, 0xe5, 0x1c, 0xbc, 0xdf, 0xb7, 0xd2, 0x38, 0xed, 0xb1, 0xaf, 0x3b, 0x76, 0x73, 0xe0, 0x21,
-	0xe3, 0xf7, 0x04, 0x70, 0x27, 0x39, 0x64, 0xb0, 0x7d, 0x84, 0xe9, 0xa1, 0x28, 0x87, 0x77, 0x35,
-	0x73, 0x08, 0x95, 0xfc, 0x66, 0x70, 0x30, 0x84, 0x8a, 0x68, 0x6c, 0x3f, 0xfe, 0x42, 0x2e, 0x60,
-	0x66, 0x4d, 0xd6, 0xdb, 0xc0, 0x45, 0x2c, 0x7b, 0x80, 0x8d, 0x22, 0x47, 0xb1, 0x92, 0x3a, 0x75,
-	0x93, 0x1f, 0xa1, 0x71, 0x8b, 0x4e, 0x7e, 0xa0, 0xf6, 0x35, 0x70, 0xc1, 0xa2, 0x69, 0x0c, 0xa8,
-	0x9f, 0x44, 0x50, 0xb8, 0x46, 0x35, 0x8d, 0x3f, 0x82, 0x4e, 0x4c, 0xb9, 0x29, 0xe7, 0xa0, 0x68,
-	0x0d, 0x55, 0x84, 0x2e, 0x31, 0x6e, 0x02, 0xbc, 0x67, 0x69, 0x78, 0xcc, 0x5b, 0x76, 0x3d, 0x75,
-	0xc2, 0x4e, 0xb8, 0xec, 0x60, 0x2e, 0x71, 0xd2, 0x6d, 0x08, 0x0f, 0x95, 0x13, 0x40, 0x44, 0xa7,
-	0x00, 0x0c, 0xc7, 0x8d, 0xd4, 0x71, 0x9e, 0x7c, 0x07, 0xc2, 0xc6, 0x39, 0xe5, 0x9e, 0xe4, 0xdb,
-	0x02, 0x75, 0x22, 0xe1, 0xbe, 0xf1, 0xeb, 0xf1, 0x67, 0xf8, 0xe1, 0x96, 0xf1, 0x66, 0xd6, 0xdd,
-	0xeb, 0xb8, 0x47, 0xfc, 0x03, 0xbb, 0xd7, 0x04, 0x22, 0xe9, 0x13, 0xc0, 0x07, 0x0b, 0xe1, 0x30,
-	0x03, 0xa9, 0x50, 0xa4, 0x5a, 0xdf, 0x4a, 0x19, 0xf6, 0xc1, 0x8c, 0xa5, 0x72, 0x0e, 0x9e, 0xb7,
-	0x06, 0xcb, 0xa5, 0x36, 0xb8, 0xc2, 0x65, 0x13, 0x07, 0x15, 0x4f, 0x5c, 0x2a, 0xdc, 0x4a, 0x39,
-	0xb9, 0x1f, 0x9f, 0x3f, 0x54, 0xce, 0xc1, 0xcb, 0x56, 0x52, 0xad, 0xb4, 0x0b, 0x2e, 0xf7, 0x4f,
-	0x49, 0x98, 0x63, 0x64, 0xc3, 0x79, 0x9b, 0x2a, 0x7b, 0x73, 0xac, 0xb2, 0x84, 0xbb, 0x8d, 0x72,
-	0x0e, 0x5e, 0xf4, 0x12, 0xae, 0x3c, 0x8e, 0xc1, 0xd5, 0x31, 0x87, 0xeb, 0x4c, 0xd5, 0x9d, 0x94,
-	0x76, 0x8d, 0xbf, 0x10, 0x20, 0x0e, 0x7f, 0x6f, 0xfc, 0x75, 0xc1, 0x2e, 0xe0, 0xad, 0x46, 0xfc,
-	0xce, 0xd2, 0x63, 0xa9, 0x51, 0x85, 0xbb, 0x29, 0x8d, 0x4b, 0x48, 0xa7, 0x22, 0x8d, 0xb3, 0x12,
-	0xb2, 0xac, 0x2a, 0xe0, 0x5c, 0xa4, 0x83, 0x8e, 0xd2, 0x3d, 0x2a, 0xfb, 0x4e, 0xaa, 0x6c, 0x42,
-	0x5c, 0xce, 0xc1, 0xb3, 0x56, 0x3c, 0x11, 0x6a, 0x07, 0x48, 0xf1, 0xeb, 0x55, 0x36, 0x22, 0x85,
-	0xfb, 0x29, 0x59, 0x9b, 0xc3, 0x79, 0x40, 0xd4, 0x9b, 0x0c, 0xe7, 0x06, 0x0d, 0x89, 0xee, 0xd1,
-	0x9c, 0x92, 0xc2, 0x83, 0xcc, 0xa2, 0x59, 0x12, 0xca, 0xa0, 0x68, 0x9e, 0x98, 0x32, 0x24, 0xda,
-	0xa6, 0x77, 0xce, 0x85, 0xd5, 0xcc, 0xa2, 0xd9, 0x25, 0xf5, 0xa0, 0x68, 0x7e, 0x71, 0xdd, 0x02,
-	0x8b, 0x71, 0xd1, 0x3c, 0xed, 0x83, 0xf7, 0xcb, 0x1b, 0x29, 0xe7, 0x02, 0xc9, 0x79, 0x40, 0xe5,
-	0x1c, 0x5c, 0xb0, 0x92, 0x33, 0x84, 0x92, 0xb5, 0xf1, 0xae, 0x7a, 0xf3, 0x05, 0xb5, 0x45, 0x1d,
-	0x36, 0xa2, 0x8d, 0x77, 0x5b, 0xb2, 0x36, 0xde, 0x7b, 0x6f, 0xbd, 0xa0, 0xb6, 0xa8, 0x0f, 0x47,
-	0xb4, 0xf1, 0x9e, 0x6c, 0x83, 0xa5, 0xb8, 0x36, 0x9a, 0x0d, 0xe2, 0x93, 0xd5, 0xb2, 0xe7, 0x63,
-	0xaf, 0xb0, 0x96, 0x59, 0x5d, 0x3c, 0x25, 0x66, 0x50, 0xdd, 0x40, 0xb2, 0xcc, 0xaf, 0x0b, 0xa0,
-	0x18, 0x0f, 0x10, 0xe2, 0x37, 0x49, 0xfd, 0x63, 0x96, 0xc2, 0xc3, 0xd4, 0x33, 0xd9, 0xd4, 0x07,
-	0x3d, 0xec, 0x4c, 0x36, 0x22, 0x6b, 0x8e, 0x92, 0x49, 0x87, 0xe0, 0x4a, 0xc2, 0x09, 0x0b, 0x76,
-	0x9a, 0xb8, 0xf0, 0x76, 0x6a, 0x88, 0x3d, 0xe6, 0x39, 0x0d, 0x0b, 0xb1, 0x87, 0x2a, 0x9d, 0x26,
-	0x1e, 0x56, 0x16, 0x86, 0x9b, 0xae, 0x8d, 0x0b, 0x8f, 0x32, 0x2b, 0x1b, 0x7a, 0xc2, 0x32, 0xa8,
-	0xac, 0x5f, 0x29, 0x7d, 0x15, 0x5c, 0x08, 0xac, 0x7d, 0xbe, 0x0e, 0x61, 0xb2, 0x20, 0x7a, 0x27,
-	0x85, 0xf5, 0x94, 0xb5, 0x28, 0xe9, 0xc2, 0x91, 0xac, 0x45, 0x81, 0xb5, 0x1f, 0x2f, 0x97, 0x02,
-	0xb0, 0xe4, 0xf3, 0xeb, 0x19, 0xe4, 0x51, 0x49, 0x68, 0x1f, 0xd3, 0x83, 0xec, 0x5e, 0x2b, 0x28,
-	0xbc, 0x93, 0x72, 0x24, 0x35, 0xe9, 0x66, 0xa7, 0x9c, 0x83, 0x57, 0xfc, 0xe4, 0xfa, 0xe1, 0x69,
-	0xc1, 0x53, 0x4c, 0xf8, 0x94, 0x7f, 0x9c, 0xd9, 0x4e, 0xe3, 0x89, 0x49, 0x83, 0x76, 0x3a, 0x90,
-	0xb2, 0x94, 0xac, 0x8d, 0x4f, 0xc2, 0x2f, 0xbc, 0xa0, 0xb6, 0xa4, 0x49, 0x38, 0x90, 0x87, 0xb3,
-	0x0b, 0x2e, 0x87, 0x86, 0x71, 0x82, 0xf6, 0x70, 0xd0, 0x3c, 0xe0, 0x6b, 0xe0, 0x17, 0x53, 0x56,
-	0xa4, 0x84, 0xeb, 0x2d, 0xb2, 0x22, 0xd9, 0x09, 0xb7, 0x5e, 0xdf, 0x1f, 0x3a, 0xcd, 0xe3, 0x06,
-	0xd8, 0xd7, 0xcb, 0xf6, 0xf8, 0x85, 0x77, 0x33, 0x1f, 0x9e, 0x8d, 0x7f, 0x89, 0x3d, 0x78, 0xa4,
-	0x97, 0x48, 0x27, 0x7d, 0x6b, 0x68, 0x67, 0x7f, 0xd8, 0xdb, 0xc5, 0xf4, 0x72, 0x76, 0x60, 0x9b,
-	0xf0, 0x24, 0xf3, 0x01, 0xe7, 0xe8, 0x0f, 0x64, 0x0c, 0x1e, 0x70, 0xd2, 0xfa, 0xc3, 0x81, 0xed,
-	0xc1, 0x77, 0x92, 0xbb, 0xc4, 0xea, 0x76, 0xe9, 0x31, 0x6b, 0x74, 0xc0, 0xf9, 0x5e, 0xea, 0x09,
-	0xf7, 0xa4, 0x97, 0x56, 0x83, 0x8e, 0x28, 0xf1, 0x2d, 0x56, 0x17, 0x2c, 0x73, 0x6b, 0xdb, 0xf7,
-	0xac, 0xee, 0x01, 0xdd, 0xd2, 0xf9, 0x4d, 0x2b, 0x8c, 0x84, 0xde, 0xa7, 0xfa, 0xdf, 0x4e, 0xb1,
-	0xb7, 0x91, 0xfb, 0x7a, 0x32, 0x9b, 0xac, 0x58, 0xd5, 0xb1, 0xdf, 0xbf, 0xca, 0xff, 0x01, 0xdb,
-	0xa8, 0x0d, 0x68, 0x6d, 0x7a, 0xee, 0x71, 0x07, 0xfd, 0x02, 0x3e, 0xc6, 0x2d, 0x64, 0x3b, 0x7b,
-	0x7b, 0x74, 0x0b, 0x5c, 0xf8, 0x20, 0xd5, 0x1e, 0xd2, 0x6f, 0x90, 0x99, 0x3d, 0x4c, 0xa4, 0x93,
-	0xfe, 0x3f, 0xb8, 0x4c, 0x93, 0x38, 0xe8, 0xbd, 0x29, 0xbd, 0xf3, 0xe4, 0xad, 0xff, 0x30, 0xed,
-	0xa6, 0x72, 0xe4, 0xfa, 0xb5, 0x9c, 0x83, 0x52, 0x6f, 0xf4, 0x52, 0x96, 0x1d, 0xa8, 0x27, 0xee,
-	0x9b, 0x70, 0x97, 0x2b, 0xfb, 0x52, 0xaa, 0xbd, 0x8d, 0x4f, 0x5f, 0x62, 0xf6, 0x36, 0xbe, 0x7e,
-	0xe3, 0x34, 0x98, 0xa1, 0x92, 0x9e, 0x4e, 0xcf, 0xe6, 0xc5, 0x29, 0x42, 0x1c, 0x6d, 0x59, 0x88,
-	0x03, 0x0d, 0x6f, 0x37, 0xe8, 0x06, 0x75, 0xf5, 0xaf, 0xce, 0xf7, 0x7f, 0xdc, 0x2a, 0x8c, 0xaa,
-	0xa5, 0x9b, 0x60, 0xa5, 0xa4, 0x19, 0x8a, 0xfe, 0x4c, 0x85, 0x08, 0xaa, 0x86, 0xde, 0x80, 0xca,
-	0xf0, 0x4f, 0x53, 0x5c, 0x05, 0x85, 0x51, 0x12, 0x43, 0x85, 0xcf, 0x54, 0x28, 0x0a, 0xd2, 0x0d,
-	0x70, 0x75, 0xb4, 0x76, 0xbb, 0xb1, 0xa1, 0xc2, 0x9a, 0x6a, 0xaa, 0x86, 0x98, 0x97, 0xde, 0x01,
-	0x0f, 0x47, 0x29, 0x4a, 0xb2, 0x29, 0x6f, 0xc8, 0x86, 0x8a, 0xea, 0xba, 0x61, 0x6e, 0x41, 0xd5,
-	0x40, 0x86, 0x5a, 0xd9, 0x44, 0x65, 0xdd, 0x30, 0xd5, 0x92, 0x38, 0x25, 0xbd, 0x0d, 0xde, 0x9c,
-	0xc0, 0x54, 0xdd, 0x31, 0x3e, 0xae, 0x0c, 0x70, 0x4c, 0x4b, 0xeb, 0x60, 0x6d, 0x12, 0x87, 0x5e,
-	0xdb, 0xd2, 0x4b, 0x1b, 0x03, 0x3c, 0x33, 0xd2, 0x1b, 0xe0, 0x5e, 0x16, 0x68, 0xb0, 0x64, 0x88,
-	0xa7, 0xa4, 0xfb, 0xe0, 0x76, 0x2a, 0x24, 0x42, 0x79, 0x5a, 0xba, 0x0b, 0x8a, 0xa3, 0x94, 0x72,
-	0xbd, 0x5e, 0xd1, 0x14, 0xd9, 0xd4, 0xf4, 0x1a, 0x2a, 0x9b, 0x66, 0x5d, 0x9c, 0x95, 0xee, 0x80,
-	0x9b, 0x93, 0xe9, 0x4c, 0xa5, 0x2e, 0xce, 0x25, 0x93, 0x3d, 0xd7, 0x6a, 0x25, 0xfd, 0xb9, 0x81,
-	0x4a, 0xaa, 0xb1, 0x6d, 0xea, 0x75, 0x11, 0x48, 0x6f, 0x82, 0xfb, 0x13, 0xf0, 0x19, 0x1f, 0x57,
-	0xd8, 0x98, 0x51, 0x8c, 0x67, 0x52, 0x3a, 0xb8, 0xdf, 0x74, 0xb5, 0x64, 0x94, 0xb5, 0x4d, 0x53,
-	0x3c, 0x2b, 0x3d, 0x06, 0x6f, 0x67, 0x92, 0x1f, 0xef, 0xe2, 0x73, 0x29, 0x7a, 0xa0, 0x5a, 0xd2,
-	0x06, 0x87, 0x7e, 0x3e, 0xeb, 0xa0, 0x6c, 0x29, 0x75, 0xf1, 0x7c, 0xa6, 0x41, 0x21, 0x94, 0x62,
-	0xe6, 0xee, 0x21, 0xd4, 0x17, 0xa4, 0x0f, 0xc0, 0xbb, 0x2f, 0xd2, 0x3d, 0x7c, 0x3e, 0x54, 0x54,
-	0xc3, 0x10, 0x25, 0xe9, 0x2d, 0xf0, 0x20, 0x0b, 0xb3, 0xfc, 0x49, 0x03, 0xaa, 0xe2, 0x45, 0xe9,
-	0x1e, 0xb8, 0x35, 0x81, 0xbc, 0xb4, 0x53, 0x93, 0xab, 0x7a, 0x69, 0x43, 0xbc, 0x94, 0x62, 0xe2,
-	0x8a, 0x6c, 0x18, 0x72, 0xad, 0x04, 0x65, 0xb4, 0xad, 0xee, 0x18, 0x75, 0x59, 0x51, 0x0d, 0xf1,
-	0x72, 0xca, 0xa8, 0xf5, 0x79, 0xe2, 0x63, 0xb0, 0x20, 0x3d, 0x01, 0x8f, 0x27, 0x70, 0xa9, 0x15,
-	0xd9, 0x30, 0x35, 0xc5, 0x50, 0x65, 0xa8, 0x94, 0x07, 0x38, 0xaf, 0x64, 0x1a, 0x6f, 0xce, 0x2f,
-	0x2b, 0x65, 0x55, 0x2c, 0xa4, 0xf4, 0x16, 0xe3, 0xa8, 0xaa, 0x55, 0x1d, 0xee, 0x94, 0x36, 0xc4,
-	0xc5, 0x4c, 0x0a, 0x68, 0xcf, 0x22, 0xa6, 0x60, 0x29, 0xa5, 0x31, 0x8c, 0x43, 0xa9, 0x34, 0x0c,
-	0x73, 0xc8, 0x78, 0x97, 0xa5, 0x55, 0x70, 0x37, 0xd5, 0xba, 0xd8, 0x28, 0x5e, 0x95, 0xd6, 0xc0,
-	0x6a, 0x26, 0xfb, 0x62, 0xf4, 0x2b, 0x29, 0x83, 0xd9, 0xa7, 0xaf, 0x6a, 0x0a, 0xd4, 0x0d, 0x7d,
-	0xd3, 0x14, 0xaf, 0x49, 0x5f, 0x04, 0xeb, 0x93, 0x06, 0x53, 0x57, 0xb6, 0xa1, 0x2e, 0x2b, 0xe5,
-	0x21, 0x3f, 0x77, 0x3d, 0xc5, 0xf6, 0x43, 0xdf, 0x28, 0x9b, 0x15, 0xd9, 0x10, 0x6f, 0xa4, 0xcc,
-	0x29, 0xa3, 0xa6, 0x3f, 0xdf, 0xac, 0xc8, 0xdb, 0xaa, 0x78, 0x73, 0x8c, 0x5c, 0x5d, 0x89, 0xf5,
-	0x6e, 0xc9, 0x40, 0x75, 0xa8, 0x7f, 0x65, 0x47, 0x2c, 0x8e, 0x31, 0xc5, 0x38, 0x75, 0x59, 0xdb,
-	0x2a, 0x23, 0xf9, 0x99, 0xac, 0x55, 0xe4, 0x0d, 0xad, 0xa2, 0x99, 0x3b, 0xe2, 0x2d, 0xe9, 0x5d,
-	0xf0, 0x4e, 0x0a, 0x17, 0x9d, 0x21, 0x9a, 0x82, 0xa0, 0xba, 0xa5, 0x19, 0x26, 0xa4, 0xae, 0x53,
-	0xbc, 0x9d, 0xec, 0x85, 0x0d, 0xb9, 0x5a, 0x89, 0xbb, 0x58, 0xf1, 0x8e, 0x54, 0x04, 0xd7, 0x46,
-	0xe9, 0x54, 0x65, 0x9d, 0xfd, 0x08, 0x53, 0x4d, 0x51, 0xc5, 0xbb, 0x63, 0x8c, 0x4e, 0x57, 0x86,
-	0xdd, 0x30, 0xaa, 0xe9, 0x35, 0x24, 0x97, 0xc4, 0x7b, 0xd2, 0x6d, 0x70, 0x63, 0xd2, 0xba, 0x48,
-	0x7f, 0x9c, 0xe7, 0x7e, 0xb2, 0xed, 0xc7, 0x57, 0x00, 0xf9, 0xb9, 0x81, 0x14, 0xbd, 0x66, 0xe8,
-	0x15, 0x55, 0x7c, 0xb0, 0xfa, 0x87, 0x02, 0x98, 0x1f, 0xfc, 0x6d, 0x47, 0xe9, 0x3a, 0x58, 0x8e,
-	0x24, 0x18, 0xa6, 0x6c, 0x36, 0x8c, 0xa1, 0xe5, 0x7b, 0x19, 0x5c, 0x19, 0x26, 0x30, 0x1a, 0x8a,
-	0x42, 0x3c, 0x95, 0x90, 0x58, 0xb9, 0xad, 0xd5, 0xeb, 0x6a, 0x49, 0xcc, 0x4b, 0x8b, 0xe0, 0xf2,
-	0x70, 0xa5, 0x0a, 0xa1, 0x0e, 0xc5, 0xa9, 0x24, 0x3e, 0x79, 0x43, 0x87, 0x74, 0x25, 0x5e, 0xfd,
-	0x69, 0x1e, 0x4c, 0x29, 0xa6, 0x2c, 0x5d, 0x04, 0xe7, 0x15, 0x53, 0x1e, 0xfd, 0x15, 0x2d, 0x52,
-	0x28, 0x37, 0xcc, 0x32, 0x69, 0x58, 0x4d, 0x55, 0x4c, 0x9d, 0xc4, 0x11, 0x57, 0xc0, 0x45, 0x5a,
-	0xae, 0x98, 0xda, 0x33, 0x12, 0x5e, 0x18, 0x86, 0xa6, 0xd7, 0x48, 0xf8, 0x10, 0x55, 0x10, 0xc8,
-	0x08, 0xaa, 0x1f, 0x37, 0x54, 0xc3, 0x34, 0xc4, 0xa9, 0xb0, 0xa2, 0x0e, 0xd5, 0xaa, 0xd6, 0xa8,
-	0x22, 0xa3, 0x51, 0xaf, 0xeb, 0xd0, 0x14, 0xa7, 0xc3, 0x0a, 0x13, 0x92, 0x29, 0x5d, 0x42, 0x25,
-	0xf5, 0x99, 0x46, 0x7c, 0xe1, 0x4c, 0xa8, 0xbb, 0x51, 0xdf, 0x82, 0x72, 0x49, 0x45, 0x1b, 0x72,
-	0xad, 0xa6, 0x42, 0xf1, 0x54, 0xc8, 0xb0, 0xa1, 0x55, 0x2a, 0x5a, 0x6d, 0x0b, 0x19, 0x8d, 0x6a,
-	0x55, 0x86, 0x3b, 0xe2, 0xe9, 0xb0, 0x05, 0x5c, 0x77, 0x45, 0x33, 0x4c, 0x71, 0x96, 0xfe, 0xd6,
-	0x52, 0xbf, 0xb0, 0xaa, 0xd7, 0x34, 0x53, 0x87, 0x5a, 0x6d, 0x4b, 0x9c, 0xa3, 0xbf, 0xe2, 0x64,
-	0xca, 0x48, 0xfd, 0x8a, 0xa9, 0xc2, 0x9a, 0x5c, 0x41, 0x72, 0xa3, 0xa4, 0x99, 0xc8, 0x30, 0x75,
-	0x28, 0x6f, 0xa9, 0x22, 0x08, 0x01, 0xe8, 0xdb, 0x04, 0x85, 0x41, 0xfa, 0x6e, 0xa7, 0xa6, 0x88,
-	0x67, 0x24, 0x11, 0x9c, 0xa5, 0x7c, 0x35, 0x13, 0xca, 0x48, 0x2b, 0x89, 0x67, 0xa5, 0x0b, 0xe0,
-	0x5c, 0x44, 0x69, 0x28, 0x5a, 0x55, 0x3c, 0x17, 0xea, 0xd5, 0x4a, 0x6a, 0xcd, 0xd4, 0xcc, 0x1d,
-	0x64, 0xa8, 0x4a, 0x03, 0x92, 0x39, 0x32, 0xbf, 0xfa, 0x37, 0x73, 0xe0, 0x72, 0xe2, 0x43, 0x05,
-	0xb2, 0xb6, 0x68, 0x35, 0x53, 0xdd, 0x62, 0xb3, 0x02, 0xa9, 0x35, 0xa8, 0x57, 0x2a, 0x68, 0x5b,
-	0xab, 0x0d, 0xff, 0x3e, 0xd5, 0x4d, 0xb0, 0x32, 0x8e, 0xd0, 0xa8, 0xc8, 0xca, 0xb6, 0x28, 0x10,
-	0x93, 0x1e, 0x47, 0x42, 0xcc, 0x54, 0xd7, 0x4a, 0x8a, 0x98, 0x27, 0xd1, 0xca, 0x38, 0xaa, 0xba,
-	0xbc, 0xa5, 0xc2, 0x52, 0xc3, 0xdc, 0x11, 0xa7, 0x26, 0xe9, 0x53, 0xab, 0xb2, 0x56, 0x11, 0xa7,
-	0x49, 0x68, 0x39, 0x8e, 0xe4, 0xa9, 0x06, 0x65, 0x71, 0x46, 0xba, 0x05, 0xae, 0x8f, 0xa3, 0xa0,
-	0xe6, 0x09, 0x4b, 0xe2, 0x29, 0xe2, 0x07, 0xc6, 0x11, 0x55, 0x65, 0xd3, 0x54, 0x61, 0x55, 0x37,
-	0x4c, 0xf1, 0xf4, 0xa4, 0xe6, 0x55, 0x0d, 0x64, 0xaa, 0x72, 0xd5, 0x10, 0x67, 0x27, 0x51, 0xe9,
-	0x75, 0x63, 0x4b, 0xad, 0x69, 0xaa, 0x38, 0x37, 0x09, 0x3a, 0x19, 0x52, 0x11, 0x4c, 0x6c, 0x9c,
-	0x5c, 0xdd, 0x14, 0xcf, 0x4c, 0xc6, 0xad, 0x94, 0xb5, 0x9a, 0xca, 0x4c, 0xe5, 0x0b, 0xe0, 0x51,
-	0x3a, 0x1d, 0xda, 0xd2, 0xcc, 0x72, 0x63, 0x83, 0xce, 0x2f, 0x32, 0xaf, 0xce, 0x49, 0x0f, 0xc1,
-	0x1b, 0x19, 0xd8, 0x14, 0x0d, 0x2a, 0x15, 0x55, 0xd1, 0xc4, 0x79, 0xe2, 0xab, 0xb2, 0xe9, 0xa9,
-	0xc8, 0x1b, 0xe2, 0x79, 0xb2, 0x1e, 0x66, 0x20, 0x7f, 0xaa, 0xd6, 0xb6, 0xb5, 0x9a, 0x21, 0x8a,
-	0x19, 0xe9, 0xe5, 0x9a, 0xa1, 0x6d, 0x54, 0x54, 0xf1, 0xc2, 0xa4, 0xee, 0x21, 0x2b, 0xa7, 0xa6,
-	0xa8, 0x35, 0xfd, 0xb9, 0x28, 0x4d, 0x1a, 0xb0, 0x68, 0xbe, 0x5d, 0x24, 0xab, 0xcc, 0x58, 0x4b,
-	0x92, 0x4d, 0xb9, 0xa4, 0x6f, 0x21, 0xad, 0xa6, 0xd0, 0xb9, 0x87, 0xaa, 0x72, 0x4d, 0xde, 0x52,
-	0xab, 0x6a, 0xcd, 0x14, 0x2f, 0x91, 0x10, 0x21, 0x0b, 0xec, 0xe7, 0x24, 0x16, 0xcb, 0x46, 0x4b,
-	0x02, 0xd0, 0x05, 0xb2, 0xb4, 0x66, 0x91, 0x4b, 0x83, 0x09, 0x1a, 0x75, 0x65, 0xa0, 0xa6, 0x41,
-	0x61, 0x85, 0x44, 0xf3, 0x05, 0xe9, 0x11, 0x78, 0x2b, 0x03, 0x47, 0x6c, 0x23, 0xb7, 0x38, 0xc9,
-	0x62, 0xc8, 0xfc, 0x8f, 0x1c, 0x93, 0xa2, 0xd6, 0x4c, 0x15, 0x8a, 0x4b, 0x93, 0x86, 0x94, 0x9b,
-	0x23, 0x54, 0xeb, 0x3a, 0xf7, 0xa4, 0xe2, 0xf2, 0xea, 0xb7, 0xa7, 0x13, 0xdc, 0x18, 0xd9, 0xed,
-	0x8e, 0x71, 0x63, 0x86, 0xa9, 0xd6, 0x87, 0xdc, 0x58, 0xb2, 0x4a, 0x4a, 0x28, 0x3f, 0x37, 0x34,
-	0x25, 0x5c, 0x73, 0x98, 0xb7, 0x12, 0xa4, 0x2f, 0x83, 0xf7, 0x27, 0xd3, 0x1b, 0xaa, 0xc9, 0x01,
-	0x12, 0xf7, 0x8f, 0x4a, 0xea, 0xa6, 0xdc, 0xa8, 0x98, 0x48, 0x7f, 0x4e, 0x96, 0x8e, 0xbc, 0xf4,
-	0x25, 0xf0, 0xde, 0x64, 0xfe, 0x46, 0xbd, 0xa2, 0xcb, 0xac, 0x83, 0x68, 0xec, 0x61, 0xd4, 0x51,
-	0x55, 0x35, 0x65, 0x62, 0x54, 0xe2, 0x14, 0x09, 0xe8, 0x26, 0xb3, 0x9b, 0xaa, 0x61, 0xd2, 0x05,
-	0x20, 0x04, 0x4e, 0x62, 0x96, 0xe9, 0x31, 0xe6, 0x4a, 0xf9, 0x58, 0xcf, 0x42, 0x19, 0x29, 0x50,
-	0x95, 0x4d, 0x15, 0xc5, 0xe8, 0xc4, 0x99, 0x49, 0x0a, 0x87, 0x19, 0xb7, 0xb4, 0x70, 0x5b, 0x23,
-	0x9e, 0xca, 0xa6, 0x90, 0xfe, 0x02, 0x21, 0x89, 0xbc, 0x0d, 0xa3, 0x8c, 0x14, 0x15, 0x12, 0xaf,
-	0x9a, 0x6c, 0x99, 0x89, 0x0a, 0x21, 0x09, 0x72, 0x66, 0x57, 0x7f, 0x26, 0x24, 0x3e, 0x2a, 0x0b,
-	0x1f, 0x84, 0x8d, 0x1d, 0x62, 0x1a, 0x85, 0x28, 0x7a, 0x69, 0xf8, 0xfc, 0x22, 0x79, 0xd6, 0xc5,
-	0xe9, 0xfb, 0xf1, 0x50, 0x06, 0xda, 0x28, 0x3c, 0xba, 0x0f, 0x6e, 0xa7, 0xd0, 0x86, 0xd1, 0x52,
-	0xba, 0xd4, 0x7e, 0xf0, 0xf4, 0x11, 0x38, 0xcd, 0xef, 0x21, 0x49, 0x58, 0xb2, 0xa9, 0xca, 0x26,
-	0xe9, 0xd0, 0x91, 0x90, 0x2e, 0xac, 0x18, 0x0e, 0x72, 0x84, 0xd5, 0xdf, 0x17, 0xc0, 0xf2, 0x84,
-	0x57, 0x42, 0xc4, 0x8d, 0x87, 0xcc, 0x50, 0x55, 0xf4, 0x6a, 0x55, 0xad, 0x95, 0x18, 0xae, 0xc4,
-	0xf0, 0x71, 0x15, 0xdc, 0x9d, 0x4c, 0x5e, 0xd3, 0x4d, 0x46, 0x2b, 0x10, 0x97, 0x3c, 0x99, 0xb6,
-	0xa4, 0xd7, 0x54, 0x31, 0xbf, 0xf1, 0xb5, 0xbf, 0xfb, 0xc9, 0x35, 0xe1, 0x1f, 0x7e, 0x72, 0x4d,
-	0xf8, 0xe7, 0x9f, 0x5c, 0x13, 0x3e, 0xd1, 0xf7, 0x9d, 0xe0, 0xa0, 0xb7, 0xbb, 0xd6, 0x74, 0xdb,
-	0x0f, 0xf7, 0x3d, 0xeb, 0xc8, 0x61, 0x79, 0x2a, 0x56, 0xeb, 0x61, 0xff, 0x3f, 0x07, 0x74, 0x9d,
-	0x87, 0xfb, 0xb8, 0xf3, 0x90, 0xbe, 0xe8, 0x7a, 0xb8, 0xef, 0x0e, 0xfd, 0x3b, 0x82, 0x0f, 0x62,
-	0x9f, 0x47, 0x8f, 0x76, 0x4f, 0x51, 0xb2, 0x77, 0xfe, 0x27, 0x00, 0x00, 0xff, 0xff, 0xe9, 0x4e,
-	0x4f, 0x5b, 0xbe, 0x60, 0x00, 0x00,
+	// 6496 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe4, 0x7d, 0x5b, 0x6c, 0x1c, 0xc9,
+	0x75, 0xe8, 0xf4, 0x90, 0x94, 0xc8, 0x92, 0x44, 0xb5, 0x5a, 0x12, 0x35, 0x22, 0x45, 0x3d, 0x46,
+	0x6f, 0xee, 0x2e, 0xb5, 0xd2, 0x6a, 0xbd, 0xda, 0x87, 0xbd, 0xdb, 0xec, 0x69, 0xce, 0xb4, 0x38,
+	0x33, 0x3d, 0x5b, 0xdd, 0x23, 0x9a, 0x6b, 0x18, 0x75, 0x9b, 0xd3, 0x45, 0xb2, 0x2f, 0x87, 0xd3,
+	0xe3, 0xee, 0x1e, 0x72, 0x89, 0x0b, 0xc3, 0xbe, 0xbe, 0xf7, 0x1a, 0x17, 0xd7, 0xf6, 0x75, 0x02,
+	0x24, 0x46, 0x80, 0x0d, 0xf2, 0x40, 0x1e, 0x08, 0xe0, 0x00, 0xf9, 0x32, 0xfc, 0x95, 0x8f, 0xfc,
+	0x05, 0x48, 0x3e, 0x0c, 0x04, 0xc8, 0x47, 0xf2, 0x13, 0xf8, 0x2b, 0x7f, 0xfe, 0x4a, 0x80, 0xc4,
+	0x79, 0xa1, 0x1e, 0x3d, 0xd3, 0x33, 0xd3, 0x3d, 0xdd, 0xda, 0x68, 0x63, 0x43, 0xfb, 0xc7, 0xa9,
+	0x3a, 0xaf, 0x3a, 0x75, 0xea, 0x9c, 0x53, 0x55, 0xa7, 0x9a, 0xe0, 0x7e, 0x80, 0xdb, 0xb8, 0xeb,
+	0x7a, 0xc1, 0x83, 0x9e, 0x6f, 0xed, 0x62, 0x7c, 0x88, 0x3b, 0x81, 0xff, 0xe0, 0xf0, 0x61, 0xf4,
+	0xe7, 0x6a, 0xd7, 0x73, 0x03, 0x57, 0xba, 0x14, 0x82, 0xae, 0x46, 0xfb, 0x0e, 0x1f, 0x2e, 0xde,
+	0xed, 0xd3, 0xb0, 0x5a, 0x2d, 0xec, 0xfb, 0x6d, 0xc7, 0x0f, 0x08, 0x89, 0xc1, 0x2f, 0x46, 0xa1,
+	0xb8, 0x02, 0xa4, 0xa6, 0xb6, 0x66, 0x75, 0x3a, 0xd8, 0x53, 0xda, 0x4e, 0x6b, 0x5f, 0x25, 0x24,
+	0xa4, 0x0b, 0x60, 0xc6, 0x6a, 0x63, 0x2f, 0x28, 0x08, 0xd7, 0x85, 0x7b, 0x73, 0x90, 0xfd, 0x28,
+	0xae, 0x83, 0x7b, 0x4d, 0x4d, 0xef, 0x6c, 0xbb, 0x96, 0x67, 0x2b, 0xee, 0x41, 0xb7, 0x8d, 0x03,
+	0x5c, 0x76, 0x4d, 0xb7, 0x64, 0xf9, 0x7b, 0xac, 0x71, 0x40, 0x61, 0x11, 0xcc, 0xf6, 0x7c, 0xec,
+	0x75, 0xac, 0x03, 0xcc, 0x89, 0xf4, 0x7f, 0x17, 0x6f, 0x83, 0x9b, 0x7d, 0x3a, 0xb2, 0x6d, 0xaf,
+	0x3b, 0x9e, 0x1f, 0x40, 0xec, 0xbb, 0x3d, 0xaf, 0x85, 0x07, 0x24, 0x8a, 0x2b, 0x11, 0x76, 0xa3,
+	0x60, 0x55, 0x2b, 0x88, 0x0a, 0x5c, 0x7c, 0x1f, 0xdc, 0xe8, 0xc3, 0x1a, 0x38, 0x50, 0x3c, 0x6c,
+	0xe3, 0x4e, 0xe0, 0x58, 0x6d, 0xa3, 0xb7, 0x7d, 0xe0, 0x04, 0xe9, 0x32, 0x45, 0x09, 0x7c, 0xd8,
+	0xc3, 0x7e, 0xe0, 0xb8, 0x9d, 0x8e, 0xe5, 0x78, 0x38, 0x2b, 0x81, 0xaf, 0x83, 0xdb, 0x7d, 0x02,
+	0x10, 0xef, 0x3a, 0x3e, 0x11, 0x70, 0xcf, 0x6a, 0xb7, 0x71, 0x67, 0x37, 0x2b, 0x11, 0xe9, 0x32,
+	0x98, 0x3d, 0xd8, 0xb1, 0x50, 0x70, 0xdc, 0xc5, 0x85, 0x3c, 0xed, 0x3b, 0x79, 0xb0, 0x63, 0x99,
+	0xc7, 0x5d, 0x2c, 0x2d, 0x03, 0xd0, 0x76, 0x77, 0x9d, 0x0e, 0xda, 0x69, 0xbb, 0x47, 0x85, 0x29,
+	0xda, 0x39, 0x47, 0x5b, 0xd6, 0xdb, 0xee, 0x11, 0x93, 0x1f, 0xe2, 0x96, 0x7b, 0x88, 0xbd, 0x63,
+	0xc5, 0xb5, 0xb1, 0xaf, 0xb8, 0x9d, 0xc0, 0xe9, 0xf4, 0x70, 0xc6, 0x49, 0x79, 0x17, 0x2c, 0x8f,
+	0x11, 0xe8, 0x1e, 0x67, 0x44, 0x7e, 0x0f, 0x5c, 0x1d, 0x41, 0x6e, 0x78, 0x4e, 0x27, 0xc8, 0x88,
+	0x5d, 0x04, 0x62, 0xc9, 0xf1, 0x29, 0x72, 0x0d, 0x07, 0x96, 0x6d, 0x05, 0x96, 0x34, 0x0f, 0xf2,
+	0x8e, 0xcd, 0x21, 0xf3, 0x8e, 0x5d, 0xb4, 0x40, 0x21, 0x84, 0x09, 0x6d, 0xa0, 0x0f, 0xab, 0x82,
+	0x59, 0x8f, 0xb7, 0x51, 0x8c, 0xf9, 0x47, 0xf7, 0x57, 0x13, 0x16, 0xc6, 0xea, 0x28, 0x11, 0xd8,
+	0x47, 0x2d, 0xee, 0x03, 0x29, 0xec, 0x35, 0x02, 0xdc, 0x35, 0x02, 0x2b, 0xe8, 0xf9, 0xd2, 0xfb,
+	0xe0, 0x84, 0x4f, 0xff, 0xe2, 0xa4, 0xef, 0xa6, 0x92, 0x66, 0x88, 0x90, 0xa3, 0x91, 0xb5, 0x84,
+	0x3d, 0xcf, 0xf5, 0xf8, 0x84, 0xb2, 0x1f, 0xc5, 0xdf, 0x17, 0xc0, 0x42, 0x53, 0x8b, 0xa0, 0x78,
+	0x01, 0xb6, 0x99, 0xaa, 0x54, 0x30, 0x7b, 0xc0, 0x87, 0x46, 0x79, 0x9e, 0xca, 0x30, 0x9c, 0x50,
+	0x17, 0xb0, 0x8f, 0x2a, 0x29, 0x7d, 0xc1, 0xf3, 0x94, 0xc8, 0x2b, 0x19, 0x04, 0x0f, 0x47, 0x1d,
+	0x0a, 0x5f, 0xfc, 0x57, 0x01, 0x5c, 0x1f, 0x88, 0x19, 0x2a, 0xcd, 0xc0, 0x6d, 0xdc, 0x22, 0x2b,
+	0xe4, 0x85, 0x0a, 0x5c, 0x8b, 0x4c, 0x23, 0x13, 0xf9, 0x61, 0xe6, 0x69, 0x1c, 0x90, 0x0b, 0x49,
+	0x44, 0xc6, 0x3f, 0xf5, 0xe9, 0xc7, 0xff, 0x7f, 0xf2, 0xc4, 0x09, 0x85, 0x00, 0x5a, 0x27, 0xc0,
+	0xbb, 0x9e, 0x45, 0x46, 0x2e, 0x6f, 0x1a, 0xba, 0x56, 0x52, 0x14, 0xb7, 0xd3, 0xc1, 0xad, 0xe0,
+	0xa5, 0xd7, 0xc3, 0x8f, 0xf3, 0x51, 0x3b, 0x28, 0x59, 0x81, 0xb5, 0x6d, 0xf9, 0x18, 0x96, 0x0c,
+	0xb5, 0xe3, 0xb9, 0xed, 0xf6, 0xcb, 0x3e, 0x7e, 0xe9, 0x09, 0x28, 0xf8, 0xd4, 0xe8, 0xb1, 0x8d,
+	0x42, 0xca, 0x3e, 0x6a, 0xb9, 0xbd, 0x4e, 0x50, 0x98, 0xbe, 0x2e, 0xdc, 0x9b, 0x82, 0x0b, 0x61,
+	0x7f, 0x28, 0x8a, 0xaf, 0x90, 0xde, 0xe2, 0x3f, 0x09, 0xe0, 0xca, 0x40, 0x73, 0x1b, 0xbd, 0x6d,
+	0xac, 0x6e, 0x7c, 0x4e, 0xb4, 0x56, 0x7c, 0x0a, 0x0a, 0x4d, 0x4d, 0xb1, 0xda, 0x6d, 0xd3, 0x95,
+	0xa9, 0xbf, 0x88, 0x04, 0x84, 0x55, 0x30, 0xd5, 0xe2, 0x23, 0x9e, 0x7f, 0x74, 0x25, 0x91, 0xba,
+	0x62, 0xca, 0x90, 0x00, 0x16, 0xbf, 0x37, 0x13, 0xd5, 0x63, 0x09, 0x77, 0xdb, 0xee, 0xb1, 0x81,
+	0xbd, 0x43, 0xa7, 0x85, 0x5f, 0x7a, 0xeb, 0xdb, 0x05, 0x67, 0x6c, 0x3a, 0x60, 0x74, 0x80, 0x83,
+	0x3d, 0xd7, 0xa6, 0x26, 0x37, 0xff, 0x68, 0x2d, 0x91, 0xd6, 0x24, 0x45, 0xad, 0xb2, 0xa6, 0x1a,
+	0xa5, 0x04, 0x4f, 0xdb, 0x91, 0x5f, 0x92, 0x05, 0x4e, 0x71, 0x46, 0x34, 0x05, 0x99, 0xa1, 0x6c,
+	0x3e, 0xf8, 0xcf, 0xb0, 0x21, 0xb9, 0x0b, 0x04, 0x76, 0xff, 0xef, 0x22, 0x02, 0xa7, 0xa3, 0x02,
+	0x48, 0xcb, 0xe0, 0x72, 0x49, 0x6d, 0x54, 0xf5, 0x2d, 0x54, 0x53, 0xcd, 0x8a, 0x5e, 0x42, 0xcd,
+	0xba, 0xd1, 0x50, 0x15, 0x6d, 0x5d, 0x53, 0x4b, 0x62, 0x4e, 0x5a, 0x00, 0xd2, 0x70, 0xb7, 0xdc,
+	0x34, 0x75, 0x51, 0x90, 0x0a, 0xe0, 0xc2, 0x70, 0x7b, 0x4d, 0xae, 0x37, 0xe5, 0xaa, 0x98, 0x2f,
+	0x62, 0x00, 0x06, 0xac, 0xa5, 0x25, 0x70, 0x89, 0xc3, 0x99, 0x5b, 0x0d, 0x75, 0x84, 0xf8, 0x55,
+	0xb0, 0x18, 0xed, 0xd4, 0xea, 0x86, 0x29, 0x57, 0xab, 0xc8, 0x50, 0xa0, 0xd6, 0x30, 0x45, 0x41,
+	0x5a, 0x04, 0x0b, 0xd1, 0x7e, 0xb9, 0x26, 0x7f, 0xa4, 0xd7, 0x91, 0xaa, 0x18, 0x62, 0xbe, 0xf8,
+	0xc9, 0x34, 0xb8, 0x35, 0x18, 0xbf, 0xe2, 0x61, 0x2b, 0xc0, 0xe1, 0xaf, 0x63, 0xc5, 0xed, 0xec,
+	0x38, 0xbb, 0x2f, 0xbd, 0x5d, 0xba, 0xe0, 0x4c, 0x8b, 0x8e, 0x74, 0xd8, 0x2e, 0x9f, 0x66, 0x30,
+	0x98, 0x64, 0x85, 0xad, 0xb2, 0xbf, 0x43, 0xfb, 0x6c, 0x45, 0x7e, 0x15, 0xff, 0x50, 0x00, 0xa7,
+	0xa3, 0xdd, 0xc4, 0x7a, 0x14, 0xbd, 0xbe, 0xae, 0x95, 0xe3, 0xad, 0x67, 0xac, 0x5b, 0xde, 0x34,
+	0x90, 0xaa, 0x3c, 0x42, 0x86, 0x51, 0x13, 0x05, 0x32, 0xff, 0xf1, 0xdd, 0xaa, 0xa6, 0xa8, 0x62,
+	0x3e, 0x1e, 0x1d, 0x96, 0x0c, 0x6a, 0x02, 0x53, 0xd2, 0x65, 0x70, 0x31, 0x06, 0x7d, 0xc3, 0x10,
+	0xa7, 0x8b, 0xff, 0x22, 0x80, 0x6b, 0x31, 0xf1, 0x92, 0xef, 0x0b, 0x5e, 0x7a, 0xc7, 0xff, 0x3f,
+	0xf3, 0xd1, 0xc5, 0x11, 0x0e, 0x9f, 0xcd, 0x5c, 0xcf, 0xc3, 0x35, 0xb3, 0x6a, 0xbc, 0xf4, 0x3a,
+	0xf8, 0xff, 0x79, 0xf0, 0x30, 0xea, 0x20, 0xfd, 0xfd, 0xc0, 0xed, 0x92, 0x30, 0x78, 0x88, 0x4b,
+	0x8e, 0x87, 0x5b, 0x81, 0xeb, 0x1d, 0x9b, 0xae, 0xdb, 0xf6, 0xb5, 0x8e, 0x1f, 0x58, 0x9f, 0x83,
+	0x6c, 0xe0, 0x3b, 0x79, 0xb0, 0x9a, 0xa6, 0x90, 0xbe, 0x89, 0xbc, 0xf4, 0xda, 0xf8, 0xe3, 0x3c,
+	0xb8, 0x33, 0xd0, 0x86, 0xdc, 0x0b, 0xdc, 0xf0, 0xef, 0x48, 0x0a, 0xf9, 0xd2, 0x47, 0x90, 0xbb,
+	0xe0, 0x6c, 0x7c, 0x3a, 0x3d, 0xef, 0x0d, 0xa7, 0xd1, 0xdf, 0xcc, 0x83, 0x9b, 0x03, 0x75, 0xa9,
+	0xca, 0x23, 0xba, 0x6a, 0x3a, 0x9f, 0xa7, 0xbd, 0xe8, 0x3f, 0x0a, 0xe0, 0xf2, 0x68, 0xc6, 0x45,
+	0x02, 0xd5, 0xe7, 0x6c, 0xe0, 0x2c, 0x73, 0xa8, 0xbb, 0xf6, 0xcb, 0xef, 0x23, 0x7e, 0x2e, 0x80,
+	0xab, 0xa3, 0x03, 0x97, 0xbb, 0x5d, 0x92, 0x66, 0x7f, 0x0e, 0x92, 0x88, 0x6f, 0xe7, 0xc1, 0xfd,
+	0x09, 0x49, 0x84, 0x26, 0xd7, 0x1a, 0x6e, 0xdb, 0x69, 0x1d, 0xbf, 0xf4, 0x8a, 0xf8, 0x77, 0x01,
+	0x14, 0x07, 0x8a, 0x68, 0x78, 0x4e, 0xa7, 0xe5, 0x74, 0xad, 0xb6, 0xff, 0xf9, 0x09, 0x96, 0xff,
+	0x2c, 0x80, 0xe5, 0x81, 0x06, 0x4c, 0xec, 0x07, 0xfc, 0xe0, 0xed, 0xf3, 0xe0, 0xf7, 0xff, 0x41,
+	0x00, 0x85, 0x88, 0x17, 0xe0, 0x17, 0x2f, 0xf6, 0x4b, 0x3f, 0xee, 0x25, 0xe2, 0xf5, 0xb9, 0xb7,
+	0xc7, 0x47, 0xd0, 0x6d, 0x47, 0x2f, 0x87, 0xfe, 0x92, 0x5a, 0xc4, 0x50, 0xaf, 0x61, 0x1d, 0x46,
+	0x2f, 0x3b, 0x6e, 0x82, 0x33, 0x24, 0x43, 0xb0, 0x2d, 0xcf, 0x46, 0x3d, 0x1f, 0xb3, 0xcb, 0x84,
+	0x59, 0x78, 0x3a, 0x6c, 0x6c, 0xfa, 0xd8, 0x96, 0x96, 0xc0, 0xdc, 0xb1, 0x75, 0xd0, 0x66, 0x00,
+	0x79, 0x0a, 0x30, 0x4b, 0x1a, 0x68, 0xe7, 0x1d, 0x70, 0xf6, 0xc0, 0xb5, 0x31, 0x3a, 0xda, 0xc3,
+	0x1d, 0xe4, 0x5b, 0x87, 0xd8, 0xe6, 0xf7, 0x2e, 0x67, 0x48, 0xf3, 0xe6, 0x1e, 0xee, 0x10, 0x96,
+	0xb6, 0x24, 0x83, 0xe5, 0x1d, 0x07, 0xb7, 0x6d, 0x1f, 0x1d, 0x39, 0xc1, 0x1e, 0x6a, 0xb9, 0x9d,
+	0x43, 0xec, 0xf9, 0x8e, 0xdb, 0x41, 0xf4, 0xac, 0xdf, 0x2f, 0x4c, 0x5f, 0x9f, 0xba, 0x37, 0x07,
+	0x17, 0x19, 0xd0, 0xa6, 0x13, 0xec, 0x29, 0x7d, 0x10, 0x95, 0x42, 0x14, 0x6f, 0x90, 0xed, 0xe2,
+	0xf0, 0x58, 0x49, 0x72, 0xd3, 0x8e, 0x8c, 0xf8, 0x55, 0xb0, 0x32, 0x02, 0xf2, 0xcc, 0xc1, 0x47,
+	0x25, 0xb7, 0xd5, 0x3b, 0xc0, 0x9d, 0xc0, 0x1a, 0x3e, 0x5e, 0x2b, 0xfe, 0x48, 0x00, 0x17, 0x65,
+	0xdf, 0x77, 0xc8, 0x4a, 0xa1, 0x06, 0xd3, 0x5f, 0x29, 0x77, 0xc1, 0x59, 0x2e, 0x21, 0xc5, 0x41,
+	0xfd, 0x6b, 0x96, 0xf9, 0x68, 0xb3, 0x66, 0x4b, 0x37, 0xc0, 0xe9, 0xc0, 0x0d, 0xac, 0x36, 0x0a,
+	0xdc, 0x7d, 0xdc, 0x61, 0xd7, 0x08, 0x53, 0xf0, 0x14, 0x6d, 0x33, 0x69, 0x13, 0xd1, 0x71, 0xd7,
+	0x73, 0x0f, 0xba, 0x41, 0x08, 0x33, 0x45, 0x61, 0x4e, 0xb3, 0x46, 0x0e, 0xf4, 0x0a, 0x38, 0xd7,
+	0xea, 0xcb, 0x10, 0x02, 0xb2, 0x2c, 0x4f, 0x1c, 0x74, 0x30, 0xe0, 0xe2, 0x5f, 0x09, 0xe0, 0x02,
+	0x93, 0x5b, 0xfd, 0x18, 0xb7, 0x7a, 0x9f, 0x42, 0xec, 0x65, 0x00, 0x3a, 0x64, 0xd6, 0x58, 0x36,
+	0xc9, 0x84, 0x9e, 0x23, 0x2d, 0x34, 0x91, 0x1c, 0x1b, 0xd5, 0x54, 0x86, 0x51, 0x4d, 0x67, 0x1d,
+	0xd5, 0x4c, 0xc2, 0xa8, 0x9e, 0x80, 0x45, 0x36, 0xa8, 0x3a, 0x3e, 0x52, 0x22, 0xe2, 0xf6, 0xef,
+	0xc6, 0x5a, 0x56, 0x80, 0x77, 0x5d, 0xef, 0x38, 0xbc, 0x1b, 0x0b, 0x7f, 0x17, 0xff, 0x44, 0x00,
+	0xe7, 0x19, 0xaa, 0x4c, 0xaf, 0x6e, 0x21, 0xfe, 0x5a, 0x0f, 0xfb, 0xd4, 0xba, 0xc3, 0xd5, 0xc6,
+	0xce, 0xea, 0x18, 0xe2, 0xe9, 0xb0, 0x91, 0x1e, 0x7e, 0xfd, 0x42, 0x66, 0xf0, 0x13, 0x01, 0x9c,
+	0x0e, 0x25, 0x26, 0xcd, 0xd2, 0x02, 0x38, 0x61, 0xd1, 0xbf, 0xb8, 0x8c, 0xfc, 0xd7, 0x2f, 0x46,
+	0xba, 0x5b, 0x40, 0x62, 0x8a, 0xac, 0x3a, 0x7e, 0x90, 0x78, 0xdb, 0xf8, 0x0d, 0x50, 0x88, 0x42,
+	0x1d, 0x6c, 0x47, 0x6e, 0x26, 0x25, 0x30, 0x1d, 0xb9, 0xc5, 0xa4, 0x7f, 0x4b, 0x3a, 0x38, 0x7b,
+	0x40, 0xa1, 0xfc, 0x3d, 0xa7, 0x8b, 0xf6, 0x9d, 0x0e, 0x73, 0x26, 0xf3, 0x8f, 0xee, 0x0c, 0x1c,
+	0x5f, 0xe4, 0xea, 0xfd, 0xf0, 0xe1, 0x6a, 0xad, 0x0f, 0xbe, 0xe1, 0x74, 0x6c, 0x38, 0x7f, 0x30,
+	0xf4, 0xbb, 0xf8, 0x15, 0x20, 0x0e, 0x04, 0x60, 0x8b, 0x5e, 0x2a, 0x8f, 0xb9, 0xfa, 0x64, 0xb7,
+	0x3a, 0x3e, 0xc6, 0x81, 0xb3, 0x1f, 0x26, 0xde, 0xec, 0xda, 0x9f, 0x1d, 0xf1, 0x12, 0x26, 0xa1,
+	0xea, 0xc5, 0x11, 0xff, 0x53, 0x01, 0x2c, 0x8c, 0x4e, 0xcc, 0x0b, 0xd6, 0x8e, 0xf4, 0x51, 0x38,
+	0x97, 0xa8, 0x4f, 0x2f, 0x2d, 0x22, 0x26, 0xd9, 0x4a, 0x38, 0xad, 0xb5, 0x49, 0xf2, 0xbf, 0xe0,
+	0x09, 0xf8, 0x2f, 0x97, 0xff, 0x05, 0xcf, 0xf1, 0x67, 0x2a, 0xff, 0x6f, 0xe7, 0xa3, 0xf2, 0x97,
+	0x3d, 0xab, 0x13, 0xf8, 0xa6, 0xdb, 0xf4, 0xb1, 0x27, 0xad, 0x82, 0xf3, 0x34, 0x62, 0x20, 0xcf,
+	0x6d, 0x63, 0x1f, 0xed, 0x92, 0x3e, 0x9e, 0x34, 0xcc, 0xc0, 0x73, 0xb4, 0x8b, 0xc4, 0x5c, 0xbf,
+	0xcc, 0x3a, 0x48, 0xd0, 0x67, 0xf0, 0x4e, 0x67, 0x0f, 0x7b, 0x0e, 0xbd, 0x18, 0x1c, 0xc2, 0x9c,
+	0xa2, 0x98, 0x8b, 0x14, 0x48, 0x0b, 0x61, 0x86, 0x48, 0xbc, 0x0e, 0x2e, 0x30, 0x12, 0x81, 0x67,
+	0x39, 0xc1, 0x00, 0x33, 0x4f, 0x31, 0x25, 0xda, 0x67, 0xd2, 0xae, 0x10, 0x43, 0x01, 0x57, 0x47,
+	0x99, 0x8e, 0xe0, 0x4e, 0x53, 0xdc, 0xa5, 0x61, 0xae, 0xc3, 0x44, 0x96, 0xc0, 0x5c, 0xcf, 0xc7,
+	0x1e, 0xa2, 0x5e, 0x6c, 0x66, 0x50, 0x8b, 0x51, 0xb7, 0x0e, 0x70, 0xf1, 0x07, 0x53, 0x51, 0x0d,
+	0x41, 0x7c, 0xe8, 0xe0, 0xa3, 0x17, 0xbd, 0xc2, 0x9e, 0x80, 0xcb, 0xb6, 0x75, 0xec, 0xa3, 0xae,
+	0xe5, 0x07, 0xa8, 0x83, 0x3f, 0x0e, 0x90, 0xd5, 0xb3, 0x9d, 0x00, 0x91, 0x75, 0xc0, 0x07, 0x7f,
+	0x91, 0x00, 0x34, 0x2c, 0x12, 0x30, 0x3f, 0x0e, 0x64, 0xd2, 0x5b, 0x22, 0x22, 0xac, 0x83, 0x6b,
+	0x11, 0x3f, 0xeb, 0xe1, 0xaf, 0xf5, 0x1c, 0x0f, 0x93, 0xf4, 0xc7, 0x47, 0xad, 0x3d, 0xab, 0xb3,
+	0xcb, 0xd5, 0x3e, 0x0b, 0x97, 0x07, 0x60, 0x30, 0x02, 0xa5, 0x30, 0x20, 0xe9, 0x09, 0x28, 0x78,
+	0x74, 0x68, 0x68, 0x87, 0x10, 0xc1, 0x9d, 0xd6, 0x71, 0x9f, 0xc0, 0x34, 0x25, 0xb0, 0xc0, 0xfa,
+	0xd7, 0xc3, 0xee, 0x10, 0xf3, 0x3d, 0xb0, 0xc4, 0x31, 0x6d, 0xeb, 0x18, 0xb9, 0x3b, 0xe8, 0xc0,
+	0xed, 0x90, 0x9c, 0x8f, 0x23, 0xcf, 0x50, 0xe4, 0x4b, 0x0c, 0xa4, 0x64, 0x1d, 0xeb, 0x3b, 0x35,
+	0xd2, 0x1f, 0x62, 0xbf, 0x0d, 0x2e, 0x77, 0x7a, 0xd4, 0xb6, 0xdd, 0x1d, 0xe4, 0xe1, 0x03, 0xf7,
+	0x10, 0xdb, 0x88, 0x8b, 0x5a, 0x38, 0x41, 0x47, 0xbe, 0xc0, 0x00, 0xf4, 0x1d, 0xc8, 0xba, 0x79,
+	0xa0, 0x28, 0xfe, 0x9a, 0x30, 0x3e, 0x31, 0x2f, 0x7a, 0xe9, 0x3d, 0x04, 0x17, 0x59, 0x94, 0x42,
+	0x24, 0x4c, 0x21, 0x3e, 0x50, 0xc7, 0xe6, 0xa5, 0x2b, 0x92, 0x35, 0xc2, 0x5f, 0xb3, 0x8b, 0xdf,
+	0x15, 0xc0, 0xe5, 0x48, 0x59, 0x04, 0xbb, 0xd8, 0x4e, 0x8a, 0xab, 0xd2, 0x1a, 0x98, 0x8e, 0x04,
+	0xc7, 0xd5, 0x44, 0x29, 0xc7, 0x28, 0xd2, 0x20, 0x49, 0x71, 0x87, 0xcd, 0x77, 0x6a, 0xc4, 0x7c,
+	0x5d, 0xb2, 0x2b, 0x18, 0xc3, 0xa6, 0xe5, 0x35, 0x2c, 0xd7, 0xaa, 0x8f, 0xe9, 0xea, 0x51, 0x76,
+	0x29, 0x62, 0x22, 0x92, 0x07, 0xae, 0xc7, 0x30, 0x0c, 0x37, 0x69, 0x9f, 0x0d, 0xcf, 0xaf, 0x83,
+	0xa5, 0x98, 0x21, 0xf6, 0x2b, 0x96, 0x2a, 0x60, 0xba, 0xe5, 0xda, 0x61, 0x29, 0xd4, 0xe3, 0xec,
+	0xac, 0x18, 0xbe, 0xe2, 0xda, 0x18, 0x52, 0x0a, 0x09, 0xa5, 0x4b, 0xdf, 0xcc, 0x83, 0x2b, 0xb1,
+	0x4a, 0xc6, 0xdd, 0xcf, 0x64, 0xbc, 0xc4, 0x6a, 0xfc, 0x00, 0x77, 0x9f, 0xdf, 0x6a, 0x88, 0x48,
+	0x90, 0xe2, 0x4a, 0xd5, 0x91, 0x1d, 0xe9, 0xe3, 0xe7, 0xa3, 0x32, 0x7e, 0x34, 0x75, 0x33, 0x4e,
+	0x05, 0xec, 0x44, 0x42, 0xef, 0xe2, 0xce, 0x2f, 0xaf, 0x26, 0x36, 0xc0, 0x49, 0x9f, 0xc9, 0x49,
+	0x55, 0x31, 0x3f, 0x21, 0xae, 0x26, 0x0d, 0x10, 0x86, 0x14, 0x8a, 0xdf, 0xca, 0x83, 0xdb, 0x31,
+	0x8a, 0x58, 0x27, 0x3b, 0xdd, 0xcf, 0x74, 0x11, 0xbc, 0x10, 0x55, 0xa8, 0x60, 0x86, 0xee, 0xc9,
+	0xb9, 0x22, 0x1e, 0x64, 0x27, 0x42, 0x07, 0x08, 0x19, 0x76, 0xf1, 0xdf, 0x84, 0x04, 0x27, 0x40,
+	0xf6, 0x9c, 0xdd, 0xe3, 0x5f, 0xde, 0xf1, 0xaf, 0x83, 0x69, 0xba, 0x77, 0x64, 0xc3, 0x7f, 0x0e,
+	0x79, 0xc8, 0xd0, 0x68, 0x65, 0x07, 0xc5, 0x2f, 0xfe, 0x85, 0x00, 0x6e, 0xc4, 0x28, 0xa0, 0xea,
+	0x74, 0xf6, 0x23, 0x07, 0x32, 0xbf, 0x8c, 0x1a, 0x90, 0xc0, 0x74, 0xdb, 0xe9, 0xec, 0xf3, 0x38,
+	0x42, 0xff, 0x2e, 0xfe, 0xad, 0x00, 0xce, 0xf7, 0xcb, 0x91, 0x69, 0xea, 0xd3, 0x3f, 0x50, 0x4a,
+	0xdf, 0x72, 0x47, 0x2e, 0xb4, 0x90, 0xeb, 0x39, 0xbb, 0x4e, 0x87, 0x3b, 0xcf, 0xfe, 0x85, 0x96,
+	0x4e, 0x5b, 0xa5, 0xdb, 0x60, 0xbe, 0xd5, 0x76, 0x7b, 0x36, 0xea, 0x7a, 0xee, 0xa1, 0x63, 0x63,
+	0x2f, 0x3c, 0x5b, 0xa2, 0xad, 0x0d, 0xde, 0x28, 0xe9, 0x60, 0xd6, 0xe6, 0x27, 0xdf, 0x34, 0x33,
+	0x39, 0xf5, 0xe8, 0x8d, 0xd4, 0xb3, 0x34, 0x6c, 0x87, 0x87, 0xe5, 0x03, 0xad, 0x85, 0x44, 0x8a,
+	0xcf, 0xc0, 0x62, 0x32, 0x9c, 0x74, 0x09, 0x9c, 0xb4, 0xb7, 0xa3, 0xa3, 0x3b, 0x61, 0x6f, 0xd3,
+	0x71, 0x5d, 0x03, 0xa7, 0xec, 0x6d, 0x44, 0x6b, 0xc6, 0x5b, 0x6e, 0x9b, 0x8f, 0x09, 0xd8, 0xdb,
+	0x0d, 0xde, 0x52, 0xfc, 0x99, 0x00, 0x16, 0xd7, 0xb1, 0x15, 0xf4, 0x3c, 0x0c, 0x71, 0xcb, 0x3d,
+	0x38, 0xc0, 0x1d, 0x3b, 0x72, 0xc6, 0x31, 0x14, 0xb5, 0x85, 0xe1, 0xa8, 0x2d, 0xbd, 0x03, 0x4e,
+	0xee, 0x30, 0x54, 0x3e, 0x99, 0xd7, 0x13, 0xc7, 0x18, 0xb2, 0x08, 0x11, 0xa4, 0x8f, 0xc1, 0x32,
+	0xff, 0x13, 0x79, 0x43, 0x7c, 0x51, 0xc4, 0xdf, 0x4f, 0x0a, 0x83, 0xb1, 0x42, 0x73, 0x7f, 0xbf,
+	0xb4, 0x93, 0xdc, 0x59, 0x3c, 0x02, 0x17, 0x4c, 0xb9, 0xcc, 0x8e, 0xa9, 0xf0, 0x87, 0x3d, 0xec,
+	0xf1, 0x95, 0x7e, 0x0d, 0xb0, 0x33, 0x0c, 0xd4, 0x71, 0x6d, 0xcc, 0xca, 0x86, 0xa7, 0x20, 0xa0,
+	0x4d, 0x75, 0xd2, 0x32, 0x00, 0xc0, 0xf6, 0x2e, 0x0e, 0xcf, 0x3d, 0x18, 0x80, 0x4a, 0x5a, 0xa4,
+	0x65, 0x00, 0x1c, 0x1f, 0xf9, 0x3d, 0x9a, 0x6e, 0xf1, 0x8c, 0x76, 0xce, 0xf1, 0x0d, 0xd6, 0x50,
+	0xfc, 0xfb, 0x29, 0x70, 0x89, 0xe5, 0x71, 0x65, 0xcf, 0xea, 0xee, 0xc9, 0x9b, 0x86, 0xd1, 0xb2,
+	0x3a, 0x61, 0x59, 0xdd, 0x79, 0x4e, 0xbb, 0xf5, 0x08, 0x39, 0xfc, 0x8e, 0x94, 0x09, 0x31, 0x0d,
+	0xcf, 0x31, 0x1e, 0xad, 0xfe, 0xe5, 0x69, 0x44, 0x16, 0x32, 0x19, 0x4c, 0x96, 0x69, 0x2e, 0x0b,
+	0xd9, 0x16, 0xf9, 0x83, 0x53, 0x9a, 0x5d, 0xcf, 0xed, 0x75, 0x99, 0x34, 0xd3, 0xfc, 0x94, 0xa6,
+	0x4c, 0x9b, 0x06, 0x34, 0xe8, 0x06, 0x88, 0x9a, 0x69, 0x48, 0x83, 0xee, 0x77, 0x88, 0xad, 0x33,
+	0x80, 0xae, 0xdb, 0x76, 0x5a, 0x0e, 0x66, 0x07, 0x65, 0xd3, 0xf0, 0x0c, 0x6d, 0x6d, 0xf0, 0x46,
+	0xe9, 0x55, 0x20, 0x71, 0xd9, 0xf7, 0x7d, 0xd4, 0x6a, 0xf7, 0xfc, 0x20, 0x4c, 0x8b, 0xa7, 0xa1,
+	0xc8, 0x44, 0xdf, 0xf7, 0x15, 0xde, 0x3e, 0x18, 0xa9, 0x67, 0xfb, 0x91, 0x91, 0x9e, 0x8c, 0x8c,
+	0x14, 0xda, 0xfe, 0x60, 0xa4, 0xf7, 0x00, 0xa3, 0x81, 0xfc, 0x37, 0xd0, 0x76, 0xaf, 0xb5, 0x8f,
+	0x03, 0xbf, 0x30, 0x4b, 0x81, 0x99, 0x70, 0xc6, 0x1b, 0x6b, 0xac, 0x95, 0xec, 0xcb, 0x38, 0xa4,
+	0x75, 0xd0, 0xee, 0xaf, 0x4f, 0xbf, 0x30, 0x47, 0xa1, 0x99, 0x8c, 0x86, 0x75, 0xd0, 0x0e, 0x17,
+	0x69, 0x04, 0xc3, 0x75, 0xec, 0x56, 0x04, 0x03, 0x44, 0x30, 0x74, 0xc7, 0x6e, 0x0d, 0x30, 0xfa,
+	0x2a, 0xb1, 0x5a, 0x74, 0xaf, 0xe6, 0x17, 0x4e, 0x45, 0x54, 0x22, 0xf3, 0xc6, 0xe2, 0x0f, 0x04,
+	0x70, 0xab, 0xa9, 0x45, 0x26, 0x5b, 0xf1, 0xdc, 0xa3, 0xce, 0x53, 0x7c, 0x84, 0xdb, 0x25, 0x67,
+	0x67, 0xe7, 0x99, 0x83, 0x8f, 0xd8, 0xbc, 0x3f, 0x01, 0x05, 0x6b, 0x67, 0x67, 0xb8, 0x40, 0x15,
+	0x45, 0x6a, 0xe2, 0xe7, 0xe0, 0x42, 0xd8, 0xdf, 0xaf, 0xe2, 0x66, 0x67, 0xf5, 0x8f, 0xc1, 0xc2,
+	0x38, 0x66, 0xe4, 0x05, 0xc2, 0x85, 0x51, 0x3c, 0x5a, 0xc6, 0xb7, 0x0e, 0xae, 0x18, 0xb8, 0xd5,
+	0xf3, 0x9c, 0xe0, 0x18, 0xd2, 0x65, 0x55, 0xc6, 0x01, 0xc4, 0x7e, 0xaf, 0xcd, 0xf3, 0xec, 0xb8,
+	0x53, 0x32, 0x09, 0x4c, 0x93, 0x6d, 0x1d, 0xdf, 0xe2, 0xd1, 0xbf, 0x8b, 0x16, 0x38, 0xdf, 0x2f,
+	0x02, 0x5b, 0xc7, 0x41, 0x6b, 0x8f, 0xa1, 0x8f, 0x7b, 0x47, 0x21, 0xce, 0x3b, 0x8e, 0xb9, 0xe4,
+	0xfc, 0xb8, 0x4b, 0x2e, 0x7e, 0x5f, 0x00, 0x12, 0xb1, 0x65, 0xd3, 0xf2, 0xf7, 0xc9, 0xd2, 0xc5,
+	0x7d, 0x8f, 0x14, 0x58, 0xfe, 0x7e, 0xd4, 0xd9, 0xcd, 0x92, 0x86, 0xf0, 0xb5, 0x85, 0xe3, 0xfb,
+	0xbd, 0x21, 0xaa, 0x73, 0xb4, 0x85, 0x76, 0x5f, 0x00, 0x33, 0xc4, 0xbb, 0x84, 0xfb, 0x0f, 0xf6,
+	0x83, 0xf8, 0xfe, 0xbe, 0x1d, 0x46, 0x8a, 0x19, 0x66, 0xe0, 0x7c, 0xbf, 0x99, 0x15, 0x33, 0xfc,
+	0xe6, 0x07, 0xe0, 0x6c, 0x93, 0x78, 0x21, 0x2a, 0x89, 0xde, 0xc1, 0xfa, 0x8e, 0xd4, 0x04, 0x67,
+	0x7b, 0x0e, 0xda, 0xa6, 0x2f, 0x71, 0x50, 0x8b, 0x44, 0xcd, 0xd4, 0xbd, 0xdc, 0xf8, 0xc3, 0x9d,
+	0x4a, 0x0e, 0x9e, 0xe9, 0x39, 0x91, 0x56, 0xe9, 0x13, 0x01, 0xdc, 0xef, 0x39, 0xc8, 0x65, 0x0f,
+	0x53, 0x10, 0x3f, 0x0f, 0xc5, 0x68, 0xd7, 0x45, 0x81, 0x8b, 0xec, 0xf0, 0xe5, 0x0e, 0xe7, 0xc8,
+	0x72, 0x63, 0x79, 0x02, 0xc7, 0x6c, 0xcf, 0x7f, 0x2a, 0x39, 0x78, 0xb3, 0xe7, 0xa4, 0xc2, 0x4a,
+	0xdf, 0x11, 0xc0, 0xcd, 0x88, 0x74, 0x96, 0x6d, 0xa3, 0x1d, 0xc7, 0xa3, 0x5b, 0x4f, 0x3e, 0xab,
+	0x4c, 0x2e, 0x16, 0xf9, 0xde, 0x4b, 0x97, 0x2b, 0xf9, 0x39, 0x51, 0x25, 0x07, 0xaf, 0xf6, 0x45,
+	0x8a, 0x05, 0x1b, 0xd5, 0x55, 0x8c, 0x34, 0x6d, 0x2b, 0xe8, 0xcf, 0xce, 0x4c, 0x56, 0x5d, 0xa5,
+	0xbc, 0x5d, 0x1a, 0xd2, 0x55, 0x32, 0xac, 0xf4, 0xbf, 0x05, 0x70, 0x3d, 0x22, 0x9d, 0x8f, 0x03,
+	0xd4, 0xea, 0x3f, 0x73, 0x42, 0x3e, 0x7d, 0x61, 0x44, 0x9d, 0xe5, 0xa9, 0x47, 0xef, 0xa4, 0x0b,
+	0x95, 0xf4, 0x48, 0xaa, 0x92, 0x83, 0x57, 0xfa, 0xd2, 0xc4, 0x00, 0x49, 0xbf, 0x22, 0x80, 0x5b,
+	0x11, 0x31, 0x3c, 0x5e, 0xd2, 0x88, 0x5a, 0xe1, 0x5b, 0xa7, 0x50, 0x94, 0x93, 0x54, 0x94, 0x2f,
+	0xa5, 0x8b, 0x32, 0xe9, 0xb5, 0x54, 0x25, 0x07, 0xaf, 0xf7, 0xc5, 0x49, 0x00, 0x0c, 0x35, 0xe3,
+	0xf1, 0xf7, 0x47, 0x88, 0xec, 0x5d, 0xc9, 0x02, 0x64, 0xef, 0x9f, 0xf8, 0x74, 0xcd, 0xa6, 0x6a,
+	0x26, 0xe5, 0xf5, 0x14, 0xd3, 0x4c, 0x32, 0x90, 0xf4, 0x31, 0xb8, 0x12, 0x27, 0x45, 0xf7, 0x98,
+	0x4b, 0x30, 0x47, 0x25, 0xf8, 0x42, 0x76, 0x09, 0xa2, 0xcf, 0xaf, 0x2a, 0x39, 0x58, 0x18, 0xe3,
+	0xce, 0x01, 0xa4, 0xff, 0x01, 0x96, 0xc7, 0x39, 0x77, 0x3d, 0xa7, 0x13, 0x70, 0xd6, 0x80, 0xb2,
+	0x7e, 0x2b, 0x2b, 0xeb, 0x91, 0xc7, 0x5b, 0x95, 0x1c, 0xbc, 0x3c, 0xc2, 0x7b, 0x00, 0x21, 0xb5,
+	0xc1, 0xe5, 0x9e, 0x83, 0x6c, 0xee, 0xc4, 0x49, 0xd6, 0xe5, 0x91, 0x50, 0x42, 0x89, 0xd3, 0xa0,
+	0x76, 0x6a, 0xc2, 0xc6, 0x2a, 0xfe, 0x09, 0x54, 0x25, 0x07, 0x17, 0x7a, 0x4e, 0xec, 0xe3, 0xa8,
+	0xef, 0x30, 0xf3, 0xeb, 0xb3, 0x1b, 0xc4, 0xba, 0xb0, 0x0e, 0x8c, 0x73, 0x3e, 0x4d, 0x39, 0xbf,
+	0x9d, 0x81, 0x73, 0xfc, 0xab, 0x26, 0x66, 0x79, 0x29, 0x2f, 0x9f, 0xbe, 0x41, 0x0d, 0xaf, 0x2f,
+	0x0c, 0xaf, 0x9d, 0xf7, 0x59, 0x19, 0x3c, 0x17, 0xe4, 0x0c, 0x15, 0xe4, 0xcd, 0x4f, 0x55, 0x44,
+	0xcf, 0x6c, 0x6e, 0xc2, 0xa3, 0x87, 0xff, 0xcb, 0x1c, 0xe8, 0x40, 0x02, 0x9e, 0xd0, 0x0f, 0xd6,
+	0x25, 0x13, 0x62, 0x9e, 0x0a, 0xf1, 0x24, 0x8b, 0x10, 0x71, 0xb5, 0xca, 0x95, 0x1c, 0xbc, 0x16,
+	0x91, 0x23, 0xb6, 0x9c, 0xf9, 0x37, 0x98, 0xf7, 0x1c, 0x17, 0xa5, 0x15, 0x96, 0xa9, 0xa0, 0x83,
+	0xa0, 0xed, 0x73, 0x81, 0xce, 0x52, 0x81, 0xbe, 0xf8, 0x1c, 0x02, 0x8d, 0x57, 0x0f, 0x57, 0x72,
+	0xf0, 0xd6, 0xb8, 0x54, 0x03, 0xb8, 0xa0, 0xcd, 0x0b, 0x28, 0xff, 0x4c, 0x00, 0x4f, 0x86, 0xe7,
+	0x89, 0xd6, 0x9e, 0x22, 0x8b, 0x16, 0x9f, 0x22, 0x3b, 0xac, 0x3e, 0x45, 0x81, 0xeb, 0xb6, 0x79,
+	0x32, 0xd9, 0x6e, 0x73, 0x49, 0x45, 0x2a, 0xe9, 0xd3, 0x4c, 0xf3, 0x97, 0xa9, 0xc6, 0xb7, 0x92,
+	0x83, 0x0f, 0xa3, 0x93, 0x9a, 0xad, 0x30, 0xf8, 0xc7, 0x02, 0x78, 0x9c, 0x69, 0x0c, 0x03, 0x75,
+	0x33, 0xf9, 0xcf, 0x51, 0xf9, 0xcb, 0x9f, 0x5a, 0xfe, 0xe1, 0x2a, 0xa3, 0x4a, 0x0e, 0xae, 0xa6,
+	0x09, 0x3f, 0x52, 0x97, 0xf4, 0x5b, 0x02, 0x78, 0x25, 0x2a, 0xb9, 0xd5, 0x23, 0x99, 0x47, 0x7f,
+	0x0f, 0x1a, 0x79, 0x4f, 0xc5, 0x04, 0x96, 0xa8, 0xc0, 0xef, 0x67, 0x10, 0x78, 0x52, 0xd5, 0x6c,
+	0x25, 0x07, 0xef, 0x0c, 0x04, 0x9d, 0x58, 0x5f, 0xfb, 0x47, 0x02, 0x78, 0x90, 0x62, 0xb9, 0x8e,
+	0x75, 0xc0, 0x36, 0x2f, 0xc7, 0x5c, 0xc8, 0xf3, 0x54, 0xc8, 0xb5, 0x4f, 0x63, 0xbf, 0xc3, 0x85,
+	0x6b, 0x95, 0x1c, 0xbc, 0x3f, 0xc1, 0x88, 0x35, 0xeb, 0x20, 0x5a, 0xe5, 0xf6, 0xab, 0x02, 0xb8,
+	0x13, 0x15, 0xb5, 0xdb, 0x2f, 0x06, 0x1b, 0x9b, 0xf7, 0x0b, 0x54, 0xc2, 0x77, 0x33, 0x48, 0x98,
+	0x54, 0x51, 0x56, 0xc9, 0xc1, 0xe2, 0x40, 0xb4, 0xc4, 0xba, 0xb3, 0x6f, 0x09, 0xe0, 0x46, 0x54,
+	0xa6, 0x00, 0xfb, 0x01, 0x91, 0xa6, 0x33, 0xe4, 0x8f, 0x2f, 0xa6, 0x46, 0xbf, 0x09, 0xe5, 0x5d,
+	0x95, 0x1c, 0x5c, 0x1e, 0x48, 0x12, 0x57, 0xff, 0xe5, 0x81, 0xa5, 0xa8, 0x0c, 0x61, 0x9e, 0x1b,
+	0xc6, 0xa1, 0x85, 0x94, 0x1b, 0xc4, 0xa4, 0xfa, 0x2a, 0x16, 0x76, 0x13, 0x6a, 0xaf, 0xda, 0xa0,
+	0xd0, 0x73, 0x48, 0x12, 0x66, 0x05, 0x18, 0x75, 0xf0, 0x11, 0xdd, 0xff, 0xf2, 0x88, 0x7b, 0x29,
+	0xe5, 0x80, 0x2b, 0xb1, 0xb2, 0xa9, 0x92, 0x83, 0x17, 0x7a, 0xce, 0x78, 0xa7, 0x74, 0x4c, 0x83,
+	0xfc, 0x28, 0x37, 0xdf, 0x3a, 0x0c, 0x59, 0x16, 0x52, 0x35, 0x3c, 0xa1, 0x5c, 0x8a, 0x0d, 0x34,
+	0x1e, 0x40, 0xfa, 0x06, 0xb8, 0x16, 0x37, 0x50, 0x5a, 0xa1, 0xc4, 0x99, 0x5f, 0x4e, 0x0d, 0x30,
+	0x13, 0xab, 0x9b, 0x2a, 0x39, 0xb8, 0x38, 0x3a, 0xea, 0x01, 0x88, 0xf4, 0xbb, 0xcc, 0x85, 0x8c,
+	0x4a, 0xc0, 0xee, 0xe1, 0xa2, 0x15, 0x50, 0x5c, 0x9a, 0x45, 0x2a, 0x8d, 0x92, 0x55, 0x9a, 0x09,
+	0x85, 0x54, 0x95, 0x1c, 0xbc, 0x3d, 0x22, 0x58, 0x3c, 0xb4, 0xf4, 0x07, 0x02, 0x58, 0x8d, 0x9a,
+	0xa0, 0x33, 0x38, 0x76, 0x44, 0xd6, 0x91, 0xcf, 0x8e, 0x06, 0xf8, 0xb2, 0xe0, 0x56, 0xb9, 0x94,
+	0xba, 0x85, 0xc8, 0xf6, 0xf2, 0xb8, 0x92, 0x83, 0xf7, 0x06, 0x56, 0x1a, 0x85, 0x3d, 0xf2, 0x75,
+	0xc7, 0x6e, 0x0d, 0xbd, 0x52, 0xfe, 0xae, 0x00, 0x6e, 0xc7, 0xa7, 0x0c, 0xb6, 0x8f, 0x30, 0x3d,
+	0x20, 0xe5, 0xe2, 0x5d, 0xc9, 0x9c, 0x42, 0xc5, 0x3f, 0x08, 0x1e, 0x4e, 0xa1, 0xfa, 0x30, 0xb6,
+	0x1f, 0x7d, 0xfe, 0x1a, 0x30, 0xb3, 0x26, 0xf1, 0x36, 0x70, 0x11, 0x2b, 0x0d, 0x62, 0xb3, 0xc8,
+	0xa5, 0x58, 0x4e, 0x5d, 0xba, 0xf1, 0x2f, 0x4c, 0xb9, 0x45, 0xc7, 0xbf, 0x3e, 0xfd, 0x2a, 0x38,
+	0x67, 0xd1, 0x1a, 0x25, 0x34, 0xa8, 0x10, 0x2a, 0x5c, 0xa5, 0x9c, 0x92, 0x0f, 0x92, 0x63, 0xeb,
+	0xe9, 0x2a, 0x39, 0x28, 0x5a, 0x23, 0x1d, 0xa1, 0x4b, 0x8c, 0x9a, 0x00, 0xd7, 0x2c, 0x4d, 0x8f,
+	0xf9, 0xc8, 0xae, 0xa5, 0x2e, 0xd8, 0x09, 0x37, 0x99, 0xcc, 0x25, 0x4e, 0xba, 0xea, 0xe4, 0xa9,
+	0x72, 0x8c, 0x10, 0xfd, 0x53, 0x00, 0x26, 0xc7, 0xf5, 0xd4, 0x79, 0x9e, 0x7c, 0xc1, 0xc9, 0xe6,
+	0x39, 0xe5, 0x12, 0xf4, 0x7f, 0x09, 0xd4, 0x89, 0x84, 0xfb, 0xc6, 0xaf, 0x45, 0xbf, 0xb1, 0x11,
+	0x6e, 0x19, 0x6f, 0x64, 0xdd, 0xbd, 0x26, 0x7d, 0xa1, 0x63, 0x68, 0xf7, 0x1a, 0x03, 0x24, 0x7d,
+	0x04, 0xf8, 0x64, 0x21, 0x1c, 0x96, 0x17, 0x16, 0x8a, 0x94, 0xeb, 0x6b, 0x29, 0xd3, 0x3e, 0x5c,
+	0x8e, 0x58, 0xc9, 0xc1, 0xb3, 0xd6, 0x70, 0xbb, 0x74, 0x00, 0x2e, 0x71, 0xda, 0xc4, 0x41, 0x45,
+	0xab, 0x12, 0x0b, 0x37, 0x53, 0x4e, 0xee, 0x93, 0x8b, 0x03, 0x2b, 0x39, 0x78, 0xd1, 0x8a, 0xeb,
+	0x95, 0xb6, 0xc1, 0xc5, 0xc1, 0x29, 0x09, 0x73, 0x8c, 0x6c, 0x3a, 0x6f, 0x51, 0x66, 0xaf, 0x26,
+	0x32, 0x8b, 0xb9, 0xdb, 0xa8, 0xe4, 0xe0, 0x79, 0x2f, 0xe6, 0xca, 0xe3, 0x08, 0x5c, 0x49, 0x38,
+	0x5c, 0x67, 0xac, 0x6e, 0xa7, 0x8c, 0x2b, 0xf9, 0x42, 0x80, 0x38, 0xfc, 0x9d, 0xe4, 0xeb, 0x82,
+	0x6d, 0xc0, 0x47, 0x8d, 0x78, 0x41, 0x82, 0xc7, 0xea, 0x1e, 0x0b, 0x77, 0x52, 0x06, 0x17, 0x53,
+	0x2b, 0x49, 0x06, 0x67, 0xc5, 0x94, 0x50, 0x56, 0xc1, 0x99, 0x3e, 0x0f, 0x3a, 0x4b, 0x77, 0x29,
+	0xed, 0xdb, 0xa9, 0xb4, 0x09, 0x70, 0x25, 0x07, 0x4f, 0x5b, 0xd1, 0x2a, 0xc7, 0x2d, 0x20, 0x45,
+	0x6b, 0x27, 0xd8, 0x8c, 0x14, 0xee, 0xa5, 0x94, 0x64, 0x8f, 0x16, 0xf9, 0x51, 0x6f, 0x32, 0x5a,
+	0xf8, 0x37, 0x42, 0xba, 0x47, 0x0b, 0xc6, 0x0a, 0xf7, 0x33, 0x93, 0x66, 0x15, 0x66, 0xc3, 0xa4,
+	0x79, 0xd5, 0xd9, 0x08, 0x69, 0x9b, 0x16, 0x94, 0x14, 0x56, 0x32, 0x93, 0x66, 0x15, 0x28, 0xc3,
+	0xa4, 0x79, 0x55, 0x4a, 0x1b, 0x5c, 0x8e, 0x92, 0xe6, 0x35, 0x5d, 0x5c, 0x2f, 0xaf, 0xa4, 0x9c,
+	0x0b, 0xc4, 0x17, 0xf9, 0x55, 0x72, 0x70, 0xc1, 0x8a, 0x2f, 0xff, 0x8b, 0xe7, 0xc6, 0x55, 0xf5,
+	0xea, 0x73, 0x72, 0xeb, 0x2b, 0x6c, 0x8c, 0x1b, 0x57, 0x5b, 0x3c, 0x37, 0xae, 0xbd, 0xd7, 0x9e,
+	0x93, 0x5b, 0x5f, 0x87, 0x63, 0xdc, 0xb8, 0x26, 0x0f, 0xc0, 0x62, 0x94, 0x1b, 0x2d, 0xf5, 0xf2,
+	0x49, 0xb4, 0xec, 0xf9, 0xd8, 0x2b, 0xac, 0x66, 0x66, 0x17, 0xad, 0x77, 0x1b, 0x66, 0x37, 0x54,
+	0x09, 0xf7, 0xff, 0x04, 0x50, 0x8c, 0x26, 0x08, 0xd1, 0x9b, 0xa4, 0xc1, 0x31, 0x4b, 0xe1, 0x41,
+	0xea, 0x99, 0x6c, 0xea, 0x6b, 0x3d, 0x76, 0x26, 0xdb, 0x07, 0x6b, 0x8d, 0x83, 0x49, 0xfb, 0xe0,
+	0x52, 0xcc, 0x09, 0x0b, 0x76, 0x5a, 0xb8, 0xf0, 0x7a, 0x6a, 0x8a, 0x9d, 0xf0, 0x56, 0x8e, 0xa5,
+	0xd8, 0x23, 0x9d, 0x4e, 0x0b, 0x8f, 0x32, 0x0b, 0xd3, 0x4d, 0xd7, 0xc6, 0x85, 0x87, 0x99, 0x99,
+	0x8d, 0xbc, 0x4f, 0x1b, 0x66, 0x36, 0xe8, 0x94, 0xbe, 0x02, 0xce, 0x05, 0xd6, 0x2e, 0x8f, 0x43,
+	0x98, 0x04, 0x44, 0xef, 0xb8, 0xf0, 0x28, 0x25, 0x16, 0xc5, 0x5d, 0x38, 0x92, 0x58, 0x14, 0x58,
+	0xbb, 0xd1, 0x76, 0x29, 0x00, 0x8b, 0x3e, 0xbf, 0x9e, 0x41, 0x1e, 0xa5, 0x84, 0x76, 0x31, 0x3d,
+	0xc8, 0xee, 0xb5, 0x83, 0xc2, 0x1b, 0x29, 0x47, 0x52, 0x93, 0x6e, 0x76, 0x2a, 0x39, 0x78, 0xc9,
+	0x8f, 0xef, 0x1f, 0x5d, 0x16, 0xbc, 0x7e, 0x8c, 0x2f, 0xf9, 0xc7, 0x99, 0xed, 0x34, 0x5a, 0x75,
+	0x38, 0x6c, 0xa7, 0x43, 0xf5, 0x88, 0xf1, 0xdc, 0xf8, 0x22, 0x7c, 0xf3, 0x39, 0xb9, 0xc5, 0x2d,
+	0xc2, 0xa1, 0x22, 0xbb, 0x6d, 0x70, 0x31, 0x34, 0x8c, 0x63, 0xb4, 0x83, 0x83, 0xd6, 0x1e, 0x8f,
+	0x81, 0x5f, 0x48, 0x89, 0x48, 0x31, 0xd7, 0x5b, 0x24, 0x22, 0xd9, 0x31, 0xb7, 0x5e, 0xdf, 0x1b,
+	0x39, 0xcd, 0xe3, 0x06, 0x38, 0xe0, 0xcb, 0xf6, 0xf8, 0x85, 0xb7, 0x32, 0x1f, 0x9e, 0x25, 0x7f,
+	0x66, 0x61, 0xf8, 0x48, 0x2f, 0x16, 0x4e, 0xfa, 0xe6, 0xc8, 0xce, 0x7e, 0xbf, 0xb7, 0x8d, 0xe9,
+	0xe5, 0xec, 0xd0, 0x36, 0xe1, 0x49, 0xe6, 0x03, 0xce, 0xf1, 0xaf, 0xdf, 0x0c, 0x1f, 0x70, 0xd2,
+	0xfe, 0xfd, 0xa1, 0xed, 0xc1, 0xb7, 0xe3, 0x55, 0x62, 0x75, 0xbb, 0xf4, 0x98, 0xb5, 0x7f, 0xc0,
+	0xf9, 0x76, 0xea, 0x09, 0xf7, 0xa4, 0x67, 0x94, 0xc3, 0x8e, 0x28, 0xf6, 0xa1, 0x65, 0x17, 0x2c,
+	0x71, 0x6b, 0xdb, 0xf5, 0xac, 0xee, 0x1e, 0xdd, 0xd2, 0xf9, 0x2d, 0x2b, 0xcc, 0x84, 0xde, 0xa1,
+	0xfc, 0x5f, 0x4f, 0xb1, 0xb7, 0xb1, 0xfb, 0x7a, 0xb2, 0x9a, 0xac, 0x48, 0xd7, 0x91, 0x3f, 0xb8,
+	0xca, 0xff, 0x3e, 0xdb, 0xa8, 0x0d, 0x71, 0x6d, 0x79, 0xee, 0x51, 0x07, 0xfd, 0x77, 0x7c, 0x84,
+	0xdb, 0xc8, 0x76, 0x76, 0x76, 0xe8, 0x16, 0xb8, 0xf0, 0x6e, 0xaa, 0x3d, 0xa4, 0xdf, 0x20, 0x33,
+	0x7b, 0x98, 0x08, 0x27, 0xfd, 0x37, 0x70, 0x91, 0x16, 0x71, 0xd0, 0x7b, 0x53, 0x7a, 0xe7, 0xc9,
+	0x47, 0xff, 0x5e, 0xda, 0x4d, 0xe5, 0xd8, 0xf5, 0x6b, 0x25, 0x07, 0xa5, 0xde, 0xf8, 0xa5, 0x2c,
+	0x3b, 0x50, 0x8f, 0xdd, 0x37, 0xe1, 0x2e, 0x67, 0xf6, 0xc5, 0x54, 0x7b, 0x4b, 0xae, 0x4d, 0x64,
+	0xf6, 0x36, 0xa1, 0x76, 0xf1, 0xd7, 0x05, 0x70, 0x2f, 0x41, 0x02, 0x7e, 0x9c, 0xe5, 0x76, 0x71,
+	0x38, 0xe9, 0x5f, 0x4a, 0x0d, 0x81, 0xa9, 0x25, 0x82, 0xec, 0xf6, 0x2f, 0xbd, 0x92, 0xf0, 0x13,
+	0x01, 0xac, 0xc4, 0xcb, 0x45, 0x6b, 0xd0, 0x46, 0xb7, 0x74, 0xef, 0xa7, 0x5e, 0xbe, 0x65, 0xa8,
+	0xd9, 0x63, 0x67, 0x1f, 0x59, 0x8a, 0xfb, 0xf8, 0x99, 0x42, 0xec, 0x56, 0x93, 0x3e, 0xc5, 0xea,
+	0x86, 0xe7, 0xa6, 0x1f, 0x7c, 0x9a, 0xbd, 0x66, 0xa4, 0x8e, 0x2e, 0x71, 0xaf, 0x19, 0xad, 0xb5,
+	0xfb, 0x3e, 0x3b, 0x25, 0x8d, 0x11, 0xa7, 0xed, 0x74, 0xf6, 0x87, 0x4e, 0x17, 0xe4, 0xd4, 0x2d,
+	0x67, 0x4a, 0x59, 0x5b, 0x25, 0x07, 0x6f, 0xc4, 0x08, 0x34, 0x0c, 0xb4, 0x76, 0x12, 0xcc, 0x50,
+	0x9a, 0x4f, 0xa7, 0x67, 0xf3, 0xe2, 0x14, 0xb1, 0xc1, 0xfe, 0x4e, 0x98, 0xc4, 0xe5, 0xf0, 0xd2,
+	0x8c, 0x4a, 0xb6, 0xf2, 0x43, 0x71, 0xf0, 0x41, 0xc4, 0x70, 0xb3, 0x26, 0xdd, 0x00, 0xcb, 0x25,
+	0xcd, 0x50, 0xf4, 0x67, 0x2a, 0x44, 0x50, 0x35, 0xf4, 0x26, 0x54, 0x46, 0x3f, 0x67, 0x74, 0x05,
+	0x14, 0xc6, 0x41, 0x0c, 0x15, 0x3e, 0x53, 0xa1, 0x28, 0x48, 0xd7, 0xc1, 0x95, 0xf1, 0xde, 0x8d,
+	0xe6, 0x9a, 0x0a, 0xeb, 0xaa, 0xa9, 0x1a, 0x62, 0x5e, 0x7a, 0x03, 0x3c, 0x18, 0x87, 0x28, 0xc9,
+	0xa6, 0xbc, 0x26, 0x1b, 0x2a, 0x6a, 0xe8, 0x86, 0x59, 0x86, 0xaa, 0x81, 0x0c, 0xb5, 0xba, 0x8e,
+	0x2a, 0xba, 0x61, 0xaa, 0x25, 0x71, 0x4a, 0x7a, 0x1d, 0xbc, 0x3a, 0x01, 0xa9, 0xb6, 0x65, 0x7c,
+	0x58, 0x1d, 0xc2, 0x98, 0x96, 0x1e, 0x81, 0xd5, 0x49, 0x18, 0x7a, 0xbd, 0xac, 0x97, 0xd6, 0x86,
+	0x70, 0x66, 0xa4, 0x57, 0xc0, 0xdd, 0x2c, 0xa2, 0xc1, 0x92, 0x21, 0x9e, 0x90, 0xee, 0x81, 0x5b,
+	0xa9, 0x22, 0x11, 0xc8, 0x93, 0xd2, 0x1d, 0x50, 0x1c, 0x87, 0x94, 0x1b, 0x8d, 0xaa, 0xa6, 0xc8,
+	0xa6, 0xa6, 0xd7, 0x51, 0xc5, 0x34, 0x1b, 0xe2, 0xac, 0x74, 0x1b, 0xdc, 0x98, 0x0c, 0x67, 0x2a,
+	0x0d, 0x71, 0x2e, 0x1e, 0x6c, 0x53, 0xab, 0x97, 0xf4, 0x4d, 0x03, 0x95, 0x54, 0x63, 0xc3, 0xd4,
+	0x1b, 0x22, 0x90, 0x5e, 0x05, 0xf7, 0x26, 0xc8, 0x67, 0x7c, 0x58, 0x65, 0x73, 0x46, 0x65, 0x3c,
+	0x95, 0xa2, 0xe0, 0xc1, 0xd0, 0xd5, 0x92, 0x51, 0xd1, 0xd6, 0x4d, 0xf1, 0xb4, 0xf4, 0x18, 0xbc,
+	0x9e, 0x89, 0x7e, 0x54, 0xc5, 0x67, 0x52, 0xf8, 0x40, 0xb5, 0xa4, 0x0d, 0x4f, 0xfd, 0x7c, 0xd6,
+	0x49, 0x29, 0x2b, 0x0d, 0xf1, 0x6c, 0xa6, 0x49, 0x21, 0x90, 0x62, 0x66, 0xf5, 0x10, 0xe8, 0x73,
+	0xd2, 0xbb, 0xe0, 0xad, 0xe7, 0x51, 0x0f, 0x5f, 0x0f, 0x55, 0xd5, 0x30, 0x44, 0x49, 0x7a, 0x0d,
+	0xdc, 0xcf, 0x82, 0x2c, 0x7f, 0xd4, 0x84, 0xaa, 0x78, 0x5e, 0xba, 0x0b, 0x6e, 0x4e, 0x00, 0x2f,
+	0x6d, 0xd5, 0xe5, 0x9a, 0x5e, 0x5a, 0x13, 0x2f, 0xa4, 0x98, 0xb8, 0x22, 0x1b, 0x86, 0x5c, 0x2f,
+	0x41, 0x19, 0x6d, 0xa8, 0x5b, 0x46, 0x43, 0x56, 0x54, 0x43, 0xbc, 0x98, 0x32, 0x6b, 0x03, 0x9c,
+	0xe8, 0x1c, 0x2c, 0x48, 0x4f, 0xc0, 0xe3, 0x09, 0x58, 0x6a, 0x55, 0x36, 0x4c, 0x4d, 0x31, 0x54,
+	0x19, 0x2a, 0x95, 0x21, 0xcc, 0x4b, 0x99, 0xe6, 0x9b, 0xe3, 0xcb, 0x4a, 0x45, 0x15, 0x0b, 0x29,
+	0xda, 0x62, 0x18, 0x35, 0xb5, 0xa6, 0xc3, 0xad, 0xd2, 0x9a, 0x78, 0x39, 0x13, 0x03, 0xaa, 0x59,
+	0xc4, 0x18, 0x2c, 0xa6, 0x0c, 0x86, 0x61, 0x28, 0xd5, 0xa6, 0x61, 0x8e, 0x18, 0xef, 0x92, 0xb4,
+	0x02, 0xee, 0xa4, 0x5a, 0x17, 0x9b, 0xc5, 0x2b, 0xd2, 0x2a, 0x58, 0xc9, 0x64, 0x5f, 0x0c, 0x7e,
+	0x39, 0x65, 0x32, 0x07, 0xf0, 0x35, 0x4d, 0x81, 0xba, 0xa1, 0xaf, 0x9b, 0xe2, 0x55, 0xe9, 0x0b,
+	0xe0, 0xd1, 0xa4, 0xc9, 0xd4, 0x95, 0x0d, 0xa8, 0xcb, 0x4a, 0x65, 0xc4, 0xcf, 0x5d, 0x4b, 0xb1,
+	0xfd, 0xd0, 0x37, 0xca, 0x66, 0x55, 0x36, 0xc4, 0xeb, 0x29, 0x6b, 0xca, 0xa8, 0xeb, 0x9b, 0xeb,
+	0x55, 0x79, 0x43, 0x15, 0x6f, 0x24, 0xd0, 0xd5, 0x95, 0x88, 0x76, 0x4b, 0x06, 0x6a, 0x40, 0xfd,
+	0xcb, 0x5b, 0x62, 0x31, 0xc1, 0x14, 0xa3, 0xd0, 0x15, 0xad, 0x5c, 0x41, 0xf2, 0x33, 0x59, 0xab,
+	0xca, 0x6b, 0x5a, 0x55, 0x33, 0xb7, 0xc4, 0x9b, 0xd2, 0x5b, 0xe0, 0x8d, 0x14, 0x2c, 0xba, 0x42,
+	0x34, 0x05, 0x41, 0xb5, 0xac, 0x19, 0x26, 0xa4, 0xae, 0x53, 0xbc, 0x15, 0xef, 0x85, 0x0d, 0xb9,
+	0x56, 0x8d, 0xba, 0x58, 0xf1, 0xb6, 0x54, 0x04, 0x57, 0xc7, 0xe1, 0x54, 0xe5, 0x11, 0xfb, 0x70,
+	0x5f, 0x5d, 0x51, 0xc5, 0x3b, 0x09, 0x46, 0xa7, 0x2b, 0xa3, 0x6e, 0x18, 0xd5, 0xf5, 0x3a, 0x92,
+	0x4b, 0xe2, 0x5d, 0xe9, 0x16, 0xb8, 0x3e, 0x29, 0x2e, 0xd2, 0x0f, 0xba, 0xdd, 0x8b, 0xb7, 0xfd,
+	0x68, 0x04, 0x90, 0x37, 0x0d, 0xa4, 0xe8, 0x75, 0x43, 0xaf, 0xaa, 0xe2, 0x7d, 0xe9, 0x1a, 0x58,
+	0x1a, 0x07, 0xaf, 0x29, 0x0d, 0x64, 0x98, 0x25, 0x4d, 0x17, 0x57, 0xe8, 0x67, 0x0f, 0xe3, 0x01,
+	0x0c, 0x55, 0x7c, 0x45, 0xba, 0x0f, 0x6e, 0x27, 0xe1, 0x43, 0x55, 0xae, 0xc9, 0x6b, 0x55, 0x95,
+	0xc5, 0xa6, 0x57, 0x57, 0x7e, 0x4f, 0x00, 0xf3, 0xc3, 0x9f, 0x1e, 0x1e, 0xe2, 0x6e, 0x98, 0xb2,
+	0xd9, 0x34, 0x46, 0x32, 0x85, 0x25, 0x70, 0x69, 0x14, 0xc0, 0x68, 0x2a, 0x0a, 0x71, 0x8a, 0x42,
+	0x6c, 0xe7, 0x86, 0xd6, 0x68, 0xa8, 0x25, 0x31, 0x2f, 0x5d, 0x06, 0x17, 0x47, 0x3b, 0x55, 0x08,
+	0x75, 0x28, 0x4e, 0xc5, 0xe1, 0xc9, 0x6b, 0x3a, 0xa4, 0x41, 0x7f, 0xe5, 0x67, 0x79, 0x30, 0xa5,
+	0x98, 0xb2, 0x74, 0x1e, 0x9c, 0x55, 0x4c, 0x79, 0xfc, 0x23, 0x8f, 0xa4, 0x51, 0x6e, 0x9a, 0x15,
+	0xa2, 0xc3, 0xba, 0xaa, 0x98, 0x3a, 0x49, 0x59, 0x2e, 0x81, 0xf3, 0xb4, 0x5d, 0x31, 0xb5, 0x67,
+	0x24, 0x93, 0x31, 0x0c, 0x4d, 0xaf, 0x93, 0x4c, 0xa5, 0xdf, 0x41, 0x44, 0x46, 0x50, 0xfd, 0xb0,
+	0xa9, 0x1a, 0xa6, 0x21, 0x4e, 0x85, 0x1d, 0x0d, 0xa8, 0xd6, 0xb4, 0x66, 0x0d, 0x19, 0xcd, 0x46,
+	0x43, 0x87, 0xa6, 0x38, 0x1d, 0x76, 0x98, 0x90, 0x78, 0x8f, 0x12, 0x2a, 0xa9, 0xcf, 0x34, 0xe2,
+	0x76, 0x67, 0x42, 0xde, 0xcd, 0x46, 0x19, 0xca, 0x25, 0x15, 0xad, 0xc9, 0xf5, 0xba, 0x0a, 0xc5,
+	0x13, 0x21, 0xc2, 0x9a, 0x56, 0xad, 0x6a, 0xf5, 0x32, 0x32, 0x9a, 0xb5, 0x9a, 0x0c, 0xb7, 0xc4,
+	0x93, 0xe1, 0x08, 0x38, 0xef, 0xaa, 0x66, 0x98, 0xe2, 0x2c, 0xfd, 0x14, 0xe0, 0xa0, 0xb1, 0xa6,
+	0xd7, 0x35, 0x53, 0x87, 0x5a, 0xbd, 0x2c, 0xce, 0xd1, 0x8f, 0x0c, 0x9a, 0x32, 0x52, 0xbf, 0x6c,
+	0xaa, 0xb0, 0x2e, 0x57, 0x91, 0xdc, 0x2c, 0x69, 0x26, 0x32, 0x4c, 0x1d, 0xca, 0x65, 0x55, 0x04,
+	0xa1, 0x00, 0xfa, 0x06, 0x91, 0xc2, 0x20, 0xba, 0xdb, 0xaa, 0x2b, 0xe2, 0x29, 0x49, 0x04, 0xa7,
+	0x29, 0x5e, 0xdd, 0x84, 0x32, 0xd2, 0x4a, 0xe2, 0x69, 0xe9, 0x1c, 0x38, 0xd3, 0x87, 0x34, 0x14,
+	0xad, 0x26, 0x9e, 0x09, 0xf9, 0x6a, 0x25, 0xb5, 0x6e, 0x6a, 0xe6, 0x16, 0x32, 0x54, 0xa5, 0x09,
+	0xc9, 0x72, 0x9c, 0x5f, 0xf9, 0x11, 0x00, 0x17, 0x63, 0xdf, 0xd1, 0x91, 0x30, 0xa6, 0xd5, 0x4d,
+	0xb5, 0xcc, 0x16, 0x20, 0x52, 0xeb, 0x50, 0xaf, 0x56, 0xd1, 0x86, 0x56, 0x1f, 0xfd, 0x7c, 0xe2,
+	0x0d, 0xb0, 0x9c, 0x04, 0x68, 0x54, 0x65, 0x65, 0x43, 0x14, 0xc8, 0xea, 0x49, 0x02, 0x21, 0x2b,
+	0x42, 0xd7, 0x4a, 0x8a, 0x98, 0x27, 0x89, 0x51, 0x12, 0x54, 0x43, 0x2e, 0xab, 0xb0, 0xd4, 0x34,
+	0xb7, 0xc4, 0xa9, 0x49, 0xfc, 0xd4, 0x9a, 0xac, 0x55, 0xc5, 0x69, 0x92, 0xc5, 0x26, 0x81, 0x3c,
+	0xd5, 0xa0, 0x2c, 0xce, 0x48, 0x37, 0xc1, 0xb5, 0x24, 0x08, 0x6a, 0x9e, 0xb0, 0x24, 0x9e, 0x20,
+	0x2e, 0x27, 0x09, 0xa8, 0x26, 0x9b, 0xa6, 0x0a, 0x6b, 0xba, 0x61, 0x8a, 0x27, 0x27, 0x0d, 0xaf,
+	0x66, 0x20, 0x53, 0x95, 0x6b, 0x86, 0x38, 0x3b, 0x09, 0x4a, 0x6f, 0x18, 0x65, 0xb5, 0xae, 0xa9,
+	0xe2, 0xdc, 0x24, 0xd1, 0xc9, 0x94, 0x8a, 0x60, 0xe2, 0xe0, 0xe4, 0xda, 0xba, 0x78, 0x6a, 0xb2,
+	0xdc, 0x4a, 0x45, 0xab, 0xab, 0xcc, 0x54, 0xde, 0x04, 0x0f, 0xd3, 0xe1, 0x50, 0x59, 0x33, 0x2b,
+	0xcd, 0x35, 0xba, 0xbe, 0xc8, 0xba, 0x3a, 0x23, 0x3d, 0x00, 0xaf, 0x64, 0x40, 0x53, 0x34, 0xa8,
+	0x54, 0x55, 0x45, 0x13, 0xe7, 0x89, 0x5b, 0xcc, 0xc6, 0xa7, 0x2a, 0xaf, 0x89, 0x67, 0x49, 0xe8,
+	0xcd, 0x00, 0xfe, 0x54, 0xad, 0x6f, 0x68, 0x75, 0x43, 0x14, 0x33, 0xc2, 0xcb, 0x75, 0x43, 0x5b,
+	0xab, 0xaa, 0xe2, 0xb9, 0x49, 0xea, 0x21, 0x41, 0x5a, 0x53, 0xd4, 0xba, 0xbe, 0x29, 0x4a, 0x93,
+	0x26, 0xac, 0xbf, 0xde, 0xce, 0x93, 0x80, 0x96, 0x68, 0x49, 0xb2, 0x29, 0x97, 0xf4, 0x32, 0xd2,
+	0xea, 0x0a, 0x5d, 0x7b, 0xa8, 0x26, 0xd7, 0xe5, 0xb2, 0x5a, 0x53, 0xeb, 0xa6, 0x78, 0x81, 0x64,
+	0x23, 0x59, 0xc4, 0xde, 0x24, 0x69, 0x5f, 0x36, 0x58, 0x92, 0xeb, 0x2e, 0x90, 0x28, 0x9e, 0x85,
+	0x2e, 0xcd, 0x5b, 0x68, 0x82, 0x97, 0x01, 0x9a, 0xe6, 0x9f, 0x55, 0xb2, 0x71, 0x28, 0x48, 0x0f,
+	0xc1, 0x6b, 0x19, 0x30, 0x22, 0x7b, 0xc6, 0xcb, 0x93, 0x2c, 0x86, 0xac, 0xff, 0xbe, 0x63, 0x52,
+	0xd4, 0xba, 0xa9, 0x42, 0x71, 0x71, 0xd2, 0x94, 0x72, 0x73, 0x84, 0x6a, 0x43, 0xe7, 0x9e, 0x54,
+	0x5c, 0xca, 0x68, 0x61, 0x32, 0x2c, 0xeb, 0x4a, 0x49, 0xbc, 0x22, 0x7d, 0x00, 0xde, 0x7b, 0x6e,
+	0xc3, 0x8f, 0x8e, 0x68, 0x79, 0xe5, 0xaf, 0x67, 0x62, 0xfc, 0xa6, 0x11, 0xe0, 0x6e, 0x82, 0xdf,
+	0x34, 0x4c, 0xb5, 0x31, 0xe2, 0x37, 0xe3, 0xc7, 0x48, 0x01, 0xe5, 0x4d, 0x43, 0x53, 0xc2, 0x20,
+	0xc7, 0xdc, 0xa3, 0x20, 0x7d, 0x09, 0xbc, 0x33, 0x19, 0xde, 0x50, 0x4d, 0xae, 0x11, 0x12, 0x6f,
+	0x50, 0x49, 0x5d, 0x97, 0x9b, 0x55, 0x13, 0xe9, 0x9b, 0x24, 0x56, 0xe5, 0xa5, 0x2f, 0x82, 0xb7,
+	0x27, 0xe3, 0x37, 0x1b, 0x55, 0x5d, 0x66, 0x33, 0x42, 0xf3, 0x2a, 0xa3, 0x81, 0x6a, 0xaa, 0x29,
+	0x13, 0x2b, 0x16, 0xa7, 0x48, 0xb2, 0x3a, 0x19, 0xdd, 0x54, 0x0d, 0x93, 0x46, 0x9c, 0x50, 0x70,
+	0x92, 0x8f, 0x4d, 0x27, 0xac, 0x0f, 0x8a, 0xc7, 0x14, 0x0c, 0x65, 0xa4, 0x40, 0x55, 0x36, 0x55,
+	0x14, 0x81, 0x13, 0x67, 0x26, 0x31, 0x1c, 0x45, 0x2c, 0x6b, 0xe1, 0x96, 0x4d, 0x3c, 0x91, 0x8d,
+	0x21, 0xfd, 0x22, 0x2f, 0xd9, 0x55, 0x18, 0x46, 0x05, 0x29, 0x2a, 0x24, 0x6e, 0x3c, 0x7e, 0x29,
+	0xc4, 0x32, 0x84, 0x24, 0x81, 0x9b, 0x25, 0x29, 0x70, 0x12, 0x46, 0x6d, 0x53, 0x2b, 0x57, 0xe4,
+	0x8d, 0x27, 0x46, 0x7f, 0x1a, 0x19, 0x0d, 0x71, 0x6e, 0xd2, 0xc0, 0x86, 0xb0, 0xb8, 0x84, 0xdc,
+	0xc8, 0x41, 0x36, 0x6e, 0x86, 0x6a, 0x36, 0x1b, 0x68, 0x53, 0x87, 0x1b, 0xeb, 0x55, 0x7d, 0x53,
+	0x3c, 0x95, 0xb0, 0x34, 0x46, 0xb0, 0x36, 0xd5, 0xaa, 0xa2, 0xd7, 0x54, 0xf1, 0xf4, 0xca, 0xcf,
+	0x85, 0xd8, 0x77, 0xe3, 0xe1, 0x9b, 0xef, 0x44, 0xab, 0xa5, 0x99, 0x9c, 0xa2, 0x97, 0x46, 0x8f,
+	0x9b, 0xe2, 0x3d, 0x57, 0x14, 0x7e, 0x90, 0x53, 0x66, 0x80, 0xed, 0xa7, 0x98, 0xf7, 0xc0, 0xad,
+	0x14, 0xd8, 0x30, 0xe3, 0x4c, 0xa7, 0x3a, 0x48, 0x40, 0xff, 0x26, 0x0f, 0x0a, 0x49, 0xc7, 0xac,
+	0x49, 0x84, 0x98, 0xa5, 0x8f, 0x0c, 0x3b, 0xde, 0xc3, 0x84, 0xb0, 0x03, 0xc5, 0x87, 0x3e, 0xa6,
+	0xf4, 0x8c, 0x6c, 0x4d, 0x48, 0x26, 0xc0, 0xa2, 0xac, 0x90, 0x99, 0x42, 0x64, 0x13, 0x52, 0x95,
+	0xd7, 0xd4, 0x2a, 0x6a, 0x68, 0xca, 0x06, 0x5d, 0xf0, 0x25, 0xf0, 0xc1, 0xf3, 0x52, 0x18, 0x93,
+	0x63, 0x4a, 0xaa, 0x80, 0xd2, 0xf3, 0x52, 0xe9, 0xef, 0x45, 0x60, 0xb3, 0xaa, 0x86, 0xf2, 0x4c,
+	0xaf, 0xfc, 0x64, 0x06, 0x2c, 0xc4, 0x9f, 0x13, 0x27, 0xcc, 0xe6, 0xba, 0xa6, 0x56, 0x47, 0xb3,
+	0xcd, 0xf7, 0xc0, 0x93, 0x44, 0xc8, 0x31, 0xb5, 0x92, 0x20, 0x61, 0x90, 0x24, 0x7b, 0x0b, 0x35,
+	0x61, 0x55, 0x14, 0x12, 0x96, 0x50, 0x02, 0xf6, 0x1a, 0x94, 0xeb, 0x4a, 0x45, 0xcc, 0x27, 0x2c,
+	0xd8, 0x04, 0xac, 0xfe, 0xd2, 0x9b, 0x92, 0xde, 0x06, 0x6f, 0x66, 0xc7, 0x53, 0xeb, 0xcf, 0x34,
+	0xa8, 0xd7, 0x69, 0x72, 0x30, 0x9d, 0x10, 0x64, 0x13, 0x87, 0xb9, 0x2e, 0xce, 0x24, 0xf8, 0xf7,
+	0x44, 0x6e, 0xa6, 0x0a, 0x1b, 0x50, 0x33, 0x54, 0x64, 0x54, 0x9b, 0x65, 0xf1, 0x44, 0x82, 0xb5,
+	0x64, 0x40, 0x37, 0x65, 0x53, 0x53, 0xd0, 0xd3, 0xcd, 0x0d, 0x43, 0x3c, 0x29, 0x3d, 0x01, 0x8f,
+	0x33, 0x50, 0x19, 0xb5, 0x59, 0x92, 0x1e, 0x3f, 0x37, 0x66, 0x19, 0xea, 0xcd, 0x86, 0x21, 0xce,
+	0x25, 0x38, 0xfc, 0x09, 0x98, 0x64, 0x03, 0x45, 0x1c, 0x6a, 0xfc, 0x12, 0x9b, 0x80, 0x38, 0x64,
+	0xd8, 0x86, 0x78, 0x6a, 0xe5, 0x87, 0x71, 0x1f, 0x36, 0x09, 0xdf, 0xbd, 0x27, 0x64, 0x62, 0xd4,
+	0xe5, 0xc4, 0xfc, 0x9f, 0x81, 0x78, 0xf7, 0x32, 0x80, 0x36, 0x55, 0x08, 0xe5, 0x75, 0x1d, 0xd6,
+	0x12, 0xed, 0x78, 0x00, 0x3b, 0x92, 0xba, 0x6c, 0xc9, 0xb5, 0xaa, 0x98, 0x5f, 0x79, 0x1f, 0x9c,
+	0xe4, 0xb5, 0x56, 0x64, 0xe3, 0xba, 0xae, 0xca, 0x26, 0x89, 0x2f, 0x63, 0x9b, 0xfe, 0xb0, 0x63,
+	0x74, 0x1b, 0x2c, 0xac, 0xfc, 0x8e, 0x00, 0x96, 0x26, 0xbc, 0x84, 0x26, 0xb1, 0x26, 0x44, 0x86,
+	0xaa, 0xa2, 0xd7, 0x6a, 0x6a, 0xbd, 0xc4, 0x24, 0x8c, 0x3d, 0x60, 0x58, 0x01, 0x77, 0x26, 0x83,
+	0xd7, 0x75, 0x93, 0xc1, 0x0a, 0x24, 0x69, 0x9f, 0x0c, 0x5b, 0xd2, 0xeb, 0xaa, 0x98, 0x5f, 0xfb,
+	0xea, 0x9f, 0xff, 0xf4, 0xaa, 0xf0, 0x93, 0x9f, 0x5e, 0x15, 0xfe, 0xee, 0xa7, 0x57, 0x85, 0x8f,
+	0xf4, 0x5d, 0x27, 0xd8, 0xeb, 0x6d, 0xaf, 0xb6, 0xdc, 0x83, 0x07, 0xbb, 0x9e, 0x75, 0xe8, 0xb0,
+	0x5a, 0x5c, 0xab, 0xfd, 0x60, 0xf0, 0xaf, 0xcf, 0xba, 0xce, 0x83, 0x5d, 0xdc, 0x79, 0x40, 0x5f,
+	0xad, 0x3f, 0xd8, 0x75, 0x47, 0xfe, 0x9f, 0xda, 0xbb, 0x91, 0x9f, 0x87, 0x0f, 0xb7, 0x4f, 0x50,
+	0xb0, 0x37, 0xfe, 0x23, 0x00, 0x00, 0xff, 0xff, 0xc7, 0xc7, 0x14, 0xee, 0x7f, 0x6d, 0x00, 0x00,
 }
 
 func (m *UIBannerClickEvent) Marshal() (dAtA []byte, err error) {
@@ -9078,7 +9599,7 @@ func (m *UIIntegrationEnrollStepEvent) MarshalToSizedBuffer(dAtA []byte) (int, e
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceCreateEvent) Marshal() (dAtA []byte, err error) {
+func (m *UIIntegrationEnrollSectionOpenEvent) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -9088,12 +9609,12 @@ func (m *ResourceCreateEvent) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceCreateEvent) MarshalTo(dAtA []byte) (int, error) {
+func (m *UIIntegrationEnrollSectionOpenEvent) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceCreateEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UIIntegrationEnrollSectionOpenEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -9102,9 +9623,19 @@ func (m *ResourceCreateEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Database != nil {
+	if m.Section != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Section))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Step != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Step))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Metadata != nil {
 		{
-			size, err := m.Database.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -9112,7 +9643,195 @@ func (m *ResourceCreateEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintUsageevents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Field != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Field))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Step != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Step))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Metadata != nil {
+		{
+			size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Type != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Type))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Step != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Step))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Metadata != nil {
+		{
+			size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Link) > 0 {
+		i -= len(m.Link)
+		copy(dAtA[i:], m.Link)
+		i = encodeVarintUsageevents(dAtA, i, uint64(len(m.Link)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Step != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.Step))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Metadata != nil {
+		{
+			size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ResourceCreateEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceCreateEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceCreateEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Database != nil {
+		{
+			size, err := m.Database.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
 	}
 	if len(m.CloudProvider) > 0 {
 		i -= len(m.CloudProvider)
@@ -10914,6 +11633,98 @@ func (m *UsageEventOneOf_UiIntegrationEnrollStepEvent) MarshalToSizedBuffer(dAtA
 	}
 	return len(dAtA) - i, nil
 }
+func (m *UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.UiIntegrationEnrollSectionOpenEvent != nil {
+		{
+			size, err := m.UiIntegrationEnrollSectionOpenEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xf2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.UiIntegrationEnrollFieldCompleteEvent != nil {
+		{
+			size, err := m.UiIntegrationEnrollFieldCompleteEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xfa
+	}
+	return len(dAtA) - i, nil
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.UiIntegrationEnrollCodeCopyEvent != nil {
+		{
+			size, err := m.UiIntegrationEnrollCodeCopyEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x82
+	}
+	return len(dAtA) - i, nil
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollLinkClickEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UsageEventOneOf_UiIntegrationEnrollLinkClickEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.UiIntegrationEnrollLinkClickEvent != nil {
+		{
+			size, err := m.UiIntegrationEnrollLinkClickEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x8a
+	}
+	return len(dAtA) - i, nil
+}
 func encodeVarintUsageevents(dAtA []byte, offset int, v uint64) int {
 	offset -= sovUsageevents(v)
 	base := offset
@@ -12143,19 +12954,108 @@ func (m *UIIntegrationEnrollStepEvent) Size() (n int) {
 	return n
 }
 
-func (m *ResourceCreateEvent) Size() (n int) {
+func (m *UIIntegrationEnrollSectionOpenEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.ResourceType)
-	if l > 0 {
+	if m.Metadata != nil {
+		l = m.Metadata.Size()
 		n += 1 + l + sovUsageevents(uint64(l))
 	}
-	l = len(m.ResourceOrigin)
-	if l > 0 {
-		n += 1 + l + sovUsageevents(uint64(l))
+	if m.Step != 0 {
+		n += 1 + sovUsageevents(uint64(m.Step))
+	}
+	if m.Section != 0 {
+		n += 1 + sovUsageevents(uint64(m.Section))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UIIntegrationEnrollFieldCompleteEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Metadata != nil {
+		l = m.Metadata.Size()
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	if m.Step != 0 {
+		n += 1 + sovUsageevents(uint64(m.Step))
+	}
+	if m.Field != 0 {
+		n += 1 + sovUsageevents(uint64(m.Field))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UIIntegrationEnrollCodeCopyEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Metadata != nil {
+		l = m.Metadata.Size()
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	if m.Step != 0 {
+		n += 1 + sovUsageevents(uint64(m.Step))
+	}
+	if m.Type != 0 {
+		n += 1 + sovUsageevents(uint64(m.Type))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UIIntegrationEnrollLinkClickEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Metadata != nil {
+		l = m.Metadata.Size()
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	if m.Step != 0 {
+		n += 1 + sovUsageevents(uint64(m.Step))
+	}
+	l = len(m.Link)
+	if l > 0 {
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ResourceCreateEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ResourceType)
+	if l > 0 {
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	l = len(m.ResourceOrigin)
+	if l > 0 {
+		n += 1 + l + sovUsageevents(uint64(l))
 	}
 	l = len(m.CloudProvider)
 	if l > 0 {
@@ -13100,6 +14000,54 @@ func (m *UsageEventOneOf_UiIntegrationEnrollStepEvent) Size() (n int) {
 	}
 	return n
 }
+func (m *UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UiIntegrationEnrollSectionOpenEvent != nil {
+		l = m.UiIntegrationEnrollSectionOpenEvent.Size()
+		n += 2 + l + sovUsageevents(uint64(l))
+	}
+	return n
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UiIntegrationEnrollFieldCompleteEvent != nil {
+		l = m.UiIntegrationEnrollFieldCompleteEvent.Size()
+		n += 2 + l + sovUsageevents(uint64(l))
+	}
+	return n
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UiIntegrationEnrollCodeCopyEvent != nil {
+		l = m.UiIntegrationEnrollCodeCopyEvent.Size()
+		n += 2 + l + sovUsageevents(uint64(l))
+	}
+	return n
+}
+func (m *UsageEventOneOf_UiIntegrationEnrollLinkClickEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UiIntegrationEnrollLinkClickEvent != nil {
+		l = m.UiIntegrationEnrollLinkClickEvent.Size()
+		n += 2 + l + sovUsageevents(uint64(l))
+	}
+	return n
+}
 
 func sovUsageevents(x uint64) (n int) {
 	return (math_bits.Len64(x|1) + 6) / 7
@@ -19947,7 +20895,463 @@ func (m *UIIntegrationEnrollStartEvent) Unmarshal(dAtA []byte) error {
 			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			iNdEx = postIndex
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipUsageevents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UIIntegrationEnrollCompleteEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowUsageevents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UIIntegrationEnrollCompleteEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UIIntegrationEnrollCompleteEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Metadata == nil {
+				m.Metadata = &IntegrationEnrollMetadata{}
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipUsageevents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowUsageevents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IntegrationEnrollStepStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IntegrationEnrollStepStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			}
+			m.Code = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Code |= IntegrationEnrollStatusCode(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipUsageevents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UIIntegrationEnrollStepEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowUsageevents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UIIntegrationEnrollStepEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UIIntegrationEnrollStepEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Metadata == nil {
+				m.Metadata = &IntegrationEnrollMetadata{}
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			m.Step = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Step |= IntegrationEnrollStep(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Status == nil {
+				m.Status = &IntegrationEnrollStepStatus{}
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipUsageevents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UIIntegrationEnrollSectionOpenEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowUsageevents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UIIntegrationEnrollSectionOpenEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UIIntegrationEnrollSectionOpenEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Metadata == nil {
+				m.Metadata = &IntegrationEnrollMetadata{}
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			m.Step = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Step |= IntegrationEnrollStep(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Section", wireType)
+			}
+			m.Section = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Section |= IntegrationEnrollSection(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
@@ -19970,7 +21374,7 @@ func (m *UIIntegrationEnrollStartEvent) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UIIntegrationEnrollCompleteEvent) Unmarshal(dAtA []byte) error {
+func (m *UIIntegrationEnrollFieldCompleteEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -19993,10 +21397,10 @@ func (m *UIIntegrationEnrollCompleteEvent) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UIIntegrationEnrollCompleteEvent: wiretype end group for non-group")
+			return fmt.Errorf("proto: UIIntegrationEnrollFieldCompleteEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UIIntegrationEnrollCompleteEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UIIntegrationEnrollFieldCompleteEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -20035,6 +21439,44 @@ func (m *UIIntegrationEnrollCompleteEvent) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			m.Step = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Step |= IntegrationEnrollStep(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Field", wireType)
+			}
+			m.Field = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Field |= IntegrationEnrollField(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
@@ -20057,7 +21499,7 @@ func (m *UIIntegrationEnrollCompleteEvent) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
+func (m *UIIntegrationEnrollCodeCopyEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -20080,17 +21522,17 @@ func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: IntegrationEnrollStepStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: UIIntegrationEnrollCodeCopyEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IntegrationEnrollStepStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UIIntegrationEnrollCodeCopyEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			m.Code = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowUsageevents
@@ -20100,16 +21542,33 @@ func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Code |= IntegrationEnrollStatusCode(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Metadata == nil {
+				m.Metadata = &IntegrationEnrollMetadata{}
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
 			}
-			var stringLen uint64
+			m.Step = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowUsageevents
@@ -20119,24 +21578,30 @@ func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.Step |= IntegrationEnrollStep(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthUsageevents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthUsageevents
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= IntegrationEnrollCodeType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.Error = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
@@ -20159,7 +21624,7 @@ func (m *IntegrationEnrollStepStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UIIntegrationEnrollStepEvent) Unmarshal(dAtA []byte) error {
+func (m *UIIntegrationEnrollLinkClickEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -20182,10 +21647,10 @@ func (m *UIIntegrationEnrollStepEvent) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UIIntegrationEnrollStepEvent: wiretype end group for non-group")
+			return fmt.Errorf("proto: UIIntegrationEnrollLinkClickEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UIIntegrationEnrollStepEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UIIntegrationEnrollLinkClickEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -20245,9 +21710,9 @@ func (m *UIIntegrationEnrollStepEvent) Unmarshal(dAtA []byte) error {
 			}
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Link", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowUsageevents
@@ -20257,27 +21722,23 @@ func (m *UIIntegrationEnrollStepEvent) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthUsageevents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthUsageevents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Status == nil {
-				m.Status = &IntegrationEnrollStepStatus{}
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Link = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -23716,6 +25177,146 @@ func (m *UsageEventOneOf) Unmarshal(dAtA []byte) error {
 			}
 			m.Event = &UsageEventOneOf_UiIntegrationEnrollStepEvent{v}
 			iNdEx = postIndex
+		case 62:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UiIntegrationEnrollSectionOpenEvent", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &UIIntegrationEnrollSectionOpenEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent{v}
+			iNdEx = postIndex
+		case 63:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UiIntegrationEnrollFieldCompleteEvent", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &UIIntegrationEnrollFieldCompleteEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent{v}
+			iNdEx = postIndex
+		case 64:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UiIntegrationEnrollCodeCopyEvent", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &UIIntegrationEnrollCodeCopyEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent{v}
+			iNdEx = postIndex
+		case 65:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UiIntegrationEnrollLinkClickEvent", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &UIIntegrationEnrollLinkClickEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &UsageEventOneOf_UiIntegrationEnrollLinkClickEvent{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
diff --git a/api/gen/proto/go/userpreferences/v1/access_graph.pb.go b/api/gen/proto/go/userpreferences/v1/access_graph.pb.go
index 73af932ecc25c..9f56b2051797e 100644
--- a/api/gen/proto/go/userpreferences/v1/access_graph.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/access_graph.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/access_graph.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/assist.pb.go b/api/gen/proto/go/userpreferences/v1/assist.pb.go
index c91b484df82f7..a4e6e5bdb9dd5 100644
--- a/api/gen/proto/go/userpreferences/v1/assist.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/assist.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/assist.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/cluster_preferences.pb.go b/api/gen/proto/go/userpreferences/v1/cluster_preferences.pb.go
index 23d25b7be0723..8f0b69e2873b3 100644
--- a/api/gen/proto/go/userpreferences/v1/cluster_preferences.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/cluster_preferences.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/cluster_preferences.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/discover_resource_preferences.pb.go b/api/gen/proto/go/userpreferences/v1/discover_resource_preferences.pb.go
index 69e65929f824e..03c1ba41385a3 100644
--- a/api/gen/proto/go/userpreferences/v1/discover_resource_preferences.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/discover_resource_preferences.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/discover_resource_preferences.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/onboard.pb.go b/api/gen/proto/go/userpreferences/v1/onboard.pb.go
index acecb297e5897..a56fdc798c38d 100644
--- a/api/gen/proto/go/userpreferences/v1/onboard.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/onboard.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/onboard.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/sidenav_preferences.pb.go b/api/gen/proto/go/userpreferences/v1/sidenav_preferences.pb.go
index c5dbfab377bd0..e99aa261be554 100644
--- a/api/gen/proto/go/userpreferences/v1/sidenav_preferences.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/sidenav_preferences.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/sidenav_preferences.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/theme.pb.go b/api/gen/proto/go/userpreferences/v1/theme.pb.go
index edcf804184ba6..d43dfbf2c2618 100644
--- a/api/gen/proto/go/userpreferences/v1/theme.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/theme.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/theme.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/unified_resource_preferences.pb.go b/api/gen/proto/go/userpreferences/v1/unified_resource_preferences.pb.go
index 9669a85a4aafc..b8f55f0c28024 100644
--- a/api/gen/proto/go/userpreferences/v1/unified_resource_preferences.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/unified_resource_preferences.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/unified_resource_preferences.proto
 
diff --git a/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go b/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go
index fddd1612c4c9a..2fe3eaa2f4a24 100644
--- a/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/userpreferences/v1/userpreferences.proto
 
diff --git a/api/go.mod b/api/go.mod
index ead3a9dc3aaf7..f2e40d4deddd5 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -1,13 +1,11 @@
 module github.com/gravitational/teleport/api
 
-go 1.23.7
-
-toolchain go1.24.1
+go 1.24.11
 
 require (
 	github.com/charlievieth/strcase v0.0.5
 	github.com/coreos/go-semver v0.3.1
-	github.com/go-piv/piv-go v1.11.0
+	github.com/go-piv/piv-go/v2 v2.3.0
 	github.com/gobwas/ws v1.4.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/go-cmp v0.7.0
@@ -25,9 +23,10 @@ require (
 	go.opentelemetry.io/otel/sdk v1.35.0
 	go.opentelemetry.io/otel/trace v1.35.0
 	go.opentelemetry.io/proto/otlp v1.6.0
-	golang.org/x/crypto v0.37.0
-	golang.org/x/net v0.39.0
-	golang.org/x/term v0.31.0
+	golang.org/x/crypto v0.45.0
+	golang.org/x/net v0.47.0
+	golang.org/x/sync v0.18.0
+	golang.org/x/term v0.37.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34
 	google.golang.org/grpc v1.72.1
 	google.golang.org/protobuf v1.36.6
@@ -48,8 +47,8 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/api/go.sum b/api/go.sum
index 2da62fd598e21..ab48e490cf7c5 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -16,8 +16,8 @@ github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.3.0 h1:kKkrYlgLQTMPA6BiSL25A7/x4CEh2YCG7rtb/aTkx+g=
+github.com/go-piv/piv-go/v2 v2.3.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
@@ -87,31 +87,33 @@ go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
diff --git a/api/mfa/mfa.go b/api/mfa/mfa.go
index 98e34b4651fae..368435fb169d1 100644
--- a/api/mfa/mfa.go
+++ b/api/mfa/mfa.go
@@ -21,7 +21,7 @@ import (
 	"context"
 	"encoding/base64"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
diff --git a/api/observability/tracing/ssh/client.go b/api/observability/tracing/ssh/client.go
index dd0a20c1d3217..28f0f8d014726 100644
--- a/api/observability/tracing/ssh/client.go
+++ b/api/observability/tracing/ssh/client.go
@@ -22,6 +22,7 @@ import (
 	"sync"
 	"sync/atomic"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"go.opentelemetry.io/otel/attribute"
 	semconv "go.opentelemetry.io/otel/semconv/v1.10.0"
@@ -29,6 +30,7 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport/api/observability/tracing"
+	"github.com/gravitational/teleport/api/types"
 )
 
 // Client is a wrapper around ssh.Client that adds tracing support.
@@ -36,6 +38,9 @@ type Client struct {
 	*ssh.Client
 	opts       []tracing.Option
 	capability tracingCapability
+
+	requestHandlersMu sync.Mutex
+	requestHandlers   map[string]RequestHandlerFn
 }
 
 type tracingCapability int
@@ -46,6 +51,24 @@ const (
 	tracingSupported
 )
 
+// NewClientWithTimeout establishes a new client connection, honoring the earliest of the following:
+//
+// - The context's deadline or cancellation
+// - The timeout specified in the config
+// - A default timeout of 30 seconds if config doesn't specify a timeout
+//
+// - If config.Timeout > 0: the specified timeout is applied in addition to any context deadline.
+// - If config.Timeout == 0: a default timeout of 30 seconds is used to prevent indefinite hangs.
+// - If config.Timeout < 0: only the context's deadline or cancellation is respected if any.
+func NewClientWithTimeout(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig, opts ...tracing.Option) (*Client, error) {
+	c, chans, reqs, err := NewClientConnWithTimeout(ctx, conn, addr, config, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewClient(c, chans, reqs, opts...), nil
+}
+
 // NewClient creates a new Client.
 //
 // The server being connected to is probed to determine if it supports
@@ -56,9 +79,10 @@ const (
 // of whether they should provide tracing context.
 func NewClient(c ssh.Conn, chans <-chan ssh.NewChannel, reqs <-chan *ssh.Request, opts ...tracing.Option) *Client {
 	clt := &Client{
-		Client:     ssh.NewClient(c, chans, reqs),
-		opts:       opts,
-		capability: tracingUnsupported,
+		Client:          ssh.NewClient(c, chans, reqs),
+		opts:            opts,
+		capability:      tracingUnsupported,
+		requestHandlers: map[string]RequestHandlerFn{},
 	}
 
 	if bytes.HasPrefix(clt.ServerVersion(), []byte("SSH-2.0-Teleport")) {
@@ -89,7 +113,7 @@ func (c *Client) DialContext(ctx context.Context, n, addr string) (net.Conn, err
 	)
 	defer span.End()
 
-	// create the wrapper while the lock is held
+	// create a new wrapper to propagate tracing span context.
 	wrapper := &clientWrapper{
 		capability: c.capability,
 		Conn:       c.Client.Conn,
@@ -162,21 +186,65 @@ func (c *Client) OpenChannel(
 	}, reqs, err
 }
 
-// NewSession creates a new SSH session that is passed tracing context
-// so that spans may be correlated properly over the ssh connection.
-func (c *Client) NewSession(ctx context.Context) (*Session, error) {
-	return c.newSession(ctx, nil)
+// SessionParams are session parameters supported by Teleport to provide additional
+// session context or parameters to the server.
+type SessionParams struct {
+	// WebProxyAddr is the address of the proxy forwarding the SSH connection to the target server.
+	WebProxyAddr string
+	// Reason is a reason attached to started sessions meant to describe their intent.
+	Reason string
+	// Invited is a list of people invited to a session.
+	Invited []string
+	// DisplayParticipantRequirements is set if debug information about participants requirements
+	// should be printed in moderated sessions.
+	DisplayParticipantRequirements bool
+	// JoinSessionID is the ID of a session to join.
+	JoinSessionID string
+	// JoinMode is the participant mode to join the session with.
+	// Required if JoinSessionID is set.
+	JoinMode types.SessionParticipantMode
+	// ModeratedSessionID is an optional parameter sent during SCP requests to specify which moderated session
+	// to check for valid FileTransferRequests.
+	ModeratedSessionID string
+}
+
+// ParseSessionParams unmarshals session parameters which have been [ssh.Marshal]ed by the client
+// and provided as extra data in the session channel request. If the provided data is empty, nil params
+// will be returned with a nil error.
+func ParseSessionParams(data []byte) (*SessionParams, error) {
+	if len(data) == 0 {
+		return nil, nil
+	}
+
+	var params SessionParams
+	if err := ssh.Unmarshal(data, &params); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if params.JoinSessionID != "" {
+		if _, err := uuid.Parse(params.JoinSessionID); err != nil {
+			return nil, trace.Wrap(err, "failed to parse join session ID: %v", params.JoinSessionID)
+		}
+
+		switch params.JoinMode {
+		case types.SessionModeratorMode, types.SessionObserverMode, types.SessionPeerMode:
+		default:
+			return nil, trace.BadParameter("Unrecognized session participant mode: %q", params.JoinMode)
+		}
+	}
+
+	return &params, nil
 }
 
-// NewSessionWithRequestCallback creates a new SSH session that is passed
-// tracing context so that spans may be correlated properly over the ssh
-// connection. The handling of channel requests from the underlying SSH
-// session can be controlled with chanReqCallback.
-func (c *Client) NewSessionWithRequestCallback(ctx context.Context, chanReqCallback ChannelRequestCallback) (*Session, error) {
-	return c.newSession(ctx, chanReqCallback)
+// NewSession creates a new SSH session. This session is passed a tracing context so that
+// spans may be correlated properly over the ssh connection.
+func (c *Client) NewSession(ctx context.Context) (*Session, error) {
+	return c.NewSessionWithParams(ctx, nil)
 }
 
-func (c *Client) newSession(ctx context.Context, chanReqCallback ChannelRequestCallback) (*Session, error) {
+// NewSessionWithParams creates a new SSH session with the given (optional) params. This session is
+// passed a tracing context so that spans may be correlated properly over the ssh connection.
+func (c *Client) NewSessionWithParams(ctx context.Context, sessionParams *SessionParams) (*Session, error) {
 	tracer := tracing.NewConfig(c.opts).TracerProvider.Tracer(instrumentationName)
 
 	ctx, span := tracer.Start(
@@ -194,7 +262,7 @@ func (c *Client) newSession(ctx context.Context, chanReqCallback ChannelRequestC
 	)
 	defer span.End()
 
-	// create the wrapper while the lock is still held
+	// create a new wrapper to propagate tracing span context.
 	wrapper := &clientWrapper{
 		capability: c.capability,
 		Conn:       c.Client.Conn,
@@ -203,9 +271,99 @@ func (c *Client) newSession(ctx context.Context, chanReqCallback ChannelRequestC
 		contexts:   make(map[string][]context.Context),
 	}
 
-	// get a session from the wrapper
-	session, err := wrapper.NewSession(chanReqCallback)
-	return session, trace.Wrap(err)
+	// If we are connected to a Teleport server, send session params in the session request.
+	// If the server does not support session parameters in the extra data, it will be ignored.
+	var sessionData []byte
+	if sessionParams != nil && c.capability == tracingSupported {
+		sessionData = ssh.Marshal(sessionParams)
+	}
+
+	// open a session manually so we can take ownership of the
+	// requests chan
+	ch, reqs, err := wrapper.OpenChannel("session", sessionData)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	unhandledReqs := c.serveSessionRequests(ctx, reqs)
+	session, err := newCryptoSSHSession(ch, unhandledReqs)
+	if err != nil {
+		_ = ch.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	// wrap the session so all session requests on the channel
+	// can be traced
+	return &Session{
+		Session: session,
+		wrapper: wrapper,
+	}, nil
+}
+
+// RequestHandlerFn is an ssh request handler function.
+type RequestHandlerFn func(ctx context.Context, req *ssh.Request)
+
+// HandleSessionRequest registers a handler for any incoming [ssh.Request] matching the
+// provided type within a session. If the type is already being handled, an error is returned.
+// All registered handlers are consumed by the next call to [Client.NewSession].
+func (c *Client) HandleSessionRequest(ctx context.Context, requestType string, handlerFn RequestHandlerFn) error {
+	c.requestHandlersMu.Lock()
+	defer c.requestHandlersMu.Unlock()
+
+	if _, ok := c.requestHandlers[requestType]; ok {
+		return trace.AlreadyExists("ssh request type %q is already being handled for this session", requestType)
+	}
+
+	c.requestHandlers[requestType] = handlerFn
+	return nil
+}
+
+// serveSessionRequests from the remote side with registered handlers.
+//
+// This method consumes all registered handlers so that the next call to
+// [Client.NewSession] will not reuse the same handlers.
+func (c *Client) serveSessionRequests(ctx context.Context, in <-chan *ssh.Request) <-chan *ssh.Request {
+	c.requestHandlersMu.Lock()
+	requestHandlers := c.requestHandlers
+	c.requestHandlers = make(map[string]RequestHandlerFn)
+	c.requestHandlersMu.Unlock()
+
+	// Capture requests not handled by registered request handlers and
+	// pass them to the crypto [ssh.Session].
+	unhandledReqs := make(chan *ssh.Request, cap(in))
+
+	tracer := tracing.NewConfig(c.opts).TracerProvider.Tracer(instrumentationName)
+	go func() {
+		defer close(unhandledReqs)
+		for req := range in {
+			ctx, span := tracer.Start(
+				ctx,
+				fmt.Sprintf("ssh.HandleRequests/%s", req.Type),
+				oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+				oteltrace.WithAttributes(
+					append(
+						peerAttr(c.Conn.RemoteAddr()),
+						semconv.RPCServiceKey.String("ssh.Client"),
+						semconv.RPCMethodKey.String("HandleRequests"),
+						semconv.RPCSystemKey.String("ssh"),
+					)...,
+				),
+			)
+
+			handler, ok := requestHandlers[req.Type]
+			if ok {
+				handler(ctx, req)
+			} else {
+				// Pass on requests without a registered handler. These will be
+				// handled by the default x/crypto/ssh request handler.
+				unhandledReqs <- req
+			}
+
+			span.End()
+		}
+	}()
+
+	return unhandledReqs
 }
 
 // clientWrapper wraps the ssh.Conn for individual ssh.Client
@@ -229,64 +387,6 @@ type clientWrapper struct {
 	contexts map[string][]context.Context
 }
 
-// ChannelRequestCallback allows the handling of channel requests
-// to be customized. nil can be returned if you don't want
-// golang/x/crypto/ssh to handle the request.
-type ChannelRequestCallback func(req *ssh.Request) *ssh.Request
-
-// NewSession opens a new Session for this client.
-func (c *clientWrapper) NewSession(callback ChannelRequestCallback) (*Session, error) {
-	// create a client that will defer to us when
-	// opening the "session" channel so that we
-	// can add an Envelope to the request
-	client := &ssh.Client{
-		Conn: c,
-	}
-
-	var session *ssh.Session
-	var err error
-	if callback != nil {
-		// open a session manually so we can take ownership of the
-		// requests chan
-		ch, originalReqs, openChannelErr := client.OpenChannel("session", nil)
-		if openChannelErr != nil {
-			return nil, trace.Wrap(openChannelErr)
-		}
-
-		// pass the channel requests to the provided callback and
-		// forward them to another chan so golang.org/x/crypto/ssh
-		// can handle Session exiting correctly
-		reqs := make(chan *ssh.Request, cap(originalReqs))
-		go func() {
-			defer close(reqs)
-
-			for req := range originalReqs {
-				if req := callback(req); req != nil {
-					reqs <- req
-				}
-			}
-		}()
-
-		session, err = newCryptoSSHSession(ch, reqs)
-		if err != nil {
-			_ = ch.Close()
-			return nil, trace.Wrap(err)
-		}
-	} else {
-		session, err = client.NewSession()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	// wrap the session so all session requests on the channel
-	// can be traced
-	return &Session{
-		Session: session,
-		wrapper: c,
-	}, nil
-}
-
 // wrappedSSHConn allows an SSH session to be created while also allowing
 // callers to take ownership of the SSH channel requests chan.
 type wrappedSSHConn struct {
diff --git a/api/observability/tracing/ssh/client_test.go b/api/observability/tracing/ssh/client_test.go
index b59549f2181bc..c7e8b5d7b9c38 100644
--- a/api/observability/tracing/ssh/client_test.go
+++ b/api/observability/tracing/ssh/client_test.go
@@ -21,7 +21,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 )
@@ -48,9 +48,8 @@ func TestIsTracingSupported(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 			t.Cleanup(cancel)
-			errChan := make(chan error, 5)
 
-			srv := newServer(t, tt.expectedCapability, func(conn *ssh.ServerConn, channels <-chan ssh.NewChannel, requests <-chan *ssh.Request) {
+			srv := newServer(t, tt.srvVersion, func(conn *ssh.ServerConn, channels <-chan ssh.NewChannel, requests <-chan *ssh.Request) {
 				go ssh.DiscardRequests(requests)
 
 				for {
@@ -64,29 +63,17 @@ func TestIsTracingSupported(t *testing.T) {
 						}
 
 						if err := ch.Reject(ssh.Prohibited, "no channels allowed"); err != nil {
-							errChan <- trace.Wrap(err, "rejecting channel")
+							assert.NoError(t, err, "rejecting channel")
 							return
 						}
 					}
 				}
 			})
 
-			if tt.srvVersion != "" {
-				srv.config.ServerVersion = tt.srvVersion
-			}
-
-			go srv.Run(errChan)
-
 			conn, chans, reqs := srv.GetClient(t)
 			client := NewClient(conn, chans, reqs)
 
 			require.Equal(t, tt.expectedCapability, client.capability)
-
-			select {
-			case err := <-errChan:
-				require.NoError(t, err)
-			default:
-			}
 		})
 	}
 }
@@ -104,14 +91,13 @@ func TestSetEnvs(t *testing.T) {
 	t.Parallel()
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
-	errChan := make(chan error, 5)
 
 	expected := map[string]string{"a": "1", "b": "2", "c": "3"}
 
 	// used to collect individual envs requests
 	envReqC := make(chan envReqParams, 3)
 
-	srv := newServer(t, tracingSupported, func(conn *ssh.ServerConn, channels <-chan ssh.NewChannel, requests <-chan *ssh.Request) {
+	srv := newServer(t, tracingSupportedVersion, func(conn *ssh.ServerConn, channels <-chan ssh.NewChannel, requests <-chan *ssh.Request) {
 		for {
 			select {
 			case <-ctx.Done():
@@ -123,7 +109,7 @@ func TestSetEnvs(t *testing.T) {
 				case ch.ChannelType() == "session":
 					ch, reqs, err := ch.Accept()
 					if err != nil {
-						errChan <- trace.Wrap(err, "failed to accept session channel")
+						assert.NoError(t, err, "failed to accept session channel")
 						return
 					}
 
@@ -178,7 +164,7 @@ func TestSetEnvs(t *testing.T) {
 									_ = req.Reply(true, nil)
 								default: // out of order or unexpected message
 									_ = req.Reply(false, []byte(fmt.Sprintf("unexpected ssh request %s on iteration %d", req.Type, i)))
-									errChan <- err
+									assert.NoError(t, err)
 									return
 								}
 							}
@@ -186,7 +172,7 @@ func TestSetEnvs(t *testing.T) {
 					}()
 				default:
 					if err := ch.Reject(ssh.ConnectionFailed, fmt.Sprintf("unexpected channel %s", ch.ChannelType())); err != nil {
-						errChan <- err
+						assert.NoError(t, err)
 						return
 					}
 				}
@@ -194,8 +180,6 @@ func TestSetEnvs(t *testing.T) {
 		}
 	})
 
-	go srv.Run(errChan)
-
 	// create a client and open a session
 	conn, chans, reqs := srv.GetClient(t)
 	client := NewClient(conn, chans, reqs)
@@ -235,12 +219,6 @@ func TestSetEnvs(t *testing.T) {
 			require.Equal(t, v, actual, "expected value %s for env %s, got %s", v, k, actual)
 		}
 	})
-
-	select {
-	case err := <-errChan:
-		require.NoError(t, err)
-	default:
-	}
 }
 
 type mockSSHChannel struct {
@@ -268,3 +246,136 @@ func TestWrappedSSHConn(t *testing.T) {
 		wrappedConn.OpenChannel("", nil)
 	})
 }
+
+// TestGlobalAndSessionRequests tests that the tracing client correctly handles global and session requests.
+func TestGlobalAndSessionRequests(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// pingRequest is an example request type. Whether sent by the server or client in
+	// a global or session context, the receiver should give an ok as the reply.
+	pingRequest := "ping@goteleport.com"
+
+	clientGlobalReply := make(chan bool, 1)
+	clientSessionReply := make(chan bool, 1)
+
+	srv := newServer(t, tracingSupportedVersion, func(conn *ssh.ServerConn, channels <-chan ssh.NewChannel, requests <-chan *ssh.Request) {
+		// Send a ping request when the client connection is established.
+		ok, _, err := conn.SendRequest(pingRequest, true, nil)
+		assert.NoError(t, err, "server failed to send global ping request")
+		clientGlobalReply <- ok
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case req := <-requests:
+				switch req.Type {
+				case pingRequest:
+					err := req.Reply(true, nil)
+					assert.NoError(t, err, "server failed to reply to global ping request")
+				default:
+					err := req.Reply(false, nil)
+					assert.NoError(t, err, "server failed to reply to global %q request", req.Type)
+				}
+			case ch := <-channels:
+				switch {
+				case ch == nil:
+					return
+				case ch.ChannelType() == "session":
+					ch, reqs, err := ch.Accept()
+					if err != nil {
+						assert.NoError(t, err, "failed to accept session channel")
+						return
+					}
+
+					go func() {
+						defer ch.Close()
+						for {
+							select {
+							case <-ctx.Done():
+								return
+							case req := <-reqs:
+								switch req.Type {
+								case pingRequest:
+									err := req.Reply(true, nil)
+									assert.NoError(t, err, "server failed to reply to session ping request")
+								}
+								continue
+							}
+						}
+					}()
+
+					// Send a ping request when the session is established.
+					ok, err := ch.SendRequest(pingRequest, true, nil)
+					assert.NoError(t, err, "server failed to send ping request")
+					clientSessionReply <- ok
+				default:
+					err := ch.Reject(ssh.ConnectionFailed, fmt.Sprintf("unexpected channel %s", ch.ChannelType()))
+					assert.NoError(t, err)
+				}
+			}
+		}
+	})
+
+	conn, chans, reqs := srv.GetClient(t)
+	client := NewClient(conn, chans, reqs)
+
+	// The client should reply false to any global request from the server, as we
+	// don't currently support a mechanism for the client to register global handlers.
+	select {
+	case reply := <-clientGlobalReply:
+		require.False(t, reply, "Expected the client to reply false to global ping request")
+	case <-time.After(10 * time.Second):
+		t.Fatalf("Failed to receive client global reply to ping request")
+	}
+
+	// The server should reply true to a global ping request.
+	ok, _, err := client.SendRequest(ctx, pingRequest, true, nil)
+	require.True(t, ok, "Expected the server to reply true to global ping request")
+	require.NoError(t, err)
+
+	// If the client isn't setup to handle session requests, it should reply false to them.
+	// The client should reply true to a session ping request.
+	_, err = client.NewSession(ctx)
+	require.NoError(t, err)
+
+	select {
+	case reply := <-clientSessionReply:
+		require.False(t, reply, "Expected the client to reply false to session ping request")
+	case <-time.After(10 * time.Second):
+		t.Fatalf("Failed to receive client session reply to ping request")
+	}
+
+	// The client should reply true to a session ping request.
+	err = client.HandleSessionRequest(ctx, pingRequest, func(ctx context.Context, req *ssh.Request) {
+		err := req.Reply(true, nil)
+		assert.NoError(t, err)
+	})
+	require.NoError(t, err)
+	_, err = client.NewSession(ctx)
+	require.NoError(t, err)
+
+	select {
+	case reply := <-clientSessionReply:
+		require.True(t, reply, "Expected the client to reply true to session ping request")
+	case <-time.After(10 * time.Second):
+		t.Fatalf("Failed to receive client session reply to ping request")
+	}
+
+	// New Sessions do not reuse previously registered handlers.
+	session, err := client.NewSession(ctx)
+	require.NoError(t, err)
+
+	select {
+	case reply := <-clientSessionReply:
+		require.False(t, reply, "Expected the client to reply false to session ping request")
+	case <-time.After(10 * time.Second):
+		t.Fatalf("Failed to receive client session reply to ping request")
+	}
+
+	// The server should reply true to a session ping request.
+	ok, err = session.SendRequest(ctx, pingRequest, true, nil)
+	require.NoError(t, err)
+	require.True(t, ok, "Expected the server to reply true to session ping request")
+}
diff --git a/api/observability/tracing/ssh/ssh.go b/api/observability/tracing/ssh/ssh.go
index 9e1d0243b5c48..5e8ee4d7003c3 100644
--- a/api/observability/tracing/ssh/ssh.go
+++ b/api/observability/tracing/ssh/ssh.go
@@ -15,10 +15,10 @@
 package ssh
 
 import (
+	"cmp"
 	"context"
 	"encoding/json"
 	"net"
-	"time"
 
 	"github.com/gravitational/trace"
 	"go.opentelemetry.io/otel/attribute"
@@ -27,6 +27,7 @@ import (
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/crypto/ssh"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/observability/tracing"
 )
 
@@ -126,58 +127,106 @@ func Dial(ctx context.Context, network, addr string, config *ssh.ClientConfig, o
 	if err != nil {
 		return nil, err
 	}
-	c, chans, reqs, err := NewClientConn(ctx, conn, addr, config, opts...)
+	c, err := NewClientWithTimeout(ctx, conn, addr, config, opts...)
 	if err != nil {
 		return nil, err
 	}
-	return NewClient(c, chans, reqs), nil
+	return c, nil
 }
 
-// NewClientConn creates a new SSH client connection that is passed tracing context so that spans may be correlated
-// properly over the ssh connection.
-func NewClientConn(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig, opts ...tracing.Option) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
+// NewClientConnWithTimeout creates a new SSH client connection that includes tracing context,
+// allowing spans to be properly correlated across the SSH connection.
+//
+// The connection respects the earliest of the following:
+// - The context's deadline or cancellation
+// - The timeout specified in the config
+// - A default timeout of 30 seconds if config doesn't specify a timeout
+//
+// Behavior based on config.Timeout:
+// - If > 0: the timeout is applied in addition to any context deadline.
+// - If == 0: a default timeout of 30 seconds is used to avoid hanging connections.
+// - If < 0: only the context’s deadline or cancellation is used.
+func NewClientConnWithTimeout(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig, opts ...tracing.Option) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
 	tracer := tracing.NewConfig(opts).TracerProvider.Tracer(instrumentationName)
 	ctx, span := tracer.Start( //nolint:staticcheck,ineffassign // keeping shadowed ctx to avoid accidental missing in the future
 		ctx,
-		"ssh/NewClientConn",
+		"ssh/NewClientConnWithTimeout",
 		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
 		oteltrace.WithAttributes(
 			append(
 				peerAttr(conn.RemoteAddr()),
 				attribute.String("address", addr),
 				semconv.RPCServiceKey.String("ssh"),
-				semconv.RPCMethodKey.String("NewClientConn"),
+				semconv.RPCMethodKey.String("NewClientConnWithTimeout"),
 				semconv.RPCSystemKey.String("ssh"),
 			)...,
 		),
 	)
 	defer span.End()
 
-	c, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
+	// ssh.ClientConfig.Timeout is not the total timeout for the connection
+	// establishment, including DNS resolution, TCP connection, but it doesn't
+	// include the SSH estalbishment.
+	// From the crypto/ssh docs:
+	// > Timeout is the maximum amount of time for the TCP connection to establish.
+	//
+	// Since we pass the connection here, the timeout will never be enforced by the
+	// ssh package. `NewClientConnWithDeadline` tries to enforced it by setting
+	// the read deadline on the connection, but might not be sufficient because
+	// we have some net.Conn implementations that don't support setting read deadlines
+	// and will block forever.
+	// To be sure that we don't block forever, we set up a timer that will close
+	// the connection when the timeout is reached.
+	// If the context has a deadline, we use that instead and take the minimum
+	// between the two.
+	// If neither is set, we default to 30 seconds.
+
+	// We aim to close the connection to avoid clients to hang forever
+	// if the server is not responding.
+
+	// If config.Timeout is negative, we don't set a timeout and restrict
+	// ourselves to the context deadline if any.
+	if config.Timeout >= 0 {
+		newCtx, cancel := context.WithTimeout(
+			ctx,
+			cmp.Or(config.Timeout, defaults.DefaultIOTimeout),
+		)
+		defer cancel()
+		ctx = newCtx
 	}
 
-	return c, chans, reqs, nil
-}
+	stopFn := context.AfterFunc(ctx, func() {
+		_ = conn.Close()
+	})
+	defer stopFn()
 
-// NewClientConnWithDeadline establishes new client connection with specified deadline
-func NewClientConnWithDeadline(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig, opts ...tracing.Option) (*Client, error) {
-	if config.Timeout > 0 {
-		if err := conn.SetReadDeadline(time.Now().Add(config.Timeout)); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-	c, chans, reqs, err := NewClientConn(ctx, conn, addr, config, opts...)
+	c, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return nil, err
+		// if the context was canceled or timed out, return that an aggregated error instead
+		// of the original error returned from NewClientConn. The returned error would be something like
+		// "ssh: handshake failed: read tcp {ip}:{port} -> {ip}:{port} use of closed network connection"
+		// which doesn't indicate the real error was a timeout or cancellation.
+		// If the context was not canceled and the function failed, it returns the original error as
+		// ctx.Err() would be nil.
+		return nil, nil, nil, trace.NewAggregate(ctx.Err(), err)
 	}
-	if config.Timeout > 0 {
-		if err := conn.SetReadDeadline(time.Time{}); err != nil {
-			return nil, trace.Wrap(err)
-		}
+
+	if !stopFn() {
+		// we failed to stop the AfterFunc so conn will be closed and
+		// c will soon become invalid no matter what we do, so we
+		// drain it and close it
+		_ = conn.Close()
+		go func() {
+			for newCh := range chans {
+				_ = newCh.Reject(0, "")
+			}
+		}()
+		go ssh.DiscardRequests(reqs)
+		_ = c.Close()
+		return nil, nil, nil, trace.Wrap(ctx.Err())
 	}
-	return NewClient(c, chans, reqs, opts...), nil
+
+	return c, chans, reqs, nil
 }
 
 // peerAttr returns attributes about the peer address.
diff --git a/api/observability/tracing/ssh/ssh_test.go b/api/observability/tracing/ssh/ssh_test.go
index e7618a3be15e3..9e6e1fe0fdbf1 100644
--- a/api/observability/tracing/ssh/ssh_test.go
+++ b/api/observability/tracing/ssh/ssh_test.go
@@ -21,10 +21,14 @@ import (
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
+	"io"
 	"net"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/propagation"
@@ -45,31 +49,6 @@ type server struct {
 	hSigner ssh.Signer
 }
 
-func (s *server) Run(errC chan error) {
-	for {
-		conn, err := s.listener.Accept()
-		if err != nil {
-			if !errors.Is(err, net.ErrClosed) {
-				errC <- err
-			}
-			return
-		}
-
-		go func() {
-			sconn, chans, reqs, err := ssh.NewServerConn(conn, s.config)
-			if err != nil {
-				errC <- err
-				return
-			}
-			s.handler(sconn, chans, reqs)
-		}()
-	}
-}
-
-func (s *server) Stop() error {
-	return s.listener.Close()
-}
-
 func generateSigner(t *testing.T) ssh.Signer {
 	_, private, err := ed25519.GenerateKey(rand.Reader)
 	require.NoError(t, err)
@@ -91,18 +70,18 @@ func (s *server) GetClient(t *testing.T) (ssh.Conn, <-chan ssh.NewChannel, <-cha
 	return sconn, nc, r
 }
 
-func newServer(t *testing.T, tracingCap tracingCapability, handler func(*ssh.ServerConn, <-chan ssh.NewChannel, <-chan *ssh.Request)) *server {
+const (
+	tracingSupportedVersion   = "SSH-2.0-Teleport"
+	tracingUnsupportedVersion = "SSH-2.0"
+)
+
+func newServer(t *testing.T, version string, handler func(*ssh.ServerConn, <-chan ssh.NewChannel, <-chan *ssh.Request)) *server {
 	listener, err := net.Listen("tcp", "localhost:0")
 	require.NoError(t, err)
 
 	cSigner := generateSigner(t)
 	hSigner := generateSigner(t)
 
-	version := "SSH-2.0-Teleport"
-	if tracingCap != tracingSupported {
-		version = "SSH-2.0"
-	}
-
 	config := &ssh.ServerConfig{
 		NoClientAuth:  true,
 		ServerVersion: version,
@@ -117,7 +96,33 @@ func newServer(t *testing.T, tracingCap tracingCapability, handler func(*ssh.Ser
 		hSigner:  hSigner,
 	}
 
-	t.Cleanup(func() { require.NoError(t, srv.Stop()) })
+	errC := make(chan error, 1)
+	go func() {
+		defer close(errC)
+		for {
+			conn, err := srv.listener.Accept()
+			if err != nil {
+				if !errors.Is(err, net.ErrClosed) {
+					errC <- err
+				}
+				return
+			}
+
+			go func() {
+				sconn, chans, reqs, err := ssh.NewServerConn(conn, srv.config)
+				if err != nil {
+					errC <- err
+					return
+				}
+				srv.handler(sconn, chans, reqs)
+			}()
+		}
+	}()
+
+	t.Cleanup(func() {
+		require.NoError(t, srv.listener.Close())
+		require.NoError(t, <-errC)
+	})
 
 	return srv
 }
@@ -300,8 +305,12 @@ func TestClient(t *testing.T) {
 				ctx:              ctx,
 			}
 
-			srv := newServer(t, tt.tracingSupported, handler.handle)
-			go srv.Run(errChan)
+			version := tracingSupportedVersion
+			if tt.tracingSupported != tracingSupported {
+				version = tracingUnsupportedVersion
+			}
+
+			srv := newServer(t, version, handler.handle)
 
 			tp := sdktrace.NewTracerProvider()
 			conn, chans, reqs := srv.GetClient(t)
@@ -414,3 +423,73 @@ func TestWrapPayload(t *testing.T) {
 		})
 	}
 }
+
+func TestNewClientConnTimeout(t *testing.T) {
+	t.Parallel()
+
+	// This test ensure that NewClientConnWithTimeout respects the context
+	// timeout and does not hang indefinitely.
+	listener, err := net.Listen("tcp", "localhost:0")
+	require.NoError(t, err)
+
+	var wg sync.WaitGroup
+	t.Cleanup(wg.Wait)
+	t.Cleanup(func() { listener.Close() })
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		defer listener.Close()
+
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				assert.ErrorIs(t, err, net.ErrClosed)
+				return
+			}
+			require.NoError(t, err)
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				defer conn.Close()
+				// Simulate a server that does not respond so the ssh.NewClientConn
+				// call on the client side hangs indefinitely.
+				_, _ = io.Copy(io.Discard, conn)
+			}()
+		}
+	}()
+
+	t.Run("context timeout is respected", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Millisecond)
+		t.Cleanup(cancel)
+
+		conn, err := net.Dial("tcp", listener.Addr().String())
+		require.NoError(t, err)
+
+		_, _, _, err = NewClientConnWithTimeout(ctx, conn, listener.Addr().String(), &ssh.ClientConfig{
+			Timeout:         -1,
+			HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		})
+
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.DeadlineExceeded, "expected context deadline exceeded error, got: %v", err)
+	})
+
+	t.Run("config timeout is respected", func(t *testing.T) {
+		t.Parallel()
+
+		conn, err := net.Dial("tcp", listener.Addr().String())
+		require.NoError(t, err)
+
+		_, _, _, err = NewClientConnWithTimeout(context.Background(), conn, listener.Addr().String(), &ssh.ClientConfig{
+			Timeout:         5 * time.Millisecond,
+			HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		})
+
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.DeadlineExceeded, "expected context deadline exceeded error, got: %v", err)
+	})
+
+}
diff --git a/api/profile/profile.go b/api/profile/profile.go
index ed9020e433b61..c01ccad841fa9 100644
--- a/api/profile/profile.go
+++ b/api/profile/profile.go
@@ -68,6 +68,14 @@ type Profile struct {
 	// MongoProxyAddr is the host:port the Mongo proxy can be accessed at.
 	MongoProxyAddr string `yaml:"mongo_proxy_addr,omitempty"`
 
+	// RelayAddr is the relay in use specified at login time, or "none" if use
+	// of a relay is explicitly disabled.
+	RelayAddr string `yaml:"relay_addr,omitempty"`
+
+	// DefaultRelayAddr is the cluster-specified address of the relay in use, to
+	// be used if RelayAddr is unspecified. Set at login time.
+	DefaultRelayAddr string `yaml:"default_relay_addr,omitempty"`
+
 	// Username is the Teleport username for the client.
 	Username string `yaml:"user,omitempty"`
 
@@ -169,7 +177,7 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 
 // Expiry returns the credential expiry.
 func (p *Profile) Expiry() (time.Time, bool) {
-	certPEMBlock, err := os.ReadFile(p.TLSCertPath())
+	certPEMBlock, err := p.TLSCert()
 	if err != nil {
 		return time.Time{}, false
 	}
@@ -180,6 +188,12 @@ func (p *Profile) Expiry() (time.Time, bool) {
 	return cert.NotAfter, true
 }
 
+// TLSCert returns the profile's TLS certificate.
+func (p *Profile) TLSCert() ([]byte, error) {
+	certPEMBlock, err := os.ReadFile(p.TLSCertPath())
+	return certPEMBlock, trace.Wrap(err)
+}
+
 // RequireKubeLocalProxy returns true if this profile indicates a local proxy
 // is required for kube access.
 func (p *Profile) RequireKubeLocalProxy() bool {
@@ -317,19 +331,26 @@ func FullProfilePath(dir string) string {
 
 // defaultProfilePath retrieves the default path of the TSH profile.
 func defaultProfilePath() string {
-	// start with UserHomeDir, which is the fastest option as it
-	// relies only on environment variables and does not perform
-	// a user lookup (which can be very slow on large AD environments)
-	home, err := os.UserHomeDir()
-	if err == nil && home != "" {
-		return filepath.Join(home, profileDir)
+	home, ok := UserHomeDir()
+	if !ok {
+		home = os.TempDir()
 	}
+	return filepath.Join(home, profileDir)
+}
 
-	home = os.TempDir()
+// UserHomeDir returns the current user's home directory if it can be found.
+func UserHomeDir() (string, bool) {
+	// Start with os.UserHomeDir, which is the fastest option as it relies only
+	// on environment variables and does not perform a user lookup (which can be
+	// very slow on large AD environments).
+	if home, err := os.UserHomeDir(); err == nil && home != "" {
+		return home, true
+	}
+	// Fall back to the user lookup.
 	if u, err := user.Current(); err == nil && u.HomeDir != "" {
-		home = u.HomeDir
+		return u.HomeDir, true
 	}
-	return filepath.Join(home, profileDir)
+	return "", false
 }
 
 // FromDir reads the user profile from a given directory. If dir is empty,
@@ -371,6 +392,10 @@ func profileFromFile(filePath string) (*Profile, error) {
 	// Older versions of tsh did not always store the cluster name in the
 	// profile. If no cluster name is found, fallback to the name of the profile
 	// for backward compatibility.
+	//
+	// TODO(gzdunek): A profile name is not the same thing as a site name, and they differ when the proxy hostname is different
+	// from the cluster name.
+	// Instead, tsh should be able to handle an empty site name, or this default should be changed.
 	if p.SiteName == "" {
 		p.SiteName = p.Name()
 	}
diff --git a/api/proto/teleport/accesslist/v1/accesslist.proto b/api/proto/teleport/accesslist/v1/accesslist.proto
index b12ee28b400f4..f57ac7c605e5b 100644
--- a/api/proto/teleport/accesslist/v1/accesslist.proto
+++ b/api/proto/teleport/accesslist/v1/accesslist.proto
@@ -71,6 +71,11 @@ message AccessListSpec {
 
   // owner_grants describes the access granted by owners to this Access List.
   AccessListGrants owner_grants = 11;
+
+  // type can be an empty string which denotes a regular Access List, "scim" which represents
+  // an Access List created from SCIM group or "static" for Access Lists managed by IaC
+  // tools.
+  string type = 12;
 }
 
 // AccessListOwner is an owner of an Access List.
@@ -304,6 +309,14 @@ message CurrentUserAssignments {
   AccessListUserAssignmentType membership_type = 2;
 }
 
+// UserAssignments describes the requested user's ownership and membership assignment types in the access list.
+message UserAssignments {
+  // ownership_type represents the requested user's ownership type (explicit, inherited, or none) in the access list.
+  AccessListUserAssignmentType ownership_type = 1;
+  // membership_type represents the requested user's membership type (explicit, inherited, or none) in the access list.
+  AccessListUserAssignmentType membership_type = 2;
+}
+
 // AccessListStatus contains dynamic fields calculated during retrieval.
 message AccessListStatus {
   // member_count is the number of members in the Access List.
@@ -316,4 +329,6 @@ message AccessListStatus {
   repeated string member_of = 4;
   // current_user_assignments describes the current user's ownership and membership status in the access list.
   CurrentUserAssignments current_user_assignments = 5;
+  // user_assignments describes the requested user's ownership and membership assignment types in the access list.
+  UserAssignments user_assignments = 6;
 }
diff --git a/api/proto/teleport/accesslist/v1/accesslist_service.proto b/api/proto/teleport/accesslist/v1/accesslist_service.proto
index 73fc691c92ab4..e1c46d166e117 100644
--- a/api/proto/teleport/accesslist/v1/accesslist_service.proto
+++ b/api/proto/teleport/accesslist/v1/accesslist_service.proto
@@ -28,7 +28,12 @@ service AccessListService {
   // GetAccessLists returns a list of all access lists.
   rpc GetAccessLists(GetAccessListsRequest) returns (GetAccessListsResponse);
   // ListAccessLists returns a paginated list of all access lists.
-  rpc ListAccessLists(ListAccessListsRequest) returns (ListAccessListsResponse);
+  // Deprecated: Use ListAccessListsV2 instead.
+  rpc ListAccessLists(ListAccessListsRequest) returns (ListAccessListsResponse) {
+    option deprecated = true;
+  }
+  // ListAccessListsV2 returns a paginated, filtered, and sorted list of all access lists.
+  rpc ListAccessListsV2(ListAccessListsV2Request) returns (ListAccessListsV2Response);
   // GetAccessList returns the specified access list resource.
   rpc GetAccessList(GetAccessListRequest) returns (AccessList);
   // UpsertAccessList creates or updates an access list resource.
@@ -53,16 +58,28 @@ service AccessListService {
   rpc ListAllAccessListMembers(ListAllAccessListMembersRequest) returns (ListAllAccessListMembersResponse);
   // GetAccessListMember returns the specified access list member resource.
   rpc GetAccessListMember(GetAccessListMemberRequest) returns (Member);
+  // GetStaticAccessListMember returns the specified access_list_member resource. If returns error
+  // if the target access_list is not of type static.  This API is there for the IaC tools to
+  // prevent them from making changes to members of dynamic access lists.
+  rpc GetStaticAccessListMember(GetStaticAccessListMemberRequest) returns (GetStaticAccessListMemberResponse);
   // GetAccessListOwners returns a list of all owners in an Access List,
   // including those inherited from nested Access Lists.
   rpc GetAccessListOwners(GetAccessListOwnersRequest) returns (GetAccessListOwnersResponse);
   // UpsertAccessListMember creates or updates an access list member resource.
   rpc UpsertAccessListMember(UpsertAccessListMemberRequest) returns (Member);
+  // UpsertStaticAccessListMember creates or updates an access_list_member resource. It returns
+  // error and does nothing if the target access_list is not of type static. This API is there for
+  // the IaC tools to prevent them from making changes to members of dynamic access lists.
+  rpc UpsertStaticAccessListMember(UpsertStaticAccessListMemberRequest) returns (UpsertStaticAccessListMemberResponse);
   // UpdateAccessListMember conditionally updates an access list member resource.
   rpc UpdateAccessListMember(UpdateAccessListMemberRequest) returns (Member);
   // DeleteAccessListMember hard deletes the specified access list member
   // resource.
   rpc DeleteAccessListMember(DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
+  // DeleteStaticAccessListMember hard deletes the specified access_list_member. It returns error
+  // and does nothing if the target access_list is not of static type. This API is there for the
+  // IaC tools to prevent them from making changes to members of dynamic access lists.
+  rpc DeleteStaticAccessListMember(DeleteStaticAccessListMemberRequest) returns (DeleteStaticAccessListMemberResponse);
   // DeleteAllAccessListMembers hard deletes all access list members for an
   // access list.
   rpc DeleteAllAccessListMembersForAccessList(DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
@@ -95,6 +112,10 @@ service AccessListService {
 
   // GetInheritedGrants returns the inherited grants for an access list.
   rpc GetInheritedGrants(GetInheritedGrantsRequest) returns (GetInheritedGrantsResponse);
+
+  // ListUserAccessLists returns a paginated list of all access lists where the
+  // user is an owner or member.
+  rpc ListUserAccessLists(ListUserAccessListsRequest) returns (ListUserAccessListsResponse);
 }
 
 // GetAccessListsRequest is the request for getting all access lists.
@@ -110,7 +131,6 @@ message GetAccessListsResponse {
 message ListAccessListsRequest {
   // page_size is the size of the page to request.
   int32 page_size = 1;
-
   // next_token is the page token.
   string next_token = 2;
 }
@@ -123,6 +143,38 @@ message ListAccessListsResponse {
   string next_token = 2;
 }
 
+// ListAccessListsV2Request is the request for getting filtered and sorted paginated access lists.
+message ListAccessListsV2Request {
+  // page_size is the size of the page to request.
+  int32 page_size = 1;
+  // page_token is the token to begin the next page with.
+  string page_token = 2;
+  // sort_by specifies the sort order for the results.
+  types.SortBy sort_by = 3;
+  // filter is a collection of fields to filter access lists.
+  AccessListsFilter filter = 4;
+}
+
+// AccessListsFilter is used to collect filter options for listing access lists.
+message AccessListsFilter {
+  // search is a search term to filter access lists by name.
+  string search = 1;
+  // owners indicates returned access lists should be owned by one of the provider owners
+  repeated string owners = 2;
+  // roles indicates returned access lists should great one of the provider roles
+  repeated string roles = 3;
+  // origin is origin of the resource
+  string origin = 4;
+}
+
+// ListAccessListsV2Response is the response for getting paginated access lists.
+message ListAccessListsV2Response {
+  // access_lists is the list of access lists.
+  repeated AccessList access_lists = 1;
+  // next_page_token is the next page token.
+  string next_page_token = 2;
+}
+
 // GetInheritedGrantsRequest is the request for getting inherited grants.
 message GetInheritedGrantsRequest {
   // access_list_id is the ID of the access list to retrieve.
@@ -247,16 +299,30 @@ message UpsertAccessListWithMembersResponse {
   repeated Member members = 2;
 }
 
-// GetAccessListMemberRequest is the request for retrieving an access list
-// member.
+// GetAccessListMemberRequest is the request for retrieving an access_list_member.
 message GetAccessListMemberRequest {
   // access_list is the name of the access list that the member belongs to.
   string access_list = 1;
-
   // member_name is the name of the user that belongs to the access list.
   string member_name = 2;
 }
 
+// GetStaticAccessListMemberRequest is the request for retrieving an access_list_member of a static
+// type access_list.
+message GetStaticAccessListMemberRequest {
+  // access_list is the name of the access_list that the member belongs to.
+  string access_list = 1;
+  // member_name is the name of the user that belongs to the access_list.
+  string member_name = 2;
+}
+
+// GetStaticAccessListMemberResponse is the response containing the access_list_member of the
+// target access_list of static type.
+message GetStaticAccessListMemberResponse {
+  // member of the target static access_list.
+  Member member = 1;
+}
+
 // GetAccessListOwnersRequest is the request for getting a list of all owners
 // in an Access List, including those inherited from nested Access Lists.
 message GetAccessListOwnersRequest {
@@ -282,6 +348,20 @@ message UpsertAccessListMemberRequest {
   Member member = 4;
 }
 
+// UpsertStaticAccessListMemberRequest is the request for upserting an access_list_member to an
+// access_list of type static.
+message UpsertStaticAccessListMemberRequest {
+  // member is the access_list_member to upsert.
+  Member member = 1;
+}
+
+// UpsertStaticAccessListMemberResponse is the response of upserting an access_list_member to an
+// static_access of type static.
+message UpsertStaticAccessListMemberResponse {
+  // member is the upserted access_list_member.
+  Member member = 1;
+}
+
 // UpdateAccessListMemberRequest is the request for updating an access list
 // member.
 message UpdateAccessListMemberRequest {
@@ -301,6 +381,19 @@ message DeleteAccessListMemberRequest {
   string member_name = 3;
 }
 
+// DeleteStaticAccessListMemberRequest is the request for deleting an access_list_member from an
+// access_list of type static.
+message DeleteStaticAccessListMemberRequest {
+  // access_list is the name of access list.
+  string access_list = 1;
+  // member_name is the name of the user to delete.
+  string member_name = 2;
+}
+
+// DeleteStaticAccessListMemberResponse is the response of deleting an access_list_member from an
+// access_list of type static.
+message DeleteStaticAccessListMemberResponse {}
+
 // DeleteAllAccessListMembersForAccessListRequest is the request for deleting
 // all members from an access list.
 message DeleteAllAccessListMembersForAccessListRequest {
@@ -416,3 +509,25 @@ message GetSuggestedAccessListsResponse {
   // access_lists is the list of suggested lists.
   repeated AccessList access_lists = 1;
 }
+
+// ListUserAccessListsRequest is the request for getting access lists where the
+// user is an owner or member.
+message ListUserAccessListsRequest {
+  // username is the name of the user to get access lists for.
+  string username = 1;
+  // page_size is the size of the page to request.
+  int32 page_size = 2;
+  // page_token is the page token.
+  string page_token = 3;
+}
+
+// ListUserAccessListsResponse is the response for getting access lists where the
+// user is an owner or member.
+message ListUserAccessListsResponse {
+  // access_lists are the access lists where the user is a member or owner.
+  repeated AccessList access_lists = 1;
+  // next_page_token is the next page token.
+  string next_page_token = 2;
+  // total_count is the total number of access lists in all pages.
+  int32 total_count = 3;
+}
diff --git a/api/proto/teleport/accessmonitoringrules/v1/access_monitoring_rules.proto b/api/proto/teleport/accessmonitoringrules/v1/access_monitoring_rules.proto
index f6ed98d53d3f0..df9c7e1a0d423 100644
--- a/api/proto/teleport/accessmonitoringrules/v1/access_monitoring_rules.proto
+++ b/api/proto/teleport/accessmonitoringrules/v1/access_monitoring_rules.proto
@@ -55,7 +55,7 @@ message AccessMonitoringRuleSpec {
   reserved 5;
   reserved "automatic_approval";
 
-  // automatic_review defines automatic review configurations for access requests.
+  // automatic_review defines automatic review configurations for Access Requests.
   // Both notification and automatic_review may be set within the same
   // access_monitoring_rule. If both fields are set, the rule will trigger
   // both notifications and automatic reviews for the same set of access events.
@@ -63,10 +63,16 @@ message AccessMonitoringRuleSpec {
   // set.
   AutomaticReview automatic_review = 6;
 
-  // desired_state defines the desired state of the subject. For access request
+  // desired_state defines the desired state of the subject. For Access Request
   // subjects, the desired_state may be set to `reviewed` to indicate that the
-  // access request should be automatically reviewed.
+  // Access Request should be automatically reviewed.
   string desired_state = 7;
+
+  // schedules specifies a map of schedules that can be used to configure the
+  // access monitoring rule conditions.
+  //
+  // Available in Teleport v18.2.8 or higher.
+  map<string, Schedule> schedules = 8;
 }
 
 // Notification contains configurations for plugin notification rules.
@@ -87,6 +93,36 @@ message AutomaticReview {
   string decision = 2;
 }
 
+// Schedule specifies a schedule that can be used to configure rule conditions.
+message Schedule {
+  // TimeSchedule specifies an in-line schedule.
+  TimeSchedule time = 1;
+}
+
+// TimeSchedule specifies an in-line schedule.
+message TimeSchedule {
+  // Shifts contains a set of shifts that make up the schedule.
+  repeated Shift shifts = 1;
+
+  // Timezone specifies the schedule timezone. This field is optional and defaults
+  // to "UTC". Accepted values use timezone locations as defined in the IANA
+  // Time Zone Database, such as "America/Los_Angeles", "Europe/Lisbon", or
+  // "Asia/Singapore".
+  //
+  // See https://data.iana.org/time-zones/tzdb/zone1970.tab for a list of supported values.
+  string timezone = 2;
+
+  // Shift contains the weekday, start time, and end time of a shift.
+  message Shift {
+    // Weekday specifies the day of the week, e.g., "Sunday", "Monday", "Tuesday".
+    string weekday = 1;
+    // Start specifies the start time in the format HH:MM, e.g., "12:30".
+    string start = 2;
+    // End specifies the end time in the format HH:MM, e.g., "12:30".
+    string end = 3;
+  }
+}
+
 // CreateAccessMonitoringRuleRequest is the request for CreateAccessMonitoringRule.
 message CreateAccessMonitoringRuleRequest {
   // access_monitoring_rule is the specification of the rule to be created.
diff --git a/api/proto/teleport/autoupdate/v1/autoupdate.proto b/api/proto/teleport/autoupdate/v1/autoupdate.proto
index 0a1a6a0cf2d62..13acd5afcc6f0 100644
--- a/api/proto/teleport/autoupdate/v1/autoupdate.proto
+++ b/api/proto/teleport/autoupdate/v1/autoupdate.proto
@@ -83,6 +83,10 @@ message AgentAutoUpdateGroup {
   // wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure".
   // This field must be positive.
   int32 wait_hours = 5;
+  // canary_count is the number of canary agents that will be updated before the whole group is updated.
+  // when set to 0, the group does not enter the canary phase. This number is capped to 5.
+  // This number must always be lower than the total number of agents in the group, else the rollout will be stuck.
+  int32 canary_count = 6;
 }
 
 // AutoUpdateVersion is a resource singleton with version required for
@@ -113,9 +117,9 @@ message AutoUpdateVersionSpecTools {
 
 // AutoUpdateVersionSpecAgents is the spec for the autoupdate version.
 message AutoUpdateVersionSpecAgents {
-  // start_version is the version to update from.
+  // start_version is the version used for newly installed agents before their update window.
   string start_version = 1;
-  // target_version is the version to update to.
+  // target_version is the version that all agents will update to during their update window.
   string target_version = 2;
   // schedule to use for the rollout
   string schedule = 3;
@@ -139,9 +143,9 @@ message AutoUpdateAgentRollout {
 // This is built by merging the user-provided AutoUpdateConfigSpecAgents and the operator-provided
 // AutoUpdateVersionSpecAgents.
 message AutoUpdateAgentRolloutSpec {
-  // start_version is the version to update from.
+  // start_version is the version used for newly installed agents before their update window.
   string start_version = 1;
-  // target_version is the version to update to.
+  // target_version is the version that all agents will update to during their update window.
   string target_version = 2;
   // schedule to use for the rollout. Supported values are "regular" and "immediate".
   // - "regular" follows the regular group schedule
@@ -230,6 +234,12 @@ message AutoUpdateAgentRolloutStatusGroup {
   // to the done state if:
   // - the ratio present_count/initial_count is above 0.9 (no more than 10% of the nodes dropped during update)
   uint64 up_to_date_count = 12;
+  // canary_count represents how many canaries this group should have to leave the AUTO_UPDATE_AGENT_GROUP_STATE_CANARY
+  // state.
+  uint64 canary_count = 13;
+  // canaries is the list of canary agents that should be updated.
+  // This list is empty until we enter the AUTO_UPDATE_AGENT_GROUP_STATE_CANARY state.
+  repeated Canary canaries = 14;
 }
 
 // AutoUpdateAgentGroupState represents the agent group state. This state controls whether the agents from this group
@@ -247,6 +257,9 @@ enum AutoUpdateAgentGroupState {
   // AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK represents that the group has been rolled back.
   // New agents should run v1, existing agents should update to v1.
   AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK = 4;
+  // AUTO_UPDATE_AGENT_GROUP_STATE_CANARY represents that the group is updating a few canary nodes, but that most nodes
+  // have not started updating yet.
+  AUTO_UPDATE_AGENT_GROUP_STATE_CANARY = 5;
 }
 
 // AutoUpdateAgentRolloutState represents the rollout state. This tells if Teleport started updating agents from the
@@ -305,3 +318,60 @@ message AutoUpdateAgentReportSpecOmitted {
   int64 count = 1;
   string reason = 2;
 }
+
+// AutoUpdateBotInstanceReport is a report generated by an elected instance of the
+// Teleport Auth service. The report tracks per group and per version how many
+// instances of tbot are running.
+message AutoUpdateBotInstanceReport {
+  // The kind of resource represented. This is always `autoupdate_bot_instance_report`.
+  string kind = 1;
+
+  // Differentiates variations of the same kind. All resources should contain
+  // one, even if it is never populated.
+  string sub_kind = 2;
+
+  // The version of the resource being represented.
+  string version = 3;
+
+  // Common metadata that all resources share.
+  teleport.header.v1.Metadata metadata = 4;
+
+  // Contents of the report.
+  AutoUpdateBotInstanceReportSpec spec = 5;
+}
+
+// AutoUpdateBotInstanceReportSpec holds the contents of an AutoUpdateBotInstanceReport.
+message AutoUpdateBotInstanceReportSpec {
+  // Timestamp is when the report was generated.
+  google.protobuf.Timestamp timestamp = 1;
+
+  // Bot counts aggregated by update group.
+  map<string, AutoUpdateBotInstanceReportSpecGroup> groups = 2;
+}
+
+// AutoUpdateBotInstanceReportSpecGroup holds an update group's bot counts.
+message AutoUpdateBotInstanceReportSpecGroup {
+  // Bot counts aggregated by version.
+  map<string, AutoUpdateBotInstanceReportSpecGroupVersion> versions = 1;
+}
+
+// AutoUpdateBotInstanceReportSpecGroupVersion holds a version's bot count.
+message AutoUpdateBotInstanceReportSpecGroupVersion {
+  // Count of bot instances running this version.
+  int32 count = 1;
+}
+
+// Canary describes a node that is acting as a canary and being updated before other nodes in its group.
+message Canary {
+  // updater_id is reported by the agent in its control stream Hello. This allows us to uniquely identify an updater so
+  // the proxy can modulate its answer when the request comes from this specific updater.
+  string updater_id = 1;
+  // host_id is the node Host ID, reported by the agent in its control stream Hello.
+  string host_id = 2;
+  // hostname is the server hostname reported by the agent in its control stream Hello.
+  // This is purely for debugging purposes: if the agent drops, we won't be able to query the inventory to know which
+  // agent it was.
+  string hostname = 3;
+  // success represents if the agent successfully connected back, running the target version.
+  bool success = 4;
+}
diff --git a/api/proto/teleport/autoupdate/v1/autoupdate_service.proto b/api/proto/teleport/autoupdate/v1/autoupdate_service.proto
index 10146e5981f8e..e00c699ae8c9b 100644
--- a/api/proto/teleport/autoupdate/v1/autoupdate_service.proto
+++ b/api/proto/teleport/autoupdate/v1/autoupdate_service.proto
@@ -96,6 +96,12 @@ service AutoUpdateService {
 
   // DeleteAutoUpdateAgentReport removes the specified AutoUpdateAgentReport resource.
   rpc DeleteAutoUpdateAgentReport(DeleteAutoUpdateAgentReportRequest) returns (google.protobuf.Empty);
+
+  // GetAutoUpdateBotInstanceReport returns the singleton AutoUpdateBotInstanceReport resource.
+  rpc GetAutoUpdateBotInstanceReport(GetAutoUpdateBotInstanceReportRequest) returns (AutoUpdateBotInstanceReport);
+
+  // DeleteAutoUpdateBotInstanceReport removes the singleton AutoUpdateBotInstanceReport resource.
+  rpc DeleteAutoUpdateBotInstanceReport(DeleteAutoUpdateBotInstanceReportRequest) returns (google.protobuf.Empty);
 }
 
 // Request for GetAutoUpdateConfig.
@@ -237,3 +243,9 @@ message DeleteAutoUpdateAgentReportRequest {
   // Name is the name of the AutoUpdateAgentReport to be deleted.
   string name = 1;
 }
+
+// Request for GetAutoUpdateBotInstanceReport.
+message GetAutoUpdateBotInstanceReportRequest {}
+
+// Request for DeleteAutoUpdateBotInstanceReport.
+message DeleteAutoUpdateBotInstanceReportRequest {}
diff --git a/api/proto/teleport/componentfeatures/v1/component_features.proto b/api/proto/teleport/componentfeatures/v1/component_features.proto
new file mode 100644
index 0000000000000..bbd3c51f6d0dc
--- /dev/null
+++ b/api/proto/teleport/componentfeatures/v1/component_features.proto
@@ -0,0 +1,32 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.componentfeatures.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1;componentfeaturesv1";
+
+// ComponentFeatureID is an identifier for a specific feature supported by a Teleport component.
+enum ComponentFeatureID {
+  COMPONENT_FEATURE_ID_UNSPECIFIED = 0;
+  // ResourceConstraintsV1 indicates support for Resource Constraints and ResourceAccessIDs, as defined in RFD 228.
+  COMPONENT_FEATURE_ID_RESOURCE_CONSTRAINTS_V1 = 1;
+}
+
+// ComponentFeatures represents a set of features supported by a given Teleport component.
+message ComponentFeatures {
+  // features is a list of supported feature identifiers.
+  repeated ComponentFeatureID features = 1;
+}
diff --git a/api/proto/teleport/decision/v1alpha1/ssh_access.proto b/api/proto/teleport/decision/v1alpha1/ssh_access.proto
index 4e982cc15cf75..2b383397ef0b1 100644
--- a/api/proto/teleport/decision/v1alpha1/ssh_access.proto
+++ b/api/proto/teleport/decision/v1alpha1/ssh_access.proto
@@ -159,6 +159,14 @@ message LockTarget {
 
   // ServerID is the host id of the Teleport instance.
   string server_id = 8;
+
+  // BotInstanceID is the bot instance ID if this is a bot identity.
+  string bot_instance_id = 9;
+
+  // JoinToken is the name of the join token used when this identity originally
+  // joined. This only applies to bot identities, and cannot be used to target
+  // bots that joined via the `token` join method.
+  string join_token = 10;
 }
 
 // HostUserMode determines how host users should be created.
diff --git a/api/proto/teleport/decision/v1alpha1/ssh_identity.proto b/api/proto/teleport/decision/v1alpha1/ssh_identity.proto
index 0b50aac726ee1..add9a21342d18 100644
--- a/api/proto/teleport/decision/v1alpha1/ssh_identity.proto
+++ b/api/proto/teleport/decision/v1alpha1/ssh_identity.proto
@@ -18,6 +18,7 @@ package teleport.decision.v1alpha1;
 
 import "google/protobuf/timestamp.proto";
 import "teleport/decision/v1alpha1/tls_identity.proto";
+import "teleport/scopes/v1/scopes.proto";
 import "teleport/trait/v1/trait.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
@@ -155,6 +156,17 @@ message SSHIdentity {
   // GitHubUsername indicates the GitHub username identified by the GitHub
   // connector.
   string github_username = 33;
+
+  // JoinToken is the name of the join token used for bot joining. It is unset
+  // for other identity types, or for bots using the `token` join method.
+  string join_token = 34;
+
+  // ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+  // set, the Roles field must not be set.
+  teleport.scopes.v1.Pin scope_pin = 35;
+
+  // The scope associated with a host identity.
+  string agent_scope = 36;
 }
 
 // CertExtensionMode specifies the type of extension to use in the cert. This type
diff --git a/api/proto/teleport/decision/v1alpha1/tls_identity.proto b/api/proto/teleport/decision/v1alpha1/tls_identity.proto
index 2bf71360d174d..e75c944e57f90 100644
--- a/api/proto/teleport/decision/v1alpha1/tls_identity.proto
+++ b/api/proto/teleport/decision/v1alpha1/tls_identity.proto
@@ -17,6 +17,7 @@ syntax = "proto3";
 package teleport.decision.v1alpha1;
 
 import "google/protobuf/timestamp.proto";
+import "teleport/scopes/v1/scopes.proto";
 import "teleport/trait/v1/trait.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
@@ -149,6 +150,15 @@ message TLSIdentity {
 
   // UserType indicates if the User was created by an SSO Provider or locally.
   string user_type = 35;
+
+  // JoinToken is the name of the join token used when a bot joins; it does not
+  // apply to other identity types, or to bots using the traditional `token`
+  // join method.
+  string join_token = 36;
+
+  // ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+  // set, the Roles field must not be set.
+  teleport.scopes.v1.Pin scope_pin = 37;
 }
 
 // RouteToApp holds routing information for applications.
diff --git a/api/proto/teleport/healthcheckconfig/v1/health_check_config.proto b/api/proto/teleport/healthcheckconfig/v1/health_check_config.proto
index f28125bf74cc0..79c537b48f2dd 100644
--- a/api/proto/teleport/healthcheckconfig/v1/health_check_config.proto
+++ b/api/proto/teleport/healthcheckconfig/v1/health_check_config.proto
@@ -64,4 +64,13 @@ message Matcher {
   // empty value is ignored. The match result is logically ANDed with DBLabels,
   // if both are non-empty.
   string db_labels_expression = 2;
+  // KubernetesLabels matches Kubernetes labels. An empty value is ignored. The match
+  // result is logically ANDed with KubernetesLabelsExpression, if both are non-empty.
+  repeated teleport.label.v1.Label kubernetes_labels = 3;
+  // KubernetesLabelsExpression is a label predicate expression to match Kubernetes. An
+  // empty value is ignored. The match result is logically ANDed with KubernetesLabels,
+  // if both are non-empty.
+  string kubernetes_labels_expression = 4;
+  // Disabled disables matches for all labels and expressions.
+  bool disabled = 5;
 }
diff --git a/api/proto/teleport/identitycenter/v1/identitycenter_service.proto b/api/proto/teleport/identitycenter/v1/identitycenter_service.proto
deleted file mode 100644
index 5230c53040f60..0000000000000
--- a/api/proto/teleport/identitycenter/v1/identitycenter_service.proto
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package teleport.identitycenter.v1;
-
-import "google/protobuf/empty.proto";
-
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1;identitycenterv1";
-
-// IdentityCenterService provides methods to manage Identity Center
-// resources.
-service IdentityCenterService {
-  // DeleteAllIdentityCenterAccounts deletes all Identity Center accounts.
-  rpc DeleteAllIdentityCenterAccounts(DeleteAllIdentityCenterAccountsRequest) returns (google.protobuf.Empty);
-
-  // DeleteAllAccountAssignments deletes all Identity Center Account assignments.
-  rpc DeleteAllAccountAssignments(DeleteAllAccountAssignmentsRequest) returns (google.protobuf.Empty);
-
-  // DeleteAllPrincipalAssignments deletes all Identity Center principal assignments.
-  rpc DeleteAllPrincipalAssignments(DeleteAllPrincipalAssignmentsRequest) returns (google.protobuf.Empty);
-
-  // DeleteAllPermissionSets deletes all Identity Center permission sets.
-  rpc DeleteAllPermissionSets(DeleteAllPermissionSetsRequest) returns (google.protobuf.Empty);
-}
-
-// DeleteAllIdentityCenterAccountsRequest is a request to delete all Identity Center imported accounts.
-message DeleteAllIdentityCenterAccountsRequest {}
-
-// DeleteAllAccountAssignmentsRequest is a request to delete all Identity Center account assignments.
-message DeleteAllAccountAssignmentsRequest {}
-
-// DeleteAllPrincipalAssignmentsRequest is a request to delete all Identity Center principal assignments.
-message DeleteAllPrincipalAssignmentsRequest {}
-
-// DeleteAllPermissionSetsRequest is a request to delete all Identity Center permission sets.
-message DeleteAllPermissionSetsRequest {}
diff --git a/api/proto/teleport/integration/v1/awsra_service.proto b/api/proto/teleport/integration/v1/awsra_service.proto
new file mode 100644
index 0000000000000..e15effa44e5f4
--- /dev/null
+++ b/api/proto/teleport/integration/v1/awsra_service.proto
@@ -0,0 +1,128 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.integration.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1;integrationv1";
+
+// AWSRolesAnywhereService provides access to AWS APIs using the AWS Roles Anywhere Integration.
+service AWSRolesAnywhereService {
+  // AWSRolesAnywherePing does an health check for the integration.
+  // Returns the caller identity and the number of AWS Roles Anywhere Profiles that are active.
+  // It uses the following APIs:
+  // https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
+  // https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+  rpc AWSRolesAnywherePing(AWSRolesAnywherePingRequest) returns (AWSRolesAnywherePingResponse);
+
+  // ListRolesAnywhereProfiles lists the AWS Roles Anywhere Profiles that are configured in the integration.
+  // It uses the following API:
+  // https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+  // https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html
+  //
+  // The number of profiles returned is always between 0 and page_size.
+  // If the number of elements is 0, then there are no more profiles to return and the next page token is empty.
+  rpc ListRolesAnywhereProfiles(ListRolesAnywhereProfilesRequest) returns (ListRolesAnywhereProfilesResponse);
+}
+
+// AWSRolesAnywherePingRequest is a request for doing an health check against the configured integration.
+message AWSRolesAnywherePingRequest {
+  oneof mode {
+    // Use an integration to perform the Ping operation.
+    string integration = 1;
+    // Use a Trust Anchor, Profile and Role to perform the Ping operation.
+    // This is useful when the integration is not configured.
+    AWSRolesAnywherePingRequestWithoutIntegration custom = 2;
+  }
+}
+
+// Identifies the Trust Anchor, Profile and Role to use for the Ping operation.
+message AWSRolesAnywherePingRequestWithoutIntegration {
+  // The AWS Roles Anywhere Trust Anchor ARN to be used when generating the token.
+  string trust_anchor_arn = 1;
+
+  // The AWS Roles Anywhere Profile ARN to be used when generating the token.
+  string profile_arn = 3;
+
+  // The AWS Role ARN to be used when generating the token.
+  string role_arn = 4;
+}
+
+// AWSRolesAnywherePingResponse contains the response for the Ping operation.
+message AWSRolesAnywherePingResponse {
+  // The AWS account ID number of the account that owns or contains the calling entity.
+  string account_id = 1;
+  // The AWS ARN associated with the calling entity.
+  string arn = 2;
+  // The unique identifier of the calling entity.
+  string user_id = 3;
+  // The number of AWS Roles Anywhere Profiles that are active and have at least one associated Role.
+  int32 profile_count = 4;
+}
+
+// ListRolesAnywhereProfilesRequest is a request to list AWS Roles Anywhere Profiles.
+message ListRolesAnywhereProfilesRequest {
+  // Integration is the AWS Roles Anywhere Integration name.
+  string integration = 1;
+  // page_size is the max size of the page to request.
+  // Depending on the filters, the actual number of profiles returned may be less than this value.
+  int32 page_size = 2;
+  // next_page_token is the page token.
+  string next_page_token = 3;
+  // ProfileNameFilters is a list of filters applied to the profile name.
+  // Only matching profiles will be returned.
+  // If empty, no filtering is applied.
+  //
+  // Filters can be globs, for example:
+  //
+  //	profile*
+  //	*name*
+  //
+  // Or regexes if they're prefixed and suffixed with ^ and $, for example:
+  //
+  //	^profile.*$
+  //	^.*name.*$
+  repeated string profile_name_filters = 4;
+}
+
+// ListRolesAnywhereProfilesResponse contains the response for the ListRolesAnywhereProfiles operation.
+message ListRolesAnywhereProfilesResponse {
+  // Profiles is a list of AWS Roles Anywhere Profiles.
+  repeated RolesAnywhereProfile profiles = 1;
+
+  // NextPageToken is used to paginate the results.
+  string next_page_token = 2;
+}
+
+// RolesAnywhereProfile represents an AWS Roles Anywhere Profile.
+message RolesAnywhereProfile {
+  // The AWS Roles Anywhere Profile ARN.
+  string arn = 1;
+
+  // Whether the AWS Roles Anywhere Profile is enabled.
+  bool enabled = 2;
+
+  // The name of the AWS Roles Anywhere Profile.
+  string name = 3;
+
+  // Whether the profile accepts role session names.
+  bool accept_role_session_name = 4;
+
+  // The tags associated with the AWS Roles Anywhere Profile.
+  map<string, string> tags = 5;
+
+  // The roles accessible from this AWS Roles Anywhere Profile.
+  repeated string roles = 6;
+}
diff --git a/api/proto/teleport/join/v1/joinservice.proto b/api/proto/teleport/join/v1/joinservice.proto
new file mode 100644
index 0000000000000..2bc620a2ac6ac
--- /dev/null
+++ b/api/proto/teleport/join/v1/joinservice.proto
@@ -0,0 +1,554 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.join.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1;joinv1";
+
+// ClientInit is the first message sent from the client during the join process, it
+// holds parameters common to all join methods.
+message ClientInit {
+  // JoinMethod is the name of the join method that the client is configured to use.
+  // This parameter is optional, the client can leave it empty to allow the
+  // server to determine the join method based on the provision token named by
+  // TokenName, it will be sent to the client in the ServerInit message.
+  optional string join_method = 1;
+  // TokenName is the name of the join token.
+  // This is a secret if using the token join method, otherwise it is a
+  // non-secret name of a provision token resource.
+  string token_name = 2;
+  // SystemRole is the system role requested, e.g. Proxy, Node, Instance, Bot.
+  string system_role = 3;
+  // ForwardedByProxy will be set to true when the message is forwarded by the
+  // Proxy service. When this is set the Auth service must ignore any
+  // any credentials authenticating the request, except for the purpose of
+  // accepting ProxySuppliedParams.
+  bool forwarded_by_proxy = 4;
+
+  // ProxySuppliedParams holds parameters set by the Proxy when nodes join
+  // via the proxy address. They must only be trusted if the incoming join
+  // request is authenticated as the Proxy.
+  message ProxySuppliedParams {
+    // RemoteAddr is the remote address of the host requesting a host certificate.
+    // It replaces 0.0.0.0 in the list of additional principals.
+    string remote_addr = 1;
+    // ClientVersion is the Teleport version of the client attempting to join.
+    string client_version = 2;
+  }
+  optional ProxySuppliedParams proxy_supplied_parameters = 5;
+}
+
+// PublicKeys holds public keys sent by the client requested subject keys for
+// issued certificates.
+message PublicKeys {
+  // PublicTlsKey is the public key requested for the subject of the x509 certificate.
+  // It must be encoded in PKIX, ASN.1 DER form.
+  bytes public_tls_key = 1;
+  // PublicSshKey is the public key requested for the subject of the SSH certificate.
+  // It must be encoded in SSH wire format.
+  bytes public_ssh_key = 2;
+}
+
+// HostParams holds parameters required for host joining.
+message HostParams {
+  // PublicKeys holds the host public keys.
+  PublicKeys public_keys = 1;
+  // HostName is the user-friendly node name for the host. This comes from
+  // teleport.nodename in the service configuration and defaults to the
+  // hostname. It is encoded as a valid principal in issued certificates.
+  string host_name = 2;
+  // AdditionalPrincipals is a list of additional principals requested.
+  repeated string additional_principals = 3;
+  // DnsNames is a list of DNS names requested for inclusion in the x509 certificate.
+  repeated string dns_names = 4;
+}
+
+// BotParams holds parameters required for bot joining.
+message BotParams {
+  // PublicKeys holds the bot public keys.
+  PublicKeys public_keys = 1;
+  // Expires is a desired time of the expiry of the returned certificates.
+  optional google.protobuf.Timestamp expires = 2;
+}
+
+// ClientParams holds either host or bot join parameters.
+message ClientParams {
+  oneof payload {
+    HostParams host_params = 1;
+    BotParams bot_params = 2;
+  }
+}
+
+// TokenInit is sent by the client in response to the ServerInit message for
+// the Token join method.
+//
+// The Token method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: TokenInit
+// 4. server->client: Result
+message TokenInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+}
+
+// OIDCInit holds the OIDC identity token used for all OIDC-based join methods.
+//
+// The join flow for all OIDC-based join methods is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: OIDCInit
+// 4. server->client: Result
+message OIDCInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+  // IdToken is the OIDC identity token.
+  bytes id_token = 2;
+}
+
+// BoundKeypairInit is sent from the client in response to the ServerInit
+// message for the bound keypair join method.
+// The server is expected to respond with a BoundKeypairChallenge.
+//
+// The bound keypair method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: BoundKeypairInit
+// 4. server->client: BoundKeypairChallenge
+// 5. client->server: BoundKeypairChallengeSolution
+//   (optional additional steps if keypair rotation is required)
+//   server->client: BoundKeypairRotationRequest
+//   client->server: BoundKeypairRotationResponse
+//   server->client: BoundKeypairChallenge
+//   client->server: BoundKeypairChallengeSolution
+// 6. server->client: Result containing BoundKeypairResult
+message BoundKeypairInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+  // If set, attempts to bind a new keypair using an initial join secret.
+  // Any value set here will be ignored if a keypair is already bound.
+  string initial_join_secret = 2;
+  // A document signed by Auth containing join state parameters from the
+  // previous join attempt. Not required on initial join; required on all
+  // subsequent joins.
+  bytes previous_join_state = 3;
+}
+
+// BoundKeypairChallenge is a challenge issued by the server that joining
+// clients are expected to complete.
+// The client is expected to respond with a BoundKeypairChallengeSolution.
+message BoundKeypairChallenge {
+  // The desired public key corresponding to the private key that should be used
+  // to sign this challenge, in SSH authorized keys format.
+  bytes public_key = 1;
+  // A challenge to sign with the requested public key. During keypair rotation,
+  // a second challenge will be provided to verify the new keypair before certs
+  // are returned.
+  string challenge = 2;
+}
+
+// BoundKeypairChallengeSolution is sent from the client in response to the
+// BoundKeypairChallenge.
+// The server is expected to respond with either a Result or a
+// BoundKeypairRotationRequest.
+message BoundKeypairChallengeSolution {
+  // A solution to a challenge from the server. This generated by signing the
+  // challenge as a JWT using the keypair associated with the requested public
+  // key.
+  bytes solution = 1;
+}
+
+// BoundKeypairRotationRequest is sent by the server in response to a
+// BoundKeypairChallenge when a keypair rotation is required. It acts like an
+// additional challenge, the client is expected to respond with a
+// BoundKeypairRotationResponse.
+message BoundKeypairRotationRequest {
+  // The signature algorithm suite in use by the cluster.
+  string signature_algorithm_suite = 1;
+}
+
+// BoundKeypairRotationResponse is sent by the client in response to a
+// BoundKeypairRotationRequest from the server.
+// The server is expected to respond with an additional BoundKeypairChallenge
+// for the new key.
+message BoundKeypairRotationResponse {
+  // The public key to be registered with auth. Clients should expect a
+  // subsequent challenge against this public key to be sent. This is encoded in
+  // SSH authorized keys format.
+  bytes public_key = 1;
+}
+
+// BoundKeypairResult holds additional result parameters relevant to the bound
+// keypair join method.
+message BoundKeypairResult {
+  // A signed join state document to be provided on the next join attempt.
+  bytes join_state = 2;
+  // The public key registered with Auth at the end of the joining ceremony.
+  // After a successful keypair rotation, this should reflect the newly
+  // registered public key. This is encoded in SSH authorized keys format.
+  bytes public_key = 3;
+}
+
+// IAMInit is sent from the client in response to the ServerInit message for
+// the IAM join method.
+//
+// The IAM method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: IAMInit
+// 4. server->client: IAMChallenge
+// 5. client->server: IAMChallengeSolution
+// 6. server->client: Result
+message IAMInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+}
+
+// IAMChallenge is from the server in response to the IAMInit message from the client.
+// The client is expected to respond with a IAMChallengeSolution.
+message IAMChallenge {
+  // Challenge is a a crypto-random string that should be included by the
+  // client in the IAMChallengeSolution message.
+  string challenge = 1;
+}
+
+// IAMChallengeSolution must be sent from the client in response to the
+// IAMChallenge message.
+message IAMChallengeSolution {
+  // STSIdentityRequest is a signed sts:GetCallerIdentity API request used
+  // to prove the AWS identity of a joining node. It must include the
+  // challenge string as a signed header.
+  bytes sts_identity_request = 1;
+}
+
+// EC2Init is sent from the client in response to the ServerInit message for
+// the EC2 join method.
+//
+// The EC2 method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: EC2Init
+// 4. server->client: Result
+message EC2Init {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+  // Document is a signed EC2 Instance Identity Document used to prove the
+  // identity of a joining EC2 instance.
+  bytes document = 2;
+}
+
+// OracleInit is sent from the client in response to the ServerInit message for
+// the Oracle join method.
+//
+// The Oracle method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: OracleInit
+// 4. client<-server: OracleChallenge
+// 5. client->server: OracleChallengeSolution
+// 6. client<-server: Result
+message OracleInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+}
+
+// OracleChallenge is sent from the server in response to the OracleInit message from the client.
+// The client is expected to respond with a OracleChallengeSolution.
+message OracleChallenge {
+  // Challenge is a a crypto-random string that should be included by the
+  // client in the OracleChallengeSolution message.
+  string challenge = 1;
+}
+
+// OracleChallengeSolution must be sent from the client in response to the
+// OracleChallenge message.
+message OracleChallengeSolution {
+  // Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
+  bytes cert = 1;
+  // Intermediate encodes the intermediate CAs that issued the instance
+  // identity certificate, in PEM format.
+  bytes intermediate = 2;
+  // Signature is a signature over the challenge, signed by the private key
+  // matching the instance identity certificate.
+  bytes signature = 3;
+  // SignedRootCaReq is a signed request to the Oracle API for retreiving the
+  // root CAs that issued the instance identity certificate.
+  bytes signed_root_ca_req = 4;
+}
+
+// TPMInit is the message sent from the client in response to the ServerInit
+// message for the TPM join flow.
+// The server is expected to respond with a TPMEncryptedCredential message.
+//
+// The TPM method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: TPMInit
+// 4. client<-server: TPMEncryptedCredential
+// 5. client->server: TPMSolution
+// 6. client<-server: Result
+message TPMInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+  // The encoded TPMT_PUBLIC structure containing the attestation public key
+  // and signing parameters.
+  bytes public = 2;
+  // The properties of the attestation key, encoded as a TPMS_CREATION_DATA
+  // structure.
+  bytes create_data = 3;
+  // An assertion as to the details of the key, encoded as a TPMS_ATTEST
+  // structure.
+  bytes create_attestation = 4;
+  // A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
+  bytes create_signature = 5;
+  oneof ek {
+    // The device's endorsement certificate in X509, ASN.1 DER form. This
+    // certificate contains the public key of the endorsement key. This is
+    // preferred to ek_key.
+    bytes ek_cert = 6;
+    // The device's public endorsement key in PKIX, ASN.1 DER form. This is
+    // used when a TPM does not contain any endorsement certificates.
+    bytes ek_key = 7;
+  }
+}
+
+// TPMEncryptedCredential is the message sent from the server in response to the
+// TPMInit message.
+// The client is expected to respond with a TPMSolution message.
+message TPMEncryptedCredential {
+  // The `credential_blob` parameter to be used with the `ActivateCredential`
+  // command. This is used with the decrypted value of `secret` in a
+  // cryptographic process to decrypt the solution.
+  bytes credential_blob = 1;
+  // The `secret` parameter to be used with `ActivateCredential`. This is a
+  // seed which can be decrypted with the EK. The decrypted seed is then used
+  // when decrypting `credential_blob`.
+  bytes secret = 2;
+}
+
+// TPMSolution is the message sent from the client in response to the
+// TPMEncryptedCredential message. The server is expected to respond with a
+// Result message.
+message TPMSolution {
+  // The client's solution to TPMEncryptedCredential using ActivateCredential.
+  bytes solution = 1;
+}
+
+// AzureInit is sent from the client in response to the ServerInit message for
+// the Azure join method.
+//
+// The Azure method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: AzureInit
+// 4. client<-server: AzureChallenge
+// 5. client->server: AzureChallengeSolution
+// 6. client<-server: Result
+message AzureInit {
+  // ClientParams holds parameters for the specific type of client trying to join.
+  ClientParams client_params = 1;
+}
+
+// AzureChallenge is sent from the server in response to the AzureInit message from the client.
+// The client is expected to respond with a AzureChallengeSolution.
+message AzureChallenge {
+  // Challenge is a a crypto-random string that should be included by the
+  // client in the challenge response message.
+  string challenge = 1;
+}
+
+// AzureChallengeSolution must be sent from the client in response to the
+// AzureChallenge message.
+message AzureChallengeSolution {
+  // AttestedData is a signed JSON document from an Azure VM's attested data
+  // metadata endpoint used to prove the identity of a joining node. It must
+  // include the challenge string as the nonce.
+  bytes attested_data = 1;
+  // Intermediate encodes the intermediate CAs that issued the leaf certificate
+  // used to sign the attested data document, in x509 DER format.
+  bytes intermediate = 2;
+  // AccessToken is a JWT signed by Azure, used to prove the identity of a
+  // joining node.
+  string access_token = 3;
+}
+
+// ChallengeSolution holds a solution to a challenge issued by the server.
+message ChallengeSolution {
+  oneof payload {
+    BoundKeypairChallengeSolution bound_keypair_challenge_solution = 1;
+    BoundKeypairRotationResponse bound_keypair_rotation_response = 2;
+    IAMChallengeSolution iam_challenge_solution = 3;
+    OracleChallengeSolution oracle_challenge_solution = 4;
+    TPMSolution tpm_solution = 5;
+    AzureChallengeSolution azure_challenge_solution = 6;
+  }
+}
+
+// GivingUp should be sent by clients that fail to complete the join flow so
+// that the Auth service can log an informative error message.
+message GivingUp {
+  // Reason is the reason the client is giving up.
+  enum Reason {
+    // REASON_UNSPECIFIED is an unspecified reason.
+    REASON_UNSPECIFIED = 0;
+    // REASON_UNSUPPORTED_JOIN_METHOD means the client does not support the
+    // join method sent by the server.
+    REASON_UNSUPPORTED_JOIN_METHOD = 1;
+    // REASON_UNSUPPORTED_MESSAGE_TYPE means the client can not handle a
+    // message type sent by the server.
+    REASON_UNSUPPORTED_MESSAGE_TYPE = 2;
+    // REASON_CHALLENGE_SOLUTION_FAILED means the client failed to solve a
+    // challenge sent by the server.
+    REASON_CHALLENGE_SOLUTION_FAILED = 3;
+  }
+  // Reason is the reason the client is giving up.
+  Reason reason = 1;
+  // Msg is an error message related to the failure.
+  string msg = 2;
+}
+
+// JoinRequest is the message type sent from the joining client to the server.
+message JoinRequest {
+  oneof payload {
+    ClientInit client_init = 1;
+    TokenInit token_init = 2;
+    BoundKeypairInit bound_keypair_init = 3;
+    ChallengeSolution solution = 4;
+    IAMInit iam_init = 5;
+    GivingUp giving_up = 6;
+    EC2Init ec2_init = 7;
+    OIDCInit oidc_init = 8;
+    OracleInit oracle_init = 9;
+    TPMInit tpm_init = 10;
+    AzureInit azure_init = 11;
+  }
+}
+
+// ServerInit is the first message sent from the server in response to the
+// ClientInit message.
+message ServerInit {
+  // JoinMethod is the name of the selected join method.
+  string join_method = 1;
+  // SignatureAlgorithmSuite is the name of the signature algorithm suite
+  // currently configured for the cluster.
+  string signature_algorithm_suite = 2;
+}
+
+// Challenge is a challenge message sent from the server that the client must solve.
+message Challenge {
+  oneof payload {
+    BoundKeypairChallenge bound_keypair_challenge = 1;
+    BoundKeypairRotationRequest bound_keypair_rotation_request = 2;
+    IAMChallenge iam_challenge = 3;
+    OracleChallenge oracle_challenge = 4;
+    TPMEncryptedCredential tpm_encrypted_credential = 5;
+    AzureChallenge azure_challenge = 6;
+  }
+}
+
+// Result is the final message sent from the cluster back to the client, it
+// contains the result of the joining process including the assigned host ID
+// and issued certificates.
+message Result {
+  oneof payload {
+    HostResult host_result = 1;
+    BotResult bot_result = 2;
+  }
+}
+
+// Certificates holds issued certificates and cluster CAs.
+message Certificates {
+  // TlsCert is an X.509 certificate encoded in ASN.1 DER form.
+  bytes tls_cert = 1;
+  // TlsCaCerts is a list of TLS certificate authorities that the client should trust.
+  // Each certificate is encoding in ASN.1 DER form.
+  repeated bytes tls_ca_certs = 2;
+  // SshCert is an SSH certificate encoded in SSH wire format.
+  bytes ssh_cert = 3;
+  // SshCaKey is a list of SSH certificate authority public keys that the client should trust.
+  // Each CA key is encoded in SSH wire format.
+  repeated bytes ssh_ca_keys = 4;
+}
+
+// HostResult holds results for host joining.
+message HostResult {
+  // Certificates holds issued certificates and cluster CAs.
+  Certificates certificates = 1;
+  // HostId is the unique ID assigned to the host.
+  string host_id = 2;
+}
+
+// HostResult holds results for bot joining.
+message BotResult {
+  // Certificates holds issued certificates and cluster CAs.
+  Certificates certificates = 1;
+  // BoundKeypairResult holds extra result parameters relevant to the bound keypair join method.
+  optional BoundKeypairResult bound_keypair_result = 2;
+}
+
+// JoinResponse is the message type sent from the server to the joining client.
+message JoinResponse {
+  oneof payload {
+    // Init is the initial message sent from the server in response to the
+    // ClientInit message. It specifies the join method used by the provision token.
+    ServerInit init = 1;
+    // Challenge is a challenge issued by the server that the client must solve
+    // in order to complete the join flow. The challenge type depends on the join method.
+    // Each method may issue zero or more challenges that the client must solve.
+    Challenge challenge = 2;
+    // Result is the result of the join flow, it is the final message sent from
+    // the cluster when the join flow is successful.
+    // For the token join method, it is sent immediately in response to the ClientInit request.
+    Result result = 3;
+  }
+}
+
+// JoinService provides methods which allow Teleport nodes, proxies, and other
+// services to "join" the Teleport cluster by completing a supported join flow
+// in order to receive signed certificates issued by the cluster.
+//
+// It may be used in multiple cases:
+// * Teleport agents joining the cluster on their first start to receive their
+//   initial certificates. These requests do not use mTLS and the client
+//   authenticates itself using only the join flow and is assigned a new host
+//   ID.
+// * Teleport agents that need certificates authenticated for an additional
+//   system role allowed by a new provision token. These requests must be
+//   authenticated with mTLS using their existing certificates so that the
+//   existing host ID can be maintained.
+// * MachineID bots fetching their initial certificates.
+// * MachineID bots refreshing their certificates.
+//
+// It is implemented on both the Auth and Proxy servers to serve the needs of
+// * clients connecting to the proxy address for their initial join when they are
+//   unauthenticated and unable to directly dial the auth service.
+// * clients connecting to the auth address for their initial join.
+// * clients refreshing existing certificates that are able to make an
+//   authenticates dial to the auth service via proxy TLS routing.
+service JoinService {
+  // Join is a bidirectional streaming RPC that implements all join methods.
+  // The client does not need to know the join method ahead of time, all it
+  // needs is the token name.
+  //
+  // The client must send an ClientInit message on the JoinRequest stream to
+  // initiate the join flow.
+  //
+  // The server will reply with a ServerInit message, and subsequent messages
+  // on the stream will depend on the join method.
+  rpc Join(stream JoinRequest) returns (stream JoinResponse);
+}
diff --git a/api/proto/teleport/legacy/client/proto/authservice.proto b/api/proto/teleport/legacy/client/proto/authservice.proto
index 3b060ae25c50c..9f45e8b2be07e 100644
--- a/api/proto/teleport/legacy/client/proto/authservice.proto
+++ b/api/proto/teleport/legacy/client/proto/authservice.proto
@@ -23,6 +23,7 @@ import "teleport/attestation/v1/attestation.proto";
 import "teleport/legacy/client/proto/certs.proto";
 import "teleport/legacy/client/proto/event.proto";
 import "teleport/legacy/client/proto/inventory.proto";
+import "teleport/legacy/client/proto/requestable_roles.proto";
 import "teleport/legacy/types/events/events.proto";
 import "teleport/legacy/types/types.proto";
 import "teleport/legacy/types/webauthn/webauthn.proto";
@@ -242,6 +243,10 @@ message UserCertsRequest {
     // tunnel. Requests from this requester allows reuse of the MFA session
     // response but TTL is limited to single use TTL.
     TSH_DB_EXEC = 5;
+    // TSH_APP_AWS_CREDENTIALPROCESS is set when tsh provides access to an AWS App which uses client side credentials.
+    // When using per-session MFA, this ensures the TTL of the certificate (and thus the AWS session) is the same as the Teleport identity session.
+    // AWS credentials should not be written to disk when this requester is used, but may be exported as env variables through stdout.
+    TSH_APP_AWS_CREDENTIALPROCESS = 6;
   }
   // RequesterName identifies who sent the request.
   Requester RequesterName = 17 [(gogoproto.jsontag) = "requester_name"];
@@ -371,6 +376,24 @@ message ChangePasswordRequest {
   webauthn.CredentialAssertionResponse Webauthn = 5 [(gogoproto.jsontag) = "webauthn"];
 }
 
+message ListSemaphoresRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+  // filter encodes semaphore filtering params.
+  types.SemaphoreFilter filter = 3;
+}
+
+message ListSemaphoresResponse {
+  // a list of semaphores.
+  repeated types.SemaphoreV3 semaphores = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // PluginDataSeq is a sequence of plugin data.
 message PluginDataSeq {
   repeated types.PluginDataV3 PluginData = 1 [(gogoproto.jsontag) = "plugin_data"];
@@ -432,6 +455,24 @@ message CreateResetPasswordTokenRequest {
   ];
 }
 
+// ListResetPasswordTokenRequest is a request for a page of user tokens.
+message ListResetPasswordTokenRequest {
+  // PageSize is the maximum amount of resources to retrieve.
+  int32 page_size = 1;
+  // StartKey is used to start listing resources from a specific spot. It
+  // should be set to the previous NextKey value if using pagination, or
+  // left empty.
+  string page_token = 2;
+}
+
+// ListResetPasswordTokenResponse contains a page of user tokens.
+message ListResetPasswordTokenResponse {
+  // UserTokens is a list of user tokens.
+  repeated types.UserTokenV3 user_tokens = 1;
+  // NextKey is the key for the next page of user tokens.
+  string next_page_token = 2;
+}
+
 // RenewableCertsRequest is a request to generate a first set of renewable
 // certificates from a bot join token.
 message RenewableCertsRequest {
@@ -597,6 +638,8 @@ message Features {
   reserved "CloudAnonymizationKey";
   // AccessGraphDemoMode enables the ability to opt-in to a demo mode of Access Graph with limited features.
   bool AccessGraphDemoMode = 38 [(gogoproto.jsontag) = "access_graph_demo_mode,omitempty"];
+  // ClientIPRestrictions allows Cloud users to setup a client IP allowlist
+  bool ClientIPRestrictions = 39 [(gogoproto.jsontag) = "client_ip_restrictions,omitempty"];
 }
 
 // EntitlementInfo is the state and limits of a particular entitlement
@@ -976,6 +1019,24 @@ message GetWebTokensResponse {
   repeated types.WebTokenV3 Tokens = 1 [(gogoproto.jsontag) = "tokens"];
 }
 
+// ListWebTokensRequest contains all the requested web tokens.
+message ListWebTokensRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+// ListWebTokensResponse contains all the requested web tokens.
+message ListWebTokensResponse {
+  // Tokens is a list of web tokens.
+  repeated types.WebTokenV3 tokens = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // UpsertKubernetesServerRequest are the parameters used to add or update a
 // kubernetes server.
 message UpsertKubernetesServerRequest {
@@ -1089,7 +1150,14 @@ message DatabaseCertRequest {
   Extensions CertificateExtensions = 6 [(gogoproto.jsontag) = "certificate_extensions"];
 
   // CRLEndpoint is a certificate revocation list distribution point. Required for Windows smartcard certs.
-  string CRLEndpoint = 7 [(gogoproto.jsontag) = "crl_endpoint"];
+  // DEPRECATED: use CRLDomain instead.
+  string CRLEndpoint = 7 [
+    (gogoproto.jsontag) = "crl_endpoint",
+    deprecated = true
+  ];
+
+  // CRLDomain is the Active Directory domain where CRLs are published.
+  string CRLDomain = 8 [(gogoproto.jsontag) = "crl_domain"];
 }
 
 // DatabaseCertResponse contains the signed certificate.
@@ -1526,6 +1594,8 @@ message GetEventsRequest {
   // Order specifies an ascending or descending order of events.
   // A value of 0 means a descending order and a value of 1 means an ascending order.
   Order Order = 7;
+  // Search is an optional search term to filter events by (case-insensitive substring match).
+  string Search = 8;
 }
 
 message GetSessionEventsRequest {
@@ -1572,6 +1642,26 @@ message GetLocksResponse {
   repeated types.LockV2 Locks = 1;
 }
 
+// ListLocksRequest is a request for a page of locks.
+message ListLocksRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+  // Filter specifies lock specific filters.
+  types.LockFilter filter = 3;
+}
+
+// ListLocksResponse contains a page of registered applications.
+message ListLocksResponse {
+  // Locks is a list of locks.
+  repeated types.LockV2 locks = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 message GetLockRequest {
   // Name is the name of the lock to get.
   string Name = 1;
@@ -1589,6 +1679,40 @@ message ReplaceRemoteLocksRequest {
   repeated types.LockV2 Locks = 2;
 }
 
+// ListAppsRequest is a request for a page of registered applications.
+message ListAppsRequest {
+  // Limit is the maximum amount of resources to retrieve.
+  int32 limit = 1;
+  // StartKey is used to start listing resources from a specific spot. It
+  // should be set to the previous NextKey value if using pagination, or
+  // left empty.
+  string start_key = 2;
+}
+
+// ListAppsResponse contains a page of registered applications.
+message ListAppsResponse {
+  // Applictaions is a list of applications.
+  repeated types.AppV3 applications = 1;
+  // NextKey is the key for the next page of applications.
+  string next_key = 2;
+}
+
+message ListDatabasesRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+message ListDatabasesResponse {
+  // a list of databases.
+  repeated types.DatabaseV3 databases = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // GetWindowsDesktopServicesResponse contains all registered Windows desktop services.
 message GetWindowsDesktopServicesResponse {
   // Services is a list of Windows desktop services.
@@ -1613,6 +1737,35 @@ message DeleteWindowsDesktopServiceRequest {
   string Name = 1 [(gogoproto.jsontag) = "name"];
 }
 
+// ListWindowsDesktopsRequest is a request for a page of registered Windows desktop hosts.
+message ListWindowsDesktopsRequest {
+  // Limit is the maximum amount of resources to retrieve.
+  int32 limit = 1;
+  // StartKey is used to start listing resources from a specific spot. It
+  // should be set to the previous NextKey value if using pagination, or
+  // left empty.
+  string start_key = 2;
+  // Labels is a label-based matcher if non-empty.
+  map<string, string> labels = 3;
+  // PredicateExpression defines boolean conditions that will be matched against the resource.
+  string predicate_expression = 4;
+  // SearchKeywords is a list of search keywords to match against resource field values.
+  repeated string search_keywords = 5;
+  // WindowsDesktopFilter specifies windows desktop specific filters.
+  types.WindowsDesktopFilter windows_desktop_filter = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "windows_desktop_filter,omitempty"
+  ];
+}
+
+// ListWindowsDesktopsResponse contains a page of registered Windows desktop hosts.
+message ListWindowsDesktopsResponse {
+  // Desktops is a list of Windows desktop hosts.
+  repeated types.WindowsDesktopV3 desktops = 1;
+  // NextKey is the key for the next page of desktops.
+  string next_key = 2;
+}
+
 // GetWindowsDesktopsResponse contains all registered Windows desktop hosts.
 message GetWindowsDesktopsResponse {
   // Servers is a list of Windows desktop hosts.
@@ -1635,9 +1788,12 @@ message WindowsDesktopCertRequest {
   // CSR is the request to sign in PEM format.
   bytes CSR = 1;
   // CRLEndpoint is the address of the CRL for this certificate.
-  string CRLEndpoint = 2;
+  // DEPRECATED: use CRLDomain instead.
+  string CRLEndpoint = 2 [deprecated = true];
   // TTL is the certificate validity period.
   int64 TTL = 3 [(gogoproto.casttype) = "Duration"];
+  // CRLDomain is the Active Directory domain where CRLs are published.
+  string CRLDomain = 4;
 }
 
 // WindowsDesktopCertResponse contains the signed Windows RDP certificate.
@@ -2006,6 +2162,22 @@ message IdentityCenterAccountAssignment {
   IdentityCenterPermissionSet PermissionSet = 7;
 }
 
+message ListInstallersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+message ListInstallersResponse {
+  // Installers is a list of installer resources.
+  repeated types.InstallerV1 installers = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // PaginatedResource represents one of the supported resources.
 message PaginatedResource {
   // Resource is the resource itself.
@@ -2331,6 +2503,24 @@ message GetGithubAuthRequestRequest {
   string StateToken = 1 [(gogoproto.jsontag) = "state_token"];
 }
 
+message ListOIDCConnectorsRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+  // WithSecrets specifies whether to load associated secrets.
+  bool with_secrets = 3;
+}
+
+message ListOIDCConnectorsResponse {
+  // Connectors is a list of OIDC connectors.
+  repeated types.OIDCConnectorV3 connectors = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // CreateOIDCConnectorRequest is a request for CreateOIDCConnector.
 message CreateOIDCConnectorRequest {
   // Connector to be created.
@@ -2367,6 +2557,45 @@ message UpsertSAMLConnectorRequest {
   types.SAMLConnectorV2 Connector = 1 [(gogoproto.jsontag) = "connector"];
 }
 
+message ListSAMLConnectorsRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+  // WithSecrets specifies whether to load associated secrets.
+  bool with_secrets = 3;
+  // NoFollowURLs specifies whether to skip following URLs when
+  // validating SAML connector resources.
+  bool no_follow_urls = 4;
+}
+
+message ListSAMLConnectorsResponse {
+  // Connectors is a list of SAML connectors.
+  repeated types.SAMLConnectorV2 connectors = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
+message ListGithubConnectorsRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+  // WithSecrets specifies whether to load associated secrets.
+  bool with_secrets = 3;
+}
+
+message ListGithubConnectorsResponse {
+  // Connectors is a list of Github connectors.
+  repeated types.GithubConnectorV3 connectors = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // CreateGithubConnectorRequest is a request for CreateGithubConnector.
 message CreateGithubConnectorRequest {
   // Connector to be created.
@@ -2639,6 +2868,67 @@ message AccessRequestAllowedPromotionResponse {
   types.AccessRequestAllowedPromotions allowedPromotions = 1;
 }
 
+// ListProvisionTokensRequest is used to retrieve a paginated list of provision tokens.
+message ListProvisionTokensRequest {
+  // Limit is the maximum amount of items per page.
+  int32 Limit = 1;
+
+  // StartKey is used to resume a query in order to enable pagination.
+  // If the previous response had NextKey set then this should be
+  // set to its value. Otherwise leave empty.
+  string StartKey = 2;
+
+  // FilterRoles allows filtering for tokens with the provided roles. Tokens
+  // with ANY of the provided roles are returned.
+  repeated string FilterRoles = 3;
+
+  // FilterBotName allows filtering for tokens associated with the
+  // named bot. In addition, only items with a role of Bot are returned.
+  string FilterBotName = 4;
+}
+
+// ListProvisionTokensResponse is used to retrieve a paginated list of provision tokens.
+message ListProvisionTokensResponse {
+  // Tokens is the list of tokens.
+  repeated types.ProvisionTokenV2 Tokens = 1;
+
+  // NextKey is used to resume a query in order to enable pagination.
+  // Leave empty to start at the beginning.
+  string NextKey = 2;
+}
+
+message ListKubernetesClustersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+message ListKubernetesClustersResponse {
+  // KubernetesClusters is a list of kubernetes cluster resources.
+  repeated types.KubernetesClusterV3 kubernetes_clusters = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
+message ListSnowflakeSessionsRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+message ListSnowflakeSessionsResponse {
+  // Sessions is a list of Snowflake web sessions.
+  repeated types.WebSessionV2 sessions = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
 // AuthService is authentication/authorization service implementation
 service AuthService {
   // InventoryControlStream is the per-instance stream used to advertise teleport instance
@@ -2739,6 +3029,8 @@ service AuthService {
   rpc SubmitAccessReview(types.AccessReviewSubmission) returns (types.AccessRequestV3);
   // GetAccessCapabilities requests the access capabilities of a user.
   rpc GetAccessCapabilities(types.AccessCapabilitiesRequest) returns (types.AccessCapabilities);
+  // GetRemoteAccessCapabilities requests the access capabilities for a user from a remote cluster
+  rpc GetRemoteAccessCapabilities(types.RemoteAccessCapabilitiesRequest) returns (types.RemoteAccessCapabilities);
 
   // GetAccessRequestAllowedPromotions returns a list of allowed promotions from an access request to an access list.
   rpc GetAccessRequestAllowedPromotions(AccessRequestAllowedPromotionRequest) returns (AccessRequestAllowedPromotionResponse);
@@ -2760,6 +3052,9 @@ service AuthService {
   // Only local users may be reset.
   rpc CreateResetPasswordToken(CreateResetPasswordTokenRequest) returns (types.UserTokenV3);
 
+  // ListResetPasswordTokens returns a page of user tokens.
+  rpc ListResetPasswordTokens(ListResetPasswordTokenRequest) returns (ListResetPasswordTokenResponse);
+
   // GetUser gets a user resource by name.
   //
   // Deprecated: Use [teleport.users.v1.UsersService] instead.
@@ -2812,6 +3107,8 @@ service AuthService {
   rpc CancelSemaphoreLease(types.SemaphoreLease) returns (google.protobuf.Empty);
   // GetSemaphores returns a list of all semaphores matching the supplied filter.
   rpc GetSemaphores(types.SemaphoreFilter) returns (Semaphores);
+  // ListSemaphores returns a page of all semaphores matching the supplied filter.
+  rpc ListSemaphores(ListSemaphoresRequest) returns (ListSemaphoresResponse);
   // DeleteSemaphore deletes a semaphore matching the supplied filter.
   rpc DeleteSemaphore(types.SemaphoreFilter) returns (google.protobuf.Empty);
 
@@ -2851,6 +3148,9 @@ service AuthService {
   rpc GetSnowflakeSession(GetSnowflakeSessionRequest) returns (GetSnowflakeSessionResponse);
   // GetSnowflakeSessions gets all Snowflake web sessions.
   rpc GetSnowflakeSessions(google.protobuf.Empty) returns (GetSnowflakeSessionsResponse);
+  // ListSnowflakeSessions returns a page of Snowflake web sessions.
+  rpc ListSnowflakeSessions(ListSnowflakeSessionsRequest) returns (ListSnowflakeSessionsResponse);
+
   // DeleteSnowflakeSession removes a Snowflake web session.
   rpc DeleteSnowflakeSession(DeleteSnowflakeSessionRequest) returns (google.protobuf.Empty);
   // DeleteAllSnowflakeSessions removes all Snowflake web sessions.
@@ -2898,6 +3198,8 @@ service AuthService {
   rpc GetWebToken(types.GetWebTokenRequest) returns (GetWebTokenResponse);
   // GetWebTokens gets all web tokens.
   rpc GetWebTokens(google.protobuf.Empty) returns (GetWebTokensResponse);
+  // ListWebTokens returns a page of web tokens.
+  rpc ListWebTokens(ListWebTokensRequest) returns (ListWebTokensResponse);
   // DeleteWebToken deletes a web token.
   rpc DeleteWebToken(types.DeleteWebTokenRequest) returns (google.protobuf.Empty);
   // DeleteAllWebTokens deletes all web tokens.
@@ -2942,6 +3244,8 @@ service AuthService {
   rpc GetRole(GetRoleRequest) returns (types.RoleV6);
   // ListRoles is a paginated role getter.
   rpc ListRoles(ListRolesRequest) returns (ListRolesResponse);
+  // ListRequestableRoles is a paginated requestable role getter.
+  rpc ListRequestableRoles(ListRequestableRolesRequest) returns (ListRequestableRolesResponse);
   // CreateRole creates a new role.
   rpc CreateRole(CreateRoleRequest) returns (types.RoleV6);
   // UpdateRole updates an existing role.
@@ -3017,6 +3321,8 @@ service AuthService {
   rpc GetOIDCConnector(types.ResourceWithSecretsRequest) returns (types.OIDCConnectorV3);
   // GetOIDCConnectors gets all current OIDC connector resources.
   rpc GetOIDCConnectors(types.ResourcesWithSecretsRequest) returns (types.OIDCConnectorV3List);
+  // ListOIDCConnectors returns a page of current OIDC connector resources.
+  rpc ListOIDCConnectors(ListOIDCConnectorsRequest) returns (ListOIDCConnectorsResponse);
   // UpsertOIDCConnector creates a new OIDC connector in the backend.
   rpc CreateOIDCConnector(CreateOIDCConnectorRequest) returns (types.OIDCConnectorV3);
   // UpsertOIDCConnector updates an existing OIDC connector in the backend.
@@ -3040,6 +3346,8 @@ service AuthService {
   rpc GetSAMLConnector(types.ResourceWithSecretsRequest) returns (types.SAMLConnectorV2);
   // GetSAMLConnectors gets all current SAML connector resources.
   rpc GetSAMLConnectors(types.ResourcesWithSecretsRequest) returns (types.SAMLConnectorV2List);
+  // ListSAMLConnectors returns a page of current SAML connector resources.
+  rpc ListSAMLConnectors(ListSAMLConnectorsRequest) returns (ListSAMLConnectorsResponse);
   // CreateSAMLConnector creates a new SAML connector in the backend.
   rpc CreateSAMLConnector(CreateSAMLConnectorRequest) returns (types.SAMLConnectorV2);
   // UpdateSAMLConnector updates an existing SAML connector in the backend.
@@ -3063,6 +3371,8 @@ service AuthService {
   rpc GetGithubConnector(types.ResourceWithSecretsRequest) returns (types.GithubConnectorV3);
   // GetGithubConnectors gets all current Github connector resources.
   rpc GetGithubConnectors(types.ResourcesWithSecretsRequest) returns (types.GithubConnectorV3List);
+  // ListGithubConnectors returns a page of current Github connector resources.
+  rpc ListGithubConnectors(ListGithubConnectorsRequest) returns (ListGithubConnectorsResponse);
   // CreateGithubConnector creates a new Github connector in the backend.
   rpc CreateGithubConnector(CreateGithubConnectorRequest) returns (types.GithubConnectorV3);
   // UpdateGithubConnector updates an existing Github connector in the backend.
@@ -3112,7 +3422,15 @@ service AuthService {
   // GetToken retrieves a token described by the given request.
   rpc GetToken(types.ResourceRequest) returns (types.ProvisionTokenV2);
   // GetToken retrieves all tokens.
-  rpc GetTokens(google.protobuf.Empty) returns (types.ProvisionTokenV2List);
+  // Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+  // TODO(hugoShaka): DELETE IN 21.0.0
+  rpc GetTokens(google.protobuf.Empty) returns (types.ProvisionTokenV2List) {
+    option deprecated = true;
+  }
+  // GetStaticTokens retrieves all static tokens.
+  rpc GetStaticTokens(google.protobuf.Empty) returns (types.StaticTokensV2);
+  // ListToken retrieves a paginated list of filtered provision tokens.
+  rpc ListProvisionTokens(ListProvisionTokensRequest) returns (ListProvisionTokensResponse);
   // CreateTokenV2 creates a token in a backend.
   rpc CreateTokenV2(CreateTokenV2Request) returns (google.protobuf.Empty);
   // UpsertTokenV2 upserts a token in a backend.
@@ -3187,6 +3505,8 @@ service AuthService {
   rpc GetLock(GetLockRequest) returns (types.LockV2);
   // GetLocks gets all/in-force locks that match at least one of the targets when specified.
   rpc GetLocks(GetLocksRequest) returns (GetLocksResponse);
+  // ListLocks returns a page of locks matching a filter.
+  rpc ListLocks(ListLocksRequest) returns (ListLocksResponse);
   // UpsertLock upserts a lock.
   rpc UpsertLock(types.LockV2) returns (google.protobuf.Empty);
   // DeleteLock deletes a lock.
@@ -3206,6 +3526,8 @@ service AuthService {
 
   // GetApps returns all registered applications.
   rpc GetApps(google.protobuf.Empty) returns (types.AppV3List);
+  // ListApps returns a page of registered applications.
+  rpc ListApps(ListAppsRequest) returns (ListAppsResponse);
   // GetApp returns an application by name.
   rpc GetApp(types.ResourceRequest) returns (types.AppV3);
   // CreateApp creates a new application resource.
@@ -3219,6 +3541,8 @@ service AuthService {
 
   // GetDatabases returns all registered databases.
   rpc GetDatabases(google.protobuf.Empty) returns (types.DatabaseV3List);
+  // ListDatabases returns a page of registered databases.
+  rpc ListDatabases(ListDatabasesRequest) returns (ListDatabasesResponse);
   // GetDatabase returns a database by name.
   rpc GetDatabase(types.ResourceRequest) returns (types.DatabaseV3);
   // CreateDatabase creates a new database resource.
@@ -3232,6 +3556,8 @@ service AuthService {
 
   // GetKubernetesClusters returns all registered kubernetes clusters.
   rpc GetKubernetesClusters(google.protobuf.Empty) returns (types.KubernetesClusterV3List);
+  // ListKubernetesClusters returns a page of registered kubernetes clusters.
+  rpc ListKubernetesClusters(ListKubernetesClustersRequest) returns (ListKubernetesClustersResponse);
   // GetKubernetesCluster returns a kubernetes cluster by name.
   rpc GetKubernetesCluster(types.ResourceRequest) returns (types.KubernetesClusterV3);
   // CreateKubernetesCluster creates a new kubernetes cluster resource.
@@ -3256,6 +3582,8 @@ service AuthService {
 
   // GetWindowsDesktops returns all registered Windows desktop hosts matching the supplied filter.
   rpc GetWindowsDesktops(types.WindowsDesktopFilter) returns (GetWindowsDesktopsResponse);
+  // ListWindowsDesktops returns a page of registered Windows desktop hosts.
+  rpc ListWindowsDesktops(ListWindowsDesktopsRequest) returns (ListWindowsDesktopsResponse);
   // CreateWindowsDesktop registers a new Windows desktop host.
   rpc CreateWindowsDesktop(types.WindowsDesktopV3) returns (google.protobuf.Empty);
   // UpdateWindowsDesktop updates an existing Windows desktop host.
@@ -3359,6 +3687,8 @@ service AuthService {
   rpc GetInstaller(types.ResourceRequest) returns (types.InstallerV1);
   // GetInstallers retrieves all of installer script resources.
   rpc GetInstallers(google.protobuf.Empty) returns (types.InstallerV1List);
+  // ListInstallers returns a page of installer script resources.
+  rpc ListInstallers(ListInstallersRequest) returns (ListInstallersResponse);
 
   // SetInstaller sets the installer script resource
   rpc SetInstaller(types.InstallerV1) returns (google.protobuf.Empty);
diff --git a/api/proto/teleport/legacy/client/proto/event.proto b/api/proto/teleport/legacy/client/proto/event.proto
index fb74c89cbcdda..02a7ca21e6b90 100644
--- a/api/proto/teleport/legacy/client/proto/event.proto
+++ b/api/proto/teleport/legacy/client/proto/event.proto
@@ -30,7 +30,11 @@ import "teleport/legacy/types/types.proto";
 import "teleport/machineid/v1/bot_instance.proto";
 import "teleport/machineid/v1/federation.proto";
 import "teleport/notifications/v1/notifications.proto";
+import "teleport/presence/v1/relay_server.proto";
 import "teleport/provisioning/v1/provisioning.proto";
+import "teleport/recordingencryption/v1/recording_encryption.proto";
+import "teleport/scopes/access/v1/assignment.proto";
+import "teleport/scopes/access/v1/role.proto";
 import "teleport/secreports/v1/secreports.proto";
 import "teleport/userloginstate/v1/userloginstate.proto";
 import "teleport/userprovisioning/v2/statichostuser.proto";
@@ -219,5 +223,16 @@ message Event {
     teleport.healthcheckconfig.v1.HealthCheckConfig HealthCheckConfig = 78;
     // AutoUpdateAgentReport is a resource for counting agents connected to an auth instance.
     teleport.autoupdate.v1.AutoUpdateAgentReport AutoUpdateAgentReport = 79;
+    // ScopedRole is a role that descibes scoped privileges.
+    teleport.scopes.access.v1.ScopedRole ScopedRole = 80;
+    // ScopedRoleAssignment is an assignment of one or more scoped roles to a user.
+    teleport.scopes.access.v1.ScopedRoleAssignment ScopedRoleAssignment = 81;
+    teleport.presence.v1.RelayServer relay_server = 82;
+    // RecordingEncryption is a resource for controlling session recording encryption.
+    teleport.recordingencryption.v1.RecordingEncryption RecordingEncryption = 83;
+    // PluginV1 is a resource for Teleport plugins.
+    types.PluginV1 plugin = 84;
+    // AutoUpdateAgentReport is a resource for counting connected bot instances.
+    teleport.autoupdate.v1.AutoUpdateBotInstanceReport AutoUpdateBotInstanceReport = 85;
   }
 }
diff --git a/api/proto/teleport/legacy/client/proto/inventory.proto b/api/proto/teleport/legacy/client/proto/inventory.proto
index 74168690b2daf..f27dd9464da3a 100644
--- a/api/proto/teleport/legacy/client/proto/inventory.proto
+++ b/api/proto/teleport/legacy/client/proto/inventory.proto
@@ -20,6 +20,7 @@ package proto;
 
 import "google/protobuf/timestamp.proto";
 import "teleport/legacy/types/types.proto";
+import "teleport/presence/v1/relay_server.proto";
 
 option go_package = "github.com/gravitational/teleport/api/client/proto";
 
@@ -38,6 +39,9 @@ message UpstreamInventoryOneOf {
     UpstreamInventoryAgentMetadata AgentMetadata = 4;
     // UpstreamInventoryGoodbye advertises that the instance is terminating.
     UpstreamInventoryGoodbye Goodbye = 5;
+    // UpstreamInventoryStopHeartbeat informs the upstream service that a
+    // heartbeat is stopping.
+    UpstreamInventoryStopHeartbeat stop_heartbeat = 6;
   }
 }
 
@@ -95,6 +99,9 @@ message UpstreamInventoryHello {
   string ExternalUpgraderVersion = 6;
   // UpdaterInfo is used by Teleport to send information about how the Teleport updater is doing.
   types.UpdaterV2Info UpdaterInfo = 8;
+  // The advertized scope of the instance. An instance's scope can not change once assigned, so future
+  // heartbeats must include a scope value matching the one declared in the hello message.
+  string scope = 9;
 }
 
 // UpstreamInventoryAgentMetadata is the message sent up the inventory control stream containing
@@ -166,6 +173,10 @@ message DownstreamInventoryHello {
     bool KubernetesHeartbeats = 17;
     // KubernetesCleanup indicates the ICS supports deleting kubernetes clusters when UpstreamInventoryGoodbye.DeleteResources is set.
     bool KubernetesCleanup = 18;
+    // Indicates that the ICS supports heartbeating relay_server entries as well as deleting them on disconnect if UpstreamInventoryGoodbye.DeleteResources is set.
+    bool relay_server_heartbeats_cleanup = 19;
+    // DatabaseHeartbeatGracefulStop indicates the ICS supports stopping an individual database heartbeat.
+    bool database_heartbeat_graceful_stop = 20;
   }
 
   // SupportedCapabilities advertises the supported features of the auth server.
@@ -217,6 +228,8 @@ message InventoryHeartbeat {
   types.DatabaseServerV3 DatabaseServer = 3;
   // KubeServer is a complete kube server spec to be heartbeated.
   types.KubernetesServerV3 KubernetesServer = 4;
+  // A relay_server to be heartbeated.
+  teleport.presence.v1.RelayServer relay_server = 5;
 }
 
 // UpstreamInventoryGoodbye informs the upstream service that instance
@@ -255,3 +268,20 @@ message InventoryStatusSummary {
   // ServiceCounts aggregates the number of services.
   map<string, uint32> ServiceCounts = 5;
 }
+
+// UpstreamInventoryStopHeartbeat informs the upstream service that the
+// heartbeat is stopping.
+message UpstreamInventoryStopHeartbeat {
+  // Kind is the kind of heartbeat to stop.
+  StopHeartbeatKind kind = 1;
+  // Name is the name of the heatbeat to stop.
+  string name = 2;
+}
+
+// StopHeartbeatKind is the type of heartbeat to stop.
+enum StopHeartbeatKind {
+  STOP_HEARTBEAT_KIND_UNSPECIFIED = 0;
+
+  // STOP_HEARTBEAT_KIND_DATABASE_SERVER means stop a database server heartbeat.
+  STOP_HEARTBEAT_KIND_DATABASE_SERVER = 1;
+}
diff --git a/api/proto/teleport/legacy/client/proto/joinservice.proto b/api/proto/teleport/legacy/client/proto/joinservice.proto
index 145f67afdf0b5..2d7e2ac2f59d1 100644
--- a/api/proto/teleport/legacy/client/proto/joinservice.proto
+++ b/api/proto/teleport/legacy/client/proto/joinservice.proto
@@ -276,7 +276,8 @@ message RegisterUsingBoundKeypairCertificates {
 // RegisterUsingBoundKeypairRotationRequest is the response sent by the server
 // when a keypair rotation is required.
 message RegisterUsingBoundKeypairRotationRequest {
-  // This is a marker, no contents at this time.
+  // The signature algorithm suite in use by the cluster.
+  types.SignatureAlgorithmSuite signature_algorithm_suite = 1;
 }
 
 // RegisterUsingBoundKeypairMethodResponse is a response sent by the server
diff --git a/api/proto/teleport/legacy/client/proto/requestable_roles.proto b/api/proto/teleport/legacy/client/proto/requestable_roles.proto
new file mode 100644
index 0000000000000..f43c4bf8987f2
--- /dev/null
+++ b/api/proto/teleport/legacy/client/proto/requestable_roles.proto
@@ -0,0 +1,52 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+// buf:lint:ignore PACKAGE_DIRECTORY_MATCH
+// buf:lint:ignore PACKAGE_VERSION_SUFFIX
+package proto;
+
+option go_package = "github.com/gravitational/teleport/api/client/proto";
+
+// ListRequestableRolesRequest is the request message for AuthService.ListRequestableRoles
+message ListRequestableRolesRequest {
+  // page_size is the maximum number of requestable roles to return per page.
+  int32 page_size = 1;
+
+  // page_token is the next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+
+  // Filter is the type for the filtering options for the returned roles.
+  message Filter {
+    // a list of search keywords to match against resource field values, if specified
+    repeated string search_keywords = 1;
+  }
+  // filter is the filtering options for the returned roles.
+  Filter filter = 3;
+}
+
+// ListRequestableRolesResponse is the response message for AuthService.ListRequestableRoles
+message ListRequestableRolesResponse {
+  // RequestableRole is the type of a requestable role, containing only its name and description.
+  message RequestableRole {
+    string name = 1;
+    string description = 2;
+  }
+  // roles is the requestable roles.
+  repeated RequestableRole roles = 1;
+
+  // next_page_token is the next page token. If there are no more results, it will be empty.
+  string next_page_token = 2;
+}
diff --git a/api/proto/teleport/legacy/types/events/events.proto b/api/proto/teleport/legacy/types/events/events.proto
index 3e2c952973dbb..84d5dce9c0c05 100644
--- a/api/proto/teleport/legacy/types/events/events.proto
+++ b/api/proto/teleport/legacy/types/events/events.proto
@@ -77,6 +77,9 @@ enum UserKind {
 
   // Indicates the user associated with this event is a Machine ID bot user.
   USER_KIND_BOT = 2;
+
+  // Indicates that the user associated with this event is a system component e.g. Okta service.
+  USER_KIND_SYSTEM = 3;
 }
 
 // UserOrigin is the origin of a user account.
@@ -140,6 +143,22 @@ message UserMetadata {
 
   // UserOrigin specifies the origin of this user account.
   UserOrigin UserOrigin = 13 [(gogoproto.jsontag) = "user_origin,omitempty"];
+
+  // UserRoles specifies the roles user for the user to perform the action.
+  repeated string UserRoles = 14 [(gogoproto.jsontag) = "user_roles,omitempty"];
+
+  // UserTraits hold claim data used to populate a role at runtime
+  // for this session.
+  wrappers.LabelValues UserTraits = 15 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "user_traits,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+
+  // UserClusterName represents the Teleport Cluster name the user belongs to.
+  // For leaf clusters, this field represents the root cluster name.
+  // For root clusters, this field holds the cluster name.
+  string UserClusterName = 16 [(gogoproto.jsontag) = "user_cluster_name,omitempty"];
 }
 
 // Server is a server metadata
@@ -553,6 +572,8 @@ message DesktopClipboardReceive {
   string DesktopAddr = 5 [(gogoproto.jsontag) = "desktop_addr"];
   // Length is the number of bytes of data received from the remote clipboard.
   int32 Length = 6 [(gogoproto.jsontag) = "length"];
+  // DesktopName is the name of the desktop resource.
+  string DesktopName = 7 [(gogoproto.jsontag) = "desktop_name"];
 }
 
 // DesktopClipboardSend is emitted when clipboard data is
@@ -586,6 +607,8 @@ message DesktopClipboardSend {
   string DesktopAddr = 5 [(gogoproto.jsontag) = "desktop_addr"];
   // Length is the number of bytes of data sent.
   int32 Length = 6 [(gogoproto.jsontag) = "length"];
+  // DesktopName is the name of the desktop resource.
+  string DesktopName = 7 [(gogoproto.jsontag) = "desktop_name"];
 }
 
 // DesktopSharedDirectoryStart is emitted when Teleport
@@ -627,6 +650,8 @@ message DesktopSharedDirectoryStart {
   string DirectoryName = 7 [(gogoproto.jsontag) = "directory_name"];
   // DirectoryID is the ID of the directory being shared (unique to the Windows Desktop Session).
   uint32 DirectoryID = 8 [(gogoproto.jsontag) = "directory_id"];
+  // DesktopName is the name of the desktop resource.
+  string DesktopName = 9 [(gogoproto.jsontag) = "desktop_name"];
 }
 
 // DesktopSharedDirectoryRead is emitted when Teleport
@@ -675,6 +700,8 @@ message DesktopSharedDirectoryRead {
   uint32 Length = 10 [(gogoproto.jsontag) = "length"];
   // Offset is the offset the bytes were read from.
   uint64 Offset = 11 [(gogoproto.jsontag) = "offset"];
+  // DesktopName is the name of the desktop resource.
+  string DesktopName = 12 [(gogoproto.jsontag) = "desktop_name"];
 }
 
 // DesktopSharedDirectoryWrite is emitted when Teleport
@@ -723,6 +750,8 @@ message DesktopSharedDirectoryWrite {
   uint32 Length = 10 [(gogoproto.jsontag) = "length"];
   // Offset is the offset the bytes were written to.
   uint64 Offset = 11 [(gogoproto.jsontag) = "offset"];
+  // DesktopName is the name of the desktop resource.
+  string DesktopName = 12 [(gogoproto.jsontag) = "desktop_name"];
 }
 
 // SessionReject event happens when a user hits a session control restriction.
@@ -1802,6 +1831,7 @@ message Exec {
 }
 
 // SCP is emitted when data transfer has occurred between server and client
+// Deprecated: use SFTP
 message SCP {
   // Metadata is a common event metadata
   Metadata Metadata = 1 [
@@ -2128,6 +2158,13 @@ message AuthAttempt {
     (gogoproto.embed) = true,
     (gogoproto.jsontag) = ""
   ];
+
+  // ServerMetadata holds information about the target host server
+  ServerMetadata Server = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
 }
 
 // UserTokenCreate is emitted when a user token is created.
@@ -3567,6 +3604,18 @@ message PostgresFunctionCall {
   repeated string FunctionArgs = 6 [(gogoproto.jsontag) = "function_args,omitempty"];
 }
 
+// WindowsCertificateMetadata contains metadata about certificates
+// issued for Windows environments.
+message WindowsCertificateMetadata {
+  string Subject = 1 [(gogoproto.jsontag) = "subject"];
+  string SerialNumber = 2 [(gogoproto.jsontag) = "serial_number"];
+  string UPN = 3 [(gogoproto.jsontag) = "upn"];
+  repeated string CRLDistributionPoints = 4 [(gogoproto.jsontag) = "crl_distribution_points"];
+  int32 KeyUsage = 5 [(gogoproto.jsontag) = "key_usage"];
+  repeated int32 ExtendedKeyUsage = 6 [(gogoproto.jsontag) = "extended_key_usage"];
+  repeated string EnhancedKeyUsage = 7 [(gogoproto.jsontag) = "enhanced_key_usage"];
+}
+
 // WindowsDesktopSessionStart is emitted when a user connects to a desktop.
 message WindowsDesktopSessionStart {
   // Metadata is common event metadata.
@@ -3617,6 +3666,8 @@ message WindowsDesktopSessionStart {
   // NLA indicates whether Teleport performed Network Level Authentication (NLA)
   // when initiating this session.
   bool NLA = 13 [(gogoproto.jsontag) = "nla"];
+
+  WindowsCertificateMetadata CertMetadata = 14 [(gogoproto.jsontag) = "certificate"];
 }
 
 // DatabaseSessionEnd is emitted when a user ends the database session.
@@ -3659,6 +3710,16 @@ message DatabaseSessionEnd {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "session_stop,omitempty"
   ];
+
+  // ConnectionMetadata holds information about the connection.
+  ConnectionMetadata Connection = 7 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Participants is the list of participants in a session.
+  repeated string Participants = 8 [(gogoproto.jsontag) = "participants,omitempty"];
 }
 
 // MFADeviceMetadata is a common MFA device metadata.
@@ -3933,6 +3994,12 @@ message WindowsDesktopSessionEnd {
   bool Recorded = 12 [(gogoproto.jsontag) = "recorded"];
   // Participants is a list of participants in the session.
   repeated string Participants = 13 [(gogoproto.jsontag) = "participants"];
+  // Connection holds information about the connection.
+  ConnectionMetadata Connection = 14 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
 }
 
 // CertificateCreate is emitted when a certificate is issued.
@@ -3956,6 +4023,19 @@ message CertificateCreate {
     (gogoproto.embed) = true,
     (gogoproto.jsontag) = ""
   ];
+
+  // CertificateAuthority holds information about the issuer of the certificate.
+  CertificateAuthority CertificateAuthority = 5 [(gogoproto.jsontag) = "certificate_authority"];
+}
+
+// CertificateAuthority holds information about the issuer of the certificate.
+message CertificateAuthority {
+  // Type of the cert authority
+  string Type = 1 [(gogoproto.jsontag) = "type,omitempty"];
+  // Domain of the cert authority
+  string Domain = 2 [(gogoproto.jsontag) = "domain,omitempty"];
+  // SubjectKeyID is BASE32-encoded subject key ID from authority certificate
+  string SubjectKeyID = 3 [(gogoproto.jsontag) = "subject_key_id,omitempty"];
 }
 
 // RenewableCertificateGenerationMismatch is emitted when a renewable
@@ -4806,6 +4886,21 @@ message OneOf {
     events.AutoUpdateAgentRolloutTrigger AutoUpdateAgentRolloutTrigger = 213;
     events.AutoUpdateAgentRolloutForceDone AutoUpdateAgentRolloutForceDone = 214;
     events.AutoUpdateAgentRolloutRollback AutoUpdateAgentRolloutRollback = 215;
+    events.MCPSessionStart MCPSessionStart = 216;
+    events.MCPSessionEnd MCPSessionEnd = 217;
+    events.MCPSessionRequest MCPSessionRequest = 218;
+    events.MCPSessionNotification MCPSessionNotification = 219;
+    events.BoundKeypairRecovery BoundKeypairRecovery = 220;
+    events.BoundKeypairRotation BoundKeypairRotation = 221;
+    events.BoundKeypairJoinStateVerificationFailed BoundKeypairJoinStateVerificationFailed = 222;
+    events.MCPSessionListenSSEStream MCPSessionListenSSEStream = 223;
+    events.MCPSessionInvalidHTTPRequest MCPSessionInvalidHTTPRequest = 224;
+    events.SCIMListingEvent SCIMListingEvent = 225;
+    events.SCIMResourceEvent SCIMResourceEvent = 226;
+    events.ClientIPRestrictionsUpdate ClientIPRestrictionsUpdate = 227;
+    events.VnetConfigCreate VnetConfigCreate = 232;
+    events.VnetConfigUpdate VnetConfigUpdate = 233;
+    events.VnetConfigDelete VnetConfigDelete = 234;
   }
 }
 
@@ -4939,6 +5034,31 @@ message Identity {
   // BotInstanceID indicates the name of the Machine ID bot instance this
   // identity was issued to, if any.
   string BotInstanceID = 29 [(gogoproto.jsontag) = "bot_instance_id,omitempty"];
+  // JoinToken is the name of the join token used when a Machine ID bot joined,
+  // if any. It is not set for bots using the `token` join method.
+  string JoinToken = 30 [(gogoproto.jsontag) = "join_token,omitempty"];
+  // ScopePin pins a certificate to a specific scope and set of scoped roles.
+  ScopePin ScopePin = 31 [(gogoproto.jsontag) = "scope_pin,omitempty"];
+}
+
+// ScopePin is a marker that identifies a certificate/identity as being "pinned" to a target scope, and encodes relevant
+// information for access-control evaluation at that scope.
+message ScopePin {
+  // Scope is the target scope that this pin is associated with. This is the scope that the certificate/identity is
+  // pinned to. Any resources in parent/orthogonal scopes are not necessarily subject to the privileges/policies
+  // conveyed by this pin.
+  string Scope = 1 [(gogoproto.jsontag) = "scope"];
+
+  // Assignments encodes the scoped role assignments relevant to access-control decisions about the pinned identity. This may
+  // include assignments to parents of the pinned scope as well as assignments to equivalent/child scopes. Effectively, this
+  // means all assignments that are not orthogonal to the pinned scope.
+  map<string, ScopePinnedAssignments> Assignments = 2 [(gogoproto.jsontag) = "assignments"];
+}
+
+// ScopePinnedAssignments is a collection of scoped role assignments that are relevant to the pinned identity at the target scope.
+message ScopePinnedAssignments {
+  // Roles is a list of scoped roles that are assigned to the pinned identity at the target scope.
+  repeated string Roles = 1 [(gogoproto.jsontag) = "roles"];
 }
 
 // RouteToApp contains parameters for application access certificate requests.
@@ -6798,6 +6918,13 @@ message OktaUserSync {
   int32 num_users_total = 8 [(gogoproto.jsontag) = "num_users_total"];
 }
 
+// LabelSelector is a label selector that can be specified by the client to
+// filter the resources that are returned by the server.
+message LabelSelector {
+  string Key = 1 [(gogoproto.jsontag) = "key"];
+  repeated string Values = 2 [(gogoproto.jsontag) = "values"];
+}
+
 // SPIFFESVIDIssued is an event recorded when a SPIFFE SVID is issued.
 message SPIFFESVIDIssued {
   // Metadata is a common event metadata
@@ -6851,6 +6978,10 @@ message SPIFFESVIDIssued {
     (gogoproto.jsontag) = "attributes,omitempty",
     (gogoproto.casttype) = "Struct"
   ];
+  // The name selector specified by the client when requesting the SVID.
+  string NameSelector = 15 [(gogoproto.jsontag) = "name_selector,omitempty"];
+  // The label selectors specified by the client when requesting the SVID.
+  repeated LabelSelector LabelSelectors = 16 [(gogoproto.jsontag) = "label_selectors,omitempty"];
 }
 
 // AuthPreferenceUpdate is emitted when the auth preference is updated.
@@ -8515,3 +8646,656 @@ message SigstorePolicyDelete {
     (gogoproto.jsontag) = ""
   ];
 }
+
+// MCPSessionStart is emitted when a user starts a MCP session.
+message MCPSessionStart {
+  // Metadata is a common event metadata
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata User = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata Session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ServerMetadata is a common server metadata
+  ServerMetadata Server = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ConnectionMetadata holds information about the connection
+  ConnectionMetadata Connection = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata App = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // McpSessionId is the session ID tracked by remote MCP servers.
+  string mcp_session_id = 7;
+  // ClientInfo stores reported client agent information, e.g. "claude-ai/0.1.0".
+  string client_info = 8;
+  // ServerInfo stores reported MCP server information, e.g. "teleport-mcp-demo/18.3.0".
+  string server_info = 9;
+  // ProtocolVersion is the MCP protocol version like "2025-06-18".
+  string protocol_version = 10;
+  // IngressAuthType indicates how the MCP session is authorized between MCP client and Teleport.
+  string ingress_auth_type = 11;
+  // EgressAuthType indicates how the MCP session is authorized between Teleport and remote MCP server.
+  string egress_auth_type = 12;
+}
+
+// MCPSessionEnd is emitted when an MCP session ends.
+message MCPSessionEnd {
+  // Metadata is a common event metadata
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata User = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata Session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ServerMetadata is a common server metadata
+  ServerMetadata Server = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ConnectionMetadata holds information about the connection
+  ConnectionMetadata Connection = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata App = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains common command or operation status fields.
+  //
+  // The protocol spec states that the MCP server may refuse the clients from
+  // terminating the session.
+  // https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management
+  Status Status = 7 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Headers are the HTTP request headers.
+  wrappers.LabelValues headers = 8 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "headers,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+}
+
+// MCPJSONRPCMessage includes details of a MCP request or notification.
+// https://modelcontextprotocol.io/docs/concepts/transports#requests
+message MCPJSONRPCMessage {
+  // JSONRPC specifies the version of the protocol.
+  string JSONRPC = 1 [(gogoproto.jsontag) = "jsonrpc"];
+  // ID is the ID of a request. Notifications have no IDs.
+  string ID = 2 [(gogoproto.jsontag) = "id,omitempty"];
+  // Method is the method of this message.
+  string method = 3 [(gogoproto.jsontag) = "method"];
+  // Params is the optional parameters.
+  google.protobuf.Struct params = 5 [
+    (gogoproto.jsontag) = "params,omitempty",
+    (gogoproto.casttype) = "Struct"
+  ];
+}
+
+// MCPSessionRequest is emitted when a request is sent by client during a MCP session.
+message MCPSessionRequest {
+  // Metadata is a common event metadata
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata user = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata App = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains information whether the request is successful or not.
+  Status status = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Message contains details of the message.
+  MCPJSONRPCMessage message = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "message,omitempty"
+  ];
+  // Headers are the HTTP request headers.
+  wrappers.LabelValues headers = 7 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "headers,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+}
+
+// MCPSessionNotification is emitted when a notification is sent by client
+// during a MCP session.
+message MCPSessionNotification {
+  // Metadata is a common event metadata
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata user = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata App = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Message contains details of the message.
+  MCPJSONRPCMessage message = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "message,omitempty"
+  ];
+  // Status contains information whether the request is successful or not.
+  Status status = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Headers are the HTTP request headers.
+  wrappers.LabelValues headers = 7 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "headers,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+}
+
+// MCPSessionListenSSEStream is emitted when client sends a GET request to a
+// streamable HTTP MCP server for listening server notifications via a SSE
+// stream.
+message MCPSessionListenSSEStream {
+  // Metadata is a common event metadata
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata user = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata app = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains information whether the request is successful or not.
+  Status status = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Headers are the HTTP request headers.
+  wrappers.LabelValues headers = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "headers,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+}
+
+// MCPSessionInvalidHTTPRequest is a blanket event for all requests that we do
+// not understand (usually out of MCP spec).
+message MCPSessionInvalidHTTPRequest {
+  // Metadata is a common event metadata
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // User is a common user event metadata
+  UserMetadata user = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // SessionMetadata is a common event session metadata
+  SessionMetadata session = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // App is a common application resource metadata.
+  AppMetadata app = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Path is relative path in the URL.
+  string path = 5 [(gogoproto.jsontag) = "path"];
+  // Method is the request HTTP method, like GET/POST/DELETE/etc.
+  string method = 6 [(gogoproto.jsontag) = "method"];
+  // RawQuery are the encoded query values.
+  string raw_query = 7 [(gogoproto.jsontag) = "raw_query"];
+  // Body is the request HTTP body.
+  bytes body = 8 [(gogoproto.jsontag) = "body"];
+  // Headers are the HTTP request headers.
+  wrappers.LabelValues headers = 9 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "headers,omitempty",
+    (gogoproto.customtype) = "github.com/gravitational/teleport/api/types/wrappers.Traits"
+  ];
+}
+
+// BoundKeypairRecovery is emitted when a client performs a self recovery using
+// a bound_keypair joining token. This event is also emitted upon first join.
+message BoundKeypairRecovery {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains common command or operation status fields.
+  Status Status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ConnectionMetadata holds information about the connection
+  ConnectionMetadata Connection = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // TokenName is the name of the provision token used to join.
+  string TokenName = 4 [(gogoproto.jsontag) = "token_name"];
+  // BotName is the name of the bot attempting to join, if any.
+  string BotName = 5 [(gogoproto.jsontag) = "bot_name,omitempty"];
+  // PublicKey is the public key at the completion of the joining process, in
+  // SSH authorized_keys format. If a keypair rotation occurred, this is the
+  // keypair trusted at the end of the join process.
+  string PublicKey = 6 [(gogoproto.jsontag) = "public_key,omitempty"];
+  // RecoveryCount is the recovery counter value at the time of this recovery.
+  uint32 RecoveryCount = 7 [(gogoproto.jsontag) = "recovery_count"];
+  // RecoveryMode is the bound keypair token's configured recovery mode.
+  string RecoveryMode = 8 [(gogoproto.jsontag) = "recovery_mode"];
+}
+
+// BoundKeypairRotation is emitted when a keypair rotation takes place.
+message BoundKeypairRotation {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains common command or operation status fields.
+  Status Status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ConnectionMetadata holds information about the connection
+  ConnectionMetadata Connection = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // TokenName is the name of the provision token used to join.
+  string TokenName = 4 [(gogoproto.jsontag) = "token_name"];
+  // BotName is the name of the bot attempting to join, if any.
+  string BotName = 5 [(gogoproto.jsontag) = "bot_name,omitempty"];
+  // PreviousPublicKey is the previous public key in SSH authorized_keys format.
+  // On first join using a registration secret, this value will be empty.
+  string PreviousPublicKey = 6 [(gogoproto.jsontag) = "previous_public_key,omitempty"];
+  // NewPublicKey is the new public key after rotation. If rotation fails, this
+  // value will be empty.
+  string NewPublicKey = 7 [(gogoproto.jsontag) = "new_public_key,omitempty"];
+}
+
+// BoundKeypairJoinStateVerificationFailed is emitted when join state
+// verification fails, potentially indicating a compromised keypair.
+message BoundKeypairJoinStateVerificationFailed {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // Status contains information about the failure.
+  Status Status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // ConnectionMetadata holds information about the connection
+  ConnectionMetadata Connection = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+  // TokenName is the name of the provision token used to join.
+  string TokenName = 4 [(gogoproto.jsontag) = "token_name"];
+  // BotName is the name of the bot attempting to join, if any.
+  string BotName = 5 [(gogoproto.jsontag) = "bot_name,omitempty"];
+}
+
+// SCIMRequest describes the SCIM http request that triggered an event
+message SCIMRequest {
+  // ID is a Teleport-generated arbitrary unique ID for the SCIM request that
+  // triggered the enclosing event. It will be included in all structured log
+  // messages involved in the handling of this request.
+  string ID = 1 [(gogoproto.jsontag) = "id,omitempty"];
+
+  // SourceAddress is the source IP address for the SCIM HTTP request that
+  // triggered the enclosing  event.
+  string SourceAddress = 2 [(gogoproto.jsontag) = "source_address,omitempty"];
+
+  // UserAgent is the user agent string from the HTTP request that triggered
+  // the enclosing event
+  string UserAgent = 3 [(gogoproto.jsontag) = "user_agent,omitempty"];
+
+  // Method is the HTTP method used by the SCIM HTTP request that triggered the
+  // enclosing event (e.g. GET, PUT, etc)
+  string Method = 4 [(gogoproto.jsontag) = "method,omitempty"];
+
+  // Path is the fully-qualified path of the SCIM request that triggered the
+  // enclosing event.
+  string Path = 5 [(gogoproto.jsontag) = "path,omitempty"];
+
+  // Body holds a representation of the arbitrary JSON body of the initial
+  // request. May be empty for list operations, hold a SCIM resource
+  // definition for creation and update operations, or a SCIM PATCH description
+  // for patch update requests.
+  google.protobuf.Struct Body = 6 [
+    (gogoproto.jsontag) = "body,omitempty",
+    (gogoproto.casttype) = "Struct"
+  ];
+}
+
+message SCIMCommonData {
+  // Request holds metadata about the original SCIM request that triggered this
+  // event.
+  SCIMRequest Request = 3 [(gogoproto.jsontag) = "request,omitempty"];
+
+  // Integration is the name of the integration/access plugin that the SCIM
+  // service was operating on for this event.
+  string Integration = 4 [(gogoproto.jsontag) = "integration,omitempty"];
+
+  // ResourceType is the SCIM resource type of the Teleport resource involved in
+  // this event. Valid values include, but are not limited to, "user" and
+  // "group".
+  string ResourceType = 5 [(gogoproto.jsontag) = "resource_type,omitempty"];
+}
+
+// SCIMListingEvent records an attempt to list SCIM resources
+message SCIMListingEvent {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status contains common command or operation status fields.
+  Status Status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Common holds values common to SCIM listing and resource events
+  SCIMCommonData Common = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Filter is the listing filter function supplied by the client, if any.
+  string Filter = 4 [(gogoproto.jsontag) = "filter,omitempty"];
+
+  // Count is the requested page size from the client. A zero value indicates that
+  // the client did not request a specific page size.
+  int32 Count = 5 [(gogoproto.jsontag) = "count,omitempty"];
+
+  // Start is the 1-based start index requested by the client, if any. A zero
+  // value indicates that the client did not request a specific starting index
+  // for the page.
+  int32 StartIndex = 6 [(gogoproto.jsontag) = "start_index,omitempty"];
+
+  // ResourceCount is the number of resources returned in response to this
+  // request.
+  uint32 ResourceCount = 7 [(gogoproto.jsontag) = "resource_count,omitempty"];
+}
+
+// SCIMResourceEvent records an attmpted operation on a specific SCIM resource
+message SCIMResourceEvent {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status contains common command or operation status fields.
+  Status Status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Common holds values common to SCIM listing and resource events
+  SCIMCommonData Common = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // TeleportID is the name of the Teleport resource involved in this event.
+  string TeleportID = 4 [(gogoproto.jsontag) = "teleport_id,omitempty"];
+
+  // ExternalID is the ID used by the external SCIM client to to refer to the
+  // resource affected by this event.
+  string ExternalID = 5 [(gogoproto.jsontag) = "external_id,omitempty"];
+
+  // Display is a human-readable name or identifier for the Teleport resource
+  // affected by the event.
+  string Display = 6 [(gogoproto.jsontag) = "display,omitempty"];
+}
+
+// ClientIPRestrictionsUpdate records a Client IP Restrictions update.
+message ClientIPRestrictionsUpdate {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // UserMetadata is a common user event metadata.
+  UserMetadata User = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // ConnectionMetadata holds information about the connection.
+  ConnectionMetadata Connection = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // ResourceMetadata is a common resource event metadata.
+  ResourceMetadata Resource = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status indicates whether the operation was successful.
+  Status Status = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // ClientIPRestrictions is the new Client IP Restrictions allowlist.
+  repeated string ClientIPRestrictions = 6 [(gogoproto.jsontag) = "client_ip_restrictions"];
+}
+
+// VnetConfigCreate is emitted when a VnetConfig is created.
+message VnetConfigCreate {
+  // Metadata is a common event metadata.
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status indicates whether the creation was successful.
+  Status status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // User is a common user event metadata.
+  UserMetadata user = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Connection holds information about the connection.
+  ConnectionMetadata connection = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+}
+
+// VnetConfigUpdate is emitted when a VnetConfig is updated.
+message VnetConfigUpdate {
+  // Metadata is a common event metadata.
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status indicates whether the update was successful.
+  Status status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // User is a common user event metadata.
+  UserMetadata user = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Connection holds information about the connection.
+  ConnectionMetadata connection = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+}
+
+// VnetConfigDelete is emitted when a VnetConfig is deleted.
+message VnetConfigDelete {
+  // Metadata is a common event metadata.
+  Metadata metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status indicates whether the deletion was successful.
+  Status status = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // User is a common user event metadata.
+  UserMetadata user = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Connection holds information about the connection.
+  ConnectionMetadata connection = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+}
diff --git a/api/proto/teleport/legacy/types/types.proto b/api/proto/teleport/legacy/types/types.proto
index 7d9653d9f07ef..869cdce35ad3f 100644
--- a/api/proto/teleport/legacy/types/types.proto
+++ b/api/proto/teleport/legacy/types/types.proto
@@ -21,6 +21,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/timestamp.proto";
 import "google/protobuf/wrappers.proto";
 import "teleport/attestation/v1/attestation.proto";
+import "teleport/componentfeatures/v1/component_features.proto";
 import "teleport/legacy/types/trusted_device_requirement.proto";
 import "teleport/legacy/types/wrappers/wrappers.proto";
 
@@ -208,6 +209,8 @@ message DatabaseServerV3 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "status"
   ];
+  // The advertized scope of the server which can not change once assigned.
+  string scope = 7;
 }
 
 // DatabaseServerSpecV3 is the database server spec.
@@ -242,6 +245,11 @@ message DatabaseServerSpecV3 {
   DatabaseV3 Database = 12 [(gogoproto.jsontag) = "database,omitempty"];
   // ProxyIDs is a list of proxy IDs this server is expected to be connected to.
   repeated string ProxyIDs = 13 [(gogoproto.jsontag) = "proxy_ids,omitempty"];
+
+  // the name of the Relay group that the server is connected to
+  string relay_group = 14;
+  // the list of Relay host IDs that the server is connected to
+  repeated string relay_ids = 15;
 }
 
 // DatabaseServerStatusV3 is the database server status.
@@ -362,11 +370,17 @@ message DatabaseAdminUser {
   string DefaultDatabase = 2 [(gogoproto.jsontag) = "default_database"];
 }
 
-// OracleOptions contains information about privileged database user used
-// for database audit.
+// OracleOptions contains Oracle-specific configuration options.
 message OracleOptions {
-  // AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
-  string AuditUser = 1 [(gogoproto.jsontag) = "audit_user"];
+  // AuditUser is the name of the Oracle database user that should be used to access
+  // the internal audit trail.
+  string AuditUser = 1 [(gogoproto.jsontag) = "audit_user,omitempty"];
+  // RetryCount is the maximum number of times to retry connecting to a
+  // host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.
+  int32 RetryCount = 2 [(gogoproto.jsontag) = "retry_count,omitempty"];
+  // ShuffleHostnames, when true, randomizes the order of hosts to connect to from
+  // the provided list.
+  bool ShuffleHostnames = 3 [(gogoproto.jsontag) = "shuffle_hostnames,omitempty"];
 }
 
 // DatabaseStatusV3 contains runtime information about the database.
@@ -437,7 +451,7 @@ message AWS {
   ];
   // AccountID is the AWS account ID this database belongs to.
   string AccountID = 4 [(gogoproto.jsontag) = "account_id,omitempty"];
-  // ElastiCache contains AWS ElastiCache Redis specific metadata.
+  // ElastiCache contains Amazon ElastiCache Redis-specific metadata.
   ElastiCache ElastiCache = 5 [
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "elasticache,omitempty"
@@ -457,7 +471,7 @@ message AWS {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "rdsproxy,omitempty"
   ];
-  // RedshiftServerless contains AWS Redshift Serverless specific metadata.
+  // RedshiftServerless contains Amazon Redshift Serverless-specific metadata.
   RedshiftServerless RedshiftServerless = 9 [
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "redshift_serverless,omitempty"
@@ -483,11 +497,17 @@ message AWS {
   // SessionTags is a list of AWS STS session tags.
   map<string, string> SessionTags = 15 [(gogoproto.jsontag) = "session_tags,omitempty"];
 
-  // DocumentDB contains AWS DocumentDB specific metadata.
+  // DocumentDB contains Amazon DocumentDB-specific metadata.
   DocumentDB DocumentDB = 16 [
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "docdb,omitempty"
   ];
+
+  // ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.
+  ElastiCacheServerless ElastiCacheServerless = 17 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "elasticache_serverless,omitempty"
+  ];
 }
 
 // SecretStore contains secret store configurations.
@@ -532,7 +552,7 @@ message RDSProxy {
   string ResourceID = 3 [(gogoproto.jsontag) = "resource_id,omitempty"];
 }
 
-// ElastiCache contains AWS ElastiCache Redis specific metadata.
+// ElastiCache contains Amazon ElastiCache Redis-specific metadata.
 message ElastiCache {
   // ReplicationGroupID is the Redis replication group ID.
   string ReplicationGroupID = 1 [(gogoproto.jsontag) = "replication_group_id,omitempty"];
@@ -544,6 +564,12 @@ message ElastiCache {
   string EndpointType = 4 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
 }
 
+// ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.
+message ElastiCacheServerless {
+  // CacheName is an ElastiCache Serverless cache name.
+  string CacheName = 1 [(gogoproto.jsontag) = "cache_name,omitempty"];
+}
+
 // MemoryDB contains AWS MemoryDB specific metadata.
 message MemoryDB {
   // ClusterName is the name of the MemoryDB cluster.
@@ -556,7 +582,7 @@ message MemoryDB {
   string EndpointType = 4 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
 }
 
-// RedshiftServerless contains AWS Redshift Serverless specific metadata.
+// RedshiftServerless contains Amazon Redshift Serverless-specific metadata.
 message RedshiftServerless {
   // WorkgroupName is the workgroup name.
   string WorkgroupName = 1 [(gogoproto.jsontag) = "workgroup_name,omitempty"];
@@ -576,7 +602,7 @@ message OpenSearch {
   string EndpointType = 3 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
 }
 
-// DocumentDB contains AWS DocumentDB specific metadata.
+// DocumentDB contains Amazon DocumentDB-specific metadata.
 message DocumentDB {
   // ClusterID is the cluster identifier.
   string ClusterID = 1 [(gogoproto.jsontag) = "cluster_id,omitempty"];
@@ -586,12 +612,26 @@ message DocumentDB {
   string EndpointType = 3 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
 }
 
-// GCPCloudSQL contains parameters specific to GCP Cloud SQL databases.
+// GCPCloudSQL contains parameters specific to GCP databases.
+// The name "GCPCloudSQL" is a legacy from a time when only GCP Cloud SQL was supported.
 message GCPCloudSQL {
   // ProjectID is the GCP project ID the Cloud SQL instance resides in.
   string ProjectID = 1 [(gogoproto.jsontag) = "project_id,omitempty"];
   // InstanceID is the Cloud SQL instance ID.
   string InstanceID = 2 [(gogoproto.jsontag) = "instance_id,omitempty"];
+  // AlloyDB contains AlloyDB specific configuration elements.
+  AlloyDB AlloyDB = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "alloydb,omitempty"
+  ];
+}
+
+// AlloyDB contains AlloyDB specific configuration elements.
+message AlloyDB {
+  // EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".
+  string EndpointType = 1 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
+  // EndpointOverride is an override of endpoint address to use.
+  string EndpointOverride = 2 [(gogoproto.jsontag) = "endpoint_override,omitempty"];
 }
 
 // Azure contains Azure specific database metadata.
@@ -886,6 +926,8 @@ message ServerV2 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "spec"
   ];
+  // The advertized scope of the server which can not change once assigned.
+  string scope = 6;
 }
 
 // ServerSpecV2 is a specification for V2 Server
@@ -926,6 +968,14 @@ message ServerSpecV2 {
   // GitHub organization.
   GitHubServerMetadata git_hub = 15 [(gogoproto.jsontag) = "github,omitempty"];
 
+  // the name of the Relay group that the server is connected to
+  string relay_group = 16;
+  // the list of Relay host IDs that the server is connected to
+  repeated string relay_ids = 17;
+
+  // component_features represents features supported by this server
+  teleport.componentfeatures.v1.ComponentFeatures component_features = 18;
+
   reserved 8;
   reserved 10;
   reserved "KubernetesClusters";
@@ -988,6 +1038,8 @@ message AppServerV3 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "spec"
   ];
+  // The advertized scope of the server which can not change once assigned.
+  string scope = 6;
 }
 
 // AppServerSpecV3 is the app access server spec.
@@ -1007,6 +1059,14 @@ message AppServerSpecV3 {
   AppV3 App = 5 [(gogoproto.jsontag) = "app"];
   // ProxyIDs is a list of proxy IDs this server is expected to be connected to.
   repeated string ProxyIDs = 6 [(gogoproto.jsontag) = "proxy_ids,omitempty"];
+
+  // the name of the Relay group that the server is connected to
+  string relay_group = 7;
+  // the list of Relay host IDs that the server is connected to
+  repeated string relay_ids = 8;
+
+  // component_features contains features supported by this app server.
+  teleport.componentfeatures.v1.ComponentFeatures component_features = 9;
 }
 
 // AppV3List represents a list of app resources.
@@ -1122,6 +1182,19 @@ message AppSpecV3 {
   // want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec,
   // setting this value to true will overwrite that public address in the web UI.
   bool UseAnyProxyPublicAddr = 14 [(gogoproto.jsontag) = "use_any_proxy_public_addr,omitempty"];
+  // MCP contains MCP server related configurations.
+  MCP MCP = 15 [(gogoproto.jsontag) = "mcp,omitempty"];
+}
+
+// MCP contains MCP server-related configurations.
+message MCP {
+  // Command to launch stdio-based MCP servers.
+  string command = 1;
+  // Args to execute with the command.
+  repeated string args = 2;
+  // RunAsHostUser is the host user account under which the command will be
+  // executed. Required for stdio-based MCP servers.
+  string run_as_host_user = 3;
 }
 
 // Rewrite is a list of rewriting rules to apply to requests and responses.
@@ -1208,6 +1281,8 @@ enum PrivateKeyType {
 
 // SSHKeyPair is an SSH CA key pair.
 message SSHKeyPair {
+  option (gogoproto.equal) = true;
+
   // PublicKey is the SSH public key.
   bytes PublicKey = 1 [(gogoproto.jsontag) = "public_key,omitempty"];
   // PrivateKey is the SSH private key.
@@ -1224,6 +1299,8 @@ message TLSKeyPair {
   bytes Key = 2 [(gogoproto.jsontag) = "key,omitempty"];
   // KeyType is the type of the Key.
   PrivateKeyType KeyType = 3 [(gogoproto.jsontag) = "key_type,omitempty"];
+  // CRL is an empty DER-encoded revocation list.
+  bytes CRL = 4 [(gogoproto.jsontag) = "crl"];
 }
 
 // JWTKeyPair is a PEM encoded keypair used for signing JWT tokens.
@@ -1236,6 +1313,25 @@ message JWTKeyPair {
   PrivateKeyType PrivateKeyType = 3 [(gogoproto.jsontag) = "private_key_type,omitempty"];
 }
 
+// EncryptionKeyPair is a PKIX ASN.1 DER encoded keypair used for encrypting and decrypting data.
+message EncryptionKeyPair {
+  // PublicKey is a PKIX ASN.1 DER encoded public key.
+  bytes public_key = 1 [(gogoproto.jsontag) = "public_key,omitempty"];
+  // PrivateKey is a PKCS#8 ASN.1 DER encoded private key.
+  bytes private_key = 2 [(gogoproto.jsontag) = "private_key,omitempty"];
+  // PrivateKeyType is the type of the PrivateKey.
+  PrivateKeyType private_key_type = 3 [(gogoproto.jsontag) = "private_key_type,omitempty"];
+  // Hash function used during OAEP encryption/decryption. It maps directly to the possible
+  // values of [crypto.Hash] in the go crypto package.
+  uint32 hash = 4 [(gogoproto.jsontag) = "hash,omitempty"];
+}
+
+// A public key to be used as a recipient during age encryption of session recordings.
+message AgeEncryptionKey {
+  // A PKIX ASN.1 DER encoded public key used for key wrapping during age encryption. Expected to be RSA 4096.
+  bytes public_key = 1 [(gogoproto.jsontag) = "public_key"];
+}
+
 // CertAuthorityV2 is version 2 resource spec for Cert Authority
 message CertAuthorityV2 {
   option (gogoproto.goproto_stringer) = false;
@@ -1472,6 +1568,8 @@ message ProvisionTokenSpecV2 {
   ProvisionTokenSpecV2BoundKeypair BoundKeypair = 19 [(gogoproto.jsontag) = "bound_keypair,omitempty"];
   // AzureDevops allows the configuration of options specific to the "azure_devops" join method.
   ProvisionTokenSpecV2AzureDevops AzureDevops = 20 [(gogoproto.jsontag) = "azure_devops,omitempty"];
+  // Env0 allows the configuration of options specific to the "env0" join method.
+  ProvisionTokenSpecV2Env0 Env0 = 21 [(gogoproto.jsontag) = "env0,omitempty"];
 }
 
 // ProvisionTokenSpecV2AzureDevops contains the Azure Devops-specific
@@ -1726,9 +1824,17 @@ message ProvisionTokenSpecV2Spacelift {
   message Rule {
     // SpaceID is the ID of the space in which the run that owns the token was
     // executed.
+    //
+    // This field supports "glob-style" matching when enable_glob_matching is true:
+    // - Use '*' to match zero or more characters.
+    // - Use '?' to match any single character.
     string SpaceID = 1 [(gogoproto.jsontag) = "space_id,omitempty"];
     // CallerID is the ID of the caller, ie. the stack or module that generated
     // the run.
+    //
+    // This field supports "glob-style" matching when enable_glob_matching is true:
+    // - Use '*' to match zero or more characters.
+    // - Use '?' to match any single character.
     string CallerID = 2 [(gogoproto.jsontag) = "caller_id,omitempty"];
     // CallerType is the type of the caller, ie. the entity that owns the run -
     // either `stack` or `module`.
@@ -1743,6 +1849,9 @@ message ProvisionTokenSpecV2Spacelift {
   // Hostname is the hostname of the Spacelift tenant that tokens
   // will originate from. E.g `example.app.spacelift.io`
   string Hostname = 2 [(gogoproto.jsontag) = "hostname,omitempty"];
+  // EnableGlobMatching enables glob-style matching for the space_id and
+  // caller_id fields in the rules.
+  bool EnableGlobMatching = 3 [(gogoproto.jsontag) = "enable_glob_matching,omitempty"];
 }
 
 // ProvisionTokenSpecV2Kubernetes contains the Kubernetes-specific part of the
@@ -1754,6 +1863,18 @@ message ProvisionTokenSpecV2Kubernetes {
     // This can be fetched from /openid/v1/jwks on the Kubernetes API Server.
     string JWKS = 1 [(gogoproto.jsontag) = "jwks,omitempty"];
   }
+  message OIDCConfig {
+    // Issuer is the URI of the OIDC issuer. It must have an accessible and
+    // OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should
+    // be a valid URL and must exactly match the `issuer` field in a service
+    // account JWT. For example:
+    // https://oidc.eks.us-west-2.amazonaws.com/id/12345...
+    string Issuer = 1 [(gogoproto.jsontag) = "issuer,omitempty"];
+
+    // InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement
+    // that the issuer must use HTTPS.
+    bool InsecureAllowHTTPIssuer = 2 [(gogoproto.jsontag) = "insecure_allow_http_issuer"];
+  }
   // Rule is a set of properties the Kubernetes-issued token might have to be
   // allowed to use this ProvisionToken
   message Rule {
@@ -1768,6 +1889,7 @@ message ProvisionTokenSpecV2Kubernetes {
   // Service Account token. Support values:
   // - `in_cluster`
   // - `static_jwks`
+  // - `oidc`
   // If unset, this defaults to `in_cluster`.
   string Type = 2 [
     (gogoproto.jsontag) = "type,omitempty",
@@ -1775,6 +1897,8 @@ message ProvisionTokenSpecV2Kubernetes {
   ];
   // StaticJWKS is the configuration specific to the `static_jwks` type.
   StaticJWKSConfig StaticJWKS = 3 [(gogoproto.jsontag) = "static_jwks,omitempty"];
+  // OIDCConfig configures the `oidc` type.
+  OIDCConfig OIDC = 4 [(gogoproto.jsontag) = "oidc,omitempty"];
 }
 
 // ProvisionTokenSpecV2Azure contains the Azure-specific part of the
@@ -1929,12 +2053,61 @@ message ProvisionTokenSpecV2Oracle {
     // full region names ("us-phoenix-1") and abbreviations ("phx") are allowed.
     // If empty, any region is allowed.
     repeated string Regions = 3 [(gogoproto.jsontag) = "regions,omitempty"];
+    // Instances is a list of the OCIDs of specific instances that are allowed
+    // to join. If empty, any instance matching the other fields in the rule is allowed.
+    // Limited to 100 instance OCIDs per rule.
+    repeated string Instances = 4 [(gogoproto.jsontag) = "instances,omitempty"];
   }
   // Allow is a list of Rules, nodes using this token must match one
   // allow rule to use this token.
   repeated Rule Allow = 1 [(gogoproto.jsontag) = "allow,omitempty"];
 }
 
+// ProvisionTokenSpecV2Env0 contains env0-specific parts of the
+// ProvisionTokenSpecV2.
+message ProvisionTokenSpecV2Env0 {
+  // Rule is a set of properties the env0 environment might have to be allowed
+  // to use this provision token.
+  message Rule {
+    // OrganizationID is the unique organization identifier, corresponding to
+    // `organizationId` in an Env0 OIDC token.
+    string OrganizationID = 1 [(gogoproto.jsontag) = "organization_id,omitempty"];
+    // ProjectID is a unique project identifier, corresponding to `projectId` in
+    // an Env0 OIDC token.
+    string ProjectID = 2 [(gogoproto.jsontag) = "project_id,omitempty"];
+    // ProjectName is the name of the project under which the job was run
+    // corresponding to `projectName` in an Env0 OIDC token.
+    string ProjectName = 3 [(gogoproto.jsontag) = "project_name,omitempty"];
+    // TemplateID is the unique identifier of the Env0 template, corresponding
+    // to `templateId` in an Env0 OIDC token.
+    string TemplateID = 4 [(gogoproto.jsontag) = "template_id,omitempty"];
+    // TemplateName is the name of the Env0 template, corresponding to
+    // `templateName` in an Env0 OIDC token.
+    string TemplateName = 5 [(gogoproto.jsontag) = "template_name,omitempty"];
+    // EnvironmentID is the unique identifier of the Env0 environment,
+    // corresponding to `environmentId` in an Env0 OIDC token.
+    string EnvironmentID = 6 [(gogoproto.jsontag) = "environment_id,omitempty"];
+    // EnvironmentName is the name of the Env0 environment, corresponding to
+    // `environmentName` in an Env0 OIDC token.
+    string EnvironmentName = 7 [(gogoproto.jsontag) = "environment_name,omitempty"];
+    // WorkspaceName is the name of the Env0 workspace, corresponding to
+    // `workspaceName` in an Env0 OIDC token.
+    string WorkspaceName = 8 [(gogoproto.jsontag) = "workspace_name,omitempty"];
+    // DeploymentType is the env0 deployment type, such as "deploy", "destroy",
+    // etc. Corresponds to `deploymentType` in an Env0 OIDC token.
+    string DeploymentType = 9 [(gogoproto.jsontag) = "deployment_type,omitempty"];
+    // DeployerEmail is the email of the person that triggered the deployment,
+    // corresponding to `deployerEmail` in an Env0 OIDC token.
+    string DeployerEmail = 10 [(gogoproto.jsontag) = "deployer_email,omitempty"];
+    // Env0Tag is a custom tag value corresponding to `env0Tag` when
+    // `ENV0_OIDC_TAG` is set.
+    string Env0Tag = 11 [(gogoproto.jsontag) = "env0_tag,omitempty"];
+  }
+  // Allow is a list of Rules, jobs using this token must match at least one
+  // allow rule to use this token.
+  repeated Rule Allow = 1 [(gogoproto.jsontag) = "allow,omitempty"];
+}
+
 // ProvisionTokenSpecV2BoundKeypair contains configuration for bound_keypair
 // type join tokens.
 message ProvisionTokenSpecV2BoundKeypair {
@@ -1953,12 +2126,12 @@ message ProvisionTokenSpecV2BoundKeypair {
     // public key on first join, which may be used instead of preregistering a
     // public key with `initial_public_key`. If `initial_public_key` is set,
     // this value is ignored. Otherwise, if set, this value will be used to
-    // populate `.status.bound_keypair.intitial_join_secret`. If unset and no
+    // populate `.status.bound_keypair.registration_secret`. If unset and no
     // `initial_public_key` is provided, a random secure value will be generated
     // server-side to populate the status field.
     string RegistrationSecret = 2 [(gogoproto.jsontag) = "registration_secret,omitempty"];
 
-    // MustRegisterBefore is an optional time before which registeration via
+    // MustRegisterBefore is an optional time before which registration via
     // initial join secret must be performed. Attempts to register using an
     // initial join secret after this timestamp will not be allowed. This may be
     // modified after creation if necessary to allow the initial registration to
@@ -2032,7 +2205,7 @@ message ProvisionTokenStatusV2BoundKeypair {
   // RegistrationSecret contains a secret value that may be used for public key
   // registration during the initial join process if no public key is
   // preregistered. If `.spec.bound_keypair.onboarding.initial_public_key`
-  // is set, †his field will remain empty. Otherwise, if
+  // is set, this field will remain empty. Otherwise, if
   // `.spec.bound_keypair.onboarding.registration_secret` is set, that value
   // will be copied here. If that field is unset, a value will be randomly
   // generated.
@@ -2059,9 +2232,9 @@ message ProvisionTokenStatusV2BoundKeypair {
   uint32 RecoveryCount = 4 [(gogoproto.jsontag) = "recovery_count"];
 
   // LastRecoveredAt contains a timestamp of the last successful recovery
-  // attempt. Note that normal renewals do not count as a recovery attempt,
-  // however onboarding does,  either with a preregistered key or registration
-  // secret. This corresponds with the last time `bound_bot_instance_id` was
+  // attempt. Note that normal renewals with valid client certificates do not
+  // count as a recovery attempt, however the initial join during onboarding
+  // does. This corresponds with the last time `bound_bot_instance_id` was
   // updated.
   google.protobuf.Timestamp LastRecoveredAt = 5 [
     (gogoproto.stdtime) = true,
@@ -2264,9 +2437,9 @@ message ClusterNetworkingConfigSpecV2 {
   // missed before the server disconnects the connection to the client.
   int64 KeepAliveCountMax = 3 [(gogoproto.jsontag) = "keep_alive_count_max"];
 
-  // SessionControlTimeout is the session control lease expiry and defines
-  // the upper limit of how long a node may be out of contact with the auth
-  // server before it begins terminating controlled sessions.
+  // SessionControlTimeout is the session control lease expiry and defines the
+  // upper limit of how long a node may be out of contact with the Auth Service
+  // before it begins terminating controlled sessions.
   int64 SessionControlTimeout = 4 [
     (gogoproto.jsontag) = "session_control_timeout",
     (gogoproto.casttype) = "Duration"
@@ -2370,6 +2543,41 @@ message SessionRecordingConfigV2 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "spec"
   ];
+  // Status is the SessionRecordingConfig status containing active encryption keys
+  SessionRecordingConfigStatus Status = 6 [
+    (gogoproto.nullable) = true,
+    (gogoproto.jsontag) = "status,omitempty"
+  ];
+}
+
+// KeyLabel combines a label that can be used to identify one or more keys with a keystore type that
+// determines where the keys can be found.
+message KeyLabel {
+  // Type represents which keystore should be searched when looking up keys by label.
+  string type = 1 [(gogoproto.jsontag) = "type"];
+  // Label is a value that can be used with the related keystore in order to find relevant keys.
+  string label = 2 [(gogoproto.jsontag) = "label"];
+}
+
+// ManualKeyManagementConfig defines whether or not recording encryption keys should be managed externally
+// and how to query those keys.
+message ManualKeyManagementConfig {
+  // Enabled controls whether or recording encryption keys should be managed externally.
+  bool enabled = 1 [(gogoproto.jsontag) = "enabled,omitempty"];
+  // ActiveKeys describe which keys should be queried for active recording encryption and replay.
+  repeated KeyLabel active_keys = 2 [(gogoproto.jsontag) = "active_keys,omitempty"];
+  // RotatedKeys describe which keys should be queried for historical replay.
+  repeated KeyLabel rotated_keys = 3 [(gogoproto.jsontag) = "rotated_keys,omitempty"];
+}
+
+// SessionRecordingEncryptionConfig configures if and how session recordings
+// should be encrypted.
+message SessionRecordingEncryptionConfig {
+  // Enabled controls whether or not session recordings should be encrypted.
+  bool enabled = 1 [(gogoproto.jsontag) = "enabled,omitempty"];
+  // ManualKeyManagement defines whether or not recording encryption keys should be managed externally
+  // and how to query those keys.
+  ManualKeyManagementConfig manual_key_management = 2 [(gogoproto.jsontag) = "manual_key_management,omitempty"];
 }
 
 // SessionRecordingConfigSpecV2 is the actual data we care about
@@ -2385,6 +2593,20 @@ message SessionRecordingConfigSpecV2 {
     (gogoproto.jsontag) = "proxy_checks_host_keys",
     (gogoproto.customtype) = "BoolOption"
   ];
+
+  // Encryption configures if and how session recordings should be encrypted.
+  SessionRecordingEncryptionConfig encryption = 3 [
+    (gogoproto.nullable) = true,
+    (gogoproto.jsontag) = "encryption,omitempty"
+  ];
+}
+
+// SessionRecordingConfigStatus contains the currently active age encryption keys used
+// for encrypted session recording.
+message SessionRecordingConfigStatus {
+  // EncryptionKeys contain the currently active age encryption keys used for
+  // encrypted session recording.
+  repeated AgeEncryptionKey encryption_keys = 1 [(gogoproto.jsontag) = "encryption_keys"];
 }
 
 // AuthPreferenceV2 implements the AuthPreference interface.
@@ -2617,6 +2839,8 @@ message DeviceTrust {
   //   endpoints.
   // - "required": enforces the presence of device extensions for sensitive
   //   endpoints.
+  // - "required-for-humans": enforces the presence of device extensions for
+  //   sensitive endpoints, for human users only (bots are exempt).
   //
   // Mode is always "off" for OSS.
   // Defaults to "optional" for Enterprise.
@@ -3064,6 +3288,23 @@ message AccessRequestSpecV3 {
 
   // DryRunEnrichment contains the extra info added in response to a dry run request.
   AccessRequestDryRunEnrichment DryRunEnrichment = 23 [(gogoproto.jsontag) = "dry_run_enrichment,omitempty"];
+
+  // RequestKind indicates the kind (short/long-term) of request.
+  AccessRequestKind RequestKind = 24 [(gogoproto.jsontag) = "request_kind,omitempty"];
+
+  // LongTermResourceGrouping contains information about how resources can be grouped
+  // based on Access List promotions for long-term Access Requests.
+  LongTermResourceGrouping LongTermGrouping = 25 [(gogoproto.jsontag) = "long_term_grouping,omitempty"];
+}
+
+// AccessRequestKind represents the kind of Access Request being made (short/long-term).
+enum AccessRequestKind {
+  // UNDEFINED is the default value, and represents an undefined request kind.
+  UNDEFINED = 0;
+  // SHORT_TERM represents a short-term request, either role-based or resource-based.
+  SHORT_TERM = 1;
+  // LONG_TERM represents a long-term resource-based request.
+  LONG_TERM = 2;
 }
 
 enum AccessRequestScope {
@@ -3146,6 +3387,34 @@ message AccessCapabilitiesRequest {
   bool FilterRequestableRolesByResource = 6 [(gogoproto.jsontag) = "filter_requestable_roles_by_resource,omitempty"];
 }
 
+// RemoteAccessCapabilities is a summary of the capabilites that a remote cluster
+// user is granted in target cluster.
+// buf:lint:ignore PAGINATION_REQUIRED
+message RemoteAccessCapabilities {
+  // ApplicableRolesForResources is a list of the remote-cluster roles applicable
+  // for access to a given set of resources. This will always be a subset of the
+  // SearchAsRoles supplied in the [RemoteAccessCapabilitiesRequest]
+  repeated string ApplicableRolesForResources = 1 [(gogoproto.jsontag) = "applicable_roles,omitempty"];
+}
+
+// AccessCapabilitiesRequest encodes parameters for the GetRemoteAccessCapabilities method.
+// buf:lint:ignore PAGINATION_REQUIRED
+message RemoteAccessCapabilitiesRequest {
+  // user is the name of the target user on their home cluster
+  string User = 1 [(gogoproto.jsontag) = "user,omitempty"];
+
+  // SearchAsRoles holds the roles the target user may use when searching for
+  // resources on the user's home cluster
+  repeated string SearchAsRoles = 2 [(gogoproto.jsontag) = "remote_search_as_roles,omitempty"];
+
+  // ResourceIDs is the list of the ResourceIDs of the resources we would like to view
+  // the necessary roles for.
+  repeated ResourceID ResourceIDs = 3 [
+    (gogoproto.jsontag) = "resource_ids,omitempty",
+    (gogoproto.nullable) = false
+  ];
+}
+
 // RequestKubernetesResource is the Kubernetes resource identifier used
 // in access request settings.
 // Modeled after existing message KubernetesResource.
@@ -3258,7 +3527,7 @@ message RoleV6 {
   // SubKind is an optional resource sub kind, used in some resources
   string SubKind = 2 [(gogoproto.jsontag) = "sub_kind,omitempty"];
   // Version is the resource version. It must be specified.
-  // Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`.
+  // Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`.
   string Version = 3 [(gogoproto.jsontag) = "version"];
   // Metadata is resource metadata
   Metadata Metadata = 4 [
@@ -3789,6 +4058,9 @@ message RoleConditions {
   // WorkloadIdentityLabelsExpression is a predicate expression used to
   // allow/deny access to issuing a WorkloadIdentity.
   string WorkloadIdentityLabelsExpression = 45 [(gogoproto.jsontag) = "workload_identity_labels_expression,omitempty"];
+
+  // MCPPermissions defines MCP servers related permissions.
+  MCPPermissions MCP = 46 [(gogoproto.jsontag) = "mcp,omitempty"];
 }
 
 // IdentityCenterAccountAssignment captures an AWS Identity Center account
@@ -3803,6 +4075,15 @@ message GitHubPermission {
   repeated string organizations = 1 [(gogoproto.jsontag) = "orgs,omitempty"];
 }
 
+// MCPPermissions defines MCP servers related permissions.
+message MCPPermissions {
+  // Tools defines the list of tools allowed or denied for this role. Each entry
+  // can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular
+  // expression (must start with '^' and end with '$'). If the list is empty, no
+  // tools are allowed.
+  repeated string tools = 1;
+}
+
 // SPIFFERoleCondition sets out which SPIFFE identities this role is allowed or
 // denied to generate. The Path matcher is required, and is evaluated first. If,
 // the Path does not match then the other matcher fields are not evaluated.
@@ -3986,6 +4267,9 @@ message AccessRequestConditionsReason {
     (gogoproto.jsontag) = "mode,omitempty",
     (gogoproto.casttype) = "RequestReasonMode"
   ];
+  // Prompt is a custom message prompted to the user for the requested roles or resources searchable
+  // as other roles. This is only applied to the requested roles and resources specifying the prompt.
+  string Prompt = 2 [(gogoproto.jsontag) = "prompt,omitempty"];
 }
 
 // AccessReviewConditions is a matcher for allow/deny restrictions on
@@ -4024,6 +4308,31 @@ message AccessRequestAllowedPromotions {
   repeated AccessRequestAllowedPromotion promotions = 1;
 }
 
+// ResourceIDList represents a list of ResourceID objects.
+message ResourceIDList {
+  repeated ResourceID resource_ids = 1 [(gogoproto.nullable) = false];
+}
+
+// LongTermResourceGrouping contains information about how resources can be grouped
+// based on Access List promotions for long-term Access Requests.
+message LongTermResourceGrouping {
+  // AccessListToResources maps applicable Access List names to the resources they can grant,
+  // including the optimal grouping.
+  map<string, ResourceIDList> AccessListToResources = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "grouped_by_access_list"
+  ];
+  // RecommendedAccessList is the name of the Access List that would provide
+  // access to the most resources. If multiple Access Lists provide the same
+  // number of resources, the first one found will be used.
+  string RecommendedAccessList = 2 [(gogoproto.jsontag) = "recommended_access_list"];
+  // ValidationMessage is a user-friendly message explaining any grouping error, if CanProceed is false.
+  string ValidationMessage = 3 [(gogoproto.jsontag) = "validation_message,omitempty"];
+  // CanProceed represents the validity of the long-term grouping. If all requested
+  // resources cannot be grouped together, this will be false.
+  bool CanProceed = 4 [(gogoproto.jsontag) = "can_proceed"];
+}
+
 // ClaimMapping maps a claim to teleport roles.
 message ClaimMapping {
   // Claim is a claim name.
@@ -4079,6 +4388,8 @@ message BoolValue {
 message UserFilter {
   // SearchKeywords is a list of search keywords to match against resource field values.
   repeated string SearchKeywords = 1 [(gogoproto.jsontag) = "search_keywords,omitempty"];
+  // SkipSystemUsers filters out teleport system users from the results.
+  bool SkipSystemUsers = 2 [(gogoproto.jsontag) = "skip_system_users,omitempty"];
 }
 
 // UserV2 is version 2 resource spec of the user
@@ -4923,6 +5234,7 @@ message KubernetesClusterV3List {
 message KubernetesServerV3 {
   option (gogoproto.goproto_stringer) = false;
   option (gogoproto.stringer) = false;
+
   // Kind is the Kubernetes server resource kind. Always "kube_server".
   string Kind = 1 [(gogoproto.jsontag) = "kind"];
   // SubKind is an optional resource subkind.
@@ -4939,6 +5251,10 @@ message KubernetesServerV3 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "spec"
   ];
+  // Status is the Kubernetes server status.
+  KubernetesServerStatusV3 status = 6;
+  // The advertized scope of the server which can not change once assigned.
+  string scope = 7;
 }
 
 // KubernetesServerSpecV3 is the Kubernetes server spec.
@@ -4958,6 +5274,18 @@ message KubernetesServerSpecV3 {
   KubernetesClusterV3 Cluster = 5 [(gogoproto.jsontag) = "cluster"];
   // ProxyIDs is a list of proxy IDs this server is expected to be connected to.
   repeated string ProxyIDs = 6 [(gogoproto.jsontag) = "proxy_ids,omitempty"];
+
+  // the name of the Relay group that the server is connected to
+  string relay_group = 7;
+  // the list of Relay host IDs that the server is connected to
+  repeated string relay_ids = 8;
+}
+
+// KubernetesServerStatusV3 is the Kubernetes cluster status.
+message KubernetesServerStatusV3 {
+  // TargetHealth is the health status of between the Teleport agent
+  // and Kubernetes cluster.
+  TargetHealth target_health = 1;
 }
 
 // WebTokenV3 describes a web token. Web tokens are used as a transport to relay bearer tokens
@@ -5161,6 +5489,40 @@ message OIDCConnectorSpecV3 {
   OIDCConnectorMFASettings MFASettings = 19 [(gogoproto.jsontag) = "mfa,omitempty"];
   // PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
   string PKCEMode = 20 [(gogoproto.jsontag) = "pkce_mode,omitempty"];
+  // UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+  // match for identifier-first login.
+  repeated string UserMatchers = 21 [(gogoproto.jsontag) = "user_matchers,omitempty"];
+  // RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization
+  // requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality
+  // for authorization request parameters.
+  string RequestObjectMode = 22 [(gogoproto.jsontag) = "request_object_mode,omitempty"];
+  // EntraIDGroupsProvider configures out-of-band user groups provider.
+  // It works by following through the groups claim source, which is sent for the "groups"
+  // claim when the user's group membership exceeds 200 max item limit.
+  EntraIDGroupsProvider entra_id_groups_provider = 23;
+}
+
+// EntraIDGroupsProvider configures out-of-band user groups provider.
+// It works by following through the groups claim source, which is sent for
+// "groups" claim when the user's group membership exceeds 200 max item limit.
+message EntraIDGroupsProvider {
+  // Disabled specifies that the groups provider should be disabled
+  // even when Entra ID responds with a groups claim source.
+  // User may choose to disable it if they are using
+  // integrations such as SCIM or similar groups importer as
+  // connector based role mapping may be not needed in such a scenario.
+  bool disabled = 1;
+  // GroupType is a user group type filter. Defaults to "security-groups".
+  // Value can be "security-groups", "directory-roles", "all-groups".
+  string group_type = 2;
+  // GraphEndpoint is a Microsoft Graph API endpoint.
+  // The groups claim source endpoint provided by Entra ID points to the
+  // now-retired Azure AD Graph endpoint ("https://graph.windows.net").
+  // To convert it to the newer Microsoft Graph API endpoint,
+  // Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com").
+  // Update GraphEndpoint to point to a different Microsoft Graph national
+  // cloud deployment endpoint.
+  string graph_endpoint = 3;
 }
 
 // MaxAge allows the max_age parameter to be nullable to preserve backwards
@@ -5200,6 +5562,12 @@ message OIDCConnectorMFASettings {
   // 0 to always force re-authentication for MFA checks. This should only be set to a non-zero
   // value if the IdP is setup to perform MFA checks on top of active user sessions.
   int64 max_age = 6 [(gogoproto.casttype) = "Duration"];
+  // RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization
+  // requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality
+  // for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior
+  // specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for
+  // the MFA client.
+  string RequestObjectMode = 7 [(gogoproto.jsontag) = "request_object_mode,omitempty"];
 }
 
 // OIDCAuthRequest is a request to authenticate with OIDC
@@ -5281,6 +5649,9 @@ message OIDCAuthRequest {
   teleport.attestation.v1.AttestationStatement tls_attestation_statement = 23 [(gogoproto.jsontag) = "tls_attestation_statement,omitempty"];
   // pkce_verifier is used to verified a generated code challenge.
   string pkce_verifier = 24 [(gogoproto.jsontag) = "pkce_verifier"];
+  // LoginHint is an optional username/email provided by the client that will be passed
+  // to the IdP via the 'login_hint' query parameter.
+  string login_hint = 25 [(gogoproto.jsontag) = "login_hint,omitempty"];
 }
 
 // SAMLConnectorV2 represents a SAML connector.
@@ -5374,6 +5745,13 @@ message SAMLConnectorSpecV2 {
   // binding as a default. Setting up PreferredRequestBinding value lets us preserve existing
   // auth connector behavior and only use http-post binding if it is explicitly configured.
   string PreferredRequestBinding = 19 [(gogoproto.jsontag) = "preferred_request_binding,omitempty"];
+  // UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+  // match for identifier-first login.
+  repeated string UserMatchers = 20 [(gogoproto.jsontag) = "user_matchers,omitempty"];
+  // IncludeSubject is a flag that indicates whether the Subject element is included in the SAML
+  // authentication request. Defaults to false.
+  // Note: Some IdPs will reject requests that contain a Subject.
+  bool IncludeSubject = 21 [(gogoproto.jsontag) = "include_subject,omitempty"];
 }
 
 // SAMLConnectorMFASettings contains SAML MFA settings.
@@ -5487,6 +5865,9 @@ message SAMLAuthRequest {
   bytes PostForm = 23 [(gogoproto.jsontag) = "post_form,omitempty"];
   // ClientVersion is the version of tsh or Proxy that is sending the SAMLAuthRequest request.
   string ClientVersion = 24 [(gogoproto.jsontag) = "client_version,omitempty"];
+  // SubjectIdentifier is an optional username/email provided by the client that will be
+  // passed to prepopulate the IdP's login form
+  string SubjectIdentifier = 25 [(gogoproto.jsontag) = "subject_identifier,omitempty"];
 }
 
 // AttributeMapping maps a SAML attribute statement to teleport roles.
@@ -5566,6 +5947,9 @@ message GithubConnectorSpecV3 {
   // ClientRedirectSettings defines which client redirect URLs are allowed for
   // non-browser SSO logins other than the standard localhost ones.
   SSOClientRedirectSettings ClientRedirectSettings = 9 [(gogoproto.jsontag) = "client_redirect_settings,omitempty"];
+  // UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+  // match for identifier-first login.
+  repeated string UserMatchers = 10 [(gogoproto.jsontag) = "user_matchers,omitempty"];
 }
 
 // GithubAuthRequest is the request to start Github OAuth2 flow.
@@ -5967,6 +6351,24 @@ message LockTarget {
 
   // ServerID is the host id of the Teleport instance.
   string ServerID = 9 [(gogoproto.jsontag) = "server_id,omitempty"];
+
+  // BotInstanceID is the bot instance ID if this is a bot identity and is
+  // ignored otherwise.
+  string BotInstanceID = 10 [(gogoproto.jsontag) = "bot_instance_id,omitempty"];
+
+  // JoinToken is the name of the join token used when this identity originally
+  // joined. This is only valid for bot identities, and cannot be used to target
+  // `token`-joined bots.
+  string JoinToken = 11 [(gogoproto.jsontag) = "join_token,omitempty"];
+}
+
+// LockFilter encodes optional filters to apply when listing Lock resources
+message LockFilter {
+  // Targets is a list of targets. Every returned lock must match at least
+  // one of the targets.
+  repeated LockTarget targets = 1;
+  // InForceOnly specifies whether to return active locks only.
+  bool in_force_only = 2;
 }
 
 // AddressCondition represents a set of addresses. Presently the addresses are specified
@@ -6038,6 +6440,11 @@ message WindowsDesktopServiceSpecV3 {
   string Hostname = 3 [(gogoproto.jsontag) = "hostname"];
   // ProxyIDs is a list of proxy IDs this server is expected to be connected to.
   repeated string ProxyIDs = 4 [(gogoproto.jsontag) = "proxy_ids,omitempty"];
+
+  // the name of the Relay group that the server is connected to
+  string relay_group = 5;
+  // the list of Relay host IDs that the server is connected to
+  repeated string relay_ids = 6;
 }
 
 // WindowsDesktopFilter are filters to apply when searching for windows desktops.
@@ -6381,6 +6788,9 @@ message Participant {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "last_active,omitempty"
   ];
+
+  // Cluster is the cluster name the user is authenticated against.
+  string Cluster = 5 [(gogoproto.jsontag) = "cluster,omitempty"];
 }
 
 // UIConfigV1 represents the configuration for the web UI served by the proxy service
@@ -6806,6 +7216,8 @@ message PluginSpecV1 {
     PluginNetIQSettings net_iq = 19;
     // Settings for the GitHub plugin.
     PluginGithubSettings github = 20;
+    // Settings for the Intune plugin.
+    PluginIntuneSettings intune = 21;
 
     // Note: If you add a new settings type, please also update the custom JSON for oneof filed
     // in the `tctl get/edit plugin` plugin command. You can find it in:
@@ -6944,6 +7356,29 @@ message PluginJamfSettings {
   JamfSpecV1 jamf_spec = 1;
 }
 
+// Defines settings for Intune plugin.
+message PluginIntuneSettings {
+  option (gogoproto.equal) = true;
+
+  // Tenant is the primary domain name (e.g. contoso.onmicrosoft.com) or the tenant ID (e.g.
+  // 38d49456-54d4-455d-a8d6-c383c71e0a6d) of an organization within Microsoft Entra ID.
+  //
+  // https://learn.microsoft.com/en-us/partner-center/account-settings/find-ids-and-domain-names#find-the-microsoft-entra-tenant-id-and-primary-domain-name
+  string tenant = 1;
+
+  // login_endpoint points to one of the national deployments of Microsoft Entra ID.
+  // Optional, defaults to "https://login.microsoftonline.com".
+  //
+  // https://learn.microsoft.com/en-us/graph/deployments
+  string login_endpoint = 2;
+
+  // graph_endpoint points to one of the national deployments of Microsoft Graph.
+  // Optional, defaults to "https://graph.microsoft.com".
+  //
+  // https://learn.microsoft.com/en-us/graph/deployments
+  string graph_endpoint = 3;
+}
+
 // Defines settings for the Okta plugin.
 message PluginOktaSettings {
   option (gogoproto.equal) = true;
@@ -7052,6 +7487,11 @@ message PluginOktaSyncSettings {
   // synchronized users. This is allows for a more advanced RBAC setup where not all
   // Okta-originated users are allowed request all Okta-originated resources.
   bool disable_assign_default_roles = 13;
+
+  // TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+  // groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+  // bidirectional sync is enabled. The default value is 30m.
+  string time_between_imports = 14;
 }
 
 // Defines a set of discord channel IDs
@@ -7104,6 +7544,32 @@ message PluginEntraIDSyncSettings {
   // This field is populated on a best-effort basis for legacy plugins but mandatory for plugins created after its introduction.
   // For existing plugins, it is filled in using the entity descriptor url when utilized.
   string entra_app_id = 5;
+
+  // GroupFilters configures which groups should be included or exlcuded.
+  repeated PluginSyncFilter group_filters = 6;
+}
+
+// PluginSyncFilter can specify inclusion or exclusion of a resource.
+message PluginSyncFilter {
+  option (gogoproto.equal) = true;
+
+  // Include describes that the resource should be explicitly included.
+  oneof include {
+    // Id includes resource matched with an ID.
+    string id = 1 [(gogoproto.jsontag) = "id,omitempty"];
+
+    // NameRegex includes resource matched with a regexp.
+    string name_regex = 2 [(gogoproto.jsontag) = "name_regex,omitempty"];
+  }
+
+  // Exclude specifies which AWS resources should be explicitly excluded.
+  oneof exclude {
+    // ExcludeId excludes resource matched with an ID.
+    string exclude_id = 3 [(gogoproto.jsontag) = "id,omitempty"];
+
+    // ExcludeNameRegex excludes resource matched with a regexp.
+    string exclude_name_regex = 4 [(gogoproto.jsontag) = "name_regex,omitempty"];
+  }
 }
 
 // EntraIDCredentialsSource defines the credentials source for Entra ID.
@@ -7148,11 +7614,28 @@ message PluginSCIMSettings {
 
   // SamlConnectorName is the name of the SAML Connector that users provisioned
   // by this SCIM plugin will use to log in to Teleport.
-  string saml_connector_name = 1;
+  // DEPRECATED: Use ConnectorInfo instead.
+  // This is old field added when the Okta SCIM plugin was created
+  // and was limited usage to SAML connectors only.
+  string saml_connector_name = 1 [deprecated = true];
 
   // DefaultRole is the default role assigned to users provisioned by this
   // plugin.
-  string default_role = 2;
+  string default_role = 2 [deprecated = true];
+
+  message ConnectorInfo {
+    option (gogoproto.equal) = true;
+    // Name is the name of the connector.
+    string name = 1 [(gogoproto.jsontag) = "name"];
+    // Type is the type of the connector: types.KindSAML, types.KindOIDC, etc.
+    // Note: The name of the connect is not unique across types.
+    string type = 2 [(gogoproto.jsontag) = "type"];
+  }
+
+  // ConnectorInfo contains information about the user's origin as provided
+  // by the SCIM plugin. It enables matching a SAML/OIDC external user
+  // with a SCIM-persisted user, allowing the ephemeral user entry to be updated to SCIM user.
+  ConnectorInfo connector_info = 3 [(gogoproto.jsontag) = "connector_info"];
 }
 
 // PluginDatadogAccessSettings defines the settings for a Datadog Incident Management plugin
@@ -7244,6 +7727,19 @@ message PluginAWSICSettings {
   // Credentials represents the AWS credentials used by the Identity Center
   // integration
   AWSICCredentials credentials = 11 [(gogoproto.jsontag) = "credentials,omitempty"];
+
+  // RolesSyncMode indicates how the Identity Center integration will create and
+  // manage roles representing potential Identity Center Account Assignments.
+  //
+  // Possible values are ALL or NONE:
+  //  ALL:           indicates that the AWS Identity Center integration should
+  //                 create and maintain roles for all possible Account Assignments.
+  //  NONE:          indicates that the AWS Identity Center integration should
+  //                 not create any roles representing potential account Account
+  //                 Assignments.
+  // For backwards compatibility, an empty value is treated as equivalent to
+  // to ALL
+  string roles_sync_mode = 12;
 }
 
 // AWSICCredentials holds the credentials for authenticating with AWS
@@ -7427,6 +7923,7 @@ message PluginBootstrapCredentialsV1 {
 
 // PluginIdSecretCredential can be OAuth2-like client_id and client_secret or username and password.
 message PluginIdSecretCredential {
+  option (gogoproto.equal) = true;
   string id = 1;
   string secret = 2;
 }
@@ -7556,6 +8053,10 @@ message PluginOktaStatusV1 {
   // AccessListSyncDetails are status details relating to synchronizing access
   // lists from Okta.
   PluginOktaStatusDetailsAccessListsSync access_lists_sync_details = 5;
+
+  // SystemLogExportDetails are the status defaults related to the System Logs
+  // exporter.
+  PluginOktaStatusSystemLogExporter system_log_export_details = 6;
 }
 
 // PluginOktaStatusDetailsSSO are details related to the
@@ -7691,9 +8192,38 @@ message PluginOktaStatusDetailsAccessListsSync {
   string error = 9;
 }
 
+// PluginOktaStatusSystemLogExporter are details related to the
+// current status of the Okta integration w/r/t system logs sync.
+message PluginOktaStatusSystemLogExporter {
+  // Enabled is whether Okta System Log exporter is enabled.
+  bool enabled = 1;
+
+  // StatusCode indicates the current state of the service
+  OktaPluginSyncStatusCode status_code = 2;
+
+  // LastSuccessful is the date of the last successful run.
+  google.protobuf.Timestamp last_successful = 3 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = true,
+    (gogoproto.jsontag) = "last_successful"
+  ];
+
+  // LastFailed is the date of the last failed run.
+  google.protobuf.Timestamp last_failed = 4 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = true,
+    (gogoproto.jsontag) = "last_failed"
+  ];
+
+  // Error contains a textual description of the reason the last synchronization
+  // failed. Only valid when StatusCode is OKTA_PLUGIN_SYNC_STATUS_CODE_ERROR.
+  string error = 9;
+}
+
 // PluginCredentialsV1 represents "live" credentials
 // that are used by the plugin to authenticate to the 3rd party API.
 message PluginCredentialsV1 {
+  option (gogoproto.equal) = true;
   oneof credentials {
     PluginOAuth2AccessTokenCredentials oauth2_access_token = 1;
     PluginBearerTokenCredentials bearer_token = 2;
@@ -7703,6 +8233,8 @@ message PluginCredentialsV1 {
 }
 
 message PluginOAuth2AccessTokenCredentials {
+  option (gogoproto.equal) = true;
+
   string access_token = 1;
   string refresh_token = 2;
   google.protobuf.Timestamp expires = 3 [
@@ -7712,6 +8244,8 @@ message PluginOAuth2AccessTokenCredentials {
 }
 
 message PluginBearerTokenCredentials {
+  option (gogoproto.equal) = true;
+
   // Token is the literal bearer token to be submitted to the 3rd-party API provider.
   string token = 1;
 
@@ -7750,6 +8284,7 @@ message PluginStaticCredentialsV1 {
 
 // PluginStaticCredentialsSpecV1 is the specification for the static credentials object.
 message PluginStaticCredentialsSpecV1 {
+  option (gogoproto.equal) = true;
   oneof credentials {
     string APIToken = 1;
     PluginStaticCredentialsBasicAuth BasicAuth = 2;
@@ -7761,6 +8296,8 @@ message PluginStaticCredentialsSpecV1 {
 
 // PluginStaticCredentialsBasicAuth represents username and password credentials for a plugin.
 message PluginStaticCredentialsBasicAuth {
+  option (gogoproto.equal) = true;
+
   // Username is the username to use for basic auth.
   string Username = 1 [(gogoproto.jsontag) = "username"];
 
@@ -7770,6 +8307,8 @@ message PluginStaticCredentialsBasicAuth {
 
 // PluginStaticCredentialsOAuthClientSecret represents an oauth client id and secret.
 message PluginStaticCredentialsOAuthClientSecret {
+  option (gogoproto.equal) = true;
+
   // ClientId is the client ID to use for OAuth client secret.
   string ClientId = 1 [(gogoproto.jsontag) = "client_id"];
 
@@ -7780,6 +8319,8 @@ message PluginStaticCredentialsOAuthClientSecret {
 // PluginStaticCredentialsSSHCertAuthorities contains the active SSH CAs used
 // for the integration or plugin.
 message PluginStaticCredentialsSSHCertAuthorities {
+  option (gogoproto.equal) = true;
+
   // CertAuthorities contains the active SSH CAs used for the integration or
   // plugin.
   repeated SSHKeyPair cert_authorities = 1;
@@ -8123,6 +8664,12 @@ message IntegrationV1 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "spec"
   ];
+
+  // Status is an Integration specification.
+  IntegrationStatusV1 Status = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "status"
+  ];
 }
 
 // IntegrationSpecV1 contains properties of all the supported integrations.
@@ -8142,6 +8689,12 @@ message IntegrationSpecV1 {
   PluginCredentialsV1 credentials = 4;
 }
 
+// IntegrationStatusV1 contains the status of the integration.
+message IntegrationStatusV1 {
+  // AWSRolesAnywhere contains the specific status fields to related to the AWS Roles Anywhere Integration subkind.
+  AWSRAIntegrationStatusV1 AWSRolesAnywhere = 1 [(gogoproto.jsontag) = "aws_ra,omitempty"];
+}
+
 // AWSOIDCIntegrationSpecV1 contains the spec properties for the AWS OIDC SubKind Integration.
 message AWSOIDCIntegrationSpecV1 {
   // RoleARN contains the Role ARN used to set up the Integration.
@@ -8152,7 +8705,7 @@ message AWSOIDCIntegrationSpecV1 {
   // This bucket/prefix/* files must be publicly accessible and contain the following:
   // > .well-known/openid-configuration
   // > .well-known/jwks
-  // Format: s3://<bucket>/<prefix>
+  // Format: `s3://<bucket>/<prefix>`
   // Optional. The proxy's endpoint is used if it is not specified.
   //
   // DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate.
@@ -8164,9 +8717,9 @@ message AWSOIDCIntegrationSpecV1 {
     deprecated = true
   ];
 
-  // Audience is used to record a name of a plugin or a discover service in Teleport
-  // that depends on this integration.
-  // Audience value can be empty or configured with supported preset audience type.
+  // Audience is used to record a name of a plugin or a discover service in
+  // Teleport that depends on this integration.
+  // Audience value can either be empty or "aws-identity-center".
   // Preset audience may impose specific behavior on the integration CRUD API,
   // such as preventing integration from update or deletion. Empty audience value
   // should be treated as a default and backward-compatible behavior of the integration.
@@ -8211,6 +8764,55 @@ message AWSRolesAnywhereProfileSyncConfig {
   bool ProfileAcceptsRoleSessionName = 3 [(gogoproto.jsontag) = "profile_accepts_role_session_name"];
   // RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.
   string RoleARN = 4 [(gogoproto.jsontag) = "role_arn"];
+  // ProfileNameFilters is a list of filters applied to the profile name.
+  // Only matching profiles will be synchronized as application servers.
+  // If empty, no filtering is applied.
+  //
+  // Filters can be globs, for example:
+  //
+  //	profile*
+  //	*name*
+  //
+  // Or regexes if they're prefixed and suffixed with ^ and $, for example:
+  //
+  //	^profile.*$
+  //	^.*name.*$
+  repeated string ProfileNameFilters = 5 [(gogoproto.jsontag) = "profile_name_filters"];
+}
+
+// AWSRAIntegrationStatusV1 contains the status properties for the AWS IAM Roles Anywhere SubKind Integration.
+message AWSRAIntegrationStatusV1 {
+  // LastProfileSync is the summary of the last profile sync iteration.
+  AWSRolesAnywhereProfileSyncIterationSummary LastProfileSync = 1 [
+    (gogoproto.nullable) = true,
+    (gogoproto.jsontag) = "last_profile_sync"
+  ];
+}
+
+// AWSRolesAnywhereProfileSyncIterationSummary contains the summary of a single profile sync iteration.
+message AWSRolesAnywhereProfileSyncIterationSummary {
+  // StartTime is the time when the sync iteration started.
+  google.protobuf.Timestamp StartTime = 1 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "start_time"
+  ];
+
+  // EndTime is the time when the sync iteration ended.
+  google.protobuf.Timestamp EndTime = 2 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "end_time"
+  ];
+
+  // Status is the result of the sync iteration: SUCCESS or ERROR.
+  string Status = 3 [(gogoproto.jsontag) = "status"];
+
+  // ErrorMessage holds the error message when status is ERROR.
+  string ErrorMessage = 4 [(gogoproto.jsontag) = "error_message"];
+
+  // SyncedProfiles is the number of profiles synchronized as application servers.
+  int32 SyncedProfiles = 5 [(gogoproto.jsontag) = "synced_profiles"];
 }
 
 // HeadlessAuthentication holds data for an ongoing headless authentication attempt.
@@ -8454,10 +9056,36 @@ message AWSMatcher {
   // KubeAppDiscovery controls whether Kubernetes App Discovery will be enabled for agents running on
   // discovered clusters, currently only affects AWS EKS discovery in integration mode.
   bool KubeAppDiscovery = 8 [(gogoproto.jsontag) = "kube_app_discovery,omitempty"];
-  // SetupAccessForARN is the role that the discovery service should create EKS Access Entries for.
+  // SetupAccessForARN is the role that the Discovery Service should create EKS Access Entries for.
   // This value should match the IAM identity that Teleport Kubernetes Service uses.
-  // If this value is empty, the discovery service will attempt to set up access for its own identity (self).
+  // If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).
   string SetupAccessForARN = 9 [(gogoproto.jsontag) = "setup_access_for_arn,omitempty"];
+  // Organization is an AWS Organization matcher for discovering resources accross multiple accounts under an Organization.
+  AWSOrganizationMatcher Organization = 10 [(gogoproto.jsontag) = "organization,omitempty"];
+}
+
+// AWSOrganizationMatcher specifies an Organization and rules for discovering accounts under that organization.
+message AWSOrganizationMatcher {
+  // OrganizationID is the AWS Organization ID to match against.
+  // Required.
+  string OrganizationID = 1 [(gogoproto.jsontag) = "organization_id,omitempty"];
+
+  // OrganizationalUnits contains rules for matchings AWS accounts based on their Organizational Units.
+  AWSOrganizationUnitsMatcher OrganizationalUnits = 2 [(gogoproto.jsontag) = "organizational_units,omitempty"];
+}
+
+// AWSOrganizationUnitsMatcher contains rules for matching accounts under an Organization.
+// Accounts that belong to an excluded Organizational Unit, and its children, will be excluded even if they were included.
+message AWSOrganizationUnitsMatcher {
+  // Include is a list of AWS Organizational Unit IDs to match.
+  // Only exact matches or wildcard (*) are supported.
+  // If empty, all Organizational Units are included by default.
+  repeated string Include = 1 [(gogoproto.jsontag) = "include,omitempty"];
+
+  // Exclude is a list of AWS Organizational Unit IDs to exclude.
+  // Only exact matches or wildcard (*) are supported.
+  // If empty, no Organizational Units are excluded by default.
+  repeated string Exclude = 2 [(gogoproto.jsontag) = "exclude,omitempty"];
 }
 
 // AssumeRole provides a role ARN and ExternalID to assume an AWS role
@@ -8496,6 +9124,34 @@ message InstallerParams {
   // 1: uses script mode
   // 2: uses eice mode
   InstallParamEnrollMode EnrollMode = 8 [(gogoproto.jsontag) = "enroll_mode,omitempty"];
+  // Suffix indicates the installation suffix for the teleport installation.
+  // Set this value if you want multiple installations of Teleport.
+  // See --install-suffix flag in teleport-update program.
+  // Note: only supported for Amazon EC2.
+  // Suffix name can only contain alphanumeric characters and hyphens.
+  string Suffix = 9 [(gogoproto.jsontag) = "suffix,omitempty"];
+  // UpdateGroup indicates the update group for the teleport installation.
+  // This value is used to group installations in order to update them in batches.
+  // See --group flag in teleport-update program.
+  // Note: only supported for Amazon EC2.
+  // Group name can only contain alphanumeric characters and hyphens.
+  string UpdateGroup = 10 [(gogoproto.jsontag) = "update_group,omitempty"];
+  // HTTPProxySettings defines HTTP proxy settings for making HTTP requests.
+  // When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.
+  HTTPProxySettings HTTPProxySettings = 11 [(gogoproto.jsontag) = "http_proxy_settings,omitempty"];
+}
+
+// HTTPProxySettings defines HTTP proxy settings for making HTTP and HTTPS requests.
+message HTTPProxySettings {
+  // HTTPProxy is the URL for the HTTP proxy to use when making requests.
+  // When applied, this will set the HTTP_PROXY environment variable.
+  string HTTPProxy = 1 [(gogoproto.jsontag) = "http_proxy,omitempty"];
+  // HTTPSProxy is the URL for the HTTPS Proxy to use when making requests.
+  // When applied, this will set the HTTPS_PROXY environment variable.
+  string HTTPSProxy = 2 [(gogoproto.jsontag) = "https_proxy,omitempty"];
+  // NoProxy is a comma separated list of URLs that will be excluded from proxying.
+  // When applied, this will set the NO_PROXY environment variable.
+  string NoProxy = 3 [(gogoproto.jsontag) = "no_proxy,omitempty"];
 }
 
 // InstallParamEnrollMode is the mode used to enroll the node into the cluster.
@@ -8543,6 +9199,9 @@ message AzureMatcher {
   // Params sets the join method when installing on
   // discovered Azure nodes.
   InstallerParams Params = 6 [(gogoproto.jsontag) = "install_params,omitempty"];
+  // Integration is the integration name used to generate credentials to interact with Azure APIs.
+  // Environment credentials will not be used when this value is set.
+  string Integration = 7 [(gogoproto.jsontag) = "integration,omitempty"];
 }
 
 // GCPMatcher matches GCP resources.
@@ -8619,6 +9278,17 @@ message AccessGraphAWSSyncCloudTrailLogs {
   string SQSQueue = 2 [(gogoproto.jsontag) = "sqs_queue,omitempty"];
 }
 
+// AccessGraphAWSSyncEKSAuditLogs defines the settings for ingesting Kubernetes apiserver
+// audit logs from EKS clusters.
+message AccessGraphAWSSyncEKSAuditLogs {
+  // The tags of EKS clusters for which apiserver audit logs should be fetched.
+  wrappers.LabelValues Tags = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "tags,omitempty",
+    (gogoproto.customtype) = "Labels"
+  ];
+}
+
 // AccessGraphAWSSync is a configuration for AWS Access Graph service poll service.
 message AccessGraphAWSSync {
   // Regions are AWS regions to import resources from.
@@ -8629,6 +9299,7 @@ message AccessGraphAWSSync {
   string Integration = 4 [(gogoproto.jsontag) = "integration,omitempty"];
   // Configuration settings for collecting AWS CloudTrail logs via an SQS queue.
   AccessGraphAWSSyncCloudTrailLogs cloud_trail_logs = 5 [(gogoproto.jsontag) = "cloud_trail_logs,omitempty"];
+  AccessGraphAWSSyncEKSAuditLogs eks_audit_logs = 6 [(gogoproto.jsontag) = "eks_audit_logs,omitempty"];
 }
 
 // AccessGraphAzureSync is a configuration for Azure Access Graph service poll service.
diff --git a/api/proto/teleport/machineid/v1/bot_instance.proto b/api/proto/teleport/machineid/v1/bot_instance.proto
index 68ce4835b2139..d31b9b4947262 100644
--- a/api/proto/teleport/machineid/v1/bot_instance.proto
+++ b/api/proto/teleport/machineid/v1/bot_instance.proto
@@ -20,6 +20,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 import "teleport/header/v1/metadata.proto";
+import "teleport/legacy/types/types.proto";
 import "teleport/workloadidentity/v1/join_attrs.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1;machineidv1";
@@ -83,11 +84,42 @@ message BotInstanceStatusHeartbeat {
   string architecture = 8;
   // The OS of the host that `tbot` is running on, determined by runtime.GOOS.
   string os = 9;
+  // Identifies the external updater process.
+  string external_updater = 10;
+  // Identifies the external updated version. Empty if no updater is configured.
+  string external_updater_version = 11;
+  // Information provided by the external updater, including the update group
+  // and updater status.
+  types.UpdaterV2Info updater_info = 12;
+
+  // Identifies whether the bot is running in the tbot binary or embedded in
+  // another component.
+  BotKind kind = 13;
+
   // In future iterations, additional information can be submitted here.
   // For example, the configuration of `tbot` or the health of individual
   // outputs.
 }
 
+// BotKind identifies whether the bot is the tbot binary or embedded in another
+// component.
+enum BotKind {
+  // The enum zero-value, it means no kind was included.
+  BOT_KIND_UNSPECIFIED = 0;
+
+  // Means the bot is running the tbot binary.
+  BOT_KIND_TBOT = 1;
+
+  // Means the bot is running inside one of our Terraform providers.
+  BOT_KIND_TERRAFORM_PROVIDER = 2;
+
+  // Means the bot is running inside the Teleport Kubernetes operator.
+  BOT_KIND_KUBERNETES_OPERATOR = 3;
+
+  // Means the bot is running inside tctl (e.g. `tctl terraform env`)
+  BOT_KIND_TCTL = 4;
+}
+
 // BotInstanceStatusAuthentication contains information about a join or renewal.
 // Ths information is entirely sourced by the Auth Server and can be trusted.
 message BotInstanceStatusAuthentication {
@@ -135,4 +167,47 @@ message BotInstanceStatus {
   BotInstanceStatusHeartbeat initial_heartbeat = 3;
   // The N most recent heartbeats for this bot instance.
   repeated BotInstanceStatusHeartbeat latest_heartbeats = 4;
+  // The health of the services/output `tbot` is running.
+  repeated BotInstanceServiceHealth service_health = 5;
+}
+
+// BotInstanceServiceHealth is a snapshot of a `tbot` service's health.
+message BotInstanceServiceHealth {
+  // Service identifies the service.
+  BotInstanceServiceIdentifier service = 1;
+
+  // Status describes the service's healthiness.
+  BotInstanceHealthStatus status = 2;
+
+  // Reason is a human-readable explanation for the service's status. It might
+  // include an error message.
+  optional string reason = 3;
+
+  // UpdatedAt is the time at which the service's health last changed.
+  google.protobuf.Timestamp updated_at = 4;
+}
+
+// BotInstanceServiceIdentifier uniquely identifies a `tbot` service.
+message BotInstanceServiceIdentifier {
+  // Type of service (e.g. database-tunnel, ssh-multiplexer).
+  string type = 1;
+
+  // Name of the service, either given by the user or auto-generated.
+  string name = 2;
+}
+
+// BotInstanceHealthStatus describes the healthiness of a `tbot` service.
+enum BotInstanceHealthStatus {
+  // The enum zero-value, it means no status was included.
+  BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED = 0;
+
+  // Means the service is still "starting up" and hasn't reported its status.
+  BOT_INSTANCE_HEALTH_STATUS_INITIALIZING = 1;
+
+  // Means the service is healthy and ready to serve traffic, or it has
+  // recently succeeded in generating an output.
+  BOT_INSTANCE_HEALTH_STATUS_HEALTHY = 2;
+
+  // Means the service is failing to serve traffic or generate output.
+  BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY = 3;
 }
diff --git a/api/proto/teleport/machineid/v1/bot_instance_service.proto b/api/proto/teleport/machineid/v1/bot_instance_service.proto
index 8f1d2fb2fefb7..bc3469f895ab6 100644
--- a/api/proto/teleport/machineid/v1/bot_instance_service.proto
+++ b/api/proto/teleport/machineid/v1/bot_instance_service.proto
@@ -17,6 +17,7 @@ syntax = "proto3";
 package teleport.machineid.v1;
 
 import "google/protobuf/empty.proto";
+import "teleport/legacy/types/types.proto";
 import "teleport/machineid/v1/bot_instance.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1;machineidv1";
@@ -45,6 +46,41 @@ message ListBotInstancesRequest {
   string page_token = 3;
   // A search term used to filter the results. If non-empty, it's used to match against supported fields.
   string filter_search_term = 4;
+  // The sort config to use for the results. If empty, the default sort field and order is used.
+  types.SortBy sort = 5;
+}
+
+// Request for ListBotInstancesV2.
+//
+// Follows the pagination semantics of
+// https://cloud.google.com/apis/design/standard_methods#list
+message ListBotInstancesV2Request {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The page_token value returned from a previous ListBotInstancesV2 request,
+  // if any.
+  string page_token = 2;
+  // The sort field to use for the results. If empty, the default sort field is
+  // used.
+  string sort_field = 3;
+  // The sort order to use for the results. If empty, the default sort order is
+  // used.
+  bool sort_desc = 4;
+  // Fields used to filter the results
+  Filters filter = 5;
+
+  // Filters contains fields to be used to filter the results.
+  message Filters {
+    // The name of the Bot to list BotInstances for. If non-empty, only
+    // BotInstances for that bot will be listed.
+    string bot_name = 1;
+    // A search term used to filter the results. If non-empty, it's used to
+    // match against supported fields.
+    string search_term = 2;
+    // A Teleport predicate language query used to filter the results.
+    string query = 3;
+  }
 }
 
 // Response for ListBotInstances.
@@ -68,6 +104,9 @@ message DeleteBotInstanceRequest {
 message SubmitHeartbeatRequest {
   // The heartbeat data to submit.
   BotInstanceStatusHeartbeat heartbeat = 1;
+
+  // The health of the services/output `tbot` is running.
+  repeated BotInstanceServiceHealth service_health = 2;
 }
 
 // The response for SubmitHeartbeat.
@@ -80,7 +119,12 @@ service BotInstanceService {
   // GetBotInstance returns the specified BotInstance resource.
   rpc GetBotInstance(GetBotInstanceRequest) returns (BotInstance);
   // ListBotInstances returns a page of BotInstance resources.
-  rpc ListBotInstances(ListBotInstancesRequest) returns (ListBotInstancesResponse);
+  // Deprecated: Use ListBotInstancesV2 instead
+  rpc ListBotInstances(ListBotInstancesRequest) returns (ListBotInstancesResponse) {
+    option deprecated = true;
+  }
+  // ListBotInstancesV2 returns a page of BotInstance resources.
+  rpc ListBotInstancesV2(ListBotInstancesV2Request) returns (ListBotInstancesResponse);
   // DeleteBotInstance hard deletes the specified BotInstance resource.
   rpc DeleteBotInstance(DeleteBotInstanceRequest) returns (google.protobuf.Empty);
   // SubmitHeartbeat submits a heartbeat for a BotInstance.
diff --git a/api/proto/teleport/okta/v1/okta_service.proto b/api/proto/teleport/okta/v1/okta_service.proto
index 4e6c562dec2ec..541e94939a5ae 100644
--- a/api/proto/teleport/okta/v1/okta_service.proto
+++ b/api/proto/teleport/okta/v1/okta_service.proto
@@ -138,6 +138,11 @@ message CreateIntegrationRequest {
   bool enable_system_log_export = 11;
   // Whether to assign the builtin okta-requester role to all Okta synced users.
   bool disable_assign_default_roles = 12;
+  // TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+  // groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+  // bidirectional sync is enabled. It will be rounded down to the nearest second The default value
+  // is 1800 (30 minutes).
+  google.protobuf.Duration time_between_imports = 13;
 }
 
 // UpdateIntegrationRequest is the request message for updating an existing Okta integration.
@@ -166,6 +171,11 @@ message UpdateIntegrationRequest {
   bool enable_system_log_export = 11;
   // Whether to assign the builtin okta-requester role to all Okta synced users.
   bool disable_assign_default_roles = 12;
+  // TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+  // groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+  // bidirectional sync is enabled. It will be rounded down to the nearest second. The default
+  // value is 1800 (30 minutes).
+  google.protobuf.Duration time_between_imports = 13;
 }
 
 // AccessListSettings contains the settings for access list synchronization.
diff --git a/api/proto/teleport/plugins/v1/plugin_service.proto b/api/proto/teleport/plugins/v1/plugin_service.proto
index 95599618cd811..fd5677cdfa6d7 100644
--- a/api/proto/teleport/plugins/v1/plugin_service.proto
+++ b/api/proto/teleport/plugins/v1/plugin_service.proto
@@ -143,6 +143,37 @@ message SearchPluginStaticCredentialsRequest {
   map<string, string> labels = 1;
 }
 
+// CredentialQuery is a set of values to match when searching for credentials
+message CredentialQuery {
+  map<string, string> labels = 1;
+}
+
+// UpdatePluginStaticCredentialsRequest holds information for updating a plugin
+// static credential. The service will attempt to find the credential to update
+// based on the supplied plugin name and labels.
+message UpdatePluginStaticCredentialsRequest {
+  oneof target {
+    // Name is the name of the plugin static credentials resource that we're
+    // targeting
+    string name = 1;
+
+    // Query is the search query that a credential must match in order to be
+    // updated. The update will only proceed if exactly one credential matches
+    // the search query.
+    CredentialQuery query = 2;
+  }
+
+  // Credential is the payload containing the updated credential. Only the spec
+  // is allowed to be updated via this interface.
+  types.PluginStaticCredentialsSpecV1 credential = 3;
+}
+
+// UpdatePluginStaticCredentialsResponse holds the updated credential returned
+// from UpdatePluginStaticCredentials
+message UpdatePluginStaticCredentialsResponse {
+  types.PluginStaticCredentialsV1 credential = 1;
+}
+
 // SearchPluginStaticCredentialsResponse is the response type for
 // SearchPluginStaticCredentials
 message SearchPluginStaticCredentialsResponse {
@@ -210,10 +241,41 @@ service PluginService {
   // RoleProxy.
   rpc SearchPluginStaticCredentials(SearchPluginStaticCredentialsRequest) returns (SearchPluginStaticCredentialsResponse);
 
+  // UpdatePluginStaticCredentials
+  rpc UpdatePluginStaticCredentials(UpdatePluginStaticCredentialsRequest) returns (UpdatePluginStaticCredentialsResponse);
+
   // NeedsCleanup will indicate whether a plugin of the given type needs cleanup
   // before it can be created.
   rpc NeedsCleanup(NeedsCleanupRequest) returns (NeedsCleanupResponse);
 
   // Cleanup will clean up the resources for the given plugin type.
   rpc Cleanup(CleanupRequest) returns (google.protobuf.Empty);
+
+  // CreatePluginOauthToken issues a short-lived OAuth access token for the specified plugin.
+  //
+  // This endpoint supports the OAuth 2.0 "client_credentials" grant type, where the plugin
+  // authenticates using its client ID and client secret
+  rpc CreatePluginOauthToken(CreatePluginOauthTokenRequest) returns (CreatePluginOauthTokenResponse);
+}
+
+// CreatePluginOauthTokenRequest is the request type for creating an OAuth token for a plugin.
+message CreatePluginOauthTokenRequest {
+  // plugin_name is the name of the plugin for which the OAuth token is requested.
+  string plugin_name = 1;
+  // client_id is the OAuth client identifier issued to the plugin.
+  string client_id = 2;
+  // client_secret is the secret associated with the client_id.
+  string client_secret = 3;
+  // grant_type is the OAuth 2.0 grant type being used. Currently, only "client_credentials" is supported.
+  string grant_type = 4;
+}
+
+// CreatePluginOauthTokenResponse is the response type for a successful OAuth token creation.
+message CreatePluginOauthTokenResponse {
+  // access_token is the generated token issued to the plugin.
+  string access_token = 1;
+  // token_type describes the type of the token issued
+  string token_type = 2;
+  // expires_in is the number of seconds until the token expires.
+  int64 expires_in = 3;
 }
diff --git a/api/proto/teleport/presence/v1/relay_server.proto b/api/proto/teleport/presence/v1/relay_server.proto
new file mode 100644
index 0000000000000..1354ecaee06b4
--- /dev/null
+++ b/api/proto/teleport/presence/v1/relay_server.proto
@@ -0,0 +1,64 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.presence.v1;
+
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1;presencev1";
+
+// A heartbeat for a relay service; this message serves as both the type used in
+// the v1 service and as the canonical v1 storage format (in protojson).
+message RelayServer {
+  // fixed string, "relay_server".
+  string kind = 1;
+  // fixed string, "".
+  string sub_kind = 2;
+  // fixed string, "v1".
+  string version = 3;
+
+  teleport.header.v1.Metadata metadata = 4;
+
+  // resource spec
+  message Spec {
+    // host IDs of Proxy Service instances that this server is available on
+    // through a reverse tunnel
+    repeated string proxy_ids = 1;
+
+    // configured hostname (or nodename) of the machine, for troubleshooting and
+    // debugging
+    string hostname = 2;
+
+    // the name of the Relay group this server belongs to
+    string relay_group = 3;
+
+    // address and port that this server is reachable at by other Relay Service
+    // instance of the same group
+    string peer_addr = 4;
+
+    // random string chosen for the duration of the process, for troubleshooting
+    // and debugging
+    string nonce = 5;
+
+    // set after the Teleport instance has received a termination signal (but
+    // hasn't necessarily began shutting down)
+    bool terminating = 6;
+  }
+  Spec spec = 5;
+  // The advertized scope of the server. A server's scope can not change once assigned, so
+  // heartbeats must include a scope value matching the one declared in the hello message.
+  string scope = 6;
+}
diff --git a/api/proto/teleport/presence/v1/service.proto b/api/proto/teleport/presence/v1/service.proto
index 325d5b68ee093..68e07a2fb49b6 100644
--- a/api/proto/teleport/presence/v1/service.proto
+++ b/api/proto/teleport/presence/v1/service.proto
@@ -19,6 +19,7 @@ package teleport.presence.v1;
 import "google/protobuf/empty.proto";
 import "google/protobuf/field_mask.proto";
 import "teleport/legacy/types/types.proto";
+import "teleport/presence/v1/relay_server.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1;presencev1";
 
@@ -39,6 +40,18 @@ service PresenceService {
   rpc UpsertReverseTunnel(UpsertReverseTunnelRequest) returns (types.ReverseTunnelV2);
   // DeleteReverseTunnel removes an existing ReverseTunnel by name.
   rpc DeleteReverseTunnel(DeleteReverseTunnelRequest) returns (google.protobuf.Empty);
+
+  // GetRelayServer returns a single relay_server by name.
+  rpc GetRelayServer(GetRelayServerRequest) returns (GetRelayServerResponse);
+  // ListRelayServers returns a page of relay_server resources.
+  rpc ListRelayServers(ListRelayServersRequest) returns (ListRelayServersResponse);
+  // DeleteRelayServer deletes a relay_server resource by name.
+  rpc DeleteRelayServer(DeleteRelayServerRequest) returns (DeleteRelayServerResponse);
+
+  // ListAuthServers returns a page of Auth servers.
+  rpc ListAuthServers(ListAuthServersRequest) returns (ListAuthServersResponse);
+  // ListProxyServers returns a page of Proxy servers.
+  rpc ListProxyServers(ListProxyServersRequest) returns (ListProxyServersResponse);
 }
 
 // Request for GetRemoteCluster
@@ -115,3 +128,77 @@ message DeleteReverseTunnelRequest {
   // Name is the name of the ReverseTunnel to delete.
   string name = 1;
 }
+
+// Request message for the PresenceService.GetRelayServer rpc.
+message GetRelayServerRequest {
+  string name = 1;
+}
+
+// Response message for the PresenceService.GetRelayServer rpc.
+message GetRelayServerResponse {
+  RelayServer relay_server = 1;
+}
+
+// Request message for the PresenceService.ListRelayServers rpc.
+message ListRelayServersRequest {
+  // The maximum number of items to return. The service may return fewer than
+  // this value. If unspecified, the service will use a sensible default.
+  int64 page_size = 1;
+
+  // A pagination token returned from a previous request. If empty, the request
+  // will return the first page.
+  string page_token = 2;
+}
+
+// Response message for the PresenceService.ListRelayServers rpc.
+message ListRelayServersResponse {
+  repeated RelayServer relays = 1;
+
+  // A token that can be sent as the page_token to retrieve the next page. If
+  // this field is empty, there are no more pages.
+  string next_page_token = 2;
+}
+
+// Request message for the PresenceService.DeleteRelayServer rpc.
+message DeleteRelayServerRequest {
+  string name = 1;
+}
+
+// Response message for the PresenceService.DeleteRelayServer rpc.
+message DeleteRelayServerResponse {}
+
+// Request message for the PresenceService.ListAuthServers rpc.
+message ListAuthServersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+// Response message for the PresenceService.ListAuthServers rpc.
+message ListAuthServersResponse {
+  // A list of auth server resources.
+  repeated types.ServerV2 servers = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
+// Request message for the PresenceService.ListProxyServers rpc.
+message ListProxyServersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+// Response message for the PresenceService.ListProxyServers rpc.
+message ListProxyServersResponse {
+  // A list of proxy server resources.
+  repeated types.ServerV2 servers = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
diff --git a/api/proto/teleport/provisioning/v1/provisioning_service.proto b/api/proto/teleport/provisioning/v1/provisioning_service.proto
deleted file mode 100644
index a477786bd0698..0000000000000
--- a/api/proto/teleport/provisioning/v1/provisioning_service.proto
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2024 Gravitational, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package teleport.provisioning.v1;
-
-import "google/protobuf/empty.proto";
-
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1;provisioningv1";
-
-// ProvisioningService provides methods to manage Provisioning resources.
-service ProvisioningService {
-  // DeleteDownstreamProvisioningStates deletes all Identity Center provisioning state for a given downstream.
-  rpc DeleteDownstreamProvisioningStates(DeleteDownstreamProvisioningStatesRequest) returns (google.protobuf.Empty);
-}
-
-// DeleteDownstreamProvisioningStatesRequest is a request to delete all provisioning states for
-// a given DownstreamId.
-message DeleteDownstreamProvisioningStatesRequest {
-  // DownstreamId identifies the downstream service that this state applies to.
-  string downstream_id = 1;
-}
diff --git a/api/proto/teleport/recordingencryption/v1/recording_encryption.proto b/api/proto/teleport/recordingencryption/v1/recording_encryption.proto
new file mode 100644
index 0000000000000..e8addac57d980
--- /dev/null
+++ b/api/proto/teleport/recordingencryption/v1/recording_encryption.proto
@@ -0,0 +1,91 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.recordingencryption.v1;
+
+import "teleport/header/v1/metadata.proto";
+import "teleport/legacy/types/types.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1;recordingencryptionv1";
+
+// The possible states a KeyPair can be in.
+enum KeyPairState {
+  // Unspecified value
+  KEY_PAIR_STATE_UNSPECIFIED = 0;
+  // Represents an active key.
+  KEY_PAIR_STATE_ACTIVE = 1;
+  // Represents a key in the process of being rotated.
+  KEY_PAIR_STATE_ROTATING = 2;
+  // Represents a key being rotated in that is inaccessible to at least one
+  // auth server.
+  KEY_PAIR_STATE_INACCESSIBLE = 3;
+}
+
+// A key pair used with age to wrap and unwrap file keys for session recording encryption.
+message KeyPair {
+  // A key pair used with age to wrap and unwrap file keys for session recording encryption.
+  types.EncryptionKeyPair key_pair = 1;
+  // The current state of the key pair.
+  KeyPairState state = 2;
+}
+
+// RecordingEncryptionSpec contains the active key set for encrypted session recording.
+message RecordingEncryptionSpec {
+  reserved 1; // active_keys
+  reserved "active_keys";
+
+  // A list of active key pairs used for session recording encryption. The unique set of
+  // active public keys are used as recipients during age encryption. This allows any
+  // active private key to be used during decryption which guards against recordings being
+  // inaccessible to auth servers waiting for key rotation.
+  repeated KeyPair active_key_pairs = 2;
+}
+
+// RecordingEncryptionStatus contains the status of the RecordingEncryption resource.
+message RecordingEncryptionStatus {}
+
+// RecordingEncryption contains cluster state for encrypted session recordings.
+message RecordingEncryption {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+  RecordingEncryptionSpec spec = 5;
+  RecordingEncryptionStatus status = 6;
+}
+
+// A rotated key pair previously used with age to wrap and unwrap file keys for session recording
+// encryption.
+message RotatedKeySpec {
+  // The rotated key pair previously used with age to wrap and unwrap file keys for session recording
+  // encryption.
+  types.EncryptionKeyPair encryption_key_pair = 2;
+}
+
+// The empty status of a RotatedKey.
+message RotatedKeyStatus {}
+
+// A previously rotated encryption key for session recordings kept for future replay. The metadata.name
+// is expected to be the fingerprint of the public key contained in the spec, which is a hex encoded
+// SHA256 hash of its PKIX form.
+message RotatedKey {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+  RotatedKeySpec spec = 5;
+  RotatedKeyStatus status = 6;
+}
diff --git a/api/proto/teleport/recordingencryption/v1/recording_encryption_service.proto b/api/proto/teleport/recordingencryption/v1/recording_encryption_service.proto
new file mode 100644
index 0000000000000..a4590271265f3
--- /dev/null
+++ b/api/proto/teleport/recordingencryption/v1/recording_encryption_service.proto
@@ -0,0 +1,141 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.recordingencryption.v1;
+
+import "google/protobuf/timestamp.proto";
+import "teleport/recordingencryption/v1/recording_encryption.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1;recordingencryptionv1";
+
+// RecordingEncryption provides methods to manage cluster encryption configuration resources.
+service RecordingEncryptionService {
+  // CreateUpload begins a multipart upload for an encrypted recording. The
+  // returned upload ID should be used while uploading parts.
+  rpc CreateUpload(CreateUploadRequest) returns (CreateUploadResponse);
+  // UploadPart uploads a part to the given upload ID.
+  rpc UploadPart(UploadPartRequest) returns (UploadPartResponse);
+  // CompleteUploadRequest marks a multipart upload as complete.
+  rpc CompleteUpload(CompleteUploadRequest) returns (CompleteUploadResponse);
+
+  // RotateKey rotates the key pair used for encrypting session recording data.
+  rpc RotateKey(RotateKeyRequest) returns (RotateKeyResponse);
+  // GetRotationState returns whether or not a rotation is in progress.
+  rpc GetRotationState(GetRotationStateRequest) returns (GetRotationStateResponse);
+  // CompleteRotation moves rotated keys out of the active set.
+  rpc CompleteRotation(CompleteRotationRequest) returns (CompleteRotationResponse);
+  // RollbackRotation removes active keys and reverts rotating keys back to being active.
+  rpc RollbackRotation(RollbackRotationRequest) returns (RollbackRotationResponse);
+}
+
+// The handle to an upload for an encrypted session.
+message Upload {
+  // The primary identifier for an Upload.
+  string upload_id = 1;
+  // The session ID an upload is tied to.
+  string session_id = 2;
+  // The time that an upload was created at.
+  google.protobuf.Timestamp initiated_at = 3;
+}
+
+// The request to start a multipart upload for a specific session recording.
+message CreateUploadRequest {
+  // The session ID associated with the recording being uploaded.
+  string session_id = 1;
+}
+
+// The resulting Upload message for a created Upload.
+message CreateUploadResponse {
+  // The handle for the created Upload.
+  Upload upload = 1;
+}
+
+// The request to upload a single part in a multipart upload.
+message UploadPartRequest {
+  // The handle to the in-progress upload that should be uploaded to.
+  Upload upload = 1;
+  // The ordered index applied to the part.
+  int64 part_number = 2;
+  // The encrypted part of session recording data being uploaded.
+  bytes part = 3;
+  // Whether this is the last upload part in the upload.
+  bool is_last = 4;
+}
+
+// The resulting metadata about an uploaded part.
+message Part {
+  // The ordered index applied to the part.
+  int64 part_number = 1;
+  // The part e-tag value relevant to some storage backends.
+  string etag = 2;
+}
+
+// A successfully uploaded Part to be included in the final CompleteUpload request.
+message UploadPartResponse {
+  // The resulting part metadata about an uploaded part.
+  Part part = 1;
+}
+
+// The request to complete an upload. The included part numbers must match the parts successfully
+// uploaded up until this point.
+message CompleteUploadRequest {
+  // The handle to an upload to complete.
+  Upload upload = 1;
+  // The parts expected to be successfully uploaded.
+  repeated Part parts = 2;
+}
+
+// The body of a CompleteUpload request.
+message CompleteUploadResponse {}
+
+// The body of a RotateKey request.
+message RotateKeyRequest {}
+
+// The return value of a RotateKey request.
+message RotateKeyResponse {}
+
+// The body of a GetRotationState request.
+message GetRotationStateRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+// A public key fingerprint coupled with its current state.
+message FingerprintWithState {
+  // A fingerprint identifying the public key of a KeyPair.
+  string fingerprint = 1;
+  // The state associated with the identified KeyPair.
+  v1.KeyPairState state = 2;
+}
+
+// The current state of all active encryption key pairs.
+message GetRotationStateResponse {
+  string next_page_token = 1;
+  // The state of all active encryption key pairs.
+  repeated FingerprintWithState key_pair_states = 2;
+}
+
+// The body of a CompleteRotation request.
+message CompleteRotationRequest {}
+
+// The return value of a CompleteRotation request.
+message CompleteRotationResponse {}
+
+// The body of a RollbackRotation request.
+message RollbackRotationRequest {}
+
+// The return value of a RollbackRotation request
+message RollbackRotationResponse {}
diff --git a/api/proto/teleport/recordingmetadata/v1/recordingmetadata.proto b/api/proto/teleport/recordingmetadata/v1/recordingmetadata.proto
new file mode 100644
index 0000000000000..1a0f2f0638b0c
--- /dev/null
+++ b/api/proto/teleport/recordingmetadata/v1/recordingmetadata.proto
@@ -0,0 +1,111 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// SessionRecordingEvent is an event that occurred during a session recording.
+
+syntax = "proto3";
+
+package teleport.recordingmetadata.v1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1;recordingmetadatav1";
+
+// SessionRecordingEvent represents an event that occurred during a session recording.
+message SessionRecordingEvent {
+  // StartOffset is the start time of the event, relative to the start of the session.
+  google.protobuf.Duration start_offset = 1;
+  // EndOffset is the end time of the event, relative to the start of the session.
+  google.protobuf.Duration end_offset = 2;
+
+  oneof event {
+    // Inactivity is an event that indicates inactivity during the session.
+    SessionRecordingInactivityEvent inactivity = 3;
+    // Join is an event that indicates a user joined the session.
+    SessionRecordingJoinEvent join = 4;
+    // Resize is an event that indicates the terminal was resized.
+    SessionRecordingResizeEvent resize = 5;
+  }
+}
+
+// SessionRecordingInactivityEvent is an event that indicates inactivity during the session.
+message SessionRecordingInactivityEvent {}
+
+// SessionRecordingJoinEvent is an event that indicates a user joined the session.
+message SessionRecordingJoinEvent {
+  // User is the name of the user who joined the session.
+  string user = 1;
+}
+
+// SessionRecordingResizeEvent is an event that indicates the terminal was resized.
+message SessionRecordingResizeEvent {
+  // Cols is the number of columns in the terminal.
+  int32 cols = 1;
+  // Rows is the number of rows in the terminal.
+  int32 rows = 2;
+}
+
+// SessionRecordingType is the type of session recording.
+enum SessionRecordingType {
+  // SessionRecordingTypeUnspecified is the default value for session recording type.
+  SESSION_RECORDING_TYPE_UNSPECIFIED = 0;
+  // SessionRecordingTypeSsh is an interactive SSH session recording.
+  SESSION_RECORDING_TYPE_SSH = 1;
+  // SessionRecordingTypeKubernetes is an interactive Kubernetes session recording.
+  SESSION_RECORDING_TYPE_KUBERNETES = 2;
+}
+
+// SessionRecordingMetadata contains metadata for a session recording.
+message SessionRecordingMetadata {
+  // Duration is the duration of the session recording.
+  google.protobuf.Duration duration = 1;
+  // Events is the events that occurred during the session.
+  repeated SessionRecordingEvent events = 2;
+  // StartCols is the number of columns in the terminal at the start of the session.
+  int32 start_cols = 3;
+  // StartRows is the number of rows in the terminal at the start of the session.
+  int32 start_rows = 4;
+  // StartTime is the start time of the session recording.
+  google.protobuf.Timestamp start_time = 5;
+  // EndTime is the end time of the session recording.
+  google.protobuf.Timestamp end_time = 6;
+  // ClusterName is the name of the cluster where the session recording took place.
+  string cluster_name = 7;
+  // User is the user whose session is being recorded.
+  string user = 8;
+  // ResourceName is the name of the resource that was connected to.
+  string resource_name = 9;
+  // Type is the type of session recording.
+  SessionRecordingType type = 10;
+}
+
+// SessionRecordingThumbnail is a thumbnail of a session recording.
+message SessionRecordingThumbnail {
+  // SVG is the SVG image of the thumbnail.
+  bytes svg = 1;
+  // Cols is the number of columns in the terminal.
+  int32 cols = 2;
+  // Rows is the number of rows in the terminal.
+  int32 rows = 3;
+  // CursorX is the X coordinate of the cursor.
+  int32 cursor_x = 4;
+  // CursorY is the Y coordinate of the cursor.
+  int32 cursor_y = 5;
+  // StartOffset is the start time of the thumbnail, relative to the start of the session.
+  google.protobuf.Duration start_offset = 6;
+  // EndOffset is the end time of the thumbnail, relative to the start of the session.
+  google.protobuf.Duration end_offset = 7;
+  // CursorVisible indicates whether the cursor is visible.
+  bool cursor_visible = 8;
+}
diff --git a/api/proto/teleport/recordingmetadata/v1/recordingmetadata_service.proto b/api/proto/teleport/recordingmetadata/v1/recordingmetadata_service.proto
new file mode 100644
index 0000000000000..c0271cd62989f
--- /dev/null
+++ b/api/proto/teleport/recordingmetadata/v1/recordingmetadata_service.proto
@@ -0,0 +1,58 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.recordingmetadata.v1;
+
+import "teleport/recordingmetadata/v1/recordingmetadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1;recordingmetadatav1";
+
+// RecordingMetadataService provides methods to retrieve metadata and thumbnails for a session recording.
+service RecordingMetadataService {
+  // GetThumbnail retrieves the thumbnail for a session recording.
+  rpc GetThumbnail(GetThumbnailRequest) returns (GetThumbnailResponse);
+  // GetMetadata retrieves the metadata for a session recording.
+  rpc GetMetadata(GetMetadataRequest) returns (stream GetMetadataResponseChunk);
+}
+
+// GetMetadataResponseChunk is a chunked response for retrieving a session's metadata.
+// It can contain either metadata or a frame from the session recording.
+message GetMetadataResponseChunk {
+  oneof chunk {
+    // Metadata contains the metadata of the session recording.
+    teleport.recordingmetadata.v1.SessionRecordingMetadata metadata = 1;
+    // Frame contains a frame from the session recording.
+    teleport.recordingmetadata.v1.SessionRecordingThumbnail frame = 2;
+  }
+}
+
+// GetThumbnailRequest is a request for a session's thumbnail.
+message GetThumbnailRequest {
+  // SessionId is the ID of the session whose thumbnail is being requested.
+  string session_id = 1;
+}
+
+// GetThumbnailResponse is a response for retrieving a session's thumbnail.
+message GetThumbnailResponse {
+  // Thumbnail is the thumbnail for the session.
+  teleport.recordingmetadata.v1.SessionRecordingThumbnail thumbnail = 1;
+}
+
+// GetMetadataRequest is a request for retrieving a session's metadata.
+message GetMetadataRequest {
+  // SessionId is the ID of the session whose metadata is being requested.
+  string session_id = 1;
+}
diff --git a/api/proto/teleport/scim/v1/scim_service.proto b/api/proto/teleport/scim/v1/scim_service.proto
index dbdd26beeb6ca..336b2e54f97b2 100644
--- a/api/proto/teleport/scim/v1/scim_service.proto
+++ b/api/proto/teleport/scim/v1/scim_service.proto
@@ -40,11 +40,17 @@ service SCIMService {
 
   // DeleteSCIMResource deletes a SCIM-managed resource
   rpc DeleteSCIMResource(DeleteSCIMResourceRequest) returns (google.protobuf.Empty);
+
+  // PatchSCIMResource handles a request to patch a resource as per RFC 7644
+  // Section 3.5.2.
+  //
+  // See https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2
+  rpc PatchSCIMResource(PatchSCIMResourceRequest) returns (Resource);
 }
 
 // ListSCIMResourcesRequest represents a request to fetch multiple resources
 message ListSCIMResourcesRequest {
-  // Target describes the set of requested by the client, vy integration and
+  // Target describes the set of requested by the client, by integration and
   // resource type.
   RequestTarget target = 1;
 
@@ -82,7 +88,7 @@ message UpdateSCIMResourceRequest {
   Resource resource = 2;
 }
 
-// DeleteSCIMResourceRequest describes a request to delete a SCIM-mamanged
+// DeleteSCIMResourceRequest describes a request to delete a SCIM-mananged
 // resource
 message DeleteSCIMResourceRequest {
   // Target is the owner, type and ID if the resource targeted by the request.
@@ -148,3 +154,18 @@ message Page {
   uint64 start_index = 1;
   uint64 count = 2;
 }
+
+// PatchSCIMResourceRequest describes a SCIM PATCH operation as per RFC 7644
+// Section 3.5.2. The PATCH operation allows modifying a resource with a set of
+// change operations, enabling partial updates without replacing the entire
+// resource.
+//
+// See https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2
+message PatchSCIMResourceRequest {
+  // Target identifies the resource to patch
+  RequestTarget target = 1;
+
+  // Payload is the SCIM PATCH Request payload containing the Operations array
+  // and schemas as defined in RFC 7644 Section 3.5.2.
+  google.protobuf.Struct payload = 2;
+}
diff --git a/api/proto/teleport/scopedrole/v1/role.proto b/api/proto/teleport/scopedrole/v1/role.proto
deleted file mode 100644
index f133493aa9cba..0000000000000
--- a/api/proto/teleport/scopedrole/v1/role.proto
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package teleport.scopedrole.v1;
-
-import "teleport/header/v1/metadata.proto";
-
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedrole";
-
-// ScopedRole is a role whose resource and permissions are scoped. Scoped roles implement a subset of role
-// features tailored to the usecases of scoped access and scoped access administration. Scoped roles may be
-// assigned to the same user multiple times at various scopes. Scoped roles do not contain deny rules.
-message ScopedRole {
-  // Kind is the resource kind.
-  string kind = 1;
-
-  // SubKind is the resource sub-kind.
-  string sub_kind = 2;
-
-  // Version is the resource version.
-  string version = 3;
-
-  // Metadata contains the resource metadata.
-  teleport.header.v1.Metadata metadata = 4;
-
-  // Scope is the scope of the role resource.
-  string scope = 5;
-
-  // Spec is the role specification.
-  ScopedRoleSpec spec = 6;
-}
-
-// ScopedRoleSpec is the specification of a scoped role.
-message ScopedRoleSpec {
-  // AssignableScopes is a list of scopes to which this role can be assigned.
-  repeated string assignable_scopes = 1;
-
-  // TODO(fspmarshall): port relevant role features to scoped roles.
-}
diff --git a/api/proto/teleport/scopedrole/v1/service.proto b/api/proto/teleport/scopedrole/v1/service.proto
deleted file mode 100644
index 3b0ace0a69f83..0000000000000
--- a/api/proto/teleport/scopedrole/v1/service.proto
+++ /dev/null
@@ -1,195 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package teleport.scopedrole.v1;
-
-import "teleport/scopedrole/v1/assignment.proto";
-import "teleport/scopedrole/v1/role.proto";
-import "teleport/scopes/v1/scopes.proto";
-
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedrole";
-
-// ScopedRoleService provides an API for managing scoped role resources and their assignments.
-service ScopedRoleService {
-  // GetScopedRole gets a scoped role by name.
-  rpc GetScopedRole(GetScopedRoleRequest) returns (GetScopedRoleResponse);
-
-  // ListScopedRoles returns a paginated list of scoped roles.
-  rpc ListScopedRoles(ListScopedRolesRequest) returns (ListScopedRolesResponse);
-
-  // CreateScopedRole creates a new scoped role.
-  rpc CreateScopedRole(CreateScopedRoleRequest) returns (CreateScopedRoleResponse);
-
-  // UpdateScopedRole updates a scoped role.
-  rpc UpdateScopedRole(UpdateScopedRoleRequest) returns (UpdateScopedRoleResponse);
-
-  // DeleteScopedRole deletes a scoped role.
-  rpc DeleteScopedRole(DeleteScopedRoleRequest) returns (DeleteScopedRoleResponse);
-
-  // GetScopedRoleAssignment gets a scoped role assignment by name.
-  rpc GetScopedRoleAssignment(GetScopedRoleAssignmentRequest) returns (GetScopedRoleAssignmentResponse);
-
-  // ListScopedRoleAssignments returns a paginated list of scoped role assignments.
-  rpc ListScopedRoleAssignments(ListScopedRoleAssignmentsRequest) returns (ListScopedRoleAssignmentsResponse);
-
-  // CreateScopedRoleAssignment creates a new scoped role assignment.
-  rpc CreateScopedRoleAssignment(CreateScopedRoleAssignmentRequest) returns (CreateScopedRoleAssignmentResponse);
-
-  // DeleteScopedRoleAssignment deletes a scoped role assignment.
-  rpc DeleteScopedRoleAssignment(DeleteScopedRoleAssignmentRequest) returns (DeleteScopedRoleAssignmentResponse);
-}
-
-// GetScopedRoleRequest is the request to get a scoped role.
-message GetScopedRoleRequest {
-  // Name is the name of the scoped role.
-  string name = 1;
-}
-
-// GetScopedRoleResponse is the response to get a scoped role.
-message GetScopedRoleResponse {
-  // Role is the scoped role.
-  ScopedRole role = 1;
-}
-
-// ListScopedRolesRequest is the request to list scoped roles.
-message ListScopedRolesRequest {
-  // PageSize is the maximum number of results to return.
-  int32 page_size = 1;
-
-  // PageToken is the pagination cursor used to start from where a previous request left off.
-  string page_token = 2;
-
-  // ResourceScope filters roles by their resource scope if specified.
-  teleport.scopes.v1.Filter resource_scope = 3;
-
-  // AssignableScope filters roles by their assignable scope if specified.
-  teleport.scopes.v1.Filter assignable_scope = 4;
-}
-
-// ListScopedRolesResponse is the response to list scoped roles.
-message ListScopedRolesResponse {
-  // Roles is the list of scoped roles.
-  repeated ScopedRole roles = 1;
-
-  // NextPageToken is a pagination cursor usable to fetch the next page of results.
-  string next_page_token = 2;
-}
-
-// CreateScopedRoleRequest is the request to create a scoped role.
-message CreateScopedRoleRequest {
-  // Role is the scoped role to create.
-  ScopedRole role = 1;
-}
-
-// CreateScopedRoleResponse is the response to create a scoped role.
-message CreateScopedRoleResponse {
-  // Role is the scoped role that was created.
-  ScopedRole role = 1;
-}
-
-// UpdateScopedRoleRequest is the request to update a scoped role.
-message UpdateScopedRoleRequest {
-  // Role is the scoped role to update.
-  ScopedRole role = 1;
-}
-
-// UpdateScopedRoleResponse is the response to update a scoped role.
-message UpdateScopedRoleResponse {
-  // Role is the post-update scoped role.
-  ScopedRole role = 1;
-}
-
-// DeleteScopedRoleRequest is the request to delete a scoped role.
-message DeleteScopedRoleRequest {
-  // Name is the name of the scoped role to delete.
-  string name = 1;
-
-  // Revision asserts the revision of the scoped role to delete (optional).
-  string revision = 2;
-}
-
-// DeleteScopedRoleResponse is the response to delete a scoped role.
-message DeleteScopedRoleResponse {}
-
-// GetScopedRoleAssignmentRequest is the request to get a scoped role assignment.
-message GetScopedRoleAssignmentRequest {
-  // Name is the name of the scoped role assignment.
-  string name = 1;
-}
-
-// GetScopedRoleAssignmentResponse is the response to get a scoped role assignment.
-message GetScopedRoleAssignmentResponse {
-  // Assignment is the scoped role assignment.
-  ScopedRoleAssignment assignment = 1;
-}
-
-// ListScopedRoleAssignmentsRequest is the request to list scoped role assignments.
-message ListScopedRoleAssignmentsRequest {
-  // PageSize is the maximum number of results to return.
-  int32 page_size = 1;
-
-  // PageToken is the pagination cursor used to start from where a previous request left off.
-  string page_token = 2;
-
-  // ResourceScope filters assignments by their resource scope if specified.
-  teleport.scopes.v1.Filter resource_scope = 3;
-
-  // AssignedScope filters assignments by the scopes they assign to if specified (note: matches assignment
-  // resources with 1 or more maching scopes, not all scopes within the assignment will necessarily match).
-  teleport.scopes.v1.Filter assigned_scope = 4;
-
-  // User optionally limits the list to assignments for a specific user.
-  string user = 5;
-
-  // Role optionally limits the list to assignments for a specific role.
-  string role = 6;
-}
-
-// ListScopedRoleAssignmentsResponse is the response to list scoped role assignments.
-message ListScopedRoleAssignmentsResponse {
-  // Assignments is the list of scoped role assignments.
-  repeated ScopedRoleAssignment assignments = 1;
-
-  // NextPageToken is a pagination cursor usable to fetch the next page of results.
-  string next_page_token = 2;
-}
-
-// CreateScopedRoleAssignmentRequest is the request to create a scoped role assignment.
-message CreateScopedRoleAssignmentRequest {
-  // Assignment is the scoped role assignment to create.
-  ScopedRoleAssignment assignment = 1;
-
-  // RoleRevisions asserts the revisions of the roles assigned by the assignments (optional).
-  map<string, string> role_revisions = 2;
-}
-
-// CreateScopedRoleAssignmentResponse is the response to create a scoped role assignment.
-message CreateScopedRoleAssignmentResponse {
-  // Assignment is the scoped role assignment that was created.
-  ScopedRoleAssignment assignment = 1;
-}
-
-// DeleteScopedRoleAssignmentRequest is the request to delete a scoped role assignment.
-message DeleteScopedRoleAssignmentRequest {
-  // Name is the name of the scoped role assignment to delete.
-  string name = 1;
-
-  // Revision asserts the revision of the scoped role assignment to delete (optional).
-  string revision = 2;
-}
-
-// DeleteScopedRoleAssignmentResponse is the response to delete a scoped role assignment.
-message DeleteScopedRoleAssignmentResponse {}
diff --git a/api/proto/teleport/scopedtoken/v1/service.proto b/api/proto/teleport/scopedtoken/v1/service.proto
deleted file mode 100644
index b410e5d4a19c1..0000000000000
--- a/api/proto/teleport/scopedtoken/v1/service.proto
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright 2025 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package teleport.scopedtoken.v1;
-
-import "teleport/scopedtoken/v1/token.proto";
-import "teleport/scopes/v1/scopes.proto";
-
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedtoken/v1;scopedtoken";
-
-// ScopedTokenService provides an API for managing scoped token resources and their assignments.
-service ScopedTokenService {
-  // GetScopedToken gets a scoped token by name.
-  rpc GetScopedToken(GetScopedTokenRequest) returns (GetScopedTokenResponse);
-
-  // ListScopedTokens returns a paginated list of scoped tokens.
-  rpc ListScopedTokens(ListScopedTokensRequest) returns (ListScopedTokensResponse);
-
-  // CreateScopedToken creates a new scoped token.
-  rpc CreateScopedToken(CreateScopedTokenRequest) returns (CreateScopedTokenResponse);
-
-  // UpdateScopedToken updates a scoped token.
-  rpc UpdateScopedToken(UpdateScopedTokenRequest) returns (UpdateScopedTokenResponse);
-
-  // DeleteScopedToken deletes a scoped token.
-  rpc DeleteScopedToken(DeleteScopedTokenRequest) returns (DeleteScopedTokenResponse);
-}
-
-// GetScopedTokenRequest is the request to get a scoped token.
-message GetScopedTokenRequest {
-  // Name is the name of the scoped token.
-  string name = 1;
-}
-
-// GetScopedTokenResponse is the response to get a scoped token.
-message GetScopedTokenResponse {
-  // Token is the scoped token.
-  ScopedToken token = 1;
-}
-
-// ListScopedTokensRequest is the request to list scoped tokens.
-message ListScopedTokensRequest {
-  // ResourceScope filters tokens by their resource scope if specified.
-  teleport.scopes.v1.Filter resource_scope = 1;
-
-  // AssignedScope filters tokens by their assigned scope if specified.
-  teleport.scopes.v1.Filter assigned_scope = 2;
-
-  // Cursor is the pagination cursor.
-  string cursor = 3;
-
-  // Limit is the maximum number of results to return.
-  uint32 limit = 4;
-}
-
-// ListScopedTokensResponse is the response to list scoped tokens.
-message ListScopedTokensResponse {
-  // Tokens is the list of scoped tokens.
-  repeated ScopedToken tokens = 1;
-
-  // Cursor is the pagination cursor.
-  string cursor = 2;
-}
-
-// CreateScopedTokenRequest is the request to create a scoped token.
-message CreateScopedTokenRequest {
-  // Token is the scoped token to create.
-  ScopedToken token = 1;
-}
-
-// CreateScopedTokenResponse is the response to create a scoped token.
-message CreateScopedTokenResponse {
-  // Token is the scoped token that was created.
-  ScopedToken token = 1;
-}
-
-// UpdateScopedTokenRequest is the request to update a scoped token.
-message UpdateScopedTokenRequest {
-  // Token is the scoped token to update.
-  ScopedToken token = 1;
-}
-
-// UpdateScopedTokenResponse is the response to update a scoped token.
-message UpdateScopedTokenResponse {
-  // Token is the post-update scoped token.
-  ScopedToken token = 1;
-}
-
-// DeleteScopedTokenRequest is the request to delete a scoped token.
-message DeleteScopedTokenRequest {
-  // Name is the name of the scoped token to delete.
-  string name = 1;
-
-  // Revision asserts the revision of the scoped token to delete (optional).
-  string revision = 2;
-}
-
-// DeleteScopedTokenResponse is the response to delete a scoped token.
-message DeleteScopedTokenResponse {}
diff --git a/api/proto/teleport/scopedrole/v1/assignment.proto b/api/proto/teleport/scopes/access/v1/assignment.proto
similarity index 96%
rename from api/proto/teleport/scopedrole/v1/assignment.proto
rename to api/proto/teleport/scopes/access/v1/assignment.proto
index adc3d0f355134..983efcf25685f 100644
--- a/api/proto/teleport/scopedrole/v1/assignment.proto
+++ b/api/proto/teleport/scopes/access/v1/assignment.proto
@@ -14,11 +14,11 @@
 
 syntax = "proto3";
 
-package teleport.scopedrole.v1;
+package teleport.scopes.access.v1;
 
 import "teleport/header/v1/metadata.proto";
 
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1;scopedrole";
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1";
 
 // ScopedRoleAssignment is a role assignment whose resource and permissions are scoped. A scoped role assignment
 // assigns roles to users at scopes. One assignment may contain multiple roles at multiple scopes. Most assignments
diff --git a/api/proto/teleport/scopes/access/v1/role.proto b/api/proto/teleport/scopes/access/v1/role.proto
new file mode 100644
index 0000000000000..442170f31a083
--- /dev/null
+++ b/api/proto/teleport/scopes/access/v1/role.proto
@@ -0,0 +1,76 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.scopes.access.v1;
+
+import "teleport/header/v1/metadata.proto";
+import "teleport/label/v1/label.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1";
+
+// ScopedRole is a role whose resource and permissions are scoped. Scoped roles implement a subset of role
+// features tailored to the usecases of scoped access and scoped access administration. Scoped roles may be
+// assigned to the same user multiple times at various scopes. Scoped roles do not contain deny rules.
+message ScopedRole {
+  // Kind is the resource kind.
+  string kind = 1;
+
+  // SubKind is the resource sub-kind.
+  string sub_kind = 2;
+
+  // Version is the resource version.
+  string version = 3;
+
+  // Metadata contains the resource metadata.
+  teleport.header.v1.Metadata metadata = 4;
+
+  // Scope is the scope of the role resource.
+  string scope = 5;
+
+  // Spec is the role specification.
+  ScopedRoleSpec spec = 6;
+}
+
+// ScopedRoleSpec is the specification of a scoped role.
+message ScopedRoleSpec {
+  // AssignableScopes is a list of scopes to which this role can be assigned.
+  repeated string assignable_scopes = 1;
+
+  // Allow specifies the permissions granted by this role.
+  ScopedRoleConditions allow = 2;
+}
+
+// ScopedRoleConditions describes a role's allow block.
+message ScopedRoleConditions {
+  // Rules describe basic resource:verb permissions.
+  repeated ScopedRule rules = 1;
+
+  // Logins is the list of host logins this role allows.
+  repeated string logins = 2;
+
+  // NodeLabels is a map of node labels (used to dynamically grant access to
+  // nodes).
+  repeated teleport.label.v1.Label node_labels = 3;
+}
+
+// Rule maps resources to verbs. This is the underlying type used to describe
+// permissions like 'node:read' or 'role:create'.
+message ScopedRule {
+  // Resources is a list of resource kinds (e.g. 'scoped_token') that the below verbs apply to.
+  repeated string resources = 1;
+  // Verbs is the list of action verbs (e.g. 'read') that apply to the above resources.
+  repeated string verbs = 2;
+}
diff --git a/api/proto/teleport/scopes/access/v1/service.proto b/api/proto/teleport/scopes/access/v1/service.proto
new file mode 100644
index 0000000000000..bf3200e5270ed
--- /dev/null
+++ b/api/proto/teleport/scopes/access/v1/service.proto
@@ -0,0 +1,203 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.scopes.access.v1;
+
+import "teleport/scopes/access/v1/assignment.proto";
+import "teleport/scopes/access/v1/role.proto";
+import "teleport/scopes/v1/scopes.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1;accessv1";
+
+// ScopedAccessService provides an API for managing scoped access-control resources.
+service ScopedAccessService {
+  // GetScopedRole gets a scoped role by name.
+  rpc GetScopedRole(GetScopedRoleRequest) returns (GetScopedRoleResponse);
+
+  // ListScopedRoles returns a paginated list of scoped roles.
+  rpc ListScopedRoles(ListScopedRolesRequest) returns (ListScopedRolesResponse);
+
+  // CreateScopedRole creates a new scoped role.
+  rpc CreateScopedRole(CreateScopedRoleRequest) returns (CreateScopedRoleResponse);
+
+  // UpdateScopedRole updates a scoped role.
+  rpc UpdateScopedRole(UpdateScopedRoleRequest) returns (UpdateScopedRoleResponse);
+
+  // DeleteScopedRole deletes a scoped role. Note that scoped role deletion is always
+  // conditional. Scoped roles cannot be deleted if referenced by any existing assignment
+  // and deletes may fail due to concurrent modification.
+  rpc DeleteScopedRole(DeleteScopedRoleRequest) returns (DeleteScopedRoleResponse);
+
+  // GetScopedRoleAssignment gets a scoped role assignment by name.
+  rpc GetScopedRoleAssignment(GetScopedRoleAssignmentRequest) returns (GetScopedRoleAssignmentResponse);
+
+  // ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+  rpc ListScopedRoleAssignments(ListScopedRoleAssignmentsRequest) returns (ListScopedRoleAssignmentsResponse);
+
+  // CreateScopedRoleAssignment creates a new scoped role assignment.
+  rpc CreateScopedRoleAssignment(CreateScopedRoleAssignmentRequest) returns (CreateScopedRoleAssignmentResponse);
+
+  // DeleteScopedRoleAssignment deletes a scoped role assignment.
+  rpc DeleteScopedRoleAssignment(DeleteScopedRoleAssignmentRequest) returns (DeleteScopedRoleAssignmentResponse);
+}
+
+// GetScopedRoleRequest is the request to get a scoped role.
+message GetScopedRoleRequest {
+  // Name is the name of the scoped role.
+  string name = 1;
+}
+
+// GetScopedRoleResponse is the response to get a scoped role.
+message GetScopedRoleResponse {
+  // Role is the scoped role.
+  ScopedRole role = 1;
+}
+
+// ListScopedRolesRequest is the request to list scoped roles.
+message ListScopedRolesRequest {
+  // PageSize is the maximum number of results to return.
+  int32 page_size = 1;
+
+  // PageToken is the pagination cursor used to start from where a previous request left off.
+  string page_token = 2;
+
+  // ResourceScope filters roles by their resource scope if specified.
+  teleport.scopes.v1.Filter resource_scope = 3;
+
+  // AssignableScope filters roles by their assignable scope if specified.
+  teleport.scopes.v1.Filter assignable_scope = 4;
+}
+
+// ListScopedRolesResponse is the response to list scoped roles.
+message ListScopedRolesResponse {
+  // Roles is the list of scoped roles.
+  repeated ScopedRole roles = 1;
+
+  // NextPageToken is a pagination cursor usable to fetch the next page of results.
+  string next_page_token = 2;
+}
+
+// CreateScopedRoleRequest is the request to create a scoped role.
+message CreateScopedRoleRequest {
+  // Role is the scoped role to create.
+  ScopedRole role = 1;
+}
+
+// CreateScopedRoleResponse is the response to create a scoped role.
+message CreateScopedRoleResponse {
+  // Role is the scoped role that was created.
+  ScopedRole role = 1;
+}
+
+// UpdateScopedRoleRequest is the request to update a scoped role.
+message UpdateScopedRoleRequest {
+  // Role is the scoped role to update.
+  ScopedRole role = 1;
+}
+
+// UpdateScopedRoleResponse is the response to update a scoped role.
+message UpdateScopedRoleResponse {
+  // Role is the post-update scoped role.
+  ScopedRole role = 1;
+}
+
+// DeleteScopedRoleRequest is the request to delete a scoped role.
+message DeleteScopedRoleRequest {
+  // Name is the name of the scoped role to delete.
+  string name = 1;
+
+  // Revision asserts the revision of the scoped role to delete (optional).
+  string revision = 2;
+}
+
+// DeleteScopedRoleResponse is the response to delete a scoped role.
+message DeleteScopedRoleResponse {}
+
+// GetScopedRoleAssignmentRequest is the request to get a scoped role assignment.
+message GetScopedRoleAssignmentRequest {
+  // Name is the name of the scoped role assignment.
+  string name = 1;
+}
+
+// GetScopedRoleAssignmentResponse is the response to get a scoped role assignment.
+message GetScopedRoleAssignmentResponse {
+  // Assignment is the scoped role assignment.
+  ScopedRoleAssignment assignment = 1;
+}
+
+// ListScopedRoleAssignmentsRequest is the request to list scoped role assignments.
+message ListScopedRoleAssignmentsRequest {
+  // PageSize is the maximum number of results to return.
+  int32 page_size = 1;
+
+  // PageToken is the pagination cursor used to start from where a previous request left off.
+  string page_token = 2;
+
+  // ResourceScope filters assignments by their resource scope if specified.
+  teleport.scopes.v1.Filter resource_scope = 3;
+
+  // AssignedScope filters assignments by the scopes they assign to if specified (note: matches assignment
+  // resources with 1 or more maching scopes, not all scopes within the assignment will necessarily match).
+  teleport.scopes.v1.Filter assigned_scope = 4;
+
+  // User optionally limits the list to assignments for a specific user.
+  string user = 5;
+
+  // Role optionally limits the list to assignments for a specific role.
+  string role = 6;
+
+  // AllCallerAssignments, if set to true, overrides the default behavior in favor of returning all
+  // assignments that apply to the caller, including those assigned in parent/orthogonal scopes. This flag
+  // is specifically used to support users discovering where they have been granted privileges across scopes,
+  // and is not intended for general use.
+  bool all_caller_assignments = 7;
+}
+
+// ListScopedRoleAssignmentsResponse is the response to list scoped role assignments.
+message ListScopedRoleAssignmentsResponse {
+  // Assignments is the list of scoped role assignments.
+  repeated ScopedRoleAssignment assignments = 1;
+
+  // NextPageToken is a pagination cursor usable to fetch the next page of results.
+  string next_page_token = 2;
+}
+
+// CreateScopedRoleAssignmentRequest is the request to create a scoped role assignment.
+message CreateScopedRoleAssignmentRequest {
+  // Assignment is the scoped role assignment to create.
+  ScopedRoleAssignment assignment = 1;
+
+  // RoleRevisions asserts the revisions of the roles assigned by the assignments (optional).
+  map<string, string> role_revisions = 2;
+}
+
+// CreateScopedRoleAssignmentResponse is the response to create a scoped role assignment.
+message CreateScopedRoleAssignmentResponse {
+  // Assignment is the scoped role assignment that was created.
+  ScopedRoleAssignment assignment = 1;
+}
+
+// DeleteScopedRoleAssignmentRequest is the request to delete a scoped role assignment.
+message DeleteScopedRoleAssignmentRequest {
+  // Name is the name of the scoped role assignment to delete.
+  string name = 1;
+
+  // Revision asserts the revision of the scoped role assignment to delete (optional).
+  string revision = 2;
+}
+
+// DeleteScopedRoleAssignmentResponse is the response to delete a scoped role assignment.
+message DeleteScopedRoleAssignmentResponse {}
diff --git a/api/proto/teleport/scopes/joining/v1/service.proto b/api/proto/teleport/scopes/joining/v1/service.proto
new file mode 100644
index 0000000000000..8d1311f24aee1
--- /dev/null
+++ b/api/proto/teleport/scopes/joining/v1/service.proto
@@ -0,0 +1,118 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.scopes.joining.v1;
+
+import "teleport/scopes/joining/v1/token.proto";
+import "teleport/scopes/v1/scopes.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1;joiningv1";
+
+// ScopedJoiningService provides an API for managing scoped cluster joining resources.
+service ScopedJoiningService {
+  // GetScopedToken gets a scoped token by name.
+  rpc GetScopedToken(GetScopedTokenRequest) returns (GetScopedTokenResponse);
+
+  // ListScopedTokens returns a paginated list of scoped tokens.
+  rpc ListScopedTokens(ListScopedTokensRequest) returns (ListScopedTokensResponse);
+
+  // CreateScopedToken creates a new scoped token.
+  rpc CreateScopedToken(CreateScopedTokenRequest) returns (CreateScopedTokenResponse);
+
+  // UpdateScopedToken updates a scoped token.
+  rpc UpdateScopedToken(UpdateScopedTokenRequest) returns (UpdateScopedTokenResponse);
+
+  // DeleteScopedToken deletes a scoped token.
+  rpc DeleteScopedToken(DeleteScopedTokenRequest) returns (DeleteScopedTokenResponse);
+}
+
+// GetScopedTokenRequest is the request to get a scoped token.
+message GetScopedTokenRequest {
+  // Name is the name of the scoped token.
+  string name = 1;
+}
+
+// GetScopedTokenResponse is the response to get a scoped token.
+message GetScopedTokenResponse {
+  // Token is the scoped token.
+  ScopedToken token = 1;
+}
+
+// ListScopedTokensRequest is the request to list scoped tokens.
+message ListScopedTokensRequest {
+  // Filter tokens by their resource scope.
+  teleport.scopes.v1.Filter resource_scope = 1;
+
+  // Filter tokens by their assigned scope.
+  teleport.scopes.v1.Filter assigned_scope = 2;
+
+  // The pagination cursor.
+  string cursor = 3;
+
+  // The maximum number of results to return.
+  uint32 limit = 4;
+
+  // Filter tokens that apply at least one of the provided roles.
+  repeated string roles = 5;
+
+  // Filter tokens that match all provided labels.
+  map<string, string> labels = 6;
+}
+
+// ListScopedTokensResponse is the response to list scoped tokens.
+message ListScopedTokensResponse {
+  // Tokens is the list of scoped tokens.
+  repeated ScopedToken tokens = 1;
+
+  // Cursor is the pagination cursor.
+  string cursor = 2;
+}
+
+// CreateScopedTokenRequest is the request to create a scoped token.
+message CreateScopedTokenRequest {
+  // Token is the scoped token to create.
+  ScopedToken token = 1;
+}
+
+// CreateScopedTokenResponse is the response to create a scoped token.
+message CreateScopedTokenResponse {
+  // Token is the scoped token that was created.
+  ScopedToken token = 1;
+}
+
+// UpdateScopedTokenRequest is the request to update a scoped token.
+message UpdateScopedTokenRequest {
+  // Token is the scoped token to update.
+  ScopedToken token = 1;
+}
+
+// UpdateScopedTokenResponse is the response to update a scoped token.
+message UpdateScopedTokenResponse {
+  // Token is the post-update scoped token.
+  ScopedToken token = 1;
+}
+
+// DeleteScopedTokenRequest is the request to delete a scoped token.
+message DeleteScopedTokenRequest {
+  // Name is the name of the scoped token to delete.
+  string name = 1;
+
+  // Revision asserts the revision of the scoped token to delete (optional).
+  string revision = 2;
+}
+
+// DeleteScopedTokenResponse is the response to delete a scoped token.
+message DeleteScopedTokenResponse {}
diff --git a/api/proto/teleport/scopedtoken/v1/token.proto b/api/proto/teleport/scopes/joining/v1/token.proto
similarity index 77%
rename from api/proto/teleport/scopedtoken/v1/token.proto
rename to api/proto/teleport/scopes/joining/v1/token.proto
index 2094ef2e5b825..6b11a02baee66 100644
--- a/api/proto/teleport/scopedtoken/v1/token.proto
+++ b/api/proto/teleport/scopes/joining/v1/token.proto
@@ -14,11 +14,11 @@
 
 syntax = "proto3";
 
-package teleport.scopedtoken.v1;
+package teleport.scopes.joining.v1;
 
 import "teleport/header/v1/metadata.proto";
 
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedtoken/v1;scopedtoken";
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1;joiningv1";
 
 // ScopedToken is a token whose resource and permissions are scoped. Scoped tokens are used for the provisioning
 // of teleport agents locked to specific scopes. Scoped tokens implement a subset of the functionality of standard
@@ -46,8 +46,15 @@ message ScopedToken {
 
 // ScopedTokenSpec is the specification of a scoped token.
 message ScopedTokenSpec {
-  // AssignedScope is the scope to which this token is assigned.
+  // The scope to which this token is assigned.
   string assigned_scope = 1;
 
-  // TODO(fspmarshall): port relevant token features to scoped tokens.
+  // The list of roles associated with the token. They will be converted
+  // to metadata in the SSH and X509 certificates issued to the user of the
+  // token.
+  repeated string roles = 2;
+
+  // The joining method required in order to use this token.
+  // Supported joining methods for scoped tokens only include 'token'.
+  string join_method = 3;
 }
diff --git a/api/proto/teleport/scopes/v1/scopes.proto b/api/proto/teleport/scopes/v1/scopes.proto
index 657724d94b8c3..3b67e51a33985 100644
--- a/api/proto/teleport/scopes/v1/scopes.proto
+++ b/api/proto/teleport/scopes/v1/scopes.proto
@@ -16,7 +16,27 @@ syntax = "proto3";
 
 package teleport.scopes.v1;
 
-option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1;scopes";
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1;scopesv1";
+
+// Pin is a marker that identifies a certificate/identity as being "pinned" to a target scope, and encodes relevant
+// information for access-control evaluation at that scope.
+message Pin {
+  // scope is the target scope that this pin is associated with. This is the scope that the certificate/identity is
+  // pinned to. Any resources in parent/orthogonal scopes are not necessarily subject to the privileges/policies
+  // conveyed by this pin.
+  string scope = 1;
+
+  // assignments encodes the scoped role assignments relevant to access-control decisions about the pinned identity. This may
+  // include assignments to parents of the pinned scope as well as assignments to equivalent/child scopes. Effectively, this
+  // means all assignments that are not orthogonal to the pinned scope.
+  map<string, PinnedAssignments> assignments = 2;
+}
+
+// PinnedAssignments is a collection of scoped role assignments that are relevant to the pinned identity at the target scope.
+message PinnedAssignments {
+  // roles is a list of scoped roles that are assigned to the pinned identity at the target scope.
+  repeated string roles = 1;
+}
 
 // Mode determines the mode of scoping when a query specifies a scope. When a query specifies a scope,
 // one of two questions is typically trying to be answered.  Either, what resources are "in" and/or "subject to"
diff --git a/api/proto/teleport/summarizer/v1/summarizer.proto b/api/proto/teleport/summarizer/v1/summarizer.proto
new file mode 100644
index 0000000000000..c246d0e7bf267
--- /dev/null
+++ b/api/proto/teleport/summarizer/v1/summarizer.proto
@@ -0,0 +1,354 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.summarizer.v1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1;summarizerv1";
+
+// InferenceModel resource specifies a session summarization inference model
+// configuration. It tells Teleport how to use a specific provider and model to
+// summarize sessions.
+message InferenceModel {
+  // Kind is the resource kind. Should always be set to "inference_model".
+  string kind = 1;
+  // SubKind is the resource sub-kind. Should be empty.
+  string sub_kind = 2;
+  // Version is the resource version. Should be set to "v1".
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+  InferenceModelSpec spec = 5;
+}
+
+// InferenceModelSpec specifies the inference provider and provider-specific
+// parameters.
+message InferenceModelSpec {
+  oneof provider {
+    // Openai indicates that this model uses OpenAI as the inference provider
+    // and specifies OpenAI-specific parameters.
+    OpenAIProvider openai = 1;
+    // Bedrock indicates that this model uses Amazon Bedrock as the inference
+    // provider and specifies Bedrock-specific parameters.
+    BedrockProvider bedrock = 3;
+  }
+  // MaxSessionLengthBytes is the maximum session length that can be sent to
+  // inference provider. Currently, it's determined by the size of model's
+  // context window; future versions of Teleport will allow summarizing larger
+  // sessions by splitting them.
+  //
+  // Inference providers will reject requests that are larger than given
+  // model's context window. Since context windows are usually sized in tokens,
+  // this value is an approximation. Assuming 2 bytes per input token should be
+  // safe.
+  //
+  // Currently, Teleport will outright reject sessions larger than this limit;
+  // future versions will split sessions in chunks, treating this size as a
+  // maximum.
+  //
+  // If unset or set to 0, defaults to 1MB.
+  int64 max_session_length_bytes = 2;
+}
+
+// OpenAIProvider specifies OpenAI-specific parameters. It can be used to
+// configure OpenAI or an OpenAI-compatible API, such as LiteLLM.
+message OpenAIProvider {
+  // OpenaiModelId specifies the model ID, as understood by the OpenAI API.
+  string openai_model_id = 1;
+  // Temperature controls the randomness of the model's output.
+  double temperature = 2;
+  // ApiKeySecretRef is a reference to an InferenceSecret that contains the
+  // OpenAI API key.
+  string api_key_secret_ref = 3;
+  // BaseUrl is the OpenAI API base URL. Optional, defaults to the public
+  // OpenAI API URL. May be used to point to a custom OpenAI-compatible API,
+  // such as LiteLLM. In such case, the `api_key_secret_ref` must point to a
+  // secret that contains the API key for that custom API.
+  string base_url = 4;
+}
+
+// BedrockProvider specifies parameters specific to Amazon Bedrock.
+message BedrockProvider {
+  // Region is the AWS region which will be used for inference.
+  string region = 1;
+  // BedrockModelId specifies a model ID or an inference profile as understood
+  // by the Bedrock API.
+  string bedrock_model_id = 2;
+  // Temperature controls the randomness of the model's output.
+  float temperature = 3;
+  // Integration is the AWS OIDC Integration name. If unset, Teleport will use
+  // AWS credentials available on the auth server machine; otherwise, it will
+  // use the specified OIDC integration for assuming appropriate role.
+  string integration = 4;
+}
+
+// InferenceSecret resource stores session summarization inference provider
+// secrets, such as API keys. They need to be referenced by appropriate
+// provider configuration inside `InferenceModelSpec`.
+message InferenceSecret {
+  // Kind is the resource kind. Should always be set to "inference_secret".
+  string kind = 1;
+  // SubKind is the resource sub-kind. Should be empty.
+  string sub_kind = 2;
+  // Version is the resource version. Should be set to "v1".
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+  // Spec contains the secret value. Once set, it can only be read by Teleport
+  // itself; it will not be returned in API responses.
+  InferenceSecretSpec spec = 5;
+}
+
+// InferenceSecretSpec defines the secret value for the inference model.
+message InferenceSecretSpec {
+  // Value is the secret value, such as an API key.
+  string value = 1;
+}
+
+// InferencePolicy resource maps sessions to summarization models.
+message InferencePolicy {
+  // Kind is the resource kind. Should always be set to "inference_policy".
+  string kind = 1;
+  // SubKind is the resource sub-kind. Should be empty.
+  string sub_kind = 2;
+  // Version is the resource version. Should be set to "v1".
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+  InferencePolicySpec spec = 5;
+}
+
+// InferencePolicySpec maps sessions to summarization models using a filter.
+message InferencePolicySpec {
+  // Kinds are session kinds matched by this policy, e.g., "ssh", "k8s", "db"
+  repeated string kinds = 1;
+  // Model is the name of the `InferenceModel` resource to be used for
+  // summarization.
+  string model = 2;
+  // Filter is an optional filter expression using Teleport Predicate Language
+  // to select sessions for summarization. If it's empty, all sessions that
+  // match the list of kinds will be summarized using this model.
+  string filter = 3;
+}
+
+// SummaryState is the state of the summarization process.
+enum SummaryState {
+  SUMMARY_STATE_UNSPECIFIED = 0;
+  SUMMARY_STATE_PENDING = 1;
+  SUMMARY_STATE_SUCCESS = 2;
+  SUMMARY_STATE_ERROR = 3;
+}
+
+// Summary represents a summary of a session recording. This format is used to
+// store the summaries in the session storage and return it with gRPC.
+message Summary {
+  // sessionId is an ID of the session whose recording got summarized.
+  string session_id = 1;
+  // State is the state of the summarization process.
+  SummaryState state = 2;
+  // InferenceStartedAt is the time when the summarization process started.
+  google.protobuf.Timestamp inference_started_at = 3;
+  // InferenceFinishedAt is the time when the summarization process finished.
+  google.protobuf.Timestamp inference_finished_at = 4;
+  // Content is the main text content of the summary, stored in Markdown
+  // format. Available if the state is SUMMARY_STATE_SUCCESS.
+  string content = 5;
+  // ModelName is the name of the `InferenceModel` resource that was used to
+  // generate this summary.
+  string model_name = 6;
+  // SessionEndEvent is the event that ended the summarized session. Session
+  // end events carry the most complete set of data that Teleport has about a
+  // given session. Used for checking access based on RBAC rule "where"
+  // filters.
+  //
+  // The event is stored in an unstructured form, as storing an instance of
+  // events.OneOf posed a number of technical challenges with JSON
+  // serialization as a subcomponent of this message. These challenges stem
+  // from the fact that audit events have gogoproto extensions.
+  google.protobuf.Struct session_end_event = 7;
+  // ErrorMessage is an error message if the summarization failed. Available if
+  // the state is SUMMARY_STATE_ERROR.
+  string error_message = 8;
+  // EnhancedSummary contains structured data extracted from the session.
+  EnhancedSummary enhanced_summary = 9;
+}
+
+// The following enums and messages should be kept in sync with `e/lib/auth/summarizer/schema/command.go`
+
+// CommandCategory represents the category of a command.
+enum CommandCategory {
+  // CommandCategoryUnspecified is the default value and indicates that the command
+  // category is not specified.
+  COMMAND_CATEGORY_UNSPECIFIED = 0;
+  // CommandCategoryFileOperation indicates that the command is related to file
+  // operations, such as copying, moving, or deleting files.
+  COMMAND_CATEGORY_FILE_OPERATION = 1;
+  // CommandCategoryNetwork indicates that the command is related to network
+  // operations, such as connecting to a remote host or transferring data.
+  COMMAND_CATEGORY_NETWORK = 2;
+  // CommandCategoryProcess indicates that the command is related to process
+  // management, such as starting or stopping processes.
+  COMMAND_CATEGORY_PROCESS = 3;
+  // CommandCategorySystemConfig indicates that the command is related to system
+  // configuration, such as changing system settings or installing software.
+  COMMAND_CATEGORY_SYSTEM_CONFIG = 4;
+  // CommandCategoryDataAccess indicates that the command is related to data access,
+  // such as querying databases or reading data files.
+  COMMAND_CATEGORY_DATA_ACCESS = 5;
+  // CommandCategoryAuthentication indicates that the command is related to
+  // authentication, such as logging in or changing user credentials.
+  COMMAND_CATEGORY_AUTHENTICATION = 6;
+  // CommandCategoryOther indicates that the command does not fit into any of the
+  // other categories.
+  COMMAND_CATEGORY_OTHER = 7;
+}
+
+// RiskLevel represents the risk level associated with a command.
+enum RiskLevel {
+  // RiskLevelUnspecified is the default value and indicates that the risk level
+  // is not specified.
+  RISK_LEVEL_UNSPECIFIED = 0;
+  // RiskLevelLow indicates that the command has a low risk level.
+  RISK_LEVEL_LOW = 1;
+  // RiskLevelMedium indicates that the command has a medium risk level.
+  RISK_LEVEL_MEDIUM = 2;
+  // RiskLevelHigh indicates that the command has a high risk level.
+  RISK_LEVEL_HIGH = 3;
+  // RiskLevelCritical indicates that the command has a critical risk level.
+  RISK_LEVEL_CRITICAL = 4;
+}
+
+// ThreatCategory represents the category of a detected threat.
+enum ThreatCategory {
+  // ThreatCategoryUnspecified is the default value and indicates that the threat
+  // category is not specified.
+  THREAT_CATEGORY_UNSPECIFIED = 0;
+  // ThreatCategoryReconnaissance indicates that the threat is related to reconnaissance
+  // activities, such as scanning or probing the system.
+  THREAT_CATEGORY_RECONNAISSANCE = 1;
+  // ThreatCategoryExecution indicates that the threat is related to execution activities,
+  // such as running malicious code.
+  THREAT_CATEGORY_EXECUTION = 2;
+  // ThreatCategoryPersistence indicates that the threat is related to persistence
+  // activities, such as installing backdoors.
+  THREAT_CATEGORY_PERSISTENCE = 3;
+  // ThreatCategoryPrivilegeEscalation indicates that the threat is related to privilege
+  // escalation activities, such as exploiting vulnerabilities to gain higher privileges.
+  THREAT_CATEGORY_PRIVILEGE_ESCALATION = 4;
+  // ThreatCategoryDefenseEvasion indicates that the threat is related to defense evasion
+  // activities, such as disabling security software.
+  THREAT_CATEGORY_DEFENSE_EVASION = 5;
+  // ThreatCategoryCredentialAccess indicates that the threat is related to credential
+  // access activities, such as stealing passwords.
+  THREAT_CATEGORY_CREDENTIAL_ACCESS = 6;
+  // ThreatCategoryDiscovery indicates that the threat is related to discovery activities,
+  // such as gathering information about the system.
+  THREAT_CATEGORY_DISCOVERY = 7;
+  // ThreatCategoryLateralMovement indicates that the threat is related to lateral movement
+  // activities, such as moving laterally within the network.
+  THREAT_CATEGORY_LATERAL_MOVEMENT = 8;
+  // ThreatCategoryCollection indicates that the threat is related to collection activities,
+  // such as collecting sensitive data.
+  THREAT_CATEGORY_COLLECTION = 9;
+  // ThreatCategoryExfiltration indicates that the threat is related to exfiltration
+  // activities, such as stealing data from the system.
+  THREAT_CATEGORY_EXFILTRATION = 10;
+  // ThreatCategoryImpact indicates that the threat is related to impact activities,
+  // such as disrupting system operations.
+  THREAT_CATEGORY_IMPACT = 11;
+  // ThreatCategoryNone indicates that there is no threat detected.
+  THREAT_CATEGORY_NONE = 12;
+}
+
+// CommandAnalysis represents a summary of a single command executed during a
+// session.
+message CommandAnalysis {
+  // Command is the command that was executed.
+  string command = 1;
+  // Category is the category of the command.
+  CommandCategory category = 2;
+  // Success indicates whether the command executed successfully.
+  bool success = 3;
+  // RiskLevel is the risk level associated with the command.
+  RiskLevel risk_level = 4;
+  // RiskScore is a numerical score representing the risk associated with the command.
+  int32 risk_score = 5;
+  // ThreatCategory is the category of any detected threat associated with the command.
+  ThreatCategory threat_category = 6;
+  // TimelineTitle is a brief title for the command's entry in the session timeline.
+  string timeline_title = 7;
+  // TimelineSubtitle is a more detailed subtitle for the command's entry in the session timeline.
+  string timeline_subtitle = 8;
+  // ShortDescription is a concise description of the command and its purpose.
+  string short_description = 9;
+  // DetailedDescription is an in-depth explanation of the command, its function,
+  // and any relevant context.
+  string detailed_description = 10;
+  // ErrorMessages contains any error messages produced during the execution of the command.
+  repeated string error_messages = 11;
+  // SuspiciousFlags contains any suspicious flags or indicators associated with the command.
+  repeated string suspicious_flags = 12;
+  // SensitiveItems contains any sensitive items accessed or modified by the command.
+  repeated string sensitive_items = 13;
+  // SuspiciousPatterns contains any suspicious patterns detected in relation to the command.
+  repeated string suspicious_patterns = 14;
+  // IOCs contains any indicators of compromise associated with the command.
+  repeated string iocs = 15;
+  // MitreAttackIDs contains any MITRE ATT&CK IDs relevant to the command.
+  repeated string mitre_attack_ids = 16;
+  // HasSensitiveData indicates whether the command involved access to or modification of sensitive data.
+  bool has_sensitive_data = 17;
+  // PrivilegeEscalation indicates whether the command involved privilege escalation.
+  bool privilege_escalation = 18;
+  // DataExfiltration indicates whether the command involved data exfiltration.
+  bool data_exfiltration = 19;
+  // Persistence indicates whether the command involved persistence mechanisms.
+  bool persistence = 20;
+  // StartOffset is the start time of the command, relative to the start of the session.
+  google.protobuf.Duration start_offset = 21;
+  // EndOffset is the end time of the command, relative to the start of the session.
+  google.protobuf.Duration end_offset = 22;
+}
+
+// SecurityRecommendation represents a security recommendation related to a command
+message SecurityRecommendation {
+  // Title is a brief title for the security recommendation.
+  string title = 1;
+  // Description is a detailed description of the security recommendation.
+  string description = 2;
+  // Severity indicates the severity level of the recommendation.
+  RiskLevel severity = 3;
+}
+
+// EnhancedSummary represents an enhanced summary of a session recording,
+// with structured data extracted from the session.
+message EnhancedSummary {
+  // ShortDescription is a concise description of the session.
+  string short_description = 1;
+  // DetailedDescription is an in-depth explanation of the session.
+  string detailed_description = 2;
+  // RiskLevel is the overall risk level associated with the session.
+  RiskLevel risk_level = 3;
+  // SuspiciousActivities is a list of suspicious activities detected during the session.
+  repeated string suspicious_activities = 4;
+  // CompromiseIndicators indicates whether any indicators of compromise were detected during the session.
+  bool compromise_indicators = 5;
+  // NotableCommandIndexes is a list of indexes of commands that are considered notable.
+  repeated int32 notable_command_indexes = 6;
+  // Commands is a list of command summaries extracted from the session.
+  repeated CommandAnalysis commands = 7;
+}
diff --git a/api/proto/teleport/summarizer/v1/summarizer_service.proto b/api/proto/teleport/summarizer/v1/summarizer_service.proto
new file mode 100644
index 0000000000000..3085829aa122c
--- /dev/null
+++ b/api/proto/teleport/summarizer/v1/summarizer_service.proto
@@ -0,0 +1,343 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.summarizer.v1;
+
+import "teleport/summarizer/v1/summarizer.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1;summarizerv1";
+
+// SummarizerService is the service for managing summarization inference
+// models, secrets, and policies. These objects configures the session
+// recording summarizer.
+service SummarizerService {
+  // CreateInferenceModel creates a new InferenceModel.
+  rpc CreateInferenceModel(CreateInferenceModelRequest) returns (CreateInferenceModelResponse);
+  // GetInferenceModel retrieves an existing InferenceModel by name.
+  rpc GetInferenceModel(GetInferenceModelRequest) returns (GetInferenceModelResponse);
+  // UpdateInferenceModel updates an existing InferenceModel.
+  rpc UpdateInferenceModel(UpdateInferenceModelRequest) returns (UpdateInferenceModelResponse);
+  // UpsertInferenceModel creates a new InferenceModel or updates an existing
+  // one.
+  rpc UpsertInferenceModel(UpsertInferenceModelRequest) returns (UpsertInferenceModelResponse);
+  // DeleteInferenceModel deletes an existing InferenceModel by name.
+  rpc DeleteInferenceModel(DeleteInferenceModelRequest) returns (DeleteInferenceModelResponse);
+  // ListInferenceModels lists all InferenceModels that match the request.
+  rpc ListInferenceModels(ListInferenceModelsRequest) returns (ListInferenceModelsResponse);
+
+  // CreateInferenceSecret creates a new InferenceSecret.
+  rpc CreateInferenceSecret(CreateInferenceSecretRequest) returns (CreateInferenceSecretResponse);
+  // GetInferenceSecret retrieves an existing InferenceSecret by name.
+  rpc GetInferenceSecret(GetInferenceSecretRequest) returns (GetInferenceSecretResponse);
+  // UpdateInferenceSecret updates an existing InferenceSecret.
+  rpc UpdateInferenceSecret(UpdateInferenceSecretRequest) returns (UpdateInferenceSecretResponse);
+  // UpsertInferenceSecret creates a new InferenceSecret or updates an existing
+  // one.
+  rpc UpsertInferenceSecret(UpsertInferenceSecretRequest) returns (UpsertInferenceSecretResponse);
+  // DeleteInferenceSecret deletes an existing InferenceSecret by name.
+  rpc DeleteInferenceSecret(DeleteInferenceSecretRequest) returns (DeleteInferenceSecretResponse);
+  // ListInferenceSecrets lists all InferenceSecrets that match the request.
+  rpc ListInferenceSecrets(ListInferenceSecretsRequest) returns (ListInferenceSecretsResponse);
+
+  // CreateInferencePolicy creates a new InferencePolicy.
+  rpc CreateInferencePolicy(CreateInferencePolicyRequest) returns (CreateInferencePolicyResponse);
+  // GetInferencePolicy retrieves an existing InferencePolicy by name.
+  rpc GetInferencePolicy(GetInferencePolicyRequest) returns (GetInferencePolicyResponse);
+  // UpdateInferencePolicy updates an existing InferencePolicy.
+  rpc UpdateInferencePolicy(UpdateInferencePolicyRequest) returns (UpdateInferencePolicyResponse);
+  // UpsertInferencePolicy creates a new InferencePolicy or updates an existing
+  // one.
+  rpc UpsertInferencePolicy(UpsertInferencePolicyRequest) returns (UpsertInferencePolicyResponse);
+  // DeleteInferencePolicy deletes an existing InferencePolicy by name.
+  rpc DeleteInferencePolicy(DeleteInferencePolicyRequest) returns (DeleteInferencePolicyResponse);
+  // ListInferencePolicies lists all InferencePolicies that match the request.
+  rpc ListInferencePolicies(ListInferencePoliciesRequest) returns (ListInferencePoliciesResponse);
+
+  // GetSummary retrieves the inference result for a session, which
+  // contains the session summary.
+  rpc GetSummary(GetSummaryRequest) returns (GetSummaryResponse);
+
+  // IsEnabled tells if the summarizer is enabled by the license and
+  // configured. (Note that this doesn't tell anything about actual correctness
+  // of the configuration or presence of recording summaries.)
+  rpc IsEnabled(IsEnabledRequest) returns (IsEnabledResponse);
+}
+
+// Summarization inference models
+
+// CreateInferenceModelRequest is a request for creating an InferenceModel.
+message CreateInferenceModelRequest {
+  // InferenceModel is the InferenceModel resource to create.
+  InferenceModel model = 1;
+}
+
+// CreateInferenceModelResponse is a response to creating an InferenceModel.
+message CreateInferenceModelResponse {
+  // Model is the InferenceModel resource that was created.
+  InferenceModel model = 1;
+}
+
+// GetInferenceModelRequest is a request for retrieving an InferenceModel.
+message GetInferenceModelRequest {
+  // Name is the resource name of the InferenceModel to retrieve.
+  string name = 1;
+}
+
+// GetInferenceModelResponse is a response to retrieving an InferenceModel.
+message GetInferenceModelResponse {
+  // Model is the InferenceModel resource that was retrieved.
+  InferenceModel model = 1;
+}
+
+// UpdateInferenceModelRequest is a request for updating an InferenceModel.
+message UpdateInferenceModelRequest {
+  // Model is the InferenceModel resource to update.
+  InferenceModel model = 1;
+}
+
+// UpdateInferenceModelResponse is a response to updating an InferenceModel.
+message UpdateInferenceModelResponse {
+  // Model is the InferenceModel resource that was updated.
+  InferenceModel model = 1;
+}
+
+// UpsertInferenceModelRequest is a request for creating or updating a
+// InferenceModel.
+message UpsertInferenceModelRequest {
+  // Model is the InferenceModel resource to create or update.
+  InferenceModel model = 1;
+}
+
+// UpsertInferenceModelResponse is a response to creating or updating an
+// InferenceModel.
+message UpsertInferenceModelResponse {
+  // Model is the InferenceModel resource that was created or updated.
+  InferenceModel model = 1;
+}
+
+// DeleteInferenceModelRequest is a request for deleting an InferenceModel.
+message DeleteInferenceModelRequest {
+  // Name is the resource name of the InferenceModel to delete.
+  string name = 1;
+}
+
+// DeleteInferenceModelResponse is a response to deleting an InferenceModel.
+message DeleteInferenceModelResponse {}
+
+// ListInferenceModelsRequest is a request for listing InferenceModels.
+message ListInferenceModelsRequest {
+  // PageSize is the maximum number of items to return. The server may use a
+  // different page size at its discretion.
+  int32 page_size = 1;
+  // PageToken is the next_page_token value returned from a previous List
+  // request, if any.
+  string page_token = 2;
+}
+
+// ListInferenceModelsResponse is the response for listing InferenceModels.
+message ListInferenceModelsResponse {
+  // Models is the page of InferenceModels that matched the request.
+  repeated InferenceModel models = 1;
+  // NextPageToken is the token to retrieve the next page of results, or empty
+  // if there are no more results in the list.
+  string next_page_token = 2;
+}
+
+// Summarization inference secrets
+
+// CreateInferenceSecretRequest is a request for creating an InferenceSecret.
+message CreateInferenceSecretRequest {
+  // InferenceSecret is the InferenceSecret resource
+  // to create.
+  InferenceSecret secret = 1;
+}
+
+// CreateInferenceSecretResponse is a response to creating an InferenceSecret.
+message CreateInferenceSecretResponse {
+  // Secret is the InferenceSecret resource that was created.
+  InferenceSecret secret = 1;
+}
+
+// GetInferenceSecretRequest is a request for retrieving an InferenceSecret.
+message GetInferenceSecretRequest {
+  // Name is the resource name of the InferenceSecret to retrieve.
+  string name = 1;
+}
+
+// GetInferenceSecretResponse is a response to retrieving an InferenceSecret.
+message GetInferenceSecretResponse {
+  // Secret is the InferenceSecret resource that was retrieved.
+  InferenceSecret secret = 1;
+}
+
+// UpdateInferenceSecretRequest is a request for updating an InferenceSecret.
+message UpdateInferenceSecretRequest {
+  // Secret is the InferenceSecret resource to update.
+  InferenceSecret secret = 1;
+}
+
+// UpdateInferenceSecretResponse is a response to updating an InferenceSecret.
+message UpdateInferenceSecretResponse {
+  // Secret is the InferenceSecret resource that was updated.
+  InferenceSecret secret = 1;
+}
+
+// UpsertInferenceSecretRequest is a request for creating or updating an
+// InferenceSecret.
+message UpsertInferenceSecretRequest {
+  // Secret is the InferenceSecret resource to create or update.
+  InferenceSecret secret = 1;
+}
+
+// UpsertInferenceSecretResponse is a response to creating or updating an
+// InferenceSecret.
+message UpsertInferenceSecretResponse {
+  // Secret is the InferenceSecret resource that was created or updated.
+  InferenceSecret secret = 1;
+}
+
+// DeleteInferenceSecretRequest is a request for deleting an InferenceSecret.
+message DeleteInferenceSecretRequest {
+  // Name is the resource name of the InferenceSecret to delete.
+  string name = 1;
+}
+
+// DeleteInferenceSecretResponse is a response to deleting an InferenceSecret.
+message DeleteInferenceSecretResponse {}
+
+// ListInferenceSecretsRequest is a request for listing InferenceSecrets.
+message ListInferenceSecretsRequest {
+  // PageSize is the maximum number of items to return. The server may use a
+  // different page size at its discretion.
+  int32 page_size = 1;
+  // PageToken is the next_page_token value returned from a previous List
+  // request, if any.
+  string page_token = 2;
+}
+
+// ListInferenceSecretsResponse is the response for listing InferenceSecrets.
+message ListInferenceSecretsResponse {
+  // Secrets is the page of InferenceSecrets that matched the
+  // request.
+  repeated InferenceSecret secrets = 1;
+  // NextPageToken is the token to retrieve the next page of results, or empty
+  // if there are no more results in the list.
+  string next_page_token = 2;
+}
+
+// Summarization inference policies
+
+// CreateInferencePolicyRequest is a request for creating an InferencePolicy.
+message CreateInferencePolicyRequest {
+  // InferencePolicy is the InferencePolicy resource to create.
+  InferencePolicy policy = 1;
+}
+
+// CreateInferencePolicyResponse is a response to creating an InferencePolicy.
+message CreateInferencePolicyResponse {
+  // Policy is the InferencePolicy resource that was created.
+  InferencePolicy policy = 1;
+}
+
+// GetInferencePolicyRequest is a request for retrieving an InferencePolicy.
+message GetInferencePolicyRequest {
+  // Name is the resource name of the InferencePolicy to retrieve.
+  string name = 1;
+}
+
+// GetInferencePolicyResponse is a response to retrieving an InferencePolicy.
+message GetInferencePolicyResponse {
+  // Policy is the InferencePolicy resource that was retrieved.
+  InferencePolicy policy = 1;
+}
+
+// UpdateInferencePolicyRequest is a request for updating an InferencePolicy.
+message UpdateInferencePolicyRequest {
+  // Policy is the InferencePolicy resource to update.
+  InferencePolicy policy = 1;
+}
+
+// UpdateInferencePolicyResponse is a response to updating an InferencePolicy.
+message UpdateInferencePolicyResponse {
+  // Policy is the InferencePolicy resource that was updated.
+  InferencePolicy policy = 1;
+}
+
+// UpsertInferencePolicyRequest is a request for creating or updating an
+// InferencePolicy.
+message UpsertInferencePolicyRequest {
+  // Policy is the InferencePolicy resource to create or update.
+  InferencePolicy policy = 1;
+}
+
+// UpsertInferencePolicyResponse is a response to creating or updating an
+// InferencePolicy.
+message UpsertInferencePolicyResponse {
+  // Policy is the InferencePolicy resource that was created or updated.
+  InferencePolicy policy = 1;
+}
+
+// DeleteInferencePolicyRequest is a request for deleting an InferencePolicy.
+message DeleteInferencePolicyRequest {
+  // Name is the resource name of the InferencePolicy to delete.
+  string name = 1;
+}
+
+// DeleteInferencePolicyResponse is a response to deleting an InferencePolicy.
+message DeleteInferencePolicyResponse {}
+
+// ListInferencePoliciesRequest is a request for listing InferencePolicies.
+message ListInferencePoliciesRequest {
+  // PageSize is the maximum number of items to return. The server may use a
+  // different page size at its discretion.
+  int32 page_size = 1;
+  // PageToken is the next_page_token value returned from a previous List
+  // request, if any.
+  string page_token = 2;
+}
+
+// ListInferencePoliciesResponse is the response for listing InferencePolicies.
+message ListInferencePoliciesResponse {
+  // Policies is the page of InferencePolicies that matched the
+  // request.
+  repeated InferencePolicy policies = 1;
+  // NextPageToken is the token to retrieve the next page of results, or empty
+  // if there are no more results in the list.
+  string next_page_token = 2;
+}
+
+// GetSummaryRequest is a request for retrieving a session recording summary.
+message GetSummaryRequest {
+  // SessionId is the ID of the session whose summary is being requested.
+  string session_id = 1;
+}
+
+// GetSummaryResponse is a response to retrieving a session recording summary.
+message GetSummaryResponse {
+  // Summary is the session recording summary.
+  Summary summary = 1;
+}
+
+// IsEnabledRequest is a request to tell if the summarizer is enabled.
+message IsEnabledRequest {}
+
+// IsEnabledResponse is a response that tells if the summarizer is enabled.
+message IsEnabledResponse {
+  // Enabled tells if the summarizer is enabled by the license and configured.
+  // (Note that this doesn't tell anything about actual correctness of the
+  // configuration or presence of recording summaries.)
+  bool enabled = 1;
+}
diff --git a/api/proto/teleport/trust/v1/trust_service.proto b/api/proto/teleport/trust/v1/trust_service.proto
index 7d8748f2375f7..7e4300e3aaade 100644
--- a/api/proto/teleport/trust/v1/trust_service.proto
+++ b/api/proto/teleport/trust/v1/trust_service.proto
@@ -47,6 +47,8 @@ service TrustService {
   rpc CreateTrustedCluster(CreateTrustedClusterRequest) returns (types.TrustedClusterV2);
   // UpdateTrustedCluster updates a Trusted Cluster in a backend.
   rpc UpdateTrustedCluster(UpdateTrustedClusterRequest) returns (types.TrustedClusterV2);
+  // ListTrustedClusters returns a page of current Trusted Cluster resources.
+  rpc ListTrustedClusters(ListTrustedClustersRequest) returns (ListTrustedClustersResponse);
 }
 
 // Request for UpsertTrustedCluster.
@@ -174,3 +176,21 @@ message GenerateHostCertResponse {
   // ssh_certificate is the encoded bytes of the SSH certificate generated by the RPC.
   bytes ssh_certificate = 1;
 }
+
+// ListTrustedClustersRequest is the request for ListTrustedClusters.
+message ListTrustedClustersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+// ListTrustedClustersResponse is the response for ListTrustedClusters.
+message ListTrustedClustersResponse {
+  // TrustedClusters is a list of Trusted Cluster resources.
+  repeated types.TrustedClusterV2 trusted_clusters = 1;
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
diff --git a/api/proto/teleport/usageevents/v1/usageevents.proto b/api/proto/teleport/usageevents/v1/usageevents.proto
index dde7cbea132c1..592b37578e163 100644
--- a/api/proto/teleport/usageevents/v1/usageevents.proto
+++ b/api/proto/teleport/usageevents/v1/usageevents.proto
@@ -147,6 +147,10 @@ enum DiscoverResource {
   DISCOVER_RESOURCE_KUBERNETES_EKS = 40;
 
   DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE = 41;
+
+  DISCOVER_RESOURCE_MCP_STDIO = 42;
+  DISCOVER_RESOURCE_MCP_SSE = 43;
+  DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP = 44;
 }
 
 // DiscoverResourceMetadata contains common metadata identifying resource type being added.
@@ -613,6 +617,8 @@ enum IntegrationEnrollKind {
   INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES = 25;
   INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER = 26;
   INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS = 27;
+  INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD = 28;
+  INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES = 29;
 }
 
 // IntegrationEnrollMetadata contains common metadata
@@ -655,6 +661,12 @@ enum IntegrationEnrollStep {
   INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER = 6;
   INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT = 7;
   INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE = 8;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB = 9;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS = 10;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW = 11;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME = 12;
 }
 
 // IntegrationEnrollStatusCode defines status code for an integration enroll step.
@@ -695,6 +707,89 @@ message UIIntegrationEnrollStepEvent {
   IntegrationEnrollStepStatus status = 3;
 }
 
+// UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+// a section (e.g. "Advanced Options") in an integration setup wizard.
+message UIIntegrationEnrollSectionOpenEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the section was opened.
+  IntegrationEnrollStep step = 2;
+  // Section that was opened.
+  IntegrationEnrollSection section = 3;
+}
+
+// IntegrationEnrollSection identifies a section the user opened or expanded in
+// an integration setup wizard.
+enum IntegrationEnrollSection {
+  INTEGRATION_ENROLL_SECTION_UNSPECIFIED = 0;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS = 1;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER = 2;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS = 3;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER = 4;
+}
+
+// UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+// field in an integration setup wizard.
+message UIIntegrationEnrollFieldCompleteEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the field was completed.
+  IntegrationEnrollStep step = 2;
+  // Field that was completed.
+  IntegrationEnrollField field = 3;
+}
+
+// IntegrationEnrollField identifies a field the user completed in an integration
+// setup wizard.
+enum IntegrationEnrollField {
+  INTEGRATION_ENROLL_FIELD_UNSPECIFIED = 0;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL = 1;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH = 2;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW = 3;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT = 4;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF = 5;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG = 6;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS = 7;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS = 8;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS = 9;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS = 10;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES = 11;
+}
+
+// UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+// IaC (e.g. Terraform) code in an integration setup wizard.
+message UIIntegrationEnrollCodeCopyEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the code was copied.
+  IntegrationEnrollStep step = 2;
+  // Type of code that was copied.
+  IntegrationEnrollCodeType type = 3;
+}
+
+// IntegrationEnrollCodeType identifies the type of code that was copied in an
+// integration setup wizard.
+enum IntegrationEnrollCodeType {
+  INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED = 0;
+  INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM = 1;
+  INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML = 2;
+}
+
+// UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+// documentation, etc. in an integration setup wizard.
+message UIIntegrationEnrollLinkClickEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the link was clicked.
+  IntegrationEnrollStep step = 2;
+  // Link that was clicked.
+  string link = 3;
+}
+
 // ResourceCreateEvent is emitted when a resource is created.
 message ResourceCreateEvent {
   // resource_type is the type of resource ("node", "node.openssh", "db", "k8s", "app").
@@ -915,6 +1010,10 @@ message UsageEventOneOf {
     UIAccessGraphCrownJewelDiffViewEvent ui_access_graph_crown_jewel_diff_view = 59;
     UserTaskStateEvent user_task_state_event = 60;
     UIIntegrationEnrollStepEvent ui_integration_enroll_step_event = 61;
+    UIIntegrationEnrollSectionOpenEvent ui_integration_enroll_section_open_event = 62;
+    UIIntegrationEnrollFieldCompleteEvent ui_integration_enroll_field_complete_event = 63;
+    UIIntegrationEnrollCodeCopyEvent ui_integration_enroll_code_copy_event = 64;
+    UIIntegrationEnrollLinkClickEvent ui_integration_enroll_link_click_event = 65;
   }
   reserved 2; //UIOnboardGetStartedClickEvent
   reserved "ui_onboard_get_started_click";
diff --git a/api/proto/teleport/userloginstate/v1/userloginstate.proto b/api/proto/teleport/userloginstate/v1/userloginstate.proto
index 85e8401161b80..7df86844bf8c8 100644
--- a/api/proto/teleport/userloginstate/v1/userloginstate.proto
+++ b/api/proto/teleport/userloginstate/v1/userloginstate.proto
@@ -32,32 +32,73 @@ message UserLoginState {
 
 // Spec is the specification for a user login state.
 message Spec {
-  // roles are the user roles attached to the user.
+  // roles are the user roles attached to the user. Basically, [roles] = [original_roles] +
+  // [access_list_roles].
   repeated string roles = 1;
 
-  // traits are the traits attached to the user.
+  // traits are the traits attached to the user. Basically, [roles] = [original_traits] +
+  // [access_list_traits].
   repeated teleport.trait.v1.Trait traits = 2;
 
   // user_type is the type of user this state represents.
   string user_type = 3;
 
-  // original_roles are the user roles that are part of the user's static definition. These roles are
-  // not affected by access granted by access lists and are obtained prior to granting access list access.
+  // original_roles are the user roles that are part of the user's static definition. These roles
+  // are not affected by access granted by access lists and are obtained prior to granting access
+  // list access. Basically, [original_roles] = [roles] - [access_list_roles].
   repeated string original_roles = 4;
 
-  // original_traits are the user traits that are part of the user's static definition. These traits are
-  // not affected by access granted by access lists and are obtained prior to granting access list access.
+  // original_traits are the user traits that are part of the user's static definition. These
+  // traits are not affected by access granted by access lists and are obtained prior to granting
+  // access list access. Basically, [original_traits] = [traits] - [access_list_traits].
   repeated teleport.trait.v1.Trait original_traits = 5;
 
   // GitHubIdentity is the external identity attached to this user state.
   ExternalIdentity git_hub_identity = 6;
+
+  // saml_identities are the identities created from the SAML connectors used to log in by this
+  // user name. They are useful for RBAC calculation when there is a user with same username form
+  // multiple SSO connectors, i.e. having multiple SSO indentities.
+  //
+  // NOTE: There is no mechanism to clean those identities. If the the user is deleted, the
+  // user_login_state and it's saml_identities will not be deleted. Or even if the user still
+  // exists, but it's SAML identity expires it isn't cleared from the user_login_state. This means
+  // the information stored here can be used only as long as there is a background sync running and
+  // making sure the user's info is up-to-date. E.g. Okta assignment creator is using this
+  // information, but it is running only when Okta user sync is active and periodically updates the
+  // user which in turn updates the user_login_state.
+  //
+  // NOTE2: This field isn't currently used. It's introduced so we can resolve the
+  // https://github.com/gravitational/teleport.e/issues/6723 issue in stages.
+  // The STAGE 1 is to introduce this field and give enough time to get existing Teleport
+  // installations to get updated and populate this field.
+  // The STAGE 2 is in the v19 release (or maybe even v20) to deploy the actual fix PR
+  // (https://github.com/gravitational/teleport.e/pull/7168) reading this field and calculating
+  // access to Okta resources. See more details in the description of the fix PR.
+  //
+  // TODO(kopiczko) v19: consider proceeding with the STAGE 2 described above.
+  repeated ExternalIdentity saml_identities = 7;
+
+  // access_list_roles are roles granted to this user by the Access Lists
+  // membership/ownership.  Basically, [access_list_roles] = [roles] - [original_roles].
+  repeated string access_list_roles = 8;
+
+  // access_list_traits are traits granted to this user by the Access Lists membership/ownership.
+  // Basically, [access_list_traits] = [traits] - [original_traits].
+  repeated teleport.trait.v1.Trait access_list_traits = 9;
 }
 
 // ExternalIdentity defines an external identity attached to this user state.
 message ExternalIdentity {
-  // UserId is the unique identifier of the external identity such as GitHub user
+  // UserID is the unique identifier of the external identity such as GitHub user
   // ID.
   string user_id = 1;
   // Username is the username of the external identity.
   string username = 2;
+  // ConnectorID is the connector this identity was created with. It's empty for the local user.
+  string connector_id = 3;
+  // GrantedRoles specific for this identity. E.g.: from connector attributes mapping.
+  repeated string granted_roles = 4;
+  // GrantedTraits specific for this identity. E.g.: from connector roles attributes mapping.
+  repeated teleport.trait.v1.Trait granted_traits = 5;
 }
diff --git a/api/proto/teleport/userloginstate/v1/userloginstate_service.proto b/api/proto/teleport/userloginstate/v1/userloginstate_service.proto
index 2c2d203d4efa5..c1b0c09d8016f 100644
--- a/api/proto/teleport/userloginstate/v1/userloginstate_service.proto
+++ b/api/proto/teleport/userloginstate/v1/userloginstate_service.proto
@@ -24,6 +24,7 @@ option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport
 // UserLoginStateService provides CRUD methods for user login state resources.
 service UserLoginStateService {
   // GetUserLoginStates returns a list of all user login states.
+  // Deprecated: Use ListUserLoginStates instead.
   rpc GetUserLoginStates(GetUserLoginStatesRequest) returns (GetUserLoginStatesResponse);
   // GetUserLoginState returns the specified user login state resource.
   rpc GetUserLoginState(GetUserLoginStateRequest) returns (UserLoginState);
@@ -33,6 +34,8 @@ service UserLoginStateService {
   rpc DeleteUserLoginState(DeleteUserLoginStateRequest) returns (google.protobuf.Empty);
   // DeleteAllUserLoginStates hard deletes all user login states.
   rpc DeleteAllUserLoginStates(DeleteAllUserLoginStatesRequest) returns (google.protobuf.Empty);
+  // ListUserLoginStates lists all user login states allowing for pagination.
+  rpc ListUserLoginStates(ListUserLoginStatesRequest) returns (ListUserLoginStatesResponse);
 }
 
 // GetUserLoginStatesRequest is the request for getting all user login states.
@@ -64,3 +67,19 @@ message DeleteUserLoginStateRequest {
 
 // DeleteAllUserLoginStatesRequest is the request for deleting all user login states.
 message DeleteAllUserLoginStatesRequest {}
+
+// ListUserLoginStatesRequest is the request for listing user login states with pagination.
+message ListUserLoginStatesRequest {
+  // page_size is the maximum number of user login states to return.
+  int32 page_size = 1;
+  // page_token is the token for the next page of results.
+  string page_token = 2;
+}
+
+// ListUserLoginStatesResponse is the response for listing user login states with pagination.
+message ListUserLoginStatesResponse {
+  // user_login_states is the list of user login states.
+  repeated UserLoginState user_login_states = 1;
+  // next_page_token is the token for the next page of results.
+  string next_page_token = 2;
+}
diff --git a/api/proto/teleport/workloadidentity/v1/join_attrs.proto b/api/proto/teleport/workloadidentity/v1/join_attrs.proto
index ee78bed71402b..b726f4086cd43 100644
--- a/api/proto/teleport/workloadidentity/v1/join_attrs.proto
+++ b/api/proto/teleport/workloadidentity/v1/join_attrs.proto
@@ -49,6 +49,8 @@ message JoinAttrs {
   JoinAttrsOracle oracle = 13;
   // Attributes that are specific to the Azure Devops (`azure_devops`) join method.
   JoinAttrsAzureDevops azure_devops = 14;
+  // Attributes that are specific to the Env0 (`env0`) join method.
+  JoinAttrsEnv0 env0 = 15;
 }
 
 // The collection of attributes that result from the join process but are not
@@ -358,3 +360,44 @@ message JoinAttrsAzureDevopsPipeline {
   // The ID of the run that is being executed.
   string run_id = 11;
 }
+
+// Attributes that are specific to the Env0 (`env0`) join method.
+message JoinAttrsEnv0 {
+  // The `sub` claim of an Env0 OIDC token.
+  string sub = 1;
+  // The unique organization identifier, corresponding to `organizationId` in an
+  // Env0 OIDC token.
+  string organization_id = 2;
+  // The unique project identifier, corresponding to `projectId` in an Env0 OIDC
+  // token.
+  string project_id = 3;
+  // The name of the project under which the job was run corresponding to
+  // `projectName` in an Env0 OIDC token.
+  string project_name = 4;
+  // The unique identifier of the Env0 template, corresponding to `templateId`
+  // in an Env0 OIDC token.
+  string template_id = 5;
+  // The name of the Env0 template, corresponding to `templateName` in an Env0
+  // OIDC token.
+  string template_name = 6;
+  // The unique identifier of the Env0 environment, corresponding to
+  // `environmentId` in an Env0 OIDC token.
+  string environment_id = 7;
+  // The name of the Env0 environment, corresponding to `environmentName` in an
+  // Env0 OIDC token.
+  string environment_name = 8;
+  // The name of the Env0 workspace, corresponding to `workspaceName` in an Env0
+  // OIDC token.
+  string workspace_name = 9;
+  // A unique ID for this deployment, corresponding to `deploymentLogId` in an
+  // Env0 OIDC token.
+  string deployment_log_id = 10;
+  // The env0 deployment type, such as "deploy", "destroy", etc. Corresponds to
+  // `deploymentType` in an Env0 OIDC token.
+  string deployment_type = 11;
+  // The email of the person that triggered the deployment, corresponding to
+  // `deployerEmail` in an Env0 OIDC token.
+  string deployer_email = 12;
+  // A custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.
+  string env0_tag = 13;
+}
diff --git a/api/proto/teleport/workloadidentity/v1/resource_service.proto b/api/proto/teleport/workloadidentity/v1/resource_service.proto
index 71d41996ec745..9c72ecadc4577 100644
--- a/api/proto/teleport/workloadidentity/v1/resource_service.proto
+++ b/api/proto/teleport/workloadidentity/v1/resource_service.proto
@@ -44,6 +44,10 @@ service WorkloadIdentityResourceService {
   // ListWorkloadIdentities of all workload identities, pagination semantics are
   // applied.
   rpc ListWorkloadIdentities(ListWorkloadIdentitiesRequest) returns (ListWorkloadIdentitiesResponse);
+  // ListWorkloadIdentities of all workload identities, pagination semantics are
+  // applied. Sorting by name or spiffe id is supported, and results can be
+  // filtered using a search term
+  rpc ListWorkloadIdentitiesV2(ListWorkloadIdentitiesV2Request) returns (ListWorkloadIdentitiesResponse);
 }
 
 // The request for CreateWorkloadIdentity.
@@ -85,6 +89,21 @@ message ListWorkloadIdentitiesRequest {
   string page_token = 2;
 }
 
+// The request for ListWorkloadIdentitiesV2.
+message ListWorkloadIdentitiesV2Request {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+  // The page_token value returned from a previous ListWorkloadIdentities request, if any.
+  string page_token = 2;
+  // The sort field to use for the results. If empty, the default sort field is used.
+  string sort_field = 3;
+  // The sort order to use for the results. If empty, the default sort order is used.
+  bool sort_desc = 4;
+  // A search term used to filter the results. If non-empty, it's used to match against supported fields.
+  string filter_search_term = 5;
+}
+
 // The response for ListWorkloadIdentities.
 message ListWorkloadIdentitiesResponse {
   // The page of workload identities that matched the request.
diff --git a/api/types/access_request.go b/api/types/access_request.go
index 590c67b8bca20..2d114ec045cb6 100644
--- a/api/types/access_request.go
+++ b/api/types/access_request.go
@@ -135,8 +135,16 @@ type AccessRequest interface {
 	GetDryRunEnrichment() *AccessRequestDryRunEnrichment
 	// SetDryRunEnrichment sets the dry run enrichment data.
 	SetDryRunEnrichment(*AccessRequestDryRunEnrichment)
+	// GetRequestKind gets the kind of request.
+	GetRequestKind() AccessRequestKind
+	// SetRequestKind sets the kind (short/long-term) of request.
+	SetRequestKind(AccessRequestKind)
 	// Copy returns a copy of the access request resource.
 	Copy() AccessRequest
+	// GetLongTermResourceGrouping gets the long-term resource grouping, if present.
+	GetLongTermResourceGrouping() *LongTermResourceGrouping
+	// SetLongTermResourceGrouping sets the long-term resource grouping.
+	SetLongTermResourceGrouping(*LongTermResourceGrouping)
 }
 
 // NewAccessRequest assembles an AccessRequest resource.
@@ -528,6 +536,36 @@ func (r *AccessRequestV3) SetDryRunEnrichment(enrichment *AccessRequestDryRunEnr
 	r.Spec.DryRunEnrichment = enrichment
 }
 
+// GetRequestKind gets the kind of request.
+func (r *AccessRequestV3) GetRequestKind() AccessRequestKind {
+	return r.Spec.RequestKind
+}
+
+// SetRequestKind sets the kind (short/long-term) of request.
+func (r *AccessRequestV3) SetRequestKind(kind AccessRequestKind) {
+	r.Spec.RequestKind = kind
+}
+
+// GetLongTermResourceGrouping gets the long-term resource grouping, if present.
+func (r *AccessRequestV3) GetLongTermResourceGrouping() *LongTermResourceGrouping {
+	return r.Spec.LongTermGrouping
+}
+
+// SetLongTermResourceGrouping sets the long-term resource grouping suggestion.
+func (r *AccessRequestV3) SetLongTermResourceGrouping(grouping *LongTermResourceGrouping) {
+	r.Spec.LongTermGrouping = grouping
+}
+
+// IsLongTerm checks if the request kind is long-term.
+func (a AccessRequestKind) IsLongTerm() bool {
+	return a == AccessRequestKind_LONG_TERM
+}
+
+// IsShortTerm checks if the request kind is explicitly short-term, or is undefined.
+func (a AccessRequestKind) IsShortTerm() bool {
+	return a != AccessRequestKind_LONG_TERM
+}
+
 // Copy returns a copy of the access request resource.
 func (r *AccessRequestV3) Copy() AccessRequest {
 	return utils.CloneProtoMsg(r)
diff --git a/api/types/accesslist/accesslist.go b/api/types/accesslist/accesslist.go
index 0d45014d9cf0c..9784c72cd5f5b 100644
--- a/api/types/accesslist/accesslist.go
+++ b/api/types/accesslist/accesslist.go
@@ -18,6 +18,7 @@ package accesslist
 
 import (
 	"encoding/json"
+	"slices"
 	"strings"
 	"time"
 
@@ -40,8 +41,6 @@ const (
 	ThreeMonths ReviewFrequency = 3
 	SixMonths   ReviewFrequency = 6
 	OneYear     ReviewFrequency = 12
-
-	twoWeeks = 24 * time.Hour * 14
 )
 
 func (r ReviewFrequency) String() string {
@@ -143,6 +142,11 @@ type AccessList struct {
 
 // Spec is the specification for an access list.
 type Spec struct {
+	// Type can be an empty string which denotes a regular Access List, "scim" which represents
+	// an Access List created from SCIM group or "static" for Access Lists managed by IaC
+	// tools.
+	Type Type `json:"type" yaml:"type"`
+
 	// Title is a plaintext short description of the access list.
 	Title string `json:"title" yaml:"title"`
 
@@ -172,11 +176,52 @@ type Spec struct {
 	OwnerGrants Grants `json:"owner_grants" yaml:"owner_grants"`
 }
 
+type Type string
+
+const (
+	// TODO(kopiczko) v21: Remove DeprecatedDynamic. The only version setting this type is 17.5.4.
+
+	// DeprecatedDynamic is deprecated and should not be used. Use [Default] instead. It has
+	// the same semantic meaning.
+	DeprecatedDynamic Type = "dynamic"
+	// Default Access Lists are the default type supposed to be managed with the web UI. They
+	// require periodic audit reviews.
+	Default Type = ""
+	// Static Access Lists are supposed to be managed with the IaC tools like Terraform. Audit
+	// reviews are not supported for them and the ownership is optional.
+	Static Type = "static"
+	// SCIM Access Lists are created with the SCIM integration. Audit reviews are not supported
+	// for them and the ownership is optional.
+	SCIM Type = "scim"
+)
+
+// AllTypes is a slice of all currently supported access list types.
+var AllTypes = []Type{DeprecatedDynamic, Default, Static, SCIM}
+
+// IsReviewable returns true if the AccessList type supports the audit reviews in the web UI.
+func (t Type) IsReviewable() bool {
+	switch t {
+	case DeprecatedDynamic, Default:
+		return true
+	default:
+		return false
+	}
+}
+
+// Equals checks if the Type is equal to another.
+func (t Type) Equals(other Type) bool {
+	return t == other
+}
+
 // Owner is an owner of an access list.
 type Owner struct {
 	// Name is the username of the owner.
 	Name string `json:"name" yaml:"name"`
 
+	// Title is the title of an owner if it is of type MEMBERSHIP_KIND_LIST.
+	// This is only populated by the proxy when fetching an access list and its members for the web UI
+	Title string `json:"title" yaml:"title"`
+
 	// Description is the plaintext description of the owner and why they are an owner.
 	Description string `json:"description" yaml:"description"`
 
@@ -188,6 +233,22 @@ type Owner struct {
 	MembershipKind string `json:"membership_kind" yaml:"membership_kind"`
 }
 
+// IsMembershipKindUser returns true if the owner is of kind user.
+// All types expect "MEMBERSHIP_KIND_LIST" are treated as "MEMBERSHIP_KIND_USER".
+func (o *Owner) IsMembershipKindUser() bool {
+	return isMembershipKindUser(o.MembershipKind)
+}
+
+func isMembershipKindUser(membershipKind string) bool {
+	switch membershipKind {
+	case MembershipKindUnspecified, MembershipKindUser, "":
+		return true
+	default:
+		// In case if MembershipKind was extended.
+		return false
+	}
+}
+
 // Audit describes the audit configuration for an access list.
 type Audit struct {
 	// NextAuditDate is the date that the next audit should be performed.
@@ -231,6 +292,17 @@ func (r *Requires) IsEmpty() bool {
 	return len(r.Roles) == 0 && len(r.Traits) == 0
 }
 
+// Clone returns a deep copy of the [Requires]
+func (r *Requires) Clone() Requires {
+	if r == nil {
+		return Requires{}
+	}
+	return Requires{
+		Roles:  slices.Clone(r.Roles),
+		Traits: r.Traits.Clone(),
+	}
+}
+
 // Grants describes what access is granted by membership to the access list.
 type Grants struct {
 	// Roles are the roles that are granted to users who are members of the access list.
@@ -254,6 +326,8 @@ type Status struct {
 
 	// CurrentUserAssignments describes the current user's ownership and membership in the access list.
 	CurrentUserAssignments *CurrentUserAssignments `json:"-" yaml:"-"`
+	// UserAssignments describes the requested user's ownership and membership assignment types in the access list.
+	UserAssignments *UserAssignments `json:"-" yaml:"-"`
 }
 
 // CurrentUserAssignments describes the current user's ownership and membership status in the access list.
@@ -274,6 +348,24 @@ func (c *CurrentUserAssignments) IsOwner() bool {
 	return c.OwnershipType != accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
 }
 
+// UserAssignments describes the requested user's ownership and membership assignment types in the access list.
+type UserAssignments struct {
+	// OwnershipType represents the requested user's ownership type (explicit, inherited, or none) in the access list.
+	OwnershipType accesslistv1.AccessListUserAssignmentType `json:"ownership_type" yaml:"ownership_type"`
+	// MembershipType represents the requested user's membership type (explicit, inherited, or none) in the access list.
+	MembershipType accesslistv1.AccessListUserAssignmentType `json:"membership_type" yaml:"membership_type"`
+}
+
+// IsMember returns true if the MembershipType is either explicit or inherited.
+func (u *UserAssignments) IsMember() bool {
+	return u.MembershipType != accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
+}
+
+// IsOwner returns true if the OwnershipType is either explicit or inherited.
+func (u *UserAssignments) IsOwner() bool {
+	return u.OwnershipType != accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED
+}
+
 // NewAccessList will create a new access list.
 func NewAccessList(metadata header.Metadata, spec Spec) (*AccessList, error) {
 	accessList := &AccessList{
@@ -288,7 +380,8 @@ func NewAccessList(metadata header.Metadata, spec Spec) (*AccessList, error) {
 	return accessList, nil
 }
 
-// CheckAndSetDefaults validates fields and populates empty fields with default values.
+// CheckAndSetDefaults performs very basic validation and populates empty fields with default
+// values. The main validation part is performed before the storage.
 func (a *AccessList) CheckAndSetDefaults() error {
 	a.SetKind(types.KindAccessList)
 	a.SetVersion(types.V1)
@@ -297,40 +390,31 @@ func (a *AccessList) CheckAndSetDefaults() error {
 		return trace.Wrap(err)
 	}
 
-	if a.Spec.Title == "" {
-		return trace.BadParameter("access list title required")
-	}
-
-	if len(a.Spec.Owners) == 0 {
-		return trace.BadParameter("owners are missing")
-	}
-
-	if a.Spec.Audit.Recurrence.Frequency == 0 {
-		a.Spec.Audit.Recurrence.Frequency = SixMonths
+	// Restore the type if the cluster was ever running in version 17.5.4.
+	if a.Spec.Type == DeprecatedDynamic {
+		a.Spec.Type = Default
 	}
 
-	switch a.Spec.Audit.Recurrence.Frequency {
-	case OneMonth, ThreeMonths, SixMonths, OneYear:
-	default:
-		return trace.BadParameter("recurrence frequency is an invalid value")
-	}
-
-	if a.Spec.Audit.Recurrence.DayOfMonth == 0 {
-		a.Spec.Audit.Recurrence.DayOfMonth = FirstDayOfMonth
-	}
-
-	switch a.Spec.Audit.Recurrence.DayOfMonth {
-	case FirstDayOfMonth, FifteenthDayOfMonth, LastDayOfMonth:
-	default:
-		return trace.BadParameter("recurrence day of month is an invalid value")
-	}
-
-	if a.Spec.Audit.NextAuditDate.IsZero() {
-		a.setInitialAuditDate(clockwork.NewRealClock())
+	if a.Spec.Title == "" {
+		return trace.BadParameter("access list title required")
 	}
 
-	if a.Spec.Audit.Notifications.Start == 0 {
-		a.Spec.Audit.Notifications.Start = twoWeeks
+	if a.IsReviewable() {
+		if a.Spec.Audit.Recurrence.Frequency == 0 {
+			a.Spec.Audit.Recurrence.Frequency = SixMonths
+		}
+		if a.Spec.Audit.Recurrence.DayOfMonth == 0 {
+			a.Spec.Audit.Recurrence.DayOfMonth = FirstDayOfMonth
+		}
+		if a.Spec.Audit.NextAuditDate.IsZero() {
+			if err := a.setInitialAuditDate(clockwork.NewRealClock()); err != nil {
+				return trace.Wrap(err, "setting initial audit date")
+			}
+		}
+		if a.Spec.Audit.Notifications.Start == 0 {
+			twoWeeks := 24 * time.Hour * 14
+			a.Spec.Audit.Notifications.Start = twoWeeks
+		}
 	}
 
 	// Deduplicate owners. The backend will currently prevent this, but it's possible that access lists
@@ -408,9 +492,12 @@ func (a *AccessList) MatchSearch(values []string) bool {
 
 // Clone returns a copy of the list.
 func (a *AccessList) Clone() *AccessList {
-	var copy *AccessList
-	utils.StrictObjectToStruct(a, &copy)
-	return copy
+	if a == nil {
+		return nil
+	}
+	out := &AccessList{}
+	deriveDeepCopyAccessList(out, a)
+	return out
 }
 
 func (a *Audit) UnmarshalJSON(data []byte) error {
@@ -510,8 +597,17 @@ func (n Notifications) MarshalJSON() ([]byte, error) {
 	})
 }
 
+// IsReviewable returns true if the AccessList type supports the audit reviews in the web UI.
+func (a *AccessList) IsReviewable() bool {
+	return a.Spec.Type.IsReviewable()
+}
+
 // SelectNextReviewDate will select the next review date for the access list.
-func (a *AccessList) SelectNextReviewDate() time.Time {
+func (a *AccessList) SelectNextReviewDate() (time.Time, error) {
+	if !a.IsReviewable() {
+		return time.Time{}, trace.BadParameter("access_list %q is not reviewable", a.GetName())
+	}
+
 	numMonths := int(a.Spec.Audit.Recurrence.Frequency)
 	dayOfMonth := int(a.Spec.Audit.Recurrence.DayOfMonth)
 
@@ -526,15 +622,94 @@ func (a *AccessList) SelectNextReviewDate() time.Time {
 	nextDate := time.Date(currentReviewDate.Year(), currentReviewDate.Month()+time.Month(numMonths), dayOfMonth,
 		0, 0, 0, 0, time.UTC)
 
-	return nextDate
+	return nextDate, nil
 }
 
 // setInitialAuditDate sets the NextAuditDate for a newly created AccessList.
 // The function is extracted from CheckAndSetDefaults for the sake of testing
 // (we need to pass a fake clock).
-func (a *AccessList) setInitialAuditDate(clock clockwork.Clock) {
+func (a *AccessList) setInitialAuditDate(clock clockwork.Clock) (err error) {
 	// We act as if the AccessList just got reviewed (we just created it, so
 	// we're pretty sure of what it does) and pick the next review date.
 	a.Spec.Audit.NextAuditDate = clock.Now()
-	a.Spec.Audit.NextAuditDate = a.SelectNextReviewDate()
+	a.Spec.Audit.NextAuditDate, err = a.SelectNextReviewDate()
+	return trace.Wrap(err)
+}
+
+// EqualAccessListsOption is a functional option for configuring
+// the behavior of EqualAccessLists.
+type EqualAccessListsOption func(*equalAccessListsConfig)
+
+type equalAccessListsConfig struct {
+	skipClone     bool
+	resetFieldsFn func(*AccessList)
+}
+
+// WithSkipClone configures EqualAccessLists to skip cloning
+// and directly mutate the input access lists. Use this option only when you're
+// certain the input access lists can be safely modified (e.g., they're already
+// clones or will be discarded after comparison).
+func WithSkipClone() EqualAccessListsOption {
+	return func(c *equalAccessListsConfig) {
+		c.skipClone = true
+	}
+}
+
+// WithIgnoreEphemeralFields configures EqualAccessLists to reset ephemeral
+// fields before comparison. Ephemeral fields are those managed by reconcilers
+// or the backend and should typically be ignored when comparing access lists.
+//
+// The following fields are reset:
+//   - Metadata.Revision: Managed by the backend
+//   - Status: Contains dynamically calculated fields (member counts, assignments, etc.)
+//   - Owner.IneligibleStatus: Managed by the IneligibleStatusReconciler
+//
+// Note: This option causes the input access lists to be cloned (unless WithSkipClone
+// is also used) to avoid modifying the originals.
+func WithIgnoreEphemeralFields() EqualAccessListsOption {
+	return func(c *equalAccessListsConfig) {
+		c.resetFieldsFn = resetEphemeralFieldsAccessList
+	}
+}
+
+// EqualAccessLists compares two access lists for semantic equality.
+//
+// By default, this function performs a standard equality check. Use WithIgnoreEphemeralFields()
+// to ignore ephemeral fields that are managed by reconcilers or the backend. This function
+// mimics the behavior of services.CompareResources for AccessList types when used with
+// WithIgnoreEphemeralFields().
+//
+// By default, this function clones the input access lists before comparison to avoid
+// modifying the originals. Use WithSkipClone() to skip cloning if the inputs can be
+// safely modified (e.g., when inputs are already clones or will be discarded after comparison).
+func EqualAccessLists(a, b *AccessList, opts ...EqualAccessListsOption) bool {
+	cfg := equalAccessListsConfig{}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
+	if !cfg.skipClone {
+		a = a.Clone()
+		b = b.Clone()
+	}
+
+	if cfg.resetFieldsFn != nil {
+		cfg.resetFieldsFn(a)
+		cfg.resetFieldsFn(b)
+	}
+
+	return deriveTeleportEqualAccessList(a, b)
+}
+
+// resetEphemeralFieldsAccessList clears ephemeral fields that should be
+// ignored when comparing access lists.
+func resetEphemeralFieldsAccessList(a *AccessList) {
+	if a == nil {
+		return
+	}
+	a.Metadata.Revision = ""
+	a.Status = Status{}
+	for i := range a.Spec.Owners {
+		a.Spec.Owners[i].IneligibleStatus = ""
+	}
 }
diff --git a/api/types/accesslist/accesslist_test.go b/api/types/accesslist/accesslist_test.go
index 765f398c77c89..73491f993293d 100644
--- a/api/types/accesslist/accesslist_test.go
+++ b/api/types/accesslist/accesslist_test.go
@@ -18,6 +18,7 @@ package accesslist
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
@@ -182,6 +183,8 @@ func TestAuditMarshaling(t *testing.T) {
 }
 
 func TestAuditUnmarshaling(t *testing.T) {
+	const twoWeeks = 14 * 24 * time.Hour
+
 	tests := []struct {
 		name                      string
 		input                     map[string]interface{}
@@ -243,86 +246,95 @@ func TestAuditUnmarshaling(t *testing.T) {
 	}
 }
 
-func TestAccessListDefaults(t *testing.T) {
-	newValidAccessList := func() *AccessList {
-		return &AccessList{
-			ResourceHeader: header.ResourceHeader{
-				Metadata: header.Metadata{
-					Name: "test",
-				},
-			},
-			Spec: Spec{
-				Title:  "test access list",
-				Owners: []Owner{{Name: "Daphne"}},
-				Grants: Grants{Roles: []string{"requester"}},
-				Audit: Audit{
-					NextAuditDate: time.Date(2000, time.September, 12, 1, 2, 3, 4, time.UTC),
-				},
-			},
-		}
-	}
-
-	t.Run("owners are required", func(t *testing.T) {
-		uut := newValidAccessList()
-		uut.Spec.Owners = []Owner{}
-
-		err := uut.CheckAndSetDefaults()
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "owners")
-	})
-}
-
 func TestSelectNextReviewDate(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
 		name              string
+		accessListTypes   []Type
 		frequency         ReviewFrequency
 		dayOfMonth        ReviewDayOfMonth
 		currentReviewDate time.Time
 		expected          time.Time
+		expectedErr       bool
 	}{
 		{
 			name:              "one month, first day",
+			accessListTypes:   []Type{Default, DeprecatedDynamic},
 			frequency:         OneMonth,
 			dayOfMonth:        FirstDayOfMonth,
 			currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
 			expected:          time.Date(2023, 2, 1, 0, 0, 0, 0, time.UTC),
+			expectedErr:       false,
 		},
 		{
 			name:              "one month, fifteenth day",
+			accessListTypes:   []Type{Default, DeprecatedDynamic},
 			frequency:         OneMonth,
 			dayOfMonth:        FifteenthDayOfMonth,
 			currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
 			expected:          time.Date(2023, 2, 15, 0, 0, 0, 0, time.UTC),
+			expectedErr:       false,
 		},
 		{
 			name:              "one month, last day",
+			accessListTypes:   []Type{Default, DeprecatedDynamic},
 			frequency:         OneMonth,
 			dayOfMonth:        LastDayOfMonth,
 			currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
 			expected:          time.Date(2023, 2, 28, 0, 0, 0, 0, time.UTC),
+			expectedErr:       false,
 		},
 		{
 			name:              "six months, last day",
+			accessListTypes:   []Type{Default, DeprecatedDynamic},
 			frequency:         SixMonths,
 			dayOfMonth:        LastDayOfMonth,
 			currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
 			expected:          time.Date(2023, 7, 31, 0, 0, 0, 0, time.UTC),
+			expectedErr:       false,
+		},
+		{
+			name:              "six months, last day",
+			accessListTypes:   []Type{Static, SCIM, "__test_unknown__"},
+			frequency:         SixMonths,
+			dayOfMonth:        LastDayOfMonth,
+			currentReviewDate: time.Time{},
+			expected:          time.Time{},
+			expectedErr:       true,
+		},
+		{
+			name:              "six months, last day",
+			accessListTypes:   []Type{Static, SCIM, "__test_unknown__"},
+			frequency:         SixMonths,
+			dayOfMonth:        LastDayOfMonth,
+			currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
+			expected:          time.Time{},
+			expectedErr:       true,
 		},
 	}
 
 	for _, test := range tests {
 		test := test
 		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-			accessList := AccessList{}
-			accessList.Spec.Audit.NextAuditDate = test.currentReviewDate
-			accessList.Spec.Audit.Recurrence = Recurrence{
-				Frequency:  test.frequency,
-				DayOfMonth: test.dayOfMonth,
+			for _, typ := range test.accessListTypes {
+				t.Run(fmt.Sprintf("type=%q", typ), func(t *testing.T) {
+					accessList := AccessList{}
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.NextAuditDate = test.currentReviewDate
+					accessList.Spec.Audit.Recurrence = Recurrence{
+						Frequency:  test.frequency,
+						DayOfMonth: test.dayOfMonth,
+					}
+					nextReviewDate, err := accessList.SelectNextReviewDate()
+					if test.expectedErr {
+						require.Error(t, err)
+					} else {
+						require.NoError(t, err)
+						require.Equal(t, test.expected, nextReviewDate)
+					}
+				})
 			}
-			require.Equal(t, test.expected, accessList.SelectNextReviewDate())
 		})
 	}
 }
@@ -381,3 +393,224 @@ func TestAccessList_setInitialReviewDate(t *testing.T) {
 		})
 	}
 }
+
+func TestEqualIgnoreEphemeralFields(t *testing.T) {
+	t.Parallel()
+
+	baseTime := time.Now()
+	createAccessList := func(name string) *AccessList {
+		al, err := NewAccessList(
+			header.Metadata{
+				Name:     name,
+				Revision: "rev1",
+			},
+			Spec{
+				Title:       "Test Access List",
+				Description: "Test description",
+				Owners: []Owner{
+					{
+						Name:             "owner1",
+						Description:      "First owner",
+						IneligibleStatus: "ineligible-reason",
+						MembershipKind:   MembershipKindUser,
+					},
+					{
+						Name:             "owner2",
+						Description:      "Second owner",
+						IneligibleStatus: "another-reason",
+						MembershipKind:   MembershipKindUser,
+					},
+				},
+				Audit: Audit{
+					NextAuditDate: baseTime,
+					Recurrence: Recurrence{
+						Frequency:  SixMonths,
+						DayOfMonth: FirstDayOfMonth,
+					},
+					Notifications: Notifications{
+						Start: 14 * 24 * time.Hour,
+					},
+				},
+				MembershipRequires: Requires{
+					Roles:  []string{"role1"},
+					Traits: map[string][]string{"trait1": {"value1"}},
+				},
+				OwnershipRequires: Requires{
+					Roles:  []string{"owner-role"},
+					Traits: map[string][]string{"owner-trait": {"owner-value"}},
+				},
+				Grants: Grants{
+					Roles:  []string{"granted-role"},
+					Traits: map[string][]string{"granted-trait": {"granted-value"}},
+				},
+				OwnerGrants: Grants{
+					Roles:  []string{"owner-granted-role"},
+					Traits: map[string][]string{"owner-granted-trait": {"owner-granted-value"}},
+				},
+			},
+		)
+		require.NoError(t, err)
+
+		al.Status = Status{
+			OwnerOf:  []string{"list1", "list2"},
+			MemberOf: []string{"list3", "list4"},
+		}
+
+		return al
+	}
+
+	t.Run("identical access lists are equal", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.True(t, result)
+	})
+
+	t.Run("default behavior does not mutate originals", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+
+		originalRevision := al1.Metadata.Revision
+		originalStatus := al1.Status
+		originalIneligibleStatus := al1.Spec.Owners[0].IneligibleStatus
+
+		EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+
+		// Verify original values are preserved
+		require.Equal(t, originalRevision, al1.Metadata.Revision)
+		require.Equal(t, originalStatus, al1.Status)
+		require.Equal(t, originalIneligibleStatus, al1.Spec.Owners[0].IneligibleStatus)
+	})
+
+	t.Run("WithSkipClone mutates originals", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+
+		originalRevision := al1.Metadata.Revision
+		originalIneligibleStatus := al1.Spec.Owners[0].IneligibleStatus
+
+		EqualAccessLists(al1, al2, WithSkipClone(), WithIgnoreEphemeralFields())
+
+		// Verify values were mutated
+		require.Empty(t, al1.Metadata.Revision)
+		require.NotEqual(t, originalRevision, al1.Metadata.Revision)
+		require.Empty(t, al1.Spec.Owners[0].IneligibleStatus)
+		require.NotEqual(t, originalIneligibleStatus, al1.Spec.Owners[0].IneligibleStatus)
+	})
+
+	t.Run("different revisions are ignored", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Metadata.Revision = "different-revision"
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.True(t, result)
+	})
+
+	t.Run("different status is ignored", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Status.OwnerOf = []string{"different", "lists"}
+		al2.Status.MemberOf = []string{"other", "lists"}
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.True(t, result)
+	})
+
+	t.Run("different owner ineligible status is ignored", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Owners[0].IneligibleStatus = "completely-different-reason"
+		al2.Spec.Owners[1].IneligibleStatus = ""
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.True(t, result)
+	})
+
+	t.Run("all ignored fields different at once", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+
+		// Change all ignored fields
+		al2.Metadata.Revision = "rev999"
+		al2.Status.OwnerOf = []string{"completely", "different", "lists"}
+		al2.Spec.Owners[0].IneligibleStatus = "new-reason-1"
+		al2.Spec.Owners[1].IneligibleStatus = "new-reason-2"
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.True(t, result)
+	})
+
+	t.Run("different name causes inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test2")
+
+		result := EqualAccessLists(al1, al2, WithIgnoreEphemeralFields())
+		require.False(t, result)
+	})
+
+	t.Run("different title causes inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Title = "Different Title"
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different description causes inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Description = "Different description"
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different owner name causes inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Owners[0].Name = "different-owner"
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different owner description causes inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Owners[0].Description = "Different owner description"
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different audit settings cause inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Audit.Recurrence.Frequency = OneMonth
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different grants cause inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.Grants.Roles = []string{"different-role"}
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("different membership requires cause inequality", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		al2 := createAccessList("test1")
+		al2.Spec.MembershipRequires.Roles = []string{"different-role"}
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+	})
+
+	t.Run("one nil access list", func(t *testing.T) {
+		al1 := createAccessList("test1")
+		var al2 *AccessList
+
+		require.False(t, EqualAccessLists(al1, al2, WithIgnoreEphemeralFields()))
+		require.False(t, EqualAccessLists(al2, al1, WithIgnoreEphemeralFields()))
+	})
+}
diff --git a/api/types/accesslist/convert/v1/accesslist.go b/api/types/accesslist/convert/v1/accesslist.go
index 057e0e8dd15d6..e94862b641ab2 100644
--- a/api/types/accesslist/convert/v1/accesslist.go
+++ b/api/types/accesslist/convert/v1/accesslist.go
@@ -33,86 +33,26 @@ type AccessListOption func(*accesslist.AccessList)
 
 // FromProto converts a v1 access list into an internal access list object.
 func FromProto(msg *accesslistv1.AccessList, opts ...AccessListOption) (*accesslist.AccessList, error) {
-	if msg == nil {
-		return nil, trace.BadParameter("access list message is nil")
-	}
-
-	if msg.Spec == nil {
+	spec := msg.GetSpec()
+	if spec == nil {
 		return nil, trace.BadParameter("spec is missing")
 	}
-	if msg.Spec.Audit == nil {
-		return nil, trace.BadParameter("audit is missing")
-	}
-	if msg.Spec.MembershipRequires == nil {
-		return nil, trace.BadParameter("membershipRequires is missing")
-	}
-	if msg.Spec.OwnershipRequires == nil {
-		return nil, trace.BadParameter("ownershipRequires is missing")
-	}
-	if msg.Spec.Grants == nil {
-		return nil, trace.BadParameter("grants is missing")
-	}
-
-	var recurrence accesslist.Recurrence
-	if msg.Spec.Audit.Recurrence != nil {
-		recurrence.Frequency = accesslist.ReviewFrequency(msg.Spec.Audit.Recurrence.Frequency)
-		recurrence.DayOfMonth = accesslist.ReviewDayOfMonth(msg.Spec.Audit.Recurrence.DayOfMonth)
-	}
-
-	var notifications accesslist.Notifications
-	if msg.Spec.Audit.Notifications != nil {
-		if msg.Spec.Audit.Notifications.Start != nil {
-			notifications.Start = msg.Spec.Audit.Notifications.Start.AsDuration()
-		}
-	}
-
-	owners := make([]accesslist.Owner, len(msg.Spec.Owners))
-	for i, owner := range msg.Spec.Owners {
-		owners[i] = FromOwnerProto(owner)
-		// Set IneligibleStatus to empty as default.
-		// Must provide as options to set it with the provided value.
-		owners[i].IneligibleStatus = ""
-	}
 
-	var ownerGrants accesslist.Grants
-	if msg.Spec.OwnerGrants != nil {
-		ownerGrants.Roles = msg.Spec.OwnerGrants.Roles
-		if msg.Spec.OwnerGrants.Traits != nil {
-			ownerGrants.Traits = traitv1.FromProto(msg.Spec.OwnerGrants.Traits)
-		}
-	}
+	metadata := headerv1.FromMetadataProto(msg.GetHeader().GetMetadata())
 
-	// We map the zero protobuf time (nil) to the zero go time.
-	// NewAccessList will handle this properly and set a time in the future
-	// based on the recurrence rules.
-	var nextAuditDate time.Time
-	if msg.Spec.Audit.NextAuditDate != nil {
-		nextAuditDate = msg.Spec.Audit.NextAuditDate.AsTime()
+	accessListSpec := accesslist.Spec{
+		Type:               accesslist.Type(msg.GetSpec().GetType()),
+		Title:              spec.GetTitle(),
+		Description:        spec.GetDescription(),
+		Owners:             convertOwnersFromProto(spec.GetOwners()),
+		Audit:              convertAuditFromProto(spec.GetAudit()),
+		MembershipRequires: convertRequiresFromProto(spec.GetMembershipRequires()),
+		OwnershipRequires:  convertRequiresFromProto(spec.GetOwnershipRequires()),
+		Grants:             convertGrantsFromProto(spec.GetGrants()),
+		OwnerGrants:        convertGrantsFromProto(spec.GetOwnerGrants()),
 	}
 
-	accessList, err := accesslist.NewAccessList(headerv1.FromMetadataProto(msg.Header.Metadata), accesslist.Spec{
-		Title:       msg.Spec.Title,
-		Description: msg.Spec.Description,
-		Owners:      owners,
-		Audit: accesslist.Audit{
-			NextAuditDate: nextAuditDate,
-			Recurrence:    recurrence,
-			Notifications: notifications,
-		},
-		MembershipRequires: accesslist.Requires{
-			Roles:  msg.Spec.MembershipRequires.Roles,
-			Traits: traitv1.FromProto(msg.Spec.MembershipRequires.Traits),
-		},
-		OwnershipRequires: accesslist.Requires{
-			Roles:  msg.Spec.OwnershipRequires.Roles,
-			Traits: traitv1.FromProto(msg.Spec.OwnershipRequires.Traits),
-		},
-		Grants: accesslist.Grants{
-			Roles:  msg.Spec.Grants.Roles,
-			Traits: traitv1.FromProto(msg.Spec.Grants.Traits),
-		},
-		OwnerGrants: ownerGrants,
-	})
+	accessList, err := accesslist.NewAccessList(metadata, accessListSpec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -121,7 +61,6 @@ func FromProto(msg *accesslistv1.AccessList, opts ...AccessListOption) (*accessl
 	if status := fromStatusProto(msg); status != nil {
 		accessList.Status = *status
 	}
-
 	for _, opt := range opts {
 		opt(accessList)
 	}
@@ -131,66 +70,83 @@ func FromProto(msg *accesslistv1.AccessList, opts ...AccessListOption) (*accessl
 
 // ToProto converts an internal access list into a v1 access list object.
 func ToProto(accessList *accesslist.AccessList) *accesslistv1.AccessList {
-	owners := make([]*accesslistv1.AccessListOwner, len(accessList.Spec.Owners))
-	for i, owner := range accessList.Spec.Owners {
-		owners[i] = ToOwnerProto(owner)
+	if accessList == nil {
+		return nil
 	}
 
-	var ownerGrants *accesslistv1.AccessListGrants
-	if len(accessList.Spec.OwnerGrants.Roles) > 0 {
-		ownerGrants = &accesslistv1.AccessListGrants{
-			Roles: accessList.Spec.OwnerGrants.Roles,
-		}
+	return &accesslistv1.AccessList{
+		Header: headerv1.ToResourceHeaderProto(accessList.ResourceHeader),
+		Spec: &accesslistv1.AccessListSpec{
+			Type:               string(accessList.Spec.Type),
+			Title:              accessList.Spec.Title,
+			Description:        accessList.Spec.Description,
+			Owners:             convertOwnersToProto(accessList.Spec.Owners),
+			Audit:              convertAuditToProto(accessList.Spec.Audit),
+			MembershipRequires: convertRequiresToProto(accessList.Spec.MembershipRequires),
+			OwnershipRequires:  convertRequiresToProto(accessList.Spec.OwnershipRequires),
+			Grants:             convertGrantsToProto(accessList.Spec.Grants),
+			OwnerGrants:        convertGrantsToProto(accessList.Spec.OwnerGrants),
+		},
+		Status: convertStatusToProto(&accessList.Status),
 	}
+}
 
-	if len(accessList.Spec.OwnerGrants.Traits) > 0 {
-		if ownerGrants == nil {
-			ownerGrants = &accesslistv1.AccessListGrants{}
-		}
+func convertAuditFromProto(audit *accesslistv1.AccessListAudit) accesslist.Audit {
+	if audit == nil {
+		return accesslist.Audit{}
+	}
+	return accesslist.Audit{
+		NextAuditDate: convertTimeFromProto(audit.GetNextAuditDate()),
+		Recurrence: accesslist.Recurrence{
+			Frequency:  accesslist.ReviewFrequency(audit.GetRecurrence().GetFrequency()),
+			DayOfMonth: accesslist.ReviewDayOfMonth(audit.GetRecurrence().GetDayOfMonth()),
+		},
+		Notifications: convertNotificationsFromProto(audit.GetNotifications()),
+	}
+}
 
-		ownerGrants.Traits = traitv1.ToProto(accessList.Spec.OwnerGrants.Traits)
+func convertTimeFromProto(t *timestamppb.Timestamp) time.Time {
+	if t == nil {
+		return time.Time{}
 	}
+	return t.AsTime()
+}
 
-	// We map the zero go time to the zero protobuf time (nil).
-	var nextAuditDate *timestamppb.Timestamp
-	if !accessList.Spec.Audit.NextAuditDate.IsZero() {
-		nextAuditDate = timestamppb.New(accessList.Spec.Audit.NextAuditDate)
+func convertNotificationsFromProto(notifications *accesslistv1.Notifications) accesslist.Notifications {
+	if notifications.GetStart() == nil {
+		return accesslist.Notifications{}
+	}
+	return accesslist.Notifications{
+		Start: notifications.GetStart().AsDuration(),
 	}
+}
 
-	proto := &accesslistv1.AccessList{
-		Header: headerv1.ToResourceHeaderProto(accessList.ResourceHeader),
-		Spec: &accesslistv1.AccessListSpec{
-			Title:       accessList.Spec.Title,
-			Description: accessList.Spec.Description,
-			Owners:      owners,
-			Audit: &accesslistv1.AccessListAudit{
-				NextAuditDate: nextAuditDate,
-				Recurrence: &accesslistv1.Recurrence{
-					Frequency:  accesslistv1.ReviewFrequency(accessList.Spec.Audit.Recurrence.Frequency),
-					DayOfMonth: accesslistv1.ReviewDayOfMonth(accessList.Spec.Audit.Recurrence.DayOfMonth),
-				},
-				Notifications: &accesslistv1.Notifications{
-					Start: durationpb.New(accessList.Spec.Audit.Notifications.Start),
-				},
-			},
-			MembershipRequires: &accesslistv1.AccessListRequires{
-				Roles:  accessList.Spec.MembershipRequires.Roles,
-				Traits: traitv1.ToProto(accessList.Spec.MembershipRequires.Traits),
-			},
-			OwnershipRequires: &accesslistv1.AccessListRequires{
-				Roles:  accessList.Spec.OwnershipRequires.Roles,
-				Traits: traitv1.ToProto(accessList.Spec.OwnershipRequires.Traits),
-			},
-			Grants: &accesslistv1.AccessListGrants{
-				Roles:  accessList.Spec.Grants.Roles,
-				Traits: traitv1.ToProto(accessList.Spec.Grants.Traits),
-			},
-			OwnerGrants: ownerGrants,
-		},
-		Status: toStatusProto(&accessList.Status),
+func convertRequiresFromProto(requires *accesslistv1.AccessListRequires) accesslist.Requires {
+	if requires == nil {
+		return accesslist.Requires{}
+	}
+	return accesslist.Requires{
+		Roles:  requires.GetRoles(),
+		Traits: traitv1.FromProto(requires.GetTraits()),
+	}
+}
+func convertOwnersFromProto(protoOwners []*accesslistv1.AccessListOwner) []accesslist.Owner {
+	owners := make([]accesslist.Owner, len(protoOwners))
+	for i, owner := range protoOwners {
+		owners[i] = FromOwnerProto(owner)
+		owners[i].IneligibleStatus = "" // default, overridden via option if needed
 	}
+	return owners
+}
 
-	return proto
+func convertGrantsFromProto(protoGrants *accesslistv1.AccessListGrants) accesslist.Grants {
+	if protoGrants == nil {
+		return accesslist.Grants{}
+	}
+	return accesslist.Grants{
+		Roles:  protoGrants.GetRoles(),
+		Traits: traitv1.FromProto(protoGrants.GetTraits()),
+	}
 }
 
 // ToOwnerProto converts an internal access list owner into a v1 access list owner object.
@@ -219,16 +175,19 @@ func ToOwnerProto(owner accesslist.Owner) *accesslistv1.AccessListOwner {
 
 // FromOwnerProto converts a v1 access list owner into an internal access list owner object.
 func FromOwnerProto(protoOwner *accesslistv1.AccessListOwner) accesslist.Owner {
+	if protoOwner == nil {
+		return accesslist.Owner{}
+	}
 	ineligibleStatus := ""
-	if protoOwner.IneligibleStatus != accesslistv1.IneligibleStatus_INELIGIBLE_STATUS_UNSPECIFIED {
-		ineligibleStatus = protoOwner.IneligibleStatus.String()
+	if protoOwner.GetIneligibleStatus() != accesslistv1.IneligibleStatus_INELIGIBLE_STATUS_UNSPECIFIED {
+		ineligibleStatus = protoOwner.GetIneligibleStatus().String()
 	}
 
 	return accesslist.Owner{
-		Name:             protoOwner.Name,
-		Description:      protoOwner.Description,
+		Name:             protoOwner.GetName(),
+		Description:      protoOwner.GetDescription(),
 		IneligibleStatus: ineligibleStatus,
-		MembershipKind:   protoOwner.MembershipKind.String(),
+		MembershipKind:   protoOwner.GetMembershipKind().String(),
 	}
 }
 
@@ -249,60 +208,43 @@ func WithOwnersIneligibleStatusField(protoOwners []*accesslistv1.AccessListOwner
 	}
 }
 
-func toStatusProto(status *accesslist.Status) *accesslistv1.AccessListStatus {
+func convertStatusToProto(status *accesslist.Status) *accesslistv1.AccessListStatus {
 	if status == nil {
 		return nil
 	}
 
-	protoStatus := &accesslistv1.AccessListStatus{}
-
-	if status.MemberCount != nil {
-		protoStatus.MemberCount = new(uint32)
-		*protoStatus.MemberCount = *status.MemberCount
-	}
-	if status.MemberListCount != nil {
-		protoStatus.MemberListCount = new(uint32)
-		*protoStatus.MemberListCount = *status.MemberListCount
-	}
-
-	if status.OwnerOf != nil {
-		protoStatus.OwnerOf = status.OwnerOf
+	return &accesslistv1.AccessListStatus{
+		MemberCount:            copyPointer(status.MemberCount),
+		MemberListCount:        copyPointer(status.MemberListCount),
+		OwnerOf:                status.OwnerOf,
+		MemberOf:               status.MemberOf,
+		CurrentUserAssignments: toCurrentUserAssignmentsProto(status.CurrentUserAssignments),
+		UserAssignments:        toUserAssignmentsProto(status.UserAssignments),
 	}
-	if status.MemberOf != nil {
-		protoStatus.MemberOf = status.MemberOf
-	}
-
-	protoStatus.CurrentUserAssignments = toCurrentUserAssignmentsProto(status.CurrentUserAssignments)
-
-	return protoStatus
 }
 
 func fromStatusProto(msg *accesslistv1.AccessList) *accesslist.Status {
-	if msg.Status == nil {
+	protoStatus := msg.GetStatus()
+	if protoStatus == nil {
 		return nil
 	}
 
-	status := &accesslist.Status{}
-
-	if msg.Status.MemberCount != nil {
-		status.MemberCount = new(uint32)
-		*status.MemberCount = *msg.Status.MemberCount
-	}
-	if msg.Status.MemberListCount != nil {
-		status.MemberListCount = new(uint32)
-		*status.MemberListCount = *msg.Status.MemberListCount
+	return &accesslist.Status{
+		MemberCount:            copyPointer(protoStatus.MemberCount),
+		MemberListCount:        copyPointer(protoStatus.MemberListCount),
+		OwnerOf:                protoStatus.GetOwnerOf(),
+		MemberOf:               protoStatus.GetMemberOf(),
+		CurrentUserAssignments: fromCurrentUserAssignmentsProto(protoStatus.GetCurrentUserAssignments()),
+		UserAssignments:        fromUserAssignmentsProto(protoStatus.GetUserAssignments()),
 	}
+}
 
-	if msg.Status.OwnerOf != nil {
-		status.OwnerOf = msg.Status.OwnerOf
-	}
-	if msg.Status.MemberOf != nil {
-		status.MemberOf = msg.Status.MemberOf
+func copyPointer[T any](val *T) *T {
+	if val == nil {
+		return nil
 	}
-
-	status.CurrentUserAssignments = fromCurrentUserAssignmentsProto(msg.Status.CurrentUserAssignments)
-
-	return status
+	out := *val
+	return &out
 }
 
 func toCurrentUserAssignmentsProto(assignments *accesslist.CurrentUserAssignments) *accesslistv1.CurrentUserAssignments {
@@ -315,12 +257,75 @@ func toCurrentUserAssignmentsProto(assignments *accesslist.CurrentUserAssignment
 	}
 }
 
-func fromCurrentUserAssignmentsProto(assignments *accesslistv1.CurrentUserAssignments) *accesslist.CurrentUserAssignments {
+func toUserAssignmentsProto(assignments *accesslist.UserAssignments) *accesslistv1.UserAssignments {
 	if assignments == nil {
 		return nil
 	}
-	return &accesslist.CurrentUserAssignments{
+	return &accesslistv1.UserAssignments{
 		OwnershipType:  assignments.OwnershipType,
 		MembershipType: assignments.MembershipType,
 	}
 }
+
+func fromCurrentUserAssignmentsProto(assignments *accesslistv1.CurrentUserAssignments) *accesslist.CurrentUserAssignments {
+	if assignments == nil {
+		return nil
+	}
+	return &accesslist.CurrentUserAssignments{
+		OwnershipType:  assignments.GetOwnershipType(),
+		MembershipType: assignments.GetMembershipType(),
+	}
+}
+
+func fromUserAssignmentsProto(assignments *accesslistv1.UserAssignments) *accesslist.UserAssignments {
+	if assignments == nil {
+		return nil
+	}
+	return &accesslist.UserAssignments{
+		OwnershipType:  assignments.GetOwnershipType(),
+		MembershipType: assignments.GetMembershipType(),
+	}
+}
+func convertOwnersToProto(owners []accesslist.Owner) []*accesslistv1.AccessListOwner {
+	protoOwners := make([]*accesslistv1.AccessListOwner, len(owners))
+	for i, owner := range owners {
+		protoOwners[i] = ToOwnerProto(owner)
+	}
+	return protoOwners
+}
+
+func convertGrantsToProto(grants accesslist.Grants) *accesslistv1.AccessListGrants {
+	return &accesslistv1.AccessListGrants{
+		Roles:  grants.Roles,
+		Traits: traitv1.ToProto(grants.Traits),
+	}
+}
+
+func convertAuditToProto(audit accesslist.Audit) *accesslistv1.AccessListAudit {
+	if audit == (accesslist.Audit{}) {
+		return nil
+	}
+
+	var nextAuditDate *timestamppb.Timestamp
+	if !audit.NextAuditDate.IsZero() {
+		nextAuditDate = timestamppb.New(audit.NextAuditDate)
+	}
+
+	return &accesslistv1.AccessListAudit{
+		NextAuditDate: nextAuditDate,
+		Recurrence: &accesslistv1.Recurrence{
+			Frequency:  accesslistv1.ReviewFrequency(audit.Recurrence.Frequency),
+			DayOfMonth: accesslistv1.ReviewDayOfMonth(audit.Recurrence.DayOfMonth),
+		},
+		Notifications: &accesslistv1.Notifications{
+			Start: durationpb.New(audit.Notifications.Start),
+		},
+	}
+}
+
+func convertRequiresToProto(requires accesslist.Requires) *accesslistv1.AccessListRequires {
+	return &accesslistv1.AccessListRequires{
+		Roles:  requires.Roles,
+		Traits: traitv1.ToProto(requires.Traits),
+	}
+}
diff --git a/api/types/accesslist/convert/v1/accesslist_test.go b/api/types/accesslist/convert/v1/accesslist_test.go
index 9af8b21f1c9e8..cb0b124d8bd4b 100644
--- a/api/types/accesslist/convert/v1/accesslist_test.go
+++ b/api/types/accesslist/convert/v1/accesslist_test.go
@@ -17,18 +17,25 @@ limitations under the License.
 package v1
 
 import (
+	stdcmp "cmp"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/header"
 )
 
 func TestWithOwnersIneligibleStatusField(t *testing.T) {
+	t.Parallel()
+
 	proto := []*accesslistv1.AccessListOwner{
 		{
 			Name:             "expired",
@@ -85,17 +92,70 @@ func TestWithOwnersIneligibleStatusField(t *testing.T) {
 }
 
 func TestRoundtrip(t *testing.T) {
-	accessList := newAccessList(t, "access-list")
-	accessList.ResourceHeader.SetSubKind("access-list-subkind")
+	t.Parallel()
 
-	converted, err := FromProto(ToProto(accessList))
-	require.NoError(t, err)
+	type testCase struct {
+		name           string
+		modificationFn func(*accesslist.AccessList)
+	}
+
+	for _, tc := range []testCase{
+		{
+			name:           "no-modifications",
+			modificationFn: func(accessList *accesslist.AccessList) {},
+		},
+		{
+			name: "with-subkind",
+			modificationFn: func(accessList *accesslist.AccessList) {
+				accessList.ResourceHeader.SetSubKind("access-list-subkind")
+			},
+		},
+		{
+			name: "deprecated-dynamic-type",
+			modificationFn: func(accessList *accesslist.AccessList) {
+				accessList.Spec.Type = accesslist.DeprecatedDynamic
+			},
+		},
+		{
+			name: "default-type",
+			modificationFn: func(accessList *accesslist.AccessList) {
+				accessList.Spec.Type = accesslist.Default
+			},
+		},
+		{
+			name: "implicit-dynamic-type",
+			modificationFn: func(accessList *accesslist.AccessList) {
+				accessList.Spec.Type = ""
+			},
+		},
+		{
+			name: "static-type",
+			modificationFn: func(accessList *accesslist.AccessList) {
+				accessList.Spec.Type = accesslist.Static
+				accessList.Spec.Audit = accesslist.Audit{}
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			accessList := newAccessList(t, "access-list")
+			tc.modificationFn(accessList)
+
+			converted, err := FromProto(ToProto(accessList))
+			require.NoError(t, err)
 
-	require.Empty(t, cmp.Diff(accessList, converted))
+			if accessList.Spec.Type == accesslist.DeprecatedDynamic {
+				accessList.Spec.Type = accesslist.Default
+			}
+
+			require.Empty(t, cmp.Diff(accessList, converted))
+		})
+	}
 }
 
 // Make sure that we don't panic if any of the message fields are missing.
 func TestFromProtoNils(t *testing.T) {
+	t.Parallel()
+
 	t.Run("spec", func(t *testing.T) {
 		accessList := ToProto(newAccessList(t, "access-list"))
 		accessList.Spec = nil
@@ -109,7 +169,7 @@ func TestFromProtoNils(t *testing.T) {
 		accessList.Spec.Owners = nil
 
 		_, err := FromProto(accessList)
-		require.Error(t, err)
+		require.NoError(t, err)
 	})
 
 	t.Run("audit", func(t *testing.T) {
@@ -117,7 +177,7 @@ func TestFromProtoNils(t *testing.T) {
 		accessList.Spec.Audit = nil
 
 		_, err := FromProto(accessList)
-		require.Error(t, err)
+		require.NoError(t, err)
 	})
 
 	t.Run("recurrence", func(t *testing.T) {
@@ -136,30 +196,6 @@ func TestFromProtoNils(t *testing.T) {
 		require.NoError(t, err)
 	})
 
-	t.Run("membership-requires", func(t *testing.T) {
-		accessList := ToProto(newAccessList(t, "access-list"))
-		accessList.Spec.MembershipRequires = nil
-
-		_, err := FromProto(accessList)
-		require.Error(t, err)
-	})
-
-	t.Run("ownership-requires", func(t *testing.T) {
-		accessList := ToProto(newAccessList(t, "access-list"))
-		accessList.Spec.OwnershipRequires = nil
-
-		_, err := FromProto(accessList)
-		require.Error(t, err)
-	})
-
-	t.Run("grants", func(t *testing.T) {
-		accessList := ToProto(newAccessList(t, "access-list"))
-		accessList.Spec.Grants = nil
-
-		_, err := FromProto(accessList)
-		require.Error(t, err)
-	})
-
 	t.Run("owner_grants", func(t *testing.T) {
 		msg := ToProto(newAccessList(t, "access-list"))
 		msg.Spec.OwnerGrants = nil
@@ -183,6 +219,20 @@ func TestFromProtoNils(t *testing.T) {
 		_, err := FromProto(msg)
 		require.NoError(t, err)
 	})
+
+	t.Run("requires is not set to nil", func(t *testing.T) {
+		acl := newAccessList(t, "access-list")
+		acl.Spec.MembershipRequires = accesslist.Requires{}
+		acl.Spec.OwnershipRequires = accesslist.Requires{}
+		msg := ToProto(acl)
+		// Ensure Requires fields are not set to nil for backward compatibility.
+		// Older implementations of FromProto (e.g., in Teleport v16) may incorrectly set these fields to nil:
+		// https://github.com/gravitational/teleport/blob/branch/v16/api/types/accesslist/convert/v1/accesslist.go#L46
+		// Since FromProto is invoked client-side (e.g., by the Terraform provider),
+		// setting Requires to nil could introduce breaking changes for existing clients.
+		require.NotNil(t, msg.Spec.MembershipRequires)
+		require.NotNil(t, msg.Spec.OwnershipRequires)
+	})
 }
 
 func newAccessList(t *testing.T, name string) *accesslist.AccessList {
@@ -271,3 +321,186 @@ func TestNextAuditDateZeroTime(t *testing.T) {
 
 	require.Nil(t, convertedTwice.Spec.Audit.NextAuditDate)
 }
+
+func TestConvAccessList(t *testing.T) {
+	t.Parallel()
+
+	newAccessList := func(modifyFn func(*accesslistv1.AccessList)) *accesslistv1.AccessList {
+		al := &accesslistv1.AccessList{
+			Header: &v1.ResourceHeader{
+				Version: "v1",
+				Kind:    types.KindAccessList,
+				Metadata: &v1.Metadata{
+					Name: "access-list",
+				},
+			},
+			Spec: &accesslistv1.AccessListSpec{
+				Title:              "test access list",
+				Description:        "test description",
+				OwnershipRequires:  &accesslistv1.AccessListRequires{},
+				MembershipRequires: &accesslistv1.AccessListRequires{},
+				Owners: []*accesslistv1.AccessListOwner{
+					{
+						Name: "test-user1",
+					},
+				},
+				Audit: &accesslistv1.AccessListAudit{
+					Recurrence: &accesslistv1.Recurrence{
+						Frequency:  1,
+						DayOfMonth: 1,
+					},
+					NextAuditDate: &timestamppb.Timestamp{
+						Seconds: 6,
+						Nanos:   1,
+					},
+					Notifications: &accesslistv1.Notifications{
+						Start: &durationpb.Duration{
+							Seconds: 1209600,
+						},
+					},
+				},
+				Grants: &accesslistv1.AccessListGrants{
+					Roles: []string{"role1"},
+				},
+			},
+			Status: &accesslistv1.AccessListStatus{},
+		}
+		if modifyFn != nil {
+			modifyFn(al)
+		}
+		return al
+	}
+
+	tests := []struct {
+		name  string
+		input *accesslistv1.AccessList
+	}{
+		{
+			name:  "basic conversion",
+			input: newAccessList(nil),
+		},
+		{
+			name: "nil grants",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Grants = nil
+			}),
+		},
+		{
+			name: "SCIM, Static access list allows for empty owners",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+				al.Spec.Owners = []*accesslistv1.AccessListOwner{}
+			}),
+		},
+		{
+			name: "audit with only Recurrence.DayOfMonth set",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+				al.Spec.Audit = &accesslistv1.AccessListAudit{
+					Recurrence: &accesslistv1.Recurrence{
+						DayOfMonth: accesslistv1.ReviewDayOfMonth_REVIEW_DAY_OF_MONTH_LAST,
+					},
+					Notifications: &accesslistv1.Notifications{
+						Start: &durationpb.Duration{
+							Seconds: 12345,
+						},
+					},
+				}
+			}),
+		},
+		{
+			name: "audit with only Recurrence.Frequency and Notifications.Start set",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+				al.Spec.Audit = &accesslistv1.AccessListAudit{
+					Recurrence: &accesslistv1.Recurrence{
+						Frequency: accesslistv1.ReviewFrequency_REVIEW_FREQUENCY_ONE_YEAR,
+					},
+					Notifications: &accesslistv1.Notifications{
+						Start: &durationpb.Duration{},
+					},
+				}
+			}),
+		},
+		{
+			name: "scim-type",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+			}),
+		},
+		{
+			name: "static-type",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+			}),
+		},
+		{
+			name: "scim-type and zero audit",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.SCIM)
+				al.Spec.Audit = &accesslistv1.AccessListAudit{
+					NextAuditDate: &timestamppb.Timestamp{},
+					Recurrence: &accesslistv1.Recurrence{
+						Frequency:  0,
+						DayOfMonth: 0,
+					},
+					Notifications: &accesslistv1.Notifications{
+						Start: &durationpb.Duration{},
+					},
+				}
+			}),
+		},
+		{
+			name: "static-type and partial audit",
+			input: newAccessList(func(al *accesslistv1.AccessList) {
+				al.Spec.Type = string(accesslist.Static)
+				al.Spec.Audit = &accesslistv1.AccessListAudit{
+					NextAuditDate: &timestamppb.Timestamp{},
+					Recurrence: &accesslistv1.Recurrence{
+						Frequency:  0,
+						DayOfMonth: 4,
+					},
+					Notifications: &accesslistv1.Notifications{
+						Start: &durationpb.Duration{},
+					},
+				}
+			}),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			acl, err := FromProto(tt.input)
+			require.NoError(t, err)
+
+			got := ToProto(acl)
+			require.NoError(t, err)
+
+			// See [Test_convertGrantsToProto_never_nil] why that is.
+			tt.input.Spec.Grants = stdcmp.Or(tt.input.Spec.Grants, &accesslistv1.AccessListGrants{})
+			tt.input.Spec.OwnerGrants = stdcmp.Or(tt.input.Spec.OwnerGrants, &accesslistv1.AccessListGrants{})
+
+			require.Equal(t, tt.input, got)
+		})
+	}
+}
+
+func Test_convertGrantsToProto_never_nil(t *testing.T) {
+	// We can't convert empty (owner) grants to nil because, when grants are
+	// not specified in Terraform, that causes it to error with:
+	//
+	// 	teleport_access_list.test_direct: Creating...
+	// 	╷
+	// 	│ Error: Provider produced inconsistent result after apply
+	// 	│
+	// 	│ When applying changes to teleport_access_list.test_direct, provider "provider[\"terraform.releases.teleport.dev/gravitational/teleport\"]" produced
+	// 	│ an unexpected new value: .spec.grants: was cty.ObjectVal(map[string]cty.Value{"roles":cty.ListValEmpty(cty.String),
+	// 	│ "traits":cty.ListValEmpty(cty.Object(map[string]cty.Type{"key":cty.String, "values":cty.List(cty.String)}))}), but now null.
+	// 	│
+	// 	│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
+	// 	╵
+	//
+	// See https://github.com/gravitational/teleport/issues/58948
+	emptyGrants := accesslist.Grants{}
+	require.NotNil(t, convertGrantsToProto(emptyGrants))
+}
diff --git a/api/types/accesslist/convert/v1/member.go b/api/types/accesslist/convert/v1/member.go
index 8fe6e596db781..78cb36143dfeb 100644
--- a/api/types/accesslist/convert/v1/member.go
+++ b/api/types/accesslist/convert/v1/member.go
@@ -18,11 +18,11 @@ package v1
 
 import (
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	headerv1 "github.com/gravitational/teleport/api/types/header/convert/v1"
+	"github.com/gravitational/teleport/api/utils"
 )
 
 type MemberOption func(*accesslist.AccessListMember)
@@ -37,13 +37,13 @@ func FromMemberProto(msg *accesslistv1.Member, opts ...MemberOption) (*accesslis
 		return nil, trace.BadParameter("spec is missing")
 	}
 
-	member, err := accesslist.NewAccessListMember(headerv1.FromMetadataProto(msg.Header.Metadata), accesslist.AccessListMemberSpec{
-		AccessList: msg.Spec.AccessList,
-		Name:       msg.Spec.Name,
-		Joined:     msg.Spec.Joined.AsTime(),
-		Expires:    msg.Spec.Expires.AsTime(),
-		Reason:     msg.Spec.Reason,
-		AddedBy:    msg.Spec.AddedBy,
+	member, err := accesslist.NewAccessListMember(headerv1.FromMetadataProto(msg.GetHeader().GetMetadata()), accesslist.AccessListMemberSpec{
+		AccessList: msg.GetSpec().GetAccessList(),
+		Name:       msg.GetSpec().GetName(),
+		Joined:     utils.TimeFromProto(msg.GetSpec().GetJoined()),
+		Expires:    utils.TimeFromProto(msg.GetSpec().GetExpires()),
+		Reason:     msg.GetSpec().GetReason(),
+		AddedBy:    msg.GetSpec().GetAddedBy(),
 		// Set it to empty as default.
 		// Must provide as options to set it with the provided value.
 		IneligibleStatus: "",
@@ -90,8 +90,8 @@ func ToMemberProto(member *accesslist.AccessListMember) *accesslistv1.Member {
 		Spec: &accesslistv1.MemberSpec{
 			AccessList:       member.Spec.AccessList,
 			Name:             member.Spec.Name,
-			Joined:           timestamppb.New(member.Spec.Joined),
-			Expires:          timestamppb.New(member.Spec.Expires),
+			Joined:           utils.TimeIntoProto(member.Spec.Joined),
+			Expires:          utils.TimeIntoProto(member.Spec.Expires),
 			Reason:           member.Spec.Reason,
 			AddedBy:          member.Spec.AddedBy,
 			IneligibleStatus: ineligibleStatus,
diff --git a/api/types/accesslist/convert/v1/member_test.go b/api/types/accesslist/convert/v1/member_test.go
index de44fb67be7c0..1b0e171ec8747 100644
--- a/api/types/accesslist/convert/v1/member_test.go
+++ b/api/types/accesslist/convert/v1/member_test.go
@@ -71,12 +71,12 @@ func TestMemberFromProtoNils(t *testing.T) {
 		{
 			name:     "accesslist",
 			mutate:   func(m *accesslistv1.Member) { m.Spec.AccessList = "" },
-			checkErr: require.Error,
+			checkErr: require.NoError,
 		},
 		{
 			name:     "joined",
 			mutate:   func(m *accesslistv1.Member) { m.Spec.Joined = nil },
-			checkErr: require.Error,
+			checkErr: require.NoError,
 		},
 		{
 			name:     "expires",
@@ -91,7 +91,7 @@ func TestMemberFromProtoNils(t *testing.T) {
 		{
 			name:     "added by",
 			mutate:   func(m *accesslistv1.Member) { m.Spec.AddedBy = "" },
-			checkErr: require.Error,
+			checkErr: require.NoError,
 		},
 	}
 
@@ -109,6 +109,43 @@ func TestMemberFromProtoNils(t *testing.T) {
 	}
 }
 
+func TestMemberTimeConversion(t *testing.T) {
+	t.Run("when zero converts to proto nil", func(t *testing.T) {
+		member := newAccessListMember(t, "test_member")
+		member.Spec.Expires = time.Time{}
+		member.Spec.Joined = time.Time{}
+
+		proto := ToMemberProto(member)
+		require.Nil(t, proto.Spec.Expires)
+		require.Nil(t, proto.Spec.Joined)
+	})
+	t.Run("when non-zero converts to proto time", func(t *testing.T) {
+		member := newAccessListMember(t, "test_member")
+		expires, err := time.Parse(time.RFC3339, "2025-10-09T15:00:00Z")
+		require.NoError(t, err)
+		joined, err := time.Parse(time.RFC3339, "2025-08-07T15:00:00Z")
+		require.NoError(t, err)
+		member.Spec.Expires = expires
+		member.Spec.Joined = joined
+
+		proto := ToMemberProto(member)
+		require.NotNil(t, proto.Spec.Expires)
+		require.NotNil(t, proto.Spec.Joined)
+		require.True(t, proto.Spec.Expires.AsTime().Equal(expires))
+		require.True(t, proto.Spec.Joined.AsTime().Equal(joined))
+	})
+	t.Run("proto nil converts to zero time", func(t *testing.T) {
+		proto := ToMemberProto(newAccessListMember(t, "test_member"))
+		proto.Spec.Expires = nil
+		proto.Spec.Joined = nil
+
+		member, err := FromMemberProto(proto)
+		require.NoError(t, err)
+		require.True(t, member.Spec.Expires.IsZero())
+		require.True(t, member.Spec.Joined.IsZero())
+	})
+}
+
 func newAccessListMember(t *testing.T, name string) *accesslist.AccessListMember {
 	t.Helper()
 
diff --git a/api/types/accesslist/convert/v1/review.go b/api/types/accesslist/convert/v1/review.go
index 5854de458fbea..e5db9149669b3 100644
--- a/api/types/accesslist/convert/v1/review.go
+++ b/api/types/accesslist/convert/v1/review.go
@@ -34,35 +34,35 @@ func FromReviewProto(msg *accesslistv1.Review) (*accesslist.Review, error) {
 		return nil, trace.BadParameter("access list review message is nil")
 	}
 
-	if msg.Spec == nil {
+	if msg.GetSpec() == nil {
 		return nil, trace.BadParameter("spec is missing")
 	}
 
 	// Manually check for the presence of the time so that we can be sure that the review date is
 	// zero if the proto message's review date is nil.
 	var reviewDate time.Time
-	if msg.Spec.ReviewDate != nil {
-		reviewDate = msg.Spec.ReviewDate.AsTime()
+	if msg.GetSpec().GetReviewDate() != nil {
+		reviewDate = msg.GetSpec().GetReviewDate().AsTime()
 	}
 
 	var reviewChanges accesslist.ReviewChanges
-	if msg.Spec.Changes != nil {
-		if msg.Spec.Changes.MembershipRequirementsChanged != nil {
+	if msg.GetSpec().GetChanges() != nil {
+		if msg.GetSpec().GetChanges().GetMembershipRequirementsChanged() != nil {
 			reviewChanges.MembershipRequirementsChanged = &accesslist.Requires{
-				Roles:  msg.Spec.Changes.MembershipRequirementsChanged.Roles,
-				Traits: traitv1.FromProto(msg.Spec.Changes.MembershipRequirementsChanged.Traits),
+				Roles:  msg.GetSpec().GetChanges().GetMembershipRequirementsChanged().GetRoles(),
+				Traits: traitv1.FromProto(msg.GetSpec().GetChanges().GetMembershipRequirementsChanged().GetTraits()),
 			}
 		}
-		reviewChanges.RemovedMembers = msg.Spec.Changes.RemovedMembers
-		reviewChanges.ReviewFrequencyChanged = accesslist.ReviewFrequency(msg.Spec.Changes.ReviewFrequencyChanged)
-		reviewChanges.ReviewDayOfMonthChanged = accesslist.ReviewDayOfMonth(msg.Spec.Changes.ReviewDayOfMonthChanged)
+		reviewChanges.RemovedMembers = msg.GetSpec().GetChanges().GetRemovedMembers()
+		reviewChanges.ReviewFrequencyChanged = accesslist.ReviewFrequency(msg.GetSpec().GetChanges().GetReviewFrequencyChanged())
+		reviewChanges.ReviewDayOfMonthChanged = accesslist.ReviewDayOfMonth(msg.GetSpec().GetChanges().GetReviewDayOfMonthChanged())
 	}
 
-	member, err := accesslist.NewReview(headerv1.FromMetadataProto(msg.Header.Metadata), accesslist.ReviewSpec{
-		AccessList: msg.Spec.AccessList,
-		Reviewers:  msg.Spec.Reviewers,
+	member, err := accesslist.NewReview(headerv1.FromMetadataProto(msg.GetHeader().GetMetadata()), accesslist.ReviewSpec{
+		AccessList: msg.GetSpec().GetAccessList(),
+		Reviewers:  msg.GetSpec().GetReviewers(),
 		ReviewDate: reviewDate,
-		Notes:      msg.Spec.Notes,
+		Notes:      msg.GetSpec().GetNotes(),
 		Changes:    reviewChanges,
 	})
 	if err != nil {
diff --git a/api/types/accesslist/derived.gen.go b/api/types/accesslist/derived.gen.go
new file mode 100644
index 0000000000000..6e0377120c681
--- /dev/null
+++ b/api/types/accesslist/derived.gen.go
@@ -0,0 +1,530 @@
+// Code generated by goderive DO NOT EDIT.
+
+package accesslist
+
+import (
+	header "github.com/gravitational/teleport/api/types/header"
+	"time"
+)
+
+// deriveTeleportEqualAccessList returns whether this and that are equal.
+func deriveTeleportEqualAccessList(this, that *AccessList) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual(&this.ResourceHeader, &that.ResourceHeader) &&
+			deriveTeleportEqual_(&this.Spec, &that.Spec)
+}
+
+// deriveDeepCopyAccessList recursively copies the contents of src into dst.
+func deriveDeepCopyAccessList(dst, src *AccessList) {
+	func() {
+		field := new(header.ResourceHeader)
+		deriveDeepCopy(field, &src.ResourceHeader)
+		dst.ResourceHeader = *field
+	}()
+	func() {
+		field := new(Spec)
+		deriveDeepCopy_(field, &src.Spec)
+		dst.Spec = *field
+	}()
+	func() {
+		field := new(Status)
+		deriveDeepCopy_1(field, &src.Status)
+		dst.Status = *field
+	}()
+}
+
+// deriveDeepCopyAccessListMember recursively copies the contents of src into dst.
+func deriveDeepCopyAccessListMember(dst, src *AccessListMember) {
+	func() {
+		field := new(header.ResourceHeader)
+		deriveDeepCopy(field, &src.ResourceHeader)
+		dst.ResourceHeader = *field
+	}()
+	func() {
+		field := new(AccessListMemberSpec)
+		deriveDeepCopy_2(field, &src.Spec)
+		dst.Spec = *field
+	}()
+}
+
+// deriveDeepCopyReview recursively copies the contents of src into dst.
+func deriveDeepCopyReview(dst, src *Review) {
+	func() {
+		field := new(header.ResourceHeader)
+		deriveDeepCopy(field, &src.ResourceHeader)
+		dst.ResourceHeader = *field
+	}()
+	func() {
+		field := new(ReviewSpec)
+		deriveDeepCopy_3(field, &src.Spec)
+		dst.Spec = *field
+	}()
+}
+
+// deriveTeleportEqual returns whether this and that are equal.
+func deriveTeleportEqual(this, that *header.ResourceHeader) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Kind == that.Kind &&
+			this.SubKind == that.SubKind &&
+			this.Version == that.Version &&
+			deriveTeleportEqual_1(&this.Metadata, &that.Metadata)
+}
+
+// deriveTeleportEqual_ returns whether this and that are equal.
+func deriveTeleportEqual_(this, that *Spec) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Type == that.Type &&
+			this.Title == that.Title &&
+			this.Description == that.Description &&
+			deriveTeleportEqual_2(this.Owners, that.Owners) &&
+			deriveTeleportEqual_3(&this.Audit, &that.Audit) &&
+			deriveTeleportEqual_4(&this.MembershipRequires, &that.MembershipRequires) &&
+			deriveTeleportEqual_4(&this.OwnershipRequires, &that.OwnershipRequires) &&
+			deriveTeleportEqual_5(&this.Grants, &that.Grants) &&
+			deriveTeleportEqual_5(&this.OwnerGrants, &that.OwnerGrants)
+}
+
+// deriveDeepCopy recursively copies the contents of src into dst.
+func deriveDeepCopy(dst, src *header.ResourceHeader) {
+	dst.Kind = src.Kind
+	dst.SubKind = src.SubKind
+	dst.Version = src.Version
+	func() {
+		field := new(header.Metadata)
+		deriveDeepCopy_4(field, &src.Metadata)
+		dst.Metadata = *field
+	}()
+}
+
+// deriveDeepCopy_ recursively copies the contents of src into dst.
+func deriveDeepCopy_(dst, src *Spec) {
+	dst.Type = src.Type
+	dst.Title = src.Title
+	dst.Description = src.Description
+	if src.Owners == nil {
+		dst.Owners = nil
+	} else {
+		if dst.Owners != nil {
+			if len(src.Owners) > len(dst.Owners) {
+				if cap(dst.Owners) >= len(src.Owners) {
+					dst.Owners = (dst.Owners)[:len(src.Owners)]
+				} else {
+					dst.Owners = make([]Owner, len(src.Owners))
+				}
+			} else if len(src.Owners) < len(dst.Owners) {
+				dst.Owners = (dst.Owners)[:len(src.Owners)]
+			}
+		} else {
+			dst.Owners = make([]Owner, len(src.Owners))
+		}
+		copy(dst.Owners, src.Owners)
+	}
+	func() {
+		field := new(Audit)
+		deriveDeepCopy_5(field, &src.Audit)
+		dst.Audit = *field
+	}()
+	func() {
+		field := new(Requires)
+		deriveDeepCopy_6(field, &src.MembershipRequires)
+		dst.MembershipRequires = *field
+	}()
+	func() {
+		field := new(Requires)
+		deriveDeepCopy_6(field, &src.OwnershipRequires)
+		dst.OwnershipRequires = *field
+	}()
+	func() {
+		field := new(Grants)
+		deriveDeepCopy_7(field, &src.Grants)
+		dst.Grants = *field
+	}()
+	func() {
+		field := new(Grants)
+		deriveDeepCopy_7(field, &src.OwnerGrants)
+		dst.OwnerGrants = *field
+	}()
+}
+
+// deriveDeepCopy_1 recursively copies the contents of src into dst.
+func deriveDeepCopy_1(dst, src *Status) {
+	if src.MemberCount == nil {
+		dst.MemberCount = nil
+	} else {
+		dst.MemberCount = new(uint32)
+		*dst.MemberCount = *src.MemberCount
+	}
+	if src.MemberListCount == nil {
+		dst.MemberListCount = nil
+	} else {
+		dst.MemberListCount = new(uint32)
+		*dst.MemberListCount = *src.MemberListCount
+	}
+	if src.OwnerOf == nil {
+		dst.OwnerOf = nil
+	} else {
+		if dst.OwnerOf != nil {
+			if len(src.OwnerOf) > len(dst.OwnerOf) {
+				if cap(dst.OwnerOf) >= len(src.OwnerOf) {
+					dst.OwnerOf = (dst.OwnerOf)[:len(src.OwnerOf)]
+				} else {
+					dst.OwnerOf = make([]string, len(src.OwnerOf))
+				}
+			} else if len(src.OwnerOf) < len(dst.OwnerOf) {
+				dst.OwnerOf = (dst.OwnerOf)[:len(src.OwnerOf)]
+			}
+		} else {
+			dst.OwnerOf = make([]string, len(src.OwnerOf))
+		}
+		copy(dst.OwnerOf, src.OwnerOf)
+	}
+	if src.MemberOf == nil {
+		dst.MemberOf = nil
+	} else {
+		if dst.MemberOf != nil {
+			if len(src.MemberOf) > len(dst.MemberOf) {
+				if cap(dst.MemberOf) >= len(src.MemberOf) {
+					dst.MemberOf = (dst.MemberOf)[:len(src.MemberOf)]
+				} else {
+					dst.MemberOf = make([]string, len(src.MemberOf))
+				}
+			} else if len(src.MemberOf) < len(dst.MemberOf) {
+				dst.MemberOf = (dst.MemberOf)[:len(src.MemberOf)]
+			}
+		} else {
+			dst.MemberOf = make([]string, len(src.MemberOf))
+		}
+		copy(dst.MemberOf, src.MemberOf)
+	}
+	if src.CurrentUserAssignments == nil {
+		dst.CurrentUserAssignments = nil
+	} else {
+		dst.CurrentUserAssignments = new(CurrentUserAssignments)
+		*dst.CurrentUserAssignments = *src.CurrentUserAssignments
+	}
+	if src.UserAssignments == nil {
+		dst.UserAssignments = nil
+	} else {
+		dst.UserAssignments = new(UserAssignments)
+		*dst.UserAssignments = *src.UserAssignments
+	}
+}
+
+// deriveDeepCopy_2 recursively copies the contents of src into dst.
+func deriveDeepCopy_2(dst, src *AccessListMemberSpec) {
+	dst.AccessList = src.AccessList
+	dst.Name = src.Name
+	dst.Title = src.Title
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_8(field, &src.Joined)
+		dst.Joined = *field
+	}()
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_8(field, &src.Expires)
+		dst.Expires = *field
+	}()
+	dst.Reason = src.Reason
+	dst.AddedBy = src.AddedBy
+	dst.IneligibleStatus = src.IneligibleStatus
+	dst.MembershipKind = src.MembershipKind
+}
+
+// deriveDeepCopy_3 recursively copies the contents of src into dst.
+func deriveDeepCopy_3(dst, src *ReviewSpec) {
+	dst.AccessList = src.AccessList
+	if src.Reviewers == nil {
+		dst.Reviewers = nil
+	} else {
+		if dst.Reviewers != nil {
+			if len(src.Reviewers) > len(dst.Reviewers) {
+				if cap(dst.Reviewers) >= len(src.Reviewers) {
+					dst.Reviewers = (dst.Reviewers)[:len(src.Reviewers)]
+				} else {
+					dst.Reviewers = make([]string, len(src.Reviewers))
+				}
+			} else if len(src.Reviewers) < len(dst.Reviewers) {
+				dst.Reviewers = (dst.Reviewers)[:len(src.Reviewers)]
+			}
+		} else {
+			dst.Reviewers = make([]string, len(src.Reviewers))
+		}
+		copy(dst.Reviewers, src.Reviewers)
+	}
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_8(field, &src.ReviewDate)
+		dst.ReviewDate = *field
+	}()
+	dst.Notes = src.Notes
+	func() {
+		field := new(ReviewChanges)
+		deriveDeepCopy_9(field, &src.Changes)
+		dst.Changes = *field
+	}()
+}
+
+// deriveTeleportEqual_1 returns whether this and that are equal.
+func deriveTeleportEqual_1(this, that *header.Metadata) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Name == that.Name &&
+			this.Description == that.Description &&
+			deriveTeleportEqual_6(this.Labels, that.Labels) &&
+			this.Expires.Equal(that.Expires)
+}
+
+// deriveTeleportEqual_2 returns whether this and that are equal.
+func deriveTeleportEqual_2(this, that []Owner) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i] == that[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_3 returns whether this and that are equal.
+func deriveTeleportEqual_3(this, that *Audit) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.NextAuditDate.Equal(that.NextAuditDate) &&
+			this.Recurrence == that.Recurrence &&
+			this.Notifications == that.Notifications
+}
+
+// deriveTeleportEqual_4 returns whether this and that are equal.
+func deriveTeleportEqual_4(this, that *Requires) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_7(this.Roles, that.Roles) &&
+			deriveTeleportEqual_8(this.Traits, that.Traits)
+}
+
+// deriveTeleportEqual_5 returns whether this and that are equal.
+func deriveTeleportEqual_5(this, that *Grants) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_7(this.Roles, that.Roles) &&
+			deriveTeleportEqual_8(this.Traits, that.Traits)
+}
+
+// deriveDeepCopy_4 recursively copies the contents of src into dst.
+func deriveDeepCopy_4(dst, src *header.Metadata) {
+	dst.Name = src.Name
+	dst.Description = src.Description
+	if src.Labels != nil {
+		dst.Labels = make(map[string]string, len(src.Labels))
+		deriveDeepCopy_10(dst.Labels, src.Labels)
+	} else {
+		dst.Labels = nil
+	}
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_8(field, &src.Expires)
+		dst.Expires = *field
+	}()
+	dst.Revision = src.Revision
+}
+
+// deriveDeepCopy_5 recursively copies the contents of src into dst.
+func deriveDeepCopy_5(dst, src *Audit) {
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_8(field, &src.NextAuditDate)
+		dst.NextAuditDate = *field
+	}()
+	dst.Recurrence = src.Recurrence
+	dst.Notifications = src.Notifications
+}
+
+// deriveDeepCopy_6 recursively copies the contents of src into dst.
+func deriveDeepCopy_6(dst, src *Requires) {
+	if src.Roles == nil {
+		dst.Roles = nil
+	} else {
+		if dst.Roles != nil {
+			if len(src.Roles) > len(dst.Roles) {
+				if cap(dst.Roles) >= len(src.Roles) {
+					dst.Roles = (dst.Roles)[:len(src.Roles)]
+				} else {
+					dst.Roles = make([]string, len(src.Roles))
+				}
+			} else if len(src.Roles) < len(dst.Roles) {
+				dst.Roles = (dst.Roles)[:len(src.Roles)]
+			}
+		} else {
+			dst.Roles = make([]string, len(src.Roles))
+		}
+		copy(dst.Roles, src.Roles)
+	}
+	if src.Traits != nil {
+		dst.Traits = make(map[string][]string, len(src.Traits))
+		deriveDeepCopy_11(dst.Traits, src.Traits)
+	} else {
+		dst.Traits = nil
+	}
+}
+
+// deriveDeepCopy_7 recursively copies the contents of src into dst.
+func deriveDeepCopy_7(dst, src *Grants) {
+	if src.Roles == nil {
+		dst.Roles = nil
+	} else {
+		if dst.Roles != nil {
+			if len(src.Roles) > len(dst.Roles) {
+				if cap(dst.Roles) >= len(src.Roles) {
+					dst.Roles = (dst.Roles)[:len(src.Roles)]
+				} else {
+					dst.Roles = make([]string, len(src.Roles))
+				}
+			} else if len(src.Roles) < len(dst.Roles) {
+				dst.Roles = (dst.Roles)[:len(src.Roles)]
+			}
+		} else {
+			dst.Roles = make([]string, len(src.Roles))
+		}
+		copy(dst.Roles, src.Roles)
+	}
+	if src.Traits != nil {
+		dst.Traits = make(map[string][]string, len(src.Traits))
+		deriveDeepCopy_11(dst.Traits, src.Traits)
+	} else {
+		dst.Traits = nil
+	}
+}
+
+// deriveDeepCopy_8 recursively copies the contents of src into dst.
+func deriveDeepCopy_8(dst, src *time.Time) {
+	*dst = *src
+}
+
+// deriveDeepCopy_9 recursively copies the contents of src into dst.
+func deriveDeepCopy_9(dst, src *ReviewChanges) {
+	if src.MembershipRequirementsChanged == nil {
+		dst.MembershipRequirementsChanged = nil
+	} else {
+		dst.MembershipRequirementsChanged = new(Requires)
+		deriveDeepCopy_6(dst.MembershipRequirementsChanged, src.MembershipRequirementsChanged)
+	}
+	if src.RemovedMembers == nil {
+		dst.RemovedMembers = nil
+	} else {
+		if dst.RemovedMembers != nil {
+			if len(src.RemovedMembers) > len(dst.RemovedMembers) {
+				if cap(dst.RemovedMembers) >= len(src.RemovedMembers) {
+					dst.RemovedMembers = (dst.RemovedMembers)[:len(src.RemovedMembers)]
+				} else {
+					dst.RemovedMembers = make([]string, len(src.RemovedMembers))
+				}
+			} else if len(src.RemovedMembers) < len(dst.RemovedMembers) {
+				dst.RemovedMembers = (dst.RemovedMembers)[:len(src.RemovedMembers)]
+			}
+		} else {
+			dst.RemovedMembers = make([]string, len(src.RemovedMembers))
+		}
+		copy(dst.RemovedMembers, src.RemovedMembers)
+	}
+	dst.ReviewFrequencyChanged = src.ReviewFrequencyChanged
+	dst.ReviewDayOfMonthChanged = src.ReviewDayOfMonthChanged
+}
+
+// deriveTeleportEqual_6 returns whether this and that are equal.
+func deriveTeleportEqual_6(this, that map[string]string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for k, v := range this {
+		thatv, ok := that[k]
+		if !ok {
+			return false
+		}
+		if !(v == thatv) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_7 returns whether this and that are equal.
+func deriveTeleportEqual_7(this, that []string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i] == that[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_8 returns whether this and that are equal.
+func deriveTeleportEqual_8(this, that map[string][]string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for k, v := range this {
+		thatv, ok := that[k]
+		if !ok {
+			return false
+		}
+		if !(deriveTeleportEqual_7(v, thatv)) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveDeepCopy_10 recursively copies the contents of src into dst.
+func deriveDeepCopy_10(dst, src map[string]string) {
+	for src_key, src_value := range src {
+		dst[src_key] = src_value
+	}
+}
+
+// deriveDeepCopy_11 recursively copies the contents of src into dst.
+func deriveDeepCopy_11(dst, src map[string][]string) {
+	for src_key, src_value := range src {
+		if src_value == nil {
+			dst[src_key] = nil
+		}
+		if src_value == nil {
+			dst[src_key] = nil
+		} else {
+			if dst[src_key] != nil {
+				if len(src_value) > len(dst[src_key]) {
+					if cap(dst[src_key]) >= len(src_value) {
+						dst[src_key] = (dst[src_key])[:len(src_value)]
+					} else {
+						dst[src_key] = make([]string, len(src_value))
+					}
+				} else if len(src_value) < len(dst[src_key]) {
+					dst[src_key] = (dst[src_key])[:len(src_value)]
+				}
+			} else {
+				dst[src_key] = make([]string, len(src_value))
+			}
+			copy(dst[src_key], src_value)
+		}
+	}
+}
diff --git a/api/types/accesslist/member.go b/api/types/accesslist/member.go
index fc3633e087ac1..376b1eca19068 100644
--- a/api/types/accesslist/member.go
+++ b/api/types/accesslist/member.go
@@ -47,6 +47,12 @@ type AccessListMemberSpec struct {
 	// Name is the name of the member of the access list.
 	Name string `json:"name" yaml:"name"`
 
+	// TODO (avatus): eventually populate this in the backend/cache.
+
+	// Title is the title of an AccessListMember if it is of type MEMBERSHIP_KIND_LIST.
+	// This is only populated by the proxy when fetching an access list and its members for the web UI
+	Title string `json:"title" yaml:"title"`
+
 	// Joined is when the user joined the access list.
 	Joined time.Time `json:"joined" yaml:"joined"`
 
@@ -67,7 +73,7 @@ type AccessListMemberSpec struct {
 	MembershipKind string `json:"membership_kind" yaml:"membership_kind"`
 }
 
-// NewAccessListMember will create a new access listm member.
+// NewAccessListMember will create a new AccessListMember.
 func NewAccessListMember(metadata header.Metadata, spec AccessListMemberSpec) (*AccessListMember, error) {
 	member := &AccessListMember{
 		ResourceHeader: header.ResourceHeaderFromMetadata(metadata),
@@ -81,35 +87,16 @@ func NewAccessListMember(metadata header.Metadata, spec AccessListMemberSpec) (*
 	return member, nil
 }
 
-// CheckAndSetDefaults validates fields and populates empty fields with default values.
+// CheckAndSetDefaults defaults empty fields and performs metadata validation.
 func (a *AccessListMember) CheckAndSetDefaults() error {
 	a.SetKind(types.KindAccessListMember)
 	a.SetVersion(types.V1)
-
 	if err := a.ResourceHeader.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
-
 	if a.Spec.MembershipKind == "" {
 		a.Spec.MembershipKind = MembershipKindUser
 	}
-
-	if a.Spec.AccessList == "" {
-		return trace.BadParameter("access list is missing")
-	}
-
-	if a.Spec.Name == "" {
-		return trace.BadParameter("member name is missing")
-	}
-
-	if a.Spec.Joined.IsZero() || a.Spec.Joined.Unix() == 0 {
-		return trace.BadParameter("member %s: joined field empty or missing", a.Spec.Name)
-	}
-
-	if a.Spec.AddedBy == "" {
-		return trace.BadParameter("member %s: added_by field is empty", a.Spec.Name)
-	}
-
 	return nil
 }
 
@@ -138,7 +125,21 @@ func (a *AccessListMember) MatchSearch(values []string) bool {
 
 // Clone returns a copy of the member.
 func (a *AccessListMember) Clone() *AccessListMember {
-	var copy *AccessListMember
-	utils.StrictObjectToStruct(a, &copy)
-	return copy
+	if a == nil {
+		return nil
+	}
+	out := &AccessListMember{}
+	deriveDeepCopyAccessListMember(out, a)
+	return out
+}
+
+// IsExpired checks if the access list member is expired based on the current time.
+func (a *AccessListMember) IsExpired(t time.Time) bool {
+	return !a.Spec.Expires.IsZero() && !t.Before(a.Spec.Expires)
+}
+
+// IsUser returns true if the membership kind is User
+// All types expect "MEMBERSHIP_KIND_LIST" are treated as "MEMBERSHIP_KIND_USER".
+func (a *AccessListMember) IsUser() bool {
+	return isMembershipKindUser(a.Spec.MembershipKind)
 }
diff --git a/api/types/accesslist/member_test.go b/api/types/accesslist/member_test.go
index e9bc6d8c6dc1b..f5b36f8468e8c 100644
--- a/api/types/accesslist/member_test.go
+++ b/api/types/accesslist/member_test.go
@@ -50,19 +50,12 @@ func TestAccessListMemberDefaults(t *testing.T) {
 		}
 	}
 
-	t.Run("join date required for member", func(t *testing.T) {
+	t.Run("membership kind defaults to user", func(t *testing.T) {
 		uut := newValidAccessListMember()
-		uut.Spec.Joined = time.Time{}
+		uut.Spec.MembershipKind = ""
 
 		err := uut.CheckAndSetDefaults()
-		require.Error(t, err)
-	})
-
-	t.Run("added-by required", func(t *testing.T) {
-		uut := newValidAccessListMember()
-		uut.Spec.AddedBy = ""
-
-		err := uut.CheckAndSetDefaults()
-		require.Error(t, err)
+		require.NoError(t, err)
+		require.Equal(t, MembershipKindUser, uut.Spec.MembershipKind)
 	})
 }
diff --git a/api/types/accesslist/review.go b/api/types/accesslist/review.go
index 776d06bdc1638..650107a8ee1a5 100644
--- a/api/types/accesslist/review.go
+++ b/api/types/accesslist/review.go
@@ -1,18 +1,20 @@
 /*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
 
 package accesslist
 
@@ -25,7 +27,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/header/convert/legacy"
-	"github.com/gravitational/teleport/api/utils"
 )
 
 // Review is an access list review resource.
@@ -117,9 +118,12 @@ func (r *Review) GetMetadata() types.Metadata {
 
 // Clone returns a copy of the review.
 func (a *Review) Clone() *Review {
-	var copy *Review
-	utils.StrictObjectToStruct(a, &copy)
-	return copy
+	if a == nil {
+		return nil
+	}
+	out := &Review{}
+	deriveDeepCopyReview(out, a)
+	return out
 }
 
 func (r *ReviewSpec) UnmarshalJSON(data []byte) error {
diff --git a/api/types/app.go b/api/types/app.go
index 790c43c4a4691..477c718b7fdda 100644
--- a/api/types/app.go
+++ b/api/types/app.go
@@ -18,6 +18,7 @@ package types
 
 import (
 	"fmt"
+	"iter"
 	"net/url"
 	"slices"
 	"strconv"
@@ -58,6 +59,8 @@ type Application interface {
 	SetURI(string)
 	// GetPublicAddr returns the app public address.
 	GetPublicAddr() string
+	// SetPublicAddr sets the app public address.
+	SetPublicAddr(s string)
 	// GetInsecureSkipVerify returns the app insecure setting.
 	GetInsecureSkipVerify() bool
 	// GetRewrite returns the app rewrite configuration.
@@ -70,6 +73,8 @@ type Application interface {
 	IsGCP() bool
 	// IsTCP returns true if this app represents a TCP endpoint.
 	IsTCP() bool
+	// IsMCP returns true if this app represents a MCP server.
+	IsMCP() bool
 	// GetProtocol returns the application protocol.
 	GetProtocol() string
 	// GetAWSAccountID returns value of label containing AWS account ID on this app.
@@ -101,6 +106,10 @@ type Application interface {
 	SetTCPPorts([]*PortRange)
 	// GetIdentityCenter fetches identity center info for the app, if any.
 	GetIdentityCenter() *AppIdentityCenter
+	// GetMCP fetches MCP specific configuration.
+	GetMCP() *MCP
+	// IsEqual determines if two application resources are equivalent to one another.
+	IsEqual(Application) bool
 }
 
 // NewAppV3 creates a new app resource.
@@ -244,6 +253,11 @@ func (a *AppV3) GetPublicAddr() string {
 	return a.Spec.PublicAddr
 }
 
+// SetPublicAddr sets the app public address.
+func (a *AppV3) SetPublicAddr(addr string) {
+	a.Spec.PublicAddr = addr
+}
+
 // GetInsecureSkipVerify returns the app insecure setting.
 func (a *AppV3) GetInsecureSkipVerify() bool {
 	return a.Spec.InsecureSkipVerify
@@ -286,15 +300,28 @@ func (a *AppV3) IsTCP() bool {
 	return IsAppTCP(a.Spec.URI)
 }
 
+// IsMCP returns true if provided uri is an MCP app.
+func (a *AppV3) IsMCP() bool {
+	return IsAppMCP(a.Spec.URI)
+}
+
 func IsAppTCP(uri string) bool {
 	return strings.HasPrefix(uri, "tcp://")
 }
 
+// IsAppMCP returns true if provided uri is an MCP app.
+func IsAppMCP(uri string) bool {
+	return GetMCPServerTransportType(uri) != ""
+}
+
 // GetProtocol returns the application protocol.
 func (a *AppV3) GetProtocol() string {
 	if a.IsTCP() {
 		return "TCP"
 	}
+	if a.IsMCP() {
+		return "MCP"
+	}
 	return "HTTP"
 }
 
@@ -400,10 +427,14 @@ func (a *AppV3) CheckAndSetDefaults() error {
 			return trace.BadParameter("app %q invalid label key: %q", a.GetName(), key)
 		}
 	}
+
 	if a.Spec.URI == "" {
-		if a.Spec.Cloud != "" {
+		switch {
+		case a.Spec.Cloud != "":
 			a.Spec.URI = fmt.Sprintf("cloud://%v", a.Spec.Cloud)
-		} else {
+		case a.Spec.MCP != nil && a.Spec.MCP.Command != "":
+			a.Spec.URI = SchemeMCPStdio + "://"
+		default:
 			return trace.BadParameter("app %q URI is empty", a.GetName())
 		}
 	}
@@ -453,6 +484,20 @@ func (a *AppV3) CheckAndSetDefaults() error {
 		}
 	}
 
+	if a.IsMCP() {
+		a.SetSubKind(SubKindMCP)
+		if err := a.checkMCP(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	// Set an "app-sub-kind" label can be used for RBAC.
+	if a.SubKind != "" {
+		if a.Metadata.Labels == nil {
+			a.Metadata.Labels = make(map[string]string)
+		}
+		a.Metadata.Labels[AppSubKindLabel] = a.SubKind
+	}
 	return nil
 }
 
@@ -486,6 +531,35 @@ func (a *AppV3) checkTCPPorts() error {
 	return nil
 }
 
+func (a *AppV3) checkMCP() error {
+	switch GetMCPServerTransportType(a.Spec.URI) {
+	case MCPTransportStdio:
+		return trace.Wrap(a.checkMCPStdio())
+	case MCPTransportSSE, MCPTransportHTTP:
+		_, err := url.Parse(a.Spec.URI)
+		return trace.Wrap(err)
+	default:
+		return trace.BadParameter("unsupported MCP server %q with URI %q", a.GetName(), a.Spec.URI)
+	}
+}
+
+func (a *AppV3) checkMCPStdio() error {
+	// Skip validation for internal demo resource.
+	if resourceType, _ := a.GetLabel(TeleportInternalResourceType); resourceType == DemoResource {
+		return nil
+	}
+	if a.Spec.MCP == nil {
+		return trace.BadParameter("MCP server %q is missing 'mcp' spec", a.GetName())
+	}
+	if a.Spec.MCP.Command == "" {
+		return trace.BadParameter("MCP server %q is missing 'command' which specifies the executable to launch the MCP server. Arguments should be specified through the 'args' field", a.GetName())
+	}
+	if a.Spec.MCP.RunAsHostUser == "" {
+		return trace.BadParameter("MCP server %q is missing 'run_as_host_user' which specifies a valid host user to execute the command", a.GetName())
+	}
+	return nil
+}
+
 // GetIdentityCenter returns the Identity Center information for the app, if any.
 // May be nil.
 func (a *AppV3) GetIdentityCenter() *AppIdentityCenter {
@@ -511,20 +585,34 @@ func (a *AppV3) IsEqual(i Application) bool {
 	return false
 }
 
+// GetMCP returns MCP specific configuration.
+func (a *AppV3) GetMCP() *MCP {
+	return a.Spec.MCP
+}
+
 // DeduplicateApps deduplicates apps by combination of app name and public address.
 // Apps can have the same name but also could have different addresses.
-func DeduplicateApps(apps []Application) (result []Application) {
+func DeduplicateApps(apps []Application) []Application {
+	return slices.Collect(DeduplicatedApps(slices.Values(apps)))
+}
+
+// DeduplicatedApps iterates deduplicated apps by combination of app name and
+// public address. This is the iter.Seq version of DeduplicateApps.
+func DeduplicatedApps(apps iter.Seq[Application]) iter.Seq[Application] {
 	type key struct{ name, addr string }
 	seen := make(map[key]struct{})
-	for _, app := range apps {
-		key := key{app.GetName(), app.GetPublicAddr()}
-		if _, ok := seen[key]; ok {
-			continue
+	return func(yield func(Application) bool) {
+		for app := range apps {
+			key := key{app.GetName(), app.GetPublicAddr()}
+			if _, ok := seen[key]; ok {
+				continue
+			}
+			seen[key] = struct{}{}
+			if !yield(app) {
+				return
+			}
 		}
-		seen[key] = struct{}{}
-		result = append(result, app)
 	}
-	return result
 }
 
 // Apps is a list of app resources.
@@ -596,3 +684,24 @@ func (p *PortRange) String() string {
 		return fmt.Sprintf("%d-%d", p.Port, p.EndPort)
 	}
 }
+
+// GetMCPServerTransportType returns the transport of the MCP server based on
+// the URI. If no MCP transport type can be determined from the URI, an empty
+// string is returned.
+func GetMCPServerTransportType(uri string) string {
+	parsed, err := url.Parse(uri)
+	if err != nil {
+		return ""
+	}
+
+	switch parsed.Scheme {
+	case SchemeMCPStdio:
+		return MCPTransportStdio
+	case SchemeMCPSSEHTTP, SchemeMCPSSEHTTPS:
+		return MCPTransportSSE
+	case SchemeMCPHTTP, SchemeMCPHTTPS:
+		return MCPTransportHTTP
+	default:
+		return ""
+	}
+}
diff --git a/api/types/app_test.go b/api/types/app_test.go
index b4b57c0023e4c..12d3110fb00ac 100644
--- a/api/types/app_test.go
+++ b/api/types/app_test.go
@@ -18,6 +18,7 @@ package types
 
 import (
 	"fmt"
+	"slices"
 	"strconv"
 	"testing"
 
@@ -603,6 +604,136 @@ func TestNewAppV3(t *testing.T) {
 			want:    nil,
 			wantErr: require.Error,
 		},
+		{
+			name: "mcp with command",
+			meta: Metadata{
+				Name: "mcp-everything",
+			},
+			spec: AppSpecV3{
+				MCP: &MCP{
+					Command:       "docker",
+					Args:          []string{"run", "-i", "--rm", "mcp/everything"},
+					RunAsHostUser: "docker",
+				},
+			},
+			want: &AppV3{
+				Kind:    "app",
+				SubKind: "mcp",
+				Version: "v3",
+				Metadata: Metadata{
+					Name:      "mcp-everything",
+					Namespace: "default",
+					Labels:    map[string]string{AppSubKindLabel: "mcp"},
+				},
+				Spec: AppSpecV3{
+					URI: "mcp+stdio://",
+					MCP: &MCP{
+						Command:       "docker",
+						Args:          []string{"run", "-i", "--rm", "mcp/everything"},
+						RunAsHostUser: "docker",
+					},
+				},
+			},
+			wantErr: require.NoError,
+		},
+		{
+			name: "mcp missing spec",
+			meta: Metadata{
+				Name: "mcp-missing-run-as",
+			},
+			spec: AppSpecV3{
+				URI: "mcp+stdio://",
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "mcp missing run_as_host_user",
+			meta: Metadata{
+				Name: "mcp-missing-spec",
+			},
+			spec: AppSpecV3{
+				MCP: &MCP{
+					Command: "docker",
+					Args:    []string{"run", "-i", "--rm", "mcp/everything"},
+				},
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "mcp demo",
+			meta: Metadata{
+				Name: "teleport-mcp-demo",
+				Labels: map[string]string{
+					TeleportInternalResourceType: DemoResource,
+				},
+			},
+			spec: AppSpecV3{
+				URI: "mcp+stdio://teleport-mcp-demo",
+			},
+			want: &AppV3{
+				Kind:    "app",
+				SubKind: "mcp",
+				Version: "v3",
+				Metadata: Metadata{
+					Name:      "teleport-mcp-demo",
+					Namespace: "default",
+					Labels: map[string]string{
+						TeleportInternalResourceType: DemoResource,
+						AppSubKindLabel:              "mcp",
+					},
+				},
+				Spec: AppSpecV3{
+					URI: "mcp+stdio://teleport-mcp-demo",
+				},
+			},
+			wantErr: require.NoError,
+		},
+		{
+			name: "mcp with SSE transport",
+			meta: Metadata{
+				Name: "mcp-everything",
+			},
+			spec: AppSpecV3{
+				URI: "mcp+sse+http://localhost:12345/sse",
+			},
+			want: &AppV3{
+				Kind:    "app",
+				SubKind: "mcp",
+				Version: "v3",
+				Metadata: Metadata{
+					Name:      "mcp-everything",
+					Namespace: "default",
+					Labels:    map[string]string{AppSubKindLabel: "mcp"},
+				},
+				Spec: AppSpecV3{
+					URI: "mcp+sse+http://localhost:12345/sse",
+				},
+			},
+			wantErr: require.NoError,
+		},
+		{
+			name: "mcp with streamable HTTP transport",
+			meta: Metadata{
+				Name: "mcp-everything",
+			},
+			spec: AppSpecV3{
+				URI: "mcp+http://localhost:12345/mcp",
+			},
+			want: &AppV3{
+				Kind:    "app",
+				SubKind: "mcp",
+				Version: "v3",
+				Metadata: Metadata{
+					Name:      "mcp-everything",
+					Namespace: "default",
+					Labels:    map[string]string{AppSubKindLabel: "mcp"},
+				},
+				Spec: AppSpecV3{
+					URI: "mcp+http://localhost:12345/mcp",
+				},
+			},
+			wantErr: require.NoError,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -658,3 +789,53 @@ func hasErrAndContains(msg string) require.ErrorAssertionFunc {
 		require.ErrorContains(t, err, msg, msgAndArgs...)
 	}
 }
+
+func TestGetMCPServerTransportType(t *testing.T) {
+	tests := []struct {
+		name string
+		uri  string
+		want string
+	}{
+		{
+			name: "stdio",
+			uri:  "mcp+stdio://",
+			want: MCPTransportStdio,
+		},
+		{
+			name: "unknown",
+			uri:  "http://localhost",
+			want: "",
+		},
+		{
+			name: "SSE HTTP",
+			uri:  "mcp+sse+http://127.0.0.1:12345",
+			want: MCPTransportSSE,
+		},
+		{
+			name: "SSE HTTPS",
+			uri:  "mcp+sse+httpS://some-domain:443",
+			want: MCPTransportSSE,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, GetMCPServerTransportType(tt.uri))
+		})
+	}
+}
+
+func TestDeduplicateApps(t *testing.T) {
+	var apps []Application
+	for _, name := range []string{"a", "b", "c", "b", "a", "d"} {
+		app_, err := NewAppV3(Metadata{
+			Name: name,
+		}, AppSpecV3{
+			URI: "localhost:3080",
+		})
+		require.NoError(t, err)
+		apps = append(apps, app_)
+	}
+
+	deduped := DeduplicateApps(apps)
+	require.Equal(t, []string{"a", "b", "c", "d"}, slices.Collect(ResourceNames(deduped)))
+}
diff --git a/api/types/appserver.go b/api/types/appserver.go
index f2094e25391af..822dfb8d31fb9 100644
--- a/api/types/appserver.go
+++ b/api/types/appserver.go
@@ -18,6 +18,8 @@ package types
 
 import (
 	"fmt"
+	"iter"
+	"slices"
 	"sort"
 	"time"
 
@@ -25,7 +27,9 @@ import (
 
 	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/constants"
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/iterutils"
 )
 
 // AppServer represents a single proxied web app.
@@ -59,6 +63,18 @@ type AppServer interface {
 	GetTunnelType() TunnelType
 	// ProxiedService provides common methods for a proxied service.
 	ProxiedService
+	// GetRelayGroup returns the name of the Relay group that the app server is
+	// connected to.
+	GetRelayGroup() string
+	// GetRelayIDs returns the list of Relay host IDs that the app server is
+	// connected to.
+	GetRelayIDs() []string
+	// GetScope returns the scope this server belongs to.
+	GetScope() string
+	// GetComponentFeatures returns the ComponentFeatures supported by this AppServer.
+	GetComponentFeatures() *componentfeaturesv1.ComponentFeatures
+	// SetComponentFeatures sets the ComponentFeatures supported by this AppServer.
+	SetComponentFeatures(*componentfeaturesv1.ComponentFeatures)
 }
 
 // NewAppServerV3 creates a new app server instance.
@@ -103,6 +119,16 @@ func NewAppServerForAWSOIDCIntegration(integrationName, hostID, publicAddr strin
 	})
 }
 
+// GetComponentFeatures returns the ComponentFeatures supported by this AppServer.
+func (s *AppServerV3) GetComponentFeatures() *componentfeaturesv1.ComponentFeatures {
+	return s.Spec.ComponentFeatures
+}
+
+// SetComponentFeatures sets the ComponentFeatures supported by this AppServer.
+func (s *AppServerV3) SetComponentFeatures(cf *componentfeaturesv1.ComponentFeatures) {
+	s.Spec.ComponentFeatures = cf
+}
+
 // GetVersion returns the database server resource version.
 func (s *AppServerV3) GetVersion() string {
 	return s.Version
@@ -269,6 +295,22 @@ func (s *AppServerV3) SetProxyIDs(proxyIDs []string) {
 	s.Spec.ProxyIDs = proxyIDs
 }
 
+// GetRelayGroup implements [AppServer].
+func (s *AppServerV3) GetRelayGroup() string {
+	if s == nil {
+		return ""
+	}
+	return s.Spec.RelayGroup
+}
+
+// GetRelayIDs implements [AppServer].
+func (s *AppServerV3) GetRelayIDs() []string {
+	if s == nil {
+		return nil
+	}
+	return s.Spec.RelayIds
+}
+
 // GetLabel retrieves the label with the provided key. If not found
 // value will be empty and ok will be false.
 func (s *AppServerV3) GetLabel(key string) (value string, ok bool) {
@@ -328,6 +370,11 @@ func (s *AppServerV3) MatchSearch(values []string) bool {
 	return MatchSearch(nil, values, nil)
 }
 
+// GetScope returns the scope this server belongs to.
+func (s *AppServerV3) GetScope() string {
+	return s.Scope
+}
+
 // AppServers represents a list of app servers.
 type AppServers []AppServer
 
@@ -409,3 +456,10 @@ func (s AppServers) GetFieldVals(field string) ([]string, error) {
 
 	return vals, nil
 }
+
+// Applications iterates over the applications that the AppServers proxy.
+func (s AppServers) Applications() iter.Seq[Application] {
+	return iterutils.Map(func(appServer AppServer) Application {
+		return appServer.GetApp()
+	}, slices.Values(s))
+}
diff --git a/api/types/authentication.go b/api/types/authentication.go
index 1f83b1386f1cb..d02a3519288a4 100644
--- a/api/types/authentication.go
+++ b/api/types/authentication.go
@@ -837,7 +837,8 @@ func (c *AuthPreferenceV2) CheckAndSetDefaults() error {
 		case "": // OK, "default" mode. Varies depending on OSS or Enterprise.
 		case constants.DeviceTrustModeOff,
 			constants.DeviceTrustModeOptional,
-			constants.DeviceTrustModeRequired: // OK.
+			constants.DeviceTrustModeRequired,
+			constants.DeviceTrustModeRequiredForHumans: // OK.
 		default:
 			return trace.BadParameter("device trust mode %q not supported", dt.Mode)
 		}
diff --git a/api/types/authentication_authpreference_test.go b/api/types/authentication_authpreference_test.go
index b6efaae1946b1..1f674985fa7b1 100644
--- a/api/types/authentication_authpreference_test.go
+++ b/api/types/authentication_authpreference_test.go
@@ -710,6 +710,16 @@ func TestAuthPreferenceV2_CheckAndSetDefaults_deviceTrust(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "Mode=required-for-humans",
+			authPref: &types.AuthPreferenceV2{
+				Spec: types.AuthPreferenceSpecV2{
+					DeviceTrust: &types.DeviceTrust{
+						Mode: constants.DeviceTrustModeRequiredForHumans,
+					},
+				},
+			},
+		},
 		{
 			name: "Mode invalid",
 			authPref: &types.AuthPreferenceV2{
diff --git a/api/types/authority.go b/api/types/authority.go
index 9b556b42ddd97..6d056a5fdc1b0 100644
--- a/api/types/authority.go
+++ b/api/types/authority.go
@@ -556,6 +556,7 @@ func (k *TLSKeyPair) Clone() *TLSKeyPair {
 		KeyType: k.KeyType,
 		Key:     slices.Clone(k.Key),
 		Cert:    slices.Clone(k.Cert),
+		CRL:     slices.Clone(k.CRL),
 	}
 }
 
diff --git a/api/types/autoupdate/config.go b/api/types/autoupdate/config.go
index ad79765895c0d..37a949606e470 100644
--- a/api/types/autoupdate/config.go
+++ b/api/types/autoupdate/config.go
@@ -104,6 +104,12 @@ func checkAgentSchedules(c *autoupdate.AutoUpdateConfig) error {
 		if group.StartHour > 23 || group.StartHour < 0 {
 			return trace.BadParameter("spec.agents.schedules.regular[%d].start_hour must be between 0 and 23", i)
 		}
+		if group.CanaryCount < 0 || group.CanaryCount > MaxCanaryCount {
+			return trace.BadParameter("spec.agents.schedule.regular[%d].canary_count must be between 0 and %d", i, MaxCanaryCount)
+		}
+		if c.Spec.Agents.Strategy == AgentsStrategyTimeBased && group.CanaryCount != 0 {
+			return trace.BadParameter("spec.agents.schedules.regular[%d].canary_count is not zero but the strategy %q doesn't support canaries", i, AgentsStrategyTimeBased)
+		}
 		if c.Spec.Agents.Strategy == AgentsStrategyTimeBased && group.WaitHours != 0 {
 			return trace.BadParameter("spec.agents.schedules.regular[%d].wait_hours must be zero when strategy is %s", i, AgentsStrategyTimeBased)
 		}
diff --git a/api/types/autoupdate/config_test.go b/api/types/autoupdate/config_test.go
index 0981dd7e681c1..6a022f11500f9 100644
--- a/api/types/autoupdate/config_test.go
+++ b/api/types/autoupdate/config_test.go
@@ -465,6 +465,28 @@ func TestValidateAutoUpdateConfig(t *testing.T) {
 			},
 			assertErr: require.Error,
 		},
+		{
+			name: "group with too many canaries",
+			config: &autoupdate.AutoUpdateConfig{
+				Kind:    types.KindAutoUpdateConfig,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateConfig,
+				},
+				Spec: &autoupdate.AutoUpdateConfigSpec{
+					Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+						Mode:     AgentsUpdateModeEnabled,
+						Strategy: AgentsStrategyHaltOnError,
+						Schedules: &autoupdate.AgentAutoUpdateSchedules{
+							Regular: []*autoupdate.AgentAutoUpdateGroup{
+								{Name: "g1", Days: []string{"*"}, WaitHours: 0, CanaryCount: 123},
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.Error,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/api/types/autoupdate/constants.go b/api/types/autoupdate/constants.go
index deed5168fb21f..0c38c7b190f42 100644
--- a/api/types/autoupdate/constants.go
+++ b/api/types/autoupdate/constants.go
@@ -43,4 +43,9 @@ const (
 	// maintenance window. There is no dependency between groups. Agents won't be instructed to update
 	// if the window is over.
 	AgentsStrategyTimeBased = "time-based"
+
+	// MaxCanaryCount is the maximum number of canaries allowed for a single group.
+	// This value is arbitrarily low to avoid XXL rollouts to grow over the max backend
+	// item size.
+	MaxCanaryCount = 5
 )
diff --git a/api/types/autoupdate/report.go b/api/types/autoupdate/report.go
index 0a2bb9d1642c3..07b2f48a00b55 100644
--- a/api/types/autoupdate/report.go
+++ b/api/types/autoupdate/report.go
@@ -28,28 +28,28 @@ import (
 )
 
 const (
-	autoUpdateAgentReportTTL = time.Hour
-	maxGroups                = 50
-	maxVersions              = 20
+	autoUpdateReportTTL = time.Hour
+	maxGroups           = 50
+	maxVersions         = 20
 )
 
-// NewAutoUpdateAgentReport creates a new auto update version resource.
+// NewAutoUpdateAgentReport creates a new auto update agent report resource.
 func NewAutoUpdateAgentReport(spec *autoupdate.AutoUpdateAgentReportSpec, authName string) (*autoupdate.AutoUpdateAgentReport, error) {
-	rollout := &autoupdate.AutoUpdateAgentReport{
+	report := &autoupdate.AutoUpdateAgentReport{
 		Kind:    types.KindAutoUpdateAgentReport,
 		Version: types.V1,
 		Metadata: &headerv1.Metadata{
 			Name: authName,
 			// Validate will fail later if timestamp is zero
-			Expires: timestamppb.New(spec.GetTimestamp().AsTime().Add(autoUpdateAgentReportTTL)),
+			Expires: timestamppb.New(spec.GetTimestamp().AsTime().Add(autoUpdateReportTTL)),
 		},
 		Spec: spec,
 	}
-	if err := ValidateAutoUpdateAgentReport(rollout); err != nil {
+	if err := ValidateAutoUpdateAgentReport(report); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return rollout, nil
+	return report, nil
 }
 
 // ValidateAutoUpdateAgentReport checks that required parameters are set
@@ -78,3 +78,49 @@ func ValidateAutoUpdateAgentReport(v *autoupdate.AutoUpdateAgentReport) error {
 
 	return nil
 }
+
+// NewAutoUpdateBotInstanceReport creates a new auto update bot instance report resource.
+func NewAutoUpdateBotInstanceReport(spec *autoupdate.AutoUpdateBotInstanceReportSpec) (*autoupdate.AutoUpdateBotInstanceReport, error) {
+	report := &autoupdate.AutoUpdateBotInstanceReport{
+		Kind:    types.KindAutoUpdateBotInstanceReport,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameAutoUpdateBotInstanceReport,
+			// Validate will fail later if timestamp is zero
+			Expires: timestamppb.New(spec.GetTimestamp().AsTime().Add(autoUpdateReportTTL)),
+		},
+		Spec: spec,
+	}
+	if err := ValidateAutoUpdateBotInstanceReport(report); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return report, nil
+}
+
+// ValidateAutoUpdateBotInstanceReport checks that the given bot instance report
+// is well-formed and doesn't exceed limits.
+func ValidateAutoUpdateBotInstanceReport(v *autoupdate.AutoUpdateBotInstanceReport) error {
+	if v.GetMetadata().GetName() == "" {
+		return trace.BadParameter("Metadata.Name is empty")
+	}
+	if v.Spec == nil {
+		return trace.BadParameter("Spec is nil")
+	}
+
+	if ts := v.GetSpec().GetTimestamp(); ts.GetSeconds() == 0 && ts.GetNanos() == 0 {
+		return trace.BadParameter("Spec.Timestamp is empty or zero")
+	}
+
+	if numGroups := len(v.GetSpec().GetGroups()); numGroups > maxGroups {
+		return trace.BadParameter("Spec.Groups is too large (%d while the max is %d)", numGroups, maxGroups)
+	}
+
+	for groupName, group := range v.GetSpec().GetGroups() {
+		if numVersions := len(group.GetVersions()); numVersions > maxVersions {
+			return trace.BadParameter("group %q has too many versions (%d while the max is %d)", groupName, numVersions, maxVersions)
+		}
+	}
+
+	return nil
+}
diff --git a/api/types/autoupdate/report_test.go b/api/types/autoupdate/report_test.go
index b93d9719c20c7..e46327aae09c5 100644
--- a/api/types/autoupdate/report_test.go
+++ b/api/types/autoupdate/report_test.go
@@ -19,6 +19,7 @@
 package autoupdate
 
 import (
+	"strconv"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -33,7 +34,7 @@ import (
 
 func TestNewAutoUpdateAgentReport(t *testing.T) {
 	now := timestamppb.Now()
-	expires := timestamppb.New(now.AsTime().Add(autoUpdateAgentReportTTL))
+	expires := timestamppb.New(now.AsTime().Add(autoUpdateReportTTL))
 	tests := []struct {
 		name     string
 		spec     *autoupdate.AutoUpdateAgentReportSpec
@@ -88,3 +89,85 @@ func TestNewAutoUpdateAgentReport(t *testing.T) {
 		})
 	}
 }
+
+func TestNewAutoUpdateBotInstanceReport(t *testing.T) {
+	now := timestamppb.Now()
+	expires := timestamppb.New(now.AsTime().Add(autoUpdateReportTTL))
+
+	generateGroups := func(t *testing.T, numGroups, numVersions int) map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup {
+		t.Helper()
+
+		groups := make(map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup, numGroups)
+		for groupIdx := range numGroups {
+			group := &autoupdate.AutoUpdateBotInstanceReportSpecGroup{
+				Versions: make(map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion, numVersions),
+			}
+			for versionIdx := range numVersions {
+				group.Versions[strconv.Itoa(versionIdx)] = &autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{Count: 1}
+			}
+			groups[strconv.Itoa(groupIdx)] = group
+		}
+		return groups
+	}
+
+	tests := []struct {
+		name string
+		spec *autoupdate.AutoUpdateBotInstanceReportSpec
+
+		want    *autoupdate.AutoUpdateBotInstanceReport
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:    "nil spec",
+			wantErr: require.Error,
+		},
+		{
+			name:    "no timestamp",
+			spec:    &autoupdate.AutoUpdateBotInstanceReportSpec{},
+			wantErr: require.Error,
+		},
+		{
+			name: "too many groups",
+			spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+				Timestamp: now,
+				Groups:    generateGroups(t, 51, 0),
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "too many versions",
+			spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+				Timestamp: now,
+				Groups:    generateGroups(t, 1, 21),
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "ok",
+			spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+				Timestamp: now,
+				Groups:    generateGroups(t, 1, 1),
+			},
+			want: &autoupdate.AutoUpdateBotInstanceReport{
+				Kind:    types.KindAutoUpdateBotInstanceReport,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name:    types.MetaNameAutoUpdateBotInstanceReport,
+					Expires: expires,
+				},
+				Spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+					Timestamp: now,
+					Groups:    generateGroups(t, 1, 1),
+				},
+			},
+			wantErr: require.NoError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := NewAutoUpdateBotInstanceReport(tt.spec)
+			tt.wantErr(t, err)
+			require.Empty(t, cmp.Diff(tt.want, result, protocmp.Transform()))
+		})
+	}
+}
diff --git a/api/types/autoupdate/rollout.go b/api/types/autoupdate/rollout.go
index 111c9a65e0095..ff7d9294d080d 100644
--- a/api/types/autoupdate/rollout.go
+++ b/api/types/autoupdate/rollout.go
@@ -93,6 +93,12 @@ func ValidateAutoUpdateAgentRollout(v *autoupdate.AutoUpdateAgentRollout) error
 		if v.Spec.Strategy == AgentsStrategyHaltOnError && i == 0 && group.ConfigWaitHours != 0 {
 			return trace.BadParameter("status.schedules.groups[0].config_wait_hours must be zero as it's the first group")
 		}
+		if group.CanaryCount > MaxCanaryCount {
+			return trace.BadParameter("status.schedules.groups[%d].canary_count must be less than %d", i, MaxCanaryCount)
+		}
+		if len(group.Canaries) > MaxCanaryCount {
+			return trace.BadParameter("status.schedules.groups[%d].canaries must be contain less than %d elements", i, MaxCanaryCount)
+		}
 		if conflictingGroup, ok := seenGroups[group.Name]; ok {
 			return trace.BadParameter("spec.agents.schedules.regular contains groups with the same name %q at indices %d and %d", group.Name, conflictingGroup, i)
 		}
diff --git a/api/types/autoupdate/rollout_test.go b/api/types/autoupdate/rollout_test.go
index d95ba9ef890fd..8a8e054f4ef1c 100644
--- a/api/types/autoupdate/rollout_test.go
+++ b/api/types/autoupdate/rollout_test.go
@@ -349,6 +349,23 @@ func TestValidateAutoUpdateAgentRollout(t *testing.T) {
 			},
 			assertErr: require.Error,
 		},
+		{
+			name: "group with too high canary count",
+			rollout: &autoupdate.AutoUpdateAgentRollout{
+				Kind:    types.KindAutoUpdateAgentRollout,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &haltOnErrorRolloutSpec,
+				Status: &autoupdate.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+						{Name: "g1", ConfigDays: []string{"*"}, CanaryCount: 15},
+					},
+				},
+			},
+			assertErr: require.Error,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/api/types/common/constants.go b/api/types/common/constants.go
index cda6ee39a803f..718bc21f1bdbc 100644
--- a/api/types/common/constants.go
+++ b/api/types/common/constants.go
@@ -92,4 +92,5 @@ var OriginValues = []string{
 	OriginDiscoveryKubernetes,
 	OriginEntraID,
 	OriginAWSIdentityCenter,
+	OriginIntegrationAWSRolesAnywhere,
 }
diff --git a/api/types/constants.go b/api/types/constants.go
index a2daa0b5ff5e0..64da596b1e91a 100644
--- a/api/types/constants.go
+++ b/api/types/constants.go
@@ -180,6 +180,14 @@ const (
 	// KindApp is a web app resource.
 	KindApp = "app"
 
+	// SubKindMCP represents an MCP server as a subkind of app.
+	SubKindMCP = KindMCP
+
+	// KindMCP is an MCP server resource.
+	// Currently, MCP servers are accessed through apps.
+	// In the future, they may become a standalone resource kind.
+	KindMCP = "mcp"
+
 	// KindDatabaseServer is a database proxy server resource.
 	KindDatabaseServer = "db_server"
 
@@ -201,6 +209,8 @@ const (
 	KindCrownJewel = "crown_jewel"
 	// KindKubernetesCluster is a Kubernetes cluster.
 	KindKubernetesCluster = "kube_cluster"
+	// KindKubernetesResource is a Kubernetes resource within a cluster.
+	KindKubernetesResource = "kube_resource"
 
 	// KindKubePod is a Kubernetes Pod resource type.
 	KindKubePod = "pod"
@@ -276,6 +286,9 @@ const (
 	// KindToken is a provisioning token resource
 	KindToken = "token"
 
+	// KindScopedToken is a provisioning token resource
+	KindScopedToken = "scoped_token"
+
 	// KindCertAuthority is a certificate authority resource
 	KindCertAuthority = "cert_authority"
 
@@ -303,10 +316,20 @@ const (
 	// KindSessionRecordingConfig is the resource for session recording configuration.
 	KindSessionRecordingConfig = "session_recording_config"
 
+	// KindRecordingEncryption is the collection of active session recording encryption keys.
+	KindRecordingEncryption = "recording_encryption"
+
+	// KindRotatedKey is a previously rotated session recording encryption key kept for future replay.
+	KindRotatedKey = "rotated_key"
+
 	// MetaNameSessionRecordingConfig is the exact name of the singleton resource for
 	// session recording configuration.
 	MetaNameSessionRecordingConfig = "session-recording-config"
 
+	// MetaNameRecordingEncryption is the exact name of the singleton resource for
+	// session recording configuration.
+	MetaNameRecordingEncryption = "recording-encryption"
+
 	// KindExternalAuditStorage the resource kind for External Audit Storage
 	// configuration.
 	KindExternalAuditStorage = "external_audit_storage"
@@ -335,6 +358,12 @@ const (
 	// KindAutoUpdateAgentReport is the resource that tracks connected agents.
 	KindAutoUpdateAgentReport = "autoupdate_agent_report"
 
+	// KindAutoUpdateBotInstanceReport is the resource that tracks connected bots.
+	KindAutoUpdateBotInstanceReport = "autoupdate_bot_instance_report"
+
+	// MetaNameAutoUpdateBotInstanceReport is the name of the singleton auto update bot report.
+	MetaNameAutoUpdateBotInstanceReport = "autoupdate-bot-instance-report"
+
 	// MetaNameAutoUpdateConfig is the name of a configuration resource for autoupdate config.
 	MetaNameAutoUpdateConfig = "autoupdate-config"
 
@@ -636,6 +665,15 @@ const (
 	// stable UNIX users.
 	KindStableUNIXUser = "stable_unix_user"
 
+	// KindInferenceModel is the kind of teleport.summarizer.v1.InferenceModel.
+	KindInferenceModel = "inference_model"
+
+	// KindInferenceSecret is the kind of teleport.summarizer.v1.InferenceSecret.
+	KindInferenceSecret = "inference_secret"
+
+	// KindInferencePolicy is the kind of teleport.summarizer.v1.InferencePolicy.
+	KindInferencePolicy = "inference_policy"
+
 	// MetaNameAccessGraphSettings is the exact name of the singleton resource holding
 	// access graph settings.
 	MetaNameAccessGraphSettings = "access-graph-settings"
@@ -643,6 +681,12 @@ const (
 	// MetaNameVnetConfig is the exact name of the singleton resource holding VNet config.
 	MetaNameVnetConfig = "vnet-config"
 
+	// KindRelayServer is the resource kind for a Relay service heartbeat.
+	KindRelayServer = "relay_server"
+
+	// KindClientIPRestriction is the resource kind for Client IP Restriction allowlist.
+	KindClientIPRestriction = "client_ip_restriction"
+
 	// V8 is the eighth version of resources.
 	V8 = "v8"
 
@@ -861,6 +905,15 @@ const (
 	// KubernetesClusterLabel indicates name of the kubernetes cluster for auto-discovered services inside kubernetes.
 	KubernetesClusterLabel = TeleportNamespace + "/kubernetes-cluster"
 
+	// AWSRolesAnywhereProfileNameOverrideLabel indicates the name of the AWS IAM Roles Anywhere Profile's tag key
+	// that Teleport will use to override the name of the discovered profile.
+	// Ensure this name is unique and valid DNS label.
+	AWSRolesAnywhereProfileNameOverrideLabel = "TeleportApplicationName"
+
+	// AWSRolesAnywhereProfileARNLabel is the label key to store the Profile ARN when creating an Application
+	// resource from an AWS IAM Roles Anywhere Profile.
+	AWSRolesAnywhereProfileARNLabel = TeleportNamespace + "/aws-roles-anywhere-profile-arn"
+
 	// DiscoveryTypeLabel specifies type of discovered service that should be created from Kubernetes service.
 	// Also added by discovery service to indicate the type of discovered
 	// resource, e.g. "rds" for RDS databases, "eks" for EKS kube clusters, etc.
@@ -881,6 +934,8 @@ const (
 	DiscoveryAppIgnore = TeleportNamespace + "/ignore"
 	// DiscoveryPublicAddr specifies the public address for a discovered app created from a Kubernetes service.
 	DiscoveryPublicAddr = TeleportNamespace + "/public-addr"
+	// DiscoveryDescription specifies the description for a discovered app created from a Kubernetes service.
+	DiscoveryDescription = TeleportNamespace + "/description"
 
 	// ReqAnnotationApproveSchedulesLabel is the request annotation key at which schedules are stored for access plugins.
 	ReqAnnotationApproveSchedulesLabel = "/schedules"
@@ -896,6 +951,27 @@ const (
 	// CloudGCP identifies that a resource was discovered in GCP.
 	CloudGCP = "GCP"
 
+	// SchemeMCPStdio is a URI scheme for MCP servers using stdio transport.
+	SchemeMCPStdio = "mcp+stdio"
+	// MCPTransportStdio indicates the MCP server uses stdio transport.
+	MCPTransportStdio = "stdio"
+	// SchemeMCPSSEHTTP is a URI scheme for MCP servers using HTTP with SSE
+	// transport.
+	SchemeMCPSSEHTTP = "mcp+sse+http"
+	// SchemeMCPSSEHTTPS is a URI scheme for MCP servers using HTTPS with SSE
+	// transport.
+	SchemeMCPSSEHTTPS = "mcp+sse+https"
+	// MCPTransportSSE indicates the MCP server uses SSE transport.
+	MCPTransportSSE = "SSE"
+	// SchemeMCPHTTP is a URI scheme for MCP servers using HTTP with streamable
+	// HTTP transport.
+	SchemeMCPHTTP = "mcp+http"
+	// SchemeMCPHTTPS is a URI scheme for MCP servers using HTTPS with
+	// streamable HTTP transport.
+	SchemeMCPHTTPS = "mcp+https"
+	// MCPTransportHTTP indicates the MCP server uses SSE transport.
+	MCPTransportHTTP = "Streamable HTTP"
+
 	// DiscoveredResourceNode identifies a discovered SSH node.
 	DiscoveredResourceNode = "node"
 	// DiscoveredResourceDatabase identifies a discovered database.
@@ -911,6 +987,8 @@ const (
 
 	// TeleportAzureMSIEndpoint is a special URL intercepted by TSH local proxy, serving Azure credentials.
 	TeleportAzureMSIEndpoint = "azure-msi." + TeleportNamespace
+	// TeleportAzureIdentityEndpoint is a special URL intercepted by TSH local proxy, serving Azure credentials.
+	TeleportAzureIdentityEndpoint = "azure-identity." + TeleportNamespace
 
 	// ConnectMyComputerNodeOwnerLabel is a label used to control access to the node managed by
 	// Teleport Connect as part of Connect My Computer. See [teleterm.connectmycomputer.RoleSetup].
@@ -1119,10 +1197,15 @@ const (
 	// should not change these resources.
 	SystemResource = "system"
 
-	// PresetResource are resources resources will be created if they don't exist. Updates may be applied
+	// PresetResource are resources that will be created if they don't exist. Updates may be applied
 	// to them, but user changes to these resources will be preserved.
 	PresetResource = "preset"
 
+	// DemoResource are resources that demonstrates specific Teleport features.
+	// These resources are typically managed internally by Teleport and enabled
+	// via flags. Users should not change these resources.
+	DemoResource = "demo"
+
 	// ProxyGroupIDLabel is the internal-use label for proxy heartbeats that's
 	// used by reverse tunnel agents to keep track of multiple independent sets
 	// of proxies in proxy peering mode.
@@ -1174,6 +1257,9 @@ const (
 
 	// GitHubOrgLabel is the label for GitHub organization.
 	GitHubOrgLabel = TeleportInternalLabelPrefix + "github-org"
+
+	// AppSubKindLabel is the label that has the same value of "app.sub_kind".
+	AppSubKindLabel = TeleportInternalLabelPrefix + "app-sub-kind"
 )
 
 const (
@@ -1352,10 +1438,22 @@ const (
 var RequestableResourceKinds = []string{
 	KindNode,
 	KindKubernetesCluster,
+	KindKubernetesResource,
 	KindDatabase,
 	KindApp,
 	KindWindowsDesktop,
 	KindUserGroup,
+	KindSAMLIdPServiceProvider,
+	KindIdentityCenterAccount,
+	KindIdentityCenterAccountAssignment,
+	KindGitServer,
+}
+
+// LegacyRequestableKubeResourceKinds lists all legacy Teleport resource kinds users can request access to.
+// Those are the requestable Kubernetes resource kinds that were supported before the introduction of
+// custom resource support. We need to keep them to maintain support with older Teleport versions.
+// TODO(@creack): DELETE IN v20.0.0.
+var LegacyRequestableKubeResourceKinds = []string{
 	KindKubePod,
 	KindKubeSecret,
 	KindKubeConfigmap,
@@ -1377,12 +1475,18 @@ var RequestableResourceKinds = []string{
 	KindKubeJob,
 	KindKubeCertificateSigningRequest,
 	KindKubeIngress,
-	KindSAMLIdPServiceProvider,
-	KindIdentityCenterAccount,
-	KindIdentityCenterAccountAssignment,
-	KindGitServer,
 }
 
+// Prefix constants to identify kubernetes resources in access requests.
+const (
+	// AccessRequestPrefixKindKube denotes that the resource is a kubernetes one. Used for access requests.
+	AccessRequestPrefixKindKube = "kube:"
+	// AccessRequestPrefixKindKubeClusterWide denotes that the kube resource is cluster-wide.
+	AccessRequestPrefixKindKubeClusterWide = AccessRequestPrefixKindKube + "cw:"
+	// AccessRequestPrefixKindKubeNamespaced denotes that the kube resource is namespaced.
+	AccessRequestPrefixKindKubeNamespaced = AccessRequestPrefixKindKube + "ns:"
+)
+
 // The list below needs to be kept in sync with `kubernetesResourceKindOptions`
 // in `web/packages/teleport/src/Roles/RoleEditor/standardmodel.ts`. (Keeping
 // this comment separate to prevent it from being included in the official
@@ -1415,6 +1519,15 @@ var KubernetesResourcesKinds = []string{
 	KindKubeIngress,
 }
 
+// KubernetesResourceSelfSubjectAccessReview is a Kubernetes resource that
+// represents a self-subject access review. This gets injected in the allow section in the roles.
+var KubernetesResourceSelfSubjectAccessReview = KubernetesResource{
+	Kind:     "selfsubjectaccessreviews",
+	Name:     Wildcard,
+	Verbs:    []string{"create"},
+	APIGroup: "authorization.k8s.io",
+}
+
 // KubernetesResourcesV7KindGroups maps the legacy Teleport kube kinds
 // to their kubernetes group.
 // Used for validation in role >=v8 to check whether an older value has
@@ -1527,49 +1640,48 @@ var KubernetesClusterWideResourceKinds = []string{
 	KindKubeCertificateSigningRequest,
 }
 
-type groupKind = struct{ apiGroup, kind string }
-
 // KubernetesNamespacedResourceKinds is the list of known Kubernetes resource kinds
 // that are namespaced.
+//
 // Generated from `kubectl api-resources --namespaced=true -o name --sort-by=name` (kind k8s v1.32.2).
-// (added .core to core resources.)
 // The format is "<plural>.<apigroup>".
 //
 // Only used in role >=v8 to attempt to validate the api_group field.
 // If we have a match, we know we need a namespaced value, if we don't
 // have a match, we don't know we don't. Best effort basis.
-var kubernetesNamespacedResourceKinds = map[groupKind]struct{}{
-	{"", "bindings"}:                                      {},
-	{"", "configmaps"}:                                    {},
-	{"apps", "controllerrevisions"}:                       {},
-	{"batch", "cronjobs"}:                                 {},
-	{"storage.k8s.io", "csistoragecapacities"}:            {},
-	{"apps", "daemonsets"}:                                {},
-	{"apps", "deployments"}:                               {},
-	{"", "endpoints"}:                                     {},
-	{"discovery.k8s.io", "endpointslices"}:                {},
-	{"events.k8s.io", "events"}:                           {},
-	{"", "events"}:                                        {},
-	{"autoscaling", "horizontalpodautoscalers"}:           {},
-	{"networking.k8s.io", "ingresses"}:                    {},
-	{"batch", "jobs"}:                                     {},
-	{"coordination.k8s.io", "leases"}:                     {},
-	{"", "limitranges"}:                                   {},
-	{"authorization.k8s.io", "localsubjectaccessreviews"}: {},
-	{"networking.k8s.io", "networkpolicies"}:              {},
-	{"", "persistentvolumeclaims"}:                        {},
-	{"policy", "poddisruptionbudgets"}:                    {},
-	{"", "pods"}:                                          {},
-	{"", "podtemplates"}:                                  {},
-	{"apps", "replicasets"}:                               {},
-	{"", "replicationcontrollers"}:                        {},
-	{"", "resourcequotas"}:                                {},
-	{"rbac.authorization.k8s.io", "rolebindings"}:         {},
-	{"rbac.authorization.k8s.io", "roles"}:                {},
-	{"", "secrets"}:                                       {},
-	{"", "serviceaccounts"}:                               {},
-	{"", "services"}:                                      {},
-	{"apps", "statefulsets"}:                              {},
+//
+// Key: resource kind, value: api group.
+var kubernetesNamespacedResourceKinds = map[string]string{
+	"bindings":                  "",
+	"configmaps":                "",
+	"controllerrevisions":       "apps",
+	"cronjobs":                  "batch",
+	"csistoragecapacities":      "storage.k8s.io",
+	"daemonsets":                "apps",
+	"deployments":               "apps",
+	"endpoints":                 "",
+	"endpointslices":            "discovery.k8s.io",
+	"events":                    "events.k8s.io",
+	"horizontalpodautoscalers":  "autoscaling",
+	"ingresses":                 "networking.k8s.io",
+	"jobs":                      "batch",
+	"leases":                    "coordination.k8s.io",
+	"limitranges":               "",
+	"localsubjectaccessreviews": "authorization.k8s.io",
+	"networkpolicies":           "networking.k8s.io",
+	"persistentvolumeclaims":    "",
+	"poddisruptionbudgets":      "policy",
+	"pods":                      "",
+	"podtemplates":              "",
+	"replicasets":               "apps",
+	"replicationcontrollers":    "",
+	"resourcequotas":            "",
+	"rolebindings":              "rbac.authorization.k8s.io",
+	"roles":                     "rbac.authorization.k8s.io",
+	"secrets":                   "",
+	"serviceaccounts":           "",
+	"services":                  "",
+	"statefulsets":              "apps",
 }
 
 // List of "" (core / legacy) resources.
diff --git a/api/types/database.go b/api/types/database.go
index 686bbfdbbed87..291e162f0094f 100644
--- a/api/types/database.go
+++ b/api/types/database.go
@@ -88,8 +88,12 @@ type Database interface {
 	SetAWSExternalID(id string)
 	// SetAWSAssumeRole sets the database AWS assume role arn in the Spec.AWS field.
 	SetAWSAssumeRole(roleARN string)
+	// IsGCPHosted returns true if the database is hosted by GCP.
+	IsGCPHosted() bool
 	// GetGCP returns GCP information for Cloud SQL databases.
 	GetGCP() GCPCloudSQL
+	// GetGCPProjectID returns Project ID for GCP databases.
+	GetGCPProjectID() (string, error)
 	// GetAzure returns Azure database server metadata.
 	GetAzure() Azure
 	// SetStatusAzure sets the database Azure metadata in the status field.
@@ -118,6 +122,8 @@ type Database interface {
 	IsAzure() bool
 	// IsElastiCache returns true if this is an AWS ElastiCache database.
 	IsElastiCache() bool
+	// IsElastiCacheServerless returns true if this is an AWS ElastiCache Serverless database.
+	IsElastiCacheServerless() bool
 	// IsMemoryDB returns true if this is an AWS MemoryDB database.
 	IsMemoryDB() bool
 	// IsAWSHosted returns true if database is hosted by AWS.
@@ -148,6 +154,8 @@ type Database interface {
 	// IsAutoUsersEnabled returns true if the database has auto user
 	// provisioning enabled.
 	IsAutoUsersEnabled() bool
+	// IsEqual determines if two database resources are equivalent to one another.
+	IsEqual(Database) bool
 }
 
 // NewDatabaseV3 creates a new database resource.
@@ -429,6 +437,11 @@ func (g GCPCloudSQL) IsEmpty() bool {
 	return deriveTeleportEqualGCPCloudSQL(&g, &GCPCloudSQL{})
 }
 
+// IsEmpty returns true if AlloyDB options are empty.
+func (a AlloyDB) IsEmpty() bool {
+	return deriveTeleportEqualAlloyDB(&a, &AlloyDB{})
+}
+
 // GetGCP returns GCP information for Cloud SQL databases.
 func (d *DatabaseV3) GetGCP() GCPCloudSQL {
 	return d.Spec.GCP
@@ -477,6 +490,11 @@ func (d *DatabaseV3) IsCloudSQL() bool {
 	return d.GetType() == DatabaseTypeCloudSQL
 }
 
+// IsAlloyDB returns true if this database is a GCP-hosted AlloyDB instance.
+func (d *DatabaseV3) IsAlloyDB() bool {
+	return d.GetType() == DatabaseTypeAlloyDB
+}
+
 // IsAzure returns true if this is Azure hosted database.
 func (d *DatabaseV3) IsAzure() bool {
 	return d.GetType() == DatabaseTypeAzure
@@ -487,6 +505,11 @@ func (d *DatabaseV3) IsElastiCache() bool {
 	return d.GetType() == DatabaseTypeElastiCache
 }
 
+// IsElastiCacheServerless returns true if this is an AWS ElastiCache database.
+func (d *DatabaseV3) IsElastiCacheServerless() bool {
+	return d.GetType() == DatabaseTypeElastiCacheServerless
+}
+
 // IsMemoryDB returns true if this is an AWS MemoryDB database.
 func (d *DatabaseV3) IsMemoryDB() bool {
 	return d.GetType() == DatabaseTypeMemoryDB
@@ -545,16 +568,50 @@ func (d *DatabaseV3) IsGCPHosted() bool {
 	return ok
 }
 
+// GetGCPProjectID returns Project ID for GCP databases.
+func (d *DatabaseV3) GetGCPProjectID() (string, error) {
+	dbType, isGCP := d.getGCPType()
+
+	if !isGCP {
+		return "", trace.NotFound("%v is not a GCP database; db type: %v", d.GetName(), dbType)
+	}
+
+	switch dbType {
+	case DatabaseTypeAlloyDB:
+		info, err := gcputils.ParseAlloyDBConnectionURI(d.GetURI())
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+		return info.ProjectID, nil
+	default:
+		return d.GetGCP().ProjectID, nil
+	}
+}
+
 // getAWSType returns the gcp hosted database type.
 func (d *DatabaseV3) getGCPType() (string, bool) {
 	if d.Spec.Protocol == DatabaseTypeSpanner {
 		return DatabaseTypeSpanner, true
 	}
+
+	if gcputils.IsAlloyDBConnectionURI(d.Spec.URI) {
+		return DatabaseTypeAlloyDB, true
+	}
+
 	gcp := d.GetGCP()
-	if !gcp.IsEmpty() {
-		return DatabaseTypeCloudSQL, true
+	if gcp.IsEmpty() {
+		return "", false
 	}
-	return "", false
+
+	// This check catches the case when URI is not prefixed with `alloydb://`, and yet spec.gcp.alloydb is not empty.
+	// Most likely this is due to a typo in URI or misconfiguration (copy-pasting the URI without adding the prefix).
+	//
+	// Making it clear this is AlloyDB instance will prevent CloudSQL-specific logic to fire,
+	// but also make it eligible for AlloyDB-specific validation to run, which will catch the URI problem.
+	if !gcp.AlloyDB.IsEmpty() {
+		return DatabaseTypeAlloyDB, true
+	}
+	return DatabaseTypeCloudSQL, true
 }
 
 // getAWSType returns the database type.
@@ -583,6 +640,9 @@ func (d *DatabaseV3) getAWSType() (string, bool) {
 	if aws.ElastiCache.ReplicationGroupID != "" {
 		return DatabaseTypeElastiCache, true
 	}
+	if aws.ElastiCacheServerless.CacheName != "" {
+		return DatabaseTypeElastiCacheServerless, true
+	}
 	if aws.MemoryDB.ClusterName != "" {
 		return DatabaseTypeMemoryDB, true
 	}
@@ -728,6 +788,10 @@ func (d *DatabaseV3) CheckAndSetDefaults() error {
 			return trace.BadParameter("GCP Spanner database %q missing GCP instance ID",
 				d.GetName())
 		}
+	case d.IsAlloyDB():
+		if err := d.handleAlloyDBConfig(); err != nil {
+			return trace.Wrap(err)
+		}
 	case d.IsDynamoDB():
 		if err := d.handleDynamoDBConfig(); err != nil {
 			return trace.Wrap(err)
@@ -804,6 +868,21 @@ func (d *DatabaseV3) CheckAndSetDefaults() error {
 		}
 		d.Spec.AWS.ElastiCache.TransitEncryptionEnabled = endpointInfo.TransitEncryptionEnabled
 		d.Spec.AWS.ElastiCache.EndpointType = endpointInfo.EndpointType
+	case awsutils.IsElastiCacheServerlessEndpoint(d.Spec.URI):
+		info, err := awsutils.ParseElastiCacheServerlessEndpoint(d.Spec.URI)
+		if err != nil {
+			slog.WarnContext(context.Background(), "Failed to parse ElastiCache Serverless endpoint",
+				"uri", d.Spec.URI,
+				"error", err,
+			)
+			break
+		}
+		if d.Spec.AWS.ElastiCacheServerless.CacheName == "" {
+			d.Spec.AWS.ElastiCacheServerless.CacheName = info.ID
+		}
+		if d.Spec.AWS.Region == "" {
+			d.Spec.AWS.Region = info.Region
+		}
 	case awsutils.IsMemoryDBEndpoint(d.Spec.URI):
 		endpointInfo, err := awsutils.ParseMemoryDBEndpoint(d.Spec.URI)
 		if err != nil {
@@ -965,6 +1044,36 @@ func (d *DatabaseV3) IsEqual(i Database) bool {
 	return false
 }
 
+// handleAlloyDBConfig validates AlloyDB configuration.
+func (d *DatabaseV3) handleAlloyDBConfig() error {
+	// default to private endpoint type, but only if override isn't set.
+	if d.Spec.GCP.AlloyDB.EndpointType == "" && d.Spec.GCP.AlloyDB.EndpointOverride == "" {
+		d.Spec.GCP.AlloyDB.EndpointType = string(gcputils.AlloyDBEndpointTypePrivate)
+	}
+
+	err := gcputils.ValidateAlloyDBEndpointType(d.Spec.GCP.AlloyDB.EndpointType)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	info, err := gcputils.ParseAlloyDBConnectionURI(d.Spec.URI)
+	if err != nil {
+		return trace.Wrap(err, "failed to parse AlloyDB connection URI")
+	}
+
+	// ensure the GCP fields are empty: we want to avoid redundant information in the database spec.
+	if d.Spec.GCP.InstanceID != "" {
+		return trace.BadParameter("database %q the gcp.instance_id field should be empty but is %q instead; the GCP instance ID configured through URI %q will be automatically used instead",
+			d.GetName(), d.Spec.GCP.InstanceID, info.InstanceID)
+	}
+	if d.Spec.GCP.ProjectID != "" {
+		return trace.BadParameter("database %q the gcp.project_id field should be empty but is %q instead; the GCP project ID configured through URI %q will be automatically used instead",
+			d.GetName(), d.Spec.GCP.ProjectID, info.ProjectID)
+	}
+
+	return nil
+}
+
 // handleDynamoDBConfig handles DynamoDB configuration checking.
 func (d *DatabaseV3) handleDynamoDBConfig() error {
 	if d.Spec.AWS.AccountID == "" {
@@ -1109,6 +1218,9 @@ func (d *DatabaseV3) GetEndpointType() string {
 	switch d.GetType() {
 	case DatabaseTypeElastiCache:
 		return d.GetAWS().ElastiCache.EndpointType
+	case DatabaseTypeElastiCacheServerless:
+		// ElastiCache Serverless endpoints are always cluster mode.
+		return awsutils.ElastiCacheConfigurationEndpoint
 	case DatabaseTypeMemoryDB:
 		return d.GetAWS().MemoryDB.EndpointType
 	case DatabaseTypeOpenSearch:
@@ -1167,12 +1279,16 @@ const (
 	DatabaseTypeRedshiftServerless = "redshift-serverless"
 	// DatabaseTypeCloudSQL is GCP-hosted Cloud SQL database.
 	DatabaseTypeCloudSQL = "gcp"
+	// DatabaseTypeAlloyDB is GCP-hosted AlloyDB database.
+	DatabaseTypeAlloyDB = "alloydb"
 	// DatabaseTypeSpanner is a GCP Spanner instance.
 	DatabaseTypeSpanner = "spanner"
 	// DatabaseTypeAzure is Azure-hosted database.
 	DatabaseTypeAzure = "azure"
 	// DatabaseTypeElastiCache is AWS-hosted ElastiCache database.
 	DatabaseTypeElastiCache = "elasticache"
+	// DatabaseTypeElastiCacheServerless is AWS-hosted ElastiCache serverless database.
+	DatabaseTypeElastiCacheServerless = "elasticache-serverless"
 	// DatabaseTypeMemoryDB is AWS-hosted MemoryDB database.
 	DatabaseTypeMemoryDB = "memorydb"
 	// DatabaseTypeAWSKeyspaces is AWS-hosted Keyspaces database (Cassandra).
diff --git a/api/types/database_test.go b/api/types/database_test.go
index 29437b970722a..6c15fa66ade3c 100644
--- a/api/types/database_test.go
+++ b/api/types/database_test.go
@@ -247,6 +247,53 @@ func TestDatabaseElastiCacheEndpoint(t *testing.T) {
 	})
 }
 
+func TestDatabaseElastiCacheServerlessEndpoint(t *testing.T) {
+	t.Run("valid URI", func(t *testing.T) {
+		database, err := NewDatabaseV3(Metadata{
+			Name: "example",
+		}, DatabaseSpecV3{
+			Protocol: "redis",
+			URI:      "example-abc123.serverless.cac1.cache.amazonaws.com:6379",
+		})
+
+		require.NoError(t, err)
+		require.Equal(t, AWS{
+			Region: "ca-central-1",
+			ElastiCacheServerless: ElastiCacheServerless{
+				CacheName: "example",
+			},
+		}, database.GetAWS())
+		require.True(t, database.IsElastiCacheServerless())
+		require.True(t, database.IsAWSHosted())
+		require.True(t, database.IsCloudHosted())
+	})
+
+	t.Run("invalid URI", func(t *testing.T) {
+		database, err := NewDatabaseV3(Metadata{
+			Name: "example",
+		}, DatabaseSpecV3{
+			Protocol: "redis",
+			URI:      "some.serverless.cache.amazonaws.com:6379",
+			AWS: AWS{
+				Region: "us-east-5",
+				ElastiCacheServerless: ElastiCacheServerless{
+					CacheName: "example",
+				},
+			},
+		})
+
+		// A warning is logged, no error is returned, and AWS metadata is not
+		// updated.
+		require.NoError(t, err)
+		require.Equal(t, AWS{
+			Region: "us-east-5",
+			ElastiCacheServerless: ElastiCacheServerless{
+				CacheName: "example",
+			},
+		}, database.GetAWS())
+	})
+}
+
 func TestDatabaseMemoryDBEndpoint(t *testing.T) {
 	t.Run("valid URI", func(t *testing.T) {
 		database, err := NewDatabaseV3(Metadata{
@@ -1121,6 +1168,231 @@ func TestDatabaseGCPCloudSQL(t *testing.T) {
 	}
 }
 
+func TestDatabaseAlloyDB(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		inputName string
+		inputSpec DatabaseSpecV3
+		wantSpec  DatabaseSpecV3
+		wantErr   string
+	}{
+		{
+			inputName: "URI-only configuration",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			wantSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType: "private",
+					},
+				},
+			},
+		},
+		{
+			inputName: "custom endpoint type",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType: "public",
+					},
+				},
+			},
+			wantSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType: "public",
+					},
+				},
+			},
+		},
+		{
+			inputName: "invalid endpoint type",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType: "does-not-exist",
+					},
+				},
+			},
+			wantErr: "invalid alloy db endpoint type: does-not-exist, expected one of [public private psc]",
+		},
+		{
+			inputName: "endpoint override to IP address",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType:     "",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+			wantSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType:     "",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+		},
+		{
+			inputName: "endpoint override, GCP fields set and matching",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType:     "private",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+			wantSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType:     "private",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+		},
+		{
+			inputName: "unwanted gcp.project_id",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					ProjectID: "my-project-123456",
+				},
+			},
+			wantErr: `database "mydb" the gcp.project_id field should be empty but is "my-project-123456" instead; the GCP project ID configured through URI "my-project-123456" will be automatically used instead`,
+		},
+		{
+			inputName: "unwanted gcp.instance_id",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				GCP: GCPCloudSQL{
+					InstanceID: "my-instance",
+				},
+			},
+			wantErr: `database "mydb" the gcp.instance_id field should be empty but is "my-instance" instead; the GCP instance ID configured through URI "my-instance" will be automatically used instead`,
+		},
+		{
+			inputName: "wrong URI scheme",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "dummy://foo",
+				GCP: GCPCloudSQL{
+					AlloyDB: AlloyDB{
+						EndpointType:     "private",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+			wantErr: `invalid connection URI "dummy://foo": should start with alloydb://`,
+		},
+		{
+			// just a single URI test for completeness; full coverage through ParseAlloyDBConnectionURI.
+			inputName: "incomplete URI",
+			inputSpec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/",
+				GCP: GCPCloudSQL{
+					ProjectID:  "my-project-123456",
+					InstanceID: "my-instance",
+					AlloyDB: AlloyDB{
+						EndpointType:     "private",
+						EndpointOverride: "11.22.33.44",
+					},
+				},
+			},
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/": wrong number of parts`,
+		},
+	} {
+		t.Run(test.inputName, func(t *testing.T) {
+			db, err := NewDatabaseV3(Metadata{Name: "mydb"}, test.inputSpec)
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, test.wantSpec, db.Spec)
+				require.True(t, db.IsAlloyDB())
+			}
+		})
+	}
+}
+
+func TestGetGCPProjectID(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name       string
+		spec       DatabaseSpecV3
+		wantResult string
+		wantErr    string
+	}{
+		{
+			name: "alloydb",
+			spec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			wantResult: "my-project-123456",
+		},
+		{
+			name: "cloudsql",
+			spec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "localhost:5432",
+				GCP: GCPCloudSQL{
+					ProjectID:  "my-project-123456",
+					InstanceID: "instance-123",
+				},
+			},
+			wantResult: "my-project-123456",
+		},
+		{
+			name: "nongcp",
+			spec: DatabaseSpecV3{
+				Protocol: DatabaseProtocolPostgreSQL,
+				URI:      "localhost:12345",
+			},
+			wantErr: "mydb is not a GCP database",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			db, err := NewDatabaseV3(Metadata{Name: "mydb"}, test.spec)
+			require.NoError(t, err)
+
+			result, err := db.GetGCPProjectID()
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, test.wantResult, result)
+			}
+		})
+	}
+}
+
 func TestGetAdminUser(t *testing.T) {
 	t.Parallel()
 
diff --git a/api/types/databaseserver.go b/api/types/databaseserver.go
index ad65057448e58..9f91553018d6e 100644
--- a/api/types/databaseserver.go
+++ b/api/types/databaseserver.go
@@ -57,10 +57,22 @@ type DatabaseServer interface {
 	SetDatabase(Database) error
 	// ProxiedService provides common methods for a proxied service.
 	ProxiedService
+	// GetRelayGroup returns the name of the Relay group that the database
+	// server is connected to.
+	GetRelayGroup() string
+	// GetRelayIDs returns the list of Relay host IDs that the database server
+	// is connected to.
+	GetRelayIDs() []string
 	// GetTargetHealth returns the database server's target health.
 	GetTargetHealth() TargetHealth
-	// SetTargetHealth sets the database server's target health status.
+	// SetTargetHealth sets the database server's target health.
 	SetTargetHealth(h TargetHealth)
+	// GetTargetHealthStatus returns target health status
+	GetTargetHealthStatus() TargetHealthStatus
+	// SetTargetHealthStatus sets target health status
+	SetTargetHealthStatus(status TargetHealthStatus)
+	// GetScope returns the scope this server belongs to.
+	GetScope() string
 }
 
 // NewDatabaseServerV3 creates a new database server instance.
@@ -188,6 +200,22 @@ func (s *DatabaseServerV3) SetProxyIDs(proxyIDs []string) {
 	s.Spec.ProxyIDs = proxyIDs
 }
 
+// GetRelayGroup implements [DatabaseServer].
+func (s *DatabaseServerV3) GetRelayGroup() string {
+	if s == nil {
+		return ""
+	}
+	return s.Spec.RelayGroup
+}
+
+// GetRelayIDs implements [DatabaseServer].
+func (s *DatabaseServerV3) GetRelayIDs() []string {
+	if s == nil {
+		return nil
+	}
+	return s.Spec.RelayIds
+}
+
 // String returns the server string representation.
 func (s *DatabaseServerV3) String() string {
 	return fmt.Sprintf("DatabaseServer(Name=%v, Version=%v, Hostname=%v, HostID=%v, Database=%v)",
@@ -278,6 +306,11 @@ func (s *DatabaseServerV3) Copy() DatabaseServer {
 	return utils.CloneProtoMsg(s)
 }
 
+// GetScope returns the scope this server belongs to.
+func (s *DatabaseServerV3) GetScope() string {
+	return s.Scope
+}
+
 // CloneResource returns a copy of this database server object.
 func (s *DatabaseServerV3) CloneResource() ResourceWithLabels {
 	return s.Copy()
@@ -302,6 +335,22 @@ func (s *DatabaseServerV3) SetTargetHealth(h TargetHealth) {
 	s.Status.TargetHealth = &h
 }
 
+// GetTargetHealthStatus returns target health status
+func (s *DatabaseServerV3) GetTargetHealthStatus() TargetHealthStatus {
+	if s.Status.TargetHealth == nil {
+		return ""
+	}
+	return TargetHealthStatus(s.Status.TargetHealth.Status)
+}
+
+// SetTargetHealthStatus sets target health status
+func (s *DatabaseServerV3) SetTargetHealthStatus(status TargetHealthStatus) {
+	if s.Status.TargetHealth == nil {
+		s.Status.TargetHealth = &TargetHealth{}
+	}
+	s.Status.TargetHealth.Status = string(status)
+}
+
 // DatabaseServers represents a list of database servers.
 type DatabaseServers []DatabaseServer
 
diff --git a/api/types/derived.gen.go b/api/types/derived.gen.go
index 932217f61bb8d..76bfffb2300d4 100644
--- a/api/types/derived.gen.go
+++ b/api/types/derived.gen.go
@@ -45,7 +45,8 @@ func deriveTeleportEqualAWS(this, that *AWS) bool {
 			deriveTeleportEqual_7(&this.OpenSearch, &that.OpenSearch) &&
 			this.IAMPolicyStatus == that.IAMPolicyStatus &&
 			deriveTeleportEqual_8(this.SessionTags, that.SessionTags) &&
-			deriveTeleportEqual_9(&this.DocumentDB, &that.DocumentDB)
+			deriveTeleportEqual_9(&this.DocumentDB, &that.DocumentDB) &&
+			deriveTeleportEqual_10(&this.ElastiCacheServerless, &that.ElastiCacheServerless)
 }
 
 // deriveTeleportEqualGCPCloudSQL returns whether this and that are equal.
@@ -53,7 +54,16 @@ func deriveTeleportEqualGCPCloudSQL(this, that *GCPCloudSQL) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ProjectID == that.ProjectID &&
-			this.InstanceID == that.InstanceID
+			this.InstanceID == that.InstanceID &&
+			deriveTeleportEqualAlloyDB(&this.AlloyDB, &that.AlloyDB)
+}
+
+// deriveTeleportEqualAlloyDB returns whether this and that are equal.
+func deriveTeleportEqualAlloyDB(this, that *AlloyDB) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.EndpointType == that.EndpointType &&
+			this.EndpointOverride == that.EndpointOverride
 }
 
 // deriveTeleportEqualAzure returns whether this and that are equal.
@@ -62,7 +72,7 @@ func deriveTeleportEqualAzure(this, that *Azure) bool {
 		this != nil && that != nil &&
 			this.Name == that.Name &&
 			this.ResourceID == that.ResourceID &&
-			deriveTeleportEqual_10(&this.Redis, &that.Redis) &&
+			deriveTeleportEqual_11(&this.Redis, &that.Redis) &&
 			this.IsFlexiServer == that.IsFlexiServer
 }
 
@@ -74,7 +84,7 @@ func deriveTeleportEqualDatabaseV3(this, that *DatabaseV3) bool {
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_11(&this.Spec, &that.Spec)
+			deriveTeleportEqual_12(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualDynamicWindowsDesktopV1 returns whether this and that are equal.
@@ -82,7 +92,7 @@ func deriveTeleportEqualDynamicWindowsDesktopV1(this, that *DynamicWindowsDeskto
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_12(&this.Spec, &that.Spec)
+			deriveTeleportEqual_13(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualWindowsDesktopV3 returns whether this and that are equal.
@@ -90,7 +100,7 @@ func deriveTeleportEqualWindowsDesktopV3(this, that *WindowsDesktopV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_13(&this.Spec, &that.Spec)
+			deriveTeleportEqual_14(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualKubeAzure returns whether this and that are equal.
@@ -129,7 +139,7 @@ func deriveTeleportEqualKubernetesClusterV3(this, that *KubernetesClusterV3) boo
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_14(&this.Spec, &that.Spec)
+			deriveTeleportEqual_15(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualKubernetesServerV3 returns whether this and that are equal.
@@ -140,7 +150,8 @@ func deriveTeleportEqualKubernetesServerV3(this, that *KubernetesServerV3) bool
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_15(&this.Spec, &that.Spec)
+			deriveTeleportEqual_16(&this.Spec, &that.Spec) &&
+			this.Scope == that.Scope
 }
 
 // deriveTeleportEqualOktaAssignmentV1 returns whether this and that are equal.
@@ -148,7 +159,7 @@ func deriveTeleportEqualOktaAssignmentV1(this, that *OktaAssignmentV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_16(&this.Spec, &that.Spec)
+			deriveTeleportEqual_17(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualResourceHeader returns whether this and that are equal.
@@ -177,7 +188,7 @@ func deriveTeleportEqualUserGroupV1(this, that *UserGroupV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_17(&this.Spec, &that.Spec)
+			deriveTeleportEqual_18(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqual returns whether this and that are equal.
@@ -186,18 +197,19 @@ func deriveTeleportEqual(this, that *AppSpecV3) bool {
 		this != nil && that != nil &&
 			this.URI == that.URI &&
 			this.PublicAddr == that.PublicAddr &&
-			deriveTeleportEqual_18(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_19(this.DynamicLabels, that.DynamicLabels) &&
 			this.InsecureSkipVerify == that.InsecureSkipVerify &&
-			deriveTeleportEqual_19(this.Rewrite, that.Rewrite) &&
-			deriveTeleportEqual_20(this.AWS, that.AWS) &&
+			deriveTeleportEqual_20(this.Rewrite, that.Rewrite) &&
+			deriveTeleportEqual_21(this.AWS, that.AWS) &&
 			this.Cloud == that.Cloud &&
-			deriveTeleportEqual_21(this.UserGroups, that.UserGroups) &&
+			deriveTeleportEqual_22(this.UserGroups, that.UserGroups) &&
 			this.Integration == that.Integration &&
-			deriveTeleportEqual_21(this.RequiredAppNames, that.RequiredAppNames) &&
-			deriveTeleportEqual_22(this.CORS, that.CORS) &&
-			deriveTeleportEqual_23(this.IdentityCenter, that.IdentityCenter) &&
-			deriveTeleportEqual_24(this.TCPPorts, that.TCPPorts) &&
-			this.UseAnyProxyPublicAddr == that.UseAnyProxyPublicAddr
+			deriveTeleportEqual_22(this.RequiredAppNames, that.RequiredAppNames) &&
+			deriveTeleportEqual_23(this.CORS, that.CORS) &&
+			deriveTeleportEqual_24(this.IdentityCenter, that.IdentityCenter) &&
+			deriveTeleportEqual_25(this.TCPPorts, that.TCPPorts) &&
+			this.UseAnyProxyPublicAddr == that.UseAnyProxyPublicAddr &&
+			deriveTeleportEqual_26(this.MCP, that.MCP)
 }
 
 // deriveTeleportEqual_ returns whether this and that are equal.
@@ -215,9 +227,9 @@ func deriveTeleportEqual_1(this, that *RDS) bool {
 			this.ClusterID == that.ClusterID &&
 			this.ResourceID == that.ResourceID &&
 			this.IAMAuth == that.IAMAuth &&
-			deriveTeleportEqual_21(this.Subnets, that.Subnets) &&
+			deriveTeleportEqual_22(this.Subnets, that.Subnets) &&
 			this.VPCID == that.VPCID &&
-			deriveTeleportEqual_21(this.SecurityGroups, that.SecurityGroups)
+			deriveTeleportEqual_22(this.SecurityGroups, that.SecurityGroups)
 }
 
 // deriveTeleportEqual_2 returns whether this and that are equal.
@@ -225,7 +237,7 @@ func deriveTeleportEqual_2(this, that *ElastiCache) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ReplicationGroupID == that.ReplicationGroupID &&
-			deriveTeleportEqual_21(this.UserGroupIDs, that.UserGroupIDs) &&
+			deriveTeleportEqual_22(this.UserGroupIDs, that.UserGroupIDs) &&
 			this.TransitEncryptionEnabled == that.TransitEncryptionEnabled &&
 			this.EndpointType == that.EndpointType
 }
@@ -305,96 +317,105 @@ func deriveTeleportEqual_9(this, that *DocumentDB) bool {
 }
 
 // deriveTeleportEqual_10 returns whether this and that are equal.
-func deriveTeleportEqual_10(this, that *AzureRedis) bool {
+func deriveTeleportEqual_10(this, that *ElastiCacheServerless) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			this.ClusteringPolicy == that.ClusteringPolicy
+			this.CacheName == that.CacheName
 }
 
 // deriveTeleportEqual_11 returns whether this and that are equal.
-func deriveTeleportEqual_11(this, that *DatabaseSpecV3) bool {
+func deriveTeleportEqual_11(this, that *AzureRedis) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.ClusteringPolicy == that.ClusteringPolicy
+}
+
+// deriveTeleportEqual_12 returns whether this and that are equal.
+func deriveTeleportEqual_12(this, that *DatabaseSpecV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Protocol == that.Protocol &&
 			this.URI == that.URI &&
 			this.CACert == that.CACert &&
-			deriveTeleportEqual_18(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_19(this.DynamicLabels, that.DynamicLabels) &&
 			deriveTeleportEqualAWS(&this.AWS, &that.AWS) &&
 			deriveTeleportEqualGCPCloudSQL(&this.GCP, &that.GCP) &&
 			deriveTeleportEqualAzure(&this.Azure, &that.Azure) &&
-			deriveTeleportEqual_25(&this.TLS, &that.TLS) &&
-			deriveTeleportEqual_26(&this.AD, &that.AD) &&
-			deriveTeleportEqual_27(&this.MySQL, &that.MySQL) &&
-			deriveTeleportEqual_28(this.AdminUser, that.AdminUser) &&
-			deriveTeleportEqual_29(&this.MongoAtlas, &that.MongoAtlas) &&
-			deriveTeleportEqual_30(&this.Oracle, &that.Oracle)
+			deriveTeleportEqual_27(&this.TLS, &that.TLS) &&
+			deriveTeleportEqual_28(&this.AD, &that.AD) &&
+			deriveTeleportEqual_29(&this.MySQL, &that.MySQL) &&
+			deriveTeleportEqual_30(this.AdminUser, that.AdminUser) &&
+			deriveTeleportEqual_31(&this.MongoAtlas, &that.MongoAtlas) &&
+			deriveTeleportEqual_32(&this.Oracle, &that.Oracle)
 }
 
-// deriveTeleportEqual_12 returns whether this and that are equal.
-func deriveTeleportEqual_12(this, that *DynamicWindowsDesktopSpecV1) bool {
+// deriveTeleportEqual_13 returns whether this and that are equal.
+func deriveTeleportEqual_13(this, that *DynamicWindowsDesktopSpecV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Addr == that.Addr &&
 			this.Domain == that.Domain &&
 			this.NonAD == that.NonAD &&
-			deriveTeleportEqual_31(this.ScreenSize, that.ScreenSize)
+			deriveTeleportEqual_33(this.ScreenSize, that.ScreenSize)
 }
 
-// deriveTeleportEqual_13 returns whether this and that are equal.
-func deriveTeleportEqual_13(this, that *WindowsDesktopSpecV3) bool {
+// deriveTeleportEqual_14 returns whether this and that are equal.
+func deriveTeleportEqual_14(this, that *WindowsDesktopSpecV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Addr == that.Addr &&
 			this.Domain == that.Domain &&
 			this.HostID == that.HostID &&
 			this.NonAD == that.NonAD &&
-			deriveTeleportEqual_31(this.ScreenSize, that.ScreenSize)
+			deriveTeleportEqual_33(this.ScreenSize, that.ScreenSize)
 }
 
-// deriveTeleportEqual_14 returns whether this and that are equal.
-func deriveTeleportEqual_14(this, that *KubernetesClusterSpecV3) bool {
+// deriveTeleportEqual_15 returns whether this and that are equal.
+func deriveTeleportEqual_15(this, that *KubernetesClusterSpecV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_18(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_19(this.DynamicLabels, that.DynamicLabels) &&
 			bytes.Equal(this.Kubeconfig, that.Kubeconfig) &&
 			deriveTeleportEqualKubeAzure(&this.Azure, &that.Azure) &&
 			deriveTeleportEqualKubeAWS(&this.AWS, &that.AWS) &&
 			deriveTeleportEqualKubeGCP(&this.GCP, &that.GCP)
 }
 
-// deriveTeleportEqual_15 returns whether this and that are equal.
-func deriveTeleportEqual_15(this, that *KubernetesServerSpecV3) bool {
+// deriveTeleportEqual_16 returns whether this and that are equal.
+func deriveTeleportEqual_16(this, that *KubernetesServerSpecV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Version == that.Version &&
 			this.Hostname == that.Hostname &&
 			this.HostID == that.HostID &&
-			deriveTeleportEqual_32(&this.Rotation, &that.Rotation) &&
+			deriveTeleportEqual_34(&this.Rotation, &that.Rotation) &&
 			deriveTeleportEqualKubernetesClusterV3(this.Cluster, that.Cluster) &&
-			deriveTeleportEqual_21(this.ProxyIDs, that.ProxyIDs)
+			deriveTeleportEqual_22(this.ProxyIDs, that.ProxyIDs) &&
+			this.RelayGroup == that.RelayGroup &&
+			deriveTeleportEqual_22(this.RelayIds, that.RelayIds)
 }
 
-// deriveTeleportEqual_16 returns whether this and that are equal.
-func deriveTeleportEqual_16(this, that *OktaAssignmentSpecV1) bool {
+// deriveTeleportEqual_17 returns whether this and that are equal.
+func deriveTeleportEqual_17(this, that *OktaAssignmentSpecV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.User == that.User &&
-			deriveTeleportEqual_33(this.Targets, that.Targets) &&
+			deriveTeleportEqual_35(this.Targets, that.Targets) &&
 			this.CleanupTime.Equal(that.CleanupTime) &&
 			this.Status == that.Status &&
 			this.LastTransition.Equal(that.LastTransition) &&
 			this.Finalized == that.Finalized
 }
 
-// deriveTeleportEqual_17 returns whether this and that are equal.
-func deriveTeleportEqual_17(this, that *UserGroupSpecV1) bool {
+// deriveTeleportEqual_18 returns whether this and that are equal.
+func deriveTeleportEqual_18(this, that *UserGroupSpecV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_21(this.Applications, that.Applications)
+			deriveTeleportEqual_22(this.Applications, that.Applications)
 }
 
-// deriveTeleportEqual_18 returns whether this and that are equal.
-func deriveTeleportEqual_18(this, that map[string]CommandLabelV2) bool {
+// deriveTeleportEqual_19 returns whether this and that are equal.
+func deriveTeleportEqual_19(this, that map[string]CommandLabelV2) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -406,32 +427,32 @@ func deriveTeleportEqual_18(this, that map[string]CommandLabelV2) bool {
 		if !ok {
 			return false
 		}
-		if !(deriveTeleportEqual_34(&v, &thatv)) {
+		if !(deriveTeleportEqual_36(&v, &thatv)) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_19 returns whether this and that are equal.
-func deriveTeleportEqual_19(this, that *Rewrite) bool {
+// deriveTeleportEqual_20 returns whether this and that are equal.
+func deriveTeleportEqual_20(this, that *Rewrite) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_21(this.Redirect, that.Redirect) &&
-			deriveTeleportEqual_35(this.Headers, that.Headers) &&
+			deriveTeleportEqual_22(this.Redirect, that.Redirect) &&
+			deriveTeleportEqual_37(this.Headers, that.Headers) &&
 			this.JWTClaims == that.JWTClaims
 }
 
-// deriveTeleportEqual_20 returns whether this and that are equal.
-func deriveTeleportEqual_20(this, that *AppAWS) bool {
+// deriveTeleportEqual_21 returns whether this and that are equal.
+func deriveTeleportEqual_21(this, that *AppAWS) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ExternalID == that.ExternalID &&
-			deriveTeleportEqual_36(this.RolesAnywhereProfile, that.RolesAnywhereProfile)
+			deriveTeleportEqual_38(this.RolesAnywhereProfile, that.RolesAnywhereProfile)
 }
 
-// deriveTeleportEqual_21 returns whether this and that are equal.
-func deriveTeleportEqual_21(this, that []string) bool {
+// deriveTeleportEqual_22 returns whether this and that are equal.
+func deriveTeleportEqual_22(this, that []string) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -446,28 +467,28 @@ func deriveTeleportEqual_21(this, that []string) bool {
 	return true
 }
 
-// deriveTeleportEqual_22 returns whether this and that are equal.
-func deriveTeleportEqual_22(this, that *CORSPolicy) bool {
+// deriveTeleportEqual_23 returns whether this and that are equal.
+func deriveTeleportEqual_23(this, that *CORSPolicy) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_21(this.AllowedOrigins, that.AllowedOrigins) &&
-			deriveTeleportEqual_21(this.AllowedMethods, that.AllowedMethods) &&
-			deriveTeleportEqual_21(this.AllowedHeaders, that.AllowedHeaders) &&
+			deriveTeleportEqual_22(this.AllowedOrigins, that.AllowedOrigins) &&
+			deriveTeleportEqual_22(this.AllowedMethods, that.AllowedMethods) &&
+			deriveTeleportEqual_22(this.AllowedHeaders, that.AllowedHeaders) &&
 			this.AllowCredentials == that.AllowCredentials &&
 			this.MaxAge == that.MaxAge &&
-			deriveTeleportEqual_21(this.ExposedHeaders, that.ExposedHeaders)
+			deriveTeleportEqual_22(this.ExposedHeaders, that.ExposedHeaders)
 }
 
-// deriveTeleportEqual_23 returns whether this and that are equal.
-func deriveTeleportEqual_23(this, that *AppIdentityCenter) bool {
+// deriveTeleportEqual_24 returns whether this and that are equal.
+func deriveTeleportEqual_24(this, that *AppIdentityCenter) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.AccountID == that.AccountID &&
-			deriveTeleportEqual_37(this.PermissionSets, that.PermissionSets)
+			deriveTeleportEqual_39(this.PermissionSets, that.PermissionSets)
 }
 
-// deriveTeleportEqual_24 returns whether this and that are equal.
-func deriveTeleportEqual_24(this, that []*PortRange) bool {
+// deriveTeleportEqual_25 returns whether this and that are equal.
+func deriveTeleportEqual_25(this, that []*PortRange) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -475,15 +496,24 @@ func deriveTeleportEqual_24(this, that []*PortRange) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_38(this[i], that[i])) {
+		if !(deriveTeleportEqual_40(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_25 returns whether this and that are equal.
-func deriveTeleportEqual_25(this, that *DatabaseTLS) bool {
+// deriveTeleportEqual_26 returns whether this and that are equal.
+func deriveTeleportEqual_26(this, that *MCP) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Command == that.Command &&
+			deriveTeleportEqual_22(this.Args, that.Args) &&
+			this.RunAsHostUser == that.RunAsHostUser
+}
+
+// deriveTeleportEqual_27 returns whether this and that are equal.
+func deriveTeleportEqual_27(this, that *DatabaseTLS) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Mode == that.Mode &&
@@ -492,8 +522,8 @@ func deriveTeleportEqual_25(this, that *DatabaseTLS) bool {
 			this.TrustSystemCertPool == that.TrustSystemCertPool
 }
 
-// deriveTeleportEqual_26 returns whether this and that are equal.
-func deriveTeleportEqual_26(this, that *AD) bool {
+// deriveTeleportEqual_28 returns whether this and that are equal.
+func deriveTeleportEqual_28(this, that *AD) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.KeytabFile == that.KeytabFile &&
@@ -506,45 +536,47 @@ func deriveTeleportEqual_26(this, that *AD) bool {
 			this.LDAPServiceAccountSID == that.LDAPServiceAccountSID
 }
 
-// deriveTeleportEqual_27 returns whether this and that are equal.
-func deriveTeleportEqual_27(this, that *MySQLOptions) bool {
+// deriveTeleportEqual_29 returns whether this and that are equal.
+func deriveTeleportEqual_29(this, that *MySQLOptions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ServerVersion == that.ServerVersion
 }
 
-// deriveTeleportEqual_28 returns whether this and that are equal.
-func deriveTeleportEqual_28(this, that *DatabaseAdminUser) bool {
+// deriveTeleportEqual_30 returns whether this and that are equal.
+func deriveTeleportEqual_30(this, that *DatabaseAdminUser) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
 			this.DefaultDatabase == that.DefaultDatabase
 }
 
-// deriveTeleportEqual_29 returns whether this and that are equal.
-func deriveTeleportEqual_29(this, that *MongoAtlas) bool {
+// deriveTeleportEqual_31 returns whether this and that are equal.
+func deriveTeleportEqual_31(this, that *MongoAtlas) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name
 }
 
-// deriveTeleportEqual_30 returns whether this and that are equal.
-func deriveTeleportEqual_30(this, that *OracleOptions) bool {
+// deriveTeleportEqual_32 returns whether this and that are equal.
+func deriveTeleportEqual_32(this, that *OracleOptions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			this.AuditUser == that.AuditUser
+			this.AuditUser == that.AuditUser &&
+			this.RetryCount == that.RetryCount &&
+			this.ShuffleHostnames == that.ShuffleHostnames
 }
 
-// deriveTeleportEqual_31 returns whether this and that are equal.
-func deriveTeleportEqual_31(this, that *Resolution) bool {
+// deriveTeleportEqual_33 returns whether this and that are equal.
+func deriveTeleportEqual_33(this, that *Resolution) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Width == that.Width &&
 			this.Height == that.Height
 }
 
-// deriveTeleportEqual_32 returns whether this and that are equal.
-func deriveTeleportEqual_32(this, that *Rotation) bool {
+// deriveTeleportEqual_34 returns whether this and that are equal.
+func deriveTeleportEqual_34(this, that *Rotation) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.State == that.State &&
@@ -554,11 +586,11 @@ func deriveTeleportEqual_32(this, that *Rotation) bool {
 			this.Started.Equal(that.Started) &&
 			this.GracePeriod == that.GracePeriod &&
 			this.LastRotated.Equal(that.LastRotated) &&
-			deriveTeleportEqual_39(&this.Schedule, &that.Schedule)
+			deriveTeleportEqual_41(&this.Schedule, &that.Schedule)
 }
 
-// deriveTeleportEqual_33 returns whether this and that are equal.
-func deriveTeleportEqual_33(this, that []*OktaAssignmentTargetV1) bool {
+// deriveTeleportEqual_35 returns whether this and that are equal.
+func deriveTeleportEqual_35(this, that []*OktaAssignmentTargetV1) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -566,24 +598,24 @@ func deriveTeleportEqual_33(this, that []*OktaAssignmentTargetV1) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_40(this[i], that[i])) {
+		if !(deriveTeleportEqual_42(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_34 returns whether this and that are equal.
-func deriveTeleportEqual_34(this, that *CommandLabelV2) bool {
+// deriveTeleportEqual_36 returns whether this and that are equal.
+func deriveTeleportEqual_36(this, that *CommandLabelV2) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Period == that.Period &&
-			deriveTeleportEqual_21(this.Command, that.Command) &&
+			deriveTeleportEqual_22(this.Command, that.Command) &&
 			this.Result == that.Result
 }
 
-// deriveTeleportEqual_35 returns whether this and that are equal.
-func deriveTeleportEqual_35(this, that []*Header) bool {
+// deriveTeleportEqual_37 returns whether this and that are equal.
+func deriveTeleportEqual_37(this, that []*Header) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -591,23 +623,23 @@ func deriveTeleportEqual_35(this, that []*Header) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_41(this[i], that[i])) {
+		if !(deriveTeleportEqual_43(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_36 returns whether this and that are equal.
-func deriveTeleportEqual_36(this, that *AppAWSRolesAnywhereProfile) bool {
+// deriveTeleportEqual_38 returns whether this and that are equal.
+func deriveTeleportEqual_38(this, that *AppAWSRolesAnywhereProfile) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ProfileARN == that.ProfileARN &&
 			this.AcceptRoleSessionName == that.AcceptRoleSessionName
 }
 
-// deriveTeleportEqual_37 returns whether this and that are equal.
-func deriveTeleportEqual_37(this, that []*IdentityCenterPermissionSet) bool {
+// deriveTeleportEqual_39 returns whether this and that are equal.
+func deriveTeleportEqual_39(this, that []*IdentityCenterPermissionSet) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -615,23 +647,23 @@ func deriveTeleportEqual_37(this, that []*IdentityCenterPermissionSet) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_42(this[i], that[i])) {
+		if !(deriveTeleportEqual_44(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_38 returns whether this and that are equal.
-func deriveTeleportEqual_38(this, that *PortRange) bool {
+// deriveTeleportEqual_40 returns whether this and that are equal.
+func deriveTeleportEqual_40(this, that *PortRange) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Port == that.Port &&
 			this.EndPort == that.EndPort
 }
 
-// deriveTeleportEqual_39 returns whether this and that are equal.
-func deriveTeleportEqual_39(this, that *RotationSchedule) bool {
+// deriveTeleportEqual_41 returns whether this and that are equal.
+func deriveTeleportEqual_41(this, that *RotationSchedule) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.UpdateClients.Equal(that.UpdateClients) &&
@@ -639,24 +671,24 @@ func deriveTeleportEqual_39(this, that *RotationSchedule) bool {
 			this.Standby.Equal(that.Standby)
 }
 
-// deriveTeleportEqual_40 returns whether this and that are equal.
-func deriveTeleportEqual_40(this, that *OktaAssignmentTargetV1) bool {
+// deriveTeleportEqual_42 returns whether this and that are equal.
+func deriveTeleportEqual_42(this, that *OktaAssignmentTargetV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Type == that.Type &&
 			this.Id == that.Id
 }
 
-// deriveTeleportEqual_41 returns whether this and that are equal.
-func deriveTeleportEqual_41(this, that *Header) bool {
+// deriveTeleportEqual_43 returns whether this and that are equal.
+func deriveTeleportEqual_43(this, that *Header) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
 			this.Value == that.Value
 }
 
-// deriveTeleportEqual_42 returns whether this and that are equal.
-func deriveTeleportEqual_42(this, that *IdentityCenterPermissionSet) bool {
+// deriveTeleportEqual_44 returns whether this and that are equal.
+func deriveTeleportEqual_44(this, that *IdentityCenterPermissionSet) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ARN == that.ARN &&
diff --git a/api/types/desktop.go b/api/types/desktop.go
index ae31c3e976221..f06d0d16168f8 100644
--- a/api/types/desktop.go
+++ b/api/types/desktop.go
@@ -45,6 +45,12 @@ type WindowsDesktopService interface {
 	GetHostname() string
 	// ProxiedService provides common methods for a proxied service.
 	ProxiedService
+	// GetRelayGroup returns the name of the Relay group that this service is
+	// connected to.
+	GetRelayGroup() string
+	// GetRelayIDs returns the list of Relay host IDs that this service is
+	// connected to.
+	GetRelayIDs() []string
 	// Clone creates a copy of the service.
 	Clone() WindowsDesktopService
 }
@@ -117,6 +123,22 @@ func (s *WindowsDesktopServiceV3) SetProxyIDs(proxyIDs []string) {
 	s.Spec.ProxyIDs = proxyIDs
 }
 
+// GetRelayGroup implements [WindowsDesktopService].
+func (s *WindowsDesktopServiceV3) GetRelayGroup() string {
+	if s == nil {
+		return ""
+	}
+	return s.Spec.RelayGroup
+}
+
+// GetRelayIDs implements [WindowsDesktopService].
+func (s *WindowsDesktopServiceV3) GetRelayIDs() []string {
+	if s == nil {
+		return nil
+	}
+	return s.Spec.RelayIds
+}
+
 // GetHostname returns the windows hostname of this service.
 func (s *WindowsDesktopServiceV3) GetHostname() string {
 	return s.Spec.Hostname
diff --git a/api/types/discoveryconfig/convert/v1/discoveryconfig.go b/api/types/discoveryconfig/convert/v1/discoveryconfig.go
index 4c5083a975f0d..ff5aed11b171d 100644
--- a/api/types/discoveryconfig/convert/v1/discoveryconfig.go
+++ b/api/types/discoveryconfig/convert/v1/discoveryconfig.go
@@ -34,48 +34,48 @@ func FromProto(msg *discoveryconfigv1.DiscoveryConfig) (*discoveryconfig.Discove
 		return nil, trace.BadParameter("discovery config message is nil")
 	}
 
-	if msg.Spec == nil {
+	if msg.GetSpec() == nil {
 		return nil, trace.BadParameter("spec is missing")
 	}
-	if msg.Spec.DiscoveryGroup == "" {
+	if msg.GetSpec().GetDiscoveryGroup() == "" {
 		return nil, trace.BadParameter("discovery group is missing")
 	}
 
-	awsMatchers := make([]types.AWSMatcher, 0, len(msg.Spec.Aws))
-	for _, m := range msg.Spec.Aws {
+	awsMatchers := make([]types.AWSMatcher, 0, len(msg.GetSpec().GetAws()))
+	for _, m := range msg.GetSpec().GetAws() {
 		awsMatchers = append(awsMatchers, *m)
 	}
 
-	azureMatchers := make([]types.AzureMatcher, 0, len(msg.Spec.Azure))
-	for _, m := range msg.Spec.Azure {
+	azureMatchers := make([]types.AzureMatcher, 0, len(msg.GetSpec().GetAzure()))
+	for _, m := range msg.GetSpec().GetAzure() {
 		azureMatchers = append(azureMatchers, *m)
 	}
 
-	gcpMatchers := make([]types.GCPMatcher, 0, len(msg.Spec.Gcp))
-	for _, m := range msg.Spec.Gcp {
+	gcpMatchers := make([]types.GCPMatcher, 0, len(msg.GetSpec().GetGcp()))
+	for _, m := range msg.GetSpec().GetGcp() {
 		gcpMatchers = append(gcpMatchers, *m)
 	}
 
-	kubeMatchers := make([]types.KubernetesMatcher, 0, len(msg.Spec.Kube))
-	for _, m := range msg.Spec.Kube {
+	kubeMatchers := make([]types.KubernetesMatcher, 0, len(msg.GetSpec().GetKube()))
+	for _, m := range msg.GetSpec().GetKube() {
 		kubeMatchers = append(kubeMatchers, *m)
 	}
 
 	discoveryConfig, err := discoveryconfig.NewDiscoveryConfig(
-		headerv1.FromMetadataProto(msg.Header.Metadata),
+		headerv1.FromMetadataProto(msg.GetHeader().GetMetadata()),
 		discoveryconfig.Spec{
-			DiscoveryGroup: msg.Spec.DiscoveryGroup,
+			DiscoveryGroup: msg.GetSpec().GetDiscoveryGroup(),
 			AWS:            awsMatchers,
 			Azure:          azureMatchers,
 			GCP:            gcpMatchers,
 			Kube:           kubeMatchers,
-			AccessGraph:    msg.Spec.AccessGraph,
+			AccessGraph:    msg.GetSpec().GetAccessGraph(),
 		},
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	discoveryConfig.Status = StatusFromProto(msg.Status)
+	discoveryConfig.Status = StatusFromProto(msg.GetStatus())
 	return discoveryConfig, nil
 }
 
diff --git a/api/types/discoveryconfig/derived.gen.go b/api/types/discoveryconfig/derived.gen.go
index 3ba43afc89bb7..26419729f5262 100644
--- a/api/types/discoveryconfig/derived.gen.go
+++ b/api/types/discoveryconfig/derived.gen.go
@@ -153,7 +153,8 @@ func deriveTeleportEqual_8(this, that *types.AWSMatcher) bool {
 			deriveTeleportEqual_18(this.SSM, that.SSM) &&
 			this.Integration == that.Integration &&
 			this.KubeAppDiscovery == that.KubeAppDiscovery &&
-			this.SetupAccessForARN == that.SetupAccessForARN
+			this.SetupAccessForARN == that.SetupAccessForARN &&
+			deriveTeleportEqual_19(this.Organization, that.Organization)
 }
 
 // deriveTeleportEqual_9 returns whether this and that are equal.
@@ -165,7 +166,8 @@ func deriveTeleportEqual_9(this, that *types.AzureMatcher) bool {
 			deriveTeleportEqual_14(this.Types, that.Types) &&
 			deriveTeleportEqual_14(this.Regions, that.Regions) &&
 			deriveTeleportEqual_16(this.ResourceTags, that.ResourceTags) &&
-			deriveTeleportEqual_17(this.Params, that.Params)
+			deriveTeleportEqual_17(this.Params, that.Params) &&
+			this.Integration == that.Integration
 }
 
 // deriveTeleportEqual_10 returns whether this and that are equal.
@@ -199,7 +201,7 @@ func deriveTeleportEqual_12(this, that []*types.AccessGraphAWSSync) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_19(this[i], that[i])) {
+		if !(deriveTeleportEqual_20(this[i], that[i])) {
 			return false
 		}
 	}
@@ -215,7 +217,7 @@ func deriveTeleportEqual_13(this, that []*types.AccessGraphAzureSync) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_20(this[i], that[i])) {
+		if !(deriveTeleportEqual_21(this[i], that[i])) {
 			return false
 		}
 	}
@@ -276,8 +278,11 @@ func deriveTeleportEqual_17(this, that *types.InstallerParams) bool {
 			this.InstallTeleport == that.InstallTeleport &&
 			this.SSHDConfig == that.SSHDConfig &&
 			this.PublicProxyAddr == that.PublicProxyAddr &&
-			deriveTeleportEqual_21(this.Azure, that.Azure) &&
-			this.EnrollMode == that.EnrollMode
+			deriveTeleportEqual_22(this.Azure, that.Azure) &&
+			this.EnrollMode == that.EnrollMode &&
+			this.Suffix == that.Suffix &&
+			this.UpdateGroup == that.UpdateGroup &&
+			deriveTeleportEqual_23(this.HTTPProxySettings, that.HTTPProxySettings)
 }
 
 // deriveTeleportEqual_18 returns whether this and that are equal.
@@ -288,34 +293,67 @@ func deriveTeleportEqual_18(this, that *types.AWSSSM) bool {
 }
 
 // deriveTeleportEqual_19 returns whether this and that are equal.
-func deriveTeleportEqual_19(this, that *types.AccessGraphAWSSync) bool {
+func deriveTeleportEqual_19(this, that *types.AWSOrganizationMatcher) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.OrganizationID == that.OrganizationID &&
+			deriveTeleportEqual_24(this.OrganizationalUnits, that.OrganizationalUnits)
+}
+
+// deriveTeleportEqual_20 returns whether this and that are equal.
+func deriveTeleportEqual_20(this, that *types.AccessGraphAWSSync) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_14(this.Regions, that.Regions) &&
 			deriveTeleportEqual_15(this.AssumeRole, that.AssumeRole) &&
 			this.Integration == that.Integration &&
-			deriveTeleportEqual_22(this.CloudTrailLogs, that.CloudTrailLogs)
+			deriveTeleportEqual_25(this.CloudTrailLogs, that.CloudTrailLogs) &&
+			deriveTeleportEqual_26(this.EksAuditLogs, that.EksAuditLogs)
 }
 
-// deriveTeleportEqual_20 returns whether this and that are equal.
-func deriveTeleportEqual_20(this, that *types.AccessGraphAzureSync) bool {
+// deriveTeleportEqual_21 returns whether this and that are equal.
+func deriveTeleportEqual_21(this, that *types.AccessGraphAzureSync) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.SubscriptionID == that.SubscriptionID &&
 			this.Integration == that.Integration
 }
 
-// deriveTeleportEqual_21 returns whether this and that are equal.
-func deriveTeleportEqual_21(this, that *types.AzureInstallerParams) bool {
+// deriveTeleportEqual_22 returns whether this and that are equal.
+func deriveTeleportEqual_22(this, that *types.AzureInstallerParams) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ClientID == that.ClientID
 }
 
-// deriveTeleportEqual_22 returns whether this and that are equal.
-func deriveTeleportEqual_22(this, that *types.AccessGraphAWSSyncCloudTrailLogs) bool {
+// deriveTeleportEqual_23 returns whether this and that are equal.
+func deriveTeleportEqual_23(this, that *types.HTTPProxySettings) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.HTTPProxy == that.HTTPProxy &&
+			this.HTTPSProxy == that.HTTPSProxy &&
+			this.NoProxy == that.NoProxy
+}
+
+// deriveTeleportEqual_24 returns whether this and that are equal.
+func deriveTeleportEqual_24(this, that *types.AWSOrganizationUnitsMatcher) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_14(this.Include, that.Include) &&
+			deriveTeleportEqual_14(this.Exclude, that.Exclude)
+}
+
+// deriveTeleportEqual_25 returns whether this and that are equal.
+func deriveTeleportEqual_25(this, that *types.AccessGraphAWSSyncCloudTrailLogs) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Region == that.Region &&
 			this.SQSQueue == that.SQSQueue
 }
+
+// deriveTeleportEqual_26 returns whether this and that are equal.
+func deriveTeleportEqual_26(this, that *types.AccessGraphAWSSyncEKSAuditLogs) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_16(this.Tags, that.Tags)
+}
diff --git a/api/types/discoveryconfig/discoveryconfig.go b/api/types/discoveryconfig/discoveryconfig.go
index 64d42367e773f..a2cd66eff97b0 100644
--- a/api/types/discoveryconfig/discoveryconfig.go
+++ b/api/types/discoveryconfig/discoveryconfig.go
@@ -201,6 +201,15 @@ func (a *DiscoveryConfig) MatchSearch(values []string) bool {
 	return types.MatchSearch(fieldVals, values, nil)
 }
 
+// IsMatchersEmpty returns true if all matchers are empty.
+func (a *DiscoveryConfig) IsMatchersEmpty() bool {
+	return len(a.Spec.AWS) == 0 &&
+		len(a.Spec.Azure) == 0 &&
+		len(a.Spec.GCP) == 0 &&
+		len(a.Spec.Kube) == 0 &&
+		(a.Spec.AccessGraph == nil || len(a.Spec.AccessGraph.AWS) == 0)
+}
+
 // CloneResource returns a copy of the resource as types.ResourceWithLabels.
 func (a *DiscoveryConfig) CloneResource() types.ResourceWithLabels {
 	var copy *DiscoveryConfig
diff --git a/api/types/discoveryconfig/discoveryconfig_test.go b/api/types/discoveryconfig/discoveryconfig_test.go
index 39c2cca20643b..b8439dd0aa015 100644
--- a/api/types/discoveryconfig/discoveryconfig_test.go
+++ b/api/types/discoveryconfig/discoveryconfig_test.go
@@ -451,3 +451,110 @@ func TestNewDiscoveryConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestDiscoveryConfig_IsMatchersEmpty(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		config   *DiscoveryConfig
+		expected bool
+	}{
+		{
+			name: "empty config",
+			config: &DiscoveryConfig{
+				Spec: Spec{},
+			},
+			expected: true,
+		},
+		{
+			name: "has AWS matchers",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					AWS: []types.AWSMatcher{{
+						Types:   []string{"ec2"},
+						Regions: []string{"us-west-2"},
+					}},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has Azure matchers",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					Azure: []types.AzureMatcher{{
+						Types:   []string{"vm"},
+						Regions: []string{"europe-west-2"},
+					}},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has GCP matchers",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					GCP: []types.GCPMatcher{{
+						Types:      []string{"gce"},
+						ProjectIDs: []string{"p1"},
+					}},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has Kube matchers",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					Kube: []types.KubernetesMatcher{{
+						Types: []string{"app"},
+					}},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has AccessGraph with AWS",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					AccessGraph: &types.AccessGraphSync{
+						AWS: []*types.AccessGraphAWSSync{{
+							Integration: "integration1",
+							Regions:     []string{"us-west-2"},
+						}},
+					},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has AccessGraph but no AWS",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					AccessGraph: &types.AccessGraphSync{},
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "has multiple matcher types",
+			config: &DiscoveryConfig{
+				Spec: Spec{
+					AWS: []types.AWSMatcher{{
+						Types:   []string{"ec2"},
+						Regions: []string{"us-west-2"},
+					}},
+					Azure: []types.AzureMatcher{{
+						Types:   []string{"vm"},
+						Regions: []string{"europe-west-2"},
+					}},
+				},
+			},
+			expected: false,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.config.IsMatchersEmpty()
+			require.Equal(t, tt.expected, got)
+		})
+	}
+}
diff --git a/api/types/events/api.go b/api/types/events/api.go
index 96456005dba94..54307bd95fa4d 100644
--- a/api/types/events/api.go
+++ b/api/types/events/api.go
@@ -115,3 +115,15 @@ type Stream interface {
 	// the stream completed and closes the stream instance
 	Close(ctx context.Context) error
 }
+
+const (
+	// EventProtocolsSSH specifies SSH as a type of captured protocol
+	EventProtocolSSH = "ssh"
+	// EventProtocolKube specifies kubernetes as a type of captured protocol
+	EventProtocolKube = "kube"
+	// EventProtocolTDP specifies Teleport Desktop Protocol (TDP)
+	// as a type of captured protocol
+	EventProtocolTDP = "tdp"
+	// EventProtocolDB specifies database as a type of captured protocol
+	EventProtocolDB = "db"
+)
diff --git a/api/types/events/events.go b/api/types/events/events.go
index d988a5ebcbfd4..2e7c8ae229ff8 100644
--- a/api/types/events/events.go
+++ b/api/types/events/events.go
@@ -80,15 +80,16 @@ func computeEventID(evt AuditEvent, payload []byte) string {
 }
 
 // trimStr trims a string to a given length.
-func trimStr(s string, n int) string {
+func trimStr[T string | []byte](s T, n int) T {
 	// Starting at 2 to leave room for quotes at the begging and end.
 	charCount := 2
-	for i, r := range s {
+	for i := range len(s) {
 		// Make sure we always have room to add an escape character if necessary.
 		if charCount+1 > n {
 			return s[:i]
 		}
-		if r == rune('"') || r == '\\' {
+		r := rune(s[i])
+		if r == '"' || r == '\\' {
 			charCount++
 		}
 		charCount++
@@ -113,6 +114,14 @@ func adjustedMaxSize(e AuditEvent, maxSize int) int {
 	return maxSize - sizeBallast
 }
 
+// nonEmptyStr returns 1 if the input string is not empty
+func nonEmptyStr[T string | []byte](s T) int {
+	if len(s) == 0 {
+		return 0
+	}
+	return 1
+}
+
 // nonEmptyStrs returns the number of non-empty strings.
 func nonEmptyStrs(s ...string) int {
 	nonEmptyStrs := 0
@@ -153,10 +162,10 @@ func (m *Status) nonEmptyStrs() int {
 	return nonEmptyStrs(m.Error, m.UserMessage)
 }
 
-func (m *Status) trimToMaxSize(maxSize int) Status {
+func (m *Status) trimToMaxFieldSize(maxFieldSize int) Status {
 	var out Status
-	out.Error = trimStr(m.Error, maxSize)
-	out.UserMessage = trimStr(m.UserMessage, maxSize)
+	out.Error = trimStr(m.Error, maxFieldSize)
+	out.UserMessage = trimStr(m.UserMessage, maxFieldSize)
 	return out
 }
 
@@ -183,7 +192,7 @@ func (m *Struct) nonEmptyStrs() int {
 	return toTrim
 }
 
-func (m *Struct) trimToMaxSize(maxSize int) *Struct {
+func (m *Struct) trimToMaxFieldSize(maxFieldSize int) *Struct {
 	if len(m.Fields) == 0 {
 		return m
 	}
@@ -194,11 +203,11 @@ func (m *Struct) trimToMaxSize(maxSize int) *Struct {
 		},
 	}
 	for k, v := range m.Fields {
-		trimmedKey := trimStr(k, maxSize)
+		trimmedKey := trimStr(k, maxFieldSize)
 
 		if v != nil {
 			if strVal := v.GetStringValue(); strVal != "" {
-				trimmedVal := trimStr(strVal, maxSize)
+				trimmedVal := trimStr(strVal, maxFieldSize)
 				out.Fields[trimmedKey] = &types.Value{
 					Kind: &types.Value_StringValue{
 						StringValue: trimmedVal,
@@ -207,7 +216,7 @@ func (m *Struct) trimToMaxSize(maxSize int) *Struct {
 			} else if l := v.GetListValue(); l != nil {
 				for i, lv := range l.Values {
 					if strVal := lv.GetStringValue(); strVal != "" {
-						trimmedVal := trimStr(strVal, maxSize)
+						trimmedVal := trimStr(strVal, maxFieldSize)
 						l.Values[i] = &types.Value{
 							Kind: &types.Value_StringValue{
 								StringValue: trimmedVal,
@@ -377,26 +386,12 @@ func (m *ClientDisconnect) TrimToMaxSize(maxSize int) AuditEvent {
 // per-field max size where only user input message fields DatabaseQuery and DatabaseQueryParameters are taken into
 // account.
 func (m *DatabaseSessionQuery) TrimToMaxSize(maxSize int) AuditEvent {
-	size := m.Size()
-	if size <= maxSize {
-		return m
-	}
-
-	out := utils.CloneProtoMsg(m)
-	out.DatabaseQuery = ""
-	out.DatabaseQueryParameters = nil
-
-	maxSize = adjustedMaxSize(out, maxSize)
-
-	// Check how many custom fields are set.
-	customFieldsCount := nonEmptyStrs(m.DatabaseQuery) + nonEmptyStrsInSlice(m.DatabaseQueryParameters)
-
-	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
-
-	out.DatabaseQuery = trimStr(m.DatabaseQuery, maxFieldsSize)
-	out.DatabaseQueryParameters = trimStrSlice(m.DatabaseQueryParameters, maxFieldsSize)
-
-	return out
+	return trimEventToMaxSize(m, maxSize, func(m *DatabaseSessionQuery, out *DatabaseSessionQuery) fieldTrimmer {
+		return fieldTrimmers{
+			newStrTrimmer(m.DatabaseQuery, &out.DatabaseQuery),
+			newStrSliceTrimmer(m.DatabaseQueryParameters, &out.DatabaseQueryParameters),
+		}
+	})
 }
 
 // TrimToMaxSize trims the Exec event to the given maximum size.
@@ -427,21 +422,9 @@ func (m *Exec) TrimToMaxSize(maxSize int) AuditEvent {
 // underlying storage and thus cause the events to be omitted entirely. See
 // teleport-private#172.
 func (m *UserLogin) TrimToMaxSize(maxSize int) AuditEvent {
-	size := m.Size()
-	if size <= maxSize {
-		return m
-	}
-
-	out := utils.CloneProtoMsg(m)
-	out.Status = Status{}
-
-	maxSize = adjustedMaxSize(out, maxSize)
-	customFieldsCount := m.Status.nonEmptyStrs()
-	maxFieldSize := maxSizePerField(maxSize, customFieldsCount)
-
-	out.Status = m.Status.trimToMaxSize(maxFieldSize)
-
-	return out
+	return trimEventToMaxSize(m, maxSize, func(m, out *UserLogin) fieldTrimmer {
+		return newGenericTrimmer(&m.Status, &out.Status)
+	})
 }
 
 func (m *UserDelete) TrimToMaxSize(maxSize int) AuditEvent {
@@ -510,7 +493,7 @@ func (m *AccessRequestCreate) TrimToMaxSize(maxSize int) AuditEvent {
 
 	out.Roles = trimStrSlice(m.Roles, maxFieldsSize)
 	out.Reason = trimStr(m.Reason, maxFieldsSize)
-	out.Annotations = m.Annotations.trimToMaxSize(maxFieldsSize)
+	out.Annotations = m.Annotations.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -774,6 +757,10 @@ func (m *AppSessionChunk) TrimToMaxSize(maxSize int) AuditEvent {
 	return m
 }
 
+func (m *AppSessionChunk) GetSessionChunkID() string {
+	return m.SessionChunkID
+}
+
 func (m *AppSessionRequest) TrimToMaxSize(maxSize int) AuditEvent {
 	size := m.Size()
 	if size <= maxSize {
@@ -815,7 +802,7 @@ func (m *AppSessionDynamoDBRequest) TrimToMaxSize(maxSize int) AuditEvent {
 	out.Path = trimStr(m.Path, maxFieldsSize)
 	out.RawQuery = trimStr(m.RawQuery, maxFieldsSize)
 	out.Target = trimStr(m.Target, maxFieldsSize)
-	out.Body = m.Body.trimToMaxSize(maxFieldsSize)
+	out.Body = m.Body.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -858,7 +845,7 @@ func (m *DatabaseSessionStart) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -909,7 +896,7 @@ func (m *DatabaseUserCreate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.Username) + nonEmptyStrsInSlice(m.Roles)
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Username = trimStr(m.Username, maxFieldsSize)
 	out.Roles = trimStrSlice(m.Roles, maxFieldsSize)
 
@@ -931,7 +918,7 @@ func (m *DatabaseUserDeactivate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.Username)
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Username = trimStr(m.Username, maxFieldsSize)
 
 	return out
@@ -1305,7 +1292,7 @@ func (m *DynamoDBRequest) TrimToMaxSize(maxSize int) AuditEvent {
 
 	out.Path = trimStr(m.Path, maxFieldsSize)
 	out.RawQuery = trimStr(m.RawQuery, maxFieldsSize)
-	out.Body = m.Body.trimToMaxSize(maxFieldsSize)
+	out.Body = m.Body.trimToMaxFieldSize(maxFieldsSize)
 	out.Target = trimStr(m.Target, maxFieldsSize)
 
 	return out
@@ -1358,7 +1345,7 @@ func (m *DeviceEvent) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	status := m.Status.trimToMaxSize(maxFieldsSize)
+	status := m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Status = &status
 
 	return out
@@ -1378,7 +1365,7 @@ func (m *DeviceEvent2) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1409,7 +1396,7 @@ func (m *RecoveryCodeUsed) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1434,7 +1421,7 @@ func (m *WindowsDesktopSessionStart) TrimToMaxSize(maxSize int) AuditEvent {
 		nonEmptyStrsInMap(m.DesktopLabels)
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Domain = trimStr(m.Domain, maxFieldsSize)
 	out.WindowsUser = trimStr(m.WindowsUser, maxFieldsSize)
 	out.DesktopLabels = trimMap(m.DesktopLabels, maxFieldsSize)
@@ -1596,6 +1583,7 @@ func (m *DesktopSharedDirectoryStart) TrimToMaxSize(maxSize int) AuditEvent {
 
 	out := utils.CloneProtoMsg(m)
 	out.DirectoryName = ""
+	out.DesktopName = ""
 
 	maxSize = adjustedMaxSize(out, maxSize)
 
@@ -1603,6 +1591,7 @@ func (m *DesktopSharedDirectoryStart) TrimToMaxSize(maxSize int) AuditEvent {
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
 	out.DirectoryName = trimStr(m.DirectoryName, maxFieldsSize)
+	out.DesktopName = trimStr(m.DesktopName, maxFieldsSize)
 
 	return out
 }
@@ -1663,7 +1652,7 @@ func (m *BotJoin) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Attributes.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Attributes = m.Attributes.trimToMaxSize(maxFieldsSize)
+	out.Attributes = m.Attributes.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1682,7 +1671,7 @@ func (m *InstanceJoin) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1721,7 +1710,7 @@ func (m *SAMLIdPAuthAttempt) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1760,7 +1749,7 @@ func (m *OktaSyncFailure) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1779,7 +1768,7 @@ func (m *OktaAssignmentResult) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1798,7 +1787,7 @@ func (m *OktaUserSync) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1817,7 +1806,7 @@ func (m *OktaAccessListSync) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1840,7 +1829,7 @@ func (m *AccessListCreate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1859,7 +1848,7 @@ func (m *AccessListUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1878,7 +1867,7 @@ func (m *AccessListDelete) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1897,7 +1886,7 @@ func (m *AccessListReview) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1916,7 +1905,7 @@ func (m *AccessListMemberCreate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1935,7 +1924,7 @@ func (m *AccessListMemberUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1954,7 +1943,7 @@ func (m *AccessListMemberDelete) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1973,7 +1962,7 @@ func (m *AccessListMemberDeleteAllForAccessList) TrimToMaxSize(maxSize int) Audi
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -1992,7 +1981,7 @@ func (m *UserLoginAccessListInvalid) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2013,7 +2002,7 @@ func (m *AuditQueryRun) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.Name, m.Query)
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Name = trimStr(m.Name, maxFieldsSize)
 	out.Query = trimStr(m.Query, maxFieldsSize)
 
@@ -2034,7 +2023,7 @@ func (m *SecurityReportRun) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2100,7 +2089,7 @@ func (m *ClusterNetworkingConfigUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2119,7 +2108,7 @@ func (m *SessionRecordingConfigUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2138,7 +2127,7 @@ func (m *AccessGraphSettingsUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2159,9 +2148,9 @@ func (m *SpannerRPC) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.Procedure) + m.Args.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	out.Procedure = trimStr(m.Procedure, maxFieldsSize)
-	out.Args = m.Args.trimToMaxSize(maxFieldsSize)
+	out.Args = m.Args.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2422,7 +2411,7 @@ func (m *WorkloadIdentityCreate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.WorkloadIdentityData.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxSize(maxFieldsSize)
+	out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2441,7 +2430,7 @@ func (m *WorkloadIdentityUpdate) TrimToMaxSize(maxSize int) AuditEvent {
 	customFieldsCount := m.WorkloadIdentityData.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
 
-	out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxSize(maxFieldsSize)
+	out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxFieldSize(maxFieldsSize)
 
 	return out
 }
@@ -2511,7 +2500,7 @@ func (m *AWSICResourceSync) TrimToMaxSize(maxSize int) AuditEvent {
 	maxSize = adjustedMaxSize(out, maxSize)
 	customFieldsCount := m.Status.nonEmptyStrs()
 	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
-	out.Status = m.Status.trimToMaxSize(maxFieldsSize)
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
 	return out
 }
 
@@ -2548,3 +2537,215 @@ func (m *SigstorePolicyUpdate) TrimToMaxSize(int) AuditEvent {
 func (m *SigstorePolicyDelete) TrimToMaxSize(int) AuditEvent {
 	return m
 }
+
+func (m *MCPSessionStart) TrimToMaxSize(maxSize int) AuditEvent {
+	return m
+}
+
+func (m *MCPSessionEnd) TrimToMaxSize(maxSize int) AuditEvent {
+	return trimEventToMaxSize(m, maxSize, func(m, out *MCPSessionEnd) fieldTrimmer {
+		return fieldTrimmers{
+			newGenericTrimmer(&m.Status, &out.Status),
+			newTraitsTrimmer(m.Headers, &out.Headers),
+		}
+	})
+}
+
+func (m *MCPJSONRPCMessage) nonEmptyStrs() int {
+	if m == nil {
+		return 0
+	}
+	return nonEmptyStrs(m.JSONRPC, m.ID, m.Method) + m.Params.nonEmptyStrs()
+}
+
+func (m *MCPJSONRPCMessage) trimToMaxFieldSize(maxFieldsSize int) MCPJSONRPCMessage {
+	if m == nil {
+		return MCPJSONRPCMessage{}
+	}
+
+	out := MCPJSONRPCMessage{}
+	out.JSONRPC = trimStr(m.JSONRPC, maxFieldsSize)
+	out.ID = trimStr(m.ID, maxFieldsSize)
+	out.Method = trimStr(m.Method, maxFieldsSize)
+	out.Params = m.Params.trimToMaxFieldSize(maxFieldsSize)
+	return out
+}
+
+func (m *MCPSessionRequest) TrimToMaxSize(maxSize int) AuditEvent {
+	return trimEventToMaxSize(m, maxSize, func(m, out *MCPSessionRequest) fieldTrimmer {
+		return fieldTrimmers{
+			newGenericTrimmer(&m.Message, &out.Message),
+			newGenericTrimmer(&m.Status, &out.Status),
+			newTraitsTrimmer(m.Headers, &out.Headers),
+		}
+	})
+}
+
+func (m *MCPSessionNotification) TrimToMaxSize(maxSize int) AuditEvent {
+	return trimEventToMaxSize(m, maxSize, func(m, out *MCPSessionNotification) fieldTrimmer {
+		return fieldTrimmers{
+			newGenericTrimmer(&m.Message, &out.Message),
+			newGenericTrimmer(&m.Status, &out.Status),
+			newTraitsTrimmer(m.Headers, &out.Headers),
+		}
+	})
+}
+
+func (m *MCPSessionListenSSEStream) TrimToMaxSize(maxSize int) AuditEvent {
+	return trimEventToMaxSize(m, maxSize, func(m, out *MCPSessionListenSSEStream) fieldTrimmer {
+		return fieldTrimmers{
+			newGenericTrimmer(&m.Status, &out.Status),
+			newTraitsTrimmer(m.Headers, &out.Headers),
+		}
+	})
+}
+
+func (m *MCPSessionInvalidHTTPRequest) TrimToMaxSize(maxSize int) AuditEvent {
+	return trimEventToMaxSize(m, maxSize, func(m, out *MCPSessionInvalidHTTPRequest) fieldTrimmer {
+		return fieldTrimmers{
+			newStrTrimmer(m.Path, &out.Path),
+			newStrTrimmer(m.RawQuery, &out.RawQuery),
+			newTraitsTrimmer(m.Headers, &out.Headers),
+			newBytesTrimmer(m.Body, &out.Body),
+		}
+	})
+}
+
+func (m *BoundKeypairRecovery) TrimToMaxSize(maxSize int) AuditEvent {
+	size := m.Size()
+	if size <= maxSize {
+		return m
+	}
+	out := utils.CloneProtoMsg(m)
+	out.Status = Status{}
+	out.TokenName = ""
+	out.BotName = ""
+	out.PublicKey = ""
+
+	maxSize = adjustedMaxSize(out, maxSize)
+	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.TokenName, m.BotName, m.PublicKey)
+	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
+
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
+	out.TokenName = trimStr(m.TokenName, maxFieldsSize)
+	out.BotName = trimStr(m.BotName, maxFieldsSize)
+	out.PublicKey = trimStr(m.PublicKey, maxFieldsSize)
+	return out
+}
+
+func (m *BoundKeypairRotation) TrimToMaxSize(maxSize int) AuditEvent {
+	size := m.Size()
+	if size <= maxSize {
+		return m
+	}
+	out := utils.CloneProtoMsg(m)
+	out.Status = Status{}
+	out.TokenName = ""
+	out.BotName = ""
+	out.PreviousPublicKey = ""
+	out.NewPublicKey = ""
+
+	maxSize = adjustedMaxSize(out, maxSize)
+	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.TokenName, m.BotName, m.PreviousPublicKey, m.NewPublicKey)
+	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
+
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
+	out.TokenName = trimStr(m.TokenName, maxFieldsSize)
+	out.BotName = trimStr(m.BotName, maxFieldsSize)
+	out.PreviousPublicKey = trimStr(m.PreviousPublicKey, maxFieldsSize)
+	out.NewPublicKey = trimStr(m.NewPublicKey, maxFieldsSize)
+	return out
+}
+
+func (m *BoundKeypairJoinStateVerificationFailed) TrimToMaxSize(maxSize int) AuditEvent {
+	size := m.Size()
+	if size <= maxSize {
+		return m
+	}
+	out := utils.CloneProtoMsg(m)
+	out.Status = Status{}
+	out.TokenName = ""
+	out.BotName = ""
+
+	maxSize = adjustedMaxSize(out, maxSize)
+	customFieldsCount := m.Status.nonEmptyStrs() + nonEmptyStrs(m.TokenName, m.BotName)
+	maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)
+
+	out.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
+	out.TokenName = trimStr(m.TokenName, maxFieldsSize)
+	out.BotName = trimStr(m.BotName, maxFieldsSize)
+	return out
+}
+
+func (m *SCIMResourceEvent) TrimToMaxSize(maxSize int) AuditEvent {
+	if m.Size() <= maxSize {
+		return m
+	}
+	trimmed := utils.CloneProtoMsg(m)
+	if trimmed.Request != nil {
+		trimmed.Request.Body = nil
+	}
+	if trimmed.Size() <= maxSize {
+		return trimmed
+	}
+
+	maxSize = adjustedMaxSize(trimmed, maxSize)
+	trimmableFieldCount := trimmed.Status.nonEmptyStrs() + nonEmptyStrs(
+		trimmed.Integration,
+		trimmed.ResourceType,
+		trimmed.TeleportID,
+		trimmed.ExternalID,
+		trimmed.Display)
+	maxFieldsSize := maxSizePerField(maxSize, trimmableFieldCount)
+
+	trimmed.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
+	trimmed.Integration = trimStr(trimmed.Integration, maxFieldsSize)
+	trimmed.ResourceType = trimStr(trimmed.ResourceType, maxFieldsSize)
+	trimmed.TeleportID = trimStr(trimmed.Integration, maxFieldsSize)
+	trimmed.ExternalID = trimStr(trimmed.ExternalID, maxFieldsSize)
+
+	return trimmed
+}
+
+func (m *SCIMListingEvent) TrimToMaxSize(maxSize int) AuditEvent {
+	if m.Size() <= maxSize {
+		return m
+	}
+	trimmed := utils.CloneProtoMsg(m)
+
+	if trimmed.Request != nil {
+		trimmed.Request.Body = nil
+	}
+	if trimmed.Size() <= maxSize {
+		return trimmed
+	}
+
+	maxSize = adjustedMaxSize(trimmed, maxSize)
+	trimmableFieldCount := m.Status.nonEmptyStrs() + nonEmptyStrs(
+		trimmed.Integration,
+		trimmed.ResourceType,
+		m.Filter)
+	maxFieldsSize := maxSizePerField(maxSize, trimmableFieldCount)
+	trimmed.Status = m.Status.trimToMaxFieldSize(maxFieldsSize)
+	trimmed.Integration = trimStr(trimmed.Integration, maxFieldsSize)
+	trimmed.ResourceType = trimStr(trimmed.ResourceType, maxFieldsSize)
+	trimmed.Filter = trimStr(trimmed.Filter, maxFieldsSize)
+
+	return trimmed
+}
+
+func (m *ClientIPRestrictionsUpdate) TrimToMaxSize(int) AuditEvent {
+	return m
+}
+
+func (m *VnetConfigCreate) TrimToMaxSize(int) AuditEvent {
+	return m
+}
+
+func (m *VnetConfigUpdate) TrimToMaxSize(int) AuditEvent {
+	return m
+}
+
+func (m *VnetConfigDelete) TrimToMaxSize(int) AuditEvent {
+	return m
+}
diff --git a/api/types/events/events.pb.go b/api/types/events/events.pb.go
index b5bc65bfa5626..48ecc672d0e6d 100644
--- a/api/types/events/events.pb.go
+++ b/api/types/events/events.pb.go
@@ -45,18 +45,22 @@ const (
 	UserKind_USER_KIND_HUMAN UserKind = 1
 	// Indicates the user associated with this event is a Machine ID bot user.
 	UserKind_USER_KIND_BOT UserKind = 2
+	// Indicates that the user associated with this event is a system component e.g. Okta service.
+	UserKind_USER_KIND_SYSTEM UserKind = 3
 )
 
 var UserKind_name = map[int32]string{
 	0: "USER_KIND_UNSPECIFIED",
 	1: "USER_KIND_HUMAN",
 	2: "USER_KIND_BOT",
+	3: "USER_KIND_SYSTEM",
 }
 
 var UserKind_value = map[string]int32{
 	"USER_KIND_UNSPECIFIED": 0,
 	"USER_KIND_HUMAN":       1,
 	"USER_KIND_BOT":         2,
+	"USER_KIND_SYSTEM":      3,
 }
 
 func (x UserKind) String() string {
@@ -581,10 +585,19 @@ type UserMetadata struct {
 	// with one.
 	BotInstanceID string `protobuf:"bytes,12,opt,name=BotInstanceID,proto3" json:"bot_instance_id,omitempty"`
 	// UserOrigin specifies the origin of this user account.
-	UserOrigin           UserOrigin `protobuf:"varint,13,opt,name=UserOrigin,proto3,enum=events.UserOrigin" json:"user_origin,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
-	XXX_unrecognized     []byte     `json:"-"`
-	XXX_sizecache        int32      `json:"-"`
+	UserOrigin UserOrigin `protobuf:"varint,13,opt,name=UserOrigin,proto3,enum=events.UserOrigin" json:"user_origin,omitempty"`
+	// UserRoles specifies the roles user for the user to perform the action.
+	UserRoles []string `protobuf:"bytes,14,rep,name=UserRoles,proto3" json:"user_roles,omitempty"`
+	// UserTraits hold claim data used to populate a role at runtime
+	// for this session.
+	UserTraits github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,15,opt,name=UserTraits,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"user_traits,omitempty"`
+	// UserClusterName represents the Teleport Cluster name the user belongs to.
+	// For leaf clusters, this field represents the root cluster name.
+	// For root clusters, this field holds the cluster name.
+	UserClusterName      string   `protobuf:"bytes,16,opt,name=UserClusterName,proto3" json:"user_cluster_name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *UserMetadata) Reset()         { *m = UserMetadata{} }
@@ -1533,7 +1546,9 @@ type DesktopClipboardReceive struct {
 	// DesktopAddr is the address of the desktop being accessed.
 	DesktopAddr string `protobuf:"bytes,5,opt,name=DesktopAddr,proto3" json:"desktop_addr"`
 	// Length is the number of bytes of data received from the remote clipboard.
-	Length               int32    `protobuf:"varint,6,opt,name=Length,proto3" json:"length"`
+	Length int32 `protobuf:"varint,6,opt,name=Length,proto3" json:"length"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,7,opt,name=DesktopName,proto3" json:"desktop_name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1586,7 +1601,9 @@ type DesktopClipboardSend struct {
 	// DesktopAddr is the address of the desktop being accessed.
 	DesktopAddr string `protobuf:"bytes,5,opt,name=DesktopAddr,proto3" json:"desktop_addr"`
 	// Length is the number of bytes of data sent.
-	Length               int32    `protobuf:"varint,6,opt,name=Length,proto3" json:"length"`
+	Length int32 `protobuf:"varint,6,opt,name=Length,proto3" json:"length"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,7,opt,name=DesktopName,proto3" json:"desktop_name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1643,7 +1660,9 @@ type DesktopSharedDirectoryStart struct {
 	// DirectoryName is the name of the directory being shared.
 	DirectoryName string `protobuf:"bytes,7,opt,name=DirectoryName,proto3" json:"directory_name"`
 	// DirectoryID is the ID of the directory being shared (unique to the Windows Desktop Session).
-	DirectoryID          uint32   `protobuf:"varint,8,opt,name=DirectoryID,proto3" json:"directory_id"`
+	DirectoryID uint32 `protobuf:"varint,8,opt,name=DirectoryID,proto3" json:"directory_id"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,9,opt,name=DesktopName,proto3" json:"desktop_name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1707,7 +1726,9 @@ type DesktopSharedDirectoryRead struct {
 	// Length is the number of bytes read.
 	Length uint32 `protobuf:"varint,10,opt,name=Length,proto3" json:"length"`
 	// Offset is the offset the bytes were read from.
-	Offset               uint64   `protobuf:"varint,11,opt,name=Offset,proto3" json:"offset"`
+	Offset uint64 `protobuf:"varint,11,opt,name=Offset,proto3" json:"offset"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,12,opt,name=DesktopName,proto3" json:"desktop_name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1771,7 +1792,9 @@ type DesktopSharedDirectoryWrite struct {
 	// Length is the number of bytes written.
 	Length uint32 `protobuf:"varint,10,opt,name=Length,proto3" json:"length"`
 	// Offset is the offset the bytes were written to.
-	Offset               uint64   `protobuf:"varint,11,opt,name=Offset,proto3" json:"offset"`
+	Offset uint64 `protobuf:"varint,11,opt,name=Offset,proto3" json:"offset"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,12,opt,name=DesktopName,proto3" json:"desktop_name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -3309,6 +3332,7 @@ func (m *Exec) XXX_DiscardUnknown() {
 var xxx_messageInfo_Exec proto.InternalMessageInfo
 
 // SCP is emitted when data transfer has occurred between server and client
+// Deprecated: use SFTP
 type SCP struct {
 	// Metadata is a common event metadata
 	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
@@ -3691,7 +3715,9 @@ type AuthAttempt struct {
 	// ConnectionMetadata holds information about the connection
 	ConnectionMetadata `protobuf:"bytes,3,opt,name=Connection,proto3,embedded=Connection" json:""`
 	// Status contains common command or operation status fields
-	Status               `protobuf:"bytes,4,opt,name=Status,proto3,embedded=Status" json:""`
+	Status `protobuf:"bytes,4,opt,name=Status,proto3,embedded=Status" json:""`
+	// ServerMetadata holds information about the target host server
+	ServerMetadata       `protobuf:"bytes,5,opt,name=Server,proto3,embedded=Server" json:""`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -6046,6 +6072,54 @@ func (m *PostgresFunctionCall) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PostgresFunctionCall proto.InternalMessageInfo
 
+// WindowsCertificateMetadata contains metadata about certificates
+// issued for Windows environments.
+type WindowsCertificateMetadata struct {
+	Subject               string   `protobuf:"bytes,1,opt,name=Subject,proto3" json:"subject"`
+	SerialNumber          string   `protobuf:"bytes,2,opt,name=SerialNumber,proto3" json:"serial_number"`
+	UPN                   string   `protobuf:"bytes,3,opt,name=UPN,proto3" json:"upn"`
+	CRLDistributionPoints []string `protobuf:"bytes,4,rep,name=CRLDistributionPoints,proto3" json:"crl_distribution_points"`
+	KeyUsage              int32    `protobuf:"varint,5,opt,name=KeyUsage,proto3" json:"key_usage"`
+	ExtendedKeyUsage      []int32  `protobuf:"varint,6,rep,packed,name=ExtendedKeyUsage,proto3" json:"extended_key_usage"`
+	EnhancedKeyUsage      []string `protobuf:"bytes,7,rep,name=EnhancedKeyUsage,proto3" json:"enhanced_key_usage"`
+	XXX_NoUnkeyedLiteral  struct{} `json:"-"`
+	XXX_unrecognized      []byte   `json:"-"`
+	XXX_sizecache         int32    `json:"-"`
+}
+
+func (m *WindowsCertificateMetadata) Reset()         { *m = WindowsCertificateMetadata{} }
+func (m *WindowsCertificateMetadata) String() string { return proto.CompactTextString(m) }
+func (*WindowsCertificateMetadata) ProtoMessage()    {}
+func (*WindowsCertificateMetadata) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{108}
+}
+func (m *WindowsCertificateMetadata) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *WindowsCertificateMetadata) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_WindowsCertificateMetadata.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *WindowsCertificateMetadata) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_WindowsCertificateMetadata.Merge(m, src)
+}
+func (m *WindowsCertificateMetadata) XXX_Size() int {
+	return m.Size()
+}
+func (m *WindowsCertificateMetadata) XXX_DiscardUnknown() {
+	xxx_messageInfo_WindowsCertificateMetadata.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_WindowsCertificateMetadata proto.InternalMessageInfo
+
 // WindowsDesktopSessionStart is emitted when a user connects to a desktop.
 type WindowsDesktopSessionStart struct {
 	// Metadata is common event metadata.
@@ -6075,17 +6149,18 @@ type WindowsDesktopSessionStart struct {
 	AllowUserCreation bool `protobuf:"varint,12,opt,name=AllowUserCreation,proto3" json:"allow_user_creation"`
 	// NLA indicates whether Teleport performed Network Level Authentication (NLA)
 	// when initiating this session.
-	NLA                  bool     `protobuf:"varint,13,opt,name=NLA,proto3" json:"nla"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	NLA                  bool                        `protobuf:"varint,13,opt,name=NLA,proto3" json:"nla"`
+	CertMetadata         *WindowsCertificateMetadata `protobuf:"bytes,14,opt,name=CertMetadata,proto3" json:"certificate"`
+	XXX_NoUnkeyedLiteral struct{}                    `json:"-"`
+	XXX_unrecognized     []byte                      `json:"-"`
+	XXX_sizecache        int32                       `json:"-"`
 }
 
 func (m *WindowsDesktopSessionStart) Reset()         { *m = WindowsDesktopSessionStart{} }
 func (m *WindowsDesktopSessionStart) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopSessionStart) ProtoMessage()    {}
 func (*WindowsDesktopSessionStart) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{108}
+	return fileDescriptor_007ba1c3d6266d56, []int{109}
 }
 func (m *WindowsDesktopSessionStart) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6127,17 +6202,21 @@ type DatabaseSessionEnd struct {
 	// StartTime is the timestamp at which the session began.
 	StartTime time.Time `protobuf:"bytes,5,opt,name=StartTime,proto3,stdtime" json:"session_start,omitempty"`
 	// EndTime is the timestamp at which the session ended.
-	EndTime              time.Time `protobuf:"bytes,6,opt,name=EndTime,proto3,stdtime" json:"session_stop,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
-	XXX_unrecognized     []byte    `json:"-"`
-	XXX_sizecache        int32     `json:"-"`
+	EndTime time.Time `protobuf:"bytes,6,opt,name=EndTime,proto3,stdtime" json:"session_stop,omitempty"`
+	// ConnectionMetadata holds information about the connection.
+	ConnectionMetadata `protobuf:"bytes,7,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// Participants is the list of participants in a session.
+	Participants         []string `protobuf:"bytes,8,rep,name=Participants,proto3" json:"participants,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *DatabaseSessionEnd) Reset()         { *m = DatabaseSessionEnd{} }
 func (m *DatabaseSessionEnd) String() string { return proto.CompactTextString(m) }
 func (*DatabaseSessionEnd) ProtoMessage()    {}
 func (*DatabaseSessionEnd) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{109}
+	return fileDescriptor_007ba1c3d6266d56, []int{110}
 }
 func (m *DatabaseSessionEnd) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6183,7 +6262,7 @@ func (m *MFADeviceMetadata) Reset()         { *m = MFADeviceMetadata{} }
 func (m *MFADeviceMetadata) String() string { return proto.CompactTextString(m) }
 func (*MFADeviceMetadata) ProtoMessage()    {}
 func (*MFADeviceMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{110}
+	return fileDescriptor_007ba1c3d6266d56, []int{111}
 }
 func (m *MFADeviceMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6231,7 +6310,7 @@ func (m *MFADeviceAdd) Reset()         { *m = MFADeviceAdd{} }
 func (m *MFADeviceAdd) String() string { return proto.CompactTextString(m) }
 func (*MFADeviceAdd) ProtoMessage()    {}
 func (*MFADeviceAdd) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{111}
+	return fileDescriptor_007ba1c3d6266d56, []int{112}
 }
 func (m *MFADeviceAdd) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6279,7 +6358,7 @@ func (m *MFADeviceDelete) Reset()         { *m = MFADeviceDelete{} }
 func (m *MFADeviceDelete) String() string { return proto.CompactTextString(m) }
 func (*MFADeviceDelete) ProtoMessage()    {}
 func (*MFADeviceDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{112}
+	return fileDescriptor_007ba1c3d6266d56, []int{113}
 }
 func (m *MFADeviceDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6323,7 +6402,7 @@ func (m *BillingInformationUpdate) Reset()         { *m = BillingInformationUpda
 func (m *BillingInformationUpdate) String() string { return proto.CompactTextString(m) }
 func (*BillingInformationUpdate) ProtoMessage()    {}
 func (*BillingInformationUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{113}
+	return fileDescriptor_007ba1c3d6266d56, []int{114}
 }
 func (m *BillingInformationUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6367,7 +6446,7 @@ func (m *BillingCardCreate) Reset()         { *m = BillingCardCreate{} }
 func (m *BillingCardCreate) String() string { return proto.CompactTextString(m) }
 func (*BillingCardCreate) ProtoMessage()    {}
 func (*BillingCardCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{114}
+	return fileDescriptor_007ba1c3d6266d56, []int{115}
 }
 func (m *BillingCardCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6411,7 +6490,7 @@ func (m *BillingCardDelete) Reset()         { *m = BillingCardDelete{} }
 func (m *BillingCardDelete) String() string { return proto.CompactTextString(m) }
 func (*BillingCardDelete) ProtoMessage()    {}
 func (*BillingCardDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{115}
+	return fileDescriptor_007ba1c3d6266d56, []int{116}
 }
 func (m *BillingCardDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6465,7 +6544,7 @@ func (m *LockCreate) Reset()         { *m = LockCreate{} }
 func (m *LockCreate) String() string { return proto.CompactTextString(m) }
 func (*LockCreate) ProtoMessage()    {}
 func (*LockCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{116}
+	return fileDescriptor_007ba1c3d6266d56, []int{117}
 }
 func (m *LockCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6513,7 +6592,7 @@ func (m *LockDelete) Reset()         { *m = LockDelete{} }
 func (m *LockDelete) String() string { return proto.CompactTextString(m) }
 func (*LockDelete) ProtoMessage()    {}
 func (*LockDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{117}
+	return fileDescriptor_007ba1c3d6266d56, []int{118}
 }
 func (m *LockDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6557,7 +6636,7 @@ func (m *RecoveryCodeGenerate) Reset()         { *m = RecoveryCodeGenerate{} }
 func (m *RecoveryCodeGenerate) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodeGenerate) ProtoMessage()    {}
 func (*RecoveryCodeGenerate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{118}
+	return fileDescriptor_007ba1c3d6266d56, []int{119}
 }
 func (m *RecoveryCodeGenerate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6604,7 +6683,7 @@ func (m *RecoveryCodeUsed) Reset()         { *m = RecoveryCodeUsed{} }
 func (m *RecoveryCodeUsed) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodeUsed) ProtoMessage()    {}
 func (*RecoveryCodeUsed) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{119}
+	return fileDescriptor_007ba1c3d6266d56, []int{120}
 }
 func (m *RecoveryCodeUsed) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6660,7 +6739,9 @@ type WindowsDesktopSessionEnd struct {
 	// Recorded is true if the session was recorded, false otherwise.
 	Recorded bool `protobuf:"varint,12,opt,name=Recorded,proto3" json:"recorded"`
 	// Participants is a list of participants in the session.
-	Participants         []string `protobuf:"bytes,13,rep,name=Participants,proto3" json:"participants"`
+	Participants []string `protobuf:"bytes,13,rep,name=Participants,proto3" json:"participants"`
+	// Connection holds information about the connection.
+	ConnectionMetadata   `protobuf:"bytes,14,opt,name=Connection,proto3,embedded=Connection" json:""`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -6670,7 +6751,7 @@ func (m *WindowsDesktopSessionEnd) Reset()         { *m = WindowsDesktopSessionE
 func (m *WindowsDesktopSessionEnd) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopSessionEnd) ProtoMessage()    {}
 func (*WindowsDesktopSessionEnd) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{120}
+	return fileDescriptor_007ba1c3d6266d56, []int{121}
 }
 func (m *WindowsDesktopSessionEnd) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6708,17 +6789,19 @@ type CertificateCreate struct {
 	// Identity is the identity associated with the certificate, as interpreted by Teleport.
 	Identity *Identity `protobuf:"bytes,3,opt,name=Identity,proto3" json:"identity"`
 	// Client is the common client event metadata
-	ClientMetadata       `protobuf:"bytes,4,opt,name=Client,proto3,embedded=Client" json:""`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	ClientMetadata `protobuf:"bytes,4,opt,name=Client,proto3,embedded=Client" json:""`
+	// CertificateAuthority holds information about the issuer of the certificate.
+	CertificateAuthority *CertificateAuthority `protobuf:"bytes,5,opt,name=CertificateAuthority,proto3" json:"certificate_authority"`
+	XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+	XXX_unrecognized     []byte                `json:"-"`
+	XXX_sizecache        int32                 `json:"-"`
 }
 
 func (m *CertificateCreate) Reset()         { *m = CertificateCreate{} }
 func (m *CertificateCreate) String() string { return proto.CompactTextString(m) }
 func (*CertificateCreate) ProtoMessage()    {}
 func (*CertificateCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{121}
+	return fileDescriptor_007ba1c3d6266d56, []int{122}
 }
 func (m *CertificateCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6747,6 +6830,52 @@ func (m *CertificateCreate) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_CertificateCreate proto.InternalMessageInfo
 
+// CertificateAuthority holds information about the issuer of the certificate.
+type CertificateAuthority struct {
+	// Type of the cert authority
+	Type string `protobuf:"bytes,1,opt,name=Type,proto3" json:"type,omitempty"`
+	// Domain of the cert authority
+	Domain string `protobuf:"bytes,2,opt,name=Domain,proto3" json:"domain,omitempty"`
+	// SubjectKeyID is BASE32-encoded subject key ID from authority certificate
+	SubjectKeyID         string   `protobuf:"bytes,3,opt,name=SubjectKeyID,proto3" json:"subject_key_id,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *CertificateAuthority) Reset()         { *m = CertificateAuthority{} }
+func (m *CertificateAuthority) String() string { return proto.CompactTextString(m) }
+func (*CertificateAuthority) ProtoMessage()    {}
+func (*CertificateAuthority) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{123}
+}
+func (m *CertificateAuthority) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *CertificateAuthority) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_CertificateAuthority.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *CertificateAuthority) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_CertificateAuthority.Merge(m, src)
+}
+func (m *CertificateAuthority) XXX_Size() int {
+	return m.Size()
+}
+func (m *CertificateAuthority) XXX_DiscardUnknown() {
+	xxx_messageInfo_CertificateAuthority.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_CertificateAuthority proto.InternalMessageInfo
+
 // RenewableCertificateGenerationMismatch is emitted when a renewable
 // certificate's generation counter fails to validate, possibly indicating a
 // stolen certificate and an invalid renewal attempt.
@@ -6766,7 +6895,7 @@ func (m *RenewableCertificateGenerationMismatch) Reset() {
 func (m *RenewableCertificateGenerationMismatch) String() string { return proto.CompactTextString(m) }
 func (*RenewableCertificateGenerationMismatch) ProtoMessage()    {}
 func (*RenewableCertificateGenerationMismatch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{122}
+	return fileDescriptor_007ba1c3d6266d56, []int{124}
 }
 func (m *RenewableCertificateGenerationMismatch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6824,7 +6953,7 @@ func (m *BotJoin) Reset()         { *m = BotJoin{} }
 func (m *BotJoin) String() string { return proto.CompactTextString(m) }
 func (*BotJoin) ProtoMessage()    {}
 func (*BotJoin) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{123}
+	return fileDescriptor_007ba1c3d6266d56, []int{125}
 }
 func (m *BotJoin) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6886,7 +7015,7 @@ func (m *InstanceJoin) Reset()         { *m = InstanceJoin{} }
 func (m *InstanceJoin) String() string { return proto.CompactTextString(m) }
 func (*InstanceJoin) ProtoMessage()    {}
 func (*InstanceJoin) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{124}
+	return fileDescriptor_007ba1c3d6266d56, []int{126}
 }
 func (m *InstanceJoin) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6934,7 +7063,7 @@ func (m *Unknown) Reset()         { *m = Unknown{} }
 func (m *Unknown) String() string { return proto.CompactTextString(m) }
 func (*Unknown) ProtoMessage()    {}
 func (*Unknown) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{125}
+	return fileDescriptor_007ba1c3d6266d56, []int{127}
 }
 func (m *Unknown) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6991,7 +7120,7 @@ func (m *DeviceMetadata) Reset()         { *m = DeviceMetadata{} }
 func (m *DeviceMetadata) String() string { return proto.CompactTextString(m) }
 func (*DeviceMetadata) ProtoMessage()    {}
 func (*DeviceMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{126}
+	return fileDescriptor_007ba1c3d6266d56, []int{128}
 }
 func (m *DeviceMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7042,7 +7171,7 @@ func (m *DeviceEvent) Reset()         { *m = DeviceEvent{} }
 func (m *DeviceEvent) String() string { return proto.CompactTextString(m) }
 func (*DeviceEvent) ProtoMessage()    {}
 func (*DeviceEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{127}
+	return fileDescriptor_007ba1c3d6266d56, []int{129}
 }
 func (m *DeviceEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7094,7 +7223,7 @@ func (m *DeviceEvent2) Reset()         { *m = DeviceEvent2{} }
 func (m *DeviceEvent2) String() string { return proto.CompactTextString(m) }
 func (*DeviceEvent2) ProtoMessage()    {}
 func (*DeviceEvent2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{128}
+	return fileDescriptor_007ba1c3d6266d56, []int{130}
 }
 func (m *DeviceEvent2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7142,7 +7271,7 @@ func (m *DiscoveryConfigCreate) Reset()         { *m = DiscoveryConfigCreate{} }
 func (m *DiscoveryConfigCreate) String() string { return proto.CompactTextString(m) }
 func (*DiscoveryConfigCreate) ProtoMessage()    {}
 func (*DiscoveryConfigCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{129}
+	return fileDescriptor_007ba1c3d6266d56, []int{131}
 }
 func (m *DiscoveryConfigCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7190,7 +7319,7 @@ func (m *DiscoveryConfigUpdate) Reset()         { *m = DiscoveryConfigUpdate{} }
 func (m *DiscoveryConfigUpdate) String() string { return proto.CompactTextString(m) }
 func (*DiscoveryConfigUpdate) ProtoMessage()    {}
 func (*DiscoveryConfigUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{130}
+	return fileDescriptor_007ba1c3d6266d56, []int{132}
 }
 func (m *DiscoveryConfigUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7238,7 +7367,7 @@ func (m *DiscoveryConfigDelete) Reset()         { *m = DiscoveryConfigDelete{} }
 func (m *DiscoveryConfigDelete) String() string { return proto.CompactTextString(m) }
 func (*DiscoveryConfigDelete) ProtoMessage()    {}
 func (*DiscoveryConfigDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{131}
+	return fileDescriptor_007ba1c3d6266d56, []int{133}
 }
 func (m *DiscoveryConfigDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7284,7 +7413,7 @@ func (m *DiscoveryConfigDeleteAll) Reset()         { *m = DiscoveryConfigDeleteA
 func (m *DiscoveryConfigDeleteAll) String() string { return proto.CompactTextString(m) }
 func (*DiscoveryConfigDeleteAll) ProtoMessage()    {}
 func (*DiscoveryConfigDeleteAll) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{132}
+	return fileDescriptor_007ba1c3d6266d56, []int{134}
 }
 func (m *DiscoveryConfigDeleteAll) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7333,7 +7462,7 @@ func (m *IntegrationCreate) Reset()         { *m = IntegrationCreate{} }
 func (m *IntegrationCreate) String() string { return proto.CompactTextString(m) }
 func (*IntegrationCreate) ProtoMessage()    {}
 func (*IntegrationCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{133}
+	return fileDescriptor_007ba1c3d6266d56, []int{135}
 }
 func (m *IntegrationCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7382,7 +7511,7 @@ func (m *IntegrationUpdate) Reset()         { *m = IntegrationUpdate{} }
 func (m *IntegrationUpdate) String() string { return proto.CompactTextString(m) }
 func (*IntegrationUpdate) ProtoMessage()    {}
 func (*IntegrationUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{134}
+	return fileDescriptor_007ba1c3d6266d56, []int{136}
 }
 func (m *IntegrationUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7431,7 +7560,7 @@ func (m *IntegrationDelete) Reset()         { *m = IntegrationDelete{} }
 func (m *IntegrationDelete) String() string { return proto.CompactTextString(m) }
 func (*IntegrationDelete) ProtoMessage()    {}
 func (*IntegrationDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{135}
+	return fileDescriptor_007ba1c3d6266d56, []int{137}
 }
 func (m *IntegrationDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7481,7 +7610,7 @@ func (m *IntegrationMetadata) Reset()         { *m = IntegrationMetadata{} }
 func (m *IntegrationMetadata) String() string { return proto.CompactTextString(m) }
 func (*IntegrationMetadata) ProtoMessage()    {}
 func (*IntegrationMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{136}
+	return fileDescriptor_007ba1c3d6266d56, []int{138}
 }
 func (m *IntegrationMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7526,7 +7655,7 @@ func (m *AWSOIDCIntegrationMetadata) Reset()         { *m = AWSOIDCIntegrationMe
 func (m *AWSOIDCIntegrationMetadata) String() string { return proto.CompactTextString(m) }
 func (*AWSOIDCIntegrationMetadata) ProtoMessage()    {}
 func (*AWSOIDCIntegrationMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{137}
+	return fileDescriptor_007ba1c3d6266d56, []int{139}
 }
 func (m *AWSOIDCIntegrationMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7570,7 +7699,7 @@ func (m *AzureOIDCIntegrationMetadata) Reset()         { *m = AzureOIDCIntegrati
 func (m *AzureOIDCIntegrationMetadata) String() string { return proto.CompactTextString(m) }
 func (*AzureOIDCIntegrationMetadata) ProtoMessage()    {}
 func (*AzureOIDCIntegrationMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{138}
+	return fileDescriptor_007ba1c3d6266d56, []int{140}
 }
 func (m *AzureOIDCIntegrationMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7612,7 +7741,7 @@ func (m *GitHubIntegrationMetadata) Reset()         { *m = GitHubIntegrationMeta
 func (m *GitHubIntegrationMetadata) String() string { return proto.CompactTextString(m) }
 func (*GitHubIntegrationMetadata) ProtoMessage()    {}
 func (*GitHubIntegrationMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{139}
+	return fileDescriptor_007ba1c3d6266d56, []int{141}
 }
 func (m *GitHubIntegrationMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7654,7 +7783,7 @@ func (m *AWSRAIntegrationMetadata) Reset()         { *m = AWSRAIntegrationMetada
 func (m *AWSRAIntegrationMetadata) String() string { return proto.CompactTextString(m) }
 func (*AWSRAIntegrationMetadata) ProtoMessage()    {}
 func (*AWSRAIntegrationMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{140}
+	return fileDescriptor_007ba1c3d6266d56, []int{142}
 }
 func (m *AWSRAIntegrationMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7703,7 +7832,7 @@ func (m *PluginCreate) Reset()         { *m = PluginCreate{} }
 func (m *PluginCreate) String() string { return proto.CompactTextString(m) }
 func (*PluginCreate) ProtoMessage()    {}
 func (*PluginCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{141}
+	return fileDescriptor_007ba1c3d6266d56, []int{143}
 }
 func (m *PluginCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7752,7 +7881,7 @@ func (m *PluginUpdate) Reset()         { *m = PluginUpdate{} }
 func (m *PluginUpdate) String() string { return proto.CompactTextString(m) }
 func (*PluginUpdate) ProtoMessage()    {}
 func (*PluginUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{142}
+	return fileDescriptor_007ba1c3d6266d56, []int{144}
 }
 func (m *PluginUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7801,7 +7930,7 @@ func (m *PluginDelete) Reset()         { *m = PluginDelete{} }
 func (m *PluginDelete) String() string { return proto.CompactTextString(m) }
 func (*PluginDelete) ProtoMessage()    {}
 func (*PluginDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{143}
+	return fileDescriptor_007ba1c3d6266d56, []int{145}
 }
 func (m *PluginDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7850,7 +7979,7 @@ func (m *PluginMetadata) Reset()         { *m = PluginMetadata{} }
 func (m *PluginMetadata) String() string { return proto.CompactTextString(m) }
 func (*PluginMetadata) ProtoMessage()    {}
 func (*PluginMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{144}
+	return fileDescriptor_007ba1c3d6266d56, []int{146}
 }
 func (m *PluginMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8093,6 +8222,21 @@ type OneOf struct {
 	//	*OneOf_AutoUpdateAgentRolloutTrigger
 	//	*OneOf_AutoUpdateAgentRolloutForceDone
 	//	*OneOf_AutoUpdateAgentRolloutRollback
+	//	*OneOf_MCPSessionStart
+	//	*OneOf_MCPSessionEnd
+	//	*OneOf_MCPSessionRequest
+	//	*OneOf_MCPSessionNotification
+	//	*OneOf_BoundKeypairRecovery
+	//	*OneOf_BoundKeypairRotation
+	//	*OneOf_BoundKeypairJoinStateVerificationFailed
+	//	*OneOf_MCPSessionListenSSEStream
+	//	*OneOf_MCPSessionInvalidHTTPRequest
+	//	*OneOf_SCIMListingEvent
+	//	*OneOf_SCIMResourceEvent
+	//	*OneOf_ClientIPRestrictionsUpdate
+	//	*OneOf_VnetConfigCreate
+	//	*OneOf_VnetConfigUpdate
+	//	*OneOf_VnetConfigDelete
 	Event                isOneOf_Event `protobuf_oneof:"Event"`
 	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
 	XXX_unrecognized     []byte        `json:"-"`
@@ -8103,7 +8247,7 @@ func (m *OneOf) Reset()         { *m = OneOf{} }
 func (m *OneOf) String() string { return proto.CompactTextString(m) }
 func (*OneOf) ProtoMessage()    {}
 func (*OneOf) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{145}
+	return fileDescriptor_007ba1c3d6266d56, []int{147}
 }
 func (m *OneOf) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8771,6 +8915,51 @@ type OneOf_AutoUpdateAgentRolloutForceDone struct {
 type OneOf_AutoUpdateAgentRolloutRollback struct {
 	AutoUpdateAgentRolloutRollback *AutoUpdateAgentRolloutRollback `protobuf:"bytes,215,opt,name=AutoUpdateAgentRolloutRollback,proto3,oneof" json:"AutoUpdateAgentRolloutRollback,omitempty"`
 }
+type OneOf_MCPSessionStart struct {
+	MCPSessionStart *MCPSessionStart `protobuf:"bytes,216,opt,name=MCPSessionStart,proto3,oneof" json:"MCPSessionStart,omitempty"`
+}
+type OneOf_MCPSessionEnd struct {
+	MCPSessionEnd *MCPSessionEnd `protobuf:"bytes,217,opt,name=MCPSessionEnd,proto3,oneof" json:"MCPSessionEnd,omitempty"`
+}
+type OneOf_MCPSessionRequest struct {
+	MCPSessionRequest *MCPSessionRequest `protobuf:"bytes,218,opt,name=MCPSessionRequest,proto3,oneof" json:"MCPSessionRequest,omitempty"`
+}
+type OneOf_MCPSessionNotification struct {
+	MCPSessionNotification *MCPSessionNotification `protobuf:"bytes,219,opt,name=MCPSessionNotification,proto3,oneof" json:"MCPSessionNotification,omitempty"`
+}
+type OneOf_BoundKeypairRecovery struct {
+	BoundKeypairRecovery *BoundKeypairRecovery `protobuf:"bytes,220,opt,name=BoundKeypairRecovery,proto3,oneof" json:"BoundKeypairRecovery,omitempty"`
+}
+type OneOf_BoundKeypairRotation struct {
+	BoundKeypairRotation *BoundKeypairRotation `protobuf:"bytes,221,opt,name=BoundKeypairRotation,proto3,oneof" json:"BoundKeypairRotation,omitempty"`
+}
+type OneOf_BoundKeypairJoinStateVerificationFailed struct {
+	BoundKeypairJoinStateVerificationFailed *BoundKeypairJoinStateVerificationFailed `protobuf:"bytes,222,opt,name=BoundKeypairJoinStateVerificationFailed,proto3,oneof" json:"BoundKeypairJoinStateVerificationFailed,omitempty"`
+}
+type OneOf_MCPSessionListenSSEStream struct {
+	MCPSessionListenSSEStream *MCPSessionListenSSEStream `protobuf:"bytes,223,opt,name=MCPSessionListenSSEStream,proto3,oneof" json:"MCPSessionListenSSEStream,omitempty"`
+}
+type OneOf_MCPSessionInvalidHTTPRequest struct {
+	MCPSessionInvalidHTTPRequest *MCPSessionInvalidHTTPRequest `protobuf:"bytes,224,opt,name=MCPSessionInvalidHTTPRequest,proto3,oneof" json:"MCPSessionInvalidHTTPRequest,omitempty"`
+}
+type OneOf_SCIMListingEvent struct {
+	SCIMListingEvent *SCIMListingEvent `protobuf:"bytes,225,opt,name=SCIMListingEvent,proto3,oneof" json:"SCIMListingEvent,omitempty"`
+}
+type OneOf_SCIMResourceEvent struct {
+	SCIMResourceEvent *SCIMResourceEvent `protobuf:"bytes,226,opt,name=SCIMResourceEvent,proto3,oneof" json:"SCIMResourceEvent,omitempty"`
+}
+type OneOf_ClientIPRestrictionsUpdate struct {
+	ClientIPRestrictionsUpdate *ClientIPRestrictionsUpdate `protobuf:"bytes,227,opt,name=ClientIPRestrictionsUpdate,proto3,oneof" json:"ClientIPRestrictionsUpdate,omitempty"`
+}
+type OneOf_VnetConfigCreate struct {
+	VnetConfigCreate *VnetConfigCreate `protobuf:"bytes,232,opt,name=VnetConfigCreate,proto3,oneof" json:"VnetConfigCreate,omitempty"`
+}
+type OneOf_VnetConfigUpdate struct {
+	VnetConfigUpdate *VnetConfigUpdate `protobuf:"bytes,233,opt,name=VnetConfigUpdate,proto3,oneof" json:"VnetConfigUpdate,omitempty"`
+}
+type OneOf_VnetConfigDelete struct {
+	VnetConfigDelete *VnetConfigDelete `protobuf:"bytes,234,opt,name=VnetConfigDelete,proto3,oneof" json:"VnetConfigDelete,omitempty"`
+}
 
 func (*OneOf_UserLogin) isOneOf_Event()                                {}
 func (*OneOf_UserCreate) isOneOf_Event()                               {}
@@ -8983,6 +9172,21 @@ func (*OneOf_SigstorePolicyDelete) isOneOf_Event()                     {}
 func (*OneOf_AutoUpdateAgentRolloutTrigger) isOneOf_Event()            {}
 func (*OneOf_AutoUpdateAgentRolloutForceDone) isOneOf_Event()          {}
 func (*OneOf_AutoUpdateAgentRolloutRollback) isOneOf_Event()           {}
+func (*OneOf_MCPSessionStart) isOneOf_Event()                          {}
+func (*OneOf_MCPSessionEnd) isOneOf_Event()                            {}
+func (*OneOf_MCPSessionRequest) isOneOf_Event()                        {}
+func (*OneOf_MCPSessionNotification) isOneOf_Event()                   {}
+func (*OneOf_BoundKeypairRecovery) isOneOf_Event()                     {}
+func (*OneOf_BoundKeypairRotation) isOneOf_Event()                     {}
+func (*OneOf_BoundKeypairJoinStateVerificationFailed) isOneOf_Event()  {}
+func (*OneOf_MCPSessionListenSSEStream) isOneOf_Event()                {}
+func (*OneOf_MCPSessionInvalidHTTPRequest) isOneOf_Event()             {}
+func (*OneOf_SCIMListingEvent) isOneOf_Event()                         {}
+func (*OneOf_SCIMResourceEvent) isOneOf_Event()                        {}
+func (*OneOf_ClientIPRestrictionsUpdate) isOneOf_Event()               {}
+func (*OneOf_VnetConfigCreate) isOneOf_Event()                         {}
+func (*OneOf_VnetConfigUpdate) isOneOf_Event()                         {}
+func (*OneOf_VnetConfigDelete) isOneOf_Event()                         {}
 
 func (m *OneOf) GetEvent() isOneOf_Event {
 	if m != nil {
@@ -10468,6 +10672,111 @@ func (m *OneOf) GetAutoUpdateAgentRolloutRollback() *AutoUpdateAgentRolloutRollb
 	return nil
 }
 
+func (m *OneOf) GetMCPSessionStart() *MCPSessionStart {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionStart); ok {
+		return x.MCPSessionStart
+	}
+	return nil
+}
+
+func (m *OneOf) GetMCPSessionEnd() *MCPSessionEnd {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionEnd); ok {
+		return x.MCPSessionEnd
+	}
+	return nil
+}
+
+func (m *OneOf) GetMCPSessionRequest() *MCPSessionRequest {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionRequest); ok {
+		return x.MCPSessionRequest
+	}
+	return nil
+}
+
+func (m *OneOf) GetMCPSessionNotification() *MCPSessionNotification {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionNotification); ok {
+		return x.MCPSessionNotification
+	}
+	return nil
+}
+
+func (m *OneOf) GetBoundKeypairRecovery() *BoundKeypairRecovery {
+	if x, ok := m.GetEvent().(*OneOf_BoundKeypairRecovery); ok {
+		return x.BoundKeypairRecovery
+	}
+	return nil
+}
+
+func (m *OneOf) GetBoundKeypairRotation() *BoundKeypairRotation {
+	if x, ok := m.GetEvent().(*OneOf_BoundKeypairRotation); ok {
+		return x.BoundKeypairRotation
+	}
+	return nil
+}
+
+func (m *OneOf) GetBoundKeypairJoinStateVerificationFailed() *BoundKeypairJoinStateVerificationFailed {
+	if x, ok := m.GetEvent().(*OneOf_BoundKeypairJoinStateVerificationFailed); ok {
+		return x.BoundKeypairJoinStateVerificationFailed
+	}
+	return nil
+}
+
+func (m *OneOf) GetMCPSessionListenSSEStream() *MCPSessionListenSSEStream {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionListenSSEStream); ok {
+		return x.MCPSessionListenSSEStream
+	}
+	return nil
+}
+
+func (m *OneOf) GetMCPSessionInvalidHTTPRequest() *MCPSessionInvalidHTTPRequest {
+	if x, ok := m.GetEvent().(*OneOf_MCPSessionInvalidHTTPRequest); ok {
+		return x.MCPSessionInvalidHTTPRequest
+	}
+	return nil
+}
+
+func (m *OneOf) GetSCIMListingEvent() *SCIMListingEvent {
+	if x, ok := m.GetEvent().(*OneOf_SCIMListingEvent); ok {
+		return x.SCIMListingEvent
+	}
+	return nil
+}
+
+func (m *OneOf) GetSCIMResourceEvent() *SCIMResourceEvent {
+	if x, ok := m.GetEvent().(*OneOf_SCIMResourceEvent); ok {
+		return x.SCIMResourceEvent
+	}
+	return nil
+}
+
+func (m *OneOf) GetClientIPRestrictionsUpdate() *ClientIPRestrictionsUpdate {
+	if x, ok := m.GetEvent().(*OneOf_ClientIPRestrictionsUpdate); ok {
+		return x.ClientIPRestrictionsUpdate
+	}
+	return nil
+}
+
+func (m *OneOf) GetVnetConfigCreate() *VnetConfigCreate {
+	if x, ok := m.GetEvent().(*OneOf_VnetConfigCreate); ok {
+		return x.VnetConfigCreate
+	}
+	return nil
+}
+
+func (m *OneOf) GetVnetConfigUpdate() *VnetConfigUpdate {
+	if x, ok := m.GetEvent().(*OneOf_VnetConfigUpdate); ok {
+		return x.VnetConfigUpdate
+	}
+	return nil
+}
+
+func (m *OneOf) GetVnetConfigDelete() *VnetConfigDelete {
+	if x, ok := m.GetEvent().(*OneOf_VnetConfigDelete); ok {
+		return x.VnetConfigDelete
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*OneOf) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -10682,6 +10991,21 @@ func (*OneOf) XXX_OneofWrappers() []interface{} {
 		(*OneOf_AutoUpdateAgentRolloutTrigger)(nil),
 		(*OneOf_AutoUpdateAgentRolloutForceDone)(nil),
 		(*OneOf_AutoUpdateAgentRolloutRollback)(nil),
+		(*OneOf_MCPSessionStart)(nil),
+		(*OneOf_MCPSessionEnd)(nil),
+		(*OneOf_MCPSessionRequest)(nil),
+		(*OneOf_MCPSessionNotification)(nil),
+		(*OneOf_BoundKeypairRecovery)(nil),
+		(*OneOf_BoundKeypairRotation)(nil),
+		(*OneOf_BoundKeypairJoinStateVerificationFailed)(nil),
+		(*OneOf_MCPSessionListenSSEStream)(nil),
+		(*OneOf_MCPSessionInvalidHTTPRequest)(nil),
+		(*OneOf_SCIMListingEvent)(nil),
+		(*OneOf_SCIMResourceEvent)(nil),
+		(*OneOf_ClientIPRestrictionsUpdate)(nil),
+		(*OneOf_VnetConfigCreate)(nil),
+		(*OneOf_VnetConfigUpdate)(nil),
+		(*OneOf_VnetConfigDelete)(nil),
 	}
 }
 
@@ -10702,7 +11026,7 @@ func (m *StreamStatus) Reset()         { *m = StreamStatus{} }
 func (m *StreamStatus) String() string { return proto.CompactTextString(m) }
 func (*StreamStatus) ProtoMessage()    {}
 func (*StreamStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{146}
+	return fileDescriptor_007ba1c3d6266d56, []int{148}
 }
 func (m *StreamStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10748,7 +11072,7 @@ func (m *SessionUpload) Reset()         { *m = SessionUpload{} }
 func (m *SessionUpload) String() string { return proto.CompactTextString(m) }
 func (*SessionUpload) ProtoMessage()    {}
 func (*SessionUpload) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{147}
+	return fileDescriptor_007ba1c3d6266d56, []int{149}
 }
 func (m *SessionUpload) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10857,17 +11181,22 @@ type Identity struct {
 	DeviceExtensions *DeviceExtensions `protobuf:"bytes,28,opt,name=DeviceExtensions,proto3" json:"device_extensions,omitempty"`
 	// BotInstanceID indicates the name of the Machine ID bot instance this
 	// identity was issued to, if any.
-	BotInstanceID        string   `protobuf:"bytes,29,opt,name=BotInstanceID,proto3" json:"bot_instance_id,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	BotInstanceID string `protobuf:"bytes,29,opt,name=BotInstanceID,proto3" json:"bot_instance_id,omitempty"`
+	// JoinToken is the name of the join token used when a Machine ID bot joined,
+	// if any. It is not set for bots using the `token` join method.
+	JoinToken string `protobuf:"bytes,30,opt,name=JoinToken,proto3" json:"join_token,omitempty"`
+	// ScopePin pins a certificate to a specific scope and set of scoped roles.
+	ScopePin             *ScopePin `protobuf:"bytes,31,opt,name=ScopePin,proto3" json:"scope_pin,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
+	XXX_unrecognized     []byte    `json:"-"`
+	XXX_sizecache        int32     `json:"-"`
 }
 
 func (m *Identity) Reset()         { *m = Identity{} }
 func (m *Identity) String() string { return proto.CompactTextString(m) }
 func (*Identity) ProtoMessage()    {}
 func (*Identity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{148}
+	return fileDescriptor_007ba1c3d6266d56, []int{150}
 }
 func (m *Identity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10896,6 +11225,97 @@ func (m *Identity) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_Identity proto.InternalMessageInfo
 
+// ScopePin is a marker that identifies a certificate/identity as being "pinned" to a target scope, and encodes relevant
+// information for access-control evaluation at that scope.
+type ScopePin struct {
+	// Scope is the target scope that this pin is associated with. This is the scope that the certificate/identity is
+	// pinned to. Any resources in parent/orthogonal scopes are not necessarily subject to the privileges/policies
+	// conveyed by this pin.
+	Scope string `protobuf:"bytes,1,opt,name=Scope,proto3" json:"scope"`
+	// Assignments encodes the scoped role assignments relevant to access-control decisions about the pinned identity. This may
+	// include assignments to parents of the pinned scope as well as assignments to equivalent/child scopes. Effectively, this
+	// means all assignments that are not orthogonal to the pinned scope.
+	Assignments          map[string]*ScopePinnedAssignments `protobuf:"bytes,2,rep,name=Assignments,proto3" json:"assignments" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	XXX_NoUnkeyedLiteral struct{}                           `json:"-"`
+	XXX_unrecognized     []byte                             `json:"-"`
+	XXX_sizecache        int32                              `json:"-"`
+}
+
+func (m *ScopePin) Reset()         { *m = ScopePin{} }
+func (m *ScopePin) String() string { return proto.CompactTextString(m) }
+func (*ScopePin) ProtoMessage()    {}
+func (*ScopePin) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{151}
+}
+func (m *ScopePin) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ScopePin) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ScopePin.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ScopePin) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ScopePin.Merge(m, src)
+}
+func (m *ScopePin) XXX_Size() int {
+	return m.Size()
+}
+func (m *ScopePin) XXX_DiscardUnknown() {
+	xxx_messageInfo_ScopePin.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ScopePin proto.InternalMessageInfo
+
+// ScopePinnedAssignments is a collection of scoped role assignments that are relevant to the pinned identity at the target scope.
+type ScopePinnedAssignments struct {
+	// Roles is a list of scoped roles that are assigned to the pinned identity at the target scope.
+	Roles                []string `protobuf:"bytes,1,rep,name=Roles,proto3" json:"roles"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ScopePinnedAssignments) Reset()         { *m = ScopePinnedAssignments{} }
+func (m *ScopePinnedAssignments) String() string { return proto.CompactTextString(m) }
+func (*ScopePinnedAssignments) ProtoMessage()    {}
+func (*ScopePinnedAssignments) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{152}
+}
+func (m *ScopePinnedAssignments) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ScopePinnedAssignments) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ScopePinnedAssignments.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ScopePinnedAssignments) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ScopePinnedAssignments.Merge(m, src)
+}
+func (m *ScopePinnedAssignments) XXX_Size() int {
+	return m.Size()
+}
+func (m *ScopePinnedAssignments) XXX_DiscardUnknown() {
+	xxx_messageInfo_ScopePinnedAssignments.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ScopePinnedAssignments proto.InternalMessageInfo
+
 // RouteToApp contains parameters for application access certificate requests.
 type RouteToApp struct {
 	// Name is the application name certificate is being requested for.
@@ -10926,7 +11346,7 @@ func (m *RouteToApp) Reset()         { *m = RouteToApp{} }
 func (m *RouteToApp) String() string { return proto.CompactTextString(m) }
 func (*RouteToApp) ProtoMessage()    {}
 func (*RouteToApp) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{149}
+	return fileDescriptor_007ba1c3d6266d56, []int{153}
 }
 func (m *RouteToApp) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10976,7 +11396,7 @@ func (m *RouteToDatabase) Reset()         { *m = RouteToDatabase{} }
 func (m *RouteToDatabase) String() string { return proto.CompactTextString(m) }
 func (*RouteToDatabase) ProtoMessage()    {}
 func (*RouteToDatabase) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{150}
+	return fileDescriptor_007ba1c3d6266d56, []int{154}
 }
 func (m *RouteToDatabase) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11026,7 +11446,7 @@ func (m *DeviceExtensions) Reset()         { *m = DeviceExtensions{} }
 func (m *DeviceExtensions) String() string { return proto.CompactTextString(m) }
 func (*DeviceExtensions) ProtoMessage()    {}
 func (*DeviceExtensions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{151}
+	return fileDescriptor_007ba1c3d6266d56, []int{155}
 }
 func (m *DeviceExtensions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11083,7 +11503,7 @@ func (m *AccessRequestResourceSearch) Reset()         { *m = AccessRequestResour
 func (m *AccessRequestResourceSearch) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestResourceSearch) ProtoMessage()    {}
 func (*AccessRequestResourceSearch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{152}
+	return fileDescriptor_007ba1c3d6266d56, []int{156}
 }
 func (m *AccessRequestResourceSearch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11134,7 +11554,7 @@ func (m *MySQLStatementPrepare) Reset()         { *m = MySQLStatementPrepare{} }
 func (m *MySQLStatementPrepare) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementPrepare) ProtoMessage()    {}
 func (*MySQLStatementPrepare) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{153}
+	return fileDescriptor_007ba1c3d6266d56, []int{157}
 }
 func (m *MySQLStatementPrepare) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11187,7 +11607,7 @@ func (m *MySQLStatementExecute) Reset()         { *m = MySQLStatementExecute{} }
 func (m *MySQLStatementExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementExecute) ProtoMessage()    {}
 func (*MySQLStatementExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{154}
+	return fileDescriptor_007ba1c3d6266d56, []int{158}
 }
 func (m *MySQLStatementExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11242,7 +11662,7 @@ func (m *MySQLStatementSendLongData) Reset()         { *m = MySQLStatementSendLo
 func (m *MySQLStatementSendLongData) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementSendLongData) ProtoMessage()    {}
 func (*MySQLStatementSendLongData) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{155}
+	return fileDescriptor_007ba1c3d6266d56, []int{159}
 }
 func (m *MySQLStatementSendLongData) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11293,7 +11713,7 @@ func (m *MySQLStatementClose) Reset()         { *m = MySQLStatementClose{} }
 func (m *MySQLStatementClose) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementClose) ProtoMessage()    {}
 func (*MySQLStatementClose) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{156}
+	return fileDescriptor_007ba1c3d6266d56, []int{160}
 }
 func (m *MySQLStatementClose) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11344,7 +11764,7 @@ func (m *MySQLStatementReset) Reset()         { *m = MySQLStatementReset{} }
 func (m *MySQLStatementReset) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementReset) ProtoMessage()    {}
 func (*MySQLStatementReset) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{157}
+	return fileDescriptor_007ba1c3d6266d56, []int{161}
 }
 func (m *MySQLStatementReset) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11397,7 +11817,7 @@ func (m *MySQLStatementFetch) Reset()         { *m = MySQLStatementFetch{} }
 func (m *MySQLStatementFetch) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementFetch) ProtoMessage()    {}
 func (*MySQLStatementFetch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{158}
+	return fileDescriptor_007ba1c3d6266d56, []int{162}
 }
 func (m *MySQLStatementFetch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11450,7 +11870,7 @@ func (m *MySQLStatementBulkExecute) Reset()         { *m = MySQLStatementBulkExe
 func (m *MySQLStatementBulkExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementBulkExecute) ProtoMessage()    {}
 func (*MySQLStatementBulkExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{159}
+	return fileDescriptor_007ba1c3d6266d56, []int{163}
 }
 func (m *MySQLStatementBulkExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11501,7 +11921,7 @@ func (m *MySQLInitDB) Reset()         { *m = MySQLInitDB{} }
 func (m *MySQLInitDB) String() string { return proto.CompactTextString(m) }
 func (*MySQLInitDB) ProtoMessage()    {}
 func (*MySQLInitDB) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{160}
+	return fileDescriptor_007ba1c3d6266d56, []int{164}
 }
 func (m *MySQLInitDB) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11551,7 +11971,7 @@ func (m *MySQLCreateDB) Reset()         { *m = MySQLCreateDB{} }
 func (m *MySQLCreateDB) String() string { return proto.CompactTextString(m) }
 func (*MySQLCreateDB) ProtoMessage()    {}
 func (*MySQLCreateDB) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{161}
+	return fileDescriptor_007ba1c3d6266d56, []int{165}
 }
 func (m *MySQLCreateDB) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11601,7 +12021,7 @@ func (m *MySQLDropDB) Reset()         { *m = MySQLDropDB{} }
 func (m *MySQLDropDB) String() string { return proto.CompactTextString(m) }
 func (*MySQLDropDB) ProtoMessage()    {}
 func (*MySQLDropDB) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{162}
+	return fileDescriptor_007ba1c3d6266d56, []int{166}
 }
 func (m *MySQLDropDB) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11649,7 +12069,7 @@ func (m *MySQLShutDown) Reset()         { *m = MySQLShutDown{} }
 func (m *MySQLShutDown) String() string { return proto.CompactTextString(m) }
 func (*MySQLShutDown) ProtoMessage()    {}
 func (*MySQLShutDown) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{163}
+	return fileDescriptor_007ba1c3d6266d56, []int{167}
 }
 func (m *MySQLShutDown) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11700,7 +12120,7 @@ func (m *MySQLProcessKill) Reset()         { *m = MySQLProcessKill{} }
 func (m *MySQLProcessKill) String() string { return proto.CompactTextString(m) }
 func (*MySQLProcessKill) ProtoMessage()    {}
 func (*MySQLProcessKill) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{164}
+	return fileDescriptor_007ba1c3d6266d56, []int{168}
 }
 func (m *MySQLProcessKill) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11749,7 +12169,7 @@ func (m *MySQLDebug) Reset()         { *m = MySQLDebug{} }
 func (m *MySQLDebug) String() string { return proto.CompactTextString(m) }
 func (*MySQLDebug) ProtoMessage()    {}
 func (*MySQLDebug) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{165}
+	return fileDescriptor_007ba1c3d6266d56, []int{169}
 }
 func (m *MySQLDebug) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11799,7 +12219,7 @@ func (m *MySQLRefresh) Reset()         { *m = MySQLRefresh{} }
 func (m *MySQLRefresh) String() string { return proto.CompactTextString(m) }
 func (*MySQLRefresh) ProtoMessage()    {}
 func (*MySQLRefresh) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{166}
+	return fileDescriptor_007ba1c3d6266d56, []int{170}
 }
 func (m *MySQLRefresh) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11851,7 +12271,7 @@ func (m *SQLServerRPCRequest) Reset()         { *m = SQLServerRPCRequest{} }
 func (m *SQLServerRPCRequest) String() string { return proto.CompactTextString(m) }
 func (*SQLServerRPCRequest) ProtoMessage()    {}
 func (*SQLServerRPCRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{167}
+	return fileDescriptor_007ba1c3d6266d56, []int{171}
 }
 func (m *SQLServerRPCRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11901,7 +12321,7 @@ func (m *DatabaseSessionMalformedPacket) Reset()         { *m = DatabaseSessionM
 func (m *DatabaseSessionMalformedPacket) String() string { return proto.CompactTextString(m) }
 func (*DatabaseSessionMalformedPacket) ProtoMessage()    {}
 func (*DatabaseSessionMalformedPacket) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{168}
+	return fileDescriptor_007ba1c3d6266d56, []int{172}
 }
 func (m *DatabaseSessionMalformedPacket) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11968,7 +12388,7 @@ func (m *ElasticsearchRequest) Reset()         { *m = ElasticsearchRequest{} }
 func (m *ElasticsearchRequest) String() string { return proto.CompactTextString(m) }
 func (*ElasticsearchRequest) ProtoMessage()    {}
 func (*ElasticsearchRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{169}
+	return fileDescriptor_007ba1c3d6266d56, []int{173}
 }
 func (m *ElasticsearchRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12034,7 +12454,7 @@ func (m *OpenSearchRequest) Reset()         { *m = OpenSearchRequest{} }
 func (m *OpenSearchRequest) String() string { return proto.CompactTextString(m) }
 func (*OpenSearchRequest) ProtoMessage()    {}
 func (*OpenSearchRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{170}
+	return fileDescriptor_007ba1c3d6266d56, []int{174}
 }
 func (m *OpenSearchRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12094,7 +12514,7 @@ func (m *DynamoDBRequest) Reset()         { *m = DynamoDBRequest{} }
 func (m *DynamoDBRequest) String() string { return proto.CompactTextString(m) }
 func (*DynamoDBRequest) ProtoMessage()    {}
 func (*DynamoDBRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{171}
+	return fileDescriptor_007ba1c3d6266d56, []int{175}
 }
 func (m *DynamoDBRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12160,7 +12580,7 @@ func (m *AppSessionDynamoDBRequest) Reset()         { *m = AppSessionDynamoDBReq
 func (m *AppSessionDynamoDBRequest) String() string { return proto.CompactTextString(m) }
 func (*AppSessionDynamoDBRequest) ProtoMessage()    {}
 func (*AppSessionDynamoDBRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{172}
+	return fileDescriptor_007ba1c3d6266d56, []int{176}
 }
 func (m *AppSessionDynamoDBRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12202,7 +12622,7 @@ func (m *UpgradeWindowStartMetadata) Reset()         { *m = UpgradeWindowStartMe
 func (m *UpgradeWindowStartMetadata) String() string { return proto.CompactTextString(m) }
 func (*UpgradeWindowStartMetadata) ProtoMessage()    {}
 func (*UpgradeWindowStartMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{173}
+	return fileDescriptor_007ba1c3d6266d56, []int{177}
 }
 func (m *UpgradeWindowStartMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12250,7 +12670,7 @@ func (m *UpgradeWindowStartUpdate) Reset()         { *m = UpgradeWindowStartUpda
 func (m *UpgradeWindowStartUpdate) String() string { return proto.CompactTextString(m) }
 func (*UpgradeWindowStartUpdate) ProtoMessage()    {}
 func (*UpgradeWindowStartUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{174}
+	return fileDescriptor_007ba1c3d6266d56, []int{178}
 }
 func (m *UpgradeWindowStartUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12301,7 +12721,7 @@ func (m *SessionRecordingAccess) Reset()         { *m = SessionRecordingAccess{}
 func (m *SessionRecordingAccess) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingAccess) ProtoMessage()    {}
 func (*SessionRecordingAccess) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{175}
+	return fileDescriptor_007ba1c3d6266d56, []int{179}
 }
 func (m *SessionRecordingAccess) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12343,7 +12763,7 @@ func (m *KubeClusterMetadata) Reset()         { *m = KubeClusterMetadata{} }
 func (m *KubeClusterMetadata) String() string { return proto.CompactTextString(m) }
 func (*KubeClusterMetadata) ProtoMessage()    {}
 func (*KubeClusterMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{176}
+	return fileDescriptor_007ba1c3d6266d56, []int{180}
 }
 func (m *KubeClusterMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12391,7 +12811,7 @@ func (m *KubernetesClusterCreate) Reset()         { *m = KubernetesClusterCreate
 func (m *KubernetesClusterCreate) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterCreate) ProtoMessage()    {}
 func (*KubernetesClusterCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{177}
+	return fileDescriptor_007ba1c3d6266d56, []int{181}
 }
 func (m *KubernetesClusterCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12439,7 +12859,7 @@ func (m *KubernetesClusterUpdate) Reset()         { *m = KubernetesClusterUpdate
 func (m *KubernetesClusterUpdate) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterUpdate) ProtoMessage()    {}
 func (*KubernetesClusterUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{178}
+	return fileDescriptor_007ba1c3d6266d56, []int{182}
 }
 func (m *KubernetesClusterUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12485,7 +12905,7 @@ func (m *KubernetesClusterDelete) Reset()         { *m = KubernetesClusterDelete
 func (m *KubernetesClusterDelete) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterDelete) ProtoMessage()    {}
 func (*KubernetesClusterDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{179}
+	return fileDescriptor_007ba1c3d6266d56, []int{183}
 }
 func (m *KubernetesClusterDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12548,7 +12968,7 @@ func (m *SSMRun) Reset()         { *m = SSMRun{} }
 func (m *SSMRun) String() string { return proto.CompactTextString(m) }
 func (*SSMRun) ProtoMessage()    {}
 func (*SSMRun) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{180}
+	return fileDescriptor_007ba1c3d6266d56, []int{184}
 }
 func (m *SSMRun) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12601,7 +13021,7 @@ func (m *CassandraPrepare) Reset()         { *m = CassandraPrepare{} }
 func (m *CassandraPrepare) String() string { return proto.CompactTextString(m) }
 func (*CassandraPrepare) ProtoMessage()    {}
 func (*CassandraPrepare) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{181}
+	return fileDescriptor_007ba1c3d6266d56, []int{185}
 }
 func (m *CassandraPrepare) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12651,7 +13071,7 @@ func (m *CassandraExecute) Reset()         { *m = CassandraExecute{} }
 func (m *CassandraExecute) String() string { return proto.CompactTextString(m) }
 func (*CassandraExecute) ProtoMessage()    {}
 func (*CassandraExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{182}
+	return fileDescriptor_007ba1c3d6266d56, []int{186}
 }
 func (m *CassandraExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12707,7 +13127,7 @@ func (m *CassandraBatch) Reset()         { *m = CassandraBatch{} }
 func (m *CassandraBatch) String() string { return proto.CompactTextString(m) }
 func (*CassandraBatch) ProtoMessage()    {}
 func (*CassandraBatch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{183}
+	return fileDescriptor_007ba1c3d6266d56, []int{187}
 }
 func (m *CassandraBatch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12753,7 +13173,7 @@ func (m *CassandraBatch_BatchChild) Reset()         { *m = CassandraBatch_BatchC
 func (m *CassandraBatch_BatchChild) String() string { return proto.CompactTextString(m) }
 func (*CassandraBatch_BatchChild) ProtoMessage()    {}
 func (*CassandraBatch_BatchChild) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{183, 0}
+	return fileDescriptor_007ba1c3d6266d56, []int{187, 0}
 }
 func (m *CassandraBatch_BatchChild) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12797,7 +13217,7 @@ func (m *CassandraBatch_BatchChild_Value) Reset()         { *m = CassandraBatch_
 func (m *CassandraBatch_BatchChild_Value) String() string { return proto.CompactTextString(m) }
 func (*CassandraBatch_BatchChild_Value) ProtoMessage()    {}
 func (*CassandraBatch_BatchChild_Value) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{183, 0, 0}
+	return fileDescriptor_007ba1c3d6266d56, []int{187, 0, 0}
 }
 func (m *CassandraBatch_BatchChild_Value) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12848,7 +13268,7 @@ func (m *CassandraRegister) Reset()         { *m = CassandraRegister{} }
 func (m *CassandraRegister) String() string { return proto.CompactTextString(m) }
 func (*CassandraRegister) ProtoMessage()    {}
 func (*CassandraRegister) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{184}
+	return fileDescriptor_007ba1c3d6266d56, []int{188}
 }
 func (m *CassandraRegister) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12894,7 +13314,7 @@ func (m *LoginRuleCreate) Reset()         { *m = LoginRuleCreate{} }
 func (m *LoginRuleCreate) String() string { return proto.CompactTextString(m) }
 func (*LoginRuleCreate) ProtoMessage()    {}
 func (*LoginRuleCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{185}
+	return fileDescriptor_007ba1c3d6266d56, []int{189}
 }
 func (m *LoginRuleCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12940,7 +13360,7 @@ func (m *LoginRuleDelete) Reset()         { *m = LoginRuleDelete{} }
 func (m *LoginRuleDelete) String() string { return proto.CompactTextString(m) }
 func (*LoginRuleDelete) ProtoMessage()    {}
 func (*LoginRuleDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{186}
+	return fileDescriptor_007ba1c3d6266d56, []int{190}
 }
 func (m *LoginRuleDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12990,7 +13410,7 @@ func (m *SAMLIdPAuthAttempt) Reset()         { *m = SAMLIdPAuthAttempt{} }
 func (m *SAMLIdPAuthAttempt) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPAuthAttempt) ProtoMessage()    {}
 func (*SAMLIdPAuthAttempt) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{187}
+	return fileDescriptor_007ba1c3d6266d56, []int{191}
 }
 func (m *SAMLIdPAuthAttempt) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13036,7 +13456,7 @@ func (m *SAMLIdPServiceProviderCreate) Reset()         { *m = SAMLIdPServiceProv
 func (m *SAMLIdPServiceProviderCreate) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderCreate) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{188}
+	return fileDescriptor_007ba1c3d6266d56, []int{192}
 }
 func (m *SAMLIdPServiceProviderCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13082,7 +13502,7 @@ func (m *SAMLIdPServiceProviderUpdate) Reset()         { *m = SAMLIdPServiceProv
 func (m *SAMLIdPServiceProviderUpdate) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderUpdate) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{189}
+	return fileDescriptor_007ba1c3d6266d56, []int{193}
 }
 func (m *SAMLIdPServiceProviderUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13128,7 +13548,7 @@ func (m *SAMLIdPServiceProviderDelete) Reset()         { *m = SAMLIdPServiceProv
 func (m *SAMLIdPServiceProviderDelete) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderDelete) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{190}
+	return fileDescriptor_007ba1c3d6266d56, []int{194}
 }
 func (m *SAMLIdPServiceProviderDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13172,7 +13592,7 @@ func (m *SAMLIdPServiceProviderDeleteAll) Reset()         { *m = SAMLIdPServiceP
 func (m *SAMLIdPServiceProviderDeleteAll) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderDeleteAll) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderDeleteAll) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{191}
+	return fileDescriptor_007ba1c3d6266d56, []int{195}
 }
 func (m *SAMLIdPServiceProviderDeleteAll) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13218,7 +13638,7 @@ func (m *OktaResourcesUpdate) Reset()         { *m = OktaResourcesUpdate{} }
 func (m *OktaResourcesUpdate) String() string { return proto.CompactTextString(m) }
 func (*OktaResourcesUpdate) ProtoMessage()    {}
 func (*OktaResourcesUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{192}
+	return fileDescriptor_007ba1c3d6266d56, []int{196}
 }
 func (m *OktaResourcesUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13264,7 +13684,7 @@ func (m *OktaSyncFailure) Reset()         { *m = OktaSyncFailure{} }
 func (m *OktaSyncFailure) String() string { return proto.CompactTextString(m) }
 func (*OktaSyncFailure) ProtoMessage()    {}
 func (*OktaSyncFailure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{193}
+	return fileDescriptor_007ba1c3d6266d56, []int{197}
 }
 func (m *OktaSyncFailure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13314,7 +13734,7 @@ func (m *OktaAssignmentResult) Reset()         { *m = OktaAssignmentResult{} }
 func (m *OktaAssignmentResult) String() string { return proto.CompactTextString(m) }
 func (*OktaAssignmentResult) ProtoMessage()    {}
 func (*OktaAssignmentResult) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{194}
+	return fileDescriptor_007ba1c3d6266d56, []int{198}
 }
 func (m *OktaAssignmentResult) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13362,7 +13782,7 @@ func (m *AccessListCreate) Reset()         { *m = AccessListCreate{} }
 func (m *AccessListCreate) String() string { return proto.CompactTextString(m) }
 func (*AccessListCreate) ProtoMessage()    {}
 func (*AccessListCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{195}
+	return fileDescriptor_007ba1c3d6266d56, []int{199}
 }
 func (m *AccessListCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13410,7 +13830,7 @@ func (m *AccessListUpdate) Reset()         { *m = AccessListUpdate{} }
 func (m *AccessListUpdate) String() string { return proto.CompactTextString(m) }
 func (*AccessListUpdate) ProtoMessage()    {}
 func (*AccessListUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{196}
+	return fileDescriptor_007ba1c3d6266d56, []int{200}
 }
 func (m *AccessListUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13458,7 +13878,7 @@ func (m *AccessListDelete) Reset()         { *m = AccessListDelete{} }
 func (m *AccessListDelete) String() string { return proto.CompactTextString(m) }
 func (*AccessListDelete) ProtoMessage()    {}
 func (*AccessListDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{197}
+	return fileDescriptor_007ba1c3d6266d56, []int{201}
 }
 func (m *AccessListDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13506,7 +13926,7 @@ func (m *AccessListMemberCreate) Reset()         { *m = AccessListMemberCreate{}
 func (m *AccessListMemberCreate) String() string { return proto.CompactTextString(m) }
 func (*AccessListMemberCreate) ProtoMessage()    {}
 func (*AccessListMemberCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{198}
+	return fileDescriptor_007ba1c3d6266d56, []int{202}
 }
 func (m *AccessListMemberCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13554,7 +13974,7 @@ func (m *AccessListMemberUpdate) Reset()         { *m = AccessListMemberUpdate{}
 func (m *AccessListMemberUpdate) String() string { return proto.CompactTextString(m) }
 func (*AccessListMemberUpdate) ProtoMessage()    {}
 func (*AccessListMemberUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{199}
+	return fileDescriptor_007ba1c3d6266d56, []int{203}
 }
 func (m *AccessListMemberUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13602,7 +14022,7 @@ func (m *AccessListMemberDelete) Reset()         { *m = AccessListMemberDelete{}
 func (m *AccessListMemberDelete) String() string { return proto.CompactTextString(m) }
 func (*AccessListMemberDelete) ProtoMessage()    {}
 func (*AccessListMemberDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{200}
+	return fileDescriptor_007ba1c3d6266d56, []int{204}
 }
 func (m *AccessListMemberDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13652,7 +14072,7 @@ func (m *AccessListMemberDeleteAllForAccessList) Reset() {
 func (m *AccessListMemberDeleteAllForAccessList) String() string { return proto.CompactTextString(m) }
 func (*AccessListMemberDeleteAllForAccessList) ProtoMessage()    {}
 func (*AccessListMemberDeleteAllForAccessList) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{201}
+	return fileDescriptor_007ba1c3d6266d56, []int{205}
 }
 func (m *AccessListMemberDeleteAllForAccessList) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13700,7 +14120,7 @@ func (m *AccessListReview) Reset()         { *m = AccessListReview{} }
 func (m *AccessListReview) String() string { return proto.CompactTextString(m) }
 func (*AccessListReview) ProtoMessage()    {}
 func (*AccessListReview) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{202}
+	return fileDescriptor_007ba1c3d6266d56, []int{206}
 }
 func (m *AccessListReview) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13748,7 +14168,7 @@ func (m *AuditQueryRun) Reset()         { *m = AuditQueryRun{} }
 func (m *AuditQueryRun) String() string { return proto.CompactTextString(m) }
 func (*AuditQueryRun) ProtoMessage()    {}
 func (*AuditQueryRun) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{203}
+	return fileDescriptor_007ba1c3d6266d56, []int{207}
 }
 func (m *AuditQueryRun) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13798,7 +14218,7 @@ func (m *AuditQueryDetails) Reset()         { *m = AuditQueryDetails{} }
 func (m *AuditQueryDetails) String() string { return proto.CompactTextString(m) }
 func (*AuditQueryDetails) ProtoMessage()    {}
 func (*AuditQueryDetails) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{204}
+	return fileDescriptor_007ba1c3d6266d56, []int{208}
 }
 func (m *AuditQueryDetails) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13854,7 +14274,7 @@ func (m *SecurityReportRun) Reset()         { *m = SecurityReportRun{} }
 func (m *SecurityReportRun) String() string { return proto.CompactTextString(m) }
 func (*SecurityReportRun) ProtoMessage()    {}
 func (*SecurityReportRun) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{205}
+	return fileDescriptor_007ba1c3d6266d56, []int{209}
 }
 func (m *SecurityReportRun) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13902,7 +14322,7 @@ func (m *ExternalAuditStorageEnable) Reset()         { *m = ExternalAuditStorage
 func (m *ExternalAuditStorageEnable) String() string { return proto.CompactTextString(m) }
 func (*ExternalAuditStorageEnable) ProtoMessage()    {}
 func (*ExternalAuditStorageEnable) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{206}
+	return fileDescriptor_007ba1c3d6266d56, []int{210}
 }
 func (m *ExternalAuditStorageEnable) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13950,7 +14370,7 @@ func (m *ExternalAuditStorageDisable) Reset()         { *m = ExternalAuditStorag
 func (m *ExternalAuditStorageDisable) String() string { return proto.CompactTextString(m) }
 func (*ExternalAuditStorageDisable) ProtoMessage()    {}
 func (*ExternalAuditStorageDisable) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{207}
+	return fileDescriptor_007ba1c3d6266d56, []int{211}
 }
 func (m *ExternalAuditStorageDisable) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14011,7 +14431,7 @@ func (m *ExternalAuditStorageDetails) Reset()         { *m = ExternalAuditStorag
 func (m *ExternalAuditStorageDetails) String() string { return proto.CompactTextString(m) }
 func (*ExternalAuditStorageDetails) ProtoMessage()    {}
 func (*ExternalAuditStorageDetails) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{208}
+	return fileDescriptor_007ba1c3d6266d56, []int{212}
 }
 func (m *ExternalAuditStorageDetails) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14069,7 +14489,7 @@ func (m *OktaAccessListSync) Reset()         { *m = OktaAccessListSync{} }
 func (m *OktaAccessListSync) String() string { return proto.CompactTextString(m) }
 func (*OktaAccessListSync) ProtoMessage()    {}
 func (*OktaAccessListSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{209}
+	return fileDescriptor_007ba1c3d6266d56, []int{213}
 }
 func (m *OktaAccessListSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14133,7 +14553,7 @@ func (m *OktaUserSync) Reset()         { *m = OktaUserSync{} }
 func (m *OktaUserSync) String() string { return proto.CompactTextString(m) }
 func (*OktaUserSync) ProtoMessage()    {}
 func (*OktaUserSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{210}
+	return fileDescriptor_007ba1c3d6266d56, []int{214}
 }
 func (m *OktaUserSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14162,6 +14582,49 @@ func (m *OktaUserSync) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_OktaUserSync proto.InternalMessageInfo
 
+// LabelSelector is a label selector that can be specified by the client to
+// filter the resources that are returned by the server.
+type LabelSelector struct {
+	Key                  string   `protobuf:"bytes,1,opt,name=Key,proto3" json:"key"`
+	Values               []string `protobuf:"bytes,2,rep,name=Values,proto3" json:"values"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *LabelSelector) Reset()         { *m = LabelSelector{} }
+func (m *LabelSelector) String() string { return proto.CompactTextString(m) }
+func (*LabelSelector) ProtoMessage()    {}
+func (*LabelSelector) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{215}
+}
+func (m *LabelSelector) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LabelSelector) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LabelSelector.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LabelSelector) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LabelSelector.Merge(m, src)
+}
+func (m *LabelSelector) XXX_Size() int {
+	return m.Size()
+}
+func (m *LabelSelector) XXX_DiscardUnknown() {
+	xxx_messageInfo_LabelSelector.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LabelSelector proto.InternalMessageInfo
+
 // SPIFFESVIDIssued is an event recorded when a SPIFFE SVID is issued.
 type SPIFFESVIDIssued struct {
 	// Metadata is a common event metadata
@@ -14196,17 +14659,21 @@ type SPIFFESVIDIssued struct {
 	WorkloadIdentityRevision string `protobuf:"bytes,13,opt,name=WorkloadIdentityRevision,proto3" json:"workload_identity_revision,omitempty"`
 	// Attributes is the collection of data that was used to make the decision on
 	// whether to issue the workload identity credential & to perform templating.
-	Attributes           *Struct  `protobuf:"bytes,14,opt,name=Attributes,proto3,casttype=Struct" json:"attributes,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	Attributes *Struct `protobuf:"bytes,14,opt,name=Attributes,proto3,casttype=Struct" json:"attributes,omitempty"`
+	// The name selector specified by the client when requesting the SVID.
+	NameSelector string `protobuf:"bytes,15,opt,name=NameSelector,proto3" json:"name_selector,omitempty"`
+	// The label selectors specified by the client when requesting the SVID.
+	LabelSelectors       []*LabelSelector `protobuf:"bytes,16,rep,name=LabelSelectors,proto3" json:"label_selectors,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
+	XXX_unrecognized     []byte           `json:"-"`
+	XXX_sizecache        int32            `json:"-"`
 }
 
 func (m *SPIFFESVIDIssued) Reset()         { *m = SPIFFESVIDIssued{} }
 func (m *SPIFFESVIDIssued) String() string { return proto.CompactTextString(m) }
 func (*SPIFFESVIDIssued) ProtoMessage()    {}
 func (*SPIFFESVIDIssued) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{211}
+	return fileDescriptor_007ba1c3d6266d56, []int{216}
 }
 func (m *SPIFFESVIDIssued) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14257,7 +14724,7 @@ func (m *AuthPreferenceUpdate) Reset()         { *m = AuthPreferenceUpdate{} }
 func (m *AuthPreferenceUpdate) String() string { return proto.CompactTextString(m) }
 func (*AuthPreferenceUpdate) ProtoMessage()    {}
 func (*AuthPreferenceUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{212}
+	return fileDescriptor_007ba1c3d6266d56, []int{217}
 }
 func (m *AuthPreferenceUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14305,7 +14772,7 @@ func (m *ClusterNetworkingConfigUpdate) Reset()         { *m = ClusterNetworking
 func (m *ClusterNetworkingConfigUpdate) String() string { return proto.CompactTextString(m) }
 func (*ClusterNetworkingConfigUpdate) ProtoMessage()    {}
 func (*ClusterNetworkingConfigUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{213}
+	return fileDescriptor_007ba1c3d6266d56, []int{218}
 }
 func (m *ClusterNetworkingConfigUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14353,7 +14820,7 @@ func (m *SessionRecordingConfigUpdate) Reset()         { *m = SessionRecordingCo
 func (m *SessionRecordingConfigUpdate) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingConfigUpdate) ProtoMessage()    {}
 func (*SessionRecordingConfigUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{214}
+	return fileDescriptor_007ba1c3d6266d56, []int{219}
 }
 func (m *SessionRecordingConfigUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14403,7 +14870,7 @@ func (m *AccessPathChanged) Reset()         { *m = AccessPathChanged{} }
 func (m *AccessPathChanged) String() string { return proto.CompactTextString(m) }
 func (*AccessPathChanged) ProtoMessage()    {}
 func (*AccessPathChanged) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{215}
+	return fileDescriptor_007ba1c3d6266d56, []int{220}
 }
 func (m *AccessPathChanged) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14457,7 +14924,7 @@ func (m *SpannerRPC) Reset()         { *m = SpannerRPC{} }
 func (m *SpannerRPC) String() string { return proto.CompactTextString(m) }
 func (*SpannerRPC) ProtoMessage()    {}
 func (*SpannerRPC) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{216}
+	return fileDescriptor_007ba1c3d6266d56, []int{221}
 }
 func (m *SpannerRPC) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14505,7 +14972,7 @@ func (m *AccessGraphSettingsUpdate) Reset()         { *m = AccessGraphSettingsUp
 func (m *AccessGraphSettingsUpdate) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphSettingsUpdate) ProtoMessage()    {}
 func (*AccessGraphSettingsUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{217}
+	return fileDescriptor_007ba1c3d6266d56, []int{222}
 }
 func (m *AccessGraphSettingsUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14553,7 +15020,7 @@ func (m *SPIFFEFederationCreate) Reset()         { *m = SPIFFEFederationCreate{}
 func (m *SPIFFEFederationCreate) String() string { return proto.CompactTextString(m) }
 func (*SPIFFEFederationCreate) ProtoMessage()    {}
 func (*SPIFFEFederationCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{218}
+	return fileDescriptor_007ba1c3d6266d56, []int{223}
 }
 func (m *SPIFFEFederationCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14601,7 +15068,7 @@ func (m *SPIFFEFederationDelete) Reset()         { *m = SPIFFEFederationDelete{}
 func (m *SPIFFEFederationDelete) String() string { return proto.CompactTextString(m) }
 func (*SPIFFEFederationDelete) ProtoMessage()    {}
 func (*SPIFFEFederationDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{219}
+	return fileDescriptor_007ba1c3d6266d56, []int{224}
 }
 func (m *SPIFFEFederationDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14651,7 +15118,7 @@ func (m *AutoUpdateConfigCreate) Reset()         { *m = AutoUpdateConfigCreate{}
 func (m *AutoUpdateConfigCreate) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateConfigCreate) ProtoMessage()    {}
 func (*AutoUpdateConfigCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{220}
+	return fileDescriptor_007ba1c3d6266d56, []int{225}
 }
 func (m *AutoUpdateConfigCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14701,7 +15168,7 @@ func (m *AutoUpdateConfigUpdate) Reset()         { *m = AutoUpdateConfigUpdate{}
 func (m *AutoUpdateConfigUpdate) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateConfigUpdate) ProtoMessage()    {}
 func (*AutoUpdateConfigUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{221}
+	return fileDescriptor_007ba1c3d6266d56, []int{226}
 }
 func (m *AutoUpdateConfigUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14751,7 +15218,7 @@ func (m *AutoUpdateConfigDelete) Reset()         { *m = AutoUpdateConfigDelete{}
 func (m *AutoUpdateConfigDelete) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateConfigDelete) ProtoMessage()    {}
 func (*AutoUpdateConfigDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{222}
+	return fileDescriptor_007ba1c3d6266d56, []int{227}
 }
 func (m *AutoUpdateConfigDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14801,7 +15268,7 @@ func (m *AutoUpdateVersionCreate) Reset()         { *m = AutoUpdateVersionCreate
 func (m *AutoUpdateVersionCreate) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateVersionCreate) ProtoMessage()    {}
 func (*AutoUpdateVersionCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{223}
+	return fileDescriptor_007ba1c3d6266d56, []int{228}
 }
 func (m *AutoUpdateVersionCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14851,7 +15318,7 @@ func (m *AutoUpdateVersionUpdate) Reset()         { *m = AutoUpdateVersionUpdate
 func (m *AutoUpdateVersionUpdate) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateVersionUpdate) ProtoMessage()    {}
 func (*AutoUpdateVersionUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{224}
+	return fileDescriptor_007ba1c3d6266d56, []int{229}
 }
 func (m *AutoUpdateVersionUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14901,7 +15368,7 @@ func (m *AutoUpdateVersionDelete) Reset()         { *m = AutoUpdateVersionDelete
 func (m *AutoUpdateVersionDelete) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateVersionDelete) ProtoMessage()    {}
 func (*AutoUpdateVersionDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{225}
+	return fileDescriptor_007ba1c3d6266d56, []int{230}
 }
 func (m *AutoUpdateVersionDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14951,7 +15418,7 @@ func (m *AutoUpdateAgentRolloutTrigger) Reset()         { *m = AutoUpdateAgentRo
 func (m *AutoUpdateAgentRolloutTrigger) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateAgentRolloutTrigger) ProtoMessage()    {}
 func (*AutoUpdateAgentRolloutTrigger) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{226}
+	return fileDescriptor_007ba1c3d6266d56, []int{231}
 }
 func (m *AutoUpdateAgentRolloutTrigger) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15001,7 +15468,7 @@ func (m *AutoUpdateAgentRolloutForceDone) Reset()         { *m = AutoUpdateAgent
 func (m *AutoUpdateAgentRolloutForceDone) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateAgentRolloutForceDone) ProtoMessage()    {}
 func (*AutoUpdateAgentRolloutForceDone) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{227}
+	return fileDescriptor_007ba1c3d6266d56, []int{232}
 }
 func (m *AutoUpdateAgentRolloutForceDone) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15051,7 +15518,7 @@ func (m *AutoUpdateAgentRolloutRollback) Reset()         { *m = AutoUpdateAgentR
 func (m *AutoUpdateAgentRolloutRollback) String() string { return proto.CompactTextString(m) }
 func (*AutoUpdateAgentRolloutRollback) ProtoMessage()    {}
 func (*AutoUpdateAgentRolloutRollback) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{228}
+	return fileDescriptor_007ba1c3d6266d56, []int{233}
 }
 func (m *AutoUpdateAgentRolloutRollback) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15101,7 +15568,7 @@ func (m *StaticHostUserCreate) Reset()         { *m = StaticHostUserCreate{} }
 func (m *StaticHostUserCreate) String() string { return proto.CompactTextString(m) }
 func (*StaticHostUserCreate) ProtoMessage()    {}
 func (*StaticHostUserCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{229}
+	return fileDescriptor_007ba1c3d6266d56, []int{234}
 }
 func (m *StaticHostUserCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15151,7 +15618,7 @@ func (m *StaticHostUserUpdate) Reset()         { *m = StaticHostUserUpdate{} }
 func (m *StaticHostUserUpdate) String() string { return proto.CompactTextString(m) }
 func (*StaticHostUserUpdate) ProtoMessage()    {}
 func (*StaticHostUserUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{230}
+	return fileDescriptor_007ba1c3d6266d56, []int{235}
 }
 func (m *StaticHostUserUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15201,7 +15668,7 @@ func (m *StaticHostUserDelete) Reset()         { *m = StaticHostUserDelete{} }
 func (m *StaticHostUserDelete) String() string { return proto.CompactTextString(m) }
 func (*StaticHostUserDelete) ProtoMessage()    {}
 func (*StaticHostUserDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{231}
+	return fileDescriptor_007ba1c3d6266d56, []int{236}
 }
 func (m *StaticHostUserDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15253,7 +15720,7 @@ func (m *CrownJewelCreate) Reset()         { *m = CrownJewelCreate{} }
 func (m *CrownJewelCreate) String() string { return proto.CompactTextString(m) }
 func (*CrownJewelCreate) ProtoMessage()    {}
 func (*CrownJewelCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{232}
+	return fileDescriptor_007ba1c3d6266d56, []int{237}
 }
 func (m *CrownJewelCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15307,7 +15774,7 @@ func (m *CrownJewelUpdate) Reset()         { *m = CrownJewelUpdate{} }
 func (m *CrownJewelUpdate) String() string { return proto.CompactTextString(m) }
 func (*CrownJewelUpdate) ProtoMessage()    {}
 func (*CrownJewelUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{233}
+	return fileDescriptor_007ba1c3d6266d56, []int{238}
 }
 func (m *CrownJewelUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15357,7 +15824,7 @@ func (m *CrownJewelDelete) Reset()         { *m = CrownJewelDelete{} }
 func (m *CrownJewelDelete) String() string { return proto.CompactTextString(m) }
 func (*CrownJewelDelete) ProtoMessage()    {}
 func (*CrownJewelDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{234}
+	return fileDescriptor_007ba1c3d6266d56, []int{239}
 }
 func (m *CrownJewelDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15409,7 +15876,7 @@ func (m *UserTaskCreate) Reset()         { *m = UserTaskCreate{} }
 func (m *UserTaskCreate) String() string { return proto.CompactTextString(m) }
 func (*UserTaskCreate) ProtoMessage()    {}
 func (*UserTaskCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{235}
+	return fileDescriptor_007ba1c3d6266d56, []int{240}
 }
 func (m *UserTaskCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15465,7 +15932,7 @@ func (m *UserTaskUpdate) Reset()         { *m = UserTaskUpdate{} }
 func (m *UserTaskUpdate) String() string { return proto.CompactTextString(m) }
 func (*UserTaskUpdate) ProtoMessage()    {}
 func (*UserTaskUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{236}
+	return fileDescriptor_007ba1c3d6266d56, []int{241}
 }
 func (m *UserTaskUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15511,7 +15978,7 @@ func (m *UserTaskMetadata) Reset()         { *m = UserTaskMetadata{} }
 func (m *UserTaskMetadata) String() string { return proto.CompactTextString(m) }
 func (*UserTaskMetadata) ProtoMessage()    {}
 func (*UserTaskMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{237}
+	return fileDescriptor_007ba1c3d6266d56, []int{242}
 }
 func (m *UserTaskMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15561,7 +16028,7 @@ func (m *UserTaskDelete) Reset()         { *m = UserTaskDelete{} }
 func (m *UserTaskDelete) String() string { return proto.CompactTextString(m) }
 func (*UserTaskDelete) ProtoMessage()    {}
 func (*UserTaskDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{238}
+	return fileDescriptor_007ba1c3d6266d56, []int{243}
 }
 func (m *UserTaskDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15615,7 +16082,7 @@ func (m *ContactCreate) Reset()         { *m = ContactCreate{} }
 func (m *ContactCreate) String() string { return proto.CompactTextString(m) }
 func (*ContactCreate) ProtoMessage()    {}
 func (*ContactCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{239}
+	return fileDescriptor_007ba1c3d6266d56, []int{244}
 }
 func (m *ContactCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15669,7 +16136,7 @@ func (m *ContactDelete) Reset()         { *m = ContactDelete{} }
 func (m *ContactDelete) String() string { return proto.CompactTextString(m) }
 func (*ContactDelete) ProtoMessage()    {}
 func (*ContactDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{240}
+	return fileDescriptor_007ba1c3d6266d56, []int{245}
 }
 func (m *ContactDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15719,7 +16186,7 @@ func (m *WorkloadIdentityCreate) Reset()         { *m = WorkloadIdentityCreate{}
 func (m *WorkloadIdentityCreate) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityCreate) ProtoMessage()    {}
 func (*WorkloadIdentityCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{241}
+	return fileDescriptor_007ba1c3d6266d56, []int{246}
 }
 func (m *WorkloadIdentityCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15769,7 +16236,7 @@ func (m *WorkloadIdentityUpdate) Reset()         { *m = WorkloadIdentityUpdate{}
 func (m *WorkloadIdentityUpdate) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityUpdate) ProtoMessage()    {}
 func (*WorkloadIdentityUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{242}
+	return fileDescriptor_007ba1c3d6266d56, []int{247}
 }
 func (m *WorkloadIdentityUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15817,7 +16284,7 @@ func (m *WorkloadIdentityDelete) Reset()         { *m = WorkloadIdentityDelete{}
 func (m *WorkloadIdentityDelete) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityDelete) ProtoMessage()    {}
 func (*WorkloadIdentityDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{243}
+	return fileDescriptor_007ba1c3d6266d56, []int{248}
 }
 func (m *WorkloadIdentityDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15868,7 +16335,7 @@ func (m *WorkloadIdentityX509RevocationCreate) Reset()         { *m = WorkloadId
 func (m *WorkloadIdentityX509RevocationCreate) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityX509RevocationCreate) ProtoMessage()    {}
 func (*WorkloadIdentityX509RevocationCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{244}
+	return fileDescriptor_007ba1c3d6266d56, []int{249}
 }
 func (m *WorkloadIdentityX509RevocationCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15919,7 +16386,7 @@ func (m *WorkloadIdentityX509RevocationUpdate) Reset()         { *m = WorkloadId
 func (m *WorkloadIdentityX509RevocationUpdate) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityX509RevocationUpdate) ProtoMessage()    {}
 func (*WorkloadIdentityX509RevocationUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{245}
+	return fileDescriptor_007ba1c3d6266d56, []int{250}
 }
 func (m *WorkloadIdentityX509RevocationUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15968,7 +16435,7 @@ func (m *WorkloadIdentityX509RevocationDelete) Reset()         { *m = WorkloadId
 func (m *WorkloadIdentityX509RevocationDelete) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityX509RevocationDelete) ProtoMessage()    {}
 func (*WorkloadIdentityX509RevocationDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{246}
+	return fileDescriptor_007ba1c3d6266d56, []int{251}
 }
 func (m *WorkloadIdentityX509RevocationDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16027,7 +16494,7 @@ func (m *GitCommand) Reset()         { *m = GitCommand{} }
 func (m *GitCommand) String() string { return proto.CompactTextString(m) }
 func (*GitCommand) ProtoMessage()    {}
 func (*GitCommand) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{247}
+	return fileDescriptor_007ba1c3d6266d56, []int{252}
 }
 func (m *GitCommand) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16075,7 +16542,7 @@ func (m *GitCommandAction) Reset()         { *m = GitCommandAction{} }
 func (m *GitCommandAction) String() string { return proto.CompactTextString(m) }
 func (*GitCommandAction) ProtoMessage()    {}
 func (*GitCommandAction) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{248}
+	return fileDescriptor_007ba1c3d6266d56, []int{253}
 }
 func (m *GitCommandAction) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16121,7 +16588,7 @@ func (m *AccessListInvalidMetadata) Reset()         { *m = AccessListInvalidMeta
 func (m *AccessListInvalidMetadata) String() string { return proto.CompactTextString(m) }
 func (*AccessListInvalidMetadata) ProtoMessage()    {}
 func (*AccessListInvalidMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{249}
+	return fileDescriptor_007ba1c3d6266d56, []int{254}
 }
 func (m *AccessListInvalidMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16169,7 +16636,7 @@ func (m *UserLoginAccessListInvalid) Reset()         { *m = UserLoginAccessListI
 func (m *UserLoginAccessListInvalid) String() string { return proto.CompactTextString(m) }
 func (*UserLoginAccessListInvalid) ProtoMessage()    {}
 func (*UserLoginAccessListInvalid) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{250}
+	return fileDescriptor_007ba1c3d6266d56, []int{255}
 }
 func (m *UserLoginAccessListInvalid) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16215,7 +16682,7 @@ func (m *StableUNIXUserCreate) Reset()         { *m = StableUNIXUserCreate{} }
 func (m *StableUNIXUserCreate) String() string { return proto.CompactTextString(m) }
 func (*StableUNIXUserCreate) ProtoMessage()    {}
 func (*StableUNIXUserCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{251}
+	return fileDescriptor_007ba1c3d6266d56, []int{256}
 }
 func (m *StableUNIXUserCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16256,7 +16723,7 @@ func (m *StableUNIXUser) Reset()         { *m = StableUNIXUser{} }
 func (m *StableUNIXUser) String() string { return proto.CompactTextString(m) }
 func (*StableUNIXUser) ProtoMessage()    {}
 func (*StableUNIXUser) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{252}
+	return fileDescriptor_007ba1c3d6266d56, []int{257}
 }
 func (m *StableUNIXUser) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16310,7 +16777,7 @@ func (m *AWSICResourceSync) Reset()         { *m = AWSICResourceSync{} }
 func (m *AWSICResourceSync) String() string { return proto.CompactTextString(m) }
 func (*AWSICResourceSync) ProtoMessage()    {}
 func (*AWSICResourceSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{253}
+	return fileDescriptor_007ba1c3d6266d56, []int{258}
 }
 func (m *AWSICResourceSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16358,7 +16825,7 @@ func (m *HealthCheckConfigCreate) Reset()         { *m = HealthCheckConfigCreate
 func (m *HealthCheckConfigCreate) String() string { return proto.CompactTextString(m) }
 func (*HealthCheckConfigCreate) ProtoMessage()    {}
 func (*HealthCheckConfigCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{254}
+	return fileDescriptor_007ba1c3d6266d56, []int{259}
 }
 func (m *HealthCheckConfigCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16406,7 +16873,7 @@ func (m *HealthCheckConfigUpdate) Reset()         { *m = HealthCheckConfigUpdate
 func (m *HealthCheckConfigUpdate) String() string { return proto.CompactTextString(m) }
 func (*HealthCheckConfigUpdate) ProtoMessage()    {}
 func (*HealthCheckConfigUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{255}
+	return fileDescriptor_007ba1c3d6266d56, []int{260}
 }
 func (m *HealthCheckConfigUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16454,7 +16921,7 @@ func (m *HealthCheckConfigDelete) Reset()         { *m = HealthCheckConfigDelete
 func (m *HealthCheckConfigDelete) String() string { return proto.CompactTextString(m) }
 func (*HealthCheckConfigDelete) ProtoMessage()    {}
 func (*HealthCheckConfigDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{256}
+	return fileDescriptor_007ba1c3d6266d56, []int{261}
 }
 func (m *HealthCheckConfigDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16499,7 +16966,7 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Reset() {
 func (m *WorkloadIdentityX509IssuerOverrideCreate) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityX509IssuerOverrideCreate) ProtoMessage()    {}
 func (*WorkloadIdentityX509IssuerOverrideCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{257}
+	return fileDescriptor_007ba1c3d6266d56, []int{262}
 }
 func (m *WorkloadIdentityX509IssuerOverrideCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16544,7 +17011,7 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Reset() {
 func (m *WorkloadIdentityX509IssuerOverrideDelete) String() string { return proto.CompactTextString(m) }
 func (*WorkloadIdentityX509IssuerOverrideDelete) ProtoMessage()    {}
 func (*WorkloadIdentityX509IssuerOverrideDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{258}
+	return fileDescriptor_007ba1c3d6266d56, []int{263}
 }
 func (m *WorkloadIdentityX509IssuerOverrideDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16592,7 +17059,7 @@ func (m *SigstorePolicyCreate) Reset()         { *m = SigstorePolicyCreate{} }
 func (m *SigstorePolicyCreate) String() string { return proto.CompactTextString(m) }
 func (*SigstorePolicyCreate) ProtoMessage()    {}
 func (*SigstorePolicyCreate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{259}
+	return fileDescriptor_007ba1c3d6266d56, []int{264}
 }
 func (m *SigstorePolicyCreate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16640,7 +17107,7 @@ func (m *SigstorePolicyUpdate) Reset()         { *m = SigstorePolicyUpdate{} }
 func (m *SigstorePolicyUpdate) String() string { return proto.CompactTextString(m) }
 func (*SigstorePolicyUpdate) ProtoMessage()    {}
 func (*SigstorePolicyUpdate) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{260}
+	return fileDescriptor_007ba1c3d6266d56, []int{265}
 }
 func (m *SigstorePolicyUpdate) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16688,7 +17155,7 @@ func (m *SigstorePolicyDelete) Reset()         { *m = SigstorePolicyDelete{} }
 func (m *SigstorePolicyDelete) String() string { return proto.CompactTextString(m) }
 func (*SigstorePolicyDelete) ProtoMessage()    {}
 func (*SigstorePolicyDelete) Descriptor() ([]byte, []int) {
-	return fileDescriptor_007ba1c3d6266d56, []int{261}
+	return fileDescriptor_007ba1c3d6266d56, []int{266}
 }
 func (m *SigstorePolicyDelete) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16717,2212 +17184,2619 @@ func (m *SigstorePolicyDelete) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_SigstorePolicyDelete proto.InternalMessageInfo
 
-func init() {
-	proto.RegisterEnum("events.UserKind", UserKind_name, UserKind_value)
-	proto.RegisterEnum("events.UserOrigin", UserOrigin_name, UserOrigin_value)
-	proto.RegisterEnum("events.EventAction", EventAction_name, EventAction_value)
-	proto.RegisterEnum("events.SFTPAction", SFTPAction_name, SFTPAction_value)
-	proto.RegisterEnum("events.OSType", OSType_name, OSType_value)
-	proto.RegisterEnum("events.DeviceOrigin", DeviceOrigin_name, DeviceOrigin_value)
-	proto.RegisterEnum("events.ElasticsearchCategory", ElasticsearchCategory_name, ElasticsearchCategory_value)
-	proto.RegisterEnum("events.OpenSearchCategory", OpenSearchCategory_name, OpenSearchCategory_value)
-	proto.RegisterEnum("events.AdminActionsMFAStatus", AdminActionsMFAStatus_name, AdminActionsMFAStatus_value)
-	proto.RegisterEnum("events.ContactType", ContactType_name, ContactType_value)
-	proto.RegisterEnum("events.SessionNetwork_NetworkOperation", SessionNetwork_NetworkOperation_name, SessionNetwork_NetworkOperation_value)
-	proto.RegisterType((*Metadata)(nil), "events.Metadata")
-	proto.RegisterType((*SessionMetadata)(nil), "events.SessionMetadata")
-	proto.RegisterType((*UserMetadata)(nil), "events.UserMetadata")
-	proto.RegisterType((*ServerMetadata)(nil), "events.ServerMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.ServerMetadata.ServerLabelsEntry")
-	proto.RegisterType((*ConnectionMetadata)(nil), "events.ConnectionMetadata")
-	proto.RegisterType((*ClientMetadata)(nil), "events.ClientMetadata")
-	proto.RegisterType((*KubernetesClusterMetadata)(nil), "events.KubernetesClusterMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.KubernetesClusterMetadata.KubernetesLabelsEntry")
-	proto.RegisterType((*KubernetesPodMetadata)(nil), "events.KubernetesPodMetadata")
-	proto.RegisterType((*SAMLIdPServiceProviderMetadata)(nil), "events.SAMLIdPServiceProviderMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.SAMLIdPServiceProviderMetadata.AttributeMappingEntry")
-	proto.RegisterType((*OktaResourcesUpdatedMetadata)(nil), "events.OktaResourcesUpdatedMetadata")
-	proto.RegisterType((*OktaResource)(nil), "events.OktaResource")
-	proto.RegisterType((*OktaAssignmentMetadata)(nil), "events.OktaAssignmentMetadata")
-	proto.RegisterType((*AccessListMemberMetadata)(nil), "events.AccessListMemberMetadata")
-	proto.RegisterType((*AccessListMember)(nil), "events.AccessListMember")
-	proto.RegisterType((*AccessListReviewMembershipRequirementsChanged)(nil), "events.AccessListReviewMembershipRequirementsChanged")
-	proto.RegisterMapType((map[string]string)(nil), "events.AccessListReviewMembershipRequirementsChanged.TraitsEntry")
-	proto.RegisterType((*AccessListReviewMetadata)(nil), "events.AccessListReviewMetadata")
-	proto.RegisterType((*LockMetadata)(nil), "events.LockMetadata")
-	proto.RegisterType((*SessionStart)(nil), "events.SessionStart")
-	proto.RegisterType((*SessionJoin)(nil), "events.SessionJoin")
-	proto.RegisterType((*SessionPrint)(nil), "events.SessionPrint")
-	proto.RegisterType((*DesktopRecording)(nil), "events.DesktopRecording")
-	proto.RegisterType((*DesktopClipboardReceive)(nil), "events.DesktopClipboardReceive")
-	proto.RegisterType((*DesktopClipboardSend)(nil), "events.DesktopClipboardSend")
-	proto.RegisterType((*DesktopSharedDirectoryStart)(nil), "events.DesktopSharedDirectoryStart")
-	proto.RegisterType((*DesktopSharedDirectoryRead)(nil), "events.DesktopSharedDirectoryRead")
-	proto.RegisterType((*DesktopSharedDirectoryWrite)(nil), "events.DesktopSharedDirectoryWrite")
-	proto.RegisterType((*SessionReject)(nil), "events.SessionReject")
-	proto.RegisterType((*SessionConnect)(nil), "events.SessionConnect")
-	proto.RegisterType((*FileTransferRequestEvent)(nil), "events.FileTransferRequestEvent")
-	proto.RegisterType((*Resize)(nil), "events.Resize")
-	proto.RegisterType((*SessionEnd)(nil), "events.SessionEnd")
-	proto.RegisterType((*BPFMetadata)(nil), "events.BPFMetadata")
-	proto.RegisterType((*Status)(nil), "events.Status")
-	proto.RegisterType((*SessionCommand)(nil), "events.SessionCommand")
-	proto.RegisterType((*SessionDisk)(nil), "events.SessionDisk")
-	proto.RegisterType((*SessionNetwork)(nil), "events.SessionNetwork")
-	proto.RegisterType((*SessionData)(nil), "events.SessionData")
-	proto.RegisterType((*SessionLeave)(nil), "events.SessionLeave")
-	proto.RegisterType((*UserLogin)(nil), "events.UserLogin")
-	proto.RegisterType((*CreateMFAAuthChallenge)(nil), "events.CreateMFAAuthChallenge")
-	proto.RegisterType((*ValidateMFAAuthResponse)(nil), "events.ValidateMFAAuthResponse")
-	proto.RegisterType((*ResourceMetadata)(nil), "events.ResourceMetadata")
-	proto.RegisterType((*UserCreate)(nil), "events.UserCreate")
-	proto.RegisterType((*UserUpdate)(nil), "events.UserUpdate")
-	proto.RegisterType((*UserDelete)(nil), "events.UserDelete")
-	proto.RegisterType((*UserPasswordChange)(nil), "events.UserPasswordChange")
-	proto.RegisterType((*AccessRequestCreate)(nil), "events.AccessRequestCreate")
-	proto.RegisterType((*AccessRequestExpire)(nil), "events.AccessRequestExpire")
-	proto.RegisterType((*ResourceID)(nil), "events.ResourceID")
-	proto.RegisterType((*AccessRequestDelete)(nil), "events.AccessRequestDelete")
-	proto.RegisterType((*PortForward)(nil), "events.PortForward")
-	proto.RegisterType((*X11Forward)(nil), "events.X11Forward")
-	proto.RegisterType((*CommandMetadata)(nil), "events.CommandMetadata")
-	proto.RegisterType((*Exec)(nil), "events.Exec")
-	proto.RegisterType((*SCP)(nil), "events.SCP")
-	proto.RegisterType((*SFTPAttributes)(nil), "events.SFTPAttributes")
-	proto.RegisterType((*SFTP)(nil), "events.SFTP")
-	proto.RegisterType((*SFTPSummary)(nil), "events.SFTPSummary")
-	proto.RegisterType((*FileTransferStat)(nil), "events.FileTransferStat")
-	proto.RegisterType((*Subsystem)(nil), "events.Subsystem")
-	proto.RegisterType((*ClientDisconnect)(nil), "events.ClientDisconnect")
-	proto.RegisterType((*AuthAttempt)(nil), "events.AuthAttempt")
-	proto.RegisterType((*UserTokenCreate)(nil), "events.UserTokenCreate")
-	proto.RegisterType((*RoleCreate)(nil), "events.RoleCreate")
-	proto.RegisterType((*RoleUpdate)(nil), "events.RoleUpdate")
-	proto.RegisterType((*RoleDelete)(nil), "events.RoleDelete")
-	proto.RegisterType((*BotCreate)(nil), "events.BotCreate")
-	proto.RegisterType((*BotUpdate)(nil), "events.BotUpdate")
-	proto.RegisterType((*BotDelete)(nil), "events.BotDelete")
-	proto.RegisterType((*TrustedClusterCreate)(nil), "events.TrustedClusterCreate")
-	proto.RegisterType((*TrustedClusterDelete)(nil), "events.TrustedClusterDelete")
-	proto.RegisterType((*ProvisionTokenCreate)(nil), "events.ProvisionTokenCreate")
-	proto.RegisterType((*TrustedClusterTokenCreate)(nil), "events.TrustedClusterTokenCreate")
-	proto.RegisterType((*GithubConnectorCreate)(nil), "events.GithubConnectorCreate")
-	proto.RegisterType((*GithubConnectorUpdate)(nil), "events.GithubConnectorUpdate")
-	proto.RegisterType((*GithubConnectorDelete)(nil), "events.GithubConnectorDelete")
-	proto.RegisterType((*OIDCConnectorCreate)(nil), "events.OIDCConnectorCreate")
-	proto.RegisterType((*OIDCConnectorUpdate)(nil), "events.OIDCConnectorUpdate")
-	proto.RegisterType((*OIDCConnectorDelete)(nil), "events.OIDCConnectorDelete")
-	proto.RegisterType((*SAMLConnectorCreate)(nil), "events.SAMLConnectorCreate")
-	proto.RegisterType((*SAMLConnectorUpdate)(nil), "events.SAMLConnectorUpdate")
-	proto.RegisterType((*SAMLConnectorDelete)(nil), "events.SAMLConnectorDelete")
-	proto.RegisterType((*KubeRequest)(nil), "events.KubeRequest")
-	proto.RegisterType((*AppMetadata)(nil), "events.AppMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.AppMetadata.AppLabelsEntry")
-	proto.RegisterType((*AppCreate)(nil), "events.AppCreate")
-	proto.RegisterType((*AppUpdate)(nil), "events.AppUpdate")
-	proto.RegisterType((*AppDelete)(nil), "events.AppDelete")
-	proto.RegisterType((*AppSessionStart)(nil), "events.AppSessionStart")
-	proto.RegisterType((*AppSessionEnd)(nil), "events.AppSessionEnd")
-	proto.RegisterType((*AppSessionChunk)(nil), "events.AppSessionChunk")
-	proto.RegisterType((*AppSessionRequest)(nil), "events.AppSessionRequest")
-	proto.RegisterType((*AWSRequestMetadata)(nil), "events.AWSRequestMetadata")
-	proto.RegisterType((*DatabaseMetadata)(nil), "events.DatabaseMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.DatabaseMetadata.DatabaseLabelsEntry")
-	proto.RegisterType((*DatabaseCreate)(nil), "events.DatabaseCreate")
-	proto.RegisterType((*DatabaseUpdate)(nil), "events.DatabaseUpdate")
-	proto.RegisterType((*DatabaseDelete)(nil), "events.DatabaseDelete")
-	proto.RegisterType((*DatabaseSessionStart)(nil), "events.DatabaseSessionStart")
-	proto.RegisterType((*DatabaseSessionQuery)(nil), "events.DatabaseSessionQuery")
-	proto.RegisterType((*DatabaseSessionCommandResult)(nil), "events.DatabaseSessionCommandResult")
-	proto.RegisterType((*DatabasePermissionUpdate)(nil), "events.DatabasePermissionUpdate")
-	proto.RegisterMapType((map[string]int32)(nil), "events.DatabasePermissionUpdate.AffectedObjectCountsEntry")
-	proto.RegisterType((*DatabasePermissionEntry)(nil), "events.DatabasePermissionEntry")
-	proto.RegisterMapType((map[string]int32)(nil), "events.DatabasePermissionEntry.CountsEntry")
-	proto.RegisterType((*DatabaseUserCreate)(nil), "events.DatabaseUserCreate")
-	proto.RegisterType((*DatabaseUserDeactivate)(nil), "events.DatabaseUserDeactivate")
-	proto.RegisterType((*PostgresParse)(nil), "events.PostgresParse")
-	proto.RegisterType((*PostgresBind)(nil), "events.PostgresBind")
-	proto.RegisterType((*PostgresExecute)(nil), "events.PostgresExecute")
-	proto.RegisterType((*PostgresClose)(nil), "events.PostgresClose")
-	proto.RegisterType((*PostgresFunctionCall)(nil), "events.PostgresFunctionCall")
-	proto.RegisterType((*WindowsDesktopSessionStart)(nil), "events.WindowsDesktopSessionStart")
-	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionStart.DesktopLabelsEntry")
-	proto.RegisterType((*DatabaseSessionEnd)(nil), "events.DatabaseSessionEnd")
-	proto.RegisterType((*MFADeviceMetadata)(nil), "events.MFADeviceMetadata")
-	proto.RegisterType((*MFADeviceAdd)(nil), "events.MFADeviceAdd")
-	proto.RegisterType((*MFADeviceDelete)(nil), "events.MFADeviceDelete")
-	proto.RegisterType((*BillingInformationUpdate)(nil), "events.BillingInformationUpdate")
-	proto.RegisterType((*BillingCardCreate)(nil), "events.BillingCardCreate")
-	proto.RegisterType((*BillingCardDelete)(nil), "events.BillingCardDelete")
-	proto.RegisterType((*LockCreate)(nil), "events.LockCreate")
-	proto.RegisterType((*LockDelete)(nil), "events.LockDelete")
-	proto.RegisterType((*RecoveryCodeGenerate)(nil), "events.RecoveryCodeGenerate")
-	proto.RegisterType((*RecoveryCodeUsed)(nil), "events.RecoveryCodeUsed")
-	proto.RegisterType((*WindowsDesktopSessionEnd)(nil), "events.WindowsDesktopSessionEnd")
-	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionEnd.DesktopLabelsEntry")
-	proto.RegisterType((*CertificateCreate)(nil), "events.CertificateCreate")
-	proto.RegisterType((*RenewableCertificateGenerationMismatch)(nil), "events.RenewableCertificateGenerationMismatch")
-	proto.RegisterType((*BotJoin)(nil), "events.BotJoin")
-	proto.RegisterType((*InstanceJoin)(nil), "events.InstanceJoin")
-	proto.RegisterType((*Unknown)(nil), "events.Unknown")
-	proto.RegisterType((*DeviceMetadata)(nil), "events.DeviceMetadata")
-	proto.RegisterType((*DeviceEvent)(nil), "events.DeviceEvent")
-	proto.RegisterType((*DeviceEvent2)(nil), "events.DeviceEvent2")
-	proto.RegisterType((*DiscoveryConfigCreate)(nil), "events.DiscoveryConfigCreate")
-	proto.RegisterType((*DiscoveryConfigUpdate)(nil), "events.DiscoveryConfigUpdate")
-	proto.RegisterType((*DiscoveryConfigDelete)(nil), "events.DiscoveryConfigDelete")
-	proto.RegisterType((*DiscoveryConfigDeleteAll)(nil), "events.DiscoveryConfigDeleteAll")
-	proto.RegisterType((*IntegrationCreate)(nil), "events.IntegrationCreate")
-	proto.RegisterType((*IntegrationUpdate)(nil), "events.IntegrationUpdate")
-	proto.RegisterType((*IntegrationDelete)(nil), "events.IntegrationDelete")
-	proto.RegisterType((*IntegrationMetadata)(nil), "events.IntegrationMetadata")
-	proto.RegisterType((*AWSOIDCIntegrationMetadata)(nil), "events.AWSOIDCIntegrationMetadata")
-	proto.RegisterType((*AzureOIDCIntegrationMetadata)(nil), "events.AzureOIDCIntegrationMetadata")
-	proto.RegisterType((*GitHubIntegrationMetadata)(nil), "events.GitHubIntegrationMetadata")
-	proto.RegisterType((*AWSRAIntegrationMetadata)(nil), "events.AWSRAIntegrationMetadata")
-	proto.RegisterType((*PluginCreate)(nil), "events.PluginCreate")
-	proto.RegisterType((*PluginUpdate)(nil), "events.PluginUpdate")
-	proto.RegisterType((*PluginDelete)(nil), "events.PluginDelete")
-	proto.RegisterType((*PluginMetadata)(nil), "events.PluginMetadata")
-	proto.RegisterType((*OneOf)(nil), "events.OneOf")
-	proto.RegisterType((*StreamStatus)(nil), "events.StreamStatus")
-	proto.RegisterType((*SessionUpload)(nil), "events.SessionUpload")
-	proto.RegisterType((*Identity)(nil), "events.Identity")
-	proto.RegisterType((*RouteToApp)(nil), "events.RouteToApp")
-	proto.RegisterType((*RouteToDatabase)(nil), "events.RouteToDatabase")
-	proto.RegisterType((*DeviceExtensions)(nil), "events.DeviceExtensions")
-	proto.RegisterType((*AccessRequestResourceSearch)(nil), "events.AccessRequestResourceSearch")
-	proto.RegisterMapType((map[string]string)(nil), "events.AccessRequestResourceSearch.LabelsEntry")
-	proto.RegisterType((*MySQLStatementPrepare)(nil), "events.MySQLStatementPrepare")
-	proto.RegisterType((*MySQLStatementExecute)(nil), "events.MySQLStatementExecute")
-	proto.RegisterType((*MySQLStatementSendLongData)(nil), "events.MySQLStatementSendLongData")
-	proto.RegisterType((*MySQLStatementClose)(nil), "events.MySQLStatementClose")
-	proto.RegisterType((*MySQLStatementReset)(nil), "events.MySQLStatementReset")
-	proto.RegisterType((*MySQLStatementFetch)(nil), "events.MySQLStatementFetch")
-	proto.RegisterType((*MySQLStatementBulkExecute)(nil), "events.MySQLStatementBulkExecute")
-	proto.RegisterType((*MySQLInitDB)(nil), "events.MySQLInitDB")
-	proto.RegisterType((*MySQLCreateDB)(nil), "events.MySQLCreateDB")
-	proto.RegisterType((*MySQLDropDB)(nil), "events.MySQLDropDB")
-	proto.RegisterType((*MySQLShutDown)(nil), "events.MySQLShutDown")
-	proto.RegisterType((*MySQLProcessKill)(nil), "events.MySQLProcessKill")
-	proto.RegisterType((*MySQLDebug)(nil), "events.MySQLDebug")
-	proto.RegisterType((*MySQLRefresh)(nil), "events.MySQLRefresh")
-	proto.RegisterType((*SQLServerRPCRequest)(nil), "events.SQLServerRPCRequest")
-	proto.RegisterType((*DatabaseSessionMalformedPacket)(nil), "events.DatabaseSessionMalformedPacket")
-	proto.RegisterType((*ElasticsearchRequest)(nil), "events.ElasticsearchRequest")
-	proto.RegisterType((*OpenSearchRequest)(nil), "events.OpenSearchRequest")
-	proto.RegisterType((*DynamoDBRequest)(nil), "events.DynamoDBRequest")
-	proto.RegisterType((*AppSessionDynamoDBRequest)(nil), "events.AppSessionDynamoDBRequest")
-	proto.RegisterType((*UpgradeWindowStartMetadata)(nil), "events.UpgradeWindowStartMetadata")
-	proto.RegisterType((*UpgradeWindowStartUpdate)(nil), "events.UpgradeWindowStartUpdate")
-	proto.RegisterType((*SessionRecordingAccess)(nil), "events.SessionRecordingAccess")
-	proto.RegisterType((*KubeClusterMetadata)(nil), "events.KubeClusterMetadata")
-	proto.RegisterMapType((map[string]string)(nil), "events.KubeClusterMetadata.KubeLabelsEntry")
-	proto.RegisterType((*KubernetesClusterCreate)(nil), "events.KubernetesClusterCreate")
-	proto.RegisterType((*KubernetesClusterUpdate)(nil), "events.KubernetesClusterUpdate")
-	proto.RegisterType((*KubernetesClusterDelete)(nil), "events.KubernetesClusterDelete")
-	proto.RegisterType((*SSMRun)(nil), "events.SSMRun")
-	proto.RegisterType((*CassandraPrepare)(nil), "events.CassandraPrepare")
-	proto.RegisterType((*CassandraExecute)(nil), "events.CassandraExecute")
-	proto.RegisterType((*CassandraBatch)(nil), "events.CassandraBatch")
-	proto.RegisterType((*CassandraBatch_BatchChild)(nil), "events.CassandraBatch.BatchChild")
-	proto.RegisterType((*CassandraBatch_BatchChild_Value)(nil), "events.CassandraBatch.BatchChild.Value")
-	proto.RegisterType((*CassandraRegister)(nil), "events.CassandraRegister")
-	proto.RegisterType((*LoginRuleCreate)(nil), "events.LoginRuleCreate")
-	proto.RegisterType((*LoginRuleDelete)(nil), "events.LoginRuleDelete")
-	proto.RegisterType((*SAMLIdPAuthAttempt)(nil), "events.SAMLIdPAuthAttempt")
-	proto.RegisterType((*SAMLIdPServiceProviderCreate)(nil), "events.SAMLIdPServiceProviderCreate")
-	proto.RegisterType((*SAMLIdPServiceProviderUpdate)(nil), "events.SAMLIdPServiceProviderUpdate")
-	proto.RegisterType((*SAMLIdPServiceProviderDelete)(nil), "events.SAMLIdPServiceProviderDelete")
-	proto.RegisterType((*SAMLIdPServiceProviderDeleteAll)(nil), "events.SAMLIdPServiceProviderDeleteAll")
-	proto.RegisterType((*OktaResourcesUpdate)(nil), "events.OktaResourcesUpdate")
-	proto.RegisterType((*OktaSyncFailure)(nil), "events.OktaSyncFailure")
-	proto.RegisterType((*OktaAssignmentResult)(nil), "events.OktaAssignmentResult")
-	proto.RegisterType((*AccessListCreate)(nil), "events.AccessListCreate")
-	proto.RegisterType((*AccessListUpdate)(nil), "events.AccessListUpdate")
-	proto.RegisterType((*AccessListDelete)(nil), "events.AccessListDelete")
-	proto.RegisterType((*AccessListMemberCreate)(nil), "events.AccessListMemberCreate")
-	proto.RegisterType((*AccessListMemberUpdate)(nil), "events.AccessListMemberUpdate")
-	proto.RegisterType((*AccessListMemberDelete)(nil), "events.AccessListMemberDelete")
-	proto.RegisterType((*AccessListMemberDeleteAllForAccessList)(nil), "events.AccessListMemberDeleteAllForAccessList")
-	proto.RegisterType((*AccessListReview)(nil), "events.AccessListReview")
-	proto.RegisterType((*AuditQueryRun)(nil), "events.AuditQueryRun")
-	proto.RegisterType((*AuditQueryDetails)(nil), "events.AuditQueryDetails")
-	proto.RegisterType((*SecurityReportRun)(nil), "events.SecurityReportRun")
-	proto.RegisterType((*ExternalAuditStorageEnable)(nil), "events.ExternalAuditStorageEnable")
-	proto.RegisterType((*ExternalAuditStorageDisable)(nil), "events.ExternalAuditStorageDisable")
-	proto.RegisterType((*ExternalAuditStorageDetails)(nil), "events.ExternalAuditStorageDetails")
-	proto.RegisterType((*OktaAccessListSync)(nil), "events.OktaAccessListSync")
-	proto.RegisterType((*OktaUserSync)(nil), "events.OktaUserSync")
-	proto.RegisterType((*SPIFFESVIDIssued)(nil), "events.SPIFFESVIDIssued")
-	proto.RegisterType((*AuthPreferenceUpdate)(nil), "events.AuthPreferenceUpdate")
-	proto.RegisterType((*ClusterNetworkingConfigUpdate)(nil), "events.ClusterNetworkingConfigUpdate")
-	proto.RegisterType((*SessionRecordingConfigUpdate)(nil), "events.SessionRecordingConfigUpdate")
-	proto.RegisterType((*AccessPathChanged)(nil), "events.AccessPathChanged")
-	proto.RegisterType((*SpannerRPC)(nil), "events.SpannerRPC")
-	proto.RegisterType((*AccessGraphSettingsUpdate)(nil), "events.AccessGraphSettingsUpdate")
-	proto.RegisterType((*SPIFFEFederationCreate)(nil), "events.SPIFFEFederationCreate")
-	proto.RegisterType((*SPIFFEFederationDelete)(nil), "events.SPIFFEFederationDelete")
-	proto.RegisterType((*AutoUpdateConfigCreate)(nil), "events.AutoUpdateConfigCreate")
-	proto.RegisterType((*AutoUpdateConfigUpdate)(nil), "events.AutoUpdateConfigUpdate")
-	proto.RegisterType((*AutoUpdateConfigDelete)(nil), "events.AutoUpdateConfigDelete")
-	proto.RegisterType((*AutoUpdateVersionCreate)(nil), "events.AutoUpdateVersionCreate")
-	proto.RegisterType((*AutoUpdateVersionUpdate)(nil), "events.AutoUpdateVersionUpdate")
-	proto.RegisterType((*AutoUpdateVersionDelete)(nil), "events.AutoUpdateVersionDelete")
-	proto.RegisterType((*AutoUpdateAgentRolloutTrigger)(nil), "events.AutoUpdateAgentRolloutTrigger")
-	proto.RegisterType((*AutoUpdateAgentRolloutForceDone)(nil), "events.AutoUpdateAgentRolloutForceDone")
-	proto.RegisterType((*AutoUpdateAgentRolloutRollback)(nil), "events.AutoUpdateAgentRolloutRollback")
-	proto.RegisterType((*StaticHostUserCreate)(nil), "events.StaticHostUserCreate")
-	proto.RegisterType((*StaticHostUserUpdate)(nil), "events.StaticHostUserUpdate")
-	proto.RegisterType((*StaticHostUserDelete)(nil), "events.StaticHostUserDelete")
-	proto.RegisterType((*CrownJewelCreate)(nil), "events.CrownJewelCreate")
-	proto.RegisterType((*CrownJewelUpdate)(nil), "events.CrownJewelUpdate")
-	proto.RegisterType((*CrownJewelDelete)(nil), "events.CrownJewelDelete")
-	proto.RegisterType((*UserTaskCreate)(nil), "events.UserTaskCreate")
-	proto.RegisterType((*UserTaskUpdate)(nil), "events.UserTaskUpdate")
-	proto.RegisterType((*UserTaskMetadata)(nil), "events.UserTaskMetadata")
-	proto.RegisterType((*UserTaskDelete)(nil), "events.UserTaskDelete")
-	proto.RegisterType((*ContactCreate)(nil), "events.ContactCreate")
-	proto.RegisterType((*ContactDelete)(nil), "events.ContactDelete")
-	proto.RegisterType((*WorkloadIdentityCreate)(nil), "events.WorkloadIdentityCreate")
-	proto.RegisterType((*WorkloadIdentityUpdate)(nil), "events.WorkloadIdentityUpdate")
-	proto.RegisterType((*WorkloadIdentityDelete)(nil), "events.WorkloadIdentityDelete")
-	proto.RegisterType((*WorkloadIdentityX509RevocationCreate)(nil), "events.WorkloadIdentityX509RevocationCreate")
-	proto.RegisterType((*WorkloadIdentityX509RevocationUpdate)(nil), "events.WorkloadIdentityX509RevocationUpdate")
-	proto.RegisterType((*WorkloadIdentityX509RevocationDelete)(nil), "events.WorkloadIdentityX509RevocationDelete")
-	proto.RegisterType((*GitCommand)(nil), "events.GitCommand")
-	proto.RegisterType((*GitCommandAction)(nil), "events.GitCommandAction")
-	proto.RegisterType((*AccessListInvalidMetadata)(nil), "events.AccessListInvalidMetadata")
-	proto.RegisterType((*UserLoginAccessListInvalid)(nil), "events.UserLoginAccessListInvalid")
-	proto.RegisterType((*StableUNIXUserCreate)(nil), "events.StableUNIXUserCreate")
-	proto.RegisterType((*StableUNIXUser)(nil), "events.StableUNIXUser")
-	proto.RegisterType((*AWSICResourceSync)(nil), "events.AWSICResourceSync")
-	proto.RegisterType((*HealthCheckConfigCreate)(nil), "events.HealthCheckConfigCreate")
-	proto.RegisterType((*HealthCheckConfigUpdate)(nil), "events.HealthCheckConfigUpdate")
-	proto.RegisterType((*HealthCheckConfigDelete)(nil), "events.HealthCheckConfigDelete")
-	proto.RegisterType((*WorkloadIdentityX509IssuerOverrideCreate)(nil), "events.WorkloadIdentityX509IssuerOverrideCreate")
-	proto.RegisterType((*WorkloadIdentityX509IssuerOverrideDelete)(nil), "events.WorkloadIdentityX509IssuerOverrideDelete")
-	proto.RegisterType((*SigstorePolicyCreate)(nil), "events.SigstorePolicyCreate")
-	proto.RegisterType((*SigstorePolicyUpdate)(nil), "events.SigstorePolicyUpdate")
-	proto.RegisterType((*SigstorePolicyDelete)(nil), "events.SigstorePolicyDelete")
+// MCPSessionStart is emitted when a user starts a MCP session.
+type MCPSessionStart struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=User,proto3,embedded=User" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=Session,proto3,embedded=Session" json:""`
+	// ServerMetadata is a common server metadata
+	ServerMetadata `protobuf:"bytes,4,opt,name=Server,proto3,embedded=Server" json:""`
+	// ConnectionMetadata holds information about the connection
+	ConnectionMetadata `protobuf:"bytes,5,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,6,opt,name=App,proto3,embedded=App" json:""`
+	// McpSessionId is the session ID tracked by remote MCP servers.
+	McpSessionId string `protobuf:"bytes,7,opt,name=mcp_session_id,json=mcpSessionId,proto3" json:"mcp_session_id,omitempty"`
+	// ClientInfo stores reported client agent information, e.g. "claude-ai/0.1.0".
+	ClientInfo string `protobuf:"bytes,8,opt,name=client_info,json=clientInfo,proto3" json:"client_info,omitempty"`
+	// ServerInfo stores reported MCP server information, e.g. "teleport-mcp-demo/18.3.0".
+	ServerInfo string `protobuf:"bytes,9,opt,name=server_info,json=serverInfo,proto3" json:"server_info,omitempty"`
+	// ProtocolVersion is the MCP protocol version like "2025-06-18".
+	ProtocolVersion string `protobuf:"bytes,10,opt,name=protocol_version,json=protocolVersion,proto3" json:"protocol_version,omitempty"`
+	// IngressAuthType indicates how the MCP session is authorized between MCP client and Teleport.
+	IngressAuthType string `protobuf:"bytes,11,opt,name=ingress_auth_type,json=ingressAuthType,proto3" json:"ingress_auth_type,omitempty"`
+	// EgressAuthType indicates how the MCP session is authorized between Teleport and remote MCP server.
+	EgressAuthType       string   `protobuf:"bytes,12,opt,name=egress_auth_type,json=egressAuthType,proto3" json:"egress_auth_type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func init() {
-	proto.RegisterFile("teleport/legacy/types/events/events.proto", fileDescriptor_007ba1c3d6266d56)
+func (m *MCPSessionStart) Reset()         { *m = MCPSessionStart{} }
+func (m *MCPSessionStart) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionStart) ProtoMessage()    {}
+func (*MCPSessionStart) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{267}
+}
+func (m *MCPSessionStart) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionStart) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionStart.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *MCPSessionStart) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionStart.Merge(m, src)
+}
+func (m *MCPSessionStart) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionStart) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionStart.DiscardUnknown(m)
 }
 
-var fileDescriptor_007ba1c3d6266d56 = []byte{
-	// 18789 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xfd, 0x7b, 0x78, 0x25, 0xc9,
-	0x75, 0x18, 0x86, 0xe3, 0x3e, 0x70, 0x01, 0x1c, 0x3c, 0xe6, 0x4e, 0xcd, 0xab, 0x67, 0x76, 0x76,
-	0xef, 0x6e, 0xef, 0x72, 0x38, 0xb3, 0xdc, 0x9d, 0xd9, 0x9d, 0x7d, 0x90, 0xfb, 0x20, 0x97, 0x17,
-	0xb8, 0xc0, 0xe0, 0xce, 0xe0, 0xc5, 0xbe, 0x98, 0x99, 0x5d, 0x52, 0xe4, 0x55, 0xe3, 0x76, 0x0d,
-	0xd0, 0x8b, 0x8b, 0xee, 0xcb, 0xee, 0xbe, 0x83, 0xc1, 0xfa, 0xf7, 0x4b, 0x44, 0x59, 0x96, 0x44,
-	0x9b, 0xa2, 0x18, 0x2a, 0x12, 0x65, 0xc9, 0x4e, 0x28, 0x3b, 0x4e, 0x64, 0x89, 0x16, 0x23, 0x87,
-	0xd1, 0x9b, 0xb6, 0x64, 0xf9, 0x41, 0x89, 0x92, 0x22, 0xc9, 0x96, 0xe2, 0x2f, 0x71, 0x20, 0x47,
-	0x89, 0xff, 0xc1, 0x97, 0xe4, 0xd3, 0x97, 0xe8, 0x8b, 0x19, 0x27, 0xce, 0x97, 0xaf, 0x4e, 0x55,
-	0x77, 0x57, 0xbf, 0x2e, 0x9e, 0x2b, 0x2c, 0x76, 0xf0, 0xcf, 0x0c, 0xee, 0x39, 0xa7, 0x4e, 0x55,
-	0x9f, 0x3a, 0x55, 0x75, 0xaa, 0xea, 0xd4, 0x39, 0x70, 0xc5, 0xa3, 0x6d, 0xda, 0xb1, 0x1d, 0xef,
-	0x5a, 0x9b, 0x2e, 0xeb, 0xad, 0x8d, 0x6b, 0xde, 0x46, 0x87, 0xba, 0xd7, 0xe8, 0x7d, 0x6a, 0x79,
-	0xfe, 0x7f, 0x57, 0x3b, 0x8e, 0xed, 0xd9, 0xa4, 0xc4, 0x7f, 0x5d, 0x38, 0xbd, 0x6c, 0x2f, 0xdb,
-	0x08, 0xba, 0xc6, 0xfe, 0xe2, 0xd8, 0x0b, 0x17, 0x97, 0x6d, 0x7b, 0xb9, 0x4d, 0xaf, 0xe1, 0xaf,
-	0xa5, 0xee, 0xbd, 0x6b, 0xae, 0xe7, 0x74, 0x5b, 0x9e, 0xc0, 0x56, 0xe2, 0x58, 0xcf, 0x5c, 0xa3,
-	0xae, 0xa7, 0xaf, 0x75, 0x04, 0xc1, 0x63, 0x71, 0x82, 0x75, 0x47, 0xef, 0x74, 0xa8, 0x23, 0x2a,
-	0xbf, 0xf0, 0xc1, 0xa0, 0x9d, 0x7a, 0xab, 0x45, 0x5d, 0xb7, 0x6d, 0xba, 0xde, 0xb5, 0xfb, 0xcf,
-	0x4b, 0xbf, 0x04, 0xe1, 0x13, 0xe9, 0x1f, 0x84, 0xff, 0x0a, 0x92, 0x67, 0xd3, 0x49, 0xfc, 0x1a,
-	0x63, 0x55, 0xab, 0x5f, 0xce, 0xc3, 0xe0, 0x2c, 0xf5, 0x74, 0x43, 0xf7, 0x74, 0x72, 0x11, 0xfa,
-	0xeb, 0x96, 0x41, 0x1f, 0x28, 0xb9, 0xc7, 0x73, 0x97, 0x0b, 0xe3, 0xa5, 0xad, 0xcd, 0x4a, 0x9e,
-	0x9a, 0x1a, 0x07, 0x92, 0x47, 0xa1, 0xb8, 0xb8, 0xd1, 0xa1, 0x4a, 0xfe, 0xf1, 0xdc, 0xe5, 0xa1,
-	0xf1, 0xa1, 0xad, 0xcd, 0x4a, 0x3f, 0x0a, 0x4d, 0x43, 0x30, 0x79, 0x02, 0xf2, 0xf5, 0x9a, 0x52,
-	0x40, 0xe4, 0xc9, 0xad, 0xcd, 0xca, 0x68, 0xd7, 0x34, 0x9e, 0xb1, 0xd7, 0x4c, 0x8f, 0xae, 0x75,
-	0xbc, 0x0d, 0x2d, 0x5f, 0xaf, 0x91, 0x4b, 0x50, 0x9c, 0xb0, 0x0d, 0xaa, 0x14, 0x91, 0x88, 0x6c,
-	0x6d, 0x56, 0xc6, 0x5a, 0xb6, 0x41, 0x25, 0x2a, 0xc4, 0x93, 0x8f, 0x43, 0x71, 0xd1, 0x5c, 0xa3,
-	0x4a, 0xff, 0xe3, 0xb9, 0xcb, 0xc3, 0xd7, 0x2f, 0x5c, 0xe5, 0xe2, 0xbb, 0xea, 0x8b, 0xef, 0xea,
-	0xa2, 0x2f, 0xdf, 0xf1, 0xf2, 0xb7, 0x36, 0x2b, 0x7d, 0x5b, 0x9b, 0x95, 0x22, 0x13, 0xf9, 0x97,
-	0xfe, 0xa4, 0x92, 0xd3, 0xb0, 0x24, 0x79, 0x1d, 0x86, 0x27, 0xda, 0x5d, 0xd7, 0xa3, 0xce, 0x9c,
-	0xbe, 0x46, 0x95, 0x12, 0x56, 0x78, 0x61, 0x6b, 0xb3, 0x72, 0xb6, 0xc5, 0xc1, 0x4d, 0x4b, 0x5f,
-	0x93, 0x2b, 0x96, 0xc9, 0xd5, 0x5f, 0xca, 0xc1, 0x89, 0x06, 0x75, 0x5d, 0xd3, 0xb6, 0x02, 0xd9,
-	0x7c, 0x00, 0x86, 0x04, 0xa8, 0x5e, 0x43, 0xf9, 0x0c, 0x8d, 0x0f, 0x6c, 0x6d, 0x56, 0x0a, 0xae,
-	0x69, 0x68, 0x21, 0x86, 0x3c, 0x07, 0x03, 0x77, 0x4d, 0x6f, 0x65, 0x76, 0xaa, 0x2a, 0xe4, 0x74,
-	0x76, 0x6b, 0xb3, 0x42, 0xd6, 0x4d, 0x6f, 0xa5, 0xb9, 0x76, 0x4f, 0x97, 0x2a, 0xf4, 0xc9, 0xc8,
-	0x0c, 0x94, 0x17, 0x1c, 0xf3, 0xbe, 0xee, 0xd1, 0x5b, 0x74, 0x63, 0xc1, 0x6e, 0x9b, 0xad, 0x0d,
-	0x21, 0xc5, 0xc7, 0xb7, 0x36, 0x2b, 0x17, 0x3b, 0x1c, 0xd7, 0x5c, 0xa5, 0x1b, 0xcd, 0x0e, 0x62,
-	0x25, 0x26, 0x89, 0x92, 0xea, 0xe7, 0x07, 0x60, 0xe4, 0xb6, 0x4b, 0x9d, 0xa0, 0xdd, 0x97, 0xa0,
-	0xc8, 0x7e, 0x8b, 0x26, 0xa3, 0xcc, 0xbb, 0x2e, 0x75, 0x64, 0x99, 0x33, 0x3c, 0xb9, 0x02, 0xfd,
-	0x33, 0xf6, 0xb2, 0x69, 0x89, 0x66, 0x9f, 0xda, 0xda, 0xac, 0x9c, 0x68, 0x33, 0x80, 0x44, 0xc9,
-	0x29, 0xc8, 0xc7, 0x60, 0xa4, 0xbe, 0xc6, 0x74, 0xc8, 0xb6, 0x74, 0xcf, 0x76, 0x44, 0x6b, 0x51,
-	0xba, 0xa6, 0x04, 0x97, 0x0a, 0x46, 0xe8, 0xc9, 0xab, 0x00, 0xd5, 0xbb, 0x0d, 0xcd, 0x6e, 0xd3,
-	0xaa, 0x36, 0x27, 0x94, 0x01, 0x4b, 0xeb, 0xeb, 0x6e, 0xd3, 0xb1, 0xdb, 0xb4, 0xa9, 0x3b, 0x72,
-	0xb5, 0x12, 0x35, 0x99, 0x84, 0xb1, 0x2a, 0x8e, 0x0a, 0x8d, 0x7e, 0xb6, 0x4b, 0x5d, 0xcf, 0x55,
-	0xfa, 0x1f, 0x2f, 0x5c, 0x1e, 0x1a, 0x7f, 0x74, 0x6b, 0xb3, 0x72, 0x9e, 0x8f, 0x97, 0xa6, 0x23,
-	0x50, 0x12, 0x8b, 0x58, 0x21, 0x32, 0x0e, 0xa3, 0xd5, 0x77, 0xba, 0x0e, 0xad, 0x1b, 0xd4, 0xf2,
-	0x4c, 0x6f, 0x43, 0x68, 0xc8, 0xc5, 0xad, 0xcd, 0x8a, 0xa2, 0x33, 0x44, 0xd3, 0x14, 0x18, 0x89,
-	0x49, 0xb4, 0x08, 0x99, 0x87, 0x93, 0x37, 0x26, 0x16, 0x1a, 0xd4, 0xb9, 0x6f, 0xb6, 0x68, 0xb5,
-	0xd5, 0xb2, 0xbb, 0x96, 0xa7, 0x0c, 0x20, 0x9f, 0x27, 0xb6, 0x36, 0x2b, 0x8f, 0x2e, 0xb7, 0x3a,
-	0x4d, 0x97, 0x63, 0x9b, 0x3a, 0x47, 0x4b, 0xcc, 0x92, 0x65, 0xc9, 0x27, 0x61, 0x74, 0xd1, 0x61,
-	0x5a, 0x68, 0xd4, 0x28, 0x83, 0x2b, 0x83, 0xa8, 0xff, 0x67, 0xaf, 0x8a, 0x99, 0x8a, 0x43, 0xfd,
-	0x9e, 0xe5, 0x8d, 0xf5, 0x78, 0x81, 0xa6, 0x81, 0x38, 0xb9, 0xb1, 0x11, 0x56, 0x84, 0x82, 0xc2,
-	0x3e, 0xde, 0x74, 0xa8, 0x91, 0xd0, 0xb6, 0x21, 0x6c, 0xf3, 0x95, 0xad, 0xcd, 0xca, 0x07, 0x1c,
-	0x41, 0xd3, 0xec, 0xa9, 0x76, 0x99, 0xac, 0xc8, 0x24, 0x0c, 0x32, 0x6d, 0xba, 0x65, 0x5a, 0x86,
-	0x02, 0x8f, 0xe7, 0x2e, 0x8f, 0x5d, 0x2f, 0xfb, 0xad, 0xf7, 0xe1, 0xe3, 0xe7, 0xb6, 0x36, 0x2b,
-	0xa7, 0x98, 0x0e, 0x36, 0x57, 0x4d, 0x4b, 0x9e, 0x22, 0x82, 0xa2, 0x6c, 0x14, 0x8d, 0xdb, 0x1e,
-	0x0e, 0xdd, 0xe1, 0x70, 0x14, 0x2d, 0xd9, 0x5e, 0x7c, 0xd8, 0xfa, 0x64, 0x64, 0x02, 0x46, 0xc7,
-	0x6d, 0xaf, 0x6e, 0xb9, 0x9e, 0x6e, 0xb5, 0x68, 0xbd, 0xa6, 0x8c, 0x60, 0x39, 0x54, 0x0b, 0x56,
-	0xce, 0x14, 0x98, 0x66, 0x64, 0x52, 0x8a, 0x96, 0x21, 0xb3, 0x00, 0xac, 0x09, 0xf3, 0x8e, 0xc9,
-	0x06, 0xc2, 0x28, 0xb6, 0x9f, 0xc8, 0xed, 0xe7, 0x98, 0xf1, 0xf3, 0x5b, 0x9b, 0x95, 0x33, 0xf8,
-	0x05, 0x36, 0x02, 0x64, 0x5d, 0x0d, 0xc9, 0xd4, 0x7f, 0x5b, 0x84, 0x31, 0xd6, 0xc5, 0xd2, 0x68,
-	0xac, 0xb2, 0x89, 0x85, 0x41, 0x58, 0xa3, 0xdd, 0x8e, 0xde, 0xa2, 0x62, 0x60, 0xa2, 0x50, 0x2c,
-	0x1f, 0x28, 0x31, 0x8c, 0xd3, 0x93, 0x2b, 0x30, 0xc8, 0x41, 0xf5, 0x9a, 0x18, 0xab, 0xa3, 0x5b,
-	0x9b, 0x95, 0x21, 0x17, 0x61, 0x4d, 0xd3, 0xd0, 0x02, 0x34, 0x1b, 0x2c, 0xfc, 0xef, 0x69, 0xdb,
-	0xf5, 0x18, 0x73, 0x31, 0x54, 0x51, 0x2a, 0xa2, 0xc0, 0x8a, 0x40, 0xc9, 0x83, 0x25, 0x5a, 0x88,
-	0xbc, 0x02, 0xc0, 0x21, 0x55, 0xc3, 0x70, 0xc4, 0x78, 0x45, 0x11, 0x08, 0x16, 0xba, 0x61, 0xc8,
-	0x83, 0x5d, 0x22, 0x26, 0x6b, 0x30, 0xc2, 0x7f, 0xcd, 0xe8, 0x4b, 0xb4, 0xcd, 0x07, 0xeb, 0xf0,
-	0xf5, 0xcb, 0xbe, 0x4c, 0xa3, 0xd2, 0xb9, 0x2a, 0x93, 0x4e, 0x5a, 0x9e, 0xb3, 0x31, 0x5e, 0x11,
-	0xf3, 0xfb, 0x39, 0x51, 0x55, 0x1b, 0x71, 0xf2, 0xcc, 0x22, 0x97, 0x61, 0xd3, 0xfe, 0x94, 0xed,
-	0xac, 0xeb, 0x8e, 0x41, 0x8d, 0xf1, 0x0d, 0x79, 0xda, 0xbf, 0xe7, 0x83, 0x9b, 0x4b, 0xb2, 0x26,
-	0xcb, 0xe4, 0x4c, 0x87, 0x38, 0xb7, 0x46, 0x77, 0x09, 0x35, 0x78, 0x20, 0x21, 0x2d, 0xb7, 0xbb,
-	0x14, 0xd7, 0xda, 0x68, 0x19, 0x36, 0xb3, 0x70, 0xc0, 0x1d, 0xea, 0xb0, 0x35, 0x01, 0x07, 0xb1,
-	0x98, 0x59, 0x04, 0x93, 0xfb, 0x1c, 0x93, 0xe4, 0x21, 0x8a, 0x5c, 0x78, 0x03, 0x4e, 0x26, 0x44,
-	0x41, 0xca, 0x50, 0x58, 0xa5, 0x1b, 0x5c, 0x5d, 0x34, 0xf6, 0x27, 0x39, 0x0d, 0xfd, 0xf7, 0xf5,
-	0x76, 0x57, 0xac, 0xc8, 0x1a, 0xff, 0xf1, 0x6a, 0xfe, 0x23, 0x39, 0xb6, 0x80, 0x91, 0x09, 0xdb,
-	0xb2, 0x68, 0xcb, 0x93, 0xd7, 0xb0, 0x97, 0x61, 0x68, 0xc6, 0x6e, 0xe9, 0x6d, 0xec, 0x47, 0xae,
-	0x77, 0xca, 0xd6, 0x66, 0xe5, 0x34, 0xeb, 0xc0, 0xab, 0x6d, 0x86, 0x91, 0xda, 0x14, 0x92, 0x32,
-	0x05, 0xd0, 0xe8, 0x9a, 0xed, 0x51, 0x2c, 0x98, 0x0f, 0x15, 0x00, 0x0b, 0x3a, 0x88, 0x92, 0x15,
-	0x20, 0x24, 0x26, 0xd7, 0x60, 0x70, 0x81, 0x2d, 0xdb, 0x2d, 0xbb, 0x2d, 0x94, 0x0f, 0x57, 0x16,
-	0x5c, 0xca, 0xe5, 0xa1, 0xef, 0x13, 0xa9, 0xd3, 0x30, 0x36, 0xd1, 0x36, 0xa9, 0xe5, 0xc9, 0xad,
-	0x66, 0x83, 0xaa, 0xba, 0x4c, 0x2d, 0x4f, 0x6e, 0x35, 0x0e, 0x40, 0x9d, 0x41, 0xe5, 0x56, 0x07,
-	0xa4, 0xea, 0xef, 0x15, 0xe0, 0xfc, 0xad, 0xee, 0x12, 0x75, 0x2c, 0xea, 0x51, 0x57, 0xac, 0xef,
-	0x01, 0xd7, 0x39, 0x38, 0x99, 0x40, 0x0a, 0xee, 0xb8, 0xee, 0xae, 0x06, 0xc8, 0xa6, 0x30, 0x19,
-	0xe4, 0xc9, 0x3b, 0x51, 0x94, 0x4c, 0xc3, 0x89, 0x10, 0xc8, 0x1a, 0xe1, 0x2a, 0x79, 0x5c, 0x99,
-	0x1e, 0xdb, 0xda, 0xac, 0x5c, 0x90, 0xb8, 0xb1, 0x66, 0xcb, 0x1a, 0x1c, 0x2f, 0x46, 0x6e, 0x41,
-	0x39, 0x04, 0xdd, 0x70, 0xec, 0x6e, 0xc7, 0x55, 0x0a, 0xc8, 0xaa, 0xb2, 0xb5, 0x59, 0x79, 0x44,
-	0x62, 0xb5, 0x8c, 0x48, 0xd9, 0x1e, 0x88, 0x17, 0x24, 0xdf, 0x97, 0x93, 0xb9, 0x89, 0x51, 0x58,
-	0xc4, 0x51, 0xf8, 0x61, 0x7f, 0x14, 0x66, 0x0a, 0xe9, 0x6a, 0xbc, 0xa4, 0x18, 0x94, 0xb1, 0x66,
-	0x24, 0x06, 0x65, 0xa2, 0xc6, 0x0b, 0x13, 0x70, 0x26, 0x95, 0xd7, 0xae, 0xb4, 0xfa, 0xdf, 0x14,
-	0x64, 0x2e, 0x0b, 0xb6, 0x11, 0x74, 0xe6, 0xbc, 0xdc, 0x99, 0x0b, 0xb6, 0x81, 0x2b, 0x47, 0x2e,
-	0x5c, 0x8a, 0xa5, 0xc6, 0x76, 0x6c, 0x23, 0xbe, 0x88, 0x24, 0xcb, 0x92, 0xcf, 0xc0, 0xd9, 0x04,
-	0x90, 0x4f, 0xd7, 0x5c, 0xfb, 0x2f, 0x6d, 0x6d, 0x56, 0xd4, 0x14, 0xae, 0xf1, 0xd9, 0x3b, 0x83,
-	0x0b, 0xd1, 0xe1, 0x9c, 0x24, 0x75, 0xdb, 0xf2, 0x74, 0xd3, 0x12, 0xb6, 0x2a, 0x1f, 0x25, 0x1f,
-	0xdc, 0xda, 0xac, 0x3c, 0x29, 0xeb, 0xa0, 0x4f, 0x13, 0x6f, 0x7c, 0x16, 0x1f, 0x62, 0x80, 0x92,
-	0x82, 0xaa, 0xaf, 0xe9, 0xcb, 0xbe, 0x01, 0x7e, 0x79, 0x6b, 0xb3, 0xf2, 0x54, 0x6a, 0x1d, 0x26,
-	0xa3, 0x92, 0x17, 0xfc, 0x2c, 0x4e, 0x44, 0x03, 0x12, 0xe2, 0xe6, 0x6c, 0x83, 0xe2, 0x37, 0xf4,
-	0x23, 0x7f, 0x75, 0x6b, 0xb3, 0xf2, 0x98, 0xc4, 0xdf, 0xb2, 0x0d, 0x1a, 0x6f, 0x7e, 0x4a, 0x69,
-	0xf5, 0x97, 0x0a, 0xf0, 0x58, 0xa3, 0x3a, 0x3b, 0x53, 0x37, 0x7c, 0x0b, 0x69, 0xc1, 0xb1, 0xef,
-	0x9b, 0x86, 0x34, 0x7a, 0x97, 0xe0, 0x5c, 0x0c, 0x35, 0x89, 0x46, 0x59, 0x60, 0x9b, 0xe3, 0xb7,
-	0xf9, 0xd6, 0x57, 0x47, 0xd0, 0x34, 0xb9, 0xe5, 0x16, 0xb5, 0x01, 0xb2, 0x18, 0xb1, 0x3e, 0x8a,
-	0xa1, 0x1a, 0x2b, 0xb6, 0xe3, 0xb5, 0xba, 0x9e, 0x50, 0x02, 0xec, 0xa3, 0x44, 0x1d, 0xae, 0x20,
-	0xea, 0x51, 0x85, 0xcf, 0x87, 0x7c, 0x3e, 0x07, 0xe5, 0xaa, 0xe7, 0x39, 0xe6, 0x52, 0xd7, 0xa3,
-	0xb3, 0x7a, 0xa7, 0x63, 0x5a, 0xcb, 0x38, 0xd6, 0x87, 0xaf, 0xbf, 0x1e, 0xac, 0x91, 0x3d, 0x25,
-	0x71, 0x35, 0x5e, 0x5c, 0x1a, 0xa2, 0xba, 0x8f, 0x6a, 0xae, 0x71, 0x9c, 0x3c, 0x44, 0xe3, 0xe5,
-	0xd8, 0x10, 0x4d, 0xe5, 0xb5, 0xab, 0x21, 0xfa, 0xe5, 0x02, 0x5c, 0x9c, 0x5f, 0xf5, 0x74, 0x8d,
-	0xba, 0x76, 0xd7, 0x69, 0x51, 0xf7, 0x76, 0xc7, 0xd0, 0x3d, 0x1a, 0x8e, 0xd4, 0x0a, 0xf4, 0x57,
-	0x0d, 0x83, 0x1a, 0xc8, 0xae, 0x9f, 0xef, 0x22, 0x75, 0x06, 0xd0, 0x38, 0x9c, 0x7c, 0x00, 0x06,
-	0x44, 0x19, 0xe4, 0xde, 0x3f, 0x3e, 0xbc, 0xb5, 0x59, 0x19, 0xe8, 0x72, 0x90, 0xe6, 0xe3, 0x18,
-	0x59, 0x8d, 0xb6, 0x29, 0x23, 0x2b, 0x84, 0x64, 0x06, 0x07, 0x69, 0x3e, 0x8e, 0x7c, 0x02, 0xc6,
-	0x90, 0x6d, 0xd0, 0x1e, 0x31, 0xf7, 0x9d, 0xf6, 0xa5, 0x2b, 0x37, 0x96, 0x2f, 0x4d, 0xd8, 0x9a,
-	0xa6, 0xe3, 0x17, 0xd0, 0x62, 0x0c, 0xc8, 0x5d, 0x28, 0x8b, 0x46, 0x84, 0x4c, 0xfb, 0x7b, 0x30,
-	0x3d, 0xb3, 0xb5, 0x59, 0x39, 0x29, 0xda, 0x2f, 0xb1, 0x4d, 0x30, 0x61, 0x8c, 0x45, 0xb3, 0x43,
-	0xc6, 0xa5, 0xed, 0x18, 0x8b, 0x2f, 0x96, 0x19, 0xc7, 0x99, 0xa8, 0x6f, 0xc1, 0x88, 0x5c, 0x90,
-	0x9c, 0xc5, 0x9d, 0x3a, 0x1f, 0x27, 0xb8, 0xc7, 0x37, 0x0d, 0xdc, 0x9e, 0x3f, 0x0f, 0xc3, 0x35,
-	0xea, 0xb6, 0x1c, 0xb3, 0xc3, 0xac, 0x06, 0xa1, 0xe4, 0x27, 0xb6, 0x36, 0x2b, 0xc3, 0x46, 0x08,
-	0xd6, 0x64, 0x1a, 0xf5, 0xff, 0xcc, 0xc1, 0x59, 0xc6, 0xbb, 0xea, 0xba, 0xe6, 0xb2, 0xb5, 0x26,
-	0x2f, 0xdb, 0xcf, 0x40, 0xa9, 0x81, 0xf5, 0x89, 0x9a, 0x4e, 0x6f, 0x6d, 0x56, 0xca, 0xbc, 0x05,
-	0x92, 0x1e, 0x0a, 0x9a, 0x60, 0x9b, 0x9a, 0xdf, 0x66, 0x9b, 0xca, 0x4c, 0x5a, 0x4f, 0x77, 0x3c,
-	0xd3, 0x5a, 0x6e, 0x78, 0xba, 0xd7, 0x75, 0x23, 0x26, 0xad, 0xc0, 0x34, 0x5d, 0x44, 0x45, 0x4c,
-	0xda, 0x48, 0x21, 0xf2, 0x06, 0x8c, 0x4c, 0x5a, 0x46, 0xc8, 0x84, 0x4f, 0x88, 0x8f, 0x30, 0x4b,
-	0x93, 0x22, 0x3c, 0xc9, 0x22, 0x52, 0x40, 0xfd, 0x4e, 0x0e, 0x14, 0xbe, 0xa7, 0x9c, 0x31, 0x5d,
-	0x6f, 0x96, 0xae, 0x2d, 0x49, 0xb3, 0xd3, 0x94, 0xbf, 0x49, 0x65, 0x38, 0x69, 0x2d, 0x42, 0x53,
-	0x40, 0x6c, 0x52, 0xdb, 0xa6, 0x9b, 0xd8, 0xcd, 0xc4, 0x4a, 0x91, 0x3a, 0x0c, 0x70, 0xce, 0xdc,
-	0x96, 0x18, 0xbe, 0xae, 0xf8, 0x8a, 0x10, 0xaf, 0x9a, 0x2b, 0xc3, 0x1a, 0x27, 0x96, 0xf7, 0x47,
-	0xa2, 0x3c, 0xa9, 0xc3, 0x89, 0xb0, 0xcc, 0xa2, 0xe9, 0xb5, 0xfd, 0x45, 0x80, 0xcf, 0x14, 0x52,
-	0x9b, 0x3c, 0x86, 0x94, 0xed, 0x93, 0x58, 0x39, 0xf5, 0xab, 0x05, 0x28, 0xc7, 0xeb, 0x27, 0x77,
-	0x61, 0xf0, 0xa6, 0x6d, 0x5a, 0xd4, 0x98, 0xb7, 0xf0, 0x63, 0x7b, 0x1f, 0xdb, 0xf8, 0x66, 0xfd,
-	0xa9, 0xb7, 0xb1, 0x4c, 0x53, 0x36, 0x86, 0xf1, 0x14, 0x27, 0x60, 0x46, 0x3e, 0x09, 0x43, 0xcc,
-	0x9c, 0xbc, 0x8f, 0x9c, 0xf3, 0xdb, 0x72, 0x7e, 0x5c, 0x70, 0x3e, 0xed, 0xf0, 0x42, 0x49, 0xd6,
-	0x21, 0x3b, 0xa6, 0xa2, 0x1a, 0xd5, 0x5d, 0xdb, 0x12, 0x4a, 0x84, 0x2a, 0xea, 0x20, 0x44, 0x56,
-	0x51, 0x4e, 0xc3, 0xac, 0x60, 0xfe, 0xb1, 0xd8, 0xa3, 0xd2, 0x36, 0x88, 0x8b, 0x3d, 0xde, 0x99,
-	0x12, 0x31, 0xb1, 0xe0, 0x84, 0xe8, 0x9b, 0x15, 0xb3, 0x83, 0x1b, 0x08, 0x5c, 0x22, 0xc7, 0xae,
-	0x5f, 0xba, 0xea, 0x1f, 0xd7, 0x5d, 0x95, 0x0e, 0xfb, 0xee, 0x3f, 0x7f, 0x75, 0x36, 0x20, 0xc7,
-	0x3d, 0x33, 0xaa, 0x77, 0x8c, 0x85, 0xac, 0x38, 0x6b, 0x11, 0x72, 0xf5, 0xfb, 0xf3, 0xf0, 0x6c,
-	0xd8, 0x45, 0x1a, 0xbd, 0x6f, 0xd2, 0xf5, 0x90, 0xa3, 0xd8, 0xbd, 0xb3, 0xd1, 0xea, 0x4e, 0xac,
-	0xe8, 0xd6, 0x32, 0x35, 0xc8, 0x15, 0xe8, 0xd7, 0xec, 0x36, 0x75, 0x95, 0x1c, 0x5a, 0x9a, 0x38,
-	0x13, 0x3a, 0x0c, 0x20, 0x1f, 0xff, 0x20, 0x05, 0xb1, 0xa1, 0xb4, 0xe8, 0xe8, 0xa6, 0xe7, 0x2b,
-	0x65, 0x35, 0xa9, 0x94, 0x3b, 0xa8, 0xf1, 0x2a, 0xe7, 0xc1, 0x97, 0x2b, 0x14, 0xbc, 0x87, 0x00,
-	0x59, 0xf0, 0x9c, 0xe4, 0xc2, 0x2b, 0x30, 0x2c, 0x11, 0xef, 0x6a, 0x3d, 0xfa, 0xbe, 0x7e, 0x79,
-	0x98, 0xfa, 0xcd, 0x12, 0xc3, 0xf4, 0x1a, 0x1b, 0x5e, 0xae, 0xcb, 0x0c, 0x22, 0x3e, 0x3e, 0xc5,
-	0x20, 0x42, 0x50, 0x74, 0x10, 0x21, 0x88, 0xbc, 0x00, 0x83, 0x9c, 0x45, 0xb0, 0xf5, 0xc6, 0x6d,
-	0xbb, 0x83, 0xb0, 0xa8, 0x55, 0x11, 0x10, 0x92, 0x9f, 0xc9, 0xc1, 0xa3, 0x3d, 0x25, 0x81, 0xca,
-	0x37, 0x7c, 0xfd, 0xa5, 0x3d, 0x89, 0x71, 0xfc, 0xd9, 0xad, 0xcd, 0xca, 0x15, 0x49, 0x33, 0x1c,
-	0x89, 0xa6, 0xd9, 0xe2, 0x44, 0x52, 0xbb, 0x7a, 0x37, 0x85, 0xd9, 0xbd, 0xbc, 0xd2, 0x29, 0x3c,
-	0x44, 0xb3, 0x5a, 0x1b, 0x7e, 0x23, 0x8b, 0xa1, 0xdd, 0x2b, 0xbe, 0xf7, 0x9e, 0x4f, 0x92, 0x52,
-	0x4d, 0x06, 0x17, 0xd2, 0x82, 0x73, 0x1c, 0x53, 0xd3, 0x37, 0xe6, 0xef, 0xcd, 0xda, 0x96, 0xb7,
-	0xe2, 0x57, 0xd0, 0x2f, 0x9f, 0x42, 0x61, 0x05, 0x86, 0xbe, 0xd1, 0xb4, 0xef, 0x35, 0xd7, 0x18,
-	0x55, 0x4a, 0x1d, 0x59, 0x9c, 0xd8, 0x1a, 0x21, 0xc6, 0xb8, 0x3f, 0x7b, 0x96, 0xc2, 0x33, 0x42,
-	0x7f, 0x5e, 0x48, 0xce, 0x95, 0xb1, 0x42, 0x69, 0x53, 0xe6, 0xc0, 0x1e, 0xa7, 0xcc, 0x3a, 0x8c,
-	0xcc, 0xd8, 0xad, 0xd5, 0x40, 0xf3, 0x5e, 0x81, 0xd2, 0xa2, 0xee, 0x2c, 0x53, 0x0f, 0xc5, 0x3a,
-	0x7c, 0xfd, 0xe4, 0x55, 0x7e, 0x84, 0xcf, 0x88, 0x38, 0x62, 0x7c, 0x4c, 0x4c, 0x64, 0x25, 0x0f,
-	0x7f, 0x6b, 0xa2, 0x80, 0xfa, 0x0f, 0x4a, 0x30, 0x22, 0x8e, 0x9b, 0x71, 0x4d, 0x23, 0xaf, 0x86,
-	0x07, 0xf8, 0x62, 0xe6, 0x0d, 0x8e, 0xdc, 0x82, 0xa3, 0xc2, 0x11, 0xc6, 0xec, 0xf7, 0x37, 0x2b,
-	0xb9, 0xad, 0xcd, 0x4a, 0x9f, 0x36, 0x28, 0x6d, 0xad, 0xc3, 0x55, 0x57, 0x32, 0x33, 0xe4, 0x03,
-	0xe4, 0x58, 0x59, 0xbe, 0x0a, 0xbf, 0x01, 0x03, 0xa2, 0x0d, 0x42, 0x79, 0xcf, 0x85, 0x27, 0x3a,
-	0x91, 0x63, 0xf3, 0x58, 0x69, 0xbf, 0x14, 0x79, 0x1d, 0x4a, 0xfc, 0x84, 0x43, 0x08, 0xe0, 0x6c,
-	0xfa, 0x89, 0x50, 0xac, 0xb8, 0x28, 0x43, 0xa6, 0x01, 0xc2, 0xd3, 0x8d, 0xe0, 0x96, 0x40, 0x70,
-	0x48, 0x9e, 0x7b, 0xc4, 0xb8, 0x48, 0x65, 0xc9, 0xcb, 0x30, 0xb2, 0x48, 0x9d, 0x35, 0xd3, 0xd2,
-	0xdb, 0x0d, 0xf3, 0x1d, 0xff, 0xa2, 0x00, 0xcd, 0x0f, 0xd7, 0x7c, 0x47, 0xee, 0xd3, 0x08, 0x1d,
-	0xf9, 0x74, 0xda, 0xe9, 0xc1, 0x00, 0x36, 0xe4, 0x89, 0x6d, 0xb7, 0xd5, 0xb1, 0xf6, 0xa4, 0x1c,
-	0x26, 0x7c, 0x02, 0x46, 0x23, 0x1b, 0x47, 0x71, 0x12, 0xfc, 0x68, 0x92, 0xb5, 0xb4, 0x0b, 0x8e,
-	0xb1, 0x8d, 0x72, 0x60, 0x83, 0xa2, 0x6e, 0x99, 0x9e, 0xa9, 0xb7, 0x27, 0xec, 0xb5, 0x35, 0xdd,
-	0x32, 0x94, 0xa1, 0x70, 0x50, 0x98, 0x1c, 0xd3, 0x6c, 0x71, 0x94, 0x3c, 0x28, 0xa2, 0x85, 0xc8,
-	0x2d, 0x28, 0x8b, 0x3e, 0xd4, 0x68, 0xcb, 0x76, 0x98, 0x45, 0x84, 0x07, 0xbd, 0x62, 0x54, 0xb8,
-	0x1c, 0xd7, 0x74, 0x7c, 0xa4, 0xbc, 0xe5, 0x88, 0x17, 0x64, 0x13, 0x70, 0xdd, 0xba, 0x6f, 0x32,
-	0x23, 0x7e, 0x04, 0x1b, 0x83, 0x13, 0xb0, 0xc9, 0x41, 0xf2, 0x04, 0x2c, 0xa8, 0xa4, 0x05, 0x7b,
-	0x74, 0xfb, 0x05, 0xfb, 0x66, 0x71, 0x70, 0xb8, 0x3c, 0x12, 0x3f, 0xfa, 0x57, 0xff, 0x6e, 0x01,
-	0x86, 0x45, 0x4b, 0x98, 0x91, 0x71, 0x3c, 0x7e, 0xf6, 0x33, 0x7e, 0x52, 0xc7, 0x41, 0xe9, 0xa0,
-	0xc6, 0x81, 0xfa, 0x85, 0x7c, 0x30, 0xd9, 0x2d, 0x38, 0xa6, 0xb5, 0xbf, 0xc9, 0xee, 0x12, 0xc0,
-	0xc4, 0x4a, 0xd7, 0x5a, 0xe5, 0x57, 0x9c, 0xf9, 0xf0, 0x8a, 0xb3, 0x65, 0x6a, 0x12, 0x86, 0x3c,
-	0x0a, 0xc5, 0x1a, 0xe3, 0xcf, 0x7a, 0x66, 0x64, 0x7c, 0xe8, 0x5b, 0x9c, 0x53, 0xee, 0x59, 0x0d,
-	0xc1, 0x6c, 0x07, 0x3b, 0xbe, 0xe1, 0x51, 0xbe, 0x67, 0x28, 0xf0, 0x1d, 0xec, 0x12, 0x03, 0x68,
-	0x1c, 0x4e, 0x5e, 0x84, 0x93, 0x35, 0xda, 0xd6, 0x37, 0x66, 0xcd, 0x76, 0xdb, 0x74, 0x69, 0xcb,
-	0xb6, 0x0c, 0x17, 0x85, 0x2c, 0xaa, 0x5b, 0x73, 0xb5, 0x24, 0x01, 0x51, 0xa1, 0x34, 0x7f, 0xef,
-	0x9e, 0x4b, 0x3d, 0x14, 0x5f, 0x61, 0x1c, 0xd8, 0xdc, 0x6f, 0x23, 0x44, 0x13, 0x18, 0xf5, 0xeb,
-	0x39, 0xb6, 0x45, 0x74, 0x57, 0x3d, 0xbb, 0x13, 0x0e, 0xa2, 0xfd, 0x88, 0xe4, 0x4a, 0x68, 0x01,
-	0xe5, 0xf1, 0x6b, 0x4f, 0x88, 0xaf, 0x1d, 0x10, 0x56, 0x50, 0x68, 0xfb, 0xa4, 0x7e, 0x55, 0x61,
-	0x9b, 0xaf, 0x52, 0xff, 0x2c, 0x0f, 0xe7, 0x44, 0x8b, 0x27, 0xda, 0x66, 0x67, 0xc9, 0xd6, 0x1d,
-	0x43, 0xa3, 0x2d, 0x6a, 0xde, 0xa7, 0x47, 0x73, 0xe0, 0x45, 0x87, 0x4e, 0x71, 0x1f, 0x43, 0xe7,
-	0x3a, 0xee, 0xb6, 0x99, 0x64, 0xf0, 0x54, 0x9d, 0x9b, 0x3f, 0xe5, 0xad, 0xcd, 0xca, 0x88, 0xc1,
-	0xc1, 0x78, 0xaf, 0xa2, 0xc9, 0x44, 0x4c, 0x49, 0x66, 0xa8, 0xb5, 0xec, 0xad, 0xa0, 0x92, 0xf4,
-	0x73, 0x25, 0x69, 0x23, 0x44, 0x13, 0x18, 0xf5, 0x7f, 0xcd, 0xc3, 0xe9, 0xb8, 0xc8, 0x1b, 0xd4,
-	0x32, 0x8e, 0xe5, 0xfd, 0xee, 0xc8, 0xfb, 0xcf, 0x0b, 0xf0, 0x88, 0x28, 0xd3, 0x58, 0xd1, 0x1d,
-	0x6a, 0xd4, 0x4c, 0x87, 0xb6, 0x3c, 0xdb, 0xd9, 0x38, 0xc2, 0xf6, 0xd9, 0xc1, 0x89, 0xfd, 0x45,
-	0x28, 0x89, 0x33, 0x16, 0xbe, 0xce, 0x8c, 0x05, 0x2d, 0x41, 0x68, 0x62, 0x85, 0xe2, 0xe7, 0x33,
-	0xb1, 0xce, 0x2a, 0xed, 0xa4, 0xb3, 0x3e, 0x02, 0xa3, 0x81, 0xe8, 0x71, 0x8b, 0x3e, 0x10, 0x1a,
-	0x73, 0x86, 0x8f, 0xc0, 0x5d, 0xba, 0x16, 0x25, 0xc4, 0xda, 0x7c, 0x40, 0xbd, 0x86, 0xc6, 0xd6,
-	0xa8, 0xa8, 0x2d, 0x28, 0x67, 0x1a, 0x9a, 0x4c, 0xa4, 0x6e, 0x16, 0xe1, 0x42, 0x7a, 0xb7, 0x6b,
-	0x54, 0x37, 0x8e, 0x7b, 0xfd, 0x7d, 0xd9, 0xeb, 0xe4, 0x09, 0x28, 0x2e, 0xe8, 0xde, 0x8a, 0x70,
-	0x99, 0xc0, 0x8b, 0xf7, 0x7b, 0x66, 0x9b, 0x36, 0x3b, 0xba, 0xb7, 0xa2, 0x21, 0x4a, 0x9a, 0x33,
-	0x00, 0x39, 0xa6, 0xcc, 0x19, 0xd2, 0x62, 0x3f, 0xfc, 0x78, 0xee, 0x72, 0x31, 0x75, 0xb1, 0xff,
-	0x93, 0x62, 0xd6, 0xbc, 0x72, 0xd7, 0x31, 0x3d, 0x7a, 0xac, 0x61, 0xc7, 0x1a, 0xb6, 0x4f, 0x0d,
-	0xfb, 0xc3, 0x3c, 0x8c, 0x06, 0x7b, 0xb2, 0xb7, 0x69, 0xeb, 0x70, 0xd6, 0xaa, 0x70, 0x2b, 0x53,
-	0xd8, 0xf7, 0x56, 0x66, 0x3f, 0x0a, 0xa5, 0x06, 0x7b, 0x4b, 0x6e, 0x1a, 0xa0, 0xc4, 0xf8, 0xde,
-	0x32, 0x38, 0x02, 0x7e, 0x02, 0x06, 0x66, 0xf5, 0x07, 0xe6, 0x5a, 0x77, 0x4d, 0x58, 0xe9, 0xe8,
-	0x02, 0xb8, 0xa6, 0x3f, 0xd0, 0x7c, 0xb8, 0xfa, 0x2f, 0x72, 0x30, 0x26, 0x84, 0x2a, 0x98, 0xef,
-	0x4b, 0xaa, 0xa1, 0x74, 0xf2, 0xfb, 0x96, 0x4e, 0x61, 0xef, 0xd2, 0x51, 0xff, 0x46, 0x01, 0x94,
-	0x29, 0xb3, 0x4d, 0x17, 0x1d, 0xdd, 0x72, 0xef, 0x51, 0x47, 0x6c, 0xa7, 0x27, 0x19, 0xab, 0x7d,
-	0x7d, 0xa0, 0x34, 0xa5, 0xe4, 0xf7, 0x34, 0xa5, 0x7c, 0x08, 0x86, 0x44, 0x63, 0x02, 0xf7, 0x53,
-	0x1c, 0x35, 0x8e, 0x0f, 0xd4, 0x42, 0x3c, 0x23, 0xae, 0x76, 0x3a, 0x8e, 0x7d, 0x9f, 0x3a, 0xfc,
-	0x2a, 0x50, 0x10, 0xeb, 0x3e, 0x50, 0x0b, 0xf1, 0x12, 0x67, 0xea, 0xdb, 0x8b, 0x32, 0x67, 0xea,
-	0x68, 0x21, 0x9e, 0x5c, 0x86, 0xc1, 0x19, 0xbb, 0xa5, 0xa3, 0xa0, 0xf9, 0xb4, 0x32, 0xb2, 0xb5,
-	0x59, 0x19, 0x6c, 0x0b, 0x98, 0x16, 0x60, 0x19, 0x65, 0xcd, 0x5e, 0xb7, 0xda, 0xb6, 0xce, 0x3d,
-	0x8c, 0x06, 0x39, 0xa5, 0x21, 0x60, 0x5a, 0x80, 0x65, 0x94, 0x4c, 0xe6, 0xe8, 0xb9, 0x35, 0x18,
-	0xf2, 0xbc, 0x27, 0x60, 0x5a, 0x80, 0x55, 0xbf, 0x5e, 0x64, 0xda, 0xeb, 0x9a, 0xef, 0x3c, 0xf4,
-	0xeb, 0x42, 0x38, 0x60, 0xfa, 0xf7, 0x30, 0x60, 0x1e, 0x9a, 0xf3, 0x40, 0xf5, 0xdf, 0x0e, 0x00,
-	0x08, 0xe9, 0x4f, 0x1e, 0x6f, 0x0e, 0xf7, 0xa7, 0x35, 0x35, 0x38, 0x39, 0x69, 0xad, 0xe8, 0x56,
-	0x8b, 0x1a, 0xe1, 0xa9, 0x68, 0x09, 0x87, 0x36, 0x3a, 0xae, 0x52, 0x81, 0x0c, 0x8f, 0x45, 0xb5,
-	0x64, 0x01, 0xf2, 0x3c, 0x0c, 0xd7, 0x2d, 0x8f, 0x3a, 0x7a, 0xcb, 0x33, 0xef, 0x53, 0x31, 0x35,
-	0xe0, 0xf5, 0xbb, 0x19, 0x82, 0x35, 0x99, 0x86, 0xbc, 0x08, 0x23, 0x0b, 0xba, 0xe3, 0x99, 0x2d,
-	0xb3, 0xa3, 0x5b, 0x9e, 0xab, 0x0c, 0xe2, 0x8c, 0x86, 0x16, 0x46, 0x47, 0x82, 0x6b, 0x11, 0x2a,
-	0xf2, 0x69, 0x18, 0xc2, 0xad, 0x29, 0xfa, 0xd8, 0x0f, 0x6d, 0x7b, 0xa5, 0xfa, 0x64, 0xe8, 0x83,
-	0xc9, 0x0f, 0x77, 0xf1, 0x9a, 0x3d, 0x7e, 0xab, 0x1a, 0x70, 0x24, 0x6f, 0xc2, 0xc0, 0xa4, 0x65,
-	0x20, 0x73, 0xd8, 0x96, 0xb9, 0x2a, 0x98, 0x9f, 0x0d, 0x99, 0xdb, 0x9d, 0x18, 0x6f, 0x9f, 0x5d,
-	0xfa, 0x28, 0x1b, 0x7e, 0xf7, 0x46, 0xd9, 0xc8, 0xbb, 0x70, 0xea, 0x3e, 0x7a, 0x50, 0xa7, 0xee,
-	0x63, 0x7b, 0x3c, 0x75, 0x57, 0xdf, 0x81, 0xe1, 0xf1, 0x85, 0xa9, 0x60, 0xf4, 0x9e, 0x87, 0xc2,
-	0x82, 0x70, 0x07, 0x29, 0x72, 0x7b, 0xa6, 0x63, 0x1a, 0x1a, 0x83, 0x91, 0x2b, 0x30, 0x38, 0x81,
-	0x3e, 0x86, 0xe2, 0xbe, 0xb3, 0xc8, 0xd7, 0xbf, 0x16, 0xc2, 0xd0, 0xd5, 0xd8, 0x47, 0x93, 0x0f,
-	0xc0, 0xc0, 0x82, 0x63, 0x2f, 0x3b, 0xfa, 0x9a, 0x58, 0x83, 0xd1, 0x1f, 0xa7, 0xc3, 0x41, 0x9a,
-	0x8f, 0x53, 0x7f, 0x24, 0xe7, 0x9b, 0xed, 0xac, 0x44, 0xa3, 0x8b, 0x47, 0xf3, 0x58, 0xf7, 0x20,
-	0x2f, 0xe1, 0x72, 0x90, 0xe6, 0xe3, 0xc8, 0x15, 0xe8, 0x9f, 0x74, 0x1c, 0xdb, 0x91, 0xdf, 0x25,
-	0x50, 0x06, 0x90, 0x2f, 0xa6, 0x91, 0x82, 0x7c, 0x18, 0x86, 0xf9, 0x9c, 0xc3, 0x4f, 0x34, 0x0b,
-	0xbd, 0xee, 0x74, 0x65, 0x4a, 0xf5, 0x37, 0x0b, 0x92, 0xcd, 0xc6, 0x25, 0xfe, 0x10, 0xde, 0x0a,
-	0xbc, 0x00, 0x85, 0xf1, 0x85, 0x29, 0x31, 0x01, 0x9e, 0xf2, 0x8b, 0x4a, 0xaa, 0x12, 0x2b, 0xc7,
-	0xa8, 0xc9, 0x45, 0x28, 0x2e, 0x30, 0xf5, 0x29, 0xa1, 0x7a, 0x0c, 0x6e, 0x6d, 0x56, 0x8a, 0x1d,
-	0xa6, 0x3f, 0x08, 0x45, 0x2c, 0xdb, 0xcc, 0xf0, 0x1d, 0x13, 0xc7, 0x86, 0xfb, 0x98, 0x8b, 0x50,
-	0xac, 0x3a, 0xcb, 0xf7, 0xc5, 0xac, 0x85, 0x58, 0xdd, 0x59, 0xbe, 0xaf, 0x21, 0x94, 0x5c, 0x03,
-	0xd0, 0xa8, 0xd7, 0x75, 0x2c, 0x7c, 0x32, 0x34, 0x84, 0xe7, 0x6f, 0x38, 0x1b, 0x3a, 0x08, 0x6d,
-	0xb6, 0x6c, 0x83, 0x6a, 0x12, 0x89, 0xfa, 0x77, 0xc2, 0x8b, 0x9d, 0x9a, 0xe9, 0xae, 0x1e, 0x77,
-	0xe1, 0x2e, 0xba, 0x50, 0x17, 0x47, 0x9c, 0xc9, 0x4e, 0xaa, 0x40, 0xff, 0x54, 0x5b, 0x5f, 0x76,
-	0xb1, 0x0f, 0x85, 0xc3, 0xde, 0x3d, 0x06, 0xd0, 0x38, 0x3c, 0xd6, 0x4f, 0x83, 0xdb, 0xf7, 0xd3,
-	0x57, 0xfa, 0x83, 0xd1, 0x36, 0x47, 0xbd, 0x75, 0xdb, 0x39, 0xee, 0xaa, 0x9d, 0x76, 0xd5, 0x25,
-	0x18, 0x68, 0x38, 0x2d, 0xe9, 0xe8, 0x02, 0xf7, 0x03, 0xae, 0xd3, 0xe2, 0xc7, 0x16, 0x3e, 0x92,
-	0xd1, 0xd5, 0x5c, 0x0f, 0xe9, 0x06, 0x42, 0x3a, 0xc3, 0xf5, 0x04, 0x9d, 0x40, 0x0a, 0xba, 0x05,
-	0xdb, 0xf1, 0x44, 0xc7, 0x05, 0x74, 0x1d, 0xdb, 0xf1, 0x34, 0x1f, 0x49, 0x3e, 0x04, 0xb0, 0x38,
-	0xb1, 0xe0, 0xbf, 0x68, 0x18, 0x0a, 0x1d, 0x2e, 0xc5, 0x53, 0x06, 0x4d, 0x42, 0x93, 0x45, 0x18,
-	0x9a, 0xef, 0x50, 0x87, 0x6f, 0x85, 0xf8, 0x23, 0xa0, 0x0f, 0xc6, 0x44, 0x2b, 0xfa, 0xfd, 0xaa,
-	0xf8, 0x3f, 0x20, 0xe7, 0xeb, 0x8b, 0xed, 0xff, 0xd4, 0x42, 0x46, 0xe4, 0xc3, 0x50, 0xaa, 0x72,
-	0x3b, 0x6f, 0x18, 0x59, 0x06, 0x22, 0xc3, 0x2d, 0x28, 0x47, 0xf1, 0x3d, 0xbb, 0x8e, 0x7f, 0x6b,
-	0x82, 0x5c, 0xbd, 0x02, 0xe5, 0x78, 0x35, 0x64, 0x18, 0x06, 0x26, 0xe6, 0xe7, 0xe6, 0x26, 0x27,
-	0x16, 0xcb, 0x7d, 0x64, 0x10, 0x8a, 0x8d, 0xc9, 0xb9, 0x5a, 0x39, 0xa7, 0x7e, 0x4d, 0x9a, 0x41,
-	0x98, 0x6a, 0x1d, 0x5f, 0x0d, 0xef, 0xeb, 0xbe, 0xa5, 0x8c, 0xf7, 0xa1, 0x78, 0x62, 0xb0, 0x66,
-	0x7a, 0x1e, 0x35, 0xc4, 0x2a, 0x81, 0xf7, 0x85, 0xde, 0x03, 0x2d, 0x81, 0x27, 0xcf, 0xc0, 0x28,
-	0xc2, 0xc4, 0x15, 0x21, 0xdf, 0x1f, 0x8b, 0x02, 0xce, 0x03, 0x2d, 0x8a, 0x54, 0xbf, 0x1d, 0xde,
-	0x0e, 0xcf, 0x50, 0xfd, 0xa8, 0xde, 0x28, 0xbe, 0x47, 0xfa, 0x4b, 0xfd, 0x95, 0x7e, 0xfe, 0xce,
-	0x86, 0xbf, 0xf1, 0x3c, 0x0c, 0x51, 0x86, 0x47, 0xba, 0x85, 0x5d, 0x1c, 0xe9, 0x3e, 0x03, 0xa5,
-	0x59, 0xea, 0xad, 0xd8, 0xbe, 0x8b, 0x1a, 0xfa, 0x84, 0xac, 0x21, 0x44, 0xf6, 0x09, 0xe1, 0x34,
-	0x64, 0x15, 0x88, 0xff, 0x80, 0x33, 0xf0, 0x76, 0xf7, 0x8f, 0x90, 0xcf, 0x25, 0xf6, 0x29, 0x0d,
-	0x7c, 0xe6, 0x8d, 0x0f, 0x19, 0x4e, 0x07, 0xde, 0xf4, 0x92, 0xcf, 0xd8, 0xbf, 0xdb, 0xac, 0x94,
-	0x38, 0x8d, 0x96, 0xc2, 0x96, 0x7c, 0x02, 0x86, 0x66, 0xa7, 0xaa, 0xe2, 0x31, 0x27, 0xf7, 0x8a,
-	0x38, 0x1f, 0x48, 0xd1, 0x47, 0x04, 0x22, 0xc1, 0x47, 0x4d, 0x6b, 0xf7, 0xf4, 0xe4, 0x5b, 0xce,
-	0x90, 0x0b, 0xd3, 0x16, 0xfe, 0x3c, 0x4a, 0x9c, 0x2e, 0x04, 0xda, 0x12, 0x7d, 0x34, 0x15, 0x97,
-	0x15, 0xc7, 0xc6, 0xb4, 0x65, 0x70, 0x1f, 0xa3, 0x7b, 0x1e, 0x4e, 0x56, 0x3b, 0x9d, 0xb6, 0x49,
-	0x0d, 0xd4, 0x17, 0xad, 0xdb, 0xa6, 0xae, 0xf0, 0x28, 0xc2, 0x17, 0x37, 0x3a, 0x47, 0x36, 0xf1,
-	0x09, 0x71, 0xd3, 0xe9, 0x46, 0x3d, 0x49, 0x93, 0x65, 0xf1, 0xc5, 0x36, 0x67, 0x6f, 0x3b, 0xf5,
-	0x9a, 0xf0, 0x29, 0xe2, 0x2f, 0xb6, 0x7d, 0x70, 0xd4, 0xc3, 0x52, 0x26, 0x57, 0x7f, 0x2c, 0x0f,
-	0x67, 0x27, 0x1c, 0xaa, 0x7b, 0x74, 0x76, 0xaa, 0x5a, 0xed, 0xa2, 0x2f, 0x60, 0xbb, 0x4d, 0xad,
-	0xe5, 0xc3, 0x99, 0x14, 0x5e, 0x83, 0xb1, 0xa0, 0x01, 0x8d, 0x96, 0xdd, 0xa1, 0xf2, 0xdb, 0xb7,
-	0x96, 0x8f, 0x69, 0xba, 0x0c, 0xa5, 0xc5, 0x48, 0xc9, 0x2d, 0x38, 0x15, 0x40, 0xaa, 0xed, 0xb6,
-	0xbd, 0xae, 0xd1, 0xae, 0xcb, 0x1d, 0x8e, 0x07, 0xb9, 0xc3, 0x71, 0xc8, 0x41, 0x67, 0xf8, 0xa6,
-	0xc3, 0x08, 0xb4, 0xb4, 0x52, 0xea, 0x57, 0x0b, 0x70, 0xee, 0x8e, 0xde, 0x36, 0x8d, 0x50, 0x34,
-	0x1a, 0x75, 0x3b, 0xb6, 0xe5, 0xd2, 0x23, 0x34, 0xc6, 0x23, 0x03, 0xa9, 0x78, 0x20, 0x03, 0x29,
-	0xd9, 0x45, 0xfd, 0xfb, 0xee, 0xa2, 0xd2, 0x9e, 0xba, 0xe8, 0x7f, 0xc9, 0x41, 0xd9, 0x7f, 0x9b,
-	0x21, 0x3f, 0xdb, 0x97, 0x1e, 0x0e, 0xe0, 0x01, 0x64, 0xcc, 0xbf, 0x1c, 0xf1, 0xa4, 0x01, 0x03,
-	0x93, 0x0f, 0x3a, 0xa6, 0x43, 0xdd, 0x1d, 0x38, 0xc7, 0x3f, 0x2a, 0x0e, 0x5b, 0x4e, 0x52, 0x5e,
-	0x24, 0x71, 0xce, 0xc2, 0xc1, 0xf8, 0xe2, 0x92, 0xbf, 0x4e, 0x19, 0xf7, 0x63, 0x11, 0xf0, 0x17,
-	0x97, 0xe2, 0x15, 0x4b, 0xe4, 0x09, 0x6d, 0x48, 0x4a, 0x9e, 0x84, 0xc2, 0xe2, 0xe2, 0x8c, 0x98,
-	0x87, 0x31, 0x06, 0x84, 0xe7, 0xc9, 0x4f, 0x4a, 0x19, 0x56, 0xfd, 0x57, 0x79, 0xfe, 0xca, 0x9a,
-	0x0f, 0xd7, 0x43, 0x51, 0xc2, 0x71, 0x18, 0xf4, 0x05, 0x2e, 0xd4, 0x30, 0x78, 0x58, 0x11, 0xef,
-	0x88, 0x78, 0xdd, 0xc1, 0x23, 0x9a, 0x8a, 0xef, 0x30, 0xcf, 0x6f, 0x11, 0x70, 0x5f, 0x84, 0x0e,
-	0xf3, 0xbe, 0x9b, 0xfc, 0x87, 0x60, 0x28, 0x98, 0xa1, 0xe4, 0xdb, 0x83, 0x60, 0x3a, 0xd3, 0x42,
-	0x7c, 0x6c, 0x62, 0x2e, 0xed, 0x63, 0x19, 0xf7, 0xc5, 0xcb, 0x7b, 0xe5, 0x58, 0xbc, 0x07, 0x2c,
-	0xde, 0x2f, 0x0a, 0xf1, 0xf2, 0x47, 0x56, 0x47, 0x56, 0xbc, 0x07, 0x76, 0x72, 0xae, 0xfe, 0x61,
-	0x0e, 0x08, 0x6b, 0xd6, 0x82, 0xee, 0xba, 0xeb, 0xb6, 0x63, 0x70, 0x27, 0xfc, 0x43, 0x11, 0xcc,
-	0xc1, 0xdd, 0x76, 0xfe, 0xc0, 0x10, 0x9c, 0x8a, 0xb8, 0x0d, 0x1f, 0xf1, 0xc9, 0xea, 0x4a, 0x74,
-	0x34, 0xf5, 0x7a, 0xdd, 0xf3, 0x94, 0x7c, 0x9d, 0xda, 0x1f, 0x79, 0x23, 0x28, 0xdd, 0xa3, 0x3e,
-	0x0b, 0x23, 0xe2, 0x07, 0x5b, 0xa1, 0xfd, 0x7b, 0x32, 0x1c, 0xa5, 0x2e, 0x03, 0x68, 0x11, 0x34,
-	0x79, 0x09, 0x86, 0xd8, 0x80, 0x59, 0xc6, 0x70, 0x31, 0x03, 0xe1, 0xcb, 0x19, 0xc3, 0x07, 0xca,
-	0xeb, 0x49, 0x40, 0x29, 0xb9, 0x7b, 0x0f, 0xee, 0xe0, 0x7d, 0xd6, 0x67, 0x60, 0xb8, 0x6a, 0x59,
-	0xb6, 0x87, 0x5b, 0x7c, 0x57, 0x5c, 0x6c, 0x64, 0xda, 0xf4, 0x4f, 0x62, 0xfc, 0x82, 0x90, 0x3e,
-	0xd5, 0xa8, 0x97, 0x19, 0x92, 0xeb, 0xfe, 0xeb, 0x1f, 0xea, 0x08, 0xf3, 0x14, 0x2f, 0x77, 0x1c,
-	0x01, 0x4b, 0x3e, 0xfe, 0xc1, 0xce, 0x1b, 0x5d, 0x70, 0xec, 0x8e, 0xed, 0x52, 0x83, 0x0b, 0x6a,
-	0x38, 0x8c, 0x06, 0xd1, 0x11, 0x08, 0x7c, 0x6a, 0x18, 0x09, 0xdd, 0x12, 0x29, 0x42, 0xee, 0xc1,
-	0x69, 0xff, 0x9a, 0x39, 0x78, 0xd4, 0x59, 0xaf, 0xb9, 0xe8, 0x32, 0x3f, 0x1c, 0xc6, 0x27, 0x09,
-	0x51, 0xe3, 0x8f, 0xf9, 0x97, 0x2a, 0xfe, 0xab, 0xd0, 0xa6, 0x69, 0xc8, 0x5d, 0x9d, 0xca, 0x8f,
-	0x7c, 0x37, 0x0c, 0xcf, 0xea, 0x0f, 0x6a, 0x5d, 0x71, 0x72, 0x33, 0xba, 0xf3, 0xbb, 0x9b, 0x35,
-	0xfd, 0x41, 0xd3, 0x10, 0xe5, 0x62, 0x36, 0x85, 0xcc, 0x92, 0x34, 0xe1, 0xec, 0x82, 0x63, 0xaf,
-	0xd9, 0x1e, 0x35, 0x62, 0xef, 0x23, 0x4f, 0x84, 0x0f, 0xaa, 0x3b, 0x82, 0xa2, 0xd9, 0xe3, 0xa1,
-	0x64, 0x06, 0x1b, 0xb2, 0x06, 0x27, 0xaa, 0xae, 0xdb, 0x5d, 0xa3, 0xe1, 0xfd, 0x56, 0x79, 0xdb,
-	0xcf, 0xf8, 0xa0, 0xf0, 0x79, 0x7e, 0x44, 0xc7, 0xa2, 0xfc, 0x7a, 0xab, 0xe9, 0x99, 0x72, 0x8d,
-	0xf8, 0x2d, 0x71, 0xde, 0xac, 0x77, 0x7d, 0x01, 0xe2, 0xd3, 0x7e, 0xe5, 0x24, 0x0e, 0x2f, 0xec,
-	0xdd, 0x40, 0xf4, 0x18, 0x16, 0x40, 0xee, 0xdd, 0x48, 0x91, 0x9b, 0xc5, 0xc1, 0xb1, 0xf2, 0x09,
-	0xed, 0x5c, 0xf2, 0x83, 0xf8, 0xcb, 0xa1, 0xbf, 0x99, 0x8f, 0xcd, 0x44, 0xdc, 0x46, 0xdb, 0xd7,
-	0x4c, 0x24, 0xcf, 0x28, 0xf9, 0x3d, 0xce, 0x28, 0x4f, 0x25, 0xbd, 0x2e, 0x52, 0xa6, 0x89, 0xef,
-	0x86, 0x31, 0xbf, 0x04, 0xb6, 0x7b, 0x23, 0x58, 0x6a, 0xb2, 0xbb, 0xe3, 0xa2, 0xe8, 0x8e, 0x32,
-	0x1a, 0xa9, 0x1b, 0xb1, 0x3e, 0x88, 0xf1, 0x53, 0xbf, 0x99, 0x03, 0x08, 0x95, 0x98, 0x3c, 0x1b,
-	0x8d, 0xfb, 0x95, 0x0b, 0xaf, 0xa2, 0x44, 0x10, 0x8f, 0x48, 0xa0, 0x2f, 0x72, 0x11, 0x8a, 0x18,
-	0xe8, 0x25, 0x1f, 0x1e, 0x7d, 0xaf, 0x9a, 0x96, 0xa1, 0x21, 0x94, 0x61, 0xa5, 0x88, 0x0c, 0x88,
-	0x45, 0xb7, 0x0b, 0x6e, 0x79, 0xd7, 0xe0, 0x44, 0xa3, 0xbb, 0x24, 0x77, 0xa6, 0x1c, 0xca, 0xca,
-	0xed, 0x2e, 0x05, 0x6f, 0xb2, 0x23, 0xd1, 0x7c, 0xa2, 0x45, 0xd4, 0xaf, 0xe7, 0x62, 0xfd, 0x7b,
-	0x88, 0x86, 0xc5, 0x8e, 0xfa, 0x54, 0xfd, 0x83, 0x02, 0x0c, 0x2f, 0xd8, 0x8e, 0x27, 0x22, 0xe7,
-	0x1c, 0xed, 0x95, 0x5e, 0xda, 0x8f, 0x16, 0x77, 0xb1, 0x1f, 0xbd, 0x08, 0x45, 0xc9, 0x89, 0x9c,
-	0xdf, 0x5c, 0x19, 0x86, 0xa3, 0x21, 0xf4, 0x5d, 0x7e, 0x14, 0x93, 0xbc, 0xa6, 0x1e, 0xd8, 0xb7,
-	0x33, 0xc8, 0xf7, 0xe4, 0x01, 0xde, 0x7c, 0xfe, 0xf9, 0x87, 0xb8, 0x4b, 0xd5, 0x9f, 0xcc, 0xc1,
-	0x09, 0x71, 0xf9, 0x2b, 0xc5, 0xfc, 0x1b, 0xf0, 0xaf, 0xed, 0xe5, 0x99, 0x84, 0x83, 0x34, 0x1f,
-	0xc7, 0x0c, 0x83, 0xc9, 0x07, 0xa6, 0x87, 0xf7, 0x5f, 0x52, 0xd0, 0x3f, 0x2a, 0x60, 0xb2, 0x61,
-	0xe0, 0xd3, 0x91, 0x67, 0xfd, 0x6b, 0xed, 0x42, 0x68, 0x0d, 0xb1, 0x02, 0x93, 0xa9, 0x57, 0xdb,
-	0xea, 0x2f, 0x14, 0xa1, 0x38, 0xf9, 0x80, 0xb6, 0x8e, 0x78, 0xd7, 0x48, 0x87, 0xe5, 0xc5, 0x7d,
-	0x1e, 0x96, 0xef, 0xc5, 0x4f, 0xe7, 0x8d, 0xb0, 0x3f, 0x4b, 0xd1, 0xea, 0x63, 0x3d, 0x1f, 0xaf,
-	0xde, 0xef, 0xe9, 0xa3, 0xe7, 0xe6, 0xf5, 0x4f, 0x0a, 0x50, 0x68, 0x4c, 0x2c, 0x1c, 0xeb, 0xcd,
-	0xa1, 0xea, 0x4d, 0x6f, 0x3f, 0x08, 0x35, 0xb8, 0xda, 0x1c, 0x0c, 0x3d, 0x8f, 0x63, 0xb7, 0x98,
-	0x7f, 0x5e, 0x80, 0xb1, 0xc6, 0xd4, 0xe2, 0x82, 0x74, 0xbb, 0x70, 0x8b, 0x7b, 0x87, 0xa2, 0x9f,
-	0x22, 0xef, 0xd2, 0x8b, 0x09, 0xb3, 0xea, 0x76, 0xdd, 0xf2, 0x5e, 0x7e, 0xf1, 0x8e, 0xde, 0xee,
-	0x52, 0x3c, 0x90, 0xe3, 0xbe, 0xe4, 0xae, 0xf9, 0x0e, 0xfd, 0x2a, 0x86, 0xd9, 0xf0, 0x19, 0x90,
-	0xd7, 0xa0, 0x70, 0x5b, 0x78, 0xf9, 0x64, 0xf1, 0x79, 0xe1, 0x3a, 0xe7, 0xc3, 0x26, 0xc1, 0x42,
-	0xd7, 0x34, 0x90, 0x03, 0x2b, 0xc5, 0x0a, 0xdf, 0x10, 0x26, 0xc3, 0x8e, 0x0a, 0x2f, 0xfb, 0x85,
-	0x6f, 0xd4, 0x6b, 0xa4, 0x01, 0xc3, 0x0b, 0xd4, 0x59, 0x33, 0xb1, 0xa3, 0xfc, 0x39, 0xbb, 0x37,
-	0x13, 0xb6, 0x7f, 0x1d, 0xee, 0x84, 0x85, 0x90, 0x99, 0xcc, 0x85, 0xbc, 0x05, 0xc0, 0xad, 0xaa,
-	0x1d, 0xc6, 0x91, 0x7d, 0x14, 0x77, 0x83, 0x7c, 0xc3, 0x91, 0x62, 0xf9, 0x4b, 0xcc, 0xc8, 0x2a,
-	0x94, 0x67, 0x6d, 0xc3, 0xbc, 0x67, 0x72, 0x77, 0x5e, 0xac, 0xa0, 0xb4, 0xbd, 0x13, 0x1d, 0xdb,
-	0x60, 0xac, 0x49, 0xe5, 0xd2, 0xaa, 0x49, 0x30, 0x56, 0xff, 0x61, 0x3f, 0x14, 0x59, 0xb7, 0x1f,
-	0x8f, 0xdf, 0xfd, 0x8c, 0xdf, 0x2a, 0x94, 0xef, 0xda, 0xce, 0xaa, 0x69, 0x2d, 0x07, 0x2f, 0x2d,
-	0xc4, 0x89, 0x05, 0x7a, 0x87, 0xad, 0x73, 0x5c, 0x33, 0x78, 0x94, 0xa1, 0x25, 0xc8, 0xb7, 0x19,
-	0xc1, 0xaf, 0x00, 0xf0, 0xf0, 0x0c, 0x48, 0x33, 0x18, 0x86, 0x86, 0xe1, 0xc1, 0x1b, 0xf0, 0xf1,
-	0x86, 0x1c, 0x1a, 0x26, 0x24, 0x26, 0x57, 0x7c, 0xff, 0x9a, 0x21, 0x7c, 0xcb, 0x81, 0x47, 0x33,
-	0xe8, 0x5f, 0x23, 0x1b, 0x01, 0xdc, 0xd3, 0x66, 0x01, 0x40, 0xba, 0xb3, 0x84, 0x98, 0x20, 0x22,
-	0x93, 0x83, 0x88, 0xeb, 0x98, 0x72, 0x65, 0xa9, 0x49, 0x3c, 0xc8, 0xcb, 0x31, 0xa7, 0x0a, 0x12,
-	0xe1, 0x96, 0xe9, 0x53, 0x11, 0x3a, 0xe5, 0x8d, 0x6c, 0xe7, 0x94, 0xa7, 0xfe, 0x6c, 0x01, 0x86,
-	0x19, 0xb7, 0x46, 0x77, 0x6d, 0x4d, 0x77, 0x36, 0x8e, 0x15, 0x79, 0x3f, 0x8a, 0xdc, 0x84, 0x93,
-	0xf2, 0x23, 0x0c, 0x66, 0xba, 0xfa, 0x31, 0xc2, 0x82, 0x2d, 0x7c, 0x9c, 0x80, 0xdb, 0x96, 0x38,
-	0xef, 0x7b, 0x02, 0x8c, 0x27, 0x4e, 0xae, 0x96, 0xe4, 0xa5, 0xfe, 0x68, 0x0e, 0xca, 0x71, 0x68,
-	0xa0, 0xfb, 0xb9, 0x54, 0xdd, 0x7f, 0x06, 0x86, 0x84, 0x5b, 0x86, 0x6e, 0x08, 0x2f, 0xd1, 0xb1,
-	0xad, 0xcd, 0x0a, 0xe0, 0x9b, 0xf8, 0xa6, 0x43, 0x75, 0x43, 0x0b, 0x09, 0xc8, 0x4b, 0x30, 0x82,
-	0x3f, 0xee, 0x3a, 0xa6, 0xe7, 0x51, 0xde, 0x19, 0x45, 0x7e, 0x57, 0xc4, 0x0b, 0xac, 0x73, 0x84,
-	0x16, 0x21, 0x53, 0x7f, 0x3b, 0x0f, 0x43, 0x8d, 0xee, 0x92, 0xbb, 0xe1, 0x7a, 0x74, 0xed, 0x88,
-	0xeb, 0x90, 0x7f, 0xac, 0x50, 0x4c, 0x3d, 0x56, 0x78, 0xd2, 0x1f, 0x5a, 0xd2, 0x9d, 0x46, 0xb0,
-	0x31, 0xf0, 0x3d, 0x5d, 0x43, 0x2d, 0x2a, 0xed, 0x5e, 0x8b, 0xd4, 0xbf, 0x9f, 0x87, 0x32, 0x77,
-	0x08, 0xa8, 0x99, 0x6e, 0xeb, 0x00, 0x1e, 0x29, 0x1d, 0xbe, 0x4c, 0xf7, 0xe7, 0x44, 0xb3, 0x83,
-	0xa7, 0x5f, 0xea, 0xe7, 0xf2, 0x30, 0x5c, 0xed, 0x7a, 0x2b, 0x55, 0x0f, 0xe7, 0xb7, 0x87, 0x72,
-	0x8f, 0xfc, 0x5b, 0x39, 0x38, 0xc1, 0x1a, 0xb2, 0x68, 0xaf, 0x52, 0xeb, 0x00, 0xae, 0x44, 0x0e,
-	0xe2, 0x20, 0xd2, 0x97, 0x65, 0x61, 0x77, 0xb2, 0xc4, 0x8b, 0x3c, 0xcd, 0x6e, 0xd3, 0xa3, 0xfd,
-	0x19, 0x07, 0x78, 0x91, 0xe7, 0x0b, 0xe4, 0x00, 0x2e, 0x8e, 0xdf, 0x5f, 0x02, 0x39, 0x80, 0x13,
-	0xd9, 0xf7, 0x87, 0x40, 0x7e, 0x33, 0x07, 0x43, 0xe3, 0xb6, 0x77, 0xc4, 0x07, 0xbe, 0xf8, 0x8a,
-	0xa3, 0xad, 0xe6, 0xfe, 0x57, 0x1c, 0x6d, 0xdd, 0x54, 0x7f, 0x3c, 0x0f, 0xa7, 0x45, 0x9e, 0x0a,
-	0x71, 0x06, 0x76, 0x3c, 0x1d, 0x8b, 0xc1, 0x96, 0x14, 0xcd, 0xf1, 0x3c, 0x24, 0x44, 0xf3, 0xd3,
-	0x05, 0x38, 0x8d, 0x71, 0xb0, 0xd9, 0x8e, 0xea, 0x7d, 0x60, 0x8b, 0x90, 0x56, 0xd4, 0x3d, 0x63,
-	0x36, 0xc5, 0x3d, 0xe3, 0xdf, 0x6d, 0x56, 0x5e, 0x5e, 0x36, 0xbd, 0x95, 0xee, 0xd2, 0xd5, 0x96,
-	0xbd, 0x76, 0x6d, 0xd9, 0xd1, 0xef, 0x9b, 0xdc, 0x31, 0x41, 0x6f, 0x5f, 0x0b, 0xd3, 0x47, 0x75,
-	0x4c, 0x91, 0x0c, 0xaa, 0x81, 0x3b, 0x25, 0xc6, 0xd5, 0x77, 0xec, 0x70, 0x01, 0x6e, 0xda, 0xa6,
-	0x25, 0x7c, 0xa5, 0xb9, 0xa1, 0xdb, 0xd8, 0xda, 0xac, 0x9c, 0x79, 0xdb, 0x36, 0xad, 0x66, 0xdc,
-	0x61, 0x7a, 0xb7, 0xf5, 0x85, 0xac, 0x35, 0xa9, 0x1a, 0xf5, 0x9f, 0xe7, 0xe0, 0x7c, 0x54, 0x8b,
-	0xdf, 0x0f, 0xb6, 0xe3, 0x5f, 0xcf, 0xc3, 0x99, 0x1b, 0x28, 0x9c, 0xc0, 0xc5, 0xec, 0x78, 0xde,
-	0x12, 0x83, 0x33, 0x45, 0x36, 0xc7, 0x16, 0x65, 0xb6, 0x6c, 0x8e, 0x27, 0x75, 0x21, 0x9b, 0xdf,
-	0xcd, 0xc1, 0xa9, 0xf9, 0x7a, 0x6d, 0xe2, 0x7d, 0x32, 0xa2, 0x92, 0xdf, 0x73, 0xc4, 0x0d, 0xce,
-	0xc4, 0xf7, 0x1c, 0x71, 0xd3, 0xf3, 0xcb, 0x79, 0x38, 0xd5, 0xa8, 0xce, 0xce, 0xbc, 0x5f, 0x66,
-	0xf0, 0x09, 0xd9, 0x1f, 0xda, 0x3f, 0x04, 0x13, 0xb6, 0x80, 0xfc, 0x99, 0x77, 0xae, 0x67, 0xfb,
-	0x49, 0x27, 0x85, 0x72, 0xc4, 0xa7, 0xee, 0x03, 0x11, 0x0a, 0xd3, 0xfc, 0x08, 0xf5, 0x11, 0xd7,
-	0xfc, 0x7f, 0x5c, 0x82, 0xe1, 0x5b, 0xdd, 0x25, 0x2a, 0x5c, 0xba, 0x1e, 0xea, 0x93, 0xdf, 0xeb,
-	0x30, 0x2c, 0xc4, 0x80, 0x37, 0x1c, 0x52, 0x50, 0x50, 0x11, 0xe4, 0x89, 0xc7, 0x5d, 0x93, 0x89,
-	0xc8, 0x45, 0x28, 0xde, 0xa1, 0xce, 0x92, 0xfc, 0x5e, 0xfe, 0x3e, 0x75, 0x96, 0x34, 0x84, 0x92,
-	0x99, 0xf0, 0x31, 0x4f, 0x75, 0xa1, 0x8e, 0x59, 0xb8, 0xc4, 0xa5, 0x21, 0xa6, 0x15, 0x0b, 0xdc,
-	0x42, 0xf5, 0x8e, 0xc9, 0xf3, 0x77, 0xc9, 0xb1, 0x3a, 0xe2, 0x25, 0xc9, 0x1c, 0x9c, 0x8c, 0xb8,
-	0x8b, 0x62, 0x0a, 0xaa, 0xc1, 0x14, 0x76, 0x69, 0xc9, 0xa7, 0x92, 0x45, 0xc9, 0x1b, 0x30, 0xe2,
-	0x03, 0xd1, 0xf1, 0x71, 0x28, 0xcc, 0x7b, 0x12, 0xb0, 0x8a, 0xe5, 0x96, 0x88, 0x14, 0x90, 0x19,
-	0xe0, 0x25, 0x06, 0xa4, 0x30, 0x88, 0x39, 0xeb, 0x46, 0x0a, 0x90, 0x97, 0x90, 0x01, 0x3e, 0x40,
-	0x43, 0x87, 0xa9, 0x61, 0x7c, 0x4c, 0x8e, 0x17, 0x40, 0x8e, 0x80, 0xf3, 0x90, 0x01, 0x11, 0x32,
-	0x32, 0x0f, 0x10, 0x3a, 0xb6, 0x88, 0xc0, 0x2c, 0xbb, 0x76, 0xb9, 0x91, 0x58, 0xc8, 0x37, 0x79,
-	0xa3, 0x7b, 0xb9, 0xc9, 0x53, 0x7f, 0xac, 0x00, 0xc3, 0xd5, 0x4e, 0x27, 0x18, 0x0a, 0xcf, 0x42,
-	0xa9, 0xda, 0xe9, 0xdc, 0xd6, 0xea, 0x72, 0x32, 0x09, 0xbd, 0xd3, 0x69, 0x76, 0x1d, 0x53, 0xf6,
-	0x56, 0xe7, 0x44, 0x64, 0x02, 0x46, 0xab, 0x9d, 0xce, 0x42, 0x77, 0xa9, 0x6d, 0xb6, 0xa4, 0xb4,
-	0x7a, 0x3c, 0x8f, 0x69, 0xa7, 0xd3, 0xec, 0x20, 0x26, 0x9e, 0x5b, 0x31, 0x5a, 0x86, 0x7c, 0x06,
-	0xc3, 0x99, 0x89, 0xac, 0x6e, 0x3c, 0x6f, 0x94, 0x1a, 0xa4, 0x91, 0x08, 0xdb, 0x76, 0x35, 0x20,
-	0xe2, 0xe9, 0x36, 0x2e, 0xfa, 0x49, 0x52, 0x58, 0x45, 0x89, 0xec, 0x6d, 0x21, 0x4b, 0xf2, 0x1c,
-	0x0c, 0x54, 0x3b, 0x1d, 0xe9, 0xb6, 0x0a, 0x1d, 0xdb, 0x58, 0xa9, 0x78, 0x1e, 0x4e, 0x41, 0x26,
-	0x3e, 0x4b, 0xdc, 0x6f, 0xdb, 0x8e, 0x87, 0x43, 0x6a, 0x34, 0xfc, 0x2c, 0xff, 0x42, 0xdc, 0x96,
-	0x23, 0x08, 0x69, 0xd1, 0x32, 0x17, 0x5e, 0x87, 0xb1, 0x68, 0x8b, 0x77, 0x95, 0xf3, 0xe3, 0x3b,
-	0x39, 0x94, 0xca, 0x11, 0x7f, 0xb2, 0xf1, 0x02, 0x14, 0xaa, 0x9d, 0x8e, 0x98, 0xd4, 0x4e, 0xa5,
-	0x74, 0x6a, 0x3c, 0x3e, 0x44, 0xb5, 0xd3, 0xf1, 0x3f, 0xfd, 0x88, 0xbf, 0xfd, 0xda, 0xd3, 0xa7,
-	0xff, 0x26, 0xff, 0xf4, 0xa3, 0xfd, 0x2e, 0x4b, 0xfd, 0x85, 0x02, 0x9c, 0xa8, 0x76, 0x3a, 0xc7,
-	0x09, 0x3e, 0x0e, 0x2a, 0x0a, 0xc5, 0xf3, 0x00, 0xd2, 0x1c, 0x3b, 0x10, 0xbc, 0x4c, 0x1d, 0x96,
-	0xe6, 0x57, 0x25, 0xa7, 0x49, 0x44, 0xbe, 0xfa, 0x0d, 0xee, 0x4a, 0xfd, 0x3e, 0x57, 0xc0, 0x89,
-	0xef, 0xa8, 0x47, 0xd4, 0x7b, 0xaf, 0x74, 0x9b, 0xe8, 0x83, 0xd2, 0xae, 0xfa, 0xe0, 0x37, 0x22,
-	0x83, 0x07, 0x33, 0x3a, 0x1c, 0xf7, 0x42, 0xff, 0xbe, 0x6c, 0xeb, 0x31, 0x59, 0x98, 0x22, 0xcc,
-	0x97, 0x9f, 0xca, 0x4f, 0x04, 0x9d, 0x6b, 0x31, 0x54, 0xd3, 0x34, 0xb4, 0x18, 0xad, 0xdf, 0x87,
-	0x03, 0xbb, 0xea, 0xc3, 0xcd, 0x3c, 0x06, 0x96, 0x08, 0x82, 0xd6, 0xed, 0x7f, 0x8b, 0x72, 0x0d,
-	0x80, 0xbb, 0x2f, 0x04, 0xfe, 0xf9, 0xa3, 0x3c, 0x3e, 0x15, 0xcf, 0xf0, 0x27, 0xe2, 0x53, 0x85,
-	0x24, 0x81, 0xbb, 0x53, 0x21, 0xd5, 0xdd, 0xe9, 0x0a, 0x0c, 0x6a, 0xfa, 0xfa, 0x27, 0xba, 0x54,
-	0x3c, 0x66, 0xf2, 0x63, 0xc2, 0xea, 0xeb, 0xcd, 0xcf, 0x32, 0xa0, 0x16, 0xa0, 0x89, 0x1a, 0x44,
-	0x26, 0x91, 0xdc, 0x4a, 0xf8, 0x41, 0x7b, 0x10, 0x8f, 0x64, 0x2f, 0x8a, 0x4e, 0x5e, 0x85, 0x42,
-	0xf5, 0x6e, 0x43, 0x48, 0x36, 0xe8, 0xda, 0xea, 0xdd, 0x86, 0x90, 0x57, 0x66, 0xd9, 0xbb, 0x0d,
-	0xf5, 0x73, 0x79, 0x20, 0x49, 0x4a, 0xf2, 0x32, 0x0c, 0x21, 0x74, 0x99, 0xe9, 0x8c, 0x9c, 0x1a,
-	0x7a, 0xdd, 0x6d, 0x3a, 0x08, 0x8d, 0x58, 0x88, 0x3e, 0x29, 0x79, 0x05, 0x73, 0xf9, 0x8b, 0xe4,
-	0xa4, 0x91, 0xd4, 0xd0, 0xeb, 0xae, 0x9f, 0xfd, 0x3e, 0x96, 0xca, 0x5f, 0x10, 0xa3, 0x71, 0x79,
-	0xb7, 0x31, 0x6d, 0xbb, 0x9e, 0x10, 0x35, 0x37, 0x2e, 0xd7, 0x5d, 0xcc, 0x49, 0x1e, 0x31, 0x2e,
-	0x39, 0x19, 0xe6, 0x55, 0xbc, 0xdb, 0xe0, 0xaf, 0xf0, 0x0c, 0xcd, 0x0e, 0x72, 0x18, 0xf2, 0xbc,
-	0x8a, 0xeb, 0x6e, 0x93, 0xbf, 0xe0, 0x33, 0x9a, 0x8e, 0xdd, 0x8e, 0xe6, 0x55, 0x8c, 0x94, 0x52,
-	0x7f, 0x68, 0x10, 0xca, 0x35, 0xdd, 0xd3, 0x97, 0x74, 0x97, 0x4a, 0x5b, 0xf2, 0x13, 0x3e, 0xcc,
-	0xff, 0x1c, 0x49, 0x0e, 0xc6, 0x52, 0xca, 0xd7, 0xc4, 0x0b, 0x90, 0xd7, 0x42, 0xbe, 0x41, 0xd6,
-	0x6b, 0x39, 0x8d, 0xe6, 0x52, 0xb3, 0x23, 0xc0, 0x5a, 0x82, 0x90, 0x3c, 0x03, 0xc3, 0x3e, 0x8c,
-	0xed, 0x22, 0x0a, 0xa1, 0xce, 0x18, 0x4b, 0x6c, 0x13, 0xa1, 0xc9, 0x68, 0xf2, 0x0a, 0x8c, 0xf8,
-	0x3f, 0x25, 0xfb, 0x9c, 0xe7, 0x04, 0x5d, 0x4a, 0x6c, 0xc1, 0x64, 0x52, 0xb9, 0x28, 0xce, 0x6f,
-	0xfd, 0x91, 0xa2, 0xb1, 0xb4, 0x9b, 0x11, 0x52, 0xf2, 0x59, 0x18, 0xf3, 0x7f, 0x8b, 0x5d, 0x07,
-	0xf7, 0x3e, 0x7c, 0xc6, 0x57, 0xc2, 0xb8, 0x58, 0xaf, 0x46, 0xc9, 0xf9, 0xfe, 0xe3, 0x11, 0x3f,
-	0xfd, 0xa3, 0xb1, 0x94, 0xdc, 0x7e, 0xc4, 0x2a, 0x20, 0x75, 0x38, 0xe9, 0x43, 0x42, 0x0d, 0x1d,
-	0x08, 0xb7, 0x9d, 0xc6, 0x52, 0x33, 0x55, 0x49, 0x93, 0xa5, 0x48, 0x1b, 0x2e, 0x46, 0x80, 0x86,
-	0xbb, 0x62, 0xde, 0xf3, 0xc4, 0x9e, 0x51, 0x04, 0x68, 0x17, 0xa9, 0x83, 0x03, 0xae, 0x9c, 0xc6,
-	0xcf, 0x01, 0x1e, 0x0d, 0x41, 0xd3, 0x93, 0x1b, 0x69, 0xc0, 0x69, 0x1f, 0x7f, 0x63, 0x62, 0x61,
-	0xc1, 0xb1, 0xdf, 0xa6, 0x2d, 0xaf, 0x5e, 0x13, 0x7b, 0x6e, 0x0c, 0xdc, 0x69, 0x2c, 0x35, 0x97,
-	0x5b, 0x1d, 0xa6, 0x14, 0x0c, 0x17, 0x65, 0x9e, 0x5a, 0x98, 0xdc, 0x81, 0x33, 0x12, 0xbc, 0x6e,
-	0xb9, 0x9e, 0x6e, 0xb5, 0x68, 0x10, 0x30, 0x07, 0x0f, 0x05, 0x04, 0x57, 0x53, 0x20, 0xa3, 0x6c,
-	0xd3, 0x8b, 0x93, 0xd7, 0x61, 0xd4, 0x47, 0xf0, 0xab, 0xc8, 0x61, 0xbc, 0x8a, 0xc4, 0x21, 0x69,
-	0x2c, 0x35, 0xe3, 0x8f, 0xc5, 0xa3, 0xc4, 0xb2, 0x46, 0x2d, 0x6e, 0x74, 0xa8, 0x70, 0x0b, 0xf6,
-	0x35, 0xca, 0xdb, 0xe8, 0xa4, 0x2a, 0x23, 0x23, 0x25, 0x6f, 0x84, 0x1a, 0x35, 0xef, 0x98, 0xcb,
-	0xa6, 0x9f, 0xda, 0xeb, 0x9c, 0xd0, 0x0f, 0x1b, 0x81, 0x69, 0xfa, 0xc1, 0xc9, 0x2f, 0x54, 0xe1,
-	0x54, 0x8a, 0x8e, 0xed, 0x6a, 0xc7, 0xf8, 0x85, 0x7c, 0xd8, 0x88, 0x23, 0xbe, 0x6d, 0x1c, 0x87,
-	0x41, 0xff, 0x4b, 0x84, 0xf1, 0xa0, 0x64, 0x0d, 0xcd, 0x38, 0x0f, 0x1f, 0x1f, 0x11, 0xc7, 0x11,
-	0xdf, 0x4a, 0x1e, 0x84, 0x38, 0xbe, 0x95, 0x0b, 0xc5, 0x71, 0xc4, 0xb7, 0x97, 0xbf, 0x55, 0x0c,
-	0xe7, 0xa4, 0xe3, 0x3d, 0xe6, 0x41, 0x99, 0xc9, 0xa1, 0x33, 0x6d, 0x69, 0x17, 0x6f, 0x88, 0x65,
-	0xd5, 0x1c, 0xd8, 0x9b, 0x6a, 0x92, 0xd7, 0x61, 0x78, 0xc1, 0x76, 0xbd, 0x65, 0x87, 0xba, 0x0b,
-	0x41, 0x82, 0x11, 0x7c, 0x7f, 0xde, 0x11, 0xe0, 0x66, 0x27, 0x1a, 0x34, 0x4d, 0x22, 0x97, 0x62,
-	0xc9, 0x0d, 0xed, 0x3e, 0x96, 0x9c, 0xfa, 0xc7, 0x85, 0x84, 0x2e, 0x71, 0xb3, 0xf7, 0x48, 0xea,
-	0xd2, 0x01, 0x4c, 0x14, 0xe4, 0x7a, 0xb8, 0x86, 0xf2, 0xfd, 0x41, 0xbf, 0x14, 0x7b, 0x75, 0x49,
-	0x6c, 0x0f, 0xa2, 0x24, 0xe4, 0x53, 0x70, 0x2e, 0x02, 0x58, 0xd0, 0x1d, 0x7d, 0x8d, 0x7a, 0x61,
-	0xd2, 0x5a, 0x8c, 0xa6, 0xe7, 0x97, 0x6e, 0x76, 0x02, 0xb4, 0x9c, 0x08, 0x37, 0x83, 0x83, 0xa4,
-	0x98, 0x03, 0xbb, 0xf0, 0xf2, 0xfe, 0x4a, 0x21, 0x34, 0x93, 0xa2, 0x51, 0xb1, 0x35, 0xea, 0x76,
-	0xdb, 0xde, 0xc3, 0xdb, 0xc1, 0x7b, 0xcb, 0x39, 0x34, 0x0d, 0x27, 0xaa, 0xf7, 0xee, 0xd1, 0x96,
-	0xe7, 0x07, 0xfb, 0x77, 0x45, 0x1c, 0x54, 0xbe, 0x6d, 0x11, 0x28, 0x11, 0xbc, 0xdd, 0x8d, 0xa4,
-	0x11, 0x8e, 0x16, 0x53, 0xff, 0x65, 0x11, 0x94, 0x60, 0xdb, 0x10, 0xbc, 0x76, 0x3c, 0xc4, 0x25,
-	0xfa, 0x3d, 0xd1, 0x2b, 0x26, 0x9c, 0x0c, 0x85, 0x21, 0x9e, 0x99, 0x29, 0xfd, 0xb8, 0x2d, 0xa9,
-	0xc4, 0x99, 0x85, 0x84, 0x7c, 0x27, 0x72, 0x41, 0xec, 0x44, 0x48, 0xf8, 0x9a, 0xb4, 0xe9, 0x72,
-	0x16, 0x5a, 0x92, 0x2b, 0xf9, 0x62, 0x0e, 0x4e, 0xfb, 0x9d, 0x32, 0xbf, 0xc4, 0x4c, 0xf2, 0x09,
-	0xbb, 0x6b, 0x05, 0x6f, 0xb0, 0x5e, 0xcd, 0xae, 0x8e, 0x77, 0xd2, 0xd5, 0xb4, 0xc2, 0xbc, 0x25,
-	0x41, 0xcc, 0x9e, 0x40, 0x21, 0x6c, 0xa4, 0x69, 0xb6, 0x90, 0x48, 0x4b, 0xad, 0xf7, 0xc2, 0x0d,
-	0x38, 0x9f, 0xc9, 0x72, 0x3b, 0x13, 0xb8, 0x5f, 0x36, 0x81, 0xff, 0x28, 0x17, 0x4e, 0x44, 0x31,
-	0x21, 0x91, 0xab, 0x00, 0x21, 0x48, 0x6c, 0x8a, 0xf1, 0x89, 0x57, 0x28, 0x34, 0x4d, 0xa2, 0x20,
-	0xf3, 0x50, 0x12, 0x62, 0xe1, 0x09, 0xe2, 0x3f, 0xb4, 0x4d, 0x2f, 0x5c, 0x95, 0xe5, 0x80, 0x1b,
-	0x5e, 0xf1, 0xcd, 0x82, 0xcd, 0x85, 0x57, 0x60, 0x78, 0xaf, 0xdf, 0xf5, 0xc5, 0x02, 0x10, 0x79,
-	0x07, 0x7b, 0x88, 0xe6, 0xfd, 0x11, 0x9e, 0xc2, 0x2e, 0xc3, 0x20, 0xfb, 0x04, 0x4c, 0x44, 0x24,
-	0x05, 0x1e, 0xef, 0x0a, 0x98, 0x16, 0x60, 0xc3, 0xb8, 0x7d, 0x03, 0xe9, 0x71, 0xfb, 0xd4, 0x1f,
-	0x2d, 0xc0, 0x59, 0xb9, 0x43, 0x6a, 0x14, 0x73, 0x99, 0x1c, 0x77, 0xca, 0xbb, 0xd8, 0x29, 0x2a,
-	0x94, 0xf8, 0xc6, 0x45, 0x24, 0x95, 0xe1, 0x87, 0x4a, 0x08, 0xd1, 0x04, 0x46, 0xfd, 0x9f, 0xf2,
-	0x30, 0x1a, 0x18, 0x87, 0xba, 0xe3, 0x3e, 0xc4, 0xdd, 0xf1, 0x11, 0x18, 0xc5, 0xc8, 0x6b, 0x6b,
-	0xd4, 0xe2, 0xd1, 0xc9, 0xfa, 0xa5, 0x2c, 0x50, 0x3e, 0x42, 0x24, 0xfc, 0x8b, 0x10, 0x32, 0xed,
-	0xe7, 0x96, 0x9f, 0x14, 0x0f, 0x8f, 0x9b, 0x7d, 0x1c, 0xae, 0xfe, 0xad, 0x02, 0x8c, 0xf8, 0x52,
-	0x1e, 0x37, 0x8f, 0xea, 0x2d, 0xd1, 0xe1, 0x0a, 0xf9, 0x1a, 0xc0, 0x82, 0xed, 0x78, 0x7a, 0x7b,
-	0x2e, 0xd4, 0x7c, 0x3c, 0x5e, 0xed, 0x20, 0x94, 0x97, 0x91, 0x48, 0x70, 0xfd, 0x0a, 0xcd, 0x6a,
-	0x3e, 0x31, 0xf1, 0xf5, 0x2b, 0x80, 0x6a, 0x12, 0x85, 0xfa, 0xab, 0x79, 0x38, 0xe1, 0x77, 0xd2,
-	0xe4, 0x03, 0xda, 0xea, 0x3e, 0xcc, 0x73, 0x53, 0x54, 0xda, 0xfd, 0xdb, 0x4a, 0x5b, 0xfd, 0x3f,
-	0xa4, 0x89, 0x64, 0xa2, 0x6d, 0x1f, 0x4f, 0x24, 0x7f, 0x11, 0x3a, 0xae, 0x7e, 0x5f, 0x01, 0x4e,
-	0xfb, 0x52, 0x9f, 0xea, 0x5a, 0x78, 0x30, 0x31, 0xa1, 0xb7, 0xdb, 0x0f, 0xf3, 0x6e, 0x7c, 0xd8,
-	0x17, 0xc4, 0xbc, 0x08, 0x65, 0x2a, 0x92, 0xaf, 0xde, 0x13, 0xe0, 0xa6, 0x6d, 0x1a, 0x9a, 0x4c,
-	0x44, 0xde, 0x80, 0x11, 0xff, 0x67, 0xd5, 0x59, 0xf6, 0xb7, 0xe0, 0x78, 0xcd, 0x10, 0x14, 0xd2,
-	0x9d, 0x48, 0x6c, 0x8e, 0x48, 0x01, 0xf5, 0x73, 0x03, 0x70, 0xe1, 0xae, 0x69, 0x19, 0xf6, 0xba,
-	0xeb, 0xe7, 0xee, 0x3d, 0xf2, 0xc7, 0x6c, 0x87, 0x9d, 0xb3, 0xf7, 0x13, 0x70, 0x26, 0x2e, 0x52,
-	0x27, 0xc8, 0xa8, 0x20, 0x7a, 0x67, 0x9d, 0x13, 0x34, 0xfd, 0x2c, 0xbe, 0xe2, 0xae, 0x4e, 0x4b,
-	0x2f, 0x19, 0x4f, 0x03, 0x3c, 0xb0, 0x93, 0x34, 0xc0, 0x4f, 0x43, 0xa9, 0x66, 0xaf, 0xe9, 0xa6,
-	0x1f, 0xa5, 0x09, 0x47, 0x71, 0x50, 0x2f, 0x62, 0x34, 0x41, 0xc1, 0xf8, 0x8b, 0x8a, 0xb1, 0xcb,
-	0x86, 0x42, 0xfe, 0x7e, 0x01, 0x66, 0xa5, 0x69, 0x32, 0x11, 0xb1, 0x61, 0x54, 0x54, 0x27, 0x6e,
-	0xd6, 0x00, 0x37, 0x4f, 0x2f, 0xf9, 0x32, 0xca, 0x56, 0xab, 0xab, 0x91, 0x72, 0x7c, 0x1b, 0xc5,
-	0xb3, 0x13, 0x8b, 0x8f, 0xe1, 0x77, 0x6c, 0x5a, 0x94, 0xbf, 0x24, 0x04, 0x9c, 0x64, 0x86, 0x93,
-	0x42, 0xc0, 0x59, 0x46, 0x26, 0x22, 0x93, 0x70, 0x12, 0x23, 0xd7, 0x07, 0x5b, 0x29, 0xa6, 0x12,
-	0x23, 0x68, 0x54, 0xe2, 0x85, 0x0d, 0x0f, 0x76, 0xcf, 0x3e, 0xae, 0xd9, 0x12, 0x68, 0x2d, 0x59,
-	0x82, 0x9c, 0x87, 0xc2, 0xdc, 0x4c, 0x15, 0x6f, 0x7a, 0x06, 0x79, 0xce, 0x39, 0xab, 0xad, 0x6b,
-	0x0c, 0x76, 0xe1, 0xe3, 0x40, 0x92, 0x9f, 0xb3, 0xab, 0xdb, 0x9c, 0x7f, 0x2a, 0x6d, 0xf9, 0x8e,
-	0xba, 0x3f, 0xce, 0x41, 0x4c, 0x84, 0x91, 0x74, 0x8f, 0xfd, 0xef, 0x66, 0xba, 0xc7, 0xd2, 0x81,
-	0xa6, 0x7b, 0x54, 0x7f, 0x2e, 0x07, 0x27, 0x13, 0xd9, 0x1d, 0xc8, 0x0b, 0x00, 0x1c, 0x22, 0x45,
-	0x78, 0xc5, 0x00, 0x44, 0x61, 0xc6, 0x07, 0xb1, 0x3c, 0x86, 0x64, 0xe4, 0x1a, 0x0c, 0xf2, 0x5f,
-	0x22, 0xc6, 0x59, 0xb2, 0x48, 0xb7, 0x6b, 0x1a, 0x5a, 0x40, 0x14, 0xd6, 0x82, 0xf7, 0x99, 0x85,
-	0xd4, 0x22, 0xde, 0x46, 0x27, 0xa8, 0x85, 0x91, 0xa9, 0x3f, 0x94, 0x87, 0x91, 0xa0, 0xc1, 0x55,
-	0xe3, 0xb0, 0x74, 0xae, 0x24, 0x12, 0x65, 0x14, 0xb6, 0x4b, 0x94, 0x11, 0x9b, 0x6f, 0x45, 0x66,
-	0x8c, 0x83, 0x7b, 0xd3, 0xf5, 0xa5, 0x3c, 0x9c, 0x08, 0x6a, 0x3d, 0xc4, 0xab, 0xb3, 0xf7, 0x90,
-	0x48, 0xbe, 0x98, 0x03, 0x65, 0xdc, 0x6c, 0xb7, 0x4d, 0x6b, 0xb9, 0x6e, 0xdd, 0xb3, 0x9d, 0x35,
-	0x9c, 0x10, 0x0f, 0xef, 0x08, 0x57, 0xfd, 0x81, 0x1c, 0x9c, 0x14, 0x0d, 0x9a, 0xd0, 0x1d, 0xe3,
-	0xf0, 0xce, 0xc7, 0xe2, 0x2d, 0x39, 0x3c, 0x7d, 0x51, 0x7f, 0x39, 0x0f, 0x30, 0x63, 0xb7, 0x56,
-	0x8f, 0xf8, 0x93, 0xb0, 0xd7, 0xa0, 0xc4, 0x9d, 0xea, 0x85, 0xc6, 0x9e, 0x14, 0x4f, 0x9f, 0xd8,
-	0xa7, 0x71, 0xc4, 0x78, 0x59, 0xcc, 0xc7, 0x25, 0xee, 0x97, 0xaf, 0xe4, 0x34, 0x51, 0x84, 0x55,
-	0xca, 0xe8, 0xc4, 0x82, 0x11, 0x54, 0xca, 0x60, 0xd1, 0x4a, 0xb7, 0x36, 0x2b, 0xc5, 0xb6, 0xdd,
-	0x5a, 0xd5, 0x90, 0x5e, 0xfd, 0x7f, 0x72, 0x5c, 0x76, 0x47, 0xfc, 0x61, 0xab, 0xff, 0xf9, 0xc5,
-	0x5d, 0x7e, 0xfe, 0x5f, 0xcd, 0xc1, 0x69, 0x8d, 0xb6, 0xec, 0xfb, 0xd4, 0xd9, 0x98, 0xb0, 0x0d,
-	0x7a, 0x83, 0x5a, 0xd4, 0x39, 0xac, 0x11, 0xf5, 0x6b, 0x98, 0x59, 0x28, 0x6c, 0xcc, 0x6d, 0x97,
-	0x1a, 0x47, 0x27, 0xeb, 0x93, 0xfa, 0x8d, 0x01, 0x50, 0x52, 0xad, 0xde, 0x23, 0x6b, 0xce, 0x65,
-	0x6e, 0x65, 0x8a, 0x07, 0xb5, 0x95, 0xe9, 0xdf, 0xdd, 0x56, 0xa6, 0xb4, 0xdb, 0xad, 0xcc, 0xc0,
-	0x4e, 0xb6, 0x32, 0x6b, 0xf1, 0xad, 0xcc, 0x20, 0x6e, 0x65, 0x5e, 0xe8, 0xb9, 0x95, 0x99, 0xb4,
-	0x8c, 0x3d, 0x6e, 0x64, 0x8e, 0x6c, 0x3e, 0xf3, 0xbd, 0xec, 0xc0, 0x2e, 0xb3, 0x49, 0xb1, 0x65,
-	0x3b, 0x06, 0x35, 0xc4, 0xc6, 0x0b, 0x4f, 0xfd, 0x1d, 0x01, 0xd3, 0x02, 0x6c, 0x22, 0x39, 0xfc,
-	0xe8, 0x4e, 0x92, 0xc3, 0x1f, 0xc0, 0xfe, 0xeb, 0x0b, 0x79, 0x38, 0x39, 0x41, 0x1d, 0x8f, 0x47,
-	0xb2, 0x3d, 0x08, 0x87, 0xba, 0x2a, 0x9c, 0x90, 0x18, 0xa2, 0x45, 0x9e, 0x0f, 0x9d, 0x04, 0x5b,
-	0xd4, 0xf1, 0xe2, 0x3e, 0x86, 0x71, 0x7a, 0x56, 0xbd, 0x9f, 0xa0, 0x51, 0x8c, 0xdd, 0xa0, 0x7a,
-	0x1f, 0xce, 0x05, 0x69, 0x8a, 0x5f, 0x5a, 0x40, 0x2f, 0xf9, 0xc9, 0x14, 0xf7, 0xe0, 0x27, 0xf3,
-	0xb5, 0x1c, 0x5c, 0xd2, 0xa8, 0x45, 0xd7, 0xf5, 0xa5, 0x36, 0x95, 0x9a, 0x25, 0x56, 0x06, 0x36,
-	0x6b, 0x98, 0xee, 0x9a, 0xee, 0xb5, 0x56, 0xf6, 0x25, 0xa3, 0x29, 0x18, 0x91, 0xe7, 0xaf, 0x5d,
-	0xcc, 0x6d, 0x91, 0x72, 0xea, 0x37, 0x8a, 0x30, 0x30, 0x6e, 0x7b, 0x37, 0xed, 0x7d, 0x26, 0x01,
-	0x0d, 0xa7, 0xfc, 0xfc, 0x2e, 0xce, 0x7a, 0x9e, 0xc3, 0xca, 0xa5, 0xac, 0x1b, 0xe8, 0x80, 0xba,
-	0x64, 0x27, 0x32, 0xc0, 0xf8, 0x64, 0xbb, 0x4c, 0xff, 0xf9, 0x32, 0x0c, 0x61, 0x00, 0x1a, 0xe9,
-	0x34, 0x16, 0xdd, 0xbb, 0x3d, 0x06, 0x8c, 0xd7, 0x11, 0x92, 0x92, 0x4f, 0x45, 0x42, 0xef, 0x96,
-	0xf6, 0x9f, 0x2e, 0x54, 0x8e, 0xc2, 0xfb, 0x02, 0xbf, 0xc8, 0xc3, 0x36, 0x49, 0xc9, 0x91, 0xf0,
-	0x14, 0x25, 0xd6, 0xa4, 0x80, 0xf0, 0x00, 0x53, 0x79, 0x4e, 0xc0, 0xe8, 0xb8, 0xed, 0x49, 0xae,
-	0xc4, 0x43, 0xe1, 0x4b, 0x54, 0x26, 0xf9, 0x74, 0x3f, 0xe2, 0x68, 0x19, 0xf5, 0xcf, 0x8b, 0x30,
-	0xe2, 0xff, 0x3c, 0x24, 0xdd, 0x79, 0x16, 0x4a, 0xd3, 0xb6, 0x94, 0xbb, 0x04, 0xdd, 0x8f, 0x57,
-	0x6c, 0x37, 0xe6, 0x57, 0x2d, 0x88, 0x98, 0xd4, 0xe7, 0x6c, 0x43, 0x76, 0x9e, 0x47, 0xa9, 0x5b,
-	0xb6, 0x91, 0x78, 0xc1, 0x1c, 0x10, 0x92, 0x4b, 0x50, 0xc4, 0x77, 0x07, 0xd2, 0x41, 0x7e, 0xec,
-	0xad, 0x01, 0xe2, 0x25, 0xad, 0x2c, 0xed, 0x56, 0x2b, 0x07, 0xf6, 0xaa, 0x95, 0x83, 0x07, 0xab,
-	0x95, 0x6f, 0xc1, 0x08, 0xd6, 0xe4, 0xa7, 0x97, 0xdc, 0x7e, 0x61, 0x3d, 0x2f, 0xd6, 0xbe, 0x51,
-	0xde, 0x6e, 0x91, 0x64, 0x12, 0x97, 0xbc, 0x08, 0xab, 0x98, 0xee, 0xc2, 0x3e, 0xb6, 0xd3, 0x7f,
-	0x9c, 0x83, 0x81, 0xdb, 0xd6, 0xaa, 0x65, 0xaf, 0xef, 0x4f, 0xe3, 0x5e, 0x80, 0x61, 0xc1, 0x46,
-	0x5a, 0x5d, 0xf0, 0x51, 0x7a, 0x97, 0x83, 0x9b, 0xc8, 0x49, 0x93, 0xa9, 0xc8, 0xeb, 0x41, 0x21,
-	0x7c, 0x5a, 0x54, 0x08, 0xb3, 0xff, 0xf8, 0x85, 0x5a, 0xd1, 0xf4, 0x1f, 0x32, 0x39, 0xb9, 0x08,
-	0xc5, 0x1a, 0x6b, 0xaa, 0x14, 0x06, 0x98, 0x35, 0x45, 0x43, 0xa8, 0xfa, 0x85, 0x22, 0x8c, 0xc5,
-	0x0e, 0xbe, 0x9e, 0x86, 0x21, 0x71, 0xf0, 0x64, 0xfa, 0xf9, 0x48, 0xf0, 0xe9, 0x51, 0x00, 0xd4,
-	0x06, 0xf9, 0x9f, 0x75, 0x83, 0x7c, 0x0c, 0x06, 0x6c, 0x17, 0x17, 0x45, 0xfc, 0x96, 0xb1, 0x70,
-	0x08, 0xcd, 0x37, 0x58, 0xdb, 0xf9, 0xe0, 0x10, 0x24, 0xb2, 0x46, 0xda, 0x2e, 0x7e, 0xda, 0x8b,
-	0x30, 0xa4, 0xbb, 0x2e, 0xf5, 0x9a, 0x9e, 0xbe, 0x2c, 0xa7, 0x28, 0x09, 0x80, 0xf2, 0xe8, 0x40,
-	0xe0, 0xa2, 0xbe, 0x4c, 0x3e, 0x0e, 0xa3, 0x2d, 0x87, 0xe2, 0xb2, 0xa9, 0xb7, 0x59, 0x2b, 0x25,
-	0xb3, 0x36, 0x82, 0x90, 0xef, 0x4f, 0x42, 0x44, 0xdd, 0x20, 0x77, 0x60, 0x54, 0x7c, 0x0e, 0xf7,
-	0xfb, 0xc7, 0x81, 0x36, 0x16, 0x2e, 0x63, 0x5c, 0x24, 0xdc, 0xf3, 0x5f, 0x3c, 0xff, 0x90, 0xc9,
-	0x65, 0xbe, 0x86, 0x44, 0x4a, 0xe6, 0x81, 0xac, 0xd3, 0xa5, 0xa6, 0xde, 0xf5, 0x56, 0x58, 0x5d,
-	0x3c, 0xc2, 0xbe, 0xc8, 0xd7, 0x8a, 0x6f, 0x26, 0x92, 0x58, 0xf9, 0x29, 0xc9, 0x3a, 0x5d, 0xaa,
-	0x46, 0x90, 0xe4, 0x2e, 0x9c, 0x49, 0x16, 0x61, 0x9f, 0xcc, 0x2f, 0x07, 0x9e, 0xdc, 0xda, 0xac,
-	0x54, 0x52, 0x09, 0x24, 0xb6, 0xa7, 0x12, 0x6c, 0xeb, 0xc6, 0xcd, 0xe2, 0xe0, 0x40, 0x79, 0x50,
-	0x1b, 0x63, 0x65, 0x7d, 0x13, 0xd2, 0x34, 0xd4, 0x6f, 0xe7, 0x98, 0xa9, 0xc8, 0x3e, 0x08, 0xd3,
-	0xdd, 0x33, 0x5d, 0x5f, 0xdb, 0xa5, 0xae, 0xaf, 0x85, 0xa9, 0x65, 0x4b, 0x6e, 0x8f, 0xd9, 0x55,
-	0x13, 0x58, 0x72, 0x15, 0x4a, 0x86, 0x7c, 0x6a, 0x76, 0x36, 0xda, 0x09, 0x7e, 0x3d, 0x9a, 0xa0,
-	0x22, 0x97, 0xa1, 0xc8, 0x96, 0xac, 0xf8, 0x96, 0x59, 0xb6, 0x2e, 0x34, 0xa4, 0x50, 0xbf, 0x27,
-	0x0f, 0x23, 0xd2, 0xd7, 0x5c, 0xdf, 0xd7, 0xe7, 0xbc, 0xba, 0xb3, 0x66, 0xfa, 0x4e, 0x2f, 0xb8,
-	0x97, 0xf2, 0x9b, 0xfc, 0x62, 0x20, 0x8a, 0x1d, 0x5d, 0x48, 0x09, 0xc1, 0xbc, 0x2c, 0x3e, 0xb4,
-	0xb4, 0xf3, 0xed, 0x23, 0xa3, 0xbf, 0x59, 0x1c, 0xcc, 0x97, 0x0b, 0x37, 0x8b, 0x83, 0xc5, 0x72,
-	0x3f, 0x86, 0x02, 0xc3, 0xe8, 0xdb, 0x7c, 0x6f, 0x6e, 0xdd, 0x33, 0x97, 0x8f, 0xf8, 0xcb, 0x93,
-	0x83, 0x0d, 0x93, 0x16, 0x93, 0xcd, 0x11, 0x7f, 0x86, 0xf2, 0xae, 0xca, 0xe6, 0x38, 0x15, 0xad,
-	0x90, 0xcd, 0xbf, 0xcc, 0x81, 0x92, 0x2a, 0x9b, 0xea, 0x21, 0xf9, 0x41, 0x1c, 0x5c, 0x42, 0xda,
-	0x3f, 0xcd, 0xc3, 0xc9, 0xba, 0xe5, 0xd1, 0x65, 0xbe, 0x63, 0x3c, 0xe2, 0x53, 0xc5, 0x2d, 0x18,
-	0x96, 0x3e, 0x46, 0xf4, 0xf9, 0x23, 0xc1, 0x7e, 0x3c, 0x44, 0x65, 0x70, 0x92, 0x4b, 0x1f, 0xdc,
-	0x3b, 0x9e, 0xb8, 0x90, 0x8f, 0xf8, 0x9c, 0x73, 0x34, 0x84, 0x7c, 0xc4, 0x27, 0xaf, 0xf7, 0xa8,
-	0x90, 0xbf, 0x54, 0x80, 0x53, 0x29, 0x95, 0x93, 0x4b, 0x30, 0xd0, 0xe8, 0x2e, 0x61, 0xe4, 0xaf,
-	0x5c, 0xe8, 0x31, 0xec, 0x76, 0x97, 0x30, 0xe8, 0x97, 0xe6, 0x23, 0xc9, 0x22, 0x3e, 0xcd, 0x9f,
-	0xaf, 0xd7, 0x26, 0x84, 0x54, 0x55, 0x29, 0xc8, 0x00, 0x03, 0xa7, 0x7d, 0x59, 0xf0, 0x7c, 0xdf,
-	0x36, 0x8d, 0x56, 0xec, 0xf9, 0x3e, 0x2b, 0x43, 0xbe, 0x0b, 0x86, 0xaa, 0xef, 0x74, 0x1d, 0x8a,
-	0x7c, 0xb9, 0xc4, 0x9f, 0x0a, 0xf8, 0xfa, 0x88, 0x34, 0xce, 0x3c, 0x12, 0x01, 0xa3, 0x88, 0xf3,
-	0x0e, 0x19, 0x92, 0x79, 0x28, 0xdd, 0x30, 0xbd, 0xe9, 0xee, 0x92, 0xe8, 0x85, 0x20, 0x3a, 0x18,
-	0x87, 0xa6, 0xf1, 0xc5, 0x5d, 0x39, 0x8f, 0x72, 0x2c, 0xef, 0x81, 0x78, 0x01, 0x32, 0x03, 0xfd,
-	0xd5, 0xbb, 0x0d, 0xad, 0x2a, 0x7a, 0xe2, 0x71, 0x39, 0xce, 0x42, 0x35, 0x93, 0x1d, 0xbe, 0x1a,
-	0xd7, 0xe5, 0x3c, 0x48, 0x48, 0xaf, 0xfe, 0x50, 0x0e, 0x2e, 0x64, 0x0b, 0x8f, 0x3c, 0x07, 0x03,
-	0x9a, 0xdd, 0xa6, 0x55, 0x6d, 0x4e, 0xf4, 0x0c, 0xcf, 0x2d, 0x6d, 0xb7, 0x69, 0x53, 0x77, 0xe4,
-	0xbd, 0x88, 0x4f, 0x46, 0x3e, 0x0a, 0xc3, 0x75, 0xd7, 0xed, 0x52, 0xa7, 0xf1, 0xc2, 0x6d, 0xad,
-	0x2e, 0xb6, 0xac, 0xb8, 0x25, 0x32, 0x11, 0xdc, 0x74, 0x5f, 0x88, 0x85, 0x1e, 0x93, 0xe9, 0xd5,
-	0x1f, 0xcc, 0xc1, 0xc5, 0x5e, 0x42, 0x27, 0x2f, 0xc0, 0xe0, 0x22, 0xb5, 0x74, 0xcb, 0xab, 0xd7,
-	0x44, 0x93, 0x70, 0x07, 0xe8, 0x21, 0x2c, 0xba, 0x91, 0x09, 0x08, 0x59, 0x21, 0x7e, 0xec, 0x19,
-	0xf8, 0x59, 0xf0, 0x23, 0x5a, 0x84, 0xc5, 0x0a, 0xf9, 0x84, 0xea, 0xa7, 0xe0, 0x7c, 0x66, 0x1f,
-	0x91, 0x8f, 0xc1, 0xc8, 0xbc, 0xb3, 0xac, 0x5b, 0xe6, 0x3b, 0x7c, 0x88, 0xe5, 0xc2, 0x5d, 0xb6,
-	0x2d, 0xc1, 0xe5, 0x9d, 0x9f, 0x4c, 0xaf, 0x2e, 0x81, 0x92, 0xd5, 0x61, 0x64, 0x0a, 0xc6, 0x30,
-	0x38, 0x75, 0xd5, 0x6a, 0xad, 0xd8, 0x4e, 0x28, 0x7b, 0x7c, 0x98, 0xe5, 0x31, 0x4c, 0x53, 0x47,
-	0x54, 0xac, 0x0f, 0x62, 0xa5, 0xd4, 0xdf, 0xcb, 0xc3, 0xc8, 0x42, 0xbb, 0xbb, 0x6c, 0x4a, 0x0b,
-	0xf3, 0x9e, 0xf7, 0x33, 0xfe, 0xee, 0x22, 0xbf, 0xbb, 0xdd, 0x05, 0x9b, 0xce, 0x9c, 0x3d, 0x4e,
-	0x67, 0x7e, 0x39, 0xf2, 0x3a, 0x94, 0x3a, 0xf8, 0x1d, 0xf1, 0x93, 0x6e, 0xfe, 0x75, 0x59, 0x27,
-	0xdd, 0xbc, 0x0c, 0x9b, 0xbf, 0x5a, 0xfb, 0x98, 0xbf, 0xc2, 0xb2, 0x92, 0x40, 0xc3, 0x45, 0xf8,
-	0x58, 0xa0, 0x07, 0x22, 0xd0, 0x70, 0xc1, 0x3d, 0x16, 0xe8, 0x3e, 0x04, 0xfa, 0x8d, 0x3c, 0x8c,
-	0x45, 0xab, 0x24, 0xcf, 0xc1, 0x30, 0xaf, 0x86, 0x9f, 0xbb, 0xe5, 0x24, 0xa7, 0xed, 0x10, 0xac,
-	0x01, 0xff, 0x21, 0x0e, 0x10, 0x4f, 0xac, 0xe8, 0x6e, 0x33, 0x3c, 0x01, 0xe3, 0xf7, 0xe3, 0x83,
-	0xdc, 0xd3, 0x2c, 0x86, 0xd2, 0xc6, 0x56, 0x74, 0x77, 0x22, 0xfc, 0x4d, 0x26, 0x81, 0x38, 0xb4,
-	0xeb, 0xd2, 0x28, 0x83, 0x22, 0x32, 0xe0, 0xab, 0x47, 0x02, 0xab, 0x9d, 0xe4, 0x30, 0x99, 0xcd,
-	0xa7, 0x83, 0x66, 0xa3, 0x32, 0xf4, 0xf7, 0x3e, 0x45, 0x7e, 0x72, 0x6b, 0xb3, 0x72, 0x46, 0xa2,
-	0x4f, 0x3f, 0x46, 0xe6, 0x04, 0x35, 0xdd, 0xd3, 0xf9, 0xa1, 0x87, 0xdf, 0x01, 0xea, 0xef, 0x7c,
-	0x6f, 0x0e, 0xfa, 0xe7, 0x2d, 0x3a, 0x7f, 0x8f, 0x3c, 0x0f, 0x43, 0x4c, 0x63, 0x66, 0x6c, 0xd6,
-	0x99, 0x39, 0xe1, 0xa0, 0x22, 0xa9, 0x12, 0x22, 0xa6, 0xfb, 0xb4, 0x90, 0x8a, 0xbc, 0x08, 0x10,
-	0xbe, 0xe1, 0x13, 0xea, 0x47, 0xe4, 0x32, 0x1c, 0x33, 0xdd, 0xa7, 0x49, 0x74, 0x7e, 0x29, 0xf1,
-	0x02, 0xaa, 0x90, 0x2c, 0xc5, 0x31, 0x7e, 0x29, 0x31, 0x40, 0x66, 0x80, 0xb0, 0x5f, 0x0b, 0xba,
-	0xeb, 0xae, 0xdb, 0x8e, 0x31, 0xb1, 0xa2, 0x5b, 0xcb, 0x34, 0xbe, 0x3d, 0x4d, 0x52, 0x4c, 0xf7,
-	0x69, 0x29, 0xe5, 0xc8, 0xab, 0x30, 0x22, 0x7b, 0xec, 0xc6, 0xbd, 0x6a, 0x64, 0xdc, 0x74, 0x9f,
-	0x16, 0xa1, 0x25, 0x1f, 0x86, 0x61, 0xf1, 0xfb, 0xa6, 0x2d, 0xae, 0xec, 0xa5, 0x50, 0x51, 0x12,
-	0x6a, 0xba, 0x4f, 0x93, 0x29, 0xa5, 0x4a, 0x17, 0x1c, 0xd3, 0xf2, 0xc4, 0x23, 0xf0, 0x78, 0xa5,
-	0x88, 0x93, 0x2a, 0xc5, 0xdf, 0xe4, 0xa3, 0x30, 0x1a, 0xc4, 0xe0, 0x7a, 0x9b, 0xb6, 0x3c, 0x71,
-	0xbb, 0x70, 0x26, 0x56, 0x98, 0x23, 0xa7, 0xfb, 0xb4, 0x28, 0x35, 0xb9, 0x0c, 0x25, 0x8d, 0xba,
-	0xe6, 0x3b, 0xfe, 0x7d, 0xfc, 0x98, 0x34, 0xd0, 0xcd, 0x77, 0x98, 0x94, 0x04, 0x9e, 0xf5, 0x4e,
-	0xe8, 0x00, 0x20, 0xee, 0x02, 0x48, 0xac, 0x96, 0x49, 0xcb, 0x60, 0xbd, 0x23, 0x79, 0x7f, 0x7c,
-	0x3c, 0x8c, 0x4c, 0x26, 0x12, 0xf3, 0x0e, 0xc7, 0x43, 0x40, 0xc8, 0xd8, 0xe9, 0x3e, 0x2d, 0x46,
-	0x2f, 0x49, 0xb5, 0x66, 0xba, 0xab, 0x22, 0xa2, 0x6c, 0x5c, 0xaa, 0x0c, 0x25, 0x49, 0x95, 0xfd,
-	0x94, 0xaa, 0x9e, 0xa3, 0xde, 0xba, 0xed, 0xac, 0x8a, 0xf8, 0xb1, 0xf1, 0xaa, 0x05, 0x56, 0xaa,
-	0x5a, 0x40, 0xe4, 0xaa, 0xd9, 0x88, 0x1b, 0x4b, 0xaf, 0x5a, 0xf7, 0x74, 0xb9, 0x6a, 0x7e, 0xd4,
-	0xe9, 0x77, 0xd2, 0x0c, 0xd5, 0xef, 0x53, 0xe5, 0x44, 0x6a, 0x87, 0x22, 0x4e, 0xea, 0x50, 0xfc,
-	0xcd, 0x2a, 0x95, 0xb2, 0xf6, 0x2b, 0xe5, 0x68, 0xa5, 0x12, 0x8a, 0x55, 0x2a, 0xe7, 0xf7, 0x7f,
-	0x51, 0x4e, 0x0d, 0xaf, 0x9c, 0x8c, 0x76, 0x50, 0x88, 0x61, 0x1d, 0x24, 0xa5, 0x90, 0xaf, 0x60,
-	0xda, 0x69, 0x85, 0x20, 0xf9, 0x70, 0xd0, 0xc2, 0x89, 0x85, 0xe9, 0x3e, 0x0d, 0x13, 0x52, 0xab,
-	0x3c, 0xa1, 0xb9, 0x72, 0x0a, 0x29, 0x46, 0x7c, 0x0a, 0x06, 0x9b, 0xee, 0xd3, 0x78, 0xb2, 0xf3,
-	0xe7, 0xa5, 0xa4, 0x8f, 0xca, 0xe9, 0xe8, 0x14, 0x11, 0x20, 0xd8, 0x14, 0x11, 0xa6, 0x86, 0x9c,
-	0x4a, 0xa6, 0x36, 0x54, 0xce, 0x44, 0xd7, 0x9a, 0x38, 0x7e, 0xba, 0x4f, 0x4b, 0xa6, 0x43, 0xfc,
-	0x70, 0x24, 0xdb, 0x9f, 0x72, 0x36, 0x16, 0x9f, 0x2d, 0x44, 0x31, 0x71, 0xc9, 0x79, 0x01, 0xe7,
-	0xe1, 0x14, 0x4f, 0x16, 0x2c, 0x22, 0xac, 0x89, 0xc9, 0xea, 0x5c, 0x74, 0x67, 0x98, 0x42, 0x32,
-	0xdd, 0xa7, 0xa5, 0x95, 0x24, 0x13, 0x89, 0x9c, 0x7b, 0x8a, 0x12, 0x75, 0x3e, 0x8a, 0xa1, 0xa7,
-	0xfb, 0xb4, 0x44, 0x96, 0xbe, 0x17, 0xe5, 0x64, 0x77, 0xca, 0xf9, 0x68, 0x27, 0x86, 0x18, 0xd6,
-	0x89, 0x52, 0x52, 0xbc, 0x17, 0xe5, 0x04, 0x68, 0xca, 0x85, 0x64, 0xa9, 0x70, 0xe6, 0x94, 0x12,
-	0xa5, 0x69, 0xe9, 0x39, 0x9d, 0x94, 0x47, 0x44, 0x66, 0x67, 0x51, 0x3e, 0x8d, 0x66, 0xba, 0x4f,
-	0x4b, 0xcf, 0x07, 0xa5, 0xa5, 0x27, 0x43, 0x52, 0x2e, 0xf6, 0xe2, 0x19, 0xb4, 0x2e, 0x3d, 0x91,
-	0x92, 0xde, 0x23, 0x35, 0x8d, 0xf2, 0x68, 0x74, 0x0f, 0x99, 0x49, 0x38, 0xdd, 0xa7, 0xf5, 0x48,
-	0x70, 0x73, 0x3b, 0x23, 0x4f, 0x8c, 0xf2, 0x58, 0x34, 0xb1, 0x7b, 0x2a, 0xd1, 0x74, 0x9f, 0x96,
-	0x91, 0x65, 0xe6, 0x76, 0x46, 0x1a, 0x11, 0xa5, 0xd2, 0x93, 0x6d, 0x20, 0x8f, 0x8c, 0x24, 0x24,
-	0xf3, 0xa9, 0x19, 0x38, 0x94, 0xc7, 0xa3, 0xaa, 0x9b, 0x42, 0xc2, 0x54, 0x37, 0x2d, 0x77, 0xc7,
-	0x7c, 0x6a, 0xca, 0x08, 0xe5, 0x89, 0x1e, 0x0c, 0x83, 0x36, 0xa6, 0x26, 0x9b, 0x98, 0x4f, 0xcd,
-	0xd9, 0xa0, 0xa8, 0x51, 0x86, 0x29, 0x24, 0x8c, 0x61, 0x5a, 0xb6, 0x87, 0xf9, 0xd4, 0xd0, 0xfe,
-	0xca, 0x93, 0x3d, 0x18, 0x86, 0x2d, 0x4c, 0x4b, 0x0a, 0xf0, 0xe1, 0x48, 0x6c, 0x7d, 0xe5, 0xa9,
-	0xe8, 0xbc, 0x21, 0xa1, 0xd8, 0xbc, 0x21, 0x47, 0xe1, 0x9f, 0x48, 0x04, 0xfe, 0x55, 0x3e, 0x10,
-	0x1d, 0xe6, 0x31, 0x34, 0x1b, 0xe6, 0xf1, 0x50, 0xc1, 0x13, 0x89, 0x00, 0xa8, 0xca, 0xa5, 0x2c,
-	0x26, 0x88, 0x8e, 0x32, 0xe1, 0x21, 0x53, 0xeb, 0x29, 0x11, 0x38, 0x95, 0x0f, 0x46, 0x1d, 0xe7,
-	0x13, 0x04, 0xd3, 0x7d, 0x5a, 0x4a, 0xdc, 0x4e, 0x2d, 0x3d, 0xdc, 0x94, 0x72, 0x39, 0x3a, 0x6c,
-	0xd3, 0x68, 0xd8, 0xb0, 0x4d, 0x0d, 0x55, 0x35, 0x93, 0xf6, 0xba, 0x47, 0xb9, 0x12, 0x35, 0xcc,
-	0x92, 0x14, 0xcc, 0x30, 0x4b, 0x79, 0x15, 0xa4, 0xa5, 0x07, 0x31, 0x52, 0x9e, 0xee, 0xd9, 0x42,
-	0xa4, 0x49, 0x69, 0x21, 0x8f, 0xe9, 0x13, 0xda, 0x4e, 0xb7, 0x3b, 0x6d, 0x5b, 0x37, 0x94, 0x0f,
-	0xa5, 0xda, 0x4e, 0x1c, 0x29, 0xd9, 0x4e, 0x1c, 0xc0, 0x56, 0x79, 0xf9, 0x11, 0x89, 0xf2, 0x4c,
-	0x74, 0x95, 0x97, 0x71, 0x6c, 0x95, 0x8f, 0x3c, 0x38, 0x99, 0x48, 0x3c, 0xb8, 0x50, 0x9e, 0x8d,
-	0x2a, 0x40, 0x0c, 0xcd, 0x14, 0x20, 0xfe, 0x44, 0xe3, 0x33, 0xd9, 0x4f, 0x14, 0x94, 0xab, 0xd1,
-	0xb3, 0xb0, 0x2c, 0xba, 0xe9, 0x3e, 0x2d, 0xfb, 0x99, 0x43, 0x3d, 0xe5, 0xc5, 0x81, 0x72, 0x2d,
-	0xaa, 0x60, 0x09, 0x02, 0xa6, 0x60, 0xc9, 0x77, 0x0a, 0xf5, 0x94, 0x27, 0x03, 0xca, 0x73, 0x99,
-	0xac, 0x82, 0x6f, 0x4e, 0x79, 0x68, 0xf0, 0xa2, 0xec, 0xf3, 0xaf, 0x3c, 0x1f, 0x5d, 0xec, 0x42,
-	0x0c, 0x5b, 0xec, 0xa4, 0xb7, 0x01, 0x2f, 0xca, 0xde, 0xee, 0xca, 0xf5, 0x64, 0xa9, 0x70, 0x89,
-	0x94, 0xbc, 0xe2, 0xb5, 0x74, 0x27, 0x71, 0xe5, 0x85, 0xa8, 0xd6, 0xa5, 0xd1, 0x30, 0xad, 0x4b,
-	0x75, 0x30, 0x9f, 0x4a, 0xfa, 0x7a, 0x2b, 0x2f, 0xc6, 0x77, 0xd9, 0x51, 0x3c, 0xb3, 0x7c, 0x12,
-	0xfe, 0xe1, 0x1f, 0x8f, 0xc7, 0x42, 0x54, 0x5e, 0x8a, 0xdd, 0xab, 0x47, 0xb0, 0xcc, 0xbe, 0x8d,
-	0xc5, 0x4e, 0xfc, 0x78, 0x3c, 0x7c, 0xa0, 0xf2, 0x72, 0x3a, 0x87, 0x40, 0x57, 0xe2, 0xe1, 0x06,
-	0x3f, 0x1e, 0x8f, 0xb8, 0xa7, 0x7c, 0x38, 0x9d, 0x43, 0x20, 0xdd, 0x78, 0x84, 0xbe, 0xe7, 0xa5,
-	0x1c, 0x00, 0xca, 0x47, 0xa2, 0xa6, 0x63, 0x80, 0x60, 0xa6, 0x63, 0x98, 0x29, 0xe0, 0x79, 0x29,
-	0x76, 0xbe, 0xf2, 0x4a, 0xa2, 0x48, 0xd0, 0x58, 0x29, 0xc2, 0xfe, 0xf3, 0x52, 0xcc, 0x79, 0xe5,
-	0xd5, 0x44, 0x91, 0xa0, 0x75, 0x52, 0x64, 0x7a, 0xa3, 0xd7, 0x03, 0x61, 0xe5, 0xb5, 0xe8, 0x69,
-	0x7b, 0x36, 0xe5, 0x74, 0x9f, 0xd6, 0xeb, 0xa1, 0xf1, 0x67, 0xb2, 0x3d, 0xe7, 0x95, 0xd7, 0xa3,
-	0x43, 0x38, 0x8b, 0x8e, 0x0d, 0xe1, 0x4c, 0xef, 0xfb, 0x8f, 0xc6, 0x82, 0x85, 0x28, 0x1f, 0x8d,
-	0x4e, 0x71, 0x11, 0x24, 0x9b, 0xe2, 0xe2, 0xa1, 0x45, 0x22, 0x51, 0x30, 0x94, 0x8f, 0x45, 0xa7,
-	0x38, 0x19, 0xc7, 0xa6, 0xb8, 0x48, 0xc4, 0x8c, 0x89, 0x44, 0x70, 0x06, 0xe5, 0x8d, 0xe8, 0x14,
-	0x17, 0x43, 0xb3, 0x29, 0x2e, 0x1e, 0xce, 0xe1, 0xa3, 0xb1, 0x18, 0x05, 0xca, 0xc7, 0xd3, 0xdb,
-	0x8f, 0x48, 0xb9, 0xfd, 0x3c, 0xa2, 0x81, 0x96, 0xfe, 0xd8, 0x5e, 0xa9, 0x46, 0xc7, 0x6f, 0x1a,
-	0x0d, 0x1b, 0xbf, 0xa9, 0x0f, 0xf5, 0xe3, 0x1b, 0x07, 0xa1, 0x55, 0xe3, 0x3d, 0x36, 0x0e, 0xa1,
-	0x29, 0x92, 0x02, 0x8e, 0xec, 0x91, 0xf9, 0x46, 0x68, 0x22, 0x63, 0x8f, 0xec, 0x6f, 0x83, 0x62,
-	0xf4, 0x6c, 0x76, 0x4d, 0x38, 0x72, 0x2b, 0xb5, 0xe8, 0xec, 0x9a, 0x20, 0x60, 0xb3, 0x6b, 0xd2,
-	0xfd, 0x7b, 0x0a, 0xca, 0x42, 0x8b, 0xb8, 0x7f, 0xba, 0x69, 0x2d, 0x2b, 0x93, 0xb1, 0x07, 0xad,
-	0x31, 0x3c, 0x9b, 0x9d, 0xe2, 0x30, 0x5c, 0xaf, 0x39, 0x6c, 0xa2, 0x6d, 0x76, 0x96, 0x6c, 0xdd,
-	0x31, 0x1a, 0xd4, 0x32, 0x94, 0xa9, 0xd8, 0x7a, 0x9d, 0x42, 0x83, 0xeb, 0x75, 0x0a, 0x1c, 0x63,
-	0xf0, 0xc5, 0xe0, 0x1a, 0x6d, 0x51, 0xf3, 0x3e, 0x55, 0x6e, 0x20, 0xdb, 0x4a, 0x16, 0x5b, 0x41,
-	0x36, 0xdd, 0xa7, 0x65, 0x71, 0x60, 0xb6, 0xfa, 0xec, 0x46, 0xe3, 0x13, 0x33, 0x41, 0x7c, 0x87,
-	0x05, 0x87, 0x76, 0x74, 0x87, 0x2a, 0xd3, 0x51, 0x5b, 0x3d, 0x95, 0x88, 0xd9, 0xea, 0xa9, 0x88,
-	0x24, 0x5b, 0x7f, 0x2c, 0xd4, 0x7b, 0xb1, 0x0d, 0x47, 0x44, 0x7a, 0x69, 0x36, 0x3b, 0x45, 0x11,
-	0x4c, 0x40, 0x33, 0xb6, 0xb5, 0x8c, 0x27, 0x15, 0x37, 0xa3, 0xb3, 0x53, 0x36, 0x25, 0x9b, 0x9d,
-	0xb2, 0xb1, 0x4c, 0xd5, 0xa3, 0x58, 0x3e, 0x06, 0x6f, 0x45, 0x55, 0x3d, 0x85, 0x84, 0xa9, 0x7a,
-	0x0a, 0x38, 0xc9, 0x50, 0xa3, 0x2e, 0xf5, 0x94, 0x99, 0x5e, 0x0c, 0x91, 0x24, 0xc9, 0x10, 0xc1,
-	0x49, 0x86, 0x53, 0xd4, 0x6b, 0xad, 0x28, 0xb3, 0xbd, 0x18, 0x22, 0x49, 0x92, 0x21, 0x82, 0xd9,
-	0x66, 0x33, 0x0a, 0x1e, 0xef, 0xb6, 0x57, 0xfd, 0x3e, 0x9b, 0x8b, 0x6e, 0x36, 0x33, 0x09, 0xd9,
-	0x66, 0x33, 0x13, 0x49, 0x7e, 0x70, 0xc7, 0x0f, 0x0d, 0x94, 0x79, 0xac, 0xf0, 0x6a, 0x68, 0x17,
-	0xec, 0xa4, 0xd4, 0x74, 0x9f, 0xb6, 0xd3, 0x87, 0x0c, 0x1f, 0x0a, 0xbc, 0x72, 0x95, 0x05, 0xac,
-	0xea, 0x44, 0x70, 0x56, 0xc1, 0xc1, 0xd3, 0x7d, 0x5a, 0xe0, 0xb7, 0xfb, 0x61, 0x18, 0xc6, 0x8f,
-	0xaa, 0x5b, 0xa6, 0x57, 0x1b, 0x57, 0x3e, 0x11, 0xdd, 0x32, 0x49, 0x28, 0xb6, 0x65, 0x92, 0x7e,
-	0xb2, 0x49, 0x1c, 0x7f, 0xf2, 0x29, 0xa6, 0x36, 0xae, 0x68, 0xd1, 0x49, 0x3c, 0x82, 0x64, 0x93,
-	0x78, 0x04, 0x10, 0xd4, 0x5b, 0x73, 0xec, 0x4e, 0x6d, 0x5c, 0x69, 0xa4, 0xd4, 0xcb, 0x51, 0x41,
-	0xbd, 0xfc, 0x67, 0x50, 0x6f, 0x63, 0xa5, 0xeb, 0xd5, 0xd8, 0x37, 0x2e, 0xa6, 0xd4, 0xeb, 0x23,
-	0x83, 0x7a, 0x7d, 0x00, 0x9b, 0x0a, 0x11, 0xb0, 0xe0, 0xd8, 0x6c, 0xd2, 0xbe, 0x65, 0xb6, 0xdb,
-	0xca, 0xed, 0xe8, 0x54, 0x18, 0xc7, 0xb3, 0xa9, 0x30, 0x0e, 0x63, 0xa6, 0x27, 0x6f, 0x15, 0x5d,
-	0xea, 0x2e, 0x2b, 0x77, 0xa2, 0xa6, 0x67, 0x88, 0x61, 0xa6, 0x67, 0xf8, 0x0b, 0x77, 0x17, 0xec,
-	0x97, 0x46, 0xef, 0x39, 0xd4, 0x5d, 0x51, 0xee, 0xc6, 0x76, 0x17, 0x12, 0x0e, 0x77, 0x17, 0xd2,
-	0x6f, 0xb2, 0x0c, 0x8f, 0x44, 0x16, 0x1a, 0xff, 0xd6, 0xa6, 0x41, 0x75, 0xa7, 0xb5, 0xa2, 0xbc,
-	0x89, 0xac, 0x9e, 0x4c, 0x5d, 0xaa, 0xa2, 0xa4, 0xd3, 0x7d, 0x5a, 0x2f, 0x4e, 0xb8, 0x2d, 0xff,
-	0xc4, 0x0c, 0x0f, 0xd4, 0xab, 0x2d, 0x4c, 0xf8, 0x9b, 0xd0, 0xb7, 0x62, 0xdb, 0xf2, 0x24, 0x09,
-	0x6e, 0xcb, 0x93, 0x60, 0xd2, 0x81, 0xc7, 0x62, 0x5b, 0xb5, 0x59, 0xbd, 0xcd, 0xf6, 0x25, 0xd4,
-	0x58, 0xd0, 0x5b, 0xab, 0xd4, 0x53, 0x3e, 0x89, 0xbc, 0x2f, 0x65, 0x6c, 0xf8, 0x62, 0xd4, 0xd3,
-	0x7d, 0xda, 0x36, 0xfc, 0x88, 0x0a, 0xc5, 0xc6, 0xd4, 0xe2, 0x82, 0xf2, 0xa9, 0xe8, 0xf9, 0x26,
-	0x83, 0x4d, 0xf7, 0x69, 0x88, 0x63, 0x56, 0xda, 0xed, 0xce, 0xb2, 0xa3, 0x1b, 0x94, 0x1b, 0x5a,
-	0x68, 0xbb, 0x09, 0x03, 0xf4, 0xbb, 0xa2, 0x56, 0x5a, 0x16, 0x1d, 0xb3, 0xd2, 0xb2, 0x70, 0x4c,
-	0x51, 0x23, 0x39, 0x69, 0x94, 0x4f, 0x47, 0x15, 0x35, 0x82, 0x64, 0x8a, 0x1a, 0xcd, 0x60, 0xf3,
-	0x26, 0x9c, 0x0d, 0xf6, 0xf3, 0x62, 0xfd, 0xe5, 0x9d, 0xa6, 0x7c, 0x06, 0xf9, 0x3c, 0x96, 0xb8,
-	0x0c, 0x88, 0x50, 0x4d, 0xf7, 0x69, 0x19, 0xe5, 0xd9, 0x8a, 0x9b, 0xc8, 0xd9, 0x26, 0xcc, 0x8b,
-	0xef, 0x8e, 0xae, 0xb8, 0x19, 0x64, 0x6c, 0xc5, 0xcd, 0x40, 0xa5, 0x32, 0x17, 0x42, 0xd5, 0xb7,
-	0x61, 0x1e, 0xc8, 0x34, 0x8b, 0x43, 0x2a, 0x73, 0x61, 0xa9, 0x2d, 0x6d, 0xc3, 0x3c, 0xb0, 0xd6,
-	0xb2, 0x38, 0x90, 0xcb, 0x50, 0x6a, 0x34, 0x66, 0xb5, 0xae, 0xa5, 0xb4, 0x62, 0xee, 0xc8, 0x08,
-	0x9d, 0xee, 0xd3, 0x04, 0x9e, 0x99, 0x41, 0x93, 0x6d, 0xdd, 0xf5, 0xcc, 0x96, 0x8b, 0x23, 0xc6,
-	0x1f, 0x21, 0x46, 0xd4, 0x0c, 0x4a, 0xa3, 0x61, 0x66, 0x50, 0x1a, 0x9c, 0xd9, 0x8b, 0x13, 0xba,
-	0xeb, 0xea, 0x96, 0xe1, 0xe8, 0xe3, 0xb8, 0x4c, 0xd0, 0xd8, 0x73, 0xb7, 0x08, 0x96, 0xd9, 0x8b,
-	0x51, 0x08, 0x1e, 0xbe, 0xfb, 0x10, 0xdf, 0xcc, 0xb9, 0x17, 0x3b, 0x7c, 0x8f, 0xe1, 0xf1, 0xf0,
-	0x3d, 0x06, 0x43, 0xbb, 0xd3, 0x87, 0x69, 0x74, 0xd9, 0x64, 0x22, 0x52, 0x96, 0x63, 0x76, 0x67,
-	0x9c, 0x00, 0xed, 0xce, 0x38, 0x30, 0xd2, 0x24, 0x7f, 0xb9, 0x5d, 0xc9, 0x68, 0x52, 0xb8, 0xca,
-	0x26, 0xca, 0xb0, 0xf5, 0x3b, 0x1c, 0x1c, 0xb5, 0x0d, 0x4b, 0x5f, 0xb3, 0x6b, 0xe3, 0xbe, 0xd4,
-	0xcd, 0xe8, 0xfa, 0x9d, 0x49, 0xc8, 0xd6, 0xef, 0x4c, 0x24, 0x9b, 0x5d, 0xfd, 0x8d, 0xd6, 0x8a,
-	0xee, 0x50, 0xa3, 0x66, 0x3a, 0x78, 0xb2, 0xb8, 0xc1, 0xb7, 0x86, 0x6f, 0x47, 0x67, 0xd7, 0x1e,
-	0xa4, 0x6c, 0x76, 0xed, 0x81, 0x66, 0x46, 0x5e, 0x3a, 0x5a, 0xa3, 0xba, 0xa1, 0xac, 0x46, 0x8d,
-	0xbc, 0x6c, 0x4a, 0x66, 0xe4, 0x65, 0x63, 0xb3, 0x3f, 0xe7, 0xae, 0x63, 0x7a, 0x54, 0x69, 0xef,
-	0xe4, 0x73, 0x90, 0x34, 0xfb, 0x73, 0x10, 0xcd, 0x36, 0x84, 0xf1, 0x0e, 0x59, 0x8b, 0x6e, 0x08,
-	0x93, 0xdd, 0x10, 0x2f, 0xc1, 0x2c, 0x16, 0xf1, 0xea, 0x51, 0xb1, 0xa2, 0x16, 0x8b, 0x00, 0x33,
-	0x8b, 0x25, 0x7c, 0x17, 0x19, 0x79, 0xeb, 0xa6, 0xd8, 0xd1, 0x35, 0x54, 0xc6, 0xb1, 0x35, 0x34,
-	0xf2, 0x2e, 0xee, 0xc3, 0x91, 0x87, 0x1c, 0x4a, 0x27, 0x6a, 0x75, 0x48, 0x28, 0x66, 0x75, 0xc8,
-	0x4f, 0x3e, 0x26, 0xe0, 0x04, 0xde, 0x82, 0x6b, 0xdd, 0xe0, 0x1e, 0xe7, 0xb3, 0xd1, 0xcf, 0x8c,
-	0xa1, 0xd9, 0x67, 0xc6, 0x40, 0x11, 0x26, 0x62, 0xda, 0x72, 0x32, 0x98, 0x84, 0xe7, 0x83, 0x31,
-	0x10, 0x99, 0x01, 0xd2, 0xa8, 0xce, 0xce, 0xd4, 0x8d, 0x05, 0xf9, 0x8a, 0xcc, 0x8d, 0x9e, 0xc0,
-	0x26, 0x29, 0xa6, 0xfb, 0xb4, 0x94, 0x72, 0xe4, 0x6d, 0xb8, 0x28, 0xa0, 0xe2, 0x49, 0xfb, 0x82,
-	0x63, 0xdf, 0x37, 0x8d, 0x60, 0x41, 0xf0, 0xa2, 0x8e, 0x82, 0xbd, 0x68, 0xa7, 0xfb, 0xb4, 0x9e,
-	0xbc, 0xb2, 0xeb, 0x12, 0xeb, 0x43, 0x77, 0x27, 0x75, 0x05, 0x8b, 0x44, 0x4f, 0x5e, 0xd9, 0x75,
-	0x09, 0xb9, 0xdf, 0xdf, 0x49, 0x5d, 0x41, 0x27, 0xf4, 0xe4, 0x45, 0x5c, 0xa8, 0xf4, 0xc2, 0x57,
-	0xdb, 0x6d, 0x65, 0x1d, 0xab, 0xfb, 0xe0, 0x4e, 0xaa, 0xab, 0xa2, 0xc1, 0xb9, 0x1d, 0x47, 0x36,
-	0x4b, 0xcf, 0x77, 0xa8, 0xd5, 0x88, 0x2c, 0x40, 0x0f, 0xa2, 0xb3, 0x74, 0x82, 0x80, 0xcd, 0xd2,
-	0x09, 0x20, 0x1b, 0x50, 0xf2, 0x7b, 0x20, 0x65, 0x23, 0x3a, 0xa0, 0x64, 0x1c, 0x1b, 0x50, 0x91,
-	0xb7, 0x43, 0xf3, 0x70, 0x6a, 0x7e, 0xd5, 0xd3, 0x7d, 0x0b, 0xd2, 0x15, 0x5d, 0xf9, 0x4e, 0xec,
-	0x92, 0x29, 0x49, 0x82, 0x97, 0x4c, 0x49, 0x30, 0x1b, 0x23, 0x0c, 0xdc, 0xd8, 0xb0, 0x5a, 0x53,
-	0xba, 0xd9, 0xee, 0x3a, 0x54, 0xf9, 0x4b, 0xd1, 0x31, 0x12, 0x43, 0xb3, 0x31, 0x12, 0x03, 0xb1,
-	0x05, 0x9a, 0x81, 0xaa, 0xae, 0x6b, 0x2e, 0x5b, 0x62, 0x5f, 0xd9, 0x6d, 0x7b, 0xca, 0xff, 0x2f,
-	0xba, 0x40, 0xa7, 0xd1, 0xb0, 0x05, 0x3a, 0x0d, 0x8e, 0xa7, 0x4e, 0xac, 0x17, 0xd8, 0xe2, 0x21,
-	0xdf, 0x55, 0xfe, 0xff, 0x63, 0xa7, 0x4e, 0x29, 0x34, 0x78, 0xea, 0x94, 0x02, 0x67, 0xeb, 0x23,
-	0xb7, 0xc9, 0x66, 0xcc, 0xe0, 0xae, 0xfa, 0x3f, 0x88, 0xae, 0x8f, 0x71, 0x3c, 0x5b, 0x1f, 0xe3,
-	0xb0, 0x28, 0x1f, 0xd1, 0x05, 0xff, 0x61, 0x16, 0x9f, 0x40, 0xfe, 0x89, 0x32, 0xe4, 0x86, 0xcc,
-	0x47, 0x8c, 0x94, 0xef, 0xc9, 0x65, 0x31, 0x0a, 0x86, 0x47, 0xa2, 0x50, 0x94, 0x91, 0x46, 0xef,
-	0x9b, 0x74, 0x5d, 0xf9, 0x5c, 0x26, 0x23, 0x4e, 0x10, 0x65, 0xc4, 0x61, 0xe4, 0x2d, 0x38, 0x1b,
-	0xc2, 0x66, 0xe9, 0xda, 0x52, 0x30, 0x33, 0x7d, 0x6f, 0x2e, 0x6a, 0x06, 0xa7, 0x93, 0x31, 0x33,
-	0x38, 0x1d, 0x93, 0xc6, 0x5a, 0x88, 0xee, 0x2f, 0x6f, 0xc3, 0x3a, 0x90, 0x60, 0x06, 0x83, 0x34,
-	0xd6, 0x42, 0x9a, 0xdf, 0xb7, 0x0d, 0xeb, 0x40, 0xa6, 0x19, 0x0c, 0xc8, 0xe7, 0x73, 0x70, 0x29,
-	0x1d, 0x55, 0x6d, 0xb7, 0xa7, 0x6c, 0x27, 0xc4, 0x29, 0x7f, 0x25, 0x17, 0x3d, 0x68, 0xd8, 0x59,
-	0xb1, 0xe9, 0x3e, 0x6d, 0x87, 0x15, 0x90, 0x8f, 0xc1, 0x68, 0xb5, 0x6b, 0x98, 0x1e, 0x5e, 0xbc,
-	0x31, 0xc3, 0xf9, 0xfb, 0x73, 0xb1, 0x2d, 0x8e, 0x8c, 0xc5, 0x2d, 0x8e, 0x0c, 0x20, 0x37, 0xe1,
-	0x64, 0x83, 0xb6, 0xba, 0x8e, 0xe9, 0x6d, 0x68, 0xb4, 0x63, 0x3b, 0x1e, 0xe3, 0xf1, 0x03, 0xb9,
-	0xe8, 0x24, 0x96, 0xa0, 0x60, 0x93, 0x58, 0x02, 0x48, 0xee, 0x24, 0x6e, 0xe5, 0x45, 0x67, 0xfe,
-	0x60, 0xae, 0xe7, 0xb5, 0x7c, 0xd0, 0x97, 0xe9, 0xc5, 0xc9, 0x42, 0xec, 0x16, 0x5d, 0x70, 0xfd,
-	0x7c, 0xae, 0xc7, 0x35, 0xba, 0x34, 0xc3, 0x25, 0xc1, 0x8c, 0x63, 0x4a, 0x96, 0x7f, 0xe5, 0xaf,
-	0xe6, 0x7a, 0x5c, 0x7b, 0x87, 0x1c, 0x53, 0xc0, 0xe4, 0x25, 0xee, 0x29, 0x22, 0x18, 0xfd, 0xb5,
-	0x5c, 0xd2, 0x55, 0x24, 0x28, 0x2f, 0x11, 0xb2, 0x62, 0xb7, 0xdd, 0x40, 0xe9, 0xbf, 0x90, 0x4b,
-	0xfa, 0xe6, 0x85, 0xc5, 0xc2, 0x5f, 0x84, 0xc2, 0x85, 0xc9, 0x07, 0x1e, 0x75, 0x2c, 0xbd, 0x8d,
-	0xdd, 0xd9, 0xf0, 0x6c, 0x47, 0x5f, 0xa6, 0x93, 0x96, 0xbe, 0xd4, 0xa6, 0xca, 0x0f, 0xe5, 0xa2,
-	0x16, 0x6c, 0x36, 0x29, 0xb3, 0x60, 0xb3, 0xb1, 0x64, 0x05, 0x1e, 0x49, 0xc3, 0xd6, 0x4c, 0x17,
-	0xeb, 0xf9, 0x62, 0x2e, 0x6a, 0xc2, 0xf6, 0xa0, 0x65, 0x26, 0x6c, 0x0f, 0x34, 0xb9, 0x0e, 0x43,
-	0xe3, 0xb6, 0x3f, 0xfd, 0xfe, 0x70, 0xcc, 0x19, 0x32, 0xc0, 0x4c, 0xf7, 0x69, 0x21, 0x99, 0x28,
-	0x23, 0x06, 0xf5, 0x97, 0x92, 0x65, 0xc2, 0xcb, 0xa7, 0xe0, 0x87, 0x28, 0x23, 0xc4, 0xfd, 0x1f,
-	0x25, 0xcb, 0x84, 0x77, 0x5c, 0xc1, 0x0f, 0x36, 0x93, 0xf0, 0x1a, 0x67, 0xa7, 0xaa, 0xcc, 0x6e,
-	0x9b, 0x58, 0xd1, 0xdb, 0x6d, 0x6a, 0x2d, 0x53, 0xe5, 0xcb, 0xb1, 0x99, 0x24, 0x9d, 0x8c, 0xcd,
-	0x24, 0xe9, 0x18, 0xf2, 0x5d, 0x70, 0xee, 0x8e, 0xde, 0x36, 0x8d, 0x10, 0xe7, 0xe7, 0x7c, 0x57,
-	0x7e, 0x24, 0x17, 0xdd, 0x4d, 0x67, 0xd0, 0xb1, 0xdd, 0x74, 0x06, 0x8a, 0xcc, 0x02, 0xc1, 0x65,
-	0x34, 0x98, 0x2d, 0xd8, 0xfa, 0xac, 0xfc, 0xc7, 0xb9, 0xa8, 0x9d, 0x9a, 0x24, 0x61, 0x76, 0x6a,
-	0x12, 0x4a, 0x9a, 0xd9, 0xb9, 0x57, 0x94, 0x1f, 0xcd, 0x45, 0x4f, 0x6b, 0xb2, 0x08, 0xa7, 0xfb,
-	0xb4, 0xec, 0x04, 0x2e, 0x37, 0xa0, 0xdc, 0x58, 0xa8, 0x4f, 0x4d, 0x4d, 0x36, 0xee, 0xd4, 0x6b,
-	0xf8, 0x54, 0xc3, 0x50, 0x7e, 0x2c, 0xb6, 0x62, 0xc5, 0x09, 0xd8, 0x8a, 0x15, 0x87, 0x91, 0xd7,
-	0x60, 0x84, 0xb5, 0x9f, 0x0d, 0x18, 0xfc, 0xe4, 0xaf, 0xe4, 0xa2, 0xe6, 0x94, 0x8c, 0x64, 0xe6,
-	0x94, 0xfc, 0x9b, 0x34, 0xe0, 0x34, 0x93, 0xe2, 0x82, 0x43, 0xef, 0x51, 0x87, 0x5a, 0x2d, 0x7f,
-	0x4c, 0xff, 0x78, 0x2e, 0x6a, 0x65, 0xa4, 0x11, 0x31, 0x2b, 0x23, 0x0d, 0x4e, 0x56, 0xe1, 0x62,
-	0xfc, 0x24, 0x48, 0x7e, 0xd7, 0xab, 0xfc, 0xf5, 0x5c, 0xcc, 0x18, 0xee, 0x41, 0x8c, 0xc6, 0x70,
-	0x0f, 0x3c, 0xb1, 0xe0, 0x51, 0x71, 0xac, 0x22, 0x1c, 0x2e, 0xe3, 0xb5, 0xfd, 0x04, 0xaf, 0xed,
-	0x03, 0xa1, 0x43, 0x60, 0x0f, 0xea, 0xe9, 0x3e, 0xad, 0x37, 0x3b, 0xa6, 0x67, 0xc9, 0x0c, 0x23,
-	0xca, 0x4f, 0xe6, 0xd2, 0x3d, 0x52, 0x22, 0x6e, 0xca, 0x69, 0xa9, 0x49, 0xde, 0xca, 0xca, 0x8f,
-	0xa1, 0xfc, 0x8d, 0xd8, 0x78, 0x4b, 0x27, 0x63, 0xe3, 0x2d, 0x23, 0xc1, 0xc6, 0x4d, 0x38, 0xc9,
-	0x95, 0x7a, 0x41, 0xc7, 0x61, 0x68, 0x2d, 0x53, 0x43, 0xf9, 0x9b, 0xb1, 0xd5, 0x2e, 0x41, 0x81,
-	0xae, 0x3d, 0x71, 0x20, 0x9b, 0xba, 0x1b, 0x1d, 0xdd, 0xb2, 0xf0, 0x98, 0x55, 0xf9, 0x4f, 0x62,
-	0x53, 0x77, 0x88, 0x42, 0xc7, 0xdd, 0xe0, 0x17, 0xd3, 0x84, 0x5e, 0xb9, 0xa5, 0x94, 0xff, 0x34,
-	0xa6, 0x09, 0xbd, 0x88, 0x99, 0x26, 0xf4, 0x4c, 0x54, 0x75, 0x27, 0xe3, 0x8d, 0xbd, 0xf2, 0xd5,
-	0xd8, 0x8a, 0x9c, 0x4a, 0xc5, 0x56, 0xe4, 0xf4, 0x27, 0xfa, 0x77, 0x32, 0xde, 0xa7, 0x2b, 0x3f,
-	0xd5, 0x9b, 0x6f, 0xb8, 0xd2, 0xa7, 0x3f, 0x6f, 0xbf, 0x93, 0xf1, 0xb6, 0x5b, 0xf9, 0x5b, 0xbd,
-	0xf9, 0x86, 0x8e, 0x7d, 0xe9, 0x4f, 0xc3, 0x9b, 0xd9, 0xef, 0xa2, 0x95, 0xbf, 0x1d, 0x9f, 0xba,
-	0x32, 0x08, 0x71, 0xea, 0xca, 0x7a, 0x5c, 0xbd, 0x04, 0xe7, 0xb9, 0x86, 0xdc, 0x70, 0xf4, 0xce,
-	0x4a, 0x83, 0x7a, 0x9e, 0x69, 0x2d, 0xfb, 0x3b, 0xb1, 0xff, 0x2c, 0x17, 0x3b, 0x1e, 0xcb, 0xa2,
-	0xc4, 0xe3, 0xb1, 0x2c, 0x24, 0x53, 0xde, 0xc4, 0x0b, 0x68, 0xe5, 0xef, 0xc4, 0x94, 0x37, 0x41,
-	0xc1, 0x94, 0x37, 0xf9, 0x70, 0xfa, 0x66, 0xca, 0x43, 0x5f, 0xe5, 0x3f, 0xcf, 0xe6, 0x15, 0xb4,
-	0x2f, 0xe5, 0x7d, 0xf0, 0xcd, 0x94, 0xf7, 0xac, 0xca, 0x7f, 0x91, 0xcd, 0x2b, 0xf4, 0x41, 0x4a,
-	0x3e, 0x83, 0x7d, 0x0b, 0xce, 0xf2, 0xd9, 0x7c, 0x8a, 0x1a, 0x34, 0xf2, 0xa1, 0x3f, 0x1d, 0x1b,
-	0xfb, 0xe9, 0x64, 0x78, 0xe4, 0x9e, 0x8a, 0x49, 0x63, 0x2d, 0xda, 0xfa, 0x77, 0xb7, 0x61, 0x1d,
-	0x6e, 0x08, 0xd2, 0x31, 0x6c, 0xbd, 0x91, 0x5f, 0xbf, 0x29, 0x3f, 0x13, 0x5b, 0x6f, 0x64, 0x24,
-	0xba, 0x73, 0xc8, 0x4f, 0xe5, 0x5e, 0x8b, 0xbe, 0xf4, 0x52, 0x7e, 0x36, 0xb5, 0x70, 0xd0, 0x01,
-	0xd1, 0x67, 0x61, 0xaf, 0x45, 0x5f, 0x35, 0x29, 0x5f, 0x4b, 0x2d, 0x1c, 0x7c, 0x40, 0xf4, 0x09,
-	0x14, 0xdb, 0x22, 0x75, 0x3d, 0x9b, 0xb3, 0x8a, 0x4c, 0x0f, 0x7f, 0x2f, 0xbe, 0x45, 0x4a, 0x25,
-	0xc3, 0x2d, 0x52, 0x2a, 0x26, 0x8d, 0xb5, 0xf8, 0xbc, 0x9f, 0xdb, 0x86, 0xb5, 0xb4, 0xb1, 0x4b,
-	0xc5, 0xa4, 0xb1, 0x16, 0x1f, 0xff, 0xf5, 0x6d, 0x58, 0x4b, 0x1b, 0xbb, 0x54, 0x0c, 0x33, 0xc7,
-	0x42, 0xcc, 0x1d, 0xea, 0xb8, 0xa1, 0xfa, 0xfd, 0x97, 0x31, 0x73, 0x2c, 0x83, 0x8e, 0x99, 0x63,
-	0x19, 0xa8, 0x54, 0xee, 0x42, 0x28, 0x3f, 0xbf, 0x1d, 0xf7, 0xf0, 0x5e, 0x26, 0x03, 0x95, 0xca,
-	0x5d, 0xc8, 0xe5, 0xef, 0x6f, 0xc7, 0x3d, 0xbc, 0x98, 0xc9, 0x40, 0x31, 0xa3, 0xa8, 0xe1, 0xe9,
-	0x9e, 0xd9, 0x9a, 0xb6, 0x5d, 0x4f, 0x5a, 0xe4, 0xff, 0xab, 0x98, 0x51, 0x94, 0x46, 0xc4, 0x8c,
-	0xa2, 0x34, 0x78, 0x92, 0xa9, 0x90, 0xc6, 0x37, 0x7a, 0x32, 0x0d, 0x2d, 0xad, 0x34, 0x78, 0x92,
-	0xa9, 0x10, 0xc2, 0x7f, 0xdd, 0x93, 0x69, 0xe8, 0x29, 0x9f, 0x06, 0x67, 0x96, 0xe9, 0x84, 0x63,
-	0xaf, 0x5b, 0x37, 0xe9, 0x3a, 0x6d, 0x8b, 0x4f, 0xff, 0x85, 0x98, 0x65, 0x1a, 0x27, 0xc0, 0x5b,
-	0x94, 0x18, 0x2c, 0xca, 0x48, 0x7c, 0xee, 0x2f, 0x66, 0x32, 0x0a, 0x8f, 0x89, 0xe2, 0xb0, 0x28,
-	0x23, 0xf1, 0x89, 0xbf, 0x94, 0xc9, 0x28, 0x3c, 0x26, 0x8a, 0xc3, 0x48, 0x15, 0xc6, 0xf0, 0xad,
-	0x84, 0xee, 0xfa, 0x9e, 0x9f, 0xbf, 0x96, 0x8b, 0xde, 0x7a, 0x45, 0xd1, 0xd3, 0x7d, 0x5a, 0xac,
-	0x80, 0xcc, 0x42, 0x7c, 0xd2, 0x37, 0x33, 0x58, 0x84, 0xfe, 0x8e, 0x51, 0x88, 0xcc, 0x42, 0x7c,
-	0xcc, 0x3f, 0xc8, 0x60, 0x11, 0x3a, 0x3c, 0x46, 0x21, 0xe4, 0x23, 0x30, 0xdc, 0x98, 0x5a, 0x5c,
-	0xf0, 0xf3, 0x1f, 0xfe, 0xc3, 0x5c, 0xec, 0x55, 0x51, 0x88, 0xc3, 0x57, 0x45, 0xe1, 0x4f, 0xf2,
-	0x31, 0x18, 0x9d, 0xb0, 0x2d, 0x4f, 0x6f, 0xf9, 0x1b, 0xd0, 0x5f, 0x8f, 0x9d, 0xa1, 0x44, 0xb0,
-	0xd3, 0x7d, 0x5a, 0x94, 0x5c, 0x2a, 0x2f, 0xda, 0xfe, 0x1b, 0xe9, 0xe5, 0x83, 0xa6, 0x47, 0xc9,
-	0xd9, 0x8c, 0x76, 0xd7, 0x76, 0x56, 0xdb, 0xb6, 0x6e, 0xf8, 0x21, 0x37, 0x45, 0x43, 0xfe, 0x51,
-	0x6c, 0x46, 0x4b, 0x27, 0x63, 0x33, 0x5a, 0x3a, 0x26, 0x8d, 0xb5, 0xe8, 0xa2, 0xdf, 0xdc, 0x86,
-	0x75, 0x38, 0x0f, 0xa7, 0x63, 0xd2, 0x58, 0x8b, 0xcf, 0xff, 0xc7, 0xdb, 0xb0, 0x0e, 0xe7, 0xe1,
-	0x74, 0x0c, 0x33, 0xad, 0x6f, 0x98, 0x9e, 0xff, 0xb0, 0xed, 0x9f, 0xc4, 0x4c, 0xeb, 0x10, 0xc5,
-	0x4c, 0xeb, 0xf0, 0x17, 0xa1, 0x70, 0x21, 0x78, 0x2a, 0x19, 0xee, 0x5d, 0xeb, 0xd6, 0x7d, 0xb6,
-	0x3f, 0x56, 0xfe, 0x69, 0xec, 0x54, 0x24, 0x9b, 0x74, 0xba, 0x4f, 0xeb, 0xc1, 0x88, 0x2c, 0xc4,
-	0xfc, 0x14, 0x79, 0x50, 0x3f, 0xe5, 0x9f, 0xe5, 0x7a, 0x38, 0x2a, 0x72, 0x9a, 0x84, 0xa3, 0x22,
-	0x07, 0x8b, 0x39, 0x6b, 0xa9, 0x4d, 0x6f, 0xcf, 0xd5, 0xdf, 0x94, 0x66, 0xd7, 0x6f, 0x25, 0xe7,
-	0xac, 0x04, 0x91, 0x98, 0xb3, 0x12, 0x70, 0xf2, 0x97, 0x73, 0xf0, 0x54, 0x5c, 0xbe, 0x6f, 0xbe,
-	0xf4, 0xdc, 0x2b, 0x1a, 0xbd, 0x6f, 0xb7, 0x64, 0xcb, 0xea, 0xb7, 0x78, 0x2d, 0xcf, 0x64, 0x75,
-	0x57, 0x5a, 0xa1, 0xe9, 0x3e, 0x6d, 0x47, 0xcc, 0x77, 0xd0, 0x0a, 0xa1, 0x34, 0xbf, 0xbd, 0xab,
-	0x56, 0x04, 0x2a, 0xb4, 0x23, 0xe6, 0x3b, 0x68, 0x85, 0x18, 0x15, 0xdf, 0xde, 0x55, 0x2b, 0x82,
-	0x31, 0xb2, 0x23, 0xe6, 0xb8, 0xfb, 0xbc, 0xdb, 0xa8, 0x4f, 0x04, 0xbe, 0x3e, 0x1b, 0x56, 0x4b,
-	0xf9, 0x9d, 0xf8, 0xee, 0x33, 0x4e, 0x81, 0xbb, 0xcf, 0x38, 0x90, 0x2d, 0xf7, 0xd3, 0x54, 0x6f,
-	0xb3, 0xed, 0x28, 0x6d, 0xad, 0x46, 0x8c, 0xb7, 0xdf, 0x8d, 0x2d, 0xf7, 0x19, 0x74, 0x6c, 0xb9,
-	0xcf, 0x40, 0xa5, 0x72, 0x17, 0x12, 0xfa, 0xbd, 0xed, 0xb8, 0x87, 0xa6, 0x4a, 0x06, 0x2a, 0x95,
-	0xbb, 0xd0, 0x82, 0xff, 0x66, 0x3b, 0xee, 0xa1, 0xa9, 0x92, 0x81, 0x22, 0x3f, 0x9c, 0x83, 0xcb,
-	0x69, 0xdd, 0xc1, 0x63, 0x7f, 0xcc, 0xdf, 0xa7, 0x8e, 0x63, 0x1a, 0xfe, 0x05, 0xf2, 0xef, 0xf3,
-	0xfa, 0x9e, 0xeb, 0xd5, 0xdf, 0x69, 0x05, 0xa7, 0xfb, 0xb4, 0x1d, 0x57, 0xb2, 0xc3, 0x16, 0x09,
-	0x09, 0xfc, 0xc1, 0xae, 0x5b, 0x14, 0x88, 0x64, 0xc7, 0x95, 0xe0, 0x84, 0x63, 0x2e, 0xbb, 0x9e,
-	0xed, 0xd0, 0x05, 0xbb, 0x6d, 0xb6, 0xfc, 0xf5, 0xe6, 0x0f, 0xe3, 0x13, 0x4e, 0x0a, 0x11, 0x4e,
-	0x38, 0x29, 0xf0, 0x24, 0x53, 0xa1, 0x31, 0xff, 0xbc, 0x27, 0x53, 0xc9, 0x9c, 0x4b, 0x81, 0x27,
-	0x99, 0x0a, 0x31, 0xfd, 0x8b, 0x9e, 0x4c, 0x25, 0x73, 0x2e, 0x05, 0x4e, 0x2c, 0x78, 0x34, 0x34,
-	0x74, 0xab, 0xcb, 0xd4, 0xf2, 0x34, 0xbb, 0xdd, 0xb6, 0xbb, 0xde, 0xa2, 0x63, 0x2e, 0x2f, 0x53,
-	0x47, 0xf9, 0xa3, 0xd8, 0x01, 0x59, 0x4f, 0xea, 0xe9, 0x3e, 0xad, 0x37, 0x3b, 0xe2, 0x41, 0x25,
-	0x9d, 0x60, 0xca, 0x76, 0x5a, 0xb4, 0x66, 0x5b, 0x54, 0xf9, 0xe3, 0x5c, 0xf4, 0x7a, 0x7a, 0x1b,
-	0xfa, 0xe9, 0x3e, 0x6d, 0x3b, 0x96, 0xe4, 0xb3, 0xf0, 0x58, 0x3a, 0x09, 0xfb, 0x6f, 0x49, 0x6f,
-	0xad, 0x2a, 0xff, 0x6d, 0x2e, 0xea, 0xf3, 0xd7, 0x9b, 0x7c, 0xba, 0x4f, 0xdb, 0x86, 0xe1, 0xf8,
-	0x00, 0xf4, 0xe3, 0xa5, 0xf4, 0xcd, 0xd2, 0xe0, 0x2f, 0xe7, 0xca, 0xbf, 0x92, 0xbb, 0x59, 0x1a,
-	0xfc, 0x95, 0x5c, 0xf9, 0x57, 0xd9, 0xff, 0xbf, 0x9a, 0x2b, 0xff, 0x5a, 0x4e, 0x3b, 0x1f, 0x63,
-	0xb0, 0xd0, 0xd6, 0xc5, 0x4a, 0x91, 0x8a, 0xe2, 0x3f, 0x53, 0x51, 0x22, 0x6b, 0xeb, 0x57, 0x73,
-	0x30, 0xd2, 0xf0, 0x1c, 0xaa, 0xaf, 0x89, 0x20, 0xc8, 0x17, 0x60, 0x90, 0x3f, 0x23, 0xf3, 0xa3,
-	0xf6, 0x68, 0xc1, 0x6f, 0x72, 0x09, 0xc6, 0x66, 0x74, 0xd7, 0xc3, 0x26, 0xd6, 0x2d, 0x83, 0x3e,
-	0xc0, 0x10, 0x0a, 0x05, 0x2d, 0x06, 0x25, 0x33, 0x9c, 0x8e, 0x97, 0xc3, 0xb8, 0xf7, 0x85, 0x6d,
-	0x63, 0xff, 0x0e, 0x7e, 0x6b, 0xb3, 0xd2, 0x87, 0xa1, 0x7e, 0x63, 0x65, 0xd5, 0x6f, 0xe7, 0x20,
-	0xf1, 0xc0, 0x6d, 0xef, 0xc1, 0xbe, 0xe6, 0xe1, 0x44, 0x2c, 0xd7, 0x82, 0x88, 0x03, 0xb1, 0xc3,
-	0x54, 0x0c, 0xf1, 0xd2, 0xe4, 0x83, 0x41, 0xfc, 0x81, 0xdb, 0xda, 0x8c, 0x88, 0xeb, 0x8c, 0x19,
-	0xc9, 0xba, 0x4e, 0x5b, 0x93, 0x50, 0x22, 0x6e, 0xe7, 0x77, 0xca, 0x61, 0x20, 0x79, 0x72, 0x49,
-	0x44, 0x1e, 0xcb, 0x85, 0xd1, 0xa0, 0xbb, 0x2e, 0x75, 0xe4, 0x68, 0xd0, 0x18, 0x69, 0xec, 0x63,
-	0x30, 0x52, 0x5f, 0xeb, 0x50, 0xc7, 0xb5, 0x2d, 0xdd, 0xb3, 0x1d, 0x11, 0x19, 0x09, 0x63, 0x18,
-	0x99, 0x12, 0x5c, 0x8e, 0x61, 0x24, 0xd3, 0x93, 0x2b, 0x7e, 0x52, 0xe5, 0x02, 0x86, 0xf0, 0xc7,
-	0xe8, 0x20, 0x98, 0x54, 0x59, 0x0e, 0x33, 0x85, 0x14, 0x8c, 0xf4, 0xb6, 0xab, 0x63, 0xa4, 0x8a,
-	0x80, 0xb4, 0xcb, 0x00, 0x32, 0x29, 0x52, 0x90, 0x67, 0xa0, 0x84, 0x26, 0x9e, 0x8b, 0xc9, 0xd2,
-	0x45, 0x8c, 0xea, 0x36, 0x42, 0xe4, 0x68, 0x58, 0x9c, 0x86, 0xdc, 0x82, 0x72, 0xe8, 0xb6, 0x78,
-	0xc3, 0xb1, 0xbb, 0x1d, 0x3f, 0x3d, 0x62, 0x65, 0x6b, 0xb3, 0xf2, 0xc8, 0x6a, 0x80, 0x6b, 0x2e,
-	0x23, 0x52, 0x62, 0x91, 0x28, 0x48, 0xa6, 0xe1, 0x44, 0x08, 0x63, 0x22, 0xf2, 0xd3, 0xb2, 0x62,
-	0xe4, 0x25, 0x89, 0x17, 0x13, 0x67, 0x24, 0x25, 0x7e, 0xac, 0x18, 0xa9, 0xc3, 0x80, 0x1f, 0xa0,
-	0x7a, 0x70, 0x5b, 0x25, 0x3d, 0x25, 0x02, 0x54, 0x0f, 0xc8, 0xa1, 0xa9, 0xfd, 0xf2, 0x64, 0x0a,
-	0xc6, 0x34, 0xbb, 0xeb, 0xd1, 0x45, 0x5b, 0x9c, 0xf7, 0x8b, 0x40, 0xe8, 0xd8, 0x26, 0x87, 0x61,
-	0x9a, 0x9e, 0xdd, 0x6c, 0x71, 0x9c, 0x1c, 0x0d, 0x2a, 0x5a, 0x8a, 0xcc, 0xc1, 0xc9, 0x84, 0x83,
-	0x27, 0x06, 0xb6, 0x18, 0xe2, 0xa1, 0x86, 0xa5, 0xcf, 0x4b, 0x32, 0x4b, 0x16, 0x25, 0xdf, 0x9f,
-	0x83, 0xd2, 0xa2, 0xa3, 0x9b, 0x9e, 0x2b, 0x82, 0x5c, 0x9c, 0xb9, 0xba, 0xee, 0xe8, 0x1d, 0xa6,
-	0x1f, 0x57, 0x31, 0x47, 0xc3, 0x1d, 0xbd, 0xdd, 0xa5, 0xee, 0xf8, 0x5d, 0xf6, 0x75, 0xff, 0xdd,
-	0x66, 0xe5, 0x35, 0x1e, 0xd1, 0xec, 0x6a, 0xcb, 0x5e, 0xbb, 0xb6, 0xec, 0xe8, 0xf7, 0x4d, 0x0f,
-	0xad, 0x30, 0xbd, 0x7d, 0xcd, 0xa3, 0x6d, 0xbc, 0xad, 0xbe, 0xa6, 0x77, 0xcc, 0x6b, 0x98, 0x0b,
-	0xe8, 0x5a, 0xc0, 0x89, 0xd7, 0xc0, 0x54, 0xc0, 0xc3, 0xbf, 0x64, 0x15, 0xe0, 0x38, 0x32, 0x07,
-	0x20, 0x3e, 0xb5, 0xda, 0xe9, 0x88, 0x88, 0x19, 0xd2, 0x1d, 0xaf, 0x8f, 0xe1, 0x8a, 0x1d, 0x08,
-	0x4c, 0xef, 0x48, 0xf9, 0x2f, 0x34, 0x89, 0x03, 0xd3, 0x82, 0x45, 0xd1, 0x22, 0x5f, 0x4c, 0xa3,
-	0x52, 0xfc, 0x2d, 0x81, 0x4a, 0x11, 0x52, 0xbc, 0x18, 0x59, 0x82, 0x13, 0x82, 0x6f, 0x90, 0x2d,
-	0x6f, 0x2c, 0x3a, 0x2b, 0xc4, 0xd0, 0x5c, 0x69, 0x83, 0x36, 0x1a, 0x02, 0x2c, 0xd7, 0x11, 0x2b,
-	0x41, 0xc6, 0x61, 0xd4, 0xff, 0x7b, 0x4e, 0x5f, 0xa3, 0xae, 0x72, 0x02, 0x35, 0xf6, 0xe2, 0xd6,
-	0x66, 0x45, 0xf1, 0xcb, 0x63, 0xac, 0x76, 0x59, 0x74, 0xd1, 0x22, 0x32, 0x0f, 0xae, 0xf5, 0xe5,
-	0x14, 0x1e, 0x71, 0x9d, 0x8f, 0x16, 0x21, 0x13, 0x30, 0x1a, 0x3c, 0xd8, 0xbd, 0x7d, 0xbb, 0x5e,
-	0xc3, 0x90, 0x1c, 0x22, 0x5c, 0x7f, 0x2c, 0x9f, 0x9d, 0xcc, 0x24, 0x52, 0x46, 0x8a, 0xd3, 0xc6,
-	0x63, 0x74, 0xc4, 0xe2, 0xb4, 0x75, 0x52, 0xe2, 0xb4, 0x2d, 0x90, 0x8f, 0xc2, 0x70, 0xf5, 0x6e,
-	0x43, 0xc4, 0x9f, 0x73, 0x95, 0x53, 0x61, 0x72, 0x54, 0x0c, 0x7a, 0x27, 0x62, 0xd5, 0xc9, 0x4d,
-	0x97, 0xe9, 0xc9, 0x24, 0x8c, 0x45, 0x76, 0x7f, 0xae, 0x72, 0x1a, 0x39, 0x60, 0xcb, 0x75, 0xc4,
-	0x34, 0x1d, 0x81, 0x92, 0x87, 0x57, 0xb4, 0x10, 0xd3, 0x9a, 0x9a, 0xe9, 0x62, 0xa2, 0x49, 0x8d,
-	0x62, 0xa8, 0x3b, 0x0c, 0xf0, 0x31, 0xc8, 0xb5, 0xc6, 0x10, 0xa8, 0xa6, 0xc3, 0x71, 0x72, 0x8f,
-	0xc6, 0x8a, 0x91, 0xb7, 0x81, 0x60, 0x6a, 0x4a, 0x6a, 0xf8, 0x7b, 0x8b, 0x7a, 0xcd, 0x55, 0xce,
-	0x62, 0xae, 0x1a, 0x12, 0x8f, 0x4c, 0x55, 0xaf, 0x8d, 0x5f, 0x12, 0xd3, 0xc7, 0x63, 0x3a, 0x2f,
-	0xd5, 0xf4, 0xa3, 0x52, 0x35, 0x4d, 0x43, 0x6e, 0x71, 0x0a, 0x57, 0xb2, 0x0e, 0xe7, 0x16, 0x1c,
-	0x7a, 0xdf, 0xb4, 0xbb, 0xae, 0xbf, 0x7c, 0xf8, 0xf3, 0xd6, 0xb9, 0x6d, 0xe7, 0xad, 0x27, 0x44,
-	0xc5, 0x67, 0x3a, 0x0e, 0xbd, 0xdf, 0xf4, 0x33, 0x94, 0x44, 0x02, 0xec, 0x67, 0x71, 0x67, 0xe2,
-	0xc2, 0x30, 0x7f, 0x02, 0x6e, 0x52, 0x57, 0x51, 0xc2, 0xa9, 0x96, 0x07, 0x55, 0x34, 0x03, 0x9c,
-	0x2c, 0xae, 0x58, 0x31, 0xa2, 0x01, 0xb9, 0x31, 0xe1, 0xbb, 0x03, 0x56, 0x5b, 0x2d, 0xbb, 0x6b,
-	0x79, 0xae, 0x72, 0x1e, 0x99, 0xa9, 0x4c, 0x2c, 0xcb, 0xad, 0x20, 0x5b, 0x51, 0x53, 0x17, 0x78,
-	0x59, 0x2c, 0xc9, 0xd2, 0x64, 0x06, 0xca, 0x0b, 0x0e, 0x5e, 0x4e, 0xde, 0xa2, 0x1b, 0xdc, 0x48,
-	0xc5, 0x38, 0x23, 0x62, 0xaa, 0xec, 0x70, 0x5c, 0x73, 0x95, 0x6e, 0x34, 0x3b, 0x88, 0x95, 0x97,
-	0x95, 0x78, 0x49, 0x39, 0x7b, 0xc8, 0x23, 0x3b, 0xcb, 0x1e, 0x42, 0xa1, 0x2c, 0x9c, 0x09, 0x1f,
-	0x78, 0xd4, 0x62, 0x4b, 0xbd, 0x2b, 0x62, 0x8a, 0x28, 0x31, 0xe7, 0xc3, 0x00, 0xcf, 0xa7, 0x0e,
-	0x31, 0xca, 0x68, 0x00, 0x96, 0x1b, 0x16, 0x2f, 0x92, 0x4c, 0xb1, 0xf1, 0xe8, 0x1e, 0x52, 0x6c,
-	0xfc, 0x6f, 0x05, 0x79, 0xfe, 0x25, 0x17, 0xa1, 0x28, 0x65, 0xc0, 0xc4, 0xfc, 0x01, 0x98, 0x2d,
-	0xa8, 0x28, 0xd2, 0xa2, 0x0c, 0x09, 0xdb, 0x25, 0x88, 0xc4, 0x88, 0x29, 0xcf, 0xc3, 0x98, 0xf2,
-	0x5a, 0x48, 0x80, 0xe9, 0xa6, 0xbb, 0x4b, 0x6d, 0xb3, 0x85, 0x39, 0xa4, 0x0a, 0x52, 0xe4, 0x32,
-	0x84, 0xf2, 0x14, 0x52, 0x12, 0x09, 0xb9, 0x0e, 0xc3, 0xfe, 0xa5, 0x78, 0x98, 0x3f, 0x03, 0x53,
-	0x0b, 0x89, 0xd9, 0x5a, 0x64, 0x2e, 0x92, 0x88, 0xc8, 0xab, 0x00, 0xe1, 0x74, 0x20, 0x2c, 0x2d,
-	0x5c, 0x2a, 0xe4, 0xd9, 0x43, 0x5e, 0x2a, 0x42, 0x6a, 0x36, 0x71, 0xca, 0xea, 0xe8, 0x27, 0xd8,
-	0xc7, 0x89, 0x33, 0xa2, 0xc3, 0xb2, 0x82, 0x44, 0x8b, 0x90, 0x79, 0x38, 0x99, 0xd0, 0x40, 0x91,
-	0x6d, 0xe3, 0x89, 0xad, 0xcd, 0xca, 0xa3, 0x29, 0xea, 0x2b, 0x2f, 0xcc, 0x89, 0xb2, 0xe4, 0x49,
-	0x28, 0xdc, 0xd6, 0xea, 0x22, 0xe2, 0x3f, 0x4f, 0x16, 0x11, 0x89, 0xb7, 0xc9, 0xb0, 0xe4, 0x15,
-	0x00, 0x9e, 0x51, 0x6f, 0xc1, 0x76, 0x3c, 0xb4, 0x28, 0x46, 0xc7, 0xcf, 0xb3, 0xb1, 0xcc, 0x33,
-	0xee, 0x35, 0xd9, 0x32, 0x26, 0x7f, 0x74, 0x48, 0xac, 0x7e, 0x6f, 0x3e, 0xb1, 0xac, 0x31, 0xc1,
-	0x8b, 0x56, 0x48, 0x9d, 0x8f, 0x82, 0xf7, 0x9b, 0xce, 0x05, 0x2f, 0x11, 0x91, 0xcb, 0x30, 0xb8,
-	0xc0, 0x26, 0x95, 0x96, 0xdd, 0x16, 0xaa, 0x80, 0x61, 0x5f, 0x3b, 0x02, 0xa6, 0x05, 0x58, 0x72,
-	0x9d, 0x67, 0xa2, 0xb1, 0x62, 0xf9, 0x77, 0xba, 0x02, 0x16, 0x4f, 0x44, 0xc3, 0x60, 0xac, 0x4c,
-	0x24, 0x45, 0xad, 0x28, 0x93, 0xb2, 0xa4, 0x86, 0x29, 0x69, 0x03, 0x83, 0xb6, 0x7f, 0x3b, 0x83,
-	0x56, 0xfd, 0xf5, 0x5c, 0x72, 0x88, 0x92, 0x17, 0x93, 0xa9, 0x30, 0x70, 0xfd, 0x0a, 0x80, 0x72,
-	0xad, 0x41, 0x52, 0x8c, 0x48, 0x52, 0x8b, 0xfc, 0x9e, 0x93, 0x5a, 0x14, 0x76, 0x99, 0xd4, 0x42,
-	0xfd, 0xbf, 0x8b, 0x3d, 0xdf, 0xcd, 0x1d, 0x4a, 0xf0, 0xe3, 0x57, 0xd8, 0xa6, 0x8c, 0xd5, 0x5e,
-	0x75, 0x13, 0x5b, 0x0b, 0xfe, 0x2c, 0xa8, 0xa9, 0xf3, 0x51, 0xe9, 0x6a, 0x51, 0x4a, 0xf2, 0x06,
-	0x8c, 0xf8, 0x1f, 0x80, 0xc9, 0x52, 0xa4, 0x24, 0x1f, 0xc1, 0x82, 0x18, 0x4b, 0x2b, 0x12, 0x29,
-	0x40, 0x5e, 0x82, 0x21, 0x34, 0x87, 0x3a, 0x7a, 0xcb, 0xcf, 0xa4, 0xc3, 0x53, 0xef, 0xf8, 0x40,
-	0x39, 0xc0, 0x6f, 0x40, 0x49, 0x3e, 0x0d, 0x25, 0x91, 0x4e, 0xae, 0x84, 0x4b, 0xf4, 0xb5, 0x1d,
-	0x3c, 0x34, 0xbc, 0x2a, 0xa7, 0x92, 0xe3, 0x1b, 0x1c, 0x04, 0x44, 0x36, 0x38, 0x3c, 0x8b, 0xdc,
-	0x22, 0x9c, 0x5a, 0x70, 0xa8, 0x81, 0x4f, 0x5a, 0x27, 0x1f, 0x74, 0x1c, 0x91, 0xe8, 0x8f, 0x4f,
-	0x10, 0xb8, 0xbe, 0x75, 0x7c, 0x34, 0x5b, 0x79, 0x05, 0x5e, 0x4e, 0xe7, 0x91, 0x52, 0x9c, 0x19,
-	0x3d, 0xbc, 0x25, 0xb7, 0xe8, 0xc6, 0xba, 0xed, 0x18, 0x3c, 0x17, 0x9e, 0x98, 0xfa, 0x85, 0xa0,
-	0x57, 0x05, 0x4a, 0x36, 0x7a, 0xa2, 0x85, 0x2e, 0xbc, 0x02, 0xc3, 0x7b, 0x4d, 0xc7, 0xf6, 0xf3,
-	0xf9, 0x8c, 0x17, 0xe8, 0x0f, 0x6f, 0x46, 0xec, 0x0a, 0xf4, 0xf3, 0x28, 0x3f, 0x5c, 0xf9, 0x86,
-	0xb6, 0x36, 0x2b, 0xfd, 0x9f, 0x45, 0x97, 0x60, 0x0e, 0x57, 0xff, 0x3c, 0x9f, 0xf1, 0xbc, 0xfe,
-	0xe1, 0x95, 0x19, 0x5b, 0x78, 0x7c, 0x61, 0xd4, 0x6b, 0x28, 0xb9, 0x51, 0xb1, 0xf0, 0xf8, 0x60,
-	0x66, 0x54, 0xc8, 0x44, 0xe4, 0x2a, 0xc0, 0x82, 0xee, 0xe8, 0x6b, 0xd4, 0x63, 0x7b, 0x1d, 0x7e,
-	0x5a, 0x80, 0x56, 0x48, 0x27, 0x80, 0x6a, 0x12, 0x85, 0xfa, 0xd3, 0x85, 0x5e, 0xe1, 0x07, 0x8e,
-	0x65, 0xbf, 0x1b, 0xd9, 0x5f, 0x87, 0xe1, 0x40, 0xb2, 0xf5, 0x1a, 0xda, 0x4b, 0xa3, 0x41, 0xf2,
-	0x47, 0x0e, 0xc6, 0x32, 0x12, 0x11, 0xb9, 0xc2, 0xdb, 0xda, 0x30, 0xdf, 0xe1, 0x69, 0xc8, 0x46,
-	0x45, 0x82, 0x29, 0xdd, 0xd3, 0x9b, 0xae, 0xf9, 0x0e, 0xd5, 0x02, 0xb4, 0xfa, 0x8f, 0xf2, 0xa9,
-	0x31, 0x1c, 0x8e, 0xfb, 0x68, 0x17, 0x7d, 0x94, 0x22, 0x44, 0x1e, 0x7d, 0xe2, 0x58, 0x88, 0xbb,
-	0x10, 0xe2, 0x9f, 0xe5, 0x53, 0x63, 0x75, 0x1c, 0x0b, 0x71, 0x37, 0xb3, 0xc5, 0x33, 0x30, 0xa4,
-	0xd9, 0xeb, 0xee, 0x04, 0xee, 0x89, 0xf8, 0x5c, 0x81, 0x13, 0xb5, 0x63, 0xaf, 0xbb, 0x4d, 0xdc,
-	0xed, 0x68, 0x21, 0x81, 0xfa, 0x9d, 0x7c, 0x8f, 0x68, 0x26, 0xc7, 0x82, 0x7f, 0x37, 0x97, 0xc8,
-	0x5f, 0xcc, 0x47, 0xa2, 0xa5, 0x3c, 0xbc, 0xc2, 0xbe, 0x06, 0xd0, 0x68, 0xad, 0xd0, 0x35, 0x5d,
-	0x4a, 0xe5, 0x8a, 0x47, 0x16, 0x2e, 0x42, 0xf9, 0x36, 0x58, 0x22, 0x51, 0x7f, 0x39, 0x1f, 0x0b,
-	0x17, 0x73, 0x2c, 0xbb, 0x1d, 0xcb, 0x2e, 0xd0, 0x3a, 0x11, 0x01, 0xe7, 0x58, 0x72, 0x3b, 0x95,
-	0xdc, 0x0f, 0xe6, 0x63, 0xc1, 0x82, 0x1e, 0x5a, 0xd9, 0xb1, 0x01, 0x98, 0x0c, 0x62, 0xf4, 0xd0,
-	0x6a, 0xd2, 0x33, 0x30, 0x24, 0xe4, 0x10, 0x2c, 0x15, 0x7c, 0xde, 0xe7, 0x40, 0x3c, 0xa0, 0x0d,
-	0x08, 0xd4, 0xbf, 0x92, 0x87, 0x68, 0x10, 0xa7, 0x87, 0x54, 0x87, 0x7e, 0x31, 0x1f, 0x0d, 0x5f,
-	0xf5, 0xf0, 0xea, 0xcf, 0x55, 0x80, 0x46, 0x77, 0xa9, 0x25, 0x9c, 0x44, 0xfb, 0xa5, 0x13, 0xfe,
-	0x00, 0xaa, 0x49, 0x14, 0xea, 0xbf, 0xcf, 0xa7, 0xc6, 0xd4, 0x7a, 0x78, 0x05, 0xf8, 0x02, 0x9e,
-	0x8a, 0xb7, 0xac, 0x70, 0x22, 0xc7, 0x43, 0x48, 0x36, 0xfe, 0x12, 0xf9, 0xbf, 0x7d, 0x42, 0xf2,
-	0x91, 0x14, 0x73, 0x0d, 0xb3, 0x93, 0x85, 0xe6, 0x9a, 0x7c, 0x98, 0x2f, 0x19, 0x6e, 0xbf, 0x9d,
-	0xdf, 0x2e, 0x04, 0xd9, 0xc3, 0xbc, 0xaa, 0x0e, 0x2c, 0xe8, 0x1b, 0x18, 0x2a, 0x9b, 0xf5, 0xc4,
-	0x08, 0xcf, 0x4e, 0xdd, 0xe1, 0x20, 0xf9, 0xda, 0x4e, 0x50, 0xa9, 0xff, 0xa6, 0x3f, 0x3d, 0xfe,
-	0xd5, 0xc3, 0x2b, 0xc2, 0x8b, 0x50, 0x5c, 0xd0, 0xbd, 0x15, 0xa1, 0xc9, 0x78, 0x1b, 0xd8, 0xd1,
-	0xbd, 0x15, 0x0d, 0xa1, 0xe4, 0x0a, 0x0c, 0x6a, 0xfa, 0x3a, 0x3f, 0xf3, 0x2c, 0x85, 0x99, 0xc3,
-	0x1d, 0x7d, 0xbd, 0xc9, 0xcf, 0x3d, 0x03, 0x34, 0x51, 0x83, 0xcc, 0xf5, 0xfc, 0xe4, 0x1b, 0xd3,
-	0x26, 0xf3, 0xcc, 0xf5, 0x41, 0xbe, 0xfa, 0x8b, 0x50, 0x1c, 0xb7, 0x8d, 0x0d, 0xbc, 0xf9, 0x1a,
-	0xe1, 0x95, 0x2d, 0xd9, 0xc6, 0x86, 0x86, 0x50, 0xf2, 0xf9, 0x1c, 0x0c, 0x4c, 0x53, 0xdd, 0x60,
-	0x23, 0x64, 0xa8, 0x97, 0xc3, 0xca, 0x9b, 0x07, 0xe3, 0xb0, 0x72, 0x72, 0x85, 0x57, 0x26, 0x2b,
-	0x8a, 0xa8, 0x9f, 0xdc, 0x80, 0xc1, 0x09, 0xdd, 0xa3, 0xcb, 0xb6, 0xb3, 0x81, 0x2e, 0x38, 0x63,
-	0xe1, 0x1b, 0xca, 0x88, 0xfe, 0xf8, 0x44, 0xfc, 0x66, 0xac, 0x25, 0x7e, 0x69, 0x41, 0x61, 0x26,
-	0x16, 0x7e, 0x33, 0x87, 0x3e, 0x38, 0x42, 0x2c, 0xfc, 0x0a, 0x4f, 0x13, 0x98, 0xf0, 0x58, 0x79,
-	0x24, 0xfd, 0x58, 0x19, 0xad, 0x47, 0x74, 0xd3, 0xc3, 0x7c, 0xf1, 0xa3, 0xb8, 0xe8, 0x73, 0xeb,
-	0x11, 0xa1, 0x98, 0x2e, 0x5e, 0x93, 0x48, 0xd4, 0x3f, 0xe9, 0x87, 0xd4, 0x68, 0x39, 0xc7, 0x4a,
-	0x7e, 0xac, 0xe4, 0xa1, 0x92, 0xd7, 0x12, 0x4a, 0x7e, 0x21, 0x19, 0x7f, 0xe9, 0x3d, 0xaa, 0xe1,
-	0x5f, 0x29, 0x26, 0xa2, 0xb7, 0x3d, 0xdc, 0xbb, 0xcb, 0x50, 0x7a, 0xfd, 0xdb, 0x4a, 0x2f, 0x18,
-	0x10, 0xa5, 0x6d, 0x07, 0xc4, 0xc0, 0x4e, 0x07, 0xc4, 0x60, 0xe6, 0x80, 0x08, 0x15, 0x64, 0x28,
-	0x53, 0x41, 0xea, 0x62, 0xd0, 0x40, 0xef, 0x2c, 0x72, 0x17, 0xb7, 0x36, 0x2b, 0x63, 0x6c, 0x34,
-	0xa5, 0xa6, 0x8f, 0x43, 0x16, 0xea, 0xb7, 0x8b, 0x3d, 0x42, 0x2e, 0x1e, 0x8a, 0x8e, 0xbc, 0x00,
-	0x85, 0x6a, 0xa7, 0x23, 0xf4, 0xe3, 0x94, 0x14, 0xed, 0x31, 0xa3, 0x14, 0xa3, 0x26, 0xaf, 0x42,
-	0xa1, 0x7a, 0xb7, 0x11, 0x4f, 0x1c, 0x57, 0xbd, 0xdb, 0x10, 0x5f, 0x92, 0x59, 0xf6, 0x6e, 0x83,
-	0xbc, 0x1e, 0x46, 0x70, 0x5f, 0xe9, 0x5a, 0xab, 0x62, 0xa3, 0x28, 0x3c, 0x75, 0x7d, 0x4f, 0x9e,
-	0x16, 0x43, 0xb1, 0xed, 0x62, 0x8c, 0x36, 0xa6, 0x4d, 0xa5, 0x9d, 0x6b, 0xd3, 0xc0, 0xb6, 0xda,
-	0x34, 0xb8, 0x53, 0x6d, 0x1a, 0xda, 0x81, 0x36, 0xc1, 0xb6, 0xda, 0x34, 0xbc, 0x7f, 0x6d, 0xea,
-	0xc0, 0x85, 0x64, 0x98, 0xdc, 0x40, 0x23, 0x34, 0x20, 0x49, 0xac, 0x70, 0x2c, 0xc1, 0xab, 0xff,
-	0x2e, 0xc7, 0x36, 0xd7, 0x11, 0xdd, 0x74, 0x19, 0x5e, 0x76, 0x6d, 0x4b, 0x96, 0x56, 0x7f, 0x3e,
-	0x9f, 0x1d, 0xdd, 0xf7, 0x68, 0x4e, 0x71, 0xdf, 0x9d, 0x2a, 0xa5, 0x62, 0xec, 0x5d, 0x61, 0xa6,
-	0x94, 0x63, 0x6c, 0xd3, 0x64, 0xf6, 0xf5, 0x7c, 0x56, 0xc8, 0xe1, 0x7d, 0x49, 0xec, 0x03, 0x49,
-	0x67, 0x38, 0x74, 0xf1, 0x77, 0xa3, 0x5e, 0x70, 0x53, 0x30, 0x22, 0x0b, 0x51, 0x48, 0x69, 0x27,
-	0x02, 0x8e, 0x94, 0x23, 0xaf, 0x07, 0xf9, 0xfd, 0x24, 0xff, 0x18, 0xf4, 0x74, 0xf3, 0xc7, 0x6c,
-	0xcc, 0x3d, 0x46, 0x26, 0x27, 0xcf, 0x40, 0x69, 0x0a, 0x13, 0xe6, 0xc8, 0x83, 0x9d, 0xa7, 0xd0,
-	0x91, 0xbd, 0x56, 0x38, 0x8d, 0xfa, 0xeb, 0x39, 0x38, 0x75, 0xab, 0xbb, 0x44, 0x85, 0xa3, 0x5d,
-	0xd0, 0x86, 0xb7, 0x01, 0x18, 0x58, 0x38, 0xcc, 0xe4, 0xd0, 0x61, 0xe6, 0x43, 0x72, 0x68, 0xe2,
-	0x58, 0x81, 0xab, 0x21, 0x35, 0x77, 0x96, 0x79, 0xd4, 0xf7, 0x39, 0x5d, 0xed, 0x2e, 0xd1, 0x66,
-	0xc2, 0x6b, 0x46, 0xe2, 0x7e, 0xe1, 0xa3, 0xdc, 0x9b, 0x7f, 0xaf, 0x0e, 0x2a, 0x3f, 0x97, 0xcf,
-	0x8c, 0x06, 0x7d, 0x64, 0xf3, 0xc2, 0x7f, 0x2a, 0xb5, 0x57, 0xe2, 0xf9, 0xe1, 0x53, 0x48, 0x62,
-	0x1c, 0xd3, 0xb8, 0xa4, 0x0b, 0xec, 0x10, 0x27, 0x96, 0xf7, 0xbc, 0xc0, 0xfe, 0x20, 0x97, 0x19,
-	0xb5, 0xfb, 0xa8, 0x0a, 0x4c, 0xfd, 0x9f, 0x0b, 0x7e, 0xb0, 0xf0, 0x7d, 0x7d, 0xc2, 0x33, 0x30,
-	0x24, 0xde, 0x8f, 0x47, 0xfd, 0x84, 0xc5, 0xb1, 0x21, 0x1e, 0x43, 0x07, 0x04, 0xcc, 0xa4, 0x90,
-	0x9c, 0x98, 0x25, 0x3f, 0x61, 0xc9, 0x81, 0x59, 0x93, 0x48, 0x98, 0xd1, 0x30, 0xf9, 0xc0, 0xf4,
-	0xd0, 0x02, 0x61, 0x7d, 0x59, 0xe0, 0x46, 0x03, 0x7d, 0x60, 0x7a, 0xdc, 0xfe, 0x08, 0xd0, 0xcc,
-	0x20, 0xe0, 0xb6, 0x88, 0x98, 0xf7, 0xd0, 0x20, 0xe0, 0xa6, 0x8a, 0x26, 0x30, 0xac, 0xb5, 0xc2,
-	0xf9, 0x56, 0xb8, 0xb4, 0x88, 0xd6, 0x0a, 0x77, 0x5d, 0x6c, 0x6d, 0x40, 0xc0, 0x38, 0x6a, 0x74,
-	0x39, 0x74, 0xe2, 0x43, 0x8e, 0x0e, 0x42, 0x34, 0x81, 0x21, 0xd7, 0x61, 0xac, 0xe1, 0xe9, 0x96,
-	0xa1, 0x3b, 0xc6, 0x7c, 0xd7, 0xeb, 0x74, 0x3d, 0xd9, 0x00, 0x76, 0x3d, 0xc3, 0xee, 0x7a, 0x5a,
-	0x8c, 0x82, 0x3c, 0x07, 0xa3, 0x3e, 0x64, 0xd2, 0x71, 0x6c, 0x47, 0xb6, 0x72, 0x5c, 0xcf, 0xa0,
-	0x8e, 0xa3, 0x45, 0x09, 0xc8, 0x47, 0x60, 0xb4, 0x6e, 0x05, 0xcf, 0xa1, 0xb5, 0x19, 0x61, 0xf3,
-	0xe0, 0x8b, 0x31, 0x33, 0x40, 0x34, 0xbb, 0x4e, 0x5b, 0x8b, 0x12, 0xaa, 0x5b, 0xf9, 0x64, 0x4c,
-	0xf5, 0x87, 0x77, 0x83, 0x74, 0x25, 0xea, 0xb8, 0x87, 0xde, 0xaa, 0x68, 0x7c, 0xca, 0x7e, 0xc3,
-	0xdc, 0x06, 0xbd, 0x0e, 0x83, 0xb7, 0xe8, 0x06, 0xf7, 0x31, 0x2d, 0x85, 0x6e, 0xc9, 0xab, 0x02,
-	0x26, 0x9f, 0xee, 0xfa, 0x74, 0xea, 0x37, 0xf3, 0xc9, 0x68, 0xf1, 0x0f, 0xaf, 0xb0, 0x9f, 0x83,
-	0x01, 0x14, 0x65, 0xdd, 0xbf, 0x5e, 0x40, 0x01, 0xa2, 0xb8, 0xa3, 0xde, 0xce, 0x3e, 0x99, 0xfa,
-	0x53, 0xa5, 0x78, 0x0a, 0x81, 0x87, 0x57, 0x7a, 0xaf, 0xc1, 0xf0, 0x84, 0x6d, 0xb9, 0xa6, 0xeb,
-	0x51, 0xab, 0xe5, 0x2b, 0x2c, 0x3a, 0xfe, 0xb7, 0x42, 0xb0, 0x6c, 0x03, 0x4a, 0xd4, 0x7b, 0x51,
-	0x5e, 0xf2, 0x32, 0x0c, 0xa1, 0xc8, 0xd1, 0xe6, 0xe4, 0x13, 0x1e, 0xde, 0x4c, 0x2c, 0x31, 0x60,
-	0xdc, 0xe2, 0x0c, 0x49, 0xc9, 0x6d, 0x18, 0x9c, 0x58, 0x31, 0xdb, 0x86, 0x43, 0x2d, 0xf4, 0x4d,
-	0x96, 0x22, 0xb5, 0x45, 0xfb, 0xf2, 0x2a, 0xfe, 0x8b, 0xb4, 0xbc, 0x39, 0x2d, 0x51, 0x2c, 0xf2,
-	0x58, 0x4c, 0xc0, 0x2e, 0xfc, 0x68, 0x1e, 0x20, 0x2c, 0x40, 0x1e, 0x87, 0xbc, 0xff, 0x22, 0x99,
-	0xbb, 0xc4, 0x44, 0x34, 0x28, 0x8f, 0x4b, 0x85, 0x18, 0xdb, 0xf9, 0x6d, 0xc7, 0xf6, 0x6d, 0x28,
-	0xf1, 0xd3, 0x35, 0xf4, 0x5a, 0x97, 0x9e, 0x8d, 0x67, 0x36, 0xf8, 0x2a, 0xd2, 0x73, 0x5b, 0x1a,
-	0x2d, 0xcf, 0x88, 0x07, 0x38, 0x67, 0x76, 0xa1, 0x05, 0xfd, 0xf8, 0x17, 0xb9, 0x04, 0xc5, 0x45,
-	0x3f, 0x85, 0xff, 0x28, 0x9f, 0xa5, 0x63, 0xf2, 0x43, 0x3c, 0xeb, 0xa6, 0x09, 0xdb, 0xf2, 0x58,
-	0xd5, 0xd8, 0xea, 0x11, 0x21, 0x17, 0x01, 0x8b, 0xc8, 0x45, 0xc0, 0xd4, 0x7f, 0x96, 0x4f, 0x49,
-	0x6e, 0xf1, 0xf0, 0x0e, 0x93, 0x57, 0x00, 0xf0, 0xe5, 0x39, 0x93, 0xa7, 0xff, 0x1c, 0x04, 0x47,
-	0x09, 0x32, 0x42, 0xb5, 0x8d, 0x6c, 0x3b, 0x42, 0x62, 0xf5, 0xb7, 0x72, 0x89, 0x8c, 0x08, 0xfb,
-	0x92, 0xa3, 0x6c, 0x95, 0xe5, 0xf7, 0x68, 0xc6, 0xfa, 0x7d, 0x51, 0xd8, 0x5d, 0x5f, 0x44, 0xbf,
-	0xe5, 0x00, 0x2c, 0xd3, 0xc3, 0xfc, 0x96, 0x3f, 0xc9, 0xa7, 0xe5, 0x87, 0x38, 0x9a, 0x2a, 0xfe,
-	0x62, 0x60, 0x94, 0x16, 0x63, 0x19, 0x79, 0x10, 0x1a, 0x2b, 0xe6, 0x9b, 0xa9, 0x9f, 0x81, 0x13,
-	0xb1, 0xac, 0x09, 0x38, 0xff, 0x4b, 0xa1, 0x26, 0xd2, 0x73, 0x2b, 0x64, 0xc7, 0x2c, 0x88, 0x90,
-	0xa9, 0xff, 0x6f, 0xae, 0x77, 0xce, 0x8c, 0x43, 0x57, 0x9d, 0x14, 0x01, 0x14, 0xfe, 0x62, 0x04,
-	0x70, 0x00, 0xdb, 0xe0, 0xa3, 0x2d, 0x80, 0xf7, 0xc8, 0xe4, 0xf1, 0x6e, 0x0b, 0xe0, 0xa7, 0x72,
-	0xdb, 0xa6, 0x3c, 0x39, 0x6c, 0x19, 0xa8, 0xff, 0x43, 0x2e, 0x35, 0x35, 0xc9, 0xbe, 0xda, 0xf5,
-	0x3a, 0x94, 0xb8, 0x0b, 0x8f, 0x68, 0x95, 0x94, 0xcc, 0x95, 0x41, 0x33, 0xca, 0x8b, 0x32, 0x64,
-	0x06, 0x06, 0x78, 0x1b, 0x0c, 0xd1, 0x1b, 0x4f, 0xf5, 0xc8, 0x8f, 0x62, 0x64, 0x4d, 0x8e, 0x02,
-	0xad, 0xfe, 0x46, 0x2e, 0x91, 0x29, 0xe5, 0x10, 0xbf, 0x2d, 0x9c, 0xaa, 0x0b, 0x3b, 0x9f, 0xaa,
-	0xd5, 0x7f, 0x9d, 0x4f, 0x4f, 0xd4, 0x72, 0x88, 0x1f, 0x72, 0x10, 0xc7, 0x69, 0x7b, 0x5b, 0xb7,
-	0x16, 0x61, 0x2c, 0x2a, 0x0b, 0xb1, 0x6c, 0x3d, 0x96, 0x9e, 0xae, 0x26, 0xa3, 0x15, 0x31, 0x1e,
-	0xea, 0x8f, 0xe4, 0x93, 0x39, 0x66, 0x0e, 0x7d, 0x7e, 0xda, 0x93, 0xb6, 0x90, 0x3a, 0x9c, 0x08,
-	0xbf, 0x64, 0xd1, 0xf4, 0xda, 0xfe, 0xe9, 0x3e, 0xc6, 0x04, 0x10, 0x31, 0x2c, 0xda, 0xa6, 0xeb,
-	0x35, 0x3d, 0x86, 0x8c, 0x44, 0x53, 0x88, 0x96, 0x8b, 0x49, 0xe5, 0x3d, 0xb2, 0x6c, 0xbd, 0xc7,
-	0xa4, 0xf2, 0x1e, 0x59, 0xcb, 0x0e, 0x5d, 0x2a, 0x3f, 0x93, 0xcf, 0xca, 0x41, 0x74, 0xe8, 0xb2,
-	0xf9, 0xa4, 0xdc, 0x5f, 0xbc, 0x65, 0x42, 0x4a, 0x8f, 0x67, 0x25, 0xfd, 0xc9, 0xe0, 0x99, 0xe0,
-	0xb3, 0xb7, 0x49, 0x2c, 0x55, 0x58, 0xef, 0x91, 0xe1, 0x75, 0x34, 0x84, 0xf5, 0x1e, 0x19, 0x75,
-	0xef, 0x3d, 0x61, 0xfd, 0x4a, 0x7e, 0xa7, 0x89, 0xaf, 0x8e, 0x85, 0x97, 0x10, 0xde, 0x97, 0xf2,
-	0xc9, 0x84, 0x6c, 0x87, 0x2e, 0xa6, 0x29, 0x28, 0x89, 0xd4, 0x70, 0x99, 0xc2, 0xe1, 0xf8, 0x2c,
-	0x93, 0x4d, 0x7c, 0xc7, 0x8b, 0x20, 0x6e, 0xaa, 0x76, 0x26, 0x12, 0x4e, 0xab, 0x7e, 0x27, 0x17,
-	0xcb, 0x5e, 0x76, 0x28, 0x67, 0x24, 0x7b, 0x5b, 0xdd, 0x3e, 0xea, 0x9f, 0xd6, 0x16, 0x63, 0xf1,
-	0x7b, 0x83, 0xef, 0xa9, 0x51, 0x4f, 0x37, 0xdb, 0xf1, 0xf2, 0x22, 0xc0, 0xc2, 0x37, 0xf3, 0x70,
-	0x32, 0x41, 0x4a, 0x2e, 0x45, 0x42, 0x1a, 0xe1, 0xb9, 0x6b, 0xcc, 0x13, 0x9f, 0x07, 0x37, 0xda,
-	0xc5, 0x51, 0xf1, 0x25, 0x28, 0xd6, 0xf4, 0x0d, 0xfe, 0x6d, 0xfd, 0x9c, 0xa5, 0xa1, 0x6f, 0xc8,
-	0x47, 0x8a, 0x88, 0x27, 0x4b, 0x70, 0x86, 0x5f, 0xf8, 0x98, 0xb6, 0xb5, 0x68, 0xae, 0xd1, 0xba,
-	0x35, 0x6b, 0xb6, 0xdb, 0xa6, 0x2b, 0x6e, 0x2d, 0x9f, 0xd9, 0xda, 0xac, 0x5c, 0xf6, 0x6c, 0x4f,
-	0x6f, 0x37, 0xa9, 0x4f, 0xd6, 0xf4, 0xcc, 0x35, 0xda, 0x34, 0xad, 0xe6, 0x1a, 0x52, 0x4a, 0x2c,
-	0xd3, 0x59, 0x91, 0x3a, 0x4f, 0x14, 0xd4, 0x68, 0xe9, 0x96, 0x45, 0x8d, 0xba, 0x35, 0xbe, 0xe1,
-	0x51, 0x7e, 0xdb, 0x59, 0xe0, 0x67, 0x9e, 0xfc, 0xa1, 0x3d, 0x47, 0x33, 0xc6, 0x4b, 0x8c, 0x40,
-	0x4b, 0x29, 0xa4, 0xfe, 0x6a, 0x31, 0x25, 0x71, 0xdd, 0x11, 0x52, 0x1f, 0xbf, 0xa7, 0x8b, 0xdb,
-	0xf4, 0xf4, 0x35, 0x18, 0x10, 0x99, 0x18, 0xc4, 0x0d, 0x0a, 0xbe, 0x0c, 0xb8, 0xcf, 0x41, 0xf2,
-	0x15, 0x94, 0xa0, 0x22, 0x6d, 0xb8, 0xb0, 0xc8, 0xba, 0x29, 0xbd, 0x33, 0x4b, 0x7b, 0xe8, 0xcc,
-	0x1e, 0xfc, 0xc8, 0x5b, 0x70, 0x0e, 0xb1, 0x29, 0xdd, 0x3a, 0x80, 0x55, 0xa1, 0xad, 0xc7, 0xab,
-	0x4a, 0xef, 0xdc, 0xac, 0xf2, 0xe4, 0x93, 0x30, 0x12, 0x0c, 0x10, 0x93, 0xba, 0xe2, 0x6a, 0xa6,
-	0xc7, 0x38, 0xe3, 0x81, 0xf8, 0x18, 0x18, 0xfd, 0xf1, 0xa2, 0xc1, 0xdc, 0x22, 0xbc, 0xd4, 0xff,
-	0x3e, 0xd7, 0x2b, 0x81, 0xde, 0xa1, 0xcf, 0xca, 0x1f, 0x85, 0x01, 0x83, 0x7f, 0x94, 0xd0, 0xa9,
-	0xde, 0x29, 0xf6, 0x38, 0xa9, 0xe6, 0x97, 0x51, 0xff, 0x55, 0xae, 0x67, 0xde, 0xbe, 0xa3, 0xfe,
-	0x79, 0x5f, 0x2a, 0x64, 0x7c, 0x9e, 0x98, 0x44, 0xaf, 0x40, 0xd9, 0x0c, 0x13, 0x0b, 0x35, 0xc3,
-	0x58, 0x5e, 0xda, 0x09, 0x09, 0x8e, 0xa3, 0xeb, 0x45, 0x08, 0x3c, 0xd2, 0x1c, 0xdf, 0xdd, 0xce,
-	0x6d, 0x76, 0x1d, 0x93, 0x8f, 0x4b, 0xed, 0xb4, 0x1b, 0xf3, 0xc5, 0x73, 0x6f, 0x3b, 0x26, 0xab,
-	0x40, 0xf7, 0x56, 0xa8, 0xa5, 0x37, 0xd7, 0x6d, 0x67, 0x15, 0xa3, 0xbd, 0xf2, 0xc1, 0xa9, 0x9d,
-	0xe0, 0xf0, 0xbb, 0x3e, 0x98, 0x3c, 0x09, 0xa3, 0xcb, 0xed, 0x2e, 0x0d, 0xe2, 0x6b, 0xf2, 0xcb,
-	0x4c, 0x6d, 0x84, 0x01, 0x83, 0x2b, 0xa0, 0x47, 0x01, 0x90, 0x08, 0xa3, 0xf8, 0xf3, 0x9b, 0x4b,
-	0x6d, 0x88, 0x41, 0x16, 0x45, 0x77, 0x5d, 0xe0, 0x5a, 0xcd, 0x85, 0xd4, 0x6c, 0xdb, 0xd6, 0x72,
-	0xd3, 0xa3, 0xce, 0x1a, 0x36, 0x14, 0xbd, 0x35, 0xb4, 0xb3, 0x48, 0x81, 0x77, 0x43, 0xee, 0x8c,
-	0x6d, 0x2d, 0x2f, 0x52, 0x67, 0x8d, 0x35, 0xf5, 0x19, 0x20, 0xa2, 0xa9, 0x0e, 0x9e, 0xea, 0xf0,
-	0x8f, 0x43, 0x77, 0x0d, 0x4d, 0x7c, 0x04, 0x3f, 0xee, 0xc1, 0x0f, 0xab, 0xc0, 0x30, 0x0f, 0x32,
-	0xc8, 0x85, 0x86, 0x3e, 0x1a, 0x1a, 0x70, 0x10, 0xca, 0xeb, 0x2c, 0x08, 0xf7, 0x11, 0xee, 0x22,
-	0xaf, 0x89, 0x5f, 0xea, 0x17, 0x0a, 0x69, 0xa9, 0x06, 0xf7, 0xa5, 0x68, 0xe1, 0xb4, 0x9a, 0xdf,
-	0xd5, 0xb4, 0x7a, 0xc2, 0xea, 0xae, 0x35, 0xf5, 0x4e, 0xa7, 0x79, 0xcf, 0x6c, 0xe3, 0x1b, 0x35,
-	0x5c, 0xf8, 0xb4, 0x51, 0xab, 0xbb, 0x56, 0xed, 0x74, 0xa6, 0x38, 0x90, 0x3c, 0x0d, 0x27, 0x19,
-	0x1d, 0x76, 0x52, 0x40, 0x59, 0x44, 0x4a, 0xc6, 0x00, 0xa3, 0xf4, 0xfa, 0xb4, 0xe7, 0x61, 0x50,
-	0xf0, 0xe4, 0x6b, 0x55, 0xbf, 0x36, 0xc0, 0x99, 0xb9, 0xac, 0xe7, 0x02, 0x36, 0x7c, 0x72, 0xed,
-	0xd7, 0x86, 0xfc, 0xf2, 0x18, 0x8b, 0xda, 0xea, 0xae, 0xf1, 0xf0, 0x62, 0x03, 0x88, 0x0c, 0x7e,
-	0x93, 0x4b, 0x30, 0xc6, 0xb8, 0x04, 0x02, 0xe3, 0xe1, 0x7b, 0xfb, 0xb5, 0x18, 0x94, 0x5c, 0x87,
-	0xd3, 0x11, 0x08, 0xb7, 0x41, 0xf9, 0x9b, 0x8b, 0x7e, 0x2d, 0x15, 0xa7, 0xfe, 0x72, 0x21, 0x9a,
-	0x00, 0xf1, 0x10, 0x3a, 0xe2, 0x1c, 0x0c, 0xd8, 0xce, 0x72, 0xb3, 0xeb, 0xb4, 0xc5, 0xd8, 0x2b,
-	0xd9, 0xce, 0xf2, 0x6d, 0xa7, 0x4d, 0xce, 0x40, 0x89, 0xf5, 0x8e, 0x69, 0x88, 0x21, 0xd6, 0xaf,
-	0x77, 0x3a, 0x75, 0x83, 0x54, 0x79, 0x87, 0x60, 0xe8, 0xd7, 0x66, 0x0b, 0xb7, 0xf6, 0xdc, 0xeb,
-	0xa2, 0x9f, 0xaf, 0x78, 0x09, 0x24, 0xf6, 0x13, 0x06, 0x84, 0xe5, 0x07, 0x01, 0x31, 0x16, 0x06,
-	0x6e, 0x4b, 0x0c, 0xde, 0x27, 0x71, 0x16, 0x02, 0x19, 0xb2, 0xe0, 0x9b, 0x18, 0x83, 0xd4, 0x80,
-	0x84, 0x54, 0x6b, 0xb6, 0x61, 0xde, 0x33, 0x29, 0x7f, 0x22, 0xd3, 0xcf, 0x6f, 0xb6, 0x93, 0x58,
-	0xad, 0xec, 0x33, 0x99, 0x15, 0x10, 0xf2, 0x1a, 0x57, 0x42, 0x4e, 0x87, 0x6b, 0x1f, 0xef, 0x5b,
-	0x6e, 0xa7, 0xc5, 0x50, 0xa8, 0x99, 0x58, 0x1e, 0x17, 0x42, 0xf5, 0x1b, 0xa5, 0x64, 0x16, 0xcc,
-	0x43, 0xb1, 0x6b, 0xa6, 0x01, 0x44, 0x92, 0xdb, 0xf0, 0xf6, 0xf0, 0x82, 0x94, 0xd1, 0x46, 0x60,
-	0x32, 0x78, 0x48, 0x65, 0xc9, 0x15, 0x18, 0xe4, 0x5f, 0x54, 0xaf, 0x09, 0x7b, 0x07, 0x7d, 0xe0,
-	0xdc, 0x8e, 0x79, 0xef, 0x1e, 0x3a, 0xcc, 0x05, 0x68, 0x72, 0x09, 0x06, 0x6a, 0x73, 0x8d, 0x46,
-	0x75, 0xce, 0xbf, 0x0a, 0xc7, 0xc7, 0x3a, 0x86, 0xe5, 0x36, 0x5d, 0xdd, 0x72, 0x35, 0x1f, 0x49,
-	0x9e, 0x84, 0x52, 0x7d, 0x01, 0xc9, 0xf8, 0x13, 0xd4, 0xe1, 0xad, 0xcd, 0xca, 0x80, 0xd9, 0xe1,
-	0x54, 0x02, 0x85, 0xf5, 0xde, 0xa9, 0xd7, 0x24, 0x7f, 0x10, 0x5e, 0xef, 0x7d, 0xd3, 0xc0, 0x7b,
-	0x75, 0x2d, 0x40, 0x93, 0x97, 0x60, 0xa4, 0x41, 0x1d, 0x53, 0x6f, 0xcf, 0x75, 0x71, 0xab, 0x28,
-	0x85, 0xb4, 0x74, 0x11, 0xde, 0xb4, 0x10, 0xa1, 0x45, 0xc8, 0xc8, 0x45, 0x28, 0x4e, 0x9b, 0x96,
-	0xff, 0x1e, 0x04, 0x1f, 0x0c, 0xac, 0x98, 0x96, 0xa7, 0x21, 0x94, 0x3c, 0x09, 0x85, 0x9b, 0x8b,
-	0x75, 0xe1, 0xea, 0x86, 0xbc, 0xde, 0xf6, 0x22, 0xe1, 0x31, 0x6f, 0x2e, 0xd6, 0xc9, 0x4b, 0x30,
-	0xc4, 0x16, 0x31, 0x6a, 0xb5, 0xa8, 0xab, 0x0c, 0xe3, 0xc7, 0xf0, 0x98, 0x8c, 0x3e, 0x50, 0x76,
-	0x5a, 0x09, 0x28, 0xc9, 0x2d, 0x28, 0xc7, 0xb3, 0x3d, 0x88, 0x37, 0x49, 0x68, 0x71, 0xad, 0x0b,
-	0x5c, 0x5a, 0x54, 0xd0, 0x44, 0x41, 0x62, 0x80, 0x12, 0x87, 0xb1, 0x7d, 0x1d, 0x5a, 0x9d, 0x3c,
-	0x20, 0xf5, 0xe5, 0xad, 0xcd, 0xca, 0x53, 0x09, 0xa6, 0x4d, 0x47, 0x50, 0x49, 0xdc, 0x33, 0x39,
-	0x91, 0x4f, 0x01, 0x54, 0x3d, 0xcf, 0x31, 0x97, 0xba, 0xcc, 0x3c, 0x1c, 0xeb, 0xfd, 0xa4, 0x41,
-	0xdd, 0xda, 0xac, 0x9c, 0xd6, 0x03, 0xf2, 0xd4, 0x87, 0x0d, 0x12, 0x3b, 0xf5, 0x7f, 0xcf, 0xa7,
-	0xa7, 0x6d, 0x3d, 0x84, 0xa9, 0x6f, 0x8f, 0x6e, 0x03, 0xb1, 0x01, 0x57, 0xdc, 0xc7, 0x80, 0xbb,
-	0x07, 0x27, 0xaa, 0xc6, 0x9a, 0x69, 0x55, 0xf1, 0xa7, 0x3b, 0x3b, 0x55, 0xc5, 0xa9, 0x54, 0x7a,
-	0xfb, 0x19, 0x43, 0x8b, 0xef, 0xe1, 0x81, 0xa8, 0x19, 0xaa, 0xa9, 0x73, 0x5c, 0x73, 0xed, 0x9e,
-	0xde, 0x6c, 0xf1, 0x8c, 0xa7, 0x5a, 0x9c, 0xa9, 0xfa, 0x23, 0xf9, 0x6d, 0x32, 0xcd, 0x3e, 0x8c,
-	0xd2, 0x57, 0xbf, 0x9c, 0xef, 0x9d, 0xec, 0xf7, 0xa1, 0x14, 0xca, 0x9f, 0xe5, 0x53, 0x52, 0xef,
-	0xee, 0x4b, 0x12, 0x57, 0x60, 0x90, 0xb3, 0x09, 0xfc, 0xb6, 0x71, 0x76, 0xe7, 0xca, 0x8a, 0xab,
-	0x8a, 0x8f, 0x26, 0x73, 0x70, 0xba, 0x7a, 0xef, 0x1e, 0x6d, 0x79, 0x61, 0x48, 0xf2, 0xb9, 0x30,
-	0xc2, 0x2f, 0x0f, 0xc1, 0x2c, 0xf0, 0x61, 0x48, 0x73, 0x8c, 0x64, 0x93, 0x5a, 0x8e, 0x2c, 0xc2,
-	0xd9, 0x38, 0xbc, 0xc1, 0xb7, 0x44, 0x45, 0x29, 0x2a, 0x73, 0x82, 0x23, 0xff, 0x4f, 0xcb, 0x28,
-	0x9b, 0xd6, 0x4a, 0x5c, 0xba, 0xfa, 0x7b, 0xb5, 0x12, 0xd7, 0xb1, 0xd4, 0x72, 0xea, 0x37, 0x0b,
-	0x72, 0x86, 0xe2, 0x87, 0xd7, 0xc3, 0xee, 0xc5, 0x88, 0x5f, 0xfd, 0x4e, 0x87, 0xcc, 0x4b, 0x22,
-	0x3c, 0x8d, 0xd1, 0x75, 0x7c, 0x17, 0xd4, 0x20, 0x3c, 0x06, 0x02, 0xe5, 0x75, 0x39, 0xa0, 0x24,
-	0x75, 0x28, 0x56, 0x9d, 0x65, 0x6e, 0xee, 0x6f, 0xf7, 0x62, 0x4f, 0x77, 0x96, 0xd3, 0x17, 0x36,
-	0x64, 0xa1, 0xfe, 0x70, 0xbe, 0x47, 0x52, 0xe1, 0x87, 0x72, 0x12, 0xf9, 0x89, 0x7c, 0x56, 0x7a,
-	0xe0, 0xa3, 0xea, 0x2b, 0xf8, 0x2e, 0x0b, 0xe7, 0x68, 0x3b, 0x52, 0x1e, 0xa0, 0x70, 0x7e, 0x3f,
-	0x9f, 0x95, 0xeb, 0xf8, 0x58, 0x38, 0x7b, 0x9b, 0x20, 0x53, 0x45, 0xfa, 0x10, 0xdb, 0xdc, 0xb2,
-	0x2a, 0xf4, 0xef, 0xd1, 0x5f, 0x2e, 0x4d, 0xa4, 0xc7, 0x43, 0x78, 0x5f, 0x5a, 0xfa, 0x07, 0xf9,
-	0xcc, 0x9c, 0xde, 0xc7, 0x32, 0x3d, 0x48, 0x99, 0x1e, 0x0f, 0xfd, 0x7d, 0x0d, 0xfd, 0x54, 0x99,
-	0x1e, 0x8f, 0xfd, 0x7d, 0xe9, 0xe9, 0xcf, 0xe6, 0xb7, 0xc9, 0xf3, 0x79, 0xc4, 0xcf, 0x55, 0xcf,
-	0x42, 0x49, 0xdc, 0x3c, 0x60, 0xae, 0x43, 0x4d, 0xfc, 0xda, 0xa3, 0xb4, 0xfe, 0x5e, 0x7e, 0xdb,
-	0x2c, 0xa5, 0xc7, 0xf2, 0x92, 0xe4, 0xf5, 0xb5, 0xfc, 0x76, 0xf9, 0x55, 0x8f, 0xc5, 0x25, 0x89,
-	0xeb, 0xf7, 0xf2, 0x98, 0xe4, 0xdc, 0x33, 0x5b, 0xd3, 0xb6, 0xeb, 0x49, 0x79, 0xca, 0xff, 0xe2,
-	0x57, 0x8c, 0x83, 0xf0, 0x2f, 0xf7, 0xbb, 0xa7, 0xb8, 0xaf, 0xee, 0xe9, 0xdf, 0xc7, 0x96, 0x26,
-	0x29, 0xd0, 0x43, 0x5b, 0x82, 0xdf, 0xaf, 0x02, 0x3d, 0x80, 0xf5, 0xf7, 0x61, 0x16, 0xe8, 0x5f,
-	0x2b, 0x40, 0x79, 0xc2, 0xb1, 0xd7, 0xad, 0x9b, 0x74, 0x9d, 0xb6, 0x0f, 0x6d, 0xb8, 0xbf, 0x27,
-	0x0c, 0x44, 0x67, 0x8f, 0x06, 0xa2, 0x5f, 0x8e, 0xbc, 0x01, 0x27, 0x42, 0x59, 0xca, 0x31, 0x1e,
-	0xf1, 0x6e, 0xbb, 0xc5, 0x50, 0xcd, 0xb7, 0x19, 0x4e, 0x04, 0x23, 0x8b, 0x53, 0xab, 0xdf, 0x89,
-	0xf4, 0xc6, 0xc3, 0x6d, 0xae, 0xef, 0xbb, 0x37, 0x6e, 0xc3, 0xd9, 0x89, 0xae, 0xe3, 0x50, 0xcb,
-	0x4b, 0xef, 0x14, 0xbc, 0x49, 0x6b, 0x71, 0x8a, 0x66, 0xb2, 0x73, 0x32, 0x0a, 0x33, 0xb6, 0xe2,
-	0x6d, 0x59, 0x9c, 0xed, 0x40, 0xc8, 0xb6, 0xcb, 0x29, 0xd2, 0xd8, 0xa6, 0x17, 0x56, 0x7f, 0x3b,
-	0x2f, 0x77, 0xfd, 0xa1, 0xcd, 0x6a, 0xef, 0x8b, 0xae, 0x57, 0xbf, 0x50, 0x80, 0x31, 0xd6, 0xac,
-	0x45, 0xdd, 0x5d, 0x3d, 0x36, 0x61, 0xf6, 0xb3, 0x40, 0xb0, 0xaf, 0xf0, 0x25, 0x89, 0xe3, 0x46,
-	0xfa, 0x0a, 0x1f, 0x9e, 0xf5, 0x15, 0x3e, 0x5e, 0xfd, 0xb9, 0x62, 0xd8, 0x1d, 0xc7, 0x06, 0xd0,
-	0x61, 0x77, 0x07, 0x99, 0x87, 0xd3, 0x62, 0x6e, 0xf3, 0x41, 0x98, 0xec, 0x47, 0xcc, 0x5f, 0x3c,
-	0x67, 0xa8, 0x98, 0x16, 0xbb, 0x2e, 0x75, 0x9a, 0x9e, 0xee, 0xae, 0x36, 0x31, 0x3b, 0x90, 0x96,
-	0x5a, 0x90, 0x31, 0x14, 0xb3, 0x5a, 0x94, 0xe1, 0x60, 0xc8, 0xd0, 0x9f, 0x10, 0x13, 0x0c, 0xd3,
-	0x0a, 0xaa, 0xbf, 0x98, 0x83, 0x72, 0xfc, 0x73, 0xc8, 0x55, 0x18, 0x64, 0xbf, 0x83, 0xa0, 0x27,
-	0xc2, 0x25, 0x3b, 0xe4, 0xc8, 0xfd, 0x85, 0x7c, 0x1a, 0xf2, 0x32, 0x0c, 0xa1, 0x6b, 0x16, 0x16,
-	0xc8, 0x87, 0xb1, 0x66, 0xc2, 0x02, 0x98, 0x61, 0x9b, 0x17, 0x0b, 0x49, 0xc9, 0x6b, 0x30, 0x5c,
-	0x0f, 0x7d, 0x50, 0xc5, 0x05, 0x34, 0xba, 0xbe, 0x4b, 0x25, 0x43, 0x02, 0x4d, 0xa6, 0x56, 0xbf,
-	0x95, 0x0f, 0x55, 0xfd, 0xd8, 0x34, 0xdd, 0x97, 0x69, 0xfa, 0xf3, 0x05, 0x18, 0x9d, 0xb0, 0x2d,
-	0x4f, 0x6f, 0x79, 0xc7, 0x87, 0xc1, 0xfb, 0x39, 0x64, 0x23, 0x15, 0xe8, 0x9f, 0x5c, 0xd3, 0xcd,
-	0xb6, 0x30, 0x7c, 0x30, 0x22, 0x36, 0x65, 0x00, 0x8d, 0xc3, 0xc9, 0x0d, 0x8c, 0x03, 0xc5, 0x24,
-	0x1d, 0x38, 0xe2, 0x8d, 0x85, 0xc1, 0x83, 0x25, 0x94, 0x48, 0x9f, 0xcd, 0x01, 0x7c, 0xe4, 0xc8,
-	0x25, 0xe5, 0x3e, 0x3b, 0x3e, 0x18, 0x3d, 0x22, 0x7d, 0xf6, 0x95, 0x02, 0x9c, 0x8d, 0x3b, 0x04,
-	0x1e, 0x0f, 0x38, 0xd1, 0x79, 0x7f, 0x09, 0x4e, 0xc7, 0x65, 0x53, 0x63, 0xd2, 0xe8, 0xef, 0xed,
-	0x3b, 0x72, 0x75, 0x6b, 0xb3, 0xf2, 0x78, 0xd2, 0x17, 0x93, 0x55, 0x96, 0xea, 0x4d, 0x92, 0x5a,
-	0x49, 0x6a, 0xcf, 0xbc, 0x47, 0x5e, 0x09, 0x3f, 0xe4, 0x3d, 0xf3, 0x13, 0xf9, 0x64, 0xcf, 0x1c,
-	0x4f, 0x78, 0x62, 0xe1, 0xfe, 0x9d, 0x3c, 0x3c, 0x15, 0x17, 0xce, 0x9b, 0x2f, 0x3d, 0xf7, 0x8a,
-	0x46, 0xfd, 0xa0, 0xa1, 0xc7, 0xd3, 0x8b, 0x50, 0x62, 0x8c, 0xfe, 0xaa, 0xbb, 0xc1, 0xcb, 0x41,
-	0x11, 0xfd, 0x95, 0x41, 0x34, 0x81, 0xd9, 0x81, 0x38, 0x8f, 0xe7, 0x84, 0x5d, 0x88, 0xf3, 0xa7,
-	0xb7, 0x15, 0xe7, 0xf1, 0x40, 0xf6, 0xdd, 0xd5, 0x8a, 0x00, 0x37, 0x4c, 0x4f, 0x84, 0x56, 0x3e,
-	0xe2, 0x57, 0x65, 0x92, 0x9f, 0x6b, 0x71, 0x4f, 0x7e, 0xae, 0x61, 0xc0, 0xa4, 0xfe, 0x3d, 0x04,
-	0x4c, 0x7a, 0x03, 0x06, 0x84, 0x1c, 0xc5, 0xbe, 0xfd, 0x5c, 0xf8, 0x15, 0x08, 0xce, 0xaa, 0xde,
-	0x97, 0xfe, 0x07, 0x60, 0xc0, 0xe5, 0x41, 0xc4, 0xc4, 0xbe, 0x1a, 0xdf, 0xd3, 0x08, 0x90, 0xe6,
-	0xff, 0x41, 0x2e, 0x02, 0xe6, 0xc3, 0x90, 0x9f, 0xbb, 0xf0, 0xfc, 0x18, 0xec, 0x5f, 0x52, 0x87,
-	0x01, 0xf1, 0x6a, 0x40, 0x01, 0x7c, 0xab, 0x1b, 0xa8, 0x65, 0xd8, 0xcf, 0xfc, 0xf1, 0x00, 0x3f,
-	0xb3, 0x16, 0xc4, 0xf2, 0x23, 0x66, 0x01, 0x52, 0x7f, 0x23, 0x07, 0xe5, 0x78, 0x21, 0xf2, 0x0c,
-	0x94, 0xf8, 0x5f, 0x62, 0x87, 0x8e, 0xb1, 0x4c, 0x79, 0x09, 0x39, 0x96, 0xa9, 0xa0, 0x7e, 0x09,
-	0x86, 0x34, 0xff, 0x29, 0x88, 0xd8, 0xa1, 0xa3, 0xff, 0x6e, 0xf0, 0x3e, 0x44, 0xf6, 0xdf, 0x0d,
-	0x28, 0xc9, 0x93, 0x50, 0x98, 0x6f, 0x1b, 0x62, 0x63, 0x8e, 0x6f, 0x76, 0xec, 0xb6, 0x1c, 0xa8,
-	0x95, 0x61, 0x19, 0xd1, 0x1c, 0x5d, 0x17, 0xce, 0xde, 0x48, 0x64, 0xd1, 0x75, 0x99, 0x68, 0x8e,
-	0xae, 0xab, 0xbf, 0x9b, 0xf3, 0xdd, 0x77, 0x67, 0x4c, 0xd7, 0xab, 0x5b, 0xf7, 0xf5, 0xb6, 0x19,
-	0x74, 0x04, 0xb9, 0x01, 0x63, 0x21, 0x52, 0x7a, 0xf3, 0x9f, 0x88, 0x8d, 0x83, 0xaf, 0xc2, 0x1f,
-	0x0f, 0x79, 0xc7, 0x8a, 0x91, 0x4b, 0x92, 0xf2, 0x4b, 0xa7, 0x16, 0xf2, 0x43, 0x72, 0xe1, 0x8a,
-	0x3d, 0x32, 0x6b, 0xba, 0xae, 0x69, 0x2d, 0xf3, 0xf7, 0x88, 0x05, 0x7c, 0x6a, 0x84, 0xe7, 0x27,
-	0x6b, 0x1c, 0xde, 0x74, 0x18, 0x42, 0x7e, 0x33, 0x2d, 0x17, 0x50, 0xff, 0x7d, 0x0e, 0x2e, 0x30,
-	0x4e, 0x18, 0xa5, 0x33, 0xf1, 0x61, 0xfb, 0x1a, 0xc0, 0x6b, 0x3d, 0x24, 0x25, 0x46, 0xf5, 0x13,
-	0xc9, 0xc0, 0x14, 0x31, 0xc2, 0x18, 0xf7, 0x1e, 0xb2, 0xdf, 0x5b, 0xa0, 0xb4, 0xdf, 0xc9, 0xe1,
-	0xf5, 0xe0, 0x52, 0x9b, 0xde, 0x9e, 0xab, 0xbf, 0x79, 0x40, 0x17, 0xd8, 0x7b, 0x9d, 0xba, 0x3e,
-	0x0e, 0x65, 0x17, 0xdb, 0xd2, 0xec, 0x5a, 0xe6, 0x03, 0x3c, 0xf9, 0x12, 0x1f, 0x73, 0x56, 0xfa,
-	0x18, 0xa9, 0xad, 0xda, 0x18, 0xa7, 0xbf, 0x6d, 0x99, 0x0f, 0x30, 0x48, 0xe9, 0xc7, 0x30, 0xee,
-	0xbb, 0x44, 0x41, 0x2e, 0xc0, 0x20, 0xe3, 0x63, 0x05, 0xca, 0xa8, 0x05, 0xbf, 0x49, 0x19, 0x0a,
-	0x5d, 0xd3, 0xc0, 0x66, 0xf6, 0x6b, 0xec, 0x4f, 0xf5, 0x8f, 0x0a, 0x70, 0xb2, 0x7a, 0xb7, 0x51,
-	0x9f, 0x08, 0x5e, 0x31, 0x88, 0x87, 0xa6, 0x6b, 0xbb, 0x94, 0x85, 0x4f, 0x4f, 0x26, 0x60, 0x8c,
-	0x07, 0x0a, 0x10, 0xc1, 0xec, 0xf9, 0xb9, 0x54, 0x3f, 0x7f, 0x4d, 0x11, 0xc5, 0x48, 0x4a, 0x3a,
-	0x8a, 0x18, 0x11, 0xf3, 0xde, 0x25, 0x2d, 0x38, 0x1f, 0x21, 0x6d, 0xea, 0x41, 0x1c, 0x36, 0x3f,
-	0x06, 0xc6, 0x07, 0xb7, 0x36, 0x2b, 0x4f, 0x66, 0x12, 0x49, 0xac, 0xcf, 0xc9, 0xac, 0xc3, 0x78,
-	0x6e, 0x2e, 0xb9, 0x05, 0x27, 0x79, 0x79, 0x3c, 0xb4, 0x0b, 0x9c, 0x24, 0x18, 0x73, 0x29, 0xde,
-	0x81, 0x84, 0x94, 0x63, 0x5b, 0x21, 0x92, 0x09, 0x5c, 0x3c, 0x12, 0xbe, 0x0b, 0x67, 0x38, 0x7d,
-	0x87, 0x3a, 0x38, 0x12, 0x6d, 0xab, 0xe9, 0x52, 0x4f, 0xbc, 0x35, 0x1e, 0x7f, 0x72, 0x6b, 0xb3,
-	0x52, 0x49, 0x25, 0x90, 0x98, 0x9e, 0x42, 0x82, 0x85, 0x00, 0xdf, 0xa0, 0x9e, 0xec, 0xa7, 0x51,
-	0xda, 0x85, 0x9a, 0xff, 0x64, 0x1e, 0xce, 0x4d, 0x53, 0xbd, 0xed, 0xad, 0x4c, 0xac, 0xd0, 0xd6,
-	0xea, 0xb1, 0xab, 0x74, 0xc4, 0x6a, 0x49, 0x95, 0xce, 0xb1, 0x89, 0xdc, 0x4b, 0x3a, 0xc7, 0x16,
-	0xaf, 0x90, 0xce, 0xd7, 0xf2, 0x70, 0x39, 0x6d, 0x73, 0x80, 0xb7, 0x03, 0xce, 0xfc, 0x7d, 0xea,
-	0x38, 0xa6, 0x41, 0x0f, 0x71, 0x51, 0x39, 0x38, 0x7b, 0x58, 0xee, 0xb0, 0xe2, 0x1e, 0x3d, 0x62,
-	0x77, 0x26, 0xae, 0x43, 0x4c, 0x62, 0xf3, 0xde, 0x12, 0xd7, 0x8f, 0xe7, 0xe1, 0x74, 0xc3, 0x5c,
-	0x76, 0x3d, 0xdb, 0xa1, 0x0b, 0x18, 0xb1, 0xe3, 0x58, 0x93, 0x32, 0x45, 0x73, 0x88, 0xb9, 0xa2,
-	0xde, 0xeb, 0xa2, 0x39, 0x1e, 0x50, 0x1c, 0xff, 0xf4, 0x2c, 0xbf, 0x0d, 0xbf, 0x65, 0x5a, 0x06,
-	0x39, 0x0f, 0x67, 0x6e, 0x37, 0x26, 0xb5, 0xe6, 0xad, 0xfa, 0x5c, 0xad, 0x79, 0x7b, 0xae, 0xb1,
-	0x30, 0x39, 0x51, 0x9f, 0xaa, 0x4f, 0xd6, 0xca, 0x7d, 0xe4, 0x14, 0x9c, 0x08, 0x51, 0xd3, 0xb7,
-	0x67, 0xab, 0x73, 0xe5, 0x1c, 0x39, 0x09, 0xa3, 0x21, 0x70, 0x7c, 0x7e, 0xb1, 0x9c, 0x7f, 0xfa,
-	0x27, 0x72, 0x00, 0x8c, 0xdf, 0xbc, 0x63, 0x2e, 0x9b, 0x16, 0x79, 0x04, 0xce, 0x21, 0xc5, 0xbc,
-	0x56, 0xbf, 0x51, 0x9f, 0x8b, 0xf1, 0x3c, 0x03, 0x27, 0x65, 0xe4, 0xcc, 0xfc, 0x44, 0x75, 0xa6,
-	0x9c, 0x0b, 0xaa, 0x12, 0xe0, 0x46, 0x63, 0xbe, 0x9c, 0x27, 0xa7, 0xa1, 0x2c, 0x03, 0xe7, 0x6f,
-	0x2d, 0x56, 0xcb, 0x85, 0x38, 0xb4, 0x31, 0x51, 0x9f, 0x2d, 0x17, 0xc9, 0x39, 0x38, 0x25, 0x43,
-	0x27, 0xe7, 0x16, 0xb5, 0x6a, 0xbd, 0x56, 0xee, 0x7f, 0xfa, 0x83, 0x30, 0x8c, 0xb1, 0x83, 0xc4,
-	0xde, 0x79, 0x04, 0x06, 0xe7, 0xc7, 0x1b, 0x93, 0xda, 0x1d, 0x6c, 0x0d, 0x40, 0xa9, 0x36, 0x39,
-	0xc7, 0x5a, 0x96, 0x7b, 0xfa, 0xff, 0xca, 0x01, 0x34, 0xa6, 0x16, 0x17, 0x04, 0xe1, 0x30, 0x0c,
-	0xd4, 0xe7, 0xee, 0x54, 0x67, 0xea, 0x8c, 0x6e, 0x10, 0x8a, 0xf3, 0x0b, 0x93, 0xec, 0xf3, 0x87,
-	0xa0, 0x7f, 0x62, 0x66, 0xbe, 0x31, 0x59, 0xce, 0x33, 0xa0, 0x36, 0x59, 0xad, 0x95, 0x0b, 0x0c,
-	0x78, 0x57, 0xab, 0x2f, 0x4e, 0x96, 0x8b, 0xec, 0xcf, 0x99, 0xc6, 0x62, 0x75, 0xb1, 0xdc, 0xcf,
-	0xfe, 0x9c, 0xc2, 0x3f, 0x4b, 0x8c, 0x59, 0x63, 0x72, 0x11, 0x7f, 0x0c, 0xb0, 0x26, 0x4c, 0xf9,
-	0xbf, 0x06, 0x19, 0x8a, 0xb1, 0xae, 0xd5, 0xb5, 0xf2, 0x10, 0xfb, 0xc1, 0x58, 0xb2, 0x1f, 0xc0,
-	0x1a, 0xa7, 0x4d, 0xce, 0xce, 0xdf, 0x99, 0x2c, 0x0f, 0x33, 0x5e, 0xb3, 0xb7, 0x18, 0x78, 0x84,
-	0xfd, 0xa9, 0xcd, 0xb2, 0x3f, 0x47, 0x19, 0x27, 0x6d, 0xb2, 0x3a, 0xb3, 0x50, 0x5d, 0x9c, 0x2e,
-	0x8f, 0xb1, 0xf6, 0x20, 0xcf, 0x13, 0xbc, 0xe4, 0x5c, 0x75, 0x76, 0xb2, 0x5c, 0x16, 0x34, 0xb5,
-	0x99, 0xfa, 0xdc, 0xad, 0xf2, 0x49, 0x6c, 0xc8, 0x5b, 0xb3, 0xf8, 0x83, 0xb0, 0x02, 0xf8, 0xd7,
-	0xa9, 0xa7, 0xbf, 0x0b, 0x4a, 0xf3, 0x0d, 0xbc, 0xc5, 0x3f, 0x07, 0xa7, 0xe6, 0x1b, 0xcd, 0xc5,
-	0xb7, 0x16, 0x26, 0x63, 0x1d, 0x77, 0x12, 0x46, 0x7d, 0xc4, 0x4c, 0x7d, 0xee, 0xf6, 0x9b, 0x5c,
-	0x15, 0x7c, 0xd0, 0x6c, 0x75, 0x62, 0xbe, 0x51, 0xce, 0xb3, 0x7e, 0xf4, 0x41, 0x77, 0xeb, 0x73,
-	0xb5, 0xf9, 0xbb, 0x8d, 0x72, 0xe1, 0xe9, 0xfb, 0x30, 0x52, 0xa3, 0xf7, 0xcd, 0x16, 0x15, 0x0a,
-	0xf2, 0x28, 0x9c, 0xaf, 0x4d, 0xde, 0xa9, 0x4f, 0x4c, 0x66, 0xaa, 0x48, 0x14, 0x5d, 0x5d, 0xa8,
-	0x97, 0x73, 0xe4, 0x2c, 0x90, 0x28, 0xf8, 0x66, 0x75, 0x76, 0xaa, 0x9c, 0x27, 0x0a, 0x9c, 0x8e,
-	0xc2, 0xeb, 0x73, 0x8b, 0xb7, 0xe7, 0x26, 0xcb, 0x85, 0xa7, 0xff, 0x76, 0x0e, 0xce, 0xa4, 0x66,
-	0x02, 0x27, 0x2a, 0x3c, 0x36, 0x39, 0x53, 0x6d, 0x2c, 0xd6, 0x27, 0x1a, 0x93, 0x55, 0x6d, 0x62,
-	0xba, 0x39, 0x51, 0x5d, 0x9c, 0xbc, 0x31, 0xaf, 0xbd, 0xd5, 0xbc, 0x31, 0x39, 0x37, 0xa9, 0x55,
-	0x67, 0xca, 0x7d, 0xe4, 0x49, 0xa8, 0x64, 0xd0, 0x34, 0x26, 0x27, 0x6e, 0x6b, 0xf5, 0xc5, 0xb7,
-	0xca, 0x39, 0xf2, 0x04, 0x3c, 0x9a, 0x49, 0xc4, 0x7e, 0x97, 0xf3, 0xe4, 0x31, 0xb8, 0x90, 0x45,
-	0xf2, 0x89, 0x99, 0x72, 0xe1, 0xe9, 0x1f, 0xcf, 0x01, 0x49, 0xa6, 0x72, 0x26, 0x8f, 0xc3, 0x45,
-	0xa6, 0x17, 0xcd, 0xec, 0x06, 0x3e, 0x01, 0x8f, 0xa6, 0x52, 0x48, 0xcd, 0xab, 0xc0, 0x23, 0x19,
-	0x24, 0xa2, 0x71, 0x17, 0x41, 0x49, 0x27, 0xc0, 0xa6, 0xfd, 0x42, 0x0e, 0xce, 0xa4, 0x86, 0xd3,
-	0x20, 0x97, 0xe1, 0xa9, 0x6a, 0x6d, 0x96, 0xf5, 0xcd, 0xc4, 0x62, 0x7d, 0x7e, 0xae, 0xd1, 0x9c,
-	0x9d, 0xaa, 0x36, 0x99, 0xf6, 0xdd, 0x6e, 0xc4, 0x7a, 0xf3, 0x12, 0xa8, 0x3d, 0x28, 0x27, 0xa6,
-	0xab, 0x73, 0x37, 0xd8, 0xf0, 0x23, 0x4f, 0xc1, 0xe3, 0x99, 0x74, 0x93, 0x73, 0xd5, 0xf1, 0x99,
-	0xc9, 0x5a, 0x39, 0x4f, 0x3e, 0x00, 0x4f, 0x64, 0x52, 0xd5, 0xea, 0x0d, 0x4e, 0x56, 0x78, 0x5a,
-	0x8f, 0x5c, 0xf2, 0xb2, 0xaf, 0x9c, 0x98, 0x9f, 0x5b, 0xac, 0x4e, 0x2c, 0xa6, 0x69, 0xf6, 0x79,
-	0x38, 0x13, 0xc1, 0x8e, 0xdf, 0x6e, 0xd4, 0xe7, 0x26, 0x1b, 0x8d, 0x72, 0x2e, 0x81, 0x0a, 0x44,
-	0x9b, 0x1f, 0xaf, 0x7d, 0xeb, 0x7f, 0x7c, 0xac, 0xef, 0x5b, 0x7f, 0xfa, 0x58, 0xee, 0xf7, 0xff,
-	0xf4, 0xb1, 0xdc, 0xbf, 0xfe, 0xd3, 0xc7, 0x72, 0x9f, 0xbc, 0xbe, 0x9b, 0x2c, 0xe0, 0x7c, 0xca,
-	0x5e, 0x2a, 0xe1, 0x3d, 0xdb, 0x0b, 0xff, 0x5f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xb3, 0xfc, 0xdb,
-	0x68, 0xce, 0xb2, 0x01, 0x00,
+var xxx_messageInfo_MCPSessionStart proto.InternalMessageInfo
+
+// MCPSessionEnd is emitted when an MCP session ends.
+type MCPSessionEnd struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=User,proto3,embedded=User" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=Session,proto3,embedded=Session" json:""`
+	// ServerMetadata is a common server metadata
+	ServerMetadata `protobuf:"bytes,4,opt,name=Server,proto3,embedded=Server" json:""`
+	// ConnectionMetadata holds information about the connection
+	ConnectionMetadata `protobuf:"bytes,5,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,6,opt,name=App,proto3,embedded=App" json:""`
+	// Status contains common command or operation status fields.
+	//
+	// The protocol spec states that the MCP server may refuse the clients from
+	// terminating the session.
+	// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management
+	Status `protobuf:"bytes,7,opt,name=Status,proto3,embedded=Status" json:""`
+	// Headers are the HTTP request headers.
+	Headers              github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,8,opt,name=headers,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"headers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                    `json:"-"`
+	XXX_unrecognized     []byte                                                      `json:"-"`
+	XXX_sizecache        int32                                                       `json:"-"`
 }
 
-func (m *Metadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+func (m *MCPSessionEnd) Reset()         { *m = MCPSessionEnd{} }
+func (m *MCPSessionEnd) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionEnd) ProtoMessage()    {}
+func (*MCPSessionEnd) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{268}
+}
+func (m *MCPSessionEnd) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionEnd) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionEnd.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *MCPSessionEnd) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionEnd.Merge(m, src)
+}
+func (m *MCPSessionEnd) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionEnd) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionEnd.DiscardUnknown(m)
 }
 
-func (m *Metadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_MCPSessionEnd proto.InternalMessageInfo
+
+// MCPJSONRPCMessage includes details of a MCP request or notification.
+// https://modelcontextprotocol.io/docs/concepts/transports#requests
+type MCPJSONRPCMessage struct {
+	// JSONRPC specifies the version of the protocol.
+	JSONRPC string `protobuf:"bytes,1,opt,name=JSONRPC,proto3" json:"jsonrpc"`
+	// ID is the ID of a request. Notifications have no IDs.
+	ID string `protobuf:"bytes,2,opt,name=ID,proto3" json:"id,omitempty"`
+	// Method is the method of this message.
+	Method string `protobuf:"bytes,3,opt,name=method,proto3" json:"method"`
+	// Params is the optional parameters.
+	Params               *Struct  `protobuf:"bytes,5,opt,name=params,proto3,casttype=Struct" json:"params,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *Metadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.ClusterName) > 0 {
-		i -= len(m.ClusterName)
-		copy(dAtA[i:], m.ClusterName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClusterName)))
-		i--
-		dAtA[i] = 0x32
-	}
-	n1, err1 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
-	if err1 != nil {
-		return 0, err1
-	}
-	i -= n1
-	i = encodeVarintEvents(dAtA, i, uint64(n1))
-	i--
-	dAtA[i] = 0x2a
-	if len(m.Code) > 0 {
-		i -= len(m.Code)
-		copy(dAtA[i:], m.Code)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Code)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.ID) > 0 {
-		i -= len(m.ID)
-		copy(dAtA[i:], m.ID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.Type) > 0 {
-		i -= len(m.Type)
-		copy(dAtA[i:], m.Type)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Type)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if m.Index != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Index))
-		i--
-		dAtA[i] = 0x8
+func (m *MCPJSONRPCMessage) Reset()         { *m = MCPJSONRPCMessage{} }
+func (m *MCPJSONRPCMessage) String() string { return proto.CompactTextString(m) }
+func (*MCPJSONRPCMessage) ProtoMessage()    {}
+func (*MCPJSONRPCMessage) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{269}
+}
+func (m *MCPJSONRPCMessage) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPJSONRPCMessage) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPJSONRPCMessage.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return len(dAtA) - i, nil
+}
+func (m *MCPJSONRPCMessage) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPJSONRPCMessage.Merge(m, src)
+}
+func (m *MCPJSONRPCMessage) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPJSONRPCMessage) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPJSONRPCMessage.DiscardUnknown(m)
 }
 
-func (m *SessionMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+var xxx_messageInfo_MCPJSONRPCMessage proto.InternalMessageInfo
+
+// MCPSessionRequest is emitted when a request is sent by client during a MCP session.
+type MCPSessionRequest struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=user,proto3,embedded=user" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=session,proto3,embedded=session" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,4,opt,name=App,proto3,embedded=App" json:""`
+	// Status contains information whether the request is successful or not.
+	Status `protobuf:"bytes,5,opt,name=status,proto3,embedded=status" json:""`
+	// Message contains details of the message.
+	Message MCPJSONRPCMessage `protobuf:"bytes,6,opt,name=message,proto3" json:"message,omitempty"`
+	// Headers are the HTTP request headers.
+	Headers              github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,7,opt,name=headers,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"headers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                    `json:"-"`
+	XXX_unrecognized     []byte                                                      `json:"-"`
+	XXX_sizecache        int32                                                       `json:"-"`
+}
+
+func (m *MCPSessionRequest) Reset()         { *m = MCPSessionRequest{} }
+func (m *MCPSessionRequest) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionRequest) ProtoMessage()    {}
+func (*MCPSessionRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{270}
+}
+func (m *MCPSessionRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *MCPSessionRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionRequest.Merge(m, src)
+}
+func (m *MCPSessionRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionRequest.DiscardUnknown(m)
 }
 
-func (m *SessionMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_MCPSessionRequest proto.InternalMessageInfo
+
+// MCPSessionNotification is emitted when a notification is sent by client
+// during a MCP session.
+type MCPSessionNotification struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=user,proto3,embedded=user" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=session,proto3,embedded=session" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,4,opt,name=App,proto3,embedded=App" json:""`
+	// Message contains details of the message.
+	Message MCPJSONRPCMessage `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
+	// Status contains information whether the request is successful or not.
+	Status `protobuf:"bytes,6,opt,name=status,proto3,embedded=status" json:""`
+	// Headers are the HTTP request headers.
+	Headers              github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,7,opt,name=headers,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"headers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                    `json:"-"`
+	XXX_unrecognized     []byte                                                      `json:"-"`
+	XXX_sizecache        int32                                                       `json:"-"`
 }
 
-func (m *SessionMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.PrivateKeyPolicy) > 0 {
-		i -= len(m.PrivateKeyPolicy)
-		copy(dAtA[i:], m.PrivateKeyPolicy)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PrivateKeyPolicy)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.WithMFA) > 0 {
-		i -= len(m.WithMFA)
-		copy(dAtA[i:], m.WithMFA)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.WithMFA)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.SessionID) > 0 {
-		i -= len(m.SessionID)
-		copy(dAtA[i:], m.SessionID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionID)))
-		i--
-		dAtA[i] = 0xa
+func (m *MCPSessionNotification) Reset()         { *m = MCPSessionNotification{} }
+func (m *MCPSessionNotification) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionNotification) ProtoMessage()    {}
+func (*MCPSessionNotification) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{271}
+}
+func (m *MCPSessionNotification) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionNotification) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionNotification.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return len(dAtA) - i, nil
+}
+func (m *MCPSessionNotification) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionNotification.Merge(m, src)
+}
+func (m *MCPSessionNotification) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionNotification) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionNotification.DiscardUnknown(m)
 }
 
-func (m *UserMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+var xxx_messageInfo_MCPSessionNotification proto.InternalMessageInfo
+
+// MCPSessionListenSSEStream is emitted when client sends a GET request to a
+// streamable HTTP MCP server for listening server notifications via a SSE
+// stream.
+type MCPSessionListenSSEStream struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=user,proto3,embedded=user" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=session,proto3,embedded=session" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,4,opt,name=app,proto3,embedded=app" json:""`
+	// Status contains information whether the request is successful or not.
+	Status `protobuf:"bytes,5,opt,name=status,proto3,embedded=status" json:""`
+	// Headers are the HTTP request headers.
+	Headers              github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,6,opt,name=headers,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"headers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                    `json:"-"`
+	XXX_unrecognized     []byte                                                      `json:"-"`
+	XXX_sizecache        int32                                                       `json:"-"`
+}
+
+func (m *MCPSessionListenSSEStream) Reset()         { *m = MCPSessionListenSSEStream{} }
+func (m *MCPSessionListenSSEStream) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionListenSSEStream) ProtoMessage()    {}
+func (*MCPSessionListenSSEStream) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{272}
+}
+func (m *MCPSessionListenSSEStream) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionListenSSEStream) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionListenSSEStream.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *MCPSessionListenSSEStream) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionListenSSEStream.Merge(m, src)
+}
+func (m *MCPSessionListenSSEStream) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionListenSSEStream) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionListenSSEStream.DiscardUnknown(m)
 }
 
-func (m *UserMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_MCPSessionListenSSEStream proto.InternalMessageInfo
+
+// MCPSessionInvalidHTTPRequest is a blanket event for all requests that we do
+// not understand (usually out of MCP spec).
+type MCPSessionInvalidHTTPRequest struct {
+	// Metadata is a common event metadata
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// User is a common user event metadata
+	UserMetadata `protobuf:"bytes,2,opt,name=user,proto3,embedded=user" json:""`
+	// SessionMetadata is a common event session metadata
+	SessionMetadata `protobuf:"bytes,3,opt,name=session,proto3,embedded=session" json:""`
+	// App is a common application resource metadata.
+	AppMetadata `protobuf:"bytes,4,opt,name=app,proto3,embedded=app" json:""`
+	// Path is relative path in the URL.
+	Path string `protobuf:"bytes,5,opt,name=path,proto3" json:"path"`
+	// Method is the request HTTP method, like GET/POST/DELETE/etc.
+	Method string `protobuf:"bytes,6,opt,name=method,proto3" json:"method"`
+	// RawQuery are the encoded query values.
+	RawQuery string `protobuf:"bytes,7,opt,name=raw_query,json=rawQuery,proto3" json:"raw_query"`
+	// Body is the request HTTP body.
+	Body []byte `protobuf:"bytes,8,opt,name=body,proto3" json:"body"`
+	// Headers are the HTTP request headers.
+	Headers              github_com_gravitational_teleport_api_types_wrappers.Traits `protobuf:"bytes,9,opt,name=headers,proto3,customtype=github.com/gravitational/teleport/api/types/wrappers.Traits" json:"headers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                    `json:"-"`
+	XXX_unrecognized     []byte                                                      `json:"-"`
+	XXX_sizecache        int32                                                       `json:"-"`
 }
 
-func (m *UserMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.UserOrigin != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.UserOrigin))
-		i--
-		dAtA[i] = 0x68
-	}
-	if len(m.BotInstanceID) > 0 {
-		i -= len(m.BotInstanceID)
-		copy(dAtA[i:], m.BotInstanceID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotInstanceID)))
-		i--
-		dAtA[i] = 0x62
-	}
-	if len(m.BotName) > 0 {
-		i -= len(m.BotName)
-		copy(dAtA[i:], m.BotName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
-		i--
-		dAtA[i] = 0x5a
-	}
-	if m.UserKind != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.UserKind))
-		i--
-		dAtA[i] = 0x50
-	}
-	if len(m.RequiredPrivateKeyPolicy) > 0 {
-		i -= len(m.RequiredPrivateKeyPolicy)
-		copy(dAtA[i:], m.RequiredPrivateKeyPolicy)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequiredPrivateKeyPolicy)))
-		i--
-		dAtA[i] = 0x4a
-	}
-	if m.TrustedDevice != nil {
-		{
-			size, err := m.TrustedDevice.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+func (m *MCPSessionInvalidHTTPRequest) Reset()         { *m = MCPSessionInvalidHTTPRequest{} }
+func (m *MCPSessionInvalidHTTPRequest) String() string { return proto.CompactTextString(m) }
+func (*MCPSessionInvalidHTTPRequest) ProtoMessage()    {}
+func (*MCPSessionInvalidHTTPRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{273}
+}
+func (m *MCPSessionInvalidHTTPRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPSessionInvalidHTTPRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPSessionInvalidHTTPRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.GCPServiceAccount) > 0 {
-		i -= len(m.GCPServiceAccount)
-		copy(dAtA[i:], m.GCPServiceAccount)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.GCPServiceAccount)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.AzureIdentity) > 0 {
-		i -= len(m.AzureIdentity)
-		copy(dAtA[i:], m.AzureIdentity)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AzureIdentity)))
-		i--
-		dAtA[i] = 0x32
+		return b[:n], nil
 	}
-	if len(m.AccessRequests) > 0 {
-		for iNdEx := len(m.AccessRequests) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.AccessRequests[iNdEx])
-			copy(dAtA[i:], m.AccessRequests[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessRequests[iNdEx])))
-			i--
-			dAtA[i] = 0x2a
+}
+func (m *MCPSessionInvalidHTTPRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPSessionInvalidHTTPRequest.Merge(m, src)
+}
+func (m *MCPSessionInvalidHTTPRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPSessionInvalidHTTPRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPSessionInvalidHTTPRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MCPSessionInvalidHTTPRequest proto.InternalMessageInfo
+
+// BoundKeypairRecovery is emitted when a client performs a self recovery using
+// a bound_keypair joining token. This event is also emitted upon first join.
+type BoundKeypairRecovery struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// Status contains common command or operation status fields.
+	Status `protobuf:"bytes,2,opt,name=Status,proto3,embedded=Status" json:""`
+	// ConnectionMetadata holds information about the connection
+	ConnectionMetadata `protobuf:"bytes,3,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// TokenName is the name of the provision token used to join.
+	TokenName string `protobuf:"bytes,4,opt,name=TokenName,proto3" json:"token_name"`
+	// BotName is the name of the bot attempting to join, if any.
+	BotName string `protobuf:"bytes,5,opt,name=BotName,proto3" json:"bot_name,omitempty"`
+	// PublicKey is the public key at the completion of the joining process, in
+	// SSH authorized_keys format. If a keypair rotation occurred, this is the
+	// keypair trusted at the end of the join process.
+	PublicKey string `protobuf:"bytes,6,opt,name=PublicKey,proto3" json:"public_key,omitempty"`
+	// RecoveryCount is the recovery counter value at the time of this recovery.
+	RecoveryCount uint32 `protobuf:"varint,7,opt,name=RecoveryCount,proto3" json:"recovery_count"`
+	// RecoveryMode is the bound keypair token's configured recovery mode.
+	RecoveryMode         string   `protobuf:"bytes,8,opt,name=RecoveryMode,proto3" json:"recovery_mode"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *BoundKeypairRecovery) Reset()         { *m = BoundKeypairRecovery{} }
+func (m *BoundKeypairRecovery) String() string { return proto.CompactTextString(m) }
+func (*BoundKeypairRecovery) ProtoMessage()    {}
+func (*BoundKeypairRecovery) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{274}
+}
+func (m *BoundKeypairRecovery) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *BoundKeypairRecovery) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_BoundKeypairRecovery.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if len(m.AWSRoleARN) > 0 {
-		i -= len(m.AWSRoleARN)
-		copy(dAtA[i:], m.AWSRoleARN)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSRoleARN)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.Impersonator) > 0 {
-		i -= len(m.Impersonator)
-		copy(dAtA[i:], m.Impersonator)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Impersonator)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.Login) > 0 {
-		i -= len(m.Login)
-		copy(dAtA[i:], m.Login)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Login)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.User) > 0 {
-		i -= len(m.User)
-		copy(dAtA[i:], m.User)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.User)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+}
+func (m *BoundKeypairRecovery) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_BoundKeypairRecovery.Merge(m, src)
+}
+func (m *BoundKeypairRecovery) XXX_Size() int {
+	return m.Size()
+}
+func (m *BoundKeypairRecovery) XXX_DiscardUnknown() {
+	xxx_messageInfo_BoundKeypairRecovery.DiscardUnknown(m)
 }
 
-func (m *ServerMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+var xxx_messageInfo_BoundKeypairRecovery proto.InternalMessageInfo
+
+// BoundKeypairRotation is emitted when a keypair rotation takes place.
+type BoundKeypairRotation struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// Status contains common command or operation status fields.
+	Status `protobuf:"bytes,2,opt,name=Status,proto3,embedded=Status" json:""`
+	// ConnectionMetadata holds information about the connection
+	ConnectionMetadata `protobuf:"bytes,3,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// TokenName is the name of the provision token used to join.
+	TokenName string `protobuf:"bytes,4,opt,name=TokenName,proto3" json:"token_name"`
+	// BotName is the name of the bot attempting to join, if any.
+	BotName string `protobuf:"bytes,5,opt,name=BotName,proto3" json:"bot_name,omitempty"`
+	// PreviousPublicKey is the previous public key in SSH authorized_keys format.
+	// On first join using a registration secret, this value will be empty.
+	PreviousPublicKey string `protobuf:"bytes,6,opt,name=PreviousPublicKey,proto3" json:"previous_public_key,omitempty"`
+	// NewPublicKey is the new public key after rotation. If rotation fails, this
+	// value will be empty.
+	NewPublicKey         string   `protobuf:"bytes,7,opt,name=NewPublicKey,proto3" json:"new_public_key,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *BoundKeypairRotation) Reset()         { *m = BoundKeypairRotation{} }
+func (m *BoundKeypairRotation) String() string { return proto.CompactTextString(m) }
+func (*BoundKeypairRotation) ProtoMessage()    {}
+func (*BoundKeypairRotation) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{275}
+}
+func (m *BoundKeypairRotation) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *BoundKeypairRotation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_BoundKeypairRotation.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *BoundKeypairRotation) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_BoundKeypairRotation.Merge(m, src)
+}
+func (m *BoundKeypairRotation) XXX_Size() int {
+	return m.Size()
+}
+func (m *BoundKeypairRotation) XXX_DiscardUnknown() {
+	xxx_messageInfo_BoundKeypairRotation.DiscardUnknown(m)
 }
 
-func (m *ServerMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_BoundKeypairRotation proto.InternalMessageInfo
+
+// BoundKeypairJoinStateVerificationFailed is emitted when join state
+// verification fails, potentially indicating a compromised keypair.
+type BoundKeypairJoinStateVerificationFailed struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// Status contains information about the failure.
+	Status `protobuf:"bytes,2,opt,name=Status,proto3,embedded=Status" json:""`
+	// ConnectionMetadata holds information about the connection
+	ConnectionMetadata `protobuf:"bytes,3,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// TokenName is the name of the provision token used to join.
+	TokenName string `protobuf:"bytes,4,opt,name=TokenName,proto3" json:"token_name"`
+	// BotName is the name of the bot attempting to join, if any.
+	BotName              string   `protobuf:"bytes,5,opt,name=BotName,proto3" json:"bot_name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *ServerMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.ServerVersion) > 0 {
-		i -= len(m.ServerVersion)
-		copy(dAtA[i:], m.ServerVersion)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerVersion)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.ServerSubKind) > 0 {
-		i -= len(m.ServerSubKind)
-		copy(dAtA[i:], m.ServerSubKind)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerSubKind)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.ForwardedBy) > 0 {
-		i -= len(m.ForwardedBy)
-		copy(dAtA[i:], m.ForwardedBy)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ForwardedBy)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.ServerLabels) > 0 {
-		for k := range m.ServerLabels {
-			v := m.ServerLabels[k]
-			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
-			i--
-			dAtA[i] = 0x12
-			i -= len(k)
-			copy(dAtA[i:], k)
-			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x2a
+func (m *BoundKeypairJoinStateVerificationFailed) Reset() {
+	*m = BoundKeypairJoinStateVerificationFailed{}
+}
+func (m *BoundKeypairJoinStateVerificationFailed) String() string { return proto.CompactTextString(m) }
+func (*BoundKeypairJoinStateVerificationFailed) ProtoMessage()    {}
+func (*BoundKeypairJoinStateVerificationFailed) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{276}
+}
+func (m *BoundKeypairJoinStateVerificationFailed) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *BoundKeypairJoinStateVerificationFailed) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_BoundKeypairJoinStateVerificationFailed.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if len(m.ServerAddr) > 0 {
-		i -= len(m.ServerAddr)
-		copy(dAtA[i:], m.ServerAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerAddr)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.ServerHostname) > 0 {
-		i -= len(m.ServerHostname)
-		copy(dAtA[i:], m.ServerHostname)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerHostname)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.ServerID) > 0 {
-		i -= len(m.ServerID)
-		copy(dAtA[i:], m.ServerID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerID)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.ServerNamespace) > 0 {
-		i -= len(m.ServerNamespace)
-		copy(dAtA[i:], m.ServerNamespace)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerNamespace)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
 }
-
-func (m *ConnectionMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
+func (m *BoundKeypairJoinStateVerificationFailed) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_BoundKeypairJoinStateVerificationFailed.Merge(m, src)
 }
-
-func (m *ConnectionMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+func (m *BoundKeypairJoinStateVerificationFailed) XXX_Size() int {
+	return m.Size()
+}
+func (m *BoundKeypairJoinStateVerificationFailed) XXX_DiscardUnknown() {
+	xxx_messageInfo_BoundKeypairJoinStateVerificationFailed.DiscardUnknown(m)
 }
 
-func (m *ConnectionMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.Protocol) > 0 {
-		i -= len(m.Protocol)
-		copy(dAtA[i:], m.Protocol)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Protocol)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.RemoteAddr) > 0 {
-		i -= len(m.RemoteAddr)
-		copy(dAtA[i:], m.RemoteAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RemoteAddr)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.LocalAddr) > 0 {
-		i -= len(m.LocalAddr)
-		copy(dAtA[i:], m.LocalAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.LocalAddr)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+var xxx_messageInfo_BoundKeypairJoinStateVerificationFailed proto.InternalMessageInfo
+
+// SCIMRequest describes the SCIM http request that triggered an event
+type SCIMRequest struct {
+	// ID is a Teleport-generated arbitrary unique ID for the SCIM request that
+	// triggered the enclosing event. It will be included in all structured log
+	// messages involved in the handling of this request.
+	ID string `protobuf:"bytes,1,opt,name=ID,proto3" json:"id,omitempty"`
+	// SourceAddress is the source IP address for the SCIM HTTP request that
+	// triggered the enclosing  event.
+	SourceAddress string `protobuf:"bytes,2,opt,name=SourceAddress,proto3" json:"source_address,omitempty"`
+	// UserAgent is the user agent string from the HTTP request that triggered
+	// the enclosing event
+	UserAgent string `protobuf:"bytes,3,opt,name=UserAgent,proto3" json:"user_agent,omitempty"`
+	// Method is the HTTP method used by the SCIM HTTP request that triggered the
+	// enclosing event (e.g. GET, PUT, etc)
+	Method string `protobuf:"bytes,4,opt,name=Method,proto3" json:"method,omitempty"`
+	// Path is the fully-qualified path of the SCIM request that triggered the
+	// enclosing event.
+	Path string `protobuf:"bytes,5,opt,name=Path,proto3" json:"path,omitempty"`
+	// Body holds a representation of the arbitrary JSON body of the initial
+	// request. May be empty for list operations, hold a SCIM resource
+	// definition for creation and update operations, or a SCIM PATCH description
+	// for patch update requests.
+	Body                 *Struct  `protobuf:"bytes,6,opt,name=Body,proto3,casttype=Struct" json:"body,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *ClientMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+func (m *SCIMRequest) Reset()         { *m = SCIMRequest{} }
+func (m *SCIMRequest) String() string { return proto.CompactTextString(m) }
+func (*SCIMRequest) ProtoMessage()    {}
+func (*SCIMRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{277}
+}
+func (m *SCIMRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SCIMRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SCIMRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
 }
-
-func (m *ClientMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+func (m *SCIMRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SCIMRequest.Merge(m, src)
+}
+func (m *SCIMRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *SCIMRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_SCIMRequest.DiscardUnknown(m)
 }
 
-func (m *ClientMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.UserAgent) > 0 {
-		i -= len(m.UserAgent)
-		copy(dAtA[i:], m.UserAgent)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserAgent)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+var xxx_messageInfo_SCIMRequest proto.InternalMessageInfo
+
+type SCIMCommonData struct {
+	// Request holds metadata about the original SCIM request that triggered this
+	// event.
+	Request *SCIMRequest `protobuf:"bytes,3,opt,name=Request,proto3" json:"request,omitempty"`
+	// Integration is the name of the integration/access plugin that the SCIM
+	// service was operating on for this event.
+	Integration string `protobuf:"bytes,4,opt,name=Integration,proto3" json:"integration,omitempty"`
+	// ResourceType is the SCIM resource type of the Teleport resource involved in
+	// this event. Valid values include, but are not limited to, "user" and
+	// "group".
+	ResourceType         string   `protobuf:"bytes,5,opt,name=ResourceType,proto3" json:"resource_type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *KubernetesClusterMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+func (m *SCIMCommonData) Reset()         { *m = SCIMCommonData{} }
+func (m *SCIMCommonData) String() string { return proto.CompactTextString(m) }
+func (*SCIMCommonData) ProtoMessage()    {}
+func (*SCIMCommonData) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{278}
+}
+func (m *SCIMCommonData) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SCIMCommonData) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SCIMCommonData.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *SCIMCommonData) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SCIMCommonData.Merge(m, src)
+}
+func (m *SCIMCommonData) XXX_Size() int {
+	return m.Size()
+}
+func (m *SCIMCommonData) XXX_DiscardUnknown() {
+	xxx_messageInfo_SCIMCommonData.DiscardUnknown(m)
 }
 
-func (m *KubernetesClusterMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_SCIMCommonData proto.InternalMessageInfo
+
+// SCIMListingEvent records an attempt to list SCIM resources
+type SCIMListingEvent struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// Status contains common command or operation status fields.
+	Status `protobuf:"bytes,2,opt,name=Status,proto3,embedded=Status" json:""`
+	// Common holds values common to SCIM listing and resource events
+	SCIMCommonData `protobuf:"bytes,3,opt,name=Common,proto3,embedded=Common" json:""`
+	// Filter is the listing filter function supplied by the client, if any.
+	Filter string `protobuf:"bytes,4,opt,name=Filter,proto3" json:"filter,omitempty"`
+	// Count is the requested page size from the client. A zero value indicates that
+	// the client did not request a specific page size.
+	Count int32 `protobuf:"varint,5,opt,name=Count,proto3" json:"count,omitempty"`
+	// Start is the 1-based start index requested by the client, if any. A zero
+	// value indicates that the client did not request a specific starting index
+	// for the page.
+	StartIndex int32 `protobuf:"varint,6,opt,name=StartIndex,proto3" json:"start_index,omitempty"`
+	// ResourceCount is the number of resources returned in response to this
+	// request.
+	ResourceCount        uint32   `protobuf:"varint,7,opt,name=ResourceCount,proto3" json:"resource_count,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *KubernetesClusterMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.KubernetesLabels) > 0 {
-		for k := range m.KubernetesLabels {
-			v := m.KubernetesLabels[k]
-			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
-			i--
-			dAtA[i] = 0x12
-			i -= len(k)
-			copy(dAtA[i:], k)
-			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x22
-		}
-	}
-	if len(m.KubernetesGroups) > 0 {
-		for iNdEx := len(m.KubernetesGroups) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.KubernetesGroups[iNdEx])
-			copy(dAtA[i:], m.KubernetesGroups[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesGroups[iNdEx])))
-			i--
-			dAtA[i] = 0x1a
-		}
-	}
-	if len(m.KubernetesUsers) > 0 {
-		for iNdEx := len(m.KubernetesUsers) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.KubernetesUsers[iNdEx])
-			copy(dAtA[i:], m.KubernetesUsers[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesUsers[iNdEx])))
-			i--
-			dAtA[i] = 0x12
+func (m *SCIMListingEvent) Reset()         { *m = SCIMListingEvent{} }
+func (m *SCIMListingEvent) String() string { return proto.CompactTextString(m) }
+func (*SCIMListingEvent) ProtoMessage()    {}
+func (*SCIMListingEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{279}
+}
+func (m *SCIMListingEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SCIMListingEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SCIMListingEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if len(m.KubernetesCluster) > 0 {
-		i -= len(m.KubernetesCluster)
-		copy(dAtA[i:], m.KubernetesCluster)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesCluster)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
 }
-
-func (m *KubernetesPodMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
+func (m *SCIMListingEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SCIMListingEvent.Merge(m, src)
 }
-
-func (m *KubernetesPodMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+func (m *SCIMListingEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *SCIMListingEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_SCIMListingEvent.DiscardUnknown(m)
 }
 
-func (m *KubernetesPodMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.KubernetesNodeName) > 0 {
-		i -= len(m.KubernetesNodeName)
-		copy(dAtA[i:], m.KubernetesNodeName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesNodeName)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.KubernetesContainerImage) > 0 {
-		i -= len(m.KubernetesContainerImage)
-		copy(dAtA[i:], m.KubernetesContainerImage)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesContainerImage)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.KubernetesContainerName) > 0 {
-		i -= len(m.KubernetesContainerName)
-		copy(dAtA[i:], m.KubernetesContainerName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesContainerName)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.KubernetesPodNamespace) > 0 {
-		i -= len(m.KubernetesPodNamespace)
-		copy(dAtA[i:], m.KubernetesPodNamespace)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesPodNamespace)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.KubernetesPodName) > 0 {
-		i -= len(m.KubernetesPodName)
-		copy(dAtA[i:], m.KubernetesPodName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesPodName)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+var xxx_messageInfo_SCIMListingEvent proto.InternalMessageInfo
+
+// SCIMResourceEvent records an attmpted operation on a specific SCIM resource
+type SCIMResourceEvent struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// Status contains common command or operation status fields.
+	Status `protobuf:"bytes,2,opt,name=Status,proto3,embedded=Status" json:""`
+	// Common holds values common to SCIM listing and resource events
+	SCIMCommonData `protobuf:"bytes,3,opt,name=Common,proto3,embedded=Common" json:""`
+	// TeleportID is the name of the Teleport resource involved in this event.
+	TeleportID string `protobuf:"bytes,4,opt,name=TeleportID,proto3" json:"teleport_id,omitempty"`
+	// ExternalID is the ID used by the external SCIM client to to refer to the
+	// resource affected by this event.
+	ExternalID string `protobuf:"bytes,5,opt,name=ExternalID,proto3" json:"external_id,omitempty"`
+	// Display is a human-readable name or identifier for the Teleport resource
+	// affected by the event.
+	Display              string   `protobuf:"bytes,6,opt,name=Display,proto3" json:"display,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *SAMLIdPServiceProviderMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+func (m *SCIMResourceEvent) Reset()         { *m = SCIMResourceEvent{} }
+func (m *SCIMResourceEvent) String() string { return proto.CompactTextString(m) }
+func (*SCIMResourceEvent) ProtoMessage()    {}
+func (*SCIMResourceEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{280}
+}
+func (m *SCIMResourceEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SCIMResourceEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SCIMResourceEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *SCIMResourceEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SCIMResourceEvent.Merge(m, src)
+}
+func (m *SCIMResourceEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *SCIMResourceEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_SCIMResourceEvent.DiscardUnknown(m)
 }
 
-func (m *SAMLIdPServiceProviderMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_SCIMResourceEvent proto.InternalMessageInfo
+
+// ClientIPRestrictionsUpdate records a Client IP Restrictions update.
+type ClientIPRestrictionsUpdate struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// UserMetadata is a common user event metadata.
+	UserMetadata `protobuf:"bytes,2,opt,name=User,proto3,embedded=User" json:""`
+	// ConnectionMetadata holds information about the connection.
+	ConnectionMetadata `protobuf:"bytes,3,opt,name=Connection,proto3,embedded=Connection" json:""`
+	// ResourceMetadata is a common resource event metadata.
+	ResourceMetadata `protobuf:"bytes,4,opt,name=Resource,proto3,embedded=Resource" json:""`
+	// Status indicates whether the operation was successful.
+	Status `protobuf:"bytes,5,opt,name=Status,proto3,embedded=Status" json:""`
+	// ClientIPRestrictions is the new Client IP Restrictions allowlist.
+	ClientIPRestrictions []string `protobuf:"bytes,6,rep,name=ClientIPRestrictions,proto3" json:"client_ip_restrictions"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *SAMLIdPServiceProviderMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.AttributeMapping) > 0 {
-		for k := range m.AttributeMapping {
-			v := m.AttributeMapping[k]
-			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
-			i--
-			dAtA[i] = 0x12
-			i -= len(k)
-			copy(dAtA[i:], k)
-			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x1a
+func (m *ClientIPRestrictionsUpdate) Reset()         { *m = ClientIPRestrictionsUpdate{} }
+func (m *ClientIPRestrictionsUpdate) String() string { return proto.CompactTextString(m) }
+func (*ClientIPRestrictionsUpdate) ProtoMessage()    {}
+func (*ClientIPRestrictionsUpdate) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{281}
+}
+func (m *ClientIPRestrictionsUpdate) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ClientIPRestrictionsUpdate) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ClientIPRestrictionsUpdate.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if len(m.ServiceProviderShortcut) > 0 {
-		i -= len(m.ServiceProviderShortcut)
-		copy(dAtA[i:], m.ServiceProviderShortcut)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServiceProviderShortcut)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.ServiceProviderEntityID) > 0 {
-		i -= len(m.ServiceProviderEntityID)
-		copy(dAtA[i:], m.ServiceProviderEntityID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServiceProviderEntityID)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+}
+func (m *ClientIPRestrictionsUpdate) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ClientIPRestrictionsUpdate.Merge(m, src)
+}
+func (m *ClientIPRestrictionsUpdate) XXX_Size() int {
+	return m.Size()
+}
+func (m *ClientIPRestrictionsUpdate) XXX_DiscardUnknown() {
+	xxx_messageInfo_ClientIPRestrictionsUpdate.DiscardUnknown(m)
 }
 
-func (m *OktaResourcesUpdatedMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+var xxx_messageInfo_ClientIPRestrictionsUpdate proto.InternalMessageInfo
+
+// VnetConfigCreate is emitted when a VnetConfig is created.
+type VnetConfigCreate struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// Status indicates whether the creation was successful.
+	Status `protobuf:"bytes,2,opt,name=status,proto3,embedded=status" json:""`
+	// User is a common user event metadata.
+	UserMetadata `protobuf:"bytes,3,opt,name=user,proto3,embedded=user" json:""`
+	// Connection holds information about the connection.
+	ConnectionMetadata   `protobuf:"bytes,4,opt,name=connection,proto3,embedded=connection" json:""`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *VnetConfigCreate) Reset()         { *m = VnetConfigCreate{} }
+func (m *VnetConfigCreate) String() string { return proto.CompactTextString(m) }
+func (*VnetConfigCreate) ProtoMessage()    {}
+func (*VnetConfigCreate) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{282}
+}
+func (m *VnetConfigCreate) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *VnetConfigCreate) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_VnetConfigCreate.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
 	}
-	return dAtA[:n], nil
+}
+func (m *VnetConfigCreate) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_VnetConfigCreate.Merge(m, src)
+}
+func (m *VnetConfigCreate) XXX_Size() int {
+	return m.Size()
+}
+func (m *VnetConfigCreate) XXX_DiscardUnknown() {
+	xxx_messageInfo_VnetConfigCreate.DiscardUnknown(m)
 }
 
-func (m *OktaResourcesUpdatedMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+var xxx_messageInfo_VnetConfigCreate proto.InternalMessageInfo
+
+// VnetConfigUpdate is emitted when a VnetConfig is updated.
+type VnetConfigUpdate struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// Status indicates whether the update was successful.
+	Status `protobuf:"bytes,2,opt,name=status,proto3,embedded=status" json:""`
+	// User is a common user event metadata.
+	UserMetadata `protobuf:"bytes,3,opt,name=user,proto3,embedded=user" json:""`
+	// Connection holds information about the connection.
+	ConnectionMetadata   `protobuf:"bytes,4,opt,name=connection,proto3,embedded=connection" json:""`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *OktaResourcesUpdatedMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.DeletedResources) > 0 {
-		for iNdEx := len(m.DeletedResources) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.DeletedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x32
+func (m *VnetConfigUpdate) Reset()         { *m = VnetConfigUpdate{} }
+func (m *VnetConfigUpdate) String() string { return proto.CompactTextString(m) }
+func (*VnetConfigUpdate) ProtoMessage()    {}
+func (*VnetConfigUpdate) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{283}
+}
+func (m *VnetConfigUpdate) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *VnetConfigUpdate) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_VnetConfigUpdate.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if len(m.UpdatedResources) > 0 {
-		for iNdEx := len(m.UpdatedResources) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.UpdatedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x2a
-		}
-	}
-	if len(m.AddedResources) > 0 {
-		for iNdEx := len(m.AddedResources) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.AddedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x22
+}
+func (m *VnetConfigUpdate) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_VnetConfigUpdate.Merge(m, src)
+}
+func (m *VnetConfigUpdate) XXX_Size() int {
+	return m.Size()
+}
+func (m *VnetConfigUpdate) XXX_DiscardUnknown() {
+	xxx_messageInfo_VnetConfigUpdate.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_VnetConfigUpdate proto.InternalMessageInfo
+
+// VnetConfigDelete is emitted when a VnetConfig is deleted.
+type VnetConfigDelete struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=metadata,proto3,embedded=metadata" json:""`
+	// Status indicates whether the deletion was successful.
+	Status `protobuf:"bytes,2,opt,name=status,proto3,embedded=status" json:""`
+	// User is a common user event metadata.
+	UserMetadata `protobuf:"bytes,3,opt,name=user,proto3,embedded=user" json:""`
+	// Connection holds information about the connection.
+	ConnectionMetadata   `protobuf:"bytes,4,opt,name=connection,proto3,embedded=connection" json:""`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *VnetConfigDelete) Reset()         { *m = VnetConfigDelete{} }
+func (m *VnetConfigDelete) String() string { return proto.CompactTextString(m) }
+func (*VnetConfigDelete) ProtoMessage()    {}
+func (*VnetConfigDelete) Descriptor() ([]byte, []int) {
+	return fileDescriptor_007ba1c3d6266d56, []int{284}
+}
+func (m *VnetConfigDelete) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *VnetConfigDelete) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_VnetConfigDelete.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
 		}
+		return b[:n], nil
 	}
-	if m.Deleted != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Deleted))
-		i--
-		dAtA[i] = 0x18
-	}
-	if m.Updated != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Updated))
-		i--
-		dAtA[i] = 0x10
-	}
-	if m.Added != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Added))
-		i--
-		dAtA[i] = 0x8
-	}
-	return len(dAtA) - i, nil
+}
+func (m *VnetConfigDelete) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_VnetConfigDelete.Merge(m, src)
+}
+func (m *VnetConfigDelete) XXX_Size() int {
+	return m.Size()
+}
+func (m *VnetConfigDelete) XXX_DiscardUnknown() {
+	xxx_messageInfo_VnetConfigDelete.DiscardUnknown(m)
 }
 
-func (m *OktaResource) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
+var xxx_messageInfo_VnetConfigDelete proto.InternalMessageInfo
+
+func init() {
+	proto.RegisterEnum("events.UserKind", UserKind_name, UserKind_value)
+	proto.RegisterEnum("events.UserOrigin", UserOrigin_name, UserOrigin_value)
+	proto.RegisterEnum("events.EventAction", EventAction_name, EventAction_value)
+	proto.RegisterEnum("events.SFTPAction", SFTPAction_name, SFTPAction_value)
+	proto.RegisterEnum("events.OSType", OSType_name, OSType_value)
+	proto.RegisterEnum("events.DeviceOrigin", DeviceOrigin_name, DeviceOrigin_value)
+	proto.RegisterEnum("events.ElasticsearchCategory", ElasticsearchCategory_name, ElasticsearchCategory_value)
+	proto.RegisterEnum("events.OpenSearchCategory", OpenSearchCategory_name, OpenSearchCategory_value)
+	proto.RegisterEnum("events.AdminActionsMFAStatus", AdminActionsMFAStatus_name, AdminActionsMFAStatus_value)
+	proto.RegisterEnum("events.ContactType", ContactType_name, ContactType_value)
+	proto.RegisterEnum("events.SessionNetwork_NetworkOperation", SessionNetwork_NetworkOperation_name, SessionNetwork_NetworkOperation_value)
+	proto.RegisterType((*Metadata)(nil), "events.Metadata")
+	proto.RegisterType((*SessionMetadata)(nil), "events.SessionMetadata")
+	proto.RegisterType((*UserMetadata)(nil), "events.UserMetadata")
+	proto.RegisterType((*ServerMetadata)(nil), "events.ServerMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.ServerMetadata.ServerLabelsEntry")
+	proto.RegisterType((*ConnectionMetadata)(nil), "events.ConnectionMetadata")
+	proto.RegisterType((*ClientMetadata)(nil), "events.ClientMetadata")
+	proto.RegisterType((*KubernetesClusterMetadata)(nil), "events.KubernetesClusterMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.KubernetesClusterMetadata.KubernetesLabelsEntry")
+	proto.RegisterType((*KubernetesPodMetadata)(nil), "events.KubernetesPodMetadata")
+	proto.RegisterType((*SAMLIdPServiceProviderMetadata)(nil), "events.SAMLIdPServiceProviderMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.SAMLIdPServiceProviderMetadata.AttributeMappingEntry")
+	proto.RegisterType((*OktaResourcesUpdatedMetadata)(nil), "events.OktaResourcesUpdatedMetadata")
+	proto.RegisterType((*OktaResource)(nil), "events.OktaResource")
+	proto.RegisterType((*OktaAssignmentMetadata)(nil), "events.OktaAssignmentMetadata")
+	proto.RegisterType((*AccessListMemberMetadata)(nil), "events.AccessListMemberMetadata")
+	proto.RegisterType((*AccessListMember)(nil), "events.AccessListMember")
+	proto.RegisterType((*AccessListReviewMembershipRequirementsChanged)(nil), "events.AccessListReviewMembershipRequirementsChanged")
+	proto.RegisterMapType((map[string]string)(nil), "events.AccessListReviewMembershipRequirementsChanged.TraitsEntry")
+	proto.RegisterType((*AccessListReviewMetadata)(nil), "events.AccessListReviewMetadata")
+	proto.RegisterType((*LockMetadata)(nil), "events.LockMetadata")
+	proto.RegisterType((*SessionStart)(nil), "events.SessionStart")
+	proto.RegisterType((*SessionJoin)(nil), "events.SessionJoin")
+	proto.RegisterType((*SessionPrint)(nil), "events.SessionPrint")
+	proto.RegisterType((*DesktopRecording)(nil), "events.DesktopRecording")
+	proto.RegisterType((*DesktopClipboardReceive)(nil), "events.DesktopClipboardReceive")
+	proto.RegisterType((*DesktopClipboardSend)(nil), "events.DesktopClipboardSend")
+	proto.RegisterType((*DesktopSharedDirectoryStart)(nil), "events.DesktopSharedDirectoryStart")
+	proto.RegisterType((*DesktopSharedDirectoryRead)(nil), "events.DesktopSharedDirectoryRead")
+	proto.RegisterType((*DesktopSharedDirectoryWrite)(nil), "events.DesktopSharedDirectoryWrite")
+	proto.RegisterType((*SessionReject)(nil), "events.SessionReject")
+	proto.RegisterType((*SessionConnect)(nil), "events.SessionConnect")
+	proto.RegisterType((*FileTransferRequestEvent)(nil), "events.FileTransferRequestEvent")
+	proto.RegisterType((*Resize)(nil), "events.Resize")
+	proto.RegisterType((*SessionEnd)(nil), "events.SessionEnd")
+	proto.RegisterType((*BPFMetadata)(nil), "events.BPFMetadata")
+	proto.RegisterType((*Status)(nil), "events.Status")
+	proto.RegisterType((*SessionCommand)(nil), "events.SessionCommand")
+	proto.RegisterType((*SessionDisk)(nil), "events.SessionDisk")
+	proto.RegisterType((*SessionNetwork)(nil), "events.SessionNetwork")
+	proto.RegisterType((*SessionData)(nil), "events.SessionData")
+	proto.RegisterType((*SessionLeave)(nil), "events.SessionLeave")
+	proto.RegisterType((*UserLogin)(nil), "events.UserLogin")
+	proto.RegisterType((*CreateMFAAuthChallenge)(nil), "events.CreateMFAAuthChallenge")
+	proto.RegisterType((*ValidateMFAAuthResponse)(nil), "events.ValidateMFAAuthResponse")
+	proto.RegisterType((*ResourceMetadata)(nil), "events.ResourceMetadata")
+	proto.RegisterType((*UserCreate)(nil), "events.UserCreate")
+	proto.RegisterType((*UserUpdate)(nil), "events.UserUpdate")
+	proto.RegisterType((*UserDelete)(nil), "events.UserDelete")
+	proto.RegisterType((*UserPasswordChange)(nil), "events.UserPasswordChange")
+	proto.RegisterType((*AccessRequestCreate)(nil), "events.AccessRequestCreate")
+	proto.RegisterType((*AccessRequestExpire)(nil), "events.AccessRequestExpire")
+	proto.RegisterType((*ResourceID)(nil), "events.ResourceID")
+	proto.RegisterType((*AccessRequestDelete)(nil), "events.AccessRequestDelete")
+	proto.RegisterType((*PortForward)(nil), "events.PortForward")
+	proto.RegisterType((*X11Forward)(nil), "events.X11Forward")
+	proto.RegisterType((*CommandMetadata)(nil), "events.CommandMetadata")
+	proto.RegisterType((*Exec)(nil), "events.Exec")
+	proto.RegisterType((*SCP)(nil), "events.SCP")
+	proto.RegisterType((*SFTPAttributes)(nil), "events.SFTPAttributes")
+	proto.RegisterType((*SFTP)(nil), "events.SFTP")
+	proto.RegisterType((*SFTPSummary)(nil), "events.SFTPSummary")
+	proto.RegisterType((*FileTransferStat)(nil), "events.FileTransferStat")
+	proto.RegisterType((*Subsystem)(nil), "events.Subsystem")
+	proto.RegisterType((*ClientDisconnect)(nil), "events.ClientDisconnect")
+	proto.RegisterType((*AuthAttempt)(nil), "events.AuthAttempt")
+	proto.RegisterType((*UserTokenCreate)(nil), "events.UserTokenCreate")
+	proto.RegisterType((*RoleCreate)(nil), "events.RoleCreate")
+	proto.RegisterType((*RoleUpdate)(nil), "events.RoleUpdate")
+	proto.RegisterType((*RoleDelete)(nil), "events.RoleDelete")
+	proto.RegisterType((*BotCreate)(nil), "events.BotCreate")
+	proto.RegisterType((*BotUpdate)(nil), "events.BotUpdate")
+	proto.RegisterType((*BotDelete)(nil), "events.BotDelete")
+	proto.RegisterType((*TrustedClusterCreate)(nil), "events.TrustedClusterCreate")
+	proto.RegisterType((*TrustedClusterDelete)(nil), "events.TrustedClusterDelete")
+	proto.RegisterType((*ProvisionTokenCreate)(nil), "events.ProvisionTokenCreate")
+	proto.RegisterType((*TrustedClusterTokenCreate)(nil), "events.TrustedClusterTokenCreate")
+	proto.RegisterType((*GithubConnectorCreate)(nil), "events.GithubConnectorCreate")
+	proto.RegisterType((*GithubConnectorUpdate)(nil), "events.GithubConnectorUpdate")
+	proto.RegisterType((*GithubConnectorDelete)(nil), "events.GithubConnectorDelete")
+	proto.RegisterType((*OIDCConnectorCreate)(nil), "events.OIDCConnectorCreate")
+	proto.RegisterType((*OIDCConnectorUpdate)(nil), "events.OIDCConnectorUpdate")
+	proto.RegisterType((*OIDCConnectorDelete)(nil), "events.OIDCConnectorDelete")
+	proto.RegisterType((*SAMLConnectorCreate)(nil), "events.SAMLConnectorCreate")
+	proto.RegisterType((*SAMLConnectorUpdate)(nil), "events.SAMLConnectorUpdate")
+	proto.RegisterType((*SAMLConnectorDelete)(nil), "events.SAMLConnectorDelete")
+	proto.RegisterType((*KubeRequest)(nil), "events.KubeRequest")
+	proto.RegisterType((*AppMetadata)(nil), "events.AppMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.AppMetadata.AppLabelsEntry")
+	proto.RegisterType((*AppCreate)(nil), "events.AppCreate")
+	proto.RegisterType((*AppUpdate)(nil), "events.AppUpdate")
+	proto.RegisterType((*AppDelete)(nil), "events.AppDelete")
+	proto.RegisterType((*AppSessionStart)(nil), "events.AppSessionStart")
+	proto.RegisterType((*AppSessionEnd)(nil), "events.AppSessionEnd")
+	proto.RegisterType((*AppSessionChunk)(nil), "events.AppSessionChunk")
+	proto.RegisterType((*AppSessionRequest)(nil), "events.AppSessionRequest")
+	proto.RegisterType((*AWSRequestMetadata)(nil), "events.AWSRequestMetadata")
+	proto.RegisterType((*DatabaseMetadata)(nil), "events.DatabaseMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.DatabaseMetadata.DatabaseLabelsEntry")
+	proto.RegisterType((*DatabaseCreate)(nil), "events.DatabaseCreate")
+	proto.RegisterType((*DatabaseUpdate)(nil), "events.DatabaseUpdate")
+	proto.RegisterType((*DatabaseDelete)(nil), "events.DatabaseDelete")
+	proto.RegisterType((*DatabaseSessionStart)(nil), "events.DatabaseSessionStart")
+	proto.RegisterType((*DatabaseSessionQuery)(nil), "events.DatabaseSessionQuery")
+	proto.RegisterType((*DatabaseSessionCommandResult)(nil), "events.DatabaseSessionCommandResult")
+	proto.RegisterType((*DatabasePermissionUpdate)(nil), "events.DatabasePermissionUpdate")
+	proto.RegisterMapType((map[string]int32)(nil), "events.DatabasePermissionUpdate.AffectedObjectCountsEntry")
+	proto.RegisterType((*DatabasePermissionEntry)(nil), "events.DatabasePermissionEntry")
+	proto.RegisterMapType((map[string]int32)(nil), "events.DatabasePermissionEntry.CountsEntry")
+	proto.RegisterType((*DatabaseUserCreate)(nil), "events.DatabaseUserCreate")
+	proto.RegisterType((*DatabaseUserDeactivate)(nil), "events.DatabaseUserDeactivate")
+	proto.RegisterType((*PostgresParse)(nil), "events.PostgresParse")
+	proto.RegisterType((*PostgresBind)(nil), "events.PostgresBind")
+	proto.RegisterType((*PostgresExecute)(nil), "events.PostgresExecute")
+	proto.RegisterType((*PostgresClose)(nil), "events.PostgresClose")
+	proto.RegisterType((*PostgresFunctionCall)(nil), "events.PostgresFunctionCall")
+	proto.RegisterType((*WindowsCertificateMetadata)(nil), "events.WindowsCertificateMetadata")
+	proto.RegisterType((*WindowsDesktopSessionStart)(nil), "events.WindowsDesktopSessionStart")
+	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionStart.DesktopLabelsEntry")
+	proto.RegisterType((*DatabaseSessionEnd)(nil), "events.DatabaseSessionEnd")
+	proto.RegisterType((*MFADeviceMetadata)(nil), "events.MFADeviceMetadata")
+	proto.RegisterType((*MFADeviceAdd)(nil), "events.MFADeviceAdd")
+	proto.RegisterType((*MFADeviceDelete)(nil), "events.MFADeviceDelete")
+	proto.RegisterType((*BillingInformationUpdate)(nil), "events.BillingInformationUpdate")
+	proto.RegisterType((*BillingCardCreate)(nil), "events.BillingCardCreate")
+	proto.RegisterType((*BillingCardDelete)(nil), "events.BillingCardDelete")
+	proto.RegisterType((*LockCreate)(nil), "events.LockCreate")
+	proto.RegisterType((*LockDelete)(nil), "events.LockDelete")
+	proto.RegisterType((*RecoveryCodeGenerate)(nil), "events.RecoveryCodeGenerate")
+	proto.RegisterType((*RecoveryCodeUsed)(nil), "events.RecoveryCodeUsed")
+	proto.RegisterType((*WindowsDesktopSessionEnd)(nil), "events.WindowsDesktopSessionEnd")
+	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionEnd.DesktopLabelsEntry")
+	proto.RegisterType((*CertificateCreate)(nil), "events.CertificateCreate")
+	proto.RegisterType((*CertificateAuthority)(nil), "events.CertificateAuthority")
+	proto.RegisterType((*RenewableCertificateGenerationMismatch)(nil), "events.RenewableCertificateGenerationMismatch")
+	proto.RegisterType((*BotJoin)(nil), "events.BotJoin")
+	proto.RegisterType((*InstanceJoin)(nil), "events.InstanceJoin")
+	proto.RegisterType((*Unknown)(nil), "events.Unknown")
+	proto.RegisterType((*DeviceMetadata)(nil), "events.DeviceMetadata")
+	proto.RegisterType((*DeviceEvent)(nil), "events.DeviceEvent")
+	proto.RegisterType((*DeviceEvent2)(nil), "events.DeviceEvent2")
+	proto.RegisterType((*DiscoveryConfigCreate)(nil), "events.DiscoveryConfigCreate")
+	proto.RegisterType((*DiscoveryConfigUpdate)(nil), "events.DiscoveryConfigUpdate")
+	proto.RegisterType((*DiscoveryConfigDelete)(nil), "events.DiscoveryConfigDelete")
+	proto.RegisterType((*DiscoveryConfigDeleteAll)(nil), "events.DiscoveryConfigDeleteAll")
+	proto.RegisterType((*IntegrationCreate)(nil), "events.IntegrationCreate")
+	proto.RegisterType((*IntegrationUpdate)(nil), "events.IntegrationUpdate")
+	proto.RegisterType((*IntegrationDelete)(nil), "events.IntegrationDelete")
+	proto.RegisterType((*IntegrationMetadata)(nil), "events.IntegrationMetadata")
+	proto.RegisterType((*AWSOIDCIntegrationMetadata)(nil), "events.AWSOIDCIntegrationMetadata")
+	proto.RegisterType((*AzureOIDCIntegrationMetadata)(nil), "events.AzureOIDCIntegrationMetadata")
+	proto.RegisterType((*GitHubIntegrationMetadata)(nil), "events.GitHubIntegrationMetadata")
+	proto.RegisterType((*AWSRAIntegrationMetadata)(nil), "events.AWSRAIntegrationMetadata")
+	proto.RegisterType((*PluginCreate)(nil), "events.PluginCreate")
+	proto.RegisterType((*PluginUpdate)(nil), "events.PluginUpdate")
+	proto.RegisterType((*PluginDelete)(nil), "events.PluginDelete")
+	proto.RegisterType((*PluginMetadata)(nil), "events.PluginMetadata")
+	proto.RegisterType((*OneOf)(nil), "events.OneOf")
+	proto.RegisterType((*StreamStatus)(nil), "events.StreamStatus")
+	proto.RegisterType((*SessionUpload)(nil), "events.SessionUpload")
+	proto.RegisterType((*Identity)(nil), "events.Identity")
+	proto.RegisterType((*ScopePin)(nil), "events.ScopePin")
+	proto.RegisterMapType((map[string]*ScopePinnedAssignments)(nil), "events.ScopePin.AssignmentsEntry")
+	proto.RegisterType((*ScopePinnedAssignments)(nil), "events.ScopePinnedAssignments")
+	proto.RegisterType((*RouteToApp)(nil), "events.RouteToApp")
+	proto.RegisterType((*RouteToDatabase)(nil), "events.RouteToDatabase")
+	proto.RegisterType((*DeviceExtensions)(nil), "events.DeviceExtensions")
+	proto.RegisterType((*AccessRequestResourceSearch)(nil), "events.AccessRequestResourceSearch")
+	proto.RegisterMapType((map[string]string)(nil), "events.AccessRequestResourceSearch.LabelsEntry")
+	proto.RegisterType((*MySQLStatementPrepare)(nil), "events.MySQLStatementPrepare")
+	proto.RegisterType((*MySQLStatementExecute)(nil), "events.MySQLStatementExecute")
+	proto.RegisterType((*MySQLStatementSendLongData)(nil), "events.MySQLStatementSendLongData")
+	proto.RegisterType((*MySQLStatementClose)(nil), "events.MySQLStatementClose")
+	proto.RegisterType((*MySQLStatementReset)(nil), "events.MySQLStatementReset")
+	proto.RegisterType((*MySQLStatementFetch)(nil), "events.MySQLStatementFetch")
+	proto.RegisterType((*MySQLStatementBulkExecute)(nil), "events.MySQLStatementBulkExecute")
+	proto.RegisterType((*MySQLInitDB)(nil), "events.MySQLInitDB")
+	proto.RegisterType((*MySQLCreateDB)(nil), "events.MySQLCreateDB")
+	proto.RegisterType((*MySQLDropDB)(nil), "events.MySQLDropDB")
+	proto.RegisterType((*MySQLShutDown)(nil), "events.MySQLShutDown")
+	proto.RegisterType((*MySQLProcessKill)(nil), "events.MySQLProcessKill")
+	proto.RegisterType((*MySQLDebug)(nil), "events.MySQLDebug")
+	proto.RegisterType((*MySQLRefresh)(nil), "events.MySQLRefresh")
+	proto.RegisterType((*SQLServerRPCRequest)(nil), "events.SQLServerRPCRequest")
+	proto.RegisterType((*DatabaseSessionMalformedPacket)(nil), "events.DatabaseSessionMalformedPacket")
+	proto.RegisterType((*ElasticsearchRequest)(nil), "events.ElasticsearchRequest")
+	proto.RegisterType((*OpenSearchRequest)(nil), "events.OpenSearchRequest")
+	proto.RegisterType((*DynamoDBRequest)(nil), "events.DynamoDBRequest")
+	proto.RegisterType((*AppSessionDynamoDBRequest)(nil), "events.AppSessionDynamoDBRequest")
+	proto.RegisterType((*UpgradeWindowStartMetadata)(nil), "events.UpgradeWindowStartMetadata")
+	proto.RegisterType((*UpgradeWindowStartUpdate)(nil), "events.UpgradeWindowStartUpdate")
+	proto.RegisterType((*SessionRecordingAccess)(nil), "events.SessionRecordingAccess")
+	proto.RegisterType((*KubeClusterMetadata)(nil), "events.KubeClusterMetadata")
+	proto.RegisterMapType((map[string]string)(nil), "events.KubeClusterMetadata.KubeLabelsEntry")
+	proto.RegisterType((*KubernetesClusterCreate)(nil), "events.KubernetesClusterCreate")
+	proto.RegisterType((*KubernetesClusterUpdate)(nil), "events.KubernetesClusterUpdate")
+	proto.RegisterType((*KubernetesClusterDelete)(nil), "events.KubernetesClusterDelete")
+	proto.RegisterType((*SSMRun)(nil), "events.SSMRun")
+	proto.RegisterType((*CassandraPrepare)(nil), "events.CassandraPrepare")
+	proto.RegisterType((*CassandraExecute)(nil), "events.CassandraExecute")
+	proto.RegisterType((*CassandraBatch)(nil), "events.CassandraBatch")
+	proto.RegisterType((*CassandraBatch_BatchChild)(nil), "events.CassandraBatch.BatchChild")
+	proto.RegisterType((*CassandraBatch_BatchChild_Value)(nil), "events.CassandraBatch.BatchChild.Value")
+	proto.RegisterType((*CassandraRegister)(nil), "events.CassandraRegister")
+	proto.RegisterType((*LoginRuleCreate)(nil), "events.LoginRuleCreate")
+	proto.RegisterType((*LoginRuleDelete)(nil), "events.LoginRuleDelete")
+	proto.RegisterType((*SAMLIdPAuthAttempt)(nil), "events.SAMLIdPAuthAttempt")
+	proto.RegisterType((*SAMLIdPServiceProviderCreate)(nil), "events.SAMLIdPServiceProviderCreate")
+	proto.RegisterType((*SAMLIdPServiceProviderUpdate)(nil), "events.SAMLIdPServiceProviderUpdate")
+	proto.RegisterType((*SAMLIdPServiceProviderDelete)(nil), "events.SAMLIdPServiceProviderDelete")
+	proto.RegisterType((*SAMLIdPServiceProviderDeleteAll)(nil), "events.SAMLIdPServiceProviderDeleteAll")
+	proto.RegisterType((*OktaResourcesUpdate)(nil), "events.OktaResourcesUpdate")
+	proto.RegisterType((*OktaSyncFailure)(nil), "events.OktaSyncFailure")
+	proto.RegisterType((*OktaAssignmentResult)(nil), "events.OktaAssignmentResult")
+	proto.RegisterType((*AccessListCreate)(nil), "events.AccessListCreate")
+	proto.RegisterType((*AccessListUpdate)(nil), "events.AccessListUpdate")
+	proto.RegisterType((*AccessListDelete)(nil), "events.AccessListDelete")
+	proto.RegisterType((*AccessListMemberCreate)(nil), "events.AccessListMemberCreate")
+	proto.RegisterType((*AccessListMemberUpdate)(nil), "events.AccessListMemberUpdate")
+	proto.RegisterType((*AccessListMemberDelete)(nil), "events.AccessListMemberDelete")
+	proto.RegisterType((*AccessListMemberDeleteAllForAccessList)(nil), "events.AccessListMemberDeleteAllForAccessList")
+	proto.RegisterType((*AccessListReview)(nil), "events.AccessListReview")
+	proto.RegisterType((*AuditQueryRun)(nil), "events.AuditQueryRun")
+	proto.RegisterType((*AuditQueryDetails)(nil), "events.AuditQueryDetails")
+	proto.RegisterType((*SecurityReportRun)(nil), "events.SecurityReportRun")
+	proto.RegisterType((*ExternalAuditStorageEnable)(nil), "events.ExternalAuditStorageEnable")
+	proto.RegisterType((*ExternalAuditStorageDisable)(nil), "events.ExternalAuditStorageDisable")
+	proto.RegisterType((*ExternalAuditStorageDetails)(nil), "events.ExternalAuditStorageDetails")
+	proto.RegisterType((*OktaAccessListSync)(nil), "events.OktaAccessListSync")
+	proto.RegisterType((*OktaUserSync)(nil), "events.OktaUserSync")
+	proto.RegisterType((*LabelSelector)(nil), "events.LabelSelector")
+	proto.RegisterType((*SPIFFESVIDIssued)(nil), "events.SPIFFESVIDIssued")
+	proto.RegisterType((*AuthPreferenceUpdate)(nil), "events.AuthPreferenceUpdate")
+	proto.RegisterType((*ClusterNetworkingConfigUpdate)(nil), "events.ClusterNetworkingConfigUpdate")
+	proto.RegisterType((*SessionRecordingConfigUpdate)(nil), "events.SessionRecordingConfigUpdate")
+	proto.RegisterType((*AccessPathChanged)(nil), "events.AccessPathChanged")
+	proto.RegisterType((*SpannerRPC)(nil), "events.SpannerRPC")
+	proto.RegisterType((*AccessGraphSettingsUpdate)(nil), "events.AccessGraphSettingsUpdate")
+	proto.RegisterType((*SPIFFEFederationCreate)(nil), "events.SPIFFEFederationCreate")
+	proto.RegisterType((*SPIFFEFederationDelete)(nil), "events.SPIFFEFederationDelete")
+	proto.RegisterType((*AutoUpdateConfigCreate)(nil), "events.AutoUpdateConfigCreate")
+	proto.RegisterType((*AutoUpdateConfigUpdate)(nil), "events.AutoUpdateConfigUpdate")
+	proto.RegisterType((*AutoUpdateConfigDelete)(nil), "events.AutoUpdateConfigDelete")
+	proto.RegisterType((*AutoUpdateVersionCreate)(nil), "events.AutoUpdateVersionCreate")
+	proto.RegisterType((*AutoUpdateVersionUpdate)(nil), "events.AutoUpdateVersionUpdate")
+	proto.RegisterType((*AutoUpdateVersionDelete)(nil), "events.AutoUpdateVersionDelete")
+	proto.RegisterType((*AutoUpdateAgentRolloutTrigger)(nil), "events.AutoUpdateAgentRolloutTrigger")
+	proto.RegisterType((*AutoUpdateAgentRolloutForceDone)(nil), "events.AutoUpdateAgentRolloutForceDone")
+	proto.RegisterType((*AutoUpdateAgentRolloutRollback)(nil), "events.AutoUpdateAgentRolloutRollback")
+	proto.RegisterType((*StaticHostUserCreate)(nil), "events.StaticHostUserCreate")
+	proto.RegisterType((*StaticHostUserUpdate)(nil), "events.StaticHostUserUpdate")
+	proto.RegisterType((*StaticHostUserDelete)(nil), "events.StaticHostUserDelete")
+	proto.RegisterType((*CrownJewelCreate)(nil), "events.CrownJewelCreate")
+	proto.RegisterType((*CrownJewelUpdate)(nil), "events.CrownJewelUpdate")
+	proto.RegisterType((*CrownJewelDelete)(nil), "events.CrownJewelDelete")
+	proto.RegisterType((*UserTaskCreate)(nil), "events.UserTaskCreate")
+	proto.RegisterType((*UserTaskUpdate)(nil), "events.UserTaskUpdate")
+	proto.RegisterType((*UserTaskMetadata)(nil), "events.UserTaskMetadata")
+	proto.RegisterType((*UserTaskDelete)(nil), "events.UserTaskDelete")
+	proto.RegisterType((*ContactCreate)(nil), "events.ContactCreate")
+	proto.RegisterType((*ContactDelete)(nil), "events.ContactDelete")
+	proto.RegisterType((*WorkloadIdentityCreate)(nil), "events.WorkloadIdentityCreate")
+	proto.RegisterType((*WorkloadIdentityUpdate)(nil), "events.WorkloadIdentityUpdate")
+	proto.RegisterType((*WorkloadIdentityDelete)(nil), "events.WorkloadIdentityDelete")
+	proto.RegisterType((*WorkloadIdentityX509RevocationCreate)(nil), "events.WorkloadIdentityX509RevocationCreate")
+	proto.RegisterType((*WorkloadIdentityX509RevocationUpdate)(nil), "events.WorkloadIdentityX509RevocationUpdate")
+	proto.RegisterType((*WorkloadIdentityX509RevocationDelete)(nil), "events.WorkloadIdentityX509RevocationDelete")
+	proto.RegisterType((*GitCommand)(nil), "events.GitCommand")
+	proto.RegisterType((*GitCommandAction)(nil), "events.GitCommandAction")
+	proto.RegisterType((*AccessListInvalidMetadata)(nil), "events.AccessListInvalidMetadata")
+	proto.RegisterType((*UserLoginAccessListInvalid)(nil), "events.UserLoginAccessListInvalid")
+	proto.RegisterType((*StableUNIXUserCreate)(nil), "events.StableUNIXUserCreate")
+	proto.RegisterType((*StableUNIXUser)(nil), "events.StableUNIXUser")
+	proto.RegisterType((*AWSICResourceSync)(nil), "events.AWSICResourceSync")
+	proto.RegisterType((*HealthCheckConfigCreate)(nil), "events.HealthCheckConfigCreate")
+	proto.RegisterType((*HealthCheckConfigUpdate)(nil), "events.HealthCheckConfigUpdate")
+	proto.RegisterType((*HealthCheckConfigDelete)(nil), "events.HealthCheckConfigDelete")
+	proto.RegisterType((*WorkloadIdentityX509IssuerOverrideCreate)(nil), "events.WorkloadIdentityX509IssuerOverrideCreate")
+	proto.RegisterType((*WorkloadIdentityX509IssuerOverrideDelete)(nil), "events.WorkloadIdentityX509IssuerOverrideDelete")
+	proto.RegisterType((*SigstorePolicyCreate)(nil), "events.SigstorePolicyCreate")
+	proto.RegisterType((*SigstorePolicyUpdate)(nil), "events.SigstorePolicyUpdate")
+	proto.RegisterType((*SigstorePolicyDelete)(nil), "events.SigstorePolicyDelete")
+	proto.RegisterType((*MCPSessionStart)(nil), "events.MCPSessionStart")
+	proto.RegisterType((*MCPSessionEnd)(nil), "events.MCPSessionEnd")
+	proto.RegisterType((*MCPJSONRPCMessage)(nil), "events.MCPJSONRPCMessage")
+	proto.RegisterType((*MCPSessionRequest)(nil), "events.MCPSessionRequest")
+	proto.RegisterType((*MCPSessionNotification)(nil), "events.MCPSessionNotification")
+	proto.RegisterType((*MCPSessionListenSSEStream)(nil), "events.MCPSessionListenSSEStream")
+	proto.RegisterType((*MCPSessionInvalidHTTPRequest)(nil), "events.MCPSessionInvalidHTTPRequest")
+	proto.RegisterType((*BoundKeypairRecovery)(nil), "events.BoundKeypairRecovery")
+	proto.RegisterType((*BoundKeypairRotation)(nil), "events.BoundKeypairRotation")
+	proto.RegisterType((*BoundKeypairJoinStateVerificationFailed)(nil), "events.BoundKeypairJoinStateVerificationFailed")
+	proto.RegisterType((*SCIMRequest)(nil), "events.SCIMRequest")
+	proto.RegisterType((*SCIMCommonData)(nil), "events.SCIMCommonData")
+	proto.RegisterType((*SCIMListingEvent)(nil), "events.SCIMListingEvent")
+	proto.RegisterType((*SCIMResourceEvent)(nil), "events.SCIMResourceEvent")
+	proto.RegisterType((*ClientIPRestrictionsUpdate)(nil), "events.ClientIPRestrictionsUpdate")
+	proto.RegisterType((*VnetConfigCreate)(nil), "events.VnetConfigCreate")
+	proto.RegisterType((*VnetConfigUpdate)(nil), "events.VnetConfigUpdate")
+	proto.RegisterType((*VnetConfigDelete)(nil), "events.VnetConfigDelete")
 }
 
-func (m *OktaResource) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
+func init() {
+	proto.RegisterFile("teleport/legacy/types/events/events.proto", fileDescriptor_007ba1c3d6266d56)
 }
 
-func (m *OktaResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.Description) > 0 {
-		i -= len(m.Description)
-		copy(dAtA[i:], m.Description)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Description)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.ID) > 0 {
-		i -= len(m.ID)
-		copy(dAtA[i:], m.ID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+var fileDescriptor_007ba1c3d6266d56 = []byte{
+	// 20935 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xbd, 0x69, 0x78, 0x24, 0x49,
+	0x76, 0x18, 0x86, 0x3a, 0x70, 0x3d, 0x5c, 0x85, 0xe8, 0x2b, 0xbb, 0xa7, 0x67, 0x6a, 0x26, 0x67,
+	0xb6, 0xa7, 0x7b, 0x76, 0xb6, 0x7b, 0xa6, 0xe7, 0xd8, 0x9d, 0x9d, 0xd9, 0x9d, 0x29, 0x14, 0x80,
+	0x46, 0x75, 0xe3, 0xa8, 0xcd, 0x42, 0x77, 0xcf, 0xec, 0x2e, 0xb7, 0x98, 0xa8, 0x8c, 0x06, 0x72,
+	0x50, 0x95, 0x59, 0x9b, 0x99, 0xd5, 0x68, 0x8c, 0x7c, 0x90, 0x12, 0xc5, 0x43, 0x5a, 0x92, 0xeb,
+	0x5d, 0xf1, 0x10, 0x29, 0xd9, 0x4b, 0x8a, 0xb2, 0x29, 0x92, 0x22, 0x4d, 0x99, 0xe6, 0x4d, 0x91,
+	0x14, 0x45, 0x73, 0x79, 0x9a, 0xb7, 0x69, 0x92, 0x02, 0x0f, 0x59, 0xdf, 0x67, 0xe3, 0xd3, 0xe7,
+	0x4f, 0x9f, 0xcd, 0xcf, 0xa4, 0x64, 0x4b, 0x9f, 0xbf, 0x78, 0x11, 0x99, 0x19, 0x79, 0x54, 0xe1,
+	0x5c, 0xa2, 0xb1, 0x8d, 0x3f, 0xdd, 0xa8, 0xf7, 0x5e, 0xbc, 0x88, 0x7c, 0xf1, 0x22, 0xe2, 0x45,
+	0xc4, 0x8b, 0xf7, 0xe0, 0x8a, 0x47, 0x9b, 0xb4, 0x6d, 0x3b, 0xde, 0xb5, 0x26, 0x5d, 0xd5, 0x1b,
+	0x9b, 0xd7, 0xbc, 0xcd, 0x36, 0x75, 0xaf, 0xd1, 0xfb, 0xd4, 0xf2, 0xfc, 0xff, 0xae, 0xb6, 0x1d,
+	0xdb, 0xb3, 0xc9, 0x00, 0xff, 0x75, 0xe1, 0xf4, 0xaa, 0xbd, 0x6a, 0x23, 0xe8, 0x1a, 0xfb, 0x8b,
+	0x63, 0x2f, 0x5c, 0x5c, 0xb5, 0xed, 0xd5, 0x26, 0xbd, 0x86, 0xbf, 0x56, 0x3a, 0xf7, 0xae, 0xb9,
+	0x9e, 0xd3, 0x69, 0x78, 0x02, 0x5b, 0x8c, 0x63, 0x3d, 0xb3, 0x45, 0x5d, 0x4f, 0x6f, 0xb5, 0x05,
+	0xc1, 0x13, 0x71, 0x82, 0x0d, 0x47, 0x6f, 0xb7, 0xa9, 0x23, 0x2a, 0xbf, 0xf0, 0x6c, 0xd0, 0x4e,
+	0xbd, 0xd1, 0xa0, 0xae, 0xdb, 0x34, 0x5d, 0xef, 0xda, 0xfd, 0x17, 0xa5, 0x5f, 0x82, 0xf0, 0xa9,
+	0xf4, 0x0f, 0xc2, 0x7f, 0x05, 0xc9, 0x07, 0xd2, 0x49, 0xfc, 0x1a, 0x63, 0x55, 0xab, 0x9f, 0xcb,
+	0xc2, 0xd0, 0x02, 0xf5, 0x74, 0x43, 0xf7, 0x74, 0x72, 0x11, 0xfa, 0x2b, 0x96, 0x41, 0x1f, 0x28,
+	0x99, 0x27, 0x33, 0x97, 0x73, 0x53, 0x03, 0xdb, 0x5b, 0xc5, 0x2c, 0x35, 0x35, 0x0e, 0x24, 0x8f,
+	0x43, 0x7e, 0x79, 0xb3, 0x4d, 0x95, 0xec, 0x93, 0x99, 0xcb, 0xc3, 0x53, 0xc3, 0xdb, 0x5b, 0xc5,
+	0x7e, 0x14, 0x9a, 0x86, 0x60, 0xf2, 0x14, 0x64, 0x2b, 0xd3, 0x4a, 0x0e, 0x91, 0x93, 0xdb, 0x5b,
+	0xc5, 0xb1, 0x8e, 0x69, 0x3c, 0x6f, 0xb7, 0x4c, 0x8f, 0xb6, 0xda, 0xde, 0xa6, 0x96, 0xad, 0x4c,
+	0x93, 0x4b, 0x90, 0x2f, 0xdb, 0x06, 0x55, 0xf2, 0x48, 0x44, 0xb6, 0xb7, 0x8a, 0xe3, 0x0d, 0xdb,
+	0xa0, 0x12, 0x15, 0xe2, 0xc9, 0x5b, 0x90, 0x5f, 0x36, 0x5b, 0x54, 0xe9, 0x7f, 0x32, 0x73, 0x79,
+	0xe4, 0xfa, 0x85, 0xab, 0x5c, 0x7c, 0x57, 0x7d, 0xf1, 0x5d, 0x5d, 0xf6, 0xe5, 0x3b, 0x55, 0xf8,
+	0xe2, 0x56, 0xb1, 0x6f, 0x7b, 0xab, 0x98, 0x67, 0x22, 0xff, 0xec, 0x9f, 0x14, 0x33, 0x1a, 0x96,
+	0x24, 0x6f, 0xc0, 0x48, 0xb9, 0xd9, 0x71, 0x3d, 0xea, 0x2c, 0xea, 0x2d, 0xaa, 0x0c, 0x60, 0x85,
+	0x17, 0xb6, 0xb7, 0x8a, 0x67, 0x1b, 0x1c, 0x5c, 0xb7, 0xf4, 0x96, 0x5c, 0xb1, 0x4c, 0xae, 0xfe,
+	0x78, 0x06, 0x26, 0x6a, 0xd4, 0x75, 0x4d, 0xdb, 0x0a, 0x64, 0xf3, 0x3e, 0x18, 0x16, 0xa0, 0xca,
+	0x34, 0xca, 0x67, 0x78, 0x6a, 0x70, 0x7b, 0xab, 0x98, 0x73, 0x4d, 0x43, 0x0b, 0x31, 0xe4, 0x05,
+	0x18, 0xbc, 0x6b, 0x7a, 0x6b, 0x0b, 0xb3, 0x25, 0x21, 0xa7, 0xb3, 0xdb, 0x5b, 0x45, 0xb2, 0x61,
+	0x7a, 0x6b, 0xf5, 0xd6, 0x3d, 0x5d, 0xaa, 0xd0, 0x27, 0x23, 0xf3, 0x50, 0xa8, 0x3a, 0xe6, 0x7d,
+	0xdd, 0xa3, 0xb7, 0xe8, 0x66, 0xd5, 0x6e, 0x9a, 0x8d, 0x4d, 0x21, 0xc5, 0x27, 0xb7, 0xb7, 0x8a,
+	0x17, 0xdb, 0x1c, 0x57, 0x5f, 0xa7, 0x9b, 0xf5, 0x36, 0x62, 0x25, 0x26, 0x89, 0x92, 0xea, 0x77,
+	0x0f, 0xc3, 0xe8, 0x6d, 0x97, 0x3a, 0x41, 0xbb, 0x2f, 0x41, 0x9e, 0xfd, 0x16, 0x4d, 0x46, 0x99,
+	0x77, 0x5c, 0xea, 0xc8, 0x32, 0x67, 0x78, 0x72, 0x05, 0xfa, 0xe7, 0xed, 0x55, 0xd3, 0x12, 0xcd,
+	0x3e, 0xb5, 0xbd, 0x55, 0x9c, 0x68, 0x32, 0x80, 0x44, 0xc9, 0x29, 0xc8, 0x47, 0x61, 0xb4, 0xd2,
+	0x62, 0x3a, 0x64, 0x5b, 0xba, 0x67, 0x3b, 0xa2, 0xb5, 0x28, 0x5d, 0x53, 0x82, 0x4b, 0x05, 0x23,
+	0xf4, 0xe4, 0xc3, 0x00, 0xa5, 0xbb, 0x35, 0xcd, 0x6e, 0xd2, 0x92, 0xb6, 0x28, 0x94, 0x01, 0x4b,
+	0xeb, 0x1b, 0x6e, 0xdd, 0xb1, 0x9b, 0xb4, 0xae, 0x3b, 0x72, 0xb5, 0x12, 0x35, 0x99, 0x81, 0xf1,
+	0x12, 0x8e, 0x0a, 0x8d, 0x7e, 0xba, 0x43, 0x5d, 0xcf, 0x55, 0xfa, 0x9f, 0xcc, 0x5d, 0x1e, 0x9e,
+	0x7a, 0x7c, 0x7b, 0xab, 0x78, 0x9e, 0x8f, 0x97, 0xba, 0x23, 0x50, 0x12, 0x8b, 0x58, 0x21, 0x32,
+	0x05, 0x63, 0xa5, 0xf7, 0x3a, 0x0e, 0xad, 0x18, 0xd4, 0xf2, 0x4c, 0x6f, 0x53, 0x68, 0xc8, 0xc5,
+	0xed, 0xad, 0xa2, 0xa2, 0x33, 0x44, 0xdd, 0x14, 0x18, 0x89, 0x49, 0xb4, 0x08, 0x59, 0x82, 0xc9,
+	0x1b, 0xe5, 0x6a, 0x8d, 0x3a, 0xf7, 0xcd, 0x06, 0x2d, 0x35, 0x1a, 0x76, 0xc7, 0xf2, 0x94, 0x41,
+	0xe4, 0xf3, 0xd4, 0xf6, 0x56, 0xf1, 0xf1, 0xd5, 0x46, 0xbb, 0xee, 0x72, 0x6c, 0x5d, 0xe7, 0x68,
+	0x89, 0x59, 0xb2, 0x2c, 0xf9, 0x38, 0x8c, 0x2d, 0x3b, 0x4c, 0x0b, 0x8d, 0x69, 0xca, 0xe0, 0xca,
+	0x10, 0xea, 0xff, 0xd9, 0xab, 0x62, 0xa6, 0xe2, 0x50, 0xbf, 0x67, 0x79, 0x63, 0x3d, 0x5e, 0xa0,
+	0x6e, 0x20, 0x4e, 0x6e, 0x6c, 0x84, 0x15, 0xa1, 0xa0, 0xb0, 0x8f, 0x37, 0x1d, 0x6a, 0x24, 0xb4,
+	0x6d, 0x18, 0xdb, 0x7c, 0x65, 0x7b, 0xab, 0xf8, 0x3e, 0x47, 0xd0, 0xd4, 0x7b, 0xaa, 0x5d, 0x57,
+	0x56, 0x64, 0x06, 0x86, 0x98, 0x36, 0xdd, 0x32, 0x2d, 0x43, 0x81, 0x27, 0x33, 0x97, 0xc7, 0xaf,
+	0x17, 0xfc, 0xd6, 0xfb, 0xf0, 0xa9, 0x73, 0xdb, 0x5b, 0xc5, 0x53, 0x4c, 0x07, 0xeb, 0xeb, 0xa6,
+	0x25, 0x4f, 0x11, 0x41, 0x51, 0x36, 0x8a, 0xa6, 0x6c, 0x0f, 0x87, 0xee, 0x48, 0x38, 0x8a, 0x56,
+	0x6c, 0x2f, 0x3e, 0x6c, 0x7d, 0x32, 0x52, 0x86, 0xb1, 0x29, 0xdb, 0xab, 0x58, 0xae, 0xa7, 0x5b,
+	0x0d, 0x5a, 0x99, 0x56, 0x46, 0xb1, 0x1c, 0xaa, 0x05, 0x2b, 0x67, 0x0a, 0x4c, 0x3d, 0x32, 0x29,
+	0x45, 0xcb, 0x90, 0x05, 0x00, 0xd6, 0x84, 0x25, 0xc7, 0x64, 0x03, 0x61, 0x0c, 0xdb, 0x4f, 0xe4,
+	0xf6, 0x73, 0xcc, 0xd4, 0xf9, 0xed, 0xad, 0xe2, 0x19, 0xfc, 0x02, 0x1b, 0x01, 0xb2, 0xae, 0x86,
+	0x64, 0xe4, 0x55, 0x18, 0x66, 0xbf, 0x98, 0xea, 0xba, 0xca, 0x38, 0xaa, 0xa9, 0xb2, 0xbd, 0x55,
+	0x3c, 0x8d, 0x25, 0x99, 0x9e, 0xcb, 0x1a, 0x1a, 0x92, 0x92, 0xcf, 0x67, 0x78, 0x3b, 0x96, 0x1d,
+	0xdd, 0xf4, 0x5c, 0x65, 0x02, 0xb5, 0xe0, 0xcc, 0xd5, 0x60, 0xe6, 0x9e, 0xd7, 0x57, 0x68, 0xf3,
+	0x8e, 0xde, 0xec, 0x50, 0x77, 0xea, 0x93, 0x6c, 0x02, 0xfc, 0xc3, 0xad, 0xe2, 0xeb, 0xab, 0xa6,
+	0xb7, 0xd6, 0x59, 0xb9, 0xda, 0xb0, 0x5b, 0xd7, 0x56, 0x1d, 0xfd, 0xbe, 0xe9, 0xe9, 0x9e, 0x69,
+	0x5b, 0x7a, 0xf3, 0x5a, 0xb8, 0xb6, 0xb4, 0xcd, 0xd8, 0x62, 0x70, 0x95, 0xd7, 0x10, 0x7c, 0x8d,
+	0x87, 0x3f, 0xe3, 0x5f, 0xc3, 0x89, 0x48, 0x05, 0x26, 0xd8, 0x2f, 0x79, 0x5a, 0x2d, 0xa0, 0x8c,
+	0x8b, 0xdb, 0x5b, 0xc5, 0xc7, 0xb0, 0x7c, 0x97, 0xb9, 0x35, 0x5e, 0x4e, 0xfd, 0xcb, 0x3c, 0x8c,
+	0x33, 0xdd, 0x97, 0xa6, 0xa9, 0x12, 0x9b, 0x71, 0x19, 0x84, 0x11, 0xb8, 0x6d, 0xbd, 0x41, 0xc5,
+	0x8c, 0x85, 0xda, 0x62, 0xf9, 0x40, 0x99, 0x6b, 0x8c, 0x9e, 0x5c, 0x81, 0x21, 0x0e, 0xaa, 0x4c,
+	0x8b, 0x49, 0x6c, 0x6c, 0x7b, 0xab, 0x38, 0xec, 0x22, 0xac, 0x6e, 0x1a, 0x5a, 0x80, 0x66, 0xb3,
+	0x08, 0xff, 0x7b, 0xce, 0x76, 0x3d, 0xc6, 0x5c, 0xcc, 0x61, 0xa8, 0x2e, 0xa2, 0xc0, 0x9a, 0x40,
+	0xc9, 0xb3, 0x48, 0xb4, 0x10, 0x79, 0x0d, 0x80, 0x43, 0x4a, 0x86, 0xe1, 0x88, 0x89, 0x0c, 0x75,
+	0x43, 0xb0, 0xd0, 0x0d, 0x43, 0x9e, 0x05, 0x25, 0x62, 0xd2, 0x82, 0x51, 0xfe, 0x0b, 0x3b, 0x93,
+	0xcf, 0x62, 0x23, 0xd7, 0x2f, 0xfb, 0xca, 0x16, 0x95, 0xce, 0x55, 0x99, 0x74, 0xc6, 0xf2, 0x9c,
+	0xcd, 0xa9, 0xa2, 0x58, 0xf8, 0xce, 0x89, 0xaa, 0x9a, 0x88, 0x93, 0xa7, 0x5c, 0xb9, 0x0c, 0x5b,
+	0x0f, 0x67, 0x6d, 0x67, 0x43, 0x77, 0x0c, 0x6a, 0x4c, 0x6d, 0xca, 0xeb, 0xe1, 0x3d, 0x1f, 0x5c,
+	0x5f, 0x91, 0x87, 0xb8, 0x4c, 0xce, 0x06, 0x17, 0xe7, 0x56, 0xeb, 0xac, 0xe0, 0xd0, 0x1e, 0x4c,
+	0x48, 0xcb, 0xed, 0xac, 0xc4, 0x87, 0x73, 0xb4, 0x0c, 0x9b, 0x72, 0x39, 0xe0, 0x0e, 0x75, 0xd8,
+	0x62, 0x89, 0xb3, 0x9b, 0x98, 0x72, 0x05, 0x93, 0xfb, 0x1c, 0x93, 0xe4, 0x21, 0x8a, 0x5c, 0x78,
+	0x13, 0x26, 0x13, 0xa2, 0x20, 0x05, 0xc8, 0xad, 0xd3, 0x4d, 0xae, 0x2e, 0x1a, 0xfb, 0x93, 0x9c,
+	0x86, 0xfe, 0xfb, 0x6c, 0x78, 0x70, 0x35, 0xd0, 0xf8, 0x8f, 0x0f, 0x67, 0x3f, 0x94, 0x61, 0x2b,
+	0x3b, 0x29, 0xdb, 0x96, 0x45, 0x1b, 0x9e, 0xbc, 0xb8, 0xbf, 0x0a, 0xc3, 0xf3, 0x76, 0x43, 0x6f,
+	0x62, 0x3f, 0x72, 0xbd, 0xc3, 0x91, 0xca, 0x3a, 0xf0, 0x6a, 0x93, 0x61, 0xe4, 0x91, 0x1a, 0x90,
+	0x32, 0x05, 0xd0, 0x68, 0xcb, 0xf6, 0x28, 0x16, 0xcc, 0x86, 0x0a, 0x80, 0x05, 0x1d, 0x44, 0xc9,
+	0x0a, 0x10, 0x12, 0x93, 0x6b, 0x30, 0x54, 0x65, 0xf6, 0x4c, 0xc3, 0x6e, 0x0a, 0xe5, 0xc3, 0x25,
+	0x17, 0x6d, 0x1c, 0x79, 0x4e, 0xf4, 0x89, 0xd4, 0x39, 0x18, 0x2f, 0x37, 0x4d, 0x6a, 0x79, 0x72,
+	0xab, 0xd9, 0xc8, 0x2a, 0xad, 0x52, 0xcb, 0x93, 0x5b, 0x8d, 0x63, 0x51, 0x67, 0xd0, 0xf8, 0xfc,
+	0x82, 0xa4, 0xea, 0x6f, 0xe4, 0xe0, 0xfc, 0xad, 0xce, 0x0a, 0x75, 0x2c, 0xea, 0x51, 0x57, 0x0c,
+	0xcc, 0x80, 0xeb, 0x22, 0x4c, 0x26, 0x90, 0x82, 0x3b, 0x1a, 0x24, 0xeb, 0x01, 0xd2, 0x1f, 0xef,
+	0xf2, 0xaa, 0x96, 0x28, 0x4a, 0xe6, 0x60, 0x22, 0x04, 0xb2, 0x46, 0xb8, 0x4a, 0x16, 0xe7, 0xc2,
+	0x27, 0xb6, 0xb7, 0x8a, 0x17, 0x24, 0x6e, 0xac, 0xd9, 0xb2, 0x06, 0xc7, 0x8b, 0x91, 0x5b, 0x50,
+	0x08, 0x41, 0x37, 0x1c, 0xbb, 0xd3, 0x76, 0x95, 0x1c, 0xb2, 0xc2, 0x29, 0x48, 0x62, 0xb5, 0x8a,
+	0x48, 0xd9, 0x50, 0x8a, 0x17, 0x24, 0x5f, 0x93, 0x91, 0xb9, 0x89, 0x51, 0x98, 0xc7, 0x51, 0xf8,
+	0x41, 0x7f, 0x14, 0x76, 0x15, 0xd2, 0xd5, 0x78, 0x49, 0x31, 0x28, 0x63, 0xcd, 0x48, 0x0c, 0xca,
+	0x44, 0x8d, 0x17, 0xca, 0x70, 0x26, 0x95, 0xd7, 0x9e, 0xb4, 0xfa, 0xdf, 0xe4, 0x64, 0x2e, 0x55,
+	0xdb, 0x08, 0x3a, 0x73, 0x49, 0xee, 0xcc, 0xaa, 0x6d, 0xe0, 0xb4, 0x9d, 0x09, 0x6d, 0x14, 0xa9,
+	0xb1, 0x6d, 0xdb, 0x88, 0x4f, 0xdc, 0xc9, 0xb2, 0xe4, 0x53, 0x70, 0x36, 0x01, 0xe4, 0xd3, 0x35,
+	0xd7, 0xfe, 0x4b, 0xdb, 0x5b, 0x45, 0x35, 0x85, 0x6b, 0x7c, 0xf6, 0xee, 0xc2, 0x85, 0xe8, 0x70,
+	0x4e, 0x92, 0xba, 0x6d, 0x79, 0xba, 0x69, 0x89, 0xd5, 0x86, 0x8f, 0x92, 0x67, 0xb7, 0xb7, 0x8a,
+	0x4f, 0xcb, 0x3a, 0xe8, 0xd3, 0xc4, 0x1b, 0xdf, 0x8d, 0x0f, 0x31, 0x40, 0x49, 0x41, 0x55, 0x5a,
+	0xfa, 0xaa, 0xbf, 0x33, 0xb9, 0xbc, 0xbd, 0x55, 0x7c, 0x26, 0xb5, 0x0e, 0x93, 0x51, 0xc9, 0x96,
+	0x50, 0x37, 0x4e, 0x44, 0x03, 0x12, 0xe2, 0x16, 0x6d, 0x83, 0xe2, 0x37, 0xf4, 0x23, 0x7f, 0x75,
+	0x7b, 0xab, 0xf8, 0x84, 0xc4, 0xdf, 0xb2, 0x0d, 0x1a, 0x6f, 0x7e, 0x4a, 0x69, 0xf5, 0xc7, 0x73,
+	0xf0, 0x44, 0xad, 0xb4, 0x30, 0x5f, 0x31, 0x7c, 0xd3, 0xb1, 0xea, 0xd8, 0xf7, 0x4d, 0x43, 0x1a,
+	0xbd, 0x2b, 0x70, 0x2e, 0x86, 0x9a, 0x41, 0x6b, 0x35, 0xd8, 0xb4, 0xe0, 0xb7, 0xf9, 0x66, 0x69,
+	0x5b, 0xd0, 0xd4, 0xb9, 0x49, 0x1b, 0x35, 0x8e, 0xba, 0x31, 0x62, 0x7d, 0x14, 0x43, 0xd5, 0xd6,
+	0x6c, 0xc7, 0x6b, 0x74, 0x3c, 0xa1, 0x04, 0xd8, 0x47, 0x89, 0x3a, 0x5c, 0x41, 0xd4, 0xa3, 0x0a,
+	0x9f, 0x0f, 0xf9, 0x86, 0x0c, 0x14, 0x4a, 0x9e, 0xe7, 0x98, 0x2b, 0x1d, 0x8f, 0x2e, 0xe8, 0xed,
+	0xb6, 0x69, 0xad, 0xe2, 0x58, 0x1f, 0xb9, 0xfe, 0x46, 0xb0, 0x46, 0xf6, 0x94, 0xc4, 0xd5, 0x78,
+	0x71, 0x69, 0x88, 0xea, 0x3e, 0xaa, 0xde, 0xe2, 0x38, 0x79, 0x88, 0xc6, 0xcb, 0xb1, 0x21, 0x9a,
+	0xca, 0x6b, 0x4f, 0x43, 0xf4, 0x73, 0x39, 0xb8, 0xb8, 0xb4, 0xee, 0xe9, 0x1a, 0x75, 0xed, 0x8e,
+	0xd3, 0xa0, 0xee, 0xed, 0xb6, 0xa1, 0x7b, 0x34, 0x1c, 0xa9, 0x45, 0xe8, 0x2f, 0x19, 0x06, 0x35,
+	0x90, 0x5d, 0x3f, 0xdf, 0x5e, 0xeb, 0x0c, 0xa0, 0x71, 0x38, 0x79, 0x1f, 0x0c, 0x8a, 0x32, 0xc8,
+	0xbd, 0x7f, 0x6a, 0x64, 0x7b, 0xab, 0x38, 0xd8, 0xe1, 0x20, 0xcd, 0xc7, 0x31, 0xb2, 0x69, 0xda,
+	0xa4, 0x8c, 0x2c, 0x17, 0x92, 0x19, 0x1c, 0xa4, 0xf9, 0x38, 0xf2, 0x31, 0x18, 0x47, 0xb6, 0x41,
+	0x7b, 0xc4, 0xdc, 0x77, 0xda, 0x97, 0xae, 0xdc, 0x58, 0xbe, 0x34, 0x61, 0x6b, 0xea, 0x8e, 0x5f,
+	0x40, 0x8b, 0x31, 0x20, 0x77, 0xa1, 0x20, 0x1a, 0x11, 0x32, 0xed, 0xef, 0xc1, 0xf4, 0xcc, 0xf6,
+	0x56, 0x71, 0x52, 0xb4, 0x5f, 0x62, 0x9b, 0x60, 0xc2, 0x18, 0x8b, 0x66, 0x87, 0x8c, 0x07, 0x76,
+	0x62, 0x2c, 0xbe, 0x58, 0x66, 0x1c, 0x67, 0xa2, 0xbe, 0x03, 0xa3, 0x72, 0x41, 0x72, 0x16, 0x8f,
+	0x30, 0xf8, 0x38, 0xc1, 0xc3, 0x0f, 0xd3, 0xc0, 0x73, 0x8b, 0x17, 0x61, 0x64, 0x9a, 0xba, 0x0d,
+	0xc7, 0x6c, 0x33, 0xab, 0x41, 0x28, 0xf9, 0xc4, 0xf6, 0x56, 0x71, 0xc4, 0x08, 0xc1, 0x9a, 0x4c,
+	0xa3, 0xfe, 0x3f, 0x19, 0x38, 0xcb, 0x78, 0x97, 0x5c, 0xd7, 0x5c, 0xb5, 0x5a, 0xf2, 0xb2, 0xfd,
+	0x3c, 0x0c, 0xd4, 0xb0, 0x3e, 0x51, 0xd3, 0xe9, 0xed, 0xad, 0x62, 0x81, 0xb7, 0x40, 0xd2, 0x43,
+	0x41, 0x13, 0xec, 0xdf, 0xb3, 0x3b, 0xec, 0xdf, 0x99, 0x49, 0xeb, 0xe9, 0x8e, 0x67, 0x5a, 0xab,
+	0x35, 0x4f, 0xf7, 0x3a, 0x6e, 0xc4, 0xa4, 0x15, 0x98, 0xba, 0x8b, 0xa8, 0x88, 0x49, 0x1b, 0x29,
+	0x44, 0xde, 0x84, 0xd1, 0x19, 0xcb, 0x08, 0x99, 0xf0, 0x09, 0xf1, 0x31, 0x66, 0x69, 0x52, 0x84,
+	0x27, 0x59, 0x44, 0x0a, 0xa8, 0x7f, 0x95, 0x01, 0x85, 0x6f, 0xb6, 0xe7, 0x4d, 0xd7, 0x5b, 0xa0,
+	0xad, 0x15, 0x69, 0x76, 0x9a, 0xf5, 0x77, 0xef, 0x0c, 0x27, 0xad, 0x45, 0x68, 0x0a, 0x88, 0xdd,
+	0x7b, 0xd3, 0x74, 0x13, 0xdb, 0xbc, 0x58, 0x29, 0x52, 0x81, 0x41, 0xce, 0x99, 0xdb, 0x12, 0x23,
+	0xd7, 0x15, 0x5f, 0x11, 0xe2, 0x55, 0x73, 0x65, 0x68, 0x71, 0x62, 0x79, 0xe3, 0x28, 0xca, 0xb3,
+	0x6d, 0x4d, 0x58, 0x66, 0xd9, 0xf4, 0x9a, 0xfe, 0x22, 0xc0, 0x67, 0x0a, 0xa9, 0x4d, 0x1e, 0x43,
+	0xca, 0xf6, 0x49, 0xac, 0x9c, 0xfa, 0x85, 0x1c, 0x14, 0xe2, 0xf5, 0x93, 0xbb, 0x30, 0x74, 0xd3,
+	0x36, 0x2d, 0x6a, 0x2c, 0x59, 0xf8, 0xb1, 0xbd, 0xcf, 0xb3, 0x7c, 0xb3, 0xfe, 0xd4, 0xbb, 0x58,
+	0xa6, 0x2e, 0x1b, 0xc3, 0x78, 0xbc, 0x15, 0x30, 0x23, 0x1f, 0x87, 0x61, 0x66, 0x4e, 0xde, 0x47,
+	0xce, 0xd9, 0x1d, 0x39, 0x3f, 0x29, 0x38, 0x9f, 0x76, 0x78, 0xa1, 0x24, 0xeb, 0x90, 0x1d, 0x53,
+	0x51, 0x8d, 0xea, 0xae, 0x6d, 0x09, 0x25, 0x42, 0x15, 0x75, 0x10, 0x22, 0xab, 0x28, 0xa7, 0x61,
+	0x56, 0x30, 0xff, 0x58, 0xec, 0x51, 0x69, 0x1b, 0xc4, 0xc5, 0x1e, 0xef, 0x4c, 0x89, 0x98, 0x58,
+	0x30, 0x21, 0xfa, 0x66, 0xcd, 0x6c, 0xe3, 0x06, 0x02, 0x97, 0xc8, 0xf1, 0xeb, 0x97, 0xae, 0xfa,
+	0xfb, 0xd6, 0xab, 0xd2, 0x29, 0xe8, 0xfd, 0x17, 0xaf, 0x2e, 0x04, 0xe4, 0x78, 0x98, 0x80, 0xea,
+	0x1d, 0x63, 0x21, 0x2b, 0x4e, 0x2b, 0x42, 0xae, 0x7e, 0x6d, 0x16, 0x3e, 0x10, 0x76, 0x91, 0x46,
+	0xef, 0x9b, 0x74, 0x23, 0xe4, 0x28, 0x8e, 0x35, 0xd8, 0x68, 0x75, 0xcb, 0x6b, 0xba, 0xb5, 0x4a,
+	0x0d, 0x72, 0x05, 0xfa, 0xf9, 0x06, 0x3e, 0x83, 0x96, 0x26, 0xce, 0x84, 0xf1, 0xbd, 0x3b, 0xa7,
+	0x20, 0x36, 0x0c, 0x88, 0x2d, 0x3b, 0x57, 0xca, 0x52, 0x52, 0x29, 0x77, 0x51, 0xa3, 0xd8, 0x94,
+	0xf3, 0xe5, 0x0a, 0x05, 0x9f, 0xd8, 0x96, 0x8b, 0x6a, 0x2e, 0xbc, 0x06, 0x23, 0x12, 0xf1, 0x9e,
+	0xd6, 0xa3, 0xaf, 0xe9, 0x97, 0x87, 0xa9, 0xdf, 0x2c, 0x31, 0x4c, 0xaf, 0xb1, 0xe1, 0xe5, 0xba,
+	0xcc, 0x20, 0xe2, 0xe3, 0x53, 0x0c, 0x22, 0x04, 0x45, 0x07, 0x11, 0x82, 0xc8, 0x4b, 0x30, 0xc4,
+	0x59, 0x04, 0x5b, 0x6f, 0xdc, 0xb6, 0x3b, 0x08, 0x8b, 0x5a, 0x15, 0x01, 0x21, 0xf9, 0xbe, 0x0c,
+	0x3c, 0xde, 0x53, 0x12, 0xa8, 0x7c, 0x23, 0xd7, 0x5f, 0xd9, 0x97, 0x18, 0xa7, 0x3e, 0xb0, 0xbd,
+	0x55, 0xbc, 0x22, 0x69, 0x86, 0x23, 0xd1, 0xd4, 0x1b, 0x9c, 0x48, 0x6a, 0x57, 0xef, 0xa6, 0x30,
+	0xbb, 0x97, 0x57, 0x3a, 0x8b, 0xa7, 0x8b, 0x56, 0x63, 0xd3, 0x6f, 0x64, 0x3e, 0xb4, 0x7b, 0xc5,
+	0xf7, 0xde, 0xf3, 0x49, 0x52, 0xaa, 0xe9, 0xc2, 0x85, 0x34, 0xe0, 0x1c, 0xc7, 0x4c, 0xeb, 0x9b,
+	0x4b, 0xf7, 0x16, 0x6c, 0xcb, 0x5b, 0xf3, 0x2b, 0xe8, 0x97, 0x8f, 0xe7, 0xb0, 0x02, 0x43, 0xdf,
+	0xac, 0xdb, 0xf7, 0xea, 0x2d, 0x46, 0x95, 0x52, 0x47, 0x37, 0x4e, 0x6c, 0x8d, 0x10, 0x63, 0xdc,
+	0x9f, 0x3d, 0x07, 0xc2, 0xc3, 0x53, 0x7f, 0x5e, 0x48, 0xce, 0x95, 0xb1, 0x42, 0x69, 0x53, 0xe6,
+	0xe0, 0x3e, 0xa7, 0xcc, 0x0a, 0x8c, 0xce, 0xdb, 0x8d, 0xf5, 0x40, 0xf3, 0x5e, 0x83, 0x81, 0x65,
+	0xdd, 0x59, 0xa5, 0x1e, 0x8a, 0x75, 0xe4, 0xfa, 0xe4, 0x55, 0x7e, 0xb7, 0xc1, 0x88, 0x38, 0x62,
+	0x6a, 0x5c, 0x4c, 0x64, 0x03, 0x1e, 0xfe, 0xd6, 0x44, 0x01, 0xf5, 0x9f, 0x0f, 0xc0, 0xa8, 0x38,
+	0x87, 0xc7, 0x35, 0x8d, 0x7c, 0x38, 0xbc, 0xd9, 0x10, 0x33, 0x6f, 0x70, 0x16, 0x19, 0x9c, 0xa1,
+	0x8e, 0x32, 0x66, 0xbf, 0xb9, 0x55, 0xcc, 0x6c, 0x6f, 0x15, 0xfb, 0xb4, 0x21, 0x69, 0x6b, 0x1d,
+	0xae, 0xba, 0x92, 0x99, 0x21, 0x9f, 0xac, 0xc7, 0xca, 0xf2, 0x55, 0xf8, 0x4d, 0x18, 0x14, 0x6d,
+	0x10, 0xca, 0x7b, 0x2e, 0x3c, 0xd1, 0x89, 0xdc, 0x27, 0xc4, 0x4a, 0xfb, 0xa5, 0xc8, 0x1b, 0x30,
+	0xc0, 0x4f, 0x38, 0x84, 0x00, 0xce, 0xa6, 0x9f, 0x08, 0xc5, 0x8a, 0x8b, 0x32, 0x64, 0x0e, 0x20,
+	0x3c, 0xdd, 0x08, 0xae, 0x4f, 0x04, 0x87, 0xe4, 0xb9, 0x47, 0x8c, 0x8b, 0x54, 0x96, 0xbc, 0x0a,
+	0xa3, 0xcb, 0xd4, 0x69, 0x99, 0x96, 0xde, 0xac, 0x99, 0xef, 0xf9, 0x37, 0x28, 0x68, 0x7e, 0xb8,
+	0xe6, 0x7b, 0x72, 0x9f, 0x46, 0xe8, 0xc8, 0x57, 0xa4, 0x9d, 0x1e, 0x0c, 0x62, 0x43, 0x9e, 0xda,
+	0x71, 0x5b, 0x1d, 0x6b, 0x4f, 0xca, 0x61, 0xc2, 0xc7, 0x60, 0x2c, 0xb2, 0x71, 0x14, 0x47, 0xe4,
+	0x8f, 0x27, 0x59, 0x4b, 0xbb, 0xe0, 0x18, 0xdb, 0x28, 0x07, 0x36, 0x28, 0x2a, 0x96, 0xe9, 0x99,
+	0x7a, 0xb3, 0x6c, 0xb7, 0x5a, 0xba, 0x65, 0x28, 0xc3, 0xe1, 0xa0, 0x30, 0x39, 0xa6, 0xde, 0xe0,
+	0x28, 0x79, 0x50, 0x44, 0x0b, 0x91, 0x5b, 0x50, 0x10, 0x7d, 0xa8, 0xd1, 0x86, 0xed, 0x30, 0x8b,
+	0x08, 0x4f, 0xc0, 0xc5, 0xa8, 0x70, 0x39, 0xae, 0xee, 0xf8, 0x48, 0x79, 0xcb, 0x11, 0x2f, 0xc8,
+	0x26, 0xe0, 0x8a, 0x75, 0xdf, 0x64, 0x46, 0xfc, 0x28, 0x36, 0x06, 0x27, 0x60, 0x93, 0x83, 0xe4,
+	0x09, 0x58, 0x50, 0x49, 0x0b, 0xf6, 0xd8, 0xce, 0x0b, 0xf6, 0xcd, 0xfc, 0xd0, 0x48, 0x61, 0x34,
+	0x7e, 0x27, 0xa2, 0xfe, 0x93, 0x1c, 0x8c, 0x88, 0x96, 0x30, 0x23, 0xe3, 0x64, 0xfc, 0x1c, 0x64,
+	0xfc, 0xa4, 0x8e, 0x83, 0x81, 0xc3, 0x1a, 0x07, 0xea, 0x67, 0xb2, 0xc1, 0x64, 0x57, 0x75, 0x4c,
+	0xeb, 0x60, 0x93, 0xdd, 0x25, 0x80, 0xf2, 0x5a, 0xc7, 0x5a, 0xe7, 0x77, 0xbf, 0xd9, 0xf0, 0xee,
+	0xb7, 0x61, 0x6a, 0x12, 0x86, 0x3c, 0x0e, 0xf9, 0x69, 0xc6, 0x9f, 0xf5, 0xcc, 0xe8, 0xd4, 0xf0,
+	0x17, 0x39, 0xa7, 0xcc, 0x07, 0x34, 0x04, 0xb3, 0x1d, 0xec, 0xd4, 0xa6, 0x47, 0xf9, 0x9e, 0x21,
+	0xc7, 0x77, 0xb0, 0x2b, 0x0c, 0xa0, 0x71, 0x38, 0x79, 0x19, 0x26, 0xa7, 0x69, 0x53, 0xdf, 0x5c,
+	0x30, 0x9b, 0x4d, 0xd3, 0xa5, 0x0d, 0xdb, 0x32, 0x5c, 0x14, 0xb2, 0xa8, 0xae, 0xe5, 0x6a, 0x49,
+	0x02, 0xa2, 0xc2, 0xc0, 0xd2, 0xbd, 0x7b, 0x2e, 0xf5, 0x50, 0x7c, 0xb9, 0x29, 0x60, 0x73, 0xbf,
+	0x8d, 0x10, 0x4d, 0x60, 0xd4, 0x1f, 0xca, 0xb0, 0x2d, 0xa2, 0xbb, 0xee, 0xd9, 0xed, 0x70, 0x10,
+	0x1d, 0x44, 0x24, 0x57, 0x42, 0x0b, 0x28, 0x8b, 0x5f, 0x3b, 0x21, 0xbe, 0x76, 0x50, 0x58, 0x41,
+	0xa1, 0xed, 0x93, 0xfa, 0x55, 0xb9, 0x1d, 0xbe, 0x4a, 0xfd, 0x9e, 0x1c, 0x9c, 0x13, 0x2d, 0x2e,
+	0x37, 0xcd, 0xf6, 0x8a, 0xad, 0x3b, 0x86, 0x46, 0x1b, 0xd4, 0xbc, 0x4f, 0x8f, 0xe7, 0xc0, 0x8b,
+	0x0e, 0x9d, 0xfc, 0x01, 0x86, 0xce, 0x75, 0xdc, 0x6d, 0x33, 0xc9, 0xe0, 0xa9, 0x3a, 0x37, 0x7f,
+	0x0a, 0xdb, 0x5b, 0xc5, 0x51, 0x83, 0x83, 0xf1, 0x5e, 0x45, 0x93, 0x89, 0x98, 0x92, 0xcc, 0x53,
+	0x6b, 0xd5, 0x5b, 0x43, 0x25, 0xe9, 0xe7, 0x4a, 0xd2, 0x44, 0x88, 0x26, 0x30, 0x12, 0x5f, 0xdc,
+	0xa7, 0x0c, 0x26, 0xf9, 0xb2, 0x8d, 0x8a, 0x26, 0x13, 0xa9, 0xdf, 0x95, 0x83, 0xd3, 0xf1, 0x6e,
+	0xaa, 0x51, 0xcb, 0x38, 0xe9, 0xa3, 0x87, 0xa7, 0x8f, 0xbe, 0x37, 0x0f, 0x8f, 0x89, 0xdf, 0xb5,
+	0x35, 0xdd, 0xa1, 0xc6, 0xb4, 0xe9, 0xd0, 0x86, 0x67, 0x3b, 0x9b, 0xc7, 0xd8, 0x0e, 0x3c, 0xbc,
+	0xae, 0x7a, 0x19, 0x06, 0xc4, 0x59, 0x0e, 0x5f, 0xcf, 0xc6, 0x83, 0x96, 0x20, 0x34, 0xb1, 0x12,
+	0xf2, 0x73, 0xa0, 0x58, 0x07, 0x0f, 0xec, 0xa6, 0x83, 0x3f, 0x04, 0x63, 0x81, 0xe8, 0xa5, 0xee,
+	0x43, 0xa3, 0xd1, 0xf0, 0x11, 0xbc, 0x03, 0xa3, 0x84, 0x58, 0x9b, 0x0f, 0xa8, 0x4c, 0xa3, 0x51,
+	0x37, 0x26, 0x6a, 0x0b, 0xca, 0x99, 0x86, 0x26, 0x13, 0xc5, 0x55, 0x65, 0x78, 0x37, 0xaa, 0xf2,
+	0xb9, 0x7e, 0xb8, 0x90, 0xae, 0x2a, 0x1a, 0xd5, 0x8d, 0x13, 0x4d, 0xf9, 0xf2, 0xd4, 0x94, 0xa7,
+	0x20, 0x5f, 0xd5, 0xbd, 0x35, 0xa1, 0x22, 0xe8, 0x14, 0x70, 0xcf, 0x6c, 0xd2, 0x7a, 0x5b, 0xf7,
+	0xd6, 0x34, 0x44, 0x49, 0x73, 0x13, 0x20, 0xc7, 0xb4, 0xb9, 0x29, 0x34, 0x44, 0x46, 0x9e, 0xcc,
+	0x5c, 0xce, 0xa7, 0x19, 0x22, 0x71, 0xa5, 0x1c, 0xdd, 0x8d, 0x52, 0x7e, 0xbe, 0xbf, 0xdb, 0xfc,
+	0x75, 0xd7, 0x31, 0x3d, 0x7a, 0xa2, 0x95, 0x27, 0x5a, 0x79, 0x04, 0x5a, 0xf9, 0xdb, 0x59, 0x18,
+	0x0b, 0xf6, 0xa5, 0xef, 0xd2, 0xc6, 0xd1, 0xac, 0xa3, 0xe1, 0x76, 0x2e, 0x77, 0xe0, 0xed, 0xdc,
+	0x41, 0x94, 0x50, 0x0d, 0xf6, 0xd7, 0xdc, 0xd4, 0x41, 0x29, 0xf3, 0xfd, 0x75, 0x70, 0x0c, 0xfe,
+	0x14, 0x0c, 0x2e, 0xe8, 0x0f, 0xcc, 0x56, 0xa7, 0x25, 0x76, 0x2a, 0xe8, 0x1f, 0xda, 0xd2, 0x1f,
+	0x68, 0x3e, 0x5c, 0xfd, 0xdd, 0x0c, 0x8c, 0x0b, 0xa1, 0x0a, 0xe6, 0x07, 0x92, 0x6a, 0x28, 0x9d,
+	0xec, 0x81, 0xa5, 0x93, 0xdb, 0xbf, 0x74, 0xd4, 0x7f, 0x90, 0x03, 0x65, 0xd6, 0x6c, 0xd2, 0x65,
+	0x47, 0xb7, 0xdc, 0x7b, 0xd4, 0x11, 0x47, 0x0a, 0x33, 0x8c, 0xd5, 0x81, 0x3e, 0x50, 0x9a, 0x86,
+	0xb2, 0xfb, 0x9a, 0x86, 0xde, 0x0f, 0xc3, 0xa2, 0x31, 0x81, 0x6f, 0x32, 0x8e, 0x34, 0xc7, 0x07,
+	0x6a, 0x21, 0x9e, 0x11, 0x97, 0xda, 0x6d, 0xc7, 0xbe, 0x4f, 0x1d, 0x7e, 0x1d, 0x2a, 0x88, 0x75,
+	0x1f, 0xa8, 0x85, 0x78, 0x89, 0x33, 0xf5, 0xed, 0x5f, 0x99, 0x33, 0x75, 0xb4, 0x10, 0x4f, 0x2e,
+	0xc3, 0xd0, 0xbc, 0xdd, 0x40, 0x8f, 0x3c, 0x31, 0x15, 0x8d, 0x6e, 0x6f, 0x15, 0x87, 0x9a, 0x02,
+	0xa6, 0x05, 0x58, 0x46, 0x39, 0x6d, 0x6f, 0x58, 0x4d, 0x5b, 0xe7, 0x5e, 0x56, 0x43, 0x9c, 0xd2,
+	0x10, 0x30, 0x2d, 0xc0, 0x32, 0x4a, 0x26, 0x73, 0xf4, 0x5e, 0x1b, 0x0a, 0x79, 0xde, 0x13, 0x30,
+	0x2d, 0xc0, 0xaa, 0x3f, 0x94, 0x67, 0xda, 0xeb, 0x9a, 0xef, 0x3d, 0xf2, 0x6b, 0x49, 0x38, 0x60,
+	0xfa, 0xf7, 0x31, 0x60, 0x1e, 0x99, 0x33, 0x51, 0xf5, 0x2f, 0x07, 0x01, 0x84, 0xf4, 0x67, 0x4e,
+	0x36, 0xbb, 0x07, 0xd3, 0x9a, 0x69, 0x98, 0x9c, 0xb1, 0xd6, 0x74, 0xab, 0x41, 0x8d, 0xf0, 0x64,
+	0x78, 0x00, 0x87, 0x36, 0x7a, 0x35, 0x53, 0x81, 0x0c, 0x8f, 0x86, 0xb5, 0x64, 0x01, 0xf2, 0x22,
+	0x8c, 0x54, 0x2c, 0x8f, 0x3a, 0x7a, 0xc3, 0x33, 0xef, 0x53, 0x31, 0x35, 0xa0, 0x0b, 0x82, 0x19,
+	0x82, 0x35, 0x99, 0x86, 0xbc, 0x0c, 0xa3, 0x55, 0xdd, 0xf1, 0xcc, 0x86, 0xd9, 0xd6, 0x2d, 0xcf,
+	0x55, 0x86, 0x70, 0x46, 0xc3, 0x65, 0xbf, 0x2d, 0xc1, 0xb5, 0x08, 0x15, 0xf9, 0x0a, 0x18, 0xc6,
+	0x6d, 0x33, 0x3e, 0xc0, 0x18, 0xde, 0xf1, 0x5a, 0xf9, 0xe9, 0xd0, 0x0f, 0x95, 0x1f, 0x70, 0xa3,
+	0xab, 0x41, 0xfc, 0x66, 0x39, 0xe0, 0x48, 0xde, 0x86, 0xc1, 0x19, 0xcb, 0x40, 0xe6, 0xb0, 0x23,
+	0x73, 0x55, 0x30, 0x3f, 0x1b, 0x32, 0xb7, 0xdb, 0x31, 0xde, 0x3e, 0xbb, 0xf4, 0x51, 0x36, 0xf2,
+	0xa5, 0x1b, 0x65, 0xa3, 0x5f, 0x82, 0x9b, 0x87, 0xb1, 0xc3, 0xba, 0x79, 0x18, 0xdf, 0xe7, 0xcd,
+	0x83, 0xfa, 0x1e, 0x8c, 0x4c, 0x55, 0x67, 0x83, 0xd1, 0x7b, 0x1e, 0x72, 0x55, 0xe1, 0x12, 0x93,
+	0xe7, 0xf6, 0x4c, 0xdb, 0x34, 0x34, 0x06, 0x23, 0x57, 0x60, 0xa8, 0x8c, 0x7e, 0x96, 0xe2, 0xce,
+	0x37, 0xcf, 0xd7, 0xbf, 0x06, 0xc2, 0xd0, 0xdd, 0xda, 0x47, 0x93, 0xf7, 0xc1, 0x60, 0xd5, 0xb1,
+	0x57, 0x1d, 0xbd, 0x25, 0xd6, 0x60, 0xf4, 0x49, 0x6a, 0x73, 0x90, 0xe6, 0xe3, 0xd4, 0xcf, 0x67,
+	0x7c, 0x53, 0x9f, 0x95, 0xa8, 0x75, 0xf0, 0x7a, 0x02, 0xeb, 0x1e, 0xe2, 0x25, 0x5c, 0x0e, 0xd2,
+	0x7c, 0x1c, 0xb9, 0x02, 0xfd, 0x33, 0x8e, 0x63, 0x3b, 0xf2, 0xa3, 0x15, 0xca, 0x00, 0xf2, 0xe5,
+	0x3c, 0x52, 0x90, 0x0f, 0xc2, 0x08, 0x9f, 0x73, 0xf8, 0xa9, 0x6e, 0xae, 0xd7, 0xbd, 0xb6, 0x4c,
+	0xa9, 0xfe, 0x42, 0x4e, 0xb2, 0xd9, 0xb8, 0xc4, 0x1f, 0xc1, 0x9b, 0x91, 0x97, 0x20, 0x37, 0x55,
+	0x9d, 0x15, 0x13, 0xe0, 0x29, 0xbf, 0xa8, 0xa4, 0x2a, 0xb1, 0x72, 0x8c, 0x9a, 0x5c, 0x84, 0x7c,
+	0x95, 0xa9, 0xcf, 0x00, 0xaa, 0xc7, 0xd0, 0xf6, 0x56, 0x31, 0xdf, 0x66, 0xfa, 0x83, 0x50, 0xc4,
+	0xb2, 0x0d, 0x10, 0xdf, 0x65, 0x71, 0x6c, 0xb8, 0xf7, 0xb9, 0x08, 0xf9, 0x92, 0xb3, 0x7a, 0x5f,
+	0xcc, 0x5a, 0x88, 0xd5, 0x9d, 0xd5, 0xfb, 0x1a, 0x42, 0xc9, 0x35, 0x00, 0x8d, 0x7a, 0x1d, 0xc7,
+	0xc2, 0xf7, 0x64, 0xc3, 0x78, 0x9e, 0x88, 0xb3, 0xa1, 0x83, 0xd0, 0x7a, 0xc3, 0x36, 0xa8, 0x26,
+	0x91, 0xa8, 0xff, 0x38, 0xbc, 0xdc, 0x9a, 0x36, 0xdd, 0xf5, 0x93, 0x2e, 0xdc, 0x43, 0x17, 0xea,
+	0xe2, 0xc8, 0x36, 0xd9, 0x49, 0x45, 0xe8, 0x9f, 0x6d, 0xea, 0xab, 0x2e, 0xf6, 0xa1, 0x70, 0x5a,
+	0xbc, 0xc7, 0x00, 0x1a, 0x87, 0xc7, 0xfa, 0x69, 0x68, 0xe7, 0x7e, 0xfa, 0xb6, 0xfe, 0x60, 0xb4,
+	0x2d, 0x52, 0x6f, 0xc3, 0x76, 0x4e, 0xba, 0x6a, 0xb7, 0x5d, 0x75, 0x09, 0x06, 0x6b, 0x4e, 0x43,
+	0x3a, 0xee, 0xc0, 0xfd, 0x80, 0xeb, 0x34, 0xf8, 0x51, 0x87, 0x8f, 0x64, 0x74, 0xd3, 0xae, 0x87,
+	0x74, 0x83, 0x21, 0x9d, 0xe1, 0x7a, 0x82, 0x4e, 0x20, 0x05, 0x5d, 0xd5, 0x76, 0x3c, 0xd1, 0x71,
+	0x01, 0x5d, 0xdb, 0x76, 0x3c, 0xcd, 0x47, 0x92, 0xf7, 0x03, 0x2c, 0x97, 0xab, 0xfe, 0xab, 0x8e,
+	0xe1, 0xd0, 0xe9, 0x54, 0x3c, 0xe7, 0xd0, 0x24, 0x34, 0x59, 0x86, 0xe1, 0xa5, 0x36, 0x75, 0xf8,
+	0x56, 0x88, 0xbf, 0x10, 0x7b, 0x36, 0x26, 0x5a, 0xd1, 0xef, 0x57, 0xc5, 0xff, 0x01, 0x39, 0x5f,
+	0x5f, 0x6c, 0xff, 0xa7, 0x16, 0x32, 0x22, 0x1f, 0x84, 0x81, 0x12, 0xb7, 0xf3, 0x46, 0x90, 0x65,
+	0x20, 0x32, 0xdc, 0x82, 0x72, 0x14, 0xdf, 0xb3, 0xeb, 0xf8, 0xb7, 0x26, 0xc8, 0xd5, 0x2b, 0x50,
+	0x88, 0x57, 0x43, 0x46, 0x60, 0xb0, 0xbc, 0xb4, 0xb8, 0x38, 0x53, 0x5e, 0x2e, 0xf4, 0x91, 0x21,
+	0xc8, 0xd7, 0x66, 0x16, 0xa7, 0x0b, 0x19, 0xf5, 0x07, 0xa4, 0x19, 0x84, 0xa9, 0xd6, 0xc9, 0xf5,
+	0xf8, 0x81, 0xee, 0x8f, 0x0a, 0x78, 0x27, 0x8c, 0x27, 0x06, 0x2d, 0xd3, 0xf3, 0xa8, 0x21, 0x56,
+	0x09, 0xbc, 0x33, 0xf5, 0x1e, 0x68, 0x09, 0x3c, 0x79, 0x1e, 0xc6, 0x10, 0x26, 0xae, 0x49, 0xf9,
+	0xfe, 0x58, 0x14, 0x70, 0x1e, 0x68, 0x51, 0xa4, 0xfa, 0xab, 0xe1, 0x0d, 0xf9, 0x3c, 0xd5, 0x8f,
+	0xeb, 0xad, 0xea, 0x43, 0xd2, 0x5f, 0xea, 0x4f, 0xf6, 0xf3, 0xb7, 0x46, 0xfc, 0x01, 0xf0, 0x51,
+	0x88, 0x32, 0x3c, 0x06, 0xce, 0xed, 0xe1, 0x18, 0xf8, 0x79, 0x18, 0x58, 0xa0, 0xde, 0x9a, 0xed,
+	0xbb, 0xe9, 0xa1, 0x5f, 0x4c, 0x0b, 0x21, 0xb2, 0x5f, 0x0c, 0xa7, 0x21, 0xeb, 0x40, 0xfc, 0xd7,
+	0xbd, 0x81, 0xc7, 0xbf, 0x7f, 0xec, 0x7c, 0x2e, 0xb1, 0x4f, 0xa9, 0x61, 0x0c, 0x00, 0x7c, 0xcc,
+	0x71, 0x3a, 0x78, 0x51, 0x20, 0xf9, 0xcd, 0xfd, 0x87, 0xad, 0xe2, 0x00, 0xa7, 0xd1, 0x52, 0xd8,
+	0x92, 0x8f, 0xc1, 0xf0, 0xc2, 0x6c, 0x49, 0xbc, 0xf4, 0xe5, 0x9e, 0x21, 0xe7, 0x03, 0x29, 0xfa,
+	0x88, 0x40, 0x24, 0xf8, 0xb0, 0xab, 0x75, 0x4f, 0x4f, 0x3e, 0xf4, 0x0d, 0xb9, 0x30, 0x6d, 0xe1,
+	0x4f, 0xc4, 0xc4, 0xe9, 0x42, 0xa0, 0x2d, 0xd1, 0x87, 0x63, 0x71, 0x59, 0x71, 0x6c, 0x4c, 0x5b,
+	0x86, 0x0e, 0x30, 0xba, 0x97, 0x60, 0xb2, 0xd4, 0x6e, 0x37, 0x4d, 0x6a, 0xa0, 0xbe, 0x68, 0x9d,
+	0x26, 0x75, 0x85, 0x57, 0x15, 0xbe, 0x3a, 0xd2, 0x39, 0xb2, 0x8e, 0xef, 0xcb, 0xeb, 0x4e, 0x27,
+	0xea, 0x4d, 0x9b, 0x2c, 0x8b, 0xcf, 0xf9, 0x39, 0x7b, 0xdb, 0xa9, 0x4c, 0x0b, 0xbf, 0x2a, 0xfe,
+	0x9c, 0xdf, 0x07, 0x47, 0xbd, 0x4c, 0x65, 0x72, 0xf5, 0x5b, 0xb3, 0x70, 0xb6, 0xec, 0x50, 0xdd,
+	0xa3, 0x0b, 0xb3, 0xa5, 0x52, 0x07, 0xfd, 0x21, 0x9b, 0x4d, 0x6a, 0xad, 0x1e, 0xcd, 0xa4, 0xf0,
+	0x3a, 0x8c, 0x07, 0x0d, 0xa8, 0x35, 0xec, 0x36, 0x95, 0xdf, 0xff, 0x35, 0x7c, 0x4c, 0xdd, 0x65,
+	0x28, 0x2d, 0x46, 0x4a, 0x6e, 0xc1, 0xa9, 0x00, 0x52, 0x6a, 0x36, 0xed, 0x0d, 0x8d, 0x76, 0x5c,
+	0xee, 0x74, 0x3d, 0xc4, 0x9d, 0xae, 0x43, 0x0e, 0x3a, 0xc3, 0xd7, 0x1d, 0x46, 0xa0, 0xa5, 0x95,
+	0x52, 0xbf, 0x90, 0x83, 0x73, 0x77, 0xf4, 0xa6, 0x69, 0x84, 0xa2, 0xd1, 0xa8, 0xdb, 0xb6, 0x2d,
+	0x97, 0x1e, 0xa3, 0x31, 0x1e, 0x19, 0x48, 0xf9, 0x43, 0x19, 0x48, 0xc9, 0x2e, 0xea, 0x3f, 0x70,
+	0x17, 0x0d, 0xec, 0xab, 0x8b, 0xfe, 0x6d, 0x06, 0x0a, 0xfe, 0xfb, 0x14, 0x39, 0xa6, 0x83, 0xf4,
+	0x78, 0x02, 0x0f, 0x20, 0x63, 0x3e, 0xf6, 0x88, 0x27, 0x35, 0x18, 0x9c, 0x79, 0xd0, 0x36, 0x1d,
+	0xea, 0xee, 0xe2, 0x81, 0xc0, 0xe3, 0xe2, 0xb0, 0x65, 0x92, 0xf2, 0x22, 0x89, 0x73, 0x16, 0x0e,
+	0xc6, 0x57, 0xa7, 0xfc, 0x85, 0xce, 0x94, 0x1f, 0xa8, 0x82, 0xbf, 0x3a, 0x15, 0x2f, 0x79, 0x22,
+	0xcf, 0x88, 0x43, 0x52, 0xf2, 0x34, 0xe4, 0x96, 0x97, 0xe7, 0xc5, 0x3c, 0x8c, 0x01, 0x42, 0x3c,
+	0x4f, 0x7e, 0x56, 0xcb, 0xb0, 0xea, 0x1f, 0x67, 0xf9, 0xd3, 0x77, 0x3e, 0x5c, 0x8f, 0x44, 0x09,
+	0xa7, 0x60, 0xc8, 0x17, 0xb8, 0x50, 0xc3, 0xe0, 0x71, 0x49, 0xbc, 0x23, 0xe2, 0x75, 0x07, 0x0f,
+	0x89, 0x8a, 0xfe, 0xa3, 0x01, 0x7e, 0x8b, 0x80, 0xfb, 0x22, 0x7c, 0x34, 0xe0, 0x3f, 0x15, 0x78,
+	0x3f, 0x0c, 0x07, 0x33, 0x94, 0x7c, 0x7b, 0x10, 0x4c, 0x67, 0x5a, 0x88, 0x8f, 0x4d, 0xcc, 0x03,
+	0x07, 0x58, 0xc6, 0x7d, 0xf1, 0xf2, 0x5e, 0x39, 0x11, 0xef, 0x21, 0x8b, 0xf7, 0x9b, 0x84, 0x78,
+	0xf9, 0x43, 0xb3, 0x63, 0x2b, 0xde, 0x43, 0x3b, 0x39, 0x57, 0x7f, 0x3b, 0x03, 0x84, 0x35, 0xab,
+	0xaa, 0xbb, 0xee, 0x86, 0xed, 0x18, 0xfc, 0x21, 0xc2, 0x91, 0x08, 0xe6, 0xf0, 0x6e, 0x3b, 0xbf,
+	0x6e, 0x18, 0x4e, 0x45, 0x5c, 0xa7, 0x8f, 0xf9, 0x64, 0x75, 0x25, 0x3a, 0x9a, 0x7a, 0xbd, 0x70,
+	0x7a, 0x46, 0xbe, 0x4e, 0xed, 0x8f, 0xbc, 0x93, 0x94, 0xee, 0x51, 0x3f, 0x00, 0xa3, 0xe2, 0x07,
+	0x5b, 0xa1, 0xfd, 0x7b, 0x32, 0x1c, 0xa5, 0x2e, 0x03, 0x68, 0x11, 0x34, 0x79, 0x05, 0x86, 0xd9,
+	0x80, 0x59, 0xc5, 0x58, 0x42, 0x83, 0xe1, 0xeb, 0x21, 0xc3, 0x07, 0xca, 0xeb, 0x49, 0x40, 0x29,
+	0xb9, 0xbc, 0x0f, 0xed, 0xe2, 0x8d, 0xda, 0xa7, 0x60, 0xa4, 0x64, 0x59, 0x36, 0x8f, 0x8a, 0xe2,
+	0x8a, 0x8b, 0x8d, 0xae, 0x36, 0xfd, 0xd3, 0x18, 0xc3, 0x21, 0xa4, 0x4f, 0x35, 0xea, 0x65, 0x86,
+	0xe4, 0xba, 0xff, 0x02, 0x8a, 0x3a, 0xc2, 0x3c, 0xc5, 0xcb, 0x1d, 0x47, 0xc0, 0x92, 0x0f, 0xa0,
+	0xb0, 0xf3, 0xc6, 0xaa, 0x8e, 0xdd, 0xb6, 0x5d, 0x6a, 0x70, 0x41, 0x8d, 0x84, 0x11, 0x31, 0xda,
+	0x02, 0x81, 0xcf, 0x2d, 0x23, 0x71, 0x7d, 0x22, 0x45, 0xc8, 0x3d, 0x38, 0xed, 0x5f, 0x33, 0x07,
+	0x0f, 0x5b, 0x2b, 0xd3, 0x2e, 0x3e, 0x1b, 0x18, 0x09, 0x83, 0xd7, 0x84, 0xa8, 0xa9, 0x27, 0xfc,
+	0x4b, 0x15, 0xff, 0x65, 0x6c, 0xdd, 0x34, 0xe4, 0xae, 0x4e, 0xe5, 0x47, 0xbe, 0x12, 0x46, 0x16,
+	0xf4, 0x07, 0xd3, 0x1d, 0x71, 0x72, 0x33, 0xb6, 0xfb, 0xbb, 0x9b, 0x96, 0xfe, 0xa0, 0x6e, 0x88,
+	0x72, 0x31, 0x9b, 0x42, 0x66, 0x49, 0xea, 0x70, 0xb6, 0xea, 0xd8, 0x2d, 0xdb, 0xa3, 0x46, 0xec,
+	0x8d, 0xe8, 0x44, 0xf8, 0xa8, 0xbc, 0x2d, 0x28, 0xea, 0x3d, 0x1e, 0x8b, 0x76, 0x61, 0x43, 0x5a,
+	0x30, 0x51, 0x72, 0xdd, 0x4e, 0x8b, 0x86, 0xf7, 0x5b, 0x85, 0x1d, 0x3f, 0xe3, 0x59, 0xe1, 0xf7,
+	0xfd, 0x98, 0x8e, 0x45, 0xf9, 0xf5, 0x56, 0xdd, 0x33, 0xe5, 0x1a, 0xf1, 0x5b, 0xe2, 0xbc, 0x59,
+	0xef, 0xfa, 0x02, 0xc4, 0xf0, 0x06, 0xca, 0x24, 0x0e, 0x2f, 0xec, 0xdd, 0x40, 0xf4, 0x18, 0x1a,
+	0x41, 0xee, 0xdd, 0x48, 0x91, 0x9b, 0xf9, 0xa1, 0xf1, 0xc2, 0x84, 0x76, 0x2e, 0xf9, 0x41, 0xfc,
+	0xf5, 0xd4, 0x3f, 0xcc, 0xc6, 0x66, 0x22, 0x6e, 0xa3, 0x1d, 0x68, 0x26, 0x92, 0x67, 0x94, 0xec,
+	0x3e, 0x67, 0x94, 0x67, 0x92, 0x5e, 0x17, 0x29, 0xd3, 0xc4, 0x57, 0xc2, 0xb8, 0x5f, 0x02, 0xdb,
+	0xbd, 0x19, 0x2c, 0x35, 0xdd, 0xbb, 0xe3, 0xa2, 0xe8, 0x8e, 0x02, 0x1a, 0xa9, 0x9b, 0xb1, 0x3e,
+	0x88, 0xf1, 0x53, 0x7f, 0x26, 0x03, 0x10, 0x2a, 0x31, 0xf9, 0x40, 0x34, 0x28, 0x5c, 0x26, 0xbc,
+	0x8a, 0x12, 0x81, 0x4c, 0x22, 0x51, 0xe0, 0xc8, 0x45, 0xc8, 0x63, 0xb0, 0x9b, 0x6c, 0x78, 0xf4,
+	0xbd, 0x6e, 0x5a, 0x86, 0x86, 0x50, 0x86, 0x95, 0xa2, 0x52, 0x20, 0x16, 0xdd, 0x2e, 0xb8, 0xe5,
+	0x3d, 0x0d, 0x13, 0xb5, 0xce, 0x8a, 0xdc, 0x99, 0x72, 0x9c, 0x33, 0xb7, 0xb3, 0x12, 0xbc, 0x4b,
+	0x8f, 0x44, 0x34, 0x8a, 0x16, 0x51, 0x7f, 0x28, 0x13, 0xeb, 0xdf, 0x23, 0x34, 0x2c, 0x76, 0xd5,
+	0xa7, 0xea, 0x6f, 0xe5, 0x60, 0xa4, 0x6a, 0x3b, 0x9e, 0x88, 0x1e, 0x74, 0xbc, 0x57, 0x7a, 0x69,
+	0x3f, 0x9a, 0xdf, 0xc3, 0x7e, 0xf4, 0x22, 0xe4, 0x25, 0xa7, 0x78, 0x7e, 0x73, 0x65, 0x18, 0x8e,
+	0x86, 0xd0, 0x2f, 0xf1, 0xc3, 0xa0, 0xe4, 0x35, 0xf5, 0xe0, 0x81, 0x9d, 0x41, 0xbe, 0x2a, 0x0b,
+	0xf0, 0xf6, 0x8b, 0x2f, 0x3e, 0xc2, 0x5d, 0xaa, 0x7e, 0x67, 0x06, 0x26, 0xc4, 0xe5, 0xaf, 0x14,
+	0x10, 0x72, 0xd0, 0xbf, 0xb6, 0x97, 0x67, 0x12, 0x0e, 0xd2, 0x7c, 0x1c, 0x33, 0x0c, 0x66, 0x1e,
+	0x98, 0x1e, 0xde, 0x7f, 0x49, 0x11, 0x21, 0xa9, 0x80, 0xc9, 0x86, 0x81, 0x4f, 0x47, 0x3e, 0xe0,
+	0x5f, 0x6b, 0xe7, 0x42, 0x6b, 0x88, 0x15, 0x98, 0x49, 0xbd, 0xda, 0x56, 0x7f, 0x34, 0x0f, 0xf9,
+	0x99, 0x07, 0xb4, 0x71, 0xcc, 0xbb, 0x46, 0x3a, 0x2c, 0xcf, 0x1f, 0xf0, 0xb0, 0x7c, 0x3f, 0x7e,
+	0x3a, 0x6f, 0x86, 0xfd, 0x39, 0x10, 0xad, 0x3e, 0xd6, 0xf3, 0xf1, 0xea, 0xfd, 0x9e, 0x3e, 0x7e,
+	0x6e, 0x5e, 0xbf, 0x98, 0x83, 0x5c, 0xad, 0x5c, 0x3d, 0xd1, 0x9b, 0x23, 0xd5, 0x9b, 0xde, 0x7e,
+	0x10, 0x6a, 0x70, 0xb5, 0x39, 0x14, 0x7a, 0x1e, 0xc7, 0x6e, 0x31, 0xff, 0x22, 0x07, 0xe3, 0xb5,
+	0xd9, 0xe5, 0xaa, 0x74, 0xbb, 0x70, 0x8b, 0x7b, 0x87, 0xa2, 0x9f, 0x22, 0xef, 0xd2, 0x8b, 0x09,
+	0xb3, 0xea, 0x76, 0xc5, 0xf2, 0x5e, 0x7d, 0x19, 0x03, 0x49, 0xe2, 0x81, 0x1c, 0xf7, 0x3f, 0x77,
+	0xcd, 0xf7, 0xe8, 0x17, 0x30, 0xd4, 0x88, 0xcf, 0x80, 0xbc, 0x0e, 0xb9, 0xdb, 0xc2, 0xcb, 0xa7,
+	0x1b, 0x9f, 0x97, 0xae, 0x73, 0x3e, 0x6c, 0x12, 0xcc, 0x75, 0x4c, 0x03, 0x39, 0xb0, 0x52, 0xac,
+	0xf0, 0x0d, 0x61, 0x32, 0xec, 0xaa, 0xf0, 0xaa, 0x5f, 0xf8, 0x46, 0x65, 0x9a, 0xd4, 0x60, 0xa4,
+	0x4a, 0x9d, 0x96, 0x89, 0x1d, 0xe5, 0xcf, 0xd9, 0xbd, 0x99, 0xb0, 0xfd, 0xeb, 0x48, 0x3b, 0x2c,
+	0x84, 0xcc, 0x64, 0x2e, 0xe4, 0x1d, 0x00, 0x6e, 0x55, 0xed, 0x32, 0xc8, 0xf0, 0xe3, 0xb8, 0x1b,
+	0xe4, 0x1b, 0x8e, 0x14, 0xcb, 0x5f, 0x62, 0x46, 0xd6, 0xa1, 0xb0, 0x60, 0x1b, 0xe6, 0x3d, 0x93,
+	0xbb, 0xf3, 0x62, 0x05, 0x03, 0x3b, 0x3b, 0xd1, 0xb1, 0x0d, 0x46, 0x4b, 0x2a, 0x97, 0x56, 0x4d,
+	0x82, 0xb1, 0xfa, 0xb3, 0xfd, 0x90, 0x67, 0xdd, 0x7e, 0x32, 0x7e, 0x0f, 0x32, 0x7e, 0x4b, 0x50,
+	0xb8, 0x6b, 0x3b, 0xeb, 0xa6, 0xb5, 0x1a, 0xbc, 0xce, 0x10, 0x27, 0x16, 0xe8, 0x1d, 0xb6, 0xc1,
+	0x71, 0xf5, 0xe0, 0x21, 0x87, 0x96, 0x20, 0xdf, 0x61, 0x04, 0xbf, 0x06, 0xc0, 0x43, 0x54, 0x20,
+	0xcd, 0x50, 0x18, 0x1e, 0x87, 0x07, 0xb0, 0xc0, 0x07, 0x1f, 0x72, 0x78, 0x9c, 0x90, 0x98, 0x5c,
+	0xf1, 0xfd, 0x6b, 0x86, 0xf1, 0xfd, 0x07, 0x1e, 0xcd, 0xa0, 0x7f, 0x8d, 0x6c, 0x04, 0x70, 0x4f,
+	0x9b, 0x2a, 0x80, 0x74, 0x67, 0x09, 0x31, 0x41, 0x44, 0x26, 0x07, 0x11, 0xdb, 0x32, 0xe5, 0xca,
+	0x52, 0x93, 0x78, 0x90, 0x57, 0x63, 0x4e, 0x15, 0x24, 0xc2, 0xad, 0xab, 0x4f, 0x45, 0xe8, 0x94,
+	0x37, 0xba, 0x93, 0x53, 0x9e, 0xfa, 0xfd, 0x39, 0x18, 0x61, 0xdc, 0x6a, 0x9d, 0x56, 0x4b, 0x77,
+	0x36, 0x4f, 0x14, 0xf9, 0x20, 0x8a, 0x5c, 0x87, 0x49, 0xf9, 0x11, 0x06, 0x33, 0x5d, 0xfd, 0x38,
+	0x69, 0xc1, 0x16, 0x3e, 0x4e, 0xc0, 0x6d, 0x4b, 0x9c, 0xf7, 0x3d, 0x01, 0xc6, 0x13, 0x27, 0x57,
+	0x4b, 0xf2, 0x52, 0xbf, 0x25, 0x03, 0x85, 0x38, 0x34, 0xd0, 0xfd, 0x4c, 0xaa, 0xee, 0x3f, 0x0f,
+	0xc3, 0xc2, 0x2d, 0x43, 0x37, 0x84, 0x97, 0xe8, 0xf8, 0xf6, 0x56, 0x11, 0x30, 0x2e, 0x40, 0xdd,
+	0xa1, 0xba, 0xa1, 0x85, 0x04, 0xe4, 0x15, 0x18, 0xc5, 0x1f, 0x77, 0x1d, 0xd3, 0xf3, 0x28, 0xef,
+	0x8c, 0x3c, 0xbf, 0x2b, 0xe2, 0x05, 0x36, 0x38, 0x42, 0x8b, 0x90, 0xa9, 0xbf, 0x92, 0x85, 0xe1,
+	0x5a, 0x67, 0xc5, 0xdd, 0x74, 0x3d, 0xda, 0x3a, 0xe6, 0x3a, 0xe4, 0x1f, 0x2b, 0xe4, 0x53, 0x8f,
+	0x15, 0x9e, 0xf6, 0x87, 0x96, 0x74, 0xa7, 0x11, 0x6c, 0x0c, 0x7c, 0x4f, 0xd7, 0x50, 0x8b, 0x06,
+	0xf6, 0xae, 0x45, 0xea, 0x3f, 0xcb, 0x42, 0x81, 0x3b, 0x04, 0x4c, 0x9b, 0x6e, 0xe3, 0x10, 0x1e,
+	0x29, 0x1d, 0xbd, 0x4c, 0x0f, 0xe6, 0x44, 0xb3, 0x8b, 0xa7, 0x5f, 0xea, 0xcf, 0x66, 0x61, 0xa4,
+	0xd4, 0xf1, 0xd6, 0x4a, 0x1e, 0xce, 0x6f, 0x8f, 0xe4, 0xb1, 0xc7, 0x81, 0x26, 0x2f, 0xf5, 0x97,
+	0x33, 0x3c, 0xbc, 0xf8, 0xb2, 0xbd, 0x4e, 0xad, 0x43, 0xb8, 0x50, 0x39, 0x8c, 0x63, 0x4c, 0xbf,
+	0x27, 0x72, 0x7b, 0xeb, 0x09, 0xbc, 0x06, 0xd4, 0xec, 0x26, 0x3d, 0xde, 0x9f, 0x71, 0x88, 0xd7,
+	0x80, 0xbe, 0x40, 0x0e, 0xe1, 0xda, 0xf9, 0xcb, 0x4b, 0x20, 0x87, 0x70, 0x9e, 0xfb, 0xe5, 0x21,
+	0x90, 0x5f, 0xc8, 0xc0, 0xf0, 0x94, 0xed, 0x1d, 0xf3, 0x81, 0x2f, 0xbe, 0xe2, 0x78, 0xab, 0xb9,
+	0xff, 0x15, 0xc7, 0x5b, 0x37, 0xd5, 0x6f, 0xcf, 0xc2, 0x69, 0x91, 0x02, 0x45, 0x9c, 0xa0, 0x9d,
+	0x4c, 0xc7, 0x62, 0xb0, 0x25, 0x45, 0x73, 0x32, 0x0f, 0x09, 0xd1, 0x7c, 0x6f, 0x0e, 0x4e, 0x63,
+	0x24, 0x71, 0xb6, 0x1f, 0xfb, 0x32, 0xb0, 0x45, 0x48, 0x23, 0xea, 0xdc, 0xb1, 0x90, 0xe2, 0xdc,
+	0xf1, 0x1f, 0xb6, 0x8a, 0xaf, 0xee, 0x21, 0x7b, 0xcc, 0xd5, 0x1a, 0xee, 0xb3, 0x18, 0x57, 0xdf,
+	0x2d, 0xc4, 0x05, 0xb8, 0x69, 0x9b, 0x96, 0xf0, 0xb4, 0xe6, 0x66, 0x72, 0x6d, 0x7b, 0xab, 0x78,
+	0xe6, 0x5d, 0xdb, 0xb4, 0xea, 0x71, 0x77, 0xeb, 0xbd, 0xd6, 0x17, 0xb2, 0xd6, 0xa4, 0x6a, 0xd4,
+	0xdf, 0xc9, 0xc0, 0xf9, 0xa8, 0x16, 0x7f, 0x39, 0xd8, 0x8e, 0x7f, 0x3f, 0x0b, 0x67, 0x6e, 0xa0,
+	0x70, 0x02, 0x07, 0xb5, 0x93, 0x79, 0x4b, 0x0c, 0xce, 0x14, 0xd9, 0x9c, 0x58, 0x94, 0xdd, 0x65,
+	0x73, 0x32, 0xa9, 0x0b, 0xd9, 0xfc, 0x7a, 0x06, 0x4e, 0x2d, 0x55, 0xa6, 0xcb, 0x5f, 0x26, 0x23,
+	0x2a, 0xf9, 0x3d, 0xc7, 0xdc, 0xe0, 0x4c, 0x7c, 0xcf, 0x31, 0x37, 0x3d, 0x3f, 0x97, 0x85, 0x53,
+	0xb5, 0xd2, 0xc2, 0xfc, 0x97, 0xcb, 0x0c, 0x5e, 0x96, 0xbd, 0xa9, 0xfd, 0x23, 0x34, 0x61, 0x0b,
+	0xc8, 0x9f, 0x79, 0xe7, 0x7a, 0x77, 0x2f, 0xeb, 0xa4, 0x50, 0x8e, 0xf9, 0xd4, 0x7d, 0x28, 0x42,
+	0x61, 0x9a, 0x1f, 0xa1, 0x3e, 0xe6, 0x9a, 0xff, 0x2f, 0x07, 0x60, 0xe4, 0x56, 0x67, 0x85, 0x0a,
+	0x87, 0xb0, 0x47, 0xfa, 0xdc, 0xf8, 0x3a, 0x8c, 0x08, 0x31, 0xe0, 0xfd, 0x88, 0x14, 0x22, 0x55,
+	0x84, 0x88, 0xe2, 0x91, 0xde, 0x64, 0x22, 0x72, 0x11, 0xf2, 0x77, 0xa8, 0xb3, 0x22, 0xbf, 0xb6,
+	0xbf, 0x4f, 0x9d, 0x15, 0x0d, 0xa1, 0x64, 0x3e, 0x7c, 0x0a, 0x54, 0xaa, 0x56, 0x30, 0x8f, 0x99,
+	0xb8, 0x72, 0xc4, 0xc4, 0x6c, 0x81, 0x53, 0xa9, 0xde, 0x36, 0x79, 0x06, 0x34, 0x39, 0xd2, 0x47,
+	0xbc, 0x24, 0x59, 0x84, 0xc9, 0x88, 0xb3, 0x29, 0x26, 0xf1, 0x1a, 0x4a, 0x61, 0x97, 0x96, 0xbe,
+	0x2b, 0x59, 0x94, 0xbc, 0x09, 0xa3, 0x3e, 0x10, 0xdd, 0x26, 0x87, 0xc3, 0xcc, 0x31, 0x01, 0xab,
+	0x58, 0x76, 0x8e, 0x48, 0x01, 0x99, 0x01, 0x5e, 0x81, 0x40, 0x0a, 0x83, 0x98, 0xab, 0x6f, 0xa4,
+	0x00, 0x79, 0x05, 0x19, 0xe0, 0xf3, 0x35, 0x74, 0xb7, 0x1a, 0xc1, 0xa7, 0xe8, 0x78, 0x7d, 0xe4,
+	0x08, 0x38, 0x0f, 0x38, 0x10, 0x21, 0x23, 0x4b, 0x00, 0xa1, 0x5b, 0x8c, 0x08, 0xeb, 0xb2, 0x67,
+	0x87, 0x1d, 0x89, 0x85, 0x7c, 0x0f, 0x38, 0xb6, 0x9f, 0x7b, 0x40, 0xf5, 0x5b, 0x73, 0x30, 0x52,
+	0x6a, 0xb7, 0x83, 0xa1, 0xf0, 0x01, 0x18, 0x28, 0xb5, 0xdb, 0xb7, 0xb5, 0x8a, 0x9c, 0x8e, 0x43,
+	0x6f, 0xb7, 0xeb, 0x1d, 0xc7, 0x94, 0x7d, 0xdd, 0x39, 0x11, 0x29, 0xc3, 0x58, 0xa9, 0xdd, 0xae,
+	0x76, 0x56, 0x9a, 0x66, 0x43, 0x4a, 0x4c, 0xc8, 0x53, 0xe4, 0xb6, 0xdb, 0xf5, 0x36, 0x62, 0xe2,
+	0xd9, 0x29, 0xa3, 0x65, 0xc8, 0xa7, 0x30, 0x18, 0x9a, 0xc8, 0x8b, 0xc7, 0x33, 0x6f, 0xa9, 0x41,
+	0x22, 0x8e, 0xb0, 0x6d, 0x57, 0x03, 0x22, 0x9e, 0xb0, 0xe4, 0xa2, 0x9f, 0x66, 0x86, 0x55, 0x94,
+	0xc8, 0x7f, 0x17, 0xb2, 0x24, 0x2f, 0xc0, 0x60, 0xa9, 0xdd, 0x96, 0xee, 0xba, 0xd0, 0x2d, 0x8e,
+	0x95, 0x8a, 0xa7, 0x78, 0x15, 0x64, 0xe2, 0xb3, 0xc4, 0xed, 0xb8, 0xed, 0x78, 0x38, 0xa4, 0xc6,
+	0xc2, 0xcf, 0xf2, 0xaf, 0xd3, 0x6d, 0x39, 0xfe, 0x90, 0x16, 0x2d, 0x73, 0xe1, 0x0d, 0x18, 0x8f,
+	0xb6, 0x78, 0x4f, 0x59, 0x53, 0xfe, 0x2a, 0x83, 0x52, 0x39, 0xe6, 0x0f, 0x3e, 0x5e, 0x82, 0x5c,
+	0xa9, 0xdd, 0x16, 0x93, 0xda, 0xa9, 0x94, 0x4e, 0x8d, 0x47, 0x97, 0x28, 0xb5, 0xdb, 0xfe, 0xa7,
+	0x1f, 0xf3, 0x97, 0x63, 0xfb, 0xfa, 0xf4, 0x5f, 0xe0, 0x9f, 0x7e, 0xbc, 0x5f, 0x75, 0xa9, 0x3f,
+	0x9a, 0x83, 0x89, 0x52, 0xbb, 0x7d, 0x92, 0x22, 0xe5, 0xb0, 0x62, 0x58, 0xbc, 0x08, 0x20, 0xcd,
+	0xb1, 0x83, 0xc1, 0xbb, 0xd6, 0x11, 0x69, 0x7e, 0x55, 0x32, 0x9a, 0x44, 0xe4, 0xab, 0xdf, 0xd0,
+	0x9e, 0xd4, 0xef, 0xab, 0x73, 0x38, 0xf1, 0x1d, 0xf7, 0x78, 0x7c, 0x0f, 0x4b, 0xb7, 0x89, 0x3e,
+	0x18, 0xd8, 0x53, 0x1f, 0xfc, 0x7c, 0x64, 0xf0, 0x60, 0x4e, 0x8c, 0x93, 0x5e, 0xe8, 0x3f, 0x90,
+	0x6d, 0x3d, 0x2e, 0x0b, 0x53, 0x04, 0x09, 0xf3, 0x93, 0x21, 0x8a, 0x90, 0x75, 0x0d, 0x86, 0xaa,
+	0x9b, 0x86, 0x16, 0xa3, 0xf5, 0xfb, 0x70, 0x70, 0x4f, 0x7d, 0xb8, 0x95, 0xc5, 0xb0, 0x14, 0x41,
+	0xc8, 0xbb, 0x83, 0x6f, 0x51, 0xae, 0x01, 0x70, 0xe7, 0x87, 0xc0, 0xbb, 0x7f, 0x8c, 0x47, 0xb7,
+	0xe2, 0x39, 0x12, 0x45, 0x74, 0xab, 0x90, 0x24, 0x70, 0x96, 0xca, 0xa5, 0x3a, 0x4b, 0x5d, 0x81,
+	0x21, 0x4d, 0xdf, 0xf8, 0x58, 0x87, 0x8a, 0xa7, 0x50, 0x7e, 0x44, 0x59, 0x7d, 0xa3, 0xfe, 0x69,
+	0x06, 0xd4, 0x02, 0x34, 0x51, 0x83, 0xb8, 0x26, 0x92, 0x53, 0x0a, 0x3f, 0x68, 0x0f, 0xa2, 0x99,
+	0xec, 0x47, 0xd1, 0xc9, 0x87, 0x21, 0x57, 0xba, 0x5b, 0x13, 0x92, 0x0d, 0xba, 0xb6, 0x74, 0xb7,
+	0x26, 0xe4, 0xd5, 0xb5, 0xec, 0xdd, 0x9a, 0xfa, 0xd5, 0x59, 0x20, 0x49, 0x4a, 0xf2, 0x2a, 0x0c,
+	0x23, 0x74, 0x95, 0xe9, 0x8c, 0x9c, 0x5c, 0x7b, 0xc3, 0xad, 0x3b, 0x08, 0x8d, 0x58, 0x88, 0x3e,
+	0x29, 0x79, 0x0d, 0xa0, 0x74, 0xb7, 0x26, 0xd2, 0xbb, 0x46, 0x92, 0x6b, 0x6f, 0xb8, 0x75, 0x91,
+	0x5d, 0x36, 0xe2, 0xba, 0x18, 0x10, 0xa3, 0x71, 0x79, 0xb7, 0x36, 0x67, 0xbb, 0x9e, 0x10, 0x35,
+	0x37, 0x2e, 0x37, 0x5c, 0xcc, 0xea, 0x1e, 0x31, 0x2e, 0x39, 0x19, 0x66, 0xa6, 0xbc, 0x5b, 0xe3,
+	0x6f, 0xf8, 0x0c, 0xcd, 0x0e, 0xb2, 0x40, 0xf2, 0xcc, 0x94, 0x1b, 0x6e, 0x9d, 0xbf, 0xff, 0x33,
+	0x30, 0x6f, 0x7f, 0x24, 0x33, 0x65, 0xa4, 0x94, 0xfa, 0x8d, 0x43, 0x50, 0x98, 0xd6, 0x3d, 0x7d,
+	0x45, 0x77, 0xa9, 0xb4, 0x25, 0x9f, 0xf0, 0x61, 0xfe, 0xe7, 0x48, 0x72, 0x30, 0x56, 0x52, 0xbe,
+	0x26, 0x5e, 0x80, 0xbc, 0x1e, 0xf2, 0x0d, 0xf2, 0x86, 0xcb, 0x89, 0x48, 0x57, 0xea, 0x6d, 0x01,
+	0xd6, 0x12, 0x84, 0xe4, 0x79, 0x18, 0xf1, 0x61, 0x6c, 0x17, 0x91, 0x0b, 0x75, 0xc6, 0x58, 0x61,
+	0x9b, 0x08, 0x4d, 0x46, 0x93, 0xd7, 0x60, 0xd4, 0xff, 0x29, 0xd9, 0xe7, 0x3c, 0xab, 0xea, 0x4a,
+	0x62, 0x0b, 0x26, 0x93, 0xca, 0x45, 0x71, 0x7e, 0xeb, 0x8f, 0x14, 0x8d, 0x25, 0x2e, 0x8d, 0x90,
+	0x92, 0x4f, 0xc3, 0xb8, 0xff, 0x5b, 0xec, 0x3a, 0xb8, 0xef, 0xe2, 0xf3, 0xbe, 0x12, 0xc6, 0xc5,
+	0x7a, 0x35, 0x4a, 0xce, 0xf7, 0x1f, 0x8f, 0xf9, 0x09, 0x34, 0x8d, 0x95, 0xe4, 0xf6, 0x23, 0x56,
+	0x01, 0xa9, 0xc0, 0xa4, 0x0f, 0x09, 0x35, 0x74, 0x30, 0xdc, 0x76, 0x1a, 0x2b, 0xf5, 0x54, 0x25,
+	0x4d, 0x96, 0x22, 0x4d, 0xb8, 0x18, 0x01, 0x1a, 0xee, 0x9a, 0x79, 0xcf, 0x13, 0x7b, 0x46, 0x11,
+	0x12, 0x5e, 0x24, 0x5f, 0x0e, 0xb8, 0x72, 0x1a, 0x3f, 0x8b, 0x7a, 0x34, 0x80, 0x4d, 0x4f, 0x6e,
+	0xa4, 0x06, 0xa7, 0x7d, 0xfc, 0x8d, 0x72, 0xb5, 0xea, 0xd8, 0xef, 0xd2, 0x86, 0x57, 0x99, 0x16,
+	0x7b, 0x6e, 0x0c, 0xfb, 0x69, 0xac, 0xd4, 0x57, 0x1b, 0x6d, 0xa6, 0x14, 0x0c, 0x17, 0x65, 0x9e,
+	0x5a, 0x98, 0xdc, 0x81, 0x33, 0x12, 0xbc, 0x62, 0xb9, 0x9e, 0x6e, 0x35, 0x68, 0x10, 0x6e, 0x07,
+	0x0f, 0x05, 0x04, 0x57, 0x53, 0x20, 0xa3, 0x6c, 0xd3, 0x8b, 0x93, 0x37, 0x60, 0xcc, 0x47, 0xf0,
+	0xab, 0xc8, 0x11, 0xbc, 0x8a, 0xc4, 0x21, 0x69, 0xac, 0xd4, 0xe3, 0x4f, 0xcd, 0xa3, 0xc4, 0xb2,
+	0x46, 0x2d, 0x6f, 0xb6, 0xfd, 0xe0, 0xf5, 0xbe, 0x46, 0x79, 0x9b, 0xed, 0x54, 0x65, 0x64, 0xa4,
+	0xe4, 0xcd, 0x50, 0xa3, 0x96, 0x1c, 0x73, 0xd5, 0xf4, 0x93, 0xa3, 0x9d, 0x13, 0xfa, 0x61, 0x23,
+	0x30, 0x4d, 0x3f, 0x38, 0xf9, 0x85, 0x12, 0x9c, 0x4a, 0xd1, 0xb1, 0x3d, 0xed, 0x18, 0x3f, 0x93,
+	0x0d, 0x1b, 0x71, 0xcc, 0xb7, 0x8d, 0x53, 0x30, 0xe4, 0x7f, 0x89, 0x30, 0x1e, 0x94, 0x6e, 0x43,
+	0x33, 0xce, 0xc3, 0xc7, 0x47, 0xc4, 0x71, 0xcc, 0xb7, 0x92, 0x87, 0x21, 0x8e, 0x2f, 0x66, 0x42,
+	0x71, 0x1c, 0xf3, 0xed, 0xe5, 0x2f, 0xe7, 0xc3, 0x39, 0xe9, 0x64, 0x8f, 0x79, 0x58, 0x66, 0x72,
+	0xe8, 0x8a, 0x3b, 0xb0, 0x07, 0x57, 0x5c, 0x59, 0x35, 0x07, 0xf7, 0xa7, 0x9a, 0xe4, 0x0d, 0x18,
+	0xa9, 0xda, 0xae, 0xb7, 0xea, 0x50, 0xb7, 0x1a, 0xa4, 0x34, 0xc1, 0xd7, 0xeb, 0x6d, 0x01, 0xae,
+	0xb7, 0xa3, 0x21, 0xd7, 0x24, 0x72, 0x29, 0x12, 0xdd, 0xf0, 0xde, 0x23, 0xd1, 0xa9, 0xbf, 0x9f,
+	0x4b, 0xe8, 0x12, 0x37, 0x7b, 0x8f, 0xa5, 0x2e, 0x1d, 0xc2, 0x44, 0x41, 0xae, 0x87, 0x6b, 0x28,
+	0xdf, 0x1f, 0xf4, 0x4b, 0x91, 0x5b, 0x57, 0xc4, 0xf6, 0x20, 0x4a, 0x42, 0x3e, 0x01, 0xe7, 0x22,
+	0x80, 0xaa, 0xee, 0xe8, 0x2d, 0xea, 0x85, 0x69, 0x7f, 0x31, 0x16, 0x9f, 0x5f, 0xba, 0xde, 0x0e,
+	0xd0, 0x72, 0x2a, 0xe1, 0x2e, 0x1c, 0x24, 0xc5, 0x1c, 0xdc, 0xc3, 0x3b, 0xea, 0x6f, 0xcb, 0x85,
+	0x66, 0x52, 0x34, 0xa6, 0xb6, 0x46, 0xdd, 0x4e, 0xd3, 0x7b, 0x74, 0x3b, 0x78, 0x7f, 0x59, 0x8e,
+	0xe6, 0x60, 0xa2, 0x74, 0xef, 0x1e, 0x6d, 0x78, 0x7e, 0xaa, 0x00, 0x57, 0x44, 0x51, 0xe5, 0xdb,
+	0x16, 0x81, 0x12, 0xa1, 0xdf, 0xdd, 0x48, 0x22, 0xe6, 0x68, 0x31, 0xf5, 0x0f, 0xf2, 0xa0, 0x04,
+	0xdb, 0x86, 0xe0, 0xad, 0xe4, 0x11, 0x2e, 0xd1, 0x0f, 0x45, 0xaf, 0x98, 0x30, 0x19, 0x0a, 0x43,
+	0x3c, 0x52, 0x53, 0xfa, 0x71, 0x5b, 0x52, 0x8c, 0x33, 0x0b, 0x09, 0xf9, 0x4e, 0xe4, 0x82, 0xd8,
+	0x89, 0x90, 0xf0, 0x2d, 0x6a, 0xdd, 0xe5, 0x2c, 0xb4, 0x24, 0x57, 0xf2, 0x4d, 0x19, 0x38, 0xed,
+	0x77, 0xca, 0xd2, 0x0a, 0x33, 0xc9, 0xcb, 0x76, 0xc7, 0x0a, 0x5e, 0x70, 0x7d, 0xb8, 0x7b, 0x75,
+	0xbc, 0x93, 0xae, 0xa6, 0x15, 0xe6, 0x2d, 0x09, 0x22, 0xfe, 0x04, 0x0a, 0x61, 0x23, 0x4d, 0xbd,
+	0x81, 0x44, 0x5a, 0x6a, 0xbd, 0x17, 0x6e, 0xc0, 0xf9, 0xae, 0x2c, 0x77, 0x32, 0x81, 0xfb, 0x65,
+	0x13, 0xf8, 0xf7, 0x32, 0xe1, 0x44, 0x14, 0x13, 0x12, 0xb9, 0x0a, 0x10, 0x82, 0xc4, 0xa6, 0x18,
+	0x1f, 0x88, 0x85, 0x42, 0xd3, 0x24, 0x0a, 0xb2, 0x04, 0x03, 0x42, 0x2c, 0x3c, 0xc5, 0xfe, 0xfb,
+	0x77, 0xe8, 0x85, 0xab, 0xb2, 0x1c, 0x70, 0xc3, 0x2b, 0xbe, 0x59, 0xb0, 0xb9, 0xf0, 0x1a, 0x8c,
+	0xec, 0xf7, 0xbb, 0xbe, 0x29, 0x07, 0x44, 0xde, 0xc1, 0x1e, 0xa1, 0x79, 0x7f, 0x8c, 0xa7, 0xb0,
+	0xcb, 0x30, 0xc4, 0x3e, 0x01, 0xd3, 0x18, 0x49, 0x61, 0xcb, 0x3b, 0x02, 0xa6, 0x05, 0xd8, 0x30,
+	0xea, 0xdf, 0x60, 0x7a, 0xd4, 0x3f, 0xf5, 0x5b, 0x72, 0x70, 0x56, 0xee, 0x90, 0x69, 0x8a, 0x99,
+	0x50, 0x4e, 0x3a, 0xe5, 0x4b, 0xd8, 0x29, 0x2a, 0x0c, 0xf0, 0x8d, 0x8b, 0x48, 0x49, 0xc3, 0x0f,
+	0x95, 0x10, 0xa2, 0x09, 0x8c, 0xfa, 0xaf, 0xb3, 0x30, 0x16, 0x18, 0x87, 0xba, 0xe3, 0x3e, 0xc2,
+	0xdd, 0xf1, 0x21, 0x18, 0xc3, 0xb8, 0x6d, 0x2d, 0x6a, 0xf1, 0xd8, 0x66, 0xfd, 0x52, 0x0e, 0x29,
+	0x1f, 0x21, 0x52, 0x0c, 0x46, 0x08, 0x99, 0xf6, 0x73, 0xcb, 0x4f, 0x8a, 0xa6, 0xc7, 0xcd, 0x3e,
+	0x0e, 0x57, 0xbf, 0x3b, 0x07, 0xa3, 0xbe, 0x94, 0xa7, 0xcc, 0xe3, 0x7a, 0x4b, 0x74, 0xb4, 0x42,
+	0xbe, 0x06, 0x50, 0xb5, 0x1d, 0x4f, 0x6f, 0x2e, 0x86, 0x9a, 0x8f, 0xc7, 0xab, 0x6d, 0x84, 0xf2,
+	0x32, 0x12, 0x09, 0xae, 0x5f, 0xa1, 0x59, 0xcd, 0x27, 0x26, 0xbe, 0x7e, 0x05, 0x50, 0x4d, 0xa2,
+	0x50, 0x7f, 0x2a, 0x0b, 0x13, 0x7e, 0x27, 0xcd, 0x3c, 0xa0, 0x8d, 0xce, 0xa3, 0x3c, 0x37, 0x45,
+	0xa5, 0xdd, 0xbf, 0xa3, 0xb4, 0xd5, 0xff, 0x5b, 0x9a, 0x48, 0xca, 0x4d, 0xfb, 0x64, 0x22, 0xf9,
+	0xeb, 0xd0, 0x71, 0xf5, 0x6b, 0x72, 0x70, 0xda, 0x97, 0xfa, 0x6c, 0xc7, 0xc2, 0x83, 0x89, 0xb2,
+	0xde, 0x6c, 0x3e, 0xca, 0xbb, 0xf1, 0x11, 0x5f, 0x10, 0x4b, 0x22, 0x10, 0xaa, 0x48, 0xf7, 0x7a,
+	0x4f, 0x80, 0xeb, 0xb6, 0x69, 0x68, 0x32, 0x11, 0x79, 0x13, 0x46, 0xfd, 0x9f, 0x25, 0x67, 0xd5,
+	0xdf, 0x82, 0xe3, 0x35, 0x43, 0x50, 0x48, 0x77, 0x22, 0x91, 0x3d, 0x22, 0x05, 0xd4, 0xef, 0xcc,
+	0xc1, 0x85, 0xbb, 0xa6, 0x65, 0xd8, 0x1b, 0x6e, 0x99, 0x3a, 0x1e, 0x0f, 0x05, 0x43, 0xe5, 0x70,
+	0x64, 0xb5, 0x0e, 0xda, 0xe9, 0x72, 0x38, 0x32, 0x97, 0x83, 0x34, 0x1f, 0x47, 0x5e, 0x81, 0xd1,
+	0x1a, 0x75, 0x4c, 0xbd, 0xb9, 0xd8, 0x69, 0xad, 0x50, 0xdf, 0x35, 0x0c, 0x7d, 0xe4, 0x5c, 0x84,
+	0xd7, 0x2d, 0x44, 0x68, 0x11, 0x32, 0x72, 0x1e, 0x72, 0xb7, 0xab, 0x8b, 0xe2, 0xe2, 0x08, 0xf3,
+	0x80, 0x75, 0xda, 0x96, 0xc6, 0x60, 0xe4, 0x63, 0x70, 0xa6, 0xac, 0xcd, 0x4f, 0x9b, 0x2e, 0x0f,
+	0x1c, 0x62, 0xda, 0x56, 0xd5, 0x36, 0x99, 0x85, 0x9e, 0x0f, 0xbf, 0xb0, 0xe1, 0x34, 0xeb, 0x86,
+	0x44, 0x51, 0x6f, 0x23, 0x89, 0x96, 0x5e, 0x92, 0x5c, 0x81, 0xa1, 0x5b, 0x74, 0xf3, 0x36, 0x26,
+	0xea, 0xea, 0x47, 0x27, 0x3e, 0xbc, 0x08, 0x5d, 0xa7, 0x9b, 0xf5, 0x0e, 0x03, 0x6a, 0x01, 0x9a,
+	0x4c, 0x41, 0x61, 0xe6, 0x81, 0x47, 0x2d, 0x83, 0x1a, 0x41, 0x11, 0x26, 0xda, 0x7e, 0x3f, 0xcc,
+	0x1a, 0xc7, 0xd5, 0xc3, 0xb2, 0x09, 0x7a, 0xe4, 0x21, 0x12, 0xee, 0x05, 0x3c, 0x06, 0xc3, 0x3b,
+	0x8a, 0x20, 0x41, 0x9f, 0xcc, 0x23, 0x46, 0xaf, 0xfe, 0xe1, 0x60, 0xd0, 0x3b, 0x7e, 0x2e, 0xe7,
+	0x63, 0x7f, 0x08, 0x7a, 0xd4, 0x39, 0x9c, 0x3f, 0x06, 0x67, 0xe2, 0x22, 0x75, 0x82, 0x6c, 0x19,
+	0x42, 0xb3, 0x36, 0x38, 0x41, 0xdd, 0x4f, 0x64, 0x2c, 0x6e, 0x52, 0xb5, 0xf4, 0x92, 0xf1, 0xb4,
+	0xd0, 0x83, 0xbb, 0x49, 0x0b, 0xfd, 0x1c, 0x0c, 0x4c, 0xdb, 0x2d, 0xdd, 0xf4, 0x23, 0x70, 0xe1,
+	0x1c, 0x1b, 0xd4, 0x8b, 0x18, 0x4d, 0x50, 0x30, 0xfe, 0xa2, 0x62, 0xec, 0x32, 0x29, 0x29, 0xbd,
+	0x5f, 0x80, 0xd9, 0xd0, 0x9a, 0x4c, 0x44, 0x6c, 0x18, 0x13, 0xd5, 0x89, 0x7b, 0x4f, 0xc0, 0xad,
+	0xed, 0x2b, 0xbe, 0x8c, 0xba, 0xab, 0xd5, 0xd5, 0x48, 0x39, 0xbe, 0xc9, 0xe5, 0xd9, 0xaa, 0xc5,
+	0xc7, 0xf0, 0x1b, 0x50, 0x2d, 0xca, 0x3f, 0x9e, 0x0e, 0x7a, 0x64, 0x17, 0xe9, 0xa0, 0xc9, 0x0c,
+	0x4c, 0x62, 0x56, 0x82, 0x60, 0xa3, 0xcb, 0x54, 0x62, 0x14, 0x4d, 0x7e, 0xbc, 0x4e, 0xe3, 0x89,
+	0x0c, 0xd8, 0xc7, 0xd5, 0x1b, 0x02, 0xad, 0x25, 0x4b, 0xb0, 0x79, 0x64, 0x71, 0xbe, 0x84, 0xf7,
+	0x70, 0x43, 0x7c, 0x1e, 0xb1, 0x9a, 0xba, 0xc6, 0x60, 0xe4, 0x2e, 0x8c, 0xb2, 0x79, 0x2d, 0x18,
+	0x26, 0xe3, 0xa8, 0x29, 0x6a, 0x4c, 0x0a, 0x29, 0x53, 0x1f, 0x5f, 0xbd, 0x1a, 0x21, 0x42, 0x8b,
+	0x30, 0xba, 0xf0, 0x16, 0x90, 0xa4, 0x9c, 0xf6, 0x74, 0x89, 0xf7, 0x9b, 0xf9, 0x70, 0xa7, 0x7f,
+	0xdc, 0xdd, 0xb0, 0x0e, 0x63, 0xfd, 0x8b, 0xe4, 0x08, 0xed, 0xff, 0x52, 0xe6, 0x08, 0x1d, 0x38,
+	0xdc, 0x1c, 0xa1, 0xd1, 0x19, 0x6d, 0xf0, 0x00, 0x33, 0xda, 0x47, 0x53, 0x93, 0xab, 0xf2, 0xfb,
+	0x11, 0x09, 0x2e, 0xaf, 0xe6, 0x32, 0xbd, 0xfa, 0x83, 0x19, 0x98, 0x4c, 0x24, 0x27, 0x21, 0x2f,
+	0x01, 0x70, 0x88, 0x14, 0xa0, 0x18, 0xe3, 0x67, 0x85, 0x09, 0x4b, 0x84, 0x7d, 0x16, 0x92, 0x91,
+	0x6b, 0x30, 0xc4, 0x7f, 0x89, 0x10, 0x7d, 0xc9, 0x22, 0x9d, 0x8e, 0x69, 0x68, 0x01, 0x51, 0x58,
+	0x0b, 0x5e, 0xa8, 0xe7, 0x52, 0x8b, 0x78, 0x9b, 0xed, 0xa0, 0x16, 0x46, 0xa6, 0x7e, 0x63, 0x16,
+	0x46, 0x83, 0x06, 0x97, 0x8c, 0xa3, 0xd2, 0xfe, 0x01, 0x91, 0xe7, 0x25, 0xb7, 0x53, 0x9e, 0x97,
+	0xd8, 0x92, 0x22, 0x12, 0xbb, 0x1c, 0xde, 0xa3, 0xc2, 0xcf, 0x66, 0x61, 0x22, 0xa8, 0xf5, 0x08,
+	0xef, 0x6e, 0x1f, 0x22, 0x91, 0x7c, 0x53, 0x06, 0x94, 0x29, 0xb3, 0xd9, 0x34, 0xad, 0xd5, 0x8a,
+	0x75, 0xcf, 0x76, 0x5a, 0x38, 0xe7, 0x1f, 0xdd, 0x1d, 0x82, 0xfa, 0x75, 0x19, 0x98, 0x14, 0x0d,
+	0x2a, 0xeb, 0x8e, 0x71, 0x74, 0x07, 0xb4, 0xf1, 0x96, 0x1c, 0x9d, 0xbe, 0xa8, 0x3f, 0x91, 0x05,
+	0x98, 0xb7, 0x1b, 0xeb, 0xc7, 0xfc, 0x4d, 0xe2, 0xeb, 0x30, 0xc0, 0x5f, 0x75, 0x08, 0x8d, 0x9d,
+	0x14, 0x6f, 0xef, 0xd8, 0xa7, 0x71, 0xc4, 0x54, 0x41, 0xac, 0x0c, 0x03, 0xfc, 0x61, 0x88, 0x92,
+	0xd1, 0x44, 0x11, 0x56, 0x29, 0xa3, 0x13, 0x4b, 0x57, 0x50, 0x29, 0x83, 0x45, 0x2b, 0xdd, 0xde,
+	0x2a, 0xe6, 0x9b, 0x76, 0x63, 0x5d, 0x43, 0x7a, 0xf5, 0xff, 0xcb, 0x70, 0xd9, 0x1d, 0xf3, 0x97,
+	0xd5, 0xfe, 0xe7, 0xe7, 0xf7, 0xf8, 0xf9, 0x7f, 0x27, 0x03, 0xa7, 0x35, 0xda, 0xb0, 0xef, 0x53,
+	0x67, 0xb3, 0x6c, 0x1b, 0xf4, 0x06, 0xb5, 0xa8, 0x73, 0x54, 0x23, 0xea, 0xa7, 0x31, 0x31, 0x56,
+	0xd8, 0x98, 0xdb, 0x2e, 0x35, 0x8e, 0x4f, 0xd2, 0x32, 0xf5, 0x3f, 0x0d, 0x82, 0x92, 0x6a, 0xd8,
+	0x1f, 0x5b, 0xc3, 0xb2, 0xeb, 0x6e, 0x2d, 0x7f, 0x58, 0xbb, 0xb5, 0xfe, 0xbd, 0xed, 0xd6, 0x06,
+	0xf6, 0xba, 0x5b, 0x1b, 0xdc, 0xcd, 0x6e, 0xad, 0x15, 0xdf, 0xad, 0x0d, 0xe1, 0x6e, 0xed, 0xa5,
+	0x9e, 0xbb, 0xb5, 0x19, 0xcb, 0xd8, 0xe7, 0x5e, 0xed, 0xd8, 0xa6, 0xe3, 0xdf, 0xcf, 0x26, 0xf3,
+	0x32, 0x9b, 0x14, 0x1b, 0xb6, 0x63, 0x50, 0x43, 0xec, 0x2d, 0xf1, 0xda, 0xc9, 0x11, 0x30, 0x2d,
+	0xc0, 0x92, 0x97, 0x63, 0xe6, 0x37, 0x4f, 0x9c, 0x8f, 0xec, 0x65, 0xf3, 0x3b, 0x6a, 0x74, 0xc7,
+	0x4c, 0x9d, 0xf1, 0xfd, 0x9b, 0x3a, 0x87, 0xb0, 0xa7, 0xfc, 0xf7, 0x59, 0x98, 0x94, 0x36, 0xb3,
+	0x87, 0xb0, 0x1c, 0x97, 0x60, 0x42, 0x62, 0x88, 0xb6, 0x7d, 0x36, 0xf4, 0x77, 0x65, 0xfb, 0xe3,
+	0xb8, 0xbb, 0x6c, 0x9c, 0x9e, 0x55, 0xef, 0x67, 0x2a, 0x15, 0xb3, 0x40, 0x50, 0xbd, 0x0f, 0xe7,
+	0x5d, 0x62, 0x8a, 0x5f, 0x5a, 0x40, 0x2f, 0xb9, 0x7c, 0xe5, 0xf7, 0x91, 0x7c, 0x74, 0x1d, 0x4e,
+	0x4b, 0x8d, 0x29, 0x75, 0xbc, 0x35, 0xdb, 0x61, 0xad, 0xe8, 0x17, 0x11, 0xbf, 0x7d, 0x5e, 0x29,
+	0x34, 0x22, 0xa7, 0x62, 0x88, 0xa9, 0xeb, 0x3e, 0x4a, 0x4b, 0x65, 0xca, 0x36, 0x5f, 0xa9, 0x08,
+	0x72, 0x09, 0xf2, 0x28, 0x37, 0x29, 0xb1, 0x62, 0x4c, 0x64, 0x88, 0x27, 0xcf, 0x07, 0x93, 0x4c,
+	0x36, 0x7c, 0xb5, 0xc2, 0x27, 0x17, 0xf9, 0x3d, 0xae, 0x98, 0x66, 0xde, 0x82, 0x51, 0x71, 0xfc,
+	0x7a, 0x8b, 0x6e, 0x06, 0xd9, 0x53, 0x30, 0x11, 0x90, 0x38, 0x9f, 0xc5, 0xa3, 0xc5, 0x88, 0x37,
+	0x5d, 0xa4, 0x84, 0xfa, 0x03, 0x19, 0xb8, 0xa4, 0x51, 0x8b, 0x6e, 0xe8, 0x2b, 0x4d, 0x2a, 0xb5,
+	0x5c, 0xac, 0xc0, 0x4c, 0x67, 0x4d, 0xb7, 0xa5, 0x7b, 0x8d, 0xb5, 0x03, 0x69, 0xd0, 0x2c, 0x8c,
+	0xca, 0xeb, 0xc4, 0x1e, 0xd6, 0x90, 0x48, 0x39, 0xf5, 0x47, 0xf2, 0x30, 0x38, 0x65, 0x7b, 0x37,
+	0xed, 0x03, 0xe6, 0x0a, 0x0e, 0x97, 0xd6, 0xec, 0x1e, 0x8e, 0x0d, 0x5f, 0xc0, 0xca, 0xa5, 0xe4,
+	0x3c, 0x78, 0x8a, 0xbb, 0x62, 0x27, 0x12, 0x45, 0xf9, 0x64, 0x7b, 0xcc, 0x12, 0xfc, 0x2a, 0x0c,
+	0x63, 0xa4, 0x29, 0xe9, 0xda, 0x05, 0xdf, 0x71, 0x78, 0x0c, 0x18, 0xaf, 0x23, 0x24, 0x25, 0x9f,
+	0x88, 0x44, 0xe8, 0x1e, 0x38, 0x78, 0x56, 0x61, 0x39, 0x58, 0xf7, 0x4b, 0xfc, 0xc6, 0x1e, 0xdb,
+	0x24, 0xe5, 0x50, 0xc3, 0x03, 0xb9, 0x58, 0x93, 0x02, 0xc2, 0x43, 0xcc, 0xf8, 0x5b, 0x86, 0xb1,
+	0x29, 0xdb, 0x93, 0xde, 0x0c, 0x0c, 0x87, 0x4f, 0xce, 0x99, 0xe4, 0xd3, 0x1f, 0x0c, 0x44, 0xcb,
+	0xa8, 0x7f, 0x91, 0x87, 0x51, 0xff, 0xe7, 0x11, 0xe9, 0xce, 0x07, 0x60, 0x60, 0xce, 0x96, 0x52,
+	0x1c, 0xe1, 0x3b, 0x83, 0x35, 0xdb, 0x8d, 0x3d, 0xa0, 0x10, 0x44, 0x4c, 0xea, 0x8b, 0xb6, 0x21,
+	0xbf, 0x92, 0x41, 0xa9, 0x5b, 0xb6, 0x91, 0x08, 0x55, 0x10, 0x10, 0xb2, 0x49, 0x06, 0x1f, 0x18,
+	0x49, 0x37, 0x76, 0xb1, 0x47, 0x45, 0x88, 0x97, 0xb4, 0x72, 0x60, 0xaf, 0x5a, 0x39, 0xb8, 0x5f,
+	0xad, 0x1c, 0x3a, 0x5c, 0xad, 0x7c, 0x07, 0x46, 0xb1, 0x26, 0x3f, 0x0b, 0xed, 0xce, 0x06, 0xcc,
+	0x79, 0x61, 0x63, 0x8c, 0xf1, 0x76, 0x8b, 0x5c, 0xb4, 0x68, 0x5a, 0x44, 0x58, 0xc5, 0x74, 0x17,
+	0x0e, 0x70, 0x6c, 0xf1, 0xfb, 0x19, 0x18, 0xbc, 0x6d, 0xad, 0x5b, 0xf6, 0xc6, 0xc1, 0x34, 0xee,
+	0x25, 0x18, 0x11, 0x6c, 0xa4, 0xb5, 0x17, 0x6f, 0xd6, 0x3a, 0x1c, 0x5c, 0x47, 0x4e, 0x9a, 0x4c,
+	0x45, 0xde, 0x08, 0x0a, 0xe1, 0x1b, 0xc2, 0x5c, 0x98, 0x24, 0xcc, 0x2f, 0xd4, 0x88, 0x66, 0x09,
+	0x92, 0xc9, 0xc9, 0x45, 0xc8, 0x4f, 0xb3, 0xa6, 0x4a, 0xd1, 0xc2, 0x59, 0x53, 0x34, 0x84, 0xaa,
+	0x9f, 0xc9, 0xc3, 0x78, 0xec, 0x80, 0xf1, 0x39, 0x18, 0x16, 0x07, 0x7c, 0xa6, 0x9f, 0xb6, 0x08,
+	0xaf, 0xd6, 0x02, 0xa0, 0x36, 0xc4, 0xff, 0xac, 0x18, 0xe4, 0xa3, 0x30, 0x68, 0xbb, 0x68, 0x32,
+	0xe0, 0xb7, 0x8c, 0x87, 0x43, 0x68, 0xa9, 0xc6, 0xda, 0xce, 0x07, 0x87, 0x20, 0x91, 0x35, 0xd2,
+	0x76, 0xf1, 0xd3, 0x5e, 0x86, 0x61, 0xdd, 0x75, 0xa9, 0x57, 0xf7, 0xf4, 0x55, 0x39, 0x93, 0x51,
+	0x00, 0x94, 0x47, 0x07, 0x02, 0x97, 0xf5, 0x55, 0xf2, 0x16, 0x8c, 0x35, 0x1c, 0x8a, 0x46, 0x85,
+	0xde, 0x64, 0xad, 0x94, 0xb6, 0x0f, 0x11, 0x84, 0xbc, 0x58, 0x86, 0x88, 0x8a, 0x41, 0xee, 0xc0,
+	0x98, 0xf8, 0x1c, 0xfe, 0xc0, 0x07, 0x07, 0xda, 0x78, 0xb8, 0x8c, 0x71, 0x91, 0xf0, 0x27, 0x3e,
+	0xe2, 0x9d, 0x97, 0x4c, 0x2e, 0xf3, 0x35, 0x24, 0x52, 0xb2, 0x04, 0x64, 0x83, 0xae, 0xa0, 0x71,
+	0xc1, 0xea, 0xe2, 0x89, 0x38, 0x44, 0x5a, 0x67, 0x7c, 0x1c, 0x95, 0xc4, 0xca, 0x6f, 0xc6, 0x36,
+	0xe8, 0x4a, 0x29, 0x82, 0x24, 0x77, 0xe1, 0x4c, 0xb2, 0x08, 0xfb, 0x64, 0x7e, 0xcf, 0xf4, 0xf4,
+	0xf6, 0x56, 0xb1, 0x98, 0x4a, 0x20, 0xb1, 0x3d, 0x95, 0x60, 0x5b, 0x31, 0x6e, 0xe6, 0x87, 0x06,
+	0x0b, 0x43, 0xda, 0x38, 0x2b, 0xeb, 0x9b, 0xea, 0xa6, 0xa1, 0xfe, 0x6a, 0x86, 0x99, 0xe4, 0xec,
+	0x83, 0x66, 0x98, 0x20, 0x98, 0xae, 0xb7, 0xf6, 0xa8, 0xeb, 0xad, 0x30, 0x03, 0xf5, 0x80, 0xdb,
+	0x63, 0x76, 0xd5, 0x04, 0x96, 0x5c, 0x85, 0x01, 0x43, 0x3e, 0x9d, 0x3c, 0x1b, 0xed, 0x04, 0xbf,
+	0x1e, 0x4d, 0x50, 0x91, 0xcb, 0x90, 0x67, 0x4b, 0x56, 0xfc, 0x68, 0x42, 0xb6, 0x2e, 0x34, 0xa4,
+	0x50, 0xbf, 0x2a, 0x0b, 0xa3, 0xd2, 0xd7, 0x5c, 0x3f, 0xd0, 0xe7, 0x7c, 0x78, 0x77, 0xcd, 0xf4,
+	0xbd, 0xdb, 0x70, 0xcf, 0xea, 0x37, 0xf9, 0xe5, 0x40, 0x14, 0xbb, 0xba, 0xdb, 0x14, 0x82, 0x79,
+	0x55, 0x7c, 0xe8, 0xc0, 0xee, 0xb7, 0xe9, 0x8c, 0xfe, 0x66, 0x7e, 0x28, 0x5b, 0xc8, 0xdd, 0xcc,
+	0x0f, 0xe5, 0x0b, 0xfd, 0x18, 0xf3, 0x0f, 0x83, 0xf4, 0xf3, 0x33, 0x10, 0xeb, 0x9e, 0xb9, 0x7a,
+	0xcc, 0x9f, 0x98, 0x1d, 0x6e, 0x3c, 0xc4, 0x98, 0x6c, 0x8e, 0xf9, 0x7b, 0xb3, 0x2f, 0xa9, 0x6c,
+	0x4e, 0x32, 0x56, 0x0b, 0xd9, 0xfc, 0x41, 0x06, 0x94, 0x54, 0xd9, 0x94, 0x8e, 0xc8, 0xe1, 0xe9,
+	0xf0, 0xf2, 0x56, 0xff, 0x79, 0x16, 0x26, 0x2b, 0x96, 0x47, 0x57, 0xf9, 0x8e, 0xf1, 0x98, 0x4f,
+	0x15, 0xb7, 0x60, 0x44, 0xfa, 0x18, 0xd1, 0xe7, 0x8f, 0x05, 0xa7, 0x15, 0x21, 0xaa, 0x0b, 0x27,
+	0xb9, 0xf4, 0xe1, 0x3d, 0xd8, 0x8b, 0x0b, 0xf9, 0x98, 0xcf, 0x39, 0xc7, 0x43, 0xc8, 0xc7, 0x7c,
+	0xf2, 0x7a, 0x48, 0x85, 0xfc, 0xd9, 0x1c, 0x9c, 0x4a, 0xa9, 0x9c, 0x5c, 0x42, 0x47, 0x43, 0x0c,
+	0xf1, 0x97, 0x09, 0x9f, 0x06, 0xb8, 0x9d, 0x15, 0x8c, 0xee, 0xa7, 0xf9, 0x48, 0xb2, 0x8c, 0x31,
+	0x38, 0x96, 0x2a, 0xd3, 0x65, 0x21, 0x55, 0x55, 0x8a, 0x26, 0xc2, 0xc0, 0x69, 0x5f, 0x16, 0xc4,
+	0xe9, 0xb0, 0x4d, 0xa3, 0x11, 0x8b, 0xd3, 0xc1, 0xca, 0x90, 0x4f, 0xc2, 0x70, 0xe9, 0xbd, 0x8e,
+	0x43, 0x91, 0x2f, 0x97, 0xf8, 0x33, 0x01, 0x5f, 0x1f, 0x91, 0xc6, 0x99, 0x87, 0x1c, 0x61, 0x14,
+	0x71, 0xde, 0x21, 0x43, 0xb2, 0x04, 0x03, 0x37, 0x4c, 0x6f, 0xae, 0xb3, 0x22, 0x7a, 0x21, 0x08,
+	0x03, 0xc8, 0xa1, 0x69, 0x7c, 0x71, 0x57, 0xce, 0xc3, 0x99, 0xcb, 0x7b, 0x20, 0x5e, 0x80, 0xcc,
+	0x43, 0x7f, 0xe9, 0x6e, 0x4d, 0x2b, 0x89, 0x9e, 0x78, 0x52, 0x0e, 0xa8, 0x52, 0xea, 0xca, 0x0e,
+	0xc3, 0x43, 0xe8, 0x72, 0xba, 0x34, 0xa4, 0x57, 0xbf, 0x31, 0x03, 0x17, 0xba, 0x0b, 0x8f, 0xbc,
+	0x00, 0x83, 0x9a, 0xdd, 0xa4, 0x25, 0x6d, 0x51, 0xf4, 0x0c, 0x4f, 0x41, 0x6f, 0x37, 0x69, 0x5d,
+	0x77, 0xe4, 0xbd, 0x88, 0x4f, 0x46, 0x3e, 0x02, 0x23, 0x15, 0xd7, 0xed, 0x50, 0xa7, 0xf6, 0xd2,
+	0x6d, 0xad, 0x22, 0xb6, 0xac, 0xb8, 0x25, 0x32, 0x11, 0x5c, 0x77, 0x5f, 0x8a, 0xc5, 0x18, 0x94,
+	0xe9, 0xd5, 0xaf, 0xcf, 0xc0, 0xc5, 0x5e, 0x42, 0x27, 0x2f, 0xc1, 0xd0, 0x32, 0xb5, 0x74, 0xcb,
+	0xab, 0x4c, 0x8b, 0x26, 0xe1, 0x0e, 0xd0, 0x43, 0x58, 0x74, 0x23, 0x13, 0x10, 0xb2, 0x42, 0xfc,
+	0x50, 0x38, 0xf0, 0x67, 0xe1, 0x07, 0xd8, 0x08, 0x8b, 0x15, 0xf2, 0x09, 0xd5, 0x4f, 0xc0, 0xf9,
+	0xae, 0x7d, 0x44, 0x3e, 0x0a, 0xa3, 0x4b, 0xce, 0xaa, 0x6e, 0x99, 0xef, 0xf1, 0x21, 0x96, 0x09,
+	0x77, 0xd9, 0xb6, 0x04, 0x97, 0x77, 0x7e, 0x32, 0xbd, 0xba, 0x02, 0x4a, 0xb7, 0x0e, 0x23, 0xb3,
+	0x30, 0x8e, 0x51, 0xe8, 0x4b, 0x56, 0x63, 0xcd, 0x76, 0x42, 0xd9, 0xe3, 0x0b, 0x4c, 0x8f, 0x61,
+	0xea, 0x3a, 0xa2, 0x62, 0x7d, 0x10, 0x2b, 0xa5, 0xfe, 0x46, 0x16, 0x46, 0xab, 0xcd, 0xce, 0xaa,
+	0x29, 0x2d, 0xcc, 0xfb, 0xde, 0xcf, 0xf8, 0xbb, 0x8b, 0xec, 0xde, 0x76, 0x17, 0x6c, 0x3a, 0x73,
+	0xf6, 0x39, 0x9d, 0xf9, 0xe5, 0xc8, 0x1b, 0x30, 0xd0, 0xc6, 0xef, 0x88, 0xdf, 0x03, 0xf0, 0xaf,
+	0xeb, 0x76, 0x0f, 0xc0, 0xcb, 0xb0, 0xf9, 0xab, 0x71, 0x80, 0xf9, 0x2b, 0x2c, 0x2b, 0x09, 0x34,
+	0x5c, 0x84, 0x4f, 0x04, 0x7a, 0x28, 0x02, 0x0d, 0x17, 0xdc, 0x13, 0x81, 0x1e, 0x40, 0xa0, 0x3f,
+	0x92, 0x85, 0xf1, 0x68, 0x95, 0xe4, 0x05, 0x18, 0xe1, 0xd5, 0xf0, 0x73, 0xb7, 0x8c, 0xf4, 0x3a,
+	0x23, 0x04, 0x6b, 0xc0, 0x7f, 0x88, 0x03, 0xc4, 0x89, 0x35, 0xdd, 0xad, 0x87, 0x27, 0x60, 0xdc,
+	0x0f, 0x61, 0x88, 0x7b, 0xf4, 0xc5, 0x50, 0xda, 0xf8, 0x9a, 0xee, 0x96, 0xc3, 0xdf, 0x64, 0x06,
+	0x88, 0x43, 0x3b, 0x2e, 0x8d, 0x32, 0xc8, 0x23, 0x03, 0xbe, 0x7a, 0x24, 0xb0, 0xda, 0x24, 0x87,
+	0xc9, 0x6c, 0xbe, 0x22, 0x68, 0x36, 0x2a, 0x43, 0x7f, 0xef, 0x53, 0xe4, 0xa7, 0xb7, 0xb7, 0x8a,
+	0x67, 0x24, 0xfa, 0xf4, 0x63, 0x64, 0x4e, 0x30, 0xad, 0x7b, 0x3a, 0x3f, 0xf4, 0xf0, 0x3b, 0x40,
+	0xfd, 0xc3, 0xcf, 0x64, 0xa0, 0x7f, 0xc9, 0xa2, 0x4b, 0xf7, 0xc8, 0x8b, 0x30, 0xcc, 0x34, 0x66,
+	0xde, 0x66, 0x9d, 0x99, 0x11, 0x8e, 0x40, 0x92, 0x2a, 0x21, 0x62, 0xae, 0x4f, 0x0b, 0xa9, 0xc8,
+	0xcb, 0x00, 0xe1, 0x63, 0x5d, 0xa1, 0x7e, 0x44, 0x2e, 0xc3, 0x31, 0x73, 0x7d, 0x9a, 0x44, 0xe7,
+	0x97, 0x12, 0x4f, 0x1d, 0x73, 0xc9, 0x52, 0x1c, 0xe3, 0x97, 0x12, 0x03, 0x64, 0x1e, 0x08, 0xfb,
+	0x55, 0xd5, 0x5d, 0x77, 0xc3, 0x76, 0x8c, 0xf2, 0x9a, 0x6e, 0xad, 0xd2, 0xf8, 0xf6, 0x34, 0x49,
+	0x31, 0xd7, 0xa7, 0xa5, 0x94, 0x23, 0x1f, 0x86, 0x51, 0xd9, 0xf9, 0x3b, 0xee, 0xbd, 0x24, 0xe3,
+	0xe6, 0xfa, 0xb4, 0x08, 0x2d, 0xf9, 0x20, 0x8c, 0x88, 0xdf, 0x37, 0x6d, 0xe1, 0x1a, 0x21, 0xc5,
+	0x84, 0x93, 0x50, 0x73, 0x7d, 0x9a, 0x4c, 0x29, 0x55, 0x5a, 0x75, 0x4c, 0xcb, 0x13, 0x3e, 0xb3,
+	0xf1, 0x4a, 0x11, 0x27, 0x55, 0x8a, 0xbf, 0xc9, 0x47, 0x60, 0x2c, 0x08, 0xb6, 0x87, 0x0f, 0x53,
+	0xf8, 0xed, 0xc2, 0x99, 0x58, 0x61, 0x8e, 0x9c, 0xeb, 0xd3, 0xa2, 0xd4, 0xe4, 0x32, 0x0c, 0x68,
+	0xd4, 0x35, 0xdf, 0xf3, 0xfd, 0x1e, 0xc6, 0xa5, 0x81, 0x6e, 0xbe, 0xc7, 0xa4, 0x24, 0xf0, 0xac,
+	0x77, 0x42, 0x47, 0x0b, 0x71, 0x17, 0x40, 0x62, 0xb5, 0xcc, 0x58, 0x06, 0xeb, 0x1d, 0xc9, 0xcb,
+	0xe6, 0xad, 0x30, 0x04, 0xa1, 0xc8, 0xdf, 0x3d, 0x12, 0x8f, 0xf5, 0x22, 0x63, 0xe7, 0xfa, 0xb4,
+	0x18, 0xbd, 0x24, 0xd5, 0x69, 0xd3, 0x5d, 0x17, 0xa1, 0xa3, 0xe3, 0x52, 0x65, 0x28, 0x49, 0xaa,
+	0xec, 0xa7, 0x54, 0xf5, 0x22, 0xf5, 0x36, 0x6c, 0x67, 0x5d, 0x04, 0x8a, 0x8e, 0x57, 0x2d, 0xb0,
+	0x52, 0xd5, 0x02, 0x22, 0x57, 0x1d, 0x3a, 0xcb, 0x27, 0xaa, 0xd6, 0x3d, 0x5d, 0xae, 0x9a, 0x1f,
+	0x75, 0xfa, 0x9d, 0x34, 0x4f, 0xf5, 0xfb, 0x54, 0x99, 0x48, 0xed, 0x50, 0xc4, 0x49, 0x1d, 0x8a,
+	0xbf, 0x59, 0xa5, 0x55, 0xdb, 0xf1, 0x66, 0x6d, 0x67, 0x43, 0x77, 0x0c, 0xa5, 0x10, 0xad, 0x54,
+	0x42, 0xb1, 0x4a, 0xa5, 0x9f, 0xac, 0x83, 0xde, 0x7e, 0xf1, 0x45, 0xbf, 0xdc, 0x64, 0xb4, 0x83,
+	0x42, 0x0c, 0xeb, 0xa0, 0xf0, 0x17, 0x29, 0x62, 0x76, 0x7a, 0x85, 0x20, 0xf9, 0x48, 0xd0, 0xc2,
+	0x72, 0x75, 0xae, 0x4f, 0xc3, 0xbc, 0xf5, 0x2a, 0xe4, 0x67, 0x1e, 0xd0, 0x86, 0x72, 0x0a, 0x29,
+	0x46, 0x7d, 0x0a, 0x06, 0x9b, 0xeb, 0xd3, 0x10, 0xc7, 0xa6, 0x88, 0x20, 0x37, 0xac, 0x72, 0x3a,
+	0x3a, 0x45, 0x04, 0x08, 0x36, 0x45, 0x84, 0x19, 0x64, 0x67, 0x93, 0x19, 0x50, 0x95, 0x33, 0xd1,
+	0xb5, 0x26, 0x8e, 0x9f, 0xeb, 0xd3, 0x92, 0x59, 0x53, 0x3f, 0x18, 0x49, 0x0a, 0xaa, 0x9c, 0x8d,
+	0x05, 0x62, 0x0c, 0x51, 0x4c, 0x5c, 0x72, 0xfa, 0xd0, 0x25, 0x38, 0xc5, 0x73, 0x8a, 0x8b, 0x50,
+	0x8a, 0x62, 0xb2, 0x3a, 0x17, 0xdd, 0x19, 0xa6, 0x90, 0xcc, 0xf5, 0x69, 0x69, 0x25, 0x49, 0x39,
+	0x91, 0x5c, 0x53, 0x51, 0xa2, 0x4e, 0x5e, 0x31, 0xf4, 0x5c, 0x9f, 0x96, 0x48, 0xc7, 0xf9, 0xb2,
+	0x9c, 0xd5, 0x52, 0x39, 0x1f, 0xed, 0xc4, 0x10, 0xc3, 0x3a, 0x51, 0xca, 0x7e, 0xf9, 0xb2, 0x9c,
+	0xe9, 0x50, 0xb9, 0x90, 0x2c, 0x15, 0xce, 0x9c, 0x52, 0x46, 0x44, 0x2d, 0x3d, 0x79, 0x9b, 0xf2,
+	0x58, 0xd4, 0x1d, 0x24, 0x8d, 0x66, 0xae, 0x4f, 0x4b, 0x4f, 0xfc, 0xa6, 0xa5, 0x67, 0x3d, 0x53,
+	0x2e, 0xf6, 0xe2, 0x19, 0xb4, 0x2e, 0x3d, 0x63, 0x9a, 0xde, 0x23, 0x07, 0x95, 0xf2, 0x78, 0x74,
+	0x0f, 0xd9, 0x95, 0x70, 0xae, 0x4f, 0xeb, 0x91, 0xc9, 0xea, 0x76, 0x97, 0x84, 0x50, 0xca, 0x13,
+	0xc8, 0xfe, 0x71, 0x69, 0x8b, 0x9a, 0x24, 0x9a, 0xeb, 0xd3, 0xba, 0xa4, 0x93, 0xba, 0xdd, 0x25,
+	0x5f, 0x90, 0x52, 0xec, 0xc9, 0x36, 0x90, 0x47, 0x97, 0x6c, 0x43, 0x4b, 0xa9, 0xa9, 0x76, 0x94,
+	0x27, 0xa3, 0xaa, 0x9b, 0x42, 0xc2, 0x54, 0x37, 0x2d, 0x49, 0xcf, 0x52, 0x6a, 0x6e, 0x18, 0xe5,
+	0xa9, 0x1e, 0x0c, 0x83, 0x36, 0xa6, 0x66, 0x95, 0x59, 0x4a, 0x4d, 0xce, 0xa2, 0xa8, 0x51, 0x86,
+	0x29, 0x24, 0x8c, 0x61, 0x5a, 0x5a, 0x97, 0xa5, 0xd4, 0x1c, 0x1e, 0xca, 0xd3, 0x3d, 0x18, 0x86,
+	0x2d, 0x4c, 0xcb, 0xfe, 0xf1, 0xc1, 0x48, 0x12, 0x0d, 0xe5, 0x99, 0xe8, 0xbc, 0x21, 0xa1, 0xd8,
+	0xbc, 0x21, 0xa7, 0xdb, 0x28, 0x27, 0x22, 0x7c, 0x2b, 0xef, 0x8b, 0x0e, 0xf3, 0x18, 0x9a, 0x0d,
+	0xf3, 0x78, 0x4c, 0xf0, 0x72, 0x22, 0xd2, 0xb1, 0x72, 0xa9, 0x1b, 0x13, 0x44, 0x47, 0x99, 0xf0,
+	0xd8, 0xc8, 0x95, 0x94, 0x50, 0xbb, 0xca, 0xb3, 0xd1, 0x07, 0x0a, 0x09, 0x82, 0xb9, 0x3e, 0x2d,
+	0x25, 0x40, 0xaf, 0x96, 0x1e, 0x57, 0x4e, 0xb9, 0x1c, 0x1d, 0xb6, 0x69, 0x34, 0x6c, 0xd8, 0xa6,
+	0xc6, 0xa4, 0x9b, 0x4f, 0x7b, 0xcf, 0xa5, 0x5c, 0x89, 0x1a, 0x66, 0x49, 0x0a, 0x66, 0x98, 0xa5,
+	0xbc, 0x03, 0xd3, 0xd2, 0xa3, 0x95, 0x29, 0xcf, 0xf5, 0x6c, 0x21, 0xd2, 0xa4, 0xb4, 0x90, 0x07,
+	0xef, 0x0a, 0x6d, 0xa7, 0xdb, 0xed, 0xa6, 0xad, 0x1b, 0xca, 0xfb, 0x53, 0x6d, 0x27, 0x8e, 0x94,
+	0x6c, 0x27, 0x0e, 0x60, 0xab, 0xbc, 0xfc, 0x58, 0x47, 0x79, 0x3e, 0xba, 0xca, 0xcb, 0x38, 0xb6,
+	0xca, 0x47, 0x1e, 0xf6, 0x94, 0x13, 0x0f, 0x5b, 0x94, 0x0f, 0x44, 0x15, 0x20, 0x86, 0x66, 0x0a,
+	0x10, 0x7f, 0x0a, 0xf3, 0xa9, 0xee, 0x4f, 0x41, 0x94, 0xab, 0xd1, 0xb3, 0xb0, 0x6e, 0x74, 0x73,
+	0x7d, 0x5a, 0xf7, 0xe7, 0x24, 0x95, 0x94, 0x97, 0x1d, 0xca, 0xb5, 0xa8, 0x82, 0x25, 0x08, 0x98,
+	0x82, 0x25, 0xdf, 0x83, 0x54, 0x52, 0x9e, 0x66, 0x28, 0x2f, 0x74, 0x65, 0x15, 0x7c, 0x73, 0xca,
+	0x83, 0x8e, 0x97, 0xe5, 0xb7, 0x15, 0xca, 0x8b, 0xd1, 0xc5, 0x2e, 0xc4, 0xb0, 0xc5, 0x4e, 0x7a,
+	0x83, 0xf1, 0xb2, 0xfc, 0xaa, 0x40, 0xb9, 0x9e, 0x2c, 0x15, 0x2e, 0x91, 0xd2, 0xeb, 0x03, 0x2d,
+	0xdd, 0x19, 0x5f, 0x79, 0x29, 0xaa, 0x75, 0x69, 0x34, 0x4c, 0xeb, 0x52, 0x1d, 0xf9, 0x67, 0x93,
+	0x3e, 0xf5, 0xca, 0xcb, 0xf1, 0x5d, 0x76, 0x14, 0xcf, 0x2c, 0x9f, 0x84, 0x1f, 0xfe, 0x5b, 0xf1,
+	0xa0, 0xa7, 0xca, 0x2b, 0xb1, 0x7b, 0xf5, 0x08, 0x96, 0xd9, 0xb7, 0xb1, 0x20, 0xa9, 0x6f, 0xc5,
+	0xe3, 0x84, 0x2a, 0xaf, 0xa6, 0x73, 0x08, 0x74, 0x25, 0x1e, 0x57, 0xf4, 0xad, 0x78, 0x68, 0x4d,
+	0xe5, 0x83, 0xe9, 0x1c, 0x02, 0xe9, 0xc6, 0x43, 0x71, 0xbe, 0x28, 0x25, 0xfb, 0x50, 0x3e, 0x14,
+	0x35, 0x1d, 0x03, 0x04, 0x33, 0x1d, 0xc3, 0x94, 0x20, 0x2f, 0x4a, 0x49, 0x32, 0x94, 0xd7, 0x12,
+	0x45, 0x82, 0xc6, 0x4a, 0xa9, 0x34, 0x5e, 0x94, 0x92, 0x4b, 0x28, 0x1f, 0x4e, 0x14, 0x09, 0x5a,
+	0x27, 0xa5, 0xa0, 0x30, 0x7a, 0xbd, 0x35, 0x57, 0x5e, 0x4f, 0x7d, 0x38, 0x9b, 0x42, 0x39, 0xd7,
+	0xa7, 0xf5, 0x7a, 0xb3, 0xfe, 0xa9, 0xee, 0x2f, 0x14, 0x94, 0x37, 0xa2, 0x43, 0xb8, 0x1b, 0x1d,
+	0x1b, 0xc2, 0x5d, 0x5f, 0x39, 0x7c, 0x24, 0x16, 0x15, 0x48, 0xf9, 0x48, 0x74, 0x8a, 0x8b, 0x20,
+	0xd9, 0x14, 0x17, 0x8f, 0x21, 0x14, 0x09, 0x77, 0xa3, 0x7c, 0x34, 0x3a, 0xc5, 0xc9, 0x38, 0x36,
+	0xc5, 0x45, 0x42, 0xe3, 0x94, 0x13, 0x51, 0x58, 0x94, 0x37, 0xa3, 0x53, 0x5c, 0x0c, 0xcd, 0xa6,
+	0xb8, 0x78, 0xdc, 0x96, 0x8f, 0xc4, 0x82, 0x91, 0x28, 0x6f, 0xa5, 0xb7, 0x1f, 0x91, 0x72, 0xfb,
+	0x79, 0xe8, 0x12, 0x2d, 0x3d, 0xaa, 0x86, 0x52, 0x8a, 0x8e, 0xdf, 0x34, 0x1a, 0x36, 0x7e, 0x53,
+	0x23, 0x72, 0xc4, 0x37, 0x0e, 0x42, 0xab, 0xa6, 0x7a, 0x6c, 0x1c, 0x42, 0x53, 0x24, 0x05, 0x1c,
+	0xd9, 0x23, 0xf3, 0x8d, 0x50, 0xb9, 0xcb, 0x1e, 0xd9, 0xdf, 0x06, 0xc5, 0xe8, 0xd9, 0xec, 0x9a,
+	0x70, 0x73, 0x57, 0xa6, 0xa3, 0xb3, 0x6b, 0x82, 0x80, 0xcd, 0xae, 0x49, 0xe7, 0xf8, 0x59, 0x28,
+	0x08, 0x2d, 0xe2, 0xef, 0x00, 0x4c, 0x6b, 0x55, 0x99, 0x89, 0x3d, 0x61, 0x8e, 0xe1, 0xd9, 0xec,
+	0x14, 0x87, 0xe1, 0x7a, 0xcd, 0x61, 0xe5, 0xa6, 0xd9, 0x5e, 0xb1, 0x75, 0xc7, 0xa8, 0x51, 0xcb,
+	0x50, 0x66, 0x63, 0xeb, 0x75, 0x0a, 0x0d, 0xae, 0xd7, 0x29, 0x70, 0x0c, 0xb6, 0x19, 0x83, 0x6b,
+	0xb4, 0x41, 0xcd, 0xfb, 0x54, 0xb9, 0x81, 0x6c, 0x8b, 0xdd, 0xd8, 0x0a, 0xb2, 0xb9, 0x3e, 0xad,
+	0x1b, 0x07, 0x66, 0xab, 0x2f, 0x6c, 0xd6, 0x3e, 0x36, 0x1f, 0x04, 0x72, 0xa9, 0x3a, 0xb4, 0xad,
+	0x3b, 0x54, 0x99, 0x8b, 0xda, 0xea, 0xa9, 0x44, 0xcc, 0x56, 0x4f, 0x45, 0x24, 0xd9, 0xfa, 0x63,
+	0xa1, 0xd2, 0x8b, 0x6d, 0x38, 0x22, 0xd2, 0x4b, 0xb3, 0xd9, 0x29, 0x8a, 0x60, 0x02, 0x9a, 0xb7,
+	0xad, 0x55, 0x3c, 0xa9, 0xb8, 0x19, 0x9d, 0x9d, 0xba, 0x53, 0xb2, 0xd9, 0xa9, 0x3b, 0x96, 0xa9,
+	0x7a, 0x14, 0xcb, 0xc7, 0xe0, 0xad, 0xa8, 0xaa, 0xa7, 0x90, 0x30, 0x55, 0x4f, 0x01, 0x27, 0x19,
+	0x6a, 0xd4, 0xa5, 0x9e, 0x32, 0xdf, 0x8b, 0x21, 0x92, 0x24, 0x19, 0x22, 0x38, 0xc9, 0x70, 0x96,
+	0x7a, 0x8d, 0x35, 0x65, 0xa1, 0x17, 0x43, 0x24, 0x49, 0x32, 0x44, 0x30, 0xdb, 0x6c, 0x46, 0xc1,
+	0x53, 0x9d, 0xe6, 0xba, 0xdf, 0x67, 0x8b, 0xd1, 0xcd, 0x66, 0x57, 0x42, 0xb6, 0xd9, 0xec, 0x8a,
+	0x24, 0x5f, 0xbf, 0xeb, 0x87, 0x06, 0xca, 0x12, 0x56, 0x78, 0x35, 0xb4, 0x0b, 0x76, 0x53, 0x6a,
+	0xae, 0x4f, 0xdb, 0xed, 0x43, 0x86, 0xf7, 0x07, 0x5e, 0xb9, 0x4a, 0x15, 0xab, 0x9a, 0x08, 0xce,
+	0x2a, 0x38, 0x78, 0xae, 0x4f, 0x0b, 0xfc, 0x76, 0x3f, 0x08, 0x23, 0xf8, 0x51, 0x15, 0xcb, 0xf4,
+	0xa6, 0xa7, 0x94, 0x8f, 0x45, 0xb7, 0x4c, 0x12, 0x8a, 0x6d, 0x99, 0xa4, 0x9f, 0x6c, 0x12, 0xc7,
+	0x9f, 0x7c, 0x8a, 0x99, 0x9e, 0x52, 0xb4, 0xe8, 0x24, 0x1e, 0x41, 0xb2, 0x49, 0x3c, 0x02, 0x08,
+	0xea, 0x9d, 0x76, 0xec, 0xf6, 0xf4, 0x94, 0x52, 0x4b, 0xa9, 0x97, 0xa3, 0x82, 0x7a, 0xf9, 0xcf,
+	0xa0, 0xde, 0xda, 0x5a, 0xc7, 0x9b, 0x66, 0xdf, 0xb8, 0x9c, 0x52, 0xaf, 0x8f, 0x0c, 0xea, 0xf5,
+	0x01, 0x6c, 0x2a, 0x44, 0x40, 0xd5, 0xb1, 0xd9, 0xa4, 0x7d, 0xcb, 0x6c, 0x36, 0x95, 0xdb, 0xd1,
+	0xa9, 0x30, 0x8e, 0x67, 0x53, 0x61, 0x1c, 0xc6, 0x4c, 0x4f, 0xde, 0x2a, 0xba, 0xd2, 0x59, 0x55,
+	0xee, 0x44, 0x4d, 0xcf, 0x10, 0xc3, 0x4c, 0xcf, 0xf0, 0x17, 0xee, 0x2e, 0xd8, 0x2f, 0x8d, 0xde,
+	0x73, 0xa8, 0xbb, 0xa6, 0xdc, 0x8d, 0xed, 0x2e, 0x24, 0x1c, 0xee, 0x2e, 0xa4, 0xdf, 0x64, 0x15,
+	0x1e, 0x8b, 0x2c, 0x34, 0xfe, 0xad, 0x4d, 0x8d, 0xea, 0x4e, 0x63, 0x4d, 0x79, 0x1b, 0x59, 0x3d,
+	0x9d, 0xba, 0x54, 0x45, 0x49, 0xe7, 0xfa, 0xb4, 0x5e, 0x9c, 0x70, 0x5b, 0xfe, 0xb1, 0x79, 0x1e,
+	0x91, 0x5b, 0xab, 0x96, 0xfd, 0x4d, 0xe8, 0x3b, 0xb1, 0x6d, 0x79, 0x92, 0x04, 0xb7, 0xe5, 0x49,
+	0x30, 0x69, 0xc3, 0x13, 0xb1, 0xad, 0xda, 0x82, 0xde, 0x64, 0xfb, 0x12, 0x6a, 0x54, 0xf5, 0xc6,
+	0x3a, 0xf5, 0x94, 0x8f, 0x23, 0xef, 0x4b, 0x5d, 0x36, 0x7c, 0x31, 0xea, 0xb9, 0x3e, 0x6d, 0x07,
+	0x7e, 0x44, 0x85, 0x7c, 0x6d, 0x76, 0xb9, 0xaa, 0x7c, 0x22, 0x7a, 0xbe, 0xc9, 0x60, 0x73, 0x7d,
+	0x1a, 0xe2, 0x98, 0x95, 0x76, 0xbb, 0xbd, 0xea, 0xe8, 0x06, 0xe5, 0x86, 0x16, 0xda, 0x6e, 0xc2,
+	0x00, 0xfd, 0x64, 0xd4, 0x4a, 0xeb, 0x46, 0xc7, 0xac, 0xb4, 0x6e, 0x38, 0xa6, 0xa8, 0x91, 0xe4,
+	0x53, 0xca, 0x57, 0x44, 0x15, 0x35, 0x82, 0x64, 0x8a, 0x1a, 0x4d, 0x55, 0xf5, 0x36, 0x9c, 0x0d,
+	0xf6, 0xf3, 0x62, 0xfd, 0xe5, 0x9d, 0xa6, 0x7c, 0x0a, 0xf9, 0x3c, 0x91, 0xb8, 0x0c, 0x88, 0x50,
+	0xcd, 0xf5, 0x69, 0x5d, 0xca, 0xb3, 0x15, 0x37, 0x91, 0x9c, 0x51, 0x98, 0x17, 0x5f, 0x19, 0x5d,
+	0x71, 0xbb, 0x90, 0xb1, 0x15, 0xb7, 0x0b, 0x2a, 0x95, 0xb9, 0x10, 0xaa, 0xbe, 0x03, 0xf3, 0x40,
+	0xa6, 0xdd, 0x38, 0xa4, 0x32, 0x17, 0x96, 0xda, 0xca, 0x0e, 0xcc, 0x03, 0x6b, 0xad, 0x1b, 0x07,
+	0x72, 0x19, 0x06, 0x6a, 0xb5, 0x05, 0xad, 0x63, 0x29, 0x8d, 0x98, 0x3b, 0x32, 0x42, 0xe7, 0xfa,
+	0x34, 0x81, 0x67, 0x66, 0xd0, 0x4c, 0x53, 0x77, 0x3d, 0xb3, 0xe1, 0xe2, 0x88, 0xf1, 0x47, 0x88,
+	0x11, 0x35, 0x83, 0xd2, 0x68, 0x98, 0x19, 0x94, 0x06, 0x67, 0xf6, 0x62, 0x59, 0x77, 0x5d, 0xdd,
+	0x32, 0x1c, 0x7d, 0x0a, 0x97, 0x09, 0x1a, 0x7b, 0x0c, 0x18, 0xc1, 0x32, 0x7b, 0x31, 0x0a, 0xc1,
+	0xc3, 0x77, 0x1f, 0xe2, 0x9b, 0x39, 0xf7, 0x62, 0x87, 0xef, 0x31, 0x3c, 0x1e, 0xbe, 0xc7, 0x60,
+	0x68, 0x77, 0xfa, 0x30, 0x8d, 0xae, 0x9a, 0x4c, 0x44, 0xca, 0x6a, 0xcc, 0xee, 0x8c, 0x13, 0xa0,
+	0xdd, 0x19, 0x07, 0x46, 0x9a, 0xe4, 0x2f, 0xb7, 0x6b, 0x5d, 0x9a, 0x14, 0xae, 0xb2, 0x89, 0x32,
+	0x6c, 0xfd, 0x0e, 0x07, 0xc7, 0xf4, 0xa6, 0xa5, 0xb7, 0xec, 0xe9, 0x29, 0x5f, 0xea, 0x66, 0x74,
+	0xfd, 0xee, 0x4a, 0xc8, 0xd6, 0xef, 0xae, 0x48, 0x36, 0xbb, 0xfa, 0x1b, 0xad, 0x35, 0xdd, 0xa1,
+	0xc6, 0xb4, 0xe9, 0xe0, 0xc9, 0xe2, 0x26, 0xdf, 0x1a, 0xbe, 0x1b, 0x9d, 0x5d, 0x7b, 0x90, 0xb2,
+	0xd9, 0xb5, 0x07, 0x9a, 0x19, 0x79, 0xe9, 0x68, 0x8d, 0xea, 0x86, 0xb2, 0x1e, 0x35, 0xf2, 0xba,
+	0x53, 0x32, 0x23, 0xaf, 0x3b, 0xb6, 0xfb, 0xe7, 0xdc, 0x75, 0x4c, 0x8f, 0x2a, 0xcd, 0xdd, 0x7c,
+	0x0e, 0x92, 0x76, 0xff, 0x1c, 0x44, 0xb3, 0x0d, 0x61, 0xbc, 0x43, 0x5a, 0xd1, 0x0d, 0x61, 0xb2,
+	0x1b, 0xe2, 0x25, 0x98, 0xc5, 0x22, 0x5e, 0x3d, 0x2a, 0x56, 0xd4, 0x62, 0x11, 0x60, 0x66, 0xb1,
+	0x84, 0xef, 0x22, 0x23, 0x6f, 0xdd, 0x14, 0x3b, 0xba, 0x86, 0xca, 0x38, 0xb6, 0x86, 0x46, 0xde,
+	0xc5, 0x7d, 0x30, 0xf2, 0x90, 0x43, 0x69, 0x47, 0xad, 0x0e, 0x09, 0xc5, 0xac, 0x0e, 0xf9, 0xc9,
+	0x47, 0x19, 0x26, 0xf0, 0x16, 0x5c, 0xeb, 0x04, 0xf7, 0x38, 0x9f, 0x8e, 0x7e, 0x66, 0x0c, 0xcd,
+	0x3e, 0x33, 0x06, 0x8a, 0x30, 0x11, 0xd3, 0x96, 0xd3, 0x85, 0x49, 0x78, 0x3e, 0x18, 0x03, 0x91,
+	0x79, 0x20, 0xb5, 0xd2, 0xc2, 0x7c, 0xc5, 0xa8, 0xca, 0x57, 0x64, 0x6e, 0xf4, 0x04, 0x36, 0x49,
+	0x31, 0xd7, 0xa7, 0xa5, 0x94, 0x23, 0xef, 0xc2, 0x45, 0x01, 0x15, 0xa1, 0x03, 0xaa, 0x8e, 0x7d,
+	0xdf, 0x34, 0x82, 0x05, 0xc1, 0x8b, 0x3a, 0x0a, 0xf6, 0xa2, 0x9d, 0xeb, 0xd3, 0x7a, 0xf2, 0xea,
+	0x5e, 0x97, 0x58, 0x1f, 0x3a, 0xbb, 0xa9, 0x2b, 0x58, 0x24, 0x7a, 0xf2, 0xea, 0x5e, 0x97, 0x90,
+	0xfb, 0xfd, 0xdd, 0xd4, 0x15, 0x74, 0x42, 0x4f, 0x5e, 0xc4, 0x85, 0x62, 0x2f, 0x7c, 0xa9, 0xd9,
+	0x54, 0x36, 0xb0, 0xba, 0x67, 0x77, 0x53, 0x5d, 0x09, 0x0d, 0xce, 0x9d, 0x38, 0xb2, 0x59, 0x7a,
+	0xa9, 0x4d, 0xad, 0x5a, 0x64, 0x01, 0x7a, 0x10, 0x9d, 0xa5, 0x13, 0x04, 0x6c, 0x96, 0x4e, 0x00,
+	0xd9, 0x80, 0x92, 0xdf, 0x03, 0x29, 0x9b, 0xd1, 0x01, 0x25, 0xe3, 0xd8, 0x80, 0x8a, 0xbc, 0x1d,
+	0x5a, 0x82, 0x53, 0x4b, 0xeb, 0x9e, 0xee, 0x5b, 0x90, 0xae, 0xe8, 0xca, 0xf7, 0x62, 0x97, 0x4c,
+	0x49, 0x12, 0xbc, 0x64, 0x4a, 0x82, 0xd9, 0x18, 0x61, 0xe0, 0xda, 0xa6, 0xd5, 0x98, 0xd5, 0xcd,
+	0x66, 0xc7, 0xa1, 0xca, 0xdf, 0x88, 0x8e, 0x91, 0x18, 0x9a, 0x8d, 0x91, 0x18, 0x88, 0x2d, 0xd0,
+	0x0c, 0x54, 0x72, 0x5d, 0x73, 0xd5, 0x12, 0xfb, 0xca, 0x4e, 0xd3, 0x53, 0xfe, 0xb3, 0xe8, 0x02,
+	0x9d, 0x46, 0xc3, 0x16, 0xe8, 0x34, 0x38, 0x9e, 0x3a, 0xb1, 0x5e, 0x60, 0x8b, 0x87, 0x7c, 0x57,
+	0xf9, 0x9f, 0xc7, 0x4e, 0x9d, 0x52, 0x68, 0xf0, 0xd4, 0x29, 0x05, 0xce, 0xd6, 0x47, 0x6e, 0x93,
+	0xcd, 0x9b, 0xc1, 0x5d, 0xf5, 0x7f, 0x11, 0x5d, 0x1f, 0xe3, 0x78, 0xb6, 0x3e, 0xc6, 0x61, 0x51,
+	0x3e, 0xa2, 0x0b, 0xfe, 0xcb, 0x6e, 0x7c, 0x02, 0xf9, 0x27, 0xca, 0x90, 0x1b, 0x32, 0x1f, 0x31,
+	0x52, 0xbe, 0x2a, 0xd3, 0x8d, 0x51, 0x30, 0x3c, 0x12, 0x85, 0xa2, 0x8c, 0x34, 0x7a, 0xdf, 0xa4,
+	0x1b, 0xca, 0x57, 0x77, 0x65, 0xc4, 0x09, 0xa2, 0x8c, 0x38, 0x8c, 0xbc, 0x03, 0x67, 0x43, 0xd8,
+	0x02, 0x6d, 0xad, 0x04, 0x33, 0xd3, 0xdf, 0xcc, 0x44, 0xcd, 0xe0, 0x74, 0x32, 0x66, 0x06, 0xa7,
+	0x63, 0xd2, 0x58, 0x0b, 0xd1, 0xfd, 0xad, 0x1d, 0x58, 0x07, 0x12, 0xec, 0xc2, 0x20, 0x8d, 0xb5,
+	0x90, 0xe6, 0xd7, 0xec, 0xc0, 0x3a, 0x90, 0x69, 0x17, 0x06, 0xe4, 0x1b, 0x32, 0x70, 0x29, 0x1d,
+	0x55, 0x6a, 0x36, 0x67, 0x6d, 0x27, 0xc4, 0x29, 0x7f, 0x3b, 0x13, 0x3d, 0x68, 0xd8, 0x5d, 0xb1,
+	0xb9, 0x3e, 0x6d, 0x97, 0x15, 0x90, 0x8f, 0xc2, 0x58, 0xa9, 0x63, 0x98, 0x1e, 0x5e, 0xbc, 0x31,
+	0xc3, 0xf9, 0x6b, 0x33, 0xb1, 0x2d, 0x8e, 0x8c, 0xc5, 0x2d, 0x8e, 0x0c, 0x20, 0x37, 0x61, 0xb2,
+	0x46, 0x1b, 0x1d, 0x8c, 0x37, 0x41, 0xdb, 0xb6, 0xe3, 0x31, 0x1e, 0x5f, 0x97, 0x89, 0x4e, 0x62,
+	0x09, 0x0a, 0x36, 0x89, 0x25, 0x80, 0xe4, 0x4e, 0xe2, 0x56, 0x5e, 0x74, 0xe6, 0xd7, 0x67, 0x7a,
+	0x5e, 0xcb, 0x07, 0x7d, 0x99, 0x5e, 0x9c, 0x54, 0x63, 0xb7, 0xe8, 0x82, 0xeb, 0x37, 0x64, 0x7a,
+	0x5c, 0xa3, 0x4b, 0x33, 0x5c, 0x12, 0xcc, 0x38, 0x46, 0xee, 0xae, 0x05, 0xc7, 0xbf, 0x93, 0xe9,
+	0x71, 0xed, 0x1d, 0x72, 0x4c, 0x01, 0x93, 0x57, 0xb8, 0xa7, 0x88, 0x60, 0xf4, 0x77, 0x33, 0x49,
+	0x57, 0x91, 0xa0, 0xbc, 0x44, 0xc8, 0x8a, 0xdd, 0x76, 0x03, 0xa5, 0xff, 0x4c, 0x26, 0xe9, 0x9b,
+	0x17, 0x16, 0x0b, 0x7f, 0x11, 0x0a, 0x17, 0x66, 0x1e, 0x78, 0xd4, 0xb1, 0xf4, 0x26, 0x76, 0x67,
+	0xcd, 0xb3, 0x1d, 0x7d, 0x95, 0xce, 0x58, 0xfa, 0x4a, 0x93, 0x2a, 0xdf, 0x98, 0x89, 0x5a, 0xb0,
+	0xdd, 0x49, 0x99, 0x05, 0xdb, 0x1d, 0x4b, 0xd6, 0xe0, 0xb1, 0x34, 0xec, 0xb4, 0xe9, 0x62, 0x3d,
+	0xdf, 0x94, 0x89, 0x9a, 0xb0, 0x3d, 0x68, 0x99, 0x09, 0xdb, 0x03, 0x4d, 0xae, 0xc3, 0xf0, 0x94,
+	0xed, 0x4f, 0xbf, 0xdf, 0x1c, 0x73, 0x86, 0x0c, 0x30, 0x73, 0x7d, 0x5a, 0x48, 0x26, 0xca, 0x88,
+	0x41, 0xfd, 0xd9, 0x64, 0x99, 0xf0, 0xf2, 0x29, 0xf8, 0x21, 0xca, 0x08, 0x71, 0xff, 0x57, 0xc9,
+	0x32, 0xe1, 0x1d, 0x57, 0xf0, 0x83, 0xcd, 0x24, 0xbc, 0xc6, 0x85, 0xd9, 0x12, 0xb3, 0xdb, 0xca,
+	0x6b, 0x7a, 0xb3, 0x49, 0xad, 0x55, 0xaa, 0x7c, 0x2e, 0x36, 0x93, 0xa4, 0x93, 0xb1, 0x99, 0x24,
+	0x1d, 0x43, 0x3e, 0x09, 0xe7, 0xee, 0xe8, 0x4d, 0xd3, 0x08, 0x71, 0x1a, 0x75, 0xdb, 0xb6, 0xe5,
+	0x52, 0xe5, 0xf3, 0x99, 0xe8, 0x6e, 0xba, 0x0b, 0x1d, 0xdb, 0x4d, 0x77, 0x41, 0x91, 0x05, 0x20,
+	0xb8, 0x8c, 0x06, 0xb3, 0x05, 0x5b, 0x9f, 0x95, 0xbf, 0x97, 0x89, 0xda, 0xa9, 0x49, 0x12, 0x66,
+	0xa7, 0x26, 0xa1, 0xa4, 0xde, 0x3d, 0xc9, 0x92, 0xf2, 0x2d, 0x99, 0xe8, 0x69, 0x4d, 0x37, 0xc2,
+	0xb9, 0x3e, 0xad, 0x7b, 0xa6, 0xa6, 0x1b, 0x50, 0xa8, 0x55, 0x2b, 0xb3, 0xb3, 0x33, 0xb5, 0x3b,
+	0x95, 0x69, 0x7c, 0xaa, 0x61, 0x28, 0xdf, 0x1a, 0x5b, 0xb1, 0xe2, 0x04, 0x6c, 0xc5, 0x8a, 0xc3,
+	0xc8, 0xeb, 0x30, 0xca, 0xda, 0xcf, 0x06, 0x0c, 0x7e, 0xf2, 0xb7, 0x65, 0xa2, 0xe6, 0x94, 0x8c,
+	0x64, 0xe6, 0x94, 0xfc, 0x9b, 0xd4, 0xe0, 0x34, 0x93, 0x62, 0xd5, 0xa1, 0xf7, 0xa8, 0x43, 0xad,
+	0x86, 0x3f, 0xa6, 0xbf, 0x3d, 0x13, 0xb5, 0x32, 0xd2, 0x88, 0x98, 0x95, 0x91, 0x06, 0x27, 0xeb,
+	0x70, 0x31, 0x7e, 0x12, 0x24, 0xbf, 0xeb, 0x55, 0xfe, 0x7e, 0x26, 0x66, 0x0c, 0xf7, 0x20, 0x46,
+	0x63, 0xb8, 0x07, 0x9e, 0x58, 0xf0, 0xb8, 0x38, 0x56, 0x11, 0x0e, 0x97, 0xf1, 0xda, 0xbe, 0x83,
+	0xd7, 0xf6, 0xbe, 0xd0, 0x21, 0xb0, 0x07, 0xf5, 0x5c, 0x9f, 0xd6, 0x9b, 0x1d, 0xd3, 0xb3, 0x64,
+	0x2a, 0x21, 0xe5, 0x3b, 0x33, 0xe9, 0x1e, 0x29, 0x11, 0x37, 0xe5, 0xb4, 0x1c, 0x44, 0xef, 0x74,
+	0x4b, 0x84, 0xa3, 0xfc, 0x83, 0xd8, 0x78, 0x4b, 0x27, 0x63, 0xe3, 0xad, 0x4b, 0x26, 0x9d, 0x9b,
+	0x30, 0xc9, 0x95, 0xba, 0xaa, 0xe3, 0x30, 0xb4, 0x56, 0xa9, 0xa1, 0xfc, 0xc3, 0xd8, 0x6a, 0x97,
+	0xa0, 0x40, 0xd7, 0x9e, 0x38, 0x90, 0x4d, 0xdd, 0xb5, 0xb6, 0x6e, 0x59, 0x78, 0xcc, 0xaa, 0xfc,
+	0xd7, 0xb1, 0xa9, 0x3b, 0x44, 0xa1, 0xe3, 0x6e, 0xf0, 0x8b, 0x69, 0x42, 0xaf, 0x24, 0x72, 0xca,
+	0x7f, 0x13, 0xd3, 0x84, 0x5e, 0xc4, 0x4c, 0x13, 0x7a, 0x66, 0xa4, 0xbb, 0xd3, 0xe5, 0x8d, 0xbd,
+	0xf2, 0x85, 0xd8, 0x8a, 0x9c, 0x4a, 0xc5, 0x56, 0xe4, 0xf4, 0x27, 0xfa, 0x77, 0xba, 0xbc, 0x4f,
+	0x57, 0xbe, 0xab, 0x37, 0xdf, 0x70, 0xa5, 0x4f, 0x7f, 0xde, 0x7e, 0xa7, 0xcb, 0xdb, 0x6e, 0xe5,
+	0xbb, 0x7b, 0xf3, 0x0d, 0x1d, 0xfb, 0xd2, 0x9f, 0x86, 0xd7, 0xbb, 0xbf, 0x8b, 0x56, 0xfe, 0x51,
+	0x7c, 0xea, 0xea, 0x42, 0x88, 0x53, 0x57, 0xb7, 0xc7, 0xd5, 0x2b, 0x70, 0x9e, 0x6b, 0xc8, 0x0d,
+	0x47, 0x6f, 0xaf, 0xd5, 0xa8, 0xe7, 0x99, 0xd6, 0xaa, 0xbf, 0x13, 0xfb, 0x9e, 0x4c, 0xec, 0x78,
+	0xac, 0x1b, 0x25, 0x1e, 0x8f, 0x75, 0x43, 0x32, 0xe5, 0x4d, 0xbc, 0x80, 0x56, 0xfe, 0x71, 0x4c,
+	0x79, 0x13, 0x14, 0x4c, 0x79, 0x93, 0x0f, 0xa7, 0x6f, 0xa6, 0x3c, 0xf4, 0x55, 0xfe, 0xdb, 0xee,
+	0xbc, 0x82, 0xf6, 0xa5, 0xbc, 0x0f, 0xbe, 0x99, 0xf2, 0x9e, 0x55, 0xf9, 0xef, 0xba, 0xf3, 0x0a,
+	0x7d, 0x90, 0x92, 0xcf, 0x60, 0xdf, 0x81, 0xb3, 0x7c, 0x36, 0x9f, 0xa5, 0x06, 0x8d, 0x7c, 0xe8,
+	0xf7, 0xc6, 0xc6, 0x7e, 0x3a, 0x19, 0x1e, 0xb9, 0xa7, 0x62, 0xd2, 0x58, 0x8b, 0xb6, 0xfe, 0x93,
+	0x1d, 0x58, 0x87, 0x1b, 0x82, 0x74, 0x0c, 0x5b, 0x6f, 0xe4, 0xd7, 0x6f, 0xca, 0xf7, 0xc5, 0xd6,
+	0x1b, 0x19, 0x89, 0xee, 0x1c, 0xf2, 0x53, 0xb9, 0xd7, 0xa3, 0x2f, 0xbd, 0x94, 0xef, 0x4f, 0x2d,
+	0x1c, 0x74, 0x40, 0xf4, 0x59, 0xd8, 0xeb, 0xd1, 0x57, 0x4d, 0xca, 0x0f, 0xa4, 0x16, 0x0e, 0x3e,
+	0x20, 0xfa, 0x04, 0x8a, 0x6d, 0x91, 0x3a, 0x9e, 0xcd, 0x59, 0x45, 0xa6, 0x87, 0x7f, 0x1a, 0xdf,
+	0x22, 0xa5, 0x92, 0xe1, 0x16, 0x29, 0x15, 0x93, 0xc6, 0x5a, 0x7c, 0xde, 0x0f, 0xee, 0xc0, 0x5a,
+	0xda, 0xd8, 0xa5, 0x62, 0xd2, 0x58, 0x8b, 0x8f, 0xff, 0xa1, 0x1d, 0x58, 0x4b, 0x1b, 0xbb, 0x54,
+	0x0c, 0x33, 0xc7, 0x42, 0xcc, 0x1d, 0xea, 0xb8, 0xa1, 0xfa, 0xfd, 0xf7, 0x31, 0x73, 0xac, 0x0b,
+	0x1d, 0x33, 0xc7, 0xba, 0xa0, 0x52, 0xb9, 0x0b, 0xa1, 0xfc, 0xf0, 0x4e, 0xdc, 0xc3, 0x7b, 0x99,
+	0x2e, 0xa8, 0x54, 0xee, 0x42, 0x2e, 0xff, 0x6c, 0x27, 0xee, 0xe1, 0xc5, 0x4c, 0x17, 0x14, 0x33,
+	0x8a, 0x6a, 0x9e, 0xee, 0x99, 0x8d, 0x39, 0xdb, 0xf5, 0xa4, 0x45, 0xfe, 0x7f, 0x88, 0x19, 0x45,
+	0x69, 0x44, 0xcc, 0x28, 0x4a, 0x83, 0x27, 0x99, 0x0a, 0x69, 0xfc, 0x48, 0x4f, 0xa6, 0xa1, 0xa5,
+	0x95, 0x06, 0x4f, 0x32, 0x15, 0x42, 0xf8, 0x1f, 0x7b, 0x32, 0x0d, 0x3d, 0xe5, 0xd3, 0xe0, 0xcc,
+	0x32, 0x2d, 0x3b, 0xf6, 0x86, 0x75, 0x93, 0x6e, 0xd0, 0xa6, 0xf8, 0xf4, 0x1f, 0x8d, 0x59, 0xa6,
+	0x71, 0x02, 0xbc, 0x45, 0x89, 0xc1, 0xa2, 0x8c, 0xc4, 0xe7, 0xfe, 0x58, 0x57, 0x46, 0xe1, 0x31,
+	0x51, 0x1c, 0x16, 0x65, 0x24, 0x3e, 0xf1, 0xc7, 0xbb, 0x32, 0x0a, 0x8f, 0x89, 0xe2, 0x30, 0x52,
+	0x82, 0x71, 0x7c, 0x2b, 0xa1, 0xbb, 0xbe, 0xe7, 0xe7, 0x4f, 0x67, 0xa2, 0xb7, 0x5e, 0x51, 0xf4,
+	0x5c, 0x9f, 0x16, 0x2b, 0x20, 0xb3, 0x10, 0x9f, 0xf4, 0x33, 0x5d, 0x58, 0x84, 0xfe, 0x8e, 0x51,
+	0x88, 0xcc, 0x42, 0x7c, 0xcc, 0x3f, 0xef, 0xc2, 0x22, 0x74, 0x78, 0x8c, 0x42, 0xc8, 0x87, 0x60,
+	0xa4, 0x36, 0xbb, 0x5c, 0xf5, 0x13, 0x9d, 0xfe, 0x6c, 0x26, 0xf6, 0xaa, 0x28, 0xc4, 0xe1, 0xab,
+	0xa2, 0xf0, 0x27, 0xf9, 0x28, 0x8c, 0x95, 0x6d, 0xcb, 0xd3, 0x1b, 0xfe, 0x06, 0xf4, 0xe7, 0x62,
+	0x67, 0x28, 0x11, 0xec, 0x5c, 0x9f, 0x16, 0x25, 0x97, 0xca, 0x8b, 0xb6, 0xff, 0x7c, 0x7a, 0xf9,
+	0xa0, 0xe9, 0x51, 0x72, 0x36, 0xa3, 0xdd, 0xb5, 0x9d, 0xf5, 0xa6, 0xad, 0x1b, 0x7e, 0x40, 0x52,
+	0xd1, 0x90, 0x7f, 0x11, 0x9b, 0xd1, 0xd2, 0xc9, 0xd8, 0x8c, 0x96, 0x8e, 0x49, 0x63, 0x2d, 0xba,
+	0xe8, 0x17, 0x76, 0x60, 0x1d, 0xce, 0xc3, 0xe9, 0x98, 0x34, 0xd6, 0xe2, 0xf3, 0xff, 0xe5, 0x0e,
+	0xac, 0xc3, 0x79, 0x38, 0x1d, 0xc3, 0x4c, 0xeb, 0x1b, 0xa6, 0xe7, 0x3f, 0x6c, 0xfb, 0xc5, 0x98,
+	0x69, 0x1d, 0xa2, 0x98, 0x69, 0x1d, 0xfe, 0x22, 0x14, 0x2e, 0x04, 0x4f, 0x25, 0xc3, 0xbd, 0x6b,
+	0xc5, 0xba, 0xcf, 0xf6, 0xc7, 0xca, 0xff, 0x14, 0x3b, 0x15, 0xe9, 0x4e, 0x3a, 0xd7, 0xa7, 0xf5,
+	0x60, 0x44, 0xaa, 0x31, 0x3f, 0x45, 0x1e, 0xd4, 0x4f, 0xf9, 0xa5, 0x4c, 0x0f, 0x47, 0x45, 0x4e,
+	0x93, 0x70, 0x54, 0xe4, 0x60, 0x31, 0x67, 0xad, 0x34, 0xe9, 0xed, 0xc5, 0xca, 0xdb, 0xd2, 0xec,
+	0xfa, 0xc5, 0xe4, 0x9c, 0x95, 0x20, 0x12, 0x73, 0x56, 0x02, 0x4e, 0xfe, 0x56, 0x06, 0x9e, 0x89,
+	0xcb, 0xf7, 0xed, 0x57, 0x5e, 0x78, 0x4d, 0xa3, 0xf7, 0xed, 0x86, 0x6c, 0x59, 0xfd, 0x32, 0xaf,
+	0xe5, 0xf9, 0x6e, 0xdd, 0x95, 0x56, 0x68, 0xae, 0x4f, 0xdb, 0x15, 0xf3, 0x5d, 0xb4, 0x42, 0x28,
+	0xcd, 0xaf, 0xec, 0xa9, 0x15, 0x81, 0x0a, 0xed, 0x8a, 0xf9, 0x2e, 0x5a, 0x21, 0x46, 0xc5, 0xaf,
+	0xee, 0xa9, 0x15, 0xc1, 0x18, 0xd9, 0x15, 0x73, 0xdc, 0x7d, 0xde, 0xad, 0x55, 0xca, 0x81, 0xaf,
+	0xcf, 0xa6, 0xd5, 0x50, 0x7e, 0x2d, 0xbe, 0xfb, 0x8c, 0x53, 0xe0, 0xee, 0x33, 0x0e, 0x64, 0xcb,
+	0xfd, 0x1c, 0xd5, 0x9b, 0x6c, 0x3b, 0x4a, 0x1b, 0xeb, 0x11, 0xe3, 0xed, 0xd7, 0x63, 0xcb, 0x7d,
+	0x17, 0x3a, 0xb6, 0xdc, 0x77, 0x41, 0xa5, 0x72, 0x17, 0x12, 0xfa, 0x8d, 0x9d, 0xb8, 0x87, 0xa6,
+	0x4a, 0x17, 0x54, 0x2a, 0x77, 0xa1, 0x05, 0xff, 0xf3, 0x4e, 0xdc, 0x43, 0x53, 0xa5, 0x0b, 0x8a,
+	0x7c, 0x73, 0x06, 0x2e, 0xa7, 0x75, 0x07, 0x8f, 0xfd, 0xb1, 0x74, 0x9f, 0x3a, 0x8e, 0x69, 0xf8,
+	0x17, 0xc8, 0xbf, 0xc9, 0xeb, 0x7b, 0xa1, 0x57, 0x7f, 0xa7, 0x15, 0x9c, 0xeb, 0xd3, 0x76, 0x5d,
+	0xc9, 0x2e, 0x5b, 0x24, 0x24, 0xf0, 0x5b, 0x7b, 0x6e, 0x51, 0x20, 0x92, 0x5d, 0x57, 0x82, 0x13,
+	0x8e, 0xb9, 0xea, 0x7a, 0xb6, 0x43, 0xab, 0x76, 0xd3, 0x6c, 0xf8, 0xeb, 0xcd, 0x6f, 0xc7, 0x27,
+	0x9c, 0x14, 0x22, 0x9c, 0x70, 0x52, 0xe0, 0x49, 0xa6, 0x42, 0x63, 0x7e, 0xa7, 0x27, 0x53, 0xc9,
+	0x9c, 0x4b, 0x81, 0x27, 0x99, 0x0a, 0x31, 0xfd, 0x6e, 0x4f, 0xa6, 0x92, 0x39, 0x97, 0x02, 0x27,
+	0x16, 0x3c, 0x1e, 0x1a, 0xba, 0xa5, 0x55, 0x6a, 0x79, 0x9a, 0xdd, 0x6c, 0xda, 0x1d, 0x6f, 0xd9,
+	0x31, 0x57, 0x57, 0xa9, 0xa3, 0xfc, 0x5e, 0xec, 0x80, 0xac, 0x27, 0xf5, 0x5c, 0x9f, 0xd6, 0x9b,
+	0x1d, 0xf1, 0xa0, 0x98, 0x4e, 0x30, 0x6b, 0x3b, 0x0d, 0x3a, 0x6d, 0x5b, 0x54, 0xf9, 0xfd, 0x4c,
+	0xf4, 0x7a, 0x7a, 0x07, 0xfa, 0xb9, 0x3e, 0x6d, 0x27, 0x96, 0xe4, 0xd3, 0xf0, 0x44, 0x3a, 0x09,
+	0xfb, 0x6f, 0x45, 0x6f, 0xac, 0x2b, 0xff, 0x4b, 0x26, 0xea, 0xf3, 0xd7, 0x9b, 0x7c, 0xae, 0x4f,
+	0xdb, 0x81, 0x21, 0x99, 0x86, 0x89, 0x85, 0x72, 0x35, 0xf2, 0xa0, 0xe3, 0x0f, 0x32, 0xb1, 0xe7,
+	0x57, 0x51, 0x3c, 0x3e, 0xbf, 0x8a, 0x82, 0x98, 0x3d, 0x15, 0x82, 0x66, 0x2c, 0x43, 0xf9, 0x5f,
+	0x63, 0xf6, 0x54, 0x04, 0x8b, 0xfe, 0xa5, 0x32, 0x80, 0xcd, 0xb3, 0x21, 0xc0, 0xbf, 0x97, 0xff,
+	0xc3, 0xd8, 0x3c, 0x9b, 0xa0, 0x60, 0xf3, 0x6c, 0x02, 0xc8, 0xac, 0x9c, 0x10, 0xb8, 0x68, 0x0b,
+	0x97, 0x5f, 0xd3, 0xb6, 0x94, 0x3f, 0x8a, 0x59, 0x39, 0xe9, 0x64, 0xcc, 0xca, 0x49, 0xc7, 0x30,
+	0xd5, 0x9e, 0xb2, 0x3b, 0x96, 0x71, 0x8b, 0x6e, 0xb6, 0x75, 0xd3, 0xf1, 0xdf, 0x21, 0x29, 0x7f,
+	0x1c, 0x53, 0xed, 0x34, 0x22, 0xa6, 0xda, 0x69, 0xf0, 0x04, 0x53, 0xdb, 0xe3, 0xad, 0xfd, 0x57,
+	0xbd, 0x98, 0x0a, 0xa2, 0x04, 0x53, 0x01, 0x27, 0x9f, 0xc9, 0xc0, 0xb3, 0x32, 0xe2, 0xa6, 0x6d,
+	0x5a, 0xe8, 0x81, 0x7d, 0x87, 0x3a, 0xc1, 0xf7, 0xcc, 0xea, 0x66, 0x93, 0x1a, 0xca, 0x16, 0xaf,
+	0xe8, 0x5a, 0x5a, 0x45, 0x3d, 0xca, 0xcd, 0xf5, 0x69, 0xbb, 0xad, 0x82, 0xac, 0xc0, 0xf9, 0x50,
+	0xa4, 0xcc, 0x32, 0xa3, 0x56, 0xad, 0x36, 0x53, 0xf3, 0x1c, 0xaa, 0xb7, 0x94, 0x3f, 0x89, 0x1d,
+	0xb6, 0x75, 0xa5, 0x44, 0x5f, 0xf2, 0x6e, 0x48, 0xb2, 0x0e, 0x17, 0x43, 0xa4, 0x6f, 0x17, 0x2e,
+	0x2f, 0x57, 0x7d, 0x75, 0xfa, 0xd3, 0xd8, 0x31, 0x6d, 0x2f, 0xe2, 0xb9, 0x3e, 0xad, 0x27, 0x33,
+	0xbc, 0xf8, 0x28, 0x57, 0x16, 0x58, 0x1b, 0x4c, 0x6b, 0x95, 0xfb, 0x45, 0xfd, 0x59, 0xfc, 0xe2,
+	0x23, 0x46, 0x80, 0x17, 0x1f, 0x31, 0x18, 0xde, 0xe6, 0x96, 0x2b, 0x0b, 0xbe, 0xa5, 0xc0, 0x39,
+	0xfd, 0x79, 0xfc, 0x36, 0x37, 0x4e, 0x81, 0xb7, 0xb9, 0x71, 0x20, 0xb3, 0xa6, 0x45, 0x80, 0xaa,
+	0xaa, 0x46, 0x5d, 0xcf, 0x31, 0xf1, 0xa5, 0x8e, 0x7f, 0xa6, 0xf9, 0xaf, 0x63, 0xd6, 0x74, 0x77,
+	0x52, 0x66, 0x4d, 0x77, 0xc7, 0xb2, 0x6f, 0xbf, 0x63, 0x51, 0x2f, 0x62, 0xc1, 0xfc, 0xef, 0xb1,
+	0x6f, 0x8f, 0x13, 0xb0, 0x6f, 0x8f, 0xc3, 0xa2, 0x8c, 0x44, 0x2b, 0xff, 0x8f, 0xae, 0x8c, 0xc2,
+	0xad, 0x75, 0x1c, 0x16, 0x65, 0x24, 0x96, 0x9b, 0xed, 0xae, 0x8c, 0xc2, 0xad, 0x75, 0x1c, 0x36,
+	0x35, 0x08, 0xfd, 0x28, 0xca, 0x9b, 0x03, 0x43, 0x3f, 0x91, 0x29, 0xfc, 0x64, 0xe6, 0xe6, 0xc0,
+	0xd0, 0x4f, 0x66, 0x0a, 0x3f, 0xc5, 0xfe, 0xff, 0xa9, 0x4c, 0xe1, 0xa7, 0x33, 0xda, 0xf9, 0xd8,
+	0x74, 0x5a, 0x6d, 0xea, 0xc2, 0x6e, 0x4e, 0x45, 0xf1, 0x9f, 0xa9, 0x28, 0x91, 0xac, 0xfe, 0x0b,
+	0x19, 0x18, 0xe5, 0x0a, 0x2c, 0x42, 0xc2, 0x5f, 0x80, 0x21, 0xfe, 0xa8, 0xd6, 0x8f, 0x61, 0xa6,
+	0x05, 0xbf, 0xc9, 0x25, 0x18, 0x9f, 0xd7, 0x5d, 0x0f, 0x9b, 0x58, 0xb1, 0x0c, 0xfa, 0x00, 0x03,
+	0xca, 0xe4, 0xb4, 0x18, 0x94, 0xcc, 0x73, 0x3a, 0x5e, 0x0e, 0xb3, 0xad, 0xe4, 0x76, 0x8c, 0x84,
+	0x3e, 0xf4, 0xc5, 0xad, 0x62, 0x1f, 0x06, 0x3e, 0x8f, 0x95, 0x55, 0x7f, 0x35, 0x03, 0x89, 0xe7,
+	0xbe, 0xfb, 0x0f, 0x7d, 0xb8, 0x04, 0x13, 0xb1, 0x0c, 0x3f, 0x22, 0x2a, 0xce, 0x2e, 0x13, 0x00,
+	0xc5, 0x4b, 0x93, 0x67, 0x83, 0x68, 0x2c, 0xb7, 0xb5, 0x79, 0x11, 0xe5, 0x9e, 0xa7, 0x0c, 0x76,
+	0x9a, 0x9a, 0x84, 0x12, 0x51, 0x8c, 0xff, 0x72, 0x32, 0x4c, 0x3a, 0x42, 0x2e, 0x89, 0x38, 0x8c,
+	0x52, 0x02, 0x8e, 0x8e, 0x4b, 0x1d, 0x39, 0x36, 0x3e, 0xc6, 0x5d, 0xfc, 0x28, 0x8c, 0x56, 0x5a,
+	0x6d, 0xea, 0xb8, 0xb6, 0xa5, 0x7b, 0xb6, 0x9f, 0xc6, 0x18, 0x23, 0xba, 0x99, 0x12, 0x5c, 0x8e,
+	0xe8, 0x26, 0xd3, 0x93, 0x2b, 0xd0, 0xaf, 0xd9, 0x4d, 0xea, 0x2a, 0x39, 0x4c, 0x1c, 0x83, 0xb1,
+	0x92, 0x1c, 0x06, 0x90, 0x83, 0xee, 0x21, 0x05, 0x23, 0xe5, 0x29, 0x81, 0xf3, 0x21, 0x29, 0x66,
+	0x01, 0x96, 0x49, 0x79, 0x22, 0xe1, 0xe7, 0x61, 0x00, 0x37, 0xbc, 0xae, 0xd2, 0x8f, 0xb4, 0x18,
+	0xcc, 0xaf, 0x89, 0x10, 0x39, 0x36, 0x20, 0xa7, 0x21, 0xb7, 0xa0, 0x10, 0x3a, 0x71, 0xdf, 0x70,
+	0xec, 0x4e, 0xdb, 0xcf, 0x0a, 0x5d, 0xdc, 0xde, 0x2a, 0x3e, 0xb6, 0x1e, 0xe0, 0xea, 0xab, 0x88,
+	0x94, 0x58, 0x24, 0x0a, 0x92, 0x39, 0x98, 0x08, 0x61, 0x4c, 0x44, 0x7e, 0x36, 0x7a, 0x8c, 0x43,
+	0x27, 0xf1, 0x62, 0xe2, 0x94, 0x59, 0xc5, 0x8b, 0x91, 0x0a, 0x0c, 0xfa, 0xe1, 0xfa, 0x87, 0x76,
+	0x54, 0xd2, 0x53, 0x22, 0x5c, 0xff, 0xa0, 0x1c, 0xa8, 0xdf, 0x2f, 0x4f, 0x66, 0x61, 0x5c, 0xb3,
+	0x3b, 0x1e, 0x5d, 0xb6, 0xc5, 0xed, 0xa7, 0x48, 0x0b, 0x81, 0x6d, 0x72, 0x18, 0xa6, 0xee, 0xd9,
+	0xf5, 0x06, 0xc7, 0xc9, 0xb1, 0xf1, 0xa2, 0xa5, 0xc8, 0x22, 0x4c, 0x26, 0xdc, 0xdd, 0x31, 0xcc,
+	0xcf, 0x30, 0x0f, 0xbc, 0x2e, 0x7d, 0x5e, 0x92, 0x59, 0xb2, 0x28, 0xf9, 0xda, 0x0c, 0x0c, 0x2c,
+	0x3b, 0xba, 0xe9, 0xb9, 0x22, 0xe4, 0xcf, 0x99, 0xab, 0x1b, 0x8e, 0xde, 0x66, 0xfa, 0x71, 0x15,
+	0xf3, 0xf9, 0xdc, 0xd1, 0x9b, 0x1d, 0xea, 0x4e, 0xdd, 0x65, 0x5f, 0xf7, 0x87, 0x5b, 0xc5, 0xd7,
+	0x79, 0x7c, 0xc7, 0xab, 0x0d, 0xbb, 0x75, 0x6d, 0xd5, 0xd1, 0xef, 0x9b, 0x7c, 0x51, 0xd7, 0x9b,
+	0xd7, 0x3c, 0xda, 0x44, 0xdf, 0x9d, 0x6b, 0x7a, 0xdb, 0xbc, 0x86, 0x19, 0xe8, 0xae, 0x05, 0x9c,
+	0x78, 0x0d, 0x4c, 0x05, 0x3c, 0xfc, 0x4b, 0x56, 0x01, 0x8e, 0x23, 0x8b, 0x00, 0xe2, 0x53, 0x4b,
+	0xed, 0xb6, 0x88, 0x1f, 0x24, 0x79, 0xbc, 0xf8, 0x18, 0xae, 0xd8, 0x81, 0xc0, 0xf4, 0xb6, 0x94,
+	0x75, 0x49, 0x93, 0x38, 0x30, 0x2d, 0x58, 0x16, 0x2d, 0xf2, 0xc5, 0x34, 0x26, 0x45, 0x23, 0x14,
+	0xa8, 0x14, 0x21, 0xc5, 0x8b, 0x91, 0x15, 0x98, 0x10, 0x7c, 0x83, 0x6c, 0xb1, 0xe3, 0xd1, 0x59,
+	0x21, 0x86, 0xe6, 0x4a, 0x1b, 0xb4, 0xd1, 0x10, 0x60, 0xb9, 0x8e, 0x58, 0x09, 0x32, 0x05, 0x63,
+	0xfe, 0xdf, 0x8b, 0x7a, 0x8b, 0xba, 0xca, 0x04, 0x6a, 0x2c, 0x26, 0xc6, 0xf1, 0xcb, 0x63, 0xe6,
+	0x0a, 0x59, 0x74, 0xd1, 0x22, 0x32, 0x0f, 0xae, 0xf5, 0x85, 0x14, 0x1e, 0x71, 0x9d, 0x8f, 0x16,
+	0x21, 0x65, 0x18, 0x0b, 0xc2, 0x17, 0xdc, 0xbe, 0x5d, 0x99, 0xc6, 0x00, 0x45, 0x22, 0x79, 0x49,
+	0x2c, 0x8b, 0xaa, 0xcc, 0x24, 0x52, 0x46, 0x8a, 0x5a, 0xc9, 0x23, 0x16, 0xc5, 0xa2, 0x56, 0xb6,
+	0x53, 0xa2, 0x56, 0x56, 0xc9, 0x47, 0x60, 0xa4, 0x74, 0xb7, 0x26, 0xa2, 0x71, 0xba, 0xca, 0xa9,
+	0x30, 0x63, 0x3a, 0x86, 0x00, 0x15, 0x91, 0x3b, 0xe5, 0xa6, 0xcb, 0xf4, 0x64, 0x06, 0xc6, 0x23,
+	0x67, 0x61, 0xae, 0x72, 0x1a, 0x39, 0x60, 0xcb, 0x75, 0xc4, 0xd4, 0x1d, 0x81, 0x92, 0x87, 0x57,
+	0xb4, 0x10, 0xd3, 0x9a, 0x69, 0xd3, 0xc5, 0x0c, 0xce, 0x1a, 0xc5, 0xc0, 0x9f, 0x18, 0xee, 0x68,
+	0x88, 0x6b, 0x8d, 0x21, 0x50, 0x75, 0x87, 0xe3, 0xe4, 0x1e, 0x8d, 0x15, 0x23, 0xef, 0x02, 0xc1,
+	0x9c, 0xcf, 0xd4, 0xf0, 0x0d, 0xa1, 0xca, 0xb4, 0xab, 0x9c, 0xc5, 0x0c, 0x69, 0x24, 0x1e, 0xa7,
+	0xaf, 0x32, 0x3d, 0x75, 0x49, 0x4c, 0x1f, 0x4f, 0xe8, 0xbc, 0x54, 0xdd, 0x8f, 0xd1, 0x57, 0x37,
+	0x0d, 0xb9, 0xc5, 0x29, 0x5c, 0xc9, 0x06, 0x9c, 0xab, 0x3a, 0xf4, 0xbe, 0x69, 0x77, 0x5c, 0x7f,
+	0xf9, 0xf0, 0xe7, 0xad, 0x73, 0x3b, 0xce, 0x5b, 0x4f, 0x89, 0x8a, 0xcf, 0xb4, 0x1d, 0x7a, 0xbf,
+	0xee, 0x67, 0xb3, 0x8a, 0xa4, 0x1b, 0xe9, 0xc6, 0x9d, 0x89, 0x0b, 0x83, 0x9e, 0x0a, 0xb8, 0x49,
+	0x5d, 0x45, 0x09, 0xa7, 0x5a, 0x1e, 0x62, 0xd6, 0x0c, 0x70, 0xb2, 0xb8, 0x62, 0xc5, 0x88, 0x06,
+	0xe4, 0x46, 0xd9, 0x77, 0x8e, 0x2e, 0x35, 0x1a, 0x76, 0xc7, 0xf2, 0x5c, 0xe5, 0x3c, 0x32, 0x53,
+	0x99, 0x58, 0x56, 0x1b, 0x41, 0x8e, 0xbc, 0xba, 0x2e, 0xf0, 0xb2, 0x58, 0x92, 0xa5, 0xc9, 0x3c,
+	0x14, 0xaa, 0x0e, 0xba, 0x6a, 0xdc, 0xa2, 0x9b, 0x7c, 0xcb, 0x8e, 0x51, 0x97, 0xc4, 0x54, 0xd9,
+	0xe6, 0x38, 0x4c, 0x38, 0xd5, 0x46, 0xac, 0xbc, 0xac, 0xc4, 0x4b, 0xca, 0xb9, 0x94, 0x1e, 0xdb,
+	0x5d, 0x2e, 0x25, 0x0a, 0x05, 0xe1, 0x5a, 0xfd, 0xc0, 0xa3, 0x16, 0x5b, 0xea, 0x5d, 0x11, 0x61,
+	0x49, 0x89, 0xb9, 0x62, 0x07, 0x78, 0x3e, 0x75, 0x88, 0x51, 0x46, 0x03, 0xb0, 0xdc, 0xb0, 0x78,
+	0x91, 0x64, 0xc2, 0xa1, 0xc7, 0xf7, 0x9e, 0x70, 0x88, 0xbc, 0x0a, 0xc3, 0x6c, 0x93, 0x84, 0xbe,
+	0xcc, 0x18, 0x4e, 0x49, 0xe4, 0xcc, 0x79, 0xd7, 0x36, 0xad, 0x3a, 0x26, 0xa0, 0x91, 0xc3, 0x04,
+	0x07, 0xa4, 0x64, 0x06, 0x86, 0x6a, 0x0d, 0xbb, 0x4d, 0xab, 0xa6, 0x25, 0xc2, 0x25, 0x05, 0xe6,
+	0x96, 0x0f, 0xe7, 0xa3, 0xdf, 0x65, 0xbf, 0xea, 0xed, 0x48, 0x52, 0x91, 0xa0, 0xa8, 0xfa, 0x67,
+	0x99, 0x90, 0x0f, 0x29, 0x42, 0x3f, 0xfe, 0x2d, 0x4c, 0x9f, 0xe1, 0xed, 0xad, 0x62, 0x3f, 0x16,
+	0xd7, 0x38, 0x9c, 0x2c, 0xc3, 0x48, 0xe8, 0xcd, 0xed, 0x2a, 0x59, 0x1c, 0x54, 0x4f, 0xc5, 0xeb,
+	0xbd, 0x2a, 0xd1, 0xf0, 0x24, 0x83, 0x18, 0x3d, 0x52, 0x0f, 0xa1, 0x9a, 0xcc, 0xe6, 0xc2, 0xa7,
+	0xa0, 0x10, 0x2f, 0x91, 0x92, 0xc6, 0xee, 0x65, 0x39, 0x8d, 0x9d, 0x7c, 0xcd, 0x2f, 0x6a, 0xb5,
+	0xa8, 0x21, 0x71, 0x91, 0xd3, 0xdc, 0xbd, 0x06, 0x67, 0xd3, 0x89, 0xd8, 0x07, 0x73, 0x13, 0x2c,
+	0x83, 0xfa, 0x8e, 0x1f, 0x8c, 0x26, 0x98, 0x30, 0xbc, 0xd4, 0xff, 0x33, 0x27, 0xaf, 0x8e, 0xe4,
+	0x22, 0xe4, 0xa5, 0xac, 0xd8, 0x98, 0xeb, 0x06, 0x33, 0x08, 0xe6, 0x45, 0x0a, 0xaf, 0x61, 0x7f,
+	0x73, 0xe8, 0x47, 0x0d, 0x1e, 0xdf, 0xde, 0x2a, 0x42, 0x98, 0xff, 0x44, 0x0b, 0x09, 0xc8, 0x35,
+	0x80, 0x6a, 0x67, 0xa5, 0x69, 0x36, 0x30, 0xaf, 0x64, 0x4e, 0x8a, 0xb2, 0x89, 0x50, 0x9e, 0x56,
+	0x52, 0x22, 0x21, 0xd7, 0x61, 0xc4, 0x77, 0xe0, 0x0a, 0x73, 0x3d, 0x61, 0xba, 0x41, 0xb1, 0x96,
+	0x8a, 0x6c, 0x86, 0x12, 0x11, 0xf9, 0x30, 0x40, 0x38, 0x59, 0x0b, 0x3b, 0x18, 0x17, 0x72, 0x79,
+	0x6e, 0x97, 0x17, 0xf2, 0x90, 0x9a, 0x2d, 0x6b, 0xf2, 0x64, 0xb1, 0x29, 0x52, 0x40, 0xe1, 0xb2,
+	0x16, 0x99, 0x61, 0xe4, 0xe1, 0x1b, 0x2d, 0x42, 0x96, 0x60, 0x32, 0x31, 0x3f, 0x88, 0xcc, 0x50,
+	0x4f, 0x6d, 0x6f, 0x15, 0x1f, 0x4f, 0x99, 0x5c, 0x64, 0xb3, 0x29, 0x51, 0x96, 0x3c, 0x0d, 0xb9,
+	0xdb, 0x5a, 0x45, 0x64, 0xa7, 0xe1, 0x89, 0x8d, 0x22, 0xb1, 0xa1, 0x19, 0x96, 0xbc, 0x06, 0xc0,
+	0xb3, 0xec, 0x56, 0x6d, 0xc7, 0x43, 0x7b, 0x6f, 0x8c, 0x27, 0xe8, 0xe3, 0x59, 0x78, 0xeb, 0xcc,
+	0xc8, 0x90, 0x3f, 0x3a, 0x24, 0x56, 0xff, 0x66, 0x36, 0x61, 0x74, 0x30, 0xc1, 0x8b, 0x56, 0x48,
+	0x9d, 0x8f, 0x82, 0xf7, 0x9b, 0xce, 0x05, 0x2f, 0x11, 0x91, 0xcb, 0x30, 0x54, 0x65, 0x53, 0x7e,
+	0xc3, 0x6e, 0x0a, 0x55, 0xc0, 0x10, 0xe5, 0x6d, 0x01, 0xd3, 0x02, 0x2c, 0xb9, 0xce, 0xb3, 0xa6,
+	0x59, 0xb1, 0x5c, 0x71, 0x1d, 0x01, 0x8b, 0x27, 0x4d, 0x63, 0x30, 0x56, 0x26, 0x92, 0x40, 0x5f,
+	0x94, 0x49, 0x31, 0x78, 0xc2, 0x84, 0xf9, 0xc1, 0x76, 0xa3, 0x7f, 0xa7, 0xed, 0x86, 0xfa, 0x73,
+	0x99, 0xe4, 0x04, 0x4a, 0x5e, 0x4e, 0xa6, 0x6d, 0xc2, 0xf9, 0x25, 0x00, 0xca, 0xb5, 0x06, 0x09,
+	0x9c, 0x22, 0x09, 0x98, 0xb2, 0xfb, 0x4e, 0xc0, 0x94, 0xdb, 0x63, 0x02, 0x26, 0xf5, 0xff, 0xcd,
+	0xf7, 0x7c, 0xe3, 0x7d, 0x24, 0x81, 0xfa, 0x5f, 0x63, 0x5b, 0x66, 0x56, 0x7b, 0xc9, 0x4d, 0x6c,
+	0xfc, 0xf8, 0x13, 0xd6, 0xba, 0xce, 0x47, 0xa5, 0xab, 0x45, 0x29, 0xc9, 0x9b, 0x30, 0xea, 0x7f,
+	0x00, 0x26, 0xf6, 0x92, 0x12, 0x52, 0x05, 0xe6, 0x4a, 0x2c, 0x05, 0x56, 0xa4, 0x00, 0x79, 0x05,
+	0x86, 0xd1, 0x58, 0x6d, 0xeb, 0x0d, 0x3f, 0xeb, 0x1b, 0x4f, 0x13, 0xe7, 0x03, 0xe5, 0x55, 0x26,
+	0xa0, 0x24, 0x5f, 0x01, 0x03, 0x22, 0xc5, 0xec, 0x00, 0xce, 0xf5, 0xd7, 0x76, 0xf1, 0x28, 0xfe,
+	0xaa, 0x9c, 0x5e, 0x96, 0x6f, 0x3f, 0x11, 0x10, 0xd9, 0x7e, 0xf2, 0xcc, 0xb2, 0xcb, 0x70, 0xaa,
+	0xea, 0x50, 0x03, 0xc3, 0x2f, 0xcc, 0x3c, 0x68, 0x3b, 0x22, 0xf9, 0x2f, 0x9f, 0x20, 0xd0, 0xfa,
+	0x68, 0xfb, 0x68, 0x66, 0x17, 0x09, 0xbc, 0x9c, 0x7a, 0x2a, 0xa5, 0x38, 0x33, 0x49, 0x79, 0x4b,
+	0x6e, 0xd1, 0xcd, 0x0d, 0xdb, 0x31, 0x78, 0x7e, 0x5c, 0xb1, 0x30, 0x0b, 0x41, 0xaf, 0x0b, 0x94,
+	0x6c, 0x92, 0x46, 0x0b, 0x5d, 0x78, 0x0d, 0x46, 0xf6, 0x9b, 0x58, 0xf5, 0x87, 0xb3, 0x5d, 0xa2,
+	0xa5, 0x1c, 0xcf, 0xb4, 0xca, 0x53, 0xb1, 0xe9, 0x46, 0xb6, 0xa3, 0x04, 0xbc, 0x5b, 0xe3, 0x83,
+	0xe9, 0xa7, 0x08, 0xfd, 0x3c, 0x22, 0x5d, 0x7f, 0x68, 0x5b, 0x7c, 0x1a, 0x9f, 0xaf, 0x70, 0xb8,
+	0xfa, 0x17, 0xd9, 0x2e, 0xa1, 0x60, 0x1e, 0x5d, 0x99, 0xb1, 0x85, 0xc7, 0x17, 0x46, 0x65, 0x1a,
+	0x25, 0x37, 0x26, 0x16, 0x1e, 0x1f, 0xcc, 0x8c, 0x0a, 0x99, 0x88, 0x5c, 0x05, 0xa8, 0xea, 0x8e,
+	0xde, 0xa2, 0x1e, 0xdb, 0x89, 0xf2, 0xb3, 0x1c, 0xb4, 0x42, 0xda, 0x01, 0x54, 0x93, 0x28, 0xd4,
+	0xef, 0xcd, 0xf5, 0x0a, 0x95, 0x73, 0x22, 0xfb, 0xbd, 0xc8, 0xfe, 0x3a, 0x8c, 0x04, 0x92, 0xad,
+	0x4c, 0xa3, 0xbd, 0x34, 0x16, 0x24, 0x84, 0xe6, 0x60, 0x2c, 0x23, 0x11, 0x91, 0x2b, 0xbc, 0xad,
+	0x35, 0xf3, 0x3d, 0x9e, 0x32, 0x73, 0x4c, 0x24, 0x43, 0xd4, 0x3d, 0xbd, 0xee, 0x9a, 0xef, 0x51,
+	0x2d, 0x40, 0xab, 0xff, 0x22, 0x9b, 0x1a, 0x6f, 0xe8, 0xa4, 0x8f, 0xf6, 0xd0, 0x47, 0x29, 0x42,
+	0xe4, 0x91, 0x92, 0x4e, 0x84, 0xb8, 0x07, 0x21, 0xfe, 0xbb, 0x6c, 0x6a, 0x5c, 0xa9, 0x13, 0x21,
+	0xee, 0x65, 0xb6, 0x78, 0x1e, 0x86, 0x35, 0x7b, 0xc3, 0x2d, 0xe3, 0x9e, 0x88, 0xcf, 0x15, 0x38,
+	0x51, 0x3b, 0xf6, 0x86, 0x5b, 0xc7, 0xdd, 0x8e, 0x16, 0x12, 0xa8, 0x7f, 0x95, 0xed, 0x11, 0x79,
+	0xeb, 0x44, 0xf0, 0x5f, 0xca, 0x25, 0xf2, 0xc7, 0xb2, 0x91, 0xc8, 0x5e, 0x8f, 0xae, 0xb0, 0xaf,
+	0x01, 0xd4, 0x1a, 0x6b, 0xb4, 0xa5, 0x4b, 0x69, 0xc7, 0xf1, 0xc8, 0xc2, 0x45, 0x28, 0xdf, 0x06,
+	0x4b, 0x24, 0xea, 0x4f, 0x64, 0x63, 0xa1, 0xcd, 0x4e, 0x64, 0xb7, 0x6b, 0xd9, 0x05, 0x5a, 0x27,
+	0xa2, 0xb5, 0x9d, 0x48, 0x6e, 0xb7, 0x92, 0xfb, 0xfa, 0x6c, 0x2c, 0xb0, 0xdd, 0x23, 0x2b, 0x3b,
+	0x36, 0x00, 0x93, 0x01, 0xf7, 0x1e, 0x59, 0x4d, 0x7a, 0x1e, 0x86, 0x85, 0x1c, 0x82, 0xa5, 0x82,
+	0xcf, 0xfb, 0x1c, 0x88, 0x07, 0xb4, 0x01, 0x81, 0xfa, 0xb7, 0xb3, 0x10, 0x0d, 0x38, 0xf8, 0x88,
+	0xea, 0xd0, 0x8f, 0x65, 0xa3, 0xa1, 0x16, 0x1f, 0x5d, 0xfd, 0xb9, 0x0a, 0x50, 0xeb, 0xac, 0x34,
+	0xc4, 0x83, 0x86, 0x7e, 0xe9, 0x84, 0x3f, 0x80, 0x6a, 0x12, 0x85, 0xfa, 0x1f, 0xb3, 0xa9, 0xf1,
+	0x1f, 0x1f, 0x5d, 0x01, 0xbe, 0x84, 0xa7, 0xe2, 0x0d, 0x2b, 0x9c, 0xc8, 0xf1, 0x10, 0x92, 0x8d,
+	0xbf, 0xf8, 0x65, 0x5e, 0x40, 0x48, 0x3e, 0x94, 0x62, 0xae, 0xe1, 0x15, 0x59, 0x68, 0xae, 0xc9,
+	0x87, 0xf9, 0x92, 0xe1, 0xf6, 0x2b, 0xd9, 0x9d, 0xc2, 0x65, 0x3e, 0xca, 0xab, 0xea, 0x60, 0x55,
+	0xdf, 0xc4, 0xb4, 0x0e, 0xac, 0x27, 0x46, 0xa7, 0xce, 0x6c, 0x6f, 0x15, 0x27, 0xdb, 0x1c, 0x24,
+	0x5f, 0xaa, 0x0a, 0x2a, 0xf5, 0xdf, 0xf4, 0xa7, 0xc7, 0x6a, 0x7c, 0x74, 0x45, 0x78, 0x11, 0xf2,
+	0x55, 0xdd, 0x5b, 0x13, 0x9a, 0x8c, 0xb7, 0x81, 0x6d, 0xdd, 0x5b, 0xd3, 0x10, 0x4a, 0xae, 0xc0,
+	0x90, 0xa6, 0x6f, 0xf0, 0x33, 0x4f, 0x7e, 0x73, 0x86, 0x07, 0x3b, 0x8e, 0xbe, 0x51, 0xe7, 0xe7,
+	0x9e, 0x01, 0x9a, 0xa8, 0x30, 0xb0, 0x40, 0xbd, 0x35, 0xdb, 0x10, 0x27, 0xdf, 0x98, 0xe2, 0xbf,
+	0x85, 0x10, 0x4d, 0x60, 0x58, 0x65, 0x53, 0xb6, 0xb1, 0x89, 0x37, 0x5f, 0xa3, 0xbc, 0xb2, 0x15,
+	0xdb, 0xd8, 0xd4, 0x10, 0x4a, 0xbe, 0x21, 0x03, 0x83, 0x73, 0x54, 0x37, 0xd8, 0x08, 0x19, 0xee,
+	0xe5, 0x4e, 0xf4, 0xf6, 0xe1, 0xb8, 0x13, 0x4d, 0xae, 0xf1, 0xca, 0x64, 0x45, 0x11, 0xf5, 0x93,
+	0x1b, 0x30, 0x54, 0xd6, 0x3d, 0xba, 0x6a, 0x3b, 0x9b, 0xe8, 0x20, 0x35, 0x1e, 0xbe, 0xf7, 0x8f,
+	0xe8, 0x8f, 0x4f, 0xc4, 0x6f, 0xc6, 0x1a, 0xe2, 0x97, 0x16, 0x14, 0x66, 0x62, 0xe1, 0x37, 0x73,
+	0xe8, 0x21, 0x25, 0xc4, 0xc2, 0xaf, 0xf0, 0x34, 0x81, 0x09, 0x8f, 0x95, 0x47, 0xd3, 0x8f, 0x95,
+	0xd1, 0x7a, 0x44, 0x27, 0xca, 0xb2, 0x6d, 0x50, 0xf4, 0x44, 0x1a, 0x13, 0xd6, 0x23, 0x42, 0xeb,
+	0x0d, 0xdb, 0x60, 0xd6, 0x63, 0x40, 0xa2, 0xfe, 0x49, 0x3f, 0xa4, 0x46, 0x76, 0x3b, 0x51, 0xf2,
+	0x13, 0x25, 0x0f, 0x95, 0x7c, 0x3a, 0xa1, 0xe4, 0x17, 0x92, 0xb1, 0x02, 0x1f, 0x52, 0x0d, 0xff,
+	0xb6, 0x7c, 0x22, 0xd2, 0xe8, 0xa3, 0xbd, 0xbb, 0x0c, 0xa5, 0xd7, 0xbf, 0xa3, 0xf4, 0x82, 0x01,
+	0x31, 0xb0, 0xe3, 0x80, 0x18, 0xdc, 0xed, 0x80, 0x18, 0xea, 0x3a, 0x20, 0x42, 0x05, 0x19, 0xee,
+	0xaa, 0x20, 0x15, 0x31, 0x68, 0xa0, 0x77, 0xc6, 0xd3, 0x8b, 0xdb, 0x5b, 0xc5, 0x71, 0x36, 0x9a,
+	0x52, 0x53, 0x9d, 0x22, 0x0b, 0xf5, 0x57, 0xf3, 0x3d, 0xc2, 0x03, 0x1f, 0x89, 0x8e, 0xbc, 0x04,
+	0xb9, 0x52, 0xbb, 0x2d, 0xf4, 0xe3, 0x94, 0x14, 0x99, 0xb8, 0x4b, 0x29, 0x46, 0x4d, 0x3e, 0x0c,
+	0xb9, 0xd2, 0xdd, 0x5a, 0x3c, 0xc9, 0x69, 0xe9, 0x6e, 0x4d, 0x7c, 0x49, 0xd7, 0xb2, 0x77, 0x6b,
+	0xe4, 0x8d, 0x30, 0xdb, 0xc8, 0x5a, 0xc7, 0x5a, 0x17, 0x1b, 0x45, 0xe1, 0x47, 0xed, 0x7b, 0xf2,
+	0x34, 0x18, 0x8a, 0x6d, 0x17, 0x63, 0xb4, 0x31, 0x6d, 0x1a, 0xd8, 0xbd, 0x36, 0x0d, 0xee, 0xa8,
+	0x4d, 0x43, 0xbb, 0xd5, 0xa6, 0xe1, 0x5d, 0x68, 0x13, 0xec, 0xa8, 0x4d, 0x23, 0x07, 0xd7, 0xa6,
+	0x36, 0x5c, 0x48, 0x86, 0x74, 0x0f, 0x34, 0x42, 0x03, 0x92, 0xc4, 0x0a, 0xc7, 0x12, 0xbc, 0xfa,
+	0xef, 0x70, 0x6c, 0x7d, 0x03, 0xd1, 0x75, 0x97, 0xe1, 0x65, 0xc7, 0xc3, 0x64, 0x69, 0xf5, 0x87,
+	0xb3, 0xdd, 0x23, 0xd1, 0x1f, 0xcf, 0x29, 0xee, 0x2b, 0x53, 0xa5, 0x94, 0x8f, 0xbd, 0x81, 0xef,
+	0x2a, 0xe5, 0x18, 0xdb, 0x34, 0x99, 0xfd, 0x50, 0xb6, 0x5b, 0x78, 0xfc, 0x03, 0x49, 0xec, 0x7d,
+	0x49, 0x67, 0x38, 0x7c, 0x80, 0xe1, 0x46, 0xbd, 0xe0, 0x66, 0x61, 0x54, 0x16, 0xa2, 0x90, 0xd2,
+	0x6e, 0x04, 0x1c, 0x29, 0x47, 0xde, 0x08, 0x72, 0xd1, 0x4a, 0xfe, 0x31, 0xe8, 0xe9, 0xe6, 0x8f,
+	0xd9, 0x98, 0x7b, 0x8c, 0x4c, 0x4e, 0x9e, 0x87, 0x81, 0x59, 0x4c, 0xee, 0x26, 0x0f, 0x76, 0x9e,
+	0xee, 0x4d, 0xf6, 0x5a, 0xe1, 0x34, 0xea, 0xcf, 0x65, 0xe0, 0xd4, 0xad, 0xce, 0x0a, 0x15, 0x8e,
+	0x76, 0x41, 0x1b, 0xde, 0x05, 0x60, 0x60, 0xe1, 0x30, 0x93, 0x41, 0x87, 0x99, 0xf7, 0xcb, 0x61,
+	0xf4, 0x63, 0x05, 0xae, 0x86, 0xd4, 0xdc, 0x59, 0xe6, 0x71, 0xdf, 0x23, 0x78, 0xbd, 0xb3, 0x42,
+	0xeb, 0x09, 0xaf, 0x19, 0x89, 0xfb, 0x85, 0x8f, 0xf0, 0xb7, 0x16, 0xfb, 0x75, 0x50, 0xf9, 0xc1,
+	0x6c, 0xd7, 0xcc, 0x05, 0x47, 0x32, 0x4e, 0xa6, 0x60, 0x48, 0xdb, 0x67, 0x4a, 0x75, 0x1f, 0x4f,
+	0x3e, 0x91, 0xda, 0x2b, 0x62, 0xac, 0x3c, 0xd6, 0xa3, 0x1f, 0x62, 0x1c, 0xd3, 0xb8, 0xa4, 0x0b,
+	0xec, 0x08, 0x27, 0x96, 0x87, 0x5e, 0x60, 0xbf, 0x95, 0xe9, 0x9a, 0x61, 0xe2, 0xb8, 0x0a, 0x4c,
+	0xfd, 0xdf, 0x72, 0x7e, 0x62, 0x8b, 0x03, 0x7d, 0xc2, 0xf3, 0x30, 0x2c, 0x62, 0x9d, 0x44, 0xfd,
+	0x84, 0xc5, 0xb1, 0x21, 0x1e, 0x43, 0x07, 0x04, 0xcc, 0xa4, 0x90, 0x5c, 0xcc, 0x25, 0x3f, 0x61,
+	0xc9, 0xbd, 0x5c, 0x93, 0x48, 0x98, 0xd1, 0x30, 0xf3, 0xc0, 0xf4, 0xd0, 0x02, 0x61, 0x7d, 0x99,
+	0xe3, 0x46, 0x03, 0x7d, 0x60, 0x7a, 0xdc, 0xfe, 0x08, 0xd0, 0xcc, 0x20, 0xe0, 0xb6, 0x88, 0x98,
+	0xf7, 0xd0, 0x20, 0xe0, 0xa6, 0x8a, 0x26, 0x30, 0xac, 0xb5, 0xc2, 0xf9, 0x56, 0xb8, 0xb4, 0x88,
+	0xd6, 0x0a, 0x77, 0x5d, 0x6c, 0x6d, 0x40, 0xc0, 0x38, 0x6a, 0x74, 0x35, 0x74, 0xe2, 0x43, 0x8e,
+	0x0e, 0x42, 0x34, 0x81, 0x21, 0xd7, 0x61, 0xbc, 0xe6, 0xe9, 0x96, 0xa1, 0x3b, 0xc6, 0x52, 0xc7,
+	0x6b, 0x77, 0x3c, 0xd9, 0x00, 0x76, 0x3d, 0xc3, 0xee, 0x78, 0x5a, 0x8c, 0x82, 0xbc, 0x00, 0x63,
+	0x3e, 0x64, 0xc6, 0x71, 0x6c, 0x47, 0xb6, 0x72, 0x5c, 0xcf, 0xa0, 0x8e, 0xa3, 0x45, 0x09, 0xc8,
+	0x87, 0x60, 0xac, 0x62, 0x05, 0xa1, 0x3b, 0xb4, 0x79, 0x61, 0xf3, 0xe0, 0x7b, 0x3e, 0x33, 0x40,
+	0xd4, 0x3b, 0x4e, 0x53, 0x8b, 0x12, 0xaa, 0xdb, 0xd9, 0x64, 0xfe, 0x8f, 0x47, 0x77, 0x83, 0x74,
+	0x25, 0xea, 0xb8, 0x87, 0xde, 0xaa, 0x68, 0x7c, 0xca, 0x7e, 0xc3, 0xdc, 0x06, 0xbd, 0x0e, 0x43,
+	0xb7, 0xe8, 0x26, 0xf7, 0x31, 0x1d, 0x08, 0xdd, 0x92, 0xd7, 0x05, 0x4c, 0x3e, 0xdd, 0xf5, 0xe9,
+	0xd4, 0x9f, 0xc9, 0x26, 0x33, 0x9b, 0x3c, 0xba, 0xc2, 0x7e, 0x01, 0x06, 0x51, 0x94, 0x15, 0xff,
+	0x7a, 0x01, 0x05, 0x88, 0xe2, 0x8e, 0x7a, 0x3b, 0xfb, 0x64, 0xea, 0x77, 0x0d, 0xc4, 0xd3, 0xdd,
+	0x3c, 0xba, 0xd2, 0x7b, 0x1d, 0x46, 0xca, 0xb6, 0xe5, 0x62, 0x0c, 0x80, 0x86, 0xaf, 0xb0, 0xe8,
+	0xf8, 0xdf, 0x08, 0xc1, 0xb2, 0x0d, 0x28, 0x51, 0xef, 0x47, 0x79, 0xc9, 0xab, 0x30, 0x8c, 0x22,
+	0x47, 0x9b, 0x73, 0x30, 0x7c, 0xbc, 0xb3, 0xc2, 0x80, 0x71, 0x8b, 0x33, 0x24, 0x25, 0xb7, 0x61,
+	0xa8, 0xbc, 0x66, 0x36, 0x0d, 0x87, 0x5a, 0xe8, 0x9b, 0x2c, 0x3d, 0xa2, 0x89, 0xf6, 0xe5, 0x55,
+	0xfc, 0x17, 0x69, 0x79, 0x73, 0x1a, 0xa2, 0x58, 0xe4, 0x29, 0x9f, 0x80, 0x5d, 0xf8, 0x96, 0x2c,
+	0x40, 0x58, 0x80, 0x3c, 0x09, 0x59, 0xff, 0xbd, 0x38, 0x77, 0x89, 0x89, 0x68, 0x50, 0x16, 0x97,
+	0x0a, 0x31, 0xb6, 0xb3, 0x3b, 0x8e, 0xed, 0xdb, 0x30, 0xc0, 0x4f, 0xd7, 0xd0, 0x6b, 0x5d, 0x0a,
+	0x71, 0xd2, 0xb5, 0xc1, 0x57, 0x91, 0x9e, 0xdb, 0xd2, 0x68, 0x79, 0x46, 0x3c, 0xc0, 0x39, 0xb3,
+	0x0b, 0x0d, 0xe8, 0xc7, 0xbf, 0xc8, 0x25, 0xc8, 0xa3, 0x14, 0x33, 0xb8, 0x67, 0xc6, 0x59, 0x3a,
+	0x26, 0x3f, 0xc4, 0xb3, 0x6e, 0x2a, 0xdb, 0x96, 0x27, 0xde, 0x1f, 0x65, 0x2e, 0x8f, 0x0a, 0xb9,
+	0x08, 0x58, 0x44, 0x2e, 0x02, 0xa6, 0xfe, 0x52, 0x36, 0x25, 0x11, 0xd3, 0xa3, 0x3b, 0x4c, 0x5e,
+	0x03, 0xc0, 0xb8, 0x00, 0x4c, 0x9e, 0xfe, 0x73, 0x10, 0x1c, 0x25, 0xc8, 0x08, 0xd5, 0x36, 0xb2,
+	0xed, 0x08, 0x89, 0xd5, 0x5f, 0xce, 0x24, 0xb2, 0xf7, 0x1c, 0x48, 0x8e, 0xb2, 0x55, 0x96, 0xdd,
+	0xa7, 0x19, 0xeb, 0xf7, 0x45, 0x6e, 0x6f, 0x7d, 0x11, 0xfd, 0x96, 0x43, 0xb0, 0x4c, 0x8f, 0xf2,
+	0x5b, 0xfe, 0x24, 0x9b, 0x96, 0xcb, 0xe8, 0x78, 0xaa, 0xf8, 0xcb, 0x81, 0x51, 0x9a, 0x8f, 0x65,
+	0x8f, 0x43, 0x68, 0xac, 0x98, 0x6f, 0xa6, 0x7e, 0x0a, 0x26, 0x62, 0x19, 0x7e, 0x70, 0xfe, 0x97,
+	0xc2, 0x22, 0xa5, 0xe7, 0x01, 0xea, 0x1e, 0x51, 0x22, 0x42, 0xa6, 0xfe, 0xa7, 0x4c, 0xef, 0xfc,
+	0x4e, 0x47, 0xae, 0x3a, 0x29, 0x02, 0xc8, 0xfd, 0xf5, 0x08, 0xe0, 0x10, 0xb6, 0xc1, 0xc7, 0x5b,
+	0x00, 0x0f, 0xc9, 0xe4, 0xf1, 0xa5, 0x16, 0xc0, 0x77, 0x65, 0x76, 0x4c, 0xcf, 0x75, 0xd4, 0x32,
+	0x50, 0xff, 0x55, 0x26, 0x35, 0x8d, 0xd6, 0x81, 0xda, 0xf5, 0x06, 0x0c, 0x70, 0x17, 0x1e, 0xd1,
+	0x2a, 0x29, 0xf1, 0x38, 0x83, 0x76, 0x29, 0x2f, 0xca, 0x90, 0x79, 0x18, 0xe4, 0x6d, 0x30, 0x44,
+	0x6f, 0x3c, 0xd3, 0x23, 0x97, 0x97, 0xd1, 0x6d, 0x72, 0x14, 0x68, 0xf5, 0xe7, 0x33, 0x89, 0xac,
+	0x5e, 0x47, 0xf8, 0x6d, 0xe1, 0x54, 0x9d, 0xdb, 0xfd, 0x54, 0xad, 0xfe, 0x69, 0x36, 0x3d, 0xa9,
+	0xd8, 0x11, 0x7e, 0xc8, 0x61, 0x1c, 0xa7, 0xed, 0x6f, 0xdd, 0x5a, 0x86, 0xf1, 0xa8, 0x2c, 0xc4,
+	0xb2, 0xf5, 0x44, 0x7a, 0x6a, 0xb5, 0x2e, 0xad, 0x88, 0xf1, 0x50, 0x3f, 0x9f, 0x4d, 0xe6, 0x43,
+	0x3b, 0xf2, 0xf9, 0x69, 0x5f, 0xda, 0x42, 0x2a, 0x30, 0x11, 0x7e, 0xc9, 0xb2, 0xe9, 0x35, 0xfd,
+	0xd3, 0x7d, 0x8c, 0xd8, 0x20, 0x22, 0x8c, 0x34, 0x4d, 0xd7, 0xab, 0x7b, 0x0c, 0x19, 0x89, 0x75,
+	0x11, 0x2d, 0x17, 0x93, 0xca, 0x43, 0xb2, 0x6c, 0x3d, 0x64, 0x52, 0x79, 0x48, 0xd6, 0xb2, 0x23,
+	0x97, 0xca, 0xf7, 0x65, 0xbb, 0xe5, 0xcb, 0x3b, 0x72, 0xd9, 0x7c, 0x5c, 0xee, 0x2f, 0xde, 0x32,
+	0x21, 0xa5, 0x27, 0xbb, 0x25, 0xa8, 0xeb, 0xc2, 0x33, 0xc1, 0x67, 0x7f, 0x93, 0x58, 0xaa, 0xb0,
+	0x1e, 0x92, 0xe1, 0x75, 0x3c, 0x84, 0xf5, 0x90, 0x8c, 0xba, 0x87, 0x4f, 0x58, 0x3f, 0x99, 0xdd,
+	0x6d, 0x92, 0xc6, 0x13, 0xe1, 0x25, 0x84, 0xf7, 0xd9, 0x6c, 0x32, 0x79, 0xe8, 0x91, 0x8b, 0x69,
+	0x16, 0x06, 0x44, 0x1a, 0xd3, 0xae, 0xc2, 0xe1, 0xf8, 0x6e, 0x26, 0x9b, 0xf8, 0x8e, 0x97, 0x41,
+	0xdc, 0x54, 0xed, 0x4e, 0x24, 0x9c, 0x56, 0xfd, 0xab, 0x4c, 0x2c, 0xd3, 0xe6, 0x91, 0x9c, 0x91,
+	0xec, 0x6f, 0x75, 0xfb, 0x88, 0x7f, 0x5a, 0x9b, 0x8f, 0xc5, 0x9a, 0x0f, 0xbe, 0x67, 0x9a, 0x7a,
+	0xba, 0xd9, 0x8c, 0x97, 0x17, 0x01, 0x16, 0x7e, 0x26, 0x0b, 0x93, 0x09, 0x52, 0x72, 0x29, 0x12,
+	0xd2, 0x08, 0xcf, 0x5d, 0x63, 0x9e, 0xf8, 0x3c, 0xb8, 0xd1, 0x1e, 0x8e, 0x8a, 0x2f, 0x41, 0x7e,
+	0x5a, 0xdf, 0xe4, 0xdf, 0xd6, 0xcf, 0x59, 0x1a, 0xfa, 0xa6, 0x7c, 0xa4, 0x88, 0x78, 0xb2, 0x02,
+	0x67, 0xf8, 0x85, 0x8f, 0x69, 0x5b, 0xcb, 0x66, 0x8b, 0x56, 0xac, 0x05, 0xb3, 0xd9, 0x34, 0x5d,
+	0x71, 0x6b, 0xf9, 0xfc, 0xf6, 0x56, 0xf1, 0xb2, 0x67, 0x7b, 0x7a, 0xb3, 0x4e, 0x7d, 0xb2, 0xba,
+	0x67, 0xb6, 0x68, 0xdd, 0xb4, 0xea, 0x2d, 0xa4, 0x94, 0x58, 0xa6, 0xb3, 0x22, 0x15, 0x9e, 0xd4,
+	0xae, 0xd6, 0xd0, 0x2d, 0x8b, 0x1a, 0x15, 0x6b, 0x6a, 0xd3, 0xa3, 0xfc, 0xb6, 0x33, 0xc7, 0xcf,
+	0x3c, 0xf9, 0x43, 0x7b, 0x8e, 0x66, 0x8c, 0x57, 0x18, 0x81, 0x96, 0x52, 0x48, 0xfd, 0xa9, 0x7c,
+	0x4a, 0x92, 0xd5, 0x63, 0xa4, 0x3e, 0x7e, 0x4f, 0xe7, 0x77, 0xe8, 0xe9, 0x6b, 0x30, 0x28, 0xb2,
+	0x06, 0x89, 0x1b, 0x14, 0x7c, 0x19, 0x70, 0x9f, 0x83, 0xe4, 0x2b, 0x28, 0x41, 0x45, 0x9a, 0x70,
+	0x61, 0x99, 0x75, 0x53, 0x7a, 0x67, 0x0e, 0xec, 0xa3, 0x33, 0x7b, 0xf0, 0x23, 0xef, 0xc0, 0x39,
+	0xc4, 0xa6, 0x74, 0xeb, 0x20, 0x56, 0x85, 0xb6, 0x1e, 0xaf, 0x2a, 0xbd, 0x73, 0xbb, 0x95, 0x27,
+	0x1f, 0x87, 0xd1, 0x60, 0x80, 0x98, 0xd4, 0x15, 0x57, 0x33, 0x3d, 0xc6, 0x19, 0x0f, 0x93, 0xc8,
+	0xc0, 0xe8, 0x8f, 0x17, 0x0d, 0xb5, 0x17, 0xe1, 0xa5, 0xfe, 0x51, 0xa6, 0x57, 0xb2, 0xd7, 0x23,
+	0x9f, 0x95, 0x3f, 0x02, 0x83, 0x06, 0xff, 0x28, 0xa1, 0x53, 0xbd, 0xd3, 0xc1, 0x72, 0x52, 0xcd,
+	0x2f, 0xa3, 0xfe, 0x71, 0xa6, 0x67, 0x8e, 0xd9, 0xe3, 0xfe, 0x79, 0x9f, 0xcd, 0x75, 0xf9, 0x3c,
+	0x31, 0x89, 0x5e, 0x81, 0x82, 0x19, 0x26, 0xc1, 0xab, 0x87, 0xb1, 0xbc, 0xb4, 0x09, 0x09, 0x8e,
+	0xa3, 0xeb, 0x65, 0x08, 0x3c, 0xd2, 0x1c, 0xdf, 0xdd, 0xce, 0xad, 0x77, 0x1c, 0x93, 0x8f, 0x4b,
+	0xed, 0xb4, 0x1b, 0xf3, 0xc5, 0x73, 0x6f, 0x3b, 0x26, 0xab, 0x40, 0xf7, 0xd6, 0xa8, 0xa5, 0xd7,
+	0x37, 0x6c, 0x67, 0x1d, 0x63, 0xf1, 0xf2, 0xc1, 0xa9, 0x4d, 0x70, 0xf8, 0x5d, 0x1f, 0x4c, 0x9e,
+	0x86, 0xb1, 0xd5, 0x66, 0x87, 0x06, 0xd1, 0x4f, 0xf9, 0x65, 0xa6, 0x36, 0xca, 0x80, 0xc1, 0x15,
+	0xd0, 0xe3, 0x00, 0x48, 0x84, 0x19, 0x67, 0xf8, 0xcd, 0xa5, 0x36, 0xcc, 0x20, 0xcb, 0xa2, 0xbb,
+	0x2e, 0x70, 0xad, 0xe6, 0x42, 0xaa, 0x37, 0x6d, 0x6b, 0xb5, 0xee, 0x51, 0xa7, 0x85, 0x0d, 0x45,
+	0x6f, 0x0d, 0xed, 0x2c, 0x52, 0xe0, 0xdd, 0x90, 0x3b, 0x6f, 0x5b, 0xab, 0xcb, 0xd4, 0x69, 0xb1,
+	0xa6, 0x3e, 0x0f, 0x44, 0x34, 0xd5, 0xc1, 0x53, 0x1d, 0xfe, 0x71, 0xe8, 0xae, 0xa1, 0x89, 0x8f,
+	0xe0, 0xc7, 0x3d, 0xf8, 0x61, 0x45, 0x18, 0xe1, 0x21, 0x20, 0xb9, 0xd0, 0xd0, 0x47, 0x43, 0x03,
+	0x0e, 0x42, 0x79, 0x9d, 0x05, 0xe1, 0x3e, 0xc2, 0x5d, 0xe4, 0x35, 0xf1, 0x4b, 0xfd, 0x4c, 0x2e,
+	0x2d, 0x2d, 0xee, 0x81, 0x14, 0x2d, 0x9c, 0x56, 0xb3, 0x7b, 0x9a, 0x56, 0x27, 0xac, 0x4e, 0xab,
+	0xae, 0xb7, 0xdb, 0xf5, 0x7b, 0x66, 0x13, 0xdf, 0xa8, 0xe1, 0xc2, 0xa7, 0x8d, 0x59, 0x9d, 0x56,
+	0xa9, 0xdd, 0x9e, 0xe5, 0x40, 0xf2, 0x1c, 0x4c, 0x32, 0x3a, 0xec, 0xa4, 0x80, 0x32, 0x8f, 0x94,
+	0x8c, 0x01, 0xc6, 0x50, 0xf6, 0x69, 0xcf, 0xc3, 0x90, 0xe0, 0xc9, 0xd7, 0xaa, 0x7e, 0x6d, 0x90,
+	0x33, 0x73, 0x59, 0xcf, 0x05, 0x6c, 0xf8, 0xe4, 0xda, 0xaf, 0x0d, 0xfb, 0xe5, 0x31, 0x52, 0xb8,
+	0xd5, 0x69, 0xf1, 0xf0, 0x62, 0x83, 0x88, 0x0c, 0x7e, 0x93, 0x4b, 0x30, 0xce, 0xb8, 0x04, 0x02,
+	0xe3, 0xc1, 0x95, 0xfb, 0xb5, 0x18, 0x94, 0x5c, 0x87, 0xd3, 0x11, 0x08, 0xb7, 0x41, 0xf9, 0x9b,
+	0x8b, 0x7e, 0x2d, 0x15, 0xa7, 0xfe, 0x44, 0x2e, 0x9a, 0xac, 0xf7, 0x08, 0x3a, 0xe2, 0x1c, 0x0c,
+	0xda, 0xce, 0x6a, 0xbd, 0xe3, 0x34, 0xc5, 0xd8, 0x1b, 0xb0, 0x9d, 0xd5, 0xdb, 0x4e, 0x93, 0x9c,
+	0x81, 0x01, 0xd6, 0x3b, 0xa6, 0x21, 0x86, 0x58, 0xbf, 0xde, 0x6e, 0x57, 0x0c, 0x52, 0xe2, 0x1d,
+	0x82, 0x81, 0x79, 0xeb, 0x0d, 0xdc, 0xda, 0x73, 0xaf, 0x8b, 0x7e, 0xbe, 0xe2, 0x25, 0x90, 0xd8,
+	0x4f, 0x18, 0xae, 0x97, 0x1f, 0x04, 0xc4, 0x58, 0x18, 0xb8, 0x2d, 0x31, 0x78, 0x9f, 0xc4, 0x59,
+	0x08, 0x64, 0xc8, 0x82, 0x6f, 0x62, 0x0c, 0x32, 0x0d, 0x24, 0xa4, 0x6a, 0xd9, 0x86, 0x79, 0xcf,
+	0xa4, 0xfc, 0x89, 0x4c, 0x3f, 0xbf, 0xd9, 0x4e, 0x62, 0xb5, 0x82, 0xcf, 0x64, 0x41, 0x40, 0xc8,
+	0xeb, 0x5c, 0x09, 0x39, 0x1d, 0xae, 0x7d, 0xbc, 0x6f, 0xb9, 0x9d, 0x16, 0x43, 0xa1, 0x66, 0x62,
+	0x79, 0x5c, 0x08, 0xd5, 0x45, 0x18, 0x43, 0x3f, 0xd2, 0x1a, 0x6d, 0x62, 0x2e, 0x74, 0x72, 0x1e,
+	0x72, 0xb7, 0x7c, 0x4f, 0x52, 0xee, 0xb5, 0xbb, 0x4e, 0x37, 0x35, 0x06, 0x23, 0x6a, 0xe0, 0x06,
+	0x90, 0xc5, 0x7b, 0x63, 0x74, 0xc0, 0xe2, 0xb7, 0xfb, 0xfe, 0x9d, 0xbe, 0xfa, 0x3b, 0x83, 0xc9,
+	0x0c, 0xd0, 0x47, 0x62, 0x27, 0xcd, 0x01, 0x88, 0x04, 0xef, 0xe1, 0x6d, 0xe4, 0x05, 0x29, 0x9b,
+	0x9b, 0xc0, 0x74, 0xe1, 0x21, 0x95, 0x25, 0x57, 0x60, 0x88, 0x7f, 0x51, 0x65, 0x5a, 0xd8, 0x4f,
+	0xe8, 0x53, 0xe7, 0xb6, 0xcd, 0x7b, 0xf7, 0xd0, 0x01, 0x2f, 0x40, 0x93, 0x4b, 0x30, 0x38, 0xbd,
+	0x58, 0xab, 0x95, 0x16, 0xfd, 0xab, 0x75, 0x7c, 0xfc, 0x63, 0x58, 0x6e, 0xdd, 0xd5, 0x2d, 0x57,
+	0xf3, 0x91, 0xe4, 0x69, 0x18, 0xa8, 0x54, 0x91, 0x8c, 0x3f, 0x69, 0x1d, 0xd9, 0xde, 0x2a, 0x0e,
+	0x9a, 0x6d, 0x4e, 0x25, 0x50, 0x58, 0xef, 0x9d, 0xca, 0xb4, 0xe4, 0x5f, 0xc2, 0xeb, 0xbd, 0x6f,
+	0x1a, 0x78, 0x4f, 0xaf, 0x05, 0x68, 0xf2, 0x0a, 0x8c, 0xd6, 0xa8, 0x63, 0xea, 0xcd, 0xc5, 0x0e,
+	0x6e, 0x3d, 0xa5, 0x10, 0x99, 0x2e, 0xc2, 0xeb, 0x16, 0x22, 0xb4, 0x08, 0x19, 0xb9, 0x08, 0xf9,
+	0x39, 0xd3, 0xf2, 0xdf, 0x97, 0xe0, 0x03, 0x84, 0x35, 0xd3, 0xf2, 0x34, 0x84, 0x92, 0xa7, 0x21,
+	0x77, 0x73, 0xb9, 0x22, 0x5c, 0xe7, 0x90, 0xd7, 0xbb, 0x5e, 0x24, 0xdc, 0xe6, 0xcd, 0xe5, 0x0a,
+	0x79, 0x05, 0x86, 0xd9, 0xa2, 0x48, 0xad, 0x06, 0x75, 0x95, 0x11, 0xfc, 0x18, 0x1e, 0xe3, 0xd1,
+	0x07, 0xca, 0x4e, 0x30, 0x01, 0x25, 0xb9, 0x05, 0x85, 0x78, 0xa6, 0x23, 0xf1, 0xc6, 0x09, 0x2d,
+	0xb8, 0x0d, 0x81, 0x4b, 0x8b, 0x32, 0x9a, 0x28, 0x48, 0x0c, 0x50, 0xe2, 0x30, 0xb6, 0x4f, 0x44,
+	0x2b, 0x96, 0x87, 0x1f, 0xbf, 0xbc, 0xbd, 0x55, 0x7c, 0x26, 0xc1, 0xb4, 0xee, 0x08, 0x2a, 0x89,
+	0x7b, 0x57, 0x4e, 0xe4, 0x13, 0x00, 0x25, 0xcf, 0x73, 0xcc, 0x95, 0x0e, 0x33, 0x37, 0xc7, 0x7b,
+	0x3f, 0x91, 0x50, 0xb7, 0xb7, 0x8a, 0xa7, 0xf5, 0x80, 0x3c, 0xf5, 0xa1, 0x84, 0xc4, 0x8e, 0xbc,
+	0x09, 0xa3, 0x6c, 0xc5, 0xf3, 0x47, 0xa1, 0x32, 0x11, 0xc6, 0x78, 0x64, 0x6b, 0x63, 0xdd, 0x15,
+	0x08, 0xd9, 0xc4, 0x94, 0x0b, 0x90, 0x4f, 0xc2, 0x78, 0x64, 0x1c, 0xf3, 0x40, 0xe4, 0x52, 0xc2,
+	0x9d, 0x08, 0x96, 0x87, 0x43, 0x44, 0x27, 0xf3, 0x80, 0x75, 0x24, 0x1c, 0x62, 0x94, 0x97, 0xfa,
+	0x7f, 0x65, 0xd3, 0x33, 0xaa, 0x1f, 0xc1, 0x4c, 0xbf, 0x4f, 0x2f, 0x89, 0xd8, 0x7c, 0x90, 0x3f,
+	0xc0, 0x7c, 0x70, 0x0f, 0x26, 0x4a, 0x46, 0xcb, 0xb4, 0x4a, 0x3c, 0x09, 0xca, 0xc2, 0x6c, 0x09,
+	0x57, 0x0e, 0xe9, 0xa9, 0x6b, 0x0c, 0x2d, 0xbe, 0x87, 0x47, 0x45, 0x67, 0xa8, 0xba, 0xce, 0x71,
+	0xf5, 0xd6, 0x3d, 0xbd, 0xde, 0xe0, 0xc9, 0xc8, 0xb5, 0x38, 0x53, 0xf5, 0xf3, 0xd9, 0x1d, 0x92,
+	0xc0, 0x3f, 0x8a, 0xd2, 0x57, 0x3f, 0x97, 0xed, 0x9d, 0x87, 0xff, 0x91, 0x14, 0xca, 0xbf, 0xcb,
+	0xa6, 0x64, 0xc5, 0x3f, 0x90, 0x24, 0xae, 0xc0, 0x10, 0x67, 0x13, 0xb8, 0xa9, 0xe3, 0xe2, 0xc3,
+	0x95, 0x15, 0x17, 0x3d, 0x1f, 0x4d, 0x16, 0xe1, 0x74, 0xe9, 0xde, 0x3d, 0xda, 0xf0, 0xc2, 0xf8,
+	0xf8, 0x8b, 0x61, 0x40, 0x63, 0x1e, 0x71, 0x5a, 0xe0, 0xc3, 0xf8, 0xfa, 0x18, 0xb8, 0x27, 0xb5,
+	0x1c, 0x59, 0x86, 0xb3, 0x71, 0x78, 0x8d, 0xef, 0x00, 0xf3, 0x52, 0x10, 0xea, 0x04, 0x47, 0xfe,
+	0x9f, 0xd6, 0xa5, 0x6c, 0x5a, 0x2b, 0x71, 0x65, 0xed, 0xef, 0xd5, 0x4a, 0x5c, 0x66, 0x53, 0xcb,
+	0xa9, 0x3f, 0x93, 0x03, 0xa8, 0xb5, 0x75, 0xcb, 0xc2, 0xe8, 0x1e, 0x8f, 0xae, 0x43, 0xe1, 0xcb,
+	0x91, 0x67, 0x04, 0xbb, 0x1d, 0x32, 0xaf, 0x88, 0x68, 0x3c, 0x46, 0xc7, 0xf1, 0x3d, 0x6e, 0x83,
+	0x68, 0x20, 0x08, 0x94, 0xcd, 0x86, 0x80, 0x92, 0x54, 0x20, 0x5f, 0x72, 0x56, 0xf9, 0xee, 0x66,
+	0xa7, 0x07, 0x8a, 0xba, 0xb3, 0x9a, 0xbe, 0xee, 0x22, 0x0b, 0xf5, 0x9b, 0xb3, 0x3d, 0xf2, 0xfd,
+	0x3f, 0x92, 0x93, 0xc8, 0x77, 0x64, 0xbb, 0x65, 0xee, 0x3f, 0xae, 0xae, 0x91, 0x5f, 0x62, 0xe1,
+	0x1c, 0x6f, 0xbf, 0xd1, 0x43, 0x14, 0xce, 0x6f, 0x66, 0x93, 0x09, 0xfd, 0x4f, 0x34, 0x47, 0x98,
+	0x8b, 0xfb, 0x9a, 0x20, 0x53, 0x45, 0xfa, 0x08, 0xdb, 0xdc, 0xb2, 0x2a, 0xf4, 0xef, 0xd3, 0x3d,
+	0x30, 0x4d, 0xa4, 0x27, 0x43, 0xf8, 0x40, 0x5a, 0xfa, 0x5b, 0x59, 0x38, 0x17, 0x8a, 0x54, 0xdc,
+	0x09, 0x9d, 0x8c, 0xfc, 0xc3, 0x97, 0xe9, 0xc9, 0xd0, 0x3f, 0xd0, 0xd0, 0x4f, 0x95, 0xe9, 0xc9,
+	0xd8, 0x3f, 0x90, 0x9e, 0x7e, 0x7f, 0x76, 0x87, 0x14, 0xdc, 0xc7, 0xfc, 0xd8, 0xf7, 0x2c, 0x0c,
+	0x88, 0x8b, 0x16, 0x4c, 0xbc, 0xa9, 0x89, 0x5f, 0xfb, 0x94, 0xd6, 0x3f, 0xcd, 0xee, 0x98, 0x40,
+	0xfc, 0x44, 0x5e, 0x92, 0xbc, 0x7e, 0x20, 0xbb, 0x53, 0xea, 0xf3, 0x13, 0x71, 0x49, 0xe2, 0xfa,
+	0x8d, 0x2c, 0x9c, 0x66, 0x7f, 0x9a, 0x8d, 0x39, 0xdb, 0xf5, 0x58, 0x53, 0x0f, 0x61, 0x15, 0xde,
+	0xdf, 0x8a, 0x71, 0x18, 0xee, 0xf4, 0x7e, 0xf7, 0xe4, 0x0f, 0xd4, 0x3d, 0xfd, 0x07, 0xd8, 0xd2,
+	0x24, 0x05, 0x7a, 0x64, 0x4b, 0xf0, 0x97, 0xab, 0x40, 0x0f, 0x61, 0xfd, 0x7d, 0x94, 0x05, 0xfa,
+	0x77, 0x73, 0x50, 0x28, 0x3b, 0xf6, 0x86, 0x75, 0x93, 0x6e, 0xd0, 0xe6, 0x91, 0x0d, 0xf7, 0x87,
+	0xc2, 0x40, 0x74, 0xf6, 0x69, 0x20, 0xfa, 0xe5, 0xc8, 0x9b, 0x30, 0x11, 0xca, 0x52, 0x0e, 0x69,
+	0x89, 0x57, 0xf9, 0x0d, 0x86, 0xaa, 0xbf, 0xcb, 0x70, 0x22, 0xf6, 0x5a, 0x9c, 0x5a, 0xfd, 0xab,
+	0x48, 0x6f, 0x3c, 0xda, 0xe6, 0xfa, 0x81, 0x7b, 0xe3, 0x36, 0x9c, 0x2d, 0x77, 0x1c, 0x87, 0x5a,
+	0x5e, 0x7a, 0xa7, 0xe0, 0x4d, 0x5a, 0x83, 0x53, 0xd4, 0x93, 0x9d, 0xd3, 0xa5, 0x30, 0x63, 0x2b,
+	0x9e, 0xd2, 0xc5, 0xd9, 0x0e, 0x86, 0x6c, 0x3b, 0x9c, 0x22, 0x8d, 0x6d, 0x7a, 0x61, 0xf5, 0x57,
+	0xb2, 0x72, 0xd7, 0x1f, 0xd9, 0xac, 0xf6, 0x65, 0xd1, 0xf5, 0xea, 0x67, 0x72, 0x30, 0xce, 0x9a,
+	0xb5, 0xac, 0xbb, 0xeb, 0x27, 0x26, 0xcc, 0x41, 0x16, 0x08, 0xf6, 0x15, 0xbe, 0x24, 0x71, 0xdc,
+	0x48, 0x5f, 0xe1, 0xc3, 0xbb, 0x7d, 0x85, 0x8f, 0x57, 0x7f, 0x30, 0x1f, 0x76, 0xc7, 0x89, 0x01,
+	0x74, 0xd4, 0xdd, 0x41, 0x96, 0xe0, 0xb4, 0x98, 0xdb, 0x7c, 0x10, 0xe6, 0x36, 0x12, 0xf3, 0x17,
+	0x4f, 0x91, 0x2a, 0xa6, 0xc5, 0x8e, 0x4b, 0x9d, 0xba, 0xa7, 0xbb, 0xeb, 0x75, 0x4c, 0x86, 0xa4,
+	0xa5, 0x16, 0x64, 0x0c, 0xc5, 0xac, 0x16, 0x65, 0x38, 0x14, 0x32, 0xf4, 0x27, 0xc4, 0x04, 0xc3,
+	0xb4, 0x82, 0xea, 0x8f, 0x65, 0xa0, 0x10, 0xff, 0x1c, 0x72, 0x15, 0x86, 0xd8, 0xef, 0x20, 0xc6,
+	0x8b, 0xf0, 0x40, 0x0f, 0x39, 0x72, 0x77, 0x26, 0x9f, 0x86, 0xbc, 0x0a, 0xc3, 0xe8, 0x39, 0x86,
+	0x05, 0xb2, 0x61, 0x68, 0x9d, 0xb0, 0x00, 0xa6, 0x7b, 0xe7, 0xc5, 0x42, 0x52, 0xf2, 0x3a, 0x8c,
+	0x54, 0x42, 0x97, 0x5b, 0x71, 0x01, 0x8d, 0x9e, 0xfe, 0x52, 0xc9, 0x90, 0x40, 0x93, 0xa9, 0xd5,
+	0x2f, 0x66, 0x43, 0x55, 0x3f, 0x31, 0x4d, 0x0f, 0x64, 0x9a, 0xfe, 0x70, 0x0e, 0xc6, 0xca, 0xb6,
+	0xe5, 0xe9, 0x0d, 0xef, 0xe4, 0x30, 0xf8, 0x20, 0x87, 0x6c, 0xa4, 0x08, 0xfd, 0x33, 0x2d, 0xdd,
+	0x6c, 0x0a, 0xc3, 0x07, 0x03, 0x80, 0x53, 0x06, 0xd0, 0x38, 0x9c, 0xdc, 0xc0, 0xb0, 0x57, 0x4c,
+	0xd2, 0x81, 0x9f, 0xe0, 0x78, 0x18, 0x2b, 0x59, 0x42, 0x89, 0x6c, 0xe1, 0x1c, 0xc0, 0x47, 0x8e,
+	0x5c, 0x52, 0xee, 0xb3, 0x93, 0x83, 0xd1, 0x63, 0xd2, 0x67, 0xdf, 0x96, 0x83, 0xb3, 0x71, 0x7f,
+	0xc5, 0x93, 0x01, 0x27, 0x3a, 0xef, 0x6f, 0xc0, 0xe9, 0xb8, 0x6c, 0xa6, 0x99, 0x34, 0xfa, 0x7b,
+	0xfb, 0x8e, 0x5c, 0xdd, 0xde, 0x2a, 0x3e, 0x99, 0x74, 0x15, 0x65, 0x95, 0xa5, 0x7a, 0x93, 0xa4,
+	0x56, 0x92, 0xda, 0x33, 0x0f, 0xc9, 0xa3, 0xe8, 0x47, 0xbc, 0x67, 0xbe, 0x23, 0x9b, 0xec, 0x99,
+	0x93, 0x09, 0x4f, 0x2c, 0xdc, 0xbf, 0x96, 0x85, 0x67, 0xe2, 0xc2, 0x79, 0xfb, 0x95, 0x17, 0x5e,
+	0xd3, 0xa8, 0x1f, 0x23, 0xf5, 0x64, 0x7a, 0x11, 0x4a, 0x8c, 0xc1, 0x6e, 0x75, 0x37, 0x78, 0x28,
+	0x29, 0x82, 0xdd, 0x32, 0x88, 0x26, 0x30, 0xbb, 0x10, 0xe7, 0xc9, 0x9c, 0xb0, 0x07, 0x71, 0x7e,
+	0xef, 0x8e, 0xe2, 0x3c, 0x19, 0xc8, 0xbe, 0xbb, 0x5a, 0x1e, 0xe0, 0x86, 0xe9, 0x89, 0x48, 0xd2,
+	0xc7, 0xfc, 0xaa, 0x4c, 0xf2, 0x73, 0xcd, 0xef, 0xcb, 0xcf, 0x35, 0x8c, 0x0f, 0xd5, 0xbf, 0x8f,
+	0xf8, 0x50, 0x6f, 0xc2, 0xa0, 0x90, 0xa3, 0xd8, 0xb7, 0x9f, 0x0b, 0xbf, 0x02, 0xc1, 0xdd, 0xaa,
+	0xf7, 0xa5, 0xff, 0x3e, 0x18, 0x74, 0x79, 0xcc, 0x34, 0xb1, 0xaf, 0xc6, 0xe7, 0x3e, 0x02, 0xa4,
+	0xf9, 0x7f, 0x90, 0x8b, 0x80, 0xe9, 0x3f, 0xe4, 0xd7, 0x38, 0x3c, 0x1d, 0x08, 0xfb, 0x97, 0x54,
+	0x60, 0x50, 0xbc, 0x1a, 0x50, 0x00, 0x5f, 0x76, 0x04, 0x6a, 0x19, 0xf6, 0x33, 0x7f, 0x3c, 0xc0,
+	0xcf, 0xac, 0x05, 0xb1, 0xfc, 0x66, 0x5b, 0x80, 0xd4, 0x9f, 0xcf, 0x40, 0x21, 0x5e, 0x88, 0x3c,
+	0x0f, 0x03, 0xfc, 0x2f, 0xb1, 0x43, 0xc7, 0xd0, 0xad, 0xbc, 0x84, 0x1c, 0xba, 0x55, 0x50, 0xbf,
+	0x02, 0xc3, 0x9a, 0xff, 0x14, 0x44, 0xec, 0xd0, 0xd1, 0x7f, 0x37, 0x78, 0x1f, 0x22, 0xfb, 0xef,
+	0x06, 0x94, 0xe4, 0x69, 0xc8, 0x2d, 0x35, 0x0d, 0xb1, 0x31, 0xc7, 0x27, 0x45, 0x76, 0x53, 0x8e,
+	0x4b, 0xcb, 0xb0, 0x8c, 0x68, 0x91, 0x6e, 0x08, 0x67, 0x6f, 0x24, 0xb2, 0xe8, 0x86, 0x4c, 0xb4,
+	0x48, 0x37, 0xd4, 0x5f, 0xcf, 0xf8, 0xee, 0xbb, 0xf3, 0xa6, 0xeb, 0x55, 0xac, 0xfb, 0x7a, 0xd3,
+	0x0c, 0x3a, 0x82, 0xdc, 0x80, 0xf1, 0x10, 0x29, 0x85, 0x38, 0x48, 0x84, 0x02, 0xc2, 0x47, 0xf0,
+	0x4f, 0x4a, 0x0f, 0x5f, 0xa2, 0xc5, 0xc8, 0x25, 0x49, 0xf9, 0xa5, 0x53, 0x0b, 0xf9, 0xdd, 0xbc,
+	0x70, 0xc5, 0x1e, 0x5d, 0x30, 0x5d, 0xd7, 0xb4, 0x56, 0xf9, 0xf3, 0xcb, 0x1c, 0xbe, 0x84, 0xc2,
+	0xf3, 0x93, 0x16, 0x87, 0xd7, 0x1d, 0x86, 0x90, 0xdf, 0xef, 0xc8, 0x05, 0xd4, 0xff, 0x98, 0x81,
+	0x0b, 0x8c, 0x13, 0x06, 0x25, 0x4d, 0x7c, 0xd8, 0x81, 0x06, 0x70, 0xab, 0x87, 0xa4, 0xc4, 0xa8,
+	0x7e, 0x2a, 0x19, 0x87, 0x23, 0x46, 0x18, 0xe3, 0xde, 0x43, 0xf6, 0xfb, 0x8b, 0x0b, 0xf7, 0x6b,
+	0x19, 0xbc, 0x1e, 0x5c, 0x69, 0xd2, 0xdb, 0x8b, 0x95, 0xb7, 0x0f, 0xe9, 0x02, 0x7b, 0xbf, 0x53,
+	0xd7, 0x5b, 0x50, 0x70, 0xb1, 0x2d, 0xf5, 0x8e, 0x65, 0x3e, 0xc0, 0x93, 0x2f, 0xf1, 0x31, 0x67,
+	0xa5, 0x8f, 0x91, 0xda, 0xaa, 0x8d, 0x73, 0xfa, 0xdb, 0x96, 0xf9, 0x00, 0x63, 0xb2, 0x7e, 0x14,
+	0xc3, 0xdc, 0x4b, 0x14, 0xe4, 0x02, 0x0c, 0x31, 0x3e, 0x56, 0xa0, 0x8c, 0x5a, 0xf0, 0x9b, 0x14,
+	0x20, 0xd7, 0x31, 0x0d, 0x6c, 0x66, 0xbf, 0xc6, 0xfe, 0x54, 0x7f, 0x2f, 0x07, 0x93, 0xa5, 0xbb,
+	0xb5, 0x4a, 0x39, 0x78, 0xc5, 0x20, 0xde, 0xd5, 0xb6, 0xf6, 0x28, 0x0b, 0x9f, 0x9e, 0x94, 0x61,
+	0x9c, 0xc7, 0x45, 0x10, 0xb1, 0xfb, 0xf9, 0xb9, 0x54, 0x3f, 0x7f, 0x4d, 0x11, 0xc5, 0x48, 0x4a,
+	0x3a, 0x86, 0x18, 0x11, 0xe2, 0xdf, 0x25, 0x0d, 0x38, 0x1f, 0x21, 0xad, 0xeb, 0x41, 0xd8, 0x39,
+	0x3f, 0xe4, 0xc7, 0xb3, 0xdb, 0x5b, 0xc5, 0xa7, 0xbb, 0x12, 0x49, 0xac, 0xcf, 0xc9, 0xac, 0xc3,
+	0xf0, 0x75, 0x2e, 0xb9, 0x05, 0x93, 0xbc, 0x3c, 0x1e, 0xda, 0x05, 0x4e, 0x12, 0x8c, 0xb9, 0x14,
+	0xde, 0x41, 0x42, 0xca, 0xa1, 0xbc, 0x10, 0xc9, 0x04, 0x2e, 0xde, 0x44, 0xdf, 0x85, 0x33, 0x9c,
+	0xbe, 0x4d, 0x1d, 0x1c, 0x89, 0xb6, 0x55, 0x77, 0xa9, 0x27, 0x9e, 0x56, 0x4f, 0x3d, 0xbd, 0xbd,
+	0x55, 0x2c, 0xa6, 0x12, 0x48, 0x4c, 0x4f, 0x21, 0x41, 0x35, 0xc0, 0xd7, 0xa8, 0x27, 0xfb, 0x69,
+	0x0c, 0xec, 0x41, 0xcd, 0xbf, 0x33, 0x0b, 0xe7, 0xe6, 0xa8, 0xde, 0xf4, 0xd6, 0xca, 0x6b, 0xb4,
+	0xb1, 0x7e, 0xe2, 0x2a, 0x1d, 0xb1, 0x5a, 0x52, 0xa5, 0x73, 0x62, 0x22, 0xf7, 0x92, 0xce, 0x89,
+	0xc5, 0x2b, 0xa4, 0xf3, 0x03, 0x59, 0xb8, 0x9c, 0xb6, 0x39, 0xc0, 0xdb, 0x01, 0x67, 0xe9, 0x3e,
+	0x75, 0x1c, 0xd3, 0xa0, 0x47, 0xb8, 0xa8, 0x1c, 0x9e, 0x3d, 0x2c, 0x77, 0x58, 0x7e, 0x9f, 0x1e,
+	0xb1, 0xbb, 0x13, 0xd7, 0x11, 0xe6, 0xec, 0x79, 0xb8, 0xc4, 0xf5, 0xed, 0x59, 0x38, 0x5d, 0x33,
+	0x57, 0x5d, 0xcf, 0x76, 0x68, 0x15, 0x03, 0x94, 0x9c, 0x68, 0x52, 0x57, 0xd1, 0x1c, 0x61, 0x6a,
+	0xac, 0x87, 0x5d, 0x34, 0x27, 0x03, 0x4a, 0x88, 0xe6, 0xdf, 0xe6, 0x61, 0x62, 0xa1, 0x5c, 0x15,
+	0x3b, 0x74, 0xcc, 0x46, 0x78, 0x3c, 0xdf, 0xd0, 0x86, 0x67, 0x0b, 0xf9, 0x7d, 0x9c, 0x2d, 0x1c,
+	0x9e, 0x7b, 0x81, 0x48, 0x96, 0x3a, 0xb0, 0xa7, 0x64, 0xa9, 0xcf, 0xc0, 0x78, 0xab, 0xd1, 0xae,
+	0xfb, 0x41, 0xa9, 0x4c, 0x91, 0x9f, 0x59, 0x1b, 0x6d, 0x35, 0xfc, 0x44, 0xb0, 0x15, 0x83, 0x14,
+	0x61, 0xa4, 0xd1, 0x34, 0xa9, 0xe5, 0xd5, 0x4d, 0xeb, 0x9e, 0x2d, 0x42, 0x40, 0x01, 0x07, 0x55,
+	0xac, 0x7b, 0x36, 0x23, 0x70, 0xf1, 0x7b, 0x38, 0x01, 0x8f, 0xf7, 0x04, 0x1c, 0x84, 0x04, 0x57,
+	0xa0, 0x80, 0xa7, 0xf9, 0x0d, 0xbb, 0x59, 0x17, 0xc1, 0xe4, 0x44, 0xb8, 0xa7, 0x09, 0x1f, 0xee,
+	0x07, 0x94, 0x7b, 0x0e, 0x26, 0x4d, 0x6b, 0xd5, 0x61, 0x3b, 0x74, 0xbd, 0xe3, 0xf1, 0x44, 0x3a,
+	0x22, 0xfc, 0xd3, 0x84, 0x40, 0x94, 0x3a, 0x1e, 0x4f, 0xa5, 0x73, 0x19, 0x0a, 0x34, 0x4e, 0x8a,
+	0x51, 0x44, 0xb4, 0x71, 0x1a, 0xa1, 0x54, 0x7f, 0x21, 0x0f, 0x63, 0xa1, 0xba, 0xcd, 0x1c, 0xd1,
+	0x91, 0xd8, 0xa3, 0xad, 0x6c, 0xe1, 0x8e, 0x69, 0x70, 0x0f, 0xb7, 0xa9, 0xdf, 0x90, 0x81, 0x41,
+	0x91, 0x8b, 0x1b, 0x35, 0xef, 0x28, 0x12, 0x7f, 0x0b, 0x90, 0xfa, 0x5b, 0x19, 0x98, 0x5c, 0x28,
+	0x57, 0x6f, 0xd6, 0x96, 0x16, 0xb5, 0x6a, 0x79, 0x81, 0xba, 0xae, 0xbe, 0x4a, 0xc9, 0xfb, 0x60,
+	0x50, 0x40, 0xc4, 0x29, 0x13, 0x1e, 0xef, 0xbd, 0xeb, 0xda, 0x96, 0xd3, 0x6e, 0x68, 0x3e, 0x4e,
+	0x64, 0x64, 0xca, 0xf6, 0xc8, 0xc8, 0xa4, 0x82, 0x48, 0xda, 0x2b, 0x0e, 0xc8, 0x22, 0x69, 0x7c,
+	0xf9, 0xff, 0x64, 0x09, 0x06, 0xda, 0xba, 0xa3, 0xb7, 0xdc, 0x9d, 0x6e, 0xcb, 0x9e, 0xd8, 0xde,
+	0x2a, 0x16, 0x38, 0x69, 0xea, 0xed, 0x98, 0x60, 0xa3, 0x7e, 0x73, 0x1e, 0xbf, 0x29, 0x08, 0xa9,
+	0x11, 0xa4, 0x7b, 0xde, 0xf7, 0x49, 0xc3, 0xab, 0x90, 0xef, 0xec, 0x71, 0x74, 0x74, 0xc4, 0xe8,
+	0x70, 0xf7, 0x35, 0x3a, 0x44, 0x29, 0x5f, 0x2b, 0xf3, 0x7b, 0xd5, 0x4a, 0x77, 0x0f, 0x77, 0xfc,
+	0x9c, 0x96, 0x2c, 0xc2, 0x60, 0x8b, 0x77, 0xbf, 0x18, 0x04, 0x41, 0xa0, 0xc8, 0x84, 0x7e, 0x4c,
+	0x9d, 0x17, 0x99, 0x5d, 0x27, 0x45, 0x09, 0x59, 0xb3, 0x04, 0x28, 0xa2, 0xe5, 0x83, 0x47, 0xac,
+	0xe5, 0x7f, 0x2f, 0x0f, 0x67, 0x43, 0x8d, 0x58, 0xb4, 0x3d, 0xf3, 0x9e, 0xc9, 0xaf, 0x57, 0x1e,
+	0x21, 0xb5, 0x90, 0x3a, 0xb8, 0xff, 0x30, 0x3a, 0x38, 0x54, 0xb3, 0x81, 0x3d, 0xa8, 0xd9, 0xc3,
+	0xa4, 0x16, 0xbf, 0x94, 0x83, 0xf3, 0xa1, 0x5a, 0xcc, 0x63, 0xea, 0xbc, 0x5a, 0x6d, 0xa6, 0xe6,
+	0x39, 0x54, 0x6f, 0x1d, 0x5b, 0xcd, 0xd0, 0xf7, 0xa4, 0x19, 0xfa, 0xbe, 0x27, 0x0c, 0xb9, 0x27,
+	0x07, 0x8e, 0xb8, 0x27, 0xbf, 0x90, 0x87, 0x8b, 0x61, 0x4f, 0x8a, 0xf3, 0xfb, 0xb9, 0xe5, 0xe5,
+	0xea, 0x71, 0x9f, 0xfd, 0xf7, 0xde, 0x99, 0xfe, 0x9d, 0x5b, 0x7f, 0xea, 0x9d, 0x5b, 0xb8, 0x20,
+	0x0f, 0x74, 0x5d, 0x90, 0x9f, 0x83, 0x30, 0x25, 0xbf, 0x1c, 0xa6, 0x4f, 0xca, 0xd3, 0xef, 0xf8,
+	0x79, 0xfa, 0x2f, 0x42, 0x7e, 0xc5, 0x36, 0x78, 0x3a, 0xff, 0x51, 0x5e, 0x1b, 0xfb, 0xad, 0xe1,
+	0xbf, 0x11, 0x15, 0x19, 0x3e, 0x62, 0x15, 0xf9, 0xa3, 0x1c, 0x9c, 0x9e, 0xb2, 0x3b, 0x96, 0x71,
+	0x8b, 0x6e, 0xb6, 0x75, 0xd3, 0xd1, 0x68, 0xc3, 0xbe, 0xcf, 0x3e, 0xe1, 0xaf, 0xdf, 0x25, 0xf6,
+	0xf0, 0xf6, 0xad, 0xcf, 0xc3, 0xf0, 0xb2, 0xbd, 0x4e, 0x2d, 0x29, 0x12, 0x36, 0x66, 0x33, 0xf6,
+	0x18, 0x90, 0x47, 0xa4, 0x0a, 0x09, 0xc8, 0x0b, 0x30, 0x38, 0x65, 0xf3, 0xcb, 0x43, 0x29, 0x1d,
+	0xeb, 0x8a, 0x2d, 0x2e, 0x0d, 0x25, 0xa1, 0x09, 0x32, 0xf2, 0x2a, 0x0c, 0x57, 0x3b, 0x2b, 0x4d,
+	0xb3, 0x71, 0x8b, 0xfa, 0x2f, 0x55, 0xd0, 0x6d, 0xb9, 0x8d, 0xc0, 0xfa, 0x3a, 0xdd, 0x8c, 0x44,
+	0x35, 0xf2, 0x49, 0xc9, 0x87, 0x60, 0xcc, 0x97, 0x6f, 0xd9, 0xee, 0x58, 0x1e, 0xaa, 0x91, 0xc8,
+	0x83, 0xe9, 0x08, 0x44, 0x1d, 0xaf, 0x49, 0xb4, 0x28, 0x21, 0x79, 0x05, 0x46, 0x7d, 0xc0, 0x82,
+	0x6d, 0x50, 0x39, 0xee, 0x63, 0x50, 0xb0, 0x65, 0x1b, 0x54, 0x8b, 0x90, 0xa9, 0xbf, 0x18, 0xef,
+	0x5d, 0xdb, 0x0b, 0xd6, 0xf7, 0x93, 0xde, 0xed, 0xd2, 0xbb, 0x4b, 0x30, 0x59, 0x75, 0xe8, 0x7d,
+	0xd3, 0xee, 0xb8, 0xf1, 0x5e, 0x7e, 0x6a, 0x7b, 0xab, 0xf8, 0x78, 0x5b, 0x20, 0xeb, 0xa9, 0xdd,
+	0x9d, 0x2c, 0x4b, 0xde, 0x82, 0xd1, 0x45, 0xba, 0x11, 0xf2, 0x1a, 0x0c, 0xa3, 0x9b, 0x59, 0x74,
+	0x23, 0x9d, 0x4d, 0xa4, 0x84, 0xfa, 0x8b, 0x59, 0x78, 0x56, 0xee, 0xc7, 0x9b, 0xb6, 0x69, 0xa1,
+	0x1b, 0xfe, 0x1d, 0xea, 0x04, 0x46, 0xdb, 0xac, 0x6e, 0x36, 0x0f, 0x18, 0x0c, 0xee, 0xcb, 0xbc,
+	0x6b, 0xd5, 0x5f, 0xcb, 0xc2, 0x48, 0xad, 0x5c, 0x59, 0xf0, 0xd7, 0xbf, 0x9d, 0x93, 0xe7, 0x4e,
+	0xc1, 0x18, 0x8f, 0x2b, 0x57, 0x32, 0x0c, 0x87, 0xba, 0xae, 0xd8, 0xd7, 0x61, 0xe7, 0x89, 0xd8,
+	0x71, 0x3a, 0xc7, 0xc8, 0x97, 0xa9, 0x91, 0x22, 0x6c, 0xba, 0x60, 0xab, 0x22, 0xbe, 0x6d, 0x17,
+	0x3b, 0xbe, 0xf0, 0x95, 0x83, 0xce, 0xa0, 0xf2, 0x74, 0x11, 0x90, 0x92, 0xe7, 0x61, 0x60, 0x81,
+	0xaf, 0x4a, 0xf9, 0xd0, 0x53, 0x83, 0xaf, 0x46, 0xb2, 0xa7, 0x06, 0xa7, 0x21, 0x97, 0x20, 0x5f,
+	0x0d, 0x57, 0x38, 0x9c, 0x53, 0xd8, 0xda, 0x26, 0x7b, 0x30, 0x54, 0xb9, 0x7f, 0x49, 0x7e, 0x8a,
+	0xad, 0x4d, 0x03, 0xbb, 0x08, 0xad, 0xc6, 0x96, 0xab, 0xf4, 0xd0, 0x6a, 0x8c, 0x85, 0xfa, 0xbb,
+	0x19, 0x18, 0x67, 0xe2, 0x2c, 0xdb, 0xad, 0x96, 0x6d, 0x4d, 0x33, 0x0d, 0x9a, 0x86, 0x41, 0x21,
+	0x5c, 0xa1, 0x08, 0xc1, 0x02, 0x2d, 0xc9, 0x9d, 0x3b, 0xae, 0x38, 0xfc, 0x87, 0xdc, 0x4f, 0x7e,
+	0xbf, 0xc4, 0xde, 0x77, 0xe4, 0xc3, 0xf7, 0x1d, 0xd2, 0xab, 0x0e, 0x39, 0xc7, 0xb3, 0x44, 0x4d,
+	0xde, 0x64, 0x73, 0x65, 0x22, 0xf0, 0x1f, 0xba, 0x68, 0x44, 0xe2, 0xfd, 0xc9, 0xa3, 0x2d, 0x12,
+	0xf1, 0xef, 0x3b, 0x72, 0x50, 0x60, 0xad, 0x65, 0xa6, 0xaf, 0x69, 0xad, 0x62, 0xf4, 0xf3, 0x23,
+	0x18, 0x56, 0x6f, 0xc0, 0x00, 0x17, 0x6c, 0xc2, 0x25, 0x21, 0x22, 0xf2, 0x78, 0x69, 0x8e, 0x61,
+	0xca, 0xc3, 0x03, 0x8d, 0xcb, 0xca, 0xc3, 0x23, 0x92, 0xcb, 0xca, 0xc3, 0x69, 0xc8, 0x15, 0xe8,
+	0xe7, 0x2b, 0x52, 0x7f, 0x18, 0x50, 0x1a, 0x17, 0x22, 0x39, 0xf1, 0x07, 0x5f, 0x8a, 0x5e, 0x03,
+	0xc0, 0x53, 0xdc, 0x8a, 0x65, 0xd0, 0x07, 0x22, 0x0e, 0x36, 0x76, 0x8d, 0xcb, 0xa0, 0x75, 0x93,
+	0x81, 0xe5, 0xc4, 0xc2, 0x21, 0x31, 0x1b, 0x4c, 0xbe, 0xa0, 0xe5, 0xf5, 0x0f, 0x07, 0x53, 0xd0,
+	0x35, 0xf1, 0x6a, 0xa3, 0x45, 0xd4, 0xed, 0x2c, 0x4c, 0x72, 0x55, 0xe2, 0xd0, 0xe3, 0xd9, 0x3b,
+	0xaf, 0x01, 0x2c, 0x0b, 0xd3, 0x2d, 0x08, 0x36, 0x8d, 0x42, 0xf4, 0x0d, 0xba, 0x68, 0x22, 0x78,
+	0x89, 0x18, 0x13, 0x3b, 0x8b, 0x2c, 0x05, 0x95, 0x69, 0x39, 0xfd, 0x39, 0x15, 0xd0, 0x58, 0xd1,
+	0x90, 0x98, 0x5c, 0x83, 0xc1, 0x69, 0xd3, 0x6d, 0x37, 0xf5, 0xc8, 0xa3, 0x67, 0x83, 0x83, 0xe4,
+	0x71, 0x28, 0xa8, 0xd4, 0xef, 0xc9, 0xc1, 0x85, 0x32, 0x3f, 0xfe, 0xad, 0x6a, 0xd4, 0xf5, 0x1c,
+	0x93, 0x7b, 0x96, 0x9d, 0x5c, 0xfc, 0x24, 0x32, 0xd8, 0xed, 0xe5, 0xe1, 0xc8, 0x22, 0x9c, 0x4e,
+	0x93, 0xaa, 0x88, 0x11, 0x8e, 0x21, 0x4a, 0xfd, 0x73, 0xf8, 0x76, 0xdd, 0x91, 0x28, 0xb4, 0xd4,
+	0x72, 0xea, 0xd7, 0x66, 0xa1, 0x70, 0xc7, 0xa2, 0x5e, 0xdc, 0xcb, 0x64, 0xdf, 0x7b, 0xbb, 0x70,
+	0xeb, 0x9b, 0xdd, 0xc3, 0xd6, 0xd7, 0xdf, 0x11, 0xe6, 0xf6, 0xb8, 0x23, 0x9c, 0x03, 0x68, 0x1c,
+	0xc0, 0x37, 0x20, 0x2c, 0x1b, 0x13, 0x44, 0xa8, 0xa5, 0x8f, 0xb8, 0x20, 0xc2, 0xcb, 0xc8, 0x47,
+	0x4d, 0x10, 0xcf, 0x35, 0xf8, 0x63, 0xdc, 0x5b, 0xa6, 0x65, 0x90, 0xf3, 0x70, 0xe6, 0x76, 0x6d,
+	0x46, 0xab, 0xdf, 0xaa, 0x2c, 0x4e, 0xd7, 0x6f, 0x2f, 0xd6, 0xaa, 0x33, 0xe5, 0xca, 0x6c, 0x65,
+	0x66, 0xba, 0xd0, 0x47, 0x4e, 0xc1, 0x44, 0x88, 0x9a, 0xbb, 0xbd, 0x50, 0x5a, 0x2c, 0x64, 0xc8,
+	0x24, 0x8c, 0x85, 0xc0, 0xa9, 0xa5, 0xe5, 0x42, 0x96, 0x9c, 0x86, 0x42, 0x08, 0xaa, 0xbd, 0x53,
+	0x5b, 0x9e, 0x59, 0x28, 0xe4, 0x9e, 0xfb, 0x8e, 0x0c, 0x00, 0xab, 0x65, 0xc9, 0x31, 0x57, 0x4d,
+	0x8b, 0x3c, 0x06, 0xe7, 0x90, 0x68, 0x49, 0xab, 0xdc, 0xa8, 0x2c, 0xc6, 0x6a, 0x3a, 0x03, 0x93,
+	0x32, 0x72, 0x7e, 0xa9, 0x5c, 0x9a, 0x2f, 0x64, 0x82, 0x06, 0x08, 0x70, 0xad, 0xb6, 0x24, 0xd5,
+	0x26, 0x80, 0x4b, 0xb7, 0x96, 0x4b, 0x85, 0x5c, 0x1c, 0xca, 0xd6, 0x9b, 0x42, 0x9e, 0x9c, 0x83,
+	0x53, 0x32, 0x74, 0x66, 0x71, 0x59, 0x2b, 0x55, 0xa6, 0x0b, 0xfd, 0xcf, 0x3d, 0x0b, 0x23, 0xb8,
+	0x46, 0x0a, 0x87, 0xde, 0x51, 0x18, 0x5a, 0x9a, 0xaa, 0xcd, 0x68, 0x77, 0xb0, 0x35, 0x00, 0x03,
+	0xd3, 0x33, 0x8b, 0xac, 0x65, 0x99, 0xe7, 0xfe, 0x7d, 0x06, 0xa0, 0x36, 0xbb, 0x5c, 0x15, 0x84,
+	0x23, 0x30, 0x58, 0x59, 0xbc, 0x53, 0x9a, 0xaf, 0x30, 0xba, 0x21, 0xc8, 0x2f, 0x55, 0x67, 0x98,
+	0x50, 0x86, 0xa1, 0xbf, 0x3c, 0xbf, 0x54, 0x9b, 0x29, 0x64, 0x19, 0x50, 0x9b, 0x29, 0x4d, 0x17,
+	0x72, 0x0c, 0x78, 0x57, 0xab, 0x2c, 0xcf, 0x14, 0xf2, 0xec, 0xcf, 0xf9, 0xda, 0x72, 0x69, 0xb9,
+	0xd0, 0xcf, 0xfe, 0x9c, 0xc5, 0x3f, 0x07, 0x18, 0xb3, 0xda, 0xcc, 0x32, 0xfe, 0x18, 0x64, 0x4d,
+	0x98, 0xf5, 0x7f, 0x0d, 0x31, 0x14, 0x63, 0x3d, 0x5d, 0xd1, 0x0a, 0xc3, 0xec, 0x07, 0x63, 0xc9,
+	0x7e, 0x00, 0x6b, 0x9c, 0x36, 0xb3, 0xb0, 0x74, 0x67, 0xa6, 0x30, 0xc2, 0x78, 0x2d, 0xdc, 0x62,
+	0xe0, 0x51, 0xf6, 0xa7, 0xb6, 0xc0, 0xfe, 0x1c, 0x63, 0x9c, 0xb4, 0x99, 0xd2, 0x7c, 0xb5, 0xb4,
+	0x3c, 0x57, 0x18, 0x67, 0xed, 0x41, 0x9e, 0x13, 0xbc, 0xe4, 0x62, 0x69, 0x61, 0xa6, 0x50, 0x10,
+	0x34, 0xd3, 0xf3, 0x95, 0xc5, 0x5b, 0x85, 0x49, 0x6c, 0xc8, 0x3b, 0x0b, 0xf8, 0x83, 0xb0, 0x02,
+	0xf8, 0xd7, 0xa9, 0xe7, 0x3e, 0x09, 0x03, 0x4b, 0x35, 0xbc, 0x6a, 0x3c, 0x07, 0xa7, 0x96, 0x6a,
+	0xf5, 0xe5, 0x77, 0xaa, 0x33, 0xb1, 0x8e, 0x9b, 0x84, 0x31, 0x1f, 0x31, 0x5f, 0x59, 0xbc, 0xfd,
+	0x36, 0x57, 0x10, 0x1f, 0xb4, 0x50, 0x2a, 0x2f, 0xd5, 0x0a, 0x59, 0xd6, 0x8f, 0x3e, 0xe8, 0x6e,
+	0x65, 0x71, 0x7a, 0xe9, 0x6e, 0xad, 0x90, 0x7b, 0xee, 0x3e, 0x8c, 0x4e, 0xd3, 0xfb, 0x66, 0x83,
+	0x0a, 0x05, 0x79, 0x1c, 0xce, 0x4f, 0xcf, 0xdc, 0xa9, 0x94, 0x67, 0xba, 0xaa, 0x48, 0x14, 0x5d,
+	0xaa, 0x56, 0x0a, 0x19, 0x72, 0x16, 0x48, 0x14, 0x7c, 0xb3, 0xb4, 0x30, 0x5b, 0xc8, 0x12, 0x05,
+	0x4e, 0x47, 0xe1, 0x95, 0xc5, 0xe5, 0xdb, 0x8b, 0x33, 0x85, 0xdc, 0x73, 0xff, 0x28, 0x03, 0x67,
+	0x66, 0x9a, 0xba, 0xeb, 0x99, 0x0d, 0x97, 0xea, 0x4e, 0x63, 0xad, 0xac, 0x7b, 0x74, 0xd5, 0x76,
+	0x36, 0x89, 0x0a, 0x4f, 0xcc, 0xcc, 0x97, 0x6a, 0xcb, 0x95, 0x72, 0x6d, 0xa6, 0xa4, 0x95, 0xe7,
+	0xea, 0xe5, 0xd2, 0xf2, 0xcc, 0x8d, 0x25, 0xed, 0x9d, 0xfa, 0x8d, 0x99, 0xc5, 0x19, 0xad, 0x34,
+	0x5f, 0xe8, 0x23, 0x4f, 0x43, 0xb1, 0x0b, 0x4d, 0x6d, 0xa6, 0x7c, 0x5b, 0xab, 0x2c, 0xbf, 0x53,
+	0xc8, 0x90, 0xa7, 0xe0, 0xf1, 0xae, 0x44, 0xec, 0x77, 0x21, 0x4b, 0x9e, 0x80, 0x0b, 0xdd, 0x48,
+	0x3e, 0x36, 0x5f, 0xc8, 0x3d, 0xf7, 0xed, 0x19, 0x20, 0x4b, 0x6d, 0x6a, 0xd5, 0xa2, 0x4d, 0x7c,
+	0x12, 0x2e, 0x32, 0xbd, 0xa8, 0x77, 0x6f, 0xe0, 0x53, 0xf0, 0x78, 0x2a, 0x85, 0xd4, 0xbc, 0x22,
+	0x3c, 0xd6, 0x85, 0x44, 0x34, 0xee, 0x22, 0x28, 0xe9, 0x04, 0xd8, 0xb4, 0x1f, 0xcd, 0xc0, 0x99,
+	0xd4, 0x18, 0xff, 0xe4, 0x32, 0x3c, 0x53, 0x9a, 0x5e, 0x60, 0x7d, 0x53, 0x5e, 0xae, 0x2c, 0x2d,
+	0xd6, 0xea, 0x0b, 0xb3, 0xa5, 0x3a, 0xd3, 0xbe, 0xdb, 0xb5, 0x58, 0x6f, 0x5e, 0x02, 0xb5, 0x07,
+	0x65, 0x79, 0xae, 0xb4, 0x78, 0x83, 0x0d, 0x3f, 0xf2, 0x0c, 0x3c, 0xd9, 0x95, 0x6e, 0x66, 0xb1,
+	0x34, 0x35, 0x3f, 0x33, 0x5d, 0xc8, 0x92, 0xf7, 0xc1, 0x53, 0x5d, 0xa9, 0xa6, 0x2b, 0x35, 0x4e,
+	0x96, 0x7b, 0x4e, 0x8f, 0xbc, 0x3c, 0x65, 0x5f, 0x59, 0x5e, 0x5a, 0x5c, 0x2e, 0x95, 0x97, 0xd3,
+	0x34, 0xfb, 0x3c, 0x9c, 0x89, 0x60, 0xa7, 0x6e, 0xd7, 0x2a, 0x8b, 0x33, 0xb5, 0x5a, 0x21, 0x93,
+	0x40, 0x05, 0xa2, 0xcd, 0x4e, 0x4d, 0x7f, 0xf1, 0xcf, 0x9e, 0xe8, 0xfb, 0xe2, 0x9f, 0x3f, 0x91,
+	0xf9, 0xcd, 0x3f, 0x7f, 0x22, 0xf3, 0xa7, 0x7f, 0xfe, 0x44, 0xe6, 0xe3, 0xd7, 0xf7, 0x72, 0x4c,
+	0xc9, 0x27, 0xf3, 0x95, 0x01, 0xdc, 0x77, 0xbe, 0xf4, 0xff, 0x07, 0x00, 0x00, 0xff, 0xff, 0xe0,
+	0xf3, 0x76, 0xa9, 0x42, 0xdd, 0x01, 0x00,
 }
 
-func (m *OktaAssignmentMetadata) Marshal() (dAtA []byte, err error) {
+func (m *Metadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -18932,12 +19806,12 @@ func (m *OktaAssignmentMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OktaAssignmentMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *Metadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OktaAssignmentMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *Metadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -18946,38 +19820,51 @@ func (m *OktaAssignmentMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.EndingStatus) > 0 {
-		i -= len(m.EndingStatus)
-		copy(dAtA[i:], m.EndingStatus)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.EndingStatus)))
+	if len(m.ClusterName) > 0 {
+		i -= len(m.ClusterName)
+		copy(dAtA[i:], m.ClusterName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClusterName)))
+		i--
+		dAtA[i] = 0x32
+	}
+	n1, err1 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
+	if err1 != nil {
+		return 0, err1
+	}
+	i -= n1
+	i = encodeVarintEvents(dAtA, i, uint64(n1))
+	i--
+	dAtA[i] = 0x2a
+	if len(m.Code) > 0 {
+		i -= len(m.Code)
+		copy(dAtA[i:], m.Code)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Code)))
 		i--
 		dAtA[i] = 0x22
 	}
-	if len(m.StartingStatus) > 0 {
-		i -= len(m.StartingStatus)
-		copy(dAtA[i:], m.StartingStatus)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.StartingStatus)))
+	if len(m.ID) > 0 {
+		i -= len(m.ID)
+		copy(dAtA[i:], m.ID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
 		i--
 		dAtA[i] = 0x1a
 	}
-	if len(m.User) > 0 {
-		i -= len(m.User)
-		copy(dAtA[i:], m.User)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.User)))
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Type)))
 		i--
 		dAtA[i] = 0x12
 	}
-	if len(m.Source) > 0 {
-		i -= len(m.Source)
-		copy(dAtA[i:], m.Source)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Source)))
+	if m.Index != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Index))
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x8
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessListMemberMetadata) Marshal() (dAtA []byte, err error) {
+func (m *SessionMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -18987,12 +19874,12 @@ func (m *AccessListMemberMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AccessListMemberMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessListMemberMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19001,38 +19888,31 @@ func (m *AccessListMemberMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.AccessListTitle) > 0 {
-		i -= len(m.AccessListTitle)
-		copy(dAtA[i:], m.AccessListTitle)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListTitle)))
+	if len(m.PrivateKeyPolicy) > 0 {
+		i -= len(m.PrivateKeyPolicy)
+		copy(dAtA[i:], m.PrivateKeyPolicy)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PrivateKeyPolicy)))
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x1a
 	}
-	if len(m.Members) > 0 {
-		for iNdEx := len(m.Members) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Members[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
+	if len(m.WithMFA) > 0 {
+		i -= len(m.WithMFA)
+		copy(dAtA[i:], m.WithMFA)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.WithMFA)))
+		i--
+		dAtA[i] = 0x12
 	}
-	if len(m.AccessListName) > 0 {
-		i -= len(m.AccessListName)
-		copy(dAtA[i:], m.AccessListName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListName)))
+	if len(m.SessionID) > 0 {
+		i -= len(m.SessionID)
+		copy(dAtA[i:], m.SessionID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionID)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessListMember) Marshal() (dAtA []byte, err error) {
+func (m *UserMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19042,12 +19922,12 @@ func (m *AccessListMember) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AccessListMember) MarshalTo(dAtA []byte) (int, error) {
+func (m *UserMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessListMember) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UserMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19056,45 +19936,132 @@ func (m *AccessListMember) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.MembershipKind != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.MembershipKind))
-		i--
-		dAtA[i] = 0x28
-	}
-	if len(m.MemberName) > 0 {
-		i -= len(m.MemberName)
-		copy(dAtA[i:], m.MemberName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.MemberName)))
+	if len(m.UserClusterName) > 0 {
+		i -= len(m.UserClusterName)
+		copy(dAtA[i:], m.UserClusterName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserClusterName)))
 		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.Reason) > 0 {
-		i -= len(m.Reason)
-		copy(dAtA[i:], m.Reason)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
+		dAtA[i] = 0x1
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x82
 	}
-	n3, err3 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.RemovedOn, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.RemovedOn):])
-	if err3 != nil {
-		return 0, err3
+	{
+		size := m.UserTraits.Size()
+		i -= size
+		if _, err := m.UserTraits.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i -= n3
-	i = encodeVarintEvents(dAtA, i, uint64(n3))
 	i--
-	dAtA[i] = 0x12
-	n4, err4 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.JoinedOn, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.JoinedOn):])
-	if err4 != nil {
-		return 0, err4
+	dAtA[i] = 0x7a
+	if len(m.UserRoles) > 0 {
+		for iNdEx := len(m.UserRoles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UserRoles[iNdEx])
+			copy(dAtA[i:], m.UserRoles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.UserRoles[iNdEx])))
+			i--
+			dAtA[i] = 0x72
+		}
+	}
+	if m.UserOrigin != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.UserOrigin))
+		i--
+		dAtA[i] = 0x68
+	}
+	if len(m.BotInstanceID) > 0 {
+		i -= len(m.BotInstanceID)
+		copy(dAtA[i:], m.BotInstanceID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotInstanceID)))
+		i--
+		dAtA[i] = 0x62
+	}
+	if len(m.BotName) > 0 {
+		i -= len(m.BotName)
+		copy(dAtA[i:], m.BotName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if m.UserKind != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.UserKind))
+		i--
+		dAtA[i] = 0x50
+	}
+	if len(m.RequiredPrivateKeyPolicy) > 0 {
+		i -= len(m.RequiredPrivateKeyPolicy)
+		copy(dAtA[i:], m.RequiredPrivateKeyPolicy)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequiredPrivateKeyPolicy)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.TrustedDevice != nil {
+		{
+			size, err := m.TrustedDevice.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.GCPServiceAccount) > 0 {
+		i -= len(m.GCPServiceAccount)
+		copy(dAtA[i:], m.GCPServiceAccount)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.GCPServiceAccount)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.AzureIdentity) > 0 {
+		i -= len(m.AzureIdentity)
+		copy(dAtA[i:], m.AzureIdentity)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AzureIdentity)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.AccessRequests) > 0 {
+		for iNdEx := len(m.AccessRequests) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.AccessRequests[iNdEx])
+			copy(dAtA[i:], m.AccessRequests[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessRequests[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.AWSRoleARN) > 0 {
+		i -= len(m.AWSRoleARN)
+		copy(dAtA[i:], m.AWSRoleARN)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSRoleARN)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Impersonator) > 0 {
+		i -= len(m.Impersonator)
+		copy(dAtA[i:], m.Impersonator)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Impersonator)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Login) > 0 {
+		i -= len(m.Login)
+		copy(dAtA[i:], m.Login)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Login)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.User) > 0 {
+		i -= len(m.User)
+		copy(dAtA[i:], m.User)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.User)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i -= n4
-	i = encodeVarintEvents(dAtA, i, uint64(n4))
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessListReviewMembershipRequirementsChanged) Marshal() (dAtA []byte, err error) {
+func (m *ServerMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19104,12 +20071,12 @@ func (m *AccessListReviewMembershipRequirementsChanged) Marshal() (dAtA []byte,
 	return dAtA[:n], nil
 }
 
-func (m *AccessListReviewMembershipRequirementsChanged) MarshalTo(dAtA []byte) (int, error) {
+func (m *ServerMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessListReviewMembershipRequirementsChanged) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ServerMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19118,9 +20085,30 @@ func (m *AccessListReviewMembershipRequirementsChanged) MarshalToSizedBuffer(dAt
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Traits) > 0 {
-		for k := range m.Traits {
-			v := m.Traits[k]
+	if len(m.ServerVersion) > 0 {
+		i -= len(m.ServerVersion)
+		copy(dAtA[i:], m.ServerVersion)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerVersion)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.ServerSubKind) > 0 {
+		i -= len(m.ServerSubKind)
+		copy(dAtA[i:], m.ServerSubKind)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerSubKind)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.ForwardedBy) > 0 {
+		i -= len(m.ForwardedBy)
+		copy(dAtA[i:], m.ForwardedBy)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ForwardedBy)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.ServerLabels) > 0 {
+		for k := range m.ServerLabels {
+			v := m.ServerLabels[k]
 			baseI := i
 			i -= len(v)
 			copy(dAtA[i:], v)
@@ -19134,22 +20122,41 @@ func (m *AccessListReviewMembershipRequirementsChanged) MarshalToSizedBuffer(dAt
 			dAtA[i] = 0xa
 			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x12
+			dAtA[i] = 0x2a
 		}
 	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0xa
-		}
+	if len(m.ServerAddr) > 0 {
+		i -= len(m.ServerAddr)
+		copy(dAtA[i:], m.ServerAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerAddr)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.ServerHostname) > 0 {
+		i -= len(m.ServerHostname)
+		copy(dAtA[i:], m.ServerHostname)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerHostname)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ServerID) > 0 {
+		i -= len(m.ServerID)
+		copy(dAtA[i:], m.ServerID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.ServerNamespace) > 0 {
+		i -= len(m.ServerNamespace)
+		copy(dAtA[i:], m.ServerNamespace)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerNamespace)))
+		i--
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessListReviewMetadata) Marshal() (dAtA []byte, err error) {
+func (m *ConnectionMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19159,12 +20166,12 @@ func (m *AccessListReviewMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AccessListReviewMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *ConnectionMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessListReviewMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ConnectionMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19173,66 +20180,31 @@ func (m *AccessListReviewMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.AccessListTitle) > 0 {
-		i -= len(m.AccessListTitle)
-		copy(dAtA[i:], m.AccessListTitle)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListTitle)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.RemovedMembers) > 0 {
-		for iNdEx := len(m.RemovedMembers) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.RemovedMembers[iNdEx])
-			copy(dAtA[i:], m.RemovedMembers[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.RemovedMembers[iNdEx])))
-			i--
-			dAtA[i] = 0x32
-		}
-	}
-	if len(m.ReviewDayOfMonthChanged) > 0 {
-		i -= len(m.ReviewDayOfMonthChanged)
-		copy(dAtA[i:], m.ReviewDayOfMonthChanged)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewDayOfMonthChanged)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.ReviewFrequencyChanged) > 0 {
-		i -= len(m.ReviewFrequencyChanged)
-		copy(dAtA[i:], m.ReviewFrequencyChanged)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewFrequencyChanged)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if m.MembershipRequirementsChanged != nil {
-		{
-			size, err := m.MembershipRequirementsChanged.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	if len(m.Protocol) > 0 {
+		i -= len(m.Protocol)
+		copy(dAtA[i:], m.Protocol)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Protocol)))
 		i--
 		dAtA[i] = 0x1a
 	}
-	if len(m.ReviewID) > 0 {
-		i -= len(m.ReviewID)
-		copy(dAtA[i:], m.ReviewID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewID)))
+	if len(m.RemoteAddr) > 0 {
+		i -= len(m.RemoteAddr)
+		copy(dAtA[i:], m.RemoteAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RemoteAddr)))
 		i--
 		dAtA[i] = 0x12
 	}
-	if len(m.Message) > 0 {
-		i -= len(m.Message)
-		copy(dAtA[i:], m.Message)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Message)))
+	if len(m.LocalAddr) > 0 {
+		i -= len(m.LocalAddr)
+		copy(dAtA[i:], m.LocalAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.LocalAddr)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *LockMetadata) Marshal() (dAtA []byte, err error) {
+func (m *ClientMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19242,12 +20214,12 @@ func (m *LockMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *LockMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *ClientMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *LockMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ClientMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19256,20 +20228,17 @@ func (m *LockMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.UserAgent) > 0 {
+		i -= len(m.UserAgent)
+		copy(dAtA[i:], m.UserAgent)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserAgent)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0x22
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionStart) Marshal() (dAtA []byte, err error) {
+func (m *KubernetesClusterMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19279,12 +20248,12 @@ func (m *SessionStart) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionStart) MarshalTo(dAtA []byte) (int, error) {
+func (m *KubernetesClusterMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *KubernetesClusterMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19293,119 +20262,54 @@ func (m *SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Reason) > 0 {
-		i -= len(m.Reason)
-		copy(dAtA[i:], m.Reason)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
-		i--
-		dAtA[i] = 0x6a
-	}
-	if len(m.Invited) > 0 {
-		for iNdEx := len(m.Invited) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Invited[iNdEx])
-			copy(dAtA[i:], m.Invited[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Invited[iNdEx])))
+	if len(m.KubernetesLabels) > 0 {
+		for k := range m.KubernetesLabels {
+			v := m.KubernetesLabels[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
 			i--
-			dAtA[i] = 0x62
-		}
-	}
-	if len(m.SessionRecording) > 0 {
-		i -= len(m.SessionRecording)
-		copy(dAtA[i:], m.SessionRecording)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionRecording)))
-		i--
-		dAtA[i] = 0x52
-	}
-	if len(m.InitialCommand) > 0 {
-		for iNdEx := len(m.InitialCommand) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.InitialCommand[iNdEx])
-			copy(dAtA[i:], m.InitialCommand[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.InitialCommand[iNdEx])))
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
 			i--
-			dAtA[i] = 0x4a
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x22
 		}
 	}
-	{
-		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.KubernetesGroups) > 0 {
+		for iNdEx := len(m.KubernetesGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.KubernetesGroups[iNdEx])
+			copy(dAtA[i:], m.KubernetesGroups[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x42
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.KubernetesUsers) > 0 {
+		for iNdEx := len(m.KubernetesUsers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.KubernetesUsers[iNdEx])
+			copy(dAtA[i:], m.KubernetesUsers[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesUsers[iNdEx])))
+			i--
+			dAtA[i] = 0x12
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x3a
-	if len(m.TerminalSize) > 0 {
-		i -= len(m.TerminalSize)
-		copy(dAtA[i:], m.TerminalSize)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TerminalSize)))
+	if len(m.KubernetesCluster) > 0 {
+		i -= len(m.KubernetesCluster)
+		copy(dAtA[i:], m.KubernetesCluster)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesCluster)))
 		i--
-		dAtA[i] = 0x32
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionJoin) Marshal() (dAtA []byte, err error) {
+func (m *KubernetesPodMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19415,12 +20319,12 @@ func (m *SessionJoin) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionJoin) MarshalTo(dAtA []byte) (int, error) {
+func (m *KubernetesPodMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *KubernetesPodMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19429,70 +20333,45 @@ func (m *SessionJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x32
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.KubernetesNodeName) > 0 {
+		i -= len(m.KubernetesNodeName)
+		copy(dAtA[i:], m.KubernetesNodeName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesNodeName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.KubernetesContainerImage) > 0 {
+		i -= len(m.KubernetesContainerImage)
+		copy(dAtA[i:], m.KubernetesContainerImage)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesContainerImage)))
+		i--
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.KubernetesContainerName) > 0 {
+		i -= len(m.KubernetesContainerName)
+		copy(dAtA[i:], m.KubernetesContainerName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesContainerName)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.KubernetesPodNamespace) > 0 {
+		i -= len(m.KubernetesPodNamespace)
+		copy(dAtA[i:], m.KubernetesPodNamespace)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesPodNamespace)))
+		i--
+		dAtA[i] = 0x12
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.KubernetesPodName) > 0 {
+		i -= len(m.KubernetesPodName)
+		copy(dAtA[i:], m.KubernetesPodName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.KubernetesPodName)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionPrint) Marshal() (dAtA []byte, err error) {
+func (m *SAMLIdPServiceProviderMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19502,12 +20381,12 @@ func (m *SessionPrint) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionPrint) MarshalTo(dAtA []byte) (int, error) {
+func (m *SAMLIdPServiceProviderMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionPrint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SAMLIdPServiceProviderMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19516,47 +20395,43 @@ func (m *SessionPrint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Offset != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
-		i--
-		dAtA[i] = 0x30
-	}
-	if m.DelayMilliseconds != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DelayMilliseconds))
-		i--
-		dAtA[i] = 0x28
-	}
-	if m.Bytes != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Bytes))
-		i--
-		dAtA[i] = 0x20
+	if len(m.AttributeMapping) > 0 {
+		for k := range m.AttributeMapping {
+			v := m.AttributeMapping[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x1a
+		}
 	}
-	if len(m.Data) > 0 {
-		i -= len(m.Data)
-		copy(dAtA[i:], m.Data)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
+	if len(m.ServiceProviderShortcut) > 0 {
+		i -= len(m.ServiceProviderShortcut)
+		copy(dAtA[i:], m.ServiceProviderShortcut)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServiceProviderShortcut)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x12
 	}
-	if m.ChunkIndex != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.ChunkIndex))
+	if len(m.ServiceProviderEntityID) > 0 {
+		i -= len(m.ServiceProviderEntityID)
+		copy(dAtA[i:], m.ServiceProviderEntityID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServiceProviderEntityID)))
 		i--
-		dAtA[i] = 0x10
-	}
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopRecording) Marshal() (dAtA []byte, err error) {
+func (m *OktaResourcesUpdatedMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19566,12 +20441,12 @@ func (m *DesktopRecording) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopRecording) MarshalTo(dAtA []byte) (int, error) {
+func (m *OktaResourcesUpdatedMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopRecording) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OktaResourcesUpdatedMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19580,32 +20455,67 @@ func (m *DesktopRecording) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.DelayMilliseconds != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DelayMilliseconds))
+	if len(m.DeletedResources) > 0 {
+		for iNdEx := len(m.DeletedResources) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DeletedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.UpdatedResources) > 0 {
+		for iNdEx := len(m.UpdatedResources) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.UpdatedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.AddedResources) > 0 {
+		for iNdEx := len(m.AddedResources) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.AddedResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if m.Deleted != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Deleted))
 		i--
 		dAtA[i] = 0x18
 	}
-	if len(m.Message) > 0 {
-		i -= len(m.Message)
-		copy(dAtA[i:], m.Message)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Message)))
+	if m.Updated != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Updated))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x10
 	}
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if m.Added != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Added))
+		i--
+		dAtA[i] = 0x8
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopClipboardReceive) Marshal() (dAtA []byte, err error) {
+func (m *OktaResource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19615,12 +20525,12 @@ func (m *DesktopClipboardReceive) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopClipboardReceive) MarshalTo(dAtA []byte) (int, error) {
+func (m *OktaResource) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopClipboardReceive) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OktaResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19629,62 +20539,24 @@ func (m *DesktopClipboardReceive) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Length != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
+	if len(m.Description) > 0 {
+		i -= len(m.Description)
+		copy(dAtA[i:], m.Description)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Description)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x12
 	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+	if len(m.ID) > 0 {
+		i -= len(m.ID)
+		copy(dAtA[i:], m.ID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
 		i--
-		dAtA[i] = 0x2a
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopClipboardSend) Marshal() (dAtA []byte, err error) {
+func (m *OktaAssignmentMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19694,12 +20566,12 @@ func (m *DesktopClipboardSend) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopClipboardSend) MarshalTo(dAtA []byte) (int, error) {
+func (m *OktaAssignmentMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopClipboardSend) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OktaAssignmentMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19708,62 +20580,38 @@ func (m *DesktopClipboardSend) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Length != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
+	if len(m.EndingStatus) > 0 {
+		i -= len(m.EndingStatus)
+		copy(dAtA[i:], m.EndingStatus)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.EndingStatus)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x22
 	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+	if len(m.StartingStatus) > 0 {
+		i -= len(m.StartingStatus)
+		copy(dAtA[i:], m.StartingStatus)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.StartingStatus)))
 		i--
-		dAtA[i] = 0x2a
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.User) > 0 {
+		i -= len(m.User)
+		copy(dAtA[i:], m.User)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.User)))
+		i--
+		dAtA[i] = 0x12
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.Source) > 0 {
+		i -= len(m.Source)
+		copy(dAtA[i:], m.Source)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Source)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopSharedDirectoryStart) Marshal() (dAtA []byte, err error) {
+func (m *AccessListMemberMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19773,12 +20621,12 @@ func (m *DesktopSharedDirectoryStart) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopSharedDirectoryStart) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessListMemberMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopSharedDirectoryStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessListMemberMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19787,79 +20635,38 @@ func (m *DesktopSharedDirectoryStart) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.DirectoryID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
-		i--
-		dAtA[i] = 0x40
-	}
-	if len(m.DirectoryName) > 0 {
-		i -= len(m.DirectoryName)
-		copy(dAtA[i:], m.DirectoryName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+	if len(m.AccessListTitle) > 0 {
+		i -= len(m.AccessListTitle)
+		copy(dAtA[i:], m.AccessListTitle)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListTitle)))
 		i--
-		dAtA[i] = 0x32
-	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Members) > 0 {
+		for iNdEx := len(m.Members) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Members[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.AccessListName) > 0 {
+		i -= len(m.AccessListName)
+		copy(dAtA[i:], m.AccessListName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListName)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopSharedDirectoryRead) Marshal() (dAtA []byte, err error) {
+func (m *AccessListMember) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19869,12 +20676,12 @@ func (m *DesktopSharedDirectoryRead) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopSharedDirectoryRead) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessListMember) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopSharedDirectoryRead) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessListMember) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19883,96 +20690,100 @@ func (m *DesktopSharedDirectoryRead) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Offset != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
-		i--
-		dAtA[i] = 0x58
-	}
-	if m.Length != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
-		i--
-		dAtA[i] = 0x50
-	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
-		i--
-		dAtA[i] = 0x4a
-	}
-	if m.DirectoryID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
+	if m.MembershipKind != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.MembershipKind))
 		i--
-		dAtA[i] = 0x40
+		dAtA[i] = 0x28
 	}
-	if len(m.DirectoryName) > 0 {
-		i -= len(m.DirectoryName)
-		copy(dAtA[i:], m.DirectoryName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
+	if len(m.MemberName) > 0 {
+		i -= len(m.MemberName)
+		copy(dAtA[i:], m.MemberName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.MemberName)))
 		i--
-		dAtA[i] = 0x3a
+		dAtA[i] = 0x22
 	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
 		i--
-		dAtA[i] = 0x32
+		dAtA[i] = 0x1a
 	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	n4, err4 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.RemovedOn, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.RemovedOn):])
+	if err4 != nil {
+		return 0, err4
 	}
+	i -= n4
+	i = encodeVarintEvents(dAtA, i, uint64(n4))
 	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0x12
+	n5, err5 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.JoinedOn, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.JoinedOn):])
+	if err5 != nil {
+		return 0, err5
 	}
+	i -= n5
+	i = encodeVarintEvents(dAtA, i, uint64(n5))
 	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessListReviewMembershipRequirementsChanged) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	return dAtA[:n], nil
+}
+
+func (m *AccessListReviewMembershipRequirementsChanged) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AccessListReviewMembershipRequirementsChanged) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Traits) > 0 {
+		for k := range m.Traits {
+			v := m.Traits[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x12
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0xa
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DesktopSharedDirectoryWrite) Marshal() (dAtA []byte, err error) {
+func (m *AccessListReviewMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -19982,12 +20793,12 @@ func (m *DesktopSharedDirectoryWrite) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DesktopSharedDirectoryWrite) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessListReviewMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DesktopSharedDirectoryWrite) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessListReviewMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -19996,44 +20807,187 @@ func (m *DesktopSharedDirectoryWrite) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Offset != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
+	if len(m.AccessListTitle) > 0 {
+		i -= len(m.AccessListTitle)
+		copy(dAtA[i:], m.AccessListTitle)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AccessListTitle)))
 		i--
-		dAtA[i] = 0x58
+		dAtA[i] = 0x3a
 	}
-	if m.Length != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
+	if len(m.RemovedMembers) > 0 {
+		for iNdEx := len(m.RemovedMembers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RemovedMembers[iNdEx])
+			copy(dAtA[i:], m.RemovedMembers[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.RemovedMembers[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.ReviewDayOfMonthChanged) > 0 {
+		i -= len(m.ReviewDayOfMonthChanged)
+		copy(dAtA[i:], m.ReviewDayOfMonthChanged)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewDayOfMonthChanged)))
 		i--
-		dAtA[i] = 0x50
+		dAtA[i] = 0x2a
 	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+	if len(m.ReviewFrequencyChanged) > 0 {
+		i -= len(m.ReviewFrequencyChanged)
+		copy(dAtA[i:], m.ReviewFrequencyChanged)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewFrequencyChanged)))
 		i--
-		dAtA[i] = 0x4a
+		dAtA[i] = 0x22
 	}
-	if m.DirectoryID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
+	if m.MembershipRequirementsChanged != nil {
+		{
+			size, err := m.MembershipRequirementsChanged.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
 		i--
-		dAtA[i] = 0x40
+		dAtA[i] = 0x1a
 	}
-	if len(m.DirectoryName) > 0 {
-		i -= len(m.DirectoryName)
-		copy(dAtA[i:], m.DirectoryName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
+	if len(m.ReviewID) > 0 {
+		i -= len(m.ReviewID)
+		copy(dAtA[i:], m.ReviewID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ReviewID)))
 		i--
-		dAtA[i] = 0x3a
+		dAtA[i] = 0x12
 	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+	if len(m.Message) > 0 {
+		i -= len(m.Message)
+		copy(dAtA[i:], m.Message)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Message)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LockMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LockMetadata) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LockMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	return len(dAtA) - i, nil
+}
+
+func (m *SessionStart) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SessionStart) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
+		i--
+		dAtA[i] = 0x6a
+	}
+	if len(m.Invited) > 0 {
+		for iNdEx := len(m.Invited) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Invited[iNdEx])
+			copy(dAtA[i:], m.Invited[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Invited[iNdEx])))
+			i--
+			dAtA[i] = 0x62
+		}
+	}
+	if len(m.SessionRecording) > 0 {
+		i -= len(m.SessionRecording)
+		copy(dAtA[i:], m.SessionRecording)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionRecording)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.InitialCommand) > 0 {
+		for iNdEx := len(m.InitialCommand) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.InitialCommand[iNdEx])
+			copy(dAtA[i:], m.InitialCommand[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.InitialCommand[iNdEx])))
+			i--
+			dAtA[i] = 0x4a
+		}
+	}
+	{
+		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x42
+	{
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x3a
+	if len(m.TerminalSize) > 0 {
+		i -= len(m.TerminalSize)
+		copy(dAtA[i:], m.TerminalSize)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TerminalSize)))
 		i--
 		dAtA[i] = 0x32
 	}
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20043,7 +20997,7 @@ func (m *DesktopSharedDirectoryWrite) MarshalToSizedBuffer(dAtA []byte) (int, er
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20085,7 +21039,7 @@ func (m *DesktopSharedDirectoryWrite) MarshalToSizedBuffer(dAtA []byte) (int, er
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionReject) Marshal() (dAtA []byte, err error) {
+func (m *SessionJoin) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20095,12 +21049,12 @@ func (m *SessionReject) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionReject) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionJoin) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20109,18 +21063,16 @@ func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Maximum != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Maximum))
-		i--
-		dAtA[i] = 0x30
-	}
-	if len(m.Reason) > 0 {
-		i -= len(m.Reason)
-		copy(dAtA[i:], m.Reason)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
-		i--
-		dAtA[i] = 0x2a
+	{
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x32
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20130,7 +21082,7 @@ func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x2a
 	{
 		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20140,6 +21092,16 @@ func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
 	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
@@ -20164,7 +21126,7 @@ func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionConnect) Marshal() (dAtA []byte, err error) {
+func (m *SessionPrint) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20174,12 +21136,12 @@ func (m *SessionConnect) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionConnect) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionPrint) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionConnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionPrint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20188,26 +21150,33 @@ func (m *SessionConnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if m.Offset != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
+		i--
+		dAtA[i] = 0x30
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if m.DelayMilliseconds != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DelayMilliseconds))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.Bytes != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Bytes))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ChunkIndex != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.ChunkIndex))
+		i--
+		dAtA[i] = 0x10
 	}
-	i--
-	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20221,7 +21190,7 @@ func (m *SessionConnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *FileTransferRequestEvent) Marshal() (dAtA []byte, err error) {
+func (m *DesktopRecording) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20231,12 +21200,12 @@ func (m *FileTransferRequestEvent) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *FileTransferRequestEvent) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopRecording) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *FileTransferRequestEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopRecording) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20245,63 +21214,18 @@ func (m *FileTransferRequestEvent) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Filename) > 0 {
-		i -= len(m.Filename)
-		copy(dAtA[i:], m.Filename)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Filename)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if m.Download {
-		i--
-		if m.Download {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x38
-	}
-	if len(m.Location) > 0 {
-		i -= len(m.Location)
-		copy(dAtA[i:], m.Location)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Location)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.Requester) > 0 {
-		i -= len(m.Requester)
-		copy(dAtA[i:], m.Requester)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Requester)))
+	if m.DelayMilliseconds != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DelayMilliseconds))
 		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.Approvers) > 0 {
-		for iNdEx := len(m.Approvers) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Approvers[iNdEx])
-			copy(dAtA[i:], m.Approvers[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Approvers[iNdEx])))
-			i--
-			dAtA[i] = 0x22
-		}
+		dAtA[i] = 0x18
 	}
-	if len(m.RequestID) > 0 {
-		i -= len(m.RequestID)
-		copy(dAtA[i:], m.RequestID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
+	if len(m.Message) > 0 {
+		i -= len(m.Message)
+		copy(dAtA[i:], m.Message)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Message)))
 		i--
-		dAtA[i] = 0x1a
-	}
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x12
 	}
-	i--
-	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20315,7 +21239,7 @@ func (m *FileTransferRequestEvent) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *Resize) Marshal() (dAtA []byte, err error) {
+func (m *DesktopClipboardReceive) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20325,12 +21249,12 @@ func (m *Resize) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Resize) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopClipboardReceive) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopClipboardReceive) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20339,43 +21263,25 @@ func (m *Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x42
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	i--
-	dAtA[i] = 0x3a
-	if len(m.TerminalSize) > 0 {
-		i -= len(m.TerminalSize)
-		copy(dAtA[i:], m.TerminalSize)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TerminalSize)))
+	if m.Length != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
 		i--
-		dAtA[i] = 0x32
+		dAtA[i] = 0x30
 	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20419,7 +21325,7 @@ func (m *Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionEnd) Marshal() (dAtA []byte, err error) {
+func (m *DesktopClipboardSend) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20429,12 +21335,12 @@ func (m *SessionEnd) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionEnd) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopClipboardSend) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopClipboardSend) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20443,97 +21349,25 @@ func (m *SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.SessionRecording) > 0 {
-		i -= len(m.SessionRecording)
-		copy(dAtA[i:], m.SessionRecording)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionRecording)))
-		i--
-		dAtA[i] = 0x72
-	}
-	if len(m.InitialCommand) > 0 {
-		for iNdEx := len(m.InitialCommand) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.InitialCommand[iNdEx])
-			copy(dAtA[i:], m.InitialCommand[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.InitialCommand[iNdEx])))
-			i--
-			dAtA[i] = 0x6a
-		}
-	}
-	{
-		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x62
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x5a
-	n63, err63 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
-	if err63 != nil {
-		return 0, err63
-	}
-	i -= n63
-	i = encodeVarintEvents(dAtA, i, uint64(n63))
-	i--
-	dAtA[i] = 0x52
-	n64, err64 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
-	if err64 != nil {
-		return 0, err64
-	}
-	i -= n64
-	i = encodeVarintEvents(dAtA, i, uint64(n64))
-	i--
-	dAtA[i] = 0x4a
-	if len(m.Participants) > 0 {
-		for iNdEx := len(m.Participants) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Participants[iNdEx])
-			copy(dAtA[i:], m.Participants[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Participants[iNdEx])))
-			i--
-			dAtA[i] = 0x42
-		}
-	}
-	if m.Interactive {
-		i--
-		if m.Interactive {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
 		i--
-		dAtA[i] = 0x38
+		dAtA[i] = 0x3a
 	}
-	if m.EnhancedRecording {
-		i--
-		if m.EnhancedRecording {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
+	if m.Length != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
 		i--
 		dAtA[i] = 0x30
 	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -20577,7 +21411,7 @@ func (m *SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *BPFMetadata) Marshal() (dAtA []byte, err error) {
+func (m *DesktopSharedDirectoryStart) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20587,12 +21421,12 @@ func (m *BPFMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BPFMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryStart) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BPFMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20601,129 +21435,34 @@ func (m *BPFMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Program) > 0 {
-		i -= len(m.Program)
-		copy(dAtA[i:], m.Program)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Program)))
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x4a
 	}
-	if m.CgroupID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.CgroupID))
+	if m.DirectoryID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
 		i--
-		dAtA[i] = 0x10
-	}
-	if m.PID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.PID))
-		i--
-		dAtA[i] = 0x8
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *Status) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Status) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Status) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.UserMessage) > 0 {
-		i -= len(m.UserMessage)
-		copy(dAtA[i:], m.UserMessage)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserMessage)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.Error) > 0 {
-		i -= len(m.Error)
-		copy(dAtA[i:], m.Error)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if m.Success {
-		i--
-		if m.Success {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x8
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *SessionCommand) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *SessionCommand) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.ReturnCode != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.ReturnCode))
-		i--
-		dAtA[i] = 0x48
-	}
-	if len(m.Argv) > 0 {
-		for iNdEx := len(m.Argv) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Argv[iNdEx])
-			copy(dAtA[i:], m.Argv[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Argv[iNdEx])))
-			i--
-			dAtA[i] = 0x42
-		}
+		dAtA[i] = 0x40
 	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+	if len(m.DirectoryName) > 0 {
+		i -= len(m.DirectoryName)
+		copy(dAtA[i:], m.DirectoryName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
 		i--
 		dAtA[i] = 0x3a
 	}
-	if m.PPID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.PPID))
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x32
 	}
 	{
-		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20733,7 +21472,7 @@ func (m *SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20775,7 +21514,7 @@ func (m *SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionDisk) Marshal() (dAtA []byte, err error) {
+func (m *DesktopSharedDirectoryRead) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20785,12 +21524,12 @@ func (m *SessionDisk) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionDisk) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryRead) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryRead) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20799,25 +21538,51 @@ func (m *SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.ReturnCode != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.ReturnCode))
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
 		i--
-		dAtA[i] = 0x40
+		dAtA[i] = 0x62
 	}
-	if m.Flags != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Flags))
+	if m.Offset != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
 		i--
-		dAtA[i] = 0x38
+		dAtA[i] = 0x58
+	}
+	if m.Length != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
+		i--
+		dAtA[i] = 0x50
 	}
 	if len(m.Path) > 0 {
 		i -= len(m.Path)
 		copy(dAtA[i:], m.Path)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
 		i--
+		dAtA[i] = 0x4a
+	}
+	if m.DirectoryID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
+		i--
+		dAtA[i] = 0x40
+	}
+	if len(m.DirectoryName) > 0 {
+		i -= len(m.DirectoryName)
+		copy(dAtA[i:], m.DirectoryName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+		i--
 		dAtA[i] = 0x32
 	}
 	{
-		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20827,7 +21592,7 @@ func (m *SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20869,7 +21634,7 @@ func (m *SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionNetwork) Marshal() (dAtA []byte, err error) {
+func (m *DesktopSharedDirectoryWrite) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20879,12 +21644,12 @@ func (m *SessionNetwork) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionNetwork) MarshalTo(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryWrite) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DesktopSharedDirectoryWrite) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -20893,42 +21658,51 @@ func (m *SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Action != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Action))
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
+		i--
+		dAtA[i] = 0x62
+	}
+	if m.Offset != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Offset))
 		i--
 		dAtA[i] = 0x58
 	}
-	if m.Operation != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Operation))
+	if m.Length != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Length))
 		i--
 		dAtA[i] = 0x50
 	}
-	if m.TCPVersion != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.TCPVersion))
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
 		i--
-		dAtA[i] = 0x48
+		dAtA[i] = 0x4a
 	}
-	if m.DstPort != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DstPort))
+	if m.DirectoryID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DirectoryID))
 		i--
 		dAtA[i] = 0x40
 	}
-	if len(m.DstAddr) > 0 {
-		i -= len(m.DstAddr)
-		copy(dAtA[i:], m.DstAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DstAddr)))
+	if len(m.DirectoryName) > 0 {
+		i -= len(m.DirectoryName)
+		copy(dAtA[i:], m.DirectoryName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DirectoryName)))
 		i--
 		dAtA[i] = 0x3a
 	}
-	if len(m.SrcAddr) > 0 {
-		i -= len(m.SrcAddr)
-		copy(dAtA[i:], m.SrcAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SrcAddr)))
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
 		i--
 		dAtA[i] = 0x32
 	}
 	{
-		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20938,7 +21712,7 @@ func (m *SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -20980,7 +21754,7 @@ func (m *SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionData) Marshal() (dAtA []byte, err error) {
+func (m *SessionReject) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -20990,12 +21764,12 @@ func (m *SessionData) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionData) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionReject) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21004,15 +21778,17 @@ func (m *SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.BytesReceived != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.BytesReceived))
+	if m.Maximum != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Maximum))
 		i--
-		dAtA[i] = 0x38
+		dAtA[i] = 0x30
 	}
-	if m.BytesTransmitted != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.BytesTransmitted))
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x2a
 	}
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
@@ -21023,19 +21799,9 @@ func (m *SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21067,7 +21833,7 @@ func (m *SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SessionLeave) Marshal() (dAtA []byte, err error) {
+func (m *SessionConnect) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21077,12 +21843,12 @@ func (m *SessionLeave) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SessionLeave) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionConnect) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionConnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21100,29 +21866,9 @@ func (m *SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21144,7 +21890,7 @@ func (m *SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *UserLogin) Marshal() (dAtA []byte, err error) {
+func (m *FileTransferRequestEvent) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21154,12 +21900,12 @@ func (m *UserLogin) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UserLogin) MarshalTo(dAtA []byte) (int, error) {
+func (m *FileTransferRequestEvent) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *FileTransferRequestEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21168,85 +21914,55 @@ func (m *UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.ConnectorID) > 0 {
-		i -= len(m.ConnectorID)
-		copy(dAtA[i:], m.ConnectorID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ConnectorID)))
+	if len(m.Filename) > 0 {
+		i -= len(m.Filename)
+		copy(dAtA[i:], m.Filename)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Filename)))
 		i--
-		dAtA[i] = 0x52
-	}
-	if len(m.AppliedLoginRules) > 0 {
-		for iNdEx := len(m.AppliedLoginRules) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.AppliedLoginRules[iNdEx])
-			copy(dAtA[i:], m.AppliedLoginRules[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.AppliedLoginRules[iNdEx])))
-			i--
-			dAtA[i] = 0x4a
-		}
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x42
 	}
-	i--
-	dAtA[i] = 0x42
-	{
-		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Download {
+		i--
+		if m.Download {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x38
 	}
-	i--
-	dAtA[i] = 0x3a
-	if m.MFADevice != nil {
-		{
-			size, err := m.MFADevice.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	if len(m.Location) > 0 {
+		i -= len(m.Location)
+		copy(dAtA[i:], m.Location)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Location)))
 		i--
 		dAtA[i] = 0x32
 	}
-	if m.IdentityAttributes != nil {
-		{
-			size, err := m.IdentityAttributes.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	if len(m.Requester) > 0 {
+		i -= len(m.Requester)
+		copy(dAtA[i:], m.Requester)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Requester)))
 		i--
 		dAtA[i] = 0x2a
 	}
-	if len(m.Method) > 0 {
-		i -= len(m.Method)
-		copy(dAtA[i:], m.Method)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
-		i--
-		dAtA[i] = 0x22
-	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Approvers) > 0 {
+		for iNdEx := len(m.Approvers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Approvers[iNdEx])
+			copy(dAtA[i:], m.Approvers[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Approvers[iNdEx])))
+			i--
+			dAtA[i] = 0x22
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x1a
+	if len(m.RequestID) > 0 {
+		i -= len(m.RequestID)
+		copy(dAtA[i:], m.RequestID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
+		i--
+		dAtA[i] = 0x1a
+	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21268,7 +21984,7 @@ func (m *UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *CreateMFAAuthChallenge) Marshal() (dAtA []byte, err error) {
+func (m *Resize) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21278,12 +21994,12 @@ func (m *CreateMFAAuthChallenge) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *CreateMFAAuthChallenge) MarshalTo(dAtA []byte) (int, error) {
+func (m *Resize) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *CreateMFAAuthChallenge) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21292,25 +22008,8 @@ func (m *CreateMFAAuthChallenge) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.ChallengeAllowReuse {
-		i--
-		if m.ChallengeAllowReuse {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x20
-	}
-	if len(m.ChallengeScope) > 0 {
-		i -= len(m.ChallengeScope)
-		copy(dAtA[i:], m.ChallengeScope)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ChallengeScope)))
-		i--
-		dAtA[i] = 0x1a
-	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21318,9 +22017,9 @@ func (m *CreateMFAAuthChallenge) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
+	dAtA[i] = 0x42
 	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21328,65 +22027,36 @@ func (m *CreateMFAAuthChallenge) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *ValidateMFAAuthResponse) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *ValidateMFAAuthResponse) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *ValidateMFAAuthResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.ChallengeAllowReuse {
-		i--
-		if m.ChallengeAllowReuse {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
+	dAtA[i] = 0x3a
+	if len(m.TerminalSize) > 0 {
+		i -= len(m.TerminalSize)
+		copy(dAtA[i:], m.TerminalSize)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TerminalSize)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x32
 	}
-	if len(m.ChallengeScope) > 0 {
-		i -= len(m.ChallengeScope)
-		copy(dAtA[i:], m.ChallengeScope)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ChallengeScope)))
-		i--
-		dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.MFADevice != nil {
-		{
-			size, err := m.MFADevice.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x22
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21418,7 +22088,7 @@ func (m *ValidateMFAAuthResponse) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceMetadata) Marshal() (dAtA []byte, err error) {
+func (m *SessionEnd) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21428,12 +22098,12 @@ func (m *ResourceMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionEnd) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21442,64 +22112,89 @@ func (m *ResourceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.TTL) > 0 {
-		i -= len(m.TTL)
-		copy(dAtA[i:], m.TTL)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TTL)))
+	if len(m.SessionRecording) > 0 {
+		i -= len(m.SessionRecording)
+		copy(dAtA[i:], m.SessionRecording)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionRecording)))
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x72
 	}
-	if len(m.UpdatedBy) > 0 {
-		i -= len(m.UpdatedBy)
-		copy(dAtA[i:], m.UpdatedBy)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UpdatedBy)))
-		i--
-		dAtA[i] = 0x1a
+	if len(m.InitialCommand) > 0 {
+		for iNdEx := len(m.InitialCommand) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.InitialCommand[iNdEx])
+			copy(dAtA[i:], m.InitialCommand[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.InitialCommand[iNdEx])))
+			i--
+			dAtA[i] = 0x6a
+		}
 	}
-	n108, err108 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err108 != nil {
-		return 0, err108
+	{
+		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i -= n108
-	i = encodeVarintEvents(dAtA, i, uint64(n108))
 	i--
-	dAtA[i] = 0x12
-	if len(m.Name) > 0 {
-		i -= len(m.Name)
-		copy(dAtA[i:], m.Name)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
-		i--
-		dAtA[i] = 0xa
+	dAtA[i] = 0x62
+	{
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return len(dAtA) - i, nil
-}
-
-func (m *UserCreate) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+	i--
+	dAtA[i] = 0x5a
+	n64, err64 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
+	if err64 != nil {
+		return 0, err64
 	}
-	return dAtA[:n], nil
-}
-
-func (m *UserCreate) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
+	i -= n64
+	i = encodeVarintEvents(dAtA, i, uint64(n64))
+	i--
+	dAtA[i] = 0x52
+	n65, err65 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
+	if err65 != nil {
+		return 0, err65
+	}
+	i -= n65
+	i = encodeVarintEvents(dAtA, i, uint64(n65))
+	i--
+	dAtA[i] = 0x4a
+	if len(m.Participants) > 0 {
+		for iNdEx := len(m.Participants) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Participants[iNdEx])
+			copy(dAtA[i:], m.Participants[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Participants[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.Interactive {
+		i--
+		if m.Interactive {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.EnhancedRecording {
+		i--
+		if m.EnhancedRecording {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21507,25 +22202,19 @@ func (m *UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
-	if len(m.Connector) > 0 {
-		i -= len(m.Connector)
-		copy(dAtA[i:], m.Connector)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Connector)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0x22
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21557,7 +22246,7 @@ func (m *UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *UserUpdate) Marshal() (dAtA []byte, err error) {
+func (m *BPFMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21567,12 +22256,107 @@ func (m *UserUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UserUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *BPFMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BPFMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Program) > 0 {
+		i -= len(m.Program)
+		copy(dAtA[i:], m.Program)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Program)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.CgroupID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.CgroupID))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.PID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.PID))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Status) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Status) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Status) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.UserMessage) > 0 {
+		i -= len(m.UserMessage)
+		copy(dAtA[i:], m.UserMessage)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserMessage)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Success {
+		i--
+		if m.Success {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SessionCommand) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SessionCommand) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21581,8 +22365,34 @@ func (m *UserUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ReturnCode != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.ReturnCode))
+		i--
+		dAtA[i] = 0x48
+	}
+	if len(m.Argv) > 0 {
+		for iNdEx := len(m.Argv) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Argv[iNdEx])
+			copy(dAtA[i:], m.Argv[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Argv[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if m.PPID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.PPID))
+		i--
+		dAtA[i] = 0x30
+	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21590,25 +22400,19 @@ func (m *UserUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
-	if len(m.Connector) > 0 {
-		i -= len(m.Connector)
-		copy(dAtA[i:], m.Connector)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Connector)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0x22
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21640,7 +22444,7 @@ func (m *UserUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *UserDelete) Marshal() (dAtA []byte, err error) {
+func (m *SessionDisk) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21650,12 +22454,12 @@ func (m *UserDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UserDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionDisk) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21664,8 +22468,35 @@ func (m *UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ReturnCode != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.ReturnCode))
+		i--
+		dAtA[i] = 0x40
+	}
+	if m.Flags != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Flags))
+		i--
+		dAtA[i] = 0x38
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x32
+	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21675,7 +22506,7 @@ func (m *UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21707,7 +22538,7 @@ func (m *UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *UserPasswordChange) Marshal() (dAtA []byte, err error) {
+func (m *SessionNetwork) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21717,12 +22548,12 @@ func (m *UserPasswordChange) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UserPasswordChange) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionNetwork) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21731,8 +22562,62 @@ func (m *UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.Action != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Action))
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.Operation != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Operation))
+		i--
+		dAtA[i] = 0x50
+	}
+	if m.TCPVersion != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.TCPVersion))
+		i--
+		dAtA[i] = 0x48
+	}
+	if m.DstPort != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DstPort))
+		i--
+		dAtA[i] = 0x40
+	}
+	if len(m.DstAddr) > 0 {
+		i -= len(m.DstAddr)
+		copy(dAtA[i:], m.DstAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DstAddr)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.SrcAddr) > 0 {
+		i -= len(m.SrcAddr)
+		copy(dAtA[i:], m.SrcAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SrcAddr)))
+		i--
+		dAtA[i] = 0x32
+	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.BPFMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21764,7 +22649,7 @@ func (m *UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessRequestCreate) Marshal() (dAtA []byte, err error) {
+func (m *SessionData) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21774,12 +22659,12 @@ func (m *AccessRequestCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AccessRequestCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionData) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessRequestCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21788,123 +22673,38 @@ func (m *AccessRequestCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.ResourceNames) > 0 {
-		for iNdEx := len(m.ResourceNames) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.ResourceNames[iNdEx])
-			copy(dAtA[i:], m.ResourceNames[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceNames[iNdEx])))
-			i--
-			dAtA[i] = 0x1
-			i--
-			dAtA[i] = 0x8a
-		}
-	}
-	if m.AssumeStartTime != nil {
-		n124, err124 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
-		if err124 != nil {
-			return 0, err124
-		}
-		i -= n124
-		i = encodeVarintEvents(dAtA, i, uint64(n124))
-		i--
-		dAtA[i] = 0x1
-		i--
-		dAtA[i] = 0x82
-	}
-	if len(m.PromotedAccessListName) > 0 {
-		i -= len(m.PromotedAccessListName)
-		copy(dAtA[i:], m.PromotedAccessListName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PromotedAccessListName)))
-		i--
-		dAtA[i] = 0x7a
-	}
-	n125, err125 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.MaxDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration):])
-	if err125 != nil {
-		return 0, err125
-	}
-	i -= n125
-	i = encodeVarintEvents(dAtA, i, uint64(n125))
-	i--
-	dAtA[i] = 0x6a
-	if len(m.RequestedResourceIDs) > 0 {
-		for iNdEx := len(m.RequestedResourceIDs) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.RequestedResourceIDs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x62
-		}
-	}
-	if len(m.ProposedState) > 0 {
-		i -= len(m.ProposedState)
-		copy(dAtA[i:], m.ProposedState)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ProposedState)))
+	if m.BytesReceived != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.BytesReceived))
 		i--
-		dAtA[i] = 0x5a
+		dAtA[i] = 0x38
 	}
-	if len(m.Reviewer) > 0 {
-		i -= len(m.Reviewer)
-		copy(dAtA[i:], m.Reviewer)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reviewer)))
+	if m.BytesTransmitted != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.BytesTransmitted))
 		i--
-		dAtA[i] = 0x52
+		dAtA[i] = 0x30
 	}
-	if m.Annotations != nil {
-		{
-			size, err := m.Annotations.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x4a
-	}
-	if len(m.Reason) > 0 {
-		i -= len(m.Reason)
-		copy(dAtA[i:], m.Reason)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.Delegator) > 0 {
-		i -= len(m.Delegator)
-		copy(dAtA[i:], m.Delegator)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Delegator)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.RequestState) > 0 {
-		i -= len(m.RequestState)
-		copy(dAtA[i:], m.RequestState)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestState)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.RequestID) > 0 {
-		i -= len(m.RequestID)
-		copy(dAtA[i:], m.RequestID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
-		i--
-		dAtA[i] = 0x2a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0x22
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -21936,7 +22736,7 @@ func (m *AccessRequestCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AccessRequestExpire) Marshal() (dAtA []byte, err error) {
+func (m *SessionLeave) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -21946,12 +22746,12 @@ func (m *AccessRequestExpire) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AccessRequestExpire) MarshalTo(dAtA []byte) (int, error) {
+func (m *SessionLeave) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AccessRequestExpire) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -21960,25 +22760,38 @@ func (m *AccessRequestExpire) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.ResourceExpiry != nil {
-		n130, err130 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ResourceExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry):])
-		if err130 != nil {
-			return 0, err130
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i -= n130
-		i = encodeVarintEvents(dAtA, i, uint64(n130))
-		i--
-		dAtA[i] = 0x22
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.RequestID) > 0 {
-		i -= len(m.RequestID)
-		copy(dAtA[i:], m.RequestID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
-		i--
-		dAtA[i] = 0x1a
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22000,7 +22813,7 @@ func (m *AccessRequestExpire) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceID) Marshal() (dAtA []byte, err error) {
+func (m *UserLogin) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22010,12 +22823,12 @@ func (m *ResourceID) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceID) MarshalTo(dAtA []byte) (int, error) {
+func (m *UserLogin) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceID) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22024,68 +22837,83 @@ func (m *ResourceID) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.SubResourceName) > 0 {
-		i -= len(m.SubResourceName)
-		copy(dAtA[i:], m.SubResourceName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SubResourceName)))
+	if len(m.ConnectorID) > 0 {
+		i -= len(m.ConnectorID)
+		copy(dAtA[i:], m.ConnectorID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ConnectorID)))
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x52
 	}
-	if len(m.Name) > 0 {
-		i -= len(m.Name)
-		copy(dAtA[i:], m.Name)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
-		i--
-		dAtA[i] = 0x1a
+	if len(m.AppliedLoginRules) > 0 {
+		for iNdEx := len(m.AppliedLoginRules) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.AppliedLoginRules[iNdEx])
+			copy(dAtA[i:], m.AppliedLoginRules[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.AppliedLoginRules[iNdEx])))
+			i--
+			dAtA[i] = 0x4a
+		}
 	}
-	if len(m.Kind) > 0 {
-		i -= len(m.Kind)
-		copy(dAtA[i:], m.Kind)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Kind)))
-		i--
-		dAtA[i] = 0x12
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.ClusterName) > 0 {
-		i -= len(m.ClusterName)
-		copy(dAtA[i:], m.ClusterName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClusterName)))
-		i--
-		dAtA[i] = 0xa
+	i--
+	dAtA[i] = 0x42
+	{
+		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return len(dAtA) - i, nil
-}
-
-func (m *AccessRequestDelete) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+	i--
+	dAtA[i] = 0x3a
+	if m.MFADevice != nil {
+		{
+			size, err := m.MFADevice.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
 	}
-	return dAtA[:n], nil
-}
-
-func (m *AccessRequestDelete) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *AccessRequestDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
+	if m.IdentityAttributes != nil {
+		{
+			size, err := m.IdentityAttributes.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
 	}
-	if len(m.RequestID) > 0 {
-		i -= len(m.RequestID)
-		copy(dAtA[i:], m.RequestID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x22
+	}
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -22109,7 +22937,7 @@ func (m *AccessRequestDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PortForward) Marshal() (dAtA []byte, err error) {
+func (m *CreateMFAAuthChallenge) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22119,12 +22947,12 @@ func (m *PortForward) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PortForward) MarshalTo(dAtA []byte) (int, error) {
+func (m *CreateMFAAuthChallenge) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *CreateMFAAuthChallenge) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22133,53 +22961,23 @@ func (m *PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x3a
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x32
-	if len(m.Addr) > 0 {
-		i -= len(m.Addr)
-		copy(dAtA[i:], m.Addr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Addr)))
+	if m.ChallengeAllowReuse {
 		i--
-		dAtA[i] = 0x2a
-	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+		if m.ChallengeAllowReuse {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x20
 	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.ChallengeScope) > 0 {
+		i -= len(m.ChallengeScope)
+		copy(dAtA[i:], m.ChallengeScope)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ChallengeScope)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -22203,7 +23001,7 @@ func (m *PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *X11Forward) Marshal() (dAtA []byte, err error) {
+func (m *ValidateMFAAuthResponse) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22213,12 +23011,12 @@ func (m *X11Forward) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *X11Forward) MarshalTo(dAtA []byte) (int, error) {
+func (m *ValidateMFAAuthResponse) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ValidateMFAAuthResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22227,18 +23025,37 @@ func (m *X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.ChallengeAllowReuse {
+		i--
+		if m.ChallengeAllowReuse {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x30
+	}
+	if len(m.ChallengeScope) > 0 {
+		i -= len(m.ChallengeScope)
+		copy(dAtA[i:], m.ChallengeScope)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ChallengeScope)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.MFADevice != nil {
+		{
+			size, err := m.MFADevice.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22270,7 +23087,7 @@ func (m *X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *CommandMetadata) Marshal() (dAtA []byte, err error) {
+func (m *ResourceMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22280,12 +23097,12 @@ func (m *CommandMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *CommandMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *CommandMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22294,31 +23111,39 @@ func (m *CommandMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Error) > 0 {
-		i -= len(m.Error)
-		copy(dAtA[i:], m.Error)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+	if len(m.TTL) > 0 {
+		i -= len(m.TTL)
+		copy(dAtA[i:], m.TTL)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TTL)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x22
 	}
-	if len(m.ExitCode) > 0 {
-		i -= len(m.ExitCode)
-		copy(dAtA[i:], m.ExitCode)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ExitCode)))
+	if len(m.UpdatedBy) > 0 {
+		i -= len(m.UpdatedBy)
+		copy(dAtA[i:], m.UpdatedBy)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UpdatedBy)))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x1a
 	}
-	if len(m.Command) > 0 {
-		i -= len(m.Command)
-		copy(dAtA[i:], m.Command)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Command)))
+	n109, err109 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err109 != nil {
+		return 0, err109
+	}
+	i -= n109
+	i = encodeVarintEvents(dAtA, i, uint64(n109))
+	i--
+	dAtA[i] = 0x12
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *Exec) Marshal() (dAtA []byte, err error) {
+func (m *UserCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22328,12 +23153,12 @@ func (m *Exec) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Exec) MarshalTo(dAtA []byte) (int, error) {
+func (m *UserCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22343,7 +23168,7 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22351,9 +23176,25 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x42
+	dAtA[i] = 0x32
+	if len(m.Connector) > 0 {
+		i -= len(m.Connector)
+		copy(dAtA[i:], m.Connector)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Connector)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
 	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22361,9 +23202,9 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x3a
+	dAtA[i] = 0x1a
 	{
-		size, err := m.CommandMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22371,9 +23212,9 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
+	dAtA[i] = 0x12
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22381,9 +23222,36 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *UserUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UserUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UserUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22391,9 +23259,25 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x32
+	if len(m.Connector) > 0 {
+		i -= len(m.Connector)
+		copy(dAtA[i:], m.Connector)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Connector)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22425,7 +23309,7 @@ func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SCP) Marshal() (dAtA []byte, err error) {
+func (m *UserDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22435,12 +23319,12 @@ func (m *SCP) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SCP) MarshalTo(dAtA []byte) (int, error) {
+func (m *UserDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22449,22 +23333,18 @@ func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Action) > 0 {
-		i -= len(m.Action)
-		copy(dAtA[i:], m.Action)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Action)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
-		i--
-		dAtA[i] = 0x3a
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.CommandMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22472,9 +23352,9 @@ func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
+	dAtA[i] = 0x1a
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22482,9 +23362,9 @@ func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0x12
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22492,7 +23372,34 @@ func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *UserPasswordChange) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UserPasswordChange) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -22526,7 +23433,7 @@ func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SFTPAttributes) Marshal() (dAtA []byte, err error) {
+func (m *AccessRequestCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22536,12 +23443,12 @@ func (m *SFTPAttributes) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SFTPAttributes) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessRequestCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SFTPAttributes) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessRequestCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22550,108 +23457,75 @@ func (m *SFTPAttributes) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.ModificationTime != nil {
-		n159, err159 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ModificationTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ModificationTime):])
-		if err159 != nil {
-			return 0, err159
+	if len(m.ResourceNames) > 0 {
+		for iNdEx := len(m.ResourceNames) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ResourceNames[iNdEx])
+			copy(dAtA[i:], m.ResourceNames[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceNames[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x8a
 		}
-		i -= n159
-		i = encodeVarintEvents(dAtA, i, uint64(n159))
-		i--
-		dAtA[i] = 0x32
 	}
-	if m.AccessTime != nil {
-		n160, err160 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AccessTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AccessTime):])
-		if err160 != nil {
-			return 0, err160
+	if m.AssumeStartTime != nil {
+		n125, err125 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
+		if err125 != nil {
+			return 0, err125
 		}
-		i -= n160
-		i = encodeVarintEvents(dAtA, i, uint64(n160))
+		i -= n125
+		i = encodeVarintEvents(dAtA, i, uint64(n125))
 		i--
-		dAtA[i] = 0x2a
-	}
-	if m.Permissions != nil {
-		n161, err161 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.Permissions, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.Permissions):])
-		if err161 != nil {
-			return 0, err161
-		}
-		i -= n161
-		i = encodeVarintEvents(dAtA, i, uint64(n161))
+		dAtA[i] = 0x1
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x82
 	}
-	if m.GID != nil {
-		n162, err162 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.GID, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.GID):])
-		if err162 != nil {
-			return 0, err162
-		}
-		i -= n162
-		i = encodeVarintEvents(dAtA, i, uint64(n162))
+	if len(m.PromotedAccessListName) > 0 {
+		i -= len(m.PromotedAccessListName)
+		copy(dAtA[i:], m.PromotedAccessListName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PromotedAccessListName)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x7a
 	}
-	if m.UID != nil {
-		n163, err163 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.UID, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.UID):])
-		if err163 != nil {
-			return 0, err163
-		}
-		i -= n163
-		i = encodeVarintEvents(dAtA, i, uint64(n163))
-		i--
-		dAtA[i] = 0x12
+	n126, err126 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.MaxDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration):])
+	if err126 != nil {
+		return 0, err126
 	}
-	if m.FileSize != nil {
-		n164, err164 := github_com_gogo_protobuf_types.StdUInt64MarshalTo(*m.FileSize, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt64(*m.FileSize):])
-		if err164 != nil {
-			return 0, err164
+	i -= n126
+	i = encodeVarintEvents(dAtA, i, uint64(n126))
+	i--
+	dAtA[i] = 0x6a
+	if len(m.RequestedResourceIDs) > 0 {
+		for iNdEx := len(m.RequestedResourceIDs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.RequestedResourceIDs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x62
 		}
-		i -= n164
-		i = encodeVarintEvents(dAtA, i, uint64(n164))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *SFTP) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *SFTP) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *SFTP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Error) > 0 {
-		i -= len(m.Error)
-		copy(dAtA[i:], m.Error)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+	if len(m.ProposedState) > 0 {
+		i -= len(m.ProposedState)
+		copy(dAtA[i:], m.ProposedState)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ProposedState)))
 		i--
-		dAtA[i] = 0x62
+		dAtA[i] = 0x5a
 	}
-	if m.Action != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Action))
+	if len(m.Reviewer) > 0 {
+		i -= len(m.Reviewer)
+		copy(dAtA[i:], m.Reviewer)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reviewer)))
 		i--
-		dAtA[i] = 0x58
+		dAtA[i] = 0x52
 	}
-	if m.Attributes != nil {
+	if m.Annotations != nil {
 		{
-			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Annotations.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -22659,56 +23533,47 @@ func (m *SFTP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x52
-	}
-	if m.Flags != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.Flags))
-		i--
-		dAtA[i] = 0x48
+		dAtA[i] = 0x4a
 	}
-	if len(m.TargetPath) > 0 {
-		i -= len(m.TargetPath)
-		copy(dAtA[i:], m.TargetPath)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TargetPath)))
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
 		i--
 		dAtA[i] = 0x42
 	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+	if len(m.Delegator) > 0 {
+		i -= len(m.Delegator)
+		copy(dAtA[i:], m.Delegator)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Delegator)))
 		i--
 		dAtA[i] = 0x3a
 	}
-	if len(m.WorkingDirectory) > 0 {
-		i -= len(m.WorkingDirectory)
-		copy(dAtA[i:], m.WorkingDirectory)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.WorkingDirectory)))
+	if len(m.RequestState) > 0 {
+		i -= len(m.RequestState)
+		copy(dAtA[i:], m.RequestState)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestState)))
 		i--
 		dAtA[i] = 0x32
 	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.RequestID) > 0 {
+		i -= len(m.RequestID)
+		copy(dAtA[i:], m.RequestID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0x22
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22740,7 +23605,7 @@ func (m *SFTP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SFTPSummary) Marshal() (dAtA []byte, err error) {
+func (m *AccessRequestExpire) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22750,12 +23615,12 @@ func (m *SFTPSummary) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SFTPSummary) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessRequestExpire) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SFTPSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessRequestExpire) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22764,52 +23629,25 @@ func (m *SFTPSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.FileTransferStats) > 0 {
-		for iNdEx := len(m.FileTransferStats) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.FileTransferStats[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x32
-		}
-	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.ResourceExpiry != nil {
+		n131, err131 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ResourceExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry):])
+		if err131 != nil {
+			return 0, err131
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i -= n131
+		i = encodeVarintEvents(dAtA, i, uint64(n131))
+		i--
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.RequestID) > 0 {
+		i -= len(m.RequestID)
+		copy(dAtA[i:], m.RequestID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -22831,7 +23669,7 @@ func (m *SFTPSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *FileTransferStat) Marshal() (dAtA []byte, err error) {
+func (m *ResourceID) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22841,12 +23679,12 @@ func (m *FileTransferStat) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *FileTransferStat) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceID) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *FileTransferStat) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceID) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22855,27 +23693,38 @@ func (m *FileTransferStat) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.BytesWritten != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.BytesWritten))
+	if len(m.SubResourceName) > 0 {
+		i -= len(m.SubResourceName)
+		copy(dAtA[i:], m.SubResourceName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SubResourceName)))
 		i--
-		dAtA[i] = 0x18
+		dAtA[i] = 0x22
 	}
-	if m.BytesRead != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.BytesRead))
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
 		i--
-		dAtA[i] = 0x10
+		dAtA[i] = 0x1a
 	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+	if len(m.Kind) > 0 {
+		i -= len(m.Kind)
+		copy(dAtA[i:], m.Kind)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Kind)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.ClusterName) > 0 {
+		i -= len(m.ClusterName)
+		copy(dAtA[i:], m.ClusterName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClusterName)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *Subsystem) Marshal() (dAtA []byte, err error) {
+func (m *AccessRequestDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22885,12 +23734,12 @@ func (m *Subsystem) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Subsystem) MarshalTo(dAtA []byte) (int, error) {
+func (m *AccessRequestDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Subsystem) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AccessRequestDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22899,40 +23748,13 @@ func (m *Subsystem) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x32
-	if len(m.Error) > 0 {
-		i -= len(m.Error)
-		copy(dAtA[i:], m.Error)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.Name) > 0 {
-		i -= len(m.Name)
-		copy(dAtA[i:], m.Name)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
+	if len(m.RequestID) > 0 {
+		i -= len(m.RequestID)
+		copy(dAtA[i:], m.RequestID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestID)))
 		i--
-		dAtA[i] = 0x22
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -22956,7 +23778,7 @@ func (m *Subsystem) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ClientDisconnect) Marshal() (dAtA []byte, err error) {
+func (m *PortForward) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -22966,12 +23788,12 @@ func (m *ClientDisconnect) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ClientDisconnect) MarshalTo(dAtA []byte) (int, error) {
+func (m *PortForward) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ClientDisconnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -22980,15 +23802,35 @@ func (m *ClientDisconnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Reason) > 0 {
-		i -= len(m.Reason)
-		copy(dAtA[i:], m.Reason)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
+	{
+		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x3a
+	{
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	if len(m.Addr) > 0 {
+		i -= len(m.Addr)
+		copy(dAtA[i:], m.Addr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Addr)))
 		i--
 		dAtA[i] = 0x2a
 	}
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23030,7 +23872,7 @@ func (m *ClientDisconnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AuthAttempt) Marshal() (dAtA []byte, err error) {
+func (m *X11Forward) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23040,12 +23882,12 @@ func (m *AuthAttempt) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AuthAttempt) MarshalTo(dAtA []byte) (int, error) {
+func (m *X11Forward) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AuthAttempt) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23097,7 +23939,7 @@ func (m *AuthAttempt) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *UserTokenCreate) Marshal() (dAtA []byte, err error) {
+func (m *CommandMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23107,12 +23949,12 @@ func (m *UserTokenCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *UserTokenCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *CommandMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *CommandMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23121,40 +23963,31 @@ func (m *UserTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.ExitCode) > 0 {
+		i -= len(m.ExitCode)
+		copy(dAtA[i:], m.ExitCode)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ExitCode)))
+		i--
+		dAtA[i] = 0x12
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.Command) > 0 {
+		i -= len(m.Command)
+		copy(dAtA[i:], m.Command)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Command)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *RoleCreate) Marshal() (dAtA []byte, err error) {
+func (m *Exec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23164,12 +23997,12 @@ func (m *RoleCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *RoleCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *Exec) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23179,7 +24012,7 @@ func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.KubernetesPodMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23187,9 +24020,9 @@ func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x42
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23197,9 +24030,9 @@ func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x1a
+	dAtA[i] = 0x3a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.CommandMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23207,9 +24040,9 @@ func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
+	dAtA[i] = 0x32
 	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23217,36 +24050,9 @@ func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *RoleUpdate) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *RoleUpdate) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *RoleUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
+	dAtA[i] = 0x2a
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23256,7 +24062,7 @@ func (m *RoleUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23266,7 +24072,7 @@ func (m *RoleUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23288,7 +24094,7 @@ func (m *RoleUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *RoleDelete) Marshal() (dAtA []byte, err error) {
+func (m *SCP) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23298,12 +24104,12 @@ func (m *RoleDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *RoleDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *SCP) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23312,18 +24118,22 @@ func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.Action) > 0 {
+		i -= len(m.Action)
+		copy(dAtA[i:], m.Action)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Action)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.CommandMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23331,9 +24141,9 @@ func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x1a
+	dAtA[i] = 0x32
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23341,9 +24151,9 @@ func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
+	dAtA[i] = 0x2a
 	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23351,36 +24161,9 @@ func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *BotCreate) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *BotCreate) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *BotCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
+	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23390,7 +24173,7 @@ func (m *BotCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23412,7 +24195,7 @@ func (m *BotCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *BotUpdate) Marshal() (dAtA []byte, err error) {
+func (m *SFTPAttributes) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23422,12 +24205,12 @@ func (m *BotUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BotUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *SFTPAttributes) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BotUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SFTPAttributes) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23436,40 +24219,70 @@ func (m *BotUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.ModificationTime != nil {
+		n160, err160 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ModificationTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ModificationTime):])
+		if err160 != nil {
+			return 0, err160
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+		i -= n160
+		i = encodeVarintEvents(dAtA, i, uint64(n160))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.AccessTime != nil {
+		n161, err161 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AccessTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AccessTime):])
+		if err161 != nil {
+			return 0, err161
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i -= n161
+		i = encodeVarintEvents(dAtA, i, uint64(n161))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Permissions != nil {
+		n162, err162 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.Permissions, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.Permissions):])
+		if err162 != nil {
+			return 0, err162
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i -= n162
+		i = encodeVarintEvents(dAtA, i, uint64(n162))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.GID != nil {
+		n163, err163 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.GID, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.GID):])
+		if err163 != nil {
+			return 0, err163
+		}
+		i -= n163
+		i = encodeVarintEvents(dAtA, i, uint64(n163))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.UID != nil {
+		n164, err164 := github_com_gogo_protobuf_types.StdUInt32MarshalTo(*m.UID, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.UID):])
+		if err164 != nil {
+			return 0, err164
+		}
+		i -= n164
+		i = encodeVarintEvents(dAtA, i, uint64(n164))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.FileSize != nil {
+		n165, err165 := github_com_gogo_protobuf_types.StdUInt64MarshalTo(*m.FileSize, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdUInt64(*m.FileSize):])
+		if err165 != nil {
+			return 0, err165
+		}
+		i -= n165
+		i = encodeVarintEvents(dAtA, i, uint64(n165))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *BotDelete) Marshal() (dAtA []byte, err error) {
+func (m *SFTP) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23479,12 +24292,12 @@ func (m *BotDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BotDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *SFTP) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BotDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SFTP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23493,8 +24306,78 @@ func (m *BotDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x62
+	}
+	if m.Action != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Action))
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.Attributes != nil {
+		{
+			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x52
+	}
+	if m.Flags != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Flags))
+		i--
+		dAtA[i] = 0x48
+	}
+	if len(m.TargetPath) > 0 {
+		i -= len(m.TargetPath)
+		copy(dAtA[i:], m.TargetPath)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TargetPath)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.WorkingDirectory) > 0 {
+		i -= len(m.WorkingDirectory)
+		copy(dAtA[i:], m.WorkingDirectory)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.WorkingDirectory)))
+		i--
+		dAtA[i] = 0x32
+	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23504,7 +24387,7 @@ func (m *BotDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23526,7 +24409,7 @@ func (m *BotDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *TrustedClusterCreate) Marshal() (dAtA []byte, err error) {
+func (m *SFTPSummary) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23536,12 +24419,12 @@ func (m *TrustedClusterCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *TrustedClusterCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *SFTPSummary) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SFTPSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23550,8 +24433,32 @@ func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.FileTransferStats) > 0 {
+		for iNdEx := len(m.FileTransferStats) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.FileTransferStats[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x32
+		}
+	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23561,7 +24468,7 @@ func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23571,7 +24478,7 @@ func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23593,7 +24500,7 @@ func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *TrustedClusterDelete) Marshal() (dAtA []byte, err error) {
+func (m *FileTransferStat) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23603,12 +24510,56 @@ func (m *TrustedClusterDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *TrustedClusterDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *FileTransferStat) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *FileTransferStat) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.BytesWritten != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.BytesWritten))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.BytesRead != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.BytesRead))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Subsystem) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Subsystem) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Subsystem) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23618,7 +24569,7 @@ func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23626,9 +24577,23 @@ func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x32
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0x22
+	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23638,7 +24603,7 @@ func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23660,7 +24625,7 @@ func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ProvisionTokenCreate) Marshal() (dAtA []byte, err error) {
+func (m *ClientDisconnect) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23670,12 +24635,12 @@ func (m *ProvisionTokenCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ProvisionTokenCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *ClientDisconnect) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ProvisionTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ClientDisconnect) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23684,24 +24649,25 @@ func (m *ProvisionTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.JoinMethod) > 0 {
-		i -= len(m.JoinMethod)
-		copy(dAtA[i:], m.JoinMethod)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.JoinMethod)))
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Reason)))
 		i--
 		dAtA[i] = 0x2a
 	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0x22
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23711,7 +24677,7 @@ func (m *ProvisionTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23733,7 +24699,7 @@ func (m *ProvisionTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *TrustedClusterTokenCreate) Marshal() (dAtA []byte, err error) {
+func (m *AuthAttempt) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23743,12 +24709,12 @@ func (m *TrustedClusterTokenCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *TrustedClusterTokenCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *AuthAttempt) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *TrustedClusterTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AuthAttempt) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23758,7 +24724,27 @@ func (m *TrustedClusterTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23768,7 +24754,7 @@ func (m *TrustedClusterTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -23790,7 +24776,7 @@ func (m *TrustedClusterTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
-func (m *GithubConnectorCreate) Marshal() (dAtA []byte, err error) {
+func (m *UserTokenCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23800,12 +24786,12 @@ func (m *GithubConnectorCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *GithubConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *UserTokenCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *GithubConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *UserTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23814,16 +24800,6 @@ func (m *GithubConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -23857,7 +24833,7 @@ func (m *GithubConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *GithubConnectorUpdate) Marshal() (dAtA []byte, err error) {
+func (m *RoleCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23867,12 +24843,12 @@ func (m *GithubConnectorUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *GithubConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *RoleCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *GithubConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *RoleCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23924,7 +24900,7 @@ func (m *GithubConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *GithubConnectorDelete) Marshal() (dAtA []byte, err error) {
+func (m *RoleUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -23934,12 +24910,12 @@ func (m *GithubConnectorDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *GithubConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *RoleUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *GithubConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *RoleUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -23991,7 +24967,7 @@ func (m *GithubConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *OIDCConnectorCreate) Marshal() (dAtA []byte, err error) {
+func (m *RoleDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24001,12 +24977,12 @@ func (m *OIDCConnectorCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OIDCConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *RoleDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OIDCConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *RoleDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24015,6 +24991,16 @@ func (m *OIDCConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -24048,7 +25034,7 @@ func (m *OIDCConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *OIDCConnectorUpdate) Marshal() (dAtA []byte, err error) {
+func (m *BotCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24058,12 +25044,12 @@ func (m *OIDCConnectorUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OIDCConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *BotCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OIDCConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BotCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24105,7 +25091,7 @@ func (m *OIDCConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *OIDCConnectorDelete) Marshal() (dAtA []byte, err error) {
+func (m *BotUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24115,12 +25101,12 @@ func (m *OIDCConnectorDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OIDCConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *BotUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OIDCConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BotUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24162,7 +25148,7 @@ func (m *OIDCConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SAMLConnectorCreate) Marshal() (dAtA []byte, err error) {
+func (m *BotDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24172,12 +25158,12 @@ func (m *SAMLConnectorCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SAMLConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *BotDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SAMLConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BotDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24186,18 +25172,6 @@ func (m *SAMLConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Connector != nil {
-		{
-			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x22
-	}
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -24231,7 +25205,7 @@ func (m *SAMLConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SAMLConnectorUpdate) Marshal() (dAtA []byte, err error) {
+func (m *TrustedClusterCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24241,12 +25215,12 @@ func (m *SAMLConnectorUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SAMLConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *TrustedClusterCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SAMLConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TrustedClusterCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24255,18 +25229,16 @@ func (m *SAMLConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Connector != nil {
-		{
-			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x22
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -24300,7 +25272,7 @@ func (m *SAMLConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *SAMLConnectorDelete) Marshal() (dAtA []byte, err error) {
+func (m *TrustedClusterDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24310,12 +25282,12 @@ func (m *SAMLConnectorDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *SAMLConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *TrustedClusterDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *SAMLConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TrustedClusterDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24324,6 +25296,16 @@ func (m *SAMLConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -24357,7 +25339,7 @@ func (m *SAMLConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *KubeRequest) Marshal() (dAtA []byte, err error) {
+func (m *ProvisionTokenCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24367,12 +25349,12 @@ func (m *KubeRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *KubeRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *ProvisionTokenCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *KubeRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ProvisionTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24381,85 +25363,24 @@ func (m *KubeRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x6a
-	{
-		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x62
-	if m.ResponseCode != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.ResponseCode))
-		i--
-		dAtA[i] = 0x58
-	}
-	if len(m.ResourceName) > 0 {
-		i -= len(m.ResourceName)
-		copy(dAtA[i:], m.ResourceName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceName)))
-		i--
-		dAtA[i] = 0x52
-	}
-	if len(m.ResourceKind) > 0 {
-		i -= len(m.ResourceKind)
-		copy(dAtA[i:], m.ResourceKind)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceKind)))
-		i--
-		dAtA[i] = 0x4a
-	}
-	if len(m.ResourceNamespace) > 0 {
-		i -= len(m.ResourceNamespace)
-		copy(dAtA[i:], m.ResourceNamespace)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceNamespace)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.ResourceAPIGroup) > 0 {
-		i -= len(m.ResourceAPIGroup)
-		copy(dAtA[i:], m.ResourceAPIGroup)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceAPIGroup)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.Verb) > 0 {
-		i -= len(m.Verb)
-		copy(dAtA[i:], m.Verb)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Verb)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.RequestPath) > 0 {
-		i -= len(m.RequestPath)
-		copy(dAtA[i:], m.RequestPath)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestPath)))
+	if len(m.JoinMethod) > 0 {
+		i -= len(m.JoinMethod)
+		copy(dAtA[i:], m.JoinMethod)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.JoinMethod)))
 		i--
 		dAtA[i] = 0x2a
 	}
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0x22
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24469,7 +25390,7 @@ func (m *KubeRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24491,7 +25412,7 @@ func (m *KubeRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppMetadata) Marshal() (dAtA []byte, err error) {
+func (m *TrustedClusterTokenCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24501,12 +25422,12 @@ func (m *AppMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *TrustedClusterTokenCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TrustedClusterTokenCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24515,55 +25436,40 @@ func (m *AppMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.AppTargetPort != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.AppTargetPort))
-		i--
-		dAtA[i] = 0x28
-	}
-	if len(m.AppName) > 0 {
-		i -= len(m.AppName)
-		copy(dAtA[i:], m.AppName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppName)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.AppLabels) > 0 {
-		for k := range m.AppLabels {
-			v := m.AppLabels[k]
-			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
-			i--
-			dAtA[i] = 0x12
-			i -= len(k)
-			copy(dAtA[i:], k)
-			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AppPublicAddr) > 0 {
-		i -= len(m.AppPublicAddr)
-		copy(dAtA[i:], m.AppPublicAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppPublicAddr)))
-		i--
-		dAtA[i] = 0x12
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AppURI) > 0 {
-		i -= len(m.AppURI)
-		copy(dAtA[i:], m.AppURI)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppURI)))
-		i--
-		dAtA[i] = 0xa
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *AppCreate) Marshal() (dAtA []byte, err error) {
+func (m *GithubConnectorCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24573,12 +25479,12 @@ func (m *AppCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *GithubConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *GithubConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24588,7 +25494,7 @@ func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24598,7 +25504,7 @@ func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24608,7 +25514,7 @@ func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24630,7 +25536,7 @@ func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppUpdate) Marshal() (dAtA []byte, err error) {
+func (m *GithubConnectorUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24640,12 +25546,12 @@ func (m *AppUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *GithubConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *GithubConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24655,7 +25561,7 @@ func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24665,7 +25571,7 @@ func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24675,7 +25581,7 @@ func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24697,7 +25603,7 @@ func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppDelete) Marshal() (dAtA []byte, err error) {
+func (m *GithubConnectorDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24707,12 +25613,12 @@ func (m *AppDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *GithubConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *GithubConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24722,7 +25628,7 @@ func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24730,7 +25636,7 @@ func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x1a
+	dAtA[i] = 0x22
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -24740,6 +25646,16 @@ func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
 	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
@@ -24754,7 +25670,7 @@ func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppSessionStart) Marshal() (dAtA []byte, err error) {
+func (m *OIDCConnectorCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24764,12 +25680,12 @@ func (m *AppSessionStart) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppSessionStart) MarshalTo(dAtA []byte) (int, error) {
+func (m *OIDCConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OIDCConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24779,7 +25695,7 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24787,16 +25703,9 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x42
-	if len(m.PublicAddr) > 0 {
-		i -= len(m.PublicAddr)
-		copy(dAtA[i:], m.PublicAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PublicAddr)))
-		i--
-		dAtA[i] = 0x3a
-	}
+	dAtA[i] = 0x1a
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24804,9 +25713,9 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0x12
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24814,9 +25723,36 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *OIDCConnectorUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OIDCConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OIDCConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24826,7 +25762,7 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24848,7 +25784,7 @@ func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppSessionEnd) Marshal() (dAtA []byte, err error) {
+func (m *OIDCConnectorDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24858,12 +25794,12 @@ func (m *AppSessionEnd) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppSessionEnd) MarshalTo(dAtA []byte) (int, error) {
+func (m *OIDCConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OIDCConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24873,7 +25809,7 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24881,9 +25817,9 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
+	dAtA[i] = 0x1a
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24891,9 +25827,9 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0x12
 	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24901,9 +25837,48 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *SAMLConnectorCreate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SAMLConnectorCreate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SAMLConnectorCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Connector != nil {
+		{
+			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24913,7 +25888,7 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -24935,7 +25910,7 @@ func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppSessionChunk) Marshal() (dAtA []byte, err error) {
+func (m *SAMLConnectorUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -24945,12 +25920,12 @@ func (m *AppSessionChunk) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppSessionChunk) MarshalTo(dAtA []byte) (int, error) {
+func (m *SAMLConnectorUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppSessionChunk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SAMLConnectorUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -24959,45 +25934,20 @@ func (m *AppSessionChunk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Connector != nil {
+		{
+			size, err := m.Connector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x3a
-	if len(m.SessionChunkID) > 0 {
-		i -= len(m.SessionChunkID)
-		copy(dAtA[i:], m.SessionChunkID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionChunkID)))
 		i--
-		dAtA[i] = 0x32
-	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25007,7 +25957,7 @@ func (m *AppSessionChunk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25029,7 +25979,7 @@ func (m *AppSessionChunk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AppSessionRequest) Marshal() (dAtA []byte, err error) {
+func (m *SAMLConnectorDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25039,12 +25989,12 @@ func (m *AppSessionRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AppSessionRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *SAMLConnectorDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *SAMLConnectorDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25054,7 +26004,7 @@ func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.AWSRequestMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25062,9 +26012,9 @@ func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x3a
+	dAtA[i] = 0x1a
 	{
-		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25072,33 +26022,7 @@ func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
-	if len(m.Method) > 0 {
-		i -= len(m.Method)
-		copy(dAtA[i:], m.Method)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.RawQuery) > 0 {
-		i -= len(m.RawQuery)
-		copy(dAtA[i:], m.RawQuery)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RawQuery)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.Path) > 0 {
-		i -= len(m.Path)
-		copy(dAtA[i:], m.Path)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if m.StatusCode != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.StatusCode))
-		i--
-		dAtA[i] = 0x10
-	}
+	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -25112,7 +26036,7 @@ func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *AWSRequestMetadata) Marshal() (dAtA []byte, err error) {
+func (m *KubeRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25122,12 +26046,12 @@ func (m *AWSRequestMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AWSRequestMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *KubeRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AWSRequestMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *KubeRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25136,38 +26060,117 @@ func (m *AWSRequestMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.AWSAssumedRole) > 0 {
-		i -= len(m.AWSAssumedRole)
-		copy(dAtA[i:], m.AWSAssumedRole)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSAssumedRole)))
-		i--
-		dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AWSHost) > 0 {
-		i -= len(m.AWSHost)
-		copy(dAtA[i:], m.AWSHost)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSHost)))
-		i--
-		dAtA[i] = 0x1a
+	i--
+	dAtA[i] = 0x6a
+	{
+		size, err := m.KubernetesClusterMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AWSService) > 0 {
-		i -= len(m.AWSService)
-		copy(dAtA[i:], m.AWSService)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSService)))
+	i--
+	dAtA[i] = 0x62
+	if m.ResponseCode != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.ResponseCode))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x58
 	}
-	if len(m.AWSRegion) > 0 {
-		i -= len(m.AWSRegion)
-		copy(dAtA[i:], m.AWSRegion)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSRegion)))
+	if len(m.ResourceName) > 0 {
+		i -= len(m.ResourceName)
+		copy(dAtA[i:], m.ResourceName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceName)))
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x52
+	}
+	if len(m.ResourceKind) > 0 {
+		i -= len(m.ResourceKind)
+		copy(dAtA[i:], m.ResourceKind)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceKind)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.ResourceNamespace) > 0 {
+		i -= len(m.ResourceNamespace)
+		copy(dAtA[i:], m.ResourceNamespace)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceNamespace)))
+		i--
+		dAtA[i] = 0x42
 	}
+	if len(m.ResourceAPIGroup) > 0 {
+		i -= len(m.ResourceAPIGroup)
+		copy(dAtA[i:], m.ResourceAPIGroup)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceAPIGroup)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.Verb) > 0 {
+		i -= len(m.Verb)
+		copy(dAtA[i:], m.Verb)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Verb)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.RequestPath) > 0 {
+		i -= len(m.RequestPath)
+		copy(dAtA[i:], m.RequestPath)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RequestPath)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseMetadata) Marshal() (dAtA []byte, err error) {
+func (m *AppMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25177,12 +26180,12 @@ func (m *DatabaseMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25191,60 +26194,21 @@ func (m *DatabaseMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.DatabaseOrigin) > 0 {
-		i -= len(m.DatabaseOrigin)
-		copy(dAtA[i:], m.DatabaseOrigin)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseOrigin)))
-		i--
-		dAtA[i] = 0x6a
-	}
-	if len(m.DatabaseType) > 0 {
-		i -= len(m.DatabaseType)
-		copy(dAtA[i:], m.DatabaseType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseType)))
-		i--
-		dAtA[i] = 0x62
-	}
-	if len(m.DatabaseRoles) > 0 {
-		for iNdEx := len(m.DatabaseRoles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.DatabaseRoles[iNdEx])
-			copy(dAtA[i:], m.DatabaseRoles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseRoles[iNdEx])))
-			i--
-			dAtA[i] = 0x5a
-		}
-	}
-	if len(m.DatabaseGCPInstanceID) > 0 {
-		i -= len(m.DatabaseGCPInstanceID)
-		copy(dAtA[i:], m.DatabaseGCPInstanceID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseGCPInstanceID)))
-		i--
-		dAtA[i] = 0x52
-	}
-	if len(m.DatabaseGCPProjectID) > 0 {
-		i -= len(m.DatabaseGCPProjectID)
-		copy(dAtA[i:], m.DatabaseGCPProjectID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseGCPProjectID)))
-		i--
-		dAtA[i] = 0x4a
-	}
-	if len(m.DatabaseAWSRedshiftClusterID) > 0 {
-		i -= len(m.DatabaseAWSRedshiftClusterID)
-		copy(dAtA[i:], m.DatabaseAWSRedshiftClusterID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseAWSRedshiftClusterID)))
+	if m.AppTargetPort != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.AppTargetPort))
 		i--
-		dAtA[i] = 0x42
+		dAtA[i] = 0x28
 	}
-	if len(m.DatabaseAWSRegion) > 0 {
-		i -= len(m.DatabaseAWSRegion)
-		copy(dAtA[i:], m.DatabaseAWSRegion)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseAWSRegion)))
+	if len(m.AppName) > 0 {
+		i -= len(m.AppName)
+		copy(dAtA[i:], m.AppName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppName)))
 		i--
-		dAtA[i] = 0x3a
+		dAtA[i] = 0x22
 	}
-	if len(m.DatabaseLabels) > 0 {
-		for k := range m.DatabaseLabels {
-			v := m.DatabaseLabels[k]
+	if len(m.AppLabels) > 0 {
+		for k := range m.AppLabels {
+			v := m.AppLabels[k]
 			baseI := i
 			i -= len(v)
 			copy(dAtA[i:], v)
@@ -25258,48 +26222,27 @@ func (m *DatabaseMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0xa
 			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x32
+			dAtA[i] = 0x1a
 		}
 	}
-	if len(m.DatabaseUser) > 0 {
-		i -= len(m.DatabaseUser)
-		copy(dAtA[i:], m.DatabaseUser)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseUser)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.DatabaseName) > 0 {
-		i -= len(m.DatabaseName)
-		copy(dAtA[i:], m.DatabaseName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseName)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.DatabaseURI) > 0 {
-		i -= len(m.DatabaseURI)
-		copy(dAtA[i:], m.DatabaseURI)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseURI)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.DatabaseProtocol) > 0 {
-		i -= len(m.DatabaseProtocol)
-		copy(dAtA[i:], m.DatabaseProtocol)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseProtocol)))
+	if len(m.AppPublicAddr) > 0 {
+		i -= len(m.AppPublicAddr)
+		copy(dAtA[i:], m.AppPublicAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppPublicAddr)))
 		i--
 		dAtA[i] = 0x12
 	}
-	if len(m.DatabaseService) > 0 {
-		i -= len(m.DatabaseService)
-		copy(dAtA[i:], m.DatabaseService)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseService)))
+	if len(m.AppURI) > 0 {
+		i -= len(m.AppURI)
+		copy(dAtA[i:], m.AppURI)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AppURI)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseCreate) Marshal() (dAtA []byte, err error) {
+func (m *AppCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25309,12 +26252,12 @@ func (m *DatabaseCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25324,7 +26267,7 @@ func (m *DatabaseCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25366,7 +26309,7 @@ func (m *DatabaseCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseUpdate) Marshal() (dAtA []byte, err error) {
+func (m *AppUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25376,12 +26319,12 @@ func (m *DatabaseUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25391,7 +26334,7 @@ func (m *DatabaseUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25433,7 +26376,7 @@ func (m *DatabaseUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseDelete) Marshal() (dAtA []byte, err error) {
+func (m *AppDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25443,12 +26386,12 @@ func (m *DatabaseDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25490,7 +26433,7 @@ func (m *DatabaseDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseSessionStart) Marshal() (dAtA []byte, err error) {
+func (m *AppSessionStart) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25500,12 +26443,12 @@ func (m *DatabaseSessionStart) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseSessionStart) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppSessionStart) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25515,7 +26458,7 @@ func (m *DatabaseSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25523,32 +26466,14 @@ func (m *DatabaseSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x4a
-	if m.PostgresPID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.PostgresPID))
+	dAtA[i] = 0x42
+	if len(m.PublicAddr) > 0 {
+		i -= len(m.PublicAddr)
+		copy(dAtA[i:], m.PublicAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PublicAddr)))
 		i--
-		dAtA[i] = 0x40
-	}
-	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x3a
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		dAtA[i] = 0x3a
 	}
-	i--
-	dAtA[i] = 0x32
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -25602,7 +26527,7 @@ func (m *DatabaseSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseSessionQuery) Marshal() (dAtA []byte, err error) {
+func (m *AppSessionEnd) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25612,12 +26537,12 @@ func (m *DatabaseSessionQuery) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseSessionQuery) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppSessionEnd) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseSessionQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25627,7 +26552,7 @@ func (m *DatabaseSessionQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25635,25 +26560,19 @@ func (m *DatabaseSessionQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x3a
-	if len(m.DatabaseQueryParameters) > 0 {
-		for iNdEx := len(m.DatabaseQueryParameters) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.DatabaseQueryParameters[iNdEx])
-			copy(dAtA[i:], m.DatabaseQueryParameters[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseQueryParameters[iNdEx])))
-			i--
-			dAtA[i] = 0x32
+	dAtA[i] = 0x32
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.DatabaseQuery) > 0 {
-		i -= len(m.DatabaseQuery)
-		copy(dAtA[i:], m.DatabaseQuery)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseQuery)))
-		i--
-		dAtA[i] = 0x2a
-	}
+	i--
+	dAtA[i] = 0x2a
 	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25695,7 +26614,7 @@ func (m *DatabaseSessionQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseSessionCommandResult) Marshal() (dAtA []byte, err error) {
+func (m *AppSessionChunk) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25705,12 +26624,12 @@ func (m *DatabaseSessionCommandResult) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseSessionCommandResult) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppSessionChunk) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseSessionCommandResult) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppSessionChunk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25719,13 +26638,25 @@ func (m *DatabaseSessionCommandResult) MarshalToSizedBuffer(dAtA []byte) (int, e
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.AffectedRecords != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.AffectedRecords))
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x3a
+	if len(m.SessionChunkID) > 0 {
+		i -= len(m.SessionChunkID)
+		copy(dAtA[i:], m.SessionChunkID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SessionChunkID)))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x32
 	}
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25735,7 +26666,7 @@ func (m *DatabaseSessionCommandResult) MarshalToSizedBuffer(dAtA []byte) (int, e
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25777,7 +26708,7 @@ func (m *DatabaseSessionCommandResult) MarshalToSizedBuffer(dAtA []byte) (int, e
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabasePermissionUpdate) Marshal() (dAtA []byte, err error) {
+func (m *AppSessionRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25787,12 +26718,12 @@ func (m *DatabasePermissionUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabasePermissionUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *AppSessionRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AppSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25801,39 +26732,8 @@ func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.AffectedObjectCounts) > 0 {
-		for k := range m.AffectedObjectCounts {
-			v := m.AffectedObjectCounts[k]
-			baseI := i
-			i = encodeVarintEvents(dAtA, i, uint64(v))
-			i--
-			dAtA[i] = 0x10
-			i -= len(k)
-			copy(dAtA[i:], k)
-			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x32
-		}
-	}
-	if len(m.PermissionSummary) > 0 {
-		for iNdEx := len(m.PermissionSummary) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.PermissionSummary[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintEvents(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x2a
-		}
-	}
 	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AWSRequestMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25841,9 +26741,9 @@ func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x3a
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -25851,17 +26751,33 @@ func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0x32
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.RawQuery) > 0 {
+		i -= len(m.RawQuery)
+		copy(dAtA[i:], m.RawQuery)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RawQuery)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.StatusCode != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.StatusCode))
+		i--
+		dAtA[i] = 0x10
 	}
-	i--
-	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -25875,7 +26791,7 @@ func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabasePermissionEntry) Marshal() (dAtA []byte, err error) {
+func (m *AWSRequestMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25885,12 +26801,12 @@ func (m *DatabasePermissionEntry) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabasePermissionEntry) MarshalTo(dAtA []byte) (int, error) {
+func (m *AWSRequestMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabasePermissionEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AWSRequestMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25899,13 +26815,121 @@ func (m *DatabasePermissionEntry) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Counts) > 0 {
-		for k := range m.Counts {
-			v := m.Counts[k]
+	if len(m.AWSAssumedRole) > 0 {
+		i -= len(m.AWSAssumedRole)
+		copy(dAtA[i:], m.AWSAssumedRole)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSAssumedRole)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.AWSHost) > 0 {
+		i -= len(m.AWSHost)
+		copy(dAtA[i:], m.AWSHost)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSHost)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.AWSService) > 0 {
+		i -= len(m.AWSService)
+		copy(dAtA[i:], m.AWSService)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSService)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.AWSRegion) > 0 {
+		i -= len(m.AWSRegion)
+		copy(dAtA[i:], m.AWSRegion)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AWSRegion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DatabaseMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DatabaseMetadata) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DatabaseMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.DatabaseOrigin) > 0 {
+		i -= len(m.DatabaseOrigin)
+		copy(dAtA[i:], m.DatabaseOrigin)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseOrigin)))
+		i--
+		dAtA[i] = 0x6a
+	}
+	if len(m.DatabaseType) > 0 {
+		i -= len(m.DatabaseType)
+		copy(dAtA[i:], m.DatabaseType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseType)))
+		i--
+		dAtA[i] = 0x62
+	}
+	if len(m.DatabaseRoles) > 0 {
+		for iNdEx := len(m.DatabaseRoles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DatabaseRoles[iNdEx])
+			copy(dAtA[i:], m.DatabaseRoles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseRoles[iNdEx])))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
+	if len(m.DatabaseGCPInstanceID) > 0 {
+		i -= len(m.DatabaseGCPInstanceID)
+		copy(dAtA[i:], m.DatabaseGCPInstanceID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseGCPInstanceID)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.DatabaseGCPProjectID) > 0 {
+		i -= len(m.DatabaseGCPProjectID)
+		copy(dAtA[i:], m.DatabaseGCPProjectID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseGCPProjectID)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.DatabaseAWSRedshiftClusterID) > 0 {
+		i -= len(m.DatabaseAWSRedshiftClusterID)
+		copy(dAtA[i:], m.DatabaseAWSRedshiftClusterID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseAWSRedshiftClusterID)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.DatabaseAWSRegion) > 0 {
+		i -= len(m.DatabaseAWSRegion)
+		copy(dAtA[i:], m.DatabaseAWSRegion)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseAWSRegion)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.DatabaseLabels) > 0 {
+		for k := range m.DatabaseLabels {
+			v := m.DatabaseLabels[k]
 			baseI := i
-			i = encodeVarintEvents(dAtA, i, uint64(v))
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
 			i--
-			dAtA[i] = 0x10
+			dAtA[i] = 0x12
 			i -= len(k)
 			copy(dAtA[i:], k)
 			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
@@ -25913,20 +26937,48 @@ func (m *DatabasePermissionEntry) MarshalToSizedBuffer(dAtA []byte) (int, error)
 			dAtA[i] = 0xa
 			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x12
+			dAtA[i] = 0x32
 		}
 	}
-	if len(m.Permission) > 0 {
-		i -= len(m.Permission)
-		copy(dAtA[i:], m.Permission)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Permission)))
+	if len(m.DatabaseUser) > 0 {
+		i -= len(m.DatabaseUser)
+		copy(dAtA[i:], m.DatabaseUser)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseUser)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.DatabaseName) > 0 {
+		i -= len(m.DatabaseName)
+		copy(dAtA[i:], m.DatabaseName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseName)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.DatabaseURI) > 0 {
+		i -= len(m.DatabaseURI)
+		copy(dAtA[i:], m.DatabaseURI)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseURI)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.DatabaseProtocol) > 0 {
+		i -= len(m.DatabaseProtocol)
+		copy(dAtA[i:], m.DatabaseProtocol)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseProtocol)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.DatabaseService) > 0 {
+		i -= len(m.DatabaseService)
+		copy(dAtA[i:], m.DatabaseService)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseService)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseUserCreate) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -25936,12 +26988,12 @@ func (m *DatabaseUserCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseUserCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseUserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -25950,32 +27002,6 @@ func (m *DatabaseUserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Roles) > 0 {
-		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Roles[iNdEx])
-			copy(dAtA[i:], m.Roles[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
-			i--
-			dAtA[i] = 0x3a
-		}
-	}
-	if len(m.Username) > 0 {
-		i -= len(m.Username)
-		copy(dAtA[i:], m.Username)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Username)))
-		i--
-		dAtA[i] = 0x32
-	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
 	{
 		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -25987,7 +27013,7 @@ func (m *DatabaseUserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26019,7 +27045,7 @@ func (m *DatabaseUserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseUserDeactivate) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26029,12 +27055,12 @@ func (m *DatabaseUserDeactivate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseUserDeactivate) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseUserDeactivate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26043,33 +27069,6 @@ func (m *DatabaseUserDeactivate) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Delete {
-		i--
-		if m.Delete {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x38
-	}
-	if len(m.Username) > 0 {
-		i -= len(m.Username)
-		copy(dAtA[i:], m.Username)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Username)))
-		i--
-		dAtA[i] = 0x32
-	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
 	{
 		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -26081,7 +27080,7 @@ func (m *DatabaseUserDeactivate) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26113,7 +27112,7 @@ func (m *DatabaseUserDeactivate) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	return len(dAtA) - i, nil
 }
 
-func (m *PostgresParse) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26123,12 +27122,12 @@ func (m *PostgresParse) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PostgresParse) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PostgresParse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26137,32 +27136,8 @@ func (m *PostgresParse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Query) > 0 {
-		i -= len(m.Query)
-		copy(dAtA[i:], m.Query)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Query)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.StatementName) > 0 {
-		i -= len(m.StatementName)
-		copy(dAtA[i:], m.StatementName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	{
-		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
 	{
-		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26194,7 +27169,7 @@ func (m *PostgresParse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PostgresBind) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseSessionStart) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26204,12 +27179,12 @@ func (m *PostgresBind) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PostgresBind) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseSessionStart) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PostgresBind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26218,28 +27193,20 @@ func (m *PostgresBind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Parameters) > 0 {
-		for iNdEx := len(m.Parameters) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Parameters[iNdEx])
-			copy(dAtA[i:], m.Parameters[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Parameters[iNdEx])))
-			i--
-			dAtA[i] = 0x3a
+	{
+		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.PortalName) > 0 {
-		i -= len(m.PortalName)
-		copy(dAtA[i:], m.PortalName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.StatementName) > 0 {
-		i -= len(m.StatementName)
-		copy(dAtA[i:], m.StatementName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
+	i--
+	dAtA[i] = 0x4a
+	if m.PostgresPID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.PostgresPID))
 		i--
-		dAtA[i] = 0x2a
+		dAtA[i] = 0x40
 	}
 	{
 		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
@@ -26250,6 +27217,36 @@ func (m *PostgresBind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
+	dAtA[i] = 0x3a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
 	dAtA[i] = 0x22
 	{
 		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
@@ -26284,7 +27281,7 @@ func (m *PostgresBind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PostgresExecute) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseSessionQuery) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26294,12 +27291,12 @@ func (m *PostgresExecute) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PostgresExecute) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseSessionQuery) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PostgresExecute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseSessionQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26308,10 +27305,29 @@ func (m *PostgresExecute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.PortalName) > 0 {
-		i -= len(m.PortalName)
-		copy(dAtA[i:], m.PortalName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x3a
+	if len(m.DatabaseQueryParameters) > 0 {
+		for iNdEx := len(m.DatabaseQueryParameters) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DatabaseQueryParameters[iNdEx])
+			copy(dAtA[i:], m.DatabaseQueryParameters[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseQueryParameters[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.DatabaseQuery) > 0 {
+		i -= len(m.DatabaseQuery)
+		copy(dAtA[i:], m.DatabaseQuery)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DatabaseQuery)))
 		i--
 		dAtA[i] = 0x2a
 	}
@@ -26358,7 +27374,7 @@ func (m *PostgresExecute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PostgresClose) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseSessionCommandResult) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26368,12 +27384,12 @@ func (m *PostgresClose) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PostgresClose) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseSessionCommandResult) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PostgresClose) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseSessionCommandResult) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26382,20 +27398,21 @@ func (m *PostgresClose) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.PortalName) > 0 {
-		i -= len(m.PortalName)
-		copy(dAtA[i:], m.PortalName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
+	if m.AffectedRecords != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.AffectedRecords))
 		i--
-		dAtA[i] = 0x32
+		dAtA[i] = 0x30
 	}
-	if len(m.StatementName) > 0 {
-		i -= len(m.StatementName)
-		copy(dAtA[i:], m.StatementName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
-		i--
-		dAtA[i] = 0x2a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x2a
 	{
 		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -26439,7 +27456,7 @@ func (m *PostgresClose) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PostgresFunctionCall) Marshal() (dAtA []byte, err error) {
+func (m *DatabasePermissionUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26449,12 +27466,12 @@ func (m *PostgresFunctionCall) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PostgresFunctionCall) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabasePermissionUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PostgresFunctionCall) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabasePermissionUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26463,19 +27480,36 @@ func (m *PostgresFunctionCall) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.FunctionArgs) > 0 {
-		for iNdEx := len(m.FunctionArgs) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.FunctionArgs[iNdEx])
-			copy(dAtA[i:], m.FunctionArgs[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.FunctionArgs[iNdEx])))
+	if len(m.AffectedObjectCounts) > 0 {
+		for k := range m.AffectedObjectCounts {
+			v := m.AffectedObjectCounts[k]
+			baseI := i
+			i = encodeVarintEvents(dAtA, i, uint64(v))
+			i--
+			dAtA[i] = 0x10
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
 			dAtA[i] = 0x32
 		}
 	}
-	if m.FunctionOID != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.FunctionOID))
-		i--
-		dAtA[i] = 0x28
+	if len(m.PermissionSummary) > 0 {
+		for iNdEx := len(m.PermissionSummary) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PermissionSummary[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x2a
+		}
 	}
 	{
 		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
@@ -26520,7 +27554,7 @@ func (m *PostgresFunctionCall) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *WindowsDesktopSessionStart) Marshal() (dAtA []byte, err error) {
+func (m *DatabasePermissionEntry) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26530,12 +27564,12 @@ func (m *WindowsDesktopSessionStart) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *WindowsDesktopSessionStart) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabasePermissionEntry) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabasePermissionEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26544,42 +27578,13 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.NLA {
-		i--
-		if m.NLA {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x68
-	}
-	if m.AllowUserCreation {
-		i--
-		if m.AllowUserCreation {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x60
-	}
-	if len(m.DesktopName) > 0 {
-		i -= len(m.DesktopName)
-		copy(dAtA[i:], m.DesktopName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
-		i--
-		dAtA[i] = 0x5a
-	}
-	if len(m.DesktopLabels) > 0 {
-		for k := range m.DesktopLabels {
-			v := m.DesktopLabels[k]
+	if len(m.Counts) > 0 {
+		for k := range m.Counts {
+			v := m.Counts[k]
 			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
+			i = encodeVarintEvents(dAtA, i, uint64(v))
 			i--
-			dAtA[i] = 0x12
+			dAtA[i] = 0x10
 			i -= len(k)
 			copy(dAtA[i:], k)
 			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
@@ -26587,34 +27592,56 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 			dAtA[i] = 0xa
 			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x52
+			dAtA[i] = 0x12
 		}
 	}
-	if len(m.WindowsUser) > 0 {
-		i -= len(m.WindowsUser)
-		copy(dAtA[i:], m.WindowsUser)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsUser)))
+	if len(m.Permission) > 0 {
+		i -= len(m.Permission)
+		copy(dAtA[i:], m.Permission)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Permission)))
 		i--
-		dAtA[i] = 0x4a
+		dAtA[i] = 0xa
 	}
-	if len(m.Domain) > 0 {
-		i -= len(m.Domain)
-		copy(dAtA[i:], m.Domain)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Domain)))
-		i--
-		dAtA[i] = 0x42
+	return len(dAtA) - i, nil
+}
+
+func (m *DatabaseUserCreate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	if len(m.DesktopAddr) > 0 {
-		i -= len(m.DesktopAddr)
-		copy(dAtA[i:], m.DesktopAddr)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
-		i--
-		dAtA[i] = 0x3a
+	return dAtA[:n], nil
+}
+
+func (m *DatabaseUserCreate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DatabaseUserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.WindowsDesktopService) > 0 {
-		i -= len(m.WindowsDesktopService)
-		copy(dAtA[i:], m.WindowsDesktopService)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsDesktopService)))
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	if len(m.Username) > 0 {
+		i -= len(m.Username)
+		copy(dAtA[i:], m.Username)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Username)))
 		i--
 		dAtA[i] = 0x32
 	}
@@ -26629,7 +27656,7 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26671,7 +27698,7 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 	return len(dAtA) - i, nil
 }
 
-func (m *DatabaseSessionEnd) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseUserDeactivate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26681,12 +27708,12 @@ func (m *DatabaseSessionEnd) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DatabaseSessionEnd) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseUserDeactivate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DatabaseSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseUserDeactivate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26695,20 +27722,31 @@ func (m *DatabaseSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n364, err364 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
-	if err364 != nil {
-		return 0, err364
+	if m.Delete {
+		i--
+		if m.Delete {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
 	}
-	i -= n364
-	i = encodeVarintEvents(dAtA, i, uint64(n364))
-	i--
-	dAtA[i] = 0x32
-	n365, err365 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
-	if err365 != nil {
-		return 0, err365
+	if len(m.Username) > 0 {
+		i -= len(m.Username)
+		copy(dAtA[i:], m.Username)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Username)))
+		i--
+		dAtA[i] = 0x32
+	}
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i -= n365
-	i = encodeVarintEvents(dAtA, i, uint64(n365))
 	i--
 	dAtA[i] = 0x2a
 	{
@@ -26754,7 +27792,7 @@ func (m *DatabaseSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *MFADeviceMetadata) Marshal() (dAtA []byte, err error) {
+func (m *PostgresParse) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26764,12 +27802,12 @@ func (m *MFADeviceMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *MFADeviceMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *PostgresParse) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *MFADeviceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PostgresParse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26778,56 +27816,22 @@ func (m *MFADeviceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.DeviceType) > 0 {
-		i -= len(m.DeviceType)
-		copy(dAtA[i:], m.DeviceType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceType)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.DeviceID) > 0 {
-		i -= len(m.DeviceID)
-		copy(dAtA[i:], m.DeviceID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceID)))
+	if len(m.Query) > 0 {
+		i -= len(m.Query)
+		copy(dAtA[i:], m.Query)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Query)))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x32
 	}
-	if len(m.DeviceName) > 0 {
-		i -= len(m.DeviceName)
-		copy(dAtA[i:], m.DeviceName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceName)))
+	if len(m.StatementName) > 0 {
+		i -= len(m.StatementName)
+		copy(dAtA[i:], m.StatementName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
 		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *MFADeviceAdd) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *MFADeviceAdd) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *MFADeviceAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
+		dAtA[i] = 0x2a
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26837,7 +27841,7 @@ func (m *MFADeviceAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.MFADeviceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26869,7 +27873,7 @@ func (m *MFADeviceAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *MFADeviceDelete) Marshal() (dAtA []byte, err error) {
+func (m *PostgresBind) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26879,12 +27883,12 @@ func (m *MFADeviceDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *MFADeviceDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *PostgresBind) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *MFADeviceDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PostgresBind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -26893,28 +27897,31 @@ func (m *MFADeviceDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Parameters) > 0 {
+		for iNdEx := len(m.Parameters) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Parameters[iNdEx])
+			copy(dAtA[i:], m.Parameters[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Parameters[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.MFADeviceMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.PortalName) > 0 {
+		i -= len(m.PortalName)
+		copy(dAtA[i:], m.PortalName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.StatementName) > 0 {
+		i -= len(m.StatementName)
+		copy(dAtA[i:], m.StatementName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26922,9 +27929,9 @@ func (m *MFADeviceDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
+	dAtA[i] = 0x22
 	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -26932,34 +27939,7 @@ func (m *MFADeviceDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *BillingInformationUpdate) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *BillingInformationUpdate) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *BillingInformationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
+	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -26983,7 +27963,7 @@ func (m *BillingInformationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *BillingCardCreate) Marshal() (dAtA []byte, err error) {
+func (m *PostgresExecute) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -26993,12 +27973,12 @@ func (m *BillingCardCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BillingCardCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *PostgresExecute) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BillingCardCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PostgresExecute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27007,8 +27987,15 @@ func (m *BillingCardCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.PortalName) > 0 {
+		i -= len(m.PortalName)
+		copy(dAtA[i:], m.PortalName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
+		i--
+		dAtA[i] = 0x2a
+	}
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27016,9 +28003,9 @@ func (m *BillingCardCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
+	dAtA[i] = 0x22
 	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27026,34 +28013,7 @@ func (m *BillingCardCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *BillingCardDelete) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *BillingCardDelete) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *BillingCardDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
+	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -27077,7 +28037,7 @@ func (m *BillingCardDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *LockCreate) Marshal() (dAtA []byte, err error) {
+func (m *PostgresClose) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27087,12 +28047,12 @@ func (m *LockCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *LockCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *PostgresClose) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PostgresClose) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27101,18 +28061,22 @@ func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.Lock.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.PortalName) > 0 {
+		i -= len(m.PortalName)
+		copy(dAtA[i:], m.PortalName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PortalName)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.StatementName) > 0 {
+		i -= len(m.StatementName)
+		copy(dAtA[i:], m.StatementName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.StatementName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
 	{
-		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27122,7 +28086,7 @@ func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27132,7 +28096,7 @@ func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27154,7 +28118,7 @@ func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *LockDelete) Marshal() (dAtA []byte, err error) {
+func (m *PostgresFunctionCall) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27164,12 +28128,12 @@ func (m *LockDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *LockDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *PostgresFunctionCall) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PostgresFunctionCall) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27178,8 +28142,22 @@ func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.FunctionArgs) > 0 {
+		for iNdEx := len(m.FunctionArgs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.FunctionArgs[iNdEx])
+			copy(dAtA[i:], m.FunctionArgs[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.FunctionArgs[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if m.FunctionOID != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.FunctionOID))
+		i--
+		dAtA[i] = 0x28
+	}
 	{
-		size, err := m.Lock.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27189,7 +28167,7 @@ func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27199,7 +28177,7 @@ func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27221,7 +28199,7 @@ func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *RecoveryCodeGenerate) Marshal() (dAtA []byte, err error) {
+func (m *WindowsCertificateMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27231,12 +28209,12 @@ func (m *RecoveryCodeGenerate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *RecoveryCodeGenerate) MarshalTo(dAtA []byte) (int, error) {
+func (m *WindowsCertificateMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *RecoveryCodeGenerate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *WindowsCertificateMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27245,87 +28223,73 @@ func (m *RecoveryCodeGenerate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.EnhancedKeyUsage) > 0 {
+		for iNdEx := len(m.EnhancedKeyUsage) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.EnhancedKeyUsage[iNdEx])
+			copy(dAtA[i:], m.EnhancedKeyUsage[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.EnhancedKeyUsage[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.ExtendedKeyUsage) > 0 {
+		dAtA362 := make([]byte, len(m.ExtendedKeyUsage)*10)
+		var j361 int
+		for _, num1 := range m.ExtendedKeyUsage {
+			num := uint64(num1)
+			for num >= 1<<7 {
+				dAtA362[j361] = uint8(uint64(num)&0x7f | 0x80)
+				num >>= 7
+				j361++
+			}
+			dAtA362[j361] = uint8(num)
+			j361++
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *RecoveryCodeUsed) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+		i -= j361
+		copy(dAtA[i:], dAtA362[:j361])
+		i = encodeVarintEvents(dAtA, i, uint64(j361))
+		i--
+		dAtA[i] = 0x32
 	}
-	return dAtA[:n], nil
-}
-
-func (m *RecoveryCodeUsed) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *RecoveryCodeUsed) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
+	if m.KeyUsage != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.KeyUsage))
+		i--
+		dAtA[i] = 0x28
 	}
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.CRLDistributionPoints) > 0 {
+		for iNdEx := len(m.CRLDistributionPoints) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CRLDistributionPoints[iNdEx])
+			copy(dAtA[i:], m.CRLDistributionPoints[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.CRLDistributionPoints[iNdEx])))
+			i--
+			dAtA[i] = 0x22
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x1a
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.UPN) > 0 {
+		i -= len(m.UPN)
+		copy(dAtA[i:], m.UPN)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UPN)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.SerialNumber) > 0 {
+		i -= len(m.SerialNumber)
+		copy(dAtA[i:], m.SerialNumber)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SerialNumber)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Subject) > 0 {
+		i -= len(m.Subject)
+		copy(dAtA[i:], m.Subject)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Subject)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *WindowsDesktopSessionEnd) Marshal() (dAtA []byte, err error) {
+func (m *WindowsDesktopSessionStart) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27335,12 +28299,12 @@ func (m *WindowsDesktopSessionEnd) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *WindowsDesktopSessionEnd) MarshalTo(dAtA []byte) (int, error) {
+func (m *WindowsDesktopSessionStart) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27349,48 +28313,45 @@ func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Participants) > 0 {
-		for iNdEx := len(m.Participants) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Participants[iNdEx])
-			copy(dAtA[i:], m.Participants[iNdEx])
-			i = encodeVarintEvents(dAtA, i, uint64(len(m.Participants[iNdEx])))
-			i--
-			dAtA[i] = 0x6a
+	if m.CertMetadata != nil {
+		{
+			size, err := m.CertMetadata.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
+		i--
+		dAtA[i] = 0x72
 	}
-	if m.Recorded {
+	if m.NLA {
 		i--
-		if m.Recorded {
+		if m.NLA {
 			dAtA[i] = 1
 		} else {
 			dAtA[i] = 0
 		}
 		i--
-		dAtA[i] = 0x60
+		dAtA[i] = 0x68
 	}
-	if len(m.DesktopName) > 0 {
+	if m.AllowUserCreation {
+		i--
+		if m.AllowUserCreation {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
+	}
+	if len(m.DesktopName) > 0 {
 		i -= len(m.DesktopName)
 		copy(dAtA[i:], m.DesktopName)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
 		i--
 		dAtA[i] = 0x5a
 	}
-	n398, err398 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
-	if err398 != nil {
-		return 0, err398
-	}
-	i -= n398
-	i = encodeVarintEvents(dAtA, i, uint64(n398))
-	i--
-	dAtA[i] = 0x52
-	n399, err399 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
-	if err399 != nil {
-		return 0, err399
-	}
-	i -= n399
-	i = encodeVarintEvents(dAtA, i, uint64(n399))
-	i--
-	dAtA[i] = 0x4a
 	if len(m.DesktopLabels) > 0 {
 		for k := range m.DesktopLabels {
 			v := m.DesktopLabels[k]
@@ -27407,7 +28368,7 @@ func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error
 			dAtA[i] = 0xa
 			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x42
+			dAtA[i] = 0x52
 		}
 	}
 	if len(m.WindowsUser) > 0 {
@@ -27415,29 +28376,49 @@ func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error
 		copy(dAtA[i:], m.WindowsUser)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsUser)))
 		i--
-		dAtA[i] = 0x3a
+		dAtA[i] = 0x4a
 	}
 	if len(m.Domain) > 0 {
 		i -= len(m.Domain)
 		copy(dAtA[i:], m.Domain)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.Domain)))
 		i--
-		dAtA[i] = 0x32
+		dAtA[i] = 0x42
 	}
 	if len(m.DesktopAddr) > 0 {
 		i -= len(m.DesktopAddr)
 		copy(dAtA[i:], m.DesktopAddr)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
 		i--
-		dAtA[i] = 0x2a
+		dAtA[i] = 0x3a
 	}
 	if len(m.WindowsDesktopService) > 0 {
 		i -= len(m.WindowsDesktopService)
 		copy(dAtA[i:], m.WindowsDesktopService)
 		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsDesktopService)))
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x32
+	}
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x22
 	{
 		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -27471,7 +28452,7 @@ func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *CertificateCreate) Marshal() (dAtA []byte, err error) {
+func (m *DatabaseSessionEnd) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27481,12 +28462,12 @@ func (m *CertificateCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *CertificateCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *DatabaseSessionEnd) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *CertificateCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DatabaseSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27495,8 +28476,43 @@ func (m *CertificateCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Participants) > 0 {
+		for iNdEx := len(m.Participants) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Participants[iNdEx])
+			copy(dAtA[i:], m.Participants[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Participants[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	{
-		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x3a
+	n370, err370 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
+	if err370 != nil {
+		return 0, err370
+	}
+	i -= n370
+	i = encodeVarintEvents(dAtA, i, uint64(n370))
+	i--
+	dAtA[i] = 0x32
+	n371, err371 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
+	if err371 != nil {
+		return 0, err371
+	}
+	i -= n371
+	i = encodeVarintEvents(dAtA, i, uint64(n371))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.DatabaseMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27505,25 +28521,26 @@ func (m *CertificateCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x22
-	if m.Identity != nil {
-		{
-			size, err := m.Identity.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x1a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.CertificateType) > 0 {
-		i -= len(m.CertificateType)
-		copy(dAtA[i:], m.CertificateType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.CertificateType)))
-		i--
-		dAtA[i] = 0x12
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -27537,7 +28554,7 @@ func (m *CertificateCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *RenewableCertificateGenerationMismatch) Marshal() (dAtA []byte, err error) {
+func (m *MFADeviceMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27547,12 +28564,12 @@ func (m *RenewableCertificateGenerationMismatch) Marshal() (dAtA []byte, err err
 	return dAtA[:n], nil
 }
 
-func (m *RenewableCertificateGenerationMismatch) MarshalTo(dAtA []byte) (int, error) {
+func (m *MFADeviceMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *MFADeviceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27561,30 +28578,31 @@ func (m *RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA []byt
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.DeviceType) > 0 {
+		i -= len(m.DeviceType)
+		copy(dAtA[i:], m.DeviceType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceType)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	if len(m.DeviceID) > 0 {
+		i -= len(m.DeviceID)
+		copy(dAtA[i:], m.DeviceID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.DeviceName) > 0 {
+		i -= len(m.DeviceName)
+		copy(dAtA[i:], m.DeviceName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceName)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *BotJoin) Marshal() (dAtA []byte, err error) {
+func (m *MFADeviceAdd) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27594,12 +28612,12 @@ func (m *BotJoin) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BotJoin) MarshalTo(dAtA []byte) (int, error) {
+func (m *MFADeviceAdd) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BotJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *MFADeviceAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27608,13 +28626,6 @@ func (m *BotJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.BotInstanceID) > 0 {
-		i -= len(m.BotInstanceID)
-		copy(dAtA[i:], m.BotInstanceID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotInstanceID)))
-		i--
-		dAtA[i] = 0x4a
-	}
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -27624,49 +28635,19 @@ func (m *BotJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x42
-	if len(m.UserName) > 0 {
-		i -= len(m.UserName)
-		copy(dAtA[i:], m.UserName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserName)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if m.Attributes != nil {
-		{
-			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0x22
+	{
+		size, err := m.MFADeviceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.TokenName) > 0 {
-		i -= len(m.TokenName)
-		copy(dAtA[i:], m.TokenName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.Method) > 0 {
-		i -= len(m.Method)
-		copy(dAtA[i:], m.Method)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.BotName) > 0 {
-		i -= len(m.BotName)
-		copy(dAtA[i:], m.BotName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
-		i--
-		dAtA[i] = 0x1a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x1a
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27688,7 +28669,7 @@ func (m *BotJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *InstanceJoin) Marshal() (dAtA []byte, err error) {
+func (m *MFADeviceDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27698,12 +28679,12 @@ func (m *InstanceJoin) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *InstanceJoin) MarshalTo(dAtA []byte) (int, error) {
+func (m *MFADeviceDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *InstanceJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *MFADeviceDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27721,64 +28702,19 @@ func (m *InstanceJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x52
-	n413, err413 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.TokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.TokenExpires):])
-	if err413 != nil {
-		return 0, err413
-	}
-	i -= n413
-	i = encodeVarintEvents(dAtA, i, uint64(n413))
-	i--
-	dAtA[i] = 0x4a
-	if m.Attributes != nil {
-		{
-			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0x22
+	{
+		size, err := m.MFADeviceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x42
-	}
-	if len(m.TokenName) > 0 {
-		i -= len(m.TokenName)
-		copy(dAtA[i:], m.TokenName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.Method) > 0 {
-		i -= len(m.Method)
-		copy(dAtA[i:], m.Method)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.Role) > 0 {
-		i -= len(m.Role)
-		copy(dAtA[i:], m.Role)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Role)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.NodeName) > 0 {
-		i -= len(m.NodeName)
-		copy(dAtA[i:], m.NodeName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.NodeName)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.HostID) > 0 {
-		i -= len(m.HostID)
-		copy(dAtA[i:], m.HostID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.HostID)))
-		i--
-		dAtA[i] = 0x1a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x1a
 	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -27800,7 +28736,7 @@ func (m *InstanceJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *Unknown) Marshal() (dAtA []byte, err error) {
+func (m *BillingInformationUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27810,12 +28746,12 @@ func (m *Unknown) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
+func (m *BillingInformationUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BillingInformationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27824,27 +28760,16 @@ func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Data) > 0 {
-		i -= len(m.Data)
-		copy(dAtA[i:], m.Data)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.UnknownCode) > 0 {
-		i -= len(m.UnknownCode)
-		copy(dAtA[i:], m.UnknownCode)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownCode)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.UnknownType) > 0 {
-		i -= len(m.UnknownType)
-		copy(dAtA[i:], m.UnknownType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownType)))
-		i--
-		dAtA[i] = 0x12
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -27858,82 +28783,7 @@ func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DeviceMetadata) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *DeviceMetadata) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *DeviceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.WebAuthenticationId) > 0 {
-		i -= len(m.WebAuthenticationId)
-		copy(dAtA[i:], m.WebAuthenticationId)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.WebAuthenticationId)))
-		i--
-		dAtA[i] = 0x42
-	}
-	if m.WebAuthentication {
-		i--
-		if m.WebAuthentication {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
-		}
-		i--
-		dAtA[i] = 0x30
-	}
-	if m.DeviceOrigin != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.DeviceOrigin))
-		i--
-		dAtA[i] = 0x28
-	}
-	if len(m.CredentialId) > 0 {
-		i -= len(m.CredentialId)
-		copy(dAtA[i:], m.CredentialId)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.CredentialId)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.AssetTag) > 0 {
-		i -= len(m.AssetTag)
-		copy(dAtA[i:], m.AssetTag)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.AssetTag)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if m.OsType != 0 {
-		i = encodeVarintEvents(dAtA, i, uint64(m.OsType))
-		i--
-		dAtA[i] = 0x10
-	}
-	if len(m.DeviceId) > 0 {
-		i -= len(m.DeviceId)
-		copy(dAtA[i:], m.DeviceId)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceId)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *DeviceEvent) Marshal() (dAtA []byte, err error) {
+func (m *BillingCardCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -27943,12 +28793,12 @@ func (m *DeviceEvent) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DeviceEvent) MarshalTo(dAtA []byte) (int, error) {
+func (m *BillingCardCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DeviceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BillingCardCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -27957,42 +28807,16 @@ func (m *DeviceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.User != nil {
-		{
-			size, err := m.User.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x22
-	}
-	if m.Device != nil {
-		{
-			size, err := m.Device.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x1a
-	}
-	if m.Status != nil {
-		{
-			size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x12
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28006,7 +28830,7 @@ func (m *DeviceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DeviceEvent2) Marshal() (dAtA []byte, err error) {
+func (m *BillingCardDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28016,12 +28840,12 @@ func (m *DeviceEvent2) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DeviceEvent2) MarshalTo(dAtA []byte) (int, error) {
+func (m *BillingCardDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DeviceEvent2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BillingCardDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28039,29 +28863,7 @@ func (m *DeviceEvent2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x32
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	if m.Device != nil {
-		{
-			size, err := m.Device.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x1a
-	}
+	dAtA[i] = 0x12
 	{
 		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28075,7 +28877,7 @@ func (m *DeviceEvent2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DiscoveryConfigCreate) Marshal() (dAtA []byte, err error) {
+func (m *LockCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28085,12 +28887,12 @@ func (m *DiscoveryConfigCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DiscoveryConfigCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *LockCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *LockCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28100,7 +28902,17 @@ func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Lock.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28110,7 +28922,7 @@ func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28120,7 +28932,7 @@ func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28142,7 +28954,7 @@ func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DiscoveryConfigUpdate) Marshal() (dAtA []byte, err error) {
+func (m *LockDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28152,12 +28964,12 @@ func (m *DiscoveryConfigUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DiscoveryConfigUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *LockDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *LockDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28167,7 +28979,7 @@ func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Lock.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28177,7 +28989,7 @@ func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x22
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28187,7 +28999,7 @@ func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28209,7 +29021,7 @@ func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DiscoveryConfigDelete) Marshal() (dAtA []byte, err error) {
+func (m *RecoveryCodeGenerate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28219,12 +29031,12 @@ func (m *DiscoveryConfigDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DiscoveryConfigDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *RecoveryCodeGenerate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DiscoveryConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *RecoveryCodeGenerate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28233,26 +29045,6 @@ func (m *DiscoveryConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x1a
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28276,7 +29068,7 @@ func (m *DiscoveryConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DiscoveryConfigDeleteAll) Marshal() (dAtA []byte, err error) {
+func (m *RecoveryCodeUsed) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28286,12 +29078,12 @@ func (m *DiscoveryConfigDeleteAll) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DiscoveryConfigDeleteAll) MarshalTo(dAtA []byte) (int, error) {
+func (m *RecoveryCodeUsed) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DiscoveryConfigDeleteAll) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *RecoveryCodeUsed) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28301,7 +29093,7 @@ func (m *DiscoveryConfigDeleteAll) MarshalToSizedBuffer(dAtA []byte) (int, error
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28333,7 +29125,7 @@ func (m *DiscoveryConfigDeleteAll) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *IntegrationCreate) Marshal() (dAtA []byte, err error) {
+func (m *WindowsDesktopSessionEnd) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28343,12 +29135,12 @@ func (m *IntegrationCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *IntegrationCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *WindowsDesktopSessionEnd) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *IntegrationCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *WindowsDesktopSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28366,19 +29158,98 @@ func (m *IntegrationCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	dAtA[i] = 0x72
+	if len(m.Participants) > 0 {
+		for iNdEx := len(m.Participants) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Participants[iNdEx])
+			copy(dAtA[i:], m.Participants[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Participants[iNdEx])))
+			i--
+			dAtA[i] = 0x6a
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	if m.Recorded {
+		i--
+		if m.Recorded {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
+	}
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
+		i--
+		dAtA[i] = 0x5a
+	}
+	n405, err405 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
+	if err405 != nil {
+		return 0, err405
+	}
+	i -= n405
+	i = encodeVarintEvents(dAtA, i, uint64(n405))
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x52
+	n406, err406 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
+	if err406 != nil {
+		return 0, err406
+	}
+	i -= n406
+	i = encodeVarintEvents(dAtA, i, uint64(n406))
+	i--
+	dAtA[i] = 0x4a
+	if len(m.DesktopLabels) > 0 {
+		for k := range m.DesktopLabels {
+			v := m.DesktopLabels[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintEvents(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if len(m.WindowsUser) > 0 {
+		i -= len(m.WindowsUser)
+		copy(dAtA[i:], m.WindowsUser)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsUser)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.Domain) > 0 {
+		i -= len(m.Domain)
+		copy(dAtA[i:], m.Domain)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Domain)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.DesktopAddr) > 0 {
+		i -= len(m.DesktopAddr)
+		copy(dAtA[i:], m.DesktopAddr)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopAddr)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.WindowsDesktopService) > 0 {
+		i -= len(m.WindowsDesktopService)
+		copy(dAtA[i:], m.WindowsDesktopService)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.WindowsDesktopService)))
+		i--
+		dAtA[i] = 0x22
+	}
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28410,7 +29281,7 @@ func (m *IntegrationCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *IntegrationUpdate) Marshal() (dAtA []byte, err error) {
+func (m *CertificateCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28420,12 +29291,12 @@ func (m *IntegrationUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *IntegrationUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *CertificateCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *CertificateCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28434,18 +29305,20 @@ func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.CertificateAuthority != nil {
+		{
+			size, err := m.CertificateAuthority.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0x2a
 	{
-		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ClientMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28454,8 +29327,27 @@ func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x22
+	if m.Identity != nil {
+		{
+			size, err := m.Identity.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.CertificateType) > 0 {
+		i -= len(m.CertificateType)
+		copy(dAtA[i:], m.CertificateType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.CertificateType)))
+		i--
+		dAtA[i] = 0x12
+	}
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28463,7 +29355,82 @@ func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x1a
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CertificateAuthority) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CertificateAuthority) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CertificateAuthority) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.SubjectKeyID) > 0 {
+		i -= len(m.SubjectKeyID)
+		copy(dAtA[i:], m.SubjectKeyID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SubjectKeyID)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Domain) > 0 {
+		i -= len(m.Domain)
+		copy(dAtA[i:], m.Domain)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Domain)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RenewableCertificateGenerationMismatch) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RenewableCertificateGenerationMismatch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
 	{
 		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28487,7 +29454,7 @@ func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *IntegrationDelete) Marshal() (dAtA []byte, err error) {
+func (m *BotJoin) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28497,12 +29464,12 @@ func (m *IntegrationDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *IntegrationDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *BotJoin) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *IntegrationDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *BotJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28511,6 +29478,13 @@ func (m *IntegrationDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.BotInstanceID) > 0 {
+		i -= len(m.BotInstanceID)
+		copy(dAtA[i:], m.BotInstanceID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotInstanceID)))
+		i--
+		dAtA[i] = 0x4a
+	}
 	{
 		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28520,29 +29494,49 @@ func (m *IntegrationDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+	dAtA[i] = 0x42
+	if len(m.UserName) > 0 {
+		i -= len(m.UserName)
+		copy(dAtA[i:], m.UserName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserName)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	i--
-	dAtA[i] = 0x22
-	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Attributes != nil {
+		{
+			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.TokenName) > 0 {
+		i -= len(m.TokenName)
+		copy(dAtA[i:], m.TokenName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.BotName) > 0 {
+		i -= len(m.BotName)
+		copy(dAtA[i:], m.BotName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0x1a
 	{
-		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28564,7 +29558,7 @@ func (m *IntegrationDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *IntegrationMetadata) Marshal() (dAtA []byte, err error) {
+func (m *InstanceJoin) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28574,12 +29568,12 @@ func (m *IntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *IntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *InstanceJoin) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *IntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *InstanceJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28588,9 +29582,27 @@ func (m *IntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.AWSRA != nil {
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x52
+	n421, err421 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.TokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.TokenExpires):])
+	if err421 != nil {
+		return 0, err421
+	}
+	i -= n421
+	i = encodeVarintEvents(dAtA, i, uint64(n421))
+	i--
+	dAtA[i] = 0x4a
+	if m.Attributes != nil {
 		{
-			size, err := m.AWSRA.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -28598,55 +29610,67 @@ func (m *IntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.TokenName) > 0 {
+		i -= len(m.TokenName)
+		copy(dAtA[i:], m.TokenName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Role)))
+		i--
 		dAtA[i] = 0x2a
 	}
-	if m.GitHub != nil {
-		{
-			size, err := m.GitHub.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	if len(m.NodeName) > 0 {
+		i -= len(m.NodeName)
+		copy(dAtA[i:], m.NodeName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.NodeName)))
 		i--
 		dAtA[i] = 0x22
 	}
-	if m.AzureOIDC != nil {
-		{
-			size, err := m.AzureOIDC.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	if len(m.HostID) > 0 {
+		i -= len(m.HostID)
+		copy(dAtA[i:], m.HostID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.HostID)))
 		i--
 		dAtA[i] = 0x1a
 	}
-	if m.AWSOIDC != nil {
-		{
-			size, err := m.AWSOIDC.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x12
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.SubKind) > 0 {
-		i -= len(m.SubKind)
-		copy(dAtA[i:], m.SubKind)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.SubKind)))
-		i--
-		dAtA[i] = 0xa
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *AWSOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+func (m *Unknown) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28656,12 +29680,12 @@ func (m *AWSOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AWSOIDCIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AWSOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28670,24 +29694,41 @@ func (m *AWSOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.IssuerS3URI) > 0 {
-		i -= len(m.IssuerS3URI)
-		copy(dAtA[i:], m.IssuerS3URI)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.IssuerS3URI)))
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x22
 	}
-	if len(m.RoleARN) > 0 {
-		i -= len(m.RoleARN)
-		copy(dAtA[i:], m.RoleARN)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.RoleARN)))
+	if len(m.UnknownCode) > 0 {
+		i -= len(m.UnknownCode)
+		copy(dAtA[i:], m.UnknownCode)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownCode)))
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x1a
+	}
+	if len(m.UnknownType) > 0 {
+		i -= len(m.UnknownType)
+		copy(dAtA[i:], m.UnknownType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownType)))
+		i--
+		dAtA[i] = 0x12
+	}
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *AzureOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+func (m *DeviceMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28697,12 +29738,12 @@ func (m *AzureOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AzureOIDCIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AzureOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28711,24 +29752,58 @@ func (m *AzureOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, e
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.ClientID) > 0 {
-		i -= len(m.ClientID)
-		copy(dAtA[i:], m.ClientID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClientID)))
+	if len(m.WebAuthenticationId) > 0 {
+		i -= len(m.WebAuthenticationId)
+		copy(dAtA[i:], m.WebAuthenticationId)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.WebAuthenticationId)))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x42
 	}
-	if len(m.TenantID) > 0 {
-		i -= len(m.TenantID)
-		copy(dAtA[i:], m.TenantID)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TenantID)))
+	if m.WebAuthentication {
+		i--
+		if m.WebAuthentication {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.DeviceOrigin != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.DeviceOrigin))
+		i--
+		dAtA[i] = 0x28
+	}
+	if len(m.CredentialId) > 0 {
+		i -= len(m.CredentialId)
+		copy(dAtA[i:], m.CredentialId)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.CredentialId)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.AssetTag) > 0 {
+		i -= len(m.AssetTag)
+		copy(dAtA[i:], m.AssetTag)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.AssetTag)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.OsType != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.OsType))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.DeviceId) > 0 {
+		i -= len(m.DeviceId)
+		copy(dAtA[i:], m.DeviceId)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DeviceId)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *GitHubIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+func (m *DeviceEvent) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28738,12 +29813,12 @@ func (m *GitHubIntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *GitHubIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceEvent) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *GitHubIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28752,17 +29827,56 @@ func (m *GitHubIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Organization) > 0 {
-		i -= len(m.Organization)
-		copy(dAtA[i:], m.Organization)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Organization)))
+	if m.User != nil {
+		{
+			size, err := m.User.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x22
+	}
+	if m.Device != nil {
+		{
+			size, err := m.Device.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
 	}
+	if m.Status != nil {
+		{
+			size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *AWSRAIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+func (m *DeviceEvent2) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28772,12 +29886,12 @@ func (m *AWSRAIntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *AWSRAIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceEvent2) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *AWSRAIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceEvent2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28786,17 +29900,52 @@ func (m *AWSRAIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.TrustAnchorARN) > 0 {
-		i -= len(m.TrustAnchorARN)
-		copy(dAtA[i:], m.TrustAnchorARN)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.TrustAnchorARN)))
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	if m.Device != nil {
+		{
+			size, err := m.Device.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *PluginCreate) Marshal() (dAtA []byte, err error) {
+func (m *DiscoveryConfigCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28806,12 +29955,12 @@ func (m *PluginCreate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PluginCreate) MarshalTo(dAtA []byte) (int, error) {
+func (m *DiscoveryConfigCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PluginCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DiscoveryConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28829,9 +29978,66 @@ func (m *PluginCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0x22
 	{
-		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *DiscoveryConfigUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DiscoveryConfigUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DiscoveryConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28873,7 +30079,7 @@ func (m *PluginCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PluginUpdate) Marshal() (dAtA []byte, err error) {
+func (m *DiscoveryConfigDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28883,12 +30089,12 @@ func (m *PluginUpdate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PluginUpdate) MarshalTo(dAtA []byte) (int, error) {
+func (m *DiscoveryConfigDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PluginUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DiscoveryConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28906,9 +30112,9 @@ func (m *PluginUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x2a
+	dAtA[i] = 0x22
 	{
-		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28916,9 +30122,56 @@ func (m *PluginUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x22
+	dAtA[i] = 0x1a
 	{
-		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *DiscoveryConfigDeleteAll) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DiscoveryConfigDeleteAll) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DiscoveryConfigDeleteAll) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -28950,7 +30203,7 @@ func (m *PluginUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PluginDelete) Marshal() (dAtA []byte, err error) {
+func (m *IntegrationCreate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -28960,12 +30213,12 @@ func (m *PluginDelete) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PluginDelete) MarshalTo(dAtA []byte) (int, error) {
+func (m *IntegrationCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PluginDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *IntegrationCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -28985,7 +30238,7 @@ func (m *PluginDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i--
 	dAtA[i] = 0x2a
 	{
-		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -29027,7 +30280,7 @@ func (m *PluginDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PluginMetadata) Marshal() (dAtA []byte, err error) {
+func (m *IntegrationUpdate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -29037,12 +30290,12 @@ func (m *PluginMetadata) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PluginMetadata) MarshalTo(dAtA []byte) (int, error) {
+func (m *IntegrationUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PluginMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *IntegrationUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -29051,49 +30304,60 @@ func (m *PluginMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.PluginData != nil {
-		{
-			size, err := m.PluginData.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x2a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.ReusesCredentials {
-		i--
-		if m.ReusesCredentials {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x20
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.HasCredentials {
-		i--
-		if m.HasCredentials {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x18
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.PluginType) > 0 {
-		i -= len(m.PluginType)
-		copy(dAtA[i:], m.PluginType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.PluginType)))
-		i--
-		dAtA[i] = 0xa
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *OneOf) Marshal() (dAtA []byte, err error) {
+func (m *IntegrationDelete) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -29103,12 +30367,12 @@ func (m *OneOf) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OneOf) MarshalTo(dAtA []byte) (int, error) {
+func (m *IntegrationDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *IntegrationDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -29117,49 +30381,86 @@ func (m *OneOf) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Event != nil {
-		{
-			size := m.Event.Size()
-			i -= size
-			if _, err := m.Event.MarshalTo(dAtA[i:]); err != nil {
-				return 0, err
-			}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.IntegrationMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *OneOf_UserLogin) MarshalTo(dAtA []byte) (int, error) {
+func (m *IntegrationMetadata) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *OneOf_UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.UserLogin != nil {
-		{
-			size, err := m.UserLogin.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0xa
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return len(dAtA) - i, nil
+	return dAtA[:n], nil
 }
-func (m *OneOf_UserCreate) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *IntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *IntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.UserCreate != nil {
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.AWSRA != nil {
 		{
-			size, err := m.UserCreate.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.AWSRA.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29167,20 +30468,11 @@ func (m *OneOf_UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x2a
 	}
-	return len(dAtA) - i, nil
-}
-func (m *OneOf_UserDelete) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *OneOf_UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.UserDelete != nil {
+	if m.GitHub != nil {
 		{
-			size, err := m.UserDelete.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.GitHub.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29188,20 +30480,11 @@ func (m *OneOf_UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x22
 	}
-	return len(dAtA) - i, nil
-}
-func (m *OneOf_UserPasswordChange) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *OneOf_UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.UserPasswordChange != nil {
+	if m.AzureOIDC != nil {
 		{
-			size, err := m.UserPasswordChange.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.AzureOIDC.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29209,20 +30492,11 @@ func (m *OneOf_UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x1a
 	}
-	return len(dAtA) - i, nil
-}
-func (m *OneOf_SessionStart) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *OneOf_SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.SessionStart != nil {
+	if m.AWSOIDC != nil {
 		{
-			size, err := m.SessionStart.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.AWSOIDC.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29230,188 +30504,426 @@ func (m *OneOf_SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x2a
+		dAtA[i] = 0x12
+	}
+	if len(m.SubKind) > 0 {
+		i -= len(m.SubKind)
+		copy(dAtA[i:], m.SubKind)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SubKind)))
+		i--
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionJoin) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
 
-func (m *OneOf_SessionJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.SessionJoin != nil {
-		{
-			size, err := m.SessionJoin.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x32
+func (m *AWSOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return len(dAtA) - i, nil
+	return dAtA[:n], nil
 }
-func (m *OneOf_SessionPrint) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *AWSOIDCIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionPrint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AWSOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionPrint != nil {
-		{
-			size, err := m.SessionPrint.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.IssuerS3URI) > 0 {
+		i -= len(m.IssuerS3URI)
+		copy(dAtA[i:], m.IssuerS3URI)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.IssuerS3URI)))
 		i--
-		dAtA[i] = 0x3a
+		dAtA[i] = 0x12
+	}
+	if len(m.RoleARN) > 0 {
+		i -= len(m.RoleARN)
+		copy(dAtA[i:], m.RoleARN)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RoleARN)))
+		i--
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionReject) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *AzureOIDCIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AzureOIDCIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AzureOIDCIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionReject != nil {
-		{
-			size, err := m.SessionReject.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ClientID) > 0 {
+		i -= len(m.ClientID)
+		copy(dAtA[i:], m.ClientID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClientID)))
 		i--
-		dAtA[i] = 0x42
+		dAtA[i] = 0x12
+	}
+	if len(m.TenantID) > 0 {
+		i -= len(m.TenantID)
+		copy(dAtA[i:], m.TenantID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TenantID)))
+		i--
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_Resize) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *GitHubIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GitHubIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *GitHubIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.Resize != nil {
-		{
-			size, err := m.Resize.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Organization) > 0 {
+		i -= len(m.Organization)
+		copy(dAtA[i:], m.Organization)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Organization)))
 		i--
-		dAtA[i] = 0x4a
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionEnd) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *AWSRAIntegrationMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSRAIntegrationMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AWSRAIntegrationMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionEnd != nil {
-		{
-			size, err := m.SessionEnd.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.TrustAnchorARN) > 0 {
+		i -= len(m.TrustAnchorARN)
+		copy(dAtA[i:], m.TrustAnchorARN)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TrustAnchorARN)))
 		i--
-		dAtA[i] = 0x52
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionCommand) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *PluginCreate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PluginCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionCommand != nil {
-		{
-			size, err := m.SessionCommand.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x5a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionDisk) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *PluginUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginUpdate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PluginUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionDisk != nil {
-		{
-			size, err := m.SessionDisk.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x62
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionNetwork) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *PluginDelete) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PluginDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionNetwork != nil {
-		{
-			size, err := m.SessionNetwork.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
-		i--
-		dAtA[i] = 0x6a
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.PluginMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionData) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *PluginMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginMetadata) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *PluginMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionData != nil {
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.PluginData != nil {
 		{
-			size, err := m.SessionData.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.PluginData.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29419,41 +30931,84 @@ func (m *OneOf_SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x72
+		dAtA[i] = 0x2a
+	}
+	if m.ReusesCredentials {
+		i--
+		if m.ReusesCredentials {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.HasCredentials {
+		i--
+		if m.HasCredentials {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.PluginType) > 0 {
+		i -= len(m.PluginType)
+		copy(dAtA[i:], m.PluginType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PluginType)))
+		i--
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SessionLeave) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *OneOf) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OneOf) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OneOf) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SessionLeave != nil {
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Event != nil {
 		{
-			size, err := m.SessionLeave.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
+			size := m.Event.Size()
+			i -= size
+			if _, err := m.Event.MarshalTo(dAtA[i:]); err != nil {
 				return 0, err
 			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
-		i--
-		dAtA[i] = 0x7a
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_PortForward) MarshalTo(dAtA []byte) (int, error) {
+
+func (m *OneOf_UserLogin) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OneOf_UserLogin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.PortForward != nil {
+	if m.UserLogin != nil {
 		{
-			size, err := m.PortForward.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.UserLogin.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29461,22 +31016,20 @@ func (m *OneOf_PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x1
-		i--
-		dAtA[i] = 0x82
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_X11Forward) MarshalTo(dAtA []byte) (int, error) {
+func (m *OneOf_UserCreate) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OneOf_UserCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.X11Forward != nil {
+	if m.UserCreate != nil {
 		{
-			size, err := m.X11Forward.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.UserCreate.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29484,22 +31037,20 @@ func (m *OneOf_X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x1
-		i--
-		dAtA[i] = 0x8a
+		dAtA[i] = 0x12
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_SCP) MarshalTo(dAtA []byte) (int, error) {
+func (m *OneOf_UserDelete) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OneOf_UserDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.SCP != nil {
+	if m.UserDelete != nil {
 		{
-			size, err := m.SCP.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.UserDelete.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -29507,20 +31058,339 @@ func (m *OneOf_SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintEvents(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x1
-		i--
-		dAtA[i] = 0x92
+		dAtA[i] = 0x1a
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_Exec) MarshalTo(dAtA []byte) (int, error) {
+func (m *OneOf_UserPasswordChange) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OneOf_Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OneOf_UserPasswordChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
-	if m.Exec != nil {
+	if m.UserPasswordChange != nil {
+		{
+			size, err := m.UserPasswordChange.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionStart) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionStart != nil {
+		{
+			size, err := m.SessionStart.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionJoin) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionJoin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionJoin != nil {
+		{
+			size, err := m.SessionJoin.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionPrint) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionPrint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionPrint != nil {
+		{
+			size, err := m.SessionPrint.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionReject) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionReject) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionReject != nil {
+		{
+			size, err := m.SessionReject.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x42
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_Resize) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_Resize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Resize != nil {
+		{
+			size, err := m.Resize.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionEnd) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionEnd != nil {
+		{
+			size, err := m.SessionEnd.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x52
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionCommand) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionCommand) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionCommand != nil {
+		{
+			size, err := m.SessionCommand.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x5a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionDisk) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionDisk) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionDisk != nil {
+		{
+			size, err := m.SessionDisk.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x62
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionNetwork) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionNetwork) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionNetwork != nil {
+		{
+			size, err := m.SessionNetwork.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x6a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionData) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionData != nil {
+		{
+			size, err := m.SessionData.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x72
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SessionLeave) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SessionLeave) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SessionLeave != nil {
+		{
+			size, err := m.SessionLeave.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x7a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_PortForward) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_PortForward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.PortForward != nil {
+		{
+			size, err := m.PortForward.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x82
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_X11Forward) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_X11Forward) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.X11Forward != nil {
+		{
+			size, err := m.X11Forward.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x8a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SCP) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SCP != nil {
+		{
+			size, err := m.SCP.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x92
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_Exec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_Exec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Exec != nil {
 		{
 			size, err := m.Exec.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
@@ -33952,6 +35822,351 @@ func (m *OneOf_AutoUpdateAgentRolloutRollback) MarshalToSizedBuffer(dAtA []byte)
 	}
 	return len(dAtA) - i, nil
 }
+func (m *OneOf_MCPSessionStart) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionStart != nil {
+		{
+			size, err := m.MCPSessionStart.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xc2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_MCPSessionEnd) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionEnd != nil {
+		{
+			size, err := m.MCPSessionEnd.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xca
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_MCPSessionRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionRequest != nil {
+		{
+			size, err := m.MCPSessionRequest.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xd2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_MCPSessionNotification) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionNotification) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionNotification != nil {
+		{
+			size, err := m.MCPSessionNotification.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xda
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_BoundKeypairRecovery) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_BoundKeypairRecovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.BoundKeypairRecovery != nil {
+		{
+			size, err := m.BoundKeypairRecovery.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xe2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_BoundKeypairRotation) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_BoundKeypairRotation) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.BoundKeypairRotation != nil {
+		{
+			size, err := m.BoundKeypairRotation.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xea
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_BoundKeypairJoinStateVerificationFailed) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_BoundKeypairJoinStateVerificationFailed) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.BoundKeypairJoinStateVerificationFailed != nil {
+		{
+			size, err := m.BoundKeypairJoinStateVerificationFailed.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xf2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_MCPSessionListenSSEStream) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionListenSSEStream) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionListenSSEStream != nil {
+		{
+			size, err := m.MCPSessionListenSSEStream.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xd
+		i--
+		dAtA[i] = 0xfa
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_MCPSessionInvalidHTTPRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_MCPSessionInvalidHTTPRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.MCPSessionInvalidHTTPRequest != nil {
+		{
+			size, err := m.MCPSessionInvalidHTTPRequest.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0x82
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SCIMListingEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SCIMListingEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SCIMListingEvent != nil {
+		{
+			size, err := m.SCIMListingEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0x8a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_SCIMResourceEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_SCIMResourceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.SCIMResourceEvent != nil {
+		{
+			size, err := m.SCIMResourceEvent.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0x92
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_ClientIPRestrictionsUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_ClientIPRestrictionsUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.ClientIPRestrictionsUpdate != nil {
+		{
+			size, err := m.ClientIPRestrictionsUpdate.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0x9a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_VnetConfigCreate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_VnetConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.VnetConfigCreate != nil {
+		{
+			size, err := m.VnetConfigCreate.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0xc2
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_VnetConfigUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_VnetConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.VnetConfigUpdate != nil {
+		{
+			size, err := m.VnetConfigUpdate.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0xca
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OneOf_VnetConfigDelete) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_VnetConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.VnetConfigDelete != nil {
+		{
+			size, err := m.VnetConfigDelete.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xe
+		i--
+		dAtA[i] = 0xd2
+	}
+	return len(dAtA) - i, nil
+}
 func (m *StreamStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -33976,12 +36191,12 @@ func (m *StreamStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n687, err687 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
-	if err687 != nil {
-		return 0, err687
+	n710, err710 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
+	if err710 != nil {
+		return 0, err710
 	}
-	i -= n687
-	i = encodeVarintEvents(dAtA, i, uint64(n687))
+	i -= n710
+	i = encodeVarintEvents(dAtA, i, uint64(n710))
 	i--
 	dAtA[i] = 0x1a
 	if m.LastEventIndex != 0 {
@@ -34077,6 +36292,29 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ScopePin != nil {
+		{
+			size, err := m.ScopePin.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xfa
+	}
+	if len(m.JoinToken) > 0 {
+		i -= len(m.JoinToken)
+		copy(dAtA[i:], m.JoinToken)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.JoinToken)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xf2
+	}
 	if len(m.BotInstanceID) > 0 {
 		i -= len(m.BotInstanceID)
 		copy(dAtA[i:], m.BotInstanceID)
@@ -34140,12 +36378,12 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0xc2
 		}
 	}
-	n691, err691 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.PreviousIdentityExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.PreviousIdentityExpires):])
-	if err691 != nil {
-		return 0, err691
+	n715, err715 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.PreviousIdentityExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.PreviousIdentityExpires):])
+	if err715 != nil {
+		return 0, err715
 	}
-	i -= n691
-	i = encodeVarintEvents(dAtA, i, uint64(n691))
+	i -= n715
+	i = encodeVarintEvents(dAtA, i, uint64(n715))
 	i--
 	dAtA[i] = 0x1
 	i--
@@ -34293,12 +36531,12 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x4a
 	}
-	n695, err695 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err695 != nil {
-		return 0, err695
+	n719, err719 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err719 != nil {
+		return 0, err719
 	}
-	i -= n695
-	i = encodeVarintEvents(dAtA, i, uint64(n695))
+	i -= n719
+	i = encodeVarintEvents(dAtA, i, uint64(n719))
 	i--
 	dAtA[i] = 0x42
 	if len(m.KubernetesUsers) > 0 {
@@ -34363,6 +36601,102 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ScopePin) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ScopePin) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ScopePin) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Assignments) > 0 {
+		for k := range m.Assignments {
+			v := m.Assignments[k]
+			baseI := i
+			if v != nil {
+				{
+					size, err := v.MarshalToSizedBuffer(dAtA[:i])
+					if err != nil {
+						return 0, err
+					}
+					i -= size
+					i = encodeVarintEvents(dAtA, i, uint64(size))
+				}
+				i--
+				dAtA[i] = 0x12
+			}
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintEvents(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintEvents(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Scope) > 0 {
+		i -= len(m.Scope)
+		copy(dAtA[i:], m.Scope)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Scope)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ScopePinnedAssignments) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ScopePinnedAssignments) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ScopePinnedAssignments) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Roles) > 0 {
+		for iNdEx := len(m.Roles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Roles[iNdEx])
+			copy(dAtA[i:], m.Roles[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Roles[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *RouteToApp) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -39002,6 +41336,49 @@ func (m *OktaUserSync) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *LabelSelector) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LabelSelector) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LabelSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Values) > 0 {
+		for iNdEx := len(m.Values) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Values[iNdEx])
+			copy(dAtA[i:], m.Values[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.Values[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *SPIFFESVIDIssued) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -39026,6 +41403,29 @@ func (m *SPIFFESVIDIssued) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.LabelSelectors) > 0 {
+		for iNdEx := len(m.LabelSelectors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.LabelSelectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintEvents(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x82
+		}
+	}
+	if len(m.NameSelector) > 0 {
+		i -= len(m.NameSelector)
+		copy(dAtA[i:], m.NameSelector)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.NameSelector)))
+		i--
+		dAtA[i] = 0x7a
+	}
 	if m.Attributes != nil {
 		{
 			size, err := m.Attributes.MarshalToSizedBuffer(dAtA[:i])
@@ -42797,919 +45197,1540 @@ func (m *SigstorePolicyDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func encodeVarintEvents(dAtA []byte, offset int, v uint64) int {
-	offset -= sovEvents(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func (m *Metadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Index != 0 {
-		n += 1 + sovEvents(uint64(m.Index))
-	}
-	l = len(m.Type)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Code)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Time)
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.ClusterName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *MCPSessionStart) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *SessionMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.SessionID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.WithMFA)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.PrivateKeyPolicy)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
+func (m *MCPSessionStart) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *UserMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *MCPSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.User)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Login)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.Impersonator)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.EgressAuthType) > 0 {
+		i -= len(m.EgressAuthType)
+		copy(dAtA[i:], m.EgressAuthType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.EgressAuthType)))
+		i--
+		dAtA[i] = 0x62
 	}
-	l = len(m.AWSRoleARN)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.IngressAuthType) > 0 {
+		i -= len(m.IngressAuthType)
+		copy(dAtA[i:], m.IngressAuthType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.IngressAuthType)))
+		i--
+		dAtA[i] = 0x5a
 	}
-	if len(m.AccessRequests) > 0 {
-		for _, s := range m.AccessRequests {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
+	if len(m.ProtocolVersion) > 0 {
+		i -= len(m.ProtocolVersion)
+		copy(dAtA[i:], m.ProtocolVersion)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ProtocolVersion)))
+		i--
+		dAtA[i] = 0x52
 	}
-	l = len(m.AzureIdentity)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.ServerInfo) > 0 {
+		i -= len(m.ServerInfo)
+		copy(dAtA[i:], m.ServerInfo)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ServerInfo)))
+		i--
+		dAtA[i] = 0x4a
 	}
-	l = len(m.GCPServiceAccount)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.ClientInfo) > 0 {
+		i -= len(m.ClientInfo)
+		copy(dAtA[i:], m.ClientInfo)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ClientInfo)))
+		i--
+		dAtA[i] = 0x42
 	}
-	if m.TrustedDevice != nil {
-		l = m.TrustedDevice.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.McpSessionId) > 0 {
+		i -= len(m.McpSessionId)
+		copy(dAtA[i:], m.McpSessionId)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.McpSessionId)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	l = len(m.RequiredPrivateKeyPolicy)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.UserKind != 0 {
-		n += 1 + sovEvents(uint64(m.UserKind))
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.BotName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.BotInstanceID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.UserOrigin != 0 {
-		n += 1 + sovEvents(uint64(m.UserOrigin))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *ServerMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *MCPSessionEnd) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *MCPSessionEnd) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPSessionEnd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.ServerNamespace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.ServerID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size := m.Headers.Size()
+		i -= size
+		if _, err := m.Headers.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.ServerHostname)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x42
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.ServerAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x3a
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.ServerLabels) > 0 {
-		for k, v := range m.ServerLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.ForwardedBy)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ServerMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.ServerSubKind)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.ServerVersion)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *ConnectionMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *MCPJSONRPCMessage) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *MCPJSONRPCMessage) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPJSONRPCMessage) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.LocalAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.RemoteAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Params != nil {
+		{
+			size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
 	}
-	l = len(m.Protocol)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.ID) > 0 {
+		i -= len(m.ID)
+		copy(dAtA[i:], m.ID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
+		i--
+		dAtA[i] = 0x12
 	}
-	return n
+	if len(m.JSONRPC) > 0 {
+		i -= len(m.JSONRPC)
+		copy(dAtA[i:], m.JSONRPC)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.JSONRPC)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
 }
 
-func (m *ClientMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.UserAgent)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *MCPSessionRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *KubernetesClusterMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *MCPSessionRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPSessionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.KubernetesCluster)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.KubernetesUsers) > 0 {
-		for _, s := range m.KubernetesUsers {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
+	{
+		size := m.Headers.Size()
+		i -= size
+		if _, err := m.Headers.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
 		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.KubernetesGroups) > 0 {
-		for _, s := range m.KubernetesGroups {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x3a
+	{
+		size, err := m.Message.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.KubernetesLabels) > 0 {
-		for k, v := range m.KubernetesLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *KubernetesPodMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.KubernetesPodName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.KubernetesPodNamespace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.KubernetesContainerName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.KubernetesContainerImage)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.KubernetesNodeName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *SAMLIdPServiceProviderMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *MCPSessionNotification) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *MCPSessionNotification) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPSessionNotification) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.ServiceProviderEntityID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.ServiceProviderShortcut)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size := m.Headers.Size()
+		i -= size
+		if _, err := m.Headers.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AttributeMapping) > 0 {
-		for k, v := range m.AttributeMapping {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+	i--
+	dAtA[i] = 0x3a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.Message.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *OktaResourcesUpdatedMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *MCPSessionListenSSEStream) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *MCPSessionListenSSEStream) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPSessionListenSSEStream) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if m.Added != 0 {
-		n += 1 + sovEvents(uint64(m.Added))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Updated != 0 {
-		n += 1 + sovEvents(uint64(m.Updated))
+	{
+		size := m.Headers.Size()
+		i -= size
+		if _, err := m.Headers.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.Deleted != 0 {
-		n += 1 + sovEvents(uint64(m.Deleted))
+	i--
+	dAtA[i] = 0x32
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.AddedResources) > 0 {
-		for _, e := range m.AddedResources {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.UpdatedResources) > 0 {
-		for _, e := range m.UpdatedResources {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.DeletedResources) > 0 {
-		for _, e := range m.DeletedResources {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *OktaResource) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.ID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Description)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *MCPSessionInvalidHTTPRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *OktaAssignmentMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *MCPSessionInvalidHTTPRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPSessionInvalidHTTPRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Source)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.User)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size := m.Headers.Size()
+		i -= size
+		if _, err := m.Headers.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.StartingStatus)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x4a
+	if len(m.Body) > 0 {
+		i -= len(m.Body)
+		copy(dAtA[i:], m.Body)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Body)))
+		i--
+		dAtA[i] = 0x42
 	}
-	l = len(m.EndingStatus)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.RawQuery) > 0 {
+		i -= len(m.RawQuery)
+		copy(dAtA[i:], m.RawQuery)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RawQuery)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x32
 	}
-	return n
-}
-
-func (m *AccessListMemberMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	var l int
-	_ = l
-	l = len(m.AccessListName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size, err := m.AppMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.Members) > 0 {
-		for _, e := range m.Members {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.SessionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.AccessListTitle)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *AccessListMember) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *BoundKeypairRecovery) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *BoundKeypairRecovery) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BoundKeypairRecovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.JoinedOn)
-	n += 1 + l + sovEvents(uint64(l))
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.RemovedOn)
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Reason)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.MemberName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.RecoveryMode) > 0 {
+		i -= len(m.RecoveryMode)
+		copy(dAtA[i:], m.RecoveryMode)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.RecoveryMode)))
+		i--
+		dAtA[i] = 0x42
 	}
-	if m.MembershipKind != 0 {
-		n += 1 + sovEvents(uint64(m.MembershipKind))
+	if m.RecoveryCount != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.RecoveryCount))
+		i--
+		dAtA[i] = 0x38
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0x32
 	}
-	return n
-}
-
-func (m *AccessListReviewMembershipRequirementsChanged) Size() (n int) {
-	if m == nil {
-		return 0
+	if len(m.BotName) > 0 {
+		i -= len(m.BotName)
+		copy(dAtA[i:], m.BotName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	var l int
-	_ = l
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
+	if len(m.TokenName) > 0 {
+		i -= len(m.TokenName)
+		copy(dAtA[i:], m.TokenName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
+		i--
+		dAtA[i] = 0x22
+	}
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if len(m.Traits) > 0 {
-		for k, v := range m.Traits {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *AccessListReviewMetadata) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *BoundKeypairRotation) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *BoundKeypairRotation) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BoundKeypairRotation) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Message)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.ReviewID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.NewPublicKey) > 0 {
+		i -= len(m.NewPublicKey)
+		copy(dAtA[i:], m.NewPublicKey)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.NewPublicKey)))
+		i--
+		dAtA[i] = 0x3a
 	}
-	if m.MembershipRequirementsChanged != nil {
-		l = m.MembershipRequirementsChanged.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.PreviousPublicKey) > 0 {
+		i -= len(m.PreviousPublicKey)
+		copy(dAtA[i:], m.PreviousPublicKey)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.PreviousPublicKey)))
+		i--
+		dAtA[i] = 0x32
 	}
-	l = len(m.ReviewFrequencyChanged)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.BotName) > 0 {
+		i -= len(m.BotName)
+		copy(dAtA[i:], m.BotName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	l = len(m.ReviewDayOfMonthChanged)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.TokenName) > 0 {
+		i -= len(m.TokenName)
+		copy(dAtA[i:], m.TokenName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
+		i--
+		dAtA[i] = 0x22
 	}
-	if len(m.RemovedMembers) > 0 {
-		for _, s := range m.RemovedMembers {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.AccessListTitle)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *LockMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Target.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *BoundKeypairJoinStateVerificationFailed) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *SessionStart) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *BoundKeypairJoinStateVerificationFailed) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BoundKeypairJoinStateVerificationFailed) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.TerminalSize)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesPodMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.InitialCommand) > 0 {
-		for _, s := range m.InitialCommand {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
+	if len(m.BotName) > 0 {
+		i -= len(m.BotName)
+		copy(dAtA[i:], m.BotName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.BotName)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	l = len(m.SessionRecording)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.TokenName) > 0 {
+		i -= len(m.TokenName)
+		copy(dAtA[i:], m.TokenName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TokenName)))
+		i--
+		dAtA[i] = 0x22
 	}
-	if len(m.Invited) > 0 {
-		for _, s := range m.Invited {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.Reason)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *SessionJoin) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *SCIMRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *SessionPrint) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *SCIMRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SCIMRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.ChunkIndex != 0 {
-		n += 1 + sovEvents(uint64(m.ChunkIndex))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.Data)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Body != nil {
+		{
+			size, err := m.Body.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
 	}
-	if m.Bytes != 0 {
-		n += 1 + sovEvents(uint64(m.Bytes))
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	if m.DelayMilliseconds != 0 {
-		n += 1 + sovEvents(uint64(m.DelayMilliseconds))
+	if len(m.Method) > 0 {
+		i -= len(m.Method)
+		copy(dAtA[i:], m.Method)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Method)))
+		i--
+		dAtA[i] = 0x22
 	}
-	if m.Offset != 0 {
-		n += 1 + sovEvents(uint64(m.Offset))
+	if len(m.UserAgent) > 0 {
+		i -= len(m.UserAgent)
+		copy(dAtA[i:], m.UserAgent)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UserAgent)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.SourceAddress) > 0 {
+		i -= len(m.SourceAddress)
+		copy(dAtA[i:], m.SourceAddress)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.SourceAddress)))
+		i--
+		dAtA[i] = 0x12
 	}
-	return n
+	if len(m.ID) > 0 {
+		i -= len(m.ID)
+		copy(dAtA[i:], m.ID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ID)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
 }
 
-func (m *DesktopRecording) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Message)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.DelayMilliseconds != 0 {
-		n += 1 + sovEvents(uint64(m.DelayMilliseconds))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+func (m *SCIMCommonData) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *DesktopClipboardReceive) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *SCIMCommonData) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SCIMCommonData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Length != 0 {
-		n += 1 + sovEvents(uint64(m.Length))
+	if len(m.ResourceType) > 0 {
+		i -= len(m.ResourceType)
+		copy(dAtA[i:], m.ResourceType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ResourceType)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.Integration) > 0 {
+		i -= len(m.Integration)
+		copy(dAtA[i:], m.Integration)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Integration)))
+		i--
+		dAtA[i] = 0x22
 	}
-	return n
+	if m.Request != nil {
+		{
+			size, err := m.Request.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
 }
 
-func (m *DesktopClipboardSend) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *SCIMListingEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *SCIMListingEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SCIMListingEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Length != 0 {
-		n += 1 + sovEvents(uint64(m.Length))
+	if m.ResourceCount != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.ResourceCount))
+		i--
+		dAtA[i] = 0x38
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.StartIndex != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.StartIndex))
+		i--
+		dAtA[i] = 0x30
 	}
-	return n
-}
-
-func (m *DesktopSharedDirectoryStart) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.Count != 0 {
+		i = encodeVarintEvents(dAtA, i, uint64(m.Count))
+		i--
+		dAtA[i] = 0x28
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Filter) > 0 {
+		i -= len(m.Filter)
+		copy(dAtA[i:], m.Filter)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Filter)))
+		i--
+		dAtA[i] = 0x22
 	}
-	l = len(m.DirectoryName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	{
+		size, err := m.SCIMCommonData.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.DirectoryID != 0 {
-		n += 1 + sovEvents(uint64(m.DirectoryID))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *DesktopSharedDirectoryRead) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *SCIMResourceEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *SCIMResourceEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SCIMResourceEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.DirectoryName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Display) > 0 {
+		i -= len(m.Display)
+		copy(dAtA[i:], m.Display)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Display)))
+		i--
+		dAtA[i] = 0x32
 	}
-	if m.DirectoryID != 0 {
-		n += 1 + sovEvents(uint64(m.DirectoryID))
+	if len(m.ExternalID) > 0 {
+		i -= len(m.ExternalID)
+		copy(dAtA[i:], m.ExternalID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.ExternalID)))
+		i--
+		dAtA[i] = 0x2a
 	}
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.TeleportID) > 0 {
+		i -= len(m.TeleportID)
+		copy(dAtA[i:], m.TeleportID)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.TeleportID)))
+		i--
+		dAtA[i] = 0x22
 	}
-	if m.Length != 0 {
-		n += 1 + sovEvents(uint64(m.Length))
+	{
+		size, err := m.SCIMCommonData.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.Offset != 0 {
-		n += 1 + sovEvents(uint64(m.Offset))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *DesktopSharedDirectoryWrite) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *ClientIPRestrictionsUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *ClientIPRestrictionsUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ClientIPRestrictionsUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	l = len(m.DirectoryName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.ClientIPRestrictions) > 0 {
+		for iNdEx := len(m.ClientIPRestrictions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ClientIPRestrictions[iNdEx])
+			copy(dAtA[i:], m.ClientIPRestrictions[iNdEx])
+			i = encodeVarintEvents(dAtA, i, uint64(len(m.ClientIPRestrictions[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
 	}
-	if m.DirectoryID != 0 {
-		n += 1 + sovEvents(uint64(m.DirectoryID))
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.ResourceMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.Length != 0 {
-		n += 1 + sovEvents(uint64(m.Length))
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.Offset != 0 {
-		n += 1 + sovEvents(uint64(m.Offset))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *SessionReject) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *VnetConfigCreate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *VnetConfigCreate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *VnetConfigCreate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Reason)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Maximum != 0 {
-		n += 1 + sovEvents(uint64(m.Maximum))
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *VnetConfigUpdate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *VnetConfigUpdate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *VnetConfigUpdate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
 	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	return n
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *SessionConnect) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *VnetConfigDelete) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *VnetConfigDelete) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *VnetConfigDelete) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	return n
+	{
+		size, err := m.ConnectionMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.UserMetadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *FileTransferRequestEvent) Size() (n int) {
+func encodeVarintEvents(dAtA []byte, offset int, v uint64) int {
+	offset -= sovEvents(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *Metadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.RequestID)
+	if m.Index != 0 {
+		n += 1 + sovEvents(uint64(m.Index))
+	}
+	l = len(m.Type)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.Approvers) > 0 {
-		for _, s := range m.Approvers {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = len(m.Requester)
+	l = len(m.ID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Location)
+	l = len(m.Code)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Download {
-		n += 2
-	}
-	l = len(m.Filename)
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Time)
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.ClusterName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -43719,81 +46740,99 @@ func (m *FileTransferRequestEvent) Size() (n int) {
 	return n
 }
 
-func (m *Resize) Size() (n int) {
+func (m *SessionMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.TerminalSize)
+	l = len(m.SessionID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.WithMFA)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PrivateKeyPolicy)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesPodMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SessionEnd) Size() (n int) {
+func (m *UserMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.EnhancedRecording {
-		n += 2
+	l = len(m.User)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Interactive {
-		n += 2
+	l = len(m.Login)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.Participants) > 0 {
-		for _, s := range m.Participants {
+	l = len(m.Impersonator)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AWSRoleARN)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.AccessRequests) > 0 {
+		for _, s := range m.AccessRequests {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
-	n += 1 + l + sovEvents(uint64(l))
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesPodMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.InitialCommand) > 0 {
-		for _, s := range m.InitialCommand {
+	l = len(m.AzureIdentity)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.GCPServiceAccount)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.TrustedDevice != nil {
+		l = m.TrustedDevice.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.RequiredPrivateKeyPolicy)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.UserKind != 0 {
+		n += 1 + sovEvents(uint64(m.UserKind))
+	}
+	l = len(m.BotName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotInstanceID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.UserOrigin != 0 {
+		n += 1 + sovEvents(uint64(m.UserOrigin))
+	}
+	if len(m.UserRoles) > 0 {
+		for _, s := range m.UserRoles {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.SessionRecording)
+	l = m.UserTraits.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.UserClusterName)
 	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -43801,19 +46840,45 @@ func (m *SessionEnd) Size() (n int) {
 	return n
 }
 
-func (m *BPFMetadata) Size() (n int) {
+func (m *ServerMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PID != 0 {
-		n += 1 + sovEvents(uint64(m.PID))
+	l = len(m.ServerNamespace)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.CgroupID != 0 {
-		n += 1 + sovEvents(uint64(m.CgroupID))
+	l = len(m.ServerID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Program)
+	l = len(m.ServerHostname)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ServerAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.ServerLabels) > 0 {
+		for k, v := range m.ServerLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.ForwardedBy)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ServerSubKind)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ServerVersion)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -43823,20 +46888,21 @@ func (m *BPFMetadata) Size() (n int) {
 	return n
 }
 
-func (m *Status) Size() (n int) {
+func (m *ConnectionMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Success {
-		n += 2
+	l = len(m.LocalAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Error)
+	l = len(m.RemoteAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.UserMessage)
+	l = len(m.Protocol)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -43846,69 +46912,51 @@ func (m *Status) Size() (n int) {
 	return n
 }
 
-func (m *SessionCommand) Size() (n int) {
+func (m *ClientMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.BPFMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.PPID != 0 {
-		n += 1 + sovEvents(uint64(m.PPID))
-	}
-	l = len(m.Path)
+	l = len(m.UserAgent)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.Argv) > 0 {
-		for _, s := range m.Argv {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.ReturnCode != 0 {
-		n += 1 + sovEvents(uint64(m.ReturnCode))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SessionDisk) Size() (n int) {
+func (m *KubernetesClusterMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.BPFMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Path)
+	l = len(m.KubernetesCluster)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Flags != 0 {
-		n += 1 + sovEvents(uint64(m.Flags))
+	if len(m.KubernetesUsers) > 0 {
+		for _, s := range m.KubernetesUsers {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	if m.ReturnCode != 0 {
-		n += 1 + sovEvents(uint64(m.ReturnCode))
+	if len(m.KubernetesGroups) > 0 {
+		for _, s := range m.KubernetesGroups {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.KubernetesLabels) > 0 {
+		for k, v := range m.KubernetesLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -43916,41 +46964,31 @@ func (m *SessionDisk) Size() (n int) {
 	return n
 }
 
-func (m *SessionNetwork) Size() (n int) {
+func (m *KubernetesPodMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.BPFMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SrcAddr)
+	l = len(m.KubernetesPodName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.DstAddr)
+	l = len(m.KubernetesPodNamespace)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.DstPort != 0 {
-		n += 1 + sovEvents(uint64(m.DstPort))
-	}
-	if m.TCPVersion != 0 {
-		n += 1 + sovEvents(uint64(m.TCPVersion))
+	l = len(m.KubernetesContainerName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Operation != 0 {
-		n += 1 + sovEvents(uint64(m.Operation))
+	l = len(m.KubernetesContainerImage)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Action != 0 {
-		n += 1 + sovEvents(uint64(m.Action))
+	l = len(m.KubernetesNodeName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -43958,27 +46996,27 @@ func (m *SessionNetwork) Size() (n int) {
 	return n
 }
 
-func (m *SessionData) Size() (n int) {
+func (m *SAMLIdPServiceProviderMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.BytesTransmitted != 0 {
-		n += 1 + sovEvents(uint64(m.BytesTransmitted))
+	l = len(m.ServiceProviderEntityID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.BytesReceived != 0 {
-		n += 1 + sovEvents(uint64(m.BytesReceived))
+	l = len(m.ServiceProviderShortcut)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.AttributeMapping) > 0 {
+		for k, v := range m.AttributeMapping {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -43986,63 +47024,56 @@ func (m *SessionData) Size() (n int) {
 	return n
 }
 
-func (m *SessionLeave) Size() (n int) {
+func (m *OktaResourcesUpdatedMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	if m.Added != 0 {
+		n += 1 + sovEvents(uint64(m.Added))
+	}
+	if m.Updated != 0 {
+		n += 1 + sovEvents(uint64(m.Updated))
+	}
+	if m.Deleted != 0 {
+		n += 1 + sovEvents(uint64(m.Deleted))
+	}
+	if len(m.AddedResources) > 0 {
+		for _, e := range m.AddedResources {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.UpdatedResources) > 0 {
+		for _, e := range m.UpdatedResources {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.DeletedResources) > 0 {
+		for _, e := range m.DeletedResources {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserLogin) Size() (n int) {
+func (m *OktaResource) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Method)
+	l = len(m.ID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.IdentityAttributes != nil {
-		l = m.IdentityAttributes.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.MFADevice != nil {
-		l = m.MFADevice.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.ClientMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.AppliedLoginRules) > 0 {
-		for _, s := range m.AppliedLoginRules {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = len(m.ConnectorID)
+	l = len(m.Description)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -44052,22 +47083,27 @@ func (m *UserLogin) Size() (n int) {
 	return n
 }
 
-func (m *CreateMFAAuthChallenge) Size() (n int) {
+func (m *OktaAssignmentMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.ChallengeScope)
+	l = len(m.Source)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.ChallengeAllowReuse {
-		n += 2
+	l = len(m.User)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.StartingStatus)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.EndingStatus)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -44075,134 +47111,134 @@ func (m *CreateMFAAuthChallenge) Size() (n int) {
 	return n
 }
 
-func (m *ValidateMFAAuthResponse) Size() (n int) {
+func (m *AccessListMemberMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.MFADevice != nil {
-		l = m.MFADevice.Size()
+	l = len(m.AccessListName)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.ChallengeScope)
+	if len(m.Members) > 0 {
+		for _, e := range m.Members {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.AccessListTitle)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.ChallengeAllowReuse {
-		n += 2
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *ResourceMetadata) Size() (n int) {
+func (m *AccessListMember) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Name)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires)
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.JoinedOn)
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.UpdatedBy)
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.RemovedOn)
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Reason)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.TTL)
+	l = len(m.MemberName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.MembershipKind != 0 {
+		n += 1 + sovEvents(uint64(m.MembershipKind))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserCreate) Size() (n int) {
+func (m *AccessListReviewMembershipRequirementsChanged) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if len(m.Roles) > 0 {
 		for _, s := range m.Roles {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.Connector)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Traits) > 0 {
+		for k, v := range m.Traits {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserUpdate) Size() (n int) {
+func (m *AccessListReviewMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
+	l = len(m.Message)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ReviewID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.MembershipRequirementsChanged != nil {
+		l = m.MembershipRequirementsChanged.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ReviewFrequencyChanged)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ReviewDayOfMonthChanged)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.RemovedMembers) > 0 {
+		for _, s := range m.RemovedMembers {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.Connector)
+	l = len(m.AccessListTitle)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserDelete) Size() (n int) {
+func (m *LockMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.Target.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -44210,7 +47246,7 @@ func (m *UserDelete) Size() (n int) {
 	return n
 }
 
-func (m *UserPasswordChange) Size() (n int) {
+func (m *SessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44220,89 +47256,47 @@ func (m *UserPasswordChange) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *AccessRequestCreate) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.TerminalSize)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.KubernetesClusterMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.KubernetesPodMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
+	if len(m.InitialCommand) > 0 {
+		for _, s := range m.InitialCommand {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.RequestID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.RequestState)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Delegator)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Reason)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Annotations != nil {
-		l = m.Annotations.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Reviewer)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ProposedState)
+	l = len(m.SessionRecording)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.RequestedResourceIDs) > 0 {
-		for _, e := range m.RequestedResourceIDs {
-			l = e.Size()
+	if len(m.Invited) > 0 {
+		for _, s := range m.Invited {
+			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration)
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.PromotedAccessListName)
+	l = len(m.Reason)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.AssumeStartTime != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime)
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	if len(m.ResourceNames) > 0 {
-		for _, s := range m.ResourceNames {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AccessRequestExpire) Size() (n int) {
+func (m *SessionJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44310,43 +47304,45 @@ func (m *AccessRequestExpire) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubernetesClusterMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.RequestID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.ResourceExpiry != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry)
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *ResourceID) Size() (n int) {
+func (m *SessionPrint) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.ClusterName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.ChunkIndex != 0 {
+		n += 1 + sovEvents(uint64(m.ChunkIndex))
 	}
-	l = len(m.Kind)
+	l = len(m.Data)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Name)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Bytes != 0 {
+		n += 1 + sovEvents(uint64(m.Bytes))
 	}
-	l = len(m.SubResourceName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.DelayMilliseconds != 0 {
+		n += 1 + sovEvents(uint64(m.DelayMilliseconds))
+	}
+	if m.Offset != 0 {
+		n += 1 + sovEvents(uint64(m.Offset))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -44354,7 +47350,7 @@ func (m *ResourceID) Size() (n int) {
 	return n
 }
 
-func (m *AccessRequestDelete) Size() (n int) {
+func (m *DesktopRecording) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44362,19 +47358,20 @@ func (m *AccessRequestDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.RequestID)
+	l = len(m.Message)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.DelayMilliseconds != 0 {
+		n += 1 + sovEvents(uint64(m.DelayMilliseconds))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PortForward) Size() (n int) {
+func (m *DesktopClipboardReceive) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44384,25 +47381,28 @@ func (m *PortForward) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Addr)
+	l = len(m.DesktopAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Length != 0 {
+		n += 1 + sovEvents(uint64(m.Length))
+	}
+	l = len(m.DesktopName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesPodMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *X11Forward) Size() (n int) {
+func (m *DesktopClipboardSend) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44412,31 +47412,18 @@ func (m *X11Forward) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *CommandMetadata) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Command)
+	l = len(m.DesktopAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.ExitCode)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Length != 0 {
+		n += 1 + sovEvents(uint64(m.Length))
 	}
-	l = len(m.Error)
+	l = len(m.DesktopName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -44446,7 +47433,7 @@ func (m *CommandMetadata) Size() (n int) {
 	return n
 }
 
-func (m *Exec) Size() (n int) {
+func (m *DesktopSharedDirectoryStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44456,25 +47443,34 @@ func (m *Exec) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.CommandMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesClusterMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubernetesPodMetadata.Size()
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.DesktopAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.DirectoryName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.DirectoryID != 0 {
+		n += 1 + sovEvents(uint64(m.DirectoryID))
+	}
+	l = len(m.DesktopName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SCP) Size() (n int) {
+func (m *DesktopSharedDirectoryRead) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44484,56 +47480,35 @@ func (m *SCP) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.CommandMetadata.Size()
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Path)
+	l = len(m.DesktopAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Action)
+	l = len(m.DirectoryName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *SFTPAttributes) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.FileSize != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdUInt64(*m.FileSize)
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.UID != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.UID)
-		n += 1 + l + sovEvents(uint64(l))
+	if m.DirectoryID != 0 {
+		n += 1 + sovEvents(uint64(m.DirectoryID))
 	}
-	if m.GID != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.GID)
+	l = len(m.Path)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Permissions != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.Permissions)
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Length != 0 {
+		n += 1 + sovEvents(uint64(m.Length))
 	}
-	if m.AccessTime != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.AccessTime)
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Offset != 0 {
+		n += 1 + sovEvents(uint64(m.Offset))
 	}
-	if m.ModificationTime != nil {
-		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.ModificationTime)
+	l = len(m.DesktopName)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
@@ -44542,7 +47517,7 @@ func (m *SFTPAttributes) Size() (n int) {
 	return n
 }
 
-func (m *SFTP) Size() (n int) {
+func (m *DesktopSharedDirectoryWrite) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44552,35 +47527,34 @@ func (m *SFTP) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.WorkingDirectory)
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.DesktopAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Path)
+	l = len(m.DirectoryName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.TargetPath)
+	if m.DirectoryID != 0 {
+		n += 1 + sovEvents(uint64(m.DirectoryID))
+	}
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Flags != 0 {
-		n += 1 + sovEvents(uint64(m.Flags))
-	}
-	if m.Attributes != nil {
-		l = m.Attributes.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Length != 0 {
+		n += 1 + sovEvents(uint64(m.Length))
 	}
-	if m.Action != 0 {
-		n += 1 + sovEvents(uint64(m.Action))
+	if m.Offset != 0 {
+		n += 1 + sovEvents(uint64(m.Offset))
 	}
-	l = len(m.Error)
+	l = len(m.DesktopName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -44590,7 +47564,7 @@ func (m *SFTP) Size() (n int) {
 	return n
 }
 
-func (m *SFTPSummary) Size() (n int) {
+func (m *SessionReject) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44600,17 +47574,16 @@ func (m *SFTPSummary) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.FileTransferStats) > 0 {
-		for _, e := range m.FileTransferStats {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
-		}
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Maximum != 0 {
+		n += 1 + sovEvents(uint64(m.Maximum))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -44618,29 +47591,25 @@ func (m *SFTPSummary) Size() (n int) {
 	return n
 }
 
-func (m *FileTransferStat) Size() (n int) {
+func (m *SessionConnect) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.BytesRead != 0 {
-		n += 1 + sovEvents(uint64(m.BytesRead))
-	}
-	if m.BytesWritten != 0 {
-		n += 1 + sovEvents(uint64(m.BytesWritten))
-	}
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *Subsystem) Size() (n int) {
+func (m *FileTransferRequestEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44648,27 +47617,40 @@ func (m *Subsystem) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Name)
+	l = len(m.RequestID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Error)
+	if len(m.Approvers) > 0 {
+		for _, s := range m.Approvers {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.Requester)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Location)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Download {
+		n += 2
+	}
+	l = len(m.Filename)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *ClientDisconnect) Size() (n int) {
+func (m *Resize) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44678,21 +47660,27 @@ func (m *ClientDisconnect) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Reason)
+	l = len(m.TerminalSize)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	l = m.KubernetesClusterMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubernetesPodMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AuthAttempt) Size() (n int) {
+func (m *SessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44702,75 +47690,94 @@ func (m *AuthAttempt) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.EnhancedRecording {
+		n += 2
 	}
-	return n
-}
-
-func (m *UserTokenCreate) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.Interactive {
+		n += 2
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
+	if len(m.Participants) > 0 {
+		for _, s := range m.Participants {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.KubernetesClusterMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubernetesPodMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.InitialCommand) > 0 {
+		for _, s := range m.InitialCommand {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.SessionRecording)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *RoleCreate) Size() (n int) {
+func (m *BPFMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	if m.PID != 0 {
+		n += 1 + sovEvents(uint64(m.PID))
+	}
+	if m.CgroupID != 0 {
+		n += 1 + sovEvents(uint64(m.CgroupID))
+	}
+	l = len(m.Program)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *RoleUpdate) Size() (n int) {
+func (m *Status) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	if m.Success {
+		n += 2
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UserMessage)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *RoleDelete) Size() (n int) {
+func (m *SessionCommand) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44778,19 +47785,37 @@ func (m *RoleDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.BPFMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.PPID != 0 {
+		n += 1 + sovEvents(uint64(m.PPID))
+	}
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Argv) > 0 {
+		for _, s := range m.Argv {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.ReturnCode != 0 {
+		n += 1 + sovEvents(uint64(m.ReturnCode))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *BotCreate) Size() (n int) {
+func (m *SessionDisk) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44798,35 +47823,31 @@ func (m *BotCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *BotUpdate) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.BPFMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Flags != 0 {
+		n += 1 + sovEvents(uint64(m.Flags))
+	}
+	if m.ReturnCode != 0 {
+		n += 1 + sovEvents(uint64(m.ReturnCode))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *BotDelete) Size() (n int) {
+func (m *SessionNetwork) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44834,17 +47855,41 @@ func (m *BotDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.BPFMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SrcAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.DstAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.DstPort != 0 {
+		n += 1 + sovEvents(uint64(m.DstPort))
+	}
+	if m.TCPVersion != 0 {
+		n += 1 + sovEvents(uint64(m.TCPVersion))
+	}
+	if m.Operation != 0 {
+		n += 1 + sovEvents(uint64(m.Operation))
+	}
+	if m.Action != 0 {
+		n += 1 + sovEvents(uint64(m.Action))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *TrustedClusterCreate) Size() (n int) {
+func (m *SessionData) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44852,19 +47897,27 @@ func (m *TrustedClusterCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.BytesTransmitted != 0 {
+		n += 1 + sovEvents(uint64(m.BytesTransmitted))
+	}
+	if m.BytesReceived != 0 {
+		n += 1 + sovEvents(uint64(m.BytesReceived))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *TrustedClusterDelete) Size() (n int) {
+func (m *SessionLeave) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44872,10 +47925,12 @@ func (m *TrustedClusterDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
@@ -44884,7 +47939,7 @@ func (m *TrustedClusterDelete) Size() (n int) {
 	return n
 }
 
-func (m *ProvisionTokenCreate) Size() (n int) {
+func (m *UserLogin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44892,17 +47947,33 @@ func (m *ProvisionTokenCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.IdentityAttributes != nil {
+		l = m.IdentityAttributes.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.MFADevice != nil {
+		l = m.MFADevice.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.ClientMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.AppliedLoginRules) > 0 {
+		for _, s := range m.AppliedLoginRules {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.JoinMethod)
+	l = len(m.ConnectorID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -44912,7 +47983,7 @@ func (m *ProvisionTokenCreate) Size() (n int) {
 	return n
 }
 
-func (m *TrustedClusterTokenCreate) Size() (n int) {
+func (m *CreateMFAAuthChallenge) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44920,17 +47991,22 @@ func (m *TrustedClusterTokenCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.ChallengeScope)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ChallengeAllowReuse {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *GithubConnectorCreate) Size() (n int) {
+func (m *ValidateMFAAuthResponse) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44938,39 +48014,54 @@ func (m *GithubConnectorCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.MFADevice != nil {
+		l = m.MFADevice.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ChallengeScope)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ChallengeAllowReuse {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *GithubConnectorUpdate) Size() (n int) {
+func (m *ResourceMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires)
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.UpdatedBy)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.TTL)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *GithubConnectorDelete) Size() (n int) {
+func (m *UserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44978,10 +48069,20 @@ func (m *GithubConnectorDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.Connector)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
@@ -44990,7 +48091,7 @@ func (m *GithubConnectorDelete) Size() (n int) {
 	return n
 }
 
-func (m *OIDCConnectorCreate) Size() (n int) {
+func (m *UserUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -44998,9 +48099,21 @@ func (m *OIDCConnectorCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.Connector)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45008,7 +48121,7 @@ func (m *OIDCConnectorCreate) Size() (n int) {
 	return n
 }
 
-func (m *OIDCConnectorUpdate) Size() (n int) {
+func (m *UserDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45016,9 +48129,11 @@ func (m *OIDCConnectorUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45026,7 +48141,7 @@ func (m *OIDCConnectorUpdate) Size() (n int) {
 	return n
 }
 
-func (m *OIDCConnectorDelete) Size() (n int) {
+func (m *UserPasswordChange) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45034,17 +48149,17 @@ func (m *OIDCConnectorDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SAMLConnectorCreate) Size() (n int) {
+func (m *AccessRequestCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45052,61 +48167,73 @@ func (m *SAMLConnectorCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.Connector != nil {
-		l = m.Connector.Size()
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.RequestID)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.RequestState)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *SAMLConnectorUpdate) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Delegator)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Connector != nil {
-		l = m.Connector.Size()
+	l = len(m.Reason)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.Annotations != nil {
+		l = m.Annotations.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *SAMLConnectorDelete) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Reviewer)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = len(m.ProposedState)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.RequestedResourceIDs) > 0 {
+		for _, e := range m.RequestedResourceIDs {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration)
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.PromotedAccessListName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AssumeStartTime != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime)
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	if len(m.ResourceNames) > 0 {
+		for _, s := range m.ResourceNames {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *KubeRequest) Size() (n int) {
+func (m *AccessRequestExpire) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45114,77 +48241,43 @@ func (m *KubeRequest) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.RequestPath)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Verb)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ResourceAPIGroup)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ResourceNamespace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ResourceKind)
+	l = len(m.RequestID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.ResourceName)
-	if l > 0 {
+	if m.ResourceExpiry != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry)
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.ResponseCode != 0 {
-		n += 1 + sovEvents(uint64(m.ResponseCode))
-	}
-	l = m.KubernetesClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AppMetadata) Size() (n int) {
+func (m *ResourceID) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.AppURI)
+	l = len(m.ClusterName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AppPublicAddr)
+	l = len(m.Kind)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.AppLabels) > 0 {
-		for k, v := range m.AppLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
-	l = len(m.AppName)
+	l = len(m.Name)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.AppTargetPort != 0 {
-		n += 1 + sovEvents(uint64(m.AppTargetPort))
+	l = len(m.SubResourceName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45192,7 +48285,7 @@ func (m *AppMetadata) Size() (n int) {
 	return n
 }
 
-func (m *AppCreate) Size() (n int) {
+func (m *AccessRequestDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45202,17 +48295,17 @@ func (m *AppCreate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AppMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.RequestID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AppUpdate) Size() (n int) {
+func (m *PortForward) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45222,9 +48315,17 @@ func (m *AppUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.AppMetadata.Size()
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Addr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.KubernetesClusterMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubernetesPodMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45232,7 +48333,7 @@ func (m *AppUpdate) Size() (n int) {
 	return n
 }
 
-func (m *AppDelete) Size() (n int) {
+func (m *X11Forward) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45242,7 +48343,9 @@ func (m *AppDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45250,35 +48353,31 @@ func (m *AppDelete) Size() (n int) {
 	return n
 }
 
-func (m *AppSessionStart) Size() (n int) {
+func (m *CommandMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.PublicAddr)
+	l = len(m.Command)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ExitCode)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Error)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.AppMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AppSessionEnd) Size() (n int) {
+func (m *Exec) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45288,13 +48387,17 @@ func (m *AppSessionEnd) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.CommandMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.AppMetadata.Size()
+	l = m.KubernetesClusterMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubernetesPodMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45302,7 +48405,7 @@ func (m *AppSessionEnd) Size() (n int) {
 	return n
 }
 
-func (m *AppSessionChunk) Size() (n int) {
+func (m *SCP) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45312,76 +48415,103 @@ func (m *AppSessionChunk) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.CommandMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SessionChunkID)
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Action)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.AppMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AppSessionRequest) Size() (n int) {
+func (m *SFTPAttributes) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatusCode != 0 {
-		n += 1 + sovEvents(uint64(m.StatusCode))
+	if m.FileSize != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdUInt64(*m.FileSize)
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Path)
-	if l > 0 {
+	if m.UID != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.UID)
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.RawQuery)
-	if l > 0 {
+	if m.GID != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.GID)
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Method)
-	if l > 0 {
+	if m.Permissions != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdUInt32(*m.Permissions)
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AccessTime != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.AccessTime)
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ModificationTime != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.ModificationTime)
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = m.AppMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AWSRequestMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AWSRequestMetadata) Size() (n int) {
+func (m *SFTP) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.AWSRegion)
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.WorkingDirectory)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AWSService)
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AWSHost)
+	l = len(m.TargetPath)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AWSAssumedRole)
+	if m.Flags != 0 {
+		n += 1 + sovEvents(uint64(m.Flags))
+	}
+	if m.Attributes != nil {
+		l = m.Attributes.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Action != 0 {
+		n += 1 + sovEvents(uint64(m.Action))
+	}
+	l = len(m.Error)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -45391,77 +48521,85 @@ func (m *AWSRequestMetadata) Size() (n int) {
 	return n
 }
 
-func (m *DatabaseMetadata) Size() (n int) {
+func (m *SFTPSummary) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.DatabaseService)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DatabaseProtocol)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DatabaseURI)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DatabaseName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.FileTransferStats) > 0 {
+		for _, e := range m.FileTransferStats {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	l = len(m.DatabaseUser)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
-	if len(m.DatabaseLabels) > 0 {
-		for k, v := range m.DatabaseLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
+	return n
+}
+
+func (m *FileTransferStat) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	l = len(m.DatabaseAWSRegion)
+	var l int
+	_ = l
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.DatabaseAWSRedshiftClusterID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.BytesRead != 0 {
+		n += 1 + sovEvents(uint64(m.BytesRead))
 	}
-	l = len(m.DatabaseGCPProjectID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.BytesWritten != 0 {
+		n += 1 + sovEvents(uint64(m.BytesWritten))
 	}
-	l = len(m.DatabaseGCPInstanceID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
-	if len(m.DatabaseRoles) > 0 {
-		for _, s := range m.DatabaseRoles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
+	return n
+}
+
+func (m *Subsystem) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	l = len(m.DatabaseType)
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Name)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.DatabaseOrigin)
+	l = len(m.Error)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseCreate) Size() (n int) {
+func (m *ClientDisconnect) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45471,17 +48609,21 @@ func (m *DatabaseCreate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseUpdate) Size() (n int) {
+func (m *AuthAttempt) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45491,9 +48633,11 @@ func (m *DatabaseUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45501,7 +48645,7 @@ func (m *DatabaseUpdate) Size() (n int) {
 	return n
 }
 
-func (m *DatabaseDelete) Size() (n int) {
+func (m *UserTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45509,17 +48653,17 @@ func (m *DatabaseDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseSessionStart) Size() (n int) {
+func (m *RoleCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45527,30 +48671,19 @@ func (m *DatabaseSessionStart) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.PostgresPID != 0 {
-		n += 1 + sovEvents(uint64(m.PostgresPID))
-	}
-	l = m.ClientMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseSessionQuery) Size() (n int) {
+func (m *RoleUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45558,23 +48691,11 @@ func (m *DatabaseSessionQuery) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DatabaseQuery)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.DatabaseQueryParameters) > 0 {
-		for _, s := range m.DatabaseQueryParameters {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = m.Status.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45582,7 +48703,7 @@ func (m *DatabaseSessionQuery) Size() (n int) {
 	return n
 }
 
-func (m *DatabaseSessionCommandResult) Size() (n int) {
+func (m *RoleDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45590,24 +48711,19 @@ func (m *DatabaseSessionCommandResult) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.AffectedRecords != 0 {
-		n += 1 + sovEvents(uint64(m.AffectedRecords))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabasePermissionUpdate) Size() (n int) {
+func (m *BotCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45615,57 +48731,35 @@ func (m *DatabasePermissionUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.PermissionSummary) > 0 {
-		for _, e := range m.PermissionSummary {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.AffectedObjectCounts) > 0 {
-		for k, v := range m.AffectedObjectCounts {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + sovEvents(uint64(v))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabasePermissionEntry) Size() (n int) {
+func (m *BotUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Permission)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Counts) > 0 {
-		for k, v := range m.Counts {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + sovEvents(uint64(v))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseUserCreate) Size() (n int) {
+func (m *BotDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45673,31 +48767,17 @@ func (m *DatabaseUserCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Username)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseUserDeactivate) Size() (n int) {
+func (m *TrustedClusterCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45705,28 +48785,19 @@ func (m *DatabaseUserDeactivate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Username)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Delete {
-		n += 2
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PostgresParse) Size() (n int) {
+func (m *TrustedClusterDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45734,27 +48805,19 @@ func (m *PostgresParse) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.StatementName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PostgresBind) Size() (n int) {
+func (m *ProvisionTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45762,33 +48825,27 @@ func (m *PostgresBind) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.StatementName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.PortalName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Parameters) > 0 {
-		for _, s := range m.Parameters {
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
+	l = len(m.JoinMethod)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PostgresExecute) Size() (n int) {
+func (m *TrustedClusterTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45796,23 +48853,17 @@ func (m *PostgresExecute) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.PortalName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PostgresClose) Size() (n int) {
+func (m *GithubConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45820,27 +48871,19 @@ func (m *PostgresClose) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.StatementName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.PortalName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PostgresFunctionCall) Size() (n int) {
+func (m *GithubConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45848,28 +48891,19 @@ func (m *PostgresFunctionCall) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.FunctionOID != 0 {
-		n += 1 + sovEvents(uint64(m.FunctionOID))
-	}
-	if len(m.FunctionArgs) > 0 {
-		for _, s := range m.FunctionArgs {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *WindowsDesktopSessionStart) Size() (n int) {
+func (m *GithubConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45877,55 +48911,19 @@ func (m *WindowsDesktopSessionStart) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.WindowsDesktopService)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Domain)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.WindowsUser)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.DesktopLabels) > 0 {
-		for k, v := range m.DesktopLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
-	l = len(m.DesktopName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.AllowUserCreation {
-		n += 2
-	}
-	if m.NLA {
-		n += 2
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DatabaseSessionEnd) Size() (n int) {
+func (m *OIDCConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45933,15 +48931,9 @@ func (m *DatabaseSessionEnd) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45949,31 +48941,25 @@ func (m *DatabaseSessionEnd) Size() (n int) {
 	return n
 }
 
-func (m *MFADeviceMetadata) Size() (n int) {
+func (m *OIDCConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.DeviceName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DeviceID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DeviceType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *MFADeviceAdd) Size() (n int) {
+func (m *OIDCConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -45981,11 +48967,9 @@ func (m *MFADeviceAdd) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.MFADeviceMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -45993,7 +48977,7 @@ func (m *MFADeviceAdd) Size() (n int) {
 	return n
 }
 
-func (m *MFADeviceDelete) Size() (n int) {
+func (m *SAMLConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46001,19 +48985,21 @@ func (m *MFADeviceDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.MFADeviceMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.Connector != nil {
+		l = m.Connector.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *BillingInformationUpdate) Size() (n int) {
+func (m *SAMLConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46021,15 +49007,21 @@ func (m *BillingInformationUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.Connector != nil {
+		l = m.Connector.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *BillingCardCreate) Size() (n int) {
+func (m *SAMLConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46037,6 +49029,8 @@ func (m *BillingCardCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
@@ -46045,7 +49039,7 @@ func (m *BillingCardCreate) Size() (n int) {
 	return n
 }
 
-func (m *BillingCardDelete) Size() (n int) {
+func (m *KubeRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46055,35 +49049,83 @@ func (m *BillingCardDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.RequestPath)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Verb)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ResourceAPIGroup)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ResourceNamespace)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ResourceKind)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ResourceName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ResponseCode != 0 {
+		n += 1 + sovEvents(uint64(m.ResponseCode))
+	}
+	l = m.KubernetesClusterMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *LockCreate) Size() (n int) {
+func (m *AppMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Target.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Lock.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.AppURI)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AppPublicAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.AppLabels) > 0 {
+		for k, v := range m.AppLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.AppName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AppTargetPort != 0 {
+		n += 1 + sovEvents(uint64(m.AppTargetPort))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *LockDelete) Size() (n int) {
+func (m *AppCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46091,11 +49133,11 @@ func (m *LockDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Lock.Size()
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46103,7 +49145,7 @@ func (m *LockDelete) Size() (n int) {
 	return n
 }
 
-func (m *RecoveryCodeGenerate) Size() (n int) {
+func (m *AppUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46113,13 +49155,17 @@ func (m *RecoveryCodeGenerate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *RecoveryCodeUsed) Size() (n int) {
+func (m *AppDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46129,7 +49175,7 @@ func (m *RecoveryCodeUsed) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46137,7 +49183,7 @@ func (m *RecoveryCodeUsed) Size() (n int) {
 	return n
 }
 
-func (m *WindowsDesktopSessionEnd) Size() (n int) {
+func (m *AppSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46149,54 +49195,23 @@ func (m *WindowsDesktopSessionEnd) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.WindowsDesktopService)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.DesktopAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Domain)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.WindowsUser)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.DesktopLabels) > 0 {
-		for k, v := range m.DesktopLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
+	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.DesktopName)
+	l = len(m.PublicAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Recorded {
-		n += 2
-	}
-	if len(m.Participants) > 0 {
-		for _, s := range m.Participants {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *CertificateCreate) Size() (n int) {
+func (m *AppSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46204,15 +49219,15 @@ func (m *CertificateCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.CertificateType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Identity != nil {
-		l = m.Identity.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.ClientMetadata.Size()
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46220,7 +49235,7 @@ func (m *CertificateCreate) Size() (n int) {
 	return n
 }
 
-func (m *RenewableCertificateGenerationMismatch) Size() (n int) {
+func (m *AppSessionChunk) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46230,55 +49245,25 @@ func (m *RenewableCertificateGenerationMismatch) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *BotJoin) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.BotName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Method)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.TokenName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Attributes != nil {
-		l = m.Attributes.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.UserName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.BotInstanceID)
+	l = len(m.SessionChunkID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *InstanceJoin) Size() (n int) {
+func (m *AppSessionRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46286,17 +49271,14 @@ func (m *InstanceJoin) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.HostID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.StatusCode != 0 {
+		n += 1 + sovEvents(uint64(m.StatusCode))
 	}
-	l = len(m.NodeName)
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Role)
+	l = len(m.RawQuery)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -46304,17 +49286,9 @@ func (m *InstanceJoin) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.TokenName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Attributes != nil {
-		l = m.Attributes.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.TokenExpires)
+	l = m.AppMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.AWSRequestMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46322,23 +49296,25 @@ func (m *InstanceJoin) Size() (n int) {
 	return n
 }
 
-func (m *Unknown) Size() (n int) {
+func (m *AWSRequestMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.UnknownType)
+	l = len(m.AWSRegion)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.UnknownCode)
+	l = len(m.AWSService)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Data)
+	l = len(m.AWSHost)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AWSAssumedRole)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -46348,61 +49324,68 @@ func (m *Unknown) Size() (n int) {
 	return n
 }
 
-func (m *DeviceMetadata) Size() (n int) {
+func (m *DatabaseMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.DeviceId)
+	l = len(m.DatabaseService)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.OsType != 0 {
-		n += 1 + sovEvents(uint64(m.OsType))
+	l = len(m.DatabaseProtocol)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AssetTag)
+	l = len(m.DatabaseURI)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.CredentialId)
+	l = len(m.DatabaseName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.DeviceOrigin != 0 {
-		n += 1 + sovEvents(uint64(m.DeviceOrigin))
+	l = len(m.DatabaseUser)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.WebAuthentication {
-		n += 2
+	if len(m.DatabaseLabels) > 0 {
+		for k, v := range m.DatabaseLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
-	l = len(m.WebAuthenticationId)
+	l = len(m.DatabaseAWSRegion)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.DatabaseAWSRedshiftClusterID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *DeviceEvent) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.DatabaseGCPProjectID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Status != nil {
-		l = m.Status.Size()
+	l = len(m.DatabaseGCPInstanceID)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Device != nil {
-		l = m.Device.Size()
+	if len(m.DatabaseRoles) > 0 {
+		for _, s := range m.DatabaseRoles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.DatabaseType)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.User != nil {
-		l = m.User.Size()
+	l = len(m.DatabaseOrigin)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
@@ -46411,7 +49394,7 @@ func (m *DeviceEvent) Size() (n int) {
 	return n
 }
 
-func (m *DeviceEvent2) Size() (n int) {
+func (m *DatabaseCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46419,21 +49402,19 @@ func (m *DeviceEvent2) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.Device != nil {
-		l = m.Device.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DiscoveryConfigCreate) Size() (n int) {
+func (m *DatabaseUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46445,7 +49426,7 @@ func (m *DiscoveryConfigCreate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46453,7 +49434,7 @@ func (m *DiscoveryConfigCreate) Size() (n int) {
 	return n
 }
 
-func (m *DiscoveryConfigUpdate) Size() (n int) {
+func (m *DatabaseDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46465,15 +49446,13 @@ func (m *DiscoveryConfigUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DiscoveryConfigDelete) Size() (n int) {
+func (m *DatabaseSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46483,17 +49462,28 @@ func (m *DiscoveryConfigDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ConnectionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.PostgresPID != 0 {
+		n += 1 + sovEvents(uint64(m.PostgresPID))
+	}
+	l = m.ClientMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *DiscoveryConfigDeleteAll) Size() (n int) {
+func (m *DatabaseSessionQuery) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46503,29 +49493,21 @@ func (m *DiscoveryConfigDeleteAll) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *IntegrationCreate) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.IntegrationMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = len(m.DatabaseQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.DatabaseQueryParameters) > 0 {
+		for _, s := range m.DatabaseQueryParameters {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46533,7 +49515,7 @@ func (m *IntegrationCreate) Size() (n int) {
 	return n
 }
 
-func (m *IntegrationUpdate) Size() (n int) {
+func (m *DatabaseSessionCommandResult) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46543,19 +49525,22 @@ func (m *IntegrationUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.IntegrationMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.AffectedRecords != 0 {
+		n += 1 + sovEvents(uint64(m.AffectedRecords))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *IntegrationDelete) Size() (n int) {
+func (m *DatabasePermissionUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46565,43 +49550,47 @@ func (m *IntegrationDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.IntegrationMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if len(m.PermissionSummary) > 0 {
+		for _, e := range m.PermissionSummary {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.AffectedObjectCounts) > 0 {
+		for k, v := range m.AffectedObjectCounts {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + sovEvents(uint64(v))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *IntegrationMetadata) Size() (n int) {
+func (m *DatabasePermissionEntry) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.SubKind)
+	l = len(m.Permission)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.AWSOIDC != nil {
-		l = m.AWSOIDC.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.AzureOIDC != nil {
-		l = m.AzureOIDC.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.GitHub != nil {
-		l = m.GitHub.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.AWSRA != nil {
-		l = m.AWSRA.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Counts) > 0 {
+		for k, v := range m.Counts {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + sovEvents(uint64(v))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46609,19 +49598,31 @@ func (m *IntegrationMetadata) Size() (n int) {
 	return n
 }
 
-func (m *AWSOIDCIntegrationMetadata) Size() (n int) {
+func (m *DatabaseUserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.RoleARN)
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Username)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.IssuerS3URI)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46629,19 +49630,28 @@ func (m *AWSOIDCIntegrationMetadata) Size() (n int) {
 	return n
 }
 
-func (m *AzureOIDCIntegrationMetadata) Size() (n int) {
+func (m *DatabaseUserDeactivate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.TenantID)
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Username)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.ClientID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Delete {
+		n += 2
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46649,13 +49659,25 @@ func (m *AzureOIDCIntegrationMetadata) Size() (n int) {
 	return n
 }
 
-func (m *GitHubIntegrationMetadata) Size() (n int) {
+func (m *PostgresParse) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Organization)
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.StatementName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Query)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -46665,23 +49687,41 @@ func (m *GitHubIntegrationMetadata) Size() (n int) {
 	return n
 }
 
-func (m *AWSRAIntegrationMetadata) Size() (n int) {
+func (m *PostgresBind) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.TrustAnchorARN)
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.StatementName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PortalName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if len(m.Parameters) > 0 {
+		for _, s := range m.Parameters {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PluginCreate) Size() (n int) {
+func (m *PostgresExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46691,19 +49731,21 @@ func (m *PluginCreate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.PluginMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.PortalName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PluginUpdate) Size() (n int) {
+func (m *PostgresClose) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46713,19 +49755,25 @@ func (m *PluginUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.PluginMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.StatementName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PortalName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PluginDelete) Size() (n int) {
+func (m *PostgresFunctionCall) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -46735,52 +49783,64 @@ func (m *PluginDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.PluginMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.FunctionOID != 0 {
+		n += 1 + sovEvents(uint64(m.FunctionOID))
+	}
+	if len(m.FunctionArgs) > 0 {
+		for _, s := range m.FunctionArgs {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *PluginMetadata) Size() (n int) {
+func (m *WindowsCertificateMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.PluginType)
+	l = len(m.Subject)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.HasCredentials {
-		n += 2
-	}
-	if m.ReusesCredentials {
-		n += 2
+	l = len(m.SerialNumber)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.PluginData != nil {
-		l = m.PluginData.Size()
+	l = len(m.UPN)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.CRLDistributionPoints) > 0 {
+		for _, s := range m.CRLDistributionPoints {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	return n
-}
-
-func (m *OneOf) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.KeyUsage != 0 {
+		n += 1 + sovEvents(uint64(m.KeyUsage))
 	}
-	var l int
-	_ = l
-	if m.Event != nil {
-		n += m.Event.Size()
+	if len(m.ExtendedKeyUsage) > 0 {
+		l = 0
+		for _, e := range m.ExtendedKeyUsage {
+			l += sovEvents(uint64(e))
+		}
+		n += 1 + sovEvents(uint64(l)) + l
+	}
+	if len(m.EnhancedKeyUsage) > 0 {
+		for _, s := range m.EnhancedKeyUsage {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -46788,4164 +49848,3693 @@ func (m *OneOf) Size() (n int) {
 	return n
 }
 
-func (m *OneOf_UserLogin) Size() (n int) {
+func (m *WindowsDesktopSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserLogin != nil {
-		l = m.UserLogin.Size()
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.WindowsDesktopService)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_UserCreate) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.UserCreate != nil {
-		l = m.UserCreate.Size()
+	l = len(m.DesktopAddr)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_UserDelete) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Domain)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	if m.UserDelete != nil {
-		l = m.UserDelete.Size()
+	l = len(m.WindowsUser)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_UserPasswordChange) Size() (n int) {
-	if m == nil {
-		return 0
+	if len(m.DesktopLabels) > 0 {
+		for k, v := range m.DesktopLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
-	var l int
-	_ = l
-	if m.UserPasswordChange != nil {
-		l = m.UserPasswordChange.Size()
+	l = len(m.DesktopName)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_SessionStart) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.AllowUserCreation {
+		n += 2
 	}
-	var l int
-	_ = l
-	if m.SessionStart != nil {
-		l = m.SessionStart.Size()
+	if m.NLA {
+		n += 2
+	}
+	if m.CertMetadata != nil {
+		l = m.CertMetadata.Size()
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
 	return n
 }
-func (m *OneOf_SessionJoin) Size() (n int) {
+
+func (m *DatabaseSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionJoin != nil {
-		l = m.SessionJoin.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
+	n += 1 + l + sovEvents(uint64(l))
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Participants) > 0 {
+		for _, s := range m.Participants {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionPrint) Size() (n int) {
+
+func (m *MFADeviceMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionPrint != nil {
-		l = m.SessionPrint.Size()
+	l = len(m.DeviceName)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_SessionReject) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.DeviceID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	if m.SessionReject != nil {
-		l = m.SessionReject.Size()
+	l = len(m.DeviceType)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
 	return n
 }
-func (m *OneOf_Resize) Size() (n int) {
+
+func (m *MFADeviceAdd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Resize != nil {
-		l = m.Resize.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.MFADeviceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionEnd) Size() (n int) {
+
+func (m *MFADeviceDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionEnd != nil {
-		l = m.SessionEnd.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.MFADeviceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionCommand) Size() (n int) {
+
+func (m *BillingInformationUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionCommand != nil {
-		l = m.SessionCommand.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionDisk) Size() (n int) {
+
+func (m *BillingCardCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionDisk != nil {
-		l = m.SessionDisk.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionNetwork) Size() (n int) {
+
+func (m *BillingCardDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionNetwork != nil {
-		l = m.SessionNetwork.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionData) Size() (n int) {
+
+func (m *LockCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionData != nil {
-		l = m.SessionData.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Target.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Lock.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionLeave) Size() (n int) {
+
+func (m *LockDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionLeave != nil {
-		l = m.SessionLeave.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Lock.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_PortForward) Size() (n int) {
+
+func (m *RecoveryCodeGenerate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PortForward != nil {
-		l = m.PortForward.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_X11Forward) Size() (n int) {
+
+func (m *RecoveryCodeUsed) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.X11Forward != nil {
-		l = m.X11Forward.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SCP) Size() (n int) {
+
+func (m *WindowsDesktopSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SCP != nil {
-		l = m.SCP.Size()
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	return n
-}
-func (m *OneOf_Exec) Size() (n int) {
-	if m == nil {
-		return 0
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.WindowsDesktopService)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	if m.Exec != nil {
-		l = m.Exec.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.DesktopAddr)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-func (m *OneOf_Subsystem) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Domain)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	if m.Subsystem != nil {
-		l = m.Subsystem.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.WindowsUser)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.DesktopLabels) > 0 {
+		for k, v := range m.DesktopLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
+	n += 1 + l + sovEvents(uint64(l))
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.DesktopName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Recorded {
+		n += 2
+	}
+	if len(m.Participants) > 0 {
+		for _, s := range m.Participants {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_ClientDisconnect) Size() (n int) {
+
+func (m *CertificateCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ClientDisconnect != nil {
-		l = m.ClientDisconnect.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.CertificateType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Identity != nil {
+		l = m.Identity.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.ClientMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.CertificateAuthority != nil {
+		l = m.CertificateAuthority.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_AuthAttempt) Size() (n int) {
+
+func (m *CertificateAuthority) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AuthAttempt != nil {
-		l = m.AuthAttempt.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Domain)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.SubjectKeyID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_AccessRequestCreate) Size() (n int) {
+
+func (m *RenewableCertificateGenerationMismatch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessRequestCreate != nil {
-		l = m.AccessRequestCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_UserTokenCreate) Size() (n int) {
+
+func (m *BotJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserTokenCreate != nil {
-		l = m.UserTokenCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.BotName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.TokenName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Attributes != nil {
+		l = m.Attributes.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UserName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.BotInstanceID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_RoleCreate) Size() (n int) {
+
+func (m *InstanceJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RoleCreate != nil {
-		l = m.RoleCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.HostID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.NodeName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.TokenName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Attributes != nil {
+		l = m.Attributes.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.TokenExpires)
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_RoleDelete) Size() (n int) {
+
+func (m *Unknown) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RoleDelete != nil {
-		l = m.RoleDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.UnknownType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UnknownCode)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_TrustedClusterCreate) Size() (n int) {
+
+func (m *DeviceMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.TrustedClusterCreate != nil {
-		l = m.TrustedClusterCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.DeviceId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.OsType != 0 {
+		n += 1 + sovEvents(uint64(m.OsType))
+	}
+	l = len(m.AssetTag)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.CredentialId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.DeviceOrigin != 0 {
+		n += 1 + sovEvents(uint64(m.DeviceOrigin))
+	}
+	if m.WebAuthentication {
+		n += 2
+	}
+	l = len(m.WebAuthenticationId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_TrustedClusterDelete) Size() (n int) {
+
+func (m *DeviceEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.TrustedClusterDelete != nil {
-		l = m.TrustedClusterDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.Status != nil {
+		l = m.Status.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Device != nil {
+		l = m.Device.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.User != nil {
+		l = m.User.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_TrustedClusterTokenCreate) Size() (n int) {
+
+func (m *DeviceEvent2) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.TrustedClusterTokenCreate != nil {
-		l = m.TrustedClusterTokenCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.Device != nil {
+		l = m.Device.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_GithubConnectorCreate) Size() (n int) {
+
+func (m *DiscoveryConfigCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.GithubConnectorCreate != nil {
-		l = m.GithubConnectorCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_GithubConnectorDelete) Size() (n int) {
+
+func (m *DiscoveryConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.GithubConnectorDelete != nil {
-		l = m.GithubConnectorDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_OIDCConnectorCreate) Size() (n int) {
+
+func (m *DiscoveryConfigDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OIDCConnectorCreate != nil {
-		l = m.OIDCConnectorCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_OIDCConnectorDelete) Size() (n int) {
+
+func (m *DiscoveryConfigDeleteAll) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OIDCConnectorDelete != nil {
-		l = m.OIDCConnectorDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SAMLConnectorCreate) Size() (n int) {
+
+func (m *IntegrationCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLConnectorCreate != nil {
-		l = m.SAMLConnectorCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.IntegrationMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SAMLConnectorDelete) Size() (n int) {
+
+func (m *IntegrationUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLConnectorDelete != nil {
-		l = m.SAMLConnectorDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.IntegrationMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_KubeRequest) Size() (n int) {
+
+func (m *IntegrationDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.KubeRequest != nil {
-		l = m.KubeRequest.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.IntegrationMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_AppSessionStart) Size() (n int) {
+
+func (m *IntegrationMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppSessionStart != nil {
-		l = m.AppSessionStart.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.SubKind)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AWSOIDC != nil {
+		l = m.AWSOIDC.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AzureOIDC != nil {
+		l = m.AzureOIDC.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.GitHub != nil {
+		l = m.GitHub.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.AWSRA != nil {
+		l = m.AWSRA.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_AppSessionChunk) Size() (n int) {
+
+func (m *AWSOIDCIntegrationMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppSessionChunk != nil {
-		l = m.AppSessionChunk.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.RoleARN)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.IssuerS3URI)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_AppSessionRequest) Size() (n int) {
+
+func (m *AzureOIDCIntegrationMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppSessionRequest != nil {
-		l = m.AppSessionRequest.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.TenantID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ClientID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_DatabaseSessionStart) Size() (n int) {
+
+func (m *GitHubIntegrationMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseSessionStart != nil {
-		l = m.DatabaseSessionStart.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.Organization)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_DatabaseSessionEnd) Size() (n int) {
+
+func (m *AWSRAIntegrationMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseSessionEnd != nil {
-		l = m.DatabaseSessionEnd.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.TrustAnchorARN)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_DatabaseSessionQuery) Size() (n int) {
+
+func (m *PluginCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseSessionQuery != nil {
-		l = m.DatabaseSessionQuery.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.PluginMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_SessionUpload) Size() (n int) {
+
+func (m *PluginUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionUpload != nil {
-		l = m.SessionUpload.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.PluginMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_MFADeviceAdd) Size() (n int) {
+
+func (m *PluginDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MFADeviceAdd != nil {
-		l = m.MFADeviceAdd.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.PluginMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_MFADeviceDelete) Size() (n int) {
+
+func (m *PluginMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MFADeviceDelete != nil {
-		l = m.MFADeviceDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	l = len(m.PluginType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.HasCredentials {
+		n += 2
+	}
+	if m.ReusesCredentials {
+		n += 2
+	}
+	if m.PluginData != nil {
+		l = m.PluginData.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_BillingInformationUpdate) Size() (n int) {
+
+func (m *OneOf) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BillingInformationUpdate != nil {
-		l = m.BillingInformationUpdate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.Event != nil {
+		n += m.Event.Size()
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
-func (m *OneOf_BillingCardCreate) Size() (n int) {
+
+func (m *OneOf_UserLogin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BillingCardCreate != nil {
-		l = m.BillingCardCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.UserLogin != nil {
+		l = m.UserLogin.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_BillingCardDelete) Size() (n int) {
+func (m *OneOf_UserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BillingCardDelete != nil {
-		l = m.BillingCardDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.UserCreate != nil {
+		l = m.UserCreate.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_LockCreate) Size() (n int) {
+func (m *OneOf_UserDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.LockCreate != nil {
-		l = m.LockCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.UserDelete != nil {
+		l = m.UserDelete.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_LockDelete) Size() (n int) {
+func (m *OneOf_UserPasswordChange) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.LockDelete != nil {
-		l = m.LockDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.UserPasswordChange != nil {
+		l = m.UserPasswordChange.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_RecoveryCodeGenerate) Size() (n int) {
+func (m *OneOf_SessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RecoveryCodeGenerate != nil {
-		l = m.RecoveryCodeGenerate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionStart != nil {
+		l = m.SessionStart.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_RecoveryCodeUsed) Size() (n int) {
+func (m *OneOf_SessionJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RecoveryCodeUsed != nil {
-		l = m.RecoveryCodeUsed.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionJoin != nil {
+		l = m.SessionJoin.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseCreate) Size() (n int) {
+func (m *OneOf_SessionPrint) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseCreate != nil {
-		l = m.DatabaseCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionPrint != nil {
+		l = m.SessionPrint.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseUpdate) Size() (n int) {
+func (m *OneOf_SessionReject) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseUpdate != nil {
-		l = m.DatabaseUpdate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionReject != nil {
+		l = m.SessionReject.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseDelete) Size() (n int) {
+func (m *OneOf_Resize) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseDelete != nil {
-		l = m.DatabaseDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.Resize != nil {
+		l = m.Resize.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AppCreate) Size() (n int) {
+func (m *OneOf_SessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppCreate != nil {
-		l = m.AppCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionEnd != nil {
+		l = m.SessionEnd.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AppUpdate) Size() (n int) {
+func (m *OneOf_SessionCommand) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppUpdate != nil {
-		l = m.AppUpdate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionCommand != nil {
+		l = m.SessionCommand.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AppDelete) Size() (n int) {
+func (m *OneOf_SessionDisk) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppDelete != nil {
-		l = m.AppDelete.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionDisk != nil {
+		l = m.SessionDisk.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WindowsDesktopSessionStart) Size() (n int) {
+func (m *OneOf_SessionNetwork) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WindowsDesktopSessionStart != nil {
-		l = m.WindowsDesktopSessionStart.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionNetwork != nil {
+		l = m.SessionNetwork.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WindowsDesktopSessionEnd) Size() (n int) {
+func (m *OneOf_SessionData) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WindowsDesktopSessionEnd != nil {
-		l = m.WindowsDesktopSessionEnd.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionData != nil {
+		l = m.SessionData.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PostgresParse) Size() (n int) {
+func (m *OneOf_SessionLeave) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PostgresParse != nil {
-		l = m.PostgresParse.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.SessionLeave != nil {
+		l = m.SessionLeave.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PostgresBind) Size() (n int) {
+func (m *OneOf_PortForward) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PostgresBind != nil {
-		l = m.PostgresBind.Size()
+	if m.PortForward != nil {
+		l = m.PortForward.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PostgresExecute) Size() (n int) {
+func (m *OneOf_X11Forward) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PostgresExecute != nil {
-		l = m.PostgresExecute.Size()
+	if m.X11Forward != nil {
+		l = m.X11Forward.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PostgresClose) Size() (n int) {
+func (m *OneOf_SCP) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PostgresClose != nil {
-		l = m.PostgresClose.Size()
+	if m.SCP != nil {
+		l = m.SCP.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PostgresFunctionCall) Size() (n int) {
+func (m *OneOf_Exec) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PostgresFunctionCall != nil {
-		l = m.PostgresFunctionCall.Size()
+	if m.Exec != nil {
+		l = m.Exec.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessRequestDelete) Size() (n int) {
+func (m *OneOf_Subsystem) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessRequestDelete != nil {
-		l = m.AccessRequestDelete.Size()
+	if m.Subsystem != nil {
+		l = m.Subsystem.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SessionConnect) Size() (n int) {
+func (m *OneOf_ClientDisconnect) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionConnect != nil {
-		l = m.SessionConnect.Size()
+	if m.ClientDisconnect != nil {
+		l = m.ClientDisconnect.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CertificateCreate) Size() (n int) {
+func (m *OneOf_AuthAttempt) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CertificateCreate != nil {
-		l = m.CertificateCreate.Size()
+	if m.AuthAttempt != nil {
+		l = m.AuthAttempt.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopRecording) Size() (n int) {
+func (m *OneOf_AccessRequestCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopRecording != nil {
-		l = m.DesktopRecording.Size()
+	if m.AccessRequestCreate != nil {
+		l = m.AccessRequestCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopClipboardSend) Size() (n int) {
+func (m *OneOf_UserTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopClipboardSend != nil {
-		l = m.DesktopClipboardSend.Size()
+	if m.UserTokenCreate != nil {
+		l = m.UserTokenCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopClipboardReceive) Size() (n int) {
+func (m *OneOf_RoleCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopClipboardReceive != nil {
-		l = m.DesktopClipboardReceive.Size()
+	if m.RoleCreate != nil {
+		l = m.RoleCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementPrepare) Size() (n int) {
+func (m *OneOf_RoleDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementPrepare != nil {
-		l = m.MySQLStatementPrepare.Size()
+	if m.RoleDelete != nil {
+		l = m.RoleDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementExecute) Size() (n int) {
+func (m *OneOf_TrustedClusterCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementExecute != nil {
-		l = m.MySQLStatementExecute.Size()
+	if m.TrustedClusterCreate != nil {
+		l = m.TrustedClusterCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementSendLongData) Size() (n int) {
+func (m *OneOf_TrustedClusterDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementSendLongData != nil {
-		l = m.MySQLStatementSendLongData.Size()
+	if m.TrustedClusterDelete != nil {
+		l = m.TrustedClusterDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementClose) Size() (n int) {
+func (m *OneOf_TrustedClusterTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementClose != nil {
-		l = m.MySQLStatementClose.Size()
+	if m.TrustedClusterTokenCreate != nil {
+		l = m.TrustedClusterTokenCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementReset) Size() (n int) {
+func (m *OneOf_GithubConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementReset != nil {
-		l = m.MySQLStatementReset.Size()
+	if m.GithubConnectorCreate != nil {
+		l = m.GithubConnectorCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementFetch) Size() (n int) {
+func (m *OneOf_GithubConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementFetch != nil {
-		l = m.MySQLStatementFetch.Size()
+	if m.GithubConnectorDelete != nil {
+		l = m.GithubConnectorDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLStatementBulkExecute) Size() (n int) {
+func (m *OneOf_OIDCConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLStatementBulkExecute != nil {
-		l = m.MySQLStatementBulkExecute.Size()
+	if m.OIDCConnectorCreate != nil {
+		l = m.OIDCConnectorCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_RenewableCertificateGenerationMismatch) Size() (n int) {
+func (m *OneOf_OIDCConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RenewableCertificateGenerationMismatch != nil {
-		l = m.RenewableCertificateGenerationMismatch.Size()
+	if m.OIDCConnectorDelete != nil {
+		l = m.OIDCConnectorDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_Unknown) Size() (n int) {
+func (m *OneOf_SAMLConnectorCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Unknown != nil {
-		l = m.Unknown.Size()
+	if m.SAMLConnectorCreate != nil {
+		l = m.SAMLConnectorCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLInitDB) Size() (n int) {
+func (m *OneOf_SAMLConnectorDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLInitDB != nil {
-		l = m.MySQLInitDB.Size()
+	if m.SAMLConnectorDelete != nil {
+		l = m.SAMLConnectorDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLCreateDB) Size() (n int) {
+func (m *OneOf_KubeRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLCreateDB != nil {
-		l = m.MySQLCreateDB.Size()
+	if m.KubeRequest != nil {
+		l = m.KubeRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLDropDB) Size() (n int) {
+func (m *OneOf_AppSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLDropDB != nil {
-		l = m.MySQLDropDB.Size()
+	if m.AppSessionStart != nil {
+		l = m.AppSessionStart.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLShutDown) Size() (n int) {
+func (m *OneOf_AppSessionChunk) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLShutDown != nil {
-		l = m.MySQLShutDown.Size()
+	if m.AppSessionChunk != nil {
+		l = m.AppSessionChunk.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLProcessKill) Size() (n int) {
+func (m *OneOf_AppSessionRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLProcessKill != nil {
-		l = m.MySQLProcessKill.Size()
+	if m.AppSessionRequest != nil {
+		l = m.AppSessionRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLDebug) Size() (n int) {
+func (m *OneOf_DatabaseSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLDebug != nil {
-		l = m.MySQLDebug.Size()
+	if m.DatabaseSessionStart != nil {
+		l = m.DatabaseSessionStart.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_MySQLRefresh) Size() (n int) {
+func (m *OneOf_DatabaseSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.MySQLRefresh != nil {
-		l = m.MySQLRefresh.Size()
+	if m.DatabaseSessionEnd != nil {
+		l = m.DatabaseSessionEnd.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessRequestResourceSearch) Size() (n int) {
+func (m *OneOf_DatabaseSessionQuery) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessRequestResourceSearch != nil {
-		l = m.AccessRequestResourceSearch.Size()
+	if m.DatabaseSessionQuery != nil {
+		l = m.DatabaseSessionQuery.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SQLServerRPCRequest) Size() (n int) {
+func (m *OneOf_SessionUpload) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SQLServerRPCRequest != nil {
-		l = m.SQLServerRPCRequest.Size()
+	if m.SessionUpload != nil {
+		l = m.SessionUpload.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseSessionMalformedPacket) Size() (n int) {
+func (m *OneOf_MFADeviceAdd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseSessionMalformedPacket != nil {
-		l = m.DatabaseSessionMalformedPacket.Size()
+	if m.MFADeviceAdd != nil {
+		l = m.MFADeviceAdd.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SFTP) Size() (n int) {
+func (m *OneOf_MFADeviceDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SFTP != nil {
-		l = m.SFTP.Size()
+	if m.MFADeviceDelete != nil {
+		l = m.MFADeviceDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UpgradeWindowStartUpdate) Size() (n int) {
+func (m *OneOf_BillingInformationUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UpgradeWindowStartUpdate != nil {
-		l = m.UpgradeWindowStartUpdate.Size()
+	if m.BillingInformationUpdate != nil {
+		l = m.BillingInformationUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AppSessionEnd) Size() (n int) {
+func (m *OneOf_BillingCardCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppSessionEnd != nil {
-		l = m.AppSessionEnd.Size()
+	if m.BillingCardCreate != nil {
+		l = m.BillingCardCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SessionRecordingAccess) Size() (n int) {
+func (m *OneOf_BillingCardDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionRecordingAccess != nil {
-		l = m.SessionRecordingAccess.Size()
+	if m.BillingCardDelete != nil {
+		l = m.BillingCardDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_KubernetesClusterCreate) Size() (n int) {
+func (m *OneOf_LockCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.KubernetesClusterCreate != nil {
-		l = m.KubernetesClusterCreate.Size()
+	if m.LockCreate != nil {
+		l = m.LockCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_KubernetesClusterUpdate) Size() (n int) {
+func (m *OneOf_LockDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.KubernetesClusterUpdate != nil {
-		l = m.KubernetesClusterUpdate.Size()
+	if m.LockDelete != nil {
+		l = m.LockDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_KubernetesClusterDelete) Size() (n int) {
+func (m *OneOf_RecoveryCodeGenerate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.KubernetesClusterDelete != nil {
-		l = m.KubernetesClusterDelete.Size()
+	if m.RecoveryCodeGenerate != nil {
+		l = m.RecoveryCodeGenerate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SSMRun) Size() (n int) {
+func (m *OneOf_RecoveryCodeUsed) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SSMRun != nil {
-		l = m.SSMRun.Size()
+	if m.RecoveryCodeUsed != nil {
+		l = m.RecoveryCodeUsed.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ElasticsearchRequest) Size() (n int) {
+func (m *OneOf_DatabaseCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ElasticsearchRequest != nil {
-		l = m.ElasticsearchRequest.Size()
+	if m.DatabaseCreate != nil {
+		l = m.DatabaseCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CassandraBatch) Size() (n int) {
+func (m *OneOf_DatabaseUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CassandraBatch != nil {
-		l = m.CassandraBatch.Size()
+	if m.DatabaseUpdate != nil {
+		l = m.DatabaseUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CassandraPrepare) Size() (n int) {
+func (m *OneOf_DatabaseDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CassandraPrepare != nil {
-		l = m.CassandraPrepare.Size()
+	if m.DatabaseDelete != nil {
+		l = m.DatabaseDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CassandraRegister) Size() (n int) {
+func (m *OneOf_AppCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CassandraRegister != nil {
-		l = m.CassandraRegister.Size()
+	if m.AppCreate != nil {
+		l = m.AppCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CassandraExecute) Size() (n int) {
+func (m *OneOf_AppUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CassandraExecute != nil {
-		l = m.CassandraExecute.Size()
+	if m.AppUpdate != nil {
+		l = m.AppUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AppSessionDynamoDBRequest) Size() (n int) {
+func (m *OneOf_AppDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AppSessionDynamoDBRequest != nil {
-		l = m.AppSessionDynamoDBRequest.Size()
+	if m.AppDelete != nil {
+		l = m.AppDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopSharedDirectoryStart) Size() (n int) {
+func (m *OneOf_WindowsDesktopSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopSharedDirectoryStart != nil {
-		l = m.DesktopSharedDirectoryStart.Size()
+	if m.WindowsDesktopSessionStart != nil {
+		l = m.WindowsDesktopSessionStart.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopSharedDirectoryRead) Size() (n int) {
+func (m *OneOf_WindowsDesktopSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopSharedDirectoryRead != nil {
-		l = m.DesktopSharedDirectoryRead.Size()
+	if m.WindowsDesktopSessionEnd != nil {
+		l = m.WindowsDesktopSessionEnd.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DesktopSharedDirectoryWrite) Size() (n int) {
+func (m *OneOf_PostgresParse) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DesktopSharedDirectoryWrite != nil {
-		l = m.DesktopSharedDirectoryWrite.Size()
+	if m.PostgresParse != nil {
+		l = m.PostgresParse.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DynamoDBRequest) Size() (n int) {
+func (m *OneOf_PostgresBind) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DynamoDBRequest != nil {
-		l = m.DynamoDBRequest.Size()
+	if m.PostgresBind != nil {
+		l = m.PostgresBind.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_BotJoin) Size() (n int) {
+func (m *OneOf_PostgresExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BotJoin != nil {
-		l = m.BotJoin.Size()
+	if m.PostgresExecute != nil {
+		l = m.PostgresExecute.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_InstanceJoin) Size() (n int) {
+func (m *OneOf_PostgresClose) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.InstanceJoin != nil {
-		l = m.InstanceJoin.Size()
+	if m.PostgresClose != nil {
+		l = m.PostgresClose.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DeviceEvent) Size() (n int) {
+func (m *OneOf_PostgresFunctionCall) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DeviceEvent != nil {
-		l = m.DeviceEvent.Size()
+	if m.PostgresFunctionCall != nil {
+		l = m.PostgresFunctionCall.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_LoginRuleCreate) Size() (n int) {
+func (m *OneOf_AccessRequestDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.LoginRuleCreate != nil {
-		l = m.LoginRuleCreate.Size()
+	if m.AccessRequestDelete != nil {
+		l = m.AccessRequestDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_LoginRuleDelete) Size() (n int) {
+func (m *OneOf_SessionConnect) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.LoginRuleDelete != nil {
-		l = m.LoginRuleDelete.Size()
+	if m.SessionConnect != nil {
+		l = m.SessionConnect.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLIdPAuthAttempt) Size() (n int) {
+func (m *OneOf_CertificateCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLIdPAuthAttempt != nil {
-		l = m.SAMLIdPAuthAttempt.Size()
+	if m.CertificateCreate != nil {
+		l = m.CertificateCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLIdPServiceProviderCreate) Size() (n int) {
+func (m *OneOf_DesktopRecording) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLIdPServiceProviderCreate != nil {
-		l = m.SAMLIdPServiceProviderCreate.Size()
+	if m.DesktopRecording != nil {
+		l = m.DesktopRecording.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLIdPServiceProviderUpdate) Size() (n int) {
+func (m *OneOf_DesktopClipboardSend) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLIdPServiceProviderUpdate != nil {
-		l = m.SAMLIdPServiceProviderUpdate.Size()
+	if m.DesktopClipboardSend != nil {
+		l = m.DesktopClipboardSend.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLIdPServiceProviderDelete) Size() (n int) {
+func (m *OneOf_DesktopClipboardReceive) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLIdPServiceProviderDelete != nil {
-		l = m.SAMLIdPServiceProviderDelete.Size()
+	if m.DesktopClipboardReceive != nil {
+		l = m.DesktopClipboardReceive.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLIdPServiceProviderDeleteAll) Size() (n int) {
+func (m *OneOf_MySQLStatementPrepare) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLIdPServiceProviderDeleteAll != nil {
-		l = m.SAMLIdPServiceProviderDeleteAll.Size()
+	if m.MySQLStatementPrepare != nil {
+		l = m.MySQLStatementPrepare.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OpenSearchRequest) Size() (n int) {
+func (m *OneOf_MySQLStatementExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OpenSearchRequest != nil {
-		l = m.OpenSearchRequest.Size()
+	if m.MySQLStatementExecute != nil {
+		l = m.MySQLStatementExecute.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DeviceEvent2) Size() (n int) {
+func (m *OneOf_MySQLStatementSendLongData) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DeviceEvent2 != nil {
-		l = m.DeviceEvent2.Size()
+	if m.MySQLStatementSendLongData != nil {
+		l = m.MySQLStatementSendLongData.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OktaResourcesUpdate) Size() (n int) {
+func (m *OneOf_MySQLStatementClose) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OktaResourcesUpdate != nil {
-		l = m.OktaResourcesUpdate.Size()
+	if m.MySQLStatementClose != nil {
+		l = m.MySQLStatementClose.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OktaSyncFailure) Size() (n int) {
+func (m *OneOf_MySQLStatementReset) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OktaSyncFailure != nil {
-		l = m.OktaSyncFailure.Size()
+	if m.MySQLStatementReset != nil {
+		l = m.MySQLStatementReset.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OktaAssignmentResult) Size() (n int) {
+func (m *OneOf_MySQLStatementFetch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OktaAssignmentResult != nil {
-		l = m.OktaAssignmentResult.Size()
+	if m.MySQLStatementFetch != nil {
+		l = m.MySQLStatementFetch.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ProvisionTokenCreate) Size() (n int) {
+func (m *OneOf_MySQLStatementBulkExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ProvisionTokenCreate != nil {
-		l = m.ProvisionTokenCreate.Size()
+	if m.MySQLStatementBulkExecute != nil {
+		l = m.MySQLStatementBulkExecute.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListCreate) Size() (n int) {
+func (m *OneOf_RenewableCertificateGenerationMismatch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListCreate != nil {
-		l = m.AccessListCreate.Size()
+	if m.RenewableCertificateGenerationMismatch != nil {
+		l = m.RenewableCertificateGenerationMismatch.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListUpdate) Size() (n int) {
+func (m *OneOf_Unknown) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListUpdate != nil {
-		l = m.AccessListUpdate.Size()
+	if m.Unknown != nil {
+		l = m.Unknown.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListDelete) Size() (n int) {
+func (m *OneOf_MySQLInitDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListDelete != nil {
-		l = m.AccessListDelete.Size()
+	if m.MySQLInitDB != nil {
+		l = m.MySQLInitDB.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListReview) Size() (n int) {
+func (m *OneOf_MySQLCreateDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListReview != nil {
-		l = m.AccessListReview.Size()
+	if m.MySQLCreateDB != nil {
+		l = m.MySQLCreateDB.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListMemberCreate) Size() (n int) {
+func (m *OneOf_MySQLDropDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListMemberCreate != nil {
-		l = m.AccessListMemberCreate.Size()
+	if m.MySQLDropDB != nil {
+		l = m.MySQLDropDB.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListMemberUpdate) Size() (n int) {
+func (m *OneOf_MySQLShutDown) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListMemberUpdate != nil {
-		l = m.AccessListMemberUpdate.Size()
+	if m.MySQLShutDown != nil {
+		l = m.MySQLShutDown.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListMemberDelete) Size() (n int) {
+func (m *OneOf_MySQLProcessKill) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListMemberDelete != nil {
-		l = m.AccessListMemberDelete.Size()
+	if m.MySQLProcessKill != nil {
+		l = m.MySQLProcessKill.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessListMemberDeleteAllForAccessList) Size() (n int) {
+func (m *OneOf_MySQLDebug) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessListMemberDeleteAllForAccessList != nil {
-		l = m.AccessListMemberDeleteAllForAccessList.Size()
+	if m.MySQLDebug != nil {
+		l = m.MySQLDebug.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AuditQueryRun) Size() (n int) {
+func (m *OneOf_MySQLRefresh) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AuditQueryRun != nil {
-		l = m.AuditQueryRun.Size()
+	if m.MySQLRefresh != nil {
+		l = m.MySQLRefresh.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SecurityReportRun) Size() (n int) {
+func (m *OneOf_AccessRequestResourceSearch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SecurityReportRun != nil {
-		l = m.SecurityReportRun.Size()
+	if m.AccessRequestResourceSearch != nil {
+		l = m.AccessRequestResourceSearch.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_GithubConnectorUpdate) Size() (n int) {
+func (m *OneOf_SQLServerRPCRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.GithubConnectorUpdate != nil {
-		l = m.GithubConnectorUpdate.Size()
+	if m.SQLServerRPCRequest != nil {
+		l = m.SQLServerRPCRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OIDCConnectorUpdate) Size() (n int) {
+func (m *OneOf_DatabaseSessionMalformedPacket) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OIDCConnectorUpdate != nil {
-		l = m.OIDCConnectorUpdate.Size()
+	if m.DatabaseSessionMalformedPacket != nil {
+		l = m.DatabaseSessionMalformedPacket.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SAMLConnectorUpdate) Size() (n int) {
+func (m *OneOf_SFTP) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SAMLConnectorUpdate != nil {
-		l = m.SAMLConnectorUpdate.Size()
+	if m.SFTP != nil {
+		l = m.SFTP.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_RoleUpdate) Size() (n int) {
+func (m *OneOf_UpgradeWindowStartUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.RoleUpdate != nil {
-		l = m.RoleUpdate.Size()
+	if m.UpgradeWindowStartUpdate != nil {
+		l = m.UpgradeWindowStartUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UserUpdate) Size() (n int) {
+func (m *OneOf_AppSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserUpdate != nil {
-		l = m.UserUpdate.Size()
+	if m.AppSessionEnd != nil {
+		l = m.AppSessionEnd.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ExternalAuditStorageEnable) Size() (n int) {
+func (m *OneOf_SessionRecordingAccess) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ExternalAuditStorageEnable != nil {
-		l = m.ExternalAuditStorageEnable.Size()
+	if m.SessionRecordingAccess != nil {
+		l = m.SessionRecordingAccess.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ExternalAuditStorageDisable) Size() (n int) {
+func (m *OneOf_KubernetesClusterCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ExternalAuditStorageDisable != nil {
-		l = m.ExternalAuditStorageDisable.Size()
+	if m.KubernetesClusterCreate != nil {
+		l = m.KubernetesClusterCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_BotCreate) Size() (n int) {
+func (m *OneOf_KubernetesClusterUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BotCreate != nil {
-		l = m.BotCreate.Size()
+	if m.KubernetesClusterUpdate != nil {
+		l = m.KubernetesClusterUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_BotDelete) Size() (n int) {
+func (m *OneOf_KubernetesClusterDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BotDelete != nil {
-		l = m.BotDelete.Size()
+	if m.KubernetesClusterDelete != nil {
+		l = m.KubernetesClusterDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_BotUpdate) Size() (n int) {
+func (m *OneOf_SSMRun) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.BotUpdate != nil {
-		l = m.BotUpdate.Size()
+	if m.SSMRun != nil {
+		l = m.SSMRun.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CreateMFAAuthChallenge) Size() (n int) {
+func (m *OneOf_ElasticsearchRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CreateMFAAuthChallenge != nil {
-		l = m.CreateMFAAuthChallenge.Size()
+	if m.ElasticsearchRequest != nil {
+		l = m.ElasticsearchRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ValidateMFAAuthResponse) Size() (n int) {
+func (m *OneOf_CassandraBatch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ValidateMFAAuthResponse != nil {
-		l = m.ValidateMFAAuthResponse.Size()
+	if m.CassandraBatch != nil {
+		l = m.CassandraBatch.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OktaAccessListSync) Size() (n int) {
+func (m *OneOf_CassandraPrepare) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OktaAccessListSync != nil {
-		l = m.OktaAccessListSync.Size()
+	if m.CassandraPrepare != nil {
+		l = m.CassandraPrepare.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabasePermissionUpdate) Size() (n int) {
+func (m *OneOf_CassandraRegister) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabasePermissionUpdate != nil {
-		l = m.DatabasePermissionUpdate.Size()
+	if m.CassandraRegister != nil {
+		l = m.CassandraRegister.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SPIFFESVIDIssued) Size() (n int) {
+func (m *OneOf_CassandraExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SPIFFESVIDIssued != nil {
-		l = m.SPIFFESVIDIssued.Size()
+	if m.CassandraExecute != nil {
+		l = m.CassandraExecute.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_OktaUserSync) Size() (n int) {
+func (m *OneOf_AppSessionDynamoDBRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.OktaUserSync != nil {
-		l = m.OktaUserSync.Size()
+	if m.AppSessionDynamoDBRequest != nil {
+		l = m.AppSessionDynamoDBRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AuthPreferenceUpdate) Size() (n int) {
+func (m *OneOf_DesktopSharedDirectoryStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AuthPreferenceUpdate != nil {
-		l = m.AuthPreferenceUpdate.Size()
+	if m.DesktopSharedDirectoryStart != nil {
+		l = m.DesktopSharedDirectoryStart.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SessionRecordingConfigUpdate) Size() (n int) {
+func (m *OneOf_DesktopSharedDirectoryRead) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SessionRecordingConfigUpdate != nil {
-		l = m.SessionRecordingConfigUpdate.Size()
+	if m.DesktopSharedDirectoryRead != nil {
+		l = m.DesktopSharedDirectoryRead.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ClusterNetworkingConfigUpdate) Size() (n int) {
+func (m *OneOf_DesktopSharedDirectoryWrite) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ClusterNetworkingConfigUpdate != nil {
-		l = m.ClusterNetworkingConfigUpdate.Size()
+	if m.DesktopSharedDirectoryWrite != nil {
+		l = m.DesktopSharedDirectoryWrite.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseUserCreate) Size() (n int) {
+func (m *OneOf_DynamoDBRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseUserCreate != nil {
-		l = m.DatabaseUserCreate.Size()
+	if m.DynamoDBRequest != nil {
+		l = m.DynamoDBRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseUserDeactivate) Size() (n int) {
+func (m *OneOf_BotJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseUserDeactivate != nil {
-		l = m.DatabaseUserDeactivate.Size()
+	if m.BotJoin != nil {
+		l = m.BotJoin.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessPathChanged) Size() (n int) {
+func (m *OneOf_InstanceJoin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessPathChanged != nil {
-		l = m.AccessPathChanged.Size()
+	if m.InstanceJoin != nil {
+		l = m.InstanceJoin.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SpannerRPC) Size() (n int) {
+func (m *OneOf_DeviceEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SpannerRPC != nil {
-		l = m.SpannerRPC.Size()
+	if m.DeviceEvent != nil {
+		l = m.DeviceEvent.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DatabaseSessionCommandResult) Size() (n int) {
+func (m *OneOf_LoginRuleCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DatabaseSessionCommandResult != nil {
-		l = m.DatabaseSessionCommandResult.Size()
+	if m.LoginRuleCreate != nil {
+		l = m.LoginRuleCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DiscoveryConfigCreate) Size() (n int) {
+func (m *OneOf_LoginRuleDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DiscoveryConfigCreate != nil {
-		l = m.DiscoveryConfigCreate.Size()
+	if m.LoginRuleDelete != nil {
+		l = m.LoginRuleDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DiscoveryConfigUpdate) Size() (n int) {
+func (m *OneOf_SAMLIdPAuthAttempt) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DiscoveryConfigUpdate != nil {
-		l = m.DiscoveryConfigUpdate.Size()
+	if m.SAMLIdPAuthAttempt != nil {
+		l = m.SAMLIdPAuthAttempt.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DiscoveryConfigDelete) Size() (n int) {
+func (m *OneOf_SAMLIdPServiceProviderCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DiscoveryConfigDelete != nil {
-		l = m.DiscoveryConfigDelete.Size()
+	if m.SAMLIdPServiceProviderCreate != nil {
+		l = m.SAMLIdPServiceProviderCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_DiscoveryConfigDeleteAll) Size() (n int) {
+func (m *OneOf_SAMLIdPServiceProviderUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.DiscoveryConfigDeleteAll != nil {
-		l = m.DiscoveryConfigDeleteAll.Size()
+	if m.SAMLIdPServiceProviderUpdate != nil {
+		l = m.SAMLIdPServiceProviderUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessGraphSettingsUpdate) Size() (n int) {
+func (m *OneOf_SAMLIdPServiceProviderDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessGraphSettingsUpdate != nil {
-		l = m.AccessGraphSettingsUpdate.Size()
+	if m.SAMLIdPServiceProviderDelete != nil {
+		l = m.SAMLIdPServiceProviderDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_IntegrationCreate) Size() (n int) {
+func (m *OneOf_SAMLIdPServiceProviderDeleteAll) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.IntegrationCreate != nil {
-		l = m.IntegrationCreate.Size()
+	if m.SAMLIdPServiceProviderDeleteAll != nil {
+		l = m.SAMLIdPServiceProviderDeleteAll.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_IntegrationUpdate) Size() (n int) {
+func (m *OneOf_OpenSearchRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.IntegrationUpdate != nil {
-		l = m.IntegrationUpdate.Size()
+	if m.OpenSearchRequest != nil {
+		l = m.OpenSearchRequest.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_IntegrationDelete) Size() (n int) {
+func (m *OneOf_DeviceEvent2) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.IntegrationDelete != nil {
-		l = m.IntegrationDelete.Size()
+	if m.DeviceEvent2 != nil {
+		l = m.DeviceEvent2.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SPIFFEFederationCreate) Size() (n int) {
+func (m *OneOf_OktaResourcesUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SPIFFEFederationCreate != nil {
-		l = m.SPIFFEFederationCreate.Size()
+	if m.OktaResourcesUpdate != nil {
+		l = m.OktaResourcesUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SPIFFEFederationDelete) Size() (n int) {
+func (m *OneOf_OktaSyncFailure) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SPIFFEFederationDelete != nil {
-		l = m.SPIFFEFederationDelete.Size()
+	if m.OktaSyncFailure != nil {
+		l = m.OktaSyncFailure.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PluginCreate) Size() (n int) {
+func (m *OneOf_OktaAssignmentResult) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PluginCreate != nil {
-		l = m.PluginCreate.Size()
+	if m.OktaAssignmentResult != nil {
+		l = m.OktaAssignmentResult.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PluginUpdate) Size() (n int) {
+func (m *OneOf_ProvisionTokenCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PluginUpdate != nil {
-		l = m.PluginUpdate.Size()
+	if m.ProvisionTokenCreate != nil {
+		l = m.ProvisionTokenCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_PluginDelete) Size() (n int) {
+func (m *OneOf_AccessListCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PluginDelete != nil {
-		l = m.PluginDelete.Size()
+	if m.AccessListCreate != nil {
+		l = m.AccessListCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateConfigCreate) Size() (n int) {
+func (m *OneOf_AccessListUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateConfigCreate != nil {
-		l = m.AutoUpdateConfigCreate.Size()
+	if m.AccessListUpdate != nil {
+		l = m.AccessListUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateConfigUpdate) Size() (n int) {
+func (m *OneOf_AccessListDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateConfigUpdate != nil {
-		l = m.AutoUpdateConfigUpdate.Size()
+	if m.AccessListDelete != nil {
+		l = m.AccessListDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateConfigDelete) Size() (n int) {
+func (m *OneOf_AccessListReview) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateConfigDelete != nil {
-		l = m.AutoUpdateConfigDelete.Size()
+	if m.AccessListReview != nil {
+		l = m.AccessListReview.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateVersionCreate) Size() (n int) {
+func (m *OneOf_AccessListMemberCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateVersionCreate != nil {
-		l = m.AutoUpdateVersionCreate.Size()
+	if m.AccessListMemberCreate != nil {
+		l = m.AccessListMemberCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateVersionUpdate) Size() (n int) {
+func (m *OneOf_AccessListMemberUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateVersionUpdate != nil {
-		l = m.AutoUpdateVersionUpdate.Size()
+	if m.AccessListMemberUpdate != nil {
+		l = m.AccessListMemberUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateVersionDelete) Size() (n int) {
+func (m *OneOf_AccessListMemberDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateVersionDelete != nil {
-		l = m.AutoUpdateVersionDelete.Size()
+	if m.AccessListMemberDelete != nil {
+		l = m.AccessListMemberDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_StaticHostUserCreate) Size() (n int) {
+func (m *OneOf_AccessListMemberDeleteAllForAccessList) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.StaticHostUserCreate != nil {
-		l = m.StaticHostUserCreate.Size()
+	if m.AccessListMemberDeleteAllForAccessList != nil {
+		l = m.AccessListMemberDeleteAllForAccessList.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_StaticHostUserUpdate) Size() (n int) {
+func (m *OneOf_AuditQueryRun) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.StaticHostUserUpdate != nil {
-		l = m.StaticHostUserUpdate.Size()
+	if m.AuditQueryRun != nil {
+		l = m.AuditQueryRun.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_StaticHostUserDelete) Size() (n int) {
+func (m *OneOf_SecurityReportRun) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.StaticHostUserDelete != nil {
-		l = m.StaticHostUserDelete.Size()
+	if m.SecurityReportRun != nil {
+		l = m.SecurityReportRun.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CrownJewelCreate) Size() (n int) {
+func (m *OneOf_GithubConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CrownJewelCreate != nil {
-		l = m.CrownJewelCreate.Size()
+	if m.GithubConnectorUpdate != nil {
+		l = m.GithubConnectorUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CrownJewelUpdate) Size() (n int) {
+func (m *OneOf_OIDCConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CrownJewelUpdate != nil {
-		l = m.CrownJewelUpdate.Size()
+	if m.OIDCConnectorUpdate != nil {
+		l = m.OIDCConnectorUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_CrownJewelDelete) Size() (n int) {
+func (m *OneOf_SAMLConnectorUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.CrownJewelDelete != nil {
-		l = m.CrownJewelDelete.Size()
+	if m.SAMLConnectorUpdate != nil {
+		l = m.SAMLConnectorUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UserTaskCreate) Size() (n int) {
+func (m *OneOf_RoleUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserTaskCreate != nil {
-		l = m.UserTaskCreate.Size()
+	if m.RoleUpdate != nil {
+		l = m.RoleUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UserTaskUpdate) Size() (n int) {
+func (m *OneOf_UserUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserTaskUpdate != nil {
-		l = m.UserTaskUpdate.Size()
+	if m.UserUpdate != nil {
+		l = m.UserUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UserTaskDelete) Size() (n int) {
+func (m *OneOf_ExternalAuditStorageEnable) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserTaskDelete != nil {
-		l = m.UserTaskDelete.Size()
+	if m.ExternalAuditStorageEnable != nil {
+		l = m.ExternalAuditStorageEnable.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SFTPSummary) Size() (n int) {
+func (m *OneOf_ExternalAuditStorageDisable) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SFTPSummary != nil {
-		l = m.SFTPSummary.Size()
+	if m.ExternalAuditStorageDisable != nil {
+		l = m.ExternalAuditStorageDisable.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ContactCreate) Size() (n int) {
+func (m *OneOf_BotCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ContactCreate != nil {
-		l = m.ContactCreate.Size()
+	if m.BotCreate != nil {
+		l = m.BotCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_ContactDelete) Size() (n int) {
+func (m *OneOf_BotDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ContactDelete != nil {
-		l = m.ContactDelete.Size()
+	if m.BotDelete != nil {
+		l = m.BotDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityCreate) Size() (n int) {
+func (m *OneOf_BotUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityCreate != nil {
-		l = m.WorkloadIdentityCreate.Size()
+	if m.BotUpdate != nil {
+		l = m.BotUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityUpdate) Size() (n int) {
+func (m *OneOf_CreateMFAAuthChallenge) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityUpdate != nil {
-		l = m.WorkloadIdentityUpdate.Size()
+	if m.CreateMFAAuthChallenge != nil {
+		l = m.CreateMFAAuthChallenge.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityDelete) Size() (n int) {
+func (m *OneOf_ValidateMFAAuthResponse) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityDelete != nil {
-		l = m.WorkloadIdentityDelete.Size()
+	if m.ValidateMFAAuthResponse != nil {
+		l = m.ValidateMFAAuthResponse.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_GitCommand) Size() (n int) {
+func (m *OneOf_OktaAccessListSync) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.GitCommand != nil {
-		l = m.GitCommand.Size()
+	if m.OktaAccessListSync != nil {
+		l = m.OktaAccessListSync.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_UserLoginAccessListInvalid) Size() (n int) {
+func (m *OneOf_DatabasePermissionUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.UserLoginAccessListInvalid != nil {
-		l = m.UserLoginAccessListInvalid.Size()
+	if m.DatabasePermissionUpdate != nil {
+		l = m.DatabasePermissionUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AccessRequestExpire) Size() (n int) {
+func (m *OneOf_SPIFFESVIDIssued) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AccessRequestExpire != nil {
-		l = m.AccessRequestExpire.Size()
+	if m.SPIFFESVIDIssued != nil {
+		l = m.SPIFFESVIDIssued.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_StableUNIXUserCreate) Size() (n int) {
+func (m *OneOf_OktaUserSync) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.StableUNIXUserCreate != nil {
-		l = m.StableUNIXUserCreate.Size()
+	if m.OktaUserSync != nil {
+		l = m.OktaUserSync.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityX509RevocationCreate) Size() (n int) {
+func (m *OneOf_AuthPreferenceUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityX509RevocationCreate != nil {
-		l = m.WorkloadIdentityX509RevocationCreate.Size()
+	if m.AuthPreferenceUpdate != nil {
+		l = m.AuthPreferenceUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityX509RevocationDelete) Size() (n int) {
+func (m *OneOf_SessionRecordingConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityX509RevocationDelete != nil {
-		l = m.WorkloadIdentityX509RevocationDelete.Size()
+	if m.SessionRecordingConfigUpdate != nil {
+		l = m.SessionRecordingConfigUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityX509RevocationUpdate) Size() (n int) {
+func (m *OneOf_ClusterNetworkingConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityX509RevocationUpdate != nil {
-		l = m.WorkloadIdentityX509RevocationUpdate.Size()
+	if m.ClusterNetworkingConfigUpdate != nil {
+		l = m.ClusterNetworkingConfigUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AWSICResourceSync) Size() (n int) {
+func (m *OneOf_DatabaseUserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AWSICResourceSync != nil {
-		l = m.AWSICResourceSync.Size()
+	if m.DatabaseUserCreate != nil {
+		l = m.DatabaseUserCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_HealthCheckConfigCreate) Size() (n int) {
+func (m *OneOf_DatabaseUserDeactivate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.HealthCheckConfigCreate != nil {
-		l = m.HealthCheckConfigCreate.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	if m.DatabaseUserDeactivate != nil {
+		l = m.DatabaseUserDeactivate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_HealthCheckConfigUpdate) Size() (n int) {
+func (m *OneOf_AccessPathChanged) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.HealthCheckConfigUpdate != nil {
-		l = m.HealthCheckConfigUpdate.Size()
+	if m.AccessPathChanged != nil {
+		l = m.AccessPathChanged.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_HealthCheckConfigDelete) Size() (n int) {
+func (m *OneOf_SpannerRPC) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.HealthCheckConfigDelete != nil {
-		l = m.HealthCheckConfigDelete.Size()
+	if m.SpannerRPC != nil {
+		l = m.SpannerRPC.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
+func (m *OneOf_DatabaseSessionCommandResult) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityX509IssuerOverrideCreate != nil {
-		l = m.WorkloadIdentityX509IssuerOverrideCreate.Size()
+	if m.DatabaseSessionCommandResult != nil {
+		l = m.DatabaseSessionCommandResult.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
+func (m *OneOf_DiscoveryConfigCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.WorkloadIdentityX509IssuerOverrideDelete != nil {
-		l = m.WorkloadIdentityX509IssuerOverrideDelete.Size()
+	if m.DiscoveryConfigCreate != nil {
+		l = m.DiscoveryConfigCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SigstorePolicyCreate) Size() (n int) {
+func (m *OneOf_DiscoveryConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SigstorePolicyCreate != nil {
-		l = m.SigstorePolicyCreate.Size()
+	if m.DiscoveryConfigUpdate != nil {
+		l = m.DiscoveryConfigUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SigstorePolicyUpdate) Size() (n int) {
+func (m *OneOf_DiscoveryConfigDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SigstorePolicyUpdate != nil {
-		l = m.SigstorePolicyUpdate.Size()
+	if m.DiscoveryConfigDelete != nil {
+		l = m.DiscoveryConfigDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_SigstorePolicyDelete) Size() (n int) {
+func (m *OneOf_DiscoveryConfigDeleteAll) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.SigstorePolicyDelete != nil {
-		l = m.SigstorePolicyDelete.Size()
+	if m.DiscoveryConfigDeleteAll != nil {
+		l = m.DiscoveryConfigDeleteAll.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateAgentRolloutTrigger) Size() (n int) {
+func (m *OneOf_AccessGraphSettingsUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateAgentRolloutTrigger != nil {
-		l = m.AutoUpdateAgentRolloutTrigger.Size()
+	if m.AccessGraphSettingsUpdate != nil {
+		l = m.AccessGraphSettingsUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateAgentRolloutForceDone) Size() (n int) {
+func (m *OneOf_IntegrationCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateAgentRolloutForceDone != nil {
-		l = m.AutoUpdateAgentRolloutForceDone.Size()
+	if m.IntegrationCreate != nil {
+		l = m.IntegrationCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *OneOf_AutoUpdateAgentRolloutRollback) Size() (n int) {
+func (m *OneOf_IntegrationUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.AutoUpdateAgentRolloutRollback != nil {
-		l = m.AutoUpdateAgentRolloutRollback.Size()
+	if m.IntegrationUpdate != nil {
+		l = m.IntegrationUpdate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-func (m *StreamStatus) Size() (n int) {
+func (m *OneOf_IntegrationDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.UploadID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.LastEventIndex != 0 {
-		n += 1 + sovEvents(uint64(m.LastEventIndex))
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime)
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.IntegrationDelete != nil {
+		l = m.IntegrationDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SessionUpload) Size() (n int) {
+func (m *OneOf_SPIFFEFederationCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SessionURL)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SPIFFEFederationCreate != nil {
+		l = m.SPIFFEFederationCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *Identity) Size() (n int) {
+func (m *OneOf_SPIFFEFederationDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.User)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Impersonator)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.Usage) > 0 {
-		for _, s := range m.Usage {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.Logins) > 0 {
-		for _, s := range m.Logins {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.KubernetesGroups) > 0 {
-		for _, s := range m.KubernetesGroups {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.KubernetesUsers) > 0 {
-		for _, s := range m.KubernetesUsers {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires)
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.RouteToCluster)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.KubernetesCluster)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.Traits.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.RouteToApp != nil {
-		l = m.RouteToApp.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.TeleportCluster)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.RouteToDatabase != nil {
-		l = m.RouteToDatabase.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.DatabaseNames) > 0 {
-		for _, s := range m.DatabaseNames {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.DatabaseUsers) > 0 {
-		for _, s := range m.DatabaseUsers {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	l = len(m.MFADeviceUUID)
-	if l > 0 {
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ClientIP)
-	if l > 0 {
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	if len(m.AWSRoleARNs) > 0 {
-		for _, s := range m.AWSRoleARNs {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.AccessRequests) > 0 {
-		for _, s := range m.AccessRequests {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.DisallowReissue {
-		n += 3
-	}
-	if len(m.AllowedResourceIDs) > 0 {
-		for _, e := range m.AllowedResourceIDs {
-			l = e.Size()
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.PreviousIdentityExpires)
-	n += 2 + l + sovEvents(uint64(l))
-	if len(m.AzureIdentities) > 0 {
-		for _, s := range m.AzureIdentities {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.GCPServiceAccounts) > 0 {
-		for _, s := range m.GCPServiceAccounts {
-			l = len(s)
-			n += 2 + l + sovEvents(uint64(l))
-		}
-	}
-	l = len(m.PrivateKeyPolicy)
-	if l > 0 {
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	l = len(m.BotName)
-	if l > 0 {
+	if m.SPIFFEFederationDelete != nil {
+		l = m.SPIFFEFederationDelete.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
-	if m.DeviceExtensions != nil {
-		l = m.DeviceExtensions.Size()
-		n += 2 + l + sovEvents(uint64(l))
+	return n
+}
+func (m *OneOf_PluginCreate) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	l = len(m.BotInstanceID)
-	if l > 0 {
+	var l int
+	_ = l
+	if m.PluginCreate != nil {
+		l = m.PluginCreate.Size()
 		n += 2 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
 	return n
 }
-
-func (m *RouteToApp) Size() (n int) {
+func (m *OneOf_PluginUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Name)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.SessionID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.PublicAddr)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.ClusterName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.AWSRoleARN)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.AzureIdentity)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.GCPServiceAccount)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.URI)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.TargetPort != 0 {
-		n += 1 + sovEvents(uint64(m.TargetPort))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.PluginUpdate != nil {
+		l = m.PluginUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *RouteToDatabase) Size() (n int) {
+func (m *OneOf_PluginDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.ServiceName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Protocol)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Username)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Database)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Roles) > 0 {
-		for _, s := range m.Roles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.PluginDelete != nil {
+		l = m.PluginDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *DeviceExtensions) Size() (n int) {
+func (m *OneOf_AutoUpdateConfigCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.DeviceId)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.AssetTag)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.CredentialId)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateConfigCreate != nil {
+		l = m.AutoUpdateConfigCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessRequestResourceSearch) Size() (n int) {
+func (m *OneOf_AutoUpdateConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.SearchAsRoles) > 0 {
-		for _, s := range m.SearchAsRoles {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = len(m.ResourceType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Namespace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Labels) > 0 {
-		for k, v := range m.Labels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
-	l = len(m.PredicateExpression)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.SearchKeywords) > 0 {
-		for _, s := range m.SearchKeywords {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateConfigUpdate != nil {
+		l = m.AutoUpdateConfigUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementPrepare) Size() (n int) {
+func (m *OneOf_AutoUpdateConfigDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateConfigDelete != nil {
+		l = m.AutoUpdateConfigDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementExecute) Size() (n int) {
+func (m *OneOf_AutoUpdateVersionCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if len(m.Parameters) > 0 {
-		for _, s := range m.Parameters {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateVersionCreate != nil {
+		l = m.AutoUpdateVersionCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementSendLongData) Size() (n int) {
+func (m *OneOf_AutoUpdateVersionUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if m.ParameterID != 0 {
-		n += 1 + sovEvents(uint64(m.ParameterID))
-	}
-	if m.DataSize != 0 {
-		n += 1 + sovEvents(uint64(m.DataSize))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateVersionUpdate != nil {
+		l = m.AutoUpdateVersionUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementClose) Size() (n int) {
+func (m *OneOf_AutoUpdateVersionDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateVersionDelete != nil {
+		l = m.AutoUpdateVersionDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementReset) Size() (n int) {
+func (m *OneOf_StaticHostUserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.StaticHostUserCreate != nil {
+		l = m.StaticHostUserCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementFetch) Size() (n int) {
+func (m *OneOf_StaticHostUserUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if m.RowsCount != 0 {
-		n += 1 + sovEvents(uint64(m.RowsCount))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.StaticHostUserUpdate != nil {
+		l = m.StaticHostUserUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLStatementBulkExecute) Size() (n int) {
+func (m *OneOf_StaticHostUserDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatementID != 0 {
-		n += 1 + sovEvents(uint64(m.StatementID))
-	}
-	if len(m.Parameters) > 0 {
-		for _, s := range m.Parameters {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.StaticHostUserDelete != nil {
+		l = m.StaticHostUserDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLInitDB) Size() (n int) {
+func (m *OneOf_CrownJewelCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SchemaName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.CrownJewelCreate != nil {
+		l = m.CrownJewelCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLCreateDB) Size() (n int) {
+func (m *OneOf_CrownJewelUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SchemaName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.CrownJewelUpdate != nil {
+		l = m.CrownJewelUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLDropDB) Size() (n int) {
+func (m *OneOf_CrownJewelDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SchemaName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.CrownJewelDelete != nil {
+		l = m.CrownJewelDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLShutDown) Size() (n int) {
+func (m *OneOf_UserTaskCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.UserTaskCreate != nil {
+		l = m.UserTaskCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLProcessKill) Size() (n int) {
+func (m *OneOf_UserTaskUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.ProcessID != 0 {
-		n += 1 + sovEvents(uint64(m.ProcessID))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.UserTaskUpdate != nil {
+		l = m.UserTaskUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLDebug) Size() (n int) {
+func (m *OneOf_UserTaskDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.UserTaskDelete != nil {
+		l = m.UserTaskDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *MySQLRefresh) Size() (n int) {
+func (m *OneOf_SFTPSummary) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Subcommand)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SFTPSummary != nil {
+		l = m.SFTPSummary.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SQLServerRPCRequest) Size() (n int) {
+func (m *OneOf_ContactCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Procname)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Parameters) > 0 {
-		for _, s := range m.Parameters {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.ContactCreate != nil {
+		l = m.ContactCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *DatabaseSessionMalformedPacket) Size() (n int) {
+func (m *OneOf_ContactDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Payload)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.ContactDelete != nil {
+		l = m.ContactDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *ElasticsearchRequest) Size() (n int) {
+func (m *OneOf_WorkloadIdentityCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.RawQuery)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Method)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Body)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.Headers.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Category != 0 {
-		n += 1 + sovEvents(uint64(m.Category))
-	}
-	l = len(m.Target)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.StatusCode != 0 {
-		n += 1 + sovEvents(uint64(m.StatusCode))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityCreate != nil {
+		l = m.WorkloadIdentityCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *OpenSearchRequest) Size() (n int) {
+func (m *OneOf_WorkloadIdentityUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.RawQuery)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Method)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Body)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.Headers.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Category != 0 {
-		n += 1 + sovEvents(uint64(m.Category))
-	}
-	l = len(m.Target)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.StatusCode != 0 {
-		n += 1 + sovEvents(uint64(m.StatusCode))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityUpdate != nil {
+		l = m.WorkloadIdentityUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *DynamoDBRequest) Size() (n int) {
+func (m *OneOf_WorkloadIdentityDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.StatusCode != 0 {
-		n += 1 + sovEvents(uint64(m.StatusCode))
-	}
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.RawQuery)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Method)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Target)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Body != nil {
-		l = m.Body.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityDelete != nil {
+		l = m.WorkloadIdentityDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AppSessionDynamoDBRequest) Size() (n int) {
+func (m *OneOf_GitCommand) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AppMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AWSRequestMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SessionChunkID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.StatusCode != 0 {
-		n += 1 + sovEvents(uint64(m.StatusCode))
-	}
-	l = len(m.Path)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.RawQuery)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Method)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Target)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.GitCommand != nil {
+		l = m.GitCommand.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
-	if m.Body != nil {
-		l = m.Body.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	return n
+}
+func (m *OneOf_UserLoginAccessListInvalid) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	var l int
+	_ = l
+	if m.UserLoginAccessListInvalid != nil {
+		l = m.UserLoginAccessListInvalid.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *UpgradeWindowStartMetadata) Size() (n int) {
+func (m *OneOf_AccessRequestExpire) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.UpgradeWindowStart)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AccessRequestExpire != nil {
+		l = m.AccessRequestExpire.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *UpgradeWindowStartUpdate) Size() (n int) {
+func (m *OneOf_StableUNIXUserCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UpgradeWindowStartMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.StableUNIXUserCreate != nil {
+		l = m.StableUNIXUserCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SessionRecordingAccess) Size() (n int) {
+func (m *OneOf_WorkloadIdentityX509RevocationCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SessionID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SessionType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.WorkloadIdentityX509RevocationCreate != nil {
+		l = m.WorkloadIdentityX509RevocationCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Format)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	return n
+}
+func (m *OneOf_WorkloadIdentityX509RevocationDelete) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	var l int
+	_ = l
+	if m.WorkloadIdentityX509RevocationDelete != nil {
+		l = m.WorkloadIdentityX509RevocationDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *KubeClusterMetadata) Size() (n int) {
+func (m *OneOf_WorkloadIdentityX509RevocationUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if len(m.KubeLabels) > 0 {
-		for k, v := range m.KubeLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
-			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityX509RevocationUpdate != nil {
+		l = m.WorkloadIdentityX509RevocationUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *KubernetesClusterCreate) Size() (n int) {
+func (m *OneOf_AWSICResourceSync) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubeClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AWSICResourceSync != nil {
+		l = m.AWSICResourceSync.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *KubernetesClusterUpdate) Size() (n int) {
+func (m *OneOf_HealthCheckConfigCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.KubeClusterMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.HealthCheckConfigCreate != nil {
+		l = m.HealthCheckConfigCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *KubernetesClusterDelete) Size() (n int) {
+func (m *OneOf_HealthCheckConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.HealthCheckConfigUpdate != nil {
+		l = m.HealthCheckConfigUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SSMRun) Size() (n int) {
+func (m *OneOf_HealthCheckConfigDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.CommandID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.InstanceID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.ExitCode != 0 {
-		n += 1 + sovEvents(uint64(m.ExitCode))
-	}
-	l = len(m.Status)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.AccountID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Region)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.StandardOutput)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.StandardError)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.InvocationURL)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.HealthCheckConfigDelete != nil {
+		l = m.HealthCheckConfigDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraPrepare) Size() (n int) {
+func (m *OneOf_WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Keyspace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityX509IssuerOverrideCreate != nil {
+		l = m.WorkloadIdentityX509IssuerOverrideCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraExecute) Size() (n int) {
+func (m *OneOf_WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.QueryId)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.WorkloadIdentityX509IssuerOverrideDelete != nil {
+		l = m.WorkloadIdentityX509IssuerOverrideDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraBatch) Size() (n int) {
+func (m *OneOf_SigstorePolicyCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Consistency)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Keyspace)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.BatchType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Children) > 0 {
-		for _, e := range m.Children {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SigstorePolicyCreate != nil {
+		l = m.SigstorePolicyCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraBatch_BatchChild) Size() (n int) {
+func (m *OneOf_SigstorePolicyUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.ID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Query)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.Values) > 0 {
-		for _, e := range m.Values {
-			l = e.Size()
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SigstorePolicyUpdate != nil {
+		l = m.SigstorePolicyUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraBatch_BatchChild_Value) Size() (n int) {
+func (m *OneOf_SigstorePolicyDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Type != 0 {
-		n += 1 + sovEvents(uint64(m.Type))
-	}
-	l = len(m.Contents)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SigstorePolicyDelete != nil {
+		l = m.SigstorePolicyDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *CassandraRegister) Size() (n int) {
+func (m *OneOf_AutoUpdateAgentRolloutTrigger) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.DatabaseMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if len(m.EventTypes) > 0 {
-		for _, s := range m.EventTypes {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateAgentRolloutTrigger != nil {
+		l = m.AutoUpdateAgentRolloutTrigger.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *LoginRuleCreate) Size() (n int) {
+func (m *OneOf_AutoUpdateAgentRolloutForceDone) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateAgentRolloutForceDone != nil {
+		l = m.AutoUpdateAgentRolloutForceDone.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *LoginRuleDelete) Size() (n int) {
+func (m *OneOf_AutoUpdateAgentRolloutRollback) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.AutoUpdateAgentRolloutRollback != nil {
+		l = m.AutoUpdateAgentRolloutRollback.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SAMLIdPAuthAttempt) Size() (n int) {
+func (m *OneOf_MCPSessionStart) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SessionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SAMLIdPServiceProviderMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionStart != nil {
+		l = m.MCPSessionStart.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SAMLIdPServiceProviderCreate) Size() (n int) {
+func (m *OneOf_MCPSessionEnd) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SAMLIdPServiceProviderMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionEnd != nil {
+		l = m.MCPSessionEnd.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SAMLIdPServiceProviderUpdate) Size() (n int) {
+func (m *OneOf_MCPSessionRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SAMLIdPServiceProviderMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionRequest != nil {
+		l = m.MCPSessionRequest.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SAMLIdPServiceProviderDelete) Size() (n int) {
+func (m *OneOf_MCPSessionNotification) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.SAMLIdPServiceProviderMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionNotification != nil {
+		l = m.MCPSessionNotification.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *SAMLIdPServiceProviderDeleteAll) Size() (n int) {
+func (m *OneOf_BoundKeypairRecovery) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.BoundKeypairRecovery != nil {
+		l = m.BoundKeypairRecovery.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *OktaResourcesUpdate) Size() (n int) {
+func (m *OneOf_BoundKeypairRotation) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.OktaResourcesUpdatedMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.BoundKeypairRotation != nil {
+		l = m.BoundKeypairRotation.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *OktaSyncFailure) Size() (n int) {
+func (m *OneOf_BoundKeypairJoinStateVerificationFailed) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.BoundKeypairJoinStateVerificationFailed != nil {
+		l = m.BoundKeypairJoinStateVerificationFailed.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *OktaAssignmentResult) Size() (n int) {
+func (m *OneOf_MCPSessionListenSSEStream) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.OktaAssignmentMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionListenSSEStream != nil {
+		l = m.MCPSessionListenSSEStream.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListCreate) Size() (n int) {
+func (m *OneOf_MCPSessionInvalidHTTPRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.AccessListTitle)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.MCPSessionInvalidHTTPRequest != nil {
+		l = m.MCPSessionInvalidHTTPRequest.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListUpdate) Size() (n int) {
+func (m *OneOf_SCIMListingEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.AccessListTitle)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SCIMListingEvent != nil {
+		l = m.SCIMListingEvent.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListDelete) Size() (n int) {
+func (m *OneOf_SCIMResourceEvent) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.AccessListTitle)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.SCIMResourceEvent != nil {
+		l = m.SCIMResourceEvent.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListMemberCreate) Size() (n int) {
+func (m *OneOf_ClientIPRestrictionsUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListMemberMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.ClientIPRestrictionsUpdate != nil {
+		l = m.ClientIPRestrictionsUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListMemberUpdate) Size() (n int) {
+func (m *OneOf_VnetConfigCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListMemberMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.VnetConfigCreate != nil {
+		l = m.VnetConfigCreate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListMemberDelete) Size() (n int) {
+func (m *OneOf_VnetConfigUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListMemberMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.VnetConfigUpdate != nil {
+		l = m.VnetConfigUpdate.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListMemberDeleteAllForAccessList) Size() (n int) {
+func (m *OneOf_VnetConfigDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListMemberMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if m.VnetConfigDelete != nil {
+		l = m.VnetConfigDelete.Size()
+		n += 2 + l + sovEvents(uint64(l))
 	}
 	return n
 }
-
-func (m *AccessListReview) Size() (n int) {
+func (m *StreamStatus) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListReviewMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = len(m.UploadID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.LastEventIndex != 0 {
+		n += 1 + sovEvents(uint64(m.LastEventIndex))
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime)
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -50953,7 +53542,7 @@ func (m *AccessListReview) Size() (n int) {
 	return n
 }
 
-func (m *AuditQueryRun) Size() (n int) {
+func (m *SessionUpload) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -50961,118 +53550,211 @@ func (m *AuditQueryRun) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.AuditQueryDetails.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SessionURL)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AuditQueryDetails) Size() (n int) {
+func (m *Identity) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Name)
+	l = len(m.User)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Query)
+	l = len(m.Impersonator)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.Days != 0 {
-		n += 1 + sovEvents(uint64(m.Days))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	if m.ExecutionTimeInMillis != 0 {
-		n += 1 + sovEvents(uint64(m.ExecutionTimeInMillis))
+	if len(m.Usage) > 0 {
+		for _, s := range m.Usage {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	if m.DataScannedInBytes != 0 {
-		n += 1 + sovEvents(uint64(m.DataScannedInBytes))
+	if len(m.Logins) > 0 {
+		for _, s := range m.Logins {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.KubernetesGroups) > 0 {
+		for _, s := range m.KubernetesGroups {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	return n
-}
-
-func (m *SecurityReportRun) Size() (n int) {
-	if m == nil {
-		return 0
+	if len(m.KubernetesUsers) > 0 {
+		for _, s := range m.KubernetesUsers {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires)
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Name)
+	l = len(m.RouteToCluster)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Version)
+	l = len(m.KubernetesCluster)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.TotalExecutionTimeInMillis != 0 {
-		n += 1 + sovEvents(uint64(m.TotalExecutionTimeInMillis))
+	l = m.Traits.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.RouteToApp != nil {
+		l = m.RouteToApp.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.TotalDataScannedInBytes != 0 {
-		n += 1 + sovEvents(uint64(m.TotalDataScannedInBytes))
+	l = len(m.TeleportCluster)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.AuditQueries) > 0 {
-		for _, e := range m.AuditQueries {
-			l = e.Size()
+	if m.RouteToDatabase != nil {
+		l = m.RouteToDatabase.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.DatabaseNames) > 0 {
+		for _, s := range m.DatabaseNames {
+			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if len(m.DatabaseUsers) > 0 {
+		for _, s := range m.DatabaseUsers {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
 	}
-	return n
-}
+	l = len(m.MFADeviceUUID)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ClientIP)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	if len(m.AWSRoleARNs) > 0 {
+		for _, s := range m.AWSRoleARNs {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.AccessRequests) > 0 {
+		for _, s := range m.AccessRequests {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.DisallowReissue {
+		n += 3
+	}
+	if len(m.AllowedResourceIDs) > 0 {
+		for _, e := range m.AllowedResourceIDs {
+			l = e.Size()
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.PreviousIdentityExpires)
+	n += 2 + l + sovEvents(uint64(l))
+	if len(m.AzureIdentities) > 0 {
+		for _, s := range m.AzureIdentities {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.GCPServiceAccounts) > 0 {
+		for _, s := range m.GCPServiceAccounts {
+			l = len(s)
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.PrivateKeyPolicy)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotName)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	if m.DeviceExtensions != nil {
+		l = m.DeviceExtensions.Size()
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotInstanceID)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	l = len(m.JoinToken)
+	if l > 0 {
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	if m.ScopePin != nil {
+		l = m.ScopePin.Size()
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
 
-func (m *ExternalAuditStorageEnable) Size() (n int) {
+func (m *ScopePin) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Details != nil {
-		l = m.Details.Size()
+	l = len(m.Scope)
+	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if len(m.Assignments) > 0 {
+		for k, v := range m.Assignments {
+			_ = k
+			_ = v
+			l = 0
+			if v != nil {
+				l = v.Size()
+				l += 1 + sovEvents(uint64(l))
+			}
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + l
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *ExternalAuditStorageDisable) Size() (n int) {
+func (m *ScopePinnedAssignments) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.Details != nil {
-		l = m.Details.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51080,47 +53762,46 @@ func (m *ExternalAuditStorageDisable) Size() (n int) {
 	return n
 }
 
-func (m *ExternalAuditStorageDetails) Size() (n int) {
+func (m *RouteToApp) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.IntegrationName)
+	l = len(m.Name)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.SessionRecordingsUri)
+	l = len(m.SessionID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AthenaWorkgroup)
+	l = len(m.PublicAddr)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.GlueDatabase)
+	l = len(m.ClusterName)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.GlueTable)
+	l = len(m.AWSRoleARN)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AuditEventsLongTermUri)
+	l = len(m.AzureIdentity)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AthenaResultsUri)
+	l = len(m.GCPServiceAccount)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.PolicyName)
+	l = len(m.URI)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Region)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.TargetPort != 0 {
+		n += 1 + sovEvents(uint64(m.TargetPort))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51128,36 +53809,33 @@ func (m *ExternalAuditStorageDetails) Size() (n int) {
 	return n
 }
 
-func (m *OktaAccessListSync) Size() (n int) {
+func (m *RouteToDatabase) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.NumAppFilters != 0 {
-		n += 1 + sovEvents(uint64(m.NumAppFilters))
-	}
-	if m.NumGroupFilters != 0 {
-		n += 1 + sovEvents(uint64(m.NumGroupFilters))
-	}
-	if m.NumApps != 0 {
-		n += 1 + sovEvents(uint64(m.NumApps))
+	l = len(m.ServiceName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.NumGroups != 0 {
-		n += 1 + sovEvents(uint64(m.NumGroups))
+	l = len(m.Protocol)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.NumRoles != 0 {
-		n += 1 + sovEvents(uint64(m.NumRoles))
+	l = len(m.Username)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.NumAccessLists != 0 {
-		n += 1 + sovEvents(uint64(m.NumAccessLists))
+	l = len(m.Database)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.NumAccessListMembers != 0 {
-		n += 1 + sovEvents(uint64(m.NumAccessListMembers))
+	if len(m.Roles) > 0 {
+		for _, s := range m.Roles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51165,35 +53843,23 @@ func (m *OktaAccessListSync) Size() (n int) {
 	return n
 }
 
-func (m *OktaUserSync) Size() (n int) {
+func (m *DeviceExtensions) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.OrgUrl)
+	l = len(m.DeviceId)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.AppId)
+	l = len(m.AssetTag)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.NumUsersCreated != 0 {
-		n += 1 + sovEvents(uint64(m.NumUsersCreated))
-	}
-	if m.NumUsersDeleted != 0 {
-		n += 1 + sovEvents(uint64(m.NumUsersDeleted))
-	}
-	if m.NumUsersModified != 0 {
-		n += 1 + sovEvents(uint64(m.NumUsersModified))
-	}
-	if m.NumUsersTotal != 0 {
-		n += 1 + sovEvents(uint64(m.NumUsersTotal))
+	l = len(m.CredentialId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51201,7 +53867,7 @@ func (m *OktaUserSync) Size() (n int) {
 	return n
 }
 
-func (m *SPIFFESVIDIssued) Size() (n int) {
+func (m *AccessRequestResourceSearch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51211,65 +53877,45 @@ func (m *SPIFFESVIDIssued) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.SPIFFEID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if len(m.DNSSANs) > 0 {
-		for _, s := range m.DNSSANs {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	if len(m.IPSANs) > 0 {
-		for _, s := range m.IPSANs {
+	if len(m.SearchAsRoles) > 0 {
+		for _, s := range m.SearchAsRoles {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.SVIDType)
+	l = len(m.ResourceType)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.SerialNumber)
+	l = len(m.Namespace)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Hint)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
-	l = len(m.JTI)
+	l = len(m.PredicateExpression)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.Audiences) > 0 {
-		for _, s := range m.Audiences {
+	if len(m.SearchKeywords) > 0 {
+		for _, s := range m.SearchKeywords {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = len(m.WorkloadIdentity)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.WorkloadIdentityRevision)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Attributes != nil {
-		l = m.Attributes.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AuthPreferenceUpdate) Size() (n int) {
+func (m *MySQLStatementPrepare) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51277,14 +53923,15 @@ func (m *AuthPreferenceUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.AdminActionsMFA != 0 {
-		n += 1 + sovEvents(uint64(m.AdminActionsMFA))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51292,7 +53939,7 @@ func (m *AuthPreferenceUpdate) Size() (n int) {
 	return n
 }
 
-func (m *ClusterNetworkingConfigUpdate) Size() (n int) {
+func (m *MySQLStatementExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51300,19 +53947,28 @@ func (m *ClusterNetworkingConfigUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
+	}
+	if len(m.Parameters) > 0 {
+		for _, s := range m.Parameters {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SessionRecordingConfigUpdate) Size() (n int) {
+func (m *MySQLStatementSendLongData) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51320,41 +53976,20 @@ func (m *SessionRecordingConfigUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *AccessPathChanged) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.ChangeID)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.AffectedResourceName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
 	}
-	l = len(m.AffectedResourceSource)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.ParameterID != 0 {
+		n += 1 + sovEvents(uint64(m.ParameterID))
 	}
-	l = len(m.AffectedResourceType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.DataSize != 0 {
+		n += 1 + sovEvents(uint64(m.DataSize))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51362,7 +53997,7 @@ func (m *AccessPathChanged) Size() (n int) {
 	return n
 }
 
-func (m *SpannerRPC) Size() (n int) {
+func (m *MySQLStatementClose) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51376,15 +54011,8 @@ func (m *SpannerRPC) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Procedure)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Args != nil {
-		l = m.Args.Size()
-		n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51392,7 +54020,7 @@ func (m *SpannerRPC) Size() (n int) {
 	return n
 }
 
-func (m *AccessGraphSettingsUpdate) Size() (n int) {
+func (m *MySQLStatementReset) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51400,19 +54028,22 @@ func (m *AccessGraphSettingsUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SPIFFEFederationCreate) Size() (n int) {
+func (m *MySQLStatementFetch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51420,19 +54051,25 @@ func (m *SPIFFEFederationCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
+	}
+	if m.RowsCount != 0 {
+		n += 1 + sovEvents(uint64(m.RowsCount))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SPIFFEFederationDelete) Size() (n int) {
+func (m *MySQLStatementBulkExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51440,19 +54077,28 @@ func (m *SPIFFEFederationDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.StatementID != 0 {
+		n += 1 + sovEvents(uint64(m.StatementID))
+	}
+	if len(m.Parameters) > 0 {
+		for _, s := range m.Parameters {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateConfigCreate) Size() (n int) {
+func (m *MySQLInitDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51460,21 +54106,23 @@ func (m *AutoUpdateConfigCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SchemaName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateConfigUpdate) Size() (n int) {
+func (m *MySQLCreateDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51482,21 +54130,23 @@ func (m *AutoUpdateConfigUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SchemaName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateConfigDelete) Size() (n int) {
+func (m *MySQLDropDB) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51504,21 +54154,23 @@ func (m *AutoUpdateConfigDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SchemaName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateVersionCreate) Size() (n int) {
+func (m *MySQLShutDown) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51526,13 +54178,11 @@ func (m *AutoUpdateVersionCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51540,7 +54190,7 @@ func (m *AutoUpdateVersionCreate) Size() (n int) {
 	return n
 }
 
-func (m *AutoUpdateVersionUpdate) Size() (n int) {
+func (m *MySQLProcessKill) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51548,21 +54198,22 @@ func (m *AutoUpdateVersionUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.ProcessID != 0 {
+		n += 1 + sovEvents(uint64(m.ProcessID))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateVersionDelete) Size() (n int) {
+func (m *MySQLDebug) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51570,13 +54221,11 @@ func (m *AutoUpdateVersionDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51584,7 +54233,7 @@ func (m *AutoUpdateVersionDelete) Size() (n int) {
 	return n
 }
 
-func (m *AutoUpdateAgentRolloutTrigger) Size() (n int) {
+func (m *MySQLRefresh) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51594,23 +54243,21 @@ func (m *AutoUpdateAgentRolloutTrigger) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Groups) > 0 {
-		for _, s := range m.Groups {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Subcommand)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateAgentRolloutForceDone) Size() (n int) {
+func (m *SQLServerRPCRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51620,23 +54267,27 @@ func (m *AutoUpdateAgentRolloutForceDone) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Groups) > 0 {
-		for _, s := range m.Groups {
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Procname)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Parameters) > 0 {
+		for _, s := range m.Parameters {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
 	}
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AutoUpdateAgentRolloutRollback) Size() (n int) {
+func (m *DatabaseSessionMalformedPacket) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51646,23 +54297,21 @@ func (m *AutoUpdateAgentRolloutRollback) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if len(m.Groups) > 0 {
-		for _, s := range m.Groups {
-			l = len(s)
-			n += 1 + l + sovEvents(uint64(l))
-		}
-	}
-	l = m.Status.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Payload)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *StaticHostUserCreate) Size() (n int) {
+func (m *ElasticsearchRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51670,21 +54319,51 @@ func (m *StaticHostUserCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.RawQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Body)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.Headers.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	if m.Category != 0 {
+		n += 1 + sovEvents(uint64(m.Category))
+	}
+	l = len(m.Target)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.StatusCode != 0 {
+		n += 1 + sovEvents(uint64(m.StatusCode))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *StaticHostUserUpdate) Size() (n int) {
+func (m *OpenSearchRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51692,69 +54371,51 @@ func (m *StaticHostUserUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *StaticHostUserDelete) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.RawQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *CrownJewelCreate) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Body)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.Headers.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.CrownJewelQuery)
+	if m.Category != 0 {
+		n += 1 + sovEvents(uint64(m.Category))
+	}
+	l = len(m.Target)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Query)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.StatusCode != 0 {
+		n += 1 + sovEvents(uint64(m.StatusCode))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *CrownJewelUpdate) Size() (n int) {
+func (m *DynamoDBRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51762,51 +54423,42 @@ func (m *CrownJewelUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.CurrentCrownJewelQuery)
+	if m.StatusCode != 0 {
+		n += 1 + sovEvents(uint64(m.StatusCode))
+	}
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.UpdatedCrownJewelQuery)
+	l = len(m.RawQuery)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *CrownJewelDelete) Size() (n int) {
-	if m == nil {
-		return 0
+	l = len(m.Target)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Body != nil {
+		l = m.Body.Size()
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserTaskCreate) Size() (n int) {
+func (m *AppSessionDynamoDBRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51814,69 +54466,52 @@ func (m *UserTaskCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.AppMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserTaskMetadata.Size()
+	l = m.AWSRequestMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	l = len(m.SessionChunkID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
-	return n
-}
-
-func (m *UserTaskUpdate) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.StatusCode != 0 {
+		n += 1 + sovEvents(uint64(m.StatusCode))
 	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserTaskMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.CurrentUserTaskState)
+	l = len(m.Path)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.UpdatedUserTaskState)
+	l = len(m.RawQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Target)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
+	if m.Body != nil {
+		l = m.Body.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *UserTaskMetadata) Size() (n int) {
+func (m *UpgradeWindowStartMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.TaskType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.IssueType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Integration)
+	l = len(m.UpgradeWindowStart)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -51886,7 +54521,7 @@ func (m *UserTaskMetadata) Size() (n int) {
 	return n
 }
 
-func (m *UserTaskDelete) Size() (n int) {
+func (m *UpgradeWindowStartUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51894,13 +54529,11 @@ func (m *UserTaskDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UpgradeWindowStartMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51908,7 +54541,7 @@ func (m *UserTaskDelete) Size() (n int) {
 	return n
 }
 
-func (m *ContactCreate) Size() (n int) {
+func (m *SessionRecordingAccess) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51916,20 +54549,19 @@ func (m *ContactCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SessionID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Email)
+	l = len(m.SessionType)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if m.ContactType != 0 {
-		n += 1 + sovEvents(uint64(m.ContactType))
+	l = len(m.Format)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51937,28 +54569,19 @@ func (m *ContactCreate) Size() (n int) {
 	return n
 }
 
-func (m *ContactDelete) Size() (n int) {
+func (m *KubeClusterMetadata) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Email)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.ContactType != 0 {
-		n += 1 + sovEvents(uint64(m.ContactType))
+	if len(m.KubeLabels) > 0 {
+		for k, v := range m.KubeLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovEvents(uint64(len(k))) + 1 + len(v) + sovEvents(uint64(len(v)))
+			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -51966,7 +54589,7 @@ func (m *ContactDelete) Size() (n int) {
 	return n
 }
 
-func (m *WorkloadIdentityCreate) Size() (n int) {
+func (m *KubernetesClusterCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51974,23 +54597,19 @@ func (m *WorkloadIdentityCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubeClusterMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.WorkloadIdentityData != nil {
-		l = m.WorkloadIdentityData.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *WorkloadIdentityUpdate) Size() (n int) {
+func (m *KubernetesClusterUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -51998,23 +54617,19 @@ func (m *WorkloadIdentityUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.KubeClusterMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.WorkloadIdentityData != nil {
-		l = m.WorkloadIdentityData.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *WorkloadIdentityDelete) Size() (n int) {
+func (m *KubernetesClusterDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52022,11 +54637,9 @@ func (m *WorkloadIdentityDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52034,7 +54647,7 @@ func (m *WorkloadIdentityDelete) Size() (n int) {
 	return n
 }
 
-func (m *WorkloadIdentityX509RevocationCreate) Size() (n int) {
+func (m *SSMRun) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52042,13 +54655,38 @@ func (m *WorkloadIdentityX509RevocationCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Reason)
+	l = len(m.CommandID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.InstanceID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ExitCode != 0 {
+		n += 1 + sovEvents(uint64(m.ExitCode))
+	}
+	l = len(m.Status)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AccountID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Region)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.StandardOutput)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.StandardError)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.InvocationURL)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -52058,7 +54696,7 @@ func (m *WorkloadIdentityX509RevocationCreate) Size() (n int) {
 	return n
 }
 
-func (m *WorkloadIdentityX509RevocationUpdate) Size() (n int) {
+func (m *CassandraPrepare) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52066,13 +54704,17 @@ func (m *WorkloadIdentityX509RevocationUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Reason)
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Keyspace)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
@@ -52082,7 +54724,7 @@ func (m *WorkloadIdentityX509RevocationUpdate) Size() (n int) {
 	return n
 }
 
-func (m *WorkloadIdentityX509RevocationDelete) Size() (n int) {
+func (m *CassandraExecute) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52090,19 +54732,23 @@ func (m *WorkloadIdentityX509RevocationDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.QueryId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *GitCommand) Size() (n int) {
+func (m *CassandraBatch) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52112,24 +54758,24 @@ func (m *GitCommand) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.SessionMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ServerMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.CommandMetadata.Size()
+	l = m.DatabaseMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.Service)
+	l = len(m.Consistency)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Path)
+	l = len(m.Keyspace)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.Actions) > 0 {
-		for _, e := range m.Actions {
+	l = len(m.BatchType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Children) > 0 {
+		for _, e := range m.Children {
 			l = e.Size()
 			n += 1 + l + sovEvents(uint64(l))
 		}
@@ -52140,27 +54786,25 @@ func (m *GitCommand) Size() (n int) {
 	return n
 }
 
-func (m *GitCommandAction) Size() (n int) {
+func (m *CassandraBatch_BatchChild) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Action)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Reference)
+	l = len(m.ID)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.Old)
+	l = len(m.Query)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	l = len(m.New)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if len(m.Values) > 0 {
+		for _, e := range m.Values {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52168,22 +54812,41 @@ func (m *GitCommandAction) Size() (n int) {
 	return n
 }
 
-func (m *AccessListInvalidMetadata) Size() (n int) {
+func (m *CassandraBatch_BatchChild_Value) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.AccessListName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
+	if m.Type != 0 {
+		n += 1 + sovEvents(uint64(m.Type))
 	}
-	l = len(m.User)
+	l = len(m.Contents)
 	if l > 0 {
 		n += 1 + l + sovEvents(uint64(l))
 	}
-	if len(m.MissingRoles) > 0 {
-		for _, s := range m.MissingRoles {
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *CassandraRegister) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.EventTypes) > 0 {
+		for _, s := range m.EventTypes {
 			l = len(s)
 			n += 1 + l + sovEvents(uint64(l))
 		}
@@ -52194,7 +54857,7 @@ func (m *AccessListInvalidMetadata) Size() (n int) {
 	return n
 }
 
-func (m *UserLoginAccessListInvalid) Size() (n int) {
+func (m *LoginRuleCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52202,9 +54865,9 @@ func (m *UserLoginAccessListInvalid) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.AccessListInvalidMetadata.Size()
+	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.Status.Size()
+	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52212,7 +54875,7 @@ func (m *UserLoginAccessListInvalid) Size() (n int) {
 	return n
 }
 
-func (m *StableUNIXUserCreate) Size() (n int) {
+func (m *LoginRuleDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52220,38 +54883,39 @@ func (m *StableUNIXUserCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	l = m.UserMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.StableUnixUser != nil {
-		l = m.StableUnixUser.Size()
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *StableUNIXUser) Size() (n int) {
+func (m *SAMLIdPAuthAttempt) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Username)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.Uid != 0 {
-		n += 1 + sovEvents(uint64(m.Uid))
-	}
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SAMLIdPServiceProviderMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *AWSICResourceSync) Size() (n int) {
+func (m *SAMLIdPServiceProviderCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52259,19 +54923,9 @@ func (m *AWSICResourceSync) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	if m.TotalAccounts != 0 {
-		n += 1 + sovEvents(uint64(m.TotalAccounts))
-	}
-	if m.TotalAccountAssignments != 0 {
-		n += 1 + sovEvents(uint64(m.TotalAccountAssignments))
-	}
-	if m.TotalUserGroups != 0 {
-		n += 1 + sovEvents(uint64(m.TotalUserGroups))
-	}
-	if m.TotalPermissionSets != 0 {
-		n += 1 + sovEvents(uint64(m.TotalPermissionSets))
-	}
-	l = m.Status.Size()
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SAMLIdPServiceProviderMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52279,7 +54933,7 @@ func (m *AWSICResourceSync) Size() (n int) {
 	return n
 }
 
-func (m *HealthCheckConfigCreate) Size() (n int) {
+func (m *SAMLIdPServiceProviderUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52289,9 +54943,7 @@ func (m *HealthCheckConfigCreate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SAMLIdPServiceProviderMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52299,7 +54951,7 @@ func (m *HealthCheckConfigCreate) Size() (n int) {
 	return n
 }
 
-func (m *HealthCheckConfigUpdate) Size() (n int) {
+func (m *SAMLIdPServiceProviderDelete) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52309,9 +54961,7 @@ func (m *HealthCheckConfigUpdate) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.SAMLIdPServiceProviderMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52319,7 +54969,7 @@ func (m *HealthCheckConfigUpdate) Size() (n int) {
 	return n
 }
 
-func (m *HealthCheckConfigDelete) Size() (n int) {
+func (m *SAMLIdPServiceProviderDeleteAll) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52329,17 +54979,13 @@ func (m *HealthCheckConfigDelete) Size() (n int) {
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
+func (m *OktaResourcesUpdate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52347,11 +54993,9 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.OktaResourcesUpdatedMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52359,7 +55003,7 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
 	return n
 }
 
-func (m *WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
+func (m *OktaSyncFailure) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52367,11 +55011,9 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
+	l = m.Status.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -52379,7 +55021,7 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
 	return n
 }
 
-func (m *SigstorePolicyCreate) Size() (n int) {
+func (m *OktaAssignmentResult) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52387,19 +55029,21 @@ func (m *SigstorePolicyCreate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
+	l = m.ServerMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.OktaAssignmentMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
-func (m *SigstorePolicyUpdate) Size() (n int) {
+func (m *AccessListCreate) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -52407,45 +55051,8204 @@ func (m *SigstorePolicyUpdate) Size() (n int) {
 	_ = l
 	l = m.Metadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
 	l = m.ResourceMetadata.Size()
 	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.AccessListTitle)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
-	return n
-}
+	return n
+}
+
+func (m *AccessListUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.AccessListTitle)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.AccessListTitle)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListMemberCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListMemberMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListMemberUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListMemberMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListMemberDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListMemberMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListMemberDeleteAllForAccessList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListMemberMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListReview) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListReviewMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AuditQueryRun) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AuditQueryDetails.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AuditQueryDetails) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Query)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Days != 0 {
+		n += 1 + sovEvents(uint64(m.Days))
+	}
+	if m.ExecutionTimeInMillis != 0 {
+		n += 1 + sovEvents(uint64(m.ExecutionTimeInMillis))
+	}
+	if m.DataScannedInBytes != 0 {
+		n += 1 + sovEvents(uint64(m.DataScannedInBytes))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SecurityReportRun) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.TotalExecutionTimeInMillis != 0 {
+		n += 1 + sovEvents(uint64(m.TotalExecutionTimeInMillis))
+	}
+	if m.TotalDataScannedInBytes != 0 {
+		n += 1 + sovEvents(uint64(m.TotalDataScannedInBytes))
+	}
+	if len(m.AuditQueries) > 0 {
+		for _, e := range m.AuditQueries {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ExternalAuditStorageEnable) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.Details != nil {
+		l = m.Details.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ExternalAuditStorageDisable) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.Details != nil {
+		l = m.Details.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ExternalAuditStorageDetails) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.IntegrationName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.SessionRecordingsUri)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AthenaWorkgroup)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.GlueDatabase)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.GlueTable)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AuditEventsLongTermUri)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AthenaResultsUri)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PolicyName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Region)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *OktaAccessListSync) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.NumAppFilters != 0 {
+		n += 1 + sovEvents(uint64(m.NumAppFilters))
+	}
+	if m.NumGroupFilters != 0 {
+		n += 1 + sovEvents(uint64(m.NumGroupFilters))
+	}
+	if m.NumApps != 0 {
+		n += 1 + sovEvents(uint64(m.NumApps))
+	}
+	if m.NumGroups != 0 {
+		n += 1 + sovEvents(uint64(m.NumGroups))
+	}
+	if m.NumRoles != 0 {
+		n += 1 + sovEvents(uint64(m.NumRoles))
+	}
+	if m.NumAccessLists != 0 {
+		n += 1 + sovEvents(uint64(m.NumAccessLists))
+	}
+	if m.NumAccessListMembers != 0 {
+		n += 1 + sovEvents(uint64(m.NumAccessListMembers))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *OktaUserSync) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.OrgUrl)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AppId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.NumUsersCreated != 0 {
+		n += 1 + sovEvents(uint64(m.NumUsersCreated))
+	}
+	if m.NumUsersDeleted != 0 {
+		n += 1 + sovEvents(uint64(m.NumUsersDeleted))
+	}
+	if m.NumUsersModified != 0 {
+		n += 1 + sovEvents(uint64(m.NumUsersModified))
+	}
+	if m.NumUsersTotal != 0 {
+		n += 1 + sovEvents(uint64(m.NumUsersTotal))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LabelSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Values) > 0 {
+		for _, s := range m.Values {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SPIFFESVIDIssued) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.SPIFFEID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.DNSSANs) > 0 {
+		for _, s := range m.DNSSANs {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if len(m.IPSANs) > 0 {
+		for _, s := range m.IPSANs {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.SVIDType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.SerialNumber)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Hint)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.JTI)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Audiences) > 0 {
+		for _, s := range m.Audiences {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = len(m.WorkloadIdentity)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.WorkloadIdentityRevision)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Attributes != nil {
+		l = m.Attributes.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.NameSelector)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.LabelSelectors) > 0 {
+		for _, e := range m.LabelSelectors {
+			l = e.Size()
+			n += 2 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AuthPreferenceUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.AdminActionsMFA != 0 {
+		n += 1 + sovEvents(uint64(m.AdminActionsMFA))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ClusterNetworkingConfigUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SessionRecordingConfigUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessPathChanged) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.ChangeID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AffectedResourceName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AffectedResourceSource)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.AffectedResourceType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SpannerRPC) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.DatabaseMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Procedure)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Args != nil {
+		l = m.Args.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessGraphSettingsUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SPIFFEFederationCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SPIFFEFederationDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateConfigCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateConfigUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateConfigDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateVersionCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateVersionUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateVersionDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateAgentRolloutTrigger) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateAgentRolloutForceDone) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AutoUpdateAgentRolloutRollback) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *StaticHostUserCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *StaticHostUserUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *StaticHostUserDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *CrownJewelCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.CrownJewelQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *CrownJewelUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.CurrentCrownJewelQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UpdatedCrownJewelQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *CrownJewelDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserTaskCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserTaskMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserTaskUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserTaskMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.CurrentUserTaskState)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UpdatedUserTaskState)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserTaskMetadata) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.TaskType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.IssueType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Integration)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserTaskDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ContactCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Email)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ContactType != 0 {
+		n += 1 + sovEvents(uint64(m.ContactType))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ContactDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Email)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.ContactType != 0 {
+		n += 1 + sovEvents(uint64(m.ContactType))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.WorkloadIdentityData != nil {
+		l = m.WorkloadIdentityData.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.WorkloadIdentityData != nil {
+		l = m.WorkloadIdentityData.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityX509RevocationCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityX509RevocationUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityX509RevocationDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *GitCommand) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.CommandMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Service)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.Actions) > 0 {
+		for _, e := range m.Actions {
+			l = e.Size()
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *GitCommandAction) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Action)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Reference)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Old)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.New)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AccessListInvalidMetadata) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.AccessListName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.User)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if len(m.MissingRoles) > 0 {
+		for _, s := range m.MissingRoles {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserLoginAccessListInvalid) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AccessListInvalidMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *StableUNIXUserCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.StableUnixUser != nil {
+		l = m.StableUnixUser.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *StableUNIXUser) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Username)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Uid != 0 {
+		n += 1 + sovEvents(uint64(m.Uid))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSICResourceSync) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.TotalAccounts != 0 {
+		n += 1 + sovEvents(uint64(m.TotalAccounts))
+	}
+	if m.TotalAccountAssignments != 0 {
+		n += 1 + sovEvents(uint64(m.TotalAccountAssignments))
+	}
+	if m.TotalUserGroups != 0 {
+		n += 1 + sovEvents(uint64(m.TotalUserGroups))
+	}
+	if m.TotalPermissionSets != 0 {
+		n += 1 + sovEvents(uint64(m.TotalPermissionSets))
+	}
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *HealthCheckConfigCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *HealthCheckConfigUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *HealthCheckConfigDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityX509IssuerOverrideCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *WorkloadIdentityX509IssuerOverrideDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SigstorePolicyCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SigstorePolicyUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SigstorePolicyDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionStart) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.McpSessionId)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ClientInfo)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ServerInfo)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ProtocolVersion)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.IngressAuthType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.EgressAuthType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionEnd) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ServerMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Headers.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPJSONRPCMessage) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.JSONRPC)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Params != nil {
+		l = m.Params.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Message.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Headers.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionNotification) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Message.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Headers.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionListenSSEStream) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Headers.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCPSessionInvalidHTTPRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SessionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.AppMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.RawQuery)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Body)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = m.Headers.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *BoundKeypairRecovery) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.TokenName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.RecoveryCount != 0 {
+		n += 1 + sovEvents(uint64(m.RecoveryCount))
+	}
+	l = len(m.RecoveryMode)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *BoundKeypairRotation) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.TokenName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.PreviousPublicKey)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.NewPublicKey)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *BoundKeypairJoinStateVerificationFailed) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.TokenName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.BotName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SCIMRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.SourceAddress)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UserAgent)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Method)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Body != nil {
+		l = m.Body.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SCIMCommonData) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Request != nil {
+		l = m.Request.Size()
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Integration)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ResourceType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SCIMListingEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SCIMCommonData.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.Filter)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.Count != 0 {
+		n += 1 + sovEvents(uint64(m.Count))
+	}
+	if m.StartIndex != 0 {
+		n += 1 + sovEvents(uint64(m.StartIndex))
+	}
+	if m.ResourceCount != 0 {
+		n += 1 + sovEvents(uint64(m.ResourceCount))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SCIMResourceEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.SCIMCommonData.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.TeleportID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.ExternalID)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Display)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ClientIPRestrictionsUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ResourceMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if len(m.ClientIPRestrictions) > 0 {
+		for _, s := range m.ClientIPRestrictions {
+			l = len(s)
+			n += 1 + l + sovEvents(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *VnetConfigCreate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *VnetConfigUpdate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *VnetConfigDelete) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.UserMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = m.ConnectionMetadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func sovEvents(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozEvents(x uint64) (n int) {
+	return sovEvents(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *Metadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Metadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Metadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Index", wireType)
+			}
+			m.Index = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Index |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Code = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Time", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Time, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WithMFA", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WithMFA = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UserMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UserMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UserMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.User = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Login", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Login = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Impersonator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Impersonator = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARN", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AWSRoleARN = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessRequests = append(m.AccessRequests, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentity", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AzureIdentity = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccount", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GCPServiceAccount = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustedDevice", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TrustedDevice == nil {
+				m.TrustedDevice = &DeviceMetadata{}
+			}
+			if err := m.TrustedDevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequiredPrivateKeyPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequiredPrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserKind", wireType)
+			}
+			m.UserKind = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.UserKind |= UserKind(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BotName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserOrigin", wireType)
+			}
+			m.UserOrigin = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.UserOrigin |= UserOrigin(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserRoles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserRoles = append(m.UserRoles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTraits", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserTraits.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 16:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserClusterName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserClusterName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ServerMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ServerMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerNamespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerNamespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerHostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerHostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ServerLabels == nil {
+				m.ServerLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.ServerLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ForwardedBy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ForwardedBy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerSubKind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerSubKind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ConnectionMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ConnectionMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LocalAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LocalAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemoteAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RemoteAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Protocol", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Protocol = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClientMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClientMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClientMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserAgent", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserAgent = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesClusterMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesClusterMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesCluster", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesCluster = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesUsers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesUsers = append(m.KubernetesUsers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesGroups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesGroups = append(m.KubernetesGroups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.KubernetesLabels == nil {
+				m.KubernetesLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.KubernetesLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesPodMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesPodMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesPodName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodNamespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesPodNamespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesContainerName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesContainerName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesContainerImage", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesContainerImage = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesNodeName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesNodeName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviderEntityID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceProviderEntityID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviderShortcut", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceProviderShortcut = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AttributeMapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AttributeMapping == nil {
+				m.AttributeMapping = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.AttributeMapping[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaResourcesUpdatedMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaResourcesUpdatedMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Added", wireType)
+			}
+			m.Added = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Added |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Updated", wireType)
+			}
+			m.Updated = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Updated |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Deleted", wireType)
+			}
+			m.Deleted = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Deleted |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AddedResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AddedResources = append(m.AddedResources, &OktaResource{})
+			if err := m.AddedResources[len(m.AddedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UpdatedResources = append(m.UpdatedResources, &OktaResource{})
+			if err := m.UpdatedResources[len(m.UpdatedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeletedResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DeletedResources = append(m.DeletedResources, &OktaResource{})
+			if err := m.DeletedResources[len(m.DeletedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaAssignmentMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaAssignmentMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Source", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Source = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.User = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartingStatus", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StartingStatus = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EndingStatus", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EndingStatus = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessListMemberMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessListMemberMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessListName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Members", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Members = append(m.Members, &AccessListMember{})
+			if err := m.Members[len(m.Members)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessListMember) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessListMember: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessListMember: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinedOn", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.JoinedOn, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemovedOn", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.RemovedOn, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MemberName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MemberName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MembershipKind", wireType)
+			}
+			m.MembershipKind = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MembershipKind |= v1.MembershipKind(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessListReviewMembershipRequirementsChanged) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessListReviewMembershipRequirementsChanged: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessListReviewMembershipRequirementsChanged: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Traits", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Traits == nil {
+				m.Traits = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Traits[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessListReviewMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessListReviewMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReviewID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReviewID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MembershipRequirementsChanged", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MembershipRequirementsChanged == nil {
+				m.MembershipRequirementsChanged = &AccessListReviewMembershipRequirementsChanged{}
+			}
+			if err := m.MembershipRequirementsChanged.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReviewFrequencyChanged", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReviewFrequencyChanged = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReviewDayOfMonthChanged", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReviewDayOfMonthChanged = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemovedMembers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RemovedMembers = append(m.RemovedMembers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LockMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LockMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LockMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionStart) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionStart: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TerminalSize", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TerminalSize = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InitialCommand", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InitialCommand = append(m.InitialCommand, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecording", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionRecording = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Invited", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Invited = append(m.Invited, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionJoin) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionJoin: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionJoin: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionPrint) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionPrint: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionPrint: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ChunkIndex", wireType)
+			}
+			m.ChunkIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ChunkIndex |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Bytes", wireType)
+			}
+			m.Bytes = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Bytes |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DelayMilliseconds", wireType)
+			}
+			m.DelayMilliseconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DelayMilliseconds |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			}
+			m.Offset = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Offset |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DesktopRecording) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DesktopRecording: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DesktopRecording: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = append(m.Message[:0], dAtA[iNdEx:postIndex]...)
+			if m.Message == nil {
+				m.Message = []byte{}
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DelayMilliseconds", wireType)
+			}
+			m.DelayMilliseconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DelayMilliseconds |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DesktopClipboardReceive: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DesktopClipboardReceive: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+			}
+			m.Length = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Length |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DesktopClipboardSend: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DesktopClipboardSend: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+			}
+			m.Length = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Length |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DesktopSharedDirectoryStart: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DesktopSharedDirectoryStart: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DirectoryName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
+			}
+			m.DirectoryID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DirectoryID |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DesktopSharedDirectoryRead: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DesktopSharedDirectoryRead: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DirectoryName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
+			}
+			m.DirectoryID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DirectoryID |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+			}
+			m.Length = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Length |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			}
+			m.Offset = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Offset |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
 
-func (m *SigstorePolicyDelete) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.UserMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ConnectionMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = m.ResourceMetadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
 	}
-	return n
-}
-
-func sovEvents(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozEvents(x uint64) (n int) {
-	return sovEvents(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+	return nil
 }
-func (m *Metadata) Unmarshal(dAtA []byte) error {
+func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52468,17 +63271,17 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Metadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: DesktopSharedDirectoryWrite: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Metadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DesktopSharedDirectoryWrite: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Index", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			m.Index = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52488,14 +63291,160 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Index |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52523,11 +63472,11 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Type = string(dAtA[iNdEx:postIndex])
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52555,13 +63504,251 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ID = string(dAtA[iNdEx:postIndex])
+			m.DirectoryName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
+			}
+			m.DirectoryID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DirectoryID |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+			}
+			m.Length = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Length |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			}
+			m.Offset = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Offset |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionReject) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionReject: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionReject: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52571,27 +63758,28 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Code = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Time", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -52618,13 +63806,13 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Time, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52652,8 +63840,27 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			m.Reason = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Maximum", wireType)
+			}
+			m.Maximum = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Maximum |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -52676,7 +63883,7 @@ func (m *Metadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
+func (m *SessionConnect) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52699,17 +63906,17 @@ func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionConnect: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionConnect: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52719,29 +63926,30 @@ func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WithMFA", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52751,29 +63959,30 @@ func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WithMFA = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52783,23 +63992,24 @@ func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -52823,7 +64033,7 @@ func (m *SessionMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserMetadata) Unmarshal(dAtA []byte) error {
+func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -52846,17 +64056,17 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: FileTransferRequestEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: FileTransferRequestEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52866,29 +64076,30 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.User = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Login", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -52898,27 +64109,28 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Login = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Impersonator", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52946,11 +64158,11 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Impersonator = string(dAtA[iNdEx:postIndex])
+			m.RequestID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARN", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Approvers", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -52978,11 +64190,11 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSRoleARN = string(dAtA[iNdEx:postIndex])
+			m.Approvers = append(m.Approvers, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requester", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53010,11 +64222,11 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessRequests = append(m.AccessRequests, string(dAtA[iNdEx:postIndex]))
+			m.Requester = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Location", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53042,132 +64254,13 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AzureIdentity = string(dAtA[iNdEx:postIndex])
+			m.Location = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccount", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.GCPServiceAccount = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TrustedDevice", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.TrustedDevice == nil {
-				m.TrustedDevice = &DeviceMetadata{}
-			}
-			if err := m.TrustedDevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequiredPrivateKeyPolicy", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.RequiredPrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 10:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserKind", wireType)
-			}
-			m.UserKind = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.UserKind |= UserKind(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Download", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53177,27 +64270,15 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.BotName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 12:
+			m.Download = bool(v != 0)
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Filename", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53225,27 +64306,8 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
+			m.Filename = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 13:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserOrigin", wireType)
-			}
-			m.UserOrigin = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.UserOrigin |= UserOrigin(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -53268,7 +64330,7 @@ func (m *UserMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
+func (m *Resize) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -53291,17 +64353,17 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ServerMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: Resize: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ServerMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Resize: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerNamespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53311,29 +64373,30 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerNamespace = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53343,29 +64406,30 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerID = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerHostname", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53375,29 +64439,30 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerHostname = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53407,27 +64472,28 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -53454,107 +64520,13 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ServerLabels == nil {
-				m.ServerLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.ServerLabels[mapkey] = mapvalue
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ForwardedBy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TerminalSize", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53582,13 +64554,13 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ForwardedBy = string(dAtA[iNdEx:postIndex])
+			m.TerminalSize = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerSubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53598,29 +64570,30 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerSubKind = string(dAtA[iNdEx:postIndex])
+			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerVersion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53630,23 +64603,24 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServerVersion = string(dAtA[iNdEx:postIndex])
+			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -53670,7 +64644,7 @@ func (m *ServerMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
+func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -53693,17 +64667,17 @@ func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ConnectionMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionEnd: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ConnectionMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LocalAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53713,29 +64687,30 @@ func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.LocalAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RemoteAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53745,29 +64720,30 @@ func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RemoteAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Protocol", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53777,80 +64753,63 @@ func (m *ConnectionMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Protocol = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ClientMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ClientMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ClientMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserAgent", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53860,78 +64819,68 @@ func (m *ClientMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UserAgent = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnhancedRecording", wireType)
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			m.EnhancedRecording = bool(v != 0)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Interactive", wireType)
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesClusterMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesClusterMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Interactive = bool(v != 0)
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesCluster", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Participants", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -53959,13 +64908,13 @@ func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesCluster = string(dAtA[iNdEx:postIndex])
+			m.Participants = append(m.Participants, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesUsers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -53975,29 +64924,30 @@ func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesUsers = append(m.KubernetesUsers, string(dAtA[iNdEx:postIndex]))
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesGroups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54007,27 +64957,28 @@ func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesGroups = append(m.KubernetesGroups, string(dAtA[iNdEx:postIndex]))
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 4:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54054,160 +65005,15 @@ func (m *KubernetesClusterMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.KubernetesLabels == nil {
-				m.KubernetesLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.KubernetesLabels[mapkey] = mapvalue
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesPodMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesPodMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54217,27 +65023,28 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesPodName = string(dAtA[iNdEx:postIndex])
+			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodNamespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InitialCommand", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54265,11 +65072,11 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesPodNamespace = string(dAtA[iNdEx:postIndex])
+			m.InitialCommand = append(m.InitialCommand, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 3:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesContainerName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecording", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54297,13 +65104,83 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesContainerName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesContainerImage", wireType)
+			m.SessionRecording = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BPFMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BPFMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BPFMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PID", wireType)
+			}
+			m.PID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PID |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupID", wireType)
 			}
-			var stringLen uint64
+			m.CgroupID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54313,27 +65190,14 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.CgroupID |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.KubernetesContainerImage = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesNodeName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Program", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54361,7 +65225,7 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesNodeName = string(dAtA[iNdEx:postIndex])
+			m.Program = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54385,7 +65249,7 @@ func (m *KubernetesPodMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
+func (m *Status) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54408,17 +65272,17 @@ func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: Status: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Status: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviderEntityID", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Success", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54428,27 +65292,15 @@ func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ServiceProviderEntityID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
+			m.Success = bool(v != 0)
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceProviderShortcut", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -54476,13 +65328,13 @@ func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServiceProviderShortcut = string(dAtA[iNdEx:postIndex])
+			m.Error = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AttributeMapping", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMessage", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54492,118 +65344,23 @@ func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AttributeMapping == nil {
-				m.AttributeMapping = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.AttributeMapping[mapkey] = mapvalue
+			m.UserMessage = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -54627,7 +65384,7 @@ func (m *SAMLIdPServiceProviderMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
+func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54650,17 +65407,17 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaResourcesUpdatedMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionCommand: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaResourcesUpdatedMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionCommand: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Added", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			m.Added = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54670,16 +65427,30 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Added |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Updated", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			m.Updated = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54689,16 +65460,30 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Updated |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Deleted", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			m.Deleted = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54708,14 +65493,28 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Deleted |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AddedResources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54742,14 +65541,13 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AddedResources = append(m.AddedResources, &OktaResource{})
-			if err := m.AddedResources[len(m.AddedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedResources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -54776,16 +65574,34 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpdatedResources = append(m.UpdatedResources, &OktaResource{})
-			if err := m.UpdatedResources[len(m.UpdatedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PPID", wireType)
+			}
+			m.PPID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PPID |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeletedResources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54795,26 +65611,75 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeletedResources = append(m.DeletedResources, &OktaResource{})
-			if err := m.DeletedResources[len(m.DeletedResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Argv", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.Argv = append(m.Argv, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReturnCode", wireType)
+			}
+			m.ReturnCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ReturnCode |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -54837,7 +65702,7 @@ func (m *OktaResourcesUpdatedMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaResource) Unmarshal(dAtA []byte) error {
+func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -54860,17 +65725,17 @@ func (m *OktaResource) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaResource: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionDisk: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaResource: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionDisk: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54880,29 +65745,30 @@ func (m *OktaResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ID = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54912,80 +65778,63 @@ func (m *OktaResource) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Description = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OktaAssignmentMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaAssignmentMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Source", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -54995,29 +65844,30 @@ func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Source = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55027,27 +65877,28 @@ func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.User = string(dAtA[iNdEx:postIndex])
+			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartingStatus", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55075,13 +65926,32 @@ func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StartingStatus = string(dAtA[iNdEx:postIndex])
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EndingStatus", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Flags", wireType)
 			}
-			var stringLen uint64
+			m.Flags = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Flags |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReturnCode", wireType)
+			}
+			m.ReturnCode = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55091,24 +65961,11 @@ func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.ReturnCode |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.EndingStatus = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -55131,7 +65988,7 @@ func (m *OktaAssignmentMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
+func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55154,17 +66011,17 @@ func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMemberMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionNetwork: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMemberMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionNetwork: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55174,27 +66031,28 @@ func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListName = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Members", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55221,16 +66079,15 @@ func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Members = append(m.Members, &AccessListMember{})
-			if err := m.Members[len(m.Members)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55240,78 +66097,28 @@ func (m *AccessListMemberMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AccessListMember) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMember: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMember: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JoinedOn", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55338,13 +66145,13 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.JoinedOn, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RemovedOn", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55371,13 +66178,13 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.RemovedOn, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SrcAddr", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55405,11 +66212,11 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
+			m.SrcAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MemberName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DstAddr", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -55437,13 +66244,13 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.MemberName = string(dAtA[iNdEx:postIndex])
+			m.DstAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 8:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MembershipKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DstPort", wireType)
 			}
-			m.MembershipKind = 0
+			m.DstPort = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55453,7 +66260,64 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.MembershipKind |= v1.MembershipKind(b&0x7F) << shift
+				m.DstPort |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TCPVersion", wireType)
+			}
+			m.TCPVersion = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TCPVersion |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
+			}
+			m.Operation = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Operation |= SessionNetwork_NetworkOperation(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+			}
+			m.Action = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Action |= EventAction(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -55480,7 +66344,7 @@ func (m *AccessListMember) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListReviewMembershipRequirementsChanged) Unmarshal(dAtA []byte) error {
+func (m *SessionData) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -55503,17 +66367,17 @@ func (m *AccessListReviewMembershipRequirementsChanged) Unmarshal(dAtA []byte) e
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListReviewMembershipRequirementsChanged: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionData: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListReviewMembershipRequirementsChanged: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionData: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55523,27 +66387,28 @@ func (m *AccessListReviewMembershipRequirementsChanged) Unmarshal(dAtA []byte) e
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Traits", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55570,160 +66435,15 @@ func (m *AccessListReviewMembershipRequirementsChanged) Unmarshal(dAtA []byte) e
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Traits == nil {
-				m.Traits = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.Traits[mapkey] = mapvalue
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListReviewMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListReviewMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55733,29 +66453,30 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Message = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReviewID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55765,27 +66486,28 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ReviewID = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MembershipRequirementsChanged", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -55812,18 +66534,104 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MembershipRequirementsChanged == nil {
-				m.MembershipRequirementsChanged = &AccessListReviewMembershipRequirementsChanged{}
-			}
-			if err := m.MembershipRequirementsChanged.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesTransmitted", wireType)
+			}
+			m.BytesTransmitted = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.BytesTransmitted |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesReceived", wireType)
+			}
+			m.BytesReceived = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.BytesReceived |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionLeave) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionLeave: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionLeave: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReviewFrequencyChanged", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55833,29 +66641,30 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ReviewFrequencyChanged = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReviewDayOfMonthChanged", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55865,29 +66674,30 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ReviewDayOfMonthChanged = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RemovedMembers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55897,29 +66707,30 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RemovedMembers = append(m.RemovedMembers, string(dAtA[iNdEx:postIndex]))
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -55929,78 +66740,28 @@ func (m *AccessListReviewMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *LockMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: LockMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: LockMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 4:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56027,7 +66788,7 @@ func (m *LockMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -56053,7 +66814,7 @@ func (m *LockMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionStart) Unmarshal(dAtA []byte) error {
+func (m *UserLogin) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56076,10 +66837,10 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionStart: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserLogin: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserLogin: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56150,7 +66911,7 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56177,15 +66938,15 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56195,28 +66956,27 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IdentityAttributes", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56243,15 +67003,18 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.IdentityAttributes == nil {
+				m.IdentityAttributes = &Struct{}
+			}
+			if err := m.IdentityAttributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TerminalSize", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADevice", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56261,27 +67024,31 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TerminalSize = string(dAtA[iNdEx:postIndex])
+			if m.MFADevice == nil {
+				m.MFADevice = &MFADeviceMetadata{}
+			}
+			if err := m.MFADevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56308,13 +67075,13 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56341,13 +67108,13 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InitialCommand", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppliedLoginRules", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -56375,11 +67142,11 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InitialCommand = append(m.InitialCommand, string(dAtA[iNdEx:postIndex]))
+			m.AppliedLoginRules = append(m.AppliedLoginRules, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecording", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -56407,13 +67174,64 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionRecording = string(dAtA[iNdEx:postIndex])
+			m.ConnectorID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 12:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateMFAAuthChallenge: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateMFAAuthChallenge: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Invited", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56423,27 +67241,61 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Invited = append(m.Invited, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 13:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeScope", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -56471,8 +67323,28 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
+			m.ChallengeScope = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeAllowReuse", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ChallengeAllowReuse = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -56495,7 +67367,7 @@ func (m *SessionStart) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionJoin) Unmarshal(dAtA []byte) error {
+func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56518,10 +67390,10 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionJoin: wiretype end group for non-group")
+			return fmt.Errorf("proto: ValidateMFAAuthResponse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionJoin: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ValidateMFAAuthResponse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56592,7 +67464,7 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56619,13 +67491,13 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADevice", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56652,15 +67524,18 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.MFADevice == nil {
+				m.MFADevice = &MFADeviceMetadata{}
+			}
+			if err := m.MFADevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeScope", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56670,28 +67545,130 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.ChallengeScope = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeAllowReuse", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ChallengeAllowReuse = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResourceMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResourceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56718,10 +67695,74 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Expires, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedBy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UpdatedBy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TTL", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TTL = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -56744,7 +67785,7 @@ func (m *SessionJoin) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionPrint) Unmarshal(dAtA []byte) error {
+func (m *UserCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56767,10 +67808,10 @@ func (m *SessionPrint) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionPrint: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionPrint: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56807,29 +67848,10 @@ func (m *SessionPrint) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChunkIndex", wireType)
-			}
-			m.ChunkIndex = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.ChunkIndex |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56839,31 +67861,30 @@ func (m *SessionPrint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
-			if m.Data == nil {
-				m.Data = []byte{}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Bytes", wireType)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			m.Bytes = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56873,35 +67894,30 @@ func (m *SessionPrint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Bytes |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DelayMilliseconds", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.DelayMilliseconds = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DelayMilliseconds |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-			m.Offset = 0
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+			}
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56911,67 +67927,29 @@ func (m *SessionPrint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Offset |= int64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DesktopRecording) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopRecording: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopRecording: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -56981,30 +67959,29 @@ func (m *DesktopRecording) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Connector = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57014,45 +67991,25 @@ func (m *DesktopRecording) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Message = append(m.Message[:0], dAtA[iNdEx:postIndex]...)
-			if m.Message == nil {
-				m.Message = []byte{}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DelayMilliseconds", wireType)
-			}
-			m.DelayMilliseconds = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DelayMilliseconds |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -57075,7 +68032,7 @@ func (m *DesktopRecording) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
+func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57098,10 +68055,10 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopClipboardReceive: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopClipboardReceive: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -57172,7 +68129,7 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57199,15 +68156,15 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57217,28 +68174,27 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57266,13 +68222,13 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			m.Connector = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.Length = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57282,11 +68238,25 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Length |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -57309,7 +68279,7 @@ func (m *DesktopClipboardReceive) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
+func (m *UserDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57332,10 +68302,10 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopClipboardSend: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopClipboardSend: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -57406,7 +68376,40 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57433,13 +68436,64 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UserPasswordChange: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UserPasswordChange: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57466,15 +68520,15 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57484,29 +68538,30 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.Length = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57516,11 +68571,25 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Length |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -57543,7 +68612,7 @@ func (m *DesktopClipboardSend) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
+func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -57566,10 +68635,10 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryStart: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessRequestCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryStart: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessRequestCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -57640,7 +68709,7 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57667,15 +68736,15 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57685,30 +68754,29 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57718,28 +68786,27 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.RequestID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestState", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57767,11 +68834,11 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			m.RequestState = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Delegator", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -57799,13 +68866,13 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DirectoryName = string(dAtA[iNdEx:postIndex])
+			m.Delegator = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
-			m.DirectoryID = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57815,65 +68882,27 @@ func (m *DesktopSharedDirectoryStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DirectoryID |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryRead: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryRead: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Annotations", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57900,15 +68929,18 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Annotations == nil {
+				m.Annotations = &Struct{}
+			}
+			if err := m.Annotations.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reviewer", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57918,30 +68950,29 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Reviewer = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ProposedState", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -57951,28 +68982,27 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ProposedState = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestedResourceIDs", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -57999,13 +69029,14 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.RequestedResourceIDs = append(m.RequestedResourceIDs, ResourceID{})
+			if err := m.RequestedResourceIDs[len(m.RequestedResourceIDs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxDuration", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58032,13 +69063,13 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.MaxDuration, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 15:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PromotedAccessListName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58066,13 +69097,13 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			m.PromotedAccessListName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 16:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AssumeStartTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58082,46 +69113,31 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DirectoryName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
+			if m.AssumeStartTime == nil {
+				m.AssumeStartTime = new(time.Time)
 			}
-			m.DirectoryID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DirectoryID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.AssumeStartTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		case 9:
+			iNdEx = postIndex
+		case 17:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceNames", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58149,46 +69165,8 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			m.ResourceNames = append(m.ResourceNames, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
-			}
-			m.Length = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Length |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
-			}
-			m.Offset = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Offset |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -58211,7 +69189,7 @@ func (m *DesktopSharedDirectoryRead) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
+func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58234,10 +69212,10 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryWrite: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessRequestExpire: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DesktopSharedDirectoryWrite: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessRequestExpire: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -58275,7 +69253,7 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58302,15 +69280,15 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58320,28 +69298,27 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.RequestID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceExpiry", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58368,15 +69345,69 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.ResourceExpiry == nil {
+				m.ResourceExpiry = new(time.Time)
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.ResourceExpiry, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ResourceID) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResourceID: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResourceID: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58386,28 +69417,27 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58435,11 +69465,11 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			m.Kind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58467,30 +69497,11 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DirectoryName = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DirectoryID", wireType)
-			}
-			m.DirectoryID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DirectoryID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 9:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SubResourceName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -58518,46 +69529,8 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			m.SubResourceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Length", wireType)
-			}
-			m.Length = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Length |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
-			}
-			m.Offset = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Offset |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -58580,7 +69553,7 @@ func (m *DesktopSharedDirectoryWrite) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionReject) Unmarshal(dAtA []byte) error {
+func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58603,10 +69576,10 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionReject: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessRequestDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionReject: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessRequestDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -58677,7 +69650,90 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequestID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PortForward) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PortForward: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PortForward: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58704,13 +69760,13 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58737,15 +69793,15 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58755,29 +69811,30 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Maximum", wireType)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			m.Maximum = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58787,67 +69844,30 @@ func (m *SessionReject) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Maximum |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SessionConnect) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SessionConnect: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionConnect: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Addr", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -58857,28 +69877,27 @@ func (m *SessionConnect) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Addr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58905,13 +69924,13 @@ func (m *SessionConnect) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -58938,7 +69957,7 @@ func (m *SessionConnect) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -58964,7 +69983,7 @@ func (m *SessionConnect) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
+func (m *X11Forward) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -58987,10 +70006,10 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: FileTransferRequestEvent: wiretype end group for non-group")
+			return fmt.Errorf("proto: X11Forward: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: FileTransferRequestEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: X11Forward: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -59028,7 +70047,7 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59055,15 +70074,15 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59073,29 +70092,30 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestID = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Approvers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59105,27 +70125,79 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Approvers = append(m.Approvers, string(dAtA[iNdEx:postIndex]))
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CommandMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CommandMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Requester", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Command", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59153,11 +70225,11 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Requester = string(dAtA[iNdEx:postIndex])
+			m.Command = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Location", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExitCode", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59185,31 +70257,11 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Location = string(dAtA[iNdEx:postIndex])
+			m.ExitCode = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Download", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.Download = bool(v != 0)
-		case 8:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Filename", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59237,7 +70289,7 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Filename = string(dAtA[iNdEx:postIndex])
+			m.Error = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -59261,7 +70313,7 @@ func (m *FileTransferRequestEvent) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Resize) Unmarshal(dAtA []byte) error {
+func (m *Exec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59284,10 +70336,10 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Resize: wiretype end group for non-group")
+			return fmt.Errorf("proto: Exec: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Resize: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Exec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -59358,7 +70410,7 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59385,13 +70437,13 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59418,7 +70470,7 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -59457,9 +70509,9 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TerminalSize", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59469,23 +70521,24 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TerminalSize = string(dAtA[iNdEx:postIndex])
+			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
@@ -59575,7 +70628,7 @@ func (m *Resize) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionEnd) Unmarshal(dAtA []byte) error {
+func (m *SCP) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -59598,10 +70651,10 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionEnd: wiretype end group for non-group")
+			return fmt.Errorf("proto: SCP: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SCP: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -59672,7 +70725,7 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59699,13 +70752,13 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59732,7 +70785,7 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -59770,10 +70823,10 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EnhancedRecording", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59783,17 +70836,30 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.EnhancedRecording = bool(v != 0)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Interactive", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var v int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59803,15 +70869,27 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.Interactive = bool(v != 0)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Participants", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -59839,11 +70917,62 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Participants = append(m.Participants, string(dAtA[iNdEx:postIndex]))
+			m.Action = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 9:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SFTPAttributes: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SFTPAttributes: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FileSize", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59870,13 +70999,16 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
+			if m.FileSize == nil {
+				m.FileSize = new(uint64)
+			}
+			if err := github_com_gogo_protobuf_types.StdUInt64Unmarshal(m.FileSize, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 10:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59903,13 +71035,16 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
+			if m.UID == nil {
+				m.UID = new(uint32)
+			}
+			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.UID, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 11:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GID", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59936,13 +71071,16 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.GID == nil {
+				m.GID = new(uint32)
+			}
+			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.GID, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 12:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -59969,15 +71107,18 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Permissions == nil {
+				m.Permissions = new(uint32)
+			}
+			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.Permissions, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 13:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InitialCommand", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -59987,29 +71128,33 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InitialCommand = append(m.InitialCommand, string(dAtA[iNdEx:postIndex]))
+			if m.AccessTime == nil {
+				m.AccessTime = new(time.Time)
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.AccessTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 14:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecording", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ModificationTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60019,23 +71164,27 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionRecording = string(dAtA[iNdEx:postIndex])
+			if m.ModificationTime == nil {
+				m.ModificationTime = new(time.Time)
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.ModificationTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -60059,7 +71208,7 @@ func (m *SessionEnd) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BPFMetadata) Unmarshal(dAtA []byte) error {
+func (m *SFTP) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -60082,17 +71231,17 @@ func (m *BPFMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BPFMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SFTP: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BPFMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SFTP: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PID", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			m.PID = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60102,35 +71251,30 @@ func (m *BPFMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.PID |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CgroupID", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.CgroupID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.CgroupID |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 3:
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Program", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60140,100 +71284,30 @@ func (m *BPFMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Program = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Status) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Status: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Status: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Success", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.Success = bool(v != 0)
-		case 2:
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60243,29 +71317,30 @@ func (m *Status) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Error = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMessage", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60275,78 +71350,28 @@ func (m *Status) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UserMessage = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SessionCommand) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SessionCommand: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionCommand: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -60373,15 +71398,15 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkingDirectory", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60391,30 +71416,29 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.WorkingDirectory = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60424,30 +71448,29 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TargetPath", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60457,28 +71480,46 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.TargetPath = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Flags", wireType)
+			}
+			m.Flags = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Flags |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -60505,34 +71546,18 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Attributes == nil {
+				m.Attributes = &SFTPAttributes{}
+			}
+			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 11:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PPID", wireType)
-			}
-			m.PPID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.PPID |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
 			}
-			var stringLen uint64
+			m.Action = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60542,27 +71567,14 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.Action |= SFTPAction(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Path = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Argv", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -60590,27 +71602,8 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Argv = append(m.Argv, string(dAtA[iNdEx:postIndex]))
+			m.Error = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReturnCode", wireType)
-			}
-			m.ReturnCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.ReturnCode |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -60633,7 +71626,7 @@ func (m *SessionCommand) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionDisk) Unmarshal(dAtA []byte) error {
+func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -60656,10 +71649,10 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionDisk: wiretype end group for non-group")
+			return fmt.Errorf("proto: SFTPSummary: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionDisk: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SFTPSummary: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -60729,6 +71722,39 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
@@ -60761,7 +71787,7 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
@@ -60794,9 +71820,9 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FileTransferStats", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -60823,11 +71849,63 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.FileTransferStats = append(m.FileTransferStats, &FileTransferStat{})
+			if err := m.FileTransferStats[len(m.FileTransferStats)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FileTransferStat: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FileTransferStat: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
@@ -60859,11 +71937,11 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 			}
 			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Flags", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesRead", wireType)
 			}
-			m.Flags = 0
+			m.BytesRead = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60873,16 +71951,16 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Flags |= int32(b&0x7F) << shift
+				m.BytesRead |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 8:
+		case 3:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReturnCode", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesWritten", wireType)
 			}
-			m.ReturnCode = 0
+			m.BytesWritten = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -60892,7 +71970,7 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ReturnCode |= int32(b&0x7F) << shift
+				m.BytesWritten |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -60919,7 +71997,7 @@ func (m *SessionDisk) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
+func (m *Subsystem) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -60942,10 +72020,10 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionNetwork: wiretype end group for non-group")
+			return fmt.Errorf("proto: Subsystem: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionNetwork: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Subsystem: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -61016,7 +72094,7 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61043,15 +72121,15 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -61061,61 +72139,27 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BPFMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.BPFMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SrcAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -61143,13 +72187,13 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SrcAddr = string(dAtA[iNdEx:postIndex])
+			m.Error = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DstAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -61159,100 +72203,25 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DstAddr = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DstPort", wireType)
-			}
-			m.DstPort = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DstPort |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TCPVersion", wireType)
-			}
-			m.TCPVersion = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TCPVersion |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
-			}
-			m.Operation = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Operation |= SessionNetwork_NetworkOperation(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
-			}
-			m.Action = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Action |= EventAction(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -61275,7 +72244,7 @@ func (m *SessionNetwork) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionData) Unmarshal(dAtA []byte) error {
+func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -61298,10 +72267,10 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionData: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClientDisconnect: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionData: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClientDisconnect: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -61372,7 +72341,7 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61399,7 +72368,7 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -61438,9 +72407,9 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -61450,63 +72419,24 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BytesTransmitted", wireType)
-			}
-			m.BytesTransmitted = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.BytesTransmitted |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BytesReceived", wireType)
-			}
-			m.BytesReceived = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.BytesReceived |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -61529,7 +72459,7 @@ func (m *SessionData) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionLeave) Unmarshal(dAtA []byte) error {
+func (m *AuthAttempt) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -61552,10 +72482,10 @@ func (m *SessionLeave) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionLeave: wiretype end group for non-group")
+			return fmt.Errorf("proto: AuthAttempt: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionLeave: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AuthAttempt: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -61620,46 +72550,46 @@ func (m *SessionLeave) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61686,13 +72616,13 @@ func (m *SessionLeave) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61719,7 +72649,7 @@ func (m *SessionLeave) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -61745,7 +72675,7 @@ func (m *SessionLeave) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserLogin) Unmarshal(dAtA []byte) error {
+func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -61768,10 +72698,10 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserLogin: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserTokenCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserLogin: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -61809,7 +72739,7 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61836,13 +72766,13 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61869,45 +72799,64 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RoleCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RoleCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RoleCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IdentityAttributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61934,16 +72883,13 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.IdentityAttributes == nil {
-				m.IdentityAttributes = &Struct{}
-			}
-			if err := m.IdentityAttributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADevice", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -61970,16 +72916,13 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MFADevice == nil {
-				m.MFADevice = &MFADeviceMetadata{}
-			}
-			if err := m.MFADevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62006,11 +72949,11 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 8:
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -62043,70 +72986,6 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppliedLoginRules", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.AppliedLoginRules = append(m.AppliedLoginRules, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 10:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ConnectorID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -62129,7 +73008,7 @@ func (m *UserLogin) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
+func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -62152,10 +73031,10 @@ func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CreateMFAAuthChallenge: wiretype end group for non-group")
+			return fmt.Errorf("proto: RoleUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CreateMFAAuthChallenge: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: RoleUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -62192,6 +73071,39 @@ func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -62224,11 +73136,11 @@ func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeScope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62238,44 +73150,25 @@ func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ChallengeScope = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeAllowReuse", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.ChallengeAllowReuse = bool(v != 0)
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -62298,7 +73191,7 @@ func (m *CreateMFAAuthChallenge) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
+func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -62321,10 +73214,10 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ValidateMFAAuthResponse: wiretype end group for non-group")
+			return fmt.Errorf("proto: RoleDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ValidateMFAAuthResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: RoleDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -62362,7 +73255,7 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62389,13 +73282,13 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62422,13 +73315,13 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADevice", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62455,18 +73348,99 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MFADevice == nil {
-				m.MFADevice = &MFADeviceMetadata{}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if err := m.MFADevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BotCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BotCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BotCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeScope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62476,29 +73450,30 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ChallengeScope = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeAllowReuse", wireType)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62508,12 +73483,25 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.ChallengeAllowReuse = bool(v != 0)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -62536,7 +73524,7 @@ func (m *ValidateMFAAuthResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
+func (m *BotUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -62559,17 +73547,17 @@ func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ResourceMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: BotUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ResourceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BotUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62579,27 +73567,28 @@ func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62626,15 +73615,15 @@ func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Expires, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedBy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62644,55 +73633,24 @@ func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpdatedBy = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TTL", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.TTL = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -62716,7 +73674,7 @@ func (m *ResourceMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserCreate) Unmarshal(dAtA []byte) error {
+func (m *BotDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -62739,10 +73697,10 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: BotDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BotDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -62780,7 +73738,7 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62807,13 +73765,13 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -62840,15 +73798,66 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TrustedClusterCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TrustedClusterCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62858,29 +73867,30 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -62890,25 +73900,59 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Connector = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -62963,7 +74007,7 @@ func (m *UserCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserUpdate) Unmarshal(dAtA []byte) error {
+func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -62986,10 +74030,10 @@ func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: TrustedClusterDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: TrustedClusterDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -63027,7 +74071,7 @@ func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63054,13 +74098,13 @@ func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63087,75 +74131,11 @@ func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Connector = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -63210,7 +74190,7 @@ func (m *UserUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserDelete) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -63233,10 +74213,10 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: ProvisionTokenCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ProvisionTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -63274,7 +74254,7 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63301,13 +74281,13 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63334,15 +74314,15 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -63352,24 +74332,55 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.Roles = append(m.Roles, github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinMethod", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinMethod = github_com_gravitational_teleport_api_types.JoinMethod(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -63393,7 +74404,7 @@ func (m *UserDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
+func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -63416,10 +74427,10 @@ func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserPasswordChange: wiretype end group for non-group")
+			return fmt.Errorf("proto: TrustedClusterTokenCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserPasswordChange: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: TrustedClusterTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -63457,7 +74468,7 @@ func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63484,13 +74495,13 @@ func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63517,7 +74528,7 @@ func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -63543,7 +74554,7 @@ func (m *UserPasswordChange) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
+func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -63566,10 +74577,10 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: GithubConnectorCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GithubConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -63607,7 +74618,7 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63634,13 +74645,13 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63667,15 +74678,15 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -63685,93 +74696,81 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestState", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestState = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GithubConnectorUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GithubConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Delegator", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -63781,29 +74780,30 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Delegator = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -63813,27 +74813,28 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Annotations", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63860,18 +74861,15 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Annotations == nil {
-				m.Annotations = &Struct{}
-			}
-			if err := m.Annotations.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 10:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reviewer", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -63881,59 +74879,79 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reviewer = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 11:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProposedState", wireType)
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ProposedState = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 12:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GithubConnectorDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GithubConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestedResourceIDs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63960,14 +74978,13 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestedResourceIDs = append(m.RequestedResourceIDs, ResourceID{})
-			if err := m.RequestedResourceIDs[len(m.RequestedResourceIDs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 13:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MaxDuration", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -63994,45 +75011,13 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.MaxDuration, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 15:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PromotedAccessListName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.PromotedAccessListName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 16:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AssumeStartTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64059,18 +75044,15 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AssumeStartTime == nil {
-				m.AssumeStartTime = new(time.Time)
-			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.AssumeStartTime, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 17:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceNames", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64080,23 +75062,24 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceNames = append(m.ResourceNames, string(dAtA[iNdEx:postIndex]))
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -64120,7 +75103,7 @@ func (m *AccessRequestCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
+func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -64143,10 +75126,10 @@ func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestExpire: wiretype end group for non-group")
+			return fmt.Errorf("proto: OIDCConnectorCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestExpire: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OIDCConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -64217,39 +75200,7 @@ func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.RequestID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceExpiry", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64276,10 +75227,7 @@ func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ResourceExpiry == nil {
-				m.ResourceExpiry = new(time.Time)
-			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.ResourceExpiry, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -64305,7 +75253,7 @@ func (m *AccessRequestExpire) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ResourceID) Unmarshal(dAtA []byte) error {
+func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -64328,17 +75276,17 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ResourceID: wiretype end group for non-group")
+			return fmt.Errorf("proto: OIDCConnectorUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ResourceID: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OIDCConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64348,29 +75296,30 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64380,29 +75329,30 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64412,55 +75362,24 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubResourceName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.SubResourceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -64484,7 +75403,7 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
+func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -64507,10 +75426,10 @@ func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: OIDCConnectorDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OIDCConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -64548,7 +75467,7 @@ func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64575,15 +75494,15 @@ func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64593,23 +75512,24 @@ func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestID = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -64633,7 +75553,7 @@ func (m *AccessRequestDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PortForward) Unmarshal(dAtA []byte) error {
+func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -64656,10 +75576,10 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PortForward: wiretype end group for non-group")
+			return fmt.Errorf("proto: SAMLConnectorCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PortForward: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SAMLConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -64691,11 +75611,44 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -64728,9 +75681,9 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64757,13 +75710,67 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Connector == nil {
+				m.Connector = &types1.SAMLConnectorV2{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLConnectorUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64790,15 +75797,15 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Addr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -64808,27 +75815,28 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Addr = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64855,13 +75863,13 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -64888,7 +75896,10 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Connector == nil {
+				m.Connector = &types1.SAMLConnectorV2{}
+			}
+			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -64914,7 +75925,7 @@ func (m *PortForward) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *X11Forward) Unmarshal(dAtA []byte) error {
+func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -64937,10 +75948,10 @@ func (m *X11Forward) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: X11Forward: wiretype end group for non-group")
+			return fmt.Errorf("proto: SAMLConnectorDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: X11Forward: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SAMLConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -64978,7 +75989,7 @@ func (m *X11Forward) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65005,46 +76016,13 @@ func (m *X11Forward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65071,7 +76049,7 @@ func (m *X11Forward) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -65097,7 +76075,7 @@ func (m *X11Forward) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
+func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -65120,17 +76098,17 @@ func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CommandMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: KubeRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CommandMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: KubeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Command", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65140,29 +76118,30 @@ func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Command = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExitCode", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65172,29 +76151,30 @@ func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ExitCode = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65204,80 +76184,95 @@ func (m *CommandMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Error = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Exec) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestPath", wireType)
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Exec: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Exec: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequestPath = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Verb", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65287,30 +76282,29 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Verb = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceAPIGroup", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65320,30 +76314,29 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ResourceAPIGroup = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceNamespace", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65353,30 +76346,29 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ResourceNamespace = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceKind", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65386,30 +76378,29 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ResourceKind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65419,30 +76410,29 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ResourceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResponseCode", wireType)
 			}
-			var msglen int
+			m.ResponseCode = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65452,26 +76442,12 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.ResponseCode |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 7:
+		case 12:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
 			}
@@ -65504,9 +76480,9 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 8:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesPodMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65533,7 +76509,7 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubernetesPodMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -65559,7 +76535,7 @@ func (m *Exec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SCP) Unmarshal(dAtA []byte) error {
+func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -65582,17 +76558,17 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SCP: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SCP: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppURI", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65602,30 +76578,29 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AppURI = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppPublicAddr", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65635,28 +76610,27 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AppPublicAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppLabels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65683,15 +76657,109 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.AppLabels == nil {
+				m.AppLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.AppLabels[mapkey] = mapvalue
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65701,28 +76769,97 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AppName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AppTargetPort", wireType)
+			}
+			m.AppTargetPort = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.AppTargetPort |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AppCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AppCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AppCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65749,13 +76886,13 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65782,15 +76919,15 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65800,29 +76937,30 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -65832,23 +76970,24 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Action = string(dAtA[iNdEx:postIndex])
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -65872,7 +77011,7 @@ func (m *SCP) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
+func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -65895,15 +77034,15 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SFTPAttributes: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SFTPAttributes: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FileSize", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65930,16 +77069,13 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.FileSize == nil {
-				m.FileSize = new(uint64)
-			}
-			if err := github_com_gogo_protobuf_types.StdUInt64Unmarshal(m.FileSize, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -65966,16 +77102,13 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.UID == nil {
-				m.UID = new(uint32)
-			}
-			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.UID, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66002,16 +77135,13 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.GID == nil {
-				m.GID = new(uint32)
-			}
-			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.GID, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66038,16 +77168,64 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Permissions == nil {
-				m.Permissions = new(uint32)
-			}
-			if err := github_com_gogo_protobuf_types.StdUInt32Unmarshal(m.Permissions, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AppDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AppDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AppDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66074,16 +77252,46 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AccessTime == nil {
-				m.AccessTime = new(time.Time)
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.AccessTime, dAtA[iNdEx:postIndex]); err != nil {
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ModificationTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66110,10 +77318,7 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ModificationTime == nil {
-				m.ModificationTime = new(time.Time)
-			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.ModificationTime, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -66139,7 +77344,7 @@ func (m *SFTPAttributes) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SFTP) Unmarshal(dAtA []byte) error {
+func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -66162,10 +77367,10 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SFTP: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppSessionStart: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SFTP: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -66236,7 +77441,7 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66263,13 +77468,13 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66296,13 +77501,13 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66329,13 +77534,13 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkingDirectory", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicAddr", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -66363,13 +77568,13 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WorkingDirectory = string(dAtA[iNdEx:postIndex])
+			m.PublicAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66379,29 +77584,81 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AppSessionEnd: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AppSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TargetPath", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66411,29 +77668,30 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TargetPath = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Flags", wireType)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			m.Flags = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66443,14 +77701,28 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Flags |= uint32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 10:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66477,18 +77749,48 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Attributes == nil {
-				m.Attributes = &SFTPAttributes{}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 11:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.Action = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66498,16 +77800,30 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Action |= SFTPAction(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 12:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66517,23 +77833,24 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Error = string(dAtA[iNdEx:postIndex])
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -66557,7 +77874,7 @@ func (m *SFTP) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
+func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -66580,10 +77897,10 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SFTPSummary: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppSessionChunk: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SFTPSummary: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppSessionChunk: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -66648,13 +77965,46 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66681,13 +78031,13 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66714,15 +78064,15 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionChunkID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66732,28 +78082,27 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SessionChunkID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FileTransferStats", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -66780,8 +78129,7 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FileTransferStats = append(m.FileTransferStats, &FileTransferStat{})
-			if err := m.FileTransferStats[len(m.FileTransferStats)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -66807,7 +78155,7 @@ func (m *SFTPSummary) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
+func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -66830,17 +78178,17 @@ func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: FileTransferStat: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppSessionRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: FileTransferStat: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppSessionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66850,29 +78198,30 @@ func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BytesRead", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
 			}
-			m.BytesRead = 0
+			m.StatusCode = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66882,16 +78231,16 @@ func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.BytesRead |= uint64(b&0x7F) << shift
+				m.StatusCode |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BytesWritten", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			m.BytesWritten = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66901,67 +78250,61 @@ func (m *FileTransferStat) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.BytesWritten |= uint64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Subsystem) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Subsystem: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Subsystem: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -66971,28 +78314,27 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67019,13 +78361,13 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRequestMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67052,13 +78394,64 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AWSRequestMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSRequestMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSRequestMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRegion", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -67086,11 +78479,11 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.AWSRegion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSService", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -67118,13 +78511,13 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Error = string(dAtA[iNdEx:postIndex])
+			m.AWSService = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSHost", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67134,24 +78527,55 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.AWSHost = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSAssumedRole", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.AWSAssumedRole = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -67175,7 +78599,7 @@ func (m *Subsystem) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
+func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -67198,17 +78622,17 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ClientDisconnect: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ClientDisconnect: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseService", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67218,30 +78642,29 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseService = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseProtocol", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67251,30 +78674,29 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseProtocol = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseURI", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67284,28 +78706,91 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseURI = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DatabaseName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUser", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DatabaseUser = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseLabels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67332,13 +78817,107 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.DatabaseLabels == nil {
+				m.DatabaseLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.DatabaseLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 5:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseAWSRegion", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -67366,97 +78945,13 @@ func (m *ClientDisconnect) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AuthAttempt) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AuthAttempt: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AuthAttempt: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseAWSRegion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseAWSRedshiftClusterID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67466,30 +78961,29 @@ func (m *AuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseAWSRedshiftClusterID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseGCPProjectID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67499,30 +78993,29 @@ func (m *AuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseGCPProjectID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseGCPInstanceID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67532,81 +79025,29 @@ func (m *AuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseGCPInstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: UserTokenCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseRoles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67616,30 +79057,29 @@ func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseRoles = append(m.DatabaseRoles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67649,30 +79089,29 @@ func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseOrigin", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -67682,24 +79121,23 @@ func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseOrigin = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -67723,7 +79161,7 @@ func (m *UserTokenCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RoleCreate) Unmarshal(dAtA []byte) error {
+func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -67746,10 +79184,10 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RoleCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RoleCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -67787,7 +79225,7 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67814,13 +79252,13 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67847,13 +79285,13 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67880,7 +79318,7 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -67906,7 +79344,7 @@ func (m *RoleCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
+func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -67929,10 +79367,10 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RoleUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RoleUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -67970,7 +79408,7 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -67997,13 +79435,13 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68030,13 +79468,13 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68063,7 +79501,7 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -68089,7 +79527,7 @@ func (m *RoleUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RoleDelete) Unmarshal(dAtA []byte) error {
+func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68112,10 +79550,10 @@ func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RoleDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RoleDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -68152,39 +79590,6 @@ func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -68217,9 +79622,9 @@ func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68246,7 +79651,7 @@ func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -68272,7 +79677,7 @@ func (m *RoleDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BotCreate) Unmarshal(dAtA []byte) error {
+func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68295,10 +79700,10 @@ func (m *BotCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BotCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseSessionStart: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BotCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -68336,7 +79741,7 @@ func (m *BotCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68363,13 +79768,13 @@ func (m *BotCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68396,64 +79801,79 @@ func (m *BotCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *BotUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if iNdEx >= l {
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: BotUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BotUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68480,13 +79900,13 @@ func (m *BotUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68513,13 +79933,32 @@ func (m *BotUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresPID", wireType)
+			}
+			m.PostgresPID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.PostgresPID |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68546,7 +79985,7 @@ func (m *BotUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -68572,7 +80011,7 @@ func (m *BotUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BotDelete) Unmarshal(dAtA []byte) error {
+func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68595,10 +80034,10 @@ func (m *BotDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BotDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseSessionQuery: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BotDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseSessionQuery: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -68636,7 +80075,7 @@ func (m *BotDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68663,13 +80102,13 @@ func (m *BotDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68696,64 +80135,13 @@ func (m *BotDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: TrustedClusterCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TrustedClusterCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68780,15 +80168,15 @@ func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseQuery", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -68798,30 +80186,29 @@ func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DatabaseQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseQueryParameters", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -68831,28 +80218,27 @@ func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+				return io.ErrUnexpectedEOF
 			}
+			m.DatabaseQueryParameters = append(m.DatabaseQueryParameters, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68879,7 +80265,7 @@ func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -68905,7 +80291,7 @@ func (m *TrustedClusterCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
+func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68928,10 +80314,10 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: TrustedClusterDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseSessionCommandResult: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TrustedClusterDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseSessionCommandResult: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -68969,7 +80355,7 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -68996,13 +80382,13 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69029,13 +80415,13 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69062,10 +80448,62 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AffectedRecords", wireType)
+			}
+			m.AffectedRecords = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.AffectedRecords |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -69088,7 +80526,7 @@ func (m *TrustedClusterDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
+func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -69111,10 +80549,10 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ProvisionTokenCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabasePermissionUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ProvisionTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabasePermissionUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -69152,7 +80590,7 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69179,13 +80617,13 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69212,15 +80650,15 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -69230,29 +80668,30 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, github_com_gravitational_teleport_api_types.SystemRole(dAtA[iNdEx:postIndex]))
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JoinMethod", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PermissionSummary", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -69262,23 +80701,138 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.JoinMethod = github_com_gravitational_teleport_api_types.JoinMethod(dAtA[iNdEx:postIndex])
+			m.PermissionSummary = append(m.PermissionSummary, DatabasePermissionEntry{})
+			if err := m.PermissionSummary[len(m.PermissionSummary)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AffectedObjectCounts", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AffectedObjectCounts == nil {
+				m.AffectedObjectCounts = make(map[string]int32)
+			}
+			var mapkey string
+			var mapvalue int32
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapvalue |= int32(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.AffectedObjectCounts[mapkey] = mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -69302,7 +80856,7 @@ func (m *ProvisionTokenCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
+func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -69325,17 +80879,17 @@ func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: TrustedClusterTokenCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabasePermissionEntry: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TrustedClusterTokenCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabasePermissionEntry: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Permission", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -69345,28 +80899,27 @@ func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Permission = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Counts", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69393,42 +80946,89 @@ func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			if m.Counts == nil {
+				m.Counts = make(map[string]int32)
 			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
+			var mapkey string
+			var mapvalue int32
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
 				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapvalue |= int32(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Counts[mapkey] = mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -69452,7 +81052,7 @@ func (m *TrustedClusterTokenCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
+func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -69475,10 +81075,10 @@ func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GithubConnectorCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseUserCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GithubConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -69515,39 +81115,6 @@ func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -69580,9 +81147,9 @@ func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69609,64 +81176,13 @@ func (m *GithubConnectorCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GithubConnectorUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GithubConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69693,13 +81209,13 @@ func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69726,15 +81242,15 @@ func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -69744,30 +81260,29 @@ func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -69777,24 +81292,23 @@ func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -69818,7 +81332,7 @@ func (m *GithubConnectorUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
+func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -69841,10 +81355,10 @@ func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GithubConnectorDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseUserDeactivate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GithubConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseUserDeactivate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -69882,7 +81396,7 @@ func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69909,13 +81423,13 @@ func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69942,13 +81456,13 @@ func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -69975,64 +81489,13 @@ func (m *GithubConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OIDCConnectorCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OIDCConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70059,15 +81522,15 @@ func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70077,30 +81540,29 @@ func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Delete", wireType)
 			}
-			var msglen int
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70110,25 +81572,12 @@ func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
+			m.Delete = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -70151,7 +81600,7 @@ func (m *OIDCConnectorCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
+func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -70174,10 +81623,10 @@ func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OIDCConnectorUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: PostgresParse: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OIDCConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PostgresParse: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -70215,7 +81664,7 @@ func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70242,13 +81691,13 @@ func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70275,64 +81724,13 @@ func (m *OIDCConnectorUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OIDCConnectorDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OIDCConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70359,15 +81757,15 @@ func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70377,30 +81775,29 @@ func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.StatementName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70410,24 +81807,23 @@ func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -70451,7 +81847,7 @@ func (m *OIDCConnectorDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
+func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -70474,10 +81870,10 @@ func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLConnectorCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: PostgresBind: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLConnectorCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PostgresBind: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -70514,39 +81910,6 @@ func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -70579,9 +81942,9 @@ func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70608,67 +81971,13 @@ func (m *SAMLConnectorCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types1.SAMLConnectorV2{}
-			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLConnectorUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLConnectorUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70695,15 +82004,15 @@ func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70713,30 +82022,29 @@ func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.StatementName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70746,30 +82054,29 @@ func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.PortalName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Connector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70779,27 +82086,23 @@ func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Connector == nil {
-				m.Connector = &types1.SAMLConnectorV2{}
-			}
-			if err := m.Connector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -70823,7 +82126,7 @@ func (m *SAMLConnectorUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
+func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -70846,10 +82149,10 @@ func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLConnectorDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: PostgresExecute: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLConnectorDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PostgresExecute: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -70881,13 +82184,79 @@ func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -70914,15 +82283,15 @@ func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -70932,24 +82301,23 @@ func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.PortalName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -70973,7 +82341,7 @@ func (m *SAMLConnectorDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *KubeRequest) Unmarshal(dAtA []byte) error {
+func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -70996,10 +82364,10 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubeRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: PostgresClose: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PostgresClose: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -71070,7 +82438,7 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -71097,13 +82465,13 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -71130,13 +82498,13 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestPath", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71164,11 +82532,11 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RequestPath = string(dAtA[iNdEx:postIndex])
+			m.StatementName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Verb", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71196,13 +82564,64 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Verb = string(dAtA[iNdEx:postIndex])
+			m.PortalName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PostgresFunctionCall: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PostgresFunctionCall: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceAPIGroup", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71212,29 +82631,30 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceAPIGroup = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceNamespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71244,29 +82664,30 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceNamespace = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71276,29 +82697,30 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceKind = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71308,48 +82730,30 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceName = string(dAtA[iNdEx:postIndex])
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 5:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResponseCode", wireType)
-			}
-			m.ResponseCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.ResponseCode |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 12:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FunctionOID", wireType)
 			}
-			var msglen int
+			m.FunctionOID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71359,30 +82763,16 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.FunctionOID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.KubernetesClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 13:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FunctionArgs", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71392,24 +82782,23 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.FunctionArgs = append(m.FunctionArgs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -71433,7 +82822,7 @@ func (m *KubeRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppMetadata) Unmarshal(dAtA []byte) error {
+func (m *WindowsCertificateMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -71452,19 +82841,51 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 			if b < 0x80 {
 				break
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AppMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WindowsCertificateMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WindowsCertificateMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subject", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subject = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppURI", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SerialNumber", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71492,11 +82913,11 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppURI = string(dAtA[iNdEx:postIndex])
+			m.SerialNumber = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppPublicAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UPN", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71524,13 +82945,13 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppPublicAddr = string(dAtA[iNdEx:postIndex])
+			m.UPN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CRLDistributionPoints", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71540,29 +82961,46 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AppLabels == nil {
-				m.AppLabels = make(map[string]string)
+			m.CRLDistributionPoints = append(m.CRLDistributionPoints, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeyUsage", wireType)
 			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
+			m.KeyUsage = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.KeyUsage |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType == 0 {
+				var v int32
 				for shift := uint(0); ; shift += 7 {
 					if shift >= 64 {
 						return ErrIntOverflowEvents
@@ -71572,43 +83010,51 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 					}
 					b := dAtA[iNdEx]
 					iNdEx++
-					wire |= uint64(b&0x7F) << shift
+					v |= int32(b&0x7F) << shift
 					if b < 0x80 {
 						break
 					}
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
+				m.ExtendedKeyUsage = append(m.ExtendedKeyUsage, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
 					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
 					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
 					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
+				}
+				if packedLen < 0 {
+					return ErrInvalidLengthEvents
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return ErrInvalidLengthEvents
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				var count int
+				for _, integer := range dAtA[iNdEx:postIndex] {
+					if integer < 128 {
+						count++
 					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
+				}
+				elementCount = count
+				if elementCount != 0 && len(m.ExtendedKeyUsage) == 0 {
+					m.ExtendedKeyUsage = make([]int32, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v int32
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
 							return ErrIntOverflowEvents
@@ -71618,44 +83064,19 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 						}
 						b := dAtA[iNdEx]
 						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
+						v |= int32(b&0x7F) << shift
 						if b < 0x80 {
 							break
 						}
 					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+					m.ExtendedKeyUsage = append(m.ExtendedKeyUsage, v)
 				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtendedKeyUsage", wireType)
 			}
-			m.AppLabels[mapkey] = mapvalue
-			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EnhancedKeyUsage", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71683,27 +83104,8 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppName = string(dAtA[iNdEx:postIndex])
+			m.EnhancedKeyUsage = append(m.EnhancedKeyUsage, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppTargetPort", wireType)
-			}
-			m.AppTargetPort = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.AppTargetPort |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -71726,7 +83128,7 @@ func (m *AppMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppCreate) Unmarshal(dAtA []byte) error {
+func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -71749,10 +83151,10 @@ func (m *AppCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WindowsDesktopSessionStart: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WindowsDesktopSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -71823,7 +83225,7 @@ func (m *AppCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -71850,13 +83252,13 @@ func (m *AppCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -71883,66 +83285,112 @@ func (m *AppCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AppUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if iNdEx >= l {
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.WindowsDesktopService = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AppUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -71952,28 +83400,59 @@ func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.Domain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsUser", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
+			m.WindowsUser = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopLabels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72000,15 +83479,109 @@ func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.DesktopLabels == nil {
+				m.DesktopLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.DesktopLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 3:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -72018,28 +83591,67 @@ func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowUserCreation", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.AllowUserCreation = bool(v != 0)
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NLA", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.NLA = bool(v != 0)
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CertMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72066,7 +83678,10 @@ func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.CertMetadata == nil {
+				m.CertMetadata = &WindowsCertificateMetadata{}
+			}
+			if err := m.CertMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -72092,7 +83707,7 @@ func (m *AppUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppDelete) Unmarshal(dAtA []byte) error {
+func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -72115,10 +83730,10 @@ func (m *AppDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: DatabaseSessionEnd: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DatabaseSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -72189,91 +83804,7 @@ func (m *AppDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AppSessionStart: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72300,13 +83831,13 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72333,13 +83864,13 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72366,13 +83897,13 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72399,11 +83930,11 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 7:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -72436,9 +83967,9 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PublicAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Participants", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -72466,40 +83997,7 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PublicAddr = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Participants = append(m.Participants, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -72523,7 +84021,7 @@ func (m *AppSessionStart) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
+func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -72546,17 +84044,17 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppSessionEnd: wiretype end group for non-group")
+			return fmt.Errorf("proto: MFADeviceMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MFADeviceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -72566,30 +84064,29 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DeviceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -72599,30 +84096,29 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DeviceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -72632,28 +84128,78 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.DeviceType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			iNdEx = postIndex
-		case 4:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MFADeviceAdd: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MFADeviceAdd: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72680,13 +84226,13 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72713,13 +84259,13 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72746,7 +84292,40 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.MFADeviceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -72772,7 +84351,7 @@ func (m *AppSessionEnd) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
+func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -72795,10 +84374,10 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppSessionChunk: wiretype end group for non-group")
+			return fmt.Errorf("proto: MFADeviceDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppSessionChunk: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MFADeviceDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -72869,7 +84448,7 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72896,13 +84475,13 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.MFADeviceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -72929,48 +84508,66 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BillingInformationUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 6:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BillingInformationUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BillingInformationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionChunkID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -72980,27 +84577,28 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionChunkID = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -73027,7 +84625,7 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -73053,7 +84651,7 @@ func (m *AppSessionChunk) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
+func (m *BillingCardCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -73076,10 +84674,10 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppSessionRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: BillingCardCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppSessionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BillingCardCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -73116,29 +84714,10 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
-			}
-			m.StatusCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatusCode |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73148,91 +84727,79 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RawQuery = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BillingCardDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BillingCardDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BillingCardDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -73259,13 +84826,13 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRequestMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -73292,7 +84859,7 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AWSRequestMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -73318,7 +84885,7 @@ func (m *AppSessionRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
+func (m *LockCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -73341,17 +84908,17 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AWSRequestMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: LockCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSRequestMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: LockCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRegion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73361,29 +84928,30 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSRegion = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSService", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73393,29 +84961,30 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSService = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSHost", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73425,29 +84994,30 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSHost = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSAssumedRole", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73457,23 +85027,57 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSAssumedRole = string(dAtA[iNdEx:postIndex])
+			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Lock", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Lock.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -73497,7 +85101,7 @@ func (m *AWSRequestMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
+func (m *LockDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -73520,17 +85124,17 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: LockDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: LockDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseService", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73540,29 +85144,30 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseService = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseProtocol", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73572,29 +85177,30 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseProtocol = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseURI", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73604,29 +85210,30 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseURI = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Lock", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73636,59 +85243,79 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUser", wireType)
+			if err := m.Lock.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RecoveryCodeGenerate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseUser = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RecoveryCodeGenerate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RecoveryCodeGenerate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -73715,109 +85342,15 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.DatabaseLabels == nil {
-				m.DatabaseLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.DatabaseLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseAWSRegion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73827,125 +85360,81 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseAWSRegion = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseAWSRedshiftClusterID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.DatabaseAWSRedshiftClusterID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseGCPProjectID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseGCPProjectID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 10:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseGCPInstanceID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RecoveryCodeUsed) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseGCPInstanceID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 11:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RecoveryCodeUsed: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RecoveryCodeUsed: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseRoles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73955,29 +85444,30 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseRoles = append(m.DatabaseRoles, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 12:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -73987,29 +85477,30 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseType = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 13:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseOrigin", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74019,23 +85510,24 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseOrigin = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -74059,7 +85551,7 @@ func (m *DatabaseMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
+func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -74082,10 +85574,10 @@ func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WindowsDesktopSessionEnd: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WindowsDesktopSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -74156,7 +85648,7 @@ func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74183,15 +85675,15 @@ func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74201,81 +85693,93 @@ func (m *DatabaseCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.WindowsDesktopService = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Domain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsUser", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74285,28 +85789,27 @@ func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.WindowsUser = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopLabels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74333,13 +85836,107 @@ func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.DesktopLabels == nil {
+				m.DesktopLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.DesktopLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 3:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74366,13 +85963,13 @@ func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74399,66 +85996,15 @@ func (m *DatabaseUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74468,30 +86014,49 @@ func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Recorded", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Recorded = bool(v != 0)
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Participants", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74501,28 +86066,27 @@ func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Participants = append(m.Participants, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 3:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74549,7 +86113,7 @@ func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -74575,7 +86139,7 @@ func (m *DatabaseDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
+func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -74598,10 +86162,10 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseSessionStart: wiretype end group for non-group")
+			return fmt.Errorf("proto: CertificateCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CertificateCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -74639,9 +86203,9 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CertificateType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74651,28 +86215,27 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CertificateType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Identity", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74699,13 +86262,16 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Identity == nil {
+				m.Identity = &Identity{}
+			}
+			if err := m.Identity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74732,13 +86298,13 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CertificateAuthority", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -74765,15 +86331,69 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.CertificateAuthority == nil {
+				m.CertificateAuthority = &CertificateAuthority{}
+			}
+			if err := m.CertificateAuthority.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertificateAuthority) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateAuthority: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateAuthority: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74783,30 +86403,29 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Type = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74816,49 +86435,29 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Domain = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresPID", wireType)
-			}
-			m.PostgresPID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.PostgresPID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SubjectKeyID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -74868,24 +86467,23 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SubjectKeyID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -74909,7 +86507,7 @@ func (m *DatabaseSessionStart) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
+func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -74932,10 +86530,10 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseSessionQuery: wiretype end group for non-group")
+			return fmt.Errorf("proto: RenewableCertificateGenerationMismatch: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseSessionQuery: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: RenewableCertificateGenerationMismatch: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -75004,9 +86602,60 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BotJoin) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BotJoin: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BotJoin: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -75033,13 +86682,13 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -75066,13 +86715,13 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -75100,11 +86749,11 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseQuery = string(dAtA[iNdEx:postIndex])
+			m.BotName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseQueryParameters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -75132,13 +86781,13 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseQueryParameters = append(m.DatabaseQueryParameters, string(dAtA[iNdEx:postIndex]))
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75148,79 +86797,27 @@ func (m *DatabaseSessionQuery) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.TokenName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseSessionCommandResult: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseSessionCommandResult: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -75247,48 +86844,18 @@ func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.Attributes == nil {
+				m.Attributes = &Struct{}
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75298,28 +86865,27 @@ func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.UserName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -75346,15 +86912,15 @@ func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75364,44 +86930,24 @@ func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AffectedRecords", wireType)
-			}
-			m.AffectedRecords = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.AffectedRecords |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -75424,7 +86970,7 @@ func (m *DatabaseSessionCommandResult) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
+func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -75447,10 +86993,10 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabasePermissionUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: InstanceJoin: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabasePermissionUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: InstanceJoin: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -75488,7 +87034,7 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -75515,15 +87061,15 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75533,30 +87079,29 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.HostID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75566,30 +87111,29 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.NodeName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PermissionSummary", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75599,31 +87143,29 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PermissionSummary = append(m.PermissionSummary, DatabasePermissionEntry{})
-			if err := m.PermissionSummary[len(m.PermissionSummary)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Role = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AffectedObjectCounts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75633,104 +87175,157 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AffectedObjectCounts == nil {
-				m.AffectedObjectCounts = make(map[string]int32)
+			m.Method = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
 			}
-			var mapkey string
-			var mapvalue int32
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapvalue |= int32(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TokenName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Attributes == nil {
+				m.Attributes = &Struct{}
+			}
+			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenExpires", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.AffectedObjectCounts[mapkey] = mapvalue
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.TokenExpires, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -75754,7 +87349,7 @@ func (m *DatabasePermissionUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
+func (m *Unknown) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -75777,15 +87372,48 @@ func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabasePermissionEntry: wiretype end group for non-group")
+			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabasePermissionEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Permission", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnknownType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -75813,13 +87441,13 @@ func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Permission = string(dAtA[iNdEx:postIndex])
+			m.UnknownType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Counts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UnknownCode", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75829,104 +87457,55 @@ func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Counts == nil {
-				m.Counts = make(map[string]int32)
+			m.UnknownCode = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
 			}
-			var mapkey string
-			var mapvalue int32
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapvalue |= int32(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.Counts[mapkey] = mapvalue
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -75950,7 +87529,7 @@ func (m *DatabasePermissionEntry) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
+func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -75973,17 +87552,17 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseUserCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -75993,30 +87572,29 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DeviceId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OsType", wireType)
 			}
-			var msglen int
+			m.OsType = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76026,30 +87604,16 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.OsType |= OSType(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AssetTag", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76059,30 +87623,29 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AssetTag = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CredentialId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76092,30 +87655,29 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CredentialId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceOrigin", wireType)
 			}
-			var msglen int
+			m.DeviceOrigin = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76125,30 +87687,16 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.DeviceOrigin |= DeviceOrigin(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WebAuthentication", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76158,27 +87706,15 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Username = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
+			m.WebAuthentication = bool(v != 0)
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WebAuthenticationId", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -76206,7 +87742,7 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			m.WebAuthenticationId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -76230,7 +87766,7 @@ func (m *DatabaseUserCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
+func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -76253,10 +87789,10 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseUserDeactivate: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseUserDeactivate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -76294,7 +87830,7 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76321,13 +87857,16 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Status == nil {
+				m.Status = &Status{}
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76354,13 +87893,16 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Device == nil {
+				m.Device = &DeviceMetadata{}
+			}
+			if err := m.Device.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76387,95 +87929,13 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.User == nil {
+				m.User = &UserMetadata{}
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.User.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Username = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Delete", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.Delete = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -76498,7 +87958,7 @@ func (m *DatabaseUserDeactivate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PostgresParse) Unmarshal(dAtA []byte) error {
+func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -76521,10 +87981,10 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PostgresParse: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceEvent2: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PostgresParse: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceEvent2: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -76556,46 +88016,13 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76622,13 +88049,16 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Device == nil {
+				m.Device = &DeviceMetadata{}
+			}
+			if err := m.Device.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76655,47 +88085,15 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.StatementName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -76705,23 +88103,24 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -76745,7 +88144,7 @@ func (m *PostgresParse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PostgresBind) Unmarshal(dAtA []byte) error {
+func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -76768,10 +88167,10 @@ func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PostgresBind: wiretype end group for non-group")
+			return fmt.Errorf("proto: DiscoveryConfigCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PostgresBind: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DiscoveryConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -76842,7 +88241,7 @@ func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76869,13 +88268,13 @@ func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -76902,106 +88301,10 @@ func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.StatementName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.PortalName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -77024,7 +88327,7 @@ func (m *PostgresBind) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
+func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77047,10 +88350,10 @@ func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PostgresExecute: wiretype end group for non-group")
+			return fmt.Errorf("proto: DiscoveryConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PostgresExecute: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DiscoveryConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -77121,7 +88424,7 @@ func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77148,13 +88451,13 @@ func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77181,42 +88484,10 @@ func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.PortalName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -77239,7 +88510,7 @@ func (m *PostgresExecute) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PostgresClose) Unmarshal(dAtA []byte) error {
+func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77262,10 +88533,10 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PostgresClose: wiretype end group for non-group")
+			return fmt.Errorf("proto: DiscoveryConfigDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PostgresClose: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DiscoveryConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -77336,7 +88607,40 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77363,13 +88667,64 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DiscoveryConfigDeleteAll) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DiscoveryConfigDeleteAll: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DiscoveryConfigDeleteAll: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77396,15 +88751,15 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -77414,29 +88769,30 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StatementName = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PortalName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -77446,23 +88802,24 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PortalName = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -77486,7 +88843,7 @@ func (m *PostgresClose) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
+func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77509,10 +88866,10 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PostgresFunctionCall: wiretype end group for non-group")
+			return fmt.Errorf("proto: IntegrationCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PostgresFunctionCall: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: IntegrationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -77583,7 +88940,7 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77610,13 +88967,13 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77643,34 +89000,15 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FunctionOID", wireType)
-			}
-			m.FunctionOID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.FunctionOID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FunctionArgs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -77680,23 +89018,24 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FunctionArgs = append(m.FunctionArgs, string(dAtA[iNdEx:postIndex]))
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -77720,7 +89059,7 @@ func (m *PostgresFunctionCall) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
+func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77743,10 +89082,10 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WindowsDesktopSessionStart: wiretype end group for non-group")
+			return fmt.Errorf("proto: IntegrationUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WindowsDesktopSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: IntegrationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -77817,7 +89156,7 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77844,13 +89183,13 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77877,13 +89216,13 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -77910,47 +89249,66 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WindowsDesktopService = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IntegrationDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IntegrationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -77960,29 +89318,30 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -77992,29 +89351,30 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Domain = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsUser", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78024,27 +89384,28 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WindowsUser = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78071,109 +89432,15 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.DesktopLabels == nil {
-				m.DesktopLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.DesktopLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 11:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78183,64 +89450,25 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 12:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllowUserCreation", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.AllowUserCreation = bool(v != 0)
-		case 13:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NLA", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.NLA = bool(v != 0)
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -78263,7 +89491,7 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
+func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -78286,17 +89514,17 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseSessionEnd: wiretype end group for non-group")
+			return fmt.Errorf("proto: IntegrationMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: IntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78306,28 +89534,27 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SubKind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSOIDC", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78354,13 +89581,16 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.AWSOIDC == nil {
+				m.AWSOIDC = &AWSOIDCIntegrationMetadata{}
+			}
+			if err := m.AWSOIDC.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AzureOIDC", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78387,46 +89617,16 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.AzureOIDC == nil {
+				m.AzureOIDC = &AzureOIDCIntegrationMetadata{}
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AzureOIDC.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GitHub", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78453,13 +89653,16 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
+			if m.GitHub == nil {
+				m.GitHub = &GitHubIntegrationMetadata{}
+			}
+			if err := m.GitHub.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRA", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78486,7 +89689,10 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
+			if m.AWSRA == nil {
+				m.AWSRA = &AWSRAIntegrationMetadata{}
+			}
+			if err := m.AWSRA.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -78512,7 +89718,7 @@ func (m *DatabaseSessionEnd) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
+func (m *AWSOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -78535,15 +89741,15 @@ func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MFADeviceMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: AWSOIDCIntegrationMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MFADeviceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AWSOIDCIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RoleARN", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -78571,43 +89777,11 @@ func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceName = string(dAtA[iNdEx:postIndex])
+			m.RoleARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.DeviceID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IssuerS3URI", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -78635,7 +89809,7 @@ func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceType = string(dAtA[iNdEx:postIndex])
+			m.IssuerS3URI = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -78659,7 +89833,7 @@ func (m *MFADeviceMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
+func (m *AzureOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -78682,17 +89856,17 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MFADeviceAdd: wiretype end group for non-group")
+			return fmt.Errorf("proto: AzureOIDCIntegrationMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MFADeviceAdd: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AzureOIDCIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TenantID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78702,30 +89876,29 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.TenantID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78735,30 +89908,80 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.ClientID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			iNdEx = postIndex
-		case 3:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GitHubIntegrationMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GitHubIntegrationMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GitHubIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Organization", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78768,30 +89991,80 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.MFADeviceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Organization = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			iNdEx = postIndex
-		case 4:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSRAIntegrationMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSRAIntegrationMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSRAIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustAnchorARN", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -78801,24 +90074,23 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.TrustAnchorARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -78842,7 +90114,7 @@ func (m *MFADeviceAdd) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
+func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -78865,10 +90137,10 @@ func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MFADeviceDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: PluginCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MFADeviceDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PluginCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -78939,7 +90211,7 @@ func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -78966,11 +90238,44 @@ func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.MFADeviceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -79025,7 +90330,7 @@ func (m *MFADeviceDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BillingInformationUpdate) Unmarshal(dAtA []byte) error {
+func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -79048,10 +90353,10 @@ func (m *BillingInformationUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BillingInformationUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: PluginUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BillingInformationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PluginUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -79120,60 +90425,42 @@ func (m *BillingInformationUpdate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *BillingCardCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: BillingCardCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BillingCardCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79200,13 +90487,13 @@ func (m *BillingCardCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79233,7 +90520,7 @@ func (m *BillingCardCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -79259,7 +90546,7 @@ func (m *BillingCardCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BillingCardDelete) Unmarshal(dAtA []byte) error {
+func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -79282,10 +90569,10 @@ func (m *BillingCardDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BillingCardDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: PluginDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BillingCardDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PluginDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -79354,60 +90641,42 @@ func (m *BillingCardDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *LockCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: LockCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: LockCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79434,13 +90703,13 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79467,15 +90736,66 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -79485,30 +90805,49 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.PluginType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HasCredentials", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
+			m.HasCredentials = bool(v != 0)
 		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReusesCredentials", wireType)
 			}
-			var msglen int
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -79518,28 +90857,15 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
+			m.ReusesCredentials = bool(v != 0)
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Lock", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79566,7 +90892,10 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Lock.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.PluginData == nil {
+				m.PluginData = &Struct{}
+			}
+			if err := m.PluginData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -79592,7 +90921,7 @@ func (m *LockCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *LockDelete) Unmarshal(dAtA []byte) error {
+func (m *OneOf) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -79615,15 +90944,15 @@ func (m *LockDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: LockDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: OneOf: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: LockDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OneOf: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserLogin", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79650,13 +90979,15 @@ func (m *LockDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UserLogin{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UserLogin{v}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79683,13 +91014,15 @@ func (m *LockDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UserCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UserCreate{v}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79716,13 +91049,15 @@ func (m *LockDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UserDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UserDelete{v}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Lock", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserPasswordChange", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79749,64 +91084,15 @@ func (m *LockDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Lock.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UserPasswordChange{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UserPasswordChange{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *RecoveryCodeGenerate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: RecoveryCodeGenerate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RecoveryCodeGenerate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionStart", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79833,13 +91119,15 @@ func (m *RecoveryCodeGenerate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionStart{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionStart{v}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionJoin", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79866,64 +91154,15 @@ func (m *RecoveryCodeGenerate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionJoin{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionJoin{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *RecoveryCodeUsed) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: RecoveryCodeUsed: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RecoveryCodeUsed: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionPrint", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79950,13 +91189,15 @@ func (m *RecoveryCodeUsed) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionPrint{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionPrint{v}
 			iNdEx = postIndex
-		case 2:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionReject", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -79983,13 +91224,15 @@ func (m *RecoveryCodeUsed) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionReject{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionReject{v}
 			iNdEx = postIndex
-		case 3:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Resize", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80016,64 +91259,15 @@ func (m *RecoveryCodeUsed) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &Resize{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_Resize{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WindowsDesktopSessionEnd: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WindowsDesktopSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionEnd", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80100,13 +91294,15 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionEnd{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionEnd{v}
 			iNdEx = postIndex
-		case 2:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionCommand", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80133,13 +91329,15 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionCommand{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionCommand{v}
 			iNdEx = postIndex
-		case 3:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionDisk", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80166,15 +91364,17 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionDisk{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionDisk{v}
 			iNdEx = postIndex
-		case 4:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopService", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionNetwork", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80184,29 +91384,32 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WindowsDesktopService = string(dAtA[iNdEx:postIndex])
+			v := &SessionNetwork{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_SessionNetwork{v}
 			iNdEx = postIndex
-		case 5:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionData", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80216,29 +91419,32 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DesktopAddr = string(dAtA[iNdEx:postIndex])
+			v := &SessionData{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_SessionData{v}
 			iNdEx = postIndex
-		case 6:
+		case 15:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionLeave", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80248,29 +91454,32 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Domain = string(dAtA[iNdEx:postIndex])
+			v := &SessionLeave{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_SessionLeave{v}
 			iNdEx = postIndex
-		case 7:
+		case 16:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsUser", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PortForward", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80280,27 +91489,30 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WindowsUser = string(dAtA[iNdEx:postIndex])
+			v := &PortForward{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_PortForward{v}
 			iNdEx = postIndex
-		case 8:
+		case 17:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field X11Forward", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80327,107 +91539,15 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.DesktopLabels == nil {
-				m.DesktopLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			v := &X11Forward{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.DesktopLabels[mapkey] = mapvalue
+			m.Event = &OneOf_X11Forward{v}
 			iNdEx = postIndex
-		case 9:
+		case 18:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SCP", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80454,13 +91574,15 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
+			v := &SCP{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SCP{v}
 			iNdEx = postIndex
-		case 10:
+		case 19:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Exec", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80487,15 +91609,17 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
+			v := &Exec{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_Exec{v}
 			iNdEx = postIndex
-		case 11:
+		case 20:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Subsystem", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80505,49 +91629,32 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.DesktopName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 12:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Recorded", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+				return io.ErrUnexpectedEOF
 			}
-			m.Recorded = bool(v != 0)
-		case 13:
+			v := &Subsystem{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_Subsystem{v}
+			iNdEx = postIndex
+		case 21:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Participants", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientDisconnect", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80557,78 +91664,30 @@ func (m *WindowsDesktopSessionEnd) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Participants = append(m.Participants, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &ClientDisconnect{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_ClientDisconnect{v}
+			iNdEx = postIndex
+		case 22:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthAttempt", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80655,15 +91714,17 @@ func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AuthAttempt{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AuthAttempt{v}
 			iNdEx = postIndex
-		case 2:
+		case 23:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CertificateType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -80673,27 +91734,30 @@ func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CertificateType = string(dAtA[iNdEx:postIndex])
+			v := &AccessRequestCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AccessRequestCreate{v}
 			iNdEx = postIndex
-		case 3:
+		case 24:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Identity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTokenCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80720,16 +91784,15 @@ func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Identity == nil {
-				m.Identity = &Identity{}
-			}
-			if err := m.Identity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UserTokenCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UserTokenCreate{v}
 			iNdEx = postIndex
-		case 4:
+		case 25:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RoleCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80756,64 +91819,15 @@ func (m *CertificateCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ClientMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &RoleCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_RoleCreate{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: RenewableCertificateGenerationMismatch: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RenewableCertificateGenerationMismatch: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 26:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RoleDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80840,13 +91854,15 @@ func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &RoleDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_RoleDelete{v}
 			iNdEx = postIndex
-		case 2:
+		case 27:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80873,64 +91889,15 @@ func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &TrustedClusterCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_TrustedClusterCreate{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *BotJoin) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: BotJoin: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BotJoin: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 28:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80957,13 +91924,15 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &TrustedClusterDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_TrustedClusterDelete{v}
 			iNdEx = postIndex
-		case 2:
+		case 29:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterTokenCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -80990,15 +91959,17 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &TrustedClusterTokenCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_TrustedClusterTokenCreate{v}
 			iNdEx = postIndex
-		case 3:
+		case 30:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81008,29 +91979,32 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BotName = string(dAtA[iNdEx:postIndex])
+			v := &GithubConnectorCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_GithubConnectorCreate{v}
 			iNdEx = postIndex
-		case 4:
+		case 31:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorDelete", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81040,29 +92014,32 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
+			v := &GithubConnectorDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_GithubConnectorDelete{v}
 			iNdEx = postIndex
-		case 5:
+		case 32:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81072,27 +92049,30 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TokenName = string(dAtA[iNdEx:postIndex])
+			v := &OIDCConnectorCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_OIDCConnectorCreate{v}
 			iNdEx = postIndex
-		case 6:
+		case 33:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81119,18 +92099,17 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Attributes == nil {
-				m.Attributes = &Struct{}
-			}
-			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &OIDCConnectorDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_OIDCConnectorDelete{v}
 			iNdEx = postIndex
-		case 7:
+		case 34:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81140,27 +92119,30 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UserName = string(dAtA[iNdEx:postIndex])
+			v := &SAMLConnectorCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_SAMLConnectorCreate{v}
 			iNdEx = postIndex
-		case 8:
+		case 35:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81187,15 +92169,17 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLConnectorDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLConnectorDelete{v}
 			iNdEx = postIndex
-		case 9:
+		case 36:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeRequest", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81205,78 +92189,30 @@ func (m *BotJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &KubeRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: InstanceJoin: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: InstanceJoin: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_KubeRequest{v}
+			iNdEx = postIndex
+		case 37:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionStart", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81303,13 +92239,15 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AppSessionStart{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AppSessionStart{v}
 			iNdEx = postIndex
-		case 2:
+		case 38:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionChunk", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81336,15 +92274,17 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AppSessionChunk{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AppSessionChunk{v}
 			iNdEx = postIndex
-		case 3:
+		case 39:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HostID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionRequest", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81354,29 +92294,32 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.HostID = string(dAtA[iNdEx:postIndex])
+			v := &AppSessionRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AppSessionRequest{v}
 			iNdEx = postIndex
-		case 4:
+		case 40:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionStart", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81386,29 +92329,32 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.NodeName = string(dAtA[iNdEx:postIndex])
+			v := &DatabaseSessionStart{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseSessionStart{v}
 			iNdEx = postIndex
-		case 5:
+		case 41:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionEnd", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81418,29 +92364,32 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Role = string(dAtA[iNdEx:postIndex])
+			v := &DatabaseSessionEnd{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseSessionEnd{v}
 			iNdEx = postIndex
-		case 6:
+		case 42:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionQuery", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81450,29 +92399,32 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
+			v := &DatabaseSessionQuery{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseSessionQuery{v}
 			iNdEx = postIndex
-		case 7:
+		case 43:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionUpload", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81482,27 +92434,30 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TokenName = string(dAtA[iNdEx:postIndex])
+			v := &SessionUpload{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_SessionUpload{v}
 			iNdEx = postIndex
-		case 8:
+		case 44:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceAdd", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81529,16 +92484,15 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Attributes == nil {
-				m.Attributes = &Struct{}
-			}
-			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MFADeviceAdd{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MFADeviceAdd{v}
 			iNdEx = postIndex
-		case 9:
+		case 45:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TokenExpires", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81565,13 +92519,15 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.TokenExpires, dAtA[iNdEx:postIndex]); err != nil {
+			v := &MFADeviceDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MFADeviceDelete{v}
 			iNdEx = postIndex
-		case 10:
+		case 46:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BillingInformationUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81598,64 +92554,15 @@ func (m *InstanceJoin) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &BillingInformationUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_BillingInformationUpdate{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Unknown) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 47:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BillingCardCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -81682,15 +92589,17 @@ func (m *Unknown) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &BillingCardCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_BillingCardCreate{v}
 			iNdEx = postIndex
-		case 2:
+		case 48:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UnknownType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BillingCardDelete", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81700,29 +92609,32 @@ func (m *Unknown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UnknownType = string(dAtA[iNdEx:postIndex])
+			v := &BillingCardDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_BillingCardDelete{v}
 			iNdEx = postIndex
-		case 3:
+		case 49:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UnknownCode", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LockCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81732,29 +92644,32 @@ func (m *Unknown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UnknownCode = string(dAtA[iNdEx:postIndex])
+			v := &LockCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_LockCreate{v}
 			iNdEx = postIndex
-		case 4:
+		case 50:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LockDelete", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81764,80 +92679,32 @@ func (m *Unknown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Data = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &LockDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_LockDelete{v}
+			iNdEx = postIndex
+		case 51:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCodeGenerate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81847,29 +92714,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceId = string(dAtA[iNdEx:postIndex])
+			v := &RecoveryCodeGenerate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_RecoveryCodeGenerate{v}
 			iNdEx = postIndex
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OsType", wireType)
+		case 52:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCodeUsed", wireType)
 			}
-			m.OsType = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81879,16 +92749,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.OsType |= OSType(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 3:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RecoveryCodeUsed{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_RecoveryCodeUsed{v}
+			iNdEx = postIndex
+		case 53:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AssetTag", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81898,29 +92784,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AssetTag = string(dAtA[iNdEx:postIndex])
+			v := &DatabaseCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseCreate{v}
 			iNdEx = postIndex
-		case 4:
+		case 54:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CredentialId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUpdate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81930,29 +92819,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CredentialId = string(dAtA[iNdEx:postIndex])
+			v := &DatabaseUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseUpdate{v}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceOrigin", wireType)
+		case 55:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseDelete", wireType)
 			}
-			m.DeviceOrigin = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81962,16 +92854,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DeviceOrigin |= DeviceOrigin(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WebAuthentication", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			var v int
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &DatabaseDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DatabaseDelete{v}
+			iNdEx = postIndex
+		case 56:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AppCreate", wireType)
+			}
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -81981,17 +92889,32 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.WebAuthentication = bool(v != 0)
-		case 8:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &AppCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AppCreate{v}
+			iNdEx = postIndex
+		case 57:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WebAuthenticationId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppUpdate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -82001,78 +92924,30 @@ func (m *DeviceMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WebAuthenticationId = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &AppUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceEvent: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceEvent: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_AppUpdate{v}
+			iNdEx = postIndex
+		case 58:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82099,13 +92974,15 @@ func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AppDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AppDelete{v}
 			iNdEx = postIndex
-		case 2:
+		case 59:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopSessionStart", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82132,16 +93009,15 @@ func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Status == nil {
-				m.Status = &Status{}
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &WindowsDesktopSessionStart{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_WindowsDesktopSessionStart{v}
 			iNdEx = postIndex
-		case 3:
+		case 60:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopSessionEnd", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82168,16 +93044,15 @@ func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Device == nil {
-				m.Device = &DeviceMetadata{}
-			}
-			if err := m.Device.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &WindowsDesktopSessionEnd{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_WindowsDesktopSessionEnd{v}
 			iNdEx = postIndex
-		case 4:
+		case 61:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresParse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82199,72 +93074,20 @@ func (m *DeviceEvent) Unmarshal(dAtA []byte) error {
 			}
 			postIndex := iNdEx + msglen
 			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.User == nil {
-				m.User = &UserMetadata{}
-			}
-			if err := m.User.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceEvent2: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceEvent2: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &PostgresParse{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_PostgresParse{v}
+			iNdEx = postIndex
+		case 62:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresBind", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82291,13 +93114,15 @@ func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &PostgresBind{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_PostgresBind{v}
 			iNdEx = postIndex
-		case 3:
+		case 63:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresExecute", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82324,16 +93149,15 @@ func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Device == nil {
-				m.Device = &DeviceMetadata{}
-			}
-			if err := m.Device.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &PostgresExecute{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_PostgresExecute{v}
 			iNdEx = postIndex
-		case 5:
+		case 64:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresClose", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82360,13 +93184,15 @@ func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &PostgresClose{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_PostgresClose{v}
 			iNdEx = postIndex
-		case 6:
+		case 65:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PostgresFunctionCall", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82393,64 +93219,15 @@ func (m *DeviceEvent2) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &PostgresFunctionCall{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_PostgresFunctionCall{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DiscoveryConfigCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DiscoveryConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 66:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82477,13 +93254,15 @@ func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AccessRequestDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AccessRequestDelete{v}
 			iNdEx = postIndex
-		case 2:
+		case 67:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionConnect", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82510,13 +93289,15 @@ func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionConnect{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionConnect{v}
 			iNdEx = postIndex
-		case 3:
+		case 68:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CertificateCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82543,13 +93324,15 @@ func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &CertificateCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_CertificateCreate{v}
 			iNdEx = postIndex
-		case 4:
+		case 69:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopRecording", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82576,64 +93359,15 @@ func (m *DiscoveryConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DesktopRecording{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DesktopRecording{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DiscoveryConfigUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DiscoveryConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 70:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopClipboardSend", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82660,13 +93394,15 @@ func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DesktopClipboardSend{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DesktopClipboardSend{v}
 			iNdEx = postIndex
-		case 2:
+		case 71:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopClipboardReceive", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82693,13 +93429,15 @@ func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DesktopClipboardReceive{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DesktopClipboardReceive{v}
 			iNdEx = postIndex
-		case 3:
+		case 72:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementPrepare", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82726,13 +93464,15 @@ func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementPrepare{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementPrepare{v}
 			iNdEx = postIndex
-		case 4:
+		case 73:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementExecute", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82759,64 +93499,15 @@ func (m *DiscoveryConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementExecute{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementExecute{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DiscoveryConfigDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DiscoveryConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 74:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementSendLongData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82843,13 +93534,15 @@ func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementSendLongData{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementSendLongData{v}
 			iNdEx = postIndex
-		case 2:
+		case 75:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementClose", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82876,13 +93569,15 @@ func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementClose{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementClose{v}
 			iNdEx = postIndex
-		case 3:
+		case 76:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementReset", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82909,13 +93604,15 @@ func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementReset{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementReset{v}
 			iNdEx = postIndex
-		case 4:
+		case 77:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementFetch", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -82942,64 +93639,15 @@ func (m *DiscoveryConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementFetch{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementFetch{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DiscoveryConfigDeleteAll) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DiscoveryConfigDeleteAll: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DiscoveryConfigDeleteAll: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 78:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementBulkExecute", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83026,13 +93674,15 @@ func (m *DiscoveryConfigDeleteAll) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLStatementBulkExecute{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLStatementBulkExecute{v}
 			iNdEx = postIndex
-		case 2:
+		case 79:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RenewableCertificateGenerationMismatch", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83059,13 +93709,15 @@ func (m *DiscoveryConfigDeleteAll) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &RenewableCertificateGenerationMismatch{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_RenewableCertificateGenerationMismatch{v}
 			iNdEx = postIndex
-		case 3:
+		case 80:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Unknown", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83092,64 +93744,15 @@ func (m *DiscoveryConfigDeleteAll) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &Unknown{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_Unknown{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: IntegrationCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IntegrationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 81:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLInitDB", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83176,13 +93779,15 @@ func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLInitDB{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLInitDB{v}
 			iNdEx = postIndex
-		case 2:
+		case 82:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLCreateDB", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83209,13 +93814,15 @@ func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLCreateDB{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLCreateDB{v}
 			iNdEx = postIndex
-		case 3:
+		case 83:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLDropDB", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83242,13 +93849,15 @@ func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLDropDB{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLDropDB{v}
 			iNdEx = postIndex
-		case 4:
+		case 84:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLShutDown", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83275,13 +93884,15 @@ func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLShutDown{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLShutDown{v}
 			iNdEx = postIndex
-		case 5:
+		case 85:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLProcessKill", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83308,64 +93919,15 @@ func (m *IntegrationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &MySQLProcessKill{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: IntegrationUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IntegrationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_MySQLProcessKill{v}
+			iNdEx = postIndex
+		case 86:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLDebug", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83392,13 +93954,15 @@ func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLDebug{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLDebug{v}
 			iNdEx = postIndex
-		case 2:
+		case 87:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MySQLRefresh", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83425,13 +93989,15 @@ func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &MySQLRefresh{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_MySQLRefresh{v}
 			iNdEx = postIndex
-		case 3:
+		case 88:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestResourceSearch", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83458,13 +94024,15 @@ func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AccessRequestResourceSearch{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AccessRequestResourceSearch{v}
 			iNdEx = postIndex
-		case 4:
+		case 89:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SQLServerRPCRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83491,13 +94059,15 @@ func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SQLServerRPCRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SQLServerRPCRequest{v}
 			iNdEx = postIndex
-		case 5:
+		case 90:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionMalformedPacket", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83524,64 +94094,15 @@ func (m *IntegrationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DatabaseSessionMalformedPacket{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DatabaseSessionMalformedPacket{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: IntegrationDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IntegrationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 91:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SFTP", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83608,13 +94129,15 @@ func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SFTP{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SFTP{v}
 			iNdEx = postIndex
-		case 2:
+		case 92:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStartUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83641,13 +94164,15 @@ func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &UpgradeWindowStartUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_UpgradeWindowStartUpdate{v}
 			iNdEx = postIndex
-		case 3:
+		case 93:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionEnd", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83674,13 +94199,15 @@ func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AppSessionEnd{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AppSessionEnd{v}
 			iNdEx = postIndex
-		case 4:
+		case 94:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingAccess", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83707,13 +94234,15 @@ func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.IntegrationMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SessionRecordingAccess{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SessionRecordingAccess{v}
 			iNdEx = postIndex
-		case 5:
+		case 96:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83740,66 +94269,17 @@ func (m *IntegrationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &KubernetesClusterCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_KubernetesClusterCreate{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: IntegrationMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: IntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 97:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterUpdate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -83809,27 +94289,30 @@ func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubKind = string(dAtA[iNdEx:postIndex])
+			v := &KubernetesClusterUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_KubernetesClusterUpdate{v}
 			iNdEx = postIndex
-		case 2:
+		case 98:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSOIDC", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83856,16 +94339,15 @@ func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AWSOIDC == nil {
-				m.AWSOIDC = &AWSOIDCIntegrationMetadata{}
-			}
-			if err := m.AWSOIDC.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &KubernetesClusterDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_KubernetesClusterDelete{v}
 			iNdEx = postIndex
-		case 3:
+		case 99:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AzureOIDC", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SSMRun", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83892,16 +94374,15 @@ func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AzureOIDC == nil {
-				m.AzureOIDC = &AzureOIDCIntegrationMetadata{}
-			}
-			if err := m.AzureOIDC.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SSMRun{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SSMRun{v}
 			iNdEx = postIndex
-		case 4:
+		case 100:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GitHub", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ElasticsearchRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83928,16 +94409,15 @@ func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.GitHub == nil {
-				m.GitHub = &GitHubIntegrationMetadata{}
-			}
-			if err := m.GitHub.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &ElasticsearchRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_ElasticsearchRequest{v}
 			iNdEx = postIndex
-		case 5:
+		case 101:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRA", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CassandraBatch", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -83964,69 +94444,52 @@ func (m *IntegrationMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AWSRA == nil {
-				m.AWSRA = &AWSRAIntegrationMetadata{}
-			}
-			if err := m.AWSRA.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &CassandraBatch{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_CassandraBatch{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 102:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CassandraPrepare", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AWSOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			v := &CassandraPrepare{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AWSOIDCIntegrationMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSOIDCIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_CassandraPrepare{v}
+			iNdEx = postIndex
+		case 103:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RoleARN", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CassandraRegister", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84036,29 +94499,32 @@ func (m *AWSOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RoleARN = string(dAtA[iNdEx:postIndex])
+			v := &CassandraRegister{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_CassandraRegister{v}
 			iNdEx = postIndex
-		case 2:
+		case 104:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IssuerS3URI", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CassandraExecute", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84068,80 +94534,32 @@ func (m *AWSOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IssuerS3URI = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &CassandraExecute{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AzureOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AzureOIDCIntegrationMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AzureOIDCIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_CassandraExecute{v}
+			iNdEx = postIndex
+		case 105:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TenantID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionDynamoDBRequest", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84151,29 +94569,32 @@ func (m *AzureOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TenantID = string(dAtA[iNdEx:postIndex])
+			v := &AppSessionDynamoDBRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AppSessionDynamoDBRequest{v}
 			iNdEx = postIndex
-		case 2:
+		case 106:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryStart", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84183,80 +94604,67 @@ func (m *AzureOIDCIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClientID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &DesktopSharedDirectoryStart{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			m.Event = &OneOf_DesktopSharedDirectoryStart{v}
+			iNdEx = postIndex
+		case 107:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryRead", wireType)
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GitHubIntegrationMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GitHubIntegrationMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GitHubIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			v := &DesktopSharedDirectoryRead{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_DesktopSharedDirectoryRead{v}
+			iNdEx = postIndex
+		case 108:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Organization", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryWrite", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84266,80 +94674,32 @@ func (m *GitHubIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Organization = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &DesktopSharedDirectoryWrite{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AWSRAIntegrationMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AWSRAIntegrationMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSRAIntegrationMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_DesktopSharedDirectoryWrite{v}
+			iNdEx = postIndex
+		case 109:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TrustAnchorARN", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DynamoDBRequest", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -84349,78 +94709,30 @@ func (m *AWSRAIntegrationMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TrustAnchorARN = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			v := &DynamoDBRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_DynamoDBRequest{v}
+			iNdEx = postIndex
+		case 110:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotJoin", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84447,13 +94759,15 @@ func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &BotJoin{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_BotJoin{v}
 			iNdEx = postIndex
-		case 2:
+		case 111:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceJoin", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84480,13 +94794,15 @@ func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &InstanceJoin{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_InstanceJoin{v}
 			iNdEx = postIndex
-		case 3:
+		case 112:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceEvent", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84513,13 +94829,15 @@ func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DeviceEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DeviceEvent{v}
 			iNdEx = postIndex
-		case 4:
+		case 113:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LoginRuleCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84546,13 +94864,15 @@ func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &LoginRuleCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_LoginRuleCreate{v}
 			iNdEx = postIndex
-		case 5:
+		case 114:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LoginRuleDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84579,64 +94899,15 @@ func (m *PluginCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &LoginRuleDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_LoginRuleDelete{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 115:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPAuthAttempt", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84663,13 +94934,15 @@ func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLIdPAuthAttempt{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLIdPAuthAttempt{v}
 			iNdEx = postIndex
-		case 2:
+		case 116:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84696,13 +94969,15 @@ func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLIdPServiceProviderCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLIdPServiceProviderCreate{v}
 			iNdEx = postIndex
-		case 3:
+		case 117:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84729,13 +95004,15 @@ func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLIdPServiceProviderUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLIdPServiceProviderUpdate{v}
 			iNdEx = postIndex
-		case 4:
+		case 118:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84762,13 +95039,15 @@ func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLIdPServiceProviderDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLIdPServiceProviderDelete{v}
 			iNdEx = postIndex
-		case 5:
+		case 119:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderDeleteAll", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84795,64 +95074,15 @@ func (m *PluginUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &SAMLIdPServiceProviderDeleteAll{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_SAMLIdPServiceProviderDeleteAll{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 120:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OpenSearchRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84879,13 +95109,15 @@ func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &OpenSearchRequest{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_OpenSearchRequest{v}
 			iNdEx = postIndex
-		case 2:
+		case 121:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceEvent2", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84912,13 +95144,15 @@ func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &DeviceEvent2{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_DeviceEvent2{v}
 			iNdEx = postIndex
-		case 3:
+		case 122:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaResourcesUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84945,13 +95179,15 @@ func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &OktaResourcesUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_OktaResourcesUpdate{v}
 			iNdEx = postIndex
-		case 4:
+		case 123:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaSyncFailure", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -84978,13 +95214,15 @@ func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.PluginMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &OktaSyncFailure{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_OktaSyncFailure{v}
 			iNdEx = postIndex
-		case 5:
+		case 124:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaAssignmentResult", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85011,66 +95249,52 @@ func (m *PluginDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &OktaAssignmentResult{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_OktaAssignmentResult{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 125:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProvisionTokenCreate", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			v := &ProvisionTokenCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_ProvisionTokenCreate{v}
+			iNdEx = postIndex
+		case 126:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListCreate", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -85080,29 +95304,32 @@ func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PluginType = string(dAtA[iNdEx:postIndex])
+			v := &AccessListCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AccessListCreate{v}
 			iNdEx = postIndex
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HasCredentials", wireType)
+		case 127:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListUpdate", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -85112,17 +95339,32 @@ func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.HasCredentials = bool(v != 0)
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReusesCredentials", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			var v int
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &AccessListUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AccessListUpdate{v}
+			iNdEx = postIndex
+		case 128:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListDelete", wireType)
+			}
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -85132,15 +95374,30 @@ func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.ReusesCredentials = bool(v != 0)
-		case 5:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &AccessListDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_AccessListDelete{v}
+			iNdEx = postIndex
+		case 129:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListReview", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85167,67 +95424,120 @@ func (m *PluginMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.PluginData == nil {
-				m.PluginData = &Struct{}
-			}
-			if err := m.PluginData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			v := &AccessListReview{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
+			m.Event = &OneOf_AccessListReview{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+		case 130:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberCreate", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &AccessListMemberCreate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			m.Event = &OneOf_AccessListMemberCreate{v}
+			iNdEx = postIndex
+		case 131:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberUpdate", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *OneOf) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			v := &AccessListMemberUpdate{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if iNdEx >= l {
+			m.Event = &OneOf_AccessListMemberUpdate{v}
+			iNdEx = postIndex
+		case 132:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberDelete", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			v := &AccessListMemberDelete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OneOf: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OneOf: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Event = &OneOf_AccessListMemberDelete{v}
+			iNdEx = postIndex
+		case 133:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserLogin", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberDeleteAllForAccessList", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85254,15 +95564,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserLogin{}
+			v := &AccessListMemberDeleteAllForAccessList{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserLogin{v}
+			m.Event = &OneOf_AccessListMemberDeleteAllForAccessList{v}
 			iNdEx = postIndex
-		case 2:
+		case 134:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueryRun", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85289,15 +95599,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserCreate{}
+			v := &AuditQueryRun{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserCreate{v}
+			m.Event = &OneOf_AuditQueryRun{v}
 			iNdEx = postIndex
-		case 3:
+		case 135:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SecurityReportRun", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85324,15 +95634,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserDelete{}
+			v := &SecurityReportRun{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserDelete{v}
+			m.Event = &OneOf_SecurityReportRun{v}
 			iNdEx = postIndex
-		case 4:
+		case 136:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserPasswordChange", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85359,15 +95669,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserPasswordChange{}
+			v := &GithubConnectorUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserPasswordChange{v}
+			m.Event = &OneOf_GithubConnectorUpdate{v}
 			iNdEx = postIndex
-		case 5:
+		case 137:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85394,15 +95704,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionStart{}
+			v := &OIDCConnectorUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionStart{v}
+			m.Event = &OneOf_OIDCConnectorUpdate{v}
 			iNdEx = postIndex
-		case 6:
+		case 138:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionJoin", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85429,15 +95739,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionJoin{}
+			v := &SAMLConnectorUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionJoin{v}
+			m.Event = &OneOf_SAMLConnectorUpdate{v}
 			iNdEx = postIndex
-		case 7:
+		case 139:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionPrint", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RoleUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85464,15 +95774,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionPrint{}
+			v := &RoleUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionPrint{v}
+			m.Event = &OneOf_RoleUpdate{v}
 			iNdEx = postIndex
-		case 8:
+		case 140:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionReject", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85499,15 +95809,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionReject{}
+			v := &UserUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionReject{v}
+			m.Event = &OneOf_UserUpdate{v}
 			iNdEx = postIndex
-		case 9:
+		case 141:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resize", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalAuditStorageEnable", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85534,15 +95844,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &Resize{}
+			v := &ExternalAuditStorageEnable{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_Resize{v}
+			m.Event = &OneOf_ExternalAuditStorageEnable{v}
 			iNdEx = postIndex
-		case 10:
+		case 142:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionEnd", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalAuditStorageDisable", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85569,15 +95879,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionEnd{}
+			v := &ExternalAuditStorageDisable{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionEnd{v}
+			m.Event = &OneOf_ExternalAuditStorageDisable{v}
 			iNdEx = postIndex
-		case 11:
+		case 143:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionCommand", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85604,15 +95914,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionCommand{}
+			v := &BotCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionCommand{v}
+			m.Event = &OneOf_BotCreate{v}
 			iNdEx = postIndex
-		case 12:
+		case 144:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionDisk", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85639,15 +95949,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionDisk{}
+			v := &BotDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionDisk{v}
+			m.Event = &OneOf_BotDelete{v}
 			iNdEx = postIndex
-		case 13:
+		case 145:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionNetwork", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85674,15 +95984,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionNetwork{}
+			v := &BotUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionNetwork{v}
+			m.Event = &OneOf_BotUpdate{v}
 			iNdEx = postIndex
-		case 14:
+		case 146:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CreateMFAAuthChallenge", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85709,15 +96019,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionData{}
+			v := &CreateMFAAuthChallenge{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionData{v}
+			m.Event = &OneOf_CreateMFAAuthChallenge{v}
 			iNdEx = postIndex
-		case 15:
+		case 147:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionLeave", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ValidateMFAAuthResponse", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85744,15 +96054,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionLeave{}
+			v := &ValidateMFAAuthResponse{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionLeave{v}
+			m.Event = &OneOf_ValidateMFAAuthResponse{v}
 			iNdEx = postIndex
-		case 16:
+		case 148:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PortForward", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaAccessListSync", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85779,15 +96089,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PortForward{}
+			v := &OktaAccessListSync{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PortForward{v}
+			m.Event = &OneOf_OktaAccessListSync{v}
 			iNdEx = postIndex
-		case 17:
+		case 149:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field X11Forward", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabasePermissionUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85814,15 +96124,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &X11Forward{}
+			v := &DatabasePermissionUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_X11Forward{v}
+			m.Event = &OneOf_DatabasePermissionUpdate{v}
 			iNdEx = postIndex
-		case 18:
+		case 150:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SCP", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFESVIDIssued", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85849,15 +96159,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SCP{}
+			v := &SPIFFESVIDIssued{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SCP{v}
+			m.Event = &OneOf_SPIFFESVIDIssued{v}
 			iNdEx = postIndex
-		case 19:
+		case 151:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Exec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaUserSync", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85884,15 +96194,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &Exec{}
+			v := &OktaUserSync{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_Exec{v}
+			m.Event = &OneOf_OktaUserSync{v}
 			iNdEx = postIndex
-		case 20:
+		case 152:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Subsystem", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthPreferenceUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85919,15 +96229,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &Subsystem{}
+			v := &AuthPreferenceUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_Subsystem{v}
+			m.Event = &OneOf_AuthPreferenceUpdate{v}
 			iNdEx = postIndex
-		case 21:
+		case 153:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientDisconnect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85954,15 +96264,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ClientDisconnect{}
+			v := &SessionRecordingConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_ClientDisconnect{v}
+			m.Event = &OneOf_SessionRecordingConfigUpdate{v}
 			iNdEx = postIndex
-		case 22:
+		case 154:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuthAttempt", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterNetworkingConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -85989,15 +96299,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AuthAttempt{}
+			v := &ClusterNetworkingConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AuthAttempt{v}
+			m.Event = &OneOf_ClusterNetworkingConfigUpdate{v}
 			iNdEx = postIndex
-		case 23:
+		case 155:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUserCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86024,15 +96334,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessRequestCreate{}
+			v := &DatabaseUserCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessRequestCreate{v}
+			m.Event = &OneOf_DatabaseUserCreate{v}
 			iNdEx = postIndex
-		case 24:
+		case 156:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTokenCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUserDeactivate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86059,15 +96369,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserTokenCreate{}
+			v := &DatabaseUserDeactivate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserTokenCreate{v}
+			m.Event = &OneOf_DatabaseUserDeactivate{v}
 			iNdEx = postIndex
-		case 25:
+		case 157:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RoleCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessPathChanged", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86094,15 +96404,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RoleCreate{}
+			v := &AccessPathChanged{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_RoleCreate{v}
+			m.Event = &OneOf_AccessPathChanged{v}
 			iNdEx = postIndex
-		case 26:
+		case 158:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RoleDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SpannerRPC", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86129,15 +96439,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RoleDelete{}
+			v := &SpannerRPC{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_RoleDelete{v}
+			m.Event = &OneOf_SpannerRPC{v}
 			iNdEx = postIndex
-		case 27:
+		case 159:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionCommandResult", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86164,15 +96474,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &TrustedClusterCreate{}
+			v := &DatabaseSessionCommandResult{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_TrustedClusterCreate{v}
+			m.Event = &OneOf_DatabaseSessionCommandResult{v}
 			iNdEx = postIndex
-		case 28:
+		case 160:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86199,15 +96509,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &TrustedClusterDelete{}
+			v := &DiscoveryConfigCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_TrustedClusterDelete{v}
+			m.Event = &OneOf_DiscoveryConfigCreate{v}
 			iNdEx = postIndex
-		case 29:
+		case 161:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TrustedClusterTokenCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86234,15 +96544,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &TrustedClusterTokenCreate{}
+			v := &DiscoveryConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_TrustedClusterTokenCreate{v}
+			m.Event = &OneOf_DiscoveryConfigUpdate{v}
 			iNdEx = postIndex
-		case 30:
+		case 162:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86269,15 +96579,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &GithubConnectorCreate{}
+			v := &DiscoveryConfigDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_GithubConnectorCreate{v}
+			m.Event = &OneOf_DiscoveryConfigDelete{v}
 			iNdEx = postIndex
-		case 31:
+		case 163:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigDeleteAll", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86304,15 +96614,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &GithubConnectorDelete{}
+			v := &DiscoveryConfigDeleteAll{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_GithubConnectorDelete{v}
+			m.Event = &OneOf_DiscoveryConfigDeleteAll{v}
 			iNdEx = postIndex
-		case 32:
+		case 164:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessGraphSettingsUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86339,15 +96649,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OIDCConnectorCreate{}
+			v := &AccessGraphSettingsUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_OIDCConnectorCreate{v}
+			m.Event = &OneOf_AccessGraphSettingsUpdate{v}
 			iNdEx = postIndex
-		case 33:
+		case 165:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86374,15 +96684,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OIDCConnectorDelete{}
+			v := &IntegrationCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_OIDCConnectorDelete{v}
+			m.Event = &OneOf_IntegrationCreate{v}
 			iNdEx = postIndex
-		case 34:
+		case 166:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86409,15 +96719,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLConnectorCreate{}
+			v := &IntegrationUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SAMLConnectorCreate{v}
+			m.Event = &OneOf_IntegrationUpdate{v}
 			iNdEx = postIndex
-		case 35:
+		case 167:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86444,15 +96754,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLConnectorDelete{}
+			v := &IntegrationDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SAMLConnectorDelete{v}
+			m.Event = &OneOf_IntegrationDelete{v}
 			iNdEx = postIndex
-		case 36:
+		case 168:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEFederationCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86479,15 +96789,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &KubeRequest{}
+			v := &SPIFFEFederationCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_KubeRequest{v}
+			m.Event = &OneOf_SPIFFEFederationCreate{v}
 			iNdEx = postIndex
-		case 37:
+		case 169:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEFederationDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86514,15 +96824,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppSessionStart{}
+			v := &SPIFFEFederationDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppSessionStart{v}
+			m.Event = &OneOf_SPIFFEFederationDelete{v}
 			iNdEx = postIndex
-		case 38:
+		case 170:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionChunk", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86549,15 +96859,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppSessionChunk{}
+			v := &PluginCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppSessionChunk{v}
+			m.Event = &OneOf_PluginCreate{v}
 			iNdEx = postIndex
-		case 39:
+		case 171:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86584,15 +96894,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppSessionRequest{}
+			v := &PluginUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppSessionRequest{v}
+			m.Event = &OneOf_PluginUpdate{v}
 			iNdEx = postIndex
-		case 40:
+		case 172:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PluginDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86619,15 +96929,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseSessionStart{}
+			v := &PluginDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseSessionStart{v}
+			m.Event = &OneOf_PluginDelete{v}
 			iNdEx = postIndex
-		case 41:
+		case 173:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionEnd", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86654,15 +96964,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseSessionEnd{}
+			v := &AutoUpdateConfigCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseSessionEnd{v}
+			m.Event = &OneOf_AutoUpdateConfigCreate{v}
 			iNdEx = postIndex
-		case 42:
+		case 174:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86689,15 +96999,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseSessionQuery{}
+			v := &AutoUpdateConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseSessionQuery{v}
+			m.Event = &OneOf_AutoUpdateConfigUpdate{v}
 			iNdEx = postIndex
-		case 43:
+		case 175:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionUpload", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86724,15 +97034,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionUpload{}
+			v := &AutoUpdateConfigDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionUpload{v}
+			m.Event = &OneOf_AutoUpdateConfigDelete{v}
 			iNdEx = postIndex
-		case 44:
+		case 176:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceAdd", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86759,15 +97069,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MFADeviceAdd{}
+			v := &AutoUpdateVersionCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MFADeviceAdd{v}
+			m.Event = &OneOf_AutoUpdateVersionCreate{v}
 			iNdEx = postIndex
-		case 45:
+		case 177:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86794,15 +97104,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MFADeviceDelete{}
+			v := &AutoUpdateVersionUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MFADeviceDelete{v}
+			m.Event = &OneOf_AutoUpdateVersionUpdate{v}
 			iNdEx = postIndex
-		case 46:
+		case 178:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BillingInformationUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86829,15 +97139,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BillingInformationUpdate{}
+			v := &AutoUpdateVersionDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_BillingInformationUpdate{v}
+			m.Event = &OneOf_AutoUpdateVersionDelete{v}
 			iNdEx = postIndex
-		case 47:
+		case 179:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BillingCardCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86864,15 +97174,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BillingCardCreate{}
+			v := &StaticHostUserCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_BillingCardCreate{v}
+			m.Event = &OneOf_StaticHostUserCreate{v}
 			iNdEx = postIndex
-		case 48:
+		case 180:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BillingCardDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86899,15 +97209,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BillingCardDelete{}
+			v := &StaticHostUserUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_BillingCardDelete{v}
+			m.Event = &OneOf_StaticHostUserUpdate{v}
 			iNdEx = postIndex
-		case 49:
+		case 181:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LockCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86934,15 +97244,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &LockCreate{}
+			v := &StaticHostUserDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_LockCreate{v}
+			m.Event = &OneOf_StaticHostUserDelete{v}
 			iNdEx = postIndex
-		case 50:
+		case 182:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LockDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -86969,15 +97279,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &LockDelete{}
+			v := &CrownJewelCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_LockDelete{v}
+			m.Event = &OneOf_CrownJewelCreate{v}
 			iNdEx = postIndex
-		case 51:
+		case 183:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCodeGenerate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87004,15 +97314,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RecoveryCodeGenerate{}
+			v := &CrownJewelUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_RecoveryCodeGenerate{v}
+			m.Event = &OneOf_CrownJewelUpdate{v}
 			iNdEx = postIndex
-		case 52:
+		case 184:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCodeUsed", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87039,15 +97349,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RecoveryCodeUsed{}
+			v := &CrownJewelDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_RecoveryCodeUsed{v}
+			m.Event = &OneOf_CrownJewelDelete{v}
 			iNdEx = postIndex
-		case 53:
+		case 188:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87074,15 +97384,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseCreate{}
+			v := &UserTaskCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseCreate{v}
+			m.Event = &OneOf_UserTaskCreate{v}
 			iNdEx = postIndex
-		case 54:
+		case 189:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87109,15 +97419,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseUpdate{}
+			v := &UserTaskUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseUpdate{v}
+			m.Event = &OneOf_UserTaskUpdate{v}
 			iNdEx = postIndex
-		case 55:
+		case 190:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87144,15 +97454,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseDelete{}
+			v := &UserTaskDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseDelete{v}
+			m.Event = &OneOf_UserTaskDelete{v}
 			iNdEx = postIndex
-		case 56:
+		case 191:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SFTPSummary", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87179,15 +97489,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppCreate{}
+			v := &SFTPSummary{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppCreate{v}
+			m.Event = &OneOf_SFTPSummary{v}
 			iNdEx = postIndex
-		case 57:
+		case 192:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ContactCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87214,15 +97524,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppUpdate{}
+			v := &ContactCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppUpdate{v}
+			m.Event = &OneOf_ContactCreate{v}
 			iNdEx = postIndex
-		case 58:
+		case 193:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ContactDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87249,15 +97559,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppDelete{}
+			v := &ContactDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppDelete{v}
+			m.Event = &OneOf_ContactDelete{v}
 			iNdEx = postIndex
-		case 59:
+		case 194:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopSessionStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87284,15 +97594,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WindowsDesktopSessionStart{}
+			v := &WorkloadIdentityCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WindowsDesktopSessionStart{v}
+			m.Event = &OneOf_WorkloadIdentityCreate{v}
 			iNdEx = postIndex
-		case 60:
+		case 195:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopSessionEnd", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87319,15 +97629,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WindowsDesktopSessionEnd{}
+			v := &WorkloadIdentityUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WindowsDesktopSessionEnd{v}
+			m.Event = &OneOf_WorkloadIdentityUpdate{v}
 			iNdEx = postIndex
-		case 61:
+		case 196:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresParse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87354,15 +97664,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PostgresParse{}
+			v := &WorkloadIdentityDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PostgresParse{v}
+			m.Event = &OneOf_WorkloadIdentityDelete{v}
 			iNdEx = postIndex
-		case 62:
+		case 197:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresBind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GitCommand", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87389,15 +97699,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PostgresBind{}
+			v := &GitCommand{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PostgresBind{v}
+			m.Event = &OneOf_GitCommand{v}
 			iNdEx = postIndex
-		case 63:
+		case 198:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresExecute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserLoginAccessListInvalid", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87424,15 +97734,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PostgresExecute{}
+			v := &UserLoginAccessListInvalid{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PostgresExecute{v}
+			m.Event = &OneOf_UserLoginAccessListInvalid{v}
 			iNdEx = postIndex
-		case 64:
+		case 199:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresClose", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestExpire", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87459,15 +97769,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PostgresClose{}
+			v := &AccessRequestExpire{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PostgresClose{v}
+			m.Event = &OneOf_AccessRequestExpire{v}
 			iNdEx = postIndex
-		case 65:
+		case 200:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PostgresFunctionCall", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StableUNIXUserCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87494,15 +97804,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PostgresFunctionCall{}
+			v := &StableUNIXUserCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PostgresFunctionCall{v}
+			m.Event = &OneOf_StableUNIXUserCreate{v}
 			iNdEx = postIndex
-		case 66:
+		case 201:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87529,15 +97839,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessRequestDelete{}
+			v := &WorkloadIdentityX509RevocationCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessRequestDelete{v}
+			m.Event = &OneOf_WorkloadIdentityX509RevocationCreate{v}
 			iNdEx = postIndex
-		case 67:
+		case 202:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionConnect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87564,15 +97874,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionConnect{}
+			v := &WorkloadIdentityX509RevocationDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionConnect{v}
+			m.Event = &OneOf_WorkloadIdentityX509RevocationDelete{v}
 			iNdEx = postIndex
-		case 68:
+		case 203:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CertificateCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87599,15 +97909,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CertificateCreate{}
+			v := &WorkloadIdentityX509RevocationUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_CertificateCreate{v}
+			m.Event = &OneOf_WorkloadIdentityX509RevocationUpdate{v}
 			iNdEx = postIndex
-		case 69:
+		case 204:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopRecording", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSICResourceSync", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87634,15 +97944,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopRecording{}
+			v := &AWSICResourceSync{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DesktopRecording{v}
+			m.Event = &OneOf_AWSICResourceSync{v}
 			iNdEx = postIndex
-		case 70:
+		case 205:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopClipboardSend", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87669,15 +97979,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopClipboardSend{}
+			v := &HealthCheckConfigCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DesktopClipboardSend{v}
+			m.Event = &OneOf_HealthCheckConfigCreate{v}
 			iNdEx = postIndex
-		case 71:
+		case 206:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopClipboardReceive", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87704,15 +98014,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopClipboardReceive{}
+			v := &HealthCheckConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DesktopClipboardReceive{v}
+			m.Event = &OneOf_HealthCheckConfigUpdate{v}
 			iNdEx = postIndex
-		case 72:
+		case 207:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementPrepare", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87739,15 +98049,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementPrepare{}
+			v := &HealthCheckConfigDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementPrepare{v}
+			m.Event = &OneOf_HealthCheckConfigDelete{v}
 			iNdEx = postIndex
-		case 73:
+		case 208:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementExecute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509IssuerOverrideCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87774,15 +98084,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementExecute{}
+			v := &WorkloadIdentityX509IssuerOverrideCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementExecute{v}
+			m.Event = &OneOf_WorkloadIdentityX509IssuerOverrideCreate{v}
 			iNdEx = postIndex
-		case 74:
+		case 209:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementSendLongData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509IssuerOverrideDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87809,15 +98119,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementSendLongData{}
+			v := &WorkloadIdentityX509IssuerOverrideDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementSendLongData{v}
+			m.Event = &OneOf_WorkloadIdentityX509IssuerOverrideDelete{v}
 			iNdEx = postIndex
-		case 75:
+		case 210:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementClose", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87844,15 +98154,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementClose{}
+			v := &SigstorePolicyCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementClose{v}
+			m.Event = &OneOf_SigstorePolicyCreate{v}
 			iNdEx = postIndex
-		case 76:
+		case 211:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementReset", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87879,15 +98189,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementReset{}
+			v := &SigstorePolicyUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementReset{v}
+			m.Event = &OneOf_SigstorePolicyUpdate{v}
 			iNdEx = postIndex
-		case 77:
+		case 212:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementFetch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87914,15 +98224,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementFetch{}
+			v := &SigstorePolicyDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementFetch{v}
+			m.Event = &OneOf_SigstorePolicyDelete{v}
 			iNdEx = postIndex
-		case 78:
+		case 213:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLStatementBulkExecute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutTrigger", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87949,15 +98259,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLStatementBulkExecute{}
+			v := &AutoUpdateAgentRolloutTrigger{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLStatementBulkExecute{v}
+			m.Event = &OneOf_AutoUpdateAgentRolloutTrigger{v}
 			iNdEx = postIndex
-		case 79:
+		case 214:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RenewableCertificateGenerationMismatch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutForceDone", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -87984,15 +98294,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RenewableCertificateGenerationMismatch{}
+			v := &AutoUpdateAgentRolloutForceDone{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_RenewableCertificateGenerationMismatch{v}
+			m.Event = &OneOf_AutoUpdateAgentRolloutForceDone{v}
 			iNdEx = postIndex
-		case 80:
+		case 215:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Unknown", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutRollback", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88019,15 +98329,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &Unknown{}
+			v := &AutoUpdateAgentRolloutRollback{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_Unknown{v}
+			m.Event = &OneOf_AutoUpdateAgentRolloutRollback{v}
 			iNdEx = postIndex
-		case 81:
+		case 216:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLInitDB", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionStart", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88054,15 +98364,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLInitDB{}
+			v := &MCPSessionStart{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLInitDB{v}
+			m.Event = &OneOf_MCPSessionStart{v}
 			iNdEx = postIndex
-		case 82:
+		case 217:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLCreateDB", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionEnd", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88089,15 +98399,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLCreateDB{}
+			v := &MCPSessionEnd{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLCreateDB{v}
+			m.Event = &OneOf_MCPSessionEnd{v}
 			iNdEx = postIndex
-		case 83:
+		case 218:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLDropDB", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88124,15 +98434,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLDropDB{}
+			v := &MCPSessionRequest{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLDropDB{v}
+			m.Event = &OneOf_MCPSessionRequest{v}
 			iNdEx = postIndex
-		case 84:
+		case 219:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLShutDown", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionNotification", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88159,15 +98469,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLShutDown{}
+			v := &MCPSessionNotification{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLShutDown{v}
+			m.Event = &OneOf_MCPSessionNotification{v}
 			iNdEx = postIndex
-		case 85:
+		case 220:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLProcessKill", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BoundKeypairRecovery", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88194,15 +98504,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLProcessKill{}
+			v := &BoundKeypairRecovery{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLProcessKill{v}
+			m.Event = &OneOf_BoundKeypairRecovery{v}
 			iNdEx = postIndex
-		case 86:
+		case 221:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLDebug", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BoundKeypairRotation", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88229,15 +98539,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLDebug{}
+			v := &BoundKeypairRotation{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLDebug{v}
+			m.Event = &OneOf_BoundKeypairRotation{v}
 			iNdEx = postIndex
-		case 87:
+		case 222:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MySQLRefresh", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BoundKeypairJoinStateVerificationFailed", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88264,15 +98574,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &MySQLRefresh{}
+			v := &BoundKeypairJoinStateVerificationFailed{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_MySQLRefresh{v}
+			m.Event = &OneOf_BoundKeypairJoinStateVerificationFailed{v}
 			iNdEx = postIndex
-		case 88:
+		case 223:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestResourceSearch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionListenSSEStream", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88299,15 +98609,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessRequestResourceSearch{}
+			v := &MCPSessionListenSSEStream{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessRequestResourceSearch{v}
+			m.Event = &OneOf_MCPSessionListenSSEStream{v}
 			iNdEx = postIndex
-		case 89:
+		case 224:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SQLServerRPCRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MCPSessionInvalidHTTPRequest", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88334,15 +98644,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SQLServerRPCRequest{}
+			v := &MCPSessionInvalidHTTPRequest{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SQLServerRPCRequest{v}
+			m.Event = &OneOf_MCPSessionInvalidHTTPRequest{v}
 			iNdEx = postIndex
-		case 90:
+		case 225:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionMalformedPacket", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SCIMListingEvent", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88369,15 +98679,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseSessionMalformedPacket{}
+			v := &SCIMListingEvent{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseSessionMalformedPacket{v}
+			m.Event = &OneOf_SCIMListingEvent{v}
 			iNdEx = postIndex
-		case 91:
+		case 226:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SFTP", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SCIMResourceEvent", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88404,15 +98714,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SFTP{}
+			v := &SCIMResourceEvent{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SFTP{v}
+			m.Event = &OneOf_SCIMResourceEvent{v}
 			iNdEx = postIndex
-		case 92:
+		case 227:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStartUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientIPRestrictionsUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88439,15 +98749,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UpgradeWindowStartUpdate{}
+			v := &ClientIPRestrictionsUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UpgradeWindowStartUpdate{v}
+			m.Event = &OneOf_ClientIPRestrictionsUpdate{v}
 			iNdEx = postIndex
-		case 93:
+		case 232:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionEnd", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field VnetConfigCreate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88474,15 +98784,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppSessionEnd{}
+			v := &VnetConfigCreate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AppSessionEnd{v}
+			m.Event = &OneOf_VnetConfigCreate{v}
 			iNdEx = postIndex
-		case 94:
+		case 233:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingAccess", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field VnetConfigUpdate", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88509,15 +98819,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionRecordingAccess{}
+			v := &VnetConfigUpdate{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionRecordingAccess{v}
+			m.Event = &OneOf_VnetConfigUpdate{v}
 			iNdEx = postIndex
-		case 96:
+		case 234:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field VnetConfigDelete", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88544,17 +98854,68 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &KubernetesClusterCreate{}
+			v := &VnetConfigDelete{}
 			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_KubernetesClusterCreate{v}
+			m.Event = &OneOf_VnetConfigDelete{v}
 			iNdEx = postIndex
-		case 97:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StreamStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StreamStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StreamStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UploadID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88564,30 +98925,46 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &KubernetesClusterUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_KubernetesClusterUpdate{v}
+			m.UploadID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 98:
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastEventIndex", wireType)
+			}
+			m.LastEventIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.LastEventIndex |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesClusterDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LastUploadTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88614,15 +98991,64 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &KubernetesClusterDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.LastUploadTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_KubernetesClusterDelete{v}
 			iNdEx = postIndex
-		case 99:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionUpload) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionUpload: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionUpload: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SSMRun", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88649,15 +99075,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SSMRun{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SSMRun{v}
 			iNdEx = postIndex
-		case 100:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ElasticsearchRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88684,17 +99108,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ElasticsearchRequest{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_ElasticsearchRequest{v}
 			iNdEx = postIndex
-		case 101:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CassandraBatch", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionURL", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88704,32 +99126,80 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CassandraBatch{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.SessionURL = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_CassandraBatch{v}
-			iNdEx = postIndex
-		case 102:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Identity) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Identity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Identity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CassandraPrepare", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88739,32 +99209,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CassandraPrepare{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_CassandraPrepare{v}
+			m.User = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 103:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CassandraRegister", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Impersonator", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88774,32 +99241,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CassandraRegister{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_CassandraRegister{v}
+			m.Impersonator = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 104:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CassandraExecute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88809,32 +99273,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CassandraExecute{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_CassandraExecute{v}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 105:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSessionDynamoDBRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Usage", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88844,32 +99305,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AppSessionDynamoDBRequest{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AppSessionDynamoDBRequest{v}
+			m.Usage = append(m.Usage, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 106:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Logins", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88879,32 +99337,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopSharedDirectoryStart{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DesktopSharedDirectoryStart{v}
+			m.Logins = append(m.Logins, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 107:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryRead", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesGroups", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88914,32 +99369,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopSharedDirectoryRead{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DesktopSharedDirectoryRead{v}
+			m.KubernetesGroups = append(m.KubernetesGroups, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 108:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopSharedDirectoryWrite", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesUsers", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -88949,30 +99401,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DesktopSharedDirectoryWrite{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DesktopSharedDirectoryWrite{v}
+			m.KubernetesUsers = append(m.KubernetesUsers, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 109:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DynamoDBRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -88999,17 +99448,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DynamoDBRequest{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Expires, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DynamoDBRequest{v}
 			iNdEx = postIndex
-		case 110:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotJoin", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RouteToCluster", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89019,32 +99466,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BotJoin{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_BotJoin{v}
+			m.RouteToCluster = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 111:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InstanceJoin", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesCluster", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89054,30 +99498,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &InstanceJoin{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_InstanceJoin{v}
+			m.KubernetesCluster = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 112:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceEvent", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Traits", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89104,15 +99545,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DeviceEvent{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Traits.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DeviceEvent{v}
 			iNdEx = postIndex
-		case 113:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LoginRuleCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RouteToApp", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89139,17 +99578,18 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &LoginRuleCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.RouteToApp == nil {
+				m.RouteToApp = &RouteToApp{}
+			}
+			if err := m.RouteToApp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_LoginRuleCreate{v}
 			iNdEx = postIndex
-		case 114:
+		case 13:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LoginRuleDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TeleportCluster", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89159,30 +99599,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &LoginRuleDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_LoginRuleDelete{v}
+			m.TeleportCluster = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 115:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPAuthAttempt", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RouteToDatabase", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89209,17 +99646,18 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLIdPAuthAttempt{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.RouteToDatabase == nil {
+				m.RouteToDatabase = &RouteToDatabase{}
+			}
+			if err := m.RouteToDatabase.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SAMLIdPAuthAttempt{v}
 			iNdEx = postIndex
-		case 116:
+		case 15:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseNames", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89229,32 +99667,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLIdPServiceProviderCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SAMLIdPServiceProviderCreate{v}
+			m.DatabaseNames = append(m.DatabaseNames, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 117:
+		case 16:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUsers", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89264,32 +99699,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLIdPServiceProviderUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SAMLIdPServiceProviderUpdate{v}
+			m.DatabaseUsers = append(m.DatabaseUsers, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 118:
+		case 17:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceUUID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89299,32 +99731,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLIdPServiceProviderDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SAMLIdPServiceProviderDelete{v}
+			m.MFADeviceUUID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 119:
+		case 18:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderDeleteAll", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientIP", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89334,32 +99763,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLIdPServiceProviderDeleteAll{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SAMLIdPServiceProviderDeleteAll{v}
+			m.ClientIP = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 120:
+		case 19:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OpenSearchRequest", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARNs", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89369,32 +99795,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OpenSearchRequest{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_OpenSearchRequest{v}
+			m.AWSRoleARNs = append(m.AWSRoleARNs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 121:
+		case 20:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceEvent2", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89404,30 +99827,47 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DeviceEvent2{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DeviceEvent2{v}
+			m.AccessRequests = append(m.AccessRequests, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 122:
+		case 21:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisallowReissue", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DisallowReissue = bool(v != 0)
+		case 22:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaResourcesUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowedResourceIDs", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89454,15 +99894,14 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OktaResourcesUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.AllowedResourceIDs = append(m.AllowedResourceIDs, ResourceID{})
+			if err := m.AllowedResourceIDs[len(m.AllowedResourceIDs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_OktaResourcesUpdate{v}
 			iNdEx = postIndex
-		case 123:
+		case 23:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaSyncFailure", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PreviousIdentityExpires", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89489,17 +99928,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OktaSyncFailure{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.PreviousIdentityExpires, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_OktaSyncFailure{v}
 			iNdEx = postIndex
-		case 124:
+		case 24:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaAssignmentResult", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentities", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89509,32 +99946,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OktaAssignmentResult{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_OktaAssignmentResult{v}
+			m.AzureIdentities = append(m.AzureIdentities, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 125:
+		case 25:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProvisionTokenCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccounts", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89544,32 +99978,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ProvisionTokenCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_ProvisionTokenCreate{v}
+			m.GCPServiceAccounts = append(m.GCPServiceAccounts, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 126:
+		case 26:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicy", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89579,32 +100010,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessListCreate{v}
+			m.PrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 127:
+		case 27:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89614,30 +100042,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessListUpdate{v}
+			m.BotName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 128:
+		case 28:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceExtensions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89664,17 +100089,18 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.DeviceExtensions == nil {
+				m.DeviceExtensions = &DeviceExtensions{}
+			}
+			if err := m.DeviceExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessListDelete{v}
 			iNdEx = postIndex
-		case 129:
+		case 29:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListReview", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89684,32 +100110,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListReview{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessListReview{v}
+			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 130:
+		case 30:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinToken", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89719,30 +100142,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListMemberCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessListMemberCreate{v}
+			m.JoinToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 131:
+		case 31:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ScopePin", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89769,17 +100189,69 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListMemberUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.ScopePin == nil {
+				m.ScopePin = &ScopePin{}
+			}
+			if err := m.ScopePin.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessListMemberUpdate{v}
 			iNdEx = postIndex
-		case 132:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ScopePin) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ScopePin: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ScopePin: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89789,30 +100261,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListMemberDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessListMemberDelete{v}
+			m.Scope = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 133:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberDeleteAllForAccessList", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Assignments", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -89839,17 +100308,162 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessListMemberDeleteAllForAccessList{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.Assignments == nil {
+				m.Assignments = make(map[string]*ScopePinnedAssignments)
 			}
-			m.Event = &OneOf_AccessListMemberDeleteAllForAccessList{v}
+			var mapkey string
+			var mapvalue *ScopePinnedAssignments
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &ScopePinnedAssignments{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Assignments[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 134:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ScopePinnedAssignments) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ScopePinnedAssignments: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ScopePinnedAssignments: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueryRun", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89859,32 +100473,80 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AuditQueryRun{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_AuditQueryRun{v}
-			iNdEx = postIndex
-		case 135:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RouteToApp) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RouteToApp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RouteToApp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SecurityReportRun", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89894,32 +100556,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SecurityReportRun{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SecurityReportRun{v}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 136:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GithubConnectorUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89929,32 +100588,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &GithubConnectorUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_GithubConnectorUpdate{v}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 137:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OIDCConnectorUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicAddr", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89964,32 +100620,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OIDCConnectorUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_OIDCConnectorUpdate{v}
+			m.PublicAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 138:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLConnectorUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -89999,32 +100652,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SAMLConnectorUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SAMLConnectorUpdate{v}
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 139:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RoleUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARN", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90034,32 +100684,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &RoleUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_RoleUpdate{v}
+			m.AWSRoleARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 140:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentity", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90069,32 +100716,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_UserUpdate{v}
+			m.AzureIdentity = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 141:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExternalAuditStorageEnable", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccount", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90104,32 +100748,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ExternalAuditStorageEnable{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_ExternalAuditStorageEnable{v}
+			m.GCPServiceAccount = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 142:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExternalAuditStorageDisable", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field URI", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90139,32 +100780,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ExternalAuditStorageDisable{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_ExternalAuditStorageDisable{v}
+			m.URI = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 143:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotCreate", wireType)
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TargetPort", wireType)
 			}
-			var msglen int
+			m.TargetPort = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90174,32 +100812,67 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.TargetPort |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BotCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Event = &OneOf_BotCreate{v}
-			iNdEx = postIndex
-		case 144:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RouteToDatabase: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RouteToDatabase: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90209,32 +100882,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BotDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_BotDelete{v}
+			m.ServiceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 145:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Protocol", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90244,32 +100914,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &BotUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_BotUpdate{v}
+			m.Protocol = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 146:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CreateMFAAuthChallenge", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90279,32 +100946,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CreateMFAAuthChallenge{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_CreateMFAAuthChallenge{v}
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 147:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ValidateMFAAuthResponse", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Database", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90314,32 +100978,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ValidateMFAAuthResponse{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_ValidateMFAAuthResponse{v}
+			m.Database = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 148:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaAccessListSync", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90349,32 +101010,80 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OktaAccessListSync{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_OktaAccessListSync{v}
-			iNdEx = postIndex
-		case 149:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceExtensions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceExtensions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabasePermissionUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90384,32 +101093,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabasePermissionUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DatabasePermissionUpdate{v}
+			m.DeviceId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 150:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFESVIDIssued", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AssetTag", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90419,32 +101125,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SPIFFESVIDIssued{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SPIFFESVIDIssued{v}
+			m.AssetTag = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 151:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaUserSync", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CredentialId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90454,30 +101157,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &OktaUserSync{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.CredentialId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_OktaUserSync{v}
-			iNdEx = postIndex
-		case 152:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessRequestResourceSearch: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessRequestResourceSearch: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuthPreferenceUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90504,15 +101255,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AuthPreferenceUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AuthPreferenceUpdate{v}
 			iNdEx = postIndex
-		case 153:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingConfigUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90539,17 +101288,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SessionRecordingConfigUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SessionRecordingConfigUpdate{v}
 			iNdEx = postIndex
-		case 154:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterNetworkingConfigUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchAsRoles", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90559,32 +101306,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ClusterNetworkingConfigUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_ClusterNetworkingConfigUpdate{v}
+			m.SearchAsRoles = append(m.SearchAsRoles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 155:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUserCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90594,32 +101338,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseUserCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DatabaseUserCreate{v}
+			m.ResourceType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 156:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUserDeactivate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90629,30 +101370,27 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseUserDeactivate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_DatabaseUserDeactivate{v}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 157:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessPathChanged", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90679,17 +101417,109 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessPathChanged{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
 			}
-			m.Event = &OneOf_AccessPathChanged{v}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 158:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SpannerRPC", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90699,32 +101529,29 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SpannerRPC{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_SpannerRPC{v}
+			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 159:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseSessionCommandResult", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90734,30 +101561,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DatabaseSessionCommandResult{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_DatabaseSessionCommandResult{v}
-			iNdEx = postIndex
-		case 160:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementPrepare) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementPrepare: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementPrepare: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90784,15 +101659,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DiscoveryConfigCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DiscoveryConfigCreate{v}
 			iNdEx = postIndex
-		case 161:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90819,15 +101692,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DiscoveryConfigUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DiscoveryConfigUpdate{v}
 			iNdEx = postIndex
-		case 162:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90854,15 +101725,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DiscoveryConfigDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DiscoveryConfigDelete{v}
 			iNdEx = postIndex
-		case 163:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryConfigDeleteAll", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90889,17 +101758,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &DiscoveryConfigDeleteAll{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_DiscoveryConfigDeleteAll{v}
 			iNdEx = postIndex
-		case 164:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessGraphSettingsUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -90909,65 +101776,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessGraphSettingsUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AccessGraphSettingsUpdate{v}
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 165:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationCreate", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &IntegrationCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Event = &OneOf_IntegrationCreate{v}
-			iNdEx = postIndex
-		case 166:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementExecute: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementExecute: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -90994,15 +101874,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &IntegrationUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_IntegrationUpdate{v}
 			iNdEx = postIndex
-		case 167:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91029,15 +101907,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &IntegrationDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_IntegrationDelete{v}
 			iNdEx = postIndex
-		case 168:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEFederationCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91064,15 +101940,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SPIFFEFederationCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SPIFFEFederationCreate{v}
 			iNdEx = postIndex
-		case 169:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEFederationDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91099,17 +101973,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SPIFFEFederationDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SPIFFEFederationDelete{v}
 			iNdEx = postIndex
-		case 170:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginCreate", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91119,32 +101991,16 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &PluginCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_PluginCreate{v}
-			iNdEx = postIndex
-		case 171:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91154,30 +102010,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PluginUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
 				return err
 			}
-			m.Event = &OneOf_PluginUpdate{v}
-			iNdEx = postIndex
-		case 172:
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementSendLongData: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementSendLongData: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PluginDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91204,15 +102108,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &PluginDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_PluginDelete{v}
 			iNdEx = postIndex
-		case 173:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91239,15 +102141,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateConfigCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AutoUpdateConfigCreate{v}
 			iNdEx = postIndex
-		case 174:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91274,15 +102174,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateConfigUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AutoUpdateConfigUpdate{v}
 			iNdEx = postIndex
-		case 175:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateConfigDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91309,17 +102207,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateConfigDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AutoUpdateConfigDelete{v}
 			iNdEx = postIndex
-		case 176:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionCreate", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91329,32 +102225,16 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &AutoUpdateVersionCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AutoUpdateVersionCreate{v}
-			iNdEx = postIndex
-		case 177:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionUpdate", wireType)
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParameterID", wireType)
 			}
-			var msglen int
+			m.ParameterID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91364,32 +102244,16 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.ParameterID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &AutoUpdateVersionUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AutoUpdateVersionUpdate{v}
-			iNdEx = postIndex
-		case 178:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateVersionDelete", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DataSize", wireType)
 			}
-			var msglen int
+			m.DataSize = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91399,30 +102263,65 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.DataSize |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateVersionDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			m.Event = &OneOf_AutoUpdateVersionDelete{v}
-			iNdEx = postIndex
-		case 179:
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementClose: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementClose: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91449,15 +102348,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &StaticHostUserCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_StaticHostUserCreate{v}
 			iNdEx = postIndex
-		case 180:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91484,15 +102381,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &StaticHostUserUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_StaticHostUserUpdate{v}
 			iNdEx = postIndex
-		case 181:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StaticHostUserDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91519,15 +102414,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &StaticHostUserDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_StaticHostUserDelete{v}
 			iNdEx = postIndex
-		case 182:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91554,17 +102447,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CrownJewelCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_CrownJewelCreate{v}
 			iNdEx = postIndex
-		case 183:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelUpdate", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91574,30 +102465,65 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CrownJewelUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementReset) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			m.Event = &OneOf_CrownJewelUpdate{v}
-			iNdEx = postIndex
-		case 184:
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementReset: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementReset: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91624,15 +102550,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &CrownJewelDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_CrownJewelDelete{v}
 			iNdEx = postIndex
-		case 188:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91659,15 +102583,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserTaskCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserTaskCreate{v}
 			iNdEx = postIndex
-		case 189:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91694,15 +102616,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserTaskUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserTaskUpdate{v}
 			iNdEx = postIndex
-		case 190:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91729,17 +102649,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserTaskDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserTaskDelete{v}
 			iNdEx = postIndex
-		case 191:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SFTPSummary", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91749,30 +102667,65 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SFTPSummary{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			m.Event = &OneOf_SFTPSummary{v}
-			iNdEx = postIndex
-		case 192:
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementFetch: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementFetch: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContactCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91799,15 +102752,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ContactCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_ContactCreate{v}
 			iNdEx = postIndex
-		case 193:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContactDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91834,15 +102785,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &ContactDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_ContactDelete{v}
 			iNdEx = postIndex
-		case 194:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91869,15 +102818,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WorkloadIdentityCreate{v}
 			iNdEx = postIndex
-		case 195:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -91904,17 +102851,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WorkloadIdentityUpdate{v}
 			iNdEx = postIndex
-		case 196:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityDelete", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91924,32 +102869,16 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &WorkloadIdentityDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_WorkloadIdentityDelete{v}
-			iNdEx = postIndex
-		case 197:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GitCommand", wireType)
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RowsCount", wireType)
 			}
-			var msglen int
+			m.RowsCount = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -91959,30 +102888,65 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.RowsCount |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &GitCommand{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			m.Event = &OneOf_GitCommand{v}
-			iNdEx = postIndex
-		case 198:
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLStatementBulkExecute: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLStatementBulkExecute: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserLoginAccessListInvalid", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92009,15 +102973,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &UserLoginAccessListInvalid{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_UserLoginAccessListInvalid{v}
 			iNdEx = postIndex
-		case 199:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequestExpire", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92044,15 +103006,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AccessRequestExpire{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AccessRequestExpire{v}
 			iNdEx = postIndex
-		case 200:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StableUNIXUserCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92079,15 +103039,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &StableUNIXUserCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_StableUNIXUserCreate{v}
 			iNdEx = postIndex
-		case 201:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92114,17 +103072,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityX509RevocationCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WorkloadIdentityX509RevocationCreate{v}
 			iNdEx = postIndex
-		case 202:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationDelete", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
 			}
-			var msglen int
+			m.StatementID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92134,32 +103090,16 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.StatementID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &WorkloadIdentityX509RevocationDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_WorkloadIdentityX509RevocationDelete{v}
-			iNdEx = postIndex
-		case 203:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509RevocationUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92169,65 +103109,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityX509RevocationUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_WorkloadIdentityX509RevocationUpdate{v}
+			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 204:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSICResourceSync", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AWSICResourceSync{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Event = &OneOf_AWSICResourceSync{v}
-			iNdEx = postIndex
-		case 205:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLInitDB: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLInitDB: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92254,15 +103207,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &HealthCheckConfigCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_HealthCheckConfigCreate{v}
 			iNdEx = postIndex
-		case 206:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92289,15 +103240,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &HealthCheckConfigUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_HealthCheckConfigUpdate{v}
 			iNdEx = postIndex
-		case 207:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HealthCheckConfigDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92324,15 +103273,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &HealthCheckConfigDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_HealthCheckConfigDelete{v}
 			iNdEx = postIndex
-		case 208:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509IssuerOverrideCreate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92359,17 +103306,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityX509IssuerOverrideCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_WorkloadIdentityX509IssuerOverrideCreate{v}
 			iNdEx = postIndex
-		case 209:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityX509IssuerOverrideDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92379,65 +103324,78 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &WorkloadIdentityX509IssuerOverrideDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_WorkloadIdentityX509IssuerOverrideDelete{v}
+			m.SchemaName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 210:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyCreate", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SigstorePolicyCreate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Event = &OneOf_SigstorePolicyCreate{v}
-			iNdEx = postIndex
-		case 211:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLCreateDB: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLCreateDB: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyUpdate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92464,15 +103422,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SigstorePolicyUpdate{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SigstorePolicyUpdate{v}
 			iNdEx = postIndex
-		case 212:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SigstorePolicyDelete", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92499,15 +103455,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &SigstorePolicyDelete{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_SigstorePolicyDelete{v}
 			iNdEx = postIndex
-		case 213:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutTrigger", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92534,15 +103488,13 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateAgentRolloutTrigger{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AutoUpdateAgentRolloutTrigger{v}
 			iNdEx = postIndex
-		case 214:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutForceDone", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92569,17 +103521,15 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateAgentRolloutForceDone{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			m.Event = &OneOf_AutoUpdateAgentRolloutForceDone{v}
 			iNdEx = postIndex
-		case 215:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AutoUpdateAgentRolloutRollback", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92589,26 +103539,23 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			v := &AutoUpdateAgentRolloutRollback{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_AutoUpdateAgentRolloutRollback{v}
+			m.SchemaName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -92632,7 +103579,7 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StreamStatus) Unmarshal(dAtA []byte) error {
+func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -92655,17 +103602,17 @@ func (m *StreamStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StreamStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: MySQLDropDB: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StreamStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MySQLDropDB: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UploadID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92675,46 +103622,28 @@ func (m *StreamStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UploadID = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastEventIndex", wireType)
-			}
-			m.LastEventIndex = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.LastEventIndex |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastUploadTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92741,64 +103670,13 @@ func (m *StreamStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.LastUploadTime, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SessionUpload) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SessionUpload: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionUpload: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92825,13 +103703,13 @@ func (m *SessionUpload) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -92858,13 +103736,13 @@ func (m *SessionUpload) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionURL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -92892,7 +103770,7 @@ func (m *SessionUpload) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionURL = string(dAtA[iNdEx:postIndex])
+			m.SchemaName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -92916,7 +103794,7 @@ func (m *SessionUpload) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Identity) Unmarshal(dAtA []byte) error {
+func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -92939,17 +103817,17 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Identity: wiretype end group for non-group")
+			return fmt.Errorf("proto: MySQLShutDown: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Identity: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MySQLShutDown: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92959,29 +103837,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.User = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Impersonator", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -92991,29 +103870,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Impersonator = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93023,29 +103903,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Usage", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93055,29 +103936,81 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Usage = append(m.Usage, string(dAtA[iNdEx:postIndex]))
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLProcessKill: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLProcessKill: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Logins", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93087,29 +104020,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Logins = append(m.Logins, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesGroups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93119,29 +104053,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesGroups = append(m.KubernetesGroups, string(dAtA[iNdEx:postIndex]))
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesUsers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93151,27 +104086,28 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesUsers = append(m.KubernetesUsers, string(dAtA[iNdEx:postIndex]))
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Expires", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93198,15 +104134,15 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.Expires, dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RouteToCluster", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProcessID", wireType)
 			}
-			var stringLen uint64
+			m.ProcessID = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93216,29 +104152,67 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.ProcessID |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RouteToCluster = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 10:
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLDebug) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLDebug: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLDebug: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesCluster", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93248,27 +104222,28 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KubernetesCluster = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Traits", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93295,13 +104270,13 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Traits.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 12:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RouteToApp", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93328,18 +104303,15 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.RouteToApp == nil {
-				m.RouteToApp = &RouteToApp{}
-			}
-			if err := m.RouteToApp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 13:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TeleportCluster", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93349,27 +104321,79 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TeleportCluster = string(dAtA[iNdEx:postIndex])
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 14:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MySQLRefresh: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MySQLRefresh: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RouteToDatabase", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93396,18 +104420,15 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.RouteToDatabase == nil {
-				m.RouteToDatabase = &RouteToDatabase{}
-			}
-			if err := m.RouteToDatabase.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 15:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseNames", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93417,29 +104438,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseNames = append(m.DatabaseNames, string(dAtA[iNdEx:postIndex]))
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 16:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseUsers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93449,29 +104471,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DatabaseUsers = append(m.DatabaseUsers, string(dAtA[iNdEx:postIndex]))
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 17:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MFADeviceUUID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93481,27 +104504,28 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.MFADeviceUUID = string(dAtA[iNdEx:postIndex])
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 18:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientIP", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Subcommand", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93529,13 +104553,64 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClientIP = string(dAtA[iNdEx:postIndex])
+			m.Subcommand = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 19:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SQLServerRPCRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SQLServerRPCRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARNs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93545,29 +104620,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSRoleARNs = append(m.AWSRoleARNs, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 20:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessRequests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93577,29 +104653,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessRequests = append(m.AccessRequests, string(dAtA[iNdEx:postIndex]))
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 21:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DisallowReissue", wireType)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93609,15 +104686,28 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.DisallowReissue = bool(v != 0)
-		case 22:
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllowedResourceIDs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93644,16 +104734,15 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AllowedResourceIDs = append(m.AllowedResourceIDs, ResourceID{})
-			if err := m.AllowedResourceIDs[len(m.AllowedResourceIDs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 23:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PreviousIdentityExpires", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Procname", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93663,28 +104752,27 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.PreviousIdentityExpires, dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Procname = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 24:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentities", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93712,13 +104800,64 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AzureIdentities = append(m.AzureIdentities, string(dAtA[iNdEx:postIndex]))
+			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 25:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DatabaseSessionMalformedPacket: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DatabaseSessionMalformedPacket: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccounts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93728,29 +104867,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.GCPServiceAccounts = append(m.GCPServiceAccounts, string(dAtA[iNdEx:postIndex]))
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 26:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93760,29 +104900,30 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PrivateKeyPolicy = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 27:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93792,27 +104933,28 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BotName = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 28:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceExtensions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -93839,18 +104981,15 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.DeviceExtensions == nil {
-				m.DeviceExtensions = &DeviceExtensions{}
-			}
-			if err := m.DeviceExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 29:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Payload", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93860,23 +104999,25 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
+			m.Payload = append(m.Payload[:0], dAtA[iNdEx:postIndex]...)
+			if m.Payload == nil {
+				m.Payload = []byte{}
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -93900,7 +105041,7 @@ func (m *Identity) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RouteToApp) Unmarshal(dAtA []byte) error {
+func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -93923,17 +105064,17 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RouteToApp: wiretype end group for non-group")
+			return fmt.Errorf("proto: ElasticsearchRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RouteToApp: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ElasticsearchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93943,29 +105084,30 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -93975,29 +105117,30 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PublicAddr", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94007,29 +105150,30 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PublicAddr = string(dAtA[iNdEx:postIndex])
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94039,27 +105183,28 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRoleARN", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94087,11 +105232,11 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWSRoleARN = string(dAtA[iNdEx:postIndex])
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AzureIdentity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94119,145 +105264,11 @@ func (m *RouteToApp) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AzureIdentity = string(dAtA[iNdEx:postIndex])
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GCPServiceAccount", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.GCPServiceAccount = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field URI", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.URI = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TargetPort", wireType)
-			}
-			m.TargetPort = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TargetPort |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: RouteToDatabase: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RouteToDatabase: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94285,13 +105296,13 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServiceName = string(dAtA[iNdEx:postIndex])
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Protocol", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94301,29 +105312,31 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Protocol = string(dAtA[iNdEx:postIndex])
+			m.Body = append(m.Body[:0], dAtA[iNdEx:postIndex]...)
+			if m.Body == nil {
+				m.Body = []byte{}
+			}
 			iNdEx = postIndex
-		case 3:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94333,27 +105346,47 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 4:
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Category", wireType)
+			}
+			m.Category = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Category |= ElasticsearchCategory(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Database", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94381,11 +105414,11 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Database = string(dAtA[iNdEx:postIndex])
+			m.Target = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94413,8 +105446,27 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
+			}
+			m.StatusCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.StatusCode |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -94437,7 +105489,7 @@ func (m *RouteToDatabase) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
+func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -94460,17 +105512,17 @@ func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceExtensions: wiretype end group for non-group")
+			return fmt.Errorf("proto: OpenSearchRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceExtensions: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OpenSearchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94480,29 +105532,30 @@ func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceId = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AssetTag", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94512,29 +105565,30 @@ func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AssetTag = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CredentialId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94544,78 +105598,28 @@ func (m *DeviceExtensions) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CredentialId = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AccessRequestResourceSearch: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessRequestResourceSearch: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -94642,15 +105646,15 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94660,28 +105664,27 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SearchAsRoles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94709,11 +105712,11 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SearchAsRoles = append(m.SearchAsRoles, string(dAtA[iNdEx:postIndex]))
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94741,13 +105744,13 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceType = string(dAtA[iNdEx:postIndex])
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -94757,27 +105760,29 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Namespace = string(dAtA[iNdEx:postIndex])
+			m.Body = append(m.Body[:0], dAtA[iNdEx:postIndex]...)
+			if m.Body == nil {
+				m.Body = []byte{}
+			}
 			iNdEx = postIndex
-		case 6:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -94804,107 +105809,32 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Labels == nil {
-				m.Labels = make(map[string]string)
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Category", wireType)
+			}
+			m.Category = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Category |= OpenSearchCategory(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.Labels[mapkey] = mapvalue
-			iNdEx = postIndex
-		case 7:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PredicateExpression", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94932,11 +105862,11 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PredicateExpression = string(dAtA[iNdEx:postIndex])
+			m.Target = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -94964,8 +105894,27 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
+			}
+			m.StatusCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.StatusCode |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -94988,7 +105937,7 @@ func (m *AccessRequestResourceSearch) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLStatementPrepare) Unmarshal(dAtA []byte) error {
+func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -95011,10 +105960,10 @@ func (m *MySQLStatementPrepare) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementPrepare: wiretype end group for non-group")
+			return fmt.Errorf("proto: DynamoDBRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementPrepare: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DynamoDBRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -95145,131 +106094,34 @@ func (m *MySQLStatementPrepare) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Query = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementExecute: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementExecute: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
+			}
+			m.StatusCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.StatusCode |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95279,30 +106131,29 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95312,30 +106163,29 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95345,30 +106195,29 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
-			m.StatementID = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95378,16 +106227,29 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 6:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Target = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95397,23 +106259,27 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
+			if m.Body == nil {
+				m.Body = &Struct{}
+			}
+			if err := m.Body.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -95437,7 +106303,7 @@ func (m *MySQLStatementExecute) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
+func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -95460,10 +106326,10 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementSendLongData: wiretype end group for non-group")
+			return fmt.Errorf("proto: AppSessionDynamoDBRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementSendLongData: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AppSessionDynamoDBRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -95534,7 +106400,7 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -95561,13 +106427,13 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRequestMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -95594,15 +106460,15 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AWSRequestMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionChunkID", wireType)
 			}
-			m.StatementID = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95612,16 +106478,29 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionChunkID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 6:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ParameterID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
 			}
-			m.ParameterID = 0
+			m.StatusCode = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95631,16 +106510,16 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ParameterID |= uint32(b&0x7F) << shift
+				m.StatusCode |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
 		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DataSize", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			m.DataSize = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95650,67 +106529,29 @@ func (m *MySQLStatementSendLongData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DataSize |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementClose: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementClose: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95720,30 +106561,29 @@ func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95753,30 +106593,29 @@ func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -95786,28 +106625,27 @@ func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Target = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -95834,29 +106672,13 @@ func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Body == nil {
+				m.Body = &Struct{}
+			}
+			if err := m.Body.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
-			}
-			m.StatementID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -95879,7 +106701,7 @@ func (m *MySQLStatementClose) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLStatementReset) Unmarshal(dAtA []byte) error {
+func (m *UpgradeWindowStartMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -95902,116 +106724,17 @@ func (m *MySQLStatementReset) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementReset: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpgradeWindowStartMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementReset: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpgradeWindowStartMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStart", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -96021,44 +106744,24 @@ func (m *MySQLStatementReset) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.UpgradeWindowStart = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
-			}
-			m.StatementID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -96081,7 +106784,7 @@ func (m *MySQLStatementReset) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
+func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96104,10 +106807,10 @@ func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementFetch: wiretype end group for non-group")
+			return fmt.Errorf("proto: UpgradeWindowStartUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementFetch: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UpgradeWindowStartUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -96211,7 +106914,7 @@ func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStartMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96238,48 +106941,10 @@ func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UpgradeWindowStartMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
-			}
-			m.StatementID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RowsCount", wireType)
-			}
-			m.RowsCount = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.RowsCount |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -96302,7 +106967,7 @@ func (m *MySQLStatementFetch) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
+func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96325,10 +106990,10 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLStatementBulkExecute: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionRecordingAccess: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLStatementBulkExecute: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionRecordingAccess: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -96366,9 +107031,9 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -96378,28 +107043,27 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SessionID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96426,15 +107090,15 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -96444,47 +107108,27 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SessionType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatementID", wireType)
-			}
-			m.StatementID = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatementID |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Format", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -96512,7 +107156,7 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
+			m.Format = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -96536,7 +107180,7 @@ func (m *MySQLStatementBulkExecute) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
+func (m *KubeClusterMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96559,15 +107203,15 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLInitDB: wiretype end group for non-group")
+			return fmt.Errorf("proto: KubeClusterMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLInitDB: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: KubeClusterMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeLabels", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96594,13 +107238,158 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.KubeLabels == nil {
+				m.KubeLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowEvents
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowEvents
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipEvents(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthEvents
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.KubeLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesClusterCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesClusterCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96627,13 +107416,13 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96660,13 +107449,13 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96693,15 +107482,15 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeClusterMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -96711,23 +107500,24 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SchemaName = string(dAtA[iNdEx:postIndex])
+			if err := m.KubeClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -96751,7 +107541,7 @@ func (m *MySQLInitDB) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
+func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96774,10 +107564,10 @@ func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLCreateDB: wiretype end group for non-group")
+			return fmt.Errorf("proto: KubernetesClusterUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLCreateDB: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: KubernetesClusterUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -96848,7 +107638,7 @@ func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96875,13 +107665,13 @@ func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeClusterMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -96908,42 +107698,10 @@ func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.KubeClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SchemaName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -96966,7 +107724,7 @@ func (m *MySQLCreateDB) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
+func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96989,10 +107747,10 @@ func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLDropDB: wiretype end group for non-group")
+			return fmt.Errorf("proto: KubernetesClusterDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLDropDB: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: KubernetesClusterDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -97063,40 +107821,7 @@ func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -97123,42 +107848,10 @@ func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchemaName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SchemaName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -97181,7 +107874,7 @@ func (m *MySQLDropDB) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
+func (m *SSMRun) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -97204,10 +107897,10 @@ func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLShutDown: wiretype end group for non-group")
+			return fmt.Errorf("proto: SSMRun: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLShutDown: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SSMRun: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -97245,9 +107938,9 @@ func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CommandID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97257,30 +107950,29 @@ func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CommandID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97290,30 +107982,48 @@ func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.InstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExitCode", wireType)
+			}
+			m.ExitCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ExitCode |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97323,81 +108033,29 @@ func (m *MySQLShutDown) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Status = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLProcessKill: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLProcessKill: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97407,30 +108065,29 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AccountID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97440,30 +108097,29 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Region = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StandardOutput", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97473,30 +108129,29 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.StandardOutput = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StandardError", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97506,30 +108161,29 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.StandardError = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProcessID", wireType)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InvocationURL", wireType)
 			}
-			m.ProcessID = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -97539,11 +108193,24 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ProcessID |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InvocationURL = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -97566,7 +108233,7 @@ func (m *MySQLProcessKill) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLDebug) Unmarshal(dAtA []byte) error {
+func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -97589,10 +108256,10 @@ func (m *MySQLDebug) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLDebug: wiretype end group for non-group")
+			return fmt.Errorf("proto: CassandraPrepare: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLDebug: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CassandraPrepare: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -97727,6 +108394,70 @@ func (m *MySQLDebug) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Query = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Keyspace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Keyspace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -97749,7 +108480,7 @@ func (m *MySQLDebug) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
+func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -97772,10 +108503,10 @@ func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MySQLRefresh: wiretype end group for non-group")
+			return fmt.Errorf("proto: CassandraExecute: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MySQLRefresh: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CassandraExecute: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -97912,7 +108643,7 @@ func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Subcommand", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field QueryId", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -97940,7 +108671,7 @@ func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Subcommand = string(dAtA[iNdEx:postIndex])
+			m.QueryId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -97964,7 +108695,7 @@ func (m *MySQLRefresh) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
+func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -97987,10 +108718,10 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SQLServerRPCRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CassandraBatch: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SQLServerRPCRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CassandraBatch: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -98078,25 +108809,90 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-			if msglen < 0 {
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Consistency", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Consistency = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Keyspace", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98106,28 +108902,27 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Keyspace = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Procname", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BatchType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -98155,13 +108950,13 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Procname = string(dAtA[iNdEx:postIndex])
+			m.BatchType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Children", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98171,23 +108966,25 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
+			m.Children = append(m.Children, &CassandraBatch_BatchChild{})
+			if err := m.Children[len(m.Children)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -98211,7 +109008,7 @@ func (m *SQLServerRPCRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
+func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -98234,17 +109031,17 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DatabaseSessionMalformedPacket: wiretype end group for non-group")
+			return fmt.Errorf("proto: BatchChild: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DatabaseSessionMalformedPacket: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BatchChild: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98254,30 +109051,29 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98287,28 +109083,27 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -98335,15 +109130,67 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Values = append(m.Values, &CassandraBatch_BatchChild_Value{})
+			if err := m.Values[len(m.Values)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			var msglen int
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CassandraBatch_BatchChild_Value) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Value: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Value: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98353,28 +109200,14 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.Type |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Payload", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Contents", wireType)
 			}
 			var byteLen int
 			for shift := uint(0); ; shift += 7 {
@@ -98401,9 +109234,9 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Payload = append(m.Payload[:0], dAtA[iNdEx:postIndex]...)
-			if m.Payload == nil {
-				m.Payload = []byte{}
+			m.Contents = append(m.Contents[:0], dAtA[iNdEx:postIndex]...)
+			if m.Contents == nil {
+				m.Contents = []byte{}
 			}
 			iNdEx = postIndex
 		default:
@@ -98428,7 +109261,7 @@ func (m *DatabaseSessionMalformedPacket) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
+func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -98451,10 +109284,10 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ElasticsearchRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: CassandraRegister: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ElasticsearchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CassandraRegister: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -98591,7 +109424,7 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EventTypes", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -98619,13 +109452,64 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			m.EventTypes = append(m.EventTypes, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 6:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LoginRuleCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LoginRuleCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98635,29 +109519,30 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RawQuery = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98667,29 +109552,30 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var byteLen int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98699,29 +109585,79 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Body = append(m.Body[:0], dAtA[iNdEx:postIndex]...)
-			if m.Body == nil {
-				m.Body = []byte{}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
 			iNdEx = postIndex
-		case 9:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LoginRuleDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LoginRuleDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -98748,34 +109684,15 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Category", wireType)
-			}
-			m.Category = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Category |= ElasticsearchCategory(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98785,29 +109702,30 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Target = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 12:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -98817,43 +109735,25 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 13:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
-			}
-			m.StatusCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatusCode |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -98876,7 +109776,7 @@ func (m *ElasticsearchRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
+func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -98899,10 +109799,10 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OpenSearchRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: SAMLIdPAuthAttempt: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OpenSearchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SAMLIdPAuthAttempt: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -99006,7 +109906,7 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99033,15 +109933,99 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99051,29 +110035,30 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99083,29 +110068,30 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RawQuery = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99115,61 +110101,79 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
+			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if byteLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Body = append(m.Body[:0], dAtA[iNdEx:postIndex]...)
-			if m.Body == nil {
-				m.Body = []byte{}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 9:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99196,34 +110200,15 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 10:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Category", wireType)
-			}
-			m.Category = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Category |= OpenSearchCategory(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 11:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99233,29 +110218,30 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Target = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 12:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99265,43 +110251,25 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 13:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
-			}
-			m.StatusCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatusCode |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -99324,7 +110292,7 @@ func (m *OpenSearchRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
+func (m *SAMLIdPServiceProviderDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99347,10 +110315,10 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DynamoDBRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: SAMLIdPServiceProviderDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DynamoDBRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SAMLIdPServiceProviderDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -99388,7 +110356,7 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99415,13 +110383,13 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99448,13 +110416,64 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLIdPServiceProviderDeleteAll) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderDeleteAll: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLIdPServiceProviderDeleteAll: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99481,34 +110500,15 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
-			}
-			m.StatusCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatusCode |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99518,61 +110518,81 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaResourcesUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RawQuery = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaResourcesUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaResourcesUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99582,29 +110602,30 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99614,27 +110635,28 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Target = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaResourcesUpdatedMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99661,10 +110683,7 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Body == nil {
-				m.Body = &Struct{}
-			}
-			if err := m.Body.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.OktaResourcesUpdatedMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -99690,7 +110709,7 @@ func (m *DynamoDBRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
+func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99713,10 +110732,10 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppSessionDynamoDBRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: OktaSyncFailure: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppSessionDynamoDBRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OktaSyncFailure: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -99754,7 +110773,7 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99781,13 +110800,13 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99814,99 +110833,66 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWSRequestMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AWSRequestMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionChunkID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionChunkID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
-			}
-			m.StatusCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.StatusCode |= uint32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-		case 7:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaAssignmentResult: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaAssignmentResult: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99916,29 +110902,30 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99948,29 +110935,30 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RawQuery = string(dAtA[iNdEx:postIndex])
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -99980,29 +110968,30 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Method = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -100012,27 +111001,28 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Target = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OktaAssignmentMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100059,10 +111049,7 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Body == nil {
-				m.Body = &Struct{}
-			}
-			if err := m.Body.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.OktaAssignmentMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -100088,7 +111075,7 @@ func (m *AppSessionDynamoDBRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpgradeWindowStartMetadata) Unmarshal(dAtA []byte) error {
+func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100111,15 +111098,114 @@ func (m *UpgradeWindowStartMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpgradeWindowStartMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpgradeWindowStartMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStart", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100147,7 +111233,7 @@ func (m *UpgradeWindowStartMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpgradeWindowStart = string(dAtA[iNdEx:postIndex])
+			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100171,7 +111257,7 @@ func (m *UpgradeWindowStartMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
+func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100194,10 +111280,10 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UpgradeWindowStartUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UpgradeWindowStartUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -100235,7 +111321,7 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100262,13 +111348,13 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100295,15 +111381,15 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeWindowStartMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -100313,24 +111399,23 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UpgradeWindowStartMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100354,7 +111439,7 @@ func (m *UpgradeWindowStartUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
+func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100377,10 +111462,10 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SessionRecordingAccess: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionRecordingAccess: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -100418,9 +111503,9 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -100430,27 +111515,28 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionID = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100477,45 +111563,13 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionType", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SessionType = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Format", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100543,7 +111597,7 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Format = string(dAtA[iNdEx:postIndex])
+			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100567,7 +111621,7 @@ func (m *SessionRecordingAccess) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *KubeClusterMetadata) Unmarshal(dAtA []byte) error {
+func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100590,15 +111644,15 @@ func (m *KubeClusterMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubeClusterMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListMemberCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubeClusterMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListMemberCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeLabels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100625,103 +111679,108 @@ func (m *KubeClusterMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.KubeLabels == nil {
-				m.KubeLabels = make(map[string]string)
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowEvents
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowEvents
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipEvents(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthEvents
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.KubeLabels[mapkey] = mapvalue
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100745,7 +111804,7 @@ func (m *KubeClusterMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
+func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100768,10 +111827,10 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesClusterCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListMemberUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesClusterCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListMemberUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -100809,7 +111868,7 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100836,13 +111895,13 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100869,13 +111928,13 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -100902,7 +111961,7 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubeClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -100928,7 +111987,7 @@ func (m *KubernetesClusterCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
+func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100951,10 +112010,10 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesClusterUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListMemberDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesClusterUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListMemberDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -100992,7 +112051,7 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101019,13 +112078,13 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101052,13 +112111,13 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeClusterMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101085,7 +112144,7 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.KubeClusterMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -101111,7 +112170,7 @@ func (m *KubernetesClusterUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
+func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -101134,10 +112193,10 @@ func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesClusterDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListMemberDeleteAllForAccessList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesClusterDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListMemberDeleteAllForAccessList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -101175,7 +112234,7 @@ func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101202,11 +112261,161 @@ func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessListReview) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessListReview: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessListReview: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
@@ -101239,6 +112448,72 @@ func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListReviewMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.AccessListReviewMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -101261,7 +112536,7 @@ func (m *KubernetesClusterDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SSMRun) Unmarshal(dAtA []byte) error {
+func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -101284,10 +112559,10 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SSMRun: wiretype end group for non-group")
+			return fmt.Errorf("proto: AuditQueryRun: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SSMRun: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AuditQueryRun: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -101325,9 +112600,9 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CommandID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101337,29 +112612,30 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CommandID = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101369,48 +112645,30 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InstanceID = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExitCode", wireType)
-			}
-			m.ExitCode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.ExitCode |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueryDetails", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101420,27 +112678,79 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Status = string(dAtA[iNdEx:postIndex])
+			if err := m.AuditQueryDetails.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuditQueryDetails: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuditQueryDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -101468,11 +112778,11 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccountID = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -101500,13 +112810,13 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Region = string(dAtA[iNdEx:postIndex])
+			m.Query = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StandardOutput", wireType)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Days", wireType)
 			}
-			var stringLen uint64
+			m.Days = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101516,29 +112826,16 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.Days |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.StandardOutput = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StandardError", wireType)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExecutionTimeInMillis", wireType)
 			}
-			var stringLen uint64
+			m.ExecutionTimeInMillis = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101548,29 +112845,16 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.ExecutionTimeInMillis |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.StandardError = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 10:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InvocationURL", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DataScannedInBytes", wireType)
 			}
-			var stringLen uint64
+			m.DataScannedInBytes = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101580,24 +112864,11 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.DataScannedInBytes |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.InvocationURL = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -101620,7 +112891,7 @@ func (m *SSMRun) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
+func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -101643,10 +112914,10 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CassandraPrepare: wiretype end group for non-group")
+			return fmt.Errorf("proto: SecurityReportRun: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CassandraPrepare: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SecurityReportRun: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -101717,7 +112988,7 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101744,15 +113015,15 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101762,28 +113033,27 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -101795,29 +113065,67 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalExecutionTimeInMillis", wireType)
+			}
+			m.TotalExecutionTimeInMillis = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TotalExecutionTimeInMillis |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalDataScannedInBytes", wireType)
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			m.TotalDataScannedInBytes = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TotalDataScannedInBytes |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Keyspace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueries", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -101827,23 +113135,25 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Keyspace = string(dAtA[iNdEx:postIndex])
+			m.AuditQueries = append(m.AuditQueries, &AuditQueryDetails{})
+			if err := m.AuditQueries[len(m.AuditQueries)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -101867,7 +113177,7 @@ func (m *CassandraPrepare) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
+func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -101890,10 +113200,10 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CassandraExecute: wiretype end group for non-group")
+			return fmt.Errorf("proto: ExternalAuditStorageEnable: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CassandraExecute: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ExternalAuditStorageEnable: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -101931,7 +113241,7 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101958,13 +113268,13 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -101991,13 +113301,67 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Details == nil {
+				m.Details = &ExternalAuditStorageDetails{}
+			}
+			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExternalAuditStorageDisable: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExternalAuditStorageDisable: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -102024,15 +113388,15 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field QueryId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102042,23 +113406,60 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.QueryId = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Details == nil {
+				m.Details = &ExternalAuditStorageDetails{}
+			}
+			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -102082,7 +113483,7 @@ func (m *CassandraExecute) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
+func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -102105,17 +113506,17 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CassandraBatch: wiretype end group for non-group")
+			return fmt.Errorf("proto: ExternalAuditStorageDetails: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CassandraBatch: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ExternalAuditStorageDetails: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102125,30 +113526,29 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.IntegrationName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingsUri", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102158,30 +113558,29 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SessionRecordingsUri = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AthenaWorkgroup", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102191,30 +113590,29 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AthenaWorkgroup = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GlueDatabase", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102224,28 +113622,27 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.GlueDatabase = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Consistency", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GlueTable", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -102273,11 +113670,11 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Consistency = string(dAtA[iNdEx:postIndex])
+			m.GlueTable = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Keyspace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AuditEventsLongTermUri", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -102305,11 +113702,11 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Keyspace = string(dAtA[iNdEx:postIndex])
+			m.AuditEventsLongTermUri = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BatchType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AthenaResultsUri", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -102337,13 +113734,13 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BatchType = string(dAtA[iNdEx:postIndex])
+			m.AthenaResultsUri = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Children", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PolicyName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102353,25 +113750,55 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Children = append(m.Children, &CassandraBatch_BatchChild{})
-			if err := m.Children[len(m.Children)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.PolicyName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
 			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Region = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -102395,7 +113822,7 @@ func (m *CassandraBatch) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
+func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -102418,17 +113845,17 @@ func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BatchChild: wiretype end group for non-group")
+			return fmt.Errorf("proto: OktaAccessListSync: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BatchChild: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OktaAccessListSync: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102438,29 +113865,30 @@ func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ID = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102470,29 +113898,30 @@ func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumAppFilters", wireType)
 			}
-			var msglen int
+			m.NumAppFilters = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102502,82 +113931,54 @@ func (m *CassandraBatch_BatchChild) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.NumAppFilters |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Values = append(m.Values, &CassandraBatch_BatchChild_Value{})
-			if err := m.Values[len(m.Values)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumGroupFilters", wireType)
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CassandraBatch_BatchChild_Value) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.NumGroupFilters = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumGroupFilters |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumApps", wireType)
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.NumApps = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumApps |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Value: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Value: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NumGroups", wireType)
 			}
-			m.Type = 0
+			m.NumGroups = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102587,16 +113988,16 @@ func (m *CassandraBatch_BatchChild_Value) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Type |= uint32(b&0x7F) << shift
+				m.NumGroups |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Contents", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumRoles", wireType)
 			}
-			var byteLen int
+			m.NumRoles = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102606,26 +114007,49 @@ func (m *CassandraBatch_BatchChild_Value) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				m.NumRoles |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
-				return ErrInvalidLengthEvents
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumAccessLists", wireType)
 			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.NumAccessLists = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumAccessLists |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumAccessListMembers", wireType)
 			}
-			m.Contents = append(m.Contents[:0], dAtA[iNdEx:postIndex]...)
-			if m.Contents == nil {
-				m.Contents = []byte{}
+			m.NumAccessListMembers = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumAccessListMembers |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -102648,7 +114072,7 @@ func (m *CassandraBatch_BatchChild_Value) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
+func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -102671,10 +114095,10 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CassandraRegister: wiretype end group for non-group")
+			return fmt.Errorf("proto: OktaUserSync: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CassandraRegister: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OktaUserSync: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -102712,7 +114136,7 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -102739,15 +114163,15 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OrgUrl", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102757,30 +114181,29 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.OrgUrl = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102790,30 +114213,29 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AppId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EventTypes", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersCreated", wireType)
 			}
-			var stringLen uint64
+			m.NumUsersCreated = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102823,24 +114245,68 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.NumUsersCreated |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersDeleted", wireType)
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.NumUsersDeleted = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumUsersDeleted |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersModified", wireType)
+			}
+			m.NumUsersModified = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumUsersModified |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersTotal", wireType)
+			}
+			m.NumUsersTotal = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumUsersTotal |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.EventTypes = append(m.EventTypes, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -102863,7 +114329,7 @@ func (m *CassandraRegister) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
+func (m *LabelSelector) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -102886,17 +114352,17 @@ func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: LoginRuleCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: LabelSelector: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: LoginRuleCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: LabelSelector: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102906,63 +114372,29 @@ func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Key = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -102972,24 +114404,23 @@ func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Values = append(m.Values, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -103013,7 +114444,7 @@ func (m *LoginRuleCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
+func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -103036,10 +114467,10 @@ func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: LoginRuleDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: SPIFFESVIDIssued: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: LoginRuleDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SPIFFESVIDIssued: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -103077,7 +114508,7 @@ func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103104,13 +114535,13 @@ func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103137,66 +114568,79 @@ func (m *LoginRuleDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEID", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.SPIFFEID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DNSSANs", wireType)
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPAuthAttempt: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPAuthAttempt: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DNSSANs = append(m.DNSSANs, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IPSANs", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103206,30 +114650,29 @@ func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.IPSANs = append(m.IPSANs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SVIDType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103239,30 +114682,29 @@ func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SVIDType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SerialNumber", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103272,30 +114714,29 @@ func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SerialNumber = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Hint", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103305,30 +114746,29 @@ func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Hint = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JTI", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103338,79 +114778,123 @@ func (m *SAMLIdPAuthAttempt) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.JTI = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Audiences", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.Audiences = append(m.Audiences, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentity", wireType)
 			}
-			if iNdEx >= l {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.WorkloadIdentity = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityRevision", wireType)
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WorkloadIdentityRevision = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103437,15 +114921,18 @@ func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Attributes == nil {
+				m.Attributes = &Struct{}
+			}
+			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 15:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NameSelector", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -103455,28 +114942,27 @@ func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.NameSelector = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 16:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LabelSelectors", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103503,7 +114989,8 @@ func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.LabelSelectors = append(m.LabelSelectors, &LabelSelector{})
+			if err := m.LabelSelectors[len(m.LabelSelectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -103529,7 +115016,7 @@ func (m *SAMLIdPServiceProviderCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
+func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -103552,10 +115039,10 @@ func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AuthPreferenceUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AuthPreferenceUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -103593,7 +115080,7 @@ func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103620,13 +115107,13 @@ func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103653,10 +115140,62 @@ func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AdminActionsMFA", wireType)
+			}
+			m.AdminActionsMFA = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.AdminActionsMFA |= AdminActionsMFAStatus(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -103679,7 +115218,7 @@ func (m *SAMLIdPServiceProviderUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SAMLIdPServiceProviderDelete) Unmarshal(dAtA []byte) error {
+func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -103702,10 +115241,10 @@ func (m *SAMLIdPServiceProviderDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClusterNetworkingConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClusterNetworkingConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -103743,7 +115282,7 @@ func (m *SAMLIdPServiceProviderDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103770,97 +115309,13 @@ func (m *SAMLIdPServiceProviderDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SAMLIdPServiceProviderMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.SAMLIdPServiceProviderMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SAMLIdPServiceProviderDeleteAll) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderDeleteAll: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SAMLIdPServiceProviderDeleteAll: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103887,13 +115342,13 @@ func (m *SAMLIdPServiceProviderDeleteAll) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -103920,7 +115375,7 @@ func (m *SAMLIdPServiceProviderDeleteAll) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -103946,7 +115401,7 @@ func (m *SAMLIdPServiceProviderDeleteAll) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaResourcesUpdate) Unmarshal(dAtA []byte) error {
+func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -103969,10 +115424,10 @@ func (m *OktaResourcesUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaResourcesUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SessionRecordingConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaResourcesUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SessionRecordingConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -104004,130 +115459,13 @@ func (m *OktaResourcesUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaResourcesUpdatedMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.OktaResourcesUpdatedMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OktaSyncFailure: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaSyncFailure: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104154,13 +115492,13 @@ func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104187,13 +115525,13 @@ func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104220,7 +115558,7 @@ func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -104246,7 +115584,7 @@ func (m *OktaSyncFailure) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
+func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -104269,10 +115607,10 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaAssignmentResult: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessPathChanged: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaAssignmentResult: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessPathChanged: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -104310,9 +115648,9 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ChangeID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104322,30 +115660,29 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ChangeID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104355,30 +115692,29 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AffectedResourceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceSource", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104388,30 +115724,29 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AffectedResourceSource = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OktaAssignmentMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104421,24 +115756,23 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.OktaAssignmentMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AffectedResourceType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -104462,7 +115796,7 @@ func (m *OktaAssignmentResult) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
+func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -104485,10 +115819,10 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SpannerRPC: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SpannerRPC: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -104526,7 +115860,7 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104553,11 +115887,77 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
@@ -104590,9 +115990,9 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Procedure", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -104620,7 +116020,43 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
+			m.Procedure = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Args", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Args == nil {
+				m.Args = &Struct{}
+			}
+			if err := m.Args.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -104644,7 +116080,7 @@ func (m *AccessListCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
+func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -104667,10 +116103,10 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessGraphSettingsUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessGraphSettingsUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -104708,7 +116144,7 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104735,13 +116171,13 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104768,15 +116204,15 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104786,23 +116222,24 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -104826,7 +116263,7 @@ func (m *AccessListUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
+func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -104849,10 +116286,10 @@ func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: SPIFFEFederationCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SPIFFEFederationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -104923,7 +116360,7 @@ func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -104950,15 +116387,15 @@ func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListTitle", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -104968,23 +116405,24 @@ func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AccessListTitle = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -105008,7 +116446,7 @@ func (m *AccessListDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
+func (m *SPIFFEFederationDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105031,10 +116469,10 @@ func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMemberCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SPIFFEFederationDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMemberCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SPIFFEFederationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105105,7 +116543,7 @@ func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105132,13 +116570,13 @@ func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105165,7 +116603,7 @@ func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -105191,7 +116629,7 @@ func (m *AccessListMemberCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105214,10 +116652,10 @@ func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMemberUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateConfigCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMemberUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105288,7 +116726,7 @@ func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105315,11 +116753,44 @@ func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
@@ -105374,7 +116845,7 @@ func (m *AccessListMemberUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105397,10 +116868,10 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMemberDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMemberDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105438,7 +116909,7 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105465,13 +116936,13 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105498,13 +116969,13 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105531,7 +117002,40 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -105557,7 +117061,7 @@ func (m *AccessListMemberDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105580,10 +117084,10 @@ func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListMemberDeleteAllForAccessList: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateConfigDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListMemberDeleteAllForAccessList: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105654,7 +117158,7 @@ func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListMemberMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105681,11 +117185,44 @@ func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AccessListMemberMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
@@ -105740,7 +117277,7 @@ func (m *AccessListMemberDeleteAllForAccessList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessListReview) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105763,10 +117300,10 @@ func (m *AccessListReview) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListReview: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateVersionCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListReview: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateVersionCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105837,7 +117374,7 @@ func (m *AccessListReview) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListReviewMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -105864,11 +117401,44 @@ func (m *AccessListReview) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AccessListReviewMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
@@ -105923,7 +117493,7 @@ func (m *AccessListReview) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -105946,10 +117516,10 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AuditQueryRun: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateVersionUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AuditQueryRun: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateVersionUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -105987,7 +117557,7 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106014,13 +117584,13 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106047,13 +117617,13 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueryDetails", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106080,7 +117650,40 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.AuditQueryDetails.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -106106,7 +117709,7 @@ func (m *AuditQueryRun) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateVersionDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -106129,17 +117732,17 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AuditQueryDetails: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateVersionDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AuditQueryDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateVersionDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106149,29 +117752,30 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Query", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106181,29 +117785,30 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Query = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Days", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			m.Days = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106213,16 +117818,30 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Days |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExecutionTimeInMillis", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.ExecutionTimeInMillis = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106232,16 +117851,30 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ExecutionTimeInMillis |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DataScannedInBytes", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			m.DataScannedInBytes = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106251,11 +117884,25 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DataScannedInBytes |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -106278,7 +117925,7 @@ func (m *AuditQueryDetails) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateAgentRolloutTrigger) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -106301,10 +117948,10 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SecurityReportRun: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutTrigger: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SecurityReportRun: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutTrigger: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -106375,7 +118022,7 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106402,13 +118049,13 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -106436,81 +118083,11 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Version = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalExecutionTimeInMillis", wireType)
-			}
-			m.TotalExecutionTimeInMillis = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TotalExecutionTimeInMillis |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalDataScannedInBytes", wireType)
-			}
-			m.TotalDataScannedInBytes = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TotalDataScannedInBytes |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuditQueries", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106537,8 +118114,7 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AuditQueries = append(m.AuditQueries, &AuditQueryDetails{})
-			if err := m.AuditQueries[len(m.AuditQueries)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -106564,7 +118140,7 @@ func (m *SecurityReportRun) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -106587,10 +118163,10 @@ func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExternalAuditStorageEnable: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutForceDone: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExternalAuditStorageEnable: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutForceDone: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -106622,13 +118198,46 @@ func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106655,13 +118264,45 @@ func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106688,10 +118329,7 @@ func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Details == nil {
-				m.Details = &ExternalAuditStorageDetails{}
-			}
-			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -106717,7 +118355,7 @@ func (m *ExternalAuditStorageEnable) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
+func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -106740,10 +118378,10 @@ func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExternalAuditStorageDisable: wiretype end group for non-group")
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutRollback: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExternalAuditStorageDisable: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AutoUpdateAgentRolloutRollback: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -106781,7 +118419,7 @@ func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106808,13 +118446,13 @@ func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -106841,10 +118479,72 @@ func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Details == nil {
-				m.Details = &ExternalAuditStorageDetails{}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -106870,7 +118570,7 @@ func (m *ExternalAuditStorageDisable) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
+func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -106893,17 +118593,17 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExternalAuditStorageDetails: wiretype end group for non-group")
+			return fmt.Errorf("proto: StaticHostUserCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExternalAuditStorageDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: StaticHostUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 3:
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntegrationName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106913,29 +118613,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IntegrationName = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionRecordingsUri", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106945,29 +118646,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SessionRecordingsUri = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AthenaWorkgroup", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -106977,29 +118679,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AthenaWorkgroup = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GlueDatabase", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107009,29 +118712,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.GlueDatabase = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GlueTable", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107041,29 +118745,81 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.GlueTable = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StaticHostUserUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StaticHostUserUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AuditEventsLongTermUri", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107073,29 +118829,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AuditEventsLongTermUri = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AthenaResultsUri", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107105,29 +118862,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AthenaResultsUri = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PolicyName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107137,29 +118895,30 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PolicyName = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107169,23 +118928,57 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Region = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -107209,7 +119002,7 @@ func (m *ExternalAuditStorageDetails) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
+func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -107232,10 +119025,10 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaAccessListSync: wiretype end group for non-group")
+			return fmt.Errorf("proto: StaticHostUserDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaAccessListSync: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: StaticHostUserDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -107305,10 +119098,10 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumAppFilters", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			m.NumAppFilters = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107318,16 +119111,30 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.NumAppFilters |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumGroupFilters", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			m.NumGroupFilters = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107337,54 +119144,30 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.NumGroupFilters |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumApps", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.NumApps = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumApps |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumGroups", wireType)
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-			m.NumGroups = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumGroups |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumRoles", wireType)
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.NumRoles = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107394,49 +119177,25 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.NumRoles |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumAccessLists", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.NumAccessLists = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumAccessLists |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumAccessListMembers", wireType)
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-			m.NumAccessListMembers = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumAccessListMembers |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -107459,7 +119218,7 @@ func (m *OktaAccessListSync) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
+func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -107482,10 +119241,10 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaUserSync: wiretype end group for non-group")
+			return fmt.Errorf("proto: CrownJewelCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaUserSync: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CrownJewelCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -107556,9 +119315,9 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OrgUrl", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107568,29 +119327,30 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OrgUrl = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107600,29 +119360,30 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppId = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersCreated", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			m.NumUsersCreated = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107632,54 +119393,30 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.NumUsersCreated |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersDeleted", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.NumUsersDeleted = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumUsersDeleted |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersModified", wireType)
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-			m.NumUsersModified = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.NumUsersModified |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NumUsersTotal", wireType)
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelQuery", wireType)
 			}
-			m.NumUsersTotal = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107689,11 +119426,24 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.NumUsersTotal |= int32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CrownJewelQuery = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -107716,7 +119466,7 @@ func (m *OktaUserSync) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
+func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -107739,10 +119489,10 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SPIFFESVIDIssued: wiretype end group for non-group")
+			return fmt.Errorf("proto: CrownJewelUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SPIFFESVIDIssued: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CrownJewelUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -107780,7 +119530,7 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -107807,13 +119557,13 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -107840,15 +119590,15 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SPIFFEID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107858,29 +119608,30 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SPIFFEID = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DNSSANs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -107890,27 +119641,28 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DNSSANs = append(m.DNSSANs, string(dAtA[iNdEx:postIndex]))
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IPSANs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CurrentCrownJewelQuery", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -107938,11 +119690,11 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IPSANs = append(m.IPSANs, string(dAtA[iNdEx:postIndex]))
+			m.CurrentCrownJewelQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SVIDType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedCrownJewelQuery", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -107970,77 +119722,64 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SVIDType = string(dAtA[iNdEx:postIndex])
+			m.UpdatedCrownJewelQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SerialNumber", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SerialNumber = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 9:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Hint", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Hint = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 10:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CrownJewelDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CrownJewelDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JTI", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108050,29 +119789,30 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.JTI = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Audiences", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108082,29 +119822,30 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Audiences = append(m.Audiences, string(dAtA[iNdEx:postIndex]))
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 12:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108114,29 +119855,30 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WorkloadIdentity = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 13:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityRevision", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108146,27 +119888,28 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WorkloadIdentityRevision = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 14:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -108193,10 +119936,7 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Attributes == nil {
-				m.Attributes = &Struct{}
-			}
-			if err := m.Attributes.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -108222,7 +119962,7 @@ func (m *SPIFFESVIDIssued) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
+func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -108245,10 +119985,10 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AuthPreferenceUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserTaskCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AuthPreferenceUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserTaskCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -108318,6 +120058,39 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -108350,7 +120123,7 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -108383,11 +120156,11 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AdminActionsMFA", wireType)
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskMetadata", wireType)
 			}
-			m.AdminActionsMFA = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108397,11 +120170,25 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.AdminActionsMFA |= AdminActionsMFAStatus(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserTaskMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -108424,7 +120211,7 @@ func (m *AuthPreferenceUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
+func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -108447,10 +120234,10 @@ func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ClusterNetworkingConfigUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserTaskUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ClusterNetworkingConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserTaskUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -108521,7 +120308,7 @@ func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -108548,13 +120335,13 @@ func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -108581,64 +120368,13 @@ func (m *ClusterNetworkingConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SessionRecordingConfigUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SessionRecordingConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -108665,13 +120401,13 @@ func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -108698,15 +120434,15 @@ func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserTaskMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CurrentUserTaskState", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108716,30 +120452,29 @@ func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CurrentUserTaskState = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedUserTaskState", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -108749,24 +120484,23 @@ func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.UpdatedUserTaskState = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -108790,7 +120524,7 @@ func (m *SessionRecordingConfigUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
+func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -108813,80 +120547,15 @@ func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessPathChanged: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserTaskMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessPathChanged: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserTaskMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ChangeID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ChangeID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TaskType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -108914,11 +120583,11 @@ func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AffectedResourceName = string(dAtA[iNdEx:postIndex])
+			m.TaskType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceSource", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IssueType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -108946,11 +120615,11 @@ func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AffectedResourceSource = string(dAtA[iNdEx:postIndex])
+			m.IssueType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AffectedResourceType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Integration", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -108978,7 +120647,7 @@ func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AffectedResourceType = string(dAtA[iNdEx:postIndex])
+			m.Integration = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -109002,7 +120671,7 @@ func (m *AccessPathChanged) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
+func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -109025,10 +120694,10 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SpannerRPC: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserTaskDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SpannerRPC: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserTaskDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -109066,7 +120735,7 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109093,13 +120762,13 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109126,13 +120795,13 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DatabaseMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109159,78 +120828,13 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DatabaseMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Procedure", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Procedure = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Args", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109257,10 +120861,7 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Args == nil {
-				m.Args = &Struct{}
-			}
-			if err := m.Args.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -109286,7 +120887,7 @@ func (m *SpannerRPC) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
+func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -109309,10 +120910,10 @@ func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessGraphSettingsUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: ContactCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessGraphSettingsUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ContactCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -109350,7 +120951,7 @@ func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109377,7 +120978,7 @@ func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -109447,93 +121048,9 @@ func (m *AccessGraphSettingsUpdate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SPIFFEFederationCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SPIFFEFederationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109560,15 +121077,15 @@ func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -109578,30 +121095,29 @@ func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Email = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContactType", wireType)
 			}
-			var msglen int
+			m.ContactType = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -109611,25 +121127,11 @@ func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.ContactType |= ContactType(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -109652,7 +121154,7 @@ func (m *SPIFFEFederationCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SPIFFEFederationDelete) Unmarshal(dAtA []byte) error {
+func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -109675,10 +121177,10 @@ func (m *SPIFFEFederationDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SPIFFEFederationDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: ContactDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SPIFFEFederationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ContactDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -109743,130 +121245,13 @@ func (m *SPIFFEFederationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateConfigCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109893,13 +121278,13 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109926,13 +121311,13 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -109959,15 +121344,15 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -109977,30 +121362,29 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Email = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContactType", wireType)
 			}
-			var msglen int
+			m.ContactType = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -110010,25 +121394,11 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.ContactType |= ContactType(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -110051,7 +121421,7 @@ func (m *AutoUpdateConfigCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -110074,10 +121444,10 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateConfigUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -110115,7 +121485,7 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -110142,7 +121512,7 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -110214,7 +121584,7 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -110241,7 +121611,10 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.WorkloadIdentityData == nil {
+				m.WorkloadIdentityData = &Struct{}
+			}
+			if err := m.WorkloadIdentityData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -110267,7 +121640,7 @@ func (m *AutoUpdateConfigUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -110290,10 +121663,10 @@ func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateConfigDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -110430,7 +121803,127 @@ func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityData", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.WorkloadIdentityData == nil {
+				m.WorkloadIdentityData = &Struct{}
+			}
+			if err := m.WorkloadIdentityData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadIdentityDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadIdentityDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -110457,7 +121950,73 @@ func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -110483,7 +122042,7 @@ func (m *AutoUpdateConfigDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -110506,10 +122065,10 @@ func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateVersionCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateVersionCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -110646,9 +122205,9 @@ func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -110658,24 +122217,23 @@ func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -110699,7 +122257,7 @@ func (m *AutoUpdateVersionCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -110722,10 +122280,10 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateVersionUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateVersionUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -110763,7 +122321,7 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -110790,7 +122348,7 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -110862,9 +122420,9 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -110874,24 +122432,23 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -110915,7 +122472,7 @@ func (m *AutoUpdateVersionUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateVersionDelete) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -110938,10 +122495,10 @@ func (m *AutoUpdateVersionDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateVersionDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateVersionDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityX509RevocationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -111076,39 +122633,6 @@ func (m *AutoUpdateVersionDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -111131,7 +122655,7 @@ func (m *AutoUpdateVersionDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateAgentRolloutTrigger) Unmarshal(dAtA []byte) error {
+func (m *GitCommand) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -111154,10 +122678,10 @@ func (m *AutoUpdateAgentRolloutTrigger) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutTrigger: wiretype end group for non-group")
+			return fmt.Errorf("proto: GitCommand: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutTrigger: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GitCommand: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -111261,39 +122785,7 @@ func (m *AutoUpdateAgentRolloutTrigger) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111320,64 +122812,13 @@ func (m *AutoUpdateAgentRolloutTrigger) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutForceDone: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutForceDone: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111404,13 +122845,13 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111437,15 +122878,15 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111455,28 +122896,27 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Service = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -111504,11 +122944,11 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Actions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111535,7 +122975,8 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Actions = append(m.Actions, &GitCommandAction{})
+			if err := m.Actions[len(m.Actions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -111561,7 +123002,7 @@ func (m *AutoUpdateAgentRolloutForceDone) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
+func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -111584,17 +123025,17 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutRollback: wiretype end group for non-group")
+			return fmt.Errorf("proto: GitCommandAction: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AutoUpdateAgentRolloutRollback: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GitCommandAction: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111604,30 +123045,29 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Action = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reference", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111637,30 +123077,29 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Reference = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Old", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111670,28 +123109,27 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Old = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field New", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -111719,40 +123157,7 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.New = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -111776,7 +123181,7 @@ func (m *AutoUpdateAgentRolloutRollback) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
+func (m *AccessListInvalidMetadata) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -111799,17 +123204,17 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StaticHostUserCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessListInvalidMetadata: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StaticHostUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessListInvalidMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111819,30 +123224,29 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.AccessListName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -111852,28 +123256,110 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.User = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MissingRoles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MissingRoles = append(m.MissingRoles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UserLoginAccessListInvalid: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UserLoginAccessListInvalid: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111900,13 +123386,13 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListInvalidMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111933,13 +123419,13 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AccessListInvalidMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -111966,7 +123452,7 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -111992,7 +123478,7 @@ func (m *StaticHostUserCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
+func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -112015,10 +123501,10 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StaticHostUserUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: StableUNIXUserCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StaticHostUserUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: StableUNIXUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -112056,7 +123542,7 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112083,13 +123569,13 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StableUnixUser", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112116,15 +123602,69 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.StableUnixUser == nil {
+				m.StableUnixUser = &StableUNIXUser{}
+			}
+			if err := m.StableUnixUser.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StableUNIXUser) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StableUNIXUser: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StableUNIXUser: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112134,30 +123674,29 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Username = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Uid", wireType)
 			}
-			var msglen int
+			m.Uid = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112167,25 +123706,11 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.Uid |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -112208,7 +123733,7 @@ func (m *StaticHostUserUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
+func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -112231,10 +123756,10 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StaticHostUserDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: AWSICResourceSync: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StaticHostUserDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AWSICResourceSync: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -112271,10 +123796,10 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalAccounts", wireType)
 			}
-			var msglen int
+			m.TotalAccounts = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112284,30 +123809,16 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.TotalAccounts |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalAccountAssignments", wireType)
 			}
-			var msglen int
+			m.TotalAccountAssignments = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112317,30 +123828,16 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.TotalAccountAssignments |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalUserGroups", wireType)
 			}
-			var msglen int
+			m.TotalUserGroups = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112350,30 +123847,16 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.TotalUserGroups |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalPermissionSets", wireType)
 			}
-			var msglen int
+			m.TotalPermissionSets = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112383,79 +123866,14 @@ func (m *StaticHostUserDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.TotalPermissionSets |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CrownJewelCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CrownJewelCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112482,46 +123900,64 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 3:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: HealthCheckConfigCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: HealthCheckConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112548,13 +123984,13 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112581,13 +124017,13 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112614,15 +124050,15 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CrownJewelQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112632,23 +124068,24 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CrownJewelQuery = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -112672,7 +124109,7 @@ func (m *CrownJewelCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
+func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -112695,10 +124132,10 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CrownJewelUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: HealthCheckConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CrownJewelUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: HealthCheckConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -112736,7 +124173,7 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112763,7 +124200,7 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -112833,9 +124270,60 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: HealthCheckConfigDelete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: HealthCheckConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -112862,15 +124350,15 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CurrentCrownJewelQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112880,29 +124368,30 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CurrentCrownJewelQuery = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedCrownJewelQuery", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -112912,78 +124401,28 @@ func (m *CrownJewelUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpdatedCrownJewelQuery = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CrownJewelDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CrownJewelDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113010,13 +124449,64 @@ func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideCreate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113043,11 +124533,11 @@ func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -113080,7 +124570,7 @@ func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -113113,7 +124603,7 @@ func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
@@ -113168,7 +124658,7 @@ func (m *CrownJewelDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
+func (m *WorkloadIdentityX509IssuerOverrideDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -113191,10 +124681,10 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserTaskCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserTaskCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -113231,72 +124721,6 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
@@ -113329,7 +124753,7 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -113362,9 +124786,9 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113391,7 +124815,7 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserTaskMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -113417,7 +124841,7 @@ func (m *UserTaskCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
+func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -113440,10 +124864,10 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserTaskUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SigstorePolicyCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserTaskUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SigstorePolicyCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -113481,7 +124905,7 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113508,13 +124932,13 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113541,13 +124965,13 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113574,13 +124998,64 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SigstorePolicyUpdate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SigstorePolicyUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113607,13 +125082,13 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserTaskMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113640,15 +125115,15 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserTaskMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CurrentUserTaskState", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -113658,29 +125133,30 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CurrentUserTaskState = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 8:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UpdatedUserTaskState", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -113690,23 +125166,24 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UpdatedUserTaskState = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -113730,7 +125207,7 @@ func (m *UserTaskUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
+func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -113753,17 +125230,17 @@ func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserTaskMetadata: wiretype end group for non-group")
+			return fmt.Errorf("proto: SigstorePolicyDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserTaskMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SigstorePolicyDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TaskType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -113773,29 +125250,30 @@ func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.TaskType = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IssueType", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -113805,29 +125283,30 @@ func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IssueType = string(dAtA[iNdEx:postIndex])
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Integration", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -113837,23 +125316,57 @@ func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Integration = string(dAtA[iNdEx:postIndex])
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -113877,7 +125390,7 @@ func (m *UserTaskMetadata) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
+func (m *MCPSessionStart) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -113900,10 +125413,10 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserTaskDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPSessionStart: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserTaskDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPSessionStart: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -113941,7 +125454,7 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -113968,13 +125481,13 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114001,13 +125514,13 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114034,7 +125547,7 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -114071,60 +125584,9 @@ func (m *UserTaskDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ContactCreate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ContactCreate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ContactCreate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114151,15 +125613,15 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field McpSessionId", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114169,30 +125631,29 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.McpSessionId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientInfo", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114202,30 +125663,29 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ClientInfo = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerInfo", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114235,30 +125695,29 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ServerInfo = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ProtocolVersion", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114268,28 +125727,27 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ProtocolVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IngressAuthType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -114317,13 +125775,13 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Email = string(dAtA[iNdEx:postIndex])
+			m.IngressAuthType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContactType", wireType)
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EgressAuthType", wireType)
 			}
-			m.ContactType = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114333,11 +125791,24 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ContactType |= ContactType(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EgressAuthType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -114360,7 +125831,7 @@ func (m *ContactCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ContactDelete) Unmarshal(dAtA []byte) error {
+func (m *MCPSessionEnd) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -114383,10 +125854,10 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ContactDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPSessionEnd: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ContactDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPSessionEnd: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -114418,13 +125889,46 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114451,13 +125955,13 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114484,11 +125988,11 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
@@ -114521,9 +126025,9 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114550,15 +126054,15 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114568,29 +126072,30 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Email = string(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContactType", wireType)
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
-			m.ContactType = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114600,11 +126105,25 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ContactType |= ContactType(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -114627,7 +126146,7 @@ func (m *ContactDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
+func (m *MCPJSONRPCMessage) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -114650,17 +126169,17 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPJSONRPCMessage: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPJSONRPCMessage: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JSONRPC", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114670,30 +126189,29 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.JSONRPC = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114703,63 +126221,29 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -114769,28 +126253,27 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Params", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114817,10 +126300,10 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.WorkloadIdentityData == nil {
-				m.WorkloadIdentityData = &Struct{}
+			if m.Params == nil {
+				m.Params = &Struct{}
 			}
-			if err := m.WorkloadIdentityData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Params.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -114846,7 +126329,7 @@ func (m *WorkloadIdentityCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
+func (m *MCPSessionRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -114869,10 +126352,10 @@ func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPSessionRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPSessionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -114910,7 +126393,7 @@ func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114937,13 +126420,13 @@ func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -114970,13 +126453,13 @@ func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115003,133 +126486,13 @@ func (m *WorkloadIdentityUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadIdentityData", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.WorkloadIdentityData == nil {
-				m.WorkloadIdentityData = &Struct{}
-			}
-			if err := m.WorkloadIdentityData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115156,13 +126519,13 @@ func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115189,13 +126552,13 @@ func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Message.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115222,7 +126585,7 @@ func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -115248,7 +126611,7 @@ func (m *WorkloadIdentityDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
+func (m *MCPSessionNotification) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -115271,10 +126634,10 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPSessionNotification: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPSessionNotification: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -115312,7 +126675,7 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115339,13 +126702,13 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115372,13 +126735,13 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115405,15 +126768,15 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -115423,78 +126786,28 @@ func (m *WorkloadIdentityX509RevocationCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.Message.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationUpdate: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115521,13 +126834,13 @@ func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115554,46 +126867,64 @@ func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MCPSessionListenSSEStream) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 4:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MCPSessionListenSSEStream: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MCPSessionListenSSEStream: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115620,15 +126951,15 @@ func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -115638,78 +126969,28 @@ func (m *WorkloadIdentityX509RevocationUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationDelete: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityX509RevocationDelete: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115736,13 +127017,13 @@ func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115769,13 +127050,13 @@ func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115802,13 +127083,13 @@ func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115835,7 +127116,7 @@ func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -115861,7 +127142,7 @@ func (m *WorkloadIdentityX509RevocationDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GitCommand) Unmarshal(dAtA []byte) error {
+func (m *MCPSessionInvalidHTTPRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -115884,10 +127165,10 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GitCommand: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPSessionInvalidHTTPRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GitCommand: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPSessionInvalidHTTPRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -115958,7 +127239,7 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -115985,13 +127266,13 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SessionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AppMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -116018,15 +127299,15 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SessionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.AppMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServerMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116036,30 +127317,29 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ServerMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CommandMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116069,28 +127349,27 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.CommandMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Method = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RawQuery", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -116118,13 +127397,13 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Service = string(dAtA[iNdEx:postIndex])
+			m.RawQuery = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 9:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116134,27 +127413,29 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			m.Body = append(m.Body[:0], dAtA[iNdEx:postIndex]...)
+			if m.Body == nil {
+				m.Body = []byte{}
+			}
 			iNdEx = postIndex
-		case 10:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Actions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -116181,8 +127462,7 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Actions = append(m.Actions, &GitCommandAction{})
-			if err := m.Actions[len(m.Actions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Headers.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -116208,7 +127488,7 @@ func (m *GitCommand) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
+func (m *BoundKeypairRecovery) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -116231,17 +127511,17 @@ func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GitCommandAction: wiretype end group for non-group")
+			return fmt.Errorf("proto: BoundKeypairRecovery: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GitCommandAction: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BoundKeypairRecovery: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116251,29 +127531,30 @@ func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Action = string(dAtA[iNdEx:postIndex])
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reference", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116283,61 +127564,30 @@ func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reference = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Old", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.Old = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field New", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116347,110 +127597,28 @@ func (m *GitCommandAction) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.New = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AccessListInvalidMetadata) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AccessListInvalidMetadata: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessListInvalidMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.AccessListName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -116478,11 +127646,11 @@ func (m *AccessListInvalidMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.User = string(dAtA[iNdEx:postIndex])
+			m.TokenName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MissingRoles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -116510,64 +127678,13 @@ func (m *AccessListInvalidMetadata) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.MissingRoles = append(m.MissingRoles, string(dAtA[iNdEx:postIndex]))
+			m.BotName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: UserLoginAccessListInvalid: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserLoginAccessListInvalid: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116577,30 +127694,29 @@ func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.PublicKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccessListInvalidMetadata", wireType)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryCount", wireType)
 			}
-			var msglen int
+			m.RecoveryCount = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116610,30 +127726,16 @@ func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.RecoveryCount |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.AccessListInvalidMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryMode", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116643,24 +127745,23 @@ func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.RecoveryMode = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -116684,7 +127785,7 @@ func (m *UserLoginAccessListInvalid) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
+func (m *BoundKeypairRotation) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -116707,10 +127808,10 @@ func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: StableUNIXUserCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: BoundKeypairRotation: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StableUNIXUserCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BoundKeypairRotation: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -116748,7 +127849,7 @@ func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -116775,13 +127876,13 @@ func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StableUnixUser", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -116808,67 +127909,77 @@ func (m *StableUNIXUserCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.StableUnixUser == nil {
-				m.StableUnixUser = &StableUNIXUser{}
-			}
-			if err := m.StableUnixUser.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *StableUNIXUser) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
+			m.TokenName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: StableUNIXUser: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StableUNIXUser: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BotName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PreviousPublicKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -116896,13 +128007,13 @@ func (m *StableUNIXUser) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			m.PreviousPublicKey = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Uid", wireType)
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NewPublicKey", wireType)
 			}
-			m.Uid = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -116912,11 +128023,24 @@ func (m *StableUNIXUser) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Uid |= int32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NewPublicKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -116939,7 +128063,7 @@ func (m *StableUNIXUser) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
+func (m *BoundKeypairJoinStateVerificationFailed) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -116962,10 +128086,10 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AWSICResourceSync: wiretype end group for non-group")
+			return fmt.Errorf("proto: BoundKeypairJoinStateVerificationFailed: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSICResourceSync: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: BoundKeypairJoinStateVerificationFailed: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -117002,10 +128126,10 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalAccounts", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			m.TotalAccounts = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117015,16 +128139,30 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.TotalAccounts |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalAccountAssignments", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
-			m.TotalAccountAssignments = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117034,16 +128172,30 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.TotalAccountAssignments |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalUserGroups", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenName", wireType)
 			}
-			m.TotalUserGroups = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117053,35 +128205,29 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.TotalUserGroups |= int32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TotalPermissionSets", wireType)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
 			}
-			m.TotalPermissionSets = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.TotalPermissionSets |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
-		case 6:
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TokenName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BotName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117091,24 +128237,23 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.BotName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -117132,7 +128277,7 @@ func (m *AWSICResourceSync) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
+func (m *SCIMRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -117155,17 +128300,17 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: HealthCheckConfigCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SCIMRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: HealthCheckConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SCIMRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117175,30 +128320,29 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SourceAddress", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117208,30 +128352,29 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SourceAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserAgent", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117241,28 +128384,91 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.UserAgent = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Method", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Method = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -117289,7 +128495,10 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Body == nil {
+				m.Body = &Struct{}
+			}
+			if err := m.Body.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -117315,7 +128524,7 @@ func (m *HealthCheckConfigCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
+func (m *SCIMCommonData) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -117338,15 +128547,15 @@ func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: HealthCheckConfigUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SCIMCommonData: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: HealthCheckConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SCIMCommonData: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -117373,48 +128582,18 @@ func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.Request == nil {
+				m.Request = &SCIMRequest{}
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Request.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Integration", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117424,30 +128603,29 @@ func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Integration = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceType", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117457,24 +128635,23 @@ func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ResourceType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -117498,7 +128675,7 @@ func (m *HealthCheckConfigUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
+func (m *SCIMListingEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -117521,10 +128698,10 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: HealthCheckConfigDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: SCIMListingEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: HealthCheckConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SCIMListingEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -117556,13 +128733,46 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SCIMCommonData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -117589,15 +128799,15 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SCIMCommonData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117607,30 +128817,29 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Filter = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
 			}
-			var msglen int
+			m.Count = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117640,25 +128849,49 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.Count |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartIndex", wireType)
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
+			m.StartIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.StartIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceCount", wireType)
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.ResourceCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ResourceCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -117681,7 +128914,7 @@ func (m *HealthCheckConfigDelete) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error {
+func (m *SCIMResourceEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -117704,10 +128937,10 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: SCIMResourceEvent: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SCIMResourceEvent: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -117745,7 +128978,7 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -117772,13 +129005,13 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SCIMCommonData", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -117805,15 +129038,15 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.SCIMCommonData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TeleportID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowEvents
@@ -117823,24 +129056,87 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthEvents
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthEvents
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.TeleportID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
 			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExternalID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Display", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Display = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -117864,7 +129160,7 @@ func (m *WorkloadIdentityX509IssuerOverrideCreate) Unmarshal(dAtA []byte) error
 	}
 	return nil
 }
-func (m *WorkloadIdentityX509IssuerOverrideDelete) Unmarshal(dAtA []byte) error {
+func (m *ClientIPRestrictionsUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -117887,10 +129183,10 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Unmarshal(dAtA []byte) error
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClientIPRestrictionsUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadIdentityX509IssuerOverrideDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClientIPRestrictionsUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -118025,6 +129321,71 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Unmarshal(dAtA []byte) error
 				return err
 			}
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientIPRestrictions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClientIPRestrictions = append(m.ClientIPRestrictions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -118047,7 +129408,7 @@ func (m *WorkloadIdentityX509IssuerOverrideDelete) Unmarshal(dAtA []byte) error
 	}
 	return nil
 }
-func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
+func (m *VnetConfigCreate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -118070,10 +129431,10 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SigstorePolicyCreate: wiretype end group for non-group")
+			return fmt.Errorf("proto: VnetConfigCreate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SigstorePolicyCreate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VnetConfigCreate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -118111,7 +129472,7 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118138,13 +129499,13 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118171,13 +129532,13 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118204,7 +129565,7 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -118230,7 +129591,7 @@ func (m *SigstorePolicyCreate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
+func (m *VnetConfigUpdate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -118253,10 +129614,10 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SigstorePolicyUpdate: wiretype end group for non-group")
+			return fmt.Errorf("proto: VnetConfigUpdate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SigstorePolicyUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VnetConfigUpdate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -118294,7 +129655,7 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118321,13 +129682,13 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118354,13 +129715,13 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118387,7 +129748,7 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -118413,7 +129774,7 @@ func (m *SigstorePolicyUpdate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
+func (m *VnetConfigDelete) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -118436,10 +129797,10 @@ func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SigstorePolicyDelete: wiretype end group for non-group")
+			return fmt.Errorf("proto: VnetConfigDelete: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SigstorePolicyDelete: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VnetConfigDelete: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -118477,7 +129838,7 @@ func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118504,13 +129865,13 @@ func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118537,13 +129898,13 @@ func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.UserMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceMetadata", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectionMetadata", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -118570,7 +129931,7 @@ func (m *SigstorePolicyDelete) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ConnectionMetadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
diff --git a/api/types/events/events_test.go b/api/types/events/events_test.go
index 74abf79895739..e0032ca295149 100644
--- a/api/types/events/events_test.go
+++ b/api/types/events/events_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package events
 
 import (
+	"bytes"
 	"strings"
 	"testing"
 
@@ -24,8 +25,12 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/wrappers"
 )
 
+// TestTrimToMaxSize tests TrimToMaxSize implementation of several events.
+// It also tests trimEventToMaxSize used by these events.
 func TestTrimToMaxSize(t *testing.T) {
 	type messageSizeTrimmer interface {
 		TrimToMaxSize(int) AuditEvent
@@ -46,7 +51,7 @@ func TestTrimToMaxSize(t *testing.T) {
 				DatabaseQuery: strings.Repeat("A", 7000),
 			},
 			want: &DatabaseSessionQuery{
-				DatabaseQuery: strings.Repeat("A", 5375),
+				DatabaseQuery: strings.Repeat("A", 5373),
 			},
 		},
 		{
@@ -60,7 +65,7 @@ func TestTrimToMaxSize(t *testing.T) {
 				},
 			},
 			want: &DatabaseSessionQuery{
-				DatabaseQuery: strings.Repeat("A", 590),
+				DatabaseQuery: strings.Repeat("A", 589),
 				DatabaseQueryParameters: []string{
 					strings.Repeat("A", 89),
 					strings.Repeat("A", 89),
@@ -100,7 +105,7 @@ func TestTrimToMaxSize(t *testing.T) {
 				DatabaseQuery: `{` + strings.Repeat(`"a": "b",`, 100) + "}",
 			},
 			want: &DatabaseSessionQuery{
-				DatabaseQuery: `{"a": "b","a":`,
+				DatabaseQuery: `{"a": "b","a"`,
 			},
 		},
 		// UserLogin
@@ -115,8 +120,8 @@ func TestTrimToMaxSize(t *testing.T) {
 			},
 			want: &UserLogin{
 				Status: Status{
-					Error:       strings.Repeat("A", 1336),
-					UserMessage: strings.Repeat("A", 1336),
+					Error:       strings.Repeat("A", 1335),
+					UserMessage: strings.Repeat("A", 1335),
 				},
 			},
 			cmpOpts: []cmp.Option{
@@ -125,6 +130,35 @@ func TestTrimToMaxSize(t *testing.T) {
 				cmpopts.IgnoreFields(UserLogin{}, "IdentityAttributes"),
 			},
 		},
+		{
+			name:    "MCPSessionInvalidHTTPRequest trimmed",
+			maxSize: 200,
+			in: &MCPSessionInvalidHTTPRequest{
+				// Metadata not being trimmed.
+				Metadata: Metadata{
+					Code: "TMCP006E",
+					Type: "mcp.session.invalid_http_request",
+				},
+				Path: strings.Repeat("/path", 10),
+				Body: bytes.Repeat([]byte("body"), 10),
+				Headers: wrappers.Traits{
+					"A": {strings.Repeat("a", 20)},
+					"B": {strings.Repeat("b", 20)},
+				},
+			},
+			want: &MCPSessionInvalidHTTPRequest{
+				Metadata: Metadata{
+					Code: "TMCP006E",
+					Type: "mcp.session.invalid_http_request",
+				},
+				Path: "/path/path/path/",
+				Body: []byte("bodybodybodybody"),
+				Headers: wrappers.Traits{
+					"A": {strings.Repeat("a", 16)},
+					"B": {strings.Repeat("b", 16)},
+				},
+			},
+		},
 	}
 
 	for _, tc := range testCases {
@@ -195,8 +229,56 @@ func TestStructTrimToMaxSize(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			got := tc.in.trimToMaxSize(tc.maxSize)
+			got := tc.in.trimToMaxFieldSize(tc.maxSize)
 			require.Equal(t, tc.want, got)
 		})
 	}
 }
+
+func TestTrimMCPJSONRPCMessage(t *testing.T) {
+	m := MCPJSONRPCMessage{
+		JSONRPC: "2.0",
+		ID:      "some-id",
+		Method:  "tools/call",
+		Params: &Struct{
+			Struct: types.Struct{
+				Fields: map[string]*types.Value{
+					strings.Repeat("A", 100): {
+						Kind: &types.Value_StringValue{
+							StringValue: "A",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	orgSize := m.Size()
+	t.Run("not trimmed", func(t *testing.T) {
+		notTrimmed := m.trimToMaxFieldSize(10000)
+		require.Equal(t, orgSize, m.Size())
+		require.Equal(t, notTrimmed, m)
+	})
+
+	t.Run("trimmed", func(t *testing.T) {
+		trimmed := m.trimToMaxFieldSize(maxSizePerField(50, m.nonEmptyStrs()))
+		require.Equal(t, orgSize, m.Size())
+		require.Less(t, trimmed.Size(), 50)
+		require.Equal(t, MCPJSONRPCMessage{
+			JSONRPC: "2.0",
+			ID:      "some-id",
+			Method:  "tools/ca",
+			Params: &Struct{
+				Struct: types.Struct{
+					Fields: map[string]*types.Value{
+						strings.Repeat("A", 8): {
+							Kind: &types.Value_StringValue{
+								StringValue: "A",
+							},
+						},
+					},
+				},
+			},
+		}, trimmed)
+	})
+}
diff --git a/api/types/events/oneof.go b/api/types/events/oneof.go
index 094f4d02ac3f2..3cd88b23673d6 100644
--- a/api/types/events/oneof.go
+++ b/api/types/events/oneof.go
@@ -886,6 +886,60 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 		out.Event = &OneOf_SigstorePolicyDelete{
 			SigstorePolicyDelete: e,
 		}
+	case *MCPSessionStart:
+		out.Event = &OneOf_MCPSessionStart{
+			MCPSessionStart: e,
+		}
+	case *MCPSessionEnd:
+		out.Event = &OneOf_MCPSessionEnd{
+			MCPSessionEnd: e,
+		}
+	case *MCPSessionRequest:
+		out.Event = &OneOf_MCPSessionRequest{
+			MCPSessionRequest: e,
+		}
+	case *MCPSessionNotification:
+		out.Event = &OneOf_MCPSessionNotification{
+			MCPSessionNotification: e,
+		}
+	case *MCPSessionListenSSEStream:
+		out.Event = &OneOf_MCPSessionListenSSEStream{
+			MCPSessionListenSSEStream: e,
+		}
+	case *MCPSessionInvalidHTTPRequest:
+		out.Event = &OneOf_MCPSessionInvalidHTTPRequest{
+			MCPSessionInvalidHTTPRequest: e,
+		}
+	case *BoundKeypairRecovery:
+		out.Event = &OneOf_BoundKeypairRecovery{
+			BoundKeypairRecovery: e,
+		}
+	case *BoundKeypairRotation:
+		out.Event = &OneOf_BoundKeypairRotation{
+			BoundKeypairRotation: e,
+		}
+	case *BoundKeypairJoinStateVerificationFailed:
+		out.Event = &OneOf_BoundKeypairJoinStateVerificationFailed{
+			BoundKeypairJoinStateVerificationFailed: e,
+		}
+	case *SCIMListingEvent:
+		out.Event = &OneOf_SCIMListingEvent{SCIMListingEvent: e}
+	case *SCIMResourceEvent:
+		out.Event = &OneOf_SCIMResourceEvent{SCIMResourceEvent: e}
+	case *ClientIPRestrictionsUpdate:
+		out.Event = &OneOf_ClientIPRestrictionsUpdate{ClientIPRestrictionsUpdate: e}
+	case *VnetConfigCreate:
+		out.Event = &OneOf_VnetConfigCreate{
+			VnetConfigCreate: e,
+		}
+	case *VnetConfigUpdate:
+		out.Event = &OneOf_VnetConfigUpdate{
+			VnetConfigUpdate: e,
+		}
+	case *VnetConfigDelete:
+		out.Event = &OneOf_VnetConfigDelete{
+			VnetConfigDelete: e,
+		}
 	default:
 		slog.ErrorContext(context.Background(), "Attempted to convert dynamic event of unknown type into protobuf event.", "event_type", in.GetType())
 		unknown := &Unknown{}
diff --git a/api/types/events/struct.go b/api/types/events/struct.go
index 71c73d5454e73..6670b3eee6c1a 100644
--- a/api/types/events/struct.go
+++ b/api/types/events/struct.go
@@ -20,7 +20,7 @@ import (
 	"bytes"
 	"encoding/json"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gogo/protobuf/types"
 	"github.com/gravitational/trace"
 )
diff --git a/api/types/events/trimmer.go b/api/types/events/trimmer.go
new file mode 100644
index 0000000000000..98fb346087fa9
--- /dev/null
+++ b/api/types/events/trimmer.go
@@ -0,0 +1,153 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package events
+
+import (
+	"google.golang.org/protobuf/protoadapt"
+
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/api/utils"
+)
+
+// fieldTrimer handles trimming a field from an event. fieldTrimmer usually
+// holds both the field from the source event (for calculation) and the pointer
+// to the field from the target copy (for trimming updates).
+type fieldTrimmer interface {
+	// emptyTarget empties the target field.
+	emptyTarget()
+	// nonEmptyStrs calculates non-empty strings from this field.
+	nonEmptyStrs() int
+	// trimToMaxFieldSize trims and updates the target field.
+	trimToMaxFieldSize(maxFieldSize int)
+}
+
+type trimmableEvent interface {
+	AuditEvent
+	protoadapt.MessageV1
+}
+
+// trimEventToMaxSize handles trimming of an event.
+// See MCPSessionInvalidHTTPRequest.TrimToMaxSize for example.
+func trimEventToMaxSize[T trimmableEvent](m T, maxSize int, makeTrimmer func(m T, out T) fieldTrimmer) AuditEvent {
+	size := m.Size()
+	if size <= maxSize {
+		return m
+	}
+
+	out := utils.CloneProtoMsg(m)
+	trimmer := makeTrimmer(m, out)
+	trimmer.emptyTarget() // Empty before adjusting max size
+	maxSize = adjustedMaxSize(out, maxSize)
+	maxFieldSize := maxSizePerField(maxSize, trimmer.nonEmptyStrs())
+	trimmer.trimToMaxFieldSize(maxFieldSize)
+	return out
+}
+
+// fieldTrimmers is a slice of fieldTrimmer that implements fieldTrimmer.
+type fieldTrimmers []fieldTrimmer
+
+func (t fieldTrimmers) emptyTarget() {
+	for _, e := range t {
+		e.emptyTarget()
+	}
+}
+func (t fieldTrimmers) nonEmptyStrs() (sum int) {
+	for _, e := range t {
+		sum += e.nonEmptyStrs()
+	}
+	return sum
+}
+func (t fieldTrimmers) trimToMaxFieldSize(maxFieldSize int) {
+	for _, e := range t {
+		e.trimToMaxFieldSize(maxFieldSize)
+	}
+}
+
+type baseTrimmer struct {
+	emptyTargetFunc        func()
+	nonEmptyStrsFunc       func() int
+	trimToMaxFieldSizeFunc func(int)
+}
+
+func newBaseTrimmer[Source any, Target any](
+	source Source,
+	target *Target,
+	nonEmptyStrs func(Source) int,
+	trimToMaxFieldSize func(Source, int) Target,
+) fieldTrimmer {
+	return &baseTrimmer{
+		emptyTargetFunc: func() {
+			var empty Target
+			*target = empty
+		},
+		nonEmptyStrsFunc: func() int {
+			return nonEmptyStrs(source)
+		},
+		trimToMaxFieldSizeFunc: func(maxFieldSize int) {
+			*target = trimToMaxFieldSize(source, maxFieldSize)
+		},
+	}
+}
+
+func (t *baseTrimmer) emptyTarget()                        { t.emptyTargetFunc() }
+func (t *baseTrimmer) nonEmptyStrs() int                   { return t.nonEmptyStrsFunc() }
+func (t *baseTrimmer) trimToMaxFieldSize(maxFieldSize int) { t.trimToMaxFieldSizeFunc(maxFieldSize) }
+
+func newStrTrimmer(source string, target *string) fieldTrimmer {
+	return newBaseTrimmer(source, target, nonEmptyStr, trimStr)
+}
+
+func newStrSliceTrimmer(source []string, target *[]string) fieldTrimmer {
+	return newBaseTrimmer(
+		source,
+		target,
+		func(source []string) int {
+			return nonEmptyStrsInSlice(source)
+		},
+		trimStrSlice,
+	)
+}
+
+func newBytesTrimmer(source []byte, target *[]byte) fieldTrimmer {
+	return newBaseTrimmer(source, target, nonEmptyStr, trimStr)
+}
+
+func newTraitsTrimmer(source wrappers.Traits, target *wrappers.Traits) fieldTrimmer {
+	return newBaseTrimmer(source, target, nonEmptyTraits, trimTraits)
+}
+
+// trimmableField defines an interface for any struct (that is a field of an
+// event) that can be trimmed.
+type trimmableField[T any] interface {
+	nonEmptyStrs() int
+	trimToMaxFieldSize(maxFieldSize int) T
+}
+
+func newGenericTrimmer[T any, Trimmable trimmableField[T]](source Trimmable, target *T) fieldTrimmer {
+	return newBaseTrimmer(
+		source,
+		target,
+		func(source Trimmable) int {
+			return source.nonEmptyStrs()
+		},
+		func(source Trimmable, maxFieldSize int) T {
+			return source.trimToMaxFieldSize(maxFieldSize)
+		},
+	)
+}
diff --git a/api/types/events/trimmer_test.go b/api/types/events/trimmer_test.go
new file mode 100644
index 0000000000000..7bd3f935dd07e
--- /dev/null
+++ b/api/types/events/trimmer_test.go
@@ -0,0 +1,118 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package events
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/wrappers"
+)
+
+const trimmerTestMaxFieldSize = 10
+
+type trimmerTestSuite[T any] struct {
+	source      T
+	target      T
+	makeTrimmer func(T, *T) fieldTrimmer
+
+	expectNonEmptyStrs int
+	expectTrimmedValue T
+}
+
+func (s *trimmerTestSuite[T]) Run(t *testing.T) {
+	require.NotEmpty(t, s.target)
+
+	trimmer := s.makeTrimmer(s.source, &s.target)
+	t.Run("emptyTarget", func(t *testing.T) {
+		trimmer.emptyTarget()
+		require.Empty(t, s.target)
+	})
+
+	t.Run("nonEmptyStrs", func(t *testing.T) {
+		require.Equal(t, s.expectNonEmptyStrs, trimmer.nonEmptyStrs())
+	})
+
+	t.Run("trimToMaxFieldSize not trimmed", func(t *testing.T) {
+		trimmer.trimToMaxFieldSize(10000)
+		require.Equal(t, s.source, s.target)
+	})
+
+	t.Run("trimToMaxFieldSize not trimmed", func(t *testing.T) {
+		trimmer.trimToMaxFieldSize(trimmerTestMaxFieldSize)
+		require.Equal(t, s.expectTrimmedValue, s.target)
+	})
+}
+
+func Test_newStrTrimmer(t *testing.T) {
+	s := trimmerTestSuite[string]{
+		source:             strings.Repeat("source", 10),
+		target:             "some-initial-value",
+		makeTrimmer:        newStrTrimmer,
+		expectNonEmptyStrs: 1,
+		// trimStr reserves two bytes for quotes so 10-2=8
+		expectTrimmedValue: "sourceso",
+	}
+	s.Run(t)
+}
+
+func Test_newBytesTrimmer(t *testing.T) {
+	s := trimmerTestSuite[[]byte]{
+		source:             bytes.Repeat([]byte("source"), 10),
+		target:             []byte("some-initial-value"),
+		makeTrimmer:        newBytesTrimmer,
+		expectNonEmptyStrs: 1,
+		// trimStr reserves two bytes for quotes so 10-2=8
+		expectTrimmedValue: []byte("sourceso"),
+	}
+	s.Run(t)
+}
+
+func Test_newStrSliceTrimmer(t *testing.T) {
+	s := trimmerTestSuite[[]string]{
+		source:             []string{strings.Repeat("a", 100), strings.Repeat("b", 100)},
+		target:             []string{"some-initial-value"},
+		makeTrimmer:        newStrSliceTrimmer,
+		expectNonEmptyStrs: 2,
+		expectTrimmedValue: []string{strings.Repeat("a", 8), strings.Repeat("b", 8)},
+	}
+	s.Run(t)
+}
+
+func Test_newTraitsTrimmer(t *testing.T) {
+	s := trimmerTestSuite[wrappers.Traits]{
+		source: wrappers.Traits{
+			"a":  {strings.Repeat("a", 100)},
+			"bc": {strings.Repeat("b", 100), strings.Repeat("c", 100)},
+		},
+		target: wrappers.Traits{
+			"some": {"initial", "value"},
+		},
+		makeTrimmer:        newTraitsTrimmer,
+		expectNonEmptyStrs: 5, // count keys and values
+		expectTrimmedValue: wrappers.Traits{
+			"a":  {strings.Repeat("a", 8)},
+			"bc": {strings.Repeat("b", 8), strings.Repeat("c", 8)},
+		},
+	}
+	s.Run(t)
+}
diff --git a/api/types/externalauditstorage/convert/v1/externalauditstorage.go b/api/types/externalauditstorage/convert/v1/externalauditstorage.go
index c97e21a48fa2e..54d1fbd66e318 100644
--- a/api/types/externalauditstorage/convert/v1/externalauditstorage.go
+++ b/api/types/externalauditstorage/convert/v1/externalauditstorage.go
@@ -31,20 +31,20 @@ func FromProtoDraft(in *externalauditstoragev1.ExternalAuditStorage) (*externala
 		return nil, trace.BadParameter("External Audit Storage message is nil")
 	}
 
-	if in.Spec == nil {
+	if in.GetSpec() == nil {
 		return nil, trace.BadParameter("spec is missing")
 	}
 
-	externalAuditStorage, err := externalauditstorage.NewDraftExternalAuditStorage(headerv1.FromMetadataProto(in.Header.Metadata), externalauditstorage.ExternalAuditStorageSpec{
-		IntegrationName:        in.Spec.IntegrationName,
-		PolicyName:             in.Spec.PolicyName,
-		Region:                 in.Spec.Region,
-		SessionRecordingsURI:   in.Spec.SessionRecordingsUri,
-		AthenaWorkgroup:        in.Spec.AthenaWorkgroup,
-		GlueDatabase:           in.Spec.GlueDatabase,
-		GlueTable:              in.Spec.GlueTable,
-		AuditEventsLongTermURI: in.Spec.AuditEventsLongTermUri,
-		AthenaResultsURI:       in.Spec.AthenaResultsUri,
+	externalAuditStorage, err := externalauditstorage.NewDraftExternalAuditStorage(headerv1.FromMetadataProto(in.GetHeader().GetMetadata()), externalauditstorage.ExternalAuditStorageSpec{
+		IntegrationName:        in.GetSpec().GetIntegrationName(),
+		PolicyName:             in.GetSpec().GetPolicyName(),
+		Region:                 in.GetSpec().GetRegion(),
+		SessionRecordingsURI:   in.GetSpec().GetSessionRecordingsUri(),
+		AthenaWorkgroup:        in.GetSpec().GetAthenaWorkgroup(),
+		GlueDatabase:           in.GetSpec().GetGlueDatabase(),
+		GlueTable:              in.GetSpec().GetGlueTable(),
+		AuditEventsLongTermURI: in.GetSpec().GetAuditEventsLongTermUri(),
+		AthenaResultsURI:       in.GetSpec().GetAthenaResultsUri(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -59,20 +59,20 @@ func FromProtoCluster(in *externalauditstoragev1.ExternalAuditStorage) (*externa
 		return nil, trace.BadParameter("External Audit Storage message is nil")
 	}
 
-	if in.Spec == nil {
+	if in.GetSpec() == nil {
 		return nil, trace.BadParameter("spec is missing")
 	}
 
-	externalAuditStorage, err := externalauditstorage.NewClusterExternalAuditStorage(headerv1.FromMetadataProto(in.Header.Metadata), externalauditstorage.ExternalAuditStorageSpec{
-		IntegrationName:        in.Spec.IntegrationName,
-		PolicyName:             in.Spec.PolicyName,
-		Region:                 in.Spec.Region,
-		SessionRecordingsURI:   in.Spec.SessionRecordingsUri,
-		AthenaWorkgroup:        in.Spec.AthenaWorkgroup,
-		GlueDatabase:           in.Spec.GlueDatabase,
-		GlueTable:              in.Spec.GlueTable,
-		AuditEventsLongTermURI: in.Spec.AuditEventsLongTermUri,
-		AthenaResultsURI:       in.Spec.AthenaResultsUri,
+	externalAuditStorage, err := externalauditstorage.NewClusterExternalAuditStorage(headerv1.FromMetadataProto(in.GetHeader().GetMetadata()), externalauditstorage.ExternalAuditStorageSpec{
+		IntegrationName:        in.GetSpec().GetIntegrationName(),
+		PolicyName:             in.GetSpec().GetPolicyName(),
+		Region:                 in.GetSpec().GetRegion(),
+		SessionRecordingsURI:   in.GetSpec().GetSessionRecordingsUri(),
+		AthenaWorkgroup:        in.GetSpec().GetAthenaWorkgroup(),
+		GlueDatabase:           in.GetSpec().GetGlueDatabase(),
+		GlueTable:              in.GetSpec().GetGlueTable(),
+		AuditEventsLongTermURI: in.GetSpec().GetAuditEventsLongTermUri(),
+		AthenaResultsURI:       in.GetSpec().GetAthenaResultsUri(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/api/types/github.go b/api/types/github.go
index 1a5f3ebb9eae6..5659d0648cb32 100644
--- a/api/types/github.go
+++ b/api/types/github.go
@@ -73,6 +73,12 @@ type GithubConnector interface {
 	GetAPIEndpointURL() string
 	// GetClientRedirectSettings returns the client redirect settings.
 	GetClientRedirectSettings() *SSOClientRedirectSettings
+	// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	GetUserMatchers() []string
+	// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+	// for identifier-first login.
+	SetUserMatchers([]string)
 }
 
 // NewGithubConnector creates a new Github connector from name and spec
@@ -323,6 +329,21 @@ func (c *GithubConnectorV3) MapClaims(claims GithubClaims) ([]string, []string,
 	return utils.Deduplicate(roles), utils.Deduplicate(kubeGroups), utils.Deduplicate(kubeUsers)
 }
 
+// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+// match for identifier-first login.
+func (r *GithubConnectorV3) GetUserMatchers() []string {
+	if r.Spec.UserMatchers == nil {
+		return nil
+	}
+	return r.Spec.UserMatchers
+}
+
+// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+// for identifier-first login.
+func (r *GithubConnectorV3) SetUserMatchers(userMatchers []string) {
+	r.Spec.UserMatchers = userMatchers
+}
+
 // SetExpiry sets expiry time for the object
 func (r *GithubAuthRequest) SetExpiry(expires time.Time) {
 	r.Expires = &expires
diff --git a/api/types/header/convert/v1/header.go b/api/types/header/convert/v1/header.go
index d8493d848a17a..670a1138c08d2 100644
--- a/api/types/header/convert/v1/header.go
+++ b/api/types/header/convert/v1/header.go
@@ -48,18 +48,21 @@ func ToResourceHeaderProto(resourceHeader header.ResourceHeader) *headerv1.Resou
 
 // FromMetadataProto converts v1 metadata into an internal metadata object.
 func FromMetadataProto(msg *headerv1.Metadata) header.Metadata {
+	if msg == nil {
+		return header.Metadata{}
+	}
 	// We map the zero protobuf time (nil) to the zero go time.
 	var expires time.Time
-	if msg.Expires != nil {
-		expires = msg.Expires.AsTime()
+	if msg.GetExpires() != nil {
+		expires = msg.GetExpires().AsTime()
 	}
 
 	return header.Metadata{
-		Name:        msg.Name,
-		Description: msg.Description,
-		Labels:      msg.Labels,
+		Name:        msg.GetName(),
+		Description: msg.GetDescription(),
+		Labels:      msg.GetLabels(),
 		Expires:     expires,
-		Revision:    msg.Revision,
+		Revision:    msg.GetRevision(),
 	}
 }
 
diff --git a/api/types/integration.go b/api/types/integration.go
index e13ae146818d7..d9ca87362f138 100644
--- a/api/types/integration.go
+++ b/api/types/integration.go
@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/url"
+	"slices"
 
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -42,6 +43,14 @@ const (
 	IntegrationSubKindAWSRolesAnywhere = "aws-ra"
 )
 
+// integrationSubKindValues is a list of supported integration subkind values.
+var integrationSubKindValues = []string{
+	IntegrationSubKindAWSOIDC,
+	IntegrationSubKindAzureOIDC,
+	IntegrationSubKindAWSRolesAnywhere,
+	IntegrationSubKindGitHub,
+}
+
 const (
 	// IntegrationAWSOIDCAudienceUnspecified denotes an empty audience value. Empty audience value
 	// is used to maintain default OIDC integration behavior and backward compatibility.
@@ -50,6 +59,21 @@ const (
 	IntegrationAWSOIDCAudienceAWSIdentityCenter = "aws-identity-center"
 )
 
+// integrationAWSOIDCAudienceValues is a list of the supported AWS OIDC Audience
+// values. If this list is updated, be sure to also update the audience field's
+// godoc string in the [AWSOIDCIntegrationSpecV1] protobuf definition.
+var integrationAWSOIDCAudienceValues = []string{
+	IntegrationAWSOIDCAudienceUnspecified,
+	IntegrationAWSOIDCAudienceAWSIdentityCenter,
+}
+
+const (
+	// IntegrationAWSRolesAnywhereProfileSyncStatusSuccess indicates that the profile sync was successful.
+	IntegrationAWSRolesAnywhereProfileSyncStatusSuccess = "SUCCESS"
+	// IntegrationAWSRolesAnywhereProfileSyncStatusError indicates that the profile sync failed.
+	IntegrationAWSRolesAnywhereProfileSyncStatusError = "ERROR"
+)
+
 // Integration specifies is a connection configuration between Teleport and a 3rd party system.
 type Integration interface {
 	ResourceWithLabels
@@ -69,6 +93,8 @@ type Integration interface {
 
 	// GetAzureOIDCIntegrationSpec returns the `azure-oidc` spec fields.
 	GetAzureOIDCIntegrationSpec() *AzureOIDCIntegrationSpecV1
+	// SetAzureOIDCIntegrationSpec sets the `azure-oidc` spec fields.
+	SetAzureOIDCIntegrationSpec(*AzureOIDCIntegrationSpecV1)
 
 	// GetGitHubIntegrationSpec returns the GitHub spec.
 	GetGitHubIntegrationSpec() *GitHubIntegrationSpecV1
@@ -86,6 +112,12 @@ type Integration interface {
 	GetCredentials() PluginCredentials
 	// WithoutCredentials returns a copy without credentials.
 	WithoutCredentials() Integration
+
+	// GetStatus retrieves the integration status.
+	GetStatus() IntegrationStatusV1
+	// SetStatus updates the integration status.
+	SetStatus(IntegrationStatusV1)
+
 	// Clone returns a copy of the integration.
 	Clone() Integration
 }
@@ -285,12 +317,13 @@ func (s *IntegrationSpecV1_AWSOIDC) CheckAndSetDefaults() error {
 // ValidateAudience validates if the audience field is configured with
 // a supported audience value.
 func (s *IntegrationSpecV1_AWSOIDC) ValidateAudience() error {
-	switch s.AWSOIDC.Audience {
-	case IntegrationAWSOIDCAudienceUnspecified, IntegrationAWSOIDCAudienceAWSIdentityCenter:
-		return nil
-	default:
-		return trace.BadParameter("unsupported audience value %q", s.AWSOIDC.Audience)
+	if !slices.Contains(integrationAWSOIDCAudienceValues, s.AWSOIDC.Audience) {
+		return trace.BadParameter("unsupported audience value %q, supported values are %q",
+			s.AWSOIDC.Audience,
+			integrationAWSOIDCAudienceValues,
+		)
 	}
+	return nil
 }
 
 // Validate validates the configuration for Azure OIDC integration subkind.
@@ -388,6 +421,13 @@ func (ig *IntegrationV1) GetAzureOIDCIntegrationSpec() *AzureOIDCIntegrationSpec
 	return ig.Spec.GetAzureOIDC()
 }
 
+// SetAzureOIDCIntegrationSpec sets the `azure-oidc` spec fields.
+func (ig *IntegrationV1) SetAzureOIDCIntegrationSpec(spec *AzureOIDCIntegrationSpecV1) {
+	ig.Spec.SubKindSpec = &IntegrationSpecV1_AzureOIDC{
+		AzureOIDC: spec,
+	}
+}
+
 // GetGitHubIntegrationSpec returns the GitHub spec.
 func (ig *IntegrationV1) GetGitHubIntegrationSpec() *GitHubIntegrationSpecV1 {
 	return ig.Spec.GetGitHub()
@@ -467,6 +507,7 @@ func (ig *IntegrationV1) UnmarshalJSON(data []byte) error {
 			AWSRA       json.RawMessage `json:"aws_ra"`
 			Credentials json.RawMessage `json:"credentials"`
 		} `json:"spec"`
+		Status IntegrationStatusV1 `json:"status,omitempty"`
 	}{}
 
 	err := json.Unmarshal(data, &d)
@@ -475,6 +516,7 @@ func (ig *IntegrationV1) UnmarshalJSON(data []byte) error {
 	}
 
 	integration.ResourceHeader = d.ResourceHeader
+	integration.Status = d.Status
 	if len(d.Spec.Credentials) != 0 {
 		var credentials PluginCredentialsV1
 		if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(d.Spec.Credentials, protoadapt.MessageV2Of(&credentials)); err != nil {
@@ -554,9 +596,11 @@ func (ig *IntegrationV1) MarshalJSON() ([]byte, error) {
 			AWSRA       AWSRAIntegrationSpecV1     `json:"aws_ra,omitempty"`
 			Credentials json.RawMessage            `json:"credentials,omitempty"`
 		} `json:"spec"`
+		Status IntegrationStatusV1 `json:"status,omitempty"`
 	}{}
 
 	d.ResourceHeader = ig.ResourceHeader
+	d.Status = ig.Status
 	if ig.Spec.Credentials != nil {
 		data, err := protojson.Marshal(protoadapt.MessageV2Of(ig.Spec.Credentials))
 		if err != nil {
@@ -589,13 +633,23 @@ func (ig *IntegrationV1) MarshalJSON() ([]byte, error) {
 		}
 		d.Spec.AWSRA = *ig.GetAWSRolesAnywhereIntegrationSpec()
 	default:
-		return nil, trace.BadParameter("invalid subkind %q", ig.SubKind)
+		return nil, trace.BadParameter("invalid subkind %q, supported values are %q", ig.SubKind, integrationSubKindValues)
 	}
 
 	out, err := json.Marshal(d)
 	return out, trace.Wrap(err)
 }
 
+// SetStatus updates the integration status.
+func (ig *IntegrationV1) SetStatus(status IntegrationStatusV1) {
+	ig.Status = status
+}
+
+// GetStatus retrieves the integration status.
+func (ig *IntegrationV1) GetStatus() IntegrationStatusV1 {
+	return ig.Status
+}
+
 // SetCredentials updates credentials.
 func (ig *IntegrationV1) SetCredentials(creds PluginCredentials) error {
 	if creds == nil {
diff --git a/api/types/integration_test.go b/api/types/integration_test.go
index 5684a0038ad24..9b9b875751759 100644
--- a/api/types/integration_test.go
+++ b/api/types/integration_test.go
@@ -18,6 +18,7 @@ package types
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 
 	"github.com/google/uuid"
@@ -68,6 +69,10 @@ func TestIntegrationJSONMarshalCycle(t *testing.T) {
 			require.Equal(t, &ig2, ig)
 		})
 	}
+
+	aws.SubKind = ""
+	_, err = json.MarshalIndent(aws, "", "  ")
+	require.ErrorContains(t, err, `invalid subkind "", supported values are ["aws-oidc" "azure-oidc" "aws-ra" "github"]`)
 }
 
 func TestIntegrationCheckAndSetDefaults(t *testing.T) {
@@ -223,7 +228,12 @@ func TestIntegrationCheckAndSetDefaults(t *testing.T) {
 					},
 				)
 			},
-			expectedErrorIs: trace.IsBadParameter,
+			expectedErrorIs: func(err error) bool {
+				return trace.IsBadParameter(err) &&
+					strings.Contains(err.Error(),
+						`unsupported audience value "testvalue", supported values are ["" "aws-identity-center"]`,
+					)
+			},
 		},
 		{
 			name: "azure-oidc: valid",
@@ -468,8 +478,8 @@ func TestIntegrationCheckAndSetDefaults(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			name := uuid.NewString()
 			ig, err := tt.integration(name)
-			require.True(t, tt.expectedErrorIs(err), "expected another error", err)
-			if err != nil {
+			require.True(t, tt.expectedErrorIs(err), "expected another error %v", err)
+			if err != nil && trace.IsBadParameter(err) {
 				return
 			}
 
diff --git a/api/types/kubernetes.go b/api/types/kubernetes.go
index 0ddac7c6ce28d..9d872f57a7f75 100644
--- a/api/types/kubernetes.go
+++ b/api/types/kubernetes.go
@@ -21,6 +21,7 @@ import (
 	"regexp"
 	"slices"
 	"sort"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -78,6 +79,8 @@ type KubeCluster interface {
 	// GetCloud gets the cloud this kube cluster is running on, or an empty string if it
 	// isn't running on a cloud provider.
 	GetCloud() string
+	// IsEqual determines if two Kubernetes cluster resources are equivalent.
+	IsEqual(KubeCluster) bool
 }
 
 // DiscoveredEKSCluster represents a server discovered by EKS discovery fetchers.
@@ -397,7 +400,7 @@ func (k *KubernetesClusterV3) CheckAndSetDefaults() error {
 	return nil
 }
 
-// IsEqual determines if two user resources are equivalent to one another.
+// IsEqual determines if two Kubernetes cluster resources are equivalent.
 func (k *KubernetesClusterV3) IsEqual(i KubeCluster) bool {
 	if other, ok := i.(*KubernetesClusterV3); ok {
 		return deriveTeleportEqualKubernetesClusterV3(k, other)
@@ -547,28 +550,14 @@ func DeduplicateKubeClusters(kubeclusters []KubeCluster) []KubeCluster {
 
 var _ ResourceWithLabels = (*KubernetesResourceV1)(nil)
 
-// NewKubernetesPodV1 creates a new kubernetes resource with kind "pod".
-func NewKubernetesPodV1(meta Metadata, spec KubernetesResourceSpecV1) (*KubernetesResourceV1, error) {
-	pod := &KubernetesResourceV1{
-		Kind:     KindKubePod,
-		Metadata: meta,
-		Spec:     spec,
-	}
-
-	if err := pod.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return pod, nil
-}
-
 // NewKubernetesResourceV1 creates a new kubernetes resource .
-func NewKubernetesResourceV1(kind string, meta Metadata, spec KubernetesResourceSpecV1) (*KubernetesResourceV1, error) {
+func NewKubernetesResourceV1(kind string, namespaced bool, meta Metadata, spec KubernetesResourceSpecV1) (*KubernetesResourceV1, error) {
 	resource := &KubernetesResourceV1{
 		Kind:     kind,
 		Metadata: meta,
 		Spec:     spec,
 	}
-	if err := resource.CheckAndSetDefaults(); err != nil {
+	if err := resource.CheckAndSetDefaults(namespaced); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return resource, nil
@@ -631,17 +620,17 @@ func (k *KubernetesResourceV1) SetRevision(rev string) {
 
 // CheckAndSetDefaults validates the Resource and sets any empty fields to
 // default values.
-func (k *KubernetesResourceV1) CheckAndSetDefaults() error {
+func (k *KubernetesResourceV1) CheckAndSetDefaults(namespaced bool) error {
 	k.setStaticFields()
-	if !slices.Contains(KubernetesResourcesKinds, k.Kind) {
-		return trace.BadParameter("invalid kind %q defined; allowed values: %v", k.Kind, KubernetesResourcesKinds)
+	if !slices.Contains(KubernetesResourcesKinds, k.Kind) && !strings.HasPrefix(k.Kind, AccessRequestPrefixKindKube) {
+		return trace.BadParameter("invalid kind %q defined; allowed values: %v, %s<kind>", k.Kind, KubernetesResourcesKinds, AccessRequestPrefixKindKube)
 	}
 	if err := k.Metadata.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Unless the resource is cluster-wide, it must have a namespace.
-	if len(k.Spec.Namespace) == 0 && !slices.Contains(KubernetesClusterWideResourceKinds, k.Kind) {
+	if len(k.Spec.Namespace) == 0 && namespaced {
 		return trace.BadParameter("missing kubernetes namespace")
 	}
 
@@ -753,3 +742,27 @@ func (k KubeResources) AsResources() ResourcesWithLabels {
 	}
 	return resources
 }
+
+// KubeResource represents either a KubernetesResource or RequestKubernetesResource.
+type KubeResource interface {
+	GetAPIGroup() string
+	GetKind() string
+	GetNamespace() string
+	SetAPIGroup(string)
+	SetKind(string)
+	SetNamespace(string)
+}
+
+// Setter/Getter to enable generics.
+func (m *RequestKubernetesResource) GetAPIGroup() string      { return m.APIGroup }
+func (m *KubernetesResource) GetAPIGroup() string             { return m.APIGroup }
+func (m *RequestKubernetesResource) SetAPIGroup(group string) { m.APIGroup = group }
+func (m *KubernetesResource) SetAPIGroup(group string)        { m.APIGroup = group }
+func (m *RequestKubernetesResource) GetKind() string          { return m.Kind }
+func (m *KubernetesResource) GetKind() string                 { return m.Kind }
+func (m *RequestKubernetesResource) SetKind(kind string)      { m.Kind = kind }
+func (m *KubernetesResource) SetKind(kind string)             { m.Kind = kind }
+func (m *RequestKubernetesResource) GetNamespace() string     { return "" }
+func (m *KubernetesResource) GetNamespace() string            { return m.Namespace }
+func (m *RequestKubernetesResource) SetNamespace(ns string)   {}
+func (m *KubernetesResource) SetNamespace(ns string)          { m.Namespace = ns }
diff --git a/api/types/kubernetes_server.go b/api/types/kubernetes_server.go
index f4cee7ca36492..85800921f4bfc 100644
--- a/api/types/kubernetes_server.go
+++ b/api/types/kubernetes_server.go
@@ -58,6 +58,22 @@ type KubeServer interface {
 	SetCluster(KubeCluster) error
 	// ProxiedService provides common methods for a proxied service.
 	ProxiedService
+	// GetTargetHealth gets health details for a target Kubernetes cluster.
+	GetTargetHealth() *TargetHealth
+	// SetTargetHealth sets health details for a target Kubernetes cluster.
+	SetTargetHealth(h *TargetHealth)
+	// GetTargetHealthStatus gets the health status of a target Kubernetes cluster.
+	GetTargetHealthStatus() TargetHealthStatus
+	// SetTargetHealthStatus sets the health status of a target Kubernetes cluster.
+	SetTargetHealthStatus(status TargetHealthStatus)
+	// GetRelayGroup returns the name of the Relay group that the kube server is
+	// connected to.
+	GetRelayGroup() string
+	// GetRelayIDs returns the list of Relay host IDs that the kube server is
+	// connected to.
+	GetRelayIDs() []string
+	// GetScope returns the scope this server belongs to.
+	GetScope() string
 }
 
 // NewKubernetesServerV3 creates a new kube server instance.
@@ -241,6 +257,22 @@ func (s *KubernetesServerV3) SetProxyIDs(proxyIDs []string) {
 	s.Spec.ProxyIDs = proxyIDs
 }
 
+// GetRelayGroup implements [KubeServer].
+func (s *KubernetesServerV3) GetRelayGroup() string {
+	if s == nil {
+		return ""
+	}
+	return s.Spec.RelayGroup
+}
+
+// GetRelayIDs implements [KubeServer].
+func (s *KubernetesServerV3) GetRelayIDs() []string {
+	if s == nil {
+		return nil
+	}
+	return s.Spec.RelayIds
+}
+
 // GetLabel retrieves the label with the provided key. If not found
 // value will be empty and ok will be false.
 func (s *KubernetesServerV3) GetLabel(key string) (value string, ok bool) {
@@ -309,6 +341,60 @@ func (k *KubernetesServerV3) IsEqual(i KubeServer) bool {
 	return false
 }
 
+// GetTargetHealth gets health details for a target Kubernetes cluster.
+func (s *KubernetesServerV3) GetTargetHealth() *TargetHealth {
+	return s.GetStatus().GetTargetHealth()
+}
+
+// SetTargetHealth sets health details for a target Kubernetes cluster.
+func (s *KubernetesServerV3) SetTargetHealth(h *TargetHealth) {
+	if s.Status == nil {
+		s.Status = &KubernetesServerStatusV3{}
+	}
+	s.Status.TargetHealth = h
+}
+
+// GetTargetHealthStatus gets the health status of a target Kubernetes cluster.
+func (s *KubernetesServerV3) GetTargetHealthStatus() TargetHealthStatus {
+	health := s.GetStatus().GetTargetHealth()
+	if health == nil {
+		return TargetHealthStatusUnknown
+	}
+	return TargetHealthStatus(health.Status)
+}
+
+// SetTargetHealthStatus sets the health status of a target Kubernetes cluster.
+func (s *KubernetesServerV3) SetTargetHealthStatus(status TargetHealthStatus) {
+	if s.Status == nil {
+		s.Status = &KubernetesServerStatusV3{}
+	}
+	if s.Status.TargetHealth == nil {
+		s.Status.TargetHealth = &TargetHealth{}
+	}
+	s.Status.TargetHealth.Status = string(status)
+}
+
+// GetStatus gets the Kubernetes server status.
+func (s *KubernetesServerV3) GetStatus() *KubernetesServerStatusV3 {
+	if s == nil {
+		return nil
+	}
+	return s.Status
+}
+
+// GetScope returns the scope this server belongs to.
+func (s *KubernetesServerV3) GetScope() string {
+	return s.Scope
+}
+
+// GetTargetHealth gets the health of a Kubernetes cluster.
+func (s *KubernetesServerStatusV3) GetTargetHealth() *TargetHealth {
+	if s == nil {
+		return nil
+	}
+	return s.TargetHealth
+}
+
 // KubeServers represents a list of kube servers.
 type KubeServers []KubeServer
 
diff --git a/api/types/lock.go b/api/types/lock.go
index 4293bb5fb77b7..aa2d7abb61af4 100644
--- a/api/types/lock.go
+++ b/api/types/lock.go
@@ -272,7 +272,9 @@ func (t LockTarget) IsEmpty() bool {
 		t.WindowsDesktop == "" &&
 		t.AccessRequest == "" &&
 		t.Device == "" &&
-		t.ServerID == ""
+		t.ServerID == "" &&
+		t.BotInstanceID == "" &&
+		t.JoinToken == ""
 }
 
 // Match returns true if the lock's target is matched by this target.
@@ -288,7 +290,9 @@ func (t LockTarget) Match(lock Lock) bool {
 		(t.WindowsDesktop == "" || lockTarget.WindowsDesktop == t.WindowsDesktop) &&
 		(t.AccessRequest == "" || lockTarget.AccessRequest == t.AccessRequest) &&
 		(t.Device == "" || lockTarget.Device == t.Device) &&
-		(t.ServerID == "" || lockTarget.ServerID == t.ServerID)
+		(t.ServerID == "" || lockTarget.ServerID == t.ServerID) &&
+		(t.BotInstanceID == "" || lockTarget.BotInstanceID == t.BotInstanceID) &&
+		(t.JoinToken == "" || lockTarget.JoinToken == t.JoinToken)
 }
 
 // String returns string representation of the LockTarget.
@@ -305,5 +309,7 @@ func (t LockTarget) Equals(t2 LockTarget) bool {
 		t.WindowsDesktop == t2.WindowsDesktop &&
 		t.AccessRequest == t2.AccessRequest &&
 		t.Device == t2.Device &&
-		t.ServerID == t2.ServerID
+		t.ServerID == t2.ServerID &&
+		t.BotInstanceID == t2.BotInstanceID &&
+		t.JoinToken == t2.JoinToken
 }
diff --git a/api/types/matchers.go b/api/types/matchers.go
index e27cc61ac3384..3fce91a72f845 100644
--- a/api/types/matchers.go
+++ b/api/types/matchers.go
@@ -16,6 +16,13 @@ limitations under the License.
 
 package types
 
+import (
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
 // Matcher is an interface for cloud resource matchers.
 type Matcher interface {
 	// GetTypes gets the types that the matcher can match.
@@ -23,3 +30,41 @@ type Matcher interface {
 	// CopyWithTypes copies the matcher with new types.
 	CopyWithTypes(t []string) Matcher
 }
+
+// CheckAndSetDefaults checks and sets defaults for HTTPProxySettings.
+func (settings *HTTPProxySettings) CheckAndSetDefaults() error {
+	if settings == nil {
+		return nil
+	}
+
+	if !isValidHTTPProxyURL(settings.HTTPProxy) {
+		return trace.BadParameter("invalid http_proxy setting: %q", settings.HTTPProxy)
+	}
+	if !isValidHTTPProxyURL(settings.HTTPSProxy) {
+		return trace.BadParameter("invalid https_proxy setting: %q", settings.HTTPSProxy)
+	}
+
+	// NO_PROXY can contain multiple comma-separated values.
+	// Each value can have multiple formats: IP address, CIDR, domain name, etc.
+	// Each tool might have its own rules for parsing and validating NO_PROXY values.
+	// Due to this complexity and ambiguity, we skip strict validation here.
+
+	return nil
+}
+
+// We expect these variables to be used by Go code, so this method must allow at least all possible variations that are allowed by the golang.org/x/net/http/httpproxy.
+func isValidHTTPProxyURL(proxyURL string) bool {
+	if proxyURL == "" {
+		return true
+	}
+
+	if !strings.HasPrefix("https://", proxyURL) && !strings.HasPrefix("http://", proxyURL) {
+		// See https://cs.opensource.google/go/x/net/+/refs/tags/v0.46.0:http/httpproxy/proxy.go;drc=cde1dda944dcf6350753df966bb5bda87a544842;l=154
+		proxyURL = "http://" + proxyURL
+	}
+	if _, err := url.Parse(proxyURL); err != nil {
+		return false
+	}
+
+	return true
+}
diff --git a/api/types/matchers_aws.go b/api/types/matchers_aws.go
index ed548235b2603..8f9182dd7b268 100644
--- a/api/types/matchers_aws.go
+++ b/api/types/matchers_aws.go
@@ -38,6 +38,10 @@ const (
 	// that will be called when executing the SSM command.
 	AWSInstallerDocument = "TeleportDiscoveryInstaller"
 
+	// AWSSSMDocumentRunShellScript is the `AWS-RunShellScript` SSM Document name.
+	// It is available in all AWS accounts and does not need to be manually created.
+	AWSSSMDocumentRunShellScript = "AWS-RunShellScript"
+
 	// AWSAgentlessInstallerDocument is the name of the default AWS document
 	// that will be called when executing the SSM command .
 	AWSAgentlessInstallerDocument = "TeleportAgentlessDiscoveryInstaller"
@@ -56,6 +60,8 @@ const (
 	AWSMatcherRedshiftServerless = "redshift-serverless"
 	// AWSMatcherElastiCache is the AWS matcher type for ElastiCache databases.
 	AWSMatcherElastiCache = "elasticache"
+	// AWSMatcherElastiCacheServerless is the AWS matcher type for ElastiCacheServerless databases.
+	AWSMatcherElastiCacheServerless = "elasticache-serverless"
 	// AWSMatcherMemoryDB is the AWS matcher type for MemoryDB databases.
 	AWSMatcherMemoryDB = "memorydb"
 	// AWSMatcherOpenSearch is the AWS matcher type for OpenSearch databases.
@@ -81,6 +87,7 @@ var SupportedAWSDatabaseMatchers = []string{
 	AWSMatcherRedshift,
 	AWSMatcherRedshiftServerless,
 	AWSMatcherElastiCache,
+	AWSMatcherElastiCacheServerless,
 	AWSMatcherMemoryDB,
 	AWSMatcherOpenSearch,
 	AWSMatcherDocumentDB,
@@ -109,6 +116,23 @@ func (m AWSMatcher) CopyWithTypes(t []string) Matcher {
 	return newMatcher
 }
 
+func isAlphanumericIncluding(s string, extraChars ...rune) bool {
+	for _, r := range s {
+		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || slices.Contains(extraChars, r) {
+			continue
+		}
+
+		return false
+	}
+
+	return true
+}
+
+// IsRegionWildcard returns true if the matcher is configured to discover resources in all regions.
+func (m *AWSMatcher) IsRegionWildcard() bool {
+	return len(m.Regions) == 1 && m.Regions[0] == Wildcard
+}
+
 // CheckAndSetDefaults that the matcher is correct and adds default values.
 func (m *AWSMatcher) CheckAndSetDefaults() error {
 	for _, matcherType := range m.Types {
@@ -123,10 +147,17 @@ func (m *AWSMatcher) CheckAndSetDefaults() error {
 	}
 
 	if len(m.Regions) == 0 {
-		return trace.BadParameter("discovery service requires at least one region")
+		return trace.BadParameter("discovery service requires at least one region, for EC2 you can also set the region to %q to iterate over all regions (requires account:ListRegions IAM permission)", Wildcard)
 	}
 
 	for _, region := range m.Regions {
+		if region == Wildcard {
+			if len(m.Regions) > 1 {
+				return trace.BadParameter("when using %q as region, no other regions can be specified", Wildcard)
+			}
+			break
+		}
+
 		if err := awsapiutils.IsValidRegion(region); err != nil {
 			return trace.BadParameter("discovery service does not support region %q", region)
 		}
@@ -199,6 +230,22 @@ func (m *AWSMatcher) CheckAndSetDefaults() error {
 		m.Params.SSHDConfig = SSHDConfigPath
 	}
 
+	if m.Params.Suffix != "" {
+		if !isAlphanumericIncluding(m.Params.Suffix, '-') {
+			return trace.BadParameter("install.suffix can only contain alphanumeric characters and hyphens")
+		}
+	}
+
+	if m.Params.UpdateGroup != "" {
+		if !isAlphanumericIncluding(m.Params.UpdateGroup, '-') {
+			return trace.BadParameter("install.update_group can only contain alphanumeric characters and hyphens")
+		}
+	}
+
+	if err := m.Params.HTTPProxySettings.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
 	if m.Params.ScriptName == "" {
 		m.Params.ScriptName = DefaultInstallerScriptNameAgentless
 		if m.Params.InstallTeleport {
diff --git a/api/types/matchers_aws_test.go b/api/types/matchers_aws_test.go
index 32b3faf67200e..449ff82596524 100644
--- a/api/types/matchers_aws_test.go
+++ b/api/types/matchers_aws_test.go
@@ -133,12 +133,12 @@ func TestAWSMatcherCheckAndSetDefaults(t *testing.T) {
 			errCheck: isBadParameterErr,
 		},
 		{
-			name: "wildcard is invalid for regions",
+			name: "wildcard is valid for the ec2 type",
 			in: &AWSMatcher{
-				Types:   []string{"ec2", "rds"},
+				Types:   []string{"ec2"},
 				Regions: []string{"*"},
 			},
-			errCheck: isBadParameterErr,
+			errCheck: require.NoError,
 		},
 		{
 			name: "invalid type",
@@ -175,6 +175,14 @@ func TestAWSMatcherCheckAndSetDefaults(t *testing.T) {
 			},
 			errCheck: isBadParameterErr,
 		},
+		{
+			name: "wildcard region is valid for ec2 type",
+			in: &AWSMatcher{
+				Types:   []string{"ec2"},
+				Regions: []string{"*"},
+			},
+			errCheck: require.NoError,
+		},
 		{
 			name: "no region",
 			in: &AWSMatcher{
@@ -326,6 +334,41 @@ func TestAWSMatcherCheckAndSetDefaults(t *testing.T) {
 				SSM: &AWSSSM{DocumentName: "TeleportDiscoveryInstaller"},
 			},
 		},
+		{
+			name: "invalid update group",
+			in: &AWSMatcher{
+				Types:   []string{"ec2"},
+				Regions: []string{"us-east-1"},
+				Params: &InstallerParams{
+					UpdateGroup: "invalid!",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid install suffix",
+			in: &AWSMatcher{
+				Types:   []string{"ec2"},
+				Regions: []string{"us-east-1"},
+				Params: &InstallerParams{
+					Suffix: "invalid!",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid proxy settings",
+			in: &AWSMatcher{
+				Types:   []string{"ec2"},
+				Regions: []string{"us-east-1"},
+				Params: &InstallerParams{
+					HTTPProxySettings: &HTTPProxySettings{
+						HTTPProxy: "not a valid url",
+					},
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			err := tt.in.CheckAndSetDefaults()
diff --git a/api/types/matchers_azure.go b/api/types/matchers_azure.go
index edadd4883a703..32da6c422cd30 100644
--- a/api/types/matchers_azure.go
+++ b/api/types/matchers_azure.go
@@ -90,6 +90,18 @@ func (m *AzureMatcher) CheckAndSetDefaults() error {
 			m.Params.Azure = &AzureInstallerParams{}
 		}
 
+		if m.Params.Suffix != "" {
+			if !isAlphanumericIncluding(m.Params.Suffix, '-') {
+				return trace.BadParameter("install.suffix can only contain alphanumeric characters and hyphens")
+			}
+		}
+
+		if m.Params.UpdateGroup != "" {
+			if !isAlphanumericIncluding(m.Params.UpdateGroup, '-') {
+				return trace.BadParameter("install.update_group can only contain alphanumeric characters and hyphens")
+			}
+		}
+
 		switch m.Params.JoinMethod {
 		case JoinMethodAzure, "":
 			m.Params.JoinMethod = JoinMethodAzure
@@ -104,6 +116,10 @@ func (m *AzureMatcher) CheckAndSetDefaults() error {
 		if m.Params.ScriptName == "" {
 			m.Params.ScriptName = DefaultInstallerScriptName
 		}
+
+		if err := m.Params.HTTPProxySettings.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	if slices.Contains(m.Regions, Wildcard) || len(m.Regions) == 0 {
diff --git a/api/types/matchers_azure_test.go b/api/types/matchers_azure_test.go
index 850b30e26d66c..376b5a1cc2f8f 100644
--- a/api/types/matchers_azure_test.go
+++ b/api/types/matchers_azure_test.go
@@ -119,6 +119,39 @@ func TestAzureMatcherCheckAndSetDefaults(t *testing.T) {
 			},
 			errCheck: isBadParameterErr,
 		},
+		{
+			name: "invalid install suffix",
+			in: &AzureMatcher{
+				Types: []string{"vm"},
+				Params: &InstallerParams{
+					Suffix: "$SHELL",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid update groups",
+			in: &AzureMatcher{
+				Types: []string{"vm"},
+				Params: &InstallerParams{
+					UpdateGroup: "$SHELL",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid proxy settings",
+			in: &AzureMatcher{
+				Types:   []string{"vm"},
+				Regions: []string{"us-east-1"},
+				Params: &InstallerParams{
+					HTTPProxySettings: &HTTPProxySettings{
+						HTTPProxy: "not a valid url",
+					},
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			err := tt.in.CheckAndSetDefaults()
diff --git a/api/types/matchers_gcp.go b/api/types/matchers_gcp.go
index e60fc8c73b7ab..4020b9711ec7d 100644
--- a/api/types/matchers_gcp.go
+++ b/api/types/matchers_gcp.go
@@ -82,6 +82,18 @@ func (m *GCPMatcher) CheckAndSetDefaults() error {
 			m.Params = &InstallerParams{}
 		}
 
+		if m.Params.Suffix != "" {
+			if !isAlphanumericIncluding(m.Params.Suffix, '-') {
+				return trace.BadParameter("install.suffix can only contain alphanumeric characters and hyphens")
+			}
+		}
+
+		if m.Params.UpdateGroup != "" {
+			if !isAlphanumericIncluding(m.Params.UpdateGroup, '-') {
+				return trace.BadParameter("install.update_group can only contain alphanumeric characters and hyphens")
+			}
+		}
+
 		switch m.Params.JoinMethod {
 		case JoinMethodGCP, "":
 			m.Params.JoinMethod = JoinMethodGCP
@@ -96,6 +108,10 @@ func (m *GCPMatcher) CheckAndSetDefaults() error {
 		if m.Params.ScriptName == "" {
 			m.Params.ScriptName = DefaultInstallerScriptName
 		}
+
+		if err := m.Params.HTTPProxySettings.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	if slices.Contains(m.Locations, Wildcard) || len(m.Locations) == 0 {
diff --git a/api/types/matchers_gcp_test.go b/api/types/matchers_gcp_test.go
index f56c93172b654..2cfa6d1f63831 100644
--- a/api/types/matchers_gcp_test.go
+++ b/api/types/matchers_gcp_test.go
@@ -148,6 +148,41 @@ func TestGCPMatcherCheckAndSetDefaults(t *testing.T) {
 			},
 			errCheck: isBadParameterErr,
 		},
+		{
+			name: "invalid install suffix",
+			in: &GCPMatcher{
+				Types:      []string{"gce"},
+				ProjectIDs: []string{"project001"},
+				Params: &InstallerParams{
+					Suffix: "$SHELL",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid update groups",
+			in: &GCPMatcher{
+				Types:      []string{"gce"},
+				ProjectIDs: []string{"project001"},
+				Params: &InstallerParams{
+					UpdateGroup: "$SHELL",
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
+		{
+			name: "invalid proxy settings",
+			in: &GCPMatcher{
+				Types:      []string{"gce"},
+				ProjectIDs: []string{"project001"},
+				Params: &InstallerParams{
+					HTTPProxySettings: &HTTPProxySettings{
+						HTTPProxy: "not a valid url",
+					},
+				},
+			},
+			errCheck: isBadParameterErr,
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			err := tt.in.CheckAndSetDefaults()
diff --git a/api/types/matchers_test.go b/api/types/matchers_test.go
new file mode 100644
index 0000000000000..7ff55610837bf
--- /dev/null
+++ b/api/types/matchers_test.go
@@ -0,0 +1,65 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPProxySettingsCheckAndSetDefaults(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		in       *HTTPProxySettings
+		errCheck require.ErrorAssertionFunc
+	}{
+		{
+			name: "valid",
+			in: &HTTPProxySettings{
+				HTTPProxy:  "http://proxy.example.com:8080",
+				HTTPSProxy: "http://proxy.example.com:8080",
+				NoProxy:    "internal.local",
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "invalid http_proxy",
+			in: &HTTPProxySettings{
+				HTTPProxy: "not a valid url",
+			},
+			errCheck: require.Error,
+		},
+		{
+			name: "invalid https_proxy",
+			in: &HTTPProxySettings{
+				HTTPSProxy: "not a valid url",
+			},
+			errCheck: require.Error,
+		},
+		{
+			name: "no_proxy is always valid",
+			in: &HTTPProxySettings{
+				NoProxy: "internal.local, ::1/128,",
+			},
+			errCheck: require.NoError,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.in.CheckAndSetDefaults()
+			tt.errCheck(t, err)
+		})
+	}
+}
diff --git a/api/types/mfa.go b/api/types/mfa.go
index bd0f42aa21729..cf9f000cabfa2 100644
--- a/api/types/mfa.go
+++ b/api/types/mfa.go
@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"time"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/utils"
diff --git a/api/types/msgraph.go b/api/types/msgraph.go
new file mode 100644
index 0000000000000..aa4733f43091c
--- /dev/null
+++ b/api/types/msgraph.go
@@ -0,0 +1,74 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"slices"
+
+	"github.com/gravitational/trace"
+)
+
+const (
+	// MSGraphDefaultLoginEndpoint is the endpoint under which Microsoft identity platform APIs are available.
+	MSGraphDefaultLoginEndpoint = "https://login.microsoftonline.com"
+	// MSDefaultGraphEndpoint is the endpoint under which Microsoft Graph API is available.
+	MSGraphDefaultEndpoint = "https://graph.microsoft.com"
+)
+
+var (
+	validLoginEndpoints = []string{
+		"https://login.microsoftonline.com",
+		"https://login.microsoftonline.us",
+		"https://login.chinacloudapi.cn",
+	}
+	validGraphEndpoints = []string{
+		"https://graph.microsoft.com",
+		"https://graph.microsoft.us",
+		"https://dod-graph.microsoft.us",
+		"https://microsoftgraph.chinacloudapi.cn",
+	}
+)
+
+// ValidateMSGraphEndpoints checks if API endpoints point to one of the official deployments of
+// the Microsoft identity platform and Microsoft Graph.
+// https://learn.microsoft.com/en-us/graph/deployments
+func ValidateMSGraphEndpoints(loginEndpoint, graphEndpoint string) error {
+	if loginEndpoint != "" && !slices.Contains(validLoginEndpoints, loginEndpoint) {
+		return trace.BadParameter("expected login endpoint to be one of %q, got %q", validLoginEndpoints, loginEndpoint)
+	}
+
+	if graphEndpoint != "" && !slices.Contains(validGraphEndpoints, graphEndpoint) {
+		return trace.BadParameter("expected graph endpoint to be one of %q, got %q", validGraphEndpoints, graphEndpoint)
+	}
+
+	return nil
+}
+
+const (
+	// EntraIDSecurityGroups represents security enabled Entra ID groups.
+	EntraIDSecurityGroups = "security-groups"
+	// EntraIDDirectoryRoles represents Entra ID directory roles.
+	EntraIDDirectoryRoles = "directory-roles"
+	// EntraIDAllGroups represents all types of Entra ID groups, including directory roles.
+	EntraIDAllGroups = "all-groups"
+)
+
+// EntraIDGroupsTypes defines supported Entra ID
+// group types for Entra ID groups proivder.
+var EntraIDGroupsTypes = []string{
+	EntraIDSecurityGroups,
+	EntraIDDirectoryRoles,
+	EntraIDAllGroups,
+}
diff --git a/api/types/msgraph_test.go b/api/types/msgraph_test.go
new file mode 100644
index 0000000000000..511ad2febd8fc
--- /dev/null
+++ b/api/types/msgraph_test.go
@@ -0,0 +1,65 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateMSGraphEndpoints(t *testing.T) {
+	for _, tt := range []struct {
+		name          string
+		loginEndpoint string
+		graphEndpoint string
+		errAssertion  require.ErrorAssertionFunc
+	}{
+		{
+			name:          "valid endpoints",
+			loginEndpoint: "https://login.microsoftonline.com",
+			graphEndpoint: "https://graph.microsoft.com",
+			errAssertion:  require.NoError,
+		},
+		{
+			name:          "empty value is permitted",
+			loginEndpoint: "",
+			graphEndpoint: "",
+			errAssertion:  require.NoError,
+		},
+		{
+			name:          "login and graph endpoint pair is not matched",
+			loginEndpoint: "https://login.microsoftonline.com",
+			graphEndpoint: "",
+			errAssertion:  require.NoError,
+		},
+		{
+			name:          "empty login endpoint and invalid graph endpoint not allowed",
+			loginEndpoint: "",
+			graphEndpoint: "https://graph.windows.net",
+			errAssertion:  require.Error,
+		},
+		{
+			name:          "invalid login and graph endpoint",
+			loginEndpoint: "https://login.microsoft.com",
+			graphEndpoint: "https://graph.windows.net",
+			errAssertion:  require.Error,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errAssertion(t, ValidateMSGraphEndpoints(tt.loginEndpoint, tt.graphEndpoint))
+		})
+	}
+}
diff --git a/api/types/oidc.go b/api/types/oidc.go
index 518a04943300c..535e8fdc9e663 100644
--- a/api/types/oidc.go
+++ b/api/types/oidc.go
@@ -19,7 +19,9 @@ package types
 import (
 	"net/netip"
 	"net/url"
+	"os"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -121,6 +123,20 @@ type OIDCConnector interface {
 	SetPKCEMode(mode constants.OIDCPKCEMode)
 	// GetPKCEMode will return the PKCEMode of the connector.
 	GetPKCEMode() constants.OIDCPKCEMode
+	// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	GetUserMatchers() []string
+	// GetRequestObjectMode will return the RequestObjectMode of the connector.
+	GetRequestObjectMode() constants.OIDCRequestObjectMode
+	// SetRequestObjectMode sets the RequestObjectMode of the connector.
+	SetRequestObjectMode(mode constants.OIDCRequestObjectMode)
+	// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+	// for identifier-first login.
+	SetUserMatchers([]string)
+	// GetEntraIDGroupsProvider returns Entra ID groups provider.
+	GetEntraIDGroupsProvider() *EntraIDGroupsProvider
+	// IsEntraIDGroupsProviderDisabled checks if the Entra ID groups provider is disabled.
+	IsEntraIDGroupsProviderDisabled() bool
 }
 
 // NewOIDCConnector returns a new OIDCConnector based off a name and OIDCConnectorSpecV3.
@@ -502,6 +518,13 @@ func (o *OIDCConnectorV3) Validate() error {
 		}
 	}
 
+	entra := o.GetEntraIDGroupsProvider()
+	if entra != nil {
+		if err := entra.checkAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
 	return nil
 }
 
@@ -565,12 +588,50 @@ func (o *OIDCConnectorV3) WithMFASettings() error {
 	o.Spec.ClientSecret = o.Spec.MFASettings.ClientSecret
 	o.Spec.ACR = o.Spec.MFASettings.AcrValues
 	o.Spec.Prompt = o.Spec.MFASettings.Prompt
-	o.Spec.MaxAge = &MaxAge{
-		Value: o.Spec.MFASettings.MaxAge,
+	// Overwrite the base connector's request object mode iff the MFA setting's
+	// request object mode is explicitly set. Otherwise, the base setting should be assumed.
+	if o.Spec.MFASettings.RequestObjectMode != string(constants.OIDCRequestObjectModeUnknown) {
+		o.Spec.RequestObjectMode = o.Spec.MFASettings.RequestObjectMode
+	}
+
+	// In rare cases, some providers will complain about the presence of the 'max_age'
+	// parameter in auth requests. Provide users with a workaround to omit it.
+	omitMaxAge, _ := strconv.ParseBool(os.Getenv("TELEPORT_OIDC_OMIT_MFA_MAX_AGE"))
+	if omitMaxAge {
+		o.Spec.MaxAge = nil
+	} else {
+		o.Spec.MaxAge = &MaxAge{
+			Value: o.Spec.MFASettings.MaxAge,
+		}
 	}
 	return nil
 }
 
+// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+// match for identifier-first login.
+func (r *OIDCConnectorV3) GetUserMatchers() []string {
+	if r.Spec.UserMatchers == nil {
+		return nil
+	}
+	return r.Spec.UserMatchers
+}
+
+// GetRequestObjectMode returns the configured OIDC request object mode.
+func (r *OIDCConnectorV3) GetRequestObjectMode() constants.OIDCRequestObjectMode {
+	return constants.OIDCRequestObjectMode(r.Spec.RequestObjectMode)
+}
+
+// SetRequestObjectMode sets the OIDC request object mode.
+func (r *OIDCConnectorV3) SetRequestObjectMode(mode constants.OIDCRequestObjectMode) {
+	r.Spec.RequestObjectMode = string(mode)
+}
+
+// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+// for identifier-first login.
+func (r *OIDCConnectorV3) SetUserMatchers(userMatchers []string) {
+	r.Spec.UserMatchers = userMatchers
+}
+
 // Check returns nil if all parameters are great, err otherwise
 func (r *OIDCAuthRequest) Check() error {
 	switch {
@@ -596,3 +657,28 @@ func (r *OIDCAuthRequest) Check() error {
 	}
 	return nil
 }
+
+func (e *EntraIDGroupsProvider) checkAndSetDefaults() error {
+	if e.GroupType != "" {
+		if !slices.Contains(EntraIDGroupsTypes, e.GroupType) {
+			return trace.BadParameter("expected group type to be one of %q, got %q", EntraIDGroupsTypes, e.GroupType)
+		}
+	}
+
+	if err := ValidateMSGraphEndpoints("", e.GraphEndpoint); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// GetEntraIDGroupsProvider returns Entra ID groups provider.
+func (o *OIDCConnectorV3) GetEntraIDGroupsProvider() *EntraIDGroupsProvider {
+	return o.Spec.EntraIdGroupsProvider
+}
+
+// IsEntraIDGroupsProviderDisabled checks if the Entra ID groups provider is disabled.
+func (o *OIDCConnectorV3) IsEntraIDGroupsProviderDisabled() bool {
+	entra := o.Spec.EntraIdGroupsProvider
+	return entra != nil && entra.Disabled
+}
diff --git a/api/types/oidc_test.go b/api/types/oidc_test.go
new file mode 100644
index 0000000000000..c382042dedc51
--- /dev/null
+++ b/api/types/oidc_test.go
@@ -0,0 +1,93 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/wrappers"
+)
+
+func TestOIDCValidate(t *testing.T) {
+	tests := []struct {
+		name         string
+		entra        *EntraIDGroupsProvider
+		errAssertion require.ErrorAssertionFunc
+	}{
+		{
+			name: "invalid group type",
+			entra: &EntraIDGroupsProvider{
+				GroupType: "random",
+			},
+			errAssertion: require.Error,
+		},
+		{
+			name: "invalid endpoint",
+			entra: &EntraIDGroupsProvider{
+				GroupType:     "all-groups",
+				GraphEndpoint: "https://example.com",
+			},
+			errAssertion: require.Error,
+		},
+		{
+			name:         "empty entra_id_groups_provider",
+			entra:        nil,
+			errAssertion: require.NoError,
+		},
+		{
+			name: "disabled state should not skip invalid configuration",
+			entra: &EntraIDGroupsProvider{
+				Disabled:      true,
+				GroupType:     "all-groups",
+				GraphEndpoint: "https://example.com",
+			},
+			errAssertion: require.Error,
+		},
+		{
+			name: "valid",
+			entra: &EntraIDGroupsProvider{
+				Disabled:      false,
+				GroupType:     "all-groups",
+				GraphEndpoint: "https://graph.microsoft.com",
+			},
+			errAssertion: require.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			connector, err := NewOIDCConnector("test-connector", OIDCConnectorSpecV3{
+				ClientID:     "testid",
+				ClientSecret: "secret",
+				ClaimsToRoles: []ClaimMapping{
+					{
+						Claim: "groups",
+						Value: "*",
+						Roles: []string{"requester"},
+					},
+				},
+				RedirectURLs: wrappers.Strings{
+					"https://example.com/proxy/oidc/callback",
+				},
+				EntraIdGroupsProvider: test.entra,
+			})
+			require.NoError(t, err)
+
+			test.errAssertion(t, connector.Validate())
+		})
+	}
+}
diff --git a/api/types/plugin.go b/api/types/plugin.go
index 6ba08b8af2942..76f0b7faa1d7c 100644
--- a/api/types/plugin.go
+++ b/api/types/plugin.go
@@ -21,7 +21,7 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/utils"
@@ -37,6 +37,7 @@ var AllPluginTypes = []PluginType{
 	PluginTypeOpenAI,
 	PluginTypeOkta,
 	PluginTypeJamf,
+	PluginTypeIntune,
 	PluginTypeJira,
 	PluginTypeOpsgenie,
 	PluginTypePagerDuty,
@@ -62,6 +63,8 @@ const (
 	PluginTypeOkta = "okta"
 	// PluginTypeJamf is the Jamf MDM plugin
 	PluginTypeJamf = "jamf"
+	// PluginTypeIntune is the Intune MDM plugin
+	PluginTypeIntune = "intune"
 	// PluginTypeJira is the Jira access plugin
 	PluginTypeJira = "jira"
 	// PluginTypeOpsgenie is the Opsgenie access request plugin
@@ -120,6 +123,7 @@ type Plugin interface {
 	SetCredentials(PluginCredentials) error
 	SetStatus(PluginStatus) error
 	GetGeneration() string
+	CloneWithoutSecrets() Plugin
 }
 
 // PluginCredentials are the credentials embedded in Plugin
@@ -244,7 +248,23 @@ func (p *PluginV1) CheckAndSetDefaults() error {
 		if len(staticCreds.Labels) == 0 {
 			return trace.BadParameter("labels must be specified")
 		}
-
+	case *PluginSpecV1_Intune:
+		if settings.Intune == nil {
+			return trace.BadParameter("missing Intune settings")
+		}
+		if err := settings.Intune.Validate(); err != nil {
+			return trace.Wrap(err)
+		}
+		if p.Credentials == nil {
+			return trace.BadParameter("credentials must be set")
+		}
+		staticCreds := p.Credentials.GetStaticCredentialsRef()
+		if staticCreds == nil {
+			return trace.BadParameter("Intune plugin must be used with the static credentials ref type")
+		}
+		if len(staticCreds.Labels) == 0 {
+			return trace.BadParameter("labels must be specified")
+		}
 	case *PluginSpecV1_Jira:
 		if settings.Jira == nil {
 			return trace.BadParameter("missing Jira settings")
@@ -418,7 +438,8 @@ func (p *PluginV1) CheckAndSetDefaults() error {
 	return nil
 }
 
-// WithoutSecrets returns an instance of resource without secrets.
+// WithoutSecrets returns the Plugin as a Resource, with secrets removed.
+// If you want to have a copy of the Plugin without secrets use CloneWithoutSecrets instead.
 func (p *PluginV1) WithoutSecrets() Resource {
 	if p.Credentials == nil {
 		return p
@@ -429,6 +450,15 @@ func (p *PluginV1) WithoutSecrets() Resource {
 	return p2
 }
 
+// CloneWithoutSecrets returns a deep copy of the Plugin instance with secrets removed.
+// Use this when you need a separate Plugin object without secrets,
+// rather than a Resource interface value as returned by WithoutSecrets.
+func (p *PluginV1) CloneWithoutSecrets() Plugin {
+	out := p.Clone().(*PluginV1)
+	out.SetCredentials(nil)
+	return out
+}
+
 func (p *PluginV1) setStaticFields() {
 	p.Kind = KindPlugin
 	p.Version = V1
@@ -555,6 +585,8 @@ func (p *PluginV1) GetType() PluginType {
 		return PluginTypeOkta
 	case *PluginSpecV1_Jamf:
 		return PluginTypeJamf
+	case *PluginSpecV1_Intune:
+		return PluginTypeIntune
 	case *PluginSpecV1_Jira:
 		return PluginTypeJira
 	case *PluginSpecV1_Opsgenie:
@@ -754,9 +786,11 @@ func (c *PluginEntraIDSettings) Validate() error {
 }
 
 func (c *PluginSCIMSettings) CheckAndSetDefaults() error {
-	if c.SamlConnectorName == "" {
-		return trace.BadParameter("saml_connector_name must be set")
+	if c.SamlConnectorName == "" && c.ConnectorInfo == nil {
+		// Don't print legacy filed.
+		return trace.BadParameter("connector_info must be set")
 	}
+
 	return nil
 }
 
@@ -770,6 +804,17 @@ func (c *PluginDatadogAccessSettings) CheckAndSetDefaults() error {
 	return nil
 }
 
+const (
+	// AWSICRolesSyncModeAll indicates that the AWS Identity Center integration
+	// should create and maintain roles for all possible Account Assignments.
+	AWSICRolesSyncModeAll string = "ALL"
+
+	// AWSICRolesSyncModeNone indicates that the AWS Identity Center integration
+	// should *not* create any roles representing potential account Account
+	// Assignments.
+	AWSICRolesSyncModeNone string = "NONE"
+)
+
 func (c *PluginAWSICSettings) CheckAndSetDefaults() error {
 
 	// Handle legacy records that pre-date the polymorphic Credentials settings
@@ -974,7 +1019,7 @@ func (c *PluginNetIQSettings) Validate() error {
 	return nil
 }
 
-// CheckAndSetDefaults checks that the required fields for the Github plugin are set.
+// Validate checks that the required fields for the Github plugin are set.
 func (c *PluginGithubSettings) Validate() error {
 	if c.ClientId == "" {
 		return trace.BadParameter("client_id must be set")
@@ -984,3 +1029,38 @@ func (c *PluginGithubSettings) Validate() error {
 	}
 	return nil
 }
+
+// Validate checks that the required fields for the Intune plugin are set.
+func (c *PluginIntuneSettings) Validate() error {
+	if c.Tenant == "" {
+		return trace.BadParameter("tenant must be set")
+	}
+
+	if err := ValidateMSGraphEndpoints(c.LoginEndpoint, c.GraphEndpoint); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// UnmarshalJSON implements [json.Unmarshaler] for the PluginSyncFilter, forcing
+// it to use the `jsonpb` unmarshaler, which understands how to unpack values
+// generated from a protobuf `oneof` directive.
+func (s *PluginSyncFilter) UnmarshalJSON(b []byte) error {
+	if err := (&jsonpb.Unmarshaler{AllowUnknownFields: true}).Unmarshal(bytes.NewReader(b), s); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// MarshalJSON implements [json.Marshaler] for the PluginSyncFilter, forcing
+// it to use the `jsonpb` marshaler, which understands how to pack values
+// generated from a protobuf `oneof` directive.
+func (s PluginSyncFilter) MarshalJSON() ([]byte, error) {
+	m := jsonpb.Marshaler{}
+	var buf bytes.Buffer
+	if err := m.Marshal(&buf, &s); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return buf.Bytes(), nil
+}
diff --git a/api/types/plugin_static_credentials.go b/api/types/plugin_static_credentials.go
index 5dd8397a29c26..3433c6a1a4b78 100644
--- a/api/types/plugin_static_credentials.go
+++ b/api/types/plugin_static_credentials.go
@@ -82,7 +82,11 @@ func (p *PluginStaticCredentialsV1) CheckAndSetDefaults() error {
 		return trace.Wrap(err)
 	}
 
-	switch credentials := p.Spec.Credentials.(type) {
+	return trace.Wrap(p.Spec.CheckAndSetDefaults())
+}
+
+func (ps *PluginStaticCredentialsSpecV1) CheckAndSetDefaults() error {
+	switch credentials := ps.Credentials.(type) {
 	case *PluginStaticCredentialsSpecV1_APIToken:
 		if credentials.APIToken == "" {
 			return trace.BadParameter("api token object is missing")
diff --git a/api/types/plugin_test.go b/api/types/plugin_test.go
index 176f1adb71f8d..bff364606e906 100644
--- a/api/types/plugin_test.go
+++ b/api/types/plugin_test.go
@@ -512,6 +512,192 @@ func TestPluginJamfValidation(t *testing.T) {
 	}
 }
 
+func TestPluginIntuneValidation(t *testing.T) {
+	testCases := []struct {
+		name      string
+		settings  *PluginSpecV1_Intune
+		creds     *PluginCredentialsV1
+		assertErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no settings",
+			settings: &PluginSpecV1_Intune{
+				Intune: nil,
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "missing Intune settings")
+			},
+		},
+		{
+			name: "no tenant",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{},
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "tenant must be set")
+			},
+		},
+		{
+			name: "no credentials inner",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{Tenant: "foo"},
+			},
+			creds: &PluginCredentialsV1{},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "must be used with the static credentials ref type")
+			},
+		},
+		{
+			name: "invalid credential type (oauth2)",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{Tenant: "foo"},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_Oauth2AccessToken{},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "must be used with the static credentials ref type")
+			},
+		},
+		{
+			name: "invalid credentials (static credentials)",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{Tenant: "foo"},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "labels must be specified")
+			},
+		},
+		{
+			name: "valid credentials (static credentials)",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{Tenant: "foo"},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "invalid login endpoint",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{
+					Tenant:        "foo",
+					LoginEndpoint: "example.com",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "login endpoint")
+			},
+		},
+		{
+			name: "valid login endpoint",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{
+					Tenant:        "foo",
+					LoginEndpoint: "https://login.microsoftonline.us",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "invalid graph endpoint",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{
+					Tenant:        "foo",
+					GraphEndpoint: "example.com",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.ErrorContains(t, err, "graph endpoint")
+			},
+		},
+		{
+			name: "valid graph endpoint",
+			settings: &PluginSpecV1_Intune{
+				Intune: &PluginIntuneSettings{
+					Tenant:        "foo",
+					GraphEndpoint: "https://graph.microsoft.us",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.NoError(t, err)
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			plugin := NewPluginV1(Metadata{Name: "foobar"}, PluginSpecV1{
+				Settings: tc.settings,
+			}, tc.creds)
+			tc.assertErr(t, plugin.CheckAndSetDefaults())
+		})
+	}
+}
+
 func TestPluginMattermostValidation(t *testing.T) {
 	defaultSettings := &PluginSpecV1_Mattermost{
 		Mattermost: &PluginMattermostSettings{
@@ -1133,6 +1319,36 @@ func TestPluginAWSICSettings(t *testing.T) {
 				require.Equal(t, "some-oidc-integration", oidc.IntegrationName)
 			},
 		},
+		{
+			name: "(role sync mode) empty value is not an error",
+			mutateSettings: func(cfg *PluginAWSICSettings) {
+				cfg.RolesSyncMode = ""
+			},
+			assertErr: require.NoError,
+			assertValue: func(t *testing.T, cfg *PluginAWSICSettings) {
+				require.Empty(t, cfg.RolesSyncMode)
+			},
+		},
+		{
+			name: "(role sync mode) value is preserved",
+			mutateSettings: func(cfg *PluginAWSICSettings) {
+				cfg.RolesSyncMode = AWSICRolesSyncModeNone
+			},
+			assertErr: require.NoError,
+			assertValue: func(t *testing.T, cfg *PluginAWSICSettings) {
+				require.Equal(t, AWSICRolesSyncModeNone, cfg.RolesSyncMode)
+			},
+		},
+		{
+			// Technically, an invalid Role Sync Mode *is* an error, its just not
+			// enforced when deserializing the plugin record. Validation is
+			// required at time of use.
+			name: "(role sync mode) invalid value is not an error",
+			mutateSettings: func(cfg *PluginAWSICSettings) {
+				cfg.RolesSyncMode = "banana"
+			},
+			assertErr: require.NoError,
+		},
 	}
 
 	for _, tc := range testCases {
diff --git a/api/types/provisioning.go b/api/types/provisioning.go
index 0ea9ab37edabe..6ad29daefa47b 100644
--- a/api/types/provisioning.go
+++ b/api/types/provisioning.go
@@ -20,6 +20,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
+	"net/url"
 	"slices"
 	"strings"
 	"time"
@@ -86,6 +87,8 @@ const (
 	// JoinMethodBoundKeypair indicates the node will join using the Bound
 	// Keypair join method. See lib/boundkeypair for more.
 	JoinMethodBoundKeypair JoinMethod = "bound_keypair"
+	// JoinMethodEnv0 indicates the node will join using the env0 join method.
+	JoinMethodEnv0 JoinMethod = "env0"
 )
 
 var JoinMethods = []JoinMethod{
@@ -105,6 +108,7 @@ var JoinMethods = []JoinMethod{
 	JoinMethodTerraformCloud,
 	JoinMethodOracle,
 	JoinMethodBoundKeypair,
+	JoinMethodEnv0,
 }
 
 func ValidateJoinMethod(method JoinMethod) error {
@@ -122,6 +126,7 @@ var (
 	KubernetesJoinTypeUnspecified KubernetesJoinType = ""
 	KubernetesJoinTypeInCluster   KubernetesJoinType = "in_cluster"
 	KubernetesJoinTypeStaticJWKS  KubernetesJoinType = "static_jwks"
+	KubernetesJoinTypeOIDC        KubernetesJoinType = "oidc"
 )
 
 // ProvisionToken is a provisioning token
@@ -145,6 +150,8 @@ type ProvisionToken interface {
 	GetGCPRules() *ProvisionTokenSpecV2GCP
 	// GetGithubRules will return the GitHub rules within this token.
 	GetGithubRules() *ProvisionTokenSpecV2GitHub
+	// GetGitlabRules will return the GitLab rules within this token.
+	GetGitlabRules() *ProvisionTokenSpecV2GitLab
 	// GetAWSIIDTTL returns the TTL of EC2 IIDs
 	GetAWSIIDTTL() Duration
 	// GetJoinMethod returns joining method that must be used with this token.
@@ -171,6 +178,11 @@ type ProvisionToken interface {
 	// join methods where the name is secret. This should be used when logging
 	// the token name.
 	GetSafeName() string
+
+	// GetAssignedScope always returns an empty string because a [ProvisionToken] is always
+	// unscoped
+	GetAssignedScope() string
+
 	// Clone creates a copy of the token.
 	Clone() ProvisionToken
 }
@@ -441,17 +453,21 @@ func (p *ProvisionTokenV2) CheckAndSetDefaults() error {
 			return trace.Wrap(err, "spec.azure_devops: failed validation")
 		}
 	case JoinMethodBoundKeypair:
-		providerCfg := p.Spec.BoundKeypair
-		if providerCfg == nil {
-			return trace.BadParameter(
-				"spec.bound_keypair: must be configured for the join method %q",
-				JoinMethodBoundKeypair,
-			)
+		if p.Spec.BoundKeypair == nil {
+			p.Spec.BoundKeypair = &ProvisionTokenSpecV2BoundKeypair{}
 		}
 
-		if err := providerCfg.checkAndSetDefaults(); err != nil {
+		if err := p.Spec.BoundKeypair.checkAndSetDefaults(); err != nil {
 			return trace.Wrap(err, "spec.bound_keypair: failed validation")
 		}
+	case JoinMethodEnv0:
+		if p.Spec.Env0 == nil {
+			p.Spec.Env0 = &ProvisionTokenSpecV2Env0{}
+		}
+
+		if err := p.Spec.Env0.checkAndSetDefaults(); err != nil {
+			return trace.Wrap(err, "spec.env0: failed validation")
+		}
 	default:
 		return trace.BadParameter("unknown join method %q", p.Spec.JoinMethod)
 	}
@@ -501,6 +517,11 @@ func (p *ProvisionTokenV2) GetGithubRules() *ProvisionTokenSpecV2GitHub {
 	return p.Spec.GitHub
 }
 
+// GetGitlabRules will return the GitLab rules within this token.
+func (p *ProvisionTokenV2) GetGitlabRules() *ProvisionTokenSpecV2GitLab {
+	return p.Spec.GitLab
+}
+
 // GetAWSIIDTTL returns the TTL of EC2 IIDs
 func (p *ProvisionTokenV2) GetAWSIIDTTL() Duration {
 	return p.Spec.AWSIIDTTL
@@ -636,6 +657,12 @@ func (p *ProvisionTokenV2) GetSafeName() string {
 	return name
 }
 
+// GetAssignedScope always returns an empty string because a [ProvisionTokenV2] is always
+// unscoped
+func (p *ProvisionTokenV2) GetAssignedScope() string {
+	return ""
+}
+
 // String returns the human readable representation of a provisioning token.
 func (p ProvisionTokenV2) String() string {
 	expires := "never"
@@ -787,10 +814,34 @@ func (a *ProvisionTokenSpecV2Kubernetes) checkAndSetDefaults() error {
 		if a.StaticJWKS.JWKS == "" {
 			return trace.BadParameter("static_jwks.jwks: must be set when type is %q", KubernetesJoinTypeStaticJWKS)
 		}
+	case KubernetesJoinTypeOIDC:
+		if a.OIDC == nil {
+			return trace.BadParameter("oidc: must be set when types is %q", KubernetesJoinTypeOIDC)
+		}
+		if a.OIDC.Issuer == "" {
+			return trace.BadParameter("oidc.issuer: must be set when type is %q", KubernetesJoinTypeOIDC)
+		}
+
+		parsed, err := url.Parse(a.OIDC.Issuer)
+		if err != nil {
+			return trace.BadParameter("oidc.issuer: must be a valid URL")
+		}
+
+		if parsed.Scheme == "http" {
+			if !a.OIDC.InsecureAllowHTTPIssuer {
+				return trace.BadParameter("oidc.issuer: must be https:// unless insecure_allow_http_issuer is set")
+			}
+		} else if parsed.Scheme != "https" {
+			return trace.BadParameter("oidc.issuer: invalid URL scheme, must be https://")
+		}
 	default:
 		return trace.BadParameter(
 			"type: must be one of (%s), got %q",
-			utils.JoinStrings(JoinMethods, ", "),
+			utils.JoinStrings([]string{
+				string(KubernetesJoinTypeInCluster),
+				string(KubernetesJoinTypeStaticJWKS),
+				string(KubernetesJoinTypeOIDC),
+			}, ", "),
 			a.Type,
 		)
 	}
@@ -999,6 +1050,9 @@ func (a *ProvisionTokenSpecV2Oracle) checkAndSetDefaults() error {
 				i,
 			)
 		}
+		if len(rule.Instances) > 100 {
+			return trace.BadParameter("allow[%d]: maximum 100 instances may be set (found %d)", i, len(rule.Instances))
+		}
 	}
 	return nil
 }
@@ -1032,22 +1086,16 @@ func (a *ProvisionTokenSpecV2AzureDevops) checkAndSetDefaults() error {
 }
 
 func (a *ProvisionTokenSpecV2BoundKeypair) checkAndSetDefaults() error {
-	// Note: don't attempt to initialize onboarding - at least for now - as it
-	// has required keys. This behavior may be relaxed when we add
-	// server-generated joining secrets.
 	if a.Onboarding == nil {
-		return trace.BadParameter("spec.bound_keypair.onboarding is required")
-	}
-
-	if a.Onboarding.RegistrationSecret == "" && a.Onboarding.InitialPublicKey == "" {
-		return trace.BadParameter("at least one of [initial_join_secret, " +
-			"initial_public_key] is required in spec.bound_keypair.onboarding")
+		a.Onboarding = &ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{}
 	}
 
 	if a.Recovery == nil {
 		a.Recovery = &ProvisionTokenSpecV2BoundKeypair_RecoverySpec{}
 	}
 
+	// Limit must be >= 1 for the token to be useful. If zero, assume it's unset
+	// and provide a sane default.
 	if a.Recovery.Limit == 0 {
 		a.Recovery.Limit = 1
 	}
@@ -1057,3 +1105,21 @@ func (a *ProvisionTokenSpecV2BoundKeypair) checkAndSetDefaults() error {
 
 	return nil
 }
+
+func (a *ProvisionTokenSpecV2Env0) checkAndSetDefaults() error {
+	if len(a.Allow) == 0 {
+		return trace.BadParameter("the %q join method requires at least one token allow rule", JoinMethodEnv0)
+	}
+
+	for i, allowRule := range a.Allow {
+		if allowRule.OrganizationID == "" {
+			return trace.BadParameter("allow[%d]: organization_id must be set", i)
+		}
+
+		if allowRule.ProjectID == "" && allowRule.ProjectName == "" {
+			return trace.BadParameter("allow[%d]: at least one of ['project_id', 'project_name'] must be set", i)
+		}
+	}
+
+	return nil
+}
diff --git a/api/types/provisioning_test.go b/api/types/provisioning_test.go
index 8fcfe17e7e48e..f632fd689a828 100644
--- a/api/types/provisioning_test.go
+++ b/api/types/provisioning_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package types
 
 import (
+	"fmt"
 	"testing"
 	"time"
 
@@ -579,6 +580,79 @@ func TestProvisionTokenV2_CheckAndSetDefaults(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			desc: "kubernetes: oidc must have valid issuer",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodKubernetes,
+					Kubernetes: &ProvisionTokenSpecV2Kubernetes{
+						Type: KubernetesJoinTypeOIDC,
+						Allow: []*ProvisionTokenSpecV2Kubernetes_Rule{
+							{
+								ServiceAccount: "namespace:my-service-account",
+							},
+						},
+						OIDC: &ProvisionTokenSpecV2Kubernetes_OIDCConfig{
+							Issuer: "https://example.com",
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			desc: "kubernetes: http issuers not allowed without override",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodKubernetes,
+					Kubernetes: &ProvisionTokenSpecV2Kubernetes{
+						Type: KubernetesJoinTypeOIDC,
+						Allow: []*ProvisionTokenSpecV2Kubernetes_Rule{
+							{
+								ServiceAccount: "namespace:my-service-account",
+							},
+						},
+						OIDC: &ProvisionTokenSpecV2Kubernetes_OIDCConfig{
+							Issuer: "http://example.com",
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			desc: "kubernetes: http issuers are allowed with override",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodKubernetes,
+					Kubernetes: &ProvisionTokenSpecV2Kubernetes{
+						Type: KubernetesJoinTypeOIDC,
+						Allow: []*ProvisionTokenSpecV2Kubernetes_Rule{
+							{
+								ServiceAccount: "namespace:my-service-account",
+							},
+						},
+						OIDC: &ProvisionTokenSpecV2Kubernetes_OIDCConfig{
+							Issuer:                  "http://example.com",
+							InsecureAllowHTTPIssuer: true,
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
 		{
 			desc: "gitlab empty allow rules",
 			token: &ProvisionTokenV2{
@@ -1408,6 +1482,8 @@ func TestProvisionTokenV2_CheckAndSetDefaults(t *testing.T) {
 			},
 		},
 		{
+			// note: missing onboarding config is allowed; we'll generate some
+			// fields at creation/upsert time.
 			desc: "bound keypair missing onboarding config",
 			token: &ProvisionTokenV2{
 				Metadata: Metadata{
@@ -1419,6 +1495,177 @@ func TestProvisionTokenV2_CheckAndSetDefaults(t *testing.T) {
 					BoundKeypair: &ProvisionTokenSpecV2BoundKeypair{},
 				},
 			},
+			wantErr: false,
+		},
+		{
+			desc: "env0 success",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								OrganizationID:  "organization-id",
+								ProjectID:       "project-id",
+								ProjectName:     "project-name",
+								TemplateID:      "template-id",
+								TemplateName:    "template-name",
+								EnvironmentID:   "environment-id",
+								EnvironmentName: "environment-name",
+								WorkspaceName:   "workspace-name",
+								DeploymentType:  "deployment-type",
+								DeployerEmail:   "deployer-email",
+								Env0Tag:         "custom-tag",
+							},
+						},
+					},
+				},
+			},
+			expected: &ProvisionTokenV2{
+				Kind:    "token",
+				Version: "v2",
+				Metadata: Metadata{
+					Name:      "test",
+					Namespace: "default",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								OrganizationID:  "organization-id",
+								ProjectID:       "project-id",
+								ProjectName:     "project-name",
+								TemplateID:      "template-id",
+								TemplateName:    "template-name",
+								EnvironmentID:   "environment-id",
+								EnvironmentName: "environment-name",
+								WorkspaceName:   "workspace-name",
+								DeploymentType:  "deployment-type",
+								DeployerEmail:   "deployer-email",
+								Env0Tag:         "custom-tag",
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			desc: "env0 multiple rules - success",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								OrganizationID: "organization-id",
+								ProjectID:      "project-id",
+							},
+							{
+								OrganizationID: "organization-id",
+								ProjectName:    "project-name",
+							},
+						},
+					},
+				},
+			},
+			expected: &ProvisionTokenV2{
+				Kind:    "token",
+				Version: "v2",
+				Metadata: Metadata{
+					Name:      "test",
+					Namespace: "default",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								OrganizationID: "organization-id",
+								ProjectID:      "project-id",
+							},
+							{
+								OrganizationID: "organization-id",
+								ProjectName:    "project-name",
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			desc: "env0 missing organization",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								ProjectName:  "test",
+								TemplateName: "test",
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			desc: "env0 missing project",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodEnv0,
+					Env0: &ProvisionTokenSpecV2Env0{
+						Allow: []*ProvisionTokenSpecV2Env0_Rule{
+							{
+								OrganizationID: "test",
+								TemplateName:   "test",
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			desc: "oracle too many instance IDs",
+			token: &ProvisionTokenV2{
+				Metadata: Metadata{
+					Name: "test",
+				},
+				Spec: ProvisionTokenSpecV2{
+					Roles:      []SystemRole{RoleNode},
+					JoinMethod: JoinMethodOracle,
+					Oracle: &ProvisionTokenSpecV2Oracle{
+						Allow: []*ProvisionTokenSpecV2Oracle_Rule{
+							{
+								Tenancy:   "ocid.tenancy.oc1..mytentant",
+								Instances: genOCIDs(101),
+							},
+						},
+					},
+				},
+			},
 			wantErr: true,
 		},
 	}
@@ -1442,6 +1689,14 @@ func TestProvisionTokenV2_CheckAndSetDefaults(t *testing.T) {
 	}
 }
 
+func genOCIDs(count int) []string {
+	out := make([]string, count)
+	for i := range count {
+		out[i] = fmt.Sprintf("ocid.instance.oc1.region.%d", i)
+	}
+	return out
+}
+
 func TestProvisionTokenV2_GetSafeName(t *testing.T) {
 	t.Run("token join method (short)", func(t *testing.T) {
 		tok, err := NewProvisionToken("1234", []SystemRole{RoleNode}, time.Now())
diff --git a/api/types/resource.go b/api/types/resource.go
index 544f7b1f92b8c..ea7786c0b0775 100644
--- a/api/types/resource.go
+++ b/api/types/resource.go
@@ -92,6 +92,11 @@ func ResourceNames[R Resource, S ~[]R](s S) iter.Seq[string] {
 	return iterutils.Map(GetName, slices.Values(s))
 }
 
+// CompareResourceByNames compares resources by their names.
+func CompareResourceByNames[R Resource](a, b R) int {
+	return strings.Compare(a.GetName(), b.GetName())
+}
+
 // ResourceDetails includes details about the resource
 type ResourceDetails struct {
 	Hostname     string
@@ -534,9 +539,19 @@ func MatchKinds(resource ResourceWithLabels, kinds []string) bool {
 	if len(kinds) == 0 {
 		return true
 	}
+
 	resourceKind := resource.GetKind()
 	switch resourceKind {
-	case KindApp, KindSAMLIdPServiceProvider, KindIdentityCenterAccount:
+	case KindApp:
+		if slices.Contains(kinds, KindApp) {
+			return true
+		}
+
+		// MCP server resources are subkinds of app resources, but it is
+		// possible for certain APIs like ListUnifiedResources to use KindMCP as
+		// a kind filter.
+		return resource.GetSubKind() == SubKindMCP && slices.Contains(kinds, KindMCP)
+	case KindSAMLIdPServiceProvider, KindIdentityCenterAccount:
 		return slices.Contains(kinds, KindApp)
 	default:
 		return slices.Contains(kinds, resourceKind)
@@ -746,7 +761,7 @@ func GetRevision(v any) (string, error) {
 	case Resource:
 		return r.GetRevision(), nil
 	case ResourceMetadata:
-		return r.GetMetadata().Revision, nil
+		return r.GetMetadata().GetRevision(), nil
 	}
 	return "", trace.BadParameter("unable to determine revision from resource of type %T", v)
 }
diff --git a/api/types/resource_ids.go b/api/types/resource_ids.go
index 3c6289351947d..0ae351da078f0 100644
--- a/api/types/resource_ids.go
+++ b/api/types/resource_ids.go
@@ -32,15 +32,29 @@ func (id *ResourceID) CheckAndSetDefaults() error {
 	if len(id.Kind) == 0 {
 		return trace.BadParameter("ResourceID must include Kind")
 	}
-	if !slices.Contains(RequestableResourceKinds, id.Kind) {
-		return trace.BadParameter("Resource kind %q is invalid or unsupported", id.Kind)
-	}
 	if len(id.Name) == 0 {
 		return trace.BadParameter("ResourceID must include Name")
 	}
 
+	// TODO(@creack): DELETE IN v20.0.0. Here to maintain backwards compatibility with older clients.
+	if id.Kind != KindKubeNamespace && slices.Contains(KubernetesResourcesKinds, id.Kind) {
+		apiGroup := KubernetesResourcesV7KindGroups[id.Kind]
+		if slices.Contains(KubernetesClusterWideResourceKinds, id.Kind) {
+			id.Kind = AccessRequestPrefixKindKubeClusterWide + KubernetesResourcesKindsPlurals[id.Kind]
+		} else {
+			id.Kind = AccessRequestPrefixKindKubeNamespaced + KubernetesResourcesKindsPlurals[id.Kind]
+		}
+		if apiGroup != "" {
+			id.Kind += "." + apiGroup
+		}
+	}
+
+	if id.Kind != KindKubeNamespace && !slices.Contains(RequestableResourceKinds, id.Kind) && !strings.HasPrefix(id.Kind, AccessRequestPrefixKindKube) {
+		return trace.BadParameter("Resource kind %q is invalid or unsupported", id.Kind)
+	}
+
 	switch {
-	case slices.Contains(KubernetesResourcesKinds, id.Kind):
+	case id.Kind == KindKubeNamespace || strings.HasPrefix(id.Kind, AccessRequestPrefixKindKube):
 		return trace.Wrap(id.validateK8sSubResource())
 	case id.SubResourceName != "":
 		return trace.BadParameter("resource kind %q doesn't allow sub resources", id.Kind)
@@ -52,17 +66,17 @@ func (id *ResourceID) validateK8sSubResource() error {
 	if id.SubResourceName == "" {
 		return trace.BadParameter("resource of kind %q must include a subresource name", id.Kind)
 	}
-	isResourceNamespaceScoped := slices.Contains(KubernetesClusterWideResourceKinds, id.Kind)
+	isResourceClusterwide := id.Kind == KindKubeNamespace || slices.Contains(KubernetesClusterWideResourceKinds, id.Kind) || strings.HasPrefix(id.Kind, AccessRequestPrefixKindKubeClusterWide)
 	switch split := strings.Split(id.SubResourceName, "/"); {
-	case isResourceNamespaceScoped && len(split) != 1:
+	case isResourceClusterwide && len(split) != 1:
 		return trace.BadParameter("subresource %q must follow the following format: <name>", id.SubResourceName)
-	case isResourceNamespaceScoped && split[0] == "":
+	case isResourceClusterwide && split[0] == "":
 		return trace.BadParameter("subresource %q must include a non-empty name: <name>", id.SubResourceName)
-	case !isResourceNamespaceScoped && len(split) != 2:
+	case !isResourceClusterwide && len(split) != 2:
 		return trace.BadParameter("subresource %q must follow the following format: <namespace>/<name>", id.SubResourceName)
-	case !isResourceNamespaceScoped && split[0] == "":
+	case !isResourceClusterwide && split[0] == "":
 		return trace.BadParameter("subresource %q must include a non-empty namespace: <namespace>/<name>", id.SubResourceName)
-	case !isResourceNamespaceScoped && split[1] == "":
+	case !isResourceClusterwide && split[1] == "":
 		return trace.BadParameter("subresource %q must include a non-empty name: <namespace>/<name>", id.SubResourceName)
 	}
 
@@ -95,9 +109,10 @@ func ResourceIDFromString(raw string) (ResourceID, error) {
 		Kind:        parts[1],
 		Name:        parts[2],
 	}
+
 	switch {
-	case slices.Contains(KubernetesResourcesKinds, resourceID.Kind):
-		isResourceNamespaceScoped := slices.Contains(KubernetesClusterWideResourceKinds, resourceID.Kind)
+	case slices.Contains(KubernetesResourcesKinds, resourceID.Kind) || strings.HasPrefix(resourceID.Kind, AccessRequestPrefixKindKube) || resourceID.Kind == KindKubeNamespace:
+		isResourceClusterWide := resourceID.Kind == KindKubeNamespace || slices.Contains(KubernetesClusterWideResourceKinds, resourceID.Kind) || strings.HasPrefix(resourceID.Kind, AccessRequestPrefixKindKubeClusterWide)
 		// Kubernetes forbids slashes "/" in Namespaces and Pod names, so it's safe to
 		// explode the resourceID.Name and extract the last two entries as namespace
 		// and name.
@@ -107,10 +122,10 @@ func ResourceIDFromString(raw string) (ResourceID, error) {
 		// will fail because, for kind=pod, it's mandatory to present a non-empty
 		// namespace and name.
 		splits := strings.Split(resourceID.Name, "/")
-		if !isResourceNamespaceScoped && len(splits) >= 3 {
+		if !isResourceClusterWide && len(splits) >= 3 {
 			resourceID.Name = strings.Join(splits[:len(splits)-2], "/")
 			resourceID.SubResourceName = strings.Join(splits[len(splits)-2:], "/")
-		} else if isResourceNamespaceScoped && len(splits) >= 2 {
+		} else if isResourceClusterWide && len(splits) >= 2 {
 			resourceID.Name = strings.Join(splits[:len(splits)-1], "/")
 			resourceID.SubResourceName = strings.Join(splits[len(splits)-1:], "/")
 		}
diff --git a/api/types/resource_ids_test.go b/api/types/resource_ids_test.go
index 8b95e2df1c8d4..47a474b5cab95 100644
--- a/api/types/resource_ids_test.go
+++ b/api/types/resource_ids_test.go
@@ -107,317 +107,327 @@ func TestResourceIDs(t *testing.T) {
 			desc: "pod resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePod,
+				Kind:            "kube:ns:pods",
 				Name:            "cluster/1",
 				SubResourceName: "namespace/pod*",
 			}},
-			expected: `["/one/pod/cluster/1/namespace/pod*"]`,
+			expected: `["/one/kube:ns:pods/cluster/1/namespace/pod*"]`,
 		},
 		{
 			desc: "pod resource name",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePod,
+				Kind:            "kube:ns:pods",
 				Name:            "cluster",
 				SubResourceName: "namespace/pod*",
 			}},
-			expected: `["/one/pod/cluster/namespace/pod*"]`,
+			expected: `["/one/kube:ns:pods/cluster/namespace/pod*"]`,
 		},
 		{
 			desc: "pod resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePod,
+				Kind:            "kube:ns:pods",
 				Name:            "cluster",
 				SubResourceName: "/pod*",
 			}},
-			expected:         `["/one/pod/cluster//pod*"]`,
+			expected:         `["/one/kube:ns:pods/cluster//pod*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "pod resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubePod,
+				Kind:        "kube:ns:pods",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/pod/cluster"]`,
+			expected:         `["/one/kube:ns:pods/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "pod resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePod,
+				Kind:            "kube:ns:pods",
 				Name:            "cluster",
 				SubResourceName: "namespace/pod*",
 			}},
-			expected: `["/one/pod/cluster/namespace/pod*"]`,
+			expected: `["/one/kube:ns:pods/cluster/namespace/pod*"]`,
 		},
 		{
 			desc: "secret resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeSecret,
+				Kind:            "kube:ns:secrets",
 				Name:            "cluster",
 				SubResourceName: "/secret*",
 			}},
-			expected:         `["/one/secret/cluster//secret*"]`,
+			expected:         `["/one/kube:ns:secrets/cluster//secret*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "secret resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeSecret,
+				Kind:        "kube:ns:secrets",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/secret/cluster"]`,
+			expected:         `["/one/kube:ns:secrets/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "secret resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeSecret,
+				Kind:            "kube:ns:secrets",
 				Name:            "cluster",
 				SubResourceName: "namespace/secret*",
 			}},
-			expected: `["/one/secret/cluster/namespace/secret*"]`,
+			expected: `["/one/kube:ns:secrets/cluster/namespace/secret*"]`,
 		},
 		{
 			desc: "configmap resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeConfigmap,
+				Kind:            "kube:ns:configmaps",
 				Name:            "cluster",
 				SubResourceName: "/configmap*",
 			}},
-			expected:         `["/one/configmap/cluster//configmap*"]`,
+			expected:         `["/one/kube:ns:configmaps/cluster//configmap*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "configmap resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeConfigmap,
+				Kind:        "kube:ns:configmaps",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/configmap/cluster"]`,
+			expected:         `["/one/kube:ns:configmaps/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "configmap resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeConfigmap,
+				Kind:            "kube:ns:configmaps",
 				Name:            "cluster",
 				SubResourceName: "namespace/configmap*",
 			}},
-			expected: `["/one/configmap/cluster/namespace/configmap*"]`,
+			expected: `["/one/kube:ns:configmaps/cluster/namespace/configmap*"]`,
 		},
 		{
 			desc: "service resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeService,
+				Kind:            "kube:ns:services",
 				Name:            "cluster",
 				SubResourceName: "/service*",
 			}},
-			expected:         `["/one/service/cluster//service*"]`,
+			expected:         `["/one/kube:ns:services/cluster//service*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "service resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeService,
+				Kind:        "kube:ns:services",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/service/cluster"]`,
+			expected:         `["/one/kube:ns:services/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "service resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeService,
+				Kind:            "kube:ns:services",
 				Name:            "cluster",
 				SubResourceName: "namespace/service*",
 			}},
-			expected: `["/one/service/cluster/namespace/service*"]`,
+			expected: `["/one/kube:ns:services/cluster/namespace/service*"]`,
 		},
 		{
 			desc: "service_account resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeServiceAccount,
+				Kind:            "kube:ns:serviceaccounts",
 				Name:            "cluster",
 				SubResourceName: "/service_account*",
 			}},
-			expected:         `["/one/serviceaccount/cluster//service_account*"]`,
+			expected:         `["/one/kube:ns:serviceaccounts/cluster//service_account*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "service_account resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeServiceAccount,
+				Kind:        "kube:ns:serviceaccounts",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/serviceaccount/cluster"]`,
+			expected:         `["/one/kube:ns:serviceaccounts/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "service_account resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeServiceAccount,
+				Kind:            "kube:ns:serviceaccounts",
 				Name:            "cluster",
 				SubResourceName: "namespace/service_account*",
 			}},
-			expected: `["/one/serviceaccount/cluster/namespace/service_account*"]`,
+			expected: `["/one/kube:ns:serviceaccounts/cluster/namespace/service_account*"]`,
 		},
 		{
 			desc: "persistent_volume_claim resource name with missing namespace",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePersistentVolumeClaim,
+				Kind:            "kube:ns:persistentvolumeclaims",
 				Name:            "cluster",
 				SubResourceName: "/persistent_volume_claim*",
 			}},
-			expected:         `["/one/persistentvolumeclaim/cluster//persistent_volume_claim*"]`,
+			expected:         `["/one/kube:ns:persistentvolumeclaims/cluster//persistent_volume_claim*"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "persistent_volume_claim resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubePersistentVolumeClaim,
+				Kind:        "kube:ns:persistentvolumeclaims",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/persistentvolumeclaim/cluster"]`,
+			expected:         `["/one/kube:ns:persistentvolumeclaims/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "namespace resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeNamespace,
+				Kind:        "kube:cw:namespaces",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/namespace/cluster"]`,
+			expected:         `["/one/kube:cw:namespaces/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "namespace resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeNamespace,
+				Kind:            "kube:cw:namespaces",
 				Name:            "cluster",
 				SubResourceName: "namespace*",
 			}},
-			expected: `["/one/namespace/cluster/namespace*"]`,
+			expected: `["/one/kube:cw:namespaces/cluster/namespace*"]`,
 		},
 		{
 			desc: "kube_node resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeNode,
+				Kind:        "kube:cw:nodes",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/kube_node/cluster"]`,
+			expected:         `["/one/kube:cw:nodes/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "kube_node resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeNode,
+				Kind:            "kube:cw:nodes",
 				Name:            "cluster",
 				SubResourceName: "kube_node*",
 			}},
-			expected: `["/one/kube_node/cluster/kube_node*"]`,
+			expected: `["/one/kube:cw:nodes/cluster/kube_node*"]`,
 		},
 		{
 			desc: "persistent_volume resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubePersistentVolume,
+				Kind:        "kube:cw:persistentvolumes",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/persistentvolume/cluster"]`,
+			expected:         `["/one/kube:cw:persistentvolumes/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "persistent_volume resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubePersistentVolume,
+				Kind:            "kube:cw:persistentvolumes",
 				Name:            "cluster",
 				SubResourceName: "persistent_volume*",
 			}},
-			expected: `["/one/persistentvolume/cluster/persistent_volume*"]`,
+			expected: `["/one/kube:cw:persistentvolumes/cluster/persistent_volume*"]`,
 		},
 		{
 			desc: "cluster_role resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeClusterRole,
+				Kind:        "kube:cw:clusterroles.rbac.authorization.k8s.io",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/clusterrole/cluster"]`,
+			expected:         `["/one/kube:cw:clusterroles.rbac.authorization.k8s.io/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "cluster_role resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeClusterRole,
+				Kind:            "kube:cw:clusterroles.rbac.authorization.k8s.io",
 				Name:            "cluster",
 				SubResourceName: "cluster_role*",
 			}},
-			expected: `["/one/clusterrole/cluster/cluster_role*"]`,
+			expected: `["/one/kube:cw:clusterroles.rbac.authorization.k8s.io/cluster/cluster_role*"]`,
 		},
 		{
 			desc: "cluster_role_binding resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeClusterRoleBinding,
+				Kind:        "kube:cw:clusterrolebindings.rbac.authorization.k8s.io",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/clusterrolebinding/cluster"]`,
+			expected:         `["/one/kube:cw:clusterrolebindings.rbac.authorization.k8s.io/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "cluster_role_binding resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeClusterRoleBinding,
+				Kind:            "kube:cw:clusterrolebindings.rbac.authorization.k8s.io",
 				Name:            "cluster",
 				SubResourceName: "cluster_role_binding*",
 			}},
-			expected: `["/one/clusterrolebinding/cluster/cluster_role_binding*"]`,
+			expected: `["/one/kube:cw:clusterrolebindings.rbac.authorization.k8s.io/cluster/cluster_role_binding*"]`,
 		},
 		{
 			desc: "certificate_signing_request resource name with missing namespace and pod name",
 			in: []ResourceID{{
 				ClusterName: "one",
-				Kind:        KindKubeCertificateSigningRequest,
+				Kind:        "kube:cw:certificatesigningrequests.certificates.k8s.io",
 				Name:        "cluster",
 			}},
-			expected:         `["/one/certificatesigningrequest/cluster"]`,
+			expected:         `["/one/kube:cw:certificatesigningrequests.certificates.k8s.io/cluster"]`,
 			expectParseError: true,
 		},
 		{
 			desc: "certificate_signing_request resource name in cluster with slash",
 			in: []ResourceID{{
 				ClusterName:     "one",
-				Kind:            KindKubeCertificateSigningRequest,
+				Kind:            "kube:cw:certificatesigningrequests.certificates.k8s.io",
 				Name:            "cluster",
 				SubResourceName: "certificate_signing_request*",
 			}},
-			expected: `["/one/certificatesigningrequest/cluster/certificate_signing_request*"]`,
+			expected: `["/one/kube:cw:certificatesigningrequests.certificates.k8s.io/cluster/certificate_signing_request*"]`,
+		},
+		{
+			desc: "full kube namespace access",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:*.*", // kind: *, api group: *.
+				Name:            "cluster",
+				SubResourceName: "default/*", // namespace: default, resource name: *.
+			}},
+			expected: `["/one/kube:ns:*.*/cluster/default/*"]`,
 		},
 	}
 	for _, tc := range testCases {
@@ -452,3 +462,341 @@ func TestResourceIDs(t *testing.T) {
 		})
 	}
 }
+
+// TODO(@creack): DELETE IN v20.0.0 when we no longer support legacy kube kinds.
+func TestLegacyKubeResourceIDs(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		expect           []ResourceID
+		in               string
+		expectParseError bool
+	}{
+		{
+			desc: "pod resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:pods",
+				Name:            "cluster/1",
+				SubResourceName: "namespace/pod*",
+			}},
+			in: `["/one/pod/cluster/1/namespace/pod*"]`,
+		},
+		{
+			desc: "pod resource name",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:pods",
+				Name:            "cluster",
+				SubResourceName: "namespace/pod*",
+			}},
+			in: `["/one/pod/cluster/namespace/pod*"]`,
+		},
+		{
+			desc: "pod resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:pods",
+				Name:            "cluster",
+				SubResourceName: "/pod*",
+			}},
+			in:               `["/one/pod/cluster//pod*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "pod resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:pods",
+				Name:        "cluster",
+			}},
+			in:               `["/one/pod/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "pod resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:pods",
+				Name:            "cluster",
+				SubResourceName: "namespace/pod*",
+			}},
+			in: `["/one/pod/cluster/namespace/pod*"]`,
+		},
+		{
+			desc: "secret resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:secrets",
+				Name:            "cluster",
+				SubResourceName: "/secret*",
+			}},
+			in:               `["/one/secret/cluster//secret*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "secret resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:secrets",
+				Name:        "cluster",
+			}},
+			in:               `["/one/secret/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "secret resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:secrets",
+				Name:            "cluster",
+				SubResourceName: "namespace/secret*",
+			}},
+			in: `["/one/secret/cluster/namespace/secret*"]`,
+		},
+		{
+			desc: "configmap resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:configmaps",
+				Name:            "cluster",
+				SubResourceName: "/configmap*",
+			}},
+			in:               `["/one/configmap/cluster//configmap*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "configmap resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:configmaps",
+				Name:        "cluster",
+			}},
+			in:               `["/one/configmap/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "configmap resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:configmaps",
+				Name:            "cluster",
+				SubResourceName: "namespace/configmap*",
+			}},
+			in: `["/one/configmap/cluster/namespace/configmap*"]`,
+		},
+		{
+			desc: "service resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:services",
+				Name:            "cluster",
+				SubResourceName: "/service*",
+			}},
+			in:               `["/one/service/cluster//service*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:services",
+				Name:        "cluster",
+			}},
+			in:               `["/one/service/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:services",
+				Name:            "cluster",
+				SubResourceName: "namespace/service*",
+			}},
+			in: `["/one/service/cluster/namespace/service*"]`,
+		},
+		{
+			desc: "service_account resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:serviceaccounts",
+				Name:            "cluster",
+				SubResourceName: "/service_account*",
+			}},
+			in:               `["/one/serviceaccount/cluster//service_account*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service_account resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:serviceaccounts",
+				Name:        "cluster",
+			}},
+			in:               `["/one/serviceaccount/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service_account resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:serviceaccounts",
+				Name:            "cluster",
+				SubResourceName: "namespace/service_account*",
+			}},
+			in: `["/one/serviceaccount/cluster/namespace/service_account*"]`,
+		},
+		{
+			desc: "persistent_volume_claim resource name with missing namespace",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:ns:persistentvolumeclaims",
+				Name:            "cluster",
+				SubResourceName: "/persistent_volume_claim*",
+			}},
+			in:               `["/one/persistentvolumeclaim/cluster//persistent_volume_claim*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "persistent_volume_claim resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:ns:persistentvolumeclaims",
+				Name:        "cluster",
+			}},
+			in:               `["/one/persistentvolumeclaim/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "namespace resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "namespaces",
+				Name:        "cluster",
+			}},
+			in:               `["/one/namespace/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "namespace resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "namespace",
+				Name:            "cluster",
+				SubResourceName: "namespace*",
+			}},
+			in: `["/one/namespace/cluster/namespace*"]`,
+		},
+		{
+			desc: "kube_node resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:cw:nodes",
+				Name:        "cluster",
+			}},
+			in:               `["/one/kube_node/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "kube_node resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:cw:nodes",
+				Name:            "cluster",
+				SubResourceName: "kube_node*",
+			}},
+			in: `["/one/kube_node/cluster/kube_node*"]`,
+		},
+		{
+			desc: "persistent_volume resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:cw:persistentvolumes",
+				Name:        "cluster",
+			}},
+			in:               `["/one/persistentvolume/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "persistent_volume resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:cw:persistentvolumes",
+				Name:            "cluster",
+				SubResourceName: "persistent_volume*",
+			}},
+			in: `["/one/persistentvolume/cluster/persistent_volume*"]`,
+		},
+		{
+			desc: "cluster_role resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:cw:clusterroles.rbac.authorization.k8s.io",
+				Name:        "cluster",
+			}},
+			in:               `["/one/clusterrole/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "cluster_role resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:cw:clusterroles.rbac.authorization.k8s.io",
+				Name:            "cluster",
+				SubResourceName: "cluster_role*",
+			}},
+			in: `["/one/clusterrole/cluster/cluster_role*"]`,
+		},
+		{
+			desc: "cluster_role_binding resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:cw:clusterrolebindings.rbac.authorization.k8s.io",
+				Name:        "cluster",
+			}},
+			in:               `["/one/clusterrolebinding/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "cluster_role_binding resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:cw:clusterrolebindings.rbac.authorization.k8s.io",
+				Name:            "cluster",
+				SubResourceName: "cluster_role_binding*",
+			}},
+			in: `["/one/clusterrolebinding/cluster/cluster_role_binding*"]`,
+		},
+		{
+			desc: "certificate_signing_request resource name with missing namespace and pod name",
+			expect: []ResourceID{{
+				ClusterName: "one",
+				Kind:        "kube:cw:certificatesigningrequests.certificates.k8s.io",
+				Name:        "cluster",
+			}},
+			in:               `["/one/certificatesigningrequest/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "certificate_signing_request resource name in cluster with slash",
+			expect: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            "kube:cw:certificatesigningrequests.certificates.k8s.io",
+				Name:            "cluster",
+				SubResourceName: "certificate_signing_request*",
+			}},
+			in: `["/one/certificatesigningrequest/cluster/certificate_signing_request*"]`,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			parsed, err := ResourceIDsFromString(tc.in)
+			if tc.expectParseError {
+				require.Error(t, err, "expected to get an error parsing resource IDs")
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.expect, parsed, "parsed resource IDs do not match the originals")
+		})
+	}
+}
diff --git a/api/types/role.go b/api/types/role.go
index c31d7d36892d9..476afc7a531f2 100644
--- a/api/types/role.go
+++ b/api/types/role.go
@@ -152,6 +152,8 @@ type Role interface {
 	// SetKubeResources configures the Kubernetes Resources for the RoleConditionType.
 	SetKubeResources(rct RoleConditionType, pods []KubernetesResource)
 
+	// GetRequestKubernetesResources returns the request Kubernetes resources.
+	GetRequestKubernetesResources(rct RoleConditionType) []RequestKubernetesResource
 	// SetRequestKubernetesResources sets the request kubernetes resources.
 	SetRequestKubernetesResources(rct RoleConditionType, resources []RequestKubernetesResource)
 
@@ -298,6 +300,12 @@ type Role interface {
 	// GetIdentityCenterAccountAssignments sets the allow or deny Account
 	// Assignments for the role
 	SetIdentityCenterAccountAssignments(RoleConditionType, []IdentityCenterAccountAssignment)
+
+	// GetMCPPermissions returns the allow or deny MCP permissions.
+	GetMCPPermissions(RoleConditionType) *MCPPermissions
+	// SetMCPPermissions sets the allow or deny MCP permissions.
+	SetMCPPermissions(RoleConditionType, *MCPPermissions)
+
 	// Clone creats a copy of the role.
 	Clone() Role
 }
@@ -464,7 +472,12 @@ func (r *RoleV6) SetKubeGroups(rct RoleConditionType, groups []string) {
 // access to.
 func (r *RoleV6) GetKubeResources(rct RoleConditionType) []KubernetesResource {
 	if rct == Allow {
-		return r.convertAllowKubernetesResourcesBetweenRoleVersions(r.Spec.Allow.KubernetesResources)
+		out := r.convertAllowKubernetesResourcesBetweenRoleVersions(r.Spec.Allow.KubernetesResources)
+		// We need to support `kubectl auth can-i` as we prompt the user to use this when they get an access denied error.
+		// Inject a selfsubjectaccessreviews resource to allow for it. It can still be explicitly denied by the role if
+		// set in the `deny` section.
+		out = append(out, KubernetesResourceSelfSubjectAccessReview)
+		return out
 	}
 	return r.convertKubernetesResourcesBetweenRoleVersions(r.Spec.Deny.KubernetesResources)
 }
@@ -476,6 +489,8 @@ func (r *RoleV6) GetKubeResources(rct RoleConditionType) []KubernetesResource {
 // For roles v8, it returns the list as it is.
 //
 // For roles <=v7, it maps the legacy teleport Kinds to k8s plurals and sets the APIGroup to wildcard.
+//
+// Must be in sync with RoleV6.convertRequestKubernetesResourcesBetweenRoleVersions.
 func (r *RoleV6) convertKubernetesResourcesBetweenRoleVersions(resources []KubernetesResource) []KubernetesResource {
 	switch r.Version {
 	case V8:
@@ -490,7 +505,7 @@ func (r *RoleV6) convertKubernetesResourcesBetweenRoleVersions(resources []Kuber
 			if r.Kind == KindKubeNamespace {
 				r.Kind = Wildcard
 				if r.Name == Wildcard {
-					r.Namespace = "^" + Wildcard + "$"
+					r.Namespace = "^.+$"
 				} else {
 					r.Namespace = r.Name
 				}
@@ -509,9 +524,11 @@ func (r *RoleV6) convertKubernetesResourcesBetweenRoleVersions(resources []Kuber
 				r.Namespace = ""
 			}
 			if k, ok := KubernetesResourcesKindsPlurals[r.Kind]; ok { // Can be empty if the kind is a wildcard.
+				r.APIGroup = KubernetesResourcesV7KindGroups[r.Kind]
 				r.Kind = k
+			} else {
+				r.APIGroup = Wildcard
 			}
-			r.APIGroup = Wildcard
 			v7resources[i] = r
 			if r.Kind == Wildcard { // If we have a wildcard, inject the clusterwide resources.
 				for _, elem := range KubernetesClusterWideResourceKinds {
@@ -574,13 +591,16 @@ func (r *RoleV6) convertAllowKubernetesResourcesBetweenRoleVersions(resources []
 			v6resources := slices.Clone(resources)
 			for i, r := range v6resources {
 				if k, ok := KubernetesResourcesKindsPlurals[r.Kind]; ok {
+					r.APIGroup = KubernetesResourcesV7KindGroups[r.Kind]
 					r.Kind = k
+				} else {
+					r.APIGroup = Wildcard
 				}
-				r.APIGroup = Wildcard
 				v6resources[i] = r
 			}
 
 			for _, resource := range KubernetesResourcesKinds { // Iterate over the list to have deterministic order.
+				group := KubernetesResourcesV7KindGroups[resource]
 				resource = KubernetesResourcesKindsPlurals[resource]
 				// Ignore Pod resources for older roles because Pods were already supported
 				// so we don't need to keep backwards compatibility for them.
@@ -589,7 +609,7 @@ func (r *RoleV6) convertAllowKubernetesResourcesBetweenRoleVersions(resources []
 				if resource == "pods" || resource == "namespaces" {
 					continue
 				}
-				v6resources = append(v6resources, KubernetesResource{Kind: resource, Name: Wildcard, Namespace: Wildcard, Verbs: []string{Wildcard}, APIGroup: Wildcard})
+				v6resources = append(v6resources, KubernetesResource{Kind: resource, Name: Wildcard, Namespace: Wildcard, Verbs: []string{Wildcard}, APIGroup: group})
 			}
 			return v6resources
 		}
@@ -607,6 +627,20 @@ func (r *RoleV6) SetKubeResources(rct RoleConditionType, pods []KubernetesResour
 	}
 }
 
+// GetRequestKubernetesResources returns the upgraded request kubernetes resources.
+func (r *RoleV6) GetRequestKubernetesResources(rct RoleConditionType) []RequestKubernetesResource {
+	if rct == Allow {
+		if r.Spec.Allow.Request == nil {
+			return nil
+		}
+		return r.convertRequestKubernetesResourcesBetweenRoleVersions(r.Spec.Allow.Request.KubernetesResources)
+	}
+	if r.Spec.Deny.Request == nil {
+		return nil
+	}
+	return r.convertRequestKubernetesResourcesBetweenRoleVersions(r.Spec.Deny.Request.KubernetesResources)
+}
+
 // SetRequestKubernetesResources sets the request kubernetes resources.
 func (r *RoleV6) SetRequestKubernetesResources(rct RoleConditionType, resources []RequestKubernetesResource) {
 	roleConditions := &r.Spec.Allow
@@ -650,6 +684,40 @@ func (r *RoleV6) GetAccessRequestConditions(rct RoleConditionType) AccessRequest
 	return *cond
 }
 
+// convertRequestKubernetesResourcesBetweenRoleVersions converts Access Request Kubernetes resources between role versions.
+//
+// This is required to keep compatibility between role versions to avoid breaking changes
+// when using an older role version.
+//
+// For roles v8, it returns the list as it is.
+//
+// For roles <=v7, it maps the legacy teleport Kinds to k8s plurals and sets the APIGroup to wildcard.
+//
+// Must be in sync with RoleV6.convertDenyKubernetesResourcesBetweenRoleVersions.
+func (r *RoleV6) convertRequestKubernetesResourcesBetweenRoleVersions(resources []RequestKubernetesResource) []RequestKubernetesResource {
+	if len(resources) == 0 {
+		return nil
+	}
+	switch r.Version {
+	case V8:
+		return resources
+	default:
+		v7resources := slices.Clone(resources)
+		for i, r := range v7resources {
+			if k, ok := KubernetesResourcesKindsPlurals[r.Kind]; ok { // Can be empty if the kind is a wildcard.
+				r.APIGroup = KubernetesResourcesV7KindGroups[r.Kind]
+				r.Kind = k
+			} else if r.Kind == KindKubeNamespace {
+				r.Kind = "namespaces"
+			} else {
+				r.APIGroup = Wildcard
+			}
+			v7resources[i] = r
+		}
+		return v7resources
+	}
+}
+
 // SetAccessRequestConditions sets allow/deny conditions for access requests.
 func (r *RoleV6) SetAccessRequestConditions(rct RoleConditionType, cond AccessRequestConditions) {
 	if rct == Allow {
@@ -1797,13 +1865,20 @@ func ProcessNamespace(namespace string) string {
 
 // WhereExpr is a tree like structure representing a `where` (sub-)expression.
 type WhereExpr struct {
-	Field            string
-	Literal          interface{}
-	And, Or          WhereExpr2
-	Not              *WhereExpr
-	Equals, Contains WhereExpr2
+	Field                    string
+	Literal                  interface{}
+	And, Or                  WhereExpr2
+	Not                      *WhereExpr
+	Equals, Contains         WhereExpr2
+	ContainsAny, ContainsAll WhereExpr2
+	CanView                  *WhereNoExpr
+	MapRef                   *WhereExpr2
 }
 
+// WhereNoExpr is an empty `where` expression used by
+// functions without arguments like `can_view()`.
+type WhereNoExpr struct{}
+
 // WhereExpr2 is a pair of `where` (sub-)expressions.
 type WhereExpr2 struct {
 	L, R *WhereExpr
@@ -1832,6 +1907,18 @@ func (e WhereExpr) String() string {
 	if e.Contains.L != nil && e.Contains.R != nil {
 		return fmt.Sprintf("contains(%s, %s)", e.Contains.L, e.Contains.R)
 	}
+	if e.ContainsAny.L != nil && e.ContainsAny.R != nil {
+		return fmt.Sprintf("contains_any(%s, %s)", e.ContainsAny.L, e.ContainsAny.R)
+	}
+	if e.ContainsAll.L != nil && e.ContainsAll.R != nil {
+		return fmt.Sprintf("contains_all(%s, %s)", e.ContainsAll.L, e.ContainsAll.R)
+	}
+	if e.CanView != nil {
+		return "can_view()"
+	}
+	if e.MapRef != nil && e.MapRef.L != nil && e.MapRef.R != nil {
+		return fmt.Sprintf("%s[%q]", e.MapRef.L, e.MapRef.R)
+	}
 	return ""
 }
 
@@ -1916,7 +2003,7 @@ func (r *RoleV6) GetRoleConditions(rct RoleConditionType) RoleConditions {
 	return roleConditions
 }
 
-// GetRoleConditions returns the role conditions for the role.
+// GetRequestReasonMode returns the request reason mode for the role.
 func (r *RoleV6) GetRequestReasonMode(rct RoleConditionType) RequestReasonMode {
 	roleConditions := r.GetRoleConditions(rct)
 	if roleConditions.Request == nil || roleConditions.Request.Reason == nil {
@@ -1981,12 +2068,12 @@ func validateKubeResources(roleVersion string, kubeResources []KubernetesResourc
 			}
 		}
 
-		// Only Pod resources are supported in role version <=V6.
-		// This is mandatory because we must append the other resources to the
-		// kubernetes resources.
 		switch roleVersion {
 		// Teleport does not support role versions < v3.
 		case V6, V5, V4, V3:
+			// Only Pod resources are supported in role version <=V6.
+			// This is mandatory because we must append the other resources to the
+			// kubernetes resources.
 			if kubeResource.Kind != KindKubePod {
 				return trace.BadParameter("KubernetesResource kind %q is not supported in role version %q. Upgrade the role version to %q", kubeResource.Kind, roleVersion, V8)
 			}
@@ -2023,7 +2110,7 @@ func validateKubeResources(roleVersion string, kubeResources []KubernetesResourc
 			}
 			// Best effort attempt to validate if the namespace field is needed.
 			if kubeResource.Namespace == "" {
-				if _, ok := kubernetesNamespacedResourceKinds[groupKind{kubeResource.APIGroup, kubeResource.Kind}]; ok {
+				if apiGroup, ok := kubernetesNamespacedResourceKinds[kubeResource.Kind]; ok && apiGroup == kubeResource.APIGroup {
 					return trace.BadParameter("KubernetesResource %q must include Namespace", kubeResource.Kind)
 				}
 			}
@@ -2037,26 +2124,50 @@ func validateKubeResources(roleVersion string, kubeResources []KubernetesResourc
 }
 
 // validateRequestKubeResources validates each kubeResources entry for `allow.request.kubernetes_resources` field.
-// Currently the only supported field for this particular field is:
-//   - Kind (belonging to KubernetesResourcesKinds)
+// Currently the only supported field for this particular field are:
+//   - Kind
+//   - APIGroup
 //
 // Mimics types.KubernetesResource data model, but opted to create own type as we don't support other fields yet.
-//
-// TODO(@creack): Handle rolev8 kind/group to support CRDs. Still use the teleport kinds for now.
 func validateRequestKubeResources(roleVersion string, kubeResources []RequestKubernetesResource) error {
 	for _, kubeResource := range kubeResources {
-		if !slices.Contains(KubernetesResourcesKinds, kubeResource.Kind) && kubeResource.Kind != Wildcard {
-			return trace.BadParameter("request.kubernetes_resource kind %q is invalid or unsupported; Supported: %v", kubeResource.Kind, append([]string{Wildcard}, KubernetesResourcesKinds...))
-		}
-
-		// Only Pod resources are supported in role version <=V6.
-		// This is mandatory because we must append the other resources to the
-		// kubernetes resources.
 		switch roleVersion {
+		case V8:
+			if kubeResource.Kind == "" {
+				return trace.BadParameter("request.kubernetes_resource kind is required in role version %q", roleVersion)
+			}
+			// If we have a kind that match a role v7 one, check the api group.
+			if slices.Contains(KubernetesResourcesKinds, kubeResource.Kind) {
+				// If the api group is a wildcard or match v7, then it is mostly definitely a mistake, reject the role.
+				if kubeResource.APIGroup == Wildcard || kubeResource.APIGroup == KubernetesResourcesV7KindGroups[kubeResource.Kind] {
+					return trace.BadParameter("request.kubernetes_resource kind %q is invalid. Please use plural name for role version %q", kubeResource.Kind, roleVersion)
+				}
+			}
+			// Only allow empty string for known core resources.
+			if kubeResource.APIGroup == "" {
+				if _, ok := KubernetesCoreResourceKinds[kubeResource.Kind]; !ok {
+					return trace.BadParameter("request.kubernetes_resource api_group is required for resource %q in role version %q", kubeResource.Kind, roleVersion)
+				}
+			}
+		case V7:
+			if kubeResource.APIGroup != "" {
+				return trace.BadParameter("request.kubernetes_resource api_group is not supported in role version %q. Upgrade the role version to %q", roleVersion, V8)
+			}
+			if !slices.Contains(KubernetesResourcesKinds, kubeResource.Kind) && kubeResource.Kind != Wildcard {
+				return trace.BadParameter("request.kubernetes_resource kind %q is invalid or unsupported in role version %q; Supported: %v",
+					kubeResource.Kind, roleVersion, append([]string{Wildcard}, KubernetesResourcesKinds...))
+			}
 		// Teleport does not support role versions < v3.
 		case V6, V5, V4, V3:
+			if kubeResource.APIGroup != "" {
+				return trace.BadParameter("request.kubernetes_resource api_group is not supported in role version %q. Upgrade the role version to %q", roleVersion, V8)
+			}
+			// Only Pod resources are supported in role version <=V6.
+			// This is mandatory because we must append the other resources to the
+			// kubernetes resources.
 			if kubeResource.Kind != KindKubePod {
-				return trace.BadParameter("request.kubernetes_resources kind %q is not supported in role version %q. Upgrade the role version to %q", kubeResource.Kind, roleVersion, V8)
+				return trace.BadParameter("request.kubernetes_resources kind %q is not supported in role version %q. Upgrade the role version to %q",
+					kubeResource.Kind, roleVersion, V8)
 			}
 		}
 	}
@@ -2065,8 +2176,8 @@ func validateRequestKubeResources(roleVersion string, kubeResources []RequestKub
 
 // ClusterResource returns the resource name in the following format
 // <namespace>/<name>.
-func (k *KubernetesResource) ClusterResource() string {
-	return path.Join(k.Namespace, k.Name)
+func (m *KubernetesResource) ClusterResource() string {
+	return path.Join(m.Namespace, m.Name)
 }
 
 // IsEmpty will return true if the condition is empty.
@@ -2275,6 +2386,23 @@ func (r *RoleV6) SetIdentityCenterAccountAssignments(rct RoleConditionType, assi
 	cond.AccountAssignments = assignments
 }
 
+// GetMCPPermissions returns the allow or deny MCP permissions.
+func (r *RoleV6) GetMCPPermissions(rct RoleConditionType) *MCPPermissions {
+	if rct == Allow {
+		return r.Spec.Allow.MCP
+	}
+	return r.Spec.Deny.MCP
+}
+
+// SetMCPPermissions sets the allow or deny MCP permissions.
+func (r *RoleV6) SetMCPPermissions(rct RoleConditionType, perms *MCPPermissions) {
+	if rct == Allow {
+		r.Spec.Allow.MCP = perms
+	} else {
+		r.Spec.Deny.MCP = perms
+	}
+}
+
 func (r *RoleV6) Clone() Role {
 	return utils.CloneProtoMsg(r)
 }
diff --git a/api/types/role_test.go b/api/types/role_test.go
index b7955781add08..6007177d61425 100644
--- a/api/types/role_test.go
+++ b/api/types/role_test.go
@@ -267,6 +267,12 @@ func TestRole_GetKubeResources(t *testing.T) {
 						Name:      "test",
 						Verbs:     []string{Wildcard},
 					},
+					{
+						Kind:      KindKubeJob,
+						Namespace: "test",
+						Name:      "test",
+						Verbs:     []string{Wildcard},
+					},
 				},
 			},
 			wantDeny: []KubernetesResource{
@@ -275,7 +281,14 @@ func TestRole_GetKubeResources(t *testing.T) {
 					Namespace: "test",
 					Name:      "test",
 					Verbs:     []string{Wildcard},
-					APIGroup:  Wildcard,
+					APIGroup:  "",
+				},
+				{
+					Kind:      "jobs",
+					Namespace: "test",
+					Name:      "test",
+					Verbs:     []string{Wildcard},
+					APIGroup:  "batch",
 				},
 			},
 			assertErrorCreation: require.NoError,
@@ -306,6 +319,11 @@ func TestRole_GetKubeResources(t *testing.T) {
 						Namespace: "test",
 						Name:      "test",
 					},
+					{
+						Kind:      KindKubeDeployment,
+						Namespace: "test",
+						Name:      "test",
+					},
 				},
 			},
 			assertErrorCreation: require.NoError,
@@ -314,7 +332,13 @@ func TestRole_GetKubeResources(t *testing.T) {
 					Kind:      "pods",
 					Namespace: "test",
 					Name:      "test",
-					APIGroup:  Wildcard,
+					APIGroup:  "",
+				},
+				{
+					Kind:      "deployments",
+					Namespace: "test",
+					Name:      "test",
+					APIGroup:  "apps",
 				},
 			},
 		},
@@ -353,7 +377,7 @@ func TestRole_GetKubeResources(t *testing.T) {
 					Kind:      "pods",
 					Namespace: "test",
 					Name:      "test",
-					APIGroup:  Wildcard,
+					APIGroup:  "",
 				},
 			},
 		},
@@ -553,7 +577,7 @@ func TestRole_GetKubeResources(t *testing.T) {
 					Namespace: "test",
 					Name:      "test",
 					Verbs:     []string{Wildcard},
-					APIGroup:  Wildcard,
+					APIGroup:  "",
 				},
 			},
 				appendV7KubeResources()...),
@@ -602,7 +626,7 @@ func TestRole_GetKubeResources(t *testing.T) {
 					Namespace: "test",
 					Name:      "test",
 					Verbs:     []string{Wildcard},
-					APIGroup:  Wildcard,
+					APIGroup:  "",
 				},
 			},
 				appendV7KubeResources()...),
@@ -661,6 +685,7 @@ func TestRole_GetKubeResources(t *testing.T) {
 			}
 			if tt.wantDeny == nil {
 				got := r.GetKubeResources(Allow)
+				tt.wantAllow = append(tt.wantAllow, KubernetesResourceSelfSubjectAccessReview)
 				require.Equal(t, tt.wantAllow, got)
 			}
 			got := r.GetKubeResources(Deny)
@@ -879,6 +904,7 @@ func appendV7KubeResources() []KubernetesResource {
 	resources := []KubernetesResource{}
 	// append other kubernetes resources
 	for _, resource := range KubernetesResourcesKinds {
+		group := KubernetesResourcesV7KindGroups[resource]
 		resource = KubernetesResourcesKindsPlurals[resource]
 		if resource == "pods" || resource == "namespaces" {
 			continue
@@ -888,7 +914,7 @@ func appendV7KubeResources() []KubernetesResource {
 			Namespace: Wildcard,
 			Name:      Wildcard,
 			Verbs:     []string{Wildcard},
-			APIGroup:  Wildcard,
+			APIGroup:  group,
 		},
 		)
 	}
diff --git a/api/types/saml.go b/api/types/saml.go
index 24dde3df1a251..b085904af4a30 100644
--- a/api/types/saml.go
+++ b/api/types/saml.go
@@ -117,6 +117,16 @@ type SAMLConnector interface {
 	GetForceAuthn() bool
 	// GetPreferredRequestBinding returns PreferredRequestBinding.
 	GetPreferredRequestBinding() string
+	// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	GetUserMatchers() []string
+	// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+	// for identifier-first login.
+	SetUserMatchers([]string)
+	// GetIncludeSubject returns true if the Subject element should be included in the AuthnRequest.
+	GetIncludeSubject() bool
+	// SetIncludeSubject sets whether the Subject element should be included.
+	SetIncludeSubject(bool)
 }
 
 // NewSAMLConnector returns a new SAMLConnector based off a name and SAMLConnectorSpecV2.
@@ -448,6 +458,29 @@ func (o *SAMLConnectorV2) GetForceAuthn() bool {
 	return o.Spec.ForceAuthn == SAMLForceAuthn_FORCE_AUTHN_YES
 }
 
+// GetUserMatchers returns the set of glob patterns to narrow down which username(s) this auth connector should
+// match for identifier-first login.
+func (r *SAMLConnectorV2) GetUserMatchers() []string {
+	if r.Spec.UserMatchers == nil {
+		return nil
+	}
+	return r.Spec.UserMatchers
+}
+
+// SetUserMatchers sets the set of glob patterns to narrow down which username(s) this auth connector should match
+// for identifier-first login.
+func (r *SAMLConnectorV2) SetUserMatchers(userMatchers []string) {
+	r.Spec.UserMatchers = userMatchers
+}
+
+func (r *SAMLConnectorV2) GetIncludeSubject() bool {
+	return r.Spec.IncludeSubject
+}
+
+func (r *SAMLConnectorV2) SetIncludeSubject(includeSubject bool) {
+	r.Spec.IncludeSubject = includeSubject
+}
+
 const (
 	// SAMLRequestHTTPRedirectBinding is the SAML http-redirect binding request name.
 	SAMLRequestHTTPRedirectBinding = "http-redirect"
diff --git a/api/types/secreports/convert/v1/secreport.go b/api/types/secreports/convert/v1/secreport.go
index eff3c64aed25c..a24b24edbfc38 100644
--- a/api/types/secreports/convert/v1/secreport.go
+++ b/api/types/secreports/convert/v1/secreport.go
@@ -34,7 +34,7 @@ func FromProtoAuditQuery(in *secreportsv1.AuditQuery) (*secreports.AuditQuery, e
 		Query:       in.GetSpec().GetQuery(),
 		Description: in.GetSpec().GetDescription(),
 	}
-	out, err := secreports.NewAuditQuery(headerv1.FromMetadataProto(in.Header.Metadata), spec)
+	out, err := secreports.NewAuditQuery(headerv1.FromMetadataProto(in.GetHeader().GetMetadata()), spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -76,7 +76,7 @@ func FromProtoReport(in *secreportsv1.Report) (*secreports.Report, error) {
 		Title:        in.GetSpec().GetTitle(),
 		Version:      in.GetSpec().GetVersion(),
 	}
-	out, err := secreports.NewReport(headerv1.FromMetadataProto(in.Header.Metadata), spec)
+	out, err := secreports.NewReport(headerv1.FromMetadataProto(in.GetHeader().GetMetadata()), spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/api/types/semaphore.go b/api/types/semaphore.go
index 68d32850de075..e6b5e07d7cebf 100644
--- a/api/types/semaphore.go
+++ b/api/types/semaphore.go
@@ -327,17 +327,37 @@ type Semaphores interface {
 	CancelSemaphoreLease(ctx context.Context, lease SemaphoreLease) error
 	// GetSemaphores returns a list of semaphores matching supplied filter.
 	GetSemaphores(ctx context.Context, filter SemaphoreFilter) ([]Semaphore, error)
+	// ListSemaphores returns a page of semaphores matching supplied filter.
+	ListSemaphores(ctx context.Context, limit int, start string, filter *SemaphoreFilter) ([]Semaphore, string, error)
 	// DeleteSemaphore deletes a semaphore matching supplied filter.
 	DeleteSemaphore(ctx context.Context, filter SemaphoreFilter) error
 }
 
 // Match checks if the supplied semaphore matches this filter.
 func (f *SemaphoreFilter) Match(sem Semaphore) bool {
-	if f.SemaphoreKind != "" && f.SemaphoreKind != sem.GetSubKind() {
+	if f.GetSemaphoreKind() != "" && f.GetSemaphoreKind() != sem.GetSubKind() {
 		return false
 	}
-	if f.SemaphoreName != "" && f.SemaphoreName != sem.GetName() {
+	if f.GetSemaphoreName() != "" && f.GetSemaphoreName() != sem.GetName() {
 		return false
 	}
 	return true
 }
+
+// GetSemaphoreKind returns the semaphore kind to filter by if filter is non-nil
+func (f *SemaphoreFilter) GetSemaphoreKind() string {
+	if f == nil {
+		return ""
+	}
+
+	return f.SemaphoreKind
+}
+
+// GetSemaphoreName returns the semaphore name to filter by if filter is non-nil
+func (f *SemaphoreFilter) GetSemaphoreName() string {
+	if f == nil {
+		return ""
+	}
+
+	return f.SemaphoreName
+}
diff --git a/api/types/server.go b/api/types/server.go
index c2e139480f89a..194bf810344b7 100644
--- a/api/types/server.go
+++ b/api/types/server.go
@@ -27,6 +27,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/aws"
 )
@@ -76,6 +77,13 @@ type Server interface {
 	// ProxiedService provides common methods for a proxied service.
 	ProxiedService
 
+	// GetRelayGroup returns the name of the Relay group that the server is
+	// connected to.
+	GetRelayGroup() string
+	// GetRelayIDs returns the list of Relay host IDs that the server is
+	// connected to.
+	GetRelayIDs() []string
+
 	// DeepCopy creates a clone of this server value
 	DeepCopy() Server
 
@@ -105,6 +113,13 @@ type Server interface {
 
 	// GetGitHub returns the GitHub server spec.
 	GetGitHub() *GitHubServerMetadata
+	// GetScope returns the scope this server belongs to.
+	GetScope() string
+
+	// GetComponentFeatures returns the supported features for the server.
+	GetComponentFeatures() *componentfeaturesv1.ComponentFeatures
+	// SetComponentFeatures sets the supported features for the server.
+	SetComponentFeatures(*componentfeaturesv1.ComponentFeatures)
 }
 
 // NewServer creates an instance of Server.
@@ -186,6 +201,16 @@ func NewGitHubServerWithName(name string, githubSpec GitHubServerMetadata) (Serv
 	return server, nil
 }
 
+// GetComponentFeatures returns the supported features for the server.
+func (s *ServerV2) GetComponentFeatures() *componentfeaturesv1.ComponentFeatures {
+	return s.Spec.ComponentFeatures
+}
+
+// SetComponentFeatures sets the supported features for the server.
+func (s *ServerV2) SetComponentFeatures(features *componentfeaturesv1.ComponentFeatures) {
+	s.Spec.ComponentFeatures = features
+}
+
 // GetVersion returns resource version
 func (s *ServerV2) GetVersion() string {
 	return s.Version
@@ -384,6 +409,22 @@ func (s *ServerV2) SetProxyIDs(proxyIDs []string) {
 	s.Spec.ProxyIDs = proxyIDs
 }
 
+// GetRelayGroup implements [Server].
+func (s *ServerV2) GetRelayGroup() string {
+	if s == nil {
+		return ""
+	}
+	return s.Spec.RelayGroup
+}
+
+// GetRelayIDs implements [Server].
+func (s *ServerV2) GetRelayIDs() []string {
+	if s == nil {
+		return nil
+	}
+	return s.Spec.RelayIds
+}
+
 // GetAllLabels returns the full key:value map of both static labels and
 // "command labels"
 func (s *ServerV2) GetAllLabels() map[string]string {
@@ -726,6 +767,11 @@ func (s *ServerV2) SetCloudMetadata(meta *CloudMetadata) {
 	s.Spec.CloudMetadata = meta
 }
 
+// GetScope returns the scope this server belongs to.
+func (s *ServerV2) GetScope() string {
+	return s.Scope
+}
+
 // CommandLabel is a label that has a value as a result of the
 // output generated by running command, e.g. hostname
 type CommandLabel interface {
diff --git a/api/types/server_test.go b/api/types/server_test.go
index 4e1476e9cbf38..7c398173ed4a5 100644
--- a/api/types/server_test.go
+++ b/api/types/server_test.go
@@ -19,7 +19,9 @@ package types
 import (
 	"fmt"
 	"testing"
+	"time"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -818,3 +820,41 @@ func TestGitServerOrgDomain(t *testing.T) {
 	_, ok = GetGitHubOrgFromNodeAddr("my-server.example.teleport.sh:22")
 	require.False(t, ok)
 }
+
+func TestServerLabels(t *testing.T) {
+	emptyLabels := make(map[string]string)
+	// empty
+	server := &ServerV2{}
+	require.Empty(t, server.GetAllLabels())
+	require.True(t, MatchLabels(server, emptyLabels))
+	require.False(t, MatchLabels(server, map[string]string{"a": "b"}))
+
+	// more complex
+	server = &ServerV2{
+		Metadata: Metadata{
+			Labels: map[string]string{
+				"role": "database",
+			},
+		},
+		Spec: ServerSpecV2{
+			CmdLabels: map[string]CommandLabelV2{
+				"time": {
+					Period:  NewDuration(time.Second),
+					Command: []string{"time"},
+					Result:  "now",
+				},
+			},
+		},
+	}
+
+	require.Empty(t, cmp.Diff(server.GetAllLabels(), map[string]string{
+		"role": "database",
+		"time": "now",
+	}))
+
+	require.True(t, MatchLabels(server, emptyLabels))
+	require.False(t, MatchLabels(server, map[string]string{"a": "b"}))
+	require.True(t, MatchLabels(server, map[string]string{"role": "database"}))
+	require.True(t, MatchLabels(server, map[string]string{"time": "now"}))
+	require.True(t, MatchLabels(server, map[string]string{"time": "now", "role": "database"}))
+}
diff --git a/api/types/session_tracker.go b/api/types/session_tracker.go
index 62089117bc976..76f6431ab81f9 100644
--- a/api/types/session_tracker.go
+++ b/api/types/session_tracker.go
@@ -105,7 +105,7 @@ type SessionTracker interface {
 	RemoveParticipant(string) error
 
 	// UpdatePresence updates presence timestamp of a participant.
-	UpdatePresence(string, time.Time) error
+	UpdatePresence(username string, cluster string, t time.Time) error
 
 	// GetKubeCluster returns the name of the kubernetes cluster the session is running in.
 	GetKubeCluster() string
@@ -320,9 +320,14 @@ func (s *SessionTrackerV1) GetHostUser() string {
 }
 
 // UpdatePresence updates presence timestamp of a participant.
-func (s *SessionTrackerV1) UpdatePresence(user string, t time.Time) error {
+func (s *SessionTrackerV1) UpdatePresence(user, userCluster string, t time.Time) error {
 	idx := slices.IndexFunc(s.Spec.Participants, func(participant Participant) bool {
-		return participant.User == user
+		// participant.Cluster == "" is a legacy participant that was created
+		// before cluster field was added, so we allow updating presence for
+		// such participants as well.
+		// TODO(tigrato): Remove this in version 20.0.0
+		// TODO(tigrato): DELETE IN 20.0.0
+		return participant.User == user && (participant.Cluster == userCluster || participant.Cluster == "")
 	})
 
 	if idx < 0 {
diff --git a/api/types/session_tracker_test.go b/api/types/session_tracker_test.go
index 59cbb7fbd84fa..9d3c7601491c4 100644
--- a/api/types/session_tracker_test.go
+++ b/api/types/session_tracker_test.go
@@ -34,12 +34,20 @@ func TestSessionTrackerV1_UpdatePresence(t *testing.T) {
 			{
 				ID:         "1",
 				User:       "llama",
+				Cluster:    "teleport-local",
 				Mode:       string(SessionPeerMode),
 				LastActive: now,
 			},
 			{
 				ID:         "2",
 				User:       "fish",
+				Cluster:    "teleport-remote",
+				Mode:       string(SessionModeratorMode),
+				LastActive: now,
+			},
+			{
+				ID:         "3",
+				User:       "cat",
 				Mode:       string(SessionModeratorMode),
 				LastActive: now,
 			},
@@ -48,11 +56,13 @@ func TestSessionTrackerV1_UpdatePresence(t *testing.T) {
 	require.NoError(t, err)
 
 	// Presence cannot be updated for a non-existent user
-	err = s.UpdatePresence("alpaca", now.Add(time.Hour))
+	err = s.UpdatePresence("alpaca", "", now.Add(time.Hour))
 	require.ErrorIs(t, err, trace.NotFound("participant alpaca not found"))
 
 	// Update presence for just the user fish
-	require.NoError(t, s.UpdatePresence("fish", now.Add(time.Hour)))
+	require.NoError(t, s.UpdatePresence("fish", "teleport-remote", now.Add(time.Hour)))
+	// Try to Update presence for user fish again, but with a different cluster.
+	require.Error(t, s.UpdatePresence("fish", "teleport-local", now.Add(time.Hour)))
 
 	// Verify that llama has not been active but that fish was
 	for _, participant := range s.GetParticipants() {
diff --git a/api/types/sessionrecording.go b/api/types/sessionrecording.go
index 832bfcc59a8ec..ad1fc5af60c8f 100644
--- a/api/types/sessionrecording.go
+++ b/api/types/sessionrecording.go
@@ -17,6 +17,7 @@ limitations under the License.
 package types
 
 import (
+	"iter"
 	"slices"
 	"strings"
 	"time"
@@ -43,8 +44,24 @@ type SessionRecordingConfig interface {
 	// SetProxyChecksHostKeys sets if the proxy will check host keys.
 	SetProxyChecksHostKeys(bool)
 
+	// GetEncrypted gets if session recordings should be encrypted or not.
+	GetEncrypted() bool
+
+	// GetEncryptionConfig gets the encryption config from the session recording config.
+	GetEncryptionConfig() *SessionRecordingEncryptionConfig
+
+	// GetEncryptionKeys gets the encryption keys for the session recording config.
+	GetEncryptionKeys() []*AgeEncryptionKey
+
+	// SetEncryptionKeys sets the encryption keys for the session recording config.
+	// It returns true if there was a change applied and false otherwise.
+	SetEncryptionKeys(iter.Seq[*AgeEncryptionKey]) bool
+
 	// Clone returns a copy of the resource.
 	Clone() SessionRecordingConfig
+
+	// CheckAndSetDefaults verifies the constraints for a SessionRecordingConfig
+	CheckAndSetDefaults() error
 }
 
 // NewSessionRecordingConfigFromConfigFile is a convenience method to create
@@ -163,6 +180,68 @@ func (c *SessionRecordingConfigV2) SetProxyChecksHostKeys(t bool) {
 	c.Spec.ProxyChecksHostKeys = NewBoolOption(t)
 }
 
+// GetEncrypted gets if session recordings should be encrypted or not.
+func (c *SessionRecordingConfigV2) GetEncrypted() bool {
+	encryption := c.GetEncryptionConfig()
+	return encryption != nil && encryption.Enabled
+}
+
+// GetEncryptionConfig gets the encryption config from the session recording config.
+func (c *SessionRecordingConfigV2) GetEncryptionConfig() *SessionRecordingEncryptionConfig {
+	if c == nil {
+		return nil
+	}
+
+	return c.Spec.Encryption
+}
+
+// GetEncryptionKeys gets the encryption keys for the session recording config.
+func (c *SessionRecordingConfigV2) GetEncryptionKeys() []*AgeEncryptionKey {
+	if c.Status != nil {
+		return c.Status.EncryptionKeys
+	}
+
+	return nil
+}
+
+// SetEncryptionKeys sets the encryption keys for the session recording config.
+// It returns true if there was a change applied and false otherwise.
+func (c *SessionRecordingConfigV2) SetEncryptionKeys(keys iter.Seq[*AgeEncryptionKey]) bool {
+	existingKeys := make(map[string]struct{})
+	for _, key := range c.GetEncryptionKeys() {
+		existingKeys[string(key.PublicKey)] = struct{}{}
+	}
+
+	var keysChanged bool
+	var newKeys []*AgeEncryptionKey
+	addedKeys := make(map[string]struct{})
+	for key := range keys {
+		if !keysChanged {
+			if _, exists := existingKeys[string(key.PublicKey)]; !exists {
+				keysChanged = true
+			}
+		}
+
+		if _, added := addedKeys[string(key.PublicKey)]; !added {
+			addedKeys[string(key.PublicKey)] = struct{}{}
+			newKeys = append(newKeys, key)
+		}
+
+	}
+
+	shouldUpdate := len(addedKeys) > 0 && (keysChanged || len(existingKeys) != len(addedKeys))
+	if !shouldUpdate {
+		return false
+	}
+
+	if c.Status == nil {
+		c.Status = &SessionRecordingConfigStatus{}
+	}
+	c.Status.EncryptionKeys = newKeys
+
+	return true
+}
+
 // Clone returns a copy of the resource.
 func (c *SessionRecordingConfigV2) Clone() SessionRecordingConfig {
 	return utils.CloneProtoMsg(c)
diff --git a/api/types/sessionrecording_test.go b/api/types/sessionrecording_test.go
new file mode 100644
index 0000000000000..375bef60ac9ab
--- /dev/null
+++ b/api/types/sessionrecording_test.go
@@ -0,0 +1,187 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package types_test
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestSetEncryptionKeys(t *testing.T) {
+	cases := []struct {
+		name         string
+		initialKeys  []*types.AgeEncryptionKey
+		newKeys      []*types.AgeEncryptionKey
+		expectChange bool
+	}{
+		{
+			name:         "adding new keys to empty list",
+			expectChange: true,
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+		}, {
+			name:         "adding new keys to existing list",
+			expectChange: true,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+				{
+					PublicKey: []byte("789"),
+				},
+			},
+		}, {
+			name:         "replacing existing keys",
+			expectChange: true,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("321"),
+				},
+				{
+					PublicKey: []byte("654"),
+				},
+			},
+		}, {
+			name:         "removing from existing keys",
+			expectChange: true,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+				{
+					PublicKey: []byte("789"),
+				},
+			},
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+		}, {
+			name:         "try to remove all keys",
+			expectChange: false,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+				{
+					PublicKey: []byte("789"),
+				},
+			},
+		}, {
+			name:         "no change",
+			expectChange: false,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+		}, {
+			name:         "adding duplicates",
+			expectChange: false,
+			initialKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+			newKeys: []*types.AgeEncryptionKey{
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("123"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+				{
+					PublicKey: []byte("456"),
+				},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			src := &types.SessionRecordingConfigV2{
+				Status: &types.SessionRecordingConfigStatus{
+					EncryptionKeys: c.initialKeys,
+				},
+			}
+
+			keysChanged := src.SetEncryptionKeys(slices.Values(c.newKeys))
+			require.Equal(t, c.expectChange, keysChanged)
+			if keysChanged {
+				require.Equal(t, c.newKeys, src.Status.EncryptionKeys)
+			} else {
+				require.Equal(t, c.initialKeys, src.Status.EncryptionKeys)
+			}
+		})
+	}
+}
diff --git a/api/types/signaturealgorithmsuite.go b/api/types/signaturealgorithmsuite.go
index fdd8f91cc5ca6..78dcbda98af05 100644
--- a/api/types/signaturealgorithmsuite.go
+++ b/api/types/signaturealgorithmsuite.go
@@ -20,23 +20,35 @@ import (
 	"github.com/gravitational/trace"
 )
 
-// MarshalText marshals a SignatureAlgorithmSuite value to text. This gets used
-// by json.Marshal.
-func (s SignatureAlgorithmSuite) MarshalText() ([]byte, error) {
+// SignatureAlgorithmSuiteToString converts a [SignatureAlgorithmSuite] to a user-friendly string.
+func SignatureAlgorithmSuiteToString(s SignatureAlgorithmSuite) string {
 	switch s {
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_LEGACY:
-		return []byte("legacy"), nil
+		return "legacy"
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1:
-		return []byte("balanced-v1"), nil
+		return "balanced-v1"
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_FIPS_V1:
-		return []byte("fips-v1"), nil
+		return "fips-v1"
 	case SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_HSM_V1:
-		return []byte("hsm-v1"), nil
+		return "hsm-v1"
 	default:
-		return []byte(s.String()), nil
+		return s.String()
 	}
 }
 
+// SignatureAlgorithmSuiteFromString parses a string to return a [SignatureAlgorithmSuite].
+func SignatureAlgorithmSuiteFromString(str string) (SignatureAlgorithmSuite, error) {
+	var suite SignatureAlgorithmSuite
+	err := suite.UnmarshalText([]byte(str))
+	return suite, trace.Wrap(err)
+}
+
+// MarshalText marshals a SignatureAlgorithmSuite value to text. This gets used
+// by json.Marshal.
+func (s SignatureAlgorithmSuite) MarshalText() ([]byte, error) {
+	return []byte(SignatureAlgorithmSuiteToString(s)), nil
+}
+
 // UnmarshalJSON unmarshals a SignatureAlgorithmSuite and supports the custom
 // string format or numeric types matching an enum value.
 func (s *SignatureAlgorithmSuite) UnmarshalJSON(data []byte) error {
diff --git a/api/types/summarizer/summarizer.go b/api/types/summarizer/summarizer.go
new file mode 100644
index 0000000000000..5f290283ad550
--- /dev/null
+++ b/api/types/summarizer/summarizer.go
@@ -0,0 +1,193 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package summarizer
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// NewInferenceModel creates a new InferenceModel resource with the given name
+// and spec.
+func NewInferenceModel(name string, spec *summarizerv1.InferenceModelSpec) *summarizerv1.InferenceModel {
+	return &summarizerv1.InferenceModel{
+		Kind:    types.KindInferenceModel,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+		},
+		Spec: spec,
+	}
+}
+
+// ValidateInferenceModel validates an InferenceModel.
+func ValidateInferenceModel(m *summarizerv1.InferenceModel) error {
+	switch {
+	case m == nil:
+		return trace.BadParameter("inference model is nil")
+	case m.GetKind() != types.KindInferenceModel:
+		return trace.BadParameter("kind must be %s, got %s", types.KindInferenceModel, m.GetKind())
+	case m.GetSubKind() != "":
+		return trace.BadParameter("subkind must be empty")
+	case m.GetVersion() == "":
+		return trace.BadParameter("version is required")
+	case m.GetVersion() != types.V1:
+		return trace.BadParameter("unsupported version %s, supported: %s", m.GetVersion(), types.V1)
+
+	case m.GetMetadata() == nil:
+		return trace.BadParameter("metadata is required")
+	case m.GetMetadata().GetName() == "":
+		return trace.BadParameter("metadata.name is required")
+	case m.GetMetadata().GetName() == "teleport-cloud-default":
+		return trace.BadParameter("metadata.name \"teleport-cloud-default\" is reserved")
+
+	case m.GetSpec() == nil:
+		return trace.BadParameter("spec is required")
+	}
+
+	provider := m.GetSpec().GetProvider()
+	switch p := provider.(type) {
+	case nil:
+		return trace.BadParameter(
+			// Unfortunately, there's no way to tell between a missing and
+			// unsupported one once the object is parsed from YAML. There may be a
+			// way to do it if it was created from binary wire format, but it's not
+			// worth the effort.
+			"missing or unsupported inference provider in spec, supported providers: openai",
+		)
+	case *summarizerv1.InferenceModelSpec_Openai:
+		if p.Openai.GetOpenaiModelId() == "" {
+			return trace.BadParameter("spec.openai.openai_model_id is required")
+		}
+	case *summarizerv1.InferenceModelSpec_Bedrock:
+		if p.Bedrock.GetBedrockModelId() == "" {
+			return trace.BadParameter("spec.bedrock.bedrock_model_id is required")
+		}
+		if p.Bedrock.GetRegion() == "" {
+			return trace.BadParameter("spec.bedrock.region is required")
+		}
+	}
+
+	return nil
+}
+
+// NewInferenceSecret creates a new InferenceSecret resource with the given name
+// and spec.
+func NewInferenceSecret(name string, spec *summarizerv1.InferenceSecretSpec) *summarizerv1.InferenceSecret {
+	return &summarizerv1.InferenceSecret{
+		Kind:    types.KindInferenceSecret,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+		},
+		Spec: spec,
+	}
+}
+
+// ValidateInferenceSecret validates an inference secret.
+func ValidateInferenceSecret(s *summarizerv1.InferenceSecret) error {
+	switch {
+	case s == nil:
+		return trace.BadParameter("inference secret is nil")
+	case s.GetKind() != types.KindInferenceSecret:
+		return trace.BadParameter("kind must be %s, got %s", types.KindInferenceSecret, s.GetKind())
+	case s.GetSubKind() != "":
+		return trace.BadParameter("subkind must be empty")
+	case s.GetVersion() == "":
+		return trace.BadParameter("version is required")
+	case s.GetVersion() != types.V1:
+		return trace.BadParameter("unsupported version %s, supported: %s", s.GetVersion(), types.V1)
+
+	case s.GetMetadata() == nil:
+		return trace.BadParameter("metadata is required")
+	case s.GetMetadata().GetName() == "":
+		return trace.BadParameter("metadata.name is required")
+
+	case s.GetSpec() == nil:
+		return trace.BadParameter("spec is required")
+	case s.GetSpec().GetValue() == "":
+		return trace.BadParameter("spec.value is required")
+	}
+
+	return nil
+}
+
+// NewInferencePolicy creates a new InferencePolicy resource with the given name
+// and spec.
+func NewInferencePolicy(name string, spec *summarizerv1.InferencePolicySpec) *summarizerv1.InferencePolicy {
+	return &summarizerv1.InferencePolicy{
+		Kind:    types.KindInferencePolicy,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+		},
+		Spec: spec,
+	}
+}
+
+// ValidateInferencePolicy validates an InferencePolicy. This function doesn't
+// validate the Filter field, as it's unable to access the lib/services
+// package; to fully validate a policy, use
+// lib/services.ValidateInferencePolicy.
+func ValidateInferencePolicy(p *summarizerv1.InferencePolicy) error {
+	switch {
+	case p == nil:
+		return trace.BadParameter("inference policy is nil")
+	case p.GetKind() != types.KindInferencePolicy:
+		return trace.BadParameter("kind must be %s, got %s", types.KindInferencePolicy, p.GetKind())
+	case p.GetSubKind() != "":
+		return trace.BadParameter("subkind must be empty")
+	case p.GetVersion() == "":
+		return trace.BadParameter("version is required")
+	case p.GetVersion() != types.V1:
+		return trace.BadParameter("unsupported version %s, supported: %s", p.GetVersion(), types.V1)
+
+	case p.GetMetadata() == nil:
+		return trace.BadParameter("metadata is required")
+	case p.GetMetadata().GetName() == "":
+		return trace.BadParameter("metadata.name is required")
+
+	case p.GetSpec() == nil:
+		return trace.BadParameter("spec is required")
+	case p.GetSpec().GetModel() == "":
+		return trace.BadParameter("spec.model is required")
+	}
+
+	kinds := p.GetSpec().GetKinds()
+	if len(kinds) == 0 {
+		return trace.BadParameter("spec.kinds are required")
+	}
+	supportedKinds := []string{
+		string(types.SSHSessionKind),
+		string(types.KubernetesSessionKind),
+		string(types.DatabaseSessionKind),
+	}
+	for _, kind := range kinds {
+		if !slices.Contains(supportedKinds, kind) {
+			return trace.BadParameter(
+				"unsupported kind in spec.kinds: %s, supported: %v",
+				kind, strings.Join(supportedKinds, ", "),
+			)
+		}
+	}
+
+	return nil
+}
diff --git a/api/types/summarizer/summarizer_test.go b/api/types/summarizer/summarizer_test.go
new file mode 100644
index 0000000000000..0fd1ad53df4bb
--- /dev/null
+++ b/api/types/summarizer/summarizer_test.go
@@ -0,0 +1,244 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package summarizer
+
+import (
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestValidateInferenceModel(t *testing.T) {
+	t.Parallel()
+	validOpenAI := NewInferenceModel("my-model", &summarizerv1.InferenceModelSpec{
+		Provider: &summarizerv1.InferenceModelSpec_Openai{
+			Openai: &summarizerv1.OpenAIProvider{
+				OpenaiModelId: "gpt-4o",
+			},
+		},
+	})
+	validBedrock := NewInferenceModel("my-model", &summarizerv1.InferenceModelSpec{
+		Provider: &summarizerv1.InferenceModelSpec_Bedrock{
+			Bedrock: &summarizerv1.BedrockProvider{
+				BedrockModelId: "amazon.nova-lite-v1:0",
+				Region:         "us-west-2",
+			},
+		},
+	})
+	require.NoError(t, ValidateInferenceModel(validOpenAI))
+	require.NoError(t, ValidateInferenceModel(validBedrock))
+
+	cases := []struct {
+		base *summarizerv1.InferenceModel
+		fn   func(m *summarizerv1.InferenceModel)
+		msg  string
+	}{
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Kind = "other" },
+			msg:  "kind must be inference_model, got other",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.SubKind = "foo" },
+			msg:  "subkind must be empty",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Version = "" },
+			msg:  "version is required",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Version = types.V2 },
+			msg:  "unsupported version v2, supported: v1",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Metadata = nil },
+			msg:  "metadata is required",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Metadata.Name = "" },
+			msg:  "metadata.name is required",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Metadata.Name = "teleport-cloud-default" },
+			msg:  "metadata.name \"teleport-cloud-default\" is reserved",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Spec = nil },
+			msg:  "spec is required",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Spec.Provider = nil },
+			msg:  "missing or unsupported inference provider in spec, supported providers: openai",
+		},
+		{
+			base: validOpenAI,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Spec.GetOpenai().OpenaiModelId = "" },
+			msg:  "spec.openai.openai_model_id is required",
+		},
+		{
+			base: validBedrock,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Spec.GetBedrock().BedrockModelId = "" },
+			msg:  "spec.bedrock.bedrock_model_id is required",
+		},
+		{
+			base: validBedrock,
+			fn:   func(m *summarizerv1.InferenceModel) { m.Spec.GetBedrock().Region = "" },
+			msg:  "spec.bedrock.region is required",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.msg, func(t *testing.T) {
+			m := proto.CloneOf(tc.base)
+			tc.fn(m)
+			assert.ErrorIs(t, ValidateInferenceModel(m), &trace.BadParameterError{Message: tc.msg})
+		})
+	}
+}
+
+func TestValidateInferenceSecret(t *testing.T) {
+	t.Parallel()
+	valid := NewInferenceSecret("my-secret", &summarizerv1.InferenceSecretSpec{
+		Value: "super-secret-value",
+	})
+	require.NoError(t, ValidateInferenceSecret(valid))
+
+	cases := []struct {
+		fn  func(s *summarizerv1.InferenceSecret)
+		msg string
+	}{
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Kind = "other" },
+			msg: "kind must be inference_secret, got other",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.SubKind = "foo" },
+			msg: "subkind must be empty",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Version = "" },
+			msg: "version is required",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Version = types.V2 },
+			msg: "unsupported version v2, supported: v1",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Metadata = nil },
+			msg: "metadata is required",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Metadata.Name = "" },
+			msg: "metadata.name is required",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Spec = nil },
+			msg: "spec is required",
+		},
+		{
+			fn:  func(s *summarizerv1.InferenceSecret) { s.Spec.Value = "" },
+			msg: "spec.value is required",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.msg, func(t *testing.T) {
+			s := proto.CloneOf(valid)
+			tc.fn(s)
+			assert.ErrorIs(t, ValidateInferenceSecret(s), &trace.BadParameterError{Message: tc.msg})
+		})
+	}
+}
+
+func TestValidateInferencePolicy(t *testing.T) {
+	t.Parallel()
+	valid := NewInferencePolicy("my-policy", &summarizerv1.InferencePolicySpec{
+		Kinds:  []string{"ssh", "k8s", "db"},
+		Filter: `equals(resource.metadata.labels["env"], "prod") || equals(user.metadata.name, "admin")`,
+		Model:  "my-model",
+	})
+	require.NoError(t, ValidateInferencePolicy(valid))
+	// Empty filter should also be valid.
+	valid.Spec.Filter = ""
+	require.NoError(t, ValidateInferencePolicy(valid))
+
+	cases := []struct {
+		fn  func(p *summarizerv1.InferencePolicy)
+		msg string
+	}{
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Kind = "other" },
+			msg: "kind must be inference_policy, got other",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.SubKind = "foo" },
+			msg: "subkind must be empty",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Version = "" },
+			msg: "version is required",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Version = types.V2 },
+			msg: "unsupported version v2, supported: v1",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Metadata = nil },
+			msg: "metadata is required",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Metadata.Name = "" },
+			msg: "metadata.name is required",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Spec = nil },
+			msg: "spec is required",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Spec.Kinds = nil },
+			msg: "spec.kinds are required",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Spec.Kinds = []string{"foo"} },
+			msg: "unsupported kind in spec.kinds: foo, supported: ssh, k8s, db",
+		},
+		{
+			fn:  func(p *summarizerv1.InferencePolicy) { p.Spec.Model = "" },
+			msg: "spec.model is required",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.msg, func(t *testing.T) {
+			p := proto.CloneOf(valid)
+			tc.fn(p)
+			assert.ErrorContains(t, ValidateInferencePolicy(p), tc.msg)
+		})
+	}
+}
diff --git a/api/types/system_role.go b/api/types/system_role.go
index 9b353254368ca..15d13746eff88 100644
--- a/api/types/system_role.go
+++ b/api/types/system_role.go
@@ -39,6 +39,8 @@ const (
 	RoleProxy SystemRole = "Proxy"
 	// RoleAdmin is admin role
 	RoleAdmin SystemRole = "Admin"
+	// RoleRelay is the system role for a relay in the cluster.
+	RoleRelay SystemRole = "Relay"
 	// RoleProvisionToken is a role for nodes authenticated using provisioning tokens
 	RoleProvisionToken SystemRole = "ProvisionToken"
 	// RoleTrustedCluster is a role needed for tokens used to add trusted clusters.
@@ -90,6 +92,7 @@ var roleMappings = map[string]SystemRole{
 	"node":              RoleNode,
 	"proxy":             RoleProxy,
 	"admin":             RoleAdmin,
+	"relay":             RoleRelay,
 	"provisiontoken":    RoleProvisionToken,
 	"trusted_cluster":   RoleTrustedCluster,
 	"trustedcluster":    RoleTrustedCluster,
@@ -132,6 +135,7 @@ var localServiceMappings = map[SystemRole]struct{}{
 	RoleAuth:              {},
 	RoleNode:              {},
 	RoleProxy:             {},
+	RoleRelay:             {},
 	RoleKube:              {},
 	RoleApp:               {},
 	RoleDatabase:          {},
diff --git a/api/types/target_health.go b/api/types/target_health.go
index 07d548fb1160c..40a16b0f19dce 100644
--- a/api/types/target_health.go
+++ b/api/types/target_health.go
@@ -17,6 +17,7 @@ limitations under the License.
 package types
 
 import (
+	"iter"
 	"time"
 )
 
@@ -24,8 +25,10 @@ import (
 type TargetHealthProtocol string
 
 const (
-	// TargetHealthProtocolTCP is a target health check protocol.
-	TargetHealthProtocolTCP TargetHealthProtocol = "TCP"
+	// TargetHealthProtocolTCP is the TCP target health check protocol.
+	TargetHealthProtocolTCP TargetHealthProtocol = "tcp"
+	// TargetHealthProtocolHTTP is the HTTP target health check protocol.
+	TargetHealthProtocolHTTP TargetHealthProtocol = "http"
 )
 
 // TargetHealthStatus is a target resource's health status.
@@ -38,8 +41,40 @@ const (
 	TargetHealthStatusUnhealthy TargetHealthStatus = "unhealthy"
 	// TargetHealthStatusUnknown indicates that an unknown health check target health status.
 	TargetHealthStatusUnknown TargetHealthStatus = "unknown"
+	// TargetHealthStatusMixed indicates the resource has a mix of health
+	// statuses. This can happen when multiple agents proxy the same resource.
+	TargetHealthStatusMixed TargetHealthStatus = "mixed"
 )
 
+// Canonical converts a status into its canonical form.
+// An empty or unknown status is converted to [TargetHealthStatusUnknown].
+//
+// Returns only a healthy, unhealthy, or unknown status.
+func (s TargetHealthStatus) Canonical() TargetHealthStatus {
+	switch s {
+	case TargetHealthStatusHealthy, TargetHealthStatusUnhealthy:
+		return s
+	default:
+		return TargetHealthStatusUnknown
+	}
+}
+
+// AggregateHealthStatus health statuses into a single status. If there are a
+// mix of different statuses then the aggregate status is "mixed".
+func AggregateHealthStatus(statuses iter.Seq[TargetHealthStatus]) TargetHealthStatus {
+	first := true
+	out := TargetHealthStatusUnknown
+	for s := range statuses {
+		if first {
+			out = s.Canonical()
+			first = false
+		} else if out != s.Canonical() {
+			return TargetHealthStatusMixed
+		}
+	}
+	return out
+}
+
 // TargetHealthTransitionReason is the reason for the target health status
 // transition.
 type TargetHealthTransitionReason string
@@ -66,17 +101,17 @@ func (t *TargetHealth) GetTransitionTimestamp() time.Time {
 	return *t.TransitionTimestamp
 }
 
-// TargetHealthGetter provides [TargetHealth] information.
-type TargetHealthGetter interface {
-	// GetTargetHealth returns the target health.
-	GetTargetHealth() TargetHealth
+// TargetHealthStatusGetter is a type that can return [TargetHealthStatus].
+type TargetHealthStatusGetter interface {
+	// GetTargetHealthStatus returns the target health status.
+	GetTargetHealthStatus() TargetHealthStatus
 }
 
-// GroupByTargetHealth groups resources by target health and returns [TargetHealthGroups].
-func GroupByTargetHealth[T TargetHealthGetter](resources []T) TargetHealthGroups[T] {
+// GroupByTargetHealthStatus groups resources by target health and returns [TargetHealthGroups].
+func GroupByTargetHealthStatus[T TargetHealthStatusGetter](resources []T) TargetHealthGroups[T] {
 	var groups TargetHealthGroups[T]
 	for _, r := range resources {
-		switch TargetHealthStatus(r.GetTargetHealth().Status) {
+		switch r.GetTargetHealthStatus() {
 		case TargetHealthStatusHealthy:
 			groups.Healthy = append(groups.Healthy, r)
 		case TargetHealthStatusUnhealthy:
@@ -90,15 +125,20 @@ func GroupByTargetHealth[T TargetHealthGetter](resources []T) TargetHealthGroups
 }
 
 // TargetHealthGroups holds resources grouped by target health status.
-type TargetHealthGroups[T TargetHealthGetter] struct {
+type TargetHealthGroups[T TargetHealthStatusGetter] struct {
 	// Healthy is the resources with [TargetHealthStatusHealthy].
 	Healthy []T
 	// Unhealthy is the resources with [TargetHealthStatusUnhealthy].
 	Unhealthy []T
 	// Unknown is the resources with any status that isn't healthy or unhealthy.
-	// Namely [TargetHealthStatusUnknown] and the empty string are grouped
-	// together.
+	// Namely [TargetHealthStatusUnknown], [TargetHealthStatusMixed], and the
+	// empty string are grouped together.
 	// Agents running with a version prior to health checks will always report
 	// an empty health status.
+	// A mixed status should only be set if health status for multiple servers
+	// are aggregated. An aggregated mixed status is equivalent to "unknown"
+	// because the underlying statuses that compose the mix are not known,
+	// although it really doesn't make sense to aggregate the health status
+	// before grouping it (please don't do that).
 	Unknown []T
 }
diff --git a/api/types/target_health_test.go b/api/types/target_health_test.go
index 769c51b095a02..ebe98145eb69f 100644
--- a/api/types/target_health_test.go
+++ b/api/types/target_health_test.go
@@ -19,6 +19,7 @@ package types
 import (
 	"fmt"
 	"math/rand/v2"
+	"slices"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -65,23 +66,72 @@ func TestGroupByTargetHealth(t *testing.T) {
 	rand.Shuffle(len(servers), func(i, j int) {
 		servers[i], servers[j] = servers[j], servers[i]
 	})
-	groups := GroupByTargetHealth(servers)
+	groups := GroupByTargetHealthStatus(servers)
 	for _, server := range groups.Healthy {
 		require.Equal(t, TargetHealthStatusHealthy,
-			TargetHealthStatus(server.GetTargetHealth().Status),
+			server.GetTargetHealthStatus(),
 			"server %s is in the wrong group", server.GetName(),
 		)
 	}
 	for _, server := range groups.Unhealthy {
 		require.Equal(t, TargetHealthStatusUnhealthy,
-			TargetHealthStatus(server.GetTargetHealth().Status),
+			server.GetTargetHealthStatus(),
 			"server %s is in the wrong group", server.GetName(),
 		)
 	}
 	for _, server := range groups.Unknown {
 		require.Contains(t, []TargetHealthStatus{TargetHealthStatusUnknown, ""},
-			TargetHealthStatus(server.GetTargetHealth().Status),
+			server.GetTargetHealthStatus(),
 			"server %s is in the wrong group", server.GetName(),
 		)
 	}
 }
+
+func TestTargetHealthStatusCanonical(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    TargetHealthStatus
+		expected TargetHealthStatus
+	}{
+		{"healthy remains healthy", TargetHealthStatusHealthy, TargetHealthStatusHealthy},
+		{"unhealthy remains unhealthy", TargetHealthStatusUnhealthy, TargetHealthStatusUnhealthy},
+		{"unknown becomes unknown", TargetHealthStatusUnknown, TargetHealthStatusUnknown},
+		{"mixed becomes unknown", TargetHealthStatusMixed, TargetHealthStatusUnknown},
+		{"empty string becomes unknown", TargetHealthStatus(""), TargetHealthStatusUnknown},
+		{"random string becomes unknown", TargetHealthStatus("invalid"), TargetHealthStatusUnknown},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := test.input.Canonical()
+			require.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestTargetHealthStatusesAggregate(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []TargetHealthStatus
+		expected TargetHealthStatus
+	}{
+		{"empty list returns unknown", []TargetHealthStatus{}, TargetHealthStatusUnknown},
+		{"one healthy", []TargetHealthStatus{TargetHealthStatusHealthy}, TargetHealthStatusHealthy},
+		{"one unhealthy", []TargetHealthStatus{TargetHealthStatusUnhealthy}, TargetHealthStatusUnhealthy},
+		{"one unknown", []TargetHealthStatus{TargetHealthStatusUnknown}, TargetHealthStatusUnknown},
+		{"one mixed", []TargetHealthStatus{TargetHealthStatusMixed}, TargetHealthStatusUnknown},
+		{"all healthy", []TargetHealthStatus{TargetHealthStatusHealthy, TargetHealthStatusHealthy}, TargetHealthStatusHealthy},
+		{"all unhealthy", []TargetHealthStatus{TargetHealthStatusUnhealthy, TargetHealthStatusUnhealthy}, TargetHealthStatusUnhealthy},
+		{"all unknown", []TargetHealthStatus{TargetHealthStatusUnknown, TargetHealthStatusUnknown}, TargetHealthStatusUnknown},
+		{"all empty", []TargetHealthStatus{"", ""}, TargetHealthStatusUnknown},
+		{"empty and unknown", []TargetHealthStatus{"", TargetHealthStatusUnknown}, TargetHealthStatusUnknown},
+		{"healthy and unhealthy", []TargetHealthStatus{TargetHealthStatusHealthy, TargetHealthStatusUnhealthy}, TargetHealthStatusMixed},
+		{"unhealthy and unknown", []TargetHealthStatus{TargetHealthStatusUnhealthy, TargetHealthStatusUnknown}, TargetHealthStatusMixed},
+		{"healthy and unhealthy and unknown", []TargetHealthStatus{TargetHealthStatusHealthy, TargetHealthStatusUnhealthy, TargetHealthStatusUnknown}, TargetHealthStatusMixed},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := AggregateHealthStatus(slices.Values(test.input))
+			require.Equal(t, test.expected, actual)
+		})
+	}
+}
diff --git a/api/types/trait/trait.go b/api/types/trait/trait.go
index c700e9a310d1f..b7429902da084 100644
--- a/api/types/trait/trait.go
+++ b/api/types/trait/trait.go
@@ -16,5 +16,33 @@ limitations under the License.
 
 package trait
 
+import (
+	"slices"
+)
+
 // Traits is a mapping of traits to values.
 type Traits map[string][]string
+
+// Clone returns a deep copy of the traits map.
+func (t Traits) Clone() Traits {
+	if t == nil {
+		return nil
+	}
+	out := make(Traits, len(t))
+	for key, values := range t {
+		out[key] = slices.Clone(values)
+	}
+	return out
+}
+
+// Merge src traits into dst. If you don't want the dst to be mutated do a Clone() first.
+// Duplicated values are removed, but the order of values for a given trait is not guaranteed.
+func Merge(dst, src Traits) {
+	for key, values := range src {
+		dst[key] = append(dst[key], values...)
+	}
+	for key, values := range dst {
+		slices.Sort(values)
+		dst[key] = slices.Compact(values)
+	}
+}
diff --git a/api/types/trait/trait_test.go b/api/types/trait/trait_test.go
new file mode 100644
index 0000000000000..2b6c9c81760af
--- /dev/null
+++ b/api/types/trait/trait_test.go
@@ -0,0 +1,62 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trait
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMerge(t *testing.T) {
+	testCases := []struct {
+		name        string
+		dst         Traits
+		src         Traits
+		expectedDst Traits
+	}{
+		{
+			name: "typical",
+			dst: Traits{
+				"only_dst": []string{"dst1"},
+				"logins":   []string{"root", "ec2-user"},
+			},
+			src: Traits{
+				"only_src": []string{"src1"},
+				"logins":   []string{"ubuntu", "ec2-user"},
+			},
+			expectedDst: Traits{
+				"only_src": []string{"src1"},
+				"only_dst": []string{"dst1"},
+				"logins":   []string{"ec2-user", "root", "ubuntu"},
+			},
+		},
+		{
+			name: "empty_dst",
+			dst:  Traits{},
+			src: Traits{
+				"only_src": []string{"src1"},
+			},
+			expectedDst: Traits{
+				"only_src": []string{"src1"},
+			},
+		},
+	}
+	for _, tt := range testCases {
+		Merge(tt.dst, tt.src)
+		require.Empty(t, cmp.Diff(tt.expectedDst, tt.dst))
+	}
+}
diff --git a/api/types/trust.go b/api/types/trust.go
index 528ab0ef45baa..cd018414277cb 100644
--- a/api/types/trust.go
+++ b/api/types/trust.go
@@ -18,6 +18,7 @@ package types
 
 import (
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -72,7 +73,8 @@ const (
 )
 
 // CertAuthTypes lists all certificate authority types.
-var CertAuthTypes = []CertAuthType{HostCA,
+var CertAuthTypes = []CertAuthType{
+	HostCA,
 	UserCA,
 	DatabaseCA,
 	DatabaseClientCA,
@@ -93,7 +95,9 @@ func (c CertAuthType) NewlyAdded() bool {
 	return c.addedInMajorVer() >= api.VersionMajor
 }
 
-// addedInVer return the major version in which given CA was added.
+// addedInMajorVer returns the major version in which given CA was added.
+// The returned version must be the X.0.0 release in which the CA first
+// existed.
 func (c CertAuthType) addedInMajorVer() int64 {
 	switch c {
 	case DatabaseCA:
@@ -105,7 +109,7 @@ func (c CertAuthType) addedInMajorVer() int64 {
 	case SPIFFECA:
 		return 15
 	case OktaCA:
-		return 16
+		return 17
 	case AWSRACA, BoundKeypairCA:
 		return 18
 	default:
@@ -125,10 +129,8 @@ const authTypeNotSupported string = "authority type is not supported"
 
 // Check checks if certificate authority type value is correct
 func (c CertAuthType) Check() error {
-	for _, caType := range CertAuthTypes {
-		if c == caType {
-			return nil
-		}
+	if slices.Contains(CertAuthTypes, c) {
+		return nil
 	}
 
 	return trace.BadParameter("%q %s", c, authTypeNotSupported)
diff --git a/api/types/types.pb.go b/api/types/types.pb.go
index 0c25b0e2509cb..514ee98863be7 100644
--- a/api/types/types.pb.go
+++ b/api/types/types.pb.go
@@ -12,7 +12,8 @@ import (
 	github_com_gogo_protobuf_types "github.com/gogo/protobuf/types"
 	types "github.com/gogo/protobuf/types"
 	github_com_gravitational_teleport_api_constants "github.com/gravitational/teleport/api/constants"
-	v1 "github.com/gravitational/teleport/api/gen/proto/go/attestation/v1"
+	v11 "github.com/gravitational/teleport/api/gen/proto/go/attestation/v1"
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	_ "github.com/gravitational/teleport/api/types/wrappers"
 	github_com_gravitational_teleport_api_types_wrappers "github.com/gravitational/teleport/api/types/wrappers"
 	io "io"
@@ -368,6 +369,38 @@ func (RequestState) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_9198ee693835762e, []int{8}
 }
 
+// AccessRequestKind represents the kind of Access Request being made (short/long-term).
+type AccessRequestKind int32
+
+const (
+	// UNDEFINED is the default value, and represents an undefined request kind.
+	AccessRequestKind_UNDEFINED AccessRequestKind = 0
+	// SHORT_TERM represents a short-term request, either role-based or resource-based.
+	AccessRequestKind_SHORT_TERM AccessRequestKind = 1
+	// LONG_TERM represents a long-term resource-based request.
+	AccessRequestKind_LONG_TERM AccessRequestKind = 2
+)
+
+var AccessRequestKind_name = map[int32]string{
+	0: "UNDEFINED",
+	1: "SHORT_TERM",
+	2: "LONG_TERM",
+}
+
+var AccessRequestKind_value = map[string]int32{
+	"UNDEFINED":  0,
+	"SHORT_TERM": 1,
+	"LONG_TERM":  2,
+}
+
+func (x AccessRequestKind) String() string {
+	return proto.EnumName(AccessRequestKind_name, int32(x))
+}
+
+func (AccessRequestKind) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{9}
+}
+
 type AccessRequestScope int32
 
 const (
@@ -403,7 +436,7 @@ func (x AccessRequestScope) String() string {
 }
 
 func (AccessRequestScope) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{9}
+	return fileDescriptor_9198ee693835762e, []int{10}
 }
 
 // CreateHostUserMode determines whether host user creation should be
@@ -446,7 +479,7 @@ func (x CreateHostUserMode) String() string {
 }
 
 func (CreateHostUserMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{10}
+	return fileDescriptor_9198ee693835762e, []int{11}
 }
 
 // CreateDatabaseUserMode determines whether database user creation should be
@@ -483,7 +516,7 @@ func (x CreateDatabaseUserMode) String() string {
 }
 
 func (CreateDatabaseUserMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{11}
+	return fileDescriptor_9198ee693835762e, []int{12}
 }
 
 // CertExtensionMode specifies the type of extension to use in the cert.
@@ -508,7 +541,7 @@ func (x CertExtensionMode) String() string {
 }
 
 func (CertExtensionMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{12}
+	return fileDescriptor_9198ee693835762e, []int{13}
 }
 
 // CertExtensionType represents the certificate type the extension is for.
@@ -533,7 +566,7 @@ func (x CertExtensionType) String() string {
 }
 
 func (CertExtensionType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{13}
+	return fileDescriptor_9198ee693835762e, []int{14}
 }
 
 // PasswordState indicates what is known about existence of user's password.
@@ -565,7 +598,7 @@ func (x PasswordState) String() string {
 }
 
 func (PasswordState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{14}
+	return fileDescriptor_9198ee693835762e, []int{15}
 }
 
 // MFADeviceKind indicates what is known about existence of user's MFA device.
@@ -601,7 +634,7 @@ func (x MFADeviceKind) String() string {
 }
 
 func (MFADeviceKind) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{15}
+	return fileDescriptor_9198ee693835762e, []int{16}
 }
 
 // SAMLForceAuthn specified whether existing SAML sessions should be accepted or re-authentication
@@ -634,7 +667,7 @@ func (x SAMLForceAuthn) String() string {
 }
 
 func (SAMLForceAuthn) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{16}
+	return fileDescriptor_9198ee693835762e, []int{17}
 }
 
 // SessionState represents the state of a session.
@@ -668,7 +701,7 @@ func (x SessionState) String() string {
 }
 
 func (SessionState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{17}
+	return fileDescriptor_9198ee693835762e, []int{18}
 }
 
 // AlertSeverity represents how problematic/urgent an alert is, and is used to assist
@@ -698,7 +731,7 @@ func (x AlertSeverity) String() string {
 }
 
 func (AlertSeverity) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{18}
+	return fileDescriptor_9198ee693835762e, []int{19}
 }
 
 // RequireMFAType is a type of MFA requirement enforced outside of login,
@@ -747,7 +780,7 @@ func (x RequireMFAType) String() string {
 }
 
 func (RequireMFAType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{19}
+	return fileDescriptor_9198ee693835762e, []int{20}
 }
 
 // SignatureAlgorithmSuite represents the suite of cryptographic signature algorithms used in the cluster.
@@ -797,7 +830,7 @@ func (x SignatureAlgorithmSuite) String() string {
 }
 
 func (SignatureAlgorithmSuite) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{20}
+	return fileDescriptor_9198ee693835762e, []int{21}
 }
 
 // EntraIDCredentialsSource defines the credentials source for Entra ID.
@@ -831,7 +864,7 @@ func (x EntraIDCredentialsSource) String() string {
 }
 
 func (EntraIDCredentialsSource) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{21}
+	return fileDescriptor_9198ee693835762e, []int{22}
 }
 
 // AWSICCredentialsSource indicates where the AWS Identity Center plugin will
@@ -871,7 +904,7 @@ func (x AWSICCredentialsSource) String() string {
 }
 
 func (AWSICCredentialsSource) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{22}
+	return fileDescriptor_9198ee693835762e, []int{23}
 }
 
 // AWSICGroupImportStatus defines Identity Center group and group members
@@ -910,7 +943,7 @@ func (x AWSICGroupImportStatusCode) String() string {
 }
 
 func (AWSICGroupImportStatusCode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{23}
+	return fileDescriptor_9198ee693835762e, []int{24}
 }
 
 type PluginStatusCode int32
@@ -956,7 +989,7 @@ func (x PluginStatusCode) String() string {
 }
 
 func (PluginStatusCode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{24}
+	return fileDescriptor_9198ee693835762e, []int{25}
 }
 
 // OktaPluginSyncStatusCode indicates the possible states of an Okta
@@ -992,7 +1025,7 @@ func (x OktaPluginSyncStatusCode) String() string {
 }
 
 func (OktaPluginSyncStatusCode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{25}
+	return fileDescriptor_9198ee693835762e, []int{26}
 }
 
 // HeadlessAuthenticationState is a headless authentication state.
@@ -1027,7 +1060,7 @@ func (x HeadlessAuthenticationState) String() string {
 }
 
 func (HeadlessAuthenticationState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{26}
+	return fileDescriptor_9198ee693835762e, []int{27}
 }
 
 // InstallParamEnrollMode is the mode used to enroll the node into the cluster.
@@ -1060,7 +1093,7 @@ func (x InstallParamEnrollMode) String() string {
 }
 
 func (InstallParamEnrollMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{27}
+	return fileDescriptor_9198ee693835762e, []int{28}
 }
 
 // The type of a KeepAlive. When adding a new type, please double-check
@@ -1143,7 +1176,7 @@ func (x CertAuthoritySpecV2_SigningAlgType) String() string {
 }
 
 func (CertAuthoritySpecV2_SigningAlgType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{60, 0}
+	return fileDescriptor_9198ee693835762e, []int{65, 0}
 }
 
 // FIPSEndpointState represents an AWS FIPS endpoint state.
@@ -1176,7 +1209,7 @@ func (x ClusterAuditConfigSpecV2_FIPSEndpointState) String() string {
 }
 
 func (ClusterAuditConfigSpecV2_FIPSEndpointState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{88, 0}
+	return fileDescriptor_9198ee693835762e, []int{94, 0}
 }
 
 // TraceType is an identification of the checkpoint.
@@ -1246,7 +1279,7 @@ func (x ConnectionDiagnosticTrace_TraceType) String() string {
 }
 
 func (ConnectionDiagnosticTrace_TraceType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{272, 0}
+	return fileDescriptor_9198ee693835762e, []int{290, 0}
 }
 
 // StatusType describes whether this was a success or a failure.
@@ -1275,7 +1308,7 @@ func (x ConnectionDiagnosticTrace_StatusType) String() string {
 }
 
 func (ConnectionDiagnosticTrace_StatusType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{272, 1}
+	return fileDescriptor_9198ee693835762e, []int{290, 1}
 }
 
 // OktaAssignmentStatus represents the status of an Okta assignment.
@@ -1315,7 +1348,7 @@ func (x OktaAssignmentSpecV1_OktaAssignmentStatus) String() string {
 }
 
 func (OktaAssignmentSpecV1_OktaAssignmentStatus) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{362, 0}
+	return fileDescriptor_9198ee693835762e, []int{383, 0}
 }
 
 // OktaAssignmentTargetType is the type of Okta object that an assignment is targeting.
@@ -1347,7 +1380,7 @@ func (x OktaAssignmentTargetV1_OktaAssignmentTargetType) String() string {
 }
 
 func (OktaAssignmentTargetV1_OktaAssignmentTargetType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{363, 0}
+	return fileDescriptor_9198ee693835762e, []int{384, 0}
 }
 
 type KeepAlive struct {
@@ -1626,10 +1659,12 @@ type DatabaseServerV3 struct {
 	// Spec is the database server spec.
 	Spec DatabaseServerSpecV3 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
 	// Status is the database server status.
-	Status               DatabaseServerStatusV3 `protobuf:"bytes,6,opt,name=Status,proto3" json:"status"`
-	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
-	XXX_unrecognized     []byte                 `json:"-"`
-	XXX_sizecache        int32                  `json:"-"`
+	Status DatabaseServerStatusV3 `protobuf:"bytes,6,opt,name=Status,proto3" json:"status"`
+	// The advertized scope of the server which can not change once assigned.
+	Scope                string   `protobuf:"bytes,7,opt,name=scope,proto3" json:"scope,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *DatabaseServerV3) Reset()      { *m = DatabaseServerV3{} }
@@ -1677,7 +1712,11 @@ type DatabaseServerSpecV3 struct {
 	// Database is the database proxied by this database server.
 	Database *DatabaseV3 `protobuf:"bytes,12,opt,name=Database,proto3" json:"database,omitempty"`
 	// ProxyIDs is a list of proxy IDs this server is expected to be connected to.
-	ProxyIDs             []string `protobuf:"bytes,13,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	ProxyIDs []string `protobuf:"bytes,13,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	// the name of the Relay group that the server is connected to
+	RelayGroup string `protobuf:"bytes,14,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// the list of Relay host IDs that the server is connected to
+	RelayIds             []string `protobuf:"bytes,15,rep,name=relay_ids,json=relayIds,proto3" json:"relay_ids,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1971,11 +2010,17 @@ func (m *DatabaseAdminUser) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_DatabaseAdminUser proto.InternalMessageInfo
 
-// OracleOptions contains information about privileged database user used
-// for database audit.
+// OracleOptions contains Oracle-specific configuration options.
 type OracleOptions struct {
-	// AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
-	AuditUser            string   `protobuf:"bytes,1,opt,name=AuditUser,proto3" json:"audit_user"`
+	// AuditUser is the name of the Oracle database user that should be used to access
+	// the internal audit trail.
+	AuditUser string `protobuf:"bytes,1,opt,name=AuditUser,proto3" json:"audit_user,omitempty"`
+	// RetryCount is the maximum number of times to retry connecting to a
+	// host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.
+	RetryCount int32 `protobuf:"varint,2,opt,name=RetryCount,proto3" json:"retry_count,omitempty"`
+	// ShuffleHostnames, when true, randomizes the order of hosts to connect to from
+	// the provided list.
+	ShuffleHostnames     bool     `protobuf:"varint,3,opt,name=ShuffleHostnames,proto3" json:"shuffle_hostnames,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -2074,7 +2119,7 @@ type AWS struct {
 	RDS RDS `protobuf:"bytes,3,opt,name=RDS,proto3" json:"rds,omitempty"`
 	// AccountID is the AWS account ID this database belongs to.
 	AccountID string `protobuf:"bytes,4,opt,name=AccountID,proto3" json:"account_id,omitempty"`
-	// ElastiCache contains AWS ElastiCache Redis specific metadata.
+	// ElastiCache contains Amazon ElastiCache Redis-specific metadata.
 	ElastiCache ElastiCache `protobuf:"bytes,5,opt,name=ElastiCache,proto3" json:"elasticache,omitempty"`
 	// SecretStore contains secret store configurations.
 	SecretStore SecretStore `protobuf:"bytes,6,opt,name=SecretStore,proto3" json:"secret_store,omitempty"`
@@ -2082,7 +2127,7 @@ type AWS struct {
 	MemoryDB MemoryDB `protobuf:"bytes,7,opt,name=MemoryDB,proto3" json:"memorydb,omitempty"`
 	// RDSProxy contains AWS Proxy specific metadata.
 	RDSProxy RDSProxy `protobuf:"bytes,8,opt,name=RDSProxy,proto3" json:"rdsproxy,omitempty"`
-	// RedshiftServerless contains AWS Redshift Serverless specific metadata.
+	// RedshiftServerless contains Amazon Redshift Serverless-specific metadata.
 	RedshiftServerless RedshiftServerless `protobuf:"bytes,9,opt,name=RedshiftServerless,proto3" json:"redshift_serverless,omitempty"`
 	// ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
 	ExternalID string `protobuf:"bytes,10,opt,name=ExternalID,proto3" json:"external_id,omitempty"`
@@ -2097,11 +2142,13 @@ type AWS struct {
 	IAMPolicyStatus IAMPolicyStatus `protobuf:"varint,14,opt,name=IAMPolicyStatus,proto3,enum=types.IAMPolicyStatus" json:"iam_policy_status"`
 	// SessionTags is a list of AWS STS session tags.
 	SessionTags map[string]string `protobuf:"bytes,15,rep,name=SessionTags,proto3" json:"session_tags,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	// DocumentDB contains AWS DocumentDB specific metadata.
-	DocumentDB           DocumentDB `protobuf:"bytes,16,opt,name=DocumentDB,proto3" json:"docdb,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
-	XXX_unrecognized     []byte     `json:"-"`
-	XXX_sizecache        int32      `json:"-"`
+	// DocumentDB contains Amazon DocumentDB-specific metadata.
+	DocumentDB DocumentDB `protobuf:"bytes,16,opt,name=DocumentDB,proto3" json:"docdb,omitempty"`
+	// ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.
+	ElastiCacheServerless ElastiCacheServerless `protobuf:"bytes,17,opt,name=ElastiCacheServerless,proto3" json:"elasticache_serverless,omitempty"`
+	XXX_NoUnkeyedLiteral  struct{}              `json:"-"`
+	XXX_unrecognized      []byte                `json:"-"`
+	XXX_sizecache         int32                 `json:"-"`
 }
 
 func (m *AWS) Reset()         { *m = AWS{} }
@@ -2323,7 +2370,7 @@ func (m *RDSProxy) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_RDSProxy proto.InternalMessageInfo
 
-// ElastiCache contains AWS ElastiCache Redis specific metadata.
+// ElastiCache contains Amazon ElastiCache Redis-specific metadata.
 type ElastiCache struct {
 	// ReplicationGroupID is the Redis replication group ID.
 	ReplicationGroupID string `protobuf:"bytes,1,opt,name=ReplicationGroupID,proto3" json:"replication_group_id,omitempty"`
@@ -2371,6 +2418,48 @@ func (m *ElastiCache) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_ElastiCache proto.InternalMessageInfo
 
+// ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.
+type ElastiCacheServerless struct {
+	// CacheName is an ElastiCache Serverless cache name.
+	CacheName            string   `protobuf:"bytes,1,opt,name=CacheName,proto3" json:"cache_name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ElastiCacheServerless) Reset()         { *m = ElastiCacheServerless{} }
+func (m *ElastiCacheServerless) String() string { return proto.CompactTextString(m) }
+func (*ElastiCacheServerless) ProtoMessage()    {}
+func (*ElastiCacheServerless) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{20}
+}
+func (m *ElastiCacheServerless) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ElastiCacheServerless) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ElastiCacheServerless.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ElastiCacheServerless) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ElastiCacheServerless.Merge(m, src)
+}
+func (m *ElastiCacheServerless) XXX_Size() int {
+	return m.Size()
+}
+func (m *ElastiCacheServerless) XXX_DiscardUnknown() {
+	xxx_messageInfo_ElastiCacheServerless.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ElastiCacheServerless proto.InternalMessageInfo
+
 // MemoryDB contains AWS MemoryDB specific metadata.
 type MemoryDB struct {
 	// ClusterName is the name of the MemoryDB cluster.
@@ -2390,7 +2479,7 @@ func (m *MemoryDB) Reset()         { *m = MemoryDB{} }
 func (m *MemoryDB) String() string { return proto.CompactTextString(m) }
 func (*MemoryDB) ProtoMessage()    {}
 func (*MemoryDB) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{20}
+	return fileDescriptor_9198ee693835762e, []int{21}
 }
 func (m *MemoryDB) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2419,7 +2508,7 @@ func (m *MemoryDB) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_MemoryDB proto.InternalMessageInfo
 
-// RedshiftServerless contains AWS Redshift Serverless specific metadata.
+// RedshiftServerless contains Amazon Redshift Serverless-specific metadata.
 type RedshiftServerless struct {
 	// WorkgroupName is the workgroup name.
 	WorkgroupName string `protobuf:"bytes,1,opt,name=WorkgroupName,proto3" json:"workgroup_name,omitempty"`
@@ -2436,7 +2525,7 @@ func (m *RedshiftServerless) Reset()         { *m = RedshiftServerless{} }
 func (m *RedshiftServerless) String() string { return proto.CompactTextString(m) }
 func (*RedshiftServerless) ProtoMessage()    {}
 func (*RedshiftServerless) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{21}
+	return fileDescriptor_9198ee693835762e, []int{22}
 }
 func (m *RedshiftServerless) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2482,7 +2571,7 @@ func (m *OpenSearch) Reset()         { *m = OpenSearch{} }
 func (m *OpenSearch) String() string { return proto.CompactTextString(m) }
 func (*OpenSearch) ProtoMessage()    {}
 func (*OpenSearch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{22}
+	return fileDescriptor_9198ee693835762e, []int{23}
 }
 func (m *OpenSearch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2511,7 +2600,7 @@ func (m *OpenSearch) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_OpenSearch proto.InternalMessageInfo
 
-// DocumentDB contains AWS DocumentDB specific metadata.
+// DocumentDB contains Amazon DocumentDB-specific metadata.
 type DocumentDB struct {
 	// ClusterID is the cluster identifier.
 	ClusterID string `protobuf:"bytes,1,opt,name=ClusterID,proto3" json:"cluster_id,omitempty"`
@@ -2528,7 +2617,7 @@ func (m *DocumentDB) Reset()         { *m = DocumentDB{} }
 func (m *DocumentDB) String() string { return proto.CompactTextString(m) }
 func (*DocumentDB) ProtoMessage()    {}
 func (*DocumentDB) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{23}
+	return fileDescriptor_9198ee693835762e, []int{24}
 }
 func (m *DocumentDB) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2557,12 +2646,15 @@ func (m *DocumentDB) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_DocumentDB proto.InternalMessageInfo
 
-// GCPCloudSQL contains parameters specific to GCP Cloud SQL databases.
+// GCPCloudSQL contains parameters specific to GCP databases.
+// The name "GCPCloudSQL" is a legacy from a time when only GCP Cloud SQL was supported.
 type GCPCloudSQL struct {
 	// ProjectID is the GCP project ID the Cloud SQL instance resides in.
 	ProjectID string `protobuf:"bytes,1,opt,name=ProjectID,proto3" json:"project_id,omitempty"`
 	// InstanceID is the Cloud SQL instance ID.
-	InstanceID           string   `protobuf:"bytes,2,opt,name=InstanceID,proto3" json:"instance_id,omitempty"`
+	InstanceID string `protobuf:"bytes,2,opt,name=InstanceID,proto3" json:"instance_id,omitempty"`
+	// AlloyDB contains AlloyDB specific configuration elements.
+	AlloyDB              AlloyDB  `protobuf:"bytes,3,opt,name=AlloyDB,proto3" json:"alloydb,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -2572,7 +2664,7 @@ func (m *GCPCloudSQL) Reset()         { *m = GCPCloudSQL{} }
 func (m *GCPCloudSQL) String() string { return proto.CompactTextString(m) }
 func (*GCPCloudSQL) ProtoMessage()    {}
 func (*GCPCloudSQL) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{24}
+	return fileDescriptor_9198ee693835762e, []int{25}
 }
 func (m *GCPCloudSQL) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2601,6 +2693,50 @@ func (m *GCPCloudSQL) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_GCPCloudSQL proto.InternalMessageInfo
 
+// AlloyDB contains AlloyDB specific configuration elements.
+type AlloyDB struct {
+	// EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".
+	EndpointType string `protobuf:"bytes,1,opt,name=EndpointType,proto3" json:"endpoint_type,omitempty"`
+	// EndpointOverride is an override of endpoint address to use.
+	EndpointOverride     string   `protobuf:"bytes,2,opt,name=EndpointOverride,proto3" json:"endpoint_override,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AlloyDB) Reset()         { *m = AlloyDB{} }
+func (m *AlloyDB) String() string { return proto.CompactTextString(m) }
+func (*AlloyDB) ProtoMessage()    {}
+func (*AlloyDB) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{26}
+}
+func (m *AlloyDB) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AlloyDB) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AlloyDB.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AlloyDB) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AlloyDB.Merge(m, src)
+}
+func (m *AlloyDB) XXX_Size() int {
+	return m.Size()
+}
+func (m *AlloyDB) XXX_DiscardUnknown() {
+	xxx_messageInfo_AlloyDB.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AlloyDB proto.InternalMessageInfo
+
 // Azure contains Azure specific database metadata.
 type Azure struct {
 	// Name is the Azure database server name.
@@ -2620,7 +2756,7 @@ func (m *Azure) Reset()         { *m = Azure{} }
 func (m *Azure) String() string { return proto.CompactTextString(m) }
 func (*Azure) ProtoMessage()    {}
 func (*Azure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{25}
+	return fileDescriptor_9198ee693835762e, []int{27}
 }
 func (m *Azure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2662,7 +2798,7 @@ func (m *AzureRedis) Reset()         { *m = AzureRedis{} }
 func (m *AzureRedis) String() string { return proto.CompactTextString(m) }
 func (*AzureRedis) ProtoMessage()    {}
 func (*AzureRedis) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{26}
+	return fileDescriptor_9198ee693835762e, []int{28}
 }
 func (m *AzureRedis) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2718,7 +2854,7 @@ func (m *AD) Reset()         { *m = AD{} }
 func (m *AD) String() string { return proto.CompactTextString(m) }
 func (*AD) ProtoMessage()    {}
 func (*AD) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{27}
+	return fileDescriptor_9198ee693835762e, []int{29}
 }
 func (m *AD) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2774,7 +2910,7 @@ func (m *DatabaseTLS) Reset()         { *m = DatabaseTLS{} }
 func (m *DatabaseTLS) String() string { return proto.CompactTextString(m) }
 func (*DatabaseTLS) ProtoMessage()    {}
 func (*DatabaseTLS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{28}
+	return fileDescriptor_9198ee693835762e, []int{30}
 }
 func (m *DatabaseTLS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2817,7 +2953,7 @@ func (m *MySQLOptions) Reset()         { *m = MySQLOptions{} }
 func (m *MySQLOptions) String() string { return proto.CompactTextString(m) }
 func (*MySQLOptions) ProtoMessage()    {}
 func (*MySQLOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{29}
+	return fileDescriptor_9198ee693835762e, []int{31}
 }
 func (m *MySQLOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2859,7 +2995,7 @@ func (m *MongoAtlas) Reset()         { *m = MongoAtlas{} }
 func (m *MongoAtlas) String() string { return proto.CompactTextString(m) }
 func (*MongoAtlas) ProtoMessage()    {}
 func (*MongoAtlas) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{30}
+	return fileDescriptor_9198ee693835762e, []int{32}
 }
 func (m *MongoAtlas) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2902,7 +3038,7 @@ func (m *InstanceV1) Reset()         { *m = InstanceV1{} }
 func (m *InstanceV1) String() string { return proto.CompactTextString(m) }
 func (*InstanceV1) ProtoMessage()    {}
 func (*InstanceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{31}
+	return fileDescriptor_9198ee693835762e, []int{33}
 }
 func (m *InstanceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2963,7 +3099,7 @@ func (m *InstanceSpecV1) Reset()         { *m = InstanceSpecV1{} }
 func (m *InstanceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*InstanceSpecV1) ProtoMessage()    {}
 func (*InstanceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{32}
+	return fileDescriptor_9198ee693835762e, []int{34}
 }
 func (m *InstanceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3009,7 +3145,7 @@ func (m *SystemClockMeasurement) Reset()         { *m = SystemClockMeasurement{}
 func (m *SystemClockMeasurement) String() string { return proto.CompactTextString(m) }
 func (*SystemClockMeasurement) ProtoMessage()    {}
 func (*SystemClockMeasurement) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{33}
+	return fileDescriptor_9198ee693835762e, []int{35}
 }
 func (m *SystemClockMeasurement) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3079,7 +3215,7 @@ func (m *InstanceControlLogEntry) Reset()         { *m = InstanceControlLogEntry
 func (m *InstanceControlLogEntry) String() string { return proto.CompactTextString(m) }
 func (*InstanceControlLogEntry) ProtoMessage()    {}
 func (*InstanceControlLogEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{34}
+	return fileDescriptor_9198ee693835762e, []int{36}
 }
 func (m *InstanceControlLogEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3133,7 +3269,7 @@ func (m *UpdaterV2Info) Reset()         { *m = UpdaterV2Info{} }
 func (m *UpdaterV2Info) String() string { return proto.CompactTextString(m) }
 func (*UpdaterV2Info) ProtoMessage()    {}
 func (*UpdaterV2Info) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{35}
+	return fileDescriptor_9198ee693835762e, []int{37}
 }
 func (m *UpdaterV2Info) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3191,7 +3327,7 @@ func (m *InstanceFilter) Reset()         { *m = InstanceFilter{} }
 func (m *InstanceFilter) String() string { return proto.CompactTextString(m) }
 func (*InstanceFilter) ProtoMessage()    {}
 func (*InstanceFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{36}
+	return fileDescriptor_9198ee693835762e, []int{38}
 }
 func (m *InstanceFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3231,16 +3367,18 @@ type ServerV2 struct {
 	// Metadata is resource metadata
 	Metadata Metadata `protobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"`
 	// Spec is a server spec
-	Spec                 ServerSpecV2 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
-	XXX_NoUnkeyedLiteral struct{}     `json:"-"`
-	XXX_unrecognized     []byte       `json:"-"`
-	XXX_sizecache        int32        `json:"-"`
+	Spec ServerSpecV2 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
+	// The advertized scope of the server which can not change once assigned.
+	Scope                string   `protobuf:"bytes,6,opt,name=scope,proto3" json:"scope,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *ServerV2) Reset()      { *m = ServerV2{} }
 func (*ServerV2) ProtoMessage() {}
 func (*ServerV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{37}
+	return fileDescriptor_9198ee693835762e, []int{39}
 }
 func (m *ServerV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3295,7 +3433,13 @@ type ServerSpecV2 struct {
 	CloudMetadata *CloudMetadata `protobuf:"bytes,14,opt,name=CloudMetadata,proto3" json:"cloud_metadata,omitempty"`
 	// GitHub contains info about GitHub proxies where each server represents a
 	// GitHub organization.
-	GitHub               *GitHubServerMetadata `protobuf:"bytes,15,opt,name=git_hub,json=gitHub,proto3" json:"github,omitempty"`
+	GitHub *GitHubServerMetadata `protobuf:"bytes,15,opt,name=git_hub,json=gitHub,proto3" json:"github,omitempty"`
+	// the name of the Relay group that the server is connected to
+	RelayGroup string `protobuf:"bytes,16,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// the list of Relay host IDs that the server is connected to
+	RelayIds []string `protobuf:"bytes,17,rep,name=relay_ids,json=relayIds,proto3" json:"relay_ids,omitempty"`
+	// component_features represents features supported by this server
+	ComponentFeatures    *v1.ComponentFeatures `protobuf:"bytes,18,opt,name=component_features,json=componentFeatures,proto3" json:"component_features,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}              `json:"-"`
 	XXX_unrecognized     []byte                `json:"-"`
 	XXX_sizecache        int32                 `json:"-"`
@@ -3305,7 +3449,7 @@ func (m *ServerSpecV2) Reset()         { *m = ServerSpecV2{} }
 func (m *ServerSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ServerSpecV2) ProtoMessage()    {}
 func (*ServerSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{38}
+	return fileDescriptor_9198ee693835762e, []int{40}
 }
 func (m *ServerSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3359,7 +3503,7 @@ func (m *AWSInfo) Reset()         { *m = AWSInfo{} }
 func (m *AWSInfo) String() string { return proto.CompactTextString(m) }
 func (*AWSInfo) ProtoMessage()    {}
 func (*AWSInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{39}
+	return fileDescriptor_9198ee693835762e, []int{41}
 }
 func (m *AWSInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3402,7 +3546,7 @@ func (m *CloudMetadata) Reset()         { *m = CloudMetadata{} }
 func (m *CloudMetadata) String() string { return proto.CompactTextString(m) }
 func (*CloudMetadata) ProtoMessage()    {}
 func (*CloudMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{40}
+	return fileDescriptor_9198ee693835762e, []int{42}
 }
 func (m *CloudMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3447,7 +3591,7 @@ func (m *GitHubServerMetadata) Reset()         { *m = GitHubServerMetadata{} }
 func (m *GitHubServerMetadata) String() string { return proto.CompactTextString(m) }
 func (*GitHubServerMetadata) ProtoMessage()    {}
 func (*GitHubServerMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{41}
+	return fileDescriptor_9198ee693835762e, []int{43}
 }
 func (m *GitHubServerMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3487,16 +3631,18 @@ type AppServerV3 struct {
 	// Metadata is the app server metadata.
 	Metadata Metadata `protobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"`
 	// Spec is the app server spec.
-	Spec                 AppServerSpecV3 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
-	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
-	XXX_unrecognized     []byte          `json:"-"`
-	XXX_sizecache        int32           `json:"-"`
+	Spec AppServerSpecV3 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
+	// The advertized scope of the server which can not change once assigned.
+	Scope                string   `protobuf:"bytes,6,opt,name=scope,proto3" json:"scope,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *AppServerV3) Reset()      { *m = AppServerV3{} }
 func (*AppServerV3) ProtoMessage() {}
 func (*AppServerV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{42}
+	return fileDescriptor_9198ee693835762e, []int{44}
 }
 func (m *AppServerV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3538,17 +3684,23 @@ type AppServerSpecV3 struct {
 	// App is the app proxied by this app server.
 	App *AppV3 `protobuf:"bytes,5,opt,name=App,proto3" json:"app"`
 	// ProxyIDs is a list of proxy IDs this server is expected to be connected to.
-	ProxyIDs             []string `protobuf:"bytes,6,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	ProxyIDs []string `protobuf:"bytes,6,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	// the name of the Relay group that the server is connected to
+	RelayGroup string `protobuf:"bytes,7,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// the list of Relay host IDs that the server is connected to
+	RelayIds []string `protobuf:"bytes,8,rep,name=relay_ids,json=relayIds,proto3" json:"relay_ids,omitempty"`
+	// component_features contains features supported by this app server.
+	ComponentFeatures    *v1.ComponentFeatures `protobuf:"bytes,9,opt,name=component_features,json=componentFeatures,proto3" json:"component_features,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+	XXX_unrecognized     []byte                `json:"-"`
+	XXX_sizecache        int32                 `json:"-"`
 }
 
 func (m *AppServerSpecV3) Reset()         { *m = AppServerSpecV3{} }
 func (m *AppServerSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AppServerSpecV3) ProtoMessage()    {}
 func (*AppServerSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{43}
+	return fileDescriptor_9198ee693835762e, []int{45}
 }
 func (m *AppServerSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3590,7 +3742,7 @@ func (m *AppV3List) Reset()         { *m = AppV3List{} }
 func (m *AppV3List) String() string { return proto.CompactTextString(m) }
 func (*AppV3List) ProtoMessage()    {}
 func (*AppV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{44}
+	return fileDescriptor_9198ee693835762e, []int{46}
 }
 func (m *AppV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3640,7 +3792,7 @@ type AppV3 struct {
 func (m *AppV3) Reset()      { *m = AppV3{} }
 func (*AppV3) ProtoMessage() {}
 func (*AppV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{45}
+	return fileDescriptor_9198ee693835762e, []int{47}
 }
 func (m *AppV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3692,7 +3844,7 @@ func (m *CORSPolicy) Reset()         { *m = CORSPolicy{} }
 func (m *CORSPolicy) String() string { return proto.CompactTextString(m) }
 func (*CORSPolicy) ProtoMessage()    {}
 func (*CORSPolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{46}
+	return fileDescriptor_9198ee693835762e, []int{48}
 }
 func (m *CORSPolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3740,7 +3892,7 @@ func (m *IdentityCenterPermissionSet) Reset()         { *m = IdentityCenterPermi
 func (m *IdentityCenterPermissionSet) String() string { return proto.CompactTextString(m) }
 func (*IdentityCenterPermissionSet) ProtoMessage()    {}
 func (*IdentityCenterPermissionSet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{47}
+	return fileDescriptor_9198ee693835762e, []int{49}
 }
 func (m *IdentityCenterPermissionSet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3785,7 +3937,7 @@ func (m *AppIdentityCenter) Reset()         { *m = AppIdentityCenter{} }
 func (m *AppIdentityCenter) String() string { return proto.CompactTextString(m) }
 func (*AppIdentityCenter) ProtoMessage()    {}
 func (*AppIdentityCenter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{48}
+	return fileDescriptor_9198ee693835762e, []int{50}
 }
 func (m *AppIdentityCenter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3853,17 +4005,19 @@ type AppSpecV3 struct {
 	// request originated from. This should be true if your proxy has multiple proxy public addrs and you
 	// want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec,
 	// setting this value to true will overwrite that public address in the web UI.
-	UseAnyProxyPublicAddr bool     `protobuf:"varint,14,opt,name=UseAnyProxyPublicAddr,proto3" json:"use_any_proxy_public_addr,omitempty"`
-	XXX_NoUnkeyedLiteral  struct{} `json:"-"`
-	XXX_unrecognized      []byte   `json:"-"`
-	XXX_sizecache         int32    `json:"-"`
+	UseAnyProxyPublicAddr bool `protobuf:"varint,14,opt,name=UseAnyProxyPublicAddr,proto3" json:"use_any_proxy_public_addr,omitempty"`
+	// MCP contains MCP server related configurations.
+	MCP                  *MCP     `protobuf:"bytes,15,opt,name=MCP,proto3" json:"mcp,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *AppSpecV3) Reset()         { *m = AppSpecV3{} }
 func (m *AppSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AppSpecV3) ProtoMessage()    {}
 func (*AppSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{49}
+	return fileDescriptor_9198ee693835762e, []int{51}
 }
 func (m *AppSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3892,6 +4046,53 @@ func (m *AppSpecV3) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AppSpecV3 proto.InternalMessageInfo
 
+// MCP contains MCP server-related configurations.
+type MCP struct {
+	// Command to launch stdio-based MCP servers.
+	Command string `protobuf:"bytes,1,opt,name=command,proto3" json:"command,omitempty"`
+	// Args to execute with the command.
+	Args []string `protobuf:"bytes,2,rep,name=args,proto3" json:"args,omitempty"`
+	// RunAsHostUser is the host user account under which the command will be
+	// executed. Required for stdio-based MCP servers.
+	RunAsHostUser        string   `protobuf:"bytes,3,opt,name=run_as_host_user,json=runAsHostUser,proto3" json:"run_as_host_user,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *MCP) Reset()         { *m = MCP{} }
+func (m *MCP) String() string { return proto.CompactTextString(m) }
+func (*MCP) ProtoMessage()    {}
+func (*MCP) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{52}
+}
+func (m *MCP) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCP) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCP.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *MCP) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCP.Merge(m, src)
+}
+func (m *MCP) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCP) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCP.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MCP proto.InternalMessageInfo
+
 // Rewrite is a list of rewriting rules to apply to requests and responses.
 type Rewrite struct {
 	// Redirect defines a list of hosts which will be rewritten to the public
@@ -3911,7 +4112,7 @@ func (m *Rewrite) Reset()         { *m = Rewrite{} }
 func (m *Rewrite) String() string { return proto.CompactTextString(m) }
 func (*Rewrite) ProtoMessage()    {}
 func (*Rewrite) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{50}
+	return fileDescriptor_9198ee693835762e, []int{53}
 }
 func (m *Rewrite) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3955,7 +4156,7 @@ func (m *Header) Reset()         { *m = Header{} }
 func (m *Header) String() string { return proto.CompactTextString(m) }
 func (*Header) ProtoMessage()    {}
 func (*Header) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{51}
+	return fileDescriptor_9198ee693835762e, []int{54}
 }
 func (m *Header) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4002,7 +4203,7 @@ type PortRange struct {
 func (m *PortRange) Reset()      { *m = PortRange{} }
 func (*PortRange) ProtoMessage() {}
 func (*PortRange) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{52}
+	return fileDescriptor_9198ee693835762e, []int{55}
 }
 func (m *PortRange) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4049,7 +4250,7 @@ func (m *CommandLabelV2) Reset()         { *m = CommandLabelV2{} }
 func (m *CommandLabelV2) String() string { return proto.CompactTextString(m) }
 func (*CommandLabelV2) ProtoMessage()    {}
 func (*CommandLabelV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{53}
+	return fileDescriptor_9198ee693835762e, []int{56}
 }
 func (m *CommandLabelV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4094,7 +4295,7 @@ func (m *AppAWS) Reset()         { *m = AppAWS{} }
 func (m *AppAWS) String() string { return proto.CompactTextString(m) }
 func (*AppAWS) ProtoMessage()    {}
 func (*AppAWS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{54}
+	return fileDescriptor_9198ee693835762e, []int{57}
 }
 func (m *AppAWS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4142,7 +4343,7 @@ func (m *AppAWSRolesAnywhereProfile) Reset()         { *m = AppAWSRolesAnywhereP
 func (m *AppAWSRolesAnywhereProfile) String() string { return proto.CompactTextString(m) }
 func (*AppAWSRolesAnywhereProfile) ProtoMessage()    {}
 func (*AppAWSRolesAnywhereProfile) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{55}
+	return fileDescriptor_9198ee693835762e, []int{58}
 }
 func (m *AppAWSRolesAnywhereProfile) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4188,7 +4389,7 @@ func (m *SSHKeyPair) Reset()         { *m = SSHKeyPair{} }
 func (m *SSHKeyPair) String() string { return proto.CompactTextString(m) }
 func (*SSHKeyPair) ProtoMessage()    {}
 func (*SSHKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{56}
+	return fileDescriptor_9198ee693835762e, []int{59}
 }
 func (m *SSHKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4224,17 +4425,19 @@ type TLSKeyPair struct {
 	// Key is a PEM encoded TLS key
 	Key []byte `protobuf:"bytes,2,opt,name=Key,proto3" json:"key,omitempty"`
 	// KeyType is the type of the Key.
-	KeyType              PrivateKeyType `protobuf:"varint,3,opt,name=KeyType,proto3,enum=types.PrivateKeyType" json:"key_type,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
-	XXX_unrecognized     []byte         `json:"-"`
-	XXX_sizecache        int32          `json:"-"`
+	KeyType PrivateKeyType `protobuf:"varint,3,opt,name=KeyType,proto3,enum=types.PrivateKeyType" json:"key_type,omitempty"`
+	// CRL is an empty DER-encoded revocation list.
+	CRL                  []byte   `protobuf:"bytes,4,opt,name=CRL,proto3" json:"crl"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *TLSKeyPair) Reset()         { *m = TLSKeyPair{} }
 func (m *TLSKeyPair) String() string { return proto.CompactTextString(m) }
 func (*TLSKeyPair) ProtoMessage()    {}
 func (*TLSKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{57}
+	return fileDescriptor_9198ee693835762e, []int{60}
 }
 func (m *TLSKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4280,7 +4483,7 @@ func (m *JWTKeyPair) Reset()         { *m = JWTKeyPair{} }
 func (m *JWTKeyPair) String() string { return proto.CompactTextString(m) }
 func (*JWTKeyPair) ProtoMessage()    {}
 func (*JWTKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{58}
+	return fileDescriptor_9198ee693835762e, []int{61}
 }
 func (m *JWTKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4309,6 +4512,97 @@ func (m *JWTKeyPair) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_JWTKeyPair proto.InternalMessageInfo
 
+// EncryptionKeyPair is a PKIX ASN.1 DER encoded keypair used for encrypting and decrypting data.
+type EncryptionKeyPair struct {
+	// PublicKey is a PKIX ASN.1 DER encoded public key.
+	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	// PrivateKey is a PKCS#8 ASN.1 DER encoded private key.
+	PrivateKey []byte `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
+	// PrivateKeyType is the type of the PrivateKey.
+	PrivateKeyType PrivateKeyType `protobuf:"varint,3,opt,name=private_key_type,json=privateKeyType,proto3,enum=types.PrivateKeyType" json:"private_key_type,omitempty"`
+	// Hash function used during OAEP encryption/decryption. It maps directly to the possible
+	// values of [crypto.Hash] in the go crypto package.
+	Hash                 uint32   `protobuf:"varint,4,opt,name=hash,proto3" json:"hash,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *EncryptionKeyPair) Reset()         { *m = EncryptionKeyPair{} }
+func (m *EncryptionKeyPair) String() string { return proto.CompactTextString(m) }
+func (*EncryptionKeyPair) ProtoMessage()    {}
+func (*EncryptionKeyPair) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{62}
+}
+func (m *EncryptionKeyPair) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *EncryptionKeyPair) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_EncryptionKeyPair.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *EncryptionKeyPair) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_EncryptionKeyPair.Merge(m, src)
+}
+func (m *EncryptionKeyPair) XXX_Size() int {
+	return m.Size()
+}
+func (m *EncryptionKeyPair) XXX_DiscardUnknown() {
+	xxx_messageInfo_EncryptionKeyPair.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EncryptionKeyPair proto.InternalMessageInfo
+
+// A public key to be used as a recipient during age encryption of session recordings.
+type AgeEncryptionKey struct {
+	// A PKIX ASN.1 DER encoded public key used for key wrapping during age encryption. Expected to be RSA 4096.
+	PublicKey            []byte   `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AgeEncryptionKey) Reset()         { *m = AgeEncryptionKey{} }
+func (m *AgeEncryptionKey) String() string { return proto.CompactTextString(m) }
+func (*AgeEncryptionKey) ProtoMessage()    {}
+func (*AgeEncryptionKey) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{63}
+}
+func (m *AgeEncryptionKey) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AgeEncryptionKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AgeEncryptionKey.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AgeEncryptionKey) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AgeEncryptionKey.Merge(m, src)
+}
+func (m *AgeEncryptionKey) XXX_Size() int {
+	return m.Size()
+}
+func (m *AgeEncryptionKey) XXX_DiscardUnknown() {
+	xxx_messageInfo_AgeEncryptionKey.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AgeEncryptionKey proto.InternalMessageInfo
+
 // CertAuthorityV2 is version 2 resource spec for Cert Authority
 type CertAuthorityV2 struct {
 	// Kind is a resource kind
@@ -4329,7 +4623,7 @@ type CertAuthorityV2 struct {
 func (m *CertAuthorityV2) Reset()      { *m = CertAuthorityV2{} }
 func (*CertAuthorityV2) ProtoMessage() {}
 func (*CertAuthorityV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{59}
+	return fileDescriptor_9198ee693835762e, []int{64}
 }
 func (m *CertAuthorityV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4390,7 +4684,7 @@ func (m *CertAuthoritySpecV2) Reset()         { *m = CertAuthoritySpecV2{} }
 func (m *CertAuthoritySpecV2) String() string { return proto.CompactTextString(m) }
 func (*CertAuthoritySpecV2) ProtoMessage()    {}
 func (*CertAuthoritySpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{60}
+	return fileDescriptor_9198ee693835762e, []int{65}
 }
 func (m *CertAuthoritySpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4436,7 +4730,7 @@ func (m *CAKeySet) Reset()         { *m = CAKeySet{} }
 func (m *CAKeySet) String() string { return proto.CompactTextString(m) }
 func (*CAKeySet) ProtoMessage()    {}
 func (*CAKeySet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{61}
+	return fileDescriptor_9198ee693835762e, []int{66}
 }
 func (m *CAKeySet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4481,7 +4775,7 @@ func (m *RoleMapping) Reset()         { *m = RoleMapping{} }
 func (m *RoleMapping) String() string { return proto.CompactTextString(m) }
 func (*RoleMapping) ProtoMessage()    {}
 func (*RoleMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{62}
+	return fileDescriptor_9198ee693835762e, []int{67}
 }
 func (m *RoleMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4529,7 +4823,7 @@ type ProvisionTokenV1 struct {
 func (m *ProvisionTokenV1) Reset()      { *m = ProvisionTokenV1{} }
 func (*ProvisionTokenV1) ProtoMessage() {}
 func (*ProvisionTokenV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{63}
+	return fileDescriptor_9198ee693835762e, []int{68}
 }
 func (m *ProvisionTokenV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4582,7 +4876,7 @@ type ProvisionTokenV2 struct {
 func (m *ProvisionTokenV2) Reset()      { *m = ProvisionTokenV2{} }
 func (*ProvisionTokenV2) ProtoMessage() {}
 func (*ProvisionTokenV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{64}
+	return fileDescriptor_9198ee693835762e, []int{69}
 }
 func (m *ProvisionTokenV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4624,7 +4918,7 @@ func (m *ProvisionTokenV2List) Reset()         { *m = ProvisionTokenV2List{} }
 func (m *ProvisionTokenV2List) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenV2List) ProtoMessage()    {}
 func (*ProvisionTokenV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{65}
+	return fileDescriptor_9198ee693835762e, []int{70}
 }
 func (m *ProvisionTokenV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4676,7 +4970,7 @@ func (m *TokenRule) Reset()         { *m = TokenRule{} }
 func (m *TokenRule) String() string { return proto.CompactTextString(m) }
 func (*TokenRule) ProtoMessage()    {}
 func (*TokenRule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{66}
+	return fileDescriptor_9198ee693835762e, []int{71}
 }
 func (m *TokenRule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4756,17 +5050,19 @@ type ProvisionTokenSpecV2 struct {
 	// BoundKeypair allows the configuration of options specific to the "bound_keypair" join method.
 	BoundKeypair *ProvisionTokenSpecV2BoundKeypair `protobuf:"bytes,19,opt,name=BoundKeypair,proto3" json:"bound_keypair,omitempty"`
 	// AzureDevops allows the configuration of options specific to the "azure_devops" join method.
-	AzureDevops          *ProvisionTokenSpecV2AzureDevops `protobuf:"bytes,20,opt,name=AzureDevops,proto3" json:"azure_devops,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}                         `json:"-"`
-	XXX_unrecognized     []byte                           `json:"-"`
-	XXX_sizecache        int32                            `json:"-"`
+	AzureDevops *ProvisionTokenSpecV2AzureDevops `protobuf:"bytes,20,opt,name=AzureDevops,proto3" json:"azure_devops,omitempty"`
+	// Env0 allows the configuration of options specific to the "env0" join method.
+	Env0                 *ProvisionTokenSpecV2Env0 `protobuf:"bytes,21,opt,name=Env0,proto3" json:"env0,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                  `json:"-"`
+	XXX_unrecognized     []byte                    `json:"-"`
+	XXX_sizecache        int32                     `json:"-"`
 }
 
 func (m *ProvisionTokenSpecV2) Reset()         { *m = ProvisionTokenSpecV2{} }
 func (m *ProvisionTokenSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{67}
+	return fileDescriptor_9198ee693835762e, []int{72}
 }
 func (m *ProvisionTokenSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4815,7 +5111,7 @@ func (m *ProvisionTokenSpecV2AzureDevops) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2AzureDevops) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2AzureDevops) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2AzureDevops) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{68}
+	return fileDescriptor_9198ee693835762e, []int{73}
 }
 func (m *ProvisionTokenSpecV2AzureDevops) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4887,7 +5183,7 @@ func (m *ProvisionTokenSpecV2AzureDevops_Rule) Reset()         { *m = ProvisionT
 func (m *ProvisionTokenSpecV2AzureDevops_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2AzureDevops_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2AzureDevops_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{68, 0}
+	return fileDescriptor_9198ee693835762e, []int{73, 0}
 }
 func (m *ProvisionTokenSpecV2AzureDevops_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4939,7 +5235,7 @@ func (m *ProvisionTokenSpecV2TPM) Reset()         { *m = ProvisionTokenSpecV2TPM
 func (m *ProvisionTokenSpecV2TPM) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2TPM) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2TPM) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{69}
+	return fileDescriptor_9198ee693835762e, []int{74}
 }
 func (m *ProvisionTokenSpecV2TPM) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4995,7 +5291,7 @@ func (m *ProvisionTokenSpecV2TPM_Rule) Reset()         { *m = ProvisionTokenSpec
 func (m *ProvisionTokenSpecV2TPM_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2TPM_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2TPM_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{69, 0}
+	return fileDescriptor_9198ee693835762e, []int{74, 0}
 }
 func (m *ProvisionTokenSpecV2TPM_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5064,7 +5360,7 @@ func (m *ProvisionTokenSpecV2GitHub) Reset()         { *m = ProvisionTokenSpecV2
 func (m *ProvisionTokenSpecV2GitHub) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitHub) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitHub) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{70}
+	return fileDescriptor_9198ee693835762e, []int{75}
 }
 func (m *ProvisionTokenSpecV2GitHub) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5126,7 +5422,7 @@ func (m *ProvisionTokenSpecV2GitHub_Rule) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2GitHub_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitHub_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitHub_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{70, 0}
+	return fileDescriptor_9198ee693835762e, []int{75, 0}
 }
 func (m *ProvisionTokenSpecV2GitHub_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5179,7 +5475,7 @@ func (m *ProvisionTokenSpecV2GitLab) Reset()         { *m = ProvisionTokenSpecV2
 func (m *ProvisionTokenSpecV2GitLab) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitLab) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitLab) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{71}
+	return fileDescriptor_9198ee693835762e, []int{76}
 }
 func (m *ProvisionTokenSpecV2GitLab) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5281,7 +5577,7 @@ func (m *ProvisionTokenSpecV2GitLab_Rule) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2GitLab_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitLab_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitLab_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{71, 0}
+	return fileDescriptor_9198ee693835762e, []int{76, 0}
 }
 func (m *ProvisionTokenSpecV2GitLab_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5326,7 +5622,7 @@ func (m *ProvisionTokenSpecV2CircleCI) Reset()         { *m = ProvisionTokenSpec
 func (m *ProvisionTokenSpecV2CircleCI) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2CircleCI) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2CircleCI) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{72}
+	return fileDescriptor_9198ee693835762e, []int{77}
 }
 func (m *ProvisionTokenSpecV2CircleCI) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5367,7 +5663,7 @@ func (m *ProvisionTokenSpecV2CircleCI_Rule) Reset()         { *m = ProvisionToke
 func (m *ProvisionTokenSpecV2CircleCI_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2CircleCI_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2CircleCI_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{72, 0}
+	return fileDescriptor_9198ee693835762e, []int{77, 0}
 }
 func (m *ProvisionTokenSpecV2CircleCI_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5404,7 +5700,10 @@ type ProvisionTokenSpecV2Spacelift struct {
 	Allow []*ProvisionTokenSpecV2Spacelift_Rule `protobuf:"bytes,1,rep,name=Allow,proto3" json:"allow,omitempty"`
 	// Hostname is the hostname of the Spacelift tenant that tokens
 	// will originate from. E.g `example.app.spacelift.io`
-	Hostname             string   `protobuf:"bytes,2,opt,name=Hostname,proto3" json:"hostname,omitempty"`
+	Hostname string `protobuf:"bytes,2,opt,name=Hostname,proto3" json:"hostname,omitempty"`
+	// EnableGlobMatching enables glob-style matching for the space_id and
+	// caller_id fields in the rules.
+	EnableGlobMatching   bool     `protobuf:"varint,3,opt,name=EnableGlobMatching,proto3" json:"enable_glob_matching,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -5414,7 +5713,7 @@ func (m *ProvisionTokenSpecV2Spacelift) Reset()         { *m = ProvisionTokenSpe
 func (m *ProvisionTokenSpecV2Spacelift) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Spacelift) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Spacelift) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{73}
+	return fileDescriptor_9198ee693835762e, []int{78}
 }
 func (m *ProvisionTokenSpecV2Spacelift) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5446,9 +5745,17 @@ var xxx_messageInfo_ProvisionTokenSpecV2Spacelift proto.InternalMessageInfo
 type ProvisionTokenSpecV2Spacelift_Rule struct {
 	// SpaceID is the ID of the space in which the run that owns the token was
 	// executed.
+	//
+	// This field supports "glob-style" matching when enable_glob_matching is true:
+	// - Use '*' to match zero or more characters.
+	// - Use '?' to match any single character.
 	SpaceID string `protobuf:"bytes,1,opt,name=SpaceID,proto3" json:"space_id,omitempty"`
 	// CallerID is the ID of the caller, ie. the stack or module that generated
 	// the run.
+	//
+	// This field supports "glob-style" matching when enable_glob_matching is true:
+	// - Use '*' to match zero or more characters.
+	// - Use '?' to match any single character.
 	CallerID string `protobuf:"bytes,2,opt,name=CallerID,proto3" json:"caller_id,omitempty"`
 	// CallerType is the type of the caller, ie. the entity that owns the run -
 	// either `stack` or `module`.
@@ -5465,7 +5772,7 @@ func (m *ProvisionTokenSpecV2Spacelift_Rule) Reset()         { *m = ProvisionTok
 func (m *ProvisionTokenSpecV2Spacelift_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Spacelift_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Spacelift_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{73, 0}
+	return fileDescriptor_9198ee693835762e, []int{78, 0}
 }
 func (m *ProvisionTokenSpecV2Spacelift_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5504,20 +5811,23 @@ type ProvisionTokenSpecV2Kubernetes struct {
 	// Service Account token. Support values:
 	// - `in_cluster`
 	// - `static_jwks`
+	// - `oidc`
 	// If unset, this defaults to `in_cluster`.
 	Type KubernetesJoinType `protobuf:"bytes,2,opt,name=Type,proto3,casttype=KubernetesJoinType" json:"type,omitempty"`
 	// StaticJWKS is the configuration specific to the `static_jwks` type.
-	StaticJWKS           *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig `protobuf:"bytes,3,opt,name=StaticJWKS,proto3" json:"static_jwks,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}                                         `json:"-"`
-	XXX_unrecognized     []byte                                           `json:"-"`
-	XXX_sizecache        int32                                            `json:"-"`
+	StaticJWKS *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig `protobuf:"bytes,3,opt,name=StaticJWKS,proto3" json:"static_jwks,omitempty"`
+	// OIDCConfig configures the `oidc` type.
+	OIDC                 *ProvisionTokenSpecV2Kubernetes_OIDCConfig `protobuf:"bytes,4,opt,name=OIDC,proto3" json:"oidc,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                   `json:"-"`
+	XXX_unrecognized     []byte                                     `json:"-"`
+	XXX_sizecache        int32                                      `json:"-"`
 }
 
 func (m *ProvisionTokenSpecV2Kubernetes) Reset()         { *m = ProvisionTokenSpecV2Kubernetes{} }
 func (m *ProvisionTokenSpecV2Kubernetes) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Kubernetes) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Kubernetes) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{74}
+	return fileDescriptor_9198ee693835762e, []int{79}
 }
 func (m *ProvisionTokenSpecV2Kubernetes) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5564,7 +5874,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) String() string {
 }
 func (*ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) ProtoMessage() {}
 func (*ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{74, 0}
+	return fileDescriptor_9198ee693835762e, []int{79, 0}
 }
 func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5593,6 +5903,58 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig proto.InternalMessageInfo
 
+type ProvisionTokenSpecV2Kubernetes_OIDCConfig struct {
+	// Issuer is the URI of the OIDC issuer. It must have an accessible and
+	// OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should
+	// be a valid URL and must exactly match the `issuer` field in a service
+	// account JWT. For example:
+	// https://oidc.eks.us-west-2.amazonaws.com/id/12345...
+	Issuer string `protobuf:"bytes,1,opt,name=Issuer,proto3" json:"issuer,omitempty"`
+	// InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement
+	// that the issuer must use HTTPS.
+	InsecureAllowHTTPIssuer bool     `protobuf:"varint,2,opt,name=InsecureAllowHTTPIssuer,proto3" json:"insecure_allow_http_issuer"`
+	XXX_NoUnkeyedLiteral    struct{} `json:"-"`
+	XXX_unrecognized        []byte   `json:"-"`
+	XXX_sizecache           int32    `json:"-"`
+}
+
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) Reset() {
+	*m = ProvisionTokenSpecV2Kubernetes_OIDCConfig{}
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) String() string {
+	return proto.CompactTextString(m)
+}
+func (*ProvisionTokenSpecV2Kubernetes_OIDCConfig) ProtoMessage() {}
+func (*ProvisionTokenSpecV2Kubernetes_OIDCConfig) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{79, 1}
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ProvisionTokenSpecV2Kubernetes_OIDCConfig.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ProvisionTokenSpecV2Kubernetes_OIDCConfig.Merge(m, src)
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) XXX_Size() int {
+	return m.Size()
+}
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) XXX_DiscardUnknown() {
+	xxx_messageInfo_ProvisionTokenSpecV2Kubernetes_OIDCConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionTokenSpecV2Kubernetes_OIDCConfig proto.InternalMessageInfo
+
 // Rule is a set of properties the Kubernetes-issued token might have to be
 // allowed to use this ProvisionToken
 type ProvisionTokenSpecV2Kubernetes_Rule struct {
@@ -5608,7 +5970,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_Rule) Reset()         { *m = ProvisionTo
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Kubernetes_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Kubernetes_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{74, 1}
+	return fileDescriptor_9198ee693835762e, []int{79, 2}
 }
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5652,7 +6014,7 @@ func (m *ProvisionTokenSpecV2Azure) Reset()         { *m = ProvisionTokenSpecV2A
 func (m *ProvisionTokenSpecV2Azure) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Azure) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Azure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{75}
+	return fileDescriptor_9198ee693835762e, []int{80}
 }
 func (m *ProvisionTokenSpecV2Azure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5698,7 +6060,7 @@ func (m *ProvisionTokenSpecV2Azure_Rule) Reset()         { *m = ProvisionTokenSp
 func (m *ProvisionTokenSpecV2Azure_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Azure_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Azure_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{75, 0}
+	return fileDescriptor_9198ee693835762e, []int{80, 0}
 }
 func (m *ProvisionTokenSpecV2Azure_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5742,7 +6104,7 @@ func (m *ProvisionTokenSpecV2GCP) Reset()         { *m = ProvisionTokenSpecV2GCP
 func (m *ProvisionTokenSpecV2GCP) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GCP) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GCP) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{76}
+	return fileDescriptor_9198ee693835762e, []int{81}
 }
 func (m *ProvisionTokenSpecV2GCP) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5791,7 +6153,7 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Reset()         { *m = ProvisionTokenSpec
 func (m *ProvisionTokenSpecV2GCP_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GCP_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GCP_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{76, 0}
+	return fileDescriptor_9198ee693835762e, []int{81, 0}
 }
 func (m *ProvisionTokenSpecV2GCP_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5848,7 +6210,7 @@ func (m *ProvisionTokenSpecV2TerraformCloud) Reset()         { *m = ProvisionTok
 func (m *ProvisionTokenSpecV2TerraformCloud) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2TerraformCloud) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2TerraformCloud) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{77}
+	return fileDescriptor_9198ee693835762e, []int{82}
 }
 func (m *ProvisionTokenSpecV2TerraformCloud) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5913,7 +6275,7 @@ func (m *ProvisionTokenSpecV2TerraformCloud_Rule) Reset() {
 func (m *ProvisionTokenSpecV2TerraformCloud_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2TerraformCloud_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2TerraformCloud_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{77, 0}
+	return fileDescriptor_9198ee693835762e, []int{82, 0}
 }
 func (m *ProvisionTokenSpecV2TerraformCloud_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5965,7 +6327,7 @@ func (m *ProvisionTokenSpecV2Bitbucket) Reset()         { *m = ProvisionTokenSpe
 func (m *ProvisionTokenSpecV2Bitbucket) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Bitbucket) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Bitbucket) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{78}
+	return fileDescriptor_9198ee693835762e, []int{83}
 }
 func (m *ProvisionTokenSpecV2Bitbucket) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6023,7 +6385,7 @@ func (m *ProvisionTokenSpecV2Bitbucket_Rule) Reset()         { *m = ProvisionTok
 func (m *ProvisionTokenSpecV2Bitbucket_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Bitbucket_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Bitbucket_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{78, 0}
+	return fileDescriptor_9198ee693835762e, []int{83, 0}
 }
 func (m *ProvisionTokenSpecV2Bitbucket_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6067,7 +6429,7 @@ func (m *ProvisionTokenSpecV2Oracle) Reset()         { *m = ProvisionTokenSpecV2
 func (m *ProvisionTokenSpecV2Oracle) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Oracle) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Oracle) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{79}
+	return fileDescriptor_9198ee693835762e, []int{84}
 }
 func (m *ProvisionTokenSpecV2Oracle) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6108,7 +6470,11 @@ type ProvisionTokenSpecV2Oracle_Rule struct {
 	// Regions is a list of regions an instance is allowed to join from. Both
 	// full region names ("us-phoenix-1") and abbreviations ("phx") are allowed.
 	// If empty, any region is allowed.
-	Regions              []string `protobuf:"bytes,3,rep,name=Regions,proto3" json:"regions,omitempty"`
+	Regions []string `protobuf:"bytes,3,rep,name=Regions,proto3" json:"regions,omitempty"`
+	// Instances is a list of the OCIDs of specific instances that are allowed
+	// to join. If empty, any instance matching the other fields in the rule is allowed.
+	// Limited to 100 instance OCIDs per rule.
+	Instances            []string `protobuf:"bytes,4,rep,name=Instances,proto3" json:"instances,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -6118,7 +6484,7 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2Oracle_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Oracle_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Oracle_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{79, 0}
+	return fileDescriptor_9198ee693835762e, []int{84, 0}
 }
 func (m *ProvisionTokenSpecV2Oracle_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6147,6 +6513,124 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_ProvisionTokenSpecV2Oracle_Rule proto.InternalMessageInfo
 
+// ProvisionTokenSpecV2Env0 contains env0-specific parts of the
+// ProvisionTokenSpecV2.
+type ProvisionTokenSpecV2Env0 struct {
+	// Allow is a list of Rules, jobs using this token must match at least one
+	// allow rule to use this token.
+	Allow                []*ProvisionTokenSpecV2Env0_Rule `protobuf:"bytes,1,rep,name=Allow,proto3" json:"allow,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                         `json:"-"`
+	XXX_unrecognized     []byte                           `json:"-"`
+	XXX_sizecache        int32                            `json:"-"`
+}
+
+func (m *ProvisionTokenSpecV2Env0) Reset()         { *m = ProvisionTokenSpecV2Env0{} }
+func (m *ProvisionTokenSpecV2Env0) String() string { return proto.CompactTextString(m) }
+func (*ProvisionTokenSpecV2Env0) ProtoMessage()    {}
+func (*ProvisionTokenSpecV2Env0) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{85}
+}
+func (m *ProvisionTokenSpecV2Env0) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ProvisionTokenSpecV2Env0) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ProvisionTokenSpecV2Env0.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ProvisionTokenSpecV2Env0) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ProvisionTokenSpecV2Env0.Merge(m, src)
+}
+func (m *ProvisionTokenSpecV2Env0) XXX_Size() int {
+	return m.Size()
+}
+func (m *ProvisionTokenSpecV2Env0) XXX_DiscardUnknown() {
+	xxx_messageInfo_ProvisionTokenSpecV2Env0.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionTokenSpecV2Env0 proto.InternalMessageInfo
+
+// Rule is a set of properties the env0 environment might have to be allowed
+// to use this provision token.
+type ProvisionTokenSpecV2Env0_Rule struct {
+	// OrganizationID is the unique organization identifier, corresponding to
+	// `organizationId` in an Env0 OIDC token.
+	OrganizationID string `protobuf:"bytes,1,opt,name=OrganizationID,proto3" json:"organization_id,omitempty"`
+	// ProjectID is a unique project identifier, corresponding to `projectId` in
+	// an Env0 OIDC token.
+	ProjectID string `protobuf:"bytes,2,opt,name=ProjectID,proto3" json:"project_id,omitempty"`
+	// ProjectName is the name of the project under which the job was run
+	// corresponding to `projectName` in an Env0 OIDC token.
+	ProjectName string `protobuf:"bytes,3,opt,name=ProjectName,proto3" json:"project_name,omitempty"`
+	// TemplateID is the unique identifier of the Env0 template, corresponding
+	// to `templateId` in an Env0 OIDC token.
+	TemplateID string `protobuf:"bytes,4,opt,name=TemplateID,proto3" json:"template_id,omitempty"`
+	// TemplateName is the name of the Env0 template, corresponding to
+	// `templateName` in an Env0 OIDC token.
+	TemplateName string `protobuf:"bytes,5,opt,name=TemplateName,proto3" json:"template_name,omitempty"`
+	// EnvironmentID is the unique identifier of the Env0 environment,
+	// corresponding to `environmentId` in an Env0 OIDC token.
+	EnvironmentID string `protobuf:"bytes,6,opt,name=EnvironmentID,proto3" json:"environment_id,omitempty"`
+	// EnvironmentName is the name of the Env0 environment, corresponding to
+	// `environmentName` in an Env0 OIDC token.
+	EnvironmentName string `protobuf:"bytes,7,opt,name=EnvironmentName,proto3" json:"environment_name,omitempty"`
+	// WorkspaceName is the name of the Env0 workspace, corresponding to
+	// `workspaceName` in an Env0 OIDC token.
+	WorkspaceName string `protobuf:"bytes,8,opt,name=WorkspaceName,proto3" json:"workspace_name,omitempty"`
+	// DeploymentType is the env0 deployment type, such as "deploy", "destroy",
+	// etc. Corresponds to `deploymentType` in an Env0 OIDC token.
+	DeploymentType string `protobuf:"bytes,9,opt,name=DeploymentType,proto3" json:"deployment_type,omitempty"`
+	// DeployerEmail is the email of the person that triggered the deployment,
+	// corresponding to `deployerEmail` in an Env0 OIDC token.
+	DeployerEmail string `protobuf:"bytes,10,opt,name=DeployerEmail,proto3" json:"deployer_email,omitempty"`
+	// Env0Tag is a custom tag value corresponding to `env0Tag` when
+	// `ENV0_OIDC_TAG` is set.
+	Env0Tag              string   `protobuf:"bytes,11,opt,name=Env0Tag,proto3" json:"env0_tag,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ProvisionTokenSpecV2Env0_Rule) Reset()         { *m = ProvisionTokenSpecV2Env0_Rule{} }
+func (m *ProvisionTokenSpecV2Env0_Rule) String() string { return proto.CompactTextString(m) }
+func (*ProvisionTokenSpecV2Env0_Rule) ProtoMessage()    {}
+func (*ProvisionTokenSpecV2Env0_Rule) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{85, 0}
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ProvisionTokenSpecV2Env0_Rule.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ProvisionTokenSpecV2Env0_Rule.Merge(m, src)
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) XXX_Size() int {
+	return m.Size()
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) XXX_DiscardUnknown() {
+	xxx_messageInfo_ProvisionTokenSpecV2Env0_Rule.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionTokenSpecV2Env0_Rule proto.InternalMessageInfo
+
 // ProvisionTokenSpecV2BoundKeypair contains configuration for bound_keypair
 // type join tokens.
 type ProvisionTokenSpecV2BoundKeypair struct {
@@ -6170,7 +6654,7 @@ func (m *ProvisionTokenSpecV2BoundKeypair) Reset()         { *m = ProvisionToken
 func (m *ProvisionTokenSpecV2BoundKeypair) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2BoundKeypair) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2BoundKeypair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{80}
+	return fileDescriptor_9198ee693835762e, []int{86}
 }
 func (m *ProvisionTokenSpecV2BoundKeypair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6213,11 +6697,11 @@ type ProvisionTokenSpecV2BoundKeypair_OnboardingSpec struct {
 	// public key on first join, which may be used instead of preregistering a
 	// public key with `initial_public_key`. If `initial_public_key` is set,
 	// this value is ignored. Otherwise, if set, this value will be used to
-	// populate `.status.bound_keypair.intitial_join_secret`. If unset and no
+	// populate `.status.bound_keypair.registration_secret`. If unset and no
 	// `initial_public_key` is provided, a random secure value will be generated
 	// server-side to populate the status field.
 	RegistrationSecret string `protobuf:"bytes,2,opt,name=RegistrationSecret,proto3" json:"registration_secret,omitempty"`
-	// MustRegisterBefore is an optional time before which registeration via
+	// MustRegisterBefore is an optional time before which registration via
 	// initial join secret must be performed. Attempts to register using an
 	// initial join secret after this timestamp will not be allowed. This may be
 	// modified after creation if necessary to allow the initial registration to
@@ -6236,7 +6720,7 @@ func (m *ProvisionTokenSpecV2BoundKeypair_OnboardingSpec) String() string {
 }
 func (*ProvisionTokenSpecV2BoundKeypair_OnboardingSpec) ProtoMessage() {}
 func (*ProvisionTokenSpecV2BoundKeypair_OnboardingSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{80, 0}
+	return fileDescriptor_9198ee693835762e, []int{86, 0}
 }
 func (m *ProvisionTokenSpecV2BoundKeypair_OnboardingSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6278,18 +6762,18 @@ type ProvisionTokenSpecV2BoundKeypair_RecoverySpec struct {
 	Limit uint32 `protobuf:"varint,1,opt,name=Limit,proto3" json:"limit"`
 	// Mode sets the recovery rule enforcement mode. It may be one of these
 	// values:
-	// - standard (or unset): all configured rules enforced. The recovery limit
-	//   and client join state are required and verified. This is the most
-	//   secure recovery mode.
-	// - relaxed: recovery limit is not enforced, but client join state is still
-	//   required. This effectively allows unlimited recovery attempts, but
-	//   client join state still helps mitigate stolen credentials.
-	// - insecure: neither the recovery limit nor client join state are
-	//   enforced. This allows any client with the private key to join freely.
-	//   This is less secure, but can be useful in certain situations, like in
-	//   otherwise unsupported CI/CD providers. This mode should be used with
-	//   care, and RBAC rules should be configured to heavily restrict which
-	//   resources this identity can access.
+	//   - standard (or unset): all configured rules enforced. The recovery limit
+	//     and client join state are required and verified. This is the most
+	//     secure recovery mode.
+	//   - relaxed: recovery limit is not enforced, but client join state is still
+	//     required. This effectively allows unlimited recovery attempts, but
+	//     client join state still helps mitigate stolen credentials.
+	//   - insecure: neither the recovery limit nor client join state are
+	//     enforced. This allows any client with the private key to join freely.
+	//     This is less secure, but can be useful in certain situations, like in
+	//     otherwise unsupported CI/CD providers. This mode should be used with
+	//     care, and RBAC rules should be configured to heavily restrict which
+	//     resources this identity can access.
 	Mode                 string   `protobuf:"bytes,2,opt,name=Mode,proto3" json:"mode"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -6304,7 +6788,7 @@ func (m *ProvisionTokenSpecV2BoundKeypair_RecoverySpec) String() string {
 }
 func (*ProvisionTokenSpecV2BoundKeypair_RecoverySpec) ProtoMessage() {}
 func (*ProvisionTokenSpecV2BoundKeypair_RecoverySpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{80, 1}
+	return fileDescriptor_9198ee693835762e, []int{86, 1}
 }
 func (m *ProvisionTokenSpecV2BoundKeypair_RecoverySpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6348,7 +6832,7 @@ func (m *ProvisionTokenStatusV2) Reset()         { *m = ProvisionTokenStatusV2{}
 func (m *ProvisionTokenStatusV2) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenStatusV2) ProtoMessage()    {}
 func (*ProvisionTokenStatusV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{81}
+	return fileDescriptor_9198ee693835762e, []int{87}
 }
 func (m *ProvisionTokenStatusV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6383,7 +6867,7 @@ type ProvisionTokenStatusV2BoundKeypair struct {
 	// RegistrationSecret contains a secret value that may be used for public key
 	// registration during the initial join process if no public key is
 	// preregistered. If `.spec.bound_keypair.onboarding.initial_public_key`
-	// is set, †his field will remain empty. Otherwise, if
+	// is set, this field will remain empty. Otherwise, if
 	// `.spec.bound_keypair.onboarding.registration_secret` is set, that value
 	// will be copied here. If that field is unset, a value will be randomly
 	// generated.
@@ -6406,9 +6890,9 @@ type ProvisionTokenStatusV2BoundKeypair struct {
 	// or `insecure`.
 	RecoveryCount uint32 `protobuf:"varint,4,opt,name=RecoveryCount,proto3" json:"recovery_count"`
 	// LastRecoveredAt contains a timestamp of the last successful recovery
-	// attempt. Note that normal renewals do not count as a recovery attempt,
-	// however onboarding does,  either with a preregistered key or registration
-	// secret. This corresponds with the last time `bound_bot_instance_id` was
+	// attempt. Note that normal renewals with valid client certificates do not
+	// count as a recovery attempt, however the initial join during onboarding
+	// does. This corresponds with the last time `bound_bot_instance_id` was
 	// updated.
 	LastRecoveredAt *time.Time `protobuf:"bytes,5,opt,name=LastRecoveredAt,proto3,stdtime" json:"last_recovered_at,omitempty"`
 	// LastRotatedAt contains a timestamp of the last time the keypair was
@@ -6423,7 +6907,7 @@ func (m *ProvisionTokenStatusV2BoundKeypair) Reset()         { *m = ProvisionTok
 func (m *ProvisionTokenStatusV2BoundKeypair) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenStatusV2BoundKeypair) ProtoMessage()    {}
 func (*ProvisionTokenStatusV2BoundKeypair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{82}
+	return fileDescriptor_9198ee693835762e, []int{88}
 }
 func (m *ProvisionTokenStatusV2BoundKeypair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6472,7 +6956,7 @@ type StaticTokensV2 struct {
 func (m *StaticTokensV2) Reset()      { *m = StaticTokensV2{} }
 func (*StaticTokensV2) ProtoMessage() {}
 func (*StaticTokensV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{83}
+	return fileDescriptor_9198ee693835762e, []int{89}
 }
 func (m *StaticTokensV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6515,7 +6999,7 @@ func (m *StaticTokensSpecV2) Reset()         { *m = StaticTokensSpecV2{} }
 func (m *StaticTokensSpecV2) String() string { return proto.CompactTextString(m) }
 func (*StaticTokensSpecV2) ProtoMessage()    {}
 func (*StaticTokensSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{84}
+	return fileDescriptor_9198ee693835762e, []int{90}
 }
 func (m *StaticTokensSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6564,7 +7048,7 @@ type ClusterNameV2 struct {
 func (m *ClusterNameV2) Reset()      { *m = ClusterNameV2{} }
 func (*ClusterNameV2) ProtoMessage() {}
 func (*ClusterNameV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{85}
+	return fileDescriptor_9198ee693835762e, []int{91}
 }
 func (m *ClusterNameV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6610,7 +7094,7 @@ func (m *ClusterNameSpecV2) Reset()         { *m = ClusterNameSpecV2{} }
 func (m *ClusterNameSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNameSpecV2) ProtoMessage()    {}
 func (*ClusterNameSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{86}
+	return fileDescriptor_9198ee693835762e, []int{92}
 }
 func (m *ClusterNameSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6660,7 +7144,7 @@ func (m *ClusterAuditConfigV2) Reset()         { *m = ClusterAuditConfigV2{} }
 func (m *ClusterAuditConfigV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterAuditConfigV2) ProtoMessage()    {}
 func (*ClusterAuditConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{87}
+	return fileDescriptor_9198ee693835762e, []int{93}
 }
 func (m *ClusterAuditConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6730,7 +7214,7 @@ func (m *ClusterAuditConfigSpecV2) Reset()         { *m = ClusterAuditConfigSpec
 func (m *ClusterAuditConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterAuditConfigSpecV2) ProtoMessage()    {}
 func (*ClusterAuditConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{88}
+	return fileDescriptor_9198ee693835762e, []int{94}
 }
 func (m *ClusterAuditConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6781,7 +7265,7 @@ func (m *ClusterNetworkingConfigV2) Reset()         { *m = ClusterNetworkingConf
 func (m *ClusterNetworkingConfigV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNetworkingConfigV2) ProtoMessage()    {}
 func (*ClusterNetworkingConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{89}
+	return fileDescriptor_9198ee693835762e, []int{95}
 }
 func (m *ClusterNetworkingConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6822,9 +7306,9 @@ type ClusterNetworkingConfigSpecV2 struct {
 	// KeepAliveCountMax is the number of keep-alive messages that can be
 	// missed before the server disconnects the connection to the client.
 	KeepAliveCountMax int64 `protobuf:"varint,3,opt,name=KeepAliveCountMax,proto3" json:"keep_alive_count_max"`
-	// SessionControlTimeout is the session control lease expiry and defines
-	// the upper limit of how long a node may be out of contact with the auth
-	// server before it begins terminating controlled sessions.
+	// SessionControlTimeout is the session control lease expiry and defines the
+	// upper limit of how long a node may be out of contact with the Auth Service
+	// before it begins terminating controlled sessions.
 	SessionControlTimeout Duration `protobuf:"varint,4,opt,name=SessionControlTimeout,proto3,casttype=Duration" json:"session_control_timeout"`
 	// ClientIdleTimeoutMessage is the message sent to the user when a connection times out.
 	ClientIdleTimeoutMessage string `protobuf:"bytes,5,opt,name=ClientIdleTimeoutMessage,proto3" json:"idle_timeout_message"`
@@ -6860,7 +7344,7 @@ func (m *ClusterNetworkingConfigSpecV2) Reset()         { *m = ClusterNetworking
 func (m *ClusterNetworkingConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNetworkingConfigSpecV2) ProtoMessage()    {}
 func (*ClusterNetworkingConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{90}
+	return fileDescriptor_9198ee693835762e, []int{96}
 }
 func (m *ClusterNetworkingConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6892,6 +7376,7 @@ var xxx_messageInfo_ClusterNetworkingConfigSpecV2 proto.InternalMessageInfo
 // TunnelStrategyV1 defines possible tunnel strategy types.
 type TunnelStrategyV1 struct {
 	// Types that are valid to be assigned to Strategy:
+	//
 	//	*TunnelStrategyV1_AgentMesh
 	//	*TunnelStrategyV1_ProxyPeering
 	Strategy             isTunnelStrategyV1_Strategy `protobuf_oneof:"Strategy"`
@@ -6904,7 +7389,7 @@ func (m *TunnelStrategyV1) Reset()         { *m = TunnelStrategyV1{} }
 func (m *TunnelStrategyV1) String() string { return proto.CompactTextString(m) }
 func (*TunnelStrategyV1) ProtoMessage()    {}
 func (*TunnelStrategyV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{91}
+	return fileDescriptor_9198ee693835762e, []int{97}
 }
 func (m *TunnelStrategyV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6989,7 +7474,7 @@ func (m *AgentMeshTunnelStrategy) Reset()         { *m = AgentMeshTunnelStrategy
 func (m *AgentMeshTunnelStrategy) String() string { return proto.CompactTextString(m) }
 func (*AgentMeshTunnelStrategy) ProtoMessage()    {}
 func (*AgentMeshTunnelStrategy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{92}
+	return fileDescriptor_9198ee693835762e, []int{98}
 }
 func (m *AgentMeshTunnelStrategy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7030,7 +7515,7 @@ func (m *ProxyPeeringTunnelStrategy) Reset()         { *m = ProxyPeeringTunnelSt
 func (m *ProxyPeeringTunnelStrategy) String() string { return proto.CompactTextString(m) }
 func (*ProxyPeeringTunnelStrategy) ProtoMessage()    {}
 func (*ProxyPeeringTunnelStrategy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{93}
+	return fileDescriptor_9198ee693835762e, []int{99}
 }
 func (m *ProxyPeeringTunnelStrategy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7071,17 +7556,19 @@ type SessionRecordingConfigV2 struct {
 	// Metadata is resource metadata
 	Metadata Metadata `protobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"`
 	// Spec is a SessionRecordingConfig specification
-	Spec                 SessionRecordingConfigSpecV2 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
-	XXX_NoUnkeyedLiteral struct{}                     `json:"-"`
-	XXX_unrecognized     []byte                       `json:"-"`
-	XXX_sizecache        int32                        `json:"-"`
+	Spec SessionRecordingConfigSpecV2 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
+	// Status is the SessionRecordingConfig status containing active encryption keys
+	Status               *SessionRecordingConfigStatus `protobuf:"bytes,6,opt,name=Status,proto3" json:"status,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                      `json:"-"`
+	XXX_unrecognized     []byte                        `json:"-"`
+	XXX_sizecache        int32                         `json:"-"`
 }
 
 func (m *SessionRecordingConfigV2) Reset()         { *m = SessionRecordingConfigV2{} }
 func (m *SessionRecordingConfigV2) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingConfigV2) ProtoMessage()    {}
 func (*SessionRecordingConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{94}
+	return fileDescriptor_9198ee693835762e, []int{100}
 }
 func (m *SessionRecordingConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7110,6 +7597,144 @@ func (m *SessionRecordingConfigV2) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_SessionRecordingConfigV2 proto.InternalMessageInfo
 
+// KeyLabel combines a label that can be used to identify one or more keys with a keystore type that
+// determines where the keys can be found.
+type KeyLabel struct {
+	// Type represents which keystore should be searched when looking up keys by label.
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type"`
+	// Label is a value that can be used with the related keystore in order to find relevant keys.
+	Label                string   `protobuf:"bytes,2,opt,name=label,proto3" json:"label"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *KeyLabel) Reset()         { *m = KeyLabel{} }
+func (m *KeyLabel) String() string { return proto.CompactTextString(m) }
+func (*KeyLabel) ProtoMessage()    {}
+func (*KeyLabel) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{101}
+}
+func (m *KeyLabel) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *KeyLabel) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_KeyLabel.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *KeyLabel) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_KeyLabel.Merge(m, src)
+}
+func (m *KeyLabel) XXX_Size() int {
+	return m.Size()
+}
+func (m *KeyLabel) XXX_DiscardUnknown() {
+	xxx_messageInfo_KeyLabel.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_KeyLabel proto.InternalMessageInfo
+
+// ManualKeyManagementConfig defines whether or not recording encryption keys should be managed externally
+// and how to query those keys.
+type ManualKeyManagementConfig struct {
+	// Enabled controls whether or recording encryption keys should be managed externally.
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// ActiveKeys describe which keys should be queried for active recording encryption and replay.
+	ActiveKeys []*KeyLabel `protobuf:"bytes,2,rep,name=active_keys,json=activeKeys,proto3" json:"active_keys,omitempty"`
+	// RotatedKeys describe which keys should be queried for historical replay.
+	RotatedKeys          []*KeyLabel `protobuf:"bytes,3,rep,name=rotated_keys,json=rotatedKeys,proto3" json:"rotated_keys,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
+	XXX_unrecognized     []byte      `json:"-"`
+	XXX_sizecache        int32       `json:"-"`
+}
+
+func (m *ManualKeyManagementConfig) Reset()         { *m = ManualKeyManagementConfig{} }
+func (m *ManualKeyManagementConfig) String() string { return proto.CompactTextString(m) }
+func (*ManualKeyManagementConfig) ProtoMessage()    {}
+func (*ManualKeyManagementConfig) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{102}
+}
+func (m *ManualKeyManagementConfig) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ManualKeyManagementConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ManualKeyManagementConfig.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ManualKeyManagementConfig) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ManualKeyManagementConfig.Merge(m, src)
+}
+func (m *ManualKeyManagementConfig) XXX_Size() int {
+	return m.Size()
+}
+func (m *ManualKeyManagementConfig) XXX_DiscardUnknown() {
+	xxx_messageInfo_ManualKeyManagementConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ManualKeyManagementConfig proto.InternalMessageInfo
+
+// SessionRecordingEncryptionConfig configures if and how session recordings
+// should be encrypted.
+type SessionRecordingEncryptionConfig struct {
+	// Enabled controls whether or not session recordings should be encrypted.
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// ManualKeyManagement defines whether or not recording encryption keys should be managed externally
+	// and how to query those keys.
+	ManualKeyManagement  *ManualKeyManagementConfig `protobuf:"bytes,2,opt,name=manual_key_management,json=manualKeyManagement,proto3" json:"manual_key_management,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+	XXX_unrecognized     []byte                     `json:"-"`
+	XXX_sizecache        int32                      `json:"-"`
+}
+
+func (m *SessionRecordingEncryptionConfig) Reset()         { *m = SessionRecordingEncryptionConfig{} }
+func (m *SessionRecordingEncryptionConfig) String() string { return proto.CompactTextString(m) }
+func (*SessionRecordingEncryptionConfig) ProtoMessage()    {}
+func (*SessionRecordingEncryptionConfig) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{103}
+}
+func (m *SessionRecordingEncryptionConfig) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SessionRecordingEncryptionConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SessionRecordingEncryptionConfig.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *SessionRecordingEncryptionConfig) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SessionRecordingEncryptionConfig.Merge(m, src)
+}
+func (m *SessionRecordingEncryptionConfig) XXX_Size() int {
+	return m.Size()
+}
+func (m *SessionRecordingEncryptionConfig) XXX_DiscardUnknown() {
+	xxx_messageInfo_SessionRecordingEncryptionConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SessionRecordingEncryptionConfig proto.InternalMessageInfo
+
 // SessionRecordingConfigSpecV2 is the actual data we care about
 // for SessionRecordingConfig.
 type SessionRecordingConfigSpecV2 struct {
@@ -7117,17 +7742,19 @@ type SessionRecordingConfigSpecV2 struct {
 	Mode string `protobuf:"bytes,1,opt,name=Mode,proto3" json:"mode"`
 	// ProxyChecksHostKeys is used to control if the proxy will check host keys
 	// when in recording mode.
-	ProxyChecksHostKeys  *BoolOption `protobuf:"bytes,2,opt,name=ProxyChecksHostKeys,proto3,customtype=BoolOption" json:"proxy_checks_host_keys"`
-	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
-	XXX_unrecognized     []byte      `json:"-"`
-	XXX_sizecache        int32       `json:"-"`
+	ProxyChecksHostKeys *BoolOption `protobuf:"bytes,2,opt,name=ProxyChecksHostKeys,proto3,customtype=BoolOption" json:"proxy_checks_host_keys"`
+	// Encryption configures if and how session recordings should be encrypted.
+	Encryption           *SessionRecordingEncryptionConfig `protobuf:"bytes,3,opt,name=encryption,proto3" json:"encryption,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                          `json:"-"`
+	XXX_unrecognized     []byte                            `json:"-"`
+	XXX_sizecache        int32                             `json:"-"`
 }
 
 func (m *SessionRecordingConfigSpecV2) Reset()         { *m = SessionRecordingConfigSpecV2{} }
 func (m *SessionRecordingConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingConfigSpecV2) ProtoMessage()    {}
 func (*SessionRecordingConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{95}
+	return fileDescriptor_9198ee693835762e, []int{104}
 }
 func (m *SessionRecordingConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7156,6 +7783,50 @@ func (m *SessionRecordingConfigSpecV2) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_SessionRecordingConfigSpecV2 proto.InternalMessageInfo
 
+// SessionRecordingConfigStatus contains the currently active age encryption keys used
+// for encrypted session recording.
+type SessionRecordingConfigStatus struct {
+	// EncryptionKeys contain the currently active age encryption keys used for
+	// encrypted session recording.
+	EncryptionKeys       []*AgeEncryptionKey `protobuf:"bytes,1,rep,name=encryption_keys,json=encryptionKeys,proto3" json:"encryption_keys"`
+	XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+	XXX_unrecognized     []byte              `json:"-"`
+	XXX_sizecache        int32               `json:"-"`
+}
+
+func (m *SessionRecordingConfigStatus) Reset()         { *m = SessionRecordingConfigStatus{} }
+func (m *SessionRecordingConfigStatus) String() string { return proto.CompactTextString(m) }
+func (*SessionRecordingConfigStatus) ProtoMessage()    {}
+func (*SessionRecordingConfigStatus) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{105}
+}
+func (m *SessionRecordingConfigStatus) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SessionRecordingConfigStatus) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SessionRecordingConfigStatus.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *SessionRecordingConfigStatus) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SessionRecordingConfigStatus.Merge(m, src)
+}
+func (m *SessionRecordingConfigStatus) XXX_Size() int {
+	return m.Size()
+}
+func (m *SessionRecordingConfigStatus) XXX_DiscardUnknown() {
+	xxx_messageInfo_SessionRecordingConfigStatus.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SessionRecordingConfigStatus proto.InternalMessageInfo
+
 // AuthPreferenceV2 implements the AuthPreference interface.
 type AuthPreferenceV2 struct {
 	// Kind is a resource kind
@@ -7177,7 +7848,7 @@ type AuthPreferenceV2 struct {
 func (m *AuthPreferenceV2) Reset()      { *m = AuthPreferenceV2{} }
 func (*AuthPreferenceV2) ProtoMessage() {}
 func (*AuthPreferenceV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{96}
+	return fileDescriptor_9198ee693835762e, []int{106}
 }
 func (m *AuthPreferenceV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7276,7 +7947,7 @@ func (m *AuthPreferenceSpecV2) Reset()         { *m = AuthPreferenceSpecV2{} }
 func (m *AuthPreferenceSpecV2) String() string { return proto.CompactTextString(m) }
 func (*AuthPreferenceSpecV2) ProtoMessage()    {}
 func (*AuthPreferenceSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{97}
+	return fileDescriptor_9198ee693835762e, []int{107}
 }
 func (m *AuthPreferenceSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7327,7 +7998,7 @@ func (m *StableUNIXUserConfig) Reset()         { *m = StableUNIXUserConfig{} }
 func (m *StableUNIXUserConfig) String() string { return proto.CompactTextString(m) }
 func (*StableUNIXUserConfig) ProtoMessage()    {}
 func (*StableUNIXUserConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{98}
+	return fileDescriptor_9198ee693835762e, []int{108}
 }
 func (m *StableUNIXUserConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7378,7 +8049,7 @@ func (m *U2F) Reset()         { *m = U2F{} }
 func (m *U2F) String() string { return proto.CompactTextString(m) }
 func (*U2F) ProtoMessage()    {}
 func (*U2F) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{99}
+	return fileDescriptor_9198ee693835762e, []int{109}
 }
 func (m *U2F) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7446,7 +8117,7 @@ func (m *Webauthn) Reset()         { *m = Webauthn{} }
 func (m *Webauthn) String() string { return proto.CompactTextString(m) }
 func (*Webauthn) ProtoMessage()    {}
 func (*Webauthn) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{100}
+	return fileDescriptor_9198ee693835762e, []int{110}
 }
 func (m *Webauthn) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7488,6 +8159,8 @@ type DeviceTrust struct {
 	//     endpoints.
 	//   - "required": enforces the presence of device extensions for sensitive
 	//     endpoints.
+	//   - "required-for-humans": enforces the presence of device extensions for
+	//     sensitive endpoints, for human users only (bots are exempt).
 	//
 	// Mode is always "off" for OSS.
 	// Defaults to "optional" for Enterprise.
@@ -7517,7 +8190,7 @@ func (m *DeviceTrust) Reset()         { *m = DeviceTrust{} }
 func (m *DeviceTrust) String() string { return proto.CompactTextString(m) }
 func (*DeviceTrust) ProtoMessage()    {}
 func (*DeviceTrust) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{101}
+	return fileDescriptor_9198ee693835762e, []int{111}
 }
 func (m *DeviceTrust) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7567,7 +8240,7 @@ func (m *HardwareKey) Reset()         { *m = HardwareKey{} }
 func (m *HardwareKey) String() string { return proto.CompactTextString(m) }
 func (*HardwareKey) ProtoMessage()    {}
 func (*HardwareKey) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{102}
+	return fileDescriptor_9198ee693835762e, []int{112}
 }
 func (m *HardwareKey) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7614,7 +8287,7 @@ func (m *HardwareKeySerialNumberValidation) Reset()         { *m = HardwareKeySe
 func (m *HardwareKeySerialNumberValidation) String() string { return proto.CompactTextString(m) }
 func (*HardwareKeySerialNumberValidation) ProtoMessage()    {}
 func (*HardwareKeySerialNumberValidation) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{103}
+	return fileDescriptor_9198ee693835762e, []int{113}
 }
 func (m *HardwareKeySerialNumberValidation) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7664,7 +8337,7 @@ func (m *Namespace) Reset()         { *m = Namespace{} }
 func (m *Namespace) String() string { return proto.CompactTextString(m) }
 func (*Namespace) ProtoMessage()    {}
 func (*Namespace) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{104}
+	return fileDescriptor_9198ee693835762e, []int{114}
 }
 func (m *Namespace) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7704,7 +8377,7 @@ func (m *NamespaceSpec) Reset()         { *m = NamespaceSpec{} }
 func (m *NamespaceSpec) String() string { return proto.CompactTextString(m) }
 func (*NamespaceSpec) ProtoMessage()    {}
 func (*NamespaceSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{105}
+	return fileDescriptor_9198ee693835762e, []int{115}
 }
 func (m *NamespaceSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7752,7 +8425,7 @@ type UserTokenV3 struct {
 func (m *UserTokenV3) Reset()      { *m = UserTokenV3{} }
 func (*UserTokenV3) ProtoMessage() {}
 func (*UserTokenV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{106}
+	return fileDescriptor_9198ee693835762e, []int{116}
 }
 func (m *UserTokenV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7799,7 +8472,7 @@ func (m *UserTokenSpecV3) Reset()         { *m = UserTokenSpecV3{} }
 func (m *UserTokenSpecV3) String() string { return proto.CompactTextString(m) }
 func (*UserTokenSpecV3) ProtoMessage()    {}
 func (*UserTokenSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{107}
+	return fileDescriptor_9198ee693835762e, []int{117}
 }
 func (m *UserTokenSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7847,7 +8520,7 @@ type UserTokenSecretsV3 struct {
 func (m *UserTokenSecretsV3) Reset()      { *m = UserTokenSecretsV3{} }
 func (*UserTokenSecretsV3) ProtoMessage() {}
 func (*UserTokenSecretsV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{108}
+	return fileDescriptor_9198ee693835762e, []int{118}
 }
 func (m *UserTokenSecretsV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7892,7 +8565,7 @@ func (m *UserTokenSecretsSpecV3) Reset()         { *m = UserTokenSecretsSpecV3{}
 func (m *UserTokenSecretsSpecV3) String() string { return proto.CompactTextString(m) }
 func (*UserTokenSecretsSpecV3) ProtoMessage()    {}
 func (*UserTokenSecretsSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{109}
+	return fileDescriptor_9198ee693835762e, []int{119}
 }
 func (m *UserTokenSecretsSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7941,7 +8614,7 @@ type AccessRequestV3 struct {
 func (m *AccessRequestV3) Reset()      { *m = AccessRequestV3{} }
 func (*AccessRequestV3) ProtoMessage() {}
 func (*AccessRequestV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{110}
+	return fileDescriptor_9198ee693835762e, []int{120}
 }
 func (m *AccessRequestV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7993,7 +8666,7 @@ func (m *AccessReviewThreshold) Reset()         { *m = AccessReviewThreshold{} }
 func (m *AccessReviewThreshold) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewThreshold) ProtoMessage()    {}
 func (*AccessReviewThreshold) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{111}
+	return fileDescriptor_9198ee693835762e, []int{121}
 }
 func (m *AccessReviewThreshold) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8038,7 +8711,7 @@ func (m *PromotedAccessList) Reset()         { *m = PromotedAccessList{} }
 func (m *PromotedAccessList) String() string { return proto.CompactTextString(m) }
 func (*PromotedAccessList) ProtoMessage()    {}
 func (*PromotedAccessList) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{112}
+	return fileDescriptor_9198ee693835762e, []int{122}
 }
 func (m *PromotedAccessList) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8083,7 +8756,7 @@ func (m *AccessRequestDryRunEnrichment) Reset()         { *m = AccessRequestDryR
 func (m *AccessRequestDryRunEnrichment) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestDryRunEnrichment) ProtoMessage()    {}
 func (*AccessRequestDryRunEnrichment) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{113}
+	return fileDescriptor_9198ee693835762e, []int{123}
 }
 func (m *AccessRequestDryRunEnrichment) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8144,7 +8817,7 @@ func (m *AccessReview) Reset()         { *m = AccessReview{} }
 func (m *AccessReview) String() string { return proto.CompactTextString(m) }
 func (*AccessReview) ProtoMessage()    {}
 func (*AccessReview) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{114}
+	return fileDescriptor_9198ee693835762e, []int{124}
 }
 func (m *AccessReview) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8189,7 +8862,7 @@ func (m *AccessReviewSubmission) Reset()         { *m = AccessReviewSubmission{}
 func (m *AccessReviewSubmission) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewSubmission) ProtoMessage()    {}
 func (*AccessReviewSubmission) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{115}
+	return fileDescriptor_9198ee693835762e, []int{125}
 }
 func (m *AccessReviewSubmission) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8232,7 +8905,7 @@ func (m *ThresholdIndexSet) Reset()         { *m = ThresholdIndexSet{} }
 func (m *ThresholdIndexSet) String() string { return proto.CompactTextString(m) }
 func (*ThresholdIndexSet) ProtoMessage()    {}
 func (*ThresholdIndexSet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{116}
+	return fileDescriptor_9198ee693835762e, []int{126}
 }
 func (m *ThresholdIndexSet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8275,7 +8948,7 @@ func (m *ThresholdIndexSets) Reset()         { *m = ThresholdIndexSets{} }
 func (m *ThresholdIndexSets) String() string { return proto.CompactTextString(m) }
 func (*ThresholdIndexSets) ProtoMessage()    {}
 func (*ThresholdIndexSets) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{117}
+	return fileDescriptor_9198ee693835762e, []int{127}
 }
 func (m *ThresholdIndexSets) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8372,17 +9045,22 @@ type AccessRequestSpecV3 struct {
 	// ResourceExpiry is the time at which the access request resource will expire.
 	ResourceExpiry *time.Time `protobuf:"bytes,22,opt,name=ResourceExpiry,proto3,stdtime" json:"expiry,omitempty"`
 	// DryRunEnrichment contains the extra info added in response to a dry run request.
-	DryRunEnrichment     *AccessRequestDryRunEnrichment `protobuf:"bytes,23,opt,name=DryRunEnrichment,proto3" json:"dry_run_enrichment,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}                       `json:"-"`
-	XXX_unrecognized     []byte                         `json:"-"`
-	XXX_sizecache        int32                          `json:"-"`
+	DryRunEnrichment *AccessRequestDryRunEnrichment `protobuf:"bytes,23,opt,name=DryRunEnrichment,proto3" json:"dry_run_enrichment,omitempty"`
+	// RequestKind indicates the kind (short/long-term) of request.
+	RequestKind AccessRequestKind `protobuf:"varint,24,opt,name=RequestKind,proto3,enum=types.AccessRequestKind" json:"request_kind,omitempty"`
+	// LongTermResourceGrouping contains information about how resources can be grouped
+	// based on Access List promotions for long-term Access Requests.
+	LongTermGrouping     *LongTermResourceGrouping `protobuf:"bytes,25,opt,name=LongTermGrouping,proto3" json:"long_term_grouping,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                  `json:"-"`
+	XXX_unrecognized     []byte                    `json:"-"`
+	XXX_sizecache        int32                     `json:"-"`
 }
 
 func (m *AccessRequestSpecV3) Reset()         { *m = AccessRequestSpecV3{} }
 func (m *AccessRequestSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestSpecV3) ProtoMessage()    {}
 func (*AccessRequestSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{118}
+	return fileDescriptor_9198ee693835762e, []int{128}
 }
 func (m *AccessRequestSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8439,7 +9117,7 @@ func (m *AccessRequestFilter) Reset()         { *m = AccessRequestFilter{} }
 func (m *AccessRequestFilter) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestFilter) ProtoMessage()    {}
 func (*AccessRequestFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{119}
+	return fileDescriptor_9198ee693835762e, []int{129}
 }
 func (m *AccessRequestFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8495,7 +9173,7 @@ func (m *AccessCapabilities) Reset()         { *m = AccessCapabilities{} }
 func (m *AccessCapabilities) String() string { return proto.CompactTextString(m) }
 func (*AccessCapabilities) ProtoMessage()    {}
 func (*AccessCapabilities) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{120}
+	return fileDescriptor_9198ee693835762e, []int{130}
 }
 func (m *AccessCapabilities) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8553,7 +9231,7 @@ func (m *AccessCapabilitiesRequest) Reset()         { *m = AccessCapabilitiesReq
 func (m *AccessCapabilitiesRequest) String() string { return proto.CompactTextString(m) }
 func (*AccessCapabilitiesRequest) ProtoMessage()    {}
 func (*AccessCapabilitiesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{121}
+	return fileDescriptor_9198ee693835762e, []int{131}
 }
 func (m *AccessCapabilitiesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8582,6 +9260,101 @@ func (m *AccessCapabilitiesRequest) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AccessCapabilitiesRequest proto.InternalMessageInfo
 
+// RemoteAccessCapabilities is a summary of the capabilites that a remote cluster
+// user is granted in target cluster.
+// buf:lint:ignore PAGINATION_REQUIRED
+type RemoteAccessCapabilities struct {
+	// ApplicableRolesForResources is a list of the remote-cluster roles applicable
+	// for access to a given set of resources. This will always be a subset of the
+	// SearchAsRoles supplied in the [RemoteAccessCapabilitiesRequest]
+	ApplicableRolesForResources []string `protobuf:"bytes,1,rep,name=ApplicableRolesForResources,proto3" json:"applicable_roles,omitempty"`
+	XXX_NoUnkeyedLiteral        struct{} `json:"-"`
+	XXX_unrecognized            []byte   `json:"-"`
+	XXX_sizecache               int32    `json:"-"`
+}
+
+func (m *RemoteAccessCapabilities) Reset()         { *m = RemoteAccessCapabilities{} }
+func (m *RemoteAccessCapabilities) String() string { return proto.CompactTextString(m) }
+func (*RemoteAccessCapabilities) ProtoMessage()    {}
+func (*RemoteAccessCapabilities) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{132}
+}
+func (m *RemoteAccessCapabilities) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RemoteAccessCapabilities) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RemoteAccessCapabilities.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RemoteAccessCapabilities) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RemoteAccessCapabilities.Merge(m, src)
+}
+func (m *RemoteAccessCapabilities) XXX_Size() int {
+	return m.Size()
+}
+func (m *RemoteAccessCapabilities) XXX_DiscardUnknown() {
+	xxx_messageInfo_RemoteAccessCapabilities.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RemoteAccessCapabilities proto.InternalMessageInfo
+
+// AccessCapabilitiesRequest encodes parameters for the GetRemoteAccessCapabilities method.
+// buf:lint:ignore PAGINATION_REQUIRED
+type RemoteAccessCapabilitiesRequest struct {
+	// user is the name of the target user on their home cluster
+	User string `protobuf:"bytes,1,opt,name=User,proto3" json:"user,omitempty"`
+	// SearchAsRoles holds the roles the target user may use when searching for
+	// resources on the user's home cluster
+	SearchAsRoles []string `protobuf:"bytes,2,rep,name=SearchAsRoles,proto3" json:"remote_search_as_roles,omitempty"`
+	// ResourceIDs is the list of the ResourceIDs of the resources we would like to view
+	// the necessary roles for.
+	ResourceIDs          []ResourceID `protobuf:"bytes,3,rep,name=ResourceIDs,proto3" json:"resource_ids,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}     `json:"-"`
+	XXX_unrecognized     []byte       `json:"-"`
+	XXX_sizecache        int32        `json:"-"`
+}
+
+func (m *RemoteAccessCapabilitiesRequest) Reset()         { *m = RemoteAccessCapabilitiesRequest{} }
+func (m *RemoteAccessCapabilitiesRequest) String() string { return proto.CompactTextString(m) }
+func (*RemoteAccessCapabilitiesRequest) ProtoMessage()    {}
+func (*RemoteAccessCapabilitiesRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{133}
+}
+func (m *RemoteAccessCapabilitiesRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RemoteAccessCapabilitiesRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RemoteAccessCapabilitiesRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RemoteAccessCapabilitiesRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RemoteAccessCapabilitiesRequest.Merge(m, src)
+}
+func (m *RemoteAccessCapabilitiesRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *RemoteAccessCapabilitiesRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_RemoteAccessCapabilitiesRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RemoteAccessCapabilitiesRequest proto.InternalMessageInfo
+
 // RequestKubernetesResource is the Kubernetes resource identifier used
 // in access request settings.
 // Modeled after existing message KubernetesResource.
@@ -8599,7 +9372,7 @@ func (m *RequestKubernetesResource) Reset()         { *m = RequestKubernetesReso
 func (m *RequestKubernetesResource) String() string { return proto.CompactTextString(m) }
 func (*RequestKubernetesResource) ProtoMessage()    {}
 func (*RequestKubernetesResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{122}
+	return fileDescriptor_9198ee693835762e, []int{134}
 }
 func (m *RequestKubernetesResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8652,7 +9425,7 @@ func (m *ResourceID) Reset()         { *m = ResourceID{} }
 func (m *ResourceID) String() string { return proto.CompactTextString(m) }
 func (*ResourceID) ProtoMessage()    {}
 func (*ResourceID) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{123}
+	return fileDescriptor_9198ee693835762e, []int{135}
 }
 func (m *ResourceID) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8701,7 +9474,7 @@ type PluginDataV3 struct {
 func (m *PluginDataV3) Reset()      { *m = PluginDataV3{} }
 func (*PluginDataV3) ProtoMessage() {}
 func (*PluginDataV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{124}
+	return fileDescriptor_9198ee693835762e, []int{136}
 }
 func (m *PluginDataV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8744,7 +9517,7 @@ func (m *PluginDataEntry) Reset()         { *m = PluginDataEntry{} }
 func (m *PluginDataEntry) String() string { return proto.CompactTextString(m) }
 func (*PluginDataEntry) ProtoMessage()    {}
 func (*PluginDataEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{125}
+	return fileDescriptor_9198ee693835762e, []int{137}
 }
 func (m *PluginDataEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8786,7 +9559,7 @@ func (m *PluginDataSpecV3) Reset()         { *m = PluginDataSpecV3{} }
 func (m *PluginDataSpecV3) String() string { return proto.CompactTextString(m) }
 func (*PluginDataSpecV3) ProtoMessage()    {}
 func (*PluginDataSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{126}
+	return fileDescriptor_9198ee693835762e, []int{138}
 }
 func (m *PluginDataSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8833,7 +9606,7 @@ func (m *PluginDataFilter) Reset()         { *m = PluginDataFilter{} }
 func (m *PluginDataFilter) String() string { return proto.CompactTextString(m) }
 func (*PluginDataFilter) ProtoMessage()    {}
 func (*PluginDataFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{127}
+	return fileDescriptor_9198ee693835762e, []int{139}
 }
 func (m *PluginDataFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8884,7 +9657,7 @@ func (m *PluginDataUpdateParams) Reset()         { *m = PluginDataUpdateParams{}
 func (m *PluginDataUpdateParams) String() string { return proto.CompactTextString(m) }
 func (*PluginDataUpdateParams) ProtoMessage()    {}
 func (*PluginDataUpdateParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{128}
+	return fileDescriptor_9198ee693835762e, []int{140}
 }
 func (m *PluginDataUpdateParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8928,7 +9701,7 @@ func (m *RoleFilter) Reset()         { *m = RoleFilter{} }
 func (m *RoleFilter) String() string { return proto.CompactTextString(m) }
 func (*RoleFilter) ProtoMessage()    {}
 func (*RoleFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{129}
+	return fileDescriptor_9198ee693835762e, []int{141}
 }
 func (m *RoleFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8964,7 +9737,7 @@ type RoleV6 struct {
 	// SubKind is an optional resource sub kind, used in some resources
 	SubKind string `protobuf:"bytes,2,opt,name=SubKind,proto3" json:"sub_kind,omitempty"`
 	// Version is the resource version. It must be specified.
-	// Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`.
+	// Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`.
 	Version string `protobuf:"bytes,3,opt,name=Version,proto3" json:"version"`
 	// Metadata is resource metadata
 	Metadata Metadata `protobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"`
@@ -8978,7 +9751,7 @@ type RoleV6 struct {
 func (m *RoleV6) Reset()      { *m = RoleV6{} }
 func (*RoleV6) ProtoMessage() {}
 func (*RoleV6) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{130}
+	return fileDescriptor_9198ee693835762e, []int{142}
 }
 func (m *RoleV6) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9025,7 +9798,7 @@ func (m *RoleSpecV6) Reset()         { *m = RoleSpecV6{} }
 func (m *RoleSpecV6) String() string { return proto.CompactTextString(m) }
 func (*RoleSpecV6) ProtoMessage()    {}
 func (*RoleSpecV6) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{131}
+	return fileDescriptor_9198ee693835762e, []int{143}
 }
 func (m *RoleSpecV6) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9066,7 +9839,7 @@ func (m *SSHLocalPortForwarding) Reset()         { *m = SSHLocalPortForwarding{}
 func (m *SSHLocalPortForwarding) String() string { return proto.CompactTextString(m) }
 func (*SSHLocalPortForwarding) ProtoMessage()    {}
 func (*SSHLocalPortForwarding) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{132}
+	return fileDescriptor_9198ee693835762e, []int{144}
 }
 func (m *SSHLocalPortForwarding) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9107,7 +9880,7 @@ func (m *SSHRemotePortForwarding) Reset()         { *m = SSHRemotePortForwarding
 func (m *SSHRemotePortForwarding) String() string { return proto.CompactTextString(m) }
 func (*SSHRemotePortForwarding) ProtoMessage()    {}
 func (*SSHRemotePortForwarding) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{133}
+	return fileDescriptor_9198ee693835762e, []int{145}
 }
 func (m *SSHRemotePortForwarding) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9151,7 +9924,7 @@ func (m *SSHPortForwarding) Reset()         { *m = SSHPortForwarding{} }
 func (m *SSHPortForwarding) String() string { return proto.CompactTextString(m) }
 func (*SSHPortForwarding) ProtoMessage()    {}
 func (*SSHPortForwarding) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{134}
+	return fileDescriptor_9198ee693835762e, []int{146}
 }
 func (m *SSHPortForwarding) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9283,7 +10056,7 @@ func (m *RoleOptions) Reset()         { *m = RoleOptions{} }
 func (m *RoleOptions) String() string { return proto.CompactTextString(m) }
 func (*RoleOptions) ProtoMessage()    {}
 func (*RoleOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{135}
+	return fileDescriptor_9198ee693835762e, []int{147}
 }
 func (m *RoleOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9329,7 +10102,7 @@ func (m *RecordSession) Reset()         { *m = RecordSession{} }
 func (m *RecordSession) String() string { return proto.CompactTextString(m) }
 func (*RecordSession) ProtoMessage()    {}
 func (*RecordSession) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{136}
+	return fileDescriptor_9198ee693835762e, []int{148}
 }
 func (m *RecordSession) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9381,7 +10154,7 @@ func (m *CertExtension) Reset()         { *m = CertExtension{} }
 func (m *CertExtension) String() string { return proto.CompactTextString(m) }
 func (*CertExtension) ProtoMessage()    {}
 func (*CertExtension) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{137}
+	return fileDescriptor_9198ee693835762e, []int{149}
 }
 func (m *CertExtension) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9516,17 +10289,19 @@ type RoleConditions struct {
 	WorkloadIdentityLabels Labels `protobuf:"bytes,44,opt,name=WorkloadIdentityLabels,proto3,customtype=Labels" json:"workload_identity_labels,omitempty"`
 	// WorkloadIdentityLabelsExpression is a predicate expression used to
 	// allow/deny access to issuing a WorkloadIdentity.
-	WorkloadIdentityLabelsExpression string   `protobuf:"bytes,45,opt,name=WorkloadIdentityLabelsExpression,proto3" json:"workload_identity_labels_expression,omitempty"`
-	XXX_NoUnkeyedLiteral             struct{} `json:"-"`
-	XXX_unrecognized                 []byte   `json:"-"`
-	XXX_sizecache                    int32    `json:"-"`
+	WorkloadIdentityLabelsExpression string `protobuf:"bytes,45,opt,name=WorkloadIdentityLabelsExpression,proto3" json:"workload_identity_labels_expression,omitempty"`
+	// MCPPermissions defines MCP servers related permissions.
+	MCP                  *MCPPermissions `protobuf:"bytes,46,opt,name=MCP,proto3" json:"mcp,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
+	XXX_unrecognized     []byte          `json:"-"`
+	XXX_sizecache        int32           `json:"-"`
 }
 
 func (m *RoleConditions) Reset()         { *m = RoleConditions{} }
 func (m *RoleConditions) String() string { return proto.CompactTextString(m) }
 func (*RoleConditions) ProtoMessage()    {}
 func (*RoleConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{138}
+	return fileDescriptor_9198ee693835762e, []int{150}
 }
 func (m *RoleConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9569,7 +10344,7 @@ func (m *IdentityCenterAccountAssignment) Reset()         { *m = IdentityCenterA
 func (m *IdentityCenterAccountAssignment) String() string { return proto.CompactTextString(m) }
 func (*IdentityCenterAccountAssignment) ProtoMessage()    {}
 func (*IdentityCenterAccountAssignment) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{139}
+	return fileDescriptor_9198ee693835762e, []int{151}
 }
 func (m *IdentityCenterAccountAssignment) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9610,7 +10385,7 @@ func (m *GitHubPermission) Reset()         { *m = GitHubPermission{} }
 func (m *GitHubPermission) String() string { return proto.CompactTextString(m) }
 func (*GitHubPermission) ProtoMessage()    {}
 func (*GitHubPermission) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{140}
+	return fileDescriptor_9198ee693835762e, []int{152}
 }
 func (m *GitHubPermission) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9639,6 +10414,51 @@ func (m *GitHubPermission) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_GitHubPermission proto.InternalMessageInfo
 
+// MCPPermissions defines MCP servers related permissions.
+type MCPPermissions struct {
+	// Tools defines the list of tools allowed or denied for this role. Each entry
+	// can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular
+	// expression (must start with '^' and end with '$'). If the list is empty, no
+	// tools are allowed.
+	Tools                []string `protobuf:"bytes,1,rep,name=tools,proto3" json:"tools,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *MCPPermissions) Reset()         { *m = MCPPermissions{} }
+func (m *MCPPermissions) String() string { return proto.CompactTextString(m) }
+func (*MCPPermissions) ProtoMessage()    {}
+func (*MCPPermissions) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{153}
+}
+func (m *MCPPermissions) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MCPPermissions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MCPPermissions.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *MCPPermissions) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MCPPermissions.Merge(m, src)
+}
+func (m *MCPPermissions) XXX_Size() int {
+	return m.Size()
+}
+func (m *MCPPermissions) XXX_DiscardUnknown() {
+	xxx_messageInfo_MCPPermissions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MCPPermissions proto.InternalMessageInfo
+
 // SPIFFERoleCondition sets out which SPIFFE identities this role is allowed or
 // denied to generate. The Path matcher is required, and is evaluated first. If,
 // the Path does not match then the other matcher fields are not evaluated.
@@ -9686,7 +10506,7 @@ func (m *SPIFFERoleCondition) Reset()         { *m = SPIFFERoleCondition{} }
 func (m *SPIFFERoleCondition) String() string { return proto.CompactTextString(m) }
 func (*SPIFFERoleCondition) ProtoMessage()    {}
 func (*SPIFFERoleCondition) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{141}
+	return fileDescriptor_9198ee693835762e, []int{154}
 }
 func (m *SPIFFERoleCondition) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9730,7 +10550,7 @@ func (m *DatabasePermission) Reset()         { *m = DatabasePermission{} }
 func (m *DatabasePermission) String() string { return proto.CompactTextString(m) }
 func (*DatabasePermission) ProtoMessage()    {}
 func (*DatabasePermission) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{142}
+	return fileDescriptor_9198ee693835762e, []int{155}
 }
 func (m *DatabasePermission) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9783,7 +10603,7 @@ func (m *KubernetesResource) Reset()         { *m = KubernetesResource{} }
 func (m *KubernetesResource) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResource) ProtoMessage()    {}
 func (*KubernetesResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{143}
+	return fileDescriptor_9198ee693835762e, []int{156}
 }
 func (m *KubernetesResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9836,7 +10656,7 @@ func (m *SessionRequirePolicy) Reset()         { *m = SessionRequirePolicy{} }
 func (m *SessionRequirePolicy) String() string { return proto.CompactTextString(m) }
 func (*SessionRequirePolicy) ProtoMessage()    {}
 func (*SessionRequirePolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{144}
+	return fileDescriptor_9198ee693835762e, []int{157}
 }
 func (m *SessionRequirePolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9884,7 +10704,7 @@ func (m *SessionJoinPolicy) Reset()         { *m = SessionJoinPolicy{} }
 func (m *SessionJoinPolicy) String() string { return proto.CompactTextString(m) }
 func (*SessionJoinPolicy) ProtoMessage()    {}
 func (*SessionJoinPolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{145}
+	return fileDescriptor_9198ee693835762e, []int{158}
 }
 func (m *SessionJoinPolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9960,7 +10780,7 @@ func (m *AccessRequestConditions) Reset()         { *m = AccessRequestConditions
 func (m *AccessRequestConditions) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestConditions) ProtoMessage()    {}
 func (*AccessRequestConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{146}
+	return fileDescriptor_9198ee693835762e, []int{159}
 }
 func (m *AccessRequestConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9996,17 +10816,20 @@ type AccessRequestConditionsReason struct {
 	// has the request reason mode set to "required", then reason is required for all Access Requests
 	// requesting roles or resources allowed by this role. It applies only to users who have this
 	// role assigned.
-	Mode                 RequestReasonMode `protobuf:"bytes,1,opt,name=Mode,proto3,casttype=RequestReasonMode" json:"mode,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	Mode RequestReasonMode `protobuf:"bytes,1,opt,name=Mode,proto3,casttype=RequestReasonMode" json:"mode,omitempty"`
+	// Prompt is a custom message prompted to the user for the requested roles or resources searchable
+	// as other roles. This is only applied to the requested roles and resources specifying the prompt.
+	Prompt               string   `protobuf:"bytes,2,opt,name=Prompt,proto3" json:"prompt,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *AccessRequestConditionsReason) Reset()         { *m = AccessRequestConditionsReason{} }
 func (m *AccessRequestConditionsReason) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestConditionsReason) ProtoMessage()    {}
 func (*AccessRequestConditionsReason) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{147}
+	return fileDescriptor_9198ee693835762e, []int{160}
 }
 func (m *AccessRequestConditionsReason) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10059,7 +10882,7 @@ func (m *AccessReviewConditions) Reset()         { *m = AccessReviewConditions{}
 func (m *AccessReviewConditions) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewConditions) ProtoMessage()    {}
 func (*AccessReviewConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{148}
+	return fileDescriptor_9198ee693835762e, []int{161}
 }
 func (m *AccessReviewConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10101,7 +10924,7 @@ func (m *AccessRequestAllowedPromotion) Reset()         { *m = AccessRequestAllo
 func (m *AccessRequestAllowedPromotion) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestAllowedPromotion) ProtoMessage()    {}
 func (*AccessRequestAllowedPromotion) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{149}
+	return fileDescriptor_9198ee693835762e, []int{162}
 }
 func (m *AccessRequestAllowedPromotion) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10144,7 +10967,7 @@ func (m *AccessRequestAllowedPromotions) Reset()         { *m = AccessRequestAll
 func (m *AccessRequestAllowedPromotions) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestAllowedPromotions) ProtoMessage()    {}
 func (*AccessRequestAllowedPromotions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{150}
+	return fileDescriptor_9198ee693835762e, []int{163}
 }
 func (m *AccessRequestAllowedPromotions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10173,6 +10996,100 @@ func (m *AccessRequestAllowedPromotions) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AccessRequestAllowedPromotions proto.InternalMessageInfo
 
+// ResourceIDList represents a list of ResourceID objects.
+type ResourceIDList struct {
+	ResourceIds          []ResourceID `protobuf:"bytes,1,rep,name=resource_ids,json=resourceIds,proto3" json:"resource_ids"`
+	XXX_NoUnkeyedLiteral struct{}     `json:"-"`
+	XXX_unrecognized     []byte       `json:"-"`
+	XXX_sizecache        int32        `json:"-"`
+}
+
+func (m *ResourceIDList) Reset()         { *m = ResourceIDList{} }
+func (m *ResourceIDList) String() string { return proto.CompactTextString(m) }
+func (*ResourceIDList) ProtoMessage()    {}
+func (*ResourceIDList) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{164}
+}
+func (m *ResourceIDList) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ResourceIDList) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ResourceIDList.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ResourceIDList) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ResourceIDList.Merge(m, src)
+}
+func (m *ResourceIDList) XXX_Size() int {
+	return m.Size()
+}
+func (m *ResourceIDList) XXX_DiscardUnknown() {
+	xxx_messageInfo_ResourceIDList.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ResourceIDList proto.InternalMessageInfo
+
+// LongTermResourceGrouping contains information about how resources can be grouped
+// based on Access List promotions for long-term Access Requests.
+type LongTermResourceGrouping struct {
+	// AccessListToResources maps applicable Access List names to the resources they can grant,
+	// including the optimal grouping.
+	AccessListToResources map[string]ResourceIDList `protobuf:"bytes,1,rep,name=AccessListToResources,proto3" json:"grouped_by_access_list" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// RecommendedAccessList is the name of the Access List that would provide
+	// access to the most resources. If multiple Access Lists provide the same
+	// number of resources, the first one found will be used.
+	RecommendedAccessList string `protobuf:"bytes,2,opt,name=RecommendedAccessList,proto3" json:"recommended_access_list"`
+	// ValidationMessage is a user-friendly message explaining any grouping error, if CanProceed is false.
+	ValidationMessage string `protobuf:"bytes,3,opt,name=ValidationMessage,proto3" json:"validation_message,omitempty"`
+	// CanProceed represents the validity of the long-term grouping. If all requested
+	// resources cannot be grouped together, this will be false.
+	CanProceed           bool     `protobuf:"varint,4,opt,name=CanProceed,proto3" json:"can_proceed"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *LongTermResourceGrouping) Reset()         { *m = LongTermResourceGrouping{} }
+func (m *LongTermResourceGrouping) String() string { return proto.CompactTextString(m) }
+func (*LongTermResourceGrouping) ProtoMessage()    {}
+func (*LongTermResourceGrouping) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{165}
+}
+func (m *LongTermResourceGrouping) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LongTermResourceGrouping) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LongTermResourceGrouping.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LongTermResourceGrouping) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LongTermResourceGrouping.Merge(m, src)
+}
+func (m *LongTermResourceGrouping) XXX_Size() int {
+	return m.Size()
+}
+func (m *LongTermResourceGrouping) XXX_DiscardUnknown() {
+	xxx_messageInfo_LongTermResourceGrouping.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LongTermResourceGrouping proto.InternalMessageInfo
+
 // ClaimMapping maps a claim to teleport roles.
 type ClaimMapping struct {
 	// Claim is a claim name.
@@ -10190,7 +11107,7 @@ func (m *ClaimMapping) Reset()         { *m = ClaimMapping{} }
 func (m *ClaimMapping) String() string { return proto.CompactTextString(m) }
 func (*ClaimMapping) ProtoMessage()    {}
 func (*ClaimMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{151}
+	return fileDescriptor_9198ee693835762e, []int{166}
 }
 func (m *ClaimMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10236,7 +11153,7 @@ func (m *TraitMapping) Reset()         { *m = TraitMapping{} }
 func (m *TraitMapping) String() string { return proto.CompactTextString(m) }
 func (*TraitMapping) ProtoMessage()    {}
 func (*TraitMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{152}
+	return fileDescriptor_9198ee693835762e, []int{167}
 }
 func (m *TraitMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10285,7 +11202,7 @@ func (m *Rule) Reset()         { *m = Rule{} }
 func (m *Rule) String() string { return proto.CompactTextString(m) }
 func (*Rule) ProtoMessage()    {}
 func (*Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{153}
+	return fileDescriptor_9198ee693835762e, []int{168}
 }
 func (m *Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10333,7 +11250,7 @@ func (m *ImpersonateConditions) Reset()         { *m = ImpersonateConditions{} }
 func (m *ImpersonateConditions) String() string { return proto.CompactTextString(m) }
 func (*ImpersonateConditions) ProtoMessage()    {}
 func (*ImpersonateConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{154}
+	return fileDescriptor_9198ee693835762e, []int{169}
 }
 func (m *ImpersonateConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10375,7 +11292,7 @@ func (m *BoolValue) Reset()         { *m = BoolValue{} }
 func (m *BoolValue) String() string { return proto.CompactTextString(m) }
 func (*BoolValue) ProtoMessage()    {}
 func (*BoolValue) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{155}
+	return fileDescriptor_9198ee693835762e, []int{170}
 }
 func (m *BoolValue) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10407,7 +11324,9 @@ var xxx_messageInfo_BoolValue proto.InternalMessageInfo
 // UserFilter matches user resources.
 type UserFilter struct {
 	// SearchKeywords is a list of search keywords to match against resource field values.
-	SearchKeywords       []string `protobuf:"bytes,1,rep,name=SearchKeywords,proto3" json:"search_keywords,omitempty"`
+	SearchKeywords []string `protobuf:"bytes,1,rep,name=SearchKeywords,proto3" json:"search_keywords,omitempty"`
+	// SkipSystemUsers filters out teleport system users from the results.
+	SkipSystemUsers      bool     `protobuf:"varint,2,opt,name=SkipSystemUsers,proto3" json:"skip_system_users,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -10417,7 +11336,7 @@ func (m *UserFilter) Reset()         { *m = UserFilter{} }
 func (m *UserFilter) String() string { return proto.CompactTextString(m) }
 func (*UserFilter) ProtoMessage()    {}
 func (*UserFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{156}
+	return fileDescriptor_9198ee693835762e, []int{171}
 }
 func (m *UserFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10468,7 +11387,7 @@ type UserV2 struct {
 func (m *UserV2) Reset()      { *m = UserV2{} }
 func (*UserV2) ProtoMessage() {}
 func (*UserV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{157}
+	return fileDescriptor_9198ee693835762e, []int{172}
 }
 func (m *UserV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10517,7 +11436,7 @@ func (m *UserStatusV2) Reset()         { *m = UserStatusV2{} }
 func (m *UserStatusV2) String() string { return proto.CompactTextString(m) }
 func (*UserStatusV2) ProtoMessage()    {}
 func (*UserStatusV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{158}
+	return fileDescriptor_9198ee693835762e, []int{173}
 }
 func (m *UserStatusV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10591,7 +11510,7 @@ func (m *UserSpecV2) Reset()         { *m = UserSpecV2{} }
 func (m *UserSpecV2) String() string { return proto.CompactTextString(m) }
 func (*UserSpecV2) ProtoMessage()    {}
 func (*UserSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{159}
+	return fileDescriptor_9198ee693835762e, []int{174}
 }
 func (m *UserSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10641,7 +11560,7 @@ type ExternalIdentity struct {
 func (m *ExternalIdentity) Reset()      { *m = ExternalIdentity{} }
 func (*ExternalIdentity) ProtoMessage() {}
 func (*ExternalIdentity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{160}
+	return fileDescriptor_9198ee693835762e, []int{175}
 }
 func (m *ExternalIdentity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10689,7 +11608,7 @@ func (m *LoginStatus) Reset()         { *m = LoginStatus{} }
 func (m *LoginStatus) String() string { return proto.CompactTextString(m) }
 func (*LoginStatus) ProtoMessage()    {}
 func (*LoginStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{161}
+	return fileDescriptor_9198ee693835762e, []int{176}
 }
 func (m *LoginStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10734,7 +11653,7 @@ type CreatedBy struct {
 func (m *CreatedBy) Reset()      { *m = CreatedBy{} }
 func (*CreatedBy) ProtoMessage() {}
 func (*CreatedBy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{162}
+	return fileDescriptor_9198ee693835762e, []int{177}
 }
 func (m *CreatedBy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10783,7 +11702,7 @@ func (m *LocalAuthSecrets) Reset()         { *m = LocalAuthSecrets{} }
 func (m *LocalAuthSecrets) String() string { return proto.CompactTextString(m) }
 func (*LocalAuthSecrets) ProtoMessage()    {}
 func (*LocalAuthSecrets) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{163}
+	return fileDescriptor_9198ee693835762e, []int{178}
 }
 func (m *LocalAuthSecrets) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10840,7 +11759,7 @@ func (m *MFADevice) Reset()         { *m = MFADevice{} }
 func (m *MFADevice) String() string { return proto.CompactTextString(m) }
 func (*MFADevice) ProtoMessage()    {}
 func (*MFADevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{164}
+	return fileDescriptor_9198ee693835762e, []int{179}
 }
 func (m *MFADevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10950,7 +11869,7 @@ func (m *TOTPDevice) Reset()         { *m = TOTPDevice{} }
 func (m *TOTPDevice) String() string { return proto.CompactTextString(m) }
 func (*TOTPDevice) ProtoMessage()    {}
 func (*TOTPDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{165}
+	return fileDescriptor_9198ee693835762e, []int{180}
 }
 func (m *TOTPDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10996,7 +11915,7 @@ func (m *U2FDevice) Reset()         { *m = U2FDevice{} }
 func (m *U2FDevice) String() string { return proto.CompactTextString(m) }
 func (*U2FDevice) ProtoMessage()    {}
 func (*U2FDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{166}
+	return fileDescriptor_9198ee693835762e, []int{181}
 }
 func (m *U2FDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11078,7 +11997,7 @@ func (m *WebauthnDevice) Reset()         { *m = WebauthnDevice{} }
 func (m *WebauthnDevice) String() string { return proto.CompactTextString(m) }
 func (*WebauthnDevice) ProtoMessage()    {}
 func (*WebauthnDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{167}
+	return fileDescriptor_9198ee693835762e, []int{182}
 }
 func (m *WebauthnDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11124,7 +12043,7 @@ func (m *SSOMFADevice) Reset()         { *m = SSOMFADevice{} }
 func (m *SSOMFADevice) String() string { return proto.CompactTextString(m) }
 func (*SSOMFADevice) ProtoMessage()    {}
 func (*SSOMFADevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{168}
+	return fileDescriptor_9198ee693835762e, []int{183}
 }
 func (m *SSOMFADevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11167,7 +12086,7 @@ func (m *WebauthnLocalAuth) Reset()         { *m = WebauthnLocalAuth{} }
 func (m *WebauthnLocalAuth) String() string { return proto.CompactTextString(m) }
 func (*WebauthnLocalAuth) ProtoMessage()    {}
 func (*WebauthnLocalAuth) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{169}
+	return fileDescriptor_9198ee693835762e, []int{184}
 }
 func (m *WebauthnLocalAuth) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11213,7 +12132,7 @@ func (m *ConnectorRef) Reset()         { *m = ConnectorRef{} }
 func (m *ConnectorRef) String() string { return proto.CompactTextString(m) }
 func (*ConnectorRef) ProtoMessage()    {}
 func (*ConnectorRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{170}
+	return fileDescriptor_9198ee693835762e, []int{185}
 }
 func (m *ConnectorRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11255,7 +12174,7 @@ func (m *UserRef) Reset()         { *m = UserRef{} }
 func (m *UserRef) String() string { return proto.CompactTextString(m) }
 func (*UserRef) ProtoMessage()    {}
 func (*UserRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{171}
+	return fileDescriptor_9198ee693835762e, []int{186}
 }
 func (m *UserRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11305,7 +12224,7 @@ func (m *ReverseTunnelV2) Reset()         { *m = ReverseTunnelV2{} }
 func (m *ReverseTunnelV2) String() string { return proto.CompactTextString(m) }
 func (*ReverseTunnelV2) ProtoMessage()    {}
 func (*ReverseTunnelV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{172}
+	return fileDescriptor_9198ee693835762e, []int{187}
 }
 func (m *ReverseTunnelV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11352,7 +12271,7 @@ func (m *ReverseTunnelSpecV2) Reset()         { *m = ReverseTunnelSpecV2{} }
 func (m *ReverseTunnelSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ReverseTunnelSpecV2) ProtoMessage()    {}
 func (*ReverseTunnelSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{173}
+	return fileDescriptor_9198ee693835762e, []int{188}
 }
 func (m *ReverseTunnelSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11401,7 +12320,7 @@ type TunnelConnectionV2 struct {
 func (m *TunnelConnectionV2) Reset()      { *m = TunnelConnectionV2{} }
 func (*TunnelConnectionV2) ProtoMessage() {}
 func (*TunnelConnectionV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{174}
+	return fileDescriptor_9198ee693835762e, []int{189}
 }
 func (m *TunnelConnectionV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11449,7 +12368,7 @@ func (m *TunnelConnectionSpecV2) Reset()         { *m = TunnelConnectionSpecV2{}
 func (m *TunnelConnectionSpecV2) String() string { return proto.CompactTextString(m) }
 func (*TunnelConnectionSpecV2) ProtoMessage()    {}
 func (*TunnelConnectionSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{175}
+	return fileDescriptor_9198ee693835762e, []int{190}
 }
 func (m *TunnelConnectionSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11497,7 +12416,7 @@ func (m *SemaphoreFilter) Reset()         { *m = SemaphoreFilter{} }
 func (m *SemaphoreFilter) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreFilter) ProtoMessage()    {}
 func (*SemaphoreFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{176}
+	return fileDescriptor_9198ee693835762e, []int{191}
 }
 func (m *SemaphoreFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11548,7 +12467,7 @@ func (m *AcquireSemaphoreRequest) Reset()         { *m = AcquireSemaphoreRequest
 func (m *AcquireSemaphoreRequest) String() string { return proto.CompactTextString(m) }
 func (*AcquireSemaphoreRequest) ProtoMessage()    {}
 func (*AcquireSemaphoreRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{177}
+	return fileDescriptor_9198ee693835762e, []int{192}
 }
 func (m *AcquireSemaphoreRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11596,7 +12515,7 @@ func (m *SemaphoreLease) Reset()         { *m = SemaphoreLease{} }
 func (m *SemaphoreLease) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreLease) ProtoMessage()    {}
 func (*SemaphoreLease) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{178}
+	return fileDescriptor_9198ee693835762e, []int{193}
 }
 func (m *SemaphoreLease) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11642,7 +12561,7 @@ func (m *SemaphoreLeaseRef) Reset()         { *m = SemaphoreLeaseRef{} }
 func (m *SemaphoreLeaseRef) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreLeaseRef) ProtoMessage()    {}
 func (*SemaphoreLeaseRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{179}
+	return fileDescriptor_9198ee693835762e, []int{194}
 }
 func (m *SemaphoreLeaseRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11691,7 +12610,7 @@ type SemaphoreV3 struct {
 func (m *SemaphoreV3) Reset()      { *m = SemaphoreV3{} }
 func (*SemaphoreV3) ProtoMessage() {}
 func (*SemaphoreV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{180}
+	return fileDescriptor_9198ee693835762e, []int{195}
 }
 func (m *SemaphoreV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11733,7 +12652,7 @@ func (m *SemaphoreSpecV3) Reset()         { *m = SemaphoreSpecV3{} }
 func (m *SemaphoreSpecV3) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreSpecV3) ProtoMessage()    {}
 func (*SemaphoreSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{181}
+	return fileDescriptor_9198ee693835762e, []int{196}
 }
 func (m *SemaphoreSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11782,7 +12701,7 @@ type WebSessionV2 struct {
 func (m *WebSessionV2) Reset()      { *m = WebSessionV2{} }
 func (*WebSessionV2) ProtoMessage() {}
 func (*WebSessionV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{182}
+	return fileDescriptor_9198ee693835762e, []int{197}
 }
 func (m *WebSessionV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11867,7 +12786,7 @@ func (m *WebSessionSpecV2) Reset()         { *m = WebSessionSpecV2{} }
 func (m *WebSessionSpecV2) String() string { return proto.CompactTextString(m) }
 func (*WebSessionSpecV2) ProtoMessage()    {}
 func (*WebSessionSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{183}
+	return fileDescriptor_9198ee693835762e, []int{198}
 }
 func (m *WebSessionSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11912,7 +12831,7 @@ func (m *DeviceWebToken) Reset()         { *m = DeviceWebToken{} }
 func (m *DeviceWebToken) String() string { return proto.CompactTextString(m) }
 func (*DeviceWebToken) ProtoMessage()    {}
 func (*DeviceWebToken) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{184}
+	return fileDescriptor_9198ee693835762e, []int{199}
 }
 func (m *DeviceWebToken) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11954,7 +12873,7 @@ func (m *WebSessionFilter) Reset()         { *m = WebSessionFilter{} }
 func (m *WebSessionFilter) String() string { return proto.CompactTextString(m) }
 func (*WebSessionFilter) ProtoMessage()    {}
 func (*WebSessionFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{185}
+	return fileDescriptor_9198ee693835762e, []int{200}
 }
 func (m *WebSessionFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12025,7 +12944,7 @@ func (m *SAMLSessionData) Reset()         { *m = SAMLSessionData{} }
 func (m *SAMLSessionData) String() string { return proto.CompactTextString(m) }
 func (*SAMLSessionData) ProtoMessage()    {}
 func (*SAMLSessionData) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{186}
+	return fileDescriptor_9198ee693835762e, []int{201}
 }
 func (m *SAMLSessionData) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12074,7 +12993,7 @@ func (m *SAMLAttribute) Reset()         { *m = SAMLAttribute{} }
 func (m *SAMLAttribute) String() string { return proto.CompactTextString(m) }
 func (*SAMLAttribute) ProtoMessage()    {}
 func (*SAMLAttribute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{187}
+	return fileDescriptor_9198ee693835762e, []int{202}
 }
 func (m *SAMLAttribute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12121,7 +13040,7 @@ func (m *SAMLAttributeValue) Reset()         { *m = SAMLAttributeValue{} }
 func (m *SAMLAttributeValue) String() string { return proto.CompactTextString(m) }
 func (*SAMLAttributeValue) ProtoMessage()    {}
 func (*SAMLAttributeValue) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{188}
+	return fileDescriptor_9198ee693835762e, []int{203}
 }
 func (m *SAMLAttributeValue) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12172,7 +13091,7 @@ func (m *SAMLNameID) Reset()         { *m = SAMLNameID{} }
 func (m *SAMLNameID) String() string { return proto.CompactTextString(m) }
 func (*SAMLNameID) ProtoMessage()    {}
 func (*SAMLNameID) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{189}
+	return fileDescriptor_9198ee693835762e, []int{204}
 }
 func (m *SAMLNameID) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12221,7 +13140,7 @@ type RemoteClusterV3 struct {
 func (m *RemoteClusterV3) Reset()      { *m = RemoteClusterV3{} }
 func (*RemoteClusterV3) ProtoMessage() {}
 func (*RemoteClusterV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{190}
+	return fileDescriptor_9198ee693835762e, []int{205}
 }
 func (m *RemoteClusterV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12265,7 +13184,7 @@ func (m *RemoteClusterStatusV3) Reset()         { *m = RemoteClusterStatusV3{} }
 func (m *RemoteClusterStatusV3) String() string { return proto.CompactTextString(m) }
 func (*RemoteClusterStatusV3) ProtoMessage()    {}
 func (*RemoteClusterStatusV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{191}
+	return fileDescriptor_9198ee693835762e, []int{206}
 }
 func (m *RemoteClusterStatusV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12315,7 +13234,7 @@ func (m *KubernetesCluster) Reset()         { *m = KubernetesCluster{} }
 func (m *KubernetesCluster) String() string { return proto.CompactTextString(m) }
 func (*KubernetesCluster) ProtoMessage()    {}
 func (*KubernetesCluster) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{192}
+	return fileDescriptor_9198ee693835762e, []int{207}
 }
 func (m *KubernetesCluster) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12364,7 +13283,7 @@ type KubernetesClusterV3 struct {
 func (m *KubernetesClusterV3) Reset()      { *m = KubernetesClusterV3{} }
 func (*KubernetesClusterV3) ProtoMessage() {}
 func (*KubernetesClusterV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{193}
+	return fileDescriptor_9198ee693835762e, []int{208}
 }
 func (m *KubernetesClusterV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12415,7 +13334,7 @@ func (m *KubernetesClusterSpecV3) Reset()         { *m = KubernetesClusterSpecV3
 func (m *KubernetesClusterSpecV3) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterSpecV3) ProtoMessage()    {}
 func (*KubernetesClusterSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{194}
+	return fileDescriptor_9198ee693835762e, []int{209}
 }
 func (m *KubernetesClusterSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12463,7 +13382,7 @@ func (m *KubeAzure) Reset()         { *m = KubeAzure{} }
 func (m *KubeAzure) String() string { return proto.CompactTextString(m) }
 func (*KubeAzure) ProtoMessage()    {}
 func (*KubeAzure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{195}
+	return fileDescriptor_9198ee693835762e, []int{210}
 }
 func (m *KubeAzure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12509,7 +13428,7 @@ func (m *KubeAWS) Reset()         { *m = KubeAWS{} }
 func (m *KubeAWS) String() string { return proto.CompactTextString(m) }
 func (*KubeAWS) ProtoMessage()    {}
 func (*KubeAWS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{196}
+	return fileDescriptor_9198ee693835762e, []int{211}
 }
 func (m *KubeAWS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12555,7 +13474,7 @@ func (m *KubeGCP) Reset()         { *m = KubeGCP{} }
 func (m *KubeGCP) String() string { return proto.CompactTextString(m) }
 func (*KubeGCP) ProtoMessage()    {}
 func (*KubeGCP) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{197}
+	return fileDescriptor_9198ee693835762e, []int{212}
 }
 func (m *KubeGCP) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12597,7 +13516,7 @@ func (m *KubernetesClusterV3List) Reset()         { *m = KubernetesClusterV3List
 func (m *KubernetesClusterV3List) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterV3List) ProtoMessage()    {}
 func (*KubernetesClusterV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{198}
+	return fileDescriptor_9198ee693835762e, []int{213}
 }
 func (m *KubernetesClusterV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12637,16 +13556,20 @@ type KubernetesServerV3 struct {
 	// Metadata is the Kubernetes server metadata.
 	Metadata Metadata `protobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"`
 	// Spec is the Kubernetes server spec.
-	Spec                 KubernetesServerSpecV3 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
-	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
-	XXX_unrecognized     []byte                 `json:"-"`
-	XXX_sizecache        int32                  `json:"-"`
+	Spec KubernetesServerSpecV3 `protobuf:"bytes,5,opt,name=Spec,proto3" json:"spec"`
+	// Status is the Kubernetes server status.
+	Status *KubernetesServerStatusV3 `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"`
+	// The advertized scope of the server which can not change once assigned.
+	Scope                string   `protobuf:"bytes,7,opt,name=scope,proto3" json:"scope,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *KubernetesServerV3) Reset()      { *m = KubernetesServerV3{} }
 func (*KubernetesServerV3) ProtoMessage() {}
 func (*KubernetesServerV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{199}
+	return fileDescriptor_9198ee693835762e, []int{214}
 }
 func (m *KubernetesServerV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12688,7 +13611,11 @@ type KubernetesServerSpecV3 struct {
 	// Cluster is a Kubernetes Cluster proxied by this Kubernetes server.
 	Cluster *KubernetesClusterV3 `protobuf:"bytes,5,opt,name=Cluster,proto3" json:"cluster"`
 	// ProxyIDs is a list of proxy IDs this server is expected to be connected to.
-	ProxyIDs             []string `protobuf:"bytes,6,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	ProxyIDs []string `protobuf:"bytes,6,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	// the name of the Relay group that the server is connected to
+	RelayGroup string `protobuf:"bytes,7,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// the list of Relay host IDs that the server is connected to
+	RelayIds             []string `protobuf:"bytes,8,rep,name=relay_ids,json=relayIds,proto3" json:"relay_ids,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -12698,7 +13625,7 @@ func (m *KubernetesServerSpecV3) Reset()         { *m = KubernetesServerSpecV3{}
 func (m *KubernetesServerSpecV3) String() string { return proto.CompactTextString(m) }
 func (*KubernetesServerSpecV3) ProtoMessage()    {}
 func (*KubernetesServerSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{200}
+	return fileDescriptor_9198ee693835762e, []int{215}
 }
 func (m *KubernetesServerSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12727,6 +13654,49 @@ func (m *KubernetesServerSpecV3) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_KubernetesServerSpecV3 proto.InternalMessageInfo
 
+// KubernetesServerStatusV3 is the Kubernetes cluster status.
+type KubernetesServerStatusV3 struct {
+	// TargetHealth is the health status of between the Teleport agent
+	// and Kubernetes cluster.
+	TargetHealth         *TargetHealth `protobuf:"bytes,1,opt,name=target_health,json=targetHealth,proto3" json:"target_health,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+	XXX_unrecognized     []byte        `json:"-"`
+	XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *KubernetesServerStatusV3) Reset()         { *m = KubernetesServerStatusV3{} }
+func (m *KubernetesServerStatusV3) String() string { return proto.CompactTextString(m) }
+func (*KubernetesServerStatusV3) ProtoMessage()    {}
+func (*KubernetesServerStatusV3) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{216}
+}
+func (m *KubernetesServerStatusV3) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *KubernetesServerStatusV3) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_KubernetesServerStatusV3.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *KubernetesServerStatusV3) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_KubernetesServerStatusV3.Merge(m, src)
+}
+func (m *KubernetesServerStatusV3) XXX_Size() int {
+	return m.Size()
+}
+func (m *KubernetesServerStatusV3) XXX_DiscardUnknown() {
+	xxx_messageInfo_KubernetesServerStatusV3.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_KubernetesServerStatusV3 proto.InternalMessageInfo
+
 // WebTokenV3 describes a web token. Web tokens are used as a transport to relay bearer tokens
 // to the client.
 // Initially bound to a web session, these have been factored out into a separate resource to
@@ -12750,7 +13720,7 @@ type WebTokenV3 struct {
 func (m *WebTokenV3) Reset()      { *m = WebTokenV3{} }
 func (*WebTokenV3) ProtoMessage() {}
 func (*WebTokenV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{201}
+	return fileDescriptor_9198ee693835762e, []int{217}
 }
 func (m *WebTokenV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12794,7 +13764,7 @@ func (m *WebTokenSpecV3) Reset()         { *m = WebTokenSpecV3{} }
 func (m *WebTokenSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WebTokenSpecV3) ProtoMessage()    {}
 func (*WebTokenSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{202}
+	return fileDescriptor_9198ee693835762e, []int{218}
 }
 func (m *WebTokenSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12838,7 +13808,7 @@ func (m *GetWebSessionRequest) Reset()         { *m = GetWebSessionRequest{} }
 func (m *GetWebSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*GetWebSessionRequest) ProtoMessage()    {}
 func (*GetWebSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{203}
+	return fileDescriptor_9198ee693835762e, []int{219}
 }
 func (m *GetWebSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12882,7 +13852,7 @@ func (m *DeleteWebSessionRequest) Reset()         { *m = DeleteWebSessionRequest
 func (m *DeleteWebSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWebSessionRequest) ProtoMessage()    {}
 func (*DeleteWebSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{204}
+	return fileDescriptor_9198ee693835762e, []int{220}
 }
 func (m *DeleteWebSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12926,7 +13896,7 @@ func (m *GetWebTokenRequest) Reset()         { *m = GetWebTokenRequest{} }
 func (m *GetWebTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*GetWebTokenRequest) ProtoMessage()    {}
 func (*GetWebTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{205}
+	return fileDescriptor_9198ee693835762e, []int{221}
 }
 func (m *GetWebTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12970,7 +13940,7 @@ func (m *DeleteWebTokenRequest) Reset()         { *m = DeleteWebTokenRequest{} }
 func (m *DeleteWebTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWebTokenRequest) ProtoMessage()    {}
 func (*DeleteWebTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{206}
+	return fileDescriptor_9198ee693835762e, []int{222}
 }
 func (m *DeleteWebTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13012,7 +13982,7 @@ func (m *ResourceRequest) Reset()         { *m = ResourceRequest{} }
 func (m *ResourceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceRequest) ProtoMessage()    {}
 func (*ResourceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{207}
+	return fileDescriptor_9198ee693835762e, []int{223}
 }
 func (m *ResourceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13061,7 +14031,7 @@ func (m *ResourceWithSecretsRequest) Reset()         { *m = ResourceWithSecretsR
 func (m *ResourceWithSecretsRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceWithSecretsRequest) ProtoMessage()    {}
 func (*ResourceWithSecretsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{208}
+	return fileDescriptor_9198ee693835762e, []int{224}
 }
 func (m *ResourceWithSecretsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13108,7 +14078,7 @@ func (m *ResourcesWithSecretsRequest) Reset()         { *m = ResourcesWithSecret
 func (m *ResourcesWithSecretsRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourcesWithSecretsRequest) ProtoMessage()    {}
 func (*ResourcesWithSecretsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{209}
+	return fileDescriptor_9198ee693835762e, []int{225}
 }
 func (m *ResourcesWithSecretsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13152,7 +14122,7 @@ func (m *ResourceInNamespaceRequest) Reset()         { *m = ResourceInNamespaceR
 func (m *ResourceInNamespaceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceInNamespaceRequest) ProtoMessage()    {}
 func (*ResourceInNamespaceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{210}
+	return fileDescriptor_9198ee693835762e, []int{226}
 }
 func (m *ResourceInNamespaceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13194,7 +14164,7 @@ func (m *ResourcesInNamespaceRequest) Reset()         { *m = ResourcesInNamespac
 func (m *ResourcesInNamespaceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourcesInNamespaceRequest) ProtoMessage()    {}
 func (*ResourcesInNamespaceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{211}
+	return fileDescriptor_9198ee693835762e, []int{227}
 }
 func (m *ResourcesInNamespaceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13245,7 +14215,7 @@ func (m *OIDCConnectorV3) Reset()         { *m = OIDCConnectorV3{} }
 func (m *OIDCConnectorV3) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorV3) ProtoMessage()    {}
 func (*OIDCConnectorV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{212}
+	return fileDescriptor_9198ee693835762e, []int{228}
 }
 func (m *OIDCConnectorV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13287,7 +14257,7 @@ func (m *OIDCConnectorV3List) Reset()         { *m = OIDCConnectorV3List{} }
 func (m *OIDCConnectorV3List) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorV3List) ProtoMessage()    {}
 func (*OIDCConnectorV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{213}
+	return fileDescriptor_9198ee693835762e, []int{229}
 }
 func (m *OIDCConnectorV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13367,17 +14337,28 @@ type OIDCConnectorSpecV3 struct {
 	// MFASettings contains settings to enable SSO MFA checks through this auth connector.
 	MFASettings *OIDCConnectorMFASettings `protobuf:"bytes,19,opt,name=MFASettings,proto3" json:"mfa,omitempty"`
 	// PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
-	PKCEMode             string   `protobuf:"bytes,20,opt,name=PKCEMode,proto3" json:"pkce_mode,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	PKCEMode string `protobuf:"bytes,20,opt,name=PKCEMode,proto3" json:"pkce_mode,omitempty"`
+	// UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	UserMatchers []string `protobuf:"bytes,21,rep,name=UserMatchers,proto3" json:"user_matchers,omitempty"`
+	// RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization
+	// requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality
+	// for authorization request parameters.
+	RequestObjectMode string `protobuf:"bytes,22,opt,name=RequestObjectMode,proto3" json:"request_object_mode,omitempty"`
+	// EntraIDGroupsProvider configures out-of-band user groups provider.
+	// It works by following through the groups claim source, which is sent for the "groups"
+	// claim when the user's group membership exceeds 200 max item limit.
+	EntraIdGroupsProvider *EntraIDGroupsProvider `protobuf:"bytes,23,opt,name=entra_id_groups_provider,json=entraIdGroupsProvider,proto3" json:"entra_id_groups_provider,omitempty"`
+	XXX_NoUnkeyedLiteral  struct{}               `json:"-"`
+	XXX_unrecognized      []byte                 `json:"-"`
+	XXX_sizecache         int32                  `json:"-"`
 }
 
 func (m *OIDCConnectorSpecV3) Reset()         { *m = OIDCConnectorSpecV3{} }
 func (m *OIDCConnectorSpecV3) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorSpecV3) ProtoMessage()    {}
 func (*OIDCConnectorSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{214}
+	return fileDescriptor_9198ee693835762e, []int{230}
 }
 func (m *OIDCConnectorSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13406,6 +14387,65 @@ func (m *OIDCConnectorSpecV3) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_OIDCConnectorSpecV3 proto.InternalMessageInfo
 
+// EntraIDGroupsProvider configures out-of-band user groups provider.
+// It works by following through the groups claim source, which is sent for
+// "groups" claim when the user's group membership exceeds 200 max item limit.
+type EntraIDGroupsProvider struct {
+	// Disabled specifies that the groups provider should be disabled
+	// even when Entra ID responds with a groups claim source.
+	// User may choose to disable it if they are using
+	// integrations such as SCIM or similar groups importer as
+	// connector based role mapping may be not needed in such a scenario.
+	Disabled bool `protobuf:"varint,1,opt,name=disabled,proto3" json:"disabled,omitempty"`
+	// GroupType is a user group type filter. Defaults to "security-groups".
+	// Value can be "security-groups", "directory-roles", "all-groups".
+	GroupType string `protobuf:"bytes,2,opt,name=group_type,json=groupType,proto3" json:"group_type,omitempty"`
+	// GraphEndpoint is a Microsoft Graph API endpoint.
+	// The groups claim source endpoint provided by Entra ID points to the
+	// now-retired Azure AD Graph endpoint ("https://graph.windows.net").
+	// To convert it to the newer Microsoft Graph API endpoint,
+	// Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com").
+	// Update GraphEndpoint to point to a different Microsoft Graph national
+	// cloud deployment endpoint.
+	GraphEndpoint        string   `protobuf:"bytes,3,opt,name=graph_endpoint,json=graphEndpoint,proto3" json:"graph_endpoint,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *EntraIDGroupsProvider) Reset()         { *m = EntraIDGroupsProvider{} }
+func (m *EntraIDGroupsProvider) String() string { return proto.CompactTextString(m) }
+func (*EntraIDGroupsProvider) ProtoMessage()    {}
+func (*EntraIDGroupsProvider) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{231}
+}
+func (m *EntraIDGroupsProvider) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *EntraIDGroupsProvider) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_EntraIDGroupsProvider.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *EntraIDGroupsProvider) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_EntraIDGroupsProvider.Merge(m, src)
+}
+func (m *EntraIDGroupsProvider) XXX_Size() int {
+	return m.Size()
+}
+func (m *EntraIDGroupsProvider) XXX_DiscardUnknown() {
+	xxx_messageInfo_EntraIDGroupsProvider.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EntraIDGroupsProvider proto.InternalMessageInfo
+
 // MaxAge allows the max_age parameter to be nullable to preserve backwards
 // compatibility. The duration is stored as nanoseconds.
 type MaxAge struct {
@@ -13419,7 +14459,7 @@ func (m *MaxAge) Reset()         { *m = MaxAge{} }
 func (m *MaxAge) String() string { return proto.CompactTextString(m) }
 func (*MaxAge) ProtoMessage()    {}
 func (*MaxAge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{215}
+	return fileDescriptor_9198ee693835762e, []int{232}
 }
 func (m *MaxAge) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13464,7 +14504,7 @@ func (m *SSOClientRedirectSettings) Reset()         { *m = SSOClientRedirectSett
 func (m *SSOClientRedirectSettings) String() string { return proto.CompactTextString(m) }
 func (*SSOClientRedirectSettings) ProtoMessage()    {}
 func (*SSOClientRedirectSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{216}
+	return fileDescriptor_9198ee693835762e, []int{233}
 }
 func (m *SSOClientRedirectSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13511,7 +14551,13 @@ type OIDCConnectorMFASettings struct {
 	// MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to
 	// 0 to always force re-authentication for MFA checks. This should only be set to a non-zero
 	// value if the IdP is setup to perform MFA checks on top of active user sessions.
-	MaxAge               Duration `protobuf:"varint,6,opt,name=max_age,json=maxAge,proto3,casttype=Duration" json:"max_age,omitempty"`
+	MaxAge Duration `protobuf:"varint,6,opt,name=max_age,json=maxAge,proto3,casttype=Duration" json:"max_age,omitempty"`
+	// RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization
+	// requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality
+	// for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior
+	// specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for
+	// the MFA client.
+	RequestObjectMode    string   `protobuf:"bytes,7,opt,name=RequestObjectMode,proto3" json:"request_object_mode,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -13521,7 +14567,7 @@ func (m *OIDCConnectorMFASettings) Reset()         { *m = OIDCConnectorMFASettin
 func (m *OIDCConnectorMFASettings) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorMFASettings) ProtoMessage()    {}
 func (*OIDCConnectorMFASettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{217}
+	return fileDescriptor_9198ee693835762e, []int{234}
 }
 func (m *OIDCConnectorMFASettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13602,11 +14648,14 @@ type OIDCAuthRequest struct {
 	// TLS cert in case of successful auth.
 	TlsPublicKey []byte `protobuf:"bytes,21,opt,name=tls_public_key,json=tlsPublicKey,proto3" json:"tls_pub_key,omitempty"`
 	// SshAttestationStatement is an attestation statement for the given SSH public key.
-	SshAttestationStatement *v1.AttestationStatement `protobuf:"bytes,22,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
+	SshAttestationStatement *v11.AttestationStatement `protobuf:"bytes,22,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
 	// TlsAttestationStatement is an attestation statement for the given TLS public key.
-	TlsAttestationStatement *v1.AttestationStatement `protobuf:"bytes,23,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
+	TlsAttestationStatement *v11.AttestationStatement `protobuf:"bytes,23,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
 	// pkce_verifier is used to verified a generated code challenge.
-	PkceVerifier         string   `protobuf:"bytes,24,opt,name=pkce_verifier,json=pkceVerifier,proto3" json:"pkce_verifier"`
+	PkceVerifier string `protobuf:"bytes,24,opt,name=pkce_verifier,json=pkceVerifier,proto3" json:"pkce_verifier"`
+	// LoginHint is an optional username/email provided by the client that will be passed
+	// to the IdP via the 'login_hint' query parameter.
+	LoginHint            string   `protobuf:"bytes,25,opt,name=login_hint,json=loginHint,proto3" json:"login_hint,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -13616,7 +14665,7 @@ func (m *OIDCAuthRequest) Reset()         { *m = OIDCAuthRequest{} }
 func (m *OIDCAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*OIDCAuthRequest) ProtoMessage()    {}
 func (*OIDCAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{218}
+	return fileDescriptor_9198ee693835762e, []int{235}
 }
 func (m *OIDCAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13667,7 +14716,7 @@ func (m *SAMLConnectorV2) Reset()         { *m = SAMLConnectorV2{} }
 func (m *SAMLConnectorV2) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorV2) ProtoMessage()    {}
 func (*SAMLConnectorV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{219}
+	return fileDescriptor_9198ee693835762e, []int{236}
 }
 func (m *SAMLConnectorV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13709,7 +14758,7 @@ func (m *SAMLConnectorV2List) Reset()         { *m = SAMLConnectorV2List{} }
 func (m *SAMLConnectorV2List) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorV2List) ProtoMessage()    {}
 func (*SAMLConnectorV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{220}
+	return fileDescriptor_9198ee693835762e, []int{237}
 }
 func (m *SAMLConnectorV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13789,17 +14838,24 @@ type SAMLConnectorSpecV2 struct {
 	// But we never honored request binding value provided by the IdP and always used http-redirect
 	// binding as a default. Setting up PreferredRequestBinding value lets us preserve existing
 	// auth connector behavior and only use http-post binding if it is explicitly configured.
-	PreferredRequestBinding string   `protobuf:"bytes,19,opt,name=PreferredRequestBinding,proto3" json:"preferred_request_binding,omitempty"`
-	XXX_NoUnkeyedLiteral    struct{} `json:"-"`
-	XXX_unrecognized        []byte   `json:"-"`
-	XXX_sizecache           int32    `json:"-"`
+	PreferredRequestBinding string `protobuf:"bytes,19,opt,name=PreferredRequestBinding,proto3" json:"preferred_request_binding,omitempty"`
+	// UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	UserMatchers []string `protobuf:"bytes,20,rep,name=UserMatchers,proto3" json:"user_matchers,omitempty"`
+	// IncludeSubject is a flag that indicates whether the Subject element is included in the SAML
+	// authentication request. Defaults to false.
+	// Note: Some IdPs will reject requests that contain a Subject.
+	IncludeSubject       bool     `protobuf:"varint,21,opt,name=IncludeSubject,proto3" json:"include_subject,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *SAMLConnectorSpecV2) Reset()         { *m = SAMLConnectorSpecV2{} }
 func (m *SAMLConnectorSpecV2) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorSpecV2) ProtoMessage()    {}
 func (*SAMLConnectorSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{221}
+	return fileDescriptor_9198ee693835762e, []int{238}
 }
 func (m *SAMLConnectorSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13858,7 +14914,7 @@ func (m *SAMLConnectorMFASettings) Reset()         { *m = SAMLConnectorMFASettin
 func (m *SAMLConnectorMFASettings) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorMFASettings) ProtoMessage()    {}
 func (*SAMLConnectorMFASettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{222}
+	return fileDescriptor_9198ee693835762e, []int{239}
 }
 func (m *SAMLConnectorMFASettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13933,15 +14989,18 @@ type SAMLAuthRequest struct {
 	// TLS cert in case of successful auth.
 	TlsPublicKey []byte `protobuf:"bytes,20,opt,name=tls_public_key,json=tlsPublicKey,proto3" json:"tls_pub_key,omitempty"`
 	// SshAttestationStatement is an attestation statement for the given SSH public key.
-	SshAttestationStatement *v1.AttestationStatement `protobuf:"bytes,21,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
+	SshAttestationStatement *v11.AttestationStatement `protobuf:"bytes,21,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
 	// TlsAttestationStatement is an attestation statement for the given TLS public key.
-	TlsAttestationStatement *v1.AttestationStatement `protobuf:"bytes,22,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
+	TlsAttestationStatement *v11.AttestationStatement `protobuf:"bytes,22,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
 	// PostForm is the HTML form value that contains the SAML authentication request data.
 	// Value is only set if the PreferredRequestBinding in the SAMLConnectorSpecV2
 	// is "http-post". In any other case, RedirectURL field will be populated.
 	PostForm []byte `protobuf:"bytes,23,opt,name=PostForm,proto3" json:"post_form,omitempty"`
 	// ClientVersion is the version of tsh or Proxy that is sending the SAMLAuthRequest request.
-	ClientVersion        string   `protobuf:"bytes,24,opt,name=ClientVersion,proto3" json:"client_version,omitempty"`
+	ClientVersion string `protobuf:"bytes,24,opt,name=ClientVersion,proto3" json:"client_version,omitempty"`
+	// SubjectIdentifier is an optional username/email provided by the client that will be
+	// passed to prepopulate the IdP's login form
+	SubjectIdentifier    string   `protobuf:"bytes,25,opt,name=SubjectIdentifier,proto3" json:"subject_identifier,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -13951,7 +15010,7 @@ func (m *SAMLAuthRequest) Reset()         { *m = SAMLAuthRequest{} }
 func (m *SAMLAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*SAMLAuthRequest) ProtoMessage()    {}
 func (*SAMLAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{223}
+	return fileDescriptor_9198ee693835762e, []int{240}
 }
 func (m *SAMLAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13997,7 +15056,7 @@ func (m *AttributeMapping) Reset()         { *m = AttributeMapping{} }
 func (m *AttributeMapping) String() string { return proto.CompactTextString(m) }
 func (*AttributeMapping) ProtoMessage()    {}
 func (*AttributeMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{224}
+	return fileDescriptor_9198ee693835762e, []int{241}
 }
 func (m *AttributeMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14042,7 +15101,7 @@ func (m *AsymmetricKeyPair) Reset()         { *m = AsymmetricKeyPair{} }
 func (m *AsymmetricKeyPair) String() string { return proto.CompactTextString(m) }
 func (*AsymmetricKeyPair) ProtoMessage()    {}
 func (*AsymmetricKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{225}
+	return fileDescriptor_9198ee693835762e, []int{242}
 }
 func (m *AsymmetricKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14093,7 +15152,7 @@ func (m *GithubConnectorV3) Reset()         { *m = GithubConnectorV3{} }
 func (m *GithubConnectorV3) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorV3) ProtoMessage()    {}
 func (*GithubConnectorV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{226}
+	return fileDescriptor_9198ee693835762e, []int{243}
 }
 func (m *GithubConnectorV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14135,7 +15194,7 @@ func (m *GithubConnectorV3List) Reset()         { *m = GithubConnectorV3List{} }
 func (m *GithubConnectorV3List) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorV3List) ProtoMessage()    {}
 func (*GithubConnectorV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{227}
+	return fileDescriptor_9198ee693835762e, []int{244}
 }
 func (m *GithubConnectorV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14189,16 +15248,19 @@ type GithubConnectorSpecV3 struct {
 	// ClientRedirectSettings defines which client redirect URLs are allowed for
 	// non-browser SSO logins other than the standard localhost ones.
 	ClientRedirectSettings *SSOClientRedirectSettings `protobuf:"bytes,9,opt,name=ClientRedirectSettings,proto3" json:"client_redirect_settings,omitempty"`
-	XXX_NoUnkeyedLiteral   struct{}                   `json:"-"`
-	XXX_unrecognized       []byte                     `json:"-"`
-	XXX_sizecache          int32                      `json:"-"`
+	// UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should
+	// match for identifier-first login.
+	UserMatchers         []string `protobuf:"bytes,10,rep,name=UserMatchers,proto3" json:"user_matchers,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *GithubConnectorSpecV3) Reset()         { *m = GithubConnectorSpecV3{} }
 func (m *GithubConnectorSpecV3) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorSpecV3) ProtoMessage()    {}
 func (*GithubConnectorSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{228}
+	return fileDescriptor_9198ee693835762e, []int{245}
 }
 func (m *GithubConnectorSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14271,9 +15333,9 @@ type GithubAuthRequest struct {
 	// TLS cert in case of successful auth.
 	TlsPublicKey []byte `protobuf:"bytes,20,opt,name=tls_public_key,json=tlsPublicKey,proto3" json:"tls_pub_key,omitempty"`
 	// SshAttestationStatement is an attestation statement for the given SSH public key.
-	SshAttestationStatement *v1.AttestationStatement `protobuf:"bytes,21,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
+	SshAttestationStatement *v11.AttestationStatement `protobuf:"bytes,21,opt,name=ssh_attestation_statement,json=sshAttestationStatement,proto3" json:"ssh_attestation_statement,omitempty"`
 	// TlsAttestationStatement is an attestation statement for the given TLS public key.
-	TlsAttestationStatement *v1.AttestationStatement `protobuf:"bytes,22,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
+	TlsAttestationStatement *v11.AttestationStatement `protobuf:"bytes,22,opt,name=tls_attestation_statement,json=tlsAttestationStatement,proto3" json:"tls_attestation_statement,omitempty"`
 	// AuthenticatedUser is the username of an authenticated Teleport user. This
 	// OAuth flow is used to retrieve GitHub identity info which will be added to
 	// the existing user.
@@ -14287,7 +15349,7 @@ func (m *GithubAuthRequest) Reset()         { *m = GithubAuthRequest{} }
 func (m *GithubAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*GithubAuthRequest) ProtoMessage()    {}
 func (*GithubAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{229}
+	return fileDescriptor_9198ee693835762e, []int{246}
 }
 func (m *GithubAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14331,7 +15393,7 @@ func (m *SSOWarnings) Reset()         { *m = SSOWarnings{} }
 func (m *SSOWarnings) String() string { return proto.CompactTextString(m) }
 func (*SSOWarnings) ProtoMessage()    {}
 func (*SSOWarnings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{230}
+	return fileDescriptor_9198ee693835762e, []int{247}
 }
 func (m *SSOWarnings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14387,7 +15449,7 @@ func (m *CreateUserParams) Reset()         { *m = CreateUserParams{} }
 func (m *CreateUserParams) String() string { return proto.CompactTextString(m) }
 func (*CreateUserParams) ProtoMessage()    {}
 func (*CreateUserParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{231}
+	return fileDescriptor_9198ee693835762e, []int{248}
 }
 func (m *CreateUserParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14472,7 +15534,7 @@ func (m *SSODiagnosticInfo) Reset()         { *m = SSODiagnosticInfo{} }
 func (m *SSODiagnosticInfo) String() string { return proto.CompactTextString(m) }
 func (*SSODiagnosticInfo) ProtoMessage()    {}
 func (*SSODiagnosticInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{232}
+	return fileDescriptor_9198ee693835762e, []int{249}
 }
 func (m *SSODiagnosticInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14516,7 +15578,7 @@ func (m *GithubTokenInfo) Reset()         { *m = GithubTokenInfo{} }
 func (m *GithubTokenInfo) String() string { return proto.CompactTextString(m) }
 func (*GithubTokenInfo) ProtoMessage()    {}
 func (*GithubTokenInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{233}
+	return fileDescriptor_9198ee693835762e, []int{250}
 }
 func (m *GithubTokenInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14567,7 +15629,7 @@ func (m *GithubClaims) Reset()         { *m = GithubClaims{} }
 func (m *GithubClaims) String() string { return proto.CompactTextString(m) }
 func (*GithubClaims) ProtoMessage()    {}
 func (*GithubClaims) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{234}
+	return fileDescriptor_9198ee693835762e, []int{251}
 }
 func (m *GithubClaims) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14619,7 +15681,7 @@ func (m *TeamMapping) Reset()         { *m = TeamMapping{} }
 func (m *TeamMapping) String() string { return proto.CompactTextString(m) }
 func (*TeamMapping) ProtoMessage()    {}
 func (*TeamMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{235}
+	return fileDescriptor_9198ee693835762e, []int{252}
 }
 func (m *TeamMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14665,7 +15727,7 @@ func (m *TeamRolesMapping) Reset()         { *m = TeamRolesMapping{} }
 func (m *TeamRolesMapping) String() string { return proto.CompactTextString(m) }
 func (*TeamRolesMapping) ProtoMessage()    {}
 func (*TeamRolesMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{236}
+	return fileDescriptor_9198ee693835762e, []int{253}
 }
 func (m *TeamRolesMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14715,7 +15777,7 @@ type TrustedClusterV2 struct {
 func (m *TrustedClusterV2) Reset()      { *m = TrustedClusterV2{} }
 func (*TrustedClusterV2) ProtoMessage() {}
 func (*TrustedClusterV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{237}
+	return fileDescriptor_9198ee693835762e, []int{254}
 }
 func (m *TrustedClusterV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14757,7 +15819,7 @@ func (m *TrustedClusterV2List) Reset()         { *m = TrustedClusterV2List{} }
 func (m *TrustedClusterV2List) String() string { return proto.CompactTextString(m) }
 func (*TrustedClusterV2List) ProtoMessage()    {}
 func (*TrustedClusterV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{238}
+	return fileDescriptor_9198ee693835762e, []int{255}
 }
 func (m *TrustedClusterV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14813,7 +15875,7 @@ func (m *TrustedClusterSpecV2) Reset()         { *m = TrustedClusterSpecV2{} }
 func (m *TrustedClusterSpecV2) String() string { return proto.CompactTextString(m) }
 func (*TrustedClusterSpecV2) ProtoMessage()    {}
 func (*TrustedClusterSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{239}
+	return fileDescriptor_9198ee693835762e, []int{256}
 }
 func (m *TrustedClusterSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14867,7 +15929,7 @@ func (m *LockV2) Reset()         { *m = LockV2{} }
 func (m *LockV2) String() string { return proto.CompactTextString(m) }
 func (*LockV2) ProtoMessage()    {}
 func (*LockV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{240}
+	return fileDescriptor_9198ee693835762e, []int{257}
 }
 func (m *LockV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14917,7 +15979,7 @@ func (m *LockSpecV2) Reset()         { *m = LockSpecV2{} }
 func (m *LockSpecV2) String() string { return proto.CompactTextString(m) }
 func (*LockSpecV2) ProtoMessage()    {}
 func (*LockSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{241}
+	return fileDescriptor_9198ee693835762e, []int{258}
 }
 func (m *LockSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14965,7 +16027,14 @@ type LockTarget struct {
 	// Requires Teleport Enterprise.
 	Device string `protobuf:"bytes,8,opt,name=Device,proto3" json:"device,omitempty"`
 	// ServerID is the host id of the Teleport instance.
-	ServerID             string   `protobuf:"bytes,9,opt,name=ServerID,proto3" json:"server_id,omitempty"`
+	ServerID string `protobuf:"bytes,9,opt,name=ServerID,proto3" json:"server_id,omitempty"`
+	// BotInstanceID is the bot instance ID if this is a bot identity and is
+	// ignored otherwise.
+	BotInstanceID string `protobuf:"bytes,10,opt,name=BotInstanceID,proto3" json:"bot_instance_id,omitempty"`
+	// JoinToken is the name of the join token used when this identity originally
+	// joined. This is only valid for bot identities, and cannot be used to target
+	// `token`-joined bots.
+	JoinToken            string   `protobuf:"bytes,11,opt,name=JoinToken,proto3" json:"join_token,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -14974,7 +16043,7 @@ type LockTarget struct {
 func (m *LockTarget) Reset()      { *m = LockTarget{} }
 func (*LockTarget) ProtoMessage() {}
 func (*LockTarget) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{242}
+	return fileDescriptor_9198ee693835762e, []int{259}
 }
 func (m *LockTarget) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15003,6 +16072,51 @@ func (m *LockTarget) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_LockTarget proto.InternalMessageInfo
 
+// LockFilter encodes optional filters to apply when listing Lock resources
+type LockFilter struct {
+	// Targets is a list of targets. Every returned lock must match at least
+	// one of the targets.
+	Targets []*LockTarget `protobuf:"bytes,1,rep,name=targets,proto3" json:"targets,omitempty"`
+	// InForceOnly specifies whether to return active locks only.
+	InForceOnly          bool     `protobuf:"varint,2,opt,name=in_force_only,json=inForceOnly,proto3" json:"in_force_only,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *LockFilter) Reset()         { *m = LockFilter{} }
+func (m *LockFilter) String() string { return proto.CompactTextString(m) }
+func (*LockFilter) ProtoMessage()    {}
+func (*LockFilter) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{260}
+}
+func (m *LockFilter) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LockFilter) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LockFilter.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LockFilter) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LockFilter.Merge(m, src)
+}
+func (m *LockFilter) XXX_Size() int {
+	return m.Size()
+}
+func (m *LockFilter) XXX_DiscardUnknown() {
+	xxx_messageInfo_LockFilter.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LockFilter proto.InternalMessageInfo
+
 // AddressCondition represents a set of addresses. Presently the addresses are specified
 // exclusively in terms of IPv4/IPv6 ranges.
 type AddressCondition struct {
@@ -15018,7 +16132,7 @@ func (m *AddressCondition) Reset()         { *m = AddressCondition{} }
 func (m *AddressCondition) String() string { return proto.CompactTextString(m) }
 func (*AddressCondition) ProtoMessage()    {}
 func (*AddressCondition) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{243}
+	return fileDescriptor_9198ee693835762e, []int{261}
 }
 func (m *AddressCondition) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15061,7 +16175,7 @@ func (m *NetworkRestrictionsSpecV4) Reset()         { *m = NetworkRestrictionsSp
 func (m *NetworkRestrictionsSpecV4) String() string { return proto.CompactTextString(m) }
 func (*NetworkRestrictionsSpecV4) ProtoMessage()    {}
 func (*NetworkRestrictionsSpecV4) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{244}
+	return fileDescriptor_9198ee693835762e, []int{262}
 }
 func (m *NetworkRestrictionsSpecV4) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15114,7 +16228,7 @@ func (m *NetworkRestrictionsV4) Reset()         { *m = NetworkRestrictionsV4{} }
 func (m *NetworkRestrictionsV4) String() string { return proto.CompactTextString(m) }
 func (*NetworkRestrictionsV4) ProtoMessage()    {}
 func (*NetworkRestrictionsV4) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{245}
+	return fileDescriptor_9198ee693835762e, []int{263}
 }
 func (m *NetworkRestrictionsV4) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15158,7 +16272,7 @@ func (m *WindowsDesktopServiceV3) Reset()         { *m = WindowsDesktopServiceV3
 func (m *WindowsDesktopServiceV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopServiceV3) ProtoMessage()    {}
 func (*WindowsDesktopServiceV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{246}
+	return fileDescriptor_9198ee693835762e, []int{264}
 }
 func (m *WindowsDesktopServiceV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15196,7 +16310,11 @@ type WindowsDesktopServiceSpecV3 struct {
 	// Hostname is the desktop service hostname.
 	Hostname string `protobuf:"bytes,3,opt,name=Hostname,proto3" json:"hostname"`
 	// ProxyIDs is a list of proxy IDs this server is expected to be connected to.
-	ProxyIDs             []string `protobuf:"bytes,4,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	ProxyIDs []string `protobuf:"bytes,4,rep,name=ProxyIDs,proto3" json:"proxy_ids,omitempty"`
+	// the name of the Relay group that the server is connected to
+	RelayGroup string `protobuf:"bytes,5,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	// the list of Relay host IDs that the server is connected to
+	RelayIds             []string `protobuf:"bytes,6,rep,name=relay_ids,json=relayIds,proto3" json:"relay_ids,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -15206,7 +16324,7 @@ func (m *WindowsDesktopServiceSpecV3) Reset()         { *m = WindowsDesktopServi
 func (m *WindowsDesktopServiceSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopServiceSpecV3) ProtoMessage()    {}
 func (*WindowsDesktopServiceSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{247}
+	return fileDescriptor_9198ee693835762e, []int{265}
 }
 func (m *WindowsDesktopServiceSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15250,7 +16368,7 @@ func (m *WindowsDesktopFilter) Reset()         { *m = WindowsDesktopFilter{} }
 func (m *WindowsDesktopFilter) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopFilter) ProtoMessage()    {}
 func (*WindowsDesktopFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{248}
+	return fileDescriptor_9198ee693835762e, []int{266}
 }
 func (m *WindowsDesktopFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15294,7 +16412,7 @@ func (m *WindowsDesktopV3) Reset()         { *m = WindowsDesktopV3{} }
 func (m *WindowsDesktopV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopV3) ProtoMessage()    {}
 func (*WindowsDesktopV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{249}
+	return fileDescriptor_9198ee693835762e, []int{267}
 }
 func (m *WindowsDesktopV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15347,7 +16465,7 @@ func (m *WindowsDesktopSpecV3) Reset()         { *m = WindowsDesktopSpecV3{} }
 func (m *WindowsDesktopSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopSpecV3) ProtoMessage()    {}
 func (*WindowsDesktopSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{250}
+	return fileDescriptor_9198ee693835762e, []int{268}
 }
 func (m *WindowsDesktopSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15391,7 +16509,7 @@ func (m *DynamicWindowsDesktopV1) Reset()         { *m = DynamicWindowsDesktopV1
 func (m *DynamicWindowsDesktopV1) String() string { return proto.CompactTextString(m) }
 func (*DynamicWindowsDesktopV1) ProtoMessage()    {}
 func (*DynamicWindowsDesktopV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{251}
+	return fileDescriptor_9198ee693835762e, []int{269}
 }
 func (m *DynamicWindowsDesktopV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15442,7 +16560,7 @@ func (m *DynamicWindowsDesktopSpecV1) Reset()         { *m = DynamicWindowsDeskt
 func (m *DynamicWindowsDesktopSpecV1) String() string { return proto.CompactTextString(m) }
 func (*DynamicWindowsDesktopSpecV1) ProtoMessage()    {}
 func (*DynamicWindowsDesktopSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{252}
+	return fileDescriptor_9198ee693835762e, []int{270}
 }
 func (m *DynamicWindowsDesktopSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15483,7 +16601,7 @@ func (m *Resolution) Reset()         { *m = Resolution{} }
 func (m *Resolution) String() string { return proto.CompactTextString(m) }
 func (*Resolution) ProtoMessage()    {}
 func (*Resolution) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{253}
+	return fileDescriptor_9198ee693835762e, []int{271}
 }
 func (m *Resolution) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15570,7 +16688,7 @@ func (m *RegisterUsingTokenRequest) Reset()         { *m = RegisterUsingTokenReq
 func (m *RegisterUsingTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*RegisterUsingTokenRequest) ProtoMessage()    {}
 func (*RegisterUsingTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{254}
+	return fileDescriptor_9198ee693835762e, []int{272}
 }
 func (m *RegisterUsingTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15624,7 +16742,7 @@ func (m *RecoveryCodesV1) Reset()         { *m = RecoveryCodesV1{} }
 func (m *RecoveryCodesV1) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodesV1) ProtoMessage()    {}
 func (*RecoveryCodesV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{255}
+	return fileDescriptor_9198ee693835762e, []int{273}
 }
 func (m *RecoveryCodesV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15669,7 +16787,7 @@ func (m *RecoveryCodesSpecV1) Reset()         { *m = RecoveryCodesSpecV1{} }
 func (m *RecoveryCodesSpecV1) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodesSpecV1) ProtoMessage()    {}
 func (*RecoveryCodesSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{256}
+	return fileDescriptor_9198ee693835762e, []int{274}
 }
 func (m *RecoveryCodesSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15713,7 +16831,7 @@ func (m *RecoveryCode) Reset()         { *m = RecoveryCode{} }
 func (m *RecoveryCode) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCode) ProtoMessage()    {}
 func (*RecoveryCode) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{257}
+	return fileDescriptor_9198ee693835762e, []int{275}
 }
 func (m *RecoveryCode) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15753,7 +16871,7 @@ func (m *NullableSessionState) Reset()         { *m = NullableSessionState{} }
 func (m *NullableSessionState) String() string { return proto.CompactTextString(m) }
 func (*NullableSessionState) ProtoMessage()    {}
 func (*NullableSessionState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{258}
+	return fileDescriptor_9198ee693835762e, []int{276}
 }
 func (m *NullableSessionState) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15799,7 +16917,7 @@ func (m *SessionTrackerFilter) Reset()         { *m = SessionTrackerFilter{} }
 func (m *SessionTrackerFilter) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerFilter) ProtoMessage()    {}
 func (*SessionTrackerFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{259}
+	return fileDescriptor_9198ee693835762e, []int{277}
 }
 func (m *SessionTrackerFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15843,7 +16961,7 @@ func (m *SessionTrackerV1) Reset()         { *m = SessionTrackerV1{} }
 func (m *SessionTrackerV1) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerV1) ProtoMessage()    {}
 func (*SessionTrackerV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{260}
+	return fileDescriptor_9198ee693835762e, []int{278}
 }
 func (m *SessionTrackerV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15941,7 +17059,7 @@ func (m *SessionTrackerSpecV1) Reset()         { *m = SessionTrackerSpecV1{} }
 func (m *SessionTrackerSpecV1) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerSpecV1) ProtoMessage()    {}
 func (*SessionTrackerSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{261}
+	return fileDescriptor_9198ee693835762e, []int{279}
 }
 func (m *SessionTrackerSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15988,7 +17106,7 @@ func (m *SessionTrackerPolicySet) Reset()         { *m = SessionTrackerPolicySet
 func (m *SessionTrackerPolicySet) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerPolicySet) ProtoMessage()    {}
 func (*SessionTrackerPolicySet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{262}
+	return fileDescriptor_9198ee693835762e, []int{280}
 }
 func (m *SessionTrackerPolicySet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16026,17 +17144,19 @@ type Participant struct {
 	// Mode is the participant mode.
 	Mode string `protobuf:"bytes,3,opt,name=Mode,proto3" json:"mode,omitempty"`
 	// LastActive is the last time this party was active in the session.
-	LastActive           time.Time `protobuf:"bytes,4,opt,name=LastActive,proto3,stdtime" json:"last_active,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
-	XXX_unrecognized     []byte    `json:"-"`
-	XXX_sizecache        int32     `json:"-"`
+	LastActive time.Time `protobuf:"bytes,4,opt,name=LastActive,proto3,stdtime" json:"last_active,omitempty"`
+	// Cluster is the cluster name the user is authenticated against.
+	Cluster              string   `protobuf:"bytes,5,opt,name=Cluster,proto3" json:"cluster,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *Participant) Reset()         { *m = Participant{} }
 func (m *Participant) String() string { return proto.CompactTextString(m) }
 func (*Participant) ProtoMessage()    {}
 func (*Participant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{263}
+	return fileDescriptor_9198ee693835762e, []int{281}
 }
 func (m *Participant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16080,7 +17200,7 @@ func (m *UIConfigV1) Reset()         { *m = UIConfigV1{} }
 func (m *UIConfigV1) String() string { return proto.CompactTextString(m) }
 func (*UIConfigV1) ProtoMessage()    {}
 func (*UIConfigV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{264}
+	return fileDescriptor_9198ee693835762e, []int{282}
 }
 func (m *UIConfigV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16126,7 +17246,7 @@ func (m *UIConfigSpecV1) Reset()         { *m = UIConfigSpecV1{} }
 func (m *UIConfigSpecV1) String() string { return proto.CompactTextString(m) }
 func (*UIConfigSpecV1) ProtoMessage()    {}
 func (*UIConfigSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{265}
+	return fileDescriptor_9198ee693835762e, []int{283}
 }
 func (m *UIConfigSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16177,7 +17297,7 @@ func (m *InstallerV1) Reset()         { *m = InstallerV1{} }
 func (m *InstallerV1) String() string { return proto.CompactTextString(m) }
 func (*InstallerV1) ProtoMessage()    {}
 func (*InstallerV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{266}
+	return fileDescriptor_9198ee693835762e, []int{284}
 }
 func (m *InstallerV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16219,7 +17339,7 @@ func (m *InstallerSpecV1) Reset()         { *m = InstallerSpecV1{} }
 func (m *InstallerSpecV1) String() string { return proto.CompactTextString(m) }
 func (*InstallerSpecV1) ProtoMessage()    {}
 func (*InstallerSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{267}
+	return fileDescriptor_9198ee693835762e, []int{285}
 }
 func (m *InstallerSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16261,7 +17381,7 @@ func (m *InstallerV1List) Reset()         { *m = InstallerV1List{} }
 func (m *InstallerV1List) String() string { return proto.CompactTextString(m) }
 func (*InstallerV1List) ProtoMessage()    {}
 func (*InstallerV1List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{268}
+	return fileDescriptor_9198ee693835762e, []int{286}
 }
 func (m *InstallerV1List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16305,7 +17425,7 @@ func (m *SortBy) Reset()         { *m = SortBy{} }
 func (m *SortBy) String() string { return proto.CompactTextString(m) }
 func (*SortBy) ProtoMessage()    {}
 func (*SortBy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{269}
+	return fileDescriptor_9198ee693835762e, []int{287}
 }
 func (m *SortBy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16351,7 +17471,7 @@ func (m *ConnectionDiagnosticV1) Reset()         { *m = ConnectionDiagnosticV1{}
 func (m *ConnectionDiagnosticV1) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticV1) ProtoMessage()    {}
 func (*ConnectionDiagnosticV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{270}
+	return fileDescriptor_9198ee693835762e, []int{288}
 }
 func (m *ConnectionDiagnosticV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16401,7 +17521,7 @@ func (m *ConnectionDiagnosticSpecV1) Reset()         { *m = ConnectionDiagnostic
 func (m *ConnectionDiagnosticSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticSpecV1) ProtoMessage()    {}
 func (*ConnectionDiagnosticSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{271}
+	return fileDescriptor_9198ee693835762e, []int{289}
 }
 func (m *ConnectionDiagnosticSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16447,7 +17567,7 @@ func (m *ConnectionDiagnosticTrace) Reset()         { *m = ConnectionDiagnosticT
 func (m *ConnectionDiagnosticTrace) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticTrace) ProtoMessage()    {}
 func (*ConnectionDiagnosticTrace) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{272}
+	return fileDescriptor_9198ee693835762e, []int{290}
 }
 func (m *ConnectionDiagnosticTrace) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16490,7 +17610,7 @@ func (m *DatabaseServiceV1) Reset()         { *m = DatabaseServiceV1{} }
 func (m *DatabaseServiceV1) String() string { return proto.CompactTextString(m) }
 func (*DatabaseServiceV1) ProtoMessage()    {}
 func (*DatabaseServiceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{273}
+	return fileDescriptor_9198ee693835762e, []int{291}
 }
 func (m *DatabaseServiceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16534,7 +17654,7 @@ func (m *DatabaseServiceSpecV1) Reset()         { *m = DatabaseServiceSpecV1{} }
 func (m *DatabaseServiceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*DatabaseServiceSpecV1) ProtoMessage()    {}
 func (*DatabaseServiceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{274}
+	return fileDescriptor_9198ee693835762e, []int{292}
 }
 func (m *DatabaseServiceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16576,7 +17696,7 @@ func (m *DatabaseResourceMatcher) Reset()         { *m = DatabaseResourceMatcher
 func (m *DatabaseResourceMatcher) String() string { return proto.CompactTextString(m) }
 func (*DatabaseResourceMatcher) ProtoMessage()    {}
 func (*DatabaseResourceMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{275}
+	return fileDescriptor_9198ee693835762e, []int{293}
 }
 func (m *DatabaseResourceMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16620,7 +17740,7 @@ func (m *ResourceMatcherAWS) Reset()         { *m = ResourceMatcherAWS{} }
 func (m *ResourceMatcherAWS) String() string { return proto.CompactTextString(m) }
 func (*ResourceMatcherAWS) ProtoMessage()    {}
 func (*ResourceMatcherAWS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{276}
+	return fileDescriptor_9198ee693835762e, []int{294}
 }
 func (m *ResourceMatcherAWS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16662,7 +17782,7 @@ func (m *ClusterAlert) Reset()         { *m = ClusterAlert{} }
 func (m *ClusterAlert) String() string { return proto.CompactTextString(m) }
 func (*ClusterAlert) ProtoMessage()    {}
 func (*ClusterAlert) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{277}
+	return fileDescriptor_9198ee693835762e, []int{295}
 }
 func (m *ClusterAlert) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16708,7 +17828,7 @@ func (m *ClusterAlertSpec) Reset()         { *m = ClusterAlertSpec{} }
 func (m *ClusterAlertSpec) String() string { return proto.CompactTextString(m) }
 func (*ClusterAlertSpec) ProtoMessage()    {}
 func (*ClusterAlertSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{278}
+	return fileDescriptor_9198ee693835762e, []int{296}
 }
 func (m *ClusterAlertSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16761,7 +17881,7 @@ func (m *GetClusterAlertsRequest) Reset()         { *m = GetClusterAlertsRequest
 func (m *GetClusterAlertsRequest) String() string { return proto.CompactTextString(m) }
 func (*GetClusterAlertsRequest) ProtoMessage()    {}
 func (*GetClusterAlertsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{279}
+	return fileDescriptor_9198ee693835762e, []int{297}
 }
 func (m *GetClusterAlertsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16811,7 +17931,7 @@ func (m *AlertAcknowledgement) Reset()         { *m = AlertAcknowledgement{} }
 func (m *AlertAcknowledgement) String() string { return proto.CompactTextString(m) }
 func (*AlertAcknowledgement) ProtoMessage()    {}
 func (*AlertAcknowledgement) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{280}
+	return fileDescriptor_9198ee693835762e, []int{298}
 }
 func (m *AlertAcknowledgement) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16863,7 +17983,7 @@ func (m *Release) Reset()         { *m = Release{} }
 func (m *Release) String() string { return proto.CompactTextString(m) }
 func (*Release) ProtoMessage()    {}
 func (*Release) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{281}
+	return fileDescriptor_9198ee693835762e, []int{299}
 }
 func (m *Release) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16921,7 +18041,7 @@ func (m *Asset) Reset()         { *m = Asset{} }
 func (m *Asset) String() string { return proto.CompactTextString(m) }
 func (*Asset) ProtoMessage()    {}
 func (*Asset) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{282}
+	return fileDescriptor_9198ee693835762e, []int{300}
 }
 func (m *Asset) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -16974,7 +18094,7 @@ func (m *PluginV1) Reset()         { *m = PluginV1{} }
 func (m *PluginV1) String() string { return proto.CompactTextString(m) }
 func (*PluginV1) ProtoMessage()    {}
 func (*PluginV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{283}
+	return fileDescriptor_9198ee693835762e, []int{301}
 }
 func (m *PluginV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17027,6 +18147,7 @@ type PluginSpecV1 struct {
 	//	*PluginSpecV1_Msteams
 	//	*PluginSpecV1_NetIq
 	//	*PluginSpecV1_Github
+	//	*PluginSpecV1_Intune
 	Settings isPluginSpecV1_Settings `protobuf_oneof:"settings"`
 	// generation contains a unique ID that should:
 	// - Be created by the backend on plugin creation.
@@ -17043,7 +18164,7 @@ func (m *PluginSpecV1) Reset()         { *m = PluginSpecV1{} }
 func (m *PluginSpecV1) String() string { return proto.CompactTextString(m) }
 func (*PluginSpecV1) ProtoMessage()    {}
 func (*PluginSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{284}
+	return fileDescriptor_9198ee693835762e, []int{302}
 }
 func (m *PluginSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17136,6 +18257,9 @@ type PluginSpecV1_NetIq struct {
 type PluginSpecV1_Github struct {
 	Github *PluginGithubSettings `protobuf:"bytes,20,opt,name=github,proto3,oneof" json:"github,omitempty"`
 }
+type PluginSpecV1_Intune struct {
+	Intune *PluginIntuneSettings `protobuf:"bytes,21,opt,name=intune,proto3,oneof" json:"intune,omitempty"`
+}
 
 func (*PluginSpecV1_SlackAccessPlugin) isPluginSpecV1_Settings() {}
 func (*PluginSpecV1_Opsgenie) isPluginSpecV1_Settings()          {}
@@ -17156,6 +18280,7 @@ func (*PluginSpecV1_Email) isPluginSpecV1_Settings()             {}
 func (*PluginSpecV1_Msteams) isPluginSpecV1_Settings()           {}
 func (*PluginSpecV1_NetIq) isPluginSpecV1_Settings()             {}
 func (*PluginSpecV1_Github) isPluginSpecV1_Settings()            {}
+func (*PluginSpecV1_Intune) isPluginSpecV1_Settings()            {}
 
 func (m *PluginSpecV1) GetSettings() isPluginSpecV1_Settings {
 	if m != nil {
@@ -17297,6 +18422,13 @@ func (m *PluginSpecV1) GetGithub() *PluginGithubSettings {
 	return nil
 }
 
+func (m *PluginSpecV1) GetIntune() *PluginIntuneSettings {
+	if x, ok := m.GetSettings().(*PluginSpecV1_Intune); ok {
+		return x.Intune
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*PluginSpecV1) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -17319,6 +18451,7 @@ func (*PluginSpecV1) XXX_OneofWrappers() []interface{} {
 		(*PluginSpecV1_Msteams)(nil),
 		(*PluginSpecV1_NetIq)(nil),
 		(*PluginSpecV1_Github)(nil),
+		(*PluginSpecV1_Intune)(nil),
 	}
 }
 
@@ -17347,7 +18480,7 @@ func (m *PluginGithubSettings) Reset()         { *m = PluginGithubSettings{} }
 func (m *PluginGithubSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginGithubSettings) ProtoMessage()    {}
 func (*PluginGithubSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{285}
+	return fileDescriptor_9198ee693835762e, []int{303}
 }
 func (m *PluginGithubSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17387,7 +18520,7 @@ func (m *PluginSlackAccessSettings) Reset()         { *m = PluginSlackAccessSett
 func (m *PluginSlackAccessSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginSlackAccessSettings) ProtoMessage()    {}
 func (*PluginSlackAccessSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{286}
+	return fileDescriptor_9198ee693835762e, []int{304}
 }
 func (m *PluginSlackAccessSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17428,7 +18561,7 @@ func (m *PluginGitlabSettings) Reset()         { *m = PluginGitlabSettings{} }
 func (m *PluginGitlabSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginGitlabSettings) ProtoMessage()    {}
 func (*PluginGitlabSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{287}
+	return fileDescriptor_9198ee693835762e, []int{305}
 }
 func (m *PluginGitlabSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17475,7 +18608,7 @@ func (m *PluginOpsgenieAccessSettings) Reset()         { *m = PluginOpsgenieAcce
 func (m *PluginOpsgenieAccessSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOpsgenieAccessSettings) ProtoMessage()    {}
 func (*PluginOpsgenieAccessSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{288}
+	return fileDescriptor_9198ee693835762e, []int{306}
 }
 func (m *PluginOpsgenieAccessSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17523,7 +18656,7 @@ func (m *PluginServiceNowSettings) Reset()         { *m = PluginServiceNowSettin
 func (m *PluginServiceNowSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginServiceNowSettings) ProtoMessage()    {}
 func (*PluginServiceNowSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{289}
+	return fileDescriptor_9198ee693835762e, []int{307}
 }
 func (m *PluginServiceNowSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17569,7 +18702,7 @@ func (m *PluginPagerDutySettings) Reset()         { *m = PluginPagerDutySettings
 func (m *PluginPagerDutySettings) String() string { return proto.CompactTextString(m) }
 func (*PluginPagerDutySettings) ProtoMessage()    {}
 func (*PluginPagerDutySettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{290}
+	return fileDescriptor_9198ee693835762e, []int{308}
 }
 func (m *PluginPagerDutySettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17615,7 +18748,7 @@ func (m *PluginJiraSettings) Reset()         { *m = PluginJiraSettings{} }
 func (m *PluginJiraSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginJiraSettings) ProtoMessage()    {}
 func (*PluginJiraSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{291}
+	return fileDescriptor_9198ee693835762e, []int{309}
 }
 func (m *PluginJiraSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17655,7 +18788,7 @@ func (m *PluginOpenAISettings) Reset()         { *m = PluginOpenAISettings{} }
 func (m *PluginOpenAISettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOpenAISettings) ProtoMessage()    {}
 func (*PluginOpenAISettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{292}
+	return fileDescriptor_9198ee693835762e, []int{310}
 }
 func (m *PluginOpenAISettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17706,7 +18839,7 @@ func (m *PluginMattermostSettings) Reset()         { *m = PluginMattermostSettin
 func (m *PluginMattermostSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginMattermostSettings) ProtoMessage()    {}
 func (*PluginMattermostSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{293}
+	return fileDescriptor_9198ee693835762e, []int{311}
 }
 func (m *PluginMattermostSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17748,7 +18881,7 @@ func (m *PluginJamfSettings) Reset()         { *m = PluginJamfSettings{} }
 func (m *PluginJamfSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginJamfSettings) ProtoMessage()    {}
 func (*PluginJamfSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{294}
+	return fileDescriptor_9198ee693835762e, []int{312}
 }
 func (m *PluginJamfSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17777,6 +18910,61 @@ func (m *PluginJamfSettings) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PluginJamfSettings proto.InternalMessageInfo
 
+// Defines settings for Intune plugin.
+type PluginIntuneSettings struct {
+	// Tenant is the primary domain name (e.g. contoso.onmicrosoft.com) or the tenant ID (e.g.
+	// 38d49456-54d4-455d-a8d6-c383c71e0a6d) of an organization within Microsoft Entra ID.
+	//
+	// https://learn.microsoft.com/en-us/partner-center/account-settings/find-ids-and-domain-names#find-the-microsoft-entra-tenant-id-and-primary-domain-name
+	Tenant string `protobuf:"bytes,1,opt,name=tenant,proto3" json:"tenant,omitempty"`
+	// login_endpoint points to one of the national deployments of Microsoft Entra ID.
+	// Optional, defaults to "https://login.microsoftonline.com".
+	//
+	// https://learn.microsoft.com/en-us/graph/deployments
+	LoginEndpoint string `protobuf:"bytes,2,opt,name=login_endpoint,json=loginEndpoint,proto3" json:"login_endpoint,omitempty"`
+	// graph_endpoint points to one of the national deployments of Microsoft Graph.
+	// Optional, defaults to "https://graph.microsoft.com".
+	//
+	// https://learn.microsoft.com/en-us/graph/deployments
+	GraphEndpoint        string   `protobuf:"bytes,3,opt,name=graph_endpoint,json=graphEndpoint,proto3" json:"graph_endpoint,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PluginIntuneSettings) Reset()         { *m = PluginIntuneSettings{} }
+func (m *PluginIntuneSettings) String() string { return proto.CompactTextString(m) }
+func (*PluginIntuneSettings) ProtoMessage()    {}
+func (*PluginIntuneSettings) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{313}
+}
+func (m *PluginIntuneSettings) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *PluginIntuneSettings) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_PluginIntuneSettings.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *PluginIntuneSettings) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_PluginIntuneSettings.Merge(m, src)
+}
+func (m *PluginIntuneSettings) XXX_Size() int {
+	return m.Size()
+}
+func (m *PluginIntuneSettings) XXX_DiscardUnknown() {
+	xxx_messageInfo_PluginIntuneSettings.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PluginIntuneSettings proto.InternalMessageInfo
+
 // Defines settings for the Okta plugin.
 type PluginOktaSettings struct {
 	// OrgUrl is the Okta organization URL to use for API communication.
@@ -17800,7 +18988,7 @@ func (m *PluginOktaSettings) Reset()         { *m = PluginOktaSettings{} }
 func (m *PluginOktaSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaSettings) ProtoMessage()    {}
 func (*PluginOktaSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{295}
+	return fileDescriptor_9198ee693835762e, []int{314}
 }
 func (m *PluginOktaSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17847,7 +19035,7 @@ func (m *PluginOktaCredentialsInfo) Reset()         { *m = PluginOktaCredentials
 func (m *PluginOktaCredentialsInfo) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaCredentialsInfo) ProtoMessage()    {}
 func (*PluginOktaCredentialsInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{296}
+	return fileDescriptor_9198ee693835762e, []int{315}
 }
 func (m *PluginOktaCredentialsInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17938,17 +19126,21 @@ type PluginOktaSyncSettings struct {
 	// DisableAssignDefaultRoles prevents the builtin okta-requester role from being assigned to all
 	// synchronized users. This is allows for a more advanced RBAC setup where not all
 	// Okta-originated users are allowed request all Okta-originated resources.
-	DisableAssignDefaultRoles bool     `protobuf:"varint,13,opt,name=disable_assign_default_roles,json=disableAssignDefaultRoles,proto3" json:"disable_assign_default_roles,omitempty"`
-	XXX_NoUnkeyedLiteral      struct{} `json:"-"`
-	XXX_unrecognized          []byte   `json:"-"`
-	XXX_sizecache             int32    `json:"-"`
+	DisableAssignDefaultRoles bool `protobuf:"varint,13,opt,name=disable_assign_default_roles,json=disableAssignDefaultRoles,proto3" json:"disable_assign_default_roles,omitempty"`
+	// TimeBetweenImports controls the time between Okta syncs. I.e. importing Okta users, apps and
+	// groups to teleport. This doesn't affect how quickly Teleport changes are propagated to Okta if
+	// bidirectional sync is enabled. The default value is 30m.
+	TimeBetweenImports   string   `protobuf:"bytes,14,opt,name=time_between_imports,json=timeBetweenImports,proto3" json:"time_between_imports,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *PluginOktaSyncSettings) Reset()         { *m = PluginOktaSyncSettings{} }
 func (m *PluginOktaSyncSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaSyncSettings) ProtoMessage()    {}
 func (*PluginOktaSyncSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{297}
+	return fileDescriptor_9198ee693835762e, []int{316}
 }
 func (m *PluginOktaSyncSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -17989,7 +19181,7 @@ func (m *DiscordChannels) Reset()         { *m = DiscordChannels{} }
 func (m *DiscordChannels) String() string { return proto.CompactTextString(m) }
 func (*DiscordChannels) ProtoMessage()    {}
 func (*DiscordChannels) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{298}
+	return fileDescriptor_9198ee693835762e, []int{317}
 }
 func (m *DiscordChannels) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18033,7 +19225,7 @@ func (m *PluginDiscordSettings) Reset()         { *m = PluginDiscordSettings{} }
 func (m *PluginDiscordSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginDiscordSettings) ProtoMessage()    {}
 func (*PluginDiscordSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{299}
+	return fileDescriptor_9198ee693835762e, []int{318}
 }
 func (m *PluginDiscordSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18078,7 +19270,7 @@ func (m *PluginEntraIDSettings) Reset()         { *m = PluginEntraIDSettings{} }
 func (m *PluginEntraIDSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginEntraIDSettings) ProtoMessage()    {}
 func (*PluginEntraIDSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{300}
+	return fileDescriptor_9198ee693835762e, []int{319}
 }
 func (m *PluginEntraIDSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18122,17 +19314,19 @@ type PluginEntraIDSyncSettings struct {
 	// entra_app_id refers to the Entra Application ID that supports the SSO for "sso_connector_id".
 	// This field is populated on a best-effort basis for legacy plugins but mandatory for plugins created after its introduction.
 	// For existing plugins, it is filled in using the entity descriptor url when utilized.
-	EntraAppId           string   `protobuf:"bytes,5,opt,name=entra_app_id,json=entraAppId,proto3" json:"entra_app_id,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	EntraAppId string `protobuf:"bytes,5,opt,name=entra_app_id,json=entraAppId,proto3" json:"entra_app_id,omitempty"`
+	// GroupFilters configures which groups should be included or exlcuded.
+	GroupFilters         []*PluginSyncFilter `protobuf:"bytes,6,rep,name=group_filters,json=groupFilters,proto3" json:"group_filters,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+	XXX_unrecognized     []byte              `json:"-"`
+	XXX_sizecache        int32               `json:"-"`
 }
 
 func (m *PluginEntraIDSyncSettings) Reset()         { *m = PluginEntraIDSyncSettings{} }
 func (m *PluginEntraIDSyncSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginEntraIDSyncSettings) ProtoMessage()    {}
 func (*PluginEntraIDSyncSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{301}
+	return fileDescriptor_9198ee693835762e, []int{320}
 }
 func (m *PluginEntraIDSyncSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18161,6 +19355,142 @@ func (m *PluginEntraIDSyncSettings) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PluginEntraIDSyncSettings proto.InternalMessageInfo
 
+// PluginSyncFilter can specify inclusion or exclusion of a resource.
+type PluginSyncFilter struct {
+	// Include describes that the resource should be explicitly included.
+	//
+	// Types that are valid to be assigned to Include:
+	//
+	//	*PluginSyncFilter_Id
+	//	*PluginSyncFilter_NameRegex
+	Include isPluginSyncFilter_Include `protobuf_oneof:"include"`
+	// Exclude specifies which AWS resources should be explicitly excluded.
+	//
+	// Types that are valid to be assigned to Exclude:
+	//
+	//	*PluginSyncFilter_ExcludeId
+	//	*PluginSyncFilter_ExcludeNameRegex
+	Exclude              isPluginSyncFilter_Exclude `protobuf_oneof:"exclude"`
+	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+	XXX_unrecognized     []byte                     `json:"-"`
+	XXX_sizecache        int32                      `json:"-"`
+}
+
+func (m *PluginSyncFilter) Reset()         { *m = PluginSyncFilter{} }
+func (m *PluginSyncFilter) String() string { return proto.CompactTextString(m) }
+func (*PluginSyncFilter) ProtoMessage()    {}
+func (*PluginSyncFilter) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{321}
+}
+func (m *PluginSyncFilter) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *PluginSyncFilter) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_PluginSyncFilter.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *PluginSyncFilter) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_PluginSyncFilter.Merge(m, src)
+}
+func (m *PluginSyncFilter) XXX_Size() int {
+	return m.Size()
+}
+func (m *PluginSyncFilter) XXX_DiscardUnknown() {
+	xxx_messageInfo_PluginSyncFilter.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PluginSyncFilter proto.InternalMessageInfo
+
+type isPluginSyncFilter_Include interface {
+	isPluginSyncFilter_Include()
+	Equal(interface{}) bool
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+type isPluginSyncFilter_Exclude interface {
+	isPluginSyncFilter_Exclude()
+	Equal(interface{}) bool
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type PluginSyncFilter_Id struct {
+	Id string `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
+}
+type PluginSyncFilter_NameRegex struct {
+	NameRegex string `protobuf:"bytes,2,opt,name=name_regex,json=nameRegex,proto3,oneof" json:"name_regex,omitempty"`
+}
+type PluginSyncFilter_ExcludeId struct {
+	ExcludeId string `protobuf:"bytes,3,opt,name=exclude_id,json=excludeId,proto3,oneof" json:"id,omitempty"`
+}
+type PluginSyncFilter_ExcludeNameRegex struct {
+	ExcludeNameRegex string `protobuf:"bytes,4,opt,name=exclude_name_regex,json=excludeNameRegex,proto3,oneof" json:"name_regex,omitempty"`
+}
+
+func (*PluginSyncFilter_Id) isPluginSyncFilter_Include()               {}
+func (*PluginSyncFilter_NameRegex) isPluginSyncFilter_Include()        {}
+func (*PluginSyncFilter_ExcludeId) isPluginSyncFilter_Exclude()        {}
+func (*PluginSyncFilter_ExcludeNameRegex) isPluginSyncFilter_Exclude() {}
+
+func (m *PluginSyncFilter) GetInclude() isPluginSyncFilter_Include {
+	if m != nil {
+		return m.Include
+	}
+	return nil
+}
+func (m *PluginSyncFilter) GetExclude() isPluginSyncFilter_Exclude {
+	if m != nil {
+		return m.Exclude
+	}
+	return nil
+}
+
+func (m *PluginSyncFilter) GetId() string {
+	if x, ok := m.GetInclude().(*PluginSyncFilter_Id); ok {
+		return x.Id
+	}
+	return ""
+}
+
+func (m *PluginSyncFilter) GetNameRegex() string {
+	if x, ok := m.GetInclude().(*PluginSyncFilter_NameRegex); ok {
+		return x.NameRegex
+	}
+	return ""
+}
+
+func (m *PluginSyncFilter) GetExcludeId() string {
+	if x, ok := m.GetExclude().(*PluginSyncFilter_ExcludeId); ok {
+		return x.ExcludeId
+	}
+	return ""
+}
+
+func (m *PluginSyncFilter) GetExcludeNameRegex() string {
+	if x, ok := m.GetExclude().(*PluginSyncFilter_ExcludeNameRegex); ok {
+		return x.ExcludeNameRegex
+	}
+	return ""
+}
+
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*PluginSyncFilter) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
+		(*PluginSyncFilter_Id)(nil),
+		(*PluginSyncFilter_NameRegex)(nil),
+		(*PluginSyncFilter_ExcludeId)(nil),
+		(*PluginSyncFilter_ExcludeNameRegex)(nil),
+	}
+}
+
 // AccessGraphSettings controls settings for syncing access graph specific data.
 type PluginEntraIDAccessGraphSettings struct {
 	// AppSsoSettingsCache is an array of single sign-on settings for Entra enterprise applications.
@@ -18177,7 +19507,7 @@ func (m *PluginEntraIDAccessGraphSettings) Reset()         { *m = PluginEntraIDA
 func (m *PluginEntraIDAccessGraphSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginEntraIDAccessGraphSettings) ProtoMessage()    {}
 func (*PluginEntraIDAccessGraphSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{302}
+	return fileDescriptor_9198ee693835762e, []int{322}
 }
 func (m *PluginEntraIDAccessGraphSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18223,7 +19553,7 @@ func (m *PluginEntraIDAppSSOSettings) Reset()         { *m = PluginEntraIDAppSSO
 func (m *PluginEntraIDAppSSOSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginEntraIDAppSSOSettings) ProtoMessage()    {}
 func (*PluginEntraIDAppSSOSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{303}
+	return fileDescriptor_9198ee693835762e, []int{323}
 }
 func (m *PluginEntraIDAppSSOSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18256,20 +19586,27 @@ var xxx_messageInfo_PluginEntraIDAppSSOSettings proto.InternalMessageInfo
 type PluginSCIMSettings struct {
 	// SamlConnectorName is the name of the SAML Connector that users provisioned
 	// by this SCIM plugin will use to log in to Teleport.
-	SamlConnectorName string `protobuf:"bytes,1,opt,name=saml_connector_name,json=samlConnectorName,proto3" json:"saml_connector_name,omitempty"`
+	// DEPRECATED: Use ConnectorInfo instead.
+	// This is old field added when the Okta SCIM plugin was created
+	// and was limited usage to SAML connectors only.
+	SamlConnectorName string `protobuf:"bytes,1,opt,name=saml_connector_name,json=samlConnectorName,proto3" json:"saml_connector_name,omitempty"` // Deprecated: Do not use.
 	// DefaultRole is the default role assigned to users provisioned by this
 	// plugin.
-	DefaultRole          string   `protobuf:"bytes,2,opt,name=default_role,json=defaultRole,proto3" json:"default_role,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	DefaultRole string `protobuf:"bytes,2,opt,name=default_role,json=defaultRole,proto3" json:"default_role,omitempty"` // Deprecated: Do not use.
+	// ConnectorInfo contains information about the user's origin as provided
+	// by the SCIM plugin. It enables matching a SAML/OIDC external user
+	// with a SCIM-persisted user, allowing the ephemeral user entry to be updated to SCIM user.
+	ConnectorInfo        *PluginSCIMSettings_ConnectorInfo `protobuf:"bytes,3,opt,name=connector_info,json=connectorInfo,proto3" json:"connector_info"`
+	XXX_NoUnkeyedLiteral struct{}                          `json:"-"`
+	XXX_unrecognized     []byte                            `json:"-"`
+	XXX_sizecache        int32                             `json:"-"`
 }
 
 func (m *PluginSCIMSettings) Reset()         { *m = PluginSCIMSettings{} }
 func (m *PluginSCIMSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginSCIMSettings) ProtoMessage()    {}
 func (*PluginSCIMSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{304}
+	return fileDescriptor_9198ee693835762e, []int{324}
 }
 func (m *PluginSCIMSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18298,6 +19635,50 @@ func (m *PluginSCIMSettings) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PluginSCIMSettings proto.InternalMessageInfo
 
+type PluginSCIMSettings_ConnectorInfo struct {
+	// Name is the name of the connector.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name"`
+	// Type is the type of the connector: types.KindSAML, types.KindOIDC, etc.
+	// Note: The name of the connect is not unique across types.
+	Type                 string   `protobuf:"bytes,2,opt,name=type,proto3" json:"type"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PluginSCIMSettings_ConnectorInfo) Reset()         { *m = PluginSCIMSettings_ConnectorInfo{} }
+func (m *PluginSCIMSettings_ConnectorInfo) String() string { return proto.CompactTextString(m) }
+func (*PluginSCIMSettings_ConnectorInfo) ProtoMessage()    {}
+func (*PluginSCIMSettings_ConnectorInfo) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{324, 0}
+}
+func (m *PluginSCIMSettings_ConnectorInfo) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *PluginSCIMSettings_ConnectorInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_PluginSCIMSettings_ConnectorInfo.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *PluginSCIMSettings_ConnectorInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_PluginSCIMSettings_ConnectorInfo.Merge(m, src)
+}
+func (m *PluginSCIMSettings_ConnectorInfo) XXX_Size() int {
+	return m.Size()
+}
+func (m *PluginSCIMSettings_ConnectorInfo) XXX_DiscardUnknown() {
+	xxx_messageInfo_PluginSCIMSettings_ConnectorInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PluginSCIMSettings_ConnectorInfo proto.InternalMessageInfo
+
 // PluginDatadogAccessSettings defines the settings for a Datadog Incident Management plugin
 type PluginDatadogAccessSettings struct {
 	// ApiEndpoint is the Datadog API endpoint.
@@ -18313,7 +19694,7 @@ func (m *PluginDatadogAccessSettings) Reset()         { *m = PluginDatadogAccess
 func (m *PluginDatadogAccessSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginDatadogAccessSettings) ProtoMessage()    {}
 func (*PluginDatadogAccessSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{305}
+	return fileDescriptor_9198ee693835762e, []int{325}
 }
 func (m *PluginDatadogAccessSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18391,17 +19772,31 @@ type PluginAWSICSettings struct {
 	GroupSyncFilters []*AWSICResourceFilter `protobuf:"bytes,10,rep,name=group_sync_filters,json=groupSyncFilters,proto3" json:"group_sync_filters,omitempty"`
 	// Credentials represents the AWS credentials used by the Identity Center
 	// integration
-	Credentials          *AWSICCredentials `protobuf:"bytes,11,opt,name=credentials,proto3" json:"credentials,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	Credentials *AWSICCredentials `protobuf:"bytes,11,opt,name=credentials,proto3" json:"credentials,omitempty"`
+	// RolesSyncMode indicates how the Identity Center integration will create and
+	// manage roles representing potential Identity Center Account Assignments.
+	//
+	// Possible values are ALL or NONE:
+	//
+	//	ALL:           indicates that the AWS Identity Center integration should
+	//	               create and maintain roles for all possible Account Assignments.
+	//	NONE:          indicates that the AWS Identity Center integration should
+	//	               not create any roles representing potential account Account
+	//	               Assignments.
+	//
+	// For backwards compatibility, an empty value is treated as equivalent to
+	// to ALL
+	RolesSyncMode        string   `protobuf:"bytes,12,opt,name=roles_sync_mode,json=rolesSyncMode,proto3" json:"roles_sync_mode,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *PluginAWSICSettings) Reset()         { *m = PluginAWSICSettings{} }
 func (m *PluginAWSICSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginAWSICSettings) ProtoMessage()    {}
 func (*PluginAWSICSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{306}
+	return fileDescriptor_9198ee693835762e, []int{326}
 }
 func (m *PluginAWSICSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18446,7 +19841,7 @@ func (m *AWSICCredentials) Reset()         { *m = AWSICCredentials{} }
 func (m *AWSICCredentials) String() string { return proto.CompactTextString(m) }
 func (*AWSICCredentials) ProtoMessage()    {}
 func (*AWSICCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{307}
+	return fileDescriptor_9198ee693835762e, []int{327}
 }
 func (m *AWSICCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18536,7 +19931,7 @@ func (m *AWSICCredentialSourceSystem) Reset()         { *m = AWSICCredentialSour
 func (m *AWSICCredentialSourceSystem) String() string { return proto.CompactTextString(m) }
 func (*AWSICCredentialSourceSystem) ProtoMessage()    {}
 func (*AWSICCredentialSourceSystem) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{308}
+	return fileDescriptor_9198ee693835762e, []int{328}
 }
 func (m *AWSICCredentialSourceSystem) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18580,7 +19975,7 @@ func (m *AWSICCredentialSourceOIDC) Reset()         { *m = AWSICCredentialSource
 func (m *AWSICCredentialSourceOIDC) String() string { return proto.CompactTextString(m) }
 func (*AWSICCredentialSourceOIDC) ProtoMessage()    {}
 func (*AWSICCredentialSourceOIDC) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{309}
+	return fileDescriptor_9198ee693835762e, []int{329}
 }
 func (m *AWSICCredentialSourceOIDC) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18636,7 +20031,7 @@ func (m *AWSICResourceFilter) Reset()         { *m = AWSICResourceFilter{} }
 func (m *AWSICResourceFilter) String() string { return proto.CompactTextString(m) }
 func (*AWSICResourceFilter) ProtoMessage()    {}
 func (*AWSICResourceFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{310}
+	return fileDescriptor_9198ee693835762e, []int{330}
 }
 func (m *AWSICResourceFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18759,7 +20154,7 @@ func (m *AWSICUserSyncFilter) Reset()         { *m = AWSICUserSyncFilter{} }
 func (m *AWSICUserSyncFilter) String() string { return proto.CompactTextString(m) }
 func (*AWSICUserSyncFilter) ProtoMessage()    {}
 func (*AWSICUserSyncFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{311}
+	return fileDescriptor_9198ee693835762e, []int{331}
 }
 func (m *AWSICUserSyncFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18806,7 +20201,7 @@ func (m *AWSICProvisioningSpec) Reset()         { *m = AWSICProvisioningSpec{} }
 func (m *AWSICProvisioningSpec) String() string { return proto.CompactTextString(m) }
 func (*AWSICProvisioningSpec) ProtoMessage()    {}
 func (*AWSICProvisioningSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{312}
+	return fileDescriptor_9198ee693835762e, []int{332}
 }
 func (m *AWSICProvisioningSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18848,7 +20243,7 @@ func (m *PluginAWSICStatusV1) Reset()         { *m = PluginAWSICStatusV1{} }
 func (m *PluginAWSICStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginAWSICStatusV1) ProtoMessage()    {}
 func (*PluginAWSICStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{313}
+	return fileDescriptor_9198ee693835762e, []int{333}
 }
 func (m *PluginAWSICStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18893,7 +20288,7 @@ func (m *AWSICGroupImportStatus) Reset()         { *m = AWSICGroupImportStatus{}
 func (m *AWSICGroupImportStatus) String() string { return proto.CompactTextString(m) }
 func (*AWSICGroupImportStatus) ProtoMessage()    {}
 func (*AWSICGroupImportStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{314}
+	return fileDescriptor_9198ee693835762e, []int{334}
 }
 func (m *AWSICGroupImportStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -18944,7 +20339,7 @@ func (m *PluginEmailSettings) Reset()         { *m = PluginEmailSettings{} }
 func (m *PluginEmailSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginEmailSettings) ProtoMessage()    {}
 func (*PluginEmailSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{315}
+	return fileDescriptor_9198ee693835762e, []int{335}
 }
 func (m *PluginEmailSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19032,7 +20427,7 @@ func (m *MailgunSpec) Reset()         { *m = MailgunSpec{} }
 func (m *MailgunSpec) String() string { return proto.CompactTextString(m) }
 func (*MailgunSpec) ProtoMessage()    {}
 func (*MailgunSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{316}
+	return fileDescriptor_9198ee693835762e, []int{336}
 }
 func (m *MailgunSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19079,7 +20474,7 @@ func (m *SMTPSpec) Reset()         { *m = SMTPSpec{} }
 func (m *SMTPSpec) String() string { return proto.CompactTextString(m) }
 func (*SMTPSpec) ProtoMessage()    {}
 func (*SMTPSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{317}
+	return fileDescriptor_9198ee693835762e, []int{337}
 }
 func (m *SMTPSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19129,7 +20524,7 @@ func (m *PluginMSTeamsSettings) Reset()         { *m = PluginMSTeamsSettings{} }
 func (m *PluginMSTeamsSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginMSTeamsSettings) ProtoMessage()    {}
 func (*PluginMSTeamsSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{318}
+	return fileDescriptor_9198ee693835762e, []int{338}
 }
 func (m *PluginMSTeamsSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19176,7 +20571,7 @@ func (m *PluginNetIQSettings) Reset()         { *m = PluginNetIQSettings{} }
 func (m *PluginNetIQSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginNetIQSettings) ProtoMessage()    {}
 func (*PluginNetIQSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{319}
+	return fileDescriptor_9198ee693835762e, []int{339}
 }
 func (m *PluginNetIQSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19221,7 +20616,7 @@ func (m *PluginBootstrapCredentialsV1) Reset()         { *m = PluginBootstrapCre
 func (m *PluginBootstrapCredentialsV1) String() string { return proto.CompactTextString(m) }
 func (*PluginBootstrapCredentialsV1) ProtoMessage()    {}
 func (*PluginBootstrapCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{320}
+	return fileDescriptor_9198ee693835762e, []int{340}
 }
 func (m *PluginBootstrapCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19321,7 +20716,7 @@ func (m *PluginIdSecretCredential) Reset()         { *m = PluginIdSecretCredenti
 func (m *PluginIdSecretCredential) String() string { return proto.CompactTextString(m) }
 func (*PluginIdSecretCredential) ProtoMessage()    {}
 func (*PluginIdSecretCredential) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{321}
+	return fileDescriptor_9198ee693835762e, []int{341}
 }
 func (m *PluginIdSecretCredential) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19364,7 +20759,7 @@ func (m *PluginOAuth2AuthorizationCodeCredentials) Reset() {
 func (m *PluginOAuth2AuthorizationCodeCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginOAuth2AuthorizationCodeCredentials) ProtoMessage()    {}
 func (*PluginOAuth2AuthorizationCodeCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{322}
+	return fileDescriptor_9198ee693835762e, []int{342}
 }
 func (m *PluginOAuth2AuthorizationCodeCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19424,7 +20819,7 @@ func (m *PluginStatusV1) Reset()         { *m = PluginStatusV1{} }
 func (m *PluginStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginStatusV1) ProtoMessage()    {}
 func (*PluginStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{323}
+	return fileDescriptor_9198ee693835762e, []int{343}
 }
 func (m *PluginStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19553,7 +20948,7 @@ func (m *PluginNetIQStatusV1) Reset()         { *m = PluginNetIQStatusV1{} }
 func (m *PluginNetIQStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginNetIQStatusV1) ProtoMessage()    {}
 func (*PluginNetIQStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{324}
+	return fileDescriptor_9198ee693835762e, []int{344}
 }
 func (m *PluginNetIQStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19599,7 +20994,7 @@ func (m *PluginGitlabStatusV1) Reset()         { *m = PluginGitlabStatusV1{} }
 func (m *PluginGitlabStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginGitlabStatusV1) ProtoMessage()    {}
 func (*PluginGitlabStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{325}
+	return fileDescriptor_9198ee693835762e, []int{345}
 }
 func (m *PluginGitlabStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19643,7 +21038,7 @@ func (m *PluginEntraIDStatusV1) Reset()         { *m = PluginEntraIDStatusV1{} }
 func (m *PluginEntraIDStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginEntraIDStatusV1) ProtoMessage()    {}
 func (*PluginEntraIDStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{326}
+	return fileDescriptor_9198ee693835762e, []int{346}
 }
 func (m *PluginEntraIDStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19688,16 +21083,19 @@ type PluginOktaStatusV1 struct {
 	// AccessListSyncDetails are status details relating to synchronizing access
 	// lists from Okta.
 	AccessListsSyncDetails *PluginOktaStatusDetailsAccessListsSync `protobuf:"bytes,5,opt,name=access_lists_sync_details,json=accessListsSyncDetails,proto3" json:"access_lists_sync_details,omitempty"`
-	XXX_NoUnkeyedLiteral   struct{}                                `json:"-"`
-	XXX_unrecognized       []byte                                  `json:"-"`
-	XXX_sizecache          int32                                   `json:"-"`
+	// SystemLogExportDetails are the status defaults related to the System Logs
+	// exporter.
+	SystemLogExportDetails *PluginOktaStatusSystemLogExporter `protobuf:"bytes,6,opt,name=system_log_export_details,json=systemLogExportDetails,proto3" json:"system_log_export_details,omitempty"`
+	XXX_NoUnkeyedLiteral   struct{}                           `json:"-"`
+	XXX_unrecognized       []byte                             `json:"-"`
+	XXX_sizecache          int32                              `json:"-"`
 }
 
 func (m *PluginOktaStatusV1) Reset()         { *m = PluginOktaStatusV1{} }
 func (m *PluginOktaStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusV1) ProtoMessage()    {}
 func (*PluginOktaStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{327}
+	return fileDescriptor_9198ee693835762e, []int{347}
 }
 func (m *PluginOktaStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19750,7 +21148,7 @@ func (m *PluginOktaStatusDetailsSSO) Reset()         { *m = PluginOktaStatusDeta
 func (m *PluginOktaStatusDetailsSSO) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusDetailsSSO) ProtoMessage()    {}
 func (*PluginOktaStatusDetailsSSO) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{328}
+	return fileDescriptor_9198ee693835762e, []int{348}
 }
 func (m *PluginOktaStatusDetailsSSO) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19807,7 +21205,7 @@ func (m *PluginOktaStatusDetailsAppGroupSync) Reset()         { *m = PluginOktaS
 func (m *PluginOktaStatusDetailsAppGroupSync) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusDetailsAppGroupSync) ProtoMessage()    {}
 func (*PluginOktaStatusDetailsAppGroupSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{329}
+	return fileDescriptor_9198ee693835762e, []int{349}
 }
 func (m *PluginOktaStatusDetailsAppGroupSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19861,7 +21259,7 @@ func (m *PluginOktaStatusDetailsUsersSync) Reset()         { *m = PluginOktaStat
 func (m *PluginOktaStatusDetailsUsersSync) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusDetailsUsersSync) ProtoMessage()    {}
 func (*PluginOktaStatusDetailsUsersSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{330}
+	return fileDescriptor_9198ee693835762e, []int{350}
 }
 func (m *PluginOktaStatusDetailsUsersSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19904,7 +21302,7 @@ func (m *PluginOktaStatusDetailsSCIM) Reset()         { *m = PluginOktaStatusDet
 func (m *PluginOktaStatusDetailsSCIM) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusDetailsSCIM) ProtoMessage()    {}
 func (*PluginOktaStatusDetailsSCIM) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{331}
+	return fileDescriptor_9198ee693835762e, []int{351}
 }
 func (m *PluginOktaStatusDetailsSCIM) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19966,7 +21364,7 @@ func (m *PluginOktaStatusDetailsAccessListsSync) Reset() {
 func (m *PluginOktaStatusDetailsAccessListsSync) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaStatusDetailsAccessListsSync) ProtoMessage()    {}
 func (*PluginOktaStatusDetailsAccessListsSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{332}
+	return fileDescriptor_9198ee693835762e, []int{352}
 }
 func (m *PluginOktaStatusDetailsAccessListsSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -19995,6 +21393,58 @@ func (m *PluginOktaStatusDetailsAccessListsSync) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PluginOktaStatusDetailsAccessListsSync proto.InternalMessageInfo
 
+// PluginOktaStatusSystemLogExporter are details related to the
+// current status of the Okta integration w/r/t system logs sync.
+type PluginOktaStatusSystemLogExporter struct {
+	// Enabled is whether Okta System Log exporter is enabled.
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// StatusCode indicates the current state of the service
+	StatusCode OktaPluginSyncStatusCode `protobuf:"varint,2,opt,name=status_code,json=statusCode,proto3,enum=types.OktaPluginSyncStatusCode" json:"status_code,omitempty"`
+	// LastSuccessful is the date of the last successful run.
+	LastSuccessful *time.Time `protobuf:"bytes,3,opt,name=last_successful,json=lastSuccessful,proto3,stdtime" json:"last_successful"`
+	// LastFailed is the date of the last failed run.
+	LastFailed *time.Time `protobuf:"bytes,4,opt,name=last_failed,json=lastFailed,proto3,stdtime" json:"last_failed"`
+	// Error contains a textual description of the reason the last synchronization
+	// failed. Only valid when StatusCode is OKTA_PLUGIN_SYNC_STATUS_CODE_ERROR.
+	Error                string   `protobuf:"bytes,9,opt,name=error,proto3" json:"error,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PluginOktaStatusSystemLogExporter) Reset()         { *m = PluginOktaStatusSystemLogExporter{} }
+func (m *PluginOktaStatusSystemLogExporter) String() string { return proto.CompactTextString(m) }
+func (*PluginOktaStatusSystemLogExporter) ProtoMessage()    {}
+func (*PluginOktaStatusSystemLogExporter) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{353}
+}
+func (m *PluginOktaStatusSystemLogExporter) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *PluginOktaStatusSystemLogExporter) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_PluginOktaStatusSystemLogExporter.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *PluginOktaStatusSystemLogExporter) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_PluginOktaStatusSystemLogExporter.Merge(m, src)
+}
+func (m *PluginOktaStatusSystemLogExporter) XXX_Size() int {
+	return m.Size()
+}
+func (m *PluginOktaStatusSystemLogExporter) XXX_DiscardUnknown() {
+	xxx_messageInfo_PluginOktaStatusSystemLogExporter.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PluginOktaStatusSystemLogExporter proto.InternalMessageInfo
+
 // PluginCredentialsV1 represents "live" credentials
 // that are used by the plugin to authenticate to the 3rd party API.
 type PluginCredentialsV1 struct {
@@ -20014,7 +21464,7 @@ func (m *PluginCredentialsV1) Reset()         { *m = PluginCredentialsV1{} }
 func (m *PluginCredentialsV1) String() string { return proto.CompactTextString(m) }
 func (*PluginCredentialsV1) ProtoMessage()    {}
 func (*PluginCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{333}
+	return fileDescriptor_9198ee693835762e, []int{354}
 }
 func (m *PluginCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20045,6 +21495,7 @@ var xxx_messageInfo_PluginCredentialsV1 proto.InternalMessageInfo
 
 type isPluginCredentialsV1_Credentials interface {
 	isPluginCredentialsV1_Credentials()
+	Equal(interface{}) bool
 	MarshalTo([]byte) (int, error)
 	Size() int
 }
@@ -20125,7 +21576,7 @@ func (m *PluginOAuth2AccessTokenCredentials) Reset()         { *m = PluginOAuth2
 func (m *PluginOAuth2AccessTokenCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginOAuth2AccessTokenCredentials) ProtoMessage()    {}
 func (*PluginOAuth2AccessTokenCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{334}
+	return fileDescriptor_9198ee693835762e, []int{355}
 }
 func (m *PluginOAuth2AccessTokenCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20166,7 +21617,7 @@ func (m *PluginBearerTokenCredentials) Reset()         { *m = PluginBearerTokenC
 func (m *PluginBearerTokenCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginBearerTokenCredentials) ProtoMessage()    {}
 func (*PluginBearerTokenCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{335}
+	return fileDescriptor_9198ee693835762e, []int{356}
 }
 func (m *PluginBearerTokenCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20208,7 +21659,7 @@ func (m *PluginStaticCredentialsRef) Reset()         { *m = PluginStaticCredenti
 func (m *PluginStaticCredentialsRef) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsRef) ProtoMessage()    {}
 func (*PluginStaticCredentialsRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{336}
+	return fileDescriptor_9198ee693835762e, []int{357}
 }
 func (m *PluginStaticCredentialsRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20250,7 +21701,7 @@ func (m *PluginListV1) Reset()         { *m = PluginListV1{} }
 func (m *PluginListV1) String() string { return proto.CompactTextString(m) }
 func (*PluginListV1) ProtoMessage()    {}
 func (*PluginListV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{337}
+	return fileDescriptor_9198ee693835762e, []int{358}
 }
 func (m *PluginListV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20293,7 +21744,7 @@ type PluginStaticCredentialsV1 struct {
 func (m *PluginStaticCredentialsV1) Reset()      { *m = PluginStaticCredentialsV1{} }
 func (*PluginStaticCredentialsV1) ProtoMessage() {}
 func (*PluginStaticCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{338}
+	return fileDescriptor_9198ee693835762e, []int{359}
 }
 func (m *PluginStaticCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20341,7 +21792,7 @@ func (m *PluginStaticCredentialsSpecV1) Reset()         { *m = PluginStaticCrede
 func (m *PluginStaticCredentialsSpecV1) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsSpecV1) ProtoMessage()    {}
 func (*PluginStaticCredentialsSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{339}
+	return fileDescriptor_9198ee693835762e, []int{360}
 }
 func (m *PluginStaticCredentialsSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20372,6 +21823,7 @@ var xxx_messageInfo_PluginStaticCredentialsSpecV1 proto.InternalMessageInfo
 
 type isPluginStaticCredentialsSpecV1_Credentials interface {
 	isPluginStaticCredentialsSpecV1_Credentials()
+	Equal(interface{}) bool
 	MarshalTo([]byte) (int, error)
 	Size() int
 }
@@ -20468,7 +21920,7 @@ func (m *PluginStaticCredentialsBasicAuth) Reset()         { *m = PluginStaticCr
 func (m *PluginStaticCredentialsBasicAuth) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsBasicAuth) ProtoMessage()    {}
 func (*PluginStaticCredentialsBasicAuth) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{340}
+	return fileDescriptor_9198ee693835762e, []int{361}
 }
 func (m *PluginStaticCredentialsBasicAuth) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20514,7 +21966,7 @@ func (m *PluginStaticCredentialsOAuthClientSecret) Reset() {
 func (m *PluginStaticCredentialsOAuthClientSecret) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsOAuthClientSecret) ProtoMessage()    {}
 func (*PluginStaticCredentialsOAuthClientSecret) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{341}
+	return fileDescriptor_9198ee693835762e, []int{362}
 }
 func (m *PluginStaticCredentialsOAuthClientSecret) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20562,7 +22014,7 @@ func (m *PluginStaticCredentialsSSHCertAuthorities) String() string {
 }
 func (*PluginStaticCredentialsSSHCertAuthorities) ProtoMessage() {}
 func (*PluginStaticCredentialsSSHCertAuthorities) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{342}
+	return fileDescriptor_9198ee693835762e, []int{363}
 }
 func (m *PluginStaticCredentialsSSHCertAuthorities) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20605,7 +22057,7 @@ type SAMLIdPServiceProviderV1 struct {
 func (m *SAMLIdPServiceProviderV1) Reset()      { *m = SAMLIdPServiceProviderV1{} }
 func (*SAMLIdPServiceProviderV1) ProtoMessage() {}
 func (*SAMLIdPServiceProviderV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{343}
+	return fileDescriptor_9198ee693835762e, []int{364}
 }
 func (m *SAMLIdPServiceProviderV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20676,7 +22128,7 @@ func (m *SAMLIdPServiceProviderSpecV1) Reset()         { *m = SAMLIdPServiceProv
 func (m *SAMLIdPServiceProviderSpecV1) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderSpecV1) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{344}
+	return fileDescriptor_9198ee693835762e, []int{365}
 }
 func (m *SAMLIdPServiceProviderSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20723,7 +22175,7 @@ func (m *SAMLAttributeMapping) Reset()         { *m = SAMLAttributeMapping{} }
 func (m *SAMLAttributeMapping) String() string { return proto.CompactTextString(m) }
 func (*SAMLAttributeMapping) ProtoMessage()    {}
 func (*SAMLAttributeMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{345}
+	return fileDescriptor_9198ee693835762e, []int{366}
 }
 func (m *SAMLAttributeMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20765,7 +22217,7 @@ func (m *IdPOptions) Reset()         { *m = IdPOptions{} }
 func (m *IdPOptions) String() string { return proto.CompactTextString(m) }
 func (*IdPOptions) ProtoMessage()    {}
 func (*IdPOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{346}
+	return fileDescriptor_9198ee693835762e, []int{367}
 }
 func (m *IdPOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20807,7 +22259,7 @@ func (m *IdPSAMLOptions) Reset()         { *m = IdPSAMLOptions{} }
 func (m *IdPSAMLOptions) String() string { return proto.CompactTextString(m) }
 func (*IdPSAMLOptions) ProtoMessage()    {}
 func (*IdPSAMLOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{347}
+	return fileDescriptor_9198ee693835762e, []int{368}
 }
 func (m *IdPSAMLOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20857,7 +22309,7 @@ func (m *KubernetesResourceV1) Reset()         { *m = KubernetesResourceV1{} }
 func (m *KubernetesResourceV1) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResourceV1) ProtoMessage()    {}
 func (*KubernetesResourceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{348}
+	return fileDescriptor_9198ee693835762e, []int{369}
 }
 func (m *KubernetesResourceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20899,7 +22351,7 @@ func (m *KubernetesResourceSpecV1) Reset()         { *m = KubernetesResourceSpec
 func (m *KubernetesResourceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResourceSpecV1) ProtoMessage()    {}
 func (*KubernetesResourceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{349}
+	return fileDescriptor_9198ee693835762e, []int{370}
 }
 func (m *KubernetesResourceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20945,7 +22397,7 @@ func (m *ClusterMaintenanceConfigV1) Reset()         { *m = ClusterMaintenanceCo
 func (m *ClusterMaintenanceConfigV1) String() string { return proto.CompactTextString(m) }
 func (*ClusterMaintenanceConfigV1) ProtoMessage()    {}
 func (*ClusterMaintenanceConfigV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{350}
+	return fileDescriptor_9198ee693835762e, []int{371}
 }
 func (m *ClusterMaintenanceConfigV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -20987,7 +22439,7 @@ func (m *ClusterMaintenanceConfigSpecV1) Reset()         { *m = ClusterMaintenan
 func (m *ClusterMaintenanceConfigSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ClusterMaintenanceConfigSpecV1) ProtoMessage()    {}
 func (*ClusterMaintenanceConfigSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{351}
+	return fileDescriptor_9198ee693835762e, []int{372}
 }
 func (m *ClusterMaintenanceConfigSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21033,7 +22485,7 @@ func (m *AgentUpgradeWindow) Reset()         { *m = AgentUpgradeWindow{} }
 func (m *AgentUpgradeWindow) String() string { return proto.CompactTextString(m) }
 func (*AgentUpgradeWindow) ProtoMessage()    {}
 func (*AgentUpgradeWindow) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{352}
+	return fileDescriptor_9198ee693835762e, []int{373}
 }
 func (m *AgentUpgradeWindow) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21080,7 +22532,7 @@ func (m *ScheduledAgentUpgradeWindow) Reset()         { *m = ScheduledAgentUpgra
 func (m *ScheduledAgentUpgradeWindow) String() string { return proto.CompactTextString(m) }
 func (*ScheduledAgentUpgradeWindow) ProtoMessage()    {}
 func (*ScheduledAgentUpgradeWindow) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{353}
+	return fileDescriptor_9198ee693835762e, []int{374}
 }
 func (m *ScheduledAgentUpgradeWindow) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21123,7 +22575,7 @@ func (m *AgentUpgradeSchedule) Reset()         { *m = AgentUpgradeSchedule{} }
 func (m *AgentUpgradeSchedule) String() string { return proto.CompactTextString(m) }
 func (*AgentUpgradeSchedule) ProtoMessage()    {}
 func (*AgentUpgradeSchedule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{354}
+	return fileDescriptor_9198ee693835762e, []int{375}
 }
 func (m *AgentUpgradeSchedule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21166,7 +22618,7 @@ type UserGroupV1 struct {
 func (m *UserGroupV1) Reset()      { *m = UserGroupV1{} }
 func (*UserGroupV1) ProtoMessage() {}
 func (*UserGroupV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{355}
+	return fileDescriptor_9198ee693835762e, []int{376}
 }
 func (m *UserGroupV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21208,7 +22660,7 @@ func (m *UserGroupSpecV1) Reset()         { *m = UserGroupSpecV1{} }
 func (m *UserGroupSpecV1) String() string { return proto.CompactTextString(m) }
 func (*UserGroupSpecV1) ProtoMessage()    {}
 func (*UserGroupSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{356}
+	return fileDescriptor_9198ee693835762e, []int{377}
 }
 func (m *UserGroupSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21252,7 +22704,7 @@ func (m *OktaImportRuleSpecV1) Reset()         { *m = OktaImportRuleSpecV1{} }
 func (m *OktaImportRuleSpecV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleSpecV1) ProtoMessage()    {}
 func (*OktaImportRuleSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{357}
+	return fileDescriptor_9198ee693835762e, []int{378}
 }
 func (m *OktaImportRuleSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21296,7 +22748,7 @@ func (m *OktaImportRuleMappingV1) Reset()         { *m = OktaImportRuleMappingV1
 func (m *OktaImportRuleMappingV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleMappingV1) ProtoMessage()    {}
 func (*OktaImportRuleMappingV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{358}
+	return fileDescriptor_9198ee693835762e, []int{379}
 }
 func (m *OktaImportRuleMappingV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21339,7 +22791,7 @@ type OktaImportRuleV1 struct {
 func (m *OktaImportRuleV1) Reset()      { *m = OktaImportRuleV1{} }
 func (*OktaImportRuleV1) ProtoMessage() {}
 func (*OktaImportRuleV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{359}
+	return fileDescriptor_9198ee693835762e, []int{380}
 }
 func (m *OktaImportRuleV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21387,7 +22839,7 @@ func (m *OktaImportRuleMatchV1) Reset()         { *m = OktaImportRuleMatchV1{} }
 func (m *OktaImportRuleMatchV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleMatchV1) ProtoMessage()    {}
 func (*OktaImportRuleMatchV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{360}
+	return fileDescriptor_9198ee693835762e, []int{381}
 }
 func (m *OktaImportRuleMatchV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21430,7 +22882,7 @@ type OktaAssignmentV1 struct {
 func (m *OktaAssignmentV1) Reset()      { *m = OktaAssignmentV1{} }
 func (*OktaAssignmentV1) ProtoMessage() {}
 func (*OktaAssignmentV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{361}
+	return fileDescriptor_9198ee693835762e, []int{382}
 }
 func (m *OktaAssignmentV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21484,7 +22936,7 @@ func (m *OktaAssignmentSpecV1) Reset()         { *m = OktaAssignmentSpecV1{} }
 func (m *OktaAssignmentSpecV1) String() string { return proto.CompactTextString(m) }
 func (*OktaAssignmentSpecV1) ProtoMessage()    {}
 func (*OktaAssignmentSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{362}
+	return fileDescriptor_9198ee693835762e, []int{383}
 }
 func (m *OktaAssignmentSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21528,7 +22980,7 @@ func (m *OktaAssignmentTargetV1) Reset()         { *m = OktaAssignmentTargetV1{}
 func (m *OktaAssignmentTargetV1) String() string { return proto.CompactTextString(m) }
 func (*OktaAssignmentTargetV1) ProtoMessage()    {}
 func (*OktaAssignmentTargetV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{363}
+	return fileDescriptor_9198ee693835762e, []int{384}
 }
 func (m *OktaAssignmentTargetV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21564,16 +23016,18 @@ type IntegrationV1 struct {
 	// Header is the resource header.
 	ResourceHeader `protobuf:"bytes,1,opt,name=Header,proto3,embedded=Header" json:""`
 	// Spec is an Integration specification.
-	Spec                 IntegrationSpecV1 `protobuf:"bytes,2,opt,name=Spec,proto3" json:"spec"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	Spec IntegrationSpecV1 `protobuf:"bytes,2,opt,name=Spec,proto3" json:"spec"`
+	// Status is an Integration specification.
+	Status               IntegrationStatusV1 `protobuf:"bytes,3,opt,name=Status,proto3" json:"status"`
+	XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+	XXX_unrecognized     []byte              `json:"-"`
+	XXX_sizecache        int32               `json:"-"`
 }
 
 func (m *IntegrationV1) Reset()      { *m = IntegrationV1{} }
 func (*IntegrationV1) ProtoMessage() {}
 func (*IntegrationV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{364}
+	return fileDescriptor_9198ee693835762e, []int{385}
 }
 func (m *IntegrationV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21622,7 +23076,7 @@ func (m *IntegrationSpecV1) Reset()         { *m = IntegrationSpecV1{} }
 func (m *IntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*IntegrationSpecV1) ProtoMessage()    {}
 func (*IntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{365}
+	return fileDescriptor_9198ee693835762e, []int{386}
 }
 func (m *IntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21720,6 +23174,48 @@ func (*IntegrationSpecV1) XXX_OneofWrappers() []interface{} {
 	}
 }
 
+// IntegrationStatusV1 contains the status of the integration.
+type IntegrationStatusV1 struct {
+	// AWSRolesAnywhere contains the specific status fields to related to the AWS Roles Anywhere Integration subkind.
+	AWSRolesAnywhere     *AWSRAIntegrationStatusV1 `protobuf:"bytes,1,opt,name=AWSRolesAnywhere,proto3" json:"aws_ra,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                  `json:"-"`
+	XXX_unrecognized     []byte                    `json:"-"`
+	XXX_sizecache        int32                     `json:"-"`
+}
+
+func (m *IntegrationStatusV1) Reset()         { *m = IntegrationStatusV1{} }
+func (m *IntegrationStatusV1) String() string { return proto.CompactTextString(m) }
+func (*IntegrationStatusV1) ProtoMessage()    {}
+func (*IntegrationStatusV1) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{387}
+}
+func (m *IntegrationStatusV1) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *IntegrationStatusV1) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_IntegrationStatusV1.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *IntegrationStatusV1) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_IntegrationStatusV1.Merge(m, src)
+}
+func (m *IntegrationStatusV1) XXX_Size() int {
+	return m.Size()
+}
+func (m *IntegrationStatusV1) XXX_DiscardUnknown() {
+	xxx_messageInfo_IntegrationStatusV1.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_IntegrationStatusV1 proto.InternalMessageInfo
+
 // AWSOIDCIntegrationSpecV1 contains the spec properties for the AWS OIDC SubKind Integration.
 type AWSOIDCIntegrationSpecV1 struct {
 	// RoleARN contains the Role ARN used to set up the Integration.
@@ -21729,7 +23225,7 @@ type AWSOIDCIntegrationSpecV1 struct {
 	// This bucket/prefix/* files must be publicly accessible and contain the following:
 	// > .well-known/openid-configuration
 	// > .well-known/jwks
-	// Format: s3://<bucket>/<prefix>
+	// Format: `s3://<bucket>/<prefix>`
 	// Optional. The proxy's endpoint is used if it is not specified.
 	//
 	// DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate.
@@ -21737,9 +23233,9 @@ type AWSOIDCIntegrationSpecV1 struct {
 	// Amazon is now trusting all the root certificate authorities, and this workaround is no longer needed.
 	// DELETE IN 18.0.
 	IssuerS3URI string `protobuf:"bytes,2,opt,name=IssuerS3URI,proto3" json:"issuer_s3_uri,omitempty"` // Deprecated: Do not use.
-	// Audience is used to record a name of a plugin or a discover service in Teleport
-	// that depends on this integration.
-	// Audience value can be empty or configured with supported preset audience type.
+	// Audience is used to record a name of a plugin or a discover service in
+	// Teleport that depends on this integration.
+	// Audience value can either be empty or "aws-identity-center".
 	// Preset audience may impose specific behavior on the integration CRUD API,
 	// such as preventing integration from update or deletion. Empty audience value
 	// should be treated as a default and backward-compatible behavior of the integration.
@@ -21753,7 +23249,7 @@ func (m *AWSOIDCIntegrationSpecV1) Reset()         { *m = AWSOIDCIntegrationSpec
 func (m *AWSOIDCIntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*AWSOIDCIntegrationSpecV1) ProtoMessage()    {}
 func (*AWSOIDCIntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{366}
+	return fileDescriptor_9198ee693835762e, []int{388}
 }
 func (m *AWSOIDCIntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21799,7 +23295,7 @@ func (m *AzureOIDCIntegrationSpecV1) Reset()         { *m = AzureOIDCIntegration
 func (m *AzureOIDCIntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*AzureOIDCIntegrationSpecV1) ProtoMessage()    {}
 func (*AzureOIDCIntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{367}
+	return fileDescriptor_9198ee693835762e, []int{389}
 }
 func (m *AzureOIDCIntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21841,7 +23337,7 @@ func (m *GitHubIntegrationSpecV1) Reset()         { *m = GitHubIntegrationSpecV1
 func (m *GitHubIntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*GitHubIntegrationSpecV1) ProtoMessage()    {}
 func (*GitHubIntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{368}
+	return fileDescriptor_9198ee693835762e, []int{390}
 }
 func (m *GitHubIntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21886,7 +23382,7 @@ func (m *AWSRAIntegrationSpecV1) Reset()         { *m = AWSRAIntegrationSpecV1{}
 func (m *AWSRAIntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*AWSRAIntegrationSpecV1) ProtoMessage()    {}
 func (*AWSRAIntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{369}
+	return fileDescriptor_9198ee693835762e, []int{391}
 }
 func (m *AWSRAIntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21925,7 +23421,21 @@ type AWSRolesAnywhereProfileSyncConfig struct {
 	// ProfileAcceptsRoleSessionName indicates whether the profile accepts a custom Role Session name.
 	ProfileAcceptsRoleSessionName bool `protobuf:"varint,3,opt,name=ProfileAcceptsRoleSessionName,proto3" json:"profile_accepts_role_session_name"`
 	// RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.
-	RoleARN              string   `protobuf:"bytes,4,opt,name=RoleARN,proto3" json:"role_arn"`
+	RoleARN string `protobuf:"bytes,4,opt,name=RoleARN,proto3" json:"role_arn"`
+	// ProfileNameFilters is a list of filters applied to the profile name.
+	// Only matching profiles will be synchronized as application servers.
+	// If empty, no filtering is applied.
+	//
+	// Filters can be globs, for example:
+	//
+	//	profile*
+	//	*name*
+	//
+	// Or regexes if they're prefixed and suffixed with ^ and $, for example:
+	//
+	//	^profile.*$
+	//	^.*name.*$
+	ProfileNameFilters   []string `protobuf:"bytes,5,rep,name=ProfileNameFilters,proto3" json:"profile_name_filters"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -21935,7 +23445,7 @@ func (m *AWSRolesAnywhereProfileSyncConfig) Reset()         { *m = AWSRolesAnywh
 func (m *AWSRolesAnywhereProfileSyncConfig) String() string { return proto.CompactTextString(m) }
 func (*AWSRolesAnywhereProfileSyncConfig) ProtoMessage()    {}
 func (*AWSRolesAnywhereProfileSyncConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{370}
+	return fileDescriptor_9198ee693835762e, []int{392}
 }
 func (m *AWSRolesAnywhereProfileSyncConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -21964,6 +23474,102 @@ func (m *AWSRolesAnywhereProfileSyncConfig) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AWSRolesAnywhereProfileSyncConfig proto.InternalMessageInfo
 
+// AWSRAIntegrationStatusV1 contains the status properties for the AWS IAM Roles Anywhere SubKind Integration.
+type AWSRAIntegrationStatusV1 struct {
+	// LastProfileSync is the summary of the last profile sync iteration.
+	LastProfileSync      *AWSRolesAnywhereProfileSyncIterationSummary `protobuf:"bytes,1,opt,name=LastProfileSync,proto3" json:"last_profile_sync"`
+	XXX_NoUnkeyedLiteral struct{}                                     `json:"-"`
+	XXX_unrecognized     []byte                                       `json:"-"`
+	XXX_sizecache        int32                                        `json:"-"`
+}
+
+func (m *AWSRAIntegrationStatusV1) Reset()         { *m = AWSRAIntegrationStatusV1{} }
+func (m *AWSRAIntegrationStatusV1) String() string { return proto.CompactTextString(m) }
+func (*AWSRAIntegrationStatusV1) ProtoMessage()    {}
+func (*AWSRAIntegrationStatusV1) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{393}
+}
+func (m *AWSRAIntegrationStatusV1) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSRAIntegrationStatusV1) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSRAIntegrationStatusV1.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSRAIntegrationStatusV1) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSRAIntegrationStatusV1.Merge(m, src)
+}
+func (m *AWSRAIntegrationStatusV1) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSRAIntegrationStatusV1) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSRAIntegrationStatusV1.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSRAIntegrationStatusV1 proto.InternalMessageInfo
+
+// AWSRolesAnywhereProfileSyncIterationSummary contains the summary of a single profile sync iteration.
+type AWSRolesAnywhereProfileSyncIterationSummary struct {
+	// StartTime is the time when the sync iteration started.
+	StartTime time.Time `protobuf:"bytes,1,opt,name=StartTime,proto3,stdtime" json:"start_time"`
+	// EndTime is the time when the sync iteration ended.
+	EndTime time.Time `protobuf:"bytes,2,opt,name=EndTime,proto3,stdtime" json:"end_time"`
+	// Status is the result of the sync iteration: SUCCESS or ERROR.
+	Status string `protobuf:"bytes,3,opt,name=Status,proto3" json:"status"`
+	// ErrorMessage holds the error message when status is ERROR.
+	ErrorMessage string `protobuf:"bytes,4,opt,name=ErrorMessage,proto3" json:"error_message"`
+	// SyncedProfiles is the number of profiles synchronized as application servers.
+	SyncedProfiles       int32    `protobuf:"varint,5,opt,name=SyncedProfiles,proto3" json:"synced_profiles"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) Reset() {
+	*m = AWSRolesAnywhereProfileSyncIterationSummary{}
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) String() string {
+	return proto.CompactTextString(m)
+}
+func (*AWSRolesAnywhereProfileSyncIterationSummary) ProtoMessage() {}
+func (*AWSRolesAnywhereProfileSyncIterationSummary) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{394}
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSRolesAnywhereProfileSyncIterationSummary.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSRolesAnywhereProfileSyncIterationSummary.Merge(m, src)
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSRolesAnywhereProfileSyncIterationSummary.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSRolesAnywhereProfileSyncIterationSummary proto.InternalMessageInfo
+
 // HeadlessAuthentication holds data for an ongoing headless authentication attempt.
 type HeadlessAuthentication struct {
 	// Header is the resource header.
@@ -21992,7 +23598,7 @@ func (m *HeadlessAuthentication) Reset()         { *m = HeadlessAuthentication{}
 func (m *HeadlessAuthentication) String() string { return proto.CompactTextString(m) }
 func (*HeadlessAuthentication) ProtoMessage()    {}
 func (*HeadlessAuthentication) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{371}
+	return fileDescriptor_9198ee693835762e, []int{395}
 }
 func (m *HeadlessAuthentication) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22049,7 +23655,7 @@ func (m *WatchKind) Reset()         { *m = WatchKind{} }
 func (m *WatchKind) String() string { return proto.CompactTextString(m) }
 func (*WatchKind) ProtoMessage()    {}
 func (*WatchKind) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{372}
+	return fileDescriptor_9198ee693835762e, []int{396}
 }
 func (m *WatchKind) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22099,7 +23705,7 @@ func (m *WatchStatusV1) Reset()         { *m = WatchStatusV1{} }
 func (m *WatchStatusV1) String() string { return proto.CompactTextString(m) }
 func (*WatchStatusV1) ProtoMessage()    {}
 func (*WatchStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{373}
+	return fileDescriptor_9198ee693835762e, []int{397}
 }
 func (m *WatchStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22140,7 +23746,7 @@ func (m *WatchStatusSpecV1) Reset()         { *m = WatchStatusSpecV1{} }
 func (m *WatchStatusSpecV1) String() string { return proto.CompactTextString(m) }
 func (*WatchStatusSpecV1) ProtoMessage()    {}
 func (*WatchStatusSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{374}
+	return fileDescriptor_9198ee693835762e, []int{398}
 }
 func (m *WatchStatusSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22190,7 +23796,7 @@ func (m *ServerInfoV1) Reset()         { *m = ServerInfoV1{} }
 func (m *ServerInfoV1) String() string { return proto.CompactTextString(m) }
 func (*ServerInfoV1) ProtoMessage()    {}
 func (*ServerInfoV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{375}
+	return fileDescriptor_9198ee693835762e, []int{399}
 }
 func (m *ServerInfoV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22232,7 +23838,7 @@ func (m *ServerInfoSpecV1) Reset()         { *m = ServerInfoSpecV1{} }
 func (m *ServerInfoSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ServerInfoSpecV1) ProtoMessage()    {}
 func (*ServerInfoSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{376}
+	return fileDescriptor_9198ee693835762e, []int{400}
 }
 func (m *ServerInfoSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22289,7 +23895,7 @@ func (m *JamfSpecV1) Reset()         { *m = JamfSpecV1{} }
 func (m *JamfSpecV1) String() string { return proto.CompactTextString(m) }
 func (*JamfSpecV1) ProtoMessage()    {}
 func (*JamfSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{377}
+	return fileDescriptor_9198ee693835762e, []int{401}
 }
 func (m *JamfSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22354,7 +23960,7 @@ func (m *JamfInventoryEntry) Reset()         { *m = JamfInventoryEntry{} }
 func (m *JamfInventoryEntry) String() string { return proto.CompactTextString(m) }
 func (*JamfInventoryEntry) ProtoMessage()    {}
 func (*JamfInventoryEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{378}
+	return fileDescriptor_9198ee693835762e, []int{402}
 }
 func (m *JamfInventoryEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22411,7 +24017,7 @@ type MessageWithHeader struct {
 func (m *MessageWithHeader) Reset()      { *m = MessageWithHeader{} }
 func (*MessageWithHeader) ProtoMessage() {}
 func (*MessageWithHeader) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{379}
+	return fileDescriptor_9198ee693835762e, []int{403}
 }
 func (m *MessageWithHeader) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22462,20 +24068,22 @@ type AWSMatcher struct {
 	// KubeAppDiscovery controls whether Kubernetes App Discovery will be enabled for agents running on
 	// discovered clusters, currently only affects AWS EKS discovery in integration mode.
 	KubeAppDiscovery bool `protobuf:"varint,8,opt,name=KubeAppDiscovery,proto3" json:"kube_app_discovery,omitempty"`
-	// SetupAccessForARN is the role that the discovery service should create EKS Access Entries for.
+	// SetupAccessForARN is the role that the Discovery Service should create EKS Access Entries for.
 	// This value should match the IAM identity that Teleport Kubernetes Service uses.
-	// If this value is empty, the discovery service will attempt to set up access for its own identity (self).
-	SetupAccessForARN    string   `protobuf:"bytes,9,opt,name=SetupAccessForARN,proto3" json:"setup_access_for_arn,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	// If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).
+	SetupAccessForARN string `protobuf:"bytes,9,opt,name=SetupAccessForARN,proto3" json:"setup_access_for_arn,omitempty"`
+	// Organization is an AWS Organization matcher for discovering resources accross multiple accounts under an Organization.
+	Organization         *AWSOrganizationMatcher `protobuf:"bytes,10,opt,name=Organization,proto3" json:"organization,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                `json:"-"`
+	XXX_unrecognized     []byte                  `json:"-"`
+	XXX_sizecache        int32                   `json:"-"`
 }
 
 func (m *AWSMatcher) Reset()         { *m = AWSMatcher{} }
 func (m *AWSMatcher) String() string { return proto.CompactTextString(m) }
 func (*AWSMatcher) ProtoMessage()    {}
 func (*AWSMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{380}
+	return fileDescriptor_9198ee693835762e, []int{404}
 }
 func (m *AWSMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22504,6 +24112,100 @@ func (m *AWSMatcher) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AWSMatcher proto.InternalMessageInfo
 
+// AWSOrganizationMatcher specifies an Organization and rules for discovering accounts under that organization.
+type AWSOrganizationMatcher struct {
+	// OrganizationID is the AWS Organization ID to match against.
+	// Required.
+	OrganizationID string `protobuf:"bytes,1,opt,name=OrganizationID,proto3" json:"organization_id,omitempty"`
+	// OrganizationalUnits contains rules for matchings AWS accounts based on their Organizational Units.
+	OrganizationalUnits  *AWSOrganizationUnitsMatcher `protobuf:"bytes,2,opt,name=OrganizationalUnits,proto3" json:"organizational_units,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                     `json:"-"`
+	XXX_unrecognized     []byte                       `json:"-"`
+	XXX_sizecache        int32                        `json:"-"`
+}
+
+func (m *AWSOrganizationMatcher) Reset()         { *m = AWSOrganizationMatcher{} }
+func (m *AWSOrganizationMatcher) String() string { return proto.CompactTextString(m) }
+func (*AWSOrganizationMatcher) ProtoMessage()    {}
+func (*AWSOrganizationMatcher) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{405}
+}
+func (m *AWSOrganizationMatcher) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSOrganizationMatcher) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSOrganizationMatcher.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSOrganizationMatcher) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSOrganizationMatcher.Merge(m, src)
+}
+func (m *AWSOrganizationMatcher) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSOrganizationMatcher) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSOrganizationMatcher.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSOrganizationMatcher proto.InternalMessageInfo
+
+// AWSOrganizationUnitsMatcher contains rules for matching accounts under an Organization.
+// Accounts that belong to an excluded Organizational Unit, and its children, will be excluded even if they were included.
+type AWSOrganizationUnitsMatcher struct {
+	// Include is a list of AWS Organizational Unit IDs to match.
+	// Only exact matches or wildcard (*) are supported.
+	// If empty, all Organizational Units are included by default.
+	Include []string `protobuf:"bytes,1,rep,name=Include,proto3" json:"include,omitempty"`
+	// Exclude is a list of AWS Organizational Unit IDs to exclude.
+	// Only exact matches or wildcard (*) are supported.
+	// If empty, no Organizational Units are excluded by default.
+	Exclude              []string `protobuf:"bytes,2,rep,name=Exclude,proto3" json:"exclude,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AWSOrganizationUnitsMatcher) Reset()         { *m = AWSOrganizationUnitsMatcher{} }
+func (m *AWSOrganizationUnitsMatcher) String() string { return proto.CompactTextString(m) }
+func (*AWSOrganizationUnitsMatcher) ProtoMessage()    {}
+func (*AWSOrganizationUnitsMatcher) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{406}
+}
+func (m *AWSOrganizationUnitsMatcher) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSOrganizationUnitsMatcher) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSOrganizationUnitsMatcher.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSOrganizationUnitsMatcher) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSOrganizationUnitsMatcher.Merge(m, src)
+}
+func (m *AWSOrganizationUnitsMatcher) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSOrganizationUnitsMatcher) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSOrganizationUnitsMatcher.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSOrganizationUnitsMatcher proto.InternalMessageInfo
+
 // AssumeRole provides a role ARN and ExternalID to assume an AWS role
 // when interacting with AWS resources.
 type AssumeRole struct {
@@ -22520,7 +24222,7 @@ func (m *AssumeRole) Reset()         { *m = AssumeRole{} }
 func (m *AssumeRole) String() string { return proto.CompactTextString(m) }
 func (*AssumeRole) ProtoMessage()    {}
 func (*AssumeRole) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{381}
+	return fileDescriptor_9198ee693835762e, []int{407}
 }
 func (m *AssumeRole) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22572,17 +24274,32 @@ type InstallerParams struct {
 	// 0: uses eice for EC2 matchers which use an integration and script for all the other methods
 	// 1: uses script mode
 	// 2: uses eice mode
-	EnrollMode           InstallParamEnrollMode `protobuf:"varint,8,opt,name=EnrollMode,proto3,enum=types.InstallParamEnrollMode" json:"enroll_mode,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
-	XXX_unrecognized     []byte                 `json:"-"`
-	XXX_sizecache        int32                  `json:"-"`
+	EnrollMode InstallParamEnrollMode `protobuf:"varint,8,opt,name=EnrollMode,proto3,enum=types.InstallParamEnrollMode" json:"enroll_mode,omitempty"`
+	// Suffix indicates the installation suffix for the teleport installation.
+	// Set this value if you want multiple installations of Teleport.
+	// See --install-suffix flag in teleport-update program.
+	// Note: only supported for Amazon EC2.
+	// Suffix name can only contain alphanumeric characters and hyphens.
+	Suffix string `protobuf:"bytes,9,opt,name=Suffix,proto3" json:"suffix,omitempty"`
+	// UpdateGroup indicates the update group for the teleport installation.
+	// This value is used to group installations in order to update them in batches.
+	// See --group flag in teleport-update program.
+	// Note: only supported for Amazon EC2.
+	// Group name can only contain alphanumeric characters and hyphens.
+	UpdateGroup string `protobuf:"bytes,10,opt,name=UpdateGroup,proto3" json:"update_group,omitempty"`
+	// HTTPProxySettings defines HTTP proxy settings for making HTTP requests.
+	// When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.
+	HTTPProxySettings    *HTTPProxySettings `protobuf:"bytes,11,opt,name=HTTPProxySettings,proto3" json:"http_proxy_settings,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
 }
 
 func (m *InstallerParams) Reset()         { *m = InstallerParams{} }
 func (m *InstallerParams) String() string { return proto.CompactTextString(m) }
 func (*InstallerParams) ProtoMessage()    {}
 func (*InstallerParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{382}
+	return fileDescriptor_9198ee693835762e, []int{408}
 }
 func (m *InstallerParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22611,6 +24328,55 @@ func (m *InstallerParams) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_InstallerParams proto.InternalMessageInfo
 
+// HTTPProxySettings defines HTTP proxy settings for making HTTP and HTTPS requests.
+type HTTPProxySettings struct {
+	// HTTPProxy is the URL for the HTTP proxy to use when making requests.
+	// When applied, this will set the HTTP_PROXY environment variable.
+	HTTPProxy string `protobuf:"bytes,1,opt,name=HTTPProxy,proto3" json:"http_proxy,omitempty"`
+	// HTTPSProxy is the URL for the HTTPS Proxy to use when making requests.
+	// When applied, this will set the HTTPS_PROXY environment variable.
+	HTTPSProxy string `protobuf:"bytes,2,opt,name=HTTPSProxy,proto3" json:"https_proxy,omitempty"`
+	// NoProxy is a comma separated list of URLs that will be excluded from proxying.
+	// When applied, this will set the NO_PROXY environment variable.
+	NoProxy              string   `protobuf:"bytes,3,opt,name=NoProxy,proto3" json:"no_proxy,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *HTTPProxySettings) Reset()         { *m = HTTPProxySettings{} }
+func (m *HTTPProxySettings) String() string { return proto.CompactTextString(m) }
+func (*HTTPProxySettings) ProtoMessage()    {}
+func (*HTTPProxySettings) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{409}
+}
+func (m *HTTPProxySettings) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *HTTPProxySettings) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_HTTPProxySettings.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *HTTPProxySettings) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_HTTPProxySettings.Merge(m, src)
+}
+func (m *HTTPProxySettings) XXX_Size() int {
+	return m.Size()
+}
+func (m *HTTPProxySettings) XXX_DiscardUnknown() {
+	xxx_messageInfo_HTTPProxySettings.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_HTTPProxySettings proto.InternalMessageInfo
+
 // AWSSSM provides options to use when executing SSM documents
 type AWSSSM struct {
 	// DocumentName is the name of the document to use when executing an
@@ -22625,7 +24391,7 @@ func (m *AWSSSM) Reset()         { *m = AWSSSM{} }
 func (m *AWSSSM) String() string { return proto.CompactTextString(m) }
 func (*AWSSSM) ProtoMessage()    {}
 func (*AWSSSM) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{383}
+	return fileDescriptor_9198ee693835762e, []int{410}
 }
 func (m *AWSSSM) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22668,7 +24434,7 @@ func (m *AzureInstallerParams) Reset()         { *m = AzureInstallerParams{} }
 func (m *AzureInstallerParams) String() string { return proto.CompactTextString(m) }
 func (*AzureInstallerParams) ProtoMessage()    {}
 func (*AzureInstallerParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{384}
+	return fileDescriptor_9198ee693835762e, []int{411}
 }
 func (m *AzureInstallerParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22712,17 +24478,20 @@ type AzureMatcher struct {
 	ResourceTags Labels `protobuf:"bytes,5,opt,name=ResourceTags,proto3,customtype=Labels" json:"tags,omitempty"`
 	// Params sets the join method when installing on
 	// discovered Azure nodes.
-	Params               *InstallerParams `protobuf:"bytes,6,opt,name=Params,proto3" json:"install_params,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
-	XXX_unrecognized     []byte           `json:"-"`
-	XXX_sizecache        int32            `json:"-"`
+	Params *InstallerParams `protobuf:"bytes,6,opt,name=Params,proto3" json:"install_params,omitempty"`
+	// Integration is the integration name used to generate credentials to interact with Azure APIs.
+	// Environment credentials will not be used when this value is set.
+	Integration          string   `protobuf:"bytes,7,opt,name=Integration,proto3" json:"integration,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *AzureMatcher) Reset()         { *m = AzureMatcher{} }
 func (m *AzureMatcher) String() string { return proto.CompactTextString(m) }
 func (*AzureMatcher) ProtoMessage()    {}
 func (*AzureMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{385}
+	return fileDescriptor_9198ee693835762e, []int{412}
 }
 func (m *AzureMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22777,7 +24546,7 @@ func (m *GCPMatcher) Reset()         { *m = GCPMatcher{} }
 func (m *GCPMatcher) String() string { return proto.CompactTextString(m) }
 func (*GCPMatcher) ProtoMessage()    {}
 func (*GCPMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{386}
+	return fileDescriptor_9198ee693835762e, []int{413}
 }
 func (m *GCPMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22823,7 +24592,7 @@ func (m *KubernetesMatcher) Reset()         { *m = KubernetesMatcher{} }
 func (m *KubernetesMatcher) String() string { return proto.CompactTextString(m) }
 func (*KubernetesMatcher) ProtoMessage()    {}
 func (*KubernetesMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{387}
+	return fileDescriptor_9198ee693835762e, []int{414}
 }
 func (m *KubernetesMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22865,7 +24634,7 @@ func (m *OktaOptions) Reset()         { *m = OktaOptions{} }
 func (m *OktaOptions) String() string { return proto.CompactTextString(m) }
 func (*OktaOptions) ProtoMessage()    {}
 func (*OktaOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{388}
+	return fileDescriptor_9198ee693835762e, []int{415}
 }
 func (m *OktaOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22911,7 +24680,7 @@ func (m *AccessGraphSync) Reset()         { *m = AccessGraphSync{} }
 func (m *AccessGraphSync) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphSync) ProtoMessage()    {}
 func (*AccessGraphSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{389}
+	return fileDescriptor_9198ee693835762e, []int{416}
 }
 func (m *AccessGraphSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22956,7 +24725,7 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) Reset()         { *m = AccessGraphAWS
 func (m *AccessGraphAWSSyncCloudTrailLogs) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphAWSSyncCloudTrailLogs) ProtoMessage()    {}
 func (*AccessGraphAWSSyncCloudTrailLogs) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{390}
+	return fileDescriptor_9198ee693835762e, []int{417}
 }
 func (m *AccessGraphAWSSyncCloudTrailLogs) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -22985,6 +24754,49 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AccessGraphAWSSyncCloudTrailLogs proto.InternalMessageInfo
 
+// AccessGraphAWSSyncEKSAuditLogs defines the settings for ingesting Kubernetes apiserver
+// audit logs from EKS clusters.
+type AccessGraphAWSSyncEKSAuditLogs struct {
+	// The tags of EKS clusters for which apiserver audit logs should be fetched.
+	Tags                 Labels   `protobuf:"bytes,1,opt,name=Tags,proto3,customtype=Labels" json:"tags,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AccessGraphAWSSyncEKSAuditLogs) Reset()         { *m = AccessGraphAWSSyncEKSAuditLogs{} }
+func (m *AccessGraphAWSSyncEKSAuditLogs) String() string { return proto.CompactTextString(m) }
+func (*AccessGraphAWSSyncEKSAuditLogs) ProtoMessage()    {}
+func (*AccessGraphAWSSyncEKSAuditLogs) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{418}
+}
+func (m *AccessGraphAWSSyncEKSAuditLogs) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AccessGraphAWSSyncEKSAuditLogs) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AccessGraphAWSSyncEKSAuditLogs.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AccessGraphAWSSyncEKSAuditLogs) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AccessGraphAWSSyncEKSAuditLogs.Merge(m, src)
+}
+func (m *AccessGraphAWSSyncEKSAuditLogs) XXX_Size() int {
+	return m.Size()
+}
+func (m *AccessGraphAWSSyncEKSAuditLogs) XXX_DiscardUnknown() {
+	xxx_messageInfo_AccessGraphAWSSyncEKSAuditLogs.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AccessGraphAWSSyncEKSAuditLogs proto.InternalMessageInfo
+
 // AccessGraphAWSSync is a configuration for AWS Access Graph service poll service.
 type AccessGraphAWSSync struct {
 	// Regions are AWS regions to import resources from.
@@ -22995,6 +24807,7 @@ type AccessGraphAWSSync struct {
 	Integration string `protobuf:"bytes,4,opt,name=Integration,proto3" json:"integration,omitempty"`
 	// Configuration settings for collecting AWS CloudTrail logs via an SQS queue.
 	CloudTrailLogs       *AccessGraphAWSSyncCloudTrailLogs `protobuf:"bytes,5,opt,name=cloud_trail_logs,json=cloudTrailLogs,proto3" json:"cloud_trail_logs,omitempty"`
+	EksAuditLogs         *AccessGraphAWSSyncEKSAuditLogs   `protobuf:"bytes,6,opt,name=eks_audit_logs,json=eksAuditLogs,proto3" json:"eks_audit_logs,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}                          `json:"-"`
 	XXX_unrecognized     []byte                            `json:"-"`
 	XXX_sizecache        int32                             `json:"-"`
@@ -23004,7 +24817,7 @@ func (m *AccessGraphAWSSync) Reset()         { *m = AccessGraphAWSSync{} }
 func (m *AccessGraphAWSSync) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphAWSSync) ProtoMessage()    {}
 func (*AccessGraphAWSSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{391}
+	return fileDescriptor_9198ee693835762e, []int{419}
 }
 func (m *AccessGraphAWSSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -23048,7 +24861,7 @@ func (m *AccessGraphAzureSync) Reset()         { *m = AccessGraphAzureSync{} }
 func (m *AccessGraphAzureSync) String() string { return proto.CompactTextString(m) }
 func (*AccessGraphAzureSync) ProtoMessage()    {}
 func (*AccessGraphAzureSync) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{392}
+	return fileDescriptor_9198ee693835762e, []int{420}
 }
 func (m *AccessGraphAzureSync) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -23104,7 +24917,7 @@ func (m *TargetHealth) Reset()         { *m = TargetHealth{} }
 func (m *TargetHealth) String() string { return proto.CompactTextString(m) }
 func (*TargetHealth) ProtoMessage()    {}
 func (*TargetHealth) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{393}
+	return fileDescriptor_9198ee693835762e, []int{421}
 }
 func (m *TargetHealth) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -23143,6 +24956,7 @@ func init() {
 	proto.RegisterEnum("types.SecondFactorType", SecondFactorType_name, SecondFactorType_value)
 	proto.RegisterEnum("types.UserTokenUsage", UserTokenUsage_name, UserTokenUsage_value)
 	proto.RegisterEnum("types.RequestState", RequestState_name, RequestState_value)
+	proto.RegisterEnum("types.AccessRequestKind", AccessRequestKind_name, AccessRequestKind_value)
 	proto.RegisterEnum("types.AccessRequestScope", AccessRequestScope_name, AccessRequestScope_value)
 	proto.RegisterEnum("types.CreateHostUserMode", CreateHostUserMode_name, CreateHostUserMode_value)
 	proto.RegisterEnum("types.CreateDatabaseUserMode", CreateDatabaseUserMode_name, CreateDatabaseUserMode_value)
@@ -23192,11 +25006,13 @@ func init() {
 	proto.RegisterType((*RDS)(nil), "types.RDS")
 	proto.RegisterType((*RDSProxy)(nil), "types.RDSProxy")
 	proto.RegisterType((*ElastiCache)(nil), "types.ElastiCache")
+	proto.RegisterType((*ElastiCacheServerless)(nil), "types.ElastiCacheServerless")
 	proto.RegisterType((*MemoryDB)(nil), "types.MemoryDB")
 	proto.RegisterType((*RedshiftServerless)(nil), "types.RedshiftServerless")
 	proto.RegisterType((*OpenSearch)(nil), "types.OpenSearch")
 	proto.RegisterType((*DocumentDB)(nil), "types.DocumentDB")
 	proto.RegisterType((*GCPCloudSQL)(nil), "types.GCPCloudSQL")
+	proto.RegisterType((*AlloyDB)(nil), "types.AlloyDB")
 	proto.RegisterType((*Azure)(nil), "types.Azure")
 	proto.RegisterType((*AzureRedis)(nil), "types.AzureRedis")
 	proto.RegisterType((*AD)(nil), "types.AD")
@@ -23225,6 +25041,7 @@ func init() {
 	proto.RegisterType((*AppIdentityCenter)(nil), "types.AppIdentityCenter")
 	proto.RegisterType((*AppSpecV3)(nil), "types.AppSpecV3")
 	proto.RegisterMapType((map[string]CommandLabelV2)(nil), "types.AppSpecV3.DynamicLabelsEntry")
+	proto.RegisterType((*MCP)(nil), "types.MCP")
 	proto.RegisterType((*Rewrite)(nil), "types.Rewrite")
 	proto.RegisterType((*Header)(nil), "types.Header")
 	proto.RegisterType((*PortRange)(nil), "types.PortRange")
@@ -23234,6 +25051,8 @@ func init() {
 	proto.RegisterType((*SSHKeyPair)(nil), "types.SSHKeyPair")
 	proto.RegisterType((*TLSKeyPair)(nil), "types.TLSKeyPair")
 	proto.RegisterType((*JWTKeyPair)(nil), "types.JWTKeyPair")
+	proto.RegisterType((*EncryptionKeyPair)(nil), "types.EncryptionKeyPair")
+	proto.RegisterType((*AgeEncryptionKey)(nil), "types.AgeEncryptionKey")
 	proto.RegisterType((*CertAuthorityV2)(nil), "types.CertAuthorityV2")
 	proto.RegisterType((*CertAuthoritySpecV2)(nil), "types.CertAuthoritySpecV2")
 	proto.RegisterType((*CAKeySet)(nil), "types.CAKeySet")
@@ -23257,6 +25076,7 @@ func init() {
 	proto.RegisterType((*ProvisionTokenSpecV2Spacelift_Rule)(nil), "types.ProvisionTokenSpecV2Spacelift.Rule")
 	proto.RegisterType((*ProvisionTokenSpecV2Kubernetes)(nil), "types.ProvisionTokenSpecV2Kubernetes")
 	proto.RegisterType((*ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig)(nil), "types.ProvisionTokenSpecV2Kubernetes.StaticJWKSConfig")
+	proto.RegisterType((*ProvisionTokenSpecV2Kubernetes_OIDCConfig)(nil), "types.ProvisionTokenSpecV2Kubernetes.OIDCConfig")
 	proto.RegisterType((*ProvisionTokenSpecV2Kubernetes_Rule)(nil), "types.ProvisionTokenSpecV2Kubernetes.Rule")
 	proto.RegisterType((*ProvisionTokenSpecV2Azure)(nil), "types.ProvisionTokenSpecV2Azure")
 	proto.RegisterType((*ProvisionTokenSpecV2Azure_Rule)(nil), "types.ProvisionTokenSpecV2Azure.Rule")
@@ -23268,6 +25088,8 @@ func init() {
 	proto.RegisterType((*ProvisionTokenSpecV2Bitbucket_Rule)(nil), "types.ProvisionTokenSpecV2Bitbucket.Rule")
 	proto.RegisterType((*ProvisionTokenSpecV2Oracle)(nil), "types.ProvisionTokenSpecV2Oracle")
 	proto.RegisterType((*ProvisionTokenSpecV2Oracle_Rule)(nil), "types.ProvisionTokenSpecV2Oracle.Rule")
+	proto.RegisterType((*ProvisionTokenSpecV2Env0)(nil), "types.ProvisionTokenSpecV2Env0")
+	proto.RegisterType((*ProvisionTokenSpecV2Env0_Rule)(nil), "types.ProvisionTokenSpecV2Env0.Rule")
 	proto.RegisterType((*ProvisionTokenSpecV2BoundKeypair)(nil), "types.ProvisionTokenSpecV2BoundKeypair")
 	proto.RegisterType((*ProvisionTokenSpecV2BoundKeypair_OnboardingSpec)(nil), "types.ProvisionTokenSpecV2BoundKeypair.OnboardingSpec")
 	proto.RegisterType((*ProvisionTokenSpecV2BoundKeypair_RecoverySpec)(nil), "types.ProvisionTokenSpecV2BoundKeypair.RecoverySpec")
@@ -23285,7 +25107,11 @@ func init() {
 	proto.RegisterType((*AgentMeshTunnelStrategy)(nil), "types.AgentMeshTunnelStrategy")
 	proto.RegisterType((*ProxyPeeringTunnelStrategy)(nil), "types.ProxyPeeringTunnelStrategy")
 	proto.RegisterType((*SessionRecordingConfigV2)(nil), "types.SessionRecordingConfigV2")
+	proto.RegisterType((*KeyLabel)(nil), "types.KeyLabel")
+	proto.RegisterType((*ManualKeyManagementConfig)(nil), "types.ManualKeyManagementConfig")
+	proto.RegisterType((*SessionRecordingEncryptionConfig)(nil), "types.SessionRecordingEncryptionConfig")
 	proto.RegisterType((*SessionRecordingConfigSpecV2)(nil), "types.SessionRecordingConfigSpecV2")
+	proto.RegisterType((*SessionRecordingConfigStatus)(nil), "types.SessionRecordingConfigStatus")
 	proto.RegisterType((*AuthPreferenceV2)(nil), "types.AuthPreferenceV2")
 	proto.RegisterType((*AuthPreferenceSpecV2)(nil), "types.AuthPreferenceSpecV2")
 	proto.RegisterType((*StableUNIXUserConfig)(nil), "types.StableUNIXUserConfig")
@@ -23313,6 +25139,8 @@ func init() {
 	proto.RegisterType((*AccessRequestFilter)(nil), "types.AccessRequestFilter")
 	proto.RegisterType((*AccessCapabilities)(nil), "types.AccessCapabilities")
 	proto.RegisterType((*AccessCapabilitiesRequest)(nil), "types.AccessCapabilitiesRequest")
+	proto.RegisterType((*RemoteAccessCapabilities)(nil), "types.RemoteAccessCapabilities")
+	proto.RegisterType((*RemoteAccessCapabilitiesRequest)(nil), "types.RemoteAccessCapabilitiesRequest")
 	proto.RegisterType((*RequestKubernetesResource)(nil), "types.RequestKubernetesResource")
 	proto.RegisterType((*ResourceID)(nil), "types.ResourceID")
 	proto.RegisterType((*PluginDataV3)(nil), "types.PluginDataV3")
@@ -23336,6 +25164,7 @@ func init() {
 	proto.RegisterType((*RoleConditions)(nil), "types.RoleConditions")
 	proto.RegisterType((*IdentityCenterAccountAssignment)(nil), "types.IdentityCenterAccountAssignment")
 	proto.RegisterType((*GitHubPermission)(nil), "types.GitHubPermission")
+	proto.RegisterType((*MCPPermissions)(nil), "types.MCPPermissions")
 	proto.RegisterType((*SPIFFERoleCondition)(nil), "types.SPIFFERoleCondition")
 	proto.RegisterType((*DatabasePermission)(nil), "types.DatabasePermission")
 	proto.RegisterType((*KubernetesResource)(nil), "types.KubernetesResource")
@@ -23346,6 +25175,9 @@ func init() {
 	proto.RegisterType((*AccessReviewConditions)(nil), "types.AccessReviewConditions")
 	proto.RegisterType((*AccessRequestAllowedPromotion)(nil), "types.AccessRequestAllowedPromotion")
 	proto.RegisterType((*AccessRequestAllowedPromotions)(nil), "types.AccessRequestAllowedPromotions")
+	proto.RegisterType((*ResourceIDList)(nil), "types.ResourceIDList")
+	proto.RegisterType((*LongTermResourceGrouping)(nil), "types.LongTermResourceGrouping")
+	proto.RegisterMapType((map[string]ResourceIDList)(nil), "types.LongTermResourceGrouping.AccessListToResourcesEntry")
 	proto.RegisterType((*ClaimMapping)(nil), "types.ClaimMapping")
 	proto.RegisterType((*TraitMapping)(nil), "types.TraitMapping")
 	proto.RegisterType((*Rule)(nil), "types.Rule")
@@ -23399,6 +25231,7 @@ func init() {
 	proto.RegisterType((*KubernetesClusterV3List)(nil), "types.KubernetesClusterV3List")
 	proto.RegisterType((*KubernetesServerV3)(nil), "types.KubernetesServerV3")
 	proto.RegisterType((*KubernetesServerSpecV3)(nil), "types.KubernetesServerSpecV3")
+	proto.RegisterType((*KubernetesServerStatusV3)(nil), "types.KubernetesServerStatusV3")
 	proto.RegisterType((*WebTokenV3)(nil), "types.WebTokenV3")
 	proto.RegisterType((*WebTokenSpecV3)(nil), "types.WebTokenSpecV3")
 	proto.RegisterType((*GetWebSessionRequest)(nil), "types.GetWebSessionRequest")
@@ -23413,6 +25246,7 @@ func init() {
 	proto.RegisterType((*OIDCConnectorV3)(nil), "types.OIDCConnectorV3")
 	proto.RegisterType((*OIDCConnectorV3List)(nil), "types.OIDCConnectorV3List")
 	proto.RegisterType((*OIDCConnectorSpecV3)(nil), "types.OIDCConnectorSpecV3")
+	proto.RegisterType((*EntraIDGroupsProvider)(nil), "types.EntraIDGroupsProvider")
 	proto.RegisterType((*MaxAge)(nil), "types.MaxAge")
 	proto.RegisterType((*SSOClientRedirectSettings)(nil), "types.SSOClientRedirectSettings")
 	proto.RegisterType((*OIDCConnectorMFASettings)(nil), "types.OIDCConnectorMFASettings")
@@ -23441,6 +25275,7 @@ func init() {
 	proto.RegisterType((*LockV2)(nil), "types.LockV2")
 	proto.RegisterType((*LockSpecV2)(nil), "types.LockSpecV2")
 	proto.RegisterType((*LockTarget)(nil), "types.LockTarget")
+	proto.RegisterType((*LockFilter)(nil), "types.LockFilter")
 	proto.RegisterType((*AddressCondition)(nil), "types.AddressCondition")
 	proto.RegisterType((*NetworkRestrictionsSpecV4)(nil), "types.NetworkRestrictionsSpecV4")
 	proto.RegisterType((*NetworkRestrictionsV4)(nil), "types.NetworkRestrictionsV4")
@@ -23494,6 +25329,7 @@ func init() {
 	proto.RegisterType((*PluginOpenAISettings)(nil), "types.PluginOpenAISettings")
 	proto.RegisterType((*PluginMattermostSettings)(nil), "types.PluginMattermostSettings")
 	proto.RegisterType((*PluginJamfSettings)(nil), "types.PluginJamfSettings")
+	proto.RegisterType((*PluginIntuneSettings)(nil), "types.PluginIntuneSettings")
 	proto.RegisterType((*PluginOktaSettings)(nil), "types.PluginOktaSettings")
 	proto.RegisterType((*PluginOktaCredentialsInfo)(nil), "types.PluginOktaCredentialsInfo")
 	proto.RegisterType((*PluginOktaSyncSettings)(nil), "types.PluginOktaSyncSettings")
@@ -23502,9 +25338,11 @@ func init() {
 	proto.RegisterMapType((map[string]*DiscordChannels)(nil), "types.PluginDiscordSettings.RoleToRecipientsEntry")
 	proto.RegisterType((*PluginEntraIDSettings)(nil), "types.PluginEntraIDSettings")
 	proto.RegisterType((*PluginEntraIDSyncSettings)(nil), "types.PluginEntraIDSyncSettings")
+	proto.RegisterType((*PluginSyncFilter)(nil), "types.PluginSyncFilter")
 	proto.RegisterType((*PluginEntraIDAccessGraphSettings)(nil), "types.PluginEntraIDAccessGraphSettings")
 	proto.RegisterType((*PluginEntraIDAppSSOSettings)(nil), "types.PluginEntraIDAppSSOSettings")
 	proto.RegisterType((*PluginSCIMSettings)(nil), "types.PluginSCIMSettings")
+	proto.RegisterType((*PluginSCIMSettings_ConnectorInfo)(nil), "types.PluginSCIMSettings.ConnectorInfo")
 	proto.RegisterType((*PluginDatadogAccessSettings)(nil), "types.PluginDatadogAccessSettings")
 	proto.RegisterType((*PluginAWSICSettings)(nil), "types.PluginAWSICSettings")
 	proto.RegisterType((*AWSICCredentials)(nil), "types.AWSICCredentials")
@@ -23534,6 +25372,7 @@ func init() {
 	proto.RegisterType((*PluginOktaStatusDetailsUsersSync)(nil), "types.PluginOktaStatusDetailsUsersSync")
 	proto.RegisterType((*PluginOktaStatusDetailsSCIM)(nil), "types.PluginOktaStatusDetailsSCIM")
 	proto.RegisterType((*PluginOktaStatusDetailsAccessListsSync)(nil), "types.PluginOktaStatusDetailsAccessListsSync")
+	proto.RegisterType((*PluginOktaStatusSystemLogExporter)(nil), "types.PluginOktaStatusSystemLogExporter")
 	proto.RegisterType((*PluginCredentialsV1)(nil), "types.PluginCredentialsV1")
 	proto.RegisterType((*PluginOAuth2AccessTokenCredentials)(nil), "types.PluginOAuth2AccessTokenCredentials")
 	proto.RegisterType((*PluginBearerTokenCredentials)(nil), "types.PluginBearerTokenCredentials")
@@ -23569,11 +25408,14 @@ func init() {
 	proto.RegisterType((*OktaAssignmentTargetV1)(nil), "types.OktaAssignmentTargetV1")
 	proto.RegisterType((*IntegrationV1)(nil), "types.IntegrationV1")
 	proto.RegisterType((*IntegrationSpecV1)(nil), "types.IntegrationSpecV1")
+	proto.RegisterType((*IntegrationStatusV1)(nil), "types.IntegrationStatusV1")
 	proto.RegisterType((*AWSOIDCIntegrationSpecV1)(nil), "types.AWSOIDCIntegrationSpecV1")
 	proto.RegisterType((*AzureOIDCIntegrationSpecV1)(nil), "types.AzureOIDCIntegrationSpecV1")
 	proto.RegisterType((*GitHubIntegrationSpecV1)(nil), "types.GitHubIntegrationSpecV1")
 	proto.RegisterType((*AWSRAIntegrationSpecV1)(nil), "types.AWSRAIntegrationSpecV1")
 	proto.RegisterType((*AWSRolesAnywhereProfileSyncConfig)(nil), "types.AWSRolesAnywhereProfileSyncConfig")
+	proto.RegisterType((*AWSRAIntegrationStatusV1)(nil), "types.AWSRAIntegrationStatusV1")
+	proto.RegisterType((*AWSRolesAnywhereProfileSyncIterationSummary)(nil), "types.AWSRolesAnywhereProfileSyncIterationSummary")
 	proto.RegisterType((*HeadlessAuthentication)(nil), "types.HeadlessAuthentication")
 	proto.RegisterType((*WatchKind)(nil), "types.WatchKind")
 	proto.RegisterMapType((map[string]string)(nil), "types.WatchKind.FilterEntry")
@@ -23586,8 +25428,11 @@ func init() {
 	proto.RegisterType((*JamfInventoryEntry)(nil), "types.JamfInventoryEntry")
 	proto.RegisterType((*MessageWithHeader)(nil), "types.MessageWithHeader")
 	proto.RegisterType((*AWSMatcher)(nil), "types.AWSMatcher")
+	proto.RegisterType((*AWSOrganizationMatcher)(nil), "types.AWSOrganizationMatcher")
+	proto.RegisterType((*AWSOrganizationUnitsMatcher)(nil), "types.AWSOrganizationUnitsMatcher")
 	proto.RegisterType((*AssumeRole)(nil), "types.AssumeRole")
 	proto.RegisterType((*InstallerParams)(nil), "types.InstallerParams")
+	proto.RegisterType((*HTTPProxySettings)(nil), "types.HTTPProxySettings")
 	proto.RegisterType((*AWSSSM)(nil), "types.AWSSSM")
 	proto.RegisterType((*AzureInstallerParams)(nil), "types.AzureInstallerParams")
 	proto.RegisterType((*AzureMatcher)(nil), "types.AzureMatcher")
@@ -23596,6 +25441,7 @@ func init() {
 	proto.RegisterType((*OktaOptions)(nil), "types.OktaOptions")
 	proto.RegisterType((*AccessGraphSync)(nil), "types.AccessGraphSync")
 	proto.RegisterType((*AccessGraphAWSSyncCloudTrailLogs)(nil), "types.AccessGraphAWSSyncCloudTrailLogs")
+	proto.RegisterType((*AccessGraphAWSSyncEKSAuditLogs)(nil), "types.AccessGraphAWSSyncEKSAuditLogs")
 	proto.RegisterType((*AccessGraphAWSSync)(nil), "types.AccessGraphAWSSync")
 	proto.RegisterType((*AccessGraphAzureSync)(nil), "types.AccessGraphAzureSync")
 	proto.RegisterType((*TargetHealth)(nil), "types.TargetHealth")
@@ -23604,2067 +25450,2261 @@ func init() {
 func init() { proto.RegisterFile("teleport/legacy/types/types.proto", fileDescriptor_9198ee693835762e) }
 
 var fileDescriptor_9198ee693835762e = []byte{
-	// 32922 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xfd, 0x7d, 0x70, 0x1c, 0x49,
-	0x76, 0x18, 0x88, 0x4f, 0x77, 0xe3, 0xa3, 0xf1, 0xd0, 0x00, 0x1a, 0x09, 0x90, 0x04, 0x31, 0xc3,
-	0x69, 0x4e, 0xcd, 0x0c, 0x87, 0x9c, 0x19, 0x92, 0x4b, 0x70, 0x87, 0xbb, 0xb3, 0xf3, 0xb5, 0x0d,
-	0x34, 0x48, 0x34, 0x09, 0x82, 0x3d, 0xd5, 0x00, 0xb9, 0xa3, 0xdd, 0xd9, 0xda, 0x42, 0x77, 0x02,
-	0xa8, 0x41, 0x77, 0x57, 0x6f, 0x55, 0x35, 0x49, 0x68, 0xad, 0x9f, 0x25, 0x4b, 0xfb, 0x93, 0x15,
-	0x3a, 0x49, 0x96, 0x2c, 0x59, 0xeb, 0x0b, 0x5b, 0xe1, 0x90, 0xed, 0x3b, 0x9f, 0x1d, 0x52, 0xd8,
-	0x92, 0x7d, 0xe7, 0x0b, 0x85, 0xe4, 0xd5, 0x9d, 0x2d, 0xeb, 0x1c, 0x17, 0x27, 0x85, 0xcf, 0xf7,
-	0xb5, 0xa1, 0x80, 0xc2, 0xa7, 0x8b, 0xfb, 0x03, 0x11, 0x17, 0x27, 0xdd, 0x45, 0x5c, 0xc4, 0xad,
-	0x42, 0xf6, 0x45, 0xbe, 0xcc, 0xac, 0xca, 0xac, 0xaa, 0x6e, 0x34, 0x66, 0x38, 0xb2, 0xb8, 0xa1,
-	0x7f, 0x48, 0xf4, 0xcb, 0xf7, 0x5e, 0x56, 0x7e, 0xbf, 0x7c, 0xf9, 0x3e, 0xe0, 0x85, 0x80, 0xb6,
-	0x68, 0xd7, 0xf5, 0x82, 0xab, 0x2d, 0xba, 0x6b, 0x37, 0x0e, 0xae, 0x06, 0x07, 0x5d, 0xea, 0xf3,
-	0x7f, 0xaf, 0x74, 0x3d, 0x37, 0x70, 0xc9, 0x28, 0xfe, 0x58, 0x9c, 0xdf, 0x75, 0x77, 0x5d, 0x84,
-	0x5c, 0x65, 0x7f, 0xf1, 0xc2, 0xc5, 0xe7, 0x77, 0x5d, 0x77, 0xb7, 0x45, 0xaf, 0xe2, 0xaf, 0xed,
-	0xde, 0xce, 0xd5, 0x66, 0xcf, 0xb3, 0x03, 0xc7, 0xed, 0x88, 0xf2, 0x52, 0xbc, 0x3c, 0x70, 0xda,
-	0xd4, 0x0f, 0xec, 0x76, 0xb7, 0x1f, 0x83, 0x47, 0x9e, 0xdd, 0xed, 0x52, 0x4f, 0xd4, 0xbe, 0x78,
-	0x29, 0xfc, 0x40, 0x3b, 0x08, 0x18, 0x25, 0x63, 0x7e, 0xf5, 0xe1, 0x35, 0xf5, 0xa7, 0x40, 0xbd,
-	0xd1, 0xa7, 0x2d, 0x5e, 0xcf, 0x0f, 0x68, 0xd3, 0x6a, 0xd2, 0x87, 0x4e, 0x83, 0x5a, 0x1e, 0xfd,
-	0x7a, 0xcf, 0xf1, 0x68, 0x9b, 0x76, 0x02, 0x41, 0x77, 0x39, 0x9d, 0x4e, 0x7e, 0x48, 0xec, 0x8b,
-	0x8c, 0x5f, 0xc8, 0xc1, 0xc4, 0x1d, 0x4a, 0xbb, 0xe5, 0x96, 0xf3, 0x90, 0x92, 0x17, 0x61, 0x64,
-	0xc3, 0x6e, 0xd3, 0x85, 0xcc, 0xf9, 0xcc, 0xc5, 0x89, 0xe5, 0x99, 0xa3, 0xc3, 0xd2, 0xa4, 0x4f,
-	0xbd, 0x87, 0xd4, 0xb3, 0x3a, 0x76, 0x9b, 0x9a, 0x58, 0x48, 0x5e, 0x83, 0x09, 0xf6, 0xbf, 0xdf,
-	0xb5, 0x1b, 0x74, 0x21, 0x8b, 0x98, 0x53, 0x47, 0x87, 0xa5, 0x89, 0x8e, 0x04, 0x9a, 0x51, 0x39,
-	0xa9, 0xc2, 0xf8, 0xea, 0xe3, 0xae, 0xe3, 0x51, 0x7f, 0x61, 0xe4, 0x7c, 0xe6, 0xe2, 0xe4, 0xd2,
-	0xe2, 0x15, 0xde, 0x47, 0x57, 0x64, 0x1f, 0x5d, 0xd9, 0x94, 0x9d, 0xb8, 0x3c, 0xf7, 0xdb, 0x87,
-	0xa5, 0x67, 0x8e, 0x0e, 0x4b, 0xe3, 0x94, 0x93, 0xfc, 0x95, 0xdf, 0x2f, 0x65, 0x4c, 0x49, 0x4f,
-	0xde, 0x86, 0x91, 0xcd, 0x83, 0x2e, 0x5d, 0x98, 0x38, 0x9f, 0xb9, 0x38, 0xbd, 0xf4, 0xfc, 0x15,
-	0x3e, 0xac, 0xe1, 0xc7, 0x47, 0x7f, 0x31, 0xac, 0xe5, 0xfc, 0xd1, 0x61, 0x69, 0x84, 0xa1, 0x98,
-	0x48, 0x45, 0x2e, 0xc3, 0xd8, 0x9a, 0xeb, 0x07, 0xd5, 0xca, 0x02, 0xe0, 0x27, 0x9f, 0x3a, 0x3a,
-	0x2c, 0xcd, 0xee, 0xb9, 0x7e, 0x60, 0x39, 0xcd, 0xd7, 0xdd, 0xb6, 0x13, 0xd0, 0x76, 0x37, 0x38,
-	0x30, 0x05, 0x92, 0xf1, 0x18, 0xa6, 0x34, 0x7e, 0x64, 0x12, 0xc6, 0xb7, 0x36, 0xee, 0x6c, 0xdc,
-	0x7b, 0xb0, 0x51, 0x7c, 0x86, 0xe4, 0x61, 0x64, 0xe3, 0x5e, 0x65, 0xb5, 0x98, 0x21, 0xe3, 0x90,
-	0x2b, 0xd7, 0x6a, 0xc5, 0x2c, 0x29, 0x40, 0xbe, 0x52, 0xde, 0x2c, 0x2f, 0x97, 0xeb, 0xab, 0xc5,
-	0x1c, 0x99, 0x83, 0x99, 0x07, 0xd5, 0x8d, 0xca, 0xbd, 0x07, 0x75, 0xab, 0xb2, 0x5a, 0xbf, 0xb3,
-	0x79, 0xaf, 0x56, 0x1c, 0x21, 0xd3, 0x00, 0x77, 0xb6, 0x96, 0x57, 0xcd, 0x8d, 0xd5, 0xcd, 0xd5,
-	0x7a, 0x71, 0x94, 0xcc, 0x43, 0x51, 0x92, 0x58, 0xf5, 0x55, 0xf3, 0x7e, 0x75, 0x65, 0xb5, 0x38,
-	0x76, 0x7b, 0x24, 0x9f, 0x2b, 0x8e, 0x98, 0xe3, 0xeb, 0xd4, 0xf6, 0x69, 0xb5, 0x62, 0xfc, 0xed,
-	0x1c, 0xe4, 0xef, 0xd2, 0xc0, 0x6e, 0xda, 0x81, 0x4d, 0x9e, 0xd3, 0xc6, 0x07, 0x9b, 0xa8, 0x0c,
-	0xcc, 0x8b, 0xc9, 0x81, 0x19, 0x3d, 0x3a, 0x2c, 0x65, 0x2e, 0xab, 0x03, 0xf2, 0x16, 0x4c, 0x56,
-	0xa8, 0xdf, 0xf0, 0x9c, 0x2e, 0x9b, 0x6c, 0x0b, 0x39, 0x44, 0x3b, 0x7b, 0x74, 0x58, 0x3a, 0xd5,
-	0x8c, 0xc0, 0x4a, 0x87, 0xa8, 0xd8, 0xa4, 0x0a, 0x63, 0xeb, 0xf6, 0x36, 0x6d, 0xf9, 0x0b, 0xa3,
-	0xe7, 0x73, 0x17, 0x27, 0x97, 0x9e, 0x15, 0x83, 0x20, 0x3f, 0xf0, 0x0a, 0x2f, 0x5d, 0xed, 0x04,
-	0xde, 0xc1, 0xf2, 0xfc, 0xd1, 0x61, 0xa9, 0xd8, 0x42, 0x80, 0xda, 0xc1, 0x1c, 0x85, 0xd4, 0xa3,
-	0x89, 0x31, 0x76, 0xec, 0xc4, 0x38, 0xf7, 0xdb, 0x87, 0xa5, 0x0c, 0x1b, 0x30, 0x31, 0x31, 0x22,
-	0x7e, 0xfa, 0x14, 0x59, 0x82, 0xbc, 0x49, 0x1f, 0x3a, 0x3e, 0x6b, 0x59, 0x1e, 0x5b, 0x76, 0xfa,
-	0xe8, 0xb0, 0x44, 0x3c, 0x01, 0x53, 0x3e, 0x23, 0xc4, 0x5b, 0x7c, 0x13, 0x26, 0x95, 0xaf, 0x26,
-	0x45, 0xc8, 0xed, 0xd3, 0x03, 0xde, 0xc3, 0x26, 0xfb, 0x93, 0xcc, 0xc3, 0xe8, 0x43, 0xbb, 0xd5,
-	0x13, 0x5d, 0x6a, 0xf2, 0x1f, 0x5f, 0xc8, 0x7e, 0x3e, 0x73, 0x7b, 0x24, 0x3f, 0x5e, 0xcc, 0x9b,
-	0xd9, 0x6a, 0xc5, 0xf8, 0x99, 0x11, 0xc8, 0x9b, 0x2e, 0x5f, 0xc0, 0xe4, 0x12, 0x8c, 0xd6, 0x03,
-	0x3b, 0x90, 0xc3, 0x34, 0x77, 0x74, 0x58, 0x9a, 0x61, 0x8b, 0x9b, 0x2a, 0xf5, 0x73, 0x0c, 0x86,
-	0x5a, 0xdb, 0xb3, 0x7d, 0x39, 0x5c, 0x88, 0xda, 0x65, 0x00, 0x15, 0x15, 0x31, 0xc8, 0x05, 0x18,
-	0xb9, 0xeb, 0x36, 0xa9, 0x18, 0x31, 0x72, 0x74, 0x58, 0x9a, 0x6e, 0xbb, 0x4d, 0x15, 0x11, 0xcb,
-	0xc9, 0xeb, 0x30, 0xb1, 0xd2, 0xf3, 0x3c, 0xda, 0x61, 0x73, 0x7d, 0x04, 0x91, 0xa7, 0x8f, 0x0e,
-	0x4b, 0xd0, 0xe0, 0x40, 0xcb, 0x69, 0x9a, 0x11, 0x02, 0x1b, 0x86, 0x7a, 0x60, 0x7b, 0x01, 0x6d,
-	0x2e, 0x8c, 0x0e, 0x35, 0x0c, 0x6c, 0x7d, 0xce, 0xfa, 0x9c, 0x24, 0x3e, 0x0c, 0x82, 0x13, 0x59,
-	0x83, 0xc9, 0x5b, 0x9e, 0xdd, 0xa0, 0x35, 0xea, 0x39, 0x6e, 0x13, 0xc7, 0x37, 0xb7, 0x7c, 0xe1,
-	0xe8, 0xb0, 0x74, 0x7a, 0x97, 0x81, 0xad, 0x2e, 0xc2, 0x23, 0xea, 0xef, 0x1e, 0x96, 0xf2, 0x15,
-	0xb1, 0xd5, 0x9a, 0x2a, 0x29, 0xf9, 0x1a, 0x1b, 0x1c, 0x3f, 0xc0, 0xae, 0xa5, 0xcd, 0x85, 0xf1,
-	0x63, 0x3f, 0xd1, 0x10, 0x9f, 0x78, 0xba, 0x65, 0xfb, 0x81, 0xe5, 0x71, 0xba, 0xd8, 0x77, 0xaa,
-	0x2c, 0xc9, 0x3d, 0xc8, 0xd7, 0x1b, 0x7b, 0xb4, 0xd9, 0x6b, 0x51, 0x9c, 0x32, 0x93, 0x4b, 0x67,
-	0xc4, 0xa4, 0x96, 0xe3, 0x29, 0x8b, 0x97, 0x17, 0x05, 0x6f, 0xe2, 0x0b, 0x88, 0x3a, 0x9f, 0x24,
-	0xd6, 0x17, 0xf2, 0xdf, 0xfa, 0x5b, 0xa5, 0x67, 0x7e, 0xf0, 0xf7, 0xce, 0x3f, 0x63, 0xfc, 0x17,
-	0x59, 0x28, 0xc6, 0x99, 0x90, 0x1d, 0x98, 0xda, 0xea, 0x36, 0xed, 0x80, 0xae, 0xb4, 0x1c, 0xda,
-	0x09, 0x7c, 0x9c, 0x24, 0x83, 0xdb, 0xf4, 0x92, 0xa8, 0x77, 0xa1, 0x87, 0x84, 0x56, 0x83, 0x53,
-	0xc6, 0x5a, 0xa5, 0xb3, 0x8d, 0xea, 0xa9, 0xe3, 0x06, 0xee, 0xe3, 0x0c, 0x3b, 0x59, 0x3d, 0x7c,
-	0xeb, 0xef, 0x53, 0x8f, 0x60, 0x2b, 0x26, 0x50, 0xa7, 0xb9, 0x7d, 0x80, 0x33, 0x73, 0xf8, 0x09,
-	0xc4, 0x48, 0x52, 0x26, 0x10, 0x03, 0x1b, 0xff, 0x5b, 0x06, 0xa6, 0x4d, 0xea, 0xbb, 0x3d, 0xaf,
-	0x41, 0xd7, 0xa8, 0xdd, 0xa4, 0x1e, 0x9b, 0xfe, 0x77, 0x9c, 0x4e, 0x53, 0xac, 0x29, 0x9c, 0xfe,
-	0xfb, 0x4e, 0x47, 0xdd, 0xba, 0xb1, 0x9c, 0x7c, 0x06, 0xc6, 0xeb, 0xbd, 0x6d, 0x44, 0xcd, 0x46,
-	0x3b, 0x80, 0xdf, 0xdb, 0xb6, 0x62, 0xe8, 0x12, 0x8d, 0x5c, 0x85, 0xf1, 0xfb, 0xd4, 0xf3, 0xa3,
-	0xdd, 0x10, 0x8f, 0x86, 0x87, 0x1c, 0xa4, 0x12, 0x08, 0x2c, 0x72, 0x2b, 0xda, 0x91, 0xc5, 0xa1,
-	0x36, 0x13, 0xdb, 0x07, 0xa3, 0xa9, 0xd2, 0x16, 0x10, 0x75, 0xaa, 0x48, 0x2c, 0xe3, 0x7f, 0xce,
-	0x42, 0xb1, 0x62, 0x07, 0xf6, 0xb6, 0xed, 0x8b, 0xfe, 0xbc, 0x7f, 0x9d, 0xed, 0xf1, 0x4a, 0x43,
-	0x71, 0x8f, 0x67, 0x5f, 0xfe, 0xb1, 0x9b, 0xf7, 0x72, 0xbc, 0x79, 0x93, 0xec, 0x84, 0x15, 0xcd,
-	0x8b, 0x1a, 0xf5, 0xce, 0xf1, 0x8d, 0x2a, 0x8a, 0x46, 0xe5, 0x65, 0xa3, 0xa2, 0xa6, 0x90, 0x77,
-	0x60, 0xa4, 0xde, 0xa5, 0x0d, 0xb1, 0x89, 0xc8, 0x73, 0x41, 0x6f, 0x1c, 0x43, 0xb8, 0x7f, 0x7d,
-	0xb9, 0x20, 0xd8, 0x8c, 0xf8, 0x5d, 0xda, 0x30, 0x91, 0x8c, 0xac, 0xc2, 0x18, 0xdb, 0x10, 0x7b,
-	0xf2, 0x30, 0x38, 0x97, 0xce, 0x00, 0x51, 0xee, 0x5f, 0x5f, 0x9e, 0x16, 0x2c, 0xc6, 0x7c, 0x84,
-	0x98, 0x82, 0x58, 0x59, 0x7b, 0xff, 0x34, 0x07, 0xf3, 0x69, 0xb5, 0xab, 0xdd, 0x31, 0x36, 0xa0,
-	0x3b, 0x2e, 0x42, 0x9e, 0x49, 0x02, 0xec, 0x74, 0xc5, 0x5d, 0x67, 0x62, 0xb9, 0xc0, 0x5a, 0xbe,
-	0x27, 0x60, 0x66, 0x58, 0x4a, 0x5e, 0x0c, 0x05, 0x8b, 0x7c, 0xc4, 0x4f, 0x08, 0x16, 0x52, 0x9c,
-	0x60, 0x53, 0x46, 0xee, 0x04, 0x28, 0x7f, 0x44, 0xbd, 0x2b, 0xc1, 0xd1, 0x94, 0xf1, 0x04, 0x44,
-	0x3b, 0xad, 0xe4, 0xd9, 0xb2, 0x0a, 0x79, 0xd9, 0xac, 0x85, 0x02, 0x32, 0x9a, 0x8d, 0x75, 0xd5,
-	0xfd, 0xeb, 0x7c, 0x4e, 0x34, 0xc5, 0x6f, 0x95, 0x8d, 0xc4, 0x21, 0xd7, 0x21, 0x5f, 0xf3, 0xdc,
-	0xc7, 0x07, 0xd5, 0x8a, 0xbf, 0x30, 0x75, 0x3e, 0x77, 0x71, 0x62, 0xf9, 0xcc, 0xd1, 0x61, 0x69,
-	0xae, 0xcb, 0x60, 0x96, 0xd3, 0x54, 0x0f, 0xec, 0x10, 0xf1, 0xf6, 0x48, 0x3e, 0x53, 0xcc, 0xde,
-	0x1e, 0xc9, 0x67, 0x8b, 0x39, 0x2e, 0xa5, 0xdc, 0x1e, 0xc9, 0x8f, 0x14, 0x47, 0x6f, 0x8f, 0xe4,
-	0x47, 0x51, 0x6e, 0x99, 0x28, 0xc2, 0xed, 0x91, 0xfc, 0x64, 0xb1, 0xa0, 0x09, 0x0d, 0xc8, 0x20,
-	0x70, 0x1b, 0x6e, 0xcb, 0xcc, 0x6d, 0x99, 0x55, 0x73, 0x6c, 0xa5, 0xbc, 0x42, 0xbd, 0xc0, 0xcc,
-	0x95, 0x1f, 0xd4, 0xcd, 0xa9, 0xca, 0x41, 0xc7, 0x6e, 0x3b, 0x0d, 0x7e, 0x02, 0x9b, 0xb9, 0x5b,
-	0x2b, 0x35, 0xa3, 0x03, 0xa7, 0xd3, 0x87, 0x9d, 0x6c, 0x42, 0x61, 0xd3, 0xf6, 0x76, 0x69, 0xb0,
-	0x46, 0xed, 0x56, 0xb0, 0xb7, 0x30, 0x8d, 0x1d, 0x30, 0x27, 0x3a, 0x40, 0x2d, 0x5a, 0x7e, 0xf6,
-	0xe8, 0xb0, 0x74, 0x26, 0x40, 0x88, 0xb5, 0x87, 0x20, 0xa5, 0x49, 0x1a, 0x17, 0xa3, 0x0c, 0xd3,
-	0x51, 0xdf, 0xad, 0x3b, 0x7e, 0x40, 0xae, 0xc2, 0x84, 0x84, 0xb0, 0xfd, 0x39, 0x97, 0xda, 0xcb,
-	0x66, 0x84, 0x63, 0xfc, 0x56, 0x16, 0x20, 0x2a, 0x79, 0x4a, 0x97, 0xf0, 0xe7, 0xb4, 0x25, 0x7c,
-	0x2a, 0xbe, 0x02, 0xfb, 0x2f, 0xde, 0xf7, 0x62, 0x8b, 0xf7, 0x4c, 0x9c, 0x74, 0xf8, 0x65, 0xfb,
-	0x0b, 0xe3, 0xd1, 0x60, 0x88, 0x05, 0x7b, 0x11, 0xc2, 0x09, 0x24, 0x3a, 0x14, 0x57, 0x62, 0x57,
-	0x4e, 0xaa, 0xb0, 0x94, 0x9c, 0x05, 0x36, 0xc1, 0x44, 0xa7, 0x8e, 0x1f, 0x1d, 0x96, 0x72, 0x3d,
-	0xcf, 0xc1, 0x49, 0x47, 0xae, 0x82, 0x98, 0x76, 0xa2, 0x03, 0xd9, 0x6c, 0x9f, 0x6d, 0xd8, 0x56,
-	0x83, 0x7a, 0x41, 0xd4, 0xe3, 0x0b, 0x19, 0x39, 0x3b, 0x49, 0x17, 0xf4, 0xa9, 0xb9, 0x30, 0x82,
-	0xd3, 0xe0, 0x62, 0x6a, 0xaf, 0x5c, 0xd1, 0x50, 0xb9, 0xf4, 0x7b, 0x5e, 0x1e, 0xa6, 0x4d, 0x5e,
-	0x66, 0x25, 0x24, 0x61, 0xbd, 0x02, 0x72, 0x1d, 0xd8, 0x8a, 0x10, 0xbd, 0x0f, 0xa2, 0x9e, 0xf2,
-	0x83, 0xfa, 0xf2, 0x29, 0xc1, 0x69, 0xca, 0x7e, 0xa4, 0x92, 0x33, 0x6c, 0xf2, 0x16, 0xb0, 0x25,
-	0x23, 0xfa, 0x9d, 0x08, 0xa2, 0x5b, 0x2b, 0xb5, 0x95, 0x96, 0xdb, 0x6b, 0xd6, 0xdf, 0x5f, 0x8f,
-	0x88, 0x77, 0x1b, 0x5d, 0x95, 0xf8, 0xd6, 0x4a, 0x8d, 0xbc, 0x05, 0xa3, 0xe5, 0xef, 0xef, 0x79,
-	0x54, 0x88, 0x55, 0x05, 0x59, 0x27, 0x83, 0x2d, 0x9f, 0x11, 0x84, 0x33, 0x36, 0xfb, 0xa9, 0x8a,
-	0xa3, 0x58, 0xce, 0x6a, 0xde, 0x5c, 0xaf, 0x0b, 0x91, 0x89, 0xc4, 0xba, 0x65, 0x73, 0x5d, 0xf9,
-	0xec, 0x40, 0x6b, 0x35, 0xa3, 0x22, 0x57, 0x21, 0x5b, 0xae, 0xe0, 0x45, 0x6e, 0x72, 0x69, 0x42,
-	0x56, 0x5b, 0x59, 0x9e, 0x17, 0x24, 0x05, 0x5b, 0x5d, 0x06, 0xd9, 0x72, 0x85, 0x2c, 0xc3, 0xe8,
-	0xdd, 0x83, 0xfa, 0xfb, 0xeb, 0x62, 0xf3, 0x94, 0x4b, 0x1e, 0x61, 0xf7, 0x70, 0x9b, 0xf1, 0xa3,
-	0x2f, 0x6e, 0x1f, 0xf8, 0x5f, 0x6f, 0xa9, 0x5f, 0x8c, 0x68, 0xa4, 0x06, 0x13, 0xe5, 0x66, 0xdb,
-	0xe9, 0x6c, 0xf9, 0xd4, 0x5b, 0x98, 0x44, 0x3e, 0x0b, 0xb1, 0xef, 0x0e, 0xcb, 0x97, 0x17, 0x8e,
-	0x0e, 0x4b, 0xf3, 0x36, 0xfb, 0x69, 0xf5, 0x7c, 0xea, 0x29, 0xdc, 0x22, 0x26, 0xa4, 0x06, 0x70,
-	0xd7, 0xed, 0xec, 0xba, 0xe5, 0xa0, 0x65, 0xfb, 0xb1, 0xed, 0x38, 0x2a, 0x08, 0xa5, 0x9e, 0x53,
-	0x6d, 0x06, 0xb3, 0x6c, 0x06, 0x54, 0x18, 0x2a, 0x3c, 0xc8, 0x4d, 0x18, 0xbb, 0xe7, 0xd9, 0x8d,
-	0x16, 0x5d, 0x98, 0x42, 0x6e, 0xf3, 0x82, 0x1b, 0x07, 0xca, 0x96, 0x2e, 0x08, 0x86, 0x45, 0x17,
-	0xc1, 0xea, 0xed, 0x8a, 0x23, 0x2e, 0x3e, 0x00, 0x92, 0x9c, 0x93, 0x29, 0x77, 0x9b, 0xd7, 0xd4,
-	0xbb, 0x4d, 0xb4, 0xe8, 0x57, 0xdc, 0x76, 0xdb, 0xee, 0x34, 0x91, 0xf6, 0xfe, 0x92, 0x72, 0xe5,
-	0x31, 0xbe, 0x0e, 0xb3, 0x89, 0xce, 0x3a, 0xe6, 0x5a, 0xfa, 0x2e, 0xcc, 0x54, 0xe8, 0x8e, 0xdd,
-	0x6b, 0x05, 0xe1, 0xc9, 0xc5, 0x97, 0x28, 0x5e, 0x10, 0x9b, 0xbc, 0xc8, 0x92, 0xc7, 0x95, 0x19,
-	0x47, 0x36, 0xde, 0x81, 0x29, 0xad, 0xf9, 0xec, 0x86, 0x53, 0xee, 0x35, 0x9d, 0x00, 0x07, 0x32,
-	0x13, 0xdd, 0x70, 0x6c, 0x06, 0xc4, 0xe1, 0x32, 0x23, 0x04, 0xe3, 0xef, 0xa8, 0x42, 0x96, 0x3c,
-	0x49, 0x2e, 0x87, 0xfb, 0x41, 0x26, 0x12, 0xf9, 0x12, 0xfb, 0x41, 0xb8, 0x1b, 0x5c, 0xe2, 0x6b,
-	0x33, 0x9b, 0x58, 0x9b, 0x93, 0x62, 0x24, 0x72, 0xf6, 0x23, 0x9f, 0xaf, 0xc8, 0x70, 0xa6, 0xe6,
-	0x3e, 0xfe, 0x4c, 0x7d, 0x0f, 0x0a, 0x77, 0xed, 0x8e, 0xbd, 0x4b, 0x9b, 0xac, 0x05, 0x7c, 0xef,
-	0x99, 0xe0, 0x47, 0x5a, 0x9b, 0xc3, 0xb1, 0x95, 0xea, 0x24, 0xd2, 0x08, 0xc8, 0x35, 0xb9, 0xb2,
-	0x47, 0x53, 0x56, 0xf6, 0x94, 0xa8, 0x7d, 0x14, 0x57, 0xb6, 0x58, 0xcf, 0xc6, 0xb7, 0x27, 0xb0,
-	0x8d, 0xe4, 0x75, 0x18, 0x33, 0xe9, 0x2e, 0x3b, 0x6a, 0x32, 0xd1, 0x20, 0x79, 0x08, 0x51, 0x3b,
-	0x86, 0xe3, 0xa0, 0x5c, 0x43, 0x9b, 0xfe, 0x9e, 0xb3, 0x13, 0x88, 0xde, 0x09, 0xe5, 0x1a, 0x01,
-	0x56, 0xe4, 0x1a, 0x01, 0xd1, 0x6f, 0xe1, 0x1c, 0xc6, 0x76, 0x3f, 0xb3, 0x52, 0x17, 0x9d, 0x26,
-	0x7b, 0xd8, 0xac, 0x28, 0xdb, 0x88, 0xa7, 0x49, 0x25, 0x0c, 0x9b, 0xdc, 0x80, 0x89, 0x72, 0xa3,
-	0xe1, 0xf6, 0x94, 0xab, 0x2e, 0x5f, 0xb7, 0x1c, 0xa8, 0x6b, 0x76, 0x22, 0x54, 0x52, 0x87, 0xc9,
-	0x55, 0x76, 0x3f, 0x74, 0x56, 0xec, 0xc6, 0x9e, 0xec, 0x24, 0xb9, 0x87, 0x29, 0x25, 0xd1, 0xca,
-	0xa5, 0x08, 0x6c, 0x30, 0xa0, 0xaa, 0x1b, 0x51, 0x70, 0xc9, 0x26, 0x4c, 0xd6, 0x69, 0xc3, 0xa3,
-	0x41, 0x3d, 0x70, 0x3d, 0x1a, 0xdb, 0x92, 0x95, 0x92, 0xe5, 0xe7, 0xe5, 0x15, 0xd5, 0x47, 0xa0,
-	0xe5, 0x33, 0xa8, 0xca, 0x55, 0x41, 0xe6, 0x77, 0x8d, 0xb6, 0xeb, 0x1d, 0x54, 0x96, 0xc5, 0x36,
-	0x1d, 0x9d, 0xe9, 0x1c, 0xac, 0xde, 0x35, 0x18, 0xa4, 0xb9, 0xad, 0xdf, 0x35, 0x38, 0x16, 0x8e,
-	0x54, 0xa5, 0x8e, 0xb2, 0x9c, 0xd8, 0xb4, 0x67, 0xa2, 0x5e, 0x46, 0xb0, 0x32, 0x52, 0x4d, 0x1f,
-	0x25, 0x41, 0x6d, 0xa4, 0x04, 0x16, 0xe9, 0x02, 0x91, 0xa3, 0xc6, 0xc5, 0xb3, 0x16, 0xf5, 0x7d,
-	0xb1, 0x97, 0x9f, 0x8d, 0x0d, 0x7e, 0x84, 0xb0, 0xfc, 0xb2, 0x60, 0x7e, 0x4e, 0x4e, 0x03, 0x71,
-	0xbd, 0x64, 0x85, 0x4a, 0x3d, 0x29, 0xbc, 0xc9, 0x9b, 0x00, 0xab, 0x8f, 0x03, 0xea, 0x75, 0xec,
-	0x56, 0xa8, 0xbe, 0x43, 0x8d, 0x15, 0x15, 0x50, 0x7d, 0xa0, 0x15, 0x64, 0xb2, 0x02, 0x53, 0x65,
-	0xdf, 0xef, 0xb5, 0xa9, 0xe9, 0xb6, 0x68, 0xd9, 0xdc, 0xc0, 0x7d, 0x7f, 0x62, 0xf9, 0xdc, 0xd1,
-	0x61, 0xe9, 0xac, 0x8d, 0x05, 0x96, 0xe7, 0xb6, 0xa8, 0x65, 0x7b, 0xea, 0xec, 0xd6, 0x69, 0xc8,
-	0x3d, 0x80, 0x7b, 0x5d, 0xda, 0xa9, 0x53, 0xdb, 0x6b, 0xec, 0xc5, 0xb6, 0xf9, 0xa8, 0x60, 0xf9,
-	0x39, 0xd1, 0xc2, 0x79, 0xb7, 0x4b, 0x3b, 0x3e, 0xc2, 0xd4, 0xaf, 0x8a, 0x30, 0xc9, 0x03, 0x98,
-	0xa9, 0x96, 0xef, 0xd6, 0xdc, 0x96, 0xd3, 0x38, 0x10, 0x92, 0xd3, 0x34, 0x2a, 0x35, 0x4f, 0x0b,
-	0xae, 0xb1, 0x52, 0xbe, 0x3d, 0x39, 0x76, 0xdb, 0xea, 0x22, 0xd4, 0x12, 0xf2, 0x53, 0x9c, 0x0b,
-	0xf9, 0x80, 0xcd, 0x41, 0x9f, 0x09, 0x83, 0x9b, 0xf6, 0xae, 0xbf, 0x30, 0xa3, 0x29, 0xe9, 0xca,
-	0x0f, 0xea, 0x57, 0x94, 0x52, 0x2e, 0xa6, 0x2c, 0xf2, 0x89, 0x88, 0x50, 0x2b, 0xb0, 0x77, 0x7d,
-	0x7d, 0x22, 0x86, 0xd8, 0xe4, 0x36, 0x40, 0xc5, 0x6d, 0xf4, 0xda, 0xb4, 0x13, 0x54, 0x96, 0x17,
-	0x8a, 0xfa, 0xd5, 0x23, 0x2c, 0x88, 0xb6, 0xb6, 0xa6, 0xdb, 0xd0, 0x66, 0xa2, 0x42, 0xbd, 0xf8,
-	0x2e, 0x14, 0xe3, 0x1f, 0x72, 0x42, 0xbd, 0xdb, 0x54, 0x71, 0x5a, 0x69, 0xfd, 0xea, 0x63, 0xc7,
-	0x0f, 0x7c, 0xe3, 0x1b, 0xda, 0x0a, 0x64, 0xbb, 0xc3, 0x1d, 0x7a, 0x50, 0xf3, 0xe8, 0x8e, 0xf3,
-	0x58, 0x6c, 0x66, 0xb8, 0x3b, 0xec, 0xd3, 0x03, 0xab, 0x8b, 0x50, 0x75, 0x77, 0x08, 0x51, 0xc9,
-	0x67, 0x21, 0x7f, 0xe7, 0x6e, 0xfd, 0x0e, 0x3d, 0xa8, 0x56, 0xc4, 0x41, 0xc5, 0xc9, 0xda, 0xbe,
-	0xc5, 0x48, 0xb5, 0xb9, 0x16, 0x62, 0x1a, 0xcb, 0xd1, 0x4e, 0xc8, 0x6a, 0x5e, 0x69, 0xf5, 0xfc,
-	0x80, 0x7a, 0xd5, 0x8a, 0x5a, 0x73, 0x83, 0x03, 0x63, 0xfb, 0x52, 0x88, 0x6a, 0xfc, 0xfb, 0x2c,
-	0xee, 0x82, 0x6c, 0xc2, 0x57, 0x3b, 0x7e, 0x60, 0x77, 0x1a, 0x34, 0x64, 0x80, 0x13, 0xde, 0x11,
-	0xd0, 0xd8, 0x84, 0x8f, 0x90, 0xf5, 0xaa, 0xb3, 0x43, 0x57, 0xcd, 0xaa, 0x94, 0x0a, 0x97, 0x6a,
-	0x45, 0xd5, 0x0a, 0x7b, 0x02, 0x1a, 0xab, 0x32, 0x42, 0x26, 0x17, 0x60, 0xbc, 0x5a, 0xbe, 0x5b,
-	0xee, 0x05, 0x7b, 0xb8, 0x07, 0xe7, 0xb9, 0x7c, 0xce, 0x66, 0xab, 0xdd, 0x0b, 0xf6, 0x4c, 0x59,
-	0x48, 0xae, 0xe2, 0xbd, 0xa7, 0x43, 0x03, 0xae, 0x3d, 0x16, 0x87, 0xae, 0xcf, 0x41, 0xb1, 0x6b,
-	0x0f, 0x03, 0x91, 0x57, 0x61, 0xf4, 0x7e, 0x6d, 0xa5, 0x5a, 0x11, 0x17, 0x75, 0x3c, 0x89, 0x1e,
-	0x76, 0x1b, 0xfa, 0x97, 0x70, 0x14, 0xb2, 0x0a, 0xd3, 0x75, 0xda, 0xe8, 0x79, 0x4e, 0x70, 0x70,
-	0xcb, 0x73, 0x7b, 0x5d, 0x7f, 0x61, 0x1c, 0xeb, 0xc0, 0x95, 0xee, 0x8b, 0x12, 0x6b, 0x17, 0x8b,
-	0x14, 0xea, 0x18, 0x91, 0xf1, 0x9b, 0x99, 0x68, 0x9b, 0x24, 0x17, 0x34, 0xb1, 0x06, 0x55, 0x4e,
-	0x4c, 0xac, 0x51, 0x55, 0x4e, 0x28, 0xe0, 0x98, 0x40, 0x56, 0x7a, 0x7e, 0xe0, 0xb6, 0x57, 0x3b,
-	0xcd, 0xae, 0xeb, 0x74, 0x02, 0xa4, 0xe2, 0x9d, 0x6f, 0x1c, 0x1d, 0x96, 0x9e, 0x6f, 0x60, 0xa9,
-	0x45, 0x45, 0xb1, 0x15, 0xe3, 0x92, 0x42, 0xfd, 0x09, 0xc6, 0xc3, 0xf8, 0x57, 0x59, 0xed, 0x78,
-	0x63, 0x9f, 0x67, 0xd2, 0x6e, 0xcb, 0x69, 0xa0, 0x06, 0x01, 0x1b, 0x1a, 0xce, 0x2a, 0xfc, 0x3c,
-	0x2f, 0x2a, 0xe5, 0x3d, 0xa4, 0xf3, 0x4e, 0xa1, 0x26, 0x5f, 0x84, 0x02, 0x93, 0x34, 0xc4, 0x4f,
-	0x7f, 0x21, 0x8b, 0x9d, 0xfd, 0x1c, 0x2a, 0x0f, 0x7d, 0xea, 0x85, 0x6c, 0x34, 0x11, 0x45, 0xa5,
-	0x20, 0x4d, 0x58, 0xd8, 0xf4, 0xec, 0x8e, 0xef, 0x04, 0xab, 0x9d, 0x86, 0x77, 0x80, 0x92, 0xd1,
-	0x6a, 0xc7, 0xde, 0x6e, 0xd1, 0x26, 0x36, 0x37, 0xbf, 0x7c, 0xf1, 0xe8, 0xb0, 0xf4, 0x52, 0xc0,
-	0x71, 0x2c, 0x1a, 0x22, 0x59, 0x94, 0x63, 0x29, 0x9c, 0xfb, 0x72, 0x62, 0x92, 0x94, 0xec, 0x56,
-	0x7c, 0x3b, 0xe2, 0x42, 0x02, 0x4a, 0x52, 0xe1, 0x68, 0xb0, 0x3d, 0x4c, 0xfd, 0x4c, 0x95, 0xc0,
-	0xf8, 0x7f, 0x32, 0xd1, 0x01, 0x4c, 0xde, 0x86, 0x49, 0xb1, 0x62, 0x94, 0x79, 0x81, 0x3b, 0xa8,
-	0x5c, 0x5e, 0xb1, 0x91, 0x55, 0xd1, 0xd9, 0xbd, 0xbf, 0xbc, 0xb2, 0xae, 0xcc, 0x0d, 0xbc, 0xf7,
-	0xdb, 0x8d, 0x56, 0x9c, 0x4a, 0xa2, 0xb1, 0x49, 0xb0, 0xb9, 0x5e, 0xd7, 0x7b, 0x05, 0x27, 0x41,
-	0xd0, 0xf2, 0x53, 0xba, 0x41, 0x41, 0xfe, 0xe4, 0x0d, 0xff, 0x9f, 0x32, 0x69, 0xe7, 0x3c, 0x59,
-	0x86, 0xa9, 0x07, 0xae, 0xb7, 0x8f, 0xe3, 0xab, 0x74, 0x02, 0x8e, 0xfc, 0x23, 0x59, 0x10, 0x6f,
-	0x90, 0x4e, 0xa2, 0x7e, 0x9b, 0xd2, 0x1b, 0xfa, 0xb7, 0xc5, 0x38, 0x68, 0x04, 0x6c, 0x1c, 0x42,
-	0x8e, 0xe1, 0xea, 0xc0, 0x71, 0x88, 0x3e, 0x41, 0x9b, 0xc2, 0x2a, 0xba, 0xf1, 0xeb, 0x19, 0xf5,
-	0x3c, 0x67, 0x9d, 0x5c, 0x71, 0xdb, 0xb6, 0xd3, 0x51, 0x9a, 0xc3, 0xdf, 0xc3, 0x10, 0x1a, 0xff,
-	0x12, 0x05, 0x99, 0x5c, 0x87, 0x3c, 0xff, 0x15, 0xee, 0xb5, 0xa8, 0x45, 0x13, 0x84, 0xfa, 0x41,
-	0x21, 0x11, 0x13, 0x23, 0x93, 0x3b, 0xe9, 0xc8, 0x7c, 0x3b, 0xa3, 0x1e, 0xc5, 0x1f, 0xf7, 0xb0,
-	0x89, 0x1d, 0x32, 0xd9, 0x93, 0x1c, 0x32, 0x9f, 0xb8, 0x09, 0x3f, 0x98, 0x81, 0x49, 0x45, 0x4b,
-	0xc1, 0xda, 0x50, 0xf3, 0xdc, 0x8f, 0x68, 0x23, 0xd0, 0xdb, 0xd0, 0xe5, 0xc0, 0x58, 0x1b, 0x42,
-	0xd4, 0x4f, 0xd0, 0x06, 0xe3, 0x8f, 0x32, 0xe2, 0x8e, 0x34, 0xf4, 0x36, 0xaf, 0x6f, 0xc9, 0xd9,
-	0x93, 0x1c, 0x91, 0x5f, 0x84, 0x51, 0x93, 0x36, 0x1d, 0x5f, 0xdc, 0x6f, 0x66, 0xd5, 0xfb, 0x18,
-	0x16, 0x44, 0x72, 0x93, 0xc7, 0x7e, 0xaa, 0xe7, 0x1b, 0x96, 0x33, 0x41, 0xb6, 0xea, 0xdf, 0x6c,
-	0xd1, 0xc7, 0x0e, 0x5f, 0x8c, 0xe2, 0xa8, 0xc5, 0xe3, 0xcd, 0xf1, 0xad, 0x1d, 0x56, 0x22, 0x24,
-	0x6a, 0x75, 0xe1, 0x69, 0x34, 0xc6, 0x07, 0x00, 0x51, 0x95, 0xe4, 0x0e, 0x14, 0xc5, 0x6c, 0x70,
-	0x3a, 0xbb, 0x5c, 0x90, 0x12, 0x7d, 0x50, 0x3a, 0x3a, 0x2c, 0x3d, 0xdb, 0x08, 0xcb, 0x84, 0xd4,
-	0xa9, 0xf0, 0x4d, 0x10, 0x1a, 0xff, 0x7b, 0x0e, 0xb2, 0x65, 0x1c, 0x90, 0x3b, 0xf4, 0x20, 0xb0,
-	0xb7, 0x6f, 0x3a, 0x2d, 0x6d, 0x31, 0xed, 0x23, 0xd4, 0xda, 0x71, 0x34, 0x75, 0x85, 0x82, 0xcc,
-	0x16, 0xd3, 0x1d, 0x6f, 0xfb, 0x0d, 0x24, 0x54, 0x16, 0xd3, 0xbe, 0xb7, 0xfd, 0x46, 0x9c, 0x2c,
-	0x44, 0x24, 0x06, 0x8c, 0xf1, 0x85, 0x25, 0xe6, 0x20, 0x1c, 0x1d, 0x96, 0xc6, 0xf8, 0xfa, 0x33,
-	0x45, 0x09, 0x39, 0x0b, 0xb9, 0x7a, 0x6d, 0x43, 0xec, 0x80, 0xa8, 0x16, 0xf4, 0xbb, 0x1d, 0x93,
-	0xc1, 0x58, 0x9d, 0xeb, 0x95, 0x72, 0x0d, 0x15, 0x01, 0xa3, 0x51, 0x9d, 0xad, 0xa6, 0xdd, 0x8d,
-	0xab, 0x02, 0x42, 0x44, 0xf2, 0x0e, 0x4c, 0xde, 0xa9, 0xac, 0xac, 0xb9, 0x3e, 0xdf, 0xbd, 0xc6,
-	0xa2, 0xc9, 0xbf, 0xdf, 0x6c, 0x58, 0xa8, 0xf9, 0x8f, 0x1f, 0x03, 0x0a, 0x3e, 0xb1, 0xe0, 0x34,
-	0x63, 0xc5, 0x86, 0xc4, 0x69, 0x50, 0x71, 0x29, 0xdd, 0x88, 0xde, 0x19, 0x5e, 0x39, 0x3a, 0x2c,
-	0xbd, 0x88, 0x5f, 0xe0, 0x73, 0x14, 0x4b, 0x5e, 0x67, 0x63, 0x5c, 0xfb, 0xb0, 0x21, 0x5f, 0x81,
-	0x53, 0xc9, 0x92, 0x7a, 0xf8, 0x3e, 0x71, 0xe1, 0xe8, 0xb0, 0x64, 0xa4, 0xf2, 0xf7, 0xb5, 0xf9,
-	0x9b, 0xce, 0xc4, 0xf8, 0x66, 0x16, 0x26, 0x15, 0x35, 0x1f, 0xf9, 0xac, 0x78, 0x96, 0xce, 0x68,
-	0x17, 0x18, 0x05, 0x83, 0x95, 0x72, 0x9d, 0x50, 0xdb, 0x6d, 0x52, 0xf1, 0x48, 0x1d, 0xe9, 0x5f,
-	0xb2, 0xc3, 0xe8, 0x5f, 0xde, 0x04, 0xe0, 0x53, 0x18, 0xfb, 0x49, 0x91, 0x86, 0x14, 0xeb, 0x14,
-	0x75, 0x5a, 0x45, 0xc8, 0xe4, 0x3e, 0xcc, 0x6d, 0x7a, 0x3d, 0x3f, 0xa8, 0x1f, 0xf8, 0x01, 0x6d,
-	0x33, 0x6e, 0x35, 0xd7, 0x6d, 0x89, 0xe5, 0xf3, 0xd2, 0xd1, 0x61, 0xe9, 0x3c, 0x9a, 0xd4, 0x58,
-	0x3e, 0x96, 0xe3, 0x07, 0x58, 0x5d, 0xd7, 0x55, 0xb5, 0x32, 0x69, 0x0c, 0x0c, 0x13, 0x0a, 0xaa,
-	0x4e, 0x87, 0x1d, 0x8c, 0xe2, 0x09, 0x4f, 0x68, 0xea, 0x95, 0x83, 0x51, 0x7c, 0x65, 0xf2, 0x49,
-	0x51, 0x27, 0x31, 0x3e, 0xab, 0xea, 0x13, 0x87, 0xdd, 0x97, 0x8c, 0xbf, 0x94, 0x89, 0x76, 0xc1,
-	0xfb, 0xd7, 0xc8, 0x5b, 0x30, 0xc6, 0x9f, 0x4c, 0xc5, 0xcb, 0xf2, 0xa9, 0xf0, 0x4e, 0xae, 0xbe,
-	0xa7, 0x72, 0x45, 0xfe, 0xef, 0x72, 0xb3, 0x8a, 0x67, 0x4c, 0x41, 0x12, 0xbe, 0x01, 0xe8, 0xea,
-	0x40, 0xc9, 0x1d, 0xb5, 0xdd, 0xd7, 0xd2, 0xde, 0x00, 0x8c, 0x7f, 0x31, 0x0a, 0xd3, 0x3a, 0x9a,
-	0xfa, 0xae, 0x9a, 0x19, 0xea, 0x5d, 0xf5, 0x8b, 0x90, 0x17, 0xf3, 0x4d, 0x0a, 0x94, 0x2f, 0xe1,
-	0xcb, 0x88, 0x80, 0x69, 0xf6, 0x02, 0xc0, 0x87, 0x83, 0x5d, 0xd1, 0xcd, 0x90, 0x8a, 0x2c, 0x29,
-	0xaf, 0x76, 0xb9, 0x48, 0xc6, 0x92, 0xaf, 0x76, 0xea, 0x72, 0x0e, 0xdf, 0xef, 0x2e, 0xc3, 0x18,
-	0xbb, 0x9e, 0x84, 0x1a, 0x24, 0xfc, 0x4a, 0x76, 0x73, 0x89, 0x19, 0x06, 0x71, 0x24, 0xf2, 0x00,
-	0xf2, 0xeb, 0xb6, 0x1f, 0xd4, 0x29, 0xed, 0x0c, 0x61, 0x31, 0x51, 0x12, 0x5d, 0x35, 0x87, 0xe6,
-	0x08, 0x3e, 0xa5, 0x9d, 0xd8, 0x93, 0x77, 0xc8, 0x8c, 0x7c, 0x08, 0xb0, 0xe2, 0x76, 0x02, 0xcf,
-	0x6d, 0xad, 0xbb, 0xbb, 0x0b, 0x63, 0x78, 0x75, 0x7f, 0x3e, 0x36, 0x00, 0x11, 0x02, 0xbf, 0xbd,
-	0x87, 0xfa, 0xa9, 0x06, 0x2f, 0xb0, 0x5a, 0xee, 0xae, 0xba, 0x0e, 0x22, 0x7c, 0x72, 0x13, 0x8a,
-	0x52, 0x2f, 0xb2, 0xd5, 0xdd, 0xf5, 0x70, 0x82, 0x8c, 0x47, 0x82, 0x13, 0x7d, 0x1c, 0x58, 0x3d,
-	0x01, 0x57, 0x37, 0xfa, 0x38, 0x0d, 0xf9, 0x0a, 0x9c, 0x89, 0xc3, 0xe4, 0x28, 0xe7, 0xa3, 0x2b,
-	0x85, 0xca, 0x2e, 0x65, 0xde, 0xf7, 0x63, 0x41, 0x6e, 0xc1, 0x0c, 0xeb, 0x90, 0xbb, 0xd4, 0xf6,
-	0x7b, 0xdc, 0xac, 0x4d, 0x68, 0x96, 0xe4, 0x83, 0xb0, 0x58, 0x85, 0x2d, 0xb7, 0xb1, 0xaf, 0x20,
-	0x99, 0x71, 0x2a, 0x72, 0x03, 0x26, 0xb9, 0x9d, 0x82, 0x57, 0xed, 0xec, 0xb8, 0xe2, 0xd9, 0x40,
-	0x6a, 0xd3, 0x45, 0xc9, 0xfd, 0x25, 0x56, 0x66, 0xaa, 0x88, 0xc6, 0x61, 0x16, 0x4e, 0xa7, 0xd7,
-	0x41, 0xfe, 0x22, 0x9c, 0x12, 0xfd, 0xd9, 0xa2, 0x9e, 0x82, 0x33, 0x84, 0x05, 0xc7, 0x65, 0x31,
-	0x4e, 0x2f, 0x34, 0x42, 0x06, 0xe1, 0x86, 0xc3, 0x58, 0xc4, 0x26, 0x45, 0x7a, 0x3d, 0xe4, 0x6b,
-	0x30, 0xa9, 0x56, 0x9b, 0x1d, 0xde, 0x18, 0x66, 0x40, 0x5d, 0x2a, 0x4b, 0x62, 0xc3, 0x8c, 0x49,
-	0xbf, 0xde, 0xa3, 0x7e, 0x20, 0xcd, 0x71, 0x84, 0xc4, 0x72, 0x36, 0x51, 0x8b, 0x44, 0x08, 0xd5,
-	0x5e, 0x45, 0x8f, 0x53, 0x5a, 0xd2, 0x68, 0xf2, 0x5b, 0x8c, 0x7d, 0x9c, 0x9f, 0xf1, 0xdd, 0x2c,
-	0x9c, 0xe9, 0x33, 0x9d, 0xd9, 0x8e, 0x87, 0xf2, 0xa4, 0xb2, 0xe3, 0xc5, 0xc4, 0x48, 0x6e, 0xcb,
-	0x77, 0x1e, 0xb2, 0x42, 0x02, 0x1b, 0x59, 0x2e, 0x1e, 0x1d, 0x96, 0x0a, 0xda, 0x4a, 0xcd, 0x56,
-	0x2b, 0xe4, 0x36, 0x8c, 0xb0, 0x6e, 0x18, 0xc2, 0x24, 0x45, 0x2a, 0x3d, 0xa7, 0x03, 0x47, 0xdd,
-	0x20, 0xb0, 0x6f, 0x90, 0x07, 0xf9, 0x2c, 0xe4, 0x36, 0x37, 0xd7, 0x71, 0x77, 0xc8, 0xe1, 0xec,
-	0x9e, 0x0a, 0x82, 0x96, 0xb6, 0x19, 0x4d, 0x31, 0xda, 0xb0, 0x47, 0x4c, 0x86, 0x4e, 0xbe, 0x14,
-	0x33, 0x95, 0x7b, 0x75, 0xf0, 0x52, 0x1e, 0xde, 0x72, 0xee, 0x13, 0x18, 0xac, 0x19, 0x3f, 0x91,
-	0x91, 0x56, 0x41, 0x62, 0xf2, 0x93, 0xf3, 0x72, 0x9d, 0xe0, 0xc5, 0x5c, 0x70, 0x51, 0x41, 0xe4,
-	0x79, 0x00, 0xfe, 0x73, 0x6b, 0x4b, 0x74, 0x7a, 0xc1, 0x54, 0x20, 0xe4, 0x0b, 0x21, 0x4b, 0xa1,
-	0xca, 0xcc, 0xa1, 0x24, 0x10, 0x5b, 0x6b, 0xbc, 0xcc, 0xd4, 0x51, 0x8d, 0xdf, 0xc8, 0x46, 0xa7,
-	0xc6, 0x4d, 0xa7, 0x15, 0x50, 0x8f, 0x2c, 0xf2, 0x43, 0x20, 0xba, 0xcd, 0x98, 0xe1, 0x6f, 0xb2,
-	0x10, 0x9d, 0x28, 0xbc, 0x69, 0xe1, 0xd1, 0xf1, 0xaa, 0x72, 0x74, 0xe4, 0xf0, 0xe8, 0x98, 0xee,
-	0x7b, 0x48, 0xbc, 0x9a, 0xb2, 0x13, 0xe2, 0xd6, 0x9f, 0xb2, 0xdb, 0xbd, 0x04, 0x53, 0x1b, 0xee,
-	0xea, 0xe3, 0x20, 0x44, 0x64, 0x5b, 0x7e, 0xde, 0xd4, 0x81, 0x8c, 0xe3, 0xbd, 0x56, 0x93, 0x7a,
-	0x9b, 0x7b, 0x76, 0x47, 0x33, 0x2e, 0x31, 0x13, 0x70, 0x86, 0xbb, 0x41, 0x1f, 0xe9, 0xb8, 0xe3,
-	0x1c, 0x37, 0x0e, 0x8f, 0x0f, 0x4e, 0x3e, 0x31, 0x38, 0xc6, 0x0f, 0x65, 0x65, 0x77, 0xdd, 0x5f,
-	0x7a, 0x4a, 0xcd, 0x0e, 0xde, 0xd0, 0xcc, 0x0e, 0xe6, 0xc2, 0x07, 0x93, 0xd0, 0x66, 0x67, 0x29,
-	0x4d, 0xe0, 0x50, 0x6c, 0x06, 0xfe, 0xce, 0x18, 0x14, 0x54, 0x74, 0xd6, 0x0f, 0xe5, 0x66, 0xd3,
-	0x53, 0xfb, 0xc1, 0x6e, 0x36, 0x3d, 0x13, 0xa1, 0x9a, 0x65, 0x4f, 0x6e, 0xa0, 0x65, 0xcf, 0x57,
-	0x61, 0x62, 0xa5, 0xdd, 0xd4, 0xde, 0xff, 0x8d, 0x94, 0xcf, 0xbb, 0x12, 0x22, 0xf1, 0xd5, 0x1b,
-	0xbe, 0x03, 0x34, 0xda, 0xcd, 0xe4, 0xab, 0x7f, 0xc4, 0x52, 0x33, 0x0a, 0x1a, 0xfd, 0x24, 0x46,
-	0x41, 0x37, 0x60, 0x62, 0xcb, 0xa7, 0x9b, 0xbd, 0x4e, 0x87, 0xb6, 0x70, 0xe2, 0xe5, 0xf9, 0xf5,
-	0xb9, 0xe7, 0x53, 0x2b, 0x40, 0xa8, 0xfa, 0x01, 0x21, 0xaa, 0x3a, 0xc0, 0xe3, 0x03, 0x06, 0xf8,
-	0x3a, 0xe4, 0x6b, 0x94, 0x7a, 0xd8, 0xa7, 0x93, 0xd1, 0x2d, 0xa9, 0x4b, 0xa9, 0x67, 0xb1, 0x8e,
-	0xd5, 0x8c, 0x85, 0x04, 0xa2, 0x66, 0x61, 0x54, 0x18, 0xd2, 0xc2, 0x88, 0xbc, 0x00, 0x85, 0x6e,
-	0x6f, 0xbb, 0xe5, 0x34, 0x90, 0xaf, 0x30, 0x4d, 0x32, 0x27, 0x39, 0x8c, 0xb1, 0xf5, 0xc9, 0x97,
-	0x60, 0x0a, 0xd5, 0x06, 0xe1, 0x94, 0x9b, 0xd6, 0x8e, 0x76, 0xad, 0x8c, 0x4b, 0xdf, 0x0d, 0x06,
-	0xb2, 0x52, 0x0c, 0xf1, 0x74, 0x46, 0xe4, 0x36, 0x8c, 0xef, 0x3a, 0x81, 0xb5, 0xd7, 0xdb, 0x5e,
-	0x98, 0xd1, 0xac, 0xd8, 0x6e, 0x39, 0xc1, 0x5a, 0x6f, 0x9b, 0x0f, 0x79, 0xc8, 0x1a, 0xf7, 0xe8,
-	0x5d, 0x27, 0xd8, 0xeb, 0xa9, 0xaf, 0x1c, 0x63, 0xbb, 0x88, 0xbb, 0x58, 0x87, 0x69, 0x7d, 0x56,
-	0x3c, 0x81, 0xb7, 0xf7, 0xd0, 0xf2, 0x2a, 0x5f, 0x9c, 0xb8, 0x3d, 0x92, 0x87, 0xe2, 0x24, 0xb7,
-	0xb9, 0x32, 0xa1, 0x16, 0xf6, 0x8f, 0x49, 0xee, 0xf4, 0xb6, 0xa9, 0xd7, 0xa1, 0x01, 0xf5, 0xc5,
-	0x1d, 0xdd, 0x37, 0x47, 0xca, 0xdd, 0xae, 0x6f, 0xfc, 0xe3, 0x2c, 0x8c, 0x97, 0x1f, 0xd4, 0x71,
-	0xd7, 0x7f, 0x5d, 0x7d, 0x38, 0x55, 0x5f, 0xd0, 0xc3, 0x87, 0x53, 0xf5, 0xb9, 0xf4, 0x6a, 0x8a,
-	0x96, 0x05, 0x7d, 0x03, 0x14, 0x2d, 0x8b, 0xa6, 0x1f, 0x8a, 0xde, 0x90, 0x73, 0x43, 0xbc, 0x21,
-	0x87, 0x6a, 0xfe, 0x91, 0xe3, 0xd5, 0xfc, 0x6f, 0xc1, 0x64, 0xb5, 0x13, 0xd0, 0x5d, 0x2f, 0x5a,
-	0x35, 0xa1, 0xc6, 0x27, 0x04, 0xab, 0x37, 0x6f, 0x05, 0x9b, 0x4d, 0x49, 0xfe, 0xb4, 0x10, 0x3e,
-	0x29, 0xe0, 0x94, 0xe4, 0x2f, 0x10, 0x31, 0x75, 0x9d, 0x44, 0x34, 0x2a, 0xb1, 0xf9, 0x26, 0xed,
-	0x74, 0xb8, 0xd0, 0x37, 0x1d, 0xbd, 0xad, 0xb1, 0x8e, 0x5d, 0x9e, 0x4d, 0xb7, 0xd3, 0x31, 0xfe,
-	0x6a, 0x06, 0xe6, 0xd3, 0xa6, 0x11, 0x79, 0x17, 0x0a, 0xae, 0xb7, 0x6b, 0x77, 0x9c, 0xef, 0xe7,
-	0x2d, 0x52, 0x74, 0xca, 0x2a, 0x5c, 0xd5, 0xa4, 0xa9, 0x70, 0xd6, 0x21, 0x4a, 0xcb, 0x75, 0x15,
-	0x58, 0x6a, 0x87, 0x28, 0x60, 0xe3, 0x47, 0xb3, 0x30, 0x59, 0xee, 0x76, 0x9f, 0x72, 0xd3, 0xd3,
-	0xcf, 0x6b, 0x07, 0x88, 0xd4, 0x40, 0x84, 0xed, 0xea, 0x6f, 0xb8, 0xa6, 0x9c, 0x21, 0xbf, 0x9c,
-	0x85, 0x99, 0x18, 0x85, 0xfa, 0xf5, 0x99, 0x21, 0x2d, 0x45, 0xb3, 0x43, 0x5a, 0x8a, 0xe6, 0x86,
-	0xb3, 0x14, 0x1d, 0xf9, 0x24, 0x87, 0xc2, 0x2b, 0x90, 0x2b, 0x77, 0xbb, 0x71, 0x0b, 0x90, 0x6e,
-	0xf7, 0xfe, 0x75, 0xae, 0x04, 0xb3, 0xbb, 0x5d, 0x93, 0x61, 0x68, 0x3b, 0xf5, 0xd8, 0x90, 0x3b,
-	0xb5, 0x71, 0x19, 0x26, 0x90, 0x17, 0xda, 0x4b, 0x9e, 0x07, 0xdc, 0x62, 0x84, 0xa9, 0xa4, 0x56,
-	0x97, 0xd8, 0x7c, 0xfe, 0x38, 0x03, 0xa3, 0xf8, 0xfb, 0x29, 0x9d, 0x63, 0x4b, 0xda, 0x1c, 0x2b,
-	0x2a, 0x73, 0x6c, 0x98, 0xd9, 0xf5, 0xf7, 0x73, 0x00, 0x2b, 0xf7, 0xcc, 0x3a, 0xd7, 0x95, 0x92,
-	0x9b, 0x30, 0x63, 0xb7, 0x5a, 0xee, 0x23, 0xda, 0xb4, 0x5c, 0xcf, 0xd9, 0x75, 0x3a, 0xbc, 0xe7,
-	0xa4, 0x59, 0x82, 0x5e, 0xa4, 0x3e, 0x56, 0x8a, 0xa2, 0x7b, 0xbc, 0x44, 0xe5, 0xd3, 0xa6, 0xc1,
-	0x9e, 0xdb, 0x94, 0x6a, 0x13, 0x8d, 0x8f, 0x28, 0x4a, 0xe1, 0x73, 0x97, 0x97, 0xa8, 0x7c, 0xf6,
-	0x50, 0x0d, 0x24, 0x65, 0x68, 0x8d, 0x8f, 0x28, 0x4a, 0xe1, 0xc3, 0x75, 0x47, 0x3e, 0x59, 0x87,
-	0x59, 0x84, 0x58, 0x0d, 0x8f, 0x36, 0x69, 0x27, 0x70, 0xec, 0x96, 0x2f, 0x14, 0x6d, 0xa8, 0x51,
-	0x4e, 0x14, 0xaa, 0x8a, 0x06, 0x2c, 0x5c, 0x89, 0xca, 0xc8, 0x15, 0x18, 0x6f, 0xdb, 0x8f, 0x2d,
-	0x7b, 0x97, 0x1b, 0xe8, 0x4c, 0x71, 0xc5, 0x8c, 0x00, 0xa9, 0xc7, 0x48, 0xdb, 0x7e, 0x5c, 0xde,
-	0xa5, 0xac, 0x15, 0xf4, 0x71, 0xd7, 0xf5, 0x95, 0x56, 0x8c, 0x45, 0xad, 0x88, 0x15, 0xa9, 0xad,
-	0x10, 0x45, 0xa2, 0x15, 0xc6, 0x2f, 0x65, 0xe0, 0xd9, 0x2a, 0x7e, 0x45, 0x70, 0xb0, 0x42, 0x3b,
-	0x01, 0xf5, 0x6a, 0xd4, 0x6b, 0x3b, 0x68, 0xae, 0x50, 0xa7, 0x01, 0x79, 0x11, 0x72, 0x65, 0x73,
-	0x43, 0xcc, 0x5f, 0xbe, 0xdf, 0x6b, 0xc6, 0x23, 0xac, 0x34, 0xd4, 0xdd, 0x65, 0x8f, 0x79, 0x53,
-	0x28, 0x43, 0xa1, 0xec, 0xfb, 0xce, 0x6e, 0xa7, 0xcd, 0xfd, 0x75, 0x72, 0x9a, 0x79, 0x8a, 0x80,
-	0x27, 0x1e, 0xc3, 0x54, 0x12, 0xe3, 0x3f, 0xcf, 0xc0, 0x6c, 0xb9, 0xdb, 0xd5, 0x3f, 0x59, 0x37,
-	0x8d, 0xca, 0x0c, 0x6f, 0x1a, 0xe5, 0xc0, 0xb4, 0xd6, 0x5c, 0x3e, 0xa5, 0x22, 0xc1, 0x77, 0x40,
-	0xcf, 0xf0, 0xcf, 0xee, 0x86, 0x20, 0xcb, 0xd7, 0xdf, 0xf5, 0x63, 0x8c, 0x8d, 0x7f, 0x37, 0x8e,
-	0x7b, 0x88, 0xd8, 0x6d, 0x85, 0xf1, 0x6e, 0x26, 0xc5, 0x78, 0xf7, 0x4d, 0x50, 0x24, 0x1c, 0xf5,
-	0x88, 0x53, 0x64, 0x45, 0x55, 0xeb, 0x15, 0x21, 0x93, 0xfd, 0xb8, 0x19, 0x6f, 0x0e, 0x5b, 0xf3,
-	0x62, 0x7c, 0x01, 0x3f, 0x11, 0x0b, 0xde, 0x35, 0x20, 0xd5, 0x0e, 0xda, 0x1a, 0xd0, 0xfa, 0xbe,
-	0xd3, 0xbd, 0x4f, 0x3d, 0x67, 0xe7, 0x40, 0x2c, 0x00, 0xec, 0x7c, 0x47, 0x94, 0x5a, 0xfe, 0xbe,
-	0xd3, 0xb5, 0x1e, 0x62, 0xb9, 0x99, 0x42, 0x43, 0xde, 0x83, 0x71, 0x93, 0x3e, 0xf2, 0x9c, 0x40,
-	0x1a, 0xa7, 0x4d, 0x87, 0x4a, 0x5c, 0x84, 0xf2, 0xb5, 0xe0, 0xf1, 0x1f, 0xea, 0xae, 0x28, 0xca,
-	0xc9, 0x12, 0x17, 0x52, 0xb8, 0x11, 0xda, 0x54, 0xd4, 0xda, 0xf2, 0x83, 0x7a, 0x3f, 0x19, 0x85,
-	0x5c, 0x82, 0x51, 0x94, 0x74, 0xc4, 0x5d, 0x00, 0x7d, 0xd1, 0x50, 0x76, 0x56, 0xc5, 0x30, 0xc4,
-	0x40, 0x9d, 0x80, 0x7c, 0xcc, 0xf7, 0x17, 0xf2, 0x28, 0xa5, 0x2b, 0x90, 0xb8, 0x98, 0x36, 0x71,
-	0x22, 0x31, 0x6d, 0x1d, 0x8a, 0x26, 0x77, 0x6b, 0x6d, 0x96, 0xbb, 0xf8, 0x62, 0xec, 0x2f, 0x00,
-	0xae, 0xe4, 0xf3, 0x47, 0x87, 0xa5, 0xe7, 0x84, 0xcb, 0x6b, 0xd3, 0xb2, 0xbb, 0xfc, 0xa1, 0x59,
-	0xdb, 0x46, 0xe2, 0x94, 0xe4, 0x4d, 0x18, 0x61, 0x5b, 0xaf, 0x30, 0xf8, 0x95, 0x2f, 0x6f, 0xd1,
-	0x6e, 0xcc, 0x17, 0x67, 0xc3, 0xd5, 0xf6, 0x04, 0x24, 0x21, 0x16, 0x4c, 0xeb, 0xd3, 0x5d, 0xd8,
-	0x7e, 0x2d, 0x44, 0xfd, 0xa9, 0x97, 0x8b, 0xe7, 0x38, 0x01, 0xb3, 0x1a, 0x08, 0x54, 0x57, 0x40,
-	0x6c, 0x91, 0xae, 0x42, 0x7e, 0x73, 0xa5, 0x56, 0x73, 0xbd, 0x80, 0x5f, 0x75, 0xa2, 0x93, 0x85,
-	0xc1, 0x4c, 0xbb, 0xb3, 0x4b, 0xf9, 0x59, 0x1c, 0x34, 0xba, 0x56, 0x97, 0xa1, 0xa9, 0x67, 0xb1,
-	0x24, 0x25, 0x1f, 0xc2, 0xa9, 0x2d, 0x9f, 0x96, 0x3b, 0x07, 0x78, 0x3a, 0x2b, 0x4b, 0x65, 0x1a,
-	0xa7, 0x1e, 0x3e, 0x28, 0xb1, 0xab, 0xa0, 0xdd, 0x39, 0xb0, 0xf8, 0xa9, 0x9e, 0xbe, 0x70, 0xd2,
-	0xb9, 0x7c, 0x7a, 0xb6, 0xc4, 0xff, 0x24, 0x03, 0xca, 0x84, 0xcd, 0x9b, 0xb4, 0xe9, 0x78, 0xb4,
-	0x11, 0x88, 0xc3, 0x50, 0x78, 0x6e, 0x72, 0x58, 0xcc, 0x66, 0x14, 0x61, 0xe4, 0x5d, 0x18, 0x17,
-	0x9b, 0xb6, 0xd8, 0xa4, 0xe4, 0x44, 0x17, 0x4f, 0x1c, 0xdc, 0xc5, 0x37, 0xb1, 0xe1, 0x4b, 0x22,
-	0xb6, 0x47, 0xde, 0x7e, 0xb0, 0xb9, 0xd2, 0xb2, 0x9d, 0xb6, 0x2f, 0x76, 0x5e, 0x5c, 0xa6, 0x1f,
-	0x3d, 0x0a, 0xac, 0x06, 0x42, 0xd5, 0x3d, 0x32, 0x44, 0x35, 0x6e, 0xc9, 0x17, 0x96, 0x63, 0x0c,
-	0x9f, 0x4b, 0x30, 0x7a, 0x3f, 0xd2, 0xc3, 0x2d, 0x4f, 0x1c, 0x1d, 0x96, 0x78, 0xeb, 0x4d, 0x0e,
-	0x37, 0x28, 0x4c, 0x84, 0x03, 0xcd, 0x78, 0xb1, 0x1f, 0xc8, 0x6b, 0x8a, 0xf3, 0x62, 0x43, 0x6e,
-	0x22, 0x94, 0x09, 0x46, 0xab, 0x9d, 0x26, 0x22, 0x64, 0x11, 0x01, 0xbb, 0x87, 0x76, 0x9a, 0x38,
-	0x2f, 0xd4, 0xd6, 0x09, 0x34, 0x45, 0xfc, 0xf8, 0xf1, 0x0c, 0x4c, 0xeb, 0xa3, 0x40, 0xae, 0xc0,
-	0x98, 0x70, 0xce, 0xcc, 0xa0, 0x5a, 0x93, 0x71, 0x1b, 0xe3, 0x6e, 0x99, 0x9a, 0x33, 0xa6, 0xc0,
-	0x62, 0x52, 0x96, 0xe0, 0x20, 0x44, 0x0c, 0x94, 0xb2, 0x1a, 0x1c, 0x64, 0xca, 0x32, 0x62, 0xb0,
-	0x8b, 0x9f, 0xdf, 0x6b, 0x05, 0xea, 0x73, 0xac, 0x87, 0x10, 0x53, 0x94, 0x18, 0xdf, 0xce, 0xc0,
-	0x18, 0xdf, 0x89, 0x62, 0x86, 0x9d, 0x99, 0x93, 0x18, 0x76, 0x7e, 0x03, 0xe6, 0x4d, 0xb7, 0x45,
-	0xfd, 0x72, 0xe7, 0xe0, 0xd1, 0x1e, 0xf5, 0x68, 0xcd, 0x73, 0x77, 0xe4, 0xcb, 0xf1, 0xe4, 0xd2,
-	0x0b, 0xda, 0x8e, 0x97, 0x86, 0xc8, 0x9f, 0xfe, 0x3c, 0x56, 0xc2, 0xd6, 0x05, 0x16, 0xb1, 0xc5,
-	0x11, 0x7b, 0x69, 0x4e, 0xad, 0xc4, 0xf8, 0x07, 0x19, 0x58, 0xec, 0xcf, 0x1a, 0xcf, 0x2b, 0xfe,
-	0x67, 0x24, 0x28, 0xf0, 0xf3, 0x8a, 0x43, 0x63, 0xd6, 0xa6, 0x0a, 0x32, 0x31, 0xe1, 0x54, 0xb9,
-	0xd1, 0xa0, 0xdd, 0x80, 0x31, 0x16, 0x36, 0x92, 0xa1, 0x20, 0x91, 0xe7, 0xfa, 0x0c, 0x1b, 0x11,
-	0xb8, 0xdd, 0xaa, 0xb4, 0xdc, 0xc4, 0x59, 0x97, 0x4e, 0x6a, 0x1c, 0x66, 0x00, 0xea, 0xf5, 0xb5,
-	0x3b, 0xf4, 0xa0, 0x66, 0x3b, 0x28, 0x19, 0xf0, 0xc5, 0x7d, 0x47, 0x2c, 0xdf, 0x82, 0xb0, 0xb5,
-	0xe0, 0x7b, 0xc2, 0x3e, 0x3d, 0xd0, 0x6c, 0x2d, 0x24, 0x2a, 0x6f, 0x95, 0xf3, 0xd0, 0x0e, 0x28,
-	0x23, 0x44, 0x3d, 0xb0, 0x6c, 0x15, 0x42, 0x63, 0x94, 0x0a, 0x32, 0xf9, 0x10, 0xa6, 0xa3, 0x5f,
-	0xa1, 0xc5, 0xc8, 0x74, 0xb8, 0x45, 0xe8, 0x85, 0xcb, 0xcf, 0x1f, 0x1d, 0x96, 0x16, 0x15, 0xae,
-	0x71, 0x5b, 0x92, 0x18, 0x33, 0xe3, 0x17, 0x33, 0x68, 0x27, 0x25, 0x1b, 0x78, 0x01, 0x46, 0x42,
-	0xcb, 0xfe, 0x82, 0xd8, 0xde, 0xf5, 0x67, 0x65, 0x2c, 0x67, 0x82, 0x5c, 0xd4, 0x12, 0x3c, 0x14,
-	0xf5, 0x16, 0xb0, 0x52, 0x72, 0x0b, 0xc6, 0x87, 0xfa, 0x66, 0x5c, 0x8e, 0x29, 0xdf, 0x2a, 0xa9,
-	0x71, 0x14, 0x6e, 0x3f, 0xd8, 0xfc, 0xde, 0x1d, 0x85, 0x9f, 0xca, 0xc2, 0x0c, 0xeb, 0xd7, 0x72,
-	0x2f, 0xd8, 0x73, 0x3d, 0x27, 0x38, 0x78, 0x6a, 0x35, 0xd2, 0x6f, 0x6b, 0x97, 0xbd, 0x45, 0x79,
-	0x8e, 0xa9, 0x6d, 0x1b, 0x4a, 0x31, 0xfd, 0xdf, 0x8e, 0xc2, 0x5c, 0x0a, 0x15, 0x79, 0x5d, 0x7b,
-	0xe6, 0x5a, 0x90, 0x81, 0x2a, 0xbe, 0x7b, 0x58, 0x2a, 0x48, 0xf4, 0xcd, 0x28, 0x70, 0xc5, 0x92,
-	0x6e, 0x74, 0xc8, 0x7b, 0x0a, 0x5f, 0xbd, 0x54, 0xa3, 0x43, 0xdd, 0xd4, 0xf0, 0x12, 0x8c, 0xe2,
-	0xce, 0x24, 0x0c, 0x6d, 0x51, 0x94, 0xc3, 0xbd, 0x4e, 0x33, 0x2c, 0x62, 0x00, 0xb2, 0x06, 0xe3,
-	0xec, 0x8f, 0xbb, 0x76, 0x57, 0xbc, 0x39, 0x93, 0x50, 0xdd, 0x80, 0xd0, 0xae, 0xd3, 0xd9, 0x55,
-	0x35, 0x0e, 0x2d, 0x6a, 0xb5, 0xed, 0xae, 0x26, 0x73, 0x72, 0x44, 0x4d, 0x73, 0x91, 0xef, 0xaf,
-	0xb9, 0xc8, 0x1c, 0xab, 0xb9, 0xd8, 0x01, 0xa8, 0x3b, 0xbb, 0x1d, 0xa7, 0xb3, 0x5b, 0x6e, 0xed,
-	0x8a, 0x70, 0x1f, 0x97, 0xfa, 0x8f, 0xc2, 0x95, 0x08, 0x19, 0x27, 0xee, 0xb3, 0x68, 0x18, 0xc2,
-	0x61, 0x96, 0xdd, 0xda, 0xd5, 0xfc, 0xfb, 0x14, 0xce, 0x64, 0x03, 0xa0, 0xdc, 0x08, 0x9c, 0x87,
-	0x6c, 0x0a, 0xfb, 0x42, 0x40, 0x94, 0x9f, 0xbc, 0x52, 0xbe, 0x43, 0x0f, 0xf0, 0x52, 0x23, 0x9f,
-	0xd8, 0x6d, 0x44, 0x65, 0x2b, 0x41, 0x73, 0xde, 0x8a, 0x38, 0x90, 0x2e, 0x9c, 0x2a, 0x37, 0x9b,
-	0x0e, 0x6b, 0x83, 0xdd, 0xda, 0xe4, 0x81, 0x5a, 0x90, 0x75, 0x21, 0x9d, 0xf5, 0x25, 0xf9, 0x2a,
-	0x6c, 0x87, 0x54, 0x96, 0x8c, 0xef, 0x12, 0xab, 0x26, 0x9d, 0xb1, 0x51, 0x87, 0x69, 0xbd, 0xf1,
-	0x7a, 0x98, 0x92, 0x02, 0xe4, 0xcd, 0x7a, 0xd9, 0xaa, 0xaf, 0x95, 0xaf, 0x15, 0x33, 0xa4, 0x08,
-	0x05, 0xf1, 0x6b, 0xc9, 0x5a, 0x7a, 0xe3, 0x46, 0x31, 0xab, 0x41, 0xde, 0xb8, 0xb6, 0x54, 0xcc,
-	0x2d, 0x66, 0x17, 0x32, 0x31, 0xd7, 0xde, 0xf1, 0x62, 0x9e, 0x2b, 0x9b, 0x8d, 0x5f, 0xc9, 0x40,
-	0x5e, 0x7e, 0x3b, 0xb9, 0x01, 0xb9, 0x7a, 0x7d, 0x2d, 0xe6, 0x1c, 0x1b, 0x9d, 0x32, 0x7c, 0x3f,
-	0xf5, 0x7d, 0xd5, 0x03, 0x82, 0x11, 0x30, 0xba, 0xcd, 0xf5, 0xba, 0x90, 0xd7, 0x24, 0x5d, 0xb4,
-	0x79, 0x73, 0xba, 0x14, 0x8f, 0xc1, 0x1b, 0x90, 0xbb, 0xfd, 0x60, 0x53, 0x5c, 0xdf, 0x24, 0x5d,
-	0xb4, 0x9f, 0x72, 0xba, 0x8f, 0x1e, 0xa9, 0xbb, 0x3c, 0x23, 0x30, 0x4c, 0x98, 0x54, 0x26, 0x32,
-	0x17, 0x50, 0xda, 0x6e, 0x18, 0x9b, 0x43, 0x08, 0x28, 0x0c, 0x62, 0x8a, 0x12, 0x26, 0xb6, 0xad,
-	0xbb, 0x0d, 0xbb, 0x25, 0x24, 0x1d, 0x14, 0xdb, 0x5a, 0x0c, 0x60, 0x72, 0xb8, 0xf1, 0x9b, 0x19,
-	0x28, 0xd6, 0x3c, 0x97, 0xc7, 0x0f, 0xd9, 0x74, 0xf7, 0x69, 0xe7, 0xfe, 0x35, 0x72, 0x59, 0x2e,
-	0xb9, 0x4c, 0xa8, 0x42, 0x1b, 0xc5, 0x25, 0x17, 0x7b, 0x87, 0x14, 0xcb, 0x4e, 0x09, 0x7f, 0x92,
-	0x1d, 0x3e, 0x6c, 0xc2, 0x31, 0xe1, 0x4f, 0x4a, 0x30, 0x8a, 0x9f, 0x23, 0x36, 0x47, 0xfc, 0xf2,
-	0x80, 0x01, 0x4c, 0x0e, 0x57, 0xf6, 0xa6, 0xc3, 0x6c, 0xa2, 0x0d, 0x4b, 0xdf, 0x53, 0xa1, 0x07,
-	0xf4, 0xc6, 0xf5, 0xdf, 0xaf, 0xc9, 0x9d, 0x3e, 0xa1, 0x07, 0x62, 0x0c, 0xb8, 0xe7, 0xe0, 0x12,
-	0x7f, 0x9e, 0xe0, 0xfe, 0x37, 0xaa, 0x12, 0x2a, 0xe1, 0xc9, 0xfc, 0x01, 0xcc, 0xc7, 0xfb, 0x17,
-	0x75, 0xa5, 0x65, 0x98, 0xd1, 0xe1, 0x52, 0x6d, 0x7a, 0x26, 0xb5, 0xde, 0xfb, 0x4b, 0x66, 0x1c,
-	0xdf, 0xf8, 0x5f, 0x33, 0x30, 0x81, 0x7f, 0x9a, 0x3d, 0x2e, 0x6d, 0x96, 0x1f, 0xd4, 0x85, 0x06,
-	0x47, 0x95, 0x36, 0xed, 0x47, 0xbe, 0x34, 0xed, 0xd3, 0x36, 0xac, 0x10, 0x59, 0x90, 0xf2, 0x67,
-	0x18, 0xa9, 0x3b, 0x0c, 0x49, 0xf9, 0x7b, 0x8d, 0x1f, 0x23, 0x15, 0xc8, 0x68, 0xcc, 0xce, 0xc5,
-	0x5f, 0xd5, 0xd0, 0x0a, 0xe9, 0xdc, 0x96, 0x6e, 0xcc, 0xce, 0xd1, 0xd0, 0xce, 0xea, 0x41, 0x9d,
-	0x49, 0xc4, 0xaa, 0x9d, 0x15, 0xfb, 0x46, 0x4d, 0x1a, 0x16, 0x48, 0xc6, 0xaf, 0x4f, 0xc5, 0x3b,
-	0x50, 0x9c, 0x9e, 0x27, 0x5c, 0x68, 0x6f, 0xc1, 0x68, 0xb9, 0xd5, 0x72, 0x1f, 0x89, 0x2d, 0x47,
-	0x5e, 0xb0, 0xc3, 0xfe, 0xe3, 0x87, 0x23, 0x6a, 0x1f, 0x35, 0x27, 0x67, 0x06, 0x20, 0x2b, 0x30,
-	0x51, 0x7e, 0x50, 0xaf, 0x56, 0x2b, 0x9b, 0x9b, 0xdc, 0xa1, 0x33, 0xb7, 0xfc, 0xb2, 0xec, 0x1f,
-	0xc7, 0x69, 0x5a, 0x71, 0x43, 0x90, 0xe8, 0xe2, 0x14, 0xd1, 0x91, 0x77, 0x00, 0x6e, 0xbb, 0x4e,
-	0x87, 0x6b, 0x5b, 0x45, 0xe3, 0xcf, 0x1d, 0x1d, 0x96, 0x26, 0x3f, 0x72, 0x9d, 0x8e, 0x50, 0xcf,
-	0xb2, 0x6f, 0x8f, 0x90, 0x4c, 0xe5, 0x6f, 0xd6, 0xd3, 0xcb, 0x2e, 0x37, 0x10, 0x1d, 0x8d, 0x7a,
-	0x7a, 0xdb, 0x4d, 0xa8, 0x05, 0x25, 0x1a, 0x69, 0xc3, 0x4c, 0xbd, 0xb7, 0xbb, 0x4b, 0xd9, 0x31,
-	0x21, 0xd4, 0x5e, 0x63, 0xe2, 0x4a, 0x1e, 0x46, 0xff, 0xe2, 0x17, 0x41, 0x76, 0x0b, 0xf5, 0x97,
-	0x5f, 0x67, 0xab, 0xe2, 0x3b, 0x87, 0x25, 0x61, 0x60, 0xc2, 0xe4, 0x3e, 0x5f, 0xd2, 0x27, 0x95,
-	0x5e, 0x71, 0xde, 0xe4, 0x1e, 0x8c, 0xf1, 0xa7, 0x2d, 0xe1, 0xa0, 0xf8, 0xc2, 0x80, 0x15, 0xc8,
-	0x11, 0xfb, 0x3d, 0x9e, 0xf2, 0x52, 0xf2, 0x00, 0xf2, 0x2b, 0x8e, 0xd7, 0x68, 0xd1, 0x95, 0xaa,
-	0x10, 0x24, 0x5e, 0x1c, 0xc0, 0x52, 0xa2, 0xf2, 0x7e, 0x69, 0xe0, 0xaf, 0x86, 0xa3, 0x0a, 0x16,
-	0x12, 0x83, 0xfc, 0xd5, 0x0c, 0x3c, 0x1b, 0x7e, 0x7d, 0x79, 0x97, 0x76, 0x82, 0xbb, 0x76, 0xd0,
-	0xd8, 0xa3, 0x9e, 0xe8, 0xa5, 0x89, 0x41, 0xbd, 0xf4, 0x85, 0x44, 0x2f, 0x5d, 0x8c, 0x7a, 0xc9,
-	0x66, 0xcc, 0xac, 0x36, 0xe7, 0x96, 0xec, 0xb3, 0x41, 0xb5, 0x12, 0x0b, 0x20, 0x7a, 0xb4, 0x15,
-	0x96, 0x6a, 0x2f, 0x0f, 0x68, 0x70, 0x84, 0x2c, 0x1c, 0xd3, 0xc2, 0xdf, 0x9a, 0x65, 0x75, 0x08,
-	0x25, 0x77, 0xa4, 0x37, 0x30, 0x17, 0x71, 0xce, 0x0f, 0xe0, 0xcd, 0x3d, 0x84, 0xe7, 0x06, 0xf8,
-	0xfd, 0xf3, 0xd1, 0x5e, 0xb7, 0xb7, 0x85, 0x54, 0x73, 0xcc, 0x68, 0xaf, 0xdb, 0xd1, 0x68, 0xb7,
-	0xec, 0xf8, 0x68, 0xaf, 0xdb, 0xdb, 0x64, 0x85, 0x87, 0x30, 0xe0, 0xfe, 0xee, 0xcf, 0x0f, 0xe2,
-	0xb6, 0x52, 0xe3, 0xc7, 0x7c, 0x4a, 0x28, 0x83, 0x2f, 0xc3, 0x44, 0xbd, 0x6b, 0x37, 0x68, 0xcb,
-	0xd9, 0x09, 0x84, 0x45, 0xc0, 0x4b, 0x03, 0x58, 0x85, 0xb8, 0xe2, 0x05, 0x58, 0xfe, 0x54, 0xef,
-	0x5c, 0x21, 0x0e, 0xfb, 0xc2, 0xcd, 0xda, 0x5d, 0x61, 0x14, 0x30, 0xe8, 0x0b, 0x37, 0x6b, 0x77,
-	0x85, 0x00, 0xd3, 0x6d, 0x6b, 0x02, 0x4c, 0xed, 0x2e, 0xe9, 0xc2, 0xf4, 0x26, 0xf5, 0x3c, 0x7b,
-	0xc7, 0xf5, 0xda, 0x5c, 0xcd, 0xca, 0x7d, 0x28, 0x2f, 0x0d, 0xe2, 0xa7, 0x11, 0x70, 0xed, 0x62,
-	0x20, 0x61, 0x56, 0x5c, 0x37, 0x1b, 0xe3, 0xcf, 0xfa, 0x64, 0xd9, 0x09, 0xb6, 0x7b, 0x8d, 0x7d,
-	0x1a, 0x2c, 0xcc, 0x1e, 0xdb, 0x27, 0x21, 0x2e, 0xef, 0x93, 0x6d, 0xf9, 0x53, 0xed, 0x93, 0x10,
-	0x87, 0x4d, 0x03, 0x11, 0xa8, 0x80, 0x1c, 0x3b, 0x0d, 0x38, 0x22, 0x9f, 0x06, 0xfd, 0x22, 0x16,
-	0x90, 0x3d, 0x28, 0x2c, 0xbb, 0xbd, 0x0e, 0x93, 0x6b, 0xbb, 0xb6, 0xe3, 0x2d, 0xcc, 0x21, 0xdb,
-	0x57, 0x06, 0x7d, 0xb0, 0x82, 0xce, 0xed, 0xef, 0xb7, 0x19, 0x84, 0x89, 0xce, 0x0c, 0xa4, 0x3e,
-	0x98, 0xa8, 0xa8, 0xa4, 0x09, 0x93, 0x38, 0x95, 0x2b, 0xf4, 0xa1, 0xdb, 0xf5, 0x17, 0xe6, 0xb1,
-	0xa2, 0x0b, 0xc7, 0x2d, 0x0a, 0x8e, 0xcd, 0x5f, 0xe6, 0x71, 0x69, 0x58, 0x4d, 0x84, 0xa8, 0x5a,
-	0x6c, 0x05, 0xd1, 0xf8, 0xc7, 0xa3, 0x50, 0x3a, 0x86, 0x19, 0xb9, 0x2f, 0xcf, 0x26, 0x2e, 0x01,
-	0xbc, 0x36, 0xdc, 0x37, 0x5c, 0x39, 0xf6, 0xd8, 0x7a, 0x0b, 0xa6, 0xef, 0x29, 0x46, 0x02, 0xa1,
-	0xd1, 0x06, 0xd2, 0xa8, 0xe6, 0x03, 0x96, 0xd3, 0x34, 0x63, 0xa8, 0x8b, 0x7f, 0x9c, 0x83, 0x11,
-	0x14, 0x2c, 0x5e, 0x84, 0x5c, 0xbd, 0xb7, 0xad, 0x3e, 0x74, 0xf9, 0xda, 0x76, 0xcd, 0x4a, 0xc9,
-	0xdb, 0x30, 0x29, 0xdc, 0x71, 0x94, 0xdb, 0x29, 0x76, 0x92, 0xf4, 0xdd, 0x89, 0xfb, 0x42, 0x28,
-	0xe8, 0xe4, 0x3d, 0x28, 0xd4, 0x9c, 0x2e, 0x6d, 0x39, 0x1d, 0xaa, 0x58, 0xf6, 0xe3, 0x58, 0x76,
-	0x05, 0x3c, 0xf1, 0xf8, 0xa5, 0x12, 0xe8, 0x8e, 0x43, 0x23, 0xc3, 0x3b, 0x0e, 0xbd, 0x07, 0x85,
-	0x0a, 0xdd, 0x71, 0x3a, 0x8e, 0xe8, 0x9f, 0xd1, 0xa8, 0xe2, 0x66, 0x08, 0xd7, 0xa9, 0x35, 0x02,
-	0xb2, 0x0c, 0x53, 0x26, 0xed, 0xba, 0xbe, 0x13, 0xb8, 0xde, 0xc1, 0x96, 0x59, 0x15, 0x06, 0x25,
-	0xa8, 0xa0, 0xf3, 0xc2, 0x02, 0xab, 0xe7, 0xa9, 0x27, 0x91, 0x4e, 0x42, 0x36, 0x60, 0x36, 0x02,
-	0xe8, 0x86, 0x58, 0xe2, 0xa5, 0x23, 0xe4, 0x93, 0x34, 0xa1, 0x4e, 0x92, 0xea, 0xdf, 0x64, 0xd2,
-	0x1d, 0x61, 0x90, 0x1d, 0xff, 0x26, 0x8f, 0xee, 0xa4, 0x7f, 0x93, 0x49, 0x77, 0x8c, 0x5f, 0xcb,
-	0xc1, 0x99, 0x3e, 0x5b, 0x1b, 0xd9, 0xd0, 0xa7, 0xeb, 0x8b, 0x83, 0x77, 0xc2, 0xe3, 0xa7, 0xe9,
-	0x3a, 0x14, 0x57, 0xef, 0xe0, 0x85, 0x9e, 0xbf, 0x23, 0xaf, 0x94, 0xa5, 0x10, 0x8a, 0xcd, 0xa7,
-	0xfb, 0xe8, 0x8c, 0x21, 0xdf, 0x9f, 0x1b, 0x5a, 0xd0, 0x94, 0x04, 0xe5, 0xe2, 0x0f, 0x65, 0xc5,
-	0xbc, 0x8d, 0x45, 0xb8, 0xcc, 0x9c, 0x28, 0xc2, 0xe5, 0x17, 0xa1, 0xb0, 0x7a, 0x87, 0xab, 0xdb,
-	0xd6, 0x6c, 0x7f, 0x4f, 0xcc, 0x29, 0xec, 0x42, 0xba, 0x2f, 0xdf, 0x4d, 0xf6, 0x6c, 0xed, 0x62,
-	0xab, 0x51, 0x90, 0x2d, 0x98, 0xe3, 0xdf, 0xe6, 0xec, 0x38, 0x0d, 0x1e, 0x28, 0xcf, 0xb1, 0x5b,
-	0x62, 0x86, 0xbd, 0x78, 0x74, 0x58, 0x2a, 0xd1, 0x7d, 0x74, 0x33, 0x11, 0xe5, 0x96, 0x8f, 0x08,
-	0xaa, 0xbf, 0x49, 0x0a, 0xbd, 0x1a, 0x76, 0xcb, 0x9c, 0xc0, 0x0a, 0x59, 0x6d, 0xac, 0x6e, 0x86,
-	0xcb, 0x91, 0x8c, 0x3f, 0x1c, 0x85, 0xc5, 0xfe, 0x62, 0x17, 0x79, 0x5f, 0x1f, 0xc0, 0x0b, 0xc7,
-	0x0a, 0x6a, 0xc7, 0x8f, 0xe1, 0x97, 0x60, 0x7e, 0xb5, 0x13, 0x50, 0xaf, 0xeb, 0x39, 0x32, 0x5c,
-	0xd7, 0x9a, 0xeb, 0x4b, 0xb7, 0x1e, 0x54, 0xb2, 0xd3, 0xb0, 0x5c, 0x38, 0xa8, 0xa1, 0x8f, 0x94,
-	0xaa, 0x64, 0x4f, 0xe3, 0x40, 0x56, 0x61, 0x5a, 0x81, 0xb7, 0x7a, 0xbb, 0xea, 0xe3, 0xb8, 0xca,
-	0xb3, 0xd5, 0x53, 0x7d, 0x1e, 0x62, 0x44, 0xe8, 0x3a, 0x14, 0xd8, 0x81, 0xd3, 0xb8, 0xfd, 0xe0,
-	0x4e, 0x5d, 0x0c, 0x27, 0x77, 0x1d, 0x42, 0xa8, 0xf5, 0xd1, 0xa3, 0x7d, 0x4d, 0x6e, 0x8a, 0x90,
-	0x17, 0x7f, 0xf1, 0x44, 0x3b, 0xe1, 0xe7, 0x01, 0xa2, 0xa5, 0xa4, 0xba, 0xde, 0x47, 0x4b, 0x4f,
-	0xf7, 0x0e, 0x94, 0x50, 0xb2, 0x06, 0x33, 0xd1, 0xaf, 0x7b, 0x8f, 0x3a, 0xd4, 0x13, 0x4d, 0x45,
-	0x15, 0xac, 0xb2, 0x72, 0x5d, 0x56, 0xa6, 0x8a, 0xe2, 0x31, 0x32, 0xb2, 0x04, 0xf9, 0x07, 0xae,
-	0xb7, 0xbf, 0xc3, 0xc6, 0x78, 0x24, 0xba, 0x2c, 0x3c, 0x12, 0x30, 0x55, 0x28, 0x96, 0x78, 0x6c,
-	0xb9, 0xac, 0x76, 0x1e, 0x3a, 0x9e, 0x8b, 0x06, 0x05, 0xaa, 0x49, 0x1d, 0x8d, 0xc0, 0x5a, 0xd0,
-	0x93, 0x08, 0x4c, 0x2e, 0xc1, 0x68, 0xb9, 0x11, 0xb8, 0x9e, 0xd8, 0xfe, 0xf8, 0x4c, 0x61, 0x00,
-	0x6d, 0xa6, 0x30, 0x00, 0xeb, 0x44, 0xb6, 0x27, 0x8d, 0x47, 0x9d, 0xa8, 0x6f, 0x44, 0xac, 0x94,
-	0x5d, 0x76, 0x4c, 0xba, 0x83, 0xda, 0x51, 0x2d, 0x7e, 0xeb, 0x4e, 0x42, 0xaf, 0x2e, 0xd0, 0x8c,
-	0x1f, 0x86, 0xbe, 0x53, 0x9e, 0x49, 0x97, 0x27, 0x9b, 0xf2, 0xeb, 0xf6, 0x10, 0x53, 0xfe, 0xf5,
-	0xd0, 0xe7, 0x50, 0x0d, 0x63, 0x84, 0x10, 0x55, 0xae, 0x11, 0xde, 0x87, 0xfa, 0xfc, 0xcb, 0x9d,
-	0x64, 0xfe, 0xfd, 0xbd, 0xfc, 0x49, 0xe6, 0x9f, 0xe8, 0xdf, 0xec, 0xb0, 0xfd, 0x9b, 0x1b, 0xaa,
-	0x7f, 0xd9, 0xa1, 0x12, 0x06, 0x0f, 0xae, 0xd9, 0x81, 0xb6, 0x23, 0x86, 0x11, 0x9f, 0xad, 0xae,
-	0xad, 0x05, 0xd8, 0xd3, 0x49, 0x14, 0x21, 0x01, 0x39, 0x8c, 0x26, 0x85, 0x84, 0x18, 0xbd, 0x8a,
-	0xce, 0x36, 0x02, 0x79, 0xe6, 0xd7, 0xd1, 0x83, 0x4d, 0x4c, 0x36, 0x6e, 0x6e, 0x22, 0xc5, 0x04,
-	0xee, 0xdc, 0xa6, 0xbd, 0x4f, 0x68, 0x44, 0xf1, 0x79, 0x3e, 0x7e, 0xa2, 0x79, 0xce, 0x2d, 0xac,
-	0xbd, 0x75, 0x77, 0xd7, 0x91, 0x7e, 0x4e, 0xd2, 0xc2, 0xda, 0xb3, 0x5a, 0x0c, 0x1a, 0xb3, 0xb0,
-	0xe6, 0xa8, 0xe4, 0x32, 0x8c, 0xb1, 0x1f, 0xd5, 0x8a, 0xb0, 0x81, 0x40, 0xa5, 0x07, 0x12, 0xe9,
-	0xce, 0x65, 0x1c, 0x49, 0x56, 0xb3, 0xda, 0xb6, 0x9d, 0x96, 0x08, 0x74, 0x13, 0x55, 0x43, 0x19,
-	0x34, 0x5e, 0x0d, 0xa2, 0x92, 0x06, 0x14, 0x4c, 0xba, 0x53, 0xf3, 0xdc, 0x80, 0x36, 0x02, 0xda,
-	0x14, 0x17, 0x3d, 0xa9, 0xeb, 0x58, 0x76, 0x5d, 0x7e, 0x89, 0x45, 0x3f, 0xa4, 0xcc, 0x77, 0x0e,
-	0x4b, 0xc0, 0x40, 0xdc, 0x73, 0x91, 0x89, 0x3c, 0x6c, 0xfc, 0xbb, 0x92, 0x58, 0x3d, 0xd8, 0x54,
-	0xa6, 0xe4, 0x1b, 0x6c, 0xab, 0x0f, 0xbb, 0x24, 0xaa, 0xac, 0xd0, 0xa7, 0xb2, 0x37, 0x52, 0x2b,
-	0x2b, 0x29, 0xbd, 0x9d, 0x5a, 0x69, 0x6a, 0x25, 0xe4, 0x1d, 0x98, 0x5c, 0xa9, 0xae, 0xb8, 0x9d,
-	0x1d, 0x67, 0xb7, 0xbe, 0x56, 0xc6, 0xdb, 0xa2, 0x90, 0xd7, 0x1a, 0x8e, 0xd5, 0x40, 0xb8, 0xe5,
-	0xef, 0xd9, 0x5a, 0xec, 0x85, 0x08, 0x9f, 0xdc, 0x82, 0x69, 0xf9, 0xd3, 0xa4, 0x3b, 0x4c, 0x5e,
-	0x9b, 0x56, 0x3c, 0x9d, 0x43, 0x0e, 0xac, 0x23, 0x74, 0x91, 0x2d, 0x46, 0xc6, 0x26, 0x63, 0x85,
-	0x76, 0x5b, 0xee, 0x01, 0xfb, 0xbc, 0x4d, 0x87, 0x7a, 0x78, 0x2d, 0x14, 0x93, 0xb1, 0x19, 0x96,
-	0x58, 0x81, 0xa3, 0x5b, 0x7e, 0xe8, 0x44, 0x4c, 0xf4, 0x13, 0x53, 0xfc, 0xbe, 0xe3, 0x3b, 0xdb,
-	0x4e, 0xcb, 0x09, 0x0e, 0xf0, 0x42, 0x28, 0x64, 0x1f, 0xb9, 0x2e, 0x1e, 0x86, 0xa5, 0xaa, 0xe8,
-	0x97, 0x20, 0x35, 0x7e, 0x25, 0x0b, 0xcf, 0x0d, 0x52, 0x8e, 0x90, 0xba, 0xbe, 0x0f, 0x5e, 0x1c,
-	0x42, 0xa1, 0x72, 0xfc, 0x4e, 0xb8, 0xda, 0xe7, 0x9e, 0x81, 0x9d, 0x11, 0xbb, 0x67, 0xa8, 0x9d,
-	0x11, 0xbb, 0x71, 0x3c, 0x14, 0xdb, 0xdc, 0xc7, 0x8d, 0x02, 0x70, 0x03, 0x26, 0x56, 0xdc, 0x4e,
-	0x40, 0x1f, 0x07, 0xb1, 0x98, 0x37, 0x1c, 0x18, 0x8f, 0x80, 0x20, 0x51, 0x8d, 0x7f, 0x9f, 0x85,
-	0x73, 0x03, 0xb5, 0x03, 0x64, 0x53, 0xef, 0xb5, 0x4b, 0xc3, 0xa8, 0x14, 0x8e, 0xef, 0xb6, 0xa5,
-	0x84, 0xc5, 0xf0, 0xb1, 0x5e, 0xaa, 0x8b, 0xff, 0x7d, 0x46, 0x74, 0xd2, 0x67, 0x60, 0x1c, 0xab,
-	0x0a, 0xbb, 0x88, 0x6b, 0xe1, 0x71, 0x17, 0x76, 0x74, 0x2d, 0x3c, 0x47, 0x23, 0xd7, 0x21, 0xbf,
-	0x62, 0xb7, 0x5a, 0x4a, 0x44, 0x20, 0xbc, 0xe0, 0x37, 0x10, 0x16, 0x33, 0x7b, 0x97, 0x88, 0xec,
-	0xd8, 0xe2, 0x7f, 0x2b, 0x67, 0x05, 0x6e, 0x96, 0x82, 0x2c, 0x76, 0x5c, 0x28, 0xc8, 0x18, 0xfe,
-	0xbc, 0xe1, 0x86, 0x31, 0x47, 0x78, 0xf8, 0x73, 0x06, 0xd0, 0xc2, 0x9f, 0x33, 0x80, 0xf1, 0xab,
-	0x39, 0x78, 0x7e, 0xb0, 0x8a, 0x8b, 0x6c, 0xe9, 0x43, 0xf0, 0xea, 0x50, 0x8a, 0xb1, 0xe3, 0xc7,
-	0x40, 0x26, 0x13, 0xe0, 0x1d, 0x72, 0x31, 0xe9, 0x6a, 0xf8, 0xdd, 0xc3, 0x92, 0xe2, 0x4b, 0x71,
-	0xdb, 0x75, 0x3a, 0xca, 0x9b, 0xec, 0xd7, 0x13, 0x87, 0xfa, 0xe4, 0xd2, 0x8d, 0xe1, 0xbe, 0x2c,
-	0xa2, 0xe3, 0xfb, 0xca, 0xb0, 0xc2, 0xc0, 0x17, 0xa0, 0x18, 0x27, 0x25, 0x17, 0x60, 0x04, 0x3f,
-	0x40, 0xf1, 0x97, 0x8c, 0x71, 0xc0, 0xf2, 0xc5, 0xbb, 0x62, 0xee, 0x60, 0x90, 0x24, 0xd5, 0xa1,
-	0x5f, 0x50, 0x8a, 0x20, 0x49, 0x5a, 0x34, 0x00, 0x3d, 0x48, 0x92, 0x4a, 0x64, 0xfc, 0x49, 0x06,
-	0xce, 0xf6, 0xd5, 0x51, 0x90, 0x9a, 0x3e, 0x60, 0x2f, 0x1f, 0xa7, 0xd4, 0x38, 0x76, 0xac, 0x16,
-	0x7f, 0x42, 0xce, 0xfd, 0x77, 0xa1, 0x50, 0xef, 0x6d, 0xc7, 0xaf, 0x76, 0x3c, 0x84, 0x99, 0x02,
-	0x57, 0x4f, 0x30, 0x15, 0x9f, 0xb5, 0x5f, 0x7a, 0xc1, 0x0b, 0xd3, 0x45, 0xc5, 0x5e, 0x3a, 0x8c,
-	0xe2, 0x91, 0x0c, 0x12, 0xa5, 0x13, 0x19, 0xbf, 0x9c, 0x4d, 0xbf, 0x23, 0xdf, 0x5a, 0xa9, 0x9d,
-	0xe4, 0x8e, 0x7c, 0x6b, 0xa5, 0x76, 0x7c, 0xdb, 0xff, 0x2b, 0xd9, 0x76, 0x6e, 0x54, 0xc4, 0x77,
-	0x3c, 0xf9, 0xf6, 0x21, 0x8d, 0x8a, 0xc4, 0xee, 0xe8, 0xc7, 0x8c, 0x8a, 0x04, 0x32, 0x79, 0x03,
-	0x26, 0xd6, 0x5d, 0x1e, 0xbf, 0x49, 0xb6, 0x98, 0x87, 0xb9, 0x90, 0x40, 0x75, 0x7b, 0x0c, 0x31,
-	0xd9, 0xb5, 0x44, 0x1f, 0x78, 0x69, 0x16, 0x8e, 0xd7, 0x92, 0xd8, 0x74, 0xd1, 0x5f, 0x08, 0x74,
-	0x32, 0xe3, 0x1f, 0x8d, 0x82, 0x71, 0xbc, 0x7e, 0x93, 0x7c, 0xa0, 0xf7, 0xdd, 0x95, 0xa1, 0x35,
-	0xa3, 0x43, 0x6d, 0xb9, 0xe5, 0x5e, 0xd3, 0xa1, 0x9d, 0x86, 0x1e, 0x7c, 0x49, 0xc0, 0xd4, 0x2d,
-	0x50, 0xe2, 0x7d, 0x9c, 0x60, 0x02, 0x8b, 0xff, 0x32, 0x17, 0x2d, 0xb5, 0xd8, 0xd1, 0x98, 0xf9,
-	0x18, 0x47, 0x23, 0xb9, 0x03, 0x45, 0x15, 0xa2, 0xe8, 0xd8, 0x50, 0x72, 0xd1, 0x18, 0xc5, 0x3e,
-	0x2a, 0x41, 0xa8, 0x9f, 0xaf, 0xb9, 0xe1, 0xcf, 0xd7, 0x98, 0x8e, 0x6f, 0xe4, 0x64, 0x3a, 0x3e,
-	0x11, 0xac, 0xc9, 0x17, 0x87, 0xd6, 0xa8, 0x1e, 0xac, 0x29, 0xe5, 0xe0, 0x52, 0xd1, 0x65, 0xbc,
-	0x29, 0xfc, 0xa9, 0x84, 0x5b, 0x09, 0xe3, 0x4d, 0x71, 0xfa, 0xb4, 0x78, 0x53, 0x21, 0x09, 0x3b,
-	0x00, 0xcd, 0x5e, 0x87, 0xe7, 0xd9, 0x18, 0x8f, 0x0e, 0x40, 0xaf, 0xd7, 0xb1, 0xe2, 0xb9, 0x36,
-	0x42, 0x44, 0xe3, 0x9f, 0x8e, 0xa4, 0x0b, 0x07, 0x91, 0x0a, 0xfc, 0x04, 0xc2, 0x41, 0x48, 0xf4,
-	0xe9, 0xcc, 0xd4, 0x2d, 0x98, 0x93, 0x96, 0xc5, 0x58, 0x7b, 0x93, 0x7a, 0x5b, 0xe6, 0xba, 0x18,
-	0x62, 0x54, 0x39, 0x85, 0x36, 0xc9, 0x5d, 0x51, 0x6e, 0xf5, 0x3c, 0x4d, 0xe5, 0x94, 0x42, 0xbf,
-	0xf8, 0x4f, 0xa4, 0x46, 0x4d, 0x1d, 0x04, 0xf4, 0x02, 0xcf, 0xa4, 0x0d, 0x42, 0xaf, 0xa7, 0x0d,
-	0xa3, 0x4e, 0xc2, 0xf7, 0xde, 0x50, 0xfb, 0xb9, 0xa5, 0xcb, 0x8a, 0xaa, 0xc6, 0x54, 0xe7, 0x12,
-	0x23, 0x22, 0xbb, 0x70, 0x36, 0x12, 0xa5, 0x95, 0x9b, 0x02, 0x72, 0xe4, 0x0d, 0xbe, 0x74, 0x74,
-	0x58, 0x7a, 0x59, 0x11, 0xc5, 0xd5, 0x0b, 0x47, 0x8c, 0x7b, 0x7f, 0x5e, 0x6c, 0xbf, 0x5d, 0xf6,
-	0xec, 0x4e, 0x63, 0x4f, 0x99, 0xf3, 0xb8, 0xdf, 0x6e, 0x23, 0x34, 0x11, 0x72, 0x26, 0x42, 0x36,
-	0xfe, 0x76, 0x36, 0x5d, 0x25, 0x21, 0x5e, 0x3a, 0x4e, 0xa0, 0x92, 0xe0, 0x14, 0xc7, 0x9f, 0x12,
-	0xff, 0x48, 0x9e, 0x12, 0x2f, 0xc3, 0xf8, 0x26, 0xed, 0xd8, 0x9d, 0x30, 0x94, 0x13, 0x5a, 0x5c,
-	0x04, 0x1c, 0x64, 0xca, 0x32, 0xf2, 0x3e, 0x90, 0x9a, 0xed, 0xd1, 0x4e, 0xb0, 0xe2, 0xb6, 0xbb,
-	0xb6, 0x17, 0xb4, 0x31, 0x13, 0x09, 0x3f, 0x1a, 0x5e, 0x38, 0x3a, 0x2c, 0x9d, 0xeb, 0x62, 0xa9,
-	0xd5, 0x50, 0x8a, 0xd5, 0x88, 0x80, 0x49, 0x62, 0x72, 0x15, 0xc6, 0xa5, 0x21, 0x41, 0x2e, 0x8a,
-	0xee, 0x98, 0x34, 0x22, 0x90, 0x58, 0xc6, 0xbf, 0x1c, 0x85, 0xf3, 0xc7, 0x3d, 0xeb, 0x90, 0x1d,
-	0x80, 0x7b, 0x9d, 0x6d, 0xd7, 0xf6, 0x9a, 0x4e, 0x67, 0x57, 0xf8, 0x5c, 0xde, 0x18, 0xf2, 0x4d,
-	0xe8, 0x4a, 0x44, 0xc9, 0x0a, 0xb9, 0x87, 0xab, 0x1b, 0xc2, 0x4c, 0x85, 0x33, 0xf9, 0x2a, 0xe4,
-	0x4d, 0xda, 0x70, 0x1f, 0x52, 0xa1, 0xba, 0x9b, 0x5c, 0xfa, 0xec, 0xb0, 0xb5, 0x48, 0x3a, 0xac,
-	0x03, 0x5d, 0xff, 0x3c, 0x01, 0x31, 0x43, 0x9e, 0xe4, 0x6b, 0x30, 0xc9, 0x13, 0xce, 0x94, 0x77,
-	0x02, 0xa1, 0xde, 0x3b, 0x3e, 0x74, 0x47, 0x86, 0x6d, 0x92, 0x3c, 0x85, 0x8d, 0x65, 0xef, 0x68,
-	0xae, 0x04, 0x3c, 0x74, 0x87, 0xc2, 0x72, 0xf1, 0x3f, 0xcb, 0xc2, 0xb4, 0xde, 0x60, 0xb2, 0x0e,
-	0xc5, 0x6a, 0xc7, 0x09, 0x1c, 0xbb, 0xa5, 0x9b, 0x9a, 0x8a, 0x3b, 0xa6, 0xc3, 0xcb, 0xac, 0x54,
-	0x93, 0xd3, 0x04, 0x25, 0x9b, 0x33, 0x6c, 0xe8, 0xfc, 0x80, 0x5b, 0x38, 0xf0, 0x48, 0xab, 0x62,
-	0x11, 0xbf, 0xc0, 0x03, 0xfb, 0x46, 0xa5, 0x16, 0x8f, 0x6d, 0xac, 0x47, 0x91, 0x8c, 0x13, 0x93,
-	0x87, 0x40, 0xee, 0xf6, 0xfc, 0x80, 0x97, 0x50, 0x6f, 0x99, 0xee, 0xb8, 0xde, 0x30, 0x31, 0x3b,
-	0x5e, 0x15, 0x9d, 0xf3, 0x7c, 0xbb, 0xe7, 0x07, 0x96, 0x27, 0xc8, 0xad, 0x6d, 0xa4, 0x8f, 0x75,
-	0x52, 0x4a, 0x0d, 0x8b, 0x77, 0xa1, 0xa0, 0x8e, 0x1a, 0x5a, 0x7c, 0x39, 0x6d, 0x47, 0xda, 0xde,
-	0x73, 0x8b, 0x2f, 0x06, 0x30, 0x39, 0x9c, 0x3c, 0x27, 0x82, 0x5c, 0x65, 0x23, 0xc3, 0xa8, 0x28,
-	0x98, 0x95, 0xf1, 0x23, 0x19, 0x38, 0x9d, 0x6e, 0x2d, 0x44, 0x3e, 0x8a, 0xbd, 0x6a, 0x66, 0x06,
-	0xbd, 0xf9, 0x4a, 0x13, 0xa3, 0x8f, 0xf7, 0xae, 0x69, 0xfc, 0xe5, 0x91, 0x84, 0x94, 0x95, 0xc2,
-	0x91, 0xdc, 0x4a, 0x1d, 0xc7, 0x8c, 0x72, 0x2e, 0x26, 0xc7, 0x31, 0x75, 0xf4, 0xde, 0x86, 0x69,
-	0x64, 0x1c, 0x4d, 0x2e, 0x45, 0x1f, 0xca, 0x3f, 0x39, 0x9a, 0x5a, 0x66, 0x0c, 0x97, 0x54, 0x81,
-	0x20, 0x64, 0xd9, 0x0d, 0x14, 0xe7, 0x72, 0xe5, 0xa2, 0xc9, 0x39, 0x6c, 0xbb, 0x81, 0xa5, 0xba,
-	0x99, 0xa7, 0x10, 0x91, 0xcf, 0xc3, 0x94, 0x1c, 0xce, 0x15, 0xbc, 0xd5, 0x8c, 0xe0, 0x30, 0xe2,
-	0x7d, 0x48, 0xae, 0x45, 0x0b, 0x45, 0x51, 0x53, 0x47, 0x24, 0x6d, 0x1e, 0x6e, 0x48, 0x00, 0x69,
-	0xb3, 0x1c, 0x0c, 0x11, 0xd3, 0xe9, 0x15, 0x31, 0xfb, 0x9e, 0xe5, 0x29, 0xa6, 0x24, 0xad, 0x65,
-	0x07, 0xb1, 0xa9, 0x17, 0xe7, 0x4d, 0x76, 0x61, 0x4a, 0x49, 0x3d, 0x55, 0x0e, 0x86, 0xc8, 0x7c,
-	0xf6, 0xb2, 0xa8, 0xec, 0xac, 0x9a, 0xcf, 0x2a, 0x59, 0x95, 0xce, 0xd7, 0xf8, 0x89, 0x2c, 0x4c,
-	0xf3, 0xdb, 0x22, 0x37, 0x19, 0x7b, 0x6a, 0x6d, 0xfb, 0xde, 0xd2, 0x6c, 0xfb, 0x64, 0x78, 0x71,
-	0xb5, 0x69, 0x43, 0x59, 0x62, 0xef, 0x01, 0x49, 0xd2, 0x10, 0x13, 0x0a, 0x2a, 0x74, 0xb0, 0x1d,
-	0xde, 0xb5, 0x28, 0x12, 0xbd, 0xb8, 0xac, 0xa3, 0x65, 0xa5, 0x6f, 0x6a, 0x3c, 0x8c, 0x1f, 0xcf,
-	0xc2, 0x94, 0x62, 0x89, 0xfd, 0xd4, 0x76, 0xfc, 0x17, 0xb4, 0x8e, 0x5f, 0x08, 0xa3, 0x6b, 0x84,
-	0x2d, 0x1b, 0xaa, 0xdf, 0x7b, 0x30, 0x9b, 0x20, 0x89, 0x1b, 0xb4, 0x67, 0x86, 0x31, 0x68, 0x7f,
-	0x3d, 0x19, 0xd6, 0x9a, 0x27, 0xb5, 0x0b, 0x83, 0x9c, 0xaa, 0x71, 0xb4, 0x7f, 0x2a, 0x0b, 0xf3,
-	0xe2, 0x17, 0xe6, 0x81, 0xe0, 0xea, 0x92, 0xa7, 0x76, 0x2c, 0xca, 0xda, 0x58, 0x94, 0xf4, 0xb1,
-	0x50, 0x1a, 0xd8, 0x7f, 0x48, 0x8c, 0x1f, 0x01, 0x58, 0xe8, 0x47, 0x30, 0x74, 0xd8, 0xad, 0x28,
-	0xac, 0x47, 0x76, 0x88, 0xb0, 0x1e, 0xeb, 0x50, 0xc4, 0xaa, 0x84, 0x2b, 0x92, 0xbf, 0x65, 0x56,
-	0x45, 0x27, 0xa1, 0xf4, 0xc1, 0x93, 0x75, 0x08, 0xff, 0x25, 0x3f, 0xa6, 0x75, 0x4f, 0x50, 0x92,
-	0x5f, 0xcc, 0xc0, 0x34, 0x02, 0x57, 0x1f, 0x32, 0x71, 0x93, 0x31, 0x1b, 0x11, 0xf1, 0x1e, 0x42,
-	0x6b, 0xbd, 0x7a, 0xe0, 0x39, 0x9d, 0x5d, 0x61, 0xae, 0xb7, 0x2d, 0xcc, 0xf5, 0xde, 0xe6, 0x66,
-	0x86, 0x57, 0x1a, 0x6e, 0xfb, 0xea, 0xae, 0x67, 0x3f, 0x74, 0xb8, 0x93, 0x81, 0xdd, 0xba, 0x1a,
-	0xe5, 0x62, 0xed, 0x3a, 0xb1, 0x2c, 0xa9, 0x82, 0x15, 0x9a, 0x42, 0xf2, 0x0f, 0xa5, 0x58, 0x6d,
-	0xfc, 0x71, 0x40, 0xff, 0x22, 0xf2, 0x7d, 0x70, 0x86, 0xc7, 0x5f, 0x5e, 0x71, 0x3b, 0x81, 0xd3,
-	0xe9, 0xb9, 0x3d, 0x7f, 0xd9, 0x6e, 0xec, 0xf7, 0xba, 0xbe, 0x88, 0xca, 0x83, 0x2d, 0x6f, 0x84,
-	0x85, 0xd6, 0x36, 0x2f, 0xd5, 0x22, 0xe3, 0xa5, 0x33, 0x20, 0x6b, 0x30, 0xcb, 0x8b, 0xca, 0xbd,
-	0xc0, 0xad, 0x37, 0xec, 0x16, 0x13, 0x88, 0xc7, 0x91, 0x2b, 0xb7, 0x49, 0xea, 0x05, 0xae, 0xe5,
-	0x73, 0xb8, 0xfa, 0x56, 0x90, 0x20, 0x22, 0x55, 0x98, 0x31, 0xa9, 0xdd, 0xbc, 0x6b, 0x3f, 0x5e,
-	0xb1, 0xbb, 0x76, 0xc3, 0x09, 0x78, 0x42, 0x88, 0x1c, 0x57, 0x29, 0x78, 0xd4, 0x6e, 0x5a, 0x6d,
-	0xfb, 0xb1, 0xd5, 0x10, 0x85, 0xfa, 0x7b, 0xb3, 0x46, 0x17, 0xb2, 0x72, 0x3a, 0x21, 0xab, 0x89,
-	0x38, 0x2b, 0xa7, 0xd3, 0x9f, 0x55, 0x44, 0x27, 0x59, 0xf1, 0xcc, 0x5c, 0xdc, 0x6d, 0x12, 0xce,
-	0x67, 0x2e, 0x66, 0x14, 0x56, 0x22, 0x9d, 0x17, 0xba, 0x50, 0xc6, 0x59, 0x29, 0x74, 0x6c, 0xe6,
-	0x3d, 0xf0, 0x9c, 0x80, 0xaa, 0x2d, 0x9c, 0xc4, 0xcf, 0xc2, 0xfe, 0x47, 0x87, 0xd3, 0x7e, 0x4d,
-	0x4c, 0x50, 0x46, 0xdc, 0x94, 0x46, 0x16, 0x12, 0xdc, 0xd2, 0x5b, 0x99, 0xa0, 0x0c, 0xb9, 0xa9,
-	0xed, 0x9c, 0xc2, 0x76, 0x2a, 0xdc, 0xfa, 0x34, 0x34, 0x41, 0x49, 0x36, 0x58, 0xa7, 0x05, 0xec,
-	0xe6, 0xee, 0x76, 0x84, 0x3f, 0xe7, 0x34, 0x7e, 0xda, 0x4b, 0x42, 0x6c, 0x28, 0x7a, 0xb2, 0xd8,
-	0x4a, 0xf1, 0xee, 0x8c, 0x13, 0x93, 0xbf, 0x00, 0x33, 0x5b, 0x3e, 0xbd, 0x59, 0xad, 0xd5, 0x65,
-	0xb8, 0x66, 0x7c, 0xde, 0x9a, 0x5e, 0xba, 0x76, 0xcc, 0xa6, 0x73, 0x45, 0xa5, 0xc1, 0xd4, 0xa6,
-	0x7c, 0xdc, 0x7a, 0x3e, 0xb5, 0x76, 0x9c, 0xae, 0x1f, 0xc6, 0xbe, 0x57, 0xc7, 0x2d, 0x56, 0x95,
-	0xb1, 0x06, 0xb3, 0x09, 0x36, 0x64, 0x1a, 0x80, 0x01, 0xad, 0xad, 0x8d, 0xfa, 0xea, 0x66, 0xf1,
-	0x19, 0x52, 0x84, 0x02, 0xfe, 0x5e, 0xdd, 0x28, 0x2f, 0xaf, 0xaf, 0x56, 0x8a, 0x19, 0x32, 0x0b,
-	0x53, 0x08, 0xa9, 0x54, 0xeb, 0x1c, 0x94, 0xe5, 0x19, 0xe9, 0xcc, 0x22, 0x5f, 0xba, 0x01, 0x5b,
-	0x00, 0x78, 0xa6, 0x18, 0x7f, 0x3d, 0x0b, 0x67, 0xe5, 0xb1, 0x42, 0x83, 0x47, 0xae, 0xb7, 0xef,
-	0x74, 0x76, 0x9f, 0xf2, 0xd3, 0xe1, 0xa6, 0x76, 0x3a, 0xbc, 0x14, 0x3b, 0xa9, 0x63, 0xad, 0x1c,
-	0x70, 0x44, 0x7c, 0x7b, 0x02, 0xce, 0x0d, 0xa4, 0x22, 0xef, 0xb3, 0xd3, 0xdc, 0xa1, 0x9d, 0xa0,
-	0xda, 0x6c, 0x51, 0x26, 0xa2, 0xba, 0xbd, 0x40, 0xf8, 0x0f, 0xbf, 0x88, 0x2f, 0x4a, 0x58, 0x68,
-	0x39, 0xcd, 0x16, 0xb5, 0x02, 0x5e, 0xac, 0x4d, 0xb7, 0x24, 0x35, 0x63, 0x19, 0xa6, 0x59, 0xae,
-	0x76, 0x02, 0xea, 0x3d, 0x44, 0xbf, 0x9b, 0x90, 0xe5, 0x3e, 0xa5, 0x5d, 0xcb, 0x66, 0xa5, 0x96,
-	0x23, 0x8a, 0x75, 0x96, 0x09, 0x6a, 0x72, 0x53, 0x61, 0x89, 0x52, 0xfe, 0x5d, 0xfb, 0xb1, 0xb0,
-	0xdd, 0x17, 0xe9, 0x3f, 0x42, 0x96, 0x3c, 0x14, 0x46, 0xdb, 0x7e, 0x6c, 0x26, 0x49, 0xc8, 0x87,
-	0x70, 0x4a, 0x1c, 0x40, 0x22, 0x54, 0xa3, 0x6c, 0x31, 0x0f, 0x04, 0xf9, 0x0a, 0xbb, 0x98, 0x49,
-	0xf7, 0x5b, 0x19, 0x7e, 0x35, 0xad, 0xd5, 0xe9, 0x5c, 0xc8, 0x26, 0x3b, 0x90, 0x63, 0xdd, 0x71,
-	0x97, 0xfa, 0xbe, 0x8c, 0x77, 0x22, 0x74, 0xb3, 0x6a, 0x67, 0x5a, 0x6d, 0x5e, 0x6e, 0xf6, 0xa5,
-	0x24, 0x6b, 0x30, 0xfd, 0x80, 0x6e, 0xab, 0xe3, 0x33, 0x16, 0x6e, 0x55, 0xc5, 0x47, 0x74, 0xbb,
-	0xff, 0xe0, 0xc4, 0xe8, 0x88, 0x83, 0x2f, 0xd4, 0x8f, 0x0f, 0xd6, 0xd9, 0xc5, 0xb9, 0x43, 0x3d,
-	0xbc, 0xff, 0x8e, 0xe3, 0x66, 0xb0, 0x10, 0x49, 0xc8, 0x7a, 0xb9, 0xd0, 0x1d, 0x61, 0x88, 0x81,
-	0x96, 0x80, 0x5b, 0xb1, 0x24, 0xc5, 0x49, 0xae, 0xe4, 0x6b, 0x30, 0x63, 0xba, 0xbd, 0xc0, 0xe9,
-	0xec, 0xd6, 0xd9, 0x0d, 0x93, 0xee, 0xf2, 0x03, 0x29, 0x8a, 0x26, 0x1d, 0x2b, 0x15, 0x76, 0x51,
-	0x1c, 0x68, 0xf9, 0x02, 0xaa, 0x9d, 0x08, 0x3a, 0x01, 0xf9, 0x2a, 0x4c, 0xf3, 0x90, 0x77, 0x61,
-	0x05, 0x13, 0x5a, 0xa6, 0x42, 0xbd, 0xf0, 0xfe, 0x35, 0x61, 0x6a, 0x8d, 0xd0, 0xb4, 0x0a, 0x62,
-	0xdc, 0xc8, 0x97, 0x45, 0x67, 0xd5, 0x9c, 0xce, 0x6e, 0x38, 0x8d, 0x01, 0x7b, 0xfe, 0x72, 0xd4,
-	0x25, 0x5d, 0xf6, 0xb9, 0x72, 0x1a, 0xf7, 0xf1, 0x1b, 0x49, 0xf2, 0x21, 0x01, 0x9c, 0x2b, 0xfb,
-	0xbe, 0xe3, 0x07, 0xc2, 0xcb, 0x7e, 0xf5, 0x31, 0x6d, 0xf4, 0x18, 0xf2, 0x03, 0xd7, 0xdb, 0xa7,
-	0x1e, 0xf7, 0x5c, 0x1c, 0x5d, 0xbe, 0x72, 0x74, 0x58, 0x7a, 0xd5, 0x46, 0x44, 0x4b, 0x38, 0xe6,
-	0x5b, 0x54, 0xa2, 0x5a, 0x8f, 0x38, 0xae, 0xd2, 0x86, 0xc1, 0x4c, 0xc9, 0x57, 0xe1, 0xf4, 0x8a,
-	0xed, 0xd3, 0x6a, 0xc7, 0xa7, 0x1d, 0xdf, 0x09, 0x9c, 0x87, 0x54, 0x74, 0x2a, 0x1e, 0x7e, 0x79,
-	0x1e, 0x46, 0xbc, 0x61, 0xfb, 0x6c, 0x61, 0x86, 0x28, 0x96, 0x18, 0x14, 0x35, 0x4a, 0x79, 0x3a,
-	0x17, 0x62, 0xc2, 0x74, 0xbd, 0xbe, 0x56, 0x71, 0xec, 0x70, 0x5d, 0x4d, 0x61, 0x7f, 0xbd, 0x8a,
-	0x8f, 0x4b, 0xfe, 0x9e, 0xd5, 0x74, 0xec, 0x70, 0x41, 0xf5, 0xe9, 0xac, 0x18, 0x07, 0xe3, 0x30,
-	0x03, 0xc5, 0xf8, 0x50, 0x92, 0x2f, 0xc1, 0x04, 0x77, 0xba, 0xa0, 0xfe, 0x9e, 0xd0, 0xbf, 0x48,
-	0x1b, 0xfe, 0x10, 0xae, 0x13, 0x89, 0x48, 0x39, 0xdc, 0xa5, 0x83, 0xaa, 0xa6, 0x9e, 0x6b, 0xcf,
-	0x98, 0x11, 0x33, 0xd2, 0x84, 0x02, 0x1f, 0x2d, 0x8a, 0x91, 0xf0, 0x63, 0xb1, 0x07, 0xd4, 0xa2,
-	0x18, 0x7f, 0x6e, 0xe0, 0xcc, 0xe7, 0x04, 0x47, 0xd0, 0xaa, 0xd0, 0xb8, 0x2e, 0x03, 0xe4, 0x25,
-	0xa1, 0x71, 0x16, 0xce, 0xf4, 0xf9, 0x66, 0xe3, 0x21, 0xea, 0x9c, 0xfb, 0xd4, 0x48, 0xbe, 0x04,
-	0xf3, 0x48, 0xb8, 0xe2, 0x76, 0x3a, 0xb4, 0x11, 0xe0, 0x76, 0x24, 0xdf, 0x7f, 0x73, 0xdc, 0x4c,
-	0x93, 0xb7, 0xb7, 0x11, 0x22, 0x58, 0xf1, 0x67, 0xe0, 0x54, 0x0e, 0xc6, 0xcf, 0x67, 0x61, 0x41,
-	0xec, 0x70, 0x26, 0x6d, 0xb8, 0xa8, 0x7d, 0x7c, 0xca, 0x4f, 0xd4, 0x55, 0xed, 0x44, 0x7d, 0x31,
-	0x0c, 0xf9, 0x99, 0xd6, 0xc8, 0x01, 0x07, 0xea, 0x2f, 0x67, 0xe0, 0xb9, 0x41, 0x44, 0xa1, 0x56,
-	0x31, 0x93, 0xa6, 0x55, 0x24, 0x5d, 0x98, 0xc3, 0x01, 0x5d, 0xd9, 0xa3, 0x8d, 0x7d, 0x7f, 0xcd,
-	0xf5, 0x03, 0xf4, 0x25, 0xce, 0xf6, 0xb1, 0xb6, 0x7a, 0x3d, 0xd5, 0xda, 0xea, 0x34, 0x9f, 0x65,
-	0x0d, 0xe4, 0xc1, 0x73, 0x13, 0xec, 0xd3, 0x03, 0xdf, 0x4c, 0x63, 0x6d, 0xfc, 0x74, 0x96, 0x5d,
-	0xd9, 0x82, 0xbd, 0x9a, 0x47, 0x77, 0xa8, 0x47, 0x3b, 0x0d, 0xfa, 0x3d, 0xe6, 0x13, 0xaa, 0x37,
-	0x6e, 0x28, 0x0d, 0xc6, 0xb7, 0xa6, 0x61, 0x3e, 0x8d, 0x8c, 0xf5, 0x8b, 0x72, 0x69, 0xce, 0x4b,
-	0x27, 0x7e, 0x71, 0x55, 0xfe, 0x66, 0x06, 0x0a, 0x75, 0xda, 0x70, 0x3b, 0xcd, 0x9b, 0x68, 0x0e,
-	0x2b, 0x7a, 0xc7, 0xe6, 0x42, 0x03, 0x83, 0x5b, 0x3b, 0x31, 0x3b, 0xd9, 0xef, 0x1e, 0x96, 0xbe,
-	0x38, 0xdc, 0x5d, 0xb5, 0xe1, 0xa2, 0xee, 0x33, 0xc0, 0xb4, 0x82, 0x61, 0x15, 0xfc, 0x6b, 0x4c,
-	0xad, 0x5a, 0xb2, 0x0c, 0x53, 0x62, 0xc1, 0xba, 0x6a, 0xee, 0x04, 0x1e, 0x17, 0x55, 0x16, 0x24,
-	0x9e, 0x4f, 0x35, 0x12, 0x72, 0x1d, 0x72, 0x5b, 0x4b, 0x37, 0xc5, 0x28, 0xc8, 0xd4, 0x8c, 0x5b,
-	0x4b, 0x37, 0x51, 0x21, 0xc6, 0x2e, 0x19, 0x53, 0xbd, 0x25, 0xcd, 0xd0, 0x74, 0x6b, 0xe9, 0x26,
-	0xf9, 0x8b, 0x70, 0xaa, 0xe2, 0xf8, 0xa2, 0x0a, 0xee, 0x9f, 0xdc, 0xc4, 0xa8, 0x1c, 0x63, 0x7d,
-	0xe6, 0xef, 0xe7, 0x52, 0xe7, 0xef, 0x0b, 0xcd, 0x90, 0x89, 0xc5, 0x9d, 0x9f, 0x9b, 0xf1, 0x1c,
-	0x11, 0xe9, 0xf5, 0x90, 0x8f, 0x60, 0x1a, 0xdf, 0xc6, 0xd0, 0x65, 0x1b, 0x93, 0x93, 0x8d, 0xf7,
-	0xa9, 0xf9, 0x33, 0xa9, 0x35, 0x2f, 0xf2, 0x68, 0x75, 0xe8, 0xf8, 0x8d, 0x89, 0xcc, 0xb4, 0x7b,
-	0xbf, 0xc6, 0x99, 0xdc, 0x86, 0x19, 0x21, 0x80, 0xdd, 0xdb, 0xd9, 0xdc, 0xa3, 0x15, 0xfb, 0x40,
-	0xd8, 0x88, 0xe2, 0x9d, 0x4e, 0x48, 0x6d, 0x96, 0xbb, 0x63, 0x05, 0x7b, 0xd4, 0x6a, 0xda, 0x9a,
-	0xa8, 0x12, 0x23, 0x24, 0xdf, 0x80, 0xc9, 0x75, 0xb7, 0xc1, 0x64, 0x6f, 0xdc, 0x1b, 0xb8, 0xd9,
-	0xe8, 0x07, 0x6c, 0x29, 0xb7, 0x38, 0x38, 0x26, 0x50, 0x7d, 0xf7, 0xb0, 0xf4, 0xd6, 0x49, 0xa7,
-	0x8d, 0x52, 0x81, 0xa9, 0xd6, 0x46, 0x56, 0x20, 0xff, 0x80, 0x6e, 0xb3, 0xd6, 0xc6, 0xd3, 0x94,
-	0x4b, 0xb0, 0x30, 0x28, 0x17, 0xbf, 0x34, 0x83, 0x72, 0x01, 0x23, 0x1e, 0xcc, 0x62, 0xff, 0xd4,
-	0x6c, 0xdf, 0x7f, 0xe4, 0x7a, 0x4d, 0xcc, 0x0f, 0xd9, 0xcf, 0x22, 0x75, 0x29, 0xb5, 0xf3, 0x9f,
-	0xe3, 0x9d, 0xdf, 0x55, 0x38, 0xa8, 0x22, 0x64, 0x82, 0x3d, 0xf9, 0x1a, 0x4c, 0x8b, 0xc8, 0x5f,
-	0x77, 0x6f, 0x96, 0x71, 0x25, 0x14, 0xb4, 0xd8, 0x26, 0x7a, 0xa1, 0x7c, 0xaf, 0x42, 0x58, 0x18,
-	0x43, 0xa7, 0xbd, 0x63, 0xeb, 0x0f, 0xcf, 0x2a, 0x09, 0xa9, 0xc1, 0x64, 0x85, 0x3e, 0x74, 0x1a,
-	0x14, 0xe3, 0x2f, 0x08, 0x77, 0xc5, 0x30, 0xef, 0x71, 0x54, 0xc2, 0xb5, 0x31, 0x4d, 0x04, 0xf0,
-	0x68, 0x0e, 0xba, 0xab, 0x49, 0x88, 0x48, 0x6e, 0x40, 0xae, 0x5a, 0xa9, 0x09, 0x6f, 0xc5, 0xd9,
-	0x30, 0xbe, 0x5e, 0x4d, 0x66, 0x89, 0x45, 0x1b, 0x6e, 0xa7, 0xa9, 0xf9, 0x3a, 0x56, 0x2b, 0x35,
-	0xb2, 0x03, 0x53, 0xd8, 0x01, 0x6b, 0xd4, 0xe6, 0x7d, 0x3b, 0xd3, 0xa7, 0x6f, 0xaf, 0xa4, 0xf6,
-	0xed, 0x02, 0xef, 0xdb, 0x3d, 0x41, 0xad, 0xa5, 0xbd, 0x54, 0xd9, 0x32, 0xa1, 0x56, 0xa4, 0xe2,
-	0x95, 0xc9, 0x1a, 0x37, 0xd7, 0xd1, 0x46, 0x55, 0x08, 0xb5, 0x32, 0x73, 0x6f, 0x98, 0x3d, 0xb2,
-	0xaf, 0x33, 0x74, 0x92, 0x0f, 0xf9, 0x02, 0x8c, 0xdc, 0xdb, 0x0f, 0x6c, 0xe1, 0x97, 0x28, 0xfb,
-	0x91, 0x81, 0x64, 0xf3, 0x51, 0x0f, 0xe9, 0xee, 0x6b, 0x11, 0x9b, 0x91, 0x86, 0x0d, 0xc5, 0x9a,
-	0xed, 0x35, 0x1f, 0xd9, 0x1e, 0x06, 0xc1, 0x99, 0xd3, 0x58, 0x28, 0x25, 0x7c, 0x28, 0xf6, 0x04,
-	0x20, 0xf6, 0xc0, 0xa9, 0xb2, 0x20, 0xdf, 0x07, 0x67, 0x7d, 0x67, 0xb7, 0x63, 0x07, 0x3d, 0x8f,
-	0x5a, 0x76, 0x6b, 0xd7, 0xf5, 0x9c, 0x60, 0xaf, 0x6d, 0xf9, 0x3d, 0x27, 0xa0, 0xe8, 0x20, 0x38,
-	0x1d, 0xca, 0x8c, 0x75, 0x89, 0x57, 0x96, 0x68, 0x75, 0x86, 0x65, 0x9e, 0xf1, 0xd3, 0x0b, 0xc8,
-	0x97, 0x61, 0x4a, 0xdd, 0x92, 0xfd, 0x85, 0x53, 0xe7, 0x73, 0x17, 0xa7, 0xc3, 0xab, 0x47, 0x7c,
-	0x0b, 0x97, 0x19, 0x63, 0x94, 0x33, 0xc2, 0xd7, 0x33, 0xc6, 0x28, 0xbc, 0x88, 0x09, 0x67, 0x7c,
-	0xae, 0xdf, 0xe8, 0x75, 0x9c, 0xc7, 0x98, 0x15, 0x58, 0xd8, 0x32, 0x2f, 0x9c, 0xd6, 0x8e, 0xbe,
-	0x3a, 0x62, 0x6d, 0x6d, 0x54, 0xbf, 0xb4, 0xe5, 0x53, 0x4f, 0x98, 0x34, 0xcf, 0x73, 0xda, 0xad,
-	0x8e, 0xf3, 0x38, 0x82, 0x86, 0xe9, 0xfc, 0x49, 0x71, 0xce, 0x9c, 0x15, 0xab, 0x40, 0x8c, 0xdc,
-	0xdd, 0x9b, 0x65, 0x73, 0xbc, 0x56, 0xbd, 0x5f, 0x6f, 0xb9, 0x81, 0xb1, 0x07, 0xf3, 0x69, 0x5c,
-	0xc9, 0x02, 0x8c, 0x8b, 0xdc, 0x74, 0x78, 0x38, 0xe6, 0x4d, 0xf9, 0x93, 0x3c, 0x0b, 0x13, 0x3b,
-	0x8e, 0xe7, 0x07, 0x56, 0xcf, 0xe1, 0xf2, 0xc2, 0xa8, 0x99, 0x47, 0xc0, 0x96, 0xd3, 0x24, 0x67,
-	0x21, 0x8f, 0x6f, 0x5c, 0xac, 0x2c, 0x87, 0x65, 0xe3, 0xec, 0xf7, 0x96, 0xd3, 0x34, 0xfe, 0xcb,
-	0x0c, 0x1e, 0x41, 0xe4, 0x55, 0x0c, 0x22, 0x1b, 0xda, 0x9f, 0xa0, 0xfe, 0xd9, 0xee, 0xc6, 0x72,
-	0xbd, 0x71, 0x14, 0xf2, 0x3a, 0x8c, 0xdd, 0xb4, 0x1b, 0x34, 0x34, 0x6b, 0x40, 0xe4, 0x1d, 0x84,
-	0xa8, 0xca, 0x6a, 0x8e, 0xc3, 0xe4, 0x63, 0xbe, 0x34, 0xcb, 0x41, 0x40, 0x7d, 0xbe, 0x7f, 0xae,
-	0x94, 0xa5, 0x29, 0x03, 0xca, 0xc7, 0x62, 0x49, 0xdb, 0x11, 0x42, 0xcc, 0x25, 0x2d, 0x95, 0x83,
-	0xf1, 0x87, 0x99, 0x68, 0x4f, 0x25, 0xaf, 0xc0, 0x88, 0x59, 0x0b, 0xbf, 0x9f, 0x87, 0xe5, 0x89,
-	0x7d, 0x3e, 0x22, 0x90, 0x2f, 0xc3, 0x29, 0x85, 0x4f, 0xc2, 0x3f, 0xee, 0x65, 0x8c, 0x1a, 0xa3,
-	0x7c, 0x49, 0xba, 0x93, 0x5c, 0x3a, 0x0f, 0xbc, 0x0c, 0x44, 0x05, 0x15, 0xda, 0x71, 0x38, 0x6f,
-	0xa5, 0xb1, 0x2a, 0xef, 0x26, 0x22, 0xc4, 0x1b, 0x9b, 0xc6, 0x81, 0x07, 0x8d, 0x31, 0x7e, 0x23,
-	0xa3, 0xed, 0x95, 0xe4, 0x82, 0x26, 0xe7, 0xe2, 0xba, 0x8e, 0x29, 0x05, 0xb8, 0xc4, 0xfb, 0x26,
-	0x40, 0xb9, 0x17, 0xb8, 0xab, 0x1d, 0xcf, 0x6d, 0xb5, 0x44, 0xc4, 0x33, 0x1e, 0x8e, 0xa2, 0x17,
-	0xb8, 0x16, 0x45, 0xb0, 0x16, 0x8e, 0x22, 0x44, 0x4e, 0x75, 0x25, 0xcc, 0x7d, 0x5c, 0x57, 0x42,
-	0xe3, 0xe7, 0xb2, 0xda, 0x0e, 0xc3, 0xa4, 0x5c, 0x31, 0xe9, 0x55, 0x9b, 0xeb, 0xae, 0xf3, 0xd0,
-	0xf2, 0x5b, 0xae, 0x16, 0x7c, 0x4f, 0xa0, 0x91, 0xbf, 0x9c, 0x81, 0xd3, 0xdc, 0x27, 0x6f, 0xa3,
-	0xd7, 0xde, 0xa6, 0xde, 0x7d, 0xbb, 0xe5, 0x34, 0xa3, 0x10, 0xdd, 0x91, 0x01, 0xbe, 0x52, 0x4d,
-	0x3a, 0x3e, 0xbf, 0x68, 0x73, 0x1f, 0x41, 0xab, 0x83, 0x85, 0xd6, 0xc3, 0xb0, 0x54, 0xbd, 0x68,
-	0xa7, 0xd3, 0x93, 0x2a, 0x4c, 0xd6, 0x9c, 0x0e, 0xa6, 0x02, 0x8d, 0xa2, 0x58, 0xbc, 0xc2, 0x5d,
-	0x6c, 0xd9, 0x14, 0x6e, 0xec, 0xd1, 0x01, 0x5b, 0xb7, 0x4a, 0x6b, 0xfc, 0x4a, 0x06, 0x5e, 0x38,
-	0xf6, 0x83, 0xc9, 0x55, 0x18, 0x5f, 0x55, 0xd7, 0x3f, 0xb7, 0x04, 0x4a, 0xa6, 0xab, 0x94, 0x58,
-	0xe4, 0x2b, 0x70, 0x4a, 0x65, 0xb5, 0xe9, 0xd9, 0x8e, 0xea, 0x4d, 0x9c, 0xd2, 0x01, 0x01, 0x43,
-	0x89, 0x8b, 0xad, 0xe9, 0x4c, 0x8c, 0xff, 0x37, 0x03, 0x13, 0xa1, 0x3b, 0xd2, 0x53, 0x7a, 0x9d,
-	0xb9, 0xa1, 0x5d, 0x67, 0x64, 0xae, 0x83, 0xb0, 0x55, 0xdc, 0xf4, 0x28, 0xe5, 0x0a, 0x3a, 0xa3,
-	0x38, 0x6f, 0x21, 0xe0, 0x47, 0xb3, 0x30, 0xc9, 0xb6, 0x6a, 0xfe, 0xa6, 0xfd, 0xbd, 0x15, 0xf1,
-	0x3d, 0x6c, 0xd7, 0x50, 0x31, 0xb9, 0xff, 0x6d, 0x06, 0xdf, 0x3a, 0x54, 0x0a, 0xd6, 0x1b, 0x0c,
-	0xa4, 0xf6, 0x06, 0x3b, 0x51, 0x4d, 0x84, 0xf2, 0x08, 0xc5, 0xeb, 0xa2, 0x27, 0x44, 0x84, 0xe2,
-	0x96, 0xc9, 0x60, 0xe4, 0x8b, 0x30, 0xba, 0x85, 0x9a, 0x5b, 0x3d, 0xa2, 0x5e, 0xc8, 0x1f, 0x0b,
-	0xf9, 0x7e, 0xdf, 0xf3, 0xf5, 0xf0, 0xd5, 0x9c, 0x90, 0xd4, 0x61, 0x7c, 0xc5, 0xa3, 0x76, 0x40,
-	0x9b, 0xa2, 0x43, 0x86, 0x8a, 0x07, 0xd5, 0xe0, 0x24, 0xf1, 0x78, 0x50, 0x82, 0x13, 0xdb, 0xc7,
-	0x48, 0xd4, 0x46, 0xb4, 0xda, 0xf1, 0x9f, 0xda, 0x41, 0x7f, 0x4f, 0x1b, 0xf4, 0x73, 0x89, 0x41,
-	0xe7, 0xcd, 0x1b, 0x6a, 0xec, 0x7f, 0x33, 0x03, 0xa7, 0xd3, 0x09, 0xc9, 0x8b, 0x30, 0x76, 0x6f,
-	0xb3, 0x16, 0x59, 0xca, 0x61, 0x53, 0xdc, 0x2e, 0xaa, 0x4d, 0x4c, 0x51, 0x44, 0x2e, 0xc3, 0xd8,
-	0xfb, 0xe6, 0x4a, 0x64, 0x10, 0x86, 0x1b, 0xdc, 0xd7, 0x99, 0xe4, 0xa5, 0x9d, 0x6a, 0x02, 0x49,
-	0x1d, 0xdb, 0xdc, 0x13, 0x1b, 0xdb, 0x9f, 0xca, 0xc2, 0x4c, 0xb9, 0xd1, 0xa0, 0xbe, 0x2f, 0x32,
-	0x6c, 0x3d, 0xb5, 0x03, 0x9b, 0x1e, 0x6e, 0x51, 0x6b, 0xdb, 0x50, 0xa3, 0xfa, 0x5b, 0x19, 0x1e,
-	0x3c, 0x95, 0x51, 0x3d, 0x74, 0xe8, 0xa3, 0xcd, 0x3d, 0x8f, 0xfa, 0x7b, 0x6e, 0xab, 0x39, 0x74,
-	0x86, 0x57, 0x26, 0x33, 0x62, 0x16, 0x2a, 0xd5, 0xc0, 0x61, 0x07, 0x21, 0x9a, 0xcc, 0xc8, 0x33,
-	0x55, 0x5d, 0x85, 0xf1, 0x72, 0xb7, 0xeb, 0xb9, 0x0f, 0xf9, 0xb2, 0x17, 0x01, 0xea, 0x6d, 0x0e,
-	0xd2, 0x22, 0x60, 0x71, 0x10, 0xfb, 0x8c, 0x0a, 0xed, 0x1c, 0xa8, 0xe6, 0x69, 0x4d, 0xda, 0x51,
-	0x2f, 0x25, 0x58, 0x6e, 0xd4, 0x81, 0xd4, 0x3c, 0xb7, 0xed, 0x06, 0xb4, 0xc9, 0xdb, 0x83, 0x81,
-	0xc3, 0x8e, 0x8d, 0x35, 0xbc, 0xe9, 0x04, 0x2d, 0x2d, 0xd6, 0x70, 0xc0, 0x00, 0x26, 0x87, 0xb3,
-	0xb3, 0xfb, 0x9c, 0xd6, 0xa7, 0x15, 0xef, 0xc0, 0xec, 0x75, 0x56, 0x3b, 0x9e, 0xd3, 0xd8, 0x43,
-	0x1f, 0xd7, 0x0d, 0x00, 0x93, 0xda, 0xbe, 0xdb, 0x51, 0x84, 0xb5, 0x2b, 0x3c, 0xbf, 0x2d, 0x83,
-	0x26, 0xf5, 0x0e, 0xb3, 0x82, 0x53, 0x44, 0x65, 0x2a, 0x1c, 0x48, 0x19, 0xa6, 0xf8, 0x2f, 0xd6,
-	0x98, 0x6e, 0x28, 0x88, 0x3f, 0xcb, 0x3d, 0x4e, 0x91, 0x65, 0x17, 0x4b, 0xf4, 0x68, 0x14, 0x0a,
-	0x85, 0xf1, 0x7f, 0x8d, 0x42, 0x41, 0x1d, 0x52, 0x62, 0xf0, 0x64, 0x8d, 0xae, 0xa7, 0xc6, 0xef,
-	0xb3, 0x11, 0x62, 0x8a, 0x92, 0x28, 0xf8, 0x65, 0xf6, 0xd8, 0xe0, 0x97, 0x0f, 0x60, 0xaa, 0xe6,
-	0xb9, 0x18, 0xfe, 0x1f, 0x5f, 0x9b, 0xc5, 0xfe, 0x3d, 0xa7, 0x68, 0x0d, 0xd8, 0xec, 0xc3, 0xf7,
-	0x6c, 0xbc, 0x97, 0x75, 0x05, 0xb6, 0xc5, 0x44, 0x5f, 0x4d, 0x67, 0xa6, 0xf1, 0xe1, 0xa6, 0x32,
-	0xac, 0x25, 0x6a, 0x52, 0x1b, 0xde, 0x68, 0xdd, 0x54, 0x86, 0x41, 0xd4, 0x0d, 0x62, 0xf4, 0x49,
-	0x6d, 0x10, 0xe4, 0xe7, 0x32, 0x30, 0x59, 0xee, 0x74, 0x44, 0x50, 0xcd, 0x63, 0x42, 0x80, 0x7d,
-	0x45, 0x58, 0xcb, 0xbc, 0xf5, 0xb1, 0xac, 0x65, 0x50, 0xd8, 0xf2, 0x51, 0x52, 0x8f, 0x2a, 0xd4,
-	0x02, 0xe3, 0x44, 0x60, 0xf2, 0x16, 0x14, 0xc3, 0x95, 0x59, 0xed, 0x34, 0xe9, 0x63, 0xca, 0x73,
-	0xf5, 0x4f, 0x89, 0x9c, 0x42, 0xaa, 0x64, 0x1e, 0x47, 0x24, 0x9b, 0x00, 0x76, 0xb8, 0x24, 0xc4,
-	0x23, 0xde, 0xd9, 0xe8, 0xc1, 0x25, 0xb6, 0x66, 0xc4, 0xed, 0x01, 0x7f, 0xe3, 0x83, 0xa4, 0x7a,
-	0x7b, 0x88, 0xf8, 0x90, 0x36, 0xcc, 0x94, 0x7d, 0xbf, 0xd7, 0xa6, 0xf5, 0xc0, 0xf6, 0x02, 0x4c,
-	0x1c, 0x08, 0xc3, 0x9b, 0x81, 0xda, 0x48, 0xca, 0x66, 0x84, 0x17, 0x58, 0x29, 0x59, 0x04, 0xe3,
-	0xbc, 0x79, 0x06, 0x27, 0xf3, 0x4c, 0xf2, 0x7b, 0xf9, 0x4a, 0xfd, 0xa9, 0x0c, 0x9c, 0x56, 0x27,
-	0x7d, 0xbd, 0xb7, 0x2d, 0xd2, 0x26, 0x90, 0x2b, 0x30, 0x21, 0xe6, 0x64, 0x78, 0x89, 0x4c, 0xe6,
-	0x3f, 0x8c, 0x50, 0xc8, 0x2a, 0x9b, 0x86, 0x8c, 0x87, 0xb8, 0x75, 0xcc, 0xc5, 0x36, 0x57, 0x56,
-	0xb4, 0xbc, 0x10, 0x25, 0x70, 0x64, 0xbf, 0xf5, 0xf9, 0xc9, 0x20, 0xc6, 0xbb, 0x30, 0xab, 0x8f,
-	0x44, 0x9d, 0x06, 0xe4, 0x12, 0x8c, 0xcb, 0xe1, 0xcb, 0xa4, 0x0f, 0x9f, 0x2c, 0x37, 0x1e, 0x00,
-	0x49, 0xd0, 0xfb, 0x68, 0xd6, 0xc6, 0xee, 0xe7, 0xdc, 0xec, 0x52, 0x3e, 0x2a, 0x27, 0x10, 0x97,
-	0xe7, 0xc4, 0xf7, 0x4d, 0x6a, 0x8e, 0x8d, 0x98, 0x42, 0xe2, 0xb7, 0x8a, 0x30, 0x97, 0x72, 0x50,
-	0x1c, 0x23, 0xc8, 0x95, 0xf4, 0x0d, 0x62, 0x22, 0x8c, 0x20, 0x28, 0xb7, 0x85, 0x77, 0x61, 0xf4,
-	0xd8, 0xed, 0x80, 0xbb, 0xb5, 0xc6, 0x76, 0x01, 0x4e, 0xf6, 0xa9, 0x08, 0x73, 0x6a, 0xc4, 0xd0,
-	0xd1, 0x27, 0x16, 0x31, 0x14, 0x43, 0x06, 0x29, 0x9b, 0xb8, 0x1e, 0xc6, 0x88, 0xe7, 0xf3, 0x4c,
-	0x6c, 0x5b, 0x3a, 0x09, 0xe7, 0xe1, 0xbb, 0xad, 0x87, 0x54, 0xf0, 0x18, 0x57, 0x79, 0x60, 0x41,
-	0x2a, 0x0f, 0x85, 0x84, 0xfc, 0x83, 0x0c, 0x10, 0x01, 0x51, 0xf7, 0xac, 0xfc, 0xa0, 0x3d, 0xab,
-	0xf9, 0x64, 0xf6, 0xac, 0x73, 0xf2, 0x1b, 0xd3, 0xf7, 0xae, 0x94, 0xcf, 0x22, 0x7f, 0x2f, 0x03,
-	0xb3, 0x3c, 0xd2, 0xa4, 0xfa, 0xb1, 0x03, 0xa3, 0x07, 0x36, 0x9e, 0xcc, 0xc7, 0x3e, 0x27, 0x32,
-	0xb9, 0xa6, 0x7f, 0x6b, 0xf2, 0xa3, 0xc8, 0xf7, 0x01, 0x84, 0x2b, 0x8a, 0xa7, 0xd1, 0x98, 0x5c,
-	0x7a, 0x2e, 0x65, 0x17, 0x08, 0x91, 0xa2, 0xf4, 0x85, 0x41, 0x48, 0xa7, 0x6e, 0x9b, 0x11, 0x37,
-	0xf2, 0x17, 0x79, 0x0c, 0xfe, 0x10, 0x22, 0x82, 0xec, 0x2e, 0x4c, 0x62, 0x2d, 0x9f, 0xed, 0x2f,
-	0xc8, 0x5d, 0x49, 0x23, 0xe3, 0x49, 0x57, 0x42, 0x23, 0x6b, 0x2f, 0x68, 0xc7, 0xe3, 0xf0, 0xc7,
-	0x29, 0x30, 0x76, 0x35, 0x7e, 0x3d, 0x4f, 0x31, 0xd8, 0x67, 0x7f, 0x3b, 0x2b, 0xd7, 0x02, 0xdf,
-	0xdf, 0x62, 0xce, 0x48, 0x08, 0x22, 0xef, 0x03, 0x09, 0x43, 0x34, 0x72, 0x18, 0x95, 0xe9, 0x07,
-	0xf9, 0x63, 0x41, 0x14, 0xea, 0xd1, 0x93, 0xc5, 0xea, 0x24, 0x49, 0x12, 0x13, 0x0a, 0xf3, 0xa2,
-	0xd1, 0x0c, 0xca, 0x1d, 0x88, 0xab, 0x15, 0x7f, 0x61, 0x5a, 0x0b, 0x61, 0x1c, 0x95, 0x2c, 0x3f,
-	0x2f, 0xb3, 0xf5, 0x86, 0x9e, 0xc8, 0xba, 0x4b, 0x6f, 0x2a, 0x3b, 0x72, 0x03, 0x26, 0x30, 0xd4,
-	0xc8, 0x9a, 0x34, 0xd6, 0x13, 0x86, 0x43, 0x18, 0x94, 0xc4, 0xda, 0xd3, 0x4d, 0xee, 0x22, 0x54,
-	0x76, 0x87, 0xe1, 0x12, 0x20, 0xaa, 0xf4, 0x85, 0x92, 0xa6, 0xe9, 0x1d, 0x58, 0x5e, 0x4f, 0x0f,
-	0x63, 0x83, 0x48, 0xe4, 0x6b, 0x30, 0x79, 0xd7, 0x7e, 0x1c, 0x66, 0x05, 0x9e, 0x1d, 0x3e, 0xf7,
-	0x70, 0xdb, 0x7e, 0x1c, 0xa6, 0x04, 0x8e, 0x3b, 0x30, 0x29, 0x2c, 0xc9, 0x87, 0x00, 0xca, 0x3b,
-	0x03, 0x39, 0xb6, 0x82, 0x17, 0x64, 0x60, 0xee, 0xd4, 0xf7, 0x07, 0xe4, 0xaf, 0x30, 0x8c, 0x49,
-	0x0e, 0xf3, 0x9f, 0x9e, 0xe4, 0x70, 0xea, 0xd3, 0x93, 0x1c, 0xf8, 0x33, 0x17, 0x1f, 0x7b, 0xdc,
-	0xc1, 0x0f, 0x84, 0x96, 0x7f, 0x50, 0x6d, 0xcf, 0x49, 0x53, 0x50, 0x3c, 0x0a, 0x0e, 0x62, 0x55,
-	0xc4, 0xf8, 0x11, 0x0f, 0x8a, 0xf1, 0x8b, 0xc1, 0xc2, 0x19, 0xcd, 0xb2, 0x70, 0xe0, 0x25, 0x82,
-	0xab, 0x5b, 0xc5, 0x34, 0xb2, 0x68, 0x08, 0x57, 0x85, 0xba, 0x38, 0xcd, 0xe2, 0x36, 0x9c, 0xed,
-	0xbb, 0x21, 0xa4, 0xe4, 0x99, 0xb9, 0xaa, 0xe7, 0x99, 0x39, 0xdb, 0x4f, 0x70, 0xf0, 0xf5, 0xdc,
-	0x99, 0x73, 0xc5, 0xf9, 0xfe, 0x32, 0xd7, 0x77, 0xb2, 0x31, 0x41, 0x42, 0xdc, 0xf1, 0x78, 0xa6,
-	0xe9, 0x7e, 0x92, 0x56, 0xb6, 0x5a, 0x61, 0x97, 0x3a, 0x14, 0x35, 0x94, 0x4c, 0x5f, 0x4c, 0xd4,
-	0x50, 0x45, 0x15, 0x14, 0x3a, 0x3e, 0xa9, 0x4c, 0xf1, 0x36, 0x4c, 0xd7, 0xa9, 0xed, 0x35, 0xf6,
-	0xee, 0xd0, 0x83, 0x47, 0xae, 0xd7, 0xe4, 0x19, 0x69, 0xc5, 0xcd, 0xc2, 0xc7, 0x12, 0x3d, 0x64,
-	0x83, 0x8a, 0x4b, 0x2a, 0x32, 0x26, 0xc7, 0x28, 0xd6, 0x7e, 0x36, 0x75, 0x6f, 0x66, 0x08, 0x83,
-	0xc2, 0x75, 0x90, 0x37, 0x42, 0xf1, 0x93, 0x7a, 0x6a, 0x06, 0x4d, 0x4f, 0x02, 0x53, 0xa4, 0x50,
-	0xea, 0x19, 0xbf, 0x97, 0x03, 0xc2, 0x6b, 0x5a, 0xb1, 0xbb, 0x36, 0x46, 0xac, 0x71, 0x30, 0x2c,
-	0x6d, 0x51, 0xe0, 0xd8, 0xdb, 0x2d, 0xaa, 0xc6, 0x74, 0x16, 0x26, 0xdf, 0x61, 0x99, 0x15, 0xbf,
-	0xbe, 0x25, 0x08, 0xfb, 0x6c, 0xe0, 0xd9, 0x4f, 0xb2, 0x81, 0x7f, 0x0d, 0x9e, 0x2d, 0x77, 0xbb,
-	0x2d, 0xa7, 0x11, 0xd6, 0x72, 0xd3, 0xf5, 0xe4, 0x72, 0xd1, 0x62, 0x21, 0xd8, 0x21, 0x5a, 0xe2,
-	0x4b, 0x07, 0xb1, 0x50, 0xa4, 0x2f, 0x7e, 0xe1, 0x55, 0x63, 0x6b, 0x49, 0xe9, 0x2b, 0xed, 0x8a,
-	0xac, 0x90, 0x48, 0x1e, 0x8e, 0x27, 0xa5, 0xaf, 0xd1, 0x28, 0x53, 0x8c, 0x7c, 0xe1, 0x4e, 0x97,
-	0xe0, 0x42, 0x12, 0xf2, 0x36, 0x4c, 0x96, 0x7b, 0x81, 0x2b, 0x18, 0x0b, 0x5f, 0x85, 0xc8, 0xab,
-	0x40, 0x7c, 0x8a, 0x76, 0xa1, 0x8b, 0xd0, 0x8d, 0x3f, 0xc8, 0xc1, 0xd9, 0xe4, 0xf0, 0x8a, 0xd2,
-	0x70, 0x7d, 0x64, 0x8e, 0x59, 0x1f, 0x69, 0xb3, 0x21, 0x1b, 0xe5, 0x0e, 0x7c, 0x12, 0xb3, 0x21,
-	0x87, 0xec, 0x3e, 0xe6, 0x6c, 0xa8, 0xc3, 0xa4, 0x7a, 0x8a, 0x8f, 0x7c, 0xdc, 0x53, 0x5c, 0xe5,
-	0x42, 0x2e, 0xc1, 0x28, 0x0f, 0x29, 0x36, 0x1a, 0x3d, 0x08, 0xc6, 0xa3, 0x89, 0x71, 0x0c, 0xf2,
-	0xff, 0x83, 0xf3, 0x7c, 0x4f, 0x8a, 0x37, 0x76, 0xf9, 0x40, 0x72, 0x14, 0x03, 0xb7, 0x74, 0x74,
-	0x58, 0xba, 0xc2, 0xb5, 0x56, 0x56, 0xa2, 0xdb, 0xac, 0xed, 0x03, 0x4b, 0x7e, 0x99, 0x52, 0xc9,
-	0xb1, 0xbc, 0x8d, 0xc7, 0x70, 0x56, 0x94, 0x46, 0xc1, 0x6c, 0x64, 0x21, 0x1b, 0xe4, 0xfd, 0x48,
-	0xf1, 0x88, 0x83, 0x1c, 0xd3, 0x29, 0x62, 0x39, 0xb9, 0x0e, 0xf9, 0x72, 0xad, 0xca, 0xb3, 0x99,
-	0x2b, 0xa1, 0x88, 0xec, 0xae, 0xc3, 0xa3, 0xae, 0x68, 0xd1, 0x0d, 0x04, 0xa2, 0xf1, 0xeb, 0x19,
-	0x80, 0xa8, 0xd3, 0xc8, 0xe5, 0x34, 0xf7, 0x31, 0x9e, 0x8e, 0x8a, 0x83, 0x75, 0xcf, 0x31, 0xa9,
-	0x13, 0xcd, 0xa6, 0xea, 0x44, 0xa5, 0x52, 0x2d, 0x97, 0xaa, 0x54, 0xab, 0xc0, 0x4c, 0xbd, 0xb7,
-	0x2d, 0xeb, 0x8e, 0x07, 0xbf, 0xf0, 0x7b, 0xdb, 0x69, 0x5d, 0x19, 0x27, 0x31, 0x7e, 0x2c, 0x0b,
-	0x85, 0x5a, 0xab, 0xb7, 0xeb, 0x74, 0x2a, 0x76, 0x60, 0x3f, 0xb5, 0x6a, 0xda, 0x37, 0x35, 0x35,
-	0x6d, 0xe8, 0x25, 0x19, 0x36, 0x6c, 0x28, 0x1d, 0xed, 0xcf, 0x66, 0x60, 0x26, 0x22, 0xe1, 0x27,
-	0xfc, 0x1a, 0x8c, 0xb0, 0x1f, 0x42, 0x0f, 0x70, 0x3e, 0xc1, 0x18, 0xb1, 0xae, 0x84, 0x7f, 0x09,
-	0xc5, 0xa9, 0x9e, 0xca, 0x1b, 0x39, 0x2c, 0x7e, 0x0e, 0x26, 0x22, 0xb6, 0x49, 0xc1, 0x61, 0x5e,
-	0x15, 0x1c, 0x26, 0xd4, 0x4c, 0x74, 0xbf, 0x9a, 0x81, 0x62, 0xbc, 0x25, 0xe4, 0x0e, 0x8c, 0x33,
-	0x4e, 0x0e, 0x95, 0x2a, 0x8a, 0x97, 0xfa, 0xb4, 0xf9, 0x8a, 0x40, 0xe3, 0x9f, 0x87, 0x9d, 0x4f,
-	0x39, 0xc4, 0x94, 0x1c, 0x16, 0x4d, 0x28, 0xa8, 0x58, 0x29, 0x5f, 0xf7, 0xba, 0x2e, 0xd6, 0x9c,
-	0x4e, 0xef, 0x07, 0xf5, 0xab, 0xff, 0x86, 0xf6, 0xd5, 0x42, 0x62, 0xb9, 0xa0, 0x4d, 0xae, 0xd4,
-	0xa5, 0x88, 0x93, 0x06, 0x13, 0xee, 0x89, 0x7d, 0x23, 0xab, 0x86, 0x82, 0x4c, 0x4c, 0xe8, 0x10,
-	0x8f, 0xbc, 0x0e, 0x63, 0xbc, 0x3e, 0x35, 0xaf, 0x77, 0x17, 0x21, 0xea, 0x95, 0x81, 0xe3, 0x18,
-	0x7f, 0x33, 0x07, 0xa7, 0xa3, 0xcf, 0xdb, 0xea, 0x36, 0xed, 0x80, 0xd6, 0x6c, 0xcf, 0x6e, 0xfb,
-	0xc7, 0xac, 0x80, 0x8b, 0x89, 0x4f, 0x13, 0x61, 0x15, 0x38, 0x4c, 0xf9, 0x20, 0x23, 0xf6, 0x41,
-	0xa8, 0x0e, 0xe6, 0x1f, 0x24, 0x3f, 0x83, 0xdc, 0x81, 0x5c, 0x9d, 0x06, 0x62, 0xc3, 0xbe, 0x90,
-	0xe8, 0x55, 0xf5, 0xbb, 0xae, 0xd4, 0x69, 0xc0, 0x07, 0x91, 0x07, 0xd9, 0xd4, 0x02, 0x18, 0x30,
-	0x2e, 0xe4, 0x01, 0x8c, 0xad, 0x3e, 0xee, 0xd2, 0x46, 0x80, 0x99, 0x95, 0x14, 0x4f, 0xfe, 0x74,
-	0x7e, 0x1c, 0x97, 0xb3, 0x9c, 0x17, 0x32, 0xb8, 0x9e, 0xcd, 0x50, 0xb0, 0x5b, 0xbc, 0x01, 0x79,
-	0x59, 0xf9, 0x49, 0x66, 0xee, 0xe2, 0x9b, 0x30, 0xa9, 0x54, 0x72, 0xa2, 0x49, 0xff, 0x0b, 0x6c,
-	0x5f, 0x75, 0x5b, 0x54, 0x4c, 0x9c, 0xd5, 0x84, 0x80, 0xa9, 0x24, 0x25, 0xe6, 0x02, 0xa6, 0xb5,
-	0x2f, 0x8a, 0x06, 0x48, 0x9a, 0x55, 0x98, 0xa9, 0xef, 0x3b, 0xdd, 0x28, 0x11, 0x87, 0x76, 0x8c,
-	0x63, 0xe2, 0x53, 0xa1, 0xc3, 0x88, 0x1f, 0xe3, 0x71, 0x3a, 0xe3, 0x4f, 0x32, 0x30, 0xc6, 0xfe,
-	0xba, 0x7f, 0xe3, 0x29, 0xdd, 0x32, 0xaf, 0x6b, 0x5b, 0xe6, 0xac, 0x92, 0x58, 0x0b, 0x37, 0x8e,
-	0x1b, 0xc7, 0x6c, 0x96, 0x87, 0x62, 0x80, 0x38, 0x32, 0xb9, 0x05, 0xe3, 0xc2, 0x36, 0x4e, 0xb8,
-	0x31, 0xa8, 0x99, 0xba, 0xa4, 0xd5, 0x5c, 0xa8, 0xec, 0x70, 0xbb, 0x71, 0xed, 0x90, 0xa4, 0x66,
-	0x97, 0x01, 0x99, 0x12, 0x45, 0x4d, 0xd4, 0xc9, 0xd8, 0xac, 0xb8, 0x1d, 0x9e, 0x67, 0xca, 0x5f,
-	0x3e, 0x23, 0x38, 0xf5, 0x0b, 0x54, 0x54, 0x16, 0xaf, 0x59, 0xb9, 0x41, 0x4c, 0x4e, 0x0b, 0x26,
-	0xe9, 0x0f, 0x5d, 0x6d, 0x38, 0x5d, 0xaf, 0xaf, 0xa1, 0x1d, 0x6d, 0xcd, 0xf5, 0x82, 0x9b, 0xae,
-	0xf7, 0x48, 0xc4, 0x63, 0xa9, 0xeb, 0x36, 0x24, 0x69, 0xd6, 0x8d, 0xaf, 0xa4, 0x5a, 0x37, 0x0e,
-	0xb0, 0x33, 0x31, 0x3a, 0x70, 0xa6, 0x5e, 0x5f, 0xe3, 0x59, 0x9e, 0xfe, 0x34, 0xea, 0xfb, 0xd5,
-	0x0c, 0xcc, 0xd6, 0xeb, 0x6b, 0xb1, 0xaa, 0xd6, 0x65, 0x7a, 0xa9, 0x8c, 0xf6, 0x90, 0x9d, 0xde,
-	0x11, 0x38, 0x0a, 0x19, 0x2e, 0x16, 0x36, 0xb4, 0x20, 0xe1, 0x9c, 0x09, 0xa9, 0x85, 0x09, 0xad,
-	0xb2, 0x9a, 0x6b, 0x4b, 0x9f, 0x86, 0xa2, 0xb2, 0x5f, 0x38, 0x86, 0xb2, 0x52, 0x5d, 0xd9, 0xcf,
-	0x20, 0xc6, 0xbf, 0x38, 0xcd, 0x53, 0x66, 0xc9, 0xd9, 0xf2, 0x0e, 0x14, 0x04, 0x3d, 0xfa, 0x7f,
-	0x08, 0x9b, 0x9e, 0xb3, 0x6c, 0x83, 0xdc, 0xe1, 0x70, 0x9e, 0xfd, 0xe4, 0xbb, 0x87, 0xa5, 0x11,
-	0xd6, 0x35, 0xa6, 0x86, 0x4e, 0xee, 0xc1, 0xd4, 0x5d, 0xfb, 0xb1, 0xa2, 0xd9, 0xe1, 0xde, 0x7d,
-	0x97, 0xd8, 0xae, 0xd2, 0xb6, 0x1f, 0x0f, 0x61, 0x3d, 0xaa, 0xd3, 0x93, 0x7d, 0x98, 0xd6, 0xdb,
-	0x24, 0x66, 0x60, 0x72, 0xc4, 0xae, 0xa5, 0x8e, 0xd8, 0xd9, 0xae, 0xeb, 0x05, 0xd6, 0x4e, 0x48,
-	0xae, 0xa5, 0x87, 0x8b, 0xb1, 0x26, 0xef, 0xc0, 0xac, 0x12, 0x8a, 0xfd, 0xa6, 0xeb, 0xb5, 0x6d,
-	0x79, 0x4b, 0xc3, 0xe7, 0x0e, 0x34, 0x2b, 0xdb, 0x41, 0xb0, 0x99, 0xc4, 0x24, 0x5f, 0x4e, 0xf3,
-	0x98, 0x1c, 0x8d, 0x4c, 0x68, 0x53, 0x3c, 0x26, 0xfb, 0x99, 0xd0, 0x26, 0x7d, 0x27, 0x77, 0x07,
-	0x99, 0xd8, 0xe7, 0x79, 0xeb, 0x87, 0x32, 0xa1, 0x0f, 0x47, 0xae, 0x8f, 0x29, 0xfd, 0x12, 0xe4,
-	0x96, 0x6b, 0x37, 0xf1, 0x91, 0x4e, 0xda, 0xd3, 0x75, 0xf6, 0xec, 0x4e, 0x03, 0x6f, 0x4f, 0xc2,
-	0xb1, 0x45, 0x3d, 0x28, 0x97, 0x6b, 0x37, 0x89, 0x0d, 0x73, 0x98, 0xee, 0x3b, 0xf8, 0xd2, 0xb5,
-	0x6b, 0xca, 0x50, 0xe5, 0xf1, 0xd3, 0xae, 0x8a, 0x4f, 0x2b, 0x61, 0xb2, 0xf0, 0xc0, 0x7a, 0x7c,
-	0xed, 0x5a, 0xea, 0x80, 0x84, 0x1f, 0x96, 0xc6, 0x8b, 0x1d, 0x58, 0x77, 0xed, 0xc7, 0x91, 0x3f,
-	0x92, 0x2f, 0x7c, 0xcf, 0xcf, 0xc9, 0xa9, 0x15, 0xf9, 0x32, 0x69, 0x07, 0x96, 0x4e, 0xc4, 0x2e,
-	0xbf, 0xd1, 0x04, 0xf3, 0x85, 0xd7, 0xde, 0xa2, 0xd4, 0x5c, 0xca, 0x00, 0x05, 0xea, 0x0d, 0x4e,
-	0x41, 0x27, 0x5b, 0xe1, 0x15, 0x9e, 0x5f, 0x81, 0xd1, 0xd0, 0x7d, 0x62, 0xf9, 0xaa, 0x7a, 0x85,
-	0xe7, 0xfa, 0x42, 0xad, 0x59, 0x33, 0xa1, 0xde, 0x87, 0x3b, 0x68, 0x99, 0x3a, 0x97, 0xa4, 0x66,
-	0xa0, 0x70, 0x72, 0xcd, 0x00, 0x85, 0x91, 0x75, 0xb7, 0xb1, 0x2f, 0x22, 0x1d, 0xbf, 0xcf, 0x76,
-	0xe1, 0x96, 0xdb, 0xd8, 0x7f, 0x72, 0xae, 0x03, 0xc8, 0x9e, 0x6c, 0xf0, 0xe8, 0x3b, 0x5e, 0x53,
-	0xf4, 0x89, 0x30, 0x47, 0x9f, 0x0f, 0xaf, 0xc6, 0x4a, 0x59, 0x14, 0x93, 0xc7, 0x6b, 0xca, 0xae,
-	0x35, 0x75, 0x72, 0x42, 0xa1, 0x58, 0xa1, 0xfe, 0x7e, 0xe0, 0x76, 0x57, 0x5a, 0x4e, 0x17, 0x03,
-	0x5a, 0x89, 0x54, 0x39, 0x43, 0xef, 0xc9, 0x4d, 0x4e, 0x6f, 0x35, 0x24, 0x03, 0x33, 0xc1, 0x92,
-	0x7c, 0x19, 0xa6, 0xd9, 0xe4, 0x5e, 0x7d, 0x1c, 0xd0, 0x0e, 0x1f, 0xf9, 0x59, 0x94, 0xe8, 0xe6,
-	0x95, 0x44, 0x93, 0x61, 0x21, 0x9f, 0x53, 0xb8, 0xd8, 0x69, 0x48, 0xa0, 0x45, 0x89, 0xd6, 0x58,
-	0x91, 0x26, 0x2c, 0xdc, 0xb5, 0x1f, 0x47, 0x17, 0x65, 0x75, 0x92, 0x12, 0x9c, 0x60, 0x17, 0x8f,
-	0x0e, 0x4b, 0x2f, 0xb1, 0x09, 0x16, 0x65, 0x6f, 0xea, 0x33, 0x5f, 0xfb, 0x72, 0x22, 0xdf, 0x80,
-	0x33, 0xa2, 0x59, 0x15, 0x4c, 0x88, 0xed, 0x7a, 0x07, 0xf5, 0x3d, 0x1b, 0x5d, 0x11, 0xe7, 0xfa,
-	0x74, 0xd8, 0xd5, 0xf4, 0x2d, 0x51, 0x76, 0x58, 0x53, 0xf2, 0xb1, 0x7c, 0xce, 0xc8, 0xec, 0x57,
-	0x03, 0xf9, 0x08, 0xa6, 0xf9, 0xcb, 0xe4, 0x9a, 0xeb, 0x07, 0xa8, 0xe1, 0x99, 0x3f, 0x99, 0x7f,
-	0x0d, 0x7f, 0xee, 0xe4, 0x3e, 0x69, 0x31, 0x8d, 0x50, 0x8c, 0x33, 0x79, 0x0b, 0x4d, 0x58, 0x79,
-	0x1c, 0xf7, 0x6a, 0x0d, 0x35, 0xec, 0xe2, 0x04, 0xea, 0x3a, 0x1d, 0x4b, 0xaa, 0x59, 0xba, 0xe1,
-	0x76, 0xa1, 0x62, 0x93, 0x07, 0x30, 0x59, 0xaf, 0xaf, 0xdd, 0x74, 0x98, 0x5c, 0xd2, 0x95, 0x0a,
-	0xf3, 0xe4, 0x57, 0xbe, 0x98, 0xfa, 0x95, 0x53, 0xbe, 0xbf, 0x67, 0x61, 0xce, 0xe6, 0x86, 0xdb,
-	0x3d, 0x30, 0x55, 0x4e, 0x29, 0x3e, 0x27, 0x67, 0x9e, 0xb0, 0xcf, 0x49, 0x15, 0x66, 0x14, 0x3b,
-	0x6a, 0x34, 0xcb, 0x59, 0x88, 0x82, 0x7f, 0xaa, 0x3e, 0x26, 0x71, 0x2f, 0xeb, 0x38, 0x9d, 0x74,
-	0x36, 0x39, 0x7b, 0x52, 0x67, 0x13, 0x07, 0x66, 0xf9, 0x60, 0x88, 0x79, 0x80, 0x23, 0xbd, 0xd8,
-	0xa7, 0x0f, 0x2f, 0xa5, 0xf6, 0xe1, 0x9c, 0x18, 0x69, 0x39, 0xc9, 0xf0, 0x25, 0x3e, 0xc9, 0x95,
-	0xec, 0x00, 0x11, 0x40, 0x3b, 0xb0, 0xb7, 0x6d, 0x9f, 0x62, 0x5d, 0xcf, 0xf6, 0xa9, 0xeb, 0xa5,
-	0xd4, 0xba, 0xa6, 0x65, 0x5d, 0xdb, 0xbc, 0x9a, 0x14, 0x8e, 0xa4, 0x23, 0xeb, 0x91, 0xf3, 0x0b,
-	0x3b, 0xf6, 0x39, 0x4d, 0x31, 0x9e, 0x44, 0xe0, 0x71, 0x34, 0xe3, 0x93, 0x36, 0xde, 0xef, 0x29,
-	0x9c, 0xc9, 0x63, 0x38, 0x9d, 0xfc, 0x0a, 0xac, 0xf3, 0x1c, 0xd6, 0x79, 0x4e, 0xab, 0x33, 0x8e,
-	0xc4, 0xe7, 0x8d, 0xde, 0xac, 0x78, 0xad, 0x7d, 0xf8, 0x93, 0x1f, 0xc9, 0xc0, 0x99, 0xbb, 0x37,
-	0xcb, 0xf7, 0xa9, 0xc7, 0xc5, 0x12, 0xc7, 0xed, 0x84, 0xde, 0xe9, 0xcf, 0x8b, 0xc7, 0x93, 0xf8,
-	0xc3, 0x91, 0x94, 0x38, 0x70, 0xab, 0x60, 0xa2, 0xfb, 0x8b, 0xed, 0x1d, 0xdb, 0x7a, 0xa8, 0xb0,
-	0x48, 0x71, 0x61, 0xff, 0xd6, 0xef, 0x97, 0x32, 0x66, 0xbf, 0xaa, 0x48, 0x0b, 0x16, 0xf5, 0x6e,
-	0x91, 0xee, 0x40, 0x7b, 0xb4, 0xd5, 0x5a, 0x28, 0xe1, 0x8c, 0x7e, 0xfd, 0xe8, 0xb0, 0x74, 0x31,
-	0xd1, 0xbb, 0xa1, 0x8b, 0x11, 0xc3, 0x54, 0x1a, 0x3c, 0x80, 0x1f, 0x69, 0xa7, 0x08, 0xdd, 0x0b,
-	0xe7, 0xb5, 0x30, 0x56, 0x89, 0xf2, 0x30, 0xcc, 0xda, 0x39, 0xb6, 0xde, 0xfb, 0x0a, 0x88, 0x66,
-	0x92, 0xf3, 0xed, 0x91, 0xfc, 0x54, 0x71, 0x3a, 0xc5, 0x4f, 0xc6, 0xf8, 0x76, 0x36, 0x76, 0x30,
-	0x92, 0x2a, 0x8c, 0x8b, 0xf9, 0xde, 0xf7, 0x92, 0x71, 0x2e, 0x75, 0x56, 0x8f, 0x8b, 0xa5, 0x63,
-	0x4a, 0x7a, 0xf2, 0x88, 0xb1, 0xc2, 0x46, 0x8b, 0x1b, 0xef, 0x87, 0xfc, 0xdc, 0x43, 0x90, 0x76,
-	0xc2, 0x57, 0x4e, 0xee, 0x53, 0xaa, 0xbb, 0x2c, 0xe3, 0x51, 0x2f, 0x6b, 0x23, 0xfb, 0x3c, 0xef,
-	0x6f, 0x2e, 0x74, 0x4b, 0xd4, 0x93, 0xfc, 0x3e, 0xb1, 0x0a, 0x59, 0x2d, 0xc6, 0x6f, 0x64, 0x60,
-	0x4a, 0x3b, 0x59, 0xc9, 0x0d, 0xc5, 0xeb, 0x36, 0x0a, 0x44, 0xa1, 0xe1, 0xe0, 0x66, 0x1b, 0xf7,
-	0xc7, 0xbd, 0xa1, 0x04, 0x70, 0xec, 0x43, 0x87, 0x8b, 0x2d, 0xee, 0x84, 0x3d, 0x58, 0x3f, 0x5c,
-	0x82, 0x51, 0x1e, 0xc1, 0x67, 0x24, 0x32, 0xba, 0x44, 0xfd, 0x8a, 0xc9, 0xe1, 0xc6, 0x7f, 0x5a,
-	0x82, 0x69, 0xfd, 0x46, 0x4c, 0x5e, 0x87, 0x31, 0x54, 0xe8, 0x4b, 0xf5, 0x0a, 0xaa, 0x85, 0x50,
-	0xe7, 0xaf, 0xf9, 0x25, 0x71, 0x1c, 0xf2, 0x32, 0x40, 0x68, 0xc0, 0x2f, 0x9f, 0xb3, 0x46, 0x8f,
-	0x0e, 0x4b, 0x99, 0xcb, 0xa6, 0x52, 0x40, 0xbe, 0x0a, 0xb0, 0xe1, 0x36, 0xa9, 0x48, 0x63, 0x99,
-	0x1b, 0x64, 0x88, 0xf2, 0x4a, 0x22, 0x8d, 0xe5, 0xa9, 0x8e, 0xdb, 0xa4, 0xc9, 0x9c, 0x95, 0x0a,
-	0x47, 0xf2, 0x05, 0x18, 0x35, 0x7b, 0x2d, 0x2a, 0x9f, 0x3d, 0x26, 0xe5, 0x09, 0xd7, 0x6b, 0xd1,
-	0x48, 0x4f, 0xe0, 0xf5, 0xe2, 0x36, 0x96, 0x0c, 0x40, 0xde, 0xe3, 0xe9, 0x2d, 0x45, 0xc0, 0xf5,
-	0xd1, 0xe8, 0x81, 0x4f, 0x91, 0x7c, 0x12, 0x21, 0xd7, 0x15, 0x12, 0x72, 0x0f, 0xc6, 0xd5, 0x97,
-	0x29, 0x25, 0x7c, 0x83, 0xfa, 0x7a, 0xa9, 0x28, 0x1d, 0x44, 0xe4, 0xd9, 0xf8, 0xa3, 0x95, 0xe4,
-	0x42, 0xde, 0x86, 0x09, 0xc6, 0x9e, 0xed, 0x1c, 0xbe, 0xb8, 0xd5, 0xe0, 0x33, 0x9e, 0xf2, 0x41,
-	0x6c, 0xf7, 0xd1, 0xc2, 0xa2, 0x87, 0x04, 0xe4, 0xcb, 0x30, 0x51, 0xee, 0x76, 0x45, 0x57, 0x0f,
-	0x34, 0x50, 0xba, 0x90, 0xe8, 0xea, 0x79, 0xbb, 0xdb, 0x4d, 0xf6, 0x74, 0xc4, 0x8f, 0xec, 0x86,
-	0xd1, 0x03, 0x87, 0x49, 0x49, 0xfa, 0x6a, 0xa2, 0x82, 0x05, 0x19, 0x10, 0x2f, 0x51, 0x89, 0xce,
-	0x97, 0x74, 0xa1, 0x18, 0x09, 0x95, 0xa2, 0x2e, 0x18, 0x54, 0xd7, 0xe5, 0x44, 0x5d, 0xea, 0x00,
-	0x26, 0xaa, 0x4b, 0x70, 0x27, 0x4d, 0x98, 0x96, 0x07, 0x94, 0xa8, 0x6f, 0x72, 0x50, 0x7d, 0x2f,
-	0x27, 0xea, 0x9b, 0x6b, 0x6e, 0x27, 0xeb, 0x89, 0xf1, 0x24, 0x6f, 0xc3, 0x94, 0x84, 0xe0, 0xfa,
-	0x40, 0xc3, 0x20, 0xa1, 0x10, 0x6c, 0x6e, 0xa3, 0xcb, 0x90, 0xd6, 0x2b, 0x1a, 0xb2, 0x4a, 0xcd,
-	0x67, 0xc7, 0x94, 0x46, 0x1d, 0x9f, 0x15, 0x3a, 0x32, 0xf9, 0x00, 0x26, 0xab, 0x6d, 0xd6, 0x10,
-	0xb7, 0x63, 0x07, 0x54, 0x38, 0xf6, 0x4a, 0x63, 0x2b, 0xa5, 0x44, 0x99, 0xaa, 0x68, 0x66, 0xe2,
-	0x44, 0x45, 0xea, 0x35, 0x53, 0xa1, 0x60, 0x9d, 0xc7, 0x9f, 0x22, 0xc5, 0x1c, 0x96, 0x4e, 0xbf,
-	0xe7, 0x52, 0x0c, 0x9e, 0x14, 0xf6, 0x22, 0xb8, 0x36, 0x83, 0xca, 0xa7, 0xc0, 0x58, 0x62, 0x03,
-	0x95, 0x27, 0x79, 0x07, 0x26, 0x45, 0xb6, 0xe6, 0xb2, 0xb9, 0xe1, 0x2f, 0x14, 0x23, 0x7b, 0x6d,
-	0x99, 0xd8, 0xd9, 0xb2, 0xbd, 0x98, 0x65, 0x6f, 0x84, 0x4f, 0xbe, 0x04, 0xf3, 0x0f, 0x9c, 0x4e,
-	0xd3, 0x7d, 0xe4, 0x8b, 0x63, 0x4a, 0x6c, 0x74, 0xb3, 0x91, 0x5f, 0xe1, 0x23, 0x5e, 0x1e, 0xca,
-	0x82, 0x89, 0x8d, 0x2f, 0x95, 0x03, 0xf9, 0x81, 0x04, 0x67, 0x3e, 0x83, 0xc8, 0xa0, 0x19, 0xb4,
-	0x94, 0x98, 0x41, 0xc9, 0xea, 0xe3, 0xd3, 0x29, 0xb5, 0x1a, 0xe2, 0x02, 0xd1, 0xcf, 0xf7, 0xdb,
-	0xae, 0xd3, 0x59, 0x98, 0xc3, 0xbd, 0xf0, 0xd9, 0x78, 0x78, 0x10, 0xc4, 0xab, 0xb9, 0x2d, 0xa7,
-	0x71, 0xb0, 0x6c, 0x1c, 0x1d, 0x96, 0x9e, 0x8f, 0xcb, 0xfc, 0x1f, 0xb9, 0xda, 0x73, 0x49, 0x0a,
-	0x6b, 0xf2, 0x01, 0x14, 0xd8, 0xff, 0xa1, 0x52, 0x62, 0x5e, 0x33, 0x91, 0x55, 0x30, 0x45, 0x3d,
-	0x38, 0x46, 0x98, 0x4e, 0x3a, 0x45, 0x5f, 0xa1, 0xb1, 0x22, 0x6f, 0x02, 0x30, 0xb1, 0x49, 0x6c,
-	0xc7, 0xa7, 0xa2, 0x3c, 0x12, 0x28, 0x75, 0x25, 0x37, 0xe2, 0x08, 0x99, 0xbc, 0x0d, 0x93, 0xec,
-	0x57, 0xbd, 0xd7, 0x74, 0xd9, 0xda, 0x38, 0x8d, 0xb4, 0xdc, 0xc7, 0x9a, 0xd1, 0xfa, 0x1c, 0xae,
-	0xf9, 0x58, 0x47, 0xe8, 0x64, 0x0d, 0x66, 0x30, 0xdf, 0x87, 0x88, 0x34, 0xef, 0x50, 0x7f, 0xe1,
-	0x8c, 0x62, 0x42, 0x81, 0x29, 0x55, 0x9d, 0xb0, 0x4c, 0xbd, 0xcb, 0xc4, 0xc8, 0x88, 0x0f, 0x73,
-	0xc9, 0x37, 0x68, 0x7f, 0x61, 0x01, 0x3b, 0x49, 0x4a, 0xf0, 0x49, 0x0c, 0xbe, 0x1f, 0xb3, 0x11,
-	0x51, 0x36, 0x2e, 0xf9, 0xa8, 0xa4, 0x56, 0x98, 0xc6, 0x9d, 0x98, 0x40, 0x6e, 0xad, 0xd4, 0xe2,
-	0x09, 0x31, 0xce, 0x62, 0x0b, 0x70, 0x98, 0x77, 0x1b, 0x5d, 0x6b, 0x40, 0x52, 0x8c, 0x14, 0x6a,
-	0xf2, 0xfd, 0x70, 0x4a, 0xee, 0x20, 0xa2, 0x48, 0xcc, 0xeb, 0xc5, 0x13, 0xee, 0xc4, 0xcd, 0xed,
-	0xb0, 0xea, 0xc4, 0x94, 0x4e, 0xaf, 0x82, 0xd8, 0x30, 0x89, 0xc3, 0x2a, 0x6a, 0x7c, 0x76, 0x50,
-	0x8d, 0x17, 0x13, 0x35, 0x9e, 0xc6, 0x89, 0x92, 0xac, 0x4c, 0xe5, 0x49, 0x96, 0x61, 0x4a, 0xac,
-	0x23, 0x31, 0xdb, 0x9e, 0xc3, 0xde, 0x42, 0x25, 0x96, 0x5c, 0x81, 0x89, 0x09, 0xa7, 0x93, 0xa8,
-	0x3b, 0x32, 0x7f, 0x4c, 0x3a, 0xa7, 0xed, 0xc8, 0xf1, 0x37, 0x24, 0x1d, 0x99, 0xed, 0x48, 0x91,
-	0x14, 0xb3, 0xfa, 0xb8, 0xeb, 0x09, 0x15, 0xd5, 0xf3, 0x51, 0x76, 0x4a, 0x45, 0xf8, 0xb1, 0x68,
-	0x88, 0xa1, 0x6e, 0x09, 0x69, 0x1c, 0xc8, 0x16, 0xcc, 0x85, 0xa7, 0xb6, 0xc2, 0xb8, 0x14, 0xa5,
-	0x5c, 0x88, 0x8e, 0xfa, 0x74, 0xbe, 0x69, 0xf4, 0xc4, 0x86, 0x33, 0xda, 0x39, 0xad, 0xb0, 0x3e,
-	0x8f, 0xac, 0x5f, 0x61, 0x37, 0x32, 0xfd, 0x90, 0x4f, 0x67, 0xdf, 0x8f, 0x0f, 0xf9, 0x08, 0x16,
-	0xe3, 0x67, 0xb3, 0x52, 0xcb, 0x0b, 0x58, 0xcb, 0xab, 0x47, 0x87, 0xa5, 0x0b, 0x89, 0xe3, 0x3d,
-	0xbd, 0xa2, 0x01, 0xdc, 0xc8, 0x57, 0x61, 0x41, 0x3f, 0x9f, 0x95, 0x9a, 0x0c, 0xac, 0x09, 0x97,
-	0x4e, 0x78, 0xb0, 0xa7, 0xd7, 0xd0, 0x97, 0x07, 0x09, 0xa0, 0x94, 0x3a, 0xbb, 0x95, 0x6a, 0x5e,
-	0x8c, 0x1a, 0x94, 0x58, 0x25, 0xe9, 0xd5, 0x1d, 0xc7, 0x92, 0x3c, 0x82, 0xe7, 0xd3, 0x8e, 0x09,
-	0xa5, 0xd2, 0x97, 0x42, 0x25, 0xf0, 0x6b, 0xe9, 0x47, 0x4e, 0x7a, 0xcd, 0xc7, 0xb0, 0x25, 0x5f,
-	0x86, 0x53, 0xca, 0xfa, 0x52, 0xea, 0x7b, 0x19, 0xeb, 0xc3, 0xa8, 0x00, 0xea, 0xc2, 0x4c, 0xaf,
-	0x25, 0x9d, 0x07, 0x69, 0xc3, 0x9c, 0x6c, 0x38, 0x6a, 0xdb, 0xc5, 0xd1, 0x73, 0x41, 0xdb, 0x55,
-	0x93, 0x18, 0xcb, 0xe7, 0xc5, 0xae, 0xba, 0xd0, 0xdc, 0xb6, 0xba, 0x11, 0xa1, 0x3a, 0xd3, 0x53,
-	0xf8, 0x92, 0x35, 0x18, 0xab, 0xd7, 0xaa, 0x37, 0x6f, 0xae, 0x2e, 0xbc, 0x82, 0x35, 0x48, 0xbf,
-	0x3f, 0x0e, 0xd4, 0x2e, 0x4d, 0xc2, 0xc6, 0xb1, 0xeb, 0xec, 0xec, 0x68, 0x0f, 0x56, 0x1c, 0x95,
-	0xfc, 0x00, 0x5a, 0x17, 0xb2, 0x1d, 0xb5, 0xec, 0xfb, 0xce, 0x6e, 0x87, 0x27, 0xb3, 0x78, 0x55,
-	0x7b, 0xef, 0x97, 0xe9, 0x4d, 0x56, 0x30, 0x71, 0x6c, 0x02, 0x9d, 0x4b, 0x9b, 0xec, 0xfe, 0x2f,
-	0x76, 0x6e, 0xcb, 0x8e, 0x58, 0xa9, 0x9b, 0x78, 0xb2, 0x22, 0xd6, 0x6f, 0xbb, 0x4e, 0x60, 0xed,
-	0xf5, 0xb4, 0xe6, 0x2f, 0xbc, 0xa6, 0x05, 0x13, 0xe7, 0xe9, 0x74, 0x95, 0x5e, 0x7b, 0x49, 0x54,
-	0xf8, 0x1c, 0xbf, 0x2d, 0xf7, 0xe9, 0xb9, 0xd9, 0xdd, 0x18, 0x9d, 0x4f, 0x7e, 0x38, 0x03, 0xa7,
-	0x1f, 0xb8, 0xde, 0x7e, 0xcb, 0xb5, 0x9b, 0xb2, 0x55, 0x62, 0x0f, 0x7f, 0x7d, 0xd0, 0x1e, 0xfe,
-	0xd9, 0xc4, 0x1e, 0x6e, 0x3c, 0x12, 0x6c, 0xac, 0x30, 0x3b, 0x4c, 0x62, 0x3f, 0xef, 0x53, 0x15,
-	0xf9, 0x01, 0x38, 0x9f, 0x5e, 0xa2, 0x4c, 0xca, 0xcb, 0x38, 0x29, 0xaf, 0x1d, 0x1d, 0x96, 0x2e,
-	0xf7, 0xab, 0x29, 0x7d, 0x82, 0x1e, 0xcb, 0xfa, 0xf6, 0x48, 0xfe, 0x62, 0xf1, 0xd2, 0xed, 0x91,
-	0xfc, 0xa5, 0xe2, 0xab, 0xe6, 0x73, 0xf5, 0xf2, 0xdd, 0xf5, 0x6a, 0x53, 0x1e, 0xae, 0x32, 0x81,
-	0x0d, 0xa7, 0x31, 0x2f, 0x0c, 0x2a, 0x8d, 0x38, 0x1a, 0x7f, 0x2d, 0x03, 0xa5, 0x63, 0x26, 0x09,
-	0x3b, 0xcf, 0xa2, 0x91, 0xa8, 0x87, 0x49, 0x13, 0xb8, 0x63, 0x60, 0x58, 0x60, 0xe9, 0x66, 0x23,
-	0x3a, 0x09, 0x3a, 0x8d, 0x8a, 0xdc, 0x6b, 0x8a, 0xef, 0x70, 0x32, 0xe7, 0x9a, 0xc4, 0x32, 0xd6,
-	0xa1, 0x18, 0x9f, 0x3c, 0xe4, 0xf3, 0x30, 0xa5, 0x66, 0x7e, 0x92, 0xaa, 0x04, 0x1e, 0x31, 0xc7,
-	0xdb, 0xd5, 0x0e, 0x44, 0x0d, 0xd1, 0xf8, 0x85, 0x0c, 0xcc, 0xa5, 0xac, 0x30, 0x72, 0x01, 0x46,
-	0x30, 0x35, 0xab, 0x62, 0x35, 0x14, 0x4b, 0xc9, 0x8a, 0xe5, 0xe4, 0x33, 0x30, 0x5e, 0xd9, 0xa8,
-	0xd7, 0xcb, 0x1b, 0x52, 0x19, 0xc1, 0x0f, 0xe2, 0x8e, 0x6f, 0xf9, 0xb6, 0x6e, 0x6c, 0x20, 0xd0,
-	0xc8, 0x65, 0x18, 0xab, 0xd6, 0x90, 0x40, 0x49, 0x0b, 0xe3, 0x74, 0xe3, 0xf8, 0x02, 0xc9, 0xf8,
-	0x89, 0x0c, 0x90, 0xe4, 0x76, 0x41, 0xae, 0xc1, 0xa4, 0xba, 0x29, 0xf1, 0xf6, 0xe2, 0x0b, 0xac,
-	0xb2, 0x70, 0x4c, 0x15, 0x87, 0x54, 0x60, 0xf4, 0xae, 0x1d, 0x34, 0xf6, 0x42, 0x2b, 0x87, 0xd4,
-	0x65, 0x71, 0x26, 0xb1, 0x2c, 0x46, 0xdb, 0x8c, 0xca, 0xe4, 0xc4, 0xc6, 0x1f, 0x67, 0x80, 0xa4,
-	0x1b, 0x3c, 0x0e, 0x65, 0x65, 0xf5, 0x86, 0x12, 0x7b, 0x42, 0xb5, 0x78, 0x0c, 0x33, 0xe7, 0xaa,
-	0x6a, 0x80, 0x28, 0x4a, 0xc5, 0x05, 0x4d, 0xed, 0xd4, 0xdf, 0x61, 0xf9, 0x12, 0x8c, 0xde, 0xa7,
-	0xde, 0xb6, 0xb4, 0x05, 0x47, 0xfb, 0xd1, 0x87, 0x0c, 0xa0, 0xaa, 0x61, 0x10, 0x43, 0x33, 0xbd,
-	0x1c, 0x1d, 0xd6, 0xf4, 0xf2, 0x0f, 0x32, 0x30, 0x9f, 0x76, 0xb1, 0x39, 0xc6, 0x19, 0xd9, 0x88,
-	0xf9, 0x51, 0xa3, 0x59, 0x16, 0xb7, 0x48, 0x0d, 0xbd, 0xa7, 0x4b, 0x30, 0xca, 0x7a, 0x48, 0x4e,
-	0x0b, 0xd4, 0x9d, 0xb1, 0x2e, 0xf4, 0x4d, 0x0e, 0x67, 0x08, 0x51, 0x36, 0x8f, 0x51, 0x8e, 0xc0,
-	0x93, 0x78, 0x70, 0x38, 0x43, 0xb8, 0xeb, 0x36, 0xa9, 0xd4, 0x29, 0x21, 0x42, 0x9b, 0x01, 0x4c,
-	0x0e, 0x27, 0x17, 0x60, 0xfc, 0x5e, 0x67, 0x9d, 0xda, 0x0f, 0x65, 0xd6, 0x30, 0x34, 0x23, 0x73,
-	0x3b, 0x56, 0x8b, 0xc1, 0x4c, 0x59, 0x68, 0xfc, 0x6c, 0x06, 0x66, 0x13, 0x77, 0xaa, 0xe3, 0xfd,
-	0xad, 0x07, 0xfb, 0x10, 0x0e, 0xd3, 0x3e, 0xfe, 0xf9, 0x23, 0xe9, 0x9f, 0x6f, 0xfc, 0x37, 0x63,
-	0x70, 0xa6, 0x8f, 0x8a, 0x2b, 0xf2, 0x71, 0xce, 0x1c, 0xeb, 0xe3, 0xfc, 0x15, 0x98, 0x5a, 0x69,
-	0xd9, 0x4e, 0xdb, 0xdf, 0x74, 0xa3, 0x2f, 0x8e, 0x5c, 0xa5, 0xb0, 0x4c, 0x78, 0x5c, 0x84, 0x3e,
-	0x35, 0x67, 0x1b, 0x48, 0x61, 0x05, 0x6e, 0x52, 0xc2, 0xd6, 0x98, 0x25, 0xbc, 0x8c, 0x73, 0x7f,
-	0x46, 0xbc, 0x8c, 0x75, 0xbf, 0xb7, 0x91, 0x27, 0xea, 0xf7, 0x96, 0x6e, 0x5d, 0x3e, 0xfa, 0x49,
-	0x7c, 0x0d, 0x56, 0x60, 0x8a, 0xdb, 0xd1, 0x95, 0x7d, 0x3e, 0x48, 0x63, 0x09, 0xdb, 0x3b, 0xdb,
-	0x4f, 0x8e, 0x85, 0x46, 0x43, 0xd6, 0x74, 0x1f, 0xad, 0x71, 0x7c, 0x68, 0xbe, 0xd0, 0xdf, 0x07,
-	0x4b, 0x0f, 0xf4, 0xa3, 0xfa, 0x62, 0x7d, 0x03, 0xe6, 0xd3, 0xee, 0xc8, 0x0b, 0x79, 0xcd, 0x44,
-	0xb7, 0xaf, 0x3d, 0xf8, 0xf0, 0x37, 0xed, 0xfd, 0xd4, 0x9b, 0xb6, 0xf4, 0x9d, 0x9f, 0xe8, 0xef,
-	0x78, 0x14, 0xad, 0x05, 0x8e, 0x3b, 0xd8, 0xc3, 0xde, 0xf8, 0x4a, 0x2c, 0xf8, 0x41, 0x9c, 0x9c,
-	0xbc, 0xa5, 0xc5, 0xa8, 0x7a, 0x25, 0x19, 0xa3, 0x2a, 0x3d, 0xde, 0x01, 0x4f, 0x00, 0xf5, 0xb3,
-	0x59, 0xdd, 0x63, 0xfb, 0xcf, 0xe2, 0x42, 0xbd, 0x04, 0xa3, 0x0f, 0xf6, 0xa8, 0x27, 0xcf, 0x14,
-	0xfc, 0x90, 0x47, 0x0c, 0xa0, 0x7e, 0x08, 0x62, 0x90, 0x9b, 0x30, 0x5d, 0xe3, 0x13, 0x57, 0xce,
-	0xc6, 0x91, 0x48, 0x51, 0xd3, 0x15, 0xea, 0xc4, 0x94, 0xe9, 0x18, 0xa3, 0x32, 0x6e, 0xc5, 0x3a,
-	0x5d, 0x44, 0xd8, 0xe2, 0x3e, 0x58, 0x5c, 0xea, 0x98, 0x8e, 0x7c, 0xe9, 0xa2, 0xcd, 0xd6, 0x8c,
-	0x41, 0x8d, 0x1d, 0x78, 0x7e, 0x20, 0x23, 0x76, 0xd8, 0x43, 0x37, 0xfc, 0x15, 0x33, 0xd7, 0x1e,
-	0x48, 0x6a, 0x2a, 0x74, 0xc6, 0x37, 0xa0, 0xa0, 0xf6, 0x32, 0x1e, 0x41, 0xec, 0xb7, 0x98, 0x15,
-	0xfc, 0x08, 0x62, 0x00, 0x93, 0xc3, 0xa3, 0x07, 0xa0, 0x6c, 0xfa, 0x03, 0x50, 0x34, 0xfc, 0xb9,
-	0xe3, 0x86, 0x9f, 0x55, 0x8e, 0x3b, 0x9c, 0x52, 0x39, 0xfe, 0x56, 0x2b, 0xc7, 0xb8, 0x57, 0x26,
-	0x87, 0x3f, 0xd1, 0xca, 0xff, 0xb9, 0x4c, 0x20, 0x88, 0x2e, 0x5e, 0x72, 0xb9, 0x67, 0xa2, 0x5c,
-	0xb1, 0x69, 0xab, 0x37, 0xc2, 0x8c, 0x04, 0x91, 0xec, 0xb1, 0x82, 0xc8, 0x09, 0x26, 0x22, 0x0a,
-	0xcb, 0x7c, 0x48, 0x47, 0x22, 0xe1, 0xd1, 0x4e, 0x98, 0xc8, 0x48, 0x2c, 0xe3, 0x5b, 0x19, 0x38,
-	0x95, 0xaa, 0x68, 0x67, 0xb5, 0x72, 0x8d, 0xbe, 0xb2, 0x0e, 0xe3, 0xea, 0x7c, 0x8e, 0x71, 0x92,
-	0xf8, 0x21, 0xc3, 0xb7, 0xc5, 0x78, 0x01, 0x26, 0xc2, 0x67, 0x5e, 0x32, 0x2f, 0x87, 0x8e, 0x07,
-	0x48, 0x14, 0xaf, 0x85, 0x75, 0x00, 0xf6, 0x05, 0x4f, 0xd4, 0x1e, 0xdb, 0xf8, 0xe7, 0x59, 0x18,
-	0x63, 0x5c, 0x9f, 0xda, 0x50, 0xce, 0xe9, 0x46, 0xd4, 0xac, 0x49, 0xfd, 0x03, 0x38, 0x93, 0x55,
-	0x18, 0xe3, 0xc9, 0xef, 0xc4, 0x93, 0xe1, 0x9c, 0x4a, 0x26, 0xb3, 0xe2, 0x85, 0x81, 0x2f, 0x7c,
-	0x84, 0x68, 0xaa, 0x05, 0x84, 0x28, 0xb6, 0xd8, 0xbf, 0x93, 0x81, 0x82, 0x4a, 0x4c, 0x3e, 0x80,
-	0x69, 0x19, 0x9e, 0x96, 0x07, 0x83, 0x11, 0x6f, 0xd2, 0xd2, 0x7e, 0x4c, 0x86, 0xa7, 0x55, 0x83,
-	0xc7, 0x68, 0xf8, 0xea, 0x56, 0xdd, 0x55, 0x91, 0x49, 0x13, 0x48, 0x7b, 0xc7, 0xb6, 0x1e, 0x51,
-	0x7b, 0x9f, 0xfa, 0x81, 0xc5, 0xed, 0x7c, 0xc4, 0xd3, 0xb5, 0x64, 0x7f, 0xf7, 0x66, 0x99, 0x9b,
-	0xf8, 0xb0, 0x91, 0x10, 0x71, 0x86, 0x13, 0x34, 0xea, 0x7b, 0x5c, 0x7b, 0xc7, 0x7e, 0xc0, 0x0b,
-	0x39, 0x9d, 0xf1, 0x87, 0x63, 0x7c, 0xba, 0x89, 0x78, 0xd6, 0xdb, 0x30, 0x7d, 0xaf, 0x5a, 0x59,
-	0x51, 0xb4, 0xf3, 0x7a, 0x3a, 0xb4, 0xd5, 0xc7, 0x01, 0xf5, 0x3a, 0x76, 0x4b, 0x5e, 0x92, 0xa3,
-	0x23, 0xc8, 0x75, 0x9a, 0x8d, 0x74, 0xcd, 0x7d, 0x8c, 0x23, 0xab, 0x83, 0x5f, 0xc7, 0xc3, 0x3a,
-	0xb2, 0x43, 0xd6, 0xe1, 0xdb, 0xed, 0x56, 0x9f, 0x3a, 0x74, 0x8e, 0x64, 0x0f, 0xef, 0xcb, 0x7b,
-	0xbd, 0x6d, 0xa5, 0x96, 0xdc, 0xe0, 0x5a, 0x5e, 0x14, 0xb5, 0x3c, 0x2b, 0x74, 0x31, 0xa9, 0xf5,
-	0x24, 0xb8, 0x46, 0xfb, 0xc4, 0xc8, 0xb1, 0xfb, 0xc4, 0xff, 0x3f, 0x03, 0x63, 0x5c, 0x7c, 0x15,
-	0xd3, 0xb8, 0x8f, 0x80, 0xfc, 0xe0, 0xc9, 0x08, 0xc8, 0x45, 0x3c, 0x27, 0xb4, 0x09, 0xcd, 0xcb,
-	0x48, 0x25, 0xb6, 0x2e, 0xa4, 0x0b, 0x01, 0xbe, 0xb3, 0xf1, 0x92, 0xe3, 0x97, 0x05, 0xa9, 0x46,
-	0xa1, 0x48, 0xc6, 0x8f, 0xf5, 0x3f, 0x97, 0xe1, 0x5b, 0xc6, 0x45, 0x28, 0x12, 0x3d, 0x00, 0xc9,
-	0x3a, 0x4c, 0x88, 0x00, 0x27, 0xcb, 0x07, 0xe2, 0x35, 0xbd, 0xa8, 0xd9, 0x43, 0x35, 0x97, 0x0f,
-	0x22, 0xd1, 0x5c, 0x84, 0x48, 0xb1, 0xb6, 0x55, 0x5f, 0x82, 0x88, 0x01, 0xb9, 0xc7, 0x33, 0x9d,
-	0xf3, 0x78, 0xdf, 0x7a, 0x8a, 0x8f, 0x10, 0x2e, 0xe2, 0xbd, 0xc9, 0x28, 0x09, 0x29, 0xe1, 0xbd,
-	0x23, 0x1e, 0x64, 0x1d, 0x8a, 0x68, 0x43, 0x47, 0x9b, 0x7c, 0xd5, 0x54, 0x2b, 0x3c, 0x88, 0x86,
-	0xb0, 0x83, 0x0e, 0x78, 0x99, 0x58, 0x6e, 0x31, 0x4f, 0xcf, 0x04, 0xa5, 0xf1, 0x33, 0x59, 0x28,
-	0xc6, 0x67, 0x1f, 0x79, 0x1b, 0x26, 0xc3, 0x78, 0xeb, 0xa1, 0xaf, 0x39, 0xbe, 0xaa, 0x45, 0x01,
-	0xda, 0xf5, 0xfc, 0xd8, 0x0a, 0x3a, 0x59, 0x82, 0x3c, 0x5b, 0xc4, 0x9d, 0x28, 0x5c, 0x26, 0x6e,
-	0xdb, 0x3d, 0x01, 0x53, 0x6f, 0xf5, 0x12, 0x8f, 0xd4, 0x61, 0x8e, 0x2d, 0x9a, 0xba, 0xd3, 0xd9,
-	0x6d, 0xd1, 0x75, 0x77, 0xd7, 0xed, 0x05, 0x51, 0xba, 0x68, 0x7e, 0x81, 0xb1, 0xdb, 0x2d, 0xad,
-	0x58, 0x4f, 0x16, 0x9d, 0x42, 0x4d, 0x2e, 0xf3, 0x63, 0xa6, 0x5a, 0x11, 0xc6, 0x30, 0x78, 0x54,
-	0xa3, 0x11, 0x97, 0xf6, 0xf1, 0x02, 0x49, 0xd9, 0x59, 0x7f, 0x3f, 0x0b, 0x93, 0xca, 0xf4, 0x23,
-	0x97, 0x20, 0x5f, 0xf5, 0xd7, 0xdd, 0xc6, 0x7e, 0x18, 0x3f, 0x74, 0xea, 0xe8, 0xb0, 0x34, 0xe1,
-	0xf8, 0x56, 0x0b, 0x81, 0x66, 0x58, 0x4c, 0x96, 0x61, 0x8a, 0xff, 0x25, 0x13, 0xe7, 0x64, 0x23,
-	0x85, 0x1c, 0x47, 0x96, 0x29, 0x73, 0xd4, 0xcd, 0x56, 0x23, 0x21, 0x1f, 0x02, 0x70, 0x00, 0x06,
-	0x6f, 0xc8, 0x0d, 0x1f, 0x76, 0x42, 0x54, 0x90, 0x12, 0xb6, 0x41, 0x61, 0x48, 0xbe, 0xc6, 0xc3,
-	0xb9, 0xcb, 0xe5, 0x32, 0x32, 0x7c, 0xdc, 0x0c, 0xc6, 0xdf, 0x4a, 0x0f, 0xdf, 0xa3, 0xb2, 0x14,
-	0xb9, 0xae, 0x16, 0x65, 0x62, 0xd3, 0x72, 0x80, 0x88, 0x0a, 0x86, 0xf1, 0xbf, 0x64, 0x94, 0x45,
-	0x46, 0x36, 0x60, 0x22, 0x9c, 0x40, 0xc2, 0x0e, 0x2d, 0xbc, 0x62, 0x48, 0xb8, 0x49, 0x77, 0x96,
-	0x9f, 0x15, 0x26, 0x71, 0x73, 0xe1, 0x34, 0xd4, 0xd6, 0x9c, 0x04, 0x92, 0x2f, 0xc2, 0x08, 0x76,
-	0x5d, 0xf6, 0xd8, 0xa6, 0xc9, 0x53, 0x7e, 0x84, 0xf5, 0x19, 0x36, 0x04, 0x29, 0xc9, 0x67, 0x84,
-	0x8b, 0x38, 0xef, 0xfc, 0x69, 0xe5, 0xa8, 0x66, 0xdf, 0x11, 0x1e, 0xef, 0x51, 0x04, 0x27, 0x65,
-	0xf6, 0xfc, 0xb5, 0x2c, 0x14, 0xe3, 0x4b, 0x9b, 0xbc, 0x07, 0x05, 0x79, 0xfc, 0xae, 0xd9, 0x22,
-	0xeb, 0x4b, 0x41, 0x64, 0x5d, 0x91, 0x67, 0xf0, 0x9e, 0xad, 0xda, 0xad, 0x99, 0x1a, 0x01, 0x93,
-	0x85, 0x36, 0x45, 0x18, 0x48, 0x65, 0x51, 0x05, 0x6e, 0xd0, 0x8d, 0x45, 0x11, 0x97, 0x68, 0xe4,
-	0x0d, 0xc8, 0xdd, 0xbd, 0x59, 0x16, 0x5e, 0x81, 0xc5, 0xf8, 0x21, 0xcd, 0xcd, 0x6b, 0x75, 0x63,
-	0x5f, 0x86, 0x4f, 0xd6, 0x95, 0x80, 0xfb, 0x63, 0x9a, 0x8d, 0xa2, 0x04, 0x87, 0x8d, 0x3b, 0x3e,
-	0xf2, 0xfe, 0xed, 0x91, 0x7c, 0xae, 0x38, 0x22, 0x82, 0x30, 0xff, 0xeb, 0x1c, 0x4c, 0x84, 0xf5,
-	0x13, 0xa2, 0x3a, 0x68, 0x0b, 0x67, 0xec, 0xb3, 0x90, 0x97, 0xd2, 0x9d, 0x70, 0x0e, 0x1c, 0xf7,
-	0x85, 0x64, 0xb7, 0x00, 0x52, 0x8c, 0xe3, 0xbb, 0x82, 0x29, 0x7f, 0x92, 0x6b, 0x10, 0xca, 0x68,
-	0xfd, 0x84, 0xb9, 0x11, 0x36, 0x60, 0x66, 0x88, 0x46, 0xa6, 0x21, 0xeb, 0xf0, 0xc0, 0x76, 0x13,
-	0x66, 0xd6, 0x69, 0x92, 0xf7, 0x20, 0x6f, 0x37, 0x9b, 0x98, 0xc5, 0x76, 0x88, 0x04, 0xb8, 0x79,
-	0xc6, 0x8d, 0x9f, 0x19, 0x48, 0x55, 0x0e, 0x48, 0x19, 0x26, 0x78, 0xa4, 0x70, 0x9f, 0x36, 0x87,
-	0x38, 0x80, 0x22, 0x0e, 0x18, 0x60, 0x7c, 0xcb, 0xa7, 0x4d, 0xf2, 0x0a, 0x8c, 0xb0, 0xd1, 0x14,
-	0x27, 0x8e, 0x14, 0x2a, 0xd9, 0x60, 0xf2, 0x0e, 0x5b, 0x7b, 0xc6, 0x44, 0x04, 0xf2, 0x12, 0xe4,
-	0x7a, 0x4b, 0x3b, 0xe2, 0x2c, 0x29, 0x46, 0xc9, 0x2f, 0x42, 0x34, 0x56, 0x4c, 0xae, 0x43, 0xfe,
-	0x91, 0x9e, 0x37, 0xe1, 0x54, 0x6c, 0x18, 0x43, 0xfc, 0x10, 0x91, 0xbc, 0x02, 0x39, 0xdf, 0x77,
-	0x85, 0x15, 0xd4, 0x5c, 0x68, 0x9a, 0x7a, 0x2f, 0x1c, 0x35, 0xc6, 0xdd, 0xf7, 0xdd, 0xe5, 0x3c,
-	0x8c, 0xf1, 0x03, 0xc6, 0x78, 0x1e, 0x20, 0xfa, 0xc6, 0xa4, 0xb3, 0xa7, 0xf1, 0x21, 0x4c, 0x84,
-	0xdf, 0x46, 0xce, 0x01, 0xec, 0xd3, 0x03, 0x6b, 0xcf, 0xee, 0x34, 0x5b, 0x5c, 0x3a, 0x2d, 0x98,
-	0x13, 0xfb, 0xf4, 0x60, 0x0d, 0x01, 0xe4, 0x0c, 0x8c, 0x77, 0xd9, 0xf0, 0x8b, 0x39, 0x5e, 0x30,
-	0xc7, 0xba, 0xbd, 0x6d, 0x36, 0x95, 0x17, 0x60, 0x1c, 0xf5, 0xac, 0x62, 0x45, 0x4e, 0x99, 0xf2,
-	0xa7, 0xf1, 0x47, 0x39, 0x4c, 0x2f, 0xa6, 0x34, 0x88, 0xbc, 0x08, 0x53, 0x0d, 0x8f, 0xe2, 0x59,
-	0x66, 0x33, 0x09, 0x4d, 0xd4, 0x53, 0x88, 0x80, 0xd5, 0x26, 0xb9, 0x00, 0x33, 0x51, 0x26, 0x68,
-	0xab, 0xb1, 0x2d, 0xf2, 0xa1, 0x14, 0xcc, 0xa9, 0xae, 0xcc, 0x07, 0xbd, 0xb2, 0x8d, 0x91, 0x1b,
-	0x8b, 0x6a, 0xe0, 0x71, 0xd6, 0x23, 0x62, 0xfe, 0xcd, 0x28, 0x70, 0x34, 0xe8, 0x3c, 0x0d, 0x63,
-	0xb6, 0xbd, 0xdb, 0x73, 0x78, 0x84, 0xb5, 0x82, 0x29, 0x7e, 0x91, 0xd7, 0x60, 0x36, 0x8a, 0xe4,
-	0x2f, 0x9b, 0x31, 0x8a, 0xcd, 0x28, 0x86, 0x05, 0x2b, 0x1c, 0x4e, 0x2e, 0x03, 0x51, 0xeb, 0x73,
-	0xb7, 0x3f, 0xa2, 0x0d, 0x3e, 0x27, 0x0b, 0xe6, 0xac, 0x52, 0x72, 0x0f, 0x0b, 0xc8, 0x0b, 0x50,
-	0xf0, 0xa8, 0x8f, 0xd2, 0x21, 0x76, 0x1b, 0x66, 0xdf, 0x34, 0x27, 0x25, 0x8c, 0xf5, 0xdd, 0x45,
-	0x28, 0x2a, 0xdd, 0x81, 0xb1, 0xdd, 0x79, 0x2a, 0x10, 0x73, 0x3a, 0x82, 0x9b, 0xdd, 0x6a, 0x93,
-	0x7c, 0x09, 0x16, 0x15, 0x4c, 0x9e, 0x08, 0xd4, 0xa2, 0x2d, 0x67, 0xd7, 0xd9, 0x6e, 0x51, 0x31,
-	0xdf, 0x92, 0xb3, 0x3a, 0xbc, 0x42, 0x9a, 0x0b, 0x11, 0x35, 0x4f, 0x11, 0xba, 0x2a, 0x68, 0xc9,
-	0x3a, 0xcc, 0xc7, 0x38, 0xd3, 0xa6, 0xd5, 0xeb, 0xf6, 0x0d, 0x69, 0x18, 0xf1, 0x24, 0x3a, 0x4f,
-	0xda, 0xdc, 0xea, 0x1a, 0xdf, 0x80, 0x82, 0x3a, 0x27, 0x59, 0x27, 0xa8, 0x72, 0x89, 0x98, 0x7d,
-	0x93, 0x21, 0xac, 0xca, 0xee, 0x85, 0xd3, 0x11, 0x0a, 0x0e, 0x22, 0xdf, 0x5e, 0xa6, 0x42, 0x28,
-	0x0e, 0xe1, 0x0b, 0x50, 0x68, 0x3a, 0x7e, 0xb7, 0x65, 0x1f, 0xa0, 0x59, 0x9e, 0x18, 0xe9, 0x49,
-	0x01, 0x43, 0xc5, 0xcf, 0x32, 0xcc, 0x26, 0xf6, 0x41, 0x45, 0xd2, 0xe0, 0xfb, 0xfa, 0x60, 0x49,
-	0xc3, 0xe8, 0x40, 0x41, 0x3d, 0xd7, 0x8e, 0x49, 0xdc, 0x73, 0x1a, 0x03, 0xfe, 0xf0, 0x4d, 0x7f,
-	0xec, 0xe8, 0xb0, 0x94, 0x75, 0x9a, 0x18, 0xe6, 0xe7, 0x22, 0xe4, 0xa5, 0xc4, 0x26, 0x04, 0x25,
-	0x7c, 0x4c, 0x90, 0xef, 0x99, 0x66, 0x58, 0x6a, 0xbc, 0x02, 0xe3, 0xe2, 0xe8, 0x1a, 0xfc, 0x84,
-	0x60, 0x7c, 0x33, 0x0b, 0x33, 0x26, 0x65, 0x1b, 0x2b, 0xe5, 0xd9, 0xba, 0x9e, 0xda, 0x2b, 0x7a,
-	0x7a, 0x04, 0x5f, 0xad, 0x6d, 0x03, 0xf2, 0x64, 0xfd, 0x52, 0x06, 0xe6, 0x52, 0x70, 0x3f, 0x56,
-	0x9e, 0xe8, 0x1b, 0x30, 0x51, 0x71, 0xec, 0x56, 0xb9, 0xd9, 0x0c, 0xa3, 0xff, 0xa0, 0x9c, 0x8f,
-	0xc9, 0xe4, 0x6c, 0x06, 0x55, 0x85, 0x98, 0x10, 0x95, 0xbc, 0x2a, 0x26, 0x45, 0x2e, 0xec, 0x56,
-	0x9c, 0x14, 0xdf, 0x3d, 0x2c, 0x01, 0xff, 0xa6, 0xcd, 0x70, 0x8a, 0x60, 0x54, 0x6d, 0x0e, 0x8c,
-	0x9c, 0xb1, 0x9e, 0xda, 0xa1, 0x4b, 0x8f, 0xaa, 0x1d, 0x6f, 0xde, 0x50, 0xa9, 0xb2, 0x7e, 0x32,
-	0x0b, 0xa7, 0xd3, 0x09, 0x3f, 0x6e, 0xca, 0x6f, 0x4c, 0x52, 0xa6, 0x64, 0x02, 0xc0, 0x94, 0xdf,
-	0x3c, 0xa3, 0x19, 0xe2, 0x47, 0x08, 0x64, 0x87, 0xa7, 0xd6, 0x5f, 0xa3, 0xb6, 0x17, 0x6c, 0x53,
-	0x3b, 0x18, 0x42, 0x92, 0x97, 0x26, 0x18, 0x0b, 0x28, 0x4c, 0xec, 0x49, 0xca, 0xb4, 0xcc, 0xfa,
-	0x21, 0xdb, 0x70, 0xa2, 0x8c, 0x0c, 0x31, 0x51, 0xbe, 0x0e, 0x33, 0x75, 0xda, 0xb6, 0xbb, 0x7b,
-	0xae, 0x27, 0x83, 0x2c, 0x5c, 0x81, 0xa9, 0x10, 0x94, 0x3a, 0x5b, 0xf4, 0x62, 0x0d, 0x5f, 0xe9,
-	0x88, 0x68, 0x2b, 0xd1, 0x8b, 0x8d, 0xbf, 0x9e, 0x85, 0x33, 0xe5, 0x86, 0xb0, 0x27, 0x15, 0x05,
-	0xd2, 0xec, 0xfd, 0x53, 0xae, 0x9b, 0x5c, 0x85, 0x89, 0xbb, 0xf6, 0xe3, 0x75, 0x6a, 0xfb, 0xd4,
-	0x17, 0x69, 0x26, 0xb8, 0xd8, 0x6b, 0x3f, 0x8e, 0x1e, 0x7f, 0xcc, 0x08, 0x47, 0x55, 0x23, 0x8c,
-	0x7c, 0x42, 0x35, 0x82, 0x01, 0x63, 0x6b, 0x6e, 0xab, 0x29, 0xce, 0x7a, 0xf1, 0xe2, 0xbc, 0x87,
-	0x10, 0x53, 0x94, 0x18, 0x7f, 0x90, 0x81, 0xe9, 0xf0, 0x8b, 0xf1, 0x13, 0x3e, 0xf5, 0x2e, 0xb9,
-	0x00, 0xe3, 0x58, 0x51, 0xb5, 0xa2, 0x1e, 0x1a, 0x2d, 0x8a, 0x69, 0x33, 0x9b, 0xa6, 0x2c, 0x54,
-	0x7b, 0x62, 0xf4, 0x93, 0xf5, 0x84, 0xf1, 0xf7, 0xf1, 0x31, 0x5b, 0x6d, 0x25, 0x3b, 0x89, 0x94,
-	0x0f, 0xc9, 0x0c, 0xf9, 0x21, 0xd9, 0x27, 0x36, 0x24, 0xb9, 0xbe, 0x43, 0xf2, 0xa3, 0x59, 0x98,
-	0x0c, 0x3f, 0xf6, 0x7b, 0x2c, 0x1d, 0x45, 0xd8, 0xae, 0xa1, 0x02, 0x23, 0xd5, 0x95, 0xbd, 0x42,
-	0xc4, 0x1f, 0xfa, 0x22, 0x8c, 0x89, 0xc5, 0x94, 0x89, 0x99, 0x7f, 0xc7, 0x46, 0x77, 0x79, 0x5a,
-	0xb0, 0x1e, 0xc3, 0x01, 0xf5, 0x4d, 0x41, 0x87, 0x91, 0xa7, 0x1e, 0xd0, 0x6d, 0x61, 0xdb, 0xf0,
-	0xd4, 0x9e, 0x51, 0xe9, 0x91, 0xa7, 0xa2, 0x86, 0x0d, 0x75, 0x3a, 0xfd, 0x77, 0x79, 0x28, 0xc6,
-	0x49, 0x8e, 0x4f, 0xf8, 0x51, 0xeb, 0x6d, 0xf3, 0xab, 0x0a, 0x4f, 0xf8, 0xd1, 0xed, 0x6d, 0x9b,
-	0x0c, 0x86, 0xf6, 0x52, 0x9e, 0xf3, 0x10, 0x5b, 0x5d, 0x10, 0xf6, 0x52, 0x9e, 0xf3, 0x50, 0xb3,
-	0x97, 0xf2, 0x9c, 0x87, 0xa8, 0x48, 0x58, 0xaf, 0x63, 0x54, 0x06, 0xbc, 0xa7, 0x08, 0x45, 0x42,
-	0xcb, 0x8f, 0x67, 0x31, 0x94, 0x68, 0xec, 0xa8, 0x5c, 0xa6, 0xb6, 0x27, 0x92, 0x53, 0x88, 0xed,
-	0x0c, 0x8f, 0xca, 0x6d, 0x04, 0x5b, 0x01, 0x83, 0x9b, 0x2a, 0x12, 0x69, 0x01, 0x51, 0x7e, 0xca,
-	0x05, 0x7c, 0xfc, 0xdd, 0x5a, 0x9a, 0x6e, 0xce, 0xab, 0xac, 0x2d, 0x75, 0x35, 0xa7, 0xf0, 0x7d,
-	0x92, 0xda, 0xdf, 0x9a, 0x08, 0x5e, 0x8b, 0x0a, 0xa4, 0xfc, 0xb1, 0xcc, 0x64, 0x34, 0x19, 0xe0,
-	0xc1, 0x6d, 0x43, 0x35, 0x52, 0xc4, 0x84, 0xbc, 0x0b, 0x93, 0x6a, 0xac, 0x0d, 0x1e, 0x11, 0xe2,
-	0x39, 0x1e, 0xb9, 0xb3, 0x4f, 0xe6, 0x6b, 0x95, 0x80, 0x6c, 0xc3, 0x99, 0x15, 0xb7, 0xe3, 0xf7,
-	0xda, 0x32, 0x46, 0x68, 0x14, 0x6f, 0x1d, 0x70, 0x28, 0xd0, 0x71, 0xbf, 0x21, 0x50, 0x44, 0x68,
-	0x07, 0xe9, 0x5b, 0xa3, 0x5f, 0x40, 0xfa, 0x31, 0x22, 0x9b, 0x30, 0x89, 0x1a, 0x54, 0x61, 0x27,
-	0x39, 0xa9, 0x6f, 0x1b, 0x51, 0x49, 0x85, 0x2d, 0x0c, 0x1e, 0x6a, 0xce, 0x6e, 0xb7, 0xa4, 0x6b,
-	0x87, 0xaa, 0x09, 0x56, 0x90, 0xc9, 0x87, 0x30, 0xcd, 0xaf, 0x68, 0x0f, 0xe8, 0x36, 0x9f, 0x3b,
-	0x05, 0x4d, 0x13, 0xa1, 0x17, 0xf2, 0xc7, 0x7c, 0xa1, 0xb7, 0x7e, 0x44, 0xb7, 0xf9, 0xd8, 0x6b,
-	0x8e, 0x55, 0x1a, 0x3e, 0xd9, 0x82, 0xb9, 0x35, 0xdb, 0xe7, 0x40, 0x25, 0x68, 0xc2, 0x14, 0x6a,
-	0x68, 0xd1, 0xe0, 0x7d, 0xcf, 0xf6, 0xa5, 0x22, 0x3c, 0x35, 0x48, 0x42, 0x1a, 0x3d, 0xf9, 0x66,
-	0x06, 0x16, 0x34, 0x3d, 0xb9, 0xb0, 0x33, 0xc3, 0xc0, 0xb3, 0xd3, 0xf8, 0xe4, 0x55, 0x92, 0x42,
-	0x69, 0x1f, 0x34, 0x3e, 0x24, 0x31, 0x55, 0xbc, 0x17, 0x95, 0xab, 0x96, 0xe4, 0xfd, 0x78, 0x88,
-	0x85, 0x8a, 0x6b, 0x7a, 0x46, 0x5f, 0xa8, 0xb1, 0x75, 0x2d, 0xd1, 0x8c, 0x1b, 0xf1, 0xfe, 0x16,
-	0x8a, 0xae, 0x4c, 0xa8, 0xe8, 0x9a, 0x87, 0x51, 0xec, 0x55, 0x19, 0x7a, 0x0b, 0x7f, 0x18, 0x9f,
-	0x51, 0xf7, 0x21, 0x21, 0x16, 0x0e, 0xdc, 0x87, 0x8c, 0xff, 0x61, 0x0c, 0x66, 0x62, 0xd3, 0x42,
-	0xdc, 0x53, 0x33, 0x89, 0x7b, 0x6a, 0x1d, 0x80, 0xab, 0x7a, 0x87, 0xd4, 0xc9, 0x4a, 0xef, 0xcd,
-	0x49, 0xe1, 0x7b, 0x1d, 0xae, 0x29, 0x85, 0x0d, 0x63, 0xca, 0x57, 0xec, 0x90, 0x3a, 0xf2, 0x90,
-	0x29, 0x5f, 0xf4, 0x0a, 0xd3, 0x88, 0x0d, 0x29, 0xc1, 0x28, 0x46, 0xea, 0x55, 0x9d, 0x67, 0x1d,
-	0x06, 0x30, 0x39, 0x9c, 0xbc, 0x08, 0x63, 0x4c, 0x88, 0xaa, 0x56, 0xc4, 0x26, 0x88, 0x67, 0x0b,
-	0x93, 0xb2, 0x98, 0xc4, 0x22, 0x8a, 0xc8, 0x0d, 0x28, 0xf0, 0xbf, 0x44, 0x6c, 0x9e, 0x31, 0xdd,
-	0x62, 0xd2, 0x72, 0x9a, 0x32, 0x3c, 0x8f, 0x86, 0xc7, 0x6e, 0x17, 0xf5, 0x1e, 0xaa, 0x75, 0xaa,
-	0x15, 0x11, 0xb0, 0x1e, 0x6f, 0x17, 0x3e, 0x07, 0xb2, 0x2a, 0x22, 0x04, 0x26, 0xcb, 0x08, 0x17,
-	0x96, 0x3c, 0xde, 0x29, 0x51, 0x96, 0xe1, 0xae, 0x2b, 0xa6, 0x28, 0x21, 0x97, 0xf8, 0x4b, 0x0c,
-	0x8a, 0x85, 0x3c, 0x6b, 0x2b, 0xbe, 0x5b, 0xa0, 0x62, 0x02, 0x65, 0xc3, 0xb0, 0x98, 0x55, 0xce,
-	0xfe, 0x5e, 0x6d, 0xdb, 0x4e, 0x4b, 0x6c, 0x2b, 0x58, 0x39, 0xe2, 0x52, 0x06, 0x35, 0x23, 0x04,
-	0xf2, 0x36, 0x4c, 0xf3, 0xec, 0x8a, 0xed, 0xb6, 0xdb, 0x41, 0xf6, 0x93, 0x51, 0xf4, 0x3d, 0x91,
-	0xf1, 0x91, 0x15, 0xf1, 0x5a, 0x62, 0xb8, 0xec, 0x3c, 0xc1, 0x57, 0xde, 0x1e, 0x7f, 0x23, 0x2a,
-	0x44, 0xe7, 0x09, 0x92, 0xfa, 0x1c, 0x6e, 0xaa, 0x48, 0xe4, 0x4d, 0x98, 0x62, 0x3f, 0x6f, 0x39,
-	0x0f, 0x29, 0xaf, 0x70, 0x2a, 0x32, 0x6f, 0x40, 0xaa, 0x5d, 0x56, 0xc2, 0xeb, 0xd3, 0x31, 0xc9,
-	0xfb, 0x70, 0x0a, 0x39, 0x35, 0xdc, 0x2e, 0x6d, 0x96, 0x77, 0x76, 0x9c, 0x96, 0xc3, 0xad, 0xd1,
-	0x78, 0x14, 0x1a, 0xd4, 0xc1, 0xf3, 0x8a, 0x11, 0xc3, 0xb2, 0x23, 0x14, 0x33, 0x9d, 0x92, 0x3c,
-	0x80, 0xe2, 0x4a, 0xcf, 0x0f, 0xdc, 0x76, 0x39, 0x08, 0x3c, 0x67, 0xbb, 0x17, 0x50, 0x7f, 0x61,
-	0x46, 0x8b, 0xd5, 0xc2, 0x16, 0x47, 0x58, 0xc8, 0xf5, 0x41, 0x0d, 0xa4, 0xb0, 0xec, 0x90, 0xc4,
-	0x4c, 0x30, 0x31, 0xfe, 0x4d, 0x06, 0xa6, 0x34, 0x52, 0xf2, 0x06, 0x14, 0x6e, 0x7a, 0x0e, 0xed,
-	0x34, 0x5b, 0x07, 0xca, 0x45, 0x15, 0x6f, 0x31, 0x3b, 0x02, 0xce, 0x5b, 0xad, 0xa1, 0x85, 0x7a,
-	0x9e, 0x6c, 0xaa, 0xa9, 0xe8, 0x55, 0xee, 0xc3, 0x2d, 0x26, 0x68, 0x2e, 0x0a, 0x1e, 0x85, 0x13,
-	0x54, 0xcc, 0x4e, 0x05, 0x85, 0xbc, 0x03, 0x63, 0xfc, 0x3d, 0x58, 0xd8, 0x2d, 0x9e, 0x4d, 0x6b,
-	0x26, 0x8f, 0x17, 0x80, 0x13, 0x11, 0x8d, 0x7e, 0x7c, 0x53, 0x10, 0x19, 0x3f, 0x97, 0x01, 0x92,
-	0x44, 0x3d, 0x46, 0xef, 0x75, 0xac, 0x31, 0xd1, 0x17, 0xc3, 0xd5, 0x98, 0xd3, 0x74, 0xe6, 0xac,
-	0x26, 0x5e, 0xc0, 0x3b, 0x5e, 0xac, 0x3a, 0x55, 0x11, 0xc7, 0x8b, 0x8d, 0x1f, 0xc9, 0x02, 0x44,
-	0xd8, 0xe4, 0xf3, 0x3c, 0x37, 0xdd, 0xfb, 0x3d, 0xbb, 0xe5, 0xec, 0x38, 0x7a, 0x84, 0x60, 0x64,
-	0xf2, 0x75, 0x59, 0x62, 0xea, 0x88, 0xe4, 0x3d, 0x98, 0xa9, 0xd7, 0x74, 0x5a, 0xc5, 0x96, 0xde,
-	0xef, 0x5a, 0x31, 0xf2, 0x38, 0x36, 0xda, 0x27, 0xab, 0xa3, 0xc1, 0xed, 0x93, 0xf9, 0x40, 0x88,
-	0x12, 0xb6, 0xb1, 0xd4, 0x6b, 0xc2, 0x5d, 0xa0, 0x19, 0xbe, 0x6a, 0xe2, 0xd7, 0xf9, 0x5d, 0xab,
-	0x2b, 0xfc, 0x08, 0xd8, 0x3e, 0xa1, 0xe1, 0x45, 0x1d, 0x39, 0xda, 0x27, 0x26, 0xc0, 0xcf, 0xa3,
-	0xda, 0xaf, 0xed, 0x06, 0x54, 0x68, 0x3b, 0x9e, 0xda, 0x7b, 0x4f, 0x64, 0x4c, 0x30, 0xaa, 0xb9,
-	0x3a, 0x6b, 0xad, 0x13, 0x06, 0x33, 0xd7, 0xa3, 0x4b, 0x0a, 0x37, 0x2b, 0x48, 0xb1, 0xb1, 0xf9,
-	0xbb, 0x19, 0x38, 0x95, 0x4a, 0x4b, 0xae, 0x00, 0x44, 0x3a, 0x25, 0xd1, 0x4b, 0xb8, 0x63, 0x46,
-	0x21, 0x93, 0x4c, 0x05, 0x83, 0x7c, 0x25, 0xae, 0x0d, 0x3a, 0xfe, 0x20, 0x5c, 0x94, 0x91, 0x0a,
-	0x75, 0x6d, 0x50, 0x8a, 0x0e, 0xc8, 0xf8, 0xa5, 0x1c, 0xcc, 0x2a, 0x11, 0x99, 0xf8, 0xb7, 0x1e,
-	0x63, 0x2f, 0xbe, 0x0f, 0x05, 0xd6, 0x1a, 0xa7, 0x21, 0x7c, 0x75, 0xb8, 0xe1, 0xcb, 0xab, 0x09,
-	0x67, 0x55, 0xc1, 0xed, 0x8a, 0x8a, 0xcc, 0xe3, 0x87, 0xe2, 0xd6, 0x89, 0x0f, 0x12, 0x8d, 0xa4,
-	0x9f, 0x8e, 0xc6, 0x9c, 0xf8, 0x30, 0x55, 0x39, 0xe8, 0xd8, 0xed, 0xb0, 0x36, 0x6e, 0x00, 0xf3,
-	0x5a, 0xdf, 0xda, 0x34, 0x6c, 0x5e, 0x5d, 0xe4, 0xd6, 0xc5, 0xcb, 0x52, 0x22, 0x0a, 0x68, 0x54,
-	0x8b, 0xef, 0xc1, 0x6c, 0xe2, 0xa3, 0x4f, 0x14, 0xca, 0xf4, 0x01, 0x90, 0xe4, 0x77, 0xa4, 0x70,
-	0x78, 0x4d, 0x0f, 0x94, 0x7b, 0x2a, 0x7c, 0xbc, 0x6e, 0xb7, 0xed, 0x4e, 0x93, 0x9b, 0xd3, 0x2c,
-	0xa9, 0x81, 0x4e, 0x7f, 0x3e, 0xab, 0x3a, 0x0c, 0x3f, 0xed, 0xab, 0xee, 0x8b, 0xda, 0x6d, 0xf8,
-	0xf9, 0x7e, 0x63, 0x3a, 0x94, 0xd6, 0xe1, 0x3b, 0x39, 0x38, 0xd3, 0x87, 0x92, 0x1c, 0xc4, 0x27,
-	0x11, 0xd7, 0x42, 0x5c, 0x1b, 0x5c, 0xe1, 0x93, 0x98, 0x4a, 0xe4, 0xf3, 0x3c, 0x64, 0x88, 0x48,
-	0x64, 0xcd, 0xef, 0xdf, 0xa8, 0xc6, 0xdf, 0x0f, 0xa1, 0xf1, 0x58, 0x21, 0x1c, 0x4a, 0xde, 0x83,
-	0x51, 0xf4, 0x16, 0x8f, 0xc5, 0x84, 0x64, 0x18, 0x08, 0x57, 0xa2, 0x9a, 0xb2, 0x9f, 0x5a, 0x54,
-	0x53, 0x06, 0x20, 0x9f, 0x83, 0x5c, 0xf9, 0x41, 0x5d, 0x8c, 0xcb, 0xb4, 0x4a, 0xfe, 0xa0, 0x1e,
-	0x25, 0xa7, 0xb1, 0xb5, 0x2c, 0x32, 0x8c, 0x82, 0x11, 0xde, 0x5a, 0xa9, 0x89, 0x51, 0x51, 0x09,
-	0x6f, 0xad, 0xd4, 0x22, 0xc2, 0xdd, 0x86, 0x16, 0x61, 0xeb, 0xd6, 0x4a, 0xed, 0xd3, 0x9b, 0xf6,
-	0xff, 0x51, 0x96, 0xc7, 0x39, 0xe1, 0x0d, 0x7b, 0x0f, 0x0a, 0x5a, 0x20, 0xf3, 0x4c, 0x24, 0x8f,
-	0x85, 0x91, 0xea, 0x63, 0x16, 0x43, 0x1a, 0x81, 0x4c, 0xf3, 0xc4, 0x7e, 0xab, 0x01, 0xdc, 0xc3,
-	0x34, 0x4f, 0xc8, 0x21, 0xee, 0x4a, 0xa4, 0x93, 0x90, 0xeb, 0x90, 0xdf, 0xa4, 0x1d, 0xbb, 0x13,
-	0x84, 0x0a, 0x51, 0x34, 0x2e, 0x0e, 0x10, 0xa6, 0x4b, 0x0d, 0x21, 0x22, 0x1a, 0xc2, 0xf6, 0xb6,
-	0xfd, 0x86, 0xe7, 0x60, 0x3c, 0xa4, 0xf0, 0x2c, 0xe6, 0x86, 0xb0, 0x4a, 0x89, 0xce, 0x20, 0x46,
-	0x64, 0xfc, 0x7c, 0x06, 0xc6, 0xc5, 0x40, 0xf2, 0xf4, 0x7c, 0xbb, 0xd1, 0x59, 0x22, 0x9c, 0x07,
-	0x76, 0x9d, 0xb8, 0xf3, 0xc0, 0x2e, 0x0f, 0x3a, 0x34, 0x21, 0xbc, 0xf1, 0xc2, 0xa7, 0x41, 0x9c,
-	0x8d, 0xd2, 0x57, 0x54, 0xcf, 0xbe, 0x16, 0xa2, 0x0e, 0xeb, 0xc5, 0x65, 0xfc, 0x4d, 0xf1, 0x65,
-	0xb7, 0x56, 0x6a, 0x64, 0x09, 0xf2, 0xeb, 0x2e, 0x8f, 0x9f, 0xa5, 0xe6, 0x9a, 0x6e, 0x09, 0x98,
-	0xda, 0x41, 0x12, 0x8f, 0x7d, 0x5f, 0xcd, 0x73, 0xc5, 0x5d, 0x46, 0xf9, 0xbe, 0x2e, 0x07, 0xc6,
-	0xbe, 0x2f, 0x44, 0x1d, 0xfa, 0xfb, 0x68, 0xca, 0x26, 0x71, 0xff, 0x3a, 0xe6, 0xbf, 0xb9, 0xad,
-	0x7a, 0xc7, 0x89, 0x22, 0xb9, 0x53, 0x2c, 0xf6, 0xdb, 0x29, 0xee, 0x5f, 0x37, 0x53, 0xa8, 0xf0,
-	0x5d, 0x2d, 0x02, 0xd7, 0xa9, 0xf7, 0xf0, 0x29, 0xde, 0xa5, 0xd3, 0xdf, 0xd5, 0xe2, 0xcd, 0x1b,
-	0x6a, 0x93, 0xfe, 0x9d, 0x2c, 0x9c, 0x4e, 0x27, 0x54, 0xdb, 0x92, 0x19, 0xd0, 0x96, 0x8b, 0x90,
-	0x5f, 0x73, 0xfd, 0x40, 0x31, 0x12, 0x44, 0xf5, 0xff, 0x9e, 0x80, 0x99, 0x61, 0x29, 0xbb, 0x73,
-	0xb3, 0xbf, 0xc3, 0xe5, 0x89, 0xfc, 0x30, 0xba, 0x07, 0xbb, 0x73, 0xf3, 0x22, 0x72, 0x0b, 0xf2,
-	0xa6, 0x70, 0xb4, 0x8a, 0x75, 0x8d, 0x04, 0x87, 0xd2, 0x14, 0xf1, 0x04, 0x44, 0x8b, 0x27, 0x2f,
-	0x60, 0xa4, 0x0c, 0xe3, 0x62, 0xf4, 0x63, 0x4f, 0xc7, 0x29, 0x53, 0x46, 0x4f, 0xf1, 0x20, 0xe9,
-	0xd8, 0x8e, 0x82, 0x8f, 0x80, 0xd5, 0x8a, 0xf4, 0x99, 0xc2, 0x1d, 0x85, 0x3f, 0x12, 0xea, 0xf6,
-	0x98, 0x21, 0xa2, 0xf1, 0xcd, 0x2c, 0x80, 0xd4, 0xda, 0x3c, 0xb5, 0x33, 0xec, 0x73, 0xda, 0x0c,
-	0x53, 0xec, 0x8d, 0x86, 0xcf, 0x81, 0x7d, 0x0f, 0xcd, 0x79, 0x86, 0xcf, 0x80, 0x5d, 0x82, 0xd1,
-	0xcd, 0x48, 0xa1, 0x25, 0x5c, 0x52, 0x50, 0x1d, 0xcd, 0xe1, 0xc6, 0x36, 0xcc, 0xdf, 0xa2, 0x41,
-	0xa4, 0xde, 0x92, 0x4f, 0x8f, 0x83, 0xd9, 0xbe, 0x0e, 0x13, 0x02, 0x3f, 0xdc, 0xbf, 0xb8, 0x2e,
-	0x46, 0x04, 0xcc, 0x41, 0x5d, 0x8c, 0x44, 0x60, 0xbb, 0x51, 0x85, 0xb6, 0x68, 0x40, 0x3f, 0xdd,
-	0x6a, 0xea, 0x40, 0x78, 0x53, 0xb0, 0x65, 0xc3, 0xd5, 0x70, 0x6c, 0xff, 0xdc, 0x87, 0x53, 0xe1,
-	0xb7, 0x3f, 0x49, 0xbe, 0x57, 0xd9, 0x95, 0x52, 0x64, 0x47, 0x88, 0x38, 0x0e, 0xb0, 0x3d, 0xf9,
-	0xbd, 0x0c, 0x2c, 0x4a, 0x8a, 0x07, 0x4e, 0x68, 0x39, 0x39, 0x14, 0x31, 0x79, 0x1b, 0x26, 0x15,
-	0x1a, 0x11, 0xde, 0x1f, 0xf5, 0xd4, 0x8f, 0x9c, 0x60, 0xcf, 0xf2, 0x39, 0x5c, 0xd5, 0x53, 0x2b,
-	0xe8, 0x64, 0x1b, 0x16, 0xeb, 0xe5, 0xbb, 0xeb, 0xf7, 0xed, 0x96, 0xd3, 0xc4, 0x6d, 0x60, 0xc3,
-	0xbd, 0xe9, 0xb6, 0x5a, 0xee, 0xa3, 0x2d, 0x73, 0x5d, 0xe6, 0xe8, 0xc1, 0xa8, 0x20, 0xa8, 0xf4,
-	0x7e, 0x18, 0xa2, 0x59, 0x1d, 0xd7, 0xda, 0x41, 0x44, 0xab, 0xe7, 0xb5, 0x7c, 0x73, 0x00, 0x17,
-	0xe3, 0x9f, 0x65, 0xe0, 0xd9, 0xd0, 0x39, 0x29, 0xa5, 0x7d, 0xb1, 0x16, 0x64, 0x9e, 0x64, 0x0b,
-	0xb2, 0x4f, 0xa4, 0x05, 0x1b, 0xd1, 0xf8, 0x54, 0x3b, 0xa1, 0x63, 0xb8, 0xfc, 0x7e, 0xa2, 0x8e,
-	0x8f, 0x18, 0x95, 0xe7, 0x12, 0xae, 0xe6, 0x8a, 0x47, 0xb9, 0xf1, 0x96, 0xd2, 0x21, 0x29, 0x0c,
-	0x35, 0xe2, 0x4c, 0x9c, 0xf8, 0x9b, 0x59, 0x98, 0xb9, 0x57, 0xad, 0xac, 0x84, 0x76, 0x54, 0xdf,
-	0x63, 0xb9, 0xc6, 0xb5, 0xb6, 0xf5, 0xdf, 0x39, 0x8d, 0x2d, 0x98, 0x8b, 0x75, 0x03, 0x0a, 0x41,
-	0xef, 0x72, 0xd7, 0x99, 0x10, 0x2c, 0x05, 0xa0, 0xd3, 0x69, 0xec, 0xef, 0x5f, 0x37, 0x63, 0xd8,
-	0xc6, 0xff, 0x09, 0x31, 0xbe, 0x62, 0x33, 0x7e, 0x1d, 0x26, 0xaa, 0xbe, 0xdf, 0xa3, 0xde, 0x96,
-	0xb9, 0xae, 0x2a, 0x3d, 0x1c, 0x04, 0xb2, 0x39, 0x64, 0x46, 0x08, 0xe4, 0x12, 0xe4, 0x45, 0x8c,
-	0x78, 0xb9, 0xbb, 0xa1, 0xfe, 0x39, 0x0c, 0x31, 0x6f, 0x86, 0xc5, 0xe4, 0x0d, 0x28, 0xf0, 0xbf,
-	0xf9, 0x8c, 0x16, 0x1d, 0x8e, 0x6a, 0x4e, 0x81, 0xce, 0x57, 0x80, 0xa9, 0xa1, 0x91, 0x57, 0x21,
-	0x57, 0x5e, 0x31, 0x85, 0x62, 0x4b, 0x48, 0xc0, 0x9e, 0xc5, 0xb5, 0x8f, 0xda, 0x75, 0x68, 0xc5,
-	0x64, 0x72, 0xac, 0x8c, 0xb5, 0x21, 0x74, 0xf2, 0x38, 0x03, 0xa4, 0xde, 0x2c, 0x76, 0x2c, 0x23,
-	0x8c, 0x5c, 0x85, 0xf1, 0x0a, 0x37, 0xfe, 0x13, 0x1a, 0x79, 0x9e, 0x93, 0x92, 0x83, 0xb4, 0xd8,
-	0x12, 0x1c, 0x44, 0x2e, 0xc9, 0xac, 0x76, 0xf9, 0xc8, 0x03, 0xa7, 0x4f, 0xea, 0xba, 0xd7, 0x61,
-	0x4c, 0x44, 0x52, 0x9f, 0x50, 0x52, 0xd7, 0xc4, 0x23, 0xa8, 0x0b, 0x9c, 0xa4, 0x2b, 0x2e, 0x3c,
-	0x49, 0x57, 0xdc, 0x6d, 0x38, 0x73, 0x0b, 0xf5, 0x50, 0x7a, 0x3c, 0xb0, 0x2d, 0xb3, 0x2a, 0x34,
-	0xfb, 0xf8, 0xa0, 0xc5, 0x55, 0x55, 0xf1, 0x90, 0x62, 0x56, 0xcf, 0x53, 0x53, 0x2c, 0xf7, 0x63,
-	0x44, 0xbe, 0x04, 0xf3, 0x69, 0x45, 0x42, 0xff, 0x8f, 0x91, 0xaf, 0xd2, 0x2b, 0x50, 0x23, 0x5f,
-	0xa5, 0x71, 0x20, 0xeb, 0x50, 0xe4, 0xf0, 0x72, 0xb3, 0xed, 0x74, 0xf8, 0x1b, 0x06, 0x7f, 0x1f,
-	0x40, 0x97, 0x18, 0xc1, 0xd5, 0x66, 0x85, 0xfc, 0x2d, 0x43, 0x73, 0xa2, 0x8a, 0x51, 0x92, 0xbf,
-	0x92, 0x61, 0xf7, 0x52, 0x1e, 0x77, 0x1c, 0xb7, 0xcf, 0x69, 0xf1, 0x1a, 0x1a, 0x7a, 0x35, 0xd5,
-	0x03, 0xcf, 0xe9, 0xec, 0x0a, 0x07, 0xa9, 0x4d, 0xe1, 0x20, 0xf5, 0xf6, 0xc7, 0x72, 0x90, 0xe2,
-	0xac, 0xfc, 0xa3, 0xc3, 0x52, 0xc1, 0x13, 0x75, 0xe2, 0x2a, 0xd2, 0xbe, 0x80, 0x75, 0x1d, 0x7a,
-	0x09, 0x6f, 0x75, 0x78, 0xd4, 0x63, 0xda, 0xe4, 0x8d, 0x9c, 0xc1, 0x8d, 0x1d, 0xbb, 0xce, 0xe6,
-	0x9b, 0x78, 0x88, 0x90, 0x68, 0x68, 0x2a, 0x07, 0x76, 0x85, 0x96, 0x4e, 0x38, 0xdc, 0xaf, 0xb8,
-	0x18, 0x5d, 0xa1, 0xa5, 0xc7, 0x8e, 0x85, 0xd3, 0x48, 0x9d, 0x3c, 0x1a, 0x09, 0xb9, 0x0a, 0x63,
-	0x77, 0xed, 0xc7, 0xe5, 0x5d, 0x2a, 0x72, 0xb0, 0x4e, 0xc9, 0xed, 0x0f, 0x81, 0xcb, 0xf9, 0xdf,
-	0xe5, 0x5e, 0x1b, 0xcf, 0x98, 0x02, 0x8d, 0xfc, 0x60, 0x06, 0x4e, 0xf3, 0x65, 0x2c, 0x5b, 0x59,
-	0xa7, 0x41, 0xc0, 0xfa, 0x41, 0x84, 0x4f, 0x3c, 0x1f, 0x99, 0x9e, 0xa7, 0xe3, 0x61, 0x0c, 0x01,
-	0x43, 0xec, 0x0c, 0x61, 0xc7, 0xf9, 0xa2, 0x54, 0x8b, 0x43, 0x9d, 0x4a, 0x4f, 0x36, 0x61, 0xf2,
-	0xee, 0xcd, 0x72, 0x58, 0x2d, 0x0f, 0x4e, 0x5f, 0x4a, 0xdb, 0x1d, 0x15, 0xb4, 0x34, 0x9f, 0x09,
-	0x95, 0x0d, 0x8a, 0xfe, 0x77, 0x56, 0x56, 0xd1, 0x6d, 0x7f, 0x3e, 0x52, 0x26, 0x74, 0xf7, 0x1b,
-	0x34, 0x1e, 0x20, 0x3b, 0x44, 0x14, 0xce, 0x11, 0x9f, 0x93, 0x9d, 0x48, 0x2e, 0xab, 0x9e, 0xb8,
-	0x39, 0xe4, 0x30, 0xde, 0xb6, 0x1f, 0x5b, 0xf6, 0x2e, 0xd5, 0x8c, 0x04, 0x84, 0xf2, 0xfe, 0x67,
-	0x33, 0x70, 0xb6, 0x6f, 0x3f, 0x91, 0x1b, 0x70, 0xc6, 0xe6, 0xfe, 0xe5, 0xd6, 0x5e, 0x10, 0x74,
-	0x7d, 0x4b, 0xde, 0xb0, 0x84, 0xef, 0xae, 0x79, 0x4a, 0x14, 0xaf, 0xb1, 0x52, 0x79, 0xe9, 0xf2,
-	0xc9, 0x7b, 0xf0, 0x9c, 0xd3, 0xf1, 0x69, 0xa3, 0xe7, 0x51, 0x4b, 0x32, 0x68, 0x38, 0x4d, 0xcf,
-	0xf2, 0xec, 0xce, 0xae, 0x74, 0x44, 0x36, 0xcf, 0x4a, 0x1c, 0xe1, 0xc3, 0xbe, 0xe2, 0x34, 0x3d,
-	0x13, 0x11, 0x8c, 0x7f, 0x93, 0x81, 0x85, 0x7e, 0xfd, 0x48, 0x16, 0x60, 0x9c, 0x2a, 0xb9, 0x6d,
-	0xf2, 0xa6, 0xfc, 0x49, 0x9e, 0x85, 0xe8, 0x78, 0x10, 0x22, 0x43, 0xbe, 0x21, 0xf2, 0x8c, 0xa0,
-	0x65, 0xbf, 0x7a, 0x18, 0x08, 0xfb, 0xec, 0x42, 0x43, 0x3d, 0x12, 0xce, 0x01, 0x44, 0x67, 0x00,
-	0xd7, 0xcb, 0x98, 0x13, 0x76, 0xc3, 0xe3, 0xcb, 0x95, 0x9c, 0x86, 0x31, 0xbe, 0xc7, 0x0a, 0xf7,
-	0x0f, 0xf1, 0x8b, 0x1d, 0xf6, 0xa2, 0x93, 0xf1, 0x70, 0xc8, 0x2d, 0x17, 0xb4, 0xce, 0x1e, 0x6b,
-	0xe3, 0xe0, 0x18, 0xbf, 0x56, 0xe0, 0x72, 0x47, 0xb9, 0x17, 0xec, 0x49, 0x49, 0x65, 0x29, 0xcd,
-	0x5d, 0x8e, 0x9b, 0x92, 0x2a, 0x66, 0xe9, 0xba, 0x93, 0x9c, 0x7c, 0xfa, 0xca, 0xa6, 0x3e, 0x7d,
-	0xbd, 0x0e, 0x13, 0x2b, 0x7b, 0xb4, 0xb1, 0x1f, 0xfa, 0x20, 0xe5, 0xc5, 0xdb, 0x02, 0x03, 0xf2,
-	0x30, 0xf2, 0x11, 0x02, 0xb9, 0x0a, 0x80, 0x5e, 0xba, 0x5c, 0x20, 0x57, 0x52, 0xc1, 0xa0, 0x53,
-	0xaf, 0xb0, 0xce, 0x51, 0x50, 0x90, 0x7d, 0xdd, 0xbc, 0xa9, 0x9a, 0xf3, 0x70, 0xf6, 0xbe, 0xb7,
-	0x23, 0xd0, 0x23, 0x04, 0xd6, 0x3c, 0x65, 0x33, 0x12, 0x47, 0x67, 0x31, 0xb1, 0x63, 0xa9, 0x48,
-	0xe4, 0x73, 0x30, 0xbe, 0x42, 0xbd, 0x60, 0x73, 0x73, 0x1d, 0x6d, 0x68, 0x78, 0x06, 0x94, 0x3c,
-	0x66, 0xab, 0x08, 0x82, 0xd6, 0x77, 0x0f, 0x4b, 0x53, 0x81, 0xd3, 0xa6, 0x61, 0x64, 0x77, 0x53,
-	0x62, 0x93, 0x65, 0x28, 0xf2, 0x57, 0xfe, 0xe8, 0x2a, 0x85, 0xc7, 0x63, 0x9e, 0x1f, 0xd6, 0xc2,
-	0x24, 0xe0, 0x11, 0xdd, 0x0e, 0x73, 0x75, 0x24, 0xf0, 0xc9, 0xaa, 0x4c, 0x71, 0xa3, 0x7e, 0x36,
-	0x44, 0xcb, 0x31, 0xbe, 0x6d, 0xb0, 0xaf, 0x4f, 0x52, 0x90, 0x32, 0x4c, 0xad, 0xb8, 0xed, 0xae,
-	0x1d, 0x38, 0x98, 0x40, 0xf4, 0x40, 0x9c, 0x84, 0xa8, 0x9f, 0x6c, 0xa8, 0x05, 0xda, 0xb1, 0xaa,
-	0x16, 0x90, 0x9b, 0x30, 0x6d, 0xba, 0x3d, 0xd6, 0xed, 0x52, 0xa9, 0xc0, 0x0f, 0x3b, 0xb4, 0x74,
-	0xf1, 0x58, 0x09, 0x3b, 0x9b, 0x85, 0x06, 0x41, 0x8b, 0x82, 0xab, 0x51, 0x91, 0x8d, 0x94, 0xd7,
-	0x1d, 0xf5, 0x84, 0x53, 0x33, 0x76, 0x24, 0x98, 0xa5, 0x3c, 0x0c, 0x5d, 0x87, 0xc9, 0x7a, 0xfd,
-	0xde, 0x26, 0xf5, 0x83, 0x9b, 0x2d, 0xf7, 0x11, 0x1e, 0x70, 0x79, 0x91, 0x60, 0xce, 0x77, 0xad,
-	0x80, 0xfa, 0x81, 0xb5, 0xd3, 0x72, 0x1f, 0x99, 0x2a, 0x16, 0xf9, 0x2a, 0xeb, 0x0f, 0x45, 0x1c,
-	0x14, 0xf1, 0x7e, 0x07, 0x49, 0xac, 0x78, 0x8c, 0x44, 0x8b, 0x80, 0xc9, 0xad, 0x7a, 0x67, 0x29,
-	0xe8, 0xe8, 0x22, 0xe7, 0xb9, 0x8f, 0x0f, 0xca, 0xcd, 0xa6, 0x47, 0x7d, 0x5f, 0x9c, 0x44, 0xdc,
-	0x45, 0x0e, 0x75, 0x27, 0x36, 0x2f, 0xd0, 0x5c, 0xe4, 0x14, 0x02, 0xb2, 0xc2, 0x44, 0x24, 0x36,
-	0x8a, 0x68, 0x7b, 0x55, 0xad, 0xe1, 0x61, 0x22, 0x94, 0xb2, 0x62, 0xcc, 0xb9, 0x95, 0x96, 0xd3,
-	0xd5, 0x25, 0x21, 0x85, 0x86, 0x54, 0x61, 0x86, 0x03, 0xd8, 0xd2, 0xe2, 0xe9, 0xa5, 0xe6, 0xa2,
-	0x04, 0x17, 0x82, 0x0d, 0x9a, 0x0b, 0x60, 0x8a, 0x29, 0x35, 0x28, 0x6c, 0x8c, 0x8e, 0xbc, 0x07,
-	0xd3, 0x18, 0xbb, 0x3f, 0xf4, 0x33, 0xc2, 0x33, 0xa1, 0xc0, 0x63, 0xdb, 0x8a, 0x92, 0x98, 0xf3,
-	0x5e, 0xc1, 0xf7, 0xf7, 0x6a, 0xd2, 0x01, 0x89, 0x31, 0x40, 0x73, 0x9f, 0x88, 0xc1, 0xa9, 0x88,
-	0x81, 0x28, 0x89, 0x33, 0x08, 0x5a, 0x7e, 0xc4, 0xe0, 0x67, 0x32, 0x70, 0x96, 0x55, 0xa4, 0xba,
-	0x14, 0xe1, 0xa6, 0x80, 0xb6, 0x4c, 0x3c, 0xef, 0xc8, 0xe5, 0x2b, 0x52, 0x3e, 0xb9, 0xa2, 0xa0,
-	0x5d, 0x79, 0x78, 0xed, 0x4a, 0x39, 0xfa, 0x59, 0x97, 0x44, 0x3c, 0xda, 0x67, 0x5f, 0x9e, 0xaa,
-	0x1c, 0xe8, 0xfb, 0x7b, 0x69, 0x1c, 0xf0, 0xa3, 0xd8, 0xc7, 0xa7, 0x7f, 0xd4, 0x99, 0x8f, 0xfd,
-	0x51, 0x7d, 0x79, 0xaa, 0x1f, 0x15, 0xb4, 0xfc, 0xd4, 0x8f, 0xba, 0x01, 0x53, 0x78, 0x4a, 0x0b,
-	0xe9, 0xc8, 0x13, 0x59, 0x4d, 0x70, 0x4d, 0x68, 0x05, 0x66, 0x81, 0xfd, 0xbc, 0x2f, 0x7e, 0xdd,
-	0x1e, 0xc9, 0x8f, 0x17, 0xf3, 0xb7, 0x47, 0xf2, 0xb3, 0x45, 0x62, 0x4e, 0x84, 0x1d, 0x6f, 0x9e,
-	0x4a, 0xfd, 0x10, 0xbc, 0xb5, 0xb2, 0x1b, 0x76, 0x74, 0xf5, 0xfa, 0xde, 0xf2, 0xaf, 0xd1, 0xda,
-	0x36, 0xc0, 0xbf, 0x66, 0x8b, 0xbb, 0x7b, 0x2b, 0xdd, 0x20, 0x6f, 0xad, 0x1a, 0x38, 0x7e, 0x6b,
-	0x8d, 0xd1, 0x98, 0x31, 0x6c, 0xe3, 0x9b, 0x93, 0x31, 0xbe, 0xc2, 0xa6, 0xd6, 0x80, 0x31, 0x7e,
-	0x29, 0x15, 0x9d, 0x8c, 0xc6, 0x15, 0xfc, 0xca, 0x6a, 0x8a, 0x12, 0x72, 0x16, 0x72, 0xf5, 0xfa,
-	0x3d, 0xd1, 0xc9, 0x68, 0x59, 0xeb, 0xfb, 0xae, 0xc9, 0x60, 0x6c, 0x84, 0xd0, 0x5c, 0x56, 0xc9,
-	0xb8, 0xc0, 0x4e, 0x32, 0x13, 0xa1, 0xac, 0xbf, 0xe5, 0x15, 0x71, 0x24, 0xea, 0x6f, 0x71, 0x45,
-	0x8c, 0x2e, 0x86, 0x2b, 0xb0, 0x50, 0xf6, 0x7d, 0xea, 0xb1, 0x19, 0x21, 0xac, 0x30, 0x3d, 0x71,
-	0x8d, 0x11, 0x47, 0x30, 0x56, 0x6a, 0x37, 0x7c, 0xb3, 0x2f, 0x22, 0xb9, 0x08, 0xf9, 0x72, 0xaf,
-	0xe9, 0xd0, 0x4e, 0x43, 0x8b, 0x1f, 0x67, 0x0b, 0x98, 0x19, 0x96, 0x92, 0xf7, 0xe1, 0x54, 0x2c,
-	0xbe, 0xa4, 0xe8, 0x81, 0xf1, 0x68, 0x57, 0x95, 0xd7, 0xac, 0xc8, 0x72, 0x84, 0x77, 0x49, 0x3a,
-	0x25, 0x29, 0x43, 0x71, 0x15, 0xfd, 0xc9, 0x2a, 0x94, 0x3f, 0x62, 0xb9, 0x1e, 0x77, 0x24, 0xe4,
-	0x97, 0x62, 0x11, 0x45, 0xb3, 0x19, 0x16, 0x9a, 0x09, 0x74, 0x72, 0x07, 0xe6, 0xe2, 0x30, 0x76,
-	0x36, 0xf3, 0xfb, 0x2f, 0xee, 0x6a, 0x09, 0x2e, 0x78, 0x3a, 0xa7, 0x51, 0x91, 0x6d, 0x98, 0x8d,
-	0x2c, 0xa7, 0xf4, 0x5b, 0xb1, 0x34, 0xc8, 0x0e, 0xcb, 0xe5, 0xcd, 0xf8, 0x59, 0x31, 0x19, 0xe7,
-	0x22, 0x2b, 0xac, 0xf0, 0x76, 0x6c, 0x26, 0xd9, 0x91, 0x26, 0x4c, 0xd7, 0x9d, 0xdd, 0x8e, 0xd3,
-	0xd9, 0xbd, 0x43, 0x0f, 0x6a, 0xb6, 0xe3, 0x09, 0xd3, 0x58, 0x69, 0xf8, 0x5e, 0xf6, 0x0f, 0xda,
-	0x6d, 0x1a, 0x78, 0xb8, 0xea, 0x59, 0x39, 0x3a, 0xcb, 0xb3, 0xdb, 0xce, 0xa2, 0xcf, 0xe9, 0xd0,
-	0xbf, 0xb4, 0x6b, 0x3b, 0xda, 0xf1, 0xae, 0xf3, 0xd4, 0x34, 0x13, 0x85, 0x21, 0x35, 0x13, 0x2d,
-	0x98, 0x5d, 0xed, 0x34, 0xbc, 0x03, 0x7c, 0x4b, 0x94, 0x1f, 0x37, 0x75, 0xcc, 0xc7, 0xbd, 0x24,
-	0x3e, 0xee, 0x39, 0x5b, 0xce, 0xb0, 0xb4, 0xcf, 0x4b, 0x32, 0x26, 0x75, 0x98, 0x45, 0x11, 0xbf,
-	0x5a, 0xa9, 0x55, 0x3b, 0x4e, 0xe0, 0xd8, 0x01, 0x6d, 0x0a, 0xb1, 0x21, 0xcc, 0x53, 0xc3, 0x6f,
-	0xa0, 0x4e, 0xb3, 0x6b, 0x39, 0x12, 0x45, 0x65, 0x9a, 0xa0, 0x1f, 0x74, 0x0d, 0x9c, 0xf9, 0x53,
-	0xba, 0x06, 0x56, 0x61, 0x26, 0x1e, 0x73, 0xa2, 0x18, 0x9d, 0xf6, 0x3e, 0x16, 0x31, 0xa1, 0xc1,
-	0xed, 0xa1, 0x98, 0xa8, 0xa5, 0x86, 0x8d, 0x45, 0x9b, 0x88, 0xdd, 0x28, 0x67, 0xb5, 0x1b, 0xa5,
-	0xb6, 0x2b, 0x9d, 0xe4, 0x46, 0x59, 0x03, 0xb8, 0xe9, 0x7a, 0x0d, 0x5a, 0x46, 0x47, 0x6e, 0xa2,
-	0x65, 0xf3, 0x62, 0x4c, 0xa3, 0x42, 0xbe, 0x7e, 0x76, 0xd8, 0x6f, 0x2b, 0xee, 0x8f, 0xaf, 0xf0,
-	0x20, 0x36, 0x9c, 0xa9, 0x79, 0x74, 0x87, 0x7a, 0x1e, 0x6d, 0x8a, 0x1b, 0xcc, 0xb2, 0xd3, 0x69,
-	0xca, 0x14, 0x6d, 0x22, 0x9e, 0x77, 0x57, 0xa2, 0x84, 0x86, 0xe4, 0xdb, 0x1c, 0x49, 0x3d, 0x4c,
-	0xfb, 0xf0, 0x31, 0x7e, 0x3c, 0x0b, 0x0b, 0xfd, 0x5a, 0x3c, 0xe0, 0xee, 0xf7, 0x1a, 0x24, 0x37,
-	0x11, 0x71, 0x07, 0x2c, 0xd2, 0xf8, 0x56, 0xb2, 0x04, 0xe9, 0x7b, 0x85, 0xb8, 0x13, 0xce, 0xc5,
-	0x09, 0xb6, 0xbc, 0x16, 0xb9, 0x01, 0x93, 0x4a, 0xff, 0xe0, 0x76, 0xdd, 0xaf, 0x37, 0x4d, 0xd8,
-	0x89, 0xba, 0xec, 0x34, 0x88, 0xd3, 0x42, 0xde, 0x19, 0xf9, 0x2f, 0x52, 0xe4, 0xee, 0xf2, 0x63,
-	0xdc, 0x22, 0xc2, 0xf7, 0x5d, 0x42, 0x00, 0x8f, 0x06, 0xbe, 0xcb, 0x9a, 0xf8, 0xb7, 0xf1, 0x8b,
-	0x05, 0x7e, 0xe8, 0xab, 0x57, 0xc6, 0x7e, 0xb6, 0xd2, 0xb1, 0xab, 0x64, 0xf6, 0x24, 0x57, 0xc9,
-	0xdc, 0xf1, 0x57, 0xc9, 0x91, 0xe3, 0xae, 0x92, 0xb1, 0xbb, 0xde, 0xe8, 0x09, 0xef, 0x7a, 0xe3,
-	0x27, 0xba, 0xeb, 0x69, 0xd7, 0xd0, 0xfc, 0x71, 0xd7, 0xd0, 0x3f, 0xbf, 0x19, 0x3e, 0xad, 0x37,
-	0xc3, 0x34, 0xa9, 0xf0, 0x44, 0x37, 0xc3, 0xc4, 0xc5, 0x6e, 0xf6, 0xc9, 0x5c, 0xec, 0xc8, 0x13,
-	0xbb, 0xd8, 0xcd, 0x7d, 0xd2, 0x8b, 0xdd, 0xfc, 0x93, 0xbc, 0xd8, 0x9d, 0xfa, 0xb3, 0x78, 0xb1,
-	0x3b, 0xfd, 0x1f, 0xe6, 0x62, 0x77, 0x1d, 0xf2, 0x35, 0xd7, 0x0f, 0x6e, 0xba, 0x5e, 0x1b, 0xef,
-	0x96, 0x05, 0xa1, 0x92, 0x75, 0x7d, 0x9e, 0x25, 0x59, 0x13, 0xae, 0x04, 0x22, 0x59, 0x96, 0x13,
-	0x4e, 0xde, 0xa4, 0x16, 0x22, 0xad, 0xb8, 0x98, 0x29, 0xe2, 0x42, 0x95, 0x9c, 0x6f, 0x82, 0xe4,
-	0xf6, 0x48, 0x7e, 0xac, 0x38, 0x7e, 0x7b, 0x24, 0x5f, 0x2c, 0xce, 0x0e, 0x71, 0x33, 0xfc, 0x0b,
-	0x50, 0x8c, 0x0b, 0xab, 0xc7, 0x87, 0x7b, 0x7e, 0x62, 0xb1, 0x36, 0x99, 0x28, 0x1d, 0x17, 0x16,
-	0xc9, 0x55, 0x80, 0x9a, 0xe7, 0x3c, 0xb4, 0x03, 0x7a, 0x47, 0x9a, 0xfd, 0x89, 0xf8, 0xe6, 0x1c,
-	0xca, 0x26, 0xa8, 0xa9, 0xa0, 0x84, 0xf7, 0xa4, 0x6c, 0xda, 0x3d, 0xc9, 0xf8, 0xb1, 0x2c, 0xcc,
-	0xf2, 0x80, 0x75, 0x4f, 0xff, 0x9b, 0xed, 0xbb, 0xda, 0xed, 0xf7, 0xb9, 0x28, 0xa3, 0x82, 0xda,
-	0xba, 0x01, 0xaf, 0xb6, 0x1f, 0xc2, 0xa9, 0x44, 0x57, 0xe0, 0x0d, 0xb8, 0x22, 0x43, 0x05, 0x26,
-	0xee, 0xc0, 0x0b, 0xe9, 0x95, 0xdc, 0xbf, 0x6e, 0x26, 0x28, 0x8c, 0x3f, 0x1a, 0x49, 0xf0, 0x17,
-	0xef, 0xb7, 0xea, 0x8b, 0x6c, 0xe6, 0x64, 0x2f, 0xb2, 0xd9, 0xe1, 0x5e, 0x64, 0x63, 0x12, 0x44,
-	0x6e, 0x18, 0x09, 0xe2, 0x7d, 0x98, 0xda, 0xa4, 0x76, 0xdb, 0xdf, 0x74, 0x45, 0x7a, 0x2e, 0xee,
-	0x64, 0x22, 0x23, 0x01, 0xb2, 0x32, 0x79, 0x81, 0x0b, 0x8d, 0x65, 0x03, 0x46, 0xc0, 0xce, 0x48,
-	0x9e, 0xaf, 0xcb, 0xd4, 0x39, 0xa8, 0xb7, 0xf2, 0xd1, 0x01, 0xb7, 0xf2, 0x3a, 0x14, 0x04, 0x5d,
-	0x14, 0xe3, 0x3a, 0xba, 0x3e, 0xb2, 0x22, 0x84, 0xcb, 0xda, 0xa5, 0xb7, 0xe7, 0x74, 0x58, 0x3b,
-	0xbf, 0x39, 0x6a, 0x4c, 0x58, 0x17, 0xac, 0x76, 0x9a, 0x5d, 0xd7, 0xe9, 0x60, 0x17, 0x8c, 0x47,
-	0x5d, 0x40, 0x05, 0x98, 0x77, 0x81, 0x82, 0x44, 0xde, 0x86, 0xe9, 0x72, 0xad, 0xaa, 0x92, 0xe5,
-	0xa3, 0x47, 0x61, 0xbb, 0xeb, 0x58, 0x1a, 0x69, 0x0c, 0x77, 0xd0, 0x4d, 0x6a, 0xe2, 0x4f, 0xe7,
-	0x26, 0x65, 0xfc, 0x46, 0x41, 0x2e, 0xef, 0x4f, 0xf7, 0x69, 0x44, 0x7f, 0xec, 0xc8, 0x9d, 0xf0,
-	0xb1, 0x63, 0xe4, 0x38, 0x29, 0x53, 0x11, 0x66, 0xc7, 0x3e, 0xf1, 0xc3, 0xc5, 0xf8, 0x09, 0xc5,
-	0xd3, 0xd8, 0xda, 0xc9, 0x0f, 0xb3, 0x76, 0x52, 0x45, 0xda, 0x89, 0x4f, 0x2e, 0xd2, 0xc2, 0x89,
-	0x45, 0xda, 0x7a, 0xe4, 0x84, 0x3d, 0x79, 0xac, 0x6f, 0xcb, 0x39, 0xa1, 0x35, 0x98, 0x4d, 0x0f,
-	0x27, 0x18, 0xba, 0x63, 0x7f, 0x4f, 0xc9, 0xc9, 0x5f, 0x4b, 0x97, 0x93, 0x07, 0x9f, 0x1f, 0x7f,
-	0x2e, 0x29, 0xff, 0xb9, 0xa4, 0xfc, 0xa7, 0x22, 0x29, 0xdf, 0x03, 0x62, 0xf7, 0x82, 0x3d, 0xda,
-	0x09, 0x9c, 0x06, 0x86, 0xb4, 0x65, 0x43, 0x8c, 0x32, 0xb3, 0x58, 0x23, 0xc9, 0x52, 0x75, 0x8d,
-	0x68, 0xa5, 0x6c, 0x06, 0xf0, 0x30, 0xa0, 0x43, 0x4b, 0xc0, 0x1e, 0xae, 0xa8, 0x07, 0xb6, 0xd7,
-	0x41, 0x35, 0xd1, 0x55, 0x18, 0x97, 0x21, 0x54, 0x33, 0x91, 0x92, 0x39, 0x19, 0x3b, 0x55, 0x62,
-	0x91, 0x25, 0xc8, 0x4b, 0x62, 0x35, 0x11, 0xd0, 0x23, 0x01, 0xd3, 0xa2, 0x53, 0x0a, 0x98, 0xf1,
-	0x9f, 0x8c, 0xc8, 0x5d, 0x9b, 0x7d, 0x70, 0xcd, 0xf6, 0xec, 0x36, 0xe6, 0x08, 0x0c, 0x17, 0x95,
-	0x22, 0x7f, 0xc7, 0xd6, 0x61, 0xcc, 0x2d, 0x41, 0x27, 0xf9, 0x58, 0x31, 0x70, 0xa3, 0x34, 0xcc,
-	0xb9, 0x21, 0xd2, 0x30, 0xbf, 0xa9, 0xe5, 0x30, 0x1e, 0x89, 0x92, 0x66, 0xb2, 0x9d, 0x6c, 0x70,
-	0xf6, 0xe2, 0x1b, 0x6a, 0xb2, 0xe1, 0xd1, 0x28, 0x22, 0x19, 0x52, 0x0e, 0x48, 0x33, 0x1c, 0x5e,
-	0x28, 0xc6, 0x4e, 0x12, 0x5d, 0x7a, 0xfc, 0x3f, 0x68, 0x74, 0xe9, 0x55, 0x00, 0x71, 0xba, 0x46,
-	0xb6, 0x08, 0x2f, 0xe3, 0xe6, 0x23, 0x4c, 0xac, 0x83, 0xa0, 0xd5, 0x27, 0xfd, 0x88, 0x42, 0x68,
-	0xfc, 0x2b, 0x02, 0xb3, 0xf5, 0xfa, 0xbd, 0x8a, 0x63, 0xef, 0x76, 0x5c, 0x3f, 0x70, 0x1a, 0xd5,
-	0xce, 0x8e, 0xcb, 0xa4, 0xe9, 0xf0, 0x04, 0x50, 0xe2, 0x02, 0x47, 0xbb, 0x7f, 0x58, 0xcc, 0x6e,
-	0x6b, 0xab, 0x9e, 0x27, 0xf5, 0x99, 0xfc, 0xb6, 0x46, 0x19, 0xc0, 0xe4, 0x70, 0x26, 0xb0, 0xd6,
-	0x7b, 0x18, 0x95, 0x43, 0x18, 0x7c, 0xa0, 0xc0, 0xea, 0x73, 0x90, 0x29, 0xcb, 0x08, 0x4d, 0x4e,
-	0x58, 0x71, 0x81, 0x39, 0xa3, 0xc5, 0xa8, 0x8e, 0x8a, 0xf9, 0xda, 0x15, 0xf2, 0x07, 0xee, 0xda,
-	0x5d, 0x84, 0xab, 0x36, 0x70, 0x89, 0x35, 0x70, 0x00, 0xa7, 0x34, 0x7f, 0xed, 0x61, 0xdf, 0x57,
-	0x5e, 0x15, 0x02, 0xb2, 0x81, 0x76, 0xc6, 0x29, 0x8f, 0x2c, 0x6a, 0xd2, 0xbf, 0xd4, 0x1a, 0xc8,
-	0x8f, 0x65, 0xe0, 0x5c, 0x6a, 0x49, 0xb8, 0xba, 0x27, 0xb5, 0x38, 0xe1, 0xca, 0xa6, 0xc1, 0xd3,
-	0x1b, 0xf6, 0xab, 0xda, 0x4a, 0xd9, 0x0a, 0x06, 0xd7, 0x44, 0x7e, 0x2d, 0x03, 0x67, 0x34, 0x8c,
-	0x70, 0xb7, 0xf4, 0xc3, 0x50, 0x26, 0xa9, 0xf3, 0xfa, 0xa3, 0x27, 0x33, 0xaf, 0x5f, 0xd4, 0xdb,
-	0x12, 0xed, 0x96, 0x6a, 0x1b, 0xfa, 0x7d, 0x21, 0x79, 0x08, 0xb3, 0x58, 0x24, 0xdf, 0x7a, 0xd8,
-	0x9c, 0x15, 0x4f, 0x44, 0xf3, 0xd1, 0x67, 0xf3, 0x18, 0x04, 0x98, 0xa2, 0x7e, 0xe9, 0x3b, 0x87,
-	0xa5, 0x29, 0x0d, 0x5d, 0x46, 0xde, 0xb6, 0xa2, 0x07, 0x23, 0xa7, 0xb3, 0xe3, 0xaa, 0xfb, 0x7e,
-	0xa2, 0x0a, 0xf2, 0xcf, 0x32, 0x5c, 0xfd, 0xcf, 0x9b, 0x71, 0xd3, 0x73, 0xdb, 0x61, 0xb9, 0x34,
-	0xa6, 0xec, 0xd3, 0x6d, 0xad, 0x27, 0xd3, 0x6d, 0x2f, 0xe3, 0x27, 0xf3, 0x3d, 0xc1, 0xda, 0xf1,
-	0xdc, 0x76, 0xf4, 0xf9, 0x6a, 0xc7, 0xf5, 0xfd, 0x48, 0xf2, 0x43, 0x19, 0x38, 0xab, 0x69, 0x2d,
-	0xd5, 0x34, 0x28, 0x22, 0xd2, 0xc3, 0x5c, 0x18, 0x03, 0x26, 0x2a, 0x5a, 0xbe, 0x22, 0xe6, 0xff,
-	0x05, 0xfc, 0x02, 0x25, 0xe4, 0x28, 0x43, 0xb2, 0xda, 0x1c, 0x4b, 0xf9, 0x84, 0xfe, 0xb5, 0x10,
-	0x07, 0x66, 0xd1, 0xa4, 0x46, 0x33, 0xfa, 0x9d, 0xef, 0x6f, 0xf4, 0x1b, 0x26, 0x38, 0xc2, 0xe4,
-	0x07, 0xfd, 0x2d, 0x7f, 0x93, 0x5c, 0xc9, 0x0f, 0xc0, 0xd9, 0x04, 0x30, 0x5c, 0x6d, 0xa7, 0xfa,
-	0xae, 0xb6, 0xd7, 0x8e, 0x0e, 0x4b, 0xaf, 0xa4, 0xd5, 0x96, 0xb6, 0xd2, 0xfa, 0xd7, 0x40, 0x6c,
-	0x80, 0xa8, 0x50, 0x48, 0x3f, 0xe9, 0x13, 0xf4, 0x35, 0x31, 0x3f, 0x14, 0x7c, 0xb6, 0x97, 0x2b,
-	0xdf, 0xa0, 0x1e, 0x79, 0x11, 0x12, 0xa1, 0x50, 0x50, 0x12, 0x3f, 0x1c, 0x08, 0x2b, 0x93, 0x3e,
-	0x95, 0x7c, 0xe7, 0xb0, 0xa4, 0x61, 0xb3, 0x3b, 0x90, 0x9a, 0x51, 0x42, 0x13, 0x36, 0x55, 0x44,
-	0xf2, 0xab, 0x19, 0x98, 0x67, 0x80, 0x68, 0x52, 0x89, 0x46, 0x2d, 0x0c, 0x9a, 0xf5, 0x7b, 0x4f,
-	0x66, 0xd6, 0xbf, 0x80, 0xdf, 0xa8, 0xce, 0xfa, 0x44, 0x97, 0xa4, 0x7e, 0x1c, 0xce, 0x76, 0xcd,
-	0x7a, 0x4b, 0x9b, 0xed, 0x67, 0x87, 0x98, 0xed, 0x7c, 0x00, 0x8e, 0x9f, 0xed, 0x7d, 0x6b, 0x21,
-	0x9b, 0x50, 0x10, 0xd7, 0x1f, 0xde, 0x61, 0xcf, 0x6b, 0x21, 0xa8, 0xd5, 0x22, 0x7e, 0x27, 0x15,
-	0x79, 0x31, 0x12, 0x2d, 0xd4, 0xb8, 0x90, 0x0e, 0xcc, 0xf1, 0xdf, 0xba, 0x7a, 0xa9, 0xd4, 0x57,
-	0xbd, 0x74, 0x51, 0xb4, 0xe8, 0xbc, 0xe0, 0x1f, 0xd3, 0x32, 0xa9, 0xa1, 0xa3, 0x52, 0x18, 0x93,
-	0x2e, 0x10, 0x0d, 0xcc, 0x17, 0xed, 0xf9, 0xc1, 0x4a, 0xa5, 0x57, 0x44, 0x9d, 0xa5, 0x78, 0x9d,
-	0xf1, 0x95, 0x9b, 0xc2, 0x9b, 0xd8, 0x30, 0x23, 0xa0, 0xee, 0x3e, 0xe5, 0x3b, 0xfc, 0x0b, 0x5a,
-	0xf0, 0xae, 0x58, 0x29, 0xbf, 0xc3, 0xc9, 0x9a, 0x30, 0xb8, 0x5a, 0x6c, 0x43, 0x8f, 0xf3, 0x23,
-	0xf7, 0x60, 0xb6, 0xdc, 0xed, 0xb6, 0x1c, 0xda, 0xc4, 0x56, 0x9a, 0x3d, 0xd6, 0x26, 0x23, 0x4a,
-	0x2d, 0x67, 0xf3, 0x42, 0x71, 0xb1, 0xf4, 0x7a, 0xb1, 0xed, 0x26, 0x41, 0x6b, 0xfc, 0x68, 0x26,
-	0xf1, 0xd1, 0xe4, 0x75, 0x98, 0xc0, 0x1f, 0x4a, 0x3c, 0x18, 0xd4, 0xd2, 0xf0, 0x4f, 0x44, 0xfd,
-	0x4f, 0x84, 0xc0, 0x84, 0x25, 0x35, 0x26, 0x64, 0x8e, 0x0b, 0x4b, 0x42, 0x95, 0x10, 0x29, 0x0f,
-	0x4a, 0xd2, 0x19, 0x23, 0x17, 0x09, 0x5d, 0xe8, 0x8c, 0x21, 0x5c, 0x30, 0x8c, 0x7f, 0x98, 0xd5,
-	0xa7, 0x1d, 0xb9, 0xa8, 0xc8, 0xed, 0x4a, 0x54, 0x4a, 0x29, 0xb7, 0x2b, 0xd2, 0xfa, 0xdf, 0xcd,
-	0xc0, 0xdc, 0x3d, 0x25, 0x91, 0xe9, 0xa6, 0x8b, 0xe3, 0x32, 0x38, 0xb5, 0xe7, 0x93, 0xca, 0x36,
-	0xa8, 0x66, 0x50, 0x65, 0x33, 0x05, 0xa7, 0x8c, 0x99, 0xf6, 0x3d, 0xe8, 0xa8, 0x87, 0x1f, 0xa6,
-	0x24, 0x7d, 0xe4, 0xe8, 0x1c, 0x7e, 0xc2, 0x2c, 0x19, 0xc6, 0x4f, 0x66, 0x61, 0x52, 0x59, 0x31,
-	0xe4, 0xb3, 0x50, 0x50, 0xab, 0x55, 0x55, 0x7c, 0xea, 0x57, 0x9a, 0x1a, 0x16, 0xea, 0xf8, 0xa8,
-	0xdd, 0xd6, 0x74, 0x7c, 0x6c, 0x5d, 0x20, 0xf4, 0x84, 0x37, 0xa1, 0xf7, 0x52, 0x6e, 0x42, 0x38,
-	0xcb, 0x15, 0x9d, 0xce, 0xc0, 0xfb, 0xd0, 0xdb, 0xc9, 0xfb, 0x10, 0xaa, 0x97, 0x14, 0xfa, 0xfe,
-	0xb7, 0x22, 0xe3, 0xa7, 0x33, 0x50, 0x8c, 0xaf, 0xe9, 0x4f, 0xa5, 0x57, 0x4e, 0xf0, 0x9e, 0xf3,
-	0x13, 0xd9, 0x30, 0x49, 0x8c, 0xf4, 0x56, 0x7e, 0x5a, 0x0d, 0x0d, 0xdf, 0xd1, 0x9e, 0x5a, 0x9e,
-	0xd5, 0x03, 0xef, 0xa9, 0x71, 0x3e, 0xd2, 0xa3, 0x6d, 0x8e, 0x7c, 0xeb, 0x6f, 0x95, 0x9e, 0x31,
-	0x3e, 0x80, 0xf9, 0x78, 0x77, 0xe0, 0x73, 0x4b, 0x19, 0x66, 0x74, 0x78, 0x3c, 0xc5, 0x54, 0x9c,
-	0xca, 0x8c, 0xe3, 0x1b, 0xbf, 0x9b, 0x8d, 0xf3, 0x16, 0x46, 0x87, 0x6c, 0x8f, 0x52, 0xed, 0x5c,
-	0xc4, 0x1e, 0xc5, 0x41, 0xa6, 0x2c, 0x3b, 0x49, 0x6a, 0xb7, 0xd0, 0xe7, 0x36, 0x97, 0xee, 0x73,
-	0x4b, 0x6e, 0xc4, 0x2c, 0xa8, 0x95, 0x00, 0x51, 0x8f, 0xe8, 0xb6, 0x15, 0x59, 0x51, 0x27, 0x0c,
-	0xa7, 0xe7, 0xb5, 0x68, 0xe7, 0x92, 0x7e, 0x34, 0xd2, 0xae, 0x07, 0x58, 0xc0, 0x89, 0x53, 0x91,
-	0xc9, 0x1a, 0x8c, 0xb3, 0xcf, 0xbc, 0x6b, 0x77, 0xc5, 0x2b, 0x0a, 0x09, 0x3d, 0xf0, 0x5b, 0xe1,
-	0xfd, 0x50, 0x71, 0xc2, 0x6f, 0x51, 0x26, 0x21, 0xa8, 0x13, 0x4b, 0x20, 0x1a, 0xff, 0x77, 0x86,
-	0xad, 0xff, 0xc6, 0xfe, 0xf7, 0x58, 0x7e, 0x38, 0xd6, 0xa4, 0x01, 0x36, 0xb1, 0xff, 0x36, 0xcb,
-	0xd3, 0xfe, 0x88, 0xe9, 0xf3, 0x26, 0x8c, 0x6d, 0xda, 0xde, 0xae, 0x48, 0xe9, 0xad, 0x73, 0xe1,
-	0x05, 0x51, 0xf8, 0xaa, 0x00, 0x7f, 0x9b, 0x82, 0x40, 0x55, 0x9d, 0x65, 0x87, 0x52, 0x9d, 0x29,
-	0x9a, 0xfb, 0xdc, 0x13, 0xd3, 0xdc, 0x7f, 0x5f, 0x98, 0xe1, 0xa7, 0x1c, 0x0c, 0x11, 0x4c, 0xfb,
-	0x7c, 0x3c, 0xa1, 0x56, 0x22, 0xec, 0x79, 0xc4, 0x8e, 0xdc, 0x50, 0x53, 0x74, 0x29, 0xce, 0x9f,
-	0xc7, 0x24, 0xe3, 0x32, 0xfe, 0xeb, 0x1c, 0xef, 0x63, 0xd1, 0x51, 0x17, 0x34, 0x17, 0x77, 0x5c,
-	0x27, 0x31, 0xad, 0x26, 0x77, 0x76, 0xbf, 0x00, 0x23, 0x6c, 0x6e, 0x8a, 0xde, 0x44, 0x3c, 0x36,
-	0x7f, 0x55, 0x3c, 0x56, 0xce, 0xd6, 0x32, 0x9e, 0x49, 0x6a, 0xee, 0x45, 0x3c, 0xb6, 0xd4, 0xb5,
-	0x8c, 0x18, 0xac, 0x05, 0x61, 0x02, 0x0b, 0xb5, 0x05, 0xed, 0x1d, 0x3b, 0x99, 0x29, 0x4f, 0xc9,
-	0x9a, 0xb3, 0x0a, 0xd3, 0x0f, 0x9c, 0x4e, 0xd3, 0x7d, 0xe4, 0x57, 0xa8, 0xbf, 0x1f, 0xb8, 0x5d,
-	0x61, 0x07, 0x8c, 0x1a, 0xfe, 0x47, 0xbc, 0xc4, 0x6a, 0xf2, 0x22, 0xf5, 0x39, 0x44, 0x27, 0x22,
-	0xcb, 0x30, 0xa5, 0x85, 0x80, 0x15, 0x8f, 0x94, 0xa8, 0xe3, 0xd4, 0x03, 0xc8, 0xaa, 0x3a, 0x4e,
-	0x8d, 0x84, 0x9d, 0xd2, 0xe2, 0xfb, 0x95, 0xa7, 0xca, 0xc4, 0xb7, 0x0b, 0x1c, 0x72, 0x1d, 0xf2,
-	0x3c, 0x4e, 0x48, 0xb5, 0xa2, 0x3e, 0x4f, 0xf9, 0x08, 0x8b, 0xc5, 0xd9, 0x91, 0x88, 0x51, 0x5c,
-	0x08, 0xee, 0x24, 0x67, 0x8e, 0x6c, 0xb8, 0x4d, 0x6a, 0x7c, 0x06, 0x8a, 0x62, 0xd3, 0x89, 0xb2,
-	0xc5, 0x3f, 0x07, 0x23, 0x2b, 0xd5, 0x8a, 0xa9, 0x6e, 0x14, 0x0d, 0xa7, 0xe9, 0x99, 0x08, 0x45,
-	0x1f, 0xb9, 0x0d, 0x1a, 0x3c, 0x72, 0xbd, 0x7d, 0x93, 0xfa, 0x81, 0xe7, 0xf0, 0xe4, 0x9c, 0xb8,
-	0xd4, 0x3e, 0x4b, 0xde, 0x86, 0x51, 0x34, 0x4e, 0x8d, 0xed, 0xfd, 0xf1, 0x3a, 0x96, 0xa7, 0xc4,
-	0x14, 0x1d, 0x45, 0x4b, 0x57, 0x93, 0x13, 0x91, 0x37, 0x61, 0xa4, 0x42, 0x3b, 0x07, 0xb1, 0xbc,
-	0x81, 0x09, 0xe2, 0x70, 0xc9, 0x37, 0x69, 0xe7, 0xc0, 0x44, 0x12, 0xe3, 0xa7, 0xb3, 0x70, 0x2a,
-	0xe5, 0xb3, 0xee, 0x7f, 0xf6, 0x29, 0xdd, 0xf7, 0x96, 0xb5, 0x7d, 0x4f, 0xbe, 0x39, 0xf7, 0xed,
-	0xf8, 0xd4, 0x6d, 0xf0, 0x6f, 0x64, 0xe0, 0x8c, 0x3e, 0x59, 0x85, 0x35, 0xfa, 0xfd, 0xeb, 0xe4,
-	0x2d, 0x18, 0x5b, 0xa3, 0x76, 0x93, 0xca, 0x24, 0x61, 0xa7, 0xc2, 0xe8, 0x7e, 0x3c, 0x8c, 0x00,
-	0x2f, 0xe4, 0x6c, 0x23, 0xa7, 0x53, 0x0e, 0x25, 0x15, 0xf1, 0x71, 0x5c, 0x40, 0x37, 0x64, 0x70,
-	0x92, 0xb4, 0xaa, 0x06, 0x58, 0x6e, 0x7c, 0x27, 0x03, 0xcf, 0x0e, 0xa0, 0x61, 0x03, 0xc7, 0x86,
-	0x5e, 0x1d, 0x38, 0x3c, 0x33, 0x11, 0x4a, 0xde, 0x85, 0x99, 0x4d, 0x21, 0xe0, 0xcb, 0xe1, 0xc8,
-	0x46, 0x6b, 0x47, 0xca, 0xfe, 0xd2, 0xb6, 0xc8, 0x8c, 0x23, 0x6b, 0x51, 0x73, 0x72, 0x03, 0xa3,
-	0xe6, 0xa8, 0x41, 0x68, 0x46, 0x86, 0x0d, 0x42, 0xf3, 0x01, 0xcc, 0xeb, 0x6d, 0x13, 0xb1, 0x80,
-	0xa3, 0x10, 0x3c, 0x99, 0xfe, 0x21, 0x78, 0x06, 0x46, 0x1c, 0x35, 0x7e, 0x32, 0x03, 0x45, 0x9d,
-	0xf7, 0x27, 0x1d, 0xcf, 0x77, 0xb4, 0xf1, 0x7c, 0x36, 0x7d, 0x3c, 0xfb, 0x0f, 0xe4, 0xff, 0x91,
-	0x89, 0x37, 0x76, 0xa8, 0x11, 0x34, 0x60, 0xac, 0xe2, 0xb6, 0x6d, 0x47, 0x0e, 0x1c, 0xba, 0x92,
-	0x34, 0x11, 0x62, 0x8a, 0x92, 0xe1, 0x22, 0x16, 0x9d, 0x87, 0xd1, 0x0d, 0xb7, 0x53, 0xae, 0x08,
-	0x9b, 0x5c, 0xe4, 0xd3, 0x71, 0x3b, 0x96, 0xdd, 0x34, 0x79, 0x01, 0x59, 0x07, 0xa8, 0x37, 0x3c,
-	0x4a, 0x3b, 0x75, 0xe7, 0xfb, 0x69, 0x4c, 0x96, 0x60, 0x3d, 0xd4, 0xea, 0xe1, 0xc6, 0xc2, 0x9f,
-	0x52, 0x11, 0xd1, 0xf2, 0x9d, 0xef, 0x57, 0xf7, 0x5e, 0x85, 0x1e, 0xd7, 0x95, 0x08, 0xea, 0x16,
-	0x1b, 0x87, 0x6b, 0x9f, 0xc6, 0xba, 0x4a, 0xad, 0x0a, 0x7b, 0xf8, 0x5a, 0xea, 0x70, 0xfc, 0x4e,
-	0x06, 0x9e, 0x1d, 0x40, 0xf3, 0x04, 0x46, 0xe5, 0x4f, 0xbb, 0xc3, 0x29, 0x40, 0x44, 0x84, 0x69,
-	0x99, 0x9d, 0x66, 0xc0, 0x13, 0xff, 0x4d, 0x89, 0xb4, 0xcc, 0x0c, 0xa0, 0xa5, 0x65, 0x66, 0x00,
-	0x76, 0xae, 0xae, 0x51, 0x67, 0x77, 0x8f, 0x9b, 0x5c, 0x4d, 0xf1, 0xbd, 0x61, 0x0f, 0x21, 0xea,
-	0xb9, 0xca, 0x71, 0x8c, 0x7f, 0x3d, 0x06, 0x67, 0x4d, 0xba, 0xeb, 0xb0, 0x9b, 0xc7, 0x96, 0xef,
-	0x74, 0x76, 0xb5, 0x20, 0x3e, 0x46, 0x6c, 0xe5, 0x8a, 0x8c, 0x17, 0x0c, 0x12, 0xce, 0xc4, 0x4b,
-	0x90, 0x67, 0xc7, 0xaa, 0xb2, 0x78, 0xf1, 0x15, 0xab, 0xe3, 0x36, 0xa9, 0x88, 0x12, 0x2d, 0x8b,
-	0xc9, 0xab, 0x42, 0x10, 0x52, 0x72, 0x12, 0x31, 0x41, 0xe8, 0xbb, 0x87, 0x25, 0xa8, 0x1f, 0xf8,
-	0x01, 0xc5, 0x4b, 0xb0, 0x10, 0x86, 0xc2, 0xdb, 0xca, 0x48, 0x9f, 0xdb, 0xca, 0x5d, 0x98, 0x2f,
-	0x37, 0xf9, 0xe9, 0x68, 0xb7, 0x6a, 0x9e, 0xd3, 0x69, 0x38, 0x5d, 0xbb, 0x25, 0x6f, 0xe0, 0xd8,
-	0xcb, 0x76, 0x58, 0x6e, 0x75, 0x43, 0x04, 0x33, 0x95, 0x8c, 0x35, 0xa3, 0xb2, 0x51, 0xc7, 0x08,
-	0x31, 0xe2, 0x81, 0x12, 0x9b, 0xd1, 0xec, 0xf8, 0xd8, 0x0a, 0xdf, 0x0c, 0x8b, 0xf1, 0x9e, 0x84,
-	0xcf, 0xd1, 0x9b, 0xeb, 0xf5, 0x3b, 0x22, 0x6b, 0x9a, 0x4c, 0x99, 0xc0, 0x0d, 0x0d, 0x82, 0x96,
-	0x8f, 0xe6, 0x8d, 0x1a, 0x5e, 0x44, 0x57, 0xaf, 0xaf, 0x31, 0xba, 0x7c, 0x82, 0xce, 0xf7, 0xf7,
-	0x54, 0x3a, 0x8e, 0x47, 0xae, 0xb2, 0xa9, 0xd0, 0x76, 0x03, 0x8a, 0x53, 0x78, 0x22, 0xba, 0x55,
-	0x79, 0x08, 0xe5, 0xb7, 0x2a, 0x05, 0x85, 0xbc, 0x0d, 0x73, 0xab, 0x2b, 0x4b, 0x52, 0xad, 0x5c,
-	0x71, 0x1b, 0x3d, 0x34, 0x0c, 0x00, 0xac, 0x0f, 0xc7, 0x90, 0x36, 0x96, 0xd8, 0x6e, 0x92, 0x86,
-	0x46, 0x2e, 0xc0, 0x78, 0xb5, 0xc2, 0xfb, 0x7e, 0x52, 0xcd, 0x0b, 0x26, 0xac, 0x9d, 0x64, 0x21,
-	0xb9, 0x17, 0x89, 0xfd, 0x85, 0x63, 0xe5, 0xf3, 0xb3, 0x43, 0x88, 0xfc, 0x6f, 0xc2, 0xd4, 0xb2,
-	0x1b, 0x54, 0x3b, 0x7e, 0x60, 0x77, 0x1a, 0xb4, 0x5a, 0x51, 0x83, 0x74, 0x6f, 0xbb, 0x81, 0xe5,
-	0x88, 0x12, 0xf6, 0xe5, 0x3a, 0x26, 0xf9, 0x3c, 0x92, 0xde, 0xa2, 0x1d, 0xea, 0x45, 0xc1, 0xb9,
-	0x47, 0x79, 0xdf, 0x32, 0xd2, 0xdd, 0xb0, 0xc4, 0xd4, 0x11, 0x89, 0x09, 0xa7, 0x30, 0xc9, 0xbf,
-	0xdb, 0xf3, 0xf5, 0xca, 0x67, 0x22, 0x91, 0xb6, 0x2b, 0x10, 0xac, 0xf8, 0x57, 0xa4, 0x93, 0x8a,
-	0x3c, 0x68, 0x3c, 0x7b, 0xe9, 0x8a, 0xdb, 0xa4, 0x3e, 0xdf, 0x81, 0xbe, 0x87, 0xf2, 0xa0, 0x29,
-	0x6d, 0x1b, 0xb0, 0x2b, 0xff, 0xc7, 0x98, 0x07, 0x2d, 0x81, 0x4b, 0x3e, 0x0f, 0xa3, 0xf8, 0x53,
-	0x48, 0xcc, 0x73, 0x29, 0x6c, 0x23, 0x69, 0xb9, 0xc1, 0x30, 0x4d, 0x4e, 0x40, 0xaa, 0x30, 0x2e,
-	0xae, 0x63, 0x27, 0xc9, 0xe6, 0x23, 0xee, 0x75, 0x7c, 0xb6, 0x09, 0x7a, 0xa3, 0x09, 0x05, 0xb5,
-	0x42, 0xb6, 0xca, 0xd6, 0x6c, 0x7f, 0x8f, 0x36, 0xd9, 0x2f, 0x91, 0x88, 0x0f, 0x57, 0xd9, 0x1e,
-	0x42, 0x2d, 0xf6, 0x1d, 0xa6, 0x82, 0xc2, 0xce, 0xe9, 0xaa, 0xbf, 0xe5, 0x8b, 0x4f, 0x11, 0x0a,
-	0x1a, 0x07, 0x95, 0x7d, 0x4d, 0x53, 0x14, 0x19, 0xdf, 0x07, 0xf3, 0x1b, 0xbd, 0x56, 0xcb, 0xde,
-	0x6e, 0x51, 0x99, 0xa8, 0x05, 0x33, 0xa2, 0x2f, 0xc3, 0x68, 0x5d, 0xc9, 0xb1, 0x1e, 0x26, 0xcb,
-	0x54, 0x70, 0xd0, 0x58, 0x35, 0x83, 0x11, 0x80, 0x62, 0xd9, 0xd5, 0x39, 0xa9, 0xf1, 0xdb, 0x19,
-	0x98, 0x97, 0x46, 0x06, 0x9e, 0xdd, 0xd8, 0x0f, 0x13, 0xed, 0x5f, 0xd0, 0xe6, 0x1a, 0x2e, 0x82,
-	0xd8, 0x34, 0xe2, 0xb3, 0xee, 0xb6, 0xfc, 0x08, 0x5d, 0x08, 0x4a, 0xfb, 0xe0, 0xe3, 0x3e, 0x86,
-	0xbc, 0x0d, 0x93, 0xe2, 0xc8, 0x55, 0x22, 0x70, 0x62, 0x00, 0x32, 0x71, 0x9d, 0x8c, 0x9b, 0xbc,
-	0xa8, 0xe8, 0x28, 0xdf, 0xe9, 0x4d, 0xf9, 0xa4, 0x72, 0x45, 0xba, 0x7c, 0xa7, 0xd7, 0x31, 0x60,
-	0xea, 0x7e, 0x7b, 0x32, 0xde, 0xb7, 0x62, 0xee, 0xde, 0x50, 0x63, 0xee, 0x65, 0xa2, 0x9b, 0x77,
-	0x14, 0x73, 0x4f, 0xbd, 0x79, 0x87, 0xa8, 0xe1, 0x98, 0x64, 0x8f, 0x19, 0x93, 0x77, 0xe5, 0x98,
-	0xe4, 0xfa, 0x4f, 0x8c, 0xb9, 0x01, 0xe3, 0x50, 0x8f, 0x56, 0xc8, 0xc8, 0x50, 0xca, 0x98, 0x67,
-	0x30, 0xb9, 0x00, 0x27, 0x89, 0xef, 0xcc, 0x82, 0x93, 0xaa, 0xe1, 0x19, 0x1d, 0x9e, 0xe9, 0x31,
-	0xdb, 0xfd, 0x17, 0xa0, 0x50, 0x0e, 0x02, 0xbb, 0xb1, 0x47, 0x9b, 0x15, 0xb6, 0x3d, 0x29, 0x41,
-	0xb5, 0x6c, 0x01, 0x57, 0x5f, 0xe6, 0x54, 0x5c, 0x1e, 0xee, 0xd6, 0xf6, 0x85, 0x91, 0x6c, 0x18,
-	0xee, 0x96, 0x41, 0xf4, 0x70, 0xb7, 0x0c, 0x42, 0xae, 0xc2, 0x78, 0xb5, 0xf3, 0xd0, 0x61, 0x7d,
-	0xc2, 0xe3, 0x6a, 0xa1, 0x46, 0xcb, 0xe1, 0x20, 0x75, 0x73, 0x15, 0x58, 0xe4, 0x4d, 0xe5, 0xa2,
-	0x34, 0x11, 0x29, 0x48, 0xb8, 0xa2, 0x2c, 0x8c, 0x81, 0xa3, 0x5e, 0x82, 0xc2, 0x9b, 0xd3, 0x0d,
-	0x18, 0x97, 0xfa, 0x4f, 0x88, 0x4e, 0x10, 0x41, 0x99, 0x0c, 0x41, 0x21, 0x91, 0x31, 0x69, 0xba,
-	0x92, 0x50, 0x70, 0x52, 0x49, 0x9a, 0xae, 0x24, 0x14, 0xd4, 0x92, 0xa6, 0x2b, 0xa9, 0x05, 0x43,
-	0xd5, 0x51, 0xe1, 0x58, 0xd5, 0xd1, 0x7d, 0x28, 0xd4, 0x6c, 0x2f, 0x70, 0x98, 0xdc, 0xd3, 0x09,
-	0xfc, 0x85, 0x29, 0x4d, 0xdb, 0xaa, 0x14, 0x2d, 0x3f, 0x2f, 0x13, 0x77, 0x77, 0x15, 0x7c, 0x3d,
-	0xc3, 0x74, 0x04, 0x4f, 0x37, 0x91, 0x9d, 0xfe, 0x24, 0x26, 0xb2, 0xd8, 0xa9, 0xa8, 0x61, 0x9b,
-	0x89, 0x34, 0x3e, 0x78, 0x11, 0x8a, 0xa9, 0xd9, 0x42, 0x44, 0xf2, 0x15, 0x28, 0xb0, 0xbf, 0x6b,
-	0x6e, 0xcb, 0x69, 0x38, 0xd4, 0x5f, 0x28, 0x62, 0xe3, 0x9e, 0x4f, 0x5d, 0xfd, 0x88, 0x74, 0x50,
-	0xa7, 0x01, 0x5f, 0xc0, 0xc8, 0x38, 0xae, 0x3a, 0xd7, 0xb8, 0x91, 0xf7, 0xa0, 0xc0, 0x66, 0xdf,
-	0xb6, 0xed, 0x73, 0x71, 0x77, 0x36, 0x32, 0x72, 0x6e, 0x0a, 0x78, 0x22, 0xe2, 0xb4, 0x4a, 0xc0,
-	0x8e, 0xf9, 0x72, 0x97, 0x6f, 0x90, 0x44, 0x99, 0xed, 0xdd, 0xc4, 0xe6, 0x28, 0xd1, 0xc8, 0x17,
-	0xa1, 0x50, 0xee, 0x76, 0xa3, 0x1d, 0x67, 0x4e, 0x51, 0xb4, 0x75, 0xbb, 0x56, 0xea, 0xae, 0xa3,
-	0x51, 0xc4, 0x37, 0xe6, 0xf9, 0x13, 0x6d, 0xcc, 0xe4, 0x72, 0x78, 0x03, 0x38, 0x15, 0xe9, 0x82,
-	0xc5, 0x65, 0x54, 0xbb, 0x4e, 0xf0, 0xcb, 0xc0, 0x0a, 0x4c, 0x71, 0xe5, 0xa8, 0x94, 0x66, 0x4e,
-	0x27, 0x56, 0x4f, 0x8a, 0x50, 0xa3, 0xd3, 0x90, 0x55, 0x98, 0xe6, 0x5e, 0xde, 0x2d, 0x11, 0x0a,
-	0x7c, 0xe1, 0x0c, 0xae, 0x5a, 0xe4, 0xc2, 0x9d, 0xc3, 0x5b, 0x98, 0x21, 0xc6, 0xd6, 0xb8, 0xc4,
-	0x88, 0x8c, 0x3f, 0xc8, 0xc0, 0x99, 0x3e, 0x23, 0x1e, 0x06, 0x8a, 0xce, 0x0c, 0x0e, 0x14, 0xcd,
-	0x76, 0x0e, 0x5d, 0xd3, 0x82, 0xed, 0x4f, 0x3a, 0x6f, 0x85, 0xf2, 0x96, 0x0b, 0x44, 0x24, 0x61,
-	0x12, 0x55, 0xdf, 0x76, 0x51, 0xa1, 0x9b, 0x4b, 0x1e, 0x42, 0x02, 0x8f, 0x7f, 0x14, 0x0f, 0xaf,
-	0x29, 0x72, 0x3c, 0x85, 0xc3, 0xfa, 0x91, 0xab, 0xad, 0xe0, 0x14, 0xd6, 0xc6, 0x61, 0x06, 0x26,
-	0x95, 0x75, 0x48, 0xce, 0x2b, 0xae, 0xc1, 0x45, 0x9e, 0x25, 0x4c, 0xe1, 0x90, 0xe5, 0x27, 0x11,
-	0x2e, 0xaa, 0xec, 0xf1, 0x6a, 0x6b, 0x8c, 0x44, 0xa6, 0x04, 0xd3, 0x8e, 0x05, 0x21, 0xc3, 0x72,
-	0xf2, 0x21, 0xc0, 0xba, 0xed, 0x07, 0xe5, 0x46, 0xe0, 0x3c, 0xa4, 0x43, 0x1c, 0x3a, 0x32, 0xbc,
-	0xe0, 0x29, 0xcc, 0x4b, 0x61, 0x23, 0x59, 0xec, 0x8c, 0x50, 0x18, 0x1a, 0x7f, 0x29, 0x03, 0xb0,
-	0x55, 0x5d, 0xc1, 0x68, 0xf8, 0x9f, 0x54, 0x28, 0x48, 0x8f, 0x30, 0x2c, 0xb9, 0x0f, 0x10, 0x07,
-	0xfe, 0xc7, 0x0c, 0x4c, 0xeb, 0x68, 0xe4, 0x5d, 0x98, 0xa9, 0x37, 0x3c, 0xb7, 0xd5, 0xda, 0xb6,
-	0x1b, 0xfb, 0xeb, 0x4e, 0x87, 0xf2, 0xa8, 0xab, 0xa3, 0xfc, 0x2c, 0xf2, 0xc3, 0x22, 0xab, 0xc5,
-	0xca, 0xcc, 0x38, 0x32, 0xf9, 0xe1, 0x0c, 0x4c, 0xd5, 0xf7, 0xdc, 0x47, 0x61, 0x10, 0x53, 0x31,
-	0x20, 0x1f, 0xb2, 0xb5, 0xed, 0xef, 0xb9, 0x8f, 0xa2, 0x14, 0xa3, 0x9a, 0x85, 0xe9, 0x3b, 0xc3,
-	0x3d, 0xfe, 0x37, 0x5c, 0xbc, 0x8f, 0x04, 0xfe, 0x15, 0xad, 0x12, 0x53, 0xaf, 0xd3, 0xf8, 0x93,
-	0x0c, 0x4c, 0xe2, 0xcd, 0xa5, 0xd5, 0x42, 0x99, 0xeb, 0x7b, 0x29, 0x5f, 0x65, 0xd8, 0xae, 0x01,
-	0x03, 0xfb, 0x06, 0xcc, 0xc4, 0xd0, 0x88, 0x01, 0x63, 0x75, 0xf4, 0xfa, 0x57, 0x95, 0x1e, 0x3c,
-	0x0e, 0x80, 0x29, 0x4a, 0x8c, 0x55, 0x85, 0xec, 0xfe, 0x35, 0x7c, 0x0c, 0x5e, 0x02, 0x70, 0x24,
-	0x48, 0xde, 0x6c, 0x48, 0xfc, 0x4b, 0xee, 0x5f, 0x33, 0x15, 0x2c, 0x63, 0x03, 0xc6, 0xea, 0xae,
-	0x17, 0x2c, 0x1f, 0xf0, 0xcb, 0x44, 0x85, 0xfa, 0x0d, 0xf5, 0xb5, 0xd7, 0xc1, 0xb7, 0x98, 0x86,
-	0x29, 0x8a, 0x48, 0x09, 0x46, 0x6f, 0x3a, 0xb4, 0xd5, 0x54, 0xad, 0x80, 0x77, 0x18, 0xc0, 0xe4,
-	0x70, 0x76, 0xe1, 0x3a, 0x1d, 0x25, 0x8d, 0x89, 0xcc, 0x8d, 0x3f, 0xe9, 0xba, 0x59, 0xd1, 0xfa,
-	0xf7, 0x85, 0x30, 0x51, 0x43, 0xb2, 0xa6, 0x01, 0x5d, 0xfd, 0x0f, 0x33, 0xb0, 0xd8, 0x9f, 0x44,
-	0xb5, 0x60, 0xce, 0x0c, 0xb0, 0x60, 0x7e, 0x39, 0xfe, 0x3a, 0x89, 0x68, 0xe2, 0x75, 0x32, 0x7a,
-	0x93, 0xac, 0xa0, 0x01, 0x79, 0x83, 0xca, 0x4c, 0x31, 0xe7, 0x07, 0x7c, 0x33, 0x22, 0xf2, 0x61,
-	0x0e, 0x90, 0xc6, 0x14, 0xb4, 0xc6, 0x6f, 0x8c, 0xc0, 0xd9, 0xbe, 0x14, 0x64, 0x4d, 0xc9, 0x3f,
-	0x35, 0x1d, 0x66, 0xbe, 0xe9, 0x8b, 0x7f, 0x05, 0xff, 0x45, 0x1b, 0xc1, 0xb8, 0x57, 0xda, 0xbd,
-	0x30, 0xef, 0x50, 0x16, 0x79, 0xbd, 0x76, 0x2c, 0x2f, 0x8e, 0x8e, 0xcc, 0x20, 0x99, 0x82, 0x08,
-	0xfd, 0x17, 0x69, 0x60, 0x3b, 0x2d, 0x5f, 0x5d, 0x76, 0x4d, 0x0e, 0x32, 0x65, 0x59, 0x64, 0x56,
-	0x3e, 0x92, 0x6e, 0x56, 0x6e, 0xfc, 0xbb, 0x0c, 0x4c, 0x84, 0x9f, 0x4d, 0x16, 0xe1, 0xf4, 0xa6,
-	0x59, 0x5e, 0x59, 0xb5, 0x36, 0x3f, 0xa8, 0xad, 0x5a, 0x5b, 0x1b, 0xf5, 0xda, 0xea, 0x4a, 0xf5,
-	0x66, 0x75, 0xb5, 0x52, 0x7c, 0x86, 0xcc, 0xc2, 0xd4, 0xd6, 0xc6, 0x9d, 0x8d, 0x7b, 0x0f, 0x36,
-	0xac, 0x55, 0xd3, 0xbc, 0x67, 0x16, 0x33, 0x64, 0x0a, 0x26, 0xcc, 0xe5, 0xf2, 0x8a, 0xb5, 0x71,
-	0xaf, 0xb2, 0x5a, 0xcc, 0x92, 0x22, 0x14, 0x56, 0xee, 0x6d, 0x6c, 0xac, 0xae, 0x6c, 0x56, 0xef,
-	0x57, 0x37, 0x3f, 0x28, 0xe6, 0x08, 0x81, 0x69, 0x44, 0xa8, 0x99, 0xd5, 0x8d, 0x95, 0x6a, 0xad,
-	0xbc, 0x5e, 0x1c, 0x61, 0x30, 0x86, 0xaf, 0xc0, 0x46, 0x43, 0x46, 0x77, 0xb6, 0x96, 0x57, 0x8b,
-	0x63, 0x0c, 0x85, 0xfd, 0xa5, 0xa0, 0x8c, 0xb3, 0xea, 0x11, 0xa5, 0x52, 0xde, 0x2c, 0x2f, 0x97,
-	0xeb, 0xab, 0xff, 0x1f, 0x7b, 0xdf, 0x16, 0x23, 0xc9, 0x91, 0x1c, 0xb6, 0xd5, 0xdd, 0x33, 0xd3,
-	0x13, 0xf3, 0xaa, 0xc9, 0x9d, 0xdd, 0x9d, 0x7d, 0xef, 0x16, 0xc9, 0x15, 0x39, 0x3c, 0xf2, 0xb8,
-	0x4b, 0xf3, 0xc8, 0x3d, 0xf1, 0xa1, 0x9a, 0xee, 0x9a, 0x99, 0xde, 0xed, 0x17, 0xab, 0x7a, 0x76,
-	0xb5, 0x47, 0x49, 0xa5, 0xda, 0xee, 0x9a, 0x99, 0xe2, 0xf6, 0x74, 0x35, 0xab, 0xaa, 0xb9, 0x9c,
-	0x83, 0x01, 0x9f, 0x20, 0xf8, 0x04, 0x58, 0x96, 0x75, 0x96, 0xcf, 0x30, 0x21, 0xd8, 0x90, 0x01,
-	0x1f, 0x0c, 0x7d, 0x08, 0xf0, 0xaf, 0xe1, 0xfb, 0x3a, 0xf8, 0x47, 0xc0, 0x41, 0x86, 0x0d, 0xff,
-	0x9d, 0x0c, 0x42, 0x3a, 0xc3, 0x86, 0x21, 0xf8, 0x4f, 0xb0, 0x3f, 0x04, 0x08, 0x30, 0x32, 0x32,
-	0xb3, 0x2a, 0xeb, 0xd1, 0xbd, 0xb3, 0x47, 0x9e, 0x6d, 0x01, 0xfa, 0x9a, 0xe9, 0xc8, 0x88, 0xa8,
-	0x7c, 0x67, 0x64, 0x44, 0x64, 0x84, 0x5a, 0x25, 0x17, 0xe0, 0x6c, 0x0a, 0x64, 0x37, 0x3b, 0xbb,
-	0x8d, 0xb6, 0xba, 0x48, 0x36, 0x40, 0x8d, 0x61, 0xf5, 0x6d, 0x7b, 0xdf, 0x32, 0x4c, 0x15, 0xb2,
-	0xd0, 0xb6, 0xde, 0x32, 0xd4, 0x25, 0xed, 0x3d, 0xf6, 0x5e, 0x90, 0x75, 0x35, 0x39, 0x0f, 0xc4,
-	0xea, 0xe9, 0xbd, 0x7d, 0x2b, 0xd3, 0xf8, 0x25, 0x58, 0xb0, 0xf6, 0x6b, 0x35, 0xc3, 0xb2, 0x54,
-	0x85, 0x00, 0xcc, 0xef, 0xe8, 0x8d, 0xa6, 0x51, 0x57, 0x4b, 0xda, 0xf7, 0x14, 0x58, 0x17, 0x12,
-	0xa0, 0x30, 0x44, 0x7d, 0xc9, 0xb5, 0xf8, 0x7e, 0xea, 0x62, 0x2b, 0x1e, 0x7f, 0x65, 0x3e, 0x32,
-	0x63, 0x19, 0xfe, 0x73, 0x05, 0xce, 0x15, 0x62, 0x93, 0x47, 0xa0, 0x8a, 0x1a, 0xb4, 0x9c, 0xa8,
-	0x7f, 0x94, 0xec, 0x63, 0xd7, 0x32, 0x5f, 0xc9, 0xa0, 0x31, 0x55, 0x69, 0x92, 0x11, 0x3b, 0xc7,
-	0xe6, 0xf4, 0xf9, 0x1a, 0xb4, 0xcf, 0x15, 0xb8, 0x30, 0xe5, 0x33, 0xa4, 0x06, 0xf3, 0x71, 0xe6,
-	0x9e, 0x19, 0x6e, 0x72, 0x1b, 0x3f, 0xf9, 0xe2, 0x3a, 0x47, 0xc4, 0x14, 0xc2, 0xf8, 0x9f, 0x39,
-	0x1f, 0xa7, 0xe2, 0xc1, 0x7c, 0x38, 0xac, 0xfb, 0x2e, 0x66, 0x7a, 0x9e, 0x7f, 0x49, 0x7f, 0x68,
-	0x6d, 0x2f, 0xf1, 0xbe, 0x2b, 0x3b, 0x4f, 0x43, 0x4c, 0x88, 0xa3, 0x7d, 0x5f, 0xa1, 0xc2, 0x5d,
-	0x16, 0x91, 0xca, 0xbc, 0x7a, 0x18, 0x4e, 0x8e, 0x5d, 0xd3, 0x1f, 0xba, 0xba, 0xd9, 0xe6, 0xc7,
-	0x06, 0x4a, 0xab, 0x0e, 0x16, 0xe0, 0xb5, 0xc2, 0x76, 0x82, 0xd4, 0x73, 0xff, 0x14, 0x0d, 0xb9,
-	0x0b, 0x60, 0x7c, 0x16, 0xb9, 0xc1, 0xc8, 0x19, 0xc6, 0x81, 0x5b, 0x58, 0x44, 0x2b, 0x0e, 0x4d,
-	0xcb, 0xdb, 0x12, 0xb2, 0xf6, 0x5d, 0x05, 0x96, 0xf9, 0xa5, 0x49, 0x1f, 0xba, 0x41, 0xf4, 0xe5,
-	0xa6, 0xd7, 0xdd, 0xd4, 0xf4, 0x8a, 0x5f, 0x85, 0x48, 0xfc, 0x69, 0x71, 0xe1, 0xcc, 0xfa, 0x0f,
-	0x0a, 0xa8, 0x59, 0x44, 0xf2, 0x3e, 0x54, 0x2d, 0xf7, 0x53, 0x37, 0xf0, 0xa2, 0x13, 0xbe, 0x51,
-	0x8a, 0x1c, 0x87, 0x0c, 0x87, 0x97, 0xb1, 0xf9, 0x10, 0xf2, 0x5f, 0x66, 0x4c, 0x73, 0xda, 0xfd,
-	0x5e, 0x52, 0x7b, 0x94, 0xbf, 0x2a, 0xb5, 0x87, 0xf6, 0x67, 0x25, 0xb8, 0xb0, 0xeb, 0x46, 0x72,
-	0x9b, 0x62, 0xf7, 0x85, 0x37, 0x4e, 0xd7, 0x2e, 0xa9, 0x25, 0x9b, 0xb0, 0x80, 0x45, 0x62, 0x7c,
-	0x4d, 0xf1, 0x93, 0x6c, 0xc7, 0xf3, 0xba, 0x9c, 0x4a, 0xa2, 0x36, 0xe5, 0xdb, 0xaf, 0x4b, 0x69,
-	0x95, 0xe2, 0x69, 0x7d, 0x0b, 0x56, 0x31, 0xa2, 0xff, 0x84, 0x2e, 0x07, 0x77, 0xc0, 0xd5, 0x3f,
-	0x55, 0x33, 0x03, 0x25, 0x5b, 0xa0, 0x52, 0x88, 0xde, 0x7f, 0x32, 0xf2, 0x9f, 0x0e, 0xdd, 0xc1,
-	0xa1, 0x3b, 0xc0, 0x63, 0xbd, 0x6a, 0xe6, 0xe0, 0x82, 0xe7, 0xfe, 0x88, 0x5d, 0xdd, 0xdc, 0x01,
-	0xea, 0x68, 0x38, 0xcf, 0x04, 0x7a, 0xe9, 0x2e, 0x2c, 0xfd, 0x8c, 0x29, 0xd2, 0xb4, 0x3f, 0x55,
-	0x60, 0x03, 0x1b, 0x27, 0x7d, 0x58, 0xa4, 0xaf, 0x15, 0xbd, 0x25, 0x65, 0x0d, 0x72, 0x28, 0x28,
-	0xbd, 0x14, 0xe2, 0x5e, 0x4c, 0x74, 0x42, 0xa5, 0x53, 0xe8, 0x84, 0xac, 0xe7, 0x49, 0xd5, 0x7f,
-	0x4a, 0x95, 0xd6, 0xbd, 0x4a, 0xb5, 0xac, 0x56, 0x92, 0x21, 0xd7, 0x7e, 0xb3, 0x04, 0x0b, 0xa6,
-	0x8b, 0x39, 0xcc, 0xc9, 0x2d, 0x58, 0x68, 0xfb, 0x91, 0x1b, 0xb6, 0x52, 0x09, 0xeb, 0x47, 0x14,
-	0x64, 0x1f, 0x0f, 0x4c, 0x51, 0x48, 0x27, 0x7c, 0x37, 0xf0, 0x07, 0x93, 0x7e, 0x24, 0x4f, 0xf8,
-	0x31, 0x03, 0x99, 0xa2, 0x8c, 0x7c, 0x0d, 0x16, 0x39, 0xe7, 0xd8, 0x50, 0x8c, 0x1e, 0xcf, 0x81,
-	0x1b, 0xe7, 0xc0, 0x4f, 0x10, 0x50, 0xa6, 0x65, 0x02, 0x46, 0x45, 0x92, 0x69, 0x73, 0x32, 0x83,
-	0x10, 0xd5, 0xe7, 0x66, 0x88, 0xea, 0x6f, 0xc0, 0xbc, 0x1e, 0x86, 0x6e, 0x24, 0xa2, 0x1d, 0x2c,
-	0xc7, 0xe1, 0xe2, 0x42, 0x37, 0x62, 0x8c, 0x1d, 0x2c, 0x37, 0x39, 0x9e, 0xf6, 0x97, 0x25, 0x98,
-	0xc3, 0x7f, 0xd1, 0x0c, 0x1b, 0xf4, 0x8f, 0x52, 0x66, 0xd8, 0xa0, 0x7f, 0x64, 0x22, 0x94, 0xdc,
-	0x46, 0x4d, 0x85, 0x48, 0x70, 0xc5, 0x5b, 0x8f, 0x2a, 0xf8, 0x41, 0x02, 0x36, 0x65, 0x9c, 0xd8,
-	0x6b, 0xa0, 0x5c, 0x18, 0xe3, 0xe4, 0x3c, 0x94, 0x3a, 0x16, 0x6f, 0x31, 0x86, 0xc9, 0xf2, 0x43,
-	0xb3, 0xd4, 0xb1, 0xb0, 0x37, 0xf6, 0xf4, 0x3b, 0x6f, 0x7d, 0x83, 0x37, 0x94, 0xf5, 0xc6, 0x91,
-	0x73, 0xe7, 0xad, 0x6f, 0x98, 0xbc, 0x84, 0xf6, 0x2f, 0xd6, 0x19, 0x8d, 0xb9, 0xec, 0x2d, 0x3f,
-	0xf6, 0x2f, 0xb6, 0x0d, 0x0d, 0xb7, 0x66, 0x82, 0x40, 0xee, 0xc0, 0x12, 0x8f, 0x09, 0x81, 0xf8,
-	0x52, 0xcc, 0x06, 0x1e, 0x33, 0x82, 0x51, 0xc8, 0x48, 0xcc, 0xac, 0xc7, 0x07, 0x48, 0xa4, 0xe1,
-	0xe5, 0x66, 0x3d, 0x31, 0x84, 0xa1, 0x29, 0xa1, 0xd0, 0x2a, 0x31, 0xbb, 0x60, 0xf2, 0x46, 0x1f,
-	0xab, 0xc4, 0x8d, 0x87, 0x98, 0x3d, 0x21, 0x46, 0xd0, 0xfe, 0xb0, 0x04, 0xd5, 0xee, 0x70, 0x72,
-	0xe8, 0x8d, 0x1e, 0xdc, 0x26, 0x04, 0xf0, 0x1a, 0x27, 0xd2, 0x6b, 0xd0, 0xff, 0xc9, 0x45, 0xa8,
-	0x8a, 0x9b, 0x9b, 0xd8, 0x90, 0x42, 0x7e, 0x6b, 0xdb, 0x04, 0x31, 0xee, 0x3c, 0x1e, 0x9a, 0xf8,
-	0x49, 0x6e, 0x43, 0x7c, 0xff, 0x9a, 0x76, 0x51, 0xab, 0xd0, 0xc5, 0x62, 0xc6, 0x68, 0xe4, 0x35,
-	0xc0, 0x43, 0x82, 0x5f, 0x1e, 0x84, 0x42, 0x9b, 0x55, 0x8d, 0xcb, 0x29, 0x8c, 0x04, 0xd1, 0xc8,
-	0x9b, 0xc0, 0x27, 0x26, 0x4f, 0xf7, 0x7e, 0x2e, 0x4d, 0xc0, 0x12, 0x68, 0x0a, 0x12, 0x8e, 0x4a,
-	0xde, 0x85, 0xa5, 0x7e, 0xe0, 0xa2, 0x25, 0xd3, 0x19, 0x26, 0x59, 0xdc, 0x65, 0xca, 0x5a, 0x52,
-	0xfe, 0xe0, 0xb6, 0x29, 0xa3, 0x6b, 0xdf, 0x5f, 0x84, 0x65, 0xb9, 0x3e, 0xc4, 0x84, 0xb3, 0xe1,
-	0x90, 0xde, 0xdd, 0xb9, 0x33, 0xdb, 0x18, 0x0b, 0xf9, 0x71, 0x7a, 0x23, 0x5d, 0x21, 0x8a, 0xc7,
-	0x3c, 0xdb, 0x44, 0x30, 0x8b, 0xbd, 0x33, 0xe6, 0x7a, 0x98, 0x80, 0x19, 0x1e, 0xd1, 0xa1, 0xea,
-	0x8f, 0xc3, 0x43, 0x77, 0xe4, 0x09, 0x7b, 0xcb, 0x0b, 0x29, 0x46, 0x1d, 0x5e, 0x98, 0xe3, 0x15,
-	0x93, 0x91, 0xb7, 0x60, 0xde, 0x1f, 0xbb, 0x23, 0xc7, 0xe3, 0x67, 0xdc, 0xe5, 0x0c, 0x03, 0x77,
-	0xa4, 0x37, 0x24, 0x42, 0x8e, 0x4c, 0xbe, 0x0e, 0x15, 0xff, 0x49, 0x3c, 0x5e, 0x17, 0xd3, 0x44,
-	0x4f, 0x22, 0x47, 0x22, 0x41, 0x44, 0x4a, 0xf0, 0xb1, 0x73, 0x7c, 0xc0, 0x47, 0x2c, 0x4d, 0x70,
-	0xcf, 0x39, 0x3e, 0x90, 0x09, 0x28, 0x22, 0xf9, 0x00, 0x60, 0xec, 0x1c, 0xba, 0x81, 0x3d, 0x98,
-	0x44, 0x27, 0x7c, 0xdc, 0xae, 0xa5, 0xc8, 0xba, 0xb4, 0xb8, 0x3e, 0x89, 0x4e, 0x24, 0xda, 0xc5,
-	0xb1, 0x00, 0x12, 0x1d, 0xe0, 0xd8, 0x89, 0x22, 0x37, 0x38, 0xf6, 0xb9, 0x37, 0x61, 0x12, 0xfc,
-	0x90, 0x31, 0x68, 0xc5, 0xc5, 0x12, 0x07, 0x89, 0x08, 0x2b, 0xed, 0x05, 0x0e, 0x4f, 0xba, 0x9f,
-	0xa9, 0xb4, 0x17, 0xa4, 0x5a, 0x49, 0x11, 0xc9, 0x3b, 0xb0, 0x30, 0xf0, 0xc2, 0xbe, 0x1f, 0x0c,
-	0x78, 0x94, 0x93, 0x2b, 0x29, 0x9a, 0x3a, 0x2b, 0x93, 0xc8, 0x04, 0x3a, 0xad, 0x2d, 0x0f, 0x7e,
-	0xda, 0xf6, 0x9f, 0xa2, 0x9a, 0x3f, 0x5b, 0x5b, 0x2b, 0x2e, 0x96, 0x6b, 0x9b, 0x10, 0xd1, 0xa1,
-	0x3c, 0xf4, 0xa2, 0xa1, 0xf3, 0x98, 0xdb, 0xce, 0xd3, 0x43, 0xb9, 0x8b, 0x45, 0xf2, 0x50, 0x32,
-	0x64, 0x72, 0x17, 0xaa, 0xee, 0x28, 0x0a, 0x1c, 0xdb, 0x1b, 0xf0, 0xa7, 0x98, 0xe9, 0x4a, 0xd3,
-	0x03, 0xd8, 0x69, 0xd4, 0xe5, 0x4a, 0x23, 0x7e, 0x63, 0x40, 0xfb, 0x27, 0xec, 0x7b, 0xc7, 0xfc,
-	0x05, 0x65, 0xba, 0x7f, 0xac, 0x5a, 0xa3, 0x25, 0xf7, 0x0f, 0x45, 0x24, 0xef, 0xc3, 0x02, 0x5d,
-	0xbf, 0x03, 0xff, 0x90, 0x07, 0x9a, 0xd0, 0xd2, 0xfd, 0xc3, 0xca, 0x72, 0xd3, 0x55, 0x10, 0xd1,
-	0x85, 0xec, 0x3c, 0x0d, 0x6d, 0xaf, 0x8f, 0x31, 0x31, 0xb3, 0xcb, 0x51, 0x7f, 0x68, 0x35, 0x6a,
-	0x12, 0xd9, 0x9c, 0xf3, 0x34, 0x6c, 0xf4, 0xc9, 0x1d, 0x98, 0xc3, 0xcc, 0x13, 0x3c, 0x00, 0x66,
-	0x9a, 0x06, 0x73, 0x4e, 0xc8, 0x34, 0x88, 0x4a, 0x07, 0xf2, 0x38, 0xc4, 0x47, 0x29, 0x3c, 0xff,
-	0x43, 0xba, 0x4f, 0x5a, 0x16, 0xbe, 0x54, 0x91, 0xab, 0xc8, 0xd1, 0x69, 0x15, 0x47, 0x6e, 0x64,
-	0x7b, 0x9f, 0xf0, 0x0c, 0x0e, 0xe9, 0xcf, 0xb5, 0xdd, 0xa8, 0xf1, 0xa1, 0xfc, 0xb9, 0x91, 0x1b,
-	0x35, 0x3e, 0xe1, 0x43, 0x77, 0x34, 0x79, 0x8c, 0xba, 0xf4, 0x82, 0xa1, 0x3b, 0x9a, 0x64, 0x87,
-	0xee, 0x68, 0xf2, 0x98, 0x5c, 0x03, 0x48, 0xbc, 0x10, 0x98, 0x7d, 0xc7, 0x94, 0x20, 0xdf, 0xac,
-	0xfc, 0x8f, 0x7f, 0x79, 0x5d, 0xd9, 0x06, 0xa8, 0x8a, 0xa8, 0x39, 0x54, 0x9e, 0xde, 0x28, 0x62,
-	0x4a, 0x6e, 0xc2, 0xb2, 0x1c, 0xd3, 0x87, 0xef, 0xea, 0x4b, 0xce, 0xd8, 0x13, 0x51, 0x7d, 0x66,
-	0x27, 0x42, 0x78, 0x15, 0xd6, 0x53, 0x4f, 0x80, 0x12, 0x87, 0x40, 0x53, 0x95, 0x0b, 0xf0, 0x10,
-	0xad, 0x01, 0x84, 0x91, 0x13, 0x44, 0xf6, 0xc0, 0x89, 0x4e, 0xa3, 0xde, 0xad, 0xd2, 0x8d, 0x99,
-	0x79, 0x5c, 0x23, 0x5d, 0xdd, 0x89, 0x5c, 0xd6, 0x38, 0xad, 0x09, 0x17, 0xa7, 0x6e, 0x9a, 0xe4,
-	0x15, 0x50, 0x0f, 0x1c, 0xae, 0x32, 0xed, 0x1f, 0x39, 0xa3, 0x91, 0x3b, 0xe4, 0x0d, 0x5b, 0x13,
-	0xf0, 0x1a, 0x03, 0x73, 0x6e, 0x1f, 0x48, 0xbd, 0x23, 0xad, 0x96, 0x53, 0xf4, 0x0e, 0x67, 0xf0,
-	0x43, 0x05, 0xae, 0xcc, 0xda, 0x7b, 0xc9, 0x25, 0xa8, 0x8e, 0x03, 0xcf, 0x47, 0x19, 0x9f, 0xf7,
-	0xa1, 0xf8, 0x8d, 0x79, 0x22, 0x50, 0x18, 0x8d, 0x9c, 0x43, 0xfe, 0xa6, 0xc6, 0x5c, 0x44, 0x48,
-	0xcf, 0x39, 0x0c, 0x69, 0x17, 0x0f, 0xdc, 0x03, 0x67, 0x32, 0x8c, 0xec, 0xb0, 0x7f, 0xe4, 0x0e,
-	0xf0, 0xd5, 0x1b, 0x7a, 0x52, 0x9a, 0x2a, 0x2f, 0xb0, 0x04, 0x3c, 0x57, 0xe3, 0xb9, 0x29, 0x35,
-	0xbe, 0x57, 0xa9, 0x2a, 0x6a, 0xc9, 0x44, 0xd7, 0x35, 0xed, 0x3b, 0x25, 0xd8, 0x9c, 0xb6, 0xd9,
-	0x90, 0xf7, 0x8a, 0xfa, 0x80, 0x59, 0x7d, 0x64, 0xb8, 0x6c, 0xf5, 0x91, 0x67, 0xcf, 0x1d, 0x88,
-	0xdf, 0xac, 0x3d, 0x2b, 0xfe, 0x84, 0x80, 0x51, 0x9a, 0xb1, 0x13, 0x86, 0x4f, 0xe9, 0x7e, 0x5a,
-	0x96, 0xa2, 0x10, 0x73, 0x98, 0x4c, 0x23, 0x60, 0xe4, 0x6d, 0x80, 0xfe, 0xd0, 0x0f, 0x5d, 0x74,
-	0xae, 0xe0, 0x82, 0x1a, 0xf3, 0xc4, 0x8f, 0xa1, 0xb2, 0x35, 0x1d, 0xa1, 0x35, 0x7f, 0x20, 0xe6,
-	0x93, 0x03, 0x17, 0xa6, 0x9c, 0x2e, 0x74, 0x78, 0xf0, 0x11, 0x1a, 0xdb, 0x4c, 0x78, 0xfe, 0x2f,
-	0x0a, 0x61, 0x79, 0x6b, 0xb2, 0x3d, 0x5e, 0x9a, 0x36, 0x47, 0x4e, 0x80, 0xe4, 0x8f, 0x10, 0xca,
-	0x9d, 0x7b, 0x9e, 0x4f, 0x82, 0x98, 0x3b, 0x83, 0xec, 0x07, 0x43, 0x72, 0x1d, 0x96, 0x44, 0xa6,
-	0x52, 0x7a, 0x11, 0x62, 0xcc, 0x81, 0x83, 0xee, 0xbb, 0x38, 0x79, 0x30, 0x06, 0x2c, 0xbe, 0x4c,
-	0xe4, 0x2b, 0x6f, 0x11, 0x21, 0xbd, 0x93, 0xb1, 0x68, 0xdd, 0x15, 0x31, 0xbf, 0xd3, 0x07, 0x3b,
-	0x2f, 0xfd, 0xa7, 0x8a, 0x18, 0xfe, 0xfc, 0xc9, 0xf8, 0xac, 0xfa, 0x11, 0xc0, 0x87, 0x61, 0xbc,
-	0x62, 0xf8, 0x3f, 0x15, 0xf9, 0xc4, 0xaa, 0xe3, 0x22, 0x1f, 0xff, 0x49, 0x6e, 0xc1, 0x5a, 0xc0,
-	0x1c, 0x8b, 0x23, 0x9f, 0xf7, 0x27, 0x4b, 0x8b, 0xb2, 0xc2, 0xc0, 0x3d, 0x1f, 0xfb, 0x94, 0xd7,
-	0xeb, 0x5e, 0xdc, 0x61, 0x92, 0xa0, 0x40, 0x5e, 0x87, 0x45, 0x2a, 0x28, 0x60, 0xf8, 0xa1, 0xcc,
-	0x8b, 0x14, 0xc4, 0x43, 0xb1, 0xcb, 0xac, 0x7e, 0xcc, 0xff, 0xe7, 0xbc, 0xfe, 0x6d, 0x49, 0x30,
-	0x93, 0xc5, 0x14, 0x72, 0x01, 0x16, 0xfc, 0xe0, 0x50, 0x6a, 0xda, 0xbc, 0x1f, 0x1c, 0xd2, 0x76,
-	0xbd, 0x0c, 0x2a, 0x7b, 0x20, 0xc5, 0x02, 0x55, 0x84, 0x27, 0x23, 0xa6, 0xc7, 0xa8, 0x9a, 0xab,
-	0x0c, 0xbe, 0x1f, 0xba, 0x81, 0x75, 0x32, 0xea, 0x53, 0xcc, 0x30, 0xf4, 0x6d, 0x39, 0x8a, 0x18,
-	0x6f, 0xf6, 0x6a, 0x18, 0xfa, 0x49, 0x38, 0xb1, 0x01, 0xd9, 0x86, 0x15, 0xca, 0x27, 0x8e, 0x65,
-	0xc6, 0x77, 0xc0, 0xab, 0x79, 0x29, 0xea, 0x64, 0xd4, 0x17, 0x55, 0x34, 0x97, 0x43, 0xe9, 0x17,
-	0xb9, 0x0f, 0xaa, 0x24, 0x6e, 0xe2, 0x8b, 0xd9, 0x8c, 0x93, 0x7b, 0xc2, 0x46, 0x12, 0x53, 0x1b,
-	0xa3, 0x03, 0xdf, 0x5c, 0xeb, 0xa7, 0x01, 0xf1, 0x4e, 0x30, 0xaf, 0x2e, 0x98, 0x9b, 0xbc, 0xb9,
-	0x21, 0x7a, 0x4f, 0xda, 0x43, 0xff, 0xd0, 0x76, 0x3f, 0xa3, 0x63, 0xa2, 0xfd, 0x81, 0x22, 0xf6,
-	0xda, 0x02, 0xa6, 0x44, 0x83, 0x95, 0x23, 0x27, 0xb4, 0xc3, 0xf0, 0x98, 0x39, 0xf5, 0xf1, 0x50,
-	0xca, 0x4b, 0x47, 0x4e, 0x68, 0x85, 0xc7, 0x22, 0x6f, 0xcb, 0x39, 0x8a, 0xe3, 0x3b, 0x93, 0xe8,
-	0xc8, 0x96, 0x85, 0x6b, 0xd6, 0xa3, 0x67, 0x8f, 0x9c, 0xb0, 0x43, 0xcb, 0x24, 0xde, 0xe4, 0x45,
-	0x58, 0x45, 0xbe, 0x7d, 0x4f, 0x30, 0xc6, 0x60, 0x24, 0xe6, 0x32, 0x65, 0xdc, 0xf7, 0x18, 0x67,
-	0x3e, 0xb8, 0x3f, 0xae, 0xc0, 0xf9, 0xe2, 0xde, 0xc3, 0xe9, 0x4b, 0xfb, 0x1c, 0x9f, 0x4d, 0xf2,
-	0xba, 0x2d, 0x52, 0x08, 0x0b, 0x24, 0x53, 0x34, 0x78, 0xa5, 0xc2, 0xc1, 0xdb, 0x82, 0x75, 0x64,
-	0xc4, 0xc5, 0xf8, 0xa1, 0x17, 0x46, 0x3c, 0x3e, 0x8a, 0xb9, 0x46, 0x0b, 0xd8, 0x7e, 0xdf, 0xa4,
-	0x60, 0xf2, 0x12, 0xac, 0x8a, 0x1d, 0xdb, 0x7f, 0x3a, 0xa2, 0x1f, 0x66, 0xdb, 0xf5, 0x0a, 0x87,
-	0x76, 0x10, 0x48, 0xce, 0xc1, 0xbc, 0x33, 0x1e, 0xd3, 0x4f, 0xb2, 0x5d, 0x7a, 0xce, 0x19, 0x8f,
-	0x59, 0x6e, 0x21, 0x7c, 0x24, 0x6a, 0x1f, 0xa0, 0x0b, 0x16, 0xf7, 0x21, 0x35, 0x97, 0x11, 0xc8,
-	0xdc, 0xb2, 0x42, 0xba, 0x2f, 0x50, 0x5a, 0x81, 0xb2, 0x80, 0x28, 0xe0, 0x8c, 0x63, 0x84, 0x8b,
-	0x50, 0x15, 0xce, 0x00, 0xec, 0x55, 0x8c, 0xb9, 0xe0, 0x70, 0x47, 0x80, 0xb7, 0xe0, 0xc2, 0xc0,
-	0x0b, 0xf9, 0x68, 0xd3, 0x26, 0x8d, 0xc7, 0xfc, 0x59, 0x2a, 0x0b, 0x63, 0x6c, 0x6e, 0xf0, 0x62,
-	0xda, 0x93, 0xfa, 0x78, 0x1c, 0x3f, 0x4e, 0xbd, 0x24, 0xc8, 0x1e, 0x7b, 0x2c, 0x5e, 0x1b, 0x73,
-	0x88, 0xc5, 0xc5, 0x01, 0x48, 0xb9, 0xc9, 0x31, 0xb6, 0x65, 0x04, 0xb1, 0x4c, 0xe2, 0x95, 0x64,
-	0x33, 0xe5, 0x21, 0x97, 0x5c, 0xd0, 0x64, 0x8c, 0x83, 0x86, 0x50, 0xf2, 0x36, 0x4c, 0x9d, 0x8b,
-	0x28, 0xe1, 0x56, 0xcd, 0x73, 0xac, 0x9c, 0x39, 0xfa, 0x36, 0xfd, 0x43, 0x03, 0x0b, 0xc9, 0x07,
-	0x70, 0x45, 0x54, 0xd0, 0x09, 0x43, 0xef, 0x70, 0x64, 0x8b, 0x51, 0x40, 0x5f, 0x0c, 0x94, 0x72,
-	0xab, 0xe6, 0x45, 0x8e, 0xa3, 0x23, 0x4a, 0x9d, 0x61, 0xe0, 0xb3, 0x46, 0x3e, 0x9b, 0xde, 0x81,
-	0x35, 0x2e, 0xb0, 0x73, 0x21, 0x01, 0x7b, 0x9b, 0x6f, 0x61, 0xf4, 0x26, 0xcd, 0xf3, 0x55, 0x01,
-	0x07, 0x35, 0x06, 0x82, 0xf2, 0xbf, 0x28, 0x70, 0xae, 0x50, 0xe2, 0x27, 0xbf, 0x0e, 0xec, 0x9d,
-	0x61, 0xe4, 0xdb, 0x81, 0xdb, 0xf7, 0xc6, 0x1e, 0x06, 0x6e, 0x61, 0x1a, 0xf1, 0x3b, 0xb3, 0xee,
-	0x0a, 0xf8, 0x66, 0xb1, 0xe7, 0x9b, 0x31, 0x11, 0x53, 0xd5, 0xa9, 0x41, 0x06, 0x7c, 0xe9, 0x23,
-	0x38, 0x57, 0x88, 0x5a, 0xa0, 0x42, 0xfb, 0x5a, 0x3a, 0x59, 0xba, 0xb0, 0x71, 0x66, 0x1a, 0x2d,
-	0xa9, 0xd6, 0x78, 0xf3, 0x7e, 0x14, 0x37, 0x2f, 0x73, 0x37, 0x20, 0x46, 0x76, 0x67, 0x2b, 0xba,
-	0xde, 0x0a, 0xa2, 0xe9, 0x9b, 0xdb, 0x47, 0x70, 0x8e, 0x2f, 0xaf, 0xc3, 0xc0, 0x19, 0x1f, 0x25,
-	0xec, 0x58, 0x45, 0x7f, 0xa1, 0x88, 0x1d, 0x5b, 0x77, 0xbb, 0x14, 0x3f, 0xe6, 0x7a, 0xd6, 0xc9,
-	0x03, 0x79, 0x1b, 0x7e, 0xa3, 0x24, 0x36, 0xb3, 0x82, 0xea, 0x14, 0x2c, 0x5c, 0xa5, 0x68, 0xe1,
-	0x9e, 0x7e, 0xd7, 0x68, 0x03, 0x91, 0xb7, 0x6b, 0x3e, 0xef, 0x99, 0x3f, 0x9e, 0xb8, 0xe6, 0xf1,
-	0x8a, 0x48, 0x9b, 0x1f, 0x5b, 0x08, 0xe6, 0x7a, 0x3f, 0x0b, 0xa2, 0xb2, 0x78, 0x9c, 0x0f, 0x9e,
-	0x1f, 0x9d, 0x55, 0x06, 0x68, 0x0c, 0xc8, 0x0d, 0x58, 0x66, 0x37, 0xba, 0xd4, 0xae, 0x02, 0x08,
-	0xd3, 0xe9, 0xd6, 0x22, 0xfa, 0x40, 0x81, 0x1b, 0xcf, 0xea, 0x43, 0xf2, 0x10, 0xce, 0xa3, 0x57,
-	0x50, 0xe8, 0xc7, 0xc3, 0x60, 0xf7, 0x9d, 0xfe, 0x91, 0xcb, 0x67, 0xad, 0x56, 0x38, 0x18, 0xe3,
-	0xb1, 0x65, 0x75, 0xa4, 0x71, 0x18, 0x8f, 0xad, 0xd0, 0x17, 0xbf, 0x6b, 0x94, 0x9c, 0xd7, 0x61,
-	0x00, 0x97, 0x67, 0x50, 0x4a, 0x5b, 0xa3, 0x22, 0x6f, 0x8d, 0x2f, 0x83, 0x7a, 0xe0, 0x0e, 0xe8,
-	0x35, 0xc7, 0x1d, 0x60, 0xd5, 0x3e, 0xbd, 0x83, 0x1d, 0xbf, 0x6c, 0xae, 0xc6, 0x70, 0x2b, 0xf4,
-	0x1f, 0xdc, 0xe1, 0x5f, 0x39, 0x16, 0x87, 0xbe, 0x7c, 0x2b, 0x25, 0xaf, 0xc3, 0xd9, 0x4c, 0x50,
-	0x9c, 0x24, 0xca, 0x82, 0xb9, 0x4e, 0x8b, 0xd2, 0x21, 0xd4, 0x6e, 0xc2, 0xb2, 0xbc, 0x91, 0x08,
-	0x09, 0x6f, 0x90, 0x6c, 0x1d, 0xfc, 0x73, 0x13, 0xd1, 0xa8, 0xc2, 0x0b, 0xed, 0x69, 0xee, 0x5a,
-	0xaf, 0x01, 0x89, 0x6f, 0x2e, 0xf1, 0x46, 0xc1, 0x3f, 0xb8, 0x2e, 0x4a, 0xe2, 0x15, 0xce, 0x3f,
-	0xfb, 0xdb, 0xf3, 0x70, 0xb6, 0xe0, 0x26, 0x4c, 0x5e, 0x03, 0xd5, 0x1b, 0x45, 0xee, 0x61, 0x20,
-	0x5d, 0xcd, 0x98, 0xf4, 0x5e, 0xda, 0x54, 0xcc, 0x35, 0xa9, 0x8c, 0xab, 0x38, 0xe7, 0x59, 0x96,
-	0x7f, 0xfe, 0x3d, 0xfe, 0x8b, 0x6e, 0x20, 0x4e, 0x20, 0xb4, 0x77, 0xf4, 0x5f, 0xd2, 0x80, 0x75,
-	0xcc, 0x08, 0x12, 0x7a, 0x3e, 0x26, 0x16, 0x41, 0x51, 0xac, 0x92, 0xba, 0x2f, 0x63, 0x4d, 0xba,
-	0x12, 0x12, 0x95, 0xc5, 0x4c, 0x75, 0x9c, 0x81, 0x90, 0x5f, 0x84, 0x4b, 0xd2, 0x89, 0x6a, 0x67,
-	0x56, 0x1f, 0x3e, 0xc0, 0x30, 0x2f, 0x38, 0xf1, 0xd9, 0x5a, 0x4f, 0xad, 0xc3, 0x6d, 0x60, 0x59,
-	0x84, 0xbd, 0xc1, 0xd8, 0xce, 0xa5, 0x90, 0xc1, 0xe6, 0xb2, 0x84, 0x08, 0x97, 0x28, 0x56, 0x63,
-	0x30, 0xce, 0x64, 0x93, 0xc1, 0x56, 0x77, 0x0b, 0x57, 0xe8, 0x02, 0xae, 0xd0, 0xab, 0x72, 0x63,
-	0x72, 0xeb, 0x13, 0x7b, 0xb1, 0x60, 0x8d, 0x1e, 0xc2, 0x7a, 0x72, 0xd2, 0x89, 0x03, 0xba, 0x9a,
-	0xca, 0xfa, 0x8f, 0x0c, 0x85, 0x04, 0xc9, 0x4e, 0x6c, 0x16, 0x28, 0x22, 0x47, 0x28, 0x87, 0x43,
-	0x99, 0xa4, 0x08, 0x42, 0xd2, 0x84, 0x0d, 0xe7, 0x69, 0x28, 0x72, 0x93, 0x86, 0xf1, 0xb7, 0x16,
-	0xf3, 0xdf, 0x12, 0xf6, 0x3a, 0x46, 0x6a, 0x12, 0xe7, 0x69, 0xc8, 0x53, 0x96, 0x86, 0x82, 0xdb,
-	0xc7, 0x40, 0x98, 0xd8, 0x91, 0xaa, 0x37, 0x3c, 0x8b, 0x17, 0x4f, 0x6c, 0x9a, 0xa3, 0x94, 0x83,
-	0xba, 0x61, 0xa9, 0x5c, 0xf3, 0x5e, 0x5a, 0xc7, 0xba, 0x94, 0x32, 0x10, 0x66, 0x7b, 0x9b, 0x19,
-	0x2f, 0x25, 0x7c, 0xf9, 0xaa, 0x29, 0x81, 0xf9, 0x6a, 0xf8, 0x5c, 0x01, 0x35, 0xcb, 0x82, 0xbc,
-	0x0b, 0xf3, 0x4c, 0x98, 0xe0, 0x27, 0x93, 0x56, 0xfc, 0x2d, 0x36, 0x82, 0x4c, 0xae, 0xd8, 0x3b,
-	0x63, 0x72, 0x1a, 0xf2, 0x0d, 0xa8, 0xf8, 0xde, 0x40, 0x18, 0x32, 0x6f, 0xcc, 0xa2, 0xed, 0x34,
-	0xea, 0x35, 0x54, 0x7e, 0x7a, 0x03, 0x7e, 0xf5, 0xd8, 0xae, 0xc2, 0x3c, 0xeb, 0x30, 0xed, 0x63,
-	0xb8, 0x3c, 0xe3, 0x83, 0xc4, 0x80, 0xb5, 0x8c, 0x91, 0xf7, 0x94, 0xf6, 0x5f, 0x27, 0xb1, 0xff,
-	0x06, 0x42, 0x26, 0x1e, 0xc2, 0xc5, 0xa9, 0x15, 0x24, 0x8d, 0xa9, 0x3b, 0x03, 0x86, 0x1b, 0xc9,
-	0x96, 0xc9, 0x93, 0x30, 0xb3, 0x6b, 0xf0, 0xaf, 0xfd, 0x4e, 0x09, 0xce, 0x16, 0x4c, 0x0e, 0xa2,
-	0x41, 0x49, 0xec, 0xe1, 0x79, 0x17, 0xc2, 0xbd, 0x33, 0x66, 0xc9, 0x1b, 0x90, 0xbb, 0x00, 0x98,
-	0xdb, 0x35, 0x70, 0x0f, 0xdd, 0xcf, 0xb8, 0x8e, 0x00, 0x6f, 0xee, 0x09, 0x34, 0x45, 0xb3, 0x88,
-	0x66, 0x19, 0x0a, 0x26, 0xb7, 0x01, 0xdc, 0xcf, 0xfa, 0xc3, 0xc9, 0xc0, 0x8d, 0x6f, 0x5d, 0x05,
-	0x9f, 0x51, 0xcc, 0x45, 0x8e, 0xd5, 0x18, 0x90, 0x3d, 0x20, 0x82, 0x44, 0xfa, 0x6a, 0xe5, 0x19,
-	0x5f, 0x55, 0x4c, 0x95, 0x53, 0xb5, 0xc5, 0xc7, 0xf9, 0xe8, 0x2e, 0xc2, 0x82, 0x37, 0xc2, 0x12,
-	0xfa, 0x2f, 0x47, 0xd2, 0xfe, 0x48, 0xe1, 0xfd, 0x91, 0x5e, 0xe4, 0xa4, 0x07, 0xdc, 0x87, 0x80,
-	0x6f, 0x08, 0xb7, 0xa6, 0x6f, 0x08, 0xb2, 0x69, 0x96, 0xc7, 0x9d, 0x41, 0x80, 0x6c, 0x80, 0x64,
-	0x90, 0x2f, 0x61, 0x34, 0xe5, 0xc3, 0xf7, 0x11, 0x9c, 0x2b, 0xdc, 0xb0, 0xe9, 0x2d, 0x02, 0x5d,
-	0x91, 0x93, 0x0b, 0xf2, 0x02, 0xfd, 0x4d, 0x6f, 0xc8, 0x37, 0x61, 0xf9, 0xb1, 0xeb, 0x04, 0x6e,
-	0xc0, 0xaf, 0x67, 0xfc, 0x54, 0x64, 0x30, 0xf9, 0x76, 0x36, 0x48, 0x9f, 0x4e, 0xdc, 0xea, 0x42,
-	0x5a, 0x70, 0x96, 0xed, 0x1a, 0xde, 0x31, 0x6a, 0x04, 0xb8, 0xa5, 0x46, 0x49, 0xdd, 0x89, 0x91,
-	0x04, 0xef, 0x1f, 0x0d, 0xc4, 0x62, 0xd4, 0xe6, 0xfa, 0x61, 0x16, 0x44, 0x85, 0x9a, 0xf3, 0xc5,
-	0xd8, 0x64, 0x1b, 0x96, 0x18, 0x73, 0xa6, 0x1b, 0x62, 0x26, 0xf6, 0x9b, 0x33, 0xbf, 0x50, 0xc3,
-	0x17, 0x3a, 0x61, 0xfc, 0x3f, 0xbd, 0x94, 0xa1, 0x37, 0x93, 0x7d, 0x2c, 0x7b, 0x10, 0x98, 0xcb,
-	0x08, 0xe4, 0x9e, 0x03, 0xda, 0x7f, 0x56, 0x44, 0x53, 0x53, 0xea, 0x65, 0x7a, 0xb2, 0x86, 0xee,
-	0x48, 0x78, 0x51, 0x2c, 0x9a, 0xfc, 0xd7, 0x73, 0x9e, 0xf6, 0xe4, 0x6d, 0x58, 0xa6, 0x6c, 0x0f,
-	0x27, 0x23, 0x76, 0xe2, 0x96, 0x53, 0xf1, 0xf0, 0x5a, 0xac, 0x88, 0x0e, 0xdb, 0xde, 0x19, 0x73,
-	0xe9, 0x38, 0xf9, 0x49, 0x5e, 0x87, 0xc5, 0xf0, 0x38, 0x1a, 0xcb, 0xe7, 0xb4, 0x30, 0xb5, 0x59,
-	0xad, 0x5e, 0x97, 0x93, 0x54, 0x29, 0x4e, 0xa2, 0x32, 0xd9, 0x9e, 0x67, 0xc6, 0x36, 0xed, 0x55,
-	0x58, 0x92, 0x78, 0xd3, 0xc6, 0xb0, 0xf7, 0xac, 0xa2, 0x31, 0xec, 0x17, 0x1f, 0xec, 0xc7, 0x50,
-	0x15, 0x2c, 0x09, 0x81, 0xca, 0x91, 0x1f, 0x0a, 0x39, 0x07, 0xff, 0xa7, 0x30, 0xbc, 0xc8, 0xd1,
-	0x46, 0xce, 0x99, 0xf8, 0x3f, 0x8a, 0xd3, 0xa8, 0x16, 0xc6, 0x28, 0xca, 0xe8, 0xc3, 0x1c, 0x6b,
-	0x50, 0x28, 0xbc, 0x37, 0x0c, 0x99, 0x67, 0xb3, 0xd0, 0xe5, 0xc4, 0xf7, 0x90, 0x8c, 0x3e, 0x7e,
-	0x9a, 0xd8, 0x98, 0x92, 0x9a, 0x4b, 0x79, 0xa9, 0x99, 0xc5, 0x39, 0xe3, 0x94, 0xec, 0xcb, 0x80,
-	0x30, 0x94, 0x9a, 0x25, 0xc1, 0xa8, 0x92, 0x12, 0x8c, 0x24, 0xc5, 0x6c, 0x32, 0x7a, 0x4c, 0xe8,
-	0x16, 0x8a, 0xd9, 0xac, 0xa8, 0xf6, 0x83, 0x78, 0x86, 0xa4, 0x2c, 0x02, 0xe4, 0x0e, 0x9c, 0x63,
-	0xda, 0x11, 0x9e, 0xbe, 0x3e, 0x23, 0x23, 0x9e, 0xc5, 0x42, 0x96, 0xfd, 0x2e, 0x96, 0x15, 0x9f,
-	0xad, 0x78, 0x24, 0x6f, 0xc0, 0x46, 0x9c, 0x3b, 0x39, 0x7c, 0xe2, 0x8d, 0x59, 0xee, 0xc8, 0x13,
-	0xae, 0xb7, 0x20, 0xa2, 0xcc, 0x7a, 0xe2, 0x8d, 0x31, 0x8f, 0xa4, 0xe8, 0xe1, 0x7f, 0x5d, 0x12,
-	0xea, 0xec, 0x6d, 0xdf, 0x8f, 0xc2, 0x28, 0x70, 0xc6, 0x29, 0x9b, 0x27, 0x39, 0x86, 0x8b, 0x58,
-	0xa5, 0x3b, 0x98, 0xc0, 0xca, 0x0f, 0x84, 0xfa, 0x3f, 0x5e, 0x60, 0x4b, 0x77, 0xbe, 0x9e, 0xd6,
-	0x47, 0xe9, 0x14, 0x5b, 0x97, 0x91, 0xe9, 0xba, 0x92, 0xb8, 0xee, 0x9d, 0x31, 0x2f, 0x30, 0x9e,
-	0x39, 0x2c, 0xb2, 0x57, 0xb0, 0xd7, 0x64, 0x8d, 0x9e, 0xdb, 0xc9, 0xc6, 0x93, 0xe6, 0x2a, 0x6f,
-	0x49, 0xe4, 0x7d, 0x58, 0xf4, 0x06, 0x72, 0xd2, 0xe6, 0xac, 0xb9, 0xad, 0x31, 0x60, 0xe9, 0x23,
-	0x12, 0x1e, 0x74, 0x69, 0x78, 0x1c, 0xba, 0xbd, 0x92, 0x92, 0x5c, 0xb4, 0x6d, 0xa1, 0x39, 0xcd,
-	0x93, 0x91, 0xd5, 0xe4, 0xec, 0xc3, 0x73, 0x0e, 0x77, 0x81, 0x24, 0x81, 0x85, 0xc9, 0x7f, 0x69,
-	0x7f, 0x17, 0x5e, 0x3e, 0x6d, 0x1f, 0xd1, 0x1d, 0x63, 0x4a, 0x87, 0x2f, 0xb2, 0xb8, 0xd7, 0xe9,
-	0x7e, 0xbb, 0x09, 0x72, 0xbc, 0x7e, 0x4f, 0x4c, 0x11, 0x01, 0xdb, 0x0f, 0x3c, 0xed, 0x7f, 0x96,
-	0x61, 0x35, 0x6d, 0x0f, 0x27, 0xaf, 0x42, 0x45, 0xda, 0x28, 0x2f, 0x14, 0x18, 0xcd, 0x71, 0x7b,
-	0x44, 0xa4, 0x53, 0x6d, 0x8c, 0xe4, 0x1e, 0xac, 0xa2, 0x87, 0x3e, 0x0a, 0x88, 0x91, 0xc7, 0x4d,
-	0x44, 0xa7, 0x35, 0xfe, 0x2c, 0x53, 0x5a, 0x7a, 0x30, 0xd2, 0x42, 0xc9, 0xdc, 0x59, 0x99, 0x6e,
-	0xee, 0xe4, 0x4d, 0x99, 0x62, 0xee, 0x9c, 0x9b, 0x61, 0xee, 0x4c, 0x28, 0x65, 0x73, 0x27, 0x1a,
-	0xbd, 0x17, 0xa6, 0x19, 0xbd, 0x13, 0x1a, 0x66, 0xf4, 0x4e, 0xcc, 0x95, 0xd5, 0xa9, 0xe6, 0xca,
-	0x84, 0x86, 0x9b, 0x2b, 0x13, 0x03, 0xe2, 0xe2, 0x54, 0x03, 0xa2, 0x44, 0xc4, 0x0c, 0x88, 0x2f,
-	0xf2, 0x8e, 0x0d, 0x9c, 0xa7, 0x36, 0xf6, 0x38, 0xbf, 0xf1, 0x60, 0x97, 0x99, 0xce, 0x53, 0x74,
-	0xbd, 0xa5, 0x82, 0x09, 0xf7, 0xd7, 0xd5, 0x7e, 0x98, 0xd9, 0x80, 0xc4, 0x98, 0xbf, 0x04, 0xab,
-	0xec, 0x1c, 0xe6, 0xf1, 0xd4, 0xd9, 0x41, 0xbc, 0x62, 0xae, 0x08, 0x28, 0xd3, 0x97, 0xfe, 0x02,
-	0xac, 0xc5, 0x68, 0x5c, 0x65, 0x88, 0xa1, 0x01, 0xcc, 0x98, 0x9a, 0x2b, 0x0b, 0x65, 0x7e, 0x01,
-	0x8f, 0x15, 0x97, 0xe2, 0xc7, 0x02, 0x89, 0xbd, 0x06, 0x24, 0x41, 0x8b, 0x5f, 0x2f, 0x54, 0x10,
-	0x75, 0x3d, 0x46, 0x8d, 0x9f, 0x18, 0xfc, 0x13, 0x25, 0x63, 0xa8, 0xfb, 0x79, 0x55, 0xff, 0x55,
-	0x88, 0xbf, 0x6e, 0x73, 0x63, 0x8b, 0x68, 0x81, 0x2a, 0x0a, 0xba, 0x1c, 0xae, 0x1d, 0x66, 0xd5,
-	0x62, 0x3f, 0xa7, 0x5a, 0x69, 0x3f, 0x2a, 0xa7, 0x8c, 0x18, 0xe2, 0x33, 0x54, 0xbe, 0x09, 0x7d,
-	0x9b, 0x0f, 0x31, 0xdf, 0x7e, 0x6f, 0x4e, 0x99, 0xa6, 0xdc, 0x5f, 0xdb, 0xb2, 0x3a, 0x26, 0x84,
-	0xa1, 0x2f, 0xdc, 0xb7, 0x6d, 0xa6, 0xee, 0x91, 0xee, 0x71, 0x82, 0x1d, 0xdb, 0x6b, 0xb7, 0x66,
-	0xb3, 0x13, 0x5a, 0x62, 0xba, 0x4a, 0x51, 0xed, 0x13, 0xff, 0x12, 0x1f, 0xd8, 0x07, 0xb4, 0xf9,
-	0x85, 0x69, 0xe6, 0xe5, 0x02, 0xc5, 0x5e, 0x8e, 0x39, 0xf6, 0x12, 0x72, 0x46, 0x15, 0x72, 0x28,
-	0xb3, 0x35, 0x60, 0x19, 0x4d, 0x04, 0x82, 0x61, 0xa5, 0xc0, 0xbd, 0x20, 0xdf, 0xf8, 0x5a, 0xa3,
-	0x65, 0x2e, 0x51, 0x3a, 0xc1, 0xe6, 0x08, 0x2e, 0xca, 0x8a, 0xfd, 0x74, 0x25, 0xe7, 0x44, 0x16,
-	0x84, 0x99, 0x3d, 0x90, 0xe8, 0xff, 0xb1, 0xaa, 0xe7, 0x9d, 0x34, 0x80, 0xa3, 0xe1, 0xd3, 0x85,
-	0xe9, 0x63, 0x32, 0x23, 0x27, 0x65, 0x22, 0xdb, 0x94, 0x64, 0xd9, 0x46, 0xd6, 0xf3, 0x97, 0xd3,
-	0x7a, 0xfe, 0x1d, 0xb8, 0x41, 0xb7, 0x23, 0x3e, 0xa8, 0xee, 0xa7, 0x6e, 0x70, 0xe2, 0x8f, 0x30,
-	0xd6, 0xdd, 0x38, 0x5e, 0x95, 0xcc, 0x30, 0x71, 0x85, 0xe2, 0xe1, 0x90, 0x19, 0x1c, 0xab, 0x85,
-	0x48, 0x2c, 0x86, 0xe3, 0xbf, 0x2a, 0xc3, 0x0b, 0xa7, 0x18, 0xf7, 0x19, 0x75, 0xff, 0xa5, 0xb4,
-	0x04, 0x5e, 0x4a, 0xe9, 0x3f, 0x29, 0x53, 0x7e, 0xb8, 0x9c, 0x8c, 0xfa, 0x53, 0xe4, 0xef, 0x5f,
-	0x87, 0x35, 0x76, 0x82, 0xb0, 0xb7, 0x1b, 0x07, 0x93, 0xe1, 0x29, 0x8e, 0x90, 0xcb, 0xe2, 0xa1,
-	0x79, 0x86, 0x14, 0x4f, 0x15, 0xdc, 0x38, 0xad, 0x18, 0x46, 0x7a, 0xb0, 0x84, 0x68, 0x07, 0x8e,
-	0x37, 0x3c, 0xd5, 0x8b, 0x67, 0xf1, 0x8c, 0x5d, 0x26, 0x63, 0x4f, 0xce, 0x28, 0x60, 0x07, 0x7f,
-	0x93, 0x5b, 0xb0, 0x36, 0x9a, 0x1c, 0x53, 0xd9, 0x92, 0x4d, 0x2a, 0xee, 0x22, 0x3b, 0x67, 0xae,
-	0x8c, 0x26, 0xc7, 0xfa, 0x78, 0x8c, 0x73, 0x03, 0x7d, 0x69, 0xd7, 0x29, 0x1e, 0x5b, 0xfe, 0x02,
-	0x73, 0x1e, 0x31, 0x29, 0x03, 0xb6, 0x01, 0x70, 0xdc, 0x0d, 0x60, 0x2f, 0x2b, 0x78, 0x6e, 0x4f,
-	0xf6, 0x43, 0xfb, 0xdf, 0x25, 0xa1, 0xd5, 0x9d, 0xbe, 0x80, 0xfe, 0x76, 0x88, 0x0a, 0x86, 0xe8,
-	0x65, 0x50, 0x69, 0xd7, 0x27, 0xbb, 0x53, 0x3c, 0x46, 0xab, 0xa3, 0xc9, 0x71, 0xdc, 0x77, 0x72,
-	0xc7, 0xcf, 0xcb, 0x1d, 0xff, 0xb6, 0xd0, 0xfa, 0x16, 0xee, 0x33, 0xd3, 0xbb, 0x9c, 0x8a, 0x5e,
-	0xb7, 0x4e, 0xb7, 0x9b, 0xfc, 0xed, 0xb8, 0x15, 0x8c, 0x5b, 0xc6, 0x04, 0x3a, 0x97, 0x33, 0x81,
-	0x16, 0xac, 0xbd, 0xf9, 0xa2, 0xb5, 0x97, 0x33, 0xb8, 0x2e, 0x14, 0x18, 0x5c, 0x0b, 0x17, 0x68,
-	0xf5, 0x19, 0x0b, 0x74, 0x51, 0x9e, 0x27, 0xff, 0xbd, 0x24, 0x44, 0xaf, 0xf4, 0x5d, 0xea, 0x23,
-	0x38, 0x2b, 0xee, 0x52, 0xec, 0x08, 0x4a, 0xec, 0xe8, 0x4b, 0x77, 0x5e, 0x29, 0xba, 0x45, 0x21,
-	0x5a, 0xc1, 0x4d, 0x67, 0x9d, 0xdf, 0x9f, 0x92, 0xf2, 0xff, 0x7f, 0x6e, 0x4e, 0xe4, 0x11, 0x9c,
-	0xc7, 0x54, 0x3b, 0x7d, 0xd9, 0x03, 0xc0, 0x0e, 0xdc, 0x03, 0x3e, 0x1f, 0x6e, 0xe6, 0xee, 0x19,
-	0x5e, 0x5f, 0xaa, 0x8e, 0xe9, 0x1e, 0xec, 0x9d, 0x31, 0x37, 0xc2, 0x02, 0x78, 0xf6, 0x52, 0xf6,
-	0x47, 0x0a, 0x68, 0xcf, 0xee, 0x2f, 0xbc, 0x3f, 0x67, 0x3b, 0x9c, 0xde, 0x9f, 0xa5, 0xde, 0x7b,
-	0x01, 0x56, 0x02, 0xf7, 0x20, 0x70, 0xc3, 0xa3, 0x94, 0x92, 0x6b, 0x99, 0x03, 0x45, 0xc7, 0x88,
-	0x78, 0xdf, 0xcf, 0x75, 0xab, 0x11, 0x44, 0xda, 0x4e, 0x7c, 0xd7, 0x2e, 0x1c, 0x07, 0x3a, 0x9b,
-	0xe4, 0x0a, 0xb2, 0x1f, 0xf7, 0x2a, 0xd5, 0x92, 0x5a, 0x36, 0x79, 0x54, 0xf2, 0x03, 0x6f, 0xe8,
-	0x6a, 0xff, 0x2e, 0x96, 0x2c, 0x8a, 0x3a, 0x8f, 0x7c, 0x24, 0xbd, 0x78, 0x2a, 0xe7, 0xe4, 0x99,
-	0x22, 0x92, 0xd3, 0x68, 0x20, 0x9b, 0x5f, 0x91, 0x06, 0xf2, 0xae, 0x70, 0x9b, 0xa6, 0x7b, 0xde,
-	0x83, 0xdb, 0xe4, 0x15, 0x58, 0x60, 0x9e, 0xd2, 0xa2, 0xba, 0x6b, 0xa9, 0xea, 0x3e, 0xb8, 0x6d,
-	0x8a, 0x72, 0xed, 0xf3, 0xd8, 0x3f, 0x25, 0xd7, 0x88, 0x07, 0xb7, 0xc9, 0xdb, 0xa7, 0x7b, 0xc1,
-	0x54, 0x15, 0x2f, 0x98, 0xe2, 0xd7, 0x4b, 0xef, 0xa4, 0x5e, 0x2f, 0xbd, 0x38, 0xbb, 0xb7, 0xb8,
-	0xd7, 0x11, 0x8b, 0xf4, 0x1c, 0xc7, 0x0a, 0xd5, 0xfe, 0xba, 0x04, 0x57, 0x67, 0x52, 0x90, 0x2b,
-	0x50, 0xd5, 0xbb, 0x8d, 0x5e, 0x32, 0xbe, 0x74, 0xcd, 0x08, 0x08, 0xd9, 0x85, 0xc5, 0x6d, 0x27,
-	0xf4, 0xfa, 0x74, 0x1a, 0x17, 0x1a, 0xc1, 0x73, 0x6c, 0x63, 0xf4, 0xbd, 0x33, 0x66, 0x42, 0x4b,
-	0x6c, 0x58, 0xc7, 0xb5, 0x90, 0xca, 0xa3, 0x59, 0x2e, 0xd0, 0xd3, 0xe4, 0x18, 0xe6, 0xc8, 0xe8,
-	0x3e, 0x93, 0x03, 0x92, 0xc7, 0x40, 0x2c, 0x6b, 0xaf, 0xe6, 0x06, 0x11, 0xd7, 0x5f, 0x44, 0x5e,
-	0xfc, 0x1c, 0xe6, 0x8d, 0x67, 0xf4, 0x5d, 0x8e, 0x6e, 0xef, 0x8c, 0x59, 0xc0, 0x8d, 0xdc, 0x04,
-	0x39, 0xe1, 0x2b, 0x9e, 0xd1, 0xcb, 0x7b, 0x67, 0x4c, 0x18, 0xc7, 0x89, 0x5f, 0xb3, 0x3b, 0xc1,
-	0xa7, 0x42, 0x24, 0x9a, 0xde, 0x4f, 0xcf, 0x11, 0x68, 0xff, 0x65, 0xa8, 0x76, 0x85, 0x5b, 0xa2,
-	0xf4, 0xf2, 0x50, 0xb8, 0x20, 0x9a, 0x71, 0xa9, 0xf6, 0x0f, 0x15, 0xa1, 0xd3, 0x79, 0x76, 0x7f,
-	0x4a, 0x99, 0x50, 0x07, 0xb3, 0x33, 0xa1, 0x0e, 0x7e, 0xc6, 0x4c, 0xa8, 0x9a, 0x07, 0xaf, 0x9c,
-	0xba, 0xef, 0xc9, 0xbb, 0xa0, 0x62, 0x92, 0x49, 0x47, 0x1a, 0x47, 0xb6, 0x04, 0xd7, 0xe3, 0xcc,
-	0x2b, 0x7b, 0x3c, 0x33, 0xaf, 0xb9, 0xd6, 0x4f, 0x53, 0x6b, 0x7f, 0xc8, 0x33, 0xee, 0x34, 0x06,
-	0xdd, 0x8c, 0xb5, 0xf5, 0xcb, 0x3e, 0x56, 0x35, 0x52, 0xeb, 0xf1, 0x05, 0x29, 0xa3, 0x77, 0xfe,
-	0x5b, 0xd3, 0xdf, 0xac, 0x4a, 0x8b, 0xf3, 0x9f, 0x95, 0xe1, 0xca, 0x2c, 0x72, 0xa2, 0x83, 0x6a,
-	0x64, 0x72, 0xf7, 0xcb, 0x19, 0xe0, 0x72, 0x49, 0xff, 0xcd, 0x1c, 0x3a, 0x1d, 0x5b, 0x06, 0x8b,
-	0x5f, 0x62, 0xe2, 0xd8, 0x72, 0x52, 0x3a, 0xb6, 0xa2, 0x98, 0xbc, 0x00, 0xf3, 0x7a, 0xcd, 0x4a,
-	0x32, 0xd5, 0xe2, 0x93, 0x29, 0xa7, 0x1f, 0xe2, 0x63, 0x1c, 0x5e, 0x44, 0x7e, 0x2d, 0x9f, 0x9c,
-	0x99, 0xa7, 0xa8, 0xbd, 0x2c, 0x75, 0x48, 0x2e, 0x19, 0x16, 0xd6, 0x37, 0x49, 0xde, 0xc4, 0xf3,
-	0xa1, 0x98, 0xf9, 0x44, 0xcf, 0x1a, 0xcc, 0x77, 0x03, 0x37, 0x74, 0x23, 0xf9, 0x39, 0xd3, 0x18,
-	0x21, 0x26, 0x2f, 0xe1, 0x8f, 0x8d, 0x9c, 0x13, 0x16, 0x5b, 0x6a, 0x5e, 0x8e, 0x21, 0x88, 0xaf,
-	0x93, 0x28, 0xd8, 0x94, 0x50, 0x28, 0x41, 0xd3, 0x99, 0x8c, 0xfa, 0x47, 0xfb, 0x66, 0x93, 0x0b,
-	0x57, 0x8c, 0x60, 0x88, 0x50, 0xda, 0xc0, 0xd0, 0x94, 0x50, 0xb4, 0xdf, 0x52, 0x60, 0xa3, 0xa8,
-	0x1d, 0xe4, 0x0a, 0x54, 0x46, 0x85, 0x79, 0xa8, 0x47, 0x2c, 0x24, 0xce, 0x12, 0x1a, 0xef, 0x0e,
-	0xfc, 0xe0, 0xd8, 0x89, 0xe4, 0x47, 0x5f, 0x12, 0xd8, 0x44, 0x63, 0xe3, 0x0e, 0xfe, 0x4f, 0xae,
-	0x8b, 0x53, 0xa9, 0x9c, 0xcb, 0x5c, 0x8d, 0x7f, 0x34, 0x1d, 0xa0, 0x31, 0xe8, 0x76, 0xc6, 0x2c,
-	0x19, 0xd3, 0x9b, 0x50, 0xa1, 0xd5, 0xca, 0xcc, 0x5e, 0x3a, 0x7f, 0xf4, 0x56, 0x93, 0x23, 0xb1,
-	0x5a, 0x85, 0xce, 0xf1, 0xd0, 0x44, 0x64, 0xed, 0x21, 0xac, 0xa6, 0x31, 0x88, 0x91, 0x8e, 0xc7,
-	0xbf, 0x74, 0x47, 0xe5, 0x9c, 0xb6, 0x7d, 0x9f, 0x3d, 0x3c, 0xde, 0xbe, 0xf8, 0x93, 0x2f, 0xae,
-	0x03, 0xfd, 0xc9, 0x68, 0x8a, 0xe2, 0xf5, 0x6b, 0xbf, 0x5b, 0x82, 0x8d, 0x24, 0xd6, 0x91, 0x58,
-	0x43, 0x7f, 0x63, 0x03, 0x6f, 0xe8, 0xa9, 0xc0, 0x10, 0x42, 0xb4, 0xcc, 0x37, 0x70, 0xc6, 0x7b,
-	0xf4, 0x5d, 0xd8, 0x9c, 0x86, 0x4f, 0x5e, 0x85, 0x45, 0x0c, 0xb9, 0x39, 0x76, 0xfa, 0xae, 0xbc,
-	0xcd, 0x8e, 0x04, 0xd0, 0x4c, 0xca, 0xb5, 0x3f, 0x51, 0xe0, 0x12, 0x7f, 0x2e, 0xdb, 0x72, 0xbc,
-	0x11, 0xda, 0x8a, 0xfa, 0xee, 0x57, 0x13, 0x38, 0x66, 0x37, 0xb5, 0x8f, 0xbd, 0x94, 0x7e, 0x15,
-	0x9d, 0xfb, 0xda, 0xf4, 0xd6, 0x92, 0x57, 0x30, 0x8c, 0x2c, 0x77, 0x27, 0xab, 0xb0, 0x40, 0x5d,
-	0x23, 0x0a, 0x90, 0x03, 0x75, 0x21, 0x86, 0xf6, 0xf7, 0xe0, 0xda, 0xec, 0x0f, 0x90, 0x5f, 0x85,
-	0x15, 0xcc, 0x93, 0xba, 0x3f, 0x3e, 0x0c, 0x9c, 0x81, 0x2b, 0xb4, 0x88, 0x42, 0xd9, 0x2d, 0x97,
-	0xb1, 0xa8, 0xb8, 0x3c, 0x70, 0xd4, 0x21, 0x66, 0x60, 0xe5, 0x44, 0xa9, 0x37, 0xe9, 0x32, 0x37,
-	0xed, 0x3b, 0x0a, 0x90, 0x3c, 0x0f, 0xf2, 0x0d, 0x58, 0xde, 0xef, 0xd5, 0xac, 0xc8, 0x09, 0xa2,
-	0x3d, 0x7f, 0x12, 0xf0, 0x90, 0xb4, 0x2c, 0x8e, 0x50, 0xd4, 0xb7, 0x99, 0x55, 0xf0, 0xc8, 0x9f,
-	0x04, 0x66, 0x0a, 0x0f, 0x33, 0x6c, 0xba, 0xee, 0x93, 0x81, 0x73, 0x92, 0xce, 0xb0, 0xc9, 0x61,
-	0xa9, 0x0c, 0x9b, 0x1c, 0xa6, 0xfd, 0x40, 0x81, 0xcb, 0xe2, 0x9d, 0xc4, 0xa0, 0xa0, 0x2e, 0x35,
-	0x8c, 0x96, 0x17, 0x88, 0x2c, 0x07, 0xb3, 0x84, 0xf8, 0x75, 0x11, 0x50, 0x12, 0x2b, 0x88, 0xd2,
-	0x3c, 0xa3, 0x25, 0xbf, 0x04, 0x15, 0x2b, 0xf2, 0xc7, 0xa7, 0x88, 0x28, 0xa9, 0xc6, 0x23, 0x1a,
-	0xf9, 0x63, 0x64, 0x81, 0x94, 0x9a, 0x0b, 0x1b, 0x72, 0xe5, 0x44, 0x8d, 0x49, 0x0b, 0x16, 0x78,
-	0x38, 0xe2, 0x8c, 0x03, 0xde, 0x8c, 0x36, 0x6d, 0xaf, 0x89, 0xb0, 0x95, 0x3c, 0x1e, 0xbf, 0x29,
-	0x78, 0x68, 0xff, 0x48, 0x81, 0x25, 0x2a, 0xd8, 0xe0, 0xbd, 0xf5, 0xcb, 0x4e, 0xe9, 0xb4, 0xa8,
-	0x2c, 0xfc, 0x49, 0x63, 0xf6, 0xa7, 0x3a, 0x8d, 0xdf, 0x82, 0xb5, 0x0c, 0x01, 0xd1, 0x30, 0x60,
-	0xd9, 0xd0, 0xeb, 0x3b, 0x2c, 0x61, 0x1f, 0xf3, 0xc5, 0x4c, 0xc1, 0xb4, 0x7f, 0xa0, 0xc0, 0x46,
-	0xe7, 0x49, 0xe4, 0x30, 0xe3, 0xbd, 0x39, 0x19, 0x8a, 0xf5, 0x4e, 0x85, 0x35, 0xf1, 0xe0, 0x86,
-	0x05, 0x53, 0x62, 0xc2, 0x1a, 0x87, 0x99, 0x71, 0x29, 0xd9, 0x83, 0x2a, 0x3f, 0x5f, 0x42, 0x1e,
-	0x3a, 0xff, 0x9a, 0xa4, 0x3e, 0x49, 0x18, 0x73, 0x24, 0xda, 0x12, 0xdc, 0xc2, 0x38, 0x8d, 0x19,
-	0x53, 0x6b, 0x7f, 0xa9, 0xc0, 0x85, 0x29, 0x34, 0xe4, 0x3d, 0x98, 0xc3, 0x40, 0x0f, 0x7c, 0xf4,
-	0xae, 0x4c, 0xf9, 0x44, 0xd4, 0x3f, 0x7a, 0x70, 0x9b, 0x1d, 0x44, 0xc7, 0xf4, 0x87, 0xc9, 0xa8,
-	0xc8, 0x47, 0xb0, 0xa8, 0x0f, 0x06, 0xfc, 0x02, 0x57, 0x4a, 0x5d, 0xe0, 0xa6, 0x7c, 0xf1, 0xf5,
-	0x18, 0x9f, 0x5d, 0xe0, 0xd8, 0x93, 0xe3, 0xc1, 0xc0, 0xe6, 0x41, 0x2c, 0x12, 0x7e, 0x97, 0xde,
-	0x85, 0xd5, 0x34, 0xf2, 0x73, 0xbd, 0xbb, 0xff, 0x5c, 0x01, 0x35, 0x5d, 0x87, 0x9f, 0x4f, 0xc0,
-	0xcd, 0xa2, 0x61, 0x7e, 0xc6, 0xa4, 0xfa, 0xc7, 0x25, 0x38, 0x57, 0xd8, 0xc3, 0xe4, 0x35, 0x98,
-	0xd7, 0xc7, 0xe3, 0x46, 0x9d, 0xcf, 0x2a, 0x2e, 0x21, 0xa1, 0x7e, 0x3d, 0x75, 0xbf, 0x65, 0x48,
-	0xe4, 0x4d, 0xa8, 0x32, 0x1f, 0x91, 0xba, 0xd8, 0x70, 0x30, 0x82, 0x20, 0x77, 0x60, 0x49, 0x07,
-	0xb1, 0x17, 0x88, 0x64, 0x07, 0x56, 0x79, 0xec, 0x3d, 0x74, 0x18, 0x8a, 0xf3, 0x25, 0xa1, 0x8f,
-	0x95, 0x50, 0xda, 0x33, 0x57, 0xa3, 0xd4, 0xde, 0x99, 0xa1, 0x22, 0x4d, 0x50, 0x91, 0xa7, 0xcc,
-	0x89, 0x45, 0xd2, 0x97, 0x7c, 0xef, 0xa6, 0xf0, 0xca, 0x51, 0xc6, 0xc3, 0xc5, 0xfc, 0xdf, 0x8f,
-	0xdd, 0x51, 0xf4, 0xf3, 0x1b, 0xae, 0xe4, 0x1b, 0xa7, 0x1a, 0xae, 0xef, 0x57, 0xd8, 0x62, 0xce,
-	0x92, 0x51, 0x89, 0x46, 0x4a, 0x8f, 0x82, 0x12, 0x0d, 0xbd, 0x9f, 0xf1, 0xe8, 0x72, 0x75, 0x58,
-	0x60, 0x51, 0xff, 0xc4, 0xca, 0xb8, 0x5a, 0x58, 0x05, 0x86, 0xf3, 0xe0, 0x36, 0x13, 0x5f, 0x58,
-	0xc4, 0x89, 0xd0, 0x14, 0xa4, 0xe4, 0x01, 0x2c, 0xd5, 0x86, 0xae, 0x33, 0x9a, 0x8c, 0x7b, 0xa7,
-	0x33, 0x50, 0x6f, 0xf2, 0xb6, 0x2c, 0xf7, 0x19, 0x19, 0x1a, 0xb6, 0x71, 0x27, 0x97, 0x19, 0x91,
-	0x5e, 0xfc, 0x08, 0xbd, 0x82, 0xba, 0xd9, 0x37, 0x66, 0xf4, 0x4f, 0x16, 0x88, 0x74, 0xe9, 0x08,
-	0x0b, 0xfc, 0x95, 0xba, 0x0d, 0xab, 0x4d, 0x27, 0x8c, 0x7a, 0x81, 0x33, 0x0a, 0x31, 0x02, 0xf9,
-	0x29, 0xa2, 0xa9, 0x5e, 0xe6, 0x15, 0x66, 0x3a, 0xdb, 0x28, 0x26, 0x65, 0x3a, 0xdb, 0x34, 0x3b,
-	0x2a, 0x2f, 0xed, 0x78, 0x23, 0x67, 0xe8, 0x7d, 0x5b, 0xc4, 0xea, 0x60, 0xf2, 0xd2, 0x81, 0x00,
-	0x9a, 0x49, 0xb9, 0xf6, 0x2b, 0xb9, 0x71, 0x63, 0xb5, 0x5c, 0x82, 0x05, 0x1e, 0xc9, 0x89, 0x45,
-	0x36, 0xea, 0x1a, 0xed, 0x7a, 0xa3, 0xbd, 0xab, 0x2a, 0x64, 0x15, 0xa0, 0x6b, 0x76, 0x6a, 0x86,
-	0x65, 0xd1, 0xdf, 0x25, 0xfa, 0x9b, 0x87, 0x3d, 0xda, 0xd9, 0x6f, 0xaa, 0x65, 0x29, 0xf2, 0x51,
-	0x45, 0xfb, 0xb1, 0x02, 0xe7, 0x8b, 0x87, 0x92, 0xf4, 0x00, 0x63, 0x5f, 0x71, 0x57, 0x85, 0x6f,
-	0xcc, 0x1c, 0xf7, 0x42, 0x70, 0x36, 0x86, 0x56, 0xc4, 0x62, 0x33, 0x95, 0x84, 0x99, 0x8d, 0x05,
-	0x7b, 0xf0, 0x06, 0x66, 0xc9, 0x1b, 0x68, 0x35, 0xd8, 0x9c, 0xc6, 0x23, 0xdd, 0xd4, 0x35, 0x58,
-	0xd2, 0xbb, 0xdd, 0x66, 0xa3, 0xa6, 0xf7, 0x1a, 0x9d, 0xb6, 0xaa, 0x90, 0x45, 0x98, 0xdb, 0x35,
-	0x3b, 0xfb, 0x5d, 0xb5, 0xa4, 0xfd, 0x9e, 0x02, 0x2b, 0x8d, 0xc4, 0x89, 0xf2, 0xcb, 0x2e, 0xbe,
-	0x6f, 0xa6, 0x16, 0xdf, 0x66, 0x1c, 0x25, 0x2e, 0xfe, 0xc0, 0xa9, 0x56, 0xde, 0xbf, 0x29, 0xc3,
-	0x7a, 0x8e, 0x86, 0x58, 0xb0, 0xa0, 0x3f, 0xb4, 0x3a, 0x8d, 0x7a, 0x8d, 0xd7, 0xec, 0x7a, 0xe2,
-	0x34, 0x87, 0xd9, 0x46, 0x73, 0x5f, 0x61, 0x91, 0x55, 0x9e, 0x86, 0xb6, 0xef, 0x0d, 0xfa, 0x29,
-	0xaf, 0x4d, 0xc1, 0x09, 0x4f, 0xb2, 0x6f, 0x4f, 0x02, 0x74, 0x44, 0xe5, 0xb5, 0x8e, 0x7d, 0xf1,
-	0x04, 0x3c, 0xcf, 0x18, 0x5d, 0x33, 0x1d, 0x5a, 0x9e, 0x67, 0x9d, 0xf0, 0x23, 0x6d, 0x98, 0xdf,
-	0xf5, 0xa2, 0xbd, 0xc9, 0x63, 0xbe, 0x7e, 0xaf, 0x25, 0xb9, 0x27, 0xf7, 0x26, 0x8f, 0xf3, 0x6c,
-	0x51, 0xab, 0xc9, 0x5e, 0x55, 0xa7, 0x58, 0x72, 0x2e, 0xe4, 0x3e, 0xcc, 0xe9, 0x0f, 0x2d, 0x53,
-	0xe7, 0xab, 0x4b, 0x72, 0x4b, 0x34, 0xf5, 0x29, 0xdc, 0x68, 0xeb, 0x03, 0x27, 0xc5, 0x8d, 0xf1,
-	0xc8, 0x46, 0x96, 0xa8, 0x3c, 0x57, 0x64, 0x89, 0xed, 0x15, 0x58, 0xe2, 0x17, 0x32, 0xbc, 0xeb,
-	0xfc, 0x48, 0x81, 0xcd, 0x69, 0xc3, 0x40, 0xef, 0x78, 0xe9, 0x08, 0x52, 0xe7, 0xe3, 0x4c, 0x67,
-	0x69, 0xd7, 0x61, 0x81, 0x46, 0x3e, 0x80, 0x25, 0xe6, 0x5e, 0x66, 0xbd, 0xb9, 0x6f, 0x36, 0xf8,
-	0xdc, 0xbf, 0xfa, 0x17, 0x5f, 0x5c, 0xbf, 0xc0, 0x3d, 0xd2, 0xc2, 0x37, 0xed, 0x49, 0xe0, 0x25,
-	0xa4, 0x9b, 0x8a, 0x29, 0x53, 0x50, 0x91, 0xdc, 0x99, 0x0c, 0x3c, 0x57, 0x5c, 0x48, 0x44, 0x94,
-	0x1d, 0x0e, 0x93, 0x0f, 0x48, 0x01, 0xd3, 0xbe, 0xab, 0xc0, 0xa5, 0xe9, 0x63, 0x4e, 0x0f, 0xdd,
-	0x1e, 0xf3, 0xd2, 0x13, 0x71, 0x6e, 0xf0, 0xd0, 0x8d, 0x5d, 0xf9, 0x64, 0x9e, 0x02, 0x91, 0x12,
-	0x71, 0x75, 0x99, 0xd0, 0xb8, 0x20, 0x51, 0xac, 0x4d, 0x93, 0x89, 0x04, 0xa2, 0xf6, 0x08, 0x2e,
-	0x4c, 0x99, 0x21, 0xe4, 0xfd, 0xc2, 0xfc, 0x89, 0xf8, 0xfc, 0x59, 0x7e, 0xdf, 0x9e, 0x4a, 0xc4,
-	0x2b, 0xc1, 0xb5, 0xff, 0xc4, 0xfc, 0x52, 0x0b, 0xa6, 0x0b, 0x95, 0x0f, 0x30, 0x5f, 0x9f, 0x3e,
-	0xea, 0x1f, 0xf9, 0x41, 0x32, 0x58, 0x28, 0x1f, 0x44, 0xb4, 0xc4, 0x76, 0xb0, 0x28, 0x33, 0x68,
-	0x19, 0x2a, 0xe2, 0xc3, 0x7a, 0x37, 0xf0, 0x0f, 0x3c, 0xf6, 0x60, 0x8f, 0x5d, 0xeb, 0xf8, 0xca,
-	0x7a, 0x59, 0x9a, 0xb0, 0xfe, 0xd0, 0x0d, 0xf5, 0xd1, 0xc9, 0xd3, 0x23, 0x37, 0x70, 0x73, 0xf8,
-	0x71, 0x52, 0x1e, 0x0a, 0x66, 0xee, 0x0f, 0x7d, 0x2c, 0x30, 0xf3, 0xbc, 0xb5, 0xef, 0x95, 0xe0,
-	0xe6, 0x33, 0x39, 0x9e, 0x36, 0xed, 0xe0, 0xd7, 0x01, 0x38, 0x2d, 0xed, 0x01, 0x49, 0x69, 0x23,
-	0x2a, 0xe3, 0x04, 0x23, 0x53, 0x42, 0x21, 0x4f, 0xe0, 0xaa, 0xf8, 0xd5, 0xef, 0xbb, 0xe3, 0x28,
-	0xa4, 0xf5, 0xe0, 0x71, 0x6c, 0xe3, 0x08, 0x3e, 0x55, 0xcc, 0xad, 0x7f, 0x33, 0xe6, 0xc1, 0x30,
-	0x99, 0xf7, 0xbc, 0x08, 0x89, 0x8b, 0xaa, 0xa3, 0xd9, 0xbc, 0xc8, 0xad, 0x64, 0x25, 0x55, 0x12,
-	0x95, 0xaf, 0x58, 0x49, 0xf1, 0xfa, 0xd1, 0x7e, 0x52, 0x82, 0xf3, 0x74, 0x47, 0x1e, 0xba, 0x61,
-	0xa8, 0x4f, 0xa2, 0x23, 0xba, 0x6a, 0xd9, 0x1d, 0x85, 0xbc, 0x0d, 0xf3, 0x47, 0xcf, 0x67, 0x81,
-	0x60, 0xe8, 0x84, 0x00, 0x4a, 0x39, 0xe2, 0x6d, 0x35, 0xfd, 0x9f, 0xbc, 0x03, 0x73, 0xa8, 0x60,
-	0xe3, 0xc2, 0x84, 0xb8, 0x04, 0x16, 0x7f, 0x1a, 0xd5, 0x6f, 0x26, 0x23, 0xa0, 0xfd, 0x9c, 0xa4,
-	0x74, 0xe3, 0xfb, 0x99, 0x50, 0x3c, 0xc5, 0x59, 0xdd, 0xcc, 0xc5, 0xe3, 0x03, 0x87, 0xe7, 0x49,
-	0xdb, 0x82, 0x75, 0xb1, 0x6a, 0xc6, 0x22, 0xdc, 0x38, 0xb7, 0x7c, 0xaf, 0xf1, 0xf8, 0x0f, 0x63,
-	0x11, 0x72, 0xfc, 0x45, 0x58, 0x0d, 0xc3, 0x23, 0x9b, 0x87, 0x0f, 0x7a, 0x22, 0x32, 0x99, 0x98,
-	0xcb, 0x61, 0x78, 0xc4, 0xe2, 0x08, 0xdd, 0x77, 0x4f, 0x28, 0x16, 0xba, 0xf8, 0x26, 0x58, 0x55,
-	0x86, 0x15, 0x0d, 0xc3, 0x18, 0x8b, 0x47, 0xbe, 0x82, 0x04, 0x4b, 0xfb, 0x6f, 0x25, 0x58, 0x7c,
-	0x48, 0x05, 0x77, 0x54, 0x47, 0xcd, 0x56, 0x6f, 0xdd, 0x81, 0xa5, 0xa6, 0xef, 0x70, 0xa3, 0x23,
-	0x7f, 0x61, 0xcc, 0xde, 0x04, 0x0c, 0x7d, 0x47, 0xd8, 0x2f, 0x43, 0x53, 0x46, 0x7a, 0x46, 0xe8,
-	0xa7, 0x7b, 0x30, 0xcf, 0x8c, 0xc0, 0x5c, 0xd3, 0x2a, 0xae, 0x6e, 0x71, 0x8d, 0x5e, 0x67, 0xc5,
-	0x92, 0x9d, 0x8c, 0x19, 0x92, 0xe5, 0x7b, 0x04, 0xf7, 0xff, 0x97, 0x94, 0x6f, 0x73, 0xa7, 0x53,
-	0xbe, 0x49, 0x61, 0xa3, 0xe7, 0x4f, 0x13, 0x36, 0xfa, 0xd2, 0x5d, 0x58, 0x92, 0xea, 0xf3, 0x5c,
-	0x37, 0xb9, 0xdf, 0x28, 0xc1, 0x0a, 0xb6, 0x2a, 0x76, 0x2d, 0xfb, 0x9b, 0xa9, 0x4a, 0xfc, 0x66,
-	0x4a, 0x95, 0xb8, 0x29, 0x8f, 0x17, 0x6b, 0xd9, 0x0c, 0x1d, 0xe2, 0x3d, 0x58, 0xcf, 0x21, 0x92,
-	0xb7, 0x60, 0x8e, 0x56, 0x5f, 0xa8, 0x5e, 0xd4, 0xec, 0x0c, 0x48, 0x52, 0x8c, 0xd0, 0x86, 0x87,
-	0x26, 0xc3, 0xd6, 0xfe, 0x97, 0x02, 0xcb, 0x3c, 0x83, 0xe0, 0xe8, 0xc0, 0x7f, 0x66, 0x77, 0xde,
-	0xca, 0x76, 0x27, 0x0b, 0x64, 0xc8, 0xbb, 0xf3, 0xff, 0x76, 0x27, 0xde, 0x4d, 0x75, 0xe2, 0x85,
-	0x38, 0xe0, 0xb8, 0x68, 0xce, 0x8c, 0x3e, 0xfc, 0x21, 0xa6, 0xe0, 0x48, 0x23, 0x92, 0x5f, 0x83,
-	0xc5, 0xb6, 0xfb, 0x34, 0xa5, 0xc1, 0xb8, 0x35, 0x85, 0xe9, 0xeb, 0x31, 0x22, 0x5b, 0x53, 0xec,
-	0x5d, 0x8e, 0xfb, 0xd4, 0xce, 0xd9, 0x9f, 0x13, 0x96, 0x97, 0xde, 0x85, 0xd5, 0x34, 0xd9, 0xf3,
-	0x4c, 0x7d, 0x1e, 0x0e, 0x05, 0x63, 0x73, 0xfe, 0x56, 0x19, 0x20, 0x89, 0x24, 0x41, 0x17, 0x60,
-	0xca, 0xf5, 0x46, 0x18, 0x7f, 0x10, 0x24, 0xcf, 0x71, 0xe1, 0x91, 0x73, 0x8b, 0x1b, 0x29, 0x4a,
-	0xd3, 0x03, 0xc2, 0x8f, 0x44, 0x34, 0x1c, 0xe6, 0x66, 0x38, 0x74, 0x98, 0x4b, 0x7e, 0x79, 0xfb,
-	0x45, 0xcc, 0xff, 0x11, 0x43, 0x53, 0xd1, 0xba, 0xab, 0xf5, 0x09, 0xcf, 0x3b, 0x84, 0x01, 0x0c,
-	0xea, 0x14, 0x21, 0x17, 0x9d, 0xa5, 0xf2, 0x7c, 0xd1, 0x59, 0xba, 0xb0, 0xe8, 0x8d, 0x3e, 0x75,
-	0x47, 0x91, 0x1f, 0x9c, 0xa0, 0x65, 0x26, 0x51, 0xf9, 0xd2, 0x2e, 0x68, 0x88, 0x32, 0x36, 0x0e,
-	0x28, 0x23, 0xc4, 0xf8, 0xf2, 0x30, 0xc4, 0xc0, 0x38, 0xa6, 0xc4, 0x9c, 0x3a, 0xcf, 0x22, 0x4b,
-	0xdc, 0xab, 0x54, 0xab, 0xea, 0xe2, 0xbd, 0x4a, 0x75, 0x51, 0x05, 0x53, 0x32, 0xab, 0xc6, 0x66,
-	0x53, 0xc9, 0xd2, 0x99, 0xb6, 0x62, 0x6a, 0x7f, 0x55, 0x02, 0x92, 0xaf, 0x06, 0xf9, 0x26, 0x2c,
-	0xb1, 0x0d, 0xd6, 0x0e, 0xc2, 0x4f, 0xf8, 0xbb, 0x24, 0xf6, 0x48, 0x50, 0x02, 0xcb, 0x11, 0x4e,
-	0x19, 0xd8, 0x0c, 0x3f, 0x19, 0x92, 0x5f, 0x85, 0xb3, 0xd8, 0xbd, 0x63, 0x37, 0xf0, 0xfc, 0x81,
-	0x8d, 0xe9, 0x28, 0x9c, 0x21, 0xcf, 0xdd, 0xfe, 0xda, 0x5f, 0x7c, 0x71, 0xfd, 0x6a, 0x41, 0xf1,
-	0x94, 0x61, 0xc0, 0x80, 0x10, 0x5d, 0xc4, 0xec, 0x32, 0x44, 0xd2, 0x03, 0x55, 0xa6, 0x3f, 0x98,
-	0x0c, 0x87, 0x7c, 0x64, 0xb7, 0xa8, 0x50, 0x97, 0x2d, 0x9b, 0xc2, 0x78, 0x35, 0x61, 0xbc, 0x33,
-	0x19, 0x0e, 0xc9, 0xdb, 0x00, 0xfe, 0xc8, 0x3e, 0xf6, 0xc2, 0x90, 0xd9, 0xfb, 0xe2, 0xb7, 0x6a,
-	0x09, 0x54, 0x1e, 0x0c, 0x7f, 0xd4, 0x62, 0x40, 0xf2, 0x77, 0x00, 0x03, 0xa3, 0x61, 0xc4, 0x40,
-	0xe6, 0xd3, 0xc6, 0xe5, 0x3c, 0x01, 0x4c, 0x87, 0xd2, 0x39, 0x74, 0x2d, 0xef, 0xdb, 0xe2, 0x49,
-	0xdf, 0xb7, 0x60, 0x9d, 0xbb, 0xef, 0x3f, 0xf4, 0xa2, 0x23, 0x7e, 0xdb, 0xfc, 0x32, 0x57, 0x55,
-	0xe9, 0xba, 0xf9, 0xa7, 0x15, 0x00, 0xfd, 0xa1, 0x25, 0x82, 0xf1, 0xbe, 0x02, 0x73, 0xf4, 0x0e,
-	0x2d, 0x74, 0x71, 0x68, 0xc9, 0x40, 0xbe, 0xb2, 0x25, 0x03, 0x31, 0xe8, 0x6a, 0x34, 0xf1, 0xf5,
-	0x8d, 0xd0, 0xc3, 0xe1, 0x6a, 0x64, 0x0f, 0x72, 0x52, 0xc9, 0x50, 0x38, 0x16, 0x69, 0x02, 0x24,
-	0xe1, 0x71, 0xf9, 0xad, 0x70, 0x3d, 0x89, 0x33, 0xc9, 0x0b, 0x78, 0x92, 0xb7, 0xe4, 0x89, 0xa5,
-	0x3c, 0x7d, 0x12, 0x34, 0x72, 0x1f, 0x2a, 0x3d, 0x27, 0x8e, 0xdc, 0x32, 0x25, 0x68, 0xf0, 0x0d,
-	0x9e, 0x5b, 0x3f, 0x09, 0x1c, 0xbc, 0x1a, 0x39, 0x87, 0x72, 0xed, 0x90, 0x09, 0x31, 0x60, 0xbe,
-	0xeb, 0x04, 0xce, 0x71, 0x38, 0x2d, 0xd8, 0x3c, 0x2b, 0x15, 0x29, 0x66, 0x10, 0x28, 0xcb, 0x14,
-	0xac, 0x98, 0xdc, 0x81, 0xb2, 0x65, 0xb5, 0x78, 0xa8, 0xbc, 0x95, 0x44, 0xe0, 0xb7, 0xac, 0x16,
-	0x73, 0x0d, 0x08, 0xc3, 0x63, 0x89, 0x8c, 0x22, 0x93, 0x5f, 0x84, 0x25, 0xe9, 0x3e, 0xc2, 0x83,
-	0x4c, 0x62, 0x1f, 0x48, 0xef, 0x3b, 0xe5, 0x4d, 0x43, 0xc2, 0x26, 0x4d, 0x50, 0xef, 0x4f, 0x1e,
-	0xbb, 0xfa, 0x78, 0x8c, 0x21, 0x23, 0x3e, 0x75, 0x03, 0x26, 0xc8, 0x55, 0x93, 0xec, 0x2c, 0xf8,
-	0x98, 0x6a, 0x20, 0x4a, 0x65, 0x7d, 0x64, 0x96, 0x92, 0x74, 0x61, 0xdd, 0x72, 0xa3, 0xc9, 0x98,
-	0x79, 0x69, 0xed, 0xb0, 0x8b, 0x10, 0x0b, 0x49, 0x89, 0x89, 0x2c, 0x42, 0x5a, 0x28, 0x5c, 0xe3,
-	0x0e, 0x72, 0x97, 0xa1, 0x3c, 0xb1, 0xe6, 0xca, 0x43, 0x2e, 0x4b, 0xf0, 0xca, 0x0c, 0x09, 0x9e,
-	0xca, 0xc7, 0xb9, 0xb0, 0xc9, 0x78, 0x0f, 0x91, 0xc2, 0x26, 0xa7, 0x82, 0x25, 0xff, 0xa0, 0x22,
-	0x45, 0xee, 0xe7, 0x63, 0xf1, 0x1e, 0xc0, 0x3d, 0xdf, 0x1b, 0xb5, 0xdc, 0xe8, 0xc8, 0x1f, 0x48,
-	0xaf, 0x77, 0x97, 0x3e, 0xf6, 0xbd, 0x91, 0x7d, 0x8c, 0xe0, 0xbf, 0xfa, 0xe2, 0xba, 0x84, 0x64,
-	0x4a, 0xff, 0x93, 0xaf, 0xc1, 0x22, 0xfd, 0xd5, 0x4b, 0x7c, 0xcd, 0x98, 0xda, 0x1e, 0xa9, 0x59,
-	0xce, 0xbc, 0x04, 0x81, 0xdc, 0xc5, 0x2c, 0x91, 0xde, 0x38, 0x92, 0x84, 0x57, 0x91, 0x12, 0xd2,
-	0x1b, 0x47, 0xd9, 0xa7, 0xbb, 0x12, 0x32, 0xd9, 0x8b, 0xab, 0x2e, 0x12, 0xbb, 0xf2, 0x64, 0x94,
-	0xfc, 0xfd, 0x2f, 0x16, 0xd9, 0x22, 0x0b, 0x84, 0xfc, 0xfe, 0x37, 0x43, 0x86, 0x95, 0xb0, 0xf6,
-	0xea, 0xfc, 0xd6, 0x39, 0x27, 0x55, 0x22, 0x3c, 0x1a, 0xf0, 0x3b, 0x64, 0xaa, 0x12, 0x31, 0x32,
-	0xd9, 0x86, 0x35, 0x26, 0xf5, 0xc7, 0x29, 0xe0, 0xb9, 0x88, 0x8b, 0x7b, 0x5b, 0x92, 0x23, 0x5e,
-	0xfe, 0x7c, 0x86, 0x80, 0xec, 0xc0, 0x1c, 0x6a, 0x10, 0xf8, 0xe3, 0x9c, 0xcb, 0xb2, 0x26, 0x29,
-	0xbb, 0x8e, 0x70, 0x5f, 0x41, 0x1d, 0x92, 0xbc, 0xaf, 0x20, 0x2a, 0xf9, 0x65, 0x00, 0x63, 0x14,
-	0xf8, 0xc3, 0x21, 0xe6, 0x29, 0xa9, 0xa6, 0x9e, 0xff, 0x73, 0x3e, 0xc8, 0x25, 0x41, 0xe2, 0x31,
-	0xb5, 0xf1, 0xb7, 0x9d, 0xc9, 0x66, 0x22, 0xf1, 0xd2, 0x1a, 0x30, 0xcf, 0x16, 0x23, 0xe6, 0xfc,
-	0xe1, 0x99, 0x11, 0xa5, 0x8c, 0x31, 0x2c, 0xe7, 0x0f, 0x87, 0xe7, 0x73, 0xfe, 0x48, 0x04, 0xda,
-	0x7d, 0xd8, 0x28, 0x6a, 0x58, 0x4a, 0xe7, 0xa1, 0x9c, 0x56, 0xe7, 0xf1, 0x07, 0x65, 0x58, 0x46,
-	0x6e, 0x62, 0x17, 0xd6, 0x61, 0xc5, 0x9a, 0x3c, 0x8e, 0x03, 0xe2, 0x8a, 0xdd, 0x18, 0xeb, 0x17,
-	0xca, 0x05, 0xb2, 0x99, 0x37, 0x45, 0x41, 0x0c, 0x58, 0x15, 0x27, 0xc1, 0xae, 0x78, 0xc8, 0x12,
-	0xa7, 0xdb, 0x11, 0xef, 0x7b, 0xb8, 0x0f, 0xad, 0xac, 0xd0, 0x48, 0x13, 0x25, 0xe7, 0x41, 0xf9,
-	0x79, 0xce, 0x83, 0xca, 0xa9, 0xce, 0x83, 0x8f, 0x60, 0x59, 0x7c, 0x0d, 0x77, 0xf2, 0xb9, 0x2f,
-	0xb7, 0x93, 0xa7, 0x98, 0x91, 0x66, 0xbc, 0xa3, 0xcf, 0xcf, 0xdc, 0xd1, 0xd1, 0x76, 0x2e, 0x56,
-	0xd9, 0x18, 0x61, 0xf9, 0x8d, 0x5d, 0xfb, 0xf3, 0x32, 0xc0, 0x6e, 0xad, 0xfb, 0x33, 0x9c, 0x92,
-	0x6f, 0xc1, 0x62, 0xd3, 0x17, 0x66, 0x53, 0xc9, 0x5e, 0x35, 0x14, 0x40, 0x59, 0x5c, 0x88, 0x31,
-	0xe3, 0xd3, 0xad, 0xfc, 0x55, 0x9c, 0x6e, 0x77, 0x51, 0xaf, 0xf3, 0xb1, 0xdb, 0x8f, 0x92, 0xcc,
-	0xcf, 0xb8, 0x64, 0x44, 0x3c, 0xbb, 0xb4, 0xd9, 0x4c, 0x42, 0xa6, 0xbb, 0x13, 0xf7, 0xc8, 0x12,
-	0x41, 0x2a, 0x78, 0x2a, 0x56, 0xdc, 0x9d, 0x44, 0xa4, 0x0f, 0x11, 0xf7, 0x42, 0xde, 0x1e, 0x32,
-	0x64, 0x5f, 0xed, 0x80, 0x90, 0x0f, 0x63, 0x17, 0xda, 0x85, 0x59, 0x3d, 0xa4, 0xe5, 0x7a, 0x68,
-	0xaa, 0xe3, 0xac, 0xf6, 0x63, 0x45, 0xce, 0x75, 0xf6, 0x33, 0x0c, 0xf5, 0x3b, 0x00, 0xb1, 0xdf,
-	0x8a, 0x18, 0xeb, 0x38, 0x8e, 0x01, 0x83, 0xca, 0xbd, 0x9c, 0xe0, 0x4a, 0xad, 0x29, 0x7f, 0x55,
-	0xad, 0xe9, 0xc1, 0x52, 0xe7, 0x49, 0xe4, 0x24, 0x8e, 0x4e, 0x60, 0xc5, 0x92, 0x2c, 0xee, 0x4c,
-	0x65, 0x54, 0xcb, 0x9d, 0x93, 0xe4, 0xe0, 0x29, 0x22, 0xb0, 0x44, 0xa8, 0xfd, 0xb5, 0x02, 0x6b,
-	0x72, 0x88, 0xa2, 0x93, 0x51, 0x9f, 0xbc, 0xcf, 0x52, 0x2f, 0x28, 0xa9, 0x2b, 0x8b, 0x84, 0x44,
-	0xb7, 0xdc, 0x93, 0x51, 0x9f, 0x09, 0x40, 0xce, 0x53, 0xb9, 0xb2, 0x94, 0x90, 0x3c, 0x86, 0xe5,
-	0xae, 0x3f, 0x1c, 0x52, 0xb1, 0x26, 0xf8, 0x94, 0x5f, 0x00, 0x28, 0xa3, 0xac, 0xf5, 0x4c, 0x54,
-	0x68, 0xfb, 0x05, 0x7e, 0xcf, 0xbd, 0x30, 0xa6, 0xfb, 0xbd, 0xc7, 0xe9, 0x12, 0xb6, 0x9f, 0xe3,
-	0x4b, 0x55, 0x99, 0x67, 0x72, 0x36, 0xa5, 0x73, 0x76, 0xc9, 0xb5, 0xa4, 0xc5, 0x58, 0xcf, 0x19,
-	0x67, 0x93, 0xf6, 0xf7, 0x15, 0xb8, 0x91, 0x6f, 0x5a, 0x6d, 0xe8, 0x4f, 0x06, 0xbd, 0xc0, 0xf1,
-	0x86, 0x4d, 0xff, 0x30, 0x64, 0x21, 0xeb, 0x0f, 0x13, 0x0d, 0x35, 0x0f, 0x59, 0x7f, 0xe8, 0x65,
-	0x43, 0xd6, 0xe3, 0xd3, 0xf5, 0x37, 0xa1, 0x6a, 0x7d, 0x68, 0x7d, 0x38, 0x71, 0xc5, 0x5d, 0x98,
-	0xed, 0x0f, 0xe1, 0x27, 0xa1, 0xfd, 0x09, 0x05, 0xca, 0x27, 0x86, 0x40, 0xd4, 0xfe, 0x7d, 0x09,
-	0x48, 0xbe, 0x1e, 0xf2, 0x16, 0xac, 0xfc, 0x3f, 0x10, 0xc9, 0x33, 0xa2, 0x6c, 0xe5, 0xb9, 0x44,
-	0xd9, 0x4f, 0x40, 0xed, 0xd3, 0x7e, 0xb4, 0x23, 0xda, 0x91, 0xf6, 0xd0, 0x8f, 0x4f, 0x84, 0x5f,
-	0x98, 0x3a, 0xa7, 0xd2, 0x1d, 0xcf, 0xf6, 0xa4, 0x2c, 0x13, 0xf9, 0x70, 0xeb, 0xa7, 0xf0, 0xb5,
-	0xdf, 0x57, 0x60, 0xa3, 0x68, 0x0a, 0xd0, 0xc3, 0x53, 0x3e, 0x4d, 0xe3, 0xb3, 0x1c, 0x0f, 0x4f,
-	0xf9, 0x00, 0x4e, 0x9f, 0xe8, 0x19, 0xa2, 0x6c, 0x7f, 0x94, 0x9e, 0xa7, 0x3f, 0xb4, 0xff, 0x5a,
-	0x86, 0x65, 0x66, 0xd4, 0xdc, 0x73, 0x9d, 0x61, 0x74, 0x44, 0x07, 0x57, 0xe4, 0xa0, 0x94, 0x5c,
-	0x5f, 0x67, 0x24, 0x9f, 0xbc, 0x83, 0xe9, 0xfe, 0x23, 0xbf, 0xef, 0x0f, 0x65, 0xa5, 0xe0, 0x98,
-	0xc3, 0x32, 0xd9, 0xfe, 0x11, 0x46, 0xe7, 0x2e, 0x4f, 0x29, 0x50, 0x4e, 0xe6, 0x2e, 0x33, 0x74,
-	0xcb, 0x73, 0x97, 0x1b, 0x95, 0x3f, 0x83, 0xb3, 0x89, 0x9d, 0x3a, 0xb6, 0x6e, 0x9f, 0xe2, 0x55,
-	0xd1, 0x16, 0x7f, 0x55, 0x74, 0x2d, 0x31, 0x7d, 0xa3, 0xcd, 0x1e, 0x4b, 0x33, 0x79, 0x18, 0x8a,
-	0x3e, 0x41, 0xee, 0x83, 0x9a, 0x80, 0x79, 0x82, 0x08, 0x26, 0xf1, 0x62, 0xf0, 0x26, 0x89, 0x6d,
-	0x2e, 0x57, 0x44, 0x8e, 0x90, 0x1e, 0x72, 0x09, 0xcc, 0x48, 0x9e, 0x95, 0x09, 0xf3, 0x4f, 0xcc,
-	0x0b, 0x5f, 0x0f, 0xc9, 0x87, 0x5c, 0x86, 0x8c, 0x8e, 0x91, 0xc8, 0x6b, 0xb2, 0x90, 0x8c, 0x11,
-	0x7f, 0x8f, 0x2f, 0x8f, 0x11, 0xc7, 0xda, 0xfa, 0x9e, 0x02, 0x6b, 0x0d, 0xbd, 0xc5, 0x73, 0x18,
-	0xb2, 0x5e, 0xbd, 0x09, 0x57, 0x1b, 0x7a, 0xcb, 0xee, 0x76, 0x9a, 0x8d, 0xda, 0x23, 0xbb, 0x30,
-	0x35, 0xd1, 0x55, 0xb8, 0x98, 0x47, 0x49, 0x4c, 0xfa, 0x57, 0x60, 0x33, 0x5f, 0x2c, 0xd2, 0x17,
-	0x15, 0x13, 0x8b, 0x4c, 0x47, 0xe5, 0xad, 0x0f, 0x60, 0x4d, 0xa4, 0xea, 0xe9, 0x35, 0x2d, 0x4c,
-	0x06, 0xb8, 0x06, 0x4b, 0x0f, 0x0c, 0xb3, 0xb1, 0xf3, 0xc8, 0xde, 0xd9, 0x6f, 0x36, 0xd5, 0x33,
-	0x64, 0x05, 0x16, 0x39, 0xa0, 0xa6, 0xab, 0x0a, 0x59, 0x86, 0x6a, 0xa3, 0x6d, 0x19, 0xb5, 0x7d,
-	0xd3, 0x50, 0x4b, 0x5b, 0xff, 0x42, 0x81, 0x95, 0xfd, 0xf1, 0xc0, 0x89, 0xdc, 0x80, 0xb7, 0xe8,
-	0x1a, 0x5c, 0xda, 0xef, 0xd6, 0xf5, 0x9e, 0x61, 0x16, 0x37, 0xe7, 0x1c, 0xac, 0x67, 0xca, 0x3b,
-	0xf7, 0x55, 0x85, 0x5c, 0x86, 0x0b, 0x19, 0x70, 0xbd, 0x61, 0xe9, 0xdb, 0xac, 0x15, 0x17, 0xe1,
-	0x5c, 0xa6, 0xb0, 0xdb, 0x68, 0xb7, 0x8d, 0xba, 0x5a, 0xa6, 0x0d, 0xcc, 0x7d, 0xce, 0x34, 0xf4,
-	0x3a, 0x25, 0x55, 0x2b, 0x5b, 0x1f, 0xc0, 0x6a, 0x37, 0x7e, 0xa7, 0x80, 0x1e, 0x03, 0x0b, 0x50,
-	0x36, 0xf5, 0x87, 0xea, 0x19, 0x02, 0x30, 0xdf, 0xbd, 0x5f, 0xb3, 0x6e, 0xdf, 0x56, 0x15, 0xb2,
-	0x04, 0x0b, 0xbb, 0xb5, 0xae, 0x7d, 0xbf, 0x65, 0xa9, 0x25, 0xfa, 0x43, 0x7f, 0x68, 0xe1, 0x8f,
-	0xf2, 0xd6, 0x1b, 0x68, 0xe5, 0xfb, 0xec, 0xa4, 0xe9, 0x85, 0x91, 0x3b, 0x72, 0x03, 0xec, 0xa3,
-	0x65, 0xa8, 0x5a, 0x2e, 0x95, 0x57, 0x22, 0x97, 0x75, 0x50, 0x6b, 0x32, 0x8c, 0xbc, 0xf1, 0xd0,
-	0xfd, 0x4c, 0x55, 0xb6, 0xee, 0xc2, 0x9a, 0xe9, 0x4f, 0x22, 0x6f, 0x74, 0x68, 0x45, 0x14, 0xe3,
-	0xf0, 0x04, 0xdb, 0xdc, 0xd6, 0x5b, 0xdb, 0x8d, 0xdd, 0xfd, 0xce, 0xbe, 0x65, 0xb7, 0xf4, 0x5e,
-	0x6d, 0x8f, 0xf9, 0x2b, 0xb4, 0x3a, 0x56, 0xcf, 0x36, 0x8d, 0x9a, 0xd1, 0xee, 0xa9, 0xca, 0xd6,
-	0xef, 0xa2, 0x06, 0xb7, 0xef, 0x8f, 0x06, 0x3b, 0x4e, 0x3f, 0xf2, 0x03, 0xac, 0xb0, 0x06, 0xd7,
-	0x2c, 0xa3, 0xd6, 0x69, 0xd7, 0xed, 0x1d, 0xbd, 0xd6, 0xeb, 0x98, 0x45, 0xb9, 0xbb, 0x2e, 0xc1,
-	0xf9, 0x02, 0x9c, 0x4e, 0xaf, 0xab, 0x2a, 0xe4, 0x3a, 0x5c, 0x2e, 0x28, 0x7b, 0x68, 0x6c, 0xeb,
-	0xfb, 0xbd, 0xbd, 0xb6, 0x5a, 0x9a, 0x42, 0x6c, 0x59, 0x1d, 0xb5, 0xbc, 0xf5, 0xdb, 0x0a, 0xac,
-	0xee, 0x87, 0xfc, 0x79, 0xd4, 0x3e, 0x46, 0x95, 0xb8, 0x01, 0x57, 0xf6, 0x2d, 0xc3, 0xb4, 0x7b,
-	0x9d, 0xfb, 0x46, 0xdb, 0xde, 0xb7, 0xf4, 0xdd, 0x6c, 0x6d, 0xae, 0xc3, 0x65, 0x09, 0xc3, 0x34,
-	0x6a, 0x9d, 0x07, 0x86, 0x69, 0x77, 0x75, 0xcb, 0x7a, 0xd8, 0x31, 0xeb, 0xaa, 0x42, 0xbf, 0x58,
-	0x80, 0xd0, 0xda, 0xd1, 0x59, 0x6d, 0x52, 0x65, 0x6d, 0xe3, 0xa1, 0xde, 0xb4, 0xb7, 0x3b, 0x3d,
-	0xb5, 0xbc, 0xd5, 0xa2, 0xb7, 0x08, 0xcc, 0xa0, 0xc3, 0x5c, 0xdc, 0xab, 0x50, 0x69, 0x77, 0xda,
-	0x46, 0xd6, 0xcb, 0x65, 0x19, 0xaa, 0x7a, 0xb7, 0x6b, 0x76, 0x1e, 0xe0, 0xe4, 0x01, 0x98, 0xaf,
-	0x1b, 0xed, 0x06, 0xce, 0x96, 0x65, 0xa8, 0x76, 0xcd, 0x4e, 0xab, 0xd3, 0x33, 0xea, 0x6a, 0x65,
-	0xcb, 0x14, 0x07, 0xab, 0x60, 0xda, 0xf7, 0x99, 0x4b, 0x49, 0xdd, 0xd8, 0xd1, 0xf7, 0x9b, 0x3d,
-	0x3e, 0x44, 0x8f, 0x6c, 0xd3, 0xf8, 0x70, 0xdf, 0xb0, 0x7a, 0x96, 0xaa, 0x10, 0x15, 0x96, 0xdb,
-	0x86, 0x51, 0xb7, 0x6c, 0xd3, 0x78, 0xd0, 0x30, 0x1e, 0xaa, 0x25, 0xca, 0x93, 0xfd, 0x4f, 0xbf,
-	0xb0, 0xf5, 0x03, 0x05, 0x08, 0xcb, 0x3e, 0x24, 0x52, 0xda, 0xe2, 0x8c, 0xb9, 0x06, 0x97, 0xf6,
-	0xe8, 0x50, 0x63, 0xd3, 0x5a, 0x9d, 0x7a, 0xb6, 0xcb, 0xce, 0x03, 0xc9, 0x94, 0x77, 0x76, 0x76,
-	0x70, 0x59, 0x9c, 0xcd, 0xc0, 0xeb, 0x66, 0xa7, 0xab, 0x96, 0x2e, 0x95, 0xaa, 0x0a, 0xb9, 0x90,
-	0x2b, 0xbc, 0x6f, 0x18, 0x5d, 0xb5, 0x4c, 0x87, 0x28, 0x53, 0x20, 0x96, 0x2c, 0x23, 0xaf, 0x6c,
-	0x7d, 0x57, 0x81, 0xf3, 0xac, 0x9a, 0x62, 0xfd, 0xc7, 0x55, 0xbd, 0x02, 0x9b, 0x3c, 0xa7, 0x5a,
-	0x51, 0x45, 0x37, 0x40, 0x4d, 0x95, 0xb2, 0x6a, 0x9e, 0x83, 0xf5, 0x14, 0x14, 0xeb, 0x51, 0xa2,
-	0xbb, 0x5b, 0x0a, 0xbc, 0x6d, 0x58, 0x3d, 0xdb, 0xd8, 0xd9, 0xe9, 0x98, 0x3d, 0x56, 0x91, 0xf2,
-	0x96, 0x06, 0xeb, 0x35, 0x37, 0x88, 0x8c, 0xcf, 0x22, 0x77, 0x14, 0x7a, 0xfe, 0x08, 0xab, 0xb0,
-	0x02, 0x8b, 0xc6, 0x2f, 0xf7, 0x8c, 0xb6, 0xd5, 0xe8, 0xb4, 0xd5, 0x33, 0x5b, 0x57, 0x32, 0x38,
-	0x62, 0x1d, 0x5b, 0xd6, 0x9e, 0x7a, 0x66, 0xcb, 0x81, 0x15, 0xf1, 0x02, 0x88, 0xcd, 0x8a, 0x6b,
-	0x70, 0x49, 0xcc, 0x35, 0xdc, 0x13, 0xb2, 0x4d, 0xd8, 0x84, 0x8d, 0x7c, 0xb9, 0xd1, 0x53, 0x15,
-	0x3a, 0x0a, 0x99, 0x12, 0x0a, 0x2f, 0x6d, 0xfd, 0xa6, 0x02, 0x2b, 0xb1, 0xb1, 0x16, 0x8d, 0x41,
-	0xd7, 0xe1, 0x72, 0x6b, 0x47, 0xb7, 0xeb, 0xc6, 0x83, 0x46, 0xcd, 0xb0, 0xef, 0x37, 0xda, 0xf5,
-	0xcc, 0x47, 0x2e, 0xc2, 0xb9, 0x02, 0x04, 0xfc, 0xca, 0x26, 0x6c, 0x64, 0x8b, 0x7a, 0x74, 0xa9,
-	0x96, 0x68, 0xd7, 0x67, 0x4b, 0xe2, 0x75, 0x5a, 0xde, 0x7a, 0x00, 0xab, 0x96, 0xde, 0x6a, 0xee,
-	0xf8, 0x41, 0xdf, 0xd5, 0x27, 0xd1, 0xd1, 0x88, 0x6e, 0x9a, 0x3b, 0x1d, 0xb3, 0x66, 0xd8, 0x88,
-	0x92, 0xa9, 0xc1, 0x59, 0x58, 0x93, 0x0b, 0x1f, 0x19, 0x74, 0xfa, 0x12, 0x58, 0x95, 0x81, 0xed,
-	0x8e, 0x5a, 0xda, 0xfa, 0x15, 0x58, 0x4e, 0x65, 0xb6, 0xbf, 0x00, 0x67, 0xe5, 0xdf, 0x5d, 0x77,
-	0x34, 0xf0, 0x46, 0x87, 0xea, 0x99, 0x6c, 0x81, 0x39, 0x19, 0x8d, 0x68, 0x01, 0xae, 0x67, 0xb9,
-	0xa0, 0xe7, 0x06, 0xc7, 0xde, 0xc8, 0x89, 0xdc, 0x81, 0x5a, 0xda, 0x7a, 0x1d, 0x56, 0x52, 0xf9,
-	0xb4, 0xe8, 0xc0, 0x35, 0x3b, 0x7c, 0x03, 0x6e, 0x19, 0xf5, 0xc6, 0x7e, 0x4b, 0x9d, 0xa3, 0x2b,
-	0x79, 0xaf, 0xb1, 0xbb, 0xa7, 0xc2, 0xd6, 0xef, 0x29, 0xb0, 0xca, 0xb3, 0xe4, 0xb6, 0x76, 0x74,
-	0x31, 0xd4, 0x74, 0x9a, 0xb1, 0x2c, 0x7d, 0x86, 0x65, 0x31, 0xe7, 0xae, 0x2b, 0xb0, 0xc9, 0x7f,
-	0xd8, 0x7a, 0xbb, 0x6e, 0xef, 0xe9, 0x66, 0xfd, 0xa1, 0x6e, 0xd2, 0xb9, 0xf7, 0x48, 0x2d, 0xe1,
-	0x82, 0x92, 0x20, 0x76, 0xaf, 0xb3, 0x5f, 0xdb, 0x53, 0xcb, 0x74, 0xfe, 0xa6, 0xe0, 0xdd, 0x46,
-	0x5b, 0xad, 0xe0, 0xf2, 0xcc, 0x61, 0x23, 0x5b, 0x5a, 0x3e, 0xb7, 0xf5, 0x53, 0x05, 0x2e, 0x58,
-	0xde, 0xe1, 0xc8, 0x89, 0x26, 0x81, 0xab, 0x0f, 0x0f, 0xfd, 0xc0, 0x8b, 0x8e, 0x8e, 0xad, 0x89,
-	0x17, 0xb9, 0xe4, 0x15, 0x78, 0xc9, 0x6a, 0xec, 0xb6, 0xf5, 0x1e, 0x5d, 0x5e, 0x7a, 0x73, 0xb7,
-	0x63, 0x36, 0x7a, 0x7b, 0x2d, 0xdb, 0xda, 0x6f, 0xe4, 0x66, 0xde, 0x8b, 0x70, 0x63, 0x3a, 0x6a,
-	0xd3, 0xd8, 0xd5, 0x6b, 0x8f, 0x54, 0x65, 0x36, 0xc3, 0x6d, 0xbd, 0xa9, 0xb7, 0x6b, 0x46, 0xdd,
-	0x7e, 0x70, 0x5b, 0x2d, 0x91, 0x97, 0xe0, 0xe6, 0x74, 0xd4, 0x9d, 0x46, 0xd7, 0xa2, 0x68, 0xe5,
-	0xd9, 0xdf, 0xdd, 0xb3, 0x5a, 0x14, 0xab, 0xb2, 0xf5, 0xfb, 0x0a, 0x6c, 0x4e, 0x8b, 0x8a, 0x4b,
-	0x6e, 0x81, 0x66, 0xb4, 0x7b, 0xa6, 0xde, 0xa8, 0xdb, 0x35, 0xd3, 0xa8, 0x1b, 0xed, 0x5e, 0x43,
-	0x6f, 0x5a, 0xb6, 0xd5, 0xd9, 0xa7, 0xb3, 0x29, 0xf1, 0xc1, 0x7b, 0x01, 0xae, 0xcf, 0xc0, 0xeb,
-	0x34, 0xea, 0x35, 0x55, 0x21, 0xb7, 0xe1, 0xb5, 0x19, 0x48, 0xd6, 0x23, 0xab, 0x67, 0xb4, 0xe4,
-	0x12, 0xb5, 0x84, 0x1b, 0x56, 0x71, 0x40, 0x50, 0xda, 0x3a, 0x2c, 0x99, 0x5d, 0xb1, 0x9b, 0x70,
-	0x75, 0x2a, 0x16, 0xaf, 0xd6, 0x0b, 0x70, 0x7d, 0x2a, 0x0a, 0xab, 0x94, 0x5a, 0xda, 0xfa, 0x08,
-	0x2e, 0x4d, 0x0f, 0x5e, 0x47, 0xcf, 0x8b, 0xf4, 0x90, 0x57, 0xa1, 0x52, 0xa7, 0x47, 0x54, 0x2a,
-	0xab, 0x24, 0x9d, 0x9d, 0xa6, 0xd1, 0x68, 0x75, 0xe9, 0x46, 0xc8, 0x0f, 0x17, 0x3c, 0x3d, 0xbe,
-	0xa3, 0x80, 0x9a, 0x8d, 0xf8, 0x94, 0x73, 0xe7, 0x34, 0xf7, 0xdb, 0x6d, 0x76, 0xd0, 0xad, 0xc1,
-	0x52, 0xa7, 0xb7, 0x67, 0x98, 0x3c, 0x61, 0x27, 0x66, 0xe8, 0xdc, 0x6f, 0xd3, 0xa5, 0xdd, 0x31,
-	0x1b, 0xdf, 0xc2, 0x13, 0x6f, 0x13, 0x36, 0xac, 0xa6, 0x5e, 0xbb, 0x6f, 0xb7, 0x3b, 0x3d, 0xbb,
-	0xd1, 0xb6, 0x6b, 0x7b, 0x7a, 0xbb, 0x6d, 0x34, 0x55, 0xa0, 0x7b, 0x76, 0xe7, 0x7e, 0x4f, 0xb7,
-	0x6b, 0x9d, 0xf6, 0x4e, 0x63, 0x97, 0xb3, 0xd8, 0xc0, 0x59, 0x30, 0x2d, 0x80, 0x01, 0xf9, 0x1a,
-	0xbc, 0x8c, 0x34, 0xdd, 0xe6, 0xfe, 0x6e, 0xa3, 0x6d, 0x5b, 0x8f, 0xda, 0x35, 0x21, 0x76, 0xd5,
-	0xf2, 0x67, 0xc5, 0xcb, 0xf0, 0xe2, 0x4c, 0xec, 0x24, 0xe3, 0xe6, 0x2d, 0xd0, 0x66, 0x62, 0xf2,
-	0xf6, 0x6d, 0xfd, 0x89, 0x02, 0x97, 0x67, 0x38, 0xdd, 0x90, 0xd7, 0xe0, 0x95, 0x3d, 0x43, 0xaf,
-	0x37, 0x0d, 0xcb, 0xc2, 0x1d, 0x8e, 0x0e, 0x22, 0xf3, 0x06, 0x2d, 0x3c, 0x09, 0x5e, 0x81, 0x97,
-	0x66, 0xa3, 0x27, 0x32, 0xc5, 0xcb, 0xf0, 0xe2, 0x6c, 0x54, 0x2e, 0x63, 0x94, 0xc8, 0x16, 0xdc,
-	0x9a, 0x8d, 0x19, 0xcb, 0x26, 0xe5, 0xad, 0xdf, 0x51, 0xe0, 0x7c, 0xb1, 0x9e, 0x9b, 0xd6, 0xad,
-	0xd1, 0xb6, 0x7a, 0x7a, 0xb3, 0x69, 0x77, 0x75, 0x53, 0x6f, 0xd9, 0x46, 0xdb, 0xec, 0x34, 0x9b,
-	0x45, 0x67, 0xf2, 0x8b, 0x70, 0x63, 0x3a, 0xaa, 0x55, 0x33, 0x1b, 0x5d, 0x7a, 0xec, 0x68, 0x70,
-	0x6d, 0x3a, 0x96, 0xd1, 0xa8, 0x19, 0x6a, 0x69, 0xfb, 0xbd, 0x3f, 0xfe, 0xf3, 0x6b, 0x67, 0xfe,
-	0xf8, 0xa7, 0xd7, 0x94, 0xff, 0xf8, 0xd3, 0x6b, 0xca, 0x9f, 0xfd, 0xf4, 0x9a, 0xf2, 0xad, 0x57,
-	0x4f, 0x97, 0xac, 0x1a, 0x6f, 0xed, 0x8f, 0xe7, 0xf1, 0xfa, 0xf7, 0xe6, 0xff, 0x09, 0x00, 0x00,
-	0xff, 0xff, 0x7e, 0x4e, 0x71, 0x5d, 0xf5, 0xe0, 0x01, 0x00,
-}
+	// 35492 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xfd, 0x79, 0x90, 0x1c, 0x59,
+	0x7a, 0x18, 0x86, 0x6f, 0x55, 0xf5, 0x51, 0xfd, 0xf5, 0x55, 0xfd, 0x70, 0x35, 0x7a, 0x06, 0xd3,
+	0x98, 0x9c, 0x19, 0x0c, 0x30, 0x07, 0x30, 0x03, 0xec, 0x60, 0x77, 0x8e, 0xdd, 0xd9, 0xea, 0x03,
+	0x40, 0x03, 0x0d, 0xa0, 0x27, 0xab, 0x01, 0xcc, 0x72, 0x8f, 0xdc, 0xec, 0xaa, 0xd7, 0xdd, 0x39,
+	0x5d, 0x95, 0x59, 0x9b, 0x99, 0xd5, 0x40, 0x6b, 0xc9, 0x9f, 0xa4, 0x9f, 0xb8, 0x3a, 0x4c, 0xaf,
+	0x78, 0x88, 0x14, 0x57, 0x11, 0x22, 0x83, 0x21, 0x8b, 0x0e, 0x59, 0x0a, 0xfa, 0x20, 0x25, 0x1f,
+	0x21, 0x9b, 0x22, 0x6d, 0x51, 0x92, 0x15, 0x36, 0xc5, 0xb0, 0xec, 0xb0, 0xbd, 0xc1, 0x68, 0x86,
+	0x44, 0x86, 0x43, 0xc6, 0x1f, 0x0a, 0x4a, 0x76, 0x28, 0xc2, 0xcb, 0x50, 0xd8, 0xf1, 0xbe, 0xef,
+	0xbd, 0xcc, 0xf7, 0x32, 0xb3, 0xba, 0xab, 0x67, 0x30, 0x14, 0xb1, 0xc1, 0x7f, 0x80, 0xae, 0xef,
+	0x7d, 0xdf, 0xf7, 0x8e, 0x7c, 0xc7, 0xf7, 0xbe, 0xf7, 0x1d, 0xf0, 0x7c, 0xcc, 0xdb, 0xbc, 0x1b,
+	0x84, 0xf1, 0xa5, 0x36, 0xdf, 0x72, 0x9b, 0x7b, 0x97, 0xe2, 0xbd, 0x2e, 0x8f, 0xe8, 0xdf, 0x8b,
+	0xdd, 0x30, 0x88, 0x03, 0x36, 0x8c, 0x3f, 0xe6, 0x8e, 0x6f, 0x05, 0x5b, 0x01, 0x42, 0x2e, 0x89,
+	0xbf, 0xa8, 0x70, 0xee, 0xb9, 0xad, 0x20, 0xd8, 0x6a, 0xf3, 0x4b, 0xf8, 0x6b, 0xa3, 0xb7, 0x79,
+	0xa9, 0xd5, 0x0b, 0xdd, 0xd8, 0x0b, 0x7c, 0x59, 0x3e, 0x9f, 0x2d, 0x8f, 0xbd, 0x0e, 0x8f, 0x62,
+	0xb7, 0xd3, 0xed, 0xc7, 0xe0, 0x61, 0xe8, 0x76, 0xbb, 0x3c, 0x94, 0xb5, 0xcf, 0x5d, 0x48, 0x1a,
+	0xe8, 0xc6, 0xb1, 0xa0, 0x14, 0xcc, 0x2f, 0xed, 0xbe, 0xa9, 0xff, 0x94, 0xa8, 0x57, 0x13, 0xd4,
+	0x66, 0xd0, 0xe9, 0x06, 0x3e, 0xf7, 0xe3, 0x4d, 0xee, 0xc6, 0xbd, 0x90, 0x47, 0x82, 0x20, 0x01,
+	0x3a, 0x0a, 0x9a, 0xa3, 0x33, 0xc7, 0x20, 0xec, 0x45, 0x31, 0x6f, 0x39, 0x2d, 0xbe, 0xeb, 0x35,
+	0xb9, 0x13, 0xf2, 0x6f, 0xf6, 0xbc, 0x90, 0x77, 0xb8, 0x1f, 0x4b, 0xba, 0xd7, 0x8b, 0xe9, 0x54,
+	0x07, 0x32, 0x3d, 0xb1, 0x7e, 0xbe, 0x02, 0x63, 0xb7, 0x38, 0xef, 0xd6, 0xdb, 0xde, 0x2e, 0x67,
+	0x2f, 0xc0, 0xd0, 0x1d, 0xb7, 0xc3, 0x67, 0x4b, 0x67, 0x4b, 0xe7, 0xc7, 0x16, 0xa6, 0x1f, 0xef,
+	0xcf, 0x8f, 0x47, 0x3c, 0xdc, 0xe5, 0xa1, 0xe3, 0xbb, 0x1d, 0x6e, 0x63, 0x21, 0x7b, 0x15, 0xc6,
+	0xc4, 0xff, 0x51, 0xd7, 0x6d, 0xf2, 0xd9, 0x32, 0x62, 0x4e, 0x3e, 0xde, 0x9f, 0x1f, 0xf3, 0x15,
+	0xd0, 0x4e, 0xcb, 0xd9, 0x0a, 0x8c, 0x2e, 0x3f, 0xea, 0x7a, 0x21, 0x8f, 0x66, 0x87, 0xce, 0x96,
+	0xce, 0x8f, 0x5f, 0x9e, 0xbb, 0x48, 0x63, 0x7b, 0x51, 0x8d, 0xed, 0xc5, 0x75, 0x35, 0xf8, 0x0b,
+	0xc7, 0xfe, 0xd1, 0xfe, 0xfc, 0x67, 0x1e, 0xef, 0xcf, 0x8f, 0x72, 0x22, 0xf9, 0x89, 0xdf, 0x99,
+	0x2f, 0xd9, 0x8a, 0x9e, 0xbd, 0x07, 0x43, 0xeb, 0x7b, 0x5d, 0x3e, 0x3b, 0x76, 0xb6, 0x74, 0x7e,
+	0xea, 0xf2, 0x73, 0x17, 0x69, 0x3a, 0x24, 0x8d, 0x4f, 0xff, 0x12, 0x58, 0x0b, 0xd5, 0xc7, 0xfb,
+	0xf3, 0x43, 0x02, 0xc5, 0x46, 0x2a, 0xf6, 0x3a, 0x8c, 0xdc, 0x08, 0xa2, 0x78, 0x65, 0x69, 0x16,
+	0xb0, 0xc9, 0x27, 0x1e, 0xef, 0xcf, 0xcf, 0x6c, 0x07, 0x51, 0xec, 0x78, 0xad, 0xd7, 0x82, 0x8e,
+	0x17, 0xf3, 0x4e, 0x37, 0xde, 0xb3, 0x25, 0x92, 0xf5, 0x08, 0x26, 0x0d, 0x7e, 0x6c, 0x1c, 0x46,
+	0xef, 0xdd, 0xb9, 0x75, 0xe7, 0xee, 0x83, 0x3b, 0xb5, 0xcf, 0xb0, 0x2a, 0x0c, 0xdd, 0xb9, 0xbb,
+	0xb4, 0x5c, 0x2b, 0xb1, 0x51, 0xa8, 0xd4, 0xd7, 0xd6, 0x6a, 0x65, 0x36, 0x01, 0xd5, 0xa5, 0xfa,
+	0x7a, 0x7d, 0xa1, 0xde, 0x58, 0xae, 0x55, 0xd8, 0x31, 0x98, 0x7e, 0xb0, 0x72, 0x67, 0xe9, 0xee,
+	0x83, 0x86, 0xb3, 0xb4, 0xdc, 0xb8, 0xb5, 0x7e, 0x77, 0xad, 0x36, 0xc4, 0xa6, 0x00, 0x6e, 0xdd,
+	0x5b, 0x58, 0xb6, 0xef, 0x2c, 0xaf, 0x2f, 0x37, 0x6a, 0xc3, 0xec, 0x38, 0xd4, 0x14, 0x89, 0xd3,
+	0x58, 0xb6, 0xef, 0xaf, 0x2c, 0x2e, 0xd7, 0x46, 0x6e, 0x0e, 0x55, 0x2b, 0xb5, 0x21, 0x7b, 0x74,
+	0x95, 0xbb, 0x11, 0x5f, 0x59, 0xb2, 0xfe, 0x83, 0x0a, 0x54, 0x6f, 0xf3, 0xd8, 0x6d, 0xb9, 0xb1,
+	0xcb, 0x9e, 0x35, 0xbe, 0x0f, 0x76, 0x51, 0xfb, 0x30, 0x2f, 0xe4, 0x3f, 0xcc, 0xf0, 0xe3, 0xfd,
+	0xf9, 0xd2, 0xeb, 0xfa, 0x07, 0x79, 0x17, 0xc6, 0x97, 0x78, 0xd4, 0x0c, 0xbd, 0xae, 0x98, 0xa4,
+	0xb3, 0x15, 0x44, 0x3b, 0xfd, 0x78, 0x7f, 0xfe, 0x44, 0x2b, 0x05, 0x6b, 0x03, 0xa2, 0x63, 0xb3,
+	0x15, 0x18, 0x59, 0x75, 0x37, 0x78, 0x3b, 0x9a, 0x1d, 0x3e, 0x5b, 0x39, 0x3f, 0x7e, 0xf9, 0x19,
+	0xf9, 0x11, 0x54, 0x03, 0x2f, 0x52, 0xe9, 0xb2, 0x1f, 0x87, 0x7b, 0x0b, 0xc7, 0x1f, 0xef, 0xcf,
+	0xd7, 0xda, 0x08, 0xd0, 0x07, 0x98, 0x50, 0x58, 0x23, 0x9d, 0x18, 0x23, 0x87, 0x4e, 0x8c, 0x33,
+	0xff, 0x68, 0x7f, 0xbe, 0x24, 0x3e, 0x98, 0x9c, 0x18, 0x29, 0x3f, 0x73, 0x8a, 0x5c, 0x86, 0xaa,
+	0xcd, 0x77, 0xbd, 0x48, 0xf4, 0xac, 0x8a, 0x3d, 0x3b, 0xf9, 0x78, 0x7f, 0x9e, 0x85, 0x12, 0xa6,
+	0x35, 0x23, 0xc1, 0x9b, 0x7b, 0x1b, 0xc6, 0xb5, 0x56, 0xb3, 0x1a, 0x54, 0x76, 0xf8, 0x1e, 0x8d,
+	0xb0, 0x2d, 0xfe, 0x64, 0xc7, 0x61, 0x78, 0xd7, 0x6d, 0xf7, 0xe4, 0x90, 0xda, 0xf4, 0xe3, 0x9d,
+	0xf2, 0xe7, 0x4b, 0x37, 0x87, 0xaa, 0xa3, 0xb5, 0xaa, 0x5d, 0x5e, 0x59, 0xb2, 0x7e, 0x6a, 0x08,
+	0xaa, 0x76, 0x40, 0x0b, 0x9f, 0x5d, 0x80, 0xe1, 0x46, 0xec, 0xc6, 0xea, 0x33, 0x1d, 0x7b, 0xbc,
+	0x3f, 0x3f, 0x2d, 0x36, 0x05, 0xae, 0xd5, 0x4f, 0x18, 0x02, 0x75, 0x6d, 0xdb, 0x8d, 0xd4, 0xe7,
+	0x42, 0xd4, 0xae, 0x00, 0xe8, 0xa8, 0x88, 0xc1, 0xce, 0xc1, 0xd0, 0xed, 0xa0, 0xc5, 0xe5, 0x17,
+	0x63, 0x8f, 0xf7, 0xe7, 0xa7, 0x3a, 0x41, 0x4b, 0x47, 0xc4, 0x72, 0xf6, 0x1a, 0x8c, 0x2d, 0xf6,
+	0xc2, 0x90, 0xfb, 0x62, 0xae, 0x0f, 0x21, 0xf2, 0xd4, 0xe3, 0xfd, 0x79, 0x68, 0x12, 0xd0, 0xf1,
+	0x5a, 0x76, 0x8a, 0x20, 0x3e, 0x43, 0x23, 0x76, 0xc3, 0x98, 0xb7, 0x66, 0x87, 0x07, 0xfa, 0x0c,
+	0x62, 0x7d, 0xce, 0x44, 0x44, 0x92, 0xfd, 0x0c, 0x92, 0x13, 0xbb, 0x01, 0xe3, 0xd7, 0x43, 0xb7,
+	0xc9, 0xd7, 0x78, 0xe8, 0x05, 0x2d, 0xfc, 0xbe, 0x95, 0x85, 0x73, 0x8f, 0xf7, 0xe7, 0x4f, 0x6e,
+	0x09, 0xb0, 0xd3, 0x45, 0x78, 0x4a, 0xfd, 0xfd, 0xfd, 0xf9, 0xea, 0x92, 0xdc, 0xa2, 0x6d, 0x9d,
+	0x94, 0x7d, 0x43, 0x7c, 0x9c, 0x28, 0xc6, 0xa1, 0xe5, 0xad, 0xd9, 0xd1, 0x43, 0x9b, 0x68, 0xc9,
+	0x26, 0x9e, 0x6c, 0xbb, 0x51, 0xec, 0x84, 0x44, 0x97, 0x69, 0xa7, 0xce, 0x92, 0xdd, 0x85, 0x6a,
+	0xa3, 0xb9, 0xcd, 0x5b, 0xbd, 0x36, 0xc7, 0x29, 0x33, 0x7e, 0xf9, 0x94, 0x9c, 0xd4, 0xea, 0x7b,
+	0xaa, 0xe2, 0x85, 0x39, 0xc9, 0x9b, 0x45, 0x12, 0xa2, 0xcf, 0x27, 0x85, 0xf5, 0x4e, 0xf5, 0xbb,
+	0xbf, 0x30, 0xff, 0x99, 0x3f, 0xf5, 0xdb, 0x67, 0x3f, 0x63, 0xfd, 0x17, 0x65, 0xa8, 0x65, 0x99,
+	0xb0, 0x4d, 0x98, 0xbc, 0xd7, 0x6d, 0xb9, 0x31, 0x5f, 0x6c, 0x7b, 0xdc, 0x8f, 0x23, 0x9c, 0x24,
+	0x07, 0xf7, 0xe9, 0x45, 0x59, 0xef, 0x6c, 0x0f, 0x09, 0x9d, 0x26, 0x51, 0x66, 0x7a, 0x65, 0xb2,
+	0x4d, 0xeb, 0x69, 0xe0, 0x06, 0x1e, 0xe1, 0x0c, 0x3b, 0x5a, 0x3d, 0xb4, 0xf5, 0xf7, 0xa9, 0x47,
+	0xb2, 0x95, 0x13, 0xc8, 0x6f, 0x6d, 0xec, 0xe1, 0xcc, 0x1c, 0x7c, 0x02, 0x09, 0x92, 0x82, 0x09,
+	0x24, 0xc0, 0xd6, 0xef, 0x95, 0x60, 0xca, 0xe6, 0x51, 0xd0, 0x0b, 0x9b, 0xfc, 0x06, 0x77, 0x5b,
+	0x3c, 0x14, 0xd3, 0xff, 0x96, 0xe7, 0xb7, 0xe4, 0x9a, 0xc2, 0xe9, 0xbf, 0xe3, 0xf9, 0xfa, 0xd6,
+	0x8d, 0xe5, 0xec, 0x0d, 0x18, 0x6d, 0xf4, 0x36, 0x10, 0xb5, 0x9c, 0xee, 0x00, 0x51, 0x6f, 0xc3,
+	0xc9, 0xa0, 0x2b, 0x34, 0x76, 0x09, 0x46, 0xef, 0xf3, 0x30, 0x4a, 0x77, 0x43, 0x3c, 0x1a, 0x76,
+	0x09, 0xa4, 0x13, 0x48, 0x2c, 0x76, 0x3d, 0xdd, 0x91, 0xe5, 0xa1, 0x36, 0x9d, 0xd9, 0x07, 0xd3,
+	0xa9, 0xd2, 0x91, 0x10, 0x7d, 0xaa, 0x28, 0x2c, 0xeb, 0x5f, 0x96, 0xa1, 0xb6, 0xe4, 0xc6, 0xee,
+	0x86, 0x1b, 0xc9, 0xf1, 0xbc, 0x7f, 0x45, 0xec, 0xf1, 0x5a, 0x47, 0x71, 0x8f, 0x17, 0x2d, 0xff,
+	0xd8, 0xdd, 0x7b, 0x29, 0xdb, 0xbd, 0x71, 0x71, 0xc2, 0xca, 0xee, 0xa5, 0x9d, 0xfa, 0xc2, 0xe1,
+	0x9d, 0xaa, 0xc9, 0x4e, 0x55, 0x55, 0xa7, 0xd2, 0xae, 0xb0, 0x2f, 0xc0, 0x50, 0xa3, 0xcb, 0x9b,
+	0x72, 0x13, 0x51, 0xe7, 0x82, 0xd9, 0x39, 0x81, 0x70, 0xff, 0xca, 0xc2, 0x84, 0x64, 0x33, 0x14,
+	0x75, 0x79, 0xd3, 0x46, 0x32, 0xb6, 0x0c, 0x23, 0x62, 0x43, 0xec, 0xa9, 0xc3, 0xe0, 0x4c, 0x31,
+	0x03, 0x44, 0xb9, 0x7f, 0x65, 0x61, 0x4a, 0xb2, 0x18, 0x89, 0x10, 0x62, 0x4b, 0x62, 0xb1, 0x55,
+	0x47, 0xcd, 0xa0, 0xcb, 0x71, 0xa3, 0x18, 0xb3, 0xe9, 0x87, 0xb6, 0x22, 0xff, 0x4d, 0x05, 0x8e,
+	0x17, 0xb5, 0x49, 0x1f, 0xa4, 0x91, 0x03, 0x06, 0xe9, 0x3c, 0x54, 0x85, 0x7c, 0x20, 0xce, 0x5c,
+	0xaa, 0x62, 0x61, 0x42, 0x8c, 0xc7, 0xb6, 0x84, 0xd9, 0x49, 0x29, 0x7b, 0x21, 0x11, 0x37, 0xaa,
+	0x29, 0x3f, 0x29, 0x6e, 0x28, 0x21, 0x43, 0x4c, 0x24, 0xb5, 0x3f, 0xa0, 0x54, 0x92, 0x8e, 0xb9,
+	0x02, 0xa7, 0x13, 0x29, 0x94, 0x10, 0xe3, 0x0c, 0x53, 0x27, 0xce, 0x32, 0x54, 0x55, 0xb7, 0x66,
+	0x27, 0x90, 0xd1, 0x4c, 0x66, 0x00, 0xef, 0x5f, 0xa1, 0x99, 0xd2, 0x92, 0xbf, 0x75, 0x36, 0x0a,
+	0x87, 0x5d, 0x81, 0xea, 0x5a, 0x18, 0x3c, 0xda, 0x5b, 0x59, 0x8a, 0x66, 0x27, 0xcf, 0x56, 0xce,
+	0x8f, 0x2d, 0x9c, 0x7a, 0xbc, 0x3f, 0x7f, 0xac, 0x2b, 0x60, 0x8e, 0xd7, 0xd2, 0x8f, 0xf1, 0x04,
+	0x91, 0xcd, 0xc3, 0x78, 0xc8, 0xdb, 0xee, 0x9e, 0xb3, 0x15, 0x06, 0xbd, 0xee, 0xec, 0x14, 0x8e,
+	0x3c, 0x20, 0xe8, 0xba, 0x80, 0xb0, 0x67, 0x60, 0x8c, 0x10, 0xbc, 0x56, 0x34, 0x3b, 0x2d, 0xd8,
+	0xda, 0x55, 0x04, 0xac, 0xb4, 0xa2, 0x9b, 0x43, 0xd5, 0x52, 0xad, 0x7c, 0x73, 0xa8, 0x5a, 0xae,
+	0x55, 0x48, 0xf2, 0xb9, 0x39, 0x54, 0x1d, 0xaa, 0x0d, 0xdf, 0x1c, 0xaa, 0x0e, 0xa3, 0x2c, 0x34,
+	0x56, 0x83, 0x9b, 0x43, 0xd5, 0xf1, 0xda, 0x84, 0x21, 0x88, 0x60, 0xf5, 0x71, 0xd0, 0x0c, 0xda,
+	0x76, 0xe5, 0x9e, 0xbd, 0x62, 0x8f, 0x2c, 0xd6, 0x17, 0x79, 0x18, 0xdb, 0x95, 0xfa, 0x83, 0x86,
+	0x3d, 0xb9, 0xb4, 0xe7, 0xbb, 0x1d, 0xaf, 0x49, 0xa7, 0xba, 0x5d, 0xb9, 0xbe, 0xb8, 0x66, 0xf9,
+	0x70, 0xb2, 0x78, 0x2a, 0xb1, 0x75, 0x98, 0x58, 0x77, 0xc3, 0x2d, 0x1e, 0xdf, 0xe0, 0x6e, 0x3b,
+	0xde, 0xc6, 0xf6, 0x8f, 0x5f, 0x3e, 0x26, 0x87, 0x4f, 0x2f, 0x5a, 0x78, 0xe6, 0xf1, 0xfe, 0xfc,
+	0xa9, 0x18, 0x21, 0xce, 0x36, 0x82, 0xb4, 0x01, 0x31, 0xb8, 0x58, 0x75, 0x98, 0x4a, 0x47, 0x7e,
+	0xd5, 0x8b, 0x62, 0x76, 0x09, 0xc6, 0x14, 0x44, 0xec, 0xf9, 0x95, 0xc2, 0x6f, 0x64, 0xa7, 0x38,
+	0xd6, 0x3f, 0x28, 0x03, 0xa4, 0x25, 0x4f, 0xe9, 0xb6, 0xf0, 0x39, 0x63, 0x5b, 0x38, 0x91, 0x5d,
+	0xd5, 0xfd, 0x37, 0x84, 0xf7, 0x33, 0x1b, 0xc2, 0xa9, 0x2c, 0xe9, 0x21, 0x5b, 0x81, 0xb6, 0xe8,
+	0x7f, 0x7e, 0x34, 0xfd, 0x18, 0x72, 0xb9, 0x9f, 0x87, 0x64, 0x02, 0xc9, 0x01, 0xc5, 0x75, 0xdc,
+	0x55, 0x93, 0x2a, 0x29, 0x65, 0xa7, 0x41, 0x4c, 0x30, 0x39, 0xa8, 0xa3, 0x8f, 0xf7, 0xe7, 0x2b,
+	0xbd, 0xd0, 0xc3, 0x49, 0xc7, 0x2e, 0x81, 0x9c, 0x76, 0x72, 0x00, 0xc5, 0x5a, 0x99, 0x69, 0xba,
+	0x4e, 0x93, 0x87, 0x71, 0x3a, 0xe2, 0xb3, 0x25, 0x35, 0x3b, 0x59, 0x17, 0xcc, 0xa9, 0x39, 0x3b,
+	0x84, 0xd3, 0xe0, 0x7c, 0xe1, 0xa8, 0x5c, 0x34, 0x50, 0x49, 0xa2, 0x3e, 0xab, 0x0e, 0xe8, 0x16,
+	0x95, 0x39, 0x39, 0xe9, 0xda, 0xac, 0x80, 0x5d, 0x01, 0xb1, 0x22, 0xe4, 0xe8, 0x83, 0xac, 0xa7,
+	0xfe, 0xa0, 0xb1, 0x70, 0x42, 0x72, 0x9a, 0x74, 0x1f, 0xea, 0xe4, 0x02, 0x9b, 0xbd, 0x0b, 0x62,
+	0xc9, 0xc8, 0x71, 0x67, 0x92, 0xe8, 0xfa, 0xe2, 0xda, 0x62, 0x3b, 0xe8, 0xb5, 0x1a, 0x1f, 0xac,
+	0xa6, 0xc4, 0x5b, 0xcd, 0xae, 0x4e, 0x7c, 0x7d, 0x71, 0x8d, 0xbd, 0x0b, 0xc3, 0xf5, 0x3f, 0xd1,
+	0x0b, 0xb9, 0x14, 0xd5, 0x26, 0x54, 0x9d, 0x02, 0xb6, 0x70, 0x4a, 0x12, 0x4e, 0xbb, 0xe2, 0xa7,
+	0x2e, 0xe2, 0x62, 0xb9, 0xa8, 0x79, 0x7d, 0xb5, 0x21, 0xc5, 0x30, 0x96, 0x19, 0x96, 0xf5, 0x55,
+	0xad, 0xd9, 0xb1, 0xd1, 0x6b, 0x41, 0xc5, 0x2e, 0x41, 0xb9, 0xbe, 0x84, 0x97, 0xc3, 0xf1, 0xcb,
+	0x63, 0xaa, 0xda, 0xa5, 0x85, 0xe3, 0x92, 0x64, 0xc2, 0xd5, 0x97, 0x41, 0xb9, 0xbe, 0xc4, 0x16,
+	0x60, 0xf8, 0xf6, 0x5e, 0xe3, 0x83, 0x55, 0xb9, 0xf5, 0xaa, 0x25, 0x8f, 0xb0, 0xbb, 0xb8, 0xcd,
+	0x44, 0x69, 0x8b, 0x3b, 0x7b, 0xd1, 0x37, 0xdb, 0x7a, 0x8b, 0x11, 0x8d, 0xad, 0xc1, 0x58, 0xbd,
+	0xd5, 0xf1, 0xfc, 0x7b, 0x11, 0x0f, 0x67, 0xc7, 0x91, 0xcf, 0x6c, 0xa6, 0xdd, 0x49, 0xf9, 0xc2,
+	0xec, 0xe3, 0xfd, 0xf9, 0xe3, 0xae, 0xf8, 0xe9, 0xf4, 0x22, 0x1e, 0x6a, 0xdc, 0x52, 0x26, 0x6c,
+	0x0d, 0xe0, 0x76, 0xe0, 0x6f, 0x05, 0xf5, 0xb8, 0xed, 0x46, 0x99, 0xcd, 0x3c, 0x2d, 0x48, 0x24,
+	0xa9, 0x13, 0x1d, 0x01, 0x73, 0x5c, 0x01, 0xd4, 0x18, 0x6a, 0x3c, 0xd8, 0x35, 0x18, 0xb9, 0x1b,
+	0xba, 0xcd, 0x36, 0x9f, 0x9d, 0x44, 0x6e, 0xc7, 0x25, 0x37, 0x02, 0xaa, 0x9e, 0xce, 0x4a, 0x86,
+	0xb5, 0x00, 0xc1, 0xfa, 0x8d, 0x8d, 0x10, 0xe7, 0x1e, 0x00, 0xcb, 0xcf, 0xc9, 0x82, 0xfb, 0xd2,
+	0xab, 0xfa, 0x7d, 0x29, 0x5d, 0xf4, 0x8b, 0x41, 0xa7, 0xe3, 0xfa, 0x2d, 0xa4, 0xbd, 0x7f, 0x59,
+	0xbb, 0x46, 0x59, 0xdf, 0x84, 0x99, 0xdc, 0x60, 0x1d, 0x72, 0xd5, 0xfd, 0x22, 0x4c, 0x2f, 0xf1,
+	0x4d, 0xb7, 0xd7, 0x8e, 0x93, 0x73, 0x8f, 0x96, 0x28, 0x5e, 0x3a, 0x5b, 0x54, 0xe4, 0xa8, 0xc3,
+	0xce, 0xce, 0x22, 0x5b, 0xff, 0xa4, 0x04, 0x93, 0x46, 0xff, 0xd9, 0x55, 0x18, 0xab, 0xf7, 0x5a,
+	0x5e, 0x8c, 0x5f, 0x92, 0x2a, 0xa5, 0xef, 0x25, 0x80, 0xf9, 0xef, 0xa5, 0x50, 0xd9, 0xdb, 0x00,
+	0x36, 0x8f, 0xc3, 0xbd, 0xc5, 0xa0, 0xe7, 0xc7, 0xd8, 0x88, 0x61, 0xba, 0x4e, 0x87, 0x02, 0xea,
+	0x34, 0x05, 0x58, 0xff, 0x30, 0x29, 0x32, 0xbb, 0x05, 0xb5, 0xc6, 0x76, 0x6f, 0x73, 0xb3, 0xcd,
+	0x95, 0xd8, 0x10, 0xe1, 0x56, 0x52, 0x5d, 0x98, 0x7f, 0xbc, 0x3f, 0xff, 0x4c, 0x44, 0x65, 0x8e,
+	0x92, 0x2e, 0xf4, 0xef, 0x9b, 0x23, 0xb4, 0xfe, 0xba, 0x2e, 0x4b, 0xaa, 0xc3, 0xed, 0xf5, 0x64,
+	0x8b, 0x2a, 0xa5, 0x92, 0x6d, 0x6e, 0x8b, 0x4a, 0x36, 0xa8, 0x0b, 0xb4, 0x5d, 0x94, 0x73, 0xdb,
+	0xc5, 0xb8, 0x9c, 0x1c, 0x15, 0xf7, 0x61, 0x44, 0x9b, 0x44, 0xb2, 0x78, 0x2a, 0x1f, 0x7f, 0xf1,
+	0xbc, 0x0f, 0x13, 0xb7, 0x5d, 0xdf, 0xdd, 0xe2, 0x2d, 0x31, 0x92, 0xb4, 0x1d, 0x8e, 0xd1, 0x29,
+	0xdb, 0x21, 0x38, 0x8e, 0xbb, 0xde, 0x6f, 0x83, 0x80, 0xbd, 0xa9, 0x36, 0x9b, 0xe1, 0x82, 0xcd,
+	0x66, 0x52, 0xd6, 0x3e, 0x8c, 0x9b, 0x8d, 0xdc, 0x62, 0xac, 0x5f, 0x05, 0xec, 0x23, 0x7b, 0x0d,
+	0x46, 0x6c, 0xbe, 0x25, 0x4e, 0xbf, 0x52, 0x3a, 0x6f, 0x42, 0x84, 0xe8, 0x03, 0x43, 0x38, 0x28,
+	0xa8, 0xf1, 0x56, 0xb4, 0xed, 0x6d, 0xc6, 0x72, 0x74, 0x12, 0x41, 0x4d, 0x82, 0x35, 0x41, 0x4d,
+	0x42, 0x4c, 0x65, 0x03, 0xc1, 0xc4, 0x86, 0x6c, 0x2f, 0x35, 0xe4, 0xa0, 0xa9, 0x11, 0xb6, 0x97,
+	0xb4, 0x9d, 0x2d, 0x34, 0xc4, 0x2c, 0x81, 0x8d, 0x53, 0xb3, 0x89, 0x13, 0x29, 0xb9, 0xd1, 0xd3,
+	0xd4, 0x24, 0xa0, 0xa9, 0xc0, 0x4a, 0x51, 0x59, 0x03, 0xc6, 0x97, 0xc5, 0x35, 0xd8, 0x5b, 0x74,
+	0x9b, 0xdb, 0x6a, 0x90, 0xd4, 0xb6, 0xaa, 0x95, 0xa4, 0x9b, 0x09, 0x47, 0x60, 0x53, 0x00, 0x75,
+	0x15, 0x90, 0x86, 0xcb, 0xd6, 0x61, 0xbc, 0xc1, 0x9b, 0x21, 0x8f, 0x1b, 0x71, 0x10, 0xf2, 0xcc,
+	0x29, 0xa1, 0x95, 0x2c, 0x3c, 0xa7, 0x6e, 0xe2, 0x11, 0x02, 0x9d, 0x48, 0x40, 0x75, 0xae, 0x1a,
+	0x32, 0x5d, 0xa9, 0x3a, 0x41, 0xb8, 0xb7, 0xb4, 0x20, 0x4f, 0x8e, 0x54, 0xcc, 0x20, 0xb0, 0x7e,
+	0xa5, 0x12, 0x90, 0xd6, 0x86, 0x79, 0xa5, 0x22, 0x2c, 0xfc, 0x52, 0x4b, 0x0d, 0x14, 0x4e, 0xe5,
+	0x39, 0x32, 0x9d, 0x8e, 0x32, 0x82, 0xb5, 0x2f, 0xd5, 0x8a, 0x50, 0xb4, 0x35, 0xbe, 0x94, 0xc4,
+	0x62, 0x5d, 0x60, 0xea, 0xab, 0x91, 0xc4, 0xd8, 0xe6, 0x51, 0x24, 0x8f, 0x97, 0xd3, 0x99, 0x8f,
+	0x9f, 0x22, 0x2c, 0xbc, 0x24, 0x99, 0x9f, 0x51, 0xd3, 0x40, 0xde, 0xa2, 0x45, 0xa1, 0x56, 0x4f,
+	0x01, 0x6f, 0xb1, 0x93, 0x2c, 0x3f, 0x8a, 0x79, 0xe8, 0xbb, 0xed, 0x44, 0x4b, 0x89, 0x3b, 0x09,
+	0x97, 0x50, 0xf3, 0x43, 0x6b, 0xc8, 0x6c, 0x11, 0x26, 0xeb, 0x51, 0xd4, 0xeb, 0x70, 0x3b, 0x68,
+	0xf3, 0xba, 0x7d, 0x07, 0x8f, 0xa2, 0xb1, 0x85, 0x33, 0x8f, 0xf7, 0xe7, 0x4f, 0xbb, 0x58, 0xe0,
+	0x84, 0x41, 0x9b, 0x3b, 0x6e, 0xa8, 0xcf, 0x6e, 0x93, 0x86, 0xdd, 0x05, 0xb8, 0xdb, 0xe5, 0x7e,
+	0x83, 0xbb, 0x61, 0x73, 0x3b, 0x73, 0xf2, 0xa4, 0x05, 0x0b, 0xcf, 0xca, 0x1e, 0x1e, 0x0f, 0xba,
+	0xdc, 0x8f, 0x10, 0xa6, 0xb7, 0x2a, 0xc5, 0x64, 0x0f, 0x60, 0x7a, 0xa5, 0x7e, 0x7b, 0x2d, 0x68,
+	0x7b, 0xcd, 0x3d, 0x29, 0xcc, 0x4d, 0xa1, 0xee, 0xf6, 0xa4, 0xe4, 0x9a, 0x29, 0xa5, 0xed, 0xc9,
+	0x73, 0x3b, 0x4e, 0x17, 0xa1, 0x8e, 0x14, 0xe9, 0xb2, 0x5c, 0xd8, 0x97, 0xc5, 0x1c, 0x8c, 0x84,
+	0x7c, 0xba, 0xee, 0x6e, 0xd1, 0x9d, 0x22, 0xbd, 0x73, 0xd6, 0x1f, 0x34, 0x2e, 0x6a, 0xa5, 0x24,
+	0x39, 0xcd, 0xd1, 0x44, 0x44, 0xa8, 0x13, 0xbb, 0x5b, 0x91, 0x39, 0x11, 0x13, 0x6c, 0x76, 0x13,
+	0x60, 0x29, 0x68, 0xf6, 0x3a, 0xdc, 0x8f, 0x97, 0x16, 0x66, 0x6b, 0xe6, 0x5d, 0x2a, 0x29, 0x48,
+	0xb7, 0xb6, 0x56, 0xd0, 0x34, 0x66, 0xa2, 0x46, 0xcd, 0x7e, 0x18, 0x4e, 0x68, 0x2b, 0x47, 0x9b,
+	0x45, 0x33, 0xc8, 0xf6, 0xd9, 0xfc, 0x4a, 0xd4, 0x26, 0xd2, 0x79, 0x59, 0xc3, 0x59, 0x6d, 0x4d,
+	0x16, 0xcf, 0xa5, 0xe2, 0x4a, 0xe6, 0xbe, 0x08, 0xb5, 0xec, 0x30, 0x1c, 0x51, 0xb9, 0x39, 0x59,
+	0x9b, 0xd2, 0xc6, 0x7e, 0xf9, 0x91, 0x17, 0xc5, 0x91, 0xf5, 0x2d, 0x63, 0xfd, 0x8b, 0xbd, 0xe9,
+	0x16, 0xdf, 0x5b, 0x0b, 0xf9, 0xa6, 0xf7, 0x48, 0x3f, 0x36, 0x77, 0xf8, 0x9e, 0xd3, 0x45, 0xa8,
+	0xbe, 0x37, 0x25, 0xa8, 0xec, 0xb3, 0x50, 0xbd, 0x75, 0xbb, 0x71, 0x8b, 0xef, 0xad, 0x2c, 0xc9,
+	0x93, 0x9b, 0xc8, 0x3a, 0x91, 0x23, 0x48, 0x8d, 0x99, 0x9e, 0x60, 0x5a, 0x0b, 0xe9, 0x3e, 0x2c,
+	0x6a, 0x5e, 0x6c, 0xf7, 0xa2, 0x98, 0x87, 0x2b, 0x4b, 0x7a, 0xcd, 0x4d, 0x02, 0x66, 0x76, 0xc5,
+	0x04, 0xd5, 0xfa, 0x7f, 0xcb, 0xb8, 0x07, 0x8b, 0xe5, 0xb6, 0xe2, 0x47, 0xb1, 0xeb, 0x37, 0x79,
+	0xc2, 0x00, 0x97, 0x9b, 0x27, 0xa1, 0x99, 0xe5, 0x96, 0x22, 0x9b, 0x55, 0x97, 0x07, 0xae, 0x9a,
+	0x64, 0x05, 0xd2, 0x6a, 0xad, 0x2c, 0xe9, 0xaa, 0xf7, 0x50, 0x42, 0x33, 0x55, 0xa6, 0xc8, 0xec,
+	0x1c, 0x8c, 0xae, 0xd4, 0x6f, 0xd7, 0x7b, 0xf1, 0x36, 0x9e, 0x00, 0x55, 0xba, 0xb0, 0x88, 0xb5,
+	0xe2, 0xf6, 0xe2, 0x6d, 0x5b, 0x15, 0xb2, 0x4b, 0x78, 0x11, 0xf4, 0x79, 0x4c, 0x2a, 0x7a, 0x79,
+	0xe4, 0x47, 0x04, 0xca, 0xdc, 0x03, 0x05, 0x88, 0xbd, 0x02, 0xc3, 0xf7, 0xd7, 0x16, 0x57, 0x96,
+	0xa4, 0xde, 0x03, 0xcf, 0xc1, 0xdd, 0x6e, 0xd3, 0x6c, 0x09, 0xa1, 0xb0, 0x65, 0x98, 0x6a, 0xf0,
+	0x66, 0x2f, 0xf4, 0x62, 0xba, 0xda, 0x47, 0xb3, 0xa3, 0x58, 0x07, 0xee, 0x33, 0x91, 0x2c, 0x21,
+	0x3d, 0x80, 0x5e, 0x57, 0x86, 0xc8, 0xfa, 0xf5, 0x52, 0xba, 0x49, 0xb3, 0x73, 0x86, 0x9c, 0x87,
+	0x7a, 0x3d, 0x21, 0xd0, 0xe8, 0x7a, 0x3d, 0x94, 0xf8, 0x6c, 0x60, 0x8b, 0xbd, 0x28, 0x0e, 0x3a,
+	0xcb, 0x7e, 0xab, 0x1b, 0x78, 0x7e, 0x8c, 0x54, 0x34, 0xf8, 0xd6, 0xe3, 0xfd, 0xf9, 0xe7, 0x9a,
+	0x58, 0xea, 0x70, 0x59, 0xec, 0x64, 0xb8, 0x14, 0x50, 0x7f, 0x82, 0xef, 0x61, 0xfd, 0xe3, 0xb2,
+	0x71, 0xb8, 0x8a, 0xe6, 0xd9, 0xbc, 0xdb, 0xf6, 0x9a, 0xa8, 0x90, 0xc1, 0x8e, 0x26, 0xb3, 0x0a,
+	0x9b, 0x17, 0xa6, 0xa5, 0x34, 0x42, 0x26, 0xef, 0x02, 0x6a, 0xf6, 0x25, 0x98, 0x10, 0x72, 0x8e,
+	0xfc, 0x19, 0xcd, 0x96, 0x71, 0xb0, 0x9f, 0x45, 0x0d, 0x6d, 0xc4, 0xc3, 0x84, 0x8d, 0x21, 0x20,
+	0xe9, 0x14, 0xac, 0x05, 0xb3, 0xeb, 0xa1, 0xeb, 0x47, 0x5e, 0xbc, 0xec, 0x37, 0xc3, 0x3d, 0x94,
+	0xcb, 0x96, 0x7d, 0x77, 0xa3, 0xcd, 0x5b, 0x52, 0xd2, 0x3c, 0xff, 0x78, 0x7f, 0xfe, 0xc5, 0x98,
+	0x70, 0x1c, 0x9e, 0x20, 0x39, 0x9c, 0xb0, 0x34, 0xce, 0x7d, 0x39, 0x09, 0x39, 0x4e, 0x0d, 0x2b,
+	0x3e, 0xd0, 0x91, 0x88, 0x82, 0x72, 0x5c, 0xf2, 0x35, 0xc4, 0x56, 0xa7, 0x37, 0x53, 0x27, 0xb0,
+	0xee, 0xf6, 0xd9, 0x28, 0x71, 0xa1, 0x09, 0x90, 0x36, 0x43, 0x68, 0xa1, 0xe1, 0x6e, 0x98, 0xf9,
+	0xc2, 0x29, 0xaa, 0xf5, 0x6f, 0x4a, 0xa9, 0x3c, 0xc1, 0xde, 0x83, 0x71, 0xb9, 0x04, 0x35, 0x36,
+	0x78, 0x20, 0xa8, 0xf5, 0x9a, 0x61, 0xa4, 0xa3, 0xb3, 0x37, 0x60, 0xb4, 0xbe, 0xb8, 0xaa, 0x4d,
+	0x36, 0xd4, 0xac, 0xb8, 0xcd, 0x76, 0x96, 0x4a, 0xa1, 0x89, 0x59, 0xb5, 0xbe, 0xda, 0x30, 0x87,
+	0x19, 0x67, 0x55, 0xdc, 0x8e, 0x0a, 0xc6, 0x55, 0x43, 0xfe, 0xe4, 0x23, 0xf9, 0xbf, 0x96, 0x8a,
+	0xc4, 0x16, 0xb6, 0x00, 0x93, 0x0f, 0x82, 0x70, 0x07, 0x27, 0x8c, 0x36, 0x08, 0x38, 0x95, 0x1e,
+	0xaa, 0x82, 0x6c, 0x87, 0x4c, 0x12, 0xbd, 0x6d, 0xda, 0x68, 0x98, 0x6d, 0xcb, 0x70, 0x30, 0x08,
+	0xc4, 0x77, 0x48, 0x38, 0x26, 0xcb, 0x0d, 0xbf, 0x43, 0xda, 0x04, 0x63, 0x4d, 0xe8, 0xe8, 0xd6,
+	0x7f, 0x53, 0xd2, 0xc5, 0x13, 0x31, 0xc8, 0x4b, 0x41, 0xc7, 0xf5, 0x7c, 0xad, 0x3b, 0xf4, 0x8a,
+	0x89, 0xd0, 0x6c, 0x4b, 0x34, 0x64, 0x76, 0x05, 0xaa, 0xf4, 0x2b, 0xd9, 0xbc, 0x51, 0xcb, 0x29,
+	0x09, 0xcd, 0x93, 0x47, 0x21, 0xe6, 0xbe, 0x4c, 0xe5, 0xa8, 0x5f, 0xe6, 0xd7, 0x4a, 0xba, 0x64,
+	0xf1, 0x71, 0x4f, 0xaf, 0xcc, 0xa9, 0x55, 0x3e, 0xca, 0xa9, 0xf5, 0x89, 0xbb, 0xf0, 0x1b, 0x25,
+	0x18, 0xd7, 0xf4, 0x40, 0xa2, 0x0f, 0x6b, 0x61, 0xf0, 0x11, 0x6f, 0xc6, 0x66, 0x1f, 0xba, 0x04,
+	0xcc, 0xf4, 0x21, 0x41, 0xfd, 0x24, 0x7d, 0x58, 0x84, 0xd1, 0x7a, 0xbb, 0x1d, 0x88, 0x6b, 0x02,
+	0xdd, 0xa1, 0xa6, 0x94, 0xd4, 0x47, 0xd0, 0x85, 0xd3, 0xea, 0x85, 0xc9, 0x15, 0x00, 0x43, 0x34,
+	0x53, 0x94, 0xd6, 0xcf, 0x96, 0x12, 0x2e, 0xb9, 0x41, 0x29, 0x1d, 0x71, 0x50, 0xc4, 0x25, 0x5e,
+	0xfd, 0xbe, 0xbb, 0xcb, 0xc3, 0xd0, 0x6b, 0xa9, 0xa5, 0x81, 0x97, 0xf8, 0x84, 0x49, 0x20, 0x0b,
+	0xf5, 0x4b, 0x7c, 0x96, 0xd0, 0xfa, 0x57, 0x25, 0x79, 0xa3, 0x1d, 0xf8, 0x58, 0x34, 0x8f, 0xb0,
+	0xf2, 0x51, 0x44, 0x8a, 0x2f, 0xc1, 0xb0, 0xcd, 0x5b, 0x5e, 0x24, 0x47, 0x72, 0x46, 0xbf, 0x3d,
+	0x63, 0x41, 0x2a, 0xe5, 0x86, 0xe2, 0xa7, 0x2e, 0x0f, 0x60, 0xb9, 0xb8, 0x76, 0xac, 0x44, 0xd7,
+	0xda, 0xfc, 0x91, 0x47, 0x7b, 0x8d, 0x14, 0x4d, 0x50, 0x1c, 0xf0, 0x22, 0x67, 0x53, 0x94, 0x48,
+	0x99, 0x55, 0xdf, 0x57, 0x0c, 0x1a, 0xeb, 0xcb, 0x00, 0x69, 0x95, 0x62, 0x38, 0xe5, 0x64, 0xf7,
+	0xfc, 0x2d, 0x12, 0x3c, 0xe5, 0x18, 0xe0, 0x70, 0x36, 0x93, 0x32, 0x79, 0x47, 0xd0, 0x87, 0x33,
+	0x4b, 0x68, 0xfd, 0x1f, 0x15, 0x28, 0xd7, 0x71, 0xbe, 0xdd, 0xe2, 0x7b, 0xb1, 0xbb, 0x71, 0xcd,
+	0x6b, 0x1b, 0x7b, 0xc5, 0x0e, 0x42, 0x9d, 0x4d, 0xcf, 0xd0, 0x77, 0x69, 0xc8, 0x62, 0xaf, 0xb8,
+	0x15, 0x6e, 0xbc, 0x85, 0x84, 0xda, 0x5e, 0xb1, 0x13, 0x6e, 0xbc, 0x95, 0x25, 0x4b, 0x10, 0x99,
+	0x05, 0x23, 0xb4, 0x6f, 0xc8, 0x25, 0x06, 0x8f, 0xf7, 0xe7, 0x47, 0x68, 0x7b, 0xb1, 0x65, 0x09,
+	0x3b, 0x0d, 0x95, 0xc6, 0xda, 0x1d, 0xb9, 0xc1, 0xa3, 0x5e, 0x39, 0xea, 0xfa, 0xb6, 0x80, 0x89,
+	0x3a, 0x57, 0x97, 0xea, 0x6b, 0xa8, 0xb6, 0x19, 0x4e, 0xeb, 0x6c, 0xb7, 0xdc, 0x6e, 0x56, 0x71,
+	0x93, 0x20, 0xb2, 0x2f, 0xc0, 0xf8, 0xad, 0xa5, 0xc5, 0x1b, 0x41, 0x44, 0x9b, 0xf3, 0x48, 0x3a,
+	0x8d, 0x77, 0x5a, 0x4d, 0x54, 0x21, 0xe5, 0x4e, 0x39, 0x0d, 0x9f, 0x39, 0x70, 0x52, 0xb0, 0x12,
+	0x9f, 0xc4, 0x6b, 0x72, 0xa9, 0x42, 0xb8, 0x93, 0x3e, 0x73, 0xbd, 0xfc, 0x78, 0x7f, 0xfe, 0x05,
+	0x6c, 0x41, 0x44, 0x28, 0x8e, 0x52, 0x3e, 0x64, 0xb8, 0xf6, 0x61, 0xc3, 0xbe, 0x0a, 0x27, 0xf2,
+	0x25, 0x8d, 0xe4, 0x79, 0xec, 0xdc, 0xe3, 0xfd, 0x79, 0xab, 0x90, 0x7f, 0x64, 0xcc, 0xdf, 0x62,
+	0x26, 0xd6, 0xb7, 0xcb, 0x30, 0xae, 0xe9, 0x89, 0xd9, 0x67, 0xa5, 0xad, 0x44, 0xc9, 0xb8, 0x6e,
+	0x6a, 0x18, 0xa2, 0x94, 0x94, 0x8a, 0x9d, 0xa0, 0xc5, 0xa5, 0xe5, 0x44, 0xaa, 0x2d, 0x2b, 0x0f,
+	0xa2, 0x2d, 0x7b, 0x1b, 0x80, 0xa6, 0x30, 0x8e, 0x93, 0x26, 0x3d, 0x6a, 0x26, 0x53, 0xfa, 0xb4,
+	0x4a, 0x91, 0xd9, 0x7d, 0x38, 0xb6, 0x1e, 0xf6, 0xa2, 0xb8, 0xb1, 0x17, 0xc5, 0xbc, 0x23, 0xb8,
+	0xad, 0x05, 0x41, 0x5b, 0x2e, 0x9f, 0x17, 0xc5, 0xad, 0x0f, 0xed, 0xbc, 0x9c, 0x08, 0xcb, 0xb1,
+	0x01, 0x4e, 0x37, 0x08, 0x74, 0x1d, 0x5a, 0x11, 0x03, 0xcb, 0x86, 0x09, 0x5d, 0x03, 0x27, 0xce,
+	0x7d, 0xf9, 0xae, 0x2c, 0x9f, 0x7a, 0xb4, 0x73, 0x5f, 0xb6, 0x32, 0xff, 0xce, 0x6d, 0x92, 0x58,
+	0x9f, 0xd5, 0x15, 0xd2, 0x83, 0xee, 0x4b, 0xd6, 0xff, 0xbf, 0x94, 0x6e, 0xf2, 0xf7, 0xdf, 0x64,
+	0xef, 0xc2, 0x08, 0xbd, 0xe3, 0x4b, 0x73, 0x87, 0x13, 0x89, 0x06, 0x45, 0x7f, 0xe4, 0xa7, 0x97,
+	0xa0, 0xdf, 0x22, 0x5b, 0x9f, 0xcf, 0xd8, 0x92, 0x24, 0x79, 0x44, 0x32, 0xf5, 0xc9, 0x8a, 0x3b,
+	0x3e, 0x97, 0xbc, 0x59, 0xf4, 0x88, 0x64, 0xfd, 0xc6, 0x30, 0x4c, 0x99, 0x68, 0xfa, 0x63, 0x7f,
+	0x69, 0xa0, 0xc7, 0xfe, 0x2f, 0x41, 0x55, 0xce, 0x37, 0x25, 0x80, 0xbf, 0x88, 0x4f, 0x6b, 0x12,
+	0x66, 0x18, 0xb1, 0x00, 0x7d, 0x0e, 0x3b, 0x68, 0x73, 0x3b, 0xa1, 0x62, 0x97, 0xb5, 0x47, 0xe3,
+	0x4a, 0x2a, 0x42, 0x2a, 0xb5, 0xae, 0xbe, 0x9c, 0x93, 0xe7, 0xe3, 0xd7, 0x61, 0x44, 0x5c, 0xe7,
+	0x12, 0x7d, 0x1f, 0xb6, 0x52, 0xdc, 0xf4, 0x32, 0xd6, 0x6a, 0x84, 0xc4, 0x1e, 0x40, 0x75, 0xd5,
+	0x8d, 0xe2, 0x06, 0xe7, 0xfe, 0x00, 0x66, 0x3c, 0xf3, 0x72, 0xa8, 0x8e, 0xa1, 0x8d, 0x4c, 0xc4,
+	0xb9, 0x9f, 0xb1, 0xc3, 0x48, 0x98, 0xb1, 0xaf, 0x01, 0x2c, 0x06, 0x7e, 0x1c, 0x06, 0xed, 0xd5,
+	0x60, 0x6b, 0x76, 0x04, 0x15, 0x2d, 0xcf, 0x65, 0x3e, 0x40, 0x8a, 0x40, 0xba, 0x96, 0x44, 0x9b,
+	0xd8, 0xa4, 0x02, 0xa7, 0x1d, 0x6c, 0xe9, 0xeb, 0x20, 0xc5, 0x67, 0xd7, 0xa0, 0xa6, 0xb4, 0x58,
+	0xf7, 0xba, 0x5b, 0x21, 0x4e, 0x90, 0xd1, 0x54, 0x2e, 0xe4, 0x8f, 0x62, 0xa7, 0x27, 0xe1, 0xc6,
+	0xb9, 0x99, 0xa1, 0x61, 0x5f, 0x85, 0x53, 0x59, 0x98, 0xfa, 0xca, 0xd5, 0xf4, 0x0a, 0xa6, 0xb3,
+	0x2b, 0x98, 0xf7, 0xfd, 0x58, 0xb0, 0xeb, 0x30, 0x2d, 0x06, 0xe4, 0x36, 0x77, 0xa3, 0x1e, 0xd9,
+	0x5a, 0x4a, 0x3d, 0xa0, 0xb2, 0x52, 0x90, 0xab, 0xb0, 0x1d, 0x34, 0x77, 0x34, 0x24, 0x3b, 0x4b,
+	0xc5, 0xae, 0xc2, 0x38, 0x19, 0xcf, 0x84, 0x2b, 0xfe, 0x66, 0x20, 0xdf, 0x9d, 0xd4, 0x73, 0x8c,
+	0x2c, 0xb9, 0x7f, 0x59, 0x94, 0xd9, 0x3a, 0xa2, 0xb5, 0x5f, 0x86, 0x93, 0xc5, 0x75, 0xb0, 0x3f,
+	0x09, 0x27, 0xe4, 0x78, 0xb6, 0x79, 0xa8, 0xe1, 0x0c, 0x60, 0x56, 0xf4, 0xba, 0xfc, 0x4e, 0xcf,
+	0x37, 0x13, 0x06, 0xc9, 0x86, 0x23, 0x58, 0x64, 0x26, 0x45, 0x71, 0x3d, 0xec, 0x1b, 0x30, 0xae,
+	0x57, 0x5b, 0x1e, 0xdc, 0x42, 0xeb, 0x80, 0xba, 0x74, 0x96, 0xcc, 0x85, 0x69, 0x9b, 0x7f, 0xb3,
+	0xc7, 0xa3, 0x58, 0xd9, 0x88, 0x49, 0x89, 0xe5, 0x74, 0xae, 0x16, 0x85, 0x90, 0x28, 0x29, 0x6b,
+	0x21, 0x51, 0x3a, 0xca, 0x02, 0xf8, 0xbb, 0x82, 0x7d, 0x96, 0x9f, 0xf5, 0xfd, 0x32, 0x9c, 0xea,
+	0x33, 0x9d, 0xc5, 0x8e, 0xa7, 0x49, 0x86, 0xb8, 0xe3, 0x65, 0x04, 0x42, 0x32, 0x30, 0x3d, 0x0b,
+	0x65, 0x29, 0x81, 0x0d, 0x2d, 0xd4, 0x1e, 0xef, 0xcf, 0x4f, 0x18, 0x2b, 0xb5, 0xbc, 0xb2, 0xc4,
+	0x6e, 0xc2, 0x90, 0x18, 0x86, 0x01, 0xec, 0xa4, 0x94, 0x8a, 0x7a, 0x2a, 0xf6, 0xf4, 0x0d, 0x02,
+	0xc7, 0x06, 0x79, 0xb0, 0xcf, 0x42, 0x65, 0x7d, 0x7d, 0x15, 0x77, 0x87, 0x0a, 0xce, 0xee, 0xc9,
+	0x38, 0x6e, 0x1b, 0x9b, 0xd1, 0xa4, 0xa0, 0x4d, 0x46, 0xc4, 0x16, 0xe8, 0xec, 0xc3, 0x8c, 0xfd,
+	0xe6, 0x2b, 0x07, 0x2f, 0xe5, 0xc1, 0xcd, 0x39, 0x3f, 0x81, 0x15, 0xa5, 0xf5, 0x9d, 0x92, 0x32,
+	0x55, 0x93, 0x93, 0x9f, 0x9d, 0x55, 0xeb, 0x04, 0x15, 0x19, 0x92, 0x8b, 0x0e, 0x62, 0xcf, 0x01,
+	0xd0, 0xcf, 0x7b, 0xf7, 0xe4, 0xa0, 0x4f, 0xd8, 0x1a, 0x84, 0xbd, 0x93, 0xb0, 0x94, 0x8a, 0xe7,
+	0x0a, 0x4a, 0x02, 0x99, 0xb5, 0x46, 0x65, 0xb6, 0x89, 0x6a, 0xfd, 0x6a, 0x39, 0x3d, 0x35, 0xae,
+	0x79, 0xed, 0x98, 0x87, 0x6c, 0x8e, 0x0e, 0x81, 0xf4, 0xb2, 0x66, 0x27, 0xbf, 0xd9, 0x6c, 0x7a,
+	0xa2, 0x50, 0xd7, 0x92, 0xa3, 0xe3, 0x15, 0xed, 0xe8, 0xa8, 0xe0, 0xd1, 0x31, 0xd5, 0xf7, 0x90,
+	0x78, 0xa5, 0x60, 0x27, 0xc4, 0xad, 0xbf, 0x60, 0xb7, 0x7b, 0x11, 0x26, 0xef, 0x04, 0xcb, 0x8f,
+	0xe2, 0x04, 0x51, 0x6c, 0xf9, 0x55, 0xdb, 0x04, 0x0a, 0x8e, 0x77, 0xdb, 0x2d, 0x1e, 0xae, 0x6f,
+	0xbb, 0xbe, 0x61, 0xdb, 0x64, 0xe7, 0xe0, 0x02, 0xf7, 0x0e, 0x7f, 0x68, 0xe2, 0x92, 0x09, 0x55,
+	0x0e, 0x9e, 0xfd, 0x38, 0xd5, 0xdc, 0xc7, 0xb1, 0x7e, 0xb6, 0xac, 0x86, 0xeb, 0xfe, 0xe5, 0xa7,
+	0xd4, 0x6e, 0xe5, 0x2d, 0xc3, 0x6e, 0xe5, 0x58, 0xf2, 0xbc, 0x95, 0x98, 0x8c, 0x5d, 0x2e, 0xb4,
+	0x5a, 0x49, 0xec, 0xcf, 0x46, 0x8a, 0xed, 0xcf, 0xfe, 0xbb, 0x51, 0x98, 0xd0, 0x99, 0x88, 0xd1,
+	0xa9, 0xb7, 0x5a, 0xa1, 0x3e, 0x3a, 0x6e, 0xab, 0x15, 0xda, 0x08, 0x35, 0xcc, 0xcd, 0x2a, 0x07,
+	0x9a, 0x9b, 0x7d, 0x1d, 0xc6, 0x16, 0x3b, 0x2d, 0xc3, 0xac, 0xc4, 0x2a, 0x68, 0xf4, 0xc5, 0x04,
+	0x89, 0xd6, 0x74, 0xf2, 0x96, 0xd3, 0xec, 0xb4, 0xf2, 0xc6, 0x24, 0x29, 0x4b, 0xc3, 0x52, 0x6d,
+	0xf8, 0x93, 0x58, 0xaa, 0x5d, 0x85, 0xb1, 0x7b, 0x11, 0x5f, 0xef, 0xf9, 0x3e, 0x6f, 0xe3, 0x28,
+	0x55, 0x49, 0x67, 0xd0, 0x8b, 0xb8, 0x13, 0x23, 0x54, 0x6f, 0x40, 0x82, 0xaa, 0x7f, 0xf6, 0xd1,
+	0x03, 0x3e, 0xfb, 0x15, 0xa8, 0xae, 0x71, 0x1e, 0xe2, 0x98, 0x8e, 0xa7, 0x77, 0xa7, 0x2e, 0xe7,
+	0xa1, 0x23, 0x06, 0xd6, 0xb0, 0x60, 0x93, 0x88, 0x86, 0xd9, 0xdb, 0xc4, 0xa0, 0x66, 0x6f, 0xcf,
+	0xc3, 0x44, 0xb7, 0xb7, 0xd1, 0xf6, 0x9a, 0xc8, 0x57, 0xda, 0xcb, 0xd9, 0xe3, 0x04, 0x13, 0x6c,
+	0x23, 0xf6, 0x21, 0x4c, 0xa2, 0xae, 0x24, 0x99, 0x88, 0x53, 0xc6, 0x81, 0x6f, 0x94, 0x91, 0x4c,
+	0xde, 0x14, 0x20, 0xa7, 0xc0, 0x66, 0xd4, 0x64, 0xc4, 0x6e, 0xc2, 0xe8, 0x96, 0x17, 0x3b, 0xdb,
+	0xbd, 0x8d, 0xd9, 0x69, 0xc3, 0xe0, 0xf2, 0xba, 0x17, 0xdf, 0xe8, 0x6d, 0xd0, 0x27, 0x4f, 0x58,
+	0xe3, 0xce, 0xbd, 0xe5, 0xc5, 0xdb, 0x3d, 0x5d, 0x1d, 0x32, 0xb2, 0x85, 0xb8, 0x59, 0xfb, 0xbd,
+	0xda, 0xc1, 0xf6, 0x7b, 0x33, 0xa6, 0xfd, 0x1e, 0x73, 0x80, 0xe5, 0x5d, 0x58, 0x66, 0x19, 0x36,
+	0xea, 0x8d, 0x8b, 0xca, 0x17, 0xe5, 0x62, 0xce, 0xf7, 0xe5, 0xe2, 0xee, 0x9b, 0x17, 0x17, 0x15,
+	0xf0, 0x9a, 0x04, 0xda, 0x33, 0xcd, 0x2c, 0x68, 0xae, 0x01, 0x53, 0xe6, 0xa4, 0x7d, 0x02, 0x16,
+	0x27, 0x89, 0xbd, 0x61, 0xb5, 0x36, 0x76, 0x73, 0xa8, 0x0a, 0xb5, 0x71, 0xb2, 0x34, 0xb4, 0x61,
+	0x2d, 0xf9, 0x7c, 0x36, 0xbb, 0xd5, 0xdb, 0xe0, 0xa1, 0xcf, 0x63, 0x1e, 0x49, 0xc5, 0x42, 0x64,
+	0x0f, 0xd5, 0xbb, 0xdd, 0xc8, 0xfa, 0xdb, 0x65, 0x18, 0xad, 0x3f, 0x68, 0xe0, 0x51, 0xf5, 0x9a,
+	0xfe, 0x36, 0x5f, 0x4a, 0xad, 0xed, 0xd3, 0xb7, 0x79, 0xfd, 0x45, 0xfe, 0x52, 0x81, 0xe6, 0x0b,
+	0xbd, 0x6c, 0x34, 0xcd, 0x97, 0xa1, 0xef, 0x4a, 0xcd, 0x14, 0x2a, 0x03, 0x98, 0x29, 0x24, 0x6f,
+	0x39, 0x43, 0x87, 0xbf, 0xe5, 0xbc, 0x0b, 0xe3, 0x2b, 0x7e, 0xcc, 0xb7, 0xc2, 0x74, 0x51, 0x27,
+	0x5a, 0xb8, 0x04, 0xac, 0xab, 0x0b, 0x34, 0x6c, 0xb1, 0x62, 0xe8, 0xfd, 0x28, 0x79, 0x37, 0xc2,
+	0x15, 0x43, 0xcf, 0x4c, 0x19, 0x15, 0xaa, 0x42, 0xb4, 0x96, 0x32, 0xcb, 0x41, 0x59, 0xa7, 0x95,
+	0x4c, 0x45, 0x1e, 0x0d, 0xec, 0xc2, 0x4c, 0xb1, 0x75, 0x9a, 0xf5, 0x97, 0x4a, 0x70, 0xbc, 0x68,
+	0x96, 0xb3, 0x2f, 0xc2, 0x44, 0x10, 0x6e, 0xb9, 0xbe, 0xf7, 0x27, 0xa8, 0x47, 0x9a, 0x9e, 0x5f,
+	0x87, 0xeb, 0x8a, 0x3c, 0x1d, 0x2e, 0x06, 0x44, 0xeb, 0xb9, 0xa9, 0x96, 0x2c, 0x1c, 0x10, 0x0d,
+	0x6c, 0xfd, 0x5c, 0x19, 0xc6, 0xeb, 0xdd, 0xee, 0x53, 0x6e, 0xc4, 0xfd, 0x79, 0xe3, 0xd4, 0x53,
+	0x6a, 0x93, 0xa4, 0x5f, 0x07, 0x98, 0x6b, 0x1e, 0x76, 0xf0, 0xfd, 0x8f, 0x15, 0x98, 0xce, 0xf0,
+	0xd1, 0xfb, 0x54, 0x1a, 0xd0, 0xe6, 0xba, 0x3c, 0xa0, 0xcd, 0x75, 0x65, 0x30, 0x9b, 0xeb, 0xa1,
+	0x4f, 0x72, 0x92, 0xbd, 0x0c, 0x95, 0x7a, 0xb7, 0x9b, 0x35, 0x3d, 0xea, 0x76, 0xef, 0x5f, 0x21,
+	0x7d, 0x9e, 0xdb, 0xed, 0xda, 0x02, 0xc3, 0x38, 0x5e, 0x46, 0x3e, 0xa6, 0x55, 0xf5, 0xe8, 0xc1,
+	0xbb, 0x72, 0x75, 0xa0, 0x5d, 0x79, 0xec, 0x89, 0xed, 0xca, 0xd6, 0xeb, 0x30, 0x86, 0x5d, 0x45,
+	0xd3, 0xe6, 0xb3, 0x80, 0xfb, 0xa2, 0xb4, 0x6a, 0x36, 0x86, 0x42, 0xee, 0x98, 0x7f, 0x50, 0x82,
+	0x61, 0xfc, 0xfd, 0x94, 0x2e, 0x8c, 0xcb, 0xc6, 0xc2, 0xa8, 0x69, 0x0b, 0xa3, 0xef, 0x92, 0xd0,
+	0x26, 0xff, 0xdf, 0xac, 0x00, 0x2c, 0xde, 0xb5, 0x1b, 0xa4, 0x95, 0x66, 0xd7, 0x60, 0xda, 0x6d,
+	0xb7, 0x83, 0x87, 0xbc, 0xe5, 0x04, 0xa1, 0xb7, 0xe5, 0xf9, 0x34, 0x72, 0xca, 0x5c, 0xc7, 0x2c,
+	0xd2, 0x9f, 0xd1, 0x65, 0xd1, 0x5d, 0x2a, 0xd1, 0xf9, 0x74, 0x78, 0xbc, 0x1d, 0xb4, 0x94, 0x82,
+	0xca, 0xe0, 0x23, 0x8b, 0x0a, 0xf8, 0xdc, 0xa6, 0x12, 0x9d, 0xcf, 0x36, 0x2a, 0xdc, 0xd4, 0x6d,
+	0xc5, 0xe0, 0x23, 0x8b, 0x0a, 0xf8, 0x90, 0x96, 0x2e, 0x62, 0xab, 0x80, 0x8f, 0x2e, 0x0f, 0x9d,
+	0x66, 0xc8, 0x5b, 0xdc, 0x8f, 0x3d, 0xb7, 0x1d, 0x49, 0x95, 0x26, 0xea, 0xee, 0x73, 0x85, 0xba,
+	0x4a, 0x07, 0x0b, 0x17, 0xd3, 0x32, 0x76, 0x11, 0x46, 0x3b, 0xee, 0x23, 0xc7, 0xdd, 0x22, 0xc3,
+	0xb5, 0x49, 0x52, 0x81, 0x49, 0x90, 0x7e, 0xf6, 0x75, 0xdc, 0x47, 0xf5, 0x2d, 0x2e, 0x7a, 0xc1,
+	0x1f, 0x75, 0x83, 0x48, 0xeb, 0xc5, 0x48, 0xda, 0x8b, 0x4c, 0x91, 0xde, 0x0b, 0x59, 0x24, 0x7b,
+	0x61, 0xfd, 0x52, 0x09, 0x9e, 0x59, 0xc1, 0x56, 0xc4, 0x7b, 0x8b, 0xdc, 0x8f, 0x79, 0xb8, 0xc6,
+	0xc3, 0x8e, 0x87, 0x86, 0x34, 0x0d, 0x1e, 0xb3, 0x17, 0xa0, 0x52, 0xb7, 0xef, 0xc8, 0xf9, 0x4b,
+	0x87, 0x94, 0x61, 0x54, 0x25, 0x4a, 0x13, 0x2d, 0x69, 0xf9, 0x90, 0xd7, 0x9b, 0x3a, 0x4c, 0xd4,
+	0xa3, 0xc8, 0xdb, 0xf2, 0x3b, 0xe4, 0xae, 0x57, 0x31, 0xcc, 0xb6, 0x24, 0x3c, 0xf7, 0xaa, 0xaa,
+	0x93, 0x58, 0xff, 0x79, 0x09, 0x66, 0xea, 0xdd, 0xae, 0xd9, 0x64, 0xd3, 0x64, 0xb0, 0x34, 0xb8,
+	0xc9, 0xa0, 0x07, 0x53, 0x46, 0x77, 0x69, 0x4a, 0xa5, 0x97, 0x89, 0x03, 0x46, 0x86, 0x9a, 0xdd,
+	0x4d, 0x40, 0x4e, 0x64, 0x5a, 0x9c, 0x64, 0x18, 0x5b, 0xff, 0x49, 0x15, 0xf7, 0x10, 0x79, 0x18,
+	0x48, 0x3b, 0xfb, 0x52, 0x81, 0x9d, 0xfd, 0xdb, 0xa0, 0x89, 0x65, 0xfa, 0xb9, 0xac, 0xc9, 0xdf,
+	0xba, 0x7e, 0x31, 0x45, 0x66, 0x3b, 0x59, 0x8b, 0xfb, 0x0a, 0xf6, 0xe6, 0x85, 0xec, 0x02, 0x7e,
+	0x22, 0xc6, 0xf6, 0x37, 0x80, 0xad, 0xf8, 0x68, 0x05, 0xc3, 0x1b, 0x3b, 0x5e, 0xf7, 0x3e, 0x0f,
+	0xbd, 0xcd, 0x3d, 0xb9, 0x00, 0x70, 0xf0, 0x3d, 0x59, 0xea, 0x44, 0x3b, 0x5e, 0xd7, 0xd9, 0xc5,
+	0x72, 0xbb, 0x80, 0x86, 0xbd, 0x0f, 0xa3, 0x36, 0x7f, 0x18, 0x7a, 0xb1, 0x32, 0xda, 0x9c, 0x4a,
+	0xd4, 0xe5, 0x08, 0xa5, 0xb5, 0x10, 0xd2, 0x0f, 0x7d, 0x57, 0x94, 0xe5, 0xec, 0x32, 0x49, 0x56,
+	0x64, 0x9c, 0x39, 0x99, 0xf6, 0xb6, 0xfe, 0xa0, 0xd1, 0x4f, 0xb0, 0x62, 0x17, 0x60, 0x18, 0xc5,
+	0x33, 0x79, 0xbf, 0x42, 0x57, 0x54, 0xbc, 0x8f, 0xe8, 0xb2, 0x23, 0x62, 0xa0, 0xf6, 0x45, 0x99,
+	0x99, 0xa8, 0xc3, 0x47, 0x83, 0x64, 0x65, 0xcb, 0xb1, 0x23, 0xc9, 0x96, 0xab, 0x50, 0xb3, 0xc9,
+	0xab, 0xbd, 0x55, 0xef, 0xa2, 0xe9, 0x41, 0x34, 0x0b, 0xb8, 0x92, 0xcf, 0x3e, 0xde, 0x9f, 0x7f,
+	0x56, 0x7a, 0xbc, 0xb7, 0x1c, 0xb7, 0x4b, 0x16, 0x0b, 0xc6, 0x36, 0x92, 0xa5, 0x64, 0x6f, 0xc3,
+	0x90, 0xd8, 0x7a, 0xa5, 0x6d, 0xbe, 0x7a, 0xe3, 0x4c, 0x77, 0x63, 0x5a, 0x9c, 0xcd, 0xc0, 0xd8,
+	0x13, 0x90, 0x84, 0x39, 0x30, 0x65, 0x4e, 0x77, 0x69, 0x13, 0x39, 0x9b, 0x8e, 0xa7, 0x59, 0x2e,
+	0x1f, 0x3e, 0x25, 0xcc, 0x69, 0x22, 0x50, 0x5f, 0x01, 0x99, 0x45, 0xba, 0x0c, 0xd5, 0xf5, 0xc5,
+	0xb5, 0xb5, 0x20, 0x8c, 0xe9, 0xfa, 0x98, 0x9e, 0x2c, 0x02, 0x66, 0xbb, 0xfe, 0x16, 0x27, 0x51,
+	0x21, 0x6e, 0x76, 0x1d, 0x71, 0x60, 0x1b, 0xa2, 0x82, 0x22, 0x65, 0x5f, 0x83, 0x13, 0xf7, 0x22,
+	0x5e, 0xf7, 0xf7, 0x50, 0x78, 0xd0, 0x96, 0xca, 0x14, 0x4e, 0x3d, 0x7c, 0xba, 0x13, 0xd7, 0x6b,
+	0xd7, 0xdf, 0x73, 0x48, 0xe8, 0x28, 0x5e, 0x38, 0xc5, 0x5c, 0xd8, 0x25, 0xa8, 0xdc, 0x5e, 0x5c,
+	0x93, 0xf7, 0x4c, 0x65, 0xb2, 0x7c, 0x7b, 0x71, 0x8d, 0x26, 0x52, 0xc7, 0x74, 0x01, 0xb9, 0xbd,
+	0xb8, 0xf6, 0xe9, 0xf9, 0x09, 0x7c, 0x15, 0x5b, 0xc2, 0x66, 0x61, 0xb4, 0x49, 0x38, 0x92, 0x9b,
+	0xfa, 0xc9, 0x18, 0x0c, 0xb9, 0xe1, 0x96, 0x3c, 0x06, 0x6d, 0xfc, 0x9b, 0xbd, 0x0c, 0xb5, 0xb0,
+	0xe7, 0x3b, 0x6e, 0x44, 0x8f, 0xa0, 0xbd, 0x88, 0x87, 0xb4, 0xcd, 0xda, 0x93, 0x61, 0xcf, 0xaf,
+	0x47, 0x42, 0x2c, 0x14, 0x53, 0xd7, 0xfa, 0x3b, 0x25, 0xd0, 0xd6, 0x4f, 0xd5, 0xe6, 0x2d, 0x2f,
+	0xe4, 0xcd, 0x58, 0x9e, 0xcd, 0xd2, 0x8f, 0x9c, 0x60, 0x19, 0xd3, 0x6e, 0x84, 0xb1, 0x2f, 0xc2,
+	0xa8, 0x3c, 0x43, 0xe4, 0x9e, 0xa9, 0xd6, 0x9d, 0x7c, 0xdb, 0xa2, 0x80, 0x03, 0xb9, 0xf3, 0x47,
+	0x11, 0x89, 0x2d, 0xfb, 0xe6, 0x83, 0xf5, 0xc5, 0xb6, 0xeb, 0x75, 0x22, 0x79, 0x10, 0xe0, 0xae,
+	0xf1, 0xd1, 0xc3, 0xd8, 0x69, 0x22, 0x54, 0xdf, 0xb2, 0x13, 0x54, 0xeb, 0xba, 0x7a, 0x5a, 0x3b,
+	0xc4, 0x65, 0x62, 0x1e, 0x86, 0xef, 0xa7, 0x0a, 0xd8, 0x85, 0xb1, 0xc7, 0xfb, 0xf3, 0x34, 0xb6,
+	0x36, 0xc1, 0x2d, 0x0e, 0x63, 0xc9, 0xbc, 0x13, 0xbc, 0xc4, 0x0f, 0xe4, 0x35, 0x49, 0xbc, 0xc4,
+	0x0c, 0xb4, 0x11, 0x2a, 0xe4, 0xb4, 0x65, 0xbf, 0x85, 0x08, 0x65, 0x44, 0xc0, 0xe1, 0xe1, 0x7e,
+	0x0b, 0xa7, 0xa9, 0xde, 0x3b, 0x89, 0xa6, 0x49, 0x43, 0x3f, 0x56, 0x82, 0x29, 0xf3, 0x1b, 0xb3,
+	0x8b, 0x30, 0x22, 0x5d, 0xc5, 0x4b, 0xa8, 0xcf, 0x16, 0xdc, 0x46, 0xc8, 0x49, 0xdc, 0x70, 0x0d,
+	0x97, 0x58, 0x42, 0xe8, 0x93, 0x1c, 0xa4, 0xc4, 0x83, 0x42, 0x9f, 0x9c, 0x05, 0xb6, 0x2a, 0x63,
+	0x96, 0xb8, 0x3c, 0x47, 0xbd, 0x76, 0xac, 0xbf, 0xc3, 0x87, 0x08, 0xb1, 0x65, 0x89, 0xf5, 0x6b,
+	0x25, 0x18, 0xa1, 0x8d, 0x31, 0x63, 0x7f, 0x5d, 0x3a, 0x8a, 0xfd, 0xf5, 0xb7, 0xe0, 0xb8, 0x1d,
+	0xb4, 0x79, 0x54, 0xf7, 0xf7, 0x1e, 0x6e, 0xf3, 0x90, 0xaf, 0x85, 0xc1, 0xa6, 0x32, 0x19, 0x18,
+	0xbf, 0xfc, 0xbc, 0xb1, 0x01, 0x17, 0x21, 0xd2, 0x9b, 0x6f, 0x28, 0x4a, 0xc4, 0x32, 0xc5, 0x22,
+	0xb1, 0x56, 0x33, 0x26, 0x06, 0x85, 0x95, 0x58, 0x7f, 0xab, 0x04, 0x73, 0xfd, 0x59, 0xe3, 0xf1,
+	0x49, 0x7f, 0xa6, 0x72, 0x0b, 0x1d, 0x9f, 0x04, 0xcd, 0x18, 0x85, 0x6b, 0xc8, 0xcc, 0x86, 0x13,
+	0xf5, 0x66, 0x93, 0x77, 0x63, 0xc1, 0x58, 0x1a, 0x13, 0x27, 0x72, 0x4d, 0x95, 0x54, 0x56, 0x2e,
+	0x22, 0x90, 0x79, 0xb9, 0x32, 0xb0, 0xc6, 0x59, 0x57, 0x4c, 0x6a, 0xfd, 0x5e, 0x09, 0xa0, 0xd1,
+	0xb8, 0x71, 0x8b, 0xef, 0xad, 0xb9, 0x1e, 0x0a, 0x2a, 0xb4, 0xd7, 0xdc, 0x92, 0x9b, 0xc3, 0x84,
+	0xb4, 0x21, 0xa2, 0x2d, 0x6a, 0x87, 0xef, 0x19, 0x36, 0x44, 0x0a, 0x95, 0x7a, 0xe5, 0xed, 0xba,
+	0x31, 0x17, 0x84, 0xf8, 0x00, 0xa0, 0x7a, 0x85, 0xd0, 0x0c, 0xa5, 0x86, 0xcc, 0xbe, 0x06, 0x53,
+	0xe9, 0xaf, 0xc4, 0x12, 0x6a, 0x2a, 0xd9, 0x80, 0xcc, 0xc2, 0x85, 0xe7, 0x1e, 0xef, 0xcf, 0xcf,
+	0x69, 0x5c, 0xb3, 0xe6, 0x40, 0x19, 0x66, 0xef, 0x0c, 0xfd, 0x8b, 0x5f, 0x98, 0x2f, 0xa1, 0xb9,
+	0xda, 0xfa, 0x6a, 0x43, 0x75, 0xf3, 0x1c, 0x0c, 0x25, 0x6e, 0x38, 0x13, 0xf2, 0xcc, 0x31, 0xad,
+	0x0a, 0xb0, 0x5c, 0x48, 0x97, 0x69, 0x7f, 0x70, 0x83, 0x35, 0xfb, 0x21, 0x4a, 0xd9, 0x75, 0x18,
+	0x1d, 0xa8, 0xe5, 0xb8, 0x28, 0x0b, 0x5a, 0xac, 0xa8, 0x85, 0xd0, 0xb5, 0x68, 0xd3, 0x23, 0xd2,
+	0x04, 0x09, 0x5d, 0xcd, 0xb0, 0x6d, 0x0b, 0x98, 0xb5, 0x5f, 0x02, 0xb8, 0xf9, 0x60, 0xfd, 0x07,
+	0xf6, 0x33, 0x59, 0x3f, 0x59, 0x86, 0x99, 0xd4, 0x94, 0x55, 0xf5, 0xf3, 0x73, 0x00, 0x69, 0x97,
+	0x0e, 0xef, 0x68, 0x37, 0xe9, 0xe8, 0x3b, 0x30, 0xae, 0x55, 0x3e, 0x40, 0x4f, 0xbb, 0x69, 0x4f,
+	0x1d, 0xa8, 0x65, 0x1b, 0xfe, 0x09, 0xfb, 0xda, 0x35, 0xf0, 0xc5, 0xec, 0xdb, 0x76, 0x23, 0xb2,
+	0x1c, 0x9f, 0xa4, 0xd9, 0x27, 0x7e, 0xeb, 0xb3, 0x4f, 0xfc, 0xb6, 0xea, 0x50, 0xab, 0x6f, 0x71,
+	0x63, 0x54, 0xd8, 0xeb, 0x05, 0x23, 0x82, 0x1a, 0xce, 0x14, 0xaa, 0x8d, 0x83, 0xf5, 0xe3, 0x65,
+	0x98, 0x16, 0x33, 0xb9, 0xde, 0x8b, 0xb7, 0x83, 0xd0, 0x8b, 0xf7, 0x9e, 0xda, 0x27, 0xa0, 0xf7,
+	0x8c, 0x3b, 0xff, 0x9c, 0x92, 0x4e, 0xf4, 0xbe, 0xf5, 0x7f, 0x09, 0xd2, 0xce, 0xbb, 0xff, 0x61,
+	0x18, 0x8e, 0x15, 0x50, 0xb1, 0xd7, 0x8c, 0x77, 0xe5, 0x59, 0x15, 0xae, 0xe8, 0xfb, 0xfb, 0xf3,
+	0x13, 0x0a, 0x7d, 0x3d, 0x0d, 0x5f, 0x74, 0xd9, 0x34, 0x62, 0xa6, 0x91, 0xc2, 0x67, 0x66, 0xdd,
+	0x88, 0xd9, 0x34, 0x5d, 0xbe, 0x00, 0xc3, 0x78, 0x22, 0x48, 0x4f, 0x00, 0x94, 0xe8, 0xf1, 0x8c,
+	0x31, 0x2c, 0xf9, 0x04, 0x80, 0xdd, 0x80, 0x51, 0xf1, 0xc7, 0x6d, 0xb7, 0x2b, 0x8d, 0x3c, 0x58,
+	0xa2, 0x14, 0x43, 0x68, 0xd7, 0xf3, 0xb7, 0x74, 0xbd, 0x58, 0x9b, 0x3b, 0x1d, 0xb7, 0x6b, 0x5c,
+	0x3d, 0x08, 0xd1, 0xd0, 0xaf, 0x55, 0xfb, 0xeb, 0xd7, 0x4a, 0x87, 0xea, 0xd7, 0x36, 0x01, 0x1a,
+	0xde, 0x96, 0xef, 0xf9, 0x5b, 0xf5, 0xf6, 0x96, 0x0c, 0xfa, 0x74, 0xa1, 0xff, 0x57, 0xb8, 0x98,
+	0x22, 0xe3, 0x1a, 0x79, 0x06, 0x2d, 0xb1, 0x08, 0xe6, 0xb8, 0xed, 0x2d, 0xc3, 0x23, 0x5b, 0xe3,
+	0xcc, 0xee, 0x00, 0xd4, 0x9b, 0xb1, 0xb7, 0x2b, 0x56, 0x4b, 0x24, 0xef, 0x09, 0xaa, 0xc9, 0x8b,
+	0xf5, 0x5b, 0x7c, 0x0f, 0xef, 0xb6, 0xca, 0xa6, 0xc5, 0x45, 0x54, 0x31, 0xeb, 0x0d, 0x77, 0xdb,
+	0x94, 0x03, 0xeb, 0xc2, 0x89, 0x7a, 0xab, 0xe5, 0x89, 0x3e, 0xb8, 0xed, 0x75, 0x0a, 0xd7, 0x85,
+	0xac, 0x27, 0x8a, 0x59, 0x5f, 0x50, 0x66, 0x18, 0x6e, 0x42, 0xe5, 0xa8, 0x28, 0x5f, 0x99, 0x6a,
+	0x8a, 0x19, 0x5b, 0x0d, 0x98, 0x32, 0x3b, 0x6f, 0x06, 0xab, 0x9a, 0x80, 0xaa, 0xdd, 0xa8, 0x3b,
+	0x8d, 0x1b, 0xf5, 0x37, 0x6b, 0x25, 0x56, 0x83, 0x09, 0xf9, 0xeb, 0xb2, 0x73, 0xf9, 0xad, 0xab,
+	0xb5, 0xb2, 0x01, 0x79, 0xeb, 0xcd, 0xcb, 0xb5, 0xca, 0x5c, 0x79, 0xb6, 0x94, 0x09, 0xc6, 0x30,
+	0x5a, 0xab, 0xd2, 0x43, 0x89, 0xf5, 0xcb, 0x25, 0xa8, 0xaa, 0xb6, 0xb3, 0xab, 0x50, 0x69, 0x34,
+	0x6e, 0x64, 0xc2, 0x19, 0xa4, 0xa7, 0x3b, 0x9d, 0x60, 0x91, 0xb1, 0xd3, 0x08, 0x02, 0x41, 0xb7,
+	0xbe, 0xda, 0x90, 0x72, 0xb2, 0xa2, 0x4b, 0x8f, 0x4b, 0xa2, 0x2b, 0xf0, 0xf1, 0xbe, 0x0a, 0x95,
+	0x9b, 0x0f, 0xd6, 0xe5, 0x2d, 0x5e, 0xd1, 0xa5, 0xc7, 0x14, 0xd1, 0x7d, 0xf4, 0x50, 0x3f, 0x57,
+	0x05, 0x81, 0x65, 0xc3, 0xb8, 0x36, 0x91, 0x49, 0x30, 0xec, 0x04, 0x49, 0x84, 0x26, 0x29, 0x18,
+	0x0a, 0x88, 0x2d, 0x4b, 0x84, 0xb8, 0xbc, 0x1a, 0x34, 0xdd, 0xb6, 0x94, 0x30, 0x51, 0x5c, 0x6e,
+	0x0b, 0x80, 0x4d, 0x70, 0xeb, 0xd7, 0x4b, 0x50, 0x5b, 0x0b, 0x03, 0x8a, 0x22, 0xb5, 0x1e, 0xec,
+	0x70, 0xff, 0xfe, 0x9b, 0xec, 0x75, 0xb5, 0xe4, 0x4a, 0x89, 0xa2, 0x77, 0x18, 0x97, 0x5c, 0xe6,
+	0xe1, 0x5f, 0x2e, 0x3b, 0x2d, 0x08, 0x56, 0x79, 0xf0, 0xe0, 0x39, 0x87, 0x04, 0xc1, 0x9a, 0x87,
+	0x61, 0x6c, 0x8e, 0xdc, 0x1c, 0xb1, 0xe5, 0xb1, 0x00, 0xd8, 0x04, 0xd7, 0xf6, 0xa6, 0xfd, 0x72,
+	0xae, 0x0f, 0x97, 0x7f, 0xa0, 0x02, 0xd0, 0x98, 0x9d, 0x3b, 0xe0, 0xe5, 0xfe, 0x56, 0x9f, 0x00,
+	0x34, 0x19, 0x06, 0xe4, 0x58, 0x7d, 0x99, 0x9e, 0xd6, 0xc8, 0x3d, 0x51, 0xd7, 0x45, 0xe6, 0x62,
+	0x4f, 0x7c, 0x19, 0x8e, 0x67, 0xc7, 0x17, 0x55, 0xe6, 0x75, 0x98, 0x36, 0xe1, 0x4a, 0x7b, 0x7e,
+	0xaa, 0xb0, 0xde, 0xfb, 0x97, 0xed, 0x2c, 0xbe, 0xf5, 0xcf, 0x4b, 0x30, 0x86, 0x7f, 0xda, 0x3d,
+	0x92, 0xf2, 0xeb, 0x0f, 0x1a, 0x52, 0x91, 0xa7, 0x4b, 0xf9, 0xee, 0xc3, 0x48, 0xd9, 0xd2, 0x1a,
+	0x1b, 0x56, 0x82, 0x2c, 0x49, 0xe9, 0x09, 0x51, 0xa9, 0x90, 0x13, 0x52, 0x7a, 0x6b, 0x8c, 0x32,
+	0xa4, 0x12, 0x19, 0x9d, 0x63, 0xe8, 0xda, 0xa1, 0x5b, 0x36, 0x22, 0x5d, 0xd0, 0x36, 0x9d, 0x63,
+	0x08, 0x0d, 0x0d, 0x1b, 0x1f, 0x34, 0xc4, 0x4d, 0x44, 0x37, 0x6c, 0x14, 0x6d, 0x34, 0x6e, 0x21,
+	0x12, 0xc9, 0xfa, 0xb3, 0x53, 0xd9, 0x01, 0x94, 0xa7, 0xe7, 0x11, 0x17, 0xda, 0xbb, 0x30, 0x5c,
+	0x6f, 0xb7, 0x83, 0x87, 0x72, 0xcb, 0x51, 0x7a, 0x96, 0x64, 0xfc, 0xe8, 0x70, 0x44, 0x25, 0xb4,
+	0x11, 0x96, 0x42, 0x00, 0xd8, 0x22, 0x8c, 0xd5, 0x1f, 0x34, 0x56, 0x56, 0x96, 0xd6, 0xd7, 0xc9,
+	0xdf, 0xbd, 0xb2, 0xf0, 0x92, 0x1a, 0x1f, 0xcf, 0x6b, 0x39, 0x59, 0xcb, 0xab, 0xf4, 0xc2, 0x9a,
+	0xd2, 0xb1, 0x2f, 0x00, 0xdc, 0x0c, 0x3c, 0x9f, 0x94, 0xee, 0xb2, 0xf3, 0x67, 0x1e, 0xef, 0xcf,
+	0x8f, 0x7f, 0x14, 0x78, 0xbe, 0xd4, 0xd2, 0x8b, 0xb6, 0xa7, 0x48, 0xb6, 0xf6, 0xb7, 0x18, 0xe9,
+	0x85, 0x80, 0x2c, 0xb2, 0x87, 0xd3, 0x91, 0xde, 0x08, 0x72, 0xda, 0x61, 0x85, 0xc6, 0x3a, 0x30,
+	0xdd, 0xe8, 0x6d, 0x6d, 0x71, 0x71, 0x4c, 0x48, 0xed, 0xe7, 0x88, 0x54, 0xb4, 0x24, 0x31, 0x20,
+	0xe9, 0x02, 0x2e, 0x6e, 0xff, 0xd1, 0xc2, 0x6b, 0x62, 0x55, 0x7c, 0x6f, 0x7f, 0x5e, 0x5a, 0x74,
+	0x09, 0x11, 0x33, 0x52, 0xf4, 0x79, 0xdd, 0x67, 0x96, 0x37, 0xbb, 0x0b, 0x23, 0xf4, 0x2c, 0x2b,
+	0xfd, 0xb7, 0x9f, 0x3f, 0x60, 0x05, 0x12, 0x62, 0x3f, 0xbb, 0x04, 0x2a, 0x65, 0x0f, 0xa0, 0xba,
+	0xe8, 0x85, 0xcd, 0x36, 0x5f, 0x5c, 0x91, 0x82, 0xc4, 0x0b, 0x07, 0xb0, 0x54, 0xa8, 0x34, 0x2e,
+	0x4d, 0xfc, 0xd5, 0xf4, 0x74, 0xc1, 0x42, 0x61, 0xb0, 0xbf, 0x54, 0x82, 0x67, 0x92, 0xd6, 0xd7,
+	0xb7, 0xb8, 0x1f, 0xdf, 0x76, 0xe3, 0xe6, 0x36, 0x0f, 0xe5, 0x28, 0x8d, 0x1d, 0x34, 0x4a, 0xef,
+	0xe4, 0x46, 0xe9, 0x7c, 0x3a, 0x4a, 0xae, 0x60, 0xe6, 0x74, 0x88, 0x5b, 0x7e, 0xcc, 0x0e, 0xaa,
+	0x95, 0x39, 0x00, 0xa9, 0xc1, 0x81, 0x34, 0x0d, 0x7d, 0xe9, 0x80, 0x0e, 0xa7, 0xc8, 0xd2, 0x73,
+	0x36, 0xf9, 0x6d, 0xb8, 0x32, 0x24, 0x50, 0x76, 0x4b, 0x05, 0x4b, 0x20, 0x11, 0xe7, 0xec, 0x01,
+	0xbc, 0x29, 0x80, 0xc2, 0xb1, 0x03, 0x22, 0xb5, 0xd0, 0xd7, 0x5e, 0x75, 0x37, 0xa4, 0x54, 0x73,
+	0xc8, 0xd7, 0x5e, 0x75, 0xd3, 0xaf, 0xdd, 0x76, 0xb3, 0x5f, 0x7b, 0xd5, 0xdd, 0x60, 0x8b, 0x14,
+	0x74, 0x86, 0x22, 0x94, 0x3c, 0x77, 0x10, 0x37, 0xa5, 0x79, 0x2c, 0x08, 0x3e, 0xf3, 0x15, 0x18,
+	0x6b, 0x74, 0xdd, 0x26, 0x6f, 0x7b, 0x9b, 0xb1, 0x34, 0xb6, 0x79, 0xf1, 0x00, 0x56, 0x09, 0xae,
+	0xb4, 0x5e, 0x50, 0x3f, 0xf5, 0x1b, 0x5e, 0x82, 0x23, 0x5a, 0xb8, 0xbe, 0x76, 0x5b, 0xea, 0x41,
+	0x0f, 0x6a, 0xe1, 0xfa, 0xda, 0x6d, 0x29, 0xc0, 0x74, 0x3b, 0x86, 0x00, 0xb3, 0x76, 0x9b, 0x75,
+	0x61, 0x6a, 0x9d, 0x87, 0xa1, 0xbb, 0x19, 0x84, 0x1d, 0xd2, 0xb6, 0x93, 0x8b, 0xf9, 0x85, 0x83,
+	0xf8, 0x19, 0x04, 0xa4, 0x64, 0x8e, 0x15, 0xcc, 0xc9, 0xaa, 0xe8, 0x33, 0xfc, 0xc5, 0x98, 0x2c,
+	0x78, 0xf1, 0x46, 0xaf, 0xb9, 0xc3, 0x63, 0xe9, 0x78, 0x7e, 0xd0, 0x98, 0x24, 0xb8, 0x34, 0x26,
+	0x1b, 0xea, 0xa7, 0x3e, 0x26, 0x09, 0x8e, 0x98, 0x06, 0x32, 0xb4, 0x0c, 0x3b, 0x74, 0x1a, 0x10,
+	0x22, 0x4d, 0x83, 0x7e, 0x31, 0x66, 0xd8, 0x36, 0x4c, 0x2c, 0x04, 0x3d, 0x5f, 0xc8, 0xb5, 0x5d,
+	0xd7, 0x0b, 0x67, 0x8f, 0x21, 0xdb, 0x97, 0x0f, 0x6a, 0xb0, 0x86, 0x4e, 0x0e, 0x2f, 0x1b, 0x02,
+	0x22, 0x44, 0x67, 0x01, 0xd2, 0xdf, 0xcd, 0x74, 0x54, 0xd6, 0x82, 0x71, 0x9c, 0xca, 0x4b, 0x7c,
+	0x37, 0xe8, 0x46, 0xb3, 0xc7, 0xb1, 0xa2, 0x73, 0x87, 0x2d, 0x0a, 0xc2, 0x26, 0xab, 0x12, 0x5c,
+	0x1a, 0x4e, 0x0b, 0x21, 0xfa, 0x63, 0x86, 0x86, 0xc8, 0xae, 0xc3, 0xd0, 0xb2, 0xbf, 0xfb, 0xc6,
+	0xec, 0x09, 0x64, 0x3f, 0x7f, 0x00, 0x7b, 0x81, 0x46, 0x57, 0x73, 0xee, 0xef, 0xbe, 0xa1, 0x5f,
+	0xcd, 0x45, 0x89, 0xf5, 0xb7, 0x87, 0x61, 0xfe, 0x90, 0x56, 0xb1, 0xfb, 0xea, 0x90, 0x23, 0x51,
+	0xe2, 0xd5, 0xc1, 0x3a, 0x73, 0xf1, 0xd0, 0xf3, 0xef, 0x5d, 0x98, 0xba, 0xab, 0x59, 0xca, 0x24,
+	0x96, 0x4b, 0x48, 0xa3, 0xdb, 0xd0, 0x38, 0x5e, 0xcb, 0xce, 0xa0, 0xce, 0xfd, 0x41, 0x05, 0x86,
+	0x50, 0x42, 0x79, 0x01, 0x2a, 0x8d, 0xde, 0x86, 0xfe, 0x70, 0x1a, 0x19, 0xfb, 0xbe, 0x28, 0x65,
+	0xef, 0xc1, 0xb8, 0xf4, 0x13, 0xd4, 0xae, 0xb9, 0x38, 0xda, 0xca, 0xa9, 0x30, 0xeb, 0xc5, 0xa4,
+	0xa1, 0xb3, 0xf7, 0x61, 0x62, 0xcd, 0xeb, 0xf2, 0xb6, 0xe7, 0x73, 0xcd, 0x27, 0x07, 0x27, 0x45,
+	0x57, 0xc2, 0x73, 0x8f, 0xa9, 0x3a, 0x81, 0xe9, 0xd1, 0x38, 0x34, 0xb8, 0x47, 0xe3, 0xfb, 0x30,
+	0xb1, 0xc4, 0x37, 0x3d, 0xdf, 0x93, 0xe3, 0x33, 0x9c, 0x56, 0xdc, 0x4a, 0xe0, 0x26, 0xb5, 0x41,
+	0xc0, 0x16, 0x60, 0xd2, 0xe6, 0xdd, 0x20, 0xf2, 0xe2, 0x20, 0xdc, 0xbb, 0x67, 0xaf, 0x48, 0xab,
+	0x2a, 0xd4, 0xb0, 0x86, 0x49, 0x81, 0xd3, 0x0b, 0xf5, 0x23, 0xcd, 0x24, 0x61, 0x77, 0x60, 0x26,
+	0x05, 0x98, 0xc6, 0x92, 0xf2, 0xe5, 0x2c, 0xe1, 0x93, 0x77, 0x7e, 0xc8, 0x93, 0x9a, 0x6d, 0xb2,
+	0xf9, 0xa6, 0x74, 0xa5, 0xc8, 0xb6, 0x29, 0xe4, 0x9b, 0xc5, 0x6d, 0xb2, 0xf9, 0xa6, 0xf5, 0x77,
+	0x2b, 0x70, 0xaa, 0xcf, 0x1e, 0xc9, 0xee, 0x98, 0xd3, 0xf5, 0x85, 0x83, 0xb7, 0xd4, 0xc3, 0xa7,
+	0xe9, 0x2a, 0xd4, 0x96, 0x6f, 0xa1, 0x66, 0x80, 0xec, 0x12, 0x16, 0xeb, 0x4a, 0x9a, 0xc5, 0xee,
+	0xf3, 0x1d, 0x74, 0xa3, 0x52, 0xf6, 0x0c, 0x4d, 0x23, 0x5e, 0x56, 0x8e, 0x72, 0xee, 0x4f, 0x97,
+	0xe5, 0xbc, 0xcd, 0x04, 0x4c, 0x2e, 0x1d, 0x29, 0x60, 0xf2, 0x97, 0x60, 0x62, 0xf9, 0x16, 0xa9,
+	0x43, 0x6f, 0x28, 0x0d, 0x9c, 0x1c, 0x42, 0xbe, 0xa3, 0xde, 0xe1, 0x32, 0xba, 0x38, 0x83, 0x82,
+	0xdd, 0x83, 0x63, 0xd4, 0x36, 0x6f, 0xd3, 0x6b, 0x52, 0xdc, 0x55, 0xcf, 0x6d, 0xcb, 0x19, 0xf6,
+	0xc2, 0xe3, 0xfd, 0xf9, 0x79, 0xbe, 0x83, 0x0e, 0x62, 0xb2, 0xdc, 0x89, 0x10, 0x41, 0xf7, 0x14,
+	0x2b, 0xa0, 0xd7, 0x23, 0x2e, 0xda, 0x63, 0x58, 0xa1, 0xa8, 0x4d, 0xd4, 0x2d, 0x70, 0x09, 0xc9,
+	0xfa, 0xfd, 0x61, 0x98, 0xeb, 0x2f, 0xbf, 0xb1, 0x0f, 0xcc, 0x0f, 0x78, 0xee, 0x50, 0x89, 0xef,
+	0xf0, 0x6f, 0xf8, 0x21, 0x1c, 0x5f, 0xf6, 0x63, 0x1e, 0x76, 0x43, 0x4f, 0x45, 0x6a, 0xbc, 0x11,
+	0x44, 0xca, 0x21, 0x0f, 0x5f, 0x49, 0x78, 0x52, 0x2e, 0x5d, 0x4b, 0xf1, 0x61, 0x4f, 0x7f, 0x25,
+	0x29, 0xe2, 0xc0, 0x96, 0x61, 0x4a, 0x83, 0xb7, 0x7b, 0x5b, 0xba, 0xb1, 0x85, 0xce, 0xb3, 0xdd,
+	0xd3, 0xbd, 0x95, 0x32, 0x44, 0xe8, 0xf4, 0x17, 0xbb, 0xb1, 0xd7, 0xbc, 0xf9, 0xe0, 0x56, 0x43,
+	0x7e, 0x4e, 0x72, 0xfa, 0x43, 0xa8, 0xf3, 0xd1, 0xc3, 0x1d, 0x43, 0x00, 0x4b, 0x91, 0xe7, 0xfe,
+	0xda, 0x91, 0x76, 0xc2, 0xcf, 0x03, 0xa4, 0x4b, 0x49, 0x0f, 0x32, 0x92, 0x2e, 0x3d, 0xd3, 0xaf,
+	0x57, 0x41, 0xd9, 0x0d, 0x98, 0x4e, 0x7f, 0xdd, 0x7d, 0xe8, 0xab, 0x07, 0x4f, 0x52, 0x1b, 0x6b,
+	0x2b, 0x37, 0x10, 0x65, 0xba, 0x4c, 0x9f, 0x21, 0x63, 0x97, 0xa1, 0xfa, 0x20, 0x08, 0x77, 0x36,
+	0xc5, 0x37, 0x1e, 0x4a, 0x6f, 0x1d, 0x0f, 0x25, 0x4c, 0x97, 0xae, 0x15, 0x9e, 0x58, 0x2e, 0xcb,
+	0xfe, 0xae, 0x17, 0x06, 0x68, 0xa0, 0xa2, 0xdb, 0x95, 0xf2, 0x14, 0x6c, 0x04, 0x97, 0x4a, 0xc1,
+	0xec, 0x02, 0x0c, 0xd7, 0x9b, 0x71, 0x10, 0xca, 0xed, 0x8f, 0x66, 0x8a, 0x00, 0x18, 0x33, 0x45,
+	0x00, 0xc4, 0x20, 0x8a, 0x3d, 0x69, 0x34, 0x1d, 0x44, 0x73, 0x23, 0x12, 0xa5, 0xe2, 0xd6, 0x64,
+	0xf3, 0x4d, 0x54, 0xb3, 0x1a, 0xe1, 0xc0, 0x37, 0x73, 0x4f, 0x22, 0x12, 0xcd, 0xfa, 0x33, 0xd0,
+	0x77, 0xca, 0x0b, 0x31, 0xf5, 0x68, 0x53, 0x7e, 0xd5, 0x1d, 0x60, 0xca, 0xbf, 0x96, 0x78, 0x0b,
+	0xeb, 0x11, 0xec, 0x10, 0xa2, 0x0b, 0x48, 0xd2, 0x6f, 0xd8, 0x9c, 0x7f, 0x95, 0xa3, 0xcc, 0xbf,
+	0xbf, 0x51, 0x3d, 0xca, 0xfc, 0x93, 0xe3, 0x5b, 0x1e, 0x74, 0x7c, 0x2b, 0x03, 0x8d, 0xaf, 0x38,
+	0x54, 0x92, 0x58, 0xf4, 0x6b, 0x6e, 0x6c, 0xec, 0x88, 0x49, 0x02, 0x01, 0xa7, 0xeb, 0x1a, 0xb1,
+	0x55, 0x4d, 0x12, 0x4d, 0x48, 0x40, 0x0e, 0xc3, 0x79, 0x21, 0x21, 0x43, 0xaf, 0xa3, 0x8b, 0x8d,
+	0x40, 0x9d, 0xf9, 0x0d, 0xf4, 0x3d, 0x95, 0x93, 0x8d, 0xcc, 0x97, 0x94, 0x98, 0x40, 0x6e, 0xa9,
+	0xc6, 0xfb, 0x91, 0x41, 0x94, 0x9d, 0xe7, 0xa3, 0x47, 0x9a, 0xe7, 0xe4, 0x05, 0x11, 0xae, 0x06,
+	0x5b, 0x9e, 0xf2, 0x50, 0x54, 0x5e, 0x10, 0xa1, 0xd3, 0x16, 0xd0, 0x8c, 0x17, 0x04, 0xa1, 0xb2,
+	0xd7, 0x61, 0x44, 0xfc, 0x58, 0x59, 0x92, 0x36, 0x35, 0xa8, 0x3d, 0x41, 0x22, 0xd3, 0x2d, 0x94,
+	0x90, 0x54, 0x35, 0xcb, 0x1d, 0xd7, 0x6b, 0xcb, 0x80, 0x62, 0x69, 0x35, 0x5c, 0x40, 0xb3, 0xd5,
+	0x20, 0x2a, 0x6b, 0xc2, 0x84, 0xcd, 0x37, 0xd7, 0xc2, 0x20, 0xe6, 0xcd, 0x98, 0xb7, 0xe4, 0x8d,
+	0x51, 0x29, 0x4d, 0x16, 0x82, 0x80, 0x6e, 0xc3, 0xe8, 0x41, 0x58, 0xfa, 0xde, 0xfe, 0x3c, 0x08,
+	0x10, 0xf9, 0x1c, 0x0b, 0x91, 0x47, 0x7c, 0xff, 0xae, 0x22, 0xd6, 0x0f, 0x36, 0x9d, 0x29, 0xfb,
+	0x96, 0xd8, 0xea, 0x93, 0x21, 0x49, 0x2b, 0x9b, 0xe8, 0x53, 0xd9, 0x5b, 0x85, 0x95, 0xcd, 0x6b,
+	0xa3, 0x5d, 0x58, 0x69, 0x61, 0x25, 0xec, 0x0b, 0x30, 0xbe, 0xb8, 0xb2, 0x18, 0xf8, 0x9b, 0xde,
+	0x56, 0xe3, 0x46, 0x1d, 0xaf, 0x9d, 0x52, 0x5e, 0x6b, 0x7a, 0x4e, 0x13, 0xe1, 0x4e, 0xb4, 0xed,
+	0x1a, 0x41, 0x61, 0x52, 0x7c, 0x76, 0x1d, 0xa6, 0xd4, 0x4f, 0x9b, 0x6f, 0x0a, 0x79, 0x6d, 0x4a,
+	0x8b, 0x51, 0x90, 0x70, 0x10, 0x03, 0x61, 0x8a, 0x6c, 0x19, 0x32, 0x31, 0x19, 0x97, 0x78, 0xb7,
+	0x1d, 0xec, 0x89, 0xe6, 0xad, 0x7b, 0x3c, 0xc4, 0xfb, 0xa5, 0x9c, 0x8c, 0xad, 0xa4, 0xc4, 0x89,
+	0x3d, 0xd3, 0x92, 0xc8, 0x24, 0x12, 0xa2, 0x9f, 0x9c, 0xe2, 0xf7, 0xbd, 0xc8, 0xdb, 0xf0, 0xda,
+	0x5e, 0xbc, 0x47, 0x9e, 0x1c, 0x24, 0xfb, 0xa8, 0x75, 0xb1, 0x9b, 0x94, 0xea, 0xa2, 0x5f, 0x8e,
+	0xd4, 0xfa, 0xe5, 0x32, 0x3c, 0x7b, 0x90, 0x96, 0x85, 0x35, 0xcc, 0x7d, 0xf0, 0xfc, 0x00, 0x9a,
+	0x99, 0xc3, 0x77, 0xc2, 0xe5, 0x3e, 0xf7, 0x0c, 0x1c, 0x8c, 0xcc, 0x3d, 0x43, 0x1f, 0x8c, 0xcc,
+	0x8d, 0x63, 0x57, 0x6e, 0x73, 0x1f, 0x37, 0x3c, 0xc9, 0x55, 0x18, 0x5b, 0x0c, 0xfc, 0x98, 0x3f,
+	0x8a, 0x33, 0xd1, 0xbd, 0x08, 0x98, 0x0d, 0xcd, 0xa2, 0x50, 0xad, 0x7f, 0x5a, 0x81, 0x33, 0x07,
+	0xaa, 0x19, 0xd8, 0xba, 0x39, 0x6a, 0x17, 0x06, 0xd1, 0x4d, 0x1c, 0x3e, 0x6c, 0x97, 0x73, 0x06,
+	0xf2, 0x87, 0xfb, 0x97, 0xdb, 0xc0, 0x28, 0xe6, 0xd0, 0xf5, 0x76, 0xb0, 0x81, 0x8a, 0x28, 0xcf,
+	0xdf, 0x92, 0xb1, 0x8a, 0xc8, 0x57, 0x1a, 0x4b, 0x9d, 0xad, 0x76, 0xb0, 0x41, 0x0a, 0x2d, 0xcf,
+	0xd7, 0xc5, 0xa2, 0x02, 0xea, 0xb9, 0x7f, 0x5a, 0x92, 0x03, 0xff, 0x06, 0x8c, 0x62, 0xf3, 0x93,
+	0x61, 0xa7, 0x27, 0x02, 0xdc, 0xd9, 0x3d, 0xf3, 0x89, 0x80, 0xd0, 0xd8, 0x15, 0xa8, 0x2e, 0xba,
+	0xed, 0xb6, 0x16, 0x4f, 0x0d, 0xb5, 0x0f, 0x4d, 0x84, 0x65, 0xfc, 0x49, 0x14, 0xa2, 0x38, 0x0a,
+	0xe9, 0x6f, 0xed, 0xfc, 0xc1, 0x0d, 0x58, 0x92, 0x65, 0x8e, 0x20, 0x0d, 0x19, 0x33, 0x74, 0xa0,
+	0xbb, 0xc2, 0x90, 0x96, 0xa1, 0x43, 0x00, 0x8c, 0x0c, 0x1d, 0x02, 0x60, 0xfd, 0xf5, 0x61, 0x78,
+	0xee, 0x60, 0xfd, 0x1b, 0xbb, 0x67, 0x7e, 0xd6, 0x57, 0x06, 0xd2, 0xda, 0x1d, 0xfe, 0x5d, 0x55,
+	0xbe, 0x1b, 0x1a, 0x90, 0xf3, 0x79, 0xc7, 0xe3, 0xef, 0xef, 0xcf, 0x6b, 0x4e, 0x4a, 0x37, 0x03,
+	0xcf, 0xd7, 0x1e, 0x8c, 0xbf, 0x99, 0x13, 0x14, 0xc6, 0x2f, 0x5f, 0x1d, 0xac, 0x65, 0x29, 0x1d,
+	0xed, 0x55, 0x03, 0x0a, 0x18, 0xec, 0x43, 0x18, 0xba, 0xbb, 0xb2, 0xb4, 0x28, 0x5f, 0x6f, 0xde,
+	0x18, 0xac, 0x32, 0x41, 0x21, 0xab, 0x41, 0xed, 0x47, 0xe0, 0xb5, 0x9a, 0xba, 0xf6, 0x43, 0x94,
+	0xcf, 0xbd, 0x03, 0xb5, 0x6c, 0xa3, 0xd8, 0x39, 0x18, 0xc2, 0xae, 0x69, 0x7e, 0xd9, 0x99, 0xb6,
+	0x61, 0xf9, 0xdc, 0x4f, 0x97, 0x00, 0xd2, 0x4a, 0x84, 0xb8, 0xb5, 0x12, 0x45, 0xbd, 0x24, 0xc8,
+	0x2f, 0x8a, 0x5b, 0x1e, 0x42, 0xf4, 0x13, 0x94, 0x70, 0xd8, 0x87, 0xe8, 0x17, 0x8e, 0xf6, 0xb9,
+	0xf8, 0x51, 0x6e, 0xac, 0xaf, 0xaf, 0x49, 0x72, 0xb2, 0x81, 0x42, 0x99, 0x3a, 0x31, 0xec, 0x25,
+	0x13, 0xf7, 0xed, 0x38, 0xee, 0x3a, 0xc4, 0xd2, 0xee, 0x47, 0x3e, 0x77, 0x5b, 0x2e, 0x16, 0x8c,
+	0xa9, 0xa7, 0xc7, 0x33, 0x91, 0xed, 0x92, 0x31, 0xf5, 0x8c, 0x60, 0x28, 0x66, 0x4c, 0x3d, 0x9d,
+	0xc8, 0xfa, 0xb7, 0x25, 0x38, 0xdd, 0x57, 0xd1, 0xc3, 0xd6, 0xcc, 0x19, 0xfa, 0xd2, 0x61, 0x9a,
+	0xa1, 0x43, 0x27, 0xe7, 0xdc, 0x77, 0xd4, 0x62, 0xff, 0x22, 0x4c, 0x34, 0x7a, 0x1b, 0xd9, 0xfb,
+	0x31, 0xc5, 0xdb, 0xd4, 0xe0, 0xba, 0x18, 0xa0, 0xe3, 0x8b, 0xfe, 0xab, 0x20, 0x20, 0xd2, 0x9e,
+	0x58, 0x73, 0x62, 0x48, 0x82, 0x18, 0xe5, 0x63, 0x0a, 0x9a, 0x44, 0xd6, 0x7f, 0x5c, 0x2e, 0x56,
+	0x34, 0x5c, 0x5f, 0x5c, 0x3b, 0x8a, 0xa2, 0xe1, 0xfa, 0xe2, 0xda, 0xe1, 0x7d, 0xff, 0x6f, 0x55,
+	0xdf, 0xc9, 0xb4, 0x8e, 0x8e, 0x0d, 0xf5, 0x12, 0xa5, 0x4c, 0xeb, 0xe4, 0x11, 0x13, 0x65, 0x4c,
+	0xeb, 0x24, 0x32, 0x7b, 0x0b, 0xc6, 0x56, 0x03, 0x0a, 0xf7, 0xa7, 0x7a, 0x4c, 0x51, 0x7e, 0x14,
+	0x50, 0x3f, 0x63, 0x12, 0x4c, 0x71, 0xb7, 0x33, 0x3f, 0xbc, 0xf2, 0xd5, 0xc0, 0x79, 0x98, 0x99,
+	0x2e, 0xe6, 0x7b, 0x8d, 0x49, 0x66, 0xfd, 0x67, 0xc3, 0x60, 0x1d, 0xae, 0x6d, 0x66, 0x5f, 0x36,
+	0xc7, 0xee, 0xe2, 0xc0, 0x7a, 0xea, 0x81, 0xce, 0xad, 0x7a, 0xaf, 0xe5, 0x71, 0xbf, 0x69, 0x86,
+	0xd6, 0x93, 0x30, 0x7d, 0xcf, 0x57, 0x78, 0x1f, 0x27, 0x96, 0xca, 0xdc, 0x3f, 0xac, 0xa4, 0x4b,
+	0x2d, 0x23, 0x5f, 0x94, 0x3e, 0x86, 0x7c, 0xc1, 0x6e, 0x41, 0x4d, 0x87, 0x68, 0x8a, 0x4a, 0x14,
+	0xff, 0x0c, 0x46, 0x99, 0x46, 0xe5, 0x08, 0x4d, 0x21, 0xa5, 0x32, 0xb8, 0x90, 0x92, 0x51, 0x94,
+	0x0e, 0x1d, 0x4d, 0x51, 0x2a, 0x43, 0xf1, 0x45, 0xf2, 0x94, 0x1e, 0x36, 0x43, 0xf1, 0x15, 0x9c,
+	0xd4, 0x3a, 0xba, 0x8a, 0x26, 0x88, 0x3f, 0xb5, 0x68, 0x53, 0x49, 0x34, 0x41, 0xa2, 0x2f, 0x8a,
+	0x26, 0x98, 0x90, 0x88, 0x13, 0xdf, 0xee, 0xf9, 0x94, 0xfb, 0x6a, 0x34, 0x3d, 0xf1, 0xc3, 0x9e,
+	0xef, 0x64, 0xf3, 0x5f, 0x25, 0x88, 0xd6, 0x7f, 0x39, 0x54, 0x2c, 0x61, 0xa5, 0x0f, 0x12, 0x47,
+	0x90, 0xb0, 0x12, 0xa2, 0x4f, 0x67, 0xa6, 0xde, 0x83, 0x63, 0xca, 0xdc, 0x1f, 0x6b, 0x6f, 0xf1,
+	0xf0, 0x9e, 0xbd, 0x2a, 0x3f, 0x31, 0xea, 0xed, 0x12, 0x47, 0x81, 0xae, 0x2c, 0x77, 0x7a, 0xa1,
+	0xa1, 0xb7, 0x2b, 0xa0, 0x9f, 0xfb, 0x3b, 0x4a, 0x2d, 0xa9, 0x7f, 0x04, 0x0c, 0x82, 0x51, 0x2a,
+	0xfa, 0x08, 0xbd, 0x9e, 0xf1, 0x19, 0x4d, 0x12, 0xda, 0x7b, 0x13, 0x15, 0xf2, 0x3d, 0x53, 0xe0,
+	0xd6, 0xd5, 0xce, 0x26, 0x97, 0x0c, 0x11, 0xdb, 0x82, 0xd3, 0xe9, 0x7d, 0x44, 0xbb, 0x6e, 0x21,
+	0x47, 0xea, 0xf0, 0x85, 0xc7, 0xfb, 0xf3, 0x2f, 0x69, 0xf7, 0x19, 0xfd, 0xd6, 0x96, 0xe1, 0xde,
+	0x9f, 0x97, 0xd8, 0x6f, 0x17, 0x42, 0xd7, 0x6f, 0x6e, 0x6b, 0x73, 0x1e, 0xf7, 0xdb, 0x0d, 0x84,
+	0xe6, 0x22, 0x6e, 0xa5, 0xc8, 0xd6, 0xf7, 0xca, 0xc5, 0x7a, 0x1d, 0xf9, 0xee, 0x74, 0x04, 0xbd,
+	0x0e, 0x51, 0x1c, 0x7e, 0x4a, 0xfc, 0x0b, 0x75, 0x4a, 0xbc, 0x04, 0xa3, 0xeb, 0xdc, 0x77, 0xfd,
+	0x24, 0x92, 0x1d, 0xda, 0xbf, 0xc4, 0x04, 0xb2, 0x55, 0x19, 0xfb, 0x00, 0xd8, 0x9a, 0x1b, 0x72,
+	0x3f, 0x5e, 0x0c, 0x3a, 0x5d, 0x37, 0x8c, 0x3b, 0x98, 0x1d, 0x8c, 0x8e, 0x86, 0xe7, 0x1f, 0xef,
+	0xcf, 0x9f, 0xe9, 0x62, 0xa9, 0xd3, 0xd4, 0x8a, 0x75, 0x89, 0x3c, 0x4f, 0xcc, 0x2e, 0xc1, 0xa8,
+	0x32, 0xeb, 0xa8, 0xa4, 0xc1, 0x80, 0xf3, 0x26, 0x1d, 0x0a, 0x4b, 0x9c, 0x4a, 0xca, 0xf9, 0x5c,
+	0x85, 0xe3, 0xc7, 0x65, 0xa9, 0xdc, 0xd3, 0x8d, 0x53, 0x29, 0xc1, 0xb4, 0xfe, 0xeb, 0x11, 0x98,
+	0xed, 0xf7, 0xa6, 0xc5, 0xee, 0x9a, 0x43, 0xfb, 0xe2, 0x21, 0x6f, 0x60, 0x87, 0x0f, 0xec, 0x6f,
+	0x0e, 0x3f, 0xd9, 0xfd, 0xdc, 0xd8, 0x82, 0xcb, 0x1f, 0x7b, 0x0b, 0xae, 0x1c, 0x6d, 0x0b, 0x7e,
+	0x1b, 0x60, 0x9d, 0x77, 0xba, 0x6d, 0x37, 0xe6, 0xc9, 0x5b, 0x13, 0x45, 0x89, 0x95, 0xd0, 0x8c,
+	0xb7, 0x41, 0x8a, 0xcc, 0xde, 0x87, 0x09, 0xf5, 0x4b, 0x33, 0x08, 0xa1, 0xec, 0x44, 0x8a, 0x38,
+	0xfb, 0xcc, 0xa5, 0x13, 0x88, 0xbd, 0x43, 0x5b, 0x5a, 0x89, 0x0f, 0x3f, 0x3d, 0x4b, 0x68, 0x2b,
+	0xd3, 0xdc, 0x3b, 0x0c, 0x12, 0x21, 0x89, 0x68, 0x00, 0x2d, 0x54, 0x20, 0x4a, 0x22, 0x3a, 0x97,
+	0x4c, 0x53, 0xb2, 0x64, 0xf9, 0xe3, 0xa4, 0x7a, 0xf4, 0xe3, 0xc4, 0xd4, 0xa3, 0xa8, 0x2c, 0xa1,
+	0x05, 0x7a, 0x94, 0x8c, 0xa1, 0xb4, 0x49, 0x24, 0x9a, 0x42, 0x10, 0x53, 0x69, 0x86, 0x4d, 0x69,
+	0xc9, 0x82, 0x9c, 0xe2, 0xcc, 0x24, 0x21, 0xdf, 0x98, 0xdd, 0x37, 0xd6, 0xdd, 0x2d, 0x19, 0x81,
+	0x44, 0xfa, 0xc6, 0xec, 0xbe, 0xe1, 0xc4, 0xee, 0x96, 0xe9, 0x1b, 0x83, 0x68, 0xd6, 0x3f, 0x1c,
+	0x86, 0xb3, 0x87, 0x3d, 0x6d, 0xb3, 0x4d, 0x80, 0xbb, 0xfe, 0x46, 0xe0, 0x86, 0x2d, 0x71, 0x53,
+	0x2f, 0x1d, 0x7a, 0x9f, 0xd3, 0x89, 0x2f, 0xa6, 0x94, 0xa2, 0x90, 0xec, 0xb7, 0x83, 0x04, 0x66,
+	0x6b, 0x9c, 0xd9, 0xd7, 0xa1, 0x6a, 0xf3, 0x66, 0xb0, 0xcb, 0xe5, 0xab, 0xc3, 0xf8, 0xe5, 0xcf,
+	0x0e, 0x5a, 0x8b, 0xa2, 0xc3, 0x3a, 0xd0, 0x49, 0x3f, 0x94, 0x10, 0x3b, 0xe1, 0xc9, 0xbe, 0x01,
+	0xe3, 0x94, 0x7a, 0xb1, 0xbe, 0x19, 0xcb, 0x97, 0x89, 0xc3, 0xe3, 0x85, 0x95, 0xc4, 0xaa, 0xa2,
+	0x64, 0x8e, 0x8e, 0xbb, 0x69, 0x78, 0xd5, 0x51, 0xbc, 0x30, 0x8d, 0xe5, 0xdc, 0x7f, 0x54, 0x86,
+	0x29, 0xb3, 0xc3, 0x6c, 0x15, 0x6a, 0x2b, 0xbe, 0x17, 0x7b, 0x6e, 0xdb, 0xf4, 0x62, 0x90, 0xea,
+	0x31, 0x8f, 0xca, 0x9c, 0x42, 0x23, 0xff, 0x1c, 0xa5, 0xd8, 0xa9, 0xc5, 0x86, 0x19, 0xc5, 0x64,
+	0xe5, 0x45, 0xe1, 0xf0, 0xe5, 0xce, 0xf1, 0x3c, 0xe5, 0x7e, 0x48, 0x4b, 0x1d, 0x4a, 0x7f, 0x61,
+	0x86, 0xfa, 0xce, 0x12, 0xb3, 0x5d, 0x60, 0xb7, 0x7b, 0x51, 0x4c, 0x25, 0x3c, 0x5c, 0xe0, 0x9b,
+	0x41, 0x38, 0x48, 0xa0, 0xb0, 0x57, 0xe4, 0xe0, 0x3c, 0xd7, 0xe9, 0x45, 0xb1, 0x13, 0x4a, 0x72,
+	0x67, 0x03, 0xe9, 0x33, 0x83, 0x54, 0x50, 0xc3, 0xdc, 0x6d, 0x98, 0xd0, 0xbf, 0x1a, 0x5a, 0xbd,
+	0x7a, 0x1d, 0x4f, 0xf9, 0x7d, 0x91, 0xd5, 0xab, 0x00, 0xd8, 0x04, 0x67, 0xcf, 0xca, 0xc8, 0x9a,
+	0xe5, 0xd4, 0x38, 0x34, 0x8d, 0xa0, 0x69, 0xfd, 0x68, 0x09, 0x4e, 0x16, 0x5b, 0x4c, 0xb2, 0x8f,
+	0x32, 0x96, 0x1d, 0xa5, 0x83, 0xec, 0x5e, 0x94, 0x99, 0xe5, 0xc7, 0xb3, 0xed, 0xb0, 0xfe, 0xfc,
+	0x50, 0xee, 0x6e, 0x53, 0xc0, 0x91, 0x5d, 0x2f, 0xfc, 0x8e, 0x25, 0x4d, 0x1a, 0xcd, 0x7f, 0xc7,
+	0xc2, 0xaf, 0xf7, 0x1e, 0x4c, 0x21, 0xe3, 0x74, 0x72, 0x69, 0x4f, 0x39, 0xd4, 0x64, 0xcd, 0x5b,
+	0x22, 0x83, 0xcb, 0x56, 0x80, 0x21, 0x64, 0x21, 0x88, 0xb5, 0xe0, 0x30, 0x9a, 0x3e, 0x8b, 0x38,
+	0x6c, 0x04, 0xb1, 0xa3, 0x87, 0x89, 0x29, 0x20, 0x62, 0x9f, 0x87, 0x49, 0xf5, 0x39, 0x29, 0x1f,
+	0x91, 0xe6, 0xf1, 0xa1, 0xd6, 0x22, 0xa5, 0x24, 0xb2, 0x4d, 0x44, 0xd6, 0xa1, 0x18, 0x87, 0x12,
+	0xc8, 0x5b, 0xf5, 0x78, 0x80, 0x40, 0x92, 0x2f, 0xcb, 0xd9, 0xf7, 0x0c, 0x25, 0x5b, 0x55, 0xb4,
+	0x8e, 0x1b, 0x67, 0xa6, 0x5e, 0x96, 0x37, 0xdb, 0x82, 0x49, 0x2d, 0x09, 0x6b, 0x3d, 0x1e, 0x20,
+	0x07, 0xf0, 0x4b, 0xb2, 0xb2, 0xd3, 0x7a, 0x66, 0xd7, 0x7c, 0x55, 0x26, 0x5f, 0xeb, 0x3b, 0x65,
+	0x98, 0x22, 0xd5, 0x11, 0x99, 0xcd, 0x3e, 0xb5, 0xf6, 0xcd, 0xef, 0x1a, 0xf6, 0xcd, 0x2a, 0x03,
+	0x8d, 0xde, 0xb5, 0x81, 0xbc, 0x51, 0xb6, 0x81, 0xe5, 0x69, 0x98, 0x0d, 0x13, 0x3a, 0xf4, 0x60,
+	0x5b, 0xe4, 0x37, 0xd3, 0x64, 0x45, 0x52, 0x27, 0x88, 0xd6, 0xe5, 0x91, 0x6d, 0xf0, 0xb0, 0x7e,
+	0xac, 0x0c, 0x93, 0x9a, 0x37, 0xca, 0x53, 0x3b, 0xf0, 0xef, 0x18, 0x03, 0x3f, 0x9b, 0x04, 0xef,
+	0x4a, 0x7a, 0x36, 0xd0, 0xb8, 0xf7, 0x60, 0x26, 0x47, 0x92, 0x75, 0xea, 0x29, 0x0d, 0xe2, 0xd4,
+	0xf3, 0x5a, 0x3e, 0xf7, 0x08, 0xa5, 0x77, 0x4e, 0x02, 0xc7, 0xeb, 0xc9, 0x4e, 0x7e, 0xbc, 0x0c,
+	0xc7, 0xe5, 0x2f, 0x4c, 0x59, 0x46, 0x4a, 0xd0, 0xa7, 0xf6, 0x5b, 0xd4, 0x8d, 0x6f, 0x31, 0x6f,
+	0x7e, 0x0b, 0xad, 0x83, 0xfd, 0x3f, 0x89, 0xf5, 0xa3, 0x00, 0xb3, 0xfd, 0x08, 0x06, 0x8e, 0xf5,
+	0x99, 0x86, 0xe5, 0x2a, 0x0f, 0x10, 0x96, 0x6b, 0x15, 0x6a, 0x58, 0x95, 0x74, 0x83, 0x8d, 0xee,
+	0xd9, 0x2b, 0x72, 0x90, 0x50, 0xfa, 0xa0, 0x0c, 0x73, 0xd2, 0x77, 0x36, 0xca, 0x3c, 0x18, 0xe6,
+	0x28, 0xd9, 0x5f, 0x2b, 0xc1, 0x14, 0x02, 0x97, 0x77, 0xc5, 0x25, 0x4f, 0x30, 0x1b, 0x92, 0xf1,
+	0x9a, 0x12, 0x8b, 0xe5, 0x46, 0x1c, 0x7a, 0xfe, 0x96, 0x34, 0x59, 0xde, 0x90, 0x26, 0xcb, 0xef,
+	0x91, 0xa9, 0xf5, 0xc5, 0x66, 0xd0, 0xb9, 0xb4, 0x15, 0xba, 0xbb, 0x1e, 0x39, 0x5a, 0xb9, 0xed,
+	0x4b, 0x2a, 0x20, 0xd0, 0x25, 0xb7, 0xeb, 0x5d, 0xc2, 0x31, 0xbd, 0x94, 0x61, 0x85, 0xe6, 0xe0,
+	0xd4, 0x50, 0x8e, 0xd5, 0x66, 0xdf, 0x35, 0xcd, 0x16, 0xb1, 0x1f, 0x82, 0x53, 0xf4, 0x42, 0xb4,
+	0x18, 0xf8, 0xb1, 0xe7, 0xf7, 0x82, 0x5e, 0xb4, 0xe0, 0x36, 0x77, 0x7a, 0xdd, 0x48, 0x06, 0xfd,
+	0xc3, 0x9e, 0x37, 0x93, 0x42, 0x67, 0x83, 0x4a, 0x8d, 0x70, 0xbc, 0xc5, 0x0c, 0xd8, 0x0d, 0x98,
+	0xa1, 0xa2, 0x7a, 0x2f, 0x0e, 0x1a, 0x4d, 0xb7, 0x2d, 0x04, 0xe2, 0x51, 0xe4, 0x4a, 0x76, 0x99,
+	0xbd, 0x38, 0x70, 0x22, 0x82, 0xeb, 0xcf, 0x9c, 0x39, 0x22, 0xb6, 0x02, 0xd3, 0x36, 0x77, 0x5b,
+	0xb7, 0xdd, 0x47, 0x8b, 0x6e, 0xd7, 0x6d, 0x7a, 0x31, 0xe5, 0x0c, 0xab, 0x90, 0x22, 0x2f, 0xe4,
+	0x6e, 0xcb, 0xe9, 0xb8, 0x8f, 0x9c, 0xa6, 0x2c, 0x34, 0x4d, 0x65, 0x0c, 0xba, 0x84, 0x95, 0xe7,
+	0x27, 0xac, 0xc6, 0xb2, 0xac, 0x3c, 0xbf, 0x3f, 0xab, 0x94, 0x4e, 0xb1, 0xa2, 0x7c, 0xb2, 0xe4,
+	0xb2, 0x2f, 0xae, 0x21, 0x25, 0x8d, 0x95, 0x4c, 0x42, 0x8b, 0xee, 0xfb, 0x59, 0x56, 0x1a, 0x9d,
+	0x98, 0x79, 0x0f, 0x42, 0x2f, 0xe6, 0x7a, 0x0f, 0xc7, 0xb1, 0x59, 0x38, 0xfe, 0x18, 0xec, 0xa0,
+	0x5f, 0x17, 0x73, 0x94, 0x29, 0x37, 0xad, 0x93, 0x13, 0x39, 0x6e, 0xc5, 0xbd, 0xcc, 0x51, 0x26,
+	0xdc, 0xf4, 0x7e, 0x4e, 0x62, 0x3f, 0x35, 0x6e, 0x7d, 0x3a, 0x9a, 0xa3, 0x64, 0x77, 0xc4, 0xa0,
+	0xc5, 0xdc, 0x17, 0x33, 0x5a, 0xc6, 0x12, 0x98, 0xc2, 0xa6, 0xbd, 0x28, 0xc5, 0x86, 0x5a, 0xa8,
+	0x8a, 0x9d, 0x82, 0xc8, 0x02, 0x59, 0x62, 0xf6, 0xc3, 0x30, 0x7d, 0x2f, 0xe2, 0xd7, 0x56, 0xd6,
+	0x1a, 0x2a, 0x49, 0x03, 0xbe, 0xcc, 0x4f, 0x5d, 0x7e, 0xf3, 0x90, 0x4d, 0xe7, 0xa2, 0x4e, 0x83,
+	0x49, 0xfe, 0xe9, 0xbb, 0xf5, 0x22, 0xee, 0x6c, 0x7a, 0xdd, 0x28, 0x49, 0x50, 0xa4, 0x7f, 0xb7,
+	0x4c, 0x55, 0xd6, 0x0d, 0x98, 0xc9, 0xb1, 0x61, 0x53, 0x00, 0x02, 0xe8, 0xdc, 0xbb, 0xd3, 0x58,
+	0x5e, 0xaf, 0x7d, 0x86, 0xd5, 0x60, 0x02, 0x7f, 0x2f, 0xdf, 0xa9, 0x2f, 0xac, 0x2e, 0x2f, 0xd5,
+	0x4a, 0x6c, 0x06, 0x26, 0x11, 0xb2, 0xb4, 0xd2, 0x20, 0x50, 0x99, 0xf2, 0x28, 0xdb, 0x35, 0x5a,
+	0xba, 0x31, 0xbe, 0xe9, 0x8a, 0x33, 0xc5, 0xfa, 0x2b, 0x65, 0x38, 0xad, 0x8e, 0x15, 0x1e, 0x8b,
+	0x6b, 0xb6, 0xe7, 0x6f, 0x3d, 0xe5, 0xa7, 0xc3, 0x35, 0xe3, 0x74, 0x78, 0x31, 0x73, 0x52, 0x67,
+	0x7a, 0x79, 0xc0, 0x11, 0xf1, 0x6b, 0x63, 0x70, 0xe6, 0x40, 0x2a, 0xf6, 0x81, 0x38, 0xcd, 0x3d,
+	0xee, 0xc7, 0x2b, 0xad, 0x36, 0x17, 0x22, 0x6a, 0xd0, 0x8b, 0x65, 0xec, 0x8a, 0x17, 0xf0, 0xe1,
+	0x1a, 0x0b, 0x1d, 0xaf, 0xd5, 0xe6, 0x4e, 0x4c, 0xc5, 0xc6, 0x74, 0xcb, 0x53, 0x0b, 0x96, 0xb7,
+	0x38, 0xef, 0xd6, 0xdb, 0xde, 0x2e, 0x5f, 0xf1, 0x63, 0x1e, 0xee, 0xa2, 0xef, 0x61, 0xc2, 0x72,
+	0x87, 0xf3, 0xae, 0xe3, 0x8a, 0x52, 0xc7, 0x93, 0xc5, 0x26, 0xcb, 0x1c, 0x35, 0xbb, 0xa6, 0xb1,
+	0x44, 0x29, 0xff, 0xb6, 0xfb, 0x48, 0xfa, 0x2f, 0xc9, 0x1c, 0x6d, 0x09, 0x4b, 0x8a, 0x0a, 0xd5,
+	0x71, 0x1f, 0xd9, 0x79, 0x12, 0xf6, 0x35, 0x38, 0x21, 0x0f, 0x20, 0x19, 0x1f, 0x5a, 0xf5, 0x98,
+	0xa2, 0x4f, 0xbf, 0x2c, 0x2e, 0x66, 0x2a, 0xf4, 0x83, 0x8a, 0xf9, 0x5e, 0xd4, 0xeb, 0x62, 0x2e,
+	0x6c, 0x5d, 0x1c, 0xc8, 0x99, 0xe1, 0xb8, 0xcd, 0xa3, 0x48, 0x85, 0xfe, 0x92, 0xea, 0x38, 0x7d,
+	0x30, 0x9d, 0x0e, 0x95, 0xdb, 0x7d, 0x29, 0xd9, 0x0d, 0x98, 0x7a, 0xc0, 0x37, 0xf4, 0xef, 0x33,
+	0x92, 0x6c, 0x55, 0xb5, 0x87, 0x7c, 0xa3, 0xff, 0xc7, 0xc9, 0xd0, 0x31, 0x0f, 0x8d, 0x6b, 0x1e,
+	0xed, 0xad, 0x8a, 0x8b, 0xb3, 0xcf, 0x43, 0xbc, 0xff, 0x8e, 0xe2, 0x66, 0x30, 0x9b, 0x4a, 0xc8,
+	0x66, 0xb9, 0xd4, 0xd8, 0x62, 0xb4, 0x9d, 0xb6, 0x84, 0x3b, 0xe2, 0xa2, 0x9c, 0xb1, 0xbb, 0x31,
+	0xa9, 0xd8, 0x37, 0x60, 0xda, 0x0e, 0x7a, 0xb1, 0xe7, 0x6f, 0x35, 0xc4, 0x0d, 0x93, 0x6f, 0xd1,
+	0x81, 0x94, 0xa6, 0xb0, 0xc8, 0x94, 0x4a, 0x93, 0x4e, 0x02, 0x3a, 0x91, 0x84, 0x1a, 0x27, 0x82,
+	0x49, 0xc0, 0xbe, 0x0e, 0x53, 0x14, 0x51, 0x37, 0xa9, 0x60, 0xcc, 0xc8, 0xaf, 0x6d, 0x16, 0xde,
+	0x7f, 0x53, 0xba, 0x9b, 0x20, 0xb4, 0xa8, 0x82, 0x0c, 0x37, 0xf6, 0x15, 0x39, 0x58, 0x6b, 0x9e,
+	0xbf, 0x95, 0x4c, 0x63, 0xc0, 0x91, 0x7f, 0x3d, 0x1d, 0x92, 0xae, 0x68, 0xae, 0x9a, 0xc6, 0x7d,
+	0x7c, 0xe7, 0xf2, 0x7c, 0x58, 0x0c, 0x67, 0xea, 0x51, 0xe4, 0x45, 0xb1, 0x8c, 0xf0, 0xb2, 0xfc,
+	0x88, 0x37, 0x7b, 0x02, 0xf9, 0x41, 0x10, 0xee, 0xf0, 0x90, 0xbc, 0xb7, 0x87, 0x17, 0x2e, 0x3e,
+	0xde, 0x9f, 0x7f, 0xc5, 0x45, 0x44, 0x47, 0x06, 0x85, 0x71, 0xb8, 0x42, 0x75, 0x1e, 0x12, 0xae,
+	0xd6, 0x87, 0x83, 0x99, 0xb2, 0xaf, 0xc3, 0xc9, 0x45, 0x37, 0xe2, 0x2b, 0x7e, 0xc4, 0xfd, 0xc8,
+	0x8b, 0xbd, 0x5d, 0x2e, 0x07, 0x15, 0x0f, 0xbf, 0x2a, 0xe5, 0x2e, 0x69, 0xba, 0x91, 0x58, 0x98,
+	0x09, 0x8a, 0x23, 0x3f, 0x8a, 0x9e, 0x1a, 0xa5, 0x98, 0x0b, 0xb3, 0x61, 0xaa, 0xd1, 0xb8, 0xb1,
+	0xe4, 0xb9, 0xc9, 0xba, 0x9a, 0xc4, 0xf1, 0x7a, 0x05, 0x9f, 0x74, 0xa3, 0x6d, 0xa7, 0xe5, 0xb9,
+	0xc9, 0x82, 0xea, 0x33, 0x58, 0x19, 0x0e, 0xd6, 0x7e, 0x09, 0x6a, 0xd9, 0x4f, 0xc9, 0x3e, 0x84,
+	0x31, 0x72, 0x3c, 0xe3, 0xd1, 0xb6, 0xd4, 0xbf, 0x28, 0x3f, 0xa6, 0x04, 0x6e, 0x12, 0xc9, 0xa0,
+	0x71, 0xe4, 0xd6, 0xc6, 0x75, 0x2b, 0xf5, 0x1b, 0x9f, 0xb1, 0x53, 0x66, 0xac, 0x05, 0x13, 0xf4,
+	0xb5, 0x38, 0xa6, 0xdf, 0xc9, 0xc4, 0xbd, 0xd1, 0x8b, 0x32, 0xfc, 0xc9, 0x37, 0x83, 0xe6, 0x04,
+	0x21, 0x18, 0x55, 0x18, 0x5c, 0x17, 0x00, 0xaa, 0x8a, 0xd0, 0x3a, 0x0d, 0xa7, 0xfa, 0xb4, 0xd9,
+	0xda, 0xc5, 0x97, 0x9e, 0x3e, 0x35, 0xb2, 0x0f, 0xe1, 0x38, 0x12, 0x2e, 0x06, 0xbe, 0xcf, 0x9b,
+	0x31, 0x6e, 0x47, 0xca, 0xea, 0xa2, 0x42, 0x16, 0xe6, 0xd4, 0xdf, 0x66, 0x82, 0x90, 0x4b, 0xe2,
+	0x5c, 0xc8, 0xc1, 0xfa, 0x97, 0x65, 0x98, 0x95, 0x3b, 0x9c, 0xcd, 0x9b, 0x01, 0x6a, 0x1f, 0x9f,
+	0xf2, 0x13, 0x75, 0xd9, 0x38, 0x51, 0x5f, 0x48, 0x22, 0x8a, 0x17, 0x75, 0xf2, 0x00, 0xe7, 0xea,
+	0x7b, 0x19, 0xe7, 0xea, 0x43, 0x18, 0x51, 0x32, 0xd8, 0x59, 0x25, 0xb8, 0xf5, 0x73, 0xb3, 0xb6,
+	0x56, 0xa0, 0x7a, 0x8b, 0xef, 0xa1, 0xff, 0xa4, 0x18, 0xdf, 0x38, 0xbd, 0xb9, 0x55, 0x55, 0x34,
+	0x0d, 0x1b, 0xff, 0x65, 0xf3, 0x30, 0x8c, 0xde, 0x98, 0x7a, 0xec, 0x2b, 0x04, 0xd8, 0xf4, 0x9f,
+	0xf5, 0x7f, 0x96, 0xe0, 0xf4, 0x6d, 0xd7, 0xef, 0xb9, 0xed, 0x5b, 0x7c, 0x8f, 0x72, 0x4c, 0x77,
+	0xe8, 0x13, 0x6f, 0x7a, 0x5b, 0xec, 0x12, 0x8c, 0xca, 0xbc, 0x7d, 0xc8, 0xbf, 0x4a, 0xef, 0x68,
+	0xf9, 0x54, 0x7e, 0x0a, 0x8b, 0xdd, 0x82, 0x71, 0x2d, 0x50, 0x84, 0x74, 0x3a, 0x56, 0x23, 0xaf,
+	0xda, 0x2c, 0x9d, 0xac, 0x8b, 0x03, 0x4a, 0xb8, 0x69, 0x40, 0x89, 0x3b, 0x30, 0xa1, 0xb4, 0x5d,
+	0xc8, 0xad, 0x52, 0xcc, 0x6d, 0x2e, 0xd5, 0x91, 0xe7, 0x02, 0x47, 0x8c, 0x4b, 0x38, 0x86, 0x8b,
+	0xf8, 0xcd, 0x12, 0x9c, 0xcd, 0x8e, 0x7c, 0x1a, 0xf3, 0xe5, 0xe3, 0x76, 0x79, 0x0f, 0x4e, 0x74,
+	0x70, 0x00, 0x31, 0x20, 0x4d, 0x27, 0x19, 0x42, 0xb9, 0x17, 0x28, 0x77, 0xd3, 0xbe, 0x83, 0x4c,
+	0x6f, 0xe2, 0x85, 0x2c, 0xf4, 0x37, 0xf1, 0x4e, 0x9e, 0xde, 0xfa, 0x99, 0x32, 0x3c, 0x7b, 0xd0,
+	0x9c, 0x4c, 0x94, 0xd6, 0xa5, 0x22, 0xa5, 0x35, 0xeb, 0xc2, 0x31, 0xdc, 0x2f, 0x16, 0xb7, 0x79,
+	0x73, 0x07, 0xe3, 0xc1, 0xdd, 0xa2, 0x8f, 0x56, 0x6c, 0x87, 0xfc, 0x5a, 0xa1, 0x1d, 0xf2, 0x49,
+	0xda, 0xc4, 0x9a, 0xc8, 0x83, 0x42, 0xcd, 0x89, 0x6f, 0x60, 0x17, 0xb1, 0x66, 0x1c, 0x20, 0x4d,
+	0xb5, 0x29, 0xb5, 0xfc, 0x2f, 0xf7, 0x59, 0x13, 0xd9, 0x2f, 0x83, 0x31, 0xfb, 0xc5, 0xba, 0x38,
+	0x9e, 0xb2, 0xd0, 0x27, 0x4e, 0x0a, 0xb5, 0x7a, 0x7d, 0x87, 0x85, 0xd2, 0x28, 0xdf, 0x83, 0x69,
+	0x2d, 0xe3, 0x27, 0xce, 0x2d, 0x53, 0xf1, 0x97, 0x0d, 0x06, 0x44, 0xcf, 0xb2, 0x19, 0x1a, 0x7b,
+	0x8a, 0xeb, 0x38, 0x91, 0xf5, 0x93, 0x65, 0xa8, 0xd5, 0x7b, 0xf1, 0xf6, 0x5a, 0xc8, 0x37, 0x79,
+	0xc8, 0xfd, 0x26, 0xff, 0x01, 0x0b, 0x2a, 0x61, 0x76, 0x6e, 0x20, 0xf5, 0xdf, 0x77, 0xa7, 0xe0,
+	0x78, 0x11, 0x99, 0x18, 0x97, 0xf5, 0xc2, 0x7d, 0x0b, 0xf5, 0x4c, 0xdf, 0x2e, 0xc1, 0x44, 0x83,
+	0x37, 0x03, 0xbf, 0x75, 0x0d, 0xdd, 0x60, 0xe4, 0xe8, 0xb8, 0x24, 0x71, 0x0b, 0xb8, 0xb3, 0x99,
+	0xf1, 0x8f, 0xf9, 0xfe, 0xfe, 0xfc, 0x97, 0x06, 0x53, 0xf4, 0x34, 0x03, 0x7c, 0x38, 0x88, 0x31,
+	0x6d, 0x7b, 0x52, 0x05, 0xb5, 0xc6, 0x36, 0xaa, 0x65, 0x0b, 0x30, 0x29, 0x4f, 0xbb, 0x40, 0xcf,
+	0x76, 0x46, 0x39, 0x0b, 0x54, 0x41, 0xee, 0x89, 0xd6, 0x20, 0x61, 0x57, 0xa0, 0x72, 0xef, 0xf2,
+	0x35, 0xf9, 0x15, 0x54, 0x1c, 0xc9, 0x7b, 0x97, 0xaf, 0xa1, 0x36, 0x59, 0x4c, 0xe8, 0xc9, 0xde,
+	0x65, 0xc3, 0xc1, 0xe4, 0xde, 0xe5, 0x6b, 0xec, 0x4f, 0xc2, 0x89, 0x25, 0x2f, 0x92, 0x55, 0x50,
+	0x80, 0x93, 0x16, 0x06, 0x52, 0x1b, 0xe9, 0xb3, 0x3a, 0x3f, 0x57, 0xb8, 0x3a, 0x9f, 0x6f, 0x25,
+	0x4c, 0x1c, 0x8a, 0x9e, 0xd2, 0xca, 0x66, 0x75, 0x2b, 0xae, 0x87, 0x7d, 0x04, 0x53, 0x68, 0x75,
+	0x80, 0x31, 0x5f, 0x30, 0xfd, 0xf2, 0x68, 0x9f, 0x9a, 0xdf, 0x28, 0xac, 0x79, 0x8e, 0x4c, 0x42,
+	0x31, 0x72, 0x0c, 0xa6, 0x6a, 0x36, 0x94, 0x66, 0x06, 0x67, 0x76, 0x13, 0xa6, 0xe5, 0xed, 0xe5,
+	0xee, 0xe6, 0xfa, 0x36, 0x5f, 0x72, 0xf7, 0xe4, 0x53, 0x38, 0x2a, 0x44, 0xe4, 0x95, 0xc7, 0x09,
+	0x36, 0x9d, 0x78, 0x9b, 0x3b, 0x2d, 0xd7, 0x90, 0xf3, 0x33, 0x84, 0xec, 0x5b, 0x30, 0xbe, 0x1a,
+	0x34, 0xc5, 0xc5, 0x15, 0x77, 0x3e, 0x7a, 0x0d, 0xff, 0xb2, 0xd8, 0xa8, 0xda, 0x04, 0xce, 0xdc,
+	0x46, 0xbe, 0xbf, 0x3f, 0xff, 0xee, 0x51, 0xa7, 0x8d, 0x56, 0x81, 0xad, 0xd7, 0xc6, 0x16, 0xa1,
+	0xfa, 0x80, 0x6f, 0x88, 0xde, 0xfa, 0x32, 0x92, 0x81, 0x5a, 0x75, 0x0a, 0x2c, 0x1d, 0xc9, 0xe4,
+	0x2f, 0xc3, 0x91, 0x4c, 0xc2, 0x58, 0x08, 0x33, 0x38, 0x3e, 0x6b, 0x6e, 0x14, 0x3d, 0x0c, 0xc2,
+	0x16, 0x66, 0x4e, 0xef, 0xe7, 0x89, 0x72, 0xb9, 0x70, 0xf0, 0x9f, 0xa5, 0xc1, 0xef, 0x6a, 0x1c,
+	0xf4, 0xfb, 0x57, 0x8e, 0x3d, 0xfb, 0x06, 0x4c, 0xc9, 0x08, 0xb2, 0xb7, 0xaf, 0xd5, 0x71, 0x25,
+	0x4c, 0x18, 0x71, 0xd8, 0xcc, 0x42, 0xf5, 0xd8, 0x8b, 0xb0, 0x24, 0xf8, 0x61, 0x67, 0xd3, 0x35,
+	0x6d, 0xa5, 0x74, 0x12, 0xb6, 0x06, 0xe3, 0x4b, 0x7c, 0xd7, 0x6b, 0x72, 0x0c, 0xe0, 0x24, 0xe3,
+	0x1d, 0xa8, 0x60, 0x5b, 0x5a, 0x09, 0x1d, 0xe7, 0x2d, 0x04, 0x50, 0x38, 0x28, 0xd3, 0xc5, 0x34,
+	0x41, 0x64, 0x57, 0xa1, 0xb2, 0xb2, 0xb4, 0x26, 0xc3, 0x1d, 0xcc, 0x24, 0x71, 0x9a, 0xd7, 0x64,
+	0x0e, 0x40, 0xf2, 0xdd, 0xf2, 0x5a, 0x46, 0xb0, 0x84, 0x95, 0xa5, 0x35, 0xb6, 0x09, 0x93, 0x64,
+	0x93, 0xcc, 0x5d, 0x1a, 0xdb, 0xe9, 0x3e, 0x63, 0x7b, 0xb1, 0x70, 0x6c, 0x67, 0xa5, 0xad, 0xb3,
+	0xa4, 0xd6, 0xd7, 0xbd, 0xc1, 0x56, 0xdc, 0x08, 0x97, 0xf8, 0xa6, 0xdb, 0x6b, 0x2b, 0x2d, 0xf6,
+	0xfa, 0xfa, 0x2a, 0xfa, 0xa6, 0xc8, 0x1b, 0x61, 0x8b, 0x0a, 0x93, 0xf1, 0xeb, 0x1f, 0x4d, 0x25,
+	0xcf, 0x87, 0xbd, 0x03, 0x43, 0x77, 0x77, 0x62, 0x57, 0x06, 0x36, 0x50, 0xe3, 0x28, 0x40, 0xaa,
+	0xfb, 0x64, 0x54, 0xbe, 0x63, 0x64, 0x53, 0x41, 0x1a, 0xf1, 0x29, 0x6e, 0xb8, 0x61, 0xeb, 0xa1,
+	0x1b, 0x62, 0x70, 0xc2, 0x63, 0x06, 0x0b, 0xad, 0x84, 0x3e, 0xc5, 0xb6, 0x04, 0x64, 0xac, 0x03,
+	0x74, 0x16, 0xec, 0x87, 0xe0, 0x74, 0xe4, 0x6d, 0xf9, 0x18, 0x23, 0xdf, 0x71, 0xdb, 0x5b, 0x41,
+	0xe8, 0xc5, 0xdb, 0x1d, 0x27, 0xea, 0x79, 0x31, 0xc7, 0x08, 0x03, 0x53, 0xc9, 0x85, 0xab, 0xa1,
+	0xf0, 0xea, 0x0a, 0xad, 0x21, 0xb0, 0xec, 0x53, 0x51, 0x71, 0x01, 0xfb, 0x0a, 0x4c, 0xea, 0x5b,
+	0x72, 0x34, 0x7b, 0xe2, 0x6c, 0xe5, 0xfc, 0x54, 0x72, 0x54, 0x67, 0xb7, 0x70, 0x95, 0xe3, 0x51,
+	0x3b, 0x23, 0x22, 0x33, 0xc7, 0xa3, 0xc6, 0x8b, 0xd9, 0x70, 0x2a, 0x22, 0xe5, 0x60, 0xcf, 0xf7,
+	0x1e, 0x61, 0x90, 0x5c, 0xe9, 0xc3, 0x34, 0x7b, 0xd2, 0x38, 0xfa, 0x1a, 0x88, 0x75, 0xef, 0xce,
+	0xca, 0x87, 0xf7, 0x22, 0x1e, 0x4a, 0x57, 0xa6, 0xe3, 0x44, 0x7b, 0xcf, 0xf7, 0x1e, 0xa5, 0x50,
+	0xd2, 0x3c, 0xde, 0x1c, 0xaa, 0xb2, 0xda, 0x31, 0x7b, 0x46, 0xae, 0x02, 0xf9, 0xe5, 0x6e, 0x5f,
+	0xab, 0xdb, 0xa3, 0x6b, 0x2b, 0xf7, 0x1b, 0xed, 0x20, 0xb6, 0xb6, 0xe1, 0x78, 0x11, 0x57, 0x36,
+	0x9b, 0x91, 0x40, 0x53, 0x51, 0xf3, 0x19, 0x18, 0xdb, 0xf4, 0xc2, 0x28, 0x76, 0x7a, 0x1e, 0xc9,
+	0x0b, 0xc3, 0x76, 0x15, 0x01, 0xf7, 0xbc, 0x16, 0x3b, 0x0d, 0x55, 0x7c, 0x20, 0x16, 0x65, 0x15,
+	0x2c, 0x1b, 0x15, 0xbf, 0xef, 0x79, 0x2d, 0xeb, 0xbf, 0x2a, 0xe1, 0x11, 0xc4, 0x5e, 0xc1, 0x64,
+	0x04, 0x89, 0xb9, 0x18, 0x3e, 0xde, 0xb8, 0xdd, 0x4c, 0xf2, 0x69, 0x42, 0x61, 0xaf, 0xc1, 0xc8,
+	0x35, 0xb7, 0xc9, 0x13, 0x4b, 0x3c, 0x44, 0xde, 0x44, 0x88, 0x7e, 0x23, 0x21, 0x1c, 0x71, 0xb9,
+	0xa4, 0xa5, 0x59, 0x8f, 0x63, 0x1e, 0xd1, 0xfe, 0xb9, 0x58, 0x57, 0xd6, 0x77, 0x78, 0xb9, 0x94,
+	0x4b, 0xda, 0x4d, 0x11, 0x32, 0xae, 0xe8, 0x85, 0x1c, 0xac, 0xdf, 0x2f, 0xa5, 0x7b, 0x2a, 0x7b,
+	0x19, 0x86, 0xec, 0xb5, 0xa4, 0xfd, 0x14, 0xd7, 0x2f, 0xd3, 0x7c, 0x44, 0x60, 0x5f, 0x81, 0x13,
+	0x1a, 0x9f, 0x9c, 0x5f, 0xfc, 0x4b, 0x18, 0x76, 0x4e, 0x6b, 0x49, 0xb1, 0x73, 0x7c, 0x31, 0x0f,
+	0xbc, 0x49, 0xa7, 0x05, 0x4b, 0xdc, 0xf7, 0x88, 0xb7, 0xd6, 0x59, 0x9d, 0x77, 0x0b, 0x11, 0xb2,
+	0x9d, 0x2d, 0xe2, 0x40, 0x51, 0xe7, 0xac, 0x5f, 0x2d, 0x19, 0x7b, 0x25, 0x3b, 0x67, 0x48, 0xf1,
+	0xb8, 0xae, 0x33, 0x1a, 0x35, 0x92, 0xe7, 0xdf, 0x06, 0xa8, 0xf7, 0xe2, 0x60, 0xd9, 0x0f, 0x83,
+	0x76, 0x5b, 0xba, 0x69, 0xd0, 0x55, 0xab, 0x17, 0x07, 0x0e, 0x47, 0xb0, 0x11, 0xcf, 0x2a, 0x41,
+	0x2e, 0x0c, 0x21, 0x50, 0xf9, 0xb8, 0x21, 0x04, 0xc4, 0xbd, 0xc4, 0xd8, 0x1e, 0xde, 0x00, 0x35,
+	0xe9, 0x75, 0xbf, 0xa8, 0xae, 0xb7, 0xeb, 0x44, 0xed, 0xc0, 0x88, 0x9a, 0x2c, 0xd1, 0xd8, 0x9f,
+	0x2f, 0xc1, 0x49, 0xf2, 0xc5, 0xbf, 0xd3, 0xeb, 0x6c, 0xf0, 0xf0, 0xbe, 0xdb, 0xf6, 0x5a, 0x69,
+	0x7e, 0x9a, 0xd4, 0xf1, 0x4e, 0xab, 0xa6, 0x18, 0x9f, 0xb4, 0x54, 0x14, 0x1b, 0xc0, 0xf1, 0xb1,
+	0xd0, 0xd9, 0x4d, 0x4a, 0x75, 0x2d, 0x55, 0x31, 0x3d, 0x5b, 0x81, 0xf1, 0x35, 0xcf, 0xc7, 0x14,
+	0xfb, 0x69, 0x18, 0xac, 0x97, 0x29, 0xb4, 0x86, 0x98, 0xc2, 0xcd, 0x6d, 0x7e, 0xc0, 0xd6, 0xad,
+	0xd3, 0x5a, 0xbf, 0x5c, 0x82, 0xe7, 0x0f, 0x6d, 0xb0, 0xb8, 0x81, 0x2e, 0x0f, 0x74, 0x03, 0x55,
+	0xc9, 0xf3, 0xbf, 0x0a, 0x27, 0x74, 0x56, 0xeb, 0xa1, 0xeb, 0xe9, 0x51, 0x44, 0x0a, 0x06, 0x20,
+	0x16, 0x28, 0x59, 0xb1, 0xb5, 0x98, 0x89, 0xf5, 0xff, 0x94, 0x60, 0x2c, 0x71, 0x43, 0x7e, 0x4a,
+	0xaf, 0x33, 0x57, 0x8d, 0xeb, 0x8c, 0xca, 0x43, 0x96, 0xf4, 0x8a, 0xec, 0xf6, 0x0a, 0x1e, 0x44,
+	0xa6, 0x35, 0xa7, 0x6d, 0x04, 0xfc, 0xb9, 0x32, 0x8c, 0x8b, 0xad, 0x9a, 0x0c, 0x42, 0x7e, 0xb0,
+	0xd2, 0x1d, 0x25, 0xfd, 0x1a, 0x28, 0xb7, 0xcb, 0x3f, 0x2b, 0xe1, 0x43, 0xa1, 0x4e, 0x21, 0x46,
+	0x43, 0x80, 0xf4, 0xd1, 0x10, 0x27, 0xaa, 0x8d, 0x50, 0xca, 0x74, 0xb1, 0x2a, 0x47, 0x42, 0x66,
+	0xba, 0x68, 0xdb, 0x02, 0xc6, 0xbe, 0x04, 0xc3, 0xf7, 0xf0, 0xd9, 0xc3, 0x8c, 0xfe, 0x9b, 0xf0,
+	0xc7, 0x42, 0xda, 0xef, 0x7b, 0x91, 0x99, 0x06, 0x85, 0x08, 0x59, 0x03, 0x46, 0x17, 0x43, 0xee,
+	0xc6, 0xbc, 0x25, 0x07, 0x64, 0xa0, 0x80, 0x92, 0x4d, 0x22, 0xc9, 0x06, 0x94, 0x94, 0x9c, 0xc4,
+	0x3e, 0xc6, 0xd2, 0x3e, 0xa2, 0xc9, 0x5b, 0xf4, 0xd4, 0x7e, 0xf4, 0xf7, 0x8d, 0x8f, 0x7e, 0x26,
+	0xf7, 0xd1, 0xa9, 0x7b, 0x03, 0x7d, 0xfb, 0x5f, 0x2f, 0xc1, 0xc9, 0x62, 0x42, 0xf6, 0x02, 0x8c,
+	0xdc, 0x5d, 0x5f, 0x4b, 0xcd, 0x4c, 0xb1, 0x2b, 0x41, 0x17, 0x95, 0x42, 0xb6, 0x2c, 0x62, 0xaf,
+	0xc3, 0xc8, 0x07, 0xf6, 0x62, 0x6a, 0x4d, 0x89, 0x1b, 0xdc, 0x37, 0x85, 0xe4, 0x65, 0x9c, 0x6a,
+	0x12, 0x49, 0xff, 0xb6, 0x95, 0x27, 0xf6, 0x6d, 0x7f, 0xbc, 0x0c, 0xd3, 0xf5, 0x66, 0x93, 0x47,
+	0x91, 0xcc, 0x89, 0xfb, 0xd4, 0x7e, 0xd8, 0xe2, 0x78, 0xcd, 0x46, 0xdf, 0x06, 0xfa, 0xaa, 0xff,
+	0xa0, 0x44, 0x51, 0xef, 0x05, 0xd5, 0xae, 0xc7, 0x1f, 0xae, 0x6f, 0x87, 0x3c, 0xda, 0x0e, 0xda,
+	0xad, 0x41, 0x73, 0x9f, 0xa3, 0xcc, 0x88, 0x79, 0x63, 0x75, 0xeb, 0xa0, 0x4d, 0x84, 0x18, 0x32,
+	0x23, 0xe5, 0x96, 0xbd, 0x04, 0xa3, 0xf5, 0x6e, 0x37, 0x0c, 0x76, 0x69, 0xd9, 0xcb, 0x44, 0x47,
+	0x2e, 0x81, 0x8c, 0x10, 0x9a, 0x04, 0x12, 0xcd, 0x58, 0xe2, 0xfe, 0x9e, 0x6e, 0xdb, 0xd9, 0xe2,
+	0xbe, 0x7e, 0x29, 0xc1, 0x72, 0xab, 0x01, 0x6c, 0x2d, 0x0c, 0x3a, 0x41, 0xcc, 0x5b, 0xd4, 0x1f,
+	0x8c, 0x3c, 0x7a, 0x68, 0x92, 0x88, 0x75, 0x2f, 0x6e, 0x1b, 0x49, 0x22, 0x62, 0x01, 0xb0, 0x09,
+	0x2e, 0xce, 0xee, 0x33, 0xc6, 0x98, 0x2e, 0x85, 0x7b, 0x76, 0xcf, 0x5f, 0xf6, 0x43, 0xaf, 0xb9,
+	0x8d, 0xb1, 0x2d, 0xee, 0x00, 0xd8, 0xdc, 0x8d, 0x02, 0x5f, 0x13, 0xd6, 0x2e, 0x0a, 0xf1, 0x2b,
+	0x44, 0x68, 0x5e, 0xef, 0x30, 0x23, 0x39, 0xa5, 0x54, 0xb6, 0xc6, 0x81, 0xd5, 0x61, 0x92, 0x7e,
+	0x89, 0xce, 0x74, 0x13, 0x41, 0xfc, 0x19, 0x8a, 0x34, 0x81, 0x2c, 0xbb, 0x58, 0x62, 0x46, 0xa1,
+	0xd2, 0x28, 0xac, 0x7f, 0x3d, 0x0c, 0x13, 0xfa, 0x27, 0x65, 0x16, 0xa5, 0x57, 0x0f, 0x42, 0x3d,
+	0x00, 0xb0, 0x8b, 0x10, 0x5b, 0x96, 0xa4, 0xd1, 0xb3, 0xcb, 0x87, 0x46, 0xcf, 0x7e, 0x00, 0x93,
+	0x6b, 0x61, 0x80, 0x69, 0xa4, 0xd0, 0x54, 0x43, 0xee, 0xdf, 0xc7, 0x34, 0xad, 0x81, 0x98, 0x7d,
+	0x68, 0x0c, 0x82, 0xf7, 0xb2, 0xae, 0xc4, 0x76, 0x84, 0xe8, 0x6b, 0xe8, 0xcc, 0x0c, 0x3e, 0x64,
+	0x67, 0x26, 0x7a, 0xa2, 0x67, 0x74, 0xa4, 0x4e, 0x9b, 0x76, 0x66, 0x02, 0xa2, 0x6f, 0x10, 0xc3,
+	0x4f, 0x6a, 0x83, 0x60, 0x3f, 0x53, 0x82, 0xf1, 0xba, 0xef, 0xcb, 0xa8, 0xdc, 0x87, 0xc4, 0x10,
+	0xfd, 0xaa, 0x34, 0x35, 0x7b, 0xf7, 0x63, 0x99, 0x9a, 0xa1, 0xb0, 0x15, 0xa1, 0xa4, 0x9e, 0x56,
+	0x68, 0x44, 0xd6, 0x4b, 0xc1, 0xec, 0x5d, 0xa8, 0x25, 0x2b, 0x73, 0xc5, 0x6f, 0xf1, 0x47, 0x3c,
+	0x9a, 0x1d, 0x3d, 0x5b, 0x39, 0x3f, 0x29, 0x13, 0x6a, 0xea, 0x92, 0x79, 0x16, 0x91, 0xad, 0x03,
+	0xb8, 0xc9, 0x92, 0x90, 0x2f, 0xe0, 0xa7, 0xd3, 0xd7, 0xca, 0xcc, 0x9a, 0x51, 0x0f, 0x35, 0xe2,
+	0x37, 0xbe, 0xe6, 0x9b, 0x0f, 0x35, 0xc9, 0xd2, 0xea, 0xc0, 0x74, 0x3d, 0x8a, 0x7a, 0x1d, 0xde,
+	0x88, 0xdd, 0x30, 0xc6, 0x54, 0xdf, 0x30, 0xb8, 0x0d, 0xb5, 0x8b, 0xa4, 0x62, 0x46, 0x84, 0xb1,
+	0x53, 0x90, 0xf7, 0x3b, 0xcb, 0x9b, 0xd2, 0x97, 0xda, 0xa7, 0xf2, 0xed, 0xa5, 0x95, 0xfa, 0xe3,
+	0x25, 0x38, 0xa9, 0x4f, 0xfa, 0x46, 0x6f, 0x43, 0xa6, 0xdf, 0x62, 0x17, 0x61, 0x4c, 0xce, 0xc9,
+	0xe4, 0x12, 0x99, 0xcf, 0x58, 0x9e, 0xa2, 0xb0, 0x65, 0x31, 0x0d, 0x05, 0x0f, 0x79, 0xeb, 0x38,
+	0x96, 0xd9, 0x5c, 0x45, 0x11, 0xbe, 0xd7, 0xc9, 0x94, 0xeb, 0xe2, 0xb7, 0x39, 0x3f, 0x05, 0xc4,
+	0xfa, 0x22, 0xcc, 0x98, 0x5f, 0xa2, 0xc1, 0x63, 0x76, 0x01, 0x46, 0xd5, 0xe7, 0x2b, 0x15, 0x7f,
+	0x3e, 0x55, 0x6e, 0x3d, 0x00, 0x96, 0xa3, 0x8f, 0xd0, 0x26, 0x54, 0xdc, 0xcf, 0xe9, 0xe9, 0x42,
+	0x59, 0x64, 0xe4, 0x10, 0x17, 0x8e, 0xc9, 0xf6, 0x8d, 0x1b, 0x21, 0x02, 0x30, 0x15, 0xd9, 0x77,
+	0x18, 0x1c, 0x2b, 0x38, 0x28, 0x0e, 0x11, 0xe4, 0xe6, 0xcd, 0x0d, 0x62, 0x2c, 0x09, 0x41, 0xac,
+	0xb6, 0x85, 0x2f, 0xc2, 0xf0, 0xa1, 0xdb, 0x01, 0x85, 0x9e, 0xc8, 0xec, 0x02, 0x44, 0xf6, 0xa9,
+	0x08, 0x73, 0x7a, 0xc8, 0xf1, 0xe1, 0x27, 0x16, 0x72, 0x1c, 0x43, 0x05, 0x6a, 0x9b, 0xb8, 0x19,
+	0xbe, 0x90, 0x32, 0xf0, 0xe7, 0xb6, 0x2d, 0x93, 0x84, 0x78, 0x44, 0x41, 0x7b, 0x97, 0x4b, 0x1e,
+	0xa3, 0x3a, 0x0f, 0x2c, 0x28, 0xe4, 0xa1, 0x91, 0xb0, 0xbf, 0x55, 0x02, 0x26, 0x21, 0xfa, 0x9e,
+	0x55, 0x3d, 0x68, 0xcf, 0x6a, 0x3d, 0x99, 0x3d, 0xeb, 0x8c, 0x6a, 0x63, 0xf1, 0xde, 0x55, 0xd0,
+	0x2c, 0xf6, 0x37, 0x4a, 0x30, 0x43, 0xa1, 0xaa, 0xf5, 0xc6, 0x1e, 0x18, 0x7e, 0xb8, 0xf9, 0x64,
+	0x1a, 0xfb, 0x6c, 0x84, 0xd5, 0xf6, 0x69, 0x6b, 0xbe, 0x51, 0xec, 0x87, 0x00, 0x92, 0x15, 0x45,
+	0xe9, 0xd8, 0xc6, 0x2f, 0x3f, 0x5b, 0xb0, 0x0b, 0x24, 0x48, 0x69, 0x6a, 0xf1, 0x38, 0xa1, 0x33,
+	0xdc, 0x19, 0x13, 0x28, 0xfb, 0x93, 0x94, 0x3c, 0x29, 0x81, 0xc8, 0x28, 0xfd, 0xb3, 0xe3, 0x58,
+	0xcb, 0x67, 0xfb, 0x0b, 0x72, 0x17, 0x8b, 0xc8, 0x28, 0x79, 0x5f, 0xe2, 0xa1, 0x10, 0xc6, 0x9d,
+	0x6c, 0x02, 0xa5, 0x2c, 0x05, 0x26, 0xbf, 0xc0, 0xd6, 0x53, 0xfa, 0xef, 0x3e, 0xfb, 0xdb, 0x69,
+	0xb5, 0x16, 0x68, 0x7f, 0xcb, 0xf8, 0xcf, 0x22, 0x88, 0x7d, 0x00, 0x2c, 0x89, 0xf1, 0x4c, 0x30,
+	0xae, 0x52, 0x83, 0xd3, 0x63, 0x41, 0x1a, 0x2b, 0x3a, 0x54, 0xc5, 0xfa, 0x24, 0xc9, 0x13, 0x33,
+	0x0e, 0xc7, 0x65, 0xa7, 0x05, 0x94, 0x62, 0x5e, 0xac, 0x2c, 0x45, 0xb3, 0x53, 0x46, 0x0e, 0x84,
+	0xb4, 0x64, 0xe1, 0x39, 0xd9, 0xce, 0x93, 0x49, 0xf0, 0x0c, 0x33, 0x0a, 0x45, 0x21, 0x3b, 0x76,
+	0x15, 0xc6, 0x30, 0xc4, 0xd8, 0x0d, 0x65, 0xe9, 0x2a, 0xad, 0xee, 0x30, 0x18, 0x99, 0xb3, 0x6d,
+	0xda, 0xab, 0xa6, 0xa8, 0xe2, 0x0e, 0x43, 0x12, 0x20, 0xaa, 0xf4, 0xa5, 0x92, 0xa6, 0x15, 0xee,
+	0x39, 0x61, 0xcf, 0x0c, 0x5f, 0x87, 0x48, 0xec, 0x1b, 0x30, 0x7e, 0xdb, 0x7d, 0xa4, 0xd4, 0x42,
+	0x52, 0x6d, 0x7f, 0x98, 0xf7, 0x1f, 0xf6, 0xa6, 0xe3, 0x3e, 0x72, 0x5a, 0xbd, 0x6c, 0xea, 0x40,
+	0xf2, 0xfe, 0xd3, 0x58, 0xb2, 0xaf, 0x01, 0x68, 0xef, 0x0c, 0xec, 0xd0, 0x0a, 0x9e, 0x57, 0x99,
+	0x3d, 0x0a, 0xdf, 0x1f, 0x90, 0xbf, 0xc6, 0x30, 0x23, 0x39, 0x1c, 0xff, 0xf4, 0x24, 0x87, 0x13,
+	0x9f, 0x9e, 0xe4, 0x40, 0xcf, 0x5c, 0xf4, 0xed, 0x71, 0x07, 0xdf, 0x93, 0x5a, 0xfe, 0x83, 0x6a,
+	0x53, 0x66, 0x07, 0x35, 0x3c, 0x0a, 0xf6, 0x32, 0x55, 0x64, 0xf8, 0xb1, 0x10, 0x6a, 0xd9, 0x8b,
+	0xc1, 0xec, 0x29, 0xc3, 0x2c, 0xf7, 0xc0, 0x4b, 0x04, 0xa9, 0x5b, 0xe5, 0x34, 0x72, 0x78, 0x02,
+	0xd7, 0x85, 0xba, 0xdc, 0xc5, 0xe3, 0x3e, 0x8c, 0x4b, 0x76, 0x78, 0x39, 0x9d, 0x35, 0x2c, 0x34,
+	0x8d, 0xea, 0x44, 0xb9, 0xb4, 0x97, 0x91, 0x87, 0x53, 0xe6, 0xea, 0xaa, 0x33, 0x62, 0x1d, 0xa8,
+	0xad, 0x06, 0xfe, 0xd6, 0x3a, 0x0f, 0x3b, 0x18, 0x6c, 0x46, 0xec, 0x4d, 0xa7, 0x0d, 0x07, 0x14,
+	0x55, 0x6c, 0xc4, 0xa4, 0xf1, 0xfc, 0x2d, 0xea, 0x46, 0x3b, 0xf0, 0xb7, 0x9c, 0x98, 0x87, 0x1d,
+	0x8a, 0x62, 0x63, 0x1a, 0x05, 0xe6, 0x58, 0xcf, 0x6d, 0xc0, 0xe9, 0xbe, 0xfb, 0x5a, 0x41, 0x16,
+	0xc5, 0x4b, 0x66, 0x16, 0xc5, 0xd3, 0xfd, 0xe4, 0x9f, 0xc8, 0xcc, 0x7f, 0x7f, 0xac, 0x76, 0xbc,
+	0xbf, 0xe8, 0xf8, 0xbd, 0x72, 0x46, 0x1e, 0x92, 0x57, 0xd5, 0xb3, 0x50, 0x3e, 0x40, 0x60, 0x2c,
+	0xaf, 0x2c, 0x89, 0xbb, 0x29, 0x4a, 0x4c, 0x5a, 0xe2, 0x5b, 0x21, 0x31, 0xe9, 0x12, 0x17, 0xca,
+	0x4e, 0x9f, 0x54, 0x34, 0x7a, 0x0f, 0xa6, 0x1a, 0xdc, 0x0d, 0x9b, 0xdb, 0xb7, 0xf8, 0xde, 0xc3,
+	0x20, 0x6c, 0xa9, 0x68, 0x05, 0x94, 0x97, 0x03, 0x4b, 0xcc, 0x60, 0x49, 0x3a, 0x2e, 0x5b, 0x52,
+	0xe1, 0xbf, 0x86, 0xb1, 0xf6, 0xd3, 0x85, 0x47, 0x8c, 0x40, 0x38, 0x28, 0x32, 0x18, 0x7b, 0x2b,
+	0x91, 0xa2, 0x79, 0xa8, 0x67, 0xc1, 0x0f, 0x15, 0xb0, 0x40, 0x98, 0xe6, 0xa1, 0xf5, 0xdb, 0x15,
+	0x60, 0x54, 0xd3, 0xa2, 0xdb, 0x75, 0x31, 0xe0, 0x9e, 0x87, 0xe1, 0xf9, 0x6b, 0x12, 0xc7, 0xdd,
+	0x68, 0x73, 0x3d, 0xb7, 0x85, 0x74, 0xfb, 0x48, 0xca, 0x9c, 0xec, 0x2d, 0x34, 0x47, 0xd8, 0xe7,
+	0x1c, 0x2a, 0x7f, 0x92, 0x73, 0xe8, 0x1b, 0xf0, 0x4c, 0xbd, 0xdb, 0x6d, 0x7b, 0xcd, 0xa4, 0x96,
+	0x6b, 0x41, 0xa8, 0x26, 0xbc, 0x11, 0x85, 0xc8, 0x4d, 0xd0, 0x72, 0x2d, 0x3d, 0x88, 0x85, 0x26,
+	0x44, 0xd2, 0xbd, 0x5d, 0x0f, 0x0d, 0xaa, 0xd6, 0x69, 0xd1, 0x4d, 0x5f, 0x23, 0x51, 0x3c, 0xbc,
+	0x50, 0x09, 0x91, 0xc3, 0x69, 0xa6, 0x42, 0xf5, 0x50, 0x5f, 0x2c, 0x88, 0x26, 0x24, 0xec, 0x3d,
+	0x18, 0xaf, 0xf7, 0xe2, 0x40, 0x32, 0x96, 0xfe, 0x4a, 0xa9, 0x67, 0x91, 0x6c, 0x8a, 0x71, 0x2f,
+	0x4d, 0xd1, 0xad, 0xdf, 0xad, 0xc0, 0xe9, 0xfc, 0xe7, 0x95, 0xa5, 0xc9, 0xfa, 0x28, 0x1d, 0xb2,
+	0x3e, 0x8a, 0x66, 0x43, 0x39, 0x4d, 0xa5, 0xfd, 0x24, 0x66, 0x03, 0x05, 0xfb, 0xfb, 0x98, 0xb3,
+	0xa1, 0x21, 0xf6, 0xda, 0x54, 0x18, 0x19, 0xfa, 0xb8, 0xc2, 0x88, 0xce, 0x85, 0x5d, 0x80, 0x61,
+	0x8a, 0x88, 0x3a, 0x9c, 0xbe, 0x6b, 0x66, 0x83, 0xa1, 0x12, 0x06, 0xfb, 0xff, 0xc1, 0x59, 0xda,
+	0x93, 0xb2, 0x9d, 0x5d, 0xd8, 0x53, 0x1c, 0xe5, 0x87, 0xbb, 0xfc, 0x78, 0x7f, 0xfe, 0x22, 0x29,
+	0xdf, 0x9c, 0xdc, 0xb0, 0x39, 0x1b, 0x7b, 0x8e, 0x6a, 0x99, 0x56, 0xc9, 0xa1, 0xbc, 0xad, 0x1f,
+	0x86, 0x59, 0xca, 0x13, 0x55, 0xb0, 0x92, 0x0f, 0x59, 0x29, 0xa5, 0x4f, 0xbc, 0x52, 0xac, 0xc7,
+	0x25, 0x98, 0xef, 0x57, 0xfd, 0x51, 0x67, 0xda, 0x4d, 0x98, 0xa4, 0xdd, 0xb1, 0x1e, 0xe9, 0xb7,
+	0x59, 0x4a, 0x48, 0x8a, 0x75, 0x38, 0xb4, 0x9f, 0x3a, 0x6e, 0x94, 0x6b, 0xa5, 0x49, 0x9a, 0x9d,
+	0x15, 0x95, 0x27, 0x31, 0x2b, 0xac, 0x47, 0x70, 0x5a, 0x9d, 0xc6, 0x49, 0xd4, 0x40, 0x55, 0x2e,
+	0x7a, 0xb9, 0x93, 0xaa, 0xaa, 0xb1, 0x97, 0x99, 0xa3, 0x1c, 0xcb, 0xd9, 0x15, 0xa8, 0xd6, 0xd7,
+	0x56, 0xf0, 0x8c, 0xd5, 0x03, 0x4c, 0xba, 0x5d, 0x8f, 0x0e, 0x65, 0x23, 0x84, 0x93, 0x44, 0xc4,
+	0x1c, 0x9e, 0x69, 0x4b, 0xd8, 0xeb, 0x45, 0xde, 0xba, 0x94, 0x79, 0x96, 0xc0, 0xa6, 0xa3, 0xae,
+	0xd2, 0xa2, 0x97, 0x0b, 0xb5, 0xe8, 0x4a, 0x0d, 0x5b, 0x29, 0x54, 0xc3, 0x2e, 0xc1, 0x74, 0xa3,
+	0xb7, 0xa1, 0xea, 0xce, 0x46, 0xf8, 0x8a, 0x7a, 0x1b, 0x45, 0xb3, 0x36, 0x4b, 0x62, 0xfd, 0x85,
+	0x32, 0x4c, 0xac, 0xb5, 0x7b, 0x5b, 0x9e, 0xbf, 0xe4, 0xc6, 0xee, 0x53, 0xab, 0xd8, 0x7f, 0xdb,
+	0x50, 0xec, 0x27, 0x4e, 0xe9, 0x49, 0xc7, 0x06, 0xd2, 0xea, 0xff, 0x74, 0x09, 0xa6, 0x53, 0x12,
+	0x12, 0xa6, 0x6e, 0xc0, 0x90, 0xf8, 0x21, 0x35, 0x47, 0x67, 0x73, 0x8c, 0x11, 0xeb, 0x62, 0xf2,
+	0x97, 0x54, 0xb5, 0xbb, 0xa6, 0x29, 0x91, 0x28, 0x9e, 0xfb, 0x1c, 0x8c, 0xa5, 0x6c, 0xf3, 0x32,
+	0xda, 0x71, 0x5d, 0x46, 0x1b, 0xd3, 0x53, 0x5a, 0xff, 0x4a, 0x09, 0x6a, 0xd9, 0x9e, 0xb0, 0x5b,
+	0x30, 0x2a, 0x38, 0x79, 0x3c, 0xca, 0xc6, 0x4c, 0xca, 0x60, 0x5e, 0x94, 0x68, 0xd4, 0x3c, 0x1c,
+	0x7c, 0x4e, 0x10, 0x5b, 0x71, 0x98, 0xb3, 0x61, 0x42, 0xc7, 0x2a, 0x68, 0xdd, 0x6b, 0xa6, 0x04,
+	0x79, 0xb2, 0x78, 0x1c, 0xf4, 0x56, 0xff, 0x55, 0xa3, 0xd5, 0x52, 0x38, 0x3c, 0x67, 0x4c, 0xae,
+	0xc2, 0xa5, 0x88, 0x93, 0x06, 0x73, 0x6b, 0xcb, 0x2d, 0xba, 0xac, 0x07, 0x0d, 0xcf, 0x4d, 0xe8,
+	0x04, 0x8f, 0xbd, 0x06, 0x23, 0x54, 0x9f, 0x9c, 0x67, 0x28, 0xe6, 0x75, 0x11, 0xa2, 0x5f, 0x32,
+	0x09, 0xc7, 0xfa, 0xb9, 0x0a, 0x9c, 0x4c, 0x9b, 0x77, 0xaf, 0xdb, 0x72, 0x63, 0xbe, 0xe6, 0x86,
+	0x6e, 0x27, 0x3a, 0x64, 0x05, 0x9c, 0xcf, 0x35, 0x4d, 0x46, 0xb1, 0x21, 0x98, 0xd6, 0x20, 0x2b,
+	0xd3, 0x20, 0x7c, 0x40, 0xa0, 0x06, 0xa9, 0x66, 0xb0, 0x5b, 0x50, 0x69, 0xf0, 0x58, 0x9e, 0x8d,
+	0xe7, 0x72, 0xa3, 0xaa, 0xb7, 0xeb, 0x62, 0x83, 0xc7, 0xf4, 0x11, 0x29, 0x1c, 0xbb, 0x11, 0x2f,
+	0x46, 0x70, 0x61, 0x0f, 0x60, 0x64, 0xf9, 0x51, 0x97, 0x37, 0x63, 0x4c, 0xe6, 0xa9, 0x05, 0x4e,
+	0x29, 0xe6, 0x47, 0xb8, 0xc4, 0xf2, 0xb8, 0xbc, 0xb5, 0x99, 0x89, 0xcb, 0x25, 0xbb, 0xb9, 0xab,
+	0x50, 0x55, 0x95, 0x1f, 0x65, 0xe6, 0xce, 0xbd, 0x0d, 0xe3, 0x5a, 0x25, 0x47, 0x9a, 0xf4, 0x3f,
+	0x2f, 0xf6, 0xd5, 0xa0, 0xcd, 0xe5, 0xc4, 0x59, 0xce, 0xc9, 0xf2, 0xa5, 0x34, 0x02, 0xa8, 0x3c,
+	0x7b, 0x76, 0x64, 0xd1, 0x01, 0x42, 0xfd, 0x0a, 0x4c, 0x37, 0x76, 0xbc, 0x6e, 0x9a, 0xfb, 0xcd,
+	0x90, 0x98, 0xa2, 0x1d, 0xaf, 0xeb, 0x48, 0xad, 0x57, 0xf6, 0x14, 0xcb, 0xd2, 0x59, 0xff, 0xb6,
+	0x04, 0x23, 0xe2, 0xaf, 0xfb, 0x57, 0x9f, 0xd2, 0x2d, 0xf3, 0x8a, 0xb1, 0x65, 0xce, 0x68, 0xb9,
+	0x5c, 0x71, 0xe3, 0xb8, 0x7a, 0xc8, 0x66, 0xb9, 0x2f, 0x3f, 0x10, 0x21, 0xb3, 0xeb, 0x30, 0x2a,
+	0xad, 0x29, 0xa5, 0xd7, 0x98, 0x9e, 0x1c, 0x56, 0xd9, 0x59, 0x26, 0xea, 0xb1, 0xa0, 0x9b, 0xd5,
+	0x27, 0x2a, 0x6a, 0x71, 0xef, 0x52, 0x59, 0xf8, 0xf4, 0x8c, 0xff, 0x82, 0xcd, 0x62, 0xe0, 0x53,
+	0x6a, 0xd3, 0x68, 0xe1, 0x94, 0xe4, 0xd4, 0x2f, 0x1a, 0x63, 0x5d, 0xbe, 0x7f, 0x56, 0x0e, 0x62,
+	0x72, 0x52, 0x32, 0x29, 0x7e, 0x1a, 0xed, 0xc0, 0xc9, 0x46, 0xe3, 0x06, 0x5a, 0x5e, 0xaf, 0x05,
+	0x61, 0x7c, 0x2d, 0x08, 0x1f, 0xca, 0xf0, 0x57, 0x0d, 0xd3, 0xea, 0xa8, 0xc8, 0x1e, 0xf6, 0xe5,
+	0x42, 0x7b, 0xd8, 0x03, 0x2c, 0x93, 0x2c, 0x1f, 0x4e, 0x35, 0x1a, 0x37, 0x48, 0x62, 0xfb, 0xc3,
+	0xa8, 0xef, 0x57, 0x4a, 0x30, 0xd3, 0x68, 0xdc, 0xc8, 0x54, 0xb5, 0xaa, 0x32, 0x9a, 0x96, 0x0c,
+	0xd3, 0x87, 0xe2, 0x81, 0xc0, 0xaf, 0x50, 0x22, 0x09, 0xbc, 0x69, 0xa4, 0x93, 0x21, 0x26, 0x6c,
+	0x2d, 0xc9, 0xa1, 0x5a, 0x36, 0x3c, 0x09, 0xfb, 0x74, 0x34, 0x75, 0xe7, 0x22, 0xa1, 0xd2, 0x7c,
+	0x1e, 0x12, 0x10, 0xeb, 0x37, 0x4e, 0x52, 0x96, 0x56, 0x35, 0x5b, 0xbe, 0x00, 0x13, 0x92, 0x1e,
+	0xdd, 0xed, 0xa4, 0x15, 0xd8, 0x69, 0xb1, 0x41, 0x6e, 0x12, 0x9c, 0x12, 0xee, 0x7d, 0x7f, 0x7f,
+	0x7e, 0x48, 0x0c, 0x8d, 0x6d, 0xa0, 0xb3, 0xbb, 0x30, 0x79, 0xdb, 0x7d, 0xa4, 0xe9, 0x02, 0xc9,
+	0x99, 0xfa, 0x82, 0xd8, 0x55, 0x3a, 0xee, 0xa3, 0x01, 0xec, 0x8d, 0x4d, 0x7a, 0xb6, 0x03, 0x53,
+	0x66, 0x9f, 0xe4, 0x0c, 0xcc, 0x7f, 0xb1, 0x37, 0x0b, 0xbf, 0xd8, 0xe9, 0x6e, 0x10, 0xc6, 0xce,
+	0x66, 0x42, 0x6e, 0x64, 0x24, 0xce, 0xb0, 0x66, 0x5f, 0x80, 0x19, 0x2d, 0x69, 0xcf, 0xb5, 0x20,
+	0xec, 0xb8, 0xea, 0x42, 0x8c, 0x0f, 0x64, 0x68, 0x88, 0xb8, 0x89, 0x60, 0x3b, 0x8f, 0xc9, 0xbe,
+	0x52, 0xe4, 0xa0, 0x3e, 0x9c, 0x1a, 0x5d, 0x17, 0x38, 0xa8, 0xf7, 0x33, 0xba, 0xce, 0xbb, 0xaa,
+	0x6f, 0x1d, 0xe4, 0x94, 0x51, 0xa5, 0xde, 0x0f, 0xe4, 0x74, 0x91, 0x7c, 0xb9, 0x3e, 0xce, 0x17,
+	0x97, 0xa1, 0xb2, 0xb0, 0x76, 0x0d, 0x9f, 0x75, 0x95, 0x05, 0xa6, 0xbf, 0xed, 0xfa, 0x4d, 0xbc,
+	0xa8, 0x4a, 0x8f, 0x26, 0xfd, 0xa0, 0x5c, 0x58, 0xbb, 0xc6, 0x5c, 0x38, 0xb6, 0xc6, 0xc3, 0x8e,
+	0x17, 0x7f, 0xf8, 0xe6, 0x9b, 0xda, 0xa7, 0xaa, 0x62, 0xd3, 0x2e, 0xc9, 0xa6, 0xcd, 0x77, 0x11,
+	0xc5, 0x79, 0xf4, 0xe6, 0x9b, 0x85, 0x1f, 0x24, 0x69, 0x58, 0x11, 0x2f, 0x71, 0x60, 0xdd, 0x76,
+	0x1f, 0xa5, 0xee, 0x9f, 0x91, 0x0c, 0xf5, 0x71, 0x46, 0x4d, 0xad, 0xd4, 0x75, 0xd4, 0x38, 0xb0,
+	0x4c, 0x22, 0xf6, 0x1e, 0xea, 0xc2, 0x55, 0x68, 0x17, 0xe9, 0x24, 0x3d, 0xa7, 0x74, 0xdd, 0x2a,
+	0x1e, 0x8c, 0x7e, 0x2d, 0xd2, 0xd0, 0xd9, 0xbd, 0x44, 0x5b, 0x42, 0x77, 0x40, 0x19, 0x6c, 0xf0,
+	0x92, 0xae, 0x2d, 0x21, 0x0d, 0xb3, 0xd1, 0xad, 0xe9, 0x44, 0xc5, 0x46, 0xfe, 0xb0, 0xb6, 0xc9,
+	0x25, 0xaf, 0x84, 0x99, 0x38, 0xba, 0x12, 0x86, 0xc3, 0xd0, 0x6a, 0xd0, 0xdc, 0x91, 0x39, 0x31,
+	0x3e, 0x10, 0xbb, 0x70, 0x3b, 0x68, 0xee, 0x3c, 0x39, 0x67, 0x13, 0x64, 0xcf, 0xee, 0x50, 0xb0,
+	0xb3, 0xb0, 0x25, 0xc7, 0x44, 0x3a, 0x30, 0x1c, 0x4f, 0xee, 0x9b, 0x5a, 0x59, 0x1a, 0x02, 0x2d,
+	0x6c, 0xa9, 0xa1, 0xb5, 0x4d, 0x72, 0xc6, 0xa1, 0xb6, 0xc4, 0xa3, 0x9d, 0x38, 0xe8, 0x2e, 0xb6,
+	0xbd, 0x2e, 0xc6, 0x0f, 0x94, 0xd9, 0x19, 0x07, 0xde, 0x93, 0x5b, 0x44, 0xef, 0x34, 0x15, 0x03,
+	0x3b, 0xc7, 0x92, 0x7d, 0x05, 0xa6, 0xc4, 0xe4, 0x5e, 0x7e, 0x14, 0x73, 0x9f, 0xbe, 0xfc, 0x0c,
+	0x4a, 0x74, 0xc7, 0xb5, 0xdc, 0xe6, 0x49, 0x21, 0xcd, 0x29, 0x5c, 0xec, 0x3c, 0x21, 0x30, 0xf2,
+	0x89, 0x18, 0xac, 0x58, 0x0b, 0x66, 0x6f, 0xbb, 0x8f, 0xd2, 0x8b, 0xb2, 0x3e, 0x49, 0x19, 0x4e,
+	0xb0, 0xf3, 0x8f, 0xf7, 0xe7, 0x5f, 0x14, 0x13, 0x2c, 0x4d, 0x18, 0xda, 0x67, 0xbe, 0xf6, 0xe5,
+	0xc4, 0xbe, 0x05, 0xa7, 0x64, 0xb7, 0x96, 0xbc, 0x10, 0x3d, 0xbc, 0xf6, 0x1a, 0xdb, 0x2e, 0x7a,
+	0x7e, 0x1f, 0xeb, 0x33, 0x60, 0x97, 0x8a, 0xb7, 0x44, 0x35, 0x60, 0x2d, 0xc5, 0xc7, 0x89, 0x88,
+	0x91, 0xdd, 0xaf, 0x06, 0xf6, 0x11, 0x4c, 0xd1, 0x5b, 0xf6, 0x8d, 0x20, 0x8a, 0x51, 0xc5, 0x71,
+	0xfc, 0x68, 0x1e, 0x59, 0xf4, 0x40, 0x4e, 0x3e, 0x9a, 0x19, 0x95, 0x48, 0x86, 0x33, 0x7b, 0x17,
+	0x8d, 0x9e, 0x29, 0xe3, 0xcf, 0xca, 0x1a, 0xbe, 0xc9, 0xc8, 0x13, 0xa8, 0xeb, 0xf9, 0x8e, 0xd2,
+	0x5d, 0x74, 0x93, 0xed, 0x42, 0xc7, 0x66, 0x0f, 0x60, 0xbc, 0xd1, 0xb8, 0x71, 0xcd, 0x13, 0x72,
+	0x49, 0x57, 0x3d, 0xb1, 0xe4, 0x5b, 0xf9, 0x42, 0x61, 0x2b, 0x27, 0xa3, 0x68, 0xdb, 0xd9, 0xf4,
+	0xda, 0xdc, 0x69, 0x06, 0xdd, 0x3d, 0x5b, 0xe7, 0x54, 0xe0, 0xa5, 0x74, 0xea, 0x09, 0x7b, 0x29,
+	0xad, 0xc0, 0xb4, 0x66, 0x79, 0x8f, 0x86, 0x5c, 0xb3, 0x69, 0x84, 0x73, 0xdd, 0x2b, 0x29, 0x1b,
+	0xd4, 0x22, 0x4b, 0xa7, 0xdc, 0x93, 0x4e, 0x1f, 0xd5, 0x3d, 0xc9, 0x83, 0x19, 0xfa, 0x18, 0x72,
+	0x1e, 0xe0, 0x97, 0x9e, 0xeb, 0x33, 0x86, 0x17, 0x0a, 0xc7, 0xf0, 0x98, 0xfc, 0xd2, 0x6a, 0x92,
+	0xa1, 0xed, 0x46, 0x9e, 0x2b, 0xdb, 0x04, 0x26, 0x81, 0x6e, 0xec, 0x6e, 0xb8, 0x11, 0xc7, 0xba,
+	0x9e, 0xe9, 0x53, 0xd7, 0x8b, 0x85, 0x75, 0x4d, 0xa9, 0xba, 0x36, 0xa8, 0x9a, 0x02, 0x8e, 0xcc,
+	0x57, 0xf5, 0xa8, 0xf9, 0x85, 0x03, 0xfb, 0xac, 0xf1, 0x06, 0x91, 0x47, 0x20, 0xc7, 0xe8, 0xec,
+	0xa4, 0xcd, 0x8e, 0x7b, 0x01, 0x67, 0xf6, 0x08, 0x4e, 0xe6, 0x5b, 0x81, 0x75, 0x9e, 0xc1, 0x3a,
+	0xcf, 0x18, 0x75, 0x66, 0x91, 0x68, 0xde, 0x98, 0xdd, 0xca, 0xd6, 0xda, 0x87, 0x3f, 0xfb, 0xd1,
+	0x12, 0x9c, 0xba, 0x7d, 0xad, 0x7e, 0x9f, 0x87, 0x24, 0x96, 0x78, 0x81, 0x9f, 0x04, 0x03, 0x79,
+	0x4e, 0xbe, 0x53, 0x65, 0x9f, 0x1a, 0x95, 0xc4, 0x81, 0x5b, 0x85, 0x10, 0xdd, 0x5f, 0xe8, 0x6c,
+	0xba, 0xce, 0xae, 0xc6, 0xa2, 0x20, 0x62, 0xc8, 0x77, 0x7f, 0x67, 0xbe, 0x64, 0xf7, 0xab, 0x8a,
+	0xb5, 0x61, 0xce, 0x1c, 0x16, 0xe5, 0x40, 0xb6, 0xcd, 0xdb, 0xed, 0xd9, 0x79, 0x9c, 0xd1, 0xaf,
+	0x3d, 0xde, 0x9f, 0x3f, 0x9f, 0x1b, 0xdd, 0xc4, 0x29, 0x4d, 0x60, 0x6a, 0x1d, 0x3e, 0x80, 0x1f,
+	0xeb, 0x14, 0x08, 0xdd, 0xb3, 0x67, 0x8d, 0xa8, 0x81, 0xb9, 0xf2, 0x24, 0xaa, 0xe5, 0x19, 0xb1,
+	0xde, 0xfb, 0x0a, 0x88, 0x76, 0x9e, 0xf3, 0xcd, 0xa1, 0xea, 0x64, 0x6d, 0xaa, 0xc0, 0xb3, 0xca,
+	0xfa, 0xb5, 0x72, 0xe6, 0x60, 0x64, 0x2b, 0x30, 0x2a, 0xe7, 0x7b, 0xdf, 0x4b, 0xc6, 0x99, 0xc2,
+	0x59, 0x3d, 0x2a, 0x97, 0x8e, 0xad, 0xe8, 0xd9, 0x43, 0xc1, 0x0a, 0x3b, 0x2d, 0x6f, 0xbc, 0x5f,
+	0xa3, 0x73, 0x0f, 0x41, 0xc6, 0x09, 0xbf, 0x74, 0x74, 0x2f, 0x64, 0xd3, 0x57, 0x1d, 0x8f, 0x7a,
+	0x55, 0x1b, 0xdb, 0x81, 0x4a, 0xa3, 0x71, 0x43, 0x5e, 0x9a, 0xbf, 0x2c, 0x77, 0xc8, 0x4f, 0xa1,
+	0x42, 0x51, 0x8b, 0xf5, 0xab, 0x25, 0x98, 0x34, 0x4e, 0x56, 0x76, 0x55, 0xf3, 0xd3, 0x4e, 0x5f,
+	0x95, 0x0d, 0x1c, 0xdc, 0x6c, 0xb3, 0x1e, 0xdc, 0x57, 0xb5, 0x78, 0xb9, 0x7d, 0xe8, 0x70, 0xb1,
+	0x65, 0x83, 0x12, 0x1c, 0xac, 0x1f, 0x9e, 0x87, 0x61, 0x0a, 0x98, 0x36, 0x94, 0x9a, 0xe9, 0xa2,
+	0x7e, 0xc5, 0x26, 0xb8, 0xf5, 0xbb, 0xf3, 0x30, 0x65, 0xde, 0x88, 0xd9, 0x6b, 0x30, 0x82, 0x6f,
+	0x27, 0x4a, 0xbd, 0x82, 0x6a, 0x21, 0x7c, 0x5e, 0x31, 0x3c, 0xd9, 0x08, 0x87, 0xbd, 0x04, 0x90,
+	0xb8, 0x7c, 0xa8, 0x37, 0x81, 0xe1, 0xc7, 0xfb, 0xf3, 0xa5, 0xd7, 0x6d, 0xad, 0x80, 0x7d, 0x1d,
+	0xe0, 0x4e, 0xd0, 0xe2, 0x32, 0x73, 0x7a, 0xe5, 0x20, 0xd3, 0xa5, 0x97, 0x73, 0x99, 0xd3, 0x4f,
+	0xf8, 0x41, 0x8b, 0xe7, 0xd3, 0xa4, 0x6b, 0x1c, 0xd9, 0x3b, 0x30, 0x6c, 0xf7, 0xda, 0x5c, 0xbd,
+	0x30, 0x8d, 0xab, 0x13, 0xae, 0xd7, 0xe6, 0xa9, 0x9e, 0x20, 0xec, 0x65, 0xad, 0x72, 0x05, 0x80,
+	0xbd, 0x4f, 0x19, 0xd5, 0x65, 0x56, 0x99, 0xe1, 0xf4, 0x2d, 0x55, 0x93, 0x7c, 0x72, 0x79, 0x65,
+	0x34, 0x12, 0x76, 0x17, 0x46, 0xf5, 0x47, 0x40, 0x2d, 0x5a, 0x8e, 0xfe, 0x50, 0xac, 0x29, 0x1d,
+	0x64, 0x78, 0xfd, 0xec, 0xfb, 0xa0, 0xe2, 0xc2, 0xde, 0x83, 0x31, 0xc1, 0x5e, 0xec, 0x1c, 0x91,
+	0xbc, 0xd5, 0xe0, 0x3b, 0x90, 0xd6, 0x20, 0xb1, 0xfb, 0x18, 0x51, 0xf6, 0x13, 0x02, 0xf6, 0x15,
+	0x18, 0xab, 0x77, 0xbb, 0x72, 0xa8, 0x0f, 0x34, 0x69, 0x3b, 0x97, 0x1b, 0xea, 0xe3, 0x6e, 0xb7,
+	0x9b, 0x1f, 0xe9, 0x94, 0x1f, 0xdb, 0x4a, 0x82, 0xb5, 0x0e, 0x92, 0x05, 0xff, 0x95, 0x5c, 0x05,
+	0xb3, 0x2a, 0xfe, 0x68, 0xae, 0x12, 0x93, 0x2f, 0xeb, 0x42, 0x2d, 0x15, 0x2a, 0x65, 0x5d, 0x70,
+	0x50, 0x5d, 0xaf, 0xe7, 0xea, 0xd2, 0x3f, 0x60, 0xae, 0xba, 0x1c, 0x77, 0xd6, 0x82, 0x29, 0x75,
+	0x40, 0xc9, 0xfa, 0xc6, 0x0f, 0xaa, 0xef, 0xa5, 0x5c, 0x7d, 0xc7, 0x5a, 0x1b, 0xf9, 0x7a, 0x32,
+	0x3c, 0xd9, 0x7b, 0x30, 0xa9, 0x20, 0xb8, 0x3e, 0xd0, 0x94, 0x4c, 0x2a, 0x04, 0x5b, 0x1b, 0xe8,
+	0x64, 0x66, 0x8c, 0x8a, 0x81, 0xac, 0x53, 0xd3, 0xec, 0x98, 0x34, 0xa8, 0xb3, 0xb3, 0xc2, 0x44,
+	0x66, 0x5f, 0x86, 0xf1, 0x95, 0x8e, 0xe8, 0x48, 0xe0, 0xbb, 0x31, 0x97, 0xae, 0xe0, 0xca, 0x3c,
+	0x4f, 0x2b, 0xd1, 0xa6, 0x2a, 0x1a, 0x26, 0x79, 0x69, 0x91, 0x7e, 0xcd, 0xd4, 0x28, 0xc4, 0xe0,
+	0xd1, 0xab, 0xaf, 0x9c, 0xc3, 0xca, 0x4d, 0xfc, 0x4c, 0x81, 0x89, 0x9c, 0xc6, 0x5e, 0x66, 0x10,
+	0x11, 0x50, 0xf5, 0xea, 0x9a, 0xc9, 0xde, 0xa4, 0xf3, 0x64, 0x5f, 0x80, 0xf1, 0xfa, 0x83, 0x86,
+	0xd8, 0xb0, 0xea, 0xf6, 0x9d, 0x68, 0xb6, 0x96, 0x5a, 0xf8, 0xbb, 0x0f, 0xe9, 0xd5, 0xd1, 0x71,
+	0xc3, 0x8c, 0x2d, 0x78, 0x8a, 0xcf, 0x3e, 0x84, 0xe3, 0x0f, 0x3c, 0xbf, 0x15, 0x3c, 0x8c, 0xe4,
+	0x31, 0x25, 0x37, 0xba, 0x99, 0xf4, 0x29, 0xf3, 0x21, 0x95, 0x27, 0xb2, 0x60, 0x6e, 0xe3, 0x2b,
+	0xe4, 0xc0, 0x7e, 0x24, 0xc7, 0x99, 0x66, 0x10, 0x3b, 0x68, 0x06, 0x5d, 0xce, 0xcd, 0xa0, 0x7c,
+	0xf5, 0xd9, 0xe9, 0x54, 0x58, 0x0d, 0x0b, 0x80, 0x99, 0xe7, 0xfb, 0xcd, 0xc0, 0xf3, 0x67, 0x8f,
+	0xe1, 0x5e, 0xf8, 0x4c, 0x36, 0x60, 0x0c, 0xe2, 0xad, 0x05, 0x6d, 0xaf, 0xb9, 0x47, 0x39, 0xfc,
+	0xb2, 0x32, 0xff, 0x47, 0x81, 0xf1, 0x5c, 0x52, 0xc0, 0x9a, 0x7d, 0x19, 0x26, 0xc4, 0xff, 0x89,
+	0x52, 0xe2, 0xb8, 0x61, 0x54, 0xad, 0x61, 0xca, 0x7a, 0xf0, 0x1b, 0x09, 0xbe, 0x45, 0xfa, 0x0a,
+	0x83, 0x15, 0x7b, 0x1b, 0x40, 0x88, 0x4d, 0x72, 0x3b, 0x3e, 0x91, 0x26, 0xcb, 0x42, 0xa9, 0x2b,
+	0xbf, 0x11, 0xa7, 0xc8, 0xec, 0x3d, 0x18, 0x17, 0xbf, 0x1a, 0xbd, 0x56, 0x20, 0xd6, 0xc6, 0x49,
+	0xa4, 0x25, 0xaf, 0x7c, 0x41, 0x1b, 0x11, 0xdc, 0xf0, 0xca, 0x4f, 0xd1, 0xd9, 0x0d, 0x98, 0xc6,
+	0xa4, 0x66, 0x32, 0x9d, 0x8e, 0xc7, 0xa3, 0xd9, 0x53, 0xda, 0x1b, 0x3c, 0x66, 0xf1, 0xf7, 0x92,
+	0x32, 0xfd, 0x2e, 0x93, 0x21, 0x63, 0x11, 0x1c, 0xcb, 0xbf, 0x41, 0x47, 0xb3, 0xb3, 0x38, 0x48,
+	0x4a, 0x82, 0xcf, 0x63, 0xd0, 0x7e, 0x2c, 0xbe, 0x88, 0xb6, 0x71, 0xa9, 0x47, 0x25, 0xbd, 0xc2,
+	0x22, 0xee, 0xcc, 0x06, 0x76, 0x7d, 0x71, 0x2d, 0x9b, 0xf5, 0xeb, 0x34, 0xf6, 0x00, 0x3f, 0xf3,
+	0x56, 0xb3, 0xeb, 0x1c, 0x90, 0xf9, 0xab, 0x80, 0x9a, 0xfd, 0x09, 0x38, 0xa1, 0x76, 0x10, 0x59,
+	0x24, 0xe7, 0xf5, 0xdc, 0x11, 0x77, 0xe2, 0xd6, 0x46, 0x52, 0x75, 0x6e, 0x4a, 0x17, 0x57, 0xc1,
+	0x5c, 0x18, 0xc7, 0xcf, 0x2a, 0x6b, 0x7c, 0xe6, 0xa0, 0x1a, 0xcf, 0xe7, 0x6a, 0x3c, 0x89, 0x13,
+	0x25, 0x5f, 0x99, 0xce, 0x93, 0xd2, 0x78, 0xe0, 0x3a, 0x92, 0xb3, 0xed, 0x59, 0x1c, 0x2d, 0x99,
+	0xc6, 0x83, 0x56, 0x60, 0x6e, 0xc2, 0x99, 0x24, 0xfa, 0x8e, 0x4c, 0x8f, 0x49, 0x67, 0x8c, 0x1d,
+	0x39, 0x67, 0x09, 0x61, 0x20, 0x8b, 0x1d, 0x29, 0x95, 0x62, 0x96, 0x1f, 0x75, 0x43, 0xa9, 0xa2,
+	0x7a, 0x2e, 0xcd, 0x63, 0xae, 0x09, 0x3f, 0x0e, 0x4f, 0x30, 0xf4, 0x2d, 0xa1, 0x88, 0x03, 0xbb,
+	0x07, 0xc7, 0x92, 0x53, 0x5b, 0x63, 0x3c, 0x9f, 0xe6, 0x95, 0x4a, 0x8f, 0xfa, 0x62, 0xbe, 0x45,
+	0xf4, 0xcc, 0x85, 0x53, 0xc6, 0x39, 0xad, 0xb1, 0x3e, 0x8b, 0xac, 0x5f, 0x16, 0x37, 0x32, 0xf3,
+	0x90, 0x2f, 0x66, 0xdf, 0x8f, 0x0f, 0xfb, 0x08, 0xe6, 0xb2, 0x67, 0xb3, 0x56, 0xcb, 0xf3, 0x58,
+	0xcb, 0x2b, 0x8f, 0xf7, 0xe7, 0xcf, 0xe5, 0x8e, 0xf7, 0xe2, 0x8a, 0x0e, 0xe0, 0xc6, 0xbe, 0x0e,
+	0xb3, 0xe6, 0xf9, 0xac, 0xd5, 0x64, 0x61, 0x4d, 0xb8, 0x74, 0x92, 0x83, 0xbd, 0xb8, 0x86, 0xbe,
+	0x3c, 0x58, 0x0c, 0xf3, 0x85, 0xb3, 0x5b, 0xab, 0xe6, 0x85, 0xb4, 0x43, 0xb9, 0x55, 0x52, 0x5c,
+	0xdd, 0x61, 0x2c, 0xd9, 0x43, 0x78, 0xae, 0xe8, 0x98, 0xd0, 0x2a, 0x7d, 0x31, 0x51, 0x02, 0xbf,
+	0x5a, 0x7c, 0xe4, 0x14, 0xd7, 0x7c, 0x08, 0x5b, 0xf6, 0x15, 0x38, 0xa1, 0xad, 0x2f, 0xad, 0xbe,
+	0x97, 0xb0, 0x3e, 0x8c, 0x23, 0xa1, 0x2f, 0xcc, 0xe2, 0x5a, 0x8a, 0x79, 0xb0, 0x0e, 0x1c, 0x53,
+	0x1d, 0x47, 0x6d, 0xbb, 0x3c, 0x7a, 0xce, 0x19, 0xbb, 0x6a, 0x1e, 0x63, 0xe1, 0xac, 0xdc, 0x55,
+	0x67, 0x5b, 0x1b, 0x4e, 0x37, 0x25, 0xd4, 0x67, 0x7a, 0x01, 0x5f, 0x76, 0x03, 0x46, 0x1a, 0x6b,
+	0x2b, 0xd7, 0xae, 0x2d, 0xcf, 0xbe, 0x8c, 0x35, 0x28, 0x4f, 0x51, 0x02, 0x1a, 0x97, 0x26, 0x69,
+	0x4e, 0xda, 0xf5, 0x36, 0x37, 0x8d, 0x07, 0x2b, 0x42, 0x65, 0x3f, 0x82, 0x86, 0x9c, 0x62, 0x47,
+	0xad, 0x47, 0x91, 0xb7, 0xe5, 0x53, 0xc6, 0xae, 0x57, 0x8c, 0xf7, 0x7e, 0x95, 0xc3, 0x6d, 0x91,
+	0xfb, 0x31, 0x0f, 0x73, 0xe8, 0x24, 0x6d, 0x8a, 0xfb, 0xbf, 0xdc, 0xb9, 0x1d, 0x37, 0x65, 0xa5,
+	0x6f, 0xe2, 0xf9, 0x8a, 0xc4, 0xb8, 0x6d, 0x79, 0xb1, 0xb3, 0xdd, 0x33, 0xba, 0x3f, 0xfb, 0xaa,
+	0x11, 0xc2, 0xed, 0xba, 0x17, 0xdf, 0xe8, 0x6d, 0x68, 0xa3, 0xf6, 0xa2, 0xac, 0xf0, 0x59, 0xba,
+	0x2d, 0xf7, 0x19, 0xb9, 0x99, 0xad, 0x0c, 0x5d, 0xc4, 0xfe, 0x4c, 0x09, 0x4e, 0x3e, 0x08, 0xc2,
+	0x9d, 0x76, 0xe0, 0xb6, 0x54, 0xaf, 0xe4, 0x1e, 0xfe, 0xda, 0x41, 0x7b, 0xf8, 0x67, 0x73, 0x7b,
+	0xb8, 0xf5, 0x50, 0xb2, 0x71, 0x92, 0x14, 0x78, 0xb9, 0xfd, 0xbc, 0x4f, 0x55, 0xec, 0x47, 0xe0,
+	0x6c, 0x71, 0x89, 0x36, 0x29, 0x5f, 0xc7, 0x49, 0xf9, 0xe6, 0xe3, 0xfd, 0xf9, 0xd7, 0xfb, 0xd5,
+	0x54, 0x3c, 0x41, 0x0f, 0x65, 0xcd, 0xde, 0x81, 0xca, 0xed, 0xc5, 0xb5, 0xd9, 0x8b, 0xc6, 0xd3,
+	0xf3, 0xed, 0xc5, 0x35, 0x6d, 0xa0, 0x48, 0xa3, 0xd9, 0x69, 0x1a, 0x1a, 0xcd, 0xdb, 0x8b, 0x6b,
+	0x37, 0x87, 0xaa, 0xe7, 0x6b, 0x17, 0x6e, 0x0e, 0x55, 0x2f, 0xd4, 0x5e, 0xb1, 0x9f, 0x6d, 0xd4,
+	0x6f, 0xaf, 0xae, 0xb4, 0xd4, 0xc1, 0xac, 0x32, 0xfc, 0x51, 0x7d, 0xf6, 0xb9, 0x83, 0x4a, 0xd3,
+	0xd6, 0x58, 0x7f, 0xb9, 0x04, 0xf3, 0x87, 0x4c, 0x30, 0x71, 0x16, 0xa6, 0x8d, 0x6b, 0x24, 0xf9,
+	0x6d, 0xc8, 0x0d, 0x35, 0x29, 0x70, 0x4c, 0x93, 0x13, 0x93, 0x04, 0x5d, 0x94, 0x65, 0x72, 0x5a,
+	0xcd, 0x53, 0x3d, 0x9f, 0x94, 0x56, 0x61, 0x59, 0xab, 0x50, 0xcb, 0x4e, 0x3c, 0xf6, 0x79, 0x98,
+	0xd4, 0x73, 0xb2, 0x29, 0x35, 0x04, 0xc5, 0x67, 0x0a, 0xb7, 0x8c, 0xc3, 0xd4, 0x40, 0xb4, 0xce,
+	0xc1, 0x94, 0x39, 0xc4, 0xec, 0x38, 0x0c, 0xc7, 0x41, 0xd0, 0x96, 0x3c, 0x6c, 0xfa, 0x61, 0xfd,
+	0x7c, 0x09, 0x8e, 0x15, 0xac, 0x62, 0x76, 0x0e, 0x86, 0xd6, 0xdc, 0x78, 0x5b, 0xb7, 0x4c, 0xea,
+	0xba, 0x46, 0x24, 0x36, 0x2c, 0x67, 0x6f, 0xc0, 0xe8, 0xd2, 0x9d, 0x46, 0xa3, 0x7e, 0x47, 0x29,
+	0x3c, 0xe8, 0xb0, 0xf7, 0x23, 0x27, 0x72, 0x4d, 0x83, 0x06, 0x89, 0xc6, 0x5e, 0x87, 0x91, 0x95,
+	0x35, 0x24, 0xd0, 0xf2, 0xeb, 0x79, 0xdd, 0x2c, 0xbe, 0x44, 0xb2, 0xbe, 0x53, 0x02, 0x96, 0xdf,
+	0x92, 0xd8, 0x9b, 0x30, 0xae, 0x6f, 0x7c, 0x34, 0x2e, 0xf8, 0xca, 0xab, 0x2d, 0x4e, 0x5b, 0xc7,
+	0x61, 0x4b, 0x30, 0x8c, 0x79, 0xb7, 0x13, 0x4b, 0x8a, 0xc2, 0xa5, 0x77, 0x2a, 0xb7, 0xf4, 0x86,
+	0x31, 0x97, 0xb7, 0x4d, 0xc4, 0xd6, 0x1f, 0x94, 0x80, 0x15, 0x1b, 0x55, 0x0e, 0x64, 0xc9, 0xf5,
+	0x96, 0x16, 0x11, 0x45, 0xb7, 0xaa, 0xf4, 0x15, 0x50, 0x57, 0x35, 0xa4, 0xb1, 0x53, 0xce, 0x19,
+	0xaa, 0xad, 0xfe, 0x6e, 0xf4, 0x17, 0x60, 0xf8, 0x3e, 0x0f, 0x37, 0x94, 0x69, 0x3f, 0x9a, 0x03,
+	0xef, 0x0a, 0x80, 0xae, 0xea, 0x41, 0x0c, 0xc3, 0xbc, 0x73, 0x78, 0x50, 0xf3, 0xce, 0xdf, 0x2d,
+	0xc1, 0xf1, 0xa2, 0xcb, 0xd3, 0x21, 0x2e, 0xf2, 0x56, 0xc6, 0xbb, 0x1f, 0x4d, 0xbf, 0xc8, 0xc0,
+	0x38, 0xf1, 0xe9, 0x9f, 0x87, 0x61, 0x31, 0x42, 0x6a, 0x5a, 0xa0, 0x7e, 0x4e, 0x0c, 0x61, 0x64,
+	0x13, 0x5c, 0x20, 0xa4, 0x09, 0x9a, 0x86, 0x09, 0x81, 0xf2, 0x32, 0x11, 0x5c, 0x20, 0xdc, 0x0e,
+	0x5a, 0x5c, 0xe9, 0xad, 0x10, 0xa1, 0x23, 0x00, 0x36, 0xc1, 0xd9, 0x39, 0x18, 0xbd, 0xeb, 0xaf,
+	0x72, 0x77, 0x57, 0xa5, 0x5f, 0x45, 0x53, 0xb5, 0xc0, 0x77, 0xda, 0x02, 0x66, 0xab, 0x42, 0xeb,
+	0xa7, 0x4b, 0x30, 0x93, 0xbb, 0xb7, 0x1d, 0x1e, 0x05, 0xe0, 0x60, 0xcf, 0xd6, 0x41, 0xfa, 0x47,
+	0xcd, 0x1f, 0x2a, 0x6e, 0xbe, 0xf5, 0xdf, 0x8f, 0xc0, 0xa9, 0x3e, 0x6a, 0xb4, 0xd4, 0xf3, 0xbe,
+	0x74, 0xa8, 0xe7, 0xfd, 0x57, 0x61, 0x72, 0xb1, 0xed, 0x7a, 0x9d, 0x68, 0x3d, 0x48, 0x5b, 0x9c,
+	0x3a, 0xf0, 0x61, 0x99, 0x74, 0xa0, 0x49, 0x3c, 0xbd, 0x4e, 0x37, 0x91, 0xc2, 0x89, 0x83, 0xbc,
+	0x14, 0x6f, 0x30, 0xcb, 0xf9, 0xbe, 0x57, 0xfe, 0x88, 0xf8, 0xbe, 0x9b, 0xde, 0x98, 0x43, 0x4f,
+	0xd4, 0x1b, 0xb3, 0xd8, 0x59, 0x60, 0xf8, 0x93, 0xb8, 0x8e, 0x2c, 0x66, 0x4d, 0xcc, 0x47, 0x72,
+	0xf6, 0x7d, 0x87, 0xdb, 0x96, 0xdf, 0x30, 0x3d, 0x07, 0x47, 0xf1, 0x31, 0xfb, 0x5c, 0x7f, 0xcf,
+	0x40, 0x33, 0xfc, 0x94, 0xee, 0x21, 0xf8, 0x2d, 0x38, 0x5e, 0x74, 0x0f, 0x9f, 0xad, 0x1a, 0x66,
+	0xc0, 0x7d, 0x6d, 0xce, 0x07, 0xbf, 0xcd, 0xef, 0x14, 0xde, 0xe6, 0x55, 0x44, 0x87, 0xb1, 0xfe,
+	0xee, 0x70, 0xe9, 0x5a, 0x20, 0xdc, 0x83, 0xe3, 0x3e, 0x58, 0xff, 0x5e, 0x36, 0x26, 0x47, 0x96,
+	0x9e, 0xbd, 0x6b, 0x84, 0x4e, 0x7b, 0x39, 0x1f, 0x3a, 0xad, 0x38, 0x0c, 0x07, 0x3d, 0x45, 0xbc,
+	0x06, 0x23, 0xd2, 0x16, 0x44, 0x0b, 0x67, 0x92, 0xb3, 0x01, 0x91, 0x38, 0xd6, 0x4f, 0x97, 0xcd,
+	0xb0, 0x03, 0x7f, 0x14, 0xd7, 0xf5, 0x05, 0x18, 0x7e, 0xb0, 0xcd, 0x43, 0x75, 0x04, 0x61, 0x43,
+	0x1e, 0x0a, 0x80, 0xde, 0x10, 0xc4, 0x60, 0xd7, 0x60, 0x6a, 0x8d, 0xe6, 0xb9, 0x9a, 0xbc, 0x43,
+	0xa9, 0xee, 0xa8, 0x2b, 0x35, 0x9c, 0x05, 0xb3, 0x37, 0x43, 0x65, 0x5d, 0xcf, 0x7c, 0x22, 0x19,
+	0x26, 0x8e, 0x3c, 0xf0, 0x48, 0x48, 0x99, 0x4a, 0x1d, 0x42, 0xd3, 0xbd, 0xd9, 0xce, 0x40, 0xad,
+	0x4d, 0x78, 0xee, 0x40, 0x46, 0x42, 0x36, 0x80, 0x6e, 0xf2, 0x2b, 0x63, 0x41, 0x7e, 0x20, 0xa9,
+	0xad, 0xd1, 0x59, 0xab, 0xa9, 0x8f, 0xe8, 0xca, 0x12, 0x3a, 0xa9, 0xbe, 0x03, 0x13, 0xba, 0xbf,
+	0x86, 0xe4, 0x5c, 0xe0, 0xde, 0x31, 0x24, 0x3e, 0x88, 0x3d, 0xae, 0x90, 0x57, 0x5a, 0x91, 0xf5,
+	0xcf, 0x2b, 0x30, 0xdb, 0xcf, 0x4b, 0x92, 0xfd, 0x44, 0x12, 0x71, 0x07, 0x5d, 0x10, 0x03, 0xd3,
+	0x57, 0x66, 0xfc, 0xf2, 0x3b, 0x87, 0xb8, 0x59, 0x5e, 0x2c, 0x24, 0x26, 0xe3, 0xe7, 0xc4, 0xd5,
+	0x04, 0xe5, 0x00, 0xde, 0x72, 0x36, 0xf6, 0x1c, 0xcd, 0x1f, 0xd7, 0x2e, 0xae, 0x98, 0x7d, 0x00,
+	0x27, 0x6c, 0xde, 0x0c, 0x3a, 0x1d, 0xee, 0xb7, 0x74, 0xff, 0x48, 0xb9, 0x04, 0x64, 0xf0, 0x99,
+	0x04, 0xc1, 0x64, 0x59, 0x48, 0xc9, 0xee, 0xc0, 0x4c, 0x1a, 0xdd, 0x4e, 0xe5, 0x37, 0xd1, 0xd2,
+	0x80, 0xa5, 0xd1, 0xf8, 0x54, 0x76, 0x13, 0xfd, 0x3e, 0x96, 0x23, 0x65, 0x97, 0x00, 0x16, 0x5d,
+	0x7f, 0x2d, 0x0c, 0x9a, 0x5c, 0x06, 0x88, 0xa8, 0x4a, 0xd3, 0x40, 0x17, 0x23, 0xe2, 0x08, 0xb0,
+	0xad, 0xa1, 0xcc, 0x39, 0x30, 0xd7, 0x7f, 0xa0, 0x0a, 0x0c, 0xb8, 0x5f, 0x35, 0xfd, 0x02, 0x4e,
+	0xe4, 0x3e, 0xb4, 0xe0, 0xa3, 0xdb, 0x75, 0x7f, 0x0b, 0x26, 0xf4, 0x85, 0x89, 0x42, 0x8e, 0xf8,
+	0x2d, 0xb7, 0x1d, 0x12, 0x72, 0x04, 0xc0, 0x26, 0x78, 0xfa, 0x8c, 0x59, 0x2e, 0x7e, 0xc6, 0x4c,
+	0x77, 0x8c, 0xca, 0x61, 0x3b, 0x86, 0xa8, 0x1c, 0xcf, 0x50, 0xad, 0x72, 0xfc, 0xad, 0x57, 0x8e,
+	0xf1, 0xfe, 0x6c, 0x82, 0x3f, 0xd1, 0xca, 0xff, 0xbe, 0xca, 0xf5, 0x8d, 0x3e, 0xa1, 0xa6, 0xa7,
+	0x97, 0xf4, 0x09, 0xcd, 0x9f, 0x0f, 0x29, 0x66, 0x2a, 0xea, 0x96, 0x0f, 0x15, 0x75, 0x8f, 0xb0,
+	0x77, 0xe1, 0xb5, 0x8d, 0x76, 0x81, 0xa1, 0xf4, 0x7a, 0xe2, 0xe6, 0x0c, 0xbd, 0x14, 0x96, 0xf5,
+	0xdd, 0x12, 0x9c, 0x28, 0x7c, 0x2e, 0x12, 0xb5, 0xd2, 0xbb, 0x94, 0xb6, 0x75, 0x67, 0x1f, 0xa5,
+	0x08, 0xe3, 0x28, 0x71, 0x93, 0x06, 0xef, 0x8b, 0xf5, 0x3c, 0x8c, 0x25, 0xc6, 0x0a, 0xe2, 0xfa,
+	0x47, 0x9f, 0x8e, 0x02, 0xc3, 0xca, 0x37, 0xef, 0x9f, 0x2f, 0x01, 0x88, 0x26, 0x7c, 0x8a, 0x6e,
+	0x05, 0x34, 0x06, 0x7d, 0xdc, 0x0a, 0xb2, 0xe3, 0x91, 0xa5, 0xb3, 0xfe, 0x7e, 0x19, 0x46, 0xc4,
+	0x5f, 0x4f, 0x6d, 0x38, 0xfc, 0x62, 0xb7, 0x02, 0xd1, 0xa5, 0x03, 0x92, 0x7f, 0x2c, 0x67, 0x92,
+	0x7f, 0x1c, 0xd3, 0xc9, 0x54, 0x5a, 0xde, 0x24, 0x78, 0x50, 0xbf, 0x64, 0x1f, 0x9a, 0x77, 0xc2,
+	0x3f, 0x29, 0xc1, 0x84, 0x4e, 0xcc, 0xbe, 0x0c, 0x53, 0x2a, 0xc4, 0x37, 0x05, 0xd4, 0x92, 0x56,
+	0x1a, 0xca, 0xa2, 0x52, 0x85, 0xf8, 0xd6, 0x03, 0x70, 0x19, 0xf8, 0xba, 0xa4, 0xd0, 0xd5, 0x91,
+	0x59, 0x0b, 0x58, 0x67, 0xd3, 0x75, 0x1e, 0x72, 0x77, 0x87, 0x47, 0xb1, 0x43, 0x96, 0x6f, 0xd2,
+	0x98, 0x43, 0xb1, 0xbf, 0x7d, 0xad, 0x4e, 0x46, 0x6f, 0x18, 0x56, 0x80, 0x62, 0xb5, 0xe7, 0x68,
+	0xf4, 0x17, 0xea, 0xce, 0xa6, 0xfb, 0x80, 0x0a, 0x89, 0xce, 0xfa, 0xfd, 0x11, 0x9a, 0xb9, 0x32,
+	0x27, 0xc0, 0x06, 0x4c, 0xdd, 0x5d, 0x59, 0x5a, 0xd4, 0xde, 0xab, 0xcc, 0xb4, 0x0c, 0xcb, 0x8f,
+	0x62, 0x1e, 0xfa, 0x6e, 0x5b, 0xa9, 0x7e, 0x52, 0x09, 0x28, 0xf0, 0x5a, 0xcd, 0xe2, 0xb7, 0xac,
+	0x0c, 0x47, 0x51, 0x07, 0x29, 0x99, 0x92, 0x3a, 0xca, 0x03, 0xd6, 0x11, 0xb9, 0x9d, 0x76, 0x9f,
+	0x3a, 0x4c, 0x8e, 0x6c, 0x1b, 0xb5, 0x40, 0xdb, 0xbd, 0x0d, 0xad, 0x96, 0xca, 0xc1, 0xb5, 0xbc,
+	0x20, 0x6b, 0x79, 0x46, 0x6a, 0x27, 0x0b, 0xeb, 0xc9, 0x71, 0x4d, 0xf7, 0x9c, 0xa1, 0x43, 0xf7,
+	0x9c, 0x3f, 0x5b, 0x82, 0x11, 0xba, 0x6c, 0xc9, 0x69, 0xdc, 0xe7, 0x3a, 0xf7, 0xe0, 0xc9, 0x5c,
+	0xe7, 0x6a, 0x78, 0xe6, 0x18, 0x13, 0x9a, 0xca, 0xd8, 0x52, 0x66, 0x5d, 0xb0, 0x44, 0xca, 0xd9,
+	0xf2, 0x7c, 0x2d, 0x07, 0xce, 0x81, 0xcb, 0x82, 0xad, 0xa4, 0xe1, 0x9c, 0x46, 0x0f, 0x8d, 0xe1,
+	0xa1, 0x42, 0x60, 0x8d, 0xca, 0x70, 0x4e, 0x66, 0x10, 0xa7, 0x55, 0x18, 0x93, 0x41, 0xa2, 0x16,
+	0xf6, 0xa4, 0x7d, 0x49, 0xcd, 0xb0, 0x10, 0x6c, 0x2d, 0xec, 0xa5, 0x17, 0x49, 0x19, 0x66, 0xca,
+	0xd9, 0xd0, 0xbd, 0x6b, 0x52, 0x06, 0xec, 0x2e, 0x8c, 0xa5, 0x39, 0x13, 0xcc, 0x1c, 0x63, 0x09,
+	0x5c, 0xc6, 0xcc, 0x54, 0x91, 0x66, 0x0a, 0x52, 0x24, 0xa4, 0x3c, 0xd8, 0x2a, 0xd4, 0xd0, 0xaa,
+	0x94, 0xb7, 0x68, 0xd5, 0xac, 0x2c, 0x51, 0x20, 0x22, 0x29, 0x3e, 0xc5, 0x54, 0x26, 0x97, 0x5b,
+	0xc6, 0xa1, 0x38, 0x47, 0x69, 0xfd, 0x54, 0x19, 0x6a, 0xd9, 0xd9, 0xc7, 0xde, 0x83, 0xf1, 0x24,
+	0x67, 0x45, 0x12, 0xe8, 0x02, 0xdf, 0x99, 0xd3, 0x24, 0x17, 0x46, 0xc8, 0x0b, 0x1d, 0x9d, 0x5d,
+	0x86, 0xaa, 0x58, 0xc4, 0x7e, 0x1a, 0x72, 0x18, 0xb7, 0xed, 0x9e, 0x84, 0xe9, 0x3a, 0x28, 0x85,
+	0xc7, 0x1a, 0x70, 0x4c, 0x2c, 0x9a, 0x86, 0xe7, 0x6f, 0xb5, 0xf9, 0x6a, 0xb0, 0x15, 0xf4, 0xe2,
+	0x7b, 0xf6, 0xaa, 0xdc, 0xc3, 0xe9, 0xba, 0xed, 0x76, 0xda, 0x46, 0x71, 0xa8, 0xdb, 0x23, 0x16,
+	0x51, 0xb3, 0xd7, 0xe9, 0x98, 0x59, 0x59, 0x92, 0xe6, 0x61, 0x78, 0xec, 0xa3, 0x59, 0xa3, 0xd1,
+	0x78, 0x89, 0xa4, 0xed, 0xac, 0xbf, 0x53, 0x86, 0x71, 0x6d, 0xfa, 0xb1, 0x0b, 0x50, 0x5d, 0x89,
+	0x56, 0x83, 0xe6, 0x4e, 0x12, 0x83, 0x79, 0xf2, 0xf1, 0xfe, 0xfc, 0x98, 0x17, 0x39, 0x6d, 0x04,
+	0xda, 0x49, 0x31, 0x5b, 0x80, 0x49, 0xfa, 0x4b, 0x49, 0xb6, 0xe5, 0x54, 0xcd, 0x4c, 0xc8, 0x05,
+	0x52, 0xad, 0x49, 0xc2, 0xbe, 0x06, 0x40, 0x00, 0x0c, 0x80, 0x53, 0x19, 0x3c, 0x74, 0x8f, 0xac,
+	0xa0, 0x20, 0xf4, 0x8d, 0xc6, 0x90, 0x7d, 0x83, 0x52, 0x62, 0xa8, 0xe5, 0x32, 0x34, 0x78, 0xec,
+	0x21, 0xc1, 0xdf, 0x29, 0x0e, 0x81, 0xa6, 0xb3, 0x94, 0xc9, 0x36, 0xe7, 0x54, 0x66, 0xf5, 0x7a,
+	0x8c, 0x88, 0x1a, 0x86, 0xf5, 0xbf, 0x97, 0xb4, 0x45, 0xc6, 0xee, 0xc0, 0x58, 0x32, 0x81, 0xa4,
+	0x65, 0x66, 0x72, 0xc3, 0x55, 0x70, 0x9b, 0x6f, 0x2e, 0x3c, 0x23, 0x8d, 0x44, 0x8f, 0x25, 0xd3,
+	0xd0, 0x58, 0x73, 0x0a, 0xc8, 0xbe, 0x04, 0x43, 0x38, 0x74, 0xe5, 0x43, 0xbb, 0xa6, 0x4e, 0xf9,
+	0x21, 0x31, 0x66, 0xd8, 0x11, 0xa4, 0x64, 0x6f, 0xc8, 0xa8, 0x01, 0x34, 0xf8, 0x53, 0xda, 0x51,
+	0x2d, 0xda, 0x91, 0x1c, 0xef, 0x69, 0x14, 0x3c, 0x6d, 0xf6, 0xfc, 0xe5, 0x32, 0xd4, 0xb2, 0x4b,
+	0x9b, 0xbd, 0x0f, 0x13, 0xea, 0xf8, 0xbd, 0xe1, 0xca, 0xb4, 0x73, 0x13, 0x32, 0xed, 0x9b, 0x3a,
+	0x83, 0xb7, 0x5d, 0xdd, 0x92, 0xd3, 0x36, 0x08, 0x84, 0x2c, 0xb4, 0x2e, 0x43, 0xe9, 0x6a, 0x8b,
+	0x2a, 0x0e, 0xe2, 0x6e, 0x26, 0x13, 0x83, 0x42, 0x63, 0x6f, 0x41, 0xe5, 0xf6, 0xb5, 0xba, 0xf4,
+	0x93, 0xad, 0x65, 0x0f, 0x69, 0xf9, 0x3c, 0x63, 0x98, 0xbf, 0x0b, 0x7c, 0xb6, 0xaa, 0x25, 0x2d,
+	0x19, 0x31, 0xac, 0x76, 0x15, 0x38, 0xe9, 0xdc, 0xe1, 0xd9, 0x4b, 0x6e, 0x0e, 0x55, 0x2b, 0xb5,
+	0x21, 0x19, 0xc8, 0xfe, 0x7f, 0xaa, 0xc0, 0x58, 0x52, 0x3f, 0x63, 0x7a, 0xc8, 0x02, 0x19, 0x9e,
+	0xe0, 0x34, 0x54, 0x95, 0x74, 0x27, 0xdd, 0x65, 0x47, 0x23, 0x29, 0xd9, 0xcd, 0x82, 0x12, 0xe3,
+	0x68, 0x57, 0xb0, 0xd5, 0x4f, 0xf6, 0x26, 0x24, 0x32, 0x5a, 0x3f, 0x61, 0x8e, 0x6e, 0xe2, 0x09,
+	0x1a, 0x9b, 0x82, 0xb2, 0x47, 0xc1, 0x41, 0xc7, 0xec, 0xb2, 0xd7, 0x62, 0xef, 0x43, 0xd5, 0x6d,
+	0xe1, 0xfd, 0x75, 0x90, 0x0c, 0xfc, 0x55, 0xc1, 0x8d, 0xce, 0x0c, 0xa4, 0xaa, 0xc7, 0xac, 0x0e,
+	0x63, 0x94, 0x6d, 0x21, 0xe2, 0xad, 0x01, 0x0e, 0xa0, 0x94, 0x03, 0x26, 0x69, 0xb8, 0x17, 0xf1,
+	0x16, 0x7b, 0x19, 0x86, 0xc4, 0xd7, 0x94, 0x27, 0x8e, 0x12, 0x2a, 0xc5, 0xc7, 0xa4, 0x01, 0xbb,
+	0xf1, 0x19, 0x1b, 0x11, 0xd8, 0x8b, 0x50, 0xe9, 0x5d, 0xde, 0x94, 0x67, 0x49, 0x2d, 0x4d, 0x20,
+	0x94, 0xa0, 0x89, 0x62, 0x76, 0x05, 0xaa, 0x0f, 0xcd, 0xdc, 0x33, 0x27, 0x32, 0x9f, 0x31, 0xc1,
+	0x4f, 0x10, 0xd9, 0xcb, 0x50, 0x89, 0xa2, 0x40, 0xda, 0x05, 0x1e, 0x4b, 0x8c, 0xb5, 0xef, 0x26,
+	0x5f, 0x4d, 0x70, 0x8f, 0xa2, 0x60, 0xa1, 0x0a, 0x23, 0x74, 0xc0, 0x58, 0xcf, 0x01, 0xa4, 0x6d,
+	0xcc, 0xdf, 0x9e, 0xad, 0xaf, 0xc1, 0x58, 0xd2, 0x36, 0x76, 0x06, 0x60, 0x87, 0xef, 0x39, 0xdb,
+	0xae, 0xdf, 0x6a, 0x93, 0x74, 0x3a, 0x61, 0x8f, 0xed, 0xf0, 0xbd, 0x1b, 0x08, 0x60, 0xa7, 0x60,
+	0xb4, 0x2b, 0x3e, 0xbf, 0x9c, 0xe3, 0x13, 0xf6, 0x48, 0xb7, 0xb7, 0x21, 0xa6, 0xf2, 0x2c, 0x8c,
+	0xe2, 0xab, 0x80, 0x5c, 0x91, 0x93, 0xb6, 0xfa, 0x69, 0xfd, 0xab, 0x0a, 0xe6, 0x37, 0xd5, 0x3a,
+	0xc4, 0x5e, 0x80, 0xc9, 0x66, 0xc8, 0xf1, 0x2c, 0x73, 0x85, 0x84, 0x26, 0xeb, 0x99, 0x48, 0x81,
+	0x2b, 0x2d, 0x76, 0x0e, 0xa6, 0xbb, 0xbd, 0x8d, 0xb6, 0xd7, 0xc4, 0x1c, 0x6b, 0xcd, 0x0d, 0x99,
+	0x53, 0x6a, 0xc2, 0x9e, 0x24, 0xf0, 0x2d, 0xbe, 0xb7, 0xb8, 0x81, 0xd1, 0x6f, 0x6b, 0x7a, 0xf2,
+	0x06, 0xcc, 0xad, 0x47, 0xf3, 0x6f, 0x5a, 0x83, 0xa3, 0x89, 0xf3, 0x49, 0x18, 0x71, 0xdd, 0xad,
+	0x9e, 0x47, 0x4a, 0x88, 0x09, 0x5b, 0xfe, 0x62, 0xaf, 0xc2, 0x4c, 0x9a, 0x0d, 0x45, 0x75, 0x63,
+	0x18, 0xbb, 0x51, 0x4b, 0x0a, 0x16, 0x09, 0xce, 0x5e, 0x07, 0xa6, 0xd7, 0x17, 0x6c, 0x7c, 0xc4,
+	0x9b, 0x34, 0x27, 0x27, 0xec, 0x19, 0xad, 0xe4, 0x2e, 0x16, 0xb0, 0xe7, 0x51, 0x17, 0x85, 0xd2,
+	0x21, 0x0e, 0x1b, 0xa6, 0xff, 0x46, 0x95, 0x13, 0xc2, 0xc4, 0xd8, 0x9d, 0x87, 0x9a, 0x36, 0x1c,
+	0x98, 0x1f, 0x83, 0xd2, 0x29, 0xd9, 0x53, 0x29, 0xdc, 0xee, 0xae, 0xb4, 0xd8, 0x87, 0x30, 0xa7,
+	0x61, 0x52, 0x26, 0x72, 0x87, 0xb7, 0xbd, 0x2d, 0x6f, 0xa3, 0xcd, 0xe5, 0x7c, 0xcb, 0xcf, 0xea,
+	0xe4, 0x3a, 0x6a, 0xcf, 0xa6, 0xd4, 0x94, 0xa3, 0x7c, 0x59, 0xd2, 0xb2, 0x55, 0x38, 0x9e, 0xe1,
+	0xcc, 0x5b, 0x4e, 0xaf, 0xdb, 0x37, 0x2c, 0x6c, 0xca, 0x93, 0x99, 0x3c, 0x79, 0xeb, 0x5e, 0xd7,
+	0xfa, 0x16, 0x4c, 0xe8, 0x73, 0x52, 0x0c, 0x82, 0x2e, 0x97, 0xc8, 0xd9, 0x37, 0x9e, 0xc0, 0x56,
+	0xc4, 0xbd, 0x70, 0x2a, 0x45, 0xc1, 0x8f, 0x48, 0xdb, 0xcb, 0x64, 0x02, 0xc5, 0x4f, 0xf8, 0x3c,
+	0x4c, 0xb4, 0xbc, 0xa8, 0xdb, 0x76, 0xf7, 0xd0, 0x50, 0x55, 0x7e, 0xe9, 0x71, 0x09, 0x43, 0xbd,
+	0xe3, 0x02, 0xcc, 0xe4, 0xf6, 0x41, 0x4d, 0xd2, 0xa0, 0x7d, 0xfd, 0x60, 0x49, 0xc3, 0xf2, 0x61,
+	0x42, 0x3f, 0xd7, 0x0e, 0x49, 0x7e, 0x76, 0x12, 0xa3, 0x8d, 0xd1, 0xa6, 0x3f, 0xf2, 0x78, 0x7f,
+	0xbe, 0xec, 0xb5, 0x30, 0xc6, 0xd8, 0x79, 0xa8, 0x2a, 0x89, 0x4d, 0x0a, 0x4a, 0xf8, 0xf4, 0xa5,
+	0x5e, 0xf8, 0xed, 0xa4, 0xd4, 0x7a, 0x19, 0x46, 0xe5, 0xd1, 0x75, 0xf0, 0x83, 0x97, 0xf5, 0xed,
+	0x32, 0x4c, 0xdb, 0x5c, 0x6c, 0xac, 0x9c, 0xd2, 0x85, 0x3e, 0xb5, 0x57, 0xf4, 0xe2, 0x28, 0xe8,
+	0x46, 0xdf, 0x0e, 0xc8, 0x7c, 0xfd, 0x4b, 0x25, 0x38, 0x56, 0x80, 0xcb, 0x2e, 0x17, 0x85, 0xbe,
+	0xc1, 0x08, 0x70, 0xca, 0x22, 0x0c, 0x07, 0xd3, 0x88, 0x7f, 0x73, 0x15, 0xc6, 0x96, 0x3c, 0xb7,
+	0x5d, 0x6f, 0xb5, 0x92, 0xd0, 0x63, 0x28, 0xe7, 0x63, 0x36, 0x5b, 0x57, 0x40, 0x75, 0x21, 0x26,
+	0x41, 0x65, 0xaf, 0xc8, 0x49, 0x51, 0x49, 0x86, 0x15, 0x27, 0xc5, 0xf7, 0xf7, 0xe7, 0x81, 0xda,
+	0xb4, 0x9e, 0x4c, 0x11, 0xcc, 0x4c, 0x40, 0xc0, 0xd4, 0x3d, 0xf1, 0xa9, 0xfd, 0x74, 0xc5, 0x99,
+	0x09, 0xb2, 0xdd, 0x1b, 0x28, 0xdd, 0xe0, 0x5f, 0x2c, 0xc3, 0xc9, 0x62, 0xc2, 0x8f, 0xf5, 0x29,
+	0x5f, 0x83, 0x31, 0x4c, 0x63, 0xa9, 0x65, 0x53, 0x99, 0x7a, 0xbc, 0x3f, 0x0f, 0x94, 0xf3, 0x12,
+	0xf1, 0x53, 0x04, 0xb6, 0x09, 0x93, 0xab, 0x6e, 0x14, 0xdf, 0xe0, 0x6e, 0x18, 0x6f, 0x70, 0x37,
+	0x1e, 0x40, 0x92, 0x57, 0x46, 0x49, 0xb3, 0x28, 0x4c, 0x6c, 0x2b, 0xca, 0x8c, 0xac, 0x6d, 0xb2,
+	0x4d, 0x26, 0xca, 0xd0, 0x00, 0x13, 0xe5, 0x9b, 0x30, 0xdd, 0xe0, 0x1d, 0xb7, 0xbb, 0x1d, 0x84,
+	0x2a, 0xec, 0xc8, 0x45, 0x98, 0x4c, 0x40, 0x85, 0xb3, 0xc5, 0x2c, 0x36, 0xf0, 0xb5, 0x81, 0x48,
+	0xb7, 0x12, 0xb3, 0xd8, 0xfa, 0x2b, 0x65, 0x38, 0x55, 0x6f, 0x4a, 0x0b, 0x6b, 0x59, 0xa0, 0x1c,
+	0x41, 0x3e, 0xe5, 0xba, 0xd9, 0x25, 0x18, 0xbb, 0xed, 0x3e, 0x5a, 0xe5, 0x6e, 0xc4, 0x23, 0x99,
+	0xaa, 0x87, 0xc4, 0x5e, 0xf7, 0x51, 0xfa, 0x54, 0x69, 0xa7, 0x38, 0xba, 0x1a, 0x61, 0xe8, 0x13,
+	0xaa, 0x11, 0x2c, 0x18, 0xb9, 0x11, 0xb4, 0x5b, 0xf2, 0xac, 0x97, 0xf6, 0x11, 0xdb, 0x08, 0xb1,
+	0x65, 0x89, 0xf5, 0xbb, 0x25, 0x98, 0x4a, 0x5a, 0x8c, 0x4d, 0xf8, 0xd4, 0x87, 0xe4, 0x1c, 0x8c,
+	0x62, 0x45, 0x2b, 0x4b, 0xfa, 0xa1, 0xd1, 0xe6, 0x98, 0xb7, 0xbb, 0x65, 0xab, 0x42, 0x7d, 0x24,
+	0x86, 0x3f, 0xd9, 0x48, 0x58, 0x7f, 0x13, 0x4d, 0x2f, 0xf4, 0x5e, 0x8a, 0x93, 0x48, 0x6b, 0x48,
+	0x69, 0xc0, 0x86, 0x94, 0x9f, 0xd8, 0x27, 0xa9, 0xf4, 0xfd, 0x24, 0x7f, 0xae, 0x0c, 0xe3, 0x49,
+	0x63, 0x7f, 0xc0, 0x52, 0xfa, 0x24, 0xfd, 0x1a, 0x28, 0x54, 0x58, 0x43, 0xdb, 0x2b, 0x64, 0x44,
+	0xae, 0x2f, 0xc1, 0x88, 0x5c, 0x4c, 0xa5, 0x8c, 0x43, 0x44, 0xe6, 0xeb, 0x2e, 0x4c, 0x49, 0xd6,
+	0x23, 0xf8, 0x41, 0x23, 0x5b, 0xd2, 0x61, 0x2c, 0xb6, 0x07, 0x7c, 0x43, 0x5a, 0xe2, 0x3c, 0xb5,
+	0x67, 0x54, 0x71, 0x2c, 0xb6, 0xb4, 0x63, 0x03, 0x9d, 0x4e, 0xbf, 0x59, 0x85, 0x5a, 0x96, 0xe4,
+	0xf0, 0xa4, 0x49, 0x6b, 0xbd, 0x0d, 0xba, 0xaa, 0x50, 0xd2, 0xa4, 0x6e, 0x6f, 0xc3, 0x16, 0x30,
+	0xb4, 0xee, 0x0b, 0xbd, 0x5d, 0xec, 0xf5, 0x84, 0xb4, 0xee, 0x0b, 0xbd, 0x5d, 0xc3, 0xba, 0x2f,
+	0xf4, 0x76, 0x51, 0x91, 0xb0, 0xda, 0xc0, 0x38, 0x25, 0x78, 0x4f, 0x91, 0x8a, 0x84, 0x76, 0x94,
+	0xcd, 0x04, 0xab, 0xd0, 0xc4, 0x51, 0xb9, 0xc0, 0xdd, 0x50, 0x26, 0xf8, 0x91, 0xdb, 0x19, 0x1e,
+	0x95, 0x1b, 0x08, 0x76, 0x62, 0x01, 0xb7, 0x75, 0x24, 0xd6, 0x06, 0xa6, 0xfd, 0x54, 0x0b, 0xf8,
+	0xf0, 0xbb, 0xb5, 0x32, 0x66, 0x3e, 0xae, 0xb3, 0x76, 0xf4, 0xd5, 0x5c, 0xc0, 0xf7, 0x49, 0x6a,
+	0x7f, 0xd7, 0x64, 0x00, 0x70, 0x54, 0x20, 0x55, 0x0f, 0x65, 0xa6, 0xe2, 0x2b, 0x01, 0x05, 0x08,
+	0x4f, 0xd4, 0x48, 0x29, 0x13, 0xf6, 0x45, 0x18, 0xd7, 0xa3, 0xcf, 0x50, 0x8c, 0x94, 0x67, 0x29,
+	0x6c, 0x70, 0x1a, 0x76, 0xc6, 0xb4, 0xd3, 0xd1, 0xc3, 0xcc, 0x6c, 0xc0, 0xa9, 0xc5, 0xc0, 0x8f,
+	0x7a, 0x1d, 0xf5, 0x8c, 0x9e, 0xe6, 0xac, 0x00, 0xfc, 0x14, 0x18, 0xca, 0xa2, 0x29, 0x51, 0xd4,
+	0x13, 0xbc, 0x0a, 0x52, 0x62, 0x5c, 0x40, 0xfa, 0x31, 0x62, 0xeb, 0x30, 0x8e, 0x1a, 0x54, 0x69,
+	0x39, 0x3c, 0x6e, 0x6e, 0x1b, 0x69, 0xc9, 0x92, 0x58, 0x18, 0x14, 0x7c, 0xd1, 0xed, 0xb4, 0x95,
+	0xb3, 0x93, 0xae, 0x09, 0xd6, 0x90, 0xd9, 0xd7, 0x60, 0x8a, 0xae, 0x68, 0x0f, 0xf8, 0x06, 0xcd,
+	0x9d, 0x09, 0x43, 0x13, 0x61, 0x16, 0x92, 0x2d, 0x89, 0xd4, 0x5b, 0x3f, 0xe4, 0x1b, 0xf4, 0xed,
+	0x0d, 0x57, 0x43, 0x03, 0x9f, 0xdd, 0x83, 0x63, 0x37, 0xdc, 0x88, 0x80, 0x5a, 0x18, 0x91, 0x49,
+	0xd4, 0xd0, 0xa2, 0x0b, 0xc8, 0xb6, 0x1b, 0x29, 0x45, 0x78, 0x61, 0xd8, 0x90, 0x22, 0x7a, 0xf6,
+	0xed, 0x12, 0xcc, 0x1a, 0x7a, 0x72, 0x69, 0x15, 0x89, 0xc1, 0xbb, 0xa7, 0xf0, 0xc9, 0x4b, 0x05,
+	0xbc, 0xee, 0x87, 0x46, 0x9f, 0x24, 0xa3, 0x8a, 0x0f, 0xd3, 0x72, 0xdd, 0xb7, 0xa2, 0x1f, 0x0f,
+	0xb9, 0x50, 0x71, 0x4d, 0x4f, 0x9b, 0x0b, 0x35, 0xb3, 0xae, 0x15, 0x9a, 0x75, 0x35, 0x3b, 0xde,
+	0x52, 0xd1, 0x55, 0x4a, 0x14, 0x5d, 0x68, 0x30, 0x2c, 0x3e, 0x84, 0x0c, 0x46, 0x87, 0x3f, 0xac,
+	0x37, 0xf4, 0x7d, 0x48, 0x8a, 0x85, 0x07, 0xee, 0x43, 0xd6, 0xff, 0x32, 0x02, 0xd3, 0x99, 0x69,
+	0x21, 0xef, 0xa9, 0xa5, 0xdc, 0x3d, 0xb5, 0x01, 0x40, 0xaa, 0xde, 0x01, 0x75, 0xb2, 0xca, 0x9f,
+	0x79, 0x5c, 0x46, 0x23, 0x48, 0xd6, 0x94, 0xc6, 0x46, 0x30, 0xa5, 0x15, 0x3b, 0xa0, 0x8e, 0x3c,
+	0x61, 0x4a, 0x8b, 0x5e, 0x63, 0x9a, 0xb2, 0x61, 0xf3, 0x30, 0x8c, 0x61, 0xc2, 0x75, 0x77, 0x72,
+	0x4f, 0x00, 0x6c, 0x82, 0xb3, 0x17, 0x60, 0x44, 0x08, 0x51, 0x2b, 0x4b, 0x72, 0x13, 0xc4, 0xb3,
+	0x45, 0x48, 0x59, 0x42, 0x62, 0x91, 0x45, 0xec, 0x2a, 0x4c, 0xd0, 0x5f, 0x32, 0x5a, 0xd5, 0x88,
+	0x69, 0xdf, 0xeb, 0x78, 0x2d, 0x15, 0xb0, 0xca, 0xc0, 0x13, 0xb7, 0x8b, 0x46, 0x0f, 0xd5, 0x3a,
+	0x2b, 0x4b, 0x32, 0xe9, 0x07, 0xde, 0x2e, 0x22, 0x02, 0x8a, 0x2a, 0x52, 0x04, 0x21, 0xcb, 0x48,
+	0xa7, 0xae, 0x2a, 0xde, 0x29, 0x51, 0x96, 0x21, 0x67, 0x2e, 0x5b, 0x96, 0xb0, 0x0b, 0xf4, 0x12,
+	0x83, 0x62, 0x21, 0x65, 0xbe, 0xc6, 0x77, 0x0b, 0x54, 0x4c, 0xa0, 0x6c, 0x98, 0x14, 0x8b, 0xca,
+	0xc5, 0xdf, 0xcb, 0x1d, 0xd7, 0x6b, 0xcb, 0x6d, 0x05, 0x2b, 0x47, 0x5c, 0x2e, 0xa0, 0x76, 0x8a,
+	0xc0, 0xde, 0x83, 0x29, 0xca, 0x50, 0xdb, 0xe9, 0x04, 0x3e, 0xb2, 0x1f, 0x4f, 0x4d, 0xe2, 0x64,
+	0xd6, 0x5c, 0x51, 0x44, 0xb5, 0x64, 0x70, 0xc5, 0x79, 0x82, 0xaf, 0xbc, 0x3d, 0x7a, 0x23, 0x9a,
+	0x48, 0xcf, 0x13, 0x24, 0x8d, 0x08, 0x6e, 0xeb, 0x48, 0xec, 0x6d, 0x98, 0x14, 0x3f, 0xaf, 0x7b,
+	0xbb, 0x9c, 0x2a, 0x9c, 0x4c, 0x4d, 0x25, 0x90, 0x6a, 0x4b, 0x94, 0x50, 0x7d, 0x26, 0x26, 0xfb,
+	0x00, 0x4e, 0x20, 0xa7, 0x66, 0xd0, 0xe5, 0xad, 0xfa, 0xe6, 0xa6, 0xd7, 0xf6, 0xc8, 0x76, 0x72,
+	0x2a, 0xb5, 0x61, 0xa2, 0x8a, 0x11, 0xc3, 0x71, 0x53, 0x14, 0xbb, 0x98, 0x92, 0x3d, 0x80, 0xda,
+	0x62, 0x2f, 0x8a, 0x83, 0x4e, 0x3d, 0x8e, 0x43, 0x6f, 0xa3, 0x17, 0xf3, 0x68, 0x76, 0xda, 0x88,
+	0x5e, 0x24, 0x16, 0x47, 0x52, 0x48, 0xfa, 0xa0, 0x26, 0x52, 0x38, 0x6e, 0x42, 0x62, 0xe7, 0x98,
+	0x58, 0xff, 0x73, 0x09, 0x26, 0x0d, 0x52, 0xf6, 0x16, 0x4c, 0x5c, 0x0b, 0x3d, 0xee, 0xb7, 0xda,
+	0x7b, 0xda, 0x45, 0x15, 0x6f, 0x31, 0x9b, 0x12, 0x4e, 0xbd, 0x36, 0xd0, 0x12, 0x3d, 0x4f, 0xb9,
+	0xd0, 0xb0, 0xf9, 0x12, 0x45, 0x35, 0x90, 0x13, 0xb4, 0x92, 0x86, 0x53, 0xc3, 0x09, 0x2a, 0x67,
+	0xa7, 0x86, 0xc2, 0xbe, 0x00, 0x23, 0xf4, 0x1e, 0x2c, 0xad, 0x6c, 0x4f, 0x17, 0x75, 0x93, 0x22,
+	0x68, 0xe0, 0x44, 0x44, 0x03, 0xa2, 0xc8, 0x96, 0x44, 0xd6, 0xcf, 0x94, 0x80, 0xe5, 0x51, 0x0f,
+	0xd1, 0x7b, 0x1d, 0x6a, 0x98, 0xf4, 0xa5, 0x64, 0x35, 0x56, 0x0c, 0x9d, 0xb9, 0xa8, 0x89, 0x0a,
+	0x68, 0xe0, 0xe5, 0xaa, 0xd3, 0x15, 0x71, 0x54, 0x6c, 0xfd, 0x68, 0x19, 0x20, 0xc5, 0x66, 0x9f,
+	0xa7, 0xfc, 0x9e, 0x1f, 0xf4, 0xdc, 0xb6, 0xb7, 0xe9, 0x99, 0x41, 0xa3, 0x91, 0xc9, 0x37, 0x55,
+	0x89, 0x6d, 0x22, 0xb2, 0xf7, 0x61, 0xba, 0xb1, 0x66, 0xd2, 0x6a, 0x1e, 0x22, 0x51, 0xd7, 0xc9,
+	0x90, 0x67, 0xb1, 0xd1, 0x9a, 0x5e, 0xff, 0x1a, 0x64, 0x4d, 0x4f, 0x1f, 0x42, 0x96, 0x88, 0x8d,
+	0xa5, 0xb1, 0x26, 0x9d, 0x60, 0x5a, 0xc9, 0xab, 0x26, 0xb6, 0x2e, 0xea, 0x3a, 0x5d, 0xe9, 0x1d,
+	0x23, 0xf6, 0x09, 0x03, 0x2f, 0x1d, 0xc8, 0xe1, 0x3e, 0x51, 0x32, 0x7e, 0x16, 0xd5, 0x7e, 0x9d,
+	0x20, 0xe6, 0x52, 0xdb, 0xf1, 0xd4, 0xde, 0x7b, 0x52, 0x63, 0x82, 0x61, 0xc3, 0xf9, 0xdf, 0xe8,
+	0x9d, 0x34, 0x98, 0xb9, 0x92, 0x5e, 0x52, 0xc8, 0xac, 0xa0, 0xc0, 0xc6, 0xe6, 0x17, 0x4b, 0x70,
+	0xa2, 0x90, 0x96, 0x5d, 0x04, 0x48, 0x75, 0x4a, 0x72, 0x94, 0x70, 0xc7, 0x4c, 0x83, 0x88, 0xd9,
+	0x1a, 0x06, 0xfb, 0x6a, 0x56, 0x1b, 0x74, 0xf8, 0x41, 0x38, 0xa7, 0x62, 0x77, 0x9a, 0xda, 0xa0,
+	0x02, 0x1d, 0x90, 0xf5, 0x4b, 0x15, 0x98, 0xd1, 0x62, 0x94, 0x51, 0x5b, 0x0f, 0xf1, 0x6e, 0xd8,
+	0x81, 0x09, 0xd1, 0x1b, 0xaf, 0x29, 0xbd, 0xd7, 0xc8, 0xf0, 0xe5, 0x95, 0x9c, 0xfb, 0xb6, 0xe4,
+	0x76, 0x51, 0x47, 0x26, 0xa3, 0x52, 0xdc, 0x3a, 0xf1, 0x41, 0xa2, 0x99, 0xf7, 0x5c, 0x33, 0x98,
+	0xb3, 0x08, 0x26, 0x97, 0xf6, 0x7c, 0xb7, 0x93, 0xd4, 0x46, 0x06, 0x30, 0xaf, 0xf6, 0xad, 0xcd,
+	0xc0, 0xa6, 0xea, 0x52, 0x47, 0x47, 0x2a, 0x2b, 0x88, 0xb1, 0x61, 0x50, 0xcd, 0xbd, 0x0f, 0x33,
+	0xb9, 0x46, 0x1f, 0x29, 0xb8, 0xef, 0x03, 0x60, 0xf9, 0x76, 0x0c, 0x6e, 0x22, 0x2a, 0xce, 0x3c,
+	0xd7, 0x6f, 0x91, 0x39, 0xcd, 0x65, 0xdd, 0x44, 0xf4, 0x67, 0xcb, 0xba, 0x0b, 0xfd, 0xd3, 0xbe,
+	0xea, 0xbe, 0x64, 0xdc, 0x86, 0x9f, 0xeb, 0xf7, 0x4d, 0x07, 0xd2, 0x3a, 0x7c, 0xaf, 0x02, 0xa7,
+	0xfa, 0x50, 0xb2, 0xbd, 0xec, 0x24, 0x22, 0x2d, 0xc4, 0x9b, 0x07, 0x57, 0xf8, 0x24, 0xa6, 0x12,
+	0xfb, 0x3c, 0x05, 0xd1, 0x69, 0x62, 0x4e, 0x7e, 0x79, 0xff, 0x46, 0x35, 0xfe, 0x4e, 0x02, 0xcd,
+	0x46, 0xcf, 0x21, 0x28, 0x7b, 0x1f, 0x86, 0x31, 0x7e, 0x42, 0x26, 0x4a, 0xaa, 0xc0, 0x40, 0xb8,
+	0x16, 0xe7, 0x57, 0xfc, 0x34, 0xe2, 0xfc, 0x0a, 0x00, 0xfb, 0x1c, 0x54, 0xea, 0x0f, 0x1a, 0xf2,
+	0xbb, 0x4c, 0xe9, 0xe4, 0x0f, 0x1a, 0x69, 0x82, 0x2f, 0xd7, 0xc8, 0xc4, 0x25, 0x28, 0x04, 0xe1,
+	0xf5, 0xc5, 0x35, 0xf9, 0x55, 0x74, 0xc2, 0xeb, 0x8b, 0x6b, 0x29, 0xe1, 0x96, 0xe9, 0xa1, 0x79,
+	0x7d, 0x71, 0xed, 0xd3, 0x9b, 0xf6, 0xff, 0x7e, 0x99, 0x22, 0xff, 0x50, 0xc7, 0xde, 0x87, 0x09,
+	0x23, 0xb4, 0x7f, 0x49, 0xb7, 0x29, 0x97, 0x06, 0xf6, 0x19, 0x8b, 0x21, 0x83, 0x40, 0xa5, 0xca,
+	0x4b, 0x6c, 0xe0, 0x75, 0x63, 0x9b, 0x84, 0x43, 0xd6, 0xf1, 0xcd, 0x24, 0x61, 0x57, 0xa0, 0xba,
+	0xce, 0x7d, 0xd7, 0x8f, 0x13, 0x85, 0x28, 0x1a, 0x2a, 0xc7, 0x08, 0x33, 0xa5, 0x86, 0x04, 0x11,
+	0x6d, 0x6a, 0x7b, 0x1b, 0x51, 0x33, 0xf4, 0x30, 0x42, 0x58, 0x72, 0x16, 0x93, 0x4d, 0xad, 0x56,
+	0x62, 0x32, 0xc8, 0x10, 0x59, 0x3f, 0x5b, 0x82, 0x51, 0xf9, 0x21, 0x29, 0xc5, 0xe9, 0x56, 0x7a,
+	0x96, 0x48, 0x57, 0x97, 0x2d, 0x2f, 0xeb, 0xea, 0xb2, 0x45, 0x61, 0xb8, 0xc6, 0xa4, 0x8f, 0x69,
+	0xf2, 0x34, 0x88, 0xb3, 0x51, 0x79, 0x4f, 0x9b, 0x19, 0x2c, 0x13, 0xd4, 0x41, 0x7d, 0x0e, 0xad,
+	0x9f, 0x93, 0x2d, 0xbb, 0xbe, 0xb8, 0xc6, 0x2e, 0x43, 0x75, 0x35, 0xa0, 0x88, 0x72, 0x7a, 0xbe,
+	0xfe, 0xb6, 0x84, 0xe9, 0x03, 0xa4, 0xf0, 0x44, 0xfb, 0xd6, 0xc2, 0x40, 0xde, 0x65, 0xb4, 0xf6,
+	0x75, 0x09, 0x98, 0x69, 0x5f, 0x82, 0x3a, 0x70, 0xfb, 0x78, 0xc1, 0x26, 0x71, 0xff, 0x0a, 0xfa,
+	0x17, 0xdc, 0xd4, 0x7d, 0x39, 0x65, 0x91, 0xda, 0x29, 0xe6, 0xfa, 0xed, 0x14, 0xf7, 0xaf, 0xd8,
+	0x05, 0x54, 0xd6, 0xef, 0x95, 0x75, 0x66, 0x0d, 0x1e, 0xee, 0x3e, 0xc5, 0xbb, 0x74, 0xf1, 0xbb,
+	0x5a, 0xb6, 0x7b, 0xfd, 0x37, 0x69, 0xf6, 0x39, 0x90, 0x82, 0x92, 0xd4, 0xe3, 0xcd, 0xf7, 0x63,
+	0x21, 0x65, 0x24, 0x5b, 0xa2, 0x8b, 0x03, 0x16, 0xef, 0x56, 0x74, 0xab, 0xb5, 0xe9, 0x87, 0xb6,
+	0xe7, 0x7f, 0xa7, 0x02, 0x27, 0x8b, 0xdb, 0xa1, 0x0f, 0x4d, 0xe9, 0x80, 0xa1, 0x39, 0x0f, 0xd5,
+	0x1b, 0x41, 0x14, 0x6b, 0x36, 0x87, 0xf8, 0x9a, 0xb0, 0x2d, 0x61, 0x76, 0x52, 0x2a, 0xae, 0xf0,
+	0xe2, 0xef, 0x64, 0xb5, 0x23, 0x3f, 0x0c, 0x9f, 0x23, 0xae, 0xf0, 0x54, 0xc4, 0xae, 0x43, 0xd5,
+	0x96, 0x5e, 0x86, 0x99, 0x91, 0x56, 0xe0, 0x44, 0x38, 0x63, 0xa1, 0x84, 0x18, 0x09, 0x1b, 0x24,
+	0x8c, 0xd5, 0x61, 0x54, 0x4e, 0xa6, 0xcc, 0x4b, 0x74, 0xc1, 0x0c, 0x34, 0x73, 0xa8, 0x28, 0x3a,
+	0xb1, 0x41, 0xe1, 0x9b, 0xe2, 0xca, 0x92, 0x72, 0x18, 0xc4, 0x0d, 0x8a, 0xde, 0x1c, 0x4d, 0xf3,
+	0xce, 0x04, 0x91, 0xcd, 0xc3, 0x78, 0xc8, 0xdb, 0xee, 0x1e, 0xed, 0x7e, 0x72, 0xdc, 0x01, 0x41,
+	0xb4, 0xed, 0x3d, 0x03, 0x63, 0x84, 0xe0, 0xb5, 0xa4, 0x06, 0xc1, 0xae, 0x22, 0x60, 0xa5, 0x15,
+	0x59, 0xeb, 0x30, 0xdb, 0xef, 0x9b, 0x8a, 0x3b, 0x52, 0xec, 0x86, 0x5b, 0x1c, 0x05, 0xd2, 0xb6,
+	0xf4, 0x26, 0x4f, 0x8d, 0x85, 0xd6, 0xb1, 0xec, 0x06, 0x16, 0xd9, 0x13, 0xb1, 0xf6, 0xcb, 0xfa,
+	0x76, 0x19, 0x40, 0x29, 0xa6, 0x9e, 0xda, 0x45, 0xf4, 0x39, 0x63, 0x11, 0x69, 0x26, 0x55, 0x94,
+	0xfc, 0x7e, 0x10, 0x09, 0xe7, 0x2e, 0x5a, 0x2c, 0x69, 0xf8, 0x87, 0xe7, 0xd7, 0x5d, 0x4f, 0x75,
+	0x76, 0xd2, 0x83, 0x07, 0x35, 0xee, 0x04, 0xb7, 0x36, 0xe0, 0xf8, 0x75, 0x1e, 0xa7, 0x1a, 0x3c,
+	0xf5, 0xba, 0x7a, 0x30, 0xdb, 0xd7, 0x60, 0x4c, 0xe2, 0x27, 0x5b, 0x34, 0xa9, 0x9b, 0x64, 0x94,
+	0x2c, 0x54, 0x37, 0x29, 0x04, 0xb1, 0xe1, 0x2e, 0xf1, 0x36, 0x8f, 0xf9, 0xa7, 0x5b, 0x4d, 0x03,
+	0x18, 0x75, 0x05, 0x7b, 0x36, 0x58, 0x0d, 0x87, 0x8e, 0xcf, 0x7d, 0x38, 0x91, 0xb4, 0xfd, 0x49,
+	0xf2, 0xbd, 0x24, 0x6e, 0xcd, 0x32, 0x25, 0x4a, 0xca, 0xf1, 0x00, 0xf3, 0x9a, 0xdf, 0x2e, 0xc1,
+	0x9c, 0xa2, 0x78, 0xe0, 0x25, 0xc6, 0xa1, 0x03, 0x11, 0xb3, 0xf7, 0x60, 0x5c, 0xa3, 0x91, 0xce,
+	0x37, 0xa8, 0x8a, 0x7f, 0xe8, 0xc5, 0xdb, 0x4e, 0x44, 0x70, 0x5d, 0x15, 0xaf, 0xa1, 0xb3, 0x0d,
+	0x98, 0x6b, 0xd4, 0x6f, 0xaf, 0xa6, 0xee, 0x73, 0x77, 0x82, 0x6b, 0x41, 0xbb, 0x1d, 0x3c, 0xbc,
+	0x67, 0xaf, 0xaa, 0x1c, 0x68, 0x18, 0x0a, 0x08, 0xf5, 0xfa, 0x9a, 0x0f, 0x9e, 0x1f, 0x38, 0x9b,
+	0x88, 0xe8, 0xf4, 0xc2, 0x76, 0x64, 0x1f, 0xc0, 0xc5, 0xfa, 0x7b, 0x25, 0x78, 0x26, 0xf1, 0xe5,
+	0x2a, 0xe8, 0x5f, 0xa6, 0x07, 0xa5, 0x27, 0xd9, 0x83, 0xf2, 0x13, 0xe9, 0xc1, 0x9d, 0xf4, 0xfb,
+	0xac, 0xf8, 0x49, 0xa4, 0x06, 0xd5, 0x7e, 0xa6, 0x7f, 0x1f, 0xf9, 0x55, 0x9e, 0xcd, 0xc5, 0x7e,
+	0xd0, 0x42, 0x3c, 0x58, 0xef, 0x6a, 0x03, 0x52, 0xc0, 0xd0, 0x20, 0x2e, 0x65, 0x89, 0xbf, 0x5d,
+	0x86, 0xe9, 0xbb, 0x2b, 0x4b, 0x8b, 0x89, 0xa9, 0xd8, 0x53, 0xbb, 0x69, 0x16, 0x1b, 0x63, 0x19,
+	0x7d, 0xeb, 0xbf, 0x73, 0x5a, 0xf7, 0xe0, 0x58, 0x66, 0x18, 0x50, 0xce, 0xfb, 0x22, 0x79, 0x07,
+	0x25, 0x60, 0x25, 0xe3, 0x9d, 0x2c, 0x62, 0x7f, 0xff, 0x8a, 0x9d, 0xc1, 0xb6, 0xfe, 0xb7, 0x89,
+	0x0c, 0x5f, 0xb9, 0x19, 0xbf, 0x06, 0x63, 0x2b, 0x51, 0xd4, 0xe3, 0xe1, 0x3d, 0x7b, 0x55, 0xd7,
+	0xeb, 0x78, 0x08, 0x14, 0x73, 0xc8, 0x4e, 0x11, 0xd8, 0x05, 0xa8, 0xca, 0xc4, 0x10, 0x6a, 0x77,
+	0x43, 0x15, 0x7b, 0x92, 0x57, 0xc2, 0x4e, 0x8a, 0xd9, 0x5b, 0x30, 0x41, 0x7f, 0xd3, 0x8c, 0x96,
+	0x03, 0x8e, 0x9a, 0x5c, 0x89, 0x4e, 0x2b, 0xc0, 0x36, 0xd0, 0xd8, 0x2b, 0x50, 0xa9, 0x2f, 0xda,
+	0x52, 0x77, 0x27, 0x85, 0xfc, 0xd0, 0x21, 0x05, 0xab, 0x71, 0xe3, 0x5b, 0xb4, 0x85, 0xa8, 0xae,
+	0x82, 0xe4, 0xc8, 0x67, 0x07, 0x9c, 0x01, 0x4a, 0x35, 0x98, 0x11, 0x15, 0x10, 0xc6, 0x2e, 0xc1,
+	0xe8, 0x12, 0xd9, 0x37, 0xca, 0x47, 0x07, 0x4a, 0x5d, 0x4c, 0x20, 0x23, 0xd8, 0x0b, 0x81, 0xd8,
+	0x05, 0x95, 0x35, 0xb4, 0x9a, 0x3a, 0x19, 0xf5, 0x49, 0x0d, 0x9a, 0xba, 0xcc, 0x8f, 0x1d, 0xee,
+	0x32, 0x9f, 0x77, 0x76, 0x87, 0x27, 0xe9, 0xec, 0xbe, 0x01, 0xa7, 0xae, 0xa3, 0xaa, 0xcd, 0x0c,
+	0x02, 0x78, 0xcf, 0x5e, 0x91, 0x8f, 0x17, 0xf8, 0x66, 0x47, 0xda, 0xb8, 0x6c, 0x1c, 0x41, 0xa7,
+	0x17, 0xea, 0x99, 0xf8, 0xfb, 0x31, 0x62, 0x1f, 0xc2, 0xf1, 0xa2, 0x22, 0xf9, 0xc4, 0x81, 0xe1,
+	0xee, 0x8a, 0x2b, 0xd0, 0xc3, 0xdd, 0x15, 0x71, 0x60, 0xab, 0x50, 0x23, 0x78, 0xbd, 0xd5, 0xf1,
+	0x7c, 0x7a, 0xa6, 0x99, 0x4c, 0x9d, 0xa6, 0x25, 0x57, 0x57, 0x14, 0xd2, 0x73, 0x8d, 0xe1, 0x27,
+	0x96, 0xa1, 0x64, 0x3f, 0x51, 0x12, 0x57, 0x6f, 0x4a, 0x36, 0x80, 0xdb, 0xe7, 0x94, 0x7c, 0xf0,
+	0x4d, 0x1c, 0xb7, 0x1a, 0x71, 0xe8, 0xf9, 0x5b, 0xd2, 0x07, 0x6c, 0x5d, 0xfa, 0x80, 0xbd, 0xf7,
+	0xb1, 0x7c, 0xc0, 0x88, 0x55, 0xf4, 0x78, 0x7f, 0x7e, 0x22, 0x94, 0x75, 0xe2, 0x2a, 0x32, 0x5a,
+	0x20, 0x86, 0x0e, 0xfd, 0xf0, 0xef, 0xf9, 0x14, 0xea, 0x9c, 0xb7, 0xa8, 0x93, 0xd3, 0xb8, 0xb1,
+	0xe3, 0xd0, 0xb9, 0xb4, 0x89, 0x27, 0x08, 0xb9, 0x8e, 0x16, 0x72, 0x60, 0x0b, 0xf4, 0x74, 0x24,
+	0x8e, 0x52, 0x72, 0xc3, 0xae, 0xa5, 0x5a, 0x02, 0xe5, 0x94, 0xe4, 0xe0, 0x34, 0xd2, 0x27, 0x8f,
+	0x41, 0xc2, 0x2e, 0xc1, 0xc8, 0x6d, 0xf7, 0x51, 0x7d, 0x8b, 0xcb, 0x54, 0xdd, 0x93, 0x6a, 0xfb,
+	0x43, 0xe0, 0x42, 0xf5, 0xb7, 0xc8, 0x31, 0xe5, 0x33, 0xb6, 0x44, 0x63, 0x7f, 0xaa, 0x04, 0x27,
+	0x69, 0x19, 0xab, 0x5e, 0x36, 0x78, 0x1c, 0x8b, 0x71, 0x90, 0x31, 0x53, 0xcf, 0xa6, 0xd6, 0xf5,
+	0xc5, 0x78, 0x18, 0xd4, 0xc3, 0x92, 0x3b, 0x43, 0x32, 0x70, 0x91, 0x2c, 0x35, 0x82, 0xcf, 0x17,
+	0xd2, 0xb3, 0x75, 0x18, 0xbf, 0x7d, 0xad, 0x9e, 0x54, 0x7b, 0xcc, 0xb8, 0xb3, 0x19, 0x3b, 0x9f,
+	0x86, 0x56, 0xe4, 0x16, 0xa2, 0xb3, 0xc1, 0xeb, 0xc8, 0xad, 0xc5, 0x65, 0x0c, 0xa3, 0x71, 0x3c,
+	0xd5, 0x97, 0x74, 0x77, 0x9a, 0x3c, 0x1b, 0x15, 0x3f, 0x41, 0x64, 0xef, 0x93, 0xa7, 0x2a, 0x46,
+	0x5b, 0x12, 0xb7, 0xf1, 0x13, 0x69, 0x60, 0x5b, 0x0a, 0xa7, 0x2f, 0x0b, 0x74, 0x4d, 0x8f, 0x4e,
+	0xc0, 0xee, 0x82, 0x0a, 0xcb, 0x41, 0x86, 0xef, 0x58, 0xfd, 0xc9, 0xd4, 0x3b, 0x4c, 0x59, 0x3b,
+	0x90, 0xbd, 0x7c, 0xb6, 0x21, 0x79, 0x5a, 0x76, 0x0f, 0x66, 0xb9, 0x1f, 0x87, 0xae, 0xe3, 0xb5,
+	0x64, 0x08, 0xcc, 0xe4, 0x01, 0x45, 0x26, 0xe8, 0x56, 0x4f, 0x07, 0xcb, 0x02, 0x6d, 0x65, 0x89,
+	0x9e, 0x54, 0xd5, 0xae, 0x69, 0x9f, 0x40, 0xea, 0x95, 0x96, 0x09, 0x96, 0x8e, 0x2e, 0x7b, 0x70,
+	0xa2, 0x90, 0x8a, 0xcd, 0x41, 0xb5, 0xe5, 0x45, 0x69, 0x9a, 0xab, 0xaa, 0x9d, 0xfc, 0x66, 0x67,
+	0x00, 0x28, 0x74, 0xa0, 0x66, 0x9e, 0x3e, 0x86, 0x10, 0x7c, 0x0d, 0x7b, 0x09, 0xa6, 0xb6, 0x42,
+	0xb7, 0xbb, 0xed, 0x70, 0xbf, 0xd5, 0x0d, 0x3c, 0x5f, 0x9e, 0x1f, 0xf6, 0x24, 0x42, 0x97, 0x25,
+	0xd0, 0xfa, 0x9c, 0x9a, 0xa8, 0xec, 0x75, 0xdd, 0x39, 0xbc, 0x82, 0x5f, 0x69, 0xb4, 0xe3, 0x3e,
+	0x72, 0xdc, 0x2d, 0x6e, 0xd8, 0x9a, 0xc8, 0x37, 0xa0, 0x9f, 0x2e, 0xc1, 0xe9, 0xbe, 0x73, 0x91,
+	0x5d, 0x85, 0x53, 0x2e, 0x45, 0xc9, 0x70, 0xb6, 0xe3, 0xb8, 0x1b, 0x39, 0xea, 0x66, 0xad, 0x42,
+	0x8f, 0x9d, 0x90, 0xc5, 0x37, 0x44, 0xa9, 0xba, 0x6c, 0x47, 0xec, 0x7d, 0x78, 0xd6, 0xf3, 0x23,
+	0xde, 0xec, 0x85, 0xdc, 0x51, 0x0c, 0x9a, 0x5e, 0x2b, 0x74, 0x42, 0xd7, 0xdf, 0x52, 0xbe, 0xf1,
+	0xf6, 0x69, 0x85, 0x23, 0x23, 0x71, 0x2c, 0x7a, 0xad, 0xd0, 0x46, 0x04, 0xeb, 0x17, 0xcb, 0x30,
+	0xdb, 0x6f, 0xae, 0xb2, 0x59, 0x18, 0xe5, 0xbe, 0x3e, 0x9a, 0xea, 0xa7, 0xb8, 0xde, 0x26, 0x47,
+	0xb0, 0x1c, 0xcb, 0x6a, 0x53, 0x26, 0x70, 0x42, 0x07, 0x11, 0xfd, 0xc0, 0x95, 0x23, 0x39, 0xd1,
+	0xd4, 0x8f, 0xdd, 0x33, 0x00, 0xe9, 0x39, 0x4b, 0xea, 0x3d, 0x7b, 0xcc, 0x6d, 0x86, 0xb4, 0x25,
+	0xb2, 0x93, 0x30, 0x42, 0xe7, 0x98, 0xf4, 0x22, 0x92, 0xbf, 0x84, 0x40, 0x25, 0x07, 0x19, 0x0f,
+	0xe0, 0xca, 0xc2, 0x84, 0x31, 0xd8, 0x23, 0x1d, 0xfa, 0x38, 0x85, 0xf3, 0x79, 0xf4, 0xe3, 0xcf,
+	0x67, 0xeb, 0xff, 0x9e, 0x20, 0x61, 0xb1, 0xde, 0x8b, 0xb7, 0x95, 0x78, 0x79, 0xb9, 0xc8, 0x8d,
+	0x93, 0x4c, 0x9c, 0x35, 0x77, 0x09, 0xd3, 0x79, 0x53, 0x3d, 0xc9, 0x96, 0x0b, 0x9f, 0x64, 0x5f,
+	0x83, 0xb1, 0xc5, 0x6d, 0xde, 0xdc, 0x49, 0x7c, 0xe3, 0xaa, 0xf2, 0xcd, 0x4b, 0x00, 0x29, 0xe1,
+	0x47, 0x8a, 0xc0, 0x2e, 0x01, 0xa0, 0xf7, 0x38, 0xdd, 0xa2, 0xb4, 0xa4, 0x5d, 0xe8, 0x6c, 0x2e,
+	0xad, 0xc6, 0x34, 0x14, 0x64, 0xdf, 0xb0, 0xaf, 0xe9, 0x66, 0x66, 0xc4, 0x3e, 0x0a, 0x37, 0x25,
+	0x7a, 0x8a, 0x20, 0xba, 0xa7, 0x9d, 0x20, 0x52, 0xde, 0xa9, 0xe5, 0x8e, 0x19, 0x1d, 0x89, 0x7d,
+	0x0e, 0x46, 0x17, 0x79, 0x18, 0xaf, 0xaf, 0xaf, 0xa2, 0x6d, 0x17, 0xe5, 0xaa, 0xaa, 0x62, 0x5e,
+	0xa1, 0x38, 0x6e, 0x7f, 0x7f, 0x7f, 0x7e, 0x32, 0xf6, 0x3a, 0x3c, 0xc9, 0xc1, 0x61, 0x2b, 0x6c,
+	0xb6, 0x00, 0x35, 0xb2, 0x3e, 0x49, 0xef, 0xbf, 0x28, 0xd3, 0x54, 0x49, 0xc2, 0x92, 0xa6, 0x2a,
+	0x0f, 0xf9, 0x46, 0x92, 0x55, 0x29, 0x87, 0xcf, 0x96, 0x55, 0x32, 0x32, 0xbd, 0xd9, 0x90, 0xee,
+	0xa1, 0xd9, 0xbd, 0x5e, 0xb4, 0x3e, 0x4f, 0xc1, 0xea, 0x30, 0xb9, 0x18, 0x74, 0xba, 0x6e, 0xec,
+	0x61, 0xae, 0xe3, 0x3d, 0x29, 0xbe, 0xe0, 0x6e, 0xda, 0xd4, 0x0b, 0x0c, 0x59, 0x48, 0x2f, 0x60,
+	0xd7, 0x60, 0xca, 0x0e, 0x7a, 0x62, 0xd8, 0x95, 0x76, 0x8a, 0x24, 0x14, 0xb4, 0xc0, 0x0a, 0x45,
+	0x89, 0x10, 0xa8, 0xa4, 0x2a, 0xca, 0x88, 0x57, 0x6e, 0x50, 0xb1, 0x3b, 0x05, 0xaf, 0x8e, 0xba,
+	0x58, 0xa2, 0xe7, 0x56, 0xca, 0x31, 0x2b, 0x78, 0xb0, 0xbc, 0x02, 0xe3, 0x8d, 0xc6, 0xdd, 0x75,
+	0x1e, 0xc5, 0xd7, 0xda, 0xc1, 0x43, 0x94, 0x4a, 0xaa, 0x32, 0x15, 0x68, 0x14, 0x38, 0xb1, 0x58,
+	0x11, 0x9b, 0xed, 0xe0, 0xa1, 0xad, 0x63, 0xb1, 0xaf, 0x8b, 0xf1, 0xd0, 0x64, 0x78, 0x19, 0x99,
+	0xfd, 0xa0, 0x6b, 0x06, 0x9e, 0xfd, 0xe9, 0x22, 0x10, 0x97, 0x0d, 0x73, 0xb0, 0x34, 0x74, 0x74,
+	0xdd, 0x0c, 0x83, 0x47, 0x7b, 0xf5, 0x56, 0x2b, 0xe4, 0x51, 0x24, 0xc5, 0x07, 0x72, 0xdd, 0x44,
+	0x25, 0x9c, 0x4b, 0x05, 0x86, 0xeb, 0xa6, 0x46, 0xc0, 0x16, 0x85, 0x5c, 0x2b, 0xbe, 0x22, 0xda,
+	0x04, 0xae, 0xac, 0xa1, 0x04, 0x20, 0x1f, 0x0b, 0xe4, 0x37, 0x27, 0xeb, 0x41, 0xaf, 0x6b, 0x8a,
+	0xaf, 0x1a, 0x0d, 0x5b, 0x81, 0x69, 0x02, 0x88, 0xa5, 0x45, 0x89, 0x00, 0x8f, 0xa5, 0xa9, 0x88,
+	0x24, 0x1b, 0x3c, 0x4c, 0x31, 0x19, 0xa0, 0x1e, 0x7f, 0x23, 0x43, 0xc7, 0xde, 0x87, 0x29, 0xcc,
+	0xb2, 0x92, 0xf8, 0xbf, 0xe1, 0x41, 0x3e, 0x41, 0x51, 0xc8, 0x65, 0x49, 0xc6, 0xa9, 0x74, 0x22,
+	0x8a, 0xb6, 0xd7, 0x94, 0x63, 0x9c, 0x60, 0x80, 0x66, 0x68, 0x29, 0x83, 0x13, 0x29, 0x03, 0x59,
+	0x92, 0x65, 0x10, 0xb7, 0xa3, 0x94, 0xc1, 0x4f, 0x95, 0xe0, 0xb4, 0xa8, 0x48, 0x77, 0x75, 0xc3,
+	0x4d, 0x01, 0x6d, 0xec, 0x28, 0x43, 0xd4, 0xeb, 0x17, 0x95, 0x50, 0x79, 0x51, 0x43, 0xbb, 0xb8,
+	0xfb, 0xe6, 0xc5, 0x7a, 0xfa, 0xb3, 0xa1, 0x88, 0x28, 0x2e, 0x73, 0x5f, 0x9e, 0xba, 0xf0, 0x1e,
+	0x45, 0xdb, 0x45, 0x1c, 0xb0, 0x51, 0xa2, 0xf1, 0xc5, 0x8d, 0x3a, 0xf5, 0xb1, 0x1b, 0xd5, 0x97,
+	0xa7, 0xde, 0xa8, 0xb8, 0x1d, 0x15, 0x36, 0xea, 0x2a, 0x4c, 0xa2, 0x68, 0x25, 0x45, 0xda, 0x50,
+	0xe6, 0x9f, 0xc2, 0x35, 0x61, 0x14, 0xd8, 0x13, 0xe2, 0xe7, 0x7d, 0xf9, 0x8b, 0x7d, 0x0e, 0xa4,
+	0x45, 0xea, 0xb6, 0x10, 0x15, 0x4e, 0xa7, 0x97, 0xc7, 0x14, 0xaa, 0xbf, 0xc0, 0x20, 0xf4, 0x86,
+	0xe7, 0xc7, 0x37, 0x87, 0xaa, 0xa3, 0xb5, 0xea, 0xcd, 0xa1, 0xea, 0x4c, 0x8d, 0xd9, 0x63, 0xc9,
+	0x17, 0xb3, 0x4f, 0x14, 0xf6, 0x00, 0x75, 0x14, 0x8d, 0xfa, 0xed, 0xd5, 0xf4, 0xa2, 0xfd, 0x83,
+	0xe5, 0x30, 0x66, 0xf4, 0xed, 0x00, 0x87, 0xb1, 0x7b, 0x14, 0xbf, 0x40, 0x1b, 0x06, 0xa5, 0xa3,
+	0x30, 0xc0, 0x59, 0x1d, 0x45, 0x86, 0xc6, 0xce, 0x60, 0x5b, 0xdf, 0x99, 0xc8, 0xf0, 0x95, 0x46,
+	0xe2, 0x16, 0x8c, 0x90, 0x0a, 0x42, 0x0e, 0x32, 0x5a, 0x0b, 0x91, 0x82, 0xc2, 0x96, 0x25, 0xec,
+	0x34, 0x54, 0x1a, 0x8d, 0xbb, 0x72, 0x90, 0xd1, 0x54, 0x3c, 0x8a, 0x02, 0x5b, 0xc0, 0xc4, 0x17,
+	0x42, 0xfb, 0x6f, 0x2d, 0xa9, 0x8e, 0x38, 0x02, 0x6d, 0x84, 0x8a, 0xf1, 0x56, 0x0a, 0x81, 0xa1,
+	0x74, 0xbc, 0xa5, 0x42, 0x20, 0x55, 0x03, 0x2c, 0xc2, 0x6c, 0x3d, 0x8a, 0x78, 0x28, 0x66, 0x84,
+	0x34, 0x2b, 0x0e, 0xe5, 0xa5, 0x55, 0x9e, 0xdd, 0x58, 0xa9, 0xdb, 0x8c, 0xec, 0xbe, 0x88, 0xec,
+	0x3c, 0x54, 0xeb, 0xbd, 0x96, 0xc7, 0xfd, 0xa6, 0x11, 0xbe, 0xd3, 0x95, 0x30, 0x3b, 0x29, 0x65,
+	0x1f, 0xc0, 0x89, 0x4c, 0x18, 0x60, 0x39, 0x02, 0xa3, 0xe9, 0x76, 0xac, 0x2e, 0xd5, 0xa9, 0x29,
+	0x14, 0x0d, 0x49, 0x31, 0x25, 0xab, 0x43, 0x6d, 0x19, 0x1d, 0x24, 0x97, 0x38, 0xbd, 0xca, 0x06,
+	0x21, 0x79, 0xc6, 0x92, 0x0a, 0x44, 0x06, 0x4a, 0x6e, 0x25, 0x85, 0x76, 0x0e, 0x9d, 0xdd, 0x82,
+	0x63, 0x59, 0x98, 0x38, 0xd4, 0x49, 0xdb, 0x81, 0xdb, 0x61, 0x8e, 0x0b, 0x1e, 0xeb, 0x45, 0x54,
+	0x6c, 0x03, 0x66, 0x52, 0x53, 0x40, 0x53, 0x07, 0xa2, 0x3c, 0x0c, 0x92, 0x72, 0xa5, 0x07, 0x79,
+	0x46, 0x4e, 0xc6, 0x63, 0xa9, 0x59, 0x61, 0xa2, 0x0b, 0xb1, 0xf3, 0xec, 0x58, 0x0b, 0xa6, 0x1a,
+	0xde, 0x96, 0xef, 0xf9, 0x5b, 0xb7, 0xf8, 0xde, 0x9a, 0xeb, 0x85, 0xd2, 0xd6, 0x5b, 0x79, 0x72,
+	0xd4, 0xa3, 0xbd, 0x4e, 0x87, 0xc7, 0x21, 0xae, 0x7a, 0x51, 0x8e, 0xd1, 0x1f, 0xc4, 0xdd, 0x76,
+	0x2e, 0x22, 0x3a, 0x74, 0x98, 0xee, 0xba, 0x9e, 0x21, 0x17, 0x98, 0x3c, 0x0d, 0x3d, 0xd4, 0xc4,
+	0x80, 0x7a, 0xa8, 0x36, 0xcc, 0x2c, 0xfb, 0xcd, 0x70, 0x0f, 0x1f, 0xc7, 0x55, 0xe3, 0x26, 0x0f,
+	0x69, 0xdc, 0x8b, 0xb2, 0x71, 0xcf, 0xba, 0x6a, 0x86, 0x15, 0x35, 0x2f, 0xcf, 0x98, 0x35, 0x60,
+	0x06, 0x2f, 0x1b, 0x2b, 0x4b, 0x6b, 0x2b, 0xbe, 0x17, 0x7b, 0x6e, 0xcc, 0x5b, 0x52, 0xde, 0x48,
+	0x52, 0x91, 0x91, 0xbe, 0xc1, 0x6b, 0x75, 0x1d, 0x4f, 0xa1, 0xe8, 0x4c, 0x73, 0xf4, 0x07, 0x5d,
+	0xfa, 0xa7, 0xff, 0x90, 0x2e, 0xfd, 0x2b, 0x30, 0x9d, 0x0d, 0xa2, 0x52, 0x4b, 0xc5, 0x84, 0x08,
+	0x8b, 0x84, 0xb4, 0x11, 0xf4, 0x50, 0xbe, 0x34, 0xc2, 0x74, 0x65, 0xc2, 0xa7, 0x64, 0xf4, 0x07,
+	0x33, 0x86, 0xfe, 0xc0, 0xd8, 0x95, 0x8e, 0xa2, 0x3f, 0x58, 0x03, 0xb8, 0x16, 0x84, 0x4d, 0x5e,
+	0xc7, 0xc8, 0x04, 0xcc, 0x48, 0xd8, 0x28, 0x98, 0xa6, 0x85, 0xb4, 0x7e, 0x36, 0xc5, 0x6f, 0x27,
+	0x1b, 0x60, 0x42, 0xe3, 0xc1, 0x5c, 0x38, 0xb5, 0x16, 0xf2, 0x4d, 0x1e, 0x86, 0xbc, 0x25, 0xaf,
+	0x3e, 0x0b, 0x9e, 0xdf, 0x52, 0x59, 0x38, 0x65, 0xca, 0x86, 0xae, 0x42, 0x49, 0x3c, 0x23, 0x36,
+	0x08, 0x49, 0x3f, 0x85, 0xfb, 0xf0, 0xc9, 0xe9, 0x2f, 0x8e, 0x1f, 0x55, 0x7f, 0xb1, 0x0c, 0x53,
+	0x2b, 0x7e, 0xb3, 0xdd, 0x6b, 0x71, 0x69, 0xc1, 0x2d, 0x73, 0x68, 0xa2, 0x0c, 0xe8, 0x51, 0x89,
+	0x23, 0x0d, 0xbd, 0xf5, 0x75, 0x65, 0x12, 0x59, 0x3f, 0x56, 0x86, 0xd9, 0x7e, 0x23, 0x7f, 0xc0,
+	0x6d, 0xf8, 0x55, 0xc8, 0x6f, 0x66, 0xf2, 0x56, 0x5c, 0xe3, 0xd9, 0x2d, 0xed, 0x32, 0x14, 0xef,
+	0x59, 0xf2, 0x96, 0x7c, 0x2c, 0x4b, 0x70, 0x2f, 0x6c, 0xb3, 0xab, 0x30, 0xae, 0x7d, 0x27, 0x3c,
+	0x36, 0xfa, 0x7d, 0x55, 0x1b, 0x36, 0xd3, 0x4f, 0x77, 0x12, 0xe4, 0xa9, 0xa5, 0x6e, 0xd1, 0xf4,
+	0x8b, 0xd5, 0x28, 0x0e, 0xc5, 0x08, 0x99, 0x1a, 0x45, 0x51, 0xc0, 0x18, 0xe0, 0x11, 0x25, 0x5f,
+	0xb2, 0xf1, 0x6f, 0xeb, 0x5f, 0x4f, 0x90, 0xf0, 0xa1, 0xdf, 0x79, 0xfb, 0x39, 0x21, 0x64, 0xee,
+	0xc2, 0xe5, 0xa3, 0xdc, 0x85, 0x2b, 0x87, 0xdf, 0x85, 0x87, 0x0e, 0xbb, 0x0b, 0x67, 0x2e, 0xab,
+	0xc3, 0x47, 0xbc, 0xac, 0x8e, 0x1e, 0xe9, 0xb2, 0x6a, 0xdc, 0xa3, 0xab, 0x87, 0xdd, 0xa3, 0xff,
+	0xf8, 0x6a, 0xfb, 0xb4, 0x5e, 0x6d, 0x8b, 0xa4, 0xd3, 0x23, 0x5d, 0x6d, 0x73, 0x37, 0xd3, 0x99,
+	0x27, 0x73, 0x33, 0x65, 0x4f, 0xec, 0x66, 0x7a, 0xec, 0x93, 0xde, 0x4c, 0x8f, 0x3f, 0xc9, 0x9b,
+	0xe9, 0x89, 0x3f, 0x8a, 0x37, 0xd3, 0x93, 0xff, 0x6e, 0x6e, 0xa6, 0x57, 0xa0, 0xba, 0x16, 0x44,
+	0xf1, 0xb5, 0x20, 0xec, 0xe0, 0xe5, 0x78, 0x42, 0x3e, 0x04, 0x04, 0x11, 0x25, 0xe4, 0x37, 0x84,
+	0x3c, 0x89, 0xc8, 0x16, 0xd4, 0x84, 0x53, 0x37, 0xba, 0xd9, 0xf4, 0x2d, 0x46, 0xce, 0x14, 0x79,
+	0xb1, 0xcb, 0xcf, 0x37, 0x75, 0xd1, 0xbb, 0x03, 0x33, 0xca, 0x0d, 0x0a, 0x03, 0x9c, 0xe0, 0xb5,
+	0xf8, 0x74, 0xba, 0x32, 0x53, 0x7f, 0x29, 0x55, 0x6a, 0x24, 0x90, 0xcd, 0x92, 0xde, 0x1c, 0xaa,
+	0x8e, 0xd4, 0x46, 0x6f, 0x0e, 0x55, 0x6b, 0xb5, 0x99, 0x01, 0x6e, 0xbc, 0x3f, 0x0c, 0xb5, 0xac,
+	0x10, 0x7e, 0x78, 0x16, 0x81, 0x27, 0x16, 0x60, 0x57, 0x5c, 0x11, 0xb2, 0x42, 0x30, 0xbb, 0x04,
+	0xb0, 0x16, 0x7a, 0xbb, 0x6e, 0xcc, 0x6f, 0x29, 0xfb, 0x5c, 0x99, 0x36, 0x83, 0xa0, 0x62, 0xc2,
+	0xdb, 0x1a, 0x4a, 0x72, 0xff, 0x2b, 0x17, 0xdd, 0xff, 0xac, 0xbf, 0x50, 0x86, 0x19, 0x8a, 0x2c,
+	0xf9, 0xf4, 0x5b, 0x1e, 0x7c, 0xd1, 0xb8, 0xd5, 0x3f, 0x9b, 0x26, 0x03, 0xd2, 0x7b, 0x77, 0x80,
+	0xed, 0xc1, 0xd7, 0xe0, 0x44, 0x6e, 0x28, 0xf0, 0x66, 0xbf, 0xa4, 0x62, 0x7a, 0xe6, 0xee, 0xf6,
+	0xb3, 0xc5, 0x95, 0xdc, 0xbf, 0x62, 0xe7, 0x28, 0xac, 0x5f, 0x1e, 0xce, 0xf1, 0x97, 0x56, 0x08,
+	0xba, 0x5d, 0x41, 0xe9, 0x68, 0x76, 0x05, 0xe5, 0xc1, 0xec, 0x0a, 0x32, 0x12, 0x49, 0x65, 0x10,
+	0x89, 0xe4, 0x03, 0x98, 0x5c, 0xe7, 0x6e, 0x27, 0x5a, 0x0f, 0x64, 0x66, 0x49, 0xf2, 0x06, 0x53,
+	0x21, 0x3b, 0x45, 0x99, 0xba, 0x98, 0x26, 0x56, 0xed, 0xb1, 0x20, 0x10, 0x67, 0x2e, 0xa5, 0x9a,
+	0xb4, 0x4d, 0x0e, 0xba, 0xb6, 0x61, 0xf8, 0x00, 0x6d, 0x43, 0x03, 0x26, 0x24, 0x5d, 0x9a, 0x3a,
+	0x21, 0xbd, 0x16, 0x8b, 0x22, 0x84, 0xab, 0xda, 0x95, 0x5b, 0xf6, 0x54, 0x52, 0x3b, 0xdd, 0x88,
+	0x0d, 0x26, 0x62, 0x08, 0xd4, 0xc3, 0x99, 0x18, 0x82, 0xd1, 0x74, 0x08, 0xd4, 0x23, 0x1b, 0x0d,
+	0x81, 0x86, 0xc4, 0xde, 0x83, 0xa9, 0xfa, 0xda, 0x8a, 0x4e, 0x56, 0x4d, 0x4d, 0x1b, 0xdc, 0xae,
+	0xe7, 0x18, 0xa4, 0x19, 0xdc, 0x83, 0x6e, 0x88, 0x63, 0x7f, 0x48, 0x37, 0xc4, 0xec, 0x5d, 0x06,
+	0x8e, 0x78, 0x97, 0xb1, 0x7e, 0x75, 0x42, 0xed, 0x0f, 0x9f, 0xee, 0x63, 0x93, 0xf9, 0x7c, 0x54,
+	0x39, 0xe2, 0xf3, 0xd1, 0xd0, 0x61, 0x62, 0xaf, 0x26, 0x5d, 0x8f, 0x7c, 0xe2, 0xa7, 0xa0, 0xd1,
+	0x23, 0xca, 0xcb, 0x99, 0xc5, 0x57, 0x1d, 0x64, 0xf1, 0x15, 0xca, 0xd8, 0x63, 0x9f, 0x5c, 0xc6,
+	0x86, 0x23, 0xcb, 0xd8, 0x8d, 0x34, 0xdc, 0xc2, 0xf8, 0xa1, 0x5e, 0x6c, 0x67, 0xa4, 0x3a, 0x65,
+	0xa6, 0x38, 0x70, 0x68, 0x12, 0x78, 0xe1, 0x07, 0x4a, 0x70, 0xff, 0x46, 0xb1, 0xe0, 0x7e, 0xf0,
+	0x01, 0xf4, 0xc7, 0xa2, 0xfb, 0x1f, 0x8b, 0xee, 0x7f, 0x28, 0xa2, 0xfb, 0x5d, 0x60, 0x6e, 0x2f,
+	0xde, 0x16, 0x12, 0x70, 0x13, 0x83, 0x57, 0x8b, 0x4f, 0x8c, 0x42, 0xbc, 0x5c, 0x23, 0xf9, 0x52,
+	0x7d, 0x8d, 0x18, 0xa5, 0x62, 0x06, 0x50, 0xc0, 0xdf, 0x81, 0x45, 0xe8, 0x10, 0x57, 0xd4, 0x03,
+	0x37, 0xf4, 0xf1, 0x40, 0xba, 0x04, 0xa3, 0x2a, 0x58, 0x72, 0x29, 0xd5, 0xbe, 0xe7, 0xa3, 0x24,
+	0x2b, 0x2c, 0x76, 0x19, 0xaa, 0x8a, 0x58, 0x4f, 0x50, 0xf7, 0x50, 0xc2, 0x8c, 0x38, 0xb4, 0x12,
+	0x66, 0xfd, 0x87, 0x43, 0x6a, 0xd7, 0x16, 0x0d, 0x5e, 0x73, 0x43, 0xb7, 0x83, 0xf9, 0x71, 0x93,
+	0x45, 0xa5, 0x09, 0xf0, 0x99, 0x75, 0x98, 0x71, 0x40, 0x32, 0x49, 0x3e, 0x56, 0xb4, 0xeb, 0xd7,
+	0x60, 0x44, 0xca, 0x4f, 0x24, 0xf1, 0xa3, 0xec, 0x90, 0xcb, 0xc4, 0x2d, 0x71, 0xd8, 0xdb, 0x46,
+	0xfe, 0xfe, 0xa1, 0x34, 0x61, 0xb4, 0xd8, 0xc9, 0x0e, 0xce, 0xdc, 0x7f, 0x55, 0x4f, 0xb4, 0x3f,
+	0x9c, 0xc6, 0x1e, 0x44, 0xca, 0x03, 0x52, 0xec, 0x27, 0x37, 0x92, 0x91, 0xa3, 0xc4, 0x91, 0x1f,
+	0xfd, 0x77, 0x1a, 0x47, 0x7e, 0x19, 0x40, 0x9e, 0xae, 0xa9, 0x75, 0xc7, 0x4b, 0xb8, 0xf9, 0x48,
+	0x4f, 0x83, 0x38, 0x6e, 0xf7, 0x49, 0x8b, 0xa5, 0x11, 0x5a, 0xff, 0x98, 0xc1, 0x4c, 0xa3, 0x71,
+	0x77, 0xc9, 0x73, 0xb7, 0xfc, 0x20, 0x8a, 0xbd, 0xe6, 0x8a, 0xbf, 0x19, 0x08, 0x71, 0x3c, 0x39,
+	0x01, 0xb4, 0x08, 0xe0, 0xe9, 0xee, 0x9f, 0x14, 0x8b, 0xeb, 0xde, 0x72, 0x18, 0x2a, 0x05, 0x2b,
+	0x5d, 0xf7, 0xb8, 0x00, 0xd8, 0x04, 0x17, 0x12, 0x6f, 0xa3, 0x87, 0xf1, 0x77, 0xa4, 0x09, 0x0d,
+	0x4a, 0xbc, 0x11, 0x81, 0x6c, 0x55, 0xc6, 0x78, 0x7e, 0xc2, 0xca, 0x1b, 0xd0, 0x29, 0x23, 0x1a,
+	0x7d, 0x5a, 0x4c, 0x6b, 0x57, 0xca, 0x1f, 0xb8, 0x6b, 0x77, 0x11, 0xae, 0x9b, 0x82, 0xe6, 0xd6,
+	0xc0, 0x1e, 0x9c, 0x30, 0x22, 0x33, 0x0c, 0xfa, 0xf0, 0xf4, 0x8a, 0x94, 0xb0, 0x2d, 0x34, 0xb7,
+	0x2f, 0x78, 0x7d, 0xd2, 0x13, 0xde, 0x16, 0xd6, 0xc0, 0xfe, 0x42, 0x09, 0xce, 0x14, 0x96, 0x24,
+	0xab, 0x7b, 0xdc, 0xc8, 0x08, 0xa0, 0x6d, 0x1a, 0x94, 0xda, 0xb7, 0x5f, 0xd5, 0x4e, 0xc1, 0x56,
+	0x70, 0x70, 0x4d, 0xec, 0xef, 0x96, 0xe0, 0x94, 0x81, 0x91, 0xec, 0x96, 0x51, 0x12, 0xb4, 0xa8,
+	0x70, 0x5e, 0x7f, 0xf4, 0x64, 0xe6, 0xf5, 0x0b, 0x66, 0x5f, 0xd2, 0xdd, 0x52, 0xef, 0x43, 0xbf,
+	0x16, 0xb2, 0x5d, 0x98, 0xc1, 0x22, 0xf5, 0x08, 0x26, 0xe6, 0xac, 0x7c, 0x3b, 0x3b, 0x9e, 0x36,
+	0x9b, 0xa2, 0x8d, 0x08, 0xd9, 0x7a, 0xe1, 0xf2, 0xf7, 0xf6, 0xe7, 0x27, 0x0d, 0x74, 0x15, 0x63,
+	0xdf, 0x49, 0x5f, 0xd2, 0x3c, 0x7f, 0x33, 0x30, 0x54, 0x27, 0xd9, 0x2a, 0xd8, 0xdf, 0x2b, 0xd1,
+	0x7b, 0x04, 0x75, 0xe3, 0x5a, 0x18, 0x74, 0x92, 0x72, 0x65, 0x53, 0xdc, 0x67, 0xd8, 0xda, 0x4f,
+	0x66, 0xd8, 0x5e, 0xc2, 0x26, 0xd3, 0x9e, 0xe0, 0x6c, 0x86, 0x41, 0x27, 0x6d, 0xbe, 0x3e, 0x70,
+	0x7d, 0x1b, 0xc9, 0xfe, 0x74, 0x09, 0x4e, 0x1b, 0x6a, 0x54, 0x3d, 0x79, 0x92, 0x8c, 0xe9, 0x92,
+	0xf8, 0xb6, 0x69, 0x45, 0x0b, 0x17, 0xe5, 0xfc, 0x3f, 0x87, 0x2d, 0xd0, 0x82, 0x0b, 0x0b, 0x24,
+	0xa7, 0x43, 0x58, 0x5a, 0x13, 0xfa, 0xd7, 0xc2, 0x3c, 0x98, 0x41, 0x23, 0x25, 0xc3, 0xf6, 0xfd,
+	0x78, 0x7f, 0xdb, 0xf7, 0x24, 0xf1, 0x1e, 0xa6, 0x39, 0xe9, 0x6f, 0x00, 0x9f, 0xe7, 0xca, 0x7e,
+	0x04, 0x4e, 0xe7, 0x80, 0xc9, 0x6a, 0x3b, 0xd1, 0x77, 0xb5, 0xbd, 0xfa, 0x78, 0x7f, 0xfe, 0xe5,
+	0xa2, 0xda, 0x8a, 0x56, 0x5a, 0xff, 0x1a, 0x98, 0x0b, 0x90, 0x16, 0x4a, 0xe9, 0xa7, 0x78, 0x82,
+	0xbe, 0x2a, 0xe7, 0x87, 0x86, 0x2f, 0xf6, 0x72, 0xad, 0x0d, 0xfa, 0x91, 0x97, 0x22, 0x31, 0x0e,
+	0x13, 0x5a, 0x8a, 0x97, 0x3d, 0x69, 0xb7, 0xd3, 0xa7, 0x92, 0xef, 0xed, 0xcf, 0x1b, 0xd8, 0xe2,
+	0x0e, 0xa4, 0xe7, 0x8e, 0x31, 0x84, 0x4d, 0x1d, 0x91, 0xfd, 0x4a, 0x09, 0x8e, 0x0b, 0x40, 0x3a,
+	0xa9, 0x64, 0xa7, 0x66, 0x0f, 0x9a, 0xf5, 0xdb, 0x4f, 0x66, 0xd6, 0x3f, 0x8f, 0x6d, 0xd4, 0x67,
+	0x7d, 0x6e, 0x48, 0x0a, 0x1b, 0x87, 0xb3, 0xdd, 0xb0, 0x87, 0x33, 0x66, 0xfb, 0xe9, 0x01, 0x66,
+	0x3b, 0x7d, 0x80, 0xc3, 0x67, 0x7b, 0xdf, 0x5a, 0xd8, 0x3a, 0x4c, 0xc8, 0xeb, 0x0f, 0x0d, 0xd8,
+	0x73, 0x86, 0xff, 0xa8, 0x5e, 0x44, 0x77, 0x52, 0x99, 0x01, 0x27, 0xd7, 0x43, 0x83, 0x0b, 0xf3,
+	0xe1, 0x18, 0xfd, 0x36, 0xf5, 0x53, 0xf3, 0x7d, 0xf5, 0x53, 0xe7, 0x65, 0x8f, 0xce, 0x4a, 0xfe,
+	0x19, 0x35, 0x95, 0x1e, 0x24, 0xae, 0x80, 0x31, 0xeb, 0x02, 0x33, 0xc0, 0xb4, 0x68, 0xcf, 0x1e,
+	0xac, 0x95, 0x7a, 0x59, 0xd6, 0x39, 0x9f, 0xad, 0x33, 0xbb, 0x72, 0x0b, 0x78, 0x33, 0x17, 0xa6,
+	0x25, 0x34, 0xd8, 0xe1, 0xb4, 0xc3, 0x3f, 0x6f, 0x84, 0xe9, 0xcb, 0x94, 0xd2, 0x1d, 0x4e, 0xd5,
+	0x84, 0x61, 0x14, 0x33, 0x1b, 0x7a, 0x96, 0x1f, 0xbb, 0x0b, 0x33, 0xf5, 0x6e, 0xb7, 0xed, 0xf1,
+	0x16, 0xf6, 0xd2, 0xee, 0x89, 0x3e, 0x59, 0x69, 0xca, 0x53, 0x97, 0x0a, 0xe5, 0xc5, 0x32, 0xec,
+	0x65, 0xb6, 0x9b, 0x1c, 0xad, 0xf5, 0xe7, 0x4a, 0xb9, 0x46, 0xb3, 0xd7, 0x60, 0x0c, 0x7f, 0x68,
+	0x91, 0x9f, 0x50, 0x4b, 0x43, 0x4d, 0x44, 0xfd, 0x4f, 0x8a, 0x20, 0x84, 0x25, 0x3d, 0xfa, 0x6b,
+	0x85, 0x84, 0x25, 0xa9, 0x4a, 0x48, 0x95, 0x07, 0xf3, 0xca, 0x27, 0xa9, 0x92, 0x0a, 0x5d, 0xe8,
+	0x93, 0x24, 0x3d, 0x91, 0xac, 0xff, 0xb4, 0x6c, 0x4e, 0x3b, 0x76, 0x5e, 0x93, 0xdb, 0xb5, 0xf8,
+	0xb3, 0x4a, 0x6e, 0xd7, 0xa4, 0xf5, 0x5f, 0x2c, 0xc1, 0xb1, 0xbb, 0x5a, 0x22, 0xee, 0xf5, 0x00,
+	0xbf, 0xcb, 0xc1, 0x29, 0xa7, 0x9f, 0x54, 0x16, 0x5c, 0x3d, 0x03, 0xb8, 0x98, 0x29, 0x38, 0x65,
+	0xec, 0xa2, 0xf6, 0xa0, 0xbf, 0x2a, 0x36, 0x4c, 0x4b, 0x46, 0x4c, 0xe8, 0x04, 0x3f, 0x62, 0x3e,
+	0x1c, 0xeb, 0x2f, 0x96, 0x61, 0x5c, 0x5b, 0x31, 0xec, 0xb3, 0x30, 0xa1, 0x57, 0xab, 0xab, 0xf8,
+	0xf4, 0x56, 0xda, 0x06, 0x16, 0xea, 0xf8, 0xb8, 0xdb, 0x31, 0x74, 0x7c, 0x62, 0x5d, 0x20, 0xf4,
+	0x88, 0x37, 0xa1, 0xf7, 0x0b, 0x6e, 0x42, 0x38, 0xcb, 0x35, 0x9d, 0xce, 0x81, 0xf7, 0xa1, 0xf7,
+	0xf2, 0xf7, 0x21, 0x54, 0x2f, 0x69, 0xf4, 0xfd, 0x6f, 0x45, 0xd6, 0x4f, 0x96, 0xa0, 0x96, 0x5d,
+	0xd3, 0x9f, 0xca, 0xa8, 0x1c, 0xe1, 0x41, 0xe8, 0x3b, 0xe5, 0x24, 0x1d, 0x94, 0x0a, 0x24, 0xf0,
+	0xb4, 0x5a, 0x60, 0x7e, 0xc1, 0x78, 0xab, 0x79, 0xc6, 0x0c, 0xb1, 0xa9, 0x47, 0xf4, 0x29, 0x8e,
+	0xab, 0x3b, 0xf4, 0xdd, 0x5f, 0x98, 0xff, 0x8c, 0xf5, 0x65, 0x38, 0x9e, 0x1d, 0x0e, 0x7c, 0xaf,
+	0xa9, 0xc3, 0xb4, 0x09, 0xcf, 0x26, 0x93, 0xcb, 0x52, 0xd9, 0x59, 0x7c, 0xeb, 0xb7, 0xca, 0x59,
+	0xde, 0xd2, 0x1a, 0x53, 0xec, 0x51, 0xba, 0xe1, 0x8d, 0xdc, 0xa3, 0x08, 0x64, 0xab, 0xb2, 0xa3,
+	0x24, 0x84, 0x4c, 0x5c, 0xcf, 0x2b, 0xc5, 0xae, 0xe7, 0xec, 0x6a, 0xc6, 0x26, 0x5d, 0x0b, 0x05,
+	0xf7, 0x90, 0x6f, 0x38, 0xa9, 0x5d, 0x7a, 0xce, 0x14, 0xfd, 0xb8, 0x91, 0xd7, 0x40, 0xd1, 0x0f,
+	0xa7, 0xda, 0xf5, 0x18, 0x0b, 0x88, 0xb8, 0x10, 0x99, 0xdd, 0x80, 0x51, 0xd1, 0xcc, 0xdb, 0x6e,
+	0x57, 0x3e, 0xc3, 0xb0, 0x24, 0x38, 0x46, 0x3b, 0xb9, 0x1f, 0x6a, 0xf1, 0x31, 0xda, 0x5c, 0x48,
+	0x08, 0xfa, 0xc4, 0x92, 0x88, 0xd6, 0xff, 0x55, 0x12, 0xeb, 0xbf, 0xb9, 0xf3, 0x03, 0x96, 0x09,
+	0x52, 0x74, 0xe9, 0x00, 0x63, 0xe1, 0x7f, 0x56, 0xa6, 0x04, 0x5f, 0x72, 0xfa, 0xbc, 0x0d, 0x23,
+	0x14, 0x35, 0x43, 0x86, 0xd2, 0xd0, 0xb9, 0x50, 0x41, 0x1a, 0xa8, 0x8e, 0x02, 0x6a, 0xd8, 0x92,
+	0x40, 0x57, 0x9d, 0x95, 0x07, 0x52, 0x9d, 0x69, 0x9a, 0xfb, 0xca, 0x13, 0xd3, 0xdc, 0xff, 0x50,
+	0x92, 0xcb, 0xab, 0x1e, 0x0f, 0x10, 0x36, 0xff, 0x6c, 0x36, 0x75, 0x5e, 0x2e, 0xc1, 0x41, 0xca,
+	0x8e, 0x5d, 0xd5, 0x93, 0xf1, 0x69, 0x3e, 0xd0, 0x87, 0xa4, 0xdd, 0xb3, 0x7e, 0x6d, 0x88, 0xc6,
+	0x58, 0x0e, 0xd4, 0x39, 0x23, 0xd2, 0x03, 0xae, 0x93, 0x8c, 0x56, 0x93, 0x62, 0x3e, 0x9c, 0x83,
+	0x21, 0x31, 0x37, 0xe5, 0x68, 0x22, 0x9e, 0x98, 0xbf, 0x3a, 0x9e, 0x28, 0x17, 0x6b, 0x19, 0xcf,
+	0x24, 0x3d, 0x63, 0x2b, 0x1e, 0x5b, 0xfa, 0x5a, 0x46, 0x0c, 0xd1, 0x83, 0x24, 0x55, 0x8d, 0xde,
+	0x83, 0xce, 0xa6, 0x9b, 0xcf, 0x89, 0xa9, 0xe5, 0xc7, 0x5a, 0x86, 0xa9, 0x07, 0x9e, 0xdf, 0x0a,
+	0x1e, 0x46, 0x4b, 0x3c, 0xda, 0x89, 0x83, 0xae, 0x34, 0x90, 0x46, 0x0d, 0xff, 0x43, 0x2a, 0x71,
+	0x5a, 0x54, 0xa4, 0x3f, 0x87, 0x98, 0x44, 0x6c, 0x01, 0x26, 0x8d, 0x60, 0xcf, 0xf2, 0x95, 0x13,
+	0x75, 0x9c, 0x66, 0xa8, 0x68, 0x5d, 0xc7, 0x69, 0x90, 0x88, 0x53, 0x5a, 0xb6, 0x5f, 0x7b, 0xeb,
+	0xcc, 0xb5, 0x5d, 0xe2, 0xb0, 0x2b, 0x50, 0xa5, 0x98, 0x31, 0x2b, 0x4b, 0xfa, 0xf3, 0x54, 0x84,
+	0xb0, 0x4c, 0x44, 0x2d, 0x85, 0xc8, 0x16, 0x61, 0x72, 0x21, 0x88, 0x57, 0xfc, 0x28, 0x76, 0xfd,
+	0x26, 0x4f, 0x42, 0x5b, 0x63, 0x67, 0x37, 0x82, 0xd8, 0xf1, 0x64, 0x89, 0x49, 0x6f, 0xd2, 0x88,
+	0xa1, 0xbe, 0x19, 0x78, 0x3e, 0x6d, 0x9d, 0xe3, 0xe9, 0x50, 0x7f, 0x14, 0x78, 0x7e, 0x2e, 0x9a,
+	0x74, 0x8a, 0x9a, 0xc6, 0x66, 0x21, 0xff, 0x4d, 0x7b, 0xe8, 0x4e, 0xd0, 0xe2, 0x96, 0x4c, 0xc3,
+	0x27, 0xe3, 0x21, 0xbf, 0x0a, 0xa3, 0xb4, 0xf8, 0xb2, 0x09, 0xbf, 0xd3, 0x59, 0x66, 0x2b, 0x0c,
+	0x66, 0xc1, 0xa4, 0xe7, 0x3b, 0x64, 0x12, 0x19, 0xf8, 0x6d, 0x4a, 0x67, 0x55, 0xb5, 0xc7, 0x3d,
+	0x1f, 0x0d, 0x21, 0xef, 0xfa, 0xed, 0x3d, 0xeb, 0x0d, 0xa8, 0xc9, 0x0d, 0x35, 0xc9, 0x2f, 0x8c,
+	0x86, 0x19, 0x2b, 0x4b, 0xb6, 0xbe, 0x09, 0x36, 0xbd, 0x56, 0x68, 0x23, 0x14, 0x5d, 0x34, 0xef,
+	0xf0, 0xf8, 0x61, 0x10, 0xee, 0xd8, 0x3c, 0x8a, 0x43, 0x8f, 0xd2, 0x15, 0xe3, 0x36, 0xf2, 0x59,
+	0xf6, 0x1e, 0x0c, 0xa3, 0x45, 0x72, 0xe6, 0x5c, 0xcb, 0xd6, 0xb1, 0x30, 0x29, 0x97, 0xdf, 0x30,
+	0x9a, 0x37, 0xdb, 0x44, 0xc4, 0xde, 0x86, 0xa1, 0x25, 0xee, 0xef, 0x65, 0xb2, 0x9f, 0xe6, 0x88,
+	0x93, 0xed, 0xac, 0xc5, 0xfd, 0x3d, 0x1b, 0x49, 0xac, 0x9f, 0x2c, 0xc3, 0x89, 0x82, 0x66, 0xdd,
+	0xff, 0xec, 0x53, 0xba, 0xa7, 0x2f, 0x18, 0x7b, 0xba, 0x7a, 0x90, 0xef, 0x3b, 0xf0, 0x85, 0x5b,
+	0xfc, 0x5f, 0x2d, 0xc1, 0x29, 0x73, 0x21, 0x4a, 0x17, 0x84, 0xfb, 0x57, 0xd8, 0xbb, 0x30, 0x72,
+	0x83, 0xbb, 0x2d, 0xae, 0x52, 0x1d, 0x66, 0x13, 0x8a, 0x53, 0x21, 0xb1, 0x4d, 0xfd, 0xca, 0x09,
+	0xca, 0x96, 0x64, 0xe3, 0xe8, 0xf2, 0x61, 0xa9, 0xf8, 0x43, 0xff, 0x1f, 0x7b, 0xdf, 0x16, 0x1b,
+	0x49, 0x76, 0x1d, 0x36, 0xd5, 0xdd, 0x24, 0x9b, 0x87, 0xaf, 0xe2, 0x1d, 0xce, 0x0c, 0x87, 0x33,
+	0x3b, 0x8f, 0xda, 0xdd, 0xf1, 0x2e, 0x57, 0xfb, 0x98, 0xd9, 0xec, 0x63, 0xa4, 0x7d, 0xa8, 0xd8,
+	0x5d, 0x24, 0x7b, 0xa6, 0xd9, 0xdd, 0x5b, 0xd5, 0x9c, 0xf1, 0x68, 0x25, 0x97, 0x6b, 0xba, 0x8b,
+	0x64, 0xed, 0x34, 0xbb, 0x7a, 0xab, 0xaa, 0x77, 0x86, 0x82, 0x01, 0xcb, 0x16, 0x22, 0x03, 0x0e,
+	0x6c, 0x39, 0xb6, 0x83, 0x2c, 0x84, 0x04, 0x09, 0x10, 0xc1, 0xf0, 0x87, 0x91, 0x04, 0xc9, 0x8f,
+	0x61, 0x01, 0x49, 0xfc, 0x27, 0x40, 0x50, 0x9e, 0x80, 0x81, 0x28, 0xc6, 0xc2, 0x96, 0x10, 0x20,
+	0x10, 0x9c, 0x2f, 0x23, 0xf9, 0x50, 0xa0, 0x20, 0xb8, 0xe7, 0xde, 0x5b, 0x75, 0xab, 0xba, 0xba,
+	0xc9, 0xd1, 0xac, 0x9c, 0xd8, 0xd1, 0x0f, 0xc1, 0x3e, 0xf7, 0x9c, 0x53, 0xf7, 0x79, 0xee, 0xb9,
+	0xe7, 0x9e, 0x7b, 0x4e, 0xde, 0xa7, 0x26, 0xb8, 0xb5, 0x7c, 0x5c, 0x80, 0x0b, 0x13, 0x68, 0xe8,
+	0xc0, 0xd1, 0xa1, 0x97, 0x07, 0x0e, 0xf5, 0x01, 0x84, 0x92, 0x77, 0x60, 0xa9, 0xcd, 0x0f, 0x2f,
+	0x62, 0x38, 0x0a, 0x89, 0x5c, 0x10, 0xe7, 0x1a, 0xe1, 0xc8, 0x65, 0x66, 0x91, 0x53, 0xc1, 0xba,
+	0x8a, 0x13, 0x83, 0x75, 0xc9, 0xb1, 0xaf, 0x4a, 0x3f, 0x61, 0xec, 0xab, 0xa9, 0xc9, 0xb1, 0xaf,
+	0xa6, 0x33, 0xb1, 0xaf, 0xee, 0xc1, 0x4a, 0xba, 0x67, 0xf8, 0xfa, 0x4f, 0xe2, 0x86, 0x29, 0xe3,
+	0xe3, 0x86, 0x4d, 0x8c, 0xba, 0xac, 0xfd, 0xa6, 0x02, 0x6a, 0x9a, 0xf7, 0x93, 0xce, 0x86, 0xb7,
+	0x53, 0xb3, 0xe1, 0x42, 0xfe, 0x6c, 0x18, 0x3f, 0x0d, 0xfe, 0xbb, 0x92, 0x6d, 0xec, 0x89, 0xc6,
+	0x5f, 0x83, 0xe9, 0xaa, 0x7f, 0xe8, 0x78, 0x62, 0xd8, 0xf1, 0xf5, 0x51, 0x17, 0x21, 0x26, 0x2f,
+	0x39, 0x59, 0x98, 0xb5, 0x2b, 0x30, 0xd5, 0xf0, 0xfb, 0x7a, 0x95, 0xbb, 0x4f, 0x23, 0x9f, 0xbe,
+	0xdf, 0xb7, 0x9d, 0xae, 0xc9, 0x0a, 0x48, 0x1d, 0xc0, 0xea, 0x04, 0xae, 0xdb, 0xb7, 0xbc, 0x2f,
+	0xbb, 0x19, 0x2d, 0x8b, 0xf6, 0x50, 0x6f, 0x88, 0x62, 0x89, 0x5d, 0x32, 0x23, 0xa2, 0x1d, 0x7a,
+	0x5f, 0x96, 0x77, 0x25, 0x89, 0x1e, 0x57, 0x25, 0x0f, 0x6c, 0x99, 0x19, 0x87, 0xeb, 0x3f, 0x8d,
+	0x55, 0x99, 0xfb, 0x29, 0xec, 0xe1, 0xeb, 0xb9, 0xc3, 0xf1, 0xef, 0x14, 0xb8, 0x30, 0x81, 0xe6,
+	0x53, 0x18, 0x95, 0xbf, 0xea, 0x0e, 0x77, 0x01, 0x12, 0x22, 0x4c, 0x73, 0xef, 0x75, 0x79, 0xc8,
+	0xb8, 0x05, 0x9e, 0xe6, 0x9e, 0x02, 0x52, 0x69, 0xee, 0x29, 0x80, 0x6a, 0x1c, 0xdb, 0xae, 0xb7,
+	0x7f, 0xc0, 0xbc, 0xd9, 0x16, 0x98, 0x64, 0x39, 0x40, 0x88, 0xac, 0x71, 0x30, 0x1c, 0xed, 0x3f,
+	0x4e, 0xc3, 0x79, 0xd3, 0xdd, 0xf7, 0xe8, 0x99, 0x6c, 0x37, 0xf4, 0xfa, 0xfb, 0xa9, 0x28, 0x5f,
+	0x5a, 0x66, 0xe5, 0xf2, 0xac, 0x3f, 0x14, 0x12, 0xcf, 0xc4, 0xe7, 0xa1, 0x4c, 0xf7, 0x7c, 0x69,
+	0xf1, 0xe2, 0xfd, 0x5e, 0xdf, 0xef, 0xba, 0x3c, 0x52, 0xbe, 0x28, 0x26, 0xeb, 0x5c, 0x45, 0x94,
+	0xf2, 0xb2, 0x51, 0x15, 0xf1, 0x47, 0x9f, 0x5c, 0x06, 0x96, 0xe4, 0x9e, 0x96, 0x72, 0x35, 0x31,
+	0x3e, 0xc7, 0x95, 0xc6, 0x9c, 0xe3, 0x76, 0x60, 0x45, 0xef, 0xb2, 0xbd, 0xd5, 0xe9, 0xb5, 0x02,
+	0xaf, 0xdf, 0xf1, 0x06, 0x4e, 0x4f, 0xd8, 0x26, 0xb0, 0x97, 0x9d, 0xb8, 0xdc, 0x1e, 0xc4, 0x08,
+	0x66, 0x2e, 0x19, 0x6d, 0x46, 0xb5, 0x61, 0x61, 0x08, 0x29, 0x7e, 0x75, 0x8b, 0xcd, 0xe8, 0xf6,
+	0x43, 0x6c, 0x45, 0x68, 0xc6, 0xc5, 0x78, 0x82, 0xc4, 0x8b, 0xfa, 0x76, 0xdd, 0xba, 0xcd, 0x33,
+	0x47, 0x8a, 0xb4, 0x31, 0xcc, 0x05, 0x23, 0xea, 0x85, 0xe8, 0x39, 0x9a, 0xc2, 0x4b, 0xe8, 0x2c,
+	0x6b, 0x9b, 0xd2, 0x95, 0x47, 0xe8, 0xc2, 0xf0, 0x40, 0xa6, 0x63, 0x78, 0xe4, 0x65, 0x3a, 0x15,
+	0x0e, 0xfd, 0xc8, 0xc5, 0x29, 0x3c, 0x9b, 0x9c, 0x37, 0x03, 0x84, 0xb2, 0xf3, 0xa6, 0x84, 0x42,
+	0xde, 0x82, 0xd3, 0x46, 0xe5, 0x86, 0x30, 0xb8, 0x57, 0xfd, 0xce, 0x10, 0x5d, 0x26, 0x00, 0xbf,
+	0x87, 0x63, 0xe8, 0x76, 0x6e, 0x50, 0x69, 0x92, 0x87, 0x46, 0xae, 0xc1, 0x4c, 0xad, 0x2a, 0x2b,
+	0x82, 0x3c, 0x37, 0x22, 0xf7, 0x03, 0x13, 0x85, 0xa4, 0x99, 0x1c, 0x88, 0xe6, 0x8f, 0x3d, 0xb9,
+	0x9c, 0x3f, 0xc1, 0x61, 0xe8, 0x66, 0x56, 0x91, 0x95, 0x12, 0x15, 0x64, 0x14, 0xd9, 0xac, 0xfa,
+	0xfa, 0x26, 0x92, 0x6e, 0xb9, 0x7d, 0x37, 0x48, 0x12, 0x14, 0x4c, 0xb1, 0xbe, 0xa5, 0xa4, 0xfb,
+	0x71, 0x89, 0x99, 0x46, 0x24, 0x26, 0x9c, 0x69, 0x05, 0xee, 0x47, 0x9e, 0x3f, 0x0c, 0xd3, 0x1f,
+	0x5f, 0x4a, 0x94, 0xfd, 0x01, 0x47, 0xb0, 0xb3, 0xb5, 0xc8, 0x27, 0xe5, 0xb9, 0x20, 0x59, 0x06,
+	0xe7, 0x8a, 0xdf, 0x75, 0x43, 0x26, 0x81, 0xfe, 0x06, 0xe5, 0x82, 0x94, 0xda, 0x36, 0x41, 0x2a,
+	0x7f, 0x03, 0x73, 0x41, 0x8e, 0xe0, 0x92, 0x37, 0x61, 0x0a, 0x7f, 0x72, 0x7d, 0xfb, 0x74, 0x0e,
+	0xdb, 0x44, 0xd7, 0xee, 0x50, 0x4c, 0x93, 0x11, 0x90, 0x1a, 0xcc, 0xf0, 0x83, 0xea, 0xe3, 0x64,
+	0x34, 0xe3, 0x27, 0x5e, 0x36, 0xdb, 0x38, 0xbd, 0xd6, 0x85, 0x79, 0xf9, 0x83, 0x74, 0x95, 0x6d,
+	0x3b, 0xe1, 0x81, 0xdb, 0xa5, 0xbf, 0x78, 0x32, 0x52, 0x5c, 0x65, 0x07, 0x08, 0xb5, 0x69, 0x3d,
+	0x4c, 0x09, 0x85, 0xee, 0xd3, 0xb5, 0x70, 0x37, 0xe4, 0x55, 0xe1, 0xa6, 0x2b, 0x0f, 0xcd, 0xa0,
+	0x5d, 0x93, 0x17, 0x69, 0x5f, 0x80, 0x95, 0xc6, 0xb0, 0xd7, 0x73, 0xee, 0xf7, 0x5c, 0x91, 0xac,
+	0x2a, 0x72, 0x22, 0x97, 0x6c, 0xc0, 0x14, 0xfe, 0x83, 0x1f, 0x5a, 0x4c, 0x12, 0x06, 0x4b, 0x38,
+	0xe8, 0x07, 0xac, 0x60, 0x88, 0x30, 0xfa, 0x33, 0x15, 0x22, 0x8c, 0x02, 0xb4, 0x6f, 0x2b, 0xb0,
+	0x22, 0xdc, 0x2f, 0x02, 0xa7, 0xf3, 0xc0, 0x0d, 0xb8, 0xc2, 0x75, 0x2d, 0x35, 0xd7, 0x70, 0x11,
+	0x64, 0xa6, 0x11, 0x9b, 0x75, 0xb7, 0x44, 0x25, 0xd2, 0x4a, 0x50, 0x5e, 0x85, 0x8f, 0xab, 0x0c,
+	0x79, 0x0b, 0xe6, 0xf8, 0x96, 0x2b, 0x45, 0x21, 0xc6, 0x08, 0x85, 0xfc, 0xa0, 0x9d, 0x75, 0x06,
+	0x92, 0xd1, 0x51, 0xbf, 0x4b, 0x37, 0xe5, 0x49, 0xf5, 0x8a, 0x7c, 0xfd, 0x2e, 0xfd, 0x8d, 0x09,
+	0x53, 0xf7, 0xdf, 0xcc, 0x65, 0xfb, 0x96, 0xcf, 0xdd, 0xd7, 0xe5, 0xa0, 0x9c, 0x4a, 0x72, 0x50,
+	0x4e, 0x82, 0x72, 0xca, 0x07, 0xe5, 0x18, 0x35, 0x1e, 0x93, 0xc2, 0x31, 0x63, 0xf2, 0x8e, 0x18,
+	0x93, 0xe2, 0xf8, 0x89, 0x71, 0x7a, 0xc2, 0x38, 0x58, 0xc9, 0x0a, 0x29, 0x9d, 0xc8, 0x4c, 0x75,
+	0x0a, 0x13, 0xac, 0x30, 0x92, 0xac, 0x64, 0xe6, 0x9c, 0x64, 0xdb, 0xd7, 0xd4, 0xc9, 0x99, 0x1e,
+	0x23, 0xee, 0x3f, 0x0b, 0xf3, 0x7a, 0x14, 0x39, 0x9d, 0x03, 0xb7, 0x5b, 0xa5, 0xe2, 0x49, 0x8a,
+	0xba, 0xe7, 0x70, 0xb8, 0x7c, 0x67, 0x29, 0xe3, 0xb2, 0x90, 0xdf, 0x4e, 0xc8, 0xdd, 0x87, 0xe3,
+	0x90, 0xdf, 0x14, 0x92, 0x0e, 0xf9, 0x4d, 0x21, 0xe4, 0x65, 0x98, 0xa9, 0xf5, 0x3f, 0xf2, 0x68,
+	0x9f, 0xb0, 0xc0, 0x7b, 0x68, 0xeb, 0xf3, 0x18, 0x48, 0x16, 0xae, 0x1c, 0x8b, 0xdc, 0x94, 0x8e,
+	0x59, 0xb3, 0x89, 0x35, 0x45, 0x44, 0xef, 0xe5, 0x45, 0xf2, 0x11, 0x2a, 0x3e, 0x77, 0xbd, 0x0e,
+	0x33, 0xc2, 0x32, 0x0c, 0xc9, 0x0e, 0xc2, 0x29, 0x47, 0xc3, 0x9d, 0x08, 0x64, 0xba, 0x7e, 0xe4,
+	0xa4, 0xaa, 0x73, 0xc9, 0xfa, 0x91, 0x93, 0xaa, 0xca, 0xeb, 0x47, 0x4e, 0xaf, 0x1a, 0x1b, 0xd5,
+	0xe6, 0x8f, 0x35, 0xaa, 0xdd, 0x81, 0xf9, 0x96, 0x13, 0x44, 0x1e, 0xd5, 0x7b, 0xfa, 0x51, 0xb8,
+	0xba, 0x90, 0xb2, 0x43, 0x4b, 0x45, 0x1b, 0x97, 0xf8, 0x40, 0x9e, 0x1d, 0x48, 0xf8, 0xe9, 0x2c,
+	0xfb, 0x09, 0x3c, 0xdf, 0x79, 0x78, 0xf1, 0x49, 0x9c, 0x87, 0xb1, 0x53, 0xd1, 0xf6, 0xb8, 0x94,
+	0xd8, 0xc2, 0xf0, 0x20, 0x94, 0x31, 0x40, 0xc6, 0x88, 0xe4, 0x8b, 0x30, 0x4f, 0xff, 0x6f, 0xf9,
+	0x3d, 0xaf, 0xe3, 0xb9, 0xe1, 0xaa, 0x8a, 0x8d, 0xbb, 0x94, 0xbb, 0xfa, 0x11, 0xe9, 0xc8, 0x72,
+	0x23, 0xb6, 0x80, 0x91, 0x71, 0xf6, 0x52, 0x21, 0xc5, 0x8d, 0xbc, 0x0b, 0xf3, 0x74, 0xf6, 0xdd,
+	0x77, 0x42, 0xa6, 0xee, 0x2e, 0x27, 0xee, 0xdf, 0x5d, 0x0e, 0x1f, 0x89, 0xba, 0x2f, 0x13, 0xd0,
+	0x6d, 0x5e, 0x1f, 0x30, 0x01, 0x49, 0xa4, 0xd9, 0x3e, 0x18, 0x11, 0x8e, 0x02, 0x8d, 0x7c, 0x1e,
+	0xe6, 0xf5, 0xc1, 0x20, 0x91, 0x38, 0xa7, 0x25, 0x13, 0xe4, 0x60, 0x60, 0xe7, 0x4a, 0x9d, 0x14,
+	0x45, 0x56, 0x30, 0xaf, 0x3c, 0x96, 0x60, 0x26, 0x2f, 0xc6, 0x27, 0x80, 0x33, 0x89, 0x95, 0x9c,
+	0x1f, 0x46, 0x53, 0xc7, 0x09, 0x76, 0x18, 0xa8, 0xc0, 0x02, 0x33, 0xe8, 0x09, 0x6d, 0xe6, 0xec,
+	0xc8, 0xea, 0xc9, 0x51, 0x6a, 0xd2, 0x34, 0xec, 0xc5, 0xb7, 0x17, 0x79, 0x4e, 0x8f, 0xa7, 0x43,
+	0x58, 0x3d, 0x87, 0xab, 0x96, 0xbf, 0xf8, 0xc6, 0x12, 0xcc, 0x92, 0xe5, 0xa4, 0xb8, 0x64, 0x88,
+	0xb4, 0x1f, 0x28, 0x70, 0x6e, 0xcc, 0x88, 0xc7, 0xc1, 0xf2, 0x95, 0xc9, 0xc1, 0xf2, 0xa9, 0xe4,
+	0x48, 0xdb, 0x69, 0xb0, 0xfd, 0xa3, 0xef, 0xec, 0x62, 0x7d, 0xcb, 0x07, 0xc2, 0x13, 0xd1, 0xf1,
+	0x4f, 0xdf, 0xf2, 0xd1, 0xd4, 0x5d, 0x1c, 0xdd, 0x84, 0x38, 0x1e, 0xab, 0x14, 0x8b, 0xbf, 0xcb,
+	0xf3, 0xdc, 0xc5, 0xc3, 0xfa, 0x81, 0x9f, 0x5a, 0xc1, 0x39, 0xac, 0xb5, 0xaf, 0x17, 0x60, 0x4e,
+	0x5a, 0x87, 0xe4, 0x8a, 0xf4, 0x8a, 0x5b, 0x65, 0x99, 0x12, 0x25, 0x0e, 0x05, 0xb6, 0x13, 0xe1,
+	0xa2, 0x2a, 0x1c, 0x6f, 0xd0, 0xc7, 0xd8, 0x6a, 0x52, 0x42, 0x81, 0x4c, 0x30, 0x35, 0x2c, 0x27,
+	0x5f, 0x02, 0xa8, 0x3b, 0x61, 0xa4, 0x77, 0x22, 0xef, 0x23, 0xf7, 0x04, 0x9b, 0x8e, 0x88, 0x3f,
+	0x7a, 0x06, 0x73, 0xf3, 0x38, 0x48, 0x96, 0xd9, 0x23, 0x24, 0x86, 0x74, 0x08, 0xe4, 0x38, 0xf0,
+	0x7c, 0x08, 0x46, 0x45, 0x88, 0xc0, 0xd2, 0x7e, 0x55, 0x01, 0xd8, 0xad, 0x55, 0x30, 0x85, 0xc8,
+	0x93, 0x6a, 0x11, 0xf9, 0x31, 0xcb, 0x05, 0xf7, 0x09, 0xfa, 0xc3, 0x9f, 0x28, 0xb0, 0x98, 0x46,
+	0x23, 0xef, 0xc0, 0x92, 0xd5, 0x09, 0xfc, 0x5e, 0xef, 0xbe, 0xd3, 0x79, 0x50, 0xf7, 0xfa, 0x2e,
+	0x8b, 0xe3, 0x3c, 0xc5, 0x36, 0xaf, 0x30, 0x2e, 0xb2, 0x7b, 0xb4, 0xcc, 0xcc, 0x22, 0x93, 0xaf,
+	0x2a, 0xb0, 0x60, 0x1d, 0xf8, 0x0f, 0xe3, 0xb0, 0xc8, 0x7c, 0x04, 0xbf, 0x44, 0x85, 0x41, 0x78,
+	0xe0, 0x3f, 0x4c, 0xf2, 0x32, 0xa7, 0x9c, 0x75, 0xdf, 0x3e, 0x99, 0x1f, 0x45, 0xc7, 0xc7, 0x03,
+	0x4c, 0x14, 0xbe, 0x94, 0xfa, 0x88, 0x99, 0xfe, 0xa6, 0xf6, 0x63, 0x05, 0xe6, 0xf0, 0xa8, 0xd3,
+	0xeb, 0xa1, 0x92, 0xf6, 0x37, 0x29, 0xc9, 0x6f, 0xdc, 0xae, 0x09, 0x03, 0xfb, 0x1a, 0x2c, 0x65,
+	0xd0, 0x88, 0x06, 0xd3, 0x16, 0x46, 0x74, 0x90, 0xad, 0x24, 0x2c, 0xc6, 0x83, 0xc9, 0x4b, 0x34,
+	0x43, 0x22, 0xbb, 0x73, 0x1d, 0xef, 0xd5, 0x6f, 0x00, 0x78, 0x02, 0x24, 0x8e, 0x42, 0x24, 0x5b,
+	0x93, 0x3b, 0xd7, 0x4d, 0x09, 0x4b, 0x6b, 0xc0, 0xb4, 0xe5, 0x07, 0xd1, 0xc6, 0x11, 0x3b, 0x7d,
+	0x54, 0xdd, 0xb0, 0x23, 0x5f, 0x9c, 0x7b, 0x78, 0xad, 0xd5, 0x31, 0x79, 0x11, 0xb9, 0x0c, 0x53,
+	0x9b, 0x9e, 0xdb, 0xeb, 0xca, 0x0e, 0xd5, 0x7b, 0x14, 0x60, 0x32, 0x38, 0x3d, 0xa1, 0x9d, 0x4d,
+	0x32, 0x6d, 0x25, 0x9e, 0xdb, 0x4f, 0xba, 0x6e, 0x2a, 0xa9, 0xfe, 0xbd, 0x1a, 0x67, 0xb7, 0x19,
+	0xfd, 0xd2, 0x84, 0xae, 0xfe, 0xe7, 0x0a, 0xac, 0x8d, 0x27, 0x91, 0x9d, 0xc1, 0x95, 0x09, 0xce,
+	0xe0, 0xcf, 0x66, 0x2f, 0x7a, 0x11, 0x8d, 0x5f, 0xf4, 0x26, 0xd7, 0xbb, 0x55, 0xf4, 0xc5, 0xef,
+	0xb8, 0x22, 0xbd, 0xd6, 0x95, 0x09, 0x75, 0x46, 0x44, 0x36, 0xcc, 0x11, 0xd2, 0x98, 0x9c, 0x56,
+	0xfb, 0x57, 0x25, 0x38, 0x3f, 0x96, 0x82, 0x6c, 0x4b, 0x49, 0xfb, 0x16, 0xe3, 0x74, 0x61, 0x63,
+	0xf1, 0x5f, 0xc2, 0xbf, 0xe8, 0x6e, 0x99, 0x7d, 0xe0, 0xd7, 0x8c, 0x93, 0xb5, 0x15, 0x90, 0xd7,
+	0x0b, 0xc7, 0xf2, 0x62, 0xe8, 0xc8, 0x0c, 0x46, 0xf3, 0xb6, 0xe1, 0x5b, 0x52, 0x37, 0x72, 0xbc,
+	0x5e, 0x28, 0x2f, 0xbb, 0x2e, 0x03, 0x99, 0xa2, 0x2c, 0xf1, 0xd0, 0x2f, 0xe5, 0x7b, 0xe8, 0x6b,
+	0xff, 0x5b, 0x81, 0xd9, 0xb8, 0xda, 0x64, 0x0d, 0xce, 0xb6, 0x4d, 0xbd, 0x62, 0xd8, 0xed, 0x7b,
+	0x2d, 0xc3, 0xde, 0x6d, 0x58, 0x2d, 0xa3, 0x52, 0xdb, 0xac, 0x19, 0x55, 0xf5, 0x14, 0x59, 0x86,
+	0x85, 0xdd, 0xc6, 0xed, 0x46, 0xf3, 0x6e, 0xc3, 0x36, 0x4c, 0xb3, 0x69, 0xaa, 0x0a, 0x59, 0x80,
+	0x59, 0x73, 0x43, 0xaf, 0xd8, 0x8d, 0x66, 0xd5, 0x50, 0x0b, 0x44, 0x85, 0xf9, 0x4a, 0xb3, 0xd1,
+	0x30, 0x2a, 0xed, 0xda, 0x9d, 0x5a, 0xfb, 0x9e, 0x5a, 0x24, 0x04, 0x16, 0x11, 0xa1, 0x65, 0xd6,
+	0x1a, 0x95, 0x5a, 0x4b, 0xaf, 0xab, 0x25, 0x0a, 0xa3, 0xf8, 0x12, 0x6c, 0x2a, 0x66, 0x74, 0x7b,
+	0x77, 0xc3, 0x50, 0xa7, 0x29, 0x0a, 0xfd, 0x4f, 0x42, 0x99, 0xa1, 0x9f, 0x47, 0x94, 0xaa, 0xde,
+	0xd6, 0x37, 0x74, 0xcb, 0x50, 0xcb, 0xe4, 0x1c, 0x9c, 0x4e, 0x81, 0xec, 0x7a, 0x73, 0xab, 0xd6,
+	0x50, 0x67, 0xc9, 0x0a, 0xa8, 0x31, 0xac, 0xba, 0x61, 0xef, 0x5a, 0x86, 0xa9, 0x42, 0x16, 0xda,
+	0xd0, 0x77, 0x0c, 0x75, 0x4e, 0x7b, 0x9b, 0x3d, 0xbd, 0x64, 0x5d, 0x4d, 0xce, 0x02, 0xb1, 0xda,
+	0x7a, 0x7b, 0xd7, 0xca, 0x34, 0x7e, 0x0e, 0x66, 0xac, 0xdd, 0x4a, 0xc5, 0xb0, 0x2c, 0x55, 0x21,
+	0x00, 0xd3, 0x9b, 0x7a, 0xad, 0x6e, 0x54, 0xd5, 0x82, 0xf6, 0x5b, 0x0a, 0x2c, 0x0b, 0x95, 0x51,
+	0xdc, 0x7b, 0x3d, 0xe1, 0x5a, 0x7c, 0x27, 0x75, 0x12, 0x16, 0xef, 0xe8, 0x32, 0x1f, 0x99, 0xb0,
+	0x0c, 0xff, 0x81, 0x02, 0x67, 0x72, 0xb1, 0xc9, 0x3d, 0x50, 0x45, 0x0d, 0xe2, 0x37, 0xb1, 0x4a,
+	0x4a, 0xe3, 0x16, 0x74, 0x19, 0x34, 0x66, 0x5b, 0x8d, 0xb7, 0x2b, 0x73, 0x84, 0xcd, 0xc9, 0xb3,
+	0xd2, 0x68, 0x1f, 0x2b, 0x70, 0x6e, 0xcc, 0x67, 0x48, 0x05, 0xa6, 0xe3, 0x74, 0x67, 0x13, 0x3c,
+	0x0e, 0x57, 0xbe, 0xf7, 0xc9, 0x65, 0x8e, 0x88, 0x79, 0xd7, 0xf1, 0x3f, 0x73, 0x3a, 0xce, 0x5f,
+	0x86, 0x49, 0xc4, 0x58, 0xf7, 0x9d, 0xcf, 0xf4, 0x3c, 0xff, 0x92, 0x7e, 0xd7, 0xda, 0x98, 0xe3,
+	0x7d, 0x57, 0x74, 0x1e, 0x86, 0x98, 0x45, 0x4c, 0xfb, 0x5d, 0x85, 0x6a, 0x83, 0x59, 0x44, 0xaa,
+	0x24, 0xeb, 0x61, 0x38, 0x3c, 0x74, 0x4d, 0xbf, 0xe7, 0xea, 0x66, 0x83, 0x6f, 0x1b, 0xa8, 0xde,
+	0x3a, 0x58, 0x80, 0xe7, 0x10, 0xdb, 0x09, 0x52, 0xa1, 0x1c, 0x52, 0x34, 0xe4, 0x26, 0x80, 0xf1,
+	0x28, 0x72, 0x83, 0xbe, 0xd3, 0x8b, 0x83, 0xf2, 0xb0, 0xa8, 0x69, 0x1c, 0x9a, 0x56, 0xd0, 0x25,
+	0x64, 0xed, 0x6b, 0x0a, 0xcc, 0x73, 0x65, 0x49, 0xef, 0xb9, 0x41, 0xf4, 0x64, 0xd3, 0xeb, 0x66,
+	0x6a, 0x7a, 0xc5, 0x0f, 0x6c, 0x24, 0xfe, 0xb4, 0x38, 0x77, 0x66, 0xfd, 0x5b, 0x05, 0xd4, 0x2c,
+	0x22, 0x79, 0x07, 0xca, 0x96, 0xfb, 0x91, 0x1b, 0x78, 0xd1, 0x11, 0x17, 0x94, 0x22, 0x31, 0x2c,
+	0xc3, 0xe1, 0x65, 0x6c, 0x3e, 0x84, 0xfc, 0x97, 0x19, 0xd3, 0x9c, 0x54, 0xde, 0x4b, 0x76, 0x92,
+	0xe2, 0xa7, 0x65, 0x27, 0xd1, 0xfe, 0xac, 0x00, 0xe7, 0xb6, 0xdc, 0x48, 0x6e, 0x53, 0xec, 0x09,
+	0xf2, 0xca, 0xc9, 0xda, 0x25, 0xb5, 0x64, 0x15, 0x66, 0xb0, 0x48, 0x8c, 0xaf, 0x29, 0x7e, 0x92,
+	0x8d, 0x78, 0x5e, 0x17, 0x53, 0x99, 0x27, 0xc7, 0x7c, 0xfb, 0x25, 0x29, 0x17, 0x5d, 0x3c, 0xad,
+	0xaf, 0xc1, 0x22, 0xe6, 0x08, 0x19, 0xd2, 0xe5, 0xe0, 0x76, 0xb9, 0xbd, 0xa8, 0x6c, 0x66, 0xa0,
+	0x64, 0x1d, 0x54, 0x0a, 0xd1, 0x3b, 0x0f, 0xfa, 0xfe, 0xc3, 0x9e, 0xdb, 0xdd, 0x77, 0xbb, 0xb8,
+	0xad, 0x97, 0xcd, 0x11, 0xb8, 0xe0, 0xb9, 0xdb, 0x67, 0x67, 0x3d, 0xb7, 0x8b, 0x46, 0x1d, 0xce,
+	0x33, 0x81, 0xae, 0xdd, 0x84, 0xb9, 0x9f, 0x30, 0xaf, 0xa4, 0xf6, 0x5f, 0x14, 0x58, 0xc1, 0xc6,
+	0x49, 0x1f, 0x16, 0x39, 0xbf, 0x45, 0x6f, 0x49, 0xa9, 0xd6, 0x1c, 0x0a, 0x4a, 0x2f, 0x85, 0xb8,
+	0x17, 0x13, 0x23, 0x52, 0xe1, 0x04, 0x46, 0x24, 0xc9, 0x06, 0x56, 0xfa, 0xb4, 0x6c, 0x60, 0xb7,
+	0x4a, 0xe5, 0xa2, 0x5a, 0x4a, 0x86, 0x5c, 0xfb, 0x6a, 0x01, 0x66, 0x4c, 0xb7, 0xe7, 0x3a, 0xa1,
+	0x4b, 0xae, 0xc1, 0x4c, 0xc3, 0x8f, 0xdc, 0x70, 0xa7, 0x2a, 0x7b, 0x59, 0xf7, 0x29, 0xc8, 0x3e,
+	0xec, 0x9a, 0xa2, 0x90, 0x4e, 0xf8, 0x56, 0xe0, 0x77, 0x87, 0x9d, 0x48, 0x9e, 0xf0, 0x03, 0x06,
+	0x32, 0x45, 0x19, 0xf9, 0x0c, 0xcc, 0x72, 0xce, 0xf1, 0xcd, 0x32, 0x3a, 0x8f, 0x07, 0x0c, 0x88,
+	0xd9, 0x84, 0x62, 0x04, 0xd4, 0x69, 0x99, 0x82, 0x51, 0x92, 0x74, 0xda, 0x11, 0x9d, 0x41, 0xa8,
+	0xea, 0x53, 0x13, 0x54, 0xf5, 0x57, 0x60, 0x5a, 0x0f, 0x43, 0x37, 0x12, 0x91, 0x27, 0xe6, 0xe3,
+	0x90, 0x84, 0xa1, 0x1b, 0x31, 0xc6, 0x0e, 0x96, 0x9b, 0x1c, 0x4f, 0xfb, 0xcb, 0x02, 0x4c, 0xe1,
+	0xbf, 0x78, 0x6f, 0x1b, 0x74, 0x0e, 0x52, 0xf7, 0xb6, 0x41, 0xe7, 0xc0, 0x44, 0x28, 0xb9, 0x8e,
+	0xa6, 0x0d, 0x91, 0x15, 0x90, 0xb7, 0x1e, 0x6d, 0xf6, 0xdd, 0x04, 0x6c, 0xca, 0x38, 0xb1, 0x9b,
+	0x41, 0x31, 0x37, 0xde, 0xcc, 0x59, 0x28, 0x34, 0x2d, 0xde, 0x62, 0x0c, 0x81, 0xe6, 0x87, 0x66,
+	0xa1, 0x69, 0x61, 0x6f, 0x6c, 0xeb, 0x37, 0x5e, 0x7b, 0x9d, 0x37, 0x94, 0xf5, 0xc6, 0x81, 0x73,
+	0xe3, 0xb5, 0xd7, 0x4d, 0x5e, 0x42, 0xfb, 0x17, 0xeb, 0x8c, 0xb7, 0xbf, 0x2c, 0x2c, 0x02, 0xf6,
+	0x2f, 0xb6, 0x0d, 0x6f, 0x7a, 0xcd, 0x04, 0x81, 0xdc, 0x80, 0x39, 0x1e, 0x9f, 0x03, 0xf1, 0xa5,
+	0xf8, 0x19, 0x3c, 0x7e, 0x07, 0xa3, 0x90, 0x91, 0xd8, 0x3d, 0x20, 0x1f, 0x20, 0x91, 0xbb, 0x9c,
+	0xdf, 0x03, 0x8a, 0x21, 0x0c, 0x4d, 0x09, 0x85, 0x56, 0x89, 0x5d, 0x24, 0x26, 0xe1, 0x0e, 0xb0,
+	0x4a, 0xfc, 0xb6, 0x11, 0xf3, 0xb1, 0xc4, 0x08, 0xda, 0xef, 0x17, 0xa0, 0xdc, 0xea, 0x0d, 0xf7,
+	0xbd, 0xfe, 0x9d, 0xeb, 0x84, 0x00, 0x1e, 0xe3, 0x44, 0xc2, 0x1e, 0xfa, 0x3f, 0x39, 0x0f, 0x65,
+	0x71, 0x72, 0x13, 0x02, 0x29, 0xe4, 0xa7, 0xb6, 0x55, 0x10, 0xe3, 0xce, 0x63, 0xdd, 0x89, 0x9f,
+	0xe4, 0x3a, 0xc4, 0xe7, 0xaf, 0x71, 0x07, 0xb5, 0x12, 0x5d, 0x2c, 0x66, 0x8c, 0x46, 0x5e, 0x04,
+	0xdc, 0x24, 0xf8, 0xe1, 0x41, 0x58, 0xc0, 0x59, 0xd5, 0xb8, 0x9e, 0xc2, 0x48, 0x10, 0x8d, 0xbc,
+	0x9a, 0xc9, 0xad, 0x77, 0x26, 0x4d, 0xc0, 0xb2, 0xaf, 0x09, 0x12, 0x91, 0x57, 0xef, 0x2d, 0x98,
+	0xeb, 0x04, 0x2e, 0x5e, 0x7d, 0x3a, 0x3d, 0xf1, 0xfe, 0x76, 0x2d, 0x45, 0x59, 0x49, 0xca, 0xef,
+	0x5c, 0x37, 0x65, 0x74, 0xed, 0x3b, 0xb3, 0x30, 0x2f, 0xd7, 0x87, 0x98, 0x70, 0x3a, 0xec, 0xd1,
+	0xb3, 0x3b, 0xf7, 0x0b, 0x1c, 0x60, 0x21, 0xdf, 0x4e, 0xaf, 0xa4, 0x2b, 0x44, 0xf1, 0x98, 0x93,
+	0xa0, 0x08, 0x2c, 0xb2, 0x7d, 0xca, 0x5c, 0x0e, 0x13, 0x30, 0xc3, 0x23, 0x3a, 0x94, 0xfd, 0x41,
+	0xb8, 0xef, 0xf6, 0x3d, 0x71, 0x41, 0xf3, 0x74, 0x8a, 0x51, 0x93, 0x17, 0x8e, 0xf0, 0x8a, 0xc9,
+	0xc8, 0x6b, 0x30, 0xed, 0x0f, 0xdc, 0xbe, 0xe3, 0xf1, 0x3d, 0xee, 0x42, 0x86, 0x81, 0xdb, 0xd7,
+	0x6b, 0x12, 0x21, 0x47, 0x26, 0x2f, 0x43, 0xc9, 0x7f, 0x10, 0x8f, 0xd7, 0xf9, 0x34, 0xd1, 0x83,
+	0xc8, 0x91, 0x48, 0x10, 0x91, 0x12, 0x7c, 0xe0, 0x1c, 0xee, 0xf1, 0x11, 0x4b, 0x13, 0xdc, 0x72,
+	0x0e, 0xf7, 0x64, 0x02, 0x8a, 0x48, 0xde, 0x05, 0x18, 0x38, 0xfb, 0x6e, 0x60, 0x77, 0x87, 0xd1,
+	0x11, 0x1f, 0xb7, 0x4b, 0x29, 0xb2, 0x16, 0x2d, 0xae, 0x0e, 0xa3, 0x23, 0x89, 0x76, 0x76, 0x20,
+	0x80, 0x44, 0x07, 0x38, 0x74, 0xa2, 0xc8, 0x0d, 0x0e, 0x7d, 0xee, 0x98, 0x99, 0x04, 0xd8, 0x64,
+	0x0c, 0x76, 0xe2, 0x62, 0x89, 0x83, 0x44, 0x84, 0x95, 0xf6, 0x02, 0x07, 0xaf, 0xe1, 0x47, 0x2a,
+	0xed, 0x05, 0xa9, 0x56, 0x52, 0x44, 0xf2, 0x26, 0xcc, 0x74, 0xbd, 0xb0, 0xe3, 0x07, 0x5d, 0x1e,
+	0x71, 0xe6, 0x62, 0x8a, 0xa6, 0xca, 0xca, 0x24, 0x32, 0x81, 0x4e, 0x6b, 0xcb, 0x03, 0xec, 0x36,
+	0xfc, 0x87, 0x78, 0x2f, 0x90, 0xad, 0xad, 0x15, 0x17, 0xcb, 0xb5, 0x4d, 0x88, 0xe8, 0x50, 0xee,
+	0x7b, 0x51, 0xcf, 0xb9, 0xcf, 0x2f, 0xdb, 0xd3, 0x43, 0xb9, 0x85, 0x45, 0xf2, 0x50, 0x32, 0x64,
+	0x72, 0x13, 0xca, 0x22, 0x59, 0x07, 0x7f, 0xd5, 0x9a, 0xae, 0x34, 0x4f, 0xb6, 0x21, 0x57, 0x9a,
+	0xa7, 0xe7, 0xa0, 0xfd, 0x13, 0x76, 0xbc, 0x43, 0xfe, 0x18, 0x35, 0xdd, 0x3f, 0x56, 0xa5, 0xb6,
+	0x23, 0xf7, 0x0f, 0x45, 0x24, 0xef, 0xc0, 0x0c, 0x5d, 0xbf, 0x5d, 0x7f, 0x9f, 0xc7, 0xec, 0xd0,
+	0xd2, 0xfd, 0xc3, 0xca, 0x46, 0xa6, 0xab, 0x20, 0xa2, 0x0b, 0xd9, 0x79, 0x18, 0xda, 0x5e, 0x07,
+	0xe3, 0xae, 0x66, 0x97, 0xa3, 0x7e, 0xd7, 0xaa, 0x55, 0x24, 0xb2, 0x29, 0xe7, 0x61, 0x58, 0xeb,
+	0x90, 0x1b, 0x30, 0x85, 0xb9, 0x6c, 0x78, 0x90, 0xd5, 0x34, 0x0d, 0x66, 0xb1, 0x91, 0x69, 0x10,
+	0x95, 0x0e, 0xe4, 0x61, 0x88, 0xef, 0x7b, 0x78, 0x46, 0x99, 0x74, 0x9f, 0xec, 0x58, 0xf8, 0xe8,
+	0x47, 0xae, 0x22, 0x47, 0xa7, 0x55, 0xec, 0xbb, 0x91, 0xed, 0x7d, 0xc8, 0x73, 0xc2, 0xa4, 0x3f,
+	0xd7, 0x70, 0xa3, 0xda, 0x7b, 0xf2, 0xe7, 0xfa, 0x6e, 0x54, 0xfb, 0x90, 0x0f, 0xdd, 0xc1, 0xf0,
+	0x3e, 0x1a, 0xdf, 0x73, 0x86, 0xee, 0x60, 0x98, 0x1d, 0xba, 0x83, 0xe1, 0x7d, 0x4a, 0xe6, 0xf5,
+	0xa3, 0x61, 0xdf, 0xe5, 0xaf, 0x4b, 0xd3, 0x64, 0x35, 0x2c, 0x92, 0xc9, 0x18, 0x32, 0xb9, 0x04,
+	0x90, 0x78, 0x3b, 0xb0, 0x7b, 0x24, 0x53, 0x82, 0x7c, 0xb6, 0xf4, 0xdf, 0xfe, 0xf1, 0x65, 0x65,
+	0x03, 0xa0, 0x2c, 0x02, 0x1f, 0x51, 0x35, 0x7c, 0x25, 0xaf, 0x2e, 0xe4, 0x2a, 0xcc, 0xcb, 0x61,
+	0x99, 0xf8, 0x66, 0x30, 0xe7, 0x0c, 0x3c, 0x11, 0x98, 0x69, 0x72, 0xb6, 0x90, 0x17, 0x60, 0x39,
+	0xf5, 0x08, 0x2b, 0x71, 0x5b, 0x34, 0x55, 0xb9, 0x00, 0xf7, 0xde, 0x0a, 0x40, 0x18, 0x39, 0x41,
+	0x64, 0x77, 0x9d, 0xe8, 0x24, 0x66, 0xe4, 0x32, 0x95, 0xe7, 0xcc, 0xe7, 0x1d, 0xe9, 0xaa, 0x4e,
+	0xe4, 0xb2, 0xc6, 0x69, 0x75, 0x38, 0x3f, 0x56, 0xd6, 0x92, 0xe7, 0x41, 0xdd, 0x73, 0xb8, 0xa5,
+	0xb5, 0x73, 0xe0, 0xf4, 0xfb, 0x6e, 0x8f, 0x37, 0x6c, 0x49, 0xc0, 0x2b, 0x0c, 0xcc, 0xb9, 0xbd,
+	0x2b, 0xf5, 0x8e, 0xb4, 0xc8, 0x4e, 0xd0, 0x3b, 0x9c, 0xc1, 0xb7, 0x14, 0xb8, 0x38, 0x49, 0x64,
+	0x93, 0x35, 0x28, 0x0f, 0x02, 0xcf, 0xc7, 0xa3, 0x01, 0xef, 0x43, 0xf1, 0x1b, 0x93, 0xa9, 0xa0,
+	0x0e, 0x1b, 0x39, 0xfb, 0xfc, 0x55, 0x93, 0x39, 0x8b, 0x90, 0xb6, 0xb3, 0x1f, 0xd2, 0x2e, 0xee,
+	0xba, 0x7b, 0xce, 0xb0, 0x17, 0xd9, 0x61, 0xe7, 0xc0, 0xed, 0xe2, 0xbb, 0x43, 0xf4, 0xf7, 0x34,
+	0x55, 0x5e, 0x60, 0x09, 0xf8, 0x48, 0x8d, 0xa7, 0xc6, 0xd4, 0xf8, 0x56, 0xa9, 0xac, 0xa8, 0x05,
+	0x13, 0x5d, 0xe4, 0xb4, 0xaf, 0x14, 0x60, 0x75, 0x9c, 0x8c, 0x22, 0x6f, 0xe7, 0xf5, 0x01, 0xbb,
+	0x5d, 0x92, 0xe1, 0xf2, 0xed, 0x92, 0x3c, 0x7b, 0x6e, 0x40, 0xfc, 0x6a, 0xf0, 0xb8, 0x08, 0x20,
+	0x02, 0x46, 0x69, 0x06, 0x4e, 0x18, 0x3e, 0xa4, 0x62, 0xb8, 0x28, 0x05, 0xc8, 0xe6, 0x30, 0x99,
+	0x46, 0xc0, 0xc8, 0x1b, 0x00, 0x9d, 0x9e, 0x1f, 0xba, 0xe8, 0xc4, 0xc1, 0xf5, 0x3b, 0xf6, 0x16,
+	0x22, 0x86, 0xca, 0xb7, 0xf6, 0x08, 0xad, 0xf8, 0x5d, 0x31, 0x9f, 0x1c, 0x38, 0x37, 0x66, 0x53,
+	0xa2, 0xc3, 0x83, 0xcf, 0x00, 0x99, 0x0c, 0xe2, 0x89, 0x08, 0x29, 0x84, 0x25, 0xd0, 0xca, 0xf6,
+	0x78, 0x61, 0xdc, 0x1c, 0x39, 0x02, 0x32, 0xba, 0xf3, 0x50, 0xee, 0xdc, 0xf7, 0x7f, 0x18, 0xc4,
+	0xdc, 0x19, 0x64, 0x37, 0xe8, 0x91, 0xcb, 0x30, 0x27, 0xb2, 0x42, 0xd3, 0xf3, 0x13, 0x63, 0x0e,
+	0x1c, 0x74, 0xdb, 0xc5, 0xc9, 0x83, 0x61, 0x81, 0x59, 0x62, 0x24, 0xb6, 0xf2, 0x66, 0x11, 0xd2,
+	0x3e, 0x1a, 0x88, 0xd6, 0x5d, 0x14, 0xf3, 0x3b, 0xad, 0x0f, 0xf0, 0xd2, 0xbf, 0xa7, 0x88, 0xe1,
+	0x1f, 0xdd, 0x50, 0x8f, 0xab, 0x1f, 0x01, 0x7c, 0x9a, 0xc7, 0x2b, 0x86, 0xff, 0x53, 0x4d, 0x51,
+	0xac, 0x3a, 0xae, 0x29, 0xf2, 0x9f, 0xe4, 0x1a, 0x2c, 0x05, 0xcc, 0xfd, 0x39, 0xf2, 0x79, 0x7f,
+	0xb2, 0xdc, 0x41, 0x0b, 0x0c, 0xdc, 0xf6, 0xb1, 0x4f, 0x79, 0xbd, 0x6e, 0xc5, 0x1d, 0x26, 0xe9,
+	0x17, 0xe4, 0x25, 0x98, 0xa5, 0xfa, 0x05, 0x06, 0x80, 0xca, 0xbc, 0x09, 0x42, 0x3c, 0xd4, 0xd6,
+	0xcc, 0xf2, 0x07, 0xfc, 0x7f, 0xce, 0xeb, 0x57, 0x63, 0x01, 0x98, 0x96, 0xaa, 0xe4, 0x2c, 0x4c,
+	0xb3, 0x6c, 0xe6, 0xbc, 0x6d, 0xfc, 0x17, 0x79, 0x16, 0x16, 0xd9, 0x43, 0xde, 0xcc, 0xc0, 0x2e,
+	0x20, 0x34, 0x9e, 0xde, 0x27, 0x4b, 0x3c, 0xc5, 0x2b, 0xf1, 0x87, 0x05, 0xd1, 0x22, 0x59, 0xc5,
+	0x22, 0xe7, 0x60, 0xc6, 0x0f, 0xf6, 0xa5, 0xfe, 0x9d, 0xf6, 0x83, 0x7d, 0xda, 0xb9, 0xcf, 0x81,
+	0xca, 0xde, 0xc9, 0xb1, 0x78, 0x25, 0xe1, 0x51, 0xbf, 0xc3, 0xdf, 0x4a, 0x2c, 0x32, 0xf8, 0x6e,
+	0xe8, 0x06, 0xd6, 0x51, 0xbf, 0x43, 0x31, 0xc3, 0xd0, 0xb7, 0xe5, 0x60, 0x72, 0xbc, 0x22, 0x8b,
+	0x61, 0xe8, 0x27, 0x51, 0xe5, 0xba, 0x64, 0x03, 0x16, 0x28, 0x9f, 0x38, 0x26, 0x1e, 0x17, 0xc3,
+	0x4f, 0x8d, 0x6a, 0x80, 0x47, 0xfd, 0x8e, 0xa8, 0xa2, 0x39, 0x1f, 0x4a, 0xbf, 0xc8, 0x6d, 0x50,
+	0x25, 0x55, 0x19, 0x1f, 0x4e, 0x67, 0xde, 0x03, 0x24, 0x6c, 0x24, 0x15, 0xbb, 0xd6, 0xdf, 0xf3,
+	0xcd, 0xa5, 0x4e, 0x1a, 0x10, 0x8b, 0xa3, 0x69, 0x75, 0xc6, 0x5c, 0xe5, 0xcd, 0x0d, 0xd1, 0x55,
+	0xd4, 0xee, 0xf9, 0xfb, 0xb6, 0xfb, 0x88, 0x4e, 0x0c, 0xed, 0x1f, 0x29, 0x42, 0xe0, 0xe7, 0x30,
+	0x25, 0x1a, 0x2c, 0x1c, 0x38, 0xa1, 0x1d, 0x86, 0x87, 0xcc, 0x83, 0x91, 0x87, 0xf8, 0x9e, 0x3b,
+	0x70, 0x42, 0x2b, 0x3c, 0x14, 0x09, 0x91, 0xce, 0x50, 0x1c, 0xdf, 0x19, 0x46, 0x07, 0xb6, 0x7c,
+	0x30, 0x60, 0x3d, 0x7a, 0xfa, 0xc0, 0x09, 0x9b, 0xb4, 0x4c, 0xe2, 0x4d, 0x9e, 0x81, 0x45, 0xe4,
+	0xdb, 0xf1, 0x04, 0x63, 0x8c, 0x49, 0x63, 0xce, 0x53, 0xc6, 0x1d, 0x8f, 0x71, 0xe6, 0x83, 0xfb,
+	0xe3, 0x12, 0x9c, 0xcd, 0xef, 0x3d, 0x5c, 0x43, 0xb4, 0xcf, 0xf1, 0xf5, 0x2c, 0xaf, 0xdb, 0x2c,
+	0x85, 0xb0, 0x78, 0x42, 0x79, 0x83, 0x57, 0xc8, 0x1d, 0xbc, 0x75, 0x58, 0x46, 0x46, 0xfc, 0x08,
+	0xd2, 0xf3, 0xc2, 0x88, 0x87, 0xc9, 0x31, 0x97, 0x68, 0x01, 0xdb, 0x74, 0xea, 0x14, 0x4c, 0x67,
+	0xa6, 0xd8, 0x36, 0xfc, 0x87, 0x7d, 0xfa, 0x61, 0xb6, 0x67, 0x2c, 0x70, 0x68, 0x13, 0x81, 0xe4,
+	0x0c, 0x4c, 0x3b, 0x83, 0x01, 0xfd, 0x24, 0xdb, 0x2a, 0xa6, 0x9c, 0xc1, 0x80, 0x65, 0x01, 0x63,
+	0xf9, 0xd6, 0xf6, 0xd0, 0xdf, 0x4c, 0xbc, 0x04, 0x98, 0x47, 0x20, 0xf3, 0x41, 0xc3, 0xb7, 0x04,
+	0x94, 0x56, 0xa0, 0xcc, 0x20, 0x0a, 0x38, 0x83, 0x18, 0xe1, 0x3c, 0x94, 0x85, 0xe7, 0x03, 0x7b,
+	0x1c, 0x65, 0xce, 0x38, 0xdc, 0xeb, 0xe1, 0x35, 0x38, 0xc7, 0x93, 0xbb, 0xd9, 0xac, 0x49, 0x83,
+	0x01, 0x7f, 0x9d, 0xcc, 0xc2, 0x6b, 0x9b, 0x2b, 0xbc, 0x98, 0xf6, 0xa4, 0x3e, 0x18, 0xc4, 0x6f,
+	0x94, 0xd7, 0x04, 0xd9, 0x7d, 0x8f, 0x85, 0xed, 0x63, 0xde, 0xbf, 0xb8, 0x38, 0x00, 0x29, 0x57,
+	0x39, 0xc6, 0x86, 0x8c, 0x20, 0x96, 0x49, 0xbc, 0x92, 0x6c, 0x66, 0xf8, 0xe4, 0xea, 0x13, 0xde,
+	0x8f, 0xe3, 0xa0, 0x21, 0x94, 0xbc, 0x01, 0x63, 0xe7, 0x22, 0x6a, 0xe7, 0x65, 0xf3, 0x0c, 0x2b,
+	0x67, 0x5e, 0xcd, 0x75, 0x7f, 0xdf, 0xc0, 0x42, 0xf2, 0x2e, 0x5c, 0x14, 0x15, 0x74, 0xc2, 0xd0,
+	0xdb, 0xef, 0xdb, 0x62, 0x14, 0xd0, 0xf1, 0x04, 0x35, 0xf4, 0xb2, 0x79, 0x9e, 0xe3, 0xe8, 0x88,
+	0x52, 0x65, 0x18, 0xec, 0x75, 0xeb, 0x2b, 0xb0, 0x12, 0x79, 0x87, 0xae, 0x7d, 0xdf, 0x8d, 0x1e,
+	0xba, 0x6e, 0xdf, 0xf6, 0x0e, 0x29, 0x5f, 0x16, 0x30, 0x66, 0xd6, 0x24, 0xb4, 0x6c, 0x83, 0x15,
+	0xd5, 0x58, 0x09, 0x9f, 0x7f, 0x6f, 0xc2, 0x12, 0x3f, 0x9e, 0x70, 0xdd, 0x06, 0xc7, 0x87, 0x4b,
+	0x5e, 0x7c, 0xcc, 0xc1, 0x72, 0xd1, 0x01, 0x07, 0xd5, 0xba, 0x82, 0xf2, 0x4f, 0x15, 0x38, 0x93,
+	0x7b, 0xbe, 0x21, 0xbf, 0x08, 0xec, 0x81, 0x6a, 0xe4, 0xdb, 0x81, 0xdb, 0xf1, 0x06, 0x1e, 0x46,
+	0xfc, 0x61, 0xf6, 0xff, 0x1b, 0x93, 0x4e, 0x46, 0xf8, 0xd8, 0xb5, 0xed, 0x9b, 0x31, 0x11, 0x33,
+	0x4c, 0xaa, 0x41, 0x06, 0xbc, 0xf6, 0x3e, 0x9c, 0xc9, 0x45, 0xcd, 0x31, 0x18, 0x7e, 0x46, 0x36,
+	0x18, 0x26, 0x37, 0xba, 0x99, 0x46, 0x4b, 0x86, 0x44, 0xde, 0xbc, 0x3f, 0x8e, 0x9b, 0x97, 0x39,
+	0x09, 0x11, 0x23, 0x2b, 0x0b, 0xf3, 0x0e, 0xf3, 0x82, 0x68, 0xbc, 0x38, 0x7c, 0x1f, 0xce, 0xf0,
+	0x05, 0xc9, 0xb6, 0x82, 0x98, 0x1d, 0xab, 0xe8, 0xcf, 0xe5, 0xb1, 0x63, 0x2b, 0x75, 0x8b, 0xe2,
+	0xc7, 0x5c, 0x4f, 0x3b, 0xa3, 0x40, 0xde, 0x86, 0x7f, 0x5d, 0x10, 0xe2, 0x2f, 0xa7, 0x3a, 0x39,
+	0x4b, 0x5d, 0xc9, 0x5b, 0xea, 0x27, 0x97, 0x33, 0x0d, 0x20, 0xb2, 0x80, 0xe7, 0x2b, 0x85, 0xb9,
+	0x2b, 0x5e, 0x4e, 0x67, 0x7e, 0x94, 0xc4, 0x25, 0x5b, 0x3a, 0xe6, 0x72, 0x27, 0x0b, 0xa2, 0x47,
+	0x08, 0xb6, 0xad, 0xd2, 0x4f, 0xb2, 0x1d, 0xbf, 0xcc, 0x00, 0xb5, 0x2e, 0xb9, 0x02, 0xf3, 0xec,
+	0xfc, 0x9a, 0x92, 0x43, 0x80, 0x30, 0x1d, 0x85, 0xd1, 0x5b, 0x79, 0xc2, 0x28, 0xb9, 0x88, 0xe0,
+	0xaa, 0xeb, 0x51, 0xbf, 0xc3, 0xe4, 0x4e, 0x5a, 0x4a, 0xf1, 0x1e, 0xfc, 0xf5, 0x02, 0xa8, 0x59,
+	0x44, 0xa2, 0x41, 0xc1, 0xeb, 0x8e, 0xf3, 0xa4, 0xd9, 0x3e, 0x65, 0x16, 0xbc, 0x2e, 0xb9, 0x09,
+	0x80, 0x39, 0x50, 0x03, 0x77, 0xdf, 0x7d, 0xc4, 0x55, 0x58, 0x54, 0x2c, 0x13, 0x68, 0x8a, 0x66,
+	0x16, 0x8d, 0x8d, 0x14, 0x4c, 0xae, 0x03, 0xb8, 0x8f, 0x58, 0xf6, 0x0a, 0xb1, 0x1f, 0xe7, 0x7c,
+	0x46, 0x31, 0x67, 0x39, 0x56, 0xad, 0x4b, 0xb6, 0x81, 0x08, 0x12, 0xe9, 0xab, 0xa5, 0x63, 0xbe,
+	0xaa, 0x98, 0x2a, 0xa7, 0x6a, 0x88, 0x8f, 0xf3, 0x43, 0xe0, 0x2c, 0xcc, 0xf0, 0x04, 0x1a, 0xf4,
+	0x5f, 0x8e, 0xa4, 0xfd, 0x8a, 0x02, 0x57, 0x8e, 0x9b, 0x8e, 0xe4, 0x2e, 0x9c, 0x45, 0xff, 0xb3,
+	0xd0, 0x8f, 0x67, 0xb4, 0xdd, 0x71, 0x3a, 0x07, 0x2e, 0x17, 0x00, 0x5a, 0xee, 0xbc, 0x1e, 0x0c,
+	0x2c, 0xab, 0x29, 0x4d, 0xe9, 0xc1, 0xc0, 0x0a, 0x7d, 0xf1, 0xbb, 0x42, 0xc9, 0xf9, 0x80, 0x74,
+	0xe1, 0xc2, 0x04, 0x4a, 0x69, 0x5f, 0x52, 0xe4, 0x7d, 0xe9, 0x39, 0x50, 0xf7, 0xdc, 0x2e, 0x3d,
+	0xe8, 0xba, 0x5d, 0xac, 0xda, 0x47, 0x37, 0x70, 0x4c, 0xe6, 0xcd, 0xc5, 0x18, 0x6e, 0x85, 0xfe,
+	0x9d, 0x1b, 0xfc, 0x2b, 0x7f, 0x10, 0xab, 0x5c, 0xb2, 0x3d, 0x83, 0xdc, 0x80, 0xd3, 0x99, 0xc8,
+	0x54, 0x52, 0xa8, 0x93, 0xc2, 0xaa, 0x62, 0x2e, 0xd3, 0xe2, 0x74, 0x2c, 0xc3, 0x67, 0x61, 0x5e,
+	0x16, 0xe5, 0x7c, 0x2a, 0x50, 0xe4, 0xb9, 0x6e, 0x22, 0xc0, 0xc9, 0x7d, 0x58, 0x94, 0x56, 0x18,
+	0x55, 0x8d, 0x8a, 0x39, 0x62, 0x40, 0xae, 0xcd, 0x4b, 0xc9, 0xd2, 0xeb, 0xef, 0xf9, 0xcc, 0x0d,
+	0x2b, 0xcd, 0xc2, 0x5c, 0xe8, 0xc8, 0x28, 0x6b, 0xef, 0x49, 0xa1, 0x19, 0x51, 0x01, 0xba, 0x08,
+	0xa5, 0x7e, 0x6e, 0x8c, 0xf5, 0x3e, 0x4b, 0xc3, 0x5e, 0x8a, 0x72, 0x23, 0x09, 0x47, 0xf1, 0x11,
+	0x81, 0x77, 0xd7, 0x50, 0x0c, 0x4a, 0xae, 0x25, 0xe7, 0x24, 0xd6, 0x82, 0x17, 0x81, 0xc4, 0x67,
+	0xef, 0x78, 0xcf, 0xe0, 0x62, 0x66, 0x59, 0x94, 0xc4, 0xc2, 0x9e, 0x7f, 0xf6, 0x5f, 0x4e, 0xc3,
+	0xe9, 0x1c, 0x13, 0x10, 0x79, 0x11, 0x54, 0xaf, 0x1f, 0xb9, 0xfb, 0x81, 0x64, 0x5c, 0x48, 0xc6,
+	0x68, 0x49, 0x2a, 0xe3, 0xb6, 0xfd, 0xe9, 0xc0, 0xdd, 0x8f, 0xef, 0x09, 0x4c, 0xfe, 0x8b, 0xee,
+	0x25, 0x4e, 0x20, 0xcc, 0xd6, 0xf4, 0x5f, 0x52, 0x83, 0x65, 0x4c, 0xb7, 0x14, 0x7a, 0x3e, 0x66,
+	0x6d, 0xc2, 0xc3, 0x44, 0x29, 0x65, 0x28, 0xc2, 0x9a, 0xb4, 0x24, 0x24, 0x7a, 0x9a, 0x30, 0xd5,
+	0x41, 0x06, 0x42, 0x3e, 0x07, 0x6b, 0x92, 0x3a, 0x66, 0x67, 0x04, 0x31, 0x3e, 0x55, 0x32, 0xcf,
+	0x39, 0xb1, 0x62, 0x56, 0x4d, 0x89, 0xe4, 0x0d, 0x60, 0x09, 0xf9, 0xbd, 0xee, 0xc0, 0x1e, 0xc9,
+	0xcf, 0x85, 0xcd, 0x65, 0x59, 0x5e, 0xd6, 0x28, 0x56, 0xad, 0x3b, 0xc8, 0xa4, 0xea, 0xc2, 0x56,
+	0xb7, 0x72, 0x85, 0xf5, 0x0c, 0x0a, 0xeb, 0xa7, 0xe4, 0xc6, 0x8c, 0x88, 0x6a, 0x36, 0xd3, 0x47,
+	0xc5, 0xf5, 0x3e, 0x2c, 0x27, 0x6a, 0x92, 0x90, 0xb9, 0x65, 0x5c, 0xf4, 0x6b, 0x32, 0x43, 0x71,
+	0xfc, 0x60, 0xd2, 0x94, 0x05, 0x9b, 0x19, 0x21, 0x94, 0x43, 0x2a, 0x0d, 0x53, 0x04, 0x21, 0xa9,
+	0xc3, 0x8a, 0xf3, 0x30, 0x14, 0x69, 0xbe, 0xc3, 0xf8, 0x5b, 0xb3, 0xa3, 0xdf, 0x12, 0x17, 0xd5,
+	0x5c, 0xc4, 0x13, 0xe7, 0x61, 0xc8, 0xb3, 0x7f, 0x87, 0x82, 0xdb, 0x07, 0x40, 0xd8, 0x36, 0x91,
+	0xaa, 0x37, 0x1c, 0xc7, 0x8b, 0xe7, 0x08, 0x1f, 0xa1, 0x94, 0x03, 0x43, 0x62, 0xa9, 0x5c, 0xf3,
+	0x76, 0xfa, 0x72, 0x61, 0x2e, 0x75, 0x33, 0x9e, 0xed, 0x6d, 0x76, 0x6b, 0x2f, 0xe1, 0xcb, 0xc6,
+	0x12, 0x09, 0x8c, 0xe7, 0x63, 0x0c, 0x1c, 0x87, 0xf5, 0x38, 0xf4, 0xbb, 0x2e, 0xf3, 0xf6, 0x36,
+	0x17, 0x10, 0x4c, 0x2b, 0xb0, 0x93, 0xd8, 0x2c, 0x3e, 0x56, 0x40, 0xcd, 0x7e, 0x8a, 0xbc, 0x05,
+	0xd3, 0x4c, 0x63, 0xe5, 0xca, 0x8c, 0x96, 0x5f, 0x27, 0x36, 0xd2, 0x4c, 0x79, 0xdd, 0x3e, 0x65,
+	0x72, 0x1a, 0xf2, 0x3a, 0x94, 0x7c, 0xaf, 0x2b, 0x6e, 0xfa, 0xaf, 0x4c, 0xa2, 0x6d, 0xd6, 0xaa,
+	0x15, 0xbc, 0x1d, 0xf0, 0xba, 0xfc, 0x90, 0xbd, 0x51, 0x86, 0x69, 0xd6, 0xb1, 0xda, 0x07, 0x70,
+	0x61, 0xc2, 0x07, 0x89, 0x01, 0x4b, 0x19, 0x2f, 0x88, 0x13, 0x3a, 0x48, 0x38, 0x89, 0x83, 0x44,
+	0x20, 0x0e, 0x5e, 0x3d, 0x38, 0x3f, 0xb6, 0x82, 0xa4, 0x36, 0x56, 0x82, 0x60, 0x68, 0xa3, 0x6c,
+	0x99, 0x3c, 0x59, 0x33, 0xd2, 0x85, 0x7f, 0xed, 0x37, 0x0a, 0x70, 0x3a, 0x67, 0x12, 0xfd, 0x7f,
+	0xab, 0x4a, 0xfc, 0x81, 0xc2, 0xfb, 0x23, 0x2d, 0x0c, 0x48, 0x1b, 0xb8, 0x93, 0x0d, 0x17, 0x1c,
+	0xd7, 0xc6, 0x0b, 0x0e, 0xd9, 0x77, 0x81, 0xc7, 0xb8, 0x42, 0x80, 0x7c, 0x43, 0xcf, 0x20, 0x4f,
+	0xe0, 0x55, 0xc0, 0x87, 0xef, 0x7d, 0x38, 0x93, 0x2b, 0xd8, 0xe9, 0x51, 0x15, 0x9d, 0xfb, 0x13,
+	0x2b, 0xcc, 0x0c, 0xfd, 0xbd, 0x1b, 0xa0, 0x85, 0xef, 0xbe, 0xeb, 0x04, 0x6e, 0xc0, 0x6d, 0x00,
+	0xdc, 0xc2, 0xc7, 0x60, 0xb2, 0x09, 0xa0, 0x9b, 0xde, 0xc5, 0xf8, 0xb5, 0x24, 0xd9, 0x81, 0xd3,
+	0x4c, 0xba, 0xb0, 0xa3, 0x9c, 0xcd, 0xaf, 0x32, 0x95, 0x94, 0xe1, 0x05, 0x49, 0xf0, 0x90, 0xcb,
+	0x8e, 0x75, 0x8c, 0xda, 0x5c, 0xde, 0xcf, 0x82, 0xa8, 0xf2, 0x76, 0x36, 0x1f, 0x9b, 0x6c, 0xc0,
+	0x1c, 0x63, 0xce, 0xac, 0xa0, 0xcc, 0x07, 0xe5, 0xea, 0xc4, 0x2f, 0x54, 0xf0, 0xcd, 0x5b, 0x18,
+	0xff, 0x4f, 0x4f, 0xfe, 0xe8, 0xee, 0x67, 0x1f, 0xca, 0x2e, 0x36, 0xe6, 0x3c, 0x02, 0xb9, 0x6b,
+	0x8d, 0xf6, 0x9f, 0x14, 0xd1, 0xd4, 0xd4, 0xfd, 0x0b, 0xdd, 0x81, 0x43, 0xb7, 0x2f, 0xdc, 0x8c,
+	0x66, 0x4d, 0xfe, 0xeb, 0x31, 0xb5, 0x02, 0xf2, 0x06, 0xcc, 0x53, 0xb6, 0xfb, 0xc3, 0x3e, 0xdb,
+	0x99, 0x8b, 0xa9, 0xd8, 0x9b, 0x3b, 0xac, 0x88, 0x0e, 0xdb, 0xf6, 0x29, 0x73, 0xee, 0x30, 0xf9,
+	0x49, 0x5e, 0x82, 0xd9, 0xf0, 0x30, 0x1a, 0xc8, 0xfb, 0xb9, 0xb8, 0x8b, 0xb6, 0x76, 0xda, 0x2d,
+	0x4e, 0x52, 0xa6, 0x38, 0x89, 0x71, 0x70, 0x63, 0x9a, 0xdd, 0x46, 0x6b, 0x2f, 0xc0, 0x9c, 0xc4,
+	0x9b, 0x36, 0x86, 0xbd, 0x10, 0x17, 0x8d, 0x61, 0xbf, 0xf8, 0x60, 0xdf, 0x87, 0xb2, 0x60, 0x49,
+	0x08, 0x94, 0x0e, 0xfc, 0x50, 0xe8, 0x43, 0xf8, 0x3f, 0x85, 0xa1, 0xb5, 0x80, 0x36, 0x72, 0xca,
+	0xc4, 0xff, 0xf1, 0x04, 0x86, 0x17, 0x20, 0x18, 0xb1, 0x1d, 0x5f, 0x05, 0xc4, 0x66, 0x3a, 0x0a,
+	0x6f, 0xf7, 0x42, 0xf6, 0x56, 0x40, 0x18, 0x0c, 0xe3, 0xa3, 0x6b, 0xe6, 0xc2, 0x6a, 0x9c, 0x7a,
+	0x9c, 0x3a, 0x68, 0x15, 0x46, 0x0f, 0x5a, 0x2c, 0xa6, 0x22, 0xa7, 0x64, 0x5f, 0x06, 0x84, 0xb1,
+	0x83, 0x56, 0xa2, 0x40, 0x95, 0x52, 0x0a, 0x94, 0x74, 0x05, 0x91, 0x8c, 0x1e, 0x3b, 0xa7, 0x89,
+	0x2b, 0x88, 0xac, 0x4a, 0xf7, 0xcd, 0x78, 0x86, 0xa4, 0xae, 0xcc, 0xc8, 0x0d, 0x38, 0xc3, 0x4c,
+	0x70, 0x2c, 0x99, 0x5d, 0x56, 0x97, 0x3c, 0x8d, 0x85, 0x2c, 0x05, 0x69, 0xac, 0x53, 0x1e, 0x6f,
+	0x62, 0x27, 0xaf, 0xc0, 0x4a, 0x9c, 0x4a, 0x3f, 0x7c, 0xe0, 0x0d, 0x58, 0xe6, 0xdf, 0x23, 0x6e,
+	0x1c, 0x23, 0xa2, 0xcc, 0x7a, 0xe0, 0x0d, 0x30, 0x0b, 0xb0, 0xe8, 0xe1, 0xdf, 0x2b, 0x88, 0x8b,
+	0x9b, 0x0d, 0xdf, 0x8f, 0xc2, 0x28, 0x70, 0x06, 0x29, 0xa7, 0x00, 0x72, 0x08, 0xe7, 0xb1, 0x4a,
+	0x37, 0x30, 0x7b, 0x9f, 0x1f, 0x88, 0x8b, 0xae, 0x78, 0x81, 0xcd, 0xdd, 0x78, 0x39, 0x6d, 0xf4,
+	0xd4, 0x29, 0xb6, 0x2e, 0x23, 0xd3, 0x75, 0x25, 0x71, 0xdd, 0x3e, 0x65, 0x9e, 0x63, 0x3c, 0x47,
+	0xb0, 0xc8, 0x76, 0x8e, 0xac, 0xc9, 0x7a, 0x05, 0x6c, 0x24, 0x82, 0x27, 0xcd, 0x55, 0x16, 0x49,
+	0xe4, 0x1d, 0x98, 0xf5, 0xba, 0x72, 0x0e, 0xff, 0xec, 0x7d, 0x74, 0xad, 0xcb, 0x72, 0xdd, 0x24,
+	0x3c, 0xe8, 0xd2, 0xf0, 0x38, 0x74, 0x63, 0x21, 0xa5, 0xe1, 0x68, 0xdb, 0xe2, 0x8e, 0x60, 0x94,
+	0x8c, 0x2c, 0x26, 0x7b, 0x1f, 0xee, 0x73, 0x28, 0x05, 0x92, 0x6c, 0x3b, 0x26, 0xff, 0xc5, 0xbb,
+	0xfc, 0x97, 0xe0, 0xb9, 0x93, 0xf6, 0x14, 0x95, 0x1b, 0x63, 0xba, 0x7d, 0x96, 0x45, 0xda, 0x4f,
+	0xf7, 0xde, 0x55, 0x90, 0x33, 0x84, 0x78, 0x62, 0xa2, 0x08, 0xd8, 0x6e, 0xe0, 0x69, 0x7f, 0x51,
+	0x84, 0xc5, 0xb4, 0xdb, 0x08, 0x79, 0x01, 0x4a, 0x92, 0xb8, 0x3c, 0x97, 0xe3, 0x5b, 0x82, 0x42,
+	0x12, 0x91, 0x4e, 0x24, 0x1e, 0xc9, 0x2d, 0x58, 0xc4, 0x97, 0x2f, 0xa8, 0xc6, 0x45, 0x1e, 0xbf,
+	0x12, 0x3d, 0xe9, 0x65, 0xe7, 0x3c, 0xa5, 0xa5, 0xdb, 0x23, 0x2d, 0x94, 0xbc, 0x02, 0x4a, 0xe3,
+	0xbd, 0x02, 0x78, 0x53, 0xc6, 0x78, 0x05, 0x4c, 0x4d, 0xf0, 0x0a, 0x48, 0x28, 0x65, 0xaf, 0x00,
+	0xf4, 0x0d, 0x99, 0x19, 0xe7, 0x1b, 0x92, 0xd0, 0x30, 0xdf, 0x90, 0xe4, 0x56, 0xbf, 0x3c, 0xf6,
+	0x56, 0x3f, 0xa1, 0xe1, 0xb7, 0xfa, 0xc9, 0x3d, 0xfb, 0xec, 0xd8, 0x7b, 0x76, 0x89, 0x88, 0xdd,
+	0xb3, 0x3f, 0xc3, 0x3b, 0x36, 0x70, 0x1e, 0xda, 0xd8, 0xe3, 0xfc, 0x7c, 0x84, 0x5d, 0x66, 0x3a,
+	0x0f, 0xd1, 0x43, 0x9d, 0xaa, 0x27, 0xdc, 0xad, 0x5d, 0xfb, 0x56, 0x46, 0x0c, 0x89, 0x31, 0x7f,
+	0x16, 0x16, 0xd9, 0x6e, 0xcc, 0x33, 0x38, 0xb0, 0xed, 0x78, 0xc1, 0x5c, 0x10, 0x50, 0x66, 0x9a,
+	0xff, 0x39, 0x58, 0x8a, 0xd1, 0xb8, 0x75, 0x1a, 0x43, 0x6e, 0x98, 0x31, 0x35, 0xb7, 0x4b, 0xcb,
+	0xfc, 0x02, 0x1e, 0x9d, 0x32, 0xc5, 0x8f, 0x19, 0x77, 0x5f, 0x04, 0x92, 0xa0, 0xc5, 0x8f, 0x7c,
+	0x4a, 0x88, 0xba, 0x1c, 0xa3, 0xc6, 0x2f, 0x71, 0x7e, 0x47, 0xc9, 0x5c, 0x4c, 0xff, 0xb4, 0xaa,
+	0xff, 0x02, 0xc4, 0x5f, 0xb7, 0xf9, 0xe5, 0xa2, 0x68, 0x81, 0x2a, 0x0a, 0x5a, 0x1c, 0xae, 0xed,
+	0x67, 0xed, 0xa9, 0x3f, 0xa5, 0x5a, 0x69, 0xbf, 0x57, 0x4a, 0xdd, 0x97, 0x89, 0xcf, 0x50, 0x2d,
+	0x27, 0xf4, 0x6d, 0x3e, 0xc4, 0x5c, 0x08, 0x5f, 0x1d, 0x33, 0x4d, 0xf9, 0xb3, 0x06, 0xcb, 0x6a,
+	0x9a, 0x10, 0x86, 0xbe, 0x78, 0xe5, 0x60, 0x33, 0xe3, 0x96, 0x74, 0xea, 0x13, 0xec, 0x98, 0xc4,
+	0x5d, 0x9f, 0xcc, 0x4e, 0x5c, 0x48, 0xd0, 0x55, 0x8a, 0x46, 0xae, 0xf8, 0x97, 0xf8, 0xc0, 0x2e,
+	0xe0, 0x1d, 0x77, 0x98, 0x66, 0x9e, 0x67, 0x0a, 0x1a, 0x61, 0x8e, 0xbd, 0x84, 0x9c, 0xf1, 0xb6,
+	0x22, 0x94, 0xd9, 0x1a, 0x30, 0x8f, 0xb7, 0x51, 0x82, 0x61, 0x29, 0xc7, 0x0b, 0x67, 0xb4, 0xf1,
+	0x95, 0xda, 0x8e, 0x39, 0x47, 0xe9, 0x04, 0x9b, 0x03, 0x38, 0x2f, 0xdf, 0x21, 0xa5, 0x2b, 0x39,
+	0x25, 0xf2, 0xae, 0x4c, 0xec, 0x81, 0xe4, 0xaa, 0x09, 0xab, 0x7a, 0xd6, 0x49, 0x03, 0xc4, 0x97,
+	0x3a, 0x70, 0x7e, 0xe4, 0x06, 0x25, 0xfe, 0x12, 0xf3, 0x0a, 0x7b, 0x6e, 0xcc, 0x97, 0x32, 0x57,
+	0x2b, 0x6e, 0x60, 0x9e, 0x0d, 0xd3, 0x20, 0xfe, 0x11, 0x7c, 0x46, 0x34, 0x7e, 0xe0, 0x27, 0xe4,
+	0xfe, 0x4d, 0xd4, 0xa8, 0x82, 0xac, 0x46, 0xc9, 0xf7, 0x56, 0xc5, 0xf4, 0xbd, 0xd5, 0x26, 0x5c,
+	0xa1, 0x32, 0x8f, 0xcf, 0x1c, 0xf7, 0x23, 0x37, 0x38, 0xf2, 0xfb, 0x18, 0xc2, 0x73, 0x10, 0x2f,
+	0x7d, 0x76, 0xd1, 0x76, 0x91, 0xe2, 0xe1, 0xbc, 0x30, 0x38, 0xd6, 0x0e, 0x22, 0xb1, 0xd0, 0xb4,
+	0xff, 0xa4, 0x08, 0x4f, 0x9f, 0x60, 0x72, 0x4d, 0xa8, 0xfb, 0xe7, 0xd3, 0xca, 0x7e, 0x21, 0x65,
+	0x9d, 0xa7, 0x4c, 0x13, 0x73, 0xf7, 0x18, 0x55, 0xff, 0x17, 0x61, 0x89, 0x6d, 0x53, 0xec, 0x1d,
+	0xd5, 0xde, 0xb0, 0x77, 0x82, 0x7d, 0xea, 0x82, 0x88, 0x12, 0x91, 0x21, 0xc5, 0xad, 0x0b, 0xa5,
+	0xb3, 0x15, 0xc3, 0x48, 0x1b, 0xe6, 0x10, 0x6d, 0xcf, 0xf1, 0x7a, 0x27, 0x0a, 0x57, 0x20, 0x62,
+	0x50, 0xc8, 0x64, 0xec, 0xbd, 0x28, 0x05, 0x6c, 0xe2, 0x6f, 0x72, 0x0d, 0x96, 0xfa, 0xc3, 0x43,
+	0xaa, 0xc6, 0xb2, 0x99, 0xcb, 0xdd, 0xd5, 0xa7, 0xcc, 0x85, 0xfe, 0xf0, 0x50, 0x1f, 0x0c, 0x70,
+	0x02, 0xa2, 0x5f, 0xfb, 0x32, 0xc5, 0x63, 0x32, 0x46, 0x60, 0x4e, 0x23, 0x26, 0x65, 0xc0, 0xa4,
+	0x0c, 0xc7, 0x5d, 0x01, 0xf6, 0xca, 0x89, 0xe7, 0x50, 0x66, 0x3f, 0xb4, 0xff, 0x59, 0x10, 0x86,
+	0xf2, 0xf1, 0xab, 0xf4, 0x67, 0x43, 0x94, 0x33, 0x44, 0xcf, 0x81, 0x4a, 0xbb, 0x3e, 0x11, 0x81,
+	0xf1, 0x18, 0x2d, 0xf6, 0x87, 0x87, 0x71, 0xdf, 0xc9, 0x1d, 0x3f, 0x2d, 0x77, 0xfc, 0x1b, 0xc2,
+	0x10, 0x9d, 0x2b, 0xcc, 0xc6, 0x77, 0x39, 0xd5, 0xef, 0xae, 0x9d, 0x4c, 0x64, 0xfd, 0x6c, 0xdc,
+	0x72, 0xc6, 0x2d, 0x73, 0xa5, 0x3f, 0x35, 0x72, 0xa5, 0x9f, 0xb3, 0xf6, 0xa6, 0xf3, 0xd6, 0xde,
+	0x88, 0x03, 0xc1, 0x4c, 0x8e, 0x03, 0x41, 0xee, 0x02, 0x2d, 0x1f, 0xb3, 0x40, 0x67, 0xe5, 0x79,
+	0xf2, 0xdd, 0x02, 0x5c, 0x3d, 0x76, 0xdf, 0xf8, 0xd9, 0x48, 0xe7, 0x8c, 0x74, 0x7e, 0x7f, 0xfe,
+	0x45, 0x41, 0xe8, 0xcb, 0xe9, 0x63, 0xf0, 0xfb, 0x70, 0x5a, 0x1c, 0x83, 0x99, 0xde, 0x90, 0xf8,
+	0xd9, 0xcc, 0xdd, 0x78, 0x3e, 0xef, 0x00, 0x8c, 0x68, 0x39, 0x87, 0xd4, 0x65, 0x7e, 0xf4, 0x4d,
+	0xca, 0xff, 0xdf, 0x39, 0xf4, 0x92, 0x7b, 0x70, 0x16, 0x33, 0xb2, 0x75, 0x64, 0x0f, 0x21, 0x3b,
+	0x70, 0xf7, 0x78, 0xaf, 0x5f, 0x1d, 0x39, 0x1c, 0x7a, 0x1d, 0xa9, 0x3a, 0xa6, 0xbb, 0xb7, 0x7d,
+	0xca, 0x5c, 0x09, 0x73, 0xe0, 0xdc, 0xd4, 0x94, 0x39, 0x55, 0xff, 0x0b, 0x05, 0xb4, 0xe3, 0x7b,
+	0x0d, 0x0d, 0x20, 0xd9, 0x6e, 0x9f, 0x35, 0xe7, 0x1c, 0xa9, 0x0f, 0x9f, 0x86, 0x85, 0xc0, 0xdd,
+	0x0b, 0xdc, 0xf0, 0x20, 0x65, 0xa5, 0x9c, 0xe7, 0x40, 0xd1, 0x3d, 0x22, 0x39, 0xc4, 0x63, 0x1d,
+	0x48, 0x05, 0x51, 0xec, 0x7b, 0x7b, 0x71, 0xd2, 0x98, 0xd0, 0x99, 0x25, 0x57, 0x93, 0xfd, 0x88,
+	0xfd, 0xbc, 0x0a, 0x6a, 0xd1, 0xe4, 0xe9, 0x2c, 0xf6, 0xbc, 0x9e, 0xab, 0xfd, 0x51, 0xac, 0xbb,
+	0xe5, 0x75, 0x27, 0x79, 0x5f, 0x7a, 0xdf, 0x59, 0x1c, 0x51, 0x4b, 0xf3, 0x48, 0x4e, 0x62, 0x4e,
+	0xae, 0x7f, 0x4a, 0xe6, 0xe4, 0x9b, 0xe2, 0x91, 0x08, 0xdd, 0x55, 0xee, 0x5c, 0x27, 0xcf, 0xc3,
+	0x0c, 0x7b, 0x17, 0x22, 0xaa, 0xbb, 0x94, 0xaa, 0xee, 0x9d, 0xeb, 0xa6, 0x28, 0xd7, 0x3e, 0x8e,
+	0x3d, 0xda, 0x46, 0x1a, 0x71, 0xe7, 0x3a, 0x79, 0xe3, 0x64, 0xef, 0x35, 0xcb, 0xe2, 0xbd, 0x66,
+	0xfc, 0x56, 0xf3, 0xcd, 0xd4, 0x5b, 0xcd, 0x67, 0x26, 0xf7, 0x16, 0x77, 0x96, 0x64, 0x29, 0x02,
+	0xe2, 0x38, 0xcf, 0xda, 0x57, 0x8b, 0xf0, 0xd4, 0x44, 0x0a, 0x72, 0x11, 0xca, 0x7a, 0xab, 0xd6,
+	0x4e, 0x46, 0x99, 0xae, 0x22, 0x01, 0x21, 0x5b, 0x30, 0xbb, 0xe1, 0x84, 0x5e, 0x87, 0x4e, 0xe9,
+	0x5c, 0x27, 0x98, 0x11, 0xb6, 0x31, 0xfa, 0xf6, 0x29, 0x33, 0xa1, 0x25, 0x36, 0x2c, 0xe3, 0xba,
+	0x48, 0x65, 0x70, 0x2e, 0xe6, 0x18, 0xdd, 0x46, 0x18, 0x8e, 0x90, 0x51, 0xc9, 0x33, 0x02, 0x24,
+	0xf7, 0x81, 0x58, 0xd6, 0x76, 0xc5, 0x0d, 0x22, 0x6e, 0x86, 0x8a, 0xbc, 0xf8, 0xf1, 0xdf, 0x2b,
+	0xc7, 0xf4, 0xdd, 0x08, 0xdd, 0xf6, 0x29, 0x33, 0x87, 0x1b, 0xb9, 0x0a, 0x72, 0xaa, 0x71, 0xd4,
+	0x82, 0xe6, 0xb7, 0x4f, 0x99, 0x30, 0x88, 0x53, 0x8e, 0xe7, 0xcb, 0x86, 0x5f, 0x12, 0xaa, 0xe7,
+	0xf8, 0xde, 0x7a, 0x8c, 0x3c, 0x2d, 0xcf, 0x41, 0xb9, 0x25, 0x7c, 0xaa, 0xa5, 0xd7, 0xd6, 0xc2,
+	0x7f, 0xda, 0x8c, 0x4b, 0xf9, 0xcc, 0xfe, 0x6d, 0x45, 0x98, 0xe9, 0x8e, 0xef, 0x5b, 0x29, 0x1f,
+	0x77, 0x77, 0x72, 0x3e, 0xee, 0xee, 0x4f, 0x98, 0x8f, 0x9b, 0x57, 0xca, 0x87, 0xe7, 0x4f, 0x3c,
+	0x1a, 0xe4, 0x2d, 0x50, 0x31, 0x5f, 0xb1, 0x23, 0x8d, 0x6c, 0x3a, 0x38, 0x39, 0x0b, 0xbe, 0xd9,
+	0x72, 0xbc, 0xc0, 0x5c, 0xea, 0xa4, 0xa9, 0xf9, 0x07, 0x7f, 0x9f, 0xa7, 0x70, 0xab, 0x75, 0x5b,
+	0x99, 0xab, 0xf7, 0x27, 0x7d, 0xb2, 0x6f, 0xa4, 0xd6, 0xa9, 0xd8, 0xeb, 0xf2, 0xbf, 0x35, 0xfe,
+	0xe5, 0xbe, 0xb4, 0x68, 0xff, 0x7e, 0x11, 0x2e, 0x4e, 0x22, 0x27, 0x3a, 0xa8, 0x06, 0x0b, 0x03,
+	0xca, 0x1f, 0x4b, 0xfa, 0x81, 0x9c, 0x52, 0x94, 0x85, 0x08, 0xb5, 0xbb, 0x71, 0xa1, 0x39, 0x82,
+	0x4e, 0xc7, 0x99, 0xc1, 0xe2, 0xf7, 0xe8, 0x38, 0xce, 0x9c, 0x94, 0x8e, 0xb3, 0x28, 0x26, 0x4f,
+	0xc3, 0xb4, 0x5e, 0xb1, 0x92, 0xdc, 0xe9, 0xf8, 0x70, 0xd4, 0xe9, 0x84, 0xf8, 0x24, 0x91, 0x17,
+	0x91, 0x5f, 0x00, 0x35, 0x9b, 0x3a, 0x91, 0x27, 0x4d, 0xbf, 0x20, 0x75, 0xc8, 0x48, 0x76, 0x45,
+	0xac, 0x6f, 0x92, 0x0d, 0x90, 0x27, 0xd8, 0x32, 0x47, 0x78, 0x11, 0x0d, 0xa6, 0x5b, 0x81, 0x1b,
+	0xba, 0x91, 0xfc, 0xa8, 0x73, 0x80, 0x10, 0x93, 0x97, 0xf0, 0x27, 0x97, 0xce, 0x11, 0x0b, 0xc9,
+	0x37, 0x2d, 0x87, 0x5e, 0xc5, 0x37, 0x9a, 0x14, 0x6c, 0x4a, 0x28, 0x94, 0xa0, 0xee, 0x0c, 0xfb,
+	0x9d, 0x83, 0x5d, 0xb3, 0xce, 0xd5, 0x5a, 0x46, 0xd0, 0x43, 0x28, 0x6d, 0x60, 0x68, 0x4a, 0x28,
+	0xda, 0xaf, 0x29, 0xb0, 0x92, 0xd7, 0x8e, 0x63, 0xbc, 0x76, 0x5e, 0x81, 0x39, 0xbc, 0xa1, 0xdd,
+	0xf3, 0x83, 0x43, 0x27, 0x92, 0x9f, 0xbe, 0x4a, 0x60, 0x13, 0x6f, 0x94, 0x37, 0xf1, 0x7f, 0x72,
+	0x59, 0xec, 0x56, 0x52, 0x62, 0x14, 0x04, 0xf0, 0x8d, 0x4b, 0xd3, 0x01, 0x6a, 0xdd, 0x56, 0x73,
+	0xc0, 0xb2, 0xfb, 0xbd, 0x0a, 0x25, 0x5a, 0xad, 0xcc, 0xec, 0xa5, 0xf3, 0x47, 0xdf, 0xa9, 0x73,
+	0x24, 0x56, 0xab, 0xd0, 0x39, 0xec, 0x99, 0x88, 0xac, 0xdd, 0x85, 0xc5, 0x34, 0x06, 0x31, 0xd2,
+	0x09, 0x5e, 0xe6, 0x6e, 0xa8, 0x9c, 0xd3, 0x86, 0xef, 0xb3, 0xf0, 0x0b, 0x1b, 0xe7, 0xbf, 0xf7,
+	0xc9, 0x65, 0xa0, 0x3f, 0x19, 0x4d, 0x5e, 0x02, 0x18, 0xed, 0xeb, 0x05, 0x58, 0x49, 0x42, 0xc4,
+	0x89, 0x35, 0xf4, 0xd7, 0x36, 0xfc, 0x90, 0x9e, 0x0a, 0x8f, 0x23, 0x94, 0xd0, 0xd1, 0x06, 0x4e,
+	0x88, 0xca, 0xb1, 0x05, 0xab, 0xe3, 0xf0, 0xc9, 0x0b, 0x30, 0x8b, 0x91, 0x8a, 0x07, 0x4e, 0xc7,
+	0x95, 0x45, 0x6e, 0x5f, 0x00, 0xcd, 0xa4, 0x5c, 0xfb, 0xae, 0x02, 0x6b, 0x3c, 0x68, 0xc0, 0x8e,
+	0xe3, 0xf5, 0xf1, 0x42, 0xb0, 0xe3, 0x7e, 0x3a, 0xe1, 0xb3, 0xb6, 0x52, 0x72, 0xec, 0xd9, 0x74,
+	0x6c, 0x88, 0x91, 0xaf, 0x8d, 0x6f, 0x2d, 0x79, 0x1e, 0xa3, 0x6f, 0x73, 0x37, 0xd3, 0x12, 0x8b,
+	0x6f, 0xd8, 0xa7, 0x00, 0x39, 0xbe, 0x21, 0x62, 0x68, 0xbf, 0x0c, 0x97, 0x26, 0x7f, 0x80, 0x7c,
+	0x09, 0x16, 0x30, 0xf1, 0xf6, 0xee, 0x60, 0x3f, 0x70, 0xba, 0xae, 0x30, 0x12, 0x8b, 0xbb, 0x0c,
+	0xb9, 0x8c, 0x05, 0x13, 0xe7, 0xf1, 0xf6, 0xf6, 0x31, 0xa5, 0x37, 0x27, 0x4a, 0x45, 0xe6, 0x90,
+	0xb9, 0x69, 0x5f, 0x51, 0x80, 0x8c, 0xf2, 0x20, 0xaf, 0xc3, 0xfc, 0x6e, 0xbb, 0x62, 0x45, 0x4e,
+	0x10, 0x6d, 0xfb, 0xc3, 0x80, 0x47, 0xf2, 0x66, 0xe1, 0xd7, 0xa2, 0x8e, 0xcd, 0xae, 0x7e, 0x0f,
+	0xfc, 0x61, 0x60, 0xa6, 0xf0, 0x30, 0x65, 0xb3, 0xeb, 0x3e, 0xe8, 0x3a, 0x47, 0xe9, 0x94, 0xcd,
+	0x1c, 0x96, 0x4a, 0xd9, 0xcc, 0x61, 0xda, 0x37, 0x15, 0xb8, 0x20, 0x9e, 0x7d, 0x75, 0x73, 0xea,
+	0x52, 0xc1, 0x20, 0xa3, 0x81, 0x48, 0x9b, 0x33, 0x49, 0xd1, 0x5f, 0x16, 0x71, 0x78, 0xb1, 0x82,
+	0xa8, 0xf1, 0x33, 0x5a, 0xf2, 0x79, 0x28, 0x59, 0x91, 0x3f, 0x38, 0x41, 0x20, 0x5e, 0x35, 0x1e,
+	0xd1, 0xc8, 0x1f, 0x20, 0x0b, 0xa4, 0xd4, 0x5c, 0x58, 0x91, 0x2b, 0x27, 0x6a, 0x4c, 0x76, 0x60,
+	0x86, 0x47, 0x71, 0xcf, 0x78, 0x93, 0x4e, 0x68, 0xd3, 0xc6, 0x92, 0x88, 0xf6, 0xcb, 0x13, 0xbc,
+	0x98, 0x82, 0x87, 0xf6, 0x9b, 0x0a, 0xcc, 0x51, 0x55, 0x07, 0x2d, 0x06, 0x4f, 0x3a, 0xa5, 0xd3,
+	0x2a, 0xb4, 0xf0, 0x33, 0x8f, 0xd9, 0x9f, 0x68, 0x37, 0x7e, 0x0d, 0x96, 0x32, 0x04, 0x44, 0xc3,
+	0x38, 0x8f, 0x3d, 0xaf, 0xe3, 0xb0, 0x0c, 0xb0, 0xcc, 0x47, 0x3b, 0x05, 0xd3, 0x7e, 0x5d, 0x81,
+	0x95, 0xe6, 0x83, 0xc8, 0x61, 0x1e, 0x1a, 0xe6, 0xb0, 0x27, 0xd6, 0x3b, 0x55, 0xdf, 0xc4, 0xfb,
+	0x41, 0x16, 0x52, 0x8e, 0xa9, 0x6f, 0x1c, 0x66, 0xc6, 0xa5, 0x64, 0x1b, 0xca, 0x7c, 0x7f, 0x09,
+	0x79, 0xbe, 0x92, 0x4b, 0x92, 0x39, 0x23, 0x61, 0xcc, 0x91, 0x68, 0x4b, 0x50, 0x84, 0x71, 0x1a,
+	0x33, 0xa6, 0xd6, 0xfe, 0x52, 0x81, 0x73, 0x63, 0x68, 0xc8, 0xdb, 0x30, 0x85, 0xe1, 0x6e, 0xf8,
+	0xe8, 0x5d, 0x1c, 0xf3, 0x89, 0xa8, 0x73, 0x70, 0xe7, 0x3a, 0xdb, 0x88, 0x0e, 0xe9, 0x0f, 0x93,
+	0x51, 0x91, 0xf7, 0x61, 0x56, 0xef, 0x76, 0xf9, 0xc1, 0xae, 0x90, 0x3a, 0xd8, 0x8d, 0xf9, 0xe2,
+	0x4b, 0x31, 0x3e, 0x3b, 0xd8, 0xb1, 0xc0, 0x0b, 0xdd, 0xae, 0xcd, 0x43, 0xf9, 0x24, 0xfc, 0xd6,
+	0xde, 0x82, 0xc5, 0x34, 0xf2, 0x63, 0x45, 0x1f, 0xf9, 0x58, 0x01, 0x35, 0x5d, 0x87, 0x9f, 0x4e,
+	0x9c, 0xe2, 0xbc, 0x61, 0x3e, 0x66, 0x52, 0xfd, 0xdd, 0x02, 0x9c, 0xc9, 0xed, 0x61, 0xf2, 0x22,
+	0x4c, 0xeb, 0x83, 0x41, 0xad, 0xca, 0x67, 0x15, 0xd7, 0x90, 0xf0, 0x66, 0x23, 0x75, 0xee, 0x65,
+	0x48, 0xe4, 0x55, 0x28, 0x33, 0x47, 0xa0, 0xaa, 0x10, 0x38, 0x18, 0x78, 0x95, 0x7b, 0x29, 0xa5,
+	0x33, 0x87, 0x08, 0x44, 0xb2, 0x09, 0x8b, 0x3c, 0x64, 0x29, 0x7a, 0x85, 0xc5, 0x09, 0xf8, 0xd0,
+	0x91, 0x4e, 0x5c, 0x97, 0x30, 0x7f, 0xb2, 0x94, 0xec, 0xcc, 0x50, 0x91, 0x3a, 0xa8, 0xc8, 0x53,
+	0xe6, 0xc4, 0xd2, 0x97, 0x48, 0x8e, 0x98, 0x63, 0x78, 0x8d, 0x50, 0xc6, 0xc3, 0xc5, 0x5e, 0xd2,
+	0x1c, 0xba, 0xfd, 0xe8, 0xa7, 0x37, 0x5c, 0xc9, 0x37, 0x4e, 0x34, 0x5c, 0xbf, 0x5b, 0x62, 0x8b,
+	0x39, 0x4b, 0x46, 0x35, 0x1a, 0x29, 0xdf, 0x16, 0x6a, 0x34, 0xf4, 0xc4, 0xc6, 0x83, 0x72, 0x56,
+	0x61, 0xa6, 0xcd, 0x73, 0x29, 0xb1, 0x95, 0xf1, 0x54, 0x6e, 0x15, 0x18, 0xce, 0x9d, 0xeb, 0x4c,
+	0x7d, 0xe1, 0xb9, 0x95, 0x4c, 0x41, 0x4a, 0xee, 0xc0, 0x5c, 0xa5, 0xe7, 0x3a, 0xfd, 0xe1, 0xa0,
+	0x7d, 0x32, 0xff, 0x83, 0x55, 0xde, 0x96, 0xf9, 0x0e, 0x23, 0x43, 0xbf, 0x05, 0x94, 0xe4, 0x32,
+	0x23, 0xd2, 0x8e, 0x43, 0x71, 0x94, 0xd0, 0x56, 0xfa, 0xca, 0x84, 0xfe, 0xc9, 0x02, 0x91, 0x2e,
+	0x1d, 0x67, 0x86, 0xc7, 0xea, 0xb0, 0x61, 0xb1, 0xee, 0x84, 0x51, 0x3b, 0x70, 0xfa, 0x21, 0x26,
+	0x6e, 0x38, 0x41, 0x10, 0xea, 0x0b, 0xbc, 0xc2, 0xcc, 0x86, 0x1a, 0xc5, 0xa4, 0xcc, 0x86, 0x9a,
+	0x66, 0x47, 0xf5, 0xa5, 0x4d, 0xaf, 0xef, 0xf4, 0xbc, 0x2f, 0x8b, 0x88, 0x45, 0x4c, 0x5f, 0xda,
+	0x13, 0x40, 0x33, 0x29, 0xd7, 0xbe, 0x38, 0x32, 0x6e, 0xac, 0x96, 0x73, 0x30, 0xc3, 0xe3, 0xd9,
+	0xb1, 0xf8, 0x6e, 0x2d, 0xa3, 0x51, 0xad, 0x35, 0xb6, 0x54, 0x85, 0x2c, 0x02, 0xb4, 0xcc, 0x66,
+	0xc5, 0xb0, 0x2c, 0xfa, 0xbb, 0x40, 0x7f, 0xf3, 0xe0, 0x6f, 0x9b, 0xbb, 0x75, 0xb5, 0x28, 0xc5,
+	0x7f, 0x2b, 0x69, 0xdf, 0x51, 0xe0, 0x6c, 0xfe, 0x50, 0x92, 0x36, 0x77, 0xd4, 0x67, 0x9e, 0x28,
+	0xaf, 0x4f, 0x1c, 0xf7, 0x5c, 0x70, 0x36, 0x92, 0x60, 0xc4, 0x22, 0xd4, 0x15, 0xc4, 0x05, 0x27,
+	0x0b, 0x79, 0xe3, 0x75, 0xcd, 0x82, 0xd7, 0xd5, 0x2a, 0xb0, 0x3a, 0x8e, 0x47, 0xba, 0xa9, 0x4b,
+	0x30, 0xa7, 0xb7, 0x5a, 0xf5, 0x5a, 0x45, 0x6f, 0xd7, 0x9a, 0x0d, 0x55, 0x21, 0xb3, 0x30, 0xb5,
+	0x65, 0x36, 0x77, 0x5b, 0x6a, 0x41, 0xfb, 0x13, 0x05, 0x16, 0x6a, 0x89, 0xa7, 0xec, 0x93, 0x2e,
+	0xbe, 0xcf, 0xa6, 0x16, 0xdf, 0x6a, 0x1c, 0x2b, 0x33, 0xfe, 0xc0, 0x04, 0x0d, 0x72, 0x23, 0x0e,
+	0x68, 0x54, 0x4c, 0x79, 0x94, 0xc8, 0xd4, 0x22, 0x54, 0x4c, 0x9c, 0x33, 0x30, 0x1d, 0xf0, 0x48,
+	0x5a, 0xbd, 0xff, 0xac, 0x08, 0xcb, 0x23, 0xdf, 0x25, 0x16, 0xcc, 0xe8, 0x77, 0xad, 0x66, 0xad,
+	0x5a, 0xe1, 0xad, 0xbb, 0x9c, 0x78, 0x57, 0x62, 0x0a, 0xec, 0x91, 0x9a, 0xb2, 0x18, 0x55, 0x0f,
+	0x43, 0xdb, 0xf7, 0xba, 0x9d, 0x94, 0x7b, 0xaf, 0xe0, 0x84, 0xbb, 0xe1, 0x97, 0x87, 0x01, 0x7a,
+	0x2c, 0xf3, 0x96, 0xc7, 0x4e, 0x9b, 0x02, 0x3e, 0xca, 0x18, 0x7d, 0x78, 0x1d, 0x5a, 0x3e, 0xca,
+	0x3a, 0xe1, 0x47, 0x1a, 0x30, 0xbd, 0xe5, 0x45, 0xdb, 0xc3, 0xfb, 0xbc, 0x57, 0x2e, 0x25, 0x09,
+	0x91, 0xb7, 0x87, 0xf7, 0x47, 0xd9, 0xa2, 0xc5, 0x94, 0xc5, 0xa7, 0x48, 0xb1, 0xe4, 0x5c, 0xc8,
+	0x6d, 0x98, 0xd2, 0xef, 0x5a, 0xa6, 0xce, 0x57, 0xa8, 0xe4, 0xbf, 0x6a, 0xea, 0x63, 0xb8, 0xd1,
+	0xd6, 0x07, 0x4e, 0x8a, 0x1b, 0xe3, 0x91, 0x8d, 0xd1, 0x53, 0x7a, 0xac, 0x18, 0x3d, 0x1b, 0x0b,
+	0x30, 0xc7, 0x0f, 0x75, 0x78, 0x5e, 0x7a, 0x04, 0xa7, 0x73, 0x86, 0x9a, 0x38, 0xe8, 0x25, 0x8f,
+	0xb7, 0xee, 0x7a, 0xff, 0xe8, 0xe1, 0x81, 0x1b, 0xb8, 0xa3, 0x63, 0x97, 0xae, 0xbb, 0x98, 0x25,
+	0xb9, 0xb5, 0x37, 0x47, 0xd8, 0x69, 0x7f, 0xac, 0xc0, 0xea, 0xb8, 0x09, 0x40, 0x4f, 0xa8, 0xe9,
+	0x28, 0x80, 0x67, 0xe3, 0xc4, 0x9f, 0x69, 0xef, 0x76, 0x81, 0x46, 0xde, 0x85, 0x39, 0xe6, 0x01,
+	0x69, 0xbd, 0xba, 0x6b, 0xd6, 0xf8, 0xca, 0x7d, 0xea, 0x87, 0x9f, 0x5c, 0x3e, 0xc7, 0x9d, 0x26,
+	0xc3, 0x57, 0xed, 0x61, 0xe0, 0x25, 0xa4, 0xab, 0x8a, 0x29, 0x53, 0xd0, 0x03, 0x85, 0x33, 0xec,
+	0x7a, 0xae, 0x38, 0x4e, 0x89, 0x48, 0x69, 0x1c, 0x26, 0x6f, 0xef, 0x02, 0xa6, 0x7d, 0x4d, 0x81,
+	0xb5, 0xf1, 0xb3, 0x8d, 0xaa, 0x0c, 0x6d, 0xe6, 0x48, 0x2a, 0x62, 0x95, 0xa1, 0xca, 0x10, 0x7b,
+	0x9b, 0xca, 0x3c, 0x05, 0x22, 0x25, 0xe2, 0x86, 0x3f, 0x61, 0x2f, 0x42, 0xa2, 0xd8, 0x2e, 0x28,
+	0x13, 0x09, 0x44, 0xed, 0x1e, 0x9c, 0x1b, 0x33, 0x37, 0xc9, 0x3b, 0xb9, 0xe9, 0x84, 0x31, 0x16,
+	0x85, 0x1c, 0x6c, 0x24, 0x95, 0x97, 0x5e, 0x82, 0x6b, 0xff, 0x81, 0xb9, 0x4e, 0xe7, 0x4c, 0x54,
+	0xaa, 0xdd, 0x60, 0xfa, 0x5a, 0xbd, 0xdf, 0x39, 0xf0, 0x83, 0x64, 0xb0, 0x50, 0xbb, 0x89, 0x68,
+	0x89, 0xed, 0x60, 0x51, 0x66, 0xd0, 0x32, 0x54, 0xc4, 0x87, 0xe5, 0x56, 0xe0, 0xef, 0x79, 0xec,
+	0xe1, 0x32, 0x3b, 0x94, 0xf2, 0x35, 0xfd, 0x9c, 0x34, 0xdd, 0xe4, 0xe9, 0x33, 0x82, 0x1f, 0xe7,
+	0x71, 0xa3, 0x60, 0xe6, 0x9b, 0xd3, 0xc1, 0x02, 0x73, 0x94, 0xb7, 0xf6, 0xbd, 0x02, 0x5c, 0x3d,
+	0x96, 0xe3, 0x49, 0xb3, 0xf0, 0xbe, 0x0c, 0xc0, 0x69, 0x69, 0x0f, 0x48, 0x26, 0x27, 0x51, 0x19,
+	0x27, 0xe8, 0x9b, 0x12, 0x0a, 0x79, 0x00, 0x4f, 0x89, 0x5f, 0x9d, 0x8e, 0x3b, 0x88, 0x42, 0x5a,
+	0x0f, 0x1e, 0xbc, 0x3c, 0x8e, 0xc2, 0x56, 0xde, 0x78, 0xf6, 0x87, 0x9f, 0x5c, 0xbe, 0x1a, 0xf3,
+	0x60, 0x98, 0xec, 0x81, 0x87, 0x88, 0x83, 0x8e, 0x86, 0xaf, 0xc9, 0xbc, 0xc8, 0xb5, 0x64, 0x25,
+	0x95, 0x12, 0x13, 0xb6, 0x58, 0x49, 0xc9, 0xfa, 0xd9, 0x06, 0xc2, 0x19, 0x51, 0xb2, 0x4d, 0xf9,
+	0x2e, 0x9b, 0x49, 0x4d, 0x51, 0x13, 0x66, 0x48, 0x63, 0xe5, 0x66, 0x0e, 0x8d, 0xf6, 0x3b, 0x6c,
+	0x61, 0xe7, 0x4a, 0x07, 0xf2, 0x10, 0x96, 0xa8, 0x96, 0x21, 0x75, 0x36, 0x97, 0x2b, 0x37, 0x8e,
+	0x1f, 0xe8, 0x5a, 0xc4, 0x83, 0xf5, 0x58, 0xc3, 0xc3, 0x43, 0x27, 0x38, 0xda, 0x38, 0x2f, 0xd2,
+	0xc9, 0xa2, 0x36, 0x23, 0x8f, 0xbd, 0x99, 0xfd, 0x8a, 0xf6, 0x83, 0x02, 0xbc, 0xf0, 0x18, 0xbc,
+	0x49, 0x0b, 0x66, 0xf1, 0x3c, 0x8f, 0x9a, 0xe0, 0xf1, 0xf6, 0x80, 0xb3, 0x7c, 0x6f, 0xe4, 0xc1,
+	0x7a, 0x62, 0x3d, 0x30, 0x61, 0x42, 0x6e, 0xd1, 0xe9, 0xd4, 0x45, 0x7e, 0xc7, 0xdb, 0x06, 0x56,
+	0x84, 0x99, 0xcc, 0xed, 0x77, 0x13, 0x6e, 0x82, 0x81, 0x14, 0x87, 0xb0, 0x38, 0x36, 0x0e, 0xe1,
+	0x6b, 0x30, 0x6f, 0x48, 0x0e, 0xb6, 0x7c, 0xf8, 0xf1, 0xd6, 0x20, 0xe5, 0x8d, 0x6b, 0xa6, 0xd0,
+	0xc8, 0xe7, 0x60, 0x91, 0x79, 0x0f, 0xf0, 0xde, 0x61, 0xbe, 0x6d, 0x53, 0x3c, 0xbb, 0x0a, 0x96,
+	0x88, 0xae, 0x0e, 0xcd, 0x0c, 0x2a, 0x5d, 0x58, 0x67, 0xa9, 0x56, 0xd2, 0x73, 0xc3, 0x50, 0x1f,
+	0x46, 0x07, 0x74, 0xd7, 0x61, 0xe7, 0x74, 0xf2, 0x06, 0x4c, 0x1f, 0x3c, 0xde, 0xed, 0x1c, 0x43,
+	0x27, 0x04, 0x50, 0xd3, 0x17, 0xe1, 0x52, 0xe8, 0xff, 0xe4, 0x4d, 0x98, 0x42, 0x23, 0x33, 0x57,
+	0xa8, 0x85, 0x21, 0x24, 0xff, 0xd3, 0x68, 0x82, 0x36, 0x19, 0x01, 0x5d, 0xad, 0x49, 0x9e, 0x5c,
+	0xbe, 0x1f, 0x0b, 0xe3, 0x6b, 0x9c, 0x2a, 0xd7, 0x9c, 0x3d, 0xdc, 0x73, 0x78, 0xf2, 0xd9, 0x75,
+	0x58, 0x16, 0xb2, 0x77, 0x20, 0x32, 0x95, 0x70, 0xbf, 0x9b, 0x25, 0x1e, 0xd2, 0x69, 0x20, 0xb2,
+	0x95, 0x3c, 0x03, 0x8b, 0x61, 0x78, 0x60, 0xf3, 0x40, 0x82, 0x0f, 0x44, 0x12, 0x34, 0x73, 0x3e,
+	0x0c, 0x0f, 0x58, 0x44, 0xc1, 0xdb, 0xee, 0x11, 0xc5, 0xc2, 0xb7, 0x0c, 0x09, 0x56, 0x99, 0x61,
+	0x45, 0xbd, 0x30, 0xc6, 0xe2, 0x31, 0x30, 0x21, 0xc1, 0xd2, 0xfe, 0x6b, 0x01, 0x66, 0xef, 0xd2,
+	0xc3, 0x2b, 0x9a, 0x64, 0x27, 0x9b, 0x78, 0x6f, 0xc0, 0x5c, 0xdd, 0x77, 0xf8, 0x15, 0x3d, 0x8f,
+	0xd7, 0xc1, 0x1e, 0x3f, 0xf5, 0x7c, 0x47, 0xdc, 0xf6, 0x87, 0xa6, 0x8c, 0x74, 0x4c, 0x10, 0xc8,
+	0x5b, 0x30, 0xcd, 0x56, 0x38, 0xbf, 0x6d, 0x10, 0xe6, 0x8b, 0xb8, 0x46, 0x2f, 0xb1, 0x62, 0xe9,
+	0x0e, 0x99, 0x49, 0x09, 0xf9, 0x2c, 0xcd, 0x1f, 0x3a, 0x49, 0x06, 0xe8, 0xa9, 0x93, 0x19, 0xa0,
+	0xa5, 0x8c, 0x13, 0xd3, 0x27, 0xc9, 0x38, 0xb1, 0x76, 0x13, 0xe6, 0xa4, 0xfa, 0x3c, 0x96, 0x35,
+	0xe3, 0x57, 0x0a, 0xb0, 0x80, 0xad, 0x8a, 0xa5, 0xd6, 0x5f, 0x4f, 0x73, 0xfa, 0x67, 0x53, 0xe6,
+	0xf4, 0x55, 0x79, 0xbc, 0xb8, 0xd3, 0xcf, 0x78, 0x3b, 0xfa, 0x2d, 0x58, 0x1e, 0x41, 0x24, 0xaf,
+	0xc1, 0x14, 0xad, 0xbe, 0x30, 0x3f, 0xaa, 0xd9, 0x19, 0x90, 0x64, 0x27, 0xa3, 0x0d, 0x0f, 0x4d,
+	0x86, 0xad, 0xfd, 0x0f, 0x05, 0xe6, 0x79, 0x5a, 0xe6, 0xfe, 0x9e, 0x7f, 0x6c, 0x77, 0x5e, 0xcb,
+	0x76, 0x27, 0x0b, 0x69, 0xcc, 0xbb, 0xf3, 0xaf, 0xba, 0x13, 0x6f, 0xa6, 0x3a, 0xf1, 0x5c, 0x9c,
+	0xab, 0x44, 0x34, 0x67, 0x42, 0x1f, 0x7e, 0x0b, 0xb3, 0x77, 0xa5, 0x11, 0xc9, 0x2f, 0xc0, 0x6c,
+	0xc3, 0x7d, 0x98, 0xb2, 0xe2, 0x5d, 0x1b, 0xc3, 0xf4, 0xa5, 0x18, 0x91, 0xad, 0x29, 0xf6, 0x00,
+	0xd1, 0x7d, 0x68, 0x8f, 0xf8, 0x66, 0x24, 0x2c, 0xd7, 0xde, 0x82, 0xc5, 0x34, 0xd9, 0xe3, 0x4c,
+	0x7d, 0x1e, 0xe1, 0x0c, 0xa3, 0x74, 0xff, 0x5a, 0x11, 0x20, 0x09, 0x0e, 0x45, 0x17, 0x60, 0xca,
+	0x1d, 0x4c, 0x5c, 0x80, 0x22, 0x48, 0x9e, 0xe3, 0xc2, 0x4b, 0xec, 0x1a, 0xbf, 0xa8, 0x2b, 0x8c,
+	0xcf, 0x25, 0xd3, 0x17, 0x01, 0xee, 0x98, 0x27, 0x75, 0xcf, 0x61, 0x6f, 0x8f, 0x8a, 0x1b, 0xcf,
+	0x60, 0xea, 0xb0, 0x18, 0x9a, 0xca, 0xdb, 0x51, 0xae, 0x0e, 0x79, 0xca, 0x42, 0x0c, 0x07, 0x54,
+	0xa5, 0x08, 0x23, 0x01, 0xd7, 0x4a, 0x8f, 0x17, 0x70, 0xad, 0x05, 0xb3, 0x5e, 0xff, 0x23, 0xb7,
+	0x1f, 0xf9, 0xc1, 0x11, 0xde, 0x4e, 0x26, 0xd7, 0x1e, 0xb4, 0x0b, 0x6a, 0xa2, 0x8c, 0x8d, 0x03,
+	0x6a, 0x9a, 0x31, 0xbe, 0x3c, 0x0c, 0x31, 0x30, 0xf6, 0xdc, 0x99, 0x52, 0xa7, 0x59, 0x9c, 0xa6,
+	0x5b, 0xa5, 0x72, 0x59, 0x9d, 0xbd, 0x55, 0x2a, 0xcf, 0xaa, 0x60, 0x4a, 0xce, 0x06, 0xb1, 0x33,
+	0x81, 0x74, 0xf3, 0x9f, 0xbe, 0xd5, 0xd7, 0x7e, 0x54, 0x00, 0x32, 0x5a, 0x0d, 0xf2, 0x59, 0x98,
+	0x63, 0x02, 0xd6, 0x0e, 0xc2, 0x0f, 0xf9, 0x03, 0x4c, 0xf6, 0x6a, 0x5a, 0x02, 0xcb, 0xb1, 0xce,
+	0x19, 0xd8, 0x0c, 0x3f, 0xec, 0x91, 0x2f, 0xc1, 0x69, 0xec, 0xde, 0x81, 0x1b, 0x78, 0x7e, 0xd7,
+	0xc6, 0x4c, 0x56, 0x4e, 0x0f, 0xc7, 0xaa, 0xb8, 0xf1, 0xe2, 0x0f, 0x3f, 0xb9, 0xfc, 0x54, 0x4e,
+	0xf1, 0x98, 0x61, 0xc0, 0xf0, 0x4a, 0x2d, 0xc4, 0x6c, 0x31, 0x44, 0xd2, 0x06, 0x55, 0xa6, 0xdf,
+	0x1b, 0xf6, 0x7a, 0x7c, 0x64, 0xd7, 0xe9, 0xd1, 0x20, 0x5b, 0x36, 0x86, 0xf1, 0x62, 0xc2, 0x78,
+	0x73, 0xd8, 0xeb, 0x91, 0x37, 0x00, 0xfc, 0xbe, 0x7d, 0xe8, 0x85, 0x21, 0xbb, 0xf3, 0x8e, 0x1f,
+	0xe5, 0x26, 0x50, 0x79, 0x30, 0xfc, 0xfe, 0x0e, 0x03, 0x92, 0xbf, 0x05, 0x18, 0x22, 0x15, 0x63,
+	0x07, 0x73, 0x6d, 0x86, 0x9d, 0x16, 0x04, 0x30, 0x1d, 0x1d, 0x6f, 0xdf, 0xb5, 0xbc, 0x2f, 0x8b,
+	0xb7, 0xcb, 0x5f, 0x80, 0x65, 0xae, 0x19, 0xdd, 0xf5, 0xa2, 0x03, 0x6e, 0x71, 0x79, 0x12, 0x73,
+	0x8d, 0x64, 0x2e, 0xf9, 0xa3, 0x29, 0x00, 0xfd, 0xae, 0x25, 0xc2, 0xf2, 0x3f, 0x0f, 0x53, 0x6d,
+	0xca, 0x86, 0xdb, 0xa3, 0x51, 0xe1, 0x42, 0xbe, 0xf2, 0x6d, 0x1e, 0x62, 0xd0, 0xd5, 0x68, 0xe2,
+	0x33, 0x43, 0x61, 0x8b, 0xc6, 0xd5, 0xc8, 0x5e, 0x1e, 0xa6, 0xf2, 0xa8, 0x71, 0x2c, 0x52, 0x07,
+	0x48, 0x02, 0xe5, 0x73, 0xab, 0xc6, 0x72, 0x12, 0x71, 0x9a, 0x17, 0xf0, 0xfc, 0xb0, 0xc9, 0x5b,
+	0x72, 0x79, 0xfa, 0x24, 0x68, 0xe4, 0x36, 0x94, 0xda, 0x4e, 0x1c, 0x07, 0x6d, 0x4c, 0xfa, 0x80,
+	0x2b, 0xb4, 0xf5, 0xa9, 0x14, 0x02, 0x8b, 0x91, 0xb3, 0x2f, 0xd7, 0x0e, 0x99, 0x10, 0x03, 0xa6,
+	0x5b, 0x4e, 0xe0, 0x1c, 0x86, 0xe3, 0xd2, 0xce, 0xb0, 0x52, 0x91, 0x9d, 0x0e, 0x81, 0xb2, 0x4e,
+	0xc1, 0x8a, 0xc9, 0x0d, 0x28, 0x5a, 0xd6, 0x0e, 0x7f, 0x1e, 0xb1, 0x90, 0x9c, 0x26, 0x2c, 0x6b,
+	0x87, 0x29, 0xbd, 0x61, 0x78, 0x28, 0x91, 0x51, 0x64, 0xf2, 0x39, 0x98, 0x93, 0x0e, 0x29, 0x3c,
+	0xdc, 0x34, 0xf6, 0x81, 0xf4, 0x90, 0x5d, 0x16, 0x1a, 0x12, 0x36, 0xa9, 0x83, 0x7a, 0x7b, 0x78,
+	0xdf, 0xd5, 0x07, 0x03, 0x0c, 0xa7, 0xf4, 0x91, 0x1b, 0x30, 0x45, 0xae, 0x9c, 0x24, 0x76, 0xc3,
+	0x57, 0xa3, 0x5d, 0x51, 0x2a, 0x9b, 0x43, 0xb2, 0x94, 0xa4, 0x05, 0xcb, 0x96, 0x1b, 0x0d, 0x07,
+	0xcc, 0x9b, 0x71, 0x93, 0x1d, 0xa7, 0x59, 0x70, 0x6a, 0xcc, 0x81, 0x15, 0xd2, 0x42, 0xe1, 0x48,
+	0xba, 0x37, 0x72, 0xa4, 0x1e, 0x25, 0x26, 0x5f, 0xca, 0x1c, 0xfc, 0x21, 0x6b, 0x7b, 0x92, 0x4b,
+	0x45, 0x06, 0x8a, 0x93, 0xdb, 0x05, 0xfe, 0x33, 0xb3, 0x0b, 0xe4, 0x30, 0x21, 0x06, 0x2c, 0xca,
+	0xe0, 0xd8, 0xfa, 0x81, 0x91, 0x0a, 0x52, 0xa1, 0x4f, 0x53, 0xe6, 0x8c, 0x0c, 0x11, 0x79, 0x04,
+	0xa7, 0x65, 0x88, 0xd3, 0xdb, 0xed, 0x7b, 0x51, 0x98, 0x49, 0x89, 0x9d, 0xa9, 0x02, 0xa2, 0x88,
+	0xc6, 0x60, 0xc7, 0xf9, 0x29, 0x16, 0xf6, 0x90, 0x22, 0x48, 0x1f, 0xcd, 0xfb, 0x84, 0xf6, 0xcb,
+	0x18, 0x8a, 0x61, 0x1c, 0x5f, 0x96, 0x38, 0x11, 0x9f, 0xf2, 0xcb, 0x57, 0x47, 0xfc, 0xa1, 0x7f,
+	0x3a, 0x71, 0x22, 0x82, 0x28, 0x81, 0xc1, 0xde, 0xfe, 0xcb, 0xcb, 0x95, 0x87, 0x03, 0x90, 0x09,
+	0x38, 0x96, 0xe6, 0xca, 0xcb, 0x55, 0x3e, 0xc3, 0x2b, 0x93, 0xce, 0xf0, 0x2f, 0xe7, 0x24, 0xbf,
+	0x40, 0x4b, 0x84, 0x94, 0xfc, 0x22, 0x95, 0xf2, 0xe2, 0x7f, 0x4d, 0x49, 0xf9, 0x97, 0xf8, 0x3a,
+	0x7a, 0x1b, 0xe0, 0x96, 0xef, 0xf5, 0x77, 0xdc, 0xe8, 0xc0, 0xef, 0x4a, 0x03, 0x37, 0xf7, 0x81,
+	0xef, 0xf5, 0xed, 0x43, 0x04, 0xff, 0xe8, 0x93, 0xcb, 0x12, 0x92, 0x29, 0xfd, 0x4f, 0x3e, 0x03,
+	0xb3, 0xf4, 0x57, 0x3b, 0xf1, 0xa7, 0x65, 0xd7, 0x8e, 0x48, 0xcd, 0x52, 0x25, 0x27, 0x08, 0xe4,
+	0x26, 0x26, 0x07, 0xf7, 0x06, 0x91, 0x74, 0xf0, 0x10, 0x99, 0xc0, 0xbd, 0x41, 0x94, 0x8d, 0x2f,
+	0x21, 0x21, 0x93, 0xed, 0xb8, 0xea, 0x6d, 0x9e, 0xaf, 0x8b, 0xe7, 0x20, 0xe7, 0x41, 0x2a, 0xb0,
+	0xc8, 0x16, 0xb9, 0xbc, 0xe4, 0x20, 0x15, 0x19, 0x32, 0xac, 0x84, 0xb5, 0x5d, 0xe5, 0x76, 0xa7,
+	0x29, 0xa9, 0x12, 0xe1, 0x41, 0x97, 0x5b, 0x91, 0x52, 0x95, 0x88, 0x91, 0xc9, 0x06, 0x2c, 0xb1,
+	0x13, 0x5b, 0x2b, 0xf0, 0x1f, 0x1d, 0x61, 0x22, 0xea, 0xe9, 0x64, 0x5f, 0x1a, 0x50, 0x20, 0x9e,
+	0x19, 0xe5, 0xcf, 0x67, 0x08, 0xc8, 0x26, 0x4c, 0xa1, 0x0d, 0x91, 0xbf, 0x1d, 0xbd, 0x20, 0x5b,
+	0xb1, 0xb3, 0x32, 0x10, 0xf7, 0x04, 0xb4, 0x5f, 0xcb, 0x7b, 0x02, 0xa2, 0x92, 0x9f, 0x07, 0x30,
+	0xfa, 0x81, 0xdf, 0xeb, 0x61, 0x7a, 0xba, 0x72, 0x2a, 0x96, 0x0d, 0xe7, 0x83, 0x5c, 0x12, 0x24,
+	0x9e, 0x19, 0x05, 0x7f, 0xdb, 0x99, 0x24, 0x76, 0x12, 0x2f, 0xf2, 0x19, 0x98, 0xb6, 0x86, 0x7b,
+	0x7b, 0xde, 0x23, 0x2e, 0x90, 0x58, 0x66, 0x36, 0x84, 0xc8, 0x82, 0x98, 0xe1, 0x90, 0xb7, 0x60,
+	0x6e, 0x77, 0xd0, 0x75, 0x22, 0x17, 0xef, 0x1d, 0x79, 0xba, 0x4f, 0x94, 0x2b, 0x43, 0x04, 0xb3,
+	0xa7, 0x0b, 0xb2, 0x54, 0x95, 0xd0, 0x89, 0x07, 0xcb, 0xdb, 0xed, 0x76, 0x0b, 0xbb, 0x47, 0x3c,
+	0x80, 0xe7, 0xa1, 0x62, 0xc4, 0x09, 0x66, 0xa4, 0x7c, 0xe3, 0x2a, 0xd5, 0x58, 0x0e, 0xa2, 0x68,
+	0x60, 0xb3, 0x2e, 0x17, 0xb1, 0xb7, 0x64, 0x01, 0x39, 0x42, 0xa5, 0xfd, 0xa1, 0x92, 0xf3, 0x2d,
+	0xf2, 0x3a, 0xcc, 0xc6, 0x40, 0x39, 0x93, 0x6d, 0xc2, 0x5e, 0x56, 0x32, 0x62, 0x54, 0x3a, 0x8b,
+	0xe8, 0x0f, 0x8b, 0x11, 0x4a, 0x99, 0x67, 0x28, 0x61, 0x38, 0x42, 0x29, 0x21, 0xd3, 0x03, 0x64,
+	0xc3, 0x67, 0x74, 0x92, 0xe5, 0xb9, 0xef, 0x8f, 0x10, 0x09, 0x34, 0xad, 0x06, 0xd3, 0x6c, 0x6b,
+	0xc3, 0xe4, 0x9b, 0x3c, 0x45, 0xb9, 0x94, 0xba, 0x91, 0x25, 0xdf, 0xe4, 0xf0, 0xd1, 0xe4, 0x9b,
+	0x12, 0x81, 0x76, 0x1b, 0x56, 0xf2, 0xa6, 0x5a, 0xca, 0x0e, 0xad, 0x9c, 0xd4, 0x0e, 0xfd, 0xa7,
+	0x45, 0x98, 0x47, 0x6e, 0x42, 0x54, 0xea, 0xb0, 0x60, 0x0d, 0xef, 0xc7, 0x89, 0x26, 0x84, 0x6e,
+	0x83, 0xf5, 0x0b, 0xe5, 0x02, 0xd9, 0x71, 0x28, 0x45, 0x41, 0x77, 0x13, 0xa1, 0x57, 0x6d, 0x89,
+	0x97, 0xaf, 0x71, 0xde, 0x4b, 0xf1, 0x20, 0x98, 0xbf, 0x87, 0x91, 0x77, 0x93, 0x34, 0x51, 0xa2,
+	0x5d, 0x15, 0x1f, 0x47, 0xbb, 0x2a, 0x9d, 0x48, 0xbb, 0x7a, 0x1f, 0xe6, 0xc5, 0xd7, 0x50, 0x2f,
+	0x9a, 0x7a, 0x32, 0xbd, 0x28, 0xc5, 0x8c, 0xd4, 0x63, 0xfd, 0x68, 0x7a, 0xa2, 0x7e, 0x84, 0xde,
+	0x58, 0x42, 0xee, 0x0d, 0x10, 0x96, 0xa3, 0x26, 0x3d, 0x89, 0xca, 0xa3, 0xfd, 0x79, 0x11, 0x60,
+	0xab, 0xd2, 0xfa, 0x09, 0x14, 0xd6, 0xd7, 0x60, 0xb6, 0xee, 0x0b, 0x2f, 0x1e, 0xc9, 0x7d, 0xa2,
+	0x27, 0x80, 0xf2, 0xa2, 0x8a, 0x31, 0x63, 0x45, 0xb3, 0xf8, 0x69, 0x28, 0x9a, 0x37, 0xd1, 0x50,
+	0xff, 0x81, 0xdb, 0x89, 0x6a, 0x55, 0x31, 0xb2, 0xd8, 0x72, 0x11, 0x2d, 0x3a, 0xed, 0xc5, 0x21,
+	0x21, 0xd3, 0xcd, 0x86, 0x3b, 0x08, 0x8b, 0x00, 0x5a, 0xdc, 0x34, 0x8e, 0x9b, 0x8d, 0x88, 0x42,
+	0x26, 0x62, 0x72, 0xc9, 0xd2, 0x3e, 0x43, 0xf6, 0x29, 0x8f, 0xe6, 0x7b, 0xf1, 0x4b, 0x8f, 0x99,
+	0x49, 0x3d, 0xa4, 0x8d, 0xf4, 0xd0, 0xd8, 0xf7, 0x1d, 0xda, 0x77, 0x14, 0x39, 0x63, 0xf1, 0x4f,
+	0x30, 0xd4, 0x6f, 0x02, 0xc4, 0x6e, 0x94, 0x62, 0xac, 0xe3, 0xd8, 0x49, 0x0c, 0x2a, 0xf7, 0x72,
+	0x82, 0x2b, 0xb5, 0xa6, 0xf8, 0x69, 0xb5, 0xa6, 0x0d, 0x73, 0xcd, 0x07, 0x91, 0x93, 0xf8, 0xdd,
+	0x82, 0x15, 0x1f, 0x2a, 0x51, 0xac, 0x15, 0xf1, 0x9e, 0xe5, 0x8c, 0x74, 0x24, 0x1d, 0x73, 0x1a,
+	0x95, 0x08, 0xb5, 0x1f, 0x2b, 0xb0, 0x24, 0x87, 0x7f, 0x3c, 0xea, 0x77, 0xc8, 0x3b, 0x2c, 0x1f,
+	0x9a, 0x92, 0xb2, 0x1e, 0x48, 0x48, 0x54, 0x5e, 0x1f, 0xf5, 0x3b, 0xec, 0x2c, 0xe2, 0x3c, 0x94,
+	0x2b, 0x4b, 0x09, 0xc9, 0x7d, 0x98, 0x6f, 0xf9, 0xbd, 0x1e, 0x5d, 0x6e, 0xc1, 0x47, 0xfc, 0x2c,
+	0x4e, 0x19, 0x65, 0xef, 0x08, 0x44, 0x85, 0x36, 0x9e, 0xe6, 0x26, 0xa7, 0x73, 0x03, 0xba, 0x7d,
+	0x7b, 0x9c, 0x2e, 0x61, 0xfb, 0x31, 0xc6, 0xc5, 0x90, 0x79, 0x26, 0xaa, 0x46, 0x3a, 0xf3, 0xae,
+	0x5c, 0x4b, 0x5a, 0x8c, 0xf5, 0x9c, 0xa0, 0x6a, 0x68, 0x7f, 0x5b, 0x81, 0x2b, 0xa3, 0x4d, 0xab,
+	0xf4, 0xfc, 0x61, 0xb7, 0x1d, 0x38, 0x5e, 0xaf, 0xee, 0xef, 0x87, 0x2c, 0x8f, 0xd4, 0x7e, 0x72,
+	0xe5, 0xc8, 0xf3, 0x48, 0xed, 0x7b, 0xd9, 0x3c, 0x52, 0x18, 0x2e, 0xe7, 0x55, 0x28, 0x5b, 0xef,
+	0x59, 0xef, 0x0d, 0x5d, 0x61, 0x96, 0x62, 0xf2, 0x21, 0xfc, 0x30, 0xb4, 0x3f, 0xa4, 0x40, 0x79,
+	0xbb, 0x11, 0x88, 0xda, 0x21, 0x5c, 0x1a, 0xad, 0x86, 0x71, 0xdb, 0xd2, 0x87, 0x5d, 0x2f, 0xc2,
+	0x4a, 0x08, 0x01, 0xa2, 0x7c, 0x0a, 0x02, 0x44, 0xfb, 0xa7, 0x45, 0x20, 0xa3, 0xdf, 0x93, 0xb7,
+	0x0b, 0xe5, 0xff, 0xc2, 0x61, 0x3c, 0x23, 0xd1, 0x4b, 0x8f, 0x75, 0x88, 0xfd, 0x10, 0xd4, 0x0e,
+	0x1d, 0x36, 0x3b, 0xa2, 0xe3, 0x66, 0xf7, 0xfc, 0x78, 0xf7, 0xfa, 0xb9, 0xb1, 0x53, 0x38, 0x3d,
+	0xce, 0x4c, 0x04, 0x66, 0x99, 0xc8, 0x1b, 0x71, 0x27, 0x3d, 0x2f, 0x3c, 0x58, 0x74, 0x1f, 0x84,
+	0xb6, 0x43, 0xc7, 0x88, 0x7d, 0x70, 0x3a, 0xe5, 0x07, 0x3d, 0x79, 0x44, 0x99, 0x60, 0x4c, 0x33,
+	0x90, 0xb7, 0x4e, 0xf7, 0x41, 0x18, 0xe3, 0x6a, 0xdf, 0x50, 0x60, 0x25, 0x6f, 0x72, 0x53, 0x9d,
+	0x42, 0x56, 0x32, 0xd2, 0x27, 0x54, 0x59, 0x2f, 0xc9, 0x9c, 0x50, 0xd3, 0x44, 0xd9, 0xae, 0x2f,
+	0x3c, 0xd6, 0x66, 0xfa, 0x83, 0x22, 0xcc, 0x33, 0xef, 0xa1, 0x6d, 0xd7, 0xe9, 0x45, 0x07, 0x74,
+	0x1e, 0x89, 0x1c, 0xf9, 0xd2, 0x1b, 0x93, 0x09, 0xc9, 0xf1, 0x6f, 0x40, 0xb9, 0x45, 0xc5, 0x42,
+	0xc7, 0xef, 0xc9, 0x37, 0x0f, 0x03, 0x0e, 0x93, 0x97, 0x8c, 0xc0, 0x43, 0x5d, 0x5e, 0xbe, 0x39,
+	0x64, 0xba, 0x3c, 0x42, 0x52, 0xba, 0x3c, 0xbb, 0x43, 0x7c, 0x04, 0xa7, 0x13, 0x87, 0xb0, 0xf8,
+	0x76, 0xf2, 0x04, 0xcf, 0x69, 0xd7, 0xf9, 0xd5, 0xec, 0xa5, 0xc4, 0xc7, 0x0c, 0xaf, 0x31, 0xb1,
+	0x34, 0x93, 0xf6, 0x2d, 0xef, 0x13, 0xe4, 0x36, 0xa8, 0x09, 0x98, 0xe7, 0xa3, 0x63, 0x47, 0x33,
+	0x0c, 0x99, 0x29, 0xb1, 0x1d, 0x49, 0x4d, 0x37, 0x42, 0x48, 0xb7, 0xef, 0x04, 0x66, 0x24, 0x2f,
+	0xe7, 0x85, 0xa7, 0x42, 0xcc, 0x0b, 0x2f, 0x46, 0xe5, 0xed, 0x3b, 0x43, 0x46, 0xc7, 0x48, 0xdc,
+	0xa7, 0xce, 0x24, 0x63, 0xc4, 0x6f, 0x52, 0xe5, 0x31, 0xe2, 0x58, 0xeb, 0xbf, 0xa5, 0xc0, 0x52,
+	0x4d, 0xdf, 0xe1, 0x39, 0xd6, 0x59, 0xaf, 0x5e, 0x85, 0xa7, 0x6a, 0xfa, 0x8e, 0xdd, 0x6a, 0xd6,
+	0x6b, 0x95, 0x7b, 0x76, 0x6e, 0x26, 0xd4, 0xa7, 0xe0, 0xfc, 0x28, 0x4a, 0xe2, 0x3b, 0x77, 0x11,
+	0x56, 0x47, 0x8b, 0x45, 0xb6, 0xd4, 0x7c, 0x62, 0x91, 0x58, 0xb5, 0xb8, 0xfe, 0x2e, 0x2c, 0x89,
+	0xcc, 0xa0, 0xed, 0xba, 0x85, 0x27, 0xbc, 0x25, 0x98, 0xbb, 0x63, 0x98, 0xb5, 0xcd, 0x7b, 0xf6,
+	0xe6, 0x6e, 0xbd, 0xae, 0x9e, 0x22, 0x0b, 0x30, 0xcb, 0x01, 0x15, 0x5d, 0x55, 0xc8, 0x3c, 0x94,
+	0x6b, 0x0d, 0xcb, 0xa8, 0xec, 0x9a, 0x86, 0x5a, 0x58, 0xff, 0x87, 0x0a, 0x2c, 0xb0, 0x33, 0x5b,
+	0xc0, 0x5b, 0x74, 0x09, 0xd6, 0x76, 0x5b, 0x55, 0xbd, 0x6d, 0x98, 0xf9, 0xcd, 0x39, 0x03, 0xcb,
+	0x99, 0xf2, 0xe6, 0x6d, 0x55, 0x21, 0x17, 0xe0, 0x5c, 0x06, 0x5c, 0xad, 0x59, 0xfa, 0x06, 0x6b,
+	0xc5, 0x79, 0x38, 0x93, 0x29, 0x6c, 0xd5, 0x1a, 0x0d, 0xa3, 0xaa, 0x16, 0x69, 0x03, 0x47, 0x3e,
+	0x67, 0x1a, 0x7a, 0x95, 0x92, 0xaa, 0xa5, 0xf5, 0x77, 0x61, 0xb1, 0x15, 0x3f, 0x14, 0x44, 0xd7,
+	0xbc, 0x19, 0x28, 0x9a, 0xfa, 0x5d, 0xf5, 0x14, 0x01, 0x98, 0x6e, 0xdd, 0xae, 0x58, 0xd7, 0xaf,
+	0xab, 0x0a, 0x99, 0x83, 0x99, 0xad, 0x4a, 0xcb, 0xbe, 0xbd, 0x63, 0xa9, 0x05, 0xfa, 0x43, 0xbf,
+	0x6b, 0xe1, 0x8f, 0xe2, 0xfa, 0x2b, 0xe8, 0x90, 0xf2, 0xe8, 0xa8, 0xee, 0x85, 0x91, 0xdb, 0x77,
+	0x03, 0xec, 0xa3, 0x79, 0x28, 0x5b, 0x2e, 0xd5, 0xc4, 0x22, 0x97, 0x75, 0xd0, 0xce, 0xb0, 0x17,
+	0x79, 0x83, 0x9e, 0xfb, 0x48, 0x55, 0xd6, 0x6f, 0xc2, 0x92, 0xe9, 0x0f, 0xe9, 0x09, 0xd2, 0x8a,
+	0x28, 0xc6, 0xfe, 0x11, 0xb6, 0xb9, 0xa1, 0xef, 0x6c, 0xd4, 0xb6, 0x76, 0x9b, 0xbb, 0x96, 0xbd,
+	0xa3, 0xb7, 0x2b, 0xdb, 0xcc, 0x31, 0x70, 0xa7, 0x69, 0xb5, 0x6d, 0xd3, 0xa8, 0x18, 0x8d, 0xb6,
+	0xaa, 0xac, 0x7f, 0x1d, 0xaf, 0x89, 0x3a, 0x7e, 0xbf, 0xbb, 0xe9, 0x74, 0x22, 0x3f, 0xc0, 0x0a,
+	0x6b, 0x70, 0xc9, 0x32, 0x2a, 0xcd, 0x46, 0xd5, 0xde, 0xd4, 0x2b, 0xed, 0xa6, 0x99, 0x97, 0x2a,
+	0x78, 0x0d, 0xce, 0xe6, 0xe0, 0x34, 0xdb, 0x2d, 0x55, 0x21, 0x97, 0xe1, 0x42, 0x4e, 0xd9, 0x5d,
+	0x63, 0x43, 0xdf, 0x6d, 0x6f, 0x37, 0xd4, 0xc2, 0x18, 0x62, 0xcb, 0x6a, 0xaa, 0xc5, 0xf5, 0xbf,
+	0xa3, 0xc0, 0xe2, 0x6e, 0xc8, 0x5f, 0x29, 0xef, 0xa2, 0x57, 0xc0, 0x15, 0xb8, 0xb8, 0x6b, 0x19,
+	0xa6, 0xdd, 0x6e, 0xde, 0x36, 0x1a, 0xf6, 0xae, 0xa5, 0x6f, 0x65, 0x6b, 0x73, 0x19, 0x2e, 0x48,
+	0x18, 0xa6, 0x51, 0x69, 0xde, 0x31, 0x4c, 0xbb, 0xa5, 0x5b, 0xd6, 0xdd, 0xa6, 0x59, 0x55, 0x15,
+	0xfa, 0xc5, 0x1c, 0x84, 0x9d, 0x4d, 0x9d, 0xd5, 0x26, 0x55, 0xd6, 0x30, 0xee, 0xea, 0x75, 0x7b,
+	0xa3, 0xd9, 0x56, 0x8b, 0xeb, 0x3b, 0xf4, 0x70, 0x85, 0x09, 0x3b, 0xd9, 0x5b, 0xb2, 0x32, 0x94,
+	0x1a, 0xcd, 0x86, 0x91, 0x75, 0x27, 0x9d, 0x87, 0xb2, 0xde, 0x6a, 0x99, 0xcd, 0x3b, 0x38, 0x79,
+	0x00, 0xa6, 0xab, 0x46, 0xa3, 0x86, 0xb3, 0x65, 0x1e, 0xca, 0x2d, 0xb3, 0xb9, 0xd3, 0x6c, 0x1b,
+	0x55, 0xb5, 0xb4, 0xae, 0xc3, 0x32, 0xdb, 0x12, 0x38, 0x53, 0xbc, 0x4b, 0x5c, 0x80, 0xd9, 0xdd,
+	0x46, 0xd5, 0xd8, 0xac, 0x35, 0xb0, 0x2d, 0x8b, 0x00, 0xd6, 0x76, 0xd3, 0x6c, 0xdb, 0x6d, 0xc3,
+	0xdc, 0x61, 0x19, 0x98, 0xeb, 0xcd, 0xc6, 0x16, 0xfb, 0x59, 0x58, 0x37, 0x85, 0x1a, 0x20, 0xea,
+	0xd5, 0xf1, 0x99, 0xfb, 0x67, 0xd5, 0xd8, 0xd4, 0x77, 0xeb, 0x6d, 0x3e, 0xca, 0xf7, 0x6c, 0xd3,
+	0x78, 0x6f, 0xd7, 0xb0, 0xda, 0x96, 0xaa, 0x10, 0x15, 0xe6, 0x1b, 0x86, 0x51, 0xb5, 0x6c, 0xd3,
+	0xb8, 0x53, 0x33, 0xee, 0xaa, 0x05, 0x5a, 0x2d, 0xf6, 0x3f, 0xad, 0xe4, 0xfa, 0x37, 0x15, 0x20,
+	0x2c, 0x5f, 0xea, 0xb6, 0x1f, 0x46, 0xb4, 0xf7, 0x71, 0xd2, 0x5d, 0x82, 0xb5, 0x6d, 0x3a, 0x5b,
+	0xb0, 0x77, 0x76, 0x9a, 0xd5, 0x6c, 0xaf, 0x9f, 0x05, 0x92, 0x29, 0x6f, 0x6e, 0x6e, 0xe2, 0xca,
+	0x3a, 0x9d, 0x81, 0x57, 0xcd, 0x66, 0x4b, 0x2d, 0xac, 0x15, 0xca, 0x0a, 0x39, 0x37, 0x52, 0x78,
+	0xdb, 0x30, 0x5a, 0x6a, 0x91, 0x8e, 0x72, 0xa6, 0x40, 0xac, 0x7a, 0x46, 0x5e, 0x5a, 0xff, 0x9a,
+	0x02, 0x67, 0x59, 0x35, 0x85, 0x08, 0x89, 0xab, 0x7a, 0x11, 0x56, 0x79, 0x16, 0xe8, 0xbc, 0x8a,
+	0xae, 0x80, 0x9a, 0x2a, 0x65, 0xd5, 0x3c, 0x03, 0xcb, 0x29, 0x28, 0xd6, 0xa3, 0x40, 0x05, 0x64,
+	0x0a, 0xbc, 0x61, 0x58, 0x6d, 0xdb, 0xd8, 0xdc, 0xa4, 0x43, 0x82, 0x15, 0x29, 0xae, 0x6b, 0xb0,
+	0x5c, 0x71, 0x83, 0xc8, 0x78, 0x14, 0xb9, 0xfd, 0xd0, 0xf3, 0xfb, 0x58, 0x85, 0x05, 0x98, 0x35,
+	0x7e, 0xbe, 0x6d, 0x34, 0xac, 0x5a, 0xb3, 0xa1, 0x9e, 0x5a, 0xbf, 0x98, 0xc1, 0x11, 0xa2, 0xc0,
+	0xb2, 0xb6, 0xd5, 0x53, 0xeb, 0x0e, 0x2c, 0x88, 0xf7, 0xbb, 0x6c, 0x62, 0x5d, 0x82, 0x35, 0x31,
+	0x5d, 0x51, 0xac, 0x64, 0x9b, 0xb0, 0x0a, 0x2b, 0xa3, 0xe5, 0x46, 0x5b, 0x55, 0xe8, 0x28, 0x64,
+	0x4a, 0x28, 0xbc, 0xb0, 0xfe, 0x55, 0x05, 0x16, 0x62, 0xa7, 0x12, 0x9c, 0x68, 0x97, 0xe1, 0xc2,
+	0xce, 0xa6, 0x6e, 0x57, 0x8d, 0x3b, 0xb5, 0x8a, 0x61, 0xdf, 0xae, 0x35, 0xaa, 0x99, 0x8f, 0x9c,
+	0x87, 0x33, 0x39, 0x08, 0xf8, 0x95, 0x55, 0x58, 0xc9, 0x16, 0xb5, 0xe9, 0x6a, 0x2f, 0xd0, 0xae,
+	0xcf, 0x96, 0xc4, 0x4b, 0xbd, 0xb8, 0x7e, 0x07, 0x16, 0x2d, 0x7d, 0xa7, 0xbe, 0xe9, 0x07, 0x1d,
+	0x57, 0x1f, 0x46, 0x07, 0x7d, 0x2a, 0x77, 0x37, 0x9b, 0x66, 0xc5, 0xb0, 0x11, 0x25, 0x53, 0x83,
+	0xd3, 0xb0, 0x24, 0x17, 0xde, 0x33, 0xe8, 0xf4, 0x25, 0xb0, 0x28, 0x03, 0x1b, 0x4d, 0xb5, 0xb0,
+	0xfe, 0x45, 0x98, 0xe7, 0x9e, 0x66, 0xac, 0xff, 0xce, 0xc1, 0x69, 0xf9, 0x77, 0xcb, 0xed, 0x77,
+	0xbd, 0xfe, 0xbe, 0x7a, 0x2a, 0x5b, 0x60, 0x0e, 0xfb, 0x7d, 0x5a, 0x80, 0x22, 0x41, 0x2e, 0x68,
+	0xbb, 0xc1, 0xa1, 0xd7, 0x77, 0x22, 0xb7, 0xab, 0x16, 0xd6, 0x5f, 0x82, 0x85, 0x54, 0x06, 0x60,
+	0x3a, 0x70, 0xf5, 0x26, 0x97, 0xe1, 0x3b, 0x46, 0xb5, 0xb6, 0xbb, 0xa3, 0x4e, 0x51, 0x61, 0xb0,
+	0x5d, 0xdb, 0xda, 0x56, 0x61, 0xfd, 0xb7, 0x15, 0x58, 0xa4, 0xeb, 0xd1, 0x0b, 0xdc, 0x9d, 0x4d,
+	0x5d, 0x0c, 0x35, 0x9d, 0x66, 0x2c, 0xaf, 0xb8, 0x61, 0x59, 0xcc, 0x11, 0xfb, 0x22, 0xac, 0xf2,
+	0x1f, 0xb6, 0xde, 0xa8, 0xda, 0xdb, 0xba, 0x59, 0xbd, 0xab, 0x9b, 0x74, 0xee, 0xdd, 0x53, 0x0b,
+	0xb8, 0xa0, 0x24, 0x88, 0xdd, 0x6e, 0xee, 0x56, 0xb6, 0xd5, 0x22, 0x9d, 0xbf, 0x29, 0x78, 0xab,
+	0xd6, 0x50, 0x4b, 0xb8, 0x3c, 0x47, 0xb0, 0x91, 0x2d, 0x2d, 0x9f, 0x5a, 0xff, 0xbe, 0x02, 0xe7,
+	0x2c, 0x6f, 0xbf, 0xef, 0x44, 0xc3, 0xc0, 0xd5, 0x7b, 0xfb, 0x7e, 0xe0, 0x45, 0x07, 0x87, 0xd6,
+	0xd0, 0x8b, 0x5c, 0xf2, 0x3c, 0x3c, 0x6b, 0xd5, 0xb6, 0x1a, 0x7a, 0x9b, 0x2e, 0x2f, 0xbd, 0xbe,
+	0xd5, 0x34, 0x6b, 0xed, 0xed, 0x1d, 0xdb, 0xda, 0xad, 0x8d, 0xcc, 0xbc, 0x67, 0xe0, 0xca, 0x78,
+	0xd4, 0xba, 0xb1, 0xa5, 0x57, 0xee, 0xa9, 0xca, 0x64, 0x86, 0x1b, 0x7a, 0x5d, 0x6f, 0x54, 0x8c,
+	0xaa, 0x7d, 0xe7, 0xba, 0x5a, 0x20, 0xcf, 0xc2, 0xd5, 0xf1, 0xa8, 0x9b, 0xb5, 0x96, 0x45, 0xd1,
+	0x8a, 0x93, 0xbf, 0xbb, 0x6d, 0xed, 0x50, 0xac, 0xd2, 0xfa, 0x37, 0x14, 0x58, 0x1d, 0x97, 0xd9,
+	0x82, 0x5c, 0x03, 0xcd, 0x68, 0xb4, 0x4d, 0xbd, 0x56, 0xb5, 0x2b, 0xa6, 0x51, 0x35, 0x1a, 0xed,
+	0x9a, 0x5e, 0xb7, 0x6c, 0xab, 0xb9, 0x4b, 0x67, 0x53, 0xe2, 0x2f, 0xff, 0x34, 0x5c, 0x9e, 0x80,
+	0xd7, 0xac, 0x55, 0x2b, 0xaa, 0x42, 0xae, 0xc3, 0x8b, 0x13, 0x90, 0xac, 0x7b, 0x56, 0xdb, 0xd8,
+	0x91, 0x4b, 0xd4, 0x02, 0x0a, 0xac, 0xfc, 0x48, 0xee, 0xb4, 0x75, 0x58, 0x32, 0xb9, 0x62, 0x57,
+	0xe1, 0xa9, 0xb1, 0x58, 0xbc, 0x5a, 0x4f, 0xc3, 0xe5, 0xb1, 0x28, 0xac, 0x52, 0x6a, 0x61, 0xfd,
+	0x7d, 0x58, 0x1b, 0x1f, 0x4d, 0x98, 0xee, 0x17, 0xe9, 0x21, 0x2f, 0x43, 0xa9, 0x4a, 0x77, 0xb9,
+	0x54, 0x1e, 0x7c, 0x3a, 0x3b, 0x4d, 0xa3, 0xb6, 0xd3, 0xa2, 0x82, 0x90, 0x6f, 0x2e, 0xb8, 0x7b,
+	0x7c, 0x45, 0x89, 0x33, 0x75, 0x24, 0x3c, 0xb3, 0x4f, 0x2f, 0xcc, 0xdd, 0x46, 0x83, 0xed, 0x95,
+	0x4b, 0x30, 0xd7, 0x6c, 0x6f, 0x1b, 0xa6, 0x6d, 0x98, 0x66, 0xd3, 0x54, 0x0b, 0x74, 0x77, 0xda,
+	0x6d, 0xd0, 0xa5, 0xdd, 0x34, 0x6b, 0x5f, 0xc0, 0x4d, 0x73, 0x15, 0x56, 0xac, 0xba, 0x5e, 0xb9,
+	0x6d, 0x37, 0x9a, 0x6d, 0xbb, 0xd6, 0xb0, 0x2b, 0xdb, 0x7a, 0xa3, 0x61, 0xd4, 0x55, 0xa0, 0x32,
+	0xbb, 0x79, 0xbb, 0xad, 0xdb, 0x95, 0x66, 0x63, 0xb3, 0xb6, 0xc5, 0x59, 0xac, 0xe0, 0x2c, 0x18,
+	0x17, 0xfc, 0x87, 0x7c, 0x06, 0x9e, 0x43, 0x9a, 0x56, 0x7d, 0x77, 0xab, 0xd6, 0xb0, 0xad, 0x7b,
+	0x8d, 0x8a, 0xd0, 0xdc, 0x2a, 0xa3, 0x7b, 0xc5, 0x73, 0xf0, 0xcc, 0x44, 0x6c, 0xa1, 0xca, 0x2a,
+	0x74, 0x76, 0x4d, 0xc4, 0xe4, 0xed, 0x5b, 0xff, 0xae, 0x02, 0x17, 0x26, 0x38, 0x07, 0x92, 0x17,
+	0xe1, 0xf9, 0x6d, 0x43, 0xaf, 0xd6, 0x0d, 0xcb, 0x42, 0x09, 0x47, 0x07, 0x91, 0xbd, 0xdc, 0xc8,
+	0xdd, 0x09, 0x9e, 0x87, 0x67, 0x27, 0xa3, 0x27, 0x6a, 0xc9, 0x73, 0xf0, 0xcc, 0x64, 0x54, 0xae,
+	0xa6, 0x14, 0xc8, 0x3a, 0x5c, 0x9b, 0x8c, 0x19, 0xab, 0x37, 0xc5, 0xf5, 0xdf, 0x50, 0xe0, 0x6c,
+	0xfe, 0x9d, 0x0e, 0xad, 0x5b, 0xad, 0x61, 0xb5, 0xf5, 0x7a, 0xdd, 0x6e, 0xe9, 0xa6, 0xbe, 0x63,
+	0x1b, 0x0d, 0xb3, 0x59, 0xaf, 0xe7, 0xed, 0xc9, 0xcf, 0xc0, 0x95, 0xf1, 0xa8, 0x56, 0xc5, 0xac,
+	0xb5, 0xe8, 0xb6, 0xa3, 0xc1, 0xa5, 0xf1, 0x58, 0x46, 0xad, 0x62, 0xa8, 0x85, 0x8d, 0xb7, 0xbf,
+	0xfd, 0xe7, 0x97, 0x4e, 0x7d, 0xfb, 0xfb, 0x97, 0x94, 0x7f, 0xff, 0xfd, 0x4b, 0xca, 0x9f, 0x7d,
+	0xff, 0x92, 0xf2, 0x85, 0x17, 0xd8, 0x73, 0x88, 0x97, 0x3a, 0xfe, 0xe1, 0xcb, 0xfb, 0x81, 0xf3,
+	0x91, 0x17, 0xf1, 0x1b, 0xd6, 0x97, 0xc5, 0x95, 0xdc, 0xcb, 0xce, 0xc0, 0x7b, 0x19, 0x8f, 0xfc,
+	0xf7, 0xa7, 0xf1, 0x04, 0xf9, 0xea, 0xff, 0x09, 0x00, 0x00, 0xff, 0xff, 0xc0, 0xfd, 0x9e, 0xbc,
+	0x9f, 0x06, 0x02, 0x00,
+}
+
+func (this *SSHKeyPair) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
 
+	that1, ok := that.(*SSHKeyPair)
+	if !ok {
+		that2, ok := that.(SSHKeyPair)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !bytes.Equal(this.PublicKey, that1.PublicKey) {
+		return false
+	}
+	if !bytes.Equal(this.PrivateKey, that1.PrivateKey) {
+		return false
+	}
+	if this.PrivateKeyType != that1.PrivateKeyType {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
 func (this *PluginSpecV1) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -26157,6 +28197,30 @@ func (this *PluginSpecV1_Github) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginSpecV1_Intune) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSpecV1_Intune)
+	if !ok {
+		that2, ok := that.(PluginSpecV1_Intune)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.Intune.Equal(that1.Intune) {
+		return false
+	}
+	return true
+}
 func (this *PluginGithubSettings) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -26479,6 +28543,39 @@ func (this *PluginJamfSettings) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginIntuneSettings) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginIntuneSettings)
+	if !ok {
+		that2, ok := that.(PluginIntuneSettings)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Tenant != that1.Tenant {
+		return false
+	}
+	if this.LoginEndpoint != that1.LoginEndpoint {
+		return false
+	}
+	if this.GraphEndpoint != that1.GraphEndpoint {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
 func (this *PluginOktaSettings) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -26624,6 +28721,9 @@ func (this *PluginOktaSyncSettings) Equal(that interface{}) bool {
 	if this.DisableAssignDefaultRoles != that1.DisableAssignDefaultRoles {
 		return false
 	}
+	if this.TimeBetweenImports != that1.TimeBetweenImports {
+		return false
+	}
 	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
 		return false
 	}
@@ -26762,11 +28862,157 @@ func (this *PluginEntraIDSyncSettings) Equal(that interface{}) bool {
 	if this.EntraAppId != that1.EntraAppId {
 		return false
 	}
+	if len(this.GroupFilters) != len(that1.GroupFilters) {
+		return false
+	}
+	for i := range this.GroupFilters {
+		if !this.GroupFilters[i].Equal(that1.GroupFilters[i]) {
+			return false
+		}
+	}
 	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
 		return false
 	}
 	return true
 }
+func (this *PluginSyncFilter) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSyncFilter)
+	if !ok {
+		that2, ok := that.(PluginSyncFilter)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if that1.Include == nil {
+		if this.Include != nil {
+			return false
+		}
+	} else if this.Include == nil {
+		return false
+	} else if !this.Include.Equal(that1.Include) {
+		return false
+	}
+	if that1.Exclude == nil {
+		if this.Exclude != nil {
+			return false
+		}
+	} else if this.Exclude == nil {
+		return false
+	} else if !this.Exclude.Equal(that1.Exclude) {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginSyncFilter_Id) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSyncFilter_Id)
+	if !ok {
+		that2, ok := that.(PluginSyncFilter_Id)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Id != that1.Id {
+		return false
+	}
+	return true
+}
+func (this *PluginSyncFilter_NameRegex) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSyncFilter_NameRegex)
+	if !ok {
+		that2, ok := that.(PluginSyncFilter_NameRegex)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.NameRegex != that1.NameRegex {
+		return false
+	}
+	return true
+}
+func (this *PluginSyncFilter_ExcludeId) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSyncFilter_ExcludeId)
+	if !ok {
+		that2, ok := that.(PluginSyncFilter_ExcludeId)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.ExcludeId != that1.ExcludeId {
+		return false
+	}
+	return true
+}
+func (this *PluginSyncFilter_ExcludeNameRegex) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSyncFilter_ExcludeNameRegex)
+	if !ok {
+		that2, ok := that.(PluginSyncFilter_ExcludeNameRegex)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.ExcludeNameRegex != that1.ExcludeNameRegex {
+		return false
+	}
+	return true
+}
 func (this *PluginEntraIDAccessGraphSettings) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -26854,6 +29100,39 @@ func (this *PluginSCIMSettings) Equal(that interface{}) bool {
 	if this.DefaultRole != that1.DefaultRole {
 		return false
 	}
+	if !this.ConnectorInfo.Equal(that1.ConnectorInfo) {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginSCIMSettings_ConnectorInfo) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSCIMSettings_ConnectorInfo)
+	if !ok {
+		that2, ok := that.(PluginSCIMSettings_ConnectorInfo)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Name != that1.Name {
+		return false
+	}
+	if this.Type != that1.Type {
+		return false
+	}
 	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
 		return false
 	}
@@ -26961,6 +29240,9 @@ func (this *PluginAWSICSettings) Equal(that interface{}) bool {
 	if !this.Credentials.Equal(that1.Credentials) {
 		return false
 	}
+	if this.RolesSyncMode != that1.RolesSyncMode {
+		return false
+	}
 	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
 		return false
 	}
@@ -27520,6 +29802,225 @@ func (this *PluginNetIQSettings) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginIdSecretCredential) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginIdSecretCredential)
+	if !ok {
+		that2, ok := that.(PluginIdSecretCredential)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Id != that1.Id {
+		return false
+	}
+	if this.Secret != that1.Secret {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginCredentialsV1) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginCredentialsV1)
+	if !ok {
+		that2, ok := that.(PluginCredentialsV1)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if that1.Credentials == nil {
+		if this.Credentials != nil {
+			return false
+		}
+	} else if this.Credentials == nil {
+		return false
+	} else if !this.Credentials.Equal(that1.Credentials) {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginCredentialsV1_Oauth2AccessToken) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginCredentialsV1_Oauth2AccessToken)
+	if !ok {
+		that2, ok := that.(PluginCredentialsV1_Oauth2AccessToken)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.Oauth2AccessToken.Equal(that1.Oauth2AccessToken) {
+		return false
+	}
+	return true
+}
+func (this *PluginCredentialsV1_BearerToken) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginCredentialsV1_BearerToken)
+	if !ok {
+		that2, ok := that.(PluginCredentialsV1_BearerToken)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.BearerToken.Equal(that1.BearerToken) {
+		return false
+	}
+	return true
+}
+func (this *PluginCredentialsV1_IdSecret) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginCredentialsV1_IdSecret)
+	if !ok {
+		that2, ok := that.(PluginCredentialsV1_IdSecret)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.IdSecret.Equal(that1.IdSecret) {
+		return false
+	}
+	return true
+}
+func (this *PluginCredentialsV1_StaticCredentialsRef) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginCredentialsV1_StaticCredentialsRef)
+	if !ok {
+		that2, ok := that.(PluginCredentialsV1_StaticCredentialsRef)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.StaticCredentialsRef.Equal(that1.StaticCredentialsRef) {
+		return false
+	}
+	return true
+}
+func (this *PluginOAuth2AccessTokenCredentials) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginOAuth2AccessTokenCredentials)
+	if !ok {
+		that2, ok := that.(PluginOAuth2AccessTokenCredentials)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.AccessToken != that1.AccessToken {
+		return false
+	}
+	if this.RefreshToken != that1.RefreshToken {
+		return false
+	}
+	if !this.Expires.Equal(that1.Expires) {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginBearerTokenCredentials) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginBearerTokenCredentials)
+	if !ok {
+		that2, ok := that.(PluginBearerTokenCredentials)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Token != that1.Token {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
 func (this *PluginStaticCredentialsRef) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -27552,6 +30053,251 @@ func (this *PluginStaticCredentialsRef) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginStaticCredentialsSpecV1) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if that1.Credentials == nil {
+		if this.Credentials != nil {
+			return false
+		}
+	} else if this.Credentials == nil {
+		return false
+	} else if !this.Credentials.Equal(that1.Credentials) {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSpecV1_APIToken) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1_APIToken)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1_APIToken)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.APIToken != that1.APIToken {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSpecV1_BasicAuth) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1_BasicAuth)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1_BasicAuth)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.BasicAuth.Equal(that1.BasicAuth) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSpecV1_OAuthClientSecret) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1_OAuthClientSecret)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1_OAuthClientSecret)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.OAuthClientSecret.Equal(that1.OAuthClientSecret) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSpecV1_SSHCertAuthorities) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1_SSHCertAuthorities)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1_SSHCertAuthorities)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.SSHCertAuthorities.Equal(that1.SSHCertAuthorities) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSpecV1_PrivateKey) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSpecV1_PrivateKey)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSpecV1_PrivateKey)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !bytes.Equal(this.PrivateKey, that1.PrivateKey) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsBasicAuth) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsBasicAuth)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsBasicAuth)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.Username != that1.Username {
+		return false
+	}
+	if this.Password != that1.Password {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsOAuthClientSecret) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsOAuthClientSecret)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsOAuthClientSecret)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.ClientId != that1.ClientId {
+		return false
+	}
+	if this.ClientSecret != that1.ClientSecret {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
+func (this *PluginStaticCredentialsSSHCertAuthorities) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginStaticCredentialsSSHCertAuthorities)
+	if !ok {
+		that2, ok := that.(PluginStaticCredentialsSSHCertAuthorities)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if len(this.CertAuthorities) != len(that1.CertAuthorities) {
+		return false
+	}
+	for i := range this.CertAuthorities {
+		if !this.CertAuthorities[i].Equal(that1.CertAuthorities[i]) {
+			return false
+		}
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
 func (this *JamfSpecV1) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -27999,6 +30745,13 @@ func (m *DatabaseServerV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Scope) > 0 {
+		i -= len(m.Scope)
+		copy(dAtA[i:], m.Scope)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Scope)))
+		i--
+		dAtA[i] = 0x3a
+	}
 	{
 		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -28077,6 +30830,22 @@ func (m *DatabaseServerSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.RelayIds) > 0 {
+		for iNdEx := len(m.RelayIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RelayIds[iNdEx])
+			copy(dAtA[i:], m.RelayIds[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayIds[iNdEx])))
+			i--
+			dAtA[i] = 0x7a
+		}
+	}
+	if len(m.RelayGroup) > 0 {
+		i -= len(m.RelayGroup)
+		copy(dAtA[i:], m.RelayGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayGroup)))
+		i--
+		dAtA[i] = 0x72
+	}
 	if len(m.ProxyIDs) > 0 {
 		for iNdEx := len(m.ProxyIDs) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.ProxyIDs[iNdEx])
@@ -28519,6 +31288,21 @@ func (m *OracleOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ShuffleHostnames {
+		i--
+		if m.ShuffleHostnames {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.RetryCount != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.RetryCount))
+		i--
+		dAtA[i] = 0x10
+	}
 	if len(m.AuditUser) > 0 {
 		i -= len(m.AuditUser)
 		copy(dAtA[i:], m.AuditUser)
@@ -28626,6 +31410,18 @@ func (m *AWS) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.ElastiCacheServerless.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x8a
 	{
 		size, err := m.DocumentDB.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -29039,6 +31835,40 @@ func (m *ElastiCache) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ElastiCacheServerless) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ElastiCacheServerless) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ElastiCacheServerless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.CacheName) > 0 {
+		i -= len(m.CacheName)
+		copy(dAtA[i:], m.CacheName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.CacheName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *MemoryDB) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -29265,6 +32095,16 @@ func (m *GCPCloudSQL) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.AlloyDB.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
 	if len(m.InstanceID) > 0 {
 		i -= len(m.InstanceID)
 		copy(dAtA[i:], m.InstanceID)
@@ -29282,6 +32122,47 @@ func (m *GCPCloudSQL) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *AlloyDB) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AlloyDB) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AlloyDB) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.EndpointOverride) > 0 {
+		i -= len(m.EndpointOverride)
+		copy(dAtA[i:], m.EndpointOverride)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.EndpointOverride)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.EndpointType) > 0 {
+		i -= len(m.EndpointType)
+		copy(dAtA[i:], m.EndpointType)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.EndpointType)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *Azure) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -29707,12 +32588,12 @@ func (m *InstanceSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x32
 		}
 	}
-	n46, err46 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSeen, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSeen):])
-	if err46 != nil {
-		return 0, err46
+	n48, err48 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSeen, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSeen):])
+	if err48 != nil {
+		return 0, err48
 	}
-	i -= n46
-	i = encodeVarintTypes(dAtA, i, uint64(n46))
+	i -= n48
+	i = encodeVarintTypes(dAtA, i, uint64(n48))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.AuthID) > 0 {
@@ -29772,28 +32653,28 @@ func (m *SystemClockMeasurement) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n47, err47 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.RequestDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.RequestDuration):])
-	if err47 != nil {
-		return 0, err47
+	n49, err49 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.RequestDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.RequestDuration):])
+	if err49 != nil {
+		return 0, err49
 	}
-	i -= n47
-	i = encodeVarintTypes(dAtA, i, uint64(n47))
+	i -= n49
+	i = encodeVarintTypes(dAtA, i, uint64(n49))
 	i--
 	dAtA[i] = 0x1a
-	n48, err48 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.SystemClock, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.SystemClock):])
-	if err48 != nil {
-		return 0, err48
+	n50, err50 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.SystemClock, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.SystemClock):])
+	if err50 != nil {
+		return 0, err50
 	}
-	i -= n48
-	i = encodeVarintTypes(dAtA, i, uint64(n48))
+	i -= n50
+	i = encodeVarintTypes(dAtA, i, uint64(n50))
 	i--
 	dAtA[i] = 0x12
-	n49, err49 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ControllerSystemClock, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ControllerSystemClock):])
-	if err49 != nil {
-		return 0, err49
+	n51, err51 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ControllerSystemClock, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ControllerSystemClock):])
+	if err51 != nil {
+		return 0, err51
 	}
-	i -= n49
-	i = encodeVarintTypes(dAtA, i, uint64(n49))
+	i -= n51
+	i = encodeVarintTypes(dAtA, i, uint64(n51))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
@@ -29847,12 +32728,12 @@ func (m *InstanceControlLogEntry) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x20
 	}
-	n50, err50 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
-	if err50 != nil {
-		return 0, err50
+	n52, err52 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
+	if err52 != nil {
+		return 0, err52
 	}
-	i -= n50
-	i = encodeVarintTypes(dAtA, i, uint64(n50))
+	i -= n52
+	i = encodeVarintTypes(dAtA, i, uint64(n52))
 	i--
 	dAtA[i] = 0x1a
 	if m.ID != 0 {
@@ -30028,6 +32909,13 @@ func (m *ServerV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Scope) > 0 {
+		i -= len(m.Scope)
+		copy(dAtA[i:], m.Scope)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Scope)))
+		i--
+		dAtA[i] = 0x32
+	}
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -30096,6 +32984,40 @@ func (m *ServerSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ComponentFeatures != nil {
+		{
+			size, err := m.ComponentFeatures.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x92
+	}
+	if len(m.RelayIds) > 0 {
+		for iNdEx := len(m.RelayIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RelayIds[iNdEx])
+			copy(dAtA[i:], m.RelayIds[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayIds[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x8a
+		}
+	}
+	if len(m.RelayGroup) > 0 {
+		i -= len(m.RelayGroup)
+		copy(dAtA[i:], m.RelayGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayGroup)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x82
+	}
 	if m.GitHub != nil {
 		{
 			size, err := m.GitHub.MarshalToSizedBuffer(dAtA[:i])
@@ -30386,6 +33308,13 @@ func (m *AppServerV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Scope) > 0 {
+		i -= len(m.Scope)
+		copy(dAtA[i:], m.Scope)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Scope)))
+		i--
+		dAtA[i] = 0x32
+	}
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -30454,6 +33383,34 @@ func (m *AppServerSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ComponentFeatures != nil {
+		{
+			size, err := m.ComponentFeatures.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.RelayIds) > 0 {
+		for iNdEx := len(m.RelayIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RelayIds[iNdEx])
+			copy(dAtA[i:], m.RelayIds[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayIds[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if len(m.RelayGroup) > 0 {
+		i -= len(m.RelayGroup)
+		copy(dAtA[i:], m.RelayGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayGroup)))
+		i--
+		dAtA[i] = 0x3a
+	}
 	if len(m.ProxyIDs) > 0 {
 		for iNdEx := len(m.ProxyIDs) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.ProxyIDs[iNdEx])
@@ -30816,6 +33773,18 @@ func (m *AppSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.MCP != nil {
+		{
+			size, err := m.MCP.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x7a
+	}
 	if m.UseAnyProxyPublicAddr {
 		i--
 		if m.UseAnyProxyPublicAddr {
@@ -30971,6 +33940,56 @@ func (m *AppSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *MCP) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MCP) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCP) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.RunAsHostUser) > 0 {
+		i -= len(m.RunAsHostUser)
+		copy(dAtA[i:], m.RunAsHostUser)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RunAsHostUser)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Args) > 0 {
+		for iNdEx := len(m.Args) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Args[iNdEx])
+			copy(dAtA[i:], m.Args[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Args[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Command) > 0 {
+		i -= len(m.Command)
+		copy(dAtA[i:], m.Command)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Command)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *Rewrite) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -31314,6 +34333,13 @@ func (m *TLSKeyPair) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.CRL) > 0 {
+		i -= len(m.CRL)
+		copy(dAtA[i:], m.CRL)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.CRL)))
+		i--
+		dAtA[i] = 0x22
+	}
 	if m.KeyType != 0 {
 		i = encodeVarintTypes(dAtA, i, uint64(m.KeyType))
 		i--
@@ -31382,6 +34408,91 @@ func (m *JWTKeyPair) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *EncryptionKeyPair) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EncryptionKeyPair) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *EncryptionKeyPair) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Hash != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.Hash))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.PrivateKeyType != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.PrivateKeyType))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.PrivateKey) > 0 {
+		i -= len(m.PrivateKey)
+		copy(dAtA[i:], m.PrivateKey)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.PrivateKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AgeEncryptionKey) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AgeEncryptionKey) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AgeEncryptionKey) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CertAuthorityV2) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -31694,12 +34805,12 @@ func (m *ProvisionTokenV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x1a
 	}
-	n75, err75 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err75 != nil {
-		return 0, err75
+	n80, err80 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err80 != nil {
+		return 0, err80
 	}
-	i -= n75
-	i = encodeVarintTypes(dAtA, i, uint64(n75))
+	i -= n80
+	i = encodeVarintTypes(dAtA, i, uint64(n80))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Roles) > 0 {
@@ -31916,6 +35027,20 @@ func (m *ProvisionTokenSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.Env0 != nil {
+		{
+			size, err := m.Env0.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xaa
+	}
 	if m.AzureDevops != nil {
 		{
 			size, err := m.AzureDevops.MarshalToSizedBuffer(dAtA[:i])
@@ -32840,6 +35965,16 @@ func (m *ProvisionTokenSpecV2Spacelift) MarshalToSizedBuffer(dAtA []byte) (int,
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.EnableGlobMatching {
+		i--
+		if m.EnableGlobMatching {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
 	if len(m.Hostname) > 0 {
 		i -= len(m.Hostname)
 		copy(dAtA[i:], m.Hostname)
@@ -32943,6 +36078,18 @@ func (m *ProvisionTokenSpecV2Kubernetes) MarshalToSizedBuffer(dAtA []byte) (int,
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.OIDC != nil {
+		{
+			size, err := m.OIDC.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
 	if m.StaticJWKS != nil {
 		{
 			size, err := m.StaticJWKS.MarshalToSizedBuffer(dAtA[:i])
@@ -33013,6 +36160,50 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) MarshalToSizedBuffer(d
 	return len(dAtA) - i, nil
 }
 
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.InsecureAllowHTTPIssuer {
+		i--
+		if m.InsecureAllowHTTPIssuer {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Issuer) > 0 {
+		i -= len(m.Issuer)
+		copy(dAtA[i:], m.Issuer)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Issuer)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -33532,6 +36723,15 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) MarshalToSizedBuffer(dAtA []byte) (int
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Instances) > 0 {
+		for iNdEx := len(m.Instances) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Instances[iNdEx])
+			copy(dAtA[i:], m.Instances[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Instances[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
 	if len(m.Regions) > 0 {
 		for iNdEx := len(m.Regions) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.Regions[iNdEx])
@@ -33560,6 +36760,151 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) MarshalToSizedBuffer(dAtA []byte) (int
 	return len(dAtA) - i, nil
 }
 
+func (m *ProvisionTokenSpecV2Env0) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ProvisionTokenSpecV2Env0) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ProvisionTokenSpecV2Env0) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Allow) > 0 {
+		for iNdEx := len(m.Allow) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Allow[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ProvisionTokenSpecV2Env0_Rule) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ProvisionTokenSpecV2Env0_Rule) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ProvisionTokenSpecV2Env0_Rule) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Env0Tag) > 0 {
+		i -= len(m.Env0Tag)
+		copy(dAtA[i:], m.Env0Tag)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Env0Tag)))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if len(m.DeployerEmail) > 0 {
+		i -= len(m.DeployerEmail)
+		copy(dAtA[i:], m.DeployerEmail)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.DeployerEmail)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.DeploymentType) > 0 {
+		i -= len(m.DeploymentType)
+		copy(dAtA[i:], m.DeploymentType)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.DeploymentType)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.WorkspaceName) > 0 {
+		i -= len(m.WorkspaceName)
+		copy(dAtA[i:], m.WorkspaceName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.WorkspaceName)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.EnvironmentName) > 0 {
+		i -= len(m.EnvironmentName)
+		copy(dAtA[i:], m.EnvironmentName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.EnvironmentName)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.EnvironmentID) > 0 {
+		i -= len(m.EnvironmentID)
+		copy(dAtA[i:], m.EnvironmentID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.EnvironmentID)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.TemplateName) > 0 {
+		i -= len(m.TemplateName)
+		copy(dAtA[i:], m.TemplateName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.TemplateName)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.TemplateID) > 0 {
+		i -= len(m.TemplateID)
+		copy(dAtA[i:], m.TemplateID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.TemplateID)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.ProjectName) > 0 {
+		i -= len(m.ProjectName)
+		copy(dAtA[i:], m.ProjectName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ProjectName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ProjectID) > 0 {
+		i -= len(m.ProjectID)
+		copy(dAtA[i:], m.ProjectID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ProjectID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.OrganizationID) > 0 {
+		i -= len(m.OrganizationID)
+		copy(dAtA[i:], m.OrganizationID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.OrganizationID)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ProvisionTokenSpecV2BoundKeypair) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -33585,12 +36930,12 @@ func (m *ProvisionTokenSpecV2BoundKeypair) MarshalToSizedBuffer(dAtA []byte) (in
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.RotateAfter != nil {
-		n97, err97 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.RotateAfter, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.RotateAfter):])
-		if err97 != nil {
-			return 0, err97
+		n104, err104 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.RotateAfter, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.RotateAfter):])
+		if err104 != nil {
+			return 0, err104
 		}
-		i -= n97
-		i = encodeVarintTypes(dAtA, i, uint64(n97))
+		i -= n104
+		i = encodeVarintTypes(dAtA, i, uint64(n104))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -33646,12 +36991,12 @@ func (m *ProvisionTokenSpecV2BoundKeypair_OnboardingSpec) MarshalToSizedBuffer(d
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.MustRegisterBefore != nil {
-		n100, err100 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.MustRegisterBefore, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.MustRegisterBefore):])
-		if err100 != nil {
-			return 0, err100
+		n107, err107 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.MustRegisterBefore, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.MustRegisterBefore):])
+		if err107 != nil {
+			return 0, err107
 		}
-		i -= n100
-		i = encodeVarintTypes(dAtA, i, uint64(n100))
+		i -= n107
+		i = encodeVarintTypes(dAtA, i, uint64(n107))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -33775,22 +37120,22 @@ func (m *ProvisionTokenStatusV2BoundKeypair) MarshalToSizedBuffer(dAtA []byte) (
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.LastRotatedAt != nil {
-		n102, err102 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastRotatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastRotatedAt):])
-		if err102 != nil {
-			return 0, err102
+		n109, err109 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastRotatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastRotatedAt):])
+		if err109 != nil {
+			return 0, err109
 		}
-		i -= n102
-		i = encodeVarintTypes(dAtA, i, uint64(n102))
+		i -= n109
+		i = encodeVarintTypes(dAtA, i, uint64(n109))
 		i--
 		dAtA[i] = 0x32
 	}
 	if m.LastRecoveredAt != nil {
-		n103, err103 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastRecoveredAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastRecoveredAt):])
-		if err103 != nil {
-			return 0, err103
+		n110, err110 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastRecoveredAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastRecoveredAt):])
+		if err110 != nil {
+			return 0, err110
 		}
-		i -= n103
-		i = encodeVarintTypes(dAtA, i, uint64(n103))
+		i -= n110
+		i = encodeVarintTypes(dAtA, i, uint64(n110))
 		i--
 		dAtA[i] = 0x2a
 	}
@@ -34564,119 +37909,339 @@ func (m *SessionRecordingConfigV2) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintTypes(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x2a
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintTypes(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x22
-	if len(m.Version) > 0 {
-		i -= len(m.Version)
-		copy(dAtA[i:], m.Version)
-		i = encodeVarintTypes(dAtA, i, uint64(len(m.Version)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.SubKind) > 0 {
-		i -= len(m.SubKind)
-		copy(dAtA[i:], m.SubKind)
-		i = encodeVarintTypes(dAtA, i, uint64(len(m.SubKind)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.Kind) > 0 {
-		i -= len(m.Kind)
-		copy(dAtA[i:], m.Kind)
-		i = encodeVarintTypes(dAtA, i, uint64(len(m.Kind)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *SessionRecordingConfigSpecV2) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *SessionRecordingConfigSpecV2) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *SessionRecordingConfigSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.ProxyChecksHostKeys != nil {
+	if m.Status != nil {
 		{
-			size := m.ProxyChecksHostKeys.Size()
-			i -= size
-			if _, err := m.ProxyChecksHostKeys.MarshalTo(dAtA[i:]); err != nil {
+			size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
 				return 0, err
 			}
+			i -= size
 			i = encodeVarintTypes(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.Mode) > 0 {
-		i -= len(m.Mode)
-		copy(dAtA[i:], m.Mode)
-		i = encodeVarintTypes(dAtA, i, uint64(len(m.Mode)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *AuthPreferenceV2) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *AuthPreferenceV2) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *AuthPreferenceV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
+		dAtA[i] = 0x32
+	}
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.SubKind) > 0 {
+		i -= len(m.SubKind)
+		copy(dAtA[i:], m.SubKind)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.SubKind)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Kind) > 0 {
+		i -= len(m.Kind)
+		copy(dAtA[i:], m.Kind)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Kind)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KeyLabel) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KeyLabel) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *KeyLabel) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Label) > 0 {
+		i -= len(m.Label)
+		copy(dAtA[i:], m.Label)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Label)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ManualKeyManagementConfig) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ManualKeyManagementConfig) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ManualKeyManagementConfig) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.RotatedKeys) > 0 {
+		for iNdEx := len(m.RotatedKeys) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.RotatedKeys[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.ActiveKeys) > 0 {
+		for iNdEx := len(m.ActiveKeys) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ActiveKeys[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SessionRecordingEncryptionConfig) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SessionRecordingEncryptionConfig) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SessionRecordingEncryptionConfig) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.ManualKeyManagement != nil {
+		{
+			size, err := m.ManualKeyManagement.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SessionRecordingConfigSpecV2) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SessionRecordingConfigSpecV2) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SessionRecordingConfigSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Encryption != nil {
+		{
+			size, err := m.Encryption.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ProxyChecksHostKeys != nil {
+		{
+			size := m.ProxyChecksHostKeys.Size()
+			i -= size
+			if _, err := m.ProxyChecksHostKeys.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Mode) > 0 {
+		i -= len(m.Mode)
+		copy(dAtA[i:], m.Mode)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Mode)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SessionRecordingConfigStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SessionRecordingConfigStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SessionRecordingConfigStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.EncryptionKeys) > 0 {
+		for iNdEx := len(m.EncryptionKeys) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.EncryptionKeys[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthPreferenceV2) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthPreferenceV2) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AuthPreferenceV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
@@ -34761,20 +38326,20 @@ func (m *AuthPreferenceSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0xb2
 	}
 	if len(m.SecondFactors) > 0 {
-		dAtA123 := make([]byte, len(m.SecondFactors)*10)
-		var j122 int
+		dAtA133 := make([]byte, len(m.SecondFactors)*10)
+		var j132 int
 		for _, num := range m.SecondFactors {
 			for num >= 1<<7 {
-				dAtA123[j122] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA133[j132] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j122++
+				j132++
 			}
-			dAtA123[j122] = uint8(num)
-			j122++
+			dAtA133[j132] = uint8(num)
+			j132++
 		}
-		i -= j122
-		copy(dAtA[i:], dAtA123[:j122])
-		i = encodeVarintTypes(dAtA, i, uint64(j122))
+		i -= j132
+		copy(dAtA[i:], dAtA133[:j132])
+		i = encodeVarintTypes(dAtA, i, uint64(j132))
 		i--
 		dAtA[i] = 0x1
 		i--
@@ -35447,12 +39012,12 @@ func (m *UserTokenSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n139, err139 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err139 != nil {
-		return 0, err139
+	n149, err149 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err149 != nil {
+		return 0, err149
 	}
-	i -= n139
-	i = encodeVarintTypes(dAtA, i, uint64(n139))
+	i -= n149
+	i = encodeVarintTypes(dAtA, i, uint64(n149))
 	i--
 	dAtA[i] = 0x22
 	if m.Usage != 0 {
@@ -35569,12 +39134,12 @@ func (m *UserTokenSecretsSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n142, err142 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err142 != nil {
-		return 0, err142
+	n152, err152 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err152 != nil {
+		return 0, err152
 	}
-	i -= n142
-	i = encodeVarintTypes(dAtA, i, uint64(n142))
+	i -= n152
+	i = encodeVarintTypes(dAtA, i, uint64(n152))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.QRCode) > 0 {
@@ -35822,12 +39387,12 @@ func (m *AccessReview) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.AssumeStartTime != nil {
-		n145, err145 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
-		if err145 != nil {
-			return 0, err145
+		n155, err155 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
+		if err155 != nil {
+			return 0, err155
 		}
-		i -= n145
-		i = encodeVarintTypes(dAtA, i, uint64(n145))
+		i -= n155
+		i = encodeVarintTypes(dAtA, i, uint64(n155))
 		i--
 		dAtA[i] = 0x52
 	}
@@ -35844,20 +39409,20 @@ func (m *AccessReview) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0x4a
 	}
 	if len(m.ThresholdIndexes) > 0 {
-		dAtA148 := make([]byte, len(m.ThresholdIndexes)*10)
-		var j147 int
+		dAtA158 := make([]byte, len(m.ThresholdIndexes)*10)
+		var j157 int
 		for _, num := range m.ThresholdIndexes {
 			for num >= 1<<7 {
-				dAtA148[j147] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA158[j157] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j147++
+				j157++
 			}
-			dAtA148[j147] = uint8(num)
-			j147++
+			dAtA158[j157] = uint8(num)
+			j157++
 		}
-		i -= j147
-		copy(dAtA[i:], dAtA148[:j147])
-		i = encodeVarintTypes(dAtA, i, uint64(j147))
+		i -= j157
+		copy(dAtA[i:], dAtA158[:j157])
+		i = encodeVarintTypes(dAtA, i, uint64(j157))
 		i--
 		dAtA[i] = 0x3a
 	}
@@ -35871,12 +39436,12 @@ func (m *AccessReview) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x32
-	n150, err150 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err150 != nil {
-		return 0, err150
+	n160, err160 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err160 != nil {
+		return 0, err160
 	}
-	i -= n150
-	i = encodeVarintTypes(dAtA, i, uint64(n150))
+	i -= n160
+	i = encodeVarintTypes(dAtA, i, uint64(n160))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.Reason) > 0 {
@@ -35979,20 +39544,20 @@ func (m *ThresholdIndexSet) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if len(m.Indexes) > 0 {
-		dAtA153 := make([]byte, len(m.Indexes)*10)
-		var j152 int
+		dAtA163 := make([]byte, len(m.Indexes)*10)
+		var j162 int
 		for _, num := range m.Indexes {
 			for num >= 1<<7 {
-				dAtA153[j152] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA163[j162] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j152++
+				j162++
 			}
-			dAtA153[j152] = uint8(num)
-			j152++
+			dAtA163[j162] = uint8(num)
+			j162++
 		}
-		i -= j152
-		copy(dAtA[i:], dAtA153[:j152])
-		i = encodeVarintTypes(dAtA, i, uint64(j152))
+		i -= j162
+		copy(dAtA[i:], dAtA163[:j162])
+		i = encodeVarintTypes(dAtA, i, uint64(j162))
 		i--
 		dAtA[i] = 0xa
 	}
@@ -36064,6 +39629,27 @@ func (m *AccessRequestSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.LongTermGrouping != nil {
+		{
+			size, err := m.LongTermGrouping.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xca
+	}
+	if m.RequestKind != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.RequestKind))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xc0
+	}
 	if m.DryRunEnrichment != nil {
 		{
 			size, err := m.DryRunEnrichment.MarshalToSizedBuffer(dAtA[:i])
@@ -36079,24 +39665,24 @@ func (m *AccessRequestSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0xba
 	}
 	if m.ResourceExpiry != nil {
-		n155, err155 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ResourceExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry):])
-		if err155 != nil {
-			return 0, err155
+		n166, err166 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.ResourceExpiry, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.ResourceExpiry):])
+		if err166 != nil {
+			return 0, err166
 		}
-		i -= n155
-		i = encodeVarintTypes(dAtA, i, uint64(n155))
+		i -= n166
+		i = encodeVarintTypes(dAtA, i, uint64(n166))
 		i--
 		dAtA[i] = 0x1
 		i--
 		dAtA[i] = 0xb2
 	}
 	if m.AssumeStartTime != nil {
-		n156, err156 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
-		if err156 != nil {
-			return 0, err156
+		n167, err167 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.AssumeStartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.AssumeStartTime):])
+		if err167 != nil {
+			return 0, err167
 		}
-		i -= n156
-		i = encodeVarintTypes(dAtA, i, uint64(n156))
+		i -= n167
+		i = encodeVarintTypes(dAtA, i, uint64(n167))
 		i--
 		dAtA[i] = 0x1
 		i--
@@ -36116,22 +39702,22 @@ func (m *AccessRequestSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0xa2
 	}
-	n158, err158 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.SessionTTL, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.SessionTTL):])
-	if err158 != nil {
-		return 0, err158
+	n169, err169 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.SessionTTL, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.SessionTTL):])
+	if err169 != nil {
+		return 0, err169
 	}
-	i -= n158
-	i = encodeVarintTypes(dAtA, i, uint64(n158))
+	i -= n169
+	i = encodeVarintTypes(dAtA, i, uint64(n169))
 	i--
 	dAtA[i] = 0x1
 	i--
 	dAtA[i] = 0x92
-	n159, err159 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.MaxDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration):])
-	if err159 != nil {
-		return 0, err159
+	n170, err170 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.MaxDuration, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.MaxDuration):])
+	if err170 != nil {
+		return 0, err170
 	}
-	i -= n159
-	i = encodeVarintTypes(dAtA, i, uint64(n159))
+	i -= n170
+	i = encodeVarintTypes(dAtA, i, uint64(n170))
 	i--
 	dAtA[i] = 0x1
 	i--
@@ -36264,20 +39850,20 @@ func (m *AccessRequestSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
-	n163, err163 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err163 != nil {
-		return 0, err163
+	n174, err174 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err174 != nil {
+		return 0, err174
 	}
-	i -= n163
-	i = encodeVarintTypes(dAtA, i, uint64(n163))
+	i -= n174
+	i = encodeVarintTypes(dAtA, i, uint64(n174))
 	i--
 	dAtA[i] = 0x2a
-	n164, err164 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err164 != nil {
-		return 0, err164
+	n175, err175 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err175 != nil {
+		return 0, err175
 	}
-	i -= n164
-	i = encodeVarintTypes(dAtA, i, uint64(n164))
+	i -= n175
+	i = encodeVarintTypes(dAtA, i, uint64(n175))
 	i--
 	dAtA[i] = 0x22
 	if m.State != 0 {
@@ -36537,6 +40123,99 @@ func (m *AccessCapabilitiesRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
+func (m *RemoteAccessCapabilities) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RemoteAccessCapabilities) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RemoteAccessCapabilities) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ApplicableRolesForResources) > 0 {
+		for iNdEx := len(m.ApplicableRolesForResources) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ApplicableRolesForResources[iNdEx])
+			copy(dAtA[i:], m.ApplicableRolesForResources[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.ApplicableRolesForResources[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RemoteAccessCapabilitiesRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RemoteAccessCapabilitiesRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RemoteAccessCapabilitiesRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ResourceIDs) > 0 {
+		for iNdEx := len(m.ResourceIDs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceIDs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.SearchAsRoles) > 0 {
+		for iNdEx := len(m.SearchAsRoles) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SearchAsRoles[iNdEx])
+			copy(dAtA[i:], m.SearchAsRoles[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.SearchAsRoles[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.User) > 0 {
+		i -= len(m.User)
+		copy(dAtA[i:], m.User)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.User)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *RequestKubernetesResource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -37281,12 +40960,12 @@ func (m *RoleOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0xfa
 	}
-	n178, err178 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.MFAVerificationInterval, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.MFAVerificationInterval):])
-	if err178 != nil {
-		return 0, err178
+	n189, err189 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.MFAVerificationInterval, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.MFAVerificationInterval):])
+	if err189 != nil {
+		return 0, err189
 	}
-	i -= n178
-	i = encodeVarintTypes(dAtA, i, uint64(n178))
+	i -= n189
+	i = encodeVarintTypes(dAtA, i, uint64(n189))
 	i--
 	dAtA[i] = 0x1
 	i--
@@ -37696,6 +41375,20 @@ func (m *RoleConditions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.MCP != nil {
+		{
+			size, err := m.MCP.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xf2
+	}
 	if len(m.WorkloadIdentityLabelsExpression) > 0 {
 		i -= len(m.WorkloadIdentityLabelsExpression)
 		copy(dAtA[i:], m.WorkloadIdentityLabelsExpression)
@@ -38259,6 +41952,42 @@ func (m *GitHubPermission) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *MCPPermissions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MCPPermissions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MCPPermissions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Tools) > 0 {
+		for iNdEx := len(m.Tools) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Tools[iNdEx])
+			copy(dAtA[i:], m.Tools[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Tools[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *SPIFFERoleCondition) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -38700,6 +42429,13 @@ func (m *AccessRequestConditionsReason) MarshalToSizedBuffer(dAtA []byte) (int,
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Prompt) > 0 {
+		i -= len(m.Prompt)
+		copy(dAtA[i:], m.Prompt)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Prompt)))
+		i--
+		dAtA[i] = 0x12
+	}
 	if len(m.Mode) > 0 {
 		i -= len(m.Mode)
 		copy(dAtA[i:], m.Mode)
@@ -38851,6 +42587,122 @@ func (m *AccessRequestAllowedPromotions) MarshalToSizedBuffer(dAtA []byte) (int,
 	return len(dAtA) - i, nil
 }
 
+func (m *ResourceIDList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceIDList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceIDList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ResourceIds) > 0 {
+		for iNdEx := len(m.ResourceIds) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceIds[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LongTermResourceGrouping) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LongTermResourceGrouping) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LongTermResourceGrouping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.CanProceed {
+		i--
+		if m.CanProceed {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.ValidationMessage) > 0 {
+		i -= len(m.ValidationMessage)
+		copy(dAtA[i:], m.ValidationMessage)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ValidationMessage)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.RecommendedAccessList) > 0 {
+		i -= len(m.RecommendedAccessList)
+		copy(dAtA[i:], m.RecommendedAccessList)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RecommendedAccessList)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.AccessListToResources) > 0 {
+		for k := range m.AccessListToResources {
+			v := m.AccessListToResources[k]
+			baseI := i
+			{
+				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = encodeVarintTypes(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintTypes(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ClaimMapping) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -39125,6 +42977,16 @@ func (m *UserFilter) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.SkipSystemUsers {
+		i--
+		if m.SkipSystemUsers {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
 	if len(m.SearchKeywords) > 0 {
 		for iNdEx := len(m.SearchKeywords) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.SearchKeywords[iNdEx])
@@ -39307,12 +43169,12 @@ func (m *UserSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x42
-	n209, err209 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err209 != nil {
-		return 0, err209
+	n222, err222 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err222 != nil {
+		return 0, err222
 	}
-	i -= n209
-	i = encodeVarintTypes(dAtA, i, uint64(n209))
+	i -= n222
+	i = encodeVarintTypes(dAtA, i, uint64(n222))
 	i--
 	dAtA[i] = 0x3a
 	{
@@ -39468,20 +43330,20 @@ func (m *LoginStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n212, err212 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockExpires):])
-	if err212 != nil {
-		return 0, err212
+	n225, err225 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockExpires):])
+	if err225 != nil {
+		return 0, err225
 	}
-	i -= n212
-	i = encodeVarintTypes(dAtA, i, uint64(n212))
+	i -= n225
+	i = encodeVarintTypes(dAtA, i, uint64(n225))
 	i--
 	dAtA[i] = 0x22
-	n213, err213 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockedTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockedTime):])
-	if err213 != nil {
-		return 0, err213
+	n226, err226 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockedTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockedTime):])
+	if err226 != nil {
+		return 0, err226
 	}
-	i -= n213
-	i = encodeVarintTypes(dAtA, i, uint64(n213))
+	i -= n226
+	i = encodeVarintTypes(dAtA, i, uint64(n226))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.LockedMessage) > 0 {
@@ -39538,12 +43400,12 @@ func (m *CreatedBy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x1a
-	n215, err215 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
-	if err215 != nil {
-		return 0, err215
+	n228, err228 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
+	if err228 != nil {
+		return 0, err228
 	}
-	i -= n215
-	i = encodeVarintTypes(dAtA, i, uint64(n215))
+	i -= n228
+	i = encodeVarintTypes(dAtA, i, uint64(n228))
 	i--
 	dAtA[i] = 0x12
 	if m.Connector != nil {
@@ -39661,20 +43523,20 @@ func (m *MFADevice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			}
 		}
 	}
-	n218, err218 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUsed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUsed):])
-	if err218 != nil {
-		return 0, err218
+	n231, err231 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUsed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUsed):])
+	if err231 != nil {
+		return 0, err231
 	}
-	i -= n218
-	i = encodeVarintTypes(dAtA, i, uint64(n218))
+	i -= n231
+	i = encodeVarintTypes(dAtA, i, uint64(n231))
 	i--
 	dAtA[i] = 0x3a
-	n219, err219 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.AddedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.AddedAt):])
-	if err219 != nil {
-		return 0, err219
+	n232, err232 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.AddedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.AddedAt):])
+	if err232 != nil {
+		return 0, err232
 	}
-	i -= n219
-	i = encodeVarintTypes(dAtA, i, uint64(n219))
+	i -= n232
+	i = encodeVarintTypes(dAtA, i, uint64(n232))
 	i--
 	dAtA[i] = 0x32
 	if len(m.Id) > 0 {
@@ -40371,12 +44233,12 @@ func (m *TunnelConnectionSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x22
 	}
-	n231, err231 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
-	if err231 != nil {
-		return 0, err231
+	n244, err244 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
+	if err244 != nil {
+		return 0, err244
 	}
-	i -= n231
-	i = encodeVarintTypes(dAtA, i, uint64(n231))
+	i -= n244
+	i = encodeVarintTypes(dAtA, i, uint64(n244))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.ProxyName) > 0 {
@@ -40468,12 +44330,12 @@ func (m *AcquireSemaphoreRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x2a
 	}
-	n232, err232 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err232 != nil {
-		return 0, err232
+	n245, err245 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err245 != nil {
+		return 0, err245
 	}
-	i -= n232
-	i = encodeVarintTypes(dAtA, i, uint64(n232))
+	i -= n245
+	i = encodeVarintTypes(dAtA, i, uint64(n245))
 	i--
 	dAtA[i] = 0x22
 	if m.MaxLeases != 0 {
@@ -40522,12 +44384,12 @@ func (m *SemaphoreLease) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n233, err233 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err233 != nil {
-		return 0, err233
+	n246, err246 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err246 != nil {
+		return 0, err246
 	}
-	i -= n233
-	i = encodeVarintTypes(dAtA, i, uint64(n233))
+	i -= n246
+	i = encodeVarintTypes(dAtA, i, uint64(n246))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.LeaseID) > 0 {
@@ -40585,12 +44447,12 @@ func (m *SemaphoreLeaseRef) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x1a
 	}
-	n234, err234 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err234 != nil {
-		return 0, err234
+	n247, err247 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err247 != nil {
+		return 0, err247
 	}
-	i -= n234
-	i = encodeVarintTypes(dAtA, i, uint64(n234))
+	i -= n247
+	i = encodeVarintTypes(dAtA, i, uint64(n247))
 	i--
 	dAtA[i] = 0x12
 	if len(m.LeaseID) > 0 {
@@ -40862,28 +44724,28 @@ func (m *WebSessionSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x48
 	}
-	n241, err241 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LoginTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LoginTime):])
-	if err241 != nil {
-		return 0, err241
+	n254, err254 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LoginTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LoginTime):])
+	if err254 != nil {
+		return 0, err254
 	}
-	i -= n241
-	i = encodeVarintTypes(dAtA, i, uint64(n241))
+	i -= n254
+	i = encodeVarintTypes(dAtA, i, uint64(n254))
 	i--
 	dAtA[i] = 0x42
-	n242, err242 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err242 != nil {
-		return 0, err242
+	n255, err255 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err255 != nil {
+		return 0, err255
 	}
-	i -= n242
-	i = encodeVarintTypes(dAtA, i, uint64(n242))
+	i -= n255
+	i = encodeVarintTypes(dAtA, i, uint64(n255))
 	i--
 	dAtA[i] = 0x3a
-	n243, err243 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.BearerTokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.BearerTokenExpires):])
-	if err243 != nil {
-		return 0, err243
+	n256, err256 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.BearerTokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.BearerTokenExpires):])
+	if err256 != nil {
+		return 0, err256
 	}
-	i -= n243
-	i = encodeVarintTypes(dAtA, i, uint64(n243))
+	i -= n256
+	i = encodeVarintTypes(dAtA, i, uint64(n256))
 	i--
 	dAtA[i] = 0x32
 	if len(m.BearerToken) > 0 {
@@ -41116,20 +44978,20 @@ func (m *SAMLSessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x22
 	}
-	n244, err244 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ExpireTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ExpireTime):])
-	if err244 != nil {
-		return 0, err244
+	n257, err257 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ExpireTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ExpireTime):])
+	if err257 != nil {
+		return 0, err257
 	}
-	i -= n244
-	i = encodeVarintTypes(dAtA, i, uint64(n244))
+	i -= n257
+	i = encodeVarintTypes(dAtA, i, uint64(n257))
 	i--
 	dAtA[i] = 0x1a
-	n245, err245 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreateTime):])
-	if err245 != nil {
-		return 0, err245
+	n258, err258 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreateTime):])
+	if err258 != nil {
+		return 0, err258
 	}
-	i -= n245
-	i = encodeVarintTypes(dAtA, i, uint64(n245))
+	i -= n258
+	i = encodeVarintTypes(dAtA, i, uint64(n258))
 	i--
 	dAtA[i] = 0x12
 	if len(m.ID) > 0 {
@@ -41411,12 +45273,12 @@ func (m *RemoteClusterStatusV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n249, err249 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
-	if err249 != nil {
-		return 0, err249
+	n262, err262 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
+	if err262 != nil {
+		return 0, err262
 	}
-	i -= n249
-	i = encodeVarintTypes(dAtA, i, uint64(n249))
+	i -= n262
+	i = encodeVarintTypes(dAtA, i, uint64(n262))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Connection) > 0 {
@@ -41878,6 +45740,25 @@ func (m *KubernetesServerV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Scope) > 0 {
+		i -= len(m.Scope)
+		copy(dAtA[i:], m.Scope)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Scope)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if m.Status != nil {
+		{
+			size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -41946,6 +45827,22 @@ func (m *KubernetesServerSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.RelayIds) > 0 {
+		for iNdEx := len(m.RelayIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RelayIds[iNdEx])
+			copy(dAtA[i:], m.RelayIds[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayIds[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if len(m.RelayGroup) > 0 {
+		i -= len(m.RelayGroup)
+		copy(dAtA[i:], m.RelayGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayGroup)))
+		i--
+		dAtA[i] = 0x3a
+	}
 	if len(m.ProxyIDs) > 0 {
 		for iNdEx := len(m.ProxyIDs) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.ProxyIDs[iNdEx])
@@ -42001,6 +45898,45 @@ func (m *KubernetesServerSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	return len(dAtA) - i, nil
 }
 
+func (m *KubernetesServerStatusV3) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesServerStatusV3) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *KubernetesServerStatusV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.TargetHealth != nil {
+		{
+			size, err := m.TargetHealth.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *WebTokenV3) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -42617,6 +46553,40 @@ func (m *OIDCConnectorSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.EntraIdGroupsProvider != nil {
+		{
+			size, err := m.EntraIdGroupsProvider.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xba
+	}
+	if len(m.RequestObjectMode) > 0 {
+		i -= len(m.RequestObjectMode)
+		copy(dAtA[i:], m.RequestObjectMode)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RequestObjectMode)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xb2
+	}
+	if len(m.UserMatchers) > 0 {
+		for iNdEx := len(m.UserMatchers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UserMatchers[iNdEx])
+			copy(dAtA[i:], m.UserMatchers[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.UserMatchers[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xaa
+		}
+	}
 	if len(m.PKCEMode) > 0 {
 		i -= len(m.PKCEMode)
 		copy(dAtA[i:], m.PKCEMode)
@@ -42793,6 +46763,57 @@ func (m *OIDCConnectorSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *EntraIDGroupsProvider) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EntraIDGroupsProvider) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *EntraIDGroupsProvider) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.GraphEndpoint) > 0 {
+		i -= len(m.GraphEndpoint)
+		copy(dAtA[i:], m.GraphEndpoint)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.GraphEndpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.GroupType) > 0 {
+		i -= len(m.GroupType)
+		copy(dAtA[i:], m.GroupType)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.GroupType)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Disabled {
+		i--
+		if m.Disabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *MaxAge) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -42894,6 +46915,13 @@ func (m *OIDCConnectorMFASettings) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.RequestObjectMode) > 0 {
+		i -= len(m.RequestObjectMode)
+		copy(dAtA[i:], m.RequestObjectMode)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RequestObjectMode)))
+		i--
+		dAtA[i] = 0x3a
+	}
 	if m.MaxAge != 0 {
 		i = encodeVarintTypes(dAtA, i, uint64(m.MaxAge))
 		i--
@@ -42964,6 +46992,15 @@ func (m *OIDCAuthRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.LoginHint) > 0 {
+		i -= len(m.LoginHint)
+		copy(dAtA[i:], m.LoginHint)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.LoginHint)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xca
+	}
 	if len(m.PkceVerifier) > 0 {
 		i -= len(m.PkceVerifier)
 		copy(dAtA[i:], m.PkceVerifier)
@@ -43292,6 +47329,29 @@ func (m *SAMLConnectorSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.IncludeSubject {
+		i--
+		if m.IncludeSubject {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa8
+	}
+	if len(m.UserMatchers) > 0 {
+		for iNdEx := len(m.UserMatchers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UserMatchers[iNdEx])
+			copy(dAtA[i:], m.UserMatchers[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.UserMatchers[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xa2
+		}
+	}
 	if len(m.PreferredRequestBinding) > 0 {
 		i -= len(m.PreferredRequestBinding)
 		copy(dAtA[i:], m.PreferredRequestBinding)
@@ -43565,6 +47625,15 @@ func (m *SAMLAuthRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.SubjectIdentifier) > 0 {
+		i -= len(m.SubjectIdentifier)
+		copy(dAtA[i:], m.SubjectIdentifier)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.SubjectIdentifier)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xca
+	}
 	if len(m.ClientVersion) > 0 {
 		i -= len(m.ClientVersion)
 		copy(dAtA[i:], m.ClientVersion)
@@ -43984,6 +48053,15 @@ func (m *GithubConnectorSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.UserMatchers) > 0 {
+		for iNdEx := len(m.UserMatchers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UserMatchers[iNdEx])
+			copy(dAtA[i:], m.UserMatchers[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.UserMatchers[iNdEx])))
+			i--
+			dAtA[i] = 0x52
+		}
+	}
 	if m.ClientRedirectSettings != nil {
 		{
 			size, err := m.ClientRedirectSettings.MarshalToSizedBuffer(dAtA[:i])
@@ -44203,12 +48281,12 @@ func (m *GithubAuthRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0x62
 	}
 	if m.Expires != nil {
-		n287, err287 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err287 != nil {
-			return 0, err287
+		n303, err303 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err303 != nil {
+			return 0, err303
 		}
-		i -= n287
-		i = encodeVarintTypes(dAtA, i, uint64(n287))
+		i -= n303
+		i = encodeVarintTypes(dAtA, i, uint64(n303))
 		i--
 		dAtA[i] = 0x5a
 	}
@@ -45220,21 +49298,21 @@ func (m *LockSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x2a
 	}
-	n305, err305 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreatedAt):])
-	if err305 != nil {
-		return 0, err305
+	n321, err321 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreatedAt):])
+	if err321 != nil {
+		return 0, err321
 	}
-	i -= n305
-	i = encodeVarintTypes(dAtA, i, uint64(n305))
+	i -= n321
+	i = encodeVarintTypes(dAtA, i, uint64(n321))
 	i--
 	dAtA[i] = 0x22
 	if m.Expires != nil {
-		n306, err306 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err306 != nil {
-			return 0, err306
+		n322, err322 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err322 != nil {
+			return 0, err322
 		}
-		i -= n306
-		i = encodeVarintTypes(dAtA, i, uint64(n306))
+		i -= n322
+		i = encodeVarintTypes(dAtA, i, uint64(n322))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -45282,6 +49360,20 @@ func (m *LockTarget) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.JoinToken) > 0 {
+		i -= len(m.JoinToken)
+		copy(dAtA[i:], m.JoinToken)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.JoinToken)))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if len(m.BotInstanceID) > 0 {
+		i -= len(m.BotInstanceID)
+		copy(dAtA[i:], m.BotInstanceID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.BotInstanceID)))
+		i--
+		dAtA[i] = 0x52
+	}
 	if len(m.ServerID) > 0 {
 		i -= len(m.ServerID)
 		copy(dAtA[i:], m.ServerID)
@@ -45341,6 +49433,57 @@ func (m *LockTarget) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *LockFilter) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LockFilter) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LockFilter) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.InForceOnly {
+		i--
+		if m.InForceOnly {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Targets) > 0 {
+		for iNdEx := len(m.Targets) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Targets[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *AddressCondition) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -45569,6 +49712,22 @@ func (m *WindowsDesktopServiceSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.RelayIds) > 0 {
+		for iNdEx := len(m.RelayIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.RelayIds[iNdEx])
+			copy(dAtA[i:], m.RelayIds[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayIds[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.RelayGroup) > 0 {
+		i -= len(m.RelayGroup)
+		copy(dAtA[i:], m.RelayGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RelayGroup)))
+		i--
+		dAtA[i] = 0x2a
+	}
 	if len(m.ProxyIDs) > 0 {
 		for iNdEx := len(m.ProxyIDs) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.ProxyIDs[iNdEx])
@@ -45951,12 +50110,12 @@ func (m *RegisterUsingTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		dAtA[i] = 0x6a
 	}
 	if m.Expires != nil {
-		n318, err318 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err318 != nil {
-			return 0, err318
+		n334, err334 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err334 != nil {
+			return 0, err334
 		}
-		i -= n318
-		i = encodeVarintTypes(dAtA, i, uint64(n318))
+		i -= n334
+		i = encodeVarintTypes(dAtA, i, uint64(n334))
 		i--
 		dAtA[i] = 0x62
 	}
@@ -46136,12 +50295,12 @@ func (m *RecoveryCodesSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n321, err321 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err321 != nil {
-		return 0, err321
+	n337, err337 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err337 != nil {
+		return 0, err337
 	}
-	i -= n321
-	i = encodeVarintTypes(dAtA, i, uint64(n321))
+	i -= n337
+	i = encodeVarintTypes(dAtA, i, uint64(n337))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Codes) > 0 {
@@ -46521,20 +50680,20 @@ func (m *SessionTrackerSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
-	n325, err325 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err325 != nil {
-		return 0, err325
+	n341, err341 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err341 != nil {
+		return 0, err341
 	}
-	i -= n325
-	i = encodeVarintTypes(dAtA, i, uint64(n325))
+	i -= n341
+	i = encodeVarintTypes(dAtA, i, uint64(n341))
 	i--
 	dAtA[i] = 0x2a
-	n326, err326 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err326 != nil {
-		return 0, err326
+	n342, err342 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err342 != nil {
+		return 0, err342
 	}
-	i -= n326
-	i = encodeVarintTypes(dAtA, i, uint64(n326))
+	i -= n342
+	i = encodeVarintTypes(dAtA, i, uint64(n342))
 	i--
 	dAtA[i] = 0x22
 	if m.State != 0 {
@@ -46638,12 +50797,19 @@ func (m *Participant) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n327, err327 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastActive, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastActive):])
-	if err327 != nil {
-		return 0, err327
+	if len(m.Cluster) > 0 {
+		i -= len(m.Cluster)
+		copy(dAtA[i:], m.Cluster)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Cluster)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	n343, err343 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastActive, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastActive):])
+	if err343 != nil {
+		return 0, err343
 	}
-	i -= n327
-	i = encodeVarintTypes(dAtA, i, uint64(n327))
+	i -= n343
+	i = encodeVarintTypes(dAtA, i, uint64(n343))
 	i--
 	dAtA[i] = 0x22
 	if len(m.Mode) > 0 {
@@ -47355,12 +51521,12 @@ func (m *ClusterAlertSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n340, err340 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err340 != nil {
-		return 0, err340
+	n356, err356 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err356 != nil {
+		return 0, err356
 	}
-	i -= n340
-	i = encodeVarintTypes(dAtA, i, uint64(n340))
+	i -= n356
+	i = encodeVarintTypes(dAtA, i, uint64(n356))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.Message) > 0 {
@@ -47490,12 +51656,12 @@ func (m *AlertAcknowledgement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n341, err341 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err341 != nil {
-		return 0, err341
+	n357, err357 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err357 != nil {
+		return 0, err357
 	}
-	i -= n341
-	i = encodeVarintTypes(dAtA, i, uint64(n341))
+	i -= n357
+	i = encodeVarintTypes(dAtA, i, uint64(n357))
 	i--
 	dAtA[i] = 0x22
 	if len(m.Reason) > 0 {
@@ -48223,6 +52389,29 @@ func (m *PluginSpecV1_Github) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	return len(dAtA) - i, nil
 }
+func (m *PluginSpecV1_Intune) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSpecV1_Intune) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Intune != nil {
+		{
+			size, err := m.Intune.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xaa
+	}
+	return len(dAtA) - i, nil
+}
 func (m *PluginGithubSettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -48247,12 +52436,12 @@ func (m *PluginGithubSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n365, err365 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
-	if err365 != nil {
-		return 0, err365
+	n382, err382 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	if err382 != nil {
+		return 0, err382
 	}
-	i -= n365
-	i = encodeVarintTypes(dAtA, i, uint64(n365))
+	i -= n382
+	i = encodeVarintTypes(dAtA, i, uint64(n382))
 	i--
 	dAtA[i] = 0x22
 	if len(m.OrganizationName) > 0 {
@@ -48671,6 +52860,54 @@ func (m *PluginJamfSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *PluginIntuneSettings) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginIntuneSettings) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginIntuneSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.GraphEndpoint) > 0 {
+		i -= len(m.GraphEndpoint)
+		copy(dAtA[i:], m.GraphEndpoint)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.GraphEndpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.LoginEndpoint) > 0 {
+		i -= len(m.LoginEndpoint)
+		copy(dAtA[i:], m.LoginEndpoint)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.LoginEndpoint)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Tenant) > 0 {
+		i -= len(m.Tenant)
+		copy(dAtA[i:], m.Tenant)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Tenant)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *PluginOktaSettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -48827,6 +53064,13 @@ func (m *PluginOktaSyncSettings) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.TimeBetweenImports) > 0 {
+		i -= len(m.TimeBetweenImports)
+		copy(dAtA[i:], m.TimeBetweenImports)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.TimeBetweenImports)))
+		i--
+		dAtA[i] = 0x72
+	}
 	if m.DisableAssignDefaultRoles {
 		i--
 		if m.DisableAssignDefaultRoles {
@@ -49109,6 +53353,20 @@ func (m *PluginEntraIDSyncSettings) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.GroupFilters) > 0 {
+		for iNdEx := len(m.GroupFilters) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.GroupFilters[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintTypes(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x32
+		}
+	}
 	if len(m.EntraAppId) > 0 {
 		i -= len(m.EntraAppId)
 		copy(dAtA[i:], m.EntraAppId)
@@ -49147,6 +53405,107 @@ func (m *PluginEntraIDSyncSettings) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
+func (m *PluginSyncFilter) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginSyncFilter) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSyncFilter) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Exclude != nil {
+		{
+			size := m.Exclude.Size()
+			i -= size
+			if _, err := m.Exclude.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	if m.Include != nil {
+		{
+			size := m.Include.Size()
+			i -= size
+			if _, err := m.Include.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PluginSyncFilter_Id) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSyncFilter_Id) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.Id)
+	copy(dAtA[i:], m.Id)
+	i = encodeVarintTypes(dAtA, i, uint64(len(m.Id)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+func (m *PluginSyncFilter_NameRegex) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSyncFilter_NameRegex) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.NameRegex)
+	copy(dAtA[i:], m.NameRegex)
+	i = encodeVarintTypes(dAtA, i, uint64(len(m.NameRegex)))
+	i--
+	dAtA[i] = 0x12
+	return len(dAtA) - i, nil
+}
+func (m *PluginSyncFilter_ExcludeId) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSyncFilter_ExcludeId) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.ExcludeId)
+	copy(dAtA[i:], m.ExcludeId)
+	i = encodeVarintTypes(dAtA, i, uint64(len(m.ExcludeId)))
+	i--
+	dAtA[i] = 0x1a
+	return len(dAtA) - i, nil
+}
+func (m *PluginSyncFilter_ExcludeNameRegex) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSyncFilter_ExcludeNameRegex) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.ExcludeNameRegex)
+	copy(dAtA[i:], m.ExcludeNameRegex)
+	i = encodeVarintTypes(dAtA, i, uint64(len(m.ExcludeNameRegex)))
+	i--
+	dAtA[i] = 0x22
+	return len(dAtA) - i, nil
+}
 func (m *PluginEntraIDAccessGraphSettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -49253,6 +53612,18 @@ func (m *PluginSCIMSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.ConnectorInfo != nil {
+		{
+			size, err := m.ConnectorInfo.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
 	if len(m.DefaultRole) > 0 {
 		i -= len(m.DefaultRole)
 		copy(dAtA[i:], m.DefaultRole)
@@ -49270,6 +53641,47 @@ func (m *PluginSCIMSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *PluginSCIMSettings_ConnectorInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginSCIMSettings_ConnectorInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSCIMSettings_ConnectorInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *PluginDatadogAccessSettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -49335,6 +53747,13 @@ func (m *PluginAWSICSettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.RolesSyncMode) > 0 {
+		i -= len(m.RolesSyncMode)
+		copy(dAtA[i:], m.RolesSyncMode)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RolesSyncMode)))
+		i--
+		dAtA[i] = 0x62
+	}
 	if m.Credentials != nil {
 		{
 			size, err := m.Credentials.MarshalToSizedBuffer(dAtA[:i])
@@ -50364,12 +54783,12 @@ func (m *PluginStatusV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
-	n382, err382 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSyncTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSyncTime):])
-	if err382 != nil {
-		return 0, err382
+	n400, err400 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSyncTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSyncTime):])
+	if err400 != nil {
+		return 0, err400
 	}
-	i -= n382
-	i = encodeVarintTypes(dAtA, i, uint64(n382))
+	i -= n400
+	i = encodeVarintTypes(dAtA, i, uint64(n400))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.ErrorMessage) > 0 {
@@ -50642,6 +55061,18 @@ func (m *PluginOktaStatusV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.SystemLogExportDetails != nil {
+		{
+			size, err := m.SystemLogExportDetails.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
 	if m.AccessListsSyncDetails != nil {
 		{
 			size, err := m.AccessListsSyncDetails.MarshalToSizedBuffer(dAtA[:i])
@@ -50807,22 +55238,22 @@ func (m *PluginOktaStatusDetailsAppGroupSync) MarshalToSizedBuffer(dAtA []byte)
 		dAtA[i] = 0x28
 	}
 	if m.LastFailed != nil {
-		n393, err393 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
-		if err393 != nil {
-			return 0, err393
+		n412, err412 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
+		if err412 != nil {
+			return 0, err412
 		}
-		i -= n393
-		i = encodeVarintTypes(dAtA, i, uint64(n393))
+		i -= n412
+		i = encodeVarintTypes(dAtA, i, uint64(n412))
 		i--
 		dAtA[i] = 0x22
 	}
 	if m.LastSuccessful != nil {
-		n394, err394 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
-		if err394 != nil {
-			return 0, err394
+		n413, err413 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
+		if err413 != nil {
+			return 0, err413
 		}
-		i -= n394
-		i = encodeVarintTypes(dAtA, i, uint64(n394))
+		i -= n413
+		i = encodeVarintTypes(dAtA, i, uint64(n413))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -50881,22 +55312,22 @@ func (m *PluginOktaStatusDetailsUsersSync) MarshalToSizedBuffer(dAtA []byte) (in
 		dAtA[i] = 0x28
 	}
 	if m.LastFailed != nil {
-		n395, err395 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
-		if err395 != nil {
-			return 0, err395
+		n414, err414 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
+		if err414 != nil {
+			return 0, err414
 		}
-		i -= n395
-		i = encodeVarintTypes(dAtA, i, uint64(n395))
+		i -= n414
+		i = encodeVarintTypes(dAtA, i, uint64(n414))
 		i--
 		dAtA[i] = 0x22
 	}
 	if m.LastSuccessful != nil {
-		n396, err396 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
-		if err396 != nil {
-			return 0, err396
+		n415, err415 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
+		if err415 != nil {
+			return 0, err415
 		}
-		i -= n396
-		i = encodeVarintTypes(dAtA, i, uint64(n396))
+		i -= n415
+		i = encodeVarintTypes(dAtA, i, uint64(n415))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -51015,22 +55446,91 @@ func (m *PluginOktaStatusDetailsAccessListsSync) MarshalToSizedBuffer(dAtA []byt
 		}
 	}
 	if m.LastFailed != nil {
-		n397, err397 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
-		if err397 != nil {
-			return 0, err397
+		n416, err416 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
+		if err416 != nil {
+			return 0, err416
+		}
+		i -= n416
+		i = encodeVarintTypes(dAtA, i, uint64(n416))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.LastSuccessful != nil {
+		n417, err417 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
+		if err417 != nil {
+			return 0, err417
+		}
+		i -= n417
+		i = encodeVarintTypes(dAtA, i, uint64(n417))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.StatusCode != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.StatusCode))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PluginOktaStatusSystemLogExporter) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginOktaStatusSystemLogExporter) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginOktaStatusSystemLogExporter) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.LastFailed != nil {
+		n418, err418 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastFailed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed):])
+		if err418 != nil {
+			return 0, err418
 		}
-		i -= n397
-		i = encodeVarintTypes(dAtA, i, uint64(n397))
+		i -= n418
+		i = encodeVarintTypes(dAtA, i, uint64(n418))
 		i--
 		dAtA[i] = 0x22
 	}
 	if m.LastSuccessful != nil {
-		n398, err398 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
-		if err398 != nil {
-			return 0, err398
+		n419, err419 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.LastSuccessful, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful):])
+		if err419 != nil {
+			return 0, err419
 		}
-		i -= n398
-		i = encodeVarintTypes(dAtA, i, uint64(n398))
+		i -= n419
+		i = encodeVarintTypes(dAtA, i, uint64(n419))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -51196,12 +55696,12 @@ func (m *PluginOAuth2AccessTokenCredentials) MarshalToSizedBuffer(dAtA []byte) (
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n403, err403 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err403 != nil {
-		return 0, err403
+	n424, err424 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err424 != nil {
+		return 0, err424
 	}
-	i -= n403
-	i = encodeVarintTypes(dAtA, i, uint64(n403))
+	i -= n424
+	i = encodeVarintTypes(dAtA, i, uint64(n424))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.RefreshToken) > 0 {
@@ -52159,20 +56659,20 @@ func (m *ScheduledAgentUpgradeWindow) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n418, err418 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Stop, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Stop):])
-	if err418 != nil {
-		return 0, err418
+	n439, err439 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Stop, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Stop):])
+	if err439 != nil {
+		return 0, err439
 	}
-	i -= n418
-	i = encodeVarintTypes(dAtA, i, uint64(n418))
+	i -= n439
+	i = encodeVarintTypes(dAtA, i, uint64(n439))
 	i--
 	dAtA[i] = 0x12
-	n419, err419 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Start, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Start):])
-	if err419 != nil {
-		return 0, err419
+	n440, err440 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Start, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Start):])
+	if err440 != nil {
+		return 0, err440
 	}
-	i -= n419
-	i = encodeVarintTypes(dAtA, i, uint64(n419))
+	i -= n440
+	i = encodeVarintTypes(dAtA, i, uint64(n440))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
@@ -52599,12 +57099,12 @@ func (m *OktaAssignmentSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x30
 	}
-	n426, err426 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastTransition, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastTransition):])
-	if err426 != nil {
-		return 0, err426
+	n447, err447 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastTransition, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastTransition):])
+	if err447 != nil {
+		return 0, err447
 	}
-	i -= n426
-	i = encodeVarintTypes(dAtA, i, uint64(n426))
+	i -= n447
+	i = encodeVarintTypes(dAtA, i, uint64(n447))
 	i--
 	dAtA[i] = 0x2a
 	if m.Status != 0 {
@@ -52612,12 +57112,12 @@ func (m *OktaAssignmentSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x20
 	}
-	n427, err427 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CleanupTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CleanupTime):])
-	if err427 != nil {
-		return 0, err427
+	n448, err448 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CleanupTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CleanupTime):])
+	if err448 != nil {
+		return 0, err448
 	}
-	i -= n427
-	i = encodeVarintTypes(dAtA, i, uint64(n427))
+	i -= n448
+	i = encodeVarintTypes(dAtA, i, uint64(n448))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.Targets) > 0 {
@@ -52707,6 +57207,16 @@ func (m *IntegrationV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -52862,6 +57372,45 @@ func (m *IntegrationSpecV1_AWSRA) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	}
 	return len(dAtA) - i, nil
 }
+func (m *IntegrationStatusV1) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *IntegrationStatusV1) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *IntegrationStatusV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.AWSRolesAnywhere != nil {
+		{
+			size, err := m.AWSRolesAnywhere.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *AWSOIDCIntegrationSpecV1) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -53055,6 +57604,15 @@ func (m *AWSRolesAnywhereProfileSyncConfig) MarshalToSizedBuffer(dAtA []byte) (i
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.ProfileNameFilters) > 0 {
+		for iNdEx := len(m.ProfileNameFilters) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ProfileNameFilters[iNdEx])
+			copy(dAtA[i:], m.ProfileNameFilters[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.ProfileNameFilters[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
 	if len(m.RoleARN) > 0 {
 		i -= len(m.RoleARN)
 		copy(dAtA[i:], m.RoleARN)
@@ -53092,6 +57650,107 @@ func (m *AWSRolesAnywhereProfileSyncConfig) MarshalToSizedBuffer(dAtA []byte) (i
 	return len(dAtA) - i, nil
 }
 
+func (m *AWSRAIntegrationStatusV1) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSRAIntegrationStatusV1) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSRAIntegrationStatusV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.LastProfileSync != nil {
+		{
+			size, err := m.LastProfileSync.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.SyncedProfiles != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.SyncedProfiles))
+		i--
+		dAtA[i] = 0x28
+	}
+	if len(m.ErrorMessage) > 0 {
+		i -= len(m.ErrorMessage)
+		copy(dAtA[i:], m.ErrorMessage)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ErrorMessage)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Status) > 0 {
+		i -= len(m.Status)
+		copy(dAtA[i:], m.Status)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Status)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	n460, err460 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime):])
+	if err460 != nil {
+		return 0, err460
+	}
+	i -= n460
+	i = encodeVarintTypes(dAtA, i, uint64(n460))
+	i--
+	dAtA[i] = 0x12
+	n461, err461 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime):])
+	if err461 != nil {
+		return 0, err461
+	}
+	i -= n461
+	i = encodeVarintTypes(dAtA, i, uint64(n461))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *HeadlessAuthentication) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -53668,6 +58327,18 @@ func (m *AWSMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.Organization != nil {
+		{
+			size, err := m.Organization.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x52
+	}
 	if len(m.SetupAccessForARN) > 0 {
 		i -= len(m.SetupAccessForARN)
 		copy(dAtA[i:], m.SetupAccessForARN)
@@ -53759,6 +58430,97 @@ func (m *AWSMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *AWSOrganizationMatcher) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSOrganizationMatcher) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSOrganizationMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.OrganizationalUnits != nil {
+		{
+			size, err := m.OrganizationalUnits.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.OrganizationID) > 0 {
+		i -= len(m.OrganizationID)
+		copy(dAtA[i:], m.OrganizationID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.OrganizationID)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AWSOrganizationUnitsMatcher) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSOrganizationUnitsMatcher) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSOrganizationUnitsMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Exclude) > 0 {
+		for iNdEx := len(m.Exclude) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Exclude[iNdEx])
+			copy(dAtA[i:], m.Exclude[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Exclude[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Include) > 0 {
+		for iNdEx := len(m.Include) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Include[iNdEx])
+			copy(dAtA[i:], m.Include[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Include[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *AssumeRole) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -53824,6 +58586,32 @@ func (m *InstallerParams) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.HTTPProxySettings != nil {
+		{
+			size, err := m.HTTPProxySettings.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x5a
+	}
+	if len(m.UpdateGroup) > 0 {
+		i -= len(m.UpdateGroup)
+		copy(dAtA[i:], m.UpdateGroup)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.UpdateGroup)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.Suffix) > 0 {
+		i -= len(m.Suffix)
+		copy(dAtA[i:], m.Suffix)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Suffix)))
+		i--
+		dAtA[i] = 0x4a
+	}
 	if m.EnrollMode != 0 {
 		i = encodeVarintTypes(dAtA, i, uint64(m.EnrollMode))
 		i--
@@ -53889,6 +58677,54 @@ func (m *InstallerParams) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *HTTPProxySettings) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *HTTPProxySettings) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *HTTPProxySettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.NoProxy) > 0 {
+		i -= len(m.NoProxy)
+		copy(dAtA[i:], m.NoProxy)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.NoProxy)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.HTTPSProxy) > 0 {
+		i -= len(m.HTTPSProxy)
+		copy(dAtA[i:], m.HTTPSProxy)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.HTTPSProxy)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.HTTPProxy) > 0 {
+		i -= len(m.HTTPProxy)
+		copy(dAtA[i:], m.HTTPProxy)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.HTTPProxy)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *AWSSSM) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -53981,6 +58817,13 @@ func (m *AzureMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Integration) > 0 {
+		i -= len(m.Integration)
+		copy(dAtA[i:], m.Integration)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Integration)))
+		i--
+		dAtA[i] = 0x3a
+	}
 	if m.Params != nil {
 		{
 			size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
@@ -54262,12 +59105,12 @@ func (m *AccessGraphSync) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x1a
 		}
 	}
-	n454, err454 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.PollInterval, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.PollInterval):])
-	if err454 != nil {
-		return 0, err454
+	n483, err483 := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.PollInterval, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdDuration(m.PollInterval):])
+	if err483 != nil {
+		return 0, err483
 	}
-	i -= n454
-	i = encodeVarintTypes(dAtA, i, uint64(n454))
+	i -= n483
+	i = encodeVarintTypes(dAtA, i, uint64(n483))
 	i--
 	dAtA[i] = 0x12
 	if len(m.AWS) > 0 {
@@ -54328,6 +59171,43 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) MarshalToSizedBuffer(dAtA []byte) (in
 	return len(dAtA) - i, nil
 }
 
+func (m *AccessGraphAWSSyncEKSAuditLogs) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessGraphAWSSyncEKSAuditLogs) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AccessGraphAWSSyncEKSAuditLogs) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	{
+		size := m.Tags.Size()
+		i -= size
+		if _, err := m.Tags.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *AccessGraphAWSSync) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -54352,6 +59232,18 @@ func (m *AccessGraphAWSSync) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.EksAuditLogs != nil {
+		{
+			size, err := m.EksAuditLogs.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
 	if m.CloudTrailLogs != nil {
 		{
 			size, err := m.CloudTrailLogs.MarshalToSizedBuffer(dAtA[:i])
@@ -54482,12 +59374,12 @@ func (m *TargetHealth) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0x2a
 	}
 	if m.TransitionTimestamp != nil {
-		n457, err457 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.TransitionTimestamp, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.TransitionTimestamp):])
-		if err457 != nil {
-			return 0, err457
+		n488, err488 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.TransitionTimestamp, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.TransitionTimestamp):])
+		if err488 != nil {
+			return 0, err488
 		}
-		i -= n457
-		i = encodeVarintTypes(dAtA, i, uint64(n457))
+		i -= n488
+		i = encodeVarintTypes(dAtA, i, uint64(n488))
 		i--
 		dAtA[i] = 0x22
 	}
@@ -54700,6 +59592,10 @@ func (m *DatabaseServerV3) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Status.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	l = len(m.Scope)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -54736,6 +59632,16 @@ func (m *DatabaseServerSpecV3) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	l = len(m.RelayGroup)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.RelayIds) > 0 {
+		for _, s := range m.RelayIds {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -54889,6 +59795,12 @@ func (m *OracleOptions) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.RetryCount != 0 {
+		n += 1 + sovTypes(uint64(m.RetryCount))
+	}
+	if m.ShuffleHostnames {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -54974,6 +59886,8 @@ func (m *AWS) Size() (n int) {
 	}
 	l = m.DocumentDB.Size()
 	n += 2 + l + sovTypes(uint64(l))
+	l = m.ElastiCacheServerless.Size()
+	n += 2 + l + sovTypes(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55112,6 +60026,22 @@ func (m *ElastiCache) Size() (n int) {
 	return n
 }
 
+func (m *ElastiCacheServerless) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.CacheName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *MemoryDB) Size() (n int) {
 	if m == nil {
 		return 0
@@ -55225,6 +60155,28 @@ func (m *GCPCloudSQL) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = m.AlloyDB.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AlloyDB) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.EndpointType)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.EndpointOverride)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55584,6 +60536,10 @@ func (m *ServerV2) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	l = len(m.Scope)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55646,6 +60602,20 @@ func (m *ServerSpecV2) Size() (n int) {
 		l = m.GitHub.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.RelayGroup)
+	if l > 0 {
+		n += 2 + l + sovTypes(uint64(l))
+	}
+	if len(m.RelayIds) > 0 {
+		for _, s := range m.RelayIds {
+			l = len(s)
+			n += 2 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.ComponentFeatures != nil {
+		l = m.ComponentFeatures.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55746,6 +60716,10 @@ func (m *AppServerV3) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	l = len(m.Scope)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55782,6 +60756,20 @@ func (m *AppServerSpecV3) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	l = len(m.RelayGroup)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.RelayIds) > 0 {
+		for _, s := range m.RelayIds {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.ComponentFeatures != nil {
+		l = m.ComponentFeatures.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55993,6 +60981,36 @@ func (m *AppSpecV3) Size() (n int) {
 	if m.UseAnyProxyPublicAddr {
 		n += 2
 	}
+	if m.MCP != nil {
+		l = m.MCP.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *MCP) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Command)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.Args) > 0 {
+		for _, s := range m.Args {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	l = len(m.RunAsHostUser)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -56169,6 +61187,10 @@ func (m *TLSKeyPair) Size() (n int) {
 	if m.KeyType != 0 {
 		n += 1 + sovTypes(uint64(m.KeyType))
 	}
+	l = len(m.CRL)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -56198,6 +61220,48 @@ func (m *JWTKeyPair) Size() (n int) {
 	return n
 }
 
+func (m *EncryptionKeyPair) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.PrivateKey)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.PrivateKeyType != 0 {
+		n += 1 + sovTypes(uint64(m.PrivateKeyType))
+	}
+	if m.Hash != 0 {
+		n += 1 + sovTypes(uint64(m.Hash))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AgeEncryptionKey) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *CertAuthorityV2) Size() (n int) {
 	if m == nil {
 		return 0
@@ -56510,6 +61574,10 @@ func (m *ProvisionTokenSpecV2) Size() (n int) {
 		l = m.AzureDevops.Size()
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if m.Env0 != nil {
+		l = m.Env0.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -56864,6 +61932,9 @@ func (m *ProvisionTokenSpecV2Spacelift) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.EnableGlobMatching {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -56918,6 +61989,10 @@ func (m *ProvisionTokenSpecV2Kubernetes) Size() (n int) {
 		l = m.StaticJWKS.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.OIDC != nil {
+		l = m.OIDC.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -56940,6 +62015,25 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Size() (n int) {
 	return n
 }
 
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Issuer)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.InsecureAllowHTTPIssuer {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) Size() (n int) {
 	if m == nil {
 		return 0
@@ -57204,6 +62298,86 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	if len(m.Instances) > 0 {
+		for _, s := range m.Instances {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ProvisionTokenSpecV2Env0) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Allow) > 0 {
+		for _, e := range m.Allow {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ProvisionTokenSpecV2Env0_Rule) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.OrganizationID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ProjectID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ProjectName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.TemplateID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.TemplateName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.EnvironmentID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.EnvironmentName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.WorkspaceName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.DeploymentType)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.DeployerEmail)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Env0Tag)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -57675,6 +62849,76 @@ func (m *SessionRecordingConfigV2) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	if m.Status != nil {
+		l = m.Status.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *KeyLabel) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Label)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ManualKeyManagementConfig) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	if len(m.ActiveKeys) > 0 {
+		for _, e := range m.ActiveKeys {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.RotatedKeys) > 0 {
+		for _, e := range m.RotatedKeys {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SessionRecordingEncryptionConfig) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	if m.ManualKeyManagement != nil {
+		l = m.ManualKeyManagement.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -57695,6 +62939,28 @@ func (m *SessionRecordingConfigSpecV2) Size() (n int) {
 		l = m.ProxyChecksHostKeys.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.Encryption != nil {
+		l = m.Encryption.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *SessionRecordingConfigStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.EncryptionKeys) > 0 {
+		for _, e := range m.EncryptionKeys {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -58402,6 +63668,13 @@ func (m *AccessRequestSpecV3) Size() (n int) {
 		l = m.DryRunEnrichment.Size()
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if m.RequestKind != 0 {
+		n += 2 + sovTypes(uint64(m.RequestKind))
+	}
+	if m.LongTermGrouping != nil {
+		l = m.LongTermGrouping.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -58519,6 +63792,52 @@ func (m *AccessCapabilitiesRequest) Size() (n int) {
 	return n
 }
 
+func (m *RemoteAccessCapabilities) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.ApplicableRolesForResources) > 0 {
+		for _, s := range m.ApplicableRolesForResources {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RemoteAccessCapabilitiesRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.User)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.SearchAsRoles) > 0 {
+		for _, s := range m.SearchAsRoles {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.ResourceIDs) > 0 {
+		for _, e := range m.ResourceIDs {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *RequestKubernetesResource) Size() (n int) {
 	if m == nil {
 		return 0
@@ -59203,6 +64522,10 @@ func (m *RoleConditions) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if m.MCP != nil {
+		l = m.MCP.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -59247,6 +64570,24 @@ func (m *GitHubPermission) Size() (n int) {
 	return n
 }
 
+func (m *MCPPermissions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Tools) > 0 {
+		for _, s := range m.Tools {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *SPIFFERoleCondition) Size() (n int) {
 	if m == nil {
 		return 0
@@ -59469,6 +64810,10 @@ func (m *AccessRequestConditionsReason) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.Prompt)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -59543,6 +64888,56 @@ func (m *AccessRequestAllowedPromotions) Size() (n int) {
 	return n
 }
 
+func (m *ResourceIDList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.ResourceIds) > 0 {
+		for _, e := range m.ResourceIds {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LongTermResourceGrouping) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.AccessListToResources) > 0 {
+		for k, v := range m.AccessListToResources {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovTypes(uint64(len(k))) + 1 + l + sovTypes(uint64(l))
+			n += mapEntrySize + 1 + sovTypes(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.RecommendedAccessList)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ValidationMessage)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.CanProceed {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *ClaimMapping) Size() (n int) {
 	if m == nil {
 		return 0
@@ -59684,6 +65079,9 @@ func (m *UserFilter) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	if m.SkipSystemUsers {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -60937,6 +66335,14 @@ func (m *KubernetesServerV3) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	if m.Status != nil {
+		l = m.Status.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Scope)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -60973,6 +66379,32 @@ func (m *KubernetesServerSpecV3) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	l = len(m.RelayGroup)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.RelayIds) > 0 {
+		for _, s := range m.RelayIds {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *KubernetesServerStatusV3) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TargetHealth != nil {
+		l = m.TargetHealth.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61328,6 +66760,43 @@ func (m *OIDCConnectorSpecV3) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if len(m.UserMatchers) > 0 {
+		for _, s := range m.UserMatchers {
+			l = len(s)
+			n += 2 + l + sovTypes(uint64(l))
+		}
+	}
+	l = len(m.RequestObjectMode)
+	if l > 0 {
+		n += 2 + l + sovTypes(uint64(l))
+	}
+	if m.EntraIdGroupsProvider != nil {
+		l = m.EntraIdGroupsProvider.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *EntraIDGroupsProvider) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Disabled {
+		n += 2
+	}
+	l = len(m.GroupType)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.GraphEndpoint)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61401,6 +66870,10 @@ func (m *OIDCConnectorMFASettings) Size() (n int) {
 	if m.MaxAge != 0 {
 		n += 1 + sovTypes(uint64(m.MaxAge))
 	}
+	l = len(m.RequestObjectMode)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61497,6 +66970,10 @@ func (m *OIDCAuthRequest) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	l = len(m.LoginHint)
+	if l > 0 {
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61631,6 +67108,15 @@ func (m *SAMLConnectorSpecV2) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if len(m.UserMatchers) > 0 {
+		for _, s := range m.UserMatchers {
+			l = len(s)
+			n += 2 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.IncludeSubject {
+		n += 3
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61765,6 +67251,10 @@ func (m *SAMLAuthRequest) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	l = len(m.SubjectIdentifier)
+	if l > 0 {
+		n += 2 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -61909,6 +67399,12 @@ func (m *GithubConnectorSpecV3) Size() (n int) {
 		l = m.ClientRedirectSettings.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if len(m.UserMatchers) > 0 {
+		for _, s := range m.UserMatchers {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -62473,6 +67969,35 @@ func (m *LockTarget) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.BotInstanceID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.JoinToken)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LockFilter) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Targets) > 0 {
+		for _, e := range m.Targets {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.InForceOnly {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -62587,6 +68112,16 @@ func (m *WindowsDesktopServiceSpecV3) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	l = len(m.RelayGroup)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if len(m.RelayIds) > 0 {
+		for _, s := range m.RelayIds {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -63071,6 +68606,10 @@ func (m *Participant) Size() (n int) {
 	}
 	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.LastActive)
 	n += 1 + l + sovTypes(uint64(l))
+	l = len(m.Cluster)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -63799,6 +69338,18 @@ func (m *PluginSpecV1_Github) Size() (n int) {
 	}
 	return n
 }
+func (m *PluginSpecV1_Intune) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Intune != nil {
+		l = m.Intune.Size()
+		n += 2 + l + sovTypes(uint64(l))
+	}
+	return n
+}
 func (m *PluginGithubSettings) Size() (n int) {
 	if m == nil {
 		return 0
@@ -64017,6 +69568,30 @@ func (m *PluginJamfSettings) Size() (n int) {
 	return n
 }
 
+func (m *PluginIntuneSettings) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Tenant)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.LoginEndpoint)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.GraphEndpoint)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *PluginOktaSettings) Size() (n int) {
 	if m == nil {
 		return 0
@@ -64127,6 +69702,10 @@ func (m *PluginOktaSyncSettings) Size() (n int) {
 	if m.DisableAssignDefaultRoles {
 		n += 2
 	}
+	l = len(m.TimeBetweenImports)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -64223,12 +69802,76 @@ func (m *PluginEntraIDSyncSettings) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if len(m.GroupFilters) > 0 {
+		for _, e := range m.GroupFilters {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
 	return n
 }
 
+func (m *PluginSyncFilter) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Include != nil {
+		n += m.Include.Size()
+	}
+	if m.Exclude != nil {
+		n += m.Exclude.Size()
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *PluginSyncFilter_Id) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Id)
+	n += 1 + l + sovTypes(uint64(l))
+	return n
+}
+func (m *PluginSyncFilter_NameRegex) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.NameRegex)
+	n += 1 + l + sovTypes(uint64(l))
+	return n
+}
+func (m *PluginSyncFilter_ExcludeId) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ExcludeId)
+	n += 1 + l + sovTypes(uint64(l))
+	return n
+}
+func (m *PluginSyncFilter_ExcludeNameRegex) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ExcludeNameRegex)
+	n += 1 + l + sovTypes(uint64(l))
+	return n
+}
 func (m *PluginEntraIDAccessGraphSettings) Size() (n int) {
 	if m == nil {
 		return 0
@@ -64281,6 +69924,30 @@ func (m *PluginSCIMSettings) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.ConnectorInfo != nil {
+		l = m.ConnectorInfo.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *PluginSCIMSettings_ConnectorInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -64364,6 +70031,10 @@ func (m *PluginAWSICSettings) Size() (n int) {
 		l = m.Credentials.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.RolesSyncMode)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -64983,6 +70654,10 @@ func (m *PluginOktaStatusV1) Size() (n int) {
 		l = m.AccessListsSyncDetails.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.SystemLogExportDetails != nil {
+		l = m.SystemLogExportDetails.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -65150,6 +70825,36 @@ func (m *PluginOktaStatusDetailsAccessListsSync) Size() (n int) {
 	return n
 }
 
+func (m *PluginOktaStatusSystemLogExporter) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	if m.StatusCode != 0 {
+		n += 1 + sovTypes(uint64(m.StatusCode))
+	}
+	if m.LastSuccessful != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastSuccessful)
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.LastFailed != nil {
+		l = github_com_gogo_protobuf_types.SizeOfStdTime(*m.LastFailed)
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *PluginCredentialsV1) Size() (n int) {
 	if m == nil {
 		return 0
@@ -65898,6 +71603,8 @@ func (m *IntegrationV1) Size() (n int) {
 	n += 1 + l + sovTypes(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovTypes(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -65971,6 +71678,22 @@ func (m *IntegrationSpecV1_AWSRA) Size() (n int) {
 	}
 	return n
 }
+func (m *IntegrationStatusV1) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.AWSRolesAnywhere != nil {
+		l = m.AWSRolesAnywhere.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *AWSOIDCIntegrationSpecV1) Size() (n int) {
 	if m == nil {
 		return 0
@@ -66071,6 +71794,55 @@ func (m *AWSRolesAnywhereProfileSyncConfig) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if len(m.ProfileNameFilters) > 0 {
+		for _, s := range m.ProfileNameFilters {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSRAIntegrationStatusV1) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.LastProfileSync != nil {
+		l = m.LastProfileSync.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.StartTime)
+	n += 1 + l + sovTypes(uint64(l))
+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.EndTime)
+	n += 1 + l + sovTypes(uint64(l))
+	l = len(m.Status)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ErrorMessage)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.SyncedProfiles != 0 {
+		n += 1 + sovTypes(uint64(m.SyncedProfiles))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -66365,6 +72137,54 @@ func (m *AWSMatcher) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.Organization != nil {
+		l = m.Organization.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSOrganizationMatcher) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.OrganizationID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.OrganizationalUnits != nil {
+		l = m.OrganizationalUnits.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSOrganizationUnitsMatcher) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Include) > 0 {
+		for _, s := range m.Include {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.Exclude) > 0 {
+		for _, s := range m.Exclude {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -66427,6 +72247,42 @@ func (m *InstallerParams) Size() (n int) {
 	if m.EnrollMode != 0 {
 		n += 1 + sovTypes(uint64(m.EnrollMode))
 	}
+	l = len(m.Suffix)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.UpdateGroup)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.HTTPProxySettings != nil {
+		l = m.HTTPProxySettings.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *HTTPProxySettings) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.HTTPProxy)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.HTTPSProxy)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.NoProxy)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -66501,6 +72357,10 @@ func (m *AzureMatcher) Size() (n int) {
 		l = m.Params.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.Integration)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -66638,6 +72498,20 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) Size() (n int) {
 	return n
 }
 
+func (m *AccessGraphAWSSyncEKSAuditLogs) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Tags.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *AccessGraphAWSSync) Size() (n int) {
 	if m == nil {
 		return 0
@@ -66662,6 +72536,10 @@ func (m *AccessGraphAWSSync) Size() (n int) {
 		l = m.CloudTrailLogs.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.EksAuditLogs != nil {
+		l = m.EksAuditLogs.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -68126,6 +74004,38 @@ func (m *DatabaseServerV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scope = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -68374,6 +74284,70 @@ func (m *DatabaseServerSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.ProxyIDs = append(m.ProxyIDs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayIds = append(m.RelayIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -69566,6 +75540,45 @@ func (m *OracleOptions) Unmarshal(dAtA []byte) error {
 			}
 			m.AuditUser = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RetryCount", wireType)
+			}
+			m.RetryCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.RetryCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShuffleHostnames", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ShuffleHostnames = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -70402,6 +76415,39 @@ func (m *AWS) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ElastiCacheServerless", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ElastiCacheServerless.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -71199,7 +77245,7 @@ func (m *ElastiCache) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MemoryDB) Unmarshal(dAtA []byte) error {
+func (m *ElastiCacheServerless) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -71222,15 +77268,15 @@ func (m *MemoryDB) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MemoryDB: wiretype end group for non-group")
+			return fmt.Errorf("proto: ElastiCacheServerless: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MemoryDB: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ElastiCacheServerless: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CacheName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71258,11 +77304,94 @@ func (m *MemoryDB) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			m.CacheName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MemoryDB) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MemoryDB: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MemoryDB: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ACLName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ACLName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -71900,6 +78029,154 @@ func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 			}
 			m.InstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AlloyDB", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.AlloyDB.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AlloyDB) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AlloyDB: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AlloyDB: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EndpointType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EndpointType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EndpointOverride", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EndpointOverride = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -74352,6 +80629,38 @@ func (m *ServerV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scope = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -74849,60 +81158,160 @@ func (m *ServerSpecV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AWSInfo) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AWSInfo: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSInfo: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 16:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayIds = append(m.RelayIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 18:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ComponentFeatures", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ComponentFeatures == nil {
+				m.ComponentFeatures = &v1.ComponentFeatures{}
+			}
+			if err := m.ComponentFeatures.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -75507,6 +81916,38 @@ func (m *AppServerV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scope = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -75755,6 +82196,106 @@ func (m *AppServerSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.ProxyIDs = append(m.ProxyIDs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayIds = append(m.RelayIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ComponentFeatures", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ComponentFeatures == nil {
+				m.ComponentFeatures = &v1.ComponentFeatures{}
+			}
+			if err := m.ComponentFeatures.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -77125,6 +83666,42 @@ func (m *AppSpecV3) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.UseAnyProxyPublicAddr = bool(v != 0)
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MCP", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MCP == nil {
+				m.MCP = &MCP{}
+			}
+			if err := m.MCP.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -77147,7 +83724,7 @@ func (m *AppSpecV3) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Rewrite) Unmarshal(dAtA []byte) error {
+func (m *MCP) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77170,15 +83747,15 @@ func (m *Rewrite) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Rewrite: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCP: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Rewrite: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCP: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Redirect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Command", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -77206,13 +83783,13 @@ func (m *Rewrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Redirect = append(m.Redirect, string(dAtA[iNdEx:postIndex]))
+			m.Command = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Args", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77222,29 +83799,27 @@ func (m *Rewrite) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Headers = append(m.Headers, &Header{})
-			if err := m.Headers[len(m.Headers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Args = append(m.Args, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JWTClaims", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RunAsHostUser", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -77272,7 +83847,7 @@ func (m *Rewrite) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.JWTClaims = string(dAtA[iNdEx:postIndex])
+			m.RunAsHostUser = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -77296,7 +83871,7 @@ func (m *Rewrite) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Header) Unmarshal(dAtA []byte) error {
+func (m *Rewrite) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77319,15 +83894,15 @@ func (m *Header) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Header: wiretype end group for non-group")
+			return fmt.Errorf("proto: Rewrite: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Header: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Rewrite: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Redirect", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -77355,11 +83930,45 @@ func (m *Header) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Redirect = append(m.Redirect, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Headers", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Headers = append(m.Headers, &Header{})
+			if err := m.Headers[len(m.Headers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JWTClaims", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -77387,7 +83996,7 @@ func (m *Header) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.JWTClaims = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -77411,7 +84020,7 @@ func (m *Header) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PortRange) Unmarshal(dAtA []byte) error {
+func (m *Header) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77434,17 +84043,17 @@ func (m *PortRange) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PortRange: wiretype end group for non-group")
+			return fmt.Errorf("proto: Header: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PortRange: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Header: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			m.Port = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77454,16 +84063,29 @@ func (m *PortRange) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Port |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EndPort", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
-			m.EndPort = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77473,11 +84095,24 @@ func (m *PortRange) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.EndPort |= uint32(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -77500,7 +84135,7 @@ func (m *PortRange) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
+func (m *PortRange) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77523,17 +84158,17 @@ func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CommandLabelV2: wiretype end group for non-group")
+			return fmt.Errorf("proto: PortRange: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CommandLabelV2: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PortRange: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Period", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
 			}
-			m.Period = 0
+			m.Port = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77543,48 +84178,16 @@ func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Period |= Duration(b&0x7F) << shift
+				m.Port |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Command", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Command = append(m.Command, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Result", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EndPort", wireType)
 			}
-			var stringLen uint64
+			m.EndPort = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77594,24 +84197,11 @@ func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.EndPort |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Result = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -77634,7 +84224,7 @@ func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AppAWS) Unmarshal(dAtA []byte) error {
+func (m *CommandLabelV2) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -77657,15 +84247,34 @@ func (m *AppAWS) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AppAWS: wiretype end group for non-group")
+			return fmt.Errorf("proto: CommandLabelV2: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AppAWS: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CommandLabelV2: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Period", wireType)
+			}
+			m.Period = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Period |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExternalID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Command", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -77693,13 +84302,13 @@ func (m *AppAWS) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ExternalID = string(dAtA[iNdEx:postIndex])
+			m.Command = append(m.Command, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RolesAnywhereProfile", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Result", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -77709,27 +84318,142 @@ func (m *AppAWS) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.RolesAnywhereProfile == nil {
-				m.RolesAnywhereProfile = &AppAWSRolesAnywhereProfile{}
-			}
-			if err := m.RolesAnywhereProfile.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Result = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AppAWS) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AppAWS: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AppAWS: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExternalID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RolesAnywhereProfile", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.RolesAnywhereProfile == nil {
+				m.RolesAnywhereProfile = &AppAWSRolesAnywhereProfile{}
+			}
+			if err := m.RolesAnywhereProfile.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -78110,6 +84834,40 @@ func (m *TLSKeyPair) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CRL", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CRL = append(m.CRL[:0], dAtA[iNdEx:postIndex]...)
+			if m.CRL == nil {
+				m.CRL = []byte{}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -78270,7 +85028,7 @@ func (m *JWTKeyPair) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
+func (m *EncryptionKeyPair) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -78293,17 +85051,17 @@ func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertAuthorityV2: wiretype end group for non-group")
+			return fmt.Errorf("proto: EncryptionKeyPair: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertAuthorityV2: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EncryptionKeyPair: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -78313,29 +85071,31 @@ func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PublicKey == nil {
+				m.PublicKey = []byte{}
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKey", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -78345,29 +85105,31 @@ func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubKind = string(dAtA[iNdEx:postIndex])
+			m.PrivateKey = append(m.PrivateKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PrivateKey == nil {
+				m.PrivateKey = []byte{}
+			}
 			iNdEx = postIndex
 		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKeyType", wireType)
 			}
-			var stringLen uint64
+			m.PrivateKeyType = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -78377,62 +85139,16 @@ func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				m.PrivateKeyType |= PrivateKeyType(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Version = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hash", wireType)
 			}
-			var msglen int
+			m.Hash = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -78442,25 +85158,309 @@ func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				m.Hash |= uint32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AgeEncryptionKey) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AgeEncryptionKey: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AgeEncryptionKey: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PublicKey == nil {
+				m.PublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertAuthorityV2) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertAuthorityV2: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertAuthorityV2: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SubKind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -80426,6 +87426,42 @@ func (m *ProvisionTokenSpecV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 21:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Env0", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Env0 == nil {
+				m.Env0 = &ProvisionTokenSpecV2Env0{}
+			}
+			if err := m.Env0.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -82671,6 +89707,26 @@ func (m *ProvisionTokenSpecV2Spacelift) Unmarshal(dAtA []byte) error {
 			}
 			m.Hostname = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableGlobMatching", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableGlobMatching = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -83003,62 +90059,11 @@ func (m *ProvisionTokenSpecV2Kubernetes) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: StaticJWKSConfig: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: StaticJWKSConfig: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JWKS", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OIDC", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -83068,23 +90073,27 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Unmarshal(dAtA []byte)
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.JWKS = string(dAtA[iNdEx:postIndex])
+			if m.OIDC == nil {
+				m.OIDC = &ProvisionTokenSpecV2Kubernetes_OIDCConfig{}
+			}
+			if err := m.OIDC.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -83108,7 +90117,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Unmarshal(dAtA []byte)
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2Kubernetes_Rule) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83131,15 +90140,15 @@ func (m *ProvisionTokenSpecV2Kubernetes_Rule) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Rule: wiretype end group for non-group")
+			return fmt.Errorf("proto: StaticJWKSConfig: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Rule: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: StaticJWKSConfig: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccount", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JWKS", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -83167,7 +90176,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServiceAccount = string(dAtA[iNdEx:postIndex])
+			m.JWKS = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -83191,7 +90200,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_Rule) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2Azure) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2Kubernetes_OIDCConfig) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83214,17 +90223,17 @@ func (m *ProvisionTokenSpecV2Azure) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2Azure: wiretype end group for non-group")
+			return fmt.Errorf("proto: OIDCConfig: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2Azure: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OIDCConfig: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Allow", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Issuer", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -83234,26 +90243,44 @@ func (m *ProvisionTokenSpecV2Azure) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Allow = append(m.Allow, &ProvisionTokenSpecV2Azure_Rule{})
-			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Issuer = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InsecureAllowHTTPIssuer", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.InsecureAllowHTTPIssuer = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -83276,7 +90303,7 @@ func (m *ProvisionTokenSpecV2Azure) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2Azure_Rule) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2Kubernetes_Rule) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83307,39 +90334,7 @@ func (m *ProvisionTokenSpecV2Azure_Rule) Unmarshal(dAtA []byte) error {
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Subscription", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Subscription = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceGroups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccount", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -83367,7 +90362,7 @@ func (m *ProvisionTokenSpecV2Azure_Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceGroups = append(m.ResourceGroups, string(dAtA[iNdEx:postIndex]))
+			m.ServiceAccount = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -83391,7 +90386,7 @@ func (m *ProvisionTokenSpecV2Azure_Rule) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2GCP) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2Azure) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83414,10 +90409,10 @@ func (m *ProvisionTokenSpecV2GCP) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2GCP: wiretype end group for non-group")
+			return fmt.Errorf("proto: ProvisionTokenSpecV2Azure: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2GCP: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ProvisionTokenSpecV2Azure: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -83449,7 +90444,7 @@ func (m *ProvisionTokenSpecV2GCP) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Allow = append(m.Allow, &ProvisionTokenSpecV2GCP_Rule{})
+			m.Allow = append(m.Allow, &ProvisionTokenSpecV2Azure_Rule{})
 			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
@@ -83476,7 +90471,7 @@ func (m *ProvisionTokenSpecV2GCP) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2Azure_Rule) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83507,7 +90502,7 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProjectIDs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Subscription", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -83535,43 +90530,11 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ProjectIDs = append(m.ProjectIDs, string(dAtA[iNdEx:postIndex]))
+			m.Subscription = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Locations", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Locations = append(m.Locations, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccounts", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceGroups", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -83599,7 +90562,7 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ServiceAccounts = append(m.ServiceAccounts, string(dAtA[iNdEx:postIndex]))
+			m.ResourceGroups = append(m.ResourceGroups, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -83623,7 +90586,7 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ProvisionTokenSpecV2TerraformCloud) Unmarshal(dAtA []byte) error {
+func (m *ProvisionTokenSpecV2GCP) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -83646,10 +90609,242 @@ func (m *ProvisionTokenSpecV2TerraformCloud) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2TerraformCloud: wiretype end group for non-group")
+			return fmt.Errorf("proto: ProvisionTokenSpecV2GCP: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ProvisionTokenSpecV2TerraformCloud: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ProvisionTokenSpecV2GCP: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Allow", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Allow = append(m.Allow, &ProvisionTokenSpecV2GCP_Rule{})
+			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ProvisionTokenSpecV2GCP_Rule) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Rule: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Rule: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProjectIDs", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProjectIDs = append(m.ProjectIDs, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Locations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Locations = append(m.Locations, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccounts", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccounts = append(m.ServiceAccounts, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ProvisionTokenSpecV2TerraformCloud) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ProvisionTokenSpecV2TerraformCloud: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ProvisionTokenSpecV2TerraformCloud: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -84585,6 +91780,526 @@ func (m *ProvisionTokenSpecV2Oracle_Rule) Unmarshal(dAtA []byte) error {
 			}
 			m.Regions = append(m.Regions, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Instances", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Instances = append(m.Instances, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ProvisionTokenSpecV2Env0) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ProvisionTokenSpecV2Env0: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ProvisionTokenSpecV2Env0: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Allow", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Allow = append(m.Allow, &ProvisionTokenSpecV2Env0_Rule{})
+			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ProvisionTokenSpecV2Env0_Rule) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Rule: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Rule: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrganizationID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OrganizationID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProjectID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProjectID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProjectName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProjectName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TemplateID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TemplateID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TemplateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TemplateName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnvironmentID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EnvironmentID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnvironmentName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EnvironmentName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkspaceName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WorkspaceName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeploymentType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DeploymentType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeployerEmail", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DeployerEmail = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Env0Tag", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Env0Tag = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -87514,6 +95229,403 @@ func (m *SessionRecordingConfigV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Status == nil {
+				m.Status = &SessionRecordingConfigStatus{}
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KeyLabel) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KeyLabel: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KeyLabel: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Label", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Label = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ManualKeyManagementConfig) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ManualKeyManagementConfig: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ManualKeyManagementConfig: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ActiveKeys", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ActiveKeys = append(m.ActiveKeys, &KeyLabel{})
+			if err := m.ActiveKeys[len(m.ActiveKeys)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RotatedKeys", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RotatedKeys = append(m.RotatedKeys, &KeyLabel{})
+			if err := m.RotatedKeys[len(m.RotatedKeys)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionRecordingEncryptionConfig) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionRecordingEncryptionConfig: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionRecordingEncryptionConfig: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManualKeyManagement", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ManualKeyManagement == nil {
+				m.ManualKeyManagement = &ManualKeyManagementConfig{}
+			}
+			if err := m.ManualKeyManagement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -87633,6 +95745,127 @@ func (m *SessionRecordingConfigSpecV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Encryption", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Encryption == nil {
+				m.Encryption = &SessionRecordingEncryptionConfig{}
+			}
+			if err := m.Encryption.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SessionRecordingConfigStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SessionRecordingConfigStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SessionRecordingConfigStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKeys", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EncryptionKeys = append(m.EncryptionKeys, &AgeEncryptionKey{})
+			if err := m.EncryptionKeys[len(m.EncryptionKeys)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -92522,6 +100755,61 @@ func (m *AccessRequestSpecV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 24:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestKind", wireType)
+			}
+			m.RequestKind = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.RequestKind |= AccessRequestKind(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 25:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LongTermGrouping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LongTermGrouping == nil {
+				m.LongTermGrouping = &LongTermResourceGrouping{}
+			}
+			if err := m.LongTermGrouping.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -93189,7 +101477,7 @@ func (m *AccessCapabilitiesRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *RequestKubernetesResource) Unmarshal(dAtA []byte) error {
+func (m *RemoteAccessCapabilities) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -93212,47 +101500,15 @@ func (m *RequestKubernetesResource) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: RequestKubernetesResource: wiretype end group for non-group")
+			return fmt.Errorf("proto: RemoteAccessCapabilities: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: RequestKubernetesResource: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: RemoteAccessCapabilities: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field APIGroup", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ApplicableRolesForResources", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93280,7 +101536,7 @@ func (m *RequestKubernetesResource) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.APIGroup = string(dAtA[iNdEx:postIndex])
+			m.ApplicableRolesForResources = append(m.ApplicableRolesForResources, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -93304,7 +101560,7 @@ func (m *RequestKubernetesResource) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ResourceID) Unmarshal(dAtA []byte) error {
+func (m *RemoteAccessCapabilitiesRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -93327,15 +101583,15 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ResourceID: wiretype end group for non-group")
+			return fmt.Errorf("proto: RemoteAccessCapabilitiesRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ResourceID: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: RemoteAccessCapabilitiesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93363,11 +101619,11 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			m.User = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchAsRoles", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93395,11 +101651,96 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			m.SearchAsRoles = append(m.SearchAsRoles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceIDs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceIDs = append(m.ResourceIDs, ResourceID{})
+			if err := m.ResourceIDs[len(m.ResourceIDs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RequestKubernetesResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RequestKubernetesResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RequestKubernetesResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93427,11 +101768,11 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Kind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubResourceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field APIGroup", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93459,7 +101800,7 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubResourceName = string(dAtA[iNdEx:postIndex])
+			m.APIGroup = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -93483,7 +101824,7 @@ func (m *ResourceID) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
+func (m *ResourceID) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -93506,15 +101847,15 @@ func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PluginDataV3: wiretype end group for non-group")
+			return fmt.Errorf("proto: ResourceID: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginDataV3: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ResourceID: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93542,11 +101883,11 @@ func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			m.ClusterName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93574,11 +101915,11 @@ func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubKind = string(dAtA[iNdEx:postIndex])
+			m.Kind = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -93606,46 +101947,13 @@ func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Version = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SubResourceName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -93655,24 +101963,236 @@ func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SubResourceName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginDataV3) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginDataV3: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginDataV3: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SubKind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -98045,6 +106565,42 @@ func (m *RoleConditions) Unmarshal(dAtA []byte) error {
 			}
 			m.WorkloadIdentityLabelsExpression = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 46:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MCP", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MCP == nil {
+				m.MCP = &MCPPermissions{}
+			}
+			if err := m.MCP.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -98265,7 +106821,7 @@ func (m *GitHubPermission) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *SPIFFERoleCondition) Unmarshal(dAtA []byte) error {
+func (m *MCPPermissions) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -98288,15 +106844,15 @@ func (m *SPIFFERoleCondition) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: SPIFFERoleCondition: wiretype end group for non-group")
+			return fmt.Errorf("proto: MCPPermissions: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SPIFFERoleCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MCPPermissions: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tools", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -98324,11 +106880,94 @@ func (m *SPIFFERoleCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Path = string(dAtA[iNdEx:postIndex])
+			m.Tools = append(m.Tools, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SPIFFERoleCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SPIFFERoleCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SPIFFERoleCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DNSSANs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DNSSANs", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99546,6 +108185,38 @@ func (m *AccessRequestConditionsReason) Unmarshal(dAtA []byte) error {
 			}
 			m.Mode = RequestReasonMode(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Prompt", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Prompt = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -99917,7 +108588,7 @@ func (m *AccessRequestAllowedPromotions) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ClaimMapping) Unmarshal(dAtA []byte) error {
+func (m *ResourceIDList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99940,49 +108611,17 @@ func (m *ClaimMapping) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ClaimMapping: wiretype end group for non-group")
+			return fmt.Errorf("proto: ResourceIDList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ClaimMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ResourceIDList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Claim", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceIds", wireType)
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Claim = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
-			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99992,55 +108631,25 @@ func (m *ClaimMapping) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			m.ResourceIds = append(m.ResourceIds, ResourceID{})
+			if err := m.ResourceIds[len(m.ResourceIds)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100064,7 +108673,7 @@ func (m *ClaimMapping) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *TraitMapping) Unmarshal(dAtA []byte) error {
+func (m *LongTermResourceGrouping) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100087,15 +108696,144 @@ func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: TraitMapping: wiretype end group for non-group")
+			return fmt.Errorf("proto: LongTermResourceGrouping: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TraitMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: LongTermResourceGrouping: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Trait", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessListToResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AccessListToResources == nil {
+				m.AccessListToResources = make(map[string]ResourceIDList)
+			}
+			var mapkey string
+			mapvalue := &ResourceIDList{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowTypes
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowTypes
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthTypes
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthTypes
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowTypes
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthTypes
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthTypes
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &ResourceIDList{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipTypes(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthTypes
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.AccessListToResources[mapkey] = *mapvalue
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecommendedAccessList", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100123,11 +108861,11 @@ func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Trait = string(dAtA[iNdEx:postIndex])
+			m.RecommendedAccessList = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ValidationMessage", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100155,13 +108893,13 @@ func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.ValidationMessage = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanProceed", wireType)
 			}
-			var stringLen uint64
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -100171,24 +108909,12 @@ func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
+			m.CanProceed = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -100211,7 +108937,7 @@ func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Rule) Unmarshal(dAtA []byte) error {
+func (m *ClaimMapping) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100234,15 +108960,15 @@ func (m *Rule) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Rule: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClaimMapping: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Rule: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClaimMapping: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Claim", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100270,11 +108996,11 @@ func (m *Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Resources = append(m.Resources, string(dAtA[iNdEx:postIndex]))
+			m.Claim = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100302,43 +109028,11 @@ func (m *Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Verbs = append(m.Verbs, string(dAtA[iNdEx:postIndex]))
+			m.Value = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Where", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Where = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Actions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100366,7 +109060,7 @@ func (m *Rule) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Actions = append(m.Actions, string(dAtA[iNdEx:postIndex]))
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100390,7 +109084,7 @@ func (m *Rule) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
+func (m *TraitMapping) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100413,15 +109107,15 @@ func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ImpersonateConditions: wiretype end group for non-group")
+			return fmt.Errorf("proto: TraitMapping: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ImpersonateConditions: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: TraitMapping: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Users", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Trait", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100449,11 +109143,11 @@ func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Users = append(m.Users, string(dAtA[iNdEx:postIndex]))
+			m.Trait = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100481,11 +109175,11 @@ func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			m.Value = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Where", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100513,7 +109207,7 @@ func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Where = string(dAtA[iNdEx:postIndex])
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -100537,7 +109231,7 @@ func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *BoolValue) Unmarshal(dAtA []byte) error {
+func (m *Rule) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100560,17 +109254,17 @@ func (m *BoolValue) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: BoolValue: wiretype end group for non-group")
+			return fmt.Errorf("proto: Rule: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BoolValue: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Rule: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
 			}
-			var v int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -100580,12 +109274,120 @@ func (m *BoolValue) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.Value = bool(v != 0)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resources = append(m.Resources, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Verbs = append(m.Verbs, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Where", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Where = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Actions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Actions = append(m.Actions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -100608,7 +109410,7 @@ func (m *BoolValue) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *UserFilter) Unmarshal(dAtA []byte) error {
+func (m *ImpersonateConditions) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -100631,15 +109433,233 @@ func (m *UserFilter) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: UserFilter: wiretype end group for non-group")
+			return fmt.Errorf("proto: ImpersonateConditions: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: UserFilter: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ImpersonateConditions: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Users", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Users = append(m.Users, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Roles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Roles = append(m.Roles, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Where", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Where = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BoolValue) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BoolValue: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BoolValue: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Value = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UserFilter) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UserFilter: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UserFilter: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchKeywords", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -100669,6 +109689,26 @@ func (m *UserFilter) Unmarshal(dAtA []byte) error {
 			}
 			m.SearchKeywords = append(m.SearchKeywords, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipSystemUsers", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SkipSystemUsers = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -109199,6 +118239,74 @@ func (m *KubernetesServerV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Status == nil {
+				m.Status = &KubernetesServerStatusV3{}
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scope = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -109447,6 +118555,157 @@ func (m *KubernetesServerSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.ProxyIDs = append(m.ProxyIDs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayIds = append(m.RelayIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesServerStatusV3) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesServerStatusV3: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesServerStatusV3: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TargetHealth", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TargetHealth == nil {
+				m.TargetHealth = &TargetHealth{}
+			}
+			if err := m.TargetHealth.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -111690,62 +120949,11 @@ func (m *OIDCConnectorSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.PKCEMode = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *MaxAge) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: MaxAge: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MaxAge: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+		case 21:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMatchers", wireType)
 			}
-			m.Value = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -111755,65 +120963,27 @@ func (m *MaxAge) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Value |= Duration(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *SSOClientRedirectSettings) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SSOClientRedirectSettings: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SSOClientRedirectSettings: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.UserMatchers = append(m.UserMatchers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 22:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllowedHttpsHostnames", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestObjectMode", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -111841,13 +121011,13 @@ func (m *SSOClientRedirectSettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AllowedHttpsHostnames = append(m.AllowedHttpsHostnames, string(dAtA[iNdEx:postIndex]))
+			m.RequestObjectMode = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 23:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InsecureAllowedCidrRanges", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EntraIdGroupsProvider", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -111857,23 +121027,27 @@ func (m *SSOClientRedirectSettings) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InsecureAllowedCidrRanges = append(m.InsecureAllowedCidrRanges, string(dAtA[iNdEx:postIndex]))
+			if m.EntraIdGroupsProvider == nil {
+				m.EntraIdGroupsProvider = &EntraIDGroupsProvider{}
+			}
+			if err := m.EntraIdGroupsProvider.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -111897,7 +121071,7 @@ func (m *SSOClientRedirectSettings) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
+func (m *EntraIDGroupsProvider) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -111920,15 +121094,15 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OIDCConnectorMFASettings: wiretype end group for non-group")
+			return fmt.Errorf("proto: EntraIDGroupsProvider: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OIDCConnectorMFASettings: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EntraIDGroupsProvider: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Disabled", wireType)
 			}
 			var v int
 			for shift := uint(0); ; shift += 7 {
@@ -111945,10 +121119,10 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-			m.Enabled = bool(v != 0)
+			m.Disabled = bool(v != 0)
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupType", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -111976,11 +121150,11 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClientId = string(dAtA[iNdEx:postIndex])
+			m.GroupType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientSecret", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GraphEndpoint", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112008,77 +121182,64 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClientSecret = string(dAtA[iNdEx:postIndex])
+			m.GraphEndpoint = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AcrValues", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthTypes
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AcrValues = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Prompt", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MaxAge) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Prompt = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 6:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MaxAge: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MaxAge: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MaxAge", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
-			m.MaxAge = 0
+			m.Value = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -112088,7 +121249,7 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.MaxAge |= Duration(b&0x7F) << shift
+				m.Value |= Duration(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -112115,7 +121276,7 @@ func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
+func (m *SSOClientRedirectSettings) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -112138,15 +121299,15 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OIDCAuthRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: SSOClientRedirectSettings: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OIDCAuthRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: SSOClientRedirectSettings: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowedHttpsHostnames", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112174,11 +121335,11 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ConnectorID = string(dAtA[iNdEx:postIndex])
+			m.AllowedHttpsHostnames = append(m.AllowedHttpsHostnames, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InsecureAllowedCidrRanges", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112206,11 +121367,62 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Type = string(dAtA[iNdEx:postIndex])
+			m.InsecureAllowedCidrRanges = append(m.InsecureAllowedCidrRanges, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OIDCConnectorMFASettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OIDCConnectorMFASettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OIDCConnectorMFASettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CheckUser", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
 			}
 			var v int
 			for shift := uint(0); ; shift += 7 {
@@ -112227,10 +121439,10 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-			m.CheckUser = bool(v != 0)
-		case 4:
+			m.Enabled = bool(v != 0)
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientId", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112258,11 +121470,11 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StateToken = string(dAtA[iNdEx:postIndex])
+			m.ClientId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CSRFToken", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientSecret", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112290,11 +121502,11 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CSRFToken = string(dAtA[iNdEx:postIndex])
+			m.ClientSecret = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RedirectURL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AcrValues", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112322,13 +121534,13 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.RedirectURL = string(dAtA[iNdEx:postIndex])
+			m.AcrValues = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CertTTL", wireType)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Prompt", wireType)
 			}
-			m.CertTTL = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -112338,16 +121550,29 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.CertTTL |= time.Duration(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 9:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Prompt = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CreateWebSession", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxAge", wireType)
 			}
-			var v int
+			m.MaxAge = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -112357,15 +121582,316 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				m.MaxAge |= Duration(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.CreateWebSession = bool(v != 0)
-		case 10:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientRedirectURL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestObjectMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequestObjectMode = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OIDCAuthRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OIDCAuthRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConnectorID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CheckUser", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CheckUser = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StateToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StateToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CSRFToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CSRFToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RedirectURL", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RedirectURL = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CertTTL", wireType)
+			}
+			m.CertTTL = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.CertTTL |= time.Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CreateWebSession", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CreateWebSession = bool(v != 0)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientRedirectURL", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -112741,7 +122267,7 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.SshAttestationStatement == nil {
-				m.SshAttestationStatement = &v1.AttestationStatement{}
+				m.SshAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.SshAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -112777,7 +122303,7 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TlsAttestationStatement == nil {
-				m.TlsAttestationStatement = &v1.AttestationStatement{}
+				m.TlsAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.TlsAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -112815,6 +122341,38 @@ func (m *OIDCAuthRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.PkceVerifier = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 25:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LoginHint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LoginHint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -113765,6 +123323,58 @@ func (m *SAMLConnectorSpecV2) Unmarshal(dAtA []byte) error {
 			}
 			m.PreferredRequestBinding = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 20:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMatchers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserMatchers = append(m.UserMatchers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 21:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeSubject", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IncludeSubject = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -114631,7 +124241,7 @@ func (m *SAMLAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.SshAttestationStatement == nil {
-				m.SshAttestationStatement = &v1.AttestationStatement{}
+				m.SshAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.SshAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -114667,7 +124277,7 @@ func (m *SAMLAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TlsAttestationStatement == nil {
-				m.TlsAttestationStatement = &v1.AttestationStatement{}
+				m.TlsAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.TlsAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -114739,6 +124349,38 @@ func (m *SAMLAuthRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.ClientVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 25:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SubjectIdentifier", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SubjectIdentifier = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -115646,6 +125288,38 @@ func (m *GithubConnectorSpecV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserMatchers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserMatchers = append(m.UserMatchers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -116278,7 +125952,7 @@ func (m *GithubAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.SshAttestationStatement == nil {
-				m.SshAttestationStatement = &v1.AttestationStatement{}
+				m.SshAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.SshAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -116314,7 +125988,7 @@ func (m *GithubAuthRequest) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TlsAttestationStatement == nil {
-				m.TlsAttestationStatement = &v1.AttestationStatement{}
+				m.TlsAttestationStatement = &v11.AttestationStatement{}
 			}
 			if err := m.TlsAttestationStatement.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -119445,6 +129119,70 @@ func (m *LockTarget) Unmarshal(dAtA []byte) error {
 			}
 			m.ServerID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BotInstanceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BotInstanceID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -119467,7 +129205,7 @@ func (m *LockTarget) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AddressCondition) Unmarshal(dAtA []byte) error {
+func (m *LockFilter) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -119490,17 +129228,17 @@ func (m *AddressCondition) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AddressCondition: wiretype end group for non-group")
+			return fmt.Errorf("proto: LockFilter: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AddressCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: LockFilter: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CIDR", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Targets", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -119510,24 +129248,46 @@ func (m *AddressCondition) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CIDR = string(dAtA[iNdEx:postIndex])
+			m.Targets = append(m.Targets, &LockTarget{})
+			if err := m.Targets[len(m.Targets)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InForceOnly", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.InForceOnly = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -119550,7 +129310,7 @@ func (m *AddressCondition) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NetworkRestrictionsSpecV4) Unmarshal(dAtA []byte) error {
+func (m *AddressCondition) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -119573,51 +129333,17 @@ func (m *NetworkRestrictionsSpecV4) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NetworkRestrictionsSpecV4: wiretype end group for non-group")
+			return fmt.Errorf("proto: AddressCondition: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NetworkRestrictionsSpecV4: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AddressCondition: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Allow", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Allow = append(m.Allow, AddressCondition{})
-			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Deny", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CIDR", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -119627,25 +129353,142 @@ func (m *NetworkRestrictionsSpecV4) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Deny = append(m.Deny, AddressCondition{})
-			if err := m.Deny[len(m.Deny)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CIDR = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NetworkRestrictionsSpecV4) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NetworkRestrictionsSpecV4: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NetworkRestrictionsSpecV4: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Allow", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Allow = append(m.Allow, AddressCondition{})
+			if err := m.Allow[len(m.Allow)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Deny", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Deny = append(m.Deny, AddressCondition{})
+			if err := m.Deny[len(m.Deny)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -120156,6 +129999,70 @@ func (m *WindowsDesktopServiceSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.ProxyIDs = append(m.ProxyIDs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RelayIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RelayIds = append(m.RelayIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -123379,6 +133286,38 @@ func (m *Participant) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cluster", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Cluster = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -127248,6 +137187,41 @@ func (m *PluginSpecV1) Unmarshal(dAtA []byte) error {
 			}
 			m.Settings = &PluginSpecV1_Github{v}
 			iNdEx = postIndex
+		case 21:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Intune", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &PluginIntuneSettings{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Settings = &PluginSpecV1_Intune{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -128553,7 +138527,7 @@ func (m *PluginJamfSettings) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PluginOktaSettings) Unmarshal(dAtA []byte) error {
+func (m *PluginIntuneSettings) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -128576,15 +138550,15 @@ func (m *PluginOktaSettings) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PluginOktaSettings: wiretype end group for non-group")
+			return fmt.Errorf("proto: PluginIntuneSettings: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginOktaSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PluginIntuneSettings: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OrgUrl", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tenant", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -128612,31 +138586,178 @@ func (m *PluginOktaSettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OrgUrl = string(dAtA[iNdEx:postIndex])
+			m.Tenant = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EnableUserSync", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.EnableUserSync = bool(v != 0)
-		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SsoConnectorId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LoginEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LoginEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GraphEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GraphEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginOktaSettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginOktaSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginOktaSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrgUrl", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OrgUrl = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableUserSync", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableUserSync = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SsoConnectorId", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -129244,6 +139365,38 @@ func (m *PluginOktaSyncSettings) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.DisableAssignDefaultRoles = bool(v != 0)
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TimeBetweenImports", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TimeBetweenImports = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -129828,60 +139981,9 @@ func (m *PluginEntraIDSyncSettings) Unmarshal(dAtA []byte) error {
 			}
 			m.EntraAppId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginEntraIDAccessGraphSettings) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginEntraIDAccessGraphSettings: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginEntraIDAccessGraphSettings: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppSsoSettingsCache", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupFilters", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -129908,8 +140010,8 @@ func (m *PluginEntraIDAccessGraphSettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppSsoSettingsCache = append(m.AppSsoSettingsCache, &PluginEntraIDAppSSOSettings{})
-			if err := m.AppSsoSettingsCache[len(m.AppSsoSettingsCache)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.GroupFilters = append(m.GroupFilters, &PluginSyncFilter{})
+			if err := m.GroupFilters[len(m.GroupFilters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -129935,7 +140037,7 @@ func (m *PluginEntraIDAccessGraphSettings) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PluginEntraIDAppSSOSettings) Unmarshal(dAtA []byte) error {
+func (m *PluginSyncFilter) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -129958,15 +140060,15 @@ func (m *PluginEntraIDAppSSOSettings) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PluginEntraIDAppSSOSettings: wiretype end group for non-group")
+			return fmt.Errorf("proto: PluginSyncFilter: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginEntraIDAppSSOSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PluginSyncFilter: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AppId", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -129994,13 +140096,13 @@ func (m *PluginEntraIDAppSSOSettings) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AppId = string(dAtA[iNdEx:postIndex])
+			m.Include = &PluginSyncFilter_Id{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FederatedSsoV2", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NameRegex", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -130010,80 +140112,344 @@ func (m *PluginEntraIDAppSSOSettings) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FederatedSsoV2 = append(m.FederatedSsoV2[:0], dAtA[iNdEx:postIndex]...)
-			if m.FederatedSsoV2 == nil {
-				m.FederatedSsoV2 = []byte{}
-			}
+			m.Include = &PluginSyncFilter_NameRegex{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginSCIMSettings) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginSCIMSettings: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginSCIMSettings: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SamlConnectorName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExcludeId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Exclude = &PluginSyncFilter_ExcludeId{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExcludeNameRegex", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Exclude = &PluginSyncFilter_ExcludeNameRegex{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginEntraIDAccessGraphSettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginEntraIDAccessGraphSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginEntraIDAccessGraphSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AppSsoSettingsCache", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AppSsoSettingsCache = append(m.AppSsoSettingsCache, &PluginEntraIDAppSSOSettings{})
+			if err := m.AppSsoSettingsCache[len(m.AppSsoSettingsCache)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginEntraIDAppSSOSettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginEntraIDAppSSOSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginEntraIDAppSSOSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AppId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AppId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FederatedSsoV2", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FederatedSsoV2 = append(m.FederatedSsoV2[:0], dAtA[iNdEx:postIndex]...)
+			if m.FederatedSsoV2 == nil {
+				m.FederatedSsoV2 = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginSCIMSettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginSCIMSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginSCIMSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SamlConnectorName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -130145,6 +140511,157 @@ func (m *PluginSCIMSettings) Unmarshal(dAtA []byte) error {
 			}
 			m.DefaultRole = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorInfo", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ConnectorInfo == nil {
+				m.ConnectorInfo = &PluginSCIMSettings_ConnectorInfo{}
+			}
+			if err := m.ConnectorInfo.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginSCIMSettings_ConnectorInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ConnectorInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ConnectorInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -130664,6 +141181,38 @@ func (m *PluginAWSICSettings) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RolesSyncMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RolesSyncMode = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -133643,6 +144192,42 @@ func (m *PluginOktaStatusV1) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemLogExportDetails", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SystemLogExportDetails == nil {
+				m.SystemLogExportDetails = &PluginOktaStatusSystemLogExporter{}
+			}
+			if err := m.SystemLogExportDetails.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -134644,6 +145229,200 @@ func (m *PluginOktaStatusDetailsAccessListsSync) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *PluginOktaStatusSystemLogExporter) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginOktaStatusSystemLogExporter: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginOktaStatusSystemLogExporter: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusCode", wireType)
+			}
+			m.StatusCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.StatusCode |= OktaPluginSyncStatusCode(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastSuccessful", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastSuccessful == nil {
+				m.LastSuccessful = new(time.Time)
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.LastSuccessful, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastFailed", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastFailed == nil {
+				m.LastFailed = new(time.Time)
+			}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(m.LastFailed, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *PluginCredentialsV1) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -138871,6 +149650,39 @@ func (m *IntegrationV1) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -139120,7 +149932,94 @@ func (m *IntegrationSpecV1) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AWSOIDCIntegrationSpecV1) Unmarshal(dAtA []byte) error {
+func (m *IntegrationStatusV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IntegrationStatusV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IntegrationStatusV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AWSRolesAnywhere", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AWSRolesAnywhere == nil {
+				m.AWSRolesAnywhere = &AWSRAIntegrationStatusV1{}
+			}
+			if err := m.AWSRolesAnywhere.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSOIDCIntegrationSpecV1) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -139717,6 +150616,38 @@ func (m *AWSRolesAnywhereProfileSyncConfig) Unmarshal(dAtA []byte) error {
 			}
 			m.RoleARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProfileNameFilters", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProfileNameFilters = append(m.ProfileNameFilters, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -139739,7 +150670,7 @@ func (m *AWSRolesAnywhereProfileSyncConfig) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
+func (m *AWSRAIntegrationStatusV1) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -139762,15 +150693,15 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: HeadlessAuthentication: wiretype end group for non-group")
+			return fmt.Errorf("proto: AWSRAIntegrationStatusV1: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: HeadlessAuthentication: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AWSRAIntegrationStatusV1: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceHeader", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProfileSync", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -139797,15 +150728,69 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceHeader.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.LastProfileSync == nil {
+				m.LastProfileSync = &AWSRolesAnywhereProfileSyncIterationSummary{}
+			}
+			if err := m.LastProfileSync.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSRolesAnywhereProfileSyncIterationSummary) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSRolesAnywhereProfileSyncIterationSummary: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSRolesAnywhereProfileSyncIterationSummary: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -139815,46 +150800,28 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.User = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
-			}
-			m.State = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.State |= HeadlessAuthenticationState(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.StartTime, dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		case 5:
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MfaDevice", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EndTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -139881,16 +150848,13 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.MfaDevice == nil {
-				m.MfaDevice = &MFADevice{}
-			}
-			if err := m.MfaDevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := github_com_gogo_protobuf_types.StdTimeUnmarshal(&m.EndTime, dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClientIpAddress", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -139918,13 +150882,13 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClientIpAddress = string(dAtA[iNdEx:postIndex])
+			m.Status = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SshPublicKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ErrorMessage", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -139934,31 +150898,29 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SshPublicKey = append(m.SshPublicKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.SshPublicKey == nil {
-				m.SshPublicKey = []byte{}
-			}
+			m.ErrorMessage = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TlsPublicKey", wireType)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncedProfiles", wireType)
 			}
-			var byteLen int
+			m.SyncedProfiles = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -139968,26 +150930,11 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				m.SyncedProfiles |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.TlsPublicKey = append(m.TlsPublicKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.TlsPublicKey == nil {
-				m.TlsPublicKey = []byte{}
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -140010,7 +150957,7 @@ func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WatchKind) Unmarshal(dAtA []byte) error {
+func (m *HeadlessAuthentication) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -140033,15 +150980,286 @@ func (m *WatchKind) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WatchKind: wiretype end group for non-group")
+			return fmt.Errorf("proto: HeadlessAuthentication: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WatchKind: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: HeadlessAuthentication: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceHeader", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceHeader.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.User = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
+			}
+			m.State = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.State |= HeadlessAuthenticationState(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MfaDevice", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MfaDevice == nil {
+				m.MfaDevice = &MFADevice{}
+			}
+			if err := m.MfaDevice.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientIpAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClientIpAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SshPublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SshPublicKey = append(m.SshPublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.SshPublicKey == nil {
+				m.SshPublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsPublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TlsPublicKey = append(m.TlsPublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.TlsPublicKey == nil {
+				m.TlsPublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchKind) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -141787,6 +153005,276 @@ func (m *AWSMatcher) Unmarshal(dAtA []byte) error {
 			}
 			m.SetupAccessForARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Organization", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Organization == nil {
+				m.Organization = &AWSOrganizationMatcher{}
+			}
+			if err := m.Organization.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSOrganizationMatcher) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSOrganizationMatcher: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSOrganizationMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrganizationID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OrganizationID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrganizationalUnits", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.OrganizationalUnits == nil {
+				m.OrganizationalUnits = &AWSOrganizationUnitsMatcher{}
+			}
+			if err := m.OrganizationalUnits.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSOrganizationUnitsMatcher) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSOrganizationUnitsMatcher: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSOrganizationUnitsMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Include", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Include = append(m.Include, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Exclude", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Exclude = append(m.Exclude, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -142131,13 +153619,283 @@ func (m *InstallerParams) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PublicProxyAddr = string(dAtA[iNdEx:postIndex])
+			m.PublicProxyAddr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Azure", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Azure == nil {
+				m.Azure = &AzureInstallerParams{}
+			}
+			if err := m.Azure.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnrollMode", wireType)
+			}
+			m.EnrollMode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.EnrollMode |= InstallParamEnrollMode(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Suffix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Suffix = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdateGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UpdateGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HTTPProxySettings", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.HTTPProxySettings == nil {
+				m.HTTPProxySettings = &HTTPProxySettings{}
+			}
+			if err := m.HTTPProxySettings.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *HTTPProxySettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: HTTPProxySettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: HTTPProxySettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HTTPProxy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HTTPProxy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HTTPSProxy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HTTPSProxy = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Azure", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NoProxy", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -142147,47 +153905,24 @@ func (m *InstallerParams) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Azure == nil {
-				m.Azure = &AzureInstallerParams{}
-			}
-			if err := m.Azure.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.NoProxy = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EnrollMode", wireType)
-			}
-			m.EnrollMode = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.EnrollMode |= InstallParamEnrollMode(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -142602,6 +154337,38 @@ func (m *AzureMatcher) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Integration", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Integration = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -142928,17 +154695,235 @@ func (m *KubernetesMatcher) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: KubernetesMatcher: wiretype end group for non-group")
+			return fmt.Errorf("proto: KubernetesMatcher: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Types", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Types = append(m.Types, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespaces", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespaces = append(m.Namespaces, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Labels.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriod", wireType)
+			}
+			m.SyncPeriod = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SyncPeriod |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessGraphSync: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: KubernetesMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessGraphSync: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Types", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AWS", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -142948,29 +154933,31 @@ func (m *KubernetesMatcher) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Types = append(m.Types, string(dAtA[iNdEx:postIndex]))
+			m.AWS = append(m.AWS, &AccessGraphAWSSync{})
+			if err := m.AWS[len(m.AWS)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Namespaces", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PollInterval", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -142980,27 +154967,28 @@ func (m *KubernetesMatcher) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Namespaces = append(m.Namespaces, string(dAtA[iNdEx:postIndex]))
+			if err := github_com_gogo_protobuf_types.StdDurationUnmarshal(&m.PollInterval, dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Azure", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -143027,7 +155015,8 @@ func (m *KubernetesMatcher) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Labels.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Azure = append(m.Azure, &AccessGraphAzureSync{})
+			if err := m.Azure[len(m.Azure)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -143053,77 +155042,7 @@ func (m *KubernetesMatcher) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaOptions) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: OktaOptions: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaOptions: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriod", wireType)
-			}
-			m.SyncPeriod = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.SyncPeriod |= Duration(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
+func (m *AccessGraphAWSSyncCloudTrailLogs) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -143146,17 +155065,17 @@ func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessGraphSync: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessGraphAWSSyncCloudTrailLogs: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessGraphSync: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessGraphAWSSyncCloudTrailLogs: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWS", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -143166,64 +155085,29 @@ func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AWS = append(m.AWS, &AccessGraphAWSSync{})
-			if err := m.AWS[len(m.AWS)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Region = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PollInterval", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := github_com_gogo_protobuf_types.StdDurationUnmarshal(&m.PollInterval, dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Azure", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SQSQueue", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -143233,25 +155117,23 @@ func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Azure = append(m.Azure, &AccessGraphAzureSync{})
-			if err := m.Azure[len(m.Azure)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SQSQueue = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -143275,7 +155157,7 @@ func (m *AccessGraphSync) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AccessGraphAWSSyncCloudTrailLogs) Unmarshal(dAtA []byte) error {
+func (m *AccessGraphAWSSyncEKSAuditLogs) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -143298,17 +155180,17 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AccessGraphAWSSyncCloudTrailLogs: wiretype end group for non-group")
+			return fmt.Errorf("proto: AccessGraphAWSSyncEKSAuditLogs: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AccessGraphAWSSyncCloudTrailLogs: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AccessGraphAWSSyncEKSAuditLogs: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tags", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -143318,55 +155200,24 @@ func (m *AccessGraphAWSSyncCloudTrailLogs) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Region = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SQSQueue", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.Tags.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.SQSQueue = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -143555,6 +155406,42 @@ func (m *AccessGraphAWSSync) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EksAuditLogs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.EksAuditLogs == nil {
+				m.EksAuditLogs = &AccessGraphAWSSyncEKSAuditLogs{}
+			}
+			if err := m.EksAuditLogs.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
diff --git a/api/types/user.go b/api/types/user.go
index 4005465989ea6..610b45b98459f 100644
--- a/api/types/user.go
+++ b/api/types/user.go
@@ -44,6 +44,10 @@ func (f *UserFilter) Match(user *UserV2) bool {
 		}
 	}
 
+	if f.SkipSystemUsers && IsSystemResource(user) {
+		return false
+	}
+
 	return true
 }
 
@@ -59,6 +63,8 @@ type User interface {
 	GetOIDCIdentities() []ExternalIdentity
 	// GetSAMLIdentities returns a list of connected SAML identities
 	GetSAMLIdentities() []ExternalIdentity
+	// SetSAMLIdentities sets a list of connected SAML identities
+	SetSAMLIdentities([]ExternalIdentity)
 	// GetGithubIdentities returns a list of connected Github identities
 	GetGithubIdentities() []ExternalIdentity
 	// SetGithubIdentities sets the list of connected GitHub identities
@@ -123,6 +129,10 @@ type User interface {
 	SetHostUserUID(uid string)
 	// SetHostUserGID sets the GID for host users
 	SetHostUserGID(gid string)
+	// SetMCPTools sets a list of allowed MCP tools for the user
+	SetMCPTools(mcpTools []string)
+	// SetDefaultRelayAddr sets the trait for the default relay address.
+	SetDefaultRelayAddr(addr string)
 	// GetCreatedBy returns information about user
 	GetCreatedBy() CreatedBy
 	// SetCreatedBy sets created by information
@@ -417,6 +427,23 @@ func (u *UserV2) SetHostUserGID(uid string) {
 	u.setTrait(constants.TraitHostUserGID, []string{uid})
 }
 
+// SetMCPTools sets a list of allowed MCP tools for the user
+func (u *UserV2) SetMCPTools(mcpTools []string) {
+	u.setTrait(constants.TraitMCPTools, mcpTools)
+}
+
+// SetDefaultRelayAddr implements [User].
+func (u *UserV2) SetDefaultRelayAddr(addr string) {
+	if addr == "" {
+		delete(u.Spec.Traits, constants.TraitDefaultRelayAddr)
+		return
+	}
+	if u.Spec.Traits == nil {
+		u.Spec.Traits = make(map[string][]string)
+	}
+	u.Spec.Traits[constants.TraitDefaultRelayAddr] = []string{addr}
+}
+
 // GetStatus returns login status of the user
 func (u *UserV2) GetStatus() LoginStatus {
 	return u.Spec.Status
@@ -432,6 +459,11 @@ func (u *UserV2) GetSAMLIdentities() []ExternalIdentity {
 	return u.Spec.SAMLIdentities
 }
 
+// SetSAMLIdentities sets a list of connected SAML identities
+func (u *UserV2) SetSAMLIdentities(identities []ExternalIdentity) {
+	u.Spec.SAMLIdentities = identities
+}
+
 // GetGithubIdentities returns a list of connected Github identities
 func (u *UserV2) GetGithubIdentities() []ExternalIdentity {
 	return u.Spec.GithubIdentities
diff --git a/api/types/userloginstate/convert/v1/user_login_state.go b/api/types/userloginstate/convert/v1/user_login_state.go
index 91c423ab10ed2..1b38b209578cc 100644
--- a/api/types/userloginstate/convert/v1/user_login_state.go
+++ b/api/types/userloginstate/convert/v1/user_login_state.go
@@ -32,13 +32,16 @@ func FromProto(msg *userloginstatev1.UserLoginState) (*userloginstate.UserLoginS
 		return nil, trace.BadParameter("spec is missing")
 	}
 
-	uls, err := userloginstate.New(headerv1.FromMetadataProto(msg.Header.Metadata), userloginstate.Spec{
-		OriginalRoles:  msg.Spec.GetOriginalRoles(),
-		OriginalTraits: traitv1.FromProto(msg.Spec.OriginalTraits),
-		Roles:          msg.Spec.Roles,
-		Traits:         traitv1.FromProto(msg.Spec.Traits),
-		UserType:       types.UserType(msg.Spec.UserType),
-		GitHubIdentity: externalIdentityFromProto(msg.Spec.GitHubIdentity),
+	uls, err := userloginstate.New(headerv1.FromMetadataProto(msg.GetHeader().GetMetadata()), userloginstate.Spec{
+		OriginalRoles:    msg.GetSpec().GetOriginalRoles(),
+		OriginalTraits:   traitv1.FromProto(msg.GetSpec().GetOriginalTraits()),
+		AccessListRoles:  msg.GetSpec().GetAccessListRoles(),
+		AccessListTraits: traitv1.FromProto(msg.GetSpec().GetAccessListTraits()),
+		Roles:            msg.GetSpec().GetRoles(),
+		Traits:           traitv1.FromProto(msg.GetSpec().GetTraits()),
+		UserType:         types.UserType(msg.GetSpec().GetUserType()),
+		GitHubIdentity:   externalIdentityFromProto(msg.GetSpec().GetGitHubIdentity()),
+		SAMLIdentities:   externalIdentitiesFromProto(msg.GetSpec().GetSamlIdentities()),
 	})
 
 	return uls, trace.Wrap(err)
@@ -49,12 +52,15 @@ func ToProto(uls *userloginstate.UserLoginState) *userloginstatev1.UserLoginStat
 	return &userloginstatev1.UserLoginState{
 		Header: headerv1.ToResourceHeaderProto(uls.ResourceHeader),
 		Spec: &userloginstatev1.Spec{
-			OriginalRoles:  uls.GetOriginalRoles(),
-			OriginalTraits: traitv1.ToProto(uls.GetOriginalTraits()),
-			Roles:          uls.GetRoles(),
-			Traits:         traitv1.ToProto(uls.GetTraits()),
-			UserType:       string(uls.Spec.UserType),
-			GitHubIdentity: externalIdentityToProto(uls.Spec.GitHubIdentity),
+			OriginalRoles:    uls.GetOriginalRoles(),
+			OriginalTraits:   traitv1.ToProto(uls.GetOriginalTraits()),
+			AccessListRoles:  uls.GetAccessListRoles(),
+			AccessListTraits: traitv1.ToProto(uls.GetAccessListTraits()),
+			Roles:            uls.GetRoles(),
+			Traits:           traitv1.ToProto(uls.GetTraits()),
+			UserType:         string(uls.Spec.UserType),
+			GitHubIdentity:   externalIdentityToProto(uls.Spec.GitHubIdentity),
+			SamlIdentities:   externalIdentitiesToProto(uls.Spec.SAMLIdentities),
 		},
 	}
 }
@@ -62,19 +68,41 @@ func ToProto(uls *userloginstate.UserLoginState) *userloginstatev1.UserLoginStat
 func externalIdentityFromProto(identity *userloginstatev1.ExternalIdentity) *userloginstate.ExternalIdentity {
 	if identity != nil {
 		return &userloginstate.ExternalIdentity{
-			UserID:   identity.UserId,
-			Username: identity.Username,
+			ConnectorID:   identity.ConnectorId,
+			UserID:        identity.UserId,
+			Username:      identity.Username,
+			GrantedRoles:  identity.GrantedRoles,
+			GrantedTraits: traitv1.FromProto(identity.GrantedTraits),
 		}
 	}
 	return nil
 }
 
+func externalIdentitiesFromProto(identities []*userloginstatev1.ExternalIdentity) []userloginstate.ExternalIdentity {
+	var res []userloginstate.ExternalIdentity
+	for _, identity := range identities {
+		res = append(res, *externalIdentityFromProto(identity))
+	}
+	return res
+}
+
 func externalIdentityToProto(identity *userloginstate.ExternalIdentity) *userloginstatev1.ExternalIdentity {
 	if identity != nil {
 		return &userloginstatev1.ExternalIdentity{
-			UserId:   identity.UserID,
-			Username: identity.Username,
+			ConnectorId:   identity.ConnectorID,
+			UserId:        identity.UserID,
+			Username:      identity.Username,
+			GrantedRoles:  identity.GrantedRoles,
+			GrantedTraits: traitv1.ToProto(identity.GrantedTraits),
 		}
 	}
 	return nil
 }
+
+func externalIdentitiesToProto(identities []userloginstate.ExternalIdentity) []*userloginstatev1.ExternalIdentity {
+	var res []*userloginstatev1.ExternalIdentity
+	for _, identity := range identities {
+		res = append(res, externalIdentityToProto(&identity))
+	}
+	return res
+}
diff --git a/api/types/userloginstate/derived.gen.go b/api/types/userloginstate/derived.gen.go
new file mode 100644
index 0000000000000..f21a22821a324
--- /dev/null
+++ b/api/types/userloginstate/derived.gen.go
@@ -0,0 +1,360 @@
+// Code generated by goderive DO NOT EDIT.
+
+package userloginstate
+
+import (
+	header "github.com/gravitational/teleport/api/types/header"
+	"time"
+)
+
+// deriveTeleportEqualUserLoginState returns whether this and that are equal.
+func deriveTeleportEqualUserLoginState(this, that *UserLoginState) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual(&this.ResourceHeader, &that.ResourceHeader) &&
+			deriveTeleportEqual_(&this.Spec, &that.Spec)
+}
+
+// deriveDeepCopyUserLoginState recursively copies the contents of src into dst.
+func deriveDeepCopyUserLoginState(dst, src *UserLoginState) {
+	func() {
+		field := new(header.ResourceHeader)
+		deriveDeepCopy(field, &src.ResourceHeader)
+		dst.ResourceHeader = *field
+	}()
+	func() {
+		field := new(Spec)
+		deriveDeepCopy_(field, &src.Spec)
+		dst.Spec = *field
+	}()
+}
+
+// deriveTeleportEqual returns whether this and that are equal.
+func deriveTeleportEqual(this, that *header.ResourceHeader) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Kind == that.Kind &&
+			this.SubKind == that.SubKind &&
+			this.Version == that.Version &&
+			deriveTeleportEqual_1(&this.Metadata, &that.Metadata)
+}
+
+// deriveTeleportEqual_ returns whether this and that are equal.
+func deriveTeleportEqual_(this, that *Spec) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.OriginalRoles, that.OriginalRoles) &&
+			deriveTeleportEqual_3(this.OriginalTraits, that.OriginalTraits) &&
+			deriveTeleportEqual_2(this.Roles, that.Roles) &&
+			deriveTeleportEqual_3(this.Traits, that.Traits) &&
+			deriveTeleportEqual_2(this.AccessListRoles, that.AccessListRoles) &&
+			deriveTeleportEqual_3(this.AccessListTraits, that.AccessListTraits) &&
+			this.UserType == that.UserType &&
+			deriveTeleportEqual_4(this.GitHubIdentity, that.GitHubIdentity) &&
+			deriveTeleportEqual_5(this.SAMLIdentities, that.SAMLIdentities)
+}
+
+// deriveDeepCopy recursively copies the contents of src into dst.
+func deriveDeepCopy(dst, src *header.ResourceHeader) {
+	dst.Kind = src.Kind
+	dst.SubKind = src.SubKind
+	dst.Version = src.Version
+	func() {
+		field := new(header.Metadata)
+		deriveDeepCopy_1(field, &src.Metadata)
+		dst.Metadata = *field
+	}()
+}
+
+// deriveDeepCopy_ recursively copies the contents of src into dst.
+func deriveDeepCopy_(dst, src *Spec) {
+	if src.OriginalRoles == nil {
+		dst.OriginalRoles = nil
+	} else {
+		if dst.OriginalRoles != nil {
+			if len(src.OriginalRoles) > len(dst.OriginalRoles) {
+				if cap(dst.OriginalRoles) >= len(src.OriginalRoles) {
+					dst.OriginalRoles = (dst.OriginalRoles)[:len(src.OriginalRoles)]
+				} else {
+					dst.OriginalRoles = make([]string, len(src.OriginalRoles))
+				}
+			} else if len(src.OriginalRoles) < len(dst.OriginalRoles) {
+				dst.OriginalRoles = (dst.OriginalRoles)[:len(src.OriginalRoles)]
+			}
+		} else {
+			dst.OriginalRoles = make([]string, len(src.OriginalRoles))
+		}
+		copy(dst.OriginalRoles, src.OriginalRoles)
+	}
+	if src.OriginalTraits != nil {
+		dst.OriginalTraits = make(map[string][]string, len(src.OriginalTraits))
+		deriveDeepCopy_2(dst.OriginalTraits, src.OriginalTraits)
+	} else {
+		dst.OriginalTraits = nil
+	}
+	if src.Roles == nil {
+		dst.Roles = nil
+	} else {
+		if dst.Roles != nil {
+			if len(src.Roles) > len(dst.Roles) {
+				if cap(dst.Roles) >= len(src.Roles) {
+					dst.Roles = (dst.Roles)[:len(src.Roles)]
+				} else {
+					dst.Roles = make([]string, len(src.Roles))
+				}
+			} else if len(src.Roles) < len(dst.Roles) {
+				dst.Roles = (dst.Roles)[:len(src.Roles)]
+			}
+		} else {
+			dst.Roles = make([]string, len(src.Roles))
+		}
+		copy(dst.Roles, src.Roles)
+	}
+	if src.Traits != nil {
+		dst.Traits = make(map[string][]string, len(src.Traits))
+		deriveDeepCopy_2(dst.Traits, src.Traits)
+	} else {
+		dst.Traits = nil
+	}
+	if src.AccessListRoles == nil {
+		dst.AccessListRoles = nil
+	} else {
+		if dst.AccessListRoles != nil {
+			if len(src.AccessListRoles) > len(dst.AccessListRoles) {
+				if cap(dst.AccessListRoles) >= len(src.AccessListRoles) {
+					dst.AccessListRoles = (dst.AccessListRoles)[:len(src.AccessListRoles)]
+				} else {
+					dst.AccessListRoles = make([]string, len(src.AccessListRoles))
+				}
+			} else if len(src.AccessListRoles) < len(dst.AccessListRoles) {
+				dst.AccessListRoles = (dst.AccessListRoles)[:len(src.AccessListRoles)]
+			}
+		} else {
+			dst.AccessListRoles = make([]string, len(src.AccessListRoles))
+		}
+		copy(dst.AccessListRoles, src.AccessListRoles)
+	}
+	if src.AccessListTraits != nil {
+		dst.AccessListTraits = make(map[string][]string, len(src.AccessListTraits))
+		deriveDeepCopy_2(dst.AccessListTraits, src.AccessListTraits)
+	} else {
+		dst.AccessListTraits = nil
+	}
+	dst.UserType = src.UserType
+	if src.GitHubIdentity == nil {
+		dst.GitHubIdentity = nil
+	} else {
+		dst.GitHubIdentity = new(ExternalIdentity)
+		deriveDeepCopy_3(dst.GitHubIdentity, src.GitHubIdentity)
+	}
+	if src.SAMLIdentities == nil {
+		dst.SAMLIdentities = nil
+	} else {
+		if dst.SAMLIdentities != nil {
+			if len(src.SAMLIdentities) > len(dst.SAMLIdentities) {
+				if cap(dst.SAMLIdentities) >= len(src.SAMLIdentities) {
+					dst.SAMLIdentities = (dst.SAMLIdentities)[:len(src.SAMLIdentities)]
+				} else {
+					dst.SAMLIdentities = make([]ExternalIdentity, len(src.SAMLIdentities))
+				}
+			} else if len(src.SAMLIdentities) < len(dst.SAMLIdentities) {
+				dst.SAMLIdentities = (dst.SAMLIdentities)[:len(src.SAMLIdentities)]
+			}
+		} else {
+			dst.SAMLIdentities = make([]ExternalIdentity, len(src.SAMLIdentities))
+		}
+		deriveDeepCopy_4(dst.SAMLIdentities, src.SAMLIdentities)
+	}
+}
+
+// deriveTeleportEqual_1 returns whether this and that are equal.
+func deriveTeleportEqual_1(this, that *header.Metadata) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Name == that.Name &&
+			this.Description == that.Description &&
+			deriveTeleportEqual_6(this.Labels, that.Labels) &&
+			this.Expires.Equal(that.Expires)
+}
+
+// deriveTeleportEqual_2 returns whether this and that are equal.
+func deriveTeleportEqual_2(this, that []string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i] == that[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_3 returns whether this and that are equal.
+func deriveTeleportEqual_3(this, that map[string][]string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for k, v := range this {
+		thatv, ok := that[k]
+		if !ok {
+			return false
+		}
+		if !(deriveTeleportEqual_2(v, thatv)) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_4 returns whether this and that are equal.
+func deriveTeleportEqual_4(this, that *ExternalIdentity) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.ConnectorID == that.ConnectorID &&
+			this.UserID == that.UserID &&
+			this.Username == that.Username &&
+			deriveTeleportEqual_2(this.GrantedRoles, that.GrantedRoles) &&
+			deriveTeleportEqual_3(this.GrantedTraits, that.GrantedTraits)
+}
+
+// deriveTeleportEqual_5 returns whether this and that are equal.
+func deriveTeleportEqual_5(this, that []ExternalIdentity) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_4(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveDeepCopy_1 recursively copies the contents of src into dst.
+func deriveDeepCopy_1(dst, src *header.Metadata) {
+	dst.Name = src.Name
+	dst.Description = src.Description
+	if src.Labels != nil {
+		dst.Labels = make(map[string]string, len(src.Labels))
+		deriveDeepCopy_5(dst.Labels, src.Labels)
+	} else {
+		dst.Labels = nil
+	}
+	func() {
+		field := new(time.Time)
+		deriveDeepCopy_6(field, &src.Expires)
+		dst.Expires = *field
+	}()
+	dst.Revision = src.Revision
+}
+
+// deriveDeepCopy_2 recursively copies the contents of src into dst.
+func deriveDeepCopy_2(dst, src map[string][]string) {
+	for src_key, src_value := range src {
+		if src_value == nil {
+			dst[src_key] = nil
+		}
+		if src_value == nil {
+			dst[src_key] = nil
+		} else {
+			if dst[src_key] != nil {
+				if len(src_value) > len(dst[src_key]) {
+					if cap(dst[src_key]) >= len(src_value) {
+						dst[src_key] = (dst[src_key])[:len(src_value)]
+					} else {
+						dst[src_key] = make([]string, len(src_value))
+					}
+				} else if len(src_value) < len(dst[src_key]) {
+					dst[src_key] = (dst[src_key])[:len(src_value)]
+				}
+			} else {
+				dst[src_key] = make([]string, len(src_value))
+			}
+			copy(dst[src_key], src_value)
+		}
+	}
+}
+
+// deriveDeepCopy_3 recursively copies the contents of src into dst.
+func deriveDeepCopy_3(dst, src *ExternalIdentity) {
+	dst.ConnectorID = src.ConnectorID
+	dst.UserID = src.UserID
+	dst.Username = src.Username
+	if src.GrantedRoles == nil {
+		dst.GrantedRoles = nil
+	} else {
+		if dst.GrantedRoles != nil {
+			if len(src.GrantedRoles) > len(dst.GrantedRoles) {
+				if cap(dst.GrantedRoles) >= len(src.GrantedRoles) {
+					dst.GrantedRoles = (dst.GrantedRoles)[:len(src.GrantedRoles)]
+				} else {
+					dst.GrantedRoles = make([]string, len(src.GrantedRoles))
+				}
+			} else if len(src.GrantedRoles) < len(dst.GrantedRoles) {
+				dst.GrantedRoles = (dst.GrantedRoles)[:len(src.GrantedRoles)]
+			}
+		} else {
+			dst.GrantedRoles = make([]string, len(src.GrantedRoles))
+		}
+		copy(dst.GrantedRoles, src.GrantedRoles)
+	}
+	if src.GrantedTraits != nil {
+		dst.GrantedTraits = make(map[string][]string, len(src.GrantedTraits))
+		deriveDeepCopy_2(dst.GrantedTraits, src.GrantedTraits)
+	} else {
+		dst.GrantedTraits = nil
+	}
+}
+
+// deriveDeepCopy_4 recursively copies the contents of src into dst.
+func deriveDeepCopy_4(dst, src []ExternalIdentity) {
+	for src_i, src_value := range src {
+		func() {
+			field := new(ExternalIdentity)
+			deriveDeepCopy_3(field, &src_value)
+			dst[src_i] = *field
+		}()
+	}
+}
+
+// deriveTeleportEqual_6 returns whether this and that are equal.
+func deriveTeleportEqual_6(this, that map[string]string) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for k, v := range this {
+		thatv, ok := that[k]
+		if !ok {
+			return false
+		}
+		if !(v == thatv) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveDeepCopy_5 recursively copies the contents of src into dst.
+func deriveDeepCopy_5(dst, src map[string]string) {
+	for src_key, src_value := range src {
+		dst[src_key] = src_value
+	}
+}
+
+// deriveDeepCopy_6 recursively copies the contents of src into dst.
+func deriveDeepCopy_6(dst, src *time.Time) {
+	*dst = *src
+}
diff --git a/api/types/userloginstate/user_login_state.go b/api/types/userloginstate/user_login_state.go
index e649c31f035f9..79f67ace589bd 100644
--- a/api/types/userloginstate/user_login_state.go
+++ b/api/types/userloginstate/user_login_state.go
@@ -23,7 +23,6 @@ import (
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/header/convert/legacy"
 	"github.com/gravitational/teleport/api/types/trait"
-	"github.com/gravitational/teleport/api/utils"
 )
 
 // UserLoginState is the ephemeral user login state. This will hold data to differentiate
@@ -42,32 +41,75 @@ type UserLoginState struct {
 
 // Spec is the specification for the user login state.
 type Spec struct {
-	// OriginalRoles is the list of the original roles from the user login state.
+	// OriginalRoles are the user roles that are part of the user's static definition. These roles
+	// are not affected by access granted by access lists and are obtained prior to granting access
+	// list access. Basically, [OriginalRoles] = [Roles] - [AccessListRoles].
 	OriginalRoles []string `json:"original_roles" yaml:"original_roles"`
 
-	// OriginalTraits is the list of the original traits from the user login state.
+	// OriginalTraits are the user traits that are part of the user's static definition. These
+	// traits are not affected by access granted by access lists and are obtained prior to granting
+	// access list access. Basically, [OriginalTraits] = [Traits] - [AccessListTraits].
 	OriginalTraits trait.Traits `json:"original_traits" yaml:"original_traits"`
 
-	// Roles is the list of roles attached to the user login state.
+	// Roles are the user roles attached to the user. Basically, [Roles] = [OriginalRoles] +
+	// [AccessListRoles].
 	Roles []string `json:"roles" yaml:"roles"`
 
-	// Traits are the traits attached to the user login state.
+	// Traits are the traits attached to the user. Basically, [roles] = [original_traits] +
+	// [access_list_traits].
 	Traits trait.Traits `json:"traits" yaml:"traits"`
 
+	// AccessListRoles are roles granted to this user by the Access Lists
+	// membership/ownership.  Basically, [AccessListRoles] = [Roles] - [OriginalRoles].
+	AccessListRoles []string `json:"access_list_roles,omitempty" yaml:"access_list_roles"`
+
+	// AccessListTraits are traits granted to this user by the Access Lists membership/ownership.
+	// Basically, [AccessListTraits] = [Traits] - [OriginalTraits].
+	AccessListTraits trait.Traits `json:"access_list_traits" yaml:"access_list_traits"`
+
 	// UserType is the type of user that this state represents.
 	UserType types.UserType `json:"user_type" yaml:"user_type"`
 
 	// GitHubIdentity is user's attached GitHub identity
 	GitHubIdentity *ExternalIdentity `json:"github_identity,omitempty" yaml:"github_identity"`
+
+	// SAMLIdentities are the identities created from the SAML connectors used to log in by
+	// this user name.
+	//
+	// NOTE: There is no mechanism to clean those identities. If the the user is deleted, the
+	// user_login_state and it's saml_identities will not be deleted. Or even if the user still
+	// exists, but it's SAML identity expires it isn't cleared from the user_login_state. This means
+	// the information stored here can be used only as long as there is a background sync running and
+	// making sure the user's info is up-to-date. E.g. Okta assignment creator is using this
+	// information, but it is running only when Okta user sync is active and periodically updates the
+	// user which in turn updates the user_login_state.
+	//
+	// NOTE2: This field isn't currently used. It's introduced so we can resolve the
+	// https://github.com/gravitational/teleport.e/issues/6723 issue in stages.
+	// The STAGE 1 is to introduce this field and give enough time to get existing Teleport
+	// installations to get updated and populate this field.
+	// The STAGE 2 is in the v19 release (or maybe even v20) to deploy the actual fix PR
+	// (https://github.com/gravitational/teleport.e/pull/7168) reading this field and calculating
+	// access to Okta resources. See more details in the description of the fix PR.
+	//
+	// TODO(kopiczko) v19: consider proceeding with the STAGE 2 described above.
+	SAMLIdentities []ExternalIdentity `json:"saml_identities,omitempty" yaml:"saml_identities"`
 }
 
 // ExternalIdentity defines an external identity attached to this user state.
 type ExternalIdentity struct {
+	// ConnectorID is the connector this identity was created with. It's empty for the local
+	// user.
+	ConnectorID string
 	// UserId is the unique identifier of the external identity such as GitHub
 	// user ID.
 	UserID string
 	// Username is the username of the external identity.
 	Username string
+	// GrantedRoles specific for this identity. E.g.: from connector attributes mapping.
+	GrantedRoles []string
+	// GrantedTraits specific for this identity. E.g.: from connector roles attributes mapping.
+	GrantedTraits trait.Traits
 }
 
 // New creates a new user login state.
@@ -102,31 +144,55 @@ func (u *UserLoginState) CheckAndSetDefaults() error {
 
 // Clone returns a copy of the member.
 func (u *UserLoginState) Clone() *UserLoginState {
-	var copy *UserLoginState
-	utils.StrictObjectToStruct(u, &copy)
-	return copy
+	if u == nil {
+		return nil
+	}
+	out := &UserLoginState{}
+	deriveDeepCopyUserLoginState(out, u)
+	return out
 }
 
-// GetOriginalRoles returns the original roles that the user login state was derived from.
+// IsEqual compares two user login states for equality.
+func (u *UserLoginState) IsEqual(i *UserLoginState) bool {
+	return deriveTeleportEqualUserLoginState(u, i)
+}
+
+// GetOriginalRoles returns the original roles that the user login state was derived from. It's the
+// same as GetRoles() - GetOriginalRoles().
 func (u *UserLoginState) GetOriginalRoles() []string {
 	return u.Spec.OriginalRoles
 }
 
-// GetOriginalTraits returns the original traits that the user login state was derived from.
+// GetOriginalTraits returns the original traits that the user login state was derived from. It's
+// the same as GetTraits() - GetAccessListTraits().
 func (u *UserLoginState) GetOriginalTraits() map[string][]string {
 	return u.Spec.OriginalTraits
 }
 
-// GetRoles returns the roles attached to the user login state.
+// GetRoles returns the roles attached to the user login state. It's the same as GetOriginalRoles()
+// + GetAccessListRoles().
 func (u *UserLoginState) GetRoles() []string {
 	return u.Spec.Roles
 }
 
-// GetTraits returns the traits attached to the user login state.
+// GetTraits returns the traits attached to the user login state. It's the same as
+// GetOriginalTraits() + GetAccessListTraits().
 func (u *UserLoginState) GetTraits() map[string][]string {
 	return u.Spec.Traits
 }
 
+// GetAccessListRoles returns roles granted to this user by the Access Lists membership/ownership.
+// It's the same as GetRoles() - GetOriginalRoles().
+func (u *UserLoginState) GetAccessListRoles() []string {
+	return u.Spec.AccessListRoles
+}
+
+// GetAccessListTraits returns traits granted to this user by the Access Lists
+// membership/ownership. It's the same as GetTraits() - GetOriginalTraits().
+func (u *UserLoginState) GetAccessListTraits() map[string][]string {
+	return u.Spec.AccessListTraits
+}
+
 // GetUserType returns the user type for the user login state.
 func (u *UserLoginState) GetUserType() types.UserType {
 	return u.Spec.UserType
diff --git a/api/types/wrappers/wrappers.go b/api/types/wrappers/wrappers.go
index c84a62420c7b0..7de3c632fc8d9 100644
--- a/api/types/wrappers/wrappers.go
+++ b/api/types/wrappers/wrappers.go
@@ -19,6 +19,7 @@ package wrappers
 
 import (
 	"encoding/json"
+	"slices"
 
 	"github.com/gogo/protobuf/proto"
 	"github.com/gravitational/trace"
@@ -58,6 +59,21 @@ func UnmarshalTraits(data []byte, traits *Traits) error {
 	return nil
 }
 
+// Clone returns a copy of the Traits map.
+func (l Traits) Clone() Traits {
+	if l == nil {
+		return nil
+	}
+	clone := make(Traits, len(l))
+	for key, vals := range l {
+		if len(vals) == 0 || len(vals) == 1 && vals[0] == "" {
+			continue
+		}
+		clone[key] = slices.Clone(vals)
+	}
+	return clone
+}
+
 // Marshal marshals value into protobuf representation
 func (l Traits) Marshal() ([]byte, error) {
 	return proto.Marshal(l.protoType())
diff --git a/api/utils/aws/endpoint.go b/api/utils/aws/endpoint.go
index 315658234c56b..c5d677c79af2a 100644
--- a/api/utils/aws/endpoint.go
+++ b/api/utils/aws/endpoint.go
@@ -58,7 +58,15 @@ func IsRedshiftServerlessEndpoint(uri string) bool {
 // IsElastiCacheEndpoint returns true if the input URI is an ElastiCache
 // endpoint.
 func IsElastiCacheEndpoint(uri string) bool {
-	return isAWSServiceEndpoint(uri, ElastiCacheServiceName)
+	_, err := ParseElastiCacheEndpoint(uri)
+	return err == nil
+}
+
+// IsElastiCacheServerlessEndpoint returns true if the input URI is an ElastiCacheServerless
+// endpoint.
+func IsElastiCacheServerlessEndpoint(uri string) bool {
+	_, err := ParseElastiCacheServerlessEndpoint(uri)
+	return err == nil
 }
 
 // IsMemoryDBEndpoint returns true if the input URI is an MemoryDB
@@ -556,6 +564,58 @@ func trimElastiCacheShardAndNodeID(input string) string {
 	return strings.Join(parts, "-")
 }
 
+// ParseElastiCacheServerlessEndpoint extracts the details from the provided
+// ElastiCacheServerless Redis endpoint, which should be in the form
+// <cache_name>.serverless.<region>.cache.amazonaws.com:<port>
+func ParseElastiCacheServerlessEndpoint(endpoint string) (*RedisEndpointInfo, error) {
+	endpoint, err := removeSchemaAndPort(endpoint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Remove partition suffix. Note that endpoints for CN regions use the same
+	// format except they end with AWSCNEndpointSuffix.
+	endpointWithoutSuffix, _, err := removePartitionSuffix(endpoint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Split into parts to extract details. They look like this in general:
+	//   <cache_name>.serverless.<short-region>.cache
+	//
+	// Note that ElastiCache uses short region codes like "use1".
+	const (
+		nameIdx = iota
+		serverlessIdx
+		shortRegionIdx
+		svcIdx
+		numParts
+	)
+	parts := strings.Split(endpointWithoutSuffix, ".")
+	if len(parts) != numParts || parts[serverlessIdx] != "serverless" || parts[svcIdx] != ElastiCacheServiceName {
+		return nil, trace.BadParameter("unknown ElastiCache Redis endpoint format %q", endpoint)
+	}
+
+	region, ok := ShortRegionToRegion(parts[shortRegionIdx])
+	if !ok {
+		return nil, trace.BadParameter("%v is not a valid region", parts[shortRegionIdx])
+	}
+
+	// Configuration endpoint for Redis with TLS disabled looks like:
+	// example-<randomhex>.serverless.cac1.cache.amazonaws.com:6379
+	info := &RedisEndpointInfo{
+		ID:                       parts[nameIdx],
+		Region:                   region,
+		TransitEncryptionEnabled: true,
+		EndpointType:             ElastiCacheConfigurationEndpoint,
+	}
+	nameParts := strings.Split(info.ID, "-")
+	if len(nameParts) > 1 {
+		info.ID = strings.Join(nameParts[:len(nameParts)-1], "-")
+	}
+	return info, nil
+}
+
 // ParseMemoryDBEndpoint extracts the details from the provided
 // MemoryDB endpoint.
 //
diff --git a/api/utils/aws/endpoint_test.go b/api/utils/aws/endpoint_test.go
index 51c408fb54d12..82efc20ed9541 100644
--- a/api/utils/aws/endpoint_test.go
+++ b/api/utils/aws/endpoint_test.go
@@ -322,6 +322,73 @@ func TestParseElastiCacheEndpoint(t *testing.T) {
 	}
 }
 
+func TestParseElastiCacheServerlessEndpoint(t *testing.T) {
+	tests := []struct {
+		name        string
+		inputURI    string
+		expectInfo  *RedisEndpointInfo
+		expectError bool
+	}{
+		{
+			name:     "normal endpoint",
+			inputURI: "example-asdf123.serverless.cac1.cache.amazonaws.com:6379",
+			expectInfo: &RedisEndpointInfo{
+				ID:                       "example",
+				Region:                   "ca-central-1",
+				TransitEncryptionEnabled: true,
+				EndpointType:             ElastiCacheConfigurationEndpoint,
+			},
+		},
+		{
+			name:     "CN endpoint",
+			inputURI: "example-asdf123.serverless.cnn1.cache.amazonaws.com.cn:6379",
+			expectInfo: &RedisEndpointInfo{
+				ID:                       "example",
+				Region:                   "cn-north-1",
+				TransitEncryptionEnabled: true,
+				EndpointType:             ElastiCacheConfigurationEndpoint,
+			},
+		},
+		{
+			name:     "endpoint with schema and parameters",
+			inputURI: "redis://example-asdf123.serverless.cac1.cache.amazonaws.com:6379?a=b&c=d",
+			expectInfo: &RedisEndpointInfo{
+				ID:                       "example",
+				Region:                   "ca-central-1",
+				TransitEncryptionEnabled: true,
+				EndpointType:             ElastiCacheConfigurationEndpoint,
+			},
+		},
+		{
+			name:        "invalid suffix",
+			inputURI:    "example.serverless.cac1.cache.amazonaws.io:6379",
+			expectError: true,
+		},
+		{
+			name:        "invalid url",
+			inputURI:    "://example.serverless.cac1.cache.amazonaws.com:6379",
+			expectError: true,
+		},
+		{
+			name:        "invalid format",
+			inputURI:    "example.serverless.cache.amazonaws.com:6379",
+			expectError: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actualInfo, err := ParseElastiCacheServerlessEndpoint(test.inputURI)
+			if test.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, test.expectInfo, actualInfo)
+			}
+		})
+	}
+}
+
 func TestParseMemoryDBEndpoint(t *testing.T) {
 	t.Parallel()
 
diff --git a/api/utils/aws/fuzz_test.go b/api/utils/aws/fuzz_test.go
index c65d018119ec3..fa37cc0b7761e 100644
--- a/api/utils/aws/fuzz_test.go
+++ b/api/utils/aws/fuzz_test.go
@@ -91,6 +91,24 @@ func FuzzParseElastiCacheEndpoint(f *testing.F) {
 	})
 }
 
+func FuzzParseElastiCacheServerlessEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add("cache.b.c.usnw1.amazonaws.com")
+	f.Add("a.b.c.d.amazonaws.com:6379")
+	f.Add("a.serverless.c.cac1.cache.amazonaws.com:6379")
+	f.Add("example-cache-abc123.serverless.cac1.cache.amazonaws.com:6379")
+	f.Add("redis://example-cache-abc123.serverless.cac1.cache.amazonaws.com:6379")
+	f.Add("://://example-cache-abc123.serverless.cac1.cache.amazonaws.com:6379")
+
+	f.Fuzz(func(t *testing.T, endpoint string) {
+		require.NotPanics(t, func() {
+			_, _ = ParseElastiCacheServerlessEndpoint(endpoint)
+		})
+	})
+}
+
 func FuzzParseDynamoDBEndpoint(f *testing.F) {
 	f.Add("")
 	f.Add(":123")
diff --git a/api/utils/aws/identifiers.go b/api/utils/aws/identifiers.go
index fd71aaf22b8e8..d245006bda012 100644
--- a/api/utils/aws/identifiers.go
+++ b/api/utils/aws/identifiers.go
@@ -53,6 +53,28 @@ func IsValidIAMRoleName(roleName string) error {
 	return nil
 }
 
+// IsValidIAMRolesAnywhereTrustAnchorName checks whether the AWS IAM Roles Anywhere Trust Anchor name is valid.
+// Validation based on the AWS documentation.
+// See https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateTrustAnchor.html#API_CreateTrustAnchor_RequestBody
+func IsValidIAMRolesAnywhereTrustAnchorName(name string) error {
+	if !matchRolesAnywhereTrustAnchorName(name) {
+		return trace.BadParameter("trust anchor name is invalid")
+	}
+
+	return nil
+}
+
+// IsValidIAMRolesAnywhereProfileName checks whether the AWS IAM Roles Anywhere Profile name is valid.
+// Validation based on the AWS documentation.
+// See https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateProfile.html#API_CreateProfile_RequestBody
+func IsValidIAMRolesAnywhereProfileName(name string) error {
+	if !matchRolesAnywhereProfileName(name) {
+		return trace.BadParameter("profile name is invalid")
+	}
+
+	return nil
+}
+
 // IsValidIAMPolicyName checks whether the policy name is a valid AWS IAM Policy
 // identifier.
 //
@@ -167,7 +189,7 @@ var (
 	//
 	// Reference:
 	// https://github.com/aws/aws-sdk-go-v2/blob/main/codegen/smithy-aws-go-codegen/src/main/resources/software/amazon/smithy/aws/go/codegen/endpoints.json
-	matchRegion = regexp.MustCompile(`^[a-z]{2}(-gov|-iso|-isob|-isoe|-isof)?-\w+-\d+$`)
+	matchRegion = regexp.MustCompile(`^(eusc-)?[a-z]{2}(-gov|-iso|-isob|-isoe|-isof)?-\w+-\d+$`)
 
 	// https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateWorkGroup.html
 	matchAthenaWorkgroupName = regexp.MustCompile(`^[a-zA-Z0-9._-]{1,128}$`).MatchString
@@ -180,6 +202,16 @@ var (
 	// > special characters other than underscore (_) are not supported
 	matchGlueName = regexp.MustCompile(`^[a-z0-9_]{1,255}$`).MatchString
 
+	// matchRolesAnywhereTrustAnchorName is a regex that matches against AWS IAM Roles Anywhere Trust Anchor Names.
+	// See https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateTrustAnchor.html#API_CreateTrustAnchor_RequestBody
+	matchRolesAnywhereTrustAnchorName = baseResourceNameMatcher
+
+	// matchRolesAnywhereProfileName is a regex that matches against AWS IAM Roles Anywhere Profile Names.
+	// See https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateProfile.html#API_CreateProfile_RequestBody
+	matchRolesAnywhereProfileName = baseResourceNameMatcher
+
+	baseResourceNameMatcher = regexp.MustCompile(`^[ a-zA-Z0-9-_]{1,255}$`).MatchString
+
 	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html
 	validPartitions = []string{"aws", "aws-cn", "aws-us-gov"}
 )
diff --git a/api/utils/aws/identifiers_test.go b/api/utils/aws/identifiers_test.go
index a6c701a2e10f9..666b8b1231365 100644
--- a/api/utils/aws/identifiers_test.go
+++ b/api/utils/aws/identifiers_test.go
@@ -391,3 +391,69 @@ func TestIsValidGlueResourceName(t *testing.T) {
 		})
 	}
 }
+
+func TestIsValidIAMRolesAnywhereTrustAnchorName(t *testing.T) {
+	for _, tt := range []struct {
+		name            string
+		trustAnchorName string
+		errCheck        require.ErrorAssertionFunc
+	}{
+		{
+			name:            "valid",
+			trustAnchorName: "aA0-_",
+			errCheck:        require.NoError,
+		},
+		{
+			name:            "empty",
+			trustAnchorName: "",
+			errCheck:        require.Error,
+		},
+		{
+			name:            "too long",
+			trustAnchorName: strings.Repeat("a", 256),
+			errCheck:        require.Error,
+		},
+		{
+			name:            "invalid chars",
+			trustAnchorName: "+",
+			errCheck:        require.Error,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errCheck(t, IsValidIAMRolesAnywhereTrustAnchorName(tt.trustAnchorName))
+		})
+	}
+}
+
+func TestIsValidIAMRolesAnywhereProfileName(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		profileName string
+		errCheck    require.ErrorAssertionFunc
+	}{
+		{
+			name:        "valid",
+			profileName: "aA0-_",
+			errCheck:    require.NoError,
+		},
+		{
+			name:        "empty",
+			profileName: "",
+			errCheck:    require.Error,
+		},
+		{
+			name:        "too long",
+			profileName: strings.Repeat("a", 256),
+			errCheck:    require.Error,
+		},
+		{
+			name:        "invalid chars",
+			profileName: "+",
+			errCheck:    require.Error,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errCheck(t, IsValidIAMRolesAnywhereProfileName(tt.profileName))
+		})
+	}
+}
diff --git a/api/utils/clientutils/resources.go b/api/utils/clientutils/resources.go
index d10fa7f76cfe4..ee5d2cdff9de6 100644
--- a/api/utils/clientutils/resources.go
+++ b/api/utils/clientutils/resources.go
@@ -20,6 +20,7 @@ package clientutils
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
@@ -28,26 +29,180 @@ import (
 
 // IterateResources is a helper that iterates through each resource from all
 // pages and passes them one by one to the provided callback.
+// Deprecated: Prefer using [Resources] instead.
+// TODO(tross): DELETE IN 19.0.0
 func IterateResources[T any](
 	ctx context.Context,
-	listPageFunc func(context.Context, int, string) ([]T, string, error),
+	pageFunc func(context.Context, int, string) ([]T, string, error),
 	callback func(T) error,
 ) error {
-	var pageToken string
-	for {
-		page, nextToken, err := listPageFunc(ctx, defaults.DefaultChunkSize, pageToken)
+	for item, err := range Resources(ctx, pageFunc) {
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		for _, resource := range page {
-			if err := callback(resource); err != nil {
-				return trace.Wrap(err)
+
+		if err := callback(item); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+// rangeParams are parameters provided to [rangeInternal]
+type rangeParams[T any] struct {
+	// start is the minimum inclusive key in the range yielded by the iteration.
+	// Empty string means start of the range.
+	start string
+	// end is the upper bound (exclusive) key in the range yielded by the iteration.
+	// Empty string means full remainder of the range.
+	end string
+	// pageSize is an optional maximum number of items to retrieve via [rangeParams.pageFunc]
+	// Default value is 0, in this case it is assumed the backend will impose a page size.
+	pageSize int
+	// pageFunc is a user provided function to retrieve a single page of items.
+	pageFunc func(context.Context, int, string) ([]T, string, error)
+	// keyFunc is a user provided function to retrieve a backend key for a given item.
+	// This key is used when a given range end key is given to compare against.
+	// Backend keys are assumed to be sorted lexigraphically.
+	keyFunc func(item T) string
+}
+
+// rangeInternal is the internal implementation of resource range getter.
+// The iterator will only produce an error if one is encountered retrieving a page.
+func rangeInternal[T any](ctx context.Context, params rangeParams[T]) iter.Seq2[T, error] {
+	return func(yield func(T, error) bool) {
+		pageToken := params.start
+		pageSize := params.pageSize
+		isLookingForEnd := params.end != "" && params.keyFunc != nil
+
+		for {
+			page, nextToken, lastPageSize, err := Page(ctx, pageSize, pageToken, params.pageFunc)
+			if err != nil {
+				yield(*new(T), trace.Wrap(err))
+				return
+			}
+
+			for _, resource := range page {
+				if isLookingForEnd && params.keyFunc(resource) >= params.end {
+					return
+				}
+
+				if !yield(resource, nil) {
+					return
+				}
+			}
+
+			pageToken = nextToken
+			if nextToken == "" {
+				return
+			}
+
+			// Note that the server may return a smaller page at its own discretion,
+			// we use the last successful requested page size here to allow the server
+			// to temporarily lower the size if needed.
+			pageSize = lastPageSize
+		}
+	}
+
+}
+
+// ResourcesWithPageSize returns an iterator over all resources from every page, limited to pageSize, produced from the pageFunc.
+// The iterator will only produce an error if one is encountered retrieving a page.
+func ResourcesWithPageSize[T any](ctx context.Context, pageFunc func(context.Context, int, string) ([]T, string, error), pageSize int) iter.Seq2[T, error] {
+	return rangeInternal(ctx, rangeParams[T]{
+		pageSize: pageSize,
+		pageFunc: pageFunc,
+	})
+}
+
+// Resources returns an iterator over all resources from every page produced from the pageFunc.
+// The iterator will only produce an error if one is encountered retrieving a page.
+func Resources[T any](ctx context.Context, pageFunc func(context.Context, int, string) ([]T, string, error)) iter.Seq2[T, error] {
+	return rangeInternal(ctx, rangeParams[T]{
+		pageFunc: pageFunc,
+		pageSize: defaults.DefaultChunkSize,
+	})
+}
+
+// RangeResources returns resources within the range [start, end).
+//
+// Example use:
+//
+//	func (c *Client) RangeFoos(ctx context.Context, start, end string) iter.Seq2[Foo, error] {
+//		return clientutils.RangeResources(ctx, start, end, c.ListFoos, Foo.GetName)
+//	}
+func RangeResources[T any](ctx context.Context, start, end string,
+	pageFunc func(context.Context, int, string) ([]T, string, error),
+	keyFunc func(item T) string) iter.Seq2[T, error] {
+
+	return rangeInternal(ctx, rangeParams[T]{
+		start:    start,
+		end:      end,
+		pageFunc: pageFunc,
+		keyFunc:  keyFunc,
+		pageSize: defaults.DefaultChunkSize,
+	})
+}
+
+// CollectWithFallback collects all items in a collection using pageFunc, should the this be NotImplemented a fallbackFunc is attempted.
+// Example:
+//
+//	foos, err := clientutils.CollectWithFallback(ctx, client.ListFoos, client.GetFoos)
+func CollectWithFallback[T any](ctx context.Context,
+	pageFunc func(context.Context, int, string) ([]T, string, error),
+	fallbackFunc func(context.Context) ([]T, error)) ([]T, error) {
+
+	var out []T
+	for item, err := range Resources(ctx, pageFunc) {
+		if err == nil {
+			out = append(out, item)
+			continue
+		}
+
+		if trace.IsNotImplemented(err) {
+			fallbackOut, fallbackErr := fallbackFunc(ctx)
+			if fallbackErr != nil {
+				return nil, trace.Wrap(fallbackErr)
 			}
+			return fallbackOut, nil
 		}
 
-		if nextToken == "" {
-			return nil
+		return nil, trace.Wrap(err)
+	}
+
+	return out, nil
+}
+
+// Page is a client side utility which implements auto page size adjustment.
+func Page[T any](
+	ctx context.Context,
+	pageSize int,
+	pageToken string,
+	pageFunc func(context.Context, int, string) ([]T, string, error),
+) (
+	_ []T,
+	nextPageToken string,
+	lastPageSize int,
+	_ error,
+) {
+	for {
+		page, nextToken, err := pageFunc(ctx, pageSize, pageToken)
+		if err != nil {
+			if trace.IsLimitExceeded(err) {
+				// Cut chunkSize in half if gRPC max message size is exceeded.
+				pageSize /= 2
+				// This is an extremely unlikely scenario, but better to cover it anyways.
+				if pageSize == 0 {
+					return nil, "", 0, trace.Wrap(err, "resource is too large to retrieve, token: %q", pageToken)
+				}
+
+				continue
+			}
+
+			return nil, "", pageSize, trace.Wrap(err)
 		}
-		pageToken = nextToken
+
+		return page, nextToken, pageSize, nil
 	}
 }
diff --git a/api/utils/clientutils/resources_test.go b/api/utils/clientutils/resources_test.go
index dffc1867e4269..9398cdd8743e4 100644
--- a/api/utils/clientutils/resources_test.go
+++ b/api/utils/clientutils/resources_test.go
@@ -20,57 +20,306 @@ package clientutils
 
 import (
 	"context"
+	"fmt"
+	"strconv"
 	"testing"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/defaults"
 )
 
+const totalItems = defaults.DefaultChunkSize*2 + 5
+
 type mockPaginator struct {
-	accessDenied bool
+	accessDenied         bool
+	maxSupportedPageSize int
+	pageCalls            int
+}
+
+func generatePage(start, count int) []int {
+	page := make([]int, count)
+	for i := range count {
+		page[i] = start + i
+	}
+	return page
+}
+
+func limitCount(start, pageSize int) int {
+	if start >= totalItems {
+		return 0
+	}
+	if start+pageSize > totalItems {
+		return totalItems - start
+	}
+	return pageSize
 }
 
-func (m *mockPaginator) List(_ context.Context, pageSize int, token string) ([]bool, string, error) {
+func nextToken(start, pageSize int) string {
+	if start+pageSize > totalItems {
+		return ""
+	}
+	return strconv.Itoa(start + pageSize)
+}
+
+func startIndex(token string) int {
+	var start int
+	if token != "" {
+		start, _ = strconv.Atoi(token)
+	}
+	return start
+}
+
+func (m *mockPaginator) List(_ context.Context, pageSize int, token string) ([]int, string, error) {
+	m.pageCalls++
 	if m.accessDenied {
 		return nil, "", trace.AccessDenied("access denied")
 	}
-	switch token {
-	case "":
-		return make([]bool, pageSize), "page1", nil
-	case "page1":
-		return make([]bool, pageSize), "page2", nil
-	case "page2":
-		return make([]bool, 5), "", nil
-	default:
+
+	if pageSize > m.maxSupportedPageSize {
+		return nil, "", trace.LimitExceeded("page size %d exceeded the limit", pageSize)
+	}
+
+	start := startIndex(token)
+	if start >= totalItems {
 		return nil, "", trace.BadParameter("invalid token")
 	}
+	count := limitCount(start, pageSize)
+	next := nextToken(start, pageSize)
+
+	return generatePage(start, count), next, nil
 }
 
 func TestIterateResources(t *testing.T) {
 	t.Run("success", func(t *testing.T) {
 		var count int
-		paginator := mockPaginator{}
-		err := IterateResources(context.Background(), paginator.List, func(bool) error {
+		paginator := mockPaginator{maxSupportedPageSize: defaults.DefaultChunkSize}
+		err := IterateResources(t.Context(), paginator.List, func(int) error {
 			count++
 			return nil
 		})
-		require.NoError(t, err)
-		require.Equal(t, defaults.DefaultChunkSize*2+5, count)
+		assert.NoError(t, err)
+		assert.Equal(t, totalItems, count)
 	})
 	t.Run("paginator error", func(t *testing.T) {
-		paginator := mockPaginator{accessDenied: true}
-		err := IterateResources(context.Background(), paginator.List, func(bool) error {
+		paginator := mockPaginator{accessDenied: true, maxSupportedPageSize: defaults.DefaultChunkSize}
+		err := IterateResources(t.Context(), paginator.List, func(int) error {
 			return nil
 		})
-		require.Error(t, err)
+		assert.Error(t, err)
 	})
 	t.Run("callback error", func(t *testing.T) {
-		paginator := mockPaginator{}
-		err := IterateResources(context.Background(), paginator.List, func(bool) error {
+		paginator := mockPaginator{maxSupportedPageSize: defaults.DefaultChunkSize}
+		err := IterateResources(t.Context(), paginator.List, func(int) error {
 			return trace.BadParameter("error")
 		})
-		require.Error(t, err)
+		assert.Error(t, err)
+	})
+}
+
+func TestResources(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		paginator := mockPaginator{maxSupportedPageSize: defaults.DefaultChunkSize}
+		var count int
+		for _, err := range Resources(t.Context(), paginator.List) {
+			count++
+			require.NoError(t, err)
+		}
+
+		assert.Equal(t, totalItems, count)
+		assert.Equal(t, 3, paginator.pageCalls)
 	})
+	t.Run("paginator error", func(t *testing.T) {
+		paginator := mockPaginator{accessDenied: true, maxSupportedPageSize: defaults.DefaultChunkSize}
+		var count int
+		for _, err := range Resources(t.Context(), paginator.List) {
+			count++
+			require.Error(t, err)
+		}
+		assert.Equal(t, 1, count)
+		assert.Equal(t, 1, paginator.pageCalls)
+	})
+
+	t.Run("limit exceeded", func(t *testing.T) {
+		paginator := mockPaginator{maxSupportedPageSize: 0}
+		var count int
+		for _, err := range Resources(t.Context(), paginator.List) {
+			count++
+			require.Error(t, err)
+		}
+		assert.Equal(t, 1, count)
+		assert.Equal(t, 10, paginator.pageCalls)
+	})
+}
+
+func TestResourcesWithCustomPageSize(t *testing.T) {
+	paginator := mockPaginator{maxSupportedPageSize: defaults.DefaultChunkSize}
+	var count int
+	for _, err := range ResourcesWithPageSize(t.Context(), paginator.List, 10) {
+		count++
+		require.NoError(t, err)
+	}
+	assert.Equal(t, totalItems, count)
+	assert.Equal(t, 201, paginator.pageCalls)
+}
+
+func TestRangeResources(t *testing.T) {
+	t.Parallel()
+	keyFunc := func(item int) string {
+		return fmt.Sprintf("%06d", item)
+	}
+
+	tests := []struct {
+		name                 string
+		start                string
+		end                  string
+		expectedItemCount    int
+		expectedListCalls    int
+		accessDenied         bool
+		maxSupportedPageSize int
+		errFn                func(require.TestingT, error, ...any)
+	}{
+		{
+			name:                 "RangeAllItems",
+			expectedItemCount:    totalItems,
+			expectedListCalls:    3,
+			maxSupportedPageSize: defaults.DefaultChunkSize,
+			errFn:                require.NoError,
+		},
+		{
+			name:                 "RangeAccessDenied",
+			expectedItemCount:    0,
+			expectedListCalls:    1,
+			accessDenied:         true,
+			maxSupportedPageSize: defaults.DefaultChunkSize,
+			errFn:                require.Error,
+		},
+		{
+			name:                 "RangeWithEnd",
+			expectedItemCount:    20,
+			expectedListCalls:    1,
+			end:                  keyFunc(20),
+			maxSupportedPageSize: defaults.DefaultChunkSize,
+			errFn:                require.NoError,
+		},
+		{
+			name:                 "RangeWithStart",
+			expectedItemCount:    totalItems - 1337,
+			expectedListCalls:    1,
+			start:                keyFunc(1337),
+			maxSupportedPageSize: defaults.DefaultChunkSize,
+			errFn:                require.NoError,
+		},
+		{
+			name:              "RangeSpan",
+			expectedItemCount: 1500 - 500,
+			// The end marker is not inclusive and the number of items falls on the pagesize, in this case 2 calls will be made.
+			expectedListCalls:    2,
+			start:                keyFunc(500),
+			end:                  keyFunc(1500),
+			maxSupportedPageSize: defaults.DefaultChunkSize,
+			errFn:                require.NoError,
+		},
+		{
+			name:                 "RangeLimitExceeded",
+			expectedItemCount:    0,
+			expectedListCalls:    10,
+			start:                keyFunc(500),
+			end:                  keyFunc(1500),
+			maxSupportedPageSize: -1,
+			errFn:                require.Error,
+		},
+		{
+			name:                 "RangeLimitExceededWithRecovery",
+			expectedItemCount:    1000,
+			expectedListCalls:    4,
+			start:                keyFunc(500),
+			end:                  keyFunc(1500),
+			maxSupportedPageSize: defaults.DefaultChunkSize / 2,
+			errFn:                require.NoError,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			paginator := mockPaginator{accessDenied: tc.accessDenied, maxSupportedPageSize: tc.maxSupportedPageSize}
+			var count int
+
+			for _, err := range RangeResources(t.Context(), tc.start, tc.end, paginator.List, keyFunc) {
+				if err == nil {
+					count++
+				}
+
+				tc.errFn(t, err)
+			}
+
+			assert.Equal(t, tc.expectedItemCount, count)
+			assert.Equal(t, tc.expectedListCalls, paginator.pageCalls)
+		})
+	}
+}
+
+func TestCollectWithFallback(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name         string
+		pageFunc     func(context.Context, int, string) ([]string, string, error)
+		fallbackFunc func(context.Context) ([]string, error)
+		err          error
+	}{
+		{
+			name: "happy primary path",
+			pageFunc: func(context.Context, int, string) ([]string, string, error) {
+				return []string{"hello", "world"}, "", nil
+			},
+			fallbackFunc: func(context.Context) ([]string, error) {
+				panic("unexpected call")
+			},
+			err: nil,
+		},
+
+		{
+			name: "fallback fail",
+			pageFunc: func(context.Context, int, string) ([]string, string, error) {
+				return nil, "", trace.NotImplemented("")
+			},
+			fallbackFunc: func(context.Context) ([]string, error) {
+				return nil, trace.BadParameter("")
+			},
+			err: trace.BadParameter(""),
+		},
+		{
+			name: "fallback success",
+			pageFunc: func(context.Context, int, string) ([]string, string, error) {
+				return nil, "", trace.NotImplemented("")
+			},
+			fallbackFunc: func(context.Context) ([]string, error) {
+				return []string{"hello", "world"}, nil
+			},
+			err: nil,
+		},
+		{
+			name: "fallback no match",
+			pageFunc: func(context.Context, int, string) ([]string, string, error) {
+				return nil, "", trace.BadParameter("")
+			},
+			fallbackFunc: func(context.Context) ([]string, error) {
+				panic("unexpected call")
+			},
+			err: trace.BadParameter(""),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := CollectWithFallback(context.Background(), tc.pageFunc, tc.fallbackFunc)
+			if tc.err == nil {
+				require.NotNil(t, out)
+			}
+			require.ErrorIs(t, err, tc.err)
+		})
+	}
 }
diff --git a/api/utils/gcp/alloydb.go b/api/utils/gcp/alloydb.go
new file mode 100644
index 0000000000000..82ccc55a62474
--- /dev/null
+++ b/api/utils/gcp/alloydb.go
@@ -0,0 +1,149 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gcp
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
+// AlloyDBFullInstanceName fully identifies particular AlloyDB instance.
+// The "full" is in contrast with the "Instance" field, which is also referenced to as "instance name",
+// yet it isn't a globally unique instance identifier.
+type AlloyDBFullInstanceName struct {
+	// Project is the project ID.
+	ProjectID string
+	// Location is location, also known as region.
+	Location string
+	// ClusterID is the cluster ID.
+	ClusterID string
+	// InstanceID is the instance ID.
+	InstanceID string
+}
+
+// ParentClusterName returns the full name of parent cluster.
+func (info AlloyDBFullInstanceName) ParentClusterName() string {
+	return fmt.Sprintf(
+		"projects/%s/locations/%s/clusters/%s", info.ProjectID, info.Location, info.ClusterID,
+	)
+}
+
+// InstanceName returns a full name of the instance.
+func (info AlloyDBFullInstanceName) InstanceName() string {
+	return fmt.Sprintf(
+		"projects/%s/locations/%s/clusters/%s/instances/%s", info.ProjectID, info.Location, info.ClusterID, info.InstanceID,
+	)
+}
+
+const (
+	// alloyDBScheme is the custom URI scheme used to disambiguate AlloyDB URIs from all others.
+	alloyDBScheme = "alloydb://"
+)
+
+// IsAlloyDBConnectionURI returns true if the uri can possibly be parsed as AlloyDB connection URI.
+//
+// It doesn't try to parse it; it merely searches for the presence of the custom `alloydb://` scheme.
+func IsAlloyDBConnectionURI(uri string) bool {
+	return strings.HasPrefix(uri, alloyDBScheme)
+}
+
+// ParseAlloyDBConnectionURI parses "connection URI" (as it is called by GCP in some places) into the full instance name.
+// The URI format requires custom scheme `alloydb://` which we use to disambiguate AlloyDB URIs from all others.
+//
+// Example URI: alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance
+func ParseAlloyDBConnectionURI(connectionURI string) (*AlloyDBFullInstanceName, error) {
+	if connectionURI == "" {
+		return nil, trace.BadParameter("connection URI cannot be empty")
+	}
+
+	uriNoPrefix, found := strings.CutPrefix(connectionURI, alloyDBScheme)
+	if !found {
+		return nil, trace.BadParameter("invalid connection URI %q: should start with %v", connectionURI, alloyDBScheme)
+	}
+
+	parts := strings.Split(uriNoPrefix, "/")
+	if len(parts) != 8 {
+		return nil, trace.BadParameter("invalid connection URI %q: wrong number of parts", connectionURI)
+	}
+
+	switch {
+	case parts[0] != "projects":
+		return nil, trace.BadParameter("invalid connection URI %q: expected 'projects', got %q", connectionURI, parts[0])
+	case parts[2] != "locations":
+		return nil, trace.BadParameter("invalid connection URI %q: expected 'locations', got %q", connectionURI, parts[2])
+	case parts[4] != "clusters":
+		return nil, trace.BadParameter("invalid connection URI %q: expected 'clusters', got %q", connectionURI, parts[4])
+	case parts[6] != "instances":
+		return nil, trace.BadParameter("invalid connection URI %q: expected 'instances', got %q", connectionURI, parts[6])
+	}
+
+	project, location, cluster, instance := parts[1], parts[3], parts[5], parts[7]
+
+	switch {
+	case project == "":
+		return nil, trace.BadParameter("invalid connection URI %q: project cannot be empty", connectionURI)
+	case location == "":
+		return nil, trace.BadParameter("invalid connection URI %q: location cannot be empty", connectionURI)
+	case cluster == "":
+		return nil, trace.BadParameter("invalid connection URI %q: cluster cannot be empty", connectionURI)
+	case instance == "":
+		return nil, trace.BadParameter("invalid connection URI %q: instance cannot be empty", connectionURI)
+	}
+
+	// '?' cannot be a part of a valid instance name; this looks like attempt at query param.
+	if strings.Contains(instance, "?") {
+		return nil, trace.BadParameter("invalid connection URI %q: query parameters are not accepted", connectionURI)
+	}
+
+	return &AlloyDBFullInstanceName{
+		ProjectID:  project,
+		Location:   location,
+		ClusterID:  cluster,
+		InstanceID: instance,
+	}, nil
+}
+
+// AlloyDBEndpointType is AlloyDB endpoint type.
+type AlloyDBEndpointType string
+
+const (
+	// AlloyDBEndpointTypePublic is the public endpoint type.
+	AlloyDBEndpointTypePublic AlloyDBEndpointType = "public"
+	// AlloyDBEndpointTypePrivate is the private endpoint type.
+	AlloyDBEndpointTypePrivate AlloyDBEndpointType = "private"
+	// AlloyDBEndpointTypePSC is the PSC endpoint type.
+	AlloyDBEndpointTypePSC AlloyDBEndpointType = "psc"
+)
+
+// AlloyDBEndpointTypes is a list of all known AlloyDB endpoint types.
+var AlloyDBEndpointTypes = []AlloyDBEndpointType{
+	AlloyDBEndpointTypePublic,
+	AlloyDBEndpointTypePrivate,
+	AlloyDBEndpointTypePSC,
+}
+
+func ValidateAlloyDBEndpointType(endpointType string) error {
+	if endpointType == "" {
+		return nil
+	}
+	for _, t := range AlloyDBEndpointTypes {
+		if endpointType == string(t) {
+			return nil
+		}
+	}
+	return trace.BadParameter("invalid alloy db endpoint type: %v, expected one of %v", endpointType, AlloyDBEndpointTypes)
+}
diff --git a/api/utils/gcp/alloydb_test.go b/api/utils/gcp/alloydb_test.go
new file mode 100644
index 0000000000000..b24d92665a155
--- /dev/null
+++ b/api/utils/gcp/alloydb_test.go
@@ -0,0 +1,155 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gcp
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsAlloyDBConnectionURI(t *testing.T) {
+	require.True(t, IsAlloyDBConnectionURI("alloydb://dummy"))
+	require.False(t, IsAlloyDBConnectionURI("http://dummy"))
+	require.False(t, IsAlloyDBConnectionURI("just/some/stuff"))
+}
+
+func TestParseAlloyDBConnectionURI(t *testing.T) {
+	tests := []struct {
+		name    string
+		uri     string
+		want    *AlloyDBFullInstanceName
+		wantErr string
+	}{
+		{
+			name: "valid address",
+			uri:  "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			want: &AlloyDBFullInstanceName{
+				ProjectID:  "my-project-123456",
+				Location:   "europe-west1",
+				ClusterID:  "my-cluster",
+				InstanceID: "my-instance",
+			},
+		},
+		{
+			name:    "empty string is rejected",
+			uri:     "",
+			wantErr: `connection URI cannot be empty`,
+		},
+		{
+			name:    "missing 'projects'",
+			uri:     "alloydb://PROJECTS/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://PROJECTS/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance": expected 'projects', got "PROJECTS"`,
+		},
+		{
+			name:    "missing 'locations'",
+			uri:     "alloydb://projects/my-project-123456/LOCATIONS/europe-west1/clusters/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/LOCATIONS/europe-west1/clusters/my-cluster/instances/my-instance": expected 'locations', got "LOCATIONS"`,
+		},
+		{
+			name:    "missing 'clusters'",
+			uri:     "alloydb://projects/my-project-123456/locations/europe-west1/CLUSTERS/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/europe-west1/CLUSTERS/my-cluster/instances/my-instance": expected 'clusters', got "CLUSTERS"`,
+		},
+		{
+			name:    "missing 'instances'",
+			uri:     "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/INSTANCES/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/INSTANCES/my-instance": expected 'instances', got "INSTANCES"`,
+		},
+		{
+			name:    "empty project",
+			uri:     "alloydb://projects//locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects//locations/europe-west1/clusters/my-cluster/instances/my-instance": project cannot be empty`,
+		},
+		{
+			name:    "empty location",
+			uri:     "alloydb://projects/my-project-123456/locations//clusters/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations//clusters/my-cluster/instances/my-instance": location cannot be empty`,
+		},
+		{
+			name:    "empty cluster",
+			uri:     "alloydb://projects/my-project-123456/locations/europe-west1/clusters//instances/my-instance",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/europe-west1/clusters//instances/my-instance": cluster cannot be empty`,
+		},
+		{
+			name:    "empty instance",
+			uri:     "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/": instance cannot be empty`,
+		},
+		{
+			name:    "missing scheme",
+			uri:     "projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			wantErr: `invalid connection URI "projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance": should start with alloydb://`,
+		},
+		{
+			name:    "invalid address",
+			uri:     "alloydb://invalid",
+			wantErr: `invalid connection URI "alloydb://invalid": wrong number of parts`,
+		},
+		{
+			name:    "query params are not accepted",
+			uri:     "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance?foo=bar",
+			wantErr: `invalid connection URI "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance?foo=bar": query parameters are not accepted`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			parsed, err := ParseAlloyDBConnectionURI(tt.uri)
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				require.Equal(t, tt.want, parsed)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestAlloyDBResourceNames(t *testing.T) {
+	info := AlloyDBFullInstanceName{
+		ProjectID:  "my-project-123456",
+		Location:   "europe-west1",
+		ClusterID:  "my-cluster",
+		InstanceID: "my-instance",
+	}
+	require.Equal(t, "projects/my-project-123456/locations/europe-west1/clusters/my-cluster", info.ParentClusterName())
+	require.Equal(t, "projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance", info.InstanceName())
+}
+
+func TestValidateAlloyDBEndpointType(t *testing.T) {
+	tests := []struct {
+		name    string
+		str     string
+		wantErr string
+	}{
+		{name: "empty string", str: "", wantErr: ""},
+		{name: "private", str: "private", wantErr: ""},
+		{name: "public", str: "public", wantErr: ""},
+		{name: "psc", str: "psc", wantErr: ""},
+		{name: "caps", str: "PUBLIC", wantErr: `invalid alloy db endpoint type: PUBLIC, expected one of [public private psc]`},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateAlloyDBEndpointType(test.str)
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/api/utils/grpc/size.go b/api/utils/grpc/size.go
new file mode 100644
index 0000000000000..2c37e2df117b3
--- /dev/null
+++ b/api/utils/grpc/size.go
@@ -0,0 +1,116 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package grpc
+
+import (
+	"fmt"
+	"math"
+	"os"
+	"strconv"
+	"strings"
+	"unicode"
+)
+
+// defaultClientRecvSize is the grpc client default for received message sizes
+const defaultClientRecvSize = 4 * 1024 * 1024 // 4MB
+
+// parseBytes takes human represtation of bytes such as '24mb' and returns number of bytes as an integer
+//
+// Only support a subset of SI prefixes up to gi/gb.
+func parseBytes(s string) (int, error) {
+	const (
+		Byte = 1 << (iota * 10)
+		KiByte
+		MiByte
+		GiByte
+		IByte = 1
+		KByte = IByte * 1000
+		MByte = KByte * 1000
+		GByte = MByte * 1000
+	)
+
+	var bytesSizeTable = map[string]int{
+		"b":   Byte,
+		"kib": KiByte,
+		"kb":  KByte,
+		"mib": MiByte,
+		"mb":  MByte,
+		"gib": GiByte,
+		"gb":  GByte,
+		"":    Byte,
+		"ki":  KiByte,
+		"k":   KByte,
+		"mi":  MiByte,
+		"m":   MByte,
+		"gi":  GiByte,
+		"g":   GByte,
+	}
+
+	lastDigit := 0
+	for _, r := range s {
+		if !unicode.IsDigit(r) && r != '.' {
+			break
+		}
+		lastDigit++
+	}
+
+	num := s[:lastDigit]
+
+	var value float32
+	if f, err := strconv.ParseFloat(num, 32); err == nil {
+		value = float32(f)
+	} else {
+		return 0, err
+
+	}
+
+	extra := strings.ToLower(strings.TrimSpace(s[lastDigit:]))
+	if m, ok := bytesSizeTable[extra]; ok {
+		value *= float32(m)
+		if value >= math.MaxInt32 {
+			return 0, fmt.Errorf("too large: %v", s)
+		}
+		return int(value), nil
+	}
+
+	return 0, fmt.Errorf("unhandled size name: %v", extra)
+}
+
+// MaxClientRecvMsgSize returns maximum message size in bytes the client can receive.
+//
+// By default 4MB is returned, to overwrite this, set `TELEPORT_UNSTABLE_GRPC_RECV_SIZE` envriroment
+// variable. If the value cannot be parsed or exceeds int32 limits, the default value is returned.
+//
+// The result of this call can be passed directly into `grpc.MaxCallRecvMsgSize`, example:
+//
+//	conn, err := grpc.DialContext(ctx, target,
+//		grpc.WithDefaultCallOptions(
+//			grpc.MaxCallRecvMsgSize(grpcutils.MaxClientRecvMsgSize()),
+//		),
+//	)
+func MaxClientRecvMsgSize() int {
+
+	val := os.Getenv("TELEPORT_UNSTABLE_GRPC_RECV_SIZE")
+	if val == "" {
+		return defaultClientRecvSize
+	}
+
+	size, err := parseBytes(val)
+	if err != nil {
+		return defaultClientRecvSize
+	}
+
+	return size
+}
diff --git a/api/utils/grpc/size_test.go b/api/utils/grpc/size_test.go
new file mode 100644
index 0000000000000..4752746732553
--- /dev/null
+++ b/api/utils/grpc/size_test.go
@@ -0,0 +1,98 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMaxClientRecvMsgSize(t *testing.T) {
+
+	testCases := []struct {
+		desc  string
+		size  string
+		bytes int
+	}{
+		{
+			desc:  "Decimal",
+			size:  "1234",
+			bytes: 1234,
+		},
+		{
+			desc:  "Unset",
+			size:  "",
+			bytes: defaultClientRecvSize,
+		},
+		{
+			desc:  "Unhandled units",
+			size:  "4TB",
+			bytes: defaultClientRecvSize,
+		},
+		{
+			desc:  "Too large",
+			size:  "20GB",
+			bytes: defaultClientRecvSize,
+		},
+		{
+			desc:  "Rubbish",
+			size:  "foobar",
+			bytes: defaultClientRecvSize,
+		},
+		{
+			desc:  "Human mib",
+			size:  "8mib",
+			bytes: 8 * 1024 * 1024,
+		},
+		{
+			desc:  "Human kib",
+			size:  "8kib",
+			bytes: 8 * 1024,
+		},
+		{
+			desc:  "Human mb",
+			size:  "8mb",
+			bytes: 8 * 1000 * 1000,
+		},
+		{
+			desc:  "Floats",
+			size:  "2.5kb",
+			bytes: 2500,
+		},
+		{
+			desc:  "Human kb",
+			size:  "8kb",
+			bytes: 8 * 1000,
+		},
+		{
+			desc:  "Human m",
+			size:  "8m",
+			bytes: 8 * 1000 * 1000,
+		},
+		{
+			desc:  "Human k",
+			size:  "8k",
+			bytes: 8 * 1000,
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.desc, func(t *testing.T) {
+			t.Setenv("TELEPORT_UNSTABLE_GRPC_RECV_SIZE", tt.size)
+			assert.Equal(t, tt.bytes, MaxClientRecvMsgSize())
+		})
+	}
+}
diff --git a/api/utils/grpc/stream/stream.go b/api/utils/grpc/stream/stream.go
index 7fe4694da7954..fecd9d2b7d1f6 100644
--- a/api/utils/grpc/stream/stream.go
+++ b/api/utils/grpc/stream/stream.go
@@ -47,17 +47,45 @@ type ReadWriter struct {
 	wLock  sync.Mutex
 	rLock  sync.Mutex
 	rBytes []byte
+
+	options *Options
+}
+
+// Options is NewReadWriter config options.
+type Options struct {
+	// DisableChunking disables automatic splitting of data messages
+	// that exceed MaxChunkSize during writes.
+	// This is useful when the receiver does not support chunked reads.
+	DisableChunking bool
+}
+
+// Option allows setting options as functional arguments to NewReadWriter.
+type Option func(s *Options)
+
+// WithDisabledChunking	disables automatic splitting of data messages
+// that exceed MaxChunkSize during writes.
+// This is useful when the receiver does not support chunked reads.
+func WithDisabledChunking() Option {
+	return func(s *Options) {
+		s.DisableChunking = true
+	}
 }
 
 // NewReadWriter creates a new ReadWriter that leverages the provided
 // source to retrieve data from and write data to.
-func NewReadWriter(source Source) (*ReadWriter, error) {
+func NewReadWriter(source Source, opts ...Option) (*ReadWriter, error) {
 	if source == nil {
 		return nil, trace.BadParameter("parameter source required")
 	}
 
+	options := &Options{}
+	for _, opt := range opts {
+		opt(options)
+	}
+
 	return &ReadWriter{
-		source: source,
+		source:  source,
+		options: options,
 	}, nil
 }
 
@@ -102,7 +130,7 @@ func (c *ReadWriter) Read(b []byte) (n int, err error) {
 // the grpc stream. To prevent exhausting the stream all
 // sends on the stream are limited to be at most MaxChunkSize.
 // If the data exceeds the MaxChunkSize it will be sent in
-// batches.
+// batches. This behavior can be disabled by using WithDisabledChunking.
 func (c *ReadWriter) Write(b []byte) (int, error) {
 	c.wLock.Lock()
 	defer c.wLock.Unlock()
@@ -110,7 +138,7 @@ func (c *ReadWriter) Write(b []byte) (int, error) {
 	var sent int
 	for len(b) > 0 {
 		chunk := b
-		if len(chunk) > MaxChunkSize {
+		if !c.options.DisableChunking && len(chunk) > MaxChunkSize {
 			chunk = chunk[:MaxChunkSize]
 		}
 
diff --git a/api/utils/grpc/stream/stream_test.go b/api/utils/grpc/stream/stream_test.go
index 35dfb7070b53c..6658e4f97daf6 100644
--- a/api/utils/grpc/stream/stream_test.go
+++ b/api/utils/grpc/stream/stream_test.go
@@ -52,7 +52,7 @@ func (m *mockStream) Recv() ([]byte, error) {
 	return b[:n], err
 }
 
-func newStreamPipe(t *testing.T) (*ReadWriter, net.Conn) {
+func newStreamPipe(t *testing.T, opts ...Option) (*ReadWriter, net.Conn) {
 	local, remote := net.Pipe()
 	stream := newMockStream(context.Background(), remote)
 
@@ -63,7 +63,7 @@ func newStreamPipe(t *testing.T) (*ReadWriter, net.Conn) {
 	require.NoError(t, remote.SetReadDeadline(timeout))
 	require.NoError(t, remote.SetWriteDeadline(timeout))
 
-	streamConn, err := NewReadWriter(stream)
+	streamConn, err := NewReadWriter(stream, opts...)
 	require.NoError(t, err)
 
 	return streamConn, local
@@ -122,6 +122,30 @@ func TestReadWriter_WriteChunk(t *testing.T) {
 	wg.Wait()
 }
 
+func TestReadWriter_WriteDisabledChunk(t *testing.T) {
+	streamConn, local := newStreamPipe(t, WithDisabledChunking())
+	wg := &sync.WaitGroup{}
+	wg.Add(2)
+
+	data := make([]byte, MaxChunkSize+1)
+	go func() {
+		defer wg.Done()
+		n, err := streamConn.Write(data)
+		assert.NoError(t, err)
+		assert.Len(t, data, n)
+	}()
+	go func() {
+		defer wg.Done()
+		b := make([]byte, 2*MaxChunkSize)
+		n, err := local.Read(b)
+		assert.NoError(t, err)
+		assert.Len(t, data, n)
+		assert.Equal(t, data[:n], b[:n])
+	}()
+
+	wg.Wait()
+}
+
 func TestReadWriter_Read(t *testing.T) {
 	streamConn, local := newStreamPipe(t)
 	wg := &sync.WaitGroup{}
diff --git a/api/utils/iterutils/iter.go b/api/utils/iterutils/iter.go
index 3d0ddf495f43c..91d68bb6741a7 100644
--- a/api/utils/iterutils/iter.go
+++ b/api/utils/iterutils/iter.go
@@ -35,3 +35,18 @@ func Map[In, Out any](f func(In) Out, seq iter.Seq[In]) iter.Seq[Out] {
 		}
 	}
 }
+
+// Filter returns an iterator over seq that only includes the values v for which
+// f(v) is true.
+//
+// Copied from https://github.com/golang/go/issues/61898. We should switch to an
+// official package once it is available.
+func Filter[V any](f func(V) bool, seq iter.Seq[V]) iter.Seq[V] {
+	return func(yield func(V) bool) {
+		for v := range seq {
+			if f(v) && !yield(v) {
+				return
+			}
+		}
+	}
+}
diff --git a/api/utils/iterutils/iter_test.go b/api/utils/iterutils/iter_test.go
index e6bf3e3feecd2..763fe63ceccbe 100644
--- a/api/utils/iterutils/iter_test.go
+++ b/api/utils/iterutils/iter_test.go
@@ -37,3 +37,21 @@ func ExampleMap() {
 	// HELLO WORLD
 	// FOO
 }
+
+func ExampleFilter() {
+	inputs := []string{
+		"a",
+		"bb",
+		"ccc",
+		"dddd",
+	}
+	isOddLen := func(s string) bool {
+		return len(s)%2 == 1
+	}
+	for filtered := range Filter(isOddLen, slices.Values(inputs)) {
+		fmt.Println(filtered)
+	}
+	// Output:
+	// a
+	// ccc
+}
diff --git a/api/utils/keypaths/keypaths.go b/api/utils/keypaths/keypaths.go
index 6e0bc36d1e3c7..cd42d96bc7aa3 100644
--- a/api/utils/keypaths/keypaths.go
+++ b/api/utils/keypaths/keypaths.go
@@ -29,7 +29,7 @@ const (
 	// sessionKeyDir is a sub-directory where session keys are stored
 	sessionKeyDir = "keys"
 	// sshDirSuffix is the suffix of a sub-directory where SSH certificates are stored.
-	sshDirSuffix = "-ssh"
+	SSHDirSuffix = "-ssh"
 	// fileNameKnownHosts is a file where known hosts are stored.
 	fileNameKnownHosts = "known_hosts"
 	// FileExtTLSCertLegacy is the legacy suffix/extension of a file where a TLS cert is stored.
@@ -73,6 +73,18 @@ const (
 	profileFileExt = ".yaml"
 	// oracleWalletDirSuffix is the suffix of the oracle wallet database directory.
 	oracleWalletDirSuffix = "-wallet"
+	// VNetClientSSHKey is the file name of the SSH key used by third-party SSH
+	// clients to connect to VNet SSH.
+	VNetClientSSHKey = "id_vnet"
+	// VNetClientSSHKeyPub is the file name of the SSH public key matching
+	// VNetClientSSHKey.
+	VNetClientSSHKeyPub = VNetClientSSHKey + fileExtPub
+	// vnetKnownHosts is the file name of the known_hosts file trusted by
+	// third-party SSH clients connecting to VNet SSH.
+	vnetKnownHosts = "vnet_known_hosts"
+	// VNetSSHConfig is the file name of the generated OpenSSH-compatible config
+	// file to be used by third-party SSH clients connecting to VNet SSH.
+	VNetSSHConfig = "vnet_ssh_config"
 )
 
 // Here's the file layout of all these keypaths.
@@ -81,6 +93,10 @@ const (
 // ├── one.example.com.yaml            --> file containing profile details for proxy "one.example.com"
 // ├── two.example.com.yaml            --> file containing profile details for proxy "two.example.com"
 // ├── known_hosts                     --> trusted certificate authorities (their keys) in a format similar to known_hosts
+// ├── id_vnet                         --> SSH Private Key for third-party clients of VNet SSH
+// ├── id_vnet.pub                     --> SSH Public Key for third-party clients of VNet SSH
+// ├── vnet_known_hosts                --> trusted certificate authorities (their keys) for third-party clients of VNet SSH
+// ├── vnet_ssh_config                 --> OpenSSH-compatible config file for third-party clients of VNet SSH
 // └── keys							   --> session keys directory
 //    ├── one.example.com              --> Proxy hostname
 //    │   ├── certs.pem                --> TLS CA certs for the Teleport CA
@@ -241,7 +257,7 @@ func TLSCAsPathCluster(baseDir, proxy, cluster string) string {
 //
 // <baseDir>/keys/<proxy>/<username>-ssh
 func SSHDir(baseDir, proxy, username string) string {
-	return filepath.Join(ProxyKeyDir(baseDir, proxy), username+sshDirSuffix)
+	return filepath.Join(ProxyKeyDir(baseDir, proxy), username+SSHDirSuffix)
 }
 
 // PPKFilePath returns the path to the user's PuTTY PPK-formatted keypair
@@ -429,6 +445,27 @@ func IdentitySSHCertPath(path string) string {
 	return path + fileExtSSHCert
 }
 
+// VNetClientSSHKeyPath returns the path to the VNet client SSH private key.
+func VNetClientSSHKeyPath(baseDir string) string {
+	return filepath.Join(baseDir, VNetClientSSHKey)
+}
+
+// VNetClientSSHKeyPubPath returns the path to the VNet client SSH public key.
+func VNetClientSSHKeyPubPath(baseDir string) string {
+	return filepath.Join(baseDir, VNetClientSSHKeyPub)
+}
+
+// VNetKnownHostsPath returns the path to the VNet known_hosts file.
+func VNetKnownHostsPath(baseDir string) string {
+	return filepath.Join(baseDir, vnetKnownHosts)
+}
+
+// VNetSSHConfigPath returns the path to VNet's generated OpenSSH-compatible
+// config file.
+func VNetSSHConfigPath(baseDir string) string {
+	return filepath.Join(baseDir, VNetSSHConfig)
+}
+
 // TrimKeyPathSuffix returns the given path with any key suffix/extension trimmed off.
 func TrimKeyPathSuffix(path string) string {
 	return strings.TrimSuffix(path, fileExtTLSKey)
diff --git a/api/utils/keys/alias.go b/api/utils/keys/alias.go
deleted file mode 100644
index 8323a9c9e53ff..0000000000000
--- a/api/utils/keys/alias.go
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
-Copyright 2025 Gravitational, Inc.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-    http://www.apache.org/licenses/LICENSE-2.0
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package keys
-
-import "github.com/gravitational/teleport/api/utils/keys/hardwarekey"
-
-// Temporary aliases for types moved to the hardwarekey or piv packages
-// TODO(Joerger): Remove once /e no longer relies on them.
-
-// AttestationStatement is an attestation statement for a hardware private key
-// that supports json marshaling through the standard json/encoding package.
-type AttestationStatement = hardwarekey.AttestationStatement
-
-// AttestationStatementFromProto converts an AttestationStatement from its protobuf form.
-var AttestationStatementFromProto = hardwarekey.AttestationStatementFromProto
diff --git a/api/utils/keys/hardwarekey/attestation.go b/api/utils/keys/hardwarekey/attestation.go
index 94de91e177dc0..cf8a93717233d 100644
--- a/api/utils/keys/hardwarekey/attestation.go
+++ b/api/utils/keys/hardwarekey/attestation.go
@@ -17,7 +17,7 @@ package hardwarekey
 import (
 	"bytes"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 
 	attestationv1 "github.com/gravitational/teleport/api/gen/proto/go/attestation/v1"
diff --git a/api/utils/keys/piv/service.go b/api/utils/keys/piv/service.go
index 50a54335a02c6..a2b51278129ed 100644
--- a/api/utils/keys/piv/service.go
+++ b/api/utils/keys/piv/service.go
@@ -25,7 +25,7 @@ import (
 	"io"
 	"sync"
 
-	"github.com/go-piv/piv-go/piv"
+	"github.com/go-piv/piv-go/v2/piv"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
diff --git a/api/utils/keys/piv/service_test.go b/api/utils/keys/piv/service_test.go
index 471a42842f7ab..1845e2d94d9b8 100644
--- a/api/utils/keys/piv/service_test.go
+++ b/api/utils/keys/piv/service_test.go
@@ -26,7 +26,7 @@ import (
 	"testing"
 	"time"
 
-	pivgo "github.com/go-piv/piv-go/piv"
+	pivgo "github.com/go-piv/piv-go/v2/piv"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/api/utils/keys/piv/yubikey.go b/api/utils/keys/piv/yubikey.go
index bb1eccdc0e0fb..006c967639efe 100644
--- a/api/utils/keys/piv/yubikey.go
+++ b/api/utils/keys/piv/yubikey.go
@@ -34,7 +34,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/go-piv/piv-go/piv"
+	"github.com/go-piv/piv-go/v2/piv"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api"
@@ -439,7 +439,11 @@ func (y *YubiKey) setPINAndPUKFromDefault(ctx context.Context, prompt hardwareke
 	y.pinCache.mu.Lock()
 	defer y.pinCache.mu.Unlock()
 
-	ctx, cancel := context.WithTimeout(ctx, pinPromptTimeout)
+	// Use a longer timeout than pinPromptTimeout since this specific prompt requires the user to
+	// re-type both PIN and PUK. The user might also want to save the values somewhere.
+	// pinPromptTimeout just doesn't give enough time for that.
+	const newPinPromptTimeout = 3 * time.Minute
+	ctx, cancel := context.WithTimeout(ctx, newPinPromptTimeout)
 	defer cancel()
 
 	pinAndPUK, err := prompt.ChangePIN(ctx, keyInfo)
@@ -684,7 +688,7 @@ func (c *sharedPIVConnection) reset() error {
 	return trace.Wrap(c.conn.Reset())
 }
 
-func (c *sharedPIVConnection) setCertificate(key [24]byte, slot piv.Slot, cert *x509.Certificate) error {
+func (c *sharedPIVConnection) setCertificate(key []byte, slot piv.Slot, cert *x509.Certificate) error {
 	release, err := c.connect()
 	if err != nil {
 		return trace.Wrap(err)
@@ -711,7 +715,7 @@ func (c *sharedPIVConnection) certificate(slot piv.Slot) (*x509.Certificate, err
 	return cert, trace.Wrap(err)
 }
 
-func (c *sharedPIVConnection) generateKey(key [24]byte, slot piv.Slot, opts piv.Key) (crypto.PublicKey, error) {
+func (c *sharedPIVConnection) generateKey(key []byte, slot piv.Slot, opts piv.Key) (crypto.PublicKey, error) {
 	release, err := c.connect()
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/api/utils/keys/piv/yubikey_test.go b/api/utils/keys/piv/yubikey_test.go
index 0715910564efa..2876d533b2604 100644
--- a/api/utils/keys/piv/yubikey_test.go
+++ b/api/utils/keys/piv/yubikey_test.go
@@ -24,7 +24,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/go-piv/piv-go/piv"
+	"github.com/go-piv/piv-go/v2/piv"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/api/utils/keys/policy_piv.go b/api/utils/keys/policy_piv.go
deleted file mode 100644
index a99fc532f3010..0000000000000
--- a/api/utils/keys/policy_piv.go
+++ /dev/null
@@ -1,45 +0,0 @@
-//go:build piv && !pivtest
-
-/*
-Copyright 2025 Gravitational, Inc.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-    http://www.apache.org/licenses/LICENSE-2.0
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package keys
-
-import (
-	"github.com/go-piv/piv-go/piv"
-)
-
-// GetPrivateKeyPolicyFromAttestation returns the PrivateKeyPolicy satisfied by the given hardware key attestation.
-// TODO(Joerger): Move to /e where this is used.
-func GetPrivateKeyPolicyFromAttestation(att *piv.Attestation) PrivateKeyPolicy {
-	if att == nil {
-		return PrivateKeyPolicyNone
-	}
-
-	isTouchPolicy := att.TouchPolicy == piv.TouchPolicyCached ||
-		att.TouchPolicy == piv.TouchPolicyAlways
-
-	isPINPolicy := att.PINPolicy == piv.PINPolicyOnce ||
-		att.PINPolicy == piv.PINPolicyAlways
-
-	switch {
-	case isPINPolicy && isTouchPolicy:
-		return PrivateKeyPolicyHardwareKeyTouchAndPIN
-	case isPINPolicy:
-		return PrivateKeyPolicyHardwareKeyPIN
-	case isTouchPolicy:
-		return PrivateKeyPolicyHardwareKeyTouch
-	default:
-		return PrivateKeyPolicyHardwareKey
-	}
-}
diff --git a/api/utils/keys/privatekey.go b/api/utils/keys/privatekey.go
index fbc745a59f36b..c1fd3470c9967 100644
--- a/api/utils/keys/privatekey.go
+++ b/api/utils/keys/privatekey.go
@@ -55,6 +55,7 @@ type cryptoPublicKeyI interface {
 // custom implementation for a non-standard private key, such as a hardware key.
 type PrivateKey struct {
 	crypto.Signer
+
 	// sshPub is the public key in ssh.PublicKey form.
 	sshPub ssh.PublicKey
 	// keyPEM is PEM-encoded private key data which can be parsed with ParsePrivateKey.
@@ -243,6 +244,10 @@ func LoadPrivateKey(keyFile string) (*PrivateKey, error) {
 
 	priv, err := ParsePrivateKey(keyPEM)
 	if err != nil {
+		// Treat malformed keys the same as missing keys.
+		if trace.IsBadParameter(err) {
+			return nil, trace.NotFound("%s", err.Error())
+		}
 		return nil, trace.Wrap(err)
 	}
 	return priv, nil
@@ -306,14 +311,14 @@ func ParsePrivateKey(keyPEM []byte, opts ...ParsePrivateKeyOpt) (*PrivateKey, er
 
 		hwSigner, err := hardwarekey.DecodeSigner(block.Bytes, hwks, appliedOpts.ContextualKeyInfo)
 		if err != nil {
-			return nil, trace.Wrap(err, "failed to parse hardware key signer")
+			return nil, trace.BadParameter("failed to parse hardware key signer: %s", err.Error())
 		}
 
 		return newPrivateKeyWithKeyPEM(hwSigner, keyPEM)
 	case OpenSSHPrivateKeyType:
 		priv, err := ssh.ParseRawPrivateKey(keyPEM)
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return nil, trace.BadParameter("%s", err.Error())
 		}
 		cryptoSigner, ok := priv.(crypto.Signer)
 		if !ok {
@@ -354,7 +359,7 @@ func ParsePrivateKey(keyPEM []byte, opts ...ParsePrivateKeyOpt) (*PrivateKey, er
 		// If all three parse functions returned an error, preferedErr is
 		// guaranteed to be set to the error from the parse function that
 		// usually matches the PEM block type.
-		return nil, trace.Wrap(preferredErr, "parsing private key PEM")
+		return nil, trace.BadParameter("parsing private key PEM: %s", preferredErr.Error())
 	default:
 		return nil, trace.BadParameter("unexpected private key PEM type %q", block.Type)
 	}
@@ -395,6 +400,21 @@ func MarshalPrivateKey(key crypto.Signer) ([]byte, error) {
 	}
 }
 
+// MarshalDecrypter will return a PEM encoded crypto.Decrypter.
+// [key] must be an *rsa.PrivateKey
+func MarshalDecrypter(key crypto.Decrypter) ([]byte, error) {
+	switch privateKey := key.(type) {
+	case *rsa.PrivateKey:
+		privPEM := pem.EncodeToMemory(&pem.Block{
+			Type:  PKCS1PrivateKeyType,
+			Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
+		})
+		return privPEM, nil
+	default:
+		return nil, trace.BadParameter("unsupported private key type %T", key)
+	}
+}
+
 // LoadKeyPair returns the PrivateKey for the given private and public key files.
 func LoadKeyPair(privFile, sshPubFile string, opts ...ParsePrivateKeyOpt) (*PrivateKey, error) {
 	privPEM, err := os.ReadFile(privFile)
@@ -409,6 +429,10 @@ func LoadKeyPair(privFile, sshPubFile string, opts ...ParsePrivateKeyOpt) (*Priv
 
 	priv, err := ParseKeyPair(privPEM, marshaledSSHPub, opts...)
 	if err != nil {
+		// Treat malformed keys the same as missing keys.
+		if trace.IsBadParameter(err) {
+			return nil, trace.NotFound("%s", err.Error())
+		}
 		return nil, trace.Wrap(err)
 	}
 	return priv, nil
@@ -444,6 +468,10 @@ func LoadX509KeyPair(certFile, keyFile string) (tls.Certificate, error) {
 
 	tlsCert, err := X509KeyPair(certPEMBlock, keyPEMBlock)
 	if err != nil {
+		// Treat malformed keys the same as missing keys.
+		if trace.IsBadParameter(err) {
+			return tls.Certificate{}, trace.NotFound("%s", err.Error())
+		}
 		return tls.Certificate{}, trace.Wrap(err)
 	}
 
diff --git a/api/utils/keys/privatekey_test.go b/api/utils/keys/privatekey_test.go
index 4be10d55e6d51..c9bea6ac52a96 100644
--- a/api/utils/keys/privatekey_test.go
+++ b/api/utils/keys/privatekey_test.go
@@ -33,6 +33,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -172,26 +173,56 @@ func TestParseMismatchedPEMHeader(t *testing.T) {
 // that the preferredErr logic in Parse(Private|Public)Key returns an error for
 // each PEM type.
 func TestParseCorruptedKey(t *testing.T) {
-	for _, tc := range []string{
-		"RSA PRIVATE KEY",
-		"PRIVATE KEY",
-		"EC PRIVATE KEY",
-	} {
-		t.Run(tc, func(t *testing.T) {
-			b := pem.EncodeToMemory(&pem.Block{Type: tc, Bytes: []byte("foo")})
-			_, err := keys.ParsePrivateKey(b)
-			require.Error(t, err)
+	t.Parallel()
+	privateKeyTests := []struct {
+		name    string
+		pemData []byte
+	}{
+		{
+			name:    "PRIVATE KEY",
+			pemData: pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: []byte("foo")}),
+		},
+		{
+			name:    "RSA PRIVATE KEY",
+			pemData: pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: []byte("foo")}),
+		},
+		{
+			name:    "EC PRIVATE KEY",
+			pemData: pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: []byte("foo")}),
+		},
+		{
+			name:    "not a private key pem file",
+			pemData: []byte("foo"),
+		},
+	}
+	for _, tc := range privateKeyTests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := keys.ParsePrivateKey(tc.pemData)
+			require.True(t, trace.IsBadParameter(err), "wanted BadParameter, got: %v", err)
 		})
 	}
 
-	for _, tc := range []string{
-		"RSA PUBLIC KEY",
-		"PUBLIC KEY",
-	} {
-		t.Run(tc, func(t *testing.T) {
-			b := pem.EncodeToMemory(&pem.Block{Type: tc, Bytes: []byte("foo")})
-			_, err := keys.ParsePublicKey(b)
-			require.Error(t, err)
+	publicKeyTests := []struct {
+		name    string
+		pemData []byte
+	}{
+		{
+			name:    "RSA PUBLIC KEY",
+			pemData: pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: []byte("foo")}),
+		},
+		{
+			name:    "PUBLIC KEY",
+			pemData: pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: []byte("foo")}),
+		},
+		{
+			name:    "not a public key pem file",
+			pemData: []byte("foo"),
+		},
+	}
+	for _, tc := range publicKeyTests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := keys.ParsePublicKey(tc.pemData)
+			require.True(t, trace.IsBadParameter(err), "wanted BadParameter, got: %v", err)
 		})
 	}
 }
diff --git a/api/utils/keys/publickey.go b/api/utils/keys/publickey.go
index 0979caf266c60..77a4489786bcb 100644
--- a/api/utils/keys/publickey.go
+++ b/api/utils/keys/publickey.go
@@ -89,5 +89,5 @@ func ParsePublicKey(keyPEM []byte) (crypto.PublicKey, error) {
 	// If both parse functions returned an error, preferedErr is guaranteed to
 	// be set to the error from the parse function that usually matches the PEM
 	// block type.
-	return nil, trace.Wrap(preferredErr, "parsing public key PEM")
+	return nil, trace.BadParameter("parsing public key PEM: %s", preferredErr)
 }
diff --git a/api/utils/retryutils/retryv2.go b/api/utils/retryutils/retryv2.go
index b54ae2e7cdfef..0b02a64d9fa52 100644
--- a/api/utils/retryutils/retryv2.go
+++ b/api/utils/retryutils/retryv2.go
@@ -51,6 +51,31 @@ type Driver interface {
 	Check() error
 }
 
+// NewConstantDriver creates a constant retry driver with the supplied step value. Resulting
+// retries have always the same value of the provided step.
+func NewConstantDriver(step time.Duration) Driver {
+	return constantDriver{step}
+}
+
+type constantDriver struct {
+	step time.Duration
+}
+
+func (d constantDriver) Duration(_ int64) time.Duration {
+	return d.step
+}
+
+func (d constantDriver) Check() error {
+	if d.step <= 0 {
+		return trace.BadParameter("constant driver requires positive step value")
+	}
+
+	if d.step > maxBackoff {
+		return trace.BadParameter("constant backoff step value too large: %v (max=%v)", d.step, maxBackoff)
+	}
+	return nil
+}
+
 // NewLinearDriver creates a linear retry driver with the supplied step value. Resulting retries
 // have increase their backoff by a fixed step amount on each increment, with the first retry
 // having a base step amount of zero.
@@ -220,9 +245,7 @@ func (r *RetryV2) Duration() time.Duration {
 		return 0
 	}
 
-	if a > r.Max {
-		a = r.Max
-	}
+	a = min(a, r.Max)
 
 	if r.Jitter != nil {
 		a = r.Jitter(a)
diff --git a/api/utils/retryutils/update_with_retry.go b/api/utils/retryutils/update_with_retry.go
new file mode 100644
index 0000000000000..2c94587df5e97
--- /dev/null
+++ b/api/utils/retryutils/update_with_retry.go
@@ -0,0 +1,119 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package retryutils
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+)
+
+const (
+	// updateWithRetryMaxRetries is the default number of retries in case of conflicts.
+	updateWithRetryMaxRetries = 3
+	// updateWithRetryHalfJitterBetweenAttempts is the default jitter, [UpdateWithRetry] is
+	// using to wait between attempts.
+	updateWithRetryHalfJitterBetweenAttempts = 2 * time.Second
+)
+
+type updateWithRetryOptions struct {
+	maxRetries  int
+	retryConfig RetryV2Config
+}
+
+// UpdateWithRetryOpt is the option type for [UpdateWithRetry]. See With* funcs in the package to
+// see what options are available.
+type UpdateWithRetryOpt func(*updateWithRetryOptions)
+
+// WithMaxRetries changes the max retry attempts number from the default
+// [updateWithRetryMaxRetries].
+func WithMaxRetries(maxRetries int) UpdateWithRetryOpt {
+	return func(o *updateWithRetryOptions) {
+		o.maxRetries = maxRetries
+	}
+}
+
+// WithRetryConfig changes the default retry configuration.
+func WithRetryConfig(config RetryV2Config) UpdateWithRetryOpt {
+	return func(o *updateWithRetryOptions) {
+		o.retryConfig = config
+	}
+}
+
+// RefreshFn refreshes the resource if needed considering if this is an retry attempt or the first
+// attempt.
+type RefreshFn[R any] func(ctx context.Context, isRetry bool) (R, error)
+
+// UpdateFn conditionally updates the resource.
+type UpdateFn[R any] func(ctx context.Context, resource R) error
+
+// UpdateWithRetry tries to conditionally update a resource, by default retrying 3 times with a 2s
+// half jittered constant backoff in between retries. The retry configuration can be changed with
+// the option arguments.
+//
+// UpdateWithRetry will retry only if updateFn returns an error matched with trace.IsCompareFailed.
+// It will return any other error immediately without retries.
+func UpdateWithRetry[R any](ctx context.Context, clock clockwork.Clock, refreshFn RefreshFn[R], updateFn UpdateFn[R], opts ...UpdateWithRetryOpt) error {
+	options := updateWithRetryOptions{
+		maxRetries: updateWithRetryMaxRetries,
+		retryConfig: RetryV2Config{
+			Clock:  clock,
+			Driver: NewConstantDriver(updateWithRetryHalfJitterBetweenAttempts),
+			Max:    updateWithRetryHalfJitterBetweenAttempts,
+			Jitter: HalfJitter,
+		},
+	}
+	for _, o := range opts {
+		o(&options)
+	}
+
+	retry, err := NewRetryV2(options.retryConfig)
+	if err != nil {
+		return trace.Wrap(err, "creating retry instance")
+	}
+
+	var updateErr error
+	attempts := min(options.maxRetries+1, maxAttempts)
+	for i := range attempts {
+		lastAttempt := i == attempts-1
+
+		isRetry := i > 0
+		resource, err := refreshFn(ctx, isRetry)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		updateErr = updateFn(ctx, resource)
+		switch {
+		case !lastAttempt && trace.IsCompareFailed(updateErr):
+			d := retry.Duration()
+			select {
+			case <-clock.After(d):
+				continue
+			case <-ctx.Done():
+				return trace.Wrap(ctx.Err())
+			}
+		case updateErr != nil:
+			return trace.Wrap(updateErr)
+		default:
+			return nil
+		}
+	}
+	return trace.Wrap(updateErr)
+}
diff --git a/api/utils/retryutils/update_with_retry_test.go b/api/utils/retryutils/update_with_retry_test.go
new file mode 100644
index 0000000000000..a0300322d7864
--- /dev/null
+++ b/api/utils/retryutils/update_with_retry_test.go
@@ -0,0 +1,242 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package retryutils
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupUpdateWithRetryTest[R any](t *testing.T) (*clockwork.FakeClock, *refreshFnRecorder[R], *updateFnRecorder[R]) {
+	t.Helper()
+	return clockwork.NewFakeClock(), new(refreshFnRecorder[R]), new(updateFnRecorder[R])
+
+}
+
+func Test_UpdateWithRetry_returns_error_if_refreshFn_returns_error(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock, refreshRecorder, updateRecorder := setupUpdateWithRetryTest[string](t)
+
+	refreshRecorder.retErr = errors.New("error from retryFn")
+
+	err := UpdateWithRetry(ctx, clock, refreshRecorder.Refresh, updateRecorder.Update)
+	require.Error(t, err)
+	require.Equal(t, refreshRecorder.retErr.Error(), err.Error())
+
+	require.Equal(t, 1, refreshRecorder.callCnt)
+	require.Equal(t, 0, updateRecorder.callCnt)
+
+	require.False(t, refreshRecorder.lastArgIsRetry)
+}
+
+func Test_UpdateWithRetry_passes_value_from_refreshFn_to_updateFn(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock, refreshRecorder, updateRecorder := setupUpdateWithRetryTest[string](t)
+
+	resource := "test_resource_value_1"
+
+	refreshRecorder.retResource = resource
+
+	err := UpdateWithRetry(ctx, clock, refreshRecorder.Refresh, updateRecorder.Update)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, refreshRecorder.callCnt)
+	require.Equal(t, 1, updateRecorder.callCnt)
+	require.Equal(t, resource, updateRecorder.lastArgResource)
+
+	require.False(t, refreshRecorder.lastArgIsRetry)
+}
+
+func Test_UpdateWithRetry_retries_if_updateFn_returns_CompareFailedError(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock, refreshRecorder, updateRecorder := setupUpdateWithRetryTest[string](t)
+
+	updateRecorder.retErr = trace.CompareFailed("test_compare_failed_1")
+
+	updateWithRetryRetCh := make(chan error)
+
+	go func() {
+		updateWithRetryRetCh <- UpdateWithRetry(ctx, clock, refreshRecorder.Refresh, updateRecorder.Update)
+	}()
+
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		require.Equal(c, 1, refreshRecorder.read().callCnt)
+		require.Equal(c, 1, updateRecorder.read().callCnt)
+		require.False(c, refreshRecorder.read().lastArgIsRetry)
+	}, 4*time.Second, 10*time.Millisecond)
+
+	clock.BlockUntilContext(ctx, 1)
+
+	totalAttempts := updateWithRetryMaxRetries + 1
+
+	for expectedCallCnt := 2; expectedCallCnt < totalAttempts; expectedCallCnt++ {
+		clock.Advance(updateWithRetryHalfJitterBetweenAttempts)
+		clock.BlockUntilContext(ctx, 1)
+
+		require.Equal(t, expectedCallCnt, refreshRecorder.read().callCnt)
+		require.Equal(t, expectedCallCnt, updateRecorder.read().callCnt)
+		require.True(t, refreshRecorder.read().lastArgIsRetry)
+	}
+
+	clock.Advance(updateWithRetryHalfJitterBetweenAttempts)
+
+	err := <-updateWithRetryRetCh
+	require.Error(t, err)
+	require.Equal(t, updateRecorder.read().retErr.Error(), err.Error())
+
+	require.Equal(t, totalAttempts, refreshRecorder.read().callCnt)
+	require.Equal(t, totalAttempts, updateRecorder.read().callCnt)
+	require.True(t, refreshRecorder.read().lastArgIsRetry)
+}
+
+func Test_UpdateWithRetry_do_not_retry_if_updateFn_returns_different_error(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock, refreshRecorder, updateRecorder := setupUpdateWithRetryTest[string](t)
+
+	updateRecorder.retErr = errors.New("different_update_error_1")
+
+	err := UpdateWithRetry(ctx, clock, refreshRecorder.Refresh, updateRecorder.Update)
+	require.Error(t, err)
+	require.Equal(t, updateRecorder.retErr.Error(), err.Error())
+
+	require.Equal(t, 1, refreshRecorder.callCnt)
+	require.Equal(t, 1, updateRecorder.callCnt)
+}
+
+func Test_UpdateWithRetry_stops_retrying_if_updateFn_returns_different_error_at_some_point(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock, refreshRecorder, updateRecorder := setupUpdateWithRetryTest[string](t)
+
+	updateRecorder.retErr = trace.CompareFailed("test_compare_failed_1")
+
+	updateWithRetryRetCh := make(chan error)
+
+	go func() {
+		updateWithRetryRetCh <- UpdateWithRetry(ctx, clock, refreshRecorder.Refresh, updateRecorder.Update)
+	}()
+
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		require.Equal(c, 1, refreshRecorder.read().callCnt)
+		require.Equal(c, 1, updateRecorder.read().callCnt)
+		require.False(c, refreshRecorder.read().lastArgIsRetry)
+	}, 4*time.Second, 10*time.Millisecond)
+
+	clock.BlockUntilContext(ctx, 1)
+
+	totalAttempts := updateWithRetryMaxRetries + 1
+	somePoint := totalAttempts - 1
+
+	for expectedCallCnt := 2; expectedCallCnt < totalAttempts; expectedCallCnt++ {
+		clock.Advance(updateWithRetryHalfJitterBetweenAttempts)
+		clock.BlockUntilContext(ctx, 1)
+
+		if expectedCallCnt == somePoint {
+			updateRecorder.mu.Lock()
+			updateRecorder.retErr = fmt.Errorf("achieved some point (%d)", somePoint)
+			updateRecorder.mu.Unlock()
+			break
+		}
+
+		require.Equal(t, expectedCallCnt, refreshRecorder.read().callCnt)
+		require.Equal(t, expectedCallCnt, updateRecorder.read().callCnt)
+		require.True(t, refreshRecorder.read().lastArgIsRetry)
+	}
+
+	clock.Advance(updateWithRetryHalfJitterBetweenAttempts)
+
+	err := <-updateWithRetryRetCh
+	require.Error(t, err)
+	require.Equal(t, updateRecorder.read().retErr.Error(), err.Error())
+
+	require.Equal(t, totalAttempts, refreshRecorder.read().callCnt)
+	require.Equal(t, totalAttempts, updateRecorder.read().callCnt)
+	require.True(t, refreshRecorder.read().lastArgIsRetry)
+}
+
+type refreshFnRecorder[R any] struct {
+	mu sync.RWMutex
+	refreshFnRecorderState[R]
+}
+
+type refreshFnRecorderState[R any] struct {
+	callCnt int
+
+	lastArgIsRetry bool
+
+	retResource R
+	retErr      error
+}
+
+func (r *refreshFnRecorder[R]) read() refreshFnRecorderState[R] {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return r.refreshFnRecorderState
+}
+
+func (r *refreshFnRecorder[R]) Refresh(_ context.Context, isRetry bool) (R, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.callCnt++
+	r.lastArgIsRetry = isRetry
+	return r.retResource, r.retErr
+}
+
+type updateFnRecorder[R any] struct {
+	mu sync.RWMutex
+	updateFnRecorderState[R]
+}
+
+type updateFnRecorderState[R any] struct {
+	callCnt int
+
+	lastArgResource R
+
+	retErr error
+}
+
+func (u *updateFnRecorder[R]) read() updateFnRecorderState[R] {
+	u.mu.RLock()
+	defer u.mu.RUnlock()
+	return u.updateFnRecorderState
+}
+
+func (u *updateFnRecorder[R]) Update(_ context.Context, resource R) error {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	u.callCnt++
+	u.lastArgResource = resource
+	return u.retErr
+}
diff --git a/api/utils/sshutils/callback.go b/api/utils/sshutils/callback.go
index c96e4ff39dc8d..a69931f28d870 100644
--- a/api/utils/sshutils/callback.go
+++ b/api/utils/sshutils/callback.go
@@ -70,23 +70,16 @@ func NewHostKeyCallback(conf HostKeyCallbackConfig) (ssh.HostKeyCallback, error)
 	return checker.CheckHostKey, nil
 }
 
-func makeIsHostAuthorityFunc(getCheckers CheckersGetter) func(key ssh.PublicKey, host string) bool {
-	return func(key ssh.PublicKey, host string) bool {
+func makeIsHostAuthorityFunc(getCheckers CheckersGetter) func(authority ssh.PublicKey, host string) bool {
+	return func(authority ssh.PublicKey, host string) bool {
 		checkers, err := getCheckers()
 		if err != nil {
 			slog.ErrorContext(context.Background(), "Failed to get checkers.", "host", host, "error", err)
 			return false
 		}
 		for _, checker := range checkers {
-			switch v := key.(type) {
-			case *ssh.Certificate:
-				if KeysEqual(v.SignatureKey, checker) {
-					return true
-				}
-			default:
-				if KeysEqual(key, checker) {
-					return true
-				}
+			if KeysEqual(authority, checker) {
+				return true
 			}
 		}
 		slog.DebugContext(context.Background(), "No CA found for target host.", "host", host)
diff --git a/api/utils/sshutils/callback_test.go b/api/utils/sshutils/callback_test.go
new file mode 100644
index 0000000000000..78ab289e33b1e
--- /dev/null
+++ b/api/utils/sshutils/callback_test.go
@@ -0,0 +1,56 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sshutils
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+func TestMakeIsHostAuthorityFunc(t *testing.T) {
+	rawCA1, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca1, err := ssh.NewPublicKey(rawCA1)
+	require.NoError(t, err)
+
+	rawCA2, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca2, err := ssh.NewPublicKey(rawCA2)
+	require.NoError(t, err)
+
+	rawCA3, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca3, err := ssh.NewPublicKey(rawCA3)
+	require.NoError(t, err)
+
+	isHostAuthority := makeIsHostAuthorityFunc(func() ([]ssh.PublicKey, error) {
+		return []ssh.PublicKey{ca1, ca2}, nil
+	})
+
+	cert1 := &ssh.Certificate{
+		Key:          ca1,
+		SignatureKey: ca1,
+	}
+
+	require.True(t, isHostAuthority(ca1, ""))
+	require.True(t, isHostAuthority(ca2, ""))
+	require.False(t, isHostAuthority(ca3, ""))
+
+	require.False(t, isHostAuthority(cert1, ""), "a certificate signed by a certificate should not pass validation")
+}
diff --git a/api/utils/sshutils/checker.go b/api/utils/sshutils/checker.go
index ba63ddb345a89..cc37a9d7421c9 100644
--- a/api/utils/sshutils/checker.go
+++ b/api/utils/sshutils/checker.go
@@ -20,6 +20,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rsa"
+	"fmt"
 	"net"
 
 	"github.com/gravitational/trace"
@@ -28,13 +29,25 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 )
 
+type FIPSError struct {
+	message string
+}
+
+func (f *FIPSError) Error() string {
+	return f.message
+}
+
+func newFIPSError(message string, args ...any) error {
+	return &FIPSError{fmt.Sprintf("FIPS: "+message, args...)}
+}
+
 // CertChecker is a drop-in replacement for ssh.CertChecker. In FIPS mode,
 // checks if the certificate (or key) were generated with a supported algorithm.
 type CertChecker struct {
 	ssh.CertChecker
 
 	// FIPS means in addition to checking the validity of the key or
-	// certificate, also check that FIPS 140-2 algorithms were used.
+	// certificate, also check that FIPS algorithms were used.
 	FIPS bool
 
 	// OnCheckCert is called when validating host certificate.
@@ -123,12 +136,12 @@ func (c *CertChecker) validateFIPS(key ssh.PublicKey) error {
 func validateFIPSAlgorithm(key ssh.PublicKey) error {
 	cryptoKey, ok := key.(ssh.CryptoPublicKey)
 	if !ok {
-		return trace.BadParameter("unable to determine underlying public key")
+		return trace.Wrap(newFIPSError("unable to determine underlying public key"))
 	}
 	switch k := cryptoKey.CryptoPublicKey().(type) {
 	case *rsa.PublicKey:
 		if k.N.BitLen() != constants.RSAKeySize {
-			return trace.BadParameter("found %v-bit RSA key, only %v-bit supported", k.N.BitLen(), constants.RSAKeySize)
+			return trace.Wrap(newFIPSError("found %v-bit RSA key, only %v-bit supported", k.N.BitLen(), constants.RSAKeySize))
 		}
 	case *ecdsa.PublicKey:
 		if k.Curve != elliptic.P256() && k.Curve != elliptic.P384() {
@@ -136,10 +149,10 @@ func validateFIPSAlgorithm(key ssh.PublicKey) error {
 			if params == nil {
 				return trace.BadParameter("unable to determine curve of ECDSA public key")
 			}
-			return trace.BadParameter("found ECDSA key with curve %s, only P-256 and P-384 are supported", params.Name)
+			return trace.Wrap(newFIPSError("found ECDSA key with curve %s, only P-256 and P-384 are supported", params.Name))
 		}
 	default:
-		return trace.BadParameter("only RSA and ECDSA keys supported")
+		return trace.Wrap(newFIPSError("only RSA and ECDSA keys supported"))
 	}
 	return nil
 }
diff --git a/api/utils/time.go b/api/utils/time.go
index 288a02d8f6b11..14411752a8314 100644
--- a/api/utils/time.go
+++ b/api/utils/time.go
@@ -18,6 +18,8 @@ package utils
 
 import (
 	"time"
+
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // UTC converts time to UTC timezone
@@ -41,3 +43,28 @@ const HumanTimeFormatString = "Mon Jan _2 15:04 UTC"
 func HumanTimeFormat(d time.Time) string {
 	return d.Format(HumanTimeFormatString)
 }
+
+// TimeFromProto converts a protobuf Timestamp to a Go time.Time, preserving
+// the zero value across the conversion boundary (standard go/proto timestamp
+// conversion doesn't preserve "zeroness").
+func TimeFromProto(t *timestamppb.Timestamp) time.Time {
+	// use the zero time to represent the nil timestamp. note that this is conceptually distinct
+	// from using t.GetSeconds() == 0 && t.GetNanos() == 0. a timstampb that happens to be created
+	// targeting the unix epoch isn't necessarily equivalent to a zero go timestamp, since the zero
+	// value for the go timestamp isn't the unix epoch.
+	if t == nil || (t.GetSeconds() == 0 && t.GetNanos() == 0) {
+		return time.Time{}
+	}
+
+	return t.AsTime()
+}
+
+// TimeIntoProto converts a Go time.Time to a protobuf Timestamp, preserving
+// the zero value across the conversion boundary (standard go/proto timestamp
+// conversion doesn't preserve "zeroness").
+func TimeIntoProto(t time.Time) *timestamppb.Timestamp {
+	if t.IsZero() {
+		return nil
+	}
+	return timestamppb.New(t)
+}
diff --git a/api/version.go b/api/version.go
index 9ad60b95cb8a7..7390ce1e099c6 100644
--- a/api/version.go
+++ b/api/version.go
@@ -2,10 +2,10 @@
 
 package api
 
-const Version = "18.0.0-dev"
+const Version = "18.6.1"
 
 const VersionMajor = 18
-const VersionMinor = 0
-const VersionPatch = 0
-const VersionPreRelease = "dev"
+const VersionMinor = 6
+const VersionPatch = 1
+const VersionPreRelease = ""
 const VersionMetadata = ""
diff --git a/assets/aws/files/install-hardened.sh b/assets/aws/files/install-hardened.sh
index c0db8a739bf3b..48b80057d9a1f 100644
--- a/assets/aws/files/install-hardened.sh
+++ b/assets/aws/files/install-hardened.sh
@@ -19,6 +19,8 @@ ln -s /opt/certbot/bin/certbot /usr/local/bin/certbot
 useradd -r teleport -u "${TELEPORT_UID}" -d /var/lib/teleport
 # Add teleport to adm group to read and write logs
 usermod -a -G adm teleport
+# Disable password age on ec2-user account to prevent users being locked out (V-230367)
+chage --maxdays -1 ec2-user
 
 # Setup teleport run dir for pid files
 install -d -m 0700 -o teleport -g adm /var/lib/teleport
diff --git a/assets/backport/go.mod b/assets/backport/go.mod
index 15f4ee14685a1..0a0c1059ee7d8 100644
--- a/assets/backport/go.mod
+++ b/assets/backport/go.mod
@@ -1,14 +1,12 @@
 module github.com/teleport/assets/backport
 
-go 1.23.7
-
-toolchain go1.24.1
+go 1.24.11
 
 require (
 	github.com/google/go-github/v41 v41.0.0
 	github.com/gravitational/trace v1.5.1
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/oauth2 v0.29.0
+	golang.org/x/oauth2 v0.30.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -16,7 +14,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/assets/backport/go.sum b/assets/backport/go.sum
index 3c5b3595ca5de..a17ce125a5f77 100644
--- a/assets/backport/go.sum
+++ b/assets/backport/go.sum
@@ -3,9 +3,8 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github/v41 v41.0.0 h1:HseJrM2JFf2vfiZJ8anY2hqBjdfY1Vlj/K27ueww4gg=
 github.com/google/go-github/v41 v41.0.0/go.mod h1:XgmCA5H323A9rtgExdTcnDkcqp6S30AVACCBDOonIxg=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
@@ -18,15 +17,15 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/assets/loadtest/helm/node-agent/templates/deployment.yaml b/assets/loadtest/helm/node-agent/templates/deployment.yaml
index 7295a8ea89005..bd81cdd7cd30f 100644
--- a/assets/loadtest/helm/node-agent/templates/deployment.yaml
+++ b/assets/loadtest/helm/node-agent/templates/deployment.yaml
@@ -30,6 +30,7 @@ spec:
             - name: SSL_CERT_FILE
               value: /etc/teleport-tls-ca/ca.pem
             {{- end }}
+            {{- if $.Values.extraEnv }}{{ toYaml $.Values.extraEnv | nindent 12 }}{{ end }}
           volumeMounts:
             - mountPath: /etc/teleport-config
               name: config
diff --git a/assets/loadtest/helm/node-agent/values.yaml b/assets/loadtest/helm/node-agent/values.yaml
index 46f09427ef2d6..e17220ac1c3fa 100644
--- a/assets/loadtest/helm/node-agent/values.yaml
+++ b/assets/loadtest/helm/node-agent/values.yaml
@@ -19,11 +19,24 @@ joinParams:
   # DO NOT USE THIS IN PRODUCTION
   token_name: ""
 
+# pod tolerations
+# array of https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#toleration-v1-core
 tolerations: []
 
+# pod affinity rules
+# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#affinity-v1-core
 affinity: {}
 
 tls:
   existingCASecretName: ""
 
+# envvars set in each container
+# array of https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#envvar-v1-core
+extraEnv: []
+
+# resource requirements for each container
+# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#resourcerequirements-v1-core
+resources: {}
+
+# Teleport labels
 labels: {}
diff --git a/buf-go.gen.yaml b/buf-go.gen.yaml
index 1b814fa2ef672..3564ee5f443e0 100644
--- a/buf-go.gen.yaml
+++ b/buf-go.gen.yaml
@@ -5,6 +5,7 @@ inputs:
     exclude_paths:
       # generated by buf-gogo.gen.yaml
       - api/proto/teleport/attestation/
+      - api/proto/teleport/componentfeatures/
       - api/proto/teleport/legacy/
       - api/proto/teleport/mfa/
       - api/proto/teleport/usageevents/
@@ -16,6 +17,7 @@ inputs:
       # excluded by buf-gogo.gen.yaml
       - api/proto/teleport/legacy/client/proto/event.proto
       - api/proto/teleport/legacy/client/proto/inventory.proto
+      - api/proto/teleport/legacy/client/proto/requestable_roles.proto
 
 plugins:
   - local:
diff --git a/buf-gogo.gen.yaml b/buf-gogo.gen.yaml
index c3044013e6e73..e0e8fd85c935e 100644
--- a/buf-gogo.gen.yaml
+++ b/buf-gogo.gen.yaml
@@ -4,6 +4,7 @@ inputs:
   - directory: .
     paths:
       - api/proto/teleport/attestation/
+      - api/proto/teleport/componentfeatures/
       - api/proto/teleport/legacy/
       - api/proto/teleport/mfa/
       - api/proto/teleport/usageevents/
@@ -12,6 +13,7 @@ inputs:
       # generated by buf-go.gen.yaml
       - api/proto/teleport/legacy/client/proto/event.proto
       - api/proto/teleport/legacy/client/proto/inventory.proto
+      - api/proto/teleport/legacy/client/proto/requestable_roles.proto
 
 plugins:
   - local:
diff --git a/buf-legacy.yaml b/buf-legacy.yaml
index f50c9f7b20e5b..5aa86eff420f0 100644
--- a/buf-legacy.yaml
+++ b/buf-legacy.yaml
@@ -21,6 +21,7 @@ lint:
     # - COMMENT_MESSAGE
     - COMMENT_RPC
     - COMMENT_SERVICE
+    - PAGINATION_REQUIRED
   except:
     # MINIMAL
     - PACKAGE_DIRECTORY_MATCH
@@ -35,3 +36,12 @@ lint:
     - RPC_REQUEST_RESPONSE_UNIQUE
     - RPC_REQUEST_STANDARD_NAME
     - RPC_RESPONSE_STANDARD_NAME
+plugins:
+  - plugin:
+      - env
+      - GOWORK=off
+      - go
+      - -C
+      - ./build.assets/tooling
+      - run
+      - ./cmd/buf-plugin-linters
diff --git a/buf-ts.gen.yaml b/buf-ts.gen.yaml
index 75ca359210c8a..b41c6ae9d5701 100644
--- a/buf-ts.gen.yaml
+++ b/buf-ts.gen.yaml
@@ -3,11 +3,6 @@ version: v2
 inputs:
   - directory: .
     paths:
-      - api/proto/teleport/accesslist/
-      - api/proto/teleport/devicetrust/
-      - api/proto/teleport/header/
-      - api/proto/teleport/trait/
-      - api/proto/teleport/legacy/types/trusted_device_requirement.proto
       - api/proto/teleport/userpreferences/
       - proto/prehog/
       - proto/teleport/lib/teleterm/
@@ -33,10 +28,12 @@ plugins:
       - protoc-gen-ts
     out: gen/proto/ts
     opt:
-      # the next time we tweak the ts codegen we should put the options in
-      # alphabetical order
-      - eslint_disable
       - add_pb_suffix
+      - eslint_disable
+      # By default, only the proto files passed as input to protoc are generated, not the files they
+      # import (with the exception of well-known types which are always generated when imported).
+      # generate_dependencies generates code for dependencies too.
+      - generate_dependencies
       - server_grpc1
       - ts_nocheck
     strategy: all
diff --git a/buf.yaml b/buf.yaml
index 88945bfcb3a0e..81f74dce9733e 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -17,6 +17,7 @@ lint:
     - COMMENT_RPC
     - COMMENT_SERVICE
     - PACKAGE_NO_IMPORT_CYCLE
+    - PAGINATION_REQUIRED
     - UNARY_RPC
   except:
     - FIELD_NOT_REQUIRED
@@ -75,6 +76,8 @@ lint:
       - api/proto/teleport/workloadidentity/v1/revocation_service.proto
       - proto/accessgraph/v1alpha/access_graph_service.proto
       - proto/teleport/lib/teleterm/v1/service.proto
+      - api/proto/teleport/recordingmetadata/v1/recordingmetadata_service.proto
+      - api/proto/teleport/join/v1/joinservice.proto
 
 breaking:
   use:
@@ -83,3 +86,15 @@ breaking:
   ignore:
     # TODO(codingllama): Remove ignore once the PDP API is stable.
     - api/proto/teleport/decision/v1alpha1
+    # TODO(nklaassen): Remove ignore once the new join API is stable.
+    - api/proto/teleport/join/v1
+
+plugins:
+  - plugin:
+      - env
+      - GOWORK=off
+      - go
+      - -C
+      - ./build.assets/tooling
+      - run
+      - ./cmd/buf-plugin-linters
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 7926786363285..82f6429998ef5 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -142,6 +142,7 @@ RUN apt-get -y update && \
         git \
         gnupg \
         gzip \
+        jq \
         libc6-dev \
         libelf-dev \
         libpam-dev \
@@ -181,8 +182,6 @@ RUN apt-get -y update && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
     tee /etc/apt/sources.list.d/hashicorp.list > /dev/null && \
     apt-get update && apt-get install terraform -y --no-install-recommends && \
-    # Manually install the wasm-opt binary from the binaryen package on ARM64.
-    if [ "$BUILDARCH" = "arm64" ]; then apt-get install -y binaryen; fi && \
     pip3 --no-cache-dir install yamllint && \
     dpkg-reconfigure locales && \
     apt-get -y clean && \
@@ -228,9 +227,10 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu; fi
 
-ARG WASM_PACK_VERSION
-# Install wasm-pack for targeting WebAssembly from Rust.
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
+ARG WASM_OPT_VERSION
+ARG WASM_BINDGEN_VERSION
+# Install wasm-bindgen-ci and wasm-opt for bulding rust webassembly module.
+RUN cargo install --locked wasm-opt@${WASM_OPT_VERSION} wasm-bindgen-cli@${WASM_BINDGEN_VERSION}
 
 # Switch back to root for the remaining instructions and keep it as the default
 # user.
@@ -249,7 +249,7 @@ RUN corepack enable yarn pnpm
 
 # Install Go.
 ARG GOLANG_VERSION
-RUN mkdir -p /opt && cd /opt && curl -fsSL https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | tar xz && \
+RUN mkdir -p /opt && cd /opt && curl -fsSL https://go.dev/dl/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | tar xz && \
     mkdir -p /go/src/github.com/gravitational/teleport && \
     chmod a+w /go && \
     chmod a+w /var/lib && \
diff --git a/build.assets/Dockerfile-arm b/build.assets/Dockerfile-arm
index 24ae7e6715589..c702e2de6a7e6 100644
--- a/build.assets/Dockerfile-arm
+++ b/build.assets/Dockerfile-arm
@@ -63,7 +63,7 @@ RUN corepack enable yarn pnpm
 ARG GOLANG_VERSION
 RUN mkdir -p /opt && \
     cd /opt && \
-    curl -fsSL "https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-$BUILDARCH.tar.gz" | tar xz && \
+    curl -fsSL "https://go.dev/dl/$GOLANG_VERSION.linux-$BUILDARCH.tar.gz" | tar xz && \
     mkdir -p /go/src/github.com/gravitational/teleport && \
     chmod a+w /go && \
     chmod a+w /var/lib && \
diff --git a/build.assets/Dockerfile-centos7 b/build.assets/Dockerfile-centos7
index c3862ee508836..a2e379e3a2970 100644
--- a/build.assets/Dockerfile-centos7
+++ b/build.assets/Dockerfile-centos7
@@ -245,7 +245,7 @@ COPY --from=git2 /opt/git /
 
 # Install Go.
 ARG GOLANG_VERSION
-RUN mkdir -p /opt && cd /opt && curl -fsSL https://storage.googleapis.com/golang/${GOLANG_VERSION}.linux-${TARGETARCH}.tar.gz | tar xz && \
+RUN mkdir -p /opt && cd /opt && curl -fsSL https://go.dev/dl/${GOLANG_VERSION}.linux-${TARGETARCH}.tar.gz | tar xz && \
     mkdir -p /go/src/github.com/gravitational/teleport && \
     chmod a+w /go && \
     chmod a+w /var/lib && \
@@ -279,11 +279,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustc --version && \
     rustup target add wasm32-unknown-unknown
 
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-# scl enable is required to use the newer C compiler installed above. Without it, the build fails.
-RUN scl enable ${DEVTOOLSET} "cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}"
-
 # Do a quick switch back to root and copy/setup libfido2 and libpcsclite binaries.
 # Do this last to take better advantage of the multi-stage build.
 USER root
diff --git a/build.assets/Dockerfile-grpcbox b/build.assets/Dockerfile-grpcbox
index e15807374df43..8360d67ec9616 100644
--- a/build.assets/Dockerfile-grpcbox
+++ b/build.assets/Dockerfile-grpcbox
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM docker.io/golang:1.24.3
+FROM docker.io/golang:1.24.11
 
 # Image layers go from less likely to most likely to change.
 RUN apt-get update && \
@@ -40,3 +40,14 @@ RUN \
   go -C /teleport-module run -exec true google.golang.org/grpc/cmd/protoc-gen-go-grpc && \
   go -C /teleport-module run -exec true google.golang.org/protobuf/cmd/protoc-gen-go && \
   rm -rf /teleport-module
+
+# Pre-cache buf plugin
+COPY build.assets/tooling /tooling-tmp/
+RUN \
+  go -C /tooling-tmp  run -exec true ./cmd/buf-plugin-linters &&  \
+  rm -rf /tooling-tmp
+
+ARG UID
+ARG GID
+RUN mkdir -p /.cache /.npm && \
+  chown -R $UID:$GID /.cache /.npm /go/pkg/mod/
diff --git a/build.assets/Dockerfile-node b/build.assets/Dockerfile-node
index 59a3100c80e1e..3aea917065e15 100644
--- a/build.assets/Dockerfile-node
+++ b/build.assets/Dockerfile-node
@@ -49,8 +49,6 @@ RUN apt-get -y update && \
     # Used during tag builds to build the RPM package of Connect.
     rpm \
     && \
-    # Manually install the wasm-opt binary from the binaryen package on ARM64.
-    if [ "$BUILDARCH" = "arm64" ]; then apt-get install -y binaryen; fi && \
     dpkg-reconfigure locales && \
     apt-get -y clean && \
     rm -rf /var/lib/apt/lists/*
@@ -83,6 +81,7 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu; fi
 
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
+ARG WASM_OPT_VERSION
+ARG WASM_BINDGEN_VERSION
+# Install wasm-bindgen-ci and wasm-opt for bulding rust webassembly module.
+RUN cargo install --locked wasm-opt@${WASM_OPT_VERSION} wasm-bindgen-cli@${WASM_BINDGEN_VERSION}
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 17106405bbc3c..61c0162fec07f 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -56,6 +56,10 @@ endif
 # $(ARCH) is the target architecture we want to build for.
 REQUIRE_HOST_ARCH = $(if $(filter-out $(ARCH),$(RUNTIME_ARCH)),$(error Cannot cross-compile $@ $(ARCH) on $(RUNTIME_ARCH)))
 
+# Determine which version of wasm-bindgen should be installed on build containers
+# responsible for building webassets.
+WASM_BINDGEN_VERSION ?= $(shell $(MAKE) -C .. --no-print-directory  print-wasm-bindgen-version)
+
 # This determines which make target we call in this repo's top level Makefile when
 # make release in this Makefile is called. Currently this supports its default value
 # (release) and release-unix-preserving-webassets. See the release-arm target for
@@ -176,7 +180,8 @@ buildbox:
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg GOLANGCI_LINT_VERSION=$(GOLANGCI_LINT_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
+		--build-arg WASM_OPT_VERSION=$(WASM_OPT_VERSION) \
+		--build-arg WASM_BINDGEN_VERSION=$(WASM_BINDGEN_VERSION) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg BUF_VERSION=$(BUF_VERSION) \
@@ -219,7 +224,6 @@ buildbox-centos7:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -248,7 +252,6 @@ buildbox-centos7-fips:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -297,7 +300,8 @@ buildbox-node:
 		--build-arg GID=$(GID) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
+		--build-arg WASM_OPT_VERSION=$(WASM_OPT_VERSION) \
+		--build-arg WASM_BINDGEN_VERSION=$(WASM_BINDGEN_VERSION) \
 		--cache-to type=inline \
 		--cache-from $(BUILDBOX_NODE) \
 		$(if $(PUSH),--push,--load) \
@@ -738,11 +742,18 @@ print-rust-version:
 	@echo $(RUST_VERSION)
 
 #
-# Print the wasm-pack version used to build Teleport.
+# Print the wasm-opt version used to build Teleport.
+#
+.PHONY:print-wasm-opt-version
+print-wasm-opt-version:
+	@echo $(WASM_OPT_VERSION)
+
+#
+# Print the wasm-bindgen version used to build Teleport.
 #
-.PHONY:print-wasm-pack-version
-print-wasm-pack-version:
-	@echo $(WASM_PACK_VERSION)
+.PHONY:print-wasm-bindgen-version
+print-wasm-bindgen-version:
+	@echo $(WASM_BINDGEN_VERSION)
 
 #
 # Print the Node version used to build Teleport Connect.
diff --git a/build.assets/build-fido2-macos.sh b/build.assets/build-fido2-macos.sh
index fa861639fafb2..4b0288ea5500f 100755
--- a/build.assets/build-fido2-macos.sh
+++ b/build.assets/build-fido2-macos.sh
@@ -90,6 +90,7 @@ cbor_build() {
 
   cmake \
     -DCMAKE_OSX_ARCHITECTURES="$C_ARCH" \
+    -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
     -DCMAKE_BUILD_TYPE=Release \
     -DCMAKE_INSTALL_PREFIX="$dest" \
     -DCMAKE_OSX_DEPLOYMENT_TARGET="$MACOS_VERSION_MIN" \
diff --git a/build.assets/build-package.sh b/build.assets/build-package.sh
index 186d5d5684a70..e2cc788ec7043 100755
--- a/build.assets/build-package.sh
+++ b/build.assets/build-package.sh
@@ -305,9 +305,6 @@ if [[ "${PACKAGE_TYPE}" != "pkg" ]]; then
     mv -v ${TAR_PATH}/examples/systemd/post-install ${PACKAGE_TEMPDIR}
     mv -v ${TAR_PATH}/examples/systemd/before-remove ${PACKAGE_TEMPDIR}
 
-    # create versions folder
-    mkdir -p ${PACKAGE_TEMPDIR}/buildroot${LINUX_DATA_DIR}/versions
-
     # /var/lib/teleport
     # shellcheck disable=SC2174
     mkdir -p -m0700 ${PACKAGE_TEMPDIR}/buildroot${LINUX_DATA_DIR}
diff --git a/build.assets/buildbox/Dockerfile b/build.assets/buildbox/Dockerfile
index b818138d8657e..41b22f9a4b5b1 100644
--- a/build.assets/buildbox/Dockerfile
+++ b/build.assets/buildbox/Dockerfile
@@ -69,7 +69,7 @@ ARG BUILDARCH
 ARG GOLANG_VERSION
 # Set BUILDARCH if not set when not using buildkit. Only works for arm64 and amd64.
 RUN BUILDARCH=${BUILDARCH:-$(uname -m | sed 's/aarch64/arm64/g; s/x86_64/amd64/g')}; \
-	curl -fsSL https://storage.googleapis.com/golang/${GOLANG_VERSION}.linux-${BUILDARCH}.tar.gz | \
+	curl -fsSL https://go.dev/dl/${GOLANG_VERSION}.linux-${BUILDARCH}.tar.gz | \
 	tar -C /opt -xz && \
 	/opt/go/bin/go version
 
diff --git a/build.assets/charts/Dockerfile-distroless b/build.assets/charts/Dockerfile-distroless
index afc9ef481d768..3df8ee5f4f56d 100644
--- a/build.assets/charts/Dockerfile-distroless
+++ b/build.assets/charts/Dockerfile-distroless
@@ -33,6 +33,7 @@ FROM $BASE_IMAGE
 COPY --from=teleport /opt/staging /
 COPY --from=staging /opt/staging/root /
 COPY --from=staging /opt/staging/status /var/lib/dpkg/status.d
+ENV TELEPORT_TOOLS_VERSION=off
 # Attempt a graceful shutdown by default
 # See https://goteleport.com/docs/reference/signals/ for signal reference.
 STOPSIGNAL SIGQUIT
diff --git a/build.assets/charts/Dockerfile-tbot-distroless b/build.assets/charts/Dockerfile-tbot-distroless
index 1b368d8aee725..5199acf6b2ffb 100644
--- a/build.assets/charts/Dockerfile-tbot-distroless
+++ b/build.assets/charts/Dockerfile-tbot-distroless
@@ -18,5 +18,6 @@ RUN --mount=type=bind,target=/ctx dpkg-deb -R /ctx/$TELEPORT_DEB_FILE_NAME /opt/
 
 FROM $BASE_IMAGE
 COPY --from=teleport /opt/staging/opt/teleport/system/bin/tbot /usr/local/bin/tbot
+COPY --from=teleport /opt/staging/opt/teleport/system/bin/fdpass-teleport /usr/local/bin/fdpass-teleport
 ENTRYPOINT ["/usr/local/bin/tbot"]
 CMD ["start"]
diff --git a/build.assets/grpcbox.mk b/build.assets/grpcbox.mk
index 6b49e1d580c16..c8d193ff37519 100644
--- a/build.assets/grpcbox.mk
+++ b/build.assets/grpcbox.mk
@@ -19,14 +19,17 @@ DOCKER ?= docker
 
 # GRPCBOX_RUN has the necessary invocation to run a command inside the grpcbox.
 # Use this variable to run it from other Makefiles.
-GRPCBOX_RUN := $(DOCKER) run -it --rm -v "$$(pwd)/../:/workdir" -w /workdir $(GRPCBOX)
+UID := $$(id -u)
+GID := $$(id -g)
+GRPCBOX_RUN := $(DOCKER) run -it --rm -u $(UID):$(GID) -v "$$(pwd)/../:/workdir" -w /workdir $(GRPCBOX)
 
 # grpcbox builds a codegen-focused buildbox.
 # It's leaner, meaner, faster and not supposed to compile code.
 .PHONY: grpcbox
 grpcbox:
-	$(DOCKER) buildx build \
+	$(DOCKER) build \
 		--build-arg BUF_VERSION=$(BUF_VERSION) \
+		--build-arg UID=$(UID) --build-arg GID=$(GID) \
 		-f Dockerfile-grpcbox \
 		-t "$(GRPCBOX)" \
 		../
diff --git a/build.assets/images.mk b/build.assets/images.mk
index b13c9c43e58cb..b62efa3b4b785 100644
--- a/build.assets/images.mk
+++ b/build.assets/images.mk
@@ -15,7 +15,7 @@ BUILDBOX_CENTOS7_ASSETS = $(BUILDBOX_BASE_NAME)-centos7-assets:$(BUILDBOX_VERSIO
 BUILDBOX_CENTOS7_FIPS = $(BUILDBOX_BASE_NAME)-centos7-fips:$(BUILDBOX_VERSION)-$(RUNTIME_ARCH)
 BUILDBOX_ARM = $(BUILDBOX_BASE_NAME)-arm:$(BUILDBOX_VERSION)
 BUILDBOX_UI = $(BUILDBOX_BASE_NAME)-ui:$(BUILDBOX_VERSION)
-BUILDBOX_NODE = $(BUILDBOX_BASE_NAME)-node:$(BUILDBOX_VERSION)
+BUILDBOX_NODE = $(BUILDBOX_BASE_NAME)-node:$(BUILDBOX_VERSION)-$(RUNTIME_ARCH)
 
 BUILDBOX_NG = $(BUILDBOX_BASE_NAME)-ng:$(BUILDBOX_VERSION)
 BUILDBOX_THIRDPARTY = $(BUILDBOX_BASE_NAME)-thirdparty:$(BUILDBOX_VERSION)
diff --git a/build.assets/install b/build.assets/install
index eb52ec7d99959..493bdcedc633d 100755
--- a/build.assets/install
+++ b/build.assets/install
@@ -14,7 +14,7 @@ VARDIR=/var/lib/teleport
 echo "Starting Teleport installation..."
 cd $(dirname $0)
 mkdir -p $VARDIR $BINDIR
-cp -f teleport tctl tsh tbot teleport-update $BINDIR/ || exit 1
+cp -f teleport tctl tsh tbot fdpass-teleport teleport-update $BINDIR/ || exit 1
 
 #
 # What operating system is the user running?
diff --git a/build.assets/kubectl-version/main.go b/build.assets/kubectl-version/main.go
deleted file mode 100644
index ff65540420efe..0000000000000
--- a/build.assets/kubectl-version/main.go
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-// Command version-check that outputs the version of kubectl used by the build.
-// It doesn't live in the build.assets/tooling/ directory because it needs to
-// be built with the go.mod file from the teleport root directory.
-package main
-
-import (
-	"fmt"
-	"os"
-	"runtime/debug"
-	"strings"
-
-	// Import the kubectl module to get the version
-	// This is a hack to get the version of kubectl
-	// without having to parse the go.mod file.
-	_ "k8s.io/kubectl"
-)
-
-func main() {
-	version, ok := getKubectlModVersion()
-	if !ok {
-		fmt.Println("kubectl version not found")
-		os.Exit(1)
-	}
-	fmt.Println(version)
-}
-
-// getKubectlModVersion returns the version of the kubectl module
-// and replaces the v0 prefix with v1.
-// This is a hack to get the version of kubectl
-// without having to parse the go.mod file.
-func getKubectlModVersion() (string, bool) {
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return "", false
-	}
-	for _, dep := range info.Deps {
-		if dep.Path == "k8s.io/kubectl" {
-			return strings.Replace(dep.Version, "v0.", "v1.", 1), true
-		}
-	}
-	return "", false
-}
diff --git a/build.assets/macos/tsh/tsh.app/Contents/Info.plist b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
index 3b35b688471cb..a8a877b571813 100644
--- a/build.assets/macos/tsh/tsh.app/Contents/Info.plist
+++ b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>1.0</string>
+		<string>18.6.1</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>1.0</string>
+		<string>18.6.1</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>
diff --git a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
index 0383531e7294a..5bdd4440a0a81 100644
--- a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
+++ b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>1.0</string>
+		<string>18.6.1</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>1.0</string>
+		<string>18.6.1</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/README.md b/build.assets/tooling/cmd/buf-plugin-linters/README.md
new file mode 100644
index 0000000000000..0998b4885f569
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/README.md
@@ -0,0 +1,30 @@
+# `buf-plugin-linters`
+
+`buf-plugin-linters` is a `buf`[1] plugin for linting `.proto` files for APIs that should
+confirm to Teleport resource guidelines for pagination[2].
+
+## Usage
+
+To enable the plugin in `buf.yaml`:
+
+```yaml
+version: v2
+
+lint:
+  use:
+    - PAGINATION_REQUIRED
+plugins:
+  - plugin:
+      - env
+      - GOWORK=off
+      - go
+      - -C
+      - ./build.assets/tooling
+      - run
+      - ./cmd/buf-plugin-linters
+```
+
+See `default.go` for the default configuration. 
+
+[1]: http://buf.build/
+[2]: https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#list
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/config.go b/build.assets/tooling/cmd/buf-plugin-linters/config.go
new file mode 100644
index 0000000000000..7ceda86526e2d
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/config.go
@@ -0,0 +1,93 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"strings"
+
+	"google.golang.org/protobuf/reflect/protoreflect"
+)
+
+// methodPaginatedPrefix is a list of RPC method name prefixes which should be paginated.
+var methodPaginatedPrefix = []string{"List", "Search", "Get"}
+
+// methodPrefixMustHaveRepeated is a prefix for methods that must have a repeated field without exception.
+var methodPrefixMustHaveRepeated = "List"
+
+const (
+	// Naming based on rfd/0153-resource-guidelines.md
+	paginationRequestSizeName       = "page_size"
+	paginationRequestTokenName      = "page_token"
+	paginationResponseNextTokenName = "next_page_token"
+)
+
+type fieldNames struct {
+	size  string // Name of the max page size field in the request.
+	token string // Name of the current page token field in the request.
+	next  string // Name of the next page token field in the response.
+}
+
+type Config struct {
+	// overwrites maps the full name of proto method to a struct of field names.
+	overwrites map[protoreflect.FullName]fieldNames
+
+	// skips contains entires of RPCs which should be skipped.
+	skips map[protoreflect.FullName]struct{}
+}
+
+func (c *Config) getPageSizeFieldName(method protoreflect.MethodDescriptor) string {
+	if overwrite, ok := c.overwrites[method.FullName()]; ok && overwrite.size != "" {
+		return overwrite.size
+	}
+	return paginationRequestSizeName
+}
+
+func (c *Config) getPageFieldName(method protoreflect.MethodDescriptor) string {
+	if overwrite, ok := c.overwrites[method.FullName()]; ok && overwrite.token != "" {
+		return overwrite.token
+	}
+	return paginationRequestTokenName
+}
+
+func (c *Config) getNextPageFieldName(method protoreflect.MethodDescriptor) string {
+	if overwrite, ok := c.overwrites[method.FullName()]; ok && overwrite.next != "" {
+		return overwrite.next
+	}
+	return paginationResponseNextTokenName
+}
+
+func (c *Config) shouldSkip(method protoreflect.MethodDescriptor) bool {
+	if _, skipped := c.skips[method.FullName()]; skipped {
+		return true
+	}
+
+	if !hasAnyPrefix(string(method.Name()), methodPaginatedPrefix) {
+		return true
+	}
+
+	return false
+}
+
+// hasAnyPrefix return true if given name starts with any of the given prefixes
+func hasAnyPrefix(name string, prefixes []string) bool {
+	for _, prefix := range prefixes {
+		if strings.HasPrefix(name, prefix) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/default.go b/build.assets/tooling/cmd/buf-plugin-linters/default.go
new file mode 100644
index 0000000000000..d4c9ee1305770
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/default.go
@@ -0,0 +1,204 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import "google.golang.org/protobuf/reflect/protoreflect"
+
+func newDefaultConfig() *Config {
+	return &Config{
+		// Existing RPCs that do not follow RFD-153 naming:
+		overwrites: map[protoreflect.FullName]fieldNames{
+			"teleport.accesslist.v1.AccessListService.ListAccessLists": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.accesslist.v1.AccessListService.ListAccessListReviews": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.accesslist.v1.AccessListService.ListAllAccessListReviews": {
+				token: "next_token",
+				next:  "next_token",
+			},
+
+			"teleport.auditlog.v1.AuditLogService.GetUnstructuredEvents": {
+				size:  "limit",
+				token: "start_key",
+				next:  "last_key",
+			},
+			"teleport.autoupdate.v1.AutoUpdateService.ListAutoUpdateAgentReports": {
+				token: "next_token",
+				next:  "next_key",
+			},
+			"teleport.discoveryconfig.v1.DiscoveryConfigService.ListDiscoveryConfigs": {
+				token: "next_token",
+				next:  "next_key",
+			},
+
+			"teleport.integration.v1.AWSOIDCService.ListDatabases": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSOIDCService.ListSecurityGroups": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSOIDCService.ListSubnets": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSOIDCService.ListVPCs": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSOIDCService.ListDeployedDatabaseServices": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSOIDCService.ListEKSClusters": {
+				token: "next_token",
+				next:  "next_token",
+			},
+			"teleport.integration.v1.AWSRolesAnywhereService.ListRolesAnywhereProfiles": {
+				size:  "page_size",
+				token: "next_page_token",
+			},
+			"teleport.integration.v1.IntegrationService.ListIntegrations": {
+				size:  "limit",
+				token: "next_key",
+				next:  "next_key",
+			},
+			"teleport.kube.v1.KubeService.ListKubernetesResources": {
+				size:  "limit",
+				token: "start_key",
+				next:  "next_key",
+			},
+			"teleport.plugins.v1.PluginService.ListPlugins": {
+				token: "start_key",
+				next:  "next_key",
+			},
+			"teleport.scim.v1.SCIMService.ListSCIMResources": {
+				// This rpc uses a different scheme for pagination (index based).
+				token: "page",
+				size:  "page",
+				next:  "start_index",
+			},
+			"teleport.scopes.joining.v1.ScopedJoiningService.ListScopedTokens": {
+				token: "cursor",
+				size:  "limit",
+				next:  "cursor",
+			},
+			"teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources": {
+				size:  "limit",
+				token: "next_key",
+				next:  "next_key",
+			},
+			"teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers": {
+				next: "next_key",
+			},
+			"teleport.lib.teleterm.v1.TerminalService.ListUnifiedResources": {
+				size:  "limit",
+				token: "start_key",
+				next:  "next_key",
+			},
+
+			// Testing only:
+			"test.foo.bar.v1.config.FooService.SearchFoos": {
+				size:  "max",
+				token: "token",
+				next:  "next",
+			},
+		},
+		skips: map[protoreflect.FullName]struct{}{
+			// TODO(okraport): review the following and remove the skip:
+			"proto.AuthService.GetAccessCapabilities":                                   {},
+			"proto.AuthService.GetAccountRecoveryCodes":                                 {},
+			"proto.AuthService.GetAlertAcks":                                            {},
+			"proto.AuthService.GetApps":                                                 {},
+			"proto.AuthService.GetClusterAlerts":                                        {},
+			"proto.AuthService.GetEvents":                                               {},
+			"proto.AuthService.GetGithubConnectors":                                     {},
+			"proto.AuthService.GetInstallers":                                           {},
+			"proto.AuthService.GetKubernetesClusters":                                   {},
+			"proto.AuthService.GetLocks":                                                {},
+			"proto.AuthService.GetMFADevices":                                           {},
+			"proto.AuthService.GetOIDCConnectors":                                       {},
+			"proto.AuthService.GetPluginData":                                           {},
+			"proto.AuthService.GetSAMLConnectors":                                       {},
+			"proto.AuthService.GetSemaphores":                                           {},
+			"proto.AuthService.GetSessionEvents":                                        {},
+			"proto.AuthService.GetSnowflakeSessions":                                    {},
+			"proto.AuthService.GetSSHTargets":                                           {},
+			"proto.AuthService.GetSSODiagnosticInfo":                                    {},
+			"proto.AuthService.GetTokens":                                               {},
+			"proto.AuthService.GetTrustedClusters":                                      {},
+			"proto.AuthService.GetWebTokens":                                            {},
+			"proto.AuthService.GetWindowsDesktops":                                      {},
+			"proto.AuthService.GetWindowsDesktopServices":                               {},
+			"proto.AuthService.ListAccessRequests":                                      {},
+			"proto.AuthService.ListApps":                                                {},
+			"proto.AuthService.ListProvisionTokens":                                     {},
+			"proto.AuthService.ListReleases":                                            {},
+			"proto.AuthService.ListResources":                                           {},
+			"proto.AuthService.ListRoles":                                               {},
+			"proto.AuthService.ListSAMLIdPServiceProviders":                             {},
+			"proto.AuthService.ListUnifiedResources":                                    {},
+			"proto.AuthService.ListUserGroups":                                          {},
+			"proto.AuthService.ListWindowsDesktops":                                     {},
+			"teleport.accesslist.v1.AccessListService.GetAccessListOwners":              {},
+			"teleport.accesslist.v1.AccessListService.GetAccessLists":                   {},
+			"teleport.accesslist.v1.AccessListService.GetAccessListsToReview":           {},
+			"teleport.accesslist.v1.AccessListService.GetSuggestedAccessLists":          {},
+			"teleport.integration.v1.AWSOIDCService.ListDatabases":                      {},
+			"teleport.integration.v1.AWSOIDCService.ListDeployedDatabaseServices":       {},
+			"teleport.integration.v1.AWSOIDCService.ListEKSClusters":                    {},
+			"teleport.integration.v1.AWSOIDCService.ListSecurityGroups":                 {},
+			"teleport.integration.v1.AWSOIDCService.ListSubnets":                        {},
+			"teleport.integration.v1.AWSOIDCService.ListVPCs":                           {},
+			"teleport.kube.v1.KubeService.ListKubernetesResources":                      {},
+			"teleport.lib.teleterm.v1.TerminalService.GetSuggestedAccessLists":          {},
+			"teleport.okta.v1.OktaService.GetApps":                                      {},
+			"teleport.okta.v1.OktaService.GetGroups":                                    {},
+			"teleport.plugins.v1.PluginService.GetAvailablePluginTypes":                 {},
+			"teleport.plugins.v1.PluginService.SearchPluginStaticCredentials":           {},
+			"teleport.secreports.v1.SecReportsService.GetSchema":                        {},
+			"teleport.trust.v1.TrustService.GetCertAuthorities":                         {},
+			"teleport.userloginstate.v1.UserLoginStateService.GetUserLoginStates":       {},
+			"teleport.lib.teleterm.auto_update.v1.AutoUpdateService.GetClusterVersions": {},
+			"teleport.lib.teleterm.v1.TerminalService.GetAccessRequests":                {},
+			"teleport.lib.teleterm.v1.TerminalService.GetRequestableRoles":              {},
+			"teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources":          {},
+			"teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers":              {},
+			"teleport.lib.teleterm.v1.TerminalService.ListGateways":                     {},
+			"teleport.lib.teleterm.v1.TerminalService.ListRootClusters":                 {},
+			"teleport.lib.teleterm.v1.TerminalService.ListLeafClusters":                 {},
+			"teleport.lib.teleterm.v1.TerminalService.ListDatabaseUsers":                {},
+			"proto.AuthService.GetInventoryStatus":                                      {},
+
+			// RPCs deprecated from v19 onwards:
+			"proto.AuthService.GetDatabases": {},
+			// repeated field `schemas` in `Resource` does not require pagination.
+			"teleport.scim.v1.SCIMService.GetSCIMResource": {},
+			// `Device` message contains repeated field `DeviceCollectedData` but is not paginated.
+			"teleport.devicetrust.v1.DeviceTrustService.GetDevice": {},
+			// AuthSettings contains repeated `auth_providers` but does not need pagination.
+			"teleport.lib.teleterm.v1.TerminalService.GetAuthSettings": {},
+			// GetServiceInfoResponse does not require pagination.
+			"teleport.lib.teleterm.vnet.v1.VnetService.GetServiceInfo": {},
+		},
+	}
+}
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/main.go b/build.assets/tooling/cmd/buf-plugin-linters/main.go
new file mode 100644
index 0000000000000..951594c273aba
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/main.go
@@ -0,0 +1,170 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"context"
+	"strings"
+
+	"buf.build/go/bufplugin/check"
+	"buf.build/go/bufplugin/check/checkutil"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/descriptorpb"
+)
+
+const (
+	paginationRuleID = "PAGINATION_REQUIRED"
+)
+
+var paginationSpec = &check.Spec{
+	Rules: []*check.RuleSpec{
+		{
+			ID:      paginationRuleID,
+			Purpose: "Ensure RPCs returning a repeated field use pagination fields.",
+			Type:    check.RuleTypeLint,
+			Handler: checkutil.NewMethodRuleHandler(checkPaginationMethod),
+		},
+	},
+}
+
+func main() {
+	check.Main(paginationSpec)
+}
+
+// checkPaginationMethod implements MethodRuleHandler for RuleSpec
+func checkPaginationMethod(
+	_ context.Context,
+	responseWriter check.ResponseWriter,
+	request check.Request,
+	method protoreflect.MethodDescriptor,
+) error {
+
+	if method.IsStreamingServer() || method.IsStreamingClient() {
+		// Streaming APIs do not expect pagination.
+		return nil
+	}
+
+	if isMethodDeprecated(method) {
+		// deprecated methods are skipped
+		return nil
+	}
+
+	config := newDefaultConfig()
+	if config.shouldSkip(method) {
+		return nil
+	}
+
+	resp := method.Output()
+	if !hasRepeated(resp.Fields()) {
+		// Check if the method *should* have the repeated field.
+		if strings.HasPrefix(string(method.Name()), methodPrefixMustHaveRepeated) {
+			responseWriter.AddAnnotation(
+				check.WithDescriptor(method),
+				check.WithMessagef(
+					"repeated fields expected for RPC names starting with: %q (RFD-0153)",
+					methodPrefixMustHaveRepeated,
+				),
+			)
+		}
+		return nil
+	}
+
+	sizeName := config.getPageSizeFieldName(method)
+	tokenName := config.getPageFieldName(method)
+	nextName := config.getNextPageFieldName(method)
+
+	req := method.Input()
+
+	if !hasFieldName(req.Fields(), sizeName) {
+		responseWriter.AddAnnotation(
+			check.WithDescriptor(req),
+			check.WithMessagef(
+				"%q taken by %q is missing page size field name: %q (RFD-0153)",
+				req.Name(),
+				method.FullName(),
+				sizeName,
+			),
+		)
+	}
+
+	if !hasFieldName(req.Fields(), tokenName) {
+		responseWriter.AddAnnotation(
+			check.WithDescriptor(req),
+			check.WithMessagef(
+				"%q taken by %q is missing page token field name: %q (RFD-0153)",
+				req.Name(),
+				method.FullName(),
+				tokenName,
+			),
+		)
+	}
+
+	if !hasFieldName(resp.Fields(), nextName) {
+		responseWriter.AddAnnotation(
+			check.WithDescriptor(resp),
+			check.WithMessagef(
+				"%q returned by %q is missing next page token field name: %q (RFD-0153)",
+				resp.Name(),
+				method.FullName(),
+				nextName,
+			),
+		)
+	}
+
+	return nil
+}
+
+// hasFieldName returns true if the proto fields match given name
+func hasFieldName(fields protoreflect.FieldDescriptors, name string) bool {
+	for i := 0; i < fields.Len(); i++ {
+		if string(fields.Get(i).Name()) == name {
+			return true
+		}
+	}
+
+	return false
+}
+
+// hasRepeated returns true any of the proto fields are marked as `repeated`
+func hasRepeated(fields protoreflect.FieldDescriptors) bool {
+	for i := 0; i < fields.Len(); i++ {
+		field := fields.Get(i)
+
+		if field.IsMap() {
+			// maps are technically repeated under the hood, but currently out of scope for the linter.
+			continue
+		}
+
+		if field.Cardinality() == protoreflect.Repeated {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isMethodDeprecated returns true if the RPC has been marked with deprecated.
+func isMethodDeprecated(method protoreflect.MethodDescriptor) bool {
+	options := method.Options()
+	if options == nil {
+		return false
+	}
+	if opts, ok := options.(*descriptorpb.MethodOptions); ok {
+		return opts.GetDeprecated()
+	}
+	return false
+}
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/main_test.go b/build.assets/tooling/cmd/buf-plugin-linters/main_test.go
new file mode 100644
index 0000000000000..9b4bb453f1c79
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/main_test.go
@@ -0,0 +1,204 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"testing"
+
+	"buf.build/go/bufplugin/check/checktest"
+)
+
+func TestSpec(t *testing.T) {
+	t.Parallel()
+	checktest.SpecTest(t, paginationSpec)
+}
+
+func TestSimple(t *testing.T) {
+	t.Parallel()
+
+	checktest.CheckTest{
+		Request: &checktest.RequestSpec{
+			Files: &checktest.ProtoFileSpec{
+				DirPaths:  []string{"testdata"},
+				FilePaths: []string{"correct.proto"},
+			},
+			RuleIDs: []string{paginationRuleID},
+		},
+		Spec:                paginationSpec,
+		ExpectedAnnotations: []checktest.ExpectedAnnotation{},
+	}.Run(t)
+}
+
+func TestDefaultConfig(t *testing.T) {
+	t.Parallel()
+
+	checktest.CheckTest{
+		Request: &checktest.RequestSpec{
+			Files: &checktest.ProtoFileSpec{
+				DirPaths:  []string{"testdata"},
+				FilePaths: []string{"bad.proto"},
+			},
+			RuleIDs: []string{paginationRuleID},
+		},
+		Spec: paginationSpec,
+		ExpectedAnnotations: []checktest.ExpectedAnnotation{
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   30,
+					StartColumn: 2,
+					EndLine:     30,
+					EndColumn:   86,
+				},
+				Message: "repeated fields expected for RPC names starting with: \"List\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   33,
+					StartColumn: 0,
+					EndLine:     35,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingPageReqFoosRequest\" taken by \"bad.FooService.ListMissingPageReqFoos\" is missing page token field name: \"page_token\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   42,
+					StartColumn: 0,
+					EndLine:     44,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingPageSizeFoosRequest\" taken by \"bad.FooService.ListMissingPageSizeFoos\" is missing page token field name: \"page_token\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   57,
+					StartColumn: 0,
+					EndLine:     59,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingNextpageFoosResponse\" returned by \"bad.FooService.ListMissingNextpageFoos\" is missing next page token field name: \"next_page_token\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   62,
+					StartColumn: 0,
+					EndLine:     63,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingAllFoosRequest\" taken by \"bad.FooService.ListMissingAllFoos\" is missing page size field name: \"page_size\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   62,
+					StartColumn: 0,
+					EndLine:     63,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingAllFoosRequest\" taken by \"bad.FooService.ListMissingAllFoos\" is missing page token field name: \"page_token\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "bad.proto",
+					StartLine:   65,
+					StartColumn: 0,
+					EndLine:     67,
+					EndColumn:   1,
+				},
+				Message: "\"ListMissingAllFoosResponse\" returned by \"bad.FooService.ListMissingAllFoos\" is missing next page token field name: \"next_page_token\" (RFD-0153)",
+			},
+		},
+	}.Run(t)
+}
+
+func TestConfig(t *testing.T) {
+	t.Parallel()
+
+	checktest.CheckTest{
+		Request: &checktest.RequestSpec{
+			Files: &checktest.ProtoFileSpec{
+				DirPaths:  []string{"testdata"},
+				FilePaths: []string{"config.proto"},
+			},
+			RuleIDs: []string{paginationRuleID},
+		},
+		Spec:                paginationSpec,
+		ExpectedAnnotations: []checktest.ExpectedAnnotation{},
+	}.Run(t)
+}
+
+func TestRepeatFields(t *testing.T) {
+	t.Parallel()
+
+	checktest.CheckTest{
+		Request: &checktest.RequestSpec{
+			Files: &checktest.ProtoFileSpec{
+				DirPaths:  []string{"testdata"},
+				FilePaths: []string{"repeat.proto"},
+			},
+			RuleIDs: []string{paginationRuleID},
+		},
+		Spec: paginationSpec,
+		ExpectedAnnotations: []checktest.ExpectedAnnotation{
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "repeat.proto",
+					StartLine:   30,
+					StartColumn: 0,
+					EndLine:     31,
+					EndColumn:   1,
+				},
+				Message: "\"GetFoosRequest\" taken by \"repeat.FooService.GetFoos\" is missing page size field name: \"page_size\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "repeat.proto",
+					StartLine:   30,
+					StartColumn: 0,
+					EndLine:     31,
+					EndColumn:   1,
+				},
+				Message: "\"GetFoosRequest\" taken by \"repeat.FooService.GetFoos\" is missing page token field name: \"page_token\" (RFD-0153)",
+			},
+			{
+				RuleID: paginationRuleID,
+				FileLocation: &checktest.ExpectedFileLocation{
+					FileName:    "repeat.proto",
+					StartLine:   33,
+					StartColumn: 0,
+					EndLine:     35,
+					EndColumn:   1,
+				},
+				Message: "\"GetFoosResponse\" returned by \"repeat.FooService.GetFoos\" is missing next page token field name: \"next_page_token\" (RFD-0153)",
+			},
+		},
+	}.Run(t)
+}
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/testdata/bad.proto b/build.assets/tooling/cmd/buf-plugin-linters/testdata/bad.proto
new file mode 100644
index 0000000000000..81d560d2d46c2
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/testdata/bad.proto
@@ -0,0 +1,80 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+syntax = "proto3";
+
+package bad;
+
+message Foo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+}
+
+service FooService {
+  rpc ListMissingPageReqFoos(ListMissingPageReqFoosRequest) returns (ListMissingPageReqFoosResponse);
+  rpc ListMissingPageSizeFoos(ListMissingPageSizeFoosRequest) returns (ListMissingPageSizeFoosResponse);
+  rpc ListMissingNextpageFoos(ListMissingNextpageFoosRequest) returns (ListMissingNextpageFoosResponse);
+  rpc ListMissingAllFoos(ListMissingAllFoosRequest) returns (ListMissingAllFoosResponse);
+  rpc ListWithoutRepeat(ListWithoutRepeatRequest) returns (ListWithoutRepeatResponse);
+}
+
+message ListMissingPageReqFoosRequest {
+  int32 page_size = 1;
+}
+
+message ListMissingPageReqFoosResponse {
+  repeated Foo foos = 1;
+  string next_page_token = 2;
+}
+
+message ListMissingPageSizeFoosRequest {
+  int32 page_size = 1;
+}
+
+message ListMissingPageSizeFoosResponse {
+  repeated Foo foos = 1;
+  string next_page_token = 2;
+}
+
+
+message ListMissingNextpageFoosRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+message ListMissingNextpageFoosResponse {
+  repeated Foo foos = 1;
+}
+
+
+message ListMissingAllFoosRequest {
+}
+
+message ListMissingAllFoosResponse {
+  repeated Foo foos = 1;
+}
+
+message ListWithoutRepeatRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+message ListWithoutRepeatResponse {
+  Foo foos = 1;
+  string next_page_token = 2;
+}
+
+
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/testdata/buf.yaml b/build.assets/tooling/cmd/buf-plugin-linters/testdata/buf.yaml
new file mode 100644
index 0000000000000..4d943895d1471
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/testdata/buf.yaml
@@ -0,0 +1,6 @@
+version: v2
+
+lint:
+  ignore:
+    # Ignore all test data
+    - .
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/testdata/config.proto b/build.assets/tooling/cmd/buf-plugin-linters/testdata/config.proto
new file mode 100644
index 0000000000000..9a86e2b16e57d
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/testdata/config.proto
@@ -0,0 +1,40 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+syntax = "proto3";
+
+package test.foo.bar.v1.config;
+
+message Foo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+
+}
+
+service FooService {
+  rpc SearchFoos(SearchFoosRequest) returns (SearchFoosResponse);
+}
+
+message SearchFoosRequest {
+  int32 max = 1;
+  string token = 2;
+}
+
+message SearchFoosResponse {
+  repeated Foo foos = 1;
+  string next = 2;
+}
+
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/testdata/correct.proto b/build.assets/tooling/cmd/buf-plugin-linters/testdata/correct.proto
new file mode 100644
index 0000000000000..5588a5e915fae
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/testdata/correct.proto
@@ -0,0 +1,79 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+syntax = "proto3";
+
+package teleport.foo.v1;
+
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/empty.proto";
+
+message Foo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  FooSpec spec = 5;
+  FooStatus status = 6;
+}
+
+message FooSpec {
+  string bar = 1;
+  int32 baz = 2;
+  bool qux = 3;
+}
+
+message FooStatus {
+  google.protobuf.Timestamp next_audit = 1;
+  string teleport_host = 2;
+}
+
+service FooService {
+  rpc GetFoo(GetFooRequest) returns (Foo);
+  rpc ListFoos(ListFoosRequest) returns (ListFoosResponse);
+  rpc CreateFoo(CreateFooRequest) returns (Foo);
+  rpc UpdateFoo(UpdateFooRequest) returns (Foo);
+  rpc UpsertFoo(UpsertFooRequest) returns (Foo);
+  rpc DeleteFoo(DeleteFooRequest) returns (google.protobuf.Empty);
+}
+
+message GetFooRequest {
+  string foo_id = 1;
+}
+
+message ListFoosRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+message ListFoosResponse {
+  repeated Foo foos = 1;
+  string next_page_token = 2;
+}
+
+message CreateFooRequest {
+  Foo foo = 1;
+}
+
+message UpdateFooRequest {
+  Foo foo = 1;
+}
+
+message UpsertFooRequest {
+  Foo foo = 2;
+}
+
+message DeleteFooRequest {
+  string foo_id = 1;
+}
\ No newline at end of file
diff --git a/build.assets/tooling/cmd/buf-plugin-linters/testdata/repeat.proto b/build.assets/tooling/cmd/buf-plugin-linters/testdata/repeat.proto
new file mode 100644
index 0000000000000..801b3ae3a45f8
--- /dev/null
+++ b/build.assets/tooling/cmd/buf-plugin-linters/testdata/repeat.proto
@@ -0,0 +1,37 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+syntax = "proto3";
+
+package repeat;
+
+message Foo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+
+}
+
+service FooService {
+  rpc GetFoos(GetFoosRequest) returns (GetFoosResponse);
+}
+
+message GetFoosRequest {
+}
+
+message GetFoosResponse {
+  repeated Foo foos = 1;
+}
+
diff --git a/build.assets/tooling/cmd/gen-athena-docs/main.go b/build.assets/tooling/cmd/gen-athena-docs/main.go
new file mode 100644
index 0000000000000..ce2f58c8d1d92
--- /dev/null
+++ b/build.assets/tooling/cmd/gen-athena-docs/main.go
@@ -0,0 +1,86 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	_ "embed"
+	"fmt"
+	"os"
+	"regexp"
+	"slices"
+	"strings"
+	"text/template"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/gravitational/teleport/gen/go/eventschema"
+)
+
+// colNameList prints an example of columns from a given Access Monitoring event
+// view to include an example command. It only prints up to the first three
+// columns.
+func colNameList(cols []*eventschema.ColumnSchemaDetails) string {
+	var sb strings.Builder
+	for i := range min(3, len(cols)) {
+		if i != 0 {
+			sb.WriteString(",")
+		}
+		sb.WriteString(cols[i].NameSQL())
+	}
+	return sb.String()
+}
+
+var descPredicate = regexp.MustCompile(`^(is|are) `)
+
+// prepareDescription returns a description of the column data provided in col.
+func prepareDescription(col *eventschema.ColumnSchemaDetails) string {
+	// Remove the initial verb, since there is no subject in the sentence.
+	desc := descPredicate.ReplaceAllString(col.Description, "")
+
+	// Capitalize the first word in the description.
+	if r, size := utf8.DecodeRuneInString(desc); r != utf8.RuneError {
+		desc = string(unicode.ToUpper(r)) + desc[size:]
+	}
+
+	return desc
+}
+
+// docTempl is the template that represents an Access Monitoring event reference
+// docs page. The assumption is that "@" characters are replaced with backticks
+// before rendering the template.
+//
+//go:embed schema-reference.mdx.tmpl
+var docTempl string
+
+func main() {
+	data, err := eventschema.GetViewsDetails()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Cannot generate an Access Monitoring schema reference: %v\n", err)
+		os.Exit(1)
+	}
+
+	slices.SortFunc(data, func(a, b *eventschema.TableSchemaDetails) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	template.Must(template.New("event-reference").Funcs(
+		template.FuncMap{
+			"ColNameList":        colNameList,
+			"PrepareDescription": prepareDescription,
+		},
+	).Parse(docTempl)).Execute(os.Stdout, data)
+}
diff --git a/build.assets/tooling/cmd/gen-athena-docs/schema-reference.mdx.tmpl b/build.assets/tooling/cmd/gen-athena-docs/schema-reference.mdx.tmpl
new file mode 100644
index 0000000000000..26c1f988e943c
--- /dev/null
+++ b/build.assets/tooling/cmd/gen-athena-docs/schema-reference.mdx.tmpl
@@ -0,0 +1,28 @@
+{/*generated file. DO NOT EDIT.*/}
+{/*To generate, run make access-monitoring-reference*/}
+{/*vale messaging.capitalization = NO*/}
+{/*vale messaging.consistent-terms = NO*/}
+
+{{ range . -}}
+## {{ .Name }}
+
+`{{ .Name }}` {{ .Description }}.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select {{ ColNameList .Columns }} from {{ .SQLViewName }} limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+{{- range .Columns }}
+|{{ .NameSQL }}|{{ .Type }}|{{ PrepareDescription . }}|
+{{- end }}
+
+{{ end }}
+{/*vale messaging.capitalization = YES*/}
+{/*vale messaging.consistent-terms = YES*/}
diff --git a/build.assets/tooling/cmd/goderive/main.go b/build.assets/tooling/cmd/goderive/main.go
index 1260866add8bc..bba584bf50076 100644
--- a/build.assets/tooling/cmd/goderive/main.go
+++ b/build.assets/tooling/cmd/goderive/main.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/awalterschulze/goderive/derive"
 
+	"github.com/gravitational/teleport/build.assets/tooling/cmd/goderive/plugin/deepcopy"
 	"github.com/gravitational/teleport/build.assets/tooling/cmd/goderive/plugin/teleportequal"
 )
 
@@ -32,6 +33,7 @@ func main() {
 	// Establish Teleport derive plugins of interest.
 	plugins := []derive.Plugin{
 		teleportequal.NewPlugin(),
+		deepcopy.NewPlugin(),
 	}
 
 	// Parse args, which are just paths at the moment..
diff --git a/build.assets/tooling/cmd/goderive/plugin/deepcopy/0001-add-time-deepcopy-support.patch b/build.assets/tooling/cmd/goderive/plugin/deepcopy/0001-add-time-deepcopy-support.patch
new file mode 100644
index 0000000000000..9d8229a04411c
--- /dev/null
+++ b/build.assets/tooling/cmd/goderive/plugin/deepcopy/0001-add-time-deepcopy-support.patch
@@ -0,0 +1,99 @@
+--- a/deepcopy/deepcopy.go
++++ b/deepcopy/deepcopy.go
+@@ -17,8 +17,8 @@
+ // The deriveDeepCopy function is a maintainable and fast way to implement fast copy functions.
+ //
+ // When goderive walks over your code it is looking for a function that:
+-//  - was not implemented (or was previously derived) and
+-//  - has a predefined prefix.
++//   - was not implemented (or was previously derived) and
++//   - has a predefined prefix.
+ //
+ // In the following code the deriveDeepCopy function will be found, because
+ // it was not implemented and it has a prefix deriveDeepCopy.
+@@ -29,7 +29,7 @@
+ //	import "sort"
+ //
+ //	type MyStruct struct {
+-// 		Int64     int64
++//		Int64     int64
+ //		StringPtr *string
+ //	}
+ //
+@@ -43,25 +43,27 @@
+ //	}
+ //
+ // The initial type that is passed into deriveDeepCopy needs to have a reference type:
+-//	- pointer
+-//	- slice
+-//	- map
++//   - pointer
++//   - slice
++//   - map
++//
+ // , otherwise we are not able to modify the input parameter and then what are you really copying,
+ // but as we go deeper we support most types.
+ //
+ // Supported types:
+-//	- basic types
+-//	- named structs
+-//	- slices
+-//	- maps
+-//	- pointers to these types
+-//	- private fields of structs in external packages (using reflect and unsafe)
+-//	- and many more
++//   - basic types
++//   - named structs
++//   - slices
++//   - maps
++//   - pointers to these types
++//   - private fields of structs in external packages (using reflect and unsafe)
++//   - and many more
++//
+ // Unsupported types:
+-//	- chan
+-//	- interface
+-//	- function
+-//	- unnamed structs, which are not comparable with the == operator
++//   - chan
++//   - interface
++//   - function
++//   - unnamed structs, which are not comparable with the == operator
+ //
+ // Example output can be found here:
+ // https://github.com/awalterschulze/goderive/tree/master/example/plugin/deepcopy
+@@ -140,6 +142,12 @@ func (g *gen) genStatement(typ types.Type, this, that string) error {
+ 		p.P("%s = %s", that, this)
+ 		return nil
+ 	}
++
++	if typ.String() == "*time.Time" {
++		p.P("*%s = *%s", that, this)
++		return nil
++	}
++
+ 	switch ttyp := typ.Underlying().(type) {
+ 	case *types.Pointer:
+ 		reftyp := ttyp.Elem()
+@@ -243,13 +251,6 @@ func nullable(typ types.Type) bool {
+ 	return false
+ }
+ 
+-func not(s string) string {
+-	if strings.HasPrefix(s, "(") && strings.HasSuffix(s, ")") {
+-		return "!" + s
+-	}
+-	return "!(" + s + ")"
+-}
+-
+ func wrap(value string) string {
+ 	if strings.HasPrefix(value, "*") ||
+ 		strings.HasPrefix(value, "&") ||
+@@ -261,7 +262,7 @@ func wrap(value string) string {
+ 
+ func prepend(before, after string) string {
+ 	bs := strings.Split(before, ".")
+-	b := strings.Replace(bs[0], "*", "", -1)
++	b := strings.ReplaceAll(bs[0], "*", "")
+ 	return b + "_" + after
+ }
diff --git a/build.assets/tooling/cmd/goderive/plugin/deepcopy/README.md b/build.assets/tooling/cmd/goderive/plugin/deepcopy/README.md
new file mode 100644
index 0000000000000..2240233502150
--- /dev/null
+++ b/build.assets/tooling/cmd/goderive/plugin/deepcopy/README.md
@@ -0,0 +1,16 @@
+# Deepcopy Patch Workflow
+
+This repository vendors `deepcopy.go` from [goderive](https://github.com/awalterschulze/goderive) and applies a custom patch to support `*time.Time` deep copy.
+
+## Workflow
+
+1. **Fetch upstream `deepcopy.go`**
+```bash
+$ GODERIVE_VERSION=$(go list -m -f '{{.Version}}' github.com/awalterschulze/goderive)
+$ curl -fsSL "https://raw.githubusercontent.com/awalterschulze/goderive/refs/tags/${GODERIVE_VERSION}/plugin/deepcopy/deepcopy.go" -o deepcopy.go
+```
+
+2. **Apply custom patch**
+```bash
+$ patch deepcopy.go < 0001-add-time-deepcopy-support.patch
+```
diff --git a/build.assets/tooling/cmd/goderive/plugin/deepcopy/deepcopy.go b/build.assets/tooling/cmd/goderive/plugin/deepcopy/deepcopy.go
new file mode 100644
index 0000000000000..979d8aab0548a
--- /dev/null
+++ b/build.assets/tooling/cmd/goderive/plugin/deepcopy/deepcopy.go
@@ -0,0 +1,418 @@
+//  Copyright 2017 Walter Schulze
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+
+// Package deepcopy contains the implementation of the deepcopy plugin, which generates the deriveDeepCopy function.
+//
+// The deriveDeepCopy function is a maintainable and fast way to implement fast copy functions.
+//
+// When goderive walks over your code it is looking for a function that:
+//   - was not implemented (or was previously derived) and
+//   - has a predefined prefix.
+//
+// In the following code the deriveDeepCopy function will be found, because
+// it was not implemented and it has a prefix deriveDeepCopy.
+// This prefix is configurable.
+//
+//	package main
+//
+//	import "sort"
+//
+//	type MyStruct struct {
+//		Int64     int64
+//		StringPtr *string
+//	}
+//
+//	func (m *MyStruct) Clone() *MyStruct {
+//		if m == nil {
+//			return nil
+//		}
+//		n := &MyStruct{}
+//		deriveDeepCopy(n, m)
+//		return n
+//	}
+//
+// The initial type that is passed into deriveDeepCopy needs to have a reference type:
+//   - pointer
+//   - slice
+//   - map
+//
+// , otherwise we are not able to modify the input parameter and then what are you really copying,
+// but as we go deeper we support most types.
+//
+// Supported types:
+//   - basic types
+//   - named structs
+//   - slices
+//   - maps
+//   - pointers to these types
+//   - private fields of structs in external packages (using reflect and unsafe)
+//   - and many more
+//
+// Unsupported types:
+//   - chan
+//   - interface
+//   - function
+//   - unnamed structs, which are not comparable with the == operator
+//
+// Example output can be found here:
+// https://github.com/awalterschulze/goderive/tree/master/example/plugin/deepcopy
+//
+// This plugin has been tested thoroughly.
+package deepcopy
+
+import (
+	"fmt"
+	"go/types"
+	"strings"
+
+	"github.com/awalterschulze/goderive/derive"
+)
+
+// NewPlugin creates a new deepcopy plugin.
+// This function returns the plugin name, default prefix and a constructor for the deepcopy code generator.
+func NewPlugin() derive.Plugin {
+	return derive.NewPlugin("deepcopy", "deriveDeepCopy", New)
+}
+
+// New is a constructor for the deepcopy code generator.
+// This generator should be reconstructed for each package.
+func New(typesMap derive.TypesMap, p derive.Printer, deps map[string]derive.Dependency) derive.Generator {
+	return &gen{
+		TypesMap:   typesMap,
+		printer:    p,
+		bytesPkg:   p.NewImport("bytes", "bytes"),
+		reflectPkg: p.NewImport("reflect", "reflect"),
+		unsafePkg:  p.NewImport("unsafe", "unsafe"),
+	}
+}
+
+type gen struct {
+	derive.TypesMap
+	printer    derive.Printer
+	bytesPkg   derive.Import
+	reflectPkg derive.Import
+	unsafePkg  derive.Import
+}
+
+func (g *gen) Add(name string, typs []types.Type) (string, error) {
+	if len(typs) != 2 {
+		return "", fmt.Errorf("%s does not have two arguments", name)
+	}
+	if !types.Identical(typs[0], typs[1]) {
+		return "", fmt.Errorf("%s has two arguments, but they are of different types %s != %s",
+			name, g.TypeString(typs[0]), g.TypeString(typs[1]))
+	}
+	return g.SetFuncName(name, typs[0])
+}
+
+func (g *gen) Generate(typs []types.Type) error {
+	return g.genFunc(typs[0])
+}
+
+func (g *gen) genFunc(typ types.Type) error {
+	p := g.printer
+	g.Generating(typ)
+	typeStr := g.TypeString(typ)
+	p.P("")
+	p.P("// %s recursively copies the contents of src into dst.", g.GetFuncName(typ))
+	p.P("func %s(dst, src %s) {", g.GetFuncName(typ), typeStr)
+	p.In()
+	if err := g.genStatement(typ, "src", "dst"); err != nil {
+		return err
+	}
+	p.Out()
+	p.P("}")
+	return nil
+}
+
+func (g *gen) genStatement(typ types.Type, this, that string) error {
+	p := g.printer
+	if canCopy(typ) {
+		p.P("%s = %s", that, this)
+		return nil
+	}
+
+	if typ.String() == "*time.Time" {
+		p.P("*%s = *%s", that, this)
+		return nil
+	}
+
+	switch ttyp := typ.Underlying().(type) {
+	case *types.Pointer:
+		reftyp := ttyp.Elem()
+		g.TypeString(reftyp)
+		thisref, thatref := "*"+this, "*"+that
+		named, isNamed := reftyp.(*types.Named)
+		strct, isStruct := reftyp.Underlying().(*types.Struct)
+		if !isStruct {
+			if err := g.genField(reftyp, thisref, thatref); err != nil {
+				return err
+			}
+			return nil
+		} else if isNamed {
+			external := g.TypesMap.IsExternal(named)
+			fields := derive.Fields(g.TypesMap, strct, external)
+			if len(fields.Fields) > 0 {
+				thisv := prepend(this, "v")
+				thatv := prepend(that, "v")
+				if fields.Reflect {
+					p.P(thisv+` := `+g.reflectPkg()+`.Indirect(`+g.reflectPkg()+`.ValueOf(%s))`, this)
+					p.P(thatv+` := `+g.reflectPkg()+`.Indirect(`+g.reflectPkg()+`.ValueOf(%s))`, that)
+				}
+				for _, field := range fields.Fields {
+					fieldType := field.Type
+					var thisField, thatField string
+					if field.Private() && external {
+						thisField, thatField = field.Name(thisv, g.unsafePkg), field.Name(thatv, g.unsafePkg)
+					} else {
+						thisField, thatField = field.Name(this, nil), field.Name(that, nil)
+					}
+					if err := g.genField(fieldType, thisField, thatField); err != nil {
+						return err
+					}
+				}
+			}
+			return nil
+		}
+	case *types.Slice:
+		elmType := ttyp.Elem()
+		if canCopy(elmType) {
+			p.P("copy(%s, %s)", that, this)
+			return nil
+		}
+		thisvalue := prepend(this, "value")
+		thisi := prepend(this, "i")
+		p.P("for %s, %s := range %s {", thisi, thisvalue, this)
+		p.In()
+		if err := g.genField(elmType, thisvalue, wrap(that)+"["+thisi+"]"); err != nil {
+			return err
+		}
+		p.Out()
+		p.P("}")
+		return nil
+	case *types.Array:
+		elmType := ttyp.Elem()
+		thisvalue := prepend(this, "value")
+		thisi := prepend(this, "i")
+		p.P("for %s, %s := range %s {", thisi, thisvalue, this)
+		p.In()
+		if err := g.genField(elmType, thisvalue, wrap(that)+"["+thisi+"]"); err != nil {
+			return err
+		}
+		p.Out()
+		p.P("}")
+		return nil
+	case *types.Map:
+		elmType := ttyp.Elem()
+		keyType := ttyp.Key()
+		thiskey, thisvalue := prepend(this, "key"), prepend(this, "value")
+		p.P("for %s, %s := range %s {", thiskey, thisvalue, this)
+		p.In()
+		thatkey := thiskey
+		if !canCopy(keyType) {
+			if err := g.genField(keyType, thatkey, thiskey); err != nil {
+				return err
+			}
+			thatkey = prepend(that, "key")
+		}
+		if nullable(elmType) {
+			p.P("if %s == nil {", thisvalue)
+			p.In()
+			p.P("%s = nil", wrap(that)+"["+thatkey+"]")
+			p.Out()
+			p.P("}")
+		}
+		if err := g.genField(elmType, thisvalue, wrap(that)+"["+thatkey+"]"); err != nil {
+			return err
+		}
+		p.Out()
+		p.P("}")
+		return nil
+	}
+	return fmt.Errorf("unsupported deepcopy type: %s", g.TypeString(typ))
+}
+
+func nullable(typ types.Type) bool {
+	switch typ.(type) {
+	case *types.Pointer, *types.Slice, *types.Map:
+		return true
+	}
+	return false
+}
+
+func wrap(value string) string {
+	if strings.HasPrefix(value, "*") ||
+		strings.HasPrefix(value, "&") ||
+		strings.HasSuffix(value, "]") {
+		return "(" + value + ")"
+	}
+	return value
+}
+
+func prepend(before, after string) string {
+	bs := strings.Split(before, ".")
+	b := strings.ReplaceAll(bs[0], "*", "")
+	return b + "_" + after
+}
+
+func canCopy(tt types.Type) bool {
+	t := tt.Underlying()
+	switch typ := t.(type) {
+	case *types.Basic:
+		return typ.Kind() != types.UntypedNil
+	case *types.Struct:
+		for i := 0; i < typ.NumFields(); i++ {
+			f := typ.Field(i)
+			ft := f.Type()
+			if !canCopy(ft) {
+				return false
+			}
+		}
+		return true
+	case *types.Array:
+		return canCopy(typ.Elem())
+	}
+	return false
+}
+
+func hasDeepCopyMethod(typ *types.Named) bool {
+	for i := 0; i < typ.NumMethods(); i++ {
+		meth := typ.Method(i)
+		if meth.Name() != "DeepCopy" {
+			continue
+		}
+		sig, ok := meth.Type().(*types.Signature)
+		if !ok {
+			// impossible, but lets check anyway
+			continue
+		}
+		if sig.Params().Len() != 1 {
+			continue
+		}
+		res := sig.Results()
+		if res.Len() != 0 {
+			continue
+		}
+		return true
+	}
+	return false
+}
+
+func (g *gen) genField(fieldType types.Type, thisField, thatField string) error {
+	p := g.printer
+	if canCopy(fieldType) {
+		p.P("%s = %s", thatField, thisField)
+		return nil
+	}
+	switch typ := fieldType.Underlying().(type) {
+	case *types.Pointer:
+		p.P("if %s == nil {", thisField)
+		p.In()
+		p.P("%s = nil", thatField)
+		p.Out()
+		p.P("} else {")
+		p.In()
+		ref := typ.Elem()
+		p.P("%s = new(%s)", thatField, g.TypeString(typ.Elem()))
+		if named, ok := ref.(*types.Named); ok && hasDeepCopyMethod(named) {
+			p.P("%s.DeepCopy(%s)", wrap(thisField), thatField)
+		} else if canCopy(typ.Elem()) {
+			p.P("*%s = *%s", thatField, thisField)
+		} else {
+			p.P("%s(%s, %s)", g.GetFuncName(typ), thatField, thisField)
+		}
+		p.Out()
+		p.P("}")
+		return nil
+	case *types.Array:
+		g.genStatement(fieldType, thisField, thatField)
+		return nil
+	case *types.Slice:
+		p.P("if %s == nil {", thisField) // nil
+		p.In()
+		p.P("%s = nil", thatField)
+		p.Out()
+		p.P("} else {") // nil
+		p.In()
+		p.P("if %s != nil {", thatField) // not nil
+		p.In()
+		p.P("if len(%s) > len(%s) {", thisField, thatField) // len
+		p.In()
+		p.P("if cap(%s) >= len(%s) {", thatField, thisField) // cap
+		p.In()
+		p.P("%s = (%s)[:len(%s)]", thatField, thatField, thisField)
+		p.Out()
+		p.P("} else {") // cap
+		p.In()
+		p.P("%s = make(%s, len(%s))", thatField, g.TypeString(typ), thisField)
+		p.Out()
+		p.P("}")
+		p.Out()
+		p.P("} else if len(%s) < len(%s) {", thisField, thatField) // len
+		p.In()
+		p.P("%s = (%s)[:len(%s)]", thatField, thatField, thisField)
+		p.Out()
+		p.P("}") // len
+		p.Out()
+		p.P("} else {") // not nil
+		p.In()
+		p.P("%s = make(%s, len(%s))", thatField, g.TypeString(typ), thisField)
+		p.Out()
+		p.P("}") // not nil
+		named, isNamed := fieldType.(*types.Named)
+		if isNamed && hasDeepCopyMethod(named) {
+			p.P("%s.DeepCopy(%s)", wrap(thisField), thatField)
+		} else if canCopy(typ.Elem()) {
+			p.P("copy(%s, %s)", thatField, thisField)
+		} else {
+			p.P("%s(%s, %s)", g.GetFuncName(typ), thatField, thisField)
+		}
+		p.Out()
+		p.P("}") // nil
+		return nil
+	case *types.Map:
+		p.P("if %s != nil {", thisField)
+		p.In()
+		p.P("%s = make(%s, len(%s))", thatField, g.TypeString(typ), thisField)
+		named, isNamed := fieldType.(*types.Named)
+		if isNamed && hasDeepCopyMethod(named) {
+			p.P("%s.DeepCopy(%s)", wrap(thisField), thatField)
+		} else {
+			p.P("%s(%s, %s)", g.GetFuncName(typ), thatField, thisField)
+		}
+		p.Out()
+		p.P("} else {")
+		p.In()
+		p.P("%s = nil", thatField)
+		p.Out()
+		p.P("}")
+		return nil
+	case *types.Struct:
+		p.P("func() {")
+		p.In()
+		p.P("field := new(%s)", g.TypeString(fieldType))
+		named, isNamed := fieldType.(*types.Named)
+		if isNamed && hasDeepCopyMethod(named) {
+			p.P("%s.DeepCopy(field)", wrap(thisField))
+		} else {
+			p.P("%s(field, &%s)", g.GetFuncName(types.NewPointer(fieldType)), wrap(thisField))
+		}
+		p.P("%s = *field", thatField)
+		p.Out()
+		p.P("}()")
+		return nil
+	default: // *Chan, *Tuple, *Signature, *Interface, *types.Basic.Kind() == types.UntypedNil, *Struct
+		return fmt.Errorf("unsupported field type %s", g.TypeString(fieldType))
+	}
+}
diff --git a/build.assets/tooling/cmd/govulncheck-report/main.go b/build.assets/tooling/cmd/govulncheck-report/main.go
new file mode 100644
index 0000000000000..a03d6fe459ef3
--- /dev/null
+++ b/build.assets/tooling/cmd/govulncheck-report/main.go
@@ -0,0 +1,186 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// govulncheck-report wraps govulncheck, allows silences vulnerabilities and
+// prints a brief report at the end.
+//
+// govulncheck must be on PATH.
+//
+// Usage: govulncheck-report -ignore=GO-2022-0635 -ignore=GO-2022-0646 -- [govulncheck flags here]
+package main
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+const programName = "govulncheck-report"
+
+// Eg: "Vulnerability #1: GO-2025-4192"
+var vulnRE = regexp.MustCompile(`^\s*Vulnerability #\d+: (GO-\d+-\d+)$`)
+
+type govulnReport struct {
+	govulnArgs   []string
+	ignoredVulns []string
+}
+
+func newGovulnReport(thisArgs, govulnArgs []string) (*govulnReport, error) {
+	cmd := &govulnReport{
+		govulnArgs: govulnArgs,
+	}
+
+	fs := flag.NewFlagSet(programName, flag.ExitOnError)
+	fs.Var(stringsFlag{dst: &cmd.ignoredVulns}, "ignore", "Vulnerability IDs to ignore")
+
+	if err := fs.Parse(thisArgs); err != nil {
+		// Unreachable, we have flag.ExitOnError set.
+		panic(err)
+	}
+	if fs.NArg() > 0 {
+		return nil, fmt.Errorf("arguments not supported, found trailing arguments: %v", fs.Args())
+	}
+
+	return cmd, nil
+}
+
+func (c *govulnReport) Run(ctx context.Context) (exitCode int, _ error) {
+	// Make sure we can run properly.
+	for _, arg := range c.govulnArgs {
+		switch arg {
+		case "-json", "--json", "-format", "--format":
+			return 0, fmt.Errorf("%s doesn't support -json or non-text -format", programName)
+		default:
+			// OK, continue.
+		}
+	}
+
+	pr, pw := io.Pipe()
+	stdout := os.Stdout
+	stderr := os.Stderr
+
+	cmd := exec.CommandContext(ctx, "govulncheck", c.govulnArgs...)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = pw
+	cmd.Stderr = stderr
+
+	// Don't read until the goroutine below exits.
+	var vulns []string
+
+	// Parse and echo stdout.
+	doneC := make(chan struct{})
+	go func() {
+		defer close(doneC)
+		scan := bufio.NewScanner(pr)
+		for scan.Scan() {
+			line := scan.Text()
+			stdout.WriteString(line)
+			stdout.WriteString("\n")
+
+			if matches := vulnRE.FindStringSubmatch(line); len(matches) == 2 {
+				vulns = append(vulns, matches[1])
+			}
+		}
+		// No need to check scan.Err(). Once the pipe is drained we're done.
+		_ = scan.Err()
+	}()
+
+	err := cmd.Run()
+	pw.Close()
+	pr.Close()
+	<-doneC
+
+	var ee *exec.ExitError
+	if errors.As(err, &ee) {
+		exitCode = ee.ExitCode()
+	} else {
+		return 0, err // Unexpected error from cmd.Run()
+	}
+	// Do not print report if we found no vulnerabilities.
+	if len(vulns) == 0 {
+		return exitCode, nil
+	}
+
+	// Print report/redact exit code.
+	slices.Sort(vulns)
+	fmt.Fprintf(stderr, "\n%s:\n", programName)
+	allIgnored := true
+	for _, vuln := range vulns {
+		var suffix string
+		if ignored := slices.Contains(c.ignoredVulns, vuln); ignored {
+			suffix = " (ignored)"
+		} else {
+			allIgnored = false
+		}
+		fmt.Fprintf(stderr, "  * %s%s\n", vuln, suffix)
+	}
+	if allIgnored {
+		return 0, nil
+	}
+
+	return exitCode, nil
+}
+
+type stringsFlag struct {
+	dst *[]string
+}
+
+func (f stringsFlag) Set(val string) error {
+	*f.dst = append(*f.dst, val)
+	return nil
+}
+
+func (f stringsFlag) String() string {
+	if f.dst == nil {
+		return ""
+	}
+	return strings.Join(*f.dst, ",")
+}
+
+func main() {
+	thisArgs, govulnArgs := splitArgs(os.Args[1:]) // Remove program name.
+
+	cmd, err := newGovulnReport(thisArgs, govulnArgs)
+	if err != nil {
+		panic(err)
+	}
+
+	ctx := context.Background()
+	exitCode, err := cmd.Run(ctx)
+	if err != nil {
+		panic(err)
+	}
+	os.Exit(exitCode)
+}
+
+func splitArgs(args []string) (thisArgs, govulnArgs []string) {
+	for i, arg := range args {
+		if arg == "--" {
+			govulnArgs = args[i+1:]
+			break
+		}
+		thisArgs = append(thisArgs, arg)
+	}
+	return thisArgs, govulnArgs
+}
diff --git a/build.assets/tooling/cmd/resource-ref-generator/README.md b/build.assets/tooling/cmd/resource-ref-generator/README.md
new file mode 100644
index 0000000000000..c44341af3e481
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/README.md
@@ -0,0 +1,84 @@
+# Resource reference generator
+
+The resource reference generator is a Go program that produces a comprehensive
+reference guide for all dynamic Teleport resources and the fields they include.
+It uses the Teleport source as the basis for the guide. 
+
+## Usage
+
+From the root of your `gravitational/teleport` clone:
+
+```
+$ make gen-resource-docs
+```
+
+## How it works
+
+The resource reference generator works by:
+
+1. Identifying Go types that represent to the fields of each dynamic resource
+   struct identified in a configuration file.
+1. Retrieving reference information about dynamic resources and their fields
+   using a combination of Go comments and type information.
+
+### Editing source files
+
+The resource reference indicates which Go source files the reference generator
+used for each entry. The generator is only aware of Go source files, not
+protobuf message definitions.
+
+If a source file is based on a protobuf message definition, edit the message
+definition first, then run:
+
+```
+$ make grpc
+```
+
+After that, you can run the reference generator.
+
+## Configuration
+
+The generator uses a YAML configuration file with the following fields.
+
+### Main config
+
+- `source` (string): the path to the root of a Go project directory.
+
+- `destination` (string): the directory path in which to place reference pages.
+
+- `resources` (array of resource configuration objects): Teleport dynamic
+  resources to represent in the reference docs.
+
+### Resource configuration
+
+In the `resources` field of the configuration file, each resource configuration
+object has the following structure:
+
+- `type`: The name of the struct type declaration that represents the resource,
+  e.g., `RoleV6`.
+- `package`: The name of the Go package that includes the type declaration,
+  e.g., `types`.
+- `yaml_kind`: The value of `kind` to include in the resource manifest, e.g.,
+  "role".
+- `yaml_version`: The value of `version` to include in the resource manifest,
+  e.g., "v6".
+
+### Example
+
+```yaml
+source: "../../../../api"
+destination: "../../../../docs/pages/reference/tctl-resources"
+resources:
+  - type: RoleV6
+    package: types
+    yaml_kind: "role"
+    yaml_version: "v6"
+  - type: OIDCConnectorV3
+    package: types
+    yaml_kind: "oidc"
+    yaml_version: "v3"
+  - type: SAMLConnectorV2
+    package: types
+    yaml_kind: "saml"
+    yaml_version: "v2"
+```
diff --git a/build.assets/tooling/cmd/resource-ref-generator/config.yaml b/build.assets/tooling/cmd/resource-ref-generator/config.yaml
new file mode 100644
index 0000000000000..86795daffef87
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/config.yaml
@@ -0,0 +1,22 @@
+source: "../../../../api"
+destination: "../../../../docs/pages/reference/infrastructure-as-code/teleport-resources"
+
+# Please alphabetize the resource list by type name.
+resources:
+  - type: DiscoveryConfig
+    package: discoveryconfig
+    yaml_kind: discovery_config
+    yaml_version: v1
+  - type: InstallerV1
+    package: types
+    yaml_kind: installer
+    yaml_version: v1
+  - type: OIDCConnectorV3
+    package: types
+    yaml_kind: oidc
+    yaml_version: v3
+  - type: SAMLConnectorV2
+    package: types
+    yaml_kind: saml
+    yaml_version: v2
+
diff --git a/build.assets/tooling/cmd/resource-ref-generator/main.go b/build.assets/tooling/cmd/resource-ref-generator/main.go
new file mode 100644
index 0000000000000..82b201819ed0c
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/main.go
@@ -0,0 +1,64 @@
+// Teleport
+// Copyright (C) 2025  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"text/template"
+
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/build.assets/tooling/cmd/resource-ref-generator/reference"
+)
+
+const tmplBase = "reference.tmpl"
+
+var tmplPath = filepath.Join("reference", tmplBase)
+
+const configHelp string = `The path to a YAML configuration file (see the README)`
+
+func main() {
+	conf := flag.String("config", "conf.yaml", configHelp)
+	flag.Parse()
+
+	conffile, err := os.Open(*conf)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Could not open the configuration file %v: %v\n", *conf, err)
+		os.Exit(1)
+	}
+	defer conffile.Close()
+
+	var genconf reference.GeneratorConfig
+	if err := yaml.NewDecoder(conffile).Decode(&genconf); err != nil {
+		fmt.Fprintf(os.Stderr, "Invalid configuration file: %v\n", err)
+		os.Exit(1)
+	}
+	tmpl, err := template.New(tmplBase).ParseFiles(tmplPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Cannot open resource reference template at %v: %v\n", tmplPath, err)
+		os.Exit(1)
+	}
+
+	err = reference.Generate(genconf, tmpl)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Could not generate the resource reference: %v\n", err)
+		os.Exit(1)
+	}
+}
diff --git a/build.assets/tooling/cmd/resource-ref-generator/reference/reference.go b/build.assets/tooling/cmd/resource-ref-generator/reference/reference.go
new file mode 100644
index 0000000000000..dbe4c757f6802
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/reference/reference.go
@@ -0,0 +1,153 @@
+// Teleport
+// Copyright (C) 2025  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package reference
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/gravitational/teleport/build.assets/tooling/cmd/resource-ref-generator/resource"
+)
+
+// pageContent represents a reference page for a single resource and its related
+// fields. Fields must be exported so we can use them in templates.
+type pageContent struct {
+	Resource resourceSection
+	Fields   map[resource.PackageInfo]resource.ReferenceEntry
+}
+
+// resourceSection represents a top-level section of the resource reference
+// dedicated to a dynamic resource.
+type resourceSection struct {
+	Version string
+	Kind    string
+	resource.ReferenceEntry
+}
+
+// TypeInfo represents the name and package name of an exported Go type. It
+// makes no guarantees about whether the type was actually declared within the
+// package.
+type TypeInfo struct {
+	// Go package path (not a file path)
+	Package string `yaml:"package"`
+	// Name of the type, e.g., Metadata
+	Name string `yaml:"name"`
+}
+
+// ResourceConfig describes a resource type to include in the reference.
+type ResourceConfig struct {
+	// The name of the struct type as declared in the Go source, e.g.,
+	// RoleV6.
+	TypeName string `yaml:"type"`
+	// The final path segment in the name of the Go package containing this
+	// type declaration, e.g., "api".
+	PackageName string `yaml:"package"`
+	// The value of the "kind" field within a YAML manifest for this
+	// resource, e.g., "role".
+	KindValue string `yaml:"yaml_kind"`
+	// The value of the "version" field within a YAML manifest for this
+	// resource, e.g., "v6".
+	VersionValue string `yaml:"yaml_version"`
+}
+
+// GeneratorConfig is the user-facing configuration for the resource reference
+// generator.
+type GeneratorConfig struct {
+	Resources []ResourceConfig `yaml:"resources"`
+	// Path to the root of the Go project directory.
+	SourcePath string `yaml:"source"`
+	// Directory where the generator writes reference pages.
+	DestinationDirectory string `yaml:"destination"`
+}
+
+type GenerationError struct {
+	messages []error
+}
+
+func (g GenerationError) Error() string {
+	// Begin with a newline to format the first list item below the outer
+	// error.
+	final := "\n"
+	for _, e := range g.messages {
+		final += fmt.Sprintf("- %v\n", e)
+	}
+	return final
+}
+
+// Generate uses the provided user-facing configuration to write the resource
+// reference to fs.
+func Generate(conf GeneratorConfig, tmpl *template.Template) error {
+	sourceData, err := resource.NewSourceData(conf.SourcePath)
+	if err != nil {
+		return fmt.Errorf("loading Go source files: %w", err)
+	}
+
+	var errs GenerationError
+	for _, r := range conf.Resources {
+		k := resource.PackageInfo{
+			DeclName:    r.TypeName,
+			PackageName: r.PackageName,
+		}
+
+		decl, ok := sourceData.TypeDecls[k]
+		if !ok {
+			errs.messages = append(errs.messages, fmt.Errorf("creating a reference entry for declaration %v.%v: cannot find a declaration of this resource type", k.PackageName, k.DeclName))
+			continue
+		}
+
+		pc := pageContent{}
+
+		// decl is a dynamic resource type, so get data for the type and
+		// its dependencies.
+		entries, err := resource.ReferenceDataFromDeclaration(decl, sourceData.TypeDecls)
+		if errors.As(err, &resource.NotAGenDeclError{}) {
+			continue
+		}
+		if err != nil {
+			errs.messages = append(errs.messages, fmt.Errorf("creating a reference entry for declaration %v.%v in file %v: %w", k.PackageName, k.DeclName, decl.FilePath, err))
+		}
+
+		pc.Resource.ReferenceEntry = entries[k]
+		delete(entries, k)
+		pc.Fields = entries
+
+		pc.Resource.Kind = r.KindValue
+		pc.Resource.Version = r.VersionValue
+
+		filename := strings.ReplaceAll(strings.ToLower(pc.Resource.SectionName), " ", "-")
+		docpath := filepath.Join(conf.DestinationDirectory, filename+".mdx")
+		doc, err := os.Create(docpath)
+		if err != nil {
+			errs.messages = append(errs.messages, fmt.Errorf("cannot create page at %v: %w", docpath, err))
+			continue
+		}
+		defer doc.Close()
+
+		if err := tmpl.Execute(doc, pc); err != nil {
+			errs.messages = append(errs.messages, fmt.Errorf("cannot populate the resource reference template: %w", err))
+		}
+	}
+	if len(errs.messages) > 0 {
+		return errs
+	}
+
+	return nil
+}
diff --git a/build.assets/tooling/cmd/resource-ref-generator/reference/reference.tmpl b/build.assets/tooling/cmd/resource-ref-generator/reference/reference.tmpl
new file mode 100644
index 0000000000000..36e3eff4fb73c
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/reference/reference.tmpl
@@ -0,0 +1,49 @@
+---
+title: {{ .Resource.SectionName }} Reference
+description: Provides a reference of fields within the {{ .Resource.SectionName }} resource, which you can manage with tctl.
+sidebar_label: {{ .Resource.SectionName }}
+---
+{/* vale 3rd-party-products.former-names = NO */}
+{/* vale messaging.capitalization = NO */}
+{/* Automatically generated from: {{ .Resource.SourcePath}} */}
+{/* DO NOT EDIT */}
+
+**Kind**: `{{ .Resource.Kind }}`<br/>
+**Version**: `{{ .Resource.Version }}`
+
+{{ .Resource.Description }}
+
+Example:
+
+```yaml
+{{ .Resource.YAMLExample -}}
+```
+
+{{- if gt (len .Resource.Fields) 0 }}
+|Field Name|Description|Type|
+|---|---|---|
+{{ range .Resource.Fields -}}
+|{{.Name}}|{{.Description}}|{{.Type}}|
+{{ end }} 
+{{- end }}
+
+{{- range .Fields }}
+## {{ .SectionName }}
+
+{{ .Description }}
+
+{{ if ne .YAMLExample "" }}
+Example:
+
+```yaml
+{{ .YAMLExample -}}
+```
+{{ end }}
+{{- if gt (len .Fields) 0 }}
+|Field Name|Description|Type|
+|---|---|---|
+{{ range .Fields -}}
+|{{.Name}}|{{.Description}}|{{.Type}}|
+{{ end }} 
+{{- end }}
+{{- end }}
diff --git a/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go b/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go
new file mode 100644
index 0000000000000..491575c455f84
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go
@@ -0,0 +1,913 @@
+// Teleport
+// Copyright (C) 2025  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package resource
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// PackageInfo is used to look up a Go declaration in a map of declaration names
+// to resource data.
+type PackageInfo struct {
+	DeclName    string
+	PackageName string
+}
+
+// ReferenceEntry represents a section in the resource reference docs.
+type ReferenceEntry struct {
+	SectionName string
+	Description string
+	SourcePath  string
+	Fields      []Field
+	YAMLExample string
+}
+
+// DeclarationInfo includes data about a declaration so the generator can
+// convert it into a ReferenceEntry.
+type DeclarationInfo struct {
+	FilePath    string
+	Decl        ast.Decl
+	PackageName string
+	// Maps the file-scoped name of each import (if given) to the
+	// corresponding full package path.
+	NamedImports map[string]string
+}
+
+// Field represents a row in a table that provides information about a field in
+// the resource reference.
+type Field struct {
+	Name        string
+	Description string
+	Type        string
+}
+
+// sortFieldsByName sorts a and b ascending by Name.
+func sortFieldsByName(a, b Field) int {
+	return strings.Compare(a.Name, b.Name)
+}
+
+type SourceData struct {
+	// TypeDecls maps package and declaration names to data that the generator
+	// uses to format documentation for dynamic resource fields.
+	TypeDecls map[PackageInfo]DeclarationInfo
+}
+
+func NewSourceData(rootPath string) (SourceData, error) {
+	// All declarations within the source tree. We use this to extract
+	// information about dynamic resource fields, which we can look up by
+	// package and declaration name.
+	typeDecls := make(map[PackageInfo]DeclarationInfo)
+
+	// Load each file in the source directory individually. Not using
+	// packages.Load here since the resulting []*Package does not expose
+	// individual file names, which we need so contributors who want to edit
+	// the resulting docs page know which files to modify.
+	err := filepath.Walk(rootPath, func(currentPath string, info fs.FileInfo, err error) error {
+		if err != nil {
+			return fmt.Errorf("loading Go source: %w", err)
+		}
+
+		if info.IsDir() {
+			return nil
+		}
+
+		if filepath.Ext(info.Name()) != ".go" {
+			return nil
+		}
+
+		// Open the file so we can pass it to ParseFile. Otherwise,
+		// ParseFile always reads from the OS FS, not from fs.
+		f, err := os.Open(currentPath)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		fset := token.NewFileSet()
+		file, err := parser.ParseFile(fset, currentPath, f, parser.ParseComments)
+		if err != nil {
+			return err
+		}
+
+		// Use a relative path from the source directory for cleaner
+		// paths
+		relDeclPath, err := filepath.Rel(rootPath, currentPath)
+		if err != nil {
+			return err
+		}
+
+		// Collect information from each file:
+		// - Imported packages and their aliases
+		// - Possible function declarations (for identifying relevant
+		//   methods later)
+		// - Type declarations
+		pn := NamedImports(file)
+		for _, decl := range file.Decls {
+			l, ok := decl.(*ast.GenDecl)
+			if !ok {
+				continue
+			}
+			if len(l.Specs) != 1 {
+				continue
+			}
+			spec, ok := l.Specs[0].(*ast.TypeSpec)
+			if !ok {
+				continue
+			}
+
+			typeDecls[PackageInfo{
+				DeclName:    spec.Name.Name,
+				PackageName: file.Name.Name,
+			}] = DeclarationInfo{
+				Decl:         l,
+				FilePath:     relDeclPath,
+				PackageName:  file.Name.Name,
+				NamedImports: pn,
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return SourceData{}, fmt.Errorf("loading Go source files: %w", err)
+	}
+	return SourceData{
+		TypeDecls: typeDecls,
+	}, nil
+}
+
+// rawField contains simplified information about a struct field type. This
+// prevents passing around AST nodes and makes testing easier.
+type rawField struct {
+	// Package that declares the field type
+	packageName string
+	// A declaration's GoDoc, including newline characters but not comment
+	// characters.
+	doc string
+	// The type of the field.
+	kind yamlKindNode
+	// Original name of the field.
+	name string
+	// Name as it appears in YAML, based on the "json" struct tag and
+	// marshaling rules in the encoding/json package.
+	jsonName string
+	// The entire struct tag expression for the field.
+	tags string
+}
+
+// rawType contains simplified information about a type, which may or may not be
+// a struct. This prevents passing around AST nodes and makes testing easier.
+type rawType struct {
+	// A declaration's GoDoc, including newline characters but not comment
+	// characters.
+	doc string
+	// The name of the type declaration.
+	name string
+	// Struct fields within the type. Empty if not a struct.
+	fields []rawField
+}
+
+// yamlKindNode represents a node in a potentially recursive YAML type, such as
+// an integer, a map of integers to strings, a sequence of maps of strings to
+// strings, etc. Used for printing example YAML documents and tables of fields.
+// This is not intended to be a comprehensive YAML AST.
+type yamlKindNode interface {
+	// Generate a string representation to include in a table of fields.
+	formatForTable() string
+	// Generate an example YAML value for the type with the provided number
+	// of indendations.
+	formatForExampleYAML(indents int) string
+	// Get the custom children of this yamlKindNode. Must call
+	// customFieldData on its own children before returning.
+	customFieldData() []PackageInfo
+}
+
+// nonYAMLKind represents a field type that we cannot convert to YAML. Consumers
+// should return an error if there is no way to avoid creating a reference entry
+// for this kind.
+type nonYAMLKind struct{}
+
+func (n nonYAMLKind) formatForTable() string {
+	return ""
+}
+
+func (n nonYAMLKind) formatForExampleYAML(indents int) string {
+	return "# See description"
+}
+
+func (n nonYAMLKind) customFieldData() []PackageInfo {
+	return []PackageInfo{}
+}
+
+// yamlSequence is a list of elements.
+type yamlSequence struct {
+	elementKind yamlKindNode
+}
+
+func (y yamlSequence) formatForTable() string {
+	return `[]` + y.elementKind.formatForTable()
+}
+
+func (y yamlSequence) formatForExampleYAML(indents int) string {
+	var leading string
+	indents++
+	for i := 0; i < indents; i++ {
+		leading += "  "
+	}
+	el := y.elementKind.formatForExampleYAML(indents)
+	// Trim leading indentation since each element is already indented.
+	el = strings.TrimLeft(el, " ")
+	// Always start a sequence on a new line
+	return fmt.Sprintf(`
+%v- %v
+%v- %v
+%v- %v`,
+		leading, el,
+		leading, el,
+		leading, el,
+	)
+}
+
+func (y yamlSequence) customFieldData() []PackageInfo {
+	return y.elementKind.customFieldData()
+}
+
+// yamlMapping is a mapping of keys to values.
+type yamlMapping struct {
+	keyKind   yamlKindNode
+	valueKind yamlKindNode
+}
+
+func (y yamlMapping) formatForExampleYAML(indents int) string {
+	var leading string
+	// Add an extra indent for mappings
+	indents = indents + 1
+	for i := 0; i < indents; i++ {
+		leading += "  "
+	}
+
+	val := y.valueKind.formatForExampleYAML(indents)
+	// Remove leading indentation on the first line of the value since the
+	// key/value pair is already indented. This does not affect subsequent
+	// lines of the value.
+	val = strings.TrimLeft(val, " ")
+
+	kv := fmt.Sprintf("%v%v: %v", leading, y.keyKind.formatForExampleYAML(0), val)
+	return fmt.Sprintf("\n%v\n%v\n%v", kv, kv, kv)
+}
+
+func (y yamlMapping) formatForTable() string {
+	return fmt.Sprintf("map[%v]%v", y.keyKind.formatForTable(), y.valueKind.formatForTable())
+}
+
+func (y yamlMapping) customFieldData() []PackageInfo {
+	k := y.keyKind.customFieldData()
+	v := y.valueKind.customFieldData()
+	return append(k, v...)
+}
+
+type yamlString struct{}
+
+func (y yamlString) formatForTable() string {
+	return "string"
+}
+
+func (y yamlString) formatForExampleYAML(indents int) string {
+	return `"string"`
+}
+
+func (y yamlString) customFieldData() []PackageInfo {
+	return []PackageInfo{}
+}
+
+type yamlBase64 struct{}
+
+func (y yamlBase64) formatForTable() string {
+	return "base64-encoded string"
+}
+
+func (y yamlBase64) formatForExampleYAML(indents int) string {
+	return "BASE64_STRING"
+}
+
+func (y yamlBase64) customFieldData() []PackageInfo {
+	return []PackageInfo{}
+}
+
+type yamlNumber struct{}
+
+func (y yamlNumber) formatForTable() string {
+	return "number"
+}
+
+func (y yamlNumber) formatForExampleYAML(indents int) string {
+	return "1"
+}
+
+func (y yamlNumber) customFieldData() []PackageInfo {
+	return []PackageInfo{}
+}
+
+type yamlBool struct{}
+
+func (y yamlBool) formatForTable() string {
+	return "Boolean"
+}
+
+func (y yamlBool) formatForExampleYAML(indents int) string {
+	return "true"
+}
+
+func (y yamlBool) customFieldData() []PackageInfo {
+	return []PackageInfo{}
+}
+
+// A type declared by the program, i.e., not one of Go's predeclared types.
+type yamlCustomType struct {
+	name string
+	// Used to look up more information about the declaration of the custom
+	// type so we can populate additional reference entries.
+	declarationInfo PackageInfo
+}
+
+func (y yamlCustomType) customFieldData() []PackageInfo {
+	return []PackageInfo{
+		y.declarationInfo,
+	}
+}
+
+func (y yamlCustomType) formatForExampleYAML(indents int) string {
+	var leading string
+	for i := 0; i < indents; i++ {
+		leading += "  "
+	}
+
+	return leading + "# [...]"
+}
+
+func (y yamlCustomType) formatForTable() string {
+	return fmt.Sprintf(
+		"[%v](#%v)",
+		y.name,
+		strings.ReplaceAll(strings.ToLower(y.name), " ", "-"),
+	)
+}
+
+type NotAGenDeclError struct{}
+
+func (e NotAGenDeclError) Error() string {
+	return "the declaration is not a GenDecl"
+}
+
+// typeForDecl returns a representation of the type spec of decl to use for
+// further processing. Returns an error if there is either no type spec or more
+// than one.
+func typeForDecl(decl DeclarationInfo, allDecls map[PackageInfo]DeclarationInfo) (rawType, error) {
+	gendecl, ok := decl.Decl.(*ast.GenDecl)
+	if !ok {
+		return rawType{}, NotAGenDeclError{}
+	}
+
+	if len(gendecl.Specs) == 0 {
+		return rawType{}, errors.New("declaration has no specs")
+	}
+
+	if len(gendecl.Specs) > 1 {
+		return rawType{}, errors.New("declaration contains more than one type spec")
+	}
+
+	if gendecl.Specs[0] == nil {
+		return rawType{}, errors.New("no spec found")
+	}
+
+	t, ok := gendecl.Specs[0].(*ast.TypeSpec)
+	if !ok {
+		return rawType{}, errors.New("no type spec found")
+	}
+
+	str, ok := t.Type.(*ast.StructType)
+	// The declaration is not a struct, but we may still want to include it
+	// in the reference. Return a rawType with no fields.
+	if !ok {
+		return rawType{
+			name:   t.Name.Name,
+			doc:    gendecl.Doc.Text(),
+			fields: []rawField{},
+		}, nil
+	}
+
+	// We have determined that decl is a struct type, so collect its fields.
+	var rawFields []rawField
+	for _, field := range str.Fields.List {
+		f, err := makeRawField(field, decl.PackageName, allDecls, decl.NamedImports)
+		if err != nil {
+			return rawType{}, err
+		}
+
+		// The struct field name is lowercased, so the field is not
+		// exported. Ignore it.
+		if f.name != "" && f.name[0] >= 'a' && f.name[0] <= 122 {
+			continue
+		}
+
+		jsonName := getJSONTag(f.tags)
+		// This field is ignored, so skip it.
+		// See: https://pkg.go.dev/encoding/json#Marshal
+		if jsonName == "-" {
+			continue
+		}
+		// Using the exported field declaration name as the field name
+		// per JSON marshaling rules.
+		if jsonName == "" {
+			f.jsonName = f.name
+		}
+
+		rawFields = append(rawFields, f)
+	}
+
+	result := rawType{
+		name: t.Name.Name,
+		// Preserving newlines for downstream processing
+		doc:    gendecl.Doc.Text(),
+		fields: rawFields,
+	}
+
+	return result, nil
+}
+
+// makeYAMLExample creates an example YAML document illustrating the fields
+// within a declaration. This appears at the end of a section within the
+// reference.
+func makeYAMLExample(fields []rawField) (string, error) {
+	var buf bytes.Buffer
+
+	for _, field := range fields {
+		example := field.kind.formatForExampleYAML(0) + "\n"
+		buf.WriteString(getJSONTag(field.tags) + ": ")
+		buf.WriteString(example)
+	}
+
+	return buf.String(), nil
+}
+
+// Key-value pair for the "json" tag within a struct tag.  See:
+// https://pkg.go.dev/reflect#StructTag
+var jsonTagKeyValue = regexp.MustCompile(`json:"([^"]+)"`)
+
+// getYAMLTag returns the "json" tag value from the provided struct tag
+// expression.
+func getJSONTag(tags string) string {
+	kv := jsonTagKeyValue.FindStringSubmatch(tags)
+
+	// No "json" tag, or a "json" tag with no value.
+	if len(kv) != 2 {
+		return ""
+	}
+
+	return strings.TrimSuffix(kv[1], ",omitempty")
+}
+
+var camelCaseExceptions = []string{
+	"IdP",
+}
+var abbreviationWordBoundary *regexp.Regexp = regexp.MustCompile(`([A-Z]{2,})([A-Z][a-z0-9])`)
+var camelCaseWordBoundary *regexp.Regexp = regexp.MustCompile(
+	fmt.Sprintf(`(%v|[a-z]+)([A-Z])`, strings.Join(camelCaseExceptions, "|")),
+)
+
+// makeSectionName edits the original name of a declaration to make it more
+// suitable as a section within the resource reference.
+func makeSectionName(original string) string {
+	s := abbreviationWordBoundary.ReplaceAllString(original, "$1 $2")
+	s = camelCaseWordBoundary.ReplaceAllString(s, "$1 $2")
+	return s
+}
+
+// isByteSlice returns whether t is a []byte.
+func isByteSlice(t *ast.ArrayType) bool {
+	i, ok := t.Elt.(*ast.Ident)
+	if !ok {
+		return false
+	}
+	return i.Name == "byte"
+}
+
+// getYAMLTypeForExpr takes an AST type expression and recursively
+// traverses it to populate a yamlKindNode. Each iteration converts a
+// single *ast.Expr into a single yamlKindNode, returning the new node.
+func getYAMLTypeForExpr(exp ast.Expr, pkg string, allDecls map[PackageInfo]DeclarationInfo, namedImports map[string]string) (yamlKindNode, error) {
+	switch t := exp.(type) {
+	case *ast.StarExpr:
+		// Ignore the star, since YAML fields are unmarshaled as the
+		// values they point to.
+		return getYAMLTypeForExpr(t.X, pkg, allDecls, namedImports)
+	case *ast.Ident:
+		switch t.Name {
+		case "string":
+			return yamlString{}, nil
+		case "uint", "uint8", "uint16", "uint32", "uint64", "int", "int8", "int16", "int32", "int64", "float32", "float64":
+			return yamlNumber{}, nil
+		case "bool":
+			return yamlBool{}, nil
+		default:
+			info := PackageInfo{
+				DeclName:    t.Name,
+				PackageName: pkg,
+			}
+			if _, ok := allDecls[info]; !ok {
+				return nonYAMLKind{}, nil
+			}
+
+			return yamlCustomType{
+				name:            makeSectionName(t.Name),
+				declarationInfo: info,
+			}, nil
+		}
+	case *ast.MapType:
+		k, err := getYAMLTypeForExpr(t.Key, pkg, allDecls, namedImports)
+		if err != nil {
+			return nil, err
+		}
+
+		v, err := getYAMLTypeForExpr(t.Value, pkg, allDecls, namedImports)
+		if err != nil {
+			return nil, err
+		}
+		return yamlMapping{
+			keyKind:   k,
+			valueKind: v,
+		}, nil
+	case *ast.ArrayType:
+		// Bite slices marshal to base64 strings
+		if isByteSlice(t) {
+			return yamlBase64{}, nil
+		}
+		e, err := getYAMLTypeForExpr(t.Elt, pkg, allDecls, namedImports)
+		if err != nil {
+			return nil, err
+		}
+		return yamlSequence{
+			elementKind: e,
+		}, nil
+	case *ast.SelectorExpr:
+		var pkg string
+		x, ok := t.X.(*ast.Ident)
+		if ok {
+			pkg = x.Name
+			if i, ok := namedImports[x.Name]; ok {
+				pkg = i
+			}
+		}
+		info := PackageInfo{
+			DeclName:    t.Sel.Name,
+			PackageName: pkg,
+		}
+		if _, ok := allDecls[info]; !ok {
+			return nonYAMLKind{}, nil
+		}
+
+		return yamlCustomType{
+			name:            makeSectionName(t.Sel.Name),
+			declarationInfo: info,
+		}, nil
+	default:
+		return nonYAMLKind{}, nil
+	}
+}
+
+// getYAMLType returns YAML type information for a struct field so we can print
+// information about it in the resource reference.
+func getYAMLType(field *ast.Field, pkg string, allDecls map[PackageInfo]DeclarationInfo, namedImports map[string]string) (yamlKindNode, error) {
+	return getYAMLTypeForExpr(field.Type, pkg, allDecls, namedImports)
+}
+
+// makeRawField translates an *ast.Field into a rawField for downstream
+// processing. packageName is the name of the package that includes this name in
+// a struct declaration.
+func makeRawField(field *ast.Field, packageName string, allDecls map[PackageInfo]DeclarationInfo, namedImports map[string]string) (rawField, error) {
+	doc := field.Doc.Text()
+	if len(field.Names) > 1 {
+		return rawField{}, fmt.Errorf("field %+v in %v contains more than one name", field, packageName)
+	}
+
+	var name string
+	// Otherwise, the field is likely an embedded struct.
+	if len(field.Names) == 1 {
+		name = field.Names[0].Name
+	}
+
+	tn, err := getYAMLType(field, packageName, allDecls, namedImports)
+	if err != nil {
+		return rawField{}, err
+	}
+
+	// Indicate which package declared this field depending on whether the
+	// field's type name includes the name of another package.
+	pkg := packageName
+	s, ok := field.Type.(*ast.SelectorExpr)
+	if ok {
+		i, ok := s.X.(*ast.Ident)
+		if ok {
+			pkg = i.Name
+		}
+	}
+
+	var tag string
+	if field.Tag != nil {
+		tag = field.Tag.Value
+	}
+
+	return rawField{
+		packageName: pkg,
+		doc:         doc,
+		kind:        tn,
+		name:        name,
+		jsonName:    getJSONTag(tag),
+		tags:        tag,
+	}, nil
+}
+
+// makeFieldTableInfo assembles a slice of human-readable information about
+// fields within a Go struct to include within the resource reference.
+func makeFieldTableInfo(fields []rawField) ([]Field, error) {
+	var result []Field
+	for _, field := range fields {
+		var desc string
+		var typ string
+
+		desc = field.doc
+		typ = field.kind.formatForTable()
+		// Escape pipes so they do not affect table rendering.
+		desc = strings.ReplaceAll(desc, "|", `\|`)
+		// Remove surrounding spaces and inner line breaks.
+		desc = strings.Trim(strings.ReplaceAll(desc, "\n", " "), " ")
+
+		// Escape angle brackets so the docs engine handles them as
+		// strings instead of HTML tags.
+		desc = strings.ReplaceAll(desc, "<", `\<`)
+		desc = strings.ReplaceAll(desc, ">", `\>`)
+
+		result = append(result, Field{
+			Description: printableDescription(desc, field.name),
+			Name:        field.jsonName,
+			Type:        typ,
+		})
+	}
+	return result, nil
+}
+
+// curlyBracePairPattern matches a pair of curly braces, with a capture group
+// for the content enclosed by the braces.
+var curlyBracePairPattern = regexp.MustCompile(`\{([^}]*)\}`)
+
+// printableDescription modifies a field or type description to make it suitable
+// for reading on a docs page.
+//
+// ident is the name of a Go identifier. printableDescription removes the name
+// from the description so we can include it within the resource reference,
+// fixing capitalization issues resulting from removing the name. Since the
+// identifier's name within the source won't mean anything to a docs reader,
+// removing it makes the description easier to read.
+//
+// Since curly brace pairs break docs site builds, printableDescription also
+// encloses any curly brace pairs with backticks.
+func printableDescription(description, ident string) string {
+	result := curlyBracePairPattern.ReplaceAllString(description, "`{$1}`")
+	// Replace any double-backticks resulting from the previous operation.
+	// This is a hack to avoid the need for more complex logic. Double
+	// backticks won't render as expected in the docs anyway, so it's fine
+	// to replace ones that don't result from the earlier replacement.
+	result = strings.ReplaceAll(result, "``", "`")
+
+	// Not possible to trim the name from description
+	if len(ident) > len(result) {
+		return result
+	}
+
+	switch {
+	case strings.HasPrefix(result, ident+" are "):
+		result = strings.TrimPrefix(result, ident+" are ")
+	case strings.HasPrefix(result, ident+" is "):
+		result = strings.TrimPrefix(result, ident+" is ")
+	case strings.HasPrefix(result, ident+" "):
+		result = strings.TrimPrefix(result, ident+" ")
+	case strings.HasPrefix(result, ident):
+		result = strings.TrimPrefix(result, ident)
+	}
+
+	// Make sure the result begins with a capital letter
+	if len(result) > 0 {
+		result = strings.ToUpper(result[:1]) + result[1:]
+	}
+
+	return result
+}
+
+// allFieldsForDecl finds embedded structs within fld and recursively
+// processes the fields of those structs as though the fields belonged to the
+// containing struct. Uses decl and allDecls to look up fields within the base
+// structs. Returns a modified slice of fields that include all non-embedded
+// fields within fld.
+func allFieldsForDecl(decl DeclarationInfo, fld []rawField, allDecls map[PackageInfo]DeclarationInfo) ([]rawField, error) {
+	fieldsToProcess := []rawField{}
+	for _, l := range fld {
+		// Not an embedded struct field, so append it to the final
+		// result.
+		if l.name != "" {
+			fieldsToProcess = append(fieldsToProcess, l)
+			continue
+		}
+		c, ok := l.kind.(yamlCustomType)
+		// Not an embedded struct since it's not a declared type.
+		if !ok {
+			continue
+		}
+
+		// Find the package name to use to look up the declaration from
+		// its identifier.
+		var pkg string
+		i, ok := decl.NamedImports[l.packageName]
+		switch {
+		// The file that made the declaration provided a name for the
+		// package associated with the identifier, so find the full
+		// package path and use that to look up the declaration.
+		case ok:
+			pkg = i
+		case l.packageName != "":
+			pkg = l.packageName
+		// If the field's type has no package name, assume the field's
+		// package name is the same as the one for decl.
+		default:
+			pkg = decl.PackageName
+
+		}
+		p := PackageInfo{
+			DeclName:    c.declarationInfo.DeclName,
+			PackageName: pkg,
+		}
+
+		// We expect to find a declaration of the embedded struct.
+		d, ok := allDecls[p]
+		if !ok {
+			return nil, fmt.Errorf(
+				"%v: field %v.%v is not declared anywhere",
+				decl.FilePath,
+				l.packageName,
+				c.name,
+			)
+		}
+		e, err := typeForDecl(d, allDecls)
+		if err != nil && !errors.As(err, &NotAGenDeclError{}) {
+			return nil, err
+		}
+
+		// The embedded struct field may have its own embedded struct
+		// fields.
+		nf, err := allFieldsForDecl(decl, e.fields, allDecls)
+		if err != nil {
+			return nil, err
+		}
+
+		fieldsToProcess = append(fieldsToProcess, nf...)
+	}
+	return fieldsToProcess, nil
+}
+
+// NamedImports creates a mapping from the provided name of each package import
+// to the original package path.
+func NamedImports(file *ast.File) map[string]string {
+	m := make(map[string]string)
+	for _, i := range file.Imports {
+		if i.Name == nil {
+			continue
+		}
+		s := strings.Trim(i.Path.Value, "\"")
+		p := strings.Split(s, "/")
+		// Consumers check the named imports map against the final path
+		// segment of a package path.
+		if len(p) > 1 {
+			s = p[len(p)-1]
+		}
+		m[i.Name.Name] = s
+	}
+	return m
+}
+
+// ReferenceDataFromDeclaration gets data for the reference by examining decl.
+// Looks up decl's fields in allDecls and methods in allMethods.
+func ReferenceDataFromDeclaration(decl DeclarationInfo, allDecls map[PackageInfo]DeclarationInfo) (map[PackageInfo]ReferenceEntry, error) {
+	rs, err := typeForDecl(decl, allDecls)
+	if err != nil {
+		return nil, err
+	}
+
+	fieldsToProcess, err := allFieldsForDecl(decl, rs.fields, allDecls)
+	if err != nil {
+		return nil, err
+	}
+
+	description := rs.doc
+	var example string
+
+	example, err = makeYAMLExample(fieldsToProcess)
+	if err != nil {
+		return nil, err
+	}
+
+	// Initialize the return value and insert the root reference entry
+	// provided by decl.
+	refs := make(map[PackageInfo]ReferenceEntry)
+	description = strings.Trim(strings.ReplaceAll(description, "\n", " "), " ")
+	entry := ReferenceEntry{
+		SectionName: makeSectionName(rs.name),
+		Description: printableDescription(description, rs.name),
+		SourcePath:  decl.FilePath,
+		YAMLExample: example,
+		Fields:      []Field{},
+	}
+	key := PackageInfo{
+		DeclName:    rs.name,
+		PackageName: decl.PackageName,
+	}
+
+	fld, err := makeFieldTableInfo(fieldsToProcess)
+	if err != nil {
+		return nil, err
+	}
+	slices.SortFunc(fld, sortFieldsByName)
+	entry.Fields = fld
+	refs[key] = entry
+
+	// For any fields within decl that have a custom type, look up the
+	// declaration for that type and create a separate reference entry for
+	// it.
+	for _, f := range fieldsToProcess {
+		// Don't make separate reference entries for embedded structs
+		// since they are part of the containing struct for the purposes
+		// of unmarshaling YAML.
+		//
+		if f.name == "" {
+			continue
+		}
+
+		c := f.kind.customFieldData()
+
+		for _, d := range c {
+			// Find the package name to use to look up the declaration from
+			// its identifier.
+			i, ok := decl.NamedImports[d.PackageName]
+			// The file that made the declaration provided a name for the
+			// package associated with the identifier, so find the full
+			// package path and use that to look up the declaration.
+			if ok {
+				d.PackageName = i
+			}
+
+			// Get information about the field type's declaration.
+			// If we can't find it, it means the field type was
+			// probably declared in the standard library or
+			// third-party package. In this case, leave it to the
+			// GoDoc to describe the field type.
+			gd, ok := allDecls[d]
+			if !ok {
+				continue
+			}
+			r, err := ReferenceDataFromDeclaration(gd, allDecls)
+			if errors.As(err, &NotAGenDeclError{}) {
+				continue
+			}
+			if err != nil {
+				return nil, err
+			}
+
+			for k, v := range r {
+				slices.SortFunc(v.Fields, sortFieldsByName)
+				refs[k] = v
+			}
+		}
+	}
+	return refs, nil
+}
diff --git a/build.assets/tooling/cmd/resource-ref-generator/resource/resource_test.go b/build.assets/tooling/cmd/resource-ref-generator/resource/resource_test.go
new file mode 100644
index 0000000000000..21b41d8949a3a
--- /dev/null
+++ b/build.assets/tooling/cmd/resource-ref-generator/resource/resource_test.go
@@ -0,0 +1,2099 @@
+// Teleport
+// Copyright (C) 2025  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package resource
+
+import (
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// replaceBackticks replaces the "BACKTICK" placeholder text with backticks so
+// we can include struct tags within source fixtures.
+func replaceBackticks(source string) string {
+	return strings.ReplaceAll(source, "BACKTICK", "`")
+}
+
+func TestReferenceDataFromDeclaration(t *testing.T) {
+	cases := []struct {
+		description string
+		source      string
+		expected    map[PackageInfo]ReferenceEntry
+		// Go source fixtures that the test uses for named type fields.
+		declSources []string
+		// Substring to expect in a resulting error message
+		errorSubstring string
+		declInfo       PackageInfo
+	}{
+		{
+			description: "scalar fields with one field ignored",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Namespace is the resource's namespace
+    Namespace string BACKTICKprotobuf:"bytes,2,opt,name=Namespace,proto3" json:"-"BACKTICK
+    // Description is the resource's description.
+    Description string BACKTICKprotobuf:"bytes,3,opt,name=Description,proto3" json:"description,omitempty"BACKTICK
+    // Age is the resource's age in seconds.
+    Age uint BACKTICKjson:"age"BACKTICK
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+description: "string"
+age: 1
+active: true
+`,
+					Fields: []Field{
+						Field{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						Field{
+							Name:        "age",
+							Description: "The resource's age in seconds.",
+							Type:        "number",
+						},
+						Field{
+							Name:        "description",
+							Description: "The resource's description.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "sequences of scalars",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Names is a list of names.
+    Names []string BACKTICKjson:"names"BACKTICK
+    // Numbers is a list of numbers.
+    Numbers []int BACKTICKjson:"numbers"BACKTICK
+    // Booleans is a list of Booleans.
+    Booleans []bool BACKTICKjson:"booleans"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `names: 
+  - "string"
+  - "string"
+  - "string"
+numbers: 
+  - 1
+  - 1
+  - 1
+booleans: 
+  - true
+  - true
+  - true
+`,
+					Fields: []Field{
+						Field{
+							Name:        "booleans",
+							Description: "A list of Booleans.",
+							Type:        "[]Boolean",
+						},
+						Field{
+							Name:        "names",
+							Description: "A list of names.",
+							Type:        "[]string",
+						},
+						Field{
+							Name:        "numbers",
+							Description: "A list of numbers.",
+							Type:        "[]number",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "a map of strings to sequences",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+  // Attributes indicates additional data for the resource.
+  Attributes map[string][]string BACKTICKjson:"attributes"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `attributes: 
+  "string": 
+    - "string"
+    - "string"
+    - "string"
+  "string": 
+    - "string"
+    - "string"
+    - "string"
+  "string": 
+    - "string"
+    - "string"
+    - "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "attributes",
+							Description: "Indicates additional data for the resource.",
+							Type:        "map[string][]string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "an undeclared custom type field",
+			declInfo: PackageInfo{
+				DeclName:    "Server",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "",
+						},
+					},
+					YAMLExample: "name: \"string\"\nspec: # See description\n",
+				},
+			},
+		},
+		{
+			description: "named scalar type",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Server",
+			},
+			source: `package mypkg
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+    // Label specifies labels for the server.
+    Label Labels BACKTICKjson:"labels"BACKTICK
+}
+`,
+			declSources: []string{
+				`package mypkg
+
+// Labels is a slice of strings that we'll process downstream
+type Labels []string
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "labels",
+							Description: "Specifies labels for the server.",
+							Type:        "[Labels](#labels)",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "",
+						},
+					},
+					YAMLExample: "name: \"string\"\nspec: # See description\nlabels: # [...]\n",
+				},
+				PackageInfo{
+					DeclName:    "Labels",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Labels",
+					Description: "A slice of strings that we'll process downstream",
+					SourcePath:  "src/myfile0.go",
+					Fields:      nil,
+					YAMLExample: "",
+				},
+			},
+		},
+		{
+			description: "custom type fields with a custom JSON unmarshaller",
+			declInfo: PackageInfo{
+				DeclName:    "Server",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			declSources: []string{
+				`package mypkg
+
+func (s *Server) UnmarshalJSON (b []byte) error {
+  return nil
+}
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "",
+						},
+					},
+					YAMLExample: "name: \"string\"\nspec: # See description\n",
+				},
+			},
+		},
+		{
+			description: "custom type with custom YAML unmarshaller",
+			declInfo: PackageInfo{
+				DeclName:    "Application",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Application includes information about an application registered with Teleport.
+type Application struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the application.
+    Spec types.AppSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			declSources: []string{
+				`package mypkg
+
+func (a *Application) UnmarshalYAML(value *yaml.Node) error {
+  return nil
+}
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Application",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Application",
+					Description: "Includes information about an application registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "spec",
+							Description: "Contains information about the application.",
+							Type:        "",
+						},
+					},
+					YAMLExample: "name: \"string\"\nspec: # See description\n",
+				},
+			},
+		},
+		{
+			description: "a custom type field declared in a second source file",
+			declInfo: PackageInfo{
+				DeclName:    "Server",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			declSources: []string{`package types
+// ServerSpecV1 includes aspects of a proxied server.
+type ServerSpecV1 struct {
+    // The address of the server.
+    Address string BACKTICKjson:"address"BACKTICK
+    // How long the resource is valid.
+    TTL int BACKTICKjson:"ttl"BACKTICK
+    // Whether the server is active.
+    IsActive bool BACKTICKjson:"is_active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+spec: # [...]
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "[Server Spec V1](#server-spec-v1)",
+						},
+					},
+				},
+				PackageInfo{
+					DeclName:    "ServerSpecV1",
+					PackageName: "types",
+				}: {
+					SectionName: "Server Spec V1",
+					Description: "Includes aspects of a proxied server.",
+					SourcePath:  "src/myfile0.go",
+					YAMLExample: `address: "string"
+ttl: 1
+is_active: true
+`,
+					Fields: []Field{
+						Field{
+							Name:        "address",
+							Description: "The address of the server.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "is_active",
+							Description: "Whether the server is active.",
+							Type:        "Boolean",
+						},
+						Field{
+							Name:        "ttl",
+							Description: "How long the resource is valid.",
+							Type:        "number",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "composite field type with named scalar type",
+			declInfo: PackageInfo{
+				DeclName:    "Server",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+    // LabelMaps includes a map of strings to labels.
+    LabelMaps []map[string]types.Label BACKTICKjson:"label_maps"BACKTICK
+}
+`,
+			declSources: []string{`package types
+// ServerSpecV1 includes aspects of a proxied server.
+type ServerSpecV1 struct {
+    // The address of the server.
+    Address string BACKTICKjson:"address"BACKTICK
+}`,
+				`package types
+
+// Label is a custom type that we unmarshal in a non-default way.
+type Label string
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `spec: # [...]
+label_maps: 
+  - 
+    "string": # [...]
+    "string": # [...]
+    "string": # [...]
+  - 
+    "string": # [...]
+    "string": # [...]
+    "string": # [...]
+  - 
+    "string": # [...]
+    "string": # [...]
+    "string": # [...]
+`,
+					Fields: []Field{
+						Field{
+							Name:        "label_maps",
+							Description: "Includes a map of strings to labels.",
+							Type:        "[]map[string][Label](#label)",
+						},
+						Field{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "[Server Spec V1](#server-spec-v1)",
+						},
+					},
+				},
+				PackageInfo{
+					DeclName:    "ServerSpecV1",
+					PackageName: "types",
+				}: {
+					SectionName: "Server Spec V1",
+					Description: "Includes aspects of a proxied server.",
+					SourcePath:  "src/myfile0.go",
+					YAMLExample: `address: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "address",
+							Description: "The address of the server.",
+							Type:        "string",
+						},
+					},
+				},
+				PackageInfo{
+					DeclName:    "Label",
+					PackageName: "types",
+				}: {
+					SectionName: "Label",
+					Description: "A custom type that we unmarshal in a non-default way.",
+					SourcePath:  "src/myfile1.go",
+					Fields:      nil,
+				},
+			},
+		},
+		{
+			description: "struct type with an interface field",
+			declInfo: PackageInfo{
+				DeclName:    "Server",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+  // The name of the server.
+  Name string BACKTICK:json:"name"BACKTICK
+  // Impl is the implementation of the server.
+  Impl ServerImplementation BACKTICK:json:"impl"BACKTICK
+}
+`,
+			declSources: []string{`package mypkg
+// ServerImplementation is a remote service with a URL.
+type ServerImplementation interface{
+  GetURL() string
+}
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "impl",
+							Description: "The implementation of the server.",
+							Type:        "[Server Implementation](#server-implementation)",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the server.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `name: "string"
+impl: # [...]
+`,
+				},
+				PackageInfo{
+					DeclName:    "ServerImplementation",
+					PackageName: "mypkg",
+				}: ReferenceEntry{
+					SectionName: "Server Implementation",
+					Description: "A remote service with a URL.",
+					SourcePath:  "src/myfile0.go",
+					Fields:      nil,
+					YAMLExample: "",
+				},
+			},
+		},
+		{
+			description: "embedded struct",
+			declInfo: PackageInfo{
+				DeclName:    "MyResource",
+				PackageName: "mypkg",
+			},
+			source: `package mypkg
+// MyResource is a resource declared for testing.
+type MyResource struct{
+  // Alias is another name to call the resource.
+  Alias string BACKTICKjson:"alias"BACKTICK
+  types.Metadata
+}
+`,
+			declSources: []string{
+				`package types
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "MyResource",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "My Resource",
+					Description: "A resource declared for testing.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						{
+							Name:        "alias",
+							Description: "Another name to call the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `alias: "string"
+name: "string"
+active: true
+`,
+				},
+			},
+		},
+		{
+			description: "embedded struct with struct field",
+			declInfo: PackageInfo{
+				DeclName:    "MyResource",
+				PackageName: "mypkg",
+			},
+			source: `package mypkg
+// MyResource is a resource declared for testing.
+type MyResource struct{
+  // Alias is another name to call the resource.
+  Alias string BACKTICKjson:"alias"BACKTICK
+  types.Header
+}
+`,
+			declSources: []string{
+				`package types
+type Header struct {
+    // Metadata is the resource metadata
+    Metadata Metadata BACKTICKjson:"metadata"BACKTICK
+}
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "MyResource",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "My Resource",
+					Description: "A resource declared for testing.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "alias",
+							Description: "Another name to call the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "metadata",
+							Description: "The resource metadata",
+							Type:        "[Metadata](#metadata)",
+						},
+					},
+					YAMLExample: `alias: "string"
+metadata: # [...]
+`,
+				},
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "types",
+				}: {
+					SectionName: "Metadata",
+					SourcePath:  "src/myfile0.go",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					Fields: []Field{
+						{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `name: "string"
+active: true
+`,
+				},
+			},
+		},
+		{
+			description: "embedded struct with base in the same package",
+			declInfo: PackageInfo{
+				DeclName:    "MyResource",
+				PackageName: "mypkg",
+			},
+			source: `package mypkg
+// MyResource is a resource declared for testing.
+type MyResource struct{
+  // Alias is another name to call the resource.
+  Alias string BACKTICKjson:"alias"BACKTICK
+  Metadata
+}
+`,
+			declSources: []string{
+				`package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "MyResource",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "My Resource",
+					Description: "A resource declared for testing.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						{
+							Name:        "alias",
+							Description: "Another name to call the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `alias: "string"
+name: "string"
+active: true
+`,
+				},
+			},
+		},
+		{
+			description: "struct with two embedded structs",
+			declInfo: PackageInfo{
+				DeclName:    "MyResource",
+				PackageName: "mypkg",
+			},
+			source: `package mypkg
+// MyResource is a resource declared for testing.
+type MyResource struct{
+  // Alias is another name to call the resource.
+  Alias string BACKTICKjson:"alias"BACKTICK
+  types.Metadata
+  moretypes.ActivityStatus
+}
+`,
+			declSources: []string{
+				`package types
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+}`,
+				`package moretypes
+
+// ActivityStatus indicates the status of a resource
+type ActivityStatus struct{
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "MyResource",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "My Resource",
+					Description: "A resource declared for testing.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						{
+							Name:        "alias",
+							Description: "Another name to call the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `alias: "string"
+name: "string"
+active: true
+`,
+				},
+			},
+		},
+		{
+			description: "embedded struct with an embedded struct",
+			declInfo: PackageInfo{
+				DeclName:    "MyResource",
+				PackageName: "mypkg",
+			},
+			source: `package mypkg
+// MyResource is a resource declared for testing.
+type MyResource struct{
+  // Alias is another name to call the resource.
+  Alias string BACKTICKjson:"alias"BACKTICK
+  types.Metadata
+}
+`,
+			declSources: []string{
+				`package types
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    moretypes.ActivityStatus
+}`,
+				`package moretypes
+
+// ActivityStatus indicates the status of a resource
+type ActivityStatus struct{
+    // Active indicates whether the resource is currently in use.
+    Active bool BACKTICKjson:"active"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "MyResource",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "My Resource",
+					Description: "A resource declared for testing.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						{
+							Name:        "active",
+							Description: "Indicates whether the resource is currently in use.",
+							Type:        "Boolean",
+						},
+						{
+							Name:        "alias",
+							Description: "Another name to call the resource.",
+							Type:        "string",
+						},
+						{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `alias: "string"
+name: "string"
+active: true
+`,
+				},
+			},
+		},
+		{
+			description: "ignored fields with non-YAML-comptabible types",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    XXX_NoUnkeyedLiteral struct{} BACKTICKjson:"-"BACKTICK
+    XXX_unrecognized     []byte   BACKTICKjson:"-"BACKTICK
+
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "non-embedded custom field type declared in the same package as the containing struct",
+			declInfo: PackageInfo{
+				DeclName:    "DatabaseServerV3",
+				PackageName: "typestest",
+			},
+			source: `package typestest
+
+// DatabaseServerV3 represents a database access server.
+type DatabaseServerV3 struct {
+	// Kind is the database server resource kind.
+	Kind string BACKTICKprotobuf:"bytes,1,opt,name=Kind,proto3" json:"kind"BACKTICK
+	// Metadata is the database server metadata.
+	Metadata Metadata BACKTICKprotobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"BACKTICK
+}
+`,
+			declSources: []string{
+				`package typestest
+
+// Metadata is resource metadata
+type Metadata struct {
+	// Name is an object name
+	Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+	// Description is object description
+	Description string BACKTICKprotobuf:"bytes,3,opt,name=Description,proto3" json:"description,omitempty"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "DatabaseServerV3",
+					PackageName: "typestest",
+				}: ReferenceEntry{
+					SectionName: "Database Server V3",
+					Description: "Represents a database access server.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						Field{
+							Name:        "kind",
+							Description: "The database server resource kind.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "metadata",
+							Description: "The database server metadata.",
+							Type:        "[Metadata](#metadata)",
+						},
+					},
+					YAMLExample: `kind: "string"
+metadata: # [...]
+`,
+				},
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "typestest",
+				}: ReferenceEntry{
+					SectionName: "Metadata",
+					Description: "Resource metadata",
+					SourcePath:  "src/myfile0.go",
+					Fields: []Field{
+						{
+							Name:        "description",
+							Description: "Object description",
+							Type:        "string",
+						},
+						{
+							Name:        "name",
+							Description: "An object name",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `name: "string"
+description: "string"
+`,
+				},
+			},
+		},
+		{
+			description: "pointer field",
+			declInfo: PackageInfo{
+				DeclName:    "DatabaseServerV3",
+				PackageName: "typestest",
+			},
+			source: `package typestest
+
+// DatabaseServerV3 represents a database access server.
+type DatabaseServerV3 struct {
+	// Metadata is the database server metadata.
+	Metadata *Metadata BACKTICKprotobuf:"bytes,4,opt,name=Metadata,proto3" json:"metadata"BACKTICK
+}
+`,
+			declSources: []string{
+				`package typestest
+
+// Metadata is resource metadata
+type Metadata struct {
+	// Name is an object name
+	Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "DatabaseServerV3",
+					PackageName: "typestest",
+				}: ReferenceEntry{
+					SectionName: "Database Server V3",
+					Description: "Represents a database access server.",
+					SourcePath:  "src/myfile.go",
+					Fields: []Field{
+						Field{
+							Name:        "metadata",
+							Description: "The database server metadata.",
+							Type:        "[Metadata](#metadata)",
+						},
+					},
+					YAMLExample: `metadata: # [...]
+`,
+				},
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "typestest",
+				}: ReferenceEntry{
+					SectionName: "Metadata",
+					Description: "Resource metadata",
+					SourcePath:  "src/myfile0.go",
+					Fields: []Field{
+						{
+							Name:        "name",
+							Description: "An object name",
+							Type:        "string",
+						},
+					},
+					YAMLExample: `name: "string"
+`,
+				},
+			},
+		},
+		{
+			description: "map of strings to an undeclared field",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Server",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the server.
+    Name string BACKTICKjson:"name"BACKTICK
+    // LabelMaps includes a map of strings to labels.
+    LabelMaps []map[string]types.Label BACKTICKjson:"label_maps"BACKTICK
+}
+`,
+			declSources: []string{`package types
+// ServerSpecV1 includes aspects of a proxied server.
+type ServerSpecV1 struct {
+    // The address of the server.
+    Address string BACKTICKjson:"address"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+label_maps: 
+  - 
+    "string": # See description
+    "string": # See description
+    "string": # See description
+  - 
+    "string": # See description
+    "string": # See description
+    "string": # See description
+  - 
+    "string": # See description
+    "string": # See description
+    "string": # See description
+`,
+					Fields: []Field{
+						Field{
+							Name:        "label_maps",
+							Description: "Includes a map of strings to labels.",
+							Type:        "[]map[string]",
+						},
+						Field{
+							Name:        "name",
+							Description: "The name of the server.",
+							Type:        "string"},
+					},
+				},
+			},
+		},
+		{
+			description: "type parameter",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Resource",
+			},
+			source: `package mypkg
+// Resource is a resource.
+type Resource struct {
+  // The name of the resource.
+  Name string BACKTICKjson:"name"BACKTICK
+}
+`,
+			declSources: []string{
+				`package mypkg
+// streamFunc is a wrapper that converts a closure into a stream.
+type streamFunc[T any] struct {
+	fn        func() (T, error)
+	doneFuncs []func()
+	item      T
+	err       error
+}
+
+func (stream *streamFunc[T]) Next() bool {
+	stream.item, stream.err = stream.fn()
+	return stream.err == nil
+}
+`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					PackageName: "mypkg",
+					DeclName:    "Resource",
+				}: ReferenceEntry{
+					SectionName: "Resource",
+					Description: "A resource.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "field type not declared in a loaded package",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Resource",
+			},
+			source: `package mypkg
+
+// Resource is a resource.
+type Resource struct {
+  // The name of the resource.
+  Name string BACKTICKjson:"name"BACKTICK
+  // How much time must elapse before the resource expires.
+  Expiry time.Time BACKTICKjson:"expiry"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					PackageName: "mypkg",
+					DeclName:    "Resource",
+				}: ReferenceEntry{
+					SectionName: "Resource",
+					Description: "A resource.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+expiry: # See description
+`,
+					Fields: []Field{
+						Field{
+							Name:        "expiry",
+							Description: "How much time must elapse before the resource expires.",
+							Type:        "",
+						},
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+			declSources: []string{},
+		},
+		{
+			description: "byte slice",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Metadata",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // PrivateKey is the private key of the resource.
+    PrivateKey []byte BACKTICKjson:"private_key"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+private_key: BASE64_STRING
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "private_key",
+							Description: "The private key of the resource.",
+							Type:        "base64-encoded string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "named import in embedded struct field",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Server",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			declSources: []string{`package types
+
+import alias "otherpkg"
+
+// ServerSpecV1 includes aspects of a proxied server.
+type ServerSpecV1 struct {
+  alias.ServerSpec
+}`,
+				`package otherpkg
+
+type ServerSpec struct {
+    // The address of the server.
+    Address string BACKTICKjson:"address"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+spec: # [...]
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "[Server Spec V1](#server-spec-v1)",
+						},
+					},
+				},
+				PackageInfo{
+					DeclName:    "ServerSpecV1",
+					PackageName: "types",
+				}: {
+					SectionName: "Server Spec V1",
+					Description: "Includes aspects of a proxied server.",
+					SourcePath:  "src/myfile0.go",
+					YAMLExample: `address: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "address",
+							Description: "The address of the server.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "named import in named struct field",
+			declInfo: PackageInfo{
+				PackageName: "mypkg",
+				DeclName:    "Server",
+			},
+			source: `
+package mypkg
+
+// Server includes information about a server registered with Teleport.
+type Server struct {
+    // Spec contains information about the server.
+    Spec types.ServerSpecV1 BACKTICKjson:"spec"BACKTICK
+}
+`,
+			declSources: []string{`package types
+import alias "otherpkg"
+
+// ServerSpecV1 includes aspects of a proxied server.
+type ServerSpecV1 struct {
+  // Address information.
+  Info alias.AddressInfo BACKTICKjson:"info"BACKTICK
+}`,
+
+				`package otherpkg
+// AddressInfo provides information about an address.
+type AddressInfo struct {
+    // The address of the server.
+    Address string BACKTICKjson:"address"BACKTICK
+}`,
+			},
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "AddressInfo",
+					PackageName: "otherpkg",
+				}: {
+					SectionName: "Address Info",
+					Description: "Provides information about an address.",
+					SourcePath:  "src/myfile1.go",
+					Fields: []Field{
+						{
+							Name:        "address",
+							Description: "The address of the server.",
+							Type:        "string",
+						},
+					},
+					YAMLExample: "address: \"string\"\n",
+				},
+				PackageInfo{
+					DeclName:    "Server",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Server",
+					Description: "Includes information about a server registered with Teleport.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `spec: # [...]
+`,
+					Fields: []Field{
+						Field{
+							Name:        "spec",
+							Description: "Contains information about the server.",
+							Type:        "[Server Spec V1](#server-spec-v1)"},
+					},
+				},
+				PackageInfo{
+					DeclName:    "ServerSpecV1",
+					PackageName: "types",
+				}: {
+					SectionName: "Server Spec V1",
+					Description: "Includes aspects of a proxied server.",
+					SourcePath:  "src/myfile0.go",
+					YAMLExample: `info: # [...]
+`,
+					Fields: []Field{
+						Field{
+							Name:        "info",
+							Description: "Address information.",
+							Type:        "[Address Info](#address-info)",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "scalar fields with two unexported fields",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a dynamic resource. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the name of the resource.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+    // Description is the resource's description.
+    Description string BACKTICKprotobuf:"bytes,3,opt,name=Description,proto3" json:"description,omitempty"BACKTICK
+    state protoimpl.MessageState BACKTICKprotogen:"open.v1"BACKTICK
+    unknownFields protoimpl.UnknownFields
+    sizeCache     protoimpl.SizeCache
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a dynamic resource. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+description: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "description",
+							Description: "The resource's description.",
+							Type:        "string",
+						},
+						Field{
+							Name:        "name",
+							Description: "The name of the resource.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+		{
+			description: "curly braces in descriptions",
+			declInfo: PackageInfo{
+				DeclName:    "Metadata",
+				PackageName: "mypkg",
+			},
+			source: `
+package mypkg
+
+// Metadata describes information about a {dynamic resource}. Every dynamic
+// resource in Teleport has a metadata object.
+type Metadata struct {
+    // Name is the {name of the resource}.
+    Name string BACKTICKprotobuf:"bytes,1,opt,name=Name,proto3" json:"name"BACKTICK
+}
+`,
+			expected: map[PackageInfo]ReferenceEntry{
+				PackageInfo{
+					DeclName:    "Metadata",
+					PackageName: "mypkg",
+				}: {
+					SectionName: "Metadata",
+					Description: "Describes information about a `{dynamic resource}`. Every dynamic resource in Teleport has a metadata object.",
+					SourcePath:  "src/myfile.go",
+					YAMLExample: `name: "string"
+`,
+					Fields: []Field{
+						Field{
+							Name:        "name",
+							Description: "The `{name of the resource}`.",
+							Type:        "string",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.description, func(t *testing.T) {
+			tmp := t.TempDir()
+			if err := os.Mkdir(filepath.Join(tmp, "src"), 0777); err != nil {
+				t.Fatal(err)
+			}
+
+			// Make a map of filenames to content
+			sources := make(map[string][]byte)
+			sources[filepath.Join(tmp, "src", "myfile.go")] = []byte(replaceBackticks(tc.source))
+			for i, s := range tc.declSources {
+				sources[filepath.Join(tmp, "src", "myfile"+strconv.Itoa(i)+".go")] = []byte(replaceBackticks(s))
+			}
+
+			// Write the source content to a temporary directory
+			for n, v := range sources {
+				f, err := os.Create(n)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if _, err := f.Write(v); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			sourceData, err := NewSourceData(tmp)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			di, ok := sourceData.TypeDecls[tc.declInfo]
+			if !ok {
+				t.Fatalf("expected data for %v.%v not found in the source", tc.declInfo.PackageName, tc.declInfo.DeclName)
+			}
+
+			r, err := ReferenceDataFromDeclaration(di, sourceData.TypeDecls)
+			if tc.errorSubstring == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.errorSubstring)
+			}
+
+			assert.Equal(t, tc.expected, r)
+		})
+	}
+}
+
+func TestNamedImports(t *testing.T) {
+	cases := []struct {
+		description string
+		input       string
+		expected    map[string]string
+	}{
+		{
+			description: "single-line format",
+			input: `package mypkg
+import alias "otherpkg"
+`,
+			expected: map[string]string{
+				"alias": "otherpkg",
+			},
+		},
+		{
+			description: "multi-line format",
+			input: `package mypkg
+import (
+    alias "first"
+    alias2 "second"
+)
+`,
+			expected: map[string]string{
+				"alias":  "first",
+				"alias2": "second",
+			},
+		},
+		{
+			description: "multi-segment package path",
+			input: `package mypkg
+import alias "my/multi/segment/package"
+`,
+			expected: map[string]string{
+				"alias": "package",
+			},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			fset := token.NewFileSet()
+			f, err := parser.ParseFile(fset,
+				"myfile.go",
+				c.input,
+				parser.ParseComments,
+			)
+			assert.NoError(t, err)
+			assert.Equal(t, c.expected, NamedImports(f))
+		})
+	}
+}
+
+func TestMakeFieldTableInfo(t *testing.T) {
+	cases := []struct {
+		description string
+		input       []rawField
+		expected    []Field
+	}{
+		{
+			description: "angle brackets in GoDoc",
+			input: []rawField{
+				rawField{
+					packageName: "mypkg",
+					doc:         `An ID, e.g., "<myid>"`,
+					kind:        yamlString{},
+					name:        "ObjectID",
+					jsonName:    "object_id",
+					tags:        `json:"object_id"`,
+				},
+			},
+			expected: []Field{
+				{
+					Name:        "object_id",
+					Description: `An ID, e.g., "\<myid\>"`,
+					Type:        "string",
+				},
+			},
+		},
+		{
+			description: "pipe in field description",
+			input: []rawField{
+				{
+					packageName: "mypkg",
+					doc:         "Specifies the locking mode (strict|best_effort) to be applied with the role.",
+					kind: yamlCustomType{
+						name: "LockingMode",
+						declarationInfo: PackageInfo{
+							DeclName:    "LockingMode",
+							PackageName: "mypkg",
+						},
+					},
+					name:     "LockingMode",
+					jsonName: "locking_mode",
+					tags:     "json:\"locking_mode\"",
+				},
+			},
+			expected: []Field{
+				{
+					Name:        "locking_mode",
+					Description: `Specifies the locking mode (strict\|best_effort) to be applied with the role.`,
+					Type:        "[LockingMode](#lockingmode)",
+				},
+			},
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			f, err := makeFieldTableInfo(c.input)
+			assert.NoError(t, err)
+			assert.Equal(t, c.expected, f)
+		})
+	}
+}
+
+func TestGetJSONTag(t *testing.T) {
+	cases := []struct {
+		description string
+		input       string
+		expected    string
+	}{
+		{
+			description: "one well-formed struct tag",
+			input:       `json:"my_tag"`,
+			expected:    "my_tag",
+		},
+		{
+			description: "multiple well-formed struct tags",
+			input:       `json:"json_tag" yaml:"yaml_tag" other:"other-tag"`,
+			expected:    "json_tag",
+		},
+		{
+			description: "omitempty option in tag value",
+			input:       `json:"json_tag,omitempty" yaml:"yaml_tag" other:"other-tag"`,
+			expected:    "json_tag",
+		},
+		{
+			description: "No JSON tag",
+			input:       `other:"other-tag"`,
+			expected:    "",
+		},
+		{
+			description: "Empty JSON tag with the omitempty option",
+			input:       `json:",omitempty" other:"other-tag"`,
+			expected:    "",
+		},
+		{
+			description: "Ignored JSON field",
+			input:       `json:"-" other:"other-tag"`,
+			expected:    "-",
+		},
+		{
+			description: "empty JSON tag",
+			input:       `json:"" yaml:"yaml_tag" other:"other-tag"`,
+			expected:    "",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			g := getJSONTag(c.input)
+			assert.Equal(t, c.expected, g)
+		})
+	}
+}
+
+func TestPrintableDescription(t *testing.T) {
+	cases := []struct {
+		description string
+		input       string
+		name        string
+		expected    string
+	}{
+		{
+			description: "short description",
+			input:       "A",
+			name:        "MyDecl",
+			expected:    "A",
+		},
+		{
+			description: "no description",
+			input:       "",
+			name:        "MyDecl",
+			expected:    "",
+		},
+		{
+			description: "GoDoc consists only of declaration name",
+			input:       "MyDecl",
+			name:        "MyDecl",
+			expected:    "",
+		},
+		{
+			description: "description containing name",
+			input:       "MyDecl is a declaration that we will describe in the docs.",
+			name:        "MyDecl",
+			expected:    "A declaration that we will describe in the docs.",
+		},
+		{
+			description: "description containing name and \"are\"",
+			input:       "MyDecls are things that we will describe in the docs.",
+			name:        "MyDecls",
+			expected:    "Things that we will describe in the docs.",
+		},
+
+		{
+			description: "description with no name",
+			input:       "Declaration that we will describe in the docs.",
+			name:        "MyDecl",
+			expected:    "Declaration that we will describe in the docs.",
+		},
+		{
+			description: "description beginning with name and non-is verb",
+			input:       "MyDecl performs an action.",
+			name:        "MyDecl",
+			expected:    "Performs an action.",
+		},
+		{
+			description: "curly brace pair and identifier name",
+			input:       "MyDecl performs an action, such as {updating, deleting}",
+			name:        "MyDecl",
+			expected:    "Performs an action, such as `{updating, deleting}`",
+		},
+		{
+			description: "curly brace pair and no identifier name",
+			input:       "Performs an action, such as {updating, deleting}",
+			name:        "MyDecl",
+			expected:    "Performs an action, such as `{updating, deleting}`",
+		},
+		{
+			description: "curly brace pair with existing backticks",
+			input:       "Performs an action, such as `{updating, deleting}`",
+			name:        "MyDecl",
+			expected:    "Performs an action, such as `{updating, deleting}`",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			assert.Equal(t, c.expected, printableDescription(c.input, c.name))
+		})
+	}
+}
+
+func TestMakeYAMLExample(t *testing.T) {
+	cases := []struct {
+		description string
+		input       []rawField
+		expected    string
+	}{
+		{
+			description: "all scalars",
+			input: []rawField{
+				rawField{
+					doc:  "myInt is an int",
+					kind: yamlNumber{},
+					name: "myInt",
+					tags: `json:"my_int"`,
+				},
+				rawField{
+					doc:  "myBool is a Boolean",
+					kind: yamlBool{},
+					name: "myBool",
+					tags: `json:"my_bool"`,
+				},
+				rawField{
+					doc:  "myString is a string",
+					kind: yamlString{},
+					tags: `json:"my_string"`,
+				},
+			},
+			expected: `my_int: 1
+my_bool: true
+my_string: "string"
+`,
+		},
+		{
+			description: "sequence of sequence of strings",
+			input: []rawField{
+				rawField{
+					name:     "mySeq",
+					jsonName: "my_seq",
+					doc:      "mySeq is a sequence of sequences of strings",
+					tags:     `json:"my_seq"`,
+					kind: yamlSequence{
+						elementKind: yamlSequence{
+							elementKind: yamlString{},
+						},
+					},
+				},
+			},
+			expected: `my_seq: 
+  - 
+    - "string"
+    - "string"
+    - "string"
+  - 
+    - "string"
+    - "string"
+    - "string"
+  - 
+    - "string"
+    - "string"
+    - "string"
+`,
+		},
+		{
+			description: "maps of numbers to strings",
+			input: []rawField{
+				rawField{
+					name:     "myMap",
+					jsonName: "my_map",
+					doc:      "myMap is a map of ints to strings",
+					tags:     `json:"my_map"`,
+					kind: yamlMapping{
+						keyKind:   yamlNumber{},
+						valueKind: yamlString{},
+					},
+				},
+			},
+			expected: `my_map: 
+  1: "string"
+  1: "string"
+  1: "string"
+`,
+		},
+		{
+			description: "sequence of maps of strings to Booleans",
+			input: []rawField{
+				rawField{
+					name:     "mySeq",
+					jsonName: "my_seq",
+					doc:      "mySeq is a complex type",
+					tags:     `json:"my_seq"`,
+					kind: yamlSequence{
+						elementKind: yamlMapping{
+							keyKind:   yamlString{},
+							valueKind: yamlBool{},
+						},
+					},
+				},
+			},
+			expected: `my_seq: 
+  - 
+    "string": true
+    "string": true
+    "string": true
+  - 
+    "string": true
+    "string": true
+    "string": true
+  - 
+    "string": true
+    "string": true
+    "string": true
+`,
+		},
+		{
+			description: "sequences of custom types",
+			input: []rawField{
+				rawField{
+					name:     "labels",
+					jsonName: "labels",
+					doc:      "labels is a list of labels",
+					tags:     `json:"labels"`,
+					kind: yamlSequence{
+						elementKind: yamlCustomType{
+							name: "label",
+							declarationInfo: PackageInfo{
+								DeclName:    "label",
+								PackageName: "mypkg",
+							},
+						},
+					},
+				},
+			},
+			expected: `labels: 
+  - # [...]
+  - # [...]
+  - # [...]
+`,
+		},
+		{
+			description: "maps of strings to custom types",
+			input: []rawField{
+				rawField{
+					name:     "labels",
+					jsonName: "labels",
+					doc:      "labels is a map of strings to labels",
+					tags:     `json:"labels"`,
+					kind: yamlMapping{
+						keyKind: yamlString{},
+						valueKind: yamlCustomType{
+							name: "label",
+							declarationInfo: PackageInfo{
+								DeclName:    "label",
+								PackageName: "mypkg",
+							},
+						},
+					},
+				},
+			},
+			expected: `labels: 
+  "string": # [...]
+  "string": # [...]
+  "string": # [...]
+`,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			e, err := makeYAMLExample(c.input)
+			assert.NoError(t, err)
+			assert.Equal(t, c.expected, e)
+		})
+	}
+}
+
+func TestMakeSectionName(t *testing.T) {
+	cases := []struct {
+		description string
+		original    string
+		expected    string
+	}{
+		{
+			description: "camel-case name",
+			original:    "ServerSpec",
+			expected:    "Server Spec",
+		},
+		{
+			description: "camel-case name with three words",
+			original:    "MyExcellentResource",
+			expected:    "My Excellent Resource",
+		},
+		{
+			description: "camel-case name with version",
+			original:    "ServerSpecV2",
+			expected:    "Server Spec V2",
+		},
+		{
+			description: "abbreviation",
+			original:    "SAMLConnector",
+			expected:    "SAML Connector",
+		},
+		{
+			description: "IdP",
+			original:    "IdPSAMLOptions",
+			expected:    "IdP SAML Options",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			assert.Equal(t, c.expected, makeSectionName(c.original))
+		})
+	}
+}
diff --git a/build.assets/tooling/go.mod b/build.assets/tooling/go.mod
index 3b3db97ae3c58..3855ae295db91 100644
--- a/build.assets/tooling/go.mod
+++ b/build.assets/tooling/go.mod
@@ -1,38 +1,51 @@
 module github.com/gravitational/teleport/build.assets/tooling
 
-go 1.24.3
+go 1.24.11
 
 require (
+	buf.build/go/bufplugin v0.9.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/alecthomas/kingpin/v2 v2.4.0 // replaced
 	github.com/awalterschulze/goderive v0.5.1
-	github.com/bmatcuk/doublestar/v4 v4.8.1
+	github.com/bmatcuk/doublestar/v4 v4.9.0
 	github.com/coreos/go-semver v0.3.1
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/go-github/v41 v41.0.0
+	github.com/gravitational/teleport v0.0.0-00010101000000-000000000000
 	github.com/gravitational/trace v1.5.1
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/waigani/diffparser v0.0.0-20190828052634-7391f219313d
-	golang.org/x/mod v0.24.0
-	golang.org/x/oauth2 v0.29.0
-	helm.sh/helm/v3 v3.17.3
+	golang.org/x/mod v0.29.0
+	golang.org/x/oauth2 v0.30.0
+	google.golang.org/protobuf v1.36.10
+	helm.sh/helm/v3 v3.18.5
 	howett.net/plist v1.0.1
-	k8s.io/apiextensions-apiserver v0.33.0
+	k8s.io/apiextensions-apiserver v0.33.3
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
+	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.3-20250121211742-6d880cc6cc8d.1 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1 // indirect
+	buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.3-20241007202033-cf42259fcbfc.1 // indirect
+	buf.build/go/protovalidate v0.14.0 // indirect
+	buf.build/go/spdx v0.2.0 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/bufbuild/protocompile v0.14.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/google/cel-go v0.25.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kisielk/gotool v1.0.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -40,23 +53,261 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.33.0 // indirect
+	k8s.io/apimachinery v0.33.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
+	pluginrpc.com/pluginrpc v0.5.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)
+
+require (
+	cloud.google.com/go/auth v0.16.5 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
+	connectrpc.com/connect v1.18.1 // indirect
+	filippo.io/age v1.2.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.39.6 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/glue v1.109.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
+	github.com/beevik/etree v1.5.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
+	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
+	github.com/crewjam/httperr v0.2.0 // indirect
+	github.com/crewjam/saml v0.4.14 // indirect
+	github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
+	github.com/di-wu/parser v0.3.0 // indirect
+	github.com/di-wu/xsd-datetime v1.0.0 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect
+	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
+	github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-webauthn/webauthn v0.11.2 // indirect
+	github.com/go-webauthn/x v0.1.20 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
+	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/certificate-transparency-go v1.3.1 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/go-attestation v0.5.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
+	github.com/google/go-github/v70 v70.0.0 // indirect
+	github.com/google/go-tpm v0.9.4 // indirect
+	github.com/google/go-tpm-tools v0.4.5 // indirect
+	github.com/google/go-tspi v0.3.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
+	github.com/gravitational/roundtrip v1.0.3 // indirect
+	github.com/gravitational/teleport/api v0.0.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/in-toto/attestation v1.1.1 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.7.4 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
+	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
+	github.com/jcmturner/gofork v1.7.6 // indirect
+	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
+	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
+	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
+	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/julienschmidt/httprouter v1.3.0 // indirect
+	github.com/kelseyhightower/envconfig v1.4.0 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/muhlemmer/gu v0.3.1 // indirect
+	github.com/muhlemmer/httpforwarded v0.1.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ohler55/ojg v1.26.8 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/okta/okta-sdk-golang/v2 v2.20.0 // indirect
+	github.com/openai/openai-go v1.8.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkoukk/tiktoken-go v0.1.8 // indirect
+	github.com/pquerna/otp v1.4.0 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rs/cors v1.11.1 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sassoftware/relic v7.2.1+incompatible // indirect
+	github.com/scim2/filter-parser/v2 v2.2.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/sigstore/protobuf-specs v0.5.0 // indirect
+	github.com/sigstore/rekor v1.4.1 // indirect
+	github.com/sigstore/sigstore v1.9.5 // indirect
+	github.com/sigstore/sigstore-go v0.7.1 // indirect
+	github.com/sigstore/timestamp-authority v1.2.5 // indirect
+	github.com/sijms/go-ora/v2 v2.8.24 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.12.0 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/viper v1.20.1 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/theupdateframework/go-tuf v0.7.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/transparency-dev/merkle v0.0.2 // indirect
+	github.com/vulcand/predicate v1.2.0 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
+	github.com/zitadel/logging v0.6.2 // indirect
+	github.com/zitadel/oidc/v3 v3.43.0 // indirect
+	github.com/zitadel/schema v1.3.1 // indirect
+	gitlab.com/gitlab-org/api/client-go v0.127.0 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/api v0.248.0 // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/api v0.33.3 // indirect
+	k8s.io/client-go v0.33.3 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	mvdan.cc/sh/v3 v3.7.0 // indirect
+	sigs.k8s.io/controller-runtime v0.20.4 // indirect
 )
 
 replace github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
+
+replace github.com/gravitational/teleport => ../..
+
+replace github.com/gravitational/teleport/api => ../../api
+
+replace github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
diff --git a/build.assets/tooling/go.sum b/build.assets/tooling/go.sum
index 300c74177a2b3..14691330be42b 100644
--- a/build.assets/tooling/go.sum
+++ b/build.assets/tooling/go.sum
@@ -1,59 +1,569 @@
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.3-20250121211742-6d880cc6cc8d.1 h1:1v+ez1GRKKKdI1IwDDQqV98lGKo8489+Ekql+prUW6c=
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.3-20250121211742-6d880cc6cc8d.1/go.mod h1:MYDFm9IHRP085R5Bis68mLc0mIqp5Q27Uk4o8YXjkAI=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1 h1:31on4W/yPcV4nZHL4+UCiCvLPsMqe/vJcNg8Rci0scc=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1/go.mod h1:fUl8CEN/6ZAMk6bP8ahBJPUJw7rbp+j4x+wCcYi2IG4=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.3-20241007202033-cf42259fcbfc.1 h1:NOipq02MS20WQCr6rfAG1o0n2AuQnY4Xg9avLl16csA=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.3-20241007202033-cf42259fcbfc.1/go.mod h1:jceo5esD5zSbflHHGad57RXzBpRrcPaiLrLQRA+Mbec=
+buf.build/go/bufplugin v0.9.0 h1:ktZJNP3If7ldcWVqh46XKeiYJVPxHQxCfjzVQDzZ/lo=
+buf.build/go/bufplugin v0.9.0/go.mod h1:Z0CxA3sKQ6EPz/Os4kJJneeRO6CjPeidtP1ABh5jPPY=
+buf.build/go/protovalidate v0.14.0 h1:kr/rC/no+DtRyYX+8KXLDxNnI1rINz0imk5K44ZpZ3A=
+buf.build/go/protovalidate v0.14.0/go.mod h1:+F/oISho9MO7gJQNYC2VWLzcO1fTPmaTA08SDYJZncA=
+buf.build/go/spdx v0.2.0 h1:IItqM0/cMxvFJJumcBuP8NrsIzMs/UYjp/6WSpq8LTw=
+buf.build/go/spdx v0.2.0/go.mod h1:bXdwQFem9Si3nsbNy8aJKGPoaPi5DKwdeEp5/ArZ6w8=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go/alloydb v1.16.1 h1:pW4D0O2jAfAjoOEI1bgChPwMHWE8X8BjwSO0tfWkWvk=
+cloud.google.com/go/alloydb v1.16.1/go.mod h1:zeZuGJ5mEaQE70FMXEvZIp5hQLR9yrGnHo1YUOncWRY=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute v1.38.0 h1:MilCLYQW2m7Dku8hRIIKo4r0oKastlD74sSu16riYKs=
+cloud.google.com/go/compute v1.38.0/go.mod h1:oAFNIuXOmXbK/ssXm3z4nZB8ckPdjltJ7xhHCdbWFZM=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
+cloud.google.com/go/container v1.43.0 h1:A6J92FJPfxTvyX7MHF+w4t2W9WCqvHOi9UB5SAeSy3w=
+cloud.google.com/go/container v1.43.0/go.mod h1:ETU9WZ1KM9ikEKLzrhRVao7KHtalDQu6aPqM34zDr/U=
+cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
+cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
+cloud.google.com/go/kms v1.22.0 h1:dBRIj7+GDeeEvatJeTB19oYZNV0aj6wEqSIT/7gLqtk=
+cloud.google.com/go/kms v1.22.0/go.mod h1:U7mf8Sva5jpOb4bxYZdtw/9zsbIjrklYwPcvMk34AL8=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
+cloud.google.com/go/resourcemanager v1.10.6 h1:LIa8kKE8HF71zm976oHMqpWFiaDHVw/H1YMO71lrGmo=
+cloud.google.com/go/resourcemanager v1.10.6/go.mod h1:VqMoDQ03W4yZmxzLPrB+RuAoVkHDS5tFUUQUhOtnRTg=
+connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
+connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
+filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
+github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 h1:Hr5FTipp7SL07o2FvoVOX9HRiRH3CR3Mj8pxqCcdD5A=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2/go.mod h1:QyVsSSN64v5TGltphKLQ2sQxe4OBQg0J1eKRcVBnfgE=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 h1:MhRfI58HblXzCtWEZCO0feHs8LweePB3s90r7WaR1KU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0/go.mod h1:okZ+ZURbArNdlJ+ptXoyHNuOETzOl1Oww19rm8I2WLA=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 h1:Hp+EScFOu9HeCbeW8WU2yQPJd4gGwhMgKxWe+G6jNzw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0/go.mod h1:/pz8dyNQe+Ey3yBp/XuYz7oqX8YDNWVpPB0hH3XWfbc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 h1:z7Mqz6l0EFH549GvHEqfjKvi+cRScxLWbaoeLm9wxVQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0/go.mod h1:v6gbfH+7DG7xH2kUNs+ZJ9tF6O3iNnR85wMtmr+F54o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0 h1:xkWEcbsnJWid3rOf/S/LOHy1I55JA+4kw/f8Tnm+Onc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0/go.mod h1:OWKfCmX4X3Vp2w7GSx1LZn8566tOHJBA6K0IAUVNYx0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0 h1:z4YeiSXxnUI+PqB46Yj6MZA3nwb1CcJIkEMDrzUd8Cs=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0/go.mod h1:rko9SzMxcMk0NJsNAxALEGaTYyy79bNRwxgJfrH0Spw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql v1.2.0 h1:dhywcZH9yPDIje9aTqwy6psZSPzI6CJLYEprDahIBSQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql v1.2.0/go.mod h1:6z3b+JdBLH0eMzfBex/cvEIoEFVEwXuB0wbgdfN11iM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.2.0 h1:3jDMffAwnvs6qmOqhjNVHB29AKxs6brnzJeo65E1YwM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.2.0/go.mod h1:0mKVz3WT8oNjBunT1zD/HPwMleQ72QClMa7Gmsm+6Kc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.2.0 h1:0hXKrsbh2M6CQyW0TDC9Bsyd99vQmrOxiBTUfQHZjPA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.2.0/go.mod h1:bvZZor36Jg9q9kouuMyfJ+ay77+qK+YUfThXH1FdXjU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0 h1:HzqcSJWx32XQdr8KtxAu/SZJj0PqDo9tKf2YGPdynV0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0/go.mod h1:nKcJObAisSPDrO9lMuuCBoYY7Ki7ADt8p6XmBhpKNTk=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v3 v3.3.0 h1:EkL5dmUoy1OlzVfsbkcHayOvOJgheyRYL3wM/RHizzg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v3 v3.3.0/go.mod h1:DiazWkJHUUKUZGpIdV7JhDTjebBxdfsJ386dE5w7G3o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0 h1:hTmVmyvriwO+ymGLEsH7HZokVwinC2MZl8F0LjvPdHU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0/go.mod h1:uHEpZj4TWSZEp35rIByJ8RX7hQBm3bxfPxS4tiz+x+g=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 h1:S087deZ0kP1RUg4pU7w9U9xpUedTCbOtz+mnd0+hrkQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0/go.mod h1:B4cEyXrWBmbfMDAPnpJ1di7MAt5DKP57jPEObAvZChg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
 github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
+github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
+github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
+github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
+github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/awalterschulze/goderive v0.5.1 h1:H2XNRDw0Ordwj/pgLAVqQgDC1LQWP7L99ofOs72bjqg=
 github.com/awalterschulze/goderive v0.5.1/go.mod h1:DLlff0SRVo846CBrp8nXuXJ4mdWA92ai5CYTr+LV/II=
-github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
-github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk=
+github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 h1:S61/E3N01oral6B3y9hZ2E1iFDqCZPPOBoBQretCnBI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75/go.mod h1:bDMQbkI1vJbNjnvJYpPTSNYBkI/VIv18ngWb/K84tkk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 h1:QWhxjrA0r+FQnDAATdGqLXUvYW0MdUIvCBK89BN3OfU=
+github.com/aws/aws-sdk-go-v2/service/athena v1.50.4/go.mod h1:xsG8Y2fMenmHTdukyknTUO1uQhEZ/entaNHvPmD1klE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 h1:xdYdX+JpIFByMG8JQe9iWM9CqepyjhenukxTVQnuCbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0/go.mod h1:c1Ik+59wgLIJFhsSY8cAnw6QooiogpTZKP0rtkVcpCQ=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0 h1:9nUhN6dRT2chbA7E9y3JDGpIV1C7cZpfiRvX63EB5XA=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 h1:se3+XU16LNr8JoHdJBrBNJKvn1dnJcnW3qRlo5g2vKI=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2/go.mod h1:OCIzmvYHkq7q6zRwmTyBjWSsE4EfLRtbEoAEgY+iFD4=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.56.2 h1:oYHra2ttm7jOSY/wfuTeEnH164O6Eo3AuygreQKa+Gg=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.56.2/go.mod h1:wAtdeFanDuF9Re/ge4DRDaYe3Wy1OGrU7jG042UcuI4=
+github.com/aws/aws-sdk-go-v2/service/eks v1.64.0 h1:EYeOThTRysemFtC6J6h6b7dNg3jN03QuO5cg92ojIQE=
+github.com/aws/aws-sdk-go-v2/service/eks v1.64.0/go.mod h1:v1xXy6ea0PHtWkjFUvAUh6B/5wv7UF909Nru0dOIJDk=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.46.0 h1:UficfhqlA7k0zQ/x9pNKmyIIeHfvJUfdbzOQJKGJkt8=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.46.0/go.mod h1:477YEP4FkrM0oUcw+w4vk4+XTB7WacLzPGPFj69kwkg=
+github.com/aws/aws-sdk-go-v2/service/glue v1.109.2 h1:cp6rvdJiV36VupuDMvrdnILZXctf6BANWzKtv4nA4xQ=
+github.com/aws/aws-sdk-go-v2/service/glue v1.109.2/go.mod h1:6FqWCqW0Py6VOvY42NQyf9e7N+sNVnDEiHFklCCCoQc=
+github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk5gF/nn+MekPD0ZY=
+github.com/aws/aws-sdk-go-v2/service/iam v1.41.1/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 h1:hWqvzMaaiHhwndQhy1rF/qoHidaa4KzevkiDaMvjk3Q=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2/go.mod h1:7nGvrQXBNp7k5yYpwpmxGucYTPY39d0cxjmANAeWwYE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 h1:4nm2G6A4pV9rdlWzGMPv4BNtQp22v1hg3yrtkYpeLl8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 h1:Z95XCqqSnwXr0AY7PgsiOUBhUG2GoDM5getw6RfD1Lg=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0/go.mod h1:DqcSngL7jJeU1fOzh5Ll5rSvX/MlMV6OZlE4mVdFAQc=
+github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 h1:ggjjmfNX+nlv+nWHXOLr1pl36buP25Y9GZBEPMSofGw=
+github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0/go.mod h1:pfuDC5zBwunXdE44WT1PRbtzuXWGohKFcFLtv+ezI6k=
+github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 h1:vWClqL1dTCuPtWkaGDW7Y6P9ocqHtfFrjlkWYARm1qI=
+github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3/go.mod h1:51rUy2+lDiOQVlekScV044he709HMMhCdUDHqSBojgg=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 h1:rAUHsUFmux71j/4wQ5nUHsXyJxSMRgMlDnmFfahDhSk=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3/go.mod h1:iYC/SPpI4WveHr4ZzPFWTmXRODyJub5Aif75W7Ll+yM=
+github.com/aws/aws-sdk-go-v2/service/rds v1.95.0 h1:7KmQEDuz6XWafMaeIahplfGSEakzX4RMSrNHyvhkEq8=
+github.com/aws/aws-sdk-go-v2/service/rds v1.95.0/go.mod h1:CXiHj5rVyQ5Q3zNSoYzwaJfWm8IGDweyyCGfO8ei5fQ=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 h1:LNOKEsPjtoBrV2WYUb2zPLOOtD5sKt907LZ/h0cYHSk=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3/go.mod h1:TC8pNvjiikrjpX2MEzX/cEJ4/T4XIoSY4BskVvHj8bk=
+github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 h1:+nldYGx2Kdn7jzntjm2fG7sRonfQ08l1RqkLSTed8G8=
+github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1/go.mod h1:gpRsJN3qxZbsj1NhAoCNX02zJ4RZUB5v/7o4QrnGTcA=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 h1:QqXnA7s6sxFe6B6dkocEfZ9ap1bAmEXp4W32n9n+cmU=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4/go.mod h1:cgPfPTC/V3JqwCKed7Q6d0FrgarV7ltz4Bz6S4Q+Dqk=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 h1:0LBxtAX2bHcfPr6VSzQSvJlR1nzlna7xp031gEjbWGU=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2/go.mod h1:NW+LcIadUUlDgM3gb8+97lr6zSKExHR58NRRWSWkXl8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 h1:BRXS0U76Z8wfF+bnkilA2QwpIch6URlm++yPUt9QPmQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3/go.mod h1:bNXKFFyaiVvWuR6O16h/I1724+aXe/tAkA9/QS01t5k=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 h1:EKXYJ8kgz4fiqef8xApu7eH0eae2SrVG+oHCLFybMRI=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4/go.mod h1:yGhDiLKguA3iFJYxbrQkQiNzuy+ddxesSZYWVeeEH5Q=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 h1:ihddI5wufQQCJiujUgAvWRqZcfDmSKIfXlAuX7T95cg=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4/go.mod h1:PJtxxMdj747j8DeZENRTTYAz/lx/pADn/U0k7YNNiUY=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 h1:KNgVWw8qbPzjYnIF1gL0EAszy6VKGnmUK6VSm1huYY8=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 h1:KWArCwA/WkuHWKfygkNz0B6YS6OvdgoJUaJHX0Qby1s=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
+github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 h1:j3YvW9+qUFIzshXoPclOEUOSlXgr9vCU6OsB/CVRKGM=
+github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2/go.mod h1:znVkl7Y14sZKEL/sbRQ6qgD8wj8VdTcVVQp5iRaKXcc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
+github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
+github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 h1:Gx4ipHtKfaABSHAVo4Zjo2E4ClKzYqZ2NrPO0gy6qvY=
+github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4/go.mod h1:nnwXv9COKyqd4q7jpPrxRaW9L+Qfwb4aGTdZqsIpOho=
+github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
+github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
+github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
+github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo=
+github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
+github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
+github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
+github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 h1:2Dx4IHfC1yHWI12AxQDJM1QbRCDfk6M+blLzlZCXdrc=
+github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/di-wu/parser v0.2.2/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX7nYo=
+github.com/di-wu/parser v0.3.0 h1:NMOvy5ifswgt4gsdhySVcKOQtvjC43cHZIfViWctqQY=
+github.com/di-wu/parser v0.3.0/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX7nYo=
+github.com/di-wu/xsd-datetime v1.0.0 h1:vZoGNkbzpBNoc+JyfVLEbutNDNydYV8XwHeV7eUJoxI=
+github.com/di-wu/xsd-datetime v1.0.0/go.mod h1:i3iEhrP3WchwseOBeIdW/zxeoleXTOzx1WyDXgdmOww=
+github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry/P5s8R4dYuLkhB9Nhso8ogFWNr4IQ=
+github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8/go.mod h1:JkjcmqbLW+khwt2fmBPJFBhx2zGZ8XobRZ+O0VhlwWo=
+github.com/emicklei/go-restful/v3 v3.11.3 h1:yagOQz/38xJmcNeZJtrUcKjkHRltIaIFXKWeG1SkWGE=
+github.com/emicklei/go-restful/v3 v3.11.3/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
+github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
+github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
+github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
+github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
+github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
+github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
+github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
+github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
+github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
+github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.11.2 h1:Fgx0/wlmkClTKlnOsdOQ+K5HcHDsDcYIvtYmfhEOSUc=
+github.com/go-webauthn/webauthn v0.11.2/go.mod h1:aOtudaF94pM71g3jRwTYYwQTG1KyTILTcZqN1srkmD0=
+github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
+github.com/go-webauthn/x v0.1.20/go.mod h1:n/gAc8ssZJGATM0qThE+W+vfgXiMedsWi3wf/C4lld0=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
+github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
+github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
+github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
+github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
+github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/cel-go v0.25.0 h1:jsFw9Fhn+3y2kBbltZR4VEz5xKkcIFRPDnuEzAGv5GY=
+github.com/google/cel-go v0.25.0/go.mod h1:hjEb6r5SuOSlhCHmFoLzu8HGCERvIsDAbxDAyNU/MmI=
+github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
+github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go=
+github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/go-attestation v0.5.1 h1:jqtOrLk5MNdliTKjPbIPrAaRKJaKW+0LIU2n/brJYms=
+github.com/google/go-attestation v0.5.1/go.mod h1:KqGatdUhg5kPFkokyzSBDxwSCFyRgIgtRkMp6c3lOBQ=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
+github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
 github.com/google/go-github/v41 v41.0.0 h1:HseJrM2JFf2vfiZJ8anY2hqBjdfY1Vlj/K27ueww4gg=
 github.com/google/go-github/v41 v41.0.0/go.mod h1:XgmCA5H323A9rtgExdTcnDkcqp6S30AVACCBDOonIxg=
+github.com/google/go-github/v70 v70.0.0 h1:/tqCp5KPrcvqCc7vIvYyFYTiCGrYvaWoYMGHSQbo55o=
+github.com/google/go-github/v70 v70.0.0/go.mod h1:xBUZgo8MI3lUL/hwxl3hlceJW1U8MVnXP3zUyI+rhQY=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-sev-guest v0.12.1 h1:H4rFYnPIn8HtqEsNTmh56Zxcf9BI9n48ZSYCnpYLYvc=
+github.com/google/go-sev-guest v0.12.1/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760=
+github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843 h1:+MoPobRN9HrDhGyn6HnF5NYo4uMBKaiFqAtf/D/OB4A=
+github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843/go.mod h1:g/n8sKITIT9xRivBUbizo34DTsUm2nN2uU3A662h09g=
+github.com/google/go-tpm v0.9.4 h1:awZRf9FwOeTunQmHoDYSHJps3ie6f1UlhS1fOdPEt1I=
+github.com/google/go-tpm v0.9.4/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.4.5 h1:3fhthtyMDbIZFR5/0y1hvUoZ1Kf4i1eZ7C73R4Pvd+k=
+github.com/google/go-tpm-tools v0.4.5/go.mod h1:ktjTNq8yZFD6TzdBFefUfen96rF3NpYwpSb2d8bc+Y8=
+github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
+github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
+github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e h1:FJta/0WsADCe1r9vQjdHbd3KuiLPu7Y9WlyLGwMUNyE=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
+github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
+github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f h1:o2yGZLlsOj5H5uvtQNEdi6DeA0GbUP3lm0gWW5RvY0s=
+github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f/go.mod h1:H3K1Iu/utuCfa10JO+GsmKUYSWi7ug57Rk6GaDRHaaQ=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
+github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
+github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js=
+github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
+github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
+github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFER/+0TfRypJhc9XeuggTtEZzhhe75DSVqMv/avHEU=
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
+github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
+github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
+github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
+github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
 github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
 github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 h1:KcFzXwzM/kGhIRHvc8jdixfIJjVzuUJdnv+5xsPutog=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1/go.mod h1:qOchhhIlmRcqk/O9uCo/puJlyo07YINaIqdZfZG3Jkc=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
+github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
+github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
+github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 h1:AgcIVYPa6XJnU3phs104wLj8l5GEththEw6+F79YsIY=
+github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
+github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/in-toto/attestation v1.1.1 h1:QD3d+oATQ0dFsWoNh5oT0udQ3tUrOsZZ0Fc3tSgWbzI=
+github.com/in-toto/attestation v1.1.1/go.mod h1:Dcq1zVwA2V7Qin8I7rgOi+i837wEf/mOZwRm047Sjys=
+github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
+github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438 h1:Dj0L5fhJ9F82ZJyVOmBx6msDp/kfd1t9GRfny/mfJA0=
+github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
+github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
+github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
+github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
+github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
+github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA=
+github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
+github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
+github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
+github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
+github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 h1:10nfvqVK4/KINnLT8bDICrRnfguTJ300dNGpW8D2bQo=
+github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27/go.mod h1:P0V19qHwJNY0htZwZDe9Ilvs/nokGhdFX7faKFyZ6+U=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -61,116 +571,464 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
+github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
+github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
+github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
+github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY=
+github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/ohler55/ojg v1.26.8 h1:njM65m+ej8sLHiFZIhJK9UkwOmDPsUikjGbTgcwu8CU=
+github.com/ohler55/ojg v1.26.8/go.mod h1:/Y5dGWkekv9ocnUixuETqiL58f+5pAsUfg5P8e7Pa2o=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/okta/okta-sdk-golang/v2 v2.20.0 h1:EDKM+uOPfihOMNwgHMdno+NAsIfyXkVnoFAYVPay0YU=
+github.com/okta/okta-sdk-golang/v2 v2.20.0/go.mod h1:FMy5hN5G8Rd/VoS0XrfyPPhIfOVo78ZK7lvwiQRS2+U=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/openai/openai-go v1.8.2 h1:UqSkJ1vCOPUpz9Ka5tS0324EJFEuOvMc+lA/EarJWP8=
+github.com/openai/openai-go v1.8.2/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+github.com/oracle/oci-go-sdk/v65 v65.89.3 h1:KSUykb5Ou54jF4SeJNjBwcDg+umbAwcvT+xhrvNDog0=
+github.com/oracle/oci-go-sdk/v65 v65.89.3/go.mod h1:u6XRPsw9tPziBh76K7GrrRXPa8P8W3BQeqJ6ZZt9VLA=
+github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible h1:IWzUvJ72xMjmrjR9q3H1PF+jwdN0uNQiR2t1BLNalyo=
+github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkoukk/tiktoken-go v0.1.8 h1:85ENo+3FpWgAACBaEUVp+lctuTcYUO7BtmfhlN/QTRo=
+github.com/pkoukk/tiktoken-go v0.1.8/go.mod h1:9NiV+i9mJKGj1rYOT+njbv+ZwA/zJxYdewGl6qVatpg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
+github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2Ns0o=
+github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
+github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
+github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
+github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
+github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
+github.com/scim2/filter-parser/v2 v2.2.0 h1:QGadEcsmypxg8gYChRSM2j1edLyE/2j72j+hdmI4BJM=
+github.com/scim2/filter-parser/v2 v2.2.0/go.mod h1:jWnkDToqX/Y0ugz0P5VvpVEUKcWcyHHj+X+je9ce5JA=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
+github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/rekor v1.4.1 h1:KK3McuHnptIE9mdNlrc9qh/OVE0AXf4rnScMxJE6xH4=
+github.com/sigstore/rekor v1.4.1/go.mod h1:/McBsz/vrtfi4EInxSIk/MGbDXzgv2+1FQUg1R/uSnE=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
+github.com/sigstore/sigstore-go v0.7.1 h1:lyzi3AjO6+BHc5zCf9fniycqPYOt3RaC08M/FRmQhVY=
+github.com/sigstore/sigstore-go v0.7.1/go.mod h1:AIRj4I3LC82qd07VFm3T2zXYiddxeBV1k/eoS8nTz0E=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5 h1:qp2VFyKuFQvTGmZwk5Q7m5nE4NwnF9tHwkyz0gtWAck=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5/go.mod h1:DKlQjjr+GsWljEYPycI0Sf8URLCk4EbGA9qYjF47j4g=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5 h1:CRZcdYn5AOptStsLRAAACudAVmb1qUbhMlzrvm7ju3o=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5/go.mod h1:b9rFfITq2fp1M3oJmq6lFFhSrAz5vOEJH1qzbMsZWN4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3 h1:a7Yz8C0aBa/LjeiTa9ZLYi9B74GNhFRnUIUdvN6ddVk=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3/go.mod h1:tRtJzSZ48MXJV9bmS8pkb3mP36PCad/Cs+BmVJ3Z4O4=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5 h1:S2ukEfN1orLKw2wEQIUHDDlzk0YcylhcheeZ5TGk8LI=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5/go.mod h1:m7sQxVJmDa+rsmS1m6biQxaLX83pzNS7ThUEyjOqkCU=
+github.com/sigstore/timestamp-authority v1.2.5 h1:W22JmwRv1Salr/NFFuP7iJuhytcZszQjldoB8GiEdnw=
+github.com/sigstore/timestamp-authority v1.2.5/go.mod h1:gWPKWq4HMWgPCETre0AakgBzcr9DRqHrsgbrRqsigOs=
+github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
+github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
+github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
+github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
+github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
+github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
+github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
+github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
+github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
+github.com/theupdateframework/go-tuf/v2 v2.0.2 h1:PyNnjV9BJNzN1ZE6BcWK+5JbF+if370jjzO84SS+Ebo=
+github.com/theupdateframework/go-tuf/v2 v2.0.2/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw=
+github.com/tink-crypto/tink-go/v2 v2.4.0 h1:8VPZeZI4EeZ8P/vB6SIkhlStrJfivTJn+cQ4dtyHNh0=
+github.com/tink-crypto/tink-go/v2 v2.4.0/go.mod h1:l//evrF2Y3MjdbpNDNGnKgCpo5zSmvUvnQ4MU+yE2sw=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
+github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
+github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
 github.com/waigani/diffparser v0.0.0-20190828052634-7391f219313d h1:xQcF7b7cZLWZG/+7A4G7un1qmEDYHIvId9qxRS1mZMs=
 github.com/waigani/diffparser v0.0.0-20190828052634-7391f219313d/go.mod h1:BzSc3WEF8R+lCaP5iGFRxd5kIXy4JKOZAwNe1w0cdc0=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
+github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
+github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
+github.com/zitadel/logging v0.6.2 h1:MW2kDDR0ieQynPZ0KIZPrh9ote2WkxfBif5QoARDQcU=
+github.com/zitadel/logging v0.6.2/go.mod h1:z6VWLWUkJpnNVDSLzrPSQSQyttysKZ6bCRongw0ROK4=
+github.com/zitadel/oidc/v3 v3.43.0 h1:LokviPoiTNNPbIAMO/eb6Kq9PNWPWp0mA1oWtdLc+Qs=
+github.com/zitadel/oidc/v3 v3.43.0/go.mod h1:5ki8s9CWoB4iGmtULndiVxwM8xt7IylZIaudro7jEq4=
+github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
+github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
+gitlab.com/gitlab-org/api/client-go v0.127.0 h1:8xnxcNKGF2gDazEoMs+hOZfOspSSw8D0vAoWhQk9U+U=
+gitlab.com/gitlab-org/api/client-go v0.127.0/go.mod h1:bYC6fPORKSmtuPRyD9Z2rtbAjE7UeNatu2VWHRf4/LE=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.step.sm/crypto v0.70.0 h1:Q9Ft7N637mucyZcHZd1+0VVQJVwDCKqcb9CYcYi7cds=
+go.step.sm/crypto v0.70.0/go.mod h1:pzfUhS5/ue7ev64PLlEgXvhx1opwbhFCjkvlhsxVds0=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
-helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
+helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
-k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
+k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
+k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
+k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
+k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg=
+mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+pluginrpc.com/pluginrpc v0.5.0 h1:tOQj2D35hOmvHyPu8e7ohW2/QvAnEtKscy2IJYWQ2yo=
+pluginrpc.com/pluginrpc v0.5.0/go.mod h1:UNWZ941hcVAoOZUn8YZsMmOZBzbUjQa3XMns8RQLp9o=
+sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
+sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
 sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
 sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
+sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
+sigs.k8s.io/kustomize/kyaml v0.19.0 h1:RFge5qsO1uHhwJsu3ipV7RNolC7Uozc0jUBC/61XSlA=
+sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/rf9NNu1cwY=
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
+software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
+software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/build.assets/versions.mk b/build.assets/versions.mk
index f5a118bc18d5d..704b9b393a366 100644
--- a/build.assets/versions.mk
+++ b/build.assets/versions.mk
@@ -3,22 +3,22 @@
 # Keep versions in sync with devbox.json, when applicable.
 
 # Sync with devbox.json.
-GOLANG_VERSION ?= go1.24.3
+GOLANG_VERSION ?= go1.24.11
 GOLANGCI_LINT_VERSION ?= v2.1.5
 
 # NOTE: Remember to update engines.node in package.json to match the major version.
-NODE_VERSION ?= 22.14.0
+NODE_VERSION ?= 22.21.0
 
 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
-WASM_PACK_VERSION ?= 0.12.1
+WASM_OPT_VERSION ?= 0.116.1
 LIBBPF_VERSION ?= 1.2.2
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 
 DEVTOOLSET ?= devtoolset-12
 
 # Protogen related versions.
-BUF_VERSION ?= v1.50.1
+BUF_VERSION ?= v1.56.0
 # Keep in sync with api/proto/buf.yaml (and buf.lock).
 GOGO_PROTO_TAG ?= v1.3.2
 NODE_GRPC_TOOLS_VERSION ?= 1.12.4
diff --git a/build.assets/windows/build.ps1 b/build.assets/windows/build.ps1
index db5ad6a23a5c5..30efd34ab5a5b 100644
--- a/build.assets/windows/build.ps1
+++ b/build.assets/windows/build.ps1
@@ -164,23 +164,15 @@ function Enable-Node {
     }
 }
 
-function Install-WasmPack {
+function Install-WasmDeps {
     <#
     .SYNOPSIS
-        Builds and installs wasm-pack and dependent tooling.
+        Builds and installs wasm-bindgen-cli, wasm-opt, and wasm32-unknown-unknown toolchain.
     #>
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]
-        [string] $WasmPackVersion
-    )
-    begin {
-        Write-Host "::group::Installing wasm-pack $WasmPackVersion"
-        # TODO(camscale): Don't hard-code wasm-binden-cli version
-        cargo install wasm-bindgen-cli --locked --version 0.2.99
-        cargo install wasm-pack --locked --version "$WasmPackVersion"
-        Write-Host "::endgroup::"
-    }
+    
+    Write-Host "::group::Installing wasm-bindgen-cli, wasm-opt, and wasm32-unknown-unknown toolchain"
+    make -C "$TeleportSourceDirectory" ensure-wasm-deps
+    Write-Host "::endgroup::"
 }
 
 function Install-Wintun {
@@ -349,8 +341,7 @@ function Install-BuildRequirements {
         $GoVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-go-version).TrimStart("go")
         Install-Go -GoVersion "$GoVersion" -ToolchainDir "$InstallDirectory"
 
-        $WasmPackVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-wasm-pack-version).Trim()
-        Install-WasmPack -WasmPackVersion "$WasmPackVersion"
+        Install-WasmDeps
     }
     Write-Host $("All build requirements installed in {0:g}" -f $CommandDuration)
 }
diff --git a/constants.go b/constants.go
index 4ddbea83d3002..c52e95ad3df36 100644
--- a/constants.go
+++ b/constants.go
@@ -120,6 +120,9 @@ const (
 	// ComponentProxy is SSH proxy (SSH server forwarding connections)
 	ComponentProxy = "proxy"
 
+	// ComponentRelay is the component name for the relay service.
+	ComponentRelay = "relay"
+
 	// ComponentProxyPeer is the proxy peering component of the proxy service
 	ComponentProxyPeer = "proxy:peer"
 
@@ -298,6 +301,12 @@ const (
 	// ComponentForwardingGit represents the SSH proxy that forwards Git commands.
 	ComponentForwardingGit = "git:forward"
 
+	// ComponentMCP represents the MCP server handler.
+	ComponentMCP = "mcp"
+
+	// ComponentRecordingEncryption represents recording encryption
+	ComponentRecordingEncryption = "recording-encryption"
+
 	// VerboseLogsEnvVar forces all logs to be verbose (down to DEBUG level)
 	VerboseLogsEnvVar = "TELEPORT_DEBUG"
 
@@ -455,6 +464,14 @@ const (
 )
 
 const (
+	// CertExtensionScopePin is used to pin a user certificate to a specific scope and
+	// set of scoped roles. This constrains a user's access to resources based on both
+	// the scoping rules and scoped roles defined.
+	CertExtensionScopePin = "scope-pin@goteleport.com"
+	// CertExtensionAgentScope is used to pin an agent/host certificate to a specific scope.
+	// This constrains other identities' access to the agent itself as well as the agent's
+	// access to other resources based on scoping rules.
+	CertExtensionAgentScope = "agent-scope@goteleport.com"
 	// CertExtensionPermitX11Forwarding allows X11 forwarding for certificate
 	CertExtensionPermitX11Forwarding = "permit-X11-forwarding"
 	// CertExtensionPermitAgentForwarding allows agent forwarding for certificate
@@ -520,6 +537,9 @@ const (
 	// Machine ID bot instance, if any. This identifier is persisted through
 	// certificate renewals.
 	CertExtensionBotInstanceID = "bot-instance-id@goteleport.com"
+	// CertExtensionJoinToken is the name of the join token used to join this
+	// bot, if any.
+	CertExtensionJoinToken = "join-token@goteleport.com"
 
 	// CertCriticalOptionSourceAddress is a critical option that defines IP addresses (in CIDR notation)
 	// from which this certificate is accepted for authentication.
@@ -585,6 +605,10 @@ const MaxHTTPRequestSize = 10 * 1024 * 1024
 // to prevent resource exhaustion attacks.
 const MaxHTTPResponseSize = 10 * 1024 * 1024
 
+// MaxUsernameLength is the maximum allowed length (characters) for usernames.
+// This limit prevents sending extremely long usernames that could clog up logs or exhaust resources.
+const MaxUsernameLength = 1000
+
 const (
 	// CertificateFormatOldSSH is used to make Teleport interoperate with older
 	// versions of OpenSSH.
@@ -654,6 +678,10 @@ const (
 	// TraitInternalGitHubOrgs is the variable used to store allowed GitHub
 	// organizations for GitHub integrations.
 	TraitInternalGitHubOrgs = "{{internal.github_orgs}}"
+
+	// TraitInternalMCPTools is the variable used to store allowed MCP tools for
+	// MCP servers.
+	TraitInternalMCPTools = "{{internal.mcp_tools}}"
 )
 
 // SCP is Secure Copy.
@@ -735,14 +763,35 @@ const (
 	// credentials using any workload_identity resource. This exists to simplify
 	// Day 0 UX experience with workload identity.
 	PresetWildcardWorkloadIdentityIssuerRoleName = "wildcard-workload-identity-issuer"
+
+	// PresetAccessPluginRoleName is a name of a preset role that includes
+	// permissions required by self-hosted access request plugin.
+	PresetAccessPluginRoleName = "access-plugin"
+
+	// PresetListAccessRequestResourcesRoleName is a name of a preset role that
+	// includes permissions to read access request resources.
+	PresetListAccessRequestResourcesRoleName = "list-access-request-resources"
+
+	// PresetMCPUserRoleName is a name of a preset role that allows
+	// accessing MCP servers.
+	PresetMCPUserRoleName = "mcp-user"
 )
 
 var PresetRoles = []string{PresetEditorRoleName, PresetAccessRoleName, PresetAuditorRoleName}
 
 const (
-	// PresetDefaultHealthCheckConfigName is the name of a preset
-	// default health_check_config that enables health checks for all resources.
-	PresetDefaultHealthCheckConfigName = "default"
+	// VirtualDefaultHealthCheckConfigDBName is the name of a virtual
+	// health_check_config that enables health checks for all database
+	// resources. For historical reasons, it's value is "default" even
+	// though it applies to databases only.
+	VirtualDefaultHealthCheckConfigDBName = "default"
+	// VirtualDefaultHealthCheckConfigKubeName is the name of a virtual
+	// health_check_config that enables health checks for all Kubernetes
+	// resources.
+	VirtualDefaultHealthCheckConfigKubeName = "default-kube"
+	// VirtualDefaultHealthCheckConfigCount is the number of virtual
+	// health_check_config resources.
+	VirtualDefaultHealthCheckConfigCount = 2
 )
 
 const (
@@ -782,9 +831,22 @@ const (
 	CurrentSessionIDRequest = "current-session-id@goteleport.com"
 
 	// SessionIDQueryRequest is sent by clients to ask servers if they
-	// will generate their own session ID when a new session is created.
+	// will generate and share their own session ID when a new session
+	// is started (session and exec/shell channels accepted).
+	//
+	// TODO(Joerger): DELETE IN v20.0.0
+	// All v17+ servers set the session ID. v19+ clients stop checking.
 	SessionIDQueryRequest = "session-id-query@goteleport.com"
 
+	// SessionIDQueryRequestV2 is sent by clients to ask servers if they
+	// will generate and share their own session ID when a new session
+	// channel is accepted, rather than when the shell/exec channel is.
+	//
+	// TODO(Joerger): DELETE IN v21.0.0
+	// all v19+ servers set the session ID directly after accepting the session channel.
+	// clients should stop checking in v21, and servers should stop responding to the query in v22.
+	SessionIDQueryRequestV2 = "session-id-query-v2@goteleport.com"
+
 	// ForceTerminateRequest is an SSH request to forcefully terminate a session.
 	ForceTerminateRequest = "x-teleport-force-terminate"
 
diff --git a/darwin-signing.mk b/darwin-signing.mk
index d4f6823114e97..201c7df2734b3 100644
--- a/darwin-signing.mk
+++ b/darwin-signing.mk
@@ -121,6 +121,11 @@ define notarize_teleport_pkg
 	$(call notarize_pkg,$(TELEPORT_PKG_UNSIGNED),$(TELEPORT_PKG_SIGNED))
 endef
 
+NOTARIZE_TELEPORT_TOOLS_PKG = $(if $(SHOULD_NOTARIZE),$(notarize_teleport_tools_pkg),$(not_notarizing_cmd))
+define notarize_teleport_tools_pkg
+	$(call notarize_pkg,$(TELEPORT_TOOLS_PKG_UNSIGNED),$(TELEPORT_TOOLS_PKG_SIGNED))
+endef
+
 define notarize_app_bundle
 	$(eval $@_BUNDLE = $(1))
 	$(eval $@_BUNDLE_ID = $(2))
diff --git a/devbox.json b/devbox.json
index 9e6cb5d6dbfb3..4576f87314496 100644
--- a/devbox.json
+++ b/devbox.json
@@ -14,7 +14,6 @@
     "yamllint@latest",
     "zlib@latest",
     "rustup@latest",
-    "wasm-pack@latest",
     "wasm-bindgen-cli@latest",
     "pkg-config@latest",
 
diff --git a/devbox.lock b/devbox.lock
index 42454fe15ef70..33c209f4fe5db 100644
--- a/devbox.lock
+++ b/devbox.lock
@@ -1458,54 +1458,6 @@
         }
       }
     },
-    "wasm-pack@latest": {
-      "last_modified": "2024-11-16T04:25:12Z",
-      "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#wasm-pack",
-      "source": "devbox-search",
-      "version": "0.13.1",
-      "systems": {
-        "aarch64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1"
-        },
-        "aarch64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1"
-        },
-        "x86_64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1"
-        },
-        "x86_64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1"
-        }
-      }
-    },
     "yamllint@latest": {
       "last_modified": "2024-11-16T04:25:12Z",
       "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#yamllint",
diff --git a/docs/.vale.ini b/docs/.vale.ini
index d117e2a7b349e..96fba68e771b9 100644
--- a/docs/.vale.ini
+++ b/docs/.vale.ini
@@ -5,5 +5,5 @@ MinAlertLevel = suggestion
 mdx = md
 
 [*.mdx]
-BasedOnStyles = messaging,examples,3rd-party-products,structure
+BasedOnStyles = messaging,examples,3rd-party-products
 CommentDelimiters = "{/*,*/}"
diff --git a/docs/config.json b/docs/config.json
index 74184915c54d1..80803ee0b06a4 100644
--- a/docs/config.json
+++ b/docs/config.json
@@ -6,7 +6,7 @@
       "nodeIP": "ip-172-31-35-170"
     },
     "access_graph": {
-      "version": "1.24.4"
+      "version": "1.29.5"
     },
     "ansible": {
       "min_version": "2.9.6"
@@ -17,8 +17,8 @@
       "aws_secret_access_key": "zyxw9876-this-is-an-example"
     },
     "cloud": {
-      "version": "17.4.10",
-      "major_version": "17",
+      "version": "18.2.8",
+      "major_version": "18",
       "sla": {
         "monthly_percentage": "99.9%",
         "monthly_downtime": "44 minutes"
@@ -51,7 +51,8 @@
     },
     "kubernetes": {
       "major_version": "1",
-      "minor_version": "17"
+      "minor_version": "17",
+      "health_check_min_version": "18.3.0"
     },
     "mongodb": {
       "min_version": "3.6"
@@ -65,19 +66,18 @@
       "ca_pin": "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
     },
     "teleport": {
-      "git": "api/14.0.0-gd1e081e",
-      "major_version": "17",
-      "version": "17.0.0-dev",
+      "major_version": "18",
+      "version": "18.6.1",
       "url": "teleport.example.com",
-      "golang": "1.22",
+      "golang": "1.24.11",
       "plugin": {
-        "version": "13.3.7"
+        "version": "18.6.1"
       },
       "helm_repo_url": "https://charts.releases.teleport.dev",
-      "latest_oss_docker_image": "public.ecr.aws/gravitational/teleport-distroless:13.3.7",
-      "latest_oss_debug_docker_image": "public.ecr.aws/gravitational/teleport-distroless-debug:13.3.7",
-      "latest_ent_docker_image": "public.ecr.aws/gravitational/teleport-ent-distroless:13.3.7",
-      "latest_ent_debug_docker_image": "public.ecr.aws/gravitational/teleport-ent-distroless-debug:13.3.7",
+      "latest_oss_docker_image": "public.ecr.aws/gravitational/teleport-distroless:18.6.1",
+      "latest_oss_debug_docker_image": "public.ecr.aws/gravitational/teleport-distroless-debug:18.6.1",
+      "latest_ent_docker_image": "public.ecr.aws/gravitational/teleport-ent-distroless:18.6.1",
+      "latest_ent_debug_docker_image": "public.ecr.aws/gravitational/teleport-ent-distroless-debug:18.6.1",
       "teleport_install_script_url": "https://cdn.teleport.dev/install.sh"
     },
     "terraform": {
@@ -97,97 +97,97 @@
   "redirects": [
     {
       "source": "/admin-guides/access-controls/guides/moderated-sessions/",
-      "destination": "/admin-guides/access-controls/guides/joining-sessions/",
+      "destination": "/zero-trust-access/authentication/joining-sessions/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_accesslists/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-accesslists/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-accesslists/",
       "permanent": true
     },
     {
       "source": "/admin-guides/deploy-a-cluster/deployments/ibm/",
-      "destination": "/admin-guides/deploy-a-cluster/helm-deployments/ibm/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/ibm/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_githubconnectors/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-githubconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-githubconnectors/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_loginrules/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-loginrules/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-loginrules/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_oidcconnectors/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-oidcconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oidcconnectors/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_oktaimportrules/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-oktaimportrules/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oktaimportrules/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_openssheiceserversv2/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-openssheiceserversv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-openssheiceserversv2/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_opensshserversv2/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-opensshserversv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-opensshserversv2/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_provisiontokens/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-provisiontokens/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_roles/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-roles/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_rolesv6/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-rolesv6/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_rolesv7/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-rolesv7/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_samlconnectors/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-samlconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-samlconnectors/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_users/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-users/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-users/",
       "permanent": true
     },
     {
       "source": "/access-controls/guides/role-templates/",
-      "destination": "/admin-guides/access-controls/guides/role-templates/",
+      "destination": "/zero-trust-access/rbac-get-started/role-templates/",
       "permanent": true
     },
     {
       "source": "/enterprise/sso/",
-      "destination": "/admin-guides/access-controls/sso/",
+      "destination": "/zero-trust-access/sso/",
       "permanent": true
     },
     {
       "source": "/access-controls/guides/headless/",
-      "destination": "/admin-guides/access-controls/guides/headless/",
+      "destination": "/zero-trust-access/authentication/headless/",
       "permanent": true
     },
     {
       "source": "/application-access/okta/hosted-guide/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/integrations/okta/",
       "permanent": true
     },
     {
@@ -202,7 +202,7 @@
     },
     {
       "source": "/enterprise/sso/google-workspace/",
-      "destination": "/admin-guides/access-controls/sso/google-workspace/",
+      "destination": "/zero-trust-access/sso/integrate-idp/google-workspace/",
       "permanent": true
     },
     {
@@ -210,49 +210,59 @@
       "destination": "/enroll-resources/kubernetes-access/",
       "permanent": true
     },
+    {
+      "source": "/kubernetes-ssh/",
+      "destination": "/enroll-resources/kubernetes-access/controls/",
+      "permanent": true
+    },
     {
       "source": "/machine-id/introduction/",
-      "destination": "/enroll-resources/machine-id/introduction/",
+      "destination": "/machine-workload-identity/introduction/",
       "permanent": true
     },
     {
       "source": "/machine-id/reference/telemetry/",
-      "destination": "/reference/machine-id/telemetry/",
+      "destination": "/reference/machine-workload-identity/telemetry/",
       "permanent": true
     },
     {
       "source": "/machine-id/reference/v16-upgrade-guide/",
-      "destination": "/reference/machine-id/v16-upgrade-guide/",
+      "destination": "/reference/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/getting-started/",
+      "destination": "/machine-workload-identity/getting-started/",
       "permanent": true
     },
     {
       "source": "/management/export-audit-events/fluentd/",
-      "destination": "/admin-guides/management/export-audit-events/fluentd/",
+      "destination": "/zero-trust-access/export-audit-events/fluentd/",
       "permanent": true
     },
     {
       "source": "/setup/admin/github-sso/",
-      "destination": "/admin-guides/access-controls/sso/github-sso/",
+      "destination": "/zero-trust-access/sso/integrate-idp/github-sso/",
       "permanent": true
     },
     {
       "source": "/access-controls/device-trust/guide/",
-      "destination": "/admin-guides/access-controls/device-trust/guide/",
+      "destination": "/identity-governance/device-trust/guide/",
       "permanent": true
     },
     {
-      "source": "/access-controls/access-request-plugins/",
-      "destination": "/admin-guides/access-controls/access-request-plugins/",
+      "source": "/upgrading/automatic-agent-updates/",
+      "destination": "/upgrading/agent-managed-updates-v1/",
       "permanent": true
     },
     {
-      "source": "/upgrading/automatic-agent-updates/",
-      "destination": "/upgrading/agent-managed-updates-v1/",
+      "source": "/upgrading/upgrading-reference/",
+      "destination": "/upgrading/upgrading-manual/",
       "permanent": true
     },
     {
       "source": "/access-controls/compliance-frameworks/fedramp/",
-      "destination": "/admin-guides/access-controls/compliance-frameworks/fedramp/",
+      "destination": "/zero-trust-access/compliance-frameworks/fedramp/",
       "permanent": true
     },
     {
@@ -260,69 +270,59 @@
       "destination": "/enroll-resources/server-access/",
       "permanent": true
     },
-    {
-      "source": "/enroll-resources/auto-discovery/reference/",
-      "destination": "/reference/agent-services/auto-discovery-reference/",
-      "permanent": true
-    },
-    {
-      "source": "/enroll-resources/auto-discovery/reference/aws-iam/",
-      "destination": "/reference/agent-services/auto-discovery-reference/aws-iam/",
-      "permanent": true
-    },
     {
       "source": "/reference/agent-services/kubernetes-application-discovery/",
-      "destination": "/reference/agent-services/auto-discovery-reference/kubernetes-application-discovery/",
+      "destination": "/enroll-resources/auto-discovery/kubernetes-applications/reference/",
       "permanent": true
     },
     {
       "source": "/reference/operator-resources/resources.teleport.dev_trustedclustersv2/",
-      "destination": "/reference/operator-resources/resources-teleport-dev-trustedclustersv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-trustedclustersv2/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/hosted-guide/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/integrations/okta/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/scim-only/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/integrations/okta/scim-integration/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/sync-scim/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/integrations/okta/scim-integration/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/app-and-group-sync/",
-      "destination": "/admin-guides/access-controls/okta/app-and-group-sync/",
+      "destination": "/identity-governance/integrations/okta/app-and-group-sync/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/guided-sso/",
-      "destination": "/admin-guides/access-controls/okta/guided-sso/",
+      "destination": "/identity-governance/integrations/okta/guided-sso/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/integrations/okta/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/scim-integration/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/integrations/okta/scim-integration/",
       "permanent": true
     },
     {
       "source": "/enroll-resources/application-access/okta/user-sync/",
-      "destination": "/admin-guides/access-controls/okta/user-sync/",
+      "destination": "/identity-governance/integrations/okta/user-sync/",
       "permanent": true
     },
     {
       "source": "/api/getting-started/",
-      "destination": "/admin-guides/api/getting-started/",
+      "destination": "/zero-trust-access/api/getting-started/",
       "permanent": true
     },
     {
@@ -369,6 +369,3102 @@
       "source": "/enroll-resources/agents/introduction/",
       "destination": "/enroll-resources/agents/",
       "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/",
+      "destination": "/identity-governance/access-lists/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/nested-access-lists/",
+      "destination": "/identity-governance/access-lists/nested-access-lists/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-monitoring/",
+      "destination": "/identity-governance/access-monitoring/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/",
+      "destination": "/identity-governance/access-requests/plugins/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/datadog-hosted/",
+      "destination": "/identity-governance/access-requests/plugins/datadog-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/notification-routing-rules/",
+      "destination": "/identity-governance/access-requests/notification-routing-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/opsgenie/",
+      "destination": "/identity-governance/access-requests/plugins/opsgenie/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/servicenow/",
+      "destination": "/identity-governance/access-requests/plugins/servicenow/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-discord/",
+      "destination": "/identity-governance/access-requests/plugins/discord/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-jira/",
+      "destination": "/identity-governance/access-requests/plugins/jira/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-email/",
+      "destination": "/identity-governance/access-requests/plugins/email/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost/",
+      "destination": "/identity-governance/access-requests/plugins/mattermost/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-msteams/",
+      "destination": "/identity-governance/access-requests/plugins/msteams/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/access-request-configuration/",
+      "destination": "/identity-governance/access-requests/access-request-configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/",
+      "destination": "/identity-governance/access-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/automatic-reviews/",
+      "destination": "/identity-governance/access-requests/automatic-reviews/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/oss-role-requests/",
+      "destination": "/identity-governance/access-requests/oss-role-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/resource-requests/",
+      "destination": "/identity-governance/access-requests/resource-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/role-requests/",
+      "destination": "/identity-governance/access-requests/role-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/device-management/",
+      "destination": "/identity-governance/device-trust/device-management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/",
+      "destination": "/identity-governance/device-trust/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/enforcing-device-trust/",
+      "destination": "/identity-governance/device-trust/enforcing-device-trust/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/guide/",
+      "destination": "/identity-governance/device-trust/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/jamf-integration/",
+      "destination": "/identity-governance/device-trust/jamf-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/locking/",
+      "destination": "/identity-governance/locking/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/app-and-group-sync/",
+      "destination": "/identity-governance/integrations/okta/app-and-group-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/guided-sso/",
+      "destination": "/identity-governance/integrations/okta/guided-sso/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/integrations/okta/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/integrations/okta/scim-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/user-sync/",
+      "destination": "/identity-governance/integrations/okta/user-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/linux-demo/",
+      "destination": "/get-started/deploy-community/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/",
+      "destination": "/machine-workload-identity/access-guides/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/ansible/",
+      "destination": "/machine-workload-identity/access-guides/ansible/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/applications/",
+      "destination": "/machine-workload-identity/access-guides/applications/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/databases/",
+      "destination": "/machine-workload-identity/access-guides/databases/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/kubernetes/",
+      "destination": "/machine-workload-identity/access-guides/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/ssh/",
+      "destination": "/machine-workload-identity/access-guides/ssh/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/access-guides/tctl/",
+      "destination": "/machine-workload-identity/access-guides/tctl/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/aws/",
+      "destination": "/machine-workload-identity/deployment/aws/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/azure-devops/",
+      "destination": "/machine-workload-identity/deployment/azure-devops/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/azure/",
+      "destination": "/machine-workload-identity/deployment/azure/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/bitbucket/",
+      "destination": "/machine-workload-identity/deployment/bitbucket/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/circleci/",
+      "destination": "/machine-workload-identity/deployment/circleci/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/",
+      "destination": "/machine-workload-identity/deployment/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/gcp/",
+      "destination": "/machine-workload-identity/deployment/gcp/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/github-actions/",
+      "destination": "/machine-workload-identity/deployment/github-actions/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/gitlab/",
+      "destination": "/machine-workload-identity/deployment/gitlab/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/jenkins/",
+      "destination": "/machine-workload-identity/deployment/jenkins/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/kubernetes/",
+      "destination": "/machine-workload-identity/deployment/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/linux-tpm/",
+      "destination": "/machine-workload-identity/deployment/linux-tpm/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/deployment/linux/",
+      "destination": "/machine-workload-identity/deployment/linux/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/faq/",
+      "destination": "/machine-workload-identity/faq/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/getting-started/",
+      "destination": "/machine-workload-identity/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/introduction/",
+      "destination": "/machine-workload-identity/introduction/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/",
+      "destination": "/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/manifesto/",
+      "destination": "/machine-workload-identity/manifesto/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/machine-id/troubleshooting/",
+      "destination": "/machine-workload-identity/troubleshooting/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/aws-oidc-federation/",
+      "destination": "/machine-workload-identity/workload-identity/aws-oidc-federation/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/aws-roles-anywhere/",
+      "destination": "/machine-workload-identity/workload-identity/aws-roles-anywhere/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/azure-federated-credentials/",
+      "destination": "/machine-workload-identity/workload-identity/azure-federated-credentials/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/best-practices/",
+      "destination": "/machine-workload-identity/workload-identity/best-practices/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/federation/",
+      "destination": "/machine-workload-identity/workload-identity/federation/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/gcp-workload-identity-federation-jwt/",
+      "destination": "/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/getting-started/",
+      "destination": "/machine-workload-identity/workload-identity/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/introduction/",
+      "destination": "/machine-workload-identity/workload-identity/introduction/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/jwt-svids/",
+      "destination": "/machine-workload-identity/workload-identity/jwt-svids/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/spiffe/",
+      "destination": "/machine-workload-identity/workload-identity/spiffe/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/tsh/",
+      "destination": "/machine-workload-identity/workload-identity/tsh/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/workload-attestation/",
+      "destination": "/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/workload-identity/workload-attestation/",
+      "destination": "/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/bound-keypair/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/workload-identity/",
+      "destination": "/machine-workload-identity/workload-identity/"
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/guide/",
+      "destination": "/identity-governance/access-lists/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty/",
+      "destination": "/identity-governance/access-requests/plugins/pagerduty/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-slack/",
+      "destination": "/identity-governance/access-requests/plugins/slack/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/mwi-use-cases/",
+      "destination": "/machine-workload-identity/workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/mwi-use-cases/mwi-ci-cd/",
+      "destination": "/machine-workload-identity/use-cases/mwi-ci-cd/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/gitlab/",
+      "destination": "/reference/deployment/join-methods/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/github-actions/",
+      "destination": "/reference/deployment/join-methods/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/",
+      "destination": "/reference/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/configuration/",
+      "destination": "/reference/machine-workload-identity/configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/diagnostics-service/",
+      "destination": "/reference/machine-workload-identity/diagnostics-service/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/telemetry/",
+      "destination": "/reference/machine-workload-identity/telemetry/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/bound-keypair/admin-guide/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/admin-guide/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/bound-keypair/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/bound-keypair/concepts/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/concepts/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/bound-keypair/getting-started/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/bound-keypair/static-keys/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/static-keys/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-workload-identity/machine-id/v16-upgrade-guide/",
+      "destination": "/reference/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/access-graph/",
+      "destination": "/identity-security/access-graph/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/access-graph/identity-activity-center/",
+      "destination": "/identity-security/access-graph/identity-activity-center/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/access-graph/self-hosted-helm/",
+      "destination": "/identity-security/access-graph/self-hosted-helm/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/access-graph/self-hosted/",
+      "destination": "/identity-security/access-graph/self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/crown-jewels/",
+      "destination": "/identity-security/usage/crown-jewels/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/aws-sync/",
+      "destination": "/identity-security/integrations/aws-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/azure-sync/",
+      "destination": "/identity-security/integrations/azure-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/entra-id/",
+      "destination": "/identity-security/integrations/entra-id/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/github/",
+      "destination": "/identity-security/integrations/github/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/gitlab/",
+      "destination": "/identity-security/integrations/gitlab/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/",
+      "destination": "/identity-security/integrations/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/netiq/",
+      "destination": "/identity-security/integrations/netiq/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/ssh-keys-scan/",
+      "destination": "/identity-security/integrations/ssh-keys-scan/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/integrations/teleport/",
+      "destination": "/identity-security/integrations/teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/policy-connections/",
+      "destination": "/identity-security/usage/graph-explorer/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/policy-how-to-use/",
+      "destination": "/identity-security/usage/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-security/policy-how-to-use/",
+      "destination": "/identity-security/usage/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/teleport-policy/",
+      "destination": "/identity-security/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-security/teleport-policy/",
+      "destination": "/identity-security/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/architecture/proxy-peering/",
+      "destination": "/zero-trust-access/deploy-a-cluster/proxy-peering/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/compliance-frameworks/",
+      "destination": "/zero-trust-access/compliance-frameworks/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/compliance-frameworks/fedramp/",
+      "destination": "/zero-trust-access/compliance-frameworks/fedramp/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/compliance-frameworks/soc2/",
+      "destination": "/zero-trust-access/compliance-frameworks/soc2/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/adfs/",
+      "destination": "/zero-trust-access/sso/integrate-idp/adfs/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/azuread/",
+      "destination": "/zero-trust-access/sso/integrate-idp/entra-id/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/github-sso/",
+      "destination": "/zero-trust-access/sso/integrate-idp/github-sso/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/gitlab/",
+      "destination": "/zero-trust-access/sso/integrate-idp/gitlab/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/google-workspace/",
+      "destination": "/zero-trust-access/sso/integrate-idp/google-workspace/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/keycloak/",
+      "destination": "/zero-trust-access/sso/integrate-idp/keycloak/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/oidc/",
+      "destination": "/zero-trust-access/sso/integrate-idp/oidc/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/okta/",
+      "destination": "/zero-trust-access/sso/integrate-idp/okta/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/one-login/",
+      "destination": "/zero-trust-access/sso/integrate-idp/one-login/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/sso/",
+      "destination": "/zero-trust-access/sso/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/",
+      "destination": "/zero-trust-access/infrastructure-as-code/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/access-list/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/access-list/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/agentless-ssh-servers/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/import-existing-resources/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/import-existing-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/login-rules-operator/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-operator/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/login-rules-terraform/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-terraform/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/trusted-cluster/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/trusted-cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/managing-resources/user-and-role/",
+      "destination": "/zero-trust-access/infrastructure-as-code/managing-resources/user-and-role/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup/",
+      "destination": "/zero-trust-access/infrastructure-as-code/teleport-operator/secret-lookup/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-helm/",
+      "destination": "/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-helm/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone/",
+      "destination": "/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/teleport-operator/",
+      "destination": "/zero-trust-access/infrastructure-as-code/teleport-operator/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/dedicated-server/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/local/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/local/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/long-lived-credentials/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/long-lived-credentials/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/spacelift/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-provider/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-starter/enroll-resources/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-starter/rbac/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/infrastructure-as-code/terraform-starter/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/datadog/",
+      "destination": "/zero-trust-access/export-audit-events/datadog/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/elastic-stack/",
+      "destination": "/zero-trust-access/export-audit-events/elastic-stack/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/",
+      "destination": "/zero-trust-access/export-audit-events/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/fluentd/",
+      "destination": "/zero-trust-access/export-audit-events/fluentd/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/panther/",
+      "destination": "/zero-trust-access/export-audit-events/panther/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/export-audit-events/splunk/",
+      "destination": "/zero-trust-access/export-audit-events/splunk/",
+      "permanent": true
+    },
+    {
+      "source": "/model-context-preview/",
+      "destination": "/connect-your-client/model-context-protocol/",
+      "permanent": true
+    },
+    {
+      "source": "/upgrading/client-tools-autoupdate/",
+      "destination": "/upgrading/client-tools-managed-updates/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/",
+      "destination": "/identity-governance/idps/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/",
+      "destination": "/zero-trust-access/authentication/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/getting-started/",
+      "destination": "/zero-trust-access/rbac-get-started/role-demo/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/dual-authz/",
+      "destination": "/identity-governance/access-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/",
+      "destination": "/zero-trust-access/authentication/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/hardware-key-support/",
+      "destination": "/zero-trust-access/authentication/hardware-key-support/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/headless/",
+      "destination": "/zero-trust-access/authentication/headless/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/impersonation/",
+      "destination": "/zero-trust-access/authentication/impersonation/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/ip-pinning/",
+      "destination": "/zero-trust-access/authentication/ip-pinning/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/joining-sessions/",
+      "destination": "/zero-trust-access/authentication/joining-sessions/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/mfa-for-admin-actions/",
+      "destination": "/zero-trust-access/authentication/mfa-for-admin-actions/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/passwordless/",
+      "destination": "/zero-trust-access/authentication/passwordless/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/per-session-mfa/",
+      "destination": "/zero-trust-access/authentication/per-session-mfa/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/role-templates/",
+      "destination": "/zero-trust-access/rbac-get-started/role-templates/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/webauthn/",
+      "destination": "/zero-trust-access/management/security/idp-compromise/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/saml-attribute-mapping/",
+      "destination": "/identity-governance/idps/saml-attribute-mapping/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation/",
+      "destination": "/identity-governance/idps/usage/saml-gcp-workforce-identity-federation/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/saml-grafana/",
+      "destination": "/identity-governance/idps/usage/saml-grafana/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/saml-guide/",
+      "destination": "/identity-governance/idps/saml-guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/idps/saml-microsoft-entra-external-id/",
+      "destination": "/identity-governance/idps/usage/saml-microsoft-entra-external-id/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/login-rules/guide/",
+      "destination": "/zero-trust-access/sso/login-rules/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/login-rules/",
+      "destination": "/zero-trust-access/sso/login-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/aws-kms/",
+      "destination": "/zero-trust-access/deploy-a-cluster/private-keys/aws-kms/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/",
+      "destination": "/zero-trust-access/deploy-a-cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/deployments/aws-starter-cluster-terraform/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/aws-starter-cluster-terraform/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/deployments/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/deployments/gcp/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/gcp/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/gcp-kms/",
+      "destination": "/zero-trust-access/deploy-a-cluster/private-keys/gcp-kms/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/argocd-helm/",
+      "destination": "/enroll-resources/agents/argocd-helm/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/aws/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/aws/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/azure/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/azure/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/custom/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/custom/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/digitalocean/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/digitalocean/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/disaster-recovery/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/disaster-recovery/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/gcp/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/gcp/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/ibm/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/ibm/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp/",
+      "destination": "/zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/high-availability/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/high-availability/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/hsm/",
+      "destination": "/zero-trust-access/deploy-a-cluster/hsm/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/license/",
+      "destination": "/zero-trust-access/deploy-a-cluster/license/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/multi-region-blueprint/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/deploy-a-cluster/separate-proxy-service-endpoints/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/separate-proxy-service-endpoints/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/daemon/",
+      "destination": "/zero-trust-access/management/daemon/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/labels/",
+      "destination": "/zero-trust-access/rbac-get-started/labels/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/self-signed-certs/",
+      "destination": "/zero-trust-access/deploy-a-cluster/self-signed-certs/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/troubleshooting/",
+      "destination": "/zero-trust-access/management/diagnostics/troubleshooting/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/trustedclusters/",
+      "destination": "/zero-trust-access/deploy-a-cluster/trustedclusters/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/uninstall-teleport/",
+      "destination": "/installation/uninstall-teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/admin/users/",
+      "destination": "/zero-trust-access/rbac-get-started/users/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/client-timeout/",
+      "destination": "/zero-trust-access/management/security/client-timeout/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/proxy-protocol/",
+      "destination": "/zero-trust-access/management/security/proxy-protocol/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/reduce-blast-radius/",
+      "destination": "/zero-trust-access/management/security/reduce-blast-radius/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/restrict-privileges/",
+      "destination": "/zero-trust-access/management/security/restrict-privileges/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/revoking-access/",
+      "destination": "/zero-trust-access/management/security/revoking-access/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/",
+      "destination": "/zero-trust-access/management/security/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/security/selinux/",
+      "destination": "/zero-trust-access/management/security/selinux/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/",
+      "destination": "/zero-trust-access/management/diagnostics/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/logging/",
+      "destination": "/zero-trust-access/management/diagnostics/logging/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/metrics/",
+      "destination": "/zero-trust-access/management/diagnostics/metrics/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/monitoring/",
+      "destination": "/zero-trust-access/management/diagnostics/monitoring/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/profiles/",
+      "destination": "/zero-trust-access/management/diagnostics/profiles/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/diagnostics/tracing/",
+      "destination": "/zero-trust-access/management/diagnostics/tracing/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/external-audit-storage/",
+      "destination": "/zero-trust-access/management/external-audit-storage/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/aws-iam-identity-center/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/aws-iam-identity-center/guide/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/awsoidc-integration-rds/",
+      "destination": "/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/awsoidc-integration/",
+      "destination": "/enroll-resources/application-access/cloud-apis/awsoidc-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/datadog/",
+      "destination": "/zero-trust-access/management/diagnostics/datadog/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/ec2-tags/",
+      "destination": "/enroll-resources/automatic-labels/ec2-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/gcp-tags/",
+      "destination": "/enroll-resources/automatic-labels/gcp-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/github-integration/",
+      "destination": "/enroll-resources/application-access/cloud-apis/github-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/oracle-tags/",
+      "destination": "/enroll-resources/automatic-labels/oracle-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/scim/sailpoint/",
+      "destination": "/identity-governance/integrations/scim/sailpoint/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/scim/",
+      "destination": "/identity-governance/integrations/scim/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/backup-restore/",
+      "destination": "/zero-trust-access/deploy-a-cluster/backup-restore/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/ca-rotation/",
+      "destination": "/zero-trust-access/management/security/ca-rotation/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/db-ca-migrations/",
+      "destination": "/zero-trust-access/management/security/db-ca-migrations/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/proxy-peering/",
+      "destination": "/zero-trust-access/deploy-a-cluster/proxy-peering/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/scaling/",
+      "destination": "/reference/deployment/scaling/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/operations/tls-routing/",
+      "destination": "/zero-trust-access/deploy-a-cluster/tls-routing/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/management/guides/aws-iam-identity-center/using-aws-cli/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/using-aws-cli/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/api/access-plugin/",
+      "destination": "/identity-governance/access-requests/plugins/how-to-build/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/api/",
+      "destination": "/zero-trust-access/api/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/",
+      "destination": "/zero-trust-access/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/api/automatically-register-agents/",
+      "destination": "/zero-trust-access/api/automatically-register-agents/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/api/getting-started/",
+      "destination": "/zero-trust-access/api/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/api/rbac/",
+      "destination": "/zero-trust-access/api/rbac/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/migrate-plans/",
+      "destination": "/migrate-plans/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/",
+      "destination": "/zero-trust-access/authentication/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/",
+      "destination": "/zero-trust-access/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/getting-started/",
+      "destination": "/zero-trust-access/authentication/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/dual-authz/",
+      "destination": "/zero-trust-access/authentication/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/hardware-key-support/",
+      "destination": "/zero-trust-access/authentication/hardware-key-support/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/headless/",
+      "destination": "/zero-trust-access/authentication/headless/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/impersonation/",
+      "destination": "/zero-trust-access/authentication/impersonation/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/ip-pinning/",
+      "destination": "/zero-trust-access/authentication/ip-pinning/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/joining-sessions/",
+      "destination": "/zero-trust-access/authentication/joining-sessions/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/mfa-for-admin-actions/",
+      "destination": "/zero-trust-access/authentication/mfa-for-admin-actions/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/passwordless/",
+      "destination": "/zero-trust-access/authentication/passwordless/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/per-session-mfa/",
+      "destination": "/zero-trust-access/authentication/per-session-mfa/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/role-templates/",
+      "destination": "/zero-trust-access/rbac-get-started/role-templates/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/guides/webauthn/",
+      "destination": "/zero-trust-access/management/security/idp-compromise/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/login-rules/guide/",
+      "destination": "/zero-trust-access/sso/login-rules/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/access-controls/login-rules/",
+      "destination": "/zero-trust-access/sso/login-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/labels/",
+      "destination": "/zero-trust-access/rbac-get-started/labels/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/aws-iam-identity-center/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/aws-iam-identity-center/guide/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/aws-iam-identity-center/using-aws-cli/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/using-aws-cli/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/azuread/",
+      "destination": "/zero-trust-access/sso/integrate-idp/entra-id/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/backends/",
+      "destination": "/reference/deployment/backends/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/cloud-faq/",
+      "destination": "/cloud-faq/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/config/",
+      "destination": "/reference/deployment/config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/identity-security-config/",
+      "destination": "/reference/deployment/identity-security-config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/join-methods/",
+      "destination": "/reference/deployment/join-methods/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/bound-keypair/admin-guide/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/admin-guide/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/bound-keypair/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/bound-keypair/concepts/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/concepts/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/bound-keypair/getting-started/",
+      "destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/configuration/",
+      "destination": "/reference/machine-workload-identity/configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/diagnostics-service/",
+      "destination": "/reference/machine-workload-identity/diagnostics-service/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/github-actions/",
+      "destination": "/reference/deployment/join-methods/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/gitlab/",
+      "destination": "/reference/deployment/join-methods/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/",
+      "destination": "/reference/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/telemetry/",
+      "destination": "/reference/machine-workload-identity/telemetry/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/machine-id/v16-upgrade-guide/",
+      "destination": "/reference/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/managed-updates-v2/",
+      "destination": "/reference/deployment/managed-updates-v2/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/monitoring/audit/",
+      "destination": "/reference/deployment/monitoring/audit/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/monitoring/metrics/",
+      "destination": "/reference/deployment/monitoring/metrics/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/monitoring/",
+      "destination": "/reference/deployment/monitoring/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/monitoring/tracing-service-configuration/",
+      "destination": "/reference/deployment/monitoring/tracing-service-configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/networking/",
+      "destination": "/reference/deployment/networking/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-accesslists/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-accesslists/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-appsv3/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-appsv3/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-autoupdateconfigsv1/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateconfigsv1/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-autoupdateversionsv1/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateversionsv1/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-botsv1/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-botsv1/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-databasesv3/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-databasesv3/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-githubconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-githubconnectors/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-loginrules/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-loginrules/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-oidcconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oidcconnectors/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-oktaimportrules/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oktaimportrules/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-openssheiceserversv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-openssheiceserversv2/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-opensshserversv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-opensshserversv2/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-provisiontokens/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-roles/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-rolesv6/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-rolesv7/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-rolesv8/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv8/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-samlconnectors/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-samlconnectors/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-trustedclustersv2/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-trustedclustersv2/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-users/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-users/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/operator-resources/resources-teleport-dev-workloadidentitiesv1/",
+      "destination": "/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-workloadidentitiesv1/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/predicate-language/",
+      "destination": "/reference/access-controls/predicate-language/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/resources/",
+      "destination": "/reference/infrastructure-as-code/teleport-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/signals/",
+      "destination": "/reference/deployment/signals/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/signature-algorithms/",
+      "destination": "/reference/deployment/signature-algorithms/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider-mwi/data-sources/",
+      "destination": "/reference/machine-workload-identity/terraform-provider-mwi/data-sources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider-mwi/data-sources/kubernetes/",
+      "destination": "/reference/machine-workload-identity/terraform-provider-mwi/data-sources/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider-mwi/ephemeral-resources/",
+      "destination": "/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider-mwi/ephemeral-resources/kubernetes/",
+      "destination": "/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider-mwi/",
+      "destination": "/reference/machine-workload-identity/terraform-provider-mwi/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/access_list/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/access_list/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/access_list_member/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/access_list_member/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/access_monitoring_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/access_monitoring_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/app/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/app/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/auth_preference/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/auth_preference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/autoupdate_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/autoupdate_version/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_version/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/cluster_maintenance_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_maintenance_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/cluster_networking_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_networking_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/database/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/database/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/dynamic_windows_desktop/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/dynamic_windows_desktop/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/github_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/github_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/health_check_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/health_check_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/installer/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/installer/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/login_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/login_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/oidc_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/oidc_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/okta_import_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/okta_import_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/provision_token/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/provision_token/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/role/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/role/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/saml_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/saml_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/session_recording_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/session_recording_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/static_host_user/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/static_host_user/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/trusted_cluster/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/trusted_device/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_device/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/user/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/user/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/data-sources/workload_identity/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/data-sources/workload_identity/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/access_list/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/access_list/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/access_list_member/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/access_list_member/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/access_monitoring_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/access_monitoring_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/app/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/app/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/auth_preference/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/auth_preference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/autoupdate_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/autoupdate_version/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_version/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/bot/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/bot/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/cluster_maintenance_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/cluster_maintenance_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/cluster_networking_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/cluster_networking_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/database/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/database/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/dynamic_windows_desktop/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/dynamic_windows_desktop/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/github_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/github_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/health_check_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/health_check_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/installer/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/installer/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/login_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/login_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/oidc_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/oidc_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/okta_import_rule/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/okta_import_rule/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/provision_token/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/provision_token/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/role/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/role/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/saml_connector/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/saml_connector/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/server/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/server/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/session_recording_config/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/session_recording_config/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/static_host_user/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/static_host_user/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/trusted_cluster/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/trusted_cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/trusted_device/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/trusted_device/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/user/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/user/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/resources/workload_identity/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/resources/workload_identity/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/terraform-provider/",
+      "destination": "/reference/infrastructure-as-code/terraform-provider/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/user-types/",
+      "destination": "/reference/access-controls/user-types/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/ai-agents-mwi/",
+      "destination": "/machine-workload-identity/use-cases/ai-agents-mwi/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/hybrid-multi-mwi/",
+      "destination": "/machine-workload-identity/use-cases/hybrid-multi-mwi/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/iac-mwi/",
+      "destination": "/machine-workload-identity/use-cases/iac-mwi/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/mwi-ci-cd/",
+      "destination": "/machine-workload-identity/use-cases/mwi-ci-cd/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/workload-mwi/",
+      "destination": "/machine-workload-identity/use-cases/workload-mwi/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/",
+      "destination": "/machine-workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/introduction/",
+      "destination": "/machine-workload-identity/introduction/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/faq/",
+      "destination": "/machine-workload-identity/faq/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/manifesto/",
+      "destination": "/machine-workload-identity/manifesto/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/troubleshooting/",
+      "destination": "/machine-workload-identity/troubleshooting/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/",
+      "destination": "/machine-workload-identity/access-guides/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/ansible-awx/",
+      "destination": "/machine-workload-identity/access-guides/ansible-awx/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/ansible/",
+      "destination": "/machine-workload-identity/access-guides/ansible/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/applications/",
+      "destination": "/machine-workload-identity/access-guides/applications/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/argocd/",
+      "destination": "/machine-workload-identity/access-guides/argocd/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/databases/",
+      "destination": "/machine-workload-identity/access-guides/databases/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/kubernetes/",
+      "destination": "/machine-workload-identity/access-guides/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/mcp/",
+      "destination": "/machine-workload-identity/access-guides/mcp/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/ssh/",
+      "destination": "/machine-workload-identity/access-guides/ssh/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/access-guides/tctl/",
+      "destination": "/machine-workload-identity/access-guides/tctl/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/",
+      "destination": "/machine-workload-identity/deployment/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/aws/",
+      "destination": "/machine-workload-identity/deployment/aws/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/azure-devops/",
+      "destination": "/machine-workload-identity/deployment/azure-devops/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/azure/",
+      "destination": "/machine-workload-identity/deployment/azure/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/bitbucket/",
+      "destination": "/machine-workload-identity/deployment/bitbucket/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/circleci/",
+      "destination": "/machine-workload-identity/deployment/circleci/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/gcp/",
+      "destination": "/machine-workload-identity/deployment/gcp/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/github-actions/",
+      "destination": "/machine-workload-identity/deployment/github-actions/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/gitlab/",
+      "destination": "/machine-workload-identity/deployment/gitlab/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/jenkins/",
+      "destination": "/machine-workload-identity/deployment/jenkins/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/kubernetes-oidc/",
+      "destination": "/machine-workload-identity/deployment/kubernetes-oidc/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/kubernetes/",
+      "destination": "/machine-workload-identity/deployment/kubernetes/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/linux-tpm/",
+      "destination": "/machine-workload-identity/deployment/linux-tpm/",
+      "permanent": true
+    },
+    {
+      "source": "/machine-workload-identity/machine-id/deployment/linux/",
+      "destination": "/machine-workload-identity/deployment/linux/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/attributes/",
+      "destination": "/reference/machine-workload-identity/workload-identity/attributes/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/configuration-resource-migration/",
+      "destination": "/reference/machine-workload-identity/workload-identity/configuration-resource-migration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/issuer-override/",
+      "destination": "/reference/machine-workload-identity/workload-identity/issuer-override/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/revocations/",
+      "destination": "/reference/machine-workload-identity/workload-identity/revocations/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/sigstore-attestation/",
+      "destination": "/reference/machine-workload-identity/workload-identity/sigstore-attestation/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/workload-identity-api-and-workload-attestation/",
+      "destination": "/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/workload-identity-resource/",
+      "destination": "/reference/machine-workload-identity/workload-identity/workload-identity-resource/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/workload-identity/",
+      "destination": "/reference/machine-workload-identity/workload-identity/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/cloud-apis/aws-console-without-agent/",
+      "destination": "/enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/infrastructure-as-code/terraform-starter/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/infrastructure-as-code/terraform-starter/enroll-resources/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/infrastructure-as-code/terraform-starter/rbac/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/scim/",
+      "destination": "/identity-governance/integrations/scim/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/scim/sailpoint/",
+      "destination": "/identity-governance/integrations/scim/sailpoint/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/advanced-options/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/advanced-options/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/guide/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/maintenance/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/maintenance/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/aws-iam-identity-center/using-aws-cli/",
+      "destination": "/identity-governance/integrations/aws-iam-identity-center/using-aws-cli/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/configure-access/",
+      "destination": "/identity-governance/integrations/entra-id/configure-access/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/",
+      "destination": "/identity-governance/integrations/entra-id/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/faq/",
+      "destination": "/identity-governance/integrations/entra-id/faq/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/getting-started/",
+      "destination": "/identity-governance/integrations/entra-id/getting-started/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/manual-installation/",
+      "destination": "/identity-governance/integrations/entra-id/setup/manual-installation/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/entra-id/terraform/",
+      "destination": "/identity-governance/integrations/entra-id/setup/terraform/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/okta/app-and-group-sync/",
+      "destination": "/identity-governance/integrations/okta/app-and-group-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/okta/guided-sso/",
+      "destination": "/identity-governance/integrations/okta/guided-sso/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/okta/",
+      "destination": "/identity-governance/integrations/okta/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/okta/scim-integration/",
+      "destination": "/identity-governance/integrations/okta/scim-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/okta/user-sync/",
+      "destination": "/identity-governance/integrations/okta/user-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/scim/sailpoint/",
+      "destination": "/identity-governance/integrations/scim/sailpoint/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/scim/",
+      "destination": "/identity-governance/integrations/scim/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-security/how-to-use/",
+      "destination": "/identity-security/usage/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-security/policy-connections/",
+      "destination": "/identity-security/usage/graph-explorer/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-security/crown-jewels/",
+      "destination": "/identity-security/usage/crown-jewels/",
+      "permanent": true
+    },
+    {
+      "source": "/linux-demo/",
+      "destination": "/get-started/deploy-community/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/infrastructure-as-code/resources/",
+      "destination": "/reference/infrastructure-as-code/teleport-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/server-access/guides/recording-proxy-mode/",
+      "destination": "/reference/architecture/session-recording/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/aws-kms/",
+      "destination": "/zero-trust-access/deploy-a-cluster/private-keys/aws-kms/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/gcp-kms/",
+      "destination": "/zero-trust-access/deploy-a-cluster/private-keys/gcp-kms/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/ec2-tags/",
+      "destination": "/enroll-resources/automatic-labels/ec2-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/gcp-tags/",
+      "destination": "/enroll-resources/automatic-labels/gcp-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/oracle-tags/",
+      "destination": "/enroll-resources/automatic-labels/oracle-tags/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-oracle/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/rds-oracle/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy-mysql/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-mysql/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy-sqlserver/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/sql-server-ad/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/sql-server-ad/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/mcp-access/sse/",
+      "destination": "/enroll-resources/mcp-access/enrolling-mcp-servers/sse/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/mcp-access/stdio/",
+      "destination": "/enroll-resources/mcp-access/enrolling-mcp-servers/stdio/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/mcp-access/streamable-http/",
+      "destination": "/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/integrations/entra-id/manual-installation/",
+      "destination": "/identity-governance/integrations/entra-id/setup/manual-installation/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/integrations/entra-id/terraform/",
+      "destination": "/identity-governance/integrations/entra-id/setup/terraform/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/amazon-athena/",
+      "destination": "/enroll-resources/application-access/protect-apps/amazon-athena/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/api-access/",
+      "destination": "/enroll-resources/application-access/protect-apps/api-access/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/connecting-apps/",
+      "destination": "/enroll-resources/application-access/protect-apps/connecting-apps/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/dynamodb/",
+      "destination": "/enroll-resources/application-access/protect-apps/dynamodb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/tcp/",
+      "destination": "/enroll-resources/application-access/protect-apps/tcp/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/",
+      "destination": "/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/application-access/",
+      "destination": "/enroll-resources/application-access/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/auto-discovery-reference/",
+      "destination": "/enroll-resources/auto-discovery/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/auto-discovery-reference/aws-iam/",
+      "destination": "/enroll-resources/auto-discovery/reference/aws-iam/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/auto-discovery-reference/kubernetes-application-discovery/",
+      "destination": "/enroll-resources/auto-discovery/kubernetes-applications/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/auto-discovery-reference/labels/",
+      "destination": "/enroll-resources/auto-discovery/reference/labels/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/audit/",
+      "destination": "/enroll-resources/database-access/reference/audit/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/aws/",
+      "destination": "/enroll-resources/database-access/reference/aws/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/cli/",
+      "destination": "/enroll-resources/database-access/reference/cli/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/configuration/",
+      "destination": "/enroll-resources/database-access/reference/configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/",
+      "destination": "/enroll-resources/database-access/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/database-access-reference/labels/",
+      "destination": "/enroll-resources/database-access/reference/labels/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/audit/",
+      "destination": "/enroll-resources/desktop-access/reference/audit/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/cli/",
+      "destination": "/enroll-resources/desktop-access/reference/cli/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/clipboard/",
+      "destination": "/enroll-resources/desktop-access/reference/clipboard/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/configuration/",
+      "destination": "/enroll-resources/desktop-access/reference/configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/",
+      "destination": "/enroll-resources/desktop-access/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/sessions/",
+      "destination": "/enroll-resources/desktop-access/reference/sessions/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/desktop-access-reference/user-creation/",
+      "destination": "/enroll-resources/desktop-access/reference/user-creation/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/mcp-access/",
+      "destination": "/enroll-resources/mcp-access/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/reference/agent-services/okta/",
+      "destination": "/identity-governance/integrations/okta/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/introduction/",
+      "destination": "/enroll-resources/application-access/",
+      "source": "/zero-trust-access/sso/adfs/",
+      "destination": "/zero-trust-access/sso/integrate-idp/adfs/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/entra-id-oidc/",
+      "destination": "/zero-trust-access/sso/integrate-idp/entra-id-oidc/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/entra-id/",
+      "destination": "/zero-trust-access/sso/integrate-idp/entra-id/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/github-sso/",
+      "destination": "/zero-trust-access/sso/integrate-idp/github-sso/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/gitlab/",
+      "destination": "/zero-trust-access/sso/integrate-idp/gitlab/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/google-workspace/",
+      "destination": "/zero-trust-access/sso/integrate-idp/google-workspace/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/keycloak/",
+      "destination": "/zero-trust-access/sso/integrate-idp/keycloak/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/oidc/",
+      "destination": "/zero-trust-access/sso/integrate-idp/oidc/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/okta/",
+      "destination": "/zero-trust-access/sso/integrate-idp/okta/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/sso/one-login/",
+      "destination": "/zero-trust-access/sso/integrate-idp/one-login/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/authentication/login-rules/guide/",
+      "destination": "/zero-trust-access/sso/login-rules/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/authentication/login-rules/",
+      "destination": "/zero-trust-access/sso/login-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/",
+      "destination": "/identity-governance/access-requests/plugins/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/opsgenie/",
+      "destination": "/identity-governance/access-requests/plugins/opsgenie/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-discord/",
+      "destination": "/identity-governance/access-requests/plugins/discord/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-email/",
+      "destination": "/identity-governance/access-requests/plugins/email/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-mattermost/",
+      "destination": "/identity-governance/access-requests/plugins/mattermost/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-msteams/",
+      "destination": "/identity-governance/access-requests/plugins/msteams/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-pagerduty/",
+      "destination": "/identity-governance/access-requests/plugins/pagerduty/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-slack/",
+      "destination": "/identity-governance/access-requests/plugins/slack/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/access-plugin/",
+      "destination": "/identity-governance/access-requests/plugins/how-to-build/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/datadog-hosted/",
+      "destination": "/identity-governance/access-requests/plugins/datadog-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/notification-routing-rules/",
+      "destination": "/identity-governance/access-requests/notification-routing-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/servicenow/",
+      "destination": "/identity-governance/access-requests/plugins/servicenow/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/access-request-plugins/ssh-approval-jira/",
+      "destination": "/identity-governance/access-requests/plugins/jira/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/idps/saml-gcp-workforce-identity-federation/",
+      "destination": "/identity-governance/idps/usage/saml-gcp-workforce-identity-federation/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/idps/saml-grafana/",
+      "destination": "/identity-governance/idps/usage/saml-grafana/",
+      "permanent": true
+    },
+    {
+      "source": "/identity-governance/idps/saml-microsoft-entra-external-id/",
+      "destination": "/identity-governance/idps/usage/saml-microsoft-entra-external-id/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/gui-clients/",
+      "destination": "/connect-your-client/third-party/gui-clients/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/introduction/",
+      "destination": "/connect-your-client/teleport-clients/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/notifications/",
+      "destination": "/connect-your-client/teleport-clients/notifications/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/putty-winscp/",
+      "destination": "/connect-your-client/third-party/putty-winscp/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/teleport-connect/",
+      "destination": "/connect-your-client/teleport-clients/teleport-connect/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/tsh/",
+      "destination": "/connect-your-client/teleport-clients/tsh/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/vnet/",
+      "destination": "/connect-your-client/teleport-clients/vnet/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/web-ui/",
+      "destination": "/connect-your-client/teleport-clients/web-ui/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/server-access/guides/jetbrains-sftp/",
+      "destination": "/connect-your-client/third-party/jetbrains-sftp/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/server-access/guides/vscode/",
+      "destination": "/connect-your-client/third-party/vscode/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/infrastructure-as-code/managing-resources/import-existing-resources/",
+      "destination": "/zero-trust-access/infrastructure-as-code/terraform-provider/import-existing-resources/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/authentication/webauthn/",
+      "destination": "/zero-trust-access/management/security/idp-compromise/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/high-availability/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/high-availability/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/multi-region-blueprint/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/separate-proxy-service-endpoints/",
+      "destination": "/zero-trust-access/deploy-a-cluster/deployments/separate-proxy-service-endpoints/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/deploy-a-cluster/helm-deployments/argocd-helm/",
+      "destination": "/enroll-resources/agents/argocd-helm/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-cassandra-keyspaces/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-cassandra-keyspaces/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-cross-account/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-cross-account/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-docdb/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-docdb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-dynamodb/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-dynamodb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-memorydb/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-memorydb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/aws-opensearch/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/aws-opensearch/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/elasticache-serverless/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/elasticache-serverless/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/postgres-redshift/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/postgres-redshift/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy/rds-proxy-mysql/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-mysql/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy/rds-proxy-postgres/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy/rds-proxy-sqlserver/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds-proxy/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds-proxy/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds/mysql-postgres-mariadb/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds/rds-oracle/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/rds-oracle/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/rds/sql-server-ad/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/rds/sql-server-ad/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/redis-aws/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/redis-aws/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-aws-databases/redshift-serverless/",
+      "destination": "/enroll-resources/database-access/enrollment/aws/redshift-serverless/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql/",
+      "destination": "/enroll-resources/database-access/enrollment/azure/azure-postgres-mysql/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-azure-databases/azure-redis/",
+      "destination": "/enroll-resources/database-access/enrollment/azure/azure-redis/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad/",
+      "destination": "/enroll-resources/database-access/enrollment/azure/azure-sql-server-ad/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-azure-databases/",
+      "destination": "/enroll-resources/database-access/enrollment/azure/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-google-cloud-databases/alloydb/",
+      "destination": "/enroll-resources/database-access/enrollment/google-cloud/alloydb/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-google-cloud-databases/",
+      "destination": "/enroll-resources/database-access/enrollment/google-cloud/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-google-cloud-databases/mysql-cloudsql/",
+      "destination": "/enroll-resources/database-access/enrollment/google-cloud/mysql-cloudsql/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-google-cloud-databases/postgres-cloudsql/",
+      "destination": "/enroll-resources/database-access/enrollment/google-cloud/postgres-cloudsql/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-google-cloud-databases/spanner/",
+      "destination": "/enroll-resources/database-access/enrollment/google-cloud/spanner/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-managed-databases/",
+      "destination": "/enroll-resources/database-access/enrollment/managed/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-managed-databases/mongodb-atlas/",
+      "destination": "/enroll-resources/database-access/enrollment/managed/mongodb-atlas/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-managed-databases/oracle-exadata/",
+      "destination": "/enroll-resources/database-access/enrollment/managed/oracle-exadata/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-managed-databases/snowflake/",
+      "destination": "/enroll-resources/database-access/enrollment/managed/snowflake/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/cassandra-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/cassandra-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/clickhouse-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/clickhouse-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/cockroachdb-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/cockroachdb-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/elastic/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/elastic/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/mongodb-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/mysql-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/mysql-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/oracle-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/oracle-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/postgres-self-hosted/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/postgres-self-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/redis-cluster/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/redis-cluster/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/redis/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/redis/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/sql-server-ad-pkinit/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/sql-server-ad-pkinit/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/database-access/enroll-self-hosted-databases/vitess/",
+      "destination": "/enroll-resources/database-access/enrollment/self-hosted/vitess/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/auto-discovery/reference/kubernetes-application-discovery/",
+      "destination": "/enroll-resources/auto-discovery/kubernetes-applications/reference/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/server-access/introduction/",
+      "destination": "/enroll-resources/server-access/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/dynamic-registration/",
+      "destination": "/enroll-resources/application-access/configuration/dynamic-registration/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/",
+      "destination": "/enroll-resources/application-access/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/ha/",
+      "destination": "/enroll-resources/application-access/configuration/ha/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/guides/vnet/",
+      "destination": "/enroll-resources/application-access/vnet/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/controls/",
+      "destination": "/enroll-resources/application-access/configuration/controls/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/dynamic-registration/",
+      "destination": "/enroll-resources/application-access/configuration/dynamic-registration/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/application-access/ha/",
+      "destination": "/enroll-resources/application-access/configuration/ha/",
+      "permanent": true
+    },
+    {
+      "source": "/enroll-resources/server-access/guides/ansible/",
+      "destination": "/connect-your-client/third-party/ansible/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/datadog/",
+      "destination": "/zero-trust-access/management/diagnostics/datadog/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/awsoidc-integration-console/",
+      "destination": "/enroll-resources/application-access/cloud-apis/awsoidc-integration-console/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/awsoidc-integration-rds/",
+      "destination": "/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/awsoidc-integration/",
+      "destination": "/enroll-resources/application-access/cloud-apis/awsoidc-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/github-integration/",
+      "destination": "/enroll-resources/application-access/cloud-apis/github-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/ca-rotation/",
+      "destination": "/zero-trust-access/management/security/ca-rotation/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/db-ca-migrations/",
+      "destination": "/zero-trust-access/management/security/db-ca-migrations/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/users/",
+      "destination": "/zero-trust-access/rbac-get-started/users/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/uninstall-teleport/",
+      "destination": "/installation/uninstall-teleport/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/self-signed-certs/",
+      "destination": "/zero-trust-access/deploy-a-cluster/self-signed-certs/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/trustedclusters/",
+      "destination": "/zero-trust-access/deploy-a-cluster/trustedclusters/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/tls-routing/",
+      "destination": "/zero-trust-access/deploy-a-cluster/tls-routing/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/troubleshooting/",
+      "destination": "/zero-trust-access/management/diagnostics/troubleshooting/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/backup-restore/",
+      "destination": "/zero-trust-access/deploy-a-cluster/backup-restore/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/proxy-peering/",
+      "destination": "/zero-trust-access/deploy-a-cluster/proxy-peering/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/scaling/",
+      "destination": "/reference/deployment/scaling/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/daemon/",
+      "destination": "/zero-trust-access/management/daemon/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/admin/trusted-cluster-address-lookup/",
+      "destination": "/zero-trust-access/deploy-a-cluster/trustedclusters/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/guides/",
+      "destination": "/zero-trust-access/management/",
+      "permanent": true
+    },
+    {
+      "source": "/zero-trust-access/management/operations/breakglass-access/",
+      "destination": "/zero-trust-access/deploy-a-cluster/breakglass-access/",
+      "permanent": true
+    },
+    {
+      "source": "/connect-your-client/request-access/",
+      "destination": "/connect-your-client/teleport-clients/request-access/",
+      "permanent": true
     }
   ]
 }
diff --git a/docs/cspell.json b/docs/cspell.json
index 781b3e584fcac..e68daef04bc47 100644
--- a/docs/cspell.json
+++ b/docs/cspell.json
@@ -5,6 +5,8 @@
     "AADUSER",
     "ABAC",
     "ABCDEFGHIJKL",
+    "ACCESSTOKEN",
+    "Acking",
     "ADFS",
     "AICPA",
     "AICPA’s",
@@ -15,27 +17,33 @@
     "APPDATA",
     "APPSECRET",
     "AQAB",
+    "AROA123456789AEXAMPLE",
     "AUTHINFO",
     "AWSARN",
     "AWSIIDTTL",
+    "AWX",
     "Aarch",
     "Activ",
     "Addrs",
     "Afax",
     "Agentic",
     "Aqxs",
+    "Authenticode",
     "Authy",
     "BDRVJUSUZ",
     "BSFD",
     "BUCKETNAME",
     "Binm",
+    "breakglass",
     "Brosnan",
+    "CAROOT",
     "CAcreateserial",
     "CCDC",
     "CGNAT",
     "CHANGEID",
     "CHANGEME",
     "CLOUDSDK",
+    "CMVP",
     "CREATEDB",
     "CTAP",
     "CXXXXXXXXX",
@@ -55,9 +63,11 @@
     "Dfumu",
     "Distroless",
     "Divio's",
+    "EADDRINUSE",
     "EBSCSI",
     "ECCP",
     "ECMWF",
+    "EICE",
     "EKCert",
     "ERRO",
     "Elastcsearch",
@@ -83,8 +93,10 @@
     "GCP's",
     "GENPASS",
     "GHES",
+    "GOAWAY",
     "GODEBUG",
     "GOMAXPROCS",
+    "GOMEMLIMIT",
     "GSLB",
     "Gbps",
     "Ghostunnel",
@@ -109,6 +121,7 @@
     "Infosec",
     "Instruqt",
     "Intelli",
+    "Intune",
     "Iqxtr",
     "Istio",
     "JCRP",
@@ -121,6 +134,7 @@
     "Jlbn",
     "Jpji",
     "Jqlang",
+    "JumpCloud",
     "Kanban",
     "Keycloak",
     "Keyspaces",
@@ -148,10 +162,13 @@
     "Mqgcq",
     "Multifactor",
     "Multihost",
+    "mypassword",
     "Mzgz",
+    "NOEXEC",
     "NOFILE",
     "NOKEY",
     "NOPASSWD",
+    "NRPT",
     "NVGJ",
     "Näme",
     "OCID",
@@ -164,6 +181,7 @@
     "OpenAI",
     "Opsgenie",
     "Orapki",
+    "PDU",
     "PFDEBUG",
     "PFSELFTEST",
     "PGCLIENTENCODING",
@@ -171,6 +189,7 @@
     "PGSSLCERT",
     "PGSSLKEY",
     "PGSSLROOTCERT",
+    "PKCE",
     "PKIX",
     "POSIX",
     "POSTALCODE",
@@ -182,6 +201,8 @@
     "Pbbd",
     "Pluggable",
     "Println",
+    "Pulumi",
+    "Pyroscope",
     "Quickstart",
     "Quicktime's",
     "REDISCLI",
@@ -193,6 +214,7 @@
     "Rekor",
     "Relogging",
     "Relogin",
+    "replayable",
     "SAMLIDP",
     "SCIM",
     "SECURITYADMIN",
@@ -201,6 +223,7 @@
     "SLAVEOF",
     "SLES",
     "SLOWLOG",
+    "Snowsight",
     "SPDY",
     "SPIFFE",
     "SQLSTATE",
@@ -212,8 +235,12 @@
     "SUPATH",
     "SVID",
     "SVIDs",
+    "SailPoint",
+    "Sailpoint",
     "Secretless",
+    "setx",
     "Shockbyte",
+    "showcerts",
     "Silverfort's",
     "Slackbot",
     "Sllavd",
@@ -222,6 +249,7 @@
     "Spacelift's",
     "Sprintf",
     "Stackdriver",
+    "Streamable",
     "Svhk",
     "Swic",
     "Swicm",
@@ -248,8 +276,10 @@
     "Uwhp",
     "VPCID",
     "VSVZY",
+    "Valkey",
     "Vhka",
     "Vitess",
+    "VMSS",
     "Vybm",
     "WIMSE",
     "WWFCX",
@@ -293,6 +323,7 @@
     "allkeys",
     "allowdeny",
     "allowedlogins",
+    "alloydb",
     "anonymization",
     "anotheruser",
     "apikey",
@@ -333,13 +364,16 @@
     "awsic",
     "awskms",
     "awsoidc",
+    "awsra",
     "awsuser",
+    "awx",
     "azblob",
     "azidentity",
     "azuread",
     "azuredatabases",
     "azurerm",
     "backdoors",
+    "backdooring",
     "backoff",
     "backported",
     "backporting",
@@ -364,6 +398,8 @@
     "certutil",
     "cfpassword",
     "cfsdf",
+    "cfssl",
+    "cfssljson",
     "cgroups",
     "cgroupv",
     "cgroupv2",
@@ -397,6 +433,7 @@
     "clusterroles",
     "cmdkey",
     "cockroachdb",
+    "codesign",
     "codingllama",
     "compat",
     "compinit",
@@ -404,10 +441,11 @@
     "cond",
     "configmap",
     "configmaps",
+    "configurator",
     "connectionupgrade",
-    "connstring",
     "connectorname",
     "connstring",
+    "contoso",
     "cprops",
     "cqlsh",
     "createkey",
@@ -416,6 +454,7 @@
     "createrow",
     "creds",
     "crond",
+    "crontabs",
     "cryptoprocessor",
     "csrs",
     "customizability",
@@ -429,6 +468,7 @@
     "dbaccessdemo",
     "dbadir",
     "dbadmin",
+    "dbas",
     "dbeaver",
     "dbgroup",
     "dbname",
@@ -439,6 +479,7 @@
     "deletecollection",
     "demodb",
     "deregisters",
+    "desync",
     "devel",
     "develnode",
     "devicetrust",
@@ -486,6 +527,7 @@
     "enzos",
     "errcode",
     "etcdctl",
+    "evtx",
     "exadata",
     "exadatadomain",
     "examplecontainer",
@@ -493,6 +535,7 @@
     "examplestorageaccount",
     "exampletoken",
     "exampleuser",
+    "executionrole",
     "exfiltrated",
     "exfiltration",
     "externaladdress",
@@ -503,6 +546,7 @@
     "fabfc",
     "fakehost",
     "fakekey",
+    "fcontext",
     "fdpass",
     "federationmedata",
     "fedmeatadataxml",
@@ -523,13 +567,17 @@
     "gcloud",
     "gcpproj",
     "gecos",
+    "gencert",
     "genpkey",
     "genrsa",
+    "geoip",
+    "getenforce",
     "getent",
     "getstring",
     "gitref",
     "glmhf",
     "gncm",
+    "goaway",
     "googleoidc",
     "googleusercontent",
     "goroutines",
@@ -542,18 +590,22 @@
     "grav",
     "groupclaim",
     "gserviceaccount",
+    "goexit",
     "gslb",
     "gsutil",
     "gworkspace",
     "hashfile",
     "hashicorp",
     "healthcheck",
+    "healthchecker",
     "healthchecks",
     "healthz",
     "highavailability",
     "highavailabilitycertmanager",
     "highavailabilitycertmanageraddcommonname",
     "hiro",
+    "homelab",
+    "homelabs",
     "hostcert",
     "hostdb",
     "hostedzone",
@@ -592,6 +644,7 @@
     "jsmith",
     "jsonencode",
     "jsonpath",
+    "jumpcloud",
     "jumphost",
     "jwks",
     "jwkset",
@@ -618,6 +671,8 @@
     "kubernetesdiscovery",
     "kvno",
     "lastname",
+    "langchain",
+    "langgraph",
     "ldapsearch",
     "leaderelection",
     "leafcluster",
@@ -628,11 +683,13 @@
     "libgcc",
     "libm",
     "libpq",
+    "lifecycle",
     "livez",
     "lmnop",
     "loadbalancer",
     "localca",
     "localinstall",
+    "localproxy",
     "loginerrortroubleshooting",
     "loginrule",
     "loginrules",
@@ -653,6 +710,7 @@
     "masterauth",
     "masteruser",
     "mattermosttokenfromsecret",
+    "maxmind",
     "mcache",
     "memlock",
     "memorydb",
@@ -667,9 +725,12 @@
     "mkstore",
     "mlock",
     "mlockall",
+    "mmdb",
+    "modelcontextprotocol",
     "mongodbatlas",
     "mongosh",
     "mpghq",
+    "mpstat",
     "msapi",
     "msclmd",
     "mspan",
@@ -678,6 +739,7 @@
     "mtls",
     "multiaccount",
     "multistep",
+    "mvcc",
     "myapp",
     "myauth",
     "mybot",
@@ -737,9 +799,13 @@
     "nologo",
     "nonprod",
     "noout",
+    "noprofile",
     "noprompt",
+    "noqa",
+    "norc",
     "nosql",
     "notifempty",
+    "notionhq",
     "nowait",
     "ntauth",
     "nvme",
@@ -774,14 +840,18 @@
     "pasteable",
     "persistentvolume",
     "persistentvolumeclaim",
+    "persistentvolumes",
     "pgaadauth",
     "pgbouncer",
     "pgpass",
     "pguser",
+    "pipx",
     "pidof",
+    "pkce",
     "pkill",
     "pkinit",
     "plugindata",
+    "policycoreutils",
     "portforward",
     "postgresqlselfhosted",
     "pprof",
@@ -853,6 +923,9 @@
     "rootfully",
     "rootlessly",
     "rtrzn",
+    "runbook",
+    "runbooks",
+    "runcmd",
     "runcommand",
     "runscript",
     "runtimes",
@@ -867,6 +940,7 @@
     "sandboxbd",
     "sasl",
     "scrollback",
+    "sealert",
     "seccomp",
     "secretname",
     "selectnongalleryapp",
@@ -874,16 +948,23 @@
     "selfhosted",
     "selfsubjectaccessreviews",
     "selfsubjectrulesreviews",
+    "semanage",
+    "semodule",
     "sendall",
     "seqno",
+    "serverlesscache",
     "serviceaccount",
     "serviceaccountname",
     "serviceaccounts",
     "serviceacct",
     "servicecfg",
     "serviceid",
+    "serviceusage",
     "sess",
     "session",
+    "sestatus",
+    "setenforce",
+    "setroubleshoot",
     "setspn",
     "sharded",
     "signup",
@@ -917,6 +998,7 @@
     "statefulset",
     "storageclasses",
     "storageenabled",
+    "streamable",
     "strslice",
     "structs",
     "subca",
@@ -931,6 +1013,7 @@
     "sysdba",
     "sysvinit",
     "tadmin",
+    "taskrole",
     "tbot",
     "tbotrole",
     "tcpip",
@@ -951,7 +1034,10 @@
     "teleportgithubconnector",
     "teleporthostname",
     "teleportinfra",
+    "teleportmwi",
     "teleportopensshserverv",
+    "teleportprovisiontoken",
+    "teleportprovisiontokenv2",
     "teleportproxy",
     "teleportrolesv",
     "teleportrolev",
@@ -968,6 +1054,7 @@
     "timechart",
     "timedatectl",
     "timekey",
+    "timesearch",
     "tlogs",
     "tlscacerts",
     "tlscert",
@@ -1017,11 +1104,14 @@
     "uuidgen",
     "viewstore",
     "vkxz",
+    "vmss",
     "vmcopy",
     "vmjm",
     "vnet",
     "vnetd",
+    "vsts",
     "vtgate",
+    "Vg5R6vpZffg",
     "walkthrough",
     "watcherjob",
     "webapi",
@@ -1042,6 +1132,7 @@
     "winserver",
     "workgroups",
     "wtmp",
+    "wtmpdb",
     "xample",
     "xauth",
     "xclip",
@@ -1061,10 +1152,14 @@
     "zxvf",
     "zztop"
   ],
-  "flagWords": ["hte"],
+  "flagWords": [
+    "hte"
+  ],
   "ignorePaths": [
-    "**/reference/terraform-provider/**",
-    "**/reference/operator-resources/**",
-    "**/includes/reference/code-blocks-no-cspell/**"
+    "**/includes/access-monitoring-events.mdx",
+    "**/includes/reference/code-blocks-no-cspell/**",
+    "**/reference/infrastructure-as-code/operator-resources/**",
+    "**/reference/infrastructure-as-code/teleport-resources/**",
+    "**/reference/infrastructure-as-code/terraform-provider/**"
   ]
-}
+}
\ No newline at end of file
diff --git a/docs/img/access-controls/access-lists/add-member.png b/docs/img/access-controls/access-lists/add-member.png
index 66218c87aff7d..70ea68557da55 100644
Binary files a/docs/img/access-controls/access-lists/add-member.png and b/docs/img/access-controls/access-lists/add-member.png differ
diff --git a/docs/img/access-controls/access-lists/create-new-access-list.png b/docs/img/access-controls/access-lists/create-new-access-list.png
index 91f8e12b9dbfe..99fb91762dd2e 100644
Binary files a/docs/img/access-controls/access-lists/create-new-access-list.png and b/docs/img/access-controls/access-lists/create-new-access-list.png differ
diff --git a/docs/img/access-controls/access-lists/create-test-user.png b/docs/img/access-controls/access-lists/create-test-user.png
index 807dac48063e1..164e2987bfb41 100644
Binary files a/docs/img/access-controls/access-lists/create-test-user.png and b/docs/img/access-controls/access-lists/create-test-user.png differ
diff --git a/docs/img/access-controls/access-lists/debug-app.png b/docs/img/access-controls/access-lists/debug-app.png
index 29b24088e10c6..d5bd2ae3aea8f 100644
Binary files a/docs/img/access-controls/access-lists/debug-app.png and b/docs/img/access-controls/access-lists/debug-app.png differ
diff --git a/docs/img/access-controls/access-lists/fill-out-access-list-fields.png b/docs/img/access-controls/access-lists/fill-out-access-list-fields.png
index fcd52798aa1e6..bde7e0de5773c 100644
Binary files a/docs/img/access-controls/access-lists/fill-out-access-list-fields.png and b/docs/img/access-controls/access-lists/fill-out-access-list-fields.png differ
diff --git a/docs/img/access-controls/access-lists/select-owner.png b/docs/img/access-controls/access-lists/select-owner.png
index 87b93e189a42c..1023a9d4e1c54 100644
Binary files a/docs/img/access-controls/access-lists/select-owner.png and b/docs/img/access-controls/access-lists/select-owner.png differ
diff --git a/docs/img/access-controls/automatic-reviews/create-automatic-review-rule.png b/docs/img/access-controls/automatic-reviews/create-automatic-review-rule.png
deleted file mode 100644
index 109d73522615d..0000000000000
Binary files a/docs/img/access-controls/automatic-reviews/create-automatic-review-rule.png and /dev/null differ
diff --git a/docs/img/access-controls/automatic-reviews/schedule-editor.png b/docs/img/access-controls/automatic-reviews/schedule-editor.png
new file mode 100644
index 0000000000000..5b2ee0def76af
Binary files /dev/null and b/docs/img/access-controls/automatic-reviews/schedule-editor.png differ
diff --git a/docs/img/access-controls/automatic-reviews/users-edit.png b/docs/img/access-controls/automatic-reviews/users-edit.png
index 6f665e17f0bcb..ab78134e03ead 100644
Binary files a/docs/img/access-controls/automatic-reviews/users-edit.png and b/docs/img/access-controls/automatic-reviews/users-edit.png differ
diff --git a/docs/img/access-controls/automatic-reviews/view-access-requests.png b/docs/img/access-controls/automatic-reviews/view-access-requests.png
deleted file mode 100644
index 4b148b3cce47d..0000000000000
Binary files a/docs/img/access-controls/automatic-reviews/view-access-requests.png and /dev/null differ
diff --git a/docs/img/access-controls/device-trust/jamf-setup-1.png b/docs/img/access-controls/device-trust/jamf-setup-1.png
index 473c83906e787..9b8475b446f4d 100644
Binary files a/docs/img/access-controls/device-trust/jamf-setup-1.png and b/docs/img/access-controls/device-trust/jamf-setup-1.png differ
diff --git a/docs/img/access-controls/device-trust/jamf-setup-2.png b/docs/img/access-controls/device-trust/jamf-setup-2.png
index fb376dee8e5ae..9c3d39b86d1e4 100644
Binary files a/docs/img/access-controls/device-trust/jamf-setup-2.png and b/docs/img/access-controls/device-trust/jamf-setup-2.png differ
diff --git a/docs/img/access-controls/dual-authz/mattermost-0-enable.png b/docs/img/access-controls/dual-authz/mattermost-0-enable.png
index 3d3e7e915a3b6..f311149bfc1d7 100644
Binary files a/docs/img/access-controls/dual-authz/mattermost-0-enable.png and b/docs/img/access-controls/dual-authz/mattermost-0-enable.png differ
diff --git a/docs/img/access-controls/dual-authz/mattermost-1-bot.png b/docs/img/access-controls/dual-authz/mattermost-1-bot.png
index 5c44f42646423..e96f6e7d91eb3 100644
Binary files a/docs/img/access-controls/dual-authz/mattermost-1-bot.png and b/docs/img/access-controls/dual-authz/mattermost-1-bot.png differ
diff --git a/docs/img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png b/docs/img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png
index 5473af4dfae5d..cb54e1a44e8b6 100644
Binary files a/docs/img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png and b/docs/img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png differ
diff --git a/docs/img/access-controls/dual-authz/mattermost-5-request.png b/docs/img/access-controls/dual-authz/mattermost-5-request.png
index 0f8c2d22eecae..4b300d62c6c42 100644
Binary files a/docs/img/access-controls/dual-authz/mattermost-5-request.png and b/docs/img/access-controls/dual-authz/mattermost-5-request.png differ
diff --git a/docs/img/access-controls/dual-authz/role-new-request.png b/docs/img/access-controls/dual-authz/role-new-request.png
index e9248e8705d2e..3087f5b745c92 100644
Binary files a/docs/img/access-controls/dual-authz/role-new-request.png and b/docs/img/access-controls/dual-authz/role-new-request.png differ
diff --git a/docs/img/access-controls/hardware-key-support/agent.png b/docs/img/access-controls/hardware-key-support/agent.png
index 3bff22c1dbf50..c84195e5a142f 100644
Binary files a/docs/img/access-controls/hardware-key-support/agent.png and b/docs/img/access-controls/hardware-key-support/agent.png differ
diff --git a/docs/img/access-controls/idp-graph.png b/docs/img/access-controls/idp-graph.png
index c69dad4a64697..29daa969b277f 100644
Binary files a/docs/img/access-controls/idp-graph.png and b/docs/img/access-controls/idp-graph.png differ
diff --git a/docs/img/access-controls/saml-idp/access-app.png b/docs/img/access-controls/saml-idp/access-app.png
deleted file mode 100644
index 28a66b3efa9a7..0000000000000
Binary files a/docs/img/access-controls/saml-idp/access-app.png and /dev/null differ
diff --git a/docs/img/access-controls/saml-idp/add-entity-descriptor.png b/docs/img/access-controls/saml-idp/add-entity-descriptor.png
deleted file mode 100644
index efb69b0fff918..0000000000000
Binary files a/docs/img/access-controls/saml-idp/add-entity-descriptor.png and /dev/null differ
diff --git a/docs/img/access-controls/saml-idp/enroll-saml-app.png b/docs/img/access-controls/saml-idp/enroll-saml-app.png
deleted file mode 100644
index f6ddb26df16bf..0000000000000
Binary files a/docs/img/access-controls/saml-idp/enroll-saml-app.png and /dev/null differ
diff --git a/docs/img/access-controls/saml-idp/gcp-workforce/gcp-workforce-tile.png b/docs/img/access-controls/saml-idp/gcp-workforce/gcp-workforce-tile.png
index b0a0b4ac38502..b793180c0e941 100644
Binary files a/docs/img/access-controls/saml-idp/gcp-workforce/gcp-workforce-tile.png and b/docs/img/access-controls/saml-idp/gcp-workforce/gcp-workforce-tile.png differ
diff --git a/docs/img/access-controls/saml-idp/gcp-workforce/generate-command.png b/docs/img/access-controls/saml-idp/gcp-workforce/generate-command.png
index 4521de5d16f10..ea9ce06a2a1e6 100644
Binary files a/docs/img/access-controls/saml-idp/gcp-workforce/generate-command.png and b/docs/img/access-controls/saml-idp/gcp-workforce/generate-command.png differ
diff --git a/docs/img/access-controls/saml-idp/iamshowcase-protected-page.png b/docs/img/access-controls/saml-idp/iamshowcase-protected-page.png
deleted file mode 100644
index 2574ff7b29111..0000000000000
Binary files a/docs/img/access-controls/saml-idp/iamshowcase-protected-page.png and /dev/null differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/add-new-resource.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/add-new-resource.png
index 0fd1808aeeff1..652387e620735 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/add-new-resource.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/add-new-resource.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-idp.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-idp.png
index 8f0e9d777db9c..592af71e1babc 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-idp.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-idp.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-new-domain.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-new-domain.png
index 81b8a4d8f0a48..eb7eb55c5cf49 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-new-domain.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-add-new-domain.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-group.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-group.png
index b19423d1fa91f..9ad80cbc22865 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-group.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-group.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-resource-group.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-resource-group.png
index cbc67e516efa8..51d27a7a90287 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-resource-group.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-create-resource-group.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-invite-user.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-invite-user.png
index 011932974c2ef..2f69c18e94538 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-invite-user.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-invite-user.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-link-subscription.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-link-subscription.png
index 3ef0ab1160c89..059d7deab5f90 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-link-subscription.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-link-subscription.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-resource-group-iam.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-resource-group-iam.png
index 043da73a73408..58c79c82a18e0 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-resource-group-iam.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-resource-group-iam.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-role-assignment.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-role-assignment.png
index c3c3a27e4059d..f05e0030776bb 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-role-assignment.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-role-assignment.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-update-domain.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-update-domain.png
index afeab4e9dc252..636c3066aa293 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-update-domain.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-update-domain.png differ
diff --git a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-user-consent.png b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-user-consent.png
index 68237ab22d883..a9c1d6dab09f6 100644
Binary files a/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-user-consent.png and b/docs/img/access-controls/saml-idp/ms-entra-external-id/entra-user-consent.png differ
diff --git a/docs/img/access-controls/saml-idp/protected-page-access.png b/docs/img/access-controls/saml-idp/protected-page-access.png
deleted file mode 100644
index a7e5682a6053c..0000000000000
Binary files a/docs/img/access-controls/saml-idp/protected-page-access.png and /dev/null differ
diff --git a/docs/img/access-controls/saml-idp/rsa-simplesp-protected-page.png b/docs/img/access-controls/saml-idp/rsa-simplesp-protected-page.png
new file mode 100644
index 0000000000000..2412258e9ddef
Binary files /dev/null and b/docs/img/access-controls/saml-idp/rsa-simplesp-protected-page.png differ
diff --git a/docs/img/access-controls/saml-idp/step-1-create-role-app-label.png b/docs/img/access-controls/saml-idp/step-1-create-role-app-label.png
new file mode 100644
index 0000000000000..29409c483c6fa
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-1-create-role-app-label.png differ
diff --git a/docs/img/access-controls/saml-idp/step-1-create-role-saml-resource.png b/docs/img/access-controls/saml-idp/step-1-create-role-saml-resource.png
new file mode 100644
index 0000000000000..eb8397b157521
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-1-create-role-saml-resource.png differ
diff --git a/docs/img/access-controls/saml-idp/step-2-copy-metadata.png b/docs/img/access-controls/saml-idp/step-2-copy-metadata.png
new file mode 100644
index 0000000000000..7476e622ef141
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-2-copy-metadata.png differ
diff --git a/docs/img/access-controls/saml-idp/step-2-find-saml-discover-tile.png b/docs/img/access-controls/saml-idp/step-2-find-saml-discover-tile.png
new file mode 100644
index 0000000000000..e7703fb0791a2
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-2-find-saml-discover-tile.png differ
diff --git a/docs/img/access-controls/saml-idp/step-3-add-service-provider-ed.png b/docs/img/access-controls/saml-idp/step-3-add-service-provider-ed.png
new file mode 100644
index 0000000000000..17c4345f96d92
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-3-add-service-provider-ed.png differ
diff --git a/docs/img/access-controls/saml-idp/step-3-add-service-provider.png b/docs/img/access-controls/saml-idp/step-3-add-service-provider.png
new file mode 100644
index 0000000000000..36397e5b9578d
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-3-add-service-provider.png differ
diff --git a/docs/img/access-controls/saml-idp/step-4-login.png b/docs/img/access-controls/saml-idp/step-4-login.png
new file mode 100644
index 0000000000000..c48c8a2579585
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-4-login.png differ
diff --git a/docs/img/access-controls/saml-idp/step-4-service-provider-authenticated-page.png b/docs/img/access-controls/saml-idp/step-4-service-provider-authenticated-page.png
new file mode 100644
index 0000000000000..4c9d4494a5bb5
Binary files /dev/null and b/docs/img/access-controls/saml-idp/step-4-service-provider-authenticated-page.png differ
diff --git a/docs/img/access-controls/saml-idp/teleport-idp-metadata.png b/docs/img/access-controls/saml-idp/teleport-idp-metadata.png
deleted file mode 100644
index 4b02f5d5b0571..0000000000000
Binary files a/docs/img/access-controls/saml-idp/teleport-idp-metadata.png and /dev/null differ
diff --git a/docs/img/access-graph/alerts.png b/docs/img/access-graph/alerts.png
new file mode 100644
index 0000000000000..808d784e72909
Binary files /dev/null and b/docs/img/access-graph/alerts.png differ
diff --git a/docs/img/access-graph/aws/eks-audit-settings.png b/docs/img/access-graph/aws/eks-audit-settings.png
new file mode 100644
index 0000000000000..2800035fe48c6
Binary files /dev/null and b/docs/img/access-graph/aws/eks-audit-settings.png differ
diff --git a/docs/img/access-graph/aws/sns-settings.png b/docs/img/access-graph/aws/sns-settings.png
new file mode 100644
index 0000000000000..cc3e27af4c56a
Binary files /dev/null and b/docs/img/access-graph/aws/sns-settings.png differ
diff --git a/docs/img/access-graph/aws/trail-settings.png b/docs/img/access-graph/aws/trail-settings.png
new file mode 100644
index 0000000000000..3b3c1d2a97a5a
Binary files /dev/null and b/docs/img/access-graph/aws/trail-settings.png differ
diff --git a/docs/img/access-graph/graph-explorer-ui.png b/docs/img/access-graph/graph-explorer-ui.png
new file mode 100644
index 0000000000000..2df44cb08f5f9
Binary files /dev/null and b/docs/img/access-graph/graph-explorer-ui.png differ
diff --git a/docs/img/access-graph/integrations.png b/docs/img/access-graph/integrations.png
deleted file mode 100644
index e12762cbb3b3f..0000000000000
Binary files a/docs/img/access-graph/integrations.png and /dev/null differ
diff --git a/docs/img/access-graph/investigate.png b/docs/img/access-graph/investigate.png
new file mode 100644
index 0000000000000..88a77d8fcaf4f
Binary files /dev/null and b/docs/img/access-graph/investigate.png differ
diff --git a/docs/img/access-monitoring/exec_passwd.png b/docs/img/access-monitoring/exec_passwd.png
index 07c9b6ee71a92..b42e30b4b43e7 100644
Binary files a/docs/img/access-monitoring/exec_passwd.png and b/docs/img/access-monitoring/exec_passwd.png differ
diff --git a/docs/img/add-resources.png b/docs/img/add-resources.png
deleted file mode 100644
index ed17f6eef9f3d..0000000000000
Binary files a/docs/img/add-resources.png and /dev/null differ
diff --git a/docs/img/adfs-add-provider-trust.png b/docs/img/adfs-add-provider-trust.png
index 4822b79ed16f8..fa906b9a5012f 100644
Binary files a/docs/img/adfs-add-provider-trust.png and b/docs/img/adfs-add-provider-trust.png differ
diff --git a/docs/img/adfs-add-teleport-cert.png b/docs/img/adfs-add-teleport-cert.png
index 7b38942ee2d5a..6f3d9e9b32cfa 100644
Binary files a/docs/img/adfs-add-teleport-cert.png and b/docs/img/adfs-add-teleport-cert.png differ
diff --git a/docs/img/agent-pool-diagram.png b/docs/img/agent-pool-diagram.png
index 291fdbc7cc2f3..07d75d87eb2d6 100644
Binary files a/docs/img/agent-pool-diagram.png and b/docs/img/agent-pool-diagram.png differ
diff --git a/docs/img/application-access/architecture.svg b/docs/img/application-access/architecture.svg
deleted file mode 100644
index 2b6e7d9f6f722..0000000000000
--- a/docs/img/application-access/architecture.svg
+++ /dev/null
@@ -1,11336 +0,0 @@
-<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="100%" viewBox="0 0 1631 854" enable-background="new 0 0 1631 854" xml:space="preserve">
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1085.000000,855.000000 
-	C723.333313,855.000000 362.166656,855.000000 1.000000,855.000000 
-	C1.000000,570.333313 1.000000,285.666656 1.000000,1.000000 
-	C544.666687,1.000000 1088.333374,1.000000 1632.000000,1.000000 
-	C1632.000000,285.666656 1632.000000,570.333313 1632.000000,855.000000 
-	C1449.833374,855.000000 1267.666626,855.000000 1085.000000,855.000000 
-M355.219116,234.959305 
-	C355.219116,234.959305 355.172485,235.004486 354.508179,235.122375 
-	C351.300476,236.287979 350.861725,234.377548 350.801727,231.876663 
-	C350.746582,229.578949 350.536346,227.284927 350.385010,224.836792 
-	C348.244202,226.124603 346.786011,227.001785 345.163483,227.188797 
-	C339.958405,222.389877 336.602051,223.828751 333.609070,232.271973 
-	C331.113800,230.944717 328.663513,229.641388 326.213226,228.338074 
-	C326.394775,227.891220 326.576294,227.444351 326.757843,226.997498 
-	C328.670044,227.356964 330.582245,227.716431 333.167786,228.202454 
-	C332.536194,227.035507 332.317719,226.102371 331.949860,226.039200 
-	C329.761536,225.663391 327.510315,225.192429 325.342072,225.399979 
-	C324.534088,225.477325 323.093719,227.956161 323.307465,228.215836 
-	C324.552551,229.728577 326.193512,230.919357 327.721954,232.193420 
-	C328.514832,232.854309 329.351379,233.462753 330.168213,234.094879 
-	C330.082764,234.522324 329.997314,234.949753 329.911865,235.377197 
-	C324.895752,235.377197 319.875641,235.472900 314.868103,235.265961 
-	C314.179108,235.237488 313.552216,233.706909 312.542725,232.421005 
-	C315.960815,232.158203 318.679352,231.949188 321.561676,231.727585 
-	C321.438049,227.719101 320.023682,224.032974 316.363373,224.980728 
-	C311.871948,226.143707 307.567535,224.745270 303.669159,225.202042 
-	C303.669159,229.692810 303.669159,233.684860 303.669159,238.651947 
-	C307.605957,234.753296 302.782593,227.811646 308.676178,226.922073 
-	C310.367493,230.814926 311.058807,234.845215 313.444672,236.994003 
-	C314.904724,238.309021 318.965881,236.736008 321.858887,236.459991 
-	C327.678802,239.156570 329.154327,239.076874 334.390625,234.648636 
-	C335.627930,235.521851 336.823456,236.365555 338.345215,237.491272 
-	C338.345215,237.491272 338.774750,237.531342 339.403748,237.809082 
-	C340.875397,237.392365 342.347015,236.975632 344.313568,236.219833 
-	C344.720001,235.528854 345.126434,234.837875 346.184998,233.651154 
-	C346.730469,233.798218 347.668457,233.818649 347.762878,234.111237 
-	C349.321381,238.941879 352.470337,238.453354 356.409515,237.195084 
-	C357.034515,236.784210 357.659485,236.373337 358.446930,235.327438 
-	C358.391296,234.897461 358.335663,234.467484 358.424377,233.147171 
-	C358.333313,230.742569 358.242249,228.337982 357.841827,225.295685 
-	C353.611389,226.542969 356.275391,229.661331 355.775391,232.665619 
-	C355.692291,233.138901 355.609192,233.612183 355.320099,234.328781 
-	C355.239624,234.525391 355.225616,234.726532 355.219116,234.959305 
-M329.592712,172.604218 
-	C329.514740,173.014099 329.436768,173.423981 329.196625,173.754761 
-	C329.196625,173.754761 329.052155,173.862869 328.323273,173.834579 
-	C327.143829,174.031250 325.964417,174.227905 324.106476,174.544296 
-	C323.396545,175.362015 322.686615,176.179733 321.741119,177.652344 
-	C321.820953,178.102280 321.900787,178.552216 322.022980,179.698120 
-	C323.353180,180.402267 324.683380,181.106400 326.856689,181.850906 
-	C327.563232,181.426331 328.269775,181.001770 329.858734,180.893295 
-	C332.350128,181.216232 334.841492,181.539154 337.963379,181.943802 
-	C337.963379,179.159805 337.647614,176.976013 338.073456,174.947922 
-	C338.361206,173.577576 339.693665,172.426620 340.558807,171.177536 
-	C341.298981,172.408264 342.409973,173.559021 342.696503,174.887589 
-	C343.184296,177.149200 343.153595,179.522629 343.340759,181.849075 
-	C348.517517,172.373856 345.817047,168.707657 334.989563,169.506042 
-	C334.989563,172.952789 334.989563,176.468887 334.989563,181.150635 
-	C333.460449,179.435562 332.830811,178.729309 332.330048,177.344543 
-	C332.280548,176.889160 332.231049,176.433792 332.351471,175.331772 
-	C332.293152,174.893616 332.234833,174.455475 332.289642,173.336563 
-	C332.188354,172.891449 332.087036,172.446320 331.993073,171.338928 
-	C330.992676,170.592529 329.992279,169.846130 328.260590,168.898758 
-	C327.507843,168.942169 326.755096,168.985580 325.244019,169.007767 
-	C324.338104,169.836899 323.432159,170.666031 322.526245,171.495163 
-	C322.810638,171.853058 323.095001,172.210953 323.379395,172.568848 
-	C324.250214,172.074051 325.121033,171.579269 326.754486,171.020813 
-	C327.510529,171.099945 328.266571,171.179062 329.147736,171.544189 
-	C329.237915,171.745270 329.384399,171.889023 329.592712,172.604218 
-M1586.789673,146.051727 
-	C1588.022217,145.701981 1589.254761,145.352234 1590.904297,144.974060 
-	C1591.259766,144.779175 1591.615356,144.584290 1592.656982,143.983795 
-	C1593.419434,141.580948 1594.837891,139.180450 1594.846436,136.774918 
-	C1594.985596,97.814583 1594.953613,58.853596 1594.940308,19.892769 
-	C1594.937866,12.424071 1592.521606,9.971891 1585.215942,9.970057 
-	C1546.255127,9.960282 1507.294312,9.960579 1468.333496,9.968872 
-	C1459.598145,9.970731 1458.052734,11.573625 1458.048462,20.580799 
-	C1458.039917,38.895718 1458.080811,57.210808 1457.993896,75.525307 
-	C1457.984985,77.401985 1457.246338,79.275185 1456.238647,80.811447 
-	C1449.964111,78.371506 1443.689697,75.931564 1437.030273,73.341965 
-	C1436.533325,75.798714 1436.220947,77.342926 1435.931641,78.773140 
-	C1423.366943,80.638008 1423.148438,80.899727 1423.148315,93.728783 
-	C1423.147827,123.035400 1423.157104,152.342026 1423.139648,181.648636 
-	C1423.135620,188.488083 1422.202881,189.402328 1415.311646,189.426468 
-	C1408.484985,189.450378 1401.656616,189.335129 1394.832520,189.464050 
-	C1393.662720,189.486160 1392.510376,190.425293 1391.349976,190.940811 
-	C1392.447144,191.600632 1393.530029,192.802475 1394.643555,192.831696 
-	C1401.466064,193.010620 1408.295410,192.927063 1415.122559,192.924988 
-	C1424.730347,192.922058 1426.905396,190.783722 1426.907959,181.254593 
-	C1426.916138,151.115402 1426.905029,120.976204 1426.913330,90.837013 
-	C1426.915405,83.411705 1428.461060,82.163780 1436.048706,83.496201 
-	C1436.276855,85.037498 1436.511353,86.622017 1436.827148,88.755997 
-	C1443.722290,86.361038 1450.271729,84.086113 1457.497437,82.371956 
-	C1457.680298,84.163544 1458.017456,85.954750 1458.021851,87.746773 
-	C1458.062134,104.184105 1458.004517,120.621719 1458.064087,137.058929 
-	C1458.088379,143.767303 1459.248291,144.966980 1466.502808,146.559525 
-	C1467.691284,146.606003 1468.879639,146.652466 1470.988037,146.820221 
-	C1483.149292,146.845978 1495.310547,146.909241 1507.471802,146.889648 
-	C1532.625244,146.849106 1557.778687,146.764465 1583.598389,146.864456 
-	C1584.401855,146.589600 1585.205200,146.314758 1586.789673,146.051727 
-M766.161804,418.450317 
-	C765.436340,418.633118 764.710815,418.815918 763.780762,419.467346 
-	C763.820679,419.633057 763.860596,419.798767 763.670288,420.562347 
-	C763.770752,422.045197 763.871277,423.528046 763.726379,425.653656 
-	C763.663330,426.107208 763.600281,426.560730 763.192566,427.392700 
-	C759.737732,429.646027 758.853699,427.854004 758.745422,424.632080 
-	C758.668030,422.329285 758.432495,420.031860 758.267456,417.732025 
-	C757.445923,417.778168 756.624329,417.824310 755.802795,417.870453 
-	C755.802795,420.703522 755.584412,423.557770 755.856750,426.364410 
-	C756.216980,430.076355 758.330139,431.607849 762.093323,430.485809 
-	C763.016663,430.210510 764.017395,430.194672 765.665588,430.088989 
-	C765.848877,429.701965 766.032227,429.314941 766.403198,428.303406 
-	C766.348389,427.876038 766.293579,427.448700 766.384155,426.136383 
-	C766.311523,423.750885 766.238831,421.365356 766.161804,418.450317 
-M530.478149,722.505981 
-	C530.652405,722.006958 530.826660,721.507935 531.894043,721.055359 
-	C534.722473,720.755127 537.550964,720.454956 540.537781,720.137939 
-	C540.866516,722.065308 541.270996,724.436401 541.675476,726.807556 
-	C542.209656,726.778992 542.743896,726.750427 543.278076,726.721863 
-	C543.446899,725.063477 543.346008,723.316833 543.852539,721.768982 
-	C544.493225,719.811157 545.628418,718.015198 546.550354,716.149414 
-	C547.255188,717.921448 548.113098,719.650879 548.620544,721.477783 
-	C549.100159,723.204590 549.211609,725.033691 549.484985,726.817810 
-	C554.026062,716.504883 551.643677,713.458862 541.318420,714.603882 
-	C540.928467,716.068481 540.538574,717.533081 540.435608,717.919800 
-	C537.714050,716.476929 535.285278,714.493835 532.610107,714.071533 
-	C531.318420,713.867615 529.563293,716.599182 527.751587,718.815796 
-	C527.845398,720.222534 527.939148,721.629333 527.412354,723.744873 
-	C525.663147,722.656921 523.914001,721.568970 522.022766,720.392639 
-	C523.743286,717.934326 524.918396,716.255310 526.093567,714.576233 
-	C525.856079,714.283264 525.618652,713.990234 525.381226,713.697266 
-	C523.739868,714.675720 522.098572,715.654175 520.082642,716.855957 
-	C519.430847,714.046692 518.871521,711.635864 518.312134,709.225037 
-	C517.873718,709.311340 517.435303,709.397583 516.996887,709.483887 
-	C516.996887,715.203247 516.996887,720.922668 516.996887,726.642029 
-	C517.352356,726.697327 517.707886,726.752563 518.063354,726.807861 
-	C518.789978,725.422791 519.516602,724.037781 520.282166,722.578491 
-	C522.234497,724.302673 523.854858,725.733704 525.589844,727.265930 
-	C526.606567,725.395630 527.280457,724.156006 528.018005,723.207275 
-	C528.018005,723.207275 528.255737,723.385437 528.313049,723.672913 
-	C528.313049,723.672913 528.469971,723.920410 528.740356,724.656555 
-	C533.202515,728.177490 535.550171,727.966614 538.075378,723.635742 
-	C535.556641,723.635742 533.142517,723.635742 530.676453,723.322815 
-	C530.676453,723.322815 530.487549,723.066284 530.478149,722.505981 
-M1047.901001,742.059509 
-	C1048.590942,742.059448 1049.281006,742.059387 1050.160889,742.931030 
-	C1050.194580,745.219055 1049.952759,747.554138 1050.333984,749.782715 
-	C1050.777832,752.377136 1052.151001,754.005005 1055.756348,752.055664 
-	C1058.167480,753.168152 1059.602051,752.763000 1059.460815,749.741516 
-	C1059.398804,748.415955 1059.132446,746.967102 1059.554199,745.786987 
-	C1060.032593,744.448425 1061.178101,743.348267 1062.033569,742.144531 
-	C1062.757690,743.374512 1063.856201,744.529114 1064.122437,745.851318 
-	C1064.575195,748.099731 1064.504272,750.453613 1064.653442,752.763184 
-	C1069.462280,744.957153 1067.310059,740.074951 1060.287842,739.508179 
-	C1059.626953,738.057251 1058.966064,736.606323 1058.316406,735.179810 
-	C1056.532471,737.186890 1055.255859,738.623047 1053.963135,740.008362 
-	C1053.963135,740.008362 1053.920044,740.039856 1053.496094,739.573853 
-	C1053.004883,738.979431 1052.513550,738.385010 1051.377930,737.787170 
-	C1050.909180,738.491150 1050.440430,739.195190 1049.220459,740.123230 
-	C1048.463379,740.177795 1047.706177,740.232361 1046.513306,740.033142 
-	C1046.351929,740.080383 1046.190552,740.127625 1045.204102,740.209900 
-	C1039.973877,738.553589 1041.125122,743.853638 1039.339722,746.032349 
-	C1037.920776,743.803955 1036.679443,741.854431 1035.437988,739.904907 
-	C1034.015015,742.117432 1032.592163,744.329956 1031.308472,746.325928 
-	C1030.487183,744.321594 1029.492798,741.894653 1028.498413,739.467712 
-	C1027.779785,739.738708 1027.061157,740.009644 1026.342651,740.280579 
-	C1027.424316,743.980103 1028.444946,747.699646 1029.646973,751.359558 
-	C1029.850464,751.979248 1030.965088,752.837646 1031.429077,752.715210 
-	C1032.241943,752.500732 1033.164795,751.746704 1033.525269,750.976807 
-	C1034.224121,749.484253 1034.564941,747.824036 1035.393677,745.129211 
-	C1036.092163,747.522583 1036.279419,748.696167 1036.775757,749.719971 
-	C1037.306519,750.814758 1038.128662,751.768311 1038.823730,752.783386 
-	C1039.745972,751.796631 1040.913574,750.941162 1041.529785,749.790466 
-	C1042.336304,748.284363 1042.707153,746.544922 1043.554688,744.056335 
-	C1044.536377,747.516174 1045.214478,749.905457 1046.824219,752.119385 
-	C1047.003052,748.937866 1047.181885,745.756409 1047.901001,742.059509 
-M492.083160,178.895309 
-	C491.732971,178.923538 491.382751,178.951767 490.850708,178.326782 
-	C488.660217,174.541473 485.307922,174.652603 483.228760,177.520203 
-	C482.138336,179.024139 483.171173,182.649384 484.240936,184.827606 
-	C484.624390,185.608383 487.932404,184.952835 489.905640,184.952835 
-	C489.841370,184.389267 489.777100,183.825684 489.712799,183.262115 
-	C488.330750,183.262115 486.948700,183.262115 485.566650,183.262115 
-	C485.547760,183.042404 485.528839,182.822693 485.509918,182.602982 
-	C487.254822,181.994232 488.999756,181.385498 491.369080,180.902893 
-	C491.782227,180.989059 492.195374,181.075226 492.716339,181.945206 
-	C493.192352,182.947586 493.668365,183.949966 494.144318,184.952347 
-	C494.575684,184.028076 495.007019,183.103806 495.949310,182.102585 
-	C496.292572,182.072678 496.635803,182.042786 497.165070,182.703003 
-	C499.355682,183.680176 501.546326,184.657349 503.736938,185.634521 
-	C504.478180,183.472458 505.661682,181.332886 505.773346,179.138779 
-	C505.828827,178.048676 503.641876,175.748672 502.946381,175.921005 
-	C500.839203,176.443100 498.964966,177.905289 496.473206,178.988953 
-	C496.127838,178.932816 495.782440,178.876678 495.317383,177.963333 
-	C495.082031,175.964127 494.846710,173.964905 494.611389,171.965698 
-	C494.114227,172.013351 493.617065,172.061005 493.119904,172.108658 
-	C492.948669,174.350540 492.777466,176.592438 492.083160,178.895309 
-M256.695953,764.947937 
-	C256.814697,762.625244 256.933472,760.302490 257.332184,757.345764 
-	C258.452332,756.137756 259.572449,754.929749 261.373566,752.987305 
-	C258.674500,753.107544 256.844788,753.189026 254.233292,753.432312 
-	C252.598450,752.411926 250.963608,751.391602 249.198837,750.290161 
-	C248.407562,751.487793 246.884125,752.735046 246.954285,753.885193 
-	C247.167480,757.380493 247.772156,760.903442 248.748749,764.263184 
-	C248.982880,765.068604 251.251419,765.282715 252.177490,765.620361 
-	C251.686371,762.140076 251.124664,759.528870 251.126999,756.918213 
-	C251.127411,756.446228 253.443527,755.976379 254.538635,756.326782 
-	C255.031143,759.264771 255.523636,762.202820 256.695953,764.947937 
-M1062.080688,406.973877 
-	C1061.664307,407.015442 1061.248047,407.057007 1060.341431,406.620026 
-	C1057.640381,404.513641 1054.693115,404.642639 1053.085327,407.427094 
-	C1052.193604,408.971375 1052.484497,412.157074 1053.558228,413.667511 
-	C1055.475586,416.364502 1058.377686,416.003082 1061.223022,414.306488 
-	C1061.833862,414.522675 1062.444824,414.738861 1063.876099,415.071930 
-	C1066.421631,412.617218 1066.659424,404.819977 1063.642578,400.243896 
-	C1063.250244,403.035217 1062.977051,404.979065 1062.080688,406.973877 
-M1134.660156,414.981567 
-	C1135.149780,414.955780 1135.639404,414.929962 1136.802490,415.113129 
-	C1138.090088,415.155823 1139.386230,415.313568 1140.663818,415.220306 
-	C1145.024658,414.901978 1149.873901,413.111237 1153.618408,414.450348 
-	C1159.082764,416.404449 1161.552246,414.750244 1163.291260,410.452820 
-	C1164.844238,412.237518 1166.268677,413.874451 1167.693115,415.511353 
-	C1168.989502,413.822388 1170.286011,412.133453 1171.590332,410.434235 
-	C1175.194702,416.350342 1177.013550,416.915741 1181.519653,413.148010 
-	C1179.591309,412.828552 1177.952026,412.556976 1176.312744,412.285400 
-	C1177.168823,411.123474 1177.983643,411.193115 1178.652100,410.913177 
-	C1179.732666,410.460785 1180.717041,409.778534 1181.742065,409.193420 
-	C1180.825928,407.941589 1180.174316,406.163818 1178.940674,405.543274 
-	C1176.034546,404.081604 1169.195679,406.714050 1167.357910,409.833862 
-	C1166.243408,406.805206 1165.189575,404.431580 1161.056396,405.981628 
-	C1158.328491,407.004608 1155.002075,406.589111 1151.948364,406.538239 
-	C1149.322021,406.494446 1146.702148,406.054840 1144.079468,405.790253 
-	C1144.004028,405.935577 1143.928589,406.080902 1143.853271,406.226227 
-	C1141.335327,406.226227 1138.817505,406.226227 1135.294434,406.099243 
-	C1134.957397,406.103546 1134.620239,406.107849 1134.179565,405.362061 
-	C1133.711548,404.026672 1133.243530,402.691254 1132.775513,401.355896 
-	C1132.283447,401.906738 1131.398560,402.434692 1131.364868,403.012207 
-	C1131.188110,406.046234 1130.997070,409.117340 1131.317749,412.121460 
-	C1131.426758,413.142761 1133.013794,414.006256 1134.660156,414.981567 
-M1028.887573,528.766541 
-	C1029.466675,528.489868 1030.045898,528.213257 1030.840942,527.184875 
-	C1031.212769,526.028503 1031.584595,524.872192 1032.529053,524.110229 
-	C1034.589478,523.259949 1038.094482,522.767883 1038.412476,521.485535 
-	C1039.094727,518.734619 1038.700195,515.324463 1037.545776,512.715759 
-	C1037.122314,511.759064 1033.304077,512.304688 1030.152100,511.835022 
-	C1029.515259,512.549927 1028.340454,513.256348 1028.329102,513.981018 
-	C1028.254761,518.739502 1028.431641,523.501953 1028.887573,528.766541 
-M549.830688,199.254623 
-	C547.015503,196.774994 544.199890,197.622742 542.987488,200.487076 
-	C542.239868,202.253433 542.878723,205.518570 544.170044,206.998123 
-	C545.678772,208.726791 548.600769,209.374695 550.487122,206.015335 
-	C550.487122,206.015335 550.935181,206.022430 551.643860,206.256256 
-	C554.277100,208.219467 556.899658,209.317551 560.069580,205.985138 
-	C558.129272,205.533371 556.708862,205.202667 555.130676,204.835205 
-	C557.070557,203.862640 558.796204,203.161041 560.242432,202.084229 
-	C560.443542,201.934464 559.374451,199.038391 558.709595,198.959320 
-	C556.640442,198.713226 554.479736,199.184189 552.362061,199.439575 
-	C551.894165,199.496002 551.457214,199.809570 550.475281,199.988525 
-	C550.298279,199.987457 550.121277,199.986389 549.830688,199.254623 
-M554.030579,691.945435 
-	C554.030579,691.945435 554.070984,691.941345 554.082581,691.140503 
-	C553.130127,689.433777 552.177673,687.726990 551.225281,686.020264 
-	C550.324890,687.631409 549.418884,689.239380 548.526978,690.855225 
-	C548.194580,691.457397 547.895203,692.077881 547.546570,692.756653 
-	C546.465881,690.223755 545.505127,687.971802 544.544312,685.719849 
-	C543.857910,685.986633 543.171570,686.253357 542.485229,686.520081 
-	C543.494751,690.072632 544.418152,693.653931 545.584961,697.154053 
-	C545.824097,697.871338 547.026367,698.775085 547.691406,698.705200 
-	C548.407288,698.629944 549.168213,697.603699 549.634949,696.827271 
-	C550.574036,695.265259 551.326721,693.591309 552.167419,692.729919 
-	C553.176575,694.753235 554.185791,696.776550 555.194946,698.799866 
-	C556.282959,696.765320 557.282593,694.675903 558.496460,692.719482 
-	C559.098694,691.748901 560.094910,691.022705 560.657593,690.995422 
-	C560.195068,694.872559 560.932800,698.305664 565.428284,698.818115 
-	C567.254395,699.026306 569.260803,697.652588 571.185242,696.998596 
-	C570.994019,696.523071 570.802795,696.047485 570.611572,695.571899 
-	C568.327271,695.168335 564.409058,699.288391 563.787170,693.282166 
-	C566.630554,693.092834 569.178650,692.923157 571.726807,692.753479 
-	C572.048828,692.246155 572.370911,691.738770 572.692932,691.231445 
-	C571.104126,689.468567 569.829895,686.950134 567.850220,686.125916 
-	C565.114868,684.986938 562.236755,685.911560 560.308533,689.147766 
-	C559.843079,688.083801 559.377625,687.019836 558.912231,685.955933 
-	C558.528748,685.946289 558.145264,685.936707 557.761780,685.927063 
-	C557.201233,688.030579 556.640747,690.134033 555.387634,692.420410 
-	C554.944092,692.253235 554.500549,692.086060 554.030579,691.945435 
-M1599.729370,844.859863 
-	C1600.183350,842.580994 1600.637451,840.302124 1601.904175,838.071594 
-	C1602.793213,840.559143 1603.682251,843.046692 1604.571289,845.534241 
-	C1605.172852,845.459045 1605.774536,845.383911 1606.376099,845.308716 
-	C1606.209351,842.624634 1606.508667,839.774536 1605.641846,837.339722 
-	C1605.304321,836.391479 1602.315796,835.989929 1600.578979,836.092041 
-	C1599.603027,836.149414 1598.717285,837.743042 1597.134888,838.864868 
-	C1596.446899,838.257690 1595.767700,837.640320 1595.069580,837.045166 
-	C1592.597656,834.938049 1590.035156,834.591370 1587.642700,837.037781 
-	C1585.241211,839.493347 1585.522339,842.326782 1587.869873,844.426880 
-	C1590.223267,846.532166 1592.946777,846.337769 1595.314575,843.888672 
-	C1595.973145,843.207581 1596.963013,842.846863 1597.696777,843.004089 
-	C1598.129639,843.666443 1598.562378,844.328857 1599.729370,844.859863 
-M1156.350342,513.953552 
-	C1156.874268,517.323120 1157.398315,520.692688 1157.922363,524.062317 
-	C1158.393555,524.037415 1158.864868,524.012573 1159.336060,523.987732 
-	C1159.609131,522.810425 1159.734985,521.559753 1160.258911,520.507324 
-	C1160.389648,520.244507 1161.802979,520.620117 1162.680298,521.375610 
-	C1166.523682,525.651733 1170.223755,525.563049 1172.256836,520.917114 
-	C1169.785156,520.436829 1165.684204,524.966431 1164.949951,518.931396 
-	C1167.779175,518.398743 1170.435791,517.898560 1173.666260,517.915222 
-	C1177.022339,525.002014 1177.022339,525.002014 1185.881592,523.172729 
-	C1185.390869,517.821045 1186.913696,512.256104 1185.075439,506.975861 
-	C1184.644043,506.961792 1184.212646,506.947754 1183.781372,506.933716 
-	C1183.339966,508.387634 1182.898438,509.841522 1182.457031,511.295410 
-	C1182.189941,510.956909 1181.922974,510.618439 1181.655884,510.279938 
-	C1179.491577,511.608612 1177.333862,512.948486 1175.158936,514.259583 
-	C1174.428955,514.699646 1173.654785,515.066650 1172.811768,514.712585 
-	C1170.848511,513.549866 1168.760376,511.319305 1166.957886,511.530273 
-	C1165.219116,511.733795 1163.775146,514.457092 1161.467651,516.588074 
-	C1159.635254,514.853638 1157.802856,513.119202 1155.137817,511.256897 
-	C1153.394775,511.480408 1151.651611,511.703949 1150.133057,511.898682 
-	C1150.133057,516.025330 1150.133057,519.971802 1150.133057,523.918274 
-	C1150.660156,523.935608 1151.187256,523.952942 1151.714478,523.970215 
-	C1151.887695,522.011292 1151.654297,519.891663 1152.347046,518.138123 
-	C1153.059937,516.334167 1154.676392,514.887390 1156.350342,513.953552 
-M1550.548706,167.206116 
-	C1550.037598,167.472305 1549.526611,167.738495 1548.537964,167.461044 
-	C1547.329956,167.022171 1545.735718,165.860382 1544.978516,166.265076 
-	C1540.896729,168.446396 1538.278320,166.300278 1536.488281,164.066574 
-	C1534.268188,165.146988 1532.632446,166.357025 1530.825684,166.722778 
-	C1528.279785,167.238144 1525.607178,167.128052 1521.651123,167.365784 
-	C1518.357422,165.309250 1507.279541,165.527786 1504.529785,168.645828 
-	C1501.247070,164.699142 1497.950806,165.743637 1494.766479,168.835281 
-	C1491.762451,166.656097 1488.905029,164.583237 1485.757812,162.300156 
-	C1485.386841,163.638992 1484.932373,165.279266 1484.450073,167.020432 
-	C1483.237549,166.804047 1482.026489,166.587936 1480.723633,166.355408 
-	C1480.241821,168.827316 1479.817261,171.005417 1479.392700,173.183517 
-	C1479.052856,173.122574 1478.713135,173.061615 1478.373291,173.000671 
-	C1477.636108,170.685669 1476.898926,168.370667 1476.161865,166.055664 
-	C1475.628906,166.175064 1475.096069,166.294449 1474.563110,166.413849 
-	C1474.320923,169.167465 1474.078613,171.921066 1473.743408,175.731903 
-	C1471.589722,172.857437 1470.137329,170.919022 1468.710205,169.014145 
-	C1470.198242,166.772446 1471.484375,164.835022 1472.770508,162.897583 
-	C1472.415405,162.562836 1472.060303,162.228073 1471.705200,161.893326 
-	C1469.643555,163.500046 1467.582031,165.106781 1465.396362,166.810135 
-	C1465.162231,166.212662 1465.039062,165.767761 1464.823242,165.373550 
-	C1464.265259,164.353897 1463.666382,163.356537 1463.083862,162.350266 
-	C1462.498535,163.512756 1461.511108,164.641006 1461.408691,165.844635 
-	C1461.169189,168.654282 1461.241089,171.508606 1461.449707,174.325333 
-	C1461.501221,175.021179 1462.557495,175.642609 1463.151855,176.298203 
-	C1463.671021,175.746384 1464.429443,175.276871 1464.654175,174.623840 
-	C1465.006836,173.598404 1464.999512,172.449203 1465.166626,171.187088 
-	C1467.557007,173.043594 1469.572144,175.922699 1471.849121,176.147491 
-	C1481.260620,177.076599 1490.740967,174.437943 1500.231934,176.294739 
-	C1501.332764,176.510147 1502.675049,175.492081 1503.905396,175.045868 
-	C1502.771240,173.844711 1501.882446,173.843719 1501.016968,173.701538 
-	C1500.191895,173.565979 1499.390991,173.283218 1498.579468,173.065186 
-	C1498.604980,172.756912 1498.630493,172.448624 1498.656006,172.140350 
-	C1500.656006,172.022308 1502.655884,171.904251 1504.510742,171.794769 
-	C1505.293091,173.627975 1505.924316,175.107101 1506.664429,176.841583 
-	C1510.188232,174.504883 1506.526245,168.081131 1512.807129,168.736053 
-	C1513.001221,171.255539 1513.197021,173.796539 1513.392700,176.337540 
-	C1513.994263,176.455231 1514.595703,176.572937 1515.197144,176.690628 
-	C1515.945923,174.154785 1516.694702,171.618942 1517.443481,169.083084 
-	C1517.798462,169.094025 1518.153320,169.104965 1518.508179,169.115906 
-	C1518.925293,171.498123 1519.342407,173.880356 1519.592041,175.305984 
-	C1524.119263,175.305984 1527.918579,175.305984 1531.717773,175.305984 
-	C1531.711548,174.892075 1531.705200,174.478165 1531.698975,174.064240 
-	C1530.197388,173.750793 1528.695923,173.437347 1526.715332,173.023926 
-	C1529.622192,171.717606 1531.763184,170.755493 1533.244019,170.089996 
-	C1534.344849,172.172821 1535.169678,175.724075 1536.540649,175.949173 
-	C1540.436646,176.588852 1544.555420,175.870956 1549.399902,175.866882 
-	C1549.949097,175.896759 1550.498291,175.926636 1551.703247,176.113998 
-	C1553.665771,175.417831 1555.628174,174.721680 1557.590698,174.025497 
-	C1556.765137,172.356628 1555.939697,170.687759 1555.107788,169.005844 
-	C1555.605347,168.780762 1556.524780,168.364868 1557.444214,167.948959 
-	C1557.348633,167.450867 1557.253174,166.952759 1557.157715,166.454651 
-	C1555.140259,166.653122 1553.122925,166.851578 1550.548706,167.206116 
-M262.265930,336.352020 
-	C261.765656,336.610962 261.265381,336.869873 260.033875,336.830322 
-	C254.111679,335.843994 259.274384,341.790466 256.304932,342.614685 
-	C254.130386,342.614685 251.910492,342.614685 249.829086,342.614685 
-	C249.272507,340.205719 248.806229,338.187592 248.339951,336.169434 
-	C247.910629,336.247375 247.481323,336.325317 247.052002,336.403259 
-	C247.052002,341.828247 247.052002,347.253204 247.052002,352.678192 
-	C247.529373,352.738220 248.006744,352.798248 248.484116,352.858276 
-	C248.915283,350.625977 249.346451,348.393677 249.840118,345.837830 
-	C252.130341,345.837830 254.476074,345.837830 256.748718,345.837830 
-	C257.165863,348.453125 257.519531,350.670319 257.873169,352.887482 
-	C258.488251,352.856537 259.103333,352.825623 259.718414,352.794678 
-	C259.846527,350.323059 259.950500,347.849915 260.109192,345.380280 
-	C260.288055,342.596283 260.516205,339.815491 261.381775,337.535217 
-	C261.874664,337.759583 262.367523,337.983978 263.647369,338.395264 
-	C266.386414,338.064423 267.535645,339.197479 267.404449,342.020752 
-	C267.240356,345.551270 267.364990,349.095245 267.364990,352.633392 
-	C268.171906,352.638062 268.978851,352.642700 269.785767,352.647339 
-	C269.992249,348.243958 270.198730,343.840576 270.405945,339.421295 
-	C271.717041,339.171112 272.835419,338.957733 274.727081,338.594055 
-	C275.508972,338.661102 276.290894,338.728149 277.899261,339.034515 
-	C280.865845,338.538269 280.935333,340.360260 280.945923,342.564453 
-	C280.962494,346.021240 281.243744,349.476776 281.412933,352.932831 
-	C282.138123,352.939636 282.863342,352.946442 283.588562,352.953247 
-	C283.919128,348.219025 284.249695,343.484802 284.572510,338.862061 
-	C286.437592,338.463776 287.953369,338.140106 289.469177,337.816406 
-	C289.458374,337.325897 289.447601,336.835419 289.436829,336.344940 
-	C285.328705,336.344940 281.220581,336.344940 276.351410,336.231995 
-	C275.847778,336.320068 275.344177,336.408142 273.985718,336.207855 
-	C270.359863,336.245880 266.734039,336.283905 262.265930,336.352020 
-M1038.197266,714.862244 
-	C1035.836670,714.470764 1033.476196,714.079224 1031.274780,712.809509 
-	C1031.047119,711.405029 1030.819580,710.000549 1030.592041,708.596008 
-	C1030.170532,708.670105 1029.749146,708.744202 1029.327637,708.818298 
-	C1029.327637,713.949646 1029.327637,719.080933 1029.327637,724.212280 
-	C1029.777832,724.244202 1030.228149,724.276184 1030.678345,724.308105 
-	C1031.075073,722.059937 1031.471802,719.811768 1031.861328,717.604614 
-	C1034.406128,717.604614 1036.657104,717.604614 1038.512939,717.604614 
-	C1039.382690,720.132568 1040.131226,722.308167 1041.482422,724.544006 
-	C1041.940430,719.715454 1042.398315,714.886963 1042.862671,709.989685 
-	C1044.998779,710.402283 1046.910645,710.771545 1049.025391,711.179993 
-	C1049.251587,715.808472 1049.471558,720.311646 1049.691528,724.814819 
-	C1050.480835,724.804993 1051.270020,724.795227 1052.059204,724.785400 
-	C1052.261475,720.224243 1052.463745,715.663025 1052.675049,710.896240 
-	C1056.442139,710.896240 1059.659912,710.896240 1063.102661,710.896240 
-	C1063.351562,715.848755 1063.577393,720.340698 1063.803101,724.832642 
-	C1064.564941,724.806519 1065.326660,724.780396 1066.088379,724.754333 
-	C1066.088379,720.315063 1066.088379,715.875854 1066.088379,711.580627 
-	C1068.570435,710.829346 1070.182251,710.341431 1071.793945,709.853577 
-	C1071.768677,709.272278 1071.743408,708.690918 1071.718140,708.109619 
-	C1067.728516,708.109619 1063.738281,708.060059 1059.749512,708.121033 
-	C1053.456909,708.217163 1047.165527,708.387573 1040.027710,708.775818 
-	C1039.721313,710.801880 1039.415039,712.828003 1038.197266,714.862244 
-M909.445618,77.533592 
-	C910.858948,78.067352 912.272217,78.601120 913.685486,79.134880 
-	C913.949951,78.809975 914.214355,78.485077 914.478821,78.160172 
-	C910.482666,74.492088 911.181396,70.599045 913.515198,66.708870 
-	C912.573242,65.544830 911.693298,64.457359 910.416199,62.879101 
-	C909.444824,64.659821 908.703918,66.018082 907.061951,67.296783 
-	C905.313477,66.850708 903.489075,65.871269 901.837463,66.106216 
-	C900.132874,66.348717 898.596191,67.772415 896.986084,68.679352 
-	C898.033691,70.114311 898.898315,71.750397 900.185791,72.921730 
-	C901.252869,73.892548 902.818298,74.315582 904.162903,74.981277 
-	C904.001648,75.542549 903.840332,76.103828 903.679016,76.665100 
-	C901.429443,76.342758 899.179871,76.020416 896.776917,75.676102 
-	C899.378906,79.997200 902.277039,80.286438 907.555237,76.940453 
-	C908.054443,76.948265 908.553650,76.956078 909.445618,77.533592 
-M60.487934,390.618866 
-	C61.007736,390.418823 61.527542,390.218781 62.883549,390.123108 
-	C63.646797,389.846313 64.410042,389.569519 65.894363,389.519012 
-	C67.110359,391.244202 67.992760,393.933167 69.611908,394.493561 
-	C72.960930,395.652771 76.313263,394.838409 77.319756,390.581573 
-	C78.178734,386.948578 76.090324,384.873779 71.269646,384.354767 
-	C70.872246,383.014679 70.479294,381.689636 70.086342,380.364563 
-	C69.713470,380.298737 69.340607,380.232941 68.967735,380.167114 
-	C67.956924,382.474182 66.946121,384.781281 65.620560,386.360535 
-	C62.443283,382.772064 59.764118,385.606110 56.569683,386.334991 
-	C56.748875,384.645294 56.928066,382.955597 57.107258,381.265900 
-	C56.607677,381.024872 56.108093,380.783813 55.608509,380.542786 
-	C54.306690,382.592163 53.004875,384.641541 51.526714,386.968536 
-	C51.122154,386.133545 50.862572,385.400269 50.443321,384.773895 
-	C49.592583,383.502930 48.655457,382.289734 47.753956,381.052704 
-	C46.819118,382.265900 45.920563,383.509399 44.938778,384.683319 
-	C44.032574,385.766846 43.037090,386.775726 42.230549,387.172699 
-	C42.302036,384.460083 42.731632,381.530273 37.706398,380.936737 
-	C38.922260,385.072693 39.841400,388.658478 41.080433,392.130066 
-	C41.445099,393.151855 42.715450,393.850433 43.570740,394.697113 
-	C44.173882,393.624023 44.777023,392.550903 45.851254,390.998718 
-	C46.415939,389.856354 46.980629,388.713989 47.794727,387.067047 
-	C48.493301,389.129242 48.816391,390.586151 49.474903,391.871155 
-	C50.022396,392.939484 50.964226,393.805725 51.731369,394.761505 
-	C52.606312,393.764526 53.601826,392.847290 54.327003,391.751221 
-	C55.332420,390.231598 56.134705,388.577576 57.283035,387.750275 
-	C57.583374,394.253693 59.544163,395.847076 64.648247,393.731506 
-	C63.092960,392.777679 61.537682,391.823853 60.487934,390.618866 
-M1487.656860,833.925964 
-	C1488.111938,833.893066 1488.566895,833.860229 1489.869629,834.078369 
-	C1490.443481,836.418518 1491.012939,838.759705 1491.592651,841.098389 
-	C1491.975464,842.642883 1492.372803,844.183777 1492.763672,845.726257 
-	C1493.392334,845.619385 1494.020996,845.512512 1494.649780,845.405579 
-	C1494.761353,842.883362 1494.544434,840.284973 1495.104980,837.866699 
-	C1495.453857,836.361572 1496.978394,835.128845 1498.844116,833.884949 
-	C1499.542847,837.804932 1500.241455,841.724915 1500.903076,845.437195 
-	C1503.869995,843.184265 1506.644287,841.391907 1509.031128,839.181213 
-	C1511.676514,836.731018 1510.480225,832.680359 1506.763794,831.998718 
-	C1503.937012,831.480347 1500.924072,831.977966 1497.114258,831.818115 
-	C1494.411865,831.866638 1491.709595,831.915100 1488.634521,831.741150 
-	C1488.087036,831.815063 1487.539429,831.888977 1486.104004,831.801270 
-	C1483.402100,831.859009 1480.700317,831.916748 1477.257935,832.023865 
-	C1475.839355,831.960754 1474.420898,831.897644 1472.784912,831.824890 
-	C1472.286621,835.013550 1472.451172,838.998413 1467.375488,836.594788 
-	C1467.248535,836.127563 1467.186646,835.634155 1466.984741,835.206726 
-	C1466.428589,834.028625 1465.814087,832.878052 1465.222656,831.716553 
-	C1464.644531,832.886108 1463.694946,834.016418 1463.566406,835.233398 
-	C1463.306763,837.689941 1463.323364,840.210999 1463.573242,842.670105 
-	C1463.684448,843.764709 1464.636597,844.773865 1465.207031,845.821777 
-	C1465.592529,845.702454 1465.977905,845.583130 1466.363281,845.463806 
-	C1466.698975,843.782959 1467.034790,842.102112 1467.395752,840.295044 
-	C1468.998047,840.295044 1470.511719,840.295044 1471.368286,840.295044 
-	C1472.448120,842.533386 1473.243408,844.181885 1474.038574,845.830383 
-	C1474.630493,845.612854 1475.222290,845.395386 1475.814209,845.177917 
-	C1475.814209,842.570190 1475.583130,839.932739 1475.913574,837.367615 
-	C1476.074341,836.119507 1477.284668,835.006592 1478.855591,834.082092 
-	C1479.387573,836.466553 1479.887207,838.858948 1480.463257,841.232727 
-	C1480.831421,842.750427 1481.312744,844.240601 1481.743408,845.743042 
-	C1482.446533,845.592834 1483.149536,845.442627 1483.852539,845.292419 
-	C1483.852539,842.574341 1483.529785,839.799561 1483.993652,837.163086 
-	C1484.213257,835.914062 1485.936157,834.929504 1487.656860,833.925964 
-M534.809937,177.968491 
-	C535.361023,179.340164 536.122009,180.667816 536.420898,182.092422 
-	C537.107300,185.365143 538.765076,186.276382 542.759094,185.159332 
-	C538.947144,181.868881 538.662537,179.159775 540.686340,178.052750 
-	C540.055725,176.255203 539.425171,174.457657 538.922974,173.026138 
-	C536.943665,174.239731 535.467285,175.144943 533.167297,175.960114 
-	C531.667969,176.789291 528.228943,174.631714 528.192993,178.929047 
-	C525.329834,176.142975 522.380310,173.957275 518.372131,177.099319 
-	C517.976929,177.409134 517.144897,177.304260 516.551941,177.194977 
-	C513.665222,176.662827 510.790863,176.063660 507.001495,175.306183 
-	C507.330017,180.703308 507.579163,184.796585 507.849945,189.245239 
-	C511.668915,186.870987 514.312744,185.227310 517.165649,183.453659 
-	C520.773193,186.607849 524.268860,186.997009 527.484253,182.985107 
-	C527.628479,182.805161 528.405212,183.132233 528.890015,183.998260 
-	C530.756714,186.183121 531.157410,184.991608 531.695312,182.982712 
-	C532.171326,181.204865 533.198547,179.574600 534.809937,177.968491 
-M576.713501,698.241150 
-	C582.603027,699.828918 585.006958,697.838013 584.995422,691.894470 
-	C584.983154,685.558960 580.554443,685.760742 576.428772,684.714111 
-	C576.140198,683.686157 575.851624,682.658264 575.563049,681.630310 
-	C574.952271,681.699158 574.341492,681.768005 573.730713,681.836792 
-	C573.730713,686.839600 573.681458,691.843872 573.830261,696.842224 
-	C573.841431,697.216248 575.269165,697.548157 576.713501,698.241150 
-M1481.317017,402.975952 
-	C1481.317017,402.975952 1480.820435,402.950012 1480.574463,402.333984 
-	C1477.156738,399.560486 1473.776123,399.961914 1471.052490,403.098083 
-	C1468.492676,406.045685 1468.423950,409.572144 1471.190918,412.477112 
-	C1473.855347,415.274261 1477.018921,416.107147 1480.746582,413.005798 
-	C1481.100342,413.007141 1481.454102,413.008453 1482.336548,413.626190 
-	C1483.249146,412.958374 1484.889404,412.350311 1484.949951,411.612549 
-	C1485.231079,408.187531 1485.074219,404.726532 1485.074219,401.278442 
-	C1484.706543,401.090424 1484.338867,400.902374 1483.971191,400.714355 
-	C1483.252075,401.474335 1482.532959,402.234283 1481.317017,402.975952 
-M578.873047,184.944595 
-	C579.291565,183.666214 579.593079,182.332428 580.164001,181.126160 
-	C580.662537,180.072800 581.464600,179.163055 582.132507,178.189835 
-	C582.786316,179.142807 583.679016,180.014786 584.036255,181.068314 
-	C584.533508,182.534866 584.629883,184.137360 585.127808,187.007462 
-	C588.527954,179.020065 587.218750,176.404785 580.648865,175.262894 
-	C580.306946,174.027542 579.963318,172.785858 579.619690,171.544159 
-	C579.197449,171.549973 578.775208,171.555786 578.352966,171.561600 
-	C578.144775,173.034409 577.936646,174.507233 577.269043,176.013931 
-	C577.269043,176.013931 576.814087,176.086014 576.137390,175.913132 
-	C575.406189,174.699738 574.674988,173.486359 574.520325,173.229645 
-	C570.980225,174.809570 568.773132,175.794601 566.428284,176.841125 
-	C566.005493,178.649704 565.504211,180.794296 565.002930,182.938904 
-	C564.554016,182.883209 564.105103,182.827515 563.656189,182.771820 
-	C563.439758,181.549133 563.259277,180.318649 562.996277,179.106064 
-	C562.754761,177.992188 562.424316,176.897614 562.132996,175.794540 
-	C561.625122,175.815109 561.117188,175.835678 560.609314,175.856247 
-	C560.292664,178.346283 559.976013,180.836319 559.507446,184.521317 
-	C557.745667,180.202805 556.684998,176.878647 554.999939,173.908691 
-	C554.487000,173.004593 551.098206,172.532761 550.980469,172.782791 
-	C549.072327,176.836136 547.479248,181.037796 545.814880,185.205887 
-	C546.321350,185.489548 546.827820,185.773193 547.334351,186.056839 
-	C548.215698,185.256134 548.972900,184.140854 550.008911,183.731735 
-	C551.406555,183.179779 553.818665,182.419525 554.411011,183.049789 
-	C558.724976,187.639877 563.799622,185.051865 568.636475,185.651947 
-	C568.953308,182.713272 569.201172,180.413742 569.516968,177.484467 
-	C572.761292,180.030731 568.667175,188.448029 577.392517,184.953857 
-	C577.619812,184.958344 577.847107,184.962830 578.873047,184.944595 
-M1125.435791,712.345886 
-	C1120.625610,711.329529 1116.057007,710.906860 1114.065063,716.926819 
-	C1114.056885,716.951599 1113.476807,716.787170 1113.132080,716.007812 
-	C1110.249634,710.610718 1107.347412,710.267700 1101.439453,714.027710 
-	C1099.432861,713.218323 1097.426270,712.408997 1094.433350,711.201782 
-	C1094.721069,716.803284 1094.925537,720.785706 1095.130005,724.768127 
-	C1095.815186,724.752441 1096.500366,724.736755 1097.185547,724.721069 
-	C1097.339355,722.712158 1097.458374,720.699890 1097.655640,718.695251 
-	C1097.913452,716.077332 1098.296265,713.533325 1102.210693,715.383057 
-	C1102.158081,717.036682 1101.505371,719.023193 1102.194458,720.265320 
-	C1103.210449,722.096252 1104.967529,724.200439 1106.808472,724.692200 
-	C1108.569702,725.162598 1110.841431,723.721863 1112.888794,723.121094 
-	C1112.736938,722.727173 1112.584961,722.333191 1112.433105,721.939270 
-	C1106.230347,722.376404 1106.230347,722.376404 1105.552490,719.687744 
-	C1108.043335,719.060547 1110.533203,718.433533 1113.458740,718.399780 
-	C1115.416992,722.593506 1117.522705,726.561768 1123.154419,725.724609 
-	C1123.402344,726.998352 1123.650269,728.272095 1123.898315,729.545898 
-	C1124.477661,729.509277 1125.057129,729.472717 1125.636475,729.436096 
-	C1125.636475,723.974976 1125.636475,718.513794 1125.435791,712.345886 
-M803.196533,753.991333 
-	C802.138550,753.992065 801.080566,753.992798 799.209778,753.914185 
-	C796.831055,754.590698 794.452332,755.267273 792.473206,755.830139 
-	C791.219543,755.282959 789.820007,754.092773 788.636414,754.278564 
-	C786.329041,754.640747 784.142517,755.773132 781.667236,756.673401 
-	C780.830139,753.548523 777.791382,753.354370 774.469543,753.971680 
-	C772.542847,754.329712 769.863220,755.949280 768.890930,755.207458 
-	C764.735107,752.036804 762.153992,754.271973 759.438354,757.197693 
-	C757.570190,756.112610 755.801880,755.085510 753.168213,753.555786 
-	C755.817261,752.886230 757.352844,752.498108 759.529724,751.947876 
-	C756.367798,749.124451 753.431580,749.019653 751.495239,751.410034 
-	C747.049866,756.897705 755.228333,756.826843 756.117493,760.563477 
-	C753.944702,760.732483 752.074158,760.877930 749.504639,761.077820 
-	C753.514099,765.653625 756.885559,763.489868 759.933411,761.615173 
-	C764.842041,764.739441 765.392090,764.741821 768.764465,761.614441 
-	C767.180237,761.272827 765.792175,760.973450 764.404114,760.674072 
-	C764.418823,760.445190 764.433594,760.216309 764.448303,759.987427 
-	C766.188538,759.715027 767.928772,759.442627 769.728271,759.160950 
-	C769.958740,759.712585 770.118469,760.170654 770.335754,760.599609 
-	C770.867310,761.648804 771.425598,762.684570 771.973022,763.725708 
-	C772.554443,762.571045 773.094910,761.393372 773.727295,760.267395 
-	C774.592041,758.727844 775.526672,757.227600 777.031494,754.704102 
-	C778.286133,757.585510 778.720520,759.037659 779.506775,760.264343 
-	C780.337646,761.560669 781.503906,762.642090 782.523560,763.817383 
-	C783.372437,762.685120 784.357727,761.628296 785.035767,760.401672 
-	C785.885986,758.863464 786.484070,757.185791 787.191040,755.568359 
-	C788.157654,757.617859 787.795227,759.591003 788.224121,761.373718 
-	C789.632263,767.226562 791.129639,761.747803 792.604675,761.303345 
-	C792.605835,761.722839 792.606995,762.142334 792.608215,762.561890 
-	C795.085510,762.711914 797.562805,762.862000 800.797852,763.004150 
-	C801.556213,762.990662 802.314575,762.977173 803.766052,763.217163 
-	C805.918457,763.217163 808.070862,763.217163 810.223206,763.217163 
-	C810.217163,762.670105 810.211060,762.122986 810.204956,761.575928 
-	C808.639526,761.294922 807.074097,761.013977 804.106873,760.481384 
-	C806.102051,759.939514 806.778320,759.908203 807.271545,759.591675 
-	C808.466797,758.824646 809.576721,757.924683 810.721008,757.078308 
-	C809.470032,755.998840 808.331421,754.721069 806.921570,753.921753 
-	C806.192871,753.508789 804.982788,753.945251 803.196533,753.991333 
-M1141.694824,429.413177 
-	C1139.613403,426.743103 1136.827515,426.508179 1135.029907,428.994781 
-	C1133.863037,430.608978 1133.697388,433.642731 1134.352173,435.620544 
-	C1134.753418,436.832642 1137.552979,437.250854 1139.444580,438.101532 
-	C1138.197021,435.345581 1137.452271,433.700256 1136.707520,432.054901 
-	C1138.487793,431.356201 1140.267944,430.657471 1142.172852,430.724915 
-	C1142.055908,432.481720 1141.938965,434.238556 1141.820679,436.015594 
-	C1147.769531,438.358154 1147.769531,438.358154 1150.780884,435.654205 
-	C1149.119995,435.237122 1147.618774,434.860138 1146.117554,434.483185 
-	C1146.145508,434.210266 1146.173340,433.937378 1146.201294,433.664459 
-	C1147.965698,433.250702 1149.730103,432.836914 1151.524658,432.416107 
-	C1149.678589,426.572693 1147.817261,426.182526 1141.694824,429.413177 
-M35.351120,844.130615 
-	C33.933186,843.957275 32.515251,843.783875 31.022282,843.601318 
-	C30.898800,842.272583 30.884840,841.291626 30.704470,840.342224 
-	C30.222557,837.805786 29.669182,835.282959 29.144192,832.754700 
-	C28.517433,835.346863 27.453619,837.921753 27.350208,840.534607 
-	C27.094183,847.003723 28.869234,848.218262 35.191746,846.507446 
-	C36.120781,846.256042 37.039104,845.965149 38.536434,846.122681 
-	C40.705090,845.454285 42.873745,844.785950 45.777851,843.917053 
-	C47.758163,844.872437 49.690823,846.509644 51.727982,846.651978 
-	C57.222790,847.036072 62.762108,846.783264 68.078796,846.783264 
-	C68.078796,841.628052 68.078796,837.015503 68.078796,832.403015 
-	C67.575233,832.390137 67.071678,832.377319 66.568115,832.364502 
-	C66.189224,834.891968 65.810333,837.419434 65.544289,839.194153 
-	C63.223145,838.228027 61.034496,836.434570 59.132912,836.699768 
-	C54.426285,837.355957 49.257244,835.530212 44.727692,838.341980 
-	C42.495190,838.076721 39.595753,836.852539 38.215343,837.812561 
-	C36.798569,838.797852 36.866589,841.918213 35.351120,844.130615 
-M746.414612,203.748871 
-	C745.094666,202.522171 743.774658,201.295471 742.078186,199.718826 
-	C744.327515,199.307556 745.723694,199.052261 747.119934,198.796982 
-	C747.071716,198.156555 747.023499,197.516129 746.975220,196.875702 
-	C744.853027,197.023712 741.962463,196.336761 740.739624,197.462082 
-	C734.982239,202.760406 743.727539,203.526611 744.525330,207.362915 
-	C742.404236,207.506729 740.707092,207.621811 738.356812,207.781174 
-	C742.762634,211.323822 744.214905,211.174042 747.907349,207.289810 
-	C750.668640,209.643143 753.395081,212.266876 757.726746,208.357712 
-	C755.451294,207.856842 753.883423,207.511734 752.314575,207.166412 
-	C754.485352,205.932343 756.137024,204.993378 757.788757,204.054367 
-	C757.135559,202.977936 756.500793,201.006104 755.825745,200.992233 
-	C753.761230,200.949753 751.630676,201.502274 749.628540,202.143875 
-	C748.629028,202.464203 747.853210,203.482559 746.414612,203.748871 
-M799.676819,419.024353 
-	C799.340515,418.991943 799.004211,418.959534 798.242310,418.317047 
-	C797.289124,417.275208 796.335938,416.233368 795.114990,414.898956 
-	C793.500000,418.425842 791.361145,419.451996 787.604858,417.988800 
-	C786.126465,417.412964 783.667847,419.353668 781.655640,420.148407 
-	C782.936523,421.752228 784.120911,423.448730 785.536438,424.923309 
-	C786.321411,425.740967 787.492737,426.187683 788.489929,426.801636 
-	C788.385986,427.220795 788.282104,427.639923 788.178162,428.059082 
-	C783.061584,428.059082 777.943054,428.119415 772.831848,427.953400 
-	C772.385864,427.938904 771.988281,426.436188 771.423035,425.344269 
-	C774.426758,425.100037 777.013367,424.889740 779.599976,424.679413 
-	C779.960571,424.249390 780.321228,423.819366 780.681885,423.389343 
-	C779.057800,421.518036 777.697998,418.563873 775.734192,418.084595 
-	C773.827881,417.619263 769.788330,419.274689 769.380493,420.745911 
-	C768.658752,423.349518 769.005615,427.368805 770.659729,429.266724 
-	C773.639954,432.686340 777.299744,430.522339 780.292358,427.909332 
-	C783.291992,430.560852 786.837036,432.601715 790.005615,429.546906 
-	C791.271545,428.326416 790.213806,424.695770 790.213806,421.293304 
-	C790.330811,421.222992 791.520874,420.507599 793.659363,419.222076 
-	C793.659363,422.374603 793.468933,424.657867 793.731384,426.887878 
-	C793.886597,428.206299 794.757874,429.440430 795.307068,430.712494 
-	C796.556641,430.137299 797.806152,429.562103 799.374084,429.093048 
-	C799.374084,429.093048 799.710205,429.094055 800.361145,429.461395 
-	C801.253662,429.895752 802.324890,430.883484 803.005981,430.663513 
-	C805.297607,429.923279 807.450500,428.753113 809.656433,427.747437 
-	C808.324646,426.158691 807.083313,424.479858 805.625244,423.016968 
-	C804.826965,422.216064 803.662537,421.780060 802.663269,421.179504 
-	C802.814209,420.807831 802.965210,420.436157 803.116150,420.064514 
-	C805.120178,420.286133 807.124207,420.507721 809.988281,420.824463 
-	C806.557129,416.565643 803.433594,417.302124 799.676819,419.024353 
-M761.973999,743.566162 
-	C762.654785,743.377136 763.335510,743.188110 764.248230,742.326965 
-	C766.155579,741.141235 768.062927,739.955505 770.690430,738.921082 
-	C774.262329,741.645020 777.866455,743.309570 781.325378,739.170837 
-	C782.487366,740.105774 783.416870,740.853577 784.460815,741.693481 
-	C787.359619,734.352600 787.359619,734.352600 790.035217,734.459595 
-	C791.233887,741.576416 791.356506,741.708923 794.878662,740.742493 
-	C794.878662,737.835510 794.878662,735.140930 794.878662,732.446411 
-	C795.191040,732.441833 795.503418,732.437256 795.815735,732.432678 
-	C794.864319,731.178772 793.912903,729.924866 793.421265,729.276978 
-	C789.115479,730.630615 785.224731,731.853821 780.842712,733.231445 
-	C776.780823,730.424316 776.794189,730.444946 771.968750,733.569641 
-	C771.524475,733.857239 770.767578,733.662170 769.978271,733.004150 
-	C766.246277,730.587769 763.600220,730.857605 761.220276,734.045532 
-	C760.593750,733.592468 759.982727,732.778442 759.337952,732.750732 
-	C756.951355,732.648071 753.421814,731.893616 752.451233,733.098877 
-	C751.281494,734.551453 751.383240,738.383850 752.553955,740.044556 
-	C754.272034,742.481689 757.285950,742.218384 760.112610,739.559692 
-	C757.854858,739.038391 756.207947,738.658142 753.456604,738.022888 
-	C757.123108,736.980835 759.441650,736.321899 761.603149,736.601440 
-	C761.727661,738.734253 761.852173,740.867126 761.973999,743.566162 
-M508.806244,206.177505 
-	C511.964783,207.212250 515.129578,209.808167 519.069885,205.910553 
-	C516.715454,205.495026 515.090698,205.208282 513.465942,204.921539 
-	C514.381531,204.136688 515.353271,204.136917 516.179138,203.789978 
-	C517.123291,203.393326 518.534363,202.794434 518.660095,202.090195 
-	C518.822937,201.177963 518.066162,199.319000 517.441772,199.194992 
-	C515.541077,198.817535 513.454651,198.793625 511.556152,199.188156 
-	C510.256592,199.458252 509.150055,200.657043 507.426086,200.904892 
-	C506.165710,200.003403 504.905334,199.101913 503.002716,197.741058 
-	C505.419525,197.114441 506.945251,196.718857 508.471008,196.323273 
-	C508.361542,195.653763 508.252106,194.984268 508.142639,194.314758 
-	C505.870972,194.682907 502.775909,194.240570 501.473969,195.563248 
-	C496.537201,200.578644 504.682800,201.150543 505.314209,204.822037 
-	C503.294037,205.092712 501.556671,205.325470 498.910614,205.679993 
-	C502.596222,208.448990 505.274658,209.137833 508.806244,206.177505 
-M62.392773,185.962418 
-	C62.812618,185.987030 63.232468,186.011658 64.159714,186.546768 
-	C65.410805,185.708145 66.661903,184.869507 67.931862,184.018234 
-	C71.137077,188.642593 74.122025,188.659241 78.699203,183.414597 
-	C80.042953,189.217743 84.148483,186.454849 87.254654,186.746902 
-	C87.254654,183.312912 87.254654,180.271637 87.254654,177.230377 
-	C86.756096,177.182877 86.257545,177.135376 85.758987,177.087875 
-	C85.229111,179.509689 84.699226,181.931519 84.169350,184.353333 
-	C83.698288,184.344330 83.227226,184.335327 82.756157,184.326324 
-	C82.257828,181.968384 81.759491,179.610428 80.940086,175.733276 
-	C79.634270,178.113144 79.031746,179.211243 78.719414,179.780472 
-	C76.748611,178.869843 74.717949,177.168335 72.750435,177.238449 
-	C70.807762,177.307709 68.928940,179.168427 66.729164,180.408356 
-	C66.729164,178.716873 66.790421,177.067215 66.714417,175.423904 
-	C66.607567,173.113892 65.717697,172.247345 62.995148,174.004669 
-	C62.561722,174.056793 62.128300,174.108902 60.967659,173.995804 
-	C57.091343,172.143845 53.313110,172.698837 51.567486,176.519196 
-	C50.536552,178.775452 50.743801,182.586548 52.033684,184.695877 
-	C54.298923,188.400208 58.198376,187.875580 62.392773,185.962418 
-M1086.863037,649.016174 
-	C1087.903931,647.555176 1089.674561,646.172791 1089.842041,644.617737 
-	C1090.260620,640.730164 1091.999512,638.904968 1096.401978,639.574463 
-	C1098.357056,639.280029 1100.312134,638.985657 1102.267334,638.691223 
-	C1102.336182,639.235840 1102.405151,639.780518 1102.474121,640.325134 
-	C1100.953735,640.752502 1099.084717,640.776611 1098.003174,641.711670 
-	C1096.715698,642.824646 1095.381104,644.753418 1095.451782,646.263916 
-	C1095.499634,647.288818 1097.905273,648.972656 1099.301636,649.019653 
-	C1103.348877,649.155823 1107.418823,648.614502 1111.547607,648.334473 
-	C1111.816284,644.914490 1112.073486,641.642029 1112.330566,638.369507 
-	C1112.989990,638.330688 1113.649414,638.291931 1114.308960,638.253113 
-	C1114.789062,641.824646 1115.269287,645.396240 1115.749512,648.967834 
-	C1116.327271,648.930420 1116.905029,648.893066 1117.482910,648.855652 
-	C1117.659180,645.354919 1117.835327,641.854126 1118.954590,638.295349 
-	C1119.636963,639.818054 1120.561890,641.283203 1120.939941,642.877991 
-	C1121.407593,644.849487 1121.420898,646.928650 1121.630371,648.961304 
-	C1122.169556,648.922180 1122.708740,648.882996 1123.247925,648.843872 
-	C1123.247925,644.809937 1123.247925,640.776001 1123.247925,636.540222 
-	C1121.794189,636.540222 1120.369873,636.540222 1118.423218,635.939697 
-	C1119.763672,634.676147 1121.104004,633.412537 1122.800537,631.813171 
-	C1120.182495,632.122559 1117.449219,632.797852 1114.746704,632.691406 
-	C1109.141479,632.470764 1107.804810,634.002991 1108.786377,639.344910 
-	C1109.217773,641.692444 1108.585327,644.235413 1108.435913,646.689697 
-	C1107.823608,646.712463 1107.211426,646.735168 1106.599121,646.757935 
-	C1106.331299,645.312439 1106.226562,643.811279 1105.757202,642.434509 
-	C1105.065186,640.403870 1104.484985,637.147461 1103.187866,636.780701 
-	C1101.088623,636.187195 1098.445557,637.516846 1095.490479,637.640198 
-	C1092.813354,633.522949 1089.161743,635.703918 1085.211548,635.881897 
-	C1084.685425,635.105164 1084.159180,634.328430 1083.587891,633.484863 
-	C1081.295410,636.057129 1080.510254,646.140930 1082.505127,648.014160 
-	C1083.311157,648.771057 1084.880005,648.715637 1086.863037,649.016174 
-M784.671265,325.162354 
-	C784.856689,327.613068 784.366943,330.433197 785.441528,332.397491 
-	C786.299255,333.965332 789.010071,335.084961 790.999634,335.261536 
-	C792.247131,335.372253 793.682190,333.369873 795.876343,331.657440 
-	C792.094727,331.862396 789.590637,332.722412 788.271484,331.830292 
-	C787.294006,331.169250 787.195618,326.890320 787.860107,326.562347 
-	C789.710815,325.649048 792.162720,325.954163 794.700989,325.752441 
-	C793.600037,322.645905 791.227783,321.990173 788.220886,322.810028 
-	C786.747070,323.211853 785.371094,323.972565 783.780823,323.795898 
-	C781.700928,323.352692 779.620972,322.909485 777.000244,322.351013 
-	C777.294678,327.436066 777.523193,331.383514 777.751770,335.330963 
-	C778.520935,335.288910 779.290100,335.246857 780.059265,335.204803 
-	C780.059265,333.564331 780.066345,331.923859 780.057678,330.283417 
-	C780.042542,327.438477 780.589905,324.981262 784.671265,325.162354 
-M754.627136,179.664230 
-	C752.017761,179.003662 749.408447,178.343079 746.110413,177.508163 
-	C746.110413,181.152451 746.110413,183.573624 745.242981,185.839767 
-	C743.369507,185.496277 741.496033,185.152771 740.222107,184.919205 
-	C741.758423,183.556992 744.695740,181.674301 744.450439,181.057785 
-	C742.132690,175.231873 738.119690,178.918991 734.445129,180.052490 
-	C734.041504,177.860321 733.692200,175.963272 733.342896,174.066208 
-	C732.858887,174.107483 732.374817,174.148773 731.890808,174.190063 
-	C731.890808,178.702560 731.890808,183.215057 731.890808,187.634155 
-	C733.689331,187.227005 735.627502,186.156403 736.429199,186.715469 
-	C740.021362,189.220261 743.009460,187.717575 746.113403,186.957687 
-	C746.278015,188.294403 746.442627,189.631119 746.665771,191.443344 
-	C749.851318,189.006393 752.373779,187.076675 755.681458,185.451706 
-	C756.479309,186.046326 757.279724,187.144165 758.074524,187.140152 
-	C760.355591,187.128616 763.555359,187.457184 764.655701,186.168213 
-	C765.762634,184.871338 765.638733,181.015457 764.465210,179.716690 
-	C763.355347,178.488342 760.176270,178.948456 757.918457,179.019791 
-	C756.887207,179.052383 755.882935,179.935471 754.627136,179.664230 
-M84.757996,836.092163 
-	C84.642212,838.054260 83.809586,840.389343 84.588348,841.885986 
-	C85.609367,843.848206 87.676445,845.885803 89.715858,846.508911 
-	C91.451843,847.039307 93.785599,845.613220 95.854897,845.052673 
-	C95.758087,844.559204 95.661285,844.065735 95.564484,843.572266 
-	C92.614235,843.188538 88.307755,845.448975 87.774391,840.230530 
-	C87.125114,833.878174 92.745346,836.413574 96.403000,835.017212 
-	C91.923698,830.952942 88.421494,832.679138 84.708412,834.298706 
-	C81.037682,831.127014 77.338737,832.532898 73.304718,834.010315 
-	C78.120575,834.983521 77.275230,838.416443 77.457932,841.495361 
-	C77.563721,843.278015 78.293900,845.023560 78.743080,846.785828 
-	C79.420654,846.630005 80.098221,846.474121 80.775795,846.318298 
-	C80.775795,844.073914 80.936470,841.815125 80.737671,839.588440 
-	C80.448700,836.351929 81.878639,835.015503 84.757996,836.092163 
-M1047.610962,513.354004 
-	C1045.675049,512.558838 1043.739136,511.763641 1040.817139,510.563416 
-	C1041.137451,516.149719 1041.362183,520.070251 1041.587036,523.990723 
-	C1042.235962,523.969604 1042.884766,523.948486 1043.533691,523.927368 
-	C1043.673462,521.908997 1043.804688,519.890015 1043.955200,517.872437 
-	C1044.143799,515.343567 1044.666138,513.150146 1048.370239,514.778870 
-	C1048.334473,516.104797 1048.167236,517.442932 1048.288452,518.754333 
-	C1048.605225,522.178894 1050.346313,524.422852 1053.981934,524.399963 
-	C1057.791870,524.375977 1059.702393,522.171936 1059.892334,518.431885 
-	C1059.967285,516.956604 1059.972412,515.477905 1060.752197,514.117310 
-	C1061.789917,516.729431 1062.717285,519.394226 1063.925293,521.925110 
-	C1064.349365,522.813477 1065.455322,523.918396 1066.262695,523.928650 
-	C1067.062256,523.938782 1068.217285,522.850342 1068.623657,521.970093 
-	C1069.961304,519.073425 1071.030273,516.052673 1072.202515,513.079590 
-	C1072.554321,513.172791 1072.906128,513.265930 1073.257935,513.359131 
-	C1073.257935,516.567566 1073.257935,519.775940 1073.257935,523.836121 
-	C1075.364258,522.005066 1076.803589,520.753845 1078.195435,520.258728 
-	C1079.770874,526.751892 1084.627197,523.415771 1088.318848,523.760925 
-	C1088.847290,522.244507 1089.336182,520.841431 1089.935791,519.120789 
-	C1094.461792,525.536011 1098.580933,526.168518 1101.350464,521.115723 
-	C1099.035522,520.350525 1095.080811,524.762939 1094.138184,518.831177 
-	C1096.940796,518.582275 1099.510010,518.354065 1102.079346,518.125916 
-	C1102.444946,517.690063 1102.810547,517.254211 1103.176270,516.818359 
-	C1101.505981,514.981812 1100.157104,512.199585 1098.100342,511.500549 
-	C1093.446899,509.918915 1091.517822,513.607605 1089.442871,517.327148 
-	C1089.104858,513.841125 1088.766724,510.355072 1088.400635,506.578522 
-	C1087.290527,507.128479 1086.811890,507.211273 1086.744507,507.424255 
-	C1086.351440,508.666565 1086.054810,509.939392 1085.729004,511.188446 
-	C1080.086548,511.194885 1080.036133,511.224884 1077.387329,515.690735 
-	C1076.624146,514.308228 1075.860962,512.925659 1075.609497,512.470337 
-	C1067.833740,508.936676 1068.718506,515.798279 1066.160645,519.869263 
-	C1065.231323,517.351257 1064.693115,515.493164 1063.854614,513.782410 
-	C1063.406006,512.867371 1062.439453,512.206299 1061.706665,511.430634 
-	C1061.162964,512.313232 1060.619263,513.195740 1059.341187,513.965576 
-	C1055.123291,510.033905 1053.348633,510.045319 1047.610962,513.354004 
-M502.406281,715.684326 
-	C501.238434,714.218689 500.070587,712.753052 498.884308,711.264282 
-	C496.033722,714.565369 495.966492,714.575195 497.238983,723.257446 
-	C497.421875,724.505493 498.555725,726.508972 499.355286,726.561890 
-	C500.548431,726.640625 501.835632,725.296387 503.891266,724.849487 
-	C506.340302,727.154236 509.591217,728.283936 511.855499,725.811584 
-	C513.545898,723.965820 514.451111,720.425537 514.079407,717.877136 
-	C513.381836,713.095093 508.982605,712.532043 502.406281,715.684326 
-M1150.463867,778.945618 
-	C1147.643555,775.534119 1148.045410,772.188599 1150.666260,768.873169 
-	C1149.704224,767.619568 1148.736328,766.358276 1147.492065,764.736938 
-	C1146.450439,766.337158 1144.803711,767.707092 1144.864258,768.996826 
-	C1145.031128,772.545410 1145.795166,776.091431 1146.698608,779.540039 
-	C1146.787720,779.880249 1149.465088,779.542542 1151.693481,778.966370 
-	C1152.302734,779.183777 1152.970337,779.305176 1153.511597,779.634338 
-	C1156.564941,781.491150 1160.108887,781.953308 1161.785767,778.704224 
-	C1163.003906,776.343811 1162.903564,772.528198 1161.814331,770.056274 
-	C1161.207031,768.678284 1157.096802,767.750732 1155.059204,768.337158 
-	C1151.466064,769.371277 1151.404541,772.895752 1151.764282,776.240540 
-	C1151.881348,777.328979 1151.244385,778.498535 1150.463867,778.945618 
-M309.826324,209.312393 
-	C310.896759,208.872360 311.967163,208.432327 313.205475,207.111664 
-	C313.155182,204.445984 313.104889,201.780289 313.793213,198.818298 
-	C318.790131,204.751389 319.286560,209.368988 315.140808,214.128281 
-	C316.116211,214.225220 317.342468,214.612061 317.527252,214.326050 
-	C320.719360,209.385376 323.783203,204.361832 327.055389,199.064651 
-	C327.327148,202.753662 327.585510,206.260468 327.843842,209.767258 
-	C328.490936,209.761673 329.138000,209.756088 329.785095,209.750504 
-	C329.936798,207.805283 329.809906,205.782791 330.321869,203.937531 
-	C330.793945,202.236038 331.951874,200.724838 332.807678,199.129822 
-	C333.618530,200.653290 334.729218,202.096741 335.162720,203.720917 
-	C335.679962,205.658722 335.617065,207.751343 335.805450,209.776901 
-	C336.283112,209.736969 336.760742,209.697037 337.238403,209.657089 
-	C337.671265,208.121613 338.104126,206.586151 338.214447,206.194778 
-	C340.615997,207.518829 342.679779,209.469940 344.922516,209.703674 
-	C348.339752,210.059769 351.880890,209.227219 355.985291,208.841553 
-	C357.686798,206.445404 353.599182,201.271240 359.631134,198.807175 
-	C360.104309,202.718369 360.528900,206.227798 361.015839,210.252762 
-	C365.720917,207.387054 360.210022,200.557587 366.890594,198.901108 
-	C367.300690,202.804413 367.667999,206.300522 368.035309,209.796646 
-	C368.814087,209.746689 369.592865,209.696747 370.371674,209.646790 
-	C370.199615,206.050613 370.256134,202.418121 369.694550,198.883835 
-	C369.554443,198.001968 367.431885,196.854691 366.202179,196.832230 
-	C362.064941,196.756638 357.919403,197.133286 353.520721,197.349503 
-	C353.316681,200.916321 353.118103,204.388031 352.919525,207.859756 
-	C352.450317,207.882080 351.981079,207.904404 351.511871,207.926727 
-	C351.266724,206.454788 351.033264,204.980804 350.773224,203.511475 
-	C350.487305,201.895920 350.704651,199.746292 349.745392,198.806259 
-	C348.515106,197.600616 346.348236,196.944504 344.550049,196.867691 
-	C343.355286,196.816666 342.099548,198.193787 340.871124,198.931641 
-	C341.462250,199.904022 342.053375,200.876404 342.767426,202.051025 
-	C341.632904,202.581055 340.382660,203.165161 340.041504,203.324539 
-	C337.811035,200.800446 336.020935,197.061020 334.221283,197.056427 
-	C328.608612,197.042084 321.223907,195.296310 320.951599,204.968506 
-	C317.753662,202.379929 319.742462,195.458771 313.264801,196.811783 
-	C313.074341,195.392670 312.883850,193.973572 312.693359,192.554474 
-	C312.278168,192.544052 311.862976,192.533646 311.447815,192.523239 
-	C310.857300,193.911911 310.266815,195.300583 309.681427,196.677261 
-	C303.635071,196.945633 301.822296,198.860031 302.330963,204.402252 
-	C302.742310,208.884491 304.458069,210.112228 309.826324,209.312393 
-M988.789246,96.827393 
-	C991.480408,99.108444 994.171570,101.389488 996.862793,103.670540 
-	C996.736389,103.995789 996.610046,104.321030 996.483704,104.646278 
-	C994.303955,104.285690 992.124268,103.925102 989.944519,103.564514 
-	C989.778564,104.057182 989.612671,104.549850 989.446716,105.042519 
-	C991.510193,105.714699 993.584778,106.919090 995.633423,106.876587 
-	C997.057800,106.847031 999.360779,105.344749 999.692505,104.084747 
-	C1001.094910,98.757973 994.507080,100.258110 992.270325,96.029510 
-	C995.288696,96.540947 997.274658,96.877449 999.932190,97.327751 
-	C998.054504,93.613594 995.387207,93.319107 992.662598,94.236519 
-	C990.955750,94.811264 989.548096,96.274879 987.683716,96.590324 
-	C985.248047,91.403336 981.066528,95.154068 977.909668,94.319298 
-	C977.909668,98.705360 977.909668,102.745415 977.909668,106.785461 
-	C978.474426,106.813293 979.039246,106.841118 979.604004,106.868950 
-	C979.800598,104.756248 979.741821,102.576042 980.276550,100.552711 
-	C980.686096,99.003319 981.845520,97.652115 982.671448,96.212791 
-	C983.454651,97.593300 984.579346,98.891006 984.938965,100.374222 
-	C985.446289,102.466354 985.387329,104.695816 985.570496,106.866562 
-	C986.365173,106.824341 987.159851,106.782127 987.954529,106.739906 
-	C987.954529,103.540321 987.954529,100.340729 988.789246,96.827393 
-M314.245056,176.477127 
-	C314.751923,175.906418 315.258759,175.335724 316.114471,174.372208 
-	C316.701385,177.218674 317.173920,179.510300 317.646423,181.801941 
-	C318.233673,181.742767 318.820892,181.683594 319.408142,181.624435 
-	C319.408142,176.643494 319.457031,171.661346 319.332092,166.683533 
-	C319.319702,166.189423 318.145477,165.247467 317.688141,165.345123 
-	C316.847412,165.524612 315.759094,166.159180 315.441925,166.892807 
-	C314.155884,169.867615 313.123779,172.952179 311.229065,176.054916 
-	C309.954498,173.024628 308.794983,169.936981 307.331451,167.000870 
-	C306.920807,166.177094 305.615936,165.799072 304.721252,165.216583 
-	C304.171021,166.088684 303.187531,166.940598 303.145813,167.836380 
-	C302.968842,171.633682 303.002930,175.446167 303.123199,179.247955 
-	C303.151215,180.133224 303.819977,180.998215 304.193939,181.872528 
-	C304.622223,181.818573 305.050537,181.764603 305.478851,181.710648 
-	C305.693512,178.951996 305.908203,176.193359 306.226349,172.104767 
-	C308.218719,176.084488 309.626495,178.896469 311.605469,182.849411 
-	C312.496429,180.101547 313.013153,178.507965 314.245056,176.477127 
-M1283.317139,156.211945 
-	C1278.615112,152.198608 1275.454590,156.067032 1271.968140,157.419647 
-	C1271.546753,156.622971 1271.125366,155.826279 1270.703979,155.029587 
-	C1270.192261,155.552689 1269.257446,156.060242 1269.237427,156.601425 
-	C1269.105347,160.198273 1269.168823,163.802322 1269.168823,167.404022 
-	C1269.768555,167.482300 1270.368286,167.560562 1270.968018,167.638840 
-	C1271.311279,166.618393 1271.654663,165.597961 1272.872192,164.656525 
-	C1277.511353,168.848465 1280.796387,168.987808 1283.961304,165.198639 
-	C1284.507080,164.545349 1285.316406,164.112183 1286.091309,164.472641 
-	C1287.332275,165.670502 1288.573364,166.868362 1290.071777,168.314743 
-	C1290.071777,163.135696 1290.071777,159.348999 1290.071777,154.573380 
-	C1289.939819,154.432236 1288.876221,153.294754 1287.686890,152.022781 
-	C1286.363892,153.638397 1285.161743,155.106461 1283.317139,156.211945 
-M1316.687500,183.256027 
-	C1314.726929,183.256027 1312.766357,183.256027 1311.316406,183.256027 
-	C1311.316406,187.681976 1311.316406,191.542587 1311.316406,195.403214 
-	C1311.776123,195.469147 1312.235718,195.535095 1312.695435,195.601044 
-	C1314.670654,191.891739 1311.551758,186.002838 1317.800293,184.387573 
-	C1318.136719,188.105042 1318.473267,191.822495 1318.809814,195.539963 
-	C1319.424316,195.543640 1320.038818,195.547302 1320.653198,195.550980 
-	C1320.844849,193.450043 1320.778931,191.280884 1321.311768,189.270370 
-	C1321.717896,187.737656 1322.883301,186.406143 1323.710815,184.985092 
-	C1324.501953,186.353333 1325.640015,187.636658 1326.000854,189.110260 
-	C1326.507324,191.179291 1326.436523,193.389694 1326.612671,195.539627 
-	C1327.462524,195.439316 1328.312500,195.339005 1329.162354,195.238693 
-	C1328.677124,191.372040 1329.370972,186.550873 1327.287964,183.977707 
-	C1325.921875,182.290131 1320.541016,183.852493 1316.687500,183.256027 
-M943.776123,106.979935 
-	C945.731323,106.929939 947.715881,107.060242 949.628662,106.749374 
-	C950.506897,106.606651 951.244324,105.597855 952.831543,104.989998 
-	C955.688599,105.690811 958.545654,106.391632 962.182983,107.283852 
-	C961.905945,102.042290 961.696777,98.085182 961.487610,94.128067 
-	C960.849548,94.135086 960.211426,94.142105 959.573364,94.149124 
-	C959.318787,97.721947 959.064270,101.294777 958.787231,105.183548 
-	C954.233765,103.480713 955.135376,99.317581 956.142456,97.596817 
-	C958.138428,94.186523 956.272095,93.103271 953.805176,91.432915 
-	C953.024231,93.399277 952.914429,95.356293 952.764099,97.310196 
-	C952.565186,99.895416 952.334473,102.478195 951.298157,104.878494 
-	C950.861938,102.880119 950.729675,100.744080 949.904480,98.921867 
-	C949.069153,97.077240 947.881226,94.740997 946.248535,94.062958 
-	C943.860291,93.071144 941.163147,93.780228 940.048584,97.141373 
-	C941.215942,97.604431 942.078613,97.946625 942.168457,97.982277 
-	C941.336487,100.040001 940.514099,102.074074 939.622375,104.635902 
-	C940.752197,105.375221 941.882019,106.114532 943.776123,106.979935 
-M1111.769043,747.044128 
-	C1112.281006,747.854187 1112.608032,748.958557 1113.339966,749.418152 
-	C1115.398560,750.710632 1117.882080,752.931458 1119.711548,752.536011 
-	C1121.570923,752.134094 1123.977661,749.112000 1124.087891,747.123352 
-	C1124.214844,744.829773 1122.622559,741.193970 1120.793213,740.395752 
-	C1119.025269,739.624451 1115.944946,741.581726 1113.564453,742.622437 
-	C1112.515625,743.080994 1111.771606,744.237366 1110.974243,744.133911 
-	C1110.732056,742.748901 1110.489990,741.363892 1110.247803,739.978882 
-	C1109.692261,740.005676 1109.136719,740.032471 1108.581177,740.059265 
-	C1108.319336,743.639526 1108.057495,747.219727 1107.786255,750.927063 
-	C1103.937500,748.721680 1103.590332,744.853516 1106.616577,740.796875 
-	C1105.634033,739.578369 1104.651855,738.360352 1103.518066,736.954163 
-	C1102.203735,738.643250 1101.104126,740.056519 1099.238281,741.680054 
-	C1095.907104,740.992798 1092.575928,740.305603 1088.564575,739.477966 
-	C1089.260498,746.335876 1087.601929,752.146973 1090.892334,757.677673 
-	C1091.291748,756.164551 1091.691284,754.651489 1092.092896,753.138672 
-	C1098.883179,752.796875 1100.201172,751.241699 1099.761841,744.211182 
-	C1099.703003,743.270813 1099.896851,742.314575 1100.786743,741.861816 
-	C1101.107178,744.057495 1101.529541,746.244263 1101.723389,748.451111 
-	C1101.995728,751.550659 1102.978516,753.560120 1106.661865,752.650513 
-	C1107.848755,752.357422 1109.125610,752.428406 1110.883423,752.292542 
-	C1110.883423,750.470276 1110.883423,748.717773 1111.769043,747.044128 
-M1102.783203,549.322937 
-	C1106.631348,553.612976 1110.272339,553.523315 1112.430908,548.913879 
-	C1110.086792,548.175598 1106.202515,552.810608 1105.158447,546.926208 
-	C1107.889893,546.512939 1110.443359,546.126526 1113.819092,545.999207 
-	C1115.516113,549.975647 1117.227417,553.932495 1122.609253,552.194885 
-	C1123.071289,554.061646 1123.432617,555.520813 1123.793823,556.979980 
-	C1124.256958,556.941162 1124.720215,556.902283 1125.183350,556.863403 
-	C1125.183350,551.102356 1125.183350,545.341309 1125.183350,539.720032 
-	C1120.359253,538.450745 1116.234619,538.963501 1113.975830,544.103821 
-	C1113.963623,544.131592 1113.395508,543.915161 1113.059692,543.094177 
-	C1110.129150,538.127808 1107.952637,537.846436 1101.508667,541.020325 
-	C1099.492310,540.342285 1097.476074,539.664246 1095.465576,538.988159 
-	C1095.465576,543.983154 1095.465576,547.971069 1095.465576,551.958923 
-	C1096.016357,551.973145 1096.567261,551.987427 1097.118042,552.001648 
-	C1097.293701,550.032410 1097.543335,548.066284 1097.627563,546.093140 
-	C1097.750122,543.220642 1098.608521,541.176697 1102.295776,542.430786 
-	C1102.255981,543.306580 1102.216187,544.182434 1101.872314,545.520081 
-	C1102.152710,546.566895 1102.433105,547.613708 1102.783203,549.322937 
-M735.367493,304.286041 
-	C735.031067,301.964172 734.694580,299.642273 734.387085,296.620972 
-	C731.964355,293.442719 728.579956,293.336487 726.325562,295.847412 
-	C724.746704,297.605927 724.814941,300.934906 724.410217,303.602386 
-	C724.282715,304.443085 724.747314,305.831177 725.396118,306.232300 
-	C726.569153,306.957397 728.075317,307.419312 729.459351,307.463989 
-	C731.631714,307.534149 733.818237,307.166809 736.703186,306.931488 
-	C742.842712,308.274475 739.858765,303.425293 740.739990,301.117065 
-	C741.315979,299.608307 742.374695,298.283813 743.217163,296.876770 
-	C743.985901,298.242401 745.084106,299.527161 745.443909,300.993164 
-	C745.948425,303.048706 745.903564,305.239136 746.093628,307.371887 
-	C750.939636,297.532959 748.560852,294.459900 737.698547,295.207031 
-	C737.698547,296.973267 737.926575,298.811676 737.634949,300.563538 
-	C737.339294,302.339539 736.530273,304.030060 735.789978,305.350372 
-	C735.789978,305.350372 735.414307,305.127869 735.367493,304.286041 
-M1060.100220,485.689240 
-	C1057.947021,482.775177 1054.627319,482.016693 1052.340698,484.211700 
-	C1050.580566,485.901367 1049.700439,489.469696 1050.009644,492.010254 
-	C1050.211182,493.667450 1053.066650,495.843445 1055.047363,496.247406 
-	C1058.101318,496.870209 1060.397705,494.966766 1061.613770,491.256958 
-	C1063.767334,497.095459 1068.160522,496.956329 1072.662598,495.611084 
-	C1072.662598,491.522247 1072.662598,487.552551 1072.662598,483.582825 
-	C1072.124146,483.582092 1071.585571,483.581390 1071.047119,483.580658 
-	C1070.901611,485.735535 1071.079102,487.982056 1070.502197,490.014496 
-	C1070.086182,491.479584 1068.665771,492.659515 1067.693237,493.966614 
-	C1067.018066,492.638977 1066.030518,491.375763 1065.740234,489.968658 
-	C1065.301514,487.842010 1065.348755,485.615051 1065.221802,483.872925 
-	C1062.981201,484.977875 1061.598389,485.659760 1060.100220,485.689240 
-M728.847534,418.800354 
-	C726.832886,418.383240 724.818237,417.966125 722.951843,417.579712 
-	C722.951843,422.512329 722.951843,426.557800 722.951843,430.603271 
-	C723.492065,430.636566 724.032288,430.669830 724.572449,430.703125 
-	C724.854553,428.990143 725.363770,427.277649 725.367615,425.564026 
-	C725.374084,422.697327 725.809937,420.274933 729.807800,420.075195 
-	C729.854309,422.366730 729.171814,425.059601 730.150757,426.837769 
-	C731.145020,428.643494 733.635986,430.097900 735.746155,430.643036 
-	C737.058105,430.981964 738.880371,429.345581 740.473572,428.595734 
-	C737.631104,426.755249 733.711426,431.313812 733.019592,425.373596 
-	C735.457458,425.088623 737.718506,424.824341 740.774109,424.143494 
-	C743.425537,426.997131 743.892151,432.742859 749.832703,430.734711 
-	C750.514465,432.597321 751.069641,434.114105 751.624817,435.630859 
-	C752.100159,435.548706 752.575439,435.466553 753.050781,435.384399 
-	C753.050781,429.579010 753.050781,423.773621 753.050781,417.957947 
-	C748.665344,417.669922 744.066711,416.323639 742.097412,422.029877 
-	C742.064392,422.125336 740.840881,421.809906 740.281250,420.981781 
-	C738.713196,416.768402 735.587280,417.255341 732.279053,418.345886 
-	C731.174988,418.709869 730.092468,419.139069 728.847534,418.800354 
-M1349.416992,184.624039 
-	C1348.382080,183.080307 1347.347046,181.536575 1346.114990,179.699020 
-	C1344.860107,181.279373 1343.957764,182.415726 1342.324219,184.127884 
-	C1340.779907,183.604752 1339.270630,182.831909 1337.684204,182.610168 
-	C1334.332397,182.141708 1331.643677,183.250259 1330.898804,186.884552 
-	C1330.137817,190.597336 1330.572998,194.009262 1334.854492,195.393631 
-	C1337.790771,196.343002 1340.014771,195.453522 1342.281738,191.822357 
-	C1338.676758,191.975128 1335.031982,195.931488 1333.947021,190.151154 
-	C1336.761230,189.944260 1339.325928,189.755722 1341.241455,189.614883 
-	C1341.988892,187.079514 1342.525269,185.259521 1343.402832,184.264542 
-	C1343.676758,186.830124 1343.709595,189.454956 1344.320068,191.937836 
-	C1344.656006,193.304276 1345.963379,194.431915 1346.832764,195.667191 
-	C1347.891479,194.767914 1348.950317,193.868622 1350.733765,192.935806 
-	C1355.533325,197.032562 1358.848877,196.804321 1360.385742,192.050369 
-	C1358.076416,191.758377 1354.638428,196.092331 1353.404297,190.303879 
-	C1356.222412,190.000351 1358.861450,189.716095 1361.497437,189.432190 
-	C1360.547485,181.812607 1356.957397,180.611725 1349.416992,184.624039 
-M516.341797,660.817627 
-	C516.249573,662.632751 515.540100,664.736328 516.219849,666.190674 
-	C517.088135,668.048401 518.846252,670.201294 520.649048,670.710266 
-	C522.432983,671.213928 524.749634,669.830444 526.832642,669.274780 
-	C524.262329,666.672302 519.793884,671.552734 519.106323,665.339966 
-	C521.885864,665.153137 524.470825,664.979431 527.031799,664.807373 
-	C526.903564,657.524231 523.296021,656.088501 515.327209,659.488403 
-	C515.652466,657.852295 515.977783,656.216187 516.303040,654.580078 
-	C515.733765,654.338684 515.164429,654.097229 514.595093,653.855835 
-	C512.668640,657.899658 510.742188,661.943420 508.798889,666.022461 
-	C505.604553,662.491882 506.616302,656.725769 501.553833,654.736206 
-	C502.373413,658.708496 503.698395,662.408386 505.379944,665.938354 
-	C506.230072,667.722839 507.725250,669.200073 508.928802,670.816162 
-	C509.995575,669.255127 511.090485,667.712463 512.122131,666.128540 
-	C513.447083,664.094177 514.721130,662.026611 516.341797,660.817627 
-M907.983032,107.043060 
-	C912.130798,107.562775 915.342468,106.319069 916.403503,102.868652 
-	C917.704773,103.970238 918.951111,105.025337 920.533997,105.182083 
-	C920.560913,101.246643 920.711792,97.305756 920.539124,93.379082 
-	C920.487488,92.203659 919.532227,91.067978 918.282532,90.129478 
-	C917.926880,92.728752 917.571228,95.328026 917.215576,97.927299 
-	C914.442505,91.889297 909.680725,94.160858 906.041870,95.236465 
-	C904.820251,95.920334 903.598694,96.604210 902.457153,96.741852 
-	C900.068298,91.540916 895.926025,95.131424 892.340942,94.298096 
-	C892.120850,98.169868 891.925903,101.598595 891.730957,105.027313 
-	C891.217224,105.035316 890.703491,105.043312 890.189758,105.051308 
-	C889.962585,103.081757 890.114746,100.960899 889.405701,99.183540 
-	C888.637817,97.258636 887.367981,94.651543 885.767822,94.171112 
-	C883.894104,93.608574 881.427917,95.019653 879.218750,95.574608 
-	C879.340576,96.100670 879.462402,96.626732 879.584290,97.152794 
-	C880.390381,97.598999 881.196472,98.045204 881.060913,97.970169 
-	C880.277100,100.356552 879.179749,102.457359 879.104675,104.594131 
-	C879.078125,105.349152 881.503052,106.767952 882.886841,106.874992 
-	C885.793091,107.099800 888.751099,106.656464 891.546204,106.495560 
-	C892.050476,108.599358 892.408020,110.091095 892.765564,111.582832 
-	C893.132446,111.607933 893.499329,111.633034 893.866272,111.658127 
-	C894.410706,110.095650 894.955200,108.533165 895.541687,106.850212 
-	C899.315308,107.279335 902.618958,106.857674 903.534119,101.366776 
-	C904.084900,101.551170 904.635620,101.735565 905.047119,102.830917 
-	C905.172852,105.652229 905.298645,108.473541 905.424377,111.294853 
-	C906.015137,111.267586 906.605835,111.240326 907.196594,111.213058 
-	C907.256836,110.016052 907.317017,108.819046 907.983032,107.043060 
-M1031.229736,92.425972 
-	C1031.817505,92.607582 1032.405151,92.789185 1033.664673,92.980873 
-	C1034.090088,92.849831 1034.515381,92.718788 1035.505981,92.691299 
-	C1035.992798,92.421570 1036.479492,92.151833 1037.652588,91.889343 
-	C1038.078247,91.733627 1038.503784,91.577904 1039.601318,91.528107 
-	C1041.060791,90.994431 1042.520142,90.460754 1044.657715,89.932587 
-	C1045.083496,89.789284 1045.509277,89.645981 1046.593018,89.587303 
-	C1047.675049,89.334892 1048.757202,89.082474 1050.653687,89.084740 
-	C1051.122681,90.875465 1051.988037,92.663734 1051.999146,94.457306 
-	C1052.103271,111.284195 1052.019775,128.112137 1052.080078,144.939453 
-	C1052.108032,152.702866 1055.386841,155.977768 1062.932251,155.980270 
-	C1101.752197,155.993149 1140.572144,155.998993 1179.392090,155.976685 
-	C1187.392334,155.972092 1189.924194,153.482742 1189.930176,145.549637 
-	C1189.959229,106.896339 1189.957153,68.242981 1189.933960,29.589666 
-	C1189.929077,21.399012 1187.431885,18.998623 1179.122559,18.997213 
-	C1140.802490,18.990709 1102.482300,18.991409 1064.162231,18.995167 
-	C1054.415161,18.996122 1052.084839,21.307537 1052.065186,31.052027 
-	C1052.027588,49.711906 1052.015503,68.371841 1051.324585,86.928307 
-	C1050.667358,86.782608 1050.010010,86.636917 1048.770996,86.100113 
-	C1043.113281,84.122368 1037.455688,82.144630 1031.330078,80.003334 
-	C1031.330078,82.258446 1031.330078,83.703835 1030.540405,85.516380 
-	C1030.051636,85.606262 1029.562500,85.776443 1029.074097,85.774246 
-	C1017.617310,85.722763 1006.160400,85.616913 994.703918,85.647430 
-	C993.682983,85.650146 992.664490,86.516731 991.644836,86.982109 
-	C992.572937,87.828728 993.372437,89.028267 994.464111,89.426224 
-	C995.638733,89.854385 997.087463,89.522865 998.416504,89.536476 
-	C1009.372498,89.648621 1020.328552,89.763954 1031.214111,90.570938 
-	C1031.294067,91.024155 1031.373901,91.477371 1031.229736,92.425972 
-M1516.433350,189.604980 
-	C1514.434082,189.535416 1512.435181,189.432343 1510.435425,189.410324 
-	C1509.424561,189.399200 1508.411133,189.523300 1507.400635,189.606155 
-	C1505.194214,189.787003 1502.989014,189.980606 1500.783325,190.168976 
-	C1501.484497,192.094299 1502.185547,194.019608 1502.906006,195.998199 
-	C1502.541626,196.167755 1501.494141,196.655075 1500.446655,197.142395 
-	C1500.585815,197.691330 1500.724976,198.240250 1500.864136,198.789169 
-	C1503.435303,198.308945 1506.006592,197.828720 1508.577881,197.348495 
-	C1508.515991,197.478668 1508.454102,197.608826 1508.392212,197.738998 
-	C1511.225830,197.799210 1514.059570,197.859421 1517.605713,197.970200 
-	C1518.081787,197.969803 1518.557739,197.969406 1519.539673,198.420929 
-	C1520.361084,197.440536 1521.319946,196.542801 1521.970947,195.459885 
-	C1522.896118,193.920609 1523.594971,192.245255 1525.019043,189.350327 
-	C1526.964233,193.382828 1528.102905,195.743240 1529.241455,198.103668 
-	C1531.209351,196.871628 1533.177368,195.639572 1535.142578,194.409210 
-	C1538.492676,199.737274 1540.248657,200.319824 1544.377930,196.549850 
-	C1542.611084,196.128433 1540.940308,195.729965 1539.269653,195.331497 
-	C1539.327759,195.041656 1539.385864,194.751801 1539.443970,194.461960 
-	C1541.164429,194.163986 1542.885010,193.866013 1546.160156,193.298782 
-	C1544.225220,191.223038 1542.861206,188.766586 1541.915649,188.918365 
-	C1537.939941,189.556427 1532.634766,186.546661 1531.100464,191.315872 
-	C1528.479004,190.306320 1526.263428,189.173538 1523.912231,188.648804 
-	C1522.416870,188.315125 1520.719971,188.884247 1518.541992,189.226837 
-	C1518.012085,189.501022 1517.482056,189.775223 1516.433350,189.604980 
-M774.799316,301.712769 
-	C775.557983,302.852966 776.081360,304.336243 777.129211,305.054810 
-	C778.796265,306.198029 780.773315,307.356201 782.695374,307.501556 
-	C784.045471,307.603668 785.522156,306.032776 786.942322,305.208954 
-	C783.945129,303.960632 780.555603,307.475250 779.217346,302.164948 
-	C782.054443,301.897369 784.718811,301.646057 787.383179,301.394745 
-	C787.726685,300.969910 788.070190,300.545074 788.413696,300.120239 
-	C786.776855,298.251221 784.994995,294.727814 783.533264,294.855988 
-	C780.447571,295.126495 777.529480,297.307251 774.728455,298.617401 
-	C774.325012,298.132294 773.152710,296.722748 771.238220,295.264740 
-	C764.869507,293.838043 764.869507,293.838043 762.142517,305.106537 
-	C761.493713,303.569122 761.025513,301.963165 761.009766,300.352753 
-	C760.981201,297.438110 760.443665,295.172302 757.063538,294.414703 
-	C750.190125,292.874146 752.188721,299.003021 750.802368,301.900696 
-	C750.221558,303.114594 751.567017,305.295685 752.171509,306.988953 
-	C752.279907,307.292542 753.051392,307.522003 753.510193,307.511261 
-	C756.339966,307.445221 759.169617,307.329803 761.995605,307.166901 
-	C763.048950,307.106171 764.092468,306.873322 765.140442,306.718964 
-	C765.019714,307.891541 764.899048,309.064087 764.714050,310.861511 
-	C767.721191,312.362579 770.901672,313.791290 773.660339,308.743713 
-	C773.753845,307.835602 773.847351,306.927521 774.117493,305.520264 
-	C774.089111,305.346039 774.060669,305.171844 774.231079,304.283508 
-	C774.183167,303.548309 774.135315,302.813080 774.799316,301.712769 
-M1293.442261,218.239456 
-	C1292.928223,217.919128 1292.414307,217.598801 1291.819458,216.495499 
-	C1289.795044,209.953323 1289.795044,209.953323 1281.813599,211.130798 
-	C1280.740723,212.965683 1279.819092,214.541824 1278.823730,215.299561 
-	C1278.040161,211.895432 1276.007080,210.106918 1272.418335,210.502563 
-	C1267.392944,211.056595 1267.610718,215.193451 1267.011719,218.776840 
-	C1265.580200,217.857010 1264.284058,216.949432 1262.916382,216.167007 
-	C1261.622559,215.426910 1260.253662,214.818192 1258.917725,214.151703 
-	C1259.070435,213.732712 1259.223145,213.313721 1259.375854,212.894745 
-	C1261.384644,213.155716 1263.393311,213.416687 1265.402100,213.677658 
-	C1264.459473,211.920792 1263.025513,210.558167 1261.848267,210.752182 
-	C1259.822021,211.086121 1257.955688,212.389755 1256.022217,213.286423 
-	C1257.243652,214.773987 1258.337280,216.398499 1259.731567,217.701096 
-	C1260.663574,218.571945 1262.023438,218.985092 1263.191895,219.603058 
-	C1263.019409,220.150101 1262.847046,220.697144 1262.674683,221.244186 
-	C1260.431885,220.874374 1258.189087,220.504547 1255.744629,220.101486 
-	C1258.716919,225.084869 1261.811646,225.074158 1267.215332,220.352951 
-	C1273.138794,225.576385 1275.409424,225.059555 1277.530884,218.077835 
-	C1277.753662,217.344315 1278.447998,216.754044 1279.795044,216.698761 
-	C1280.451782,219.018799 1281.108521,221.338837 1281.765137,223.658890 
-	C1282.264038,223.601715 1282.762939,223.544540 1283.261963,223.487366 
-	C1283.411621,221.476593 1283.307251,219.402069 1283.790894,217.475037 
-	C1284.183594,215.909958 1285.281738,214.521927 1286.067139,213.055435 
-	C1287.031128,214.185638 1288.229492,215.192993 1288.902100,216.475937 
-	C1289.816772,218.220978 1290.033936,220.388901 1291.150269,221.944977 
-	C1291.648560,222.639404 1294.577271,222.726334 1294.754028,222.338333 
-	C1296.384888,218.755585 1297.654907,215.008560 1299.029907,211.309311 
-	C1298.304321,211.047272 1297.578857,210.785248 1296.853271,210.523209 
-	C1295.917847,213.061554 1294.982422,215.599915 1293.442261,218.239456 
-M826.559204,307.352325 
-	C831.527527,307.211212 833.418091,305.047546 832.899719,299.938019 
-	C832.471924,295.722107 830.453796,293.617676 825.345642,294.933441 
-	C823.585938,295.918518 821.826172,296.903564 819.940979,297.958862 
-	C818.874878,295.894073 817.246643,292.884125 812.333801,295.091736 
-	C809.933228,294.424042 808.556885,294.848145 808.735474,297.830597 
-	C808.877441,300.202057 808.528503,302.602936 808.397583,304.990753 
-	C807.869995,304.978546 807.342407,304.966339 806.814819,304.954132 
-	C806.642273,303.571838 806.301270,302.185852 806.331421,300.808014 
-	C806.398804,297.734863 805.949585,295.176300 802.295776,294.437347 
-	C796.437927,293.252533 796.901917,297.686462 796.428955,301.087708 
-	C796.184692,302.844147 795.854248,305.427704 796.796143,306.289520 
-	C797.880066,307.281342 800.327026,306.779053 802.181213,306.934357 
-	C804.996704,307.170197 808.531189,306.082367 808.961121,310.686462 
-	C809.035156,311.479065 809.374512,312.246887 809.591248,313.026123 
-	C810.136169,312.681488 810.681091,312.336823 811.226013,311.992188 
-	C811.473083,310.267548 811.720093,308.542908 812.659607,307.037201 
-	C817.530396,309.234650 819.052490,305.341919 821.217834,301.402710 
-	C821.646240,305.700439 821.975647,309.004639 822.305054,312.308838 
-	C822.756531,312.286865 823.207947,312.264893 823.659363,312.242920 
-	C824.443604,310.480652 825.227844,308.718384 826.559204,307.352325 
-M1113.149170,776.649414 
-	C1116.263672,782.069702 1119.937622,782.553833 1123.548218,777.786133 
-	C1121.135132,776.738953 1116.785156,781.417908 1116.053101,775.295288 
-	C1118.760010,775.117920 1121.341064,774.948792 1125.726929,774.661377 
-	C1123.652832,771.830688 1122.584473,768.868713 1120.814331,768.363098 
-	C1118.893311,767.814392 1116.319214,769.552002 1113.241943,769.987793 
-	C1111.883911,767.886719 1110.534058,766.675110 1109.362305,770.103577 
-	C1108.827637,771.668030 1108.378784,773.261841 1107.510864,776.073730 
-	C1106.815674,773.581909 1106.646606,772.412537 1106.164062,771.391296 
-	C1105.580200,770.155884 1104.731201,769.045959 1103.996826,767.881714 
-	C1103.158447,768.936951 1102.387207,770.055603 1101.464966,771.031494 
-	C1100.322998,772.239685 1099.055786,773.329407 1097.282837,774.997070 
-	C1098.018066,776.044617 1099.380493,777.985596 1100.952759,780.225464 
-	C1102.055786,777.917847 1102.802246,776.356079 1103.609375,774.667480 
-	C1105.036377,776.854431 1106.297607,778.787415 1107.558960,780.720459 
-	C1108.987671,778.532227 1110.416504,776.343933 1111.987183,773.938354 
-	C1112.385864,774.610962 1112.776123,775.269470 1113.149170,776.649414 
-M1135.202393,515.916626 
-	C1134.448608,514.374390 1133.694946,512.832214 1132.823853,511.049957 
-	C1130.429077,515.229004 1130.676392,521.543762 1132.391113,523.209839 
-	C1133.940796,522.301941 1135.282227,521.515930 1136.619873,521.410400 
-	C1137.485352,522.539185 1138.350830,523.667969 1139.193848,524.767334 
-	C1138.374146,525.243225 1137.338257,525.844543 1136.165039,526.525696 
-	C1141.614014,530.257324 1145.803711,529.658203 1146.570557,524.852661 
-	C1147.251343,520.586365 1146.713257,516.125610 1146.713257,511.731079 
-	C1142.340576,511.930756 1137.296509,509.410858 1135.202393,515.916626 
-M84.842148,620.138672 
-	C85.565033,619.893372 86.287918,619.648132 87.270714,620.242004 
-	C87.474052,625.903870 89.037621,627.930542 92.950157,627.611267 
-	C97.436722,627.245056 101.923645,626.883301 106.304604,626.528137 
-	C104.820175,621.888733 104.820175,621.888733 108.013458,619.106934 
-	C108.922409,623.276184 109.705482,626.868042 110.885300,632.279724 
-	C113.381859,626.850952 115.353470,622.563660 117.325089,618.276367 
-	C116.492867,617.605103 115.660652,616.933899 114.828430,616.262695 
-	C114.213379,618.081787 113.598328,619.900879 112.926926,621.886719 
-	C109.249504,617.059570 93.500443,616.303467 86.890236,618.846252 
-	C85.939316,618.610718 84.988396,618.375183 83.357162,618.062500 
-	C82.902802,618.044739 82.448441,618.026917 81.380600,618.032104 
-	C81.203506,618.375977 81.026413,618.719788 80.444489,619.605347 
-	C77.144028,618.683350 73.843567,617.761353 70.377670,616.793152 
-	C70.377670,622.286072 70.377670,626.457397 70.377670,631.676270 
-	C71.864243,630.390381 72.270172,629.918945 72.777733,629.620300 
-	C75.461418,628.041321 78.170631,626.505615 80.797333,625.497192 
-	C80.833473,625.676025 80.869621,625.854858 80.967087,626.656677 
-	C81.833900,626.304260 83.298454,626.121704 83.455894,625.567688 
-	C83.936249,623.877625 83.913055,622.044495 84.842148,620.138672 
-M440.311798,366.375061 
-	C440.864105,366.541718 441.416412,366.708374 442.706146,366.819031 
-	C448.439728,364.857819 454.173279,362.896606 460.704010,361.158752 
-	C461.132507,362.623505 461.886261,364.078522 461.930511,365.554810 
-	C462.083618,370.661499 462.118591,375.779816 461.948914,380.885437 
-	C461.813812,384.951752 461.314148,389.005951 460.259186,392.883698 
-	C453.785614,390.945465 447.312012,389.007202 440.838440,387.068939 
-	C440.935120,387.749451 441.031799,388.429962 441.128479,389.110474 
-	C439.291016,389.935730 437.467438,391.437042 435.613800,391.475189 
-	C424.618652,391.701233 413.616180,391.539001 402.616791,391.605835 
-	C394.780243,391.653412 392.494141,393.810089 391.932373,401.486237 
-	C391.750244,403.974915 391.678436,406.476929 391.678162,408.972839 
-	C391.666138,517.470825 391.667755,625.968872 391.667694,734.466858 
-	C391.667694,735.800171 391.595612,737.138000 391.679749,738.466003 
-	C391.970459,743.052734 390.075562,745.395325 385.263428,745.082520 
-	C382.940033,744.931519 380.598572,745.059814 378.265289,745.059937 
-	C362.598907,745.060547 346.932434,745.032349 331.266205,745.078247 
-	C326.517426,745.092163 326.273804,745.465271 327.324493,749.333984 
-	C329.660309,749.171204 331.955048,748.877869 334.250458,748.872559 
-	C351.416718,748.832886 368.583221,748.886353 385.749390,748.831970 
-	C392.969574,748.809082 395.645538,746.054321 395.785309,738.820129 
-	C395.814301,737.320740 395.792023,735.820251 395.792023,734.320312 
-	C395.792145,624.655640 395.792023,514.990967 395.793121,405.326324 
-	C395.793121,403.659760 395.289307,401.742035 395.944244,400.388397 
-	C396.821136,398.576172 398.565918,395.881989 399.998779,395.843750 
-	C413.114288,395.493927 426.242950,395.638000 439.480347,395.638000 
-	C439.906677,397.564301 440.249603,399.113617 440.676971,401.044373 
-	C447.233124,398.913605 453.510468,396.873413 460.613464,395.058899 
-	C461.072144,396.529419 461.897461,397.992584 461.927124,399.471710 
-	C462.067261,406.462189 461.960541,413.457214 461.998322,420.450317 
-	C462.034973,427.224792 463.821075,429.017242 470.538544,429.019531 
-	C507.336639,429.032135 544.134705,429.028351 580.932800,429.029175 
-	C584.096436,429.029266 587.261902,429.089966 590.423218,429.003021 
-	C595.947449,428.851135 597.943909,426.849579 598.012329,421.495056 
-	C598.048462,418.665009 598.017761,415.834076 598.829285,412.801514 
-	C599.946533,412.527832 601.063477,412.016418 602.181091,412.015015 
-	C636.231689,411.972687 670.282288,411.980499 704.641235,411.980499 
-	C705.013794,407.722717 701.615356,408.683441 699.359070,408.678802 
-	C667.234802,408.613159 635.110352,408.628082 602.985962,408.649261 
-	C601.329163,408.650360 599.672424,408.883240 598.038025,408.107849 
-	C598.346497,400.337128 598.956909,392.564423 598.905334,384.796112 
-	C598.764465,363.566772 598.314026,342.339630 598.100769,321.110443 
-	C598.085876,319.630280 599.010315,318.140656 600.163574,316.853821 
-	C606.524719,319.078827 612.885803,321.303833 619.571899,323.642487 
-	C619.861023,321.391510 620.064636,319.806396 620.332092,317.724670 
-	C624.175171,317.724670 627.800781,317.724792 631.426392,317.724640 
-	C652.220154,317.723785 673.014160,317.757202 693.807251,317.638550 
-	C695.084167,317.631287 696.354309,316.422546 697.627625,315.772858 
-	C696.660217,315.203644 695.692871,314.138153 694.725342,314.137909 
-	C671.775024,314.132263 648.824768,314.241608 625.874451,314.328278 
-	C624.091980,314.334991 622.309448,314.329163 620.552917,314.329163 
-	C620.081482,312.061249 619.735229,310.395355 619.316589,308.381042 
-	C612.627747,310.715332 606.369141,312.899475 599.311768,314.861023 
-	C598.880981,310.045258 598.311951,305.236816 598.057129,300.411774 
-	C597.785339,295.264343 595.974854,293.033539 590.815918,293.025269 
-	C550.338928,292.960541 509.861694,292.963593 469.384644,293.019043 
-	C464.283051,293.026031 462.110107,295.294189 462.019806,300.383240 
-	C461.904572,306.877655 461.974335,313.375366 461.039093,320.017822 
-	C459.218414,320.157257 457.397888,320.415924 455.577026,320.418060 
-	C432.280975,320.445343 408.984894,320.443909 385.688812,320.430878 
-	C378.846741,320.427063 377.847870,319.464905 377.835236,312.696289 
-	C377.810059,299.218079 377.788940,285.739319 377.891235,272.261719 
-	C377.918152,268.719025 376.830231,267.713257 374.162323,269.158295 
-	C374.162323,282.790558 374.162476,295.909943 374.162262,309.029358 
-	C374.162048,323.176819 375.019257,324.006866 389.077637,324.046509 
-	C413.367096,324.114990 437.656433,324.228516 461.968292,325.219635 
-	C461.975159,335.036804 462.066162,344.855377 461.897827,354.669556 
-	C461.872681,356.135651 460.630005,357.580872 459.176514,359.038513 
-	C453.099854,357.303101 447.023224,355.567657 440.571075,353.725006 
-	C440.406708,355.550659 440.292847,356.815033 439.219696,358.039520 
-	C403.296722,358.015686 367.373718,357.991577 331.450745,357.970184 
-	C330.785919,357.969788 329.893341,357.732697 329.498474,358.067596 
-	C328.255310,359.121887 327.199036,360.396515 325.783203,361.888519 
-	C364.841675,361.888519 402.551392,361.888519 440.223999,362.702667 
-	C440.321228,363.774017 440.418457,364.845367 440.311798,366.375061 
-M379.130920,229.066086 
-	C378.972992,228.910583 378.815094,228.755066 378.458038,228.019318 
-	C376.776611,224.339508 374.071564,223.981262 370.705261,225.573410 
-	C369.893890,225.957169 368.916351,226.486115 368.132355,226.336075 
-	C365.954529,225.919357 363.838318,225.180435 361.661499,224.558426 
-	C361.661499,229.558807 361.661499,233.626633 361.661499,237.694473 
-	C362.192474,237.716507 362.723480,237.738525 363.254456,237.760559 
-	C363.450317,235.659576 363.654572,233.559357 363.840149,231.457458 
-	C364.148132,227.968872 364.396851,227.731247 368.202789,227.450806 
-	C368.202789,227.932938 368.080719,228.449265 368.222534,228.878403 
-	C369.151337,231.688980 369.349335,235.412598 371.292847,237.055588 
-	C374.062134,239.396683 377.216919,237.811798 378.853912,234.338028 
-	C379.588684,234.695404 380.323486,235.052780 381.443329,236.084534 
-	C385.249634,239.689545 388.602997,237.463654 391.296234,235.338867 
-	C393.593414,236.363876 395.412231,237.873215 397.117218,237.754059 
-	C399.108063,237.614929 400.999481,236.054123 402.934052,235.110138 
-	C401.724487,233.468445 400.659271,231.686615 399.251923,230.236938 
-	C398.388367,229.347351 397.000916,228.966370 395.848694,228.357010 
-	C395.996735,227.954865 396.144775,227.552734 396.292816,227.150589 
-	C398.306885,227.369781 400.320953,227.588974 402.781952,227.856796 
-	C398.851074,223.316772 395.737549,223.679611 391.944092,228.582672 
-	C386.897034,223.509354 384.628448,223.295334 380.397980,227.936737 
-	C380.141571,228.460114 379.885162,228.983490 379.130920,229.066086 
-M1526.650635,610.698914 
-	C1524.030640,610.060242 1521.410767,609.421509 1518.771240,608.777954 
-	C1518.771240,613.904724 1518.771240,617.922363 1518.771240,622.154663 
-	C1521.608887,620.222900 1523.825317,618.714050 1526.836060,616.969177 
-	C1527.839722,618.700073 1528.843506,620.430908 1529.766235,622.022095 
-	C1531.469604,620.884216 1532.848511,619.997437 1534.190552,619.057678 
-	C1535.753052,617.963562 1537.283081,616.823242 1538.686157,615.805298 
-	C1539.166138,616.650696 1539.707764,617.772766 1540.447876,618.743469 
-	C1540.571899,618.906128 1541.747925,618.586365 1542.108887,618.190063 
-	C1543.326782,616.852722 1542.280518,606.622253 1540.032837,603.780212 
-	C1539.545044,607.211182 1539.183350,609.755676 1538.835815,612.302124 
-	C1535.510986,607.389221 1530.070679,608.480469 1526.650635,610.698914 
-M784.722900,400.989655 
-	C791.524841,403.791718 792.410645,403.693390 795.086060,399.839142 
-	C788.863708,400.008301 788.863708,400.008301 788.221985,397.207916 
-	C790.688293,397.079926 793.129333,396.953247 795.527222,396.828827 
-	C795.854919,390.691406 792.285828,388.075287 787.279358,390.351562 
-	C786.231628,390.827942 785.084717,391.086121 783.695007,390.775574 
-	C782.667175,389.553436 781.639343,388.331268 781.056824,387.638672 
-	C778.430054,388.888611 776.172546,389.962891 773.335815,391.312775 
-	C773.335815,392.655243 773.657837,394.703796 773.228455,396.580475 
-	C772.915283,397.949524 771.611755,399.091980 770.749695,400.335419 
-	C769.994446,399.110443 768.862122,397.968628 768.569336,396.641602 
-	C768.089966,394.468933 768.156738,392.175751 767.993103,389.933411 
-	C767.171387,389.981262 766.349609,390.029114 765.527893,390.076965 
-	C765.751770,393.635193 764.881531,397.889709 766.557861,400.523499 
-	C767.818665,402.504486 772.346985,402.405762 775.820190,403.340302 
-	C776.232788,398.807068 776.541321,395.417267 776.849915,392.027435 
-	C777.370300,392.042572 777.890686,392.057709 778.411133,392.072845 
-	C778.524658,394.443726 778.432861,396.847198 778.802185,399.177521 
-	C779.299011,402.311737 780.561951,404.481995 784.722900,400.989655 
-M803.778931,184.870438 
-	C805.420288,185.925537 807.061707,186.980637 808.548279,187.936188 
-	C808.350403,184.862686 808.196289,182.469254 808.876770,179.867920 
-	C809.655029,181.168655 810.416260,182.479965 811.216125,183.767288 
-	C812.084656,185.164886 812.855835,187.603882 813.901672,187.734909 
-	C817.736633,188.215347 821.668091,187.925262 826.893555,187.925262 
-	C825.857300,184.083405 825.370728,181.109436 824.097107,178.523056 
-	C823.835449,177.991730 820.629395,178.897568 818.789490,179.196228 
-	C818.702820,179.210297 818.703857,179.764160 818.628601,180.335236 
-	C819.858398,180.630997 821.109375,180.931854 822.457581,181.256119 
-	C820.158020,182.747559 818.149170,184.050415 816.012573,185.436142 
-	C811.982056,182.945587 819.219788,177.134872 813.782349,175.542770 
-	C810.942627,176.862778 808.602539,177.950546 805.642212,179.497284 
-	C803.412048,179.749588 803.412048,179.749588 803.033875,174.447906 
-	C802.316284,174.615677 801.598755,174.783447 800.550842,175.549072 
-	C800.329224,176.639130 800.107605,177.729187 799.839355,179.048630 
-	C795.379761,173.705505 790.946228,172.578537 787.388855,175.656418 
-	C784.511536,178.145905 784.294678,183.234680 786.948730,185.983810 
-	C790.303528,189.458832 794.986206,188.506271 799.886963,183.329391 
-	C800.208252,183.914932 800.523804,184.490158 800.733521,185.791779 
-	C801.275024,186.400284 801.816528,187.008789 802.358032,187.617294 
-	C802.593201,186.752792 802.828430,185.888290 803.778931,184.870438 
-M950.249756,66.285439 
-	C947.858765,67.271622 945.467712,68.257797 942.925110,69.306511 
-	C942.750977,66.944420 942.556396,64.304367 942.327576,61.200157 
-	C938.972900,63.965359 938.730042,75.520340 941.698975,79.319122 
-	C942.299744,77.413925 942.790588,75.857430 943.447205,73.775131 
-	C944.741699,75.292870 945.696716,76.570625 946.815125,77.684181 
-	C948.240417,79.103241 949.640503,79.750793 951.011780,77.231277 
-	C957.143799,77.869911 963.275818,78.508545 969.256958,79.131462 
-	C968.859680,75.967590 968.903320,73.628677 968.205627,71.537071 
-	C967.546387,69.560677 966.457397,66.786766 964.924133,66.279968 
-	C962.989441,65.640533 960.412781,66.943825 958.113037,67.409035 
-	C958.166687,67.946869 958.220276,68.484711 958.273865,69.022552 
-	C959.161255,69.527489 960.048584,70.032425 960.563477,70.325417 
-	C959.056030,72.419296 957.579285,74.470520 955.390137,77.511330 
-	C955.390137,73.332687 955.390137,70.156410 955.390137,65.962425 
-	C955.342224,65.907761 954.411621,64.846115 953.351562,63.636696 
-	C952.493530,64.641830 951.761841,65.498978 950.249756,66.285439 
-M246.174194,378.341248 
-	C244.702408,377.770935 243.230621,377.200592 241.758835,376.630249 
-	C241.957703,376.116211 242.156555,375.602142 242.355423,375.088074 
-	C245.252457,375.088074 248.149506,375.088074 251.205414,375.088074 
-	C251.834656,380.221924 254.895035,381.862976 259.545044,380.744995 
-	C259.918579,382.635864 260.224487,384.184509 260.530396,385.733124 
-	C261.057190,385.689423 261.583984,385.645721 262.110779,385.602020 
-	C262.110779,379.885986 262.110779,374.169922 262.110779,368.398132 
-	C257.763916,367.690338 253.052521,366.402679 251.122360,371.931946 
-	C249.260468,370.539795 247.626556,369.318115 245.259552,367.891357 
-	C244.508987,367.962494 243.758408,368.033600 242.269592,368.124847 
-	C238.110229,370.264862 237.970505,373.956451 239.340271,377.536621 
-	C240.658157,380.981232 243.616043,381.898712 247.704758,380.175385 
-	C248.238541,379.494965 248.772324,378.814545 249.306107,378.134064 
-	C248.546158,378.122437 247.786224,378.110809 246.174194,378.341248 
-M1317.288208,220.802612 
-	C1320.918457,225.628479 1324.667969,223.843979 1328.106934,221.028595 
-	C1329.952759,221.995148 1331.617065,223.612381 1333.129150,223.480759 
-	C1335.302979,223.291534 1337.365845,221.829086 1339.476074,220.910080 
-	C1338.282227,219.248398 1337.219238,217.466644 1335.844849,215.970795 
-	C1335.039795,215.094666 1333.738525,214.674393 1332.660522,214.049057 
-	C1332.844116,213.632294 1333.027832,213.215546 1333.211548,212.798782 
-	C1335.134644,213.128067 1337.057739,213.457336 1338.980835,213.786621 
-	C1339.139526,213.393417 1339.298340,213.000198 1339.457153,212.606979 
-	C1338.005737,211.928772 1336.477173,210.579147 1335.121582,210.734909 
-	C1333.242432,210.950821 1331.493164,212.297989 1329.688354,213.160782 
-	C1330.861328,214.678024 1331.907227,216.322235 1333.252197,217.667450 
-	C1334.135376,218.550644 1335.450317,219.002075 1336.571899,219.646851 
-	C1336.436768,220.112671 1336.301514,220.578476 1336.166260,221.044296 
-	C1333.217896,220.832794 1330.261108,220.685883 1327.334473,220.306854 
-	C1327.051392,220.270203 1326.521973,218.494125 1326.840698,218.036758 
-	C1329.111084,214.778290 1327.455078,212.402634 1324.793701,211.105103 
-	C1321.678345,209.586304 1318.567139,210.053040 1316.250000,213.902252 
-	C1310.864014,209.121475 1309.392578,209.181671 1303.946289,214.449799 
-	C1303.204346,213.225296 1302.466919,212.008347 1301.058960,209.684616 
-	C1301.058960,215.105469 1301.058960,219.070969 1301.058960,223.036469 
-	C1301.571777,223.040466 1302.084473,223.044464 1302.597290,223.048462 
-	C1302.832031,220.795013 1303.066895,218.541565 1303.437744,214.981598 
-	C1304.269165,216.785721 1304.587158,217.308273 1304.759644,217.875061 
-	C1306.842651,224.720673 1309.985962,225.580673 1315.316528,220.791718 
-	C1315.766235,220.387726 1316.483398,220.281433 1317.288208,220.802612 
-M75.738846,604.326721 
-	C78.230667,604.508728 80.722481,604.690674 84.827843,604.990479 
-	C83.315613,600.940979 82.875320,597.627869 81.003700,595.715576 
-	C80.159668,594.853271 76.463150,596.782837 73.832726,596.607971 
-	C70.435852,592.961304 68.000946,595.851135 65.513672,597.908081 
-	C59.360363,592.958069 56.685287,593.960571 54.303673,602.034119 
-	C51.228889,602.874390 49.478668,602.085327 49.753922,598.505371 
-	C49.881077,596.851624 49.918571,595.157410 49.690216,593.524292 
-	C49.578716,592.726868 48.765209,592.027527 48.269474,591.283752 
-	C47.633419,592.060486 46.493046,592.809326 46.448147,593.618835 
-	C46.248108,597.225342 46.361309,600.849304 46.361309,605.500549 
-	C53.072754,603.420166 59.690556,606.914246 65.818741,602.644226 
-	C68.156113,606.015503 71.480896,605.644897 75.738846,604.326721 
-M155.065460,226.948730 
-	C114.042137,226.961411 73.018806,226.974091 31.311474,227.233200 
-	C26.591526,228.365784 25.912687,231.806244 25.919899,236.004913 
-	C25.987167,275.168823 25.954401,314.332947 25.962690,353.496979 
-	C25.964338,361.278687 27.802551,363.061005 35.739170,363.061584 
-	C71.736755,363.064148 107.734352,363.053497 143.731918,363.082916 
-	C145.878113,363.084686 148.027390,363.568939 150.169525,363.528290 
-	C157.649063,363.386475 163.147461,363.017303 163.020355,352.266510 
-	C162.799713,333.606659 163.059158,314.941101 164.005096,296.007355 
-	C169.992340,295.954865 175.979614,295.858124 181.966812,295.862061 
-	C188.245987,295.866180 189.535095,297.150635 189.551651,303.506500 
-	C189.588486,317.648804 189.393158,331.794434 189.658691,345.931824 
-	C189.746765,350.621307 190.983414,355.285858 191.619659,359.972015 
-	C191.717285,360.690918 191.421906,361.467987 191.282761,362.213379 
-	C190.714890,365.255524 189.645294,368.294525 189.637222,371.337006 
-	C189.526917,412.931976 189.563477,454.527313 189.559845,496.122559 
-	C189.559723,497.619202 190.036545,499.422028 189.375488,500.541534 
-	C188.353851,502.271759 186.592041,504.728607 185.055069,504.794312 
-	C177.432083,505.120209 169.779892,504.762939 162.039383,503.766693 
-	C162.008591,485.275116 161.953766,466.783569 161.965073,448.291992 
-	C161.967667,444.041138 160.782516,440.768921 155.481537,439.254578 
-	C154.501099,439.136017 153.520676,438.913788 152.540237,438.913788 
-	C112.020775,438.913940 71.501320,438.934082 30.247482,439.026489 
-	C25.886292,440.180634 24.912596,443.338348 24.929094,447.406708 
-	C25.007252,466.677429 24.961319,485.948639 24.961229,505.219696 
-	C24.961132,525.653625 24.954796,546.087585 24.972219,566.521545 
-	C24.974937,569.710388 24.897114,573.002075 29.744524,574.391785 
-	C31.372952,574.605591 33.001213,575.004517 34.629829,575.005981 
-	C73.538315,575.040710 112.447174,575.097961 151.354706,574.900635 
-	C154.236801,574.886047 157.109344,572.986084 160.595642,571.498047 
-	C161.046295,569.268250 161.874359,567.040833 161.888199,564.808350 
-	C162.003540,546.192261 161.968948,527.575195 162.911102,508.816101 
-	C169.076721,508.787354 175.242325,508.752197 181.407959,508.731323 
-	C191.194977,508.698242 193.520111,506.388458 193.520798,496.630127 
-	C193.523773,454.965271 193.521133,413.300446 193.521439,371.635590 
-	C193.521454,370.302368 193.566772,368.968170 193.529541,367.636108 
-	C193.441711,364.493286 195.126785,362.973969 198.088135,362.947235 
-	C206.025299,362.875610 213.963516,362.922821 221.851730,362.922821 
-	C223.808029,358.814392 221.232437,358.160919 218.579834,358.200745 
-	C213.254288,358.280670 207.935196,358.732056 202.611053,358.978271 
-	C194.297211,359.362701 193.623932,358.736572 193.615204,350.575684 
-	C193.576355,314.244385 193.535782,277.913055 193.524643,241.581757 
-	C193.509827,193.250549 193.528824,144.919327 193.515427,96.588112 
-	C193.513107,88.254868 191.089218,85.904358 182.893326,85.757103 
-	C176.245132,85.637657 169.600494,85.320190 162.960526,84.137817 
-	C162.954559,65.815483 162.980133,47.493065 162.927521,29.170868 
-	C162.905609,21.535456 160.314651,19.002262 152.720016,19.000078 
-	C113.909676,18.988924 75.099342,18.987694 36.289001,18.999170 
-	C27.636093,19.001728 25.961393,20.653227 25.960230,29.083935 
-	C25.954868,67.894272 25.956059,106.704613 25.960171,145.514954 
-	C25.961052,153.827240 28.164078,155.982758 36.675823,155.983932 
-	C74.819885,155.989197 112.963951,155.988754 151.108017,155.984985 
-	C160.767776,155.984024 162.916946,153.846268 162.946320,144.348923 
-	C163.002991,126.029732 163.079071,107.710609 164.050171,89.224548 
-	C170.041016,89.198837 176.031876,89.149757 182.022705,89.153648 
-	C188.696976,89.157990 189.553299,89.976685 189.554550,96.566376 
-	C189.566605,160.143768 189.566269,223.721161 189.539902,287.298553 
-	C189.539185,289.021088 189.206085,290.743500 189.038956,292.360016 
-	C179.938004,292.360016 171.464294,292.360016 162.972900,291.361328 
-	C162.962601,273.299225 162.975510,255.237045 162.929718,237.175018 
-	C162.913071,230.607986 161.166824,228.139893 155.065460,226.948730 
-M161.979065,744.070984 
-	C161.968857,725.996216 162.009827,707.921143 161.875122,689.847290 
-	C161.860474,687.880493 160.831909,685.921143 160.179077,683.185120 
-	C159.352676,679.356140 156.359802,678.940918 153.253540,678.939148 
-	C113.091499,678.915833 72.929420,678.925842 32.767357,678.925354 
-	C28.610277,678.925293 25.634439,680.414062 25.002333,685.916077 
-	C24.989288,725.866760 24.969860,765.817383 24.968929,805.768066 
-	C24.968756,813.190918 26.886936,815.054199 34.501625,815.056213 
-	C73.453682,815.066833 112.405731,815.066650 151.357788,815.058167 
-	C159.375595,815.056458 161.851578,812.841309 161.898422,804.714844 
-	C162.003983,786.406311 161.856201,768.096313 162.446381,749.194580 
-	C182.337036,749.194580 202.227707,749.194580 222.575516,749.194580 
-	C223.138428,744.721680 219.834305,744.959778 216.979034,744.957153 
-	C198.650848,744.940552 180.322632,744.985352 161.979065,744.070984 
-M1467.078735,808.715881 
-	C1468.790283,812.722412 1471.781372,814.119446 1476.145508,814.106628 
-	C1515.206421,813.991943 1554.267822,814.050171 1593.329102,814.002441 
-	C1594.915771,814.000549 1596.501709,813.450012 1598.811279,813.028137 
-	C1601.921875,811.671570 1603.109253,809.318481 1603.104004,805.919556 
-	C1603.042603,765.839111 1603.059448,725.758545 1603.070312,685.677979 
-	C1603.071533,681.485535 1601.476196,678.615906 1596.076538,677.914795 
-	C1555.045044,677.927368 1514.013672,677.939880 1472.244751,678.021545 
-	C1467.959229,679.124695 1466.823853,681.983887 1466.866089,686.218994 
-	C1467.043091,703.959900 1466.971191,721.703796 1466.894165,739.446167 
-	C1466.885864,741.334229 1466.247314,743.219482 1465.185181,744.916992 
-	C1458.658936,743.083313 1452.132812,741.249695 1445.001465,739.246033 
-	C1445.100342,744.683594 1441.559082,743.667358 1438.643677,743.667908 
-	C1371.331787,743.679321 1304.020020,743.675110 1236.708130,743.685059 
-	C1234.880249,743.685303 1232.845337,743.337219 1231.288696,744.020874 
-	C1229.994141,744.589661 1229.261963,746.438782 1227.946411,748.157227 
-	C1301.011597,748.157227 1372.556763,748.157227 1444.049316,748.157227 
-	C1444.542236,749.917358 1444.967285,751.434509 1445.521606,753.413635 
-	C1452.470215,751.032654 1459.055176,748.776306 1466.281372,747.200378 
-	C1466.500732,749.153931 1466.903442,751.106812 1466.911255,753.061218 
-	C1466.985107,771.375916 1466.991455,789.690918 1467.078735,808.715881 
-M539.826904,668.018250 
-	C539.826904,665.291992 539.826904,662.565674 539.826904,659.839417 
-	C540.468689,659.784119 541.110413,659.728821 541.752197,659.673523 
-	C542.261230,663.424500 542.770264,667.175476 543.279297,670.926453 
-	C543.878845,670.880188 544.478455,670.833923 545.078003,670.787659 
-	C545.361694,667.247131 545.645386,663.706604 545.929016,660.166077 
-	C546.419556,660.091431 546.910034,660.016846 547.400513,659.942200 
-	C548.535889,662.553894 550.268799,665.086914 550.626038,667.801025 
-	C550.937134,670.165100 549.695496,672.733398 549.164124,675.103638 
-	C553.282104,675.103577 559.303894,664.364868 557.657654,656.915100 
-	C555.979370,660.451294 554.743042,663.056396 553.400757,665.884766 
-	C550.812805,662.933472 552.090454,656.999390 545.592468,657.798584 
-	C546.450256,656.265015 547.002747,655.277222 547.555237,654.289490 
-	C547.173645,653.901489 546.792114,653.513550 546.410522,653.125549 
-	C544.229919,654.923706 542.298950,657.569458 539.805054,658.303894 
-	C536.733948,659.208313 533.193848,658.520020 530.028564,658.520020 
-	C530.028564,662.732422 530.028564,666.753418 530.028564,671.457764 
-	C534.771240,668.520264 529.017212,660.880676 537.135681,660.270996 
-	C537.135681,663.381836 537.135681,666.171753 537.049866,669.652466 
-	C537.633423,670.044067 538.217041,670.435730 538.800598,670.827332 
-	C539.104431,670.191650 539.408264,669.555969 539.826904,668.018250 
-M750.900208,330.218262 
-	C752.589050,334.883636 755.290955,336.543365 758.910706,335.138977 
-	C762.214905,333.856995 763.662781,328.934418 761.805786,325.296387 
-	C759.888367,321.540039 756.308411,321.483063 750.401062,325.068237 
-	C748.945618,324.244659 747.479736,322.714447 746.126221,322.808136 
-	C743.919739,322.960907 741.786682,324.173889 739.622681,324.939514 
-	C740.898315,326.540344 742.081116,328.229340 743.484802,329.708710 
-	C744.320007,330.588959 745.502686,331.139526 747.578064,332.552307 
-	C743.135071,332.552307 739.828674,333.431763 737.469360,332.313293 
-	C734.939392,331.113953 730.766052,336.542786 729.670166,330.060059 
-	C731.170288,329.927612 732.455200,329.834015 733.735168,329.695557 
-	C734.991028,329.559692 736.242004,329.378204 737.460266,329.221222 
-	C737.189819,323.468018 733.880676,320.929626 729.564880,322.852692 
-	C728.300049,323.416290 727.173767,324.290771 725.699524,324.326599 
-	C723.677063,323.614624 721.654541,322.902649 719.732117,322.225891 
-	C719.732117,327.390442 719.732117,331.345703 719.732117,335.300964 
-	C720.266785,335.321014 720.801453,335.341064 721.336121,335.361115 
-	C721.530334,333.634308 721.728394,331.907898 721.917847,330.180573 
-	C722.203064,327.579620 721.856384,324.483978 726.541931,325.704498 
-	C725.680664,334.955566 728.658447,337.106750 737.213257,333.613037 
-	C738.043518,333.273956 739.467041,333.980377 740.455139,334.503693 
-	C745.312195,337.076080 748.816589,335.509186 750.143555,329.916229 
-	C750.294739,329.806610 750.445862,329.696991 750.900208,330.218262 
-M513.028992,460.109680 
-	C515.591675,461.046143 518.093506,462.314850 520.738953,462.799377 
-	C522.432068,463.109497 524.337219,462.261841 527.028992,461.773163 
-	C527.634644,460.095825 525.860352,455.071930 531.671021,456.017365 
-	C533.893433,463.823425 533.893433,463.823425 538.526428,462.110413 
-	C535.197449,459.522522 534.795532,456.834137 537.337402,455.133820 
-	C536.444458,453.430542 535.564148,451.751251 534.655396,450.017822 
-	C532.774414,452.360413 523.872925,455.723999 522.326416,454.576233 
-	C518.711548,451.893402 515.919189,453.089813 513.971863,455.501160 
-	C511.881287,454.650879 510.380432,454.040466 508.156006,453.556061 
-	C507.436829,453.690857 506.717651,453.825653 505.299744,453.764740 
-	C504.386536,454.353180 503.473358,454.941650 502.466339,455.590546 
-	C500.264038,452.930603 497.204895,451.546295 494.723541,454.570404 
-	C493.505829,456.054443 493.380737,459.830566 494.446686,461.480530 
-	C496.249115,464.270477 499.311798,464.009033 502.297729,461.186127 
-	C500.318848,460.637024 498.848297,460.229004 497.377747,459.820953 
-	C497.433167,459.564850 497.488556,459.308777 497.543976,459.052673 
-	C499.282288,459.052673 501.020569,459.052673 503.103699,459.052673 
-	C503.228577,460.972870 503.195160,462.780884 503.579041,464.495514 
-	C503.660492,464.859375 505.264709,464.882294 506.284332,464.492188 
-	C506.261078,464.299591 506.237823,464.107025 506.644287,463.487946 
-	C507.430511,463.322601 508.216766,463.157257 509.688049,462.970428 
-	C510.580994,462.016693 511.473969,461.062958 513.028992,460.109680 
-M763.332703,455.016357 
-	C763.306763,471.329590 763.237183,487.642944 763.267456,503.956055 
-	C763.296509,519.596741 763.429199,535.237305 763.182983,551.618530 
-	C761.713867,552.409302 760.244812,553.200073 758.389160,554.198914 
-	C760.093079,560.403625 761.872009,566.881714 763.030823,574.084595 
-	C761.269287,574.384827 759.509399,574.933350 757.745972,574.945129 
-	C746.082092,575.022888 734.417542,574.980530 722.753174,574.986938 
-	C714.355042,574.991638 712.029785,577.284119 712.024780,585.566711 
-	C712.002991,621.226074 711.986023,656.885437 711.065308,692.814026 
-	C673.061157,692.814026 635.057007,692.814026 597.052856,692.814026 
-	C596.939819,693.550232 596.826782,694.286377 596.713745,695.022583 
-	C598.540039,695.367371 600.365479,696.008179 602.192688,696.013306 
-	C638.784180,696.114563 675.375854,696.142578 711.994690,697.068726 
-	C712.004272,698.067932 712.019714,699.067200 712.022583,700.066406 
-	C712.050293,709.706116 713.352966,711.020081 722.925415,711.020386 
-	C761.899414,711.021606 800.873413,711.026428 839.847412,711.013428 
-	C847.100830,711.011047 848.971924,709.129639 848.977417,701.869934 
-	C848.991760,682.882629 848.979919,663.895264 849.919434,644.890930 
-	C875.083740,644.951294 900.248047,645.011169 925.412354,645.072388 
-	C932.502625,645.089661 933.151978,645.692566 933.147888,652.732361 
-	C933.131958,680.398376 933.079834,708.064392 933.057129,735.730408 
-	C933.049133,745.461182 935.380005,747.772888 945.159058,747.775696 
-	C970.754700,747.783081 996.350342,747.778198 1022.455017,747.778198 
-	C1022.880493,743.440186 1019.386841,744.037354 1016.659668,744.032288 
-	C992.826599,743.987549 968.993286,744.013184 945.160095,744.003723 
-	C937.524841,744.000671 936.880188,743.356567 936.877930,735.741089 
-	C936.869446,707.241211 936.902771,678.741272 936.851990,650.241516 
-	C936.840637,643.861877 936.712830,643.857605 943.050476,643.857117 
-	C969.791809,643.855286 996.533142,643.856384 1023.674866,643.856384 
-	C1023.105225,639.554810 1019.664673,640.308411 1017.019348,640.300903 
-	C992.352966,640.230774 967.686401,640.258484 943.019836,640.257935 
-	C941.084045,640.257874 939.148254,640.257935 936.872070,640.257935 
-	C936.872070,638.572632 936.872009,637.608826 936.872070,636.645020 
-	C936.872681,599.978516 936.867554,563.312012 936.879333,526.645508 
-	C936.881409,520.152527 937.912659,519.082947 944.407349,519.063721 
-	C958.573853,519.021851 972.740479,519.051086 986.907104,519.049194 
-	C997.407043,519.047791 1007.907959,519.109863 1018.405762,518.958374 
-	C1019.764648,518.938721 1021.107422,517.808472 1022.457703,517.192688 
-	C1021.209412,516.577759 1019.963135,515.431152 1018.712524,515.426453 
-	C994.213379,515.334900 969.713684,515.369446 945.214111,515.393799 
-	C935.242676,515.403748 933.049255,517.554626 933.056335,527.330750 
-	C933.081543,562.163391 933.122192,596.995972 933.153809,631.828613 
-	C933.155151,633.328247 933.195862,634.832520 933.096191,636.326477 
-	C932.887634,639.450684 931.462524,641.101318 928.028687,641.083130 
-	C901.698364,640.943359 875.367554,640.905945 849.015198,639.924683 
-	C849.004272,621.304260 849.023010,602.683777 848.965942,584.063477 
-	C848.946472,577.717896 846.168823,574.993896 839.919678,574.990295 
-	C817.142822,574.977173 794.365723,575.021240 771.589294,574.922668 
-	C769.589966,574.914001 767.594360,574.022461 765.776733,572.860840 
-	C767.996887,566.491760 770.217041,560.122742 772.541748,553.453857 
-	C770.320862,553.150085 768.726440,552.932068 766.969055,552.691711 
-	C766.969055,519.068176 766.969055,485.706848 766.969055,450.940491 
-	C765.384460,452.426819 764.478516,453.276520 763.332703,455.016357 
-M837.075378,84.437668 
-	C837.054749,65.621727 837.044434,46.805767 837.007568,27.989855 
-	C836.995728,21.944551 834.305237,19.050291 828.331482,19.043274 
-	C789.033752,18.997108 749.735901,18.982439 710.438293,19.054363 
-	C703.440796,19.067171 700.984314,21.793966 700.983154,28.782267 
-	C700.976624,67.413948 700.977905,106.045624 700.979736,144.677307 
-	C700.980225,153.853104 703.114075,155.974411 712.409058,155.979019 
-	C733.723083,155.989594 755.037170,155.982513 776.351196,155.982422 
-	C793.169312,155.982361 809.987488,156.017914 826.805420,155.965805 
-	C834.483948,155.942017 837.007202,153.397598 837.010803,145.955429 
-	C837.019958,126.972771 837.016479,107.990120 837.949646,89.082405 
-	C848.557739,89.119965 859.165833,89.147781 869.773804,89.202118 
-	C872.343079,89.215279 874.600342,89.057220 872.966797,85.426399 
-	C860.933289,85.426399 849.037292,85.426399 837.075378,84.437668 
-M1051.992065,318.668304 
-	C1051.999634,337.319397 1051.985474,355.970581 1052.026367,374.621582 
-	C1052.041138,381.337158 1054.712280,384.001801 1061.280762,384.002960 
-	C1100.414795,384.009827 1139.548950,384.008026 1178.682983,384.005341 
-	C1186.701782,384.004791 1188.971069,381.731201 1188.977905,373.656677 
-	C1189.003784,343.182281 1189.019409,312.707916 1189.863159,282.037109 
-	C1196.636597,281.692993 1203.406738,281.201294 1210.184448,281.042053 
-	C1218.697021,280.842010 1220.930664,278.776520 1220.933594,270.415405 
-	C1220.940918,248.755157 1220.925659,227.094925 1220.938721,205.434677 
-	C1220.943115,198.232025 1222.053101,197.133194 1229.400024,197.098694 
-	C1235.397705,197.070511 1241.398438,197.224823 1247.390869,197.054779 
-	C1248.435913,197.025131 1249.446655,195.788269 1250.473267,195.108994 
-	C1249.534058,194.524261 1248.600098,193.444717 1247.654663,193.434525 
-	C1241.163940,193.364441 1234.670898,193.533142 1228.178467,193.596298 
-	C1219.777100,193.678024 1217.238525,196.216187 1217.244751,204.750076 
-	C1217.260620,226.409714 1217.326904,248.069305 1217.341431,269.728943 
-	C1217.345825,276.399200 1216.456055,277.294861 1209.973267,277.463043 
-	C1202.982056,277.644379 1195.990112,277.802032 1189.000366,277.036469 
-	C1188.993774,270.373016 1189.031372,263.709167 1188.967773,257.046265 
-	C1188.907349,250.701233 1186.169678,247.987427 1179.882812,247.985703 
-	C1140.568359,247.974884 1101.253784,247.972641 1061.939331,247.985809 
-	C1054.613037,247.988266 1052.029175,250.568970 1052.021118,257.868408 
-	C1052.000488,276.526093 1052.011597,295.183777 1051.214722,314.086609 
-	C1049.076782,314.285126 1046.938843,314.656067 1044.800781,314.657074 
-	C978.676025,314.687500 912.551331,314.678864 846.426575,314.698578 
-	C844.830811,314.699066 843.235168,314.952850 841.639465,315.088470 
-	C841.642700,315.723083 841.645874,316.357697 841.649048,316.992310 
-	C844.128357,317.197571 846.607483,317.580017 849.086975,317.582245 
-	C916.709778,317.642914 984.332520,317.664764 1051.992065,318.668304 
-M1466.024536,565.835815 
-	C1466.039185,570.167725 1465.960815,574.502502 1466.091797,578.830872 
-	C1466.258057,584.328918 1469.750244,587.937927 1475.249023,587.946289 
-	C1515.071167,588.006958 1554.893188,588.002197 1594.715332,587.945068 
-	C1599.167358,587.938660 1602.405518,585.942688 1603.131958,581.144409 
-	C1603.478027,578.859436 1603.898804,576.552002 1603.902588,574.254089 
-	C1603.953125,542.929626 1603.936523,511.605133 1603.936401,480.280609 
-	C1603.936401,474.448914 1604.016846,468.615875 1603.917847,462.785858 
-	C1603.754761,453.180542 1601.513062,450.982178 1592.119507,450.981262 
-	C1554.296875,450.977509 1516.474121,450.978027 1478.651489,450.980286 
-	C1468.008301,450.980927 1466.076172,452.879150 1466.068970,463.419769 
-	C1466.055908,482.747650 1466.100342,502.075653 1466.053101,521.403442 
-	C1466.018433,535.561401 1465.875366,549.719055 1465.032104,563.579895 
-	C1458.654541,561.778992 1452.277100,559.978027 1445.399536,558.035889 
-	C1445.724487,563.022583 1442.714478,562.849915 1439.529297,562.846130 
-	C1401.043701,562.799927 1362.557983,562.812073 1324.072388,562.820984 
-	C1314.884155,562.823059 1312.661743,565.072449 1312.653809,574.401672 
-	C1312.637329,593.561218 1312.654053,612.720703 1312.647339,631.880249 
-	C1312.644653,639.737000 1312.085571,640.290283 1304.038940,640.291443 
-	C1259.222412,640.297852 1214.405762,640.292908 1169.589233,640.301819 
-	C1167.926636,640.302124 1166.117920,640.022766 1164.648560,640.583984 
-	C1163.518921,641.015442 1162.816284,642.565125 1161.743652,643.830017 
-	C1166.254761,643.830017 1169.529663,643.830078 1172.804443,643.830017 
-	C1217.121216,643.829224 1261.438110,643.834839 1305.754883,643.821838 
-	C1313.931519,643.819397 1316.577881,641.218323 1316.581299,633.113464 
-	C1316.589355,613.787720 1316.539429,594.462036 1316.522949,575.136292 
-	C1316.515747,566.752930 1317.134888,566.135071 1325.648560,566.133545 
-	C1363.467773,566.126709 1401.286987,566.130798 1439.106201,566.130981 
-	C1440.888062,566.130981 1442.669922,566.131042 1444.482300,566.131042 
-	C1444.881958,568.362183 1445.166504,569.950562 1445.539185,572.031189 
-	C1452.544189,569.583130 1459.263062,567.235046 1466.024536,565.835815 
-M1465.069092,359.084229 
-	C1458.548096,357.246338 1452.027100,355.408447 1445.057007,353.444000 
-	C1445.091675,357.863159 1442.686646,358.193573 1439.492432,358.183502 
-	C1408.831665,358.086945 1378.170654,358.114075 1347.509644,358.133057 
-	C1338.543701,358.138580 1336.236206,360.470581 1336.235962,369.341705 
-	C1336.234863,415.333160 1336.241211,461.324585 1336.229858,507.316040 
-	C1336.228027,514.518860 1335.347656,515.388916 1328.208008,515.388123 
-	C1289.715454,515.383728 1251.222778,515.354553 1212.730347,515.422729 
-	C1211.561523,515.424805 1210.394531,516.402771 1209.226685,516.925720 
-	C1210.305542,517.630188 1211.310547,518.530334 1212.487549,518.974670 
-	C1213.363770,519.305481 1214.462891,519.048889 1215.462646,519.048889 
-	C1252.955688,519.049255 1290.448730,519.053589 1327.941772,519.046021 
-	C1338.084717,519.043945 1339.986694,517.166260 1339.980225,507.162750 
-	C1339.950684,461.338623 1339.904785,415.514465 1339.882324,369.690338 
-	C1339.878906,362.894409 1340.894775,361.892212 1347.706909,361.889313 
-	C1378.201172,361.876373 1408.695557,361.883667 1439.189819,361.883636 
-	C1440.813354,361.883636 1442.436890,361.883606 1444.122192,361.883606 
-	C1444.535156,363.960358 1444.846558,365.525909 1445.267456,367.642242 
-	C1452.327759,365.237457 1459.046509,362.949066 1466.393799,361.306702 
-	C1466.584473,365.767181 1466.836060,370.226135 1466.951050,374.688568 
-	C1467.110962,380.901001 1469.135864,383.038635 1475.432983,383.043396 
-	C1515.067017,383.073425 1554.701050,383.074402 1594.335083,383.045441 
-	C1600.911011,383.040649 1603.027222,380.934174 1603.031982,374.389587 
-	C1603.060791,334.755554 1603.060913,295.121552 1603.028442,255.487549 
-	C1603.023193,249.005493 1600.871582,246.950928 1594.240479,246.947510 
-	C1554.772949,246.927200 1515.305542,246.926651 1475.838013,246.944595 
-	C1468.729614,246.947830 1466.970093,248.729538 1466.968262,255.743362 
-	C1466.960327,288.216614 1466.984985,320.689911 1466.912476,353.162994 
-	C1466.907959,355.210907 1466.176147,357.257202 1465.069092,359.084229 
-M529.500000,19.016695 
-	C510.350677,19.017164 491.201202,18.979811 472.052063,19.037035 
-	C464.570312,19.059391 461.992706,21.618843 461.991913,28.677319 
-	C461.987457,67.808151 461.987640,106.938988 461.991394,146.069824 
-	C461.992065,153.127808 464.417908,155.927414 471.310760,155.941376 
-	C510.441681,156.020676 549.572937,156.021362 588.703918,155.941132 
-	C595.587830,155.927017 598.021667,153.119003 598.022766,146.063736 
-	C598.028748,107.432190 598.027649,68.800644 598.025513,30.169094 
-	C598.025024,21.257130 595.835571,19.031942 586.948669,19.023001 
-	C568.132446,19.004068 549.316223,19.016920 529.500000,19.016695 
-M390.568176,85.591942 
-	C388.901733,85.592369 387.235260,85.584869 385.568878,85.594566 
-	C376.277191,85.648628 374.169281,87.778893 374.164215,97.158554 
-	C374.156708,111.115509 374.162262,125.072456 374.162262,139.348770 
-	C377.495331,140.776352 377.897186,138.817245 377.874939,135.764252 
-	C377.781525,122.933556 377.814087,110.101814 377.828613,97.270493 
-	C377.836700,90.143318 378.647034,89.361526 385.961609,89.356201 
-	C401.959137,89.344551 417.957306,89.427399 433.953735,89.294273 
-	C437.444550,89.265221 440.475983,89.295502 440.933289,93.830147 
-	C447.783173,91.839088 454.178772,89.980072 460.574371,88.121056 
-	C460.561798,87.723206 460.549225,87.325356 460.536682,86.927505 
-	C454.035187,84.597626 447.533691,82.267746 440.718781,79.825539 
-	C440.279999,81.986969 439.963074,83.548073 439.547974,85.592827 
-	C423.458710,85.592827 407.503662,85.592827 390.568176,85.591942 
-M1536.678711,409.698853 
-	C1537.489868,408.776764 1538.301147,407.854706 1538.472290,407.660126 
-	C1540.777954,410.383240 1542.394897,414.009003 1544.516602,414.333466 
-	C1546.802490,414.682983 1549.561279,411.940033 1552.253296,410.470093 
-	C1552.105225,410.131500 1552.308350,410.971771 1552.786011,411.604736 
-	C1553.625000,412.716492 1554.632080,413.701416 1555.568726,414.739502 
-	C1556.422974,413.618103 1557.419067,412.575409 1558.095459,411.355469 
-	C1558.947876,409.817780 1559.538818,408.135284 1560.817383,405.192139 
-	C1561.200317,408.951477 1561.434082,411.247162 1561.667236,413.535858 
-	C1571.203857,413.535858 1580.303589,413.535858 1589.272339,413.535858 
-	C1589.984497,411.589752 1590.884521,409.130402 1591.474121,407.519287 
-	C1593.825684,409.344208 1595.522705,410.661163 1597.140259,411.916382 
-	C1596.324707,412.180939 1595.329712,412.503784 1594.334717,412.826630 
-	C1594.377808,413.340118 1594.421021,413.853577 1594.464111,414.367065 
-	C1596.316406,414.253265 1598.670166,414.823334 1599.929077,413.900269 
-	C1604.067627,410.865784 1599.464722,409.503082 1598.242432,407.661682 
-	C1599.174683,407.028595 1599.992920,406.472961 1600.811157,405.917297 
-	C1600.732788,405.604187 1600.654541,405.291077 1600.576172,404.977966 
-	C1596.188232,404.977966 1591.800293,404.977966 1587.206177,404.977966 
-	C1587.024170,407.394745 1586.853271,409.662384 1586.656494,412.275146 
-	C1584.264160,412.046875 1582.216797,411.851501 1580.169312,411.656128 
-	C1580.190796,411.310638 1580.212280,410.965179 1580.233765,410.619690 
-	C1582.041016,410.208588 1583.848267,409.797455 1585.683228,409.380005 
-	C1584.012817,403.829193 1583.661133,403.717865 1576.255249,405.962921 
-	C1575.553467,404.041016 1574.853760,402.124695 1574.284058,400.564545 
-	C1570.933838,403.242523 1568.189087,405.436554 1565.252808,407.783661 
-	C1564.770996,406.439911 1564.319214,405.228394 1563.903198,404.004730 
-	C1563.528442,402.902863 1563.192871,401.787689 1562.839966,400.678406 
-	C1562.366455,401.964935 1561.892944,403.251465 1561.799927,403.503906 
-	C1559.112305,405.378937 1557.043091,406.822510 1556.159058,407.439240 
-	C1554.796265,406.563385 1553.348511,404.862152 1551.831421,404.797882 
-	C1546.605225,404.576416 1541.350342,404.843689 1536.116211,405.114716 
-	C1534.715698,405.187256 1533.284180,406.441254 1531.982056,406.271149 
-	C1529.146973,405.900726 1526.386108,404.962860 1523.626465,404.264954 
-	C1523.626465,409.428070 1523.626465,413.566254 1523.626465,417.937256 
-	C1526.937500,415.796051 1529.680298,414.022400 1532.119751,412.444885 
-	C1532.816650,413.683716 1533.478638,414.860535 1534.140625,416.037384 
-	C1534.819580,415.583069 1535.498535,415.128784 1536.177490,414.674469 
-	C1536.331543,413.286835 1536.485718,411.899231 1536.678711,409.698853 
-M524.321960,507.577423 
-	C523.734314,509.450684 523.146729,511.323944 522.467346,513.489807 
-	C524.557495,513.812256 526.273926,514.077087 528.112915,514.360779 
-	C528.112915,552.255432 528.112915,589.818848 528.112915,627.536316 
-	C532.553894,628.732971 531.716248,625.517761 531.718201,623.285034 
-	C531.747986,588.984497 531.738220,554.683960 531.737610,520.383423 
-	C531.737549,518.416748 531.737610,516.450134 531.737610,514.529236 
-	C533.538757,514.045898 534.889771,513.683350 536.598694,513.224792 
-	C534.594543,506.371033 532.685852,499.843750 530.777161,493.316467 
-	C530.345886,493.342194 529.914612,493.367920 529.483337,493.393646 
-	C527.850159,497.877106 526.216980,502.360596 524.321960,507.577423 
-M126.163857,385.169739 
-	C124.113716,385.920685 122.063568,386.671631 119.794151,387.502899 
-	C117.744804,383.937012 117.461021,383.908142 114.380310,387.695435 
-	C113.608643,386.856628 112.846657,385.302490 112.063782,385.291901 
-	C105.658325,385.205200 99.248947,385.404236 92.840866,385.522217 
-	C91.973587,385.538177 90.917946,385.921844 90.273567,385.559296 
-	C87.835205,384.187439 85.530312,382.578339 82.743484,380.779053 
-	C82.743484,385.064697 82.743484,389.726105 82.743484,395.270599 
-	C85.946503,394.496796 88.942490,393.773010 91.949181,393.046661 
-	C92.580849,393.443909 93.582672,394.073944 94.584488,394.703979 
-	C94.980850,393.700653 95.385895,392.700684 95.771477,391.693237 
-	C96.308205,390.290863 96.830406,388.882935 97.054230,388.287598 
-	C100.096642,390.960846 102.125748,394.010345 104.669563,394.527344 
-	C106.326752,394.864166 108.732353,391.518555 110.695129,389.910736 
-	C113.915459,396.195831 113.915459,396.195831 117.455406,391.295197 
-	C118.349289,392.558655 119.243172,393.822113 120.755615,395.959930 
-	C122.257935,392.879547 123.344391,390.651855 124.468155,388.347656 
-	C125.921539,389.500244 127.261887,390.563141 128.683502,391.690521 
-	C127.354774,392.273132 126.329659,392.722626 125.304543,393.172119 
-	C125.432442,393.700928 125.560349,394.229736 125.688248,394.758545 
-	C128.176376,394.378632 130.664490,393.998688 131.809845,393.823822 
-	C137.433197,394.096405 141.853073,394.310669 145.516327,394.488251 
-	C147.114151,391.076385 148.453094,388.217346 149.918182,385.088928 
-	C148.555344,385.088928 146.842804,384.925537 145.181015,385.145569 
-	C144.045578,385.295868 142.950485,386.424652 141.889908,386.351746 
-	C136.887512,386.007751 131.903259,385.400177 126.163857,385.169739 
-M1039.283691,549.070374 
-	C1039.754517,550.070862 1040.225342,551.071411 1040.696167,552.071899 
-	C1041.225342,551.932129 1041.754517,551.792297 1042.283691,551.652527 
-	C1042.283691,546.800415 1042.283691,541.948303 1042.283691,537.047302 
-	C1045.053101,537.632202 1047.088501,538.062134 1049.015259,538.469055 
-	C1049.328979,543.183044 1049.624390,547.620972 1049.919800,552.058899 
-	C1050.642334,552.003052 1051.364868,551.947205 1052.087402,551.891357 
-	C1052.087402,547.406250 1052.087402,542.921143 1052.087402,538.160889 
-	C1056.296387,538.160889 1059.693726,538.160889 1063.170044,538.160889 
-	C1063.432129,543.079346 1063.670898,547.558472 1063.909668,552.037598 
-	C1064.647949,552.005310 1065.386230,551.972961 1066.124512,551.940613 
-	C1066.320679,547.465942 1066.516846,542.991272 1066.720337,538.347229 
-	C1068.950439,538.074402 1070.983521,537.825684 1073.309937,537.541138 
-	C1073.569946,542.601074 1073.811279,547.296692 1074.052612,551.992371 
-	C1074.668335,551.991943 1075.284180,551.991577 1075.900024,551.991211 
-	C1076.256958,550.066589 1076.613892,548.141907 1076.986694,546.132141 
-	C1078.093018,546.064697 1078.911011,546.015625 1079.729126,545.964783 
-	C1083.308594,545.742310 1086.695190,544.914795 1086.549194,540.476746 
-	C1086.411011,536.275391 1083.005981,535.693115 1079.685547,535.632629 
-	C1074.230957,535.533325 1068.773438,535.580688 1063.317139,535.576843 
-	C1055.514160,535.571350 1047.711060,535.575439 1039.730103,535.575439 
-	C1039.384521,538.031494 1039.097046,540.074585 1038.829956,541.972168 
-	C1036.239258,541.972168 1034.039307,541.972168 1032.077026,541.972168 
-	C1031.462769,539.500916 1030.971680,537.525330 1030.480713,535.549805 
-	C1030.053467,535.643188 1029.626343,535.736633 1029.199219,535.830078 
-	C1029.199219,541.188599 1029.199219,546.547180 1029.199219,551.905701 
-	C1029.735474,551.956970 1030.271729,552.008179 1030.807861,552.059448 
-	C1031.176025,549.816284 1031.544189,547.573181 1031.981079,544.910339 
-	C1034.531616,546.048157 1039.003052,541.761902 1039.283691,549.070374 
-M577.664246,461.919067 
-	C578.583679,462.290741 579.503113,462.662384 580.773438,463.175873 
-	C580.925781,460.078796 576.532776,457.110077 582.261230,454.925354 
-	C583.224365,458.679504 584.155151,462.307404 585.481262,467.476379 
-	C587.914062,462.175018 589.813171,458.036560 591.712280,453.898071 
-	C591.298950,453.585693 590.885620,453.273315 590.472290,452.960907 
-	C589.082336,454.194946 587.692383,455.428986 587.079285,455.973297 
-	C584.862122,454.921509 583.190308,453.633606 581.374878,453.382202 
-	C578.591125,452.996674 575.703857,453.231232 572.869141,453.373993 
-	C569.580627,453.539642 566.274170,454.279114 563.025757,454.051727 
-	C559.765137,453.823517 555.773743,453.654572 553.526611,451.765656 
-	C550.176392,448.949493 547.216553,448.943329 543.266113,449.822845 
-	C543.266113,453.677002 543.205261,457.314606 543.320862,460.946594 
-	C543.342285,461.618652 543.952881,462.623260 544.518616,462.819489 
-	C545.001587,462.986969 545.893372,462.312988 546.460999,461.839447 
-	C548.679321,459.988861 550.840698,458.070007 553.426270,455.826874 
-	C554.434998,459.267487 555.012390,461.236969 555.992004,464.578339 
-	C557.593445,460.586487 558.565002,458.164764 559.536499,455.743011 
-	C560.090515,455.810425 560.644531,455.877838 561.198547,455.945221 
-	C561.487732,459.831848 562.283447,463.549835 566.926392,463.265442 
-	C570.342896,463.056152 573.710815,462.053009 577.664246,461.919067 
-M1156.460205,712.154358 
-	C1155.182617,713.153687 1153.904907,714.153076 1152.648315,715.135925 
-	C1148.107788,711.265625 1144.675293,710.791260 1142.196045,713.621765 
-	C1139.803345,716.353577 1140.321411,721.978821 1143.149658,723.974854 
-	C1145.907837,725.921448 1149.013062,725.174255 1151.254150,722.024719 
-	C1145.070679,722.287109 1145.070679,722.287109 1144.376831,719.740173 
-	C1147.487671,719.029358 1150.616089,718.314453 1154.530396,717.420044 
-	C1156.084473,718.268188 1158.572266,719.625854 1161.060059,720.983521 
-	C1160.953735,721.459534 1160.847534,721.935486 1160.741211,722.411499 
-	C1159.616943,722.411499 1158.468262,722.555542 1157.374878,722.371277 
-	C1156.265991,722.184387 1155.211670,721.673340 1153.187744,720.980591 
-	C1157.056396,726.361938 1159.996582,726.247986 1165.308105,721.544312 
-	C1167.271362,724.312134 1177.427124,726.128784 1180.318848,724.229431 
-	C1182.975098,722.484741 1182.801758,719.521362 1179.903442,717.924561 
-	C1178.336792,717.061523 1176.702515,716.321228 1175.098877,715.525574 
-	C1175.289429,715.053284 1175.479980,714.580933 1175.670410,714.108643 
-	C1177.544189,714.497314 1179.417847,714.885986 1181.291504,715.274719 
-	C1181.471558,714.755920 1181.651611,714.237183 1181.831787,713.718445 
-	C1179.814575,713.096497 1177.757446,711.911316 1175.794189,712.050293 
-	C1174.480957,712.143250 1173.300903,714.117981 1172.061279,715.250610 
-	C1173.347656,716.540833 1174.566528,717.909241 1175.943237,719.094543 
-	C1176.907349,719.924622 1178.086792,720.504761 1179.170166,721.196472 
-	C1178.962402,721.682983 1178.754639,722.169495 1178.546997,722.656006 
-	C1177.106445,722.345581 1175.673950,721.839417 1174.222900,721.778931 
-	C1172.722656,721.716370 1171.204346,722.086792 1168.684204,722.388855 
-	C1169.078247,718.917053 1169.433594,715.786987 1169.880859,711.847595 
-	C1169.636475,711.563354 1168.627686,710.389771 1167.327026,708.876526 
-	C1165.767456,712.585938 1163.596069,713.835510 1160.158691,711.956665 
-	C1159.396973,711.540283 1158.205078,711.910950 1156.460205,712.154358 
-M1151.899536,542.235413 
-	C1150.771484,541.294312 1149.479980,539.426758 1148.546997,539.591492 
-	C1146.068726,540.028809 1142.726074,540.686035 1141.586182,542.454285 
-	C1139.616699,545.509399 1139.986572,549.494263 1143.716675,551.530823 
-	C1146.565308,553.086243 1149.660034,553.043823 1151.925293,548.840210 
-	C1148.967896,548.406250 1145.115967,552.651733 1144.029785,547.166077 
-	C1147.286987,546.451355 1150.371826,545.774475 1153.456665,545.097595 
-	C1153.372070,544.698792 1153.287598,544.299988 1153.203125,543.901184 
-	C1155.784912,545.385071 1158.366699,546.868958 1160.948486,548.352844 
-	C1160.824585,548.833679 1160.700806,549.314575 1160.576904,549.795410 
-	C1158.343506,549.537659 1156.110107,549.279907 1153.620117,548.992554 
-	C1157.005371,553.881897 1160.883301,553.600830 1165.013794,548.508362 
-	C1166.012451,549.687927 1166.895020,551.732971 1168.025757,551.880798 
-	C1171.620972,552.350830 1175.339111,552.390076 1178.943481,551.993835 
-	C1180.131836,551.863281 1181.880981,549.963684 1181.979004,548.759399 
-	C1182.073364,547.602600 1180.555786,546.055969 1179.391113,545.125427 
-	C1178.141357,544.126953 1176.477539,543.647034 1174.994385,542.940796 
-	C1175.163940,542.488831 1175.333374,542.036804 1175.502808,541.584839 
-	C1177.469360,541.872131 1179.435791,542.159485 1181.402222,542.446838 
-	C1181.538940,541.897827 1181.675537,541.348877 1181.812256,540.799866 
-	C1179.687622,540.326355 1177.097778,538.849304 1175.529541,539.576172 
-	C1171.568726,541.411926 1169.569946,539.550659 1168.221802,537.285583 
-	C1166.047974,538.367188 1163.753296,540.447998 1162.547363,539.940735 
-	C1158.147583,538.089966 1155.337891,539.959473 1151.899536,542.235413 
-M1077.265381,412.449463 
-	C1077.542725,414.521576 1077.819946,416.593689 1078.140015,418.985535 
-	C1081.877075,416.506653 1084.631714,414.679413 1087.477173,412.791931 
-	C1090.771118,416.402161 1094.135132,416.336243 1097.359619,413.178986 
-	C1098.526489,414.108154 1099.577148,414.944763 1100.736206,415.867798 
-	C1103.106079,413.148834 1099.629517,407.017944 1106.225708,407.963928 
-	C1108.071289,410.217804 1105.096191,417.118805 1112.828735,414.423706 
-	C1109.498901,411.756989 1108.680786,409.187683 1111.967041,406.564392 
-	C1110.817993,405.090759 1109.774658,403.752838 1109.646484,403.588348 
-	C1104.594482,404.721039 1100.200928,406.963440 1096.417236,406.196625 
-	C1092.720703,405.447418 1090.107666,405.182678 1087.342163,408.115570 
-	C1084.999512,403.476715 1080.689209,404.738007 1078.132324,406.116699 
-	C1076.192749,407.162567 1075.738647,406.167145 1074.494141,406.099609 
-	C1072.295776,405.980316 1068.615356,406.285400 1068.137695,407.461548 
-	C1067.364868,409.364471 1067.937988,412.750946 1069.302856,414.349640 
-	C1071.034912,416.378326 1073.921753,416.135925 1076.300293,413.098450 
-	C1074.169800,412.785522 1072.644531,412.561523 1071.119141,412.337494 
-	C1071.169800,411.857117 1071.220459,411.376770 1071.271118,410.896393 
-	C1073.197388,411.128906 1075.123779,411.361389 1077.265381,412.449463 
-M102.184731,595.399414 
-	C101.105568,595.874146 99.251427,596.956909 99.070831,596.726685 
-	C97.722298,595.007996 96.704987,593.029419 95.556641,591.086182 
-	C93.736687,593.005310 92.503853,602.345215 93.814949,604.072021 
-	C94.153954,604.518433 95.074364,605.025391 95.414078,604.859985 
-	C96.036446,604.557190 96.442818,603.788086 96.907745,603.188965 
-	C97.845520,601.980469 98.762215,600.755737 99.687576,599.537659 
-	C100.559280,600.644348 101.423935,601.756714 102.305252,602.855713 
-	C102.857254,603.544006 103.434280,604.212219 104.000053,604.889465 
-	C104.598656,604.081177 105.652138,603.305847 105.713501,602.458618 
-	C105.926765,599.514404 105.795868,596.545288 105.795868,593.600891 
-	C109.455200,593.327026 110.862236,594.687683 110.516571,597.912842 
-	C110.358093,599.391479 110.292625,600.944397 110.583099,602.383301 
-	C110.766365,603.291138 111.686172,604.050293 112.275597,604.876099 
-	C112.833923,604.030212 113.805214,603.216309 113.873665,602.332458 
-	C114.084579,599.608704 113.950577,596.858215 113.950577,593.765015 
-	C116.933868,593.898132 119.011917,593.990845 121.520210,594.102783 
-	C121.520210,596.928711 121.313728,599.259644 121.604774,601.526672 
-	C121.756989,602.712280 122.783417,603.785645 123.415009,604.909668 
-	C123.936317,603.853394 124.806084,602.829590 124.907982,601.734314 
-	C125.135216,599.291870 124.978951,596.813721 124.978951,594.244751 
-	C126.847031,593.926392 128.245682,593.688049 130.053009,593.380127 
-	C130.053009,596.689270 129.954361,599.669800 130.120056,602.635620 
-	C130.163284,603.409180 131.029938,604.136780 131.518417,604.885498 
-	C132.192566,604.315857 132.908661,603.788147 133.531082,603.166687 
-	C134.483505,602.215820 135.426682,601.245300 136.274170,600.202148 
-	C137.681290,598.470093 139.009262,596.673645 140.370560,594.904297 
-	C138.283356,593.625122 136.230896,591.314941 134.103012,591.243164 
-	C124.293465,590.912659 114.460533,591.126831 104.644089,591.418701 
-	C103.817436,591.443298 103.050880,593.489197 102.184731,595.399414 
-M278.193085,764.258728 
-	C278.473450,756.244934 278.473450,756.244934 281.062561,755.291016 
-	C281.357147,758.735657 281.646454,762.118286 281.935730,765.500854 
-	C282.473633,765.521667 283.011566,765.542480 283.549469,765.563293 
-	C284.134216,761.980835 284.718964,758.398376 285.303680,754.815918 
-	C285.884583,754.938904 286.465454,755.061890 287.046356,755.184875 
-	C287.306244,758.625244 287.566162,762.065613 287.826050,765.506042 
-	C288.492615,765.512085 289.159149,765.518127 289.825714,765.524170 
-	C290.093353,761.819519 290.360962,758.114868 290.584106,755.026123 
-	C288.183594,753.830750 286.410675,752.947876 284.637726,752.065063 
-	C284.727692,751.643494 284.817627,751.221924 284.907593,750.800415 
-	C286.531464,750.518372 288.155304,750.236389 289.779175,749.954346 
-	C286.699982,749.254822 283.693756,749.583313 280.789581,749.179016 
-	C276.263153,748.548828 274.185730,750.963928 275.082031,755.645996 
-	C275.597687,758.339783 275.175507,761.213074 275.175507,764.005615 
-	C274.572266,764.045959 273.969025,764.086365 273.365753,764.126770 
-	C273.087646,762.193848 273.124084,760.141357 272.447021,758.360046 
-	C271.700226,756.395325 270.646393,753.633240 269.095093,753.117615 
-	C267.116455,752.459900 264.505341,753.705200 262.166840,754.130249 
-	C262.201752,754.653015 262.236694,755.175781 262.271606,755.698547 
-	C263.183197,756.266724 264.094818,756.834839 264.030334,756.794678 
-	C263.238281,759.213440 262.052063,761.335693 262.099091,763.430298 
-	C262.117920,764.268555 264.840515,765.693359 266.355011,765.723633 
-	C270.179443,765.800354 274.016785,765.237183 278.193085,764.258728 
-M802.781372,741.044739 
-	C804.656189,740.123840 807.068176,737.986023 808.297058,738.528564 
-	C811.089905,739.761475 813.301208,742.311707 815.779175,744.351379 
-	C818.322876,742.623413 820.977051,740.820435 823.698792,738.971497 
-	C824.519470,741.190308 825.180359,742.977112 825.739685,744.489380 
-	C827.986755,743.130676 829.907288,742.488342 831.022217,741.166504 
-	C832.481445,739.436401 833.924194,737.235535 834.151001,735.106934 
-	C834.272644,733.965698 831.915100,731.553406 830.532043,731.437683 
-	C825.276184,730.997742 819.961487,731.260315 814.449341,731.260315 
-	C814.260986,734.399292 814.115723,736.819641 813.970459,739.239990 
-	C811.992859,736.279602 810.870972,733.040039 809.418823,729.955933 
-	C808.934570,728.927246 807.707031,728.038452 806.613525,727.606873 
-	C806.155701,727.426086 804.797485,728.442993 804.475952,729.186584 
-	C803.023621,732.545227 801.722595,735.976807 800.583130,739.452942 
-	C800.446167,739.870667 801.623169,740.719116 802.781372,741.044739 
-M1535.321655,836.458679 
-	C1534.684570,836.576538 1533.828491,837.020020 1533.444458,836.761719 
-	C1529.819092,834.322937 1526.529907,834.968262 1524.658203,836.537720 
-	C1520.937500,836.147095 1518.374512,835.877991 1516.370728,835.667664 
-	C1515.943848,838.343567 1516.053833,839.941711 1515.424805,841.157288 
-	C1513.712280,844.466309 1515.580566,845.222229 1518.226196,845.740173 
-	C1520.970947,846.277527 1523.695801,846.916199 1527.293213,847.698425 
-	C1529.044678,846.531250 1531.932129,844.607056 1534.900391,842.629028 
-	C1535.220337,844.819885 1535.507202,846.784668 1535.795654,848.760254 
-	C1538.515625,847.300598 1540.729614,846.401917 1542.572998,845.011780 
-	C1543.632446,844.212891 1544.514771,842.691345 1544.745117,841.367737 
-	C1545.602417,836.442749 1543.280151,835.079407 1535.321655,836.458679 
-M147.659927,846.672913 
-	C147.934418,845.694763 148.374832,844.728760 148.447037,843.735901 
-	C148.576172,841.960144 148.483414,840.168213 148.483414,838.383118 
-	C149.139435,838.317749 149.795471,838.252441 150.451492,838.187134 
-	C151.415070,841.951233 152.378647,845.715393 153.776855,851.177429 
-	C156.139832,845.872009 158.070969,841.536072 160.002121,837.200195 
-	C159.145248,836.494385 158.288376,835.788513 157.431519,835.082642 
-	C156.709030,836.811462 155.986526,838.540222 155.063644,840.748535 
-	C152.720291,836.408020 149.915039,835.315308 146.174515,837.489197 
-	C145.662064,837.787048 144.984436,837.984009 144.400620,837.947754 
-	C137.366547,837.511658 130.335754,837.022888 122.878212,836.519043 
-	C123.090599,840.534363 123.253250,843.609436 123.449333,847.316528 
-	C127.651772,845.197754 123.872841,838.941589 129.602982,839.315918 
-	C130.895508,847.406616 137.999893,849.775085 144.917511,844.442932 
-	C145.621078,845.108459 146.332840,845.781738 147.659927,846.672913 
-M1060.548340,764.269836 
-	C1055.109253,765.445740 1055.226807,770.315491 1054.303711,773.929688 
-	C1051.499146,772.822510 1048.835571,771.993164 1046.406982,770.716431 
-	C1045.228271,770.096741 1044.489746,768.639587 1043.552002,767.561584 
-	C1045.031128,767.168518 1046.551880,766.358521 1047.977539,766.500977 
-	C1049.370361,766.640076 1050.666138,767.751221 1052.831665,768.858643 
-	C1050.563721,764.053955 1046.925659,762.604919 1043.214111,764.545837 
-	C1041.935547,765.214478 1040.340698,766.908386 1040.388184,768.072937 
-	C1040.448486,769.553467 1041.835938,771.171265 1043.030884,772.342651 
-	C1043.752808,773.050232 1045.372681,772.765381 1046.271606,773.386353 
-	C1047.651733,774.339966 1048.758545,775.689392 1049.981445,776.870911 
-	C1048.073486,777.307983 1046.152710,778.119385 1044.261963,778.054504 
-	C1042.934082,778.008911 1041.647217,776.769592 1039.366211,775.535400 
-	C1040.530273,780.214294 1043.203613,780.798340 1046.017700,780.965332 
-	C1050.410278,781.225830 1053.322266,779.311768 1053.900635,775.008057 
-	C1055.925171,776.887817 1057.634644,779.800415 1059.712036,780.092285 
-	C1062.802368,780.526367 1067.438354,780.165833 1069.054932,778.200745 
-	C1070.918335,775.935608 1071.206909,771.294067 1070.375977,768.163269 
-	C1069.307251,764.137451 1065.177246,763.541565 1060.548340,764.269836 
-M366.397736,186.649612 
-	C371.834045,184.541214 372.991577,180.153442 370.813782,168.916046 
-	C367.913025,169.331619 364.051788,168.775131 362.272766,170.441574 
-	C360.369751,172.224167 360.429535,176.102173 359.632599,179.065582 
-	C358.597168,176.631332 358.886963,173.942856 357.862549,171.919907 
-	C357.102631,170.419266 354.729492,169.275070 352.897064,168.937332 
-	C351.641937,168.706009 350.081116,170.133347 348.656921,170.819153 
-	C349.325867,171.803421 349.994781,172.787689 349.829681,172.544769 
-	C349.022278,175.531754 348.452484,177.639633 347.882721,179.747513 
-	C350.055054,180.259445 352.210510,181.102524 354.403198,181.214142 
-	C358.920074,181.444061 363.456848,181.283310 367.985413,181.283310 
-	C367.992340,181.952179 367.999268,182.621048 368.006195,183.289917 
-	C365.851990,183.289917 363.697784,183.289917 361.543549,183.289917 
-	C361.430542,183.669601 361.317535,184.049271 361.204529,184.428955 
-	C362.689270,185.167328 364.174011,185.905701 366.397736,186.649612 
-M1561.428955,835.562256 
-	C1557.704712,834.991089 1555.278564,836.884521 1555.474121,840.312195 
-	C1555.580078,842.170898 1557.814941,845.141418 1559.475098,845.435730 
-	C1563.649902,846.175964 1568.043823,845.680542 1572.535645,845.680542 
-	C1572.728149,843.946045 1572.841309,842.828857 1572.978638,841.714783 
-	C1573.124878,840.528320 1573.293945,839.344666 1573.549194,837.443420 
-	C1576.886108,844.982178 1576.886108,844.982178 1585.131714,845.096741 
-	C1585.131714,841.200439 1585.187988,837.300964 1585.073364,833.406494 
-	C1585.055176,832.793091 1584.263062,832.202515 1583.828613,831.601440 
-	C1583.154541,832.132507 1582.172241,832.538391 1581.891602,833.229309 
-	C1581.600464,833.946350 1581.988647,834.939270 1582.197998,836.942871 
-	C1579.781128,835.037842 1578.238037,833.821350 1576.688354,832.599792 
-	C1572.660278,838.454468 1567.041870,835.200073 1561.428955,835.562256 
-M1571.671875,613.574646 
-	C1572.268066,612.311951 1572.864136,611.049255 1573.451050,609.806091 
-	C1572.423340,608.583618 1571.434570,607.407471 1570.172241,605.905945 
-	C1566.925659,612.862976 1560.976440,608.051941 1556.492798,609.628784 
-	C1554.057373,610.485291 1551.208130,610.165405 1548.004395,610.419067 
-	C1548.015015,610.439148 1547.371948,609.226440 1546.728882,608.013794 
-	C1545.874512,608.432983 1545.020142,608.852112 1544.165894,609.271301 
-	C1544.491577,612.415405 1544.817383,615.559448 1545.143066,618.703613 
-	C1546.356079,618.011230 1547.569092,617.318848 1548.452271,616.814697 
-	C1554.224365,620.661743 1560.320190,618.205688 1566.237549,618.718933 
-	C1566.497803,615.861572 1566.696411,613.681030 1567.009766,610.241699 
-	C1569.871338,619.133545 1569.871338,619.133545 1573.502686,618.216553 
-	C1572.895874,616.930603 1572.291626,615.650146 1571.671875,613.574646 
-M115.747810,185.842850 
-	C120.205246,186.323914 124.662674,186.804962 129.828400,187.362457 
-	C129.828400,183.043762 129.967636,179.588394 129.740601,176.157272 
-	C129.675446,175.172623 128.552094,174.258011 127.913940,173.311279 
-	C127.375412,174.359238 126.461021,175.376450 126.372231,176.461212 
-	C126.148911,179.189423 126.298355,181.948151 126.298355,184.936035 
-	C123.763649,184.523361 122.007439,184.237427 119.789833,183.876373 
-	C119.789833,182.049881 119.789833,180.414597 119.789833,178.779297 
-	C119.789833,177.040192 119.789833,175.301071 119.789833,174.376984 
-	C116.694534,173.894455 114.531898,173.693024 112.436661,173.203262 
-	C107.655342,172.085678 103.156944,175.536133 103.271545,180.350616 
-	C103.414375,186.351257 108.214325,188.621170 115.747810,185.842850 
-M1142.637329,176.843903 
-	C1141.550049,174.749359 1140.358643,170.968384 1137.726196,174.516724 
-	C1135.235352,177.874390 1134.372070,182.439560 1132.792847,186.473679 
-	C1133.230103,186.715134 1133.667358,186.956604 1134.104614,187.198059 
-	C1134.929932,186.566101 1135.668823,185.638901 1136.599365,185.366394 
-	C1138.306274,184.866562 1140.264404,184.201813 1141.867310,184.604080 
-	C1144.428467,185.246796 1146.785034,186.705200 1149.228027,187.818771 
-	C1149.205078,187.192184 1149.182007,186.565598 1149.158936,185.939011 
-	C1151.062866,184.561356 1153.241333,183.432388 1154.784668,181.728180 
-	C1156.041504,180.340271 1157.504028,178.059601 1157.181274,176.532806 
-	C1156.378662,172.734787 1152.760742,172.871384 1149.851074,173.322113 
-	C1148.781372,173.487793 1147.430298,175.524918 1147.232544,176.860275 
-	C1146.825928,179.605026 1147.110352,182.452179 1147.110352,185.257172 
-	C1146.771851,185.269653 1146.433472,185.282135 1146.094971,185.294632 
-	C1145.032715,182.709976 1143.970459,180.125320 1142.637329,176.843903 
-M1204.304932,780.391846 
-	C1205.272461,780.592346 1206.419067,781.222168 1207.172119,780.908203 
-	C1209.004395,780.144714 1210.654053,778.942993 1212.377197,777.917786 
-	C1211.219360,776.387878 1210.203613,774.714355 1208.853760,773.378479 
-	C1207.951782,772.485840 1206.575073,772.073059 1205.410767,771.445496 
-	C1205.579102,770.980469 1205.747437,770.515442 1205.915771,770.050415 
-	C1207.802979,770.393127 1209.690186,770.735901 1211.577393,771.078674 
-	C1211.746216,770.582947 1211.914917,770.087280 1212.083740,769.591614 
-	C1210.057251,768.997498 1208.017334,767.926819 1206.009399,767.984009 
-	C1204.759277,768.019653 1203.557983,769.760986 1202.334717,770.736816 
-	C1203.658325,772.178162 1204.906006,773.701172 1206.334229,775.029968 
-	C1207.179810,775.816650 1208.310547,776.296692 1209.313110,776.914612 
-	C1209.188477,777.372253 1209.063965,777.829834 1208.939453,778.287415 
-	C1207.696533,778.208435 1206.435791,778.233643 1205.215454,778.024048 
-	C1203.682129,777.760864 1202.181885,777.305542 1200.704956,776.942322 
-	C1199.828125,768.179688 1200.920044,766.694397 1189.497559,768.646973 
-	C1189.705933,772.627380 1189.915894,776.637268 1190.125854,780.647095 
-	C1190.798218,780.632080 1191.470703,780.617004 1192.143066,780.601929 
-	C1192.329468,777.931641 1192.300781,775.219116 1192.813354,772.612976 
-	C1193.004395,771.641113 1194.460327,770.917969 1195.339478,770.081482 
-	C1196.025513,771.011841 1197.191284,771.888123 1197.303589,772.883179 
-	C1197.587402,775.399231 1197.397705,777.968750 1197.397705,779.499634 
-	C1200.201172,779.740662 1201.889648,779.885864 1204.304932,780.391846 
-M717.412659,293.993073 
-	C716.431152,296.481628 715.449646,298.970215 713.960144,302.746826 
-	C712.255127,298.299744 711.226624,295.342041 709.955933,292.492310 
-	C709.629700,291.760620 708.598450,291.109955 707.777527,290.924438 
-	C707.325012,290.822205 706.142700,291.751526 706.130554,292.236786 
-	C706.006226,297.214844 706.054382,302.197205 706.054382,307.178345 
-	C706.687805,307.213196 707.321228,307.248016 707.954651,307.282837 
-	C708.307068,304.644165 708.659424,302.005493 709.165894,298.213226 
-	C710.880493,302.028870 712.109497,304.763916 713.898438,308.744812 
-	C715.831238,305.013550 717.118774,302.528015 718.629028,299.612579 
-	C719.240356,302.652924 719.721924,305.048248 720.203552,307.443542 
-	C720.904419,307.364777 721.605225,307.285980 722.306030,307.207214 
-	C722.306030,302.831726 722.403992,298.452454 722.237061,294.083344 
-	C722.195374,292.992462 721.299988,291.934174 720.796997,290.860901 
-	C719.763794,291.684845 718.730591,292.508759 717.412659,293.993073 
-M1110.199097,183.231110 
-	C1110.883423,184.462662 1111.567627,185.694214 1112.251953,186.925781 
-	C1112.742188,185.663147 1113.624023,184.407700 1113.647461,183.136505 
-	C1113.711914,179.621902 1112.851562,175.859955 1117.729248,174.141998 
-	C1110.757202,173.544983 1103.682617,170.412064 1098.778198,177.444321 
-	C1097.715454,175.935135 1096.789429,174.620071 1095.863403,173.305008 
-	C1095.322510,174.852982 1094.505127,176.366760 1094.308594,177.957291 
-	C1094.045532,180.086105 1094.098145,182.294098 1094.353271,184.427719 
-	C1094.460083,185.321533 1095.433716,186.111710 1096.013184,186.949020 
-	C1096.604248,186.123062 1097.292847,185.347382 1097.752808,184.453934 
-	C1098.074829,183.828308 1098.084473,183.041855 1098.274902,182.128860 
-	C1100.652100,184.111862 1102.696167,185.817017 1104.740356,187.522171 
-	C1105.156494,187.091629 1105.572754,186.661087 1105.989014,186.230545 
-	C1104.718872,184.374908 1103.098755,182.664536 1102.255493,180.631821 
-	C1100.745483,176.992416 1105.351318,174.771271 1110.198486,176.985779 
-	C1110.198486,178.702744 1110.198486,180.524078 1110.199097,183.231110 
-M1142.269653,752.935608 
-	C1146.380615,752.690308 1150.491577,752.444946 1154.886353,752.182739 
-	C1154.618774,746.403198 1155.502319,740.866943 1154.397461,735.504944 
-	C1153.732666,735.515991 1153.067993,735.527039 1152.403320,735.538086 
-	C1152.147583,740.504211 1151.891846,745.470337 1151.636108,750.436401 
-	C1151.123779,750.440063 1150.611328,750.443726 1150.098999,750.447327 
-	C1149.874756,748.628113 1150.014404,746.655945 1149.331177,745.029480 
-	C1148.535278,743.135193 1147.306885,740.523804 1145.742065,740.082458 
-	C1143.854858,739.550293 1141.416992,740.971191 1139.217407,741.546692 
-	C1139.347534,742.063477 1139.477661,742.580261 1139.607788,743.097046 
-	C1140.413940,743.545166 1141.220215,743.993347 1142.056396,744.458191 
-	C1137.440063,748.350830 1137.366577,749.480896 1142.269653,752.935608 
-M767.046082,242.497330 
-	C766.949829,247.967758 766.770264,253.439056 766.826172,258.907928 
-	C766.837708,260.032166 767.729370,261.147369 768.215454,262.266754 
-	C769.110779,261.216156 770.771545,260.175476 770.785278,259.113464 
-	C770.960876,245.498444 770.877502,231.880325 770.917664,218.263168 
-	C770.927612,214.886581 769.515564,214.214279 767.046204,215.388641 
-	C767.046204,224.318832 767.046204,232.908569 767.046082,242.497330 
-M1594.090820,612.826721 
-	C1594.494263,612.603149 1594.897827,612.379578 1595.301270,612.156067 
-	C1595.704712,613.630493 1596.023315,615.135925 1596.544556,616.567383 
-	C1596.842285,617.385193 1597.395874,618.156860 1598.009888,618.774963 
-	C1598.141357,618.907532 1599.493164,618.294983 1599.497681,618.013123 
-	C1599.536377,615.572327 1599.850464,612.972961 1599.093018,610.759399 
-	C1598.772949,609.823975 1596.088257,609.313660 1594.473022,609.301208 
-	C1592.396729,609.285278 1589.564941,611.013916 1588.368408,610.158630 
-	C1583.700195,606.821655 1581.084106,611.466553 1577.582275,612.349121 
-	C1577.219727,612.440552 1576.881470,614.798035 1577.167847,614.956726 
-	C1579.886353,616.463196 1582.630127,618.271667 1585.594482,618.876343 
-	C1587.947144,619.356079 1590.618164,618.274475 1593.671265,617.805847 
-	C1593.723389,616.894958 1593.815796,615.277588 1594.090820,612.826721 
-M1084.803955,769.685059 
-	C1084.708130,771.096802 1084.612305,772.508545 1084.516479,773.920349 
-	C1082.468140,772.738464 1081.528076,771.066528 1080.314087,769.625549 
-	C1078.708252,767.719421 1076.887573,765.994019 1075.159302,764.190979 
-	C1074.671875,766.618896 1073.934204,769.029114 1073.760986,771.479248 
-	C1073.549805,774.463684 1073.813354,777.481628 1073.871704,780.485107 
-	C1074.579590,780.468384 1075.287598,780.451660 1075.995605,780.434937 
-	C1076.110596,778.869446 1076.217407,777.303284 1076.343018,775.738647 
-	C1076.473022,774.118408 1076.621338,772.499695 1076.761719,770.880310 
-	C1079.700806,773.555969 1081.274170,776.472168 1083.324829,779.001099 
-	C1083.974609,779.802368 1086.369995,780.221802 1087.136597,779.667725 
-	C1088.503418,778.679871 1087.253540,766.143372 1085.323730,763.467041 
-	C1085.096680,765.821716 1084.950928,767.332886 1084.803955,769.685059 
-M1493.016724,404.530945 
-	C1491.034546,405.821167 1488.383423,406.721466 1487.319458,408.546906 
-	C1486.674927,409.652771 1488.292969,413.681854 1489.234253,413.805267 
-	C1492.002563,414.168030 1494.940552,413.236267 1496.853394,412.953217 
-	C1500.282349,413.752533 1503.207642,414.434418 1506.239624,415.141174 
-	C1506.239624,410.910278 1506.239624,407.722839 1506.239624,404.535370 
-	C1505.751099,404.489319 1505.262573,404.443237 1504.773926,404.397156 
-	C1504.240845,406.779572 1503.707764,409.161987 1503.174683,411.544373 
-	C1502.684082,411.528961 1502.193481,411.513580 1501.702881,411.498169 
-	C1501.210083,409.162750 1500.717163,406.827332 1499.992798,403.394928 
-	C1498.659546,405.394562 1497.975220,406.420929 1497.371460,407.326508 
-	C1496.103760,406.431488 1494.906616,405.586212 1493.016724,404.530945 
-M312.011139,371.519135 
-	C314.032623,371.153076 316.054138,370.787048 317.921143,370.448975 
-	C315.796356,367.081909 314.197845,366.877563 308.273346,369.587006 
-	C307.009186,368.193542 305.735565,366.789673 304.090149,364.976044 
-	C303.207397,366.655365 301.833923,368.057922 301.887848,369.403290 
-	C302.023987,372.799744 302.659790,376.204224 303.445709,379.522522 
-	C303.600372,380.175507 305.296906,380.733521 306.336182,380.848389 
-	C308.276031,381.062805 310.358551,381.310913 312.192169,380.826965 
-	C314.486298,380.221436 316.589447,378.892151 318.775024,377.875275 
-	C317.417206,376.298859 316.125336,374.657318 314.667175,373.179962 
-	C314.128479,372.634125 313.198181,372.474823 312.011139,371.519135 
-M1092.661133,430.825012 
-	C1093.980591,431.729156 1095.299927,432.633331 1097.807617,434.351807 
-	C1094.416138,434.661285 1092.712646,434.816742 1089.931641,435.070526 
-	C1094.553467,439.345367 1097.597534,438.057007 1100.220825,434.709412 
-	C1104.998291,438.838531 1106.013306,438.921082 1109.457520,435.443542 
-	C1107.958252,435.185028 1106.625000,434.955170 1105.406494,434.745056 
-	C1106.977661,433.378052 1108.412842,432.129364 1109.848022,430.880646 
-	C1108.900146,429.841217 1107.764648,427.804901 1107.038086,427.941650 
-	C1104.426636,428.433136 1101.953369,429.658508 1098.790039,430.845978 
-	C1098.106445,430.295593 1096.476562,428.983276 1094.495972,427.388672 
-	C1096.644409,426.871765 1098.112549,426.518524 1099.580688,426.165283 
-	C1099.562622,425.554657 1099.544678,424.944061 1099.526611,424.333466 
-	C1097.361328,424.333466 1094.690552,423.577850 1093.194946,424.578674 
-	C1092.051514,425.343842 1092.394531,428.330688 1092.661133,430.825012 
-M1469.389038,606.367920 
-	C1472.923218,608.030029 1473.932129,610.869873 1473.231689,614.534058 
-	C1473.140015,615.013672 1473.053589,615.615051 1473.258179,616.006775 
-	C1473.782349,617.010193 1474.471924,617.927246 1475.095337,618.878845 
-	C1475.641235,617.847778 1476.497803,616.863708 1476.662720,615.774963 
-	C1476.932861,613.990234 1476.494019,612.082458 1476.864868,610.334900 
-	C1477.072754,609.355042 1478.306519,608.592896 1479.078003,607.732605 
-	C1480.007812,612.653503 1479.306030,617.237427 1484.588501,618.806702 
-	C1487.166870,619.572815 1489.923340,619.546692 1492.368286,616.046448 
-	C1488.666016,615.378113 1484.316406,618.112915 1483.656982,612.792603 
-	C1482.806274,605.929626 1488.991211,609.133911 1491.748535,606.594116 
-	C1489.181641,605.706238 1486.673706,605.595459 1484.171875,605.676331 
-	C1483.121460,605.710266 1482.075317,606.398193 1481.042725,606.360657 
-	C1477.260376,606.222961 1473.484375,605.905334 1469.389038,606.367920 
-M503.568848,485.744598 
-	C505.637787,484.920563 507.706726,484.096558 509.843079,483.245667 
-	C513.995605,486.648590 514.964600,486.698700 518.273682,483.551239 
-	C516.599426,483.095123 514.957275,482.647766 513.053955,482.129211 
-	C515.391235,481.105225 517.085205,480.363098 518.779175,479.620941 
-	C518.116394,478.378723 517.298950,476.012115 516.816101,476.078491 
-	C513.878601,476.482361 511.017151,477.439972 507.258301,478.446259 
-	C506.797028,478.081940 505.319244,476.914795 503.377197,475.380981 
-	C505.575958,474.802643 507.119781,474.396545 508.663574,473.990479 
-	C508.600555,473.307495 508.537506,472.624512 508.474487,471.941559 
-	C506.178528,472.130096 503.091614,471.435852 501.724304,472.660889 
-	C495.993896,477.794861 504.679291,478.760254 505.482605,482.787292 
-	C503.326050,482.787292 501.720001,482.787292 500.113953,482.787292 
-	C500.006500,483.123749 499.899078,483.460236 499.791656,483.796692 
-	C500.807129,484.400940 501.822601,485.005188 503.568848,485.744598 
-M527.622131,478.797394 
-	C529.062744,481.047974 530.503418,483.298523 531.943970,485.549072 
-	C533.299011,483.567108 534.640137,481.575287 536.030212,479.618225 
-	C536.173340,479.416718 536.608276,479.422455 536.842957,479.351654 
-	C537.466370,481.515564 538.086975,483.669800 538.707581,485.824005 
-	C539.221008,485.658447 539.734497,485.492859 540.247925,485.327271 
-	C540.247925,480.731201 540.247925,476.135132 540.247925,471.539093 
-	C539.764893,471.473633 539.281860,471.408203 538.798828,471.342743 
-	C538.465393,472.770020 538.131897,474.197296 538.063416,474.490356 
-	C535.463928,476.201904 533.547607,477.463684 531.458191,478.839417 
-	C529.194641,473.368164 524.685852,475.844940 520.780762,476.231567 
-	C520.780762,479.456299 520.780762,482.521210 520.780762,485.586121 
-	C521.285400,485.657715 521.789978,485.729309 522.294617,485.800903 
-	C522.700989,484.432648 522.838623,482.889954 523.583862,481.741699 
-	C524.453796,480.401398 525.854248,479.405487 527.622131,478.797394 
-M1576.954224,162.536209 
-	C1575.741455,167.248825 1575.095703,171.908997 1577.069580,175.846771 
-	C1580.613403,173.227692 1583.583740,171.032364 1587.240479,168.329788 
-	C1587.393677,171.075882 1587.317261,172.733566 1587.647827,174.305771 
-	C1587.804199,175.049728 1588.739136,175.630035 1589.321411,176.284439 
-	C1589.853516,175.752380 1590.829590,175.234314 1590.846924,174.686066 
-	C1590.976685,170.566483 1590.917725,166.440933 1590.917725,162.317261 
-	C1590.431763,162.256165 1589.945801,162.195084 1589.459717,162.133987 
-	C1588.457031,163.045822 1587.454346,163.957657 1587.414917,163.993423 
-	C1583.623779,163.307480 1580.688110,162.776352 1576.954224,162.536209 
-M521.342834,696.754028 
-	C521.764343,697.386414 522.185852,698.018860 522.607300,698.651306 
-	C523.047241,698.039490 523.835632,697.444946 523.867004,696.812866 
-	C524.005798,694.014954 523.927063,691.206238 523.927063,688.401428 
-	C526.966309,691.279114 528.708191,694.314758 530.768127,697.116577 
-	C531.400269,697.976318 532.903320,698.195740 534.007507,698.708435 
-	C534.421265,697.710510 535.149170,696.725708 535.191772,695.712219 
-	C535.338379,692.221252 535.331848,688.716797 535.191956,685.225159 
-	C535.149597,684.166992 534.485840,683.133728 534.106750,682.089111 
-	C533.628967,682.157654 533.151184,682.226196 532.673462,682.294739 
-	C532.459412,685.710327 532.245361,689.125916 531.945129,693.917786 
-	C529.371277,689.865356 527.651062,686.887451 525.630066,684.130005 
-	C524.975525,683.237061 523.532288,682.922119 522.449829,682.342773 
-	C522.072144,683.364014 521.408386,684.374207 521.368713,685.408447 
-	C521.234863,688.900330 521.322510,692.400757 521.342834,696.754028 
-M776.731323,209.289276 
-	C777.738464,209.009964 779.605347,208.773941 779.621948,208.444733 
-	C779.823486,204.442825 779.752747,200.427185 779.752747,196.457672 
-	C776.561279,199.415466 773.825256,201.951202 770.772339,204.780563 
-	C767.929077,197.987991 763.344666,200.874283 758.951172,200.722473 
-	C759.110046,204.119431 759.248230,207.074539 759.386414,210.029648 
-	C759.997681,210.067413 760.609009,210.105179 761.220276,210.142944 
-	C761.511719,208.567947 761.615784,206.923737 762.162781,205.443130 
-	C762.506897,204.511642 763.383240,203.502365 764.270508,203.140930 
-	C764.878174,202.893387 766.191833,203.467728 766.709534,204.080505 
-	C768.297546,205.960159 769.654053,208.035431 771.100586,210.034637 
-	C772.480774,207.890091 773.857117,205.743011 775.252686,203.608505 
-	C775.322693,203.501480 775.559937,203.503845 776.288513,203.281754 
-	C776.385498,205.137924 776.475586,206.861374 776.731323,209.289276 
-M749.578308,400.251190 
-	C748.742676,398.852966 747.907043,397.454742 747.071350,396.056488 
-	C747.541809,396.051270 748.012207,396.046051 748.482666,396.040833 
-	C748.825134,393.530853 750.353760,390.183075 749.285034,388.669830 
-	C746.226562,384.339386 741.322021,385.971497 737.159424,386.297760 
-	C737.159424,391.934662 737.159424,397.236176 737.159424,402.537659 
-	C737.673096,402.560883 738.186768,402.584106 738.700500,402.607330 
-	C739.010376,400.501709 739.320312,398.396057 739.603943,396.468933 
-	C744.103027,394.779816 744.875061,398.426025 746.571350,400.674347 
-	C748.479675,403.203735 748.580811,403.200714 749.578308,400.251190 
-M492.809784,699.015137 
-	C493.474335,699.021790 494.144196,699.086060 494.802521,699.025269 
-	C497.815674,698.747009 501.042450,697.760681 500.607666,694.353821 
-	C500.369598,692.488342 497.448792,690.922363 495.641541,689.330505 
-	C495.199951,688.941589 494.224091,689.168945 493.766327,688.786682 
-	C492.751404,687.939270 491.909180,686.884888 490.996552,685.914917 
-	C492.417053,685.424622 493.868225,684.478149 495.249512,684.571045 
-	C496.663269,684.666138 498.008545,685.779602 499.383789,686.447327 
-	C499.630707,685.985168 499.877625,685.523010 500.124512,685.060852 
-	C498.659576,682.290894 495.740479,681.455078 492.757050,682.227173 
-	C490.860352,682.718079 488.296692,684.478943 487.905151,686.117798 
-	C487.146820,689.291809 489.882782,690.621704 492.740662,691.159668 
-	C493.230103,691.251831 493.855347,691.213379 494.176453,691.502930 
-	C495.346283,692.557861 496.413757,693.726257 497.519806,694.851929 
-	C495.779724,695.387756 494.015594,696.401123 492.306824,696.315063 
-	C490.821381,696.240295 489.398468,694.922607 487.947937,694.154114 
-	C487.602509,694.684082 487.257050,695.214111 486.911591,695.744080 
-	C488.608490,696.806580 490.305389,697.869141 492.809784,699.015137 
-M935.452332,77.066925 
-	C936.163208,75.784126 937.212097,74.577354 937.520935,73.204132 
-	C938.409485,69.253868 938.207581,64.825546 934.067505,63.389553 
-	C931.090698,62.357040 926.690247,62.707550 923.986633,64.273865 
-	C920.322083,66.396797 920.672546,70.876251 922.127563,74.621964 
-	C923.926208,79.252563 928.819397,80.281090 935.452332,77.066925 
-M518.736694,692.918945 
-	C519.267822,688.562805 519.058777,684.502747 514.125000,682.638123 
-	C509.654877,680.948669 504.711823,682.738342 503.089722,686.532227 
-	C501.196747,690.959656 502.843719,696.329407 506.671814,698.211182 
-	C511.273926,700.473511 515.791077,698.753235 518.736694,692.918945 
-M548.363525,485.486694 
-	C550.231506,485.418060 552.103149,485.401184 553.966370,485.266327 
-	C555.851562,485.129944 557.728271,484.876801 559.608765,484.674805 
-	C559.528564,484.251892 559.448364,483.828979 559.368164,483.406067 
-	C557.936523,483.078247 556.504883,482.750397 555.073242,482.422577 
-	C555.100891,482.164124 555.128601,481.905701 555.156250,481.647247 
-	C556.921387,481.214417 558.686584,480.781616 560.632874,480.304413 
-	C559.762085,476.241455 557.792053,474.849884 554.114380,475.707672 
-	C552.619934,476.056213 550.880554,476.293243 549.467712,475.867340 
-	C545.976501,474.814758 543.242432,475.530670 542.428894,479.131439 
-	C541.566162,482.949768 543.119080,485.664886 548.363525,485.486694 
-M486.889160,462.491882 
-	C488.307404,462.600403 489.725647,462.708923 491.818268,462.869049 
-	C491.818268,460.435089 492.026855,458.305176 491.763519,456.235260 
-	C491.459381,453.844299 490.739349,451.506287 490.199890,449.145264 
-	C489.273712,451.172638 488.347565,453.200012 487.797943,454.403168 
-	C485.390167,454.200806 482.658722,453.330719 480.431732,454.041412 
-	C479.232483,454.424164 478.034271,457.673401 478.341095,459.354553 
-	C479.139404,463.728546 482.520203,463.811432 486.889160,462.491882 
-M739.114807,731.646179 
-	C735.484863,733.179504 735.054626,736.367981 736.760254,738.969421 
-	C737.730469,740.449158 740.820435,740.753052 743.033936,741.139648 
-	C745.002808,741.483582 747.079224,741.211853 749.804504,741.211853 
-	C749.804504,738.464844 749.978271,735.703125 749.745911,732.976135 
-	C749.579468,731.022400 748.869446,729.114990 748.401917,727.186890 
-	C747.680237,729.081421 746.969543,730.980225 746.224182,732.865417 
-	C746.124695,733.116943 745.850342,733.299316 746.026855,733.103516 
-	C743.766968,732.484802 741.805237,731.947632 739.114807,731.646179 
-M785.738770,200.190659 
-	C782.464478,200.464523 780.722412,202.501984 781.266663,205.493515 
-	C781.589111,207.266129 783.290894,209.951431 784.668762,210.147766 
-	C788.622314,210.711121 792.728821,210.263367 796.769775,210.086990 
-	C797.419128,210.058624 798.040222,209.383469 799.395447,208.579575 
-	C796.858215,208.000198 795.181519,207.617340 793.921692,207.329651 
-	C795.751343,205.870697 798.902161,204.256317 798.709839,203.357117 
-	C797.848877,199.332947 794.832092,200.049011 791.659485,200.971039 
-	C790.157898,201.407410 788.267395,200.505615 785.738770,200.190659 
-M1267.685791,191.576172 
-	C1266.258057,189.818222 1264.830444,188.060287 1263.318848,186.198975 
-	C1265.388306,183.827911 1267.165405,181.791763 1268.942505,179.755630 
-	C1268.612427,179.378708 1268.282349,179.001785 1267.952271,178.624863 
-	C1265.368164,180.707108 1262.784058,182.789368 1260.068848,184.977280 
-	C1259.562866,182.707291 1259.147217,180.842361 1258.512085,177.993134 
-	C1255.769165,183.343048 1256.104248,192.953979 1258.811401,195.671753 
-	C1259.329102,193.167221 1259.790039,190.937943 1260.380249,188.082642 
-	C1263.633301,191.075775 1266.338867,193.565155 1269.044434,196.054520 
-	C1269.427368,195.603989 1269.810425,195.153458 1270.193359,194.702927 
-	C1269.505859,193.829010 1268.818481,192.955109 1267.685791,191.576172 
-M270.620514,722.126404 
-	C266.247375,725.122925 266.035950,729.204468 267.852600,733.615173 
-	C269.344757,737.237854 272.493958,738.200256 276.082794,737.830811 
-	C278.955261,737.535095 280.970367,736.091919 282.633026,732.033203 
-	C277.960938,733.817200 274.448273,737.990173 271.399323,733.510925 
-	C270.108612,731.614685 269.907776,727.685486 271.023651,725.697266 
-	C273.782684,720.781250 277.755005,724.622009 281.375122,725.850403 
-	C280.102142,721.009949 277.303772,720.012573 270.620514,722.126404 
-M1048.135742,635.455017 
-	C1051.160889,635.794617 1054.186035,636.134216 1057.118652,636.463440 
-	C1056.015015,633.034119 1053.659790,631.764526 1049.418457,632.507812 
-	C1045.014282,633.279663 1042.569702,636.411316 1042.796387,640.991028 
-	C1043.034546,645.802307 1045.595825,648.853271 1049.826050,649.174255 
-	C1053.436768,649.448181 1056.348145,648.453796 1057.467651,644.213013 
-	C1053.870972,645.543579 1050.011475,649.386597 1047.186890,644.599426 
-	C1045.954834,642.511108 1047.313599,638.893982 1048.135742,635.455017 
-M1028.015869,485.392334 
-	C1028.250122,487.671844 1028.033691,490.122131 1028.818604,492.192993 
-	C1030.178711,495.782013 1033.369629,496.793671 1036.991089,496.366547 
-	C1039.841919,496.030334 1041.992310,494.808411 1042.666504,492.561737 
-	C1038.896606,492.561737 1035.412109,493.281067 1032.598877,492.220154 
-	C1031.415527,491.773834 1030.636230,487.169525 1031.429077,485.142181 
-	C1033.893921,478.840179 1038.616577,483.518585 1042.811523,484.284698 
-	C1039.011230,477.531891 1032.289673,478.058441 1028.015869,485.392334 
-M291.284698,337.995148 
-	C291.716797,342.936188 290.278809,348.114471 292.171234,352.870239 
-	C292.693298,352.872070 293.215393,352.873901 293.737457,352.875732 
-	C294.123718,351.066162 294.509979,349.256561 294.923370,347.319763 
-	C296.972961,346.905853 299.313019,346.918091 301.091217,345.924652 
-	C302.581024,345.092316 304.113556,343.177460 304.324646,341.570801 
-	C304.503479,340.209564 302.999542,337.487000 301.924408,337.312439 
-	C298.526550,336.760895 294.980469,337.122498 291.284698,337.995148 
-M1084.086914,709.129272 
-	C1080.767090,708.736816 1077.447266,708.344421 1073.488159,707.876343 
-	C1073.965210,714.203125 1073.082520,719.531372 1074.097412,724.690979 
-	C1074.708374,724.686707 1075.319214,724.682434 1075.930054,724.678162 
-	C1076.275635,722.847656 1076.621216,721.017151 1076.955933,719.243652 
-	C1087.000977,717.498535 1088.663940,715.391235 1084.086914,709.129272 
-M1290.621704,195.791061 
-	C1295.624512,195.197723 1295.984497,191.598236 1295.732056,187.728424 
-	C1295.415771,182.883759 1292.199219,181.890427 1288.258423,182.663391 
-	C1287.559814,180.848114 1287.036865,179.489075 1286.513916,178.130035 
-	C1286.088745,178.199310 1285.663696,178.268585 1285.238525,178.337860 
-	C1285.238525,183.889755 1285.238525,189.441650 1285.238525,195.021622 
-	C1286.756592,195.233215 1288.325073,195.451828 1290.621704,195.791061 
-M1199.073242,407.964844 
-	C1199.097534,407.205688 1199.121704,406.446503 1199.145996,405.687317 
-	C1197.627930,406.528717 1196.109863,407.370117 1194.296509,408.375153 
-	C1192.154541,402.550201 1187.418701,405.976959 1182.886841,405.686829 
-	C1183.121826,409.316864 1183.323242,412.427368 1183.524536,415.537903 
-	C1184.150635,415.511841 1184.776611,415.485748 1185.402710,415.459656 
-	C1185.605713,414.265686 1185.628174,413.001617 1186.057617,411.895599 
-	C1186.587280,410.531677 1187.455688,409.299286 1188.177856,408.010101 
-	C1189.390137,409.080383 1191.192139,409.934937 1191.680542,411.270050 
-	C1192.467529,413.421112 1192.388184,415.889069 1192.674927,418.223175 
-	C1193.111206,418.411011 1193.547363,418.598846 1193.983643,418.786682 
-	C1195.585938,415.396210 1197.188232,412.005707 1199.073242,407.964844 
-M284.413147,731.296631 
-	C284.591919,733.386902 284.770691,735.477173 284.949463,737.567444 
-	C285.481842,737.580566 286.014221,737.593628 286.546570,737.606689 
-	C286.970825,735.692139 287.395050,733.777588 287.797974,731.959229 
-	C291.944672,730.851624 297.689148,732.259277 297.257263,725.476440 
-	C297.008850,721.574646 292.401459,720.209778 284.413635,721.657593 
-	C284.413635,724.481140 284.413635,727.429932 284.413147,731.296631 
-M1126.222534,771.558716 
-	C1126.222534,774.487732 1126.222534,777.416809 1126.222534,780.293091 
-	C1135.540405,780.746033 1136.932373,780.097656 1137.440186,775.425415 
-	C1138.021484,770.077942 1136.246460,768.121826 1130.129150,767.364685 
-	C1129.422974,765.960510 1128.716675,764.556396 1128.010498,763.152283 
-	C1127.521240,763.263062 1127.031982,763.373779 1126.542725,763.484558 
-	C1126.435791,765.865051 1126.328857,768.245483 1126.222534,771.558716 
-M1063.149536,646.642944 
-	C1062.400391,642.757202 1065.095581,642.965332 1067.631958,642.721313 
-	C1070.676025,642.428406 1073.271240,641.209595 1073.271973,637.648499 
-	C1073.272949,633.770386 1070.501587,632.701233 1067.222656,632.553528 
-	C1064.991943,632.453003 1062.752930,632.534363 1060.264404,632.534363 
-	C1060.264404,637.621033 1060.165405,641.924255 1060.301147,646.220154 
-	C1060.384766,648.863098 1060.545776,648.858032 1063.149536,646.642944 
-M1306.286621,192.017792 
-	C1302.214111,193.984131 1302.214111,193.984131 1300.577393,190.257706 
-	C1303.204346,190.001389 1305.746094,189.753387 1308.287720,189.505402 
-	C1308.656738,189.063293 1309.025879,188.621170 1309.394897,188.179062 
-	C1307.770630,186.333801 1306.395386,183.394196 1304.452026,182.952087 
-	C1302.521484,182.512970 1298.512085,184.167953 1298.101196,185.649734 
-	C1297.379395,188.252518 1297.958008,191.933228 1299.470703,194.156158 
-	C1300.311523,195.391586 1304.142212,194.630966 1306.622925,194.597214 
-	C1306.746094,194.595535 1306.846680,192.940872 1306.286621,192.017792 
-M803.912537,332.672058 
-	C802.308167,332.304077 800.703857,331.936096 799.099487,331.568085 
-	C799.221008,331.062042 799.342468,330.556000 799.463989,330.049927 
-	C802.060181,329.832336 804.656311,329.614746 807.252502,329.397156 
-	C807.635254,328.981537 808.018066,328.565948 808.400818,328.150330 
-	C806.799683,326.267670 805.509460,323.451874 803.503723,322.783783 
-	C801.751587,322.200104 797.735291,323.561432 797.301270,324.900360 
-	C796.444092,327.544861 796.571838,331.208191 797.874573,333.581604 
-	C798.614746,334.929932 802.478577,334.696136 804.955872,334.850250 
-	C805.472168,334.882355 806.077332,333.485321 806.641541,332.746857 
-	C805.947266,332.581024 805.252991,332.415192 803.912537,332.672058 
-M1075.349365,491.142303 
-	C1077.020752,496.915680 1077.763794,497.190033 1085.693604,495.303009 
-	C1085.693604,489.758087 1085.693604,484.367523 1085.693604,478.976929 
-	C1085.287231,478.951172 1084.880859,478.925415 1084.474609,478.899658 
-	C1083.941528,480.310150 1083.408447,481.720612 1082.881226,483.115784 
-	C1076.630371,483.386353 1075.798584,484.187866 1075.349365,491.142303 
-M376.461639,181.329178 
-	C381.317535,182.330887 381.317535,182.330887 383.922943,178.967392 
-	C381.746246,177.584427 377.549316,182.330933 376.638702,176.463120 
-	C379.382050,176.224411 381.936371,176.002136 384.561890,175.773666 
-	C385.070984,171.724503 383.704315,169.234955 379.800140,168.827606 
-	C376.304443,168.462875 373.640198,170.145233 373.605804,173.721069 
-	C373.582794,176.116104 375.009399,178.525085 376.461639,181.329178 
-M1177.123901,778.228455 
-	C1181.493164,782.209106 1184.386841,782.069580 1186.571533,777.627930 
-	C1184.301270,776.846436 1180.225098,781.351074 1179.556030,775.314941 
-	C1182.325806,775.115906 1184.912964,774.929993 1187.624634,774.735107 
-	C1187.733154,770.839050 1186.616455,768.191284 1182.665527,767.775146 
-	C1179.118896,767.401489 1176.887573,769.119141 1176.428223,772.646912 
-	C1176.222168,774.230591 1176.640625,775.895569 1177.123901,778.228455 
-M1126.588379,432.259125 
-	C1126.984741,430.961365 1127.381226,429.663605 1127.777588,428.365845 
-	C1127.400757,428.127533 1127.023926,427.889221 1126.647217,427.650909 
-	C1125.359619,428.824554 1124.072021,429.998230 1122.765259,431.189453 
-	C1119.864990,426.868469 1119.864990,426.868469 1111.146973,428.615784 
-	C1111.146973,430.304962 1110.916748,432.133942 1111.220825,433.869293 
-	C1111.458130,435.222565 1112.359741,436.459442 1112.966064,437.748047 
-	C1113.501221,436.543579 1113.994141,435.317932 1114.583496,434.140533 
-	C1115.180298,432.948273 1115.872559,431.803772 1116.523071,430.638367 
-	C1117.649048,431.583008 1118.843018,432.460876 1119.868164,433.504547 
-	C1120.288574,433.932556 1120.222168,434.806702 1120.593750,435.321686 
-	C1121.227661,436.200378 1122.032471,436.955841 1122.765381,437.763092 
-	C1123.649414,436.933899 1124.639771,436.188293 1125.379517,435.245789 
-	C1125.865234,434.626923 1125.988770,433.723694 1126.588379,432.259125 
-M281.570709,378.013153 
-	C280.012695,375.969788 280.647858,375.100037 283.085693,375.064148 
-	C284.977020,375.036346 286.866577,374.886963 288.932281,374.782776 
-	C288.892365,370.697418 287.670685,368.215363 283.996216,367.839600 
-	C280.813660,367.514099 278.461609,368.820465 277.700439,372.161316 
-	C276.937988,375.507843 277.366882,378.523834 280.670349,380.359833 
-	C283.374542,381.862762 285.807190,381.012207 288.111298,377.660187 
-	C285.958527,377.978668 284.131531,378.248932 281.570709,378.013153 
-M97.869705,846.177917 
-	C98.809334,845.739563 99.867256,845.451660 100.660973,844.827698 
-	C101.855705,843.888428 102.683311,842.273621 103.992233,841.731873 
-	C106.659760,840.627869 108.373108,839.048523 107.516647,836.142151 
-	C106.444939,832.505127 103.218880,832.622192 100.182205,832.577209 
-	C96.681259,832.525391 97.358269,835.044067 97.349243,837.096008 
-	C97.336914,839.900330 97.419731,842.705078 97.869705,846.177917 
-M1083.558472,186.872803 
-	C1087.169067,187.827133 1090.651733,187.138626 1091.962158,183.622894 
-	C1092.810425,181.347031 1092.659302,177.633408 1091.279419,175.893463 
-	C1089.913330,174.170746 1086.229248,173.133392 1083.960083,173.626862 
-	C1081.971313,174.059402 1079.837280,176.768295 1079.015137,178.943283 
-	C1077.728149,182.348450 1079.877075,184.912842 1083.558472,186.872803 
-M1124.487793,415.148621 
-	C1129.304810,412.995056 1130.988770,409.949921 1129.570679,405.957336 
-	C1128.148682,401.953918 1123.977661,400.529724 1117.208618,402.048431 
-	C1117.208618,404.522797 1117.204102,407.128998 1117.209473,409.735199 
-	C1117.222290,416.046234 1117.224243,416.046234 1124.487793,415.148621 
-M1508.109497,408.861115 
-	C1508.624878,414.868011 1508.982544,415.077423 1517.662109,414.111938 
-	C1517.263672,409.589050 1518.936035,404.851685 1516.389526,399.922211 
-	C1514.698120,401.851898 1513.668335,403.174835 1512.483276,404.339783 
-	C1511.139038,405.660858 1509.655518,406.840302 1508.109497,408.861115 
-M1500.318726,613.986145 
-	C1503.317871,612.852234 1504.813843,610.501526 1503.174805,607.794006 
-	C1500.922241,604.072632 1497.167114,604.763794 1493.266113,605.760437 
-	C1493.266113,609.419434 1493.156982,612.869019 1493.341553,616.302856 
-	C1493.388672,617.180664 1494.365356,618.008484 1494.915039,618.859253 
-	C1495.509888,618.219971 1496.087402,617.563416 1496.703735,616.945496 
-	C1497.641724,616.005249 1498.606445,615.091736 1500.318726,613.986145 
-M1572.807129,169.550980 
-	C1572.095825,167.703674 1571.698242,165.618652 1570.549438,164.103104 
-	C1569.915894,163.267212 1566.973145,162.892670 1566.851318,163.150726 
-	C1564.904419,167.273361 1563.245239,171.531876 1561.520508,175.759430 
-	C1564.735474,175.132309 1566.762329,173.279053 1568.780518,173.288483 
-	C1570.580322,173.296906 1572.370483,175.364609 1574.164917,176.523544 
-	C1574.487671,176.224976 1574.810303,175.926407 1575.133057,175.627838 
-	C1574.439941,173.844284 1573.746948,172.060730 1572.807129,169.550980 
-M98.775055,181.399612 
-	C98.775558,180.904968 98.827827,180.403946 98.767670,179.916794 
-	C98.494987,177.708755 98.190582,175.504639 97.897591,173.299103 
-	C96.704903,174.461502 95.548363,175.665390 94.294533,176.757584 
-	C93.974335,177.036514 93.329231,176.909042 92.861908,177.057831 
-	C89.289139,178.195450 88.534752,180.906845 89.254883,184.128708 
-	C89.987534,187.406555 92.546333,187.265778 95.158432,186.875031 
-	C96.105080,186.733429 97.090691,186.852264 98.454102,186.852264 
-	C98.571579,185.191925 98.673004,183.758530 98.775055,181.399612 
-M1279.500122,189.512985 
-	C1278.468018,190.788055 1277.435791,192.063141 1276.403687,193.338226 
-	C1275.790894,191.794907 1274.972290,190.297119 1274.618286,188.696533 
-	C1274.191284,186.766388 1274.158691,184.749054 1273.955322,182.769470 
-	C1273.144165,182.858810 1272.333008,182.948166 1271.521729,183.037521 
-	C1271.845825,186.649780 1271.112061,190.946640 1272.855469,193.640213 
-	C1274.073242,195.521500 1278.681152,195.208389 1281.583008,195.834045 
-	C1281.583008,190.825073 1281.583008,186.831085 1281.583008,182.837097 
-	C1281.026733,182.832764 1280.470337,182.828430 1279.914062,182.824081 
-	C1279.787720,184.762024 1279.661499,186.699951 1279.500122,189.512985 
-M1125.518921,175.984299 
-	C1124.604614,173.714310 1122.742676,171.560989 1121.006836,174.264664 
-	C1118.661987,177.917099 1117.561035,182.368210 1115.926392,186.476593 
-	C1116.269531,187.065521 1116.612549,187.654465 1116.955688,188.243393 
-	C1120.729248,182.404388 1124.520264,182.694031 1128.325806,188.126678 
-	C1128.647217,187.573013 1128.968506,187.019333 1129.289917,186.465668 
-	C1128.116455,183.207291 1126.942993,179.948898 1125.518921,175.984299 
-M775.284363,185.075912 
-	C776.703979,186.203720 778.123596,187.331528 779.530029,188.448822 
-	C779.530029,184.401749 779.530029,181.556412 779.530029,177.807312 
-	C779.300964,177.533783 778.309753,176.350052 778.081543,176.077499 
-	C774.028320,177.193558 770.790527,178.085052 767.077515,179.107407 
-	C767.077515,180.566376 766.884216,182.384811 767.142273,184.136780 
-	C767.329407,185.407043 768.114563,186.589218 768.633118,187.810654 
-	C769.262268,186.695724 769.872986,185.569885 770.525024,184.468491 
-	C771.473572,182.866211 772.451904,181.281601 773.417480,179.689468 
-	C773.913574,179.933960 774.409668,180.178467 774.905762,180.422974 
-	C775.014160,181.706589 775.122620,182.990219 775.284363,185.075912 
-M116.643242,846.966797 
-	C121.058960,846.412964 122.862679,843.718384 121.708138,839.648926 
-	C120.105659,834.000610 115.868713,837.679260 112.773727,837.196716 
-	C112.773727,841.560364 112.773727,845.560974 112.773727,849.561523 
-	C113.124039,849.719299 113.474350,849.877075 113.824661,850.034851 
-	C114.554924,849.159485 115.285179,848.284180 116.643242,846.966797 
-M1125.112671,513.563293 
-	C1126.296997,513.984131 1127.481445,514.404968 1128.665771,514.825806 
-	C1128.876465,514.327637 1129.087036,513.829407 1129.297729,513.331238 
-	C1127.977051,512.650757 1126.536621,511.252960 1125.362427,511.449158 
-	C1123.335693,511.787781 1121.474365,513.116943 1119.543701,514.030518 
-	C1120.746338,515.511108 1121.831543,517.113220 1123.193115,518.429626 
-	C1124.104614,519.310852 1125.408447,519.786255 1126.536865,520.443237 
-	C1126.368652,520.937256 1126.200439,521.431335 1126.032227,521.925354 
-	C1123.812744,521.637390 1121.593140,521.349487 1119.373657,521.061584 
-	C1119.258179,521.689819 1119.142822,522.318115 1119.027344,522.946350 
-	C1121.465088,523.371338 1123.930420,524.204590 1126.328735,524.043396 
-	C1127.470703,523.966553 1129.553345,521.242249 1129.386719,521.006470 
-	C1128.194336,519.320190 1126.647461,517.813416 1124.982422,516.555115 
-	C1123.685425,515.574768 1121.495972,515.162048 1125.112671,513.563293 
-M1365.433838,189.148132 
-	C1367.074341,189.949509 1368.714844,190.750885 1370.355347,191.552261 
-	C1370.188354,192.121460 1370.021240,192.690643 1369.854126,193.259842 
-	C1367.630981,192.889465 1365.407837,192.519104 1363.184692,192.148727 
-	C1363.729736,193.800919 1364.891968,195.380112 1365.820190,195.252823 
-	C1368.338623,194.907440 1371.890869,194.564484 1372.961792,192.893250 
-	C1374.749878,190.102798 1371.707642,188.774200 1369.272217,187.809509 
-	C1368.240234,187.400742 1367.357056,186.616241 1366.406250,186.002487 
-	C1366.571533,185.634628 1366.736938,185.266785 1366.902222,184.898926 
-	C1368.816162,185.177811 1370.729980,185.456696 1373.315674,185.833481 
-	C1370.816895,181.702469 1367.748047,181.949570 1364.877563,183.482025 
-	C1362.333374,184.840225 1362.830811,186.969177 1365.433838,189.148132 
-M1128.235962,547.940735 
-	C1129.613281,555.585205 1134.882202,550.889465 1138.177979,551.611511 
-	C1138.177979,547.245178 1138.177979,543.309631 1138.177979,539.374084 
-	C1137.650757,539.359192 1137.123535,539.344299 1136.596313,539.329407 
-	C1136.413452,541.437683 1136.514282,543.625061 1135.955566,545.628540 
-	C1135.528809,547.159119 1134.267212,548.456970 1133.376953,549.858337 
-	C1132.659058,548.453430 1131.654541,547.118042 1131.292969,545.626709 
-	C1130.798828,543.588562 1130.793823,541.431885 1130.579102,539.325989 
-	C1129.912354,539.376709 1129.245605,539.427490 1128.578857,539.478210 
-	C1128.436890,542.019348 1128.294800,544.560425 1128.235962,547.940735 
-M540.809387,205.957428 
-	C540.809387,203.525345 540.809387,201.093262 540.809387,197.508636 
-	C537.163879,198.578766 534.347656,199.405472 531.190430,200.332260 
-	C530.349243,200.001648 528.746948,199.371902 526.055969,198.314240 
-	C527.474243,201.289963 528.182068,203.093414 529.165527,204.731339 
-	C529.870972,205.906097 530.945129,206.859421 531.854858,207.911530 
-	C532.777405,206.891006 533.821899,205.953384 534.587646,204.826309 
-	C535.336548,203.724045 535.801147,202.428589 536.390503,201.217926 
-	C537.356323,202.936646 537.348938,204.401871 537.566345,205.832916 
-	C537.923340,208.182404 538.974792,208.679535 540.809387,205.957428 
-M264.994507,371.748932 
-	C264.949219,380.831787 264.949219,380.831787 275.849213,380.220978 
-	C275.581238,376.165283 275.314850,372.133362 275.048431,368.101440 
-	C274.365814,368.133789 273.683197,368.166168 273.000549,368.198517 
-	C272.896912,370.405060 273.077271,372.677277 272.587708,374.794586 
-	C272.272217,376.158966 270.973236,377.295959 270.115051,378.534851 
-	C269.368652,377.311981 268.243866,376.170166 267.960724,374.848083 
-	C267.485260,372.627930 267.545349,370.293091 267.380096,368.006500 
-	C266.908508,367.985138 266.436920,367.963776 265.965332,367.942413 
-	C265.643768,368.916809 265.322205,369.891205 264.994507,371.748932 
-M1136.859741,750.864563 
-	C1137.164185,740.272278 1137.164307,740.268066 1127.492432,740.040344 
-	C1127.216553,740.033875 1126.933350,740.343811 1126.895630,740.365723 
-	C1126.895630,744.592407 1126.895630,748.649109 1126.895630,752.705750 
-	C1127.541016,752.733093 1128.186523,752.760376 1128.831909,752.787659 
-	C1128.971069,750.388123 1128.821411,747.920654 1129.362793,745.615601 
-	C1129.666504,744.321838 1131.113159,743.296509 1132.044922,742.150208 
-	C1132.699341,743.288818 1133.692017,744.362061 1133.927612,745.581604 
-	C1134.268433,747.345764 1133.926880,749.236816 1134.205566,751.022278 
-	C1134.258667,751.362976 1135.838013,751.465454 1136.859741,750.864563 
-M809.004150,332.779419 
-	C810.448242,333.722382 811.957764,335.513123 813.320984,335.407990 
-	C815.324036,335.253418 817.222595,333.744598 819.165649,332.812683 
-	C817.970886,331.156982 816.901245,329.386749 815.532227,327.890472 
-	C814.767090,327.054199 813.505066,326.672546 812.466919,326.086029 
-	C812.608826,325.651001 812.750732,325.215973 812.892700,324.780945 
-	C814.752502,325.087280 816.612305,325.393616 818.472107,325.699921 
-	C818.648682,325.209076 818.825317,324.718201 819.001892,324.227356 
-	C816.996399,323.668884 814.973999,322.647614 812.991577,322.720123 
-	C811.739868,322.765930 810.548035,324.445953 809.329285,325.392914 
-	C810.626282,326.839172 811.839600,328.374542 813.250305,329.699707 
-	C814.158569,330.552826 815.356934,331.097198 816.425232,331.779968 
-	C816.235474,332.243958 816.045715,332.707977 815.855896,333.171967 
-	C813.631042,332.859894 811.406128,332.547791 809.004150,332.779419 
-M1036.465088,646.786438 
-	C1036.465088,642.996338 1036.465088,639.206177 1036.465088,635.603516 
-	C1038.592896,634.960571 1040.161133,634.486755 1041.729248,634.012939 
-	C1041.652100,633.739807 1041.574829,633.466736 1041.497681,633.193604 
-	C1037.119263,633.193604 1032.740845,633.193604 1028.362549,633.193604 
-	C1028.344360,633.550415 1028.326172,633.907227 1028.307983,634.263977 
-	C1029.961548,634.678711 1031.615234,635.093384 1033.415771,635.544922 
-	C1033.415771,639.291748 1033.322388,642.785645 1033.451538,646.271240 
-	C1033.526733,648.306152 1033.909668,650.433594 1036.465088,646.786438 
-M553.509644,717.495972 
-	C555.802063,719.478821 558.094482,721.461670 560.386841,723.444519 
-	C560.256836,723.807983 560.126770,724.171387 559.996704,724.534851 
-	C557.880310,724.192444 555.763855,723.850037 553.328674,723.455994 
-	C555.811768,727.096069 560.045715,728.415344 562.087830,725.936523 
-	C567.789734,719.015259 557.706665,720.483032 556.567749,716.159302 
-	C559.013733,716.460571 560.967834,716.701294 563.387085,716.999268 
-	C559.602722,712.605408 557.058044,712.697632 553.509644,717.495972 
-M480.063110,696.104492 
-	C478.472687,695.415405 476.882263,694.726318 475.291809,694.037292 
-	C474.939545,694.653992 474.587280,695.270752 474.235016,695.887512 
-	C476.079407,696.929016 478.024597,698.925171 479.739929,698.744080 
-	C481.461029,698.562378 484.052338,696.396118 484.327240,694.772034 
-	C484.996765,690.816895 484.545380,686.671936 484.545380,682.087769 
-	C482.340820,682.290283 480.588348,682.451294 478.093323,682.680481 
-	C482.147034,686.197876 482.697937,689.739502 480.063110,696.104492 
-M766.331299,335.081543 
-	C769.029541,335.081543 771.727783,335.081543 774.268860,335.081543 
-	C774.268860,330.754272 774.268860,326.685730 774.268860,322.617157 
-	C773.660034,322.573120 773.051270,322.529083 772.442444,322.485046 
-	C772.310303,324.703033 772.497620,327.006226 771.936707,329.109863 
-	C771.545776,330.575806 770.128784,331.768158 769.170105,333.082703 
-	C768.464600,331.786102 767.424805,330.560516 767.130737,329.176483 
-	C766.673401,327.023438 766.723206,324.762726 766.557983,322.547638 
-	C765.914429,322.597382 765.270813,322.647095 764.627258,322.696808 
-	C764.238159,326.689209 762.950623,330.700562 766.331299,335.081543 
-M295.019440,372.581726 
-	C292.927887,370.851959 293.711609,370.032318 295.950439,370.119080 
-	C297.238708,370.168976 298.504242,370.805786 299.780029,371.178406 
-	C299.960205,370.604675 300.140381,370.030914 300.320587,369.457153 
-	C298.232544,368.955048 296.112579,367.987701 294.068604,368.127930 
-	C292.871857,368.210083 291.796265,370.058411 290.666168,371.112213 
-	C292.065613,372.474670 293.428070,373.878265 294.878723,375.183807 
-	C295.720917,375.941742 296.704865,376.542114 297.625061,377.213379 
-	C297.437592,377.660522 297.250153,378.107697 297.062714,378.554840 
-	C294.946411,378.232452 292.830139,377.910065 290.321411,377.527893 
-	C292.802490,380.842346 294.881165,381.877228 297.501831,380.721069 
-	C298.817596,380.140625 299.690094,378.555420 300.763062,377.424622 
-	C299.084656,375.904358 297.406281,374.384125 295.019440,372.581726 
-M756.870056,402.795044 
-	C762.466797,402.352844 764.637939,399.710907 763.720947,394.458740 
-	C763.067749,390.717346 760.031921,388.556122 756.426331,389.965179 
-	C754.747559,390.621246 752.927734,392.632507 752.483765,394.365601 
-	C751.627380,397.708374 752.271606,401.029480 756.870056,402.795044 
-M1173.039917,771.033447 
-	C1173.658325,770.135071 1174.276611,769.236694 1174.894897,768.338318 
-	C1174.544800,768.050537 1174.194580,767.762756 1173.844360,767.474976 
-	C1172.092529,768.956848 1170.340576,770.438721 1168.071777,772.357849 
-	C1167.963379,770.172241 1167.940674,768.736755 1167.807373,767.311646 
-	C1167.684448,765.997559 1167.442505,764.694580 1167.131226,762.546814 
-	C1164.254150,766.874817 1164.382690,777.744995 1166.996704,780.862610 
-	C1167.494995,779.163452 1167.920898,777.710999 1168.346680,776.259338 
-	C1169.694824,776.652283 1170.994507,777.031128 1171.634888,777.217773 
-	C1171.978638,775.070679 1172.259155,773.319275 1173.039917,771.033447 
-M260.421204,728.455322 
-	C260.514526,727.005798 260.607819,725.556213 260.699219,724.136169 
-	C262.592377,723.587830 264.179169,723.128174 265.765961,722.668518 
-	C265.714325,722.315430 265.662659,721.962341 265.611023,721.609253 
-	C261.194885,721.609253 256.778748,721.609253 252.362610,721.609253 
-	C251.803696,722.117188 251.244797,722.625122 250.685883,723.133057 
-	C260.059296,722.304260 257.137482,728.043091 257.583405,731.990845 
-	C257.793396,733.849854 258.043823,735.704224 258.275940,737.560730 
-	C258.990631,737.520508 259.705322,737.480286 260.420013,737.440063 
-	C260.420013,734.756042 260.420013,732.072083 260.421204,728.455322 
-M1031.927124,778.090454 
-	C1030.620361,777.389832 1029.313721,776.689270 1028.006958,775.988708 
-	C1027.635742,776.483154 1027.264404,776.977661 1026.893188,777.472168 
-	C1028.447876,778.619751 1030.194824,780.881470 1031.512451,780.654297 
-	C1033.500854,780.311279 1036.439819,778.474121 1036.757080,776.841064 
-	C1037.523438,772.897156 1037.005737,768.703796 1037.005737,764.091919 
-	C1034.968262,764.207703 1033.198486,764.308289 1030.698853,764.450317 
-	C1034.999878,768.395569 1035.494873,773.366211 1031.927124,778.090454 
-M1084.446289,752.088257 
-	C1088.480835,746.969604 1087.402832,740.314636 1082.307495,739.957764 
-	C1080.354614,739.820984 1077.119385,740.953247 1076.522827,742.371399 
-	C1075.559326,744.661865 1075.342407,748.309387 1076.601074,750.176636 
-	C1077.697144,751.802734 1081.269165,751.760071 1084.446289,752.088257 
-M975.546814,100.504112 
-	C975.210205,96.622711 973.854614,93.642982 969.263977,93.827309 
-	C965.595032,93.974648 963.867554,96.354210 963.720520,99.667206 
-	C963.574768,102.952332 964.350464,106.186836 968.308777,106.870979 
-	C972.584167,107.609940 974.861877,105.387413 975.546814,100.504112 
-M1259.604736,162.352661 
-	C1259.038330,158.633972 1260.776123,154.504211 1257.501099,151.150299 
-	C1256.628174,156.057953 1256.576904,160.913803 1256.692139,165.765656 
-	C1256.706787,166.379669 1257.568359,167.468246 1258.081055,167.494766 
-	C1261.212891,167.656921 1264.357300,167.575836 1267.497437,167.575836 
-	C1267.522461,166.947830 1267.547607,166.319839 1267.572632,165.691833 
-	C1266.093506,165.495956 1264.565308,165.467850 1263.150146,165.053467 
-	C1261.919434,164.693115 1260.816772,163.896240 1259.604736,162.352661 
-M931.934814,106.928764 
-	C934.890625,107.179039 937.475708,106.897545 937.814026,103.351692 
-	C935.446472,103.351692 933.130676,103.862694 931.350464,103.108864 
-	C930.602234,102.792023 930.342590,98.588844 930.976440,98.252052 
-	C932.892517,97.234009 935.355103,97.244560 939.073364,96.599373 
-	C936.366882,95.429939 934.195190,93.616547 932.734680,94.074005 
-	C930.747986,94.696205 927.905090,97.084030 927.939697,98.659523 
-	C927.999329,101.371132 929.996704,104.040123 931.934814,106.928764 
-M377.781158,206.521286 
-	C379.936401,207.615311 382.006378,209.157959 384.287140,209.591293 
-	C385.252991,209.774780 386.661621,207.627396 388.489777,205.980042 
-	C384.981750,206.242996 382.545044,207.122391 381.104340,206.286041 
-	C380.161133,205.738495 379.926208,201.471954 380.660370,201.035660 
-	C382.376373,200.015930 384.867554,200.300766 387.274200,200.031631 
-	C387.195557,199.783005 387.136444,198.810211 386.817810,198.716080 
-	C384.747467,198.104538 382.318604,196.791656 380.573822,197.382309 
-	C376.654724,198.709000 376.761963,202.306046 377.781158,206.521286 
-M881.980835,63.039349 
-	C881.133423,63.549934 879.573914,64.030121 879.550659,64.575890 
-	C879.354187,69.178085 879.438599,73.792259 879.438599,78.417809 
-	C883.451294,78.417809 886.877869,78.417809 890.304504,78.417809 
-	C890.270630,77.230408 889.862122,76.922546 889.410278,76.832893 
-	C882.443176,75.450539 882.447144,75.457108 882.425232,68.219444 
-	C882.420715,66.725327 882.361267,65.231377 881.980835,63.039349 
-M300.395294,756.702087 
-	C303.982361,756.332397 302.153900,754.787354 300.878632,753.827942 
-	C297.940186,751.617493 295.205536,752.442749 293.078278,755.100220 
-	C291.005493,757.689697 291.895294,763.379944 294.643097,764.956909 
-	C297.601196,766.654724 300.381805,766.365234 302.305359,763.172729 
-	C302.497772,762.853333 302.283936,762.289124 302.278534,762.192993 
-	C299.886871,762.078369 297.689148,761.973083 295.491425,761.867798 
-	C295.643097,759.817688 295.794800,757.767517 295.946503,755.717468 
-	C297.236084,755.921387 298.525665,756.125366 300.395294,756.702087 
-M1130.145752,638.661194 
-	C1131.907227,639.158264 1133.668701,639.655273 1135.919678,640.290466 
-	C1135.113281,636.496948 1132.825195,635.616150 1130.048462,636.236633 
-	C1126.342163,637.064819 1125.106812,639.870422 1125.599854,643.416687 
-	C1126.045044,646.618042 1127.436646,649.448059 1131.160889,649.074158 
-	C1132.950195,648.894470 1134.589966,647.224548 1136.297485,646.229492 
-	C1135.991333,645.872009 1135.685059,645.514526 1135.378906,645.157043 
-	C1133.469482,645.483032 1131.560059,645.808960 1129.650513,646.135010 
-	C1129.492798,643.950500 1129.329956,641.766235 1129.189941,639.580627 
-	C1129.181519,639.447510 1129.355347,639.302795 1130.145752,638.661194 
-M472.261993,456.497162 
-	C472.261932,457.329712 472.087646,458.209961 472.299530,458.984528 
-	C472.692474,460.420807 473.311005,461.795380 473.835602,463.195648 
-	C474.488434,461.754211 475.616882,460.339142 475.698578,458.865997 
-	C475.889648,455.420959 475.016388,451.702820 479.517853,450.011658 
-	C475.860596,450.011658 472.203308,450.011658 469.070221,450.011658 
-	C470.320038,452.207092 471.290649,453.912109 472.261993,456.497162 
-M1046.850342,401.304657 
-	C1045.435547,401.547699 1044.020752,401.790771 1042.606079,402.033844 
-	C1042.409302,402.436676 1042.212646,402.839539 1042.015869,403.242371 
-	C1047.726562,403.675140 1046.127686,407.522430 1046.479126,410.565643 
-	C1046.675415,412.265656 1047.428833,413.901337 1048.291138,416.759064 
-	C1051.509399,411.139008 1046.401367,404.733795 1053.655029,401.793549 
-	C1051.662354,401.630096 1049.669800,401.466644 1046.850342,401.304657 
-M728.340393,187.454651 
-	C728.365417,186.747864 728.505798,185.445999 728.397949,185.425095 
-	C727.126099,185.178680 725.817139,185.123993 724.518005,185.018845 
-	C725.280884,183.965912 726.122070,184.007645 726.778137,183.679413 
-	C727.821960,183.157150 728.742493,182.388260 729.715149,181.723679 
-	C728.909180,180.579361 728.350464,178.995239 727.249146,178.376022 
-	C724.348511,176.745117 720.726440,179.021454 720.383728,182.423859 
-	C719.995483,186.278824 722.462280,188.089050 728.340393,187.454651 
-M728.448853,727.538208 
-	C727.819702,727.871582 727.190613,728.205017 725.467285,729.118286 
-	C734.758057,730.193604 727.114929,738.671509 732.372070,741.507141 
-	C735.981262,737.774475 729.847351,730.555725 737.991150,728.855652 
-	C737.774170,728.404968 737.557251,727.954285 737.340271,727.503601 
-	C734.637390,727.503601 731.934448,727.503601 728.448853,727.538208 
-M1516.729370,613.013611 
-	C1516.136108,609.372681 1513.844238,608.401978 1510.583618,609.291382 
-	C1509.825562,609.498047 1509.247070,610.363770 1508.258667,611.204712 
-	C1510.047363,611.695374 1511.258667,612.027649 1511.483643,612.089355 
-	C1510.365479,613.938477 1509.321777,615.664612 1508.278076,617.390747 
-	C1510.873169,618.041199 1513.468262,618.691711 1516.491821,619.449646 
-	C1516.616333,616.770142 1516.684326,615.306946 1516.729370,613.013611 
-M715.009644,183.333725 
-	C715.571777,184.819183 716.133911,186.304657 716.696106,187.790115 
-	C717.310120,186.287415 718.020508,184.815750 718.517273,183.275253 
-	C719.428772,180.448364 720.214294,177.580887 721.087769,174.609924 
-	C718.553528,174.609924 714.934570,174.609924 712.252625,174.609924 
-	C713.256775,177.466171 714.132629,179.957596 715.009644,183.333725 
-M476.316742,177.672302 
-	C476.507477,180.333145 476.698181,182.993988 476.888916,185.654816 
-	C481.852661,181.950607 476.218658,174.803894 483.208496,172.488251 
-	C479.706665,172.488251 476.204834,172.488251 472.833588,172.488251 
-	C474.164673,174.140717 475.237000,175.471970 476.316742,177.672302 
-M135.432083,187.114639 
-	C142.082809,184.575317 137.936600,182.262802 134.996658,179.970917 
-	C136.183014,179.530090 137.104492,179.187683 138.025986,178.845276 
-	C137.939545,178.313477 137.853104,177.781677 137.766663,177.249863 
-	C135.836914,177.575500 133.907150,177.901123 131.977386,178.226761 
-	C132.324051,180.073792 132.670731,181.920822 133.124664,184.339325 
-	C133.036743,184.433548 132.271729,185.253494 131.131104,186.476044 
-	C132.778793,186.786804 133.724594,186.965179 135.432083,187.114639 
-M1104.369141,519.270630 
-	C1104.591675,520.862671 1104.814209,522.454651 1105.036743,524.046692 
-	C1105.392456,524.030029 1105.748047,524.013428 1106.103638,523.996765 
-	C1107.304932,519.903442 1108.506226,515.810059 1109.762939,511.528442 
-	C1108.463013,511.592224 1106.601074,511.683594 1104.369507,511.793091 
-	C1104.369507,514.158142 1104.369507,516.269470 1104.369141,519.270630 
-M231.437210,373.572021 
-	C231.573547,375.972839 231.709900,378.373688 231.846252,380.774506 
-	C232.331161,380.770691 232.816071,380.766876 233.300980,380.763092 
-	C234.438202,376.616180 235.575439,372.469238 236.758301,368.155975 
-	C235.544586,368.230225 233.683502,368.344086 231.630753,368.469666 
-	C231.556229,370.077667 231.495651,371.384491 231.437210,373.572021 
-M1128.120605,719.215149 
-	C1129.153809,725.498230 1130.407593,726.305786 1135.195312,723.227356 
-	C1127.465210,722.250427 1133.863159,714.747009 1128.813599,711.298706 
-	C1128.537720,714.091431 1128.327271,716.221558 1128.120605,719.215149 
-M1162.357300,185.738419 
-	C1161.973267,181.574112 1163.971680,176.993011 1160.084717,173.321091 
-	C1159.205933,177.500076 1159.152222,181.627945 1159.324829,185.746338 
-	C1159.336548,186.025375 1161.051025,186.233109 1162.357300,185.738419 
-M1549.346802,196.786301 
-	C1550.270264,194.234238 1551.193726,191.682159 1552.202393,188.894531 
-	C1550.566284,188.894531 1548.562622,188.894531 1546.134644,188.894531 
-	C1546.134644,191.535339 1546.009644,194.006134 1546.170898,196.458099 
-	C1546.323486,198.779068 1547.286377,199.627045 1549.346802,196.786301 
-M1045.062256,480.051178 
-	C1044.982788,485.373474 1044.569214,490.727600 1046.258057,495.935577 
-	C1047.263062,490.443939 1047.272217,484.993866 1047.190063,479.545197 
-	C1047.188477,479.448273 1046.092407,479.367828 1045.062256,480.051178 
-M375.413818,205.919815 
-	C374.889374,202.993866 376.620300,199.625565 373.114960,195.919220 
-	C373.114960,201.284897 373.114960,205.405014 373.114960,209.525116 
-	C373.537384,209.615402 373.959808,209.705688 374.382263,209.795959 
-	C374.725220,208.774887 375.068176,207.753815 375.413818,205.919815 
-M1548.921387,843.801025 
-	C1548.568115,839.644653 1549.893066,835.258667 1547.153320,831.330627 
-	C1546.201294,835.697388 1546.182861,840.026062 1546.308228,844.350464 
-	C1546.311401,844.458862 1547.903809,844.521179 1548.921387,843.801025 
-M1131.446411,424.481445 
-	C1131.373901,424.333527 1131.327759,424.161835 1131.221436,424.044739 
-	C1131.120850,423.933868 1130.865234,423.785217 1130.834106,423.815186 
-	C1128.459717,426.105682 1128.395508,434.936829 1131.570190,438.695679 
-	C1131.570190,433.510193 1131.570190,429.308807 1131.446411,424.481445 
-M85.056633,598.458740 
-	C85.236099,600.625671 85.415565,602.792603 85.595032,604.959534 
-	C88.826248,600.662476 88.559258,593.628845 85.568542,590.372375 
-	C85.366943,593.202393 85.212753,595.366882 85.056633,598.458740 
-M892.021606,75.193611 
-	C892.258545,76.446609 892.495483,77.699615 892.732422,78.952614 
-	C893.231262,78.895706 893.730042,78.838791 894.228882,78.781876 
-	C894.228882,74.584915 894.228882,70.387955 894.228882,66.190994 
-	C893.596741,66.161156 892.964600,66.131325 892.332397,66.101486 
-	C892.228638,68.832970 892.124878,71.564445 892.021606,75.193611 
-M925.297058,94.377136 
-	C922.211487,95.730743 921.773132,103.298920 925.795227,106.898872 
-	C925.795227,102.968399 925.795227,99.037918 925.297058,94.377136 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1591.970825,144.389420 
-	C1591.615356,144.584290 1591.259766,144.779175 1590.401367,144.707153 
-	C1588.600708,144.298752 1587.302734,144.157272 1585.628662,143.994492 
-	C1584.499146,143.990005 1583.745728,144.006821 1582.524414,144.008881 
-	C1544.706909,144.003922 1507.357178,144.013733 1469.607178,143.998718 
-	C1468.137817,143.984268 1467.068970,143.994644 1465.618164,143.981171 
-	C1458.908081,142.440857 1460.353638,136.934433 1460.268677,132.954742 
-	C1459.916748,116.467003 1460.119385,99.967422 1460.119385,83.472191 
-	C1460.119507,63.311352 1460.071289,43.150337 1460.143066,22.989750 
-	C1460.176514,13.592722 1461.763916,12.062988 1470.727295,12.062587 
-	C1508.216431,12.060910 1545.705688,12.061116 1583.194824,12.061690 
-	C1591.139893,12.061812 1592.074951,12.979014 1592.069702,20.934277 
-	C1592.042725,62.085995 1592.004883,103.237709 1591.970825,144.389420 
-M1549.172485,113.768990 
-	C1555.214722,106.241257 1561.183228,98.652519 1567.335449,91.215813 
-	C1569.798584,88.238556 1570.398804,85.176727 1569.494141,81.480721 
-	C1567.278687,72.428894 1565.556152,63.242409 1562.961914,54.305592 
-	C1562.152344,51.516933 1559.676147,48.461216 1557.122437,47.067215 
-	C1548.663696,42.449657 1539.950195,38.224556 1531.051880,34.528961 
-	C1528.202637,33.345661 1524.054565,33.258354 1521.228271,34.427860 
-	C1512.326660,38.111256 1503.649780,42.405014 1495.160034,46.972267 
-	C1492.851807,48.214108 1490.581055,51.000549 1489.893066,53.515759 
-	C1487.349243,62.816608 1485.168701,72.247917 1483.533569,81.747581 
-	C1483.037720,84.628708 1483.902710,88.493057 1485.600464,90.864784 
-	C1491.114380,98.567497 1497.070312,105.994385 1503.369751,113.070183 
-	C1505.326782,115.268448 1508.865356,117.078308 1511.773071,117.225548 
-	C1521.734619,117.729965 1531.743652,117.608292 1541.719727,117.275467 
-	C1544.079102,117.196747 1546.379761,115.361160 1549.172485,113.768990 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M162.954269,85.090546 
-	C169.600494,85.320190 176.245132,85.637657 182.893326,85.757103 
-	C191.089218,85.904358 193.513107,88.254868 193.515427,96.588112 
-	C193.528824,144.919327 193.509827,193.250549 193.524643,241.581757 
-	C193.535782,277.913055 193.576355,314.244385 193.615204,350.575684 
-	C193.623932,358.736572 194.297211,359.362701 202.611053,358.978271 
-	C207.935196,358.732056 213.254288,358.280670 218.579834,358.200745 
-	C221.232437,358.160919 223.808029,358.814392 221.851730,362.922821 
-	C213.963516,362.922821 206.025299,362.875610 198.088135,362.947235 
-	C195.126785,362.973969 193.441711,364.493286 193.529541,367.636108 
-	C193.566772,368.968170 193.521454,370.302368 193.521439,371.635590 
-	C193.521133,413.300446 193.523773,454.965271 193.520798,496.630127 
-	C193.520111,506.388458 191.194977,508.698242 181.407959,508.731323 
-	C175.242325,508.752197 169.076721,508.787354 162.187225,508.763062 
-	C160.941666,508.483459 160.419998,508.256927 159.932098,507.651001 
-	C159.961472,506.510345 159.957047,505.749115 160.323303,504.983276 
-	C161.175354,504.867981 161.656677,504.757202 162.138000,504.646423 
-	C169.779892,504.762939 177.432083,505.120209 185.055069,504.794312 
-	C186.592041,504.728607 188.353851,502.271759 189.375488,500.541534 
-	C190.036545,499.422028 189.559723,497.619202 189.559845,496.122559 
-	C189.563477,454.527313 189.526917,412.931976 189.637222,371.337006 
-	C189.645294,368.294525 190.714890,365.255524 191.282761,362.213379 
-	C191.421906,361.467987 191.717285,360.690918 191.619659,359.972015 
-	C190.983414,355.285858 189.746765,350.621307 189.658691,345.931824 
-	C189.393158,331.794434 189.588486,317.648804 189.551651,303.506500 
-	C189.535095,297.150635 188.245987,295.866180 181.966812,295.862061 
-	C175.979614,295.858124 169.992340,295.954865 163.193970,296.117676 
-	C161.899429,296.158264 161.416016,296.088531 160.965118,295.644348 
-	C161.012512,294.519257 161.027359,293.768646 161.313293,293.039917 
-	C162.053116,292.827881 162.521866,292.593964 162.990601,292.360016 
-	C171.464294,292.360016 179.938004,292.360016 189.038956,292.360016 
-	C189.206085,290.743500 189.539185,289.021088 189.539902,287.298553 
-	C189.566269,223.721161 189.566605,160.143768 189.554550,96.566376 
-	C189.553299,89.976685 188.696976,89.157990 182.022705,89.153648 
-	C176.031876,89.149757 170.041016,89.198837 163.261505,89.171341 
-	C161.993774,89.073524 161.514694,89.028923 161.038483,88.609924 
-	C161.014160,87.487061 160.986984,86.738579 161.229523,85.932388 
-	C161.984253,85.613304 162.469254,85.351921 162.954269,85.090546 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M459.787842,394.833221 
-	C453.510468,396.873413 447.233124,398.913605 440.676971,401.044373 
-	C440.249603,399.113617 439.906677,397.564301 439.480347,395.638000 
-	C426.242950,395.638000 413.114288,395.493927 399.998779,395.843750 
-	C398.565918,395.881989 396.821136,398.576172 395.944244,400.388397 
-	C395.289307,401.742035 395.793121,403.659760 395.793121,405.326324 
-	C395.792023,514.990967 395.792145,624.655640 395.792023,734.320312 
-	C395.792023,735.820251 395.814301,737.320740 395.785309,738.820129 
-	C395.645538,746.054321 392.969574,748.809082 385.749390,748.831970 
-	C368.583221,748.886353 351.416718,748.832886 334.250458,748.872559 
-	C331.955048,748.877869 329.660309,749.171204 327.324493,749.333984 
-	C326.273804,745.465271 326.517426,745.092163 331.266205,745.078247 
-	C346.932434,745.032349 362.598907,745.060547 378.265289,745.059937 
-	C380.598572,745.059814 382.940033,744.931519 385.263428,745.082520 
-	C390.075562,745.395325 391.970459,743.052734 391.679749,738.466003 
-	C391.595612,737.138000 391.667694,735.800171 391.667694,734.466858 
-	C391.667755,625.968872 391.666138,517.470825 391.678162,408.972839 
-	C391.678436,406.476929 391.750244,403.974915 391.932373,401.486237 
-	C392.494141,393.810089 394.780243,391.653412 402.616791,391.605835 
-	C413.616180,391.539001 424.618652,391.701233 435.613800,391.475189 
-	C437.467438,391.437042 439.291016,389.935730 441.128479,389.110474 
-	C441.031799,388.429962 440.935120,387.749451 440.838440,387.068939 
-	C447.312012,389.007202 453.785614,390.945465 460.504883,393.218262 
-	C460.429657,393.979614 460.108734,394.406403 459.787842,394.833221 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M849.036865,640.836792 
-	C875.367554,640.905945 901.698364,640.943359 928.028687,641.083130 
-	C931.462524,641.101318 932.887634,639.450684 933.096191,636.326477 
-	C933.195862,634.832520 933.155151,633.328247 933.153809,631.828613 
-	C933.122192,596.995972 933.081543,562.163391 933.056335,527.330750 
-	C933.049255,517.554626 935.242676,515.403748 945.214111,515.393799 
-	C969.713684,515.369446 994.213379,515.334900 1018.712524,515.426453 
-	C1019.963135,515.431152 1021.209412,516.577759 1022.457703,517.192688 
-	C1021.107422,517.808472 1019.764648,518.938721 1018.405762,518.958374 
-	C1007.907959,519.109863 997.407043,519.047791 986.907104,519.049194 
-	C972.740479,519.051086 958.573853,519.021851 944.407349,519.063721 
-	C937.912659,519.082947 936.881409,520.152527 936.879333,526.645508 
-	C936.867554,563.312012 936.872681,599.978516 936.872070,636.645020 
-	C936.872009,637.608826 936.872070,638.572632 936.872070,640.257935 
-	C939.148254,640.257935 941.084045,640.257874 943.019836,640.257935 
-	C967.686401,640.258484 992.352966,640.230774 1017.019348,640.300903 
-	C1019.664673,640.308411 1023.105225,639.554810 1023.674866,643.856384 
-	C996.533142,643.856384 969.791809,643.855286 943.050476,643.857117 
-	C936.712830,643.857605 936.840637,643.861877 936.851990,650.241516 
-	C936.902771,678.741272 936.869446,707.241211 936.877930,735.741089 
-	C936.880188,743.356567 937.524841,744.000671 945.160095,744.003723 
-	C968.993286,744.013184 992.826599,743.987549 1016.659668,744.032288 
-	C1019.386841,744.037354 1022.880493,743.440186 1022.455017,747.778198 
-	C996.350342,747.778198 970.754700,747.783081 945.159058,747.775696 
-	C935.380005,747.772888 933.049133,745.461182 933.057129,735.730408 
-	C933.079834,708.064392 933.131958,680.398376 933.147888,652.732361 
-	C933.151978,645.692566 932.502625,645.089661 925.412354,645.072388 
-	C900.248047,645.011169 875.083740,644.951294 849.219849,644.662964 
-	C848.692505,643.235596 848.864685,642.036133 849.036865,640.836792 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M1465.765259,360.660675 
-	C1459.046509,362.949066 1452.327759,365.237457 1445.267456,367.642242 
-	C1444.846558,365.525909 1444.535156,363.960358 1444.122192,361.883606 
-	C1442.436890,361.883606 1440.813354,361.883636 1439.189819,361.883636 
-	C1408.695557,361.883667 1378.201172,361.876373 1347.706909,361.889313 
-	C1340.894775,361.892212 1339.878906,362.894409 1339.882324,369.690338 
-	C1339.904785,415.514465 1339.950684,461.338623 1339.980225,507.162750 
-	C1339.986694,517.166260 1338.084717,519.043945 1327.941772,519.046021 
-	C1290.448730,519.053589 1252.955688,519.049255 1215.462646,519.048889 
-	C1214.462891,519.048889 1213.363770,519.305481 1212.487549,518.974670 
-	C1211.310547,518.530334 1210.305542,517.630188 1209.226685,516.925720 
-	C1210.394531,516.402771 1211.561523,515.424805 1212.730347,515.422729 
-	C1251.222778,515.354553 1289.715454,515.383728 1328.208008,515.388123 
-	C1335.347656,515.388916 1336.228027,514.518860 1336.229858,507.316040 
-	C1336.241211,461.324585 1336.234863,415.333160 1336.235962,369.341705 
-	C1336.236206,360.470581 1338.543701,358.138580 1347.509644,358.133057 
-	C1378.170654,358.114075 1408.831665,358.086945 1439.492432,358.183502 
-	C1442.686646,358.193573 1445.091675,357.863159 1445.057007,353.444000 
-	C1452.027100,355.408447 1458.548096,357.246338 1465.406982,359.419128 
-	C1465.730591,360.056763 1465.737427,360.358948 1465.765259,360.660675 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1051.992920,87.031769 
-	C1052.015503,68.371841 1052.027588,49.711906 1052.065186,31.052027 
-	C1052.084839,21.307537 1054.415161,18.996122 1064.162231,18.995167 
-	C1102.482300,18.991409 1140.802490,18.990709 1179.122559,18.997213 
-	C1187.431885,18.998623 1189.929077,21.399012 1189.933960,29.589666 
-	C1189.957153,68.242981 1189.959229,106.896339 1189.930176,145.549637 
-	C1189.924194,153.482742 1187.392334,155.972092 1179.392090,155.976685 
-	C1140.572144,155.998993 1101.752197,155.993149 1062.932251,155.980270 
-	C1055.386841,155.977768 1052.108032,152.702866 1052.080078,144.939453 
-	C1052.019775,128.112137 1052.103271,111.284195 1051.999146,94.457306 
-	C1051.988037,92.663734 1051.122681,90.875465 1050.440552,88.746399 
-	C1050.815918,87.949303 1051.404419,87.490547 1051.992920,87.031769 
-M1108.500000,153.036301 
-	C1132.317261,153.035812 1156.134644,153.046951 1179.951904,153.026443 
-	C1185.745239,153.021454 1186.934570,151.864166 1186.938843,145.963715 
-	C1186.967041,106.989944 1186.967407,68.016136 1186.937500,29.042358 
-	C1186.932983,23.110209 1185.761475,21.967510 1179.978882,21.965298 
-	C1140.671997,21.950251 1101.365112,21.949821 1062.058228,21.965061 
-	C1056.249268,21.967314 1055.071045,23.106806 1055.066406,29.014008 
-	C1055.036499,67.987778 1055.036865,106.961578 1055.066895,145.935349 
-	C1055.071411,151.849030 1056.272949,153.016617 1062.030518,153.026077 
-	C1077.187012,153.050995 1092.343506,153.035675 1108.500000,153.036301 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1465.780518,563.876892 
-	C1465.875366,549.719055 1466.018433,535.561401 1466.053101,521.403442 
-	C1466.100342,502.075653 1466.055908,482.747650 1466.068970,463.419769 
-	C1466.076172,452.879150 1468.008301,450.980927 1478.651489,450.980286 
-	C1516.474121,450.978027 1554.296875,450.977509 1592.119507,450.981262 
-	C1601.513062,450.982178 1603.754761,453.180542 1603.917847,462.785858 
-	C1604.016846,468.615875 1603.936401,474.448914 1603.936401,480.280609 
-	C1603.936523,511.605133 1603.953125,542.929626 1603.902588,574.254089 
-	C1603.898804,576.552002 1603.478027,578.859436 1603.131958,581.144409 
-	C1602.405518,585.942688 1599.167358,587.938660 1594.715332,587.945068 
-	C1554.893188,588.002197 1515.071167,588.006958 1475.249023,587.946289 
-	C1469.750244,587.937927 1466.258057,584.328918 1466.091797,578.830872 
-	C1465.960815,574.502502 1466.039185,570.167725 1465.967285,565.191650 
-	C1465.808716,564.335205 1465.765503,564.111694 1465.780518,563.876892 
-M1480.566650,453.954254 
-	C1479.733887,453.954285 1478.901123,453.953827 1478.068359,453.954468 
-	C1469.520630,453.960724 1469.047974,454.427795 1469.047363,462.989471 
-	C1469.045166,500.796387 1469.037720,538.603271 1469.054810,576.410217 
-	C1469.057983,583.374023 1470.688721,585.014709 1477.464844,585.016052 
-	C1515.937988,585.023560 1554.411133,585.024719 1592.884277,585.014038 
-	C1599.079102,585.012329 1600.923218,583.259277 1600.928833,577.045837 
-	C1600.963257,538.739258 1600.965942,500.432678 1600.930786,462.126129 
-	C1600.924072,454.812897 1599.943848,453.956451 1592.468872,453.955841 
-	C1555.494751,453.952820 1518.520508,453.954285 1480.566650,453.954254 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M161.035629,88.984322 
-	C161.514694,89.028923 161.993774,89.073524 162.809967,89.254791 
-	C163.079071,107.710609 163.002991,126.029732 162.946320,144.348923 
-	C162.916946,153.846268 160.767776,155.984024 151.108017,155.984985 
-	C112.963951,155.988754 74.819885,155.989197 36.675823,155.983932 
-	C28.164078,155.982758 25.961052,153.827240 25.960171,145.514954 
-	C25.956059,106.704613 25.954868,67.894272 25.960230,29.083935 
-	C25.961393,20.653227 27.636093,19.001728 36.289001,18.999170 
-	C75.099342,18.987694 113.909676,18.988924 152.720016,19.000078 
-	C160.314651,19.002262 162.905609,21.535456 162.927521,29.170868 
-	C162.980133,47.493065 162.954559,65.815483 162.957397,84.614182 
-	C162.469254,85.351921 161.984253,85.613304 160.923431,85.648651 
-	C160.225739,83.608719 160.000977,81.794991 159.998001,79.980896 
-	C159.970673,63.323502 160.018784,46.665928 159.964279,30.008671 
-	C159.941040,22.905045 158.920502,21.963636 151.869110,21.962690 
-	C113.223862,21.957497 74.578621,21.953701 35.933376,21.967426 
-	C29.756981,21.969620 28.945374,22.767632 28.943214,28.844110 
-	C28.929363,67.822502 28.930866,106.800903 28.940966,145.779297 
-	C28.942646,152.263046 29.688993,153.023209 36.080292,153.025055 
-	C74.725540,153.036270 113.370789,153.036530 152.016037,153.024887 
-	C158.432587,153.022949 159.970657,151.482956 159.976761,145.088959 
-	C159.992981,128.098389 159.952011,111.107658 160.027924,94.117416 
-	C160.035583,92.404922 160.684372,90.695282 161.035629,88.984322 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1465.406250,563.728394 
-	C1465.765503,564.111694 1465.808716,564.335205 1465.945801,564.717285 
-	C1459.263062,567.235046 1452.544189,569.583130 1445.539185,572.031189 
-	C1445.166504,569.950562 1444.881958,568.362183 1444.482300,566.131042 
-	C1442.669922,566.131042 1440.888062,566.130981 1439.106201,566.130981 
-	C1401.286987,566.130798 1363.467773,566.126709 1325.648560,566.133545 
-	C1317.134888,566.135071 1316.515747,566.752930 1316.522949,575.136292 
-	C1316.539429,594.462036 1316.589355,613.787720 1316.581299,633.113464 
-	C1316.577881,641.218323 1313.931519,643.819397 1305.754883,643.821838 
-	C1261.438110,643.834839 1217.121216,643.829224 1172.804443,643.830017 
-	C1169.529663,643.830078 1166.254761,643.830017 1161.743652,643.830017 
-	C1162.816284,642.565125 1163.518921,641.015442 1164.648560,640.583984 
-	C1166.117920,640.022766 1167.926636,640.302124 1169.589233,640.301819 
-	C1214.405762,640.292908 1259.222412,640.297852 1304.038940,640.291443 
-	C1312.085571,640.290283 1312.644653,639.737000 1312.647339,631.880249 
-	C1312.654053,612.720703 1312.637329,593.561218 1312.653809,574.401672 
-	C1312.661743,565.072449 1314.884155,562.823059 1324.072388,562.820984 
-	C1362.557983,562.812073 1401.043701,562.799927 1439.529297,562.846130 
-	C1442.714478,562.849915 1445.724487,563.022583 1445.399536,558.035889 
-	C1452.277100,559.978027 1458.654541,561.778992 1465.406250,563.728394 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M849.026001,640.380737 
-	C848.864685,642.036133 848.692505,643.235596 848.749390,644.671509 
-	C848.979919,663.895264 848.991760,682.882629 848.977417,701.869934 
-	C848.971924,709.129639 847.100830,711.011047 839.847412,711.013428 
-	C800.873413,711.026428 761.899414,711.021606 722.925415,711.020386 
-	C713.352966,711.020081 712.050293,709.706116 712.022583,700.066406 
-	C712.019714,699.067200 712.004272,698.067932 712.277100,696.403198 
-	C712.362061,694.673340 712.164673,693.609070 711.967285,692.544800 
-	C711.986023,656.885437 712.002991,621.226074 712.024780,585.566711 
-	C712.029785,577.284119 714.355042,574.991638 722.753174,574.986938 
-	C734.417542,574.980530 746.082092,575.022888 757.745972,574.945129 
-	C759.509399,574.933350 761.269287,574.384827 763.564453,573.839783 
-	C764.597778,573.576965 765.097412,573.558960 765.597046,573.540955 
-	C767.594360,574.022461 769.589966,574.914001 771.589294,574.922668 
-	C794.365723,575.021240 817.142822,574.977173 839.919678,574.990295 
-	C846.168823,574.993896 848.946472,577.717896 848.965942,584.063477 
-	C849.023010,602.683777 849.004272,621.304260 849.026001,640.380737 
-M844.386536,708.019165 
-	C844.932373,705.855713 845.948914,703.693420 845.954224,701.528625 
-	C846.050110,662.539001 846.027039,623.549011 846.020569,584.559143 
-	C846.019531,578.042847 845.040466,577.017151 838.533142,577.013916 
-	C799.876526,576.994690 761.219849,576.995361 722.563232,577.012573 
-	C715.973450,577.015564 714.983032,578.025391 714.982239,584.456421 
-	C714.977295,623.446289 714.977417,662.436157 714.982727,701.426025 
-	C714.983704,708.493774 715.513062,709.012085 722.768860,709.013184 
-	C761.258850,709.018921 799.748901,709.022034 838.238892,708.994995 
-	C840.048950,708.993713 841.858826,708.696228 844.386536,708.019165 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1189.038818,282.233521 
-	C1189.019409,312.707916 1189.003784,343.182281 1188.977905,373.656677 
-	C1188.971069,381.731201 1186.701782,384.004791 1178.682983,384.005341 
-	C1139.548950,384.008026 1100.414795,384.009827 1061.280762,384.002960 
-	C1054.712280,384.001801 1052.041138,381.337158 1052.026367,374.621582 
-	C1051.985474,355.970581 1051.999634,337.319397 1052.125977,317.919952 
-	C1052.176636,316.061554 1052.093384,314.951508 1052.010010,313.841461 
-	C1052.011597,295.183777 1052.000488,276.526093 1052.021118,257.868408 
-	C1052.029175,250.568970 1054.613037,247.988266 1061.939331,247.985809 
-	C1101.253784,247.972641 1140.568359,247.974884 1179.882812,247.985703 
-	C1186.169678,247.987427 1188.907349,250.701233 1188.967773,257.046265 
-	C1189.031372,263.709167 1188.993774,270.373016 1188.876099,277.810364 
-	C1188.847534,279.800659 1188.943237,281.017090 1189.038818,282.233521 
-M1054.980469,298.500000 
-	C1054.980957,324.162323 1055.028564,349.824829 1054.935303,375.486786 
-	C1054.919922,379.730194 1056.118530,382.050018 1060.844849,382.040955 
-	C1100.671143,381.964569 1140.497925,381.979065 1180.324463,382.021240 
-	C1184.309692,382.025482 1186.050415,380.347046 1186.045288,376.316620 
-	C1185.994141,336.156830 1185.994751,295.996918 1186.045532,255.837143 
-	C1186.050537,251.923996 1184.598022,249.975052 1180.491211,249.979630 
-	C1140.831299,250.023849 1101.171265,249.984924 1061.511353,250.030670 
-	C1056.080933,250.036926 1054.992798,251.330856 1054.986084,257.006866 
-	C1054.970337,270.504578 1054.980713,284.002289 1054.980469,298.500000 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M1465.640137,746.519897 
-	C1459.055176,748.776306 1452.470215,751.032654 1445.521606,753.413635 
-	C1444.967285,751.434509 1444.542236,749.917358 1444.049316,748.157227 
-	C1372.556763,748.157227 1301.011597,748.157227 1227.946411,748.157227 
-	C1229.261963,746.438782 1229.994141,744.589661 1231.288696,744.020874 
-	C1232.845337,743.337219 1234.880249,743.685303 1236.708130,743.685059 
-	C1304.020020,743.675110 1371.331787,743.679321 1438.643677,743.667908 
-	C1441.559082,743.667358 1445.100342,744.683594 1445.001465,739.246033 
-	C1452.132812,741.249695 1458.658936,743.083313 1465.511963,745.250061 
-	C1465.754883,745.891602 1465.688599,746.203918 1465.640137,746.519897 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M460.200653,394.946045 
-	C460.108734,394.406403 460.429657,393.979614 460.863403,393.309143 
-	C461.314148,389.005951 461.813812,384.951752 461.948914,380.885437 
-	C462.118591,375.779816 462.083618,370.661499 461.930511,365.554810 
-	C461.886261,364.078522 461.132507,362.623505 460.372742,360.733948 
-	C460.011169,359.884705 459.980865,359.460236 459.950562,359.035767 
-	C460.630005,357.580872 461.872681,356.135651 461.897827,354.669556 
-	C462.066162,344.855377 461.975159,335.036804 462.197998,324.632812 
-	C462.611053,324.021088 462.794464,323.996185 463.283417,324.261261 
-	C463.725555,326.360748 463.979675,328.170105 463.981232,329.979675 
-	C464.006226,359.452850 463.987854,388.926025 464.007904,418.399200 
-	C464.012604,425.288605 465.288574,426.991547 470.755646,426.997223 
-	C510.219666,427.038300 549.683777,427.035858 589.147888,427.000275 
-	C594.402039,426.995514 595.924805,425.386810 595.990540,420.106659 
-	C596.054810,414.945496 596.008057,409.782959 596.008057,404.621002 
-	C596.008118,370.651917 596.015564,336.682831 595.999817,302.713745 
-	C595.997009,296.695190 594.314331,295.018829 588.308716,295.017059 
-	C549.344177,295.005585 510.379639,295.003052 471.415100,295.022186 
-	C465.745239,295.024963 464.049805,296.776855 464.006958,302.494263 
-	C463.974518,306.823395 464.098053,311.156433 463.946442,315.480530 
-	C463.892303,317.024170 463.233795,318.546600 462.616943,320.080383 
-	C462.382782,320.082031 461.964325,319.871643 461.964325,319.871643 
-	C461.974335,313.375366 461.904572,306.877655 462.019806,300.383240 
-	C462.110107,295.294189 464.283051,293.026031 469.384644,293.019043 
-	C509.861694,292.963593 550.338928,292.960541 590.815918,293.025269 
-	C595.974854,293.033539 597.785339,295.264343 598.057129,300.411774 
-	C598.311951,305.236816 598.880981,310.045258 599.643738,315.173889 
-	C599.816467,315.876282 599.657227,316.265869 599.497986,316.655426 
-	C599.010315,318.140656 598.085876,319.630280 598.100769,321.110443 
-	C598.314026,342.339630 598.764465,363.566772 598.905334,384.796112 
-	C598.956909,392.564423 598.346497,400.337128 598.010498,408.957764 
-	C597.994446,410.872955 598.005859,411.938263 598.017334,413.003540 
-	C598.017761,415.834076 598.048462,418.665009 598.012329,421.495056 
-	C597.943909,426.849579 595.947449,428.851135 590.423218,429.003021 
-	C587.261902,429.089966 584.096436,429.029266 580.932800,429.029175 
-	C544.134705,429.028351 507.336639,429.032135 470.538544,429.019531 
-	C463.821075,429.017242 462.034973,427.224792 461.998322,420.450317 
-	C461.960541,413.457214 462.067261,406.462189 461.927124,399.471710 
-	C461.897461,397.992584 461.072144,396.529419 460.200653,394.946045 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1466.079590,360.983704 
-	C1465.737427,360.358948 1465.730591,360.056763 1465.763672,359.529175 
-	C1466.176147,357.257202 1466.907959,355.210907 1466.912476,353.162994 
-	C1466.984985,320.689911 1466.960327,288.216614 1466.968262,255.743362 
-	C1466.970093,248.729538 1468.729614,246.947830 1475.838013,246.944595 
-	C1515.305542,246.926651 1554.772949,246.927200 1594.240479,246.947510 
-	C1600.871582,246.950928 1603.023193,249.005493 1603.028442,255.487549 
-	C1603.060913,295.121552 1603.060791,334.755554 1603.031982,374.389587 
-	C1603.027222,380.934174 1600.911011,383.040649 1594.335083,383.045441 
-	C1554.701050,383.074402 1515.067017,383.073425 1475.432983,383.043396 
-	C1469.135864,383.038635 1467.110962,380.901001 1466.951050,374.688568 
-	C1466.836060,370.226135 1466.584473,365.767181 1466.079590,360.983704 
-M1494.500122,380.972015 
-	C1526.498413,380.971954 1558.496704,380.973145 1590.494995,380.971130 
-	C1599.675293,380.970520 1600.964233,379.718628 1600.968262,370.750519 
-	C1600.976440,352.751465 1600.972656,334.752441 1600.972412,316.753387 
-	C1600.972168,296.921112 1600.989868,277.088776 1600.957397,257.256561 
-	C1600.947510,251.232986 1599.184204,249.050430 1594.162598,249.045792 
-	C1554.664673,249.009247 1515.166748,249.030594 1475.668823,249.018265 
-	C1471.117065,249.016830 1469.005981,251.217392 1469.009277,255.770538 
-	C1469.038086,294.935120 1469.007935,334.099762 1469.044922,373.264282 
-	C1469.050293,379.002625 1471.091309,380.898804 1477.001221,380.958832 
-	C1482.500366,381.014709 1488.000488,380.971527 1494.500122,380.972015 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M837.018005,89.007462 
-	C837.016479,107.990120 837.019958,126.972771 837.010803,145.955429 
-	C837.007202,153.397598 834.483948,155.942017 826.805420,155.965805 
-	C809.987488,156.017914 793.169312,155.982361 776.351196,155.982422 
-	C755.037170,155.982513 733.723083,155.989594 712.409058,155.979019 
-	C703.114075,155.974411 700.980225,153.853104 700.979736,144.677307 
-	C700.977905,106.045624 700.976624,67.413948 700.983154,28.782267 
-	C700.984314,21.793966 703.440796,19.067171 710.438293,19.054363 
-	C749.735901,18.982439 789.033752,18.997108 828.331482,19.043274 
-	C834.305237,19.050291 836.995728,21.944551 837.007568,27.989855 
-	C837.044434,46.805767 837.054749,65.621727 837.113647,85.287308 
-	C837.107300,87.093781 837.062622,88.050621 837.018005,89.007462 
-M835.000000,62.500000 
-	C835.000000,51.838722 835.005188,41.177441 834.998291,30.516169 
-	C834.993286,22.768200 833.312683,21.023987 825.766357,21.022299 
-	C787.951965,21.013836 750.137573,21.014309 712.323181,21.021654 
-	C704.707703,21.023134 702.996155,22.753660 702.995117,30.422295 
-	C702.989807,68.236687 702.991699,106.051086 702.993469,143.865479 
-	C702.993835,152.309525 704.385498,153.914017 712.747498,153.928787 
-	C750.561768,153.995605 788.376282,153.983536 826.190613,153.936798 
-	C833.246765,153.928070 834.992981,152.034882 834.995728,144.959152 
-	C835.006226,117.806099 835.000000,90.653053 835.000000,62.500000 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M530.000000,19.016716 
-	C549.316223,19.016920 568.132446,19.004068 586.948669,19.023001 
-	C595.835571,19.031942 598.025024,21.257130 598.025513,30.169094 
-	C598.027649,68.800644 598.028748,107.432190 598.022766,146.063736 
-	C598.021667,153.119003 595.587830,155.927017 588.703918,155.941132 
-	C549.572937,156.021362 510.441681,156.020676 471.310760,155.941376 
-	C464.417908,155.927414 461.992065,153.127808 461.991394,146.069824 
-	C461.987640,106.938988 461.987457,67.808151 461.991913,28.677319 
-	C461.992706,21.618843 464.570312,19.059391 472.052063,19.037035 
-	C491.201202,18.979811 510.350677,19.017164 530.000000,19.016716 
-M464.000641,28.884155 
-	C464.000488,67.695747 463.992401,106.507347 464.007751,145.318939 
-	C464.010406,152.020294 465.924469,153.925110 472.585144,153.951706 
-	C479.914246,153.980972 487.243591,153.959015 494.572815,153.959000 
-	C525.555481,153.958893 556.538208,153.969025 587.520874,153.949799 
-	C593.819153,153.945892 595.986755,152.161713 595.990417,146.880737 
-	C596.017639,107.569397 596.021606,68.258011 595.990112,28.946672 
-	C595.985474,23.167023 593.908508,21.044756 588.201599,21.039339 
-	C549.389954,21.002491 510.578308,21.032942 471.766663,21.003138 
-	C466.982727,20.999464 464.151306,22.943775 464.000641,28.884155 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1592.313965,144.186615 
-	C1592.004883,103.237709 1592.042725,62.085995 1592.069702,20.934277 
-	C1592.074951,12.979014 1591.139893,12.061812 1583.194824,12.061690 
-	C1545.705688,12.061116 1508.216431,12.060910 1470.727295,12.062587 
-	C1461.763916,12.062988 1460.176514,13.592722 1460.143066,22.989750 
-	C1460.071289,43.150337 1460.119507,63.311352 1460.119385,83.472191 
-	C1460.119385,99.967422 1459.916748,116.467003 1460.268677,132.954742 
-	C1460.353638,136.934433 1458.908081,142.440857 1465.619995,144.322769 
-	C1466.001709,145.144363 1466.000000,145.600479 1465.998169,146.056610 
-	C1459.248291,144.966980 1458.088379,143.767303 1458.064087,137.058929 
-	C1458.004517,120.621719 1458.062134,104.184105 1458.021851,87.746773 
-	C1458.017456,85.954750 1457.680298,84.163544 1457.165771,81.926407 
-	C1456.834229,81.480858 1456.846313,81.150002 1456.846313,81.149994 
-	C1457.246338,79.275185 1457.984985,77.401985 1457.993896,75.525307 
-	C1458.080811,57.210808 1458.039917,38.895718 1458.048462,20.580799 
-	C1458.052734,11.573625 1459.598145,9.970731 1468.333496,9.968872 
-	C1507.294312,9.960579 1546.255127,9.960282 1585.215942,9.970057 
-	C1592.521606,9.971891 1594.937866,12.424071 1594.940308,19.892769 
-	C1594.953613,58.853596 1594.985596,97.814583 1594.846436,136.774918 
-	C1594.837891,139.180450 1593.419434,141.580948 1592.313965,144.186615 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1456.542480,80.980728 
-	C1456.846313,81.150002 1456.834229,81.480858 1456.827759,81.646027 
-	C1450.271729,84.086113 1443.722290,86.361038 1436.827148,88.755997 
-	C1436.511353,86.622017 1436.276855,85.037498 1436.048706,83.496201 
-	C1428.461060,82.163780 1426.915405,83.411705 1426.913330,90.837013 
-	C1426.905029,120.976204 1426.916138,151.115402 1426.907959,181.254593 
-	C1426.905396,190.783722 1424.730347,192.922058 1415.122559,192.924988 
-	C1408.295410,192.927063 1401.466064,193.010620 1394.643555,192.831696 
-	C1393.530029,192.802475 1392.447144,191.600632 1391.349976,190.940811 
-	C1392.510376,190.425293 1393.662720,189.486160 1394.832520,189.464050 
-	C1401.656616,189.335129 1408.484985,189.450378 1415.311646,189.426468 
-	C1422.202881,189.402328 1423.135620,188.488083 1423.139648,181.648636 
-	C1423.157104,152.342026 1423.147827,123.035400 1423.148315,93.728783 
-	C1423.148438,80.899727 1423.366943,80.638008 1435.931641,78.773140 
-	C1436.220947,77.342926 1436.533325,75.798714 1437.030273,73.341965 
-	C1443.689697,75.931564 1449.964111,78.371506 1456.542480,80.980728 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1548.586548,175.687500 
-	C1544.555420,175.870956 1540.436646,176.588852 1536.540649,175.949173 
-	C1535.169678,175.724075 1534.344849,172.172821 1533.244019,170.089996 
-	C1531.763184,170.755493 1529.622192,171.717606 1526.715332,173.023926 
-	C1528.695923,173.437347 1530.197388,173.750793 1531.698975,174.064240 
-	C1531.705200,174.478165 1531.711548,174.892075 1531.717773,175.305984 
-	C1527.918579,175.305984 1524.119263,175.305984 1519.592041,175.305984 
-	C1519.342407,173.880356 1518.925293,171.498123 1518.508179,169.115906 
-	C1518.153320,169.104965 1517.798462,169.094025 1517.443481,169.083084 
-	C1516.694702,171.618942 1515.945923,174.154785 1515.197144,176.690628 
-	C1514.595703,176.572937 1513.994263,176.455231 1513.392700,176.337540 
-	C1513.197021,173.796539 1513.001221,171.255539 1512.807129,168.736053 
-	C1506.526245,168.081131 1510.188232,174.504883 1506.664429,176.841583 
-	C1505.924316,175.107101 1505.293091,173.627975 1504.510742,171.794769 
-	C1502.655884,171.904251 1500.656006,172.022308 1498.656006,172.140350 
-	C1498.630493,172.448624 1498.604980,172.756912 1498.579468,173.065186 
-	C1499.390991,173.283218 1500.191895,173.565979 1501.016968,173.701538 
-	C1501.882446,173.843719 1502.771240,173.844711 1503.905396,175.045868 
-	C1502.675049,175.492081 1501.332764,176.510147 1500.231934,176.294739 
-	C1490.740967,174.437943 1481.260620,177.076599 1471.849121,176.147491 
-	C1469.572144,175.922699 1467.557007,173.043594 1465.166626,171.187088 
-	C1464.999512,172.449203 1465.006836,173.598404 1464.654175,174.623840 
-	C1464.429443,175.276871 1463.671021,175.746384 1463.151855,176.298218 
-	C1462.557495,175.642609 1461.501221,175.021179 1461.449707,174.325333 
-	C1461.241089,171.508606 1461.169189,168.654282 1461.408691,165.844635 
-	C1461.511108,164.641006 1462.498535,163.512756 1463.083862,162.350281 
-	C1463.666382,163.356537 1464.265259,164.353897 1464.823242,165.373550 
-	C1465.039062,165.767761 1465.162231,166.212662 1465.396362,166.810135 
-	C1467.582031,165.106781 1469.643555,163.500046 1471.705200,161.893326 
-	C1472.060303,162.228073 1472.415405,162.562836 1472.770508,162.897583 
-	C1471.484375,164.835022 1470.198242,166.772446 1468.710205,169.014145 
-	C1470.137329,170.919022 1471.589722,172.857437 1473.743408,175.731903 
-	C1474.078613,171.921066 1474.320923,169.167465 1474.563110,166.413849 
-	C1475.096069,166.294449 1475.628906,166.175064 1476.161865,166.055664 
-	C1476.898926,168.370667 1477.636108,170.685669 1478.373291,173.000671 
-	C1478.713135,173.061615 1479.052856,173.122574 1479.392700,173.183517 
-	C1479.817261,171.005417 1480.241821,168.827316 1480.723633,166.355408 
-	C1482.026489,166.587936 1483.237549,166.804047 1484.450073,167.020432 
-	C1484.932373,165.279266 1485.386841,163.638992 1485.757812,162.300156 
-	C1488.905029,164.583237 1491.762451,166.656097 1494.766479,168.835281 
-	C1497.950806,165.743637 1501.247070,164.699142 1504.529785,168.645828 
-	C1507.279541,165.527786 1518.357422,165.309250 1521.651123,167.365784 
-	C1525.607178,167.128052 1528.279785,167.238144 1530.825684,166.722778 
-	C1532.632446,166.357025 1534.268188,165.146988 1536.488281,164.066574 
-	C1538.278320,166.300278 1540.896729,168.446396 1544.978516,166.265076 
-	C1545.735718,165.860382 1547.329956,167.022171 1548.789307,168.131958 
-	C1547.477905,170.310776 1545.915161,171.818680 1544.605835,173.082092 
-	C1545.820923,173.877411 1547.203735,174.782471 1548.586548,175.687500 
-M1538.517456,169.007751 
-	C1538.390869,170.584412 1538.264160,172.161087 1538.137573,173.737747 
-	C1538.819092,173.711426 1539.500610,173.685089 1540.182129,173.658768 
-	C1539.923218,172.094284 1539.664307,170.529816 1538.517456,169.007751 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M160.932587,296.018799 
-	C161.416016,296.088531 161.899429,296.158264 162.750076,296.252991 
-	C163.059158,314.941101 162.799713,333.606659 163.020355,352.266510 
-	C163.147461,363.017303 157.649063,363.386475 150.169525,363.528290 
-	C148.027390,363.568939 145.878113,363.084686 143.731918,363.082916 
-	C107.734352,363.053497 71.736755,363.064148 35.739170,363.061584 
-	C27.802551,363.061005 25.964338,361.278687 25.962690,353.496979 
-	C25.954401,314.332947 25.987167,275.168823 25.919899,236.004913 
-	C25.912687,231.806244 26.591526,228.365784 31.651434,227.465729 
-	C31.996967,228.172287 32.002541,228.646317 31.773369,229.385422 
-	C27.394278,232.485245 28.164829,237.001190 28.148598,240.917908 
-	C28.003021,276.048950 28.047476,311.180847 28.096031,346.312408 
-	C28.099669,348.945526 28.861095,351.589844 28.756420,354.208405 
-	C28.522665,360.056061 31.906908,361.000854 36.724880,360.991425 
-	C74.853371,360.916718 112.982079,360.955963 151.110718,360.944489 
-	C158.220032,360.942352 159.968018,359.203674 159.974960,352.151917 
-	C159.991714,335.168854 159.952377,318.185669 160.021072,301.202911 
-	C160.028061,299.473633 160.614853,297.746765 160.932587,296.018799 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M161.811508,749.786926 
-	C161.856201,768.096313 162.003983,786.406311 161.898422,804.714844 
-	C161.851578,812.841309 159.375595,815.056458 151.357788,815.058167 
-	C112.405731,815.066650 73.453682,815.066833 34.501625,815.056213 
-	C26.886936,815.054199 24.968756,813.190918 24.968929,805.768066 
-	C24.969860,765.817383 24.989288,725.866760 25.367790,685.451904 
-	C26.397072,684.975464 27.060892,684.963257 27.803452,685.383972 
-	C27.608028,696.446716 27.060894,707.077820 27.111935,717.706116 
-	C27.253418,747.166748 27.596657,776.626770 27.975441,806.085571 
-	C28.053234,812.135620 29.129232,812.940063 35.632195,812.943176 
-	C73.790382,812.961365 111.948593,812.959839 150.106796,812.946106 
-	C157.176849,812.943542 158.962463,811.158752 158.972153,804.114746 
-	C158.994598,787.785034 158.950287,771.455200 159.027969,755.125854 
-	C159.036118,753.411194 159.678284,751.699646 160.320953,749.929932 
-	C161.014252,749.844421 161.412872,749.815674 161.811508,749.786926 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M391.058411,85.592384 
-	C407.503662,85.592827 423.458710,85.592827 439.547974,85.592827 
-	C439.963074,83.548073 440.279999,81.986969 440.718781,79.825539 
-	C447.533691,82.267746 454.035187,84.597626 460.536682,86.927505 
-	C460.549225,87.325356 460.561798,87.723206 460.574371,88.121056 
-	C454.178772,89.980072 447.783173,91.839088 440.933289,93.830147 
-	C440.475983,89.295502 437.444550,89.265221 433.953735,89.294273 
-	C417.957306,89.427399 401.959137,89.344551 385.961609,89.356201 
-	C378.647034,89.361526 377.836700,90.143318 377.828613,97.270493 
-	C377.814087,110.101814 377.781525,122.933556 377.874939,135.764252 
-	C377.897186,138.817245 377.495331,140.776352 374.162262,139.348770 
-	C374.162262,125.072456 374.156708,111.115509 374.164215,97.158554 
-	C374.169281,87.778893 376.277191,85.648628 385.568878,85.594566 
-	C387.235260,85.584869 388.901733,85.592369 391.058411,85.592384 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1536.659180,410.105225 
-	C1536.485718,411.899231 1536.331543,413.286835 1536.177490,414.674469 
-	C1535.498535,415.128784 1534.819580,415.583069 1534.140625,416.037384 
-	C1533.478638,414.860535 1532.816650,413.683716 1532.119751,412.444885 
-	C1529.680298,414.022400 1526.937500,415.796051 1523.626465,417.937256 
-	C1523.626465,413.566254 1523.626465,409.428070 1523.626465,404.264954 
-	C1526.386108,404.962860 1529.146973,405.900726 1531.982056,406.271149 
-	C1533.284180,406.441254 1534.715698,405.187256 1536.116211,405.114716 
-	C1541.350342,404.843689 1546.605225,404.576416 1551.831421,404.797882 
-	C1553.348511,404.862152 1554.796265,406.563385 1556.159058,407.439240 
-	C1557.043091,406.822510 1559.112305,405.378937 1561.799927,403.503906 
-	C1561.892944,403.251465 1562.366455,401.964935 1562.839966,400.678406 
-	C1563.192871,401.787689 1563.528442,402.902863 1563.903198,404.004730 
-	C1564.319214,405.228394 1564.770996,406.439911 1565.252808,407.783661 
-	C1568.189087,405.436554 1570.933838,403.242523 1574.284058,400.564545 
-	C1574.853760,402.124695 1575.553467,404.041016 1576.255249,405.962921 
-	C1583.661133,403.717865 1584.012817,403.829193 1585.683228,409.380005 
-	C1583.848267,409.797455 1582.041016,410.208588 1580.233765,410.619690 
-	C1580.212280,410.965179 1580.190796,411.310638 1580.169312,411.656128 
-	C1582.216797,411.851501 1584.264160,412.046875 1586.656494,412.275146 
-	C1586.853271,409.662384 1587.024170,407.394745 1587.206177,404.977966 
-	C1591.800293,404.977966 1596.188232,404.977966 1600.576172,404.977966 
-	C1600.654541,405.291077 1600.732788,405.604187 1600.811157,405.917297 
-	C1599.992920,406.472961 1599.174683,407.028595 1598.242432,407.661682 
-	C1599.464722,409.503082 1604.067627,410.865784 1599.929077,413.900269 
-	C1598.670166,414.823334 1596.316406,414.253265 1594.464111,414.367065 
-	C1594.421021,413.853577 1594.377808,413.340118 1594.334717,412.826630 
-	C1595.329712,412.503784 1596.324707,412.180939 1597.140259,411.916382 
-	C1595.522705,410.661163 1593.825684,409.344208 1591.474121,407.519287 
-	C1590.884521,409.130402 1589.984497,411.589752 1589.272339,413.535858 
-	C1580.303589,413.535858 1571.203857,413.535858 1561.667236,413.535858 
-	C1561.434082,411.247162 1561.200317,408.951477 1560.817383,405.192139 
-	C1559.538818,408.135284 1558.947876,409.817780 1558.095459,411.355469 
-	C1557.419067,412.575409 1556.422974,413.618103 1555.568726,414.739471 
-	C1554.632080,413.701416 1553.625000,412.716492 1552.786011,411.604736 
-	C1552.308350,410.971771 1552.105225,410.131500 1552.253296,410.470093 
-	C1549.561279,411.940033 1546.802490,414.682983 1544.516602,414.333466 
-	C1542.394897,414.009003 1540.777954,410.383240 1538.472290,407.660126 
-	C1538.301147,407.854706 1537.489868,408.776764 1536.659180,410.105225 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M524.452881,507.210754 
-	C526.216980,502.360596 527.850159,497.877106 529.483337,493.393646 
-	C529.914612,493.367920 530.345886,493.342194 530.777161,493.316467 
-	C532.685852,499.843750 534.594543,506.371033 536.598694,513.224792 
-	C534.889771,513.683350 533.538757,514.045898 531.737610,514.529236 
-	C531.737610,516.450134 531.737549,518.416748 531.737610,520.383423 
-	C531.738220,554.683960 531.747986,588.984497 531.718201,623.285034 
-	C531.716248,625.517761 532.553894,628.732971 528.112915,627.536316 
-	C528.112915,589.818848 528.112915,552.255432 528.112915,514.360779 
-	C526.273926,514.077087 524.557495,513.812256 522.467346,513.489807 
-	C523.146729,511.323944 523.734314,509.450684 524.452881,507.210754 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1051.612305,313.964050 
-	C1052.093384,314.951508 1052.176636,316.061554 1052.107666,317.432373 
-	C984.332520,317.664764 916.709778,317.642914 849.086975,317.582245 
-	C846.607483,317.580017 844.128357,317.197571 841.649048,316.992310 
-	C841.645874,316.357697 841.642700,315.723083 841.639465,315.088470 
-	C843.235168,314.952850 844.830811,314.699066 846.426575,314.698578 
-	C912.551331,314.678864 978.676025,314.687500 1044.800781,314.657074 
-	C1046.938843,314.656067 1049.076782,314.285126 1051.612305,313.964050 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M126.538193,385.028168 
-	C131.903259,385.400177 136.887512,386.007751 141.889908,386.351746 
-	C142.950485,386.424652 144.045578,385.295868 145.181015,385.145569 
-	C146.842804,384.925537 148.555344,385.088928 149.918182,385.088928 
-	C148.453094,388.217346 147.114151,391.076385 145.516327,394.488251 
-	C141.853073,394.310669 137.433197,394.096405 131.809845,393.823822 
-	C130.664490,393.998688 128.176376,394.378632 125.688248,394.758545 
-	C125.560349,394.229736 125.432442,393.700928 125.304543,393.172119 
-	C126.329659,392.722626 127.354774,392.273132 128.683502,391.690521 
-	C127.261887,390.563141 125.921539,389.500244 124.468155,388.347656 
-	C123.344391,390.651855 122.257935,392.879547 120.755615,395.959930 
-	C119.243172,393.822113 118.349289,392.558655 117.459091,391.294525 
-	C113.915459,396.195831 113.915459,396.195831 110.695129,389.910736 
-	C108.732353,391.518555 106.326752,394.864166 104.669563,394.527344 
-	C102.125748,394.010345 100.096642,390.960846 97.054230,388.287598 
-	C96.830406,388.882935 96.308205,390.290863 95.771477,391.693237 
-	C95.385895,392.700684 94.980850,393.700653 94.584488,394.703979 
-	C93.582672,394.073944 92.580849,393.443909 91.949181,393.046661 
-	C88.942490,393.773010 85.946503,394.496796 82.743484,395.270599 
-	C82.743484,389.726105 82.743484,385.064697 82.743484,380.779053 
-	C85.530312,382.578339 87.835205,384.187439 90.273567,385.559296 
-	C90.917946,385.921844 91.973587,385.538177 92.840866,385.522217 
-	C99.248947,385.404236 105.658325,385.205200 112.063782,385.291901 
-	C112.846657,385.302490 113.608643,386.856628 114.380417,387.695312 
-	C117.461021,383.908142 117.744804,383.937012 119.794151,387.502899 
-	C122.063568,386.671631 124.113716,385.920685 126.538193,385.028168 
-M142.621124,390.134918 
-	C140.895248,390.381348 139.169357,390.627777 137.443481,390.874176 
-	C137.577118,391.443756 137.710754,392.013336 137.844391,392.582916 
-	C139.589218,391.999969 141.334045,391.417053 142.621124,390.134918 
-M131.937775,389.672424 
-	C132.273849,388.969055 132.609940,388.265686 132.945999,387.562347 
-	C131.779358,387.418488 130.612732,387.274628 129.446106,387.130768 
-	C129.406143,387.447418 129.366196,387.764038 129.326248,388.080688 
-	C129.972702,388.499451 130.619171,388.918243 131.937775,389.672424 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M462.977875,323.971252 
-	C462.794464,323.996185 462.611053,324.021088 462.186737,324.184570 
-	C437.656433,324.228516 413.367096,324.114990 389.077637,324.046509 
-	C375.019257,324.006866 374.162048,323.176819 374.162262,309.029358 
-	C374.162476,295.909943 374.162323,282.790558 374.162323,269.158295 
-	C376.830231,267.713257 377.918152,268.719025 377.891235,272.261719 
-	C377.788940,285.739319 377.810059,299.218079 377.835236,312.696289 
-	C377.847870,319.464905 378.846741,320.427063 385.688812,320.430878 
-	C408.984894,320.443909 432.280975,320.445343 455.577026,320.418060 
-	C457.397888,320.415924 459.218414,320.157257 461.501709,319.944733 
-	C461.964325,319.871643 462.382782,320.082031 462.680664,320.465515 
-	C462.978363,321.889740 462.978119,322.930511 462.977875,323.971252 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1189.450928,282.135315 
-	C1188.943237,281.017090 1188.847534,279.800659 1188.875244,278.277130 
-	C1195.990112,277.802032 1202.982056,277.644379 1209.973267,277.463043 
-	C1216.456055,277.294861 1217.345825,276.399200 1217.341431,269.728943 
-	C1217.326904,248.069305 1217.260620,226.409714 1217.244751,204.750076 
-	C1217.238525,196.216187 1219.777100,193.678024 1228.178467,193.596298 
-	C1234.670898,193.533142 1241.163940,193.364441 1247.654663,193.434525 
-	C1248.600098,193.444717 1249.534058,194.524261 1250.473267,195.108978 
-	C1249.446655,195.788269 1248.435913,197.025131 1247.390869,197.054779 
-	C1241.398438,197.224823 1235.397705,197.070511 1229.400024,197.098694 
-	C1222.053101,197.133194 1220.943115,198.232025 1220.938721,205.434677 
-	C1220.925659,227.094925 1220.940918,248.755157 1220.933594,270.415405 
-	C1220.930664,278.776520 1218.697021,280.842010 1210.184448,281.042053 
-	C1203.406738,281.201294 1196.636597,281.692993 1189.450928,282.135315 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M313.060364,197.555511 
-	C319.742462,195.458771 317.753662,202.379929 320.951599,204.968506 
-	C321.223907,195.296310 328.608612,197.042084 334.221283,197.056427 
-	C336.020935,197.061020 337.811035,200.800446 340.041504,203.324539 
-	C340.382660,203.165161 341.632904,202.581055 342.767426,202.051025 
-	C342.053375,200.876404 341.462250,199.904022 340.871124,198.931641 
-	C342.099548,198.193787 343.355286,196.816666 344.550049,196.867691 
-	C346.348236,196.944504 348.515106,197.600616 349.745392,198.806259 
-	C350.704651,199.746292 350.487305,201.895920 350.773224,203.511475 
-	C351.033264,204.980804 351.266724,206.454788 351.511871,207.926727 
-	C351.981079,207.904404 352.450317,207.882080 352.919525,207.859756 
-	C353.118103,204.388031 353.316681,200.916321 353.520721,197.349503 
-	C357.919403,197.133286 362.064941,196.756638 366.202179,196.832230 
-	C367.431885,196.854691 369.554443,198.001968 369.694550,198.883835 
-	C370.256134,202.418121 370.199615,206.050613 370.371674,209.646790 
-	C369.592865,209.696747 368.814087,209.746689 368.035309,209.796646 
-	C367.667999,206.300522 367.300690,202.804413 366.890594,198.901108 
-	C360.210022,200.557587 365.720917,207.387054 361.015839,210.252762 
-	C360.528900,206.227798 360.104309,202.718369 359.631134,198.807175 
-	C353.599182,201.271240 357.686798,206.445404 355.985291,208.841553 
-	C351.880890,209.227219 348.339752,210.059769 344.922516,209.703674 
-	C342.679779,209.469940 340.615997,207.518829 338.214447,206.194778 
-	C338.104126,206.586151 337.671265,208.121613 337.238403,209.657089 
-	C336.760742,209.697037 336.283112,209.736969 335.805450,209.776901 
-	C335.617065,207.751343 335.679962,205.658722 335.162720,203.720917 
-	C334.729218,202.096741 333.618530,200.653290 332.807678,199.129822 
-	C331.951874,200.724838 330.793945,202.236038 330.321869,203.937531 
-	C329.809906,205.782791 329.936798,207.805283 329.785095,209.750504 
-	C329.138000,209.756088 328.490936,209.761673 327.843842,209.767258 
-	C327.585510,206.260468 327.327148,202.753662 327.055389,199.064651 
-	C323.783203,204.361832 320.719360,209.385376 317.527252,214.326050 
-	C317.342468,214.612061 316.116211,214.225220 315.140808,214.128281 
-	C319.286560,209.368988 318.790131,204.751389 313.389557,198.770416 
-	C313.010712,198.333542 313.035522,197.944519 313.060364,197.555511 
-M346.389648,199.230576 
-	C345.557556,199.513092 344.725464,199.795609 343.893402,200.078094 
-	C344.190033,200.552155 344.486694,201.026215 344.783325,201.500275 
-	C345.532562,200.967712 346.281830,200.435135 346.389648,199.230576 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M599.830811,316.754639 
-	C599.657227,316.265869 599.816467,315.876282 600.043091,315.285187 
-	C606.369141,312.899475 612.627747,310.715332 619.316589,308.381042 
-	C619.735229,310.395355 620.081482,312.061249 620.552917,314.329163 
-	C622.309448,314.329163 624.091980,314.334991 625.874451,314.328278 
-	C648.824768,314.241608 671.775024,314.132263 694.725342,314.137909 
-	C695.692871,314.138153 696.660217,315.203644 697.627625,315.772827 
-	C696.354309,316.422546 695.084167,317.631287 693.807251,317.638550 
-	C673.014160,317.757202 652.220154,317.723785 631.426392,317.724640 
-	C627.800781,317.724792 624.175171,317.724670 620.332092,317.724670 
-	C620.064636,319.806396 619.861023,321.391510 619.571899,323.642487 
-	C612.885803,321.303833 606.524719,319.078827 599.830811,316.754639 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1039.281860,548.630981 
-	C1039.003052,541.761902 1034.531616,546.048157 1031.981079,544.910339 
-	C1031.544189,547.573181 1031.176025,549.816284 1030.807861,552.059448 
-	C1030.271729,552.008179 1029.735474,551.956970 1029.199219,551.905701 
-	C1029.199219,546.547180 1029.199219,541.188599 1029.199219,535.830078 
-	C1029.626343,535.736633 1030.053467,535.643188 1030.480713,535.549805 
-	C1030.971680,537.525330 1031.462769,539.500916 1032.077026,541.972168 
-	C1034.039307,541.972168 1036.239258,541.972168 1038.829956,541.972168 
-	C1039.097046,540.074585 1039.384521,538.031494 1039.730103,535.575439 
-	C1047.711060,535.575439 1055.514160,535.571350 1063.317139,535.576843 
-	C1068.773438,535.580688 1074.230957,535.533325 1079.685547,535.632629 
-	C1083.005981,535.693115 1086.411011,536.275391 1086.549194,540.476746 
-	C1086.695190,544.914795 1083.308594,545.742310 1079.729126,545.964783 
-	C1078.911011,546.015625 1078.093018,546.064697 1076.986694,546.132141 
-	C1076.613892,548.141907 1076.256958,550.066589 1075.900024,551.991211 
-	C1075.284180,551.991577 1074.668335,551.991943 1074.052612,551.992371 
-	C1073.811279,547.296692 1073.569946,542.601074 1073.309937,537.541138 
-	C1070.983521,537.825684 1068.950439,538.074402 1066.720337,538.347229 
-	C1066.516846,542.991272 1066.320679,547.465942 1066.124512,551.940613 
-	C1065.386230,551.972961 1064.647949,552.005310 1063.909668,552.037598 
-	C1063.670898,547.558472 1063.432129,543.079346 1063.170044,538.160889 
-	C1059.693726,538.160889 1056.296387,538.160889 1052.087402,538.160889 
-	C1052.087402,542.921143 1052.087402,547.406250 1052.087402,551.891357 
-	C1051.364868,551.947205 1050.642334,552.003052 1049.919800,552.058899 
-	C1049.624390,547.620972 1049.328979,543.183044 1049.015259,538.469055 
-	C1047.088501,538.062134 1045.053101,537.632202 1042.283691,537.047302 
-	C1042.283691,541.948303 1042.283691,546.800415 1042.283691,551.652527 
-	C1041.754517,551.792297 1041.225342,551.932129 1040.696167,552.071899 
-	C1040.225342,551.071411 1039.754517,550.070862 1039.281860,548.630981 
-M1083.612305,539.685059 
-	C1081.374634,538.948242 1079.136963,538.211487 1076.162109,537.231934 
-	C1076.330811,540.224243 1076.419067,541.787292 1076.517212,543.528015 
-	C1079.769043,543.692871 1082.941528,544.813599 1083.612305,539.685059 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M440.261108,361.888519 
-	C402.551392,361.888519 364.841675,361.888519 325.783203,361.888519 
-	C327.199036,360.396515 328.255310,359.121887 329.498474,358.067596 
-	C329.893341,357.732697 330.785919,357.969788 331.450745,357.970184 
-	C367.373718,357.991577 403.296722,358.015686 439.933960,358.259399 
-	C440.519196,359.615662 440.390167,360.752106 440.261108,361.888519 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M577.382324,461.661346 
-	C573.710815,462.053009 570.342896,463.056152 566.926392,463.265442 
-	C562.283447,463.549835 561.487732,459.831848 561.198547,455.945221 
-	C560.644531,455.877838 560.090515,455.810425 559.536499,455.743011 
-	C558.565002,458.164764 557.593445,460.586487 555.992004,464.578339 
-	C555.012390,461.236969 554.434998,459.267487 553.426270,455.826874 
-	C550.840698,458.070007 548.679321,459.988861 546.460999,461.839447 
-	C545.893372,462.312988 545.001587,462.986969 544.518616,462.819489 
-	C543.952881,462.623260 543.342285,461.618652 543.320862,460.946594 
-	C543.205261,457.314606 543.266113,453.677002 543.266113,449.822845 
-	C547.216553,448.943329 550.176392,448.949493 553.526611,451.765656 
-	C555.773743,453.654572 559.765137,453.823517 563.025757,454.051727 
-	C566.274170,454.279114 569.580627,453.539642 572.869141,453.373993 
-	C575.703857,453.231232 578.591125,452.996674 581.374878,453.382202 
-	C583.190308,453.633606 584.862122,454.921509 587.079285,455.973297 
-	C587.692383,455.428986 589.082336,454.194946 590.472290,452.960907 
-	C590.885620,453.273315 591.298950,453.585693 591.712280,453.898071 
-	C589.813171,458.036560 587.914062,462.175018 585.481262,467.476379 
-	C584.155151,462.307404 583.224365,458.679504 582.261230,454.925354 
-	C576.532776,457.110077 580.925781,460.078796 580.773438,463.175873 
-	C579.503113,462.662384 578.583679,462.290741 577.382324,461.661346 
-M571.944824,456.943359 
-	C571.944824,458.099884 571.944824,459.256409 571.944824,460.412964 
-	C572.518738,460.298401 573.092651,460.183838 573.666565,460.069275 
-	C573.218445,458.815125 572.770325,457.561005 571.944824,456.943359 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1156.835693,712.036804 
-	C1158.205078,711.910950 1159.396973,711.540283 1160.158691,711.956665 
-	C1163.596069,713.835510 1165.767456,712.585938 1167.327026,708.876526 
-	C1168.627686,710.389771 1169.636475,711.563354 1169.880859,711.847595 
-	C1169.433594,715.786987 1169.078247,718.917053 1168.684204,722.388855 
-	C1171.204346,722.086792 1172.722656,721.716370 1174.222900,721.778931 
-	C1175.673950,721.839417 1177.106445,722.345581 1178.546997,722.656006 
-	C1178.754639,722.169495 1178.962402,721.682983 1179.170166,721.196472 
-	C1178.086792,720.504761 1176.907349,719.924622 1175.943237,719.094543 
-	C1174.566528,717.909241 1173.347656,716.540833 1172.061279,715.250610 
-	C1173.300903,714.117981 1174.480957,712.143250 1175.794189,712.050293 
-	C1177.757446,711.911316 1179.814575,713.096497 1181.831787,713.718445 
-	C1181.651611,714.237183 1181.471558,714.755920 1181.291504,715.274719 
-	C1179.417847,714.885986 1177.544189,714.497314 1175.670410,714.108643 
-	C1175.479980,714.580933 1175.289429,715.053284 1175.098877,715.525574 
-	C1176.702515,716.321228 1178.336792,717.061523 1179.903442,717.924561 
-	C1182.801758,719.521362 1182.975098,722.484741 1180.318848,724.229431 
-	C1177.427124,726.128784 1167.271362,724.312134 1165.308105,721.544312 
-	C1159.996582,726.247986 1157.056396,726.361938 1153.187744,720.980591 
-	C1155.211670,721.673340 1156.265991,722.184387 1157.374878,722.371277 
-	C1158.468262,722.555542 1159.616943,722.411499 1160.741211,722.411499 
-	C1160.847534,721.935486 1160.953735,721.459534 1161.060059,720.983521 
-	C1158.572266,719.625854 1156.084473,718.268188 1154.530396,717.420044 
-	C1150.616089,718.314453 1147.487671,719.029358 1144.376831,719.740173 
-	C1145.070679,722.287109 1145.070679,722.287109 1151.254150,722.024719 
-	C1149.013062,725.174255 1145.907837,725.921448 1143.149658,723.974854 
-	C1140.321411,721.978821 1139.803345,716.353577 1142.196045,713.621765 
-	C1144.675293,710.791260 1148.107788,711.265625 1152.648315,715.135925 
-	C1153.904907,714.153076 1155.182617,713.153687 1156.835693,712.036804 
-M1161.704224,715.206604 
-	C1160.338501,714.859558 1158.972778,714.512512 1157.607056,714.165527 
-	C1157.425659,714.693420 1157.244263,715.221375 1157.062744,715.749268 
-	C1159.667603,716.911438 1162.272583,718.073669 1165.397705,719.468018 
-	C1165.397705,717.046265 1165.397705,715.463196 1165.397705,713.484253 
-	C1164.014648,714.346436 1163.211182,714.847351 1161.704224,715.206604 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1152.231812,542.518127 
-	C1155.337891,539.959473 1158.147583,538.089966 1162.547363,539.940735 
-	C1163.753296,540.447998 1166.047974,538.367188 1168.221802,537.285583 
-	C1169.569946,539.550659 1171.568726,541.411926 1175.529541,539.576172 
-	C1177.097778,538.849304 1179.687622,540.326355 1181.812256,540.799866 
-	C1181.675537,541.348877 1181.538940,541.897827 1181.402222,542.446838 
-	C1179.435791,542.159485 1177.469360,541.872131 1175.502808,541.584839 
-	C1175.333374,542.036804 1175.163940,542.488831 1174.994385,542.940796 
-	C1176.477539,543.647034 1178.141357,544.126953 1179.391113,545.125427 
-	C1180.555786,546.055969 1182.073364,547.602600 1181.979004,548.759399 
-	C1181.880981,549.963684 1180.131836,551.863281 1178.943481,551.993835 
-	C1175.339111,552.390076 1171.620972,552.350830 1168.025757,551.880798 
-	C1166.895020,551.732971 1166.012451,549.687927 1165.013794,548.508362 
-	C1160.883301,553.600830 1157.005371,553.881897 1153.620117,548.992554 
-	C1156.110107,549.279907 1158.343506,549.537659 1160.576904,549.795410 
-	C1160.700806,549.314575 1160.824585,548.833679 1160.948486,548.352844 
-	C1158.366699,546.868958 1155.784912,545.385071 1153.203125,543.901184 
-	C1153.287598,544.299988 1153.372070,544.698792 1153.456665,545.097595 
-	C1150.371826,545.774475 1147.286987,546.451355 1144.029785,547.166077 
-	C1145.115967,552.651733 1148.967896,548.406250 1151.925293,548.840210 
-	C1149.660034,553.043823 1146.565308,553.086243 1143.716675,551.530823 
-	C1139.986572,549.494263 1139.616699,545.509399 1141.586182,542.454285 
-	C1142.726074,540.686035 1146.068726,540.028809 1148.546997,539.591492 
-	C1149.479980,539.426758 1150.771484,541.294312 1152.231812,542.518127 
-M1178.606445,549.339050 
-	C1178.044312,548.516113 1177.622559,547.530518 1176.893066,546.901428 
-	C1174.876953,545.162720 1172.732300,543.572876 1170.001831,541.422791 
-	C1167.255005,543.241028 1169.045532,546.514832 1169.466797,549.038696 
-	C1172.678833,549.351135 1175.289795,549.605042 1178.606445,549.339050 
-M1162.757568,545.864929 
-	C1163.339111,546.894775 1163.920776,547.924622 1164.502441,548.954468 
-	C1164.997803,548.615356 1165.493164,548.276306 1165.988525,547.937195 
-	C1165.858398,545.651123 1165.728271,543.365112 1165.644897,541.900940 
-	C1162.241699,541.900940 1159.733032,541.900940 1157.224365,541.900940 
-	C1157.156128,542.312805 1157.087891,542.724609 1157.019653,543.136475 
-	C1158.714844,543.904968 1160.409912,544.673523 1162.757568,545.864929 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1077.157715,412.021667 
-	C1075.123779,411.361389 1073.197388,411.128906 1071.271118,410.896393 
-	C1071.220459,411.376770 1071.169800,411.857117 1071.119141,412.337494 
-	C1072.644531,412.561523 1074.169800,412.785522 1076.300293,413.098450 
-	C1073.921753,416.135925 1071.034912,416.378326 1069.302856,414.349640 
-	C1067.937988,412.750946 1067.364868,409.364471 1068.137695,407.461548 
-	C1068.615356,406.285400 1072.295776,405.980316 1074.494141,406.099609 
-	C1075.738647,406.167145 1076.192749,407.162567 1078.132324,406.116699 
-	C1080.689209,404.738007 1084.999512,403.476715 1087.342163,408.115570 
-	C1090.107666,405.182678 1092.720703,405.447418 1096.417236,406.196625 
-	C1100.200928,406.963440 1104.594482,404.721039 1109.646484,403.588348 
-	C1109.774658,403.752838 1110.817993,405.090759 1111.967041,406.564392 
-	C1108.680786,409.187683 1109.498901,411.756989 1112.828735,414.423706 
-	C1105.096191,417.118805 1108.071289,410.217804 1106.225708,407.963928 
-	C1099.629517,407.017944 1103.106079,413.148834 1100.736206,415.867798 
-	C1099.577148,414.944763 1098.526489,414.108154 1097.359619,413.178986 
-	C1094.135132,416.336243 1090.771118,416.402161 1087.477173,412.791931 
-	C1084.631714,414.679413 1081.877075,416.506653 1078.140015,418.985535 
-	C1077.819946,416.593689 1077.542725,414.521576 1077.157715,412.021667 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M765.686890,573.200928 
-	C765.097412,573.558960 764.597778,573.576965 763.874573,573.477417 
-	C761.872009,566.881714 760.093079,560.403625 758.389160,554.198914 
-	C760.244812,553.200073 761.713867,552.409302 763.697510,551.126343 
-	C764.475586,549.895935 764.968811,549.158081 764.969788,548.419556 
-	C765.009521,518.074646 765.019897,487.729675 764.945862,457.384857 
-	C764.943176,456.297546 764.050598,455.212402 763.572693,454.126251 
-	C764.478516,453.276520 765.384460,452.426819 766.969055,450.940491 
-	C766.969055,485.706848 766.969055,519.068176 766.969055,552.691711 
-	C768.726440,552.932068 770.320862,553.150085 772.541748,553.453857 
-	C770.217041,560.122742 767.996887,566.491760 765.686890,573.200928 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M102.220566,594.997803 
-	C103.050880,593.489197 103.817436,591.443298 104.644089,591.418701 
-	C114.460533,591.126831 124.293465,590.912659 134.103012,591.243164 
-	C136.230896,591.314941 138.283356,593.625122 140.370575,594.904297 
-	C139.009262,596.673645 137.681290,598.470093 136.274170,600.202148 
-	C135.426682,601.245300 134.483505,602.215820 133.531082,603.166687 
-	C132.908661,603.788147 132.192566,604.315857 131.518417,604.885498 
-	C131.029938,604.136780 130.163284,603.409180 130.120056,602.635620 
-	C129.954361,599.669800 130.053009,596.689270 130.053009,593.380127 
-	C128.245682,593.688049 126.847031,593.926392 124.978951,594.244751 
-	C124.978951,596.813721 125.135216,599.291870 124.907982,601.734314 
-	C124.806084,602.829590 123.936317,603.853394 123.415016,604.909668 
-	C122.783417,603.785645 121.756989,602.712280 121.604774,601.526672 
-	C121.313728,599.259644 121.520210,596.928711 121.520210,594.102783 
-	C119.011917,593.990845 116.933868,593.898132 113.950577,593.765015 
-	C113.950577,596.858215 114.084579,599.608704 113.873665,602.332458 
-	C113.805214,603.216309 112.833923,604.030212 112.275597,604.876099 
-	C111.686172,604.050293 110.766365,603.291138 110.583099,602.383301 
-	C110.292625,600.944397 110.358093,599.391479 110.516571,597.912842 
-	C110.862236,594.687683 109.455200,593.327026 105.795868,593.600891 
-	C105.795868,596.545288 105.926765,599.514404 105.713501,602.458618 
-	C105.652138,603.305847 104.598656,604.081177 104.000061,604.889465 
-	C103.434280,604.212219 102.857254,603.544006 102.305252,602.855713 
-	C101.423935,601.756714 100.559280,600.644348 99.687584,599.537659 
-	C98.762215,600.755737 97.845520,601.980469 96.907745,603.188965 
-	C96.442818,603.788086 96.036446,604.557190 95.414078,604.859985 
-	C95.074364,605.025391 94.153954,604.518433 93.814949,604.072021 
-	C92.503853,602.345215 93.736687,593.005310 95.556641,591.086182 
-	C96.704987,593.029419 97.722298,595.007996 99.070831,596.726685 
-	C99.251427,596.956909 101.105568,595.874146 102.220566,594.997803 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M800.040161,763.012085 
-	C797.562805,762.862000 795.085510,762.711914 792.608215,762.561890 
-	C792.606995,762.142334 792.605835,761.722839 792.604675,761.303345 
-	C791.129639,761.747803 789.632263,767.226562 788.224121,761.373718 
-	C787.795227,759.591003 788.157654,757.617859 787.191040,755.568359 
-	C786.484070,757.185791 785.885986,758.863464 785.035767,760.401672 
-	C784.357727,761.628296 783.372437,762.685120 782.523560,763.817383 
-	C781.503906,762.642090 780.337646,761.560669 779.506775,760.264343 
-	C778.720520,759.037659 778.286133,757.585510 777.031494,754.704102 
-	C775.526672,757.227600 774.592041,758.727844 773.727295,760.267395 
-	C773.094910,761.393372 772.554443,762.571045 771.973022,763.725708 
-	C771.425598,762.684570 770.867310,761.648804 770.335754,760.599609 
-	C770.118469,760.170654 769.958740,759.712585 769.728271,759.160950 
-	C767.928772,759.442627 766.188538,759.715027 764.448303,759.987427 
-	C764.433594,760.216309 764.418823,760.445190 764.404114,760.674072 
-	C765.792175,760.973450 767.180237,761.272827 768.764465,761.614441 
-	C765.392090,764.741821 764.842041,764.739441 759.933411,761.615173 
-	C756.885559,763.489868 753.514099,765.653625 749.504639,761.077820 
-	C752.074158,760.877930 753.944702,760.732483 756.117493,760.563477 
-	C755.228333,756.826843 747.049866,756.897705 751.495239,751.410034 
-	C753.431580,749.019653 756.367798,749.124451 759.529724,751.947876 
-	C757.352844,752.498108 755.817261,752.886230 753.168213,753.555786 
-	C755.801880,755.085510 757.570190,756.112610 759.438354,757.197693 
-	C762.153992,754.271973 764.735107,752.036804 768.890930,755.207458 
-	C769.863220,755.949280 772.542847,754.329712 774.469543,753.971680 
-	C777.791382,753.354370 780.830139,753.548523 781.667236,756.673401 
-	C784.142517,755.773132 786.329041,754.640747 788.636414,754.278564 
-	C789.820007,754.092773 791.219543,755.282959 792.473206,755.830139 
-	C794.452332,755.267273 796.831055,754.590698 799.609375,754.354248 
-	C798.620850,755.839233 796.570190,756.598633 795.972900,757.984497 
-	C794.384216,761.670288 798.441162,761.483337 800.040161,763.012085 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1136.299683,406.226257 
-	C1138.817505,406.226227 1141.335327,406.226227 1143.853271,406.226227 
-	C1143.928589,406.080902 1144.004028,405.935577 1144.079468,405.790253 
-	C1146.702148,406.054840 1149.322021,406.494446 1151.948364,406.538239 
-	C1155.002075,406.589111 1158.328491,407.004608 1161.056396,405.981628 
-	C1165.189575,404.431580 1166.243408,406.805206 1167.357910,409.833862 
-	C1169.195679,406.714050 1176.034546,404.081604 1178.940674,405.543274 
-	C1180.174316,406.163818 1180.825928,407.941589 1181.742065,409.193359 
-	C1180.717041,409.778534 1179.732666,410.460785 1178.652100,410.913177 
-	C1177.983643,411.193115 1177.168823,411.123474 1176.312744,412.285400 
-	C1177.952026,412.556976 1179.591309,412.828552 1181.519653,413.148010 
-	C1177.013550,416.915741 1175.194702,416.350342 1171.590332,410.434235 
-	C1170.286011,412.133453 1168.989502,413.822388 1167.693115,415.511353 
-	C1166.268677,413.874451 1164.844238,412.237518 1163.291260,410.452820 
-	C1161.552246,414.750244 1159.082764,416.404449 1153.618408,414.450348 
-	C1149.873901,413.111237 1145.024658,414.901978 1140.663818,415.220306 
-	C1139.386230,415.313568 1138.090088,415.155823 1136.463379,414.661133 
-	C1137.241211,413.610443 1138.358154,413.011719 1138.662598,412.848572 
-	C1137.833740,410.525543 1137.066650,408.375916 1136.299683,406.226257 
-M1152.248657,409.435455 
-	C1150.570801,409.298767 1148.892944,409.162109 1147.215088,409.025421 
-	C1147.457642,410.185699 1147.700195,411.345947 1147.942627,412.506165 
-	C1149.387695,411.766724 1150.832764,411.027283 1152.248657,409.435455 
-M1141.571411,407.882172 
-	C1140.931396,408.033844 1140.291382,408.185547 1139.651367,408.337219 
-	C1139.831055,408.686737 1140.010742,409.036255 1140.190308,409.385773 
-	C1140.902710,408.924500 1141.615112,408.463257 1141.571411,407.882172 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M278.020996,764.594604 
-	C274.016785,765.237183 270.179443,765.800354 266.355011,765.723633 
-	C264.840515,765.693359 262.117920,764.268555 262.099091,763.430298 
-	C262.052063,761.335693 263.238281,759.213440 264.030334,756.794678 
-	C264.094818,756.834839 263.183197,756.266724 262.271606,755.698547 
-	C262.236694,755.175781 262.201752,754.653015 262.166840,754.130249 
-	C264.505341,753.705200 267.116455,752.459900 269.095093,753.117615 
-	C270.646393,753.633240 271.700226,756.395325 272.447021,758.360046 
-	C273.124084,760.141357 273.087646,762.193848 273.365753,764.126770 
-	C273.969025,764.086365 274.572266,764.045959 275.175507,764.005615 
-	C275.175507,761.213074 275.597687,758.339783 275.082031,755.645996 
-	C274.185730,750.963928 276.263153,748.548828 280.789581,749.179016 
-	C283.693756,749.583313 286.699982,749.254822 289.779175,749.954346 
-	C288.155304,750.236389 286.531464,750.518372 284.907593,750.800415 
-	C284.817627,751.221924 284.727692,751.643494 284.637726,752.065063 
-	C286.410675,752.947876 288.183594,753.830750 290.584106,755.026123 
-	C290.360962,758.114868 290.093353,761.819519 289.825714,765.524170 
-	C289.159149,765.518127 288.492615,765.512085 287.826050,765.506042 
-	C287.566162,762.065613 287.306244,758.625244 287.046356,755.184875 
-	C286.465454,755.061890 285.884583,754.938904 285.303680,754.815918 
-	C284.718964,758.398376 284.134216,761.980835 283.549469,765.563293 
-	C283.011566,765.542480 282.473633,765.521667 281.935730,765.500854 
-	C281.646454,762.118286 281.357147,758.735657 281.062561,755.291016 
-	C278.473450,756.244934 278.473450,756.244934 278.020996,764.594604 
-M267.308868,755.007446 
-	C266.729645,755.617920 266.150421,756.228455 265.571228,756.838928 
-	C266.467865,757.070740 267.364502,757.302490 268.261108,757.534302 
-	C268.257111,756.752930 268.253082,755.971497 267.308868,755.007446 
-M278.978882,751.544006 
-	C279.432983,751.820068 279.867950,752.151917 280.359009,752.320251 
-	C280.446411,752.350159 280.766663,751.700806 280.979401,751.365112 
-	C280.521057,751.165100 280.062714,750.965088 278.978882,751.544006 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M506.167358,465.062256 
-	C505.264709,464.882294 503.660492,464.859375 503.579041,464.495514 
-	C503.195160,462.780884 503.228577,460.972870 503.103699,459.052673 
-	C501.020569,459.052673 499.282288,459.052673 497.543976,459.052673 
-	C497.488556,459.308777 497.433167,459.564850 497.377747,459.820953 
-	C498.848297,460.229004 500.318848,460.637024 502.297729,461.186127 
-	C499.311798,464.009033 496.249115,464.270477 494.446686,461.480530 
-	C493.380737,459.830566 493.505829,456.054443 494.723541,454.570404 
-	C497.204895,451.546295 500.264038,452.930603 502.466339,455.590546 
-	C503.473358,454.941650 504.386536,454.353180 505.603485,454.237915 
-	C505.655548,456.283783 505.403900,457.856506 505.152252,459.429230 
-	C505.769012,459.583344 506.385803,459.737427 507.002594,459.891510 
-	C507.628235,457.737701 508.253906,455.583862 508.879578,453.430023 
-	C510.380432,454.040466 511.881287,454.650879 513.971863,455.501160 
-	C515.919189,453.089813 518.711548,451.893402 522.326416,454.576233 
-	C523.872925,455.723999 532.774414,452.360413 534.655396,450.017822 
-	C535.564148,451.751251 536.444458,453.430542 537.337402,455.133820 
-	C534.795532,456.834137 535.197449,459.522522 538.526428,462.110413 
-	C533.893433,463.823425 533.893433,463.823425 531.671021,456.017365 
-	C525.860352,455.071930 527.634644,460.095825 527.028992,461.773163 
-	C524.337219,462.261841 522.432068,463.109497 520.738953,462.799377 
-	C518.093506,462.314850 515.591675,461.046143 512.297791,460.075684 
-	C510.712036,461.025085 509.857513,462.008514 509.002991,462.991943 
-	C508.216766,463.157257 507.430511,463.322601 506.224243,463.799561 
-	C505.716034,464.231232 505.531799,464.430817 505.554901,464.458740 
-	C505.736694,464.678406 505.958099,464.865295 506.167358,465.062256 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M711.516296,692.679443 
-	C712.164673,693.609070 712.362061,694.673340 712.263489,695.961487 
-	C675.375854,696.142578 638.784180,696.114563 602.192688,696.013306 
-	C600.365479,696.008179 598.540039,695.367371 596.713745,695.022583 
-	C596.826782,694.286377 596.939819,693.550232 597.052856,692.814026 
-	C635.057007,692.814026 673.061157,692.814026 711.516296,692.679443 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M338.018982,237.209259 
-	C336.823456,236.365555 335.627930,235.521851 334.390625,234.648636 
-	C329.154327,239.076874 327.678802,239.156570 321.858887,236.459991 
-	C318.965881,236.736008 314.904724,238.309021 313.444672,236.994003 
-	C311.058807,234.845215 310.367493,230.814926 308.676178,226.922073 
-	C302.782593,227.811646 307.605957,234.753296 303.669159,238.651947 
-	C303.669159,233.684860 303.669159,229.692810 303.669159,225.202042 
-	C307.567535,224.745270 311.871948,226.143707 316.363373,224.980728 
-	C320.023682,224.032974 321.438049,227.719101 321.561676,231.727585 
-	C318.679352,231.949188 315.960815,232.158203 312.542725,232.421005 
-	C313.552216,233.706909 314.179108,235.237488 314.868103,235.265961 
-	C319.875641,235.472900 324.895752,235.377197 329.911865,235.377197 
-	C329.997314,234.949753 330.082764,234.522324 330.168213,234.094879 
-	C329.351379,233.462753 328.514832,232.854309 327.721954,232.193420 
-	C326.193512,230.919357 324.552551,229.728577 323.307465,228.215836 
-	C323.093719,227.956161 324.534088,225.477325 325.342072,225.399979 
-	C327.510315,225.192429 329.761536,225.663391 331.949860,226.039200 
-	C332.317719,226.102371 332.536194,227.035507 333.167786,228.202454 
-	C330.582245,227.716431 328.670044,227.356964 326.757843,226.997498 
-	C326.576294,227.444351 326.394775,227.891220 326.213226,228.338074 
-	C328.663513,229.641388 331.113800,230.944717 333.609070,232.271973 
-	C336.602051,223.828751 339.958405,222.389877 344.850464,227.579208 
-	C344.007538,227.985275 343.477631,228.000931 342.648621,227.798584 
-	C337.271240,226.741196 336.343536,228.317215 338.039795,235.273468 
-	C338.026733,236.176712 338.022858,236.692993 338.018982,237.209259 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M802.486328,741.206360 
-	C801.623169,740.719116 800.446167,739.870667 800.583130,739.452942 
-	C801.722595,735.976807 803.023621,732.545227 804.475952,729.186584 
-	C804.797485,728.442993 806.155701,727.426086 806.613525,727.606873 
-	C807.707031,728.038452 808.934570,728.927246 809.418823,729.955933 
-	C810.870972,733.040039 811.992859,736.279602 813.970459,739.239990 
-	C814.115723,736.819641 814.260986,734.399292 814.449341,731.260315 
-	C819.961487,731.260315 825.276184,730.997742 830.532043,731.437683 
-	C831.915100,731.553406 834.272644,733.965698 834.151001,735.106934 
-	C833.924194,737.235535 832.481445,739.436401 831.022217,741.166504 
-	C829.907288,742.488342 827.986755,743.130676 825.739685,744.489380 
-	C825.180359,742.977112 824.519470,741.190308 823.698792,738.971497 
-	C820.977051,740.820435 818.322876,742.623413 815.779175,744.351379 
-	C813.301208,742.311707 811.089905,739.761475 808.297058,738.528564 
-	C807.068176,737.986023 804.656189,740.123840 802.486328,741.206360 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1470.007568,144.023560 
-	C1507.357178,144.013733 1544.706909,144.003922 1582.526855,144.346130 
-	C1582.975464,145.364761 1582.953735,146.031357 1582.932129,146.697968 
-	C1557.778687,146.764465 1532.625244,146.849106 1507.471802,146.889648 
-	C1495.310547,146.909241 1483.149292,146.845978 1470.508789,146.430801 
-	C1470.022217,145.368774 1470.014893,144.696167 1470.007568,144.023560 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M725.983948,325.022766 
-	C727.173767,324.290771 728.300049,323.416290 729.564880,322.852692 
-	C733.880676,320.929626 737.189819,323.468018 737.460266,329.221222 
-	C736.242004,329.378204 734.991028,329.559692 733.735168,329.695557 
-	C732.455200,329.834015 731.170288,329.927612 729.670166,330.060059 
-	C730.766052,336.542786 734.939392,331.113953 737.469360,332.313293 
-	C739.828674,333.431763 743.135071,332.552307 747.578064,332.552307 
-	C745.502686,331.139526 744.320007,330.588959 743.484802,329.708710 
-	C742.081116,328.229340 740.898315,326.540344 739.622681,324.939514 
-	C741.786682,324.173889 743.919739,322.960907 746.126221,322.808136 
-	C747.479736,322.714447 748.945618,324.244659 750.401062,325.068237 
-	C756.308411,321.483063 759.888367,321.540039 761.805786,325.296387 
-	C763.662781,328.934418 762.214905,333.856995 758.910706,335.138977 
-	C755.290955,336.543365 752.589050,334.883636 750.801270,329.465454 
-	C750.234131,325.624939 746.534302,324.270538 742.569946,326.030853 
-	C745.076355,327.519226 747.393066,328.894958 749.709839,330.270691 
-	C748.816589,335.509186 745.312195,337.076080 740.455139,334.503693 
-	C739.467041,333.980377 738.043518,333.273956 737.213257,333.613037 
-	C728.658447,337.106750 725.680664,334.955566 726.265137,325.338257 
-	C725.988281,324.972015 725.983948,325.022766 725.983948,325.022766 
-M753.723206,327.620422 
-	C753.712524,328.111176 753.519348,328.701874 753.723572,329.075012 
-	C754.509460,330.510773 755.422607,331.876862 756.288269,333.268951 
-	C757.360413,332.479492 759.284546,331.737854 759.332092,330.890961 
-	C759.439819,328.970154 758.623657,326.997498 758.183167,325.045929 
-	C756.756287,325.614685 755.329407,326.183441 753.723206,327.620422 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1535.539673,836.162903 
-	C1543.280151,835.079407 1545.602417,836.442749 1544.745117,841.367737 
-	C1544.514771,842.691345 1543.632446,844.212891 1542.572998,845.011780 
-	C1540.729614,846.401917 1538.515625,847.300598 1535.795654,848.760254 
-	C1535.507202,846.784668 1535.220337,844.819885 1534.900391,842.629028 
-	C1531.932129,844.607056 1529.044678,846.531250 1527.293213,847.698425 
-	C1523.695801,846.916199 1520.970947,846.277527 1518.226196,845.740173 
-	C1515.580566,845.222229 1513.712280,844.466309 1515.424805,841.157288 
-	C1516.053833,839.941711 1515.943848,838.343567 1516.370728,835.667664 
-	C1518.374512,835.877991 1520.937500,836.147095 1524.658203,836.537720 
-	C1526.529907,834.968262 1529.819092,834.322937 1533.444458,836.761719 
-	C1533.828491,837.020020 1534.684570,836.576538 1535.539673,836.162903 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M598.423340,412.902527 
-	C598.005859,411.938263 597.994446,410.872955 597.999390,409.407959 
-	C599.672424,408.883240 601.329163,408.650360 602.985962,408.649261 
-	C635.110352,408.628082 667.234802,408.613159 699.359070,408.678802 
-	C701.615356,408.683441 705.013794,407.722717 704.641235,411.980499 
-	C670.282288,411.980499 636.231689,411.972687 602.181091,412.015015 
-	C601.063477,412.016418 599.946533,412.527832 598.423340,412.902527 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M799.055725,428.986908 
-	C797.806152,429.562103 796.556641,430.137299 795.307068,430.712494 
-	C794.757874,429.440430 793.886597,428.206299 793.731384,426.887878 
-	C793.468933,424.657867 793.659363,422.374603 793.659363,419.222076 
-	C791.520874,420.507599 790.330811,421.222992 790.213806,421.293304 
-	C790.213806,424.695770 791.271545,428.326416 790.005615,429.546906 
-	C786.837036,432.601715 783.291992,430.560852 780.292358,427.909332 
-	C777.299744,430.522339 773.639954,432.686340 770.659729,429.266724 
-	C769.005615,427.368805 768.658752,423.349518 769.380493,420.745911 
-	C769.788330,419.274689 773.827881,417.619263 775.734192,418.084595 
-	C777.697998,418.563873 779.057800,421.518036 780.681885,423.389343 
-	C780.321228,423.819366 779.960571,424.249390 779.599976,424.679413 
-	C777.013367,424.889740 774.426758,425.100037 771.423035,425.344269 
-	C771.988281,426.436188 772.385864,427.938904 772.831848,427.953400 
-	C777.943054,428.119415 783.061584,428.059082 788.178162,428.059082 
-	C788.282104,427.639923 788.385986,427.220795 788.489929,426.801636 
-	C787.492737,426.187683 786.321411,425.740967 785.536438,424.923309 
-	C784.120911,423.448730 782.936523,421.752228 781.655640,420.148376 
-	C783.667847,419.353668 786.126465,417.412964 787.604858,417.988800 
-	C791.361145,419.451996 793.500000,418.425842 795.114990,414.898956 
-	C796.335938,416.233368 797.289124,417.275208 798.114807,418.857727 
-	C795.102234,423.115448 795.495789,426.647064 799.055725,428.986908 
-M784.960388,420.675049 
-	C785.954468,421.367645 786.948608,422.060242 787.942688,422.752838 
-	C788.217407,422.150543 788.492188,421.548218 788.766907,420.945892 
-	C787.753296,420.652710 786.739746,420.359528 784.960388,420.675049 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M147.352264,846.563965 
-	C146.332840,845.781738 145.621078,845.108459 144.917511,844.442932 
-	C137.999893,849.775085 130.895508,847.406616 129.602982,839.315918 
-	C123.872841,838.941589 127.651772,845.197754 123.449333,847.316528 
-	C123.253250,843.609436 123.090599,840.534363 122.878212,836.519043 
-	C130.335754,837.022888 137.366547,837.511658 144.400620,837.947754 
-	C144.984436,837.984009 145.662064,837.787048 146.174515,837.489197 
-	C149.915039,835.315308 152.720291,836.408020 155.063644,840.748535 
-	C155.986526,838.540222 156.709030,836.811462 157.431519,835.082642 
-	C158.288376,835.788513 159.145248,836.494385 160.002121,837.200195 
-	C158.070969,841.536072 156.139832,845.872009 153.776855,851.177429 
-	C152.378647,845.715393 151.415070,841.951233 150.451492,838.187134 
-	C149.795471,838.252441 149.139435,838.317749 148.483414,838.383118 
-	C148.483414,840.168213 148.576172,841.960144 148.447037,843.735901 
-	C148.374832,844.728760 147.934418,845.694763 147.352264,846.563965 
-M139.418381,842.963623 
-	C140.233139,842.861328 141.047882,842.759094 141.862640,842.656799 
-	C141.560699,841.411438 141.258743,840.166077 140.956802,838.920776 
-	C140.555893,839.000793 140.154984,839.080872 139.754074,839.160950 
-	C139.585983,840.181519 139.417892,841.202026 139.418381,842.963623 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1060.898193,764.170898 
-	C1065.177246,763.541565 1069.307251,764.137451 1070.375977,768.163269 
-	C1071.206909,771.294067 1070.918335,775.935608 1069.054932,778.200745 
-	C1067.438354,780.165833 1062.802368,780.526367 1059.712036,780.092285 
-	C1057.634644,779.800415 1055.925171,776.887817 1053.900635,775.008057 
-	C1053.322266,779.311768 1050.410278,781.225830 1046.017700,780.965332 
-	C1043.203613,780.798340 1040.530273,780.214294 1039.366211,775.535400 
-	C1041.647217,776.769592 1042.934082,778.008911 1044.261963,778.054504 
-	C1046.152710,778.119385 1048.073486,777.307983 1049.981445,776.870911 
-	C1048.758545,775.689392 1047.651733,774.339966 1046.271606,773.386353 
-	C1045.372681,772.765381 1043.752808,773.050232 1043.030884,772.342651 
-	C1041.835938,771.171265 1040.448486,769.553467 1040.388184,768.072937 
-	C1040.340698,766.908386 1041.935547,765.214478 1043.214111,764.545837 
-	C1046.925659,762.604919 1050.563721,764.053955 1052.831665,768.858643 
-	C1050.666138,767.751221 1049.370361,766.640076 1047.977539,766.500977 
-	C1046.551880,766.358521 1045.031128,767.168518 1043.552002,767.561523 
-	C1044.489746,768.639587 1045.228271,770.096741 1046.406982,770.716431 
-	C1048.835571,771.993164 1051.499146,772.822510 1054.303711,773.929688 
-	C1055.226807,770.315491 1055.109253,765.445740 1060.898193,764.170898 
-M1065.653931,766.917236 
-	C1062.650879,765.636719 1059.518677,766.001404 1058.669800,769.142517 
-	C1058.005615,771.600281 1058.715210,774.908447 1059.982422,777.190002 
-	C1060.545654,778.203857 1065.300781,778.466370 1065.862427,777.594482 
-	C1067.280273,775.393127 1067.541260,772.375427 1067.939331,769.637329 
-	C1068.041016,768.937622 1066.928223,768.061279 1065.653931,766.917236 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1118.011719,638.353394 
-	C1117.835327,641.854126 1117.659180,645.354919 1117.482910,648.855652 
-	C1116.905029,648.893066 1116.327271,648.930420 1115.749512,648.967834 
-	C1115.269287,645.396240 1114.789062,641.824646 1114.308960,638.253113 
-	C1113.649414,638.291931 1112.989990,638.330688 1112.330566,638.369507 
-	C1112.073486,641.642029 1111.816284,644.914490 1111.547607,648.334473 
-	C1107.418823,648.614502 1103.348877,649.155823 1099.301636,649.019653 
-	C1097.905273,648.972656 1095.499634,647.288818 1095.451782,646.263916 
-	C1095.381104,644.753418 1096.715698,642.824646 1098.003174,641.711670 
-	C1099.084717,640.776611 1100.953735,640.752502 1102.474121,640.325134 
-	C1102.405151,639.780518 1102.336182,639.235840 1102.267334,638.691223 
-	C1100.312134,638.985657 1098.357056,639.280029 1096.215576,639.058228 
-	C1096.030273,638.372803 1096.031250,638.203613 1096.032227,638.034363 
-	C1098.445557,637.516846 1101.088623,636.187195 1103.187866,636.780701 
-	C1104.484985,637.147461 1105.065186,640.403870 1105.757202,642.434509 
-	C1106.226562,643.811279 1106.331299,645.312439 1106.599121,646.757935 
-	C1107.211426,646.735168 1107.823608,646.712463 1108.435913,646.689697 
-	C1108.585327,644.235413 1109.217773,641.692444 1108.786377,639.344910 
-	C1107.804810,634.002991 1109.141479,632.470764 1114.746704,632.691406 
-	C1117.449219,632.797852 1120.182495,632.122559 1122.800537,631.813171 
-	C1121.104004,633.412537 1119.763672,634.676147 1118.665283,636.451782 
-	C1118.608765,637.427063 1118.310303,637.890259 1118.011719,638.353394 
-M1113.002319,634.041687 
-	C1112.775146,634.523926 1112.547852,635.006165 1112.320557,635.488342 
-	C1112.898193,635.561707 1113.475830,635.635071 1114.053589,635.708435 
-	C1114.002075,635.119141 1113.950562,634.529907 1113.002319,634.041687 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M537.135681,668.961670 
-	C537.135681,666.171753 537.135681,663.381836 537.135681,660.270996 
-	C529.017212,660.880676 534.771240,668.520264 530.028564,671.457764 
-	C530.028564,666.753418 530.028564,662.732422 530.028564,658.520020 
-	C533.193848,658.520020 536.733948,659.208313 539.805054,658.303894 
-	C542.298950,657.569458 544.229919,654.923706 546.410522,653.125549 
-	C546.792114,653.513550 547.173645,653.901489 547.555237,654.289490 
-	C547.002747,655.277222 546.450256,656.265015 545.592468,657.798584 
-	C552.090454,656.999390 550.812805,662.933472 553.400757,665.884766 
-	C554.743042,663.056396 555.979370,660.451294 557.657654,656.915100 
-	C559.303894,664.364868 553.282104,675.103577 549.164124,675.103638 
-	C549.695496,672.733398 550.937134,670.165100 550.626038,667.801025 
-	C550.268799,665.086914 548.535889,662.553894 547.400513,659.942200 
-	C546.910034,660.016846 546.419556,660.091431 545.929016,660.166077 
-	C545.645386,663.706604 545.361694,667.247131 545.078003,670.787659 
-	C544.478455,670.833923 543.878845,670.880188 543.279297,670.926453 
-	C542.770264,667.175476 542.261230,663.424500 541.752197,659.673523 
-	C541.110413,659.728821 540.468689,659.784119 539.826904,659.839417 
-	C539.826904,662.565674 539.826904,665.291992 539.447632,668.475952 
-	C538.424133,668.942993 537.779907,668.952332 537.135681,668.961670 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1597.016846,677.954956 
-	C1601.476196,678.615906 1603.071533,681.485535 1603.070312,685.677979 
-	C1603.059448,725.758545 1603.042603,765.839111 1603.104004,805.919556 
-	C1603.109253,809.318481 1601.921875,811.671570 1598.412842,812.734009 
-	C1597.995239,812.201843 1597.976196,811.963806 1598.147949,811.442261 
-	C1599.207275,808.908081 1600.824219,806.660339 1600.833252,804.406189 
-	C1600.988159,765.438171 1601.017822,726.468933 1600.776245,687.501770 
-	C1600.760742,684.993347 1598.315186,682.499939 1597.003662,679.659058 
-	C1597.010620,678.863953 1597.013672,678.409485 1597.016846,677.954956 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M28.984718,574.037720 
-	C24.897114,573.002075 24.974937,569.710388 24.972219,566.521545 
-	C24.954796,546.087585 24.961132,525.653625 24.961229,505.219696 
-	C24.961319,485.948639 25.007252,466.677429 24.929094,447.406708 
-	C24.912596,443.338348 25.886292,440.180634 30.616470,439.332062 
-	C30.989758,440.093933 30.994057,440.550262 30.684031,441.177795 
-	C29.267263,443.929688 27.218832,446.505188 27.204544,449.091888 
-	C26.996630,486.738251 27.005529,524.386414 27.150944,562.033325 
-	C27.164574,565.561951 28.450022,569.085754 29.100452,572.967773 
-	C29.032198,573.561707 29.008459,573.799744 28.984718,574.037720 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M27.724716,684.951050 
-	C27.060892,684.963257 26.397072,684.975464 25.403076,684.983032 
-	C25.634439,680.414062 28.610277,678.925293 32.767357,678.925354 
-	C72.929420,678.925842 113.091499,678.915833 153.253540,678.939148 
-	C156.359802,678.940918 159.352676,679.356140 159.877457,683.596069 
-	C159.344818,684.020691 159.113785,684.034485 158.716797,683.722656 
-	C156.469711,682.601685 154.390976,681.119873 152.307098,681.112671 
-	C112.788437,680.975098 73.268845,680.953674 33.750999,681.179443 
-	C31.735123,681.190979 29.733162,683.638000 27.724716,684.951050 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M366.028259,186.646851 
-	C364.174011,185.905701 362.689270,185.167328 361.204529,184.428955 
-	C361.317535,184.049271 361.430542,183.669601 361.543549,183.289917 
-	C363.697784,183.289917 365.851990,183.289917 368.006195,183.289917 
-	C367.999268,182.621048 367.992340,181.952179 367.985413,181.283310 
-	C363.456848,181.283310 358.920074,181.444061 354.403198,181.214142 
-	C352.210510,181.102524 350.055054,180.259445 347.882721,179.747513 
-	C348.452484,177.639633 349.022278,175.531754 349.829681,172.544769 
-	C349.994781,172.787689 349.325867,171.803421 348.656921,170.819183 
-	C350.081116,170.133347 351.641937,168.706009 352.897064,168.937332 
-	C354.729492,169.275070 357.102631,170.419266 357.862549,171.919907 
-	C358.886963,173.942856 358.597168,176.631332 359.632599,179.065582 
-	C360.429535,176.102173 360.369751,172.224167 362.272766,170.441574 
-	C364.051788,168.775131 367.913025,169.331619 370.813782,168.916046 
-	C372.991577,180.153442 371.834045,184.541214 366.028259,186.646851 
-M368.482971,173.107559 
-	C367.194092,172.497360 365.905212,171.887161 364.616333,171.276978 
-	C364.153198,173.247162 363.380646,175.215866 363.371307,177.188202 
-	C363.367249,178.039383 364.941528,178.898071 365.798798,179.753357 
-	C366.803558,178.450836 367.897797,177.203949 368.762024,175.814041 
-	C369.045013,175.358948 368.730255,174.532166 368.482971,173.107559 
-M353.252289,173.685165 
-	C353.777588,173.103546 354.302887,172.521942 354.828217,171.940338 
-	C354.123322,171.681702 353.418396,171.423065 352.713470,171.164429 
-	C352.565338,171.961670 352.417236,172.758911 353.252289,173.685165 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1465.960693,746.860168 
-	C1465.688599,746.203918 1465.754883,745.891602 1465.869995,745.344604 
-	C1466.247314,743.219482 1466.885864,741.334229 1466.894165,739.446167 
-	C1466.971191,721.703796 1467.043091,703.959900 1466.866089,686.218994 
-	C1466.823853,681.983887 1467.959229,679.124695 1472.615112,678.329834 
-	C1472.990112,679.094299 1472.994873,679.550476 1472.675659,680.168457 
-	C1471.250000,682.863708 1469.201172,685.392334 1469.188354,687.931213 
-	C1468.986206,727.947937 1469.046143,767.966064 1468.707520,807.988403 
-	C1467.918701,807.997314 1467.467896,808.001587 1467.017334,808.005798 
-	C1466.991455,789.690918 1466.985107,771.375916 1466.911255,753.061218 
-	C1466.903442,751.106812 1466.500732,749.153931 1465.960693,746.860168 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1467.047974,808.360840 
-	C1467.467896,808.001587 1467.918701,807.997314 1468.867676,808.307739 
-	C1471.941040,809.728943 1474.505981,811.767273 1477.092896,811.795898 
-	C1499.900269,812.047974 1522.711670,811.970337 1545.521851,811.934387 
-	C1563.000244,811.906799 1580.478760,811.798340 1597.957153,811.725769 
-	C1597.976196,811.963806 1597.995239,812.201843 1598.051147,812.797424 
-	C1596.501709,813.450012 1594.915771,814.000549 1593.329102,814.002441 
-	C1554.267822,814.050171 1515.206421,813.991943 1476.145508,814.106628 
-	C1471.781372,814.119446 1468.790283,812.722412 1467.047974,808.360840 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M86.965469,619.493347 
-	C93.500443,616.303467 109.249504,617.059570 112.926926,621.886719 
-	C113.598328,619.900879 114.213379,618.081787 114.828430,616.262695 
-	C115.660652,616.933899 116.492867,617.605103 117.325089,618.276367 
-	C115.353470,622.563660 113.381859,626.850952 110.885300,632.279724 
-	C109.705482,626.868042 108.922409,623.276184 108.013458,619.106934 
-	C104.820175,621.888733 104.820175,621.888733 106.304604,626.528137 
-	C101.923645,626.883301 97.436722,627.245056 92.950157,627.611267 
-	C89.037621,627.930542 87.474052,625.903870 87.133102,619.846802 
-	C86.995499,619.451538 86.965469,619.493347 86.965469,619.493347 
-M99.173508,621.667480 
-	C98.698074,621.906372 98.159882,622.079224 97.790558,622.429871 
-	C97.696114,622.519531 98.135986,623.171875 98.330368,623.565735 
-	C98.692726,623.190918 99.055084,622.816101 99.173508,621.667480 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M29.364620,574.214722 
-	C29.008459,573.799744 29.032198,573.561707 29.546577,573.066772 
-	C70.852287,572.851624 111.667389,572.918762 152.482300,572.852234 
-	C154.308563,572.849304 156.132858,571.631775 158.211792,570.899048 
-	C158.972427,571.199585 159.479370,571.581116 159.986328,571.962646 
-	C157.109344,572.986084 154.236801,574.886047 151.354706,574.900635 
-	C112.447174,575.097961 73.538315,575.040710 34.629829,575.005981 
-	C33.001213,575.004517 31.372952,574.605591 29.364620,574.214722 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1561.816162,835.675598 
-	C1567.041870,835.200073 1572.660278,838.454468 1576.688354,832.599792 
-	C1578.238037,833.821350 1579.781128,835.037842 1582.197998,836.942871 
-	C1581.988647,834.939270 1581.600464,833.946350 1581.891602,833.229309 
-	C1582.172241,832.538391 1583.154541,832.132507 1583.828613,831.601440 
-	C1584.263062,832.202515 1585.055176,832.793091 1585.073364,833.406494 
-	C1585.187988,837.300964 1585.131714,841.200439 1585.131714,845.096741 
-	C1576.886108,844.982178 1576.886108,844.982178 1573.549194,837.443420 
-	C1573.293945,839.344666 1573.124878,840.528320 1572.978638,841.714783 
-	C1572.841309,842.828857 1572.728149,843.946045 1572.535645,845.680542 
-	C1568.043823,845.680542 1563.649902,846.175964 1559.475098,845.435730 
-	C1557.814941,845.141418 1555.580078,842.170898 1555.474121,840.312195 
-	C1555.278564,836.884521 1557.704712,834.991089 1561.816162,835.675598 
-M1563.724487,842.813232 
-	C1565.400513,841.448730 1567.076416,840.084167 1569.715088,837.935852 
-	C1566.536743,837.935852 1564.551025,837.629333 1562.722656,838.033936 
-	C1561.286133,838.351807 1560.044067,839.548340 1558.715698,840.354553 
-	C1560.114136,841.212585 1561.512451,842.070557 1563.724487,842.813232 
-M1579.917603,837.803223 
-	C1577.530884,840.242737 1577.725830,842.058044 1582.407715,843.891846 
-	C1581.646118,841.068604 1581.158691,839.261536 1579.917603,837.803223 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M162.128937,749.490723 
-	C161.412872,749.815674 161.014252,749.844421 160.301758,749.528931 
-	C159.957947,748.112854 159.928009,747.041016 160.184753,745.916321 
-	C160.979095,745.578979 161.486755,745.294434 161.994415,745.009949 
-	C180.322632,744.985352 198.650848,744.940552 216.979034,744.957153 
-	C219.834305,744.959778 223.138428,744.721680 222.575516,749.194580 
-	C202.227707,749.194580 182.337036,749.194580 162.128937,749.490723 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M30.998356,441.006531 
-	C30.994057,440.550262 30.989758,440.093933 30.983660,439.294678 
-	C71.501320,438.934082 112.020775,438.913940 152.540237,438.913788 
-	C153.520676,438.913788 154.501099,439.136017 155.754700,439.886108 
-	C156.012131,440.742920 155.996414,440.968262 155.516449,441.128906 
-	C113.700943,441.045013 72.349648,441.025787 30.998356,441.006531 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M32.008114,229.120331 
-	C32.002541,228.646317 31.996967,228.172287 31.993439,227.342529 
-	C73.018806,226.974091 114.042137,226.961411 155.536469,227.314819 
-	C156.003860,228.139282 156.000229,228.597656 155.528152,229.052185 
-	C114.042496,229.072342 73.025307,229.096329 32.008114,229.120331 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1472.999634,680.006592 
-	C1472.994873,679.550476 1472.990112,679.094299 1472.983887,678.295288 
-	C1514.013672,677.939880 1555.045044,677.927368 1596.546631,677.934875 
-	C1597.013672,678.409485 1597.010620,678.863953 1596.535156,679.657410 
-	C1555.041748,679.999756 1514.020630,680.003174 1472.999634,680.006592 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1571.679688,613.972168 
-	C1572.291626,615.650146 1572.895874,616.930603 1573.502686,618.216553 
-	C1569.871338,619.133545 1569.871338,619.133545 1567.009766,610.241699 
-	C1566.696411,613.681030 1566.497803,615.861572 1566.237549,618.718933 
-	C1560.320190,618.205688 1554.224365,620.661743 1548.452271,616.814697 
-	C1547.569092,617.318848 1546.356079,618.011230 1545.143066,618.703613 
-	C1544.817383,615.559448 1544.491577,612.415405 1544.165894,609.271301 
-	C1545.020142,608.852112 1545.874512,608.432983 1546.728882,608.013794 
-	C1547.371948,609.226440 1548.015015,610.439148 1548.004395,610.419067 
-	C1551.208130,610.165405 1554.057373,610.485291 1556.492798,609.628784 
-	C1560.976440,608.051941 1566.925659,612.862976 1570.172241,605.905945 
-	C1571.434570,607.407471 1572.423340,608.583618 1573.451050,609.806091 
-	C1572.864136,611.049255 1572.268066,612.311951 1571.679688,613.972168 
-M1557.343750,611.410950 
-	C1555.540527,612.107239 1553.737305,612.803467 1551.934204,613.499695 
-	C1552.281860,614.348755 1552.740234,615.959534 1552.959839,615.927673 
-	C1554.884277,615.647827 1556.809204,615.196411 1558.646362,614.547974 
-	C1559.959839,614.084412 1561.138916,613.240112 1563.060913,612.193970 
-	C1560.938354,611.900452 1559.578125,611.712341 1557.343750,611.410950 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M576.712158,184.882599 
-	C568.667175,188.448029 572.761292,180.030731 569.516968,177.484467 
-	C569.201172,180.413742 568.953308,182.713272 568.636475,185.651947 
-	C563.799622,185.051865 558.724976,187.639877 554.411011,183.049789 
-	C553.818665,182.419525 551.406555,183.179779 550.008911,183.731735 
-	C548.972900,184.140854 548.215698,185.256134 547.334351,186.056839 
-	C546.827820,185.773193 546.321350,185.489548 545.814880,185.205887 
-	C547.479248,181.037796 549.072327,176.836136 550.980469,172.782791 
-	C551.098206,172.532761 554.487000,173.004593 554.999939,173.908691 
-	C556.684998,176.878647 557.745667,180.202805 559.507446,184.521317 
-	C559.976013,180.836319 560.292664,178.346283 560.609314,175.856247 
-	C561.117188,175.835678 561.625122,175.815109 562.132996,175.794540 
-	C562.424316,176.897614 562.754761,177.992188 562.996277,179.106064 
-	C563.259277,180.318649 563.439758,181.549133 563.656189,182.771820 
-	C564.105103,182.827515 564.554016,182.883209 565.002930,182.938904 
-	C565.504211,180.794296 566.005493,178.649704 566.428284,176.841125 
-	C568.773132,175.794601 570.980225,174.809570 574.520325,173.229645 
-	C574.674988,173.486359 575.406189,174.699738 576.420288,176.335449 
-	C572.683533,179.470459 573.793945,182.177521 576.712158,184.882599 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1078.271973,515.587891 
-	C1080.036133,511.224884 1080.086548,511.194885 1085.729004,511.188446 
-	C1086.054810,509.939392 1086.351440,508.666565 1086.744507,507.424255 
-	C1086.811890,507.211273 1087.290527,507.128479 1088.400635,506.578522 
-	C1088.766724,510.355072 1089.104858,513.841125 1089.442871,517.327148 
-	C1091.517822,513.607605 1093.446899,509.918915 1098.100342,511.500549 
-	C1100.157104,512.199585 1101.505981,514.981812 1103.176270,516.818359 
-	C1102.810547,517.254211 1102.444946,517.690063 1102.079346,518.125916 
-	C1099.510010,518.354065 1096.940796,518.582275 1094.138184,518.831177 
-	C1095.080811,524.762939 1099.035522,520.350525 1101.350464,521.115723 
-	C1098.580933,526.168518 1094.461792,525.536011 1089.935791,519.120789 
-	C1089.336182,520.841431 1088.847290,522.244507 1088.318848,523.760925 
-	C1084.627197,523.415771 1079.770874,526.751892 1078.334717,519.644165 
-	C1078.406494,517.882324 1078.339233,516.735107 1078.271973,515.587891 
-M1084.309326,513.650574 
-	C1079.500000,513.383484 1080.767090,516.954956 1080.990234,519.411621 
-	C1081.075928,520.355164 1082.776123,521.152039 1083.740601,522.015686 
-	C1084.515015,520.116821 1085.414917,518.254639 1085.986816,516.296631 
-	C1086.155396,515.719360 1085.397217,514.871399 1084.309326,513.650574 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M774.032288,304.997650 
-	C774.060669,305.171844 774.089111,305.346039 773.718018,305.911682 
-	C772.093933,306.863037 770.869263,307.422943 768.352234,308.573761 
-	C770.926392,308.836426 772.112549,308.957458 773.298645,309.078491 
-	C770.901672,313.791290 767.721191,312.362579 764.714050,310.861511 
-	C764.899048,309.064087 765.019714,307.891541 765.140442,306.718964 
-	C764.092468,306.873322 763.048950,307.106171 761.995605,307.166901 
-	C759.169617,307.329803 756.339966,307.445221 753.510193,307.511261 
-	C753.051392,307.522003 752.279907,307.292542 752.171509,306.988953 
-	C751.567017,305.295685 750.221558,303.114594 750.802368,301.900696 
-	C752.188721,299.003021 750.190125,292.874146 757.063538,294.414703 
-	C760.443665,295.172302 760.981201,297.438110 761.009766,300.352753 
-	C761.025513,301.963165 761.493713,303.569122 762.142517,305.106537 
-	C764.869507,293.838043 764.869507,293.838043 771.615234,295.597168 
-	C771.667847,296.617981 771.343506,297.306396 770.717285,297.734497 
-	C769.048645,297.707184 766.572815,297.767883 766.505188,298.202728 
-	C766.198303,300.178009 766.569885,302.258728 766.697388,304.301514 
-	C768.122131,304.197937 769.546936,304.094330 771.275513,304.107483 
-	C772.397034,304.482056 773.214661,304.739868 774.032288,304.997650 
-M757.701843,297.730621 
-	C756.348938,297.730621 754.995972,297.730621 753.643066,297.730621 
-	C753.745422,298.311035 753.847778,298.891479 753.950134,299.471893 
-	C755.216553,299.193237 756.482971,298.914612 757.701843,297.730621 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M902.803711,101.927307 
-	C902.618958,106.857674 899.315308,107.279335 895.541687,106.850212 
-	C894.955200,108.533165 894.410706,110.095650 893.866272,111.658127 
-	C893.499329,111.633034 893.132446,111.607933 892.765564,111.582832 
-	C892.408020,110.091095 892.050476,108.599358 891.546204,106.495560 
-	C888.751099,106.656464 885.793091,107.099800 882.886841,106.874992 
-	C881.503052,106.767952 879.078125,105.349152 879.104675,104.594131 
-	C879.179749,102.457359 880.277100,100.356552 881.060913,97.970169 
-	C881.196472,98.045204 880.390381,97.598999 879.584290,97.152794 
-	C879.462402,96.626732 879.340576,96.100670 879.218750,95.574608 
-	C881.427917,95.019653 883.894104,93.608574 885.767822,94.171112 
-	C887.367981,94.651543 888.637817,97.258636 889.405701,99.183540 
-	C890.114746,100.960899 889.962585,103.081757 890.189758,105.051308 
-	C890.703491,105.043312 891.217224,105.035316 891.730957,105.027313 
-	C891.925903,101.598595 892.120850,98.169868 892.340942,94.298096 
-	C895.926025,95.131424 900.068298,91.540916 902.316040,97.423019 
-	C902.384521,99.378563 902.594116,100.652939 902.803711,101.927307 
-M898.943787,104.581505 
-	C899.367798,102.429924 899.959167,100.289825 900.108215,98.119385 
-	C900.149963,97.511696 898.969788,96.428795 898.201965,96.267021 
-	C897.436279,96.105690 896.215027,96.585663 895.662842,97.203712 
-	C893.635010,99.473190 895.059692,103.525970 898.943787,104.581505 
-M884.310669,98.715836 
-	C884.830261,98.132553 885.349854,97.549278 885.869385,96.965981 
-	C885.177795,96.710243 884.486145,96.454506 883.794495,96.198753 
-	C883.643188,96.999374 883.491821,97.799995 884.310669,98.715836 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1278.923706,216.097336 
-	C1278.447998,216.754044 1277.753662,217.344315 1277.530884,218.077835 
-	C1275.409424,225.059555 1273.138794,225.576385 1267.215332,220.352951 
-	C1261.811646,225.074158 1258.716919,225.084869 1255.744629,220.101486 
-	C1258.189087,220.504547 1260.431885,220.874374 1262.674683,221.244186 
-	C1262.847046,220.697144 1263.019409,220.150101 1263.191895,219.603058 
-	C1262.023438,218.985092 1260.663574,218.571945 1259.731567,217.701096 
-	C1258.337280,216.398499 1257.243652,214.773987 1256.022217,213.286407 
-	C1257.955688,212.389755 1259.822021,211.086121 1261.848267,210.752182 
-	C1263.025513,210.558167 1264.459473,211.920792 1265.402100,213.677658 
-	C1263.393311,213.416687 1261.384644,213.155716 1259.375854,212.894745 
-	C1259.223145,213.313721 1259.070435,213.732712 1258.917725,214.151703 
-	C1260.253662,214.818192 1261.622559,215.426910 1262.916382,216.167007 
-	C1264.284058,216.949432 1265.580200,217.857010 1267.011719,218.776840 
-	C1267.610718,215.193451 1267.392944,211.056595 1272.418335,210.502563 
-	C1276.007080,210.106918 1278.040161,211.895432 1278.877441,215.686905 
-	C1278.931274,216.074249 1278.923706,216.097351 1278.923706,216.097336 
-M1270.781250,219.308441 
-	C1273.886230,222.267517 1273.976440,222.255051 1276.929932,217.873398 
-	C1274.607666,218.073410 1272.760010,218.232529 1270.781250,219.308441 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1040.873535,708.526550 
-	C1047.165527,708.387573 1053.456909,708.217163 1059.749512,708.121033 
-	C1063.738281,708.060059 1067.728516,708.109619 1071.718140,708.109619 
-	C1071.743408,708.690918 1071.768677,709.272278 1071.793945,709.853577 
-	C1070.182251,710.341431 1068.570435,710.829346 1066.088379,711.580627 
-	C1066.088379,715.875854 1066.088379,720.315063 1066.088379,724.754333 
-	C1065.326660,724.780396 1064.564941,724.806519 1063.803101,724.832642 
-	C1063.577393,720.340698 1063.351562,715.848755 1063.102661,710.896240 
-	C1059.659912,710.896240 1056.442139,710.896240 1052.675049,710.896240 
-	C1052.463745,715.663025 1052.261475,720.224243 1052.059204,724.785400 
-	C1051.270020,724.795227 1050.480835,724.804993 1049.691528,724.814819 
-	C1049.471558,720.311646 1049.251587,715.808472 1049.025391,711.179993 
-	C1046.910645,710.771545 1044.998779,710.402283 1042.862671,709.989685 
-	C1042.398315,714.886963 1041.940430,719.715454 1041.219971,724.009644 
-	C1040.929443,718.492432 1040.901489,713.509460 1040.873535,708.526550 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M75.025070,603.692688 
-	C71.480896,605.644897 68.156113,606.015503 65.818741,602.644226 
-	C59.690556,606.914246 53.072754,603.420166 46.361309,605.500549 
-	C46.361309,600.849304 46.248108,597.225342 46.448147,593.618835 
-	C46.493046,592.809326 47.633419,592.060486 48.269463,591.283752 
-	C48.765209,592.027527 49.578716,592.726868 49.690216,593.524292 
-	C49.918571,595.157410 49.881077,596.851624 49.753922,598.505371 
-	C49.478668,602.085327 51.228889,602.874390 54.303673,602.034119 
-	C56.685287,593.960571 59.360363,592.958069 65.513672,597.908081 
-	C68.000946,595.851135 70.435852,592.961304 73.953247,597.009399 
-	C74.073769,597.410767 74.032700,597.493347 73.596436,597.550354 
-	C71.749748,598.473694 70.339317,599.339966 68.928879,600.206238 
-	C70.313782,600.918701 71.660980,601.727783 73.104126,602.291016 
-	C73.606018,602.487000 74.345261,602.074890 74.996246,602.160889 
-	C75.019279,602.818481 75.022171,603.255554 75.025070,603.692688 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M115.329926,185.849152 
-	C108.214325,188.621170 103.414375,186.351257 103.271545,180.350616 
-	C103.156944,175.536133 107.655342,172.085678 112.436661,173.203262 
-	C114.531898,173.693024 116.694534,173.894455 119.789833,174.376984 
-	C119.789833,175.301071 119.789833,177.040192 119.789833,178.779297 
-	C119.789833,180.414597 119.789833,182.049881 119.789833,183.876373 
-	C122.007439,184.237427 123.763649,184.523361 126.298355,184.936035 
-	C126.298355,181.948151 126.148911,179.189423 126.372231,176.461212 
-	C126.461021,175.376450 127.375412,174.359238 127.913940,173.311279 
-	C128.552094,174.258011 129.675446,175.172623 129.740601,176.157272 
-	C129.967636,179.588394 129.828400,183.043762 129.828400,187.362457 
-	C124.662674,186.804962 120.205246,186.323914 115.329926,185.849152 
-M108.884003,176.328400 
-	C108.334129,178.361038 107.784248,180.393677 107.234375,182.426315 
-	C110.098900,183.109146 112.963432,183.791977 116.159691,184.553879 
-	C116.159691,180.988083 116.159691,178.714081 116.159691,176.453949 
-	C113.842949,176.306808 111.744926,176.173569 108.884003,176.328400 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1142.772705,177.192291 
-	C1143.970459,180.125320 1145.032715,182.709976 1146.094971,185.294632 
-	C1146.433472,185.282135 1146.771851,185.269653 1147.110352,185.257172 
-	C1147.110352,182.452179 1146.825928,179.605026 1147.232544,176.860275 
-	C1147.430298,175.524918 1148.781372,173.487793 1149.851074,173.322113 
-	C1152.760742,172.871384 1156.378662,172.734787 1157.181274,176.532806 
-	C1157.504028,178.059601 1156.041504,180.340271 1154.784668,181.728180 
-	C1153.241333,183.432388 1151.062866,184.561356 1149.158936,185.939011 
-	C1149.182007,186.565598 1149.205078,187.192184 1149.228027,187.818771 
-	C1146.785034,186.705200 1144.428467,185.246796 1141.867310,184.604080 
-	C1140.264404,184.201813 1138.306274,184.866562 1136.599365,185.366394 
-	C1135.668823,185.638901 1134.929932,186.566101 1134.104614,187.198059 
-	C1133.667358,186.956604 1133.230103,186.715134 1132.792847,186.473679 
-	C1134.372070,182.439560 1135.235352,177.874390 1137.726196,174.516724 
-	C1140.358643,170.968384 1141.550049,174.749359 1142.772705,177.192291 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1317.086548,213.946030 
-	C1318.567139,210.053040 1321.678345,209.586304 1324.793701,211.105103 
-	C1327.455078,212.402634 1329.111084,214.778290 1326.840698,218.036758 
-	C1326.521973,218.494125 1327.051392,220.270203 1327.334473,220.306854 
-	C1330.261108,220.685883 1333.217896,220.832794 1336.166260,221.044296 
-	C1336.301514,220.578476 1336.436768,220.112671 1336.571899,219.646851 
-	C1335.450317,219.002075 1334.135376,218.550644 1333.252197,217.667450 
-	C1331.907227,216.322235 1330.861328,214.678024 1329.688354,213.160782 
-	C1331.493164,212.297989 1333.242432,210.950821 1335.121582,210.734909 
-	C1336.477173,210.579147 1338.005737,211.928772 1339.457153,212.606979 
-	C1339.298340,213.000198 1339.139526,213.393417 1338.980835,213.786621 
-	C1337.057739,213.457336 1335.134644,213.128067 1333.211548,212.798782 
-	C1333.027832,213.215546 1332.844116,213.632294 1332.660522,214.049057 
-	C1333.738525,214.674393 1335.039795,215.094666 1335.844849,215.970795 
-	C1337.219238,217.466644 1338.282227,219.248398 1339.476074,220.910095 
-	C1337.365845,221.829086 1335.302979,223.291534 1333.129150,223.480759 
-	C1331.617065,223.612381 1329.952759,221.995148 1328.106934,221.028595 
-	C1324.667969,223.843979 1320.918457,225.628479 1317.134521,220.171844 
-	C1316.889282,219.211426 1316.797729,218.881805 1316.595459,218.235016 
-	C1316.603271,217.037003 1316.721802,216.156158 1316.894409,215.054932 
-	C1316.998169,214.538940 1317.044189,214.242767 1317.086548,213.946030 
-M1325.061035,220.013489 
-	C1324.614746,217.433594 1324.569824,217.421249 1319.898682,218.593826 
-	C1319.802368,219.051712 1319.706177,219.509598 1319.609863,219.967484 
-	C1321.181396,220.192139 1322.752808,220.416794 1325.061035,220.013489 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M770.155884,733.691223 
-	C770.767578,733.662170 771.524475,733.857239 771.968750,733.569641 
-	C776.794189,730.444946 776.780823,730.424316 780.842712,733.231445 
-	C785.224731,731.853821 789.115479,730.630615 793.421265,729.276978 
-	C793.912903,729.924866 794.864319,731.178772 795.815735,732.432678 
-	C795.503418,732.437256 795.191040,732.441833 794.878662,732.446411 
-	C794.878662,735.140930 794.878662,737.835510 794.878662,740.742493 
-	C791.356506,741.708923 791.233887,741.576416 790.035217,734.459595 
-	C787.359619,734.352600 787.359619,734.352600 784.460815,741.693481 
-	C783.416870,740.853577 782.487366,740.105774 781.325378,739.170837 
-	C777.866455,743.309570 774.262329,741.645020 770.336670,738.426514 
-	C770.040527,736.518311 770.098206,735.104797 770.155884,733.691223 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M247.109512,380.321320 
-	C243.616043,381.898712 240.658157,380.981232 239.340271,377.536621 
-	C237.970505,373.956451 238.110229,370.264862 242.639954,368.476318 
-	C243.544891,369.494049 244.079483,370.160309 244.614059,370.826599 
-	C245.073578,369.916534 245.533112,369.006500 245.992645,368.096436 
-	C247.626556,369.318115 249.260468,370.539795 251.122360,371.931946 
-	C253.052521,366.402679 257.763916,367.690338 262.110779,368.398132 
-	C262.110779,374.169922 262.110779,379.885986 262.110779,385.602020 
-	C261.583984,385.645721 261.057190,385.689423 260.530396,385.733124 
-	C260.224487,384.184509 259.918579,382.635864 259.545044,380.744995 
-	C254.895035,381.862976 251.834656,380.221924 251.205414,375.088074 
-	C248.149506,375.088074 245.252457,375.088074 242.355423,375.088074 
-	C242.156555,375.602142 241.957703,376.116211 241.758835,376.630249 
-	C243.230621,377.200592 244.702408,377.770935 246.596436,378.591217 
-	C247.048965,379.334564 247.079239,379.827942 247.109512,380.321320 
-M254.463974,375.911377 
-	C255.422791,376.838898 256.381622,377.766388 257.340454,378.693909 
-	C258.174591,377.589783 259.783264,376.401642 259.674591,375.399750 
-	C259.475311,373.562195 258.263184,371.834473 257.473328,370.060974 
-	C256.431030,371.758636 255.388702,373.456299 254.463974,375.911377 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1203.941650,780.211426 
-	C1201.889648,779.885864 1200.201172,779.740662 1197.397705,779.499634 
-	C1197.397705,777.968750 1197.587402,775.399231 1197.303589,772.883179 
-	C1197.191284,771.888123 1196.025513,771.011841 1195.339355,770.081421 
-	C1194.460327,770.917969 1193.004395,771.641113 1192.813354,772.612976 
-	C1192.300781,775.219116 1192.329468,777.931641 1192.143066,780.601929 
-	C1191.470703,780.617004 1190.798218,780.632080 1190.125854,780.647095 
-	C1189.915894,776.637268 1189.705933,772.627380 1189.497559,768.646973 
-	C1200.920044,766.694397 1199.828125,768.179688 1200.704956,776.942322 
-	C1202.181885,777.305542 1203.682129,777.760864 1205.215454,778.024048 
-	C1206.435791,778.233643 1207.696533,778.208435 1208.939453,778.287415 
-	C1209.063965,777.829834 1209.188477,777.372253 1209.313110,776.914612 
-	C1208.310547,776.296692 1207.179810,775.816650 1206.334229,775.029968 
-	C1204.906006,773.701172 1203.658325,772.178162 1202.334717,770.736816 
-	C1203.557983,769.760986 1204.759277,768.019653 1206.009399,767.984009 
-	C1208.017334,767.926819 1210.057251,768.997498 1212.083740,769.591614 
-	C1211.914917,770.087280 1211.746216,770.582947 1211.577393,771.078674 
-	C1209.690186,770.735901 1207.802979,770.393127 1205.915771,770.050415 
-	C1205.747437,770.515442 1205.579102,770.980469 1205.410767,771.445496 
-	C1206.575073,772.073059 1207.951782,772.485840 1208.853760,773.378479 
-	C1210.203613,774.714355 1211.219360,776.387878 1212.377197,777.917786 
-	C1210.654053,778.942993 1209.004395,780.144714 1207.172119,780.908203 
-	C1206.419067,781.222168 1205.272461,780.592346 1203.941650,780.211426 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M811.967163,306.818268 
-	C811.720093,308.542908 811.473083,310.267548 811.226013,311.992188 
-	C810.681091,312.336823 810.136169,312.681488 809.591248,313.026123 
-	C809.374512,312.246887 809.035156,311.479065 808.961121,310.686462 
-	C808.531189,306.082367 804.996704,307.170197 802.181213,306.934357 
-	C800.327026,306.779053 797.880066,307.281342 796.796143,306.289520 
-	C795.854248,305.427704 796.184692,302.844147 796.428955,301.087708 
-	C796.901917,297.686462 796.437927,293.252533 802.295776,294.437347 
-	C805.949585,295.176300 806.398804,297.734863 806.331421,300.808014 
-	C806.301270,302.185852 806.642273,303.571838 806.814819,304.954132 
-	C807.342407,304.966339 807.869995,304.978546 808.397583,304.990753 
-	C808.528503,302.602936 808.877441,300.202057 808.735474,297.830597 
-	C808.556885,294.848145 809.933228,294.424042 812.666870,295.384827 
-	C812.992920,296.092834 812.985901,296.507751 812.755615,297.255127 
-	C812.682190,300.110321 812.832031,302.633026 812.870300,305.372925 
-	C812.494873,305.999512 812.231018,306.408875 811.967163,306.818268 
-M799.524963,297.643677 
-	C800.497498,298.186737 801.470093,298.729828 802.442627,299.272888 
-	C802.645813,298.687286 802.848938,298.101715 803.052063,297.516113 
-	C802.125061,297.339203 801.197998,297.162292 799.524963,297.643677 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M528.887390,183.223175 
-	C528.405212,183.132233 527.628479,182.805161 527.484253,182.985107 
-	C524.268860,186.997009 520.773193,186.607849 517.165649,183.453659 
-	C514.312744,185.227310 511.668915,186.870987 507.849945,189.245239 
-	C507.579163,184.796585 507.330017,180.703308 507.001495,175.306183 
-	C510.790863,176.063660 513.665222,176.662827 516.551941,177.194977 
-	C517.144897,177.304260 517.976929,177.409134 518.372131,177.099319 
-	C522.380310,173.957275 525.329834,176.142975 528.588135,179.287048 
-	C528.951355,180.837753 528.919373,182.030472 528.887390,183.223175 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M380.824707,227.533630 
-	C384.628448,223.295334 386.897034,223.509354 391.944092,228.582672 
-	C395.737549,223.679611 398.851074,223.316772 402.781952,227.856796 
-	C400.320953,227.588974 398.306885,227.369781 396.292816,227.150589 
-	C396.144775,227.552734 395.996735,227.954865 395.848694,228.357010 
-	C397.000916,228.966370 398.388367,229.347351 399.251923,230.236938 
-	C400.659271,231.686615 401.724487,233.468445 402.934052,235.110138 
-	C400.999481,236.054123 399.108063,237.614929 397.117218,237.754059 
-	C395.412231,237.873215 393.593414,236.363876 391.296234,235.338867 
-	C388.602997,237.463654 385.249634,239.689545 381.235474,235.408173 
-	C380.959961,232.332413 380.892334,229.933029 380.824707,227.533630 
-M395.129364,231.344650 
-	C394.127533,230.546188 393.125702,229.747726 392.123871,228.949280 
-	C392.221832,229.444275 392.319794,229.939285 392.417755,230.434296 
-	C389.333374,231.228455 386.249023,232.022614 382.593964,232.963715 
-	C386.497711,238.234863 392.168732,232.303894 396.225830,235.119980 
-	C397.022949,235.673279 398.603729,235.097565 399.823090,235.042557 
-	C399.897430,234.550079 399.971802,234.057617 400.046143,233.565140 
-	C398.639496,232.940903 397.232819,232.316666 395.129364,231.344650 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M717.555054,293.662903 
-	C718.730591,292.508759 719.763794,291.684845 720.796997,290.860901 
-	C721.299988,291.934174 722.195374,292.992462 722.237061,294.083344 
-	C722.403992,298.452454 722.306030,302.831726 722.306030,307.207214 
-	C721.605225,307.285980 720.904419,307.364777 720.203552,307.443542 
-	C719.721924,305.048248 719.240356,302.652924 718.629028,299.612579 
-	C717.118774,302.528015 715.831238,305.013550 713.898438,308.744812 
-	C712.109497,304.763916 710.880493,302.028870 709.165894,298.213226 
-	C708.659424,302.005493 708.307068,304.644165 707.954651,307.282837 
-	C707.321228,307.248016 706.687805,307.213196 706.054382,307.178345 
-	C706.054382,302.197205 706.006226,297.214844 706.130554,292.236786 
-	C706.142700,291.751526 707.325012,290.822205 707.777527,290.924438 
-	C708.598450,291.109955 709.629700,291.760620 709.955933,292.492310 
-	C711.226624,295.342041 712.255127,298.299744 713.960144,302.746826 
-	C715.449646,298.970215 716.431152,296.481628 717.555054,293.662903 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M951.030151,66.356140 
-	C951.761841,65.498978 952.493530,64.641830 953.351562,63.636696 
-	C954.411621,64.846115 955.342224,65.907761 955.390137,65.962425 
-	C955.390137,70.156410 955.390137,73.332687 955.390137,77.511330 
-	C957.579285,74.470520 959.056030,72.419296 960.563477,70.325417 
-	C960.048584,70.032425 959.161255,69.527489 958.273865,69.022552 
-	C958.220276,68.484711 958.166687,67.946869 958.113037,67.409035 
-	C960.412781,66.943825 962.989441,65.640533 964.924133,66.279968 
-	C966.457397,66.786766 967.546387,69.560677 968.205627,71.537071 
-	C968.903320,73.628677 968.859680,75.967590 969.256958,79.131462 
-	C963.275818,78.508545 957.143799,77.869911 950.560181,77.051643 
-	C950.108521,76.872009 950.033203,76.522392 950.538025,76.454178 
-	C951.044434,73.530525 951.046021,70.675087 951.045654,67.575638 
-	C951.045776,67.006371 951.041260,66.681206 951.030151,66.356140 
-M963.248657,68.144119 
-	C962.686829,68.745750 962.125000,69.347382 961.563110,69.948997 
-	C962.426392,70.178368 963.289612,70.407745 964.152893,70.637131 
-	C964.151794,69.875084 964.150635,69.113029 963.248657,68.144119 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M63.647415,173.964294 
-	C65.717697,172.247345 66.607567,173.113892 66.714417,175.423904 
-	C66.790421,177.067215 66.729164,178.716873 66.729164,180.408356 
-	C68.928940,179.168427 70.807762,177.307709 72.750435,177.238449 
-	C74.717949,177.168335 76.748611,178.869843 78.719414,179.780472 
-	C79.031746,179.211243 79.634270,178.113144 80.940086,175.733276 
-	C81.759491,179.610428 82.257828,181.968384 82.756157,184.326324 
-	C83.227226,184.335327 83.698288,184.344330 84.169350,184.353333 
-	C84.699226,181.931519 85.229111,179.509689 85.758987,177.087875 
-	C86.257545,177.135376 86.756096,177.182877 87.254654,177.230377 
-	C87.254654,180.271637 87.254654,183.312912 87.254654,186.746902 
-	C84.148483,186.454849 80.042953,189.217743 78.699203,183.414597 
-	C74.122025,188.659241 71.137077,188.642593 67.931862,184.018234 
-	C66.661903,184.869507 65.410805,185.708145 63.995880,185.834442 
-	C63.770504,181.402832 63.708958,177.683563 63.647415,173.964294 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M45.012302,838.959106 
-	C49.257244,835.530212 54.426285,837.355957 59.132912,836.699768 
-	C61.034496,836.434570 63.223145,838.228027 65.544289,839.194153 
-	C65.810333,837.419434 66.189224,834.891968 66.568115,832.364502 
-	C67.071678,832.377319 67.575233,832.390137 68.078796,832.403015 
-	C68.078796,837.015503 68.078796,841.628052 68.078796,846.783264 
-	C62.762108,846.783264 57.222790,847.036072 51.727982,846.651978 
-	C49.690823,846.509644 47.758163,844.872437 45.391022,843.586487 
-	C45.006893,841.823669 45.009598,840.391357 45.012302,838.959106 
-M56.477989,838.907104 
-	C55.521088,838.937561 54.508728,838.780579 53.620541,839.043335 
-	C52.343575,839.421143 51.010563,839.928833 50.016014,840.758301 
-	C49.694199,841.026672 50.215405,843.187866 50.602146,843.267761 
-	C52.093983,843.576111 53.867138,843.832825 55.200512,843.288513 
-	C57.160412,842.488281 58.833309,840.985107 61.558834,839.157654 
-	C59.388332,839.157654 58.286175,839.157654 56.477989,838.907104 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M155.996613,229.056015 
-	C156.000229,228.597656 156.003860,228.139282 156.004883,227.337036 
-	C161.166824,228.139893 162.913071,230.607986 162.929718,237.175018 
-	C162.975510,255.237045 162.962601,273.299225 162.981750,291.860657 
-	C162.521866,292.593964 162.053116,292.827881 160.989960,292.765991 
-	C160.256973,290.673248 160.001389,288.876556 159.998032,287.079376 
-	C159.967239,270.538513 160.165985,253.993454 159.801331,237.460587 
-	C159.738953,234.632462 157.324493,231.856216 155.996613,229.056015 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1110.198730,182.788269 
-	C1110.198486,180.524078 1110.198486,178.702744 1110.198486,176.985779 
-	C1105.351318,174.771271 1100.745483,176.992416 1102.255493,180.631821 
-	C1103.098755,182.664536 1104.718872,184.374908 1105.989014,186.230545 
-	C1105.572754,186.661087 1105.156494,187.091629 1104.740356,187.522171 
-	C1102.696167,185.817017 1100.652100,184.111862 1098.274902,182.128860 
-	C1098.084473,183.041855 1098.074829,183.828308 1097.752808,184.453934 
-	C1097.292847,185.347382 1096.604248,186.123062 1096.013184,186.949020 
-	C1095.433716,186.111710 1094.460083,185.321533 1094.353271,184.427719 
-	C1094.098145,182.294098 1094.045532,180.086105 1094.308594,177.957291 
-	C1094.505127,176.366760 1095.322510,174.852982 1095.863403,173.305008 
-	C1096.789429,174.620071 1097.715454,175.935135 1098.778198,177.444321 
-	C1103.682617,170.412064 1110.757202,173.544983 1117.729248,174.141998 
-	C1112.851562,175.859955 1113.711914,179.621902 1113.647461,183.136505 
-	C1113.624023,184.407700 1112.742188,185.663147 1112.251953,186.925781 
-	C1111.567627,185.694214 1110.883423,184.462662 1110.198730,182.788269 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1141.857178,752.861145 
-	C1137.366577,749.480896 1137.440063,748.350830 1142.056396,744.458191 
-	C1141.220215,743.993347 1140.413940,743.545166 1139.607788,743.097046 
-	C1139.477661,742.580261 1139.347534,742.063477 1139.217407,741.546692 
-	C1141.416992,740.971191 1143.854858,739.550293 1145.742065,740.082458 
-	C1147.306885,740.523804 1148.535278,743.135193 1149.331177,745.029480 
-	C1150.014404,746.655945 1149.874756,748.628113 1150.098999,750.447327 
-	C1150.611328,750.443726 1151.123779,750.440063 1151.636108,750.436401 
-	C1151.891846,745.470337 1152.147583,740.504211 1152.403320,735.538086 
-	C1153.067993,735.527039 1153.732666,735.515991 1154.397461,735.504944 
-	C1155.502319,740.866943 1154.618774,746.403198 1154.886353,752.182739 
-	C1150.491577,752.444946 1146.380615,752.690308 1141.857178,752.861145 
-M1145.270752,744.593079 
-	C1145.105835,743.783508 1144.941040,742.973877 1144.776245,742.164246 
-	C1144.088257,742.433777 1143.400391,742.703308 1142.712402,742.972900 
-	C1143.244995,743.546387 1143.777466,744.119873 1145.270752,744.593079 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M767.046143,241.997803 
-	C767.046204,232.908569 767.046204,224.318832 767.046204,215.388641 
-	C769.515564,214.214279 770.927612,214.886581 770.917664,218.263168 
-	C770.877502,231.880325 770.960876,245.498444 770.785278,259.113464 
-	C770.771545,260.175476 769.110779,261.216156 768.215454,262.266724 
-	C767.729370,261.147369 766.837708,260.032166 766.826172,258.907928 
-	C766.770264,253.439056 766.949829,247.967758 767.046143,241.997803 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M155.980682,441.193573 
-	C155.996414,440.968262 156.012131,440.742920 156.065186,440.179504 
-	C160.782516,440.768921 161.967667,444.041138 161.965073,448.291992 
-	C161.953766,466.783569 162.008591,485.275116 162.088684,504.206543 
-	C161.656677,504.757202 161.175354,504.867981 160.018280,504.698975 
-	C159.222351,502.612122 159.000839,500.805237 158.997803,498.997955 
-	C158.970230,482.571136 159.122894,466.141846 158.845352,449.719666 
-	C158.797058,446.862305 156.980499,444.034851 155.980682,441.193573 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M763.452759,454.571289 
-	C764.050598,455.212402 764.943176,456.297546 764.945862,457.384857 
-	C765.019897,487.729675 765.009521,518.074646 764.969788,548.419556 
-	C764.968811,549.158081 764.475586,549.895935 763.864197,550.755981 
-	C763.429199,535.237305 763.296509,519.596741 763.267456,503.956055 
-	C763.237183,487.642944 763.306763,471.329590 763.452759,454.571289 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1519.113525,189.048553 
-	C1520.719971,188.884247 1522.416870,188.315125 1523.912231,188.648804 
-	C1526.263428,189.173538 1528.479004,190.306320 1531.100464,191.315872 
-	C1532.634766,186.546661 1537.939941,189.556427 1541.915649,188.918365 
-	C1542.861206,188.766586 1544.225220,191.223038 1546.160156,193.298782 
-	C1542.885010,193.866013 1541.164429,194.163986 1539.443970,194.461960 
-	C1539.385864,194.751801 1539.327759,195.041656 1539.269653,195.331497 
-	C1540.940308,195.729965 1542.611084,196.128433 1544.377930,196.549850 
-	C1540.248657,200.319824 1538.492676,199.737274 1535.142578,194.409210 
-	C1533.177368,195.639572 1531.209351,196.871628 1529.241455,198.103668 
-	C1528.102905,195.743240 1526.964233,193.382828 1525.019043,189.350327 
-	C1523.594971,192.245255 1522.896118,193.920609 1521.970947,195.459885 
-	C1521.319946,196.542801 1520.361084,197.440536 1519.308716,197.749619 
-	C1519.089600,194.401718 1519.101562,191.725143 1519.113525,189.048553 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M160.290985,571.730347 
-	C159.479370,571.581116 158.972427,571.199585 158.244019,570.479736 
-	C158.342239,567.370605 158.923538,564.601257 158.938568,561.828796 
-	C159.026550,545.619202 158.954514,529.408813 159.022247,513.199036 
-	C159.029465,511.474976 159.592926,509.753204 159.898315,508.030396 
-	C160.419998,508.256927 160.941666,508.483459 161.721466,508.834229 
-	C161.968948,527.575195 162.003540,546.192261 161.888199,564.808350 
-	C161.874359,567.040833 161.046295,569.268250 160.290985,571.730347 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M808.042236,180.075806 
-	C808.196289,182.469254 808.350403,184.862686 808.548279,187.936188 
-	C807.061707,186.980637 805.420288,185.925537 803.050415,184.943146 
-	C801.827759,185.032379 801.333618,185.048874 800.839417,185.065369 
-	C800.523804,184.490158 800.208252,183.914932 799.886963,183.329391 
-	C794.986206,188.506271 790.303528,189.458832 786.948730,185.983810 
-	C784.294678,183.234680 784.511536,178.145905 787.388855,175.656418 
-	C790.946228,172.578537 795.379761,173.705505 799.839355,179.048630 
-	C800.107605,177.729187 800.329224,176.639130 801.073853,175.265228 
-	C802.074036,174.987335 802.551147,174.993286 803.028259,174.999237 
-	C803.412048,179.749588 803.412048,179.749588 806.225769,179.295135 
-	C807.220276,179.420578 807.631226,179.748199 808.042236,180.075806 
-M793.319214,185.187363 
-	C796.664917,183.923767 796.680969,181.221954 795.477905,178.734863 
-	C794.975342,177.695938 792.423096,176.603409 791.530212,177.036148 
-	C790.083740,177.737244 788.084473,180.042007 788.392151,181.011429 
-	C788.930420,182.706848 791.041748,183.902924 793.319214,185.187363 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1593.999512,613.243408 
-	C1593.815796,615.277588 1593.723389,616.894958 1593.671265,617.805847 
-	C1590.618164,618.274475 1587.947144,619.356079 1585.594482,618.876343 
-	C1582.630127,618.271667 1579.886353,616.463196 1577.167847,614.956726 
-	C1576.881470,614.798035 1577.219727,612.440552 1577.582275,612.349121 
-	C1581.084106,611.466553 1583.700195,606.821655 1588.368408,610.158630 
-	C1589.564941,611.013916 1592.396729,609.285278 1594.473022,609.301208 
-	C1596.088257,609.313660 1598.772949,609.823975 1599.093018,610.759399 
-	C1599.850464,612.972961 1599.536377,615.572327 1599.497681,618.013123 
-	C1599.493164,618.294983 1598.141357,618.907532 1598.009888,618.774963 
-	C1597.395874,618.156860 1596.842285,617.385193 1596.544556,616.567383 
-	C1596.023315,615.135925 1595.704712,613.630493 1595.301270,612.156067 
-	C1594.897827,612.379578 1594.494263,612.603149 1593.999512,613.243408 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M783.988403,401.552856 
-	C780.561951,404.481995 779.299011,402.311737 778.802185,399.177521 
-	C778.432861,396.847198 778.524658,394.443726 778.411133,392.072845 
-	C777.890686,392.057709 777.370300,392.042572 776.849915,392.027435 
-	C776.541321,395.417267 776.232788,398.807068 775.820190,403.340302 
-	C772.346985,402.405762 767.818665,402.504486 766.557861,400.523499 
-	C764.881531,397.889709 765.751770,393.635193 765.527893,390.076965 
-	C766.349609,390.029114 767.171387,389.981262 767.993103,389.933411 
-	C768.156738,392.175751 768.089966,394.468933 768.569336,396.641602 
-	C768.862122,397.968628 769.994446,399.110443 770.749695,400.335449 
-	C771.611755,399.091980 772.915283,397.949524 773.228455,396.580475 
-	C773.657837,394.703796 773.335815,392.655243 773.335815,391.312775 
-	C776.172546,389.962891 778.430054,388.888611 781.056824,387.638672 
-	C781.639343,388.331268 782.667175,389.553436 783.855347,391.091187 
-	C784.015747,391.406830 784.026978,391.456665 783.612549,391.610718 
-	C780.522949,395.262512 781.010376,398.503876 784.005981,401.561523 
-	C784.021179,401.579865 783.988403,401.552856 783.988403,401.552856 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M161.986725,744.540466 
-	C161.486755,745.294434 160.979095,745.578979 159.892700,745.624878 
-	C159.203354,743.572083 159.001694,741.758057 158.996231,739.943542 
-	C158.940170,721.311829 158.915878,702.679993 158.882736,684.048218 
-	C159.113785,684.034485 159.344818,684.020691 159.924744,683.982666 
-	C160.831909,685.921143 161.860474,687.880493 161.875122,689.847290 
-	C162.009827,707.921143 161.968857,725.996216 161.986725,744.540466 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1045.892334,752.294739 
-	C1045.214478,749.905457 1044.536377,747.516174 1043.554688,744.056335 
-	C1042.707153,746.544922 1042.336304,748.284363 1041.529785,749.790466 
-	C1040.913574,750.941162 1039.745972,751.796631 1038.823730,752.783447 
-	C1038.128662,751.768311 1037.306519,750.814758 1036.775757,749.719971 
-	C1036.279419,748.696167 1036.092163,747.522583 1035.393677,745.129211 
-	C1034.564941,747.824036 1034.224121,749.484253 1033.525269,750.976807 
-	C1033.164795,751.746704 1032.241943,752.500732 1031.429077,752.715210 
-	C1030.965088,752.837646 1029.850464,751.979248 1029.646973,751.359558 
-	C1028.444946,747.699646 1027.424316,743.980103 1026.342651,740.280579 
-	C1027.061157,740.009644 1027.779785,739.738708 1028.498413,739.467712 
-	C1029.492798,741.894653 1030.487183,744.321594 1031.308472,746.325928 
-	C1032.592163,744.329956 1034.015015,742.117432 1035.437988,739.904907 
-	C1036.679443,741.854431 1037.920776,743.803955 1039.339722,746.032349 
-	C1041.125122,743.853638 1039.973877,738.553589 1045.596436,740.642700 
-	C1045.956787,744.815186 1045.924561,748.554993 1045.892334,752.294739 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1084.804565,769.264587 
-	C1084.950928,767.332886 1085.096680,765.821716 1085.323730,763.467041 
-	C1087.253540,766.143372 1088.503418,778.679871 1087.136597,779.667725 
-	C1086.369995,780.221802 1083.974609,779.802368 1083.324829,779.001099 
-	C1081.274170,776.472168 1079.700806,773.555969 1076.761719,770.880310 
-	C1076.621338,772.499695 1076.473022,774.118408 1076.343018,775.738647 
-	C1076.217407,777.303284 1076.110596,778.869446 1075.995605,780.434937 
-	C1075.287598,780.451660 1074.579590,780.468384 1073.871704,780.485107 
-	C1073.813354,777.481628 1073.549805,774.463684 1073.760986,771.479248 
-	C1073.934204,769.029114 1074.671875,766.618896 1075.159302,764.190979 
-	C1076.887573,765.994019 1078.708252,767.719421 1080.314087,769.625549 
-	C1081.528076,771.066528 1082.468140,772.738464 1084.516479,773.920349 
-	C1084.612305,772.508545 1084.708130,771.096802 1084.804565,769.264587 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1493.363037,404.635925 
-	C1494.906616,405.586212 1496.103760,406.431488 1497.371460,407.326508 
-	C1497.975220,406.420929 1498.659546,405.394562 1499.992798,403.394928 
-	C1500.717163,406.827332 1501.210083,409.162750 1501.702881,411.498169 
-	C1502.193481,411.513580 1502.684082,411.528961 1503.174683,411.544373 
-	C1503.707764,409.161987 1504.240845,406.779572 1504.773926,404.397156 
-	C1505.262573,404.443237 1505.751099,404.489319 1506.239624,404.535370 
-	C1506.239624,407.722839 1506.239624,410.910278 1506.239624,415.141174 
-	C1503.207642,414.434418 1500.282349,413.752533 1496.853394,412.953217 
-	C1494.940552,413.236267 1492.002563,414.168030 1489.234253,413.805267 
-	C1488.292969,413.681854 1486.674927,409.652771 1487.319458,408.546906 
-	C1488.383423,406.721466 1491.034546,405.821167 1493.363037,404.635925 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M312.228821,371.829193 
-	C313.198181,372.474823 314.128479,372.634125 314.667175,373.179962 
-	C316.125336,374.657318 317.417206,376.298859 318.775024,377.875275 
-	C316.589447,378.892151 314.486298,380.221436 312.192169,380.826965 
-	C310.358551,381.310913 308.276031,381.062805 306.336182,380.848389 
-	C305.296906,380.733521 303.600372,380.175507 303.445709,379.522522 
-	C302.659790,376.204224 302.023987,372.799744 301.887848,369.403290 
-	C301.833923,368.057922 303.207397,366.655365 304.090149,364.976044 
-	C305.735565,366.789673 307.009186,368.193542 308.273346,369.587006 
-	C314.197845,366.877563 315.796356,367.081909 317.921143,370.448975 
-	C316.054138,370.787048 314.032623,371.153076 312.228821,371.829193 
-M308.879608,372.390564 
-	C308.280334,371.584625 307.681061,370.778687 307.081757,369.972778 
-	C306.585938,370.719604 305.698120,371.452026 305.670074,372.216003 
-	C305.595398,374.250610 305.890930,376.298798 306.003998,377.856445 
-	C309.647247,378.016418 312.479584,378.140778 315.311890,378.265167 
-	C315.424072,377.822632 315.536285,377.380096 315.648499,376.937561 
-	C313.514374,375.658295 311.380280,374.379059 308.879608,372.390564 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1092.368652,430.577148 
-	C1092.394531,428.330688 1092.051514,425.343842 1093.194946,424.578674 
-	C1094.690552,423.577850 1097.361328,424.333466 1099.526611,424.333466 
-	C1099.544678,424.944061 1099.562622,425.554657 1099.580688,426.165283 
-	C1098.112549,426.518524 1096.644409,426.871765 1094.495972,427.388672 
-	C1096.476562,428.983276 1098.106445,430.295593 1098.790039,430.845978 
-	C1101.953369,429.658508 1104.426636,428.433136 1107.038086,427.941650 
-	C1107.764648,427.804901 1108.900146,429.841217 1109.848022,430.880646 
-	C1108.412842,432.129364 1106.977661,433.378052 1105.406494,434.745056 
-	C1106.625000,434.955170 1107.958252,435.185028 1109.457520,435.443542 
-	C1106.013306,438.921082 1104.998291,438.838531 1100.220825,434.709412 
-	C1097.597534,438.057007 1094.553467,439.345367 1089.931641,435.070526 
-	C1092.712646,434.816742 1094.416138,434.661285 1097.807617,434.351807 
-	C1095.299927,432.633331 1093.980591,431.729156 1092.368652,430.577148 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1469.547607,606.011719 
-	C1473.484375,605.905334 1477.260376,606.222961 1481.042725,606.360657 
-	C1482.075317,606.398193 1483.121460,605.710266 1484.171875,605.676331 
-	C1486.673706,605.595459 1489.181641,605.706238 1491.748535,606.594116 
-	C1488.991211,609.133911 1482.806274,605.929626 1483.656982,612.792603 
-	C1484.316406,618.112915 1488.666016,615.378113 1492.368286,616.046448 
-	C1489.923340,619.546692 1487.166870,619.572815 1484.588501,618.806702 
-	C1479.306030,617.237427 1480.007812,612.653503 1479.078003,607.732605 
-	C1478.306519,608.592896 1477.072754,609.355042 1476.864868,610.334900 
-	C1476.494019,612.082458 1476.932861,613.990234 1476.662720,615.774963 
-	C1476.497803,616.863708 1475.641235,617.847778 1475.095337,618.878784 
-	C1474.471924,617.927246 1473.782349,617.010193 1473.258179,616.006775 
-	C1473.053589,615.615051 1473.140015,615.013672 1473.231689,614.534058 
-	C1473.932129,610.869873 1472.923218,608.030029 1469.547607,606.011719 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1526.898438,611.485291 
-	C1530.070679,608.480469 1535.510986,607.389221 1538.828613,612.301147 
-	C1539.183350,609.755676 1539.545044,607.211182 1540.032837,603.780212 
-	C1542.280518,606.622253 1543.326782,616.852722 1542.108887,618.190063 
-	C1541.747925,618.586365 1540.571899,618.906128 1540.447876,618.743469 
-	C1539.707764,617.772766 1539.166138,616.650696 1538.686157,615.805298 
-	C1537.283081,616.823242 1535.753052,617.963562 1534.190552,619.057678 
-	C1532.848511,619.997437 1531.469604,620.884216 1529.766235,622.022095 
-	C1528.843506,620.430908 1527.839722,618.700073 1526.532471,616.720337 
-	C1526.452026,614.809448 1526.675293,613.147339 1526.898438,611.485291 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M503.203461,485.677002 
-	C501.822601,485.005188 500.807129,484.400940 499.791656,483.796692 
-	C499.899078,483.460236 500.006500,483.123749 500.113953,482.787292 
-	C501.720001,482.787292 503.326050,482.787292 505.482605,482.787292 
-	C504.679291,478.760254 495.993896,477.794861 501.724304,472.660889 
-	C503.091614,471.435852 506.178528,472.130096 508.474487,471.941559 
-	C508.537506,472.624512 508.600555,473.307495 508.663574,473.990479 
-	C507.119781,474.396545 505.575958,474.802643 503.377197,475.380981 
-	C505.319244,476.914795 506.797028,478.081940 507.258301,478.446259 
-	C511.017151,477.439972 513.878601,476.482361 516.816101,476.078491 
-	C517.298950,476.012115 518.116394,478.378723 518.779175,479.620972 
-	C517.085205,480.363098 515.391235,481.105225 513.053955,482.129211 
-	C514.957275,482.647766 516.599426,483.095123 518.273682,483.551239 
-	C514.964600,486.698700 513.995605,486.648590 509.843079,483.245667 
-	C507.706726,484.096558 505.637787,484.920563 503.203461,485.677002 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M527.323303,478.528778 
-	C525.854248,479.405487 524.453796,480.401398 523.583862,481.741699 
-	C522.838623,482.889954 522.700989,484.432648 522.294617,485.800903 
-	C521.789978,485.729309 521.285400,485.657715 520.780762,485.586121 
-	C520.780762,482.521210 520.780762,479.456299 520.780762,476.231567 
-	C524.685852,475.844940 529.194641,473.368164 531.458191,478.839417 
-	C533.547607,477.463684 535.463928,476.201904 538.063416,474.490356 
-	C538.131897,474.197296 538.465393,472.770020 538.798828,471.342743 
-	C539.281860,471.408203 539.764893,471.473633 540.247925,471.539093 
-	C540.247925,476.135132 540.247925,480.731201 540.247925,485.327271 
-	C539.734497,485.492859 539.221008,485.658447 538.707581,485.824005 
-	C538.086975,483.669800 537.466370,481.515564 536.842957,479.351654 
-	C536.608276,479.422455 536.173340,479.416718 536.030212,479.618225 
-	C534.640137,481.575287 533.299011,483.567108 531.943970,485.549072 
-	C530.503418,483.298523 529.062744,481.047974 527.323303,478.528778 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1577.353271,162.390717 
-	C1580.688110,162.776352 1583.623779,163.307480 1587.414917,163.993423 
-	C1587.454346,163.957657 1588.457031,163.045822 1589.459717,162.133987 
-	C1589.945801,162.195084 1590.431763,162.256165 1590.917725,162.317261 
-	C1590.917725,166.440933 1590.976685,170.566483 1590.846924,174.686066 
-	C1590.829590,175.234314 1589.853516,175.752380 1589.321411,176.284470 
-	C1588.739136,175.630035 1587.804199,175.049728 1587.647827,174.305771 
-	C1587.317261,172.733566 1587.393677,171.075882 1587.240479,168.329788 
-	C1583.583740,171.032364 1580.613403,173.227692 1577.069580,175.846771 
-	C1575.095703,171.908997 1575.741455,167.248825 1577.353271,162.390717 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M528.018005,718.001648 
-	C529.563293,716.599182 531.318420,713.867615 532.610107,714.071533 
-	C535.285278,714.493835 537.714050,716.476929 540.435608,717.919800 
-	C540.538574,717.533081 540.928467,716.068481 541.322937,714.603149 
-	C551.643677,713.458862 554.026062,716.504883 549.484985,726.817810 
-	C549.211609,725.033691 549.100159,723.204590 548.620544,721.477783 
-	C548.113098,719.650879 547.255188,717.921448 546.550354,716.149414 
-	C545.628418,718.015198 544.493225,719.811157 543.852539,721.768982 
-	C543.346008,723.316833 543.446899,725.063477 543.278076,726.721863 
-	C542.743896,726.750427 542.209656,726.778992 541.675476,726.807556 
-	C541.270996,724.436401 540.866516,722.065308 540.537781,720.137939 
-	C537.550964,720.454956 534.722473,720.755127 531.418213,720.691284 
-	C529.967651,719.552063 528.992798,718.776855 528.018005,718.001648 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M521.334106,696.325928 
-	C521.322510,692.400757 521.234863,688.900330 521.368713,685.408447 
-	C521.408386,684.374207 522.072144,683.364014 522.449829,682.342773 
-	C523.532288,682.922119 524.975525,683.237061 525.630066,684.130005 
-	C527.651062,686.887451 529.371277,689.865356 531.945129,693.917786 
-	C532.245361,689.125916 532.459412,685.710327 532.673462,682.294739 
-	C533.151184,682.226196 533.628967,682.157654 534.106750,682.089111 
-	C534.485840,683.133728 535.149597,684.166992 535.191956,685.225159 
-	C535.331848,688.716797 535.338379,692.221252 535.191772,695.712219 
-	C535.149170,696.725708 534.421265,697.710510 534.007507,698.708435 
-	C532.903320,698.195740 531.400269,697.976318 530.768127,697.116577 
-	C528.708191,694.314758 526.966309,691.279114 523.927063,688.401428 
-	C523.927063,691.206238 524.005798,694.014954 523.867004,696.812866 
-	C523.835632,697.444946 523.047241,698.039490 522.607300,698.651306 
-	C522.185852,698.018860 521.764343,697.386414 521.334106,696.325928 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1031.284546,89.878326 
-	C1020.328552,89.763954 1009.372498,89.648621 998.416504,89.536476 
-	C997.087463,89.522865 995.638733,89.854385 994.464111,89.426224 
-	C993.372437,89.028267 992.572937,87.828728 991.644836,86.982101 
-	C992.664490,86.516731 993.682983,85.650146 994.703918,85.647430 
-	C1006.160400,85.616913 1017.617310,85.722763 1029.074097,85.774246 
-	C1029.562500,85.776443 1030.051636,85.606262 1031.151245,85.568130 
-	C1031.602905,87.039352 1031.443726,88.458839 1031.284546,89.878326 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M776.648499,208.937057 
-	C776.475586,206.861374 776.385498,205.137924 776.288513,203.281754 
-	C775.559937,203.503845 775.322693,203.501480 775.252686,203.608505 
-	C773.857117,205.743011 772.480774,207.890091 771.100586,210.034637 
-	C769.654053,208.035431 768.297546,205.960159 766.709534,204.080505 
-	C766.191833,203.467728 764.878174,202.893387 764.270508,203.140930 
-	C763.383240,203.502365 762.506897,204.511642 762.162781,205.443130 
-	C761.615784,206.923737 761.511719,208.567947 761.220276,210.142944 
-	C760.609009,210.105179 759.997681,210.067413 759.386414,210.029648 
-	C759.248230,207.074539 759.110046,204.119431 758.951172,200.722473 
-	C763.344666,200.874283 767.929077,197.987991 770.772339,204.780563 
-	C773.825256,201.951202 776.561279,199.415466 779.752747,196.457672 
-	C779.752747,200.427185 779.823486,204.442825 779.621948,208.444733 
-	C779.605347,208.773941 777.738464,209.009964 776.648499,208.937057 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M380.611328,227.735184 
-	C380.892334,229.933029 380.959961,232.332413 381.042908,235.070984 
-	C380.323486,235.052780 379.588684,234.695404 378.853912,234.338013 
-	C377.216919,237.811798 374.062134,239.396683 371.292847,237.055588 
-	C369.349335,235.412598 369.151337,231.688980 368.222534,228.878403 
-	C368.080719,228.449265 368.202789,227.932938 368.202789,227.450806 
-	C364.396851,227.731247 364.148132,227.968872 363.840149,231.457458 
-	C363.654572,233.559357 363.450317,235.659576 363.254456,237.760559 
-	C362.723480,237.738525 362.192474,237.716507 361.661499,237.694473 
-	C361.661499,233.626633 361.661499,229.558807 361.661499,224.558426 
-	C363.838318,225.180435 365.954529,225.919357 368.132355,226.336075 
-	C368.916351,226.486115 369.893890,225.957169 370.705261,225.573410 
-	C374.071564,223.981262 376.776611,224.339508 378.218628,228.378021 
-	C375.794312,229.534790 372.938843,224.206940 371.377228,229.320816 
-	C370.911530,230.845825 371.524200,232.802078 372.014557,234.450150 
-	C372.148010,234.898727 374.109314,235.414047 374.422211,235.097763 
-	C376.208954,233.291946 380.662994,233.878433 379.628754,229.506851 
-	C379.885162,228.983490 380.141571,228.460114 380.611328,227.735184 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M440.242554,362.295593 
-	C440.390167,360.752106 440.519196,359.615662 440.413605,358.279358 
-	C440.292847,356.815033 440.406708,355.550659 440.571075,353.725006 
-	C447.023224,355.567657 453.099854,357.303101 459.563538,359.037140 
-	C459.980865,359.460236 460.011169,359.884705 459.974182,360.622253 
-	C454.173279,362.896606 448.439728,364.857819 442.220337,366.649719 
-	C441.328247,366.292511 440.921967,366.104614 440.515686,365.916718 
-	C440.418457,364.845367 440.321228,363.774017 440.242554,362.295593 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M749.751770,400.538544 
-	C748.580811,403.200714 748.479675,403.203735 746.571350,400.674347 
-	C744.875061,398.426025 744.103027,394.779816 739.603943,396.468933 
-	C739.320312,398.396057 739.010376,400.501709 738.700500,402.607330 
-	C738.186768,402.584106 737.673096,402.560883 737.159424,402.537659 
-	C737.159424,397.236176 737.159424,391.934662 737.159424,386.297760 
-	C741.322021,385.971497 746.226562,384.339386 749.285034,388.669830 
-	C750.353760,390.183075 748.825134,393.530853 748.482666,396.040833 
-	C748.012207,396.046051 747.541809,396.051270 747.071350,396.056488 
-	C747.907043,397.454742 748.742676,398.852966 749.751770,400.538544 
-M744.850037,388.502594 
-	C743.095703,388.421783 741.341431,388.341003 739.389648,388.251099 
-	C739.389648,390.300201 739.389648,391.848785 739.389648,394.535095 
-	C742.319946,393.562195 744.639954,392.791901 746.959961,392.021637 
-	C746.513428,390.953522 746.066956,389.885437 744.850037,388.502594 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M81.994080,618.009155 
-	C82.448441,618.026917 82.902802,618.044739 83.689545,618.455688 
-	C84.043221,619.321655 84.064522,619.794312 84.085823,620.267029 
-	C83.913055,622.044495 83.936249,623.877625 83.455894,625.567688 
-	C83.298454,626.121704 81.833900,626.304260 81.120491,626.245605 
-	C81.139595,625.541260 81.005287,625.248108 80.870987,624.954895 
-	C78.170631,626.505615 75.461418,628.041321 72.777733,629.620300 
-	C72.270172,629.918945 71.864243,630.390381 70.377670,631.676270 
-	C70.377670,626.457397 70.377670,622.286072 70.377670,616.793152 
-	C73.843567,617.761353 77.144028,618.683350 80.892136,619.222046 
-	C81.557877,618.562256 81.775978,618.285706 81.994080,618.009155 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1077.829590,515.639282 
-	C1078.339233,516.735107 1078.406494,517.882324 1078.358398,519.266113 
-	C1076.803589,520.753845 1075.364258,522.005066 1073.257935,523.836121 
-	C1073.257935,519.775940 1073.257935,516.567566 1073.257935,513.359131 
-	C1072.906128,513.265930 1072.554321,513.172791 1072.202515,513.079590 
-	C1071.030273,516.052673 1069.961304,519.073425 1068.623657,521.970093 
-	C1068.217285,522.850342 1067.062256,523.938782 1066.262695,523.928650 
-	C1065.455322,523.918396 1064.349365,522.813477 1063.925293,521.925110 
-	C1062.717285,519.394226 1061.789917,516.729431 1060.395752,514.079102 
-	C1060.039307,514.040833 1060.075562,514.078308 1060.075562,514.078308 
-	C1060.619263,513.195740 1061.162964,512.313232 1061.706665,511.430634 
-	C1062.439453,512.206299 1063.406006,512.867371 1063.854614,513.782410 
-	C1064.693115,515.493164 1065.231323,517.351257 1066.160645,519.869263 
-	C1068.718506,515.798279 1067.833740,508.936676 1075.609497,512.470337 
-	C1075.860962,512.925659 1076.624146,514.308228 1077.829590,515.639282 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1135.967285,515.984497 
-	C1137.296509,509.410858 1142.340576,511.930756 1146.713257,511.731079 
-	C1146.713257,516.125610 1147.251343,520.586365 1146.570557,524.852661 
-	C1145.803711,529.658203 1141.614014,530.257324 1136.165039,526.525696 
-	C1137.338257,525.844543 1138.374146,525.243225 1139.193848,524.767334 
-	C1138.350830,523.667969 1137.485352,522.539185 1136.724121,520.643066 
-	C1136.541260,518.578613 1136.254272,517.281555 1135.967285,515.984497 
-M1143.596191,514.918030 
-	C1142.338013,514.651367 1141.079956,514.384705 1139.821777,514.118042 
-	C1139.627441,516.308411 1139.293823,518.502686 1139.354858,520.685913 
-	C1139.367310,521.130188 1141.490234,522.004028 1141.581909,521.882202 
-	C1142.567261,520.574768 1143.429932,519.148865 1144.121826,517.660461 
-	C1144.357666,517.153015 1144.017700,516.378052 1143.596191,514.918030 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1113.166382,775.927979 
-	C1112.776123,775.269470 1112.385864,774.610962 1111.987183,773.938354 
-	C1110.416504,776.343933 1108.987671,778.532227 1107.558960,780.720459 
-	C1106.297607,778.787415 1105.036377,776.854431 1103.609375,774.667480 
-	C1102.802246,776.356079 1102.055786,777.917847 1100.952759,780.225464 
-	C1099.380493,777.985596 1098.018066,776.044617 1097.282837,774.997070 
-	C1099.055786,773.329407 1100.322998,772.239685 1101.464966,771.031494 
-	C1102.387207,770.055603 1103.158447,768.936951 1103.996826,767.881714 
-	C1104.731201,769.045959 1105.580200,770.155884 1106.164062,771.391296 
-	C1106.646606,772.412537 1106.815674,773.581909 1107.510864,776.073730 
-	C1108.378784,773.261841 1108.827637,771.668030 1109.362305,770.103577 
-	C1110.534058,766.675110 1111.883911,767.886719 1113.634521,770.452148 
-	C1113.740112,772.587036 1113.453247,774.257507 1113.166382,775.927979 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M812.313354,306.927734 
-	C812.231018,306.408875 812.494873,305.999512 813.291260,305.419525 
-	C817.623352,305.260925 817.104797,302.445404 817.103271,300.095337 
-	C817.101562,297.367249 815.590332,296.373657 812.978821,296.922668 
-	C812.985901,296.507751 812.992920,296.092834 813.005188,295.366760 
-	C817.246643,292.884125 818.874878,295.894073 819.940979,297.958862 
-	C821.826172,296.903564 823.585938,295.918518 825.671509,295.290863 
-	C825.999451,296.043152 826.001587,296.438049 825.754028,297.149597 
-	C825.658264,300.054321 825.812195,302.642365 825.983276,305.517700 
-	C826.004333,306.188690 826.008179,306.572418 826.012024,306.956116 
-	C825.227844,308.718384 824.443604,310.480652 823.659363,312.242920 
-	C823.207947,312.264893 822.756531,312.286865 822.305054,312.308838 
-	C821.975647,309.004639 821.646240,305.700439 821.217834,301.402710 
-	C819.052490,305.341919 817.530396,309.234650 812.313354,306.927734 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1279.359375,216.398056 
-	C1278.923706,216.097351 1278.931274,216.074249 1278.914429,216.096115 
-	C1279.819092,214.541824 1280.740723,212.965683 1281.813599,211.130798 
-	C1289.795044,209.953323 1289.795044,209.953323 1291.881348,217.201202 
-	C1292.340576,218.484283 1292.737915,219.061646 1293.135254,219.638992 
-	C1293.439209,219.138733 1293.743042,218.638489 1294.046997,218.138245 
-	C1294.982422,215.599915 1295.917847,213.061554 1296.853271,210.523209 
-	C1297.578857,210.785248 1298.304321,211.047272 1299.029907,211.309311 
-	C1297.654907,215.008560 1296.384888,218.755585 1294.754028,222.338333 
-	C1294.577271,222.726334 1291.648560,222.639404 1291.150269,221.944977 
-	C1290.033936,220.388901 1289.816772,218.220978 1288.902100,216.475937 
-	C1288.229492,215.192993 1287.031128,214.185638 1286.067139,213.055405 
-	C1285.281738,214.521927 1284.183594,215.909958 1283.790894,217.475037 
-	C1283.307251,219.402069 1283.411621,221.476593 1283.261963,223.487366 
-	C1282.762939,223.544540 1282.264038,223.601715 1281.765137,223.658890 
-	C1281.108521,221.338837 1280.451782,219.018799 1279.359375,216.398056 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M808.459473,179.971863 
-	C807.631226,179.748199 807.220276,179.420578 806.535889,179.065643 
-	C808.602539,177.950546 810.942627,176.862778 813.782349,175.542770 
-	C819.219788,177.134872 811.982056,182.945587 816.012573,185.436142 
-	C818.149170,184.050415 820.158020,182.747559 822.457581,181.256119 
-	C821.109375,180.931854 819.858398,180.630997 818.628601,180.335236 
-	C818.703857,179.764160 818.702820,179.210297 818.789490,179.196228 
-	C820.629395,178.897568 823.835449,177.991730 824.097107,178.523056 
-	C825.370728,181.109436 825.857300,184.083405 826.893555,187.925262 
-	C821.668091,187.925262 817.736633,188.215347 813.901672,187.734909 
-	C812.855835,187.603882 812.084656,185.164886 811.216125,183.767288 
-	C810.416260,182.479965 809.655029,181.168655 808.459473,179.971863 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M492.406036,698.973389 
-	C490.305389,697.869141 488.608490,696.806580 486.911591,695.744080 
-	C487.257050,695.214111 487.602509,694.684082 487.947937,694.154114 
-	C489.398468,694.922607 490.821381,696.240295 492.306824,696.315063 
-	C494.015594,696.401123 495.779724,695.387756 497.519806,694.851929 
-	C496.413757,693.726257 495.346283,692.557861 494.176453,691.502930 
-	C493.855347,691.213379 493.230103,691.251831 492.740662,691.159668 
-	C489.882782,690.621704 487.146820,689.291809 487.905151,686.117798 
-	C488.296692,684.478943 490.860352,682.718079 492.757050,682.227173 
-	C495.740479,681.455078 498.659576,682.290894 500.124512,685.060852 
-	C499.877625,685.523010 499.630707,685.985168 499.383789,686.447327 
-	C498.008545,685.779602 496.663269,684.666138 495.249512,684.571045 
-	C493.868225,684.478149 492.417053,685.424622 490.996552,685.914917 
-	C491.909180,686.884888 492.751404,687.939270 493.766327,688.786682 
-	C494.224091,689.168945 495.199951,688.941589 495.641541,689.330505 
-	C497.448792,690.922363 500.369598,692.488342 500.607666,694.353821 
-	C501.042450,697.760681 497.815674,698.747009 494.802521,699.025269 
-	C494.144196,699.086060 493.474335,699.021790 492.406036,698.973389 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M935.152344,77.320267 
-	C928.819397,80.281090 923.926208,79.252563 922.127563,74.621964 
-	C920.672546,70.876251 920.322083,66.396797 923.986633,64.273865 
-	C926.690247,62.707550 931.090698,62.357040 934.067505,63.389553 
-	C938.207581,64.825546 938.409485,69.253868 937.520935,73.204132 
-	C937.212097,74.577354 936.163208,75.784126 935.152344,77.320267 
-M925.108521,74.209976 
-	C927.008911,76.943329 929.979126,78.035843 932.235962,75.864517 
-	C933.891907,74.271362 934.718079,70.934593 934.447388,68.540825 
-	C934.276733,67.032387 931.549011,64.983063 929.708984,64.661743 
-	C925.538696,63.933517 923.624756,67.669785 925.108521,74.209976 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M518.631836,693.307617 
-	C515.791077,698.753235 511.273926,700.473511 506.671814,698.211182 
-	C502.843719,696.329407 501.196747,690.959656 503.089722,686.532227 
-	C504.711823,682.738342 509.654877,680.948669 514.125000,682.638123 
-	C519.058777,684.502747 519.267822,688.562805 518.631836,693.307617 
-M515.966125,688.901855 
-	C515.177734,685.355652 512.666199,683.528809 509.487854,684.698303 
-	C507.697723,685.357117 505.883423,688.008728 505.520172,690.022400 
-	C504.918945,693.355103 506.438293,696.509888 510.385437,696.657776 
-	C514.917603,696.827637 516.176025,693.676025 515.966125,688.901855 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M260.722931,337.033295 
-	C260.516205,339.815491 260.288055,342.596283 260.109192,345.380280 
-	C259.950500,347.849915 259.846527,350.323059 259.718414,352.794678 
-	C259.103333,352.825623 258.488251,352.856537 257.873169,352.887482 
-	C257.519531,350.670319 257.165863,348.453125 256.748718,345.837830 
-	C254.476074,345.837830 252.130341,345.837830 249.840118,345.837830 
-	C249.346451,348.393677 248.915283,350.625977 248.484116,352.858276 
-	C248.006744,352.798248 247.529373,352.738220 247.052002,352.678192 
-	C247.052002,347.253204 247.052002,341.828247 247.052002,336.403259 
-	C247.481323,336.325317 247.910629,336.247375 248.339951,336.169434 
-	C248.806229,338.187592 249.272507,340.205719 249.829086,342.614685 
-	C251.910492,342.614685 254.130386,342.614685 256.304932,342.614685 
-	C259.274384,341.790466 254.111679,335.843994 260.429199,336.967651 
-	C260.824554,337.104950 260.722931,337.033295 260.722931,337.033295 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M547.973999,485.590668 
-	C543.119080,485.664886 541.566162,482.949768 542.428894,479.131439 
-	C543.242432,475.530670 545.976501,474.814758 549.467712,475.867340 
-	C550.880554,476.293243 552.619934,476.056213 554.114380,475.707672 
-	C557.792053,474.849884 559.762085,476.241455 560.632874,480.304413 
-	C558.686584,480.781616 556.921387,481.214417 555.156250,481.647247 
-	C555.128601,481.905701 555.100891,482.164124 555.073242,482.422577 
-	C556.504883,482.750397 557.936523,483.078247 559.368164,483.406067 
-	C559.448364,483.828979 559.528564,484.251892 559.608765,484.674805 
-	C557.728271,484.876801 555.851562,485.129944 553.966370,485.266327 
-	C552.103149,485.401184 550.231506,485.418060 547.973999,485.590668 
-M548.488892,482.944061 
-	C552.983948,482.850952 550.510864,480.072540 550.815735,477.041748 
-	C548.558472,478.170013 547.115051,478.891510 545.671631,479.613007 
-	C546.313171,480.741974 546.954773,481.870941 548.488892,482.944061 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M486.487732,462.611908 
-	C482.520203,463.811432 479.139404,463.728546 478.341095,459.354553 
-	C478.034271,457.673401 479.232483,454.424164 480.431732,454.041412 
-	C482.658722,453.330719 485.390167,454.200806 487.797943,454.403168 
-	C488.347565,453.200012 489.273712,451.172638 490.199890,449.145264 
-	C490.739349,451.506287 491.459381,453.844299 491.763519,456.235260 
-	C492.026855,458.305176 491.818268,460.435089 491.818268,462.869049 
-	C489.725647,462.708923 488.307404,462.600403 486.487732,462.611908 
-M486.304749,458.782776 
-	C485.001190,458.955078 483.697632,459.127350 482.394043,459.299652 
-	C482.415588,459.588287 482.437103,459.876953 482.458618,460.165588 
-	C484.028992,460.362488 485.599335,460.559357 487.169708,460.756256 
-	C487.162567,460.094421 487.155426,459.432617 486.304749,458.782776 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M771.019165,297.994781 
-	C771.343506,297.306396 771.667847,296.617981 771.986328,295.621399 
-	C773.152710,296.722748 774.325012,298.132294 774.728455,298.617401 
-	C777.529480,297.307251 780.447571,295.126495 783.533264,294.855988 
-	C784.994995,294.727814 786.776855,298.251221 788.413696,300.120239 
-	C788.070190,300.545074 787.726685,300.969910 787.383179,301.394745 
-	C784.718811,301.646057 782.054443,301.897369 779.217346,302.164948 
-	C780.555603,307.475250 783.945129,303.960632 786.942322,305.208954 
-	C785.522156,306.032776 784.045471,307.603668 782.695374,307.501556 
-	C780.773315,307.356201 778.796265,306.198029 777.129211,305.054810 
-	C776.081360,304.336243 775.557983,302.852966 774.378296,301.837280 
-	C773.957336,301.961761 773.827454,301.845551 773.806030,301.515381 
-	C773.065857,300.829163 772.347107,300.473114 771.485535,299.876465 
-	C771.234802,299.088806 771.127014,298.541779 771.019165,297.994781 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1516.893311,197.919617 
-	C1514.059570,197.859421 1511.225830,197.799210 1508.392212,197.738998 
-	C1508.454102,197.608826 1508.515991,197.478668 1508.577881,197.348495 
-	C1506.006592,197.828720 1503.435303,198.308945 1500.864136,198.789169 
-	C1500.724976,198.240250 1500.585815,197.691330 1500.446655,197.142395 
-	C1501.494141,196.655075 1502.541626,196.167755 1502.906006,195.998199 
-	C1502.185547,194.019608 1501.484497,192.094299 1500.783325,190.168976 
-	C1502.989014,189.980606 1505.194214,189.787003 1507.400635,189.606155 
-	C1508.411133,189.523300 1509.424561,189.399200 1510.435425,189.410324 
-	C1512.435181,189.432343 1514.434082,189.535416 1516.740845,190.236771 
-	C1518.173950,195.575653 1513.107788,192.870102 1511.853027,195.268738 
-	C1513.591797,196.183167 1515.242554,197.051392 1516.893311,197.919617 
-M1508.008057,191.421143 
-	C1506.879150,191.306152 1505.750244,191.191162 1504.621216,191.076187 
-	C1504.681396,191.631149 1504.741577,192.186127 1504.801758,192.741104 
-	C1505.935059,192.539444 1507.068237,192.337799 1508.008057,191.421143 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M332.201141,178.023071 
-	C332.830811,178.729309 333.460449,179.435562 334.989563,181.150635 
-	C334.989563,176.468887 334.989563,172.952789 334.989563,169.506042 
-	C345.817047,168.707657 348.517517,172.373856 343.340759,181.849075 
-	C343.153595,179.522629 343.184296,177.149200 342.696503,174.887589 
-	C342.409973,173.559021 341.298981,172.408264 340.558807,171.177536 
-	C339.693665,172.426620 338.361206,173.577576 338.073456,174.947922 
-	C337.647614,176.976013 337.963379,179.159805 337.963379,181.943802 
-	C334.841492,181.539154 332.350128,181.216232 329.352600,180.466522 
-	C326.462463,177.899124 326.588379,175.842072 329.052155,173.862869 
-	C329.052155,173.862869 329.196625,173.754761 329.747314,173.849014 
-	C330.924164,173.967957 331.550323,173.992630 332.176483,174.017319 
-	C332.234833,174.455475 332.293152,174.893616 331.939941,175.686859 
-	C331.176941,176.475098 330.825409,176.908264 330.473907,177.341431 
-	C331.049652,177.568649 331.625397,177.795853 332.201141,178.023071 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M739.479126,731.528320 
-	C741.805237,731.947632 743.766968,732.484802 746.026855,733.103516 
-	C745.850342,733.299316 746.124695,733.116943 746.224182,732.865417 
-	C746.969543,730.980225 747.680237,729.081421 748.401917,727.186890 
-	C748.869446,729.114990 749.579468,731.022400 749.745911,732.976135 
-	C749.978271,735.703125 749.804504,738.464844 749.804504,741.211853 
-	C747.079224,741.211853 745.002808,741.483582 743.033936,741.139648 
-	C740.820435,740.753052 737.730469,740.449158 736.760254,738.969421 
-	C735.054626,736.367981 735.484863,733.179504 739.479126,731.528320 
-M745.948547,738.417358 
-	C743.942810,737.834534 741.937073,737.251770 739.931396,736.668945 
-	C739.813721,737.281921 739.696045,737.894836 739.578369,738.507812 
-	C741.504395,738.686523 743.430481,738.865295 745.948547,738.417358 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M786.145935,200.200378 
-	C788.267395,200.505615 790.157898,201.407410 791.659485,200.971039 
-	C794.832092,200.049011 797.848877,199.332947 798.709839,203.357117 
-	C798.902161,204.256317 795.751343,205.870697 793.921692,207.329651 
-	C795.181519,207.617340 796.858215,208.000198 799.395447,208.579575 
-	C798.040222,209.383469 797.419128,210.058624 796.769775,210.086990 
-	C792.728821,210.263367 788.622314,210.711121 784.668762,210.147766 
-	C783.290894,209.951431 781.589111,207.266129 781.266663,205.493515 
-	C780.722412,202.501984 782.464478,200.464523 786.145935,200.200378 
-M788.274353,202.904861 
-	C784.167297,202.533691 783.932434,204.508881 785.277588,207.621124 
-	C786.899475,207.621124 788.339172,207.621124 790.312134,207.621124 
-	C789.870544,205.894073 789.495056,204.425674 788.274353,202.904861 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1053.979370,740.059265 
-	C1055.255859,738.623047 1056.532471,737.186890 1058.316406,735.179810 
-	C1058.966064,736.606323 1059.626953,738.057251 1060.282715,739.513428 
-	C1067.310059,740.074951 1069.462280,744.957153 1064.653442,752.763184 
-	C1064.504272,750.453613 1064.575195,748.099731 1064.122437,745.851318 
-	C1063.856201,744.529114 1062.757690,743.374512 1062.033447,742.144531 
-	C1061.178101,743.348267 1060.032593,744.448425 1059.554199,745.786987 
-	C1059.132446,746.967102 1059.398804,748.415955 1059.460815,749.741516 
-	C1059.602051,752.763000 1058.167480,753.168152 1055.344238,751.880859 
-	C1054.932129,751.706055 1054.951538,751.372009 1055.354370,751.156067 
-	C1055.938354,748.986511 1056.430298,746.992615 1056.184937,745.094177 
-	C1056.036255,743.945129 1054.744751,742.943848 1053.975952,741.573364 
-	C1053.983154,740.866821 1053.981323,740.463074 1053.979370,740.059265 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1267.908447,191.828674 
-	C1268.818481,192.955109 1269.505859,193.829010 1270.193359,194.702927 
-	C1269.810425,195.153458 1269.427368,195.603989 1269.044434,196.054520 
-	C1266.338867,193.565155 1263.633301,191.075775 1260.380249,188.082642 
-	C1259.790039,190.937943 1259.329102,193.167221 1258.811401,195.671753 
-	C1256.104248,192.953979 1255.769165,183.343048 1258.512085,177.993134 
-	C1259.147217,180.842361 1259.562866,182.707291 1260.068848,184.977280 
-	C1262.784058,182.789368 1265.368164,180.707108 1267.952271,178.624863 
-	C1268.282349,179.001785 1268.612427,179.378708 1268.942505,179.755630 
-	C1267.165405,181.791763 1265.388306,183.827911 1263.318848,186.198975 
-	C1264.830444,188.060287 1266.258057,189.818222 1267.908447,191.828674 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M740.172852,421.686249 
-	C740.840881,421.809906 742.064392,422.125336 742.097412,422.029877 
-	C744.066711,416.323639 748.665344,417.669922 753.050781,417.957947 
-	C753.050781,423.773621 753.050781,429.579010 753.050781,435.384399 
-	C752.575439,435.466553 752.100159,435.548706 751.624817,435.630859 
-	C751.069641,434.114105 750.514465,432.597321 749.832703,430.734711 
-	C743.892151,432.742859 743.425537,426.997131 740.371460,423.991577 
-	C740.036804,423.121857 740.104858,422.404053 740.172852,421.686249 
-M748.384155,419.940765 
-	C744.076660,420.620819 745.150330,423.835480 745.624451,426.416992 
-	C745.779236,427.259705 747.454346,427.823212 748.434143,428.514404 
-	C749.148254,426.366241 749.978149,424.245056 750.489258,422.049622 
-	C750.606873,421.544342 749.630493,420.784363 748.384155,419.940765 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M746.110352,185.984619 
-	C743.009460,187.717575 740.021362,189.220261 736.429199,186.715469 
-	C735.627502,186.156403 733.689331,187.227005 731.890808,187.634155 
-	C731.890808,183.215057 731.890808,178.702560 731.890808,174.190063 
-	C732.374817,174.148773 732.858887,174.107483 733.342896,174.066208 
-	C733.692200,175.963272 734.041504,177.860321 734.445129,180.052490 
-	C738.119690,178.918991 742.132690,175.231873 744.450439,181.057785 
-	C744.695740,181.674301 741.758423,183.556992 740.222107,184.919205 
-	C741.496033,185.152771 743.369507,185.496277 745.664185,185.905426 
-	C746.085327,185.971069 746.110352,185.984619 746.110352,185.984619 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M270.939087,721.967102 
-	C277.303772,720.012573 280.102142,721.009949 281.375122,725.850403 
-	C277.755005,724.622009 273.782684,720.781250 271.023651,725.697266 
-	C269.907776,727.685486 270.108612,731.614685 271.399323,733.510925 
-	C274.448273,737.990173 277.960938,733.817200 282.633026,732.033203 
-	C280.970367,736.091919 278.955261,737.535095 276.082794,737.830811 
-	C272.493958,738.200256 269.344757,737.237854 267.852600,733.615173 
-	C266.035950,729.204468 266.247375,725.122925 270.939087,721.967102 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1478.019775,833.832520 
-	C1477.284668,835.006592 1476.074341,836.119507 1475.913574,837.367615 
-	C1475.583130,839.932739 1475.814209,842.570190 1475.814209,845.177917 
-	C1475.222290,845.395386 1474.630493,845.612854 1474.038574,845.830383 
-	C1473.243408,844.181885 1472.448120,842.533386 1471.368286,840.295044 
-	C1470.511719,840.295044 1468.998047,840.295044 1467.395752,840.295044 
-	C1467.034790,842.102112 1466.698975,843.782959 1466.363281,845.463806 
-	C1465.977905,845.583130 1465.592529,845.702454 1465.207031,845.821777 
-	C1464.636597,844.773865 1463.684448,843.764709 1463.573242,842.670105 
-	C1463.323364,840.210999 1463.306763,837.689941 1463.566406,835.233398 
-	C1463.694946,834.016418 1464.644531,832.886108 1465.222656,831.716553 
-	C1465.814087,832.878052 1466.428589,834.028625 1466.984741,835.206726 
-	C1467.186646,835.634155 1467.248535,836.127563 1467.375488,836.594788 
-	C1472.451172,838.998413 1472.286621,835.013550 1472.784912,831.824890 
-	C1474.420898,831.897644 1475.839355,831.960754 1477.626343,832.309021 
-	C1478.003174,833.006958 1478.011475,833.419739 1478.019775,833.832520 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1031.249268,90.224632 
-	C1031.443726,88.458839 1031.602905,87.039352 1031.546143,85.384552 
-	C1031.330078,83.703835 1031.330078,82.258446 1031.330078,80.003334 
-	C1037.455688,82.144630 1043.113281,84.122368 1048.870483,86.595428 
-	C1047.958374,87.894722 1046.946655,88.698700 1045.935059,89.502678 
-	C1045.509277,89.645981 1045.083496,89.789284 1044.120117,89.697586 
-	C1042.031616,90.115776 1040.480469,90.768974 1038.929443,91.422180 
-	C1038.503784,91.577904 1038.078247,91.733627 1037.155884,91.679955 
-	C1036.086426,91.842964 1035.513550,92.215355 1034.940796,92.587746 
-	C1034.515381,92.718788 1034.090088,92.849831 1033.213867,92.756683 
-	C1032.326660,92.331863 1031.890259,92.131226 1031.453857,91.930588 
-	C1031.373901,91.477371 1031.294067,91.024155 1031.249268,90.224632 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1099.973877,741.365723 
-	C1099.896851,742.314575 1099.703003,743.270813 1099.761841,744.211182 
-	C1100.201172,751.241699 1098.883179,752.796875 1092.091797,753.138550 
-	C1091.691284,754.651489 1091.291748,756.164551 1090.892334,757.677673 
-	C1087.601929,752.146973 1089.260498,746.335876 1088.564575,739.477966 
-	C1092.575928,740.305603 1095.907104,740.992798 1099.627197,741.545532 
-	C1100.015991,741.410950 1099.973755,741.365723 1099.973877,741.365723 
-M1092.917114,750.274719 
-	C1096.984009,751.797913 1097.263062,748.871704 1096.924927,746.363647 
-	C1096.719360,744.839050 1095.126709,743.501465 1094.157227,742.079834 
-	C1093.329834,743.823975 1092.371704,745.522949 1091.745850,747.336609 
-	C1091.524536,747.977356 1092.114990,748.898193 1092.917114,750.274719 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1047.815674,635.713135 
-	C1047.313599,638.893982 1045.954834,642.511108 1047.186890,644.599426 
-	C1050.011475,649.386597 1053.870972,645.543579 1057.467651,644.213013 
-	C1056.348145,648.453796 1053.436768,649.448181 1049.826050,649.174255 
-	C1045.595825,648.853271 1043.034546,645.802307 1042.796387,640.991028 
-	C1042.569702,636.411316 1045.014282,633.279663 1049.418457,632.507812 
-	C1053.659790,631.764526 1056.015015,633.034119 1057.118652,636.463440 
-	C1054.186035,636.134216 1051.160889,635.794617 1047.815674,635.713135 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1343.061768,183.439529 
-	C1342.525269,185.259521 1341.988892,187.079514 1341.241455,189.614883 
-	C1339.325928,189.755722 1336.761230,189.944260 1333.947021,190.151154 
-	C1335.031982,195.931488 1338.676758,191.975128 1342.281738,191.822357 
-	C1340.014771,195.453522 1337.790771,196.343002 1334.854492,195.393631 
-	C1330.572998,194.009262 1330.137817,190.597336 1330.898804,186.884552 
-	C1331.643677,183.250259 1334.332397,182.141708 1337.684204,182.610168 
-	C1339.270630,182.831909 1340.779907,183.604752 1342.693359,183.812271 
-	C1343.062500,183.496658 1343.061768,183.439529 1343.061768,183.439529 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M784.026978,391.456665 
-	C784.026978,391.456665 784.015747,391.406830 783.999634,391.425842 
-	C785.084717,391.086121 786.231628,390.827942 787.279358,390.351562 
-	C792.285828,388.075287 795.854919,390.691406 795.527222,396.828827 
-	C793.129333,396.953247 790.688293,397.079926 788.221985,397.207916 
-	C788.863708,400.008301 788.863708,400.008301 795.086060,399.839142 
-	C792.410645,403.693390 791.524841,403.791718 784.355652,401.271240 
-	C783.988403,401.552856 784.021179,401.579865 784.482544,401.519043 
-	C784.638306,398.124359 784.332642,394.790497 784.026978,391.456665 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1028.115479,485.043427 
-	C1032.289673,478.058441 1039.011230,477.531891 1042.811523,484.284698 
-	C1038.616577,483.518585 1033.893921,478.840179 1031.429077,485.142181 
-	C1030.636230,487.169525 1031.415527,491.773834 1032.598877,492.220154 
-	C1035.412109,493.281067 1038.896606,492.561737 1042.666504,492.561737 
-	C1041.992310,494.808411 1039.841919,496.030334 1036.991089,496.366547 
-	C1033.369629,496.793671 1030.178711,495.782013 1028.818604,492.192993 
-	C1028.033691,490.122131 1028.250122,487.671844 1028.115479,485.043427 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M291.388184,337.562988 
-	C294.980469,337.122498 298.526550,336.760895 301.924408,337.312439 
-	C302.999542,337.487000 304.503479,340.209564 304.324646,341.570801 
-	C304.113556,343.177460 302.581024,345.092316 301.091217,345.924652 
-	C299.313019,346.918091 296.972961,346.905853 294.923370,347.319763 
-	C294.509979,349.256561 294.123718,351.066162 293.737457,352.875732 
-	C293.215393,352.873901 292.693298,352.872070 292.171234,352.870239 
-	C290.278809,348.114471 291.716797,342.936188 291.388184,337.562988 
-M294.388519,339.550140 
-	C294.317291,340.032440 294.017883,340.658264 294.215027,340.971741 
-	C294.997955,342.216492 296.129456,344.449127 296.778473,344.333435 
-	C298.406006,344.043335 299.841156,342.673981 301.353455,341.737457 
-	C300.027527,340.689362 298.780853,339.505188 297.335022,338.662933 
-	C296.787781,338.344177 295.780975,338.814270 294.388519,339.550140 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M527.954346,722.916382 
-	C527.280457,724.156006 526.606567,725.395630 525.589844,727.265930 
-	C523.854858,725.733704 522.234497,724.302673 520.282166,722.578491 
-	C519.516602,724.037781 518.789978,725.422791 518.063354,726.807861 
-	C517.707886,726.752563 517.352356,726.697327 516.996887,726.642029 
-	C516.996887,720.922668 516.996887,715.203247 516.996887,709.483887 
-	C517.435303,709.397583 517.873718,709.311340 518.312134,709.225037 
-	C518.871521,711.635864 519.430847,714.046692 520.082642,716.855957 
-	C522.098572,715.654175 523.739868,714.675720 525.381226,713.697266 
-	C525.618652,713.990234 525.856079,714.283264 526.093567,714.576233 
-	C524.918396,716.255310 523.743286,717.934326 522.022766,720.392639 
-	C523.914001,721.568970 525.663147,722.656921 527.688049,723.370422 
-	C527.963745,722.995972 527.954346,722.916382 527.954346,722.916382 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1084.408447,709.349365 
-	C1088.663940,715.391235 1087.000977,717.498535 1076.955933,719.243652 
-	C1076.621216,721.017151 1076.275635,722.847656 1075.930054,724.678162 
-	C1075.319214,724.682434 1074.708374,724.686707 1074.097412,724.690979 
-	C1073.082520,719.531372 1073.965210,714.203125 1073.488159,707.876343 
-	C1077.447266,708.344421 1080.767090,708.736816 1084.408447,709.349365 
-M1076.277954,714.342041 
-	C1078.170898,714.862305 1080.049927,715.632935 1081.965942,715.739197 
-	C1082.490845,715.768311 1083.861450,713.260681 1083.567139,712.863647 
-	C1082.807373,711.838867 1081.412354,711.016296 1080.128540,710.709839 
-	C1078.039673,710.211060 1076.036987,710.461182 1076.277954,714.342041 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M65.935310,387.088348 
-	C66.946121,384.781281 67.956924,382.474182 68.967735,380.167114 
-	C69.340607,380.232941 69.713470,380.298737 70.086342,380.364563 
-	C70.479294,381.689636 70.872246,383.014679 71.269646,384.354767 
-	C76.090324,384.873779 78.178734,386.948578 77.319756,390.581573 
-	C76.313263,394.838409 72.960930,395.652771 69.611908,394.493561 
-	C67.992760,393.933167 67.110359,391.244202 65.646530,389.247284 
-	C65.577568,388.346497 65.756432,387.717407 65.935310,387.088348 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1290.257568,195.730743 
-	C1288.325073,195.451828 1286.756592,195.233215 1285.238525,195.021622 
-	C1285.238525,189.441650 1285.238525,183.889755 1285.238525,178.337860 
-	C1285.663696,178.268585 1286.088745,178.199310 1286.513916,178.130035 
-	C1287.036865,179.489075 1287.559814,180.848114 1288.258423,182.663391 
-	C1292.199219,181.890427 1295.415771,182.883759 1295.732056,187.728424 
-	C1295.984497,191.598236 1295.624512,195.197723 1290.257568,195.730743 
-M1292.037354,185.415634 
-	C1288.477905,183.753159 1287.348633,186.098114 1287.560547,188.760101 
-	C1287.693848,190.434464 1289.402466,191.983444 1290.404297,193.588699 
-	C1291.266846,191.882629 1292.250854,190.222839 1292.927734,188.446075 
-	C1293.172852,187.802551 1292.683228,186.879120 1292.037354,185.415634 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M903.168945,101.647041 
-	C902.594116,100.652939 902.384521,99.378563 902.276001,97.696136 
-	C903.598694,96.604210 904.820251,95.920334 906.041870,95.236465 
-	C909.680725,94.160858 914.442505,91.889297 917.215576,97.927299 
-	C917.571228,95.328026 917.926880,92.728752 918.631836,90.494850 
-	C919.386658,95.933624 919.792114,101.007027 920.197510,106.080429 
-	C918.951111,105.025337 917.704773,103.970238 916.403503,102.868652 
-	C915.342468,106.319069 912.130798,107.562775 907.585571,106.924057 
-	C907.511902,105.770332 907.835693,104.735619 908.463135,103.908600 
-	C910.116882,103.820129 912.537964,103.709824 912.627380,103.194893 
-	C912.971191,101.213593 912.703430,99.072548 912.257751,97.082001 
-	C912.207336,96.856804 909.585693,97.207352 908.020508,96.985825 
-	C907.259460,96.700302 906.124817,96.599777 906.087524,96.757927 
-	C905.687500,98.455101 905.460693,100.193123 905.186401,101.919952 
-	C904.635620,101.735565 904.084900,101.551170 903.168945,101.647041 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1198.931885,408.290039 
-	C1197.188232,412.005707 1195.585938,415.396210 1193.983643,418.786682 
-	C1193.547363,418.598846 1193.111206,418.411011 1192.674927,418.223175 
-	C1192.388184,415.889069 1192.467529,413.421112 1191.680542,411.270050 
-	C1191.192139,409.934937 1189.390137,409.080383 1188.177856,408.010071 
-	C1187.455688,409.299286 1186.587280,410.531677 1186.057617,411.895599 
-	C1185.628174,413.001617 1185.605713,414.265686 1185.402710,415.459656 
-	C1184.776611,415.485748 1184.150635,415.511841 1183.524536,415.537903 
-	C1183.323242,412.427368 1183.121826,409.316864 1182.886841,405.686829 
-	C1187.418701,405.976959 1192.154541,402.550201 1194.296509,408.375153 
-	C1196.109863,407.370117 1197.627930,406.528717 1199.145996,405.687317 
-	C1199.121704,406.446503 1199.097534,407.205688 1198.931885,408.290039 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M284.413391,730.837646 
-	C284.413635,727.429932 284.413635,724.481140 284.413635,721.657593 
-	C292.401459,720.209778 297.008850,721.574646 297.257263,725.476440 
-	C297.689148,732.259277 291.944672,730.851624 287.797974,731.959229 
-	C287.395050,733.777588 286.970825,735.692139 286.546570,737.606689 
-	C286.014221,737.593628 285.481842,737.580566 284.949463,737.567444 
-	C284.770691,735.477173 284.591919,733.386902 284.413391,730.837646 
-M293.638519,728.080566 
-	C294.423889,723.658997 293.324036,722.909668 287.385925,723.997131 
-	C287.385925,725.526428 287.385925,727.091797 287.385925,729.220337 
-	C289.467621,728.992065 291.207489,728.801331 293.638519,728.080566 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1126.222290,771.092346 
-	C1126.328857,768.245483 1126.435791,765.865051 1126.542725,763.484558 
-	C1127.031982,763.373779 1127.521240,763.263062 1128.010498,763.152283 
-	C1128.716675,764.556396 1129.422974,765.960510 1130.127808,767.365356 
-	C1136.246460,768.121826 1138.021484,770.077942 1137.440186,775.425415 
-	C1136.932373,780.097656 1135.540405,780.746033 1126.222534,780.293091 
-	C1126.222534,777.416809 1126.222534,774.487732 1126.222290,771.092346 
-M1134.545166,775.871521 
-	C1134.591431,775.210754 1134.886353,774.429260 1134.635620,773.912720 
-	C1133.980957,772.564514 1133.087402,771.332275 1132.289185,770.053772 
-	C1131.316650,770.767456 1129.546387,771.458557 1129.525391,772.199219 
-	C1129.468872,774.191467 1130.159546,776.204895 1130.553589,778.209839 
-	C1131.814941,777.672485 1133.076294,777.135132 1134.545166,775.871521 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M950.639954,66.320786 
-	C951.041260,66.681206 951.045776,67.006371 950.642822,67.529984 
-	C944.963562,71.138344 944.942139,72.038651 950.033203,76.522392 
-	C950.033203,76.522392 950.108521,76.872009 950.106140,76.879593 
-	C949.640503,79.750793 948.240417,79.103241 946.815125,77.684181 
-	C945.696716,76.570625 944.741699,75.292870 943.447205,73.775131 
-	C942.790588,75.857430 942.299744,77.413925 941.698975,79.319122 
-	C938.730042,75.520340 938.972900,63.965359 942.327576,61.200157 
-	C942.556396,64.304367 942.750977,66.944420 942.925110,69.306511 
-	C945.467712,68.257797 947.858765,67.271622 950.639954,66.320786 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1172.900879,515.466980 
-	C1173.654785,515.066650 1174.428955,514.699646 1175.158936,514.259583 
-	C1177.333862,512.948486 1179.491577,511.608612 1181.655884,510.279938 
-	C1181.922974,510.618439 1182.189941,510.956909 1182.457031,511.295410 
-	C1182.898438,509.841522 1183.339966,508.387634 1183.781372,506.933716 
-	C1184.212646,506.947754 1184.644043,506.961792 1185.075439,506.975861 
-	C1186.913696,512.256104 1185.390869,517.821045 1185.881592,523.172729 
-	C1177.022339,525.002014 1177.022339,525.002014 1173.325684,517.424255 
-	C1172.956909,516.444519 1172.928955,515.955750 1172.900879,515.466980 
-M1182.356323,520.810852 
-	C1182.482056,519.051941 1183.062012,517.145752 1182.558228,515.591003 
-	C1182.269409,514.700317 1180.218994,514.380615 1178.961670,513.803894 
-	C1178.576172,515.789124 1177.803223,517.815857 1178.009277,519.737610 
-	C1178.084351,520.438110 1180.489990,520.888672 1182.356323,520.810852 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1063.109619,647.052612 
-	C1060.545776,648.858032 1060.384766,648.863098 1060.301147,646.220154 
-	C1060.165405,641.924255 1060.264404,637.621033 1060.264404,632.534363 
-	C1062.752930,632.534363 1064.991943,632.453003 1067.222656,632.553528 
-	C1070.501587,632.701233 1073.272949,633.770386 1073.271973,637.648499 
-	C1073.271240,641.209595 1070.676025,642.428406 1067.631958,642.721313 
-	C1065.095581,642.965332 1062.400391,642.757202 1063.109619,647.052612 
-M1068.114624,635.038757 
-	C1066.519165,635.038757 1064.923584,635.038757 1062.968506,635.038757 
-	C1063.099609,637.102966 1063.199219,638.671143 1063.357666,641.166748 
-	C1065.882446,640.382324 1067.901733,639.960144 1069.648438,639.027283 
-	C1069.971191,638.854797 1069.191772,636.618958 1068.114624,635.038757 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1306.622192,192.036850 
-	C1306.846680,192.940872 1306.746094,194.595535 1306.622925,194.597214 
-	C1304.142212,194.630966 1300.311523,195.391586 1299.470703,194.156158 
-	C1297.958008,191.933228 1297.379395,188.252518 1298.101196,185.649734 
-	C1298.512085,184.167953 1302.521484,182.512970 1304.452026,182.952087 
-	C1306.395386,183.394196 1307.770630,186.333801 1309.394897,188.179062 
-	C1309.025879,188.621170 1308.656738,189.063293 1308.287720,189.505402 
-	C1305.746094,189.753387 1303.204346,190.001389 1300.577393,190.257706 
-	C1302.214111,193.984131 1302.214111,193.984131 1306.622192,192.036850 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M804.235596,332.460693 
-	C805.252991,332.415192 805.947266,332.581024 806.641541,332.746857 
-	C806.077332,333.485321 805.472168,334.882355 804.955872,334.850250 
-	C802.478577,334.696136 798.614746,334.929932 797.874573,333.581604 
-	C796.571838,331.208191 796.444092,327.544861 797.301270,324.900360 
-	C797.735291,323.561432 801.751587,322.200104 803.503723,322.783783 
-	C805.509460,323.451874 806.799683,326.267670 808.400818,328.150330 
-	C808.018066,328.565948 807.635254,328.981537 807.252502,329.397156 
-	C804.656311,329.614746 802.060181,329.832336 799.463989,330.049927 
-	C799.342468,330.556000 799.221008,331.062042 799.099487,331.568085 
-	C800.703857,331.936096 802.308167,332.304077 804.235596,332.460693 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M516.017090,659.973389 
-	C514.721130,662.026611 513.447083,664.094177 512.122131,666.128540 
-	C511.090485,667.712463 509.995575,669.255127 508.928772,670.816162 
-	C507.725250,669.200073 506.230072,667.722839 505.379944,665.938354 
-	C503.698395,662.408386 502.373413,658.708496 501.553833,654.736206 
-	C506.616302,656.725769 505.604553,662.491882 508.798889,666.022461 
-	C510.742188,661.943420 512.668640,657.899658 514.595093,653.855835 
-	C515.164429,654.097229 515.733765,654.338684 516.303040,654.580078 
-	C515.977783,656.216187 515.652466,657.852295 515.649841,659.737488 
-	C515.972473,659.986572 516.017090,659.973389 516.017090,659.973389 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1113.086914,543.812744 
-	C1113.395508,543.915161 1113.963623,544.131592 1113.975830,544.103821 
-	C1116.234619,538.963501 1120.359253,538.450745 1125.183350,539.720032 
-	C1125.183350,545.341309 1125.183350,551.102356 1125.183350,556.863403 
-	C1124.720215,556.902283 1124.256958,556.941162 1123.793823,556.979980 
-	C1123.432617,555.520813 1123.071289,554.061646 1122.609253,552.194885 
-	C1117.227417,553.932495 1115.516113,549.975647 1113.397583,545.629272 
-	C1113.013062,544.777161 1113.050049,544.294922 1113.086914,543.812744 
-M1117.955811,548.084900 
-	C1119.246948,548.534668 1120.537964,548.984436 1121.828979,549.434265 
-	C1122.170044,547.425415 1122.797974,545.402588 1122.700928,543.415100 
-	C1122.665649,542.692932 1120.900269,542.055176 1119.924316,541.378906 
-	C1119.183716,542.686340 1118.356323,543.955017 1117.745605,545.320557 
-	C1117.505981,545.856201 1117.752319,546.609131 1117.955811,548.084900 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1075.343140,490.745178 
-	C1075.798584,484.187866 1076.630371,483.386353 1082.881226,483.115784 
-	C1083.408447,481.720612 1083.941528,480.310150 1084.474609,478.899658 
-	C1084.880859,478.925415 1085.287231,478.951172 1085.693604,478.976929 
-	C1085.693604,484.367523 1085.693604,489.758087 1085.693604,495.303009 
-	C1077.763794,497.190033 1077.020752,496.915680 1075.343140,490.745178 
-M1078.081665,490.483276 
-	C1078.386597,493.112061 1079.429321,495.483307 1082.269165,493.352203 
-	C1083.433594,492.478302 1083.366943,489.538300 1083.239868,487.578430 
-	C1083.189087,486.794159 1081.466309,486.118286 1080.504517,485.393066 
-	C1079.693848,486.821075 1078.883179,488.249084 1078.081665,490.483276 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1316.706177,218.552185 
-	C1316.797729,218.881805 1316.889282,219.211426 1317.028564,219.788940 
-	C1316.483398,220.281433 1315.766235,220.387726 1315.316528,220.791718 
-	C1309.985962,225.580673 1306.842651,224.720673 1304.759644,217.875061 
-	C1304.587158,217.308273 1304.269165,216.785721 1303.437744,214.981598 
-	C1303.066895,218.541565 1302.832031,220.795013 1302.597290,223.048462 
-	C1302.084473,223.044464 1301.571777,223.040466 1301.058960,223.036469 
-	C1301.058960,219.070969 1301.058960,215.105469 1301.058960,209.684616 
-	C1302.466919,212.008347 1303.204346,213.225296 1303.946289,214.449799 
-	C1309.392578,209.181671 1310.864014,209.121475 1316.668213,213.924133 
-	C1317.044189,214.242767 1316.998169,214.538940 1316.599854,214.753235 
-	C1314.609863,214.196976 1312.993042,213.543060 1311.318115,213.316071 
-	C1310.353638,213.185349 1308.494629,213.598434 1308.417480,214.019424 
-	C1308.072998,215.900360 1308.018433,217.906738 1308.333130,219.788559 
-	C1308.418823,220.300919 1310.274902,221.012451 1311.112427,220.804092 
-	C1313.044189,220.323456 1314.849487,219.334778 1316.706177,218.552185 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1350.020264,185.024643 
-	C1356.957397,180.611725 1360.547485,181.812607 1361.497437,189.432190 
-	C1358.861450,189.716095 1356.222412,190.000351 1353.404297,190.303879 
-	C1354.638428,196.092331 1358.076416,191.758377 1360.385742,192.050369 
-	C1358.848877,196.804321 1355.533325,197.032562 1350.365967,192.974426 
-	C1349.998047,193.013031 1350.044312,193.003983 1350.202515,192.578506 
-	C1350.255005,189.767975 1350.149292,187.382919 1350.021729,184.992676 
-	C1349.999878,184.987503 1350.020264,185.024643 1350.020264,185.024643 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M57.023952,386.981110 
-	C56.134705,388.577576 55.332420,390.231598 54.327003,391.751221 
-	C53.601826,392.847290 52.606312,393.764526 51.731369,394.761505 
-	C50.964226,393.805725 50.022396,392.939484 49.474903,391.871155 
-	C48.816391,390.586151 48.493301,389.129242 47.794727,387.067047 
-	C46.980629,388.713989 46.415939,389.856354 45.413185,390.924896 
-	C44.010391,389.839874 43.045662,388.828674 42.080933,387.817444 
-	C43.037090,386.775726 44.032574,385.766846 44.938778,384.683319 
-	C45.920563,383.509399 46.819118,382.265900 47.753952,381.052704 
-	C48.655457,382.289734 49.592583,383.502930 50.443321,384.773895 
-	C50.862572,385.400269 51.122154,386.133545 51.526714,386.968536 
-	C53.004875,384.641541 54.306690,382.592163 55.608509,380.542786 
-	C56.108093,380.783813 56.607677,381.024872 57.107258,381.265900 
-	C56.928066,382.955597 56.748875,384.645294 56.776375,386.662292 
-	C56.983067,386.989594 57.023949,386.981110 57.023952,386.981110 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M740.227051,421.334015 
-	C740.104858,422.404053 740.036804,423.121857 739.974182,424.199829 
-	C737.718506,424.824341 735.457458,425.088623 733.019592,425.373596 
-	C733.711426,431.313812 737.631104,426.755249 740.473572,428.595734 
-	C738.880371,429.345581 737.058105,430.981964 735.746155,430.643036 
-	C733.635986,430.097900 731.145020,428.643494 730.150757,426.837769 
-	C729.171814,425.059601 729.854309,422.366730 729.403198,419.774017 
-	C728.998657,419.472839 729.000061,419.538483 729.000061,419.538483 
-	C730.092468,419.139069 731.174988,418.709869 732.279053,418.345886 
-	C735.587280,417.255341 738.713196,416.768402 740.227051,421.334015 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M376.124512,181.128494 
-	C375.009399,178.525085 373.582794,176.116104 373.605804,173.721069 
-	C373.640198,170.145233 376.304443,168.462875 379.800140,168.827606 
-	C383.704315,169.234955 385.070984,171.724503 384.561890,175.773666 
-	C381.936371,176.002136 379.382050,176.224411 376.638702,176.463120 
-	C377.549316,182.330933 381.746246,177.584427 383.922943,178.967392 
-	C381.317535,182.330887 381.317535,182.330887 376.124512,181.128494 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1176.949829,777.876038 
-	C1176.640625,775.895569 1176.222168,774.230591 1176.428223,772.646912 
-	C1176.887573,769.119141 1179.118896,767.401489 1182.665527,767.775146 
-	C1186.616455,768.191284 1187.733154,770.839050 1187.624634,774.735107 
-	C1184.912964,774.929993 1182.325806,775.115906 1179.556030,775.314941 
-	C1180.225098,781.351074 1184.301270,776.846436 1186.571533,777.627930 
-	C1184.386841,782.069580 1181.493164,782.209106 1176.949829,777.876038 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1060.215698,486.341644 
-	C1061.598389,485.659760 1062.981201,484.977875 1065.221802,483.872925 
-	C1065.348755,485.615051 1065.301514,487.842010 1065.740234,489.968658 
-	C1066.030518,491.375763 1067.018066,492.638977 1067.693237,493.966614 
-	C1068.665771,492.659515 1070.086182,491.479584 1070.502197,490.014496 
-	C1071.079102,487.982056 1070.901611,485.735535 1071.047119,483.580658 
-	C1071.585571,483.581390 1072.124146,483.582092 1072.662598,483.582825 
-	C1072.662598,487.552551 1072.662598,491.522247 1072.662598,495.611084 
-	C1068.160522,496.956329 1063.767334,497.095459 1061.067261,491.124329 
-	C1060.419067,489.441681 1060.317383,487.891663 1060.215698,486.341644 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1126.431396,432.603455 
-	C1125.988770,433.723694 1125.865234,434.626923 1125.379517,435.245789 
-	C1124.639771,436.188293 1123.649414,436.933899 1122.765381,437.763062 
-	C1122.032471,436.955841 1121.227661,436.200378 1120.593750,435.321686 
-	C1120.222168,434.806702 1120.288574,433.932556 1119.868164,433.504547 
-	C1118.843018,432.460876 1117.649048,431.583008 1116.523071,430.638367 
-	C1115.872559,431.803772 1115.180298,432.948273 1114.583496,434.140533 
-	C1113.994141,435.317932 1113.501221,436.543579 1112.966064,437.748047 
-	C1112.359741,436.459442 1111.458130,435.222565 1111.220825,433.869293 
-	C1110.916748,432.133942 1111.146973,430.304962 1111.146973,428.615784 
-	C1119.864990,426.868469 1119.864990,426.868469 1122.765259,431.189453 
-	C1124.072021,429.998230 1125.359619,428.824554 1126.647217,427.650909 
-	C1127.023926,427.889221 1127.400757,428.127533 1127.777588,428.365845 
-	C1127.381226,429.663605 1126.984741,430.961365 1126.431396,432.603455 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M837.483826,89.044937 
-	C837.062622,88.050621 837.107300,87.093781 837.146606,85.781670 
-	C849.037292,85.426399 860.933289,85.426399 872.966797,85.426399 
-	C874.600342,89.057220 872.343079,89.215279 869.773804,89.202118 
-	C859.165833,89.147781 848.557739,89.119965 837.483826,89.044937 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M281.937622,378.266174 
-	C284.131531,378.248932 285.958527,377.978668 288.111298,377.660187 
-	C285.807190,381.012207 283.374542,381.862762 280.670349,380.359833 
-	C277.366882,378.523834 276.937988,375.507843 277.700439,372.161316 
-	C278.461609,368.820465 280.813660,367.514099 283.996216,367.839600 
-	C287.670685,368.215363 288.892365,370.697418 288.932281,374.782776 
-	C286.866577,374.886963 284.977020,375.036346 283.085693,375.064148 
-	C280.647858,375.100037 280.012695,375.969788 281.937622,378.266174 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M97.665741,845.843750 
-	C97.419731,842.705078 97.336914,839.900330 97.349243,837.096008 
-	C97.358269,835.044067 96.681259,832.525391 100.182205,832.577209 
-	C103.218880,832.622192 106.444939,832.505127 107.516647,836.142151 
-	C108.373108,839.048523 106.659760,840.627869 103.992233,841.731873 
-	C102.683311,842.273621 101.855705,843.888428 100.660973,844.827698 
-	C99.867256,845.451660 98.809334,845.739563 97.665741,845.843750 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M515.966309,660.009155 
-	C523.296021,656.088501 526.903564,657.524231 527.031799,664.807373 
-	C524.470825,664.979431 521.885864,665.153137 519.106323,665.339966 
-	C519.793884,671.552734 524.262329,666.672302 526.832642,669.274780 
-	C524.749634,669.830444 522.432983,671.213928 520.649048,670.710266 
-	C518.846252,670.201294 517.088135,668.048401 516.219849,666.190674 
-	C515.540100,664.736328 516.249573,662.632751 516.179443,660.395508 
-	C516.017090,659.973389 515.972473,659.986572 515.966309,660.009155 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M735.946167,305.758057 
-	C736.530273,304.030060 737.339294,302.339539 737.634949,300.563538 
-	C737.926575,298.811676 737.698547,296.973267 737.698547,295.207031 
-	C748.560852,294.459900 750.939636,297.532959 746.093628,307.371887 
-	C745.903564,305.239136 745.948425,303.048706 745.443909,300.993164 
-	C745.084106,299.527161 743.985901,298.242401 743.217163,296.876770 
-	C742.374695,298.283813 741.315979,299.608307 740.739990,301.117065 
-	C739.858765,303.425293 742.842712,308.274475 736.343506,306.753418 
-	C735.968689,306.303009 735.956177,306.030579 735.946167,305.758057 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1083.219482,186.753204 
-	C1079.877075,184.912842 1077.728149,182.348450 1079.015137,178.943283 
-	C1079.837280,176.768295 1081.971313,174.059402 1083.960083,173.626862 
-	C1086.229248,173.133392 1089.913330,174.170746 1091.279419,175.893463 
-	C1092.659302,177.633408 1092.810425,181.347031 1091.962158,183.622894 
-	C1090.651733,187.138626 1087.169067,187.827133 1083.219482,186.753204 
-M1089.462646,178.054016 
-	C1086.116211,175.047195 1083.013428,175.188126 1082.314209,178.575851 
-	C1081.994019,180.126724 1082.519775,182.230026 1083.445068,183.521667 
-	C1084.021484,184.326172 1086.850464,184.726257 1087.294800,184.183365 
-	C1088.503052,182.707199 1088.980225,180.632660 1089.462646,178.054016 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1124.099121,415.237000 
-	C1117.224243,416.046234 1117.222290,416.046234 1117.209473,409.735199 
-	C1117.204102,407.128998 1117.208618,404.522797 1117.208618,402.048431 
-	C1123.977661,400.529724 1128.148682,401.953918 1129.570679,405.957336 
-	C1130.988770,409.949921 1129.304810,412.995056 1124.099121,415.237000 
-M1123.927856,404.163391 
-	C1118.664551,403.044250 1120.345093,407.051880 1120.319092,409.395630 
-	C1120.306641,410.519928 1121.506958,411.657684 1122.157959,412.789368 
-	C1123.566650,411.908905 1125.987671,411.186310 1126.155151,410.112366 
-	C1126.430054,408.349396 1125.242432,406.358459 1123.927856,404.163391 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M735.868042,305.554199 
-	C735.956177,306.030579 735.968689,306.303009 735.991211,306.780029 
-	C733.818237,307.166809 731.631714,307.534149 729.459351,307.463989 
-	C728.075317,307.419312 726.569153,306.957397 725.396118,306.232300 
-	C724.747314,305.831177 724.282715,304.443085 724.410217,303.602386 
-	C724.814941,300.934906 724.746704,297.605927 726.325562,295.847412 
-	C728.579956,293.336487 731.964355,293.442719 734.277832,297.425232 
-	C734.583862,300.528961 734.999084,302.828430 735.414307,305.127869 
-	C735.414307,305.127869 735.789978,305.350372 735.868042,305.554199 
-M731.292175,297.075562 
-	C729.842529,297.412048 728.392883,297.748535 726.943237,298.085022 
-	C727.183960,298.735840 727.424744,299.386658 727.665466,300.037476 
-	C729.062378,299.269592 730.459290,298.501740 731.292175,297.075562 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1497.993896,832.023560 
-	C1500.924072,831.977966 1503.937012,831.480347 1506.763794,831.998718 
-	C1510.480225,832.680359 1511.676514,836.731018 1509.031128,839.181213 
-	C1506.644287,841.391907 1503.869995,843.184265 1500.903076,845.437195 
-	C1500.241455,841.724915 1499.542847,837.804932 1498.413574,833.537964 
-	C1497.986694,832.801880 1497.990356,832.412720 1497.993896,832.023560 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1508.171021,408.471222 
-	C1509.655518,406.840302 1511.139038,405.660858 1512.483276,404.339783 
-	C1513.668335,403.174835 1514.698120,401.851898 1516.389526,399.922211 
-	C1518.936035,404.851685 1517.263672,409.589050 1517.662109,414.111938 
-	C1508.982544,415.077423 1508.624878,414.868011 1508.171021,408.471222 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1113.073242,543.453491 
-	C1113.050049,544.294922 1113.013062,544.777161 1112.986572,545.499756 
-	C1110.443359,546.126526 1107.889893,546.512939 1105.158447,546.926208 
-	C1106.202515,552.810608 1110.086792,548.175598 1112.430908,548.913879 
-	C1110.272339,553.523315 1106.631348,553.612976 1102.820312,548.606689 
-	C1102.630371,546.946350 1102.403320,546.002319 1102.176392,545.058228 
-	C1102.216187,544.182434 1102.255981,543.306580 1102.140137,542.020020 
-	C1101.984497,541.609314 1102.000366,541.664734 1102.000366,541.664734 
-	C1107.952637,537.846436 1110.129150,538.127808 1113.073242,543.453491 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1101.998047,714.691772 
-	C1107.347412,710.267700 1110.249634,710.610718 1113.083008,716.629761 
-	C1113.030396,717.436646 1113.026733,717.621582 1113.023071,717.806580 
-	C1110.533203,718.433533 1108.043335,719.060547 1105.552490,719.687744 
-	C1106.230347,722.376404 1106.230347,722.376404 1112.433105,721.939270 
-	C1112.584961,722.333191 1112.736938,722.727173 1112.888794,723.121094 
-	C1110.841431,723.721863 1108.569702,725.162598 1106.808472,724.692200 
-	C1104.967529,724.200439 1103.210449,722.096252 1102.194458,720.265320 
-	C1101.505371,719.023193 1102.158081,717.036682 1102.094971,715.010498 
-	C1101.979370,714.637939 1101.998047,714.691772 1101.998047,714.691772 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1499.939209,614.076538 
-	C1498.606445,615.091736 1497.641724,616.005249 1496.703735,616.945496 
-	C1496.087402,617.563416 1495.509888,618.219971 1494.915039,618.859253 
-	C1494.365356,618.008484 1493.388672,617.180664 1493.341553,616.302856 
-	C1493.156982,612.869019 1493.266113,609.419434 1493.266113,605.760437 
-	C1497.167114,604.763794 1500.922241,604.072632 1503.174805,607.794006 
-	C1504.813843,610.501526 1503.317871,612.852234 1499.939209,614.076538 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1572.930420,169.914078 
-	C1573.746948,172.060730 1574.439941,173.844284 1575.133057,175.627838 
-	C1574.810303,175.926407 1574.487671,176.224976 1574.164917,176.523544 
-	C1572.370483,175.364609 1570.580322,173.296906 1568.780518,173.288483 
-	C1566.762329,173.279053 1564.735474,175.132309 1561.520508,175.759430 
-	C1563.245239,171.531876 1564.904419,167.273361 1566.851318,163.150726 
-	C1566.973145,162.892670 1569.915894,163.267212 1570.549438,164.103104 
-	C1571.698242,165.618652 1572.095825,167.703674 1572.930420,169.914078 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M952.117493,105.062027 
-	C952.334473,102.478195 952.565186,99.895416 952.764099,97.310196 
-	C952.914429,95.356293 953.024231,93.399277 953.805176,91.432915 
-	C956.272095,93.103271 958.138428,94.186523 956.142456,97.596817 
-	C955.135376,99.317581 954.233765,103.480713 958.787231,105.183548 
-	C959.064270,101.294777 959.318787,97.721947 959.573364,94.149124 
-	C960.211426,94.142105 960.849548,94.135086 961.487610,94.128067 
-	C961.696777,98.085182 961.905945,102.042290 962.182983,107.283852 
-	C958.545654,106.391632 955.688599,105.690811 952.462463,105.000633 
-	C952.093384,105.011269 952.117493,105.062027 952.117493,105.062027 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M561.085449,689.323242 
-	C562.236755,685.911560 565.114868,684.986938 567.850220,686.125916 
-	C569.829895,686.950134 571.104126,689.468567 572.692932,691.231445 
-	C572.370911,691.738770 572.048828,692.246155 571.726807,692.753479 
-	C569.178650,692.923157 566.630554,693.092834 563.787170,693.282166 
-	C564.409058,699.288391 568.327271,695.168335 570.611572,695.571899 
-	C570.802795,696.047485 570.994019,696.523071 571.185242,696.998596 
-	C569.260803,697.652588 567.254395,699.026306 565.428284,698.818115 
-	C560.932800,698.305664 560.195068,694.872559 560.839966,690.376892 
-	C561.022339,689.758362 561.085449,689.323242 561.085449,689.323242 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M98.774742,181.862366 
-	C98.673004,183.758530 98.571579,185.191925 98.454102,186.852264 
-	C97.090691,186.852264 96.105080,186.733429 95.158432,186.875031 
-	C92.546333,187.265778 89.987534,187.406555 89.254883,184.128708 
-	C88.534752,180.906845 89.289139,178.195450 92.861908,177.057831 
-	C93.329231,176.909042 93.974335,177.036514 94.294533,176.757584 
-	C95.548363,175.665390 96.704903,174.461502 97.897591,173.299103 
-	C98.190582,175.504639 98.494987,177.708755 98.767670,179.916794 
-	C98.827827,180.403946 98.775558,180.904968 98.774742,181.862366 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1279.517700,189.075439 
-	C1279.661499,186.699951 1279.787720,184.762024 1279.914062,182.824081 
-	C1280.470337,182.828430 1281.026733,182.832764 1281.583008,182.837097 
-	C1281.583008,186.831085 1281.583008,190.825073 1281.583008,195.834045 
-	C1278.681152,195.208389 1274.073242,195.521500 1272.855469,193.640213 
-	C1271.112061,190.946640 1271.845825,186.649780 1271.521729,183.037521 
-	C1272.333008,182.948166 1273.144165,182.858810 1273.955322,182.769470 
-	C1274.158691,184.749054 1274.191284,186.766388 1274.618286,188.696533 
-	C1274.972290,190.297119 1275.790894,191.794907 1276.403687,193.338226 
-	C1277.435791,192.063141 1278.468018,190.788055 1279.517700,189.075439 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1100.380249,741.613770 
-	C1099.973755,741.365723 1100.015991,741.410950 1100.010254,741.440308 
-	C1101.104126,740.056519 1102.203735,738.643250 1103.518066,736.954163 
-	C1104.651855,738.360352 1105.634033,739.578369 1106.616577,740.796875 
-	C1103.590332,744.853516 1103.937500,748.721680 1107.786255,750.927063 
-	C1108.057495,747.219727 1108.319336,743.639526 1108.581177,740.059265 
-	C1109.136719,740.032471 1109.692261,740.005676 1110.247803,739.978882 
-	C1110.489990,741.363892 1110.732056,742.748901 1111.023438,744.769409 
-	C1111.009644,745.925049 1110.946533,746.445190 1110.883423,746.965271 
-	C1110.883423,748.717773 1110.883423,750.470276 1110.883423,752.292542 
-	C1109.125610,752.428406 1107.848755,752.357422 1106.661865,752.650513 
-	C1102.978516,753.560120 1101.995728,751.550659 1101.723389,748.451111 
-	C1101.529541,746.244263 1101.107178,744.057495 1100.380249,741.613770 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M952.069458,104.996529 
-	C951.244324,105.597855 950.506897,106.606651 949.628662,106.749374 
-	C947.715881,107.060242 945.731323,106.929939 943.422058,106.586578 
-	C943.067993,104.697525 943.067993,103.201828 943.067993,100.482994 
-	C941.230286,102.456268 940.460999,103.282265 939.691711,104.108200 
-	C940.514099,102.074074 941.336487,100.040001 942.168457,97.982277 
-	C942.078613,97.946625 941.215942,97.604431 940.048584,97.141373 
-	C941.163147,93.780228 943.860291,93.071144 946.248535,94.062958 
-	C947.881226,94.740997 949.069153,97.077240 949.904480,98.921867 
-	C950.729675,100.744080 950.861938,102.880119 951.707825,104.970261 
-	C952.117493,105.062027 952.093384,105.011269 952.069458,104.996529 
-M944.190369,96.285507 
-	C944.184509,97.030693 944.178650,97.775871 944.172729,98.521057 
-	C945.029785,98.338913 945.886841,98.156769 946.743896,97.974648 
-	C946.204468,97.356934 945.665039,96.739227 944.190369,96.285507 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1125.644287,176.337402 
-	C1126.942993,179.948898 1128.116455,183.207291 1129.289917,186.465668 
-	C1128.968506,187.019333 1128.647217,187.573013 1128.325806,188.126678 
-	C1124.520264,182.694031 1120.729248,182.404388 1116.955688,188.243393 
-	C1116.612549,187.654465 1116.269531,187.065521 1115.926392,186.476593 
-	C1117.561035,182.368210 1118.661987,177.917099 1121.006836,174.264664 
-	C1122.742676,171.560989 1124.604614,173.714310 1125.644287,176.337402 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M775.257690,184.674881 
-	C775.122620,182.990219 775.014160,181.706589 774.905762,180.422974 
-	C774.409668,180.178467 773.913574,179.933960 773.417480,179.689468 
-	C772.451904,181.281601 771.473572,182.866211 770.525024,184.468491 
-	C769.872986,185.569885 769.262268,186.695724 768.633118,187.810669 
-	C768.114563,186.589218 767.329407,185.407043 767.142273,184.136780 
-	C766.884216,182.384811 767.077515,180.566376 767.077515,179.107407 
-	C770.790527,178.085052 774.028320,177.193558 778.081543,176.077499 
-	C778.309753,176.350052 779.300964,177.533783 779.530029,177.807312 
-	C779.530029,181.556412 779.530029,184.401749 779.530029,188.448822 
-	C778.123596,187.331528 776.703979,186.203720 775.257690,184.674881 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1316.958252,183.959351 
-	C1320.541016,183.852493 1325.921875,182.290131 1327.287964,183.977707 
-	C1329.370972,186.550873 1328.677124,191.372040 1329.162354,195.238693 
-	C1328.312500,195.339005 1327.462524,195.439316 1326.612671,195.539627 
-	C1326.436523,193.389694 1326.507324,191.179291 1326.000854,189.110260 
-	C1325.640015,187.636658 1324.501953,186.353333 1323.710815,184.985107 
-	C1322.883301,186.406143 1321.717896,187.737656 1321.311768,189.270370 
-	C1320.778931,191.280884 1320.844849,193.450043 1320.653198,195.550980 
-	C1320.038818,195.547302 1319.424316,195.543640 1318.809814,195.539963 
-	C1318.473267,191.822495 1318.136719,188.105042 1317.396240,184.112625 
-	C1316.992188,183.837677 1316.958252,183.959351 1316.958252,183.959351 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1271.998779,158.425613 
-	C1275.454590,156.067032 1278.615112,152.198608 1283.649658,156.365631 
-	C1283.982300,156.519318 1283.959839,156.462479 1283.836060,156.754028 
-	C1281.547119,157.168076 1279.381958,157.290573 1275.908936,157.487061 
-	C1280.096436,159.988205 1283.064819,161.761154 1286.008911,163.556854 
-	C1285.984619,163.579575 1286.003906,163.577347 1286.003906,163.577332 
-	C1285.316406,164.112183 1284.507080,164.545349 1283.961304,165.198639 
-	C1280.796387,168.987808 1277.511353,168.848465 1272.438721,164.649750 
-	C1272.005249,164.642960 1271.966187,164.534912 1272.384399,164.714813 
-	C1275.505371,164.894714 1278.208252,164.894714 1280.911011,164.894714 
-	C1280.975220,164.455246 1281.039429,164.015793 1281.103638,163.576324 
-	C1278.057983,161.873505 1275.012329,160.170670 1271.987549,158.445038 
-	C1272.008423,158.422211 1271.998779,158.425613 1271.998779,158.425613 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M116.329346,847.187805 
-	C115.285179,848.284180 114.554924,849.159485 113.824661,850.034851 
-	C113.474350,849.877075 113.124039,849.719299 112.773727,849.561523 
-	C112.773727,845.560974 112.773727,841.560364 112.773727,837.196716 
-	C115.868713,837.679260 120.105659,834.000610 121.708138,839.648926 
-	C122.862679,843.718384 121.058960,846.412964 116.329346,847.187805 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1111.326172,747.004700 
-	C1110.946533,746.445190 1111.009644,745.925049 1110.980957,745.240967 
-	C1111.771606,744.237366 1112.515625,743.080994 1113.564453,742.622437 
-	C1115.944946,741.581726 1119.025269,739.624451 1120.793213,740.395752 
-	C1122.622559,741.193970 1124.214844,744.829773 1124.087891,747.123352 
-	C1123.977661,749.112000 1121.570923,752.134094 1119.711548,752.536011 
-	C1117.882080,752.931458 1115.398560,750.710632 1113.339966,749.418152 
-	C1112.608032,748.958557 1112.281006,747.854187 1111.326172,747.004700 
-M1115.645996,745.633362 
-	C1116.515991,747.355164 1117.385986,749.076965 1118.256104,750.798767 
-	C1119.327881,749.796997 1121.257324,748.817261 1121.283691,747.788574 
-	C1121.331421,745.932068 1120.241089,744.046326 1119.626099,742.172729 
-	C1118.333130,743.046509 1117.040039,743.920288 1115.645996,745.633362 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1113.157715,776.288696 
-	C1113.453247,774.257507 1113.740112,772.587036 1114.028442,770.604614 
-	C1116.319214,769.552002 1118.893311,767.814392 1120.814331,768.363098 
-	C1122.584473,768.868713 1123.652832,771.830688 1125.726929,774.661377 
-	C1121.341064,774.948792 1118.760010,775.117920 1116.053101,775.295288 
-	C1116.785156,781.417908 1121.135132,776.738953 1123.548218,777.786133 
-	C1119.937622,782.553833 1116.263672,782.069702 1113.157715,776.288696 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1124.718018,513.504700 
-	C1121.495972,515.162048 1123.685425,515.574768 1124.982422,516.555115 
-	C1126.647461,517.813416 1128.194336,519.320190 1129.386719,521.006470 
-	C1129.553345,521.242249 1127.470703,523.966553 1126.328735,524.043396 
-	C1123.930420,524.204590 1121.465088,523.371338 1119.027344,522.946350 
-	C1119.142822,522.318115 1119.258179,521.689819 1119.373657,521.061584 
-	C1121.593140,521.349487 1123.812744,521.637390 1126.032227,521.925354 
-	C1126.200439,521.431335 1126.368652,520.937256 1126.536865,520.443237 
-	C1125.408447,519.786255 1124.104614,519.310852 1123.193115,518.429626 
-	C1121.831543,517.113220 1120.746338,515.511108 1119.543701,514.030518 
-	C1121.474365,513.116943 1123.335693,511.787781 1125.362427,511.449158 
-	C1126.536621,511.252960 1127.977051,512.650757 1129.297729,513.331238 
-	C1129.087036,513.829407 1128.876465,514.327637 1128.665771,514.825806 
-	C1127.481445,514.404968 1126.296997,513.984131 1124.718018,513.504700 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M313.529846,176.914383 
-	C313.013153,178.507965 312.496429,180.101547 311.605469,182.849411 
-	C309.626495,178.896469 308.218719,176.084488 306.226349,172.104767 
-	C305.908203,176.193359 305.693512,178.951996 305.478851,181.710648 
-	C305.050537,181.764603 304.622223,181.818573 304.193939,181.872528 
-	C303.819977,180.998215 303.151215,180.133224 303.123199,179.247955 
-	C303.002930,175.446167 302.968842,171.633682 303.145813,167.836380 
-	C303.187531,166.940598 304.171021,166.088684 304.721252,165.216583 
-	C305.615936,165.799072 306.920807,166.177094 307.331451,167.000870 
-	C308.794983,169.936981 309.954498,173.024628 311.736206,176.229752 
-	C312.672150,176.574524 313.101013,176.744461 313.529846,176.914383 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M988.006226,97.339661 
-	C989.548096,96.274879 990.955750,94.811264 992.662598,94.236519 
-	C995.387207,93.319107 998.054504,93.613594 999.932190,97.327751 
-	C997.274658,96.877449 995.288696,96.540947 992.270325,96.029510 
-	C994.507080,100.258110 1001.094910,98.757973 999.692505,104.084747 
-	C999.360779,105.344749 997.057800,106.847031 995.633423,106.876587 
-	C993.584778,106.919090 991.510193,105.714699 989.446716,105.042519 
-	C989.612671,104.549850 989.778564,104.057182 989.944519,103.564514 
-	C992.124268,103.925102 994.303955,104.285690 996.483704,104.646278 
-	C996.610046,104.321030 996.736389,103.995789 996.862793,103.670540 
-	C994.171570,101.389488 991.480408,99.108444 988.376709,97.018547 
-	C987.964233,97.209702 988.006226,97.339653 988.006226,97.339661 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1365.098145,188.970734 
-	C1362.830811,186.969177 1362.333374,184.840225 1364.877563,183.482025 
-	C1367.748047,181.949570 1370.816895,181.702469 1373.315674,185.833481 
-	C1370.729980,185.456696 1368.816162,185.177811 1366.902222,184.898926 
-	C1366.736938,185.266785 1366.571533,185.634628 1366.406250,186.002487 
-	C1367.357056,186.616241 1368.240234,187.400742 1369.272217,187.809509 
-	C1371.707642,188.774200 1374.749878,190.102798 1372.961792,192.893250 
-	C1371.890869,194.564484 1368.338623,194.907440 1365.820190,195.252823 
-	C1364.891968,195.380112 1363.729736,193.800919 1363.184692,192.148727 
-	C1365.407837,192.519104 1367.630981,192.889465 1369.854126,193.259842 
-	C1370.021240,192.690643 1370.188354,192.121460 1370.355347,191.552261 
-	C1368.714844,190.750885 1367.074341,189.949509 1365.098145,188.970734 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1128.194336,547.521118 
-	C1128.294800,544.560425 1128.436890,542.019348 1128.578857,539.478210 
-	C1129.245605,539.427490 1129.912354,539.376709 1130.579102,539.325989 
-	C1130.793823,541.431885 1130.798828,543.588562 1131.292969,545.626709 
-	C1131.654541,547.118042 1132.659058,548.453430 1133.376953,549.858337 
-	C1134.267212,548.456970 1135.528809,547.159119 1135.955566,545.628540 
-	C1136.514282,543.625061 1136.413452,541.437683 1136.596313,539.329407 
-	C1137.123535,539.344299 1137.650757,539.359192 1138.177979,539.374084 
-	C1138.177979,543.309631 1138.177979,547.245178 1138.177979,551.611511 
-	C1134.882202,550.889465 1129.613281,555.585205 1128.194336,547.521118 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M313.162567,197.183655 
-	C313.035522,197.944519 313.010712,198.333542 313.020264,198.918579 
-	C313.104889,201.780289 313.155182,204.445984 312.808899,207.558563 
-	C311.328247,208.433334 310.244232,208.861206 309.160187,209.289078 
-	C304.458069,210.112228 302.742310,208.884491 302.330963,204.402252 
-	C301.822296,198.860031 303.635071,196.945633 309.681427,196.677261 
-	C310.266815,195.300583 310.857300,193.911911 311.447815,192.523239 
-	C311.862976,192.533646 312.278168,192.544052 312.693359,192.554474 
-	C312.883850,193.973572 313.074341,195.392670 313.162567,197.183655 
-M305.096558,201.768631 
-	C305.072327,202.422424 304.800598,203.212219 305.070923,203.704193 
-	C305.841888,205.107285 306.833435,206.389160 307.738190,207.718735 
-	C308.611237,206.885742 310.193390,206.070068 310.214264,205.216263 
-	C310.262085,203.257004 309.548706,201.279160 309.144379,199.308868 
-	C307.852356,199.865372 306.560364,200.421875 305.096558,201.768631 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M540.747803,206.367828 
-	C538.974792,208.679535 537.923340,208.182404 537.566345,205.832916 
-	C537.348938,204.401871 537.356323,202.936646 536.390503,201.217926 
-	C535.801147,202.428589 535.336548,203.724045 534.587646,204.826309 
-	C533.821899,205.953384 532.777405,206.891006 531.854858,207.911530 
-	C530.945129,206.859421 529.870972,205.906097 529.165527,204.731339 
-	C528.182068,203.093414 527.474243,201.289963 526.055969,198.314240 
-	C528.746948,199.371902 530.349243,200.001648 531.190430,200.332260 
-	C534.347656,199.405472 537.163879,198.578766 540.809387,197.508636 
-	C540.809387,201.093262 540.809387,203.525345 540.747803,206.367828 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1150.952271,779.631042 
-	C1151.244385,778.498535 1151.881348,777.328979 1151.764282,776.240540 
-	C1151.404541,772.895752 1151.466064,769.371277 1155.059204,768.337158 
-	C1157.096802,767.750732 1161.207031,768.678284 1161.814331,770.056274 
-	C1162.903564,772.528198 1163.003906,776.343811 1161.785767,778.704224 
-	C1160.108887,781.953308 1156.564941,781.491150 1153.511597,779.634338 
-	C1152.970337,779.305176 1152.302734,779.183777 1151.317871,779.270935 
-	C1150.942261,779.575500 1150.952271,779.631042 1150.952271,779.631042 
-M1154.345947,773.672974 
-	C1154.590332,776.327942 1154.501221,779.685669 1158.541138,778.320068 
-	C1159.593262,777.964417 1160.077271,774.986023 1160.191528,773.172546 
-	C1160.253784,772.183594 1158.993408,771.111328 1158.329468,770.076660 
-	C1157.043823,771.020386 1155.758301,771.964111 1154.345947,773.672974 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M987.844971,96.964989 
-	C988.006226,97.339653 987.964233,97.209702 987.959351,97.175423 
-	C987.954529,100.340729 987.954529,103.540321 987.954529,106.739906 
-	C987.159851,106.782127 986.365173,106.824341 985.570496,106.866562 
-	C985.387329,104.695816 985.446289,102.466354 984.938965,100.374222 
-	C984.579346,98.891006 983.454651,97.593300 982.671448,96.212776 
-	C981.845520,97.652115 980.686096,99.003319 980.276550,100.552711 
-	C979.741821,102.576042 979.800598,104.756248 979.604004,106.868950 
-	C979.039246,106.841118 978.474426,106.813293 977.909668,106.785461 
-	C977.909668,102.745415 977.909668,98.705360 977.909668,94.319298 
-	C981.066528,95.154068 985.248047,91.403336 987.844971,96.964989 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M264.997559,371.307251 
-	C265.322205,369.891205 265.643768,368.916809 265.965332,367.942413 
-	C266.436920,367.963776 266.908508,367.985138 267.380096,368.006500 
-	C267.545349,370.293091 267.485260,372.627930 267.960724,374.848083 
-	C268.243866,376.170166 269.368652,377.311981 270.115051,378.534851 
-	C270.973236,377.295959 272.272217,376.158966 272.587708,374.794586 
-	C273.077271,372.677277 272.896912,370.405060 273.000549,368.198517 
-	C273.683197,368.166168 274.365814,368.133789 275.048431,368.101440 
-	C275.314850,372.133362 275.581238,376.165283 275.849213,380.220978 
-	C264.949219,380.831787 264.949219,380.831787 264.997559,371.307251 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1136.786377,751.271240 
-	C1135.838013,751.465454 1134.258667,751.362976 1134.205566,751.022278 
-	C1133.926880,749.236816 1134.268433,747.345764 1133.927612,745.581604 
-	C1133.692017,744.362061 1132.699341,743.288818 1132.044922,742.150208 
-	C1131.113159,743.296509 1129.666504,744.321838 1129.362793,745.615601 
-	C1128.821411,747.920654 1128.971069,750.388123 1128.831909,752.787659 
-	C1128.186523,752.760376 1127.541016,752.733093 1126.895630,752.705750 
-	C1126.895630,748.649109 1126.895630,744.592407 1126.895630,740.365723 
-	C1126.933350,740.343811 1127.216553,740.033875 1127.492432,740.040344 
-	C1137.164307,740.268066 1137.164185,740.272278 1136.786377,751.271240 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M809.092712,332.507568 
-	C811.406128,332.547791 813.631042,332.859894 815.855896,333.171967 
-	C816.045715,332.707977 816.235474,332.243958 816.425232,331.779968 
-	C815.356934,331.097198 814.158569,330.552826 813.250305,329.699707 
-	C811.839600,328.374542 810.626282,326.839172 809.329285,325.392944 
-	C810.548035,324.445953 811.739868,322.765930 812.991577,322.720123 
-	C814.973999,322.647614 816.996399,323.668884 819.001892,324.227356 
-	C818.825317,324.718201 818.648682,325.209076 818.472107,325.699921 
-	C816.612305,325.393616 814.752502,325.087280 812.892700,324.780945 
-	C812.750732,325.215973 812.608826,325.651001 812.466919,326.086029 
-	C813.505066,326.672546 814.767090,327.054199 815.532227,327.890472 
-	C816.901245,329.386749 817.970886,331.156982 819.165649,332.812683 
-	C817.222595,333.744598 815.324036,335.253418 813.320984,335.407990 
-	C811.957764,335.513123 810.448242,333.722382 809.092712,332.507568 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M503.021484,716.021484 
-	C508.982605,712.532043 513.381836,713.095093 514.079407,717.877136 
-	C514.451111,720.425537 513.545898,723.965820 511.855499,725.811584 
-	C509.591217,728.283936 506.340302,727.154236 503.477112,724.731262 
-	C503.062958,724.613037 503.045197,724.511169 503.175720,724.127197 
-	C503.218658,721.161255 503.131073,718.579224 503.021912,715.991455 
-	C503.000336,715.985718 503.021484,716.021484 503.021484,716.021484 
-M506.074860,722.860962 
-	C507.420715,723.385376 508.766541,723.909851 510.112396,724.434265 
-	C510.554016,722.286926 511.258209,720.142151 511.279785,717.990601 
-	C511.286377,717.330933 509.422516,716.652405 508.415192,715.982483 
-	C507.513702,717.351440 506.522217,718.672852 505.760162,720.115479 
-	C505.498535,720.610779 505.810577,721.409058 506.074860,722.860962 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1036.422363,647.202515 
-	C1033.909668,650.433594 1033.526733,648.306152 1033.451538,646.271240 
-	C1033.322388,642.785645 1033.415771,639.291748 1033.415771,635.544922 
-	C1031.615234,635.093384 1029.961548,634.678711 1028.307983,634.263977 
-	C1028.326172,633.907227 1028.344360,633.550415 1028.362549,633.193604 
-	C1032.740845,633.193604 1037.119263,633.193604 1041.497681,633.193604 
-	C1041.574829,633.466736 1041.652100,633.739807 1041.729248,634.012939 
-	C1040.161133,634.486755 1038.592896,634.960571 1036.465088,635.603516 
-	C1036.465088,639.206177 1036.465088,642.996338 1036.422363,647.202515 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1047.989624,514.038513 
-	C1053.348633,510.045319 1055.123291,510.033905 1059.708374,514.021973 
-	C1060.075562,514.078308 1060.039307,514.040833 1060.024414,514.020752 
-	C1059.972412,515.477905 1059.967285,516.956604 1059.892334,518.431885 
-	C1059.702393,522.171936 1057.791870,524.375977 1053.981934,524.399963 
-	C1050.346313,524.422852 1048.605225,522.178894 1048.288452,518.754333 
-	C1048.167236,517.442932 1048.334473,516.104797 1048.191895,514.389404 
-	C1048.013428,513.999939 1047.989624,514.038513 1047.989624,514.038513 
-M1051.034058,518.437866 
-	C1052.236450,519.643250 1053.438721,520.848572 1054.641113,522.053894 
-	C1055.425415,520.454834 1056.826782,518.846191 1056.802246,517.259705 
-	C1056.781982,515.950867 1055.074097,514.668152 1054.114014,513.373901 
-	C1053.082275,514.793518 1052.050415,516.213074 1051.034058,518.437866 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1597.800903,842.339233 
-	C1596.963013,842.846863 1595.973145,843.207581 1595.314575,843.888672 
-	C1592.946777,846.337769 1590.223267,846.532166 1587.869873,844.426880 
-	C1585.522339,842.326782 1585.241211,839.493347 1587.642700,837.037781 
-	C1590.035156,834.591370 1592.597656,834.938049 1595.069580,837.045166 
-	C1595.767700,837.640320 1596.446899,838.257690 1597.541382,839.214844 
-	C1597.898804,840.489624 1597.849854,841.414429 1597.800903,842.339233 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M84.934471,835.154480 
-	C88.421494,832.679138 91.923698,830.952942 96.403000,835.017212 
-	C92.745346,836.413574 87.125114,833.878174 87.774391,840.230530 
-	C88.307755,845.448975 92.614235,843.188538 95.564484,843.572266 
-	C95.661285,844.065735 95.758087,844.559204 95.854897,845.052673 
-	C93.785599,845.613220 91.451843,847.039307 89.715858,846.508911 
-	C87.676445,845.885803 85.609367,843.848206 84.588348,841.885986 
-	C83.809586,840.389343 84.642212,838.054260 84.849617,835.639099 
-	C84.941238,835.186035 84.934471,835.154480 84.934471,835.154480 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M553.547424,717.155884 
-	C557.058044,712.697632 559.602722,712.605408 563.387085,716.999268 
-	C560.967834,716.701294 559.013733,716.460571 556.567749,716.159302 
-	C557.706665,720.483032 567.789734,719.015259 562.087830,725.936523 
-	C560.045715,728.415344 555.811768,727.096069 553.328674,723.455994 
-	C555.763855,723.850037 557.880310,724.192444 559.996704,724.534851 
-	C560.126770,724.171387 560.256836,723.807983 560.386841,723.444519 
-	C558.094482,721.461670 555.802063,719.478821 553.547424,717.155884 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M480.452332,695.913696 
-	C482.697937,689.739502 482.147034,686.197876 478.093323,682.680481 
-	C480.588348,682.451294 482.340820,682.290283 484.545380,682.087769 
-	C484.545380,686.671936 484.996765,690.816895 484.327240,694.772034 
-	C484.052338,696.396118 481.461029,698.562378 479.739929,698.744080 
-	C478.024597,698.925171 476.079407,696.929016 474.235016,695.887512 
-	C474.587280,695.270752 474.939545,694.653992 475.291809,694.037292 
-	C476.882263,694.726318 478.472687,695.415405 480.452332,695.913696 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M766.015564,334.854126 
-	C762.950623,330.700562 764.238159,326.689209 764.627258,322.696808 
-	C765.270813,322.647095 765.914429,322.597382 766.557983,322.547638 
-	C766.723206,324.762726 766.673401,327.023438 767.130737,329.176483 
-	C767.424805,330.560516 768.464600,331.786102 769.170105,333.082703 
-	C770.128784,331.768158 771.545776,330.575806 771.936707,329.109863 
-	C772.497620,327.006226 772.310303,324.703033 772.442444,322.485046 
-	C773.051270,322.529083 773.660034,322.573120 774.268860,322.617157 
-	C774.268860,326.685730 774.268860,330.754272 774.268860,335.081543 
-	C771.727783,335.081543 769.029541,335.081543 766.015564,334.854126 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M295.373657,372.722778 
-	C297.406281,374.384125 299.084656,375.904358 300.763062,377.424622 
-	C299.690094,378.555420 298.817596,380.140625 297.501831,380.721069 
-	C294.881165,381.877228 292.802490,380.842346 290.321411,377.527893 
-	C292.830139,377.910065 294.946411,378.232452 297.062714,378.554840 
-	C297.250153,378.107697 297.437592,377.660522 297.625061,377.213379 
-	C296.704865,376.542114 295.720917,375.941742 294.878723,375.183807 
-	C293.428070,373.878265 292.065613,372.474670 290.666168,371.112213 
-	C291.796265,370.058411 292.871857,368.210083 294.068604,368.127930 
-	C296.112579,367.987701 298.232544,368.955048 300.320587,369.457153 
-	C300.140381,370.030914 299.960205,370.604675 299.780029,371.178406 
-	C298.504242,370.805786 297.238708,370.168976 295.950439,370.119080 
-	C293.711609,370.032318 292.927887,370.851959 295.373657,372.722778 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1172.856323,515.089783 
-	C1172.928955,515.955750 1172.956909,516.444519 1173.038818,517.165833 
-	C1170.435791,517.898560 1167.779175,518.398743 1164.949951,518.931396 
-	C1165.684204,524.966431 1169.785156,520.436829 1172.256836,520.917114 
-	C1170.223755,525.563049 1166.523682,525.651733 1162.751587,520.632446 
-	C1162.615845,518.617310 1162.408691,517.345398 1162.201660,516.073486 
-	C1163.775146,514.457092 1165.219116,511.733795 1166.957886,511.530273 
-	C1168.760376,511.319305 1170.848511,513.549866 1172.856323,515.089783 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M756.493958,402.701691 
-	C752.271606,401.029480 751.627380,397.708374 752.483765,394.365601 
-	C752.927734,392.632507 754.747559,390.621246 756.426331,389.965179 
-	C760.031921,388.556122 763.067749,390.717346 763.720947,394.458740 
-	C764.637939,399.710907 762.466797,402.352844 756.493958,402.701691 
-M760.767883,393.903259 
-	C759.293457,393.392792 757.819092,392.882355 756.344666,392.371887 
-	C755.987305,394.383789 755.317993,396.412292 755.423828,398.399536 
-	C755.466980,399.210632 757.189636,399.932312 758.148193,400.694672 
-	C759.096741,399.362946 760.133179,398.081848 760.946045,396.671844 
-	C761.227478,396.183746 760.953796,395.375610 760.767883,393.903259 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1172.789795,771.300659 
-	C1172.259155,773.319275 1171.978638,775.070679 1171.634888,777.217773 
-	C1170.994507,777.031128 1169.694824,776.652283 1168.346680,776.259338 
-	C1167.920898,777.710999 1167.494995,779.163452 1166.996704,780.862610 
-	C1164.382690,777.744995 1164.254150,766.874817 1167.131226,762.546814 
-	C1167.442505,764.694580 1167.684448,765.997559 1167.807373,767.311646 
-	C1167.940674,768.736755 1167.963379,770.172241 1168.071777,772.357849 
-	C1170.340576,770.438721 1172.092529,768.956848 1173.844360,767.474976 
-	C1174.194580,767.762756 1174.544800,768.050537 1174.894897,768.338318 
-	C1174.276611,769.236694 1173.658325,770.135071 1172.789795,771.300659 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M260.420593,728.921692 
-	C260.420013,732.072083 260.420013,734.756042 260.420013,737.440063 
-	C259.705322,737.480286 258.990631,737.520508 258.275940,737.560730 
-	C258.043823,735.704224 257.793396,733.849854 257.583405,731.990845 
-	C257.137482,728.043091 260.059296,722.304260 250.685883,723.133057 
-	C251.244797,722.625122 251.803696,722.117188 252.362610,721.609253 
-	C256.778748,721.609253 261.194885,721.609253 265.611023,721.609253 
-	C265.662659,721.962341 265.714325,722.315430 265.765961,722.668518 
-	C264.179169,723.128174 262.592377,723.587830 260.699219,724.136169 
-	C260.607819,725.556213 260.514526,727.005798 260.420593,728.921692 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1032.345093,778.041504 
-	C1035.494873,773.366211 1034.999878,768.395569 1030.698853,764.450317 
-	C1033.198486,764.308289 1034.968262,764.207703 1037.005737,764.091919 
-	C1037.005737,768.703796 1037.523438,772.897156 1036.757080,776.841064 
-	C1036.439819,778.474121 1033.500854,780.311279 1031.512451,780.654297 
-	C1030.194824,780.881470 1028.447876,778.619751 1026.893188,777.472168 
-	C1027.264404,776.977661 1027.635742,776.483154 1028.006958,775.988708 
-	C1029.313721,776.689270 1030.620361,777.389832 1032.345093,778.041504 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1084.096680,752.271545 
-	C1081.269165,751.760071 1077.697144,751.802734 1076.601074,750.176636 
-	C1075.342407,748.309387 1075.559326,744.661865 1076.522827,742.371399 
-	C1077.119385,740.953247 1080.354614,739.820984 1082.307495,739.957764 
-	C1087.402832,740.314636 1088.480835,746.969604 1084.096680,752.271545 
-M1083.552856,743.221802 
-	C1082.002075,743.191956 1079.185791,742.857300 1079.107544,743.182251 
-	C1078.632080,745.155701 1078.554077,747.313660 1078.858032,749.332581 
-	C1078.949829,749.942993 1081.449463,750.832581 1081.536865,750.704041 
-	C1082.545898,749.219910 1083.385498,747.598938 1084.079102,745.934692 
-	C1084.299683,745.405090 1083.954346,744.639648 1083.552856,743.221802 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M313.887451,176.695755 
-	C313.101013,176.744461 312.672150,176.574524 312.120667,176.200424 
-	C313.123779,172.952179 314.155884,169.867615 315.441925,166.892807 
-	C315.759094,166.159180 316.847412,165.524612 317.688141,165.345123 
-	C318.145477,165.247467 319.319702,166.189423 319.332092,166.683533 
-	C319.457031,171.661346 319.408142,176.643494 319.408142,181.624435 
-	C318.820892,181.683594 318.233673,181.742767 317.646423,181.801941 
-	C317.173920,179.510300 316.701385,177.218674 316.114471,174.372208 
-	C315.258759,175.335724 314.751923,175.906418 313.887451,176.695755 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M746.111877,186.471161 
-	C746.110352,185.984619 746.085327,185.971069 746.097900,185.982941 
-	C746.110413,183.573624 746.110413,181.152451 746.110413,177.508163 
-	C749.408447,178.343079 752.017761,179.003662 754.773315,180.391510 
-	C754.911804,182.461502 754.904053,183.804199 754.896240,185.146927 
-	C752.373779,187.076675 749.851318,189.006393 746.665771,191.443344 
-	C746.442627,189.631119 746.278015,188.294403 746.111877,186.471161 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1526.774658,611.092102 
-	C1526.675293,613.147339 1526.452026,614.809448 1526.135254,616.838379 
-	C1523.825317,618.714050 1521.608887,620.222900 1518.771240,622.154663 
-	C1518.771240,617.922363 1518.771240,613.904724 1518.771240,608.777954 
-	C1521.410767,609.421509 1524.030640,610.060242 1526.774658,611.092102 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M755.288879,185.299316 
-	C754.904053,183.804199 754.911804,182.461502 754.893005,180.775787 
-	C755.882935,179.935471 756.887207,179.052383 757.918457,179.019791 
-	C760.176270,178.948456 763.355347,178.488342 764.465210,179.716690 
-	C765.638733,181.015457 765.762634,184.871338 764.655701,186.168213 
-	C763.555359,187.457184 760.355591,187.128616 758.074524,187.140152 
-	C757.279724,187.144165 756.479309,186.046326 755.288879,185.299316 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M975.511475,100.876053 
-	C974.861877,105.387413 972.584167,107.609940 968.308777,106.870979 
-	C964.350464,106.186836 963.574768,102.952332 963.720520,99.667206 
-	C963.867554,96.354210 965.595032,93.974648 969.263977,93.827309 
-	C973.854614,93.642982 975.210205,96.622711 975.511475,100.876053 
-M969.543030,104.865585 
-	C973.803894,103.779037 972.969666,100.560265 972.065552,97.831238 
-	C971.793091,97.008904 969.502563,96.855171 968.136536,96.395180 
-	C967.845886,98.801636 967.488525,101.203949 967.338562,103.619110 
-	C967.316711,103.970367 968.286438,104.383209 969.543030,104.865585 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M552.156372,691.963562 
-	C551.326721,693.591309 550.574036,695.265259 549.634949,696.827271 
-	C549.168213,697.603699 548.407288,698.629944 547.691406,698.705200 
-	C547.026367,698.775085 545.824097,697.871338 545.584961,697.154053 
-	C544.418152,693.653931 543.494751,690.072632 542.485229,686.520081 
-	C543.171570,686.253357 543.857910,685.986633 544.544312,685.719849 
-	C545.505127,687.971802 546.465881,690.223755 547.546570,692.756653 
-	C547.895203,692.077881 548.194580,691.457397 548.526978,690.855225 
-	C549.418884,689.239380 550.324890,687.631409 551.225220,686.020264 
-	C552.177673,687.726990 553.130127,689.433777 553.757629,691.552124 
-	C553.007263,691.963684 552.581787,691.963623 552.156372,691.963562 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M783.950806,324.570831 
-	C785.371094,323.972565 786.747070,323.211853 788.220886,322.810028 
-	C791.227783,321.990173 793.600037,322.645905 794.700989,325.752441 
-	C792.162720,325.954163 789.710815,325.649048 787.860107,326.562347 
-	C787.195618,326.890320 787.294006,331.169250 788.271484,331.830292 
-	C789.590637,332.722412 792.094727,331.862396 795.876343,331.657440 
-	C793.682190,333.369873 792.247131,335.372253 790.999634,335.261536 
-	C789.010071,335.084961 786.299255,333.965332 785.441528,332.397491 
-	C784.366943,330.433197 784.856689,327.613068 784.313477,324.833984 
-	C783.955627,324.505646 783.950806,324.570831 783.950806,324.570831 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1259.631104,162.822449 
-	C1260.816772,163.896240 1261.919434,164.693115 1263.150146,165.053467 
-	C1264.565308,165.467850 1266.093506,165.495956 1267.572632,165.691833 
-	C1267.547607,166.319839 1267.522461,166.947830 1267.497437,167.575836 
-	C1264.357300,167.575836 1261.212891,167.656921 1258.081055,167.494766 
-	C1257.568359,167.468246 1256.706787,166.379669 1256.692139,165.765656 
-	C1256.576904,160.913803 1256.628174,156.057953 1257.501099,151.150299 
-	C1260.776123,154.504211 1259.038330,158.633972 1259.631104,162.822449 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M931.557800,106.827881 
-	C929.996704,104.040123 927.999329,101.371132 927.939697,98.659523 
-	C927.905090,97.084030 930.747986,94.696205 932.734680,94.074005 
-	C934.195190,93.616547 936.366882,95.429939 939.073364,96.599373 
-	C935.355103,97.244560 932.892517,97.234009 930.976440,98.252052 
-	C930.342590,98.588844 930.602234,102.792023 931.350464,103.108864 
-	C933.130676,103.862694 935.446472,103.351692 937.814026,103.351692 
-	C937.475708,106.897545 934.890625,107.179039 931.557800,106.827881 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M377.645020,206.149109 
-	C376.761963,202.306046 376.654724,198.709000 380.573822,197.382309 
-	C382.318604,196.791656 384.747467,198.104538 386.817810,198.716080 
-	C387.136444,198.810211 387.195557,199.783005 387.274200,200.031631 
-	C384.867554,200.300766 382.376373,200.015930 380.660370,201.035660 
-	C379.926208,201.471954 380.161133,205.738495 381.104340,206.286041 
-	C382.545044,207.122391 384.981750,206.242996 388.489777,205.980042 
-	C386.661621,207.627396 385.252991,209.774780 384.287140,209.591293 
-	C382.006378,209.157959 379.936401,207.615311 377.645020,206.149109 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1095.761353,637.837280 
-	C1096.031250,638.203613 1096.030273,638.372803 1095.942139,638.780273 
-	C1091.999512,638.904968 1090.260620,640.730164 1089.842041,644.617737 
-	C1089.674561,646.172791 1087.903931,647.555176 1086.523438,648.629883 
-	C1082.809570,644.316223 1084.343384,640.225403 1085.780518,636.137817 
-	C1089.161743,635.703918 1092.813354,633.522949 1095.761353,637.837280 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1060.157959,486.015442 
-	C1060.317383,487.891663 1060.419067,489.441681 1060.657104,491.257660 
-	C1060.397705,494.966766 1058.101318,496.870209 1055.047363,496.247406 
-	C1053.066650,495.843445 1050.211182,493.667450 1050.009644,492.010254 
-	C1049.700439,489.469696 1050.580566,485.901367 1052.340698,484.211700 
-	C1054.627319,482.016693 1057.947021,482.775177 1060.157959,486.015442 
-M1052.175781,490.479797 
-	C1053.080322,491.709900 1053.854492,493.087982 1054.973999,494.073792 
-	C1055.281982,494.344940 1057.284424,493.560486 1057.372681,493.060089 
-	C1057.731201,491.025513 1057.869751,488.882629 1057.590454,486.848145 
-	C1057.508057,486.248169 1055.124634,485.272827 1054.921875,485.495422 
-	C1053.808716,486.717224 1053.045410,488.257782 1052.175781,490.479797 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M906.806030,76.906685 
-	C902.277039,80.286438 899.378906,79.997200 896.776917,75.676102 
-	C899.179871,76.020416 901.429443,76.342758 903.679016,76.665100 
-	C903.840332,76.103828 904.001648,75.542549 904.162903,74.981277 
-	C902.818298,74.315582 901.252869,73.892548 900.185791,72.921730 
-	C898.898315,71.750397 898.033691,70.114311 896.986084,68.679352 
-	C898.596191,67.772415 900.132874,66.348717 901.837463,66.106216 
-	C903.489075,65.871269 905.313477,66.850708 907.514404,67.342407 
-	C907.966919,67.388039 908.005188,67.468887 907.588074,67.434967 
-	C904.751953,67.919197 902.333008,68.437340 899.583740,69.026237 
-	C906.597595,74.846657 906.597595,74.846657 906.806030,76.906685 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M63.321281,173.984482 
-	C63.708958,177.683563 63.770504,181.402832 63.742180,185.579193 
-	C63.232468,186.011658 62.812618,185.987030 62.093452,185.576508 
-	C61.204021,184.806213 60.455696,183.966904 60.048534,184.108505 
-	C56.407623,185.374863 54.093876,184.279266 53.835350,180.393234 
-	C53.560219,176.257706 56.196785,175.547989 59.703796,175.971634 
-	C60.286079,176.041992 61.027168,174.797745 61.694870,174.161011 
-	C62.128300,174.108902 62.561722,174.056793 63.321281,173.984482 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M882.153992,63.388351 
-	C882.361267,65.231377 882.420715,66.725327 882.425232,68.219444 
-	C882.447144,75.457108 882.443176,75.450539 889.410278,76.832893 
-	C889.862122,76.922546 890.270630,77.230408 890.304504,78.417809 
-	C886.877869,78.417809 883.451294,78.417809 879.438599,78.417809 
-	C879.438599,73.792259 879.354187,69.178085 879.550659,64.575890 
-	C879.573914,64.030121 881.133423,63.549934 882.153992,63.388351 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M507.957214,201.440674 
-	C509.150055,200.657043 510.256592,199.458252 511.556152,199.188156 
-	C513.454651,198.793625 515.541077,198.817535 517.441772,199.194992 
-	C518.066162,199.319000 518.822937,201.177963 518.660095,202.090195 
-	C518.534363,202.794434 517.123291,203.393326 516.179138,203.789978 
-	C515.353271,204.136917 514.381531,204.136688 513.465942,204.921539 
-	C515.090698,205.208282 516.715454,205.495026 519.069885,205.910553 
-	C515.129578,209.808167 511.964783,207.212250 508.376953,205.823425 
-	C507.950867,204.126465 507.954041,202.783569 507.957214,201.440674 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M300.105286,756.515747 
-	C298.525665,756.125366 297.236084,755.921387 295.946503,755.717407 
-	C295.794800,757.767517 295.643097,759.817688 295.491425,761.867798 
-	C297.689148,761.973083 299.886871,762.078369 302.278534,762.192993 
-	C302.283936,762.289124 302.497772,762.853333 302.305359,763.172729 
-	C300.381805,766.365234 297.601196,766.654724 294.643097,764.956909 
-	C291.895294,763.379944 291.005493,757.689697 293.078278,755.100220 
-	C295.205536,752.442749 297.940186,751.617493 300.878632,753.827942 
-	C302.153900,754.787354 303.982361,756.332397 300.105286,756.515747 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1129.795044,638.912354 
-	C1129.355347,639.302795 1129.181519,639.447510 1129.189941,639.580627 
-	C1129.329956,641.766235 1129.492798,643.950500 1129.650635,646.135010 
-	C1131.560059,645.808960 1133.469482,645.483032 1135.378906,645.157043 
-	C1135.685059,645.514526 1135.991333,645.872009 1136.297485,646.229492 
-	C1134.589966,647.224548 1132.950195,648.894470 1131.160889,649.074158 
-	C1127.436646,649.448059 1126.045044,646.618042 1125.599854,643.416687 
-	C1125.106812,639.870422 1126.342163,637.064819 1130.048462,636.236633 
-	C1132.825195,635.616150 1135.113281,636.496948 1135.919678,640.290466 
-	C1133.668701,639.655273 1131.907227,639.158264 1129.795044,638.912354 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1480.216187,413.003784 
-	C1477.018921,416.107147 1473.855347,415.274261 1471.190918,412.477112 
-	C1468.423950,409.572144 1468.492676,406.045685 1471.052490,403.098083 
-	C1473.776123,399.961914 1477.156738,399.560486 1480.347168,402.810303 
-	C1479.351318,403.496246 1478.503052,404.027557 1477.827881,403.860321 
-	C1474.724243,403.091888 1472.961060,404.208282 1472.795288,407.356018 
-	C1472.640625,410.294098 1474.113403,411.918976 1477.198242,412.063141 
-	C1478.216675,412.110748 1479.210938,412.675507 1480.216187,413.003784 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M84.821442,834.726562 
-	C84.934471,835.154480 84.941238,835.186035 84.961586,835.169067 
-	C81.878639,835.015503 80.448700,836.351929 80.737671,839.588440 
-	C80.936470,841.815125 80.775795,844.073914 80.775795,846.318298 
-	C80.098221,846.474121 79.420654,846.630005 78.743080,846.785828 
-	C78.293900,845.023560 77.563721,843.278015 77.457932,841.495361 
-	C77.275230,838.416443 78.120575,834.983521 73.304718,834.010315 
-	C77.338737,832.532898 81.037682,831.127014 84.821442,834.726562 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M770.067078,733.347656 
-	C770.098206,735.104797 770.040527,736.518311 769.976562,738.350830 
-	C768.062927,739.955505 766.155579,741.141235 763.792297,742.660645 
-	C762.883179,742.996155 762.429932,742.998047 761.976746,742.999878 
-	C761.852173,740.867126 761.727661,738.734253 761.743591,735.980347 
-	C761.896667,734.848083 761.909302,734.336975 761.921997,733.825806 
-	C763.600220,730.857605 766.246277,730.587769 770.067078,733.347656 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M61.331264,174.078400 
-	C61.027168,174.797745 60.286079,176.041992 59.703796,175.971634 
-	C56.196785,175.547989 53.560219,176.257706 53.835350,180.393234 
-	C54.093876,184.279266 56.407623,185.374863 60.048534,184.108505 
-	C60.455696,183.966904 61.204021,184.806213 61.778717,185.545059 
-	C58.198376,187.875580 54.298923,188.400208 52.033684,184.695877 
-	C50.743801,182.586548 50.536552,178.775452 51.567486,176.519196 
-	C53.313110,172.698837 57.091343,172.143845 61.331264,174.078400 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M800.176880,419.115784 
-	C803.433594,417.302124 806.557129,416.565643 809.988281,420.824463 
-	C807.124207,420.507721 805.120178,420.286133 803.116150,420.064514 
-	C802.965210,420.436157 802.814209,420.807831 802.663269,421.179504 
-	C803.662537,421.780060 804.826965,422.216064 805.625244,423.016968 
-	C807.083313,424.479858 808.324646,426.158691 809.656433,427.747437 
-	C807.450500,428.753113 805.297607,429.923279 803.005981,430.663513 
-	C802.324890,430.883484 801.253662,429.895752 800.062622,428.922211 
-	C800.649780,428.275970 801.533264,428.107025 802.421692,428.075836 
-	C803.886963,428.024384 805.355408,428.061859 808.075073,428.061859 
-	C804.959656,424.098541 798.318726,425.117767 800.176880,419.115784 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M507.691650,201.172791 
-	C507.954041,202.783569 507.950867,204.126465 507.945496,205.783295 
-	C505.274658,209.137833 502.596222,208.448990 498.910614,205.679993 
-	C501.556671,205.325470 503.294037,205.092712 505.314209,204.822037 
-	C504.682800,201.150543 496.537201,200.578644 501.473969,195.563248 
-	C502.775909,194.240570 505.870972,194.682907 508.142639,194.314758 
-	C508.252106,194.984268 508.361542,195.653763 508.471008,196.323273 
-	C506.945251,196.718857 505.419525,197.114441 503.002716,197.741058 
-	C504.905334,199.101913 506.165710,200.003403 507.691650,201.172791 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M342.947723,228.016586 
-	C343.477631,228.000931 344.007538,227.985275 344.932617,227.924286 
-	C346.786011,227.001785 348.244202,226.124603 350.385010,224.836792 
-	C350.536346,227.284927 350.746582,229.578949 350.801727,231.876663 
-	C350.861725,234.377548 351.300476,236.287979 355.061707,235.486786 
-	C355.757568,236.133331 355.899902,236.415466 356.042236,236.697601 
-	C352.470337,238.453354 349.321381,238.941879 347.762878,234.111237 
-	C347.668457,233.818649 346.730469,233.798218 345.466125,233.853210 
-	C344.221436,234.041687 343.695618,234.028091 343.177338,233.584656 
-	C343.105804,231.442078 343.026764,229.729340 342.947723,228.016586 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M496.999939,179.001221 
-	C498.964966,177.905289 500.839203,176.443100 502.946381,175.921005 
-	C503.641876,175.748672 505.828827,178.048676 505.773346,179.138779 
-	C505.661682,181.332886 504.478180,183.472458 503.736938,185.634521 
-	C501.546326,184.657349 499.355682,183.680176 497.122192,181.983276 
-	C497.052887,180.509430 497.026398,179.755325 496.999939,179.001221 
-M501.666534,181.869812 
-	C501.795837,182.230545 501.925140,182.591293 502.054474,182.952042 
-	C502.159729,182.589676 502.264984,182.227310 501.666534,181.869812 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M472.261658,456.057129 
-	C471.290649,453.912109 470.320038,452.207092 469.070221,450.011658 
-	C472.203308,450.011658 475.860596,450.011658 479.517853,450.011658 
-	C475.016388,451.702820 475.889648,455.420959 475.698578,458.865997 
-	C475.616882,460.339142 474.488434,461.754211 473.835571,463.195648 
-	C473.311005,461.795380 472.692474,460.420807 472.299530,458.984528 
-	C472.087646,458.209961 472.261932,457.329712 472.261658,456.057129 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M746.976196,204.185181 
-	C747.853210,203.482559 748.629028,202.464203 749.628540,202.143875 
-	C751.630676,201.502274 753.761230,200.949753 755.825745,200.992233 
-	C756.500793,201.006104 757.135559,202.977936 757.788696,204.054382 
-	C756.137024,204.993378 754.485352,205.932343 752.314575,207.166412 
-	C753.883423,207.511734 755.451294,207.856842 757.726746,208.357712 
-	C753.395081,212.266876 750.668640,209.643143 747.510376,206.980804 
-	C747.067688,205.842926 747.021973,205.014038 746.976196,204.185181 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1047.263672,401.303925 
-	C1049.669800,401.466644 1051.662354,401.630096 1053.655029,401.793549 
-	C1046.401367,404.733795 1051.509399,411.139008 1048.291138,416.759064 
-	C1047.428833,413.901337 1046.675415,412.265656 1046.479126,410.565643 
-	C1046.127686,407.522430 1047.726562,403.675140 1042.015869,403.242371 
-	C1042.212646,402.839539 1042.409302,402.436676 1042.606079,402.033844 
-	C1044.020752,401.790771 1045.435547,401.547699 1047.263672,401.303925 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M746.695435,203.967010 
-	C747.021973,205.014038 747.067688,205.842926 747.196533,207.084854 
-	C744.214905,211.174042 742.762634,211.323822 738.356812,207.781174 
-	C740.707092,207.621811 742.404236,207.506729 744.525330,207.362915 
-	C743.727539,203.526611 734.982239,202.760406 740.739624,197.462082 
-	C741.962463,196.336761 744.853027,197.023712 746.975220,196.875702 
-	C747.023499,197.516129 747.071716,198.156555 747.119934,198.796982 
-	C745.723694,199.052261 744.327515,199.307556 742.078186,199.718826 
-	C743.774658,201.295471 745.094666,202.522171 746.695435,203.967010 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M728.012390,187.618011 
-	C722.462280,188.089050 719.995483,186.278824 720.383728,182.423859 
-	C720.726440,179.021454 724.348511,176.745117 727.249146,178.376022 
-	C728.350464,178.995239 728.909180,180.579361 729.715149,181.723679 
-	C728.742493,182.388260 727.821960,183.157150 726.778137,183.679413 
-	C726.122070,184.007645 725.280884,183.965912 724.518005,185.018845 
-	C725.817139,185.123993 727.126099,185.178680 728.397949,185.425095 
-	C728.505798,185.445999 728.365417,186.747864 728.012390,187.618011 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M761.571167,733.935669 
-	C761.909302,734.336975 761.896667,734.848083 761.822144,735.511108 
-	C759.441650,736.321899 757.123108,736.980835 753.456604,738.022888 
-	C756.207947,738.658142 757.854858,739.038391 760.112610,739.559692 
-	C757.285950,742.218384 754.272034,742.481689 752.553955,740.044556 
-	C751.383240,738.383850 751.281494,734.551453 752.451233,733.098877 
-	C753.421814,731.893616 756.951355,732.648071 759.337952,732.750732 
-	C759.982727,732.778442 760.593750,733.592468 761.571167,733.935669 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M75.381958,604.009705 
-	C75.022171,603.255554 75.019279,602.818481 75.062683,601.825073 
-	C76.587036,600.289246 78.065086,599.309753 80.148109,597.929382 
-	C77.564796,597.745178 75.798752,597.619263 74.032700,597.493347 
-	C74.032700,597.493347 74.073769,597.410767 74.067314,597.428223 
-	C76.463150,596.782837 80.159668,594.853271 81.003700,595.715576 
-	C82.875320,597.627869 83.315613,600.940979 84.827843,604.990479 
-	C80.722481,604.690674 78.230667,604.508728 75.381958,604.009705 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M728.840210,727.520874 
-	C731.934448,727.503601 734.637390,727.503601 737.340271,727.503601 
-	C737.557251,727.954285 737.774170,728.404968 737.991150,728.855652 
-	C729.847351,730.555725 735.981262,737.774475 732.372070,741.507141 
-	C727.114929,738.671509 734.758057,730.193604 725.467285,729.118286 
-	C727.190613,728.205017 727.819702,727.871582 728.840210,727.520874 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M44.869995,838.650513 
-	C45.009598,840.391357 45.006893,841.823669 45.023296,843.686768 
-	C42.873745,844.785950 40.705090,845.454285 38.134045,845.700439 
-	C37.249355,844.886841 36.767056,844.495483 36.284771,844.104126 
-	C36.866589,841.918213 36.798569,838.797852 38.215343,837.812561 
-	C39.595753,836.852539 42.495190,838.076721 44.869995,838.650513 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M551.006042,200.004715 
-	C551.457214,199.809570 551.894165,199.496002 552.362061,199.439575 
-	C554.479736,199.184189 556.640442,198.713226 558.709595,198.959320 
-	C559.374451,199.038391 560.443542,201.934464 560.242432,202.084229 
-	C558.796204,203.161041 557.070557,203.862640 555.130676,204.835205 
-	C556.708862,205.202667 558.129272,205.533371 560.069580,205.985138 
-	C556.899658,209.317551 554.277100,208.219467 551.317810,205.709229 
-	C550.996521,203.443054 551.001282,201.723877 551.006042,200.004715 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1516.740845,613.428711 
-	C1516.684326,615.306946 1516.616333,616.770142 1516.491821,619.449646 
-	C1513.468262,618.691711 1510.873169,618.041199 1508.278076,617.390747 
-	C1509.321777,615.664612 1510.365479,613.938477 1511.483643,612.089355 
-	C1511.258667,612.027649 1510.047363,611.695374 1508.258667,611.204712 
-	C1509.247070,610.363770 1509.825562,609.498047 1510.583618,609.291382 
-	C1513.844238,608.401978 1516.136108,609.372681 1516.740845,613.428711 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1141.993652,430.021790 
-	C1147.817261,426.182526 1149.678589,426.572693 1151.524658,432.416107 
-	C1149.730103,432.836914 1147.965698,433.250702 1146.201294,433.664459 
-	C1146.173340,433.937378 1146.145508,434.210266 1146.117554,434.483185 
-	C1147.618774,434.860138 1149.119995,435.237122 1150.780884,435.654205 
-	C1147.769531,438.358154 1147.769531,438.358154 1141.820679,436.015594 
-	C1141.938965,434.238556 1142.055908,432.481720 1142.094727,430.356049 
-	C1142.016724,429.987183 1141.993652,430.021790 1141.993652,430.021790 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M715.009033,182.891373 
-	C714.132629,179.957596 713.256775,177.466171 712.252625,174.609924 
-	C714.934570,174.609924 718.553528,174.609924 721.087769,174.609924 
-	C720.214294,177.580887 719.428772,180.448364 718.517273,183.275253 
-	C718.020508,184.815750 717.310120,186.287415 716.696106,187.790131 
-	C716.133911,186.304657 715.571777,184.819183 715.009033,182.891373 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1343.232300,183.852036 
-	C1343.061768,183.439529 1343.062500,183.496658 1343.058960,183.524368 
-	C1343.957764,182.415726 1344.860107,181.279373 1346.114990,179.699020 
-	C1347.347046,181.536575 1348.382080,183.080307 1349.718628,184.824341 
-	C1350.020264,185.024643 1349.999878,184.987503 1349.570190,184.821121 
-	C1346.044800,188.041260 1346.435913,191.653870 1350.044312,193.003983 
-	C1350.044312,193.003983 1349.998047,193.013031 1350.003540,192.991180 
-	C1348.950317,193.868622 1347.891479,194.767914 1346.832764,195.667206 
-	C1345.963379,194.431915 1344.656006,193.304276 1344.320068,191.937836 
-	C1343.709595,189.454956 1343.676758,186.830124 1343.232300,183.852036 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M35.817940,844.117371 
-	C36.767056,844.495483 37.249355,844.886841 37.847015,845.485291 
-	C37.039104,845.965149 36.120781,846.256042 35.191746,846.507446 
-	C28.869234,848.218262 27.094183,847.003723 27.350208,840.534607 
-	C27.453619,837.921753 28.517433,835.346863 29.144196,832.754700 
-	C29.669182,835.282959 30.222557,837.805786 30.704470,840.342224 
-	C30.884840,841.291626 30.898800,842.272583 31.022282,843.601318 
-	C32.515251,843.783875 33.933186,843.957275 35.817940,844.117371 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M803.990173,753.997925 
-	C804.982788,753.945251 806.192871,753.508789 806.921570,753.921753 
-	C808.331421,754.721069 809.470032,755.998840 810.721008,757.078369 
-	C809.576721,757.924683 808.466797,758.824646 807.271545,759.591675 
-	C806.778320,759.908203 806.102051,759.939514 804.106873,760.481384 
-	C807.074097,761.013977 808.639526,761.294922 810.204956,761.575928 
-	C810.211060,762.122986 810.217163,762.670105 810.223206,763.217163 
-	C808.070862,763.217163 805.918457,763.217163 803.251404,762.743835 
-	C800.967590,759.181641 801.632812,756.461609 803.990173,753.997925 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M490.744659,180.776764 
-	C488.999756,181.385498 487.254822,181.994232 485.509918,182.602982 
-	C485.528839,182.822693 485.547760,183.042404 485.566650,183.262115 
-	C486.948700,183.262115 488.330750,183.262115 489.712799,183.262115 
-	C489.777100,183.825684 489.841370,184.389267 489.905640,184.952835 
-	C487.932404,184.952835 484.624390,185.608383 484.240936,184.827606 
-	C483.171173,182.649384 482.138336,179.024139 483.228760,177.520203 
-	C485.307922,174.652603 488.660217,174.541473 490.863892,178.947769 
-	C490.832916,179.971420 490.788788,180.374100 490.744659,180.776764 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1113.240967,718.103149 
-	C1113.026733,717.621582 1113.030396,717.436646 1113.098877,716.981445 
-	C1113.476807,716.787170 1114.056885,716.951599 1114.065063,716.926819 
-	C1116.057007,710.906860 1120.625610,711.329529 1125.217773,712.726990 
-	C1124.278687,713.820801 1123.557617,714.533508 1122.527588,715.039307 
-	C1120.877686,715.085632 1118.473145,715.141418 1118.382935,715.626892 
-	C1118.019775,717.582520 1118.224243,719.702454 1118.645020,721.670715 
-	C1118.697876,721.918274 1121.280518,721.625061 1122.813721,721.870422 
-	C1123.069946,723.059753 1123.203247,723.961060 1123.336548,724.862366 
-	C1117.522705,726.561768 1115.416992,722.593506 1113.240967,718.103149 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1286.047607,164.024994 
-	C1286.003906,163.577347 1285.984619,163.579575 1286.026489,163.087158 
-	C1285.365479,160.550659 1284.662720,158.506577 1283.959839,156.462479 
-	C1283.959839,156.462479 1283.982300,156.519318 1283.970947,156.546936 
-	C1285.161743,155.106461 1286.363892,153.638397 1287.686890,152.022781 
-	C1288.876221,153.294754 1289.939819,154.432236 1290.071777,154.573380 
-	C1290.071777,159.348999 1290.071777,163.135696 1290.071777,168.314743 
-	C1288.573364,166.868362 1287.332275,165.670502 1286.047607,164.024994 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M577.728516,175.980042 
-	C577.936646,174.507233 578.144775,173.034409 578.352966,171.561600 
-	C578.775208,171.555786 579.197449,171.549973 579.619690,171.544159 
-	C579.963318,172.785858 580.306946,174.027542 580.648865,175.262894 
-	C587.218750,176.404785 588.527954,179.020065 585.127808,187.007462 
-	C584.629883,184.137360 584.533508,182.534866 584.036255,181.068314 
-	C583.679016,180.014786 582.786316,179.142807 582.132507,178.189835 
-	C581.464600,179.163055 580.662537,180.072800 580.164001,181.126160 
-	C579.593079,182.332428 579.291565,183.666214 578.415649,184.510345 
-	C577.881653,181.377396 577.805054,178.678726 577.728516,175.980042 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M277.112427,336.344940 
-	C281.220581,336.344940 285.328705,336.344940 289.436829,336.344940 
-	C289.447601,336.835419 289.458374,337.325897 289.469177,337.816406 
-	C287.953369,338.140106 286.437592,338.463776 284.572510,338.862061 
-	C284.249695,343.484802 283.919128,348.219025 283.588562,352.953247 
-	C282.863342,352.946442 282.138123,352.939636 281.412933,352.932831 
-	C281.243744,349.476776 280.962494,346.021240 280.945923,342.564453 
-	C280.935333,340.360260 280.865845,338.538269 277.460632,338.607849 
-	C277.052155,337.569092 277.082306,336.957001 277.112427,336.344940 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1480.481445,413.004791 
-	C1479.210938,412.675507 1478.216675,412.110748 1477.198242,412.063141 
-	C1474.113403,411.918976 1472.640625,410.294098 1472.795288,407.356018 
-	C1472.961060,404.208282 1474.724243,403.091888 1477.827881,403.860321 
-	C1478.503052,404.027557 1479.351318,403.496246 1480.470215,403.118347 
-	C1480.820435,402.950012 1481.317017,402.975952 1481.641846,403.434814 
-	C1481.913818,406.932343 1481.860840,409.971069 1481.807861,413.009766 
-	C1481.454102,413.008453 1481.100342,413.007141 1480.481445,413.004791 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1150.708008,779.288330 
-	C1150.952271,779.631042 1150.942261,779.575500 1150.941650,779.547485 
-	C1149.465088,779.542542 1146.787720,779.880249 1146.698608,779.540039 
-	C1145.795166,776.091431 1145.031128,772.545410 1144.864258,768.996826 
-	C1144.803711,767.707092 1146.450439,766.337158 1147.492065,764.736938 
-	C1148.736328,766.358276 1149.704224,767.619568 1150.666260,768.873169 
-	C1148.045410,772.188599 1147.643555,775.534119 1150.708008,779.288330 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1060.852417,413.746674 
-	C1058.377686,416.003082 1055.475586,416.364502 1053.558228,413.667511 
-	C1052.484497,412.157074 1052.193604,408.971375 1053.085327,407.427094 
-	C1054.693115,404.642639 1057.640381,404.513641 1060.602783,407.239471 
-	C1059.252319,409.299377 1057.640259,410.739838 1055.810425,412.374969 
-	C1057.178345,412.747101 1059.015381,413.246887 1060.852417,413.746674 
-z"/>
-<path fill="#818690" opacity="1.000000" stroke="none" 
-	d="
-M476.313049,177.237762 
-	C475.237000,175.471970 474.164673,174.140717 472.833588,172.488251 
-	C476.204834,172.488251 479.706665,172.488251 483.208496,172.488251 
-	C476.218658,174.803894 481.852661,181.950607 476.888916,185.654816 
-	C476.698181,182.993988 476.507477,180.333145 476.313049,177.237762 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M254.690552,755.505493 
-	C253.443527,755.976379 251.127411,756.446228 251.126999,756.918213 
-	C251.124664,759.528870 251.686371,762.140076 252.177490,765.620361 
-	C251.251419,765.282715 248.982880,765.068604 248.748749,764.263184 
-	C247.772156,760.903442 247.167480,757.380493 246.954285,753.885193 
-	C246.884125,752.735046 248.407562,751.487793 249.198837,750.290161 
-	C250.963608,751.391602 252.598450,752.411926 254.607727,753.728210 
-	C254.884949,754.517883 254.787750,755.011719 254.690552,755.505493 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M503.045227,724.511169 
-	C503.045197,724.511169 503.062958,724.613037 503.072876,724.585327 
-	C501.835632,725.296387 500.548431,726.640625 499.355286,726.561890 
-	C498.555725,726.508972 497.421875,724.505493 497.238983,723.257446 
-	C495.966492,714.575195 496.033722,714.565369 498.884308,711.264282 
-	C500.070587,712.753052 501.238434,714.218689 502.713867,715.852905 
-	C503.021484,716.021484 503.000336,715.985718 502.620544,715.821350 
-	C498.369324,716.550049 500.133026,719.658630 500.150208,721.784668 
-	C500.157623,722.701233 502.023590,723.602783 503.045227,724.511169 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M766.238770,427.021332 
-	C766.293579,427.448700 766.348389,427.876038 766.044800,428.734070 
-	C765.451782,429.463013 765.217163,429.761292 764.982544,430.059570 
-	C764.017395,430.194672 763.016663,430.210510 762.093323,430.485809 
-	C758.330139,431.607849 756.216980,430.076355 755.856750,426.364410 
-	C755.584412,423.557770 755.802795,420.703522 755.802795,417.870453 
-	C756.624329,417.824310 757.445923,417.778168 758.267456,417.732025 
-	C758.432495,420.031860 758.668030,422.329285 758.745422,424.632080 
-	C758.853699,427.854004 759.737732,429.646027 763.816895,427.216858 
-	C765.040466,427.034454 765.639587,427.027893 766.238770,427.021332 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1031.034424,512.164978 
-	C1033.304077,512.304688 1037.122314,511.759064 1037.545776,512.715759 
-	C1038.700195,515.324463 1039.094727,518.734619 1038.412476,521.485535 
-	C1038.094482,522.767883 1034.589478,523.259949 1032.254883,523.606262 
-	C1032.006958,522.693726 1032.033081,522.285217 1032.470459,521.922729 
-	C1037.621338,521.804565 1036.163452,518.228882 1035.868652,515.800232 
-	C1035.795166,515.196472 1032.966919,514.927246 1031.321777,514.117737 
-	C1031.170654,513.209167 1031.102539,512.687073 1031.034424,512.164978 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M576.277100,685.527771 
-	C580.554443,685.760742 584.983154,685.558960 584.995422,691.894470 
-	C585.006958,697.838013 582.603027,699.828918 576.497314,697.803345 
-	C576.551147,696.846619 576.821167,696.327698 577.395752,695.992737 
-	C579.030273,695.815735 581.380310,695.660339 581.502014,695.056152 
-	C581.892517,693.117493 581.617981,690.975281 581.155640,689.016602 
-	C581.093140,688.751587 578.491516,689.085999 576.923340,688.790527 
-	C576.613037,687.468079 576.445068,686.497925 576.277100,685.527771 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1497.554199,831.920837 
-	C1497.990356,832.412720 1497.986694,832.801880 1497.979248,833.482422 
-	C1496.978394,835.128845 1495.453857,836.361572 1495.104980,837.866699 
-	C1494.544434,840.284973 1494.761353,842.883362 1494.649780,845.405579 
-	C1494.020996,845.512512 1493.392334,845.619385 1492.763672,845.726257 
-	C1492.372803,844.183777 1491.975464,842.642883 1491.592651,841.098389 
-	C1491.012939,838.759705 1490.443481,836.418518 1489.438721,833.642456 
-	C1489.007690,832.792236 1489.007568,832.377930 1489.007324,831.963562 
-	C1491.709595,831.915100 1494.411865,831.866638 1497.554199,831.920837 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M533.990967,176.050171 
-	C535.467285,175.144943 536.943665,174.239731 538.922974,173.026138 
-	C539.425171,174.457657 540.055725,176.255203 540.686340,178.052750 
-	C538.662537,179.159775 538.947144,181.868881 542.759094,185.159332 
-	C538.765076,186.276382 537.107300,185.365143 536.420898,182.092422 
-	C536.122009,180.667816 535.361023,179.340164 534.397705,177.619217 
-	C533.987305,176.863358 533.989136,176.456757 533.990967,176.050171 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1478.437744,833.957275 
-	C1478.011475,833.419739 1478.003174,833.006958 1477.996582,832.284302 
-	C1480.700317,831.916748 1483.402100,831.859009 1486.553467,832.192627 
-	C1486.994629,832.997681 1486.986328,833.411438 1486.978027,833.825134 
-	C1485.936157,834.929504 1484.213257,835.914062 1483.993652,837.163086 
-	C1483.529785,839.799561 1483.852539,842.574341 1483.852539,845.292419 
-	C1483.149536,845.442627 1482.446533,845.592834 1481.743408,845.743042 
-	C1481.312744,844.240601 1480.831421,842.750427 1480.463257,841.232727 
-	C1479.887207,838.858948 1479.387573,836.466553 1478.437744,833.957275 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M65.777931,386.724426 
-	C65.756432,387.717407 65.577568,388.346497 65.285995,389.134155 
-	C64.410042,389.569519 63.646797,389.846313 62.164635,390.062958 
-	C60.957939,390.291870 60.470165,390.580933 59.982395,390.869995 
-	C61.537682,391.823853 63.092960,392.777679 64.647430,393.732788 
-	C59.544163,395.847076 57.583374,394.253693 57.153492,387.365692 
-	C57.023949,386.981110 56.983067,386.989594 56.979362,387.010315 
-	C59.764118,385.606110 62.443283,382.772064 65.777931,386.724426 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1101.718750,714.359741 
-	C1101.998047,714.691772 1101.979370,714.637939 1102.004883,714.632141 
-	C1098.296265,713.533325 1097.913452,716.077332 1097.655640,718.695251 
-	C1097.458374,720.699890 1097.339355,722.712158 1097.185547,724.721069 
-	C1096.500366,724.736755 1095.815186,724.752441 1095.130005,724.768127 
-	C1094.925537,720.785706 1094.721069,716.803284 1094.433350,711.201782 
-	C1097.426270,712.408997 1099.432861,713.218323 1101.718750,714.359741 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1101.754517,541.342529 
-	C1102.000366,541.664734 1101.984497,541.609314 1102.010254,541.599365 
-	C1098.608521,541.176697 1097.750122,543.220642 1097.627563,546.093140 
-	C1097.543335,548.066284 1097.293701,550.032410 1097.118042,552.001648 
-	C1096.567261,551.987427 1096.016357,551.973145 1095.465576,551.958923 
-	C1095.465576,547.971069 1095.465576,543.983154 1095.465576,538.988159 
-	C1097.476074,539.664246 1099.492310,540.342285 1101.754517,541.342529 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M728.923828,419.169434 
-	C729.000061,419.538483 728.998657,419.472839 729.023438,419.451904 
-	C725.809937,420.274933 725.374084,422.697327 725.367615,425.564026 
-	C725.363770,427.277649 724.854553,428.990143 724.572449,430.703125 
-	C724.032288,430.669830 723.492065,430.636566 722.951843,430.603271 
-	C722.951843,426.557800 722.951843,422.512329 722.951843,417.579712 
-	C724.818237,417.966125 726.832886,418.383240 728.923828,419.169434 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M135.051239,187.129105 
-	C133.724594,186.965179 132.778793,186.786804 131.131104,186.476044 
-	C132.271729,185.253494 133.036743,184.433548 133.124664,184.339325 
-	C132.670731,181.920822 132.324051,180.073792 131.977386,178.226746 
-	C133.907150,177.901123 135.836914,177.575500 137.766663,177.249863 
-	C137.853104,177.781677 137.939545,178.313477 138.025986,178.845276 
-	C137.104492,179.187683 136.183014,179.530090 134.996658,179.970917 
-	C137.936600,182.262802 142.082809,184.575317 135.051239,187.129105 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M783.865845,324.183350 
-	C783.950806,324.570831 783.955627,324.505646 783.979065,324.483887 
-	C780.589905,324.981262 780.042542,327.438477 780.057678,330.283417 
-	C780.066345,331.923859 780.059265,333.564331 780.059265,335.204803 
-	C779.290100,335.246857 778.520935,335.288910 777.751770,335.330963 
-	C777.523193,331.383514 777.294678,327.436066 777.000244,322.351013 
-	C779.620972,322.909485 781.700928,323.352692 783.865845,324.183350 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M908.005127,67.468887 
-	C908.005188,67.468887 907.966919,67.388039 907.964966,67.382187 
-	C908.703918,66.018082 909.444824,64.659821 910.416199,62.879101 
-	C911.693298,64.457359 912.573242,65.544830 913.515198,66.708870 
-	C911.181396,70.599045 910.482666,74.492088 914.478821,78.160172 
-	C914.214355,78.485077 913.949951,78.809975 913.685486,79.134880 
-	C912.272217,78.601120 910.858948,78.067352 909.263062,76.804810 
-	C908.722107,73.206985 908.363586,70.337936 908.005127,67.468887 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M799.926880,419.070068 
-	C798.318726,425.117767 804.959656,424.098541 808.075073,428.061859 
-	C805.355408,428.061859 803.886963,428.024384 802.421692,428.075836 
-	C801.533264,428.107025 800.649780,428.275970 799.737122,428.738525 
-	C799.710205,429.094055 799.374084,429.093048 799.214905,429.039978 
-	C795.495789,426.647064 795.102234,423.115448 798.327637,419.162781 
-	C799.004211,418.959534 799.340515,418.991943 799.926880,419.070068 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1040.450684,708.651184 
-	C1040.901489,713.509460 1040.929443,718.492432 1040.918579,723.979492 
-	C1040.131226,722.308167 1039.382690,720.132568 1038.512939,717.604614 
-	C1036.657104,717.604614 1034.406128,717.604614 1031.861328,717.604614 
-	C1031.471802,719.811768 1031.075073,722.059937 1030.678345,724.308105 
-	C1030.228149,724.276184 1029.777832,724.244202 1029.327637,724.212280 
-	C1029.327637,719.080933 1029.327637,713.949646 1029.327637,708.818298 
-	C1029.749146,708.744202 1030.170532,708.670105 1030.592041,708.596008 
-	C1030.819580,710.000549 1031.047119,711.405029 1031.206299,713.653015 
-	C1033.794678,714.615723 1036.451660,714.734863 1039.108643,714.854004 
-	C1039.415039,712.828003 1039.721313,710.801880 1040.450684,708.651184 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1104.369385,518.825745 
-	C1104.369507,516.269470 1104.369507,514.158142 1104.369507,511.793091 
-	C1106.601074,511.683594 1108.463013,511.592224 1109.762939,511.528442 
-	C1108.506226,515.810059 1107.304932,519.903442 1106.103638,523.996765 
-	C1105.748047,524.013428 1105.392456,524.030029 1105.036743,524.046692 
-	C1104.814209,522.454651 1104.591675,520.862671 1104.369385,518.825745 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M273.953766,338.744324 
-	C272.835419,338.957733 271.717041,339.171112 270.405945,339.421295 
-	C270.198730,343.840576 269.992249,348.243958 269.785767,352.647339 
-	C268.978851,352.642700 268.171906,352.638062 267.364990,352.633392 
-	C267.364990,349.095245 267.240356,345.551270 267.404449,342.020752 
-	C267.535645,339.197479 266.386414,338.064423 263.272522,337.984192 
-	C262.967865,337.156067 263.038025,336.739014 263.108185,336.321899 
-	C266.734039,336.283905 270.359863,336.245880 274.401978,336.600098 
-	C274.530060,337.576294 274.241913,338.160309 273.953766,338.744324 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M231.436142,373.131683 
-	C231.495651,371.384491 231.556229,370.077667 231.630753,368.469666 
-	C233.683502,368.344086 235.544586,368.230225 236.758301,368.155975 
-	C235.575439,372.469238 234.438202,376.616180 233.300980,380.763092 
-	C232.816071,380.766876 232.331161,380.770691 231.846252,380.774506 
-	C231.709900,378.373688 231.573547,375.972839 231.436142,373.131683 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1316.822876,183.607697 
-	C1316.958252,183.959351 1316.992188,183.837677 1316.991211,183.806458 
-	C1311.551758,186.002838 1314.670654,191.891739 1312.695435,195.601044 
-	C1312.235718,195.535095 1311.776123,195.469147 1311.316406,195.403214 
-	C1311.316406,191.542587 1311.316406,187.681976 1311.316406,183.256027 
-	C1312.766357,183.256027 1314.726929,183.256027 1316.822876,183.607697 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1551.105469,167.050049 
-	C1553.122925,166.851578 1555.140259,166.653122 1557.157715,166.454651 
-	C1557.253174,166.952759 1557.348633,167.450867 1557.444214,167.948959 
-	C1556.524780,168.364868 1555.605347,168.780762 1555.107788,169.005844 
-	C1555.939697,170.687759 1556.765137,172.356628 1557.590698,174.025513 
-	C1555.628174,174.721680 1553.665771,175.417831 1551.367065,175.685608 
-	C1552.124268,174.605072 1553.217773,173.952942 1553.492554,173.789078 
-	C1552.641113,171.385544 1551.873291,169.217804 1551.105469,167.050049 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1085.496094,636.009888 
-	C1084.343384,640.225403 1082.809570,644.316223 1086.142700,648.636719 
-	C1084.880005,648.715637 1083.311157,648.771057 1082.505127,648.014160 
-	C1080.510254,646.140930 1081.295410,636.057129 1083.587891,633.484863 
-	C1084.159180,634.328430 1084.685425,635.105164 1085.496094,636.009888 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1155.897461,513.284302 
-	C1154.676392,514.887390 1153.059937,516.334167 1152.347046,518.138123 
-	C1151.654297,519.891663 1151.887695,522.011292 1151.714478,523.970215 
-	C1151.187256,523.952942 1150.660156,523.935608 1150.133057,523.918274 
-	C1150.133057,519.971802 1150.133057,516.025330 1150.133057,511.898682 
-	C1151.651611,511.703949 1153.394775,511.480408 1155.557373,511.637878 
-	C1155.950439,512.440674 1155.923950,512.862488 1155.897461,513.284302 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M726.013489,324.966980 
-	C721.856384,324.483978 722.203064,327.579620 721.917847,330.180573 
-	C721.728394,331.907898 721.530334,333.634308 721.336121,335.361115 
-	C720.801453,335.341064 720.266785,335.321014 719.732117,335.300964 
-	C719.732117,331.345703 719.732117,327.390442 719.732117,322.225891 
-	C721.654541,322.902649 723.677063,323.614624 725.841736,324.674683 
-	C725.983948,325.022766 725.988281,324.972015 726.013489,324.966980 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1597.748779,842.671631 
-	C1597.849854,841.414429 1597.898804,840.489624 1597.869385,839.104675 
-	C1598.717285,837.743042 1599.603027,836.149414 1600.578979,836.092041 
-	C1602.315796,835.989929 1605.304321,836.391479 1605.641846,837.339722 
-	C1606.508667,839.774536 1606.209351,842.624634 1606.376099,845.308716 
-	C1605.774536,845.383911 1605.172852,845.459045 1604.571289,845.534241 
-	C1603.682251,843.046692 1602.793213,840.559143 1601.146606,838.201660 
-	C1599.924438,840.551575 1599.459717,842.771423 1598.995117,844.991272 
-	C1598.562378,844.328857 1598.129639,843.666443 1597.748779,842.671631 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1128.118774,718.783447 
-	C1128.327271,716.221558 1128.537720,714.091431 1128.813599,711.298706 
-	C1133.863159,714.747009 1127.465210,722.250427 1135.195312,723.227356 
-	C1130.407593,726.305786 1129.153809,725.498230 1128.118774,718.783447 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1053.971191,740.033813 
-	C1053.981323,740.463074 1053.983154,740.866821 1053.645996,741.924438 
-	C1053.855225,745.509460 1054.403320,748.440735 1054.951538,751.372009 
-	C1054.951538,751.372009 1054.932129,751.706055 1054.947388,751.783203 
-	C1052.151001,754.005005 1050.777832,752.377136 1050.333984,749.782715 
-	C1049.952759,747.554138 1050.194580,745.219055 1050.062500,742.135193 
-	C1049.966553,740.859314 1049.968994,740.379211 1049.971558,739.899170 
-	C1050.440430,739.195190 1050.909180,738.491150 1051.721191,738.127808 
-	C1052.682983,738.992188 1053.301514,739.516052 1053.920044,740.039856 
-	C1053.920044,740.039856 1053.963135,740.008362 1053.971191,740.033813 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1162.165405,186.106216 
-	C1161.051025,186.233109 1159.336548,186.025375 1159.324829,185.746338 
-	C1159.152222,181.627945 1159.205933,177.500076 1160.084717,173.321091 
-	C1163.971680,176.993011 1161.973267,181.574112 1162.165405,186.106216 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1156.123901,513.618896 
-	C1155.923950,512.862488 1155.950439,512.440674 1155.973633,511.701843 
-	C1157.802856,513.119202 1159.635254,514.853638 1161.834717,516.330811 
-	C1162.408691,517.345398 1162.615845,518.617310 1162.724854,520.295776 
-	C1161.802979,520.620117 1160.389648,520.244507 1160.258911,520.507324 
-	C1159.734985,521.559753 1159.609131,522.810425 1159.336060,523.987732 
-	C1158.864868,524.012573 1158.393555,524.037415 1157.922363,524.062317 
-	C1157.398315,520.692688 1156.874268,517.323120 1156.123901,513.618896 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M42.155743,387.495087 
-	C43.045662,388.828674 44.010391,389.839874 45.177643,391.164429 
-	C44.777023,392.550903 44.173882,393.624023 43.570740,394.697113 
-	C42.715450,393.850433 41.445099,393.151855 41.080433,392.130066 
-	C39.841400,388.658478 38.922260,385.072693 37.706398,380.936737 
-	C42.731632,381.530273 42.302036,384.460083 42.155743,387.495087 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M552.161865,692.346741 
-	C552.581787,691.963623 553.007263,691.963684 553.751831,691.952515 
-	C554.070984,691.941345 554.030579,691.945435 554.043945,692.241638 
-	C554.431641,692.920898 554.806091,693.303894 555.180542,693.686951 
-	C555.480469,693.203796 555.780396,692.720642 556.080322,692.237488 
-	C556.640747,690.134033 557.201233,688.030579 557.761780,685.927063 
-	C558.145264,685.936707 558.528748,685.946289 558.912231,685.955933 
-	C559.377625,687.019836 559.843079,688.083801 560.697021,689.235474 
-	C561.085449,689.323242 561.022339,689.758362 560.967651,689.972168 
-	C560.094910,691.022705 559.098694,691.748901 558.496460,692.719482 
-	C557.282593,694.675903 556.282959,696.765320 555.194946,698.799866 
-	C554.185791,696.776550 553.176575,694.753235 552.161865,692.346741 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M576.352905,685.120972 
-	C576.445068,686.497925 576.613037,687.468079 576.853271,689.205688 
-	C576.980713,691.918396 577.035950,693.863647 577.091187,695.808838 
-	C576.821167,696.327698 576.551147,696.846619 576.159790,697.632568 
-	C575.269165,697.548157 573.841431,697.216248 573.830261,696.842224 
-	C573.681458,691.843872 573.730713,686.839600 573.730713,681.836792 
-	C574.341492,681.768005 574.952271,681.699158 575.563049,681.630310 
-	C575.851624,682.658264 576.140198,683.686157 576.352905,685.120972 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1142.032471,429.972961 
-	C1140.267944,430.657471 1138.487793,431.356201 1136.707520,432.054932 
-	C1137.452271,433.700256 1138.197021,435.345581 1139.444580,438.101532 
-	C1137.552979,437.250854 1134.753418,436.832642 1134.352173,435.620544 
-	C1133.697388,433.642731 1133.863037,430.608978 1135.029907,428.994781 
-	C1136.827515,426.508179 1139.613403,426.743103 1141.844238,429.717468 
-	C1141.993652,430.021790 1142.016724,429.987183 1142.032471,429.972961 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1048.032715,513.987610 
-	C1044.666138,513.150146 1044.143799,515.343567 1043.955200,517.872437 
-	C1043.804688,519.890015 1043.673462,521.908997 1043.533691,523.927368 
-	C1042.884766,523.948486 1042.235962,523.969604 1041.587036,523.990723 
-	C1041.362183,520.070251 1041.137451,516.149719 1040.817139,510.563416 
-	C1043.739136,511.763641 1045.675049,512.558838 1047.800293,513.696289 
-	C1047.989624,514.038513 1048.013428,513.999939 1048.032715,513.987610 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1549.251709,197.153458 
-	C1547.286377,199.627045 1546.323486,198.779068 1546.170898,196.458099 
-	C1546.009644,194.006134 1546.134644,191.535339 1546.134644,188.894531 
-	C1548.562622,188.894531 1550.566284,188.894531 1552.202393,188.894531 
-	C1551.193726,191.682159 1550.270264,194.234238 1549.251709,197.153458 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1045.284668,479.665436 
-	C1046.092407,479.367828 1047.188477,479.448273 1047.190063,479.545197 
-	C1047.272217,484.993866 1047.263062,490.443939 1046.258057,495.935577 
-	C1044.569214,490.727600 1044.982788,485.373474 1045.284668,479.665436 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1135.584839,515.950562 
-	C1136.254272,517.281555 1136.541260,518.578613 1136.726074,520.302856 
-	C1135.282227,521.515930 1133.940796,522.301941 1132.391113,523.209839 
-	C1130.676392,521.543762 1130.429077,515.229004 1132.823853,511.049957 
-	C1133.694946,512.832214 1134.448608,514.374390 1135.584839,515.950562 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M826.285645,307.154236 
-	C826.008179,306.572418 826.004333,306.188690 826.407837,305.565063 
-	C830.603821,305.322510 830.028687,302.504730 830.083618,300.169189 
-	C830.149170,297.381531 828.497314,296.560089 826.003784,296.832916 
-	C826.001587,296.438049 825.999451,296.043152 825.991211,295.352173 
-	C830.453796,293.617676 832.471924,295.722107 832.899719,299.938019 
-	C833.418091,305.047546 831.527527,307.211212 826.285645,307.154236 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M375.412476,206.326279 
-	C375.068176,207.753815 374.725220,208.774887 374.382263,209.795959 
-	C373.959808,209.705688 373.537384,209.615402 373.114960,209.525116 
-	C373.114960,205.405014 373.114960,201.284897 373.114960,195.919220 
-	C376.620300,199.625565 374.889374,202.993866 375.412476,206.326279 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M550.039795,205.989014 
-	C548.600769,209.374695 545.678772,208.726791 544.170044,206.998123 
-	C542.878723,205.518570 542.239868,202.253433 542.987488,200.487076 
-	C544.199890,197.622742 547.015503,196.774994 549.501465,199.627365 
-	C547.854004,201.045273 546.535767,202.090454 545.217529,203.135620 
-	C546.824951,204.086746 548.432373,205.037888 550.039795,205.989014 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M803.593384,753.994629 
-	C801.632812,756.461609 800.967590,759.181641 802.904846,762.617065 
-	C802.314575,762.977173 801.556213,762.990662 800.419006,763.008057 
-	C798.441162,761.483337 794.384216,761.670288 795.972900,757.984497 
-	C796.570190,756.598633 798.620850,755.839233 800.015747,754.393921 
-	C801.080566,753.992798 802.138550,753.992065 803.593384,753.994629 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1118.483154,638.324341 
-	C1118.310303,637.890259 1118.608765,637.427063 1118.926392,636.752075 
-	C1120.369873,636.540222 1121.794189,636.540222 1123.247925,636.540222 
-	C1123.247925,640.776001 1123.247925,644.809937 1123.247925,648.843872 
-	C1122.708740,648.882996 1122.169556,648.922180 1121.630371,648.961304 
-	C1121.420898,646.928650 1121.407593,644.849487 1120.939941,642.877991 
-	C1120.561890,641.283203 1119.636963,639.818054 1118.483154,638.324341 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1032.059326,521.876648 
-	C1032.033081,522.285217 1032.006958,522.693726 1031.968628,523.409058 
-	C1031.584595,524.872192 1031.212769,526.028503 1030.382935,527.608032 
-	C1029.458740,528.108459 1028.992676,528.185730 1028.526489,528.263062 
-	C1028.431641,523.501953 1028.254761,518.739502 1028.329102,513.981018 
-	C1028.340454,513.256348 1029.515259,512.549927 1030.593262,512.000000 
-	C1031.102539,512.687073 1031.170654,513.209167 1031.229736,514.491455 
-	C1031.500122,517.459961 1031.779663,519.668335 1032.059326,521.876648 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1548.838135,844.203003 
-	C1547.903809,844.521179 1546.311401,844.458862 1546.308228,844.350464 
-	C1546.182861,840.026062 1546.201294,835.697388 1547.153320,831.330627 
-	C1549.893066,835.258667 1548.568115,839.644653 1548.838135,844.203003 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1123.245483,725.293457 
-	C1123.203247,723.961060 1123.069946,723.059753 1122.890137,721.480591 
-	C1122.841309,718.950623 1122.838989,717.098389 1122.836670,715.246216 
-	C1123.557617,714.533508 1124.278687,713.820801 1125.318115,713.080383 
-	C1125.636475,718.513794 1125.636475,723.974976 1125.636475,729.436096 
-	C1125.057129,729.472717 1124.477661,729.509277 1123.898315,729.545898 
-	C1123.650269,728.272095 1123.402344,726.998352 1123.245483,725.293457 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M907.588013,67.434975 
-	C908.363586,70.337936 908.722107,73.206985 909.066711,76.519958 
-	C908.553650,76.956078 908.054443,76.948265 907.180664,76.923569 
-	C906.597595,74.846657 906.597595,74.846657 899.583740,69.026237 
-	C902.333008,68.437340 904.751953,67.919197 907.588013,67.434975 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1133.925415,414.941864 
-	C1133.013794,414.006256 1131.426758,413.142761 1131.317749,412.121460 
-	C1130.997070,409.117340 1131.188110,406.046234 1131.364868,403.012207 
-	C1131.398560,402.434692 1132.283447,401.906738 1132.775635,401.355865 
-	C1133.243530,402.691254 1133.711548,404.026672 1134.124756,406.087616 
-	C1134.021851,409.522736 1133.973633,412.232300 1133.925415,414.941864 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1131.508301,424.794434 
-	C1131.570190,429.308807 1131.570190,433.510193 1131.570190,438.695679 
-	C1128.395508,434.936829 1128.459717,426.105682 1130.834106,423.815186 
-	C1130.865234,423.785217 1131.120850,423.933868 1131.221436,424.044739 
-	C1131.327759,424.161835 1131.373901,424.333527 1131.508301,424.794434 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1062.703857,406.922943 
-	C1062.977051,404.979065 1063.250244,403.035217 1063.642578,400.243896 
-	C1066.659424,404.819977 1066.421631,412.617218 1063.454224,414.569824 
-	C1062.922852,411.686096 1062.813354,409.304535 1062.703857,406.922943 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M85.057602,597.995056 
-	C85.212753,595.366882 85.366943,593.202393 85.568542,590.372375 
-	C88.559258,593.628845 88.826248,600.662476 85.595032,604.959534 
-	C85.415565,602.792603 85.236099,600.625671 85.057602,597.995056 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1271.966187,164.534912 
-	C1271.966187,164.534912 1272.005249,164.642960 1272.001587,164.610245 
-	C1271.654663,165.597961 1271.311279,166.618393 1270.968018,167.638840 
-	C1270.368286,167.560562 1269.768555,167.482300 1269.168823,167.404022 
-	C1269.168823,163.802322 1269.105347,160.198273 1269.237427,156.601425 
-	C1269.257446,156.060242 1270.192261,155.552689 1270.703979,155.029587 
-	C1271.125366,155.826279 1271.546753,156.622971 1271.983398,157.922638 
-	C1271.998779,158.425613 1272.008423,158.422211 1271.983398,158.950378 
-	C1271.960938,161.164001 1271.963501,162.849457 1271.966187,164.534912 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M1482.072266,413.317993 
-	C1481.860840,409.971069 1481.913818,406.932343 1481.890381,403.443970 
-	C1482.532959,402.234283 1483.252075,401.474335 1483.971191,400.714355 
-	C1484.338867,400.902374 1484.706543,401.090424 1485.074219,401.278442 
-	C1485.074219,404.726532 1485.231079,408.187531 1484.949951,411.612549 
-	C1484.889404,412.350311 1483.249146,412.958374 1482.072266,413.317993 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M892.021362,74.744766 
-	C892.124878,71.564445 892.228638,68.832970 892.332397,66.101486 
-	C892.964600,66.131325 893.596741,66.161156 894.228882,66.190994 
-	C894.228882,70.387955 894.228882,74.584915 894.228882,78.781876 
-	C893.730042,78.838791 893.231262,78.895706 892.732422,78.952614 
-	C892.495483,77.699615 892.258545,76.446609 892.021362,74.744766 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M925.546143,94.742294 
-	C925.795227,99.037918 925.795227,102.968399 925.795227,106.898872 
-	C921.773132,103.298920 922.211487,95.730743 925.546143,94.742294 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1550.827148,167.128082 
-	C1551.873291,169.217804 1552.641113,171.385544 1553.492554,173.789078 
-	C1553.217773,173.952942 1552.124268,174.605072 1551.039185,175.606857 
-	C1550.498291,175.926636 1549.949097,175.896759 1548.993164,175.777191 
-	C1547.203735,174.782471 1545.820923,173.877411 1544.605835,173.082092 
-	C1545.915161,171.818680 1547.477905,170.310776 1549.028076,168.403793 
-	C1549.526611,167.738495 1550.037598,167.472305 1550.827148,167.128082 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M905.116760,102.375435 
-	C905.460693,100.193123 905.687500,98.455101 906.087524,96.757927 
-	C906.124817,96.599777 907.259460,96.700302 907.958984,97.384155 
-	C908.075378,99.958679 908.117432,101.829788 908.159485,103.700897 
-	C907.835693,104.735619 907.511902,105.770332 907.282654,107.213547 
-	C907.317017,108.819046 907.256836,110.016052 907.196594,111.213058 
-	C906.605835,111.240326 906.015137,111.267586 905.424377,111.294853 
-	C905.298645,108.473541 905.172852,105.652229 905.116760,102.375435 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M550.263428,206.002167 
-	C548.432373,205.037888 546.824951,204.086746 545.217529,203.135620 
-	C546.535767,202.090454 547.854004,201.045273 549.558228,199.992706 
-	C550.121277,199.986389 550.298279,199.987457 550.740662,199.996613 
-	C551.001282,201.723877 550.996521,203.443054 550.963501,205.592316 
-	C550.935181,206.022430 550.487122,206.015335 550.263428,206.002167 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M533.579102,176.005142 
-	C533.989136,176.456757 533.987305,176.863358 533.983948,177.574554 
-	C533.198547,179.574600 532.171326,181.204865 531.695312,182.982712 
-	C531.157410,184.991608 530.756714,186.183121 528.888672,183.610718 
-	C528.919373,182.030472 528.951355,180.837753 528.925293,179.198853 
-	C528.228943,174.631714 531.667969,176.789291 533.579102,176.005142 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M530.728394,723.635742 
-	C533.142517,723.635742 535.556641,723.635742 538.075378,723.635742 
-	C535.550171,727.966614 533.202515,728.177490 529.174072,724.242798 
-	C529.981384,723.764648 530.354858,723.700195 530.728394,723.635742 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1517.249512,197.944901 
-	C1515.242554,197.051392 1513.591797,196.183167 1511.853027,195.268738 
-	C1513.107788,192.870102 1518.173950,195.575653 1517.000244,190.458984 
-	C1517.482056,189.775223 1518.012085,189.501022 1518.827759,189.137695 
-	C1519.101562,191.725143 1519.089600,194.401718 1519.055786,197.523651 
-	C1518.557739,197.969406 1518.081787,197.969803 1517.249512,197.944901 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1062.392334,406.948425 
-	C1062.813354,409.304535 1062.922852,411.686096 1063.043945,414.511353 
-	C1062.444824,414.738861 1061.833862,414.522675 1061.037720,414.026581 
-	C1059.015381,413.246887 1057.178345,412.747101 1055.810425,412.374969 
-	C1057.640259,410.739838 1059.252319,409.299377 1060.847900,407.478760 
-	C1061.248047,407.057007 1061.664307,407.015442 1062.392334,406.948425 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M254.614594,755.916138 
-	C254.787750,755.011719 254.884949,754.517883 254.998596,753.647339 
-	C256.844788,753.189026 258.674500,753.107544 261.373566,752.987305 
-	C259.572449,754.929749 258.452332,756.137756 256.897644,757.934265 
-	C256.314148,760.728760 256.165161,762.934814 256.016144,765.140808 
-	C255.523636,762.202820 255.031143,759.264771 254.614594,755.916138 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1134.292725,414.961731 
-	C1133.973633,412.232300 1134.021851,409.522736 1134.176514,406.462646 
-	C1134.620239,406.107849 1134.957397,406.103546 1135.797119,406.162750 
-	C1137.066650,408.375916 1137.833740,410.525543 1138.662598,412.848572 
-	C1138.358154,413.011719 1137.241211,413.610443 1136.126587,414.556641 
-	C1135.639404,414.929962 1135.149780,414.955780 1134.292725,414.961731 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M495.438354,182.179550 
-	C495.007019,183.103806 494.575684,184.028076 494.144348,184.952347 
-	C493.668365,183.949966 493.192352,182.947586 492.783630,181.171265 
-	C492.769379,179.876312 492.687805,179.355316 492.606232,178.834320 
-	C492.777466,176.592438 492.948669,174.350540 493.119904,172.108658 
-	C493.617065,172.061005 494.114227,172.013351 494.611389,171.965698 
-	C494.846710,173.964905 495.082031,175.964127 495.237366,178.801697 
-	C495.251007,180.486542 495.344696,181.333054 495.438354,182.179550 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M577.498779,175.996979 
-	C577.805054,178.678726 577.881653,181.377396 578.016296,184.521698 
-	C577.847107,184.962830 577.619812,184.958344 577.052368,184.918228 
-	C573.793945,182.177521 572.683533,179.470459 576.758667,176.421906 
-	C576.814087,176.086014 577.269043,176.013931 577.498779,175.996979 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M328.687714,173.848724 
-	C326.588379,175.842072 326.462463,177.899124 328.911377,180.308472 
-	C328.269775,181.001770 327.563232,181.426331 326.422882,181.426102 
-	C325.587708,178.809052 325.186340,176.616806 324.784973,174.424561 
-	C325.964417,174.227905 327.143829,174.031250 328.687714,173.848724 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M324.445740,174.484436 
-	C325.186340,176.616806 325.587708,178.809052 326.001343,181.405914 
-	C324.683380,181.106400 323.353180,180.402267 322.308533,179.316132 
-	C322.921722,178.519943 323.249390,178.105759 323.577057,177.691589 
-	C323.043610,177.460220 322.510132,177.228836 321.976685,176.997452 
-	C322.686615,176.179733 323.396545,175.362015 324.445740,174.484436 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M508.517792,453.493042 
-	C508.253906,455.583862 507.628235,457.737701 507.002594,459.891510 
-	C506.385803,459.737427 505.769012,459.583344 505.152252,459.429230 
-	C505.403900,457.856506 505.655548,456.283783 505.952850,454.335754 
-	C506.717651,453.825653 507.436829,453.690857 508.517792,453.493042 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M939.657104,104.372086 
-	C940.460999,103.282265 941.230286,102.456268 943.067993,100.482994 
-	C943.067993,103.201828 943.067993,104.697525 943.039917,106.523529 
-	C941.882019,106.114532 940.752197,105.375221 939.657104,104.372086 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1038.652954,714.858154 
-	C1036.451660,714.734863 1033.794678,714.615723 1031.126709,714.092102 
-	C1033.476196,714.079224 1035.836670,714.470764 1038.652954,714.858154 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M920.365723,105.631256 
-	C919.792114,101.007027 919.386658,95.933624 918.986084,90.387154 
-	C919.532227,91.067978 920.487488,92.203659 920.539124,93.379082 
-	C920.711792,97.305756 920.560913,101.246643 920.365723,105.631256 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M356.025360,231.988861 
-	C356.275391,229.661331 353.611389,226.542969 357.692078,225.842178 
-	C357.036682,228.255402 356.531036,230.122131 356.025360,231.988861 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M735.390869,304.706970 
-	C734.999084,302.828430 734.583862,300.528961 734.263367,297.774963 
-	C734.694580,299.642273 735.031067,301.964172 735.390869,304.706970 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M256.356049,765.044373 
-	C256.165161,762.934814 256.314148,760.728760 256.757690,758.251282 
-	C256.933472,760.302490 256.814697,762.625244 256.356049,765.044373 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1599.362183,844.925537 
-	C1599.459717,842.771423 1599.924438,840.551575 1600.740234,838.177490 
-	C1600.637451,840.302124 1600.183350,842.580994 1599.362183,844.925537 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1469.607178,143.998718 
-	C1470.014893,144.696167 1470.022217,145.368774 1470.048828,146.370148 
-	C1468.879639,146.652466 1467.691284,146.606003 1466.250488,146.308075 
-	C1466.000000,145.600479 1466.001709,145.144363 1466.001709,144.346619 
-	C1467.068970,143.994644 1468.137817,143.984268 1469.607178,143.998718 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M773.479492,308.911102 
-	C772.112549,308.957458 770.926392,308.836426 768.352234,308.573761 
-	C770.869263,307.422943 772.093933,306.863037 773.629639,306.161255 
-	C773.847351,306.927521 773.753845,307.835602 773.479492,308.911102 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M1046.358276,752.207031 
-	C1045.924561,748.554993 1045.956787,744.815186 1046.009033,740.625122 
-	C1046.190552,740.127625 1046.351929,740.080383 1046.758545,740.547119 
-	C1047.122681,741.565674 1047.241699,742.070251 1047.360718,742.574890 
-	C1047.181885,745.756409 1047.003052,748.937866 1046.358276,752.207031 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M527.884766,718.408691 
-	C528.992798,718.776855 529.967651,719.552063 530.971680,720.668091 
-	C530.826660,721.507935 530.652405,722.006958 529.920471,722.840576 
-	C528.993774,723.245239 528.624756,723.315369 528.255737,723.385498 
-	C528.255737,723.385437 528.018005,723.207275 527.986206,723.061829 
-	C527.954346,722.916382 527.963745,722.995972 527.998291,723.015991 
-	C527.939148,721.629333 527.845398,720.222534 527.884766,718.408691 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M766.311462,426.578857 
-	C765.639587,427.027893 765.040466,427.034454 763.989258,427.027649 
-	C763.600281,426.560730 763.663330,426.107208 764.123047,425.099487 
-	C764.313293,423.018372 764.106934,421.491425 763.900513,419.964478 
-	C763.860596,419.798767 763.820679,419.633057 764.246338,419.230774 
-	C765.196716,418.989410 765.681396,418.984650 766.166138,418.979858 
-	C766.238831,421.365356 766.311523,423.750885 766.311462,426.578857 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M355.900391,232.327240 
-	C356.531036,230.122131 357.036682,228.255402 357.846741,226.161026 
-	C358.242249,228.337982 358.333313,230.742569 357.893494,233.597076 
-	C356.750458,234.059799 356.138275,234.072632 355.526093,234.085449 
-	C355.609192,233.612183 355.692291,233.138901 355.900391,232.327240 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M763.785400,420.263428 
-	C764.106934,421.491425 764.313293,423.018372 764.245728,424.778137 
-	C763.871277,423.528046 763.770752,422.045197 763.785400,420.263428 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M309.493256,209.300735 
-	C310.244232,208.861206 311.328247,208.433334 312.724945,207.998886 
-	C311.967163,208.432327 310.896759,208.872360 309.493256,209.300735 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1583.265137,146.781219 
-	C1582.953735,146.031357 1582.975464,145.364761 1582.994873,144.360901 
-	C1583.745728,144.006821 1584.499146,143.990005 1585.626099,144.331482 
-	C1586.002686,145.139801 1586.005615,145.589859 1586.008545,146.039917 
-	C1585.205200,146.314758 1584.401855,146.589600 1583.265137,146.781219 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M84.463989,620.202881 
-	C84.064522,619.794312 84.043221,619.321655 84.029701,618.494263 
-	C84.988396,618.375183 85.939316,618.610718 86.927856,619.169800 
-	C86.965469,619.493347 86.995499,619.451538 87.003143,619.427246 
-	C86.287918,619.648132 85.565033,619.893372 84.463989,620.202881 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1039.265381,91.475143 
-	C1040.480469,90.768974 1042.031616,90.115776 1043.781128,89.694824 
-	C1042.520142,90.460754 1041.060791,90.994431 1039.265381,91.475143 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1046.264038,89.544991 
-	C1046.946655,88.698700 1047.958374,87.894722 1049.161377,86.790985 
-	C1050.010010,86.636917 1050.667358,86.782608 1051.658691,86.980049 
-	C1051.404419,87.490547 1050.815918,87.949303 1050.033325,88.619057 
-	C1048.757202,89.082474 1047.675049,89.334892 1046.264038,89.544991 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M245.626099,367.993896 
-	C245.533112,369.006500 245.073578,369.916534 244.614059,370.826599 
-	C244.079483,370.160309 243.544891,369.494049 243.009079,368.466248 
-	C243.758408,368.033600 244.508987,367.962494 245.626099,367.993896 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M247.407135,380.248352 
-	C247.079239,379.827942 247.048965,379.334564 247.022476,378.470184 
-	C247.786224,378.110809 248.546158,378.122437 249.306122,378.134094 
-	C248.772324,378.814545 248.238541,379.494965 247.407135,380.248352 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M343.818665,236.558914 
-	C342.347015,236.975632 340.875397,237.392365 339.164215,237.216370 
-	C338.978424,236.322067 339.032196,236.020462 339.414612,235.741867 
-	C340.588989,235.602921 341.434753,235.440979 342.652832,235.613678 
-	C343.289642,236.151840 343.554169,236.355377 343.818665,236.558914 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M509.345520,462.981171 
-	C509.857513,462.008514 510.712036,461.025085 511.966736,460.075439 
-	C511.473969,461.062958 510.580994,462.016693 509.345520,462.981171 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M774.131714,304.640564 
-	C773.214661,304.739868 772.397034,304.482056 771.301147,303.828491 
-	C771.225220,302.915161 771.427551,302.397614 771.997070,301.918243 
-	C772.851929,301.919464 773.339722,301.882507 773.827454,301.845551 
-	C773.827454,301.845551 773.957336,301.961761 774.022339,302.019836 
-	C774.135315,302.813080 774.183167,303.548309 774.131714,304.640564 
-z"/>
-<path fill="#C3CED3" opacity="1.000000" stroke="none" 
-	d="
-M1586.399170,146.045807 
-	C1586.005615,145.589859 1586.002686,145.139801 1586.002319,144.352783 
-	C1587.302734,144.157272 1588.600708,144.298752 1590.192871,144.721359 
-	C1589.254761,145.352234 1588.022217,145.701981 1586.399170,146.045807 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M325.991821,171.084473 
-	C325.121033,171.579269 324.250214,172.074051 323.379395,172.568848 
-	C323.095001,172.210953 322.810638,171.853058 322.526245,171.495163 
-	C323.432159,170.666031 324.338104,169.836899 325.617584,169.360626 
-	C325.991364,170.170471 325.991577,170.627457 325.991821,171.084473 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M274.340424,338.669189 
-	C274.241913,338.160309 274.530060,337.576294 274.829407,336.744263 
-	C275.344177,336.408142 275.847778,336.320068 276.731934,336.288452 
-	C277.082306,336.957001 277.052155,337.569092 277.047394,338.488190 
-	C276.290894,338.728149 275.508972,338.661102 274.340424,338.669189 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M326.373138,171.052643 
-	C325.991577,170.627457 325.991364,170.170471 325.996765,169.371246 
-	C326.755096,168.985580 327.507843,168.942169 328.635315,169.358826 
-	C329.014252,170.298660 329.018433,170.778427 329.022614,171.258209 
-	C328.266571,171.179062 327.510529,171.099945 326.373138,171.052643 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M329.085175,171.401199 
-	C329.018433,170.778427 329.014252,170.298660 329.000977,169.459290 
-	C329.992279,169.846130 330.992676,170.592529 331.590515,171.661728 
-	C330.654327,171.981491 330.120758,171.978455 329.587158,171.975418 
-	C329.384399,171.889023 329.237915,171.745270 329.085175,171.401199 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M1487.317383,833.875549 
-	C1486.986328,833.411438 1486.994629,832.997681 1486.997559,832.273438 
-	C1487.539429,831.888977 1488.087036,831.815063 1488.820923,831.852356 
-	C1489.007568,832.377930 1489.007690,832.792236 1489.014893,833.516968 
-	C1488.566895,833.860229 1488.111938,833.893066 1487.317383,833.875549 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M495.693848,182.141068 
-	C495.344696,181.333054 495.251007,180.486542 495.297211,179.230301 
-	C495.782440,178.876678 496.127838,178.932816 496.736572,178.995087 
-	C497.026398,179.755325 497.052887,180.509430 497.029205,181.638214 
-	C496.635803,182.042786 496.292572,182.072678 495.693848,182.141068 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M537.092773,669.307068 
-	C537.779907,668.952332 538.424133,668.942993 539.390259,668.927002 
-	C539.408264,669.555969 539.104431,670.191650 538.800598,670.827332 
-	C538.217041,670.435730 537.633423,670.044067 537.092773,669.307068 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1047.630859,742.317200 
-	C1047.241699,742.070251 1047.122681,741.565674 1046.976318,740.673950 
-	C1047.706177,740.232361 1048.463379,740.177795 1049.595947,740.011230 
-	C1049.968994,740.379211 1049.966553,740.859314 1049.967529,741.699341 
-	C1049.281006,742.059387 1048.590942,742.059448 1047.630859,742.317200 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M800.786499,185.428574 
-	C801.333618,185.048874 801.827759,185.032379 802.692749,185.019836 
-	C802.828430,185.888290 802.593201,186.752792 802.358032,187.617294 
-	C801.816528,187.008789 801.275024,186.400284 800.786499,185.428574 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1102.024414,545.289185 
-	C1102.403320,546.002319 1102.630371,546.946350 1102.785400,548.275513 
-	C1102.433105,547.613708 1102.152710,546.566895 1102.024414,545.289185 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1293.744629,218.188843 
-	C1293.743042,218.638489 1293.439209,219.138733 1293.135254,219.638992 
-	C1292.737915,219.061646 1292.340576,218.484283 1291.921753,217.592697 
-	C1292.414307,217.598801 1292.928223,217.919128 1293.744629,218.188843 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M356.225891,236.946350 
-	C355.899902,236.415466 355.757568,236.133331 355.393860,235.427826 
-	C355.172485,235.004486 355.219116,234.959305 355.696533,235.271423 
-	C356.877472,235.709854 357.580994,235.836166 358.284485,235.962463 
-	C357.659485,236.373337 357.034515,236.784210 356.225891,236.946350 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M358.365723,235.644958 
-	C357.580994,235.836166 356.877472,235.709854 355.726044,235.257874 
-	C355.225616,234.726532 355.239624,234.525391 355.423096,234.207123 
-	C356.138275,234.072632 356.750458,234.059799 357.821350,234.042236 
-	C358.335663,234.467484 358.391296,234.897461 358.365723,235.644958 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M492.344696,178.864807 
-	C492.687805,179.355316 492.769379,179.876312 492.729736,180.779358 
-	C492.195374,181.075226 491.782227,180.989059 491.056885,180.839828 
-	C490.788788,180.374100 490.832916,179.971420 490.954834,179.274384 
-	C491.382751,178.951767 491.732971,178.923538 492.344696,178.864807 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M321.858887,177.324890 
-	C322.510132,177.228836 323.043610,177.460220 323.577057,177.691589 
-	C323.249390,178.105759 322.921722,178.519943 322.287354,178.968140 
-	C321.900787,178.552216 321.820953,178.102280 321.858887,177.324890 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M761.975342,743.283020 
-	C762.429932,742.998047 762.883179,742.996155 763.676270,742.996704 
-	C763.335510,743.188110 762.654785,743.377136 761.975342,743.283020 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M766.163940,418.715088 
-	C765.681396,418.984650 765.196716,418.989410 764.348633,418.996460 
-	C764.710815,418.815918 765.436340,418.633118 766.163940,418.715088 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1031.341797,92.178276 
-	C1031.890259,92.131226 1032.326660,92.331863 1032.877930,92.751648 
-	C1032.405151,92.789185 1031.817505,92.607582 1031.341797,92.178276 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1035.223389,92.639526 
-	C1035.513550,92.215355 1036.086426,91.842964 1036.812744,91.676331 
-	C1036.479492,92.151833 1035.992798,92.421570 1035.223389,92.639526 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M262.687073,336.336975 
-	C263.038025,336.739014 262.967865,337.156067 262.879059,337.890747 
-	C262.367523,337.983978 261.874664,337.759583 261.052368,337.284241 
-	C260.722931,337.033295 260.824554,337.104950 260.794830,337.116882 
-	C261.265381,336.869873 261.765656,336.610962 262.687073,336.336975 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M329.589935,172.289825 
-	C330.120758,171.978455 330.654327,171.981491 331.586823,171.992859 
-	C332.087036,172.446320 332.188354,172.891449 332.233063,173.676941 
-	C331.550323,173.992630 330.924164,173.967957 329.828430,173.888565 
-	C329.436768,173.423981 329.514740,173.014099 329.589935,172.289825 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M440.413757,366.145874 
-	C440.921967,366.104614 441.328247,366.292511 441.851624,366.677704 
-	C441.416412,366.708374 440.864105,366.541718 440.413757,366.145874 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M555.734009,692.328979 
-	C555.780396,692.720642 555.480469,693.203796 555.180542,693.686951 
-	C554.806091,693.303894 554.431641,692.920898 554.057129,692.228394 
-	C554.500549,692.086060 554.944092,692.253235 555.734009,692.328979 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M803.031067,174.723572 
-	C802.551147,174.993286 802.074036,174.987335 801.239014,174.966309 
-	C801.598755,174.783447 802.316284,174.615677 803.031067,174.723572 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M332.265594,177.683807 
-	C331.625397,177.795853 331.049652,177.568649 330.473907,177.341431 
-	C330.825409,176.908264 331.176941,176.475098 331.854980,176.010162 
-	C332.231049,176.433792 332.280548,176.889160 332.265594,177.683807 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M1053.708008,739.806885 
-	C1053.301514,739.516052 1052.682983,738.992188 1052.043457,738.129517 
-	C1052.513550,738.385010 1053.004883,738.979431 1053.708008,739.806885 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M343.169830,234.014496 
-	C343.695618,234.028091 344.221436,234.041687 345.140045,234.101089 
-	C345.126434,234.837875 344.720001,235.528854 344.066101,236.389374 
-	C343.554169,236.355377 343.289642,236.151840 342.783112,235.390869 
-	C342.750671,234.560455 342.960266,234.287476 343.169830,234.014496 
-z"/>
-<path fill="#7B818B" opacity="1.000000" stroke="none" 
-	d="
-M1028.707031,528.514771 
-	C1028.992676,528.185730 1029.458740,528.108459 1030.274902,527.983887 
-	C1030.045898,528.213257 1029.466675,528.489868 1028.707031,528.514771 
-z"/>
-<path fill="#8B97A1" opacity="1.000000" stroke="none" 
-	d="
-M60.235161,390.744446 
-	C60.470165,390.580933 60.957939,390.291870 61.746529,390.010773 
-	C61.527542,390.218781 61.007736,390.418823 60.235161,390.744446 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M339.085938,235.718872 
-	C339.032196,236.020462 338.978424,236.322067 338.849731,237.077515 
-	C338.774750,237.531342 338.345215,237.491272 338.182098,237.350266 
-	C338.022858,236.692993 338.026733,236.176712 338.251129,235.360565 
-	C338.753754,235.207932 338.958496,235.427322 339.085938,235.718872 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M506.225830,464.777222 
-	C505.958099,464.865295 505.736694,464.678406 505.554901,464.458740 
-	C505.531799,464.430817 505.716034,464.231232 506.009399,464.012817 
-	C506.237823,464.107025 506.261078,464.299591 506.225830,464.777222 
-z"/>
-<path fill="#71767C" opacity="1.000000" stroke="none" 
-	d="
-M528.284424,723.529175 
-	C528.624756,723.315369 528.993774,723.245239 529.925171,723.120728 
-	C530.487549,723.066284 530.676453,723.322815 530.702393,723.479248 
-	C530.354858,723.700195 529.981384,723.764648 529.038940,723.874756 
-	C528.469971,723.920410 528.313049,723.672913 528.284424,723.529175 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M81.687340,618.020630 
-	C81.775978,618.285706 81.557877,618.562256 81.094543,618.951233 
-	C81.026413,618.719788 81.203506,618.375977 81.687340,618.020630 
-z"/>
-<path fill="#858B94" opacity="1.000000" stroke="none" 
-	d="
-M80.834152,625.226074 
-	C81.005287,625.248108 81.139595,625.541260 81.089828,625.934082 
-	C80.869621,625.854858 80.833473,625.676025 80.834152,625.226074 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M765.324036,430.074280 
-	C765.217163,429.761292 765.451782,429.463013 765.950989,429.046326 
-	C766.032227,429.314941 765.848877,429.701965 765.324036,430.074280 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1548.939941,114.051361 
-	C1546.379761,115.361160 1544.079102,117.196747 1541.719727,117.275467 
-	C1531.743652,117.608292 1521.734619,117.729965 1511.773071,117.225548 
-	C1508.865356,117.078308 1505.326782,115.268448 1503.369751,113.070183 
-	C1497.070312,105.994385 1491.114380,98.567497 1485.600464,90.864784 
-	C1483.902710,88.493057 1483.037720,84.628708 1483.533569,81.747581 
-	C1485.168701,72.247917 1487.349243,62.816608 1489.893066,53.515759 
-	C1490.581055,51.000549 1492.851807,48.214108 1495.160034,46.972267 
-	C1503.649780,42.405014 1512.326660,38.111256 1521.228271,34.427860 
-	C1524.054565,33.258354 1528.202637,33.345661 1531.051880,34.528961 
-	C1539.950195,38.224556 1548.663696,42.449657 1557.122437,47.067215 
-	C1559.676147,48.461216 1562.152344,51.516933 1562.961914,54.305592 
-	C1565.556152,63.242409 1567.278687,72.428894 1569.494141,81.480721 
-	C1570.398804,85.176727 1569.798584,88.238556 1567.335449,91.215813 
-	C1561.183228,98.652519 1555.214722,106.241257 1548.939941,114.051361 
-M1511.608398,58.242416 
-	C1506.842651,63.818882 1504.516357,55.932915 1500.071411,56.682911 
-	C1500.733154,58.426163 1501.652222,60.018349 1503.021606,60.945827 
-	C1505.283447,62.477673 1506.040527,63.859489 1504.948730,66.697845 
-	C1503.598877,70.207146 1502.711060,73.992882 1502.302246,77.733360 
-	C1501.991577,80.575577 1501.070435,81.877548 1498.237305,82.308823 
-	C1496.502563,82.572891 1494.888062,83.627365 1493.219604,84.326874 
-	C1493.428345,84.935295 1493.637207,85.543709 1493.845947,86.152130 
-	C1495.400635,85.980949 1497.079834,86.127289 1498.485229,85.575752 
-	C1501.934082,84.222382 1503.523926,85.659782 1505.140503,88.632141 
-	C1506.694336,91.489082 1508.829590,94.202972 1511.258301,96.362396 
-	C1513.706665,98.539238 1514.317627,100.245499 1512.492432,103.112213 
-	C1511.745117,104.286018 1512.138184,106.185860 1512.012451,107.755478 
-	C1513.071411,106.741676 1514.657837,105.912720 1515.090088,104.679268 
-	C1516.367065,101.035599 1518.451172,100.481750 1522.036133,101.305725 
-	C1524.852661,101.953102 1528.047607,101.874680 1530.888916,101.260429 
-	C1534.486816,100.482635 1536.548462,101.124825 1537.729736,104.812553 
-	C1538.117554,106.023331 1539.813232,106.815132 1540.910889,107.798576 
-	C1540.761841,106.246643 1541.100220,104.396263 1540.368408,103.201332 
-	C1538.513916,100.172951 1539.078247,98.238167 1541.718994,95.954193 
-	C1544.037231,93.949219 1546.104126,91.381233 1547.511230,88.662857 
-	C1549.319824,85.169212 1551.366089,84.012505 1555.067383,85.636497 
-	C1556.162842,86.117111 1557.647461,85.710640 1558.953735,85.710640 
-	C1559.061523,85.286308 1559.169189,84.861977 1559.276978,84.437637 
-	C1558.254639,83.908234 1557.267578,83.017288 1556.203735,82.913391 
-	C1552.097046,82.512383 1549.976074,80.925507 1550.231567,76.292389 
-	C1550.380493,73.591614 1549.605957,70.550255 1548.346924,68.130280 
-	C1546.512451,64.603981 1546.734619,62.393501 1550.362549,60.396858 
-	C1551.386841,59.833118 1551.660645,57.906025 1552.278687,56.604259 
-	C1550.876953,57.005085 1549.042603,56.982502 1548.156372,57.887871 
-	C1545.708984,60.388618 1543.822144,60.646740 1540.930786,58.304798 
-	C1538.550415,56.376823 1535.503906,54.925007 1532.522949,54.175011 
-	C1528.979736,53.283554 1527.346558,51.871510 1527.820068,48.049870 
-	C1527.977661,46.778164 1526.881348,45.351093 1526.358154,43.995068 
-	C1525.740967,45.433945 1524.458374,46.962585 1524.638062,48.293983 
-	C1525.083618,51.597347 1524.135742,53.104813 1520.810913,53.960079 
-	C1517.814331,54.730930 1515.067017,56.470234 1511.608398,58.242416 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M155.528152,229.052185 
-	C157.324493,231.856216 159.738953,234.632462 159.801331,237.460587 
-	C160.165985,253.993454 159.967239,270.538513 159.998032,287.079376 
-	C160.001389,288.876556 160.256973,290.673248 160.718872,292.744110 
-	C161.027359,293.768646 161.012512,294.519257 160.965118,295.644318 
-	C160.614853,297.746765 160.028061,299.473633 160.021072,301.202911 
-	C159.952377,318.185669 159.991714,335.168854 159.974960,352.151917 
-	C159.968018,359.203674 158.220032,360.942352 151.110718,360.944489 
-	C112.982079,360.955963 74.853371,360.916718 36.724880,360.991425 
-	C31.906908,361.000854 28.522665,360.056061 28.756420,354.208405 
-	C28.861095,351.589844 28.099669,348.945526 28.096031,346.312408 
-	C28.047476,311.180847 28.003021,276.048950 28.148598,240.917908 
-	C28.164829,237.001190 27.394278,232.485245 31.773369,229.385422 
-	C73.025307,229.096329 114.042496,229.072342 155.528152,229.052185 
-M90.500076,325.862213 
-	C97.981255,325.861755 105.463356,325.933044 112.943283,325.836212 
-	C118.129829,325.769104 120.132568,323.314880 119.467056,318.209076 
-	C118.177475,308.315369 110.089180,301.112762 100.010292,300.969910 
-	C94.857613,300.896851 89.702568,300.909393 84.549469,300.964569 
-	C74.691292,301.070068 67.019623,307.393066 65.050667,316.963562 
-	C63.758289,323.245453 65.713310,325.780304 72.044220,325.849518 
-	C77.862221,325.913147 83.681473,325.862427 90.500076,325.862213 
-M108.031013,272.672485 
-	C102.902115,264.457489 95.211510,261.512543 87.269295,264.722229 
-	C79.953217,267.678925 75.739677,275.415619 77.377609,282.884918 
-	C79.405777,292.133759 88.430084,297.768707 97.442993,295.414093 
-	C107.091400,292.893494 111.621071,283.737366 108.031013,272.672485 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M159.932114,507.651001 
-	C159.592926,509.753204 159.029465,511.474976 159.022247,513.199036 
-	C158.954514,529.408813 159.026550,545.619202 158.938568,561.828796 
-	C158.923538,564.601257 158.342239,567.370605 157.990311,570.560669 
-	C156.132858,571.631775 154.308563,572.849304 152.482300,572.852234 
-	C111.667389,572.918762 70.852287,572.851624 29.591095,572.710754 
-	C28.450022,569.085754 27.164574,565.561951 27.150944,562.033325 
-	C27.005529,524.386414 26.996630,486.738251 27.204544,449.091888 
-	C27.218832,446.505188 29.267263,443.929688 30.684032,441.177765 
-	C72.349648,441.025787 113.700943,441.045013 155.516449,441.128906 
-	C156.980499,444.034851 158.797058,446.862305 158.845352,449.719666 
-	C159.122894,466.141846 158.970230,482.571136 158.997803,498.997955 
-	C159.000839,500.805237 159.222351,502.612122 159.647583,504.703522 
-	C159.957047,505.749115 159.961472,506.510345 159.932114,507.651001 
-M62.740047,507.614197 
-	C62.494205,508.079651 62.248360,508.545105 61.489643,509.549835 
-	C61.659115,513.719971 61.828587,517.890076 62.002922,522.753967 
-	C62.024055,523.216431 62.045189,523.678833 61.525078,524.639160 
-	C61.181042,527.535889 60.786156,530.427734 60.507706,533.330750 
-	C60.244778,536.071960 61.569557,537.230164 64.325905,537.223877 
-	C83.482689,537.180298 102.639816,537.235413 121.796028,537.122803 
-	C123.038521,537.115540 125.364639,535.923828 125.337646,535.373779 
-	C125.152428,531.598938 124.473839,527.848267 123.986252,523.430725 
-	C123.995384,522.991394 124.004517,522.552063 124.627769,521.638428 
-	C124.708206,517.555725 124.788643,513.473083 124.793488,508.747345 
-	C124.527039,508.160889 124.260597,507.574402 124.566681,506.480713 
-	C124.993683,504.111542 125.513275,501.754547 125.826805,499.370453 
-	C126.345764,495.424225 124.859695,493.756104 120.555367,493.802185 
-	C102.117607,493.999634 83.676445,493.864624 65.236816,493.930664 
-	C63.849602,493.935638 62.068947,494.144226 61.160988,494.994629 
-	C59.267578,496.768066 60.709156,505.072479 62.740047,507.614197 
-M111.223236,472.097260 
-	C101.905533,472.097198 92.587822,472.097168 83.270119,472.097137 
-	C68.043449,472.097107 68.093750,472.116333 62.601421,486.485901 
-	C61.208801,490.129425 62.021309,491.917633 66.059822,491.915680 
-	C84.029655,491.906982 101.999481,491.911133 119.969315,491.913483 
-	C124.055206,491.914032 124.936890,489.977539 123.320518,486.459564 
-	C121.792473,483.133850 120.092422,479.865509 118.862587,476.430634 
-	C117.665077,473.086060 115.689705,471.517151 111.223236,472.097260 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M161.038483,88.609924 
-	C160.684372,90.695282 160.035583,92.404922 160.027924,94.117416 
-	C159.952011,111.107658 159.992981,128.098389 159.976761,145.088959 
-	C159.970657,151.482956 158.432587,153.022949 152.016037,153.024887 
-	C113.370789,153.036530 74.725540,153.036270 36.080292,153.025055 
-	C29.688993,153.023209 28.942646,152.263046 28.940966,145.779297 
-	C28.930866,106.800903 28.929363,67.822502 28.943214,28.844110 
-	C28.945374,22.767632 29.756981,21.969620 35.933376,21.967426 
-	C74.578621,21.953701 113.223862,21.957497 151.869110,21.962690 
-	C158.920502,21.963636 159.941040,22.905045 159.964279,30.008671 
-	C160.018784,46.665928 159.970673,63.323502 159.998001,79.980896 
-	C160.000977,81.794991 160.225739,83.608719 160.653717,85.706360 
-	C160.986984,86.738579 161.014160,87.487061 161.038483,88.609924 
-M58.755119,62.638187 
-	C58.648289,77.628082 58.497334,92.617859 58.456154,107.607941 
-	C58.439472,113.679947 60.424126,115.699524 66.566956,115.758522 
-	C84.397110,115.929794 102.228271,116.020782 120.059235,116.066147 
-	C126.283066,116.081978 128.235382,114.165695 128.260727,108.070847 
-	C128.318954,94.071411 128.321548,80.071373 128.258286,66.071976 
-	C128.232086,60.272762 126.152863,58.095562 120.494026,58.073921 
-	C102.328041,58.004440 84.159317,57.911098 65.998207,58.216732 
-	C63.656078,58.256145 61.352539,60.588680 58.755119,62.638187 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1108.000000,153.036346 
-	C1092.343506,153.035675 1077.187012,153.050995 1062.030518,153.026077 
-	C1056.272949,153.016617 1055.071411,151.849030 1055.066895,145.935349 
-	C1055.036865,106.961578 1055.036499,67.987778 1055.066406,29.014008 
-	C1055.071045,23.106806 1056.249268,21.967314 1062.058228,21.965061 
-	C1101.365112,21.949821 1140.671997,21.950251 1179.978882,21.965298 
-	C1185.761475,21.967510 1186.932983,23.110209 1186.937500,29.042358 
-	C1186.967407,68.016136 1186.967041,106.989944 1186.938843,145.963715 
-	C1186.934570,151.864166 1185.745239,153.021454 1179.951904,153.026443 
-	C1156.134644,153.046951 1132.317261,153.035812 1108.000000,153.036346 
-M1101.730713,69.725182 
-	C1097.272827,67.048187 1092.814941,64.371193 1087.886963,61.411945 
-	C1086.791260,63.402290 1085.825562,65.156281 1084.968384,66.713310 
-	C1090.551758,70.571861 1095.610474,74.067787 1100.601929,78.605782 
-	C1094.428833,77.181908 1088.255737,75.758041 1081.693604,74.244431 
-	C1081.319458,76.822556 1081.052246,78.662979 1080.808838,80.340454 
-	C1088.094482,82.181999 1094.743896,83.862770 1101.393433,85.543541 
-	C1101.815552,85.039413 1102.237671,84.535286 1102.659668,84.031158 
-	C1101.995605,81.841881 1101.331543,79.652603 1101.412231,77.717857 
-	C1102.701416,76.539680 1104.072510,75.436974 1105.252808,74.158318 
-	C1106.124023,73.214424 1106.832764,72.088844 1107.459473,70.958519 
-	C1108.369385,69.317459 1109.140137,67.599213 1110.690674,65.971741 
-	C1111.849731,66.381676 1113.566406,67.477402 1114.063477,67.073196 
-	C1115.566040,65.851532 1116.595337,64.047707 1117.361084,63.052887 
-	C1118.241821,63.780254 1119.592163,65.816444 1120.802368,65.736252 
-	C1126.147949,65.382050 1130.623779,66.805367 1134.347778,70.626717 
-	C1136.654053,72.993187 1138.944336,75.375404 1141.090332,78.527504 
-	C1140.979858,80.318954 1140.869507,82.110405 1140.724976,84.453033 
-	C1148.444946,83.734131 1155.379028,83.088409 1162.725098,82.404327 
-	C1162.185669,79.785736 1161.804077,77.932610 1161.462769,76.275986 
-	C1154.322021,76.839790 1147.717651,77.361244 1140.679810,77.218513 
-	C1146.707031,74.313667 1152.734131,71.408813 1159.051880,68.363937 
-	C1157.770020,66.200768 1156.786377,64.540985 1156.052979,63.303341 
-	C1150.828125,65.390182 1146.114136,67.272987 1141.106445,68.370392 
-	C1140.959106,68.132881 1140.811646,67.895378 1140.938599,67.047562 
-	C1144.224854,63.627018 1147.511108,60.206470 1151.058472,56.514145 
-	C1149.022583,54.911690 1147.520020,53.729111 1146.222778,52.708080 
-	C1141.312622,57.474693 1136.811768,61.844086 1132.310791,66.213478 
-	C1132.064697,66.139923 1131.818604,66.066376 1131.572388,65.992821 
-	C1134.161255,60.247169 1136.750122,54.501518 1139.519775,48.354439 
-	C1137.140137,47.440491 1135.254517,46.716263 1133.814697,46.163239 
-	C1130.772217,52.174656 1128.044434,57.564396 1125.316650,62.954132 
-	C1125.054199,62.884686 1124.791626,62.815235 1124.529053,62.745789 
-	C1124.888306,56.840355 1125.247437,50.934921 1125.628784,44.666389 
-	C1123.269897,44.666389 1121.249146,44.666389 1119.656982,44.666389 
-	C1118.886353,50.483135 1118.170410,55.887314 1117.454346,61.291496 
-	C1117.009399,61.339470 1116.564453,61.387444 1116.119507,61.435421 
-	C1114.635742,56.270416 1113.151978,51.105412 1111.518677,45.419445 
-	C1109.137573,46.272461 1107.224487,46.957790 1106.364014,47.266037 
-	C1107.000610,53.096287 1107.543457,58.069462 1107.386353,63.365036 
-	C1104.437378,59.425308 1101.488403,55.485580 1098.274414,51.191772 
-	C1096.362061,52.864872 1094.913330,54.132332 1093.945801,54.978897 
-	C1096.800659,59.949078 1099.400146,64.474846 1102.056641,68.953102 
-	C1102.056641,68.953102 1102.115601,68.907990 1101.730713,69.725182 
-M1144.282349,92.269447 
-	C1149.820190,93.671753 1155.358032,95.074051 1161.235718,96.562408 
-	C1161.618652,93.895584 1161.886963,92.026413 1162.142456,90.247192 
-	C1154.822144,88.467812 1148.142212,86.844101 1140.429688,84.969391 
-	C1141.559692,90.388153 1139.804199,93.193871 1137.249878,96.053612 
-	C1135.312866,98.222160 1134.453491,101.353271 1132.356934,104.436470 
-	C1128.365967,102.118645 1126.206909,103.490540 1125.369873,108.986794 
-	C1125.371460,105.242088 1123.364136,104.948593 1120.204224,104.747704 
-	C1116.800903,104.531342 1112.938843,103.510651 1110.270630,101.513466 
-	C1105.533569,97.967651 1101.600464,93.388771 1102.067993,86.262550 
-	C1094.666992,86.932243 1087.801392,87.553513 1080.306641,88.231682 
-	C1080.787598,90.742638 1081.171021,92.744057 1081.391846,93.897049 
-	C1087.494263,93.897049 1092.926270,93.897049 1098.358276,93.897049 
-	C1098.465332,94.230423 1098.572266,94.563797 1098.679321,94.897171 
-	C1093.801636,97.341057 1088.923950,99.784943 1083.787354,102.358589 
-	C1085.151245,104.533470 1086.181030,106.175514 1086.804932,107.170364 
-	C1091.776001,105.432289 1096.187744,103.889809 1100.599365,102.347321 
-	C1100.870605,102.916695 1101.141846,103.486076 1101.413086,104.055450 
-	C1098.309448,107.360535 1095.205933,110.665619 1091.891846,114.194878 
-	C1093.939697,115.792686 1095.461914,116.980385 1096.661987,117.916718 
-	C1100.664185,114.167801 1104.313110,110.749779 1107.962036,107.331749 
-	C1108.343140,107.650429 1108.724365,107.969109 1109.105469,108.287788 
-	C1107.341797,112.921242 1105.578003,117.554688 1103.698242,122.492882 
-	C1105.938477,123.274055 1107.750732,123.905952 1109.486450,124.511185 
-	C1112.230591,118.613869 1114.789185,113.115532 1117.347778,107.617203 
-	C1117.761475,107.647766 1118.175171,107.678329 1118.588867,107.708900 
-	C1118.150146,113.773186 1117.711426,119.837471 1117.252197,126.186378 
-	C1119.707031,126.186378 1121.608643,126.186378 1123.263794,126.186378 
-	C1124.041992,120.471230 1124.777344,115.071190 1125.512573,109.671158 
-	C1125.981201,109.623894 1126.449951,109.576622 1126.918579,109.529358 
-	C1128.399292,114.656548 1129.880005,119.783730 1131.498779,125.389137 
-	C1133.996704,124.378365 1135.891235,123.611717 1136.908203,123.200226 
-	C1135.820435,116.932373 1134.865967,111.432014 1134.632812,105.923012 
-	C1137.852417,110.308601 1141.072021,114.694183 1144.562988,119.449303 
-	C1146.436523,117.897385 1148.012451,116.591965 1149.277832,115.543732 
-	C1146.480225,111.257301 1143.989136,107.440552 1141.498047,103.623802 
-	C1141.991821,103.114777 1142.485718,102.605743 1142.979492,102.096718 
-	C1146.805908,104.415459 1150.632446,106.734207 1154.842773,109.285545 
-	C1156.014893,107.380592 1157.082153,105.645981 1158.034668,104.097992 
-	C1152.616821,100.272285 1147.679199,96.785721 1143.133911,92.803452 
-	C1143.253784,92.630188 1143.373657,92.456924 1144.282349,92.269447 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1481.056519,453.954224 
-	C1518.520508,453.954285 1555.494751,453.952820 1592.468872,453.955841 
-	C1599.943848,453.956451 1600.924072,454.812897 1600.930786,462.126129 
-	C1600.965942,500.432678 1600.963257,538.739258 1600.928833,577.045837 
-	C1600.923218,583.259277 1599.079102,585.012329 1592.884277,585.014038 
-	C1554.411133,585.024719 1515.937988,585.023560 1477.464844,585.016052 
-	C1470.688721,585.014709 1469.057983,583.374023 1469.054810,576.410217 
-	C1469.037720,538.603271 1469.045166,500.796387 1469.047363,462.989471 
-	C1469.047974,454.427795 1469.520630,453.960724 1478.068359,453.954468 
-	C1478.901123,453.953827 1479.733887,453.954285 1481.056519,453.954224 
-M1565.736328,505.723541 
-	C1565.487305,505.144196 1565.238281,504.564850 1565.496216,503.466248 
-	C1563.760132,498.429291 1561.948486,493.416626 1560.317139,488.345947 
-	C1559.387573,485.456665 1557.516846,484.723358 1554.658569,484.758545 
-	C1544.209229,484.887115 1533.703003,485.467896 1523.322632,484.612305 
-	C1514.091919,483.851471 1507.964844,486.032349 1505.962280,495.753571 
-	C1505.711182,496.972717 1504.405029,497.970459 1504.137695,499.191315 
-	C1503.809082,500.691742 1504.058105,502.318695 1504.092773,504.699615 
-	C1504.134399,505.238159 1504.176025,505.776672 1503.603149,506.727448 
-	C1503.186890,509.415497 1502.721680,512.097107 1502.366943,514.793274 
-	C1501.925659,518.146423 1503.362061,519.695740 1506.841187,519.684692 
-	C1525.651733,519.625000 1544.462891,519.687683 1563.273193,519.585327 
-	C1564.591919,519.578186 1567.057495,518.535217 1567.038696,518.049683 
-	C1566.886963,514.141052 1566.266724,510.250580 1565.736328,505.723541 
-M1509.743530,521.520508 
-	C1502.345703,521.553467 1502.345581,521.553467 1502.354492,528.347961 
-	C1502.363037,534.842163 1502.363159,534.845947 1509.599365,534.846924 
-	C1526.879272,534.849304 1544.159302,534.855957 1561.439209,534.843323 
-	C1567.550659,534.838806 1567.709106,534.648743 1567.715576,528.243896 
-	C1567.722046,521.823608 1567.489990,521.534119 1561.532837,521.527222 
-	C1544.585205,521.507507 1527.637573,521.520935 1509.743530,521.520508 
-M1523.500244,536.801086 
-	C1518.173584,536.801331 1512.819946,537.137512 1507.527832,536.709839 
-	C1501.937134,536.257935 1502.316406,539.643188 1502.314331,543.326294 
-	C1502.312134,547.006958 1501.942261,550.109680 1507.499878,550.020996 
-	C1525.805542,549.729004 1544.120850,549.751648 1562.427612,550.009521 
-	C1567.804077,550.085266 1567.785767,547.176636 1567.773193,543.348145 
-	C1567.760742,539.554810 1567.881714,536.557373 1562.449585,536.697571 
-	C1549.807251,537.023682 1537.150879,536.801147 1523.500244,536.801086 
-z"/>
-<path fill="#FEFEFF" opacity="1.000000" stroke="none" 
-	d="
-M844.027649,708.277954 
-	C841.858826,708.696228 840.048950,708.993713 838.238892,708.994995 
-	C799.748901,709.022034 761.258850,709.018921 722.768860,709.013184 
-	C715.513062,709.012085 714.983704,708.493774 714.982727,701.426025 
-	C714.977417,662.436157 714.977295,623.446289 714.982239,584.456421 
-	C714.983032,578.025391 715.973450,577.015564 722.563232,577.012573 
-	C761.219849,576.995361 799.876526,576.994690 838.533142,577.013916 
-	C845.040466,577.017151 846.019531,578.042847 846.020569,584.559143 
-	C846.027039,623.549011 846.050110,662.539001 845.954224,701.528625 
-	C845.948914,703.693420 844.932373,705.855713 844.027649,708.277954 
-M753.174377,663.440857 
-	C755.131897,663.484802 757.232971,664.014282 759.021057,663.485413 
-	C765.471497,661.578003 770.199036,664.040161 771.169189,670.679626 
-	C771.717224,674.430054 773.449036,675.927734 777.024475,675.815369 
-	C779.018677,675.752747 781.015686,675.737305 783.010864,675.755188 
-	C785.984863,675.781921 787.364502,674.445312 787.920654,671.397827 
-	C789.339905,663.621460 793.402710,661.389404 800.910645,663.776917 
-	C802.146606,664.169983 804.269226,664.941467 804.603210,664.498474 
-	C807.068054,661.229492 809.594238,657.869202 811.157715,654.141907 
-	C811.627686,653.021667 809.400391,650.347595 807.906067,648.906738 
-	C803.824768,644.971619 803.470093,639.144653 808.147522,635.922607 
-	C812.919189,632.635681 811.418762,629.495178 809.254761,625.852112 
-	C807.100098,622.224854 805.378052,618.661682 799.744812,621.168701 
-	C794.150818,623.658264 788.767578,620.590454 788.230469,614.638672 
-	C787.668701,608.413635 783.639709,608.765137 779.433044,608.745178 
-	C775.301880,608.725586 771.606934,608.738159 771.033936,614.562988 
-	C770.451355,620.485596 765.244019,623.131897 759.476135,621.324829 
-	C757.785339,620.795105 754.938538,619.791138 754.401001,620.452026 
-	C751.821960,623.622620 749.440002,627.123657 747.929443,630.885376 
-	C747.499512,631.956055 750.015320,634.524353 751.560730,636.010132 
-	C755.122009,639.434082 755.576172,645.669800 751.569275,648.418823 
-	C746.673462,651.777527 747.336243,655.169067 750.152466,659.187317 
-	C751.011292,660.412720 751.859314,661.645691 753.174377,663.440857 
-z"/>
-<path fill="#FEFEFF" opacity="1.000000" stroke="none" 
-	d="
-M1054.980469,298.000000 
-	C1054.980713,284.002289 1054.970337,270.504578 1054.986084,257.006866 
-	C1054.992798,251.330856 1056.080933,250.036926 1061.511353,250.030670 
-	C1101.171265,249.984924 1140.831299,250.023849 1180.491211,249.979630 
-	C1184.598022,249.975052 1186.050537,251.923996 1186.045532,255.837143 
-	C1185.994751,295.996918 1185.994141,336.156830 1186.045288,376.316620 
-	C1186.050415,380.347046 1184.309692,382.025482 1180.324463,382.021240 
-	C1140.497925,381.979065 1100.671143,381.964569 1060.844849,382.040955 
-	C1056.118530,382.050018 1054.919922,379.730194 1054.935303,375.486786 
-	C1055.028564,349.824829 1054.980957,324.162323 1054.980469,298.000000 
-M1129.604004,340.451630 
-	C1132.536011,336.681274 1136.078613,334.017700 1140.933228,336.537476 
-	C1146.619751,339.489044 1148.145752,335.221649 1150.308594,331.760254 
-	C1152.463379,328.311798 1153.848877,325.325134 1149.424683,322.063080 
-	C1144.281006,318.270447 1144.620728,312.785187 1149.406982,308.446777 
-	C1150.690674,307.283264 1152.810669,305.184753 1152.475708,304.408447 
-	C1150.854858,300.649475 1148.878662,296.893280 1146.233521,293.820221 
-	C1145.464478,292.926880 1142.017334,294.103912 1139.886841,294.668152 
-	C1135.902344,295.723389 1130.569092,293.236267 1129.515869,289.622375 
-	C1127.172729,281.580933 1126.478882,281.255432 1117.959595,281.767792 
-	C1114.311523,281.987213 1112.736816,283.393158 1112.170166,287.043884 
-	C1111.136353,293.701874 1106.275757,296.668182 1100.092407,294.031464 
-	C1094.548340,291.667450 1093.030640,295.463837 1091.019653,298.792389 
-	C1089.036011,302.075378 1086.937866,305.141510 1091.632446,308.511017 
-	C1096.816772,312.232208 1096.895630,318.344574 1091.836792,322.035370 
-	C1087.405884,325.268066 1088.758301,328.285706 1090.895508,331.702789 
-	C1093.042480,335.135162 1094.487427,339.219421 1100.306274,336.623260 
-	C1106.153320,334.014557 1110.923340,337.157410 1112.262085,343.371796 
-	C1112.622070,345.042358 1113.443726,347.837646 1114.342041,347.957672 
-	C1118.395020,348.499237 1122.690552,348.874939 1126.596436,347.984406 
-	C1127.986328,347.667511 1128.520630,343.598297 1129.604004,340.451630 
-z"/>
-<path fill="#FEFEFF" opacity="1.000000" stroke="none" 
-	d="
-M463.283417,324.261261 
-	C462.978119,322.930511 462.978363,321.889740 462.914856,320.463867 
-	C463.233795,318.546600 463.892303,317.024170 463.946442,315.480530 
-	C464.098053,311.156433 463.974518,306.823395 464.006958,302.494263 
-	C464.049805,296.776855 465.745239,295.024963 471.415100,295.022186 
-	C510.379639,295.003052 549.344177,295.005585 588.308716,295.017059 
-	C594.314331,295.018829 595.997009,296.695190 595.999817,302.713745 
-	C596.015564,336.682831 596.008118,370.651917 596.008057,404.621002 
-	C596.008057,409.782959 596.054810,414.945496 595.990540,420.106659 
-	C595.924805,425.386810 594.402039,426.995514 589.147888,427.000275 
-	C549.683777,427.035858 510.219666,427.038300 470.755646,426.997223 
-	C465.288574,426.991547 464.012604,425.288605 464.007904,418.399200 
-	C463.987854,388.926025 464.006226,359.452850 463.981232,329.979675 
-	C463.979675,328.170105 463.725555,326.360748 463.283417,324.261261 
-M507.248230,336.485474 
-	C500.940491,335.902313 501.003387,341.789551 498.615906,345.109375 
-	C496.324249,348.295990 499.151276,349.804352 501.133392,351.521698 
-	C504.806854,354.704712 505.638794,360.765045 502.842682,363.720245 
-	C497.161804,369.724304 497.160583,371.151062 502.157410,377.932495 
-	C503.873596,380.261566 505.480011,381.005127 508.440735,379.972137 
-	C516.115417,377.294403 519.948975,379.491638 521.493164,387.346954 
-	C522.081787,390.340942 523.402588,391.772858 526.404602,391.741791 
-	C528.567810,391.719421 530.732239,391.737732 532.895142,391.782928 
-	C536.035950,391.848572 537.572937,390.576447 538.161987,387.237183 
-	C539.506531,379.616364 543.686035,377.477142 551.351868,379.864532 
-	C552.565613,380.242615 554.677551,380.847992 555.035034,380.362366 
-	C557.468750,377.056488 559.963318,373.655151 561.474121,369.897064 
-	C561.916504,368.796600 559.453186,366.219635 557.937256,364.703918 
-	C554.698730,361.465881 554.198975,355.805237 557.166016,352.795441 
-	C562.693115,347.188629 562.651245,346.137878 557.914978,339.245850 
-	C556.018555,336.486237 554.199768,335.684052 550.871948,336.910187 
-	C543.758057,339.531403 539.514343,337.049316 538.161926,329.497803 
-	C537.572327,326.205841 536.107361,324.821228 532.930664,324.883575 
-	C530.769104,324.925995 528.606201,324.938080 526.444275,324.922058 
-	C523.451965,324.899902 522.113953,326.327606 521.511780,329.319702 
-	C519.874695,337.453979 516.123047,339.399780 507.248230,336.485474 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1494.000244,380.971985 
-	C1488.000488,380.971527 1482.500366,381.014709 1477.001221,380.958832 
-	C1471.091309,380.898804 1469.050293,379.002625 1469.044922,373.264282 
-	C1469.007935,334.099762 1469.038086,294.935120 1469.009277,255.770538 
-	C1469.005981,251.217392 1471.117065,249.016830 1475.668823,249.018265 
-	C1515.166748,249.030594 1554.664673,249.009247 1594.162598,249.045792 
-	C1599.184204,249.050430 1600.947510,251.232986 1600.957397,257.256561 
-	C1600.989868,277.088776 1600.972168,296.921112 1600.972412,316.753387 
-	C1600.972656,334.752441 1600.976440,352.751465 1600.968262,370.750519 
-	C1600.964233,379.718628 1599.675293,380.970520 1590.494995,380.971130 
-	C1558.496704,380.973145 1526.498413,380.971954 1494.000244,380.971985 
-M1555.112183,327.272736 
-	C1556.077515,327.829803 1557.042725,328.386871 1558.676758,328.750031 
-	C1570.394531,323.398132 1571.847412,311.825897 1561.914795,303.933899 
-	C1560.669312,302.944214 1559.810303,301.121216 1559.373657,299.520233 
-	C1557.464233,292.521820 1552.205078,288.142517 1545.153442,288.993958 
-	C1541.561890,289.427551 1538.160767,291.437103 1534.263062,292.887024 
-	C1534.181763,292.839752 1533.613892,292.508240 1533.044922,292.178528 
-	C1521.812134,285.670532 1508.960938,288.837219 1503.398193,299.483612 
-	C1497.833618,310.133057 1502.396729,322.607697 1514.005615,328.206085 
-	C1514.394897,328.393799 1515.338135,327.432861 1516.711182,326.970795 
-	C1517.170410,326.980194 1517.629639,326.989624 1518.148071,327.752899 
-	C1519.449341,328.439392 1520.981079,328.889587 1521.990967,329.874786 
-	C1523.138428,330.993896 1524.897339,333.233459 1524.517822,333.870697 
-	C1522.796265,336.761627 1523.507935,338.548065 1526.145630,340.016998 
-	C1528.876221,341.537659 1531.525391,343.744629 1534.244263,339.636078 
-	C1534.728638,338.904236 1537.729858,338.917694 1538.808472,339.672974 
-	C1541.954590,341.876221 1548.804932,341.101959 1548.303711,338.467133 
-	C1547.100952,332.143524 1550.889526,330.027649 1555.112183,327.272736 
-z"/>
-<path fill="#FEFEFF" opacity="1.000000" stroke="none" 
-	d="
-M835.000000,63.000000 
-	C835.000000,90.653053 835.006226,117.806099 834.995728,144.959152 
-	C834.992981,152.034882 833.246765,153.928070 826.190613,153.936798 
-	C788.376282,153.983536 750.561768,153.995605 712.747498,153.928787 
-	C704.385498,153.914017 702.993835,152.309525 702.993469,143.865479 
-	C702.991699,106.051086 702.989807,68.236687 702.995117,30.422295 
-	C702.996155,22.753660 704.707703,21.023134 712.323181,21.021654 
-	C750.137573,21.014309 787.951965,21.013836 825.766357,21.022299 
-	C833.312683,21.023987 834.993286,22.768200 834.998291,30.516169 
-	C835.005188,41.177441 835.000000,51.838722 835.000000,63.000000 
-M792.354065,64.125351 
-	C791.248291,64.491455 790.143494,64.860512 789.036560,65.223152 
-	C782.813904,67.261864 777.815674,64.731552 777.184082,58.387043 
-	C776.586426,52.383011 772.680969,52.762859 768.677002,52.762016 
-	C764.680786,52.761177 760.745422,52.372864 760.081604,58.322411 
-	C759.370667,64.694572 754.430725,67.192284 748.228394,65.254448 
-	C746.571350,64.736732 743.744263,63.905720 743.193481,64.599411 
-	C740.647705,67.805595 738.227051,71.323074 736.858948,75.124001 
-	C736.445374,76.273163 739.433289,78.813179 741.083923,80.500031 
-	C743.604431,83.075981 743.996826,89.188469 741.615784,91.696243 
-	C735.823303,97.796989 735.883606,98.925079 740.859924,105.892334 
-	C742.777100,108.576462 744.619446,108.889809 747.575134,107.820427 
-	C754.607117,105.276260 758.799805,107.822136 760.373230,115.124817 
-	C760.644836,116.385429 761.110168,118.561562 761.707092,118.640358 
-	C765.759766,119.175331 769.925598,119.708717 773.932678,119.226807 
-	C775.180054,119.076805 776.486755,115.899200 777.004333,113.909393 
-	C778.215271,109.253510 782.816528,105.795433 787.036621,106.850960 
-	C794.869995,108.810242 795.508972,108.388992 799.277039,101.044838 
-	C800.894226,97.892891 800.750671,95.825600 797.793579,93.440300 
-	C792.209290,88.935829 792.470825,84.027420 797.743347,79.096375 
-	C798.993225,77.927452 800.638916,75.382011 800.168274,74.487473 
-	C798.222534,70.789192 795.533997,67.481682 792.354065,64.125351 
-z"/>
-<path fill="#FEFEFF" opacity="1.000000" stroke="none" 
-	d="
-M464.002136,28.434586 
-	C464.151306,22.943775 466.982727,20.999464 471.766663,21.003138 
-	C510.578308,21.032942 549.389954,21.002491 588.201599,21.039339 
-	C593.908508,21.044756 595.985474,23.167023 595.990112,28.946672 
-	C596.021606,68.258011 596.017639,107.569397 595.990417,146.880737 
-	C595.986755,152.161713 593.819153,153.945892 587.520874,153.949799 
-	C556.538208,153.969025 525.555481,153.958893 494.572815,153.959000 
-	C487.243591,153.959015 479.914246,153.980972 472.585144,153.951706 
-	C465.924469,153.925110 464.010406,152.020294 464.007751,145.318939 
-	C463.992401,106.507347 464.000488,67.695747 464.002136,28.434586 
-M543.639648,65.149765 
-	C540.435364,63.944199 538.284363,61.891628 538.225830,58.242733 
-	C538.127380,52.109257 533.591125,52.826599 529.681213,52.773483 
-	C525.597229,52.717999 521.807800,52.675568 521.195984,58.548084 
-	C520.565918,64.596054 515.545654,67.121826 509.637756,65.312477 
-	C507.957550,64.797905 505.122711,63.877991 504.573395,64.559456 
-	C502.007416,67.742729 499.644165,71.258064 498.150391,75.027977 
-	C497.735107,76.076019 500.372711,78.577644 501.913879,80.105637 
-	C505.013336,83.178665 505.409882,89.169945 502.483521,92.020439 
-	C496.862640,97.495590 496.905762,97.824524 501.272736,104.678574 
-	C503.298553,107.858170 505.309906,109.312553 509.371246,107.689957 
-	C515.717346,105.154526 520.184937,107.911507 521.382324,114.822838 
-	C521.967407,118.200119 523.372681,119.925797 526.868408,119.790558 
-	C528.862854,119.713409 530.863281,119.750992 532.860168,119.785759 
-	C535.973877,119.839973 537.561157,118.637444 538.156738,115.272423 
-	C539.518066,107.581253 543.713379,105.262230 551.278687,107.963936 
-	C554.220947,109.014671 556.012268,108.494492 557.489014,105.929466 
-	C558.484314,104.200714 559.549316,102.511841 560.594482,100.812141 
-	C562.339600,97.974167 562.022583,95.871124 559.207275,93.588013 
-	C553.551514,89.001495 553.492249,83.777969 559.080505,79.254257 
-	C562.090881,76.817368 562.285706,74.568329 560.447998,71.596260 
-	C559.573303,70.181625 558.705383,68.760551 557.897034,67.307556 
-	C556.276550,64.394936 554.227112,63.513615 550.897705,64.875267 
-	C548.929993,65.680023 546.515015,65.391068 543.639648,65.149765 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1538.961426,168.986542 
-	C1539.664307,170.529816 1539.923218,172.094284 1540.182129,173.658768 
-	C1539.500610,173.685089 1538.819092,173.711426 1538.137573,173.737747 
-	C1538.264160,172.161087 1538.390869,170.584412 1538.961426,168.986542 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M158.716797,683.722656 
-	C158.915878,702.679993 158.940170,721.311829 158.996231,739.943542 
-	C159.001694,741.758057 159.203354,743.572083 159.606003,745.677734 
-	C159.928009,747.041016 159.957947,748.112854 160.007095,749.585693 
-	C159.678284,751.699646 159.036118,753.411194 159.027969,755.125854 
-	C158.950287,771.455200 158.994598,787.785034 158.972153,804.114746 
-	C158.962463,811.158752 157.176849,812.943542 150.106796,812.946106 
-	C111.948593,812.959839 73.790382,812.961365 35.632195,812.943176 
-	C29.129232,812.940063 28.053234,812.135620 27.975441,806.085571 
-	C27.596657,776.626770 27.253418,747.166748 27.111935,717.706116 
-	C27.060894,707.077820 27.608028,696.446716 27.803457,685.383972 
-	C29.733162,683.638000 31.735123,681.190979 33.750999,681.179443 
-	C73.268845,680.953674 112.788437,680.975098 152.307098,681.112671 
-	C154.390976,681.119873 156.469711,682.601685 158.716797,683.722656 
-M124.846886,764.403625 
-	C124.850945,763.525513 124.854996,762.647461 125.220474,761.066528 
-	C125.094589,757.208313 124.968704,753.350159 124.797134,748.829224 
-	C124.532562,748.226746 124.267990,747.624207 124.594460,746.529175 
-	C128.563385,737.677734 126.307297,733.896118 117.057808,733.896057 
-	C100.468109,733.895996 83.877724,733.823547 67.289558,733.983154 
-	C65.103218,734.004150 61.104153,735.102600 61.057892,735.885864 
-	C60.835293,739.654541 58.281551,744.156555 62.729122,747.634216 
-	C62.484394,748.130554 62.239666,748.626831 61.496731,749.654724 
-	C61.395737,753.667053 61.294739,757.679443 61.254055,762.279236 
-	C61.175819,763.202454 61.097580,764.125732 60.711521,765.768433 
-	C60.637371,767.422546 60.504074,769.076538 60.499413,770.730835 
-	C60.480209,777.548401 60.529034,777.594482 67.493889,777.597473 
-	C84.771019,777.604858 102.049103,777.685791 119.324059,777.491882 
-	C121.495453,777.467468 123.650299,775.968994 126.353790,774.712219 
-	C126.110298,771.757629 125.866806,768.803101 125.302948,765.406433 
-	C125.211090,765.249390 125.119232,765.092285 124.846886,764.403625 
-M85.500076,731.905151 
-	C96.807152,731.905151 108.114464,731.948792 119.421181,731.884949 
-	C124.311951,731.857361 125.052383,730.657471 123.137039,726.131592 
-	C121.711830,722.763977 120.002579,719.510132 118.704025,716.097473 
-	C117.600197,713.196411 115.874161,712.067444 112.703323,712.125977 
-	C102.896118,712.307129 93.083435,712.191406 83.272873,712.191284 
-	C67.986099,712.191101 68.034531,712.209717 62.578568,726.552002 
-	C61.196678,730.184631 61.952595,731.954773 66.043159,731.917847 
-	C72.195038,731.862305 78.347801,731.904419 85.500076,731.905151 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M142.850006,390.484497 
-	C141.334045,391.417053 139.589218,391.999969 137.844391,392.582916 
-	C137.710754,392.013336 137.577118,391.443756 137.443481,390.874176 
-	C139.169357,390.627777 140.895248,390.381348 142.850006,390.484497 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M131.601700,389.504700 
-	C130.619171,388.918243 129.972702,388.499451 129.326248,388.080688 
-	C129.366196,387.764038 129.406143,387.447418 129.446106,387.130768 
-	C130.612732,387.274628 131.779358,387.418488 132.946014,387.562317 
-	C132.609940,388.265686 132.273849,388.969055 131.601700,389.504700 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M346.710358,199.566574 
-	C346.281830,200.435135 345.532562,200.967712 344.783325,201.500275 
-	C344.486694,201.026215 344.190033,200.552155 343.893372,200.078094 
-	C344.725464,199.795609 345.557556,199.513092 346.710358,199.566574 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1083.715332,540.062988 
-	C1082.941528,544.813599 1079.769043,543.692871 1076.517212,543.528015 
-	C1076.419067,541.787292 1076.330811,540.224243 1076.162109,537.231934 
-	C1079.136963,538.211487 1081.374634,538.948242 1083.715332,540.062988 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M572.133545,456.625122 
-	C572.770325,457.561005 573.218445,458.815125 573.666565,460.069275 
-	C573.092651,460.183838 572.518738,460.298401 571.944824,460.412964 
-	C571.944824,459.256409 571.944824,458.099884 572.133545,456.625122 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1162.055908,715.277466 
-	C1163.211182,714.847351 1164.014648,714.346436 1165.397705,713.484253 
-	C1165.397705,715.463196 1165.397705,717.046265 1165.397705,719.468018 
-	C1162.272583,718.073669 1159.667603,716.911438 1157.062744,715.749268 
-	C1157.244263,715.221375 1157.425659,714.693420 1157.607056,714.165527 
-	C1158.972778,714.512512 1160.338501,714.859558 1162.055908,715.277466 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1178.253540,549.598999 
-	C1175.289795,549.605042 1172.678833,549.351135 1169.466797,549.038696 
-	C1169.045532,546.514832 1167.255005,543.241028 1170.001831,541.422791 
-	C1172.732300,543.572876 1174.876953,545.162720 1176.893066,546.901428 
-	C1177.622559,547.530518 1178.044312,548.516113 1178.253540,549.598999 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1162.431274,545.653442 
-	C1160.409912,544.673523 1158.714844,543.904968 1157.019653,543.136475 
-	C1157.087891,542.724609 1157.156128,542.312805 1157.224365,541.900940 
-	C1159.733032,541.900940 1162.241699,541.900940 1165.644897,541.900940 
-	C1165.728271,543.365112 1165.858398,545.651123 1165.988525,547.937195 
-	C1165.493164,548.276306 1164.997803,548.615356 1164.502441,548.954468 
-	C1163.920776,547.924622 1163.339111,546.894775 1162.431274,545.653442 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1152.263306,409.861633 
-	C1150.832764,411.027283 1149.387695,411.766724 1147.942627,412.506195 
-	C1147.700195,411.345947 1147.457642,410.185699 1147.215088,409.025421 
-	C1148.892944,409.162109 1150.570801,409.298767 1152.263306,409.861633 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1141.949463,407.942078 
-	C1141.615112,408.463257 1140.902710,408.924500 1140.190308,409.385773 
-	C1140.010742,409.036255 1139.831055,408.686737 1139.651367,408.337219 
-	C1140.291382,408.185547 1140.931396,408.033844 1141.949463,407.942078 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M267.778992,755.098755 
-	C268.253082,755.971497 268.257111,756.752930 268.261108,757.534302 
-	C267.364502,757.302490 266.467865,757.070740 265.571228,756.838989 
-	C266.150421,756.228455 266.729645,755.617920 267.778992,755.098755 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M279.291626,751.154541 
-	C280.062714,750.965088 280.521057,751.165100 280.979401,751.365112 
-	C280.766663,751.700806 280.446411,752.350159 280.359009,752.320251 
-	C279.867950,752.151917 279.432983,751.820068 279.291626,751.154541 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M339.414612,235.741867 
-	C338.958496,235.427322 338.753754,235.207932 338.260315,234.973602 
-	C336.343536,228.317215 337.271240,226.741196 342.648621,227.798584 
-	C343.026764,229.729340 343.105804,231.442078 343.177338,233.584656 
-	C342.960266,234.287476 342.750671,234.560455 342.410767,235.056229 
-	C341.434753,235.440979 340.588989,235.602921 339.414612,235.741867 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M753.812866,327.186310 
-	C755.329407,326.183441 756.756287,325.614685 758.183167,325.045929 
-	C758.623657,326.997498 759.439819,328.970154 759.332092,330.890961 
-	C759.284546,331.737854 757.360413,332.479492 756.288269,333.268951 
-	C755.422607,331.876862 754.509460,330.510773 753.723572,329.075012 
-	C753.519348,328.701874 753.712524,328.111176 753.812866,327.186310 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M749.926697,330.093445 
-	C747.393066,328.894958 745.076355,327.519226 742.569946,326.030853 
-	C746.534302,324.270538 750.234131,325.624939 750.649658,329.150024 
-	C750.445862,329.696991 750.294739,329.806610 749.926697,330.093445 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M785.343262,420.370697 
-	C786.739746,420.359528 787.753296,420.652710 788.766907,420.945892 
-	C788.492188,421.548218 788.217407,422.150543 787.942688,422.752838 
-	C786.948608,422.060242 785.954468,421.367645 785.343262,420.370697 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M139.334106,842.593140 
-	C139.417892,841.202026 139.585983,840.181519 139.754074,839.160950 
-	C140.154984,839.080872 140.555893,839.000793 140.956802,838.920776 
-	C141.258743,840.166077 141.560699,841.411438 141.862640,842.656799 
-	C141.047882,842.759094 140.233139,842.861328 139.334106,842.593140 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1066.013672,767.091675 
-	C1066.928223,768.061279 1068.041016,768.937622 1067.939331,769.637329 
-	C1067.541260,772.375427 1067.280273,775.393127 1065.862427,777.594482 
-	C1065.300781,778.466370 1060.545654,778.203857 1059.982422,777.190002 
-	C1058.715210,774.908447 1058.005615,771.600281 1058.669800,769.142517 
-	C1059.518677,766.001404 1062.650879,765.636719 1066.013672,767.091675 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1113.450684,633.991150 
-	C1113.950562,634.529907 1114.002075,635.119141 1114.053467,635.708435 
-	C1113.475830,635.635071 1112.898193,635.561707 1112.320557,635.488342 
-	C1112.547852,635.006165 1112.775146,634.523926 1113.450684,633.991150 
-z"/>
-<path fill="#FDFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1472.675659,680.168457 
-	C1514.020630,680.003174 1555.041748,679.999756 1596.531372,679.997925 
-	C1598.315186,682.499939 1600.760742,684.993347 1600.776245,687.501770 
-	C1601.017822,726.468933 1600.988159,765.438171 1600.833252,804.406189 
-	C1600.824219,806.660339 1599.207275,808.908081 1598.147949,811.442261 
-	C1580.478760,811.798340 1563.000244,811.906799 1545.521851,811.934387 
-	C1522.711670,811.970337 1499.900269,812.047974 1477.092896,811.795898 
-	C1474.505981,811.767273 1471.941040,809.728943 1469.205811,808.303162 
-	C1469.046143,767.966064 1468.986206,727.947937 1469.188354,687.931213 
-	C1469.201172,685.392334 1471.250000,682.863708 1472.675659,680.168457 
-M1503.452515,748.553772 
-	C1503.357178,752.614441 1503.261841,756.675171 1503.280029,761.358154 
-	C1503.540527,761.934570 1503.801025,762.510986 1503.339478,763.441650 
-	C1502.886841,766.244690 1502.435181,769.047974 1501.981445,771.850830 
-	C1501.470581,775.006287 1502.858276,776.461243 1506.006714,776.458435 
-	C1525.245483,776.441528 1544.484375,776.479797 1563.722290,776.353027 
-	C1564.951416,776.344910 1567.247681,775.060364 1567.221436,774.447693 
-	C1567.060669,770.692200 1566.373169,766.959229 1565.923218,762.493835 
-	C1565.955200,762.011169 1565.987183,761.528564 1566.620239,760.578918 
-	C1568.201782,756.322083 1568.838013,752.114502 1565.805176,747.557129 
-	C1565.544189,747.066040 1565.283203,746.575012 1565.725220,745.817383 
-	C1569.397583,742.584717 1567.743286,738.397034 1567.073608,734.778137 
-	C1566.889526,733.783386 1562.942505,732.969238 1560.714722,732.950378 
-	C1543.290283,732.802307 1525.863159,732.800659 1508.438843,732.961243 
-	C1506.449463,732.979614 1502.727783,734.410522 1502.769897,734.959290 
-	C1503.057251,738.704163 1499.858032,743.345703 1504.755127,746.595215 
-	C1504.512207,747.087097 1504.269287,747.578918 1503.452515,748.553772 
-M1507.098633,719.514465 
-	C1506.164917,721.647766 1505.280762,723.804504 1504.285522,725.908752 
-	C1502.850098,728.944763 1503.506714,730.866272 1507.091553,730.875793 
-	C1525.558472,730.924744 1544.025635,730.916809 1562.492798,730.871521 
-	C1565.577515,730.864014 1566.786621,729.307861 1565.483398,726.321228 
-	C1563.820190,722.509827 1561.902832,718.797302 1560.453979,714.908386 
-	C1559.330933,711.893677 1557.472534,711.005737 1554.393311,711.042358 
-	C1542.748901,711.180786 1531.082642,711.500732 1519.463745,710.939941 
-	C1512.987061,710.627319 1508.953613,712.399414 1507.098633,719.514465 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M368.585938,173.491455 
-	C368.730255,174.532166 369.045013,175.358948 368.762024,175.814041 
-	C367.897797,177.203949 366.803558,178.450836 365.798798,179.753357 
-	C364.941528,178.898071 363.367249,178.039383 363.371307,177.188202 
-	C363.380646,175.215866 364.153198,173.247162 364.616333,171.276978 
-	C365.905212,171.887161 367.194092,172.497360 368.585938,173.491455 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M352.760681,173.620667 
-	C352.417236,172.758911 352.565338,171.961670 352.713501,171.164429 
-	C353.418396,171.423065 354.123322,171.681702 354.828217,171.940338 
-	C354.302887,172.521942 353.777588,173.103546 352.760681,173.620667 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M99.295471,622.054382 
-	C99.055084,622.816101 98.692726,623.190918 98.330368,623.565735 
-	C98.135986,623.171875 97.696114,622.519531 97.790558,622.429871 
-	C98.159882,622.079224 98.698074,621.906372 99.295471,622.054382 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1563.317627,842.870850 
-	C1561.512451,842.070557 1560.114136,841.212585 1558.715698,840.354553 
-	C1560.044067,839.548340 1561.286133,838.351807 1562.722656,838.033936 
-	C1564.551025,837.629333 1566.536743,837.935852 1569.715088,837.935852 
-	C1567.076416,840.084167 1565.400513,841.448730 1563.317627,842.870850 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1580.294434,837.628845 
-	C1581.158691,839.261536 1581.646118,841.068604 1582.407715,843.891846 
-	C1577.725830,842.058044 1577.530884,840.242737 1580.294434,837.628845 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1557.780762,611.467590 
-	C1559.578125,611.712341 1560.938354,611.900452 1563.060913,612.193970 
-	C1561.138916,613.240112 1559.959839,614.084412 1558.646362,614.547974 
-	C1556.809204,615.196411 1554.884277,615.647827 1552.959839,615.927673 
-	C1552.740234,615.959534 1552.281860,614.348755 1551.934082,613.499756 
-	C1553.737305,612.803467 1555.540527,612.107239 1557.780762,611.467590 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1084.686646,513.899048 
-	C1085.397217,514.871399 1086.155396,515.719360 1085.986816,516.296631 
-	C1085.414917,518.254639 1084.515015,520.116821 1083.740601,522.015686 
-	C1082.776123,521.152039 1081.075928,520.355164 1080.990234,519.411621 
-	C1080.767090,516.954956 1079.500000,513.383484 1084.686646,513.899048 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M771.629883,301.880066 
-	C771.427551,302.397614 771.225220,302.915161 770.997253,303.711731 
-	C769.546936,304.094330 768.122131,304.197937 766.697388,304.301514 
-	C766.569885,302.258728 766.198303,300.178009 766.505188,298.202728 
-	C766.572815,297.767883 769.048645,297.707184 770.717285,297.734497 
-	C771.127014,298.541779 771.234802,299.088806 771.442505,300.169220 
-	C771.571472,301.095123 771.600708,301.487579 771.629883,301.880066 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M757.725586,298.183289 
-	C756.482971,298.914612 755.216553,299.193237 753.950134,299.471893 
-	C753.847778,298.891479 753.745422,298.311035 753.643066,297.730621 
-	C754.995972,297.730621 756.348938,297.730621 757.725586,298.183289 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M898.577271,104.701378 
-	C895.059692,103.525970 893.635010,99.473190 895.662842,97.203712 
-	C896.215027,96.585663 897.436279,96.105690 898.201965,96.267021 
-	C898.969788,96.428795 900.149963,97.511696 900.108215,98.119385 
-	C899.959167,100.289825 899.367798,102.429924 898.577271,104.701378 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M883.825562,98.658218 
-	C883.491821,97.799995 883.643188,96.999374 883.794556,96.198761 
-	C884.486145,96.454506 885.177795,96.710243 885.869385,96.965988 
-	C885.349854,97.549278 884.830261,98.132553 883.825562,98.658218 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1270.846924,218.850052 
-	C1272.760010,218.232529 1274.607666,218.073410 1276.929932,217.873398 
-	C1273.976440,222.255051 1273.886230,222.267517 1270.846924,218.850052 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M73.596436,597.550354 
-	C75.798752,597.619263 77.564796,597.745178 80.148109,597.929382 
-	C78.065086,599.309753 76.587036,600.289246 75.042549,601.604614 
-	C74.345261,602.074890 73.606018,602.487000 73.104126,602.291016 
-	C71.660980,601.727783 70.313782,600.918701 68.928879,600.206238 
-	C70.339317,599.339966 71.749748,598.473694 73.596436,597.550354 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M109.265457,176.184357 
-	C111.744926,176.173569 113.842949,176.306808 116.159691,176.453949 
-	C116.159691,178.714081 116.159691,180.988083 116.159691,184.553879 
-	C112.963432,183.791977 110.098900,183.109146 107.234375,182.426315 
-	C107.784248,180.393677 108.334129,178.361038 109.265457,176.184357 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1316.595459,218.235016 
-	C1314.849487,219.334778 1313.044189,220.323456 1311.112427,220.804092 
-	C1310.274902,221.012451 1308.418823,220.300919 1308.333130,219.788559 
-	C1308.018433,217.906738 1308.072998,215.900360 1308.417480,214.019424 
-	C1308.494629,213.598434 1310.353638,213.185349 1311.318115,213.316071 
-	C1312.993042,213.543060 1314.609863,214.196976 1316.545654,214.973602 
-	C1316.721802,216.156158 1316.603271,217.037003 1316.595459,218.235016 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1324.692627,220.327469 
-	C1322.752808,220.416794 1321.181396,220.192139 1319.609863,219.967484 
-	C1319.706177,219.509598 1319.802368,219.051712 1319.898682,218.593826 
-	C1324.569824,217.421249 1324.614746,217.433594 1324.692627,220.327469 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M254.405182,375.532654 
-	C255.388702,373.456299 256.431030,371.758636 257.473328,370.060974 
-	C258.263184,371.834473 259.475311,373.562195 259.674591,375.399750 
-	C259.783264,376.401642 258.174591,377.589783 257.340454,378.693909 
-	C256.381622,377.766388 255.422791,376.838898 254.405182,375.532654 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M812.755615,297.255127 
-	C815.590332,296.373657 817.101562,297.367249 817.103271,300.095337 
-	C817.104797,302.445404 817.623352,305.260925 813.402710,305.202332 
-	C812.832031,302.633026 812.682190,300.110321 812.755615,297.255127 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M799.897949,297.314514 
-	C801.197998,297.162292 802.125061,297.339203 803.052063,297.516113 
-	C802.848938,298.101715 802.645813,298.687286 802.442627,299.272888 
-	C801.470093,298.729828 800.497498,298.186737 799.897949,297.314514 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M395.477783,231.518555 
-	C397.232819,232.316666 398.639496,232.940903 400.046143,233.565140 
-	C399.971802,234.057617 399.897430,234.550079 399.823090,235.042557 
-	C398.603729,235.097565 397.022949,235.673279 396.225830,235.119980 
-	C392.168732,232.303894 386.497711,238.234863 382.593964,232.963715 
-	C386.249023,232.022614 389.333374,231.228455 392.417755,230.434296 
-	C392.319794,229.939285 392.221832,229.444275 392.123871,228.949280 
-	C393.125702,229.747726 394.127533,230.546188 395.477783,231.518555 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M950.538025,76.454178 
-	C944.942139,72.038651 944.963562,71.138344 950.644775,67.774002 
-	C951.046021,70.675087 951.044434,73.530525 950.538025,76.454178 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M963.699097,68.247551 
-	C964.150635,69.113029 964.151794,69.875084 964.152893,70.637131 
-	C963.289612,70.407745 962.426392,70.178368 961.563110,69.949005 
-	C962.125000,69.347382 962.686829,68.745750 963.699097,68.247551 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M56.831001,839.032349 
-	C58.286175,839.157654 59.388332,839.157654 61.558834,839.157654 
-	C58.833309,840.985107 57.160412,842.488281 55.200512,843.288513 
-	C53.867138,843.832825 52.093983,843.576111 50.602146,843.267761 
-	C50.215405,843.187866 49.694199,841.026672 50.016014,840.758301 
-	C51.010563,839.928833 52.343575,839.421143 53.620541,839.043335 
-	C54.508728,838.780579 55.521088,838.937561 56.831001,839.032349 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1144.790405,744.643188 
-	C1143.777466,744.119873 1143.244995,743.546387 1142.712402,742.972900 
-	C1143.400391,742.703308 1144.088257,742.433777 1144.776245,742.164307 
-	C1144.941040,742.973877 1145.105835,743.783508 1144.790405,744.643188 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M792.906616,185.247803 
-	C791.041748,183.902924 788.930420,182.706848 788.392151,181.011429 
-	C788.084473,180.042007 790.083740,177.737244 791.530212,177.036148 
-	C792.423096,176.603409 794.975342,177.695938 795.477905,178.734863 
-	C796.680969,181.221954 796.664917,183.923767 792.906616,185.247803 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M783.612610,391.610718 
-	C784.332642,394.790497 784.638306,398.124359 784.467346,401.500671 
-	C781.010376,398.503876 780.522949,395.262512 783.612610,391.610718 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M309.062866,372.745178 
-	C311.380280,374.379059 313.514374,375.658295 315.648499,376.937561 
-	C315.536285,377.380096 315.424072,377.822632 315.311890,378.265167 
-	C312.479584,378.140778 309.647247,378.016418 306.003998,377.856445 
-	C305.890930,376.298798 305.595398,374.250610 305.670074,372.216003 
-	C305.698120,371.452026 306.585938,370.719604 307.081757,369.972778 
-	C307.681061,370.778687 308.280334,371.584625 309.062866,372.745178 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M379.379822,229.286469 
-	C380.662994,233.878433 376.208954,233.291946 374.422211,235.097763 
-	C374.109314,235.414047 372.148010,234.898727 372.014557,234.450150 
-	C371.524200,232.802078 370.911530,230.845825 371.377228,229.320816 
-	C372.938843,224.206940 375.794312,229.534790 378.318176,228.668152 
-	C378.815094,228.755066 378.972992,228.910583 379.379822,229.286469 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M745.235229,388.659973 
-	C746.066956,389.885437 746.513428,390.953522 746.959961,392.021637 
-	C744.639954,392.791901 742.319946,393.562195 739.389648,394.535095 
-	C739.389648,391.848785 739.389648,390.300201 739.389648,388.251099 
-	C741.341431,388.341003 743.095703,388.421783 745.235229,388.659973 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1143.768555,515.321655 
-	C1144.017700,516.378052 1144.357666,517.153015 1144.121826,517.660461 
-	C1143.429932,519.148865 1142.567261,520.574768 1141.581909,521.882202 
-	C1141.490234,522.004028 1139.367310,521.130188 1139.354858,520.685913 
-	C1139.293823,518.502686 1139.627441,516.308411 1139.821777,514.118042 
-	C1141.079956,514.384705 1142.338013,514.651367 1143.768555,515.321655 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M825.754028,297.149597 
-	C828.497314,296.560089 830.149170,297.381531 830.083618,300.169189 
-	C830.028687,302.504730 830.603821,305.322510 826.390625,305.277771 
-	C825.812195,302.642365 825.658264,300.054321 825.754028,297.149597 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M924.945496,73.857834 
-	C923.624756,67.669785 925.538696,63.933517 929.708984,64.661743 
-	C931.549011,64.983063 934.276733,67.032387 934.447388,68.540825 
-	C934.718079,70.934593 933.891907,74.271362 932.235962,75.864517 
-	C929.979126,78.035843 927.008911,76.943329 924.945496,73.857834 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M516.000122,689.302124 
-	C516.176025,693.676025 514.917603,696.827637 510.385437,696.657776 
-	C506.438293,696.509888 504.918945,693.355103 505.520172,690.022400 
-	C505.883423,688.008728 507.697723,685.357117 509.487854,684.698303 
-	C512.666199,683.528809 515.177734,685.355652 516.000122,689.302124 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M548.042603,482.971985 
-	C546.954773,481.870941 546.313171,480.741974 545.671631,479.613007 
-	C547.115051,478.891510 548.558472,478.170013 550.815735,477.041748 
-	C550.510864,480.072540 552.983948,482.850952 548.042603,482.971985 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M486.726501,458.776794 
-	C487.155426,459.432617 487.162567,460.094421 487.169708,460.756256 
-	C485.599335,460.559357 484.028992,460.362488 482.458618,460.165588 
-	C482.437103,459.876953 482.415588,459.588287 482.394043,459.299652 
-	C483.697632,459.127350 485.001190,458.955078 486.726501,458.776794 
-z"/>
-<path fill="#686D74" opacity="1.000000" stroke="none" 
-	d="
-M771.997070,301.918243 
-	C771.600708,301.487579 771.571472,301.095123 771.585327,300.409851 
-	C772.347107,300.473114 773.065857,300.829163 773.806030,301.515381 
-	C773.339722,301.882507 772.851929,301.919464 771.997070,301.918243 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1508.104736,191.778641 
-	C1507.068237,192.337799 1505.935059,192.539444 1504.801758,192.741104 
-	C1504.741577,192.186127 1504.681396,191.631149 1504.621216,191.076187 
-	C1505.750244,191.191162 1506.879150,191.306152 1508.104736,191.778641 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M745.652527,738.730713 
-	C743.430481,738.865295 741.504395,738.686523 739.578369,738.507812 
-	C739.696045,737.894836 739.813721,737.281921 739.931396,736.668945 
-	C741.937073,737.251770 743.942810,737.834534 745.652527,738.730713 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M788.696960,202.931061 
-	C789.495056,204.425674 789.870544,205.894073 790.312134,207.621124 
-	C788.339172,207.621124 786.899475,207.621124 785.277588,207.621124 
-	C783.932434,204.508881 784.167297,202.533691 788.696960,202.931061 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1055.354370,751.156067 
-	C1054.403320,748.440735 1053.855225,745.509460 1053.636963,742.227173 
-	C1054.744751,742.943848 1056.036255,743.945129 1056.184937,745.094177 
-	C1056.430298,746.992615 1055.938354,748.986511 1055.354370,751.156067 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M748.770874,420.041199 
-	C749.630493,420.784363 750.606873,421.544342 750.489258,422.049622 
-	C749.978149,424.245056 749.148254,426.366241 748.434143,428.514404 
-	C747.454346,427.823212 745.779236,427.259705 745.624451,426.416992 
-	C745.150330,423.835480 744.076660,420.620819 748.770874,420.041199 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1092.625977,749.982910 
-	C1092.114990,748.898193 1091.524536,747.977356 1091.745850,747.336609 
-	C1092.371704,745.522949 1093.329834,743.823975 1094.157227,742.079834 
-	C1095.126709,743.501465 1096.719360,744.839050 1096.924927,746.363647 
-	C1097.263062,748.871704 1096.984009,751.797913 1092.625977,749.982910 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M294.686096,339.237457 
-	C295.780975,338.814270 296.787781,338.344177 297.335022,338.662933 
-	C298.780853,339.505188 300.027527,340.689362 301.353455,341.737488 
-	C299.841156,342.673981 298.406006,344.043335 296.778473,344.333435 
-	C296.129456,344.449127 294.997955,342.216492 294.215027,340.971741 
-	C294.017883,340.658264 294.317291,340.032440 294.686096,339.237457 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1076.264648,713.911255 
-	C1076.036987,710.461182 1078.039673,710.211060 1080.128540,710.709839 
-	C1081.412354,711.016296 1082.807373,711.838867 1083.567139,712.863647 
-	C1083.861450,713.260681 1082.490845,715.768311 1081.965942,715.739197 
-	C1080.049927,715.632935 1078.170898,714.862305 1076.264648,713.911255 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1292.283081,185.749542 
-	C1292.683228,186.879120 1293.172852,187.802551 1292.927734,188.446075 
-	C1292.250854,190.222839 1291.266846,191.882629 1290.404297,193.588684 
-	C1289.402466,191.983444 1287.693848,190.434464 1287.560547,188.760101 
-	C1287.348633,186.098114 1288.477905,183.753159 1292.283081,185.749542 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M908.463135,103.908592 
-	C908.117432,101.829788 908.075378,99.958679 908.094849,97.689247 
-	C909.585693,97.207352 912.207336,96.856804 912.257751,97.082001 
-	C912.703430,99.072548 912.971191,101.213593 912.627380,103.194893 
-	C912.537964,103.709824 910.116882,103.820129 908.463135,103.908592 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M293.292938,728.345581 
-	C291.207489,728.801331 289.467621,728.992065 287.385925,729.220337 
-	C287.385925,727.091797 287.385925,725.526428 287.385925,723.997131 
-	C293.324036,722.909668 294.423889,723.658997 293.292938,728.345581 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1134.441406,776.234619 
-	C1133.076294,777.135132 1131.814941,777.672485 1130.553589,778.209839 
-	C1130.159546,776.204895 1129.468872,774.191467 1129.525391,772.199219 
-	C1129.546387,771.458557 1131.316650,770.767456 1132.289185,770.053772 
-	C1133.087402,771.332275 1133.980957,772.564514 1134.635620,773.912720 
-	C1134.886353,774.429260 1134.591431,775.210754 1134.441406,776.234619 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1182.094360,521.132019 
-	C1180.489990,520.888672 1178.084351,520.438110 1178.009277,519.737610 
-	C1177.803223,517.815857 1178.576172,515.789124 1178.961670,513.803894 
-	C1180.218994,514.380615 1182.269409,514.700317 1182.558228,515.591003 
-	C1183.062012,517.145752 1182.482056,519.051941 1182.094360,521.132019 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1068.517822,635.187134 
-	C1069.191772,636.618958 1069.971191,638.854797 1069.648438,639.027283 
-	C1067.901733,639.960144 1065.882446,640.382324 1063.357666,641.166748 
-	C1063.199219,638.671143 1063.099609,637.102966 1062.968506,635.038757 
-	C1064.923584,635.038757 1066.519165,635.038757 1068.517822,635.187134 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1117.866577,547.674011 
-	C1117.752319,546.609131 1117.505981,545.856201 1117.745605,545.320557 
-	C1118.356323,543.955017 1119.183716,542.686340 1119.924316,541.378906 
-	C1120.900269,542.055176 1122.665649,542.692932 1122.700928,543.415100 
-	C1122.797974,545.402588 1122.170044,547.425415 1121.829102,549.434204 
-	C1120.537964,548.984436 1119.246948,548.534668 1117.866577,547.674011 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1078.077148,490.080200 
-	C1078.883179,488.249084 1079.693848,486.821075 1080.504517,485.393066 
-	C1081.466309,486.118286 1083.189087,486.794159 1083.239868,487.578430 
-	C1083.366943,489.538300 1083.433594,492.478302 1082.269165,493.352203 
-	C1079.429321,495.483307 1078.386597,493.112061 1078.077148,490.080200 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1350.202515,192.578506 
-	C1346.435913,191.653870 1346.044800,188.041260 1349.592041,184.826294 
-	C1350.149292,187.382919 1350.255005,189.767975 1350.202515,192.578506 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1089.604980,178.424652 
-	C1088.980225,180.632660 1088.503052,182.707199 1087.294800,184.183365 
-	C1086.850464,184.726257 1084.021484,184.326172 1083.445068,183.521667 
-	C1082.519775,182.230026 1081.994019,180.126724 1082.314209,178.575851 
-	C1083.013428,175.188126 1086.116211,175.047195 1089.604980,178.424652 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1124.299805,404.313538 
-	C1125.242432,406.358459 1126.430054,408.349396 1126.155151,410.112366 
-	C1125.987671,411.186310 1123.566650,411.908905 1122.157959,412.789368 
-	C1121.506958,411.657684 1120.306641,410.519928 1120.319092,409.395630 
-	C1120.345093,407.051880 1118.664551,403.044250 1124.299805,404.313538 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M731.574219,297.404724 
-	C730.459290,298.501740 729.062378,299.269592 727.665466,300.037476 
-	C727.424744,299.386658 727.183960,298.735840 726.943237,298.085022 
-	C728.392883,297.748535 729.842529,297.412048 731.574219,297.404724 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M944.658020,96.203506 
-	C945.665039,96.739227 946.204468,97.356934 946.743896,97.974640 
-	C945.886841,98.156769 945.029785,98.338913 944.172729,98.521057 
-	C944.178650,97.775871 944.184509,97.030693 944.658020,96.203506 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1272.384399,164.714813 
-	C1271.963501,162.849457 1271.960938,161.164001 1271.962402,158.973206 
-	C1275.012329,160.170670 1278.057983,161.873505 1281.103638,163.576324 
-	C1281.039429,164.015793 1280.975220,164.455246 1280.911011,164.894714 
-	C1278.208252,164.894714 1275.505371,164.894714 1272.384399,164.714813 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1283.836060,156.754028 
-	C1284.662720,158.506577 1285.365479,160.550659 1286.050781,163.064423 
-	C1283.064819,161.761154 1280.096436,159.988205 1275.908936,157.487061 
-	C1279.381958,157.290573 1281.547119,157.168076 1283.836060,156.754028 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1115.696533,745.213745 
-	C1117.040039,743.920288 1118.333130,743.046509 1119.625977,742.172729 
-	C1120.241089,744.046326 1121.331421,745.932068 1121.283691,747.788574 
-	C1121.257324,748.817261 1119.327881,749.796997 1118.256104,750.798706 
-	C1117.385986,749.076965 1116.515991,747.355164 1115.696533,745.213745 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M305.182434,201.373505 
-	C306.560364,200.421875 307.852356,199.865372 309.144379,199.308868 
-	C309.548706,201.279160 310.262085,203.257004 310.214264,205.216263 
-	C310.193390,206.070068 308.611237,206.885742 307.738190,207.718750 
-	C306.833435,206.389160 305.841888,205.107285 305.070923,203.704193 
-	C304.800598,203.212219 305.072327,202.422424 305.182434,201.373505 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1154.409302,773.290405 
-	C1155.758301,771.964111 1157.043823,771.020386 1158.329468,770.076660 
-	C1158.993408,771.111328 1160.253784,772.183594 1160.191528,773.172546 
-	C1160.077271,774.986023 1159.593262,777.964417 1158.541138,778.320068 
-	C1154.501221,779.685669 1154.590332,776.327942 1154.409302,773.290405 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M505.967682,722.464966 
-	C505.810577,721.409058 505.498535,720.610779 505.760162,720.115479 
-	C506.522217,718.672852 507.513702,717.351440 508.415192,715.982483 
-	C509.422516,716.652405 511.286377,717.330933 511.279785,717.990601 
-	C511.258209,720.142151 510.554016,722.286926 510.112396,724.434265 
-	C508.766541,723.909851 507.420715,723.385376 505.967682,722.464966 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M503.175720,724.127197 
-	C502.023590,723.602783 500.157623,722.701233 500.150208,721.784668 
-	C500.133026,719.658630 498.369324,716.550049 502.642151,715.827087 
-	C503.131073,718.579224 503.218658,721.161255 503.175720,724.127197 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1051.026367,518.035278 
-	C1052.050415,516.213074 1053.082275,514.793518 1054.114014,513.373901 
-	C1055.074097,514.668152 1056.781982,515.950867 1056.802246,517.259705 
-	C1056.826782,518.846191 1055.425415,520.454834 1054.641113,522.053894 
-	C1053.438721,520.848572 1052.236450,519.643250 1051.026367,518.035278 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M760.850830,394.308472 
-	C760.953796,395.375610 761.227478,396.183746 760.946045,396.671844 
-	C760.133179,398.081848 759.096741,399.362946 758.148193,400.694672 
-	C757.189636,399.932312 755.466980,399.210632 755.423828,398.399536 
-	C755.317993,396.412292 755.987305,394.383789 756.344666,392.371887 
-	C757.819092,392.882355 759.293457,393.392792 760.850830,394.308472 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1083.710449,743.601929 
-	C1083.954346,744.639648 1084.299683,745.405090 1084.079102,745.934692 
-	C1083.385498,747.598938 1082.545898,749.219910 1081.536865,750.704041 
-	C1081.449463,750.832581 1078.949829,749.942993 1078.858032,749.332581 
-	C1078.554077,747.313660 1078.632080,745.155701 1079.107544,743.182251 
-	C1079.185791,742.857300 1082.002075,743.191956 1083.710449,743.601929 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M969.170166,104.816574 
-	C968.286438,104.383209 967.316711,103.970367 967.338562,103.619110 
-	C967.488525,101.203949 967.845886,98.801636 968.136475,96.395172 
-	C969.502563,96.855171 971.793091,97.008904 972.065552,97.831238 
-	C972.969666,100.560265 973.803894,103.779037 969.170166,104.816574 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1052.168945,490.084351 
-	C1053.045410,488.257782 1053.808716,486.717224 1054.921875,485.495422 
-	C1055.124634,485.272827 1057.508057,486.248169 1057.590454,486.848145 
-	C1057.869751,488.882629 1057.731201,491.025513 1057.372681,493.060089 
-	C1057.284424,493.560486 1055.281982,494.344940 1054.973999,494.073792 
-	C1053.854492,493.087982 1053.080322,491.709900 1052.168945,490.084351 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M502.018402,181.867371 
-	C502.264984,182.227310 502.159729,182.589676 502.054443,182.952042 
-	C501.925140,182.591293 501.795837,182.230545 502.018402,181.867371 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1122.527588,715.039307 
-	C1122.838989,717.098389 1122.841309,718.950623 1122.767334,721.192627 
-	C1121.280518,721.625061 1118.697876,721.918274 1118.645020,721.670715 
-	C1118.224243,719.702454 1118.019775,717.582520 1118.382935,715.626892 
-	C1118.473145,715.141418 1120.877686,715.085632 1122.527588,715.039307 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1032.470459,521.922729 
-	C1031.779663,519.668335 1031.500122,517.459961 1031.312744,514.877930 
-	C1032.966919,514.927246 1035.795166,515.196472 1035.868652,515.800232 
-	C1036.163452,518.228882 1037.621338,521.804565 1032.470459,521.922729 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M577.395752,695.992737 
-	C577.035950,693.863647 576.980713,691.918396 576.995544,689.558044 
-	C578.491516,689.085999 581.093140,688.751587 581.155640,689.016602 
-	C581.617981,690.975281 581.892517,693.117493 581.502014,695.056152 
-	C581.380310,695.660339 579.030273,695.815735 577.395752,695.992737 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1511.909058,58.012409 
-	C1515.067017,56.470234 1517.814331,54.730930 1520.810913,53.960079 
-	C1524.135742,53.104813 1525.083618,51.597347 1524.638062,48.293983 
-	C1524.458374,46.962585 1525.740967,45.433945 1526.358154,43.995060 
-	C1526.881348,45.351093 1527.977661,46.778164 1527.820068,48.049870 
-	C1527.346558,51.871510 1528.979736,53.283554 1532.522949,54.175011 
-	C1535.503906,54.925007 1538.550415,56.376823 1540.930786,58.304798 
-	C1543.822144,60.646740 1545.708984,60.388618 1548.156372,57.887871 
-	C1549.042603,56.982502 1550.876953,57.005085 1552.278564,56.604233 
-	C1551.660645,57.906025 1551.386841,59.833118 1550.362549,60.396858 
-	C1546.734619,62.393501 1546.512451,64.603981 1548.346924,68.130280 
-	C1549.605957,70.550255 1550.380493,73.591614 1550.231567,76.292389 
-	C1549.976074,80.925507 1552.097046,82.512383 1556.203735,82.913391 
-	C1557.267578,83.017288 1558.254639,83.908234 1559.276978,84.437637 
-	C1559.169189,84.861977 1559.061523,85.286308 1558.953735,85.710640 
-	C1557.647461,85.710640 1556.162842,86.117111 1555.067383,85.636497 
-	C1551.366089,84.012505 1549.319824,85.169212 1547.511230,88.662857 
-	C1546.104126,91.381233 1544.037231,93.949219 1541.718994,95.954193 
-	C1539.078247,98.238167 1538.513916,100.172951 1540.368408,103.201332 
-	C1541.100220,104.396263 1540.761841,106.246643 1540.910889,107.798538 
-	C1539.813232,106.815132 1538.117554,106.023331 1537.729736,104.812553 
-	C1536.548462,101.124825 1534.486816,100.482635 1530.888916,101.260429 
-	C1528.047607,101.874680 1524.852661,101.953102 1522.036133,101.305725 
-	C1518.451172,100.481750 1516.367065,101.035599 1515.090088,104.679268 
-	C1514.657837,105.912720 1513.071411,106.741676 1512.012451,107.755463 
-	C1512.138184,106.185860 1511.745117,104.286018 1512.492432,103.112213 
-	C1514.317627,100.245499 1513.706665,98.539238 1511.258301,96.362396 
-	C1508.829590,94.202972 1506.694336,91.489082 1505.140503,88.632141 
-	C1503.523926,85.659782 1501.934082,84.222382 1498.485229,85.575752 
-	C1497.079834,86.127289 1495.400635,85.980949 1493.845947,86.152130 
-	C1493.637207,85.543709 1493.428345,84.935295 1493.219604,84.326874 
-	C1494.888062,83.627365 1496.502563,82.572891 1498.237305,82.308823 
-	C1501.070435,81.877548 1501.991577,80.575577 1502.302246,77.733360 
-	C1502.711060,73.992882 1503.598877,70.207146 1504.948730,66.697845 
-	C1506.040527,63.859489 1505.283447,62.477673 1503.021606,60.945827 
-	C1501.652222,60.018349 1500.733154,58.426163 1500.071411,56.682911 
-	C1504.516357,55.932915 1506.842651,63.818882 1511.909058,58.012409 
-M1545.511475,78.259743 
-	C1544.874390,74.888771 1544.237427,71.517799 1543.333618,66.735527 
-	C1539.497559,70.392578 1537.044312,72.731293 1534.591064,75.070000 
-	C1534.682251,75.610130 1534.773438,76.150269 1534.864624,76.690399 
-	C1538.255981,77.430473 1541.647339,78.170547 1545.511475,78.259743 
-M1540.375732,90.952927 
-	C1541.699585,88.979904 1543.023438,87.006882 1544.850952,84.283226 
-	C1540.321167,83.667122 1536.882446,83.199402 1532.355225,82.583656 
-	C1533.623657,86.102959 1534.510742,88.356537 1535.247437,90.658287 
-	C1536.291626,93.920853 1537.926392,93.399063 1540.375732,90.952927 
-M1517.815552,67.735680 
-	C1519.141113,68.490631 1520.466553,69.245583 1522.807251,70.578773 
-	C1523.146240,66.030708 1523.402588,62.592377 1523.768677,57.680103 
-	C1519.424072,59.913132 1516.185913,61.577427 1512.336426,63.555950 
-	C1514.643311,65.325920 1515.936523,66.318245 1517.815552,67.735680 
-M1508.119873,71.043442 
-	C1507.686035,73.649521 1507.252197,76.255600 1506.649048,79.878883 
-	C1511.099854,78.449532 1514.260986,77.434334 1518.834229,75.965622 
-	C1515.518555,72.947479 1513.446777,70.886276 1511.139526,69.135429 
-	C1510.757935,68.845871 1509.345947,69.914162 1508.119873,71.043442 
-M1527.042603,87.437065 
-	C1521.866577,88.103256 1522.588013,92.868919 1519.999146,96.490562 
-	C1524.599976,96.490562 1528.145386,96.490562 1532.432983,96.490562 
-	C1530.502197,93.080864 1529.044312,90.506363 1527.042603,87.437065 
-M1535.413940,60.868107 
-	C1533.311157,60.175087 1531.208252,59.482063 1528.345947,58.538723 
-	C1528.761230,62.845154 1529.089600,66.251122 1529.540771,70.930328 
-	C1533.529419,68.140503 1536.277710,66.218178 1539.429810,64.013474 
-	C1537.997070,62.858891 1537.014526,62.067173 1535.413940,60.868107 
-M1515.484619,93.097412 
-	C1516.889160,90.080147 1518.293823,87.062881 1520.390747,82.558357 
-	C1515.293823,83.349342 1511.907227,83.874901 1506.983154,84.639061 
-	C1510.195801,88.147545 1512.459229,90.619576 1515.484619,93.097412 
-M1525.687988,74.846886 
-	C1524.896973,76.197929 1523.863281,77.486320 1523.486816,78.944389 
-	C1523.393555,79.305664 1525.401367,80.655205 1526.498535,80.728882 
-	C1527.292603,80.782219 1529.001709,79.201889 1528.876465,78.828369 
-	C1528.395386,77.393860 1527.339111,76.152184 1525.687988,74.846886 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M90.000122,325.862152 
-	C83.681473,325.862427 77.862221,325.913147 72.044220,325.849518 
-	C65.713310,325.780304 63.758289,323.245453 65.050667,316.963562 
-	C67.019623,307.393066 74.691292,301.070068 84.549469,300.964569 
-	C89.702568,300.909393 94.857613,300.896851 100.010292,300.969910 
-	C110.089180,301.112762 118.177475,308.315369 119.467056,318.209076 
-	C120.132568,323.314880 118.129829,325.769104 112.943283,325.836212 
-	C105.463356,325.933044 97.981255,325.861755 90.000122,325.862152 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M108.190590,273.019531 
-	C111.621071,283.737366 107.091400,292.893494 97.442993,295.414093 
-	C88.430084,297.768707 79.405777,292.133759 77.377609,282.884918 
-	C75.739677,275.415619 79.953217,267.678925 87.269295,264.722229 
-	C95.211510,261.512543 102.902115,264.457489 108.190590,273.019531 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M111.682045,472.097504 
-	C115.689705,471.517151 117.665077,473.086060 118.862587,476.430634 
-	C120.092422,479.865509 121.792473,483.133850 123.320518,486.459564 
-	C124.936890,489.977539 124.055206,491.914032 119.969315,491.913483 
-	C101.999481,491.911133 84.029655,491.906982 66.059822,491.915680 
-	C62.021309,491.917633 61.208801,490.129425 62.601421,486.485901 
-	C68.093750,472.116333 68.043449,472.097107 83.270119,472.097137 
-	C92.587822,472.097168 101.905533,472.097198 111.682045,472.097504 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M123.954102,524.089844 
-	C124.473839,527.848267 125.152428,531.598938 125.337646,535.373779 
-	C125.364639,535.923828 123.038521,537.115540 121.796028,537.122803 
-	C102.639816,537.235413 83.482689,537.180298 64.325905,537.223877 
-	C61.569557,537.230164 60.244778,536.071960 60.507706,533.330750 
-	C60.786156,530.427734 61.181042,527.535889 62.257866,524.416870 
-	C83.311806,524.159668 103.632950,524.124756 123.954102,524.089844 
-M117.808205,532.851624 
-	C118.459114,532.857300 119.229828,533.090027 119.736641,532.822632 
-	C120.882683,532.217896 121.898476,531.366394 122.967232,530.615234 
-	C122.458916,530.073914 121.934013,529.057312 121.445175,529.074341 
-	C119.426735,529.144714 117.419212,529.528381 115.407669,529.796875 
-	C115.939461,530.772461 116.471245,531.747986 117.808205,532.851624 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M124.869080,509.390381 
-	C124.788643,513.473083 124.708206,517.555725 123.853195,521.834717 
-	C102.718430,522.040710 82.358238,522.050476 61.998055,522.060242 
-	C61.828587,517.890076 61.659115,513.719971 62.213707,509.309143 
-	C83.581535,509.175751 104.225304,509.283081 124.869080,509.390381 
-M120.223694,513.186951 
-	C119.569008,513.183533 118.789917,512.949951 118.284721,513.223083 
-	C117.115929,513.854858 116.079742,514.731934 114.989784,515.509583 
-	C115.739937,516.259705 116.491577,517.637390 117.239937,517.635559 
-	C119.069328,517.631226 120.897202,516.989075 122.725693,516.603638 
-	C122.156631,515.511169 121.587570,514.418640 120.223694,513.186951 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M62.968437,507.137451 
-	C60.709156,505.072479 59.267578,496.768066 61.160988,494.994629 
-	C62.068947,494.144226 63.849602,493.935638 65.236816,493.930664 
-	C83.676445,493.864624 102.117607,493.999634 120.555367,493.802185 
-	C124.859695,493.756104 126.345764,495.424225 125.826805,499.370453 
-	C125.513275,501.754547 124.993683,504.111542 123.812599,506.715332 
-	C103.028488,507.012482 82.998466,507.074951 62.968437,507.137451 
-M121.004936,502.652863 
-	C121.583473,501.556458 122.162010,500.460083 122.740555,499.363678 
-	C120.911957,498.982941 119.083839,498.347687 117.254509,498.344208 
-	C116.502945,498.342804 115.748795,499.702942 114.995834,500.443756 
-	C116.081863,501.229736 117.113182,502.115509 118.279526,502.755005 
-	C118.779938,503.029358 119.560966,502.791901 121.004936,502.652863 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M62.854240,507.375824 
-	C82.998466,507.074951 103.028488,507.012482 123.526337,506.968964 
-	C124.260597,507.574402 124.527039,508.160889 124.831284,509.068848 
-	C104.225304,509.283081 83.581535,509.175751 62.470139,509.039490 
-	C62.248360,508.545105 62.494205,508.079651 62.854240,507.375824 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M62.000488,522.407104 
-	C82.358238,522.050476 102.718430,522.040710 123.546127,522.071838 
-	C124.004517,522.552063 123.995384,522.991394 123.970177,523.760254 
-	C103.632950,524.124756 83.311806,524.159668 62.528488,524.167969 
-	C62.045189,523.678833 62.024055,523.216431 62.000488,522.407104 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M58.893120,62.248581 
-	C61.352539,60.588680 63.656078,58.256145 65.998207,58.216732 
-	C84.159317,57.911098 102.328041,58.004440 120.494026,58.073921 
-	C126.152863,58.095562 128.232086,60.272762 128.258286,66.071976 
-	C128.321548,80.071373 128.318954,94.071411 128.260727,108.070847 
-	C128.235382,114.165695 126.283066,116.081978 120.059235,116.066147 
-	C102.228271,116.020782 84.397110,115.929794 66.566956,115.758522 
-	C60.424126,115.699524 58.439472,113.679947 58.456154,107.607941 
-	C58.497334,92.617859 58.648289,77.628082 58.893120,62.248581 
-M78.328194,76.299225 
-	C76.581017,76.008781 74.833847,75.718338 73.086670,75.427895 
-	C73.914505,76.958961 74.458252,78.774254 75.637901,79.953339 
-	C77.335320,81.649933 79.495338,82.883713 81.929939,84.659271 
-	C78.927376,86.933617 76.332008,88.678452 74.045601,90.762276 
-	C73.333153,91.411591 73.456345,92.977768 73.196991,94.124214 
-	C74.260864,94.233238 75.355789,94.542740 76.378242,94.384369 
-	C77.122849,94.269028 77.784203,93.553772 78.461533,93.075996 
-	C91.721863,83.722427 91.605019,85.736748 78.328194,76.299225 
-M104.433899,97.778587 
-	C106.742706,97.732704 109.095573,97.931190 111.339722,97.526634 
-	C112.304642,97.352692 113.044067,95.927841 113.885948,95.071304 
-	C112.943832,94.356842 112.022354,93.058342 111.056190,93.024185 
-	C105.448936,92.825996 99.828033,92.829094 94.219810,93.011658 
-	C93.194878,93.045029 92.207085,94.219330 91.202148,94.866974 
-	C92.157257,95.799637 93.026764,97.403519 94.083618,97.538300 
-	C97.173424,97.932343 100.337936,97.740532 104.433899,97.778587 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1133.911377,105.931648 
-	C1134.865967,111.432014 1135.820435,116.932373 1136.908203,123.200226 
-	C1135.891235,123.611717 1133.996704,124.378365 1131.498779,125.389137 
-	C1129.880005,119.783730 1128.399292,114.656548 1126.918579,109.529358 
-	C1126.449951,109.576622 1125.981201,109.623894 1125.512573,109.671158 
-	C1124.777344,115.071190 1124.041992,120.471230 1123.263794,126.186378 
-	C1121.608643,126.186378 1119.707031,126.186378 1117.252197,126.186378 
-	C1117.711426,119.837471 1118.150146,113.773186 1118.588867,107.708900 
-	C1118.175171,107.678329 1117.761475,107.647766 1117.347778,107.617203 
-	C1114.789185,113.115532 1112.230591,118.613869 1109.486450,124.511185 
-	C1107.750732,123.905952 1105.938477,123.274055 1103.698242,122.492882 
-	C1105.578003,117.554688 1107.341797,112.921242 1109.105469,108.287788 
-	C1108.724365,107.969109 1108.343140,107.650429 1107.962036,107.331749 
-	C1104.313110,110.749779 1100.664185,114.167801 1096.661987,117.916718 
-	C1095.461914,116.980385 1093.939697,115.792686 1091.891846,114.194878 
-	C1095.205933,110.665619 1098.309448,107.360535 1101.413086,104.055450 
-	C1101.141846,103.486076 1100.870605,102.916695 1100.599365,102.347321 
-	C1096.187744,103.889809 1091.776001,105.432289 1086.804932,107.170364 
-	C1086.181030,106.175514 1085.151245,104.533470 1083.787354,102.358589 
-	C1088.923950,99.784943 1093.801636,97.341057 1098.679321,94.897171 
-	C1098.572266,94.563797 1098.465332,94.230423 1098.358276,93.897049 
-	C1092.926270,93.897049 1087.494263,93.897049 1081.391846,93.897049 
-	C1081.171021,92.744057 1080.787598,90.742638 1080.306641,88.231682 
-	C1087.801392,87.553513 1094.666992,86.932243 1102.067993,86.262550 
-	C1101.600464,93.388771 1105.533569,97.967651 1110.270630,101.513466 
-	C1112.938843,103.510651 1116.800903,104.531342 1120.204224,104.747704 
-	C1123.364136,104.948593 1125.371460,105.242088 1125.369873,108.986794 
-	C1126.206909,103.490540 1128.365967,102.118645 1132.700073,104.216583 
-	C1133.043213,103.996689 1132.993774,103.918106 1132.657959,104.242096 
-	C1132.897339,105.063309 1133.472412,105.560539 1134.014893,106.024857 
-	C1133.982056,105.991936 1133.911499,105.931641 1133.911377,105.931648 
-M1101.035400,93.607552 
-	C1100.530518,93.399910 1100.025757,93.192268 1099.520752,92.984604 
-	C1099.384766,93.344810 1099.248657,93.705017 1099.112671,94.065262 
-	C1099.504883,94.110649 1099.896973,94.156036 1101.035400,93.607552 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1108.086426,63.042633 
-	C1107.543457,58.069462 1107.000610,53.096287 1106.364014,47.266037 
-	C1107.224487,46.957790 1109.137573,46.272461 1111.518677,45.419445 
-	C1113.151978,51.105412 1114.635742,56.270416 1116.119507,61.435421 
-	C1116.564453,61.387444 1117.009399,61.339470 1117.454346,61.291496 
-	C1118.170410,55.887314 1118.886353,50.483135 1119.656982,44.666389 
-	C1121.249146,44.666389 1123.269897,44.666389 1125.628784,44.666389 
-	C1125.247437,50.934921 1124.888306,56.840355 1124.529053,62.745789 
-	C1124.791626,62.815235 1125.054199,62.884686 1125.316650,62.954132 
-	C1128.044434,57.564396 1130.772217,52.174656 1133.814697,46.163239 
-	C1135.254517,46.716263 1137.140137,47.440491 1139.519775,48.354439 
-	C1136.750122,54.501518 1134.161255,60.247169 1131.572388,65.992821 
-	C1131.818604,66.066376 1132.064697,66.139923 1132.310791,66.213478 
-	C1136.811768,61.844086 1141.312622,57.474693 1146.222778,52.708080 
-	C1147.520020,53.729111 1149.022583,54.911690 1151.058472,56.514145 
-	C1147.511108,60.206470 1144.224854,63.627018 1140.558594,67.435608 
-	C1140.020386,68.113907 1139.862183,68.404167 1139.455811,68.785477 
-	C1139.072266,69.184944 1138.936890,69.493378 1138.466797,69.942154 
-	C1138.175171,70.480911 1138.218018,70.879326 1138.260986,71.277725 
-	C1138.674316,71.041306 1139.087524,70.804901 1139.715820,70.514587 
-	C1140.190674,70.301109 1140.384888,70.083046 1140.710938,69.783676 
-	C1141.143188,69.616455 1141.307007,69.414764 1141.400146,69.155792 
-	C1146.114136,67.272987 1150.828125,65.390182 1156.052979,63.303341 
-	C1156.786377,64.540985 1157.770020,66.200768 1159.051880,68.363937 
-	C1152.734131,71.408813 1146.707031,74.313667 1140.930542,77.519402 
-	C1141.181274,77.820290 1141.241821,77.750534 1141.241821,77.750549 
-	C1138.944336,75.375404 1136.654053,72.993187 1134.347778,70.626717 
-	C1130.623779,66.805367 1126.147949,65.382050 1120.802368,65.736252 
-	C1119.592163,65.816444 1118.241821,63.780254 1117.361084,63.052887 
-	C1116.595337,64.047707 1115.566040,65.851532 1114.063477,67.073196 
-	C1113.566406,67.477402 1111.849731,66.381676 1110.348877,65.981186 
-	C1110.006958,65.990639 1110.058594,66.058456 1110.151855,65.646332 
-	C1109.806763,65.141273 1109.368530,65.048347 1108.953857,64.984161 
-	C1108.977417,65.012917 1109.015137,65.077103 1109.407471,64.756165 
-	C1109.190308,63.942894 1108.580688,63.450554 1107.997437,62.982784 
-	C1108.023804,63.007355 1108.086426,63.042633 1108.086426,63.042633 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1133.078857,104.026367 
-	C1134.453491,101.353271 1135.312866,98.222160 1137.249878,96.053612 
-	C1139.804199,93.193871 1141.559692,90.388153 1140.429688,84.969391 
-	C1148.142212,86.844101 1154.822144,88.467812 1162.142456,90.247192 
-	C1161.886963,92.026413 1161.618652,93.895584 1161.235718,96.562408 
-	C1155.358032,95.074051 1149.820190,93.671753 1143.562500,92.123795 
-	C1142.253906,92.036308 1141.665161,92.094467 1141.076416,92.152634 
-	C1141.631470,92.534798 1142.186646,92.916969 1142.741699,93.299149 
-	C1147.679199,96.785721 1152.616821,100.272285 1158.034668,104.097992 
-	C1157.082153,105.645981 1156.014893,107.380592 1154.842773,109.285545 
-	C1150.632446,106.734207 1146.805908,104.415459 1142.979492,102.096718 
-	C1142.485718,102.605743 1141.991821,103.114777 1141.498047,103.623802 
-	C1143.989136,107.440552 1146.480225,111.257301 1149.277832,115.543732 
-	C1148.012451,116.591965 1146.436523,117.897385 1144.562988,119.449303 
-	C1141.072021,114.694183 1137.852417,110.308601 1134.272217,105.927322 
-	C1133.911499,105.931641 1133.982056,105.991936 1134.139160,105.710655 
-	C1133.862183,104.925606 1133.427979,104.421844 1132.993774,103.918091 
-	C1132.993774,103.918106 1133.043213,103.996689 1133.078857,104.026367 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1100.669189,77.563721 
-	C1095.610474,74.067787 1090.551758,70.571861 1084.968384,66.713310 
-	C1085.825562,65.156281 1086.791260,63.402290 1087.886963,61.411945 
-	C1092.814941,64.371193 1097.272827,67.048187 1101.719727,69.773788 
-	C1102.229004,69.821457 1102.749390,69.820518 1102.974854,70.112305 
-	C1102.977295,70.614014 1103.274414,70.822983 1103.571533,71.031967 
-	C1103.421265,70.658394 1103.270996,70.284790 1102.997314,69.687225 
-	C1102.582397,69.309067 1102.291016,69.154854 1101.999756,69.000626 
-	C1099.400146,64.474846 1096.800659,59.949078 1093.945801,54.978897 
-	C1094.913330,54.132332 1096.362061,52.864872 1098.274414,51.191772 
-	C1101.488403,55.485580 1104.437378,59.425308 1107.736328,63.203835 
-	C1108.086426,63.042633 1108.023804,63.007355 1107.759155,63.281158 
-	C1108.001343,64.062340 1108.508301,64.569717 1109.015137,65.077103 
-	C1109.015137,65.077103 1108.977417,65.012917 1108.954834,65.337845 
-	C1109.307617,65.794670 1109.683105,65.926575 1110.058594,66.058464 
-	C1110.058594,66.058456 1110.006958,65.990639 1109.988525,65.952255 
-	C1109.140137,67.599213 1108.369385,69.317459 1107.459473,70.958519 
-	C1106.832764,72.088844 1106.124023,73.214424 1105.252808,74.158318 
-	C1104.072510,75.436974 1102.701416,76.539680 1101.062256,77.615326 
-	C1100.712402,77.512787 1100.669189,77.563736 1100.669189,77.563721 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1100.689941,77.488052 
-	C1101.331543,79.652603 1101.995605,81.841881 1102.659668,84.031158 
-	C1102.237671,84.535286 1101.815552,85.039413 1101.393433,85.543541 
-	C1094.743896,83.862770 1088.094482,82.181999 1080.808838,80.340454 
-	C1081.052246,78.662979 1081.319458,76.822556 1081.693604,74.244431 
-	C1088.255737,75.758041 1094.428833,77.181908 1100.635498,78.084763 
-	C1100.669189,77.563736 1100.712402,77.512787 1100.689941,77.488052 
-z"/>
-<path fill="#1A1A1A" opacity="1.000000" stroke="none" 
-	d="
-M1141.147217,77.851486 
-	C1147.717651,77.361244 1154.322021,76.839790 1161.462769,76.275986 
-	C1161.804077,77.932610 1162.185669,79.785736 1162.725098,82.404327 
-	C1155.379028,83.088409 1148.444946,83.734131 1140.724976,84.453033 
-	C1140.869507,82.110405 1140.979858,80.318954 1141.166016,78.139023 
-	C1141.241821,77.750534 1141.181274,77.820290 1141.147217,77.851486 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M1504.057495,503.890930 
-	C1504.058105,502.318695 1503.809082,500.691742 1504.137695,499.191315 
-	C1504.405029,497.970459 1505.711182,496.972717 1505.962280,495.753571 
-	C1507.964844,486.032349 1514.091919,483.851471 1523.322632,484.612305 
-	C1533.703003,485.467896 1544.209229,484.887115 1554.658569,484.758545 
-	C1557.516846,484.723358 1559.387573,485.456665 1560.317139,488.345947 
-	C1561.948486,493.416626 1563.760132,498.429291 1564.774780,503.735596 
-	C1544.054688,503.966919 1524.056152,503.928925 1504.057495,503.890930 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1565.789795,506.354553 
-	C1566.266724,510.250580 1566.886963,514.141052 1567.038696,518.049683 
-	C1567.057495,518.535217 1564.591919,519.578186 1563.273193,519.585327 
-	C1544.462891,519.687683 1525.651733,519.625000 1506.841187,519.684692 
-	C1503.362061,519.695740 1501.925659,518.146423 1502.366943,514.793274 
-	C1502.721680,512.097107 1503.186890,509.415497 1504.359619,506.552032 
-	C1525.340698,506.369263 1545.565186,506.361908 1565.789795,506.354553 
-M1560.555298,515.144592 
-	C1561.977539,514.421631 1563.399780,513.698669 1564.822021,512.975647 
-	C1564.037109,512.308167 1563.216797,511.047058 1562.474243,511.091278 
-	C1560.684326,511.197754 1558.930664,511.914856 1557.162476,512.385620 
-	C1558.018799,513.296509 1558.875122,514.207336 1560.555298,515.144592 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1510.216797,521.520874 
-	C1527.637573,521.520935 1544.585205,521.507507 1561.532837,521.527222 
-	C1567.489990,521.534119 1567.722046,521.823608 1567.715576,528.243896 
-	C1567.709106,534.648743 1567.550659,534.838806 1561.439209,534.843323 
-	C1544.159302,534.855957 1526.879272,534.849304 1509.599365,534.846924 
-	C1502.363159,534.845947 1502.363037,534.842163 1502.354492,528.347961 
-	C1502.345581,521.553467 1502.345703,521.553467 1510.216797,521.520874 
-M1563.827393,526.429382 
-	C1562.200684,526.322266 1560.497925,525.890381 1558.979370,526.245605 
-	C1558.223755,526.422424 1557.805786,528.042236 1557.234985,529.009277 
-	C1558.915649,529.403687 1560.644897,530.211731 1562.256714,530.021973 
-	C1563.091431,529.923706 1563.718018,528.057800 1563.827393,526.429382 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1524.000244,536.801025 
-	C1537.150879,536.801147 1549.807251,537.023682 1562.449585,536.697571 
-	C1567.881714,536.557373 1567.760742,539.554810 1567.773193,543.348145 
-	C1567.785767,547.176636 1567.804077,550.085266 1562.427612,550.009521 
-	C1544.120850,549.751648 1525.805542,549.729004 1507.499878,550.020996 
-	C1501.942261,550.109680 1502.312134,547.006958 1502.314331,543.326294 
-	C1502.316406,539.643188 1501.937134,536.257935 1507.527832,536.709839 
-	C1512.819946,537.137512 1518.173584,536.801331 1524.000244,536.801025 
-M1564.995361,543.391418 
-	C1563.300537,539.879700 1560.496704,540.930603 1557.899414,541.848633 
-	C1557.447021,542.008545 1557.444092,543.440674 1557.233521,544.285217 
-	C1559.382446,544.555176 1561.527588,544.872009 1563.684204,545.046448 
-	C1564.022949,545.073853 1564.414062,544.455811 1564.995361,543.391418 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1565.763062,506.039062 
-	C1545.565186,506.361908 1525.340698,506.369263 1504.666870,506.345917 
-	C1504.176025,505.776672 1504.134399,505.238159 1504.075195,504.295288 
-	C1524.056152,503.928925 1544.054688,503.966919 1564.521240,503.995209 
-	C1565.238281,504.564850 1565.487305,505.144196 1565.763062,506.039062 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M752.943298,663.158020 
-	C751.859314,661.645691 751.011292,660.412720 750.152466,659.187317 
-	C747.336243,655.169067 746.673462,651.777527 751.569275,648.418823 
-	C755.576172,645.669800 755.122009,639.434082 751.560730,636.010132 
-	C750.015320,634.524353 747.499512,631.956055 747.929443,630.885376 
-	C749.440002,627.123657 751.821960,623.622620 754.401001,620.452026 
-	C754.938538,619.791138 757.785339,620.795105 759.476135,621.324829 
-	C765.244019,623.131897 770.451355,620.485596 771.033936,614.562988 
-	C771.606934,608.738159 775.301880,608.725586 779.433044,608.745178 
-	C783.639709,608.765137 787.668701,608.413635 788.230469,614.638672 
-	C788.767578,620.590454 794.150818,623.658264 799.744812,621.168701 
-	C805.378052,618.661682 807.100098,622.224854 809.254761,625.852112 
-	C811.418762,629.495178 812.919189,632.635681 808.147522,635.922607 
-	C803.470093,639.144653 803.824768,644.971619 807.906067,648.906738 
-	C809.400391,650.347595 811.627686,653.021667 811.157715,654.141907 
-	C809.594238,657.869202 807.068054,661.229492 804.603210,664.498474 
-	C804.269226,664.941467 802.146606,664.169983 800.910645,663.776917 
-	C793.402710,661.389404 789.339905,663.621460 787.920654,671.397827 
-	C787.364502,674.445312 785.984863,675.781921 783.010864,675.755188 
-	C781.015686,675.737305 779.018677,675.752747 777.024475,675.815369 
-	C773.449036,675.927734 771.717224,674.430054 771.169189,670.679626 
-	C770.199036,664.040161 765.471497,661.578003 759.021057,663.485413 
-	C757.232971,664.014282 755.131897,663.484802 752.943298,663.158020 
-M764.111084,654.291870 
-	C771.568909,662.291016 780.772766,664.172180 789.204834,659.420837 
-	C796.993042,655.032349 800.943359,645.819214 798.454834,637.203369 
-	C796.231567,629.505676 791.058960,624.591431 783.160217,623.179810 
-	C775.072205,621.734314 768.221985,624.485718 763.581299,631.266479 
-	C758.570923,638.587524 758.834961,646.243103 764.111084,654.291870 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M1129.524780,340.846802 
-	C1128.520630,343.598297 1127.986328,347.667511 1126.596436,347.984406 
-	C1122.690552,348.874939 1118.395020,348.499237 1114.342041,347.957672 
-	C1113.443726,347.837646 1112.622070,345.042358 1112.262085,343.371796 
-	C1110.923340,337.157410 1106.153320,334.014557 1100.306274,336.623260 
-	C1094.487427,339.219421 1093.042480,335.135162 1090.895508,331.702789 
-	C1088.758301,328.285706 1087.405884,325.268066 1091.836792,322.035370 
-	C1096.895630,318.344574 1096.816772,312.232208 1091.632446,308.511017 
-	C1086.937866,305.141510 1089.036011,302.075378 1091.019653,298.792389 
-	C1093.030640,295.463837 1094.548340,291.667450 1100.092407,294.031464 
-	C1106.275757,296.668182 1111.136353,293.701874 1112.170166,287.043884 
-	C1112.736816,283.393158 1114.311523,281.987213 1117.959595,281.767792 
-	C1126.478882,281.255432 1127.172729,281.580933 1129.515869,289.622375 
-	C1130.569092,293.236267 1135.902344,295.723389 1139.886841,294.668152 
-	C1142.017334,294.103912 1145.464478,292.926880 1146.233521,293.820221 
-	C1148.878662,296.893280 1150.854858,300.649475 1152.475708,304.408447 
-	C1152.810669,305.184753 1150.690674,307.283264 1149.406982,308.446777 
-	C1144.620728,312.785187 1144.281006,318.270447 1149.424683,322.063080 
-	C1153.848877,325.325134 1152.463379,328.311798 1150.308594,331.760254 
-	C1148.145752,335.221649 1146.619751,339.489044 1140.933228,336.537476 
-	C1136.078613,334.017700 1132.536011,336.681274 1129.524780,340.846802 
-M1105.111206,327.291901 
-	C1112.568481,335.290955 1121.772949,337.172272 1130.204956,332.420837 
-	C1137.993286,328.032104 1141.943115,318.819733 1139.454712,310.203247 
-	C1137.231445,302.505341 1132.058838,297.591553 1124.160034,296.179901 
-	C1116.071899,294.734406 1109.221802,297.485931 1104.581055,304.266571 
-	C1099.570679,311.587616 1099.835205,319.243286 1105.111206,327.291901 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M507.614838,336.622559 
-	C516.123047,339.399780 519.874695,337.453979 521.511780,329.319702 
-	C522.113953,326.327606 523.451965,324.899902 526.444275,324.922058 
-	C528.606201,324.938080 530.769104,324.925995 532.930664,324.883575 
-	C536.107361,324.821228 537.572327,326.205841 538.161926,329.497803 
-	C539.514343,337.049316 543.758057,339.531403 550.871948,336.910187 
-	C554.199768,335.684052 556.018555,336.486237 557.914978,339.245850 
-	C562.651245,346.137878 562.693115,347.188629 557.166016,352.795441 
-	C554.198975,355.805237 554.698730,361.465881 557.937256,364.703918 
-	C559.453186,366.219635 561.916504,368.796600 561.474121,369.897064 
-	C559.963318,373.655151 557.468750,377.056488 555.035034,380.362366 
-	C554.677551,380.847992 552.565613,380.242615 551.351868,379.864532 
-	C543.686035,377.477142 539.506531,379.616364 538.161987,387.237183 
-	C537.572937,390.576447 536.035950,391.848572 532.895142,391.782928 
-	C530.732239,391.737732 528.567810,391.719421 526.404602,391.741791 
-	C523.402588,391.772858 522.081787,390.340942 521.493164,387.346954 
-	C519.948975,379.491638 516.115417,377.294403 508.440735,379.972137 
-	C505.480011,381.005127 503.873596,380.261566 502.157410,377.932495 
-	C497.160583,371.151062 497.161804,369.724304 502.842682,363.720245 
-	C505.638794,360.765045 504.806854,354.704712 501.133392,351.521698 
-	C499.151276,349.804352 496.324249,348.295990 498.615906,345.109375 
-	C501.003387,341.789551 500.940491,335.902313 507.614838,336.622559 
-M516.711060,372.803467 
-	C525.098633,379.292542 534.526062,379.656738 541.875610,373.775574 
-	C549.103455,367.991791 551.528015,358.103363 547.492920,349.979401 
-	C543.830505,342.605743 537.738281,338.743164 529.485535,338.893463 
-	C521.446289,339.039856 515.429688,342.947815 512.164246,350.248077 
-	C508.545593,358.338135 510.134521,365.807434 516.711060,372.803467 
-z"/>
-<path fill="#60707D" opacity="1.000000" stroke="none" 
-	d="
-M1516.023193,327.007324 
-	C1515.338135,327.432861 1514.394897,328.393799 1514.005615,328.206085 
-	C1502.396729,322.607697 1497.833618,310.133057 1503.398193,299.483612 
-	C1508.960938,288.837219 1521.812134,285.670532 1533.044922,292.178528 
-	C1533.613892,292.508240 1534.181763,292.839752 1534.263062,292.887024 
-	C1538.160767,291.437103 1541.561890,289.427551 1545.153442,288.993958 
-	C1552.205078,288.142517 1557.464233,292.521820 1559.373657,299.520233 
-	C1559.810303,301.121216 1560.669312,302.944214 1561.914795,303.933899 
-	C1571.847412,311.825897 1570.394531,323.398132 1558.098267,328.535461 
-	C1556.219482,323.604095 1559.048340,316.484711 1549.714478,316.509216 
-	C1552.858521,312.507141 1551.580688,309.963715 1548.367310,307.696869 
-	C1543.077881,303.965546 1540.985229,303.947144 1535.982178,308.259796 
-	C1533.804321,303.921783 1530.472290,304.111206 1526.846313,306.205383 
-	C1522.989746,308.432739 1519.119629,310.710999 1522.033813,315.745819 
-	C1520.065430,316.907593 1518.439331,317.867401 1516.556396,319.003235 
-	C1516.211060,319.781464 1516.122314,320.383667 1515.903076,321.305359 
-	C1515.856201,323.419037 1515.939697,325.213165 1516.023193,327.007324 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1554.549561,327.192047 
-	C1550.889526,330.027649 1547.100952,332.143524 1548.303711,338.467133 
-	C1548.804932,341.101959 1541.954590,341.876221 1538.808472,339.672974 
-	C1537.729858,338.917694 1534.728638,338.904236 1534.244263,339.636078 
-	C1531.525391,343.744629 1528.876221,341.537659 1526.145630,340.016998 
-	C1523.507935,338.548065 1522.796265,336.761627 1524.517822,333.870697 
-	C1524.897339,333.233459 1523.138428,330.993896 1521.990967,329.874786 
-	C1520.981079,328.889587 1519.449341,328.439392 1518.317871,327.053680 
-	C1519.288208,324.067596 1519.566528,320.280853 1520.990601,319.785034 
-	C1524.735596,318.481049 1525.762817,317.168396 1524.437012,313.299683 
-	C1524.045166,312.156281 1525.883179,309.446533 1527.342285,308.682861 
-	C1529.005493,307.812225 1532.448853,307.418701 1533.263184,308.383698 
-	C1535.997070,311.623291 1537.738281,311.506439 1540.374634,308.403320 
-	C1541.103638,307.545319 1543.779541,307.463623 1544.990479,308.105103 
-	C1546.676880,308.998322 1549.289917,311.619934 1548.973755,312.269867 
-	C1546.228760,317.913269 1549.570679,319.330841 1554.008423,320.079865 
-	C1554.201172,322.612244 1554.375366,324.902130 1554.549561,327.192047 
-M1541.155762,325.330139 
-	C1541.147461,321.663391 1539.374023,319.465149 1535.655151,319.972412 
-	C1532.491577,320.403931 1531.046997,322.893829 1532.003174,325.861786 
-	C1532.470215,327.311951 1534.526611,329.415466 1535.573853,329.260742 
-	C1537.506592,328.975128 1539.225464,327.242981 1541.155762,325.330139 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1554.830811,327.232391 
-	C1554.375366,324.902130 1554.201172,322.612244 1554.008423,320.079865 
-	C1549.570679,319.330841 1546.228760,317.913269 1548.973755,312.269867 
-	C1549.289917,311.619934 1546.676880,308.998322 1544.990479,308.105103 
-	C1543.779541,307.463623 1541.103638,307.545319 1540.374634,308.403320 
-	C1537.738281,311.506439 1535.997070,311.623291 1533.263184,308.383698 
-	C1532.448853,307.418701 1529.005493,307.812225 1527.342285,308.682861 
-	C1525.883179,309.446533 1524.045166,312.156281 1524.437012,313.299683 
-	C1525.762817,317.168396 1524.735596,318.481049 1520.990601,319.785034 
-	C1519.566528,320.280853 1519.288208,324.067596 1518.288330,326.676758 
-	C1517.629639,326.989624 1517.170410,326.980194 1516.367188,326.989075 
-	C1515.939697,325.213165 1515.856201,323.419037 1516.216309,321.295563 
-	C1516.711060,320.253235 1516.762085,319.540253 1516.813232,318.827209 
-	C1518.439331,317.867401 1520.065430,316.907593 1522.033813,315.745819 
-	C1519.119629,310.710999 1522.989746,308.432739 1526.846313,306.205383 
-	C1530.472290,304.111206 1533.804321,303.921783 1535.982178,308.259796 
-	C1540.985229,303.947144 1543.077881,303.965546 1548.367310,307.696869 
-	C1551.580688,309.963715 1552.858521,312.507141 1549.714478,316.509216 
-	C1559.048340,316.484711 1556.219482,323.604095 1557.763916,328.632385 
-	C1557.042725,328.386871 1556.077515,327.829803 1554.830811,327.232391 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M792.736206,64.077980 
-	C795.533997,67.481682 798.222534,70.789192 800.168274,74.487473 
-	C800.638916,75.382011 798.993225,77.927452 797.743347,79.096375 
-	C792.470825,84.027420 792.209290,88.935829 797.793579,93.440300 
-	C800.750671,95.825600 800.894226,97.892891 799.277039,101.044838 
-	C795.508972,108.388992 794.869995,108.810242 787.036621,106.850960 
-	C782.816528,105.795433 778.215271,109.253510 777.004333,113.909393 
-	C776.486755,115.899200 775.180054,119.076805 773.932678,119.226807 
-	C769.925598,119.708717 765.759766,119.175331 761.707092,118.640358 
-	C761.110168,118.561562 760.644836,116.385429 760.373230,115.124817 
-	C758.799805,107.822136 754.607117,105.276260 747.575134,107.820427 
-	C744.619446,108.889809 742.777100,108.576462 740.859924,105.892334 
-	C735.883606,98.925079 735.823303,97.796989 741.615784,91.696243 
-	C743.996826,89.188469 743.604431,83.075981 741.083923,80.500031 
-	C739.433289,78.813179 736.445374,76.273163 736.858948,75.124001 
-	C738.227051,71.323074 740.647705,67.805595 743.193481,64.599411 
-	C743.744263,63.905720 746.571350,64.736732 748.228394,65.254448 
-	C754.430725,67.192284 759.370667,64.694572 760.081604,58.322411 
-	C760.745422,52.372864 764.680786,52.761177 768.677002,52.762016 
-	C772.680969,52.762859 776.586426,52.383011 777.184082,58.387043 
-	C777.815674,64.731552 782.813904,67.261864 789.036560,65.223152 
-	C790.143494,64.860512 791.248291,64.491455 792.736206,64.077980 
-M787.466797,91.546944 
-	C789.632385,79.615250 783.821167,69.762169 773.172913,67.311440 
-	C763.115906,64.996796 752.948303,70.794792 749.951660,80.553261 
-	C746.862488,90.612740 752.149780,101.232719 762.019470,104.792816 
-	C772.372131,108.527115 782.631897,103.453194 787.466797,91.546944 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M543.970398,65.371857 
-	C546.515015,65.391068 548.929993,65.680023 550.897705,64.875267 
-	C554.227112,63.513615 556.276550,64.394936 557.897034,67.307556 
-	C558.705383,68.760551 559.573303,70.181625 560.447998,71.596260 
-	C562.285706,74.568329 562.090881,76.817368 559.080505,79.254257 
-	C553.492249,83.777969 553.551514,89.001495 559.207275,93.588013 
-	C562.022583,95.871124 562.339600,97.974167 560.594482,100.812141 
-	C559.549316,102.511841 558.484314,104.200714 557.489014,105.929466 
-	C556.012268,108.494492 554.220947,109.014671 551.278687,107.963936 
-	C543.713379,105.262230 539.518066,107.581253 538.156738,115.272423 
-	C537.561157,118.637444 535.973877,119.839973 532.860168,119.785759 
-	C530.863281,119.750992 528.862854,119.713409 526.868408,119.790558 
-	C523.372681,119.925797 521.967407,118.200119 521.382324,114.822838 
-	C520.184937,107.911507 515.717346,105.154526 509.371246,107.689957 
-	C505.309906,109.312553 503.298553,107.858170 501.272736,104.678574 
-	C496.905762,97.824524 496.862640,97.495590 502.483521,92.020439 
-	C505.409882,89.169945 505.013336,83.178665 501.913879,80.105637 
-	C500.372711,78.577644 497.735107,76.076019 498.150391,75.027977 
-	C499.644165,71.258064 502.007416,67.742729 504.573395,64.559456 
-	C505.122711,63.877991 507.957550,64.797905 509.637756,65.312477 
-	C515.545654,67.121826 520.565918,64.596054 521.195984,58.548084 
-	C521.807800,52.675568 525.597229,52.717999 529.681213,52.773483 
-	C533.591125,52.826599 538.127380,52.109257 538.225830,58.242733 
-	C538.284363,61.891628 540.435364,63.944199 543.970398,65.371857 
-M514.569824,74.177116 
-	C509.168976,82.291969 508.900604,90.298889 513.790833,97.417007 
-	C518.399963,104.125931 526.514954,107.285408 534.299866,105.401917 
-	C542.453552,103.429207 548.314697,96.830589 549.180969,88.648552 
-	C550.076965,80.185432 545.991333,72.531052 538.629578,68.880714 
-	C530.624329,64.911308 522.226746,66.596840 514.569824,74.177116 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M85.000130,731.905090 
-	C78.347801,731.904419 72.195038,731.862305 66.043159,731.917847 
-	C61.952595,731.954773 61.196678,730.184631 62.578568,726.552002 
-	C68.034531,712.209717 67.986099,712.191101 83.272873,712.191284 
-	C93.083435,712.191406 102.896118,712.307129 112.703323,712.125977 
-	C115.874161,712.067444 117.600197,713.196411 118.704025,716.097473 
-	C120.002579,719.510132 121.711830,722.763977 123.137039,726.131592 
-	C125.052383,730.657471 124.311951,731.857361 119.421181,731.884949 
-	C108.114464,731.948792 96.807152,731.905151 85.000130,731.905090 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M61.193741,761.691772 
-	C61.294739,757.679443 61.395737,753.667053 62.214668,749.412476 
-	C83.569344,749.277466 104.206078,749.384705 124.842812,749.491943 
-	C124.968704,753.350159 125.094589,757.208313 124.583649,761.476318 
-	C116.475296,761.952881 109.003357,762.104492 101.532341,762.067871 
-	C88.085854,762.002014 74.639915,761.823364 61.193741,761.691772 
-M120.323174,753.673401 
-	C119.671440,753.669800 118.925751,753.459839 118.387329,753.705017 
-	C117.228004,754.232910 116.175323,754.994995 115.079025,755.661255 
-	C115.678253,756.348755 116.309349,757.643433 116.870964,757.614014 
-	C118.845734,757.510376 120.796631,756.951721 122.756569,756.565796 
-	C122.234642,755.627258 121.712715,754.688721 120.323174,753.673401 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M62.969494,747.133545 
-	C58.281551,744.156555 60.835293,739.654541 61.057892,735.885864 
-	C61.104153,735.102600 65.103218,734.004150 67.289558,733.983154 
-	C83.877724,733.823547 100.468109,733.895996 117.057808,733.896057 
-	C126.307297,733.896118 128.563385,737.677734 123.831268,746.739136 
-	C103.035210,747.010559 83.002350,747.072021 62.969494,747.133545 
-M116.242020,738.590637 
-	C116.139153,739.793518 116.036285,740.996338 115.933418,742.199219 
-	C117.852036,742.302856 119.788635,742.586121 121.677963,742.396973 
-	C122.221199,742.342590 122.627968,740.925232 123.097290,740.132751 
-	C121.896301,739.491455 120.744194,738.712341 119.475342,738.262512 
-	C118.752266,738.006165 117.838585,738.287476 116.242020,738.590637 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M125.812813,775.153442 
-	C123.650299,775.968994 121.495453,777.467468 119.324059,777.491882 
-	C102.049103,777.685791 84.771019,777.604858 67.493889,777.597473 
-	C60.529034,777.594482 60.480209,777.548401 60.499413,770.730835 
-	C60.504074,769.076538 60.637371,767.422546 61.329521,765.340820 
-	C82.974144,764.920532 104.000763,764.927856 125.027382,764.935181 
-	C125.119232,765.092285 125.211090,765.249390 125.357346,766.085083 
-	C125.545425,769.560242 125.679115,772.356873 125.812813,775.153442 
-M121.921326,769.190308 
-	C120.274040,769.105835 118.562408,768.730530 117.009827,769.074097 
-	C116.350746,769.219849 116.025192,770.872925 115.548050,771.841003 
-	C117.108223,772.193726 118.765381,773.023254 120.194717,772.732544 
-	C121.158524,772.536560 121.800812,770.759644 121.921326,769.190308 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M124.937134,764.669434 
-	C104.000763,764.927856 82.974144,764.920532 61.483433,764.981079 
-	C61.097580,764.125732 61.175819,763.202454 61.223900,761.985474 
-	C74.639915,761.823364 88.085854,762.002014 101.532341,762.067871 
-	C109.003357,762.104492 116.475296,761.952881 124.402931,761.827698 
-	C124.854996,762.647461 124.850945,763.525513 124.937134,764.669434 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M62.849308,747.383850 
-	C83.002350,747.072021 103.035210,747.010559 123.535744,746.985352 
-	C124.267990,747.624207 124.532562,748.226746 124.819977,749.160583 
-	C104.206078,749.384705 83.569344,749.277466 62.463776,749.146667 
-	C62.239666,748.626831 62.484394,748.130554 62.849308,747.383850 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M126.083298,774.932861 
-	C125.679115,772.356873 125.545425,769.560242 125.517517,766.306091 
-	C125.866806,768.803101 126.110298,771.757629 126.083298,774.932861 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1507.253540,719.170715 
-	C1508.953613,712.399414 1512.987061,710.627319 1519.463745,710.939941 
-	C1531.082642,711.500732 1542.748901,711.180786 1554.393311,711.042358 
-	C1557.472534,711.005737 1559.330933,711.893677 1560.453979,714.908386 
-	C1561.902832,718.797302 1563.820190,722.509827 1565.483398,726.321228 
-	C1566.786621,729.307861 1565.577515,730.864014 1562.492798,730.871521 
-	C1544.025635,730.916809 1525.558472,730.924744 1507.091553,730.875793 
-	C1503.506714,730.866272 1502.850098,728.944763 1504.285522,725.908752 
-	C1505.280762,723.804504 1506.164917,721.647766 1507.253540,719.170715 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1565.861328,763.218750 
-	C1566.373169,766.959229 1567.060669,770.692200 1567.221436,774.447693 
-	C1567.247681,775.060364 1564.951416,776.344910 1563.722290,776.353027 
-	C1544.484375,776.479797 1525.245483,776.441528 1506.006714,776.458435 
-	C1502.858276,776.461243 1501.470581,775.006287 1501.981445,771.850830 
-	C1502.435181,769.047974 1502.886841,766.244690 1504.159180,763.340454 
-	C1525.273071,763.232361 1545.567139,763.225525 1565.861328,763.218750 
-M1562.205933,771.901611 
-	C1562.849365,770.727905 1563.492676,769.554138 1564.135986,768.380371 
-	C1562.075317,768.330688 1560.008911,768.190979 1557.960205,768.324341 
-	C1557.637939,768.345276 1557.396240,769.603455 1557.117188,770.289551 
-	C1558.538574,770.836060 1559.960083,771.382507 1562.205933,771.901611 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1504.974243,746.089050 
-	C1499.858032,743.345703 1503.057251,738.704163 1502.769897,734.959290 
-	C1502.727783,734.410522 1506.449463,732.979614 1508.438843,732.961243 
-	C1525.863159,732.800659 1543.290283,732.802307 1560.714722,732.950378 
-	C1562.942505,732.969238 1566.889526,733.783386 1567.073608,734.778137 
-	C1567.743286,738.397034 1569.397583,742.584717 1564.909302,745.872314 
-	C1544.386963,745.981140 1524.680664,746.035095 1504.974243,746.089050 
-M1558.973389,737.323730 
-	C1558.418457,738.397644 1557.863525,739.471619 1557.308716,740.545593 
-	C1559.124390,740.938721 1560.939331,741.593506 1562.756348,741.599060 
-	C1563.505249,741.601318 1564.258545,740.207825 1565.009766,739.449158 
-	C1563.917480,738.703003 1562.876099,737.858276 1561.709473,737.256104 
-	C1561.195557,736.990845 1560.427368,737.218384 1558.973389,737.323730 
-z"/>
-<path fill="#647480" opacity="1.000000" stroke="none" 
-	d="
-M1503.166504,760.735840 
-	C1503.261841,756.675171 1503.357178,752.614441 1504.204346,748.348999 
-	C1525.293945,748.126099 1545.631592,748.107849 1565.969238,748.089600 
-	C1568.838013,752.114502 1568.201782,756.322083 1565.850464,760.783325 
-	C1544.442627,760.903809 1523.804565,760.819824 1503.166504,760.735840 
-M1563.698120,752.698242 
-	C1562.087158,752.618286 1560.389526,752.204834 1558.900269,752.592712 
-	C1558.103271,752.800171 1557.665649,754.388184 1557.065918,755.353149 
-	C1558.842041,755.859497 1560.645874,756.786804 1562.381104,756.672607 
-	C1563.114136,756.624390 1563.702759,754.383057 1563.698120,752.698242 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M1503.223267,761.046997 
-	C1523.804565,760.819824 1544.442627,760.903809 1565.550049,761.016846 
-	C1565.987183,761.528564 1565.955200,762.011169 1565.892334,762.856323 
-	C1545.567139,763.225525 1525.273071,763.232361 1504.520264,763.163330 
-	C1503.801025,762.510986 1503.540527,761.934570 1503.223267,761.046997 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1565.887207,747.823364 
-	C1545.631592,748.107849 1525.293945,748.126099 1504.491211,748.107544 
-	C1504.269287,747.578918 1504.512207,747.087097 1504.864746,746.342163 
-	C1524.680664,746.035095 1544.386963,745.981140 1564.557861,746.005554 
-	C1565.283203,746.575012 1565.544189,747.066040 1565.887207,747.823364 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1545.275146,78.585190 
-	C1541.647339,78.170547 1538.255981,77.430473 1534.864624,76.690399 
-	C1534.773438,76.150269 1534.682251,75.610130 1534.591064,75.070000 
-	C1537.044312,72.731293 1539.497559,70.392578 1543.333618,66.735527 
-	C1544.237427,71.517799 1544.874390,74.888771 1545.275146,78.585190 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1540.117432,91.225060 
-	C1537.926392,93.399063 1536.291626,93.920853 1535.247437,90.658287 
-	C1534.510742,88.356537 1533.623657,86.102959 1532.355225,82.583656 
-	C1536.882446,83.199402 1540.321167,83.667122 1544.850952,84.283226 
-	C1543.023438,87.006882 1541.699585,88.979904 1540.117432,91.225060 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1517.522705,67.523117 
-	C1515.936523,66.318245 1514.643311,65.325920 1512.336426,63.555950 
-	C1516.185913,61.577427 1519.424072,59.913132 1523.768677,57.680103 
-	C1523.402588,62.592377 1523.146240,66.030708 1522.807251,70.578773 
-	C1520.466553,69.245583 1519.141113,68.490631 1517.522705,67.523117 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1508.265015,70.699203 
-	C1509.345947,69.914162 1510.757935,68.845871 1511.139526,69.135429 
-	C1513.446777,70.886276 1515.518555,72.947479 1518.834229,75.965622 
-	C1514.260986,77.434334 1511.099854,78.449532 1506.649048,79.878883 
-	C1507.252197,76.255600 1507.686035,73.649521 1508.265015,70.699203 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1527.314453,87.684464 
-	C1529.044312,90.506363 1530.502197,93.080864 1532.432983,96.490562 
-	C1528.145386,96.490562 1524.599976,96.490562 1519.999146,96.490562 
-	C1522.588013,92.868919 1521.866577,88.103256 1527.314453,87.684464 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1535.723022,61.071781 
-	C1537.014526,62.067173 1537.997070,62.858891 1539.429810,64.013474 
-	C1536.277710,66.218178 1533.529419,68.140503 1529.540771,70.930328 
-	C1529.089600,66.251122 1528.761230,62.845154 1528.345947,58.538723 
-	C1531.208252,59.482063 1533.311157,60.175087 1535.723022,61.071781 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1515.103760,93.094513 
-	C1512.459229,90.619576 1510.195801,88.147545 1506.983154,84.639061 
-	C1511.907227,83.874901 1515.293823,83.349342 1520.390747,82.558357 
-	C1518.293823,87.062881 1516.889160,90.080147 1515.103760,93.094513 
-z"/>
-<path fill="#3266E2" opacity="1.000000" stroke="none" 
-	d="
-M1526.092773,74.842728 
-	C1527.339111,76.152184 1528.395386,77.393860 1528.876465,78.828369 
-	C1529.001709,79.201889 1527.292603,80.782219 1526.498535,80.728882 
-	C1525.401367,80.655205 1523.393555,79.305664 1523.486816,78.944389 
-	C1523.863281,77.486320 1524.896973,76.197929 1526.092773,74.842728 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M117.405617,532.787598 
-	C116.471245,531.747986 115.939461,530.772461 115.407669,529.796875 
-	C117.419212,529.528381 119.426735,529.144714 121.445175,529.074341 
-	C121.934013,529.057312 122.458916,530.073914 122.967239,530.615234 
-	C121.898476,531.366394 120.882683,532.217896 119.736641,532.822632 
-	C119.229828,533.090027 118.459114,532.857300 117.405617,532.787598 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M120.621101,513.256592 
-	C121.587570,514.418640 122.156631,515.511169 122.725693,516.603638 
-	C120.897202,516.989075 119.069328,517.631226 117.239937,517.635559 
-	C116.491577,517.637390 115.739937,516.259705 114.989784,515.509583 
-	C116.079742,514.731934 117.115929,513.854858 118.284721,513.223083 
-	C118.789917,512.949951 119.569008,513.183533 120.621101,513.256592 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M120.609711,502.719910 
-	C119.560966,502.791901 118.779938,503.029358 118.279526,502.755005 
-	C117.113182,502.115509 116.081863,501.229736 114.995834,500.443726 
-	C115.748795,499.702942 116.502945,498.342804 117.254509,498.344208 
-	C119.083839,498.347687 120.911957,498.982941 122.740555,499.363678 
-	C122.162010,500.460083 121.583473,501.556458 120.609711,502.719910 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M78.608353,76.510864 
-	C91.605019,85.736748 91.721863,83.722427 78.461533,93.075996 
-	C77.784203,93.553772 77.122849,94.269028 76.378242,94.384369 
-	C75.355789,94.542740 74.260864,94.233238 73.196991,94.124222 
-	C73.456345,92.977768 73.333153,91.411591 74.045601,90.762276 
-	C76.332008,88.678452 78.927376,86.933617 81.929939,84.659271 
-	C79.495338,82.883713 77.335320,81.649933 75.637901,79.953339 
-	C74.458252,78.774254 73.914505,76.958961 73.086670,75.427895 
-	C74.833847,75.718338 76.581017,76.008781 78.608353,76.510864 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M103.953537,97.778450 
-	C100.337936,97.740532 97.173424,97.932343 94.083618,97.538300 
-	C93.026764,97.403519 92.157257,95.799637 91.202148,94.866974 
-	C92.207085,94.219330 93.194878,93.045029 94.219810,93.011658 
-	C99.828033,92.829094 105.448936,92.825996 111.056190,93.024185 
-	C112.022354,93.058342 112.943832,94.356842 113.885941,95.071304 
-	C113.044067,95.927841 112.304642,97.352692 111.339722,97.526634 
-	C109.095573,97.931190 106.742706,97.732704 103.953537,97.778450 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1100.662354,93.904488 
-	C1099.896973,94.156036 1099.504883,94.110649 1099.112549,94.065247 
-	C1099.248657,93.705017 1099.384766,93.344810 1099.520752,92.984612 
-	C1100.025757,93.192268 1100.530518,93.399910 1100.662354,93.904488 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1132.657959,104.242081 
-	C1133.427979,104.421844 1133.862183,104.925606 1134.171875,105.743576 
-	C1133.472412,105.560539 1132.897339,105.063309 1132.657959,104.242081 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1109.407471,64.756165 
-	C1108.508301,64.569717 1108.001343,64.062340 1107.732788,63.256584 
-	C1108.580688,63.450554 1109.190308,63.942894 1109.407471,64.756165 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1110.151855,65.646332 
-	C1109.683105,65.926575 1109.307617,65.794670 1108.931152,65.309090 
-	C1109.368530,65.048347 1109.806763,65.141273 1110.151855,65.646332 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1141.253296,68.763092 
-	C1141.307007,69.414764 1141.143188,69.616455 1140.521973,69.495850 
-	C1139.991577,69.052032 1139.847778,68.873222 1139.703979,68.694420 
-	C1139.862183,68.404167 1140.020386,68.113907 1140.421387,67.740753 
-	C1140.811646,67.895378 1140.959106,68.132881 1141.253296,68.763092 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1138.801514,69.801804 
-	C1138.936890,69.493378 1139.072266,69.184944 1139.455811,68.785461 
-	C1139.847778,68.873222 1139.991577,69.052032 1140.324341,69.518661 
-	C1140.384888,70.083046 1140.190674,70.301109 1139.544922,70.319290 
-	C1139.039917,70.052544 1138.920776,69.927162 1138.801514,69.801804 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1139.329956,70.373207 
-	C1139.087524,70.804901 1138.674316,71.041306 1138.260986,71.277725 
-	C1138.218018,70.879326 1138.175171,70.480911 1138.466797,69.942139 
-	C1138.920776,69.927162 1139.039917,70.052544 1139.329956,70.373207 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1142.937744,93.051292 
-	C1142.186646,92.916969 1141.631470,92.534798 1141.076416,92.152634 
-	C1141.665161,92.094467 1142.253906,92.036308 1143.168091,92.130905 
-	C1143.373657,92.456924 1143.253784,92.630188 1142.937744,93.051292 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1102.028198,68.976868 
-	C1102.291016,69.154854 1102.582397,69.309067 1103.033325,69.662460 
-	C1103.192993,69.861649 1103.269775,69.819572 1103.269775,69.819572 
-	C1102.749390,69.820518 1102.229004,69.821457 1101.912109,69.365196 
-	C1102.115601,68.907990 1102.056641,68.953102 1102.028198,68.976868 
-z"/>
-<path fill="#FBFBFB" opacity="1.000000" stroke="none" 
-	d="
-M1103.156982,69.886414 
-	C1103.270996,70.284790 1103.421265,70.658394 1103.571533,71.031967 
-	C1103.274414,70.822983 1102.977295,70.614014 1102.974854,70.112305 
-	C1103.269775,69.819572 1103.192993,69.861649 1103.156982,69.886414 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1560.143311,515.131348 
-	C1558.875122,514.207336 1558.018799,513.296509 1557.162476,512.385620 
-	C1558.930664,511.914856 1560.684326,511.197754 1562.474243,511.091278 
-	C1563.216797,511.047058 1564.037109,512.308167 1564.822021,512.975708 
-	C1563.399780,513.698669 1561.977539,514.421631 1560.143311,515.131348 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1564.133057,526.709900 
-	C1563.718018,528.057800 1563.091431,529.923706 1562.256714,530.021973 
-	C1560.644897,530.211731 1558.915649,529.403687 1557.234985,529.009277 
-	C1557.805786,528.042236 1558.223755,526.422424 1558.979370,526.245605 
-	C1560.497925,525.890381 1562.200684,526.322266 1564.133057,526.709900 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1564.888184,543.763794 
-	C1564.414062,544.455811 1564.022949,545.073853 1563.684204,545.046448 
-	C1561.527588,544.872009 1559.382446,544.555176 1557.233521,544.285217 
-	C1557.444092,543.440674 1557.447021,542.008545 1557.899414,541.848633 
-	C1560.496704,540.930603 1563.300537,539.879700 1564.888184,543.763794 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M763.889771,653.998535 
-	C758.834961,646.243103 758.570923,638.587524 763.581299,631.266479 
-	C768.221985,624.485718 775.072205,621.734314 783.160217,623.179810 
-	C791.058960,624.591431 796.231567,629.505676 798.454834,637.203369 
-	C800.943359,645.819214 796.993042,655.032349 789.204834,659.420837 
-	C780.772766,664.172180 771.568909,662.291016 763.889771,653.998535 
-M791.143494,635.639282 
-	C786.518860,629.270264 780.030640,627.262268 773.831970,630.281799 
-	C768.248779,633.001526 765.153931,639.404846 766.595093,645.254761 
-	C768.503418,653.000977 776.083313,657.479370 783.412292,655.190735 
-	C791.446411,652.681946 794.675598,645.181519 791.143494,635.639282 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1104.889893,326.998657 
-	C1099.835205,319.243286 1099.570679,311.587616 1104.581055,304.266571 
-	C1109.221802,297.485931 1116.071899,294.734406 1124.160034,296.179901 
-	C1132.058838,297.591553 1137.231445,302.505341 1139.454712,310.203247 
-	C1141.943115,318.819733 1137.993286,328.032104 1130.204956,332.420837 
-	C1121.772949,337.172272 1112.568481,335.290955 1104.889893,326.998657 
-M1113.211670,326.489197 
-	C1118.432373,329.724426 1123.671143,329.770203 1128.580688,326.048737 
-	C1133.076660,322.640869 1134.923340,317.927429 1133.606323,312.363098 
-	C1132.300781,306.847992 1128.711670,303.389099 1123.126709,302.201752 
-	C1117.514404,301.008514 1111.663818,303.874298 1108.847534,309.073669 
-	C1105.708618,314.868652 1106.972168,320.586700 1113.211670,326.489197 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M516.451904,372.549927 
-	C510.134521,365.807434 508.545593,358.338135 512.164246,350.248077 
-	C515.429688,342.947815 521.446289,339.039856 529.485535,338.893463 
-	C537.738281,338.743164 543.830505,342.605743 547.492920,349.979401 
-	C551.528015,358.103363 549.103455,367.991791 541.875610,373.775574 
-	C534.526062,379.656738 525.098633,379.292542 516.451904,372.549927 
-M524.862427,345.956390 
-	C519.220520,348.444366 516.315979,352.920197 516.532043,358.934113 
-	C516.724243,364.283600 519.517395,368.396515 524.538757,370.646515 
-	C529.908264,373.052582 536.154480,371.574219 539.960388,367.141205 
-	C543.758789,362.716797 544.261841,356.349854 541.209229,351.334076 
-	C537.994812,346.052368 532.628784,344.113892 524.862427,345.956390 
-z"/>
-<path fill="#FEFEFE" opacity="1.000000" stroke="none" 
-	d="
-M1516.556519,319.003235 
-	C1516.762085,319.540253 1516.711060,320.253235 1516.346802,320.976074 
-	C1516.122314,320.383667 1516.211060,319.781464 1516.556519,319.003235 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1541.094604,325.721802 
-	C1539.225464,327.242981 1537.506592,328.975128 1535.573853,329.260742 
-	C1534.526611,329.415466 1532.470215,327.311951 1532.003174,325.861786 
-	C1531.046997,322.893829 1532.491577,320.403931 1535.655151,319.972412 
-	C1539.374023,319.465149 1541.147461,321.663391 1541.094604,325.721802 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M787.345947,91.937195 
-	C782.631897,103.453194 772.372131,108.527115 762.019470,104.792816 
-	C752.149780,101.232719 746.862488,90.612740 749.951660,80.553261 
-	C752.948303,70.794792 763.115906,64.996796 773.172913,67.311440 
-	C783.821167,69.762169 789.632385,79.615250 787.345947,91.937195 
-M757.847290,78.493164 
-	C754.227356,83.773613 754.260864,89.090469 757.919739,94.284210 
-	C761.012268,98.674088 766.580322,100.688850 771.559814,99.458473 
-	C777.119751,98.084663 781.221130,93.525215 781.919373,87.941795 
-	C782.604065,82.466743 779.497375,76.727562 774.555481,74.338020 
-	C768.913147,71.609787 763.690002,72.751717 757.847290,78.493164 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M514.805847,73.896126 
-	C522.226746,66.596840 530.624329,64.911308 538.629578,68.880714 
-	C545.991333,72.531052 550.076965,80.185432 549.180969,88.648552 
-	C548.314697,96.830589 542.453552,103.429207 534.299866,105.401917 
-	C526.514954,107.285408 518.399963,104.125931 513.790833,97.417007 
-	C508.900604,90.298889 509.168976,82.291969 514.805847,73.896126 
-M528.759644,72.987907 
-	C521.405029,74.606621 517.745544,78.067459 516.674683,84.416664 
-	C515.795959,89.627220 518.491333,95.252182 523.158020,97.946342 
-	C528.049805,100.770439 533.627563,100.378258 538.110779,96.894981 
-	C542.359558,93.593819 544.211426,87.781174 542.676208,82.565193 
-	C540.983521,76.814087 536.662170,73.640930 528.759644,72.987907 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M120.756981,753.711792 
-	C121.712715,754.688721 122.234642,755.627258 122.756577,756.565796 
-	C120.796631,756.951721 118.845734,757.510376 116.870964,757.614014 
-	C116.309349,757.643433 115.678253,756.348755 115.079010,755.661255 
-	C116.175323,754.994995 117.228004,754.232910 118.387329,753.705017 
-	C118.925751,753.459839 119.671440,753.669800 120.756981,753.711792 
-z"/>
-<path fill="#CED9DC" opacity="1.000000" stroke="none" 
-	d="
-M116.626373,738.458740 
-	C117.838585,738.287476 118.752266,738.006165 119.475342,738.262512 
-	C120.744194,738.712341 121.896301,739.491455 123.097305,740.132751 
-	C122.627968,740.925232 122.221199,742.342590 121.677963,742.396973 
-	C119.788635,742.586121 117.852036,742.302856 115.933418,742.199219 
-	C116.036285,740.996338 116.139153,739.793518 116.626373,738.458740 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M122.254120,769.440125 
-	C121.800812,770.759644 121.158524,772.536560 120.194717,772.732544 
-	C118.765381,773.023254 117.108223,772.193726 115.548050,771.841003 
-	C116.025192,770.872925 116.350746,769.219849 117.009827,769.074097 
-	C118.562408,768.730530 120.274040,769.105835 122.254120,769.440125 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1561.793701,771.915283 
-	C1559.960083,771.382507 1558.538574,770.836060 1557.117188,770.289551 
-	C1557.396240,769.603455 1557.637939,768.345276 1557.960205,768.324341 
-	C1560.008911,768.190979 1562.075317,768.330688 1564.135986,768.380371 
-	C1563.492676,769.554138 1562.849365,770.727905 1561.793701,771.915283 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1559.374023,737.272949 
-	C1560.427368,737.218384 1561.195557,736.990845 1561.709473,737.256104 
-	C1562.876099,737.858276 1563.917480,738.703003 1565.009766,739.449219 
-	C1564.258545,740.207825 1563.505249,741.601318 1562.756348,741.599060 
-	C1560.939331,741.593506 1559.124390,740.938721 1557.308594,740.545532 
-	C1557.863525,739.471619 1558.418457,738.397644 1559.374023,737.272949 
-z"/>
-<path fill="#E0DBF4" opacity="1.000000" stroke="none" 
-	d="
-M1564.027588,752.918335 
-	C1563.702759,754.383057 1563.114136,756.624390 1562.381104,756.672607 
-	C1560.645874,756.786804 1558.842041,755.859497 1557.065918,755.353149 
-	C1557.665649,754.388184 1558.103271,752.800171 1558.900269,752.592712 
-	C1560.389526,752.204834 1562.087158,752.618286 1564.027588,752.918335 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M791.345825,635.966553 
-	C794.675598,645.181519 791.446411,652.681946 783.412292,655.190735 
-	C776.083313,657.479370 768.503418,653.000977 766.595093,645.254761 
-	C765.153931,639.404846 768.248779,633.001526 773.831970,630.281799 
-	C780.030640,627.262268 786.518860,629.270264 791.345825,635.966553 
-M785.477234,637.121582 
-	C782.084961,633.993225 778.377991,633.527161 774.713013,636.385193 
-	C771.796021,638.659912 771.070312,641.848633 772.461731,645.320923 
-	C774.106506,649.425720 778.836243,651.312317 782.766663,649.544556 
-	C787.223206,647.540039 788.387817,643.267273 785.477234,637.121582 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M1112.905029,326.268921 
-	C1106.972168,320.586700 1105.708618,314.868652 1108.847534,309.073669 
-	C1111.663818,303.874298 1117.514404,301.008514 1123.126709,302.201752 
-	C1128.711670,303.389099 1132.300781,306.847992 1133.606323,312.363098 
-	C1134.923340,317.927429 1133.076660,322.640869 1128.580688,326.048737 
-	C1123.671143,329.770203 1118.432373,329.724426 1112.905029,326.268921 
-M1125.728271,321.259796 
-	C1128.972534,317.009033 1129.313721,313.079498 1126.421875,310.120972 
-	C1123.524414,307.156586 1120.052002,306.684418 1116.466675,308.815063 
-	C1113.000000,310.875305 1111.879150,315.223999 1113.686523,318.812103 
-	C1115.835449,323.078369 1119.804932,324.106964 1125.728271,321.259796 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M525.237000,345.827881 
-	C532.628784,344.113892 537.994812,346.052368 541.209229,351.334076 
-	C544.261841,356.349854 543.758789,362.716797 539.960388,367.141205 
-	C536.154480,371.574219 529.908264,373.052582 524.538757,370.646515 
-	C519.517395,368.396515 516.724243,364.283600 516.532043,358.934113 
-	C516.315979,352.920197 519.220520,348.444366 525.237000,345.827881 
-M529.602478,366.147705 
-	C535.338074,365.246826 538.478699,361.613678 537.535339,356.970642 
-	C536.606262,352.397583 532.237732,349.594482 527.790527,350.885040 
-	C524.231934,351.917725 522.116638,354.426758 522.072693,358.138580 
-	C522.020203,362.564911 524.534912,365.149139 529.602478,366.147705 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M758.070801,78.193146 
-	C763.690002,72.751717 768.913147,71.609787 774.555481,74.338020 
-	C779.497375,76.727562 782.604065,82.466743 781.919373,87.941795 
-	C781.221130,93.525215 777.119751,98.084663 771.559814,99.458473 
-	C766.580322,100.688850 761.012268,98.674088 757.919739,94.284210 
-	C754.260864,89.090469 754.227356,83.773613 758.070801,78.193146 
-M764.610291,79.689735 
-	C760.652344,82.568985 759.577942,86.252365 762.127075,90.483650 
-	C764.295410,94.082657 767.789673,95.141853 771.607727,93.542892 
-	C775.421387,91.945793 776.984131,88.722076 776.204529,84.624512 
-	C775.308167,79.913498 771.295410,77.998184 764.610291,79.689735 
-z"/>
-<path fill="#5033C6" opacity="1.000000" stroke="none" 
-	d="
-M529.172485,72.970245 
-	C536.662170,73.640930 540.983521,76.814087 542.676208,82.565193 
-	C544.211426,87.781174 542.359558,93.593819 538.110779,96.894981 
-	C533.627563,100.378258 528.049805,100.770439 523.158020,97.946342 
-	C518.491333,95.252182 515.795959,89.627220 516.674683,84.416664 
-	C517.745544,78.067459 521.405029,74.606621 529.172485,72.970245 
-M537.274292,88.688721 
-	C537.941284,83.029495 535.633545,79.328979 531.031738,78.678505 
-	C527.051270,78.115845 523.195923,80.524384 522.281982,84.400551 
-	C521.314392,88.504013 522.950012,91.586388 526.665771,93.427971 
-	C530.582397,95.369125 533.857666,94.016304 537.274292,88.688721 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M785.725220,637.450806 
-	C788.387817,643.267273 787.223206,647.540039 782.766663,649.544556 
-	C778.836243,651.312317 774.106506,649.425720 772.461731,645.320923 
-	C771.070312,641.848633 771.796021,638.659912 774.713013,636.385193 
-	C778.377991,633.527161 782.084961,633.993225 785.725220,637.450806 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M1125.411621,321.514099 
-	C1119.804932,324.106964 1115.835449,323.078369 1113.686523,318.812103 
-	C1111.879150,315.223999 1113.000000,310.875305 1116.466675,308.815063 
-	C1120.052002,306.684418 1123.524414,307.156586 1126.421875,310.120972 
-	C1129.313721,313.079498 1128.972534,317.009033 1125.411621,321.514099 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M529.197998,366.125031 
-	C524.534912,365.149139 522.020203,362.564911 522.072693,358.138580 
-	C522.116638,354.426758 524.231934,351.917725 527.790527,350.885040 
-	C532.237732,349.594482 536.606262,352.397583 537.535339,356.970642 
-	C538.478699,361.613678 535.338074,365.246826 529.197998,366.125031 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M764.966187,79.480148 
-	C771.295410,77.998184 775.308167,79.913498 776.204529,84.624512 
-	C776.984131,88.722076 775.421387,91.945793 771.607727,93.542892 
-	C767.789673,95.141853 764.295410,94.082657 762.127075,90.483650 
-	C759.577942,86.252365 760.652344,82.568985 764.966187,79.480148 
-z"/>
-<path fill="#F3F1FC" opacity="1.000000" stroke="none" 
-	d="
-M537.137085,89.040352 
-	C533.857666,94.016304 530.582397,95.369125 526.665771,93.427971 
-	C522.950012,91.586388 521.314392,88.504013 522.281982,84.400551 
-	C523.195923,80.524384 527.051270,78.115845 531.031738,78.678505 
-	C535.633545,79.328979 537.941284,83.029495 537.137085,89.040352 
-z"/>
-</svg>
\ No newline at end of file
diff --git a/docs/img/application-access/attach-security-role.png b/docs/img/application-access/attach-security-role.png
deleted file mode 100644
index 67e2e669e4eb2..0000000000000
Binary files a/docs/img/application-access/attach-security-role.png and /dev/null differ
diff --git a/docs/img/application-access/aws-trusted-entities@2x.png b/docs/img/application-access/aws-trusted-entities@2x.png
deleted file mode 100644
index 72ee9edf49a63..0000000000000
Binary files a/docs/img/application-access/aws-trusted-entities@2x.png and /dev/null differ
diff --git a/docs/img/application-access/create-role-example-readonly-1.png b/docs/img/application-access/create-role-example-readonly-1.png
deleted file mode 100644
index 8eff57f53ede4..0000000000000
Binary files a/docs/img/application-access/create-role-example-readonly-1.png and /dev/null differ
diff --git a/docs/img/application-access/create-role-example-readonly-2.png b/docs/img/application-access/create-role-example-readonly-2.png
deleted file mode 100644
index b113ea49c64fb..0000000000000
Binary files a/docs/img/application-access/create-role-example-readonly-2.png and /dev/null differ
diff --git a/docs/img/application-access/create-role-example-readonly-3.png b/docs/img/application-access/create-role-example-readonly-3.png
deleted file mode 100644
index adda1744eecfb..0000000000000
Binary files a/docs/img/application-access/create-role-example-readonly-3.png and /dev/null differ
diff --git a/docs/img/application-access/okta/okta-application-access-request.png b/docs/img/application-access/okta/okta-application-access-request.png
deleted file mode 100644
index b7a9a5d63f2dc..0000000000000
Binary files a/docs/img/application-access/okta/okta-application-access-request.png and /dev/null differ
diff --git a/docs/img/application-access/okta/okta-user-group-access-request.png b/docs/img/application-access/okta/okta-user-group-access-request.png
deleted file mode 100644
index 8e263659dc73b..0000000000000
Binary files a/docs/img/application-access/okta/okta-user-group-access-request.png and /dev/null differ
diff --git a/docs/img/architecture/managed-updates-v2.svg b/docs/img/architecture/managed-updates-v2.svg
new file mode 100644
index 0000000000000..db5eb1f0e7266
--- /dev/null
+++ b/docs/img/architecture/managed-updates-v2.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1727" height="883"><g transform="translate(-194 -258)" lucid:page-tab-id="0_0"><path d="M0 0h2000v1500H0z" fill="#fff"/><path d="M1600 584.67a8 8 0 0 1 8-8h304a8 8 0 0 1 8 8V1132a8 8 0 0 1-8 8h-304a8 8 0 0 1-8-8z" stroke="#999" stroke-width="2" fill-opacity="0"/><path d="M1600 540h320v36.67h-320z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><use xlink:href="#a" transform="matrix(1,0,0,1,1605,545) translate(130.932065 19.897380000000002)"/><path d="M1600 764.44h320V877.1h-320z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><path d="M378.5 886.9a8 8 0 0 1 8-8h601.38a8 8 0 0 1 8 8v214.25a8 8 0 0 1-8 8H386.5a8 8 0 0 1-8-8z" stroke="#5130c9" stroke-width="2" fill-opacity="0"/><path d="M378.5 839.4h617.38v39.5H378.5z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><use xlink:href="#b" transform="matrix(1,0,0,1,383.5039767813621,844.4018022448504) translate(176.97688 22.147380000000002)"/><path d="M421.06 925.4a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M400 1065.4a6 6 0 0 1 6-6h158.13a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H406a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#d" transform="matrix(1,0,0,1,400.0000000006985,1059.4018022448372) translate(54.06888888888891 18.879999999999995)"/><use xlink:href="#e" transform="matrix(1,0,0,1,400.0000000006985,1059.4018022448372) translate(106.61999999999999 18.879999999999995)"/><path d="M474.6 1006.7v2.06c0 2.3 1.94 4.2 4.22 4.2h31.3c2.26 0 4.13-1.9 4.13-4.2v-37.53c0-2.25-1.87-4.13-4.14-4.13H508v35.4c0 2.32-1.86 4.2-4.2 4.2h-29.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M466.33 999.2v1.24c0 2.3 1.86 4.2 4.14 4.2h31.3c2.27 0 4.13-1.9 4.13-4.2V962.9c0-2.3-1.86-4.18-4.14-4.18h-5.84v36.1c0 2.5-1.87 4.37-4.38 4.37h-25.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M489.44 950.4h-21.9c-.4 0-.8.2-1.04.44l-10.2 10.2c-.2.18-.42.62-.42 1.06v30.65c0 2.5 1.86 4.37 4.37 4.37h29.19c2.52 0 4.4-1.87 4.4-4.37v-37.97c0-2.5-1.88-4.38-4.4-4.38zm-21.25 10.2c0 .87-.65 1.5-1.47 1.5h-6.7l8.16-8.13v6.63z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M623.2 925.4a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M602.13 1065.4a6 6 0 0 1 6-6h158.13a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H608.13a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#d" transform="matrix(1,0,0,1,602.1291695510954,1059.4018022448372) translate(54.06888888888891 18.879999999999995)"/><use xlink:href="#f" transform="matrix(1,0,0,1,602.1291695510954,1059.4018022448372) translate(106.61999999999999 18.879999999999995)"/><path d="M676.74 1006.7v2.06c0 2.3 1.93 4.2 4.2 4.2h31.3c2.27 0 4.14-1.9 4.14-4.2v-37.53c0-2.25-1.87-4.13-4.14-4.13h-2.1v35.4c0 2.32-1.87 4.2-4.2 4.2h-29.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M668.46 999.2v1.24c0 2.3 1.86 4.2 4.14 4.2h31.3c2.27 0 4.13-1.9 4.13-4.2V962.9c0-2.3-1.86-4.18-4.14-4.18h-5.85v36.1c0 2.5-1.87 4.37-4.38 4.37h-25.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M691.57 950.4h-21.9c-.4 0-.8.2-1.04.44l-10.22 10.2c-.16.18-.4.62-.4 1.06v30.65c0 2.5 1.87 4.37 4.38 4.37h29.18c2.52 0 4.4-1.87 4.4-4.37v-37.97c0-2.5-1.88-4.38-4.4-4.38zm-21.25 10.2c0 .87-.64 1.5-1.46 1.5h-6.7l8.16-8.13v6.63z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M825.32 927.4a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M804.26 1067.4a6 6 0 0 1 6-6H968.4a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H810.25a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#d" transform="matrix(1,0,0,1,804.2583391014923,1061.40180224485) translate(54.06888888888891 18.879999999999995)"/><use xlink:href="#g" transform="matrix(1,0,0,1,804.2583391014923,1061.40180224485) translate(106.61999999999999 18.879999999999995)"/><path d="M878.87 1008.7v2.06c0 2.3 1.93 4.2 4.2 4.2h31.3c2.27 0 4.14-1.9 4.14-4.2v-37.53c0-2.25-1.86-4.13-4.13-4.13h-2.1v35.4c0 2.32-1.87 4.2-4.2 4.2h-29.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M870.58 1001.2v1.24c0 2.3 1.87 4.2 4.15 4.2h31.3c2.27 0 4.13-1.9 4.13-4.2V964.9c0-2.3-1.86-4.18-4.14-4.18h-5.84v36.1c0 2.5-1.87 4.37-4.38 4.37H870.58z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M893.7 952.4h-21.9c-.4 0-.8.2-1.04.44l-10.22 10.2c-.17.18-.4.62-.4 1.06v30.65c0 2.5 1.86 4.37 4.37 4.37h29.19c2.5 0 4.38-1.87 4.38-4.37v-37.97c0-2.5-1.87-4.38-4.38-4.38zm-21.25 10.2c0 .87-.64 1.5-1.46 1.5h-6.72l8.17-8.13v6.63z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1181.07 626a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M1155.34 766a6 6 0 0 1 6-6h167.45a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-167.46a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#h" transform="matrix(1,0,0,1,1155.3351692859978,759.9999999998836) translate(14.706666666666706 18.879999999999995)"/><use xlink:href="#i" transform="matrix(1,0,0,1,1155.3351692859978,759.9999999998836) translate(105.3111111111111 18.879999999999995)"/><path d="M1275.9 655.4h-61.66c-1.32 0-2.18.86-2.18 2.17v8.8c0 1.33.86 2.24 2.18 2.24h61.65c1.3 0 2.16-.9 2.16-2.22v-8.8c0-1.32-.85-2.18-2.17-2.18zm-13.2 8.8c-1.33 0-2.26-.9-2.26-2.22 0-1.32.93-2.18 2.25-2.18 1.3 0 2.16.86 2.16 2.18 0 1.3-.85 2.23-2.17 2.23zm10.94 0h-4.35c-1.33 0-2.26-.9-2.26-2.22 0-1.32.93-2.18 2.25-2.18h4.34c1.32 0 2.25.86 2.25 2.18 0 1.3-.94 2.23-2.26 2.23zM1275.9 677.42h-61.66c-1.32 0-2.18.86-2.18 2.18v8.8c0 1.32.86 2.18 2.18 2.18h28.65v9.27c-2 .63-3.3 2.18-3.97 3.95h-18.1c-1.3 0-2.16.9-2.16 2.22 0 1.32.85 2.18 2.17 2.18h18.1c.85 2.63 3.3 4.4 6.13 4.4s5.28-1.77 6.13-4.4h18.09c1.3 0 2.16-.86 2.16-2.18 0-1.3-.85-2.23-2.17-2.23H1251.2c-.66-1.95-2.17-3.33-3.96-3.96v-9.25h28.65c1.3 0 2.16-.86 2.16-2.18v-8.8c0-1.32-.85-2.18-2.17-2.18zm-52.8 8.75c-1.33 0-2.26-.85-2.26-2.17 0-1.32.93-2.17 2.25-2.17 1.3 0 2.17.85 2.17 2.17 0 1.32-.86 2.17-2.18 2.17zm6.6 0c-1.33 0-2.26-.85-2.26-2.17 0-1.32.93-2.17 2.25-2.17 1.3 0 2.16.85 2.16 2.17 0 1.32-.85 2.17-2.17 2.17zm6.6 0c-1.33 0-2.26-.85-2.26-2.17 0-1.32.93-2.17 2.25-2.17 1.3 0 2.16.85 2.16 2.17 0 1.32-.85 2.17-2.17 2.17zm4.34-2.17c0-1.32.93-2.17 2.25-2.17 1.3 0 2.16.85 2.16 2.17 0 1.32-.85 2.17-2.17 2.17-1.33 0-2.26-.85-2.26-2.17zm22.05 2.17c-1.33 0-2.26-.85-2.26-2.17 0-1.32.93-2.17 2.25-2.17 1.3 0 2.16.85 2.16 2.17 0 1.32-.85 2.17-2.17 2.17zm10.94 0h-4.35c-1.33 0-2.26-.85-2.26-2.17 0-1.32.93-2.17 2.25-2.17h4.34c1.32 0 2.25.85 2.25 2.17 0 1.32-.94 2.17-2.26 2.17z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1181.07 936.02a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M1160 1076.02a6 6 0 0 1 6-6h158.13a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H1166a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#j" transform="matrix(1,0,0,1,1159.9999999998836,1070.0168956240555) translate(41.913333333333355 17.54666666666666)"/><use xlink:href="#k" transform="matrix(1,0,0,1,1159.9999999998836,1070.0168956240555) translate(23.39333333333336 38.87999999999998)"/><use xlink:href="#l" transform="matrix(1,0,0,1,1159.9999999998836,1070.0168956240555) translate(75.94444444444444 38.87999999999998)"/><path d="M1230.76 994.02c0 1.97-1.6 3.58-3.6 3.58-1.95 0-3.55-1.6-3.55-3.58 0-1.97 1.6-3.58 3.55-3.58 2 0 3.6 1.6 3.6 3.58zM1230.76 1010.73c0 1.97-1.6 3.58-3.6 3.58-1.95 0-3.55-1.6-3.55-3.57 0-1.97 1.6-3.58 3.55-3.58 2 0 3.6 1.6 3.6 3.58z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1268.93 964.18h-47.73c-5.28 0-9.56 4.3-9.56 9.55v40.58c0 5.26 4.28 9.56 9.56 9.56h47.73c5.28 0 9.55-4.3 9.55-9.55v-40.57c0-5.25-4.27-9.55-9.55-9.55zm-41.78 52.52c-3.34 0-5.95-2.63-5.95-5.97 0-3.35 2.6-5.97 5.95-5.97 3.34 0 5.95 2.63 5.95 5.97s-2.6 5.97-5.95 5.97zm0-16.72c-3.34 0-5.95-2.62-5.95-5.96 0-3.35 2.6-5.97 5.95-5.97 3.34 0 5.95 2.63 5.95 5.97s-2.6 5.97-5.95 5.97zm6.7-25.3l-8.1 7.16c-.47.48-1.2.48-1.47 0l-3.8-3.1c-.48-.48-.75-1.2-.2-1.67.45-.48 1.12-.48 1.66-.24l3.07 2.4 7.43-6.46c.47-.48 1.2-.48 1.67 0s.2 1.43-.26 1.9zm34.14 37.24h-29.15c-.47 0-.94-.48-.94-1.2 0-.7.48-1.2.95-1.2H1268c.46 0 .93.5.93 1.2 0 .72-.47 1.2-.94 1.2zm0-16.7h-29.15c-.47 0-.94-.5-.94-1.2 0-.72.48-1.2.95-1.2H1268c.46 0 .93.48.93 1.2 0 .7-.47 1.2-.94 1.2zm0-16.72h-29.15c-.47 0-.94-.48-.94-1.2 0-.7.48-1.2.95-1.2H1268c.46 0 .93.5.93 1.2 0 .72-.47 1.2-.94 1.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1620 936.02a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M1620 1076.02a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#m" transform="matrix(1,0,0,1,1620.0000000004661,1070.0168956240555) translate(20.413333333333355 17.54666666666666)"/><use xlink:href="#n" transform="matrix(1,0,0,1,1620.0000000004661,1070.0168956240555) translate(34.391111111111115 38.87999999999998)"/><path d="M1653.56 968.53a6 6 0 0 1 6-6h48.88a6 6 0 0 1 6 6v50.98a6 6 0 0 1-6 6h-48.88a6 6 0 0 1-6-6z" fill="url(#o)"/><path d="M390.5 266a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#p)"/><path d="M378.5 406a6 6 0 0 1 6-6h140a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-140a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#q" transform="matrix(1,0,0,1,378.5039767813614,400) translate(-20.07777777777774 18.879999999999995)"/><path d="M483.94 315.85c-1.3 0-2.16-.8-2.16-2.1v-17.03h-17.03c-1.3 0-2.1-.87-2.1-2.16 0-1.24.8-2.1 2.1-2.1h19.2c1.23 0 2.1.86 2.1 2.1v19.2c0 1.3-.87 2.1-2.1 2.1zM445.62 354.18h-19.2c-1.23 0-2.1-.87-2.1-2.1v-19.2c0-1.3.87-2.1 2.1-2.1 1.3 0 2.16.8 2.16 2.1v17.04h17.04c1.3 0 2.1.86 2.1 2.16 0 1.23-.8 2.1-2.1 2.1zM426.42 315.85c-1.23 0-2.1-.8-2.1-2.1v-19.2c0-1.23.87-2.1 2.1-2.1h19.2c1.3 0 2.1.87 2.1 2.1 0 1.3-.8 2.17-2.1 2.17h-17.04v17.03c0 1.3-.86 2.1-2.16 2.1zM483.94 354.18h-19.2c-1.3 0-2.1-.87-2.1-2.1 0-1.3.8-2.16 2.1-2.16h17.04v-17.04c0-1.3.87-2.1 2.16-2.1 1.24 0 2.1.8 2.1 2.1v19.2c0 1.23-.86 2.1-2.1 2.1zM476.48 313.94v18.94c0 .87-.25 1.73-.68 2.35-.37.62-1.05 1.3-1.67 1.73l-16.6 9.3s-.25 0-.25.26v-21.9l19.2-11.12v.44zM474.32 309.92c-.2 0-.2 0 0 0l-16.6-9.56c-.8-.43-1.67-.68-2.54-.68-.86 0-1.72.25-2.34.68l-16.6 9.56h-.2l19.14 11.05 19.14-11.05zM433.9 313.5l19.2 11.1v21.92s-.26 0-.26-.25l-16.6-9.3c-.62-.45-1.3-1.13-1.67-1.74-.43-.62-.68-1.48-.68-2.35v-18.94-.44z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M390.5 446a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#p)"/><path d="M378.5 586a6 6 0 0 1 6-6h140a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-140a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#r" transform="matrix(1,0,0,1,378.5039767813621,579.9999999999999) translate(-24.69111111111107 18.879999999999995)"/><path d="M483.94 495.85c-1.3 0-2.16-.8-2.16-2.1v-17.03h-17.03c-1.3 0-2.1-.87-2.1-2.16 0-1.24.8-2.1 2.1-2.1h19.2c1.23 0 2.1.86 2.1 2.1v19.2c0 1.3-.87 2.1-2.1 2.1zM445.62 534.17h-19.2c-1.23 0-2.1-.86-2.1-2.1v-19.2c0-1.28.87-2.1 2.1-2.1 1.3 0 2.16.82 2.16 2.1v17.05h17.04c1.3 0 2.1.86 2.1 2.16 0 1.23-.8 2.1-2.1 2.1zM426.42 495.85c-1.23 0-2.1-.8-2.1-2.1v-19.2c0-1.23.87-2.1 2.1-2.1h19.2c1.3 0 2.1.87 2.1 2.1 0 1.3-.8 2.17-2.1 2.17h-17.04v17.03c0 1.3-.86 2.1-2.16 2.1zM483.94 534.17h-19.2c-1.3 0-2.1-.86-2.1-2.1 0-1.3.8-2.15 2.1-2.15h17.04v-17.04c0-1.3.87-2.1 2.16-2.1 1.24 0 2.1.8 2.1 2.1v19.2c0 1.23-.86 2.1-2.1 2.1zM476.48 493.94v18.94c0 .87-.25 1.73-.68 2.35-.37.62-1.05 1.3-1.67 1.73l-16.6 9.3s-.25 0-.25.26v-21.9l19.2-11.12v.44zM474.32 489.92c-.2 0-.2 0 0 0l-16.6-9.56c-.8-.43-1.67-.68-2.54-.68-.86 0-1.72.25-2.34.68l-16.6 9.56h-.2l19.14 11.05 19.14-11.05zM433.9 493.5l19.2 11.1v21.92s-.26 0-.26-.25l-16.6-9.3c-.62-.45-1.3-1.13-1.67-1.74-.43-.62-.68-1.48-.68-2.35v-18.94-.44z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M632 626a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6H638a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#p)"/><path d="M620 766a6 6 0 0 1 6-6h140a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H626a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#s" transform="matrix(1,0,0,1,620.0000000000564,760) translate(-59.61111111111106 18.879999999999995)"/><path d="M725.44 675.85c-1.3 0-2.16-.8-2.16-2.1v-17.03h-17.03c-1.3 0-2.1-.87-2.1-2.16 0-1.24.8-2.1 2.1-2.1h19.2c1.22 0 2.1.86 2.1 2.1v19.2c0 1.3-.88 2.1-2.1 2.1zM687.1 714.17h-19.18c-1.23 0-2.1-.86-2.1-2.1v-19.2c0-1.28.87-2.1 2.1-2.1 1.3 0 2.16.82 2.16 2.1v17.05h17.03c1.3 0 2.1.86 2.1 2.16 0 1.23-.8 2.1-2.1 2.1zM667.92 675.85c-1.23 0-2.1-.8-2.1-2.1v-19.2c0-1.23.87-2.1 2.1-2.1h19.2c1.3 0 2.1.87 2.1 2.1 0 1.3-.8 2.17-2.1 2.17h-17.04v17.03c0 1.3-.86 2.1-2.16 2.1zM725.44 714.17h-19.2c-1.3 0-2.1-.86-2.1-2.1 0-1.3.8-2.15 2.1-2.15h17.04v-17.04c0-1.3.86-2.1 2.16-2.1 1.23 0 2.1.8 2.1 2.1v19.2c0 1.23-.87 2.1-2.1 2.1zM717.97 673.94v18.94c0 .87-.25 1.73-.68 2.35-.38.62-1.06 1.3-1.67 1.73l-16.6 9.3s-.25 0-.25.26v-21.9l19.2-11.12v.44zM715.8 669.92c-.17 0-.17 0 0 0l-16.6-9.56c-.8-.43-1.66-.68-2.52-.68-.86 0-1.73.25-2.34.68l-16.6 9.56h-.2l19.14 11.05 19.13-11.05zM675.4 673.5l19.18 11.1v21.92s-.25 0-.25-.25l-16.6-9.3c-.6-.45-1.3-1.13-1.66-1.74-.44-.62-.68-1.48-.68-2.35v-18.94-.44z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1620 626a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#p)"/><path d="M1608 766a6 6 0 0 1 6-6h140a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-140a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#t" transform="matrix(1,0,0,1,1608.0000000001767,760) translate(-3.9577777777777357 18.879999999999995)"/><path d="M1684 644.6c-21.27 0-38.4 17.12-38.4 38.4 0 21.27 17.13 38.4 38.4 38.4s38.4-17.13 38.4-38.4c0-21.28-17.13-38.4-38.4-38.4zm20.97 49.3c-4.15 8-12.14 12.75-20.97 12.75-6.22 0-12.13-2.38-16.82-6.84-4.45-4.36-6.84-10.05-6.84-16.2l-3.22 3.24c-.6.6-1.46.6-2.07 0-.62-.62-.62-1.47 0-2.08l5.9-5.9c.62-.63 1.47-.63 2.08 0l5.92 5.9c.6.62.6 1.46 0 2.08-.3.3-.62.3-1.23.3-.54 0-.85 0-1.15-.3l-3.23-3.23c.3 11.22 9.45 20.05 20.66 20.05 7.68 0 14.75-4.14 18.28-10.9.3-.62 1.23-.92 2.07-.62.62.3.92 1.23.62 1.77zm2.38-6.76c-.3.3-.62.3-1.23.3-.23 0-.85 0-1.15-.3l-5.92-5.9c-.6-.63-.6-1.47 0-2.1.62-.6 1.46-.6 2.08 0l3.22 3.24c0-11.2-9.14-20.04-20.35-20.04-7.68 0-14.75 4.14-18.28 10.9-.3.62-1.23.92-2.07.62-.62-.3-.92-1.23-.62-2.08 4.15-7.68 12.14-12.44 20.97-12.44 6.22 0 12.13 2.38 16.82 6.83 4.45 4.38 6.84 10.07 6.84 16.2l3.22-3.22c.6-.6 1.46-.6 2.07 0 .62.62.62 1.46 0 2.08l-5.6 5.9z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M1344.06 684.48h-17.6v-.96h17.6zm274.44 0H1585v-.96h33.5z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1619 684.48h-.5v-.96h.5z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1325.95 688.63l-14.27-4.63 14.27-4.63z" fill="#3a414a"/><path d="M1326.42 689.3l-16.28-5.3 16.28-5.3zm-13.2-5.3l12.25 3.98v-7.96z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><use xlink:href="#u" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(0 17.22222222222222)"/><use xlink:href="#v" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(9.20138888888889 17.22222222222222)"/><use xlink:href="#w" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(39.95659722222223 17.22222222222222)"/><use xlink:href="#x" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(60.05208333333334 17.22222222222222)"/><use xlink:href="#y" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(115.47743055555557 17.22222222222222)"/><use xlink:href="#z" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(0 43.034722222222214)"/><use xlink:href="#A" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(60.06944444444445 43.034722222222214)"/><use xlink:href="#B" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(129.19270833333334 43.034722222222214)"/><use xlink:href="#C" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(192.421875 43.034722222222214)"/><use xlink:href="#D" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(201.62326388888889 43.034722222222214)"/><use xlink:href="#E" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(0 68.84722222222221)"/><use xlink:href="#F" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(64.91319444444446 68.84722222222221)"/><use xlink:href="#G" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(74.11458333333334 68.84722222222221)"/><use xlink:href="#H" transform="matrix(1,0,0,1,1344.0592021099378,647.4322916666666) translate(140.9982638888889 68.84722222222221)"/><path d="M859.47 682.14H761.5v-.95h97.97zm304.2 0h-82.08v-.95h82.08z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M761.5 682.14h-.5v-.95h.5z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1178.45 681.67l-14.27 4.63v-9.27z" fill="#3a414a"/><path d="M1179.98 681.67l-16.28 5.3v-10.6zm-15.33 3.98l12.26-3.98-12.25-4z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><use xlink:href="#I" transform="matrix(1,0,0,1,859.4732625982672,670.9114583332944) translate(0 17.22222222222222)"/><use xlink:href="#J" transform="matrix(1,0,0,1,859.4732625982672,670.9114583332944) translate(101.02430555555556 17.22222222222222)"/><use xlink:href="#K" transform="matrix(1,0,0,1,859.4732625982672,670.9114583332944) translate(155.12152777777777 17.22222222222222)"/><path d="M1840.47 988.04l-.07 1-.24.98-.4.94-.52.86-.66.78-.77.66-.86.53-.94.38-1 .23-.98.1h-68.64v-.96h68.6l.88-.07.85-.2.8-.33.75-.45.66-.58.57-.66.45-.74.33-.8.2-.84.08-.88v-94.96h.94zM1835 683.6l1 .24.94.4.87.52.78.66.66.77.53.86.4.94.23 1 .07.98v155.74h-.94v-155.7l-.07-.88-.2-.85-.34-.8-.45-.75-.56-.66-.65-.57-.74-.45-.8-.33-.84-.2-.88-.07h-84.48v-.96h84.52z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1749.5 684.48h-.5v-.96h.5z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1764.88 998.65l-14.26-4.63 14.26-4.64z" fill="#3a414a"/><path d="M1765.36 999.3l-16.28-5.28 16.28-5.3zm-13.2-5.28l12.25 3.98v-7.96z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><use xlink:href="#L" transform="matrix(1,0,0,1,1776.5538194444443,845.7204456730454) translate(0 17.22222222222222)"/><use xlink:href="#M" transform="matrix(1,0,0,1,1776.5538194444443,845.7204456730454) translate(0 43.034722222222214)"/><use xlink:href="#N" transform="matrix(1,0,0,1,1776.5538194444443,845.7204456730454) translate(72.03993055555556 43.034722222222214)"/><path d="M1400.16 994.5h-73.7v-.96h73.7zm218.34 0h-89.6v-.96h89.6z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1619 994.5h-.5v-.96h.5z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1325.95 998.65l-14.27-4.63 14.27-4.64z" fill="#3a414a"/><path d="M1326.42 999.3l-16.27-5.28 16.27-5.3zm-13.2-5.28l12.25 3.98v-7.97z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><use xlink:href="#O" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(0 17.22222222222222)"/><use xlink:href="#u" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(0 43.034722222222214)"/><use xlink:href="#v" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(9.20138888888889 43.034722222222214)"/><use xlink:href="#w" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(39.95659722222223 43.034722222222214)"/><use xlink:href="#x" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(60.05208333333334 43.034722222222214)"/><use xlink:href="#y" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(115.47743055555557 43.034722222222214)"/><use xlink:href="#u" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(0 68.84722222222221)"/><use xlink:href="#P" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(9.20138888888889 68.84722222222221)"/><use xlink:href="#Q" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(42.78645833333333 68.84722222222221)"/><use xlink:href="#R" transform="matrix(1,0,0,1,1400.1572923877159,957.4491872907224) translate(111.90972222222221 68.84722222222221)"/><path d="M1037.2 994.5h-23.93v-.96h23.93zm142.37 0h-39.82v-.96h39.82z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1180.07 994.5h-.52v-.96h.52z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M1012.77 998.65l-14.27-4.63 14.27-4.64z" fill="#3a414a"/><path d="M1013.24 999.3l-16.28-5.28 16.28-5.3zm-13.2-5.28l12.25 3.98v-7.97z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><g><use xlink:href="#S" transform="matrix(1,0,0,1,1037.1980166114968,970.3554372907222) translate(0 17.22222222222222)"/><use xlink:href="#T" transform="matrix(1,0,0,1,1037.1980166114968,970.3554372907222) translate(0 43.034722222222214)"/></g><path d="M696.48 602.62h-.96v-74.96h.96zM520 504.48v-.96h53.64v.96z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M520.02 504.48h-.52v-.96h.52z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M696 617.38l-4.63-14.26h9.26z" fill="#3a414a"/><path d="M696 618.92l-5.3-16.28h10.6zm-3.98-15.33l3.98 12.25 3.98-12.26z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><g><use xlink:href="#U" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(0 17.22222222222222)"/><use xlink:href="#V" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(42.77777777777778 17.22222222222222)"/><use xlink:href="#W" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(87.96006944444444 17.22222222222222)"/><use xlink:href="#X" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(124.765625 17.22222222222222)"/><use xlink:href="#Y" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(0 43.034722222222214)"/><use xlink:href="#Z" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(72.13541666666666 43.034722222222214)"/><use xlink:href="#aa" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(86.66666666666666 43.034722222222214)"/><use xlink:href="#ab" transform="matrix(1,0,0,1,573.6374050574323,480.3385416666667) translate(127.40451388888889 43.034722222222214)"/></g><path d="M840.48 638.87l-.08 1-.24.98-.4.94-.52.86-.66.77-.77.66-.86.52-.94.4-1 .23-.98.08h-56.64v-.95h56.6l.88-.07.85-.2.8-.33.75-.45.66-.56.57-.66.45-.74.33-.8.2-.84.07-.9v-232.4h.96zM835 323.6l1 .24.94.4.87.52.78.66.66.77.53.86.4.94.23 1 .08.98v29.12h-.96v-29.08l-.06-.88-.2-.85-.34-.8-.45-.75-.56-.66-.65-.57-.74-.45-.8-.33-.84-.2-.88-.07H520v-.96h314.02z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M520.02 324.48h-.52v-.96h.52z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M776.88 649.5l-14.26-4.65 14.26-4.63z" fill="#3a414a"/><path d="M777.36 650.14l-16.28-5.3 16.28-5.28zm-13.2-5.3l12.25 4v-7.97z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><g><use xlink:href="#ac" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(0 17.22222222222222)"/><use xlink:href="#ad" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(101.02430555555556 17.22222222222222)"/><use xlink:href="#ae" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(0 43.034722222222214)"/><use xlink:href="#af" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(73.828125 43.034722222222214)"/><use xlink:href="#ag" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(100.00868055555556 43.034722222222214)"/><use xlink:href="#ah" transform="matrix(1,0,0,1,719.8263888888889,359.0955255093187) translate(169.13194444444446 43.034722222222214)"/></g><path d="M859.2 877.4V731.13a6 6 0 0 0-6-6h-75.82" stroke="#3a414a" fill="none"/><path d="M859.68 877.9h-.95v-.52h.95z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M762.62 725.14l14.26-4.63v9.27z" stroke="#3a414a" fill="#3a414a"/><g><use xlink:href="#ai" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(0 17.22222222222222)"/><use xlink:href="#aj" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(106.76215277777779 17.22222222222222)"/><use xlink:href="#ak" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(185.26041666666669 17.22222222222222)"/><use xlink:href="#al" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(0 43.034722222222214)"/><use xlink:href="#am" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(51.36284722222222 43.034722222222214)"/><use xlink:href="#an" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(67.46527777777777 43.034722222222214)"/><use xlink:href="#ao" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(127.5 43.034722222222214)"/><use xlink:href="#ap" transform="matrix(1,0,0,1,867.2031401550765,785.3659833997568) translate(163.73263888888889 43.034722222222214)"/></g><g filter="url(#p)"><path d="M200 626a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6H206a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M200 766a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H206a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#aq" transform="matrix(1,0,0,1,200,760) translate(20.253333333333345 18.879999999999995)"/></g><path d="M275.07 675.6h-.2c-2.9 2.68-6.65 4.4-10.87 4.4-4.22 0-7.96-1.72-10.86-4.4h-.2l-8.87 8.9h39.86l-8.86-8.9zM288.1 686.67h-48.25c-1.32 0-2.22 1.1-2.22 2.43l2.22 24.38c0 1.1 1.1 2 2.2 2h43.83c1.1 0 2-.9 2.22-2l2.2-24.38c.28-1.34-.83-2.43-2.2-2.43zm-32.06 18.37c.42.45.42 1.15 0 1.6-.48.45-1.1.45-1.6 0l-4.4-4.93c-.44-.38-.44-1.08 0-1.53l4.42-4.86c.47-.44 1.1-.44 1.58 0 .42.46.42 1.1 0 1.55l-3.8 4.03 3.8 4.16zm13.3-7.94l-8.87 9.54c-.48.45-1.1.45-1.6 0-.4-.45-.4-1.15 0-1.6l8.87-9.47c.48-.45 1.1-.45 1.6 0 .2.44.4 1.08 0 1.53zm8.8 4.6l-4.38 4.94c-.48.45-1.1.45-1.6 0-.4-.45-.4-1.15 0-1.6l3.76-3.97-3.75-3.97c-.42-.45-.42-1.1 0-1.53.48-.45 1.1-.45 1.6 0l4.36 4.86c.27.45.27.9 0 1.28z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#697986"/><path d="M256.67 675.6c.47.44.9.7 1.32.9.25 0 .25.18.46.18.43.26 1.1.45 1.53.7.47.2 1.1.2 1.57.46h.43c.68 0 1.1.2 1.8.2.62 0 1.1 0 1.73-.2h.47c.43 0 1.1-.26 1.53-.45.43-.27 1.1-.46 1.53-.72.27 0 .27-.2.48-.2.42-.18.9-.44 1.3-.63h.23c3.53-2.43 5.95-6.46 5.95-11.07 0-7.36-5.95-13.3-13.23-13.3-7.34 0-13.3 5.94-13.3 13.3.2 4.42 2.64 8.38 6.17 10.82z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#697986"/><path d="M379.26 684.48H329.5v-.96h49.76zm235.36 0h-33.88v-.96h33.88z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M329.5 684.48h-.5v-.96h.5z" fill="#3a414a"/><path stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><path d="M629.38 684l-14.26 4.63v-9.26z" fill="#3a414a"/><path d="M630.92 684l-16.28 5.3v-10.6zm-15.33 3.98l12.25-3.98-12.26-3.98z" stroke="#3a414a" stroke-width=".05" fill="#3a414a"/><g><use xlink:href="#ar" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(0 17.22222222222222)"/><use xlink:href="#as" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(68.36805555555556 17.22222222222222)"/><use xlink:href="#at" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(4.674479166666667 43.034722222222214)"/><use xlink:href="#au" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(17.77777777777778 43.034722222222214)"/><use xlink:href="#av" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(85.32986111111111 43.034722222222214)"/><use xlink:href="#aw" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(140.75520833333334 43.034722222222214)"/><use xlink:href="#at" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(4.674479166666667 68.84722222222221)"/><use xlink:href="#ax" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(17.77777777777778 68.84722222222221)"/><use xlink:href="#ay" transform="matrix(1,0,0,1,379.2578125000564,647.4322916666666) translate(96.45833333333334 68.84722222222221)"/></g><defs><image width="10" height="10" id="bj" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHYAAAB2CAYAAAAdp2cRAAAAAXNSR0IArs4c6QAAIABJREFUeF7VXXl8lMX5f56Z990jCTcoKhVEEAhJdnNweRS0VkUFSUKs2lIPPKvVtt62Ftp6VXqordhDa8WftRJyCKjVqqC1KpJNdjcQRFAQPKrcIdfu+848P2dDEDDZd3azWcx+PvxDZp55nuf7zswzzzzPMwi9/Hdm9psD+5sZgy2kIQa4h9jUUogIx5OkYwhpKAENRKIsAHQBAgJBBICagbGdSPgZAPsIkDYZ6AnYZP2PG2z7zqa27a+8O2knAFBvVQ/2TsaJzfaFzjaMrD9F7F2ZQNIDCB4EBhTDIlE8FOIKcwIgigBim8vo3yxl6zXldXnLAVD2Nj31SmBLfcHxhuF9K2Lv6qMA6YmfAtltDIBoW7O/am1BqCfG6EmaPaOVnuQYAEp9NY8Q0FwCafbsUAwQ2FOVocLv9ew4qafe64CdBiuMIfmDXrRF6zSl9dSr5ECKBAbLCHxQF50SgCKrZ8dKLfVeB2zx2FWD0M2ekyQnYk+twwfoGImta23hU1/YWLAttarvWWq9DthSf91oSdFqAhiH0EMb7EE6x60g+JlVawrX9SwUqaXe64Atya89HaR4lEAOT60qOqeGwLcB8ksrg/nPpWO8VI3R64At9tXcCiRvAaSBqVJCXDoETYju31eG/D9Py3gpGqTXAVvir32WyD4bgIwU6cCBDAqO7jeWBH3T0jNeakbpZcDOZxcWXPxqROycSmCnRgNOsAIDtzEoZAduLSyHcpGWQVMwSK8C9oKitfnCthfZFMlJ3LuUrLYQOLo3ETcurAiMX5UslXT361XAzspbNZch3kVAQ9OpKATcKUn+sjo8+cF0jtudsXoVsBcUvndnRDTeRGT3TcMRNqZX5VpkwJtNPuDhZ2pH3dodZaezb68Btix7jcs2WhYA0JXK4Z9OJQFAFIA91dbc/5oXNo6OpHnspIbrTcBmCVfbw0TiuwDAk5I22U6EkjG2zGrNmrN0/di9yZJJZ79eA2xJ3oZhHFsW2hCZkT7DqQMKZUC5VtrgvrQ6OG5zOgFKdqxeAWxZYU0/YdMFAHATgRyVrLDd6YfIt6CE3wnGn6gO5u/uDq109P3aAqtucfoW9B3BBX6TMz5BkjiNpDWq5290ulA7oUTkmxH5y5LkKhLyNXPNB5vL4fyv5dk2KWDLhr3ptQe4S5DDiSTpHRFp+/fS9Z98BikScvqot/t6s8zLgPBMSXY2Q3YUAZkAhzuQQdnizCKgTzgzGojguTbB//Fcfd6u1MxCYsV54cEMaRoydjKJaMCKZFUms68nBWyJf/UdAOwyIHksAPsYka0Dku8DuFYxZr1YXpf8FVdpfu3VIMRZxHAikTwq/fupLkQMGBofEYnVQOy5D025KBBI7s52lr+uPyfjDInRExmx4wFpDJE8FgE+IaInuO29t7whJ6rLmWqXMLCz8lbPZch+Q2D3329aEEpCiiCwRpfRf7uQkRVStP2faOTrqzfr7UcluatHcsOzyJatY4BgICD18CV6ImqK21Ygsp0MXQ0R0XbpsvCkTTqUp4/a0Ned1TSSE59jGt4zomLPICLRHwjdB8qOYOxBwtsrwgWP6ND90txLoPWFOfVHWoZYJygy4KvdVACZ+k5UOAm0KJAlis8Q+IcojXsqwr4u3XHnF6y9wxYtlxLQSIBeA+ghKkCBQFs47/NYeW323V2pdaZvdb7B2C0g5RhAPhRI9AWATIptMx06PLg3Q9duy91v7NJVIz/ThUt7xqrlws294ai9Z5j2TCeUgCAN5m0jkp9KEn+wwH51b6h5/Uo41S7OCx2BaP0NEE6VJLypuzjviFLsmPSHitnx9449W1sNTnolhmYrEP2Hsb5zyutGb4sZgXnm8QZ6pyHy6xgzhtuixRtzaOmvSmTyfo1R6R5RHTxOyyLXkijm9TFbKgDoLADoxnUZEkNuA+AWKe0VjLsLpLTyAYQWH51rFYmIABFVTJJA4MLgmQJISotatjBgDRwztjAGsZglIYUhKTqMSGQbLOM4QMZs0cwJbA6AHAiMWCwqUDd4YmSge60to68yxtUV43BJttE9mmpCs1cM23u2zn7ryPw0IGOgL3ADQ/c8QS19nD5Z57+3LzcIBhBI2mfpOvLxVbqoNG8bLGtbVDTt4Mx8w2B9gtJqrAfRtr684UQV8O34U2dkacFYw8zItWXUJ2XkZIP1GSJk85B2SzwpgCm2JSFHIvU9db7EOjJ3SAODZUaEaP3lh2Fc4BRc56jQ2XmBUwSIhQQ0Ph3BY/GFjbFrA8F2xswdQkY3SvDcujTsW5+okuK1L/U3jBbU/CuO5nhJkUEAOKR9pUo0ED2VXKlY9thXtgnAuKIqXPhqPOpxgS0ZVzsc3PAQkT0dYl/v4fshoMXQ9aEEO4iSVUpofaUqfNLnPclRLCLSZZ4KSLMReT5R9Lj2WXw4f2gz4K+1SXnlc/UTPuiKky6BVZv+QF+f2wnlDUA06PCJElvSNiPItwhgeWuTvfyFjZMb08nPjKNrMoxBcA5jfCahnAwkR7VbsYfrx3YD4J+2GPDzrs7OXQJb4q+bACAfkCSmYHL7TLelRuB7MbZ3uh9vlC0rX6jL3w6Ah2k9JCwe+85A09PnFAnWpZKsqQSiX7eFTIqAsi8wCGj8sDKY/9/OSHQK7PRRtUMys/AmSeJaApGZ1NhJdlJpUaorA/4hEX+YmPlydTAnmCS5HulWnBfKAaRvA9hXEYgT1CCpO6rpssxaGON/a43Ydz/fMPF/h/bqFNiyvNBZktm/lmTn6Q6TsnbIBBIPfRFDdq/1mXx+2SdFLSmjnUJCyl9Og71nSKRbQYqins8j+irziMY6INdPK0O5VY7AlmWvySJT/pjQ/pmkqCsJr2O31IfofoOk6xojPG5dOeDX8uakQ8AyIB7NrxvDCR8gsk5NX0is4oCAoSuKYDzQ3PTR3S9sPPsgu+MrM7bM33COxOjDUkaHp9e8V14iesom953Lwj4tf2u3vqAUdo6dHlziTgKYm+4bKIaujxhz31Rem/3MgSIdBKwy77nL+JlEeT2BTKMTXlm++HxEuL6XuiuwFCKnQUq5XBHsJ4BgZjrBRWASgT3aaol5B+61BwFbmhPII05PEYgcDVlS1oQAnrSk94ZUglqWveZYadJkwogfpBjtMgeZDBm0WNsFA9yIzBVkwv12eXhsylaHaSM2efr32/5HBDk3ZcrRIITA3+WSXVZeX/BWR/P9wKpz65H+I84RKKqFbNUg170myvpFVF8bf0MCXlIdzE86lmj6qA1udO0a4HYbY5iUFxhGv1lINNSSzUCkHFVyXwmDdmemSqtF5GCwTFBJV5bYswwJ/yFN2bBzx95dKzef2pasdGX5tUOkhKclimlEkqXDWubMAxzMizfWtTzd4WrcD+ysnJrjmUH/JKKidOytCliOZgCIXVIR8q9NRpHKMm0bmDnUzfFSSZHLlSOFVBGRhJ0H6qpROXVxB+PuRULIx+xt9kfJWuSz/HUjGNHTEqxJ6QC2/XNldSjwkoo1heF9xy+AMljMbf/o0xjgS5LUx+roQk4Gh4P6ILBNiMZPKoL+pckU75iVGyhERqcjws0AOEjNzFT81EwGgp0E8KABxr/KQ/53Eqc7nxX7z/sWgnyYyB6deP9EeygL2Q0g2ezN4beXBuAqK4bgzDFv9DG8ntuJxO2JkkymPUPW+MV8/QXb0fZI+UcnJrTuz8x5+0gX9/gkyoVE1vHJjK/bB8H4lDFzrmyLBivXFX2q20+1mzZihWdQ//5zAOzfSJLqMr3Hf0T4AEbprqp3J+2IATvjhJrBLi88LkGc2+OjK58SmstRuO8orx9Xn8h4M/NWjzEYXgzAriSy0uK/RnDtBRB/Qct4vKIhsS2jLC80hpj8rST7nHT4lhH4i1ELrlzeULQlBqyKCszIct8JgDcKVeaoB9diBP4BMs8tFXU5FYmAGlt6Od6IJGYSyLS6ORFZKxD7F0l7QVX9pP2Wpw7/pflrSqVsuxtAjNFpn0ybdnvFrfwAC1ua6BeqXsa+zZTYdwo2jBEUuUnI1kuTvFx24ImUBRpl6Ppnq8AfJXK0mZmzqogzuBWQnQUgs5IRvvt9sAWIXpUS7312zcQ3demdkxse4OXiLkH2XADh7pk5gwrYf3L0/Pqzuk/WqrCjA6wkwhl574wwkf+cgL4HILsRAtOZ2EyV1lkLJG8tD+Zq13NQy5lAez6BPBdAqNJ5ujpNcTt1N8FaEPlLyGBeRW279anzK8kNn84Ndp+QrYWpX5JjbtcKW9rzltW/9B7A/Nh94iFaIpw5pu4ow01XIINrJYkhqTv6sAgD86lPdrRc95amwXR29jtDvSa7gYB+mMzyi6iCHqQkkM2AGEFAFYTgRsIsFeuUnCXNWhjgo0Tmgsqw7yMdYPcZUvcR2VcSSK9OH+c2qOKadxDRY1GLHl7eULj1wCvNTj//c3L/M8DNs85DgtskWGNSAy5+QoTXV4cnaO+ts331ZxDYT0uIJlRIJOZ4QLbelq1/IynCKHCvNNqD2ZgNJjPMTAHWeIN55yLieEs0OevxgBaIrl0czSvL63KW6HYs8decQ1I8BAgjdft03Q4B0dgMxO6jSGSJsoIPbRs3gqJ/XkYZZ+YvZOwsluz9dnsgF2ee+miL+yTddAV10Y8glkgSx+oqApG3gqT/MjQfROvolR94t0QCgUIVFalIdAigIhChEALGyGyPW7jlZBDRHyPCVBkzyvTkROAfE5nfrwr74sYedfCubs2ky/6XpMhJ3QtuU7o0twhpzd8Van5S7aed6cdxwyrOW52DSIsIwJ+sUYXIWwDxb5V1hT/UAUl5lOQg1w0SxL067WMzEc1tSPK3S0JF9yde/pSwzBe6VqC8ncg+OgFw72ptthfohuqU5tfeK0n+YF+QuK5oB64V6qvbSGieXx3Mjxt84Aisolo87r853JO5UMjIlMTjipFcvN9HzU2tU5a/5/9YRxrl3uQGC0iyNEJPUBo8Y62Q1jVdhYnojKnalPmCE4GbD9myuYiIHP28sdAdMKZWhPx1OmOcOa7mqP4Zff4dtRuzAaSW7g+gSwbz1tjR1iuq1k5yrMaqTXz6qIfcWX2mLrdlZCIAJeJJEUDsv1XhCVN1hFc3JEMG7LlbSPsnBE737AgGywo3RujUFxvGa8URO/GgjicZBltuU+skIBk3cx6Bq5VioQ3yp7o5s8W+mmUA4kwA0I92JNhrcM/atXXrpzbA+VrJWdrAtitkPiv1n3cfkTVXVe52UlLs74QRxtwPVQR9t+i0nzmm9mjDY9cR0BFO7RHNz0Hy8yrDvred2iby99Kc+iIw7MWSrOOclmV1O2STeYpubPNsf2i+kJGfAJJG8L0K3GO7AXFRVfC+GyGBOlMJAtuunhJf7S8B6SIiW8NXiy1cuq5bUu9/XEe5xTmrvw2cnncKM2FgNBOjeZV1Rb/VoZtom2J/4FpG9GvpGMyHNgI/n4feX6qTBF2SW3cRofUQoHNIL0O+SRIsbmv+fN4LG89OqKhJUsCqaAGGdB9IcZXTgZszVyPZfFJFfd67Osot9q/+BxBd6DhTyHy+Mlxwjg7NZNuU+AOqvN/M+P3V0YMtsT7/9OJln8xwDLxT1VsRcIWgyDHx6cbyb59gUeu28k6iEJ1kSgrY2KVBBi6SJFSGQJwxCDzG4N2797w3VPeLKyto2GWLvftzbzsjbrAMIJvOXlKf94KTgN35++y80CnI+eu2bI5LxuR99piN5rFPbRztGMiuEty41/NexN4+PL4XTYUDGK9QFOZWriv4MFE5kgK2LHvNUPDA87Zoyndy8Rksc1N5XY7WoVx9zZx53rNEfP0YvE8Y2uRJ5Q05iXkWEtUOAJxf0BCwxN6CeF0N3gcYQuEzgexanSHK8tfW2bLJH78tAWdZYUQsLa8dv1GH7oFtkgPWFzyGGLwkZFt2fGBjNfWrKkOFJTqMlfhWX4XI/iTjXJozNJVj8OrtocbHujqc64yl22a2v+67BPB/kro2RhmqzEH4cWWw8AEduiW+wCICOSd+pAcBR+964jirIqC3jXUbWBVuiW56WZLtUJpH7ROeBRXBXC2LuNi36k8AeFX85Z3ZRHRWdXjCq+lI95iZU1tkcPFm/IDw2Px4vCo08TIdYGf76+dLiMwjin+cY6CMJ5pZFZ6wRodu94HNXT2SGL4CIEbEG1Cd8wTAbc+Gin6tw9gFBRsr2sT2Eoc6ibuQjLMrw4UpPeJ0xd95+bXZjOzX4yWmqXqLXj5o2dO1ox0MrfZRivNqrkcGDzoBq2pLEYqZVXXODolD+U9qKZ6Z/eYow2W+oiqbxAfWAAH21c+GJv1ZB9iLijZVt1ifnecA7Oe2bZ+7bO1Jq3VodreNitrgQCsBu664GgPWOOK5pwMjtSJQZuW+dQnnrsfjbTmKb+WPtoFmLA1N0PJsdXvGKmC5abwKQN9wAtaCyNXLQidqAvthdYv1qSOwQsA5S9dMqukuaDr9ewLYmXmrLjaZ+XcZy3bv+pd2YFXpHuCwwnnGclBJS9XBCcox7/i7sHBjZau9vTj+jMWdjNjZFeGitBSF3rcUvwZEg7sSQM1YjzFo+T8Do2c4Chlz8NT8EFAllDu5TNlWYHxGVV3iL3UltRTPGls3gnvo35IsR+OJM++vl9Tl3KYjcHHeqr8C4uXxjSe0gejMqvDEFekxnlYVGZw5Gk9E8snq8OTv68g5218/T0JkvhOwCHwTpdV4ygsNYxxftGVLdvzZFcvJWVIZLCrTEbg4d/W1jLM/xj/uuICAX8qDuU+mIxuvJL92NhKWxzvuqEgNArq5Klj0Gx05S3yBxwnkJU7HHYae94Cz89J23FEOCvTgc1Gxt8Cp0rfBMt4vr8vVqlhaWrh+LCOxzhbxSwJzllnjFYOnPRkeGt8lpKNlhzZlBWvfskXz5HiriMGzAIQxqTw0Riu4vCw/HLBla1ynhxqPs8x6RG9Jee2o9Dgopo96fYg3M+NJAnmms0txyO5Qa+DIhga966bvFL67J2rviXstqEJfhITTKkM5K1KAXZckSvPriziw1ZaM7+AyjL57AZq/UR4o2uPET2FhjTka+m/QcimisZIQLqmsS5dLsbCmHwnzHknRHzhfArgbVT5QRTB/g5PQ6u8lvsASAlHqdAnAiD9bES6apUMz2TYl/trFRJbDNqLWLL7M2kYX6OT6lOSGRzIuX9e8BPi7ZRu3LV2Tq11qr0PWpIynYt/qHyOwy9rTLZ1ihLAFwXV1Zcj/pI6CS3NXny0ZPet0baeiFwDw5spQodZRSmfsA9uU+AOXINCDsr3WYbxDiU3Av2uGCip09vxSX/B8SdGFOtd2qhQBEi1ilud3OtXYDmQyYWBL8gJ3ANK1BLGSs879CSOIrgcqQ34ty7gk7+1hgEYtgQp9jatQQGZsNYVn1jNhPee7LrjF+Wt8jCLPSFLR+/E/XCS2gyQ7RfdRw1Jf8OeSIjcBgtZFOwP2mZTwl6r6onm6/Kt2zsDsp0ZY4g8sJpLTALo+03UyuADA16pCE7+lw1jZsK1eGrz9N5LED3RCY0yW+fbnFJ2+MkXl3FW6S1afzApBracSkWNoDAfjMbBabtEt8VfiW11FINU9ciKhMTsRjXcqQ8u+6NceEO700wJWnVsND/+doLZzAMjlRPTgv6tgtr5bdrd+PuXFdd/UylgrzgmMQw6rCGznrxpRGJixShD8qDKY0y03Y6kvmM+Zeb9NrVMlScOpvhWC2YTET68I572jc6YuPj50hNnP/bIl9uYkHMxGKmjP/e9IxL5uaUOho5XsCGyxb9UJAPxRADGF1E2S0/mmE9QZGupYsrAiWKh1y6MqoZmD6ZYv6ls7Lj9fZsYbW0nS76vCBX9IPPwUoCSv5nJg/GYC63hSJWdB5Ro5rGjEFlBj0z3Vm0/VKjU72x9Q0+0Goi+LeCc2SdSdCg9Jy57zbMPkhvgbVZy/zsqtnc4Y3k9gaRhJXRHqCBj3hrP65U76+0rUKgNQnFs7BblcRiQ00yVjWd0thPQaB+P+JcH8lTpKK80LTQJm3UYEp1Ms4cvJGOygyncxMC6sCPlf1BnnkhGbPE0DGtUd9indCxgHYMx8nyS7uTLk/0p9pw5eOp2xasa4BpvfAiZ+Jcn26QsbV8SPkeQPKsNTluooQrWZnR+eTlIslhBNKMMu5jBAXCusloVErE6CbDJcrpjH3Y5GTY52JoBrPDfd1wGh38khcii/DM1mRNflS+py/qkry6ycmjOAi4cRQMtZ42Q4MjDXI8Kd26PmCys7iST5CrBnZq8dmOWKzgFkN0oZ/Ubi9Ry6YCkWhsoXsaj7Ol3TfWZ+7dGmpJuIxDWElPCzZ+1JWSQB5F4CiLR/oMyFAH0ROWt3XerO0H1yxax8/Dswfq+u40A5JYbb7F4CcQ2AzND9GOK3Y2rm/o+I/tDaRH99YePBdSYPArZkXM1R5JLqWHIFAHgTFjoOJyo0i/PMsKC2GyvrCl7WFU7VLWTMukuS/DYAqUw1R7tAl3aC7QgA2xD4a1yaPyuvzwvo9i/zBU9G7lpgi5bJzpa+LtX2dkjYpkJ3IpZ11/PrTtrS8aXuU9J8VpZXPFxyuk5S5AblpkyMvE5rZYwYEYbGP9zuzB89tco5oq+D6nk575zIOKj6GKcBUIq+eB2eD2yDqlbGG0B0X1V4klYiluqtXuvIzGz5FUH0SgnC0zPfJUoGrr8w8jwA4fBGFd8cA7Yse0WWcPW/CQHV4Tn2ISQqtm57BPYecu9NFbU5y3T7qHYKXG7wm4nkGalbzjQ5IIwA468KixYsXVuUkH+6NG/NDImRuwHsXM3RkmlGsaoxJH8vI9Y9BxUXMbzycQDSCu1IZuSOPmpJZmhWkWB36AaRd/QtLQjkSUmXIbHvE1idPBHTHc4676sMJQK5SAp8rLq+UHv5VdRm5dQfbxhigSSr2MmnngrOkdjLURvnHlRcxJNh3AkobkrFAE40EGJHhXnb9/T768rNx2kdfzpoluSFhnEOkwXZvyWytXNnnXjq7O8IxueMjBvQtt4sbyhS+5f2b/qo592ZmUdfJMH+LYFIy0eIxBe2trD5+4uLxMrE+/ufiQDL25fiHluJ9ysm5uAG86aKYO6/kingNdtfN80mcRoDuA4QBjhFI+gi0l7AC3cDyL8QwstVwQn/1u37ZTvC4vz6byJZ6j2FNNR8jpW4VS6V7/KouUSdOvYj2O5hYpUAND6V1nBXSlEeI4bmmyiMyxNdkjtozhzzbh+e0TLSBD7HltHvAdBAAkziccPY616q5N4uzlyLJeATbE9kQ/kHzvernclXll1zrHRxFaw2NT0vfykY8T2S7KKO7WI/sCqnhNysBMB+Ol1FMhkwG9F4ORIVV6t9IfGZ0d7ju6M29G3LajpSknpWjGa7WNbZ6kkVlXOjZnLXRTK9KqFqR0TsfYkAFktJ6xgzPqsO+vfo+H4741flNZke9higPEuCMB3dkskKfUA/VSQTpHH19j2fP9FR4POgNbfUt1rl4jwte7DY1FflUGmI+DeJxq26ycNd6ULVhPxo2DDXSM8QM9qvdbiUOEGKSB4DNsJ09TeUsFFrlxQgP+ToDjNgq11N7g+ibdss+OijqE4aZDwcVHWY/v2y7kega5zuk1OA55fbGrAPGLFLloQL/9PxnwcBW5a/YYigRhU9pxjr+Y12P2vK5y6f3dV4xAWJGlOpVFB3aClQB/TLfAIAz0+Zt06LIVTlgZ/kZNxRHvqyFMRXwCvz1RdLtP8sKepw0a01agKNmHLuPYbkuqMq7OvRh5ISYEqraWz59dI8UoZcwiV1tYboshED106G/MbyYN7fD2z0FWBn+Vf0ZzDwZgRxs6SomQ4L+UCGGLpXCHBfVh0cuyUZa7l7akq0N7Gy7LXDyGUtFGSpwL4UV7OLx496qNG0GZmPRFqjv1z2XtH2uMCqP5bmhWYQWvcTiLGJitrt9sgEI6NGEpu/q3Hnyu5U++42L3EIqKrmmRktJ0sm7wSyTzw8z7Pw9xHZnRV1BU8fymqn+6i6DAAXux1QXk4kUlQiTk/N+x9UIvYBIFtAwvV61ZrcdXq909NKJWiTpG8Cyh9JEOPVqOmwfg+WjkcYM56yrej8Z9dM3KoFrGpUkheYDEi/J5CT0mtIfckiAtuL6HrDAPfjjU0tKw+9mkoPjB2jEJZlNwxgLn6KgMhlh/0JNGT1hOz6qrqC1zrTQ5eWr7pDPNaieSoiEYDi1oToSQUr3zIg34CSVgJjz++I7n55ZcOpPV6i4ECZpgx703vUYNdpSHAuIPsmkcxO9fVbQjok3MuQPc4sz81d3W3HPdLEKnoje5DAVhGGaTQMOhOTRRmaG4jk2wD0HEXs1zsrDpmQghwax97SIXkyAsxAZJMlWWMTD+ZLJUcxWupV67eJ6Op4me6OZ9XZvuAZAtoeJMAx6d9HDlVK+2sbBPQxoutTgugG4hm/rA7kvp9K9V3grxvRRtbtHM0cKa2hgPANSMpVmUquYo5e5VzYgsy8vrKuIG6IkSOwyvrzZO661WCem23ZmlDsUTyxVBmD9qss9c+RjU5IMUKiiGn02RyxG7dx5lplYEZ9KzQ3MMKNul6sWNn8TM/xnHvGS2rLEdKaaLKMobZsGU6xKJKEax7uf7q7XUanHFh98DnzRoWM/n7XnkHznRw5WhpVr3xwt6sakFQ9xO5FVyCzUUW3k1zN0BhDZI3r3qUDIyBJhNjKACIILMp5VhRICls0bwXO1xks42MQIqZhZCbasvkYIjGWM88Ihga3ZbNJJNwSwI2gYqsYSw7QDpCUZWB+IClay5gxhUAeSdT9iu2IbHVrkzhdp9qqFrCK3bJRtUN4v8wNEXu3ymXR7qdAUwW3GJrbLdH6IFDk+daWwWtf2Dg6ou5WgdlLiGhibOtI2a8jQE0t3R0bSAf59gOVykL/0kuUwqFeKr1+AAAE+ElEQVSBEyOot6X73GfX5G5VK16Wd88JguN0g3mvJxDH2MKxgNuhmiC30R9bIruGLl0zWStBKyGJzs2uOdbjNtYLGekkYrA9fngf5jYDsw3A3sbQvVWg/at4AWxl/rX3C2q7uD1fJ50+6pR9SYoQIbFdBvMuWhzM+XFXlMvya6cSGT+VFDkewTiCwHJTLN1D6a9Dh4ecWJm7zbbsnOo1Rdq2RELAxs63/sCPAOhuIpHxJSOx57UtQGxz8/6NQrb91wbrEWj1rql6d9xXypp3JnTx2FUnGN7Mals2f4MIMpPJOEgpTLrECCUANRvcuxVEpKQ8PGG9TteLcsMD2tAag8y81sUzp0bsXX0JYs4gldMTq4Iee9oMjZYvXJV3VQaLtItyx7YcHSYObVPsq7kPEecgwJFEtB2Rvw9E7wMaqyItTdXL3ztRq+B0pwDn194Ggs5CRjlEclD39t9kpNPto5TOdwDItQjGchY1H9SNlz50hNjT6ZmshJCmANAoAlDldI9AAuX/fbqlue/tauvS5SxpYGcU1mS4yTXHhIxpEbl3Fedm5bbAtk9SVQJPPTbh5VnXE9AZqoAJIhvUnvmWYHB3IprQaqvAREEkdyCa7wPgSyTZwtTdRi3m5/pOGOpmcqaLZZ1iSestm6JP6lr4B4qQ1IzV0kE3G7V7vswxiNaZDPlkSWKyBHHM4TpLt4fy8P8hGW9Kst9mEl/a7KZ1gUBR/GJN3dRDst2/tsAeKFBxXugIYNGLkUAlXA9PVtju9ENgnxLQnyIW/OXAl5W7Q7Mn+/YKYGNGW37DcEbRhwVFVY5uT+qkE9rq8SLzdRZ1zS1vSLzEbJqZjQ3Xa4BV79bYZuQRIHERIKXx/fjYQUYi48tbm6w5Os6BwwHkoWP2GmDVQd+duXsBkrwCEBLOvOuesjEKBE/vamy++ut68d9rgVWry3cKN9wZFXtuJLL7JpFYnxS2ykPFgDebvN/CZ2pH35psWGpSg3ejU6+ZsUrG83yrrvqiiN8vAOjIbsicRFfcBSTvqQpP1iqpl8QAKe/Sq4D9jn/9BIFtjwsZSUu2Qoe2GXNtZtKcUx7KeSPlCPQQwV4FbBmUcbPo/lfarJ1TCTp9qy/lalL3NG5jcCgUWD1R95WqlDORBMFeBaySr9Qfek5SRIV6du/6UFNZX+QMS4NlvLW4LudkzS5fi2a9DtgSX82dBELdnqQlNZEAmxmYD1eG8m/9WiCmyUSvA7YsL3CWAPlnwvjvEWjKr9GMbWdoXFERzK/WaPy1adILgQ2NsVm0ikiOTY/fmG1lYE6vCPnXfm1Q02Ck9wE7qnaInSmWE8kJ6bizRWDv2sIzLZnSshr677EmvQ7YQqgxR/rNF23ZNlWVYusxzcQIqyrfGQGMsBOTvWvtWf66pt7rgI1Zxr7aRyXaFwP1dBJUzPm/uCKY/53DBVCy4/ZKYGf53pzo5oNeiYhdWT3lWmx/cmUA2KLlpCXB/DeTVfDh6tcrgS2EP5ujCk7+HgC/JyoaM74oquUBRJcCuT36MNFrPdVzX1+KvU4YcfG+LTbI+Tvqsh9dCZgeb0gKv4JeCaySX1W68Y4aluH17h4M3BiEhAMZugcRtfkkiuOI4CgCMRQB+wPJLJVMqgJbJJGFAE0AuBsRPwPET4DgQw4ZISBrm4W0E4S9w3QP2L4tsKU5VeE+KcRMi9T/AwqyCmejSf6HAAAAAElFTkSuQmCC" preserveAspectRatio="none"/><path fill="#333" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="az"/><path fill="#333" d="M1480-1018c71 176 71 414 0 590-106 261-323 444-679 444S225-168 120-428c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zM801-214c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" id="aA"/><path fill="#333" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="aB"/><path fill="#333" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="aC"/><g id="a"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#az"/><use transform="matrix(0.00837,0,0,0.00837,12.65544,0)" xlink:href="#aA"/><use transform="matrix(0.00837,0,0,0.00837,26.039070000000002,0)" xlink:href="#aB"/><use transform="matrix(0.00837,0,0,0.00837,38.552220000000005,0)" xlink:href="#aC"/></g><path fill="#5130c9" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="aD"/><path fill="#5130c9" d="M398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269v865" id="aE"/><path fill="#5130c9" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="aF"/><path fill="#5130c9" d="M1480-1018c71 176 71 414 0 590-106 261-323 444-679 444S225-168 120-428c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zM801-214c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" id="aG"/><path fill="#5130c9" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="aH"/><path fill="#5130c9" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="aI"/><path fill="#5130c9" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="aJ"/><path fill="#5130c9" d="M788 134v160H0V134h788" id="aK"/><path fill="#5130c9" d="M1341-140C1204-38 1028 20 789 16c-350-5-566-186-673-442-73-175-71-420-1-596 107-266 333-435 699-440 235-2 404 78 526 189l-78 122c-45 78-131 10-176-17-110-67-334-90-474-29-171 74-275 233-275 474 0 251 105 414 283 489 144 62 360 37 477-26v-263H916c-88 2-46-125-56-202h481v585" id="aL"/><path fill="#5130c9" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="aM"/><path fill="#5130c9" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="aN"/><path fill="#5130c9" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="aO"/><g id="b"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#aD"/><use transform="matrix(0.00837,0,0,0.00837,11.45016,0)" xlink:href="#aE"/><use transform="matrix(0.00837,0,0,0.00837,23.63688,0)" xlink:href="#aF"/><use transform="matrix(0.00837,0,0,0.00837,32.944320000000005,0)" xlink:href="#aG"/><use transform="matrix(0.00837,0,0,0.00837,46.32795000000001,0)" xlink:href="#aE"/><use transform="matrix(0.00837,0,0,0.00837,58.51467000000001,0)" xlink:href="#aH"/><use transform="matrix(0.00837,0,0,0.00837,68.97717000000002,0)" xlink:href="#aI"/><use transform="matrix(0.00837,0,0,0.00837,81.06345000000002,0)" xlink:href="#aD"/><use transform="matrix(0.00837,0,0,0.00837,91.71846000000002,0)" xlink:href="#aF"/><use transform="matrix(0.00837,0,0,0.00837,101.67876000000003,0)" xlink:href="#aJ"/><use transform="matrix(0.00837,0,0,0.00837,111.26241000000003,0)" xlink:href="#aK"/><use transform="matrix(0.00837,0,0,0.00837,117.85797000000004,0)" xlink:href="#aD"/><use transform="matrix(0.00837,0,0,0.00837,129.31650000000005,0)" xlink:href="#aL"/><use transform="matrix(0.00837,0,0,0.00837,141.41952000000003,0)" xlink:href="#aJ"/><use transform="matrix(0.00837,0,0,0.00837,151.00317000000004,0)" xlink:href="#aM"/><use transform="matrix(0.00837,0,0,0.00837,163.65861000000004,0)" xlink:href="#aF"/><use transform="matrix(0.00837,0,0,0.00837,173.61891000000003,0)" xlink:href="#aK"/><use transform="matrix(0.00837,0,0,0.00837,180.21447000000003,0)" xlink:href="#aN"/><use transform="matrix(0.00837,0,0,0.00837,191.17917000000003,0)" xlink:href="#aJ"/><use transform="matrix(0.00837,0,0,0.00837,200.76282000000003,0)" xlink:href="#aH"/><use transform="matrix(0.00837,0,0,0.00837,211.22532000000004,0)" xlink:href="#aG"/><use transform="matrix(0.00837,0,0,0.00837,224.60895000000005,0)" xlink:href="#aN"/><use transform="matrix(0.00837,0,0,0.00837,235.10493000000005,0)" xlink:href="#aF"/><use transform="matrix(0.00837,0,0,0.00837,245.06523000000004,0)" xlink:href="#aO"/></g><filter id="c" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="aP"/><path fill="#697986" d="M398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269v865" id="aQ"/><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="aR"/><path fill="#697986" d="M1366 0h-271v-632H417V0H146v-1446h271v622h678v-622h271V0" id="aS"/><g id="d"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.159999999999995,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.10222222222221,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.679999999999986,0)" xlink:href="#aS"/></g><path fill="#697986" d="M269-185h293c2-315-3-636 3-946L357-957c-27 30-93 19-114-9l-78-107 441-375h203v1263h260V0H269v-185" id="aT"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aT" id="e"/><path fill="#697986" d="M109-1043c42-259 201-419 493-419 211 0 351 94 417 243 41 90 43 220 9 317-53 155-161 261-266 368L436-201c149-49 364-22 553-29 51-1 87 32 87 82V0H84c-3-78 1-142 44-184 181-178 371-356 538-547 72-82 133-167 133-311 0-137-75-210-211-212-123-2-200 69-227 166-15 55-55 80-122 68" id="aU"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aU" id="f"/><path fill="#697986" d="M132-1043c42-259 201-419 493-419 203 0 339 87 405 226 20 45 31 94 31 147 1 186-89 278-229 324 157 49 258 146 258 336 0 229-131 357-306 416C606 47 366 8 264-83c-81-72-135-166-174-284 67-25 192-105 244-14 55 95 110 189 258 189 151 0 244-85 251-229 10-197-134-230-333-231v-176c179-3 309-43 310-218 1-134-78-207-209-208-120-1-200 73-227 166-16 55-54 80-122 68" id="aV"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aV" id="g"/><path fill="#697986" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="aW"/><path fill="#697986" d="M415-222h579V0H146v-1446h269v1224" id="aX"/><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="aY"/><path fill="#697986" d="M1480-1018c71 176 71 414 0 590-106 261-323 444-679 444S225-168 120-428c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zM801-214c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" id="aZ"/><path fill="#697986" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="ba"/><g id="h"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.577777777777774,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,20.755555555555546,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.94666666666665,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.12444444444442,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.23555555555553,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,65.44888888888886,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,76.59555555555552,0)" xlink:href="#aR"/></g><path fill="#697986" d="M493-744L32-1446h268c38 0 48 9 63 32l329 531c7-19 15-35 25-51l301-475c15-25 34-37 57-37h258L867-755 1346 0h-269c-37 1-57-23-71-46L671-600c-5 15-12 29-19 42L331-46c-14 20-33 47-67 46H12" id="bb"/><path fill="#697986" d="M789-562V0H520v-562L-7-1446h237c50 0 72 27 90 60 102 188 210 370 305 564 12 25 22 51 31 76 20-56 40-105 69-157l263-483c15-28 44-60 89-60h238" id="bc"/><g id="i"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.328888888888883,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.27555555555554,0)" xlink:href="#bb"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.34666666666665,0)" xlink:href="#bc"/></g><g id="j"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.577777777777774,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,20.755555555555546,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.94666666666665,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.12444444444442,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.23555555555553,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,65.44888888888886,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,76.59555555555552,0)" xlink:href="#aR"/></g><g id="k"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.159999999999995,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.10222222222221,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.679999999999986,0)" xlink:href="#aS"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="bd"/><path fill="#697986" d="M4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217L831 0H588" id="be"/><path fill="#697986" d="M449 0H179v-1446h270V0" id="bf"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="bg"/><g id="l"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#bd"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.715555555555547,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.359999999999985,0)" xlink:href="#be"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,43.982222222222205,0)" xlink:href="#bf"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.564444444444426,0)" xlink:href="#bg"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,61.48444444444442,0)" xlink:href="#aW"/></g><g id="m"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.577777777777774,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,20.755555555555546,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.94666666666665,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.12444444444442,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.23555555555553,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,65.44888888888886,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,76.59555555555552,0)" xlink:href="#aR"/></g><path fill="#697986" d="M1341-140C1204-38 1028 20 789 16c-350-5-566-186-673-442-73-175-71-420-1-596 107-266 333-435 699-440 235-2 404 78 526 189l-78 122c-45 78-131 10-176-17-110-67-334-90-474-29-171 74-275 233-275 474 0 251 105 414 283 489 144 62 360 37 477-26v-263H916c-88 2-46-125-56-202h481v585" id="bh"/><path fill="#697986" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="bi"/><g id="n"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.168888888888883,0)" xlink:href="#bh"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.02222222222221,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.19999999999999,0)" xlink:href="#bi"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.639999999999986,0)" xlink:href="#aR"/></g><pattern id="o" patternUnits="userSpaceOnUse" x="1653.56" y="962.53" width="60.88" height="62.98"><use xlink:href="#bj" transform="translate(-1.0495898936412686, 0) scale(6.297539361847409,6.297539361847409)"/></pattern><filter id="p" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="bk"/><path fill="#697986" d="M788 134v160H0V134h788" id="bl"/><path fill="#697986" d="M1058-1446v214H417v428h541v215H417V0H146v-1446h912" id="bm"/><g id="q"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.159999999999995,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.10222222222221,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.98666666666665,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.199999999999974,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,62.14222222222219,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,73.2533333333333,0)" xlink:href="#bk"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,86.08888888888885,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,97.4044444444444,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,107.98222222222216,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,118.15999999999994,0)" xlink:href="#bl"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,125.16444444444438,0)" xlink:href="#bg"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,137.0844444444444,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,151.29777777777772,0)" xlink:href="#bi"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,164.73777777777772,0)" xlink:href="#bm"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,174.71999999999994,0)" xlink:href="#bf"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,180.30222222222216,0)" xlink:href="#bh"/></g><g id="r"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.159999999999995,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.10222222222221,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.98666666666665,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.199999999999974,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,62.14222222222219,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,73.2533333333333,0)" xlink:href="#bk"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,86.08888888888885,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,97.4044444444444,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,107.98222222222216,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,118.15999999999994,0)" xlink:href="#bl"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,125.16444444444438,0)" xlink:href="#be"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,137.7866666666666,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,147.96444444444438,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,159.60888888888883,0)" xlink:href="#bd"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,169.1466666666666,0)" xlink:href="#bf"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,174.72888888888878,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,188.94222222222214,0)" xlink:href="#bi"/></g><g id="s"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.159999999999995,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.10222222222221,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.98666666666665,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.199999999999974,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,62.14222222222219,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,73.2533333333333,0)" xlink:href="#bk"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,86.08888888888885,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,97.4044444444444,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,107.98222222222216,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,118.15999999999994,0)" xlink:href="#bl"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,125.16444444444438,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,137.33333333333326,0)" xlink:href="#bh"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,150.18666666666658,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,160.36444444444436,0)" xlink:href="#bi"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,173.80444444444436,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,184.38222222222214,0)" xlink:href="#bl"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,191.38666666666657,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,202.60444444444434,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,216.8177777777777,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,226.00888888888878,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,234.48888888888877,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,248.7022222222221,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,261.64444444444433,0)" xlink:href="#aR"/></g><path fill="#697986" d="M100-707h518v206H100v-206" id="bn"/><g id="t"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.577777777777774,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,20.755555555555546,0)" xlink:href="#aX"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.94666666666665,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.12444444444442,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.23555555555553,0)" xlink:href="#aZ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,65.44888888888886,0)" xlink:href="#ba"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,76.59555555555552,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,85.5733333333333,0)" xlink:href="#bn"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,91.95555555555552,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,104.89777777777773,0)" xlink:href="#aY"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,116.00888888888883,0)" xlink:href="#bk"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,128.84444444444438,0)" xlink:href="#aP"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,140.1599999999999,0)" xlink:href="#aR"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,150.7377777777777,0)" xlink:href="#aW"/></g><path fill="#333" d="M440-1490V0H135v-1490h305" id="bo"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bo" id="u"/><path fill="#333" d="M440 22C227 22 68-92 68-313c0-250 202-322 422-343 195-21 271-24 271-105 0-95-63-149-175-149-116 0-187 57-211 129l-275-46c57-194 237-305 487-305 240 0 474 108 474 379V0H777v-155h-10C713-51 605 22 440 22zm85-211c140 0 238-93 238-211v-121c-37 26-156 42-222 51-111 16-185 59-185 149 0 87 70 132 169 132" id="bp"/><path fill="#333" d="M128 0v-1118h278l12 217c60-163 185-234 319-234 143 0 236 81 288 251 63-172 205-251 359-251 205 0 357 138 357 381V0h-301v-697c0-126-76-187-177-187-114 0-184 79-184 196V0H789v-705c0-109-72-179-174-179-106 0-187 74-187 208V0H128" id="bq"/><g id="v"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.321180555555555,0)" xlink:href="#bq"/></g><path fill="#333" d="M128 0v-1118h300V0H128zm150-1264c-91 0-165-68-165-154 0-85 74-154 165-154 90 0 165 69 165 154 0 86-75 154-165 154" id="br"/><path fill="#333" d="M428-647V0H128v-1118h283l4 231c63-156 176-245 348-245 232 0 384 159 384 421V0H847v-659c0-139-76-222-202-222-128 0-217 86-217 234" id="bs"/><g id="w"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,4.817708333333334,0)" xlink:href="#bs"/></g><path fill="#333" d="M625 442c-280 0-454-114-503-274l258-72c28 63 97 128 243 128 153 0 246-69 246-216v-206h-23C805-108 717-16 536-16 284-16 81-191 81-561c0-378 208-571 456-571 188 0 280 113 321 202h13v-188h295V-9c0 303-226 451-541 451zm5-686c153 0 240-119 240-319 0-198-86-329-240-329-158 0-241 137-241 329 0 195 85 319 241 319" id="bt"/><path fill="#333" d="M128 0v-1118h290v195h12c54-169 184-238 367-200v268c-27-8-86-15-130-15-138 0-239 95-239 234V0H128" id="bu"/><path fill="#333" d="M628 22C291 22 81-210 81-554c0-346 210-578 547-578 336 0 547 232 547 578 0 344-211 576-547 576zm0-236c160 0 242-146 242-341 0-197-82-341-242-341S387-753 387-555c0 195 81 341 241 341" id="bv"/><path fill="#333" d="M513 14c-232 0-385-159-385-421v-711h300v659c0 139 76 222 202 222 127 0 217-86 217-234v-647h301V0H864l-4-232C797-74 683 14 513 14" id="bw"/><path fill="#333" d="M128 418v-1536h295v188h14c41-89 129-202 319-202 248 0 453 193 453 575 0 372-197 576-455 576-183 0-275-108-317-198h-9v597H128zm534-640c156 0 240-139 240-336 0-196-83-334-240-334-154 0-241 131-241 334 0 202 88 336 241 336" id="bx"/><g id="x"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.23263888888889,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.038194444444443,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.940972222222218,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,40.00868055555556,0)" xlink:href="#bx"/></g><path fill="#333" d="M49 0l509-1490h400L1480 0h-339l-115-346H497L386 0H49zm524-585h374c-75-213-124-402-192-666-66 268-110 453-182 666" id="by"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#by" id="y"/><path fill="#333" d="M449 0L49-1490h333c89 395 194 758 253 1185 65-426 176-790 269-1185h317c93 394 201 758 268 1181 60-425 164-788 253-1181h334L1675 0h-348c-90-376-204-711-266-1118C1004-714 886-373 798 0H449" id="bz"/><path fill="#333" d="M428-647V0H128v-1490h294v586c65-146 175-228 341-228 232 0 385 159 385 421V0H847v-659c0-139-76-222-202-222-128 0-217 86-217 234" id="bA"/><path fill="#333" d="M628 22C291 22 81-210 81-554c0-346 210-578 547-578 265 0 455 142 497 372l-279 52c-25-116-99-188-215-188-160 0-244 139-244 341 0 200 84 341 244 341 116 0 193-74 217-195l279 51C1085-123 896 22 628 22" id="bB"/><g id="z"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bz"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.446180555555557,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,29.513888888888893,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.33159722222223,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,44.79166666666667,0)" xlink:href="#bA"/></g><path fill="#333" d="M443 0L31-1118h319c90 293 199 572 268 885 66-313 175-593 264-885h315L784 0H443" id="bC"/><path fill="#333" d="M633 22C291 22 81-200 81-553c0-345 210-579 537-579 292 0 525 185 525 567v84H378c7 183 109 277 260 277 105 0 184-46 216-132l272 51C1071-99 893 22 633 22zM380-669h474c-15-146-94-237-233-237-143 0-229 99-241 237" id="bD"/><path fill="#333" d="M572 22C302 22 117-98 78-306l279-48c29 105 101 156 224 156 114 0 185-48 185-115 0-118-228-130-337-155-215-49-322-150-322-317 0-215 187-347 470-347 265 0 424 116 466 298l-266 47c-24-76-87-130-196-130-98 0-174 46-174 113 0 56 38 95 144 117l201 40c216 44 320 143 320 302 0 220-207 367-500 367" id="bE"/><g id="A"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bC"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.338541666666668,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,20.928819444444446,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.16840277777778,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.125,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.942708333333336,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,53.845486111111114,0)" xlink:href="#bs"/></g><path fill="#333" d="M428-1490V0H128v-1490h300" id="bF"/><path fill="#333" d="M537 19C279 19 81-185 81-557c0-382 206-575 454-575 190 0 278 113 318 202h10v-560h300V0H868v-179h-15C812-89 719 19 537 19zm92-241c153 0 240-134 240-336 0-203-86-334-240-334-158 0-240 138-240 334 0 197 84 336 240 336" id="bG"/><g id="B"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,9.956597222222223,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.024305555555557,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,31.927083333333336,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.99479166666667,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,47.81250000000001,0)" xlink:href="#bG"/></g><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bo" id="C"/><path fill="#333" d="M390-458c-5-262 65-345 192-421 92-55 159-122 159-219 0-103-81-170-182-170-97 0-187 63-192 185H79c4-288 220-427 481-427 287 0 489 150 489 402 0 170-86 277-223 359-123 72-173 130-168 291H390zM525 19c-105 0-178-69-178-169 0-101 73-170 178-170 104 0 177 69 177 170 0 100-73 169-177 169" id="bH"/><g id="D"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,7.239583333333334,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.307291666666668,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,29.375,0)" xlink:href="#bH"/></g><path fill="#333" d="M681 22C323 22 94-145 85-462h297c10 151 131 226 296 226 163 0 271-77 271-190 0-102-95-149-257-189l-164-41c-252-61-403-188-403-405 0-269 236-449 560-449 330 0 546 183 551 445H941c-11-119-106-188-259-188-156 0-244 72-244 172-3 156 226 185 373 221 250 61 445 186 445 436 0 271-213 446-575 446" id="bI"/><g id="E"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bI"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.640625,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.708333333333336,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,33.611111111111114,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,44.67881944444445,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.496527777777786,0)" xlink:href="#bG"/></g><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bo" id="F"/><path fill="#333" d="M750 21c-371 0-615-218-615-544v-967h305v942c0 174 123 299 310 299s309-125 309-299v-942h306v967c0 326-247 544-615 544" id="bJ"/><path fill="#333" d="M683-1118v229H474v562c0 71 29 104 102 104 23 0 73-7 95-13l43 225C647 9 580 16 520 16 296 16 174-96 174-301v-588H20v-229h154v-266h300v266h209" id="bK"/><g id="G"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bJ"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.012152777777779,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,24.21875,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,35.42534722222222,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.74652777777778,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,52.08333333333333,0)" xlink:href="#bD"/></g><path fill="#333" d="M361 0L31-1118h315c68 295 127 523 188 845 63-317 128-551 199-845h276c71 296 131 525 196 846 57-321 119-552 186-846h319L1378 0h-305c-73-261-148-486-204-771C813-484 740-261 666 0H361" id="bL"/><g id="H"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.067708333333334,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.727430555555557,0)" xlink:href="#bL"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,36.84027777777778,0)" xlink:href="#bH"/></g><path fill="#333" d="M786 20C389 20 94-260 94-744c0-487 299-766 692-766 339 0 597 194 641 529h-309c-28-162-156-258-326-258-233 0-388 179-388 495 0 323 157 493 387 493 170 0 298-97 328-259h309c-34 277-266 530-642 530" id="bM"/><path fill="#333" d="M750-1118v229H516V0H217v-889H20v-229h197v-86c0-238 156-356 363-356 94 0 178 20 215 31l-54 226c-25-7-61-15-100-15-123-3-131 84-125 200h234" id="bN"/><g id="I"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bM"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.151041666666668,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,24.053819444444446,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,35.12152777777778,0)" xlink:href="#bN"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.34375,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,47.161458333333336,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,58.39409722222222,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,69.46180555555556,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,76.26736111111111,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,86.85763888888889,0)" xlink:href="#bE"/></g><path fill="#333" d="M135 0v-1490h581c339 0 533 210 533 503 0 295-197 500-540 500H440V0H135zm305-733h220c186 0 274-104 274-254s-88-251-275-251H440v505" id="bO"/><path fill="#333" d="M42 0l360-574-338-544h324c72 124 151 261 209 394 58-134 140-271 215-394h318L785-570 1146 0H824c-79-136-169-280-234-425C528-278 439-134 360 0H42" id="bP"/><path fill="#333" d="M120 396l69-226c123 42 245 23 254-107l8-60L31-1118h319c87 288 199 559 259 872 72-308 185-583 277-872h315L726 132c-68 181-186 294-410 294-79 0-153-13-196-30" id="bQ"/><g id="J"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bO"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.519097222222223,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.32465277777778,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.87152777777778,0)" xlink:href="#bP"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,39.18402777777778,0)" xlink:href="#bQ"/></g><g id="K"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#by"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.272569444444445,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,24.34027777777778,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.296875,0)" xlink:href="#bL"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.166666666666664,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,59.756944444444436,0)" xlink:href="#bu"/></g><g id="L"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bJ"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.012152777777779,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,24.21875,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,35.42534722222222,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.74652777777778,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,52.08333333333333,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,62.67361111111111,0)" xlink:href="#bE"/></g><path fill="#333" d="M135 0v-1490h468l242 684c30 94 76 293 111 455 34-161 80-360 110-455l238-684h470V0h-307c0-447-3-765 11-1227-122 503-246 788-395 1227H826C676-435 552-717 427-1215c15 453 11 775 11 1215H135" id="bR"/><g id="M"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bR"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,16.5625,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,27.46527777777778,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.532986111111114,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,43.35069444444444,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.6875,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,60.59027777777778,0)" xlink:href="#bu"/></g><g id="N"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.067708333333334,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.83159722222222,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,32.15277777777778,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,37.23090277777778,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,43.78472222222222,0)" xlink:href="#bA"/></g><path fill="#333" d="M135 0v-1490h581c339 0 533 192 533 485 0 204-94 351-264 424L1302 0H964L680-532H440V0H135zm305-779h220c186 0 274-77 274-226 0-150-88-233-275-233H440v459" id="bS"/><g id="O"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bS"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.458333333333334,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.048611111111114,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,33.28125,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.098958333333336,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,48.05555555555556,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,54.39236111111111,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,64.98263888888889,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,72.22222222222221,0)" xlink:href="#bE"/></g><g id="P"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,7.239583333333334,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.307291666666668,0)" xlink:href="#bs"/></g><g id="Q"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bC"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.338541666666668,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,20.928819444444446,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.16840277777778,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.125,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.942708333333336,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,53.845486111111114,0)" xlink:href="#bs"/></g><path fill="#333" d="M51 0l535-762-487-728h354c99 152 240 357 306 516 68-159 211-365 312-516h346L934-771 1461 0h-362C993-164 838-379 756-546 674-378 513-163 404 0H51" id="bT"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bT" id="R"/><g id="S"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bO"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.371527777777779,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.961805555555557,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,29.331597222222218,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.14930555555556,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.052083333333336,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,56.25868055555556,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,61.07638888888889,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,71.71006944444446,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,82.03125000000001,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,86.84895833333334,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,91.84895833333334,0)" xlink:href="#bQ"/></g><path fill="#333" d="M795 20C377 20 94-272 94-743c0-483 302-767 694-767 335 0 593 206 635 500h-310c-42-142-154-229-320-229-230 0-389 177-389 493s154 495 393 495c212 0 340-120 345-311H818v-232h620v186c0 391-269 628-643 628" id="bU"/><g id="T"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bU"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.34201388888889,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,23.932291666666668,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,35,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.59027777777778,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,52.58680555555556,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,62.907986111111114,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,69.24479166666667,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,79.83506944444446,0)" xlink:href="#bE"/></g><g id="U"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bI"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.640625,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.23090277777778,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.61111111111111,0)" xlink:href="#bE"/></g><g id="V"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,9.956597222222223,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,16.553819444444446,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,26.875,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.46180555555556,0)" xlink:href="#bK"/></g><g id="W"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.321180555555555,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.38888888888889,0)" xlink:href="#bG"/></g><g id="X"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,6.597222222222222,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,16.91840277777778,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,23.723958333333336,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.95659722222223,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.54687500000001,0)" xlink:href="#bK"/></g><g id="Y"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bM"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.151041666666668,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,19.95659722222222,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,30.72048611111111,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,41.04166666666666,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,47.378472222222214,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,57.96874999999999,0)" xlink:href="#bE"/></g><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bp" id="Z"/><g id="aa"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.067708333333334,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.414930555555557,0)" xlink:href="#bL"/></g><g id="ab"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,6.805555555555556,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,17.708333333333336,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.52604166666667,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,27.343750000000004,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.246527777777786,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.31423611111112,0)" xlink:href="#bK"/></g><g id="ac"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bM"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,13.151041666666668,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,24.053819444444446,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,35.12152777777778,0)" xlink:href="#bN"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.34375,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,47.161458333333336,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,58.39409722222222,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,69.46180555555556,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,76.26736111111111,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,86.85763888888889,0)" xlink:href="#bE"/></g><g id="ad"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,9.956597222222223,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,20.416666666666668,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,31.484375,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.07465277777778,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,53.28125,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,64.34895833333333,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,69.16666666666666,0)" xlink:href="#bD"/></g><path fill="#333" d="M169-607c0-330 107-732 258-974h279c-145 311-231 674-231 974 0 262 67 512 231 886H427C258-1 169-307 169-607" id="bV"/><g id="ae"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bV"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,6.701388888888889,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,17.022569444444443,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.229166666666664,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,39.435763888888886,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,44.25347222222222,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.07118055555556,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,59.661458333333336,0)" xlink:href="#bE"/></g><g id="af"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.902777777777779,0)" xlink:href="#bs"/></g><g id="ag"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bC"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.338541666666668,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,20.928819444444446,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.16840277777778,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.125,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.942708333333336,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,53.845486111111114,0)" xlink:href="#bs"/></g><path fill="#333" d="M67 279c166-379 230-627 230-886 0-300-86-663-230-974h278c151 241 258 644 258 974 0 302-90 608-258 886H67" id="bW"/><g id="ah"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.460069444444445,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.52777777777778,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,31.848958333333336,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.91666666666667,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,54.14930555555556,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,64.51388888888889,0)" xlink:href="#bW"/></g><g id="ai"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bO"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.371527777777779,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.961805555555557,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,29.331597222222218,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.14930555555556,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.052083333333336,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,56.25868055555556,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,61.07638888888889,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,71.71006944444446,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,82.03125000000001,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,86.84895833333334,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,91.84895833333334,0)" xlink:href="#bQ"/></g><path fill="#333" d="M128 0v-1490h300v802h17l366-430h347L740-633 1179 0H826L514-456l-86 97V0H128" id="bX"/><g id="aj"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.460069444444445,0)" xlink:href="#bA"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.52777777777778,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,32.11805555555556,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,42.578125,0)" xlink:href="#bX"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,52.49131944444445,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,63.08159722222223,0)" xlink:href="#bG"/></g><g id="ak"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,6.336805555555556,0)" xlink:href="#bv"/></g><g id="al"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bX"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.3125,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,21.380208333333336,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,32.03993055555556,0)" xlink:href="#bL"/></g><g id="am"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,4.817708333333334,0)" xlink:href="#bN"/></g><g id="an"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,6.805555555555556,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,17.708333333333336,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.52604166666667,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,27.343750000000004,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,38.246527777777786,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.31423611111112,0)" xlink:href="#bK"/></g><g id="ao"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.633680555555555,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,20.95486111111111,0)" xlink:href="#bs"/></g><g id="ap"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.206597222222223,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.01215277777778,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.914930555555557,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,40.14756944444444,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,46.953125,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,57.54340277777778,0)" xlink:href="#bE"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,67.5,0)" xlink:href="#bE"/></g><g id="aq"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.177777777777774,0)" xlink:href="#bi"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.617777777777768,0)" xlink:href="#bh"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.4711111111111,0)" xlink:href="#bf"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.05333333333332,0)" xlink:href="#bi"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,55.49333333333331,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,65.67111111111109,0)" xlink:href="#aW"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,75.84888888888887,0)" xlink:href="#ba"/></g><g id="ar"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bR"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,16.5625,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,26.883680555555557,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,37.95138888888889,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,49.019097222222236,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,59.340277777777786,0)" xlink:href="#bF"/></g><path fill="#333" d="M342-723c-98 0-173-75-173-172s75-172 173-172 173 75 173 172-75 172-173 172zm0 742c-98 0-173-75-173-172s75-172 173-172 173 75 173 172S440 19 342 19" id="bY"/><g id="as"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,4.817708333333334,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,15.885416666666668,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.22222222222222,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,32.8125,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,40.329861111111114,0)" xlink:href="#bC"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,50.66840277777778,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,61.25868055555556,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,72.32638888888889,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,78.83680555555556,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,83.65451388888889,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,94.55729166666666,0)" xlink:href="#bs"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,105.62499999999999,0)" xlink:href="#bY"/></g><path fill="#333" d="M485-274c-177 0-320-143-320-320s143-320 320-320 320 143 320 320-143 320-320 320" id="bZ"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bZ" id="at"/><path fill="#333" d="M75-1237v-253h1217v253H837V0H531v-1237H75" id="ca"/><g id="au"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#ca"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,10.859375,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.229166666666668,0)" xlink:href="#br"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,23.046875,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,34.279513888888886,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,45.51215277777777,0)" xlink:href="#bD"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,56.10243055555555,0)" xlink:href="#bu"/></g><g id="av"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.23263888888889,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.038194444444443,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.940972222222218,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,40.00868055555556,0)" xlink:href="#bx"/></g><g id="aw"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.067708333333334,0)" xlink:href="#bx"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.274305555555557,0)" xlink:href="#bG"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,33.48090277777778,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,43.802083333333336,0)" xlink:href="#bK"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,50.138888888888886,0)" xlink:href="#bD"/></g><path fill="#333" d="M754 19C571 19 479-89 437-179h-14V0H128v-1490h300v560h9c41-89 129-202 319-202 248 0 453 193 453 575 0 372-197 576-455 576zm-92-241c156 0 240-139 240-336 0-196-83-334-240-334-154 0-241 131-241 334 0 202 88 336 241 336" id="cb"/><g id="ax"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bS"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.458333333333334,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,22.361111111111118,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,27.17881944444445,0)" xlink:href="#bF"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,31.996527777777786,0)" xlink:href="#cb"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,43.37673611111112,0)" xlink:href="#bp"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,53.69791666666668,0)" xlink:href="#bB"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,64.15798611111113,0)" xlink:href="#bX"/></g><g id="ay"><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,0,0)" xlink:href="#bt"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,11.23263888888889,0)" xlink:href="#bu"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,18.038194444444443,0)" xlink:href="#bv"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,28.940972222222218,0)" xlink:href="#bw"/><use transform="matrix(0.008680555555555556,0,0,0.008680555555555556,40.00868055555556,0)" xlink:href="#bx"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/architecture/ssh-tunnel-mode@1.2x.png b/docs/img/architecture/ssh-tunnel-mode@1.2x.png
deleted file mode 100644
index d2247a64c62f1..0000000000000
Binary files a/docs/img/architecture/ssh-tunnel-mode@1.2x.png and /dev/null differ
diff --git a/docs/img/auto-discovery/auto-discovery-hero.jpg b/docs/img/auto-discovery/auto-discovery-hero.jpg
new file mode 100644
index 0000000000000..2abd692a0d6a5
Binary files /dev/null and b/docs/img/auto-discovery/auto-discovery-hero.jpg differ
diff --git a/docs/img/aws/allow-tags.png b/docs/img/aws/allow-tags.png
index 43cbbca289c14..71932b555bd53 100644
Binary files a/docs/img/aws/allow-tags.png and b/docs/img/aws/allow-tags.png differ
diff --git a/docs/img/aws/enroll-aws-access-awsoidc.png b/docs/img/aws/enroll-aws-access-awsoidc.png
new file mode 100644
index 0000000000000..225c15a7d316c
Binary files /dev/null and b/docs/img/aws/enroll-aws-access-awsoidc.png differ
diff --git a/docs/img/aws/instance-settings.png b/docs/img/aws/instance-settings.png
index bf8d600d40145..4ceadf84f259b 100644
Binary files a/docs/img/aws/instance-settings.png and b/docs/img/aws/instance-settings.png differ
diff --git a/docs/img/aws/launch-instance-advanced-options.png b/docs/img/aws/launch-instance-advanced-options.png
index c9ba1f5e342d4..a6202286d8394 100644
Binary files a/docs/img/aws/launch-instance-advanced-options.png and b/docs/img/aws/launch-instance-advanced-options.png differ
diff --git a/docs/img/azure/add-custom-role@2x.png b/docs/img/azure/add-custom-role@2x.png
index 6d60ce3bbd4bf..bb01f9f494e76 100644
Binary files a/docs/img/azure/add-custom-role@2x.png and b/docs/img/azure/add-custom-role@2x.png differ
diff --git a/docs/img/azure/add-role-assignment.png b/docs/img/azure/add-role-assignment.png
index a994494106061..8254181825258 100644
Binary files a/docs/img/azure/add-role-assignment.png and b/docs/img/azure/add-role-assignment.png differ
diff --git a/docs/img/azure/app-registrations@2x.png b/docs/img/azure/app-registrations@2x.png
index 3915b71c6c967..c0e6d19afd7c1 100644
Binary files a/docs/img/azure/app-registrations@2x.png and b/docs/img/azure/app-registrations@2x.png differ
diff --git a/docs/img/azure/create-custom-role.png b/docs/img/azure/create-custom-role.png
index 09a6cd6143bb0..569bf30ae64f4 100644
Binary files a/docs/img/azure/create-custom-role.png and b/docs/img/azure/create-custom-role.png differ
diff --git a/docs/img/azure/managed-identities@2x.png b/docs/img/azure/managed-identities@2x.png
index be02c8cf0ee63..b499ad4c11e7d 100644
Binary files a/docs/img/azure/managed-identities@2x.png and b/docs/img/azure/managed-identities@2x.png differ
diff --git a/docs/img/azure/read-permission.png b/docs/img/azure/read-permission.png
index 73fdba7f50475..34f46d470e7eb 100644
Binary files a/docs/img/azure/read-permission.png and b/docs/img/azure/read-permission.png differ
diff --git a/docs/img/azure/registered-app-secrets@2x.png b/docs/img/azure/registered-app-secrets@2x.png
index e4b3f80a85209..9028421ac773c 100644
Binary files a/docs/img/azure/registered-app-secrets@2x.png and b/docs/img/azure/registered-app-secrets@2x.png differ
diff --git a/docs/img/azuread/azuread-4-turnoffuserassign.png b/docs/img/azuread/azuread-4-turnoffuserassign.png
index 99d125715f824..7dc91fe613b49 100644
Binary files a/docs/img/azuread/azuread-4-turnoffuserassign.png and b/docs/img/azuread/azuread-4-turnoffuserassign.png differ
diff --git a/docs/img/azuread/azuread-7-entityandreplyurl.png b/docs/img/azuread/azuread-7-entityandreplyurl.png
index ce78e5bb2849a..9008dcd220dba 100644
Binary files a/docs/img/azuread/azuread-7-entityandreplyurl.png and b/docs/img/azuread/azuread-7-entityandreplyurl.png differ
diff --git a/docs/img/azuread/azuread-8a-nameidentifier.png b/docs/img/azuread/azuread-8a-nameidentifier.png
index ef28e3d29ecf6..e30482cb47f78 100644
Binary files a/docs/img/azuread/azuread-8a-nameidentifier.png and b/docs/img/azuread/azuread-8a-nameidentifier.png differ
diff --git a/docs/img/azuread/azuread-8b-groupclaim.png b/docs/img/azuread/azuread-8b-groupclaim.png
index c29256719d233..b225b589a4e4d 100644
Binary files a/docs/img/azuread/azuread-8b-groupclaim.png and b/docs/img/azuread/azuread-8b-groupclaim.png differ
diff --git a/docs/img/azuread/azuread-8c-usernameclaim.png b/docs/img/azuread/azuread-8c-usernameclaim.png
index 884df14c9eca1..c156ea5abb569 100644
Binary files a/docs/img/azuread/azuread-8c-usernameclaim.png and b/docs/img/azuread/azuread-8c-usernameclaim.png differ
diff --git a/docs/img/azuread/azuread-9-fedmeatadataxml.png b/docs/img/azuread/azuread-9-fedmeatadataxml.png
index c5bbb977f4b10..6c54e40a0b31a 100644
Binary files a/docs/img/azuread/azuread-9-fedmeatadataxml.png and b/docs/img/azuread/azuread-9-fedmeatadataxml.png differ
diff --git a/docs/img/azuread/azuread-nameid.png b/docs/img/azuread/azuread-nameid.png
index b2bc772294612..e925f1249b1f4 100644
Binary files a/docs/img/azuread/azuread-nameid.png and b/docs/img/azuread/azuread-nameid.png differ
diff --git a/docs/img/cloud/getting-started/add-my-first-resource@2x.png b/docs/img/cloud/getting-started/add-my-first-resource@2x.png
deleted file mode 100644
index 9cb0e68c22691..0000000000000
Binary files a/docs/img/cloud/getting-started/add-my-first-resource@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/choose-resource@2x.png b/docs/img/cloud/getting-started/choose-resource@2x.png
deleted file mode 100644
index a84e85b18486f..0000000000000
Binary files a/docs/img/cloud/getting-started/choose-resource@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/identity-platform.png b/docs/img/cloud/getting-started/identity-platform.png
deleted file mode 100644
index b5f33a789fed5..0000000000000
Binary files a/docs/img/cloud/getting-started/identity-platform.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/intro-velocity-resiliency.png b/docs/img/cloud/getting-started/intro-velocity-resiliency.png
deleted file mode 100644
index c91c91d1fc650..0000000000000
Binary files a/docs/img/cloud/getting-started/intro-velocity-resiliency.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/paste-script@2x.png b/docs/img/cloud/getting-started/paste-script@2x.png
deleted file mode 100644
index 747dab39340e5..0000000000000
Binary files a/docs/img/cloud/getting-started/paste-script@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/session-recordings@2x.png b/docs/img/cloud/getting-started/session-recordings@2x.png
deleted file mode 100644
index 2b628c91437f6..0000000000000
Binary files a/docs/img/cloud/getting-started/session-recordings@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/set-up-access@2x.png b/docs/img/cloud/getting-started/set-up-access@2x.png
deleted file mode 100644
index cf75d23f4e2df..0000000000000
Binary files a/docs/img/cloud/getting-started/set-up-access@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/successfully-connected@2x.png b/docs/img/cloud/getting-started/successfully-connected@2x.png
deleted file mode 100644
index d8564d4bd1507..0000000000000
Binary files a/docs/img/cloud/getting-started/successfully-connected@2x.png and /dev/null differ
diff --git a/docs/img/cloud/getting-started/test-connection@2x.png b/docs/img/cloud/getting-started/test-connection@2x.png
deleted file mode 100644
index 3059567370d76..0000000000000
Binary files a/docs/img/cloud/getting-started/test-connection@2x.png and /dev/null differ
diff --git a/docs/img/cloud/notification-complete.png b/docs/img/cloud/notification-complete.png
index e31486a61241e..e148893ae3480 100644
Binary files a/docs/img/cloud/notification-complete.png and b/docs/img/cloud/notification-complete.png differ
diff --git a/docs/img/cloud/notification-message.png b/docs/img/cloud/notification-message.png
index 1f4d69893bd03..f8d5a5fc0c9e7 100644
Binary files a/docs/img/cloud/notification-message.png and b/docs/img/cloud/notification-message.png differ
diff --git a/docs/img/cloud/notification-scheduled.png b/docs/img/cloud/notification-scheduled.png
index 50e8f37c48d8a..0fcb517841d23 100644
Binary files a/docs/img/cloud/notification-scheduled.png and b/docs/img/cloud/notification-scheduled.png differ
diff --git a/docs/img/cloud/recovery-codes.png b/docs/img/cloud/recovery-codes.png
index 3c533345d4efb..60e1edd113c87 100644
Binary files a/docs/img/cloud/recovery-codes.png and b/docs/img/cloud/recovery-codes.png differ
diff --git a/docs/img/cloud/security-business-contacts.png b/docs/img/cloud/security-business-contacts.png
new file mode 100644
index 0000000000000..2f4a448674435
Binary files /dev/null and b/docs/img/cloud/security-business-contacts.png differ
diff --git a/docs/img/connect-your-client/model-context-protocol/usage-example-database-access.png b/docs/img/connect-your-client/model-context-protocol/usage-example-database-access.png
new file mode 100644
index 0000000000000..29ecdfdc24a0e
Binary files /dev/null and b/docs/img/connect-your-client/model-context-protocol/usage-example-database-access.png differ
diff --git a/docs/img/connect-your-client/model-context-protocol/usage-example-everything.png b/docs/img/connect-your-client/model-context-protocol/usage-example-everything.png
new file mode 100644
index 0000000000000..93d2101e8e08e
Binary files /dev/null and b/docs/img/connect-your-client/model-context-protocol/usage-example-everything.png differ
diff --git a/docs/img/connect-your-client/model-context-protocol/usage-kube-context.png b/docs/img/connect-your-client/model-context-protocol/usage-kube-context.png
new file mode 100644
index 0000000000000..3ca08582424e9
Binary files /dev/null and b/docs/img/connect-your-client/model-context-protocol/usage-kube-context.png differ
diff --git a/docs/img/connect-your-client/model-context-protocol/usage-kube-pod.png b/docs/img/connect-your-client/model-context-protocol/usage-kube-pod.png
new file mode 100644
index 0000000000000..74b30a394c5d9
Binary files /dev/null and b/docs/img/connect-your-client/model-context-protocol/usage-kube-pod.png differ
diff --git a/docs/img/connect-your-client/putty-console.png b/docs/img/connect-your-client/putty-console.png
index ff83d635004cf..2387eb5c4adf4 100644
Binary files a/docs/img/connect-your-client/putty-console.png and b/docs/img/connect-your-client/putty-console.png differ
diff --git a/docs/img/connect-your-client/putty-window.png b/docs/img/connect-your-client/putty-window.png
index 39899857ecad9..0e4079ba7fc8f 100644
Binary files a/docs/img/connect-your-client/putty-window.png and b/docs/img/connect-your-client/putty-window.png differ
diff --git a/docs/img/connect-your-client/webui-db-sessions/connect-dialog-custom.png b/docs/img/connect-your-client/webui-db-sessions/connect-dialog-custom.png
index 1ed7f0e494230..977a6ab3485a2 100644
Binary files a/docs/img/connect-your-client/webui-db-sessions/connect-dialog-custom.png and b/docs/img/connect-your-client/webui-db-sessions/connect-dialog-custom.png differ
diff --git a/docs/img/connect-your-client/webui-db-sessions/connect-dialog.png b/docs/img/connect-your-client/webui-db-sessions/connect-dialog.png
index f1614f0a2826e..6de33d54f9ffa 100644
Binary files a/docs/img/connect-your-client/webui-db-sessions/connect-dialog.png and b/docs/img/connect-your-client/webui-db-sessions/connect-dialog.png differ
diff --git a/docs/img/connect-your-client/webui-db-sessions/resources-connect-dialog.png b/docs/img/connect-your-client/webui-db-sessions/resources-connect-dialog.png
index 51137d8769469..97bc81c5ef007 100644
Binary files a/docs/img/connect-your-client/webui-db-sessions/resources-connect-dialog.png and b/docs/img/connect-your-client/webui-db-sessions/resources-connect-dialog.png differ
diff --git a/docs/img/connect-your-client/webui-db-sessions/session-terminal.png b/docs/img/connect-your-client/webui-db-sessions/session-terminal.png
index c062ec00e2ace..6ab4d48a024f7 100644
Binary files a/docs/img/connect-your-client/webui-db-sessions/session-terminal.png and b/docs/img/connect-your-client/webui-db-sessions/session-terminal.png differ
diff --git a/docs/img/connect-your-client/winscp-1.png b/docs/img/connect-your-client/winscp-1.png
index 79db262681dcd..f1d1160556dd9 100644
Binary files a/docs/img/connect-your-client/winscp-1.png and b/docs/img/connect-your-client/winscp-1.png differ
diff --git a/docs/img/connect-your-client/winscp-2.png b/docs/img/connect-your-client/winscp-2.png
index a39037c8d2ed5..004efa24468e9 100644
Binary files a/docs/img/connect-your-client/winscp-2.png and b/docs/img/connect-your-client/winscp-2.png differ
diff --git a/docs/img/connect-your-client/winscp-3.png b/docs/img/connect-your-client/winscp-3.png
index 9f50be49c1868..84433e4a0accc 100644
Binary files a/docs/img/connect-your-client/winscp-3.png and b/docs/img/connect-your-client/winscp-3.png differ
diff --git a/docs/img/connect-your-client/winscp-4.png b/docs/img/connect-your-client/winscp-4.png
index 47b51b900443f..368e74af480f9 100644
Binary files a/docs/img/connect-your-client/winscp-4.png and b/docs/img/connect-your-client/winscp-4.png differ
diff --git a/docs/img/connect-your-client/winscp-5.png b/docs/img/connect-your-client/winscp-5.png
index b070dde676047..b3302f98da779 100644
Binary files a/docs/img/connect-your-client/winscp-5.png and b/docs/img/connect-your-client/winscp-5.png differ
diff --git a/docs/img/connect-your-client/winscp-6.png b/docs/img/connect-your-client/winscp-6.png
index aebc66b44bd46..088f645e04bee 100644
Binary files a/docs/img/connect-your-client/winscp-6.png and b/docs/img/connect-your-client/winscp-6.png differ
diff --git a/docs/img/database-access/azure-data-studio-connection.png b/docs/img/database-access/azure-data-studio-connection.png
index df7e363f75630..698c78530b4d2 100644
Binary files a/docs/img/database-access/azure-data-studio-connection.png and b/docs/img/database-access/azure-data-studio-connection.png differ
diff --git a/docs/img/database-access/compass-hostname@2x.png b/docs/img/database-access/compass-hostname@2x.png
index 5ba28a4e3f2f3..b9871ee37925e 100644
Binary files a/docs/img/database-access/compass-hostname@2x.png and b/docs/img/database-access/compass-hostname@2x.png differ
diff --git a/docs/img/database-access/compass-more-options@2x.png b/docs/img/database-access/compass-more-options@2x.png
index 6ab07d6f694de..18b0028bde341 100644
Binary files a/docs/img/database-access/compass-more-options@2x.png and b/docs/img/database-access/compass-more-options@2x.png differ
diff --git a/docs/img/database-access/compass-new-connection@2x.png b/docs/img/database-access/compass-new-connection@2x.png
index 55e4395d6f6f4..b72737fd3badf 100644
Binary files a/docs/img/database-access/compass-new-connection@2x.png and b/docs/img/database-access/compass-new-connection@2x.png differ
diff --git a/docs/img/database-access/dbeaver-add-server.png b/docs/img/database-access/dbeaver-add-server.png
index 4bbbd29ade0a5..71984aa7042f1 100644
Binary files a/docs/img/database-access/dbeaver-add-server.png and b/docs/img/database-access/dbeaver-add-server.png differ
diff --git a/docs/img/database-access/dbeaver-configure-server.png b/docs/img/database-access/dbeaver-configure-server.png
index 9f5a12a66131b..99c9aa1834622 100644
Binary files a/docs/img/database-access/dbeaver-configure-server.png and b/docs/img/database-access/dbeaver-configure-server.png differ
diff --git a/docs/img/database-access/dbeaver-configure-user.png b/docs/img/database-access/dbeaver-configure-user.png
index e195e410e4923..2d3792edd1ee2 100644
Binary files a/docs/img/database-access/dbeaver-configure-user.png and b/docs/img/database-access/dbeaver-configure-user.png differ
diff --git a/docs/img/database-access/dbeaver-driver-settings.png b/docs/img/database-access/dbeaver-driver-settings.png
index d4fa24e8eb440..79eda89b0ebda 100644
Binary files a/docs/img/database-access/dbeaver-driver-settings.png and b/docs/img/database-access/dbeaver-driver-settings.png differ
diff --git a/docs/img/database-access/dbeaver-pg-configure-server.png b/docs/img/database-access/dbeaver-pg-configure-server.png
index 12a597709fc09..1670a74a28610 100644
Binary files a/docs/img/database-access/dbeaver-pg-configure-server.png and b/docs/img/database-access/dbeaver-pg-configure-server.png differ
diff --git a/docs/img/database-access/dbeaver-select-driver.png b/docs/img/database-access/dbeaver-select-driver.png
index b9743875fec7f..5f9de26b58d9c 100644
Binary files a/docs/img/database-access/dbeaver-select-driver.png and b/docs/img/database-access/dbeaver-select-driver.png differ
diff --git a/docs/img/database-access/enrollment-wizard/db-connection-test-timeout.png b/docs/img/database-access/enrollment-wizard/db-connection-test-timeout.png
index 8673b8f272744..6dff15f0c38d1 100644
Binary files a/docs/img/database-access/enrollment-wizard/db-connection-test-timeout.png and b/docs/img/database-access/enrollment-wizard/db-connection-test-timeout.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-clusters-overview@2x.png b/docs/img/database-access/enrollment-wizard/ecs-clusters-overview@2x.png
index 248e88eeb5a48..5da39ef2f3dd0 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-clusters-overview@2x.png and b/docs/img/database-access/enrollment-wizard/ecs-clusters-overview@2x.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-deployment-tasks-overview.png b/docs/img/database-access/enrollment-wizard/ecs-deployment-tasks-overview.png
index 7fb4d86b6555e..3bc652e592647 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-deployment-tasks-overview.png and b/docs/img/database-access/enrollment-wizard/ecs-deployment-tasks-overview.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-networking-panel.png b/docs/img/database-access/enrollment-wizard/ecs-networking-panel.png
index 12b8d370b3ebc..9779248561aa1 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-networking-panel.png and b/docs/img/database-access/enrollment-wizard/ecs-networking-panel.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-service-network-config.png b/docs/img/database-access/enrollment-wizard/ecs-service-network-config.png
index c2b8404f7a83e..9bfcd96885731 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-service-network-config.png and b/docs/img/database-access/enrollment-wizard/ecs-service-network-config.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-services-overview@2x.png b/docs/img/database-access/enrollment-wizard/ecs-services-overview@2x.png
index bcc16559cf9da..aa9103834e462 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-services-overview@2x.png and b/docs/img/database-access/enrollment-wizard/ecs-services-overview@2x.png differ
diff --git a/docs/img/database-access/enrollment-wizard/ecs-task-logs@2x.png b/docs/img/database-access/enrollment-wizard/ecs-task-logs@2x.png
index a979613535291..fa3628ee44640 100644
Binary files a/docs/img/database-access/enrollment-wizard/ecs-task-logs@2x.png and b/docs/img/database-access/enrollment-wizard/ecs-task-logs@2x.png differ
diff --git a/docs/img/database-access/enrollment-wizard/example-network-analyzer-results@2x.png b/docs/img/database-access/enrollment-wizard/example-network-analyzer-results@2x.png
index 93fa709557eb6..134806b700f96 100644
Binary files a/docs/img/database-access/enrollment-wizard/example-network-analyzer-results@2x.png and b/docs/img/database-access/enrollment-wizard/example-network-analyzer-results@2x.png differ
diff --git a/docs/img/database-access/enrollment-wizard/example-outbound-internet-rule.png b/docs/img/database-access/enrollment-wizard/example-outbound-internet-rule.png
index 02cf748ccf1b0..0ef6a86e81e87 100644
Binary files a/docs/img/database-access/enrollment-wizard/example-outbound-internet-rule.png and b/docs/img/database-access/enrollment-wizard/example-outbound-internet-rule.png differ
diff --git a/docs/img/database-access/enrollment-wizard/example-rds-sg-inbound.png b/docs/img/database-access/enrollment-wizard/example-rds-sg-inbound.png
index 84c2cbeca2f92..669b1377f38b0 100644
Binary files a/docs/img/database-access/enrollment-wizard/example-rds-sg-inbound.png and b/docs/img/database-access/enrollment-wizard/example-rds-sg-inbound.png differ
diff --git a/docs/img/database-access/enrollment-wizard/example-vpc-routes-overview.png b/docs/img/database-access/enrollment-wizard/example-vpc-routes-overview.png
index 2c8c553b83e7f..4042a2a0a480c 100644
Binary files a/docs/img/database-access/enrollment-wizard/example-vpc-routes-overview.png and b/docs/img/database-access/enrollment-wizard/example-vpc-routes-overview.png differ
diff --git a/docs/img/database-access/enrollment-wizard/resource-panel-rds.png b/docs/img/database-access/enrollment-wizard/resource-panel-rds.png
index d2089f5465b9e..25f0f8092b777 100644
Binary files a/docs/img/database-access/enrollment-wizard/resource-panel-rds.png and b/docs/img/database-access/enrollment-wizard/resource-panel-rds.png differ
diff --git a/docs/img/database-access/enrollment-wizard/stopped-ecs-tasks@2x.png b/docs/img/database-access/enrollment-wizard/stopped-ecs-tasks@2x.png
index 1bee0654e141c..b757c07958431 100644
Binary files a/docs/img/database-access/enrollment-wizard/stopped-ecs-tasks@2x.png and b/docs/img/database-access/enrollment-wizard/stopped-ecs-tasks@2x.png differ
diff --git a/docs/img/database-access/guides/alloydb/add-user-account.png b/docs/img/database-access/guides/alloydb/add-user-account.png
new file mode 100644
index 0000000000000..04bc2b8b6900a
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/add-user-account.png differ
diff --git a/docs/img/database-access/guides/alloydb/architecture.png b/docs/img/database-access/guides/alloydb/architecture.png
new file mode 100644
index 0000000000000..eaf49e4669317
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/architecture.png differ
diff --git a/docs/img/database-access/guides/alloydb/connection-uri.png b/docs/img/database-access/guides/alloydb/connection-uri.png
new file mode 100644
index 0000000000000..9f21211cd4da2
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/connection-uri.png differ
diff --git a/docs/img/database-access/guides/alloydb/create-system-service-account.png b/docs/img/database-access/guides/alloydb/create-system-service-account.png
new file mode 100644
index 0000000000000..4d983bd5f9bd4
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/create-system-service-account.png differ
diff --git a/docs/img/database-access/guides/alloydb/create-user-service-account.png b/docs/img/database-access/guides/alloydb/create-user-service-account.png
new file mode 100644
index 0000000000000..e2fc01790140a
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/create-user-service-account.png differ
diff --git a/docs/img/database-access/guides/alloydb/flag-iam-authentication-on.png b/docs/img/database-access/guides/alloydb/flag-iam-authentication-on.png
new file mode 100644
index 0000000000000..5b7dbc1b32b56
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/flag-iam-authentication-on.png differ
diff --git a/docs/img/database-access/guides/alloydb/service-account-keys.png b/docs/img/database-access/guides/alloydb/service-account-keys.png
new file mode 100644
index 0000000000000..8fa5dbdb34ce1
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/service-account-keys.png differ
diff --git a/docs/img/database-access/guides/alloydb/service-account-new-key.png b/docs/img/database-access/guides/alloydb/service-account-new-key.png
new file mode 100644
index 0000000000000..d1de449b2621f
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/service-account-new-key.png differ
diff --git a/docs/img/database-access/guides/alloydb/system-service-account-permissions.png b/docs/img/database-access/guides/alloydb/system-service-account-permissions.png
new file mode 100644
index 0000000000000..9692736c0a970
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/system-service-account-permissions.png differ
diff --git a/docs/img/database-access/guides/alloydb/user-account-added.png b/docs/img/database-access/guides/alloydb/user-account-added.png
new file mode 100644
index 0000000000000..30474ddf6f394
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/user-account-added.png differ
diff --git a/docs/img/database-access/guides/alloydb/user-service-account-grant-access.png b/docs/img/database-access/guides/alloydb/user-service-account-grant-access.png
new file mode 100644
index 0000000000000..3723d140c9c02
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/user-service-account-grant-access.png differ
diff --git a/docs/img/database-access/guides/alloydb/user-service-account-permissions.png b/docs/img/database-access/guides/alloydb/user-service-account-permissions.png
new file mode 100644
index 0000000000000..9c0e1353489cd
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/user-service-account-permissions.png differ
diff --git a/docs/img/database-access/guides/alloydb/user-service-account-principals-with-access.png b/docs/img/database-access/guides/alloydb/user-service-account-principals-with-access.png
new file mode 100644
index 0000000000000..f1478b2ba56e1
Binary files /dev/null and b/docs/img/database-access/guides/alloydb/user-service-account-principals-with-access.png differ
diff --git a/docs/img/database-access/guides/atlas/atlas-add-user@2x.png b/docs/img/database-access/guides/atlas/atlas-add-user@2x.png
index 8b29279477cb4..6f6ec9e8bd492 100644
Binary files a/docs/img/database-access/guides/atlas/atlas-add-user@2x.png and b/docs/img/database-access/guides/atlas/atlas-add-user@2x.png differ
diff --git a/docs/img/database-access/guides/atlas/atlas-connect-btn@2x.png b/docs/img/database-access/guides/atlas/atlas-connect-btn@2x.png
index c371344a2dabb..c9a991c1f683a 100644
Binary files a/docs/img/database-access/guides/atlas/atlas-connect-btn@2x.png and b/docs/img/database-access/guides/atlas/atlas-connect-btn@2x.png differ
diff --git a/docs/img/database-access/guides/atlas/atlas-connect@2x.png b/docs/img/database-access/guides/atlas/atlas-connect@2x.png
index eeb9b9d8c1458..f4f93a1255c17 100644
Binary files a/docs/img/database-access/guides/atlas/atlas-connect@2x.png and b/docs/img/database-access/guides/atlas/atlas-connect@2x.png differ
diff --git a/docs/img/database-access/guides/atlas/atlas-self-managed-x509@2x.png b/docs/img/database-access/guides/atlas/atlas-self-managed-x509@2x.png
index 95d9e621d397f..8a7a7a5e4cc60 100644
Binary files a/docs/img/database-access/guides/atlas/atlas-self-managed-x509@2x.png and b/docs/img/database-access/guides/atlas/atlas-self-managed-x509@2x.png differ
diff --git a/docs/img/database-access/guides/aws-create-role-add-tags.png b/docs/img/database-access/guides/aws-create-role-add-tags.png
index 56f6216337a3b..70fe0be8b75e3 100644
Binary files a/docs/img/database-access/guides/aws-create-role-add-tags.png and b/docs/img/database-access/guides/aws-create-role-add-tags.png differ
diff --git a/docs/img/database-access/guides/aws-dynamodb_cloud.png b/docs/img/database-access/guides/aws-dynamodb_cloud.png
index 015ecfee3997c..a45c86549b196 100644
Binary files a/docs/img/database-access/guides/aws-dynamodb_cloud.png and b/docs/img/database-access/guides/aws-dynamodb_cloud.png differ
diff --git a/docs/img/database-access/guides/aws-dynamodb_selfhosted.png b/docs/img/database-access/guides/aws-dynamodb_selfhosted.png
index 438b47d716e68..c4f88c7971e9b 100644
Binary files a/docs/img/database-access/guides/aws-dynamodb_selfhosted.png and b/docs/img/database-access/guides/aws-dynamodb_selfhosted.png differ
diff --git a/docs/img/database-access/guides/aws-opensearch/01-opensearch_get_started.png b/docs/img/database-access/guides/aws-opensearch/01-opensearch_get_started.png
index 110b3f313c548..37c7740d2beaf 100644
Binary files a/docs/img/database-access/guides/aws-opensearch/01-opensearch_get_started.png and b/docs/img/database-access/guides/aws-opensearch/01-opensearch_get_started.png differ
diff --git a/docs/img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png b/docs/img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png
index b35ee4154b51f..169c340e92cff 100644
Binary files a/docs/img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png and b/docs/img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png differ
diff --git a/docs/img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png b/docs/img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png
index 1a3c544e12dc8..d1aaa1351f65a 100644
Binary files a/docs/img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png and b/docs/img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png differ
diff --git a/docs/img/database-access/guides/aws-opensearch/opensearch_cloud.png b/docs/img/database-access/guides/aws-opensearch/opensearch_cloud.png
index 14d4859717079..35d7335237f5c 100644
Binary files a/docs/img/database-access/guides/aws-opensearch/opensearch_cloud.png and b/docs/img/database-access/guides/aws-opensearch/opensearch_cloud.png differ
diff --git a/docs/img/database-access/guides/aws-opensearch/opensearch_selfhosted.png b/docs/img/database-access/guides/aws-opensearch/opensearch_selfhosted.png
index 71d674fcc23de..47085f4a96309 100644
Binary files a/docs/img/database-access/guides/aws-opensearch/opensearch_selfhosted.png and b/docs/img/database-access/guides/aws-opensearch/opensearch_selfhosted.png differ
diff --git a/docs/img/database-access/guides/aws_memorydb_cloud.png b/docs/img/database-access/guides/aws_memorydb_cloud.png
new file mode 100644
index 0000000000000..aed7d1a94b2d4
Binary files /dev/null and b/docs/img/database-access/guides/aws_memorydb_cloud.png differ
diff --git a/docs/img/database-access/guides/aws_memorydb_selfhosted.png b/docs/img/database-access/guides/aws_memorydb_selfhosted.png
new file mode 100644
index 0000000000000..230312ce1f122
Binary files /dev/null and b/docs/img/database-access/guides/aws_memorydb_selfhosted.png differ
diff --git a/docs/img/database-access/guides/azure/create-role-assignment@2x.png b/docs/img/database-access/guides/azure/create-role-assignment@2x.png
index 57e9018bae515..76f3439b3aaf9 100644
Binary files a/docs/img/database-access/guides/azure/create-role-assignment@2x.png and b/docs/img/database-access/guides/azure/create-role-assignment@2x.png differ
diff --git a/docs/img/database-access/guides/azure/create-role-from-json@2x.png b/docs/img/database-access/guides/azure/create-role-from-json@2x.png
index 1091cde4d0379..31350ef18975b 100644
Binary files a/docs/img/database-access/guides/azure/create-role-from-json@2x.png and b/docs/img/database-access/guides/azure/create-role-from-json@2x.png differ
diff --git a/docs/img/database-access/guides/azure/registered-app@2x.png b/docs/img/database-access/guides/azure/registered-app@2x.png
index 6f9bcc0da1a28..e2d331ced8d87 100644
Binary files a/docs/img/database-access/guides/azure/registered-app@2x.png and b/docs/img/database-access/guides/azure/registered-app@2x.png differ
diff --git a/docs/img/database-access/guides/azure/set-ad-admin@2x.png b/docs/img/database-access/guides/azure/set-ad-admin@2x.png
index ce5447f048386..f222625229111 100644
Binary files a/docs/img/database-access/guides/azure/set-ad-admin@2x.png and b/docs/img/database-access/guides/azure/set-ad-admin@2x.png differ
diff --git a/docs/img/database-access/guides/azure_cloud.png b/docs/img/database-access/guides/azure_cloud.png
index da12c6a28b883..5b666bb823679 100644
Binary files a/docs/img/database-access/guides/azure_cloud.png and b/docs/img/database-access/guides/azure_cloud.png differ
diff --git a/docs/img/database-access/guides/azure_selfhosted.png b/docs/img/database-access/guides/azure_selfhosted.png
index 7936d7e69ab45..3a72eb8851b66 100644
Binary files a/docs/img/database-access/guides/azure_selfhosted.png and b/docs/img/database-access/guides/azure_selfhosted.png differ
diff --git a/docs/img/database-access/guides/cassandra_cloud.png b/docs/img/database-access/guides/cassandra_cloud.png
index 9ecfe223f14e3..f19a357e5f4f7 100644
Binary files a/docs/img/database-access/guides/cassandra_cloud.png and b/docs/img/database-access/guides/cassandra_cloud.png differ
diff --git a/docs/img/database-access/guides/cassandra_keyspaces_cloud.png b/docs/img/database-access/guides/cassandra_keyspaces_cloud.png
index 45fa3343f29e4..1039d635a8330 100644
Binary files a/docs/img/database-access/guides/cassandra_keyspaces_cloud.png and b/docs/img/database-access/guides/cassandra_keyspaces_cloud.png differ
diff --git a/docs/img/database-access/guides/cassandra_keyspaces_selfhosted.png b/docs/img/database-access/guides/cassandra_keyspaces_selfhosted.png
index 9f401b73591a3..5335d5d125400 100644
Binary files a/docs/img/database-access/guides/cassandra_keyspaces_selfhosted.png and b/docs/img/database-access/guides/cassandra_keyspaces_selfhosted.png differ
diff --git a/docs/img/database-access/guides/cassandra_selfhosted.png b/docs/img/database-access/guides/cassandra_selfhosted.png
index 631e9adf316e2..303b8edb5e736 100644
Binary files a/docs/img/database-access/guides/cassandra_selfhosted.png and b/docs/img/database-access/guides/cassandra_selfhosted.png differ
diff --git a/docs/img/database-access/guides/clickhouse_selfhosted_cloud.png b/docs/img/database-access/guides/clickhouse_selfhosted_cloud.png
index 9d3db52cc33a3..03cb089085873 100644
Binary files a/docs/img/database-access/guides/clickhouse_selfhosted_cloud.png and b/docs/img/database-access/guides/clickhouse_selfhosted_cloud.png differ
diff --git a/docs/img/database-access/guides/clickhouse_selfhosted_selfhosted.png b/docs/img/database-access/guides/clickhouse_selfhosted_selfhosted.png
index 0ccb0decaba21..930dceb117518 100644
Binary files a/docs/img/database-access/guides/clickhouse_selfhosted_selfhosted.png and b/docs/img/database-access/guides/clickhouse_selfhosted_selfhosted.png differ
diff --git a/docs/img/database-access/guides/cloudsql/add-user-account-mysql@2x.png b/docs/img/database-access/guides/cloudsql/add-user-account-mysql@2x.png
index 145137eb615ae..28af88ab14c5a 100644
Binary files a/docs/img/database-access/guides/cloudsql/add-user-account-mysql@2x.png and b/docs/img/database-access/guides/cloudsql/add-user-account-mysql@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/add-user-account@2x.png b/docs/img/database-access/guides/cloudsql/add-user-account@2x.png
index ca4842bb1cc6d..63ea2421d74f7 100644
Binary files a/docs/img/database-access/guides/cloudsql/add-user-account@2x.png and b/docs/img/database-access/guides/cloudsql/add-user-account@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/grant-token-creator@2x.png b/docs/img/database-access/guides/cloudsql/grant-token-creator@2x.png
index 157dd73ec923f..ec845fdb898c7 100644
Binary files a/docs/img/database-access/guides/cloudsql/grant-token-creator@2x.png and b/docs/img/database-access/guides/cloudsql/grant-token-creator@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/iam-existing-instance@2x.png b/docs/img/database-access/guides/cloudsql/iam-existing-instance@2x.png
index caf65c3aa6686..c75ebd4918e0e 100644
Binary files a/docs/img/database-access/guides/cloudsql/iam-existing-instance@2x.png and b/docs/img/database-access/guides/cloudsql/iam-existing-instance@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/iam-new-instance@2x.png b/docs/img/database-access/guides/cloudsql/iam-new-instance@2x.png
index 2c53ace12a3cd..1428b44967969 100644
Binary files a/docs/img/database-access/guides/cloudsql/iam-new-instance@2x.png and b/docs/img/database-access/guides/cloudsql/iam-new-instance@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/instance-id-mysql@2x.png b/docs/img/database-access/guides/cloudsql/instance-id-mysql@2x.png
deleted file mode 100644
index 29dac1ace8c84..0000000000000
Binary files a/docs/img/database-access/guides/cloudsql/instance-id-mysql@2x.png and /dev/null differ
diff --git a/docs/img/database-access/guides/cloudsql/instance-root-ca@2x.png b/docs/img/database-access/guides/cloudsql/instance-root-ca@2x.png
index 302140d95cc9e..fc12d19494c64 100644
Binary files a/docs/img/database-access/guides/cloudsql/instance-root-ca@2x.png and b/docs/img/database-access/guides/cloudsql/instance-root-ca@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-db-grant@2x.png b/docs/img/database-access/guides/cloudsql/service-account-db-grant@2x.png
index 61cb2072f2659..26eeeb6cfc06d 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-db-grant@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-db-grant@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-db-service@2x.png b/docs/img/database-access/guides/cloudsql/service-account-db-service@2x.png
index 76c78999863e0..81e95e7020939 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-db-service@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-db-service@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-db@2x.png b/docs/img/database-access/guides/cloudsql/service-account-db@2x.png
index 1ea0c8b7cb97f..27eb8b97d0a21 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-db@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-db@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-keys@2x.png b/docs/img/database-access/guides/cloudsql/service-account-keys@2x.png
index 81a0e972ba000..c890e2764d42a 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-keys@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-keys@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-new-key@2x.png b/docs/img/database-access/guides/cloudsql/service-account-new-key@2x.png
index 1ada05ac57d80..00fc1645f1f36 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-new-key@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-new-key@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-permissions-tab@2x.png b/docs/img/database-access/guides/cloudsql/service-account-permissions-tab@2x.png
index a87fe72fd3bb8..29699b0f02072 100644
Binary files a/docs/img/database-access/guides/cloudsql/service-account-permissions-tab@2x.png and b/docs/img/database-access/guides/cloudsql/service-account-permissions-tab@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql/service-account-sql-admin-grant@2x.png b/docs/img/database-access/guides/cloudsql/service-account-sql-admin-grant@2x.png
deleted file mode 100644
index c6861ff72dc84..0000000000000
Binary files a/docs/img/database-access/guides/cloudsql/service-account-sql-admin-grant@2x.png and /dev/null differ
diff --git a/docs/img/database-access/guides/cloudsql/user-accounts@2x.png b/docs/img/database-access/guides/cloudsql/user-accounts@2x.png
index 791a54db11884..1a6fbf2a9d8a7 100644
Binary files a/docs/img/database-access/guides/cloudsql/user-accounts@2x.png and b/docs/img/database-access/guides/cloudsql/user-accounts@2x.png differ
diff --git a/docs/img/database-access/guides/cloudsql_cloud.png b/docs/img/database-access/guides/cloudsql_cloud.png
index 303beb5888d59..7c5f34f02d73e 100644
Binary files a/docs/img/database-access/guides/cloudsql_cloud.png and b/docs/img/database-access/guides/cloudsql_cloud.png differ
diff --git a/docs/img/database-access/guides/cloudsql_selfhosted.png b/docs/img/database-access/guides/cloudsql_selfhosted.png
index 4e95eabd6098e..9ca0e5e04b311 100644
Binary files a/docs/img/database-access/guides/cloudsql_selfhosted.png and b/docs/img/database-access/guides/cloudsql_selfhosted.png differ
diff --git a/docs/img/database-access/guides/cockroachdb_cloud.png b/docs/img/database-access/guides/cockroachdb_cloud.png
index 49e8a30e3de21..8d9758f6a5d4e 100644
Binary files a/docs/img/database-access/guides/cockroachdb_cloud.png and b/docs/img/database-access/guides/cockroachdb_cloud.png differ
diff --git a/docs/img/database-access/guides/cockroachdb_selfhosted.png b/docs/img/database-access/guides/cockroachdb_selfhosted.png
index 29df01d017f6c..9ea01ebce1d3f 100644
Binary files a/docs/img/database-access/guides/cockroachdb_selfhosted.png and b/docs/img/database-access/guides/cockroachdb_selfhosted.png differ
diff --git a/docs/img/database-access/guides/create-redshift-iam-role-policy.png b/docs/img/database-access/guides/create-redshift-iam-role-policy.png
deleted file mode 100644
index 6fa5394155d0f..0000000000000
Binary files a/docs/img/database-access/guides/create-redshift-iam-role-policy.png and /dev/null differ
diff --git a/docs/img/database-access/guides/docdb-create-role-select-policy.png b/docs/img/database-access/guides/docdb-create-role-select-policy.png
index 5b1f617863625..b15bbccc4b2db 100644
Binary files a/docs/img/database-access/guides/docdb-create-role-select-policy.png and b/docs/img/database-access/guides/docdb-create-role-select-policy.png differ
diff --git a/docs/img/database-access/guides/elasticache_serverless_cloud.png b/docs/img/database-access/guides/elasticache_serverless_cloud.png
new file mode 100644
index 0000000000000..fd8f2d71a9ec4
Binary files /dev/null and b/docs/img/database-access/guides/elasticache_serverless_cloud.png differ
diff --git a/docs/img/database-access/guides/elasticache_serverless_selfhosted.png b/docs/img/database-access/guides/elasticache_serverless_selfhosted.png
new file mode 100644
index 0000000000000..f3b0ab0eff53d
Binary files /dev/null and b/docs/img/database-access/guides/elasticache_serverless_selfhosted.png differ
diff --git a/docs/img/database-access/guides/keyspaces/create-role-step1.png b/docs/img/database-access/guides/keyspaces/create-role-step1.png
index 9130cf40ed96f..b7e830b7635b7 100644
Binary files a/docs/img/database-access/guides/keyspaces/create-role-step1.png and b/docs/img/database-access/guides/keyspaces/create-role-step1.png differ
diff --git a/docs/img/database-access/guides/keyspaces/create-role-step2.png b/docs/img/database-access/guides/keyspaces/create-role-step2.png
index 918bc04dd28c7..01c34c2d9f89c 100644
Binary files a/docs/img/database-access/guides/keyspaces/create-role-step2.png and b/docs/img/database-access/guides/keyspaces/create-role-step2.png differ
diff --git a/docs/img/database-access/guides/keyspaces/create-role-step3.png b/docs/img/database-access/guides/keyspaces/create-role-step3.png
index 83d6c715253cc..5d4e36aa9dac0 100644
Binary files a/docs/img/database-access/guides/keyspaces/create-role-step3.png and b/docs/img/database-access/guides/keyspaces/create-role-step3.png differ
diff --git a/docs/img/database-access/guides/mongodb_cloud.png b/docs/img/database-access/guides/mongodb_cloud.png
index 9cacf4ec9000c..3d46f05430ceb 100644
Binary files a/docs/img/database-access/guides/mongodb_cloud.png and b/docs/img/database-access/guides/mongodb_cloud.png differ
diff --git a/docs/img/database-access/guides/mongodb_selfhosted.png b/docs/img/database-access/guides/mongodb_selfhosted.png
index dec53f1fd6e42..c43f984eb04f6 100644
Binary files a/docs/img/database-access/guides/mongodb_selfhosted.png and b/docs/img/database-access/guides/mongodb_selfhosted.png differ
diff --git a/docs/img/database-access/guides/mongodbatlas_cloud.png b/docs/img/database-access/guides/mongodbatlas_cloud.png
index efc7fa40ae48c..7f0e0c11d055e 100644
Binary files a/docs/img/database-access/guides/mongodbatlas_cloud.png and b/docs/img/database-access/guides/mongodbatlas_cloud.png differ
diff --git a/docs/img/database-access/guides/mongodbatlas_selfhosted.png b/docs/img/database-access/guides/mongodbatlas_selfhosted.png
index 64ff67590a9d8..11d1bf78ecbb6 100644
Binary files a/docs/img/database-access/guides/mongodbatlas_selfhosted.png and b/docs/img/database-access/guides/mongodbatlas_selfhosted.png differ
diff --git a/docs/img/database-access/guides/mysql_cloud.png b/docs/img/database-access/guides/mysql_cloud.png
index 85d9003a446d4..b3efcef722434 100644
Binary files a/docs/img/database-access/guides/mysql_cloud.png and b/docs/img/database-access/guides/mysql_cloud.png differ
diff --git a/docs/img/database-access/guides/mysql_selfhosted.png b/docs/img/database-access/guides/mysql_selfhosted.png
index 72e90e0132e1e..1c178ff67b9f0 100644
Binary files a/docs/img/database-access/guides/mysql_selfhosted.png and b/docs/img/database-access/guides/mysql_selfhosted.png differ
diff --git a/docs/img/database-access/guides/oracle_selfhosted.png b/docs/img/database-access/guides/oracle_selfhosted.png
index 01f8315f16285..ae060f9356037 100644
Binary files a/docs/img/database-access/guides/oracle_selfhosted.png and b/docs/img/database-access/guides/oracle_selfhosted.png differ
diff --git a/docs/img/database-access/guides/oracle_selfhosted_cloud.png b/docs/img/database-access/guides/oracle_selfhosted_cloud.png
index 56c19aa7269ce..b00b54e36aaa1 100644
Binary files a/docs/img/database-access/guides/oracle_selfhosted_cloud.png and b/docs/img/database-access/guides/oracle_selfhosted_cloud.png differ
diff --git a/docs/img/database-access/guides/postgresqlselfhosted_cloud.png b/docs/img/database-access/guides/postgresqlselfhosted_cloud.png
index aec7a5b9c92e5..af54550326b5b 100644
Binary files a/docs/img/database-access/guides/postgresqlselfhosted_cloud.png and b/docs/img/database-access/guides/postgresqlselfhosted_cloud.png differ
diff --git a/docs/img/database-access/guides/postgresqlselfhosted_selfhosted.png b/docs/img/database-access/guides/postgresqlselfhosted_selfhosted.png
index 8741ae46ea75c..562d1e7a4f48e 100644
Binary files a/docs/img/database-access/guides/postgresqlselfhosted_selfhosted.png and b/docs/img/database-access/guides/postgresqlselfhosted_selfhosted.png differ
diff --git a/docs/img/database-access/guides/rds-proxy_cloud.png b/docs/img/database-access/guides/rds-proxy_cloud.png
index 5de6f90f86330..8f7faf22e8510 100644
Binary files a/docs/img/database-access/guides/rds-proxy_cloud.png and b/docs/img/database-access/guides/rds-proxy_cloud.png differ
diff --git a/docs/img/database-access/guides/rds-proxy_selfhosted.png b/docs/img/database-access/guides/rds-proxy_selfhosted.png
index 4e1b55fa5b973..c6ec61e6cf517 100644
Binary files a/docs/img/database-access/guides/rds-proxy_selfhosted.png and b/docs/img/database-access/guides/rds-proxy_selfhosted.png differ
diff --git a/docs/img/database-access/guides/rds_cloud.png b/docs/img/database-access/guides/rds_cloud.png
index 18ccb249ef8af..665b51430388e 100644
Binary files a/docs/img/database-access/guides/rds_cloud.png and b/docs/img/database-access/guides/rds_cloud.png differ
diff --git a/docs/img/database-access/guides/rds_selfhosted.png b/docs/img/database-access/guides/rds_selfhosted.png
index 9ef9850c90f38..849f183db7bd2 100644
Binary files a/docs/img/database-access/guides/rds_selfhosted.png and b/docs/img/database-access/guides/rds_selfhosted.png differ
diff --git a/docs/img/database-access/guides/redis/redis-aws-iam-user@2x.png b/docs/img/database-access/guides/redis/redis-aws-iam-user@2x.png
index 9564707f7875d..74e2523687718 100644
Binary files a/docs/img/database-access/guides/redis/redis-aws-iam-user@2x.png and b/docs/img/database-access/guides/redis/redis-aws-iam-user@2x.png differ
diff --git a/docs/img/database-access/guides/redis/redis-aws-managed-user-tag.png b/docs/img/database-access/guides/redis/redis-aws-managed-user-tag.png
index ff684ba29985c..23350da68d2f9 100644
Binary files a/docs/img/database-access/guides/redis/redis-aws-managed-user-tag.png and b/docs/img/database-access/guides/redis/redis-aws-managed-user-tag.png differ
diff --git a/docs/img/database-access/guides/redis/redisinsight-add-config.png b/docs/img/database-access/guides/redis/redisinsight-add-config.png
index da0298b6c6f02..1fed10a42a81e 100644
Binary files a/docs/img/database-access/guides/redis/redisinsight-add-config.png and b/docs/img/database-access/guides/redis/redisinsight-add-config.png differ
diff --git a/docs/img/database-access/guides/redis/redisinsight-connected.png b/docs/img/database-access/guides/redis/redisinsight-connected.png
index f0f54ce2f1d26..7bca06f986e61 100644
Binary files a/docs/img/database-access/guides/redis/redisinsight-connected.png and b/docs/img/database-access/guides/redis/redisinsight-connected.png differ
diff --git a/docs/img/database-access/guides/redis/redisinsight-startup.png b/docs/img/database-access/guides/redis/redisinsight-startup.png
index 3102842af9d8e..74d31ca5b7d78 100644
Binary files a/docs/img/database-access/guides/redis/redisinsight-startup.png and b/docs/img/database-access/guides/redis/redisinsight-startup.png differ
diff --git a/docs/img/database-access/guides/redis/redisinsight-tls-config.png b/docs/img/database-access/guides/redis/redisinsight-tls-config.png
index c35add5405589..0b43e51311ee6 100644
Binary files a/docs/img/database-access/guides/redis/redisinsight-tls-config.png and b/docs/img/database-access/guides/redis/redisinsight-tls-config.png differ
diff --git a/docs/img/database-access/guides/redis_cloud.png b/docs/img/database-access/guides/redis_cloud.png
index b371038fbafb2..ea70a85e2b30d 100644
Binary files a/docs/img/database-access/guides/redis_cloud.png and b/docs/img/database-access/guides/redis_cloud.png differ
diff --git a/docs/img/database-access/guides/redis_elasticache_cloud.png b/docs/img/database-access/guides/redis_elasticache_cloud.png
index c962bad2051a1..47229a89fd00a 100644
Binary files a/docs/img/database-access/guides/redis_elasticache_cloud.png and b/docs/img/database-access/guides/redis_elasticache_cloud.png differ
diff --git a/docs/img/database-access/guides/redis_elasticache_selfhosted.png b/docs/img/database-access/guides/redis_elasticache_selfhosted.png
index 15ad6a9147ed2..2144fd8487210 100644
Binary files a/docs/img/database-access/guides/redis_elasticache_selfhosted.png and b/docs/img/database-access/guides/redis_elasticache_selfhosted.png differ
diff --git a/docs/img/database-access/guides/redis_selfhosted.png b/docs/img/database-access/guides/redis_selfhosted.png
index 851d537b706c6..f522bca2d60e2 100644
Binary files a/docs/img/database-access/guides/redis_selfhosted.png and b/docs/img/database-access/guides/redis_selfhosted.png differ
diff --git a/docs/img/database-access/guides/rediscluster_cloud.png b/docs/img/database-access/guides/rediscluster_cloud.png
index d84aeab95a837..f148f529a8195 100644
Binary files a/docs/img/database-access/guides/rediscluster_cloud.png and b/docs/img/database-access/guides/rediscluster_cloud.png differ
diff --git a/docs/img/database-access/guides/rediscluster_selfhosted.png b/docs/img/database-access/guides/rediscluster_selfhosted.png
index 8e3f24cac5ab0..62c3518581abc 100644
Binary files a/docs/img/database-access/guides/rediscluster_selfhosted.png and b/docs/img/database-access/guides/rediscluster_selfhosted.png differ
diff --git a/docs/img/database-access/guides/redshift_cloud.png b/docs/img/database-access/guides/redshift_cloud.png
index 922e616d9190f..e04c8235f7f53 100644
Binary files a/docs/img/database-access/guides/redshift_cloud.png and b/docs/img/database-access/guides/redshift_cloud.png differ
diff --git a/docs/img/database-access/guides/redshift_selfhosted.png b/docs/img/database-access/guides/redshift_selfhosted.png
index cb0210e773dea..92e7aad1779e2 100644
Binary files a/docs/img/database-access/guides/redshift_selfhosted.png and b/docs/img/database-access/guides/redshift_selfhosted.png differ
diff --git a/docs/img/database-access/guides/snowflake/dbeaver-driver.png b/docs/img/database-access/guides/snowflake/dbeaver-driver.png
index aad3f911c3e50..d641a553937a8 100644
Binary files a/docs/img/database-access/guides/snowflake/dbeaver-driver.png and b/docs/img/database-access/guides/snowflake/dbeaver-driver.png differ
diff --git a/docs/img/database-access/guides/snowflake/dbeaver-main-screen.png b/docs/img/database-access/guides/snowflake/dbeaver-main-screen.png
index 2a2a19ed334a9..c33adadff094a 100644
Binary files a/docs/img/database-access/guides/snowflake/dbeaver-main-screen.png and b/docs/img/database-access/guides/snowflake/dbeaver-main-screen.png differ
diff --git a/docs/img/database-access/guides/snowflake/dbeaver-main.png b/docs/img/database-access/guides/snowflake/dbeaver-main.png
index 226244f6d2173..b495997253128 100644
Binary files a/docs/img/database-access/guides/snowflake/dbeaver-main.png and b/docs/img/database-access/guides/snowflake/dbeaver-main.png differ
diff --git a/docs/img/database-access/guides/snowflake/dbeaver-select-database.png b/docs/img/database-access/guides/snowflake/dbeaver-select-database.png
index f741275f2e78e..1805a1917c7eb 100644
Binary files a/docs/img/database-access/guides/snowflake/dbeaver-select-database.png and b/docs/img/database-access/guides/snowflake/dbeaver-select-database.png differ
diff --git a/docs/img/database-access/guides/snowflake/dbeaver-success.png b/docs/img/database-access/guides/snowflake/dbeaver-success.png
index 3fbeb3b6cc48b..74d5cd3c757a4 100644
Binary files a/docs/img/database-access/guides/snowflake/dbeaver-success.png and b/docs/img/database-access/guides/snowflake/dbeaver-success.png differ
diff --git a/docs/img/database-access/guides/snowflake/jetbrains-add-database.png b/docs/img/database-access/guides/snowflake/jetbrains-add-database.png
index 266c7e159f758..4de07b69a2f34 100644
Binary files a/docs/img/database-access/guides/snowflake/jetbrains-add-database.png and b/docs/img/database-access/guides/snowflake/jetbrains-add-database.png differ
diff --git a/docs/img/database-access/guides/snowflake/jetbrains-advanced.png b/docs/img/database-access/guides/snowflake/jetbrains-advanced.png
index 8074dd7de8295..ea41975c08406 100644
Binary files a/docs/img/database-access/guides/snowflake/jetbrains-advanced.png and b/docs/img/database-access/guides/snowflake/jetbrains-advanced.png differ
diff --git a/docs/img/database-access/guides/snowflake/jetbrains-general.png b/docs/img/database-access/guides/snowflake/jetbrains-general.png
index 348a96ab7264a..370054df9ce64 100644
Binary files a/docs/img/database-access/guides/snowflake/jetbrains-general.png and b/docs/img/database-access/guides/snowflake/jetbrains-general.png differ
diff --git a/docs/img/database-access/guides/snowflake/jetbrains-success.png b/docs/img/database-access/guides/snowflake/jetbrains-success.png
index 246b0da46ea8c..8cf7a4c66a1a7 100644
Binary files a/docs/img/database-access/guides/snowflake/jetbrains-success.png and b/docs/img/database-access/guides/snowflake/jetbrains-success.png differ
diff --git a/docs/img/database-access/guides/snowflake_cloud.png b/docs/img/database-access/guides/snowflake_cloud.png
index 3f96e9a4d717b..c127580039f32 100644
Binary files a/docs/img/database-access/guides/snowflake_cloud.png and b/docs/img/database-access/guides/snowflake_cloud.png differ
diff --git a/docs/img/database-access/guides/snowflake_selfhosted.png b/docs/img/database-access/guides/snowflake_selfhosted.png
index b2c9b4d3b994f..589d51a557dc1 100644
Binary files a/docs/img/database-access/guides/snowflake_selfhosted.png and b/docs/img/database-access/guides/snowflake_selfhosted.png differ
diff --git a/docs/img/database-access/guides/spanner/create-spanner-user@2x.png b/docs/img/database-access/guides/spanner/create-spanner-user@2x.png
index 59c5e0fd7bb38..083378730e052 100644
Binary files a/docs/img/database-access/guides/spanner/create-spanner-user@2x.png and b/docs/img/database-access/guides/spanner/create-spanner-user@2x.png differ
diff --git a/docs/img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png b/docs/img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png
index 5701ae4eb97f8..c7130a91c1c66 100644
Binary files a/docs/img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png and b/docs/img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png differ
diff --git a/docs/img/database-access/guides/spanner/grant-token-creator@2x.png b/docs/img/database-access/guides/spanner/grant-token-creator@2x.png
index 2ccd33671b1a8..d0d92a37380b3 100644
Binary files a/docs/img/database-access/guides/spanner/grant-token-creator@2x.png and b/docs/img/database-access/guides/spanner/grant-token-creator@2x.png differ
diff --git a/docs/img/database-access/guides/spanner/select-instance@2x.png b/docs/img/database-access/guides/spanner/select-instance@2x.png
index c33d0a2b9ba45..6903991b67418 100644
Binary files a/docs/img/database-access/guides/spanner/select-instance@2x.png and b/docs/img/database-access/guides/spanner/select-instance@2x.png differ
diff --git a/docs/img/database-access/guides/spanner/service-account-permissions-tab@2x.png b/docs/img/database-access/guides/spanner/service-account-permissions-tab@2x.png
index 582f3ca3b2414..a0df2adcfba91 100644
Binary files a/docs/img/database-access/guides/spanner/service-account-permissions-tab@2x.png and b/docs/img/database-access/guides/spanner/service-account-permissions-tab@2x.png differ
diff --git a/docs/img/database-access/guides/spanner_cloud.png b/docs/img/database-access/guides/spanner_cloud.png
index 6ca9ad2271f64..5a57aef96653f 100644
Binary files a/docs/img/database-access/guides/spanner_cloud.png and b/docs/img/database-access/guides/spanner_cloud.png differ
diff --git a/docs/img/database-access/guides/spanner_selfhosted.png b/docs/img/database-access/guides/spanner_selfhosted.png
index 990b7bb77d570..f9f84fd622dc9 100644
Binary files a/docs/img/database-access/guides/spanner_selfhosted.png and b/docs/img/database-access/guides/spanner_selfhosted.png differ
diff --git a/docs/img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png b/docs/img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png
index 83599c0327a2b..3f53156b1f673 100644
Binary files a/docs/img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png and b/docs/img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png differ
diff --git a/docs/img/database-access/guides/sqlserver/azure-set-ad-admin.png b/docs/img/database-access/guides/sqlserver/azure-set-ad-admin.png
index 61f532f1649ea..fd49af03b8399 100644
Binary files a/docs/img/database-access/guides/sqlserver/azure-set-ad-admin.png and b/docs/img/database-access/guides/sqlserver/azure-set-ad-admin.png differ
diff --git a/docs/img/database-access/guides/sqlserver/azure-user-managed-identity.png b/docs/img/database-access/guides/sqlserver/azure-user-managed-identity.png
index 7e381d24e8e40..a211d56f25536 100644
Binary files a/docs/img/database-access/guides/sqlserver/azure-user-managed-identity.png and b/docs/img/database-access/guides/sqlserver/azure-user-managed-identity.png differ
diff --git a/docs/img/database-access/guides/sqlserver/cloud-sql-aad.png b/docs/img/database-access/guides/sqlserver/cloud-sql-aad.png
index 9d160142f768b..871b9833db03b 100644
Binary files a/docs/img/database-access/guides/sqlserver/cloud-sql-aad.png and b/docs/img/database-access/guides/sqlserver/cloud-sql-aad.png differ
diff --git a/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png b/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png
index aae0ead22285c..27c62a72adcd3 100644
Binary files a/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png and b/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png differ
diff --git a/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png b/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png
index 9a5bdb7505e43..0e4f300ce95e1 100644
Binary files a/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png and b/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png differ
diff --git a/docs/img/database-access/guides/sqlserver/spn@2x.png b/docs/img/database-access/guides/sqlserver/spn@2x.png
index a107fa50ebc1a..6ec0ea4e1b68a 100644
Binary files a/docs/img/database-access/guides/sqlserver/spn@2x.png and b/docs/img/database-access/guides/sqlserver/spn@2x.png differ
diff --git a/docs/img/database-access/guides/sqlserver/sql-aad.png b/docs/img/database-access/guides/sqlserver/sql-aad.png
index accf6498cef37..26362e684e44a 100644
Binary files a/docs/img/database-access/guides/sqlserver/sql-aad.png and b/docs/img/database-access/guides/sqlserver/sql-aad.png differ
diff --git a/docs/img/database-access/guides/sqlserver/system-managed-identity.png b/docs/img/database-access/guides/sqlserver/system-managed-identity.png
index 77a2e8c7746f3..a2790297d0719 100644
Binary files a/docs/img/database-access/guides/sqlserver/system-managed-identity.png and b/docs/img/database-access/guides/sqlserver/system-managed-identity.png differ
diff --git a/docs/img/database-access/guides/vitess_cloud.png b/docs/img/database-access/guides/vitess_cloud.png
index b87459cf849b4..57f4ce31ea239 100644
Binary files a/docs/img/database-access/guides/vitess_cloud.png and b/docs/img/database-access/guides/vitess_cloud.png differ
diff --git a/docs/img/database-access/guides/vitess_selfhosted.png b/docs/img/database-access/guides/vitess_selfhosted.png
index e48622606ed9c..3da1de5e3cd42 100644
Binary files a/docs/img/database-access/guides/vitess_selfhosted.png and b/docs/img/database-access/guides/vitess_selfhosted.png differ
diff --git a/docs/img/database-access/iam@2x.png b/docs/img/database-access/iam@2x.png
deleted file mode 100644
index 204eab77190e9..0000000000000
Binary files a/docs/img/database-access/iam@2x.png and /dev/null differ
diff --git a/docs/img/database-access/msft-sql-server-management-studio-connection.png b/docs/img/database-access/msft-sql-server-management-studio-connection.png
index 1606266edd9f9..ef0edf375ce55 100644
Binary files a/docs/img/database-access/msft-sql-server-management-studio-connection.png and b/docs/img/database-access/msft-sql-server-management-studio-connection.png differ
diff --git a/docs/img/database-access/pgadmin-connection@2x.png b/docs/img/database-access/pgadmin-connection@2x.png
index 0d28e8164922d..8a054fce914ea 100644
Binary files a/docs/img/database-access/pgadmin-connection@2x.png and b/docs/img/database-access/pgadmin-connection@2x.png differ
diff --git a/docs/img/database-access/pgadmin-ssl@2x.png b/docs/img/database-access/pgadmin-ssl@2x.png
index f574d94a5b737..ec672a10fae19 100644
Binary files a/docs/img/database-access/pgadmin-ssl@2x.png and b/docs/img/database-access/pgadmin-ssl@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png b/docs/img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png
index ef04361d7ee31..c60663c8f47ef 100644
Binary files a/docs/img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png and b/docs/img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png b/docs/img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png
index 1724a0c4c4617..3c32e9879ed43 100644
Binary files a/docs/img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png and b/docs/img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png b/docs/img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png
index 4b97bc5053f48..4039f6c241eee 100644
Binary files a/docs/img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png and b/docs/img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png b/docs/img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png
index cf5f2aede6a79..f1e1cd7ccd80d 100644
Binary files a/docs/img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png and b/docs/img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png b/docs/img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png
index 8fb99f35b0c82..7faab33a57531 100644
Binary files a/docs/img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png and b/docs/img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png differ
diff --git a/docs/img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png b/docs/img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png
index e792b6ddf0473..8bde5c9263714 100644
Binary files a/docs/img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png and b/docs/img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png differ
diff --git a/docs/img/deploy-a-cluster/aws-gslb-proxy-peering-ha-deployment.png b/docs/img/deploy-a-cluster/aws-gslb-proxy-peering-ha-deployment.png
index e43817f5d6ca4..f4b61ef169931 100644
Binary files a/docs/img/deploy-a-cluster/aws-gslb-proxy-peering-ha-deployment.png and b/docs/img/deploy-a-cluster/aws-gslb-proxy-peering-ha-deployment.png differ
diff --git a/docs/img/device-trust/device-trust-shield-dark-failure.png b/docs/img/device-trust/device-trust-shield-dark-failure.png
index 6c0a77cd4b906..a4043406747cd 100644
Binary files a/docs/img/device-trust/device-trust-shield-dark-failure.png and b/docs/img/device-trust/device-trust-shield-dark-failure.png differ
diff --git a/docs/img/device-trust/device-trust-shield-dark-success.png b/docs/img/device-trust/device-trust-shield-dark-success.png
index 631ac80ba2292..4d70b43801e76 100644
Binary files a/docs/img/device-trust/device-trust-shield-dark-success.png and b/docs/img/device-trust/device-trust-shield-dark-success.png differ
diff --git a/docs/img/device-trust/device-trust-shield-light-failure.png b/docs/img/device-trust/device-trust-shield-light-failure.png
index e3e1030530fd7..5327abc00a64b 100644
Binary files a/docs/img/device-trust/device-trust-shield-light-failure.png and b/docs/img/device-trust/device-trust-shield-light-failure.png differ
diff --git a/docs/img/device-trust/device-trust-shield-light-success.png b/docs/img/device-trust/device-trust-shield-light-success.png
index f3feb4e46a885..81e228829f4ff 100644
Binary files a/docs/img/device-trust/device-trust-shield-light-success.png and b/docs/img/device-trust/device-trust-shield-light-success.png differ
diff --git a/docs/img/doc-submodules.png b/docs/img/doc-submodules.png
deleted file mode 100644
index 8250180e268d8..0000000000000
Binary files a/docs/img/doc-submodules.png and /dev/null differ
diff --git a/docs/img/download_files_connect.png b/docs/img/download_files_connect.png
index bfd84203b9cad..c4e45d705d48a 100644
Binary files a/docs/img/download_files_connect.png and b/docs/img/download_files_connect.png differ
diff --git a/docs/img/enroll-resources/enroll-resources-hero.png b/docs/img/enroll-resources/enroll-resources-hero.png
new file mode 100644
index 0000000000000..f9f30d936d17d
Binary files /dev/null and b/docs/img/enroll-resources/enroll-resources-hero.png differ
diff --git a/docs/img/enterprise/plugins/datadog/review-access-request.png b/docs/img/enterprise/plugins/datadog/review-access-request.png
index 05a2ab77bd67d..7e3ea385ce3f2 100644
Binary files a/docs/img/enterprise/plugins/datadog/review-access-request.png and b/docs/img/enterprise/plugins/datadog/review-access-request.png differ
diff --git a/docs/img/enterprise/plugins/datadog/teleport-users.png b/docs/img/enterprise/plugins/datadog/teleport-users.png
index 0d99c7289d237..7f93820b7f75b 100644
Binary files a/docs/img/enterprise/plugins/datadog/teleport-users.png and b/docs/img/enterprise/plugins/datadog/teleport-users.png differ
diff --git a/docs/img/enterprise/plugins/discord/discord-permissions.png b/docs/img/enterprise/plugins/discord/discord-permissions.png
deleted file mode 100644
index 6994faf0f6347..0000000000000
Binary files a/docs/img/enterprise/plugins/discord/discord-permissions.png and /dev/null differ
diff --git a/docs/img/enterprise/plugins/enroll.png b/docs/img/enterprise/plugins/enroll.png
index 958c14122abca..4e9cfae257ab9 100644
Binary files a/docs/img/enterprise/plugins/enroll.png and b/docs/img/enterprise/plugins/enroll.png differ
diff --git a/docs/img/enterprise/plugins/integration-plugin.png b/docs/img/enterprise/plugins/integration-plugin.png
new file mode 100644
index 0000000000000..b8b693a3d3b0a
Binary files /dev/null and b/docs/img/enterprise/plugins/integration-plugin.png differ
diff --git a/docs/img/enterprise/plugins/okta/okta-delete-integration.png b/docs/img/enterprise/plugins/okta/okta-delete-integration.png
index 15aba79019b24..26dab22492901 100644
Binary files a/docs/img/enterprise/plugins/okta/okta-delete-integration.png and b/docs/img/enterprise/plugins/okta/okta-delete-integration.png differ
diff --git a/docs/img/get-started/get-started-audit-log@2x.png b/docs/img/get-started/get-started-audit-log@2x.png
new file mode 100644
index 0000000000000..22f7579e4ac10
Binary files /dev/null and b/docs/img/get-started/get-started-audit-log@2x.png differ
diff --git a/docs/img/get-started/get-started-enroll-resources@2x.png b/docs/img/get-started/get-started-enroll-resources@2x.png
new file mode 100644
index 0000000000000..59d36407e7a1f
Binary files /dev/null and b/docs/img/get-started/get-started-enroll-resources@2x.png differ
diff --git a/docs/img/headless/approval.png b/docs/img/headless/approval.png
index dce71a9a6e8ec..7c84036a642c6 100644
Binary files a/docs/img/headless/approval.png and b/docs/img/headless/approval.png differ
diff --git a/docs/img/headless/confirmation.png b/docs/img/headless/confirmation.png
index 963d55258f7a1..ece8b2041ea63 100644
Binary files a/docs/img/headless/confirmation.png and b/docs/img/headless/confirmation.png differ
diff --git a/docs/img/helm/digitalocean/create-k8s.png b/docs/img/helm/digitalocean/create-k8s.png
index 8fb2bb1c0fce2..113e0664405a7 100644
Binary files a/docs/img/helm/digitalocean/create-k8s.png and b/docs/img/helm/digitalocean/create-k8s.png differ
diff --git a/docs/img/helm/digitalocean/edit-user.png b/docs/img/helm/digitalocean/edit-user.png
index 05fb4b09893bd..800590c03fd4b 100644
Binary files a/docs/img/helm/digitalocean/edit-user.png and b/docs/img/helm/digitalocean/edit-user.png differ
diff --git a/docs/img/helm/digitalocean/fqdn.png b/docs/img/helm/digitalocean/fqdn.png
index 1105fd0baa315..2771e254ac737 100644
Binary files a/docs/img/helm/digitalocean/fqdn.png and b/docs/img/helm/digitalocean/fqdn.png differ
diff --git a/docs/img/helm/digitalocean/setup-k8s.png b/docs/img/helm/digitalocean/setup-k8s.png
index 38550e0ee74d8..cbfd50832ad41 100644
Binary files a/docs/img/helm/digitalocean/setup-k8s.png and b/docs/img/helm/digitalocean/setup-k8s.png differ
diff --git a/docs/img/helm/digitalocean/setup-user.png b/docs/img/helm/digitalocean/setup-user.png
index ace6d96343ab5..5b22ab8488ed0 100644
Binary files a/docs/img/helm/digitalocean/setup-user.png and b/docs/img/helm/digitalocean/setup-user.png differ
diff --git a/docs/img/helm/digitalocean/update-role.png b/docs/img/helm/digitalocean/update-role.png
index 02a7af701276d..a767cf0910036 100644
Binary files a/docs/img/helm/digitalocean/update-role.png and b/docs/img/helm/digitalocean/update-role.png differ
diff --git a/docs/img/helm/digitalocean/view-activity.png b/docs/img/helm/digitalocean/view-activity.png
index 394b85a221466..eb4e67b05b30f 100644
Binary files a/docs/img/helm/digitalocean/view-activity.png and b/docs/img/helm/digitalocean/view-activity.png differ
diff --git a/docs/img/helm/gcp/1-roles@1.5x.png b/docs/img/helm/gcp/1-roles@1.5x.png
index 813454629c3fe..b70741e11ec03 100644
Binary files a/docs/img/helm/gcp/1-roles@1.5x.png and b/docs/img/helm/gcp/1-roles@1.5x.png differ
diff --git a/docs/img/helm/gcp/10-serviceaccountdetails@1.5x.png b/docs/img/helm/gcp/10-serviceaccountdetails@1.5x.png
index 9b0ae83898d29..58569657ed857 100644
Binary files a/docs/img/helm/gcp/10-serviceaccountdetails@1.5x.png and b/docs/img/helm/gcp/10-serviceaccountdetails@1.5x.png differ
diff --git a/docs/img/helm/gcp/11-createkey.png b/docs/img/helm/gcp/11-createkey.png
index 50c36270441f1..4c372578557a4 100644
Binary files a/docs/img/helm/gcp/11-createkey.png and b/docs/img/helm/gcp/11-createkey.png differ
diff --git a/docs/img/helm/gcp/12-privatekey@1.5x.png b/docs/img/helm/gcp/12-privatekey@1.5x.png
index a3a843d6794de..704ed7c780180 100644
Binary files a/docs/img/helm/gcp/12-privatekey@1.5x.png and b/docs/img/helm/gcp/12-privatekey@1.5x.png differ
diff --git a/docs/img/helm/gcp/13-dns-createrole@1.5x.png b/docs/img/helm/gcp/13-dns-createrole@1.5x.png
index 284fc2c2d86ff..c36436530979f 100644
Binary files a/docs/img/helm/gcp/13-dns-createrole@1.5x.png and b/docs/img/helm/gcp/13-dns-createrole@1.5x.png differ
diff --git a/docs/img/helm/gcp/14-dns-permissions-create@1.5x.png b/docs/img/helm/gcp/14-dns-permissions-create@1.5x.png
index 4b64e8fe7bd4e..350d355c1e296 100644
Binary files a/docs/img/helm/gcp/14-dns-permissions-create@1.5x.png and b/docs/img/helm/gcp/14-dns-permissions-create@1.5x.png differ
diff --git a/docs/img/helm/gcp/2-createrole@1.5x.png b/docs/img/helm/gcp/2-createrole@1.5x.png
index 77bf0b5cbc643..2d1aa0909e5df 100644
Binary files a/docs/img/helm/gcp/2-createrole@1.5x.png and b/docs/img/helm/gcp/2-createrole@1.5x.png differ
diff --git a/docs/img/helm/gcp/3-addpermissions@1.5x.png b/docs/img/helm/gcp/3-addpermissions@1.5x.png
index 5a6c70a2192f2..a57460dfb99d3 100644
Binary files a/docs/img/helm/gcp/3-addpermissions@1.5x.png and b/docs/img/helm/gcp/3-addpermissions@1.5x.png differ
diff --git a/docs/img/helm/gcp/4-storagebucketscreate@1.5x.png b/docs/img/helm/gcp/4-storagebucketscreate@1.5x.png
index 5457d1b1a764b..204aa0eae7b85 100644
Binary files a/docs/img/helm/gcp/4-storagebucketscreate@1.5x.png and b/docs/img/helm/gcp/4-storagebucketscreate@1.5x.png differ
diff --git a/docs/img/helm/gcp/5-select@1.5x.png b/docs/img/helm/gcp/5-select@1.5x.png
index 55ae16315c72b..de6542ed21dfa 100644
Binary files a/docs/img/helm/gcp/5-select@1.5x.png and b/docs/img/helm/gcp/5-select@1.5x.png differ
diff --git a/docs/img/helm/gcp/6-createrole@1.5x.png b/docs/img/helm/gcp/6-createrole@1.5x.png
index e4c3edd0782a6..4ff04b549ec23 100644
Binary files a/docs/img/helm/gcp/6-createrole@1.5x.png and b/docs/img/helm/gcp/6-createrole@1.5x.png differ
diff --git a/docs/img/helm/gcp/7-serviceaccounts@1.5x.png b/docs/img/helm/gcp/7-serviceaccounts@1.5x.png
index a55b8c38c6e64..4ab0d82559b3a 100644
Binary files a/docs/img/helm/gcp/7-serviceaccounts@1.5x.png and b/docs/img/helm/gcp/7-serviceaccounts@1.5x.png differ
diff --git a/docs/img/helm/gcp/8-createserviceaccount@1.5x.png b/docs/img/helm/gcp/8-createserviceaccount@1.5x.png
index 6f790f50f2782..0d30f2deda289 100644
Binary files a/docs/img/helm/gcp/8-createserviceaccount@1.5x.png and b/docs/img/helm/gcp/8-createserviceaccount@1.5x.png differ
diff --git a/docs/img/helm/gcp/9-addroles@1.5x.png b/docs/img/helm/gcp/9-addroles@1.5x.png
index ab7a58c12d5c6..c701ace8f2cc3 100644
Binary files a/docs/img/helm/gcp/9-addroles@1.5x.png and b/docs/img/helm/gcp/9-addroles@1.5x.png differ
diff --git a/docs/img/identity-center/ic-app.png b/docs/img/identity-center/ic-app.png
index a4d91becf4cc0..d3fef011b748f 100644
Binary files a/docs/img/identity-center/ic-app.png and b/docs/img/identity-center/ic-app.png differ
diff --git a/docs/img/identity-center/ic-lists.png b/docs/img/identity-center/ic-lists.png
index 05b0bbc721001..bde5657f53aae 100644
Binary files a/docs/img/identity-center/ic-lists.png and b/docs/img/identity-center/ic-lists.png differ
diff --git a/docs/img/identity-center/ic-migrate-end.png b/docs/img/identity-center/ic-migrate-end.png
index 50c922acf1223..399484a5fce69 100644
Binary files a/docs/img/identity-center/ic-migrate-end.png and b/docs/img/identity-center/ic-migrate-end.png differ
diff --git a/docs/img/identity-center/ic-migrate-mid.png b/docs/img/identity-center/ic-migrate-mid.png
index 72adcd42a4f7b..38d9a59a8b1aa 100644
Binary files a/docs/img/identity-center/ic-migrate-mid.png and b/docs/img/identity-center/ic-migrate-mid.png differ
diff --git a/docs/img/identity-center/ic-migrate-start.png b/docs/img/identity-center/ic-migrate-start.png
index 561c5074197fa..7e8c0bb9d9d53 100644
Binary files a/docs/img/identity-center/ic-migrate-start.png and b/docs/img/identity-center/ic-migrate-start.png differ
diff --git a/docs/img/identity-center/ic-pick-integration.png b/docs/img/identity-center/ic-pick-integration.png
index 45407e384c5d3..b154143c2493d 100644
Binary files a/docs/img/identity-center/ic-pick-integration.png and b/docs/img/identity-center/ic-pick-integration.png differ
diff --git a/docs/img/identity-center/ic-promote.png b/docs/img/identity-center/ic-promote.png
index 7f288a6ebdfe7..5cb823d52a468 100644
Binary files a/docs/img/identity-center/ic-promote.png and b/docs/img/identity-center/ic-promote.png differ
diff --git a/docs/img/identity-center/ic-role-assumed.png b/docs/img/identity-center/ic-role-assumed.png
index dae226206e02d..d1af3eaece4e2 100644
Binary files a/docs/img/identity-center/ic-role-assumed.png and b/docs/img/identity-center/ic-role-assumed.png differ
diff --git a/docs/img/identity-center/ic-saml-login-audit-log.png b/docs/img/identity-center/ic-saml-login-audit-log.png
new file mode 100644
index 0000000000000..e995cfc7adb9e
Binary files /dev/null and b/docs/img/identity-center/ic-saml-login-audit-log.png differ
diff --git a/docs/img/identity-center/ic-select-ps.png b/docs/img/identity-center/ic-select-ps.png
index a4400ada18c50..d140707b6498f 100644
Binary files a/docs/img/identity-center/ic-select-ps.png and b/docs/img/identity-center/ic-select-ps.png differ
diff --git a/docs/img/identity-center/ic-step1.1.png b/docs/img/identity-center/ic-step1.1.png
index 7a4b849841285..d6d9f4a21364e 100644
Binary files a/docs/img/identity-center/ic-step1.1.png and b/docs/img/identity-center/ic-step1.1.png differ
diff --git a/docs/img/identity-center/ic-step1.2.png b/docs/img/identity-center/ic-step1.2.png
index f98c0a02da476..1774d12d64195 100644
Binary files a/docs/img/identity-center/ic-step1.2.png and b/docs/img/identity-center/ic-step1.2.png differ
diff --git a/docs/img/identity-center/ic-step2.png b/docs/img/identity-center/ic-step2.png
index 1e392097e9125..9ab6e7821e6f0 100644
Binary files a/docs/img/identity-center/ic-step2.png and b/docs/img/identity-center/ic-step2.png differ
diff --git a/docs/img/identity-center/ic-step3.png b/docs/img/identity-center/ic-step3.png
index 70d871c885928..9a1a9d3f3e84e 100644
Binary files a/docs/img/identity-center/ic-step3.png and b/docs/img/identity-center/ic-step3.png differ
diff --git a/docs/img/identity-center/ic-step4.png b/docs/img/identity-center/ic-step4.png
index 1cd85509a2eb3..9e33a0f816aab 100644
Binary files a/docs/img/identity-center/ic-step4.png and b/docs/img/identity-center/ic-step4.png differ
diff --git a/docs/img/identity-governance/access-lists/alice-review-request.png b/docs/img/identity-governance/access-lists/alice-review-request.png
new file mode 100644
index 0000000000000..aa1f152fad719
Binary files /dev/null and b/docs/img/identity-governance/access-lists/alice-review-request.png differ
diff --git a/docs/img/identity-governance/access-lists/bob-submit-request.png b/docs/img/identity-governance/access-lists/bob-submit-request.png
new file mode 100644
index 0000000000000..98e5c2a2acafb
Binary files /dev/null and b/docs/img/identity-governance/access-lists/bob-submit-request.png differ
diff --git a/docs/img/identity-governance/access-lists/bob-user-roles.png b/docs/img/identity-governance/access-lists/bob-user-roles.png
new file mode 100644
index 0000000000000..502baa78b7406
Binary files /dev/null and b/docs/img/identity-governance/access-lists/bob-user-roles.png differ
diff --git a/docs/img/identity-governance/access-lists/ssh-access-list-owners.png b/docs/img/identity-governance/access-lists/ssh-access-list-owners.png
new file mode 100644
index 0000000000000..0351501de158f
Binary files /dev/null and b/docs/img/identity-governance/access-lists/ssh-access-list-owners.png differ
diff --git a/docs/img/identity-governance/identity-governance-hero.png b/docs/img/identity-governance/identity-governance-hero.png
new file mode 100644
index 0000000000000..47e50d4bcb991
Binary files /dev/null and b/docs/img/identity-governance/identity-governance-hero.png differ
diff --git a/docs/img/identity-security/identity-security-hero.png b/docs/img/identity-security/identity-security-hero.png
new file mode 100644
index 0000000000000..2a58d1a58df5a
Binary files /dev/null and b/docs/img/identity-security/identity-security-hero.png differ
diff --git a/docs/img/identity-security/rec-list-with-summary.png b/docs/img/identity-security/rec-list-with-summary.png
new file mode 100644
index 0000000000000..1238a431f389b
Binary files /dev/null and b/docs/img/identity-security/rec-list-with-summary.png differ
diff --git a/docs/img/identity-security/summary-button.png b/docs/img/identity-security/summary-button.png
new file mode 100644
index 0000000000000..f9b4c42e139fe
Binary files /dev/null and b/docs/img/identity-security/summary-button.png differ
diff --git a/docs/img/igs/entraid/entra-api-permission.png b/docs/img/igs/entraid/entra-api-permission.png
new file mode 100644
index 0000000000000..a7776373c7107
Binary files /dev/null and b/docs/img/igs/entraid/entra-api-permission.png differ
diff --git a/docs/img/igs/entraid/entra-create-enterprise-app.png b/docs/img/igs/entraid/entra-create-enterprise-app.png
new file mode 100644
index 0000000000000..b07c31e5ac9cd
Binary files /dev/null and b/docs/img/igs/entraid/entra-create-enterprise-app.png differ
diff --git a/docs/img/igs/entraid/entra-create-group.png b/docs/img/igs/entraid/entra-create-group.png
new file mode 100644
index 0000000000000..22c8a3e8adb8b
Binary files /dev/null and b/docs/img/igs/entraid/entra-create-group.png differ
diff --git a/docs/img/igs/entraid/entra-default-owners.png b/docs/img/igs/entraid/entra-default-owners.png
new file mode 100644
index 0000000000000..1a69a390b9fdc
Binary files /dev/null and b/docs/img/igs/entraid/entra-default-owners.png differ
diff --git a/docs/img/igs/entraid/entra-finish.png b/docs/img/igs/entraid/entra-finish.png
new file mode 100644
index 0000000000000..4a6b3dab5decb
Binary files /dev/null and b/docs/img/igs/entraid/entra-finish.png differ
diff --git a/docs/img/igs/entraid/entra-setup-oidc.png b/docs/img/igs/entraid/entra-setup-oidc.png
new file mode 100644
index 0000000000000..8c01330a9f1c5
Binary files /dev/null and b/docs/img/igs/entraid/entra-setup-oidc.png differ
diff --git a/docs/img/igs/entraid/entra-sso-config.png b/docs/img/igs/entraid/entra-sso-config.png
new file mode 100644
index 0000000000000..a00bf74995fb7
Binary files /dev/null and b/docs/img/igs/entraid/entra-sso-config.png differ
diff --git a/docs/img/igs/entraid/entra-teleport-acl-long-term.png b/docs/img/igs/entraid/entra-teleport-acl-long-term.png
new file mode 100644
index 0000000000000..70cec8729df30
Binary files /dev/null and b/docs/img/igs/entraid/entra-teleport-acl-long-term.png differ
diff --git a/docs/img/igs/entraid/entra-teleport-acl-short-term.png b/docs/img/igs/entraid/entra-teleport-acl-short-term.png
new file mode 100644
index 0000000000000..7ebfc81de5e17
Binary files /dev/null and b/docs/img/igs/entraid/entra-teleport-acl-short-term.png differ
diff --git a/docs/img/igs/entraid/entra-teleport-grafana-app.png b/docs/img/igs/entraid/entra-teleport-grafana-app.png
new file mode 100644
index 0000000000000..6ecef9006653c
Binary files /dev/null and b/docs/img/igs/entraid/entra-teleport-grafana-app.png differ
diff --git a/docs/img/igs/entraid/entra-teleport-role-mapping.png b/docs/img/igs/entraid/entra-teleport-role-mapping.png
new file mode 100644
index 0000000000000..c4cf9d3adffec
Binary files /dev/null and b/docs/img/igs/entraid/entra-teleport-role-mapping.png differ
diff --git a/docs/img/igs/entraid/entra-teleport-role-yaml-editor.png b/docs/img/igs/entraid/entra-teleport-role-yaml-editor.png
new file mode 100644
index 0000000000000..2de943e6862dd
Binary files /dev/null and b/docs/img/igs/entraid/entra-teleport-role-yaml-editor.png differ
diff --git a/docs/img/infrastructure-as-code/terraform-cloud-variables.png b/docs/img/infrastructure-as-code/terraform-cloud-variables.png
index cba8e494f4c07..e862ed1599342 100644
Binary files a/docs/img/infrastructure-as-code/terraform-cloud-variables.png and b/docs/img/infrastructure-as-code/terraform-cloud-variables.png differ
diff --git a/docs/img/jetbrains-sftp/add-server.png b/docs/img/jetbrains-sftp/add-server.png
index c72cfe9329a42..575d744f97ecb 100644
Binary files a/docs/img/jetbrains-sftp/add-server.png and b/docs/img/jetbrains-sftp/add-server.png differ
diff --git a/docs/img/jetbrains-sftp/browse-window.png b/docs/img/jetbrains-sftp/browse-window.png
index f5ce8cf244f92..8bce4da480219 100644
Binary files a/docs/img/jetbrains-sftp/browse-window.png and b/docs/img/jetbrains-sftp/browse-window.png differ
diff --git a/docs/img/jetbrains-sftp/deployment-added.png b/docs/img/jetbrains-sftp/deployment-added.png
index 0ebbc5ba0af83..b7a7314b76ece 100644
Binary files a/docs/img/jetbrains-sftp/deployment-added.png and b/docs/img/jetbrains-sftp/deployment-added.png differ
diff --git a/docs/img/jetbrains-sftp/deployment-main.png b/docs/img/jetbrains-sftp/deployment-main.png
index ddbf44f28e516..5e0abb730b605 100644
Binary files a/docs/img/jetbrains-sftp/deployment-main.png and b/docs/img/jetbrains-sftp/deployment-main.png differ
diff --git a/docs/img/jetbrains-sftp/ssh-configurations.png b/docs/img/jetbrains-sftp/ssh-configurations.png
index 603d7f6811e6c..05e768fba01f8 100644
Binary files a/docs/img/jetbrains-sftp/ssh-configurations.png and b/docs/img/jetbrains-sftp/ssh-configurations.png differ
diff --git a/docs/img/jetbrains-sftp/successfully-connected.png b/docs/img/jetbrains-sftp/successfully-connected.png
index 44c02523daeb3..c08b572862e5e 100644
Binary files a/docs/img/jetbrains-sftp/successfully-connected.png and b/docs/img/jetbrains-sftp/successfully-connected.png differ
diff --git a/docs/img/k8s/mini-diagrams/k8s-to-teleport-mono.png b/docs/img/k8s/mini-diagrams/k8s-to-teleport-mono.png
deleted file mode 100644
index 3f226d9dba2fd..0000000000000
Binary files a/docs/img/k8s/mini-diagrams/k8s-to-teleport-mono.png and /dev/null differ
diff --git a/docs/img/k8s/mini-diagrams/teleport-in-k8s-mono.png b/docs/img/k8s/mini-diagrams/teleport-in-k8s-mono.png
deleted file mode 100644
index e9f8562e2dea0..0000000000000
Binary files a/docs/img/k8s/mini-diagrams/teleport-in-k8s-mono.png and /dev/null differ
diff --git a/docs/img/k8s/test-k8s-connection.png b/docs/img/k8s/test-k8s-connection.png
deleted file mode 100644
index 8a332d43afec8..0000000000000
Binary files a/docs/img/k8s/test-k8s-connection.png and /dev/null differ
diff --git a/docs/img/machine-id/jenkins.png b/docs/img/machine-id/jenkins.png
index 63f6292946a45..6623c81638ce4 100644
Binary files a/docs/img/machine-id/jenkins.png and b/docs/img/machine-id/jenkins.png differ
diff --git a/docs/img/management/access-list-web-ui.png b/docs/img/management/access-list-web-ui.png
index 360d167251056..5adf1549cd970 100644
Binary files a/docs/img/management/access-list-web-ui.png and b/docs/img/management/access-list-web-ui.png differ
diff --git a/docs/img/management/datadog-diagram.png b/docs/img/management/datadog-diagram.png
index 71cfb3a6f42d2..56466f8d032b1 100644
Binary files a/docs/img/management/datadog-diagram.png and b/docs/img/management/datadog-diagram.png differ
diff --git a/docs/img/management/fluentd-diagram.png b/docs/img/management/fluentd-diagram.png
index cf525cc5d34dd..b20d07b83db78 100644
Binary files a/docs/img/management/fluentd-diagram.png and b/docs/img/management/fluentd-diagram.png differ
diff --git a/docs/img/management/panther-ingest.png b/docs/img/management/panther-ingest.png
index ee8bdd26e2ab3..3a8da03213738 100644
Binary files a/docs/img/management/panther-ingest.png and b/docs/img/management/panther-ingest.png differ
diff --git a/docs/img/management/spacelift/apply-success.png b/docs/img/management/spacelift/apply-success.png
index 69b708d3646f9..ba828b681dd43 100644
Binary files a/docs/img/management/spacelift/apply-success.png and b/docs/img/management/spacelift/apply-success.png differ
diff --git a/docs/img/management/spacelift/id-file.png b/docs/img/management/spacelift/id-file.png
index a420b5a954df0..0341b707be1bb 100644
Binary files a/docs/img/management/spacelift/id-file.png and b/docs/img/management/spacelift/id-file.png differ
diff --git a/docs/img/management/spacelift/newstack.png b/docs/img/management/spacelift/newstack.png
deleted file mode 100644
index c2a632d41e2ea..0000000000000
Binary files a/docs/img/management/spacelift/newstack.png and /dev/null differ
diff --git a/docs/img/management/spacelift/pr-run.png b/docs/img/management/spacelift/pr-run.png
index 42bf01d58b17f..692fc56a8d3af 100644
Binary files a/docs/img/management/spacelift/pr-run.png and b/docs/img/management/spacelift/pr-run.png differ
diff --git a/docs/img/mcp-access/architecture-demo.svg b/docs/img/mcp-access/architecture-demo.svg
new file mode 100644
index 0000000000000..9388f7b5b9092
--- /dev/null
+++ b/docs/img/mcp-access/architecture-demo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1169.84" height="503.25"><g transform="translate(980.5211560738079 -459.18110852663085)" lucid:page-tab-id="vEfyK7~VCnsd"><path d="M-1000 0H500v1000h-1500z" fill="#fff"/><path d="M-399.77 467.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-399.77 607.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-399.7731157592707,601.1811085265144) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#c" transform="matrix(1,0,0,1,-399.7731157592707,601.1811085265144) translate(9.475555555555573 38.87999999999998)"/><use xlink:href="#d" transform="matrix(1,0,0,1,-399.7731157592707,601.1811085265144) translate(59.937777777777775 38.87999999999998)"/><path d="M-381.3 485.26a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#e)"/><path d="M-113.3 467.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-113.3 606.1a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#f" transform="matrix(1,0,0,1,-113.30911844671118,600.0951218255755) translate(12.475555555555573 17.54666666666666)"/><use xlink:href="#g" transform="matrix(1,0,0,1,-113.30911844671118,600.0951218255755) translate(82.79555555555555 17.54666666666666)"/><use xlink:href="#h" transform="matrix(1,0,0,1,-113.30911844671118,600.0951218255755) translate(34.70666666666668 38.87999999999998)"/><path d="M-115.3 525.18h-137.97" stroke="#697986" stroke-width="2" fill="none"/><path d="M-114.3 526.16h-1.03v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-268.54 525.18l14.27-4.63v9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#i" transform="matrix(1,0,0,1,-225.08109210299114,529.1811085266309) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-225.08109210299114,529.1811085266309) translate(5.147222222222222 38.879999999999995)"/><path d="M-94.84 485.26a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#k)"/><path d="M131.2 557.38l-.08 1.06-.26 1.06-.42 1-.57.95-.7.83-.84.7-.94.58-1.02.42-1.06.26-1.05.08H34.19v-1.95h90l.8-.07.78-.18.73-.3.68-.4.6-.52.5-.6.42-.67.3-.73.2-.77.05-.82v-9.85h1.95zM125.32 488l1.06.26 1.02.42.93.57.83.7.7.84.58.93.42 1 .26 1.07.08 1.06v9.93h-1.95v-9.87l-.06-.82-.2-.76-.3-.72-.4-.68-.52-.6-.6-.5-.67-.42-.72-.3-.77-.2-.8-.05H16.7v-1.95h107.56z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M16.72 489.87H15.7v-1.95h1.02z" fill="#697986"/><path stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M33.2 567.98l-14.27-4.63 14.26-4.64z" fill="#697986"/><path d="M34.17 569.32l-18.4-5.98 18.4-5.97zm-12.1-5.98l10.15 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#l" transform="matrix(1,0,0,1,71.13355090739597,504.78675720866653) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#m" transform="matrix(1,0,0,1,71.13355090739597,504.78675720866653) translate(70.32499999999999 17.546666666666667)"/><use xlink:href="#n" transform="matrix(1,0,0,1,71.13355090739597,504.78675720866653) translate(11.471666666666671 38.879999999999995)"/><use xlink:href="#o" transform="matrix(1,0,0,1,71.13355090739597,504.78675720866653) translate(54.467222222222226 38.879999999999995)"/><path d="M-399.77 787.1a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-399.77 927.1a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-399.7731157592707,921.1001216818322) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#p" transform="matrix(1,0,0,1,-399.7731157592707,921.1001216818322) translate(13.133333333333354 38.87999999999998)"/><use xlink:href="#d" transform="matrix(1,0,0,1,-399.7731157592707,921.1001216818322) translate(56.28 38.87999999999998)"/><path d="M-381.3 805.18a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#q)"/><path d="M-229.8 839.14l-.08 1.05-.26 1.06-.42 1-.57.94-.7.83-.84.72-.94.57-1.02.42-1.06.25-1.06.08h-15.53v-1.96h15.46l.8-.06.78-.18.73-.3.68-.42.6-.5.5-.6.42-.68.3-.73.2-.76.05-.84V726.43h1.95zm-5.88-274.93l1.06.26 1.02.42.93.58.83.7.7.84.58.93.42 1 .26 1.08.08 1.06v112.7h-1.95V571.15l-.06-.82-.2-.77-.3-.73-.4-.67-.52-.6-.6-.5-.67-.42-.72-.3-.77-.2-.8-.05h-32.97v-1.96h33.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-269.75 566.08h-1.02v-1.96h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-253.27 849.74l-14.27-4.64 14.27-4.63z" fill="#697986"/><path d="M-252.3 851.08l-18.4-5.98 18.4-5.98zm-12.08-5.98l10.13 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#r" transform="matrix(1,0,0,1,-283.3687213148259,683.7668057336796) translate(0 17.546666666666667)"/><use xlink:href="#s" transform="matrix(1,0,0,1,-283.3687213148259,683.7668057336796) translate(31.39611111111112 38.879999999999995)"/><path d="M-679.16 467.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-697.3 607.18a6 6 0 0 1 6-6H-539a6 6 0 0 1 6 6v16.33a6 6 0 0 1-6 6h-152.3a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#t" transform="matrix(1,0,0,1,-697.3072288168055,601.1811085267109) translate(18.108888888888913 21.379999999999995)"/><use xlink:href="#u" transform="matrix(1,0,0,1,-697.3072288168055,601.1811085267109) translate(46.295555555555566 21.379999999999995)"/><use xlink:href="#v" transform="matrix(1,0,0,1,-697.3072288168055,601.1811085267109) translate(83.22888888888889 21.379999999999995)"/><path d="M-587.24 497h-54.87c-3.07 0-5.73 2.65-5.73 5.75v43.36c0 3.33 2.46 5.76 5.52 5.76l25.43.44h29.9c3.06 0 5.72-2.65 5.72-5.75v-43.8c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.2l-11.1 7.75c-1.08.66-2.4.44-3.08-.44-.66-1.1-.46-2.43.47-3.1l8.4-5.96-8.4-5.98c-1.13-.66-1.33-2-.47-3.1.67-1.1 2-1.32 3.07-.44l11.12 7.75c.66.44.86 1.1.86 1.77 0 .66-.46 1.32-.86 1.77zm22.98 10.4h-17.7c-1.34 0-2.2-.88-2.2-2.2 0-1.33.86-2.22 2.2-2.22h17.7c1.33 0 2.2.9 2.2 2.2 0 1.34-.87 2.23-2.2 2.23z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M-549.16 525.18h130.88" stroke="#697986" stroke-width="2" fill="none"/><path d="M-549.13 526.16h-1.03v-1.95h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-403 525.18l-14.27 4.64v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><g><use xlink:href="#w" transform="matrix(1,0,0,1,-497.10245102330606,529.1811085267474) translate(0.004999999999999005 17.546666666666667)"/></g><g filter="url(#x)"><path d="M-974.52 467.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M-974.52 607.18a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#y" transform="matrix(1,0,0,1,-974.5211560738079,601.1811085266309) translate(18.480000000000018 17.54666666666666)"/><use xlink:href="#z" transform="matrix(1,0,0,1,-974.5211560738079,601.1811085266309) translate(61.47555555555556 17.54666666666666)"/><use xlink:href="#A" transform="matrix(1,0,0,1,-974.5211560738079,601.1811085266309) translate(38.97333333333334 38.87999999999998)"/></g><path d="M-895.25 510.94c0 8.55-6.9 15.43-15.4 15.43s-15.45-6.88-15.45-15.43c0-8.54 6.94-15.42 15.45-15.42 8.5 0 15.4 6.88 15.4 15.42zM-937.95 550.1c0-10.5 8.5-19 19-19h14.2c10.5 0 19 8.5 19 19 0 2.6-2.14 4.74-4.75 4.74h-42.7c-2.6 0-4.75-2.13-4.75-4.75z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-844.52 525.18h145.86" stroke="#697986" stroke-width="2" fill="none"/><path d="M-844.5 526.16h-1.02v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-683.4 525.18l-14.26 4.64v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><defs><image width="10" height="10" id="P" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9B4AcxZX2e9U9MzsblEUwYLAQSUg7MxskES18TtggaWe1wmBj+87pHHA8+xz+M7J99tk+n/EZ53CHExjt7qwAA8bhCAYkbZqZlRA52GCCctg0M91V/3uzEkgbZ2Y7zOx0bfd2d3XVe9/7qup1dVV3jwAvlCwDLUvuro7WJk9uru8+e03t5hVvq3vqoivqtkWbwp3/Eg1v/cG6SPIXzeGuO6Lhzs6m0NZHaH2O1n20DkZDnSnaSl4P7w82hTrp3BZO8wjn4bwsI0qyWCbLZh1rSBfrZN0thKFkCfSAg+cASqgSNIe3vKUlnPz3taHN265seOJZ5Z/9tMLhHcow4wLF5ozcd19GptpR4X8qhR80ZeqdUqlLlVKNZOZZtJ5E6xxagwqUn7bI6+H9IICic8hpzuI8nJdlsCyWybJZB+tinVndhIGxMCbGxhhJpreUCAOeAyjOgsL1dQ+tXxeOf7U50vMnukJnrmp4Wgmsvl2C+QUEbelwZvfJpsosAIAaBVBBW5TKAKVMUCDpkGJpjxo17Re6vCKDZbJs1kHSkM6wzhqTMDAWJEySsDFGxsqYGXtLOP7v68IPtYAXipIBzwEUWbE01XYtXV/3sMyYh242VfrzUhr/oEDpQ5mdYMgBkCpDiKn5AV+8abcoFsaistgYI2NVhJmxGyr9BVMd2kg2qdW1XdwLKQrEHggA5sBzAMxCkax8P61p/s0Z8wAh4kZFmxmxILBNfuHvurr2rqoZYdIMMcJzAEVUkKa/eouUqWooqqs7WBSQegipmgGcv9UigZ4YCxjwHIAFJFoh4tLIHQsRfUuo62yFuKKUwbYh6kuaah84rigBliEozwEUSaHPwpNON+VwkaCxD4ZUw6CJWYvt0+BJzoWBI2k8B3CECZe3UvnOQEB0GYYD6hE11DwH4ADTuajwHEAuLDmQxlSpsx1QUxQqMjC8pCiAeCC8B4GKpQ4gqPOLBYvtOJRaabsOT0FODHg9gJxosj+RArnKfi3FoQEBX1scSMoTxdFWew7gaDZc2l912v9WVOjzXNLuvNqAPhsuOOuWGuc1expHM+A5gNGMuHA8f07dFWnzkAua3VHJtp5c9Zp17mj3tB7NgOcAjmbDpX0JqejII74uAXBYrVQGpOWg936Aw7yPp85zAOOx4nCcD6vrFTUKh9W6po5t9YlZta4BKGPFo033HMBoRhw+bjnvoXmmHAgCIJRPQDDMwcrL67v5bcbyMbsILfUcgMuFIvuHjqMZgEqXYTiunm3WFS50XLGn8BgGPAdwDB3OH0g/LAAU/G6988pd1IgoAqh8ngNwsQxYtecAmAUXV82EldnvdriIwRXVSgHKdPk8/OQKyccqHe/IcwDjseJgnAR4oypDD8A2K4Q3Oki1p2ocBjwHMA4pTkYJ0N8AZegA2GYNA5eAF1xlwHMALtK/+qz7a/z6LBcRuKta16pgbfjuOe6iKG/tngNwsfwDwarL09nPf7kIwkXVGeMAaGLuZS5CKBvVExnqOYCJmHEgPgPDb5XScEBTcargJwJNc+jy4kRXHqg8B+BiOVdo8xcpMF1E4K5qtr1Cn/9qd1GUt3bPAbhU/lfXJqtSxv4TAMrpCUAYFRBSxsETmItRJ7xDhxjwHIBDRI9WM6yZlQjKexAGzOOYi9H8eMfWMTCZJM8BTMaOneeEP6iJYNl/I18XwUogLuyk2pM9MQOeA5iYG1vPmGb/ZeX0CvBEZDIHGbO/aaLzXry9DHgOwF5+J5QuIHCpUuU7AHiEGKUkaOi79Mixt3WWAc8BOMv3y9qo+38ZPw77ckSZ7iiQ4MOaN5Wp+babPZUCzwFMxZAN59+05PfzENEGyaUpkp1AS+Q+b0DUheLzHIALpM/2v3ol3fe6oLk4VRpyABDneZ8Kd6F4PAfgAukmDF0ivfv/l5lnLkyVLpvPor9seBHseA7AhULQReAUoHtfF1QXqUoeCPQTJ0UKr0Rh5QLbcwC5sGRhmg2wQaTl0FkACF44wgCCIYfP3ADKq49HKHFo6xHuENFH1DwESxCVOuPIsbcdYUApeeZD0Op5xRE6HPvvOQDHqB5RJCOL3y9ERdXIkff/CAO6qAiatYs+cOTY2zrDgOcAHOD5bY3bTlkX6v63lrptCpT6gSmHHNBaWioM4gSF+P66SFJFw1s/H61NnlxaFhQX2lzReA4gV6YKSLcmsvn1V9Q93JtKDz4uEb5smIMgy+gHQPKljB8LNuUwZdO+qnD4sbfVPbxlTWTLEorwFpsY8ByAxcS+e9XTFU2hzmhT7da/BcScP6bNAxFSEfAe+yUWclwOcxVMmQdWVGoLH4qGOnvXLuu6tKVlo5ajCC9Zjgy46gBWL72/YV24JxYNbX2GGk1sde39NDqeI/IiTBaNJN9zcN/ugwStHRBOyRi8641rER8FLgjDmd1A900RFPJ28/FFe5pqO99coLCiyLb6rN5XUV1vpwvE7mi4+3drw51hN4G55gBaIslfVvjndklQTQrwVETRVOlb+EhTaOuudXV932gOd73FTWLy0R2NdL2HCvMJIvNnCqQPqMrmk99LmxMDNHlizvbplXdGIz2bo6GeknmDMBrpfX1L5KEv0YXuucrq6r9TXY8Cwnyy+q1+URlfF07+lPYtW/IRRHU2n+RWpFViXaRvEw36XJ0x+2lMjN+IU9ltytjPChaY5tBnpJK3t9RtV83hnh9fXXtX1QYovjni1Ut6FkdDXUNKqp8pZZ4+cv/KJnirXQxkzAFQ0lgJKGPN4fij9fU/Jodrl7bC5G6ADWLVqrt1wvftKyIPm0pm/mjI/i8qgJNSxj6gupIVzFu2x1RD722uS3TQhcPx9ui4wuZw4ocAcg2QC4QpgsGFDer9Kf2k/mSoq299Xd/3onXJlVNks/302qXdp7fUbb/FH9AfVyArwLvi2875aAVKSRpQzZx5mrk83RTqvrml/snZo9M4fdwc6W1YX7fj28nQW3oXHlyYAZCfSMuDObQxBFSwdl2493qnMecAzjpITeHOf5Eq/X5TpnIWesRLAqhzM+bQh4VSm9dFEgPRcM/Hm2qTx126+I5AzsKmmfD99d2+pmWd7/P7g08YZv9qU/KI9TSFetmnwQC5X5Wm/MZ6JQ/tj4bjF/CVlyIcWVqWbPe3RHoXRpduvmZdJLlPgNaVMQ99gupqyKCLl8xjxsekNmEq40N0C/xJR8AfVuKYA4hGOi8WoP8nTDNkiZKpSgS4DkTq75XVJ8TJ814fPee+E6cpetLszfXJFXukeEJovp9k6NYFcujBgBccYgCB64VAcf+8fdXb3rKk8wQ7FbdE7lu4LpL4lvSn44Y0nkPd/11TDs8xLLggCPT919pQYnmh+PPN54gDiNZuOVnHyntNlaHboHwhjp9esndVSpcqc45S8iOBqpOep65gX3Oo5x0tdT2Lx8+Vf+zVtcmq5kj3FzWlbZEyc4rMXnHyl+PlsJ8BaoSgwDx7VnDOC9FQ1wesHB+INvQtao50Xdkc7urStZN2SmV8SqrMEgDlp33LjDOpjfg1fevqyP2vskzoJIIccQCIejJDXSK6atMyCZoCT/FtAk8XAZjLFKpfGWamjzw0zSbEP1OgyGy2prP/NH9QmI8qBV/KEH6KtAU/yfUWyxhA4IE2EvejReqCHW8kB077BS/r6uIfp3vzXSoztE0pvFEq2cB1Tdn0OjdVMOS6pquKRMGg88hoswNQGA133UONcl4emKaVdKRgMEhXgwWg4BtXNjylouHu25vCPe9bG46flqvwdXV9H6ioOm03efmTRmTmmtNLVwwM0OgA0H344jm63r++7qH1hzFR+zq8N8FmzdLOU6K1W98bjfTccmXDEwoUXmeq9AJKXulwPVgYDXf9kXoYU2ImbAUvtjqAdaHeJgTttYpGbMHxgHRfmIbhzC6ggnsLKOMnGsgnaS62P1rbtXoyOET8M6Y5/KNhY89kybxzJcBAhsZrDDl4M5VpkuBOeAvKDxg1hbbu03X9GYXwUyWN1cOZPVSHeMDa1jZIsMYuVGcBQXt9c23fZZBjKCSZbQ5gTe3WizStsp2uoIXgsiWPVIagGlCl68FbmkJdal1dcmNT7eaPrjrtfytYYXOkt6E53PusUupUAErJkSW5jmBH1ECgDzRRAT6tGgL6XAj6FkKl/3haT4QK34LsWuk/kY6Pz57jNJyW83BeRO0wAyMyDx+U1EbxBUip2uZw/Ekataf7doBVqzboTeEtH14X2X7j2tBW6dOr7gTAOVRfBRRJICyg675bm5ZtPc8uSLYY23Leg0FNaL9Km/worF3QC5ebyd7PSzDN4RZA7b9PmH/RUFPtlseQpnGkSp9cao0fAeFwSNN4y6Bfm30Q0fe8kuoWTav8t7QceI9hHDovPfjiq27sXoS/6TqN1lfjTd2nZ9ffdL2ajk9DPpcePPiqTGb/+dR9fi/nVVLeKlB/YUSmxq8x8rwbIP0d1lkSG0UOXarUIgD9IbrSbzux/+oMKPE9Uw5ciQCYoZ5CMZZ72jwEQtN//e5VT2cvUmBxEBbLy4qTQ/47EARdRaEEgqJBoz2AKM4ws9M4VB2KGrWiq7o/e+UWqA0g+lqFVvVPoPBSXVRFNBw47ebec2bHEnUndfQ1rt3Yc/a/35o8/39ifSu3xB6++IWpTIs93PBCx7YLNm/qO//nnLejb/ma9kT9q1imhuJU1gGaTrqC70HU2hDFYMA3P4upGBvQsfYiGPzaMYilfGsIUCq9Glx0cP+eW4+1xZojYY2YV6Q013Z+VCm1SqrMK5ElsKeKuDIg6sQgKto+Tw1wGx18fP/+XbPbEw3VsUTd+rbec/+XGurvW+NLd7TGL95F521ZWuN1u1hHR2/97zfGl/1PLNHQEks0Vg0bz84FJT+pa9XbGCMrRzxy68BHxbWq7PcYi93Rv8LZSFtSb6Dp6A++EnvsXqFHljsAJcR/jxBcKCQv3wgDSPftNUANah/9+6ip8JyhQOac1viy2vZE5L/vfGLlwZF07v/flLhkf3uy/rrW3qW1wcCsc4Q0zxGof5SwH/BpNQSwdBobgS3KRdE4Bi3ftxqcpQ4gGu5+hkcvrQZZLvIQBPDgG6L2uEDfDSozWBtL1M+Lxeuuv7Wv8dE7txZPo4cJwm+2nnGwfdv5j7TFw9cT9jkmDIU09P0CUTyhiSAg2QheKIgBurBic7j78YIyT5DJMgfQHEn8EzX+Ernvh6ILPm0WN46/mDi4ZKh/5zK6yv9j67YG7u4XHdZ8ALX31ve1JSLvHurftTQDg+ciiAdHegXghbwZUCCVXLyutvedeWedIIMlDqBl0R9ngzJ/PoEOL3oCBjRRQY0ehoXwfU8ZBxdRN/rijt7zHr7zibfw5PMEuUozmm26Jb5yB9l4gZEZOF2IwPcQcFgTjr3LVZrEjUFNTkDIG95Ye1fVkVPT2VriAMxZ8x6S/Gz+dJCUWV6Bvoyp9ReBJgAAEABJREFUBv9fLLki2B6vu6a1b8XT5UJBbFvjU+3x8DWx5PKghPQXETWjXGy3wk6lTKzGeQ9bIWvaDqA53PUWAuTIiwtWGOymDEGj+UL4CYL4pAkHjutInPdVOijrJRZf/hUJhxbS6MenuDfAHJU1ITkar0Cd3BSOvyHH5BMmm7YDEFhxO82n4oQavBOAkKV5UAHe2B6PYEey8ToeOQcvZBlgLtqTDd9ui4epHombKHIQiTXaesuEDCjUEP8w4ekcT2RrZo5pxyRbX/fQzabkh8PGnPIiDjPg12dTVRa3+XWNRvTr3n442ttMwEB7InKVrukhQLzDTwOjEyTzookBKTOwLrKNHSYdFbYU7ACikd5TM+bAGuqKFKZ5hufSBHf18fmMeeAyGvhafXNPw5Mz3GTLzGvtrX8ilmh8q2Ec4pe2Xhjh0jLxM0aQAglSDq7lNxgLNapgBwDS/D8E8IZwxzDPj+r6QCr5TUMXZ8QSK24fk8SLyImB9r7ltxm6tlgp+S2B/O1PlVO+8kokKjRd3FWozQU5gGg4fpUQvkWqiB+fLZSQ6eRDQBAYeE7JdEssUf+vt/U0DIIXpsUAc9ieqP+0qYwriNu/M8fTEjjDMivqBWjoPyca6ryiENPydgAbQAmljM+aMlWIvhmbB1EHhZBsT0ROifWtbJuxhrpk2Kbk8o3E7ckIYhuiBl4AOMIBv+CkED/LnyM/EpfrNm8H0Le0c42uBZflqqAc0vn12eATgQ90JJa7+isv5cA1zRbU6hj4oF+fUw7m5myjjsFwMnTpW3LOcDhh3g4gEJgXM8z+w9nLfcMdUhxIZ/Ycf3Pv0p+UOxtO2b8xvuxHUjx/IgDSLRaCFwAM2Q8Bfe5t+XKRlwNYX7f9w8PGXtLhkY4oQEP/g6Dk2R19F+wkUrzFQQZauy55UZpDZwvh34KYVzV2EKWTqhBSxj5YH3non/PRmhdzGXPwi/kIn6lp+X5fQ/8DbYnwBbG+lX+fqXYWu123bH/tc+3x8Hk6VjwgUC92uJbim0iYIQeunejcePE5O4CmUOdnNRE4bjwh5RZH01Lfbo2HLjxstzq89TbOM5DlfmN8GZfFdc6rLz6NQgROaApv/XSuyHJyAKtOu7vCJ4JfNsv8qT9BVxmB/p90JBs/lSvBXjpnGGhP1H9SaP6fchk5o7E4tXAb1TH41Utz/Mm8nBzACXOO/4eMHPIBlO+9P7LtSn2ZpqI+AF4oSgbaeyPvV8r8SrasihKhE6CQBgSHfbNqTn1dLtpycgApGKQR7mxvKxeZMy6NQA0A8Us0BXUteKGoGYgll38RQXxZUG8NZmiY2iwFdMH+8dTpAKZ0AM3hrrfQvGvZvu6LzCKKH8USjRt4tzRXhRtAiZaWjVpLi9JWrbpbH2/lc5yG0wI/1lSaxkLWUaP2oxKFbwlsTQROaarrfPNUwiZ1ANmKgNp/GZKmW6eSNAPPI19FhPhGe7zug6VkXkt996ubI71XRkPd311fv+PGaKjnvr5wz3bjsVOfNx7rHFqwf07muIPHZ44/dGJ25f35FMfnOE1fuHs75xnJ2/1dlsUyS4kDmh34IKD4z3LtCXCbFVL/9lRPB07qAB6q7TtVSuM1pVTwVmFF6vYj4l9i8cbPWiXTDjl81W6qfeC4aF1yZXM4/psr6h5WqCr/CkrdqEBekzEOXqnAvJDujc8h/TyL4zNVGjLmIUgbB7Ir70uKo/M0zgPHKSXP4TyZbF55DctimSybdbAu1sm6KU/RLh2Jxs+QE/8Ll2XRgrQRmFLp1yTCa149mYpJHYBE9W5EUYZv/CEICPyhPV53MRRpaIEWrSm09YfwxI4eQP1poWCzUsZVafNgtnFLxV/ZUoQeaS104bzkRkgWOwmWzTpYF+tk3YyBsRSqwe58bfHQxQJ9fwZgW6DkQ14GoF4hpHzXZHkmdQB+X/UXlTInyz8jzyHgAUwPTUqcG4bzhyCjkd6LqdHdF2j8toGo/bMhD4UIS6Uph4GaKu3au7AO1kVaKlk3Y2AsjImxMUY6V1SLFAeupopeNL+j4BQ53Hb9/lkbJtNHvIx/OhrqviZtlB1n4NOqYWjAfHXrjuUvjs+MO7HRcPfXZmknPgfKvBcALxpIP089c3bOCO4FzGJgLECYGBtjZKxQRCHWc/ELgwPyFC7bIoLlCJSMcQioPD40kbIJHIBCTatoOXxfOFHeGRevCT8oCW8vll/d4Yc5WiI7PhgN9wwgiM+ZcnCOIoBA13oouqCAsTFGJKzNhJmxsw1QBIHLVAK8g8u4COA4BoHbsIYVb6M6M+6VYlwHsPqsB6oNc+BCgHHzwEwMiAJMmfpDa+LcG4vBvrWhLVfPmvWaYepm/0Apo1Jmf2uxFMoDgbFKwszY2Qa2pRg4bes99zeGOfwnLutiwJMvhsLSIxhy4AJu0+PlH9cB+IJVUU0ESqG2jWdTAXEKaLT4yY7kyjdRZlftXhvqWt4c6bnXJyp/mTYPEJzSXtgGtoVtYttctgY39Z33Bi5rKMpelD3saKJC+Cqq14wnfVwHQNMHN9DVcLz0MzJOwwBVB/VPh41Th7eOb2i+/UsBvWYrTb1ebGTfu3DVF1lkP9IVaAjYpoBevZVttEhwIWKyZWsq471c5oUIKMU8Jg0QSxj+5XjYxziAaLizUdC98HiJZ2KcJqjxS/PjsXjdfW7Zd9mSv7y6Odz7GN1EfzFtlP5VfyIes4PKSn2Rbb1sSfek89MTybAiflOi8R4J8hNc9lbIKwUZmgji2rqe+tFYxzgAVOIyU6ZHp5uxx1JmHqs5eOjHbhnYXNt5ebBi7l9NlVksab7dLRxO6WUbTbI1WFHxV7bdKb2j9cyac/BHUqYt/aXd0TqsPJ6uLO4FUDfsstFyxjgAJfSq0Ylm6nHQdwKgabbc8Mwlw27Y2FTbdaNCuJUGXIE6+7S4gcJ5nWQoss1sO3PgPAKAG+65ZFgZqZag73g31LuiUyhVM1rxGAeAkOlB1Eanm3HHCAIGjed/2L59ZR84HC6v765sjiRv0DTflQqyt6UOIygOdWw7c9Ac6buBOXEaVcdDFyWHMi/8CKkuwAwP3KYRtE4YFcY4gPZ4400a8q/ajEo5ww4V4sGgUf0lN8wKmKJLytS7TO/T6sAcSDn8Lr8put0oiwqzegP1SGb8E28CfNCerN8Io8IYB8DnDd/QApoq2c/7M3HVRSVdd43v37R92UtO2scv0ERDXc9IUEuAEDipu7h1cV9AncPcrF66xdE+OdcBA9QPuE4UK0fTxcVtGdMD88eTM64D6OhcsSeWqJ8rUB8YL1Opx9EU20ubEis/77QdCP4uBfJUVQaDfflyy5wwN7oY203NV1a+6W9JLv+cKYdm5JedNWrD3JZbd5zPn/MeQ40YE3NURHuiroa6R3fNrGeoldK14MeOMtP23ZYld1c3h3seASFcm/qy3UirFBBHzBVzZpXIXOQIUUl1Qs2YAZnDbfYPbYnbZk1m/6QOAABVLLnizVKZ30CcIimUQlDg02YPtvYuu9lJtMo//0fE4Vl8lXNSbynqYo6YK/DPc3Rqti2+9LdcN2bCrRm3VSnNb3YkV7wJYIOcrB7k1Krb4rWfBU2/zK/PnkxW0Z/z63Nh2NxzuZNAmyM9vwWUbwfvnj8P2hUoVFc1R3p/m0emaSfNGHtX+/Xi+smxfI3iNiqEuLwtUfuvueTNyQGwoFhP5PZ0ZuAfqCIPISBHldyaMQ89fmvywrudAt4c7l6rlLyCR7qd0jlT9DBnSplXRENbm5yyqaPvgv/LmP0l+XAQjrTJoVTm4Ovbeut/lytnOTsAFtjRV/9/ekYsEsK/i3w0R5XUqlD+2inAVyztOQfR30EOwCmVk+hRVD0ECPSBT6uCCt8CqAqcBNWBV2dX3q/wzQc+x2kQuFoocDswd0IEYy2RLTRr4gwaRHCsjlhlEbdFbpN6Bhdt6lv+53zkcknnkx74Qxnpwf7TqbLcL1DPK6+biXlQxBxMX+cUBlPXfkezDa61Ik0EQBdBoCvDdp+ovgmU/JIG+luH4eAZN3Wfrv2682T8VeeJ2ZX3b+r+tWbK/jMF+C7jtJTntwi4nWVoJAtcCoYcUkpV3OaU+szg8HVcV5zSN109AnV23PenqU1y28xXXt4OgBXc+uiFh6B36Srad6w7TboKXhA1kDD8gyzugqXknjFa2/19CcYiBKAFHA2IAjQMSGlm3tsar8XaZGNoY3zpVbG+FRs2JmrvuLX3/CcI0DgDQxtke2Ll462JZbdn08aXXsl5W0mGNI33kROQSLIpr6MLEYjMZXNt5w+cUMx1xFRDP0SqM07om0xHLufoCnM3t0XGnUv60WkKcgAspBXQbE/Uvw4Av65hACgQFvpfhAtS3z9o6J9xAlo0tOUSn171Ibp/dUJdVgcCcqMHn6i8Hkz12rZEWIv1Nf4cKGygEUjaFLQcyRvra/hZWzysKVOtoi759zTqEbDOgoQWkIm51PWaD64mbgvInneWStP3aVD0l3dOxzIoLdvm8Os0x/86bouFai7YARxR2MEPUUDq3bpWiUfiim2rEHqfnbc35QQuRN8306ZzT5YiCAWo38uNfmN82Udj25bb9lpzx7bl97bHa69pi2/ShPDdm9UNzgTmlDq7/+mEtmxdQexxQlchOritmZh6F7e9QvIfnWfaDoCFdSRW/EJCOjRy76Q4qmhWpG4rIt52zz2X8HeybcW1tvbBjwv0Ndiq5LBwQfd+tMapr98YS9Tx7Zg8fMqBzQbZFo+sYt0CfQlBWBxQCprw1TeFNn/Cbl1cV7jOIFrSPCyEy8+xVNPtbDrUEV8x7gc+8lVmmYXtvfV9G3vPRQTtJYDi6Qz4tTmQFn//Ftgc3rrsd3NpDvk6w4lfUULq6IO6sT1RX7dp28pem02bUDzrbk/URSSom6jIzQkTWnSCufVps7/91mV/mWuRyAnFpEXXt7juTJjA5hNjxSNRrL3IbYzb2tjzhcVY5gCOqB8amHMqeYFugb4jUS5uEVLGvgdu67nc9t82q9RO+VDGPES2Iq22LSqgzwdAuCiWaHg7jAQ3u1xZ3R2JhqsAfRcF9HmMKBvHO9avmP3Rk6Be82HrZR8r8baeDwxy3QEiG1wOAv2MopPa1mlWQ7HcAdz5xOJ0LLG8UcOKn+mi0mq8eckTqNFIjvhyXpkKS0wj1ea/F5Y191yIuHvvcw9WU/dvc+65nEnZEa/bvDfzVDWC2A02B5oX/AqpsNXTkvxs3eE6xPturdyGNBH4aSy5fAW3LatxWO4AADB7BdgYX/I+Q6XWu0mgVMYhH+gPgc2hOdTzC6DqYqcaIXQzlrjjhD+89M4BO/VMR/Yf+t40EEvefoJA3ebxCAnRUPevpoM1l7xcd6TKcLcul+SWp+G2Y0KmZWPvkvePCB9pWyP71vy3wQG8Aqwj0UAzFOIqisk6Bdo6uCjwa1W74MzHbP2Fn5YlD85DIbAlHi8AABAASURBVNZQRbHLNuZuZ3u8nu6pNtjcsKwwYYNsT9TrdHnm12sZuxVCj5HBXAuhXc7cH3PC6gOqOzrXIZud+2jYfIyA0kRxVSxe18bHdq22OgAG3R6vu0lIc4kugsN87NSKNDKdkgNbWlvX2zs4FVi4TCpzFgCCHYHuq3H2gR2nkmxbGhPJtWNRswgzY7dDOBDXzLnmn1sLNgauOxk5uIXrko1qxojmtmIoXLKJ2s6YkxZH2O4AGG/7tvMfMUx1qiZ8js2tEokgRMX1rN/O1ZB7b+AHVezRgcawOthwwzP/6KjztMIWxszYAdAAG4JSJqTVwRtsEH2MSK5DXJeOibTxQBO+bgDj1bf2NT5qo5qXRTviAFhbR19oZ1u8rkGATobZc7WEowIXWqw3tOWoKMt31y594HS6ylk+MstABfVgNNRv2NRb75jTZL1WroydbWBbrJR7RJZfn3fq6iUPLj5ybMeW65AmgnaIHiUTgXoaD1MbaWyN1+0addK2Q8ccwBEL2pP1Z9OA2Y98mr1fHx8ydm8+otOurdArvkVTRTaIR6DacF9bou59UOKBbUAU/IvGllvC3Pv8AdufDkwZex60HPxRAg+3he/HEvVLjop2ZNdxB8BWdSRXfNCQmU8g6DY9nosgAG8HG8O7T3u6QoA4h5yZ5VoEaFKapu1z3ZYDn0CgaRofYZsmOD2NaEXDc7jk3auerpiGkByy6r8DIKcM1ge66qeIn2s6kss/Yr30qSWKqZPYkyKWiHzHr8+i+x17xrZouHy7PchHpB6cv2euqdJnjRxZ9x9RAwlyU0dfo634rUM8tSS2hW1i26ZOnV8KpTJnHjy0x9YnAxUYO/JDlWtqBQGtpqs9Gf5erjmsTueaA7h08R2BtHlwHoD1nhVBZXTQ/wo2BjT0iwT6LdeAIGRHsrEZZlhgmxCF5TMy2TIw8GI76aJ+xl+5TlmvAyFtHFqw6rS7be7BTIzcNQdQPfs4Mtq05wNsqBmQztg6/y8h8ym6+kzMbIFnfKLqKwVmLfpsPgxa/rRktgxQfspO44OGfAG4TtmgRKE5e+H8mgCLdmN1zQEMDB0KKgXzrTdagV+ryRTydZR8sAR9C5bTlSGfLFOm1YQfUsZBWx/8mBKEjQlSRn8b22ilCi6DCn1ho5UyR8u6afvKl7hO2THeo5San0oZdDEcrdWZY9ccwKyqBT5NBKzvQwPCsLFvyE761iztPD9tHLRYBYJppvbx/bLFgotGHNtmmMP7gMoILAxp4wBEw5svsFDkGFE04zAIYH1z0agNVAarbGgHY0wYN8J6i8ZVMzbSlMqW7r9AHYTQ7xqr0boYTYPzJKStE0iSfDQtipp/Le3O6EXp/jVsq5VGclko0M6zUuZoWUL47xKojY624BhhyKa2kAs49xyAGl7CT3PlAjKfNAgCBFbEwcbg12uWWY09YxySsfit99sIuyhER3pveyBjHjKtBMNlEdBqllopc7QsoXxxROubC2MXZvrs0fqcOrbeolyRm3CGogmvXJPnmk6gD8x0v41vACo05PBxAAhWBkT9QYBrlZUyi1HWBrhWIegWP6SFMFImJNomozNyaLugumW1eG4DqKTl08m54nTPAaB2IoD19V3QQBpdXvpyJSDfdBsA0JTGyWBx0PVqmve3/nVPi2FaIA6VrleSrRaIOkqEKTOncNkcFWXpLkJmm0C/pTJHhClA9J0wsu/8f9ccgEBRbUP7p+6/H26lUVu7qHyopRURYYGV8hE1MM0B1z7tZaUtucgyzFQP25xL2lzTUH9sAZdNrunzTdfRd8FOzQ4HoAAQcDa4FFxzAAqkLU9vSZWxmcoWUEoutFKJoK6lEL6ycQBSyDjbbCWHVJ+oTFqsFDlGlqmsHfg9ogCUaekF5WW5Oey45wCknGfHLUDa5k9y79p1D+qiUs+B25yT+EQl7Nq7x8Zxi5yhOJIwdfCl7Wyzlcp0UaVx2Vgpc7Qs66d+WQO5LjBtmRFj6VOt7jkAUFXU+5kKX97naVTVpheMXoGiCWsf3NK1KrjnmUtK7p3/VxjJb+/OJ96SYpvzyzV5aqvLZHxtpuVlNNIG7Li3GN+C0bGuOQAAZceICtmnLC8kEvrycuahGlQWD16kjX0vyy+XnZSx11JTuUwW7lxoa32mxmpT3VLWXlHyYNZWwqbA4ZvifGGnqQtQWMbcclFTrSTnlVviHFOlzaL9zmeOFuSfLGO1zUpBxr+LyiZ/LLnnsP7rRqxboSq/R4EBUANbAl2gbZHrCS1+Bly7lZ4mNTjN/IVnd7EHIO3RjWDpAN1oamnqYhDA2gKz+tFYKIHgE1XWokQEX/pxKhtrxY6SZkvdQintnroaZcYrh/Y0wlfkT7KHNhmNtnanHqs5pNBiBxDQya1MwtRMPOX30SSQhYZxmew6bqG0UOQYUQj2dNUVCpvawhgTxkS45gAQwBZvjajZPqBiSmsnGgy6H1512v/a6rjGlLyLEfwxGJNsthKCbXP0x4DULC0jFk3tAGh1bRDINQcAqO8lw5kDS1e/VmOpvNHCFi5cpQw5aIyOn85xRg7CnHn1505HRinlDc4+6Vy22UrMhtlvctlYKXO0LL8+a3SUBccIArQ94FJwzQGQ0buAfR9YG4TtU6qtgCgIu3W4+elFIc2IdRKLXBLZKpWlPhQQuExawc6g2VW3hF5+DkCh3AM2dAGkSsPqpX863q6KcG5ri6Kwx0r5PHOpa8F6K2UWsyxdVDQoix0AzdHv5rKxy+6WxfctNO14zJzagFLSvd8ftIuwqeQqaTwPNngAdgBCzLLt3fANAEoTvmfB4mAaA3QLQOOLFsstPnEKTWOQbLUWmSb057hsrJX6ijSjMrBMKuvGfo5IRhAg0bS8PkGOwbVbAKnwYSTjweIgyUvrIrDMYrFHiUOli4qd5AeOipv+rgTjvA3wJboeTF9WMUtgG9lWazEq0EXVSwBIHQGwJei+CnIAdgzWI9A04DO2gM5BqGsOIKBX7EAbngWi7hQoNMM52F5wkpR5aLvV2H1atZ4MXXZ+waBKJGN86ZqVPq3G0vl0LouUedDWl6mkaYS5bllNM2PXqC1YLTdXea45gOH0UL9SZq44c04nSaaU6TflnKGAhAjmZgHWvsow8mis2VEAnJLKIrTMphFbrYOdLQtlWvyVoWPxmSrzRkl169hYC46UhHQK91sgqSARrjkAITIp6q7b8PVeCQF9rq3PhMcS5z3gt3xKSIEm/AuaQ52W3x8XVDNsyLQmsmWJJnwLAaztqXNZdCRX2vo9xQp9bjWAtISVo4WYKp1WMGDThwaO1jT+vmsOoDJ43DAg7hsf1nRiEdLmId/qpVtsmwlgdMPGrm4E5F3LVlOmQdNmr7NMYJEJCuDcFrbRSlhIZTCU2dVjpczRsrgucZ0C0gUWBwTYGwjowxaLzVmcaw5g7x5ICdAPgB1BmbrQxYl2iD4iU6H+X4jWv9BoqoF/O6Jjpm3tsI3LQBOBb9nJlebznwBUp+zQgaDv37XnkPXTCzmCdc0B3PnEGSmfqKb5dGu7g2y3AvQh4Km8b9eKQt5LtzCWi1dKak21XfY+0WI56qkFRkNdG9m2qVPml4LLQIrMvfnlyi81gnkq16n8cuWSWoFPq9l9j4sfg3HNAbREkqsz6lAD2NCtAgrkWZfQxrZF86f3I+qPWa2AB0YFYrQ5lJgxYwE8rkEOuZlts5ovLgMuC6vlHi0PQbOsLsExAYHbwLqGvjXHRDt44IoDWBveeq0uKm+RMmP5yxUj3CnaGJfRP9uW1s3nDyGoHWCDA5MgBU0Ofw9mSkDf9VmbLLeH3ArgDi4Ly0UfJZAcF9UlrlNHRVq0y23Ap4KbouGtGywSmZcYkVdqCxJHw91bUOGG4ewnodACieOLCOjzzh//jJWx/Z8J6HZ8hIIrm1rVHOr5sZVo3ZAVzdogLwGLR/7ZFuZeqv5/5X07V6pLNv7uIAK3BaXw2uZwzxY77RhPtmMO4LyTNwabIz33gZIr7KgMo40zZQqa65Oka/QZ647bE699PGXst+UxTqkMajLyH5tDXSX7klBLOB4GMP+RbbGO9VckpYx9z3UkL7L8NuwVDQBrG7qWc106Os6efQXU01jBbaTl5AeD9ugYK9URB9DS2HnCKcct3UndnYvIzLEobIgx5CBIc/gaG0QfIzKAc9+JqB0TZ9WBAunz6bN7W5ZstPapI6sATiKnvr7bp2lVcQXK+qkS0sucEzfvpF1bF5GRH+G6ZIWSqWQQVyClcREeN2tXtL7b1lmsI1hsdwDRSNdqMw2PZcxD1QD2dflhVFB0BdVF1XktLRvtaZ2H9aWG924TqB20q1dDVzll+l7z18PqSmZzqiH/xtjtAayAOc9oB2z7CTjG3QIbNU2rvIDrEjgYMuZAFRjwWFN4i+2Dg7Y6gKbara+jfs0t5Nns/UrHuIWDYJj9C7Unam19IKjjkRV7lDJvF2jLhY4tQwXyhHXheJoPSmFtDvdkFCj+vTtbPD4S10oad3Z0rqBpZPsY0SKLj6er/wIAW8yAyYICsxpB27Qu0vsPYGOwwwFk2Vof7vuGrgX/rBQPaNlowSSiBfpqUuqQ7dNp7Yn6tyPaQeUrxpkq7WsKbX1p1Wl32zRz8oquQvcYW1Oo8yWpDL1QGbnkE6BBe/L2q3JJO500BsA5Anx2fAYIcglKSUDQ/9RS99A3D6fPtq3D+5ZsLK+1LUu2+6Lh3l8ohM8Y0oZH/fMwW/LLG0r9Wx5ZCkyK5ObUtQVmzifbwhPmnzy0NpRYnk8mJ9KuDXUtZ2wAaqHd+hTKawE2SLv1UP35oqRbSSv0FCoj24aU+elouOfX3LYKlTNRPssdgOEf3AEg35kFPpFWx+IV0BTORU58cLM/Nfw9n8YXC1t7PJii6VOE9ANNoa5fHabR8qvCYbm5bLK6o6GuXyKoBxgbZcrG0daGJfvkHOwf2vt9G4QfI/LSxd8NBLS5FwPNxRxzwoWDkbak3m74Bh+2Wr1lDuDy2q2vIS8lia/T6Z7YapwFy0ub+2DB3NCnCxaQY8a7dpy/N20e+Bdd2Poi4mE0Shco3tEc7umiaUKaajsc7fCGdTeHezsRxdXUUGzt9rNpzG1KHvz0nx95va33/qyrqubCz6So7vB+MawjbUotioa7VXRZ1yKrMFniAKL1m+sqtKqnlDLI+9t6BczbbkX3UUqpy1etutv2CropufK/pEzF8wZZQAapDKC1QQH2NEd6/1SAiGlliUbifwQQ3VJlGgnHtGTlmlnKdPyWxEpbX/xhLFxXFNUZRXWHj4tpVcoEzRd8cu2SBy25DZy2A2gKdX1Ck9U9Gdmviomoo7EQsPqaQzWOzKWbSn3an70VOBqBffsKTFTS+Id1kYRaX9d3XVNoy4V2aYuGuy5YX7f9OpqRUCAzr5dgTLv+5IqVOTVk5jO5pp9OOq4rSqn66cg4Oq/V+zRNqHyBmq3RUPc9wVK7AAAQAElEQVSnpit7WgXYFOq6CRG+bchBQKC96aKxLb8Sfim+YZv4owRv6lv+57Qx8FNE7ahYe3cV3XeZMgUZc+jjpPcv1CMwoqFe6pbTUBlsKLiMNxzOy7KaIz0GAN5Ple/jpkqTRnKr4EwgmyBlHPz5LdvOc6SnE5Di64BQMG9gc0AA5DYHqL5FtwQbAQgtFBYKNrI53PtHug99myrCbtJoKrjbJDDwERpFrR59zo7jjr6G9wvQn6YmQgs4Grg8pMxoQmi/XBdJqr7at8ZbItt/Ew11/htdvd90ee29r5kIEI/jrK9LvInTch7OyzJYlpSGxjxOlNeueCJQCeJyU9+K94IDYdWSu6sR/de4YWu+5nFZI2BLc6iXbsfyzT2SPm8H0LLkwXnr67Y9ZKrMP0hFF4UROUX/3zAHwAwMf9wpoJrE1boIolP6Rusx5TDwSlNmtYbspzlz/LIp078P6gufurLhKfWO5X+n9Xlaeft3xXFBveYpU8rfA+CXOQ/nZRm8gkvBRxwqYa51Sv18f/XHDHPQKXXT1sNt0ITM61rqtj/csuShvH9wMS8HsHbZlnrT73/EkKklVLNpmTZ+BwXQtUTKbLfYCaU394W2U8NpRsyLYpug0SQdSBo0zNBtwiEYzuyCgdRztD5LK2+fy8ZlzEPZNIrSArhfvEjcGXK4ub233tZHfuGoIBVQHaG6clTcdHadyEslhVTXzjb9g49Fw52N+ejMuXauqd28QteD3dQ1WkhrPjqKJq1fn33murqtFzkFqCO5PCbAt1ETAfBCfgyMcKa3Mof55Sw8dRMNoAb0WWcVLsG9nNwmlZLzNVHR2RTZel6uSHJyAM3h+PsEalvIy+QqtyjTpYx9oMGsO5wE15YIX0EjZjRQQ37aScUlrQtBoNgYS0TWg4PBr82+k+uIgyotV2WYQwASH2yu7f1gLsIncQAqW2Ob6+Lf8Ws1PwGqxbkILO40CCnzQNX6um2OVqz0UP97BWpPIDo3M1Dc5TAxOuaIuRoeOOjIoN8RJM2hxHquGwDZag+lHRT4fDU/WBfuOfzE5EhbHs+mSRwAqqZQ55PSzHxs2LD9wavxsNkSh4A0hTL8HVuETyD01kcvPNSeqD8DlPn3CZJ40YcZUMp4nrlizg5HObJRkLmO64aVytyUlTL2gqnMDzXVdv4NACcc1BjXAVy6+PFANNT1NwRYNDOu/HBM0LDixGhoy1eOiXTgYDgz2ICAzyHqDmgrLRXMCXNTYUKd08jXhrZ8WRPBVzmt1359ii53cEo03P3c5fXd4z6jPq4DCFYd2E0jwaeoGdHtH0vzyEMUvmuaapPHjT1rX8wdOy55MZZcfgoAPkYreOEIA9T0iRPm5qbtK186EuvEluuAQP2jhhxwQp3jOrgNK2We5Ddg3J8fG+MAmkJbL0MUjjwwA24GJWcDDn3RDQha+kA99UJ+o6E3O8AcMBeCOHGjLLJ1gOuCK8odVIroa67tah6tcYwDoC7/BVJlRqebcccKJAT9J364qfaBpU4b17rjkv62RO07TDR/i4hOqy8afYgIkjhgLpgTp4E1L7n/XK4DyoaertO2TKVPKgMU4pjpwTEOABWmphI2U84PpV8EgYE2HvNww6aOeP2VgLhG1ypBked1A4MbOtnWEZtxbYw5cAFEtsx9gXauAy6od0clqjFte4wDAL3i95pw5MU5d0gYpRWFfhaNebx/VLRjh7F4462ZdGqxhr4nRRkMDiLZqJOtGUwt7kg03uIY0aMUVVYdfB8KX0k+9DPKlJwOBfpAU747Ryce4wBivaEtoMqnW2rKFAjUv7u+IW7jjz+Mpv3Y403bG55sT9SdoVB9w6/zV4WOPT9TjrK2IX6jjWzd1NPwpFt2rQ93XYCoXc9l7xYGp/UK1KE1Gb5/tN4xDoATSJn+sIbl0wsw1TBIE26AkeCa94vFGz6bTh88H9F/v579shB1lkcwlfB/BWwLovZAWg6dH4vXfdZFY7JlK1G/gcvcLhzFJlejtmyYwx8bD9e4DsBIpX/FgwbjZZiZcTQYpczFTbWb7yT7XG11HdtWbI4lIhfRtNQ/+bTZBKe0F582B9iWWKLhwo543WaXrVFra7fcIamsAbK+AMohSDBhOCiPXOCOMXlcB1D36AUDugg+UEbjUqD4U0ta8M3rI9uvPIYhlw46kiv/t3Lvi0FNVH5UCH1Y0D1caZSHAsYqQB9m7JV7XwiyLVAEYV1k+9t0reJSLusigOMQBAUaBjav2LqifzyF4zqADYAyIwd/J7KVbrxsMzPOpPEAQLhx9Vn3u/BDJmM5veGZS4bb4suub4/XBwGMb1GD2o/IRVaMVy8ERA0YIwj5rfZkfZCxsw1jLXM+hstUINyULWPn1bumUVAbNtTg7RuoTY8HQowXyXEdyeVfD+h5f1+As5b0mjEHQK8IPLt66RZbf1EoX5LaE8s/jak9p+gYeC11V7ZU+l8FmHUGbt6xKEDCwFiod7JFR/9rGWN7b8On87XPzvRcllSmf+OytVMPyy62NeCbDx2JFV+dCNeEDoAzDGX2fBtR492yWhWo2QFf5bj3TG4S0brjkv6N8dr7OvpWnPf3XX8KSiV/rmtVfeQQqLtdAQiTFidYEZB0aKKC2rsaZt10P/0/f9/1BHXzV5zH2BgjFFkI+II3UJnOKTJYtsNB1GAovfO7kymatMboGv4QlJz5jwWOYUiBqdJvbg7H7x1zqkgi7nnmH4c3JVe8d9es3fUAwVOpnC4Q6NsY0OaAT6sGnm8fgapGNgX9H8krUM/KZNmCdLAu1sm6NyVXvueeZy4ZLki8A5maw733mirzZvJYDmgrLhVKmQbZffiV4PGxTeoAds06+AyCeBbKMBB5QG7g4mi4+2vFbP4991xidPSFdrYlIg+2JcJX/Lb3LDQyg6ej0q4mJ/ADXZt1s0DxIIJ4BBTsAQRTEwHwa7OAb/F45X2O43OchtNyHs6LqP9AKXxnOr1/MctmHW2ki3WybijiwGWnQF7MZVnEMG2DJlB7dt/cwacmUzCpA+ACRvR/Ntvlm0zKDD2XrTjK/FxzuPcHpWRibFvjU+3J8K9jifoPt/YueVs7TcHVJhvO1c/66/H6GcsDu2fv870060XfizXPZVfe5zg+x2k4LefhvDGSEUvW/WrT9gtce3CnEO6zZUZlly3DQgQUkKeYsnCb1dD3BW7Dk+Ga1AFwxrZEbatUxm7eL8d1pBMsP7i2duuG0rUf1QYaBW5tXW+2tqLJlWK8lc9xGk4LgApKNHBZKZAfLFkDLOCdHN/ejfHQTVOJmtIBsABNVL+fJnl4tyxXqUwQiNdGS9oJlEfRcRlxWVEDKA+Dx7GS26qGwZzeb8nJAcDw83/URTANdIM4jr6yiFJkOwrt2mik90dlYXAJGtkcSfyQy4jLqgThWwSZH70Opg/5D/wxF4E5OYDWHZf0Z+TwdXxfkYvQmZqGewI0KfKBpnD3f85UG0vVrqZwzzelTP0zl5EbNhSLTk0EgNrq9+7cuvJgLphycgAsqCPZ+FlTpXMSyuln8kpdrH9pqUv+ZSbbWEq2raOyQICievjILf6kNPqpreb8o6E5OwA2SMOqL5fzbQBzwKtSBpgyfeG6SPK+y0IPnsRx3uo8A8z9ukjiPkllwWXiPIJi00jdfy34lXxQ5eUAnhb3f7dCn0/yy3l8lcynRSlJTiB1kR/0R6+s715AUd7iIANX1t+9wA++R8gRX8Rl4aDqIlWlIEBtc+ferkmf/BsNPi8H0NPzgcxwZve7da1qtJwyPVY0NKiqJFTvuqJ+u6M/ZFGmhFNPH+CK8Pb3SnXiLgWyuhh6pMVQFrqogqHM7vfxE6L54MnLAbDgUN/KX5nm4BO8760jDKSNA2CYqZ9GQ509IzHef5sY4B+r6TEg9dO0ecAmFaUp1pSDT0X6Vv5PvujzdgAbAKXAim8I9OWra0anlzQuAIB1zeHeZ5tCnVHwgqUMRENbm5ojvX9D4niEa0vFl7QwRB2EFvwmt818DcnbAbCCtkToZ0qaewAQvPAKAwokSJU+WaDeHg33fm2iX2N5JYe3NxUDzGE03P01RF+MBvtOYY6nylNe56kNKrW/rbf2x4XYXZADYEUo9PPo/kvyvrcezQCSE8iAQPyczzAfW1374JuPPuvt587AmtDWNzGHArXPyexvVVBlzz27IyndV6KUptTKQnEU7ADaE5HH/aLmNgCvUGCcQKPTNEAIJ1X6FtzZFO7aFF3Wt2icZF7UOAxEl3Utioa7O4L63N/TfNNJzOU4ybwoYkDXam5v7Wt8lHYLWgp2AKzt5viStX697L6zwKbnvKaMfYAK1igxtK053POrnDOWacLmUM+vlJDbQKm1zF2Z0pCT2RW++dDau+TynBJPkGhaDoBlmubB9cBVHLwwEQOH71srAfAdzeFe1Rzu/Nili7fM3B8AgPzCpYvvmMWcMDeA+A7KXXmYM9r1lokYGDL3XTXRuVzjp+0A2hINrZrwv0jjAbnqLNt0fB87sqrvVFYHdq8Jbfls2ZJx2PA1oc3/Wll94m6p1HdGuMkcPlP8G/cQKtBF5Qub4o1Tvu47FcZpOwBW4PNrEU0Eeddbc2RAqrTPJ4L/QVOGA82Rnuujkd5Tc8xa8snY1mayuSm0dcAnKr/OXJS8UQ4aoIlK0MDXYIVKSxzATVuXvYTg+5AVgMpJhimHyVxVKaXxER8Gn2kOxf+PGsWZLUu2++nEjFrYJrZtXaj3z2wr20wGVo5wQHvekjMDiHDNb+NnP59zhkkSWuIAWH5r/JwfIWp7eN9b82cgbR6kWQPjEk1UPGr6aMAwlPhZcyhxbv6SiisH20Drz9gmtk2C+Tq2tbhQlg4aRHHg3N5lln2izjIHADQQGEs0LNBwxl28wKmgQAJfERXIMyWk36Nr/u3N4d6d0XD8Q3z1XH3WIzVOYSlUD2NkrIy5Odyzk21gW9imw7YVKrqo8rkBRsMA1CZun7cB0LLnbyx0ACOUmGD8v5E97//0GFCQNg/xQ0ULEeT3EfBhX3Dw4XWRvr5opPeaN9beVTU9+dblZizRSPc1jI0xMlbGLJWxkG3wBoit4Vop49oNsMGyxs+oLHcAHYnGryJoPQJ1KK2ARQuXGhLdHighVeYkUw4tQ4Xfne9f3N8U6jzYFO6++W2RHVc3h7a+qbn+0bOblm/l97VtsaXp7K3zWQfrehvpZN2MgbGg0r7L2BijAsZq2ILBGqHFW9bj2YfUllCJvvZkw5fHOz+dOMsdAIPRModWSWW+xPulsPo07lmrfoFaKcClXkEahjP8oWZVA8pcn5YDv6TLwu+lsT8p0r6/ra975EA01PO3aKiz7W11D31+bWjL1auXbm24/My7p/xuAafhtJyH87KMKMlimaJC/xvrYF2sk3UDqBrGIlW6JLgbuTDJ/pEyLwnIRLHcpRnBC+xAa4sD4G8ICtDeFdDn2IF52jJpMAp09YmwxAAADBNJREFUmkpBof8eUfu8gbtf1ZFcUSOlvFTDwM5pK3BYgKKxg8Mq/VJlKjPm/lkKjFMARXNGpr5Ktv6ywl/TVVVz8q6rGp5Wb2/8q7qq4Rl1ZcOT2ZX3R+KeVpyG03IezssyWBbLlMqoJD3ZQZ6jdFJUaSwa+F8ylPHmjuTKGjX80omotM8L9N2p0xQ21wnIMTiZjJ+0RYR3t+5Y2m+HXlscAANtT9bfZRj9/yRQ58OiWBGEpMLOKEh9qDW+DGPx+ktp4PI/Yj0XvwAUOvqW/x4Tj70KURuiwxJeRrq4SpnUW8jQwOIQZGg8IWXshaHMThhMv0jbl7K9CL56D2VeOhy3EzgNp6XufDYvyxghYkTmyH7p/Rfo29mWjJxwS3LFXYyeLlIvxvoa/qM9UfeW1ngtSpn+Z00EM0h1BIokCGo7hup/f3ui8Q67INnmABgwnvnkL6kCxQHcqDwKBPqg0n8iAGCnX5v1AaUgRIXtb48v/yFMEFphvRlLNFRq6P9She+4CVJ50aXCQNC3AATon2xP1B0Pk4RYsvHHbfFaP4Kq9WtVHwDALVx3BNUh6oODG0GB7BOnP5n3Rz7ywWqrA2htpcaUXF6HKBy7oiJqZD+mfdqsXabKXP+brldjR3L5ipt7z/lJR1/jdjqZ09KWiGww0rvPBsQ9mJWZUzYvUZEwwGUmUH9hWO17VXuy/rpcYbUnlz90c+/Sn3Qkl5/HdUeq9He5LlH+NDpYD0hXKpZoDHEbIt22LbY6gCOopQbLdI1vH0EdibNyi4AQ0OeRSNwtwPc+UFi/sfec4zclV3wUphH4NUs9XXUmoviuJipYki34WbC3WsaA4rqGSv9ypmrorFhPQ/b2rlDpNF7wMa5LArBOw8B7Sc5OrmsIAuwJ/Jx/EBC0ZeBAsMuKY6Bv6ml4MmMMrBOo4zEnpnGAqAFSIQj0PQ4oWjN6/5nktRfy14pGrvRoSWNt3XHu3vZ43cdMmWoWwv+iwOIZ0wAvHMOAoO46Cv05U+KF7cnwtbc+cOGhYxIUfICKewY0bvTzjuSK402VPkMhbiR9jyPVQaS6CBYFgX7IQP9V7YnI4xaJnFSMIw6AEWzqW9lOrf8LANNrl4IKWafeBKL+dU3HU0VwOBRLNKxv32ovYR3J5TGR8p2GIL7g1/hN3unZAV6wkAEFPq0aaLzpnxcIdXossfQBC4WPEdXae+4THYmGK7jupTN4KoD2NV2rAq6bYxLnFcF1Sv2/TfHzp/2WX65qHXMADKgtUc/fdvuNJgJ8mNOKKLKFCwB/Fei7UQBe1tq7DNvj4c+19jT8rXXz+Y6NL9BUTLotEfnacGZfrS5q/piPHYTfW2xggG/NdK361uHhA2fEaCDvJz0Njr1PzHXvdzsa/hZLRL7Q2rsUqU/6Vg39vwHAZ9ghIdVdyDFwXULw/bY9Uf/VHLNYkkxYIiUPIbFE3TuF8N0+dU9Aga7RvZAStxmZwdNDyeWL2hN1b29NRChvHgptSHrLtvO3tcbPfSMNEC0X6LNBgydyagYQEEQ6ZQ4vosa35tYd59v+qXqYImxMRO5oS0TeEUo2np6WB18DCm7TqbeaS12nHu2dsWTd26dQYflpxx0AAMqNPRvWaKL6Jl3w4+w08UJMcXH6st0ofUCA/j9CBNcNv/jXqvZk/erYtsanNlA+KLIQSyzvak/UoRC+DwnQaHyAn5HhblyRAZ0xcBRo1HtE1J5Ege+NJRsDt/WteLrYzOO6uilx3jOEb/VzOx+u5LqM6PuZQG2A6zjXdUV1HgDpIlcFuqi6edesXavpWILDwQUHwBa2mm3xpVehgNcJFDuCvuMO0g1cX8oceHN7or66PVn/nvZ4qP225y8f5NTFvrbH637Ynmw4USnzixr6M1zAxY659PAhCNQzSqmPxBINi2Pxxp9DCYTNz60f4rpMPd/3tScaqtPpA29SSvZxnReAj6ISb6DBxbfdc88lrrw8IdzkcGPP0ruJlHNv6l40O9a3InTkKS03MU1HdyzZ8JWBQHqBwIr1CFq/LrJTh+CFwhnIXjFR7BYC14lgenZ7IvL9wqW5n3PT9gv+0NG3MsR1vj3ZePbG+JI/uYnKVQfgpuF26ebfZW9L1LaSM6gxVObdQlQ8RroMBI9qyDEgcYUAGV1UPZQ2+tfFEo0L2+ON7TzoBi6FmarWq5U2lmxHouEXe2bvPVfp2tmI+NMKfT4gajZqLG3RzE1AnwsgtOs1VXFWa7ytlqePS9uq4kbvOQCby4fv7fhBKLrVef9j8Gc/Ilyr0UCWzWpLTjxP51E3/0tmT0KPxes+2toXosG9DY4PipUccdME7DmAaRKYT/aeng9kRPypr0qZ4q+B5pN1xqc1ZcrA3ie/0grrzRlvbBEZ6DkAhwvjXGhRgILHBRzWXOTqEB7LclOEMGcyJM8BOFy6GwClhgFyAMphzcWtjgdLN0z9xExxG1GC6DwH4EKhSWU+C+BRfzT1qCRxgp5XPJoUB/a9WugAyaNVCPTdI7zZgJdpEajTtV/85eUIb8cxBjwH4BjVryhKZV7cqgt+DPqVuHLe00QQMsbwlmLkYKZj8hyACyV86/bXv4ReD+Bl5jVRAbdsX063AC9HeTsOMeA5AIeIHq3GMA/+Ab1xAED6Sxl77wcvuMKA5wBcoR1AQuZOmg50SXsRqUWuguq2IkJUVlCY/bIyuFiM1bTqmIbetwQ09IOmzfttsZTL0TjKYd9zAC6VspE5MGzIIce+ZuSSmVOqNeRwKpXalZoyoZfAFgY8B2ALrVML1Y30IIDYOXXKmZ0CEV4KyOqBmW1l8VrnOQCXyqZ1xyX9AX32CwDl/OyLAp82+4VWm372yqWiLSm1ngNwsbiGMrv+jlDOrwcLoBmAXVCEoVwgeQ7AxZL2a1W3CH4KzkUMbqoW6AOfqtzkJoZy1+05ABdrwMHUi7f7dP6NARdBuKjar1WD6Ttwh4sQyl615wBcrAJ37XjzXhoFdxGBu6oVKIj1jPwys7tIyle75wBcLnvTGLwXAKEcQ9rcv7kY7S4nTJ4DcLm0lZB/xDJ0AAgClBJ/BC+4yoDnAFylH0BH3/1Ak+Euw3BePdmsaz7q/Tiv2tP4CgPilV1vzw0G0pDepZQsuyfhlDLThpEu+weh3KhzR+v0HMDRbLiwXyn0nYBi0AXV7qrM2lx8DsBdUpzX7jkA5zk/RuNNPQ27faJyqLyeCFTgF1WDHX0X7DyGDO/AcQY8B+A45WMVGuahbVhGDwQhaJAx+x8BL7jOgOcAXC8CAIEVbaKMHIAQPtBFsLUIqC97CJ4DKIIqsHv/U20+raYIkDgDwSeqQEGm3RltuWspx5SeAyiCUr/nmab9aeNQESBxBoIhh6A1Xue9BOQM3ZNq8RzApPQ4dxJRls1nsU2V8Z4AdK5qTarJcwCT0uPcSaXUVue0ua6pnGx1nezJAHgOYDJ2HDyn68FtDqpzVZVPr467CmAc5eUa5TmAIil5mUk/RVDK4fNAKm0O/JVs9ZYiYMBzAEVQCAzhoH7wSQ19M94BCLLRBHicbfZW9xnwHID7ZZBFcFfPxS+YYLwEgDBzA/LvIey+NV73/My1sbQs8xxAMZWXzIRR6MbMfCxYgUDN1H0YKibKGUs5r54DKKLS52fjTTAvnYkPBWVtUqm3tnYtf7GIKC97KJ4DKLIqcEu88U9q//Nz/Nrsd9AV8xeIWp8uKqFCXwC8Fci/JsS3CcU0XMBYkK7w2Ud8X8YKILYhar8M6HPfnpY757Ynz78LvFBUDHgOoKiKYwRM61NvOHBz79m/aU80vDuWaAi1xpehse+pORIy6+j24DpEfLhCn/echr7ddHwIAYYpp0LUAVEDBC5WiqU9yK5QYHhFBpJMZNmkA0gpnSGd6hBjqCAsSJgUqO+YYLQwVsbckWysJfzv+m3PmTduSlyyn/J5S5ExwDWlyCB5cMZjgJ1Ce7yuvT1R/8lYonHJTT1nnpIeGlyEKrgEpRahO+yVflF9sQD/Wroef1IBXq+JCupBiNsBsBNB8dt3zwEAN8RBBEwDNWReR/aRv0lA5/BZin6U4ruowd/OMqhhf08BfFKQbNYhlTwPdS3CuhkDY2FMsUT9J2LxujbGSvlLYil3kP8fAAD//7HH6iYAAAAGSURBVAMAyTzxUhiUNjIAAAAASUVORK5CYII=" preserveAspectRatio="none"/><filter id="a" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="B"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="C"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="D"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="E"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="F"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="G"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="H"/><g id="b"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#B"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#H"/></g><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="I"/><path fill="#697986" d="M375-529L38-1026h238c37 0 48 9 63 32l215 343c8-25 17-47 31-68l173-270c15-21 26-37 57-37h227L704-540 1056 0H818c-37 1-57-23-71-46L529-403c-6 24-14 44-25 60L312-46c-14 20-33 47-67 46H24" id="J"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="K"/><g id="c"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.373333333333328,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.94666666666666,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,37.54666666666665,0)" xlink:href="#K"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="L"/><path fill="#697986" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="M"/><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="N"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="O"/><g id="d"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#C"/></g><pattern id="e" patternUnits="userSpaceOnUse" x="-381.31" y="479.26" width="88.84" height="91.9"><use xlink:href="#P" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><g id="f"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#B"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#H"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="Q"/><g id="g"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.675555555555547,0)" xlink:href="#E"/></g><g id="h"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#C"/></g><path fill="#6f7681" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="R"/><path fill="#6f7681" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="S"/><path fill="#6f7681" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="T"/><path fill="#6f7681" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="U"/><path fill="#6f7681" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="V"/><g id="i"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,11.644444444444444,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.85333333333333,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.044444444444444,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.54666666666667,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,46.80888888888889,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,54.577777777777776,0)" xlink:href="#S"/></g><path fill="#6f7681" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="W"/><path fill="#6f7681" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="X"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="Y"/><path fill="#6f7681" d="M395-1486V0H148v-1486h247" id="Z"/><g id="j"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.155555555555555,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.26222222222222,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.36888888888889,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.47555555555556,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.977777777777774,0)" xlink:href="#Z"/></g><pattern id="k" patternUnits="userSpaceOnUse" x="-94.85" y="479.26" width="88.84" height="91.9"><use xlink:href="#P" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="aa"/><path fill="#6f7681" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="ab"/><path fill="#6f7681" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="ac"/><g id="l"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,8.764444444444445,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,18.266666666666666,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,23.084444444444443,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,32.586666666666666,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,42.64,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,52.74666666666667,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,60.00888888888889,0)" xlink:href="#ac"/></g><path fill="#6f7681" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="ad"/><path fill="#6f7681" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ae"/><g id="m"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,13.28888888888889,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.791111111111114,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,37.760000000000005,0)" xlink:href="#ab"/></g><path fill="#6f7681" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="af"/><path fill="#6f7681" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="ag"/><path fill="#6f7681" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="ah"/><g id="n"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#ah"/></g><path fill="#6f7681" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="ai"/><g id="o"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.04,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.30222222222222,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.49333333333333,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.995555555555555,0)" xlink:href="#U"/></g><path fill="#697986" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="aj"/><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ak"/><g id="p"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.72888888888888,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.608888888888877,0)" xlink:href="#ak"/></g><pattern id="q" patternUnits="userSpaceOnUse" x="-381.31" y="799.18" width="88.84" height="91.9"><use xlink:href="#P" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="al"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="am"/><path fill="#6f7681" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="an"/><path fill="#6f7681" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="ao"/><path fill="#6f7681" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="ap"/><g id="r"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,12.622222222222222,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.72888888888889,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.608888888888888,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.715555555555554,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.217777777777776,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.324444444444445,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,66.20444444444445,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,71.02222222222223,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.50222222222222,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,88.8088888888889,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,95.68888888888891,0)" xlink:href="#S"/></g><g id="s"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.106666666666667,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,17.875555555555557,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,27.377777777777784,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.64,0)" xlink:href="#V"/></g><path fill="#697986" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="aq"/><g id="t"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,6.879999999999997,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.648888888888884,0)" xlink:href="#ak"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ar"/><g id="u"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ar"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.968888888888882,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.44888888888888,0)" xlink:href="#E"/></g><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="as"/><g id="v"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.479999999999997,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.58666666666666,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.69333333333332,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,38.79999999999998,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.3022222222222,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,56.782222222222195,0)" xlink:href="#H"/></g><path fill="#6f7681" d="M415-222h579V0H146v-1446h269v1224" id="at"/><g id="w"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.96888888888889,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,25.546666666666667,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.73777777777778,0)" xlink:href="#ai"/></g><filter id="x" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="au"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="av"/><g id="y"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.533333333333328,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.453333333333322,0)" xlink:href="#I"/></g><g id="z"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.737777777777772,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,21.55555555555555,0)" xlink:href="#C"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.05777777777777,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.16444444444443,0)" xlink:href="#H"/></g><path fill="#697986" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="aw"/><path fill="#697986" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="ax"/><path fill="#697986" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="ay"/><g id="A"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.115555555555538,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.933333333333316,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,44.71999999999998,0)" xlink:href="#ay"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/mcp-access/architecture-http.svg b/docs/img/mcp-access/architecture-http.svg
new file mode 100644
index 0000000000000..710a7f87e671c
--- /dev/null
+++ b/docs/img/mcp-access/architecture-http.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1295.32" height="506.33"><g transform="translate(876.4973520705908 292.4711934781417)" lucid:page-tab-id="vEfyK7~VCnsd"><path d="M-1000-500H500V500h-1500z" fill="#fff"/><path d="M287.32-287.47a3 3 0 0 1 3-3h122a3 3 0 0 1 3 3v120.88a3 3 0 0 1-3 3h-122a3 3 0 0 1-3-3z" stroke="#becacf" fill="#fff" filter="url(#a)"/><path d="M287.32-144.9a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v16.76a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,287.3179732003359,-150.8998251879102) translate(12.488888888888894 21.380000000000003)"/><use xlink:href="#c" transform="matrix(1,0,0,1,287.3179732003359,-150.8998251879102) translate(55.48444444444445 21.380000000000003)"/><path d="M312.92-265.43h76.8v76.8h-76.8z" fill="url(#d)"/><path d="M130.85-230.47h137.47M130.88-230.47h-1.03" stroke="#697986" stroke-width="2" fill="none"/><path d="M283.58-230.47l-14.26 4.63v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#e" transform="matrix(1,0,0,1,132.82486028531133,-221.83593856251701) translate(55.73388888888888 17.546666666666667)"/><use xlink:href="#f" transform="matrix(1,0,0,1,132.82486028531133,-221.83593856251701) translate(0.0049999999999954525 38.879999999999995)"/><use xlink:href="#g" transform="matrix(1,0,0,1,132.82486028531133,-221.83593856251701) translate(99.98722222222221 38.879999999999995)"/><path d="M-276.5-284.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#h)"/><path d="M-276.5-144.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#i" transform="matrix(1,0,0,1,-276.49735207059075,-150.47119347814169) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-276.49735207059075,-150.47119347814169) translate(9.475555555555573 38.87999999999998)"/><use xlink:href="#k" transform="matrix(1,0,0,1,-276.49735207059075,-150.47119347814169) translate(59.937777777777775 38.87999999999998)"/><path d="M-258.03-266.4a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#l)"/><path d="M-555.88-284.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#h)"/><path d="M-574.03-144.47a6 6 0 0 1 6-6h152.3a6 6 0 0 1 6 6v16.33a6 6 0 0 1-6 6h-152.3a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#m" transform="matrix(1,0,0,1,-574.0314651281255,-150.47119347806165) translate(18.108888888888913 21.379999999999995)"/><use xlink:href="#n" transform="matrix(1,0,0,1,-574.0314651281255,-150.47119347806165) translate(46.295555555555566 21.379999999999995)"/><use xlink:href="#o" transform="matrix(1,0,0,1,-574.0314651281255,-150.47119347806165) translate(83.22888888888889 21.379999999999995)"/><path d="M-463.96-254.66h-54.87c-3.06 0-5.73 2.66-5.73 5.76v43.36c0 3.3 2.47 5.75 5.53 5.75l25.44.45h29.9c3.07 0 5.73-2.66 5.73-5.75v-43.8c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.22l-11.12 7.74c-1.06.66-2.4.44-3.06-.45-.67-1.1-.47-2.43.47-3.1l8.4-5.97-8.4-5.97c-1.14-.65-1.33-1.98-.47-3.08.67-1.1 2-1.33 3.06-.45l11.12 7.75c.67.44.87 1.1.87 1.76 0 .67-.46 1.33-.86 1.78zm22.98 10.4h-17.72c-1.33 0-2.2-.9-2.2-2.22 0-1.33.87-2.2 2.2-2.2h17.7c1.35 0 2.2.87 2.2 2.2s-.85 2.2-2.2 2.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M-425.88-226.47H-295" stroke="#697986" stroke-width="2" fill="none"/><path d="M-425.86-225.5h-1.02v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-279.73-226.47l-14.27 4.63v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#p" transform="matrix(1,0,0,1,-359.38115679958975,-222.47119347802536) translate(0.004999999999999005 17.546666666666667)"/><path d="M-276.5 35.53a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#h)"/><path d="M-276.5 175.53a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#i" transform="matrix(1,0,0,1,-276.49735207059075,169.52880652185877) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#q" transform="matrix(1,0,0,1,-276.49735207059075,169.52880652185877) translate(13.133333333333354 38.87999999999998)"/><use xlink:href="#k" transform="matrix(1,0,0,1,-276.49735207059075,169.52880652185877) translate(56.28 38.87999999999998)"/><path d="M-258.03 53.6a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#r)"/><path d="M9.97-284.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#h)"/><path d="M9.97-144.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#i" transform="matrix(1,0,0,1,9.966645241968763,-150.47119347814169) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#s" transform="matrix(1,0,0,1,9.966645241968763,-150.47119347814169) translate(16.626666666666686 38.87999999999998)"/><use xlink:href="#k" transform="matrix(1,0,0,1,9.966645241968763,-150.47119347814169) translate(52.78666666666667 38.87999999999998)"/><path d="M7.97-226.47H-130" stroke="#697986" stroke-width="2" fill="none"/><path d="M8.97-225.5H7.94v-1.95h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-145.26-226.47l14.27-4.64v9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#t" transform="matrix(1,0,0,1,-101.80532841431119,-222.47119347802527) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#u" transform="matrix(1,0,0,1,-101.80532841431119,-222.47119347802527) translate(5.147222222222222 38.879999999999995)"/><path d="M28.43-266.4a6 6 0 0 1 6-6h76.84a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6H34.43a6 6 0 0 1-6-6z" fill="url(#v)"/><path d="M-106.52 87.57l-.1 1.05-.24 1.06-.42 1.02-.57.93-.7.83-.85.7-.93.6-1 .4-1.08.26-1.06.08H-129v-1.95h15.46l.83-.06.75-.2.73-.3.67-.4.6-.52.52-.6.4-.67.3-.72.2-.77.06-.8V-25.15h1.95zm-5.9-274.93l1.08.25 1 .4.94.58.84.72.7.83.58.93.42 1 .25 1.08.08 1.05v112.7h-1.95v-112.63l-.07-.83-.18-.76-.3-.73-.42-.67-.5-.6-.6-.5-.68-.43-.73-.3-.76-.18-.84-.07h-32.96v-1.95h33.04z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-146.47-185.5h-1.03v-1.95h1.03z" fill="#697986"/><path stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-130 98.16l-14.26-4.63L-130 88.9z" fill="#697986"/><path d="M-129.02 99.5l-18.4-5.97 18.4-5.98zm-12.1-5.97l10.15 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#w" transform="matrix(1,0,0,1,-160.09295762614596,-67.80450942629427) translate(0 17.546666666666667)"/><use xlink:href="#x" transform="matrix(1,0,0,1,-160.09295762614596,-67.80450942629427) translate(31.39611111111112 38.879999999999995)"/><path d="M-851.25-284.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#y)"/><path d="M-851.25-144.47a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#z" transform="matrix(1,0,0,1,-851.245392385128,-150.47119347814169) translate(18.480000000000018 17.54666666666666)"/><use xlink:href="#A" transform="matrix(1,0,0,1,-851.245392385128,-150.47119347814169) translate(61.47555555555556 17.54666666666666)"/><use xlink:href="#B" transform="matrix(1,0,0,1,-851.245392385128,-150.47119347814169) translate(38.97333333333334 38.87999999999998)"/><path d="M-771.97-240.7c0 8.53-6.9 15.4-15.4 15.4-8.5.02-15.45-6.87-15.45-15.4 0-8.55 6.94-15.43 15.45-15.43 8.5 0 15.4 6.88 15.4 15.42zM-814.67-201.56c0-10.5 8.5-18.98 19-18.98h14.2c10.5 0 19 8.48 19 18.98 0 2.6-2.14 4.75-4.75 4.75h-42.7c-2.6 0-4.75-2.15-4.75-4.76z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-721.25-226.47h145.87" stroke="#697986" stroke-width="2" fill="none"/><path d="M-721.22-225.5h-1.02v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-560.12-226.47l-14.26 4.63v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><path d="M-555.24 35.53a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#h)"/><path d="M-581.48 175.53a6 6 0 0 1 6-6h172.98a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-172.98a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#C" transform="matrix(1,0,0,1,-581.4804170430211,169.52880652205522) translate(42.731111111111126 17.54666666666666)"/><use xlink:href="#D" transform="matrix(1,0,0,1,-581.4804170430211,169.52880652205522) translate(83.69111111111111 17.54666666666666)"/><use xlink:href="#E" transform="matrix(1,0,0,1,-581.4804170430211,169.52880652205522) translate(2.3622222222222575 38.87999999999998)"/><use xlink:href="#F" transform="matrix(1,0,0,1,-581.4804170430211,169.52880652205522) translate(39.88222222222224 38.87999999999998)"/><use xlink:href="#G" transform="matrix(1,0,0,1,-581.4804170430211,169.52880652205522) translate(110.20222222222222 38.87999999999998)"/></g><path d="M-463.32 65.34h-54.87c-3.05 0-5.7 2.66-5.7 5.76v43.36c0 3.3 2.45 5.75 5.5 5.75l25.45.45h29.9c3.06 0 5.72-2.66 5.72-5.75V71.1c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.22l-11.12 7.74c-1.06.66-2.4.44-3.06-.44-.66-1.1-.46-2.44.47-3.1l8.4-5.98-8.4-5.97c-1.13-.65-1.33-1.98-.47-3.08.67-1.1 2-1.33 3.06-.45l11.13 7.75c.65.44.85 1.1.85 1.77 0 .65-.47 1.3-.87 1.76zm22.98 10.4h-17.7c-1.35 0-2.2-.9-2.2-2.22 0-1.33.85-2.2 2.2-2.2h17.7c1.33 0 2.2.87 2.2 2.2s-.87 2.2-2.2 2.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><g filter="url(#y)"><path d="M-850.6 35.53a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M-876.5 175.53a6 6 0 0 1 6-6h168a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-168a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#z" transform="matrix(1,0,0,1,-876.4973520705908,169.52880652197518) translate(44.48000000000002 17.54666666666666)"/><use xlink:href="#A" transform="matrix(1,0,0,1,-876.4973520705908,169.52880652197518) translate(87.47555555555556 17.54666666666666)"/><use xlink:href="#H" transform="matrix(1,0,0,1,-876.4973520705908,169.52880652197518) translate(15.373333333333363 38.87999999999998)"/><use xlink:href="#I" transform="matrix(1,0,0,1,-876.4973520705908,169.52880652197518) translate(113.58666666666666 38.87999999999998)"/></g><path d="M-771.33 79.3c0 8.53-6.9 15.42-15.4 15.42s-15.45-6.9-15.45-15.43c0-8.55 6.94-15.43 15.45-15.43 8.5 0 15.4 6.88 15.4 15.42zM-814.03 118.44c0-10.5 8.5-18.98 19-18.98h14.2c10.5 0 19 8.48 19 18.98 0 2.6-2.14 4.75-4.75 4.75h-42.7c-2.6 0-4.75-2.15-4.75-4.76z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-720.6 93.53h145.86" stroke="#697986" stroke-width="2" fill="none"/><path d="M-720.58 94.5h-1.02v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-559.47 93.53l-14.27 4.63V88.9z" stroke="#697986" stroke-width="2" fill="#697986"/><path d="M-425.24 93.53h42.74a6 6 0 0 0 6-6v-308a6 6 0 0 1 6-6h74.5" stroke="#697986" stroke-width="2" fill="none"/><path d="M-425.2 94.5h-1.04v-1.95h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-280.73-226.47l-14.27 4.63v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><defs><image width="10" height="10" id="aq" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9B4AcxZX2e9U9MzsblEUwYLAQSUg7MxskES18TtggaWe1wmBj+87pHHA8+xz+M7J99tk+n/EZ53CHExjt7qwAA8bhCAYkbZqZlRA52GCCctg0M91V/3uzEkgbZ2Y7zOx0bfd2d3XVe9/7qup1dVV3jwAvlCwDLUvuro7WJk9uru8+e03t5hVvq3vqoivqtkWbwp3/Eg1v/cG6SPIXzeGuO6Lhzs6m0NZHaH2O1n20DkZDnSnaSl4P7w82hTrp3BZO8wjn4bwsI0qyWCbLZh1rSBfrZN0thKFkCfSAg+cASqgSNIe3vKUlnPz3taHN265seOJZ5Z/9tMLhHcow4wLF5ozcd19GptpR4X8qhR80ZeqdUqlLlVKNZOZZtJ5E6xxagwqUn7bI6+H9IICic8hpzuI8nJdlsCyWybJZB+tinVndhIGxMCbGxhhJpreUCAOeAyjOgsL1dQ+tXxeOf7U50vMnukJnrmp4Wgmsvl2C+QUEbelwZvfJpsosAIAaBVBBW5TKAKVMUCDpkGJpjxo17Re6vCKDZbJs1kHSkM6wzhqTMDAWJEySsDFGxsqYGXtLOP7v68IPtYAXipIBzwEUWbE01XYtXV/3sMyYh242VfrzUhr/oEDpQ5mdYMgBkCpDiKn5AV+8abcoFsaistgYI2NVhJmxGyr9BVMd2kg2qdW1XdwLKQrEHggA5sBzAMxCkax8P61p/s0Z8wAh4kZFmxmxILBNfuHvurr2rqoZYdIMMcJzAEVUkKa/eouUqWooqqs7WBSQegipmgGcv9UigZ4YCxjwHIAFJFoh4tLIHQsRfUuo62yFuKKUwbYh6kuaah84rigBliEozwEUSaHPwpNON+VwkaCxD4ZUw6CJWYvt0+BJzoWBI2k8B3CECZe3UvnOQEB0GYYD6hE11DwH4ADTuajwHEAuLDmQxlSpsx1QUxQqMjC8pCiAeCC8B4GKpQ4gqPOLBYvtOJRaabsOT0FODHg9gJxosj+RArnKfi3FoQEBX1scSMoTxdFWew7gaDZc2l912v9WVOjzXNLuvNqAPhsuOOuWGuc1expHM+A5gNGMuHA8f07dFWnzkAua3VHJtp5c9Zp17mj3tB7NgOcAjmbDpX0JqejII74uAXBYrVQGpOWg936Aw7yPp85zAOOx4nCcD6vrFTUKh9W6po5t9YlZta4BKGPFo033HMBoRhw+bjnvoXmmHAgCIJRPQDDMwcrL67v5bcbyMbsILfUcgMuFIvuHjqMZgEqXYTiunm3WFS50XLGn8BgGPAdwDB3OH0g/LAAU/G6988pd1IgoAqh8ngNwsQxYtecAmAUXV82EldnvdriIwRXVSgHKdPk8/OQKyccqHe/IcwDjseJgnAR4oypDD8A2K4Q3Oki1p2ocBjwHMA4pTkYJ0N8AZegA2GYNA5eAF1xlwHMALtK/+qz7a/z6LBcRuKta16pgbfjuOe6iKG/tngNwsfwDwarL09nPf7kIwkXVGeMAaGLuZS5CKBvVExnqOYCJmHEgPgPDb5XScEBTcargJwJNc+jy4kRXHqg8B+BiOVdo8xcpMF1E4K5qtr1Cn/9qd1GUt3bPAbhU/lfXJqtSxv4TAMrpCUAYFRBSxsETmItRJ7xDhxjwHIBDRI9WM6yZlQjKexAGzOOYi9H8eMfWMTCZJM8BTMaOneeEP6iJYNl/I18XwUogLuyk2pM9MQOeA5iYG1vPmGb/ZeX0CvBEZDIHGbO/aaLzXry9DHgOwF5+J5QuIHCpUuU7AHiEGKUkaOi79Mixt3WWAc8BOMv3y9qo+38ZPw77ckSZ7iiQ4MOaN5Wp+babPZUCzwFMxZAN59+05PfzENEGyaUpkp1AS+Q+b0DUheLzHIALpM/2v3ol3fe6oLk4VRpyABDneZ8Kd6F4PAfgAukmDF0ivfv/l5lnLkyVLpvPor9seBHseA7AhULQReAUoHtfF1QXqUoeCPQTJ0UKr0Rh5QLbcwC5sGRhmg2wQaTl0FkACF44wgCCIYfP3ADKq49HKHFo6xHuENFH1DwESxCVOuPIsbcdYUApeeZD0Op5xRE6HPvvOQDHqB5RJCOL3y9ERdXIkff/CAO6qAiatYs+cOTY2zrDgOcAHOD5bY3bTlkX6v63lrptCpT6gSmHHNBaWioM4gSF+P66SFJFw1s/H61NnlxaFhQX2lzReA4gV6YKSLcmsvn1V9Q93JtKDz4uEb5smIMgy+gHQPKljB8LNuUwZdO+qnD4sbfVPbxlTWTLEorwFpsY8ByAxcS+e9XTFU2hzmhT7da/BcScP6bNAxFSEfAe+yUWclwOcxVMmQdWVGoLH4qGOnvXLuu6tKVlo5ajCC9Zjgy46gBWL72/YV24JxYNbX2GGk1sde39NDqeI/IiTBaNJN9zcN/ugwStHRBOyRi8641rER8FLgjDmd1A900RFPJ28/FFe5pqO99coLCiyLb6rN5XUV1vpwvE7mi4+3drw51hN4G55gBaIslfVvjndklQTQrwVETRVOlb+EhTaOuudXV932gOd73FTWLy0R2NdL2HCvMJIvNnCqQPqMrmk99LmxMDNHlizvbplXdGIz2bo6GeknmDMBrpfX1L5KEv0YXuucrq6r9TXY8Cwnyy+q1+URlfF07+lPYtW/IRRHU2n+RWpFViXaRvEw36XJ0x+2lMjN+IU9ltytjPChaY5tBnpJK3t9RtV83hnh9fXXtX1QYovjni1Ut6FkdDXUNKqp8pZZ4+cv/KJnirXQxkzAFQ0lgJKGPN4fij9fU/Jodrl7bC5G6ADWLVqrt1wvftKyIPm0pm/mjI/i8qgJNSxj6gupIVzFu2x1RD722uS3TQhcPx9ui4wuZw4ocAcg2QC4QpgsGFDer9Kf2k/mSoq299Xd/3onXJlVNks/302qXdp7fUbb/FH9AfVyArwLvi2875aAVKSRpQzZx5mrk83RTqvrml/snZo9M4fdwc6W1YX7fj28nQW3oXHlyYAZCfSMuDObQxBFSwdl2493qnMecAzjpITeHOf5Eq/X5TpnIWesRLAqhzM+bQh4VSm9dFEgPRcM/Hm2qTx126+I5AzsKmmfD99d2+pmWd7/P7g08YZv9qU/KI9TSFetmnwQC5X5Wm/MZ6JQ/tj4bjF/CVlyIcWVqWbPe3RHoXRpduvmZdJLlPgNaVMQ99gupqyKCLl8xjxsekNmEq40N0C/xJR8AfVuKYA4hGOi8WoP8nTDNkiZKpSgS4DkTq75XVJ8TJ814fPee+E6cpetLszfXJFXukeEJovp9k6NYFcujBgBccYgCB64VAcf+8fdXb3rKk8wQ7FbdE7lu4LpL4lvSn44Y0nkPd/11TDs8xLLggCPT919pQYnmh+PPN54gDiNZuOVnHyntNlaHboHwhjp9esndVSpcqc45S8iOBqpOep65gX3Oo5x0tdT2Lx8+Vf+zVtcmq5kj3FzWlbZEyc4rMXnHyl+PlsJ8BaoSgwDx7VnDOC9FQ1wesHB+INvQtao50Xdkc7urStZN2SmV8SqrMEgDlp33LjDOpjfg1fevqyP2vskzoJIIccQCIejJDXSK6atMyCZoCT/FtAk8XAZjLFKpfGWamjzw0zSbEP1OgyGy2prP/NH9QmI8qBV/KEH6KtAU/yfUWyxhA4IE2EvejReqCHW8kB077BS/r6uIfp3vzXSoztE0pvFEq2cB1Tdn0OjdVMOS6pquKRMGg88hoswNQGA133UONcl4emKaVdKRgMEhXgwWg4BtXNjylouHu25vCPe9bG46flqvwdXV9H6ioOm03efmTRmTmmtNLVwwM0OgA0H344jm63r++7qH1hzFR+zq8N8FmzdLOU6K1W98bjfTccmXDEwoUXmeq9AJKXulwPVgYDXf9kXoYU2ImbAUvtjqAdaHeJgTttYpGbMHxgHRfmIbhzC6ggnsLKOMnGsgnaS62P1rbtXoyOET8M6Y5/KNhY89kybxzJcBAhsZrDDl4M5VpkuBOeAvKDxg1hbbu03X9GYXwUyWN1cOZPVSHeMDa1jZIsMYuVGcBQXt9c23fZZBjKCSZbQ5gTe3WizStsp2uoIXgsiWPVIagGlCl68FbmkJdal1dcmNT7eaPrjrtfytYYXOkt6E53PusUupUAErJkSW5jmBH1ECgDzRRAT6tGgL6XAj6FkKl/3haT4QK34LsWuk/kY6Pz57jNJyW83BeRO0wAyMyDx+U1EbxBUip2uZw/Ekataf7doBVqzboTeEtH14X2X7j2tBW6dOr7gTAOVRfBRRJICyg675bm5ZtPc8uSLYY23Leg0FNaL9Km/worF3QC5ebyd7PSzDN4RZA7b9PmH/RUFPtlseQpnGkSp9cao0fAeFwSNN4y6Bfm30Q0fe8kuoWTav8t7QceI9hHDovPfjiq27sXoS/6TqN1lfjTd2nZ9ffdL2ajk9DPpcePPiqTGb/+dR9fi/nVVLeKlB/YUSmxq8x8rwbIP0d1lkSG0UOXarUIgD9IbrSbzux/+oMKPE9Uw5ciQCYoZ5CMZZ72jwEQtN//e5VT2cvUmBxEBbLy4qTQ/47EARdRaEEgqJBoz2AKM4ws9M4VB2KGrWiq7o/e+UWqA0g+lqFVvVPoPBSXVRFNBw47ebec2bHEnUndfQ1rt3Yc/a/35o8/39ifSu3xB6++IWpTIs93PBCx7YLNm/qO//nnLejb/ma9kT9q1imhuJU1gGaTrqC70HU2hDFYMA3P4upGBvQsfYiGPzaMYilfGsIUCq9Glx0cP+eW4+1xZojYY2YV6Q013Z+VCm1SqrMK5ElsKeKuDIg6sQgKto+Tw1wGx18fP/+XbPbEw3VsUTd+rbec/+XGurvW+NLd7TGL95F521ZWuN1u1hHR2/97zfGl/1PLNHQEks0Vg0bz84FJT+pa9XbGCMrRzxy68BHxbWq7PcYi93Rv8LZSFtSb6Dp6A++EnvsXqFHljsAJcR/jxBcKCQv3wgDSPftNUANah/9+6ip8JyhQOac1viy2vZE5L/vfGLlwZF07v/flLhkf3uy/rrW3qW1wcCsc4Q0zxGof5SwH/BpNQSwdBobgS3KRdE4Bi3ftxqcpQ4gGu5+hkcvrQZZLvIQBPDgG6L2uEDfDSozWBtL1M+Lxeuuv7Wv8dE7txZPo4cJwm+2nnGwfdv5j7TFw9cT9jkmDIU09P0CUTyhiSAg2QheKIgBurBic7j78YIyT5DJMgfQHEn8EzX+Ernvh6ILPm0WN46/mDi4ZKh/5zK6yv9j67YG7u4XHdZ8ALX31ve1JSLvHurftTQDg+ciiAdHegXghbwZUCCVXLyutvedeWedIIMlDqBl0R9ngzJ/PoEOL3oCBjRRQY0ehoXwfU8ZBxdRN/rijt7zHr7zibfw5PMEuUozmm26Jb5yB9l4gZEZOF2IwPcQcFgTjr3LVZrEjUFNTkDIG95Ye1fVkVPT2VriAMxZ8x6S/Gz+dJCUWV6Bvoyp9ReBJgAAEABJREFUBv9fLLki2B6vu6a1b8XT5UJBbFvjU+3x8DWx5PKghPQXETWjXGy3wk6lTKzGeQ9bIWvaDqA53PUWAuTIiwtWGOymDEGj+UL4CYL4pAkHjutInPdVOijrJRZf/hUJhxbS6MenuDfAHJU1ITkar0Cd3BSOvyHH5BMmm7YDEFhxO82n4oQavBOAkKV5UAHe2B6PYEey8ToeOQcvZBlgLtqTDd9ui4epHombKHIQiTXaesuEDCjUEP8w4ekcT2RrZo5pxyRbX/fQzabkh8PGnPIiDjPg12dTVRa3+XWNRvTr3n442ttMwEB7InKVrukhQLzDTwOjEyTzookBKTOwLrKNHSYdFbYU7ACikd5TM+bAGuqKFKZ5hufSBHf18fmMeeAyGvhafXNPw5Mz3GTLzGvtrX8ilmh8q2Ec4pe2Xhjh0jLxM0aQAglSDq7lNxgLNapgBwDS/D8E8IZwxzDPj+r6QCr5TUMXZ8QSK24fk8SLyImB9r7ltxm6tlgp+S2B/O1PlVO+8kokKjRd3FWozQU5gGg4fpUQvkWqiB+fLZSQ6eRDQBAYeE7JdEssUf+vt/U0DIIXpsUAc9ieqP+0qYwriNu/M8fTEjjDMivqBWjoPyca6ryiENPydgAbQAmljM+aMlWIvhmbB1EHhZBsT0ROifWtbJuxhrpk2Kbk8o3E7ckIYhuiBl4AOMIBv+CkED/LnyM/EpfrNm8H0Le0c42uBZflqqAc0vn12eATgQ90JJa7+isv5cA1zRbU6hj4oF+fUw7m5myjjsFwMnTpW3LOcDhh3g4gEJgXM8z+w9nLfcMdUhxIZ/Ycf3Pv0p+UOxtO2b8xvuxHUjx/IgDSLRaCFwAM2Q8Bfe5t+XKRlwNYX7f9w8PGXtLhkY4oQEP/g6Dk2R19F+wkUrzFQQZauy55UZpDZwvh34KYVzV2EKWTqhBSxj5YH3non/PRmhdzGXPwi/kIn6lp+X5fQ/8DbYnwBbG+lX+fqXYWu123bH/tc+3x8Hk6VjwgUC92uJbim0iYIQeunejcePE5O4CmUOdnNRE4bjwh5RZH01Lfbo2HLjxstzq89TbOM5DlfmN8GZfFdc6rLz6NQgROaApv/XSuyHJyAKtOu7vCJ4JfNsv8qT9BVxmB/p90JBs/lSvBXjpnGGhP1H9SaP6fchk5o7E4tXAb1TH41Utz/Mm8nBzACXOO/4eMHPIBlO+9P7LtSn2ZpqI+AF4oSgbaeyPvV8r8SrasihKhE6CQBgSHfbNqTn1dLtpycgApGKQR7mxvKxeZMy6NQA0A8Us0BXUteKGoGYgll38RQXxZUG8NZmiY2iwFdMH+8dTpAKZ0AM3hrrfQvGvZvu6LzCKKH8USjRt4tzRXhRtAiZaWjVpLi9JWrbpbH2/lc5yG0wI/1lSaxkLWUaP2oxKFbwlsTQROaarrfPNUwiZ1ANmKgNp/GZKmW6eSNAPPI19FhPhGe7zug6VkXkt996ubI71XRkPd311fv+PGaKjnvr5wz3bjsVOfNx7rHFqwf07muIPHZ44/dGJ25f35FMfnOE1fuHs75xnJ2/1dlsUyS4kDmh34IKD4z3LtCXCbFVL/9lRPB07qAB6q7TtVSuM1pVTwVmFF6vYj4l9i8cbPWiXTDjl81W6qfeC4aF1yZXM4/psr6h5WqCr/CkrdqEBekzEOXqnAvJDujc8h/TyL4zNVGjLmIUgbB7Ir70uKo/M0zgPHKSXP4TyZbF55DctimSybdbAu1sm6KU/RLh2Jxs+QE/8Ll2XRgrQRmFLp1yTCa149mYpJHYBE9W5EUYZv/CEICPyhPV53MRRpaIEWrSm09YfwxI4eQP1poWCzUsZVafNgtnFLxV/ZUoQeaS104bzkRkgWOwmWzTpYF+tk3YyBsRSqwe58bfHQxQJ9fwZgW6DkQ14GoF4hpHzXZHkmdQB+X/UXlTInyz8jzyHgAUwPTUqcG4bzhyCjkd6LqdHdF2j8toGo/bMhD4UIS6Uph4GaKu3au7AO1kVaKlk3Y2AsjImxMUY6V1SLFAeupopeNL+j4BQ53Hb9/lkbJtNHvIx/OhrqviZtlB1n4NOqYWjAfHXrjuUvjs+MO7HRcPfXZmknPgfKvBcALxpIP089c3bOCO4FzGJgLECYGBtjZKxQRCHWc/ELgwPyFC7bIoLlCJSMcQioPD40kbIJHIBCTatoOXxfOFHeGRevCT8oCW8vll/d4Yc5WiI7PhgN9wwgiM+ZcnCOIoBA13oouqCAsTFGJKzNhJmxsw1QBIHLVAK8g8u4COA4BoHbsIYVb6M6M+6VYlwHsPqsB6oNc+BCgHHzwEwMiAJMmfpDa+LcG4vBvrWhLVfPmvWaYepm/0Apo1Jmf2uxFMoDgbFKwszY2Qa2pRg4bes99zeGOfwnLutiwJMvhsLSIxhy4AJu0+PlH9cB+IJVUU0ESqG2jWdTAXEKaLT4yY7kyjdRZlftXhvqWt4c6bnXJyp/mTYPEJzSXtgGtoVtYttctgY39Z33Bi5rKMpelD3saKJC+Cqq14wnfVwHQNMHN9DVcLz0MzJOwwBVB/VPh41Th7eOb2i+/UsBvWYrTb1ebGTfu3DVF1lkP9IVaAjYpoBevZVttEhwIWKyZWsq471c5oUIKMU8Jg0QSxj+5XjYxziAaLizUdC98HiJZ2KcJqjxS/PjsXjdfW7Zd9mSv7y6Odz7GN1EfzFtlP5VfyIes4PKSn2Rbb1sSfek89MTybAiflOi8R4J8hNc9lbIKwUZmgji2rqe+tFYxzgAVOIyU6ZHp5uxx1JmHqs5eOjHbhnYXNt5ebBi7l9NlVksab7dLRxO6WUbTbI1WFHxV7bdKb2j9cyac/BHUqYt/aXd0TqsPJ6uLO4FUDfsstFyxjgAJfSq0Ylm6nHQdwKgabbc8Mwlw27Y2FTbdaNCuJUGXIE6+7S4gcJ5nWQoss1sO3PgPAKAG+65ZFgZqZag73g31LuiUyhVM1rxGAeAkOlB1Eanm3HHCAIGjed/2L59ZR84HC6v765sjiRv0DTflQqyt6UOIygOdWw7c9Ac6buBOXEaVcdDFyWHMi/8CKkuwAwP3KYRtE4YFcY4gPZ4400a8q/ajEo5ww4V4sGgUf0lN8wKmKJLytS7TO/T6sAcSDn8Lr8put0oiwqzegP1SGb8E28CfNCerN8Io8IYB8DnDd/QApoq2c/7M3HVRSVdd43v37R92UtO2scv0ERDXc9IUEuAEDipu7h1cV9AncPcrF66xdE+OdcBA9QPuE4UK0fTxcVtGdMD88eTM64D6OhcsSeWqJ8rUB8YL1Opx9EU20ubEis/77QdCP4uBfJUVQaDfflyy5wwN7oY203NV1a+6W9JLv+cKYdm5JedNWrD3JZbd5zPn/MeQ40YE3NURHuiroa6R3fNrGeoldK14MeOMtP23ZYld1c3h3seASFcm/qy3UirFBBHzBVzZpXIXOQIUUl1Qs2YAZnDbfYPbYnbZk1m/6QOAABVLLnizVKZ30CcIimUQlDg02YPtvYuu9lJtMo//0fE4Vl8lXNSbynqYo6YK/DPc3Rqti2+9LdcN2bCrRm3VSnNb3YkV7wJYIOcrB7k1Krb4rWfBU2/zK/PnkxW0Z/z63Nh2NxzuZNAmyM9vwWUbwfvnj8P2hUoVFc1R3p/m0emaSfNGHtX+/Xi+smxfI3iNiqEuLwtUfuvueTNyQGwoFhP5PZ0ZuAfqCIPISBHldyaMQ89fmvywrudAt4c7l6rlLyCR7qd0jlT9DBnSplXRENbm5yyqaPvgv/LmP0l+XAQjrTJoVTm4Ovbeut/lytnOTsAFtjRV/9/ekYsEsK/i3w0R5XUqlD+2inAVyztOQfR30EOwCmVk+hRVD0ECPSBT6uCCt8CqAqcBNWBV2dX3q/wzQc+x2kQuFoocDswd0IEYy2RLTRr4gwaRHCsjlhlEbdFbpN6Bhdt6lv+53zkcknnkx74Qxnpwf7TqbLcL1DPK6+biXlQxBxMX+cUBlPXfkezDa61Ik0EQBdBoCvDdp+ovgmU/JIG+luH4eAZN3Wfrv2682T8VeeJ2ZX3b+r+tWbK/jMF+C7jtJTntwi4nWVoJAtcCoYcUkpV3OaU+szg8HVcV5zSN109AnV23PenqU1y28xXXt4OgBXc+uiFh6B36Srad6w7TboKXhA1kDD8gyzugqXknjFa2/19CcYiBKAFHA2IAjQMSGlm3tsar8XaZGNoY3zpVbG+FRs2JmrvuLX3/CcI0DgDQxtke2Ll462JZbdn08aXXsl5W0mGNI33kROQSLIpr6MLEYjMZXNt5w+cUMx1xFRDP0SqM07om0xHLufoCnM3t0XGnUv60WkKcgAspBXQbE/Uvw4Av65hACgQFvpfhAtS3z9o6J9xAlo0tOUSn171Ibp/dUJdVgcCcqMHn6i8Hkz12rZEWIv1Nf4cKGygEUjaFLQcyRvra/hZWzysKVOtoi759zTqEbDOgoQWkIm51PWaD64mbgvInneWStP3aVD0l3dOxzIoLdvm8Os0x/86bouFai7YARxR2MEPUUDq3bpWiUfiim2rEHqfnbc35QQuRN8306ZzT5YiCAWo38uNfmN82Udj25bb9lpzx7bl97bHa69pi2/ShPDdm9UNzgTmlDq7/+mEtmxdQexxQlchOritmZh6F7e9QvIfnWfaDoCFdSRW/EJCOjRy76Q4qmhWpG4rIt52zz2X8HeybcW1tvbBjwv0Ndiq5LBwQfd+tMapr98YS9Tx7Zg8fMqBzQbZFo+sYt0CfQlBWBxQCprw1TeFNn/Cbl1cV7jOIFrSPCyEy8+xVNPtbDrUEV8x7gc+8lVmmYXtvfV9G3vPRQTtJYDi6Qz4tTmQFn//Ftgc3rrsd3NpDvk6w4lfUULq6IO6sT1RX7dp28pem02bUDzrbk/URSSom6jIzQkTWnSCufVps7/91mV/mWuRyAnFpEXXt7juTJjA5hNjxSNRrL3IbYzb2tjzhcVY5gCOqB8amHMqeYFugb4jUS5uEVLGvgdu67nc9t82q9RO+VDGPES2Iq22LSqgzwdAuCiWaHg7jAQ3u1xZ3R2JhqsAfRcF9HmMKBvHO9avmP3Rk6Be82HrZR8r8baeDwxy3QEiG1wOAv2MopPa1mlWQ7HcAdz5xOJ0LLG8UcOKn+mi0mq8eckTqNFIjvhyXpkKS0wj1ea/F5Y191yIuHvvcw9WU/dvc+65nEnZEa/bvDfzVDWC2A02B5oX/AqpsNXTkvxs3eE6xPturdyGNBH4aSy5fAW3LatxWO4AADB7BdgYX/I+Q6XWu0mgVMYhH+gPgc2hOdTzC6DqYqcaIXQzlrjjhD+89M4BO/VMR/Yf+t40EEvefoJA3ebxCAnRUPevpoM1l7xcd6TKcLcul+SWp+G2Y0KmZWPvkvePCB9pWyP71vy3wQG8Aqwj0UAzFOIqisk6Bdo6uCjwa1W74MzHbP2Fn5YlD85DIbAlHi8AABAASURBVNZQRbHLNuZuZ3u8nu6pNtjcsKwwYYNsT9TrdHnm12sZuxVCj5HBXAuhXc7cH3PC6gOqOzrXIZud+2jYfIyA0kRxVSxe18bHdq22OgAG3R6vu0lIc4kugsN87NSKNDKdkgNbWlvX2zs4FVi4TCpzFgCCHYHuq3H2gR2nkmxbGhPJtWNRswgzY7dDOBDXzLnmn1sLNgauOxk5uIXrko1qxojmtmIoXLKJ2s6YkxZH2O4AGG/7tvMfMUx1qiZ8js2tEokgRMX1rN/O1ZB7b+AHVezRgcawOthwwzP/6KjztMIWxszYAdAAG4JSJqTVwRtsEH2MSK5DXJeOibTxQBO+bgDj1bf2NT5qo5qXRTviAFhbR19oZ1u8rkGATobZc7WEowIXWqw3tOWoKMt31y594HS6ylk+MstABfVgNNRv2NRb75jTZL1WroydbWBbrJR7RJZfn3fq6iUPLj5ybMeW65AmgnaIHiUTgXoaD1MbaWyN1+0addK2Q8ccwBEL2pP1Z9OA2Y98mr1fHx8ydm8+otOurdArvkVTRTaIR6DacF9bou59UOKBbUAU/IvGllvC3Pv8AdufDkwZex60HPxRAg+3he/HEvVLjop2ZNdxB8BWdSRXfNCQmU8g6DY9nosgAG8HG8O7T3u6QoA4h5yZ5VoEaFKapu1z3ZYDn0CgaRofYZsmOD2NaEXDc7jk3auerpiGkByy6r8DIKcM1ge66qeIn2s6kss/Yr30qSWKqZPYkyKWiHzHr8+i+x17xrZouHy7PchHpB6cv2euqdJnjRxZ9x9RAwlyU0dfo634rUM8tSS2hW1i26ZOnV8KpTJnHjy0x9YnAxUYO/JDlWtqBQGtpqs9Gf5erjmsTueaA7h08R2BtHlwHoD1nhVBZXTQ/wo2BjT0iwT6LdeAIGRHsrEZZlhgmxCF5TMy2TIw8GI76aJ+xl+5TlmvAyFtHFqw6rS7be7BTIzcNQdQPfs4Mtq05wNsqBmQztg6/y8h8ym6+kzMbIFnfKLqKwVmLfpsPgxa/rRktgxQfspO44OGfAG4TtmgRKE5e+H8mgCLdmN1zQEMDB0KKgXzrTdagV+ryRTydZR8sAR9C5bTlSGfLFOm1YQfUsZBWx/8mBKEjQlSRn8b22ilCi6DCn1ho5UyR8u6afvKl7hO2THeo5San0oZdDEcrdWZY9ccwKyqBT5NBKzvQwPCsLFvyE761iztPD9tHLRYBYJppvbx/bLFgotGHNtmmMP7gMoILAxp4wBEw5svsFDkGFE04zAIYH1z0agNVAarbGgHY0wYN8J6i8ZVMzbSlMqW7r9AHYTQ7xqr0boYTYPzJKStE0iSfDQtipp/Le3O6EXp/jVsq5VGclko0M6zUuZoWUL47xKojY624BhhyKa2kAs49xyAGl7CT3PlAjKfNAgCBFbEwcbg12uWWY09YxySsfit99sIuyhER3pveyBjHjKtBMNlEdBqllopc7QsoXxxROubC2MXZvrs0fqcOrbeolyRm3CGogmvXJPnmk6gD8x0v41vACo05PBxAAhWBkT9QYBrlZUyi1HWBrhWIegWP6SFMFImJNomozNyaLugumW1eG4DqKTl08m54nTPAaB2IoD19V3QQBpdXvpyJSDfdBsA0JTGyWBx0PVqmve3/nVPi2FaIA6VrleSrRaIOkqEKTOncNkcFWXpLkJmm0C/pTJHhClA9J0wsu/8f9ccgEBRbUP7p+6/H26lUVu7qHyopRURYYGV8hE1MM0B1z7tZaUtucgyzFQP25xL2lzTUH9sAZdNrunzTdfRd8FOzQ4HoAAQcDa4FFxzAAqkLU9vSZWxmcoWUEoutFKJoK6lEL6ycQBSyDjbbCWHVJ+oTFqsFDlGlqmsHfg9ogCUaekF5WW5Oey45wCknGfHLUDa5k9y79p1D+qiUs+B25yT+EQl7Nq7x8Zxi5yhOJIwdfCl7Wyzlcp0UaVx2Vgpc7Qs66d+WQO5LjBtmRFj6VOt7jkAUFXU+5kKX97naVTVpheMXoGiCWsf3NK1KrjnmUtK7p3/VxjJb+/OJ96SYpvzyzV5aqvLZHxtpuVlNNIG7Li3GN+C0bGuOQAAZceICtmnLC8kEvrycuahGlQWD16kjX0vyy+XnZSx11JTuUwW7lxoa32mxmpT3VLWXlHyYNZWwqbA4ZvifGGnqQtQWMbcclFTrSTnlVviHFOlzaL9zmeOFuSfLGO1zUpBxr+LyiZ/LLnnsP7rRqxboSq/R4EBUANbAl2gbZHrCS1+Bly7lZ4mNTjN/IVnd7EHIO3RjWDpAN1oamnqYhDA2gKz+tFYKIHgE1XWokQEX/pxKhtrxY6SZkvdQintnroaZcYrh/Y0wlfkT7KHNhmNtnanHqs5pNBiBxDQya1MwtRMPOX30SSQhYZxmew6bqG0UOQYUQj2dNUVCpvawhgTxkS45gAQwBZvjajZPqBiSmsnGgy6H1512v/a6rjGlLyLEfwxGJNsthKCbXP0x4DULC0jFk3tAGh1bRDINQcAqO8lw5kDS1e/VmOpvNHCFi5cpQw5aIyOn85xRg7CnHn1505HRinlDc4+6Vy22UrMhtlvctlYKXO0LL8+a3SUBccIArQ94FJwzQGQ0buAfR9YG4TtU6qtgCgIu3W4+elFIc2IdRKLXBLZKpWlPhQQuExawc6g2VW3hF5+DkCh3AM2dAGkSsPqpX863q6KcG5ri6Kwx0r5PHOpa8F6K2UWsyxdVDQoix0AzdHv5rKxy+6WxfctNO14zJzagFLSvd8ftIuwqeQqaTwPNngAdgBCzLLt3fANAEoTvmfB4mAaA3QLQOOLFsstPnEKTWOQbLUWmSb057hsrJX6ijSjMrBMKuvGfo5IRhAg0bS8PkGOwbVbAKnwYSTjweIgyUvrIrDMYrFHiUOli4qd5AeOipv+rgTjvA3wJboeTF9WMUtgG9lWazEq0EXVSwBIHQGwJei+CnIAdgzWI9A04DO2gM5BqGsOIKBX7EAbngWi7hQoNMM52F5wkpR5aLvV2H1atZ4MXXZ+waBKJGN86ZqVPq3G0vl0LouUedDWl6mkaYS5bllNM2PXqC1YLTdXea45gOH0UL9SZq44c04nSaaU6TflnKGAhAjmZgHWvsow8mis2VEAnJLKIrTMphFbrYOdLQtlWvyVoWPxmSrzRkl169hYC46UhHQK91sgqSARrjkAITIp6q7b8PVeCQF9rq3PhMcS5z3gt3xKSIEm/AuaQ52W3x8XVDNsyLQmsmWJJnwLAaztqXNZdCRX2vo9xQp9bjWAtISVo4WYKp1WMGDThwaO1jT+vmsOoDJ43DAg7hsf1nRiEdLmId/qpVtsmwlgdMPGrm4E5F3LVlOmQdNmr7NMYJEJCuDcFrbRSlhIZTCU2dVjpczRsrgucZ0C0gUWBwTYGwjowxaLzVmcaw5g7x5ICdAPgB1BmbrQxYl2iD4iU6H+X4jWv9BoqoF/O6Jjpm3tsI3LQBOBb9nJlebznwBUp+zQgaDv37XnkPXTCzmCdc0B3PnEGSmfqKb5dGu7g2y3AvQh4Km8b9eKQt5LtzCWi1dKak21XfY+0WI56qkFRkNdG9m2qVPml4LLQIrMvfnlyi81gnkq16n8cuWSWoFPq9l9j4sfg3HNAbREkqsz6lAD2NCtAgrkWZfQxrZF86f3I+qPWa2AB0YFYrQ5lJgxYwE8rkEOuZlts5ovLgMuC6vlHi0PQbOsLsExAYHbwLqGvjXHRDt44IoDWBveeq0uKm+RMmP5yxUj3CnaGJfRP9uW1s3nDyGoHWCDA5MgBU0Ofw9mSkDf9VmbLLeH3ArgDi4Ly0UfJZAcF9UlrlNHRVq0y23Ap4KbouGtGywSmZcYkVdqCxJHw91bUOGG4ewnodACieOLCOjzzh//jJWx/Z8J6HZ8hIIrm1rVHOr5sZVo3ZAVzdogLwGLR/7ZFuZeqv5/5X07V6pLNv7uIAK3BaXw2uZwzxY77RhPtmMO4LyTNwabIz33gZIr7KgMo40zZQqa65Oka/QZ647bE699PGXst+UxTqkMajLyH5tDXSX7klBLOB4GMP+RbbGO9VckpYx9z3UkL7L8NuwVDQBrG7qWc106Os6efQXU01jBbaTl5AeD9ugYK9URB9DS2HnCKcct3UndnYvIzLEobIgx5CBIc/gaG0QfIzKAc9+JqB0TZ9WBAunz6bN7W5ZstPapI6sATiKnvr7bp2lVcQXK+qkS0sucEzfvpF1bF5GRH+G6ZIWSqWQQVyClcREeN2tXtL7b1lmsI1hsdwDRSNdqMw2PZcxD1QD2dflhVFB0BdVF1XktLRvtaZ2H9aWG924TqB20q1dDVzll+l7z18PqSmZzqiH/xtjtAayAOc9oB2z7CTjG3QIbNU2rvIDrEjgYMuZAFRjwWFN4i+2Dg7Y6gKbara+jfs0t5Nns/UrHuIWDYJj9C7Unam19IKjjkRV7lDJvF2jLhY4tQwXyhHXheJoPSmFtDvdkFCj+vTtbPD4S10oad3Z0rqBpZPsY0SKLj6er/wIAW8yAyYICsxpB27Qu0vsPYGOwwwFk2Vof7vuGrgX/rBQPaNlowSSiBfpqUuqQ7dNp7Yn6tyPaQeUrxpkq7WsKbX1p1Wl32zRz8oquQvcYW1Oo8yWpDL1QGbnkE6BBe/L2q3JJO500BsA5Anx2fAYIcglKSUDQ/9RS99A3D6fPtq3D+5ZsLK+1LUu2+6Lh3l8ohM8Y0oZH/fMwW/LLG0r9Wx5ZCkyK5ObUtQVmzifbwhPmnzy0NpRYnk8mJ9KuDXUtZ2wAaqHd+hTKawE2SLv1UP35oqRbSSv0FCoj24aU+elouOfX3LYKlTNRPssdgOEf3AEg35kFPpFWx+IV0BTORU58cLM/Nfw9n8YXC1t7PJii6VOE9ANNoa5fHabR8qvCYbm5bLK6o6GuXyKoBxgbZcrG0daGJfvkHOwf2vt9G4QfI/LSxd8NBLS5FwPNxRxzwoWDkbak3m74Bh+2Wr1lDuDy2q2vIS8lia/T6Z7YapwFy0ub+2DB3NCnCxaQY8a7dpy/N20e+Bdd2Poi4mE0Shco3tEc7umiaUKaajsc7fCGdTeHezsRxdXUUGzt9rNpzG1KHvz0nx95va33/qyrqubCz6So7vB+MawjbUotioa7VXRZ1yKrMFniAKL1m+sqtKqnlDLI+9t6BczbbkX3UUqpy1etutv2CropufK/pEzF8wZZQAapDKC1QQH2NEd6/1SAiGlliUbifwQQ3VJlGgnHtGTlmlnKdPyWxEpbX/xhLFxXFNUZRXWHj4tpVcoEzRd8cu2SBy25DZy2A2gKdX1Ck9U9Gdmviomoo7EQsPqaQzWOzKWbSn3an70VOBqBffsKTFTS+Id1kYRaX9d3XVNoy4V2aYuGuy5YX7f9OpqRUCAzr5dgTLv+5IqVOTVk5jO5pp9OOq4rSqn66cg4Oq/V+zRNqHyBmq3RUPc9wVK7AAAQAElEQVSnpit7WgXYFOq6CRG+bchBQKC96aKxLb8Sfim+YZv4owRv6lv+57Qx8FNE7ahYe3cV3XeZMgUZc+jjpPcv1CMwoqFe6pbTUBlsKLiMNxzOy7KaIz0GAN5Ple/jpkqTRnKr4EwgmyBlHPz5LdvOc6SnE5Di64BQMG9gc0AA5DYHqL5FtwQbAQgtFBYKNrI53PtHug99myrCbtJoKrjbJDDwERpFrR59zo7jjr6G9wvQn6YmQgs4Grg8pMxoQmi/XBdJqr7at8ZbItt/Ew11/htdvd90ee29r5kIEI/jrK9LvInTch7OyzJYlpSGxjxOlNeueCJQCeJyU9+K94IDYdWSu6sR/de4YWu+5nFZI2BLc6iXbsfyzT2SPm8H0LLkwXnr67Y9ZKrMP0hFF4UROUX/3zAHwAwMf9wpoJrE1boIolP6Rusx5TDwSlNmtYbspzlz/LIp078P6gufurLhKfWO5X+n9Xlaeft3xXFBveYpU8rfA+CXOQ/nZRm8gkvBRxwqYa51Sv18f/XHDHPQKXXT1sNt0ITM61rqtj/csuShvH9wMS8HsHbZlnrT73/EkKklVLNpmTZ+BwXQtUTKbLfYCaU394W2U8NpRsyLYpug0SQdSBo0zNBtwiEYzuyCgdRztD5LK2+fy8ZlzEPZNIrSArhfvEjcGXK4ub233tZHfuGoIBVQHaG6clTcdHadyEslhVTXzjb9g49Fw52N+ejMuXauqd28QteD3dQ1WkhrPjqKJq1fn33murqtFzkFqCO5PCbAt1ETAfBCfgyMcKa3Mof55Sw8dRMNoAb0WWcVLsG9nNwmlZLzNVHR2RTZel6uSHJyAM3h+PsEalvIy+QqtyjTpYx9oMGsO5wE15YIX0EjZjRQQ37aScUlrQtBoNgYS0TWg4PBr82+k+uIgyotV2WYQwASH2yu7f1gLsIncQAqW2Ob6+Lf8Ws1PwGqxbkILO40CCnzQNX6um2OVqz0UP97BWpPIDo3M1Dc5TAxOuaIuRoeOOjIoN8RJM2hxHquGwDZag+lHRT4fDU/WBfuOfzE5EhbHs+mSRwAqqZQ55PSzHxs2LD9wavxsNkSh4A0hTL8HVuETyD01kcvPNSeqD8DlPn3CZJ40YcZUMp4nrlizg5HObJRkLmO64aVytyUlTL2gqnMDzXVdv4NACcc1BjXAVy6+PFANNT1NwRYNDOu/HBM0LDixGhoy1eOiXTgYDgz2ICAzyHqDmgrLRXMCXNTYUKd08jXhrZ8WRPBVzmt1359ii53cEo03P3c5fXd4z6jPq4DCFYd2E0jwaeoGdHtH0vzyEMUvmuaapPHjT1rX8wdOy55MZZcfgoAPkYreOEIA9T0iRPm5qbtK186EuvEluuAQP2jhhxwQp3jOrgNK2We5Ddg3J8fG+MAmkJbL0MUjjwwA24GJWcDDn3RDQha+kA99UJ+o6E3O8AcMBeCOHGjLLJ1gOuCK8odVIroa67tah6tcYwDoC7/BVJlRqebcccKJAT9J364qfaBpU4b17rjkv62RO07TDR/i4hOqy8afYgIkjhgLpgTp4E1L7n/XK4DyoaertO2TKVPKgMU4pjpwTEOABWmphI2U84PpV8EgYE2HvNww6aOeP2VgLhG1ypBked1A4MbOtnWEZtxbYw5cAFEtsx9gXauAy6od0clqjFte4wDAL3i95pw5MU5d0gYpRWFfhaNebx/VLRjh7F4462ZdGqxhr4nRRkMDiLZqJOtGUwt7kg03uIY0aMUVVYdfB8KX0k+9DPKlJwOBfpAU747Ryce4wBivaEtoMqnW2rKFAjUv7u+IW7jjz+Mpv3Y403bG55sT9SdoVB9w6/zV4WOPT9TjrK2IX6jjWzd1NPwpFt2rQ93XYCoXc9l7xYGp/UK1KE1Gb5/tN4xDoATSJn+sIbl0wsw1TBIE26AkeCa94vFGz6bTh88H9F/v579shB1lkcwlfB/BWwLovZAWg6dH4vXfdZFY7JlK1G/gcvcLhzFJlejtmyYwx8bD9e4DsBIpX/FgwbjZZiZcTQYpczFTbWb7yT7XG11HdtWbI4lIhfRtNQ/+bTZBKe0F582B9iWWKLhwo543WaXrVFra7fcIamsAbK+AMohSDBhOCiPXOCOMXlcB1D36AUDugg+UEbjUqD4U0ta8M3rI9uvPIYhlw46kiv/t3Lvi0FNVH5UCH1Y0D1caZSHAsYqQB9m7JV7XwiyLVAEYV1k+9t0reJSLusigOMQBAUaBjav2LqifzyF4zqADYAyIwd/J7KVbrxsMzPOpPEAQLhx9Vn3u/BDJmM5veGZS4bb4suub4/XBwGMb1GD2o/IRVaMVy8ERA0YIwj5rfZkfZCxsw1jLXM+hstUINyULWPn1bumUVAbNtTg7RuoTY8HQowXyXEdyeVfD+h5f1+As5b0mjEHQK8IPLt66RZbf1EoX5LaE8s/jak9p+gYeC11V7ZU+l8FmHUGbt6xKEDCwFiod7JFR/9rGWN7b8On87XPzvRcllSmf+OytVMPyy62NeCbDx2JFV+dCNeEDoAzDGX2fBtR492yWhWo2QFf5bj3TG4S0brjkv6N8dr7OvpWnPf3XX8KSiV/rmtVfeQQqLtdAQiTFidYEZB0aKKC2rsaZt10P/0/f9/1BHXzV5zH2BgjFFkI+II3UJnOKTJYtsNB1GAovfO7kymatMboGv4QlJz5jwWOYUiBqdJvbg7H7x1zqkgi7nnmH4c3JVe8d9es3fUAwVOpnC4Q6NsY0OaAT6sGnm8fgapGNgX9H8krUM/KZNmCdLAu1sm6NyVXvueeZy4ZLki8A5maw733mirzZvJYDmgrLhVKmQbZffiV4PGxTeoAds06+AyCeBbKMBB5QG7g4mi4+2vFbP4991xidPSFdrYlIg+2JcJX/Lb3LDQyg6ej0q4mJ/ADXZt1s0DxIIJ4BBTsAQRTEwHwa7OAb/F45X2O43OchtNyHs6LqP9AKXxnOr1/MctmHW2ki3WybijiwGWnQF7MZVnEMG2DJlB7dt/cwacmUzCpA+ACRvR/Ntvlm0zKDD2XrTjK/FxzuPcHpWRibFvjU+3J8K9jifoPt/YueVs7TcHVJhvO1c/66/H6GcsDu2fv870060XfizXPZVfe5zg+x2k4LefhvDGSEUvW/WrT9gtce3CnEO6zZUZlly3DQgQUkKeYsnCb1dD3BW7Dk+Ga1AFwxrZEbatUxm7eL8d1pBMsP7i2duuG0rUf1QYaBW5tXW+2tqLJlWK8lc9xGk4LgApKNHBZKZAfLFkDLOCdHN/ejfHQTVOJmtIBsABNVL+fJnl4tyxXqUwQiNdGS9oJlEfRcRlxWVEDKA+Dx7GS26qGwZzeb8nJAcDw83/URTANdIM4jr6yiFJkOwrt2mik90dlYXAJGtkcSfyQy4jLqgThWwSZH70Opg/5D/wxF4E5OYDWHZf0Z+TwdXxfkYvQmZqGewI0KfKBpnD3f85UG0vVrqZwzzelTP0zl5EbNhSLTk0EgNrq9+7cuvJgLphycgAsqCPZ+FlTpXMSyuln8kpdrH9pqUv+ZSbbWEq2raOyQICievjILf6kNPqpreb8o6E5OwA2SMOqL5fzbQBzwKtSBpgyfeG6SPK+y0IPnsRx3uo8A8z9ukjiPkllwWXiPIJi00jdfy34lXxQ5eUAnhb3f7dCn0/yy3l8lcynRSlJTiB1kR/0R6+s715AUd7iIANX1t+9wA++R8gRX8Rl4aDqIlWlIEBtc+ferkmf/BsNPi8H0NPzgcxwZve7da1qtJwyPVY0NKiqJFTvuqJ+u6M/ZFGmhFNPH+CK8Pb3SnXiLgWyuhh6pMVQFrqogqHM7vfxE6L54MnLAbDgUN/KX5nm4BO8760jDKSNA2CYqZ9GQ509IzHef5sY4B+r6TEg9dO0ecAmFaUp1pSDT0X6Vv5PvujzdgAbAKXAim8I9OWra0anlzQuAIB1zeHeZ5tCnVHwgqUMRENbm5ojvX9D4niEa0vFl7QwRB2EFvwmt818DcnbAbCCtkToZ0qaewAQvPAKAwokSJU+WaDeHg33fm2iX2N5JYe3NxUDzGE03P01RF+MBvtOYY6nylNe56kNKrW/rbf2x4XYXZADYEUo9PPo/kvyvrcezQCSE8iAQPyczzAfW1374JuPPuvt587AmtDWNzGHArXPyexvVVBlzz27IyndV6KUptTKQnEU7ADaE5HH/aLmNgCvUGCcQKPTNEAIJ1X6FtzZFO7aFF3Wt2icZF7UOAxEl3Utioa7O4L63N/TfNNJzOU4ybwoYkDXam5v7Wt8lHYLWgp2AKzt5viStX697L6zwKbnvKaMfYAK1igxtK053POrnDOWacLmUM+vlJDbQKm1zF2Z0pCT2RW++dDau+TynBJPkGhaDoBlmubB9cBVHLwwEQOH71srAfAdzeFe1Rzu/Nili7fM3B8AgPzCpYvvmMWcMDeA+A7KXXmYM9r1lokYGDL3XTXRuVzjp+0A2hINrZrwv0jjAbnqLNt0fB87sqrvVFYHdq8Jbfls2ZJx2PA1oc3/Wll94m6p1HdGuMkcPlP8G/cQKtBF5Qub4o1Tvu47FcZpOwBW4PNrEU0Eeddbc2RAqrTPJ4L/QVOGA82Rnuujkd5Tc8xa8snY1mayuSm0dcAnKr/OXJS8UQ4aoIlK0MDXYIVKSxzATVuXvYTg+5AVgMpJhimHyVxVKaXxER8Gn2kOxf+PGsWZLUu2++nEjFrYJrZtXaj3z2wr20wGVo5wQHvekjMDiHDNb+NnP59zhkkSWuIAWH5r/JwfIWp7eN9b82cgbR6kWQPjEk1UPGr6aMAwlPhZcyhxbv6SiisH20Drz9gmtk2C+Tq2tbhQlg4aRHHg3N5lln2izjIHADQQGEs0LNBwxl28wKmgQAJfERXIMyWk36Nr/u3N4d6d0XD8Q3z1XH3WIzVOYSlUD2NkrIy5Odyzk21gW9imw7YVKrqo8rkBRsMA1CZun7cB0LLnbyx0ACOUmGD8v5E97//0GFCQNg/xQ0ULEeT3EfBhX3Dw4XWRvr5opPeaN9beVTU9+dblZizRSPc1jI0xMlbGLJWxkG3wBoit4Vop49oNsMGyxs+oLHcAHYnGryJoPQJ1KK2ARQuXGhLdHighVeYkUw4tQ4Xfne9f3N8U6jzYFO6++W2RHVc3h7a+qbn+0bOblm/l97VtsaXp7K3zWQfrehvpZN2MgbGg0r7L2BijAsZq2ILBGqHFW9bj2YfUllCJvvZkw5fHOz+dOMsdAIPRModWSWW+xPulsPo07lmrfoFaKcClXkEahjP8oWZVA8pcn5YDv6TLwu+lsT8p0r6/ra975EA01PO3aKiz7W11D31+bWjL1auXbm24/My7p/xuAafhtJyH87KMKMlimaJC/xvrYF2sk3UDqBrGIlW6JLgbuTDJ/pEyLwnIRLHcpRnBC+xAa4sD4G8ICtDeFdDn2IF52jJpMAp09YmwxAAADBNJREFUmkpBof8eUfu8gbtf1ZFcUSOlvFTDwM5pK3BYgKKxg8Mq/VJlKjPm/lkKjFMARXNGpr5Ktv6ywl/TVVVz8q6rGp5Wb2/8q7qq4Rl1ZcOT2ZX3R+KeVpyG03IezssyWBbLlMqoJD3ZQZ6jdFJUaSwa+F8ylPHmjuTKGjX80omotM8L9N2p0xQ21wnIMTiZjJ+0RYR3t+5Y2m+HXlscAANtT9bfZRj9/yRQ58OiWBGEpMLOKEh9qDW+DGPx+ktp4PI/Yj0XvwAUOvqW/x4Tj70KURuiwxJeRrq4SpnUW8jQwOIQZGg8IWXshaHMThhMv0jbl7K9CL56D2VeOhy3EzgNp6XufDYvyxghYkTmyH7p/Rfo29mWjJxwS3LFXYyeLlIvxvoa/qM9UfeW1ngtSpn+Z00EM0h1BIokCGo7hup/f3ui8Q67INnmABgwnvnkL6kCxQHcqDwKBPqg0n8iAGCnX5v1AaUgRIXtb48v/yFMEFphvRlLNFRq6P9She+4CVJ50aXCQNC3AATon2xP1B0Pk4RYsvHHbfFaP4Kq9WtVHwDALVx3BNUh6oODG0GB7BOnP5n3Rz7ywWqrA2htpcaUXF6HKBy7oiJqZD+mfdqsXabKXP+brldjR3L5ipt7z/lJR1/jdjqZ09KWiGww0rvPBsQ9mJWZUzYvUZEwwGUmUH9hWO17VXuy/rpcYbUnlz90c+/Sn3Qkl5/HdUeq9He5LlH+NDpYD0hXKpZoDHEbIt22LbY6gCOopQbLdI1vH0EdibNyi4AQ0OeRSNwtwPc+UFi/sfec4zclV3wUphH4NUs9XXUmoviuJipYki34WbC3WsaA4rqGSv9ypmrorFhPQ/b2rlDpNF7wMa5LArBOw8B7Sc5OrmsIAuwJ/Jx/EBC0ZeBAsMuKY6Bv6ml4MmMMrBOo4zEnpnGAqAFSIQj0PQ4oWjN6/5nktRfy14pGrvRoSWNt3XHu3vZ43cdMmWoWwv+iwOIZ0wAvHMOAoO46Cv05U+KF7cnwtbc+cOGhYxIUfICKewY0bvTzjuSK402VPkMhbiR9jyPVQaS6CBYFgX7IQP9V7YnI4xaJnFSMIw6AEWzqW9lOrf8LANNrl4IKWafeBKL+dU3HU0VwOBRLNKxv32ovYR3J5TGR8p2GIL7g1/hN3unZAV6wkAEFPq0aaLzpnxcIdXossfQBC4WPEdXae+4THYmGK7jupTN4KoD2NV2rAq6bYxLnFcF1Sv2/TfHzp/2WX65qHXMADKgtUc/fdvuNJgJ8mNOKKLKFCwB/Fei7UQBe1tq7DNvj4c+19jT8rXXz+Y6NL9BUTLotEfnacGZfrS5q/piPHYTfW2xggG/NdK361uHhA2fEaCDvJz0Njr1PzHXvdzsa/hZLRL7Q2rsUqU/6Vg39vwHAZ9ghIdVdyDFwXULw/bY9Uf/VHLNYkkxYIiUPIbFE3TuF8N0+dU9Aga7RvZAStxmZwdNDyeWL2hN1b29NRChvHgptSHrLtvO3tcbPfSMNEC0X6LNBgydyagYQEEQ6ZQ4vosa35tYd59v+qXqYImxMRO5oS0TeEUo2np6WB18DCm7TqbeaS12nHu2dsWTd26dQYflpxx0AAMqNPRvWaKL6Jl3w4+w08UJMcXH6st0ofUCA/j9CBNcNv/jXqvZk/erYtsanNlA+KLIQSyzvak/UoRC+DwnQaHyAn5HhblyRAZ0xcBRo1HtE1J5Ege+NJRsDt/WteLrYzOO6uilx3jOEb/VzOx+u5LqM6PuZQG2A6zjXdUV1HgDpIlcFuqi6edesXavpWILDwQUHwBa2mm3xpVehgNcJFDuCvuMO0g1cX8oceHN7or66PVn/nvZ4qP225y8f5NTFvrbH637Ynmw4USnzixr6M1zAxY659PAhCNQzSqmPxBINi2Pxxp9DCYTNz60f4rpMPd/3tScaqtPpA29SSvZxnReAj6ISb6DBxbfdc88lrrw8IdzkcGPP0ruJlHNv6l40O9a3InTkKS03MU1HdyzZ8JWBQHqBwIr1CFq/LrJTh+CFwhnIXjFR7BYC14lgenZ7IvL9wqW5n3PT9gv+0NG3MsR1vj3ZePbG+JI/uYnKVQfgpuF26ebfZW9L1LaSM6gxVObdQlQ8RroMBI9qyDEgcYUAGV1UPZQ2+tfFEo0L2+ON7TzoBi6FmarWq5U2lmxHouEXe2bvPVfp2tmI+NMKfT4gajZqLG3RzE1AnwsgtOs1VXFWa7ytlqePS9uq4kbvOQCby4fv7fhBKLrVef9j8Gc/Ilyr0UCWzWpLTjxP51E3/0tmT0KPxes+2toXosG9DY4PipUccdME7DmAaRKYT/aeng9kRPypr0qZ4q+B5pN1xqc1ZcrA3ie/0grrzRlvbBEZ6DkAhwvjXGhRgILHBRzWXOTqEB7LclOEMGcyJM8BOFy6GwClhgFyAMphzcWtjgdLN0z9xExxG1GC6DwH4EKhSWU+C+BRfzT1qCRxgp5XPJoUB/a9WugAyaNVCPTdI7zZgJdpEajTtV/85eUIb8cxBjwH4BjVryhKZV7cqgt+DPqVuHLe00QQMsbwlmLkYKZj8hyACyV86/bXv4ReD+Bl5jVRAbdsX063AC9HeTsOMeA5AIeIHq3GMA/+Ab1xAED6Sxl77wcvuMKA5wBcoR1AQuZOmg50SXsRqUWuguq2IkJUVlCY/bIyuFiM1bTqmIbetwQ09IOmzfttsZTL0TjKYd9zAC6VspE5MGzIIce+ZuSSmVOqNeRwKpXalZoyoZfAFgY8B2ALrVML1Y30IIDYOXXKmZ0CEV4KyOqBmW1l8VrnOQCXyqZ1xyX9AX32CwDl/OyLAp82+4VWm372yqWiLSm1ngNwsbiGMrv+jlDOrwcLoBmAXVCEoVwgeQ7AxZL2a1W3CH4KzkUMbqoW6AOfqtzkJoZy1+05ABdrwMHUi7f7dP6NARdBuKjar1WD6Ttwh4sQyl615wBcrAJ37XjzXhoFdxGBu6oVKIj1jPwys7tIyle75wBcLnvTGLwXAKEcQ9rcv7kY7S4nTJ4DcLm0lZB/xDJ0AAgClBJ/BC+4yoDnAFylH0BH3/1Ak+Euw3BePdmsaz7q/Tiv2tP4CgPilV1vzw0G0pDepZQsuyfhlDLThpEu+weh3KhzR+v0HMDRbLiwXyn0nYBi0AXV7qrM2lx8DsBdUpzX7jkA5zk/RuNNPQ27faJyqLyeCFTgF1WDHX0X7DyGDO/AcQY8B+A45WMVGuahbVhGDwQhaJAx+x8BL7jOgOcAXC8CAIEVbaKMHIAQPtBFsLUIqC97CJ4DKIIqsHv/U20+raYIkDgDwSeqQEGm3RltuWspx5SeAyiCUr/nmab9aeNQESBxBoIhh6A1Xue9BOQM3ZNq8RzApPQ4dxJRls1nsU2V8Z4AdK5qTarJcwCT0uPcSaXUVue0ua6pnGx1nezJAHgOYDJ2HDyn68FtDqpzVZVPr467CmAc5eUa5TmAIil5mUk/RVDK4fNAKm0O/JVs9ZYiYMBzAEVQCAzhoH7wSQ19M94BCLLRBHicbfZW9xnwHID7ZZBFcFfPxS+YYLwEgDBzA/LvIey+NV73/My1sbQs8xxAMZWXzIRR6MbMfCxYgUDN1H0YKibKGUs5r54DKKLS52fjTTAvnYkPBWVtUqm3tnYtf7GIKC97KJ4DKLIqcEu88U9q//Nz/Nrsd9AV8xeIWp8uKqFCXwC8Fci/JsS3CcU0XMBYkK7w2Ud8X8YKILYhar8M6HPfnpY757Ynz78LvFBUDHgOoKiKYwRM61NvOHBz79m/aU80vDuWaAi1xpehse+pORIy6+j24DpEfLhCn/echr7ddHwIAYYpp0LUAVEDBC5WiqU9yK5QYHhFBpJMZNmkA0gpnSGd6hBjqCAsSJgUqO+YYLQwVsbckWysJfzv+m3PmTduSlyyn/J5S5ExwDWlyCB5cMZjgJ1Ce7yuvT1R/8lYonHJTT1nnpIeGlyEKrgEpRahO+yVflF9sQD/Wroef1IBXq+JCupBiNsBsBNB8dt3zwEAN8RBBEwDNWReR/aRv0lA5/BZin6U4ruowd/OMqhhf08BfFKQbNYhlTwPdS3CuhkDY2FMsUT9J2LxujbGSvlLYil3kP8fAAD//7HH6iYAAAAGSURBVAMAyTzxUhiUNjIAAAAASUVORK5CYII=" preserveAspectRatio="none"/><image width="10" height="10" id="R" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aeyde4xc133fz7l33sOXzNXDdGXLQOmGtotUCWWlBZwWbdMk0h+pmAqxU6uKlYoSl0tHKz6Wu5So0YO7XHIpqhK5guQ2dus2cRxEbovYbdAWBRw0qCsmAdrIbKE/XFi1LJuUbZGcncede0/P95IbcOm973tn7sx8B3M4d875vc7n3t93Z4e7s4bgjQRIYGwJUADG9tRz4yQgBAWAVwEJjDEBCsAYn3xufbwJYPcUAFDgIIExJUABGNMTz22TAAhQAECBgwTGlMBQCcC+ffvKuxtLE/s5yCCH1wCuzUajURoGLVmtcSgEoNF4pbZn9rn/Im760P82u9b5lh4rHOfJwMoNA1yTuDZ/qDb+nz2z83/UaHyhstpkeX7MuwDIfU8sHrxctJpSmn+3Z3XvEEpNKD3wyKEmyCAfDFavSavbvkNK+Q/eMy+1po6euj/PzY/aci0Ae2YX/pftOCdWrlzS17lCvRwkkHMC0r1W2ytNoZzeVz535OSv5LngnAqAklNPnPiXhiE/ppU1z/xYGwl4EnBsWxSr5X87/fw/f5+n0QAWrk+ZSwHYc/j4FmkY/8RxnOtr5TEJDB2Bln4l0LrwgxfyWnguBUAa4k/snpVXZqyLBEITwCvYgmn+3P05/d+B3AnAo4cX7jTNwk8BXGjKNCSBHBMoFIrbt/WqH85jibkTgGKp8HCPX/3zeK2wppgEOp22cKTxP2K6p+p2Y7DcCYB+4+SBG4vkcxIYdgKOY2+aOrr0i3nbR64EYPLwwpP6zb8NeYPEekggKQG8oe3Yvd9MGidt/9wIQKPRKBRKpWfsXi/tPTIeCeSCgJTy/ry9GZgbAfh+t/Ipy+rk4kSxCBLIhIAS4pZe9dVMYocIup5JbgRAKPX4egVyjgRGhYB+H0AYhvng3tn5rXnZUy4E4OHZxkdq9Q135gUK6yCBrAj0rK4wzOI/yip+1Li5EIAN1S1fXmlejlo77UlgKAn0nN5zeSl84AKgXw59pNVq7sgLENZBAlkTKJcqE48efu6+rPNcH9/reOACIE35GUMaQ/G7014QOU8CUQh0Oi1RqdaXovhkZTtwASiWqk/yx36zOr2Mm1cCnXbr9s81Tn580PUNVACmZhde6nbag2bA/CTQfwJSFntdNdP/xGszDkwApqefr8pC4V78hNTakviMBMaAgFKiWq9+Zl+jsSnr3frFH5gANDe3PySkyOVvSPkB4xoJpEVgpXlF9KzSv0krXpw4AxOAUs/8Rs+y4tRMHxIYDQL6VYAUxicG+SpgIAKw9+jiL0gpbxa8kcCYEzBN8xblVP7moDAMQgCkUHJfj7/0M6hzzrw5IoBXwaZR/MOsSgqK23cB0G/+VYTt3BtUGNdJYFwIWJZVmDq6+NlB7LfvAmDVrCVhyL7nHQRc5iSBMASU4win5zyolJJh7NO06WsjTjYaG4rlyqRj22nugbFIYOgJmIXC3374sflb+r2RvgqAYVcebbea/d4j85FA7gnYPVuUa+aX0yw0TKy+CoDdcz4XpijakMC4EVDKEYVy8e9MHXi2rz8b0zcBeHjm2C+WKpXbx+3Ecr8kEJZAt9MR5ob6Pw5rn4Zd3wSgVq3+i267nUbNjEECI0vA6naf6Ofm+iIA+xqLn+i027f1c2PMRQLDSMA0zfLk3PHfSlp7WP++CIBjqUekFKbgjQRIwJdAr2cJwzSf3r17d9HXMKXFzAVg9yuvFKu1+kMp1cswJDDyBHqWtam2bfsn+7HRzAWg8H/f/ff4rad+bIY5SGAUCOhXy7Lbteb6sZdMBeA3G8+/TxrmXUqpfuyFOUhgZAjU6hv/3lRjcVucDUXxyVQAar3eTillbj4DPQoY2pLAIAk0r1wWquN8PesaMhUAYciv2nYv6z0wPgmMJAH9uvmv7p479v4sN5eZAOw9svSgcpxalsUzNgmMMgFpGvWiYe7Kco+ZCMD993/FFMraY/OXfrI8d4w94gTwS3OlUuVMlG1Gtc1EAG798LdvFYZxd9RiaE8CJLCWQKfTFvuOnMjsfwQyEQBlOp/nO/9rTySfkUAcAvrbaGEL51O7d7+SyQ8GpS4ADx1qbCvX6/eg8Dgbpg8JkMBaAqZZ+Oty67vb186m8yx1AdhU3/S5VvNKOtUxCgmQgLB7ljCE/FoQijjrRhwnP59uu/Oo3zrXSIAEohHAt9PFUumOqSPP7YzmGWydqgDsmVv4p2ahsDk4LS1IgASiELC6HVEsb0j9g0PTFACpv1d5Eb/NFGVjtCUBEghHQP+PwGQ4y/BWqQnAbz1x6t6eZfHPfIdnT0sSiERASimmnjxxcj2nuHOpCYBld/fq+vr+scZxN04/Ehg2AvjBIOWo6TT/lFgqAvBY4/SW2saNvzRsQFkvCQwbAcexTceq3pdW3akIQKfb/m/Ny5fSqolxSIAEfAmoad/lCIuJBeDRwwt36Nf9d0TISVMSIIEEBCq1+k9PHjz2N1ZDJHlMLAAF07hHCMnf+hO8kUB/CKxcuSyMSukP08iWWACMQuElpZw0amEMEiCBkATsXu+Wqdn5nwpp7mmWSAD2Hjk+pwtJFMOzMi6QAAl4EtD/41a0hfGIp0HIhdjNu+/FF8tCiQf1u5IhU9GMBEggLQJKKVGpVh9LGi+2APTeufzXpGF8JGkB9CcBEohHoNNeEVNHl16M533VK7YACGF8mV/9r0LkvyQwCAJ4FeD0rH842Ti7IW7+WALwyMwzP12t1HaggLiJ6UcCJJCcgGkWbjft5p1xI8USgA0bNk+3Wvyd/7jQ6UcCaRBADPzynWX1/iuO44xYArDSWvm0EFLwRgIkMHgCxVLJfGTmuV+JU0lkAZicPf6IftlRipOMPiRAAukT6HU7olbf+Kk4kSMLgFL2UYd/7CMOa/qQQDYEpBSdduvuRqMRuZ8jO2zYtGWbcviTf9mcSUYlgXAEbrTSPfnBNz760cjfl0cWAAfNHznNjeXyOQmQQKoEDGle+Na3IndmZAHotlsdwTcABW8kkCsCSvzg5jfeUFFriiwAyhDLhmFGzUN7EiCBDAkUCub//P2vfCXy9+aRBWDCWDkkRGShyXDrDE0C40Xgxt2apilsx/53QsrIjRlZAPQ7jT2jUPjijUXwOQmQwGAI6P+Z++HysdkzcbJHFgAkeenpAw8VS+X/aBYKeMpBAiQwIAKGab6nit0PxU0fSwB0MvXi0/t/WTjqj/SxJWXkNx+1G+8kQAJxCEgp9at9PQzzrbPPzWxZbjRi/1x+XAFw6z5zbOaXjELlTiHNJSnEhY2bt4ibtk6Im97HQQa8BtK+BjZv2Sp043WFkP+qaBY/sXxsJvZXfnHtlkgAEOPss4+/sXzs0MHlhblbThyelPMHdsv5gxxkwGsg7Wvg+Mwj8uWFufLy/OEH/9mzB17X/Rf5TT/ts+aeWADWROMTEiCBoSJAARiq08ViSSBdAhSAdHkyGglkRiCLwBSALKgyJgkMCQEKwJCcKJZJAlkQoABkQZUxSWBICMQWgAcOnKzvnZ3fur+xNMFBBrwGsr0GvPiiB9GLcfUmsgDsffrkfY89ffr1TWXnvJLyfKtrnV/hIANeA32/BtB76EH0InoSvRlVCEILwCNPnNi+98jx101bvtZpt3Y6jn27UupmPSaEUhxkwGugz9cAek+Pm9GL6En0JnoUvRpWCEIJAAIWhPNnjqN2WlY3bGzakQAJ9JEAehM9il5Fz4ZJHUoACsr5HcdWG/g5AGGQ0oYE0iUQLZoS6FX0bBi/QAHA9xWmWdjJ5g+DkzYkkAcCSpi6Z9G7QdUECkBRmHN4aREUiOskQAL5IYCeRe8GVeQrAPjvBatr3RoUhOskQAL5I4DeRQ/7VeYrAJuKVkUpp+IXgGskQALZEUgSGb2LHvaL4SsAlXJJamcM/cA7CZDAkBGQ13rYs2xfAYBX4k8cQBAOEiCBvhMI07uBAtD3qpmQBEigbwQoAH1DzUQkEI1AP6wpAP2gzBwkkFMCFICcnhiWRQL9IEAB6Adl5iCBnBKgAOT0xLCsbAhIKYVhmkIK2ZRSvusOfWyYek5KkfQmpRSmWRD6tiKkvBh3rPETYgUxpUxen65rzZ0CsAYHn4wygUqtrrenXpNK3CWM0g5TKXfg2J0T6rWrNtosxr1SrQmh1NcL5eJHbcfYUSsVUxmIhZiI7eaIUZuXCwXAiwznR4aAYRiiUCi+2W6+t3N5fu5XzxybObd8bP9bLy3MXcDA8RnM6TXYwBY+IsJNSvm9K81LH19emLv3hSenz7+6ePg7pxoHLqYxEAsxERs5kCtCab6mFABfPFwcBQKGYb5Z3iTufPn40T8N2g9sYAufINvVdW0rludnt31+8egbq3NZPSIHciFnGjkoAGlQZIzcEsBL+p7V+vTSwYPNsEXCFj7wDfSRsist8YFAuwgGYUzdnDp3GFs/GwqAHx2uDTUB/VJZtFvN1/BVPepG4ANfxPD2VaJcLn/zzImZt71tsllBTuTWbzokSkABSISPznkmIPX3/qY0F+LWCF/E8PIvFEqi2+n8ttd61vPIjRqS5KEAJKFH31wTULbTdETh+3GLhC9iePmXKlVRbpV/z2s963nkRg1J8lAAktCjb74JSNE2nU47bpGur47h5V8slcTp04+3vNbjzEfxQe5iqRTF5SdsKQA/gYQTJDA+BCgA43Oux2+nSlRsoxz7E61cXx3DC5zV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61Hno9ojN2qI6ne9PQXgeho8HikCSunX79X6rj2Hn/nZqBuDT0X7Ioa3rxSdTufuqUOL27xtsllBTuQWItkvCFEABG+jTKC90hSFYvV3D5w8id8ECrVV2MIHvoEOSpVUUXw30C5lAzenzp00LAUgKUH6556A49jbO5fEn+OrelCxsIEtfIJsV9e1rZicW3j74ZlnPrY6l9UjciAXcqaRgwKQBkXGyDUBR78X0OtZ2yv1zecm5+b/YOrI4s7JI6du3zc7fzMGjt05vQYb2MInyqb0twrv31Df9BeTs/Nfe+zZ0zt2zxz/oNff9F9v3m8OsRATsZEDuaLU5mdLAfCjw7WRInD1Jb3cpaR4XTjd87aU7sCxOyfkrqs28bbdbq0IIeU9vY71LdNwzq90rVQGYiEmYrs5RHo3CkB6LBlpCAjor57CsW2hhKrr463u0MfunH7TMOkWdDxh2z2EqQmlJlIZQtQQE7EROM1BAUiTJmORwJARoAAM2QljuaNHYJA7ogAMkj5zk8CACVAABnwCmJ4EBkmAAjBI+sxNAgMmECgAyX7QcMC7Y3oSyDmBLMsL07u+AtDudJUuEEM/8E4CJDBkBNS1HvYs21cALlnFtpRG7E9U8czKBRIggcwJoHfRw36JfAXgplwr6AAAEABJREFUS0sHm8VSMfZnqvkl5hoJkEC2BNC76GG/LL4CAEdL2PPFYrLPHUMcDhIggbUEsnyGnkXvBuUIFICzTx38qm33zgkR5i0FwRsJkMDACUj8OPI59G5QKYECgAA9afy6YcorgiIgeCOBfBOQAr2KnhUhbqEE4JXnDr3ZE8bPGIY8h5cWIeLShARIoM8E0JvoUfQqejZM+lACgEAIePbY4btsU+0qV6rnDMN8S0p5QY+LQkoOMuA1EOEaSKNn0Ht6XEAvoifRm+hR9Cp6NswILQCrwfB9xQtPTd91qWPskErtqJaKO2ocZMBroO/XAHoPPYheRE+iN1f7NOxjZAFYDYz/Xji7MPfuqcaBixxkwGtgMNcAehC9uNqXUR9jC0DURLQnARLIHwEKQP7OCSsacQJ52h4FIE9ng7WQQJ8JUAD6DJzpSCBPBCgAeTobrIUE+kyAAtBn4Ew33gTytvtIAtBoNEp7njzxyb1HTnxhz+x889DCsppbelXNneQgA14Dfb8GdO+hB9GLbk/q3kSPRhGZSALwg27l29K2v6GU/Rs6Se3ypR+LH717UfzohxxkwGug79eA7j30IHoRPYneRI/q56HvoQRgsnHitn1HTyqlnG1KKYEROgMNSYAEMieAnrw6nG3oVfRsmKShBEC1e/+5Z1lh4tGGBEjAg0C/ptGr6Nkw+QIFYM/c8V+u1usfCxOMNiRAAvkggJ5F7wZVEygAxYJ5qrXSDIrDdRIggRwRQM+id4NK8hWA3Y1GTSmnHhSE6yRAAvkjgN5FD/tV5isA2rHWs3o1/cg7CZBAAgKDcL3Wu7796ysAG8UGIQxfk0HsizlJgATCENC96/awjy272wcOl0hg1AlQAEb9DHN/JOBDgALgA4dLJJAGgTzHoADk+eywNhLImAAFIGPADE8CeSZAAcjz2WFtJJAxgSEUACUKhaKobdgkNr9vwh04xpwQ6fwlc8Sq6/hbdHwMHGNOpHIb9vpTgTDAIP3lv2XrhLhJX0dxBnzTv/7Woh8uAZCyW6lU/9i2e591LnZrxw/ulhg4xhzWhLZZu8Vwz6SU2lAqaRj/XdnigUvWxfqCjo+BY8xhTQht49qK6DddG2pEragZtWPgGHNYy3X90XecL49B8D+wW87r6yjOWNC+qV5/65yNoREAwzCF2TM+fPqpx39+eX72i6dPP95a3Q+O3Tm9BhvYrq6FeVRKCbNQeKdgGx9cPnb4b52ZP/ivX200VlZ9cYw5rMEGtvBZXQ/ziJpQ22ldo1vrkNUfZo95thkk/6Rc0rj+vGowvBbyNC+l/N7ZYzPyzImZt4Pqgg1s4RNki3VtJ4ql0jvvXGxuf+nEzP/Tc37fRyjYwBY+8NX2gXdtN9T1B24w5wY54p+UVKzrzy9p7gWgUq0Jy7Z+wW8T663BB77rrV0/p7/4K9F27vr95caV6+f9jl1b7eP6+hnqNdSAWvRhpDt84Bvk5Naga3FrCjK+tu7aah/X99rcqD6AIVhG3R984Bvk5zLULF2mNxhn9dTNpXO6uRMmybUAaOUWndbK1z+/ePSNqPuED3wRw89XGvKb+qv6d/1s1luDD3zXW1udQ27UgFpW58I+wge+iOHngxpQi5/Nemvwge96a6MyB3ZgCJZR9wQf+CKGny8YgqWfTRZryIncSWPnWgDwfVt148b9cTcJX8Tw8sc7+4Yyz+p1v5f9enndu4IvYqy7qieRGzXow1h3+CKGlzNyowa9nkn9Ou5Q38EODONuAr6I4eWfkL9X2LDzgddfmEC5FgD9zvjK5feaf/lmXJgNXW8DX8S4fu7643KlKt7rfv+r189FOYYvYnj5IDdq8FoPmocvYnjZITdq8FoPmocvYgTZDes62IFh3Prhixhe/mAHhl7rWc8jN2pIkifXAqD/S2xlY7UQWwBcXyk9/fUbeeJLS0uxP+4IvojheQJ0brcGTwP/BddXx/CyQm7U4LUeNA9fxAiyG9p1zc5lGHMDrq+O4eUOdmC43no/5pAbNSTJlW8BSLIz+pIACQQSyLcAKFW73Ir/iUSur47hRcHqdsUDBw7UvdaD5uGLGJ52Ordbg6eB/4Lrq2N4WSE3avBaD5qHL2IE2Q3tumbnMoy5AddXx/ByBzsw9FrPeh65UUOSPLkWANMs1DZurvt+pJHf5uGLGF42nXZLbC7dep/XetA8fBHDyw65UYPXetA8fBHDyw65UYPXetA8fBEjyG5Y18EODOPWD1/E8PIHOzD0Ws96HrlRQ5I8uRYAx7FF6/LlU3E3CF/E8PLv9SzhSHuvXsfPAeuHSHcJX8Tw8kJu1OC1HjQPX8TwskNu1KDXM6lfxx3qO9iBYdxNwBcxvPy9+HvZpzwfeP2FyZdrAcCP25artXsennkm8t8lgA98EcMPhHLU3fsOLX7Az2a9NfjAd7211TnkRg2oZXUu7CN84IsYfj6oAbX42ay3Bh/4rrc2KnNgB4ZgGXVP8IEvYvj5giFY+tlksYacyJ00dq4FAJtrt1ZE0Sz+JxxHGfCBb5CPlEKKivH6/ZONDUG2q+uurfZxfVcnPR5RA2rxWPachg98PQ2uLbg16Frcmq7NBT24ttrH9Q0yHvJ1MATLqNuAD3yD/FyGmqXLNMg4pXU3l87p5k4YM/cCgP1pFX7/3iOLaurQ4jY89xuwgS18/OxW17Sd0G+k3HbbRP1Nrap/Rc9LPbzuEjawhQ98vQyvn9d2Q13/9XsZxuMc8U+KL9b155d0KAQAG3D0+wF2wfn29NPPf2NybuE3pqefr2IeA8funF6DDWwxH3ZIKYXd693WM53vTB45/idTcyc/c/0fVMAx5rAGG9hK6acTP5kZNaG2aV3j5BDW/5M7Gq6ZfvHHNTJ1w/WTlFQa159XDUMjAO4GlCq1261P6ndmv2BMlFYOn3xVYeAYc1gT2sa1jfiP/iqhPZRUjvNz0hRf2lScaM7q+Bg4xhzWhNA2Ks5P3iL8kNevtzDUd31t4BoxzUL/rp+lV9Wcvo7ijFntm+r1t87JGy4BcDcgBd59XblySbz3w4vuwDHmhP52XqRwQ6ymjv9jHR8Dx5hLIbQOMez16y0M9b3P/N+9KH6kr6M448faN/3rb+3JG0IBWLsBPiMBEohPgAIQnx09SWANgWF8QgEYxrPGmkkgJQIUgJRAMgwJDCMBCsAwnjXWTAIpEaAApASSYcabwLDu3lcALosrQjjOsO6NdZPAeBPQvev2sA8FXwHQfiuFYsHzE3X0Ou8kQAI5JXCtd33711cA8AcJpDRif2RWTrmwLBIYCwLoXfSw32Z9BQCOVs/eX63F/tAchOAggZEmkMfNoWfRu0G1BQrAy/OH/0Or2Yz8ufxBiblOAiSQHQH0LHo3KEOgACCArBT+fqFYxCEHCZBAzgmgV9GzYcoMJQDLjUPvvPTMQam/p3hb/yMwwgSnDQmQQH8IoCevDuNt9Cp6NkzmUAKwGuiWUvvDyjR/Xkrzi3puZeOmLeKmBH//PM7fTKfPhCCD/DAY6LnQvYceRC+iJ9Gb6FH9PPQ9kgA0Go3uy88e+uOzxw599uWFufqJ2Uk5f2C3nD/IQQa8Bvp+DejeQw+iF92e1L2JHg3d/dowkgBoe95JgARGiAAFYIROJrdCAlEJUACiEqM9CVwjMAoPFIBROIvcAwnEJEABiAmObiQwCgQoAKNwFrkHEohJILYAPHDgZH3v7PzW/Y2lCQ4yGLdrIC/7RQ+iF2P2v4gsAHufPnnfY0+ffn1T2TmvpDzf6lrnVzjIgNdA368B9B56EL2InkRvRhWC0ALwyBMntu89cvx105avddqtnY5j366UulmPCaEUBxnwGujzNYDe0+Nm9CJ6Er2JHkWvhhWCUAKAgAXh/JnjqJ2W1Q0bm3YkQAJ9JIDeRI+iV9GzYVKHEoCCcn7HsdUGIWL+SawwldCGBIaEQL7LVAK9ip4NU2egAOD7CtMs7GTzh8FJGxLIAwElTN2z6N2gagIFoCjMOby0CArEdRIggfwQQM+id4Mq8hUA/PeC1bVuDQrCdRIggfwRQO+ih/0q8xWATUWropRT8QvANRIYJwLDtFf0LnrYr2ZfAaiUS1I7Y+gH3kmABIaMgLzWw55l+woAvPi+PyhwkMDwEQjTu4ECMHzbZsUkQAJhCVAAwpKi3dgTGEUAFIBRPKvcEwmEJEABCAmKZiQwigQoAKN4VrknEghJgAIQEhTNRoMA/niGYZpCCtnUx++6Qx8bpp6T0nOTYReklMI0C0LfVoSUF1MZQqwgppTJ69N1rblTANbg4JNRJlCp1fX21GtSibuEUdphKuUOHLtzQr121UabxbhXqjUhlPp6oVz8qO0YO2qlYioDsRATsd0cMWrzcqEAeJHh/MgQMAxDFArFN9vN93Yuz8/96pljM+eWj+1/66WFuQsYOD6DOb0GG9jCR0S4SSm/d6V56ePLC3P3vvDk9PlXFw9/51TjwMU0BmIhJmIjB3JFKM3XlALgi4eLo0DAMMw3y5vEnS8fP/qnQfuBDWzhE2S7uq5txfL87LbPLx7N/K9oIwdyIedq/iSPFIAk9OibewJ4Sd+zWp9eOniwGbZY2MIHvvDxHVJ2pSU+4GuTwaKbU+dOGpoCkJQg/XNLQL9UFu1W8zV8VY9aJHzgixjevkqUy+Vvnjkx87a3TTYryInc+k2HRAkoAInw0TnPBKT+3t+U5kLcGuGLGF7+hUJJdDud3/Zaz3oeuVFDkjwUgCT06JtrAsp2mo4ofD9ukfBFDC//UqUqyq3y73mtZz2P3KghSR4KQBJ69M03ASnaptNpxy0SvkLH8PIvlkri9OnHW17rWc8jd7FUSpSGApAIH51JYLgJUACG+/yxej8CSlRsoxz7E61cXx3DK4XV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61nPIzdqSJKHApCEHn1zTUAp/fq9Wt+15/AzPxu1UPhUtC9iePtK0el07p46tLjN2yabFeREbqHfpRQJbhSABPDomn8C7ZWmKBSrv3vg5En8JlCogmELH/gGOihVUkXx3UC7lA3cnDp30rAUgKQE6Z97Ao5jb+9cEn+Or+pBxcIGtvAJsl1d17Zicm7h7YdnnvnY6lxWj8iBXMiZRg4KQBoUGSPXBBz9XkCvZ22v1Defm5yb/4OpI4s7J4+cun3f7PzNGDh25/QabGALnyib0t8qvH9DfdNfTM7Of+2xZ0/v2D1z/IP7G0sTaQzEQkzERg7kilKbny0FwI8O10aKwNWX9HKXkuJ14XTP21K6A8funJC7rtrE23a7tSKElPf0Ota3TMM5v9K1UhmIhZiI7eYQ6d0oAOmxZKQhIKC/egrHtoUSqq6Pt7pDH7tz+k3DpFvQ8YRt9xCmJpSaSGUIUUNMxKXOUcQAAAHhSURBVEbgNAcFIE2ajEUCQ0aAAjBkJ4zlZk9gnDJQAMbpbHOvJHADAQrADUD4lATGiQAFYJzONvdKAjcQCBSA9D+J/IYK+JQEckRglEoJ07u+AtDudJUGgqEfeCcBEhgyAupaD3uW7SsAl6xiW0oj9ieqeGblAgmQQOYE0LvoYb9EvgLwpaWDzWKpGPsz1fwSc40ESCBbAuhd9LBfFl8BgKMl7PliMdnnjiEOBwnkncAo1YeeRe8G7SlQAM4+dfCrtt07J0SYtxQEbyRAAgMnIPHjyOfQu0GlBAoAAvSk8euGKa8IioDgjQTyTUAK9Cp6VoS4hRKAV5479GZPGD9jGPIcXlqEiEsTEiCBPhNAb6JH0avo2TDpQwkAAiHg2WOH77JNtatcqZ4zDPMtKeUFPdL5G+hp/S11xuH5iHENiCH0Qe/pcQG9iJ5Eb6JH0avo2TAjtACsBsP3FS88NX3XpY6xQyq1o1oq7qhxkAGvgb5fA+g99CB6ET2J3lzt07CPkQVgNTD+e+Hswty7pxoHLnKQAa+BwVwD6EH04mpfRn2MLQBRE9GeBEggfwQoAPk7J6yozwTGOR0FYJzPPvc+9gQoAGN/CRDAOBOgAIzz2efex54ABWDsL4HxBjDuu///AAAA//8pEgg1AAAABklEQVQDANTsRLN50QRTAAAAAElFTkSuQmCC" preserveAspectRatio="none"/><filter id="a" filterUnits="objectBoundingBox" x="-.05" y="-.03" width="1.09" height="1.09"><feOffset result="offOut" in="SourceAlpha" dy="2"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="3"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="J"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="K"/><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="L"/><g id="b"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#L"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="M"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="N"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="O"/><path fill="#697986" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="P"/><path fill="#697986" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="Q"/><g id="c"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.04,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.30222222222222,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.49333333333333,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.995555555555555,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,52.257777777777775,0)" xlink:href="#Q"/></g><pattern id="d" patternUnits="userSpaceOnUse" x="312.92" y="-265.43" width="76.8" height="76.8"><use xlink:href="#R" transform="translate(0, 0) scale(7.68,7.68)"/></pattern><path fill="#6f7681" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="S"/><path fill="#6f7681" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="T"/><path fill="#6f7681" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="U"/><g id="e"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#U"/></g><path fill="#6f7681" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="V"/><path fill="#6f7681" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="W"/><path fill="#6f7681" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="X"/><path fill="#6f7681" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="Y"/><path fill="#6f7681" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="Z"/><path fill="#6f7681" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="aa"/><path fill="#6f7681" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ab"/><path fill="#6f7681" d="M638 15c-134 0-208-58-269-132-10 52-5 117-71 117H135v-1486h247v586c77-79 169-142 318-142 277 0 379 230 379 521 0 241-97 412-259 495-54 27-115 41-182 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 61 104 93 199 93 187 0 243-152 243-348" id="ac"/><path fill="#6f7681" d="M395-1486V0H148v-1486h247" id="ad"/><g id="f"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,5.333333333333333,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.871111111111112,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,21.75111111111111,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.01333333333334,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,38.51555555555556,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,47.82222222222222,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,62.791111111111114,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,72.09777777777778,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,82.2311111111111,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,87.04888888888888,0)" xlink:href="#Z"/></g><path fill="#6f7681" d="M1366 0h-271v-632H417V0H146v-1446h271v622h678v-622h271V0" id="ae"/><path fill="#6f7681" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="af"/><path fill="#6f7681" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="ag"/><g id="g"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,13.44,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.017777777777777,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.595555555555556,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,45.70666666666666,0)" xlink:href="#ag"/></g><filter id="h" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="ah"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="ai"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="aj"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="ak"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="al"/><g id="i"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#al"/></g><path fill="#697986" d="M375-529L38-1026h238c37 0 48 9 63 32l215 343c8-25 17-47 31-68l173-270c15-21 26-37 57-37h227L704-540 1056 0H818c-37 1-57-23-71-46L529-403c-6 24-14 44-25 60L312-46c-14 20-33 47-67 46H24" id="am"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="an"/><g id="j"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.373333333333328,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.94666666666666,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,37.54666666666665,0)" xlink:href="#an"/></g><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="ao"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="ap"/><g id="k"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#N"/></g><pattern id="l" patternUnits="userSpaceOnUse" x="-258.03" y="-272.39" width="88.84" height="91.9"><use xlink:href="#aq" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ar"/><g id="m"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,6.879999999999997,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.648888888888884,0)" xlink:href="#ar"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="as"/><g id="n"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.968888888888882,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.44888888888888,0)" xlink:href="#aj"/></g><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="at"/><g id="o"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.479999999999997,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.58666666666666,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.69333333333332,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,38.79999999999998,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.3022222222222,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,56.782222222222195,0)" xlink:href="#al"/></g><path fill="#6f7681" d="M415-222h579V0H146v-1446h269v1224" id="au"/><g id="p"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.96888888888889,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,25.546666666666667,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.73777777777778,0)" xlink:href="#W"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="av"/><path fill="#697986" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="aw"/><g id="q"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.72888888888888,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.608888888888877,0)" xlink:href="#ar"/></g><pattern id="r" patternUnits="userSpaceOnUse" x="-258.03" y="47.61" width="88.84" height="91.9"><use xlink:href="#aq" transform="translate(-1.531668989976481, 7.105427357601002e-15) scale(9.190013939858911,9.190013939858911)"/></pattern><g id="s"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.675555555555547,0)" xlink:href="#aj"/></g><path fill="#6f7681" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="ax"/><path fill="#6f7681" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="ay"/><path fill="#6f7681" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="az"/><g id="t"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,11.644444444444444,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.85333333333333,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.044444444444444,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.54666666666667,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,46.80888888888889,0)" xlink:href="#az"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,54.577777777777776,0)" xlink:href="#Z"/></g><path fill="#6f7681" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="aA"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aB"/><g id="u"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.155555555555555,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.26222222222222,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.36888888888889,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.47555555555556,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.977777777777774,0)" xlink:href="#ad"/></g><pattern id="v" patternUnits="userSpaceOnUse" x="28.43" y="-272.39" width="88.84" height="91.9"><use xlink:href="#aq" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="aC"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aD"/><path fill="#6f7681" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="aE"/><path fill="#6f7681" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="aF"/><g id="w"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,12.622222222222222,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.72888888888889,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.608888888888888,0)" xlink:href="#aD"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.715555555555554,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.217777777777776,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.324444444444445,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,66.20444444444445,0)" xlink:href="#aE"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,71.02222222222223,0)" xlink:href="#aF"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.50222222222222,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,88.8088888888889,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,95.68888888888891,0)" xlink:href="#Z"/></g><g id="x"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.106666666666667,0)" xlink:href="#az"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,17.875555555555557,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,27.377777777777784,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.64,0)" xlink:href="#az"/></g><filter id="y" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><g id="z"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.533333333333328,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.453333333333322,0)" xlink:href="#L"/></g><g id="A"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.737777777777772,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,21.55555555555555,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.05777777777777,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.16444444444443,0)" xlink:href="#al"/></g><path fill="#697986" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="aG"/><path fill="#697986" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="aH"/><path fill="#697986" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="aI"/><g id="B"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.115555555555538,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.933333333333316,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,44.71999999999998,0)" xlink:href="#aI"/></g><path fill="#697986" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="aJ"/><g id="C"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,4.817777777777776,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.924444444444438,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.404444444444437,0)" xlink:href="#aJ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.7111111111111,0)" xlink:href="#ai"/></g><g id="D"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.05333333333333,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,17.315555555555548,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.88888888888888,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.48888888888887,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.30666666666665,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,50.80888888888888,0)" xlink:href="#Q"/></g><path fill="#697986" d="M221-3C132-8 80-62 80-152c0-85 58-133 145-135 137-3 173 141 135 270-37 126-112 227-205 301-28-24-89-65-42-112 45-45 92-100 108-175" id="aK"/><g id="E"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.21333333333333,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#ar"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.088888888888874,0)" xlink:href="#aK"/></g><g id="F"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#al"/></g><g id="G"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.026666666666657,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.13333333333332,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.23999999999998,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.742222222222196,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.22222222222219,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,67.1022222222222,0)" xlink:href="#aI"/></g><path fill="#697986" d="M638 15c-134 0-208-58-269-132-10 52-5 117-71 117H135v-1486h247v586c77-79 169-142 318-142 277 0 379 230 379 521 0 241-97 412-259 495-54 27-115 41-182 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 61 104 93 199 93 187 0 243-152 243-348" id="aL"/><g id="H"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.244444444444433,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.746666666666655,0)" xlink:href="#aJ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,46.05333333333332,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,61.022222222222204,0)" xlink:href="#aJ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,70.32888888888887,0)" xlink:href="#aL"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,80.4622222222222,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,85.27999999999997,0)" xlink:href="#N"/></g><path fill="#697986" d="M1366 0h-271v-632H417V0H146v-1446h271v622h678v-622h271V0" id="aM"/><g id="I"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aM"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.439999999999994,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,24.017777777777763,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.59555555555554,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,45.70666666666665,0)" xlink:href="#aI"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/mcp-access/architecture-sse.svg b/docs/img/mcp-access/architecture-sse.svg
new file mode 100644
index 0000000000000..270a45f4392c8
--- /dev/null
+++ b/docs/img/mcp-access/architecture-sse.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1264.83" height="503.25"><g transform="translate(1212.3741262626959 18.41931416343141)" lucid:page-tab-id="vEfyK7~VCnsd"><path d="M-1500-500H500V500h-2000z" fill="#fff"/><path d="M-79.05-13.42a3 3 0 0 1 3-3h122a3 3 0 0 1 3 3v120.88a3 3 0 0 1-3 3h-122a3 3 0 0 1-3-3z" stroke="#becacf" fill="#fff" filter="url(#a)"/><path d="M-79.05 129.15a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v16.76a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-79.04613163749195,123.1520541267987) translate(12.488888888888894 21.380000000000003)"/><use xlink:href="#c" transform="matrix(1,0,0,1,-79.04613163749195,123.1520541267987) translate(55.48444444444445 21.380000000000003)"/><path d="M-53.45 8.62h76.8v76.8h-76.8z" fill="url(#d)"/><path d="M-235.5 43.58h137.45M-235.5 43.58h-1" stroke="#697986" stroke-width="2" fill="none"/><path d="M-82.78 43.58l-14.27 4.64v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#e" transform="matrix(1,0,0,1,-177.98813344140544,47.580685836568136) translate(0.18277777777777615 17.546666666666667)"/><use xlink:href="#f" transform="matrix(1,0,0,1,-177.98813344140544,47.580685836568136) translate(0.004999999999999005 38.879999999999995)"/><path d="M-631.63-10.42a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-631.63 129.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#h" transform="matrix(1,0,0,1,-631.6260859481588,123.58068583645218) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#i" transform="matrix(1,0,0,1,-631.6260859481588,123.58068583645218) translate(9.475555555555573 38.87999999999998)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-631.6260859481588,123.58068583645218) translate(59.937777777777775 38.87999999999998)"/><path d="M-613.16 7.66a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#k)"/><path d="M-345.16-10.42a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-345.16 128.5a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#l" transform="matrix(1,0,0,1,-345.1620886355995,122.49469913551275) translate(12.475555555555573 17.54666666666666)"/><use xlink:href="#m" transform="matrix(1,0,0,1,-345.1620886355995,122.49469913551275) translate(82.79555555555555 17.54666666666666)"/><use xlink:href="#n" transform="matrix(1,0,0,1,-345.1620886355995,122.49469913551275) translate(34.70666666666668 38.87999999999998)"/><path d="M-347.16 47.58h-137.96" stroke="#697986" stroke-width="2" fill="none"/><path d="M-346.16 48.56h-1.03V46.6h1.04z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-500.4 47.58l14.28-4.63v9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#o" transform="matrix(1,0,0,1,-456.93406229187946,51.580685836568605) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#p" transform="matrix(1,0,0,1,-456.93406229187946,51.580685836568605) translate(5.147222222222222 38.879999999999995)"/><path d="M-326.7 7.66a6 6 0 0 1 6-6h76.84a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#q)"/><path d="M-631.63 309.5a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-631.63 449.5a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#h" transform="matrix(1,0,0,1,-631.6260859481588,443.4996989917695) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#r" transform="matrix(1,0,0,1,-631.6260859481588,443.4996989917695) translate(13.133333333333354 38.87999999999998)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-631.6260859481588,443.4996989917695) translate(56.28 38.87999999999998)"/><path d="M-613.16 327.58a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#s)"/><path d="M-461.65 361.54l-.08 1.05-.26 1.06-.4 1-.58.94-.7.83-.84.7-.94.6-1 .4-1.08.26-1.05.08h-15.52v-1.96h15.46l.82-.06.77-.18.72-.3.68-.42.6-.5.5-.6.42-.68.3-.73.18-.76.07-.84V248.83h1.95zm-5.9-274.93l1.08.26 1 .42.95.57.83.72.72.83.57.93.4 1 .27 1.08.08 1.06v112.7h-1.95V93.55l-.07-.83-.18-.75-.3-.73-.4-.67-.52-.6-.6-.5-.68-.42-.72-.3-.77-.2-.82-.06h-32.97v-1.94h33.04z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-501.6 88.47h-1.03v-1.94h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-485.12 372.13l-14.27-4.63 14.28-4.64z" fill="#697986"/><path d="M-484.15 373.48l-18.4-5.98 18.4-5.98zm-12.1-5.98l10.15 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#t" transform="matrix(1,0,0,1,-515.2216915037143,206.1663830436169) translate(0 17.546666666666667)"/><use xlink:href="#u" transform="matrix(1,0,0,1,-515.2216915037143,206.1663830436169) translate(31.39611111111112 38.879999999999995)"/><path d="M-911-10.42a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-929.16 129.58a6 6 0 0 1 6-6h152.3a6 6 0 0 1 6 6v16.33a6 6 0 0 1-6 6h-152.3a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#v" transform="matrix(1,0,0,1,-929.1601990056936,123.58068583664817) translate(18.108888888888913 21.379999999999995)"/><use xlink:href="#w" transform="matrix(1,0,0,1,-929.1601990056936,123.58068583664817) translate(46.295555555555566 21.379999999999995)"/><use xlink:href="#x" transform="matrix(1,0,0,1,-929.1601990056936,123.58068583664817) translate(83.22888888888889 21.379999999999995)"/><path d="M-819.1 19.4h-54.86c-3.06 0-5.72 2.65-5.72 5.75V68.5c0 3.33 2.46 5.76 5.52 5.76l25.44.44h29.9c3.06 0 5.72-2.65 5.72-5.75v-43.8c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.2l-11.1 7.75c-1.07.66-2.4.44-3.07-.44-.66-1.1-.46-2.43.47-3.1l8.4-5.96-8.4-5.98c-1.13-.66-1.33-2-.47-3.1.67-1.1 2-1.32 3.06-.43l11.1 7.74c.68.44.88 1.1.88 1.77 0 .66-.47 1.32-.87 1.77zm23 10.4h-17.73c-1.33 0-2.2-.88-2.2-2.2 0-1.33.87-2.22 2.2-2.22h17.72c1.32 0 2.18.9 2.18 2.2 0 1.34-.86 2.22-2.2 2.22z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M-781 47.58h130.87" stroke="#697986" stroke-width="2" fill="none"/><path d="M-780.98 48.56H-782V46.6h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-634.86 47.58l-14.27 4.64v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><g><use xlink:href="#y" transform="matrix(1,0,0,1,-728.9554212121942,51.58068583668501) translate(0.004999999999999005 17.546666666666667)"/></g><g filter="url(#z)"><path d="M-1206.37-10.42a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M-1206.37 129.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#A" transform="matrix(1,0,0,1,-1206.3741262626959,123.58068583656859) translate(18.480000000000018 17.54666666666666)"/><use xlink:href="#B" transform="matrix(1,0,0,1,-1206.3741262626959,123.58068583656859) translate(61.47555555555556 17.54666666666666)"/><use xlink:href="#C" transform="matrix(1,0,0,1,-1206.3741262626959,123.58068583656859) translate(38.97333333333334 38.87999999999998)"/></g><path d="M-1127.1 33.34c0 8.55-6.9 15.43-15.4 15.43s-15.45-6.88-15.45-15.43c0-8.54 6.94-15.42 15.45-15.42 8.5 0 15.4 6.88 15.4 15.42zM-1169.8 72.5c0-10.5 8.5-19 19-19h14.2c10.5 0 19 8.5 19 19 0 2.6-2.14 4.74-4.75 4.74h-42.7c-2.6 0-4.75-2.13-4.75-4.74z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-1076.37 47.58h145.86" stroke="#697986" stroke-width="2" fill="none"/><path d="M-1076.35 48.56h-1.02V46.6h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-915.25 47.58l-14.26 4.64v-9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><defs><image width="10" height="10" id="ac" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9B4AcxZX2e9U9MzsblEUwYLAQSUg7MxskES18TtggaWe1wmBj+87pHHA8+xz+M7J99tk+n/EZ53CHExjt7qwAA8bhCAYkbZqZlRA52GCCctg0M91V/3uzEkgbZ2Y7zOx0bfd2d3XVe9/7qup1dVV3jwAvlCwDLUvuro7WJk9uru8+e03t5hVvq3vqoivqtkWbwp3/Eg1v/cG6SPIXzeGuO6Lhzs6m0NZHaH2O1n20DkZDnSnaSl4P7w82hTrp3BZO8wjn4bwsI0qyWCbLZh1rSBfrZN0thKFkCfSAg+cASqgSNIe3vKUlnPz3taHN265seOJZ5Z/9tMLhHcow4wLF5ozcd19GptpR4X8qhR80ZeqdUqlLlVKNZOZZtJ5E6xxagwqUn7bI6+H9IICic8hpzuI8nJdlsCyWybJZB+tinVndhIGxMCbGxhhJpreUCAOeAyjOgsL1dQ+tXxeOf7U50vMnukJnrmp4Wgmsvl2C+QUEbelwZvfJpsosAIAaBVBBW5TKAKVMUCDpkGJpjxo17Re6vCKDZbJs1kHSkM6wzhqTMDAWJEySsDFGxsqYGXtLOP7v68IPtYAXipIBzwEUWbE01XYtXV/3sMyYh242VfrzUhr/oEDpQ5mdYMgBkCpDiKn5AV+8abcoFsaistgYI2NVhJmxGyr9BVMd2kg2qdW1XdwLKQrEHggA5sBzAMxCkax8P61p/s0Z8wAh4kZFmxmxILBNfuHvurr2rqoZYdIMMcJzAEVUkKa/eouUqWooqqs7WBSQegipmgGcv9UigZ4YCxjwHIAFJFoh4tLIHQsRfUuo62yFuKKUwbYh6kuaah84rigBliEozwEUSaHPwpNON+VwkaCxD4ZUw6CJWYvt0+BJzoWBI2k8B3CECZe3UvnOQEB0GYYD6hE11DwH4ADTuajwHEAuLDmQxlSpsx1QUxQqMjC8pCiAeCC8B4GKpQ4gqPOLBYvtOJRaabsOT0FODHg9gJxosj+RArnKfi3FoQEBX1scSMoTxdFWew7gaDZc2l912v9WVOjzXNLuvNqAPhsuOOuWGuc1expHM+A5gNGMuHA8f07dFWnzkAua3VHJtp5c9Zp17mj3tB7NgOcAjmbDpX0JqejII74uAXBYrVQGpOWg936Aw7yPp85zAOOx4nCcD6vrFTUKh9W6po5t9YlZta4BKGPFo033HMBoRhw+bjnvoXmmHAgCIJRPQDDMwcrL67v5bcbyMbsILfUcgMuFIvuHjqMZgEqXYTiunm3WFS50XLGn8BgGPAdwDB3OH0g/LAAU/G6988pd1IgoAqh8ngNwsQxYtecAmAUXV82EldnvdriIwRXVSgHKdPk8/OQKyccqHe/IcwDjseJgnAR4oypDD8A2K4Q3Oki1p2ocBjwHMA4pTkYJ0N8AZegA2GYNA5eAF1xlwHMALtK/+qz7a/z6LBcRuKta16pgbfjuOe6iKG/tngNwsfwDwarL09nPf7kIwkXVGeMAaGLuZS5CKBvVExnqOYCJmHEgPgPDb5XScEBTcargJwJNc+jy4kRXHqg8B+BiOVdo8xcpMF1E4K5qtr1Cn/9qd1GUt3bPAbhU/lfXJqtSxv4TAMrpCUAYFRBSxsETmItRJ7xDhxjwHIBDRI9WM6yZlQjKexAGzOOYi9H8eMfWMTCZJM8BTMaOneeEP6iJYNl/I18XwUogLuyk2pM9MQOeA5iYG1vPmGb/ZeX0CvBEZDIHGbO/aaLzXry9DHgOwF5+J5QuIHCpUuU7AHiEGKUkaOi79Mixt3WWAc8BOMv3y9qo+38ZPw77ckSZ7iiQ4MOaN5Wp+babPZUCzwFMxZAN59+05PfzENEGyaUpkp1AS+Q+b0DUheLzHIALpM/2v3ol3fe6oLk4VRpyABDneZ8Kd6F4PAfgAukmDF0ivfv/l5lnLkyVLpvPor9seBHseA7AhULQReAUoHtfF1QXqUoeCPQTJ0UKr0Rh5QLbcwC5sGRhmg2wQaTl0FkACF44wgCCIYfP3ADKq49HKHFo6xHuENFH1DwESxCVOuPIsbcdYUApeeZD0Op5xRE6HPvvOQDHqB5RJCOL3y9ERdXIkff/CAO6qAiatYs+cOTY2zrDgOcAHOD5bY3bTlkX6v63lrptCpT6gSmHHNBaWioM4gSF+P66SFJFw1s/H61NnlxaFhQX2lzReA4gV6YKSLcmsvn1V9Q93JtKDz4uEb5smIMgy+gHQPKljB8LNuUwZdO+qnD4sbfVPbxlTWTLEorwFpsY8ByAxcS+e9XTFU2hzmhT7da/BcScP6bNAxFSEfAe+yUWclwOcxVMmQdWVGoLH4qGOnvXLuu6tKVlo5ajCC9Zjgy46gBWL72/YV24JxYNbX2GGk1sde39NDqeI/IiTBaNJN9zcN/ugwStHRBOyRi8641rER8FLgjDmd1A900RFPJ28/FFe5pqO99coLCiyLb6rN5XUV1vpwvE7mi4+3drw51hN4G55gBaIslfVvjndklQTQrwVETRVOlb+EhTaOuudXV932gOd73FTWLy0R2NdL2HCvMJIvNnCqQPqMrmk99LmxMDNHlizvbplXdGIz2bo6GeknmDMBrpfX1L5KEv0YXuucrq6r9TXY8Cwnyy+q1+URlfF07+lPYtW/IRRHU2n+RWpFViXaRvEw36XJ0x+2lMjN+IU9ltytjPChaY5tBnpJK3t9RtV83hnh9fXXtX1QYovjni1Ut6FkdDXUNKqp8pZZ4+cv/KJnirXQxkzAFQ0lgJKGPN4fij9fU/Jodrl7bC5G6ADWLVqrt1wvftKyIPm0pm/mjI/i8qgJNSxj6gupIVzFu2x1RD722uS3TQhcPx9ui4wuZw4ocAcg2QC4QpgsGFDer9Kf2k/mSoq299Xd/3onXJlVNks/302qXdp7fUbb/FH9AfVyArwLvi2875aAVKSRpQzZx5mrk83RTqvrml/snZo9M4fdwc6W1YX7fj28nQW3oXHlyYAZCfSMuDObQxBFSwdl2493qnMecAzjpITeHOf5Eq/X5TpnIWesRLAqhzM+bQh4VSm9dFEgPRcM/Hm2qTx126+I5AzsKmmfD99d2+pmWd7/P7g08YZv9qU/KI9TSFetmnwQC5X5Wm/MZ6JQ/tj4bjF/CVlyIcWVqWbPe3RHoXRpduvmZdJLlPgNaVMQ99gupqyKCLl8xjxsekNmEq40N0C/xJR8AfVuKYA4hGOi8WoP8nTDNkiZKpSgS4DkTq75XVJ8TJ814fPee+E6cpetLszfXJFXukeEJovp9k6NYFcujBgBccYgCB64VAcf+8fdXb3rKk8wQ7FbdE7lu4LpL4lvSn44Y0nkPd/11TDs8xLLggCPT919pQYnmh+PPN54gDiNZuOVnHyntNlaHboHwhjp9esndVSpcqc45S8iOBqpOep65gX3Oo5x0tdT2Lx8+Vf+zVtcmq5kj3FzWlbZEyc4rMXnHyl+PlsJ8BaoSgwDx7VnDOC9FQ1wesHB+INvQtao50Xdkc7urStZN2SmV8SqrMEgDlp33LjDOpjfg1fevqyP2vskzoJIIccQCIejJDXSK6atMyCZoCT/FtAk8XAZjLFKpfGWamjzw0zSbEP1OgyGy2prP/NH9QmI8qBV/KEH6KtAU/yfUWyxhA4IE2EvejReqCHW8kB077BS/r6uIfp3vzXSoztE0pvFEq2cB1Tdn0OjdVMOS6pquKRMGg88hoswNQGA133UONcl4emKaVdKRgMEhXgwWg4BtXNjylouHu25vCPe9bG46flqvwdXV9H6ioOm03efmTRmTmmtNLVwwM0OgA0H344jm63r++7qH1hzFR+zq8N8FmzdLOU6K1W98bjfTccmXDEwoUXmeq9AJKXulwPVgYDXf9kXoYU2ImbAUvtjqAdaHeJgTttYpGbMHxgHRfmIbhzC6ggnsLKOMnGsgnaS62P1rbtXoyOET8M6Y5/KNhY89kybxzJcBAhsZrDDl4M5VpkuBOeAvKDxg1hbbu03X9GYXwUyWN1cOZPVSHeMDa1jZIsMYuVGcBQXt9c23fZZBjKCSZbQ5gTe3WizStsp2uoIXgsiWPVIagGlCl68FbmkJdal1dcmNT7eaPrjrtfytYYXOkt6E53PusUupUAErJkSW5jmBH1ECgDzRRAT6tGgL6XAj6FkKl/3haT4QK34LsWuk/kY6Pz57jNJyW83BeRO0wAyMyDx+U1EbxBUip2uZw/Ekataf7doBVqzboTeEtH14X2X7j2tBW6dOr7gTAOVRfBRRJICyg675bm5ZtPc8uSLYY23Leg0FNaL9Km/worF3QC5ebyd7PSzDN4RZA7b9PmH/RUFPtlseQpnGkSp9cao0fAeFwSNN4y6Bfm30Q0fe8kuoWTav8t7QceI9hHDovPfjiq27sXoS/6TqN1lfjTd2nZ9ffdL2ajk9DPpcePPiqTGb/+dR9fi/nVVLeKlB/YUSmxq8x8rwbIP0d1lkSG0UOXarUIgD9IbrSbzux/+oMKPE9Uw5ciQCYoZ5CMZZ72jwEQtN//e5VT2cvUmBxEBbLy4qTQ/47EARdRaEEgqJBoz2AKM4ws9M4VB2KGrWiq7o/e+UWqA0g+lqFVvVPoPBSXVRFNBw47ebec2bHEnUndfQ1rt3Yc/a/35o8/39ifSu3xB6++IWpTIs93PBCx7YLNm/qO//nnLejb/ma9kT9q1imhuJU1gGaTrqC70HU2hDFYMA3P4upGBvQsfYiGPzaMYilfGsIUCq9Glx0cP+eW4+1xZojYY2YV6Q013Z+VCm1SqrMK5ElsKeKuDIg6sQgKto+Tw1wGx18fP/+XbPbEw3VsUTd+rbec/+XGurvW+NLd7TGL95F521ZWuN1u1hHR2/97zfGl/1PLNHQEks0Vg0bz84FJT+pa9XbGCMrRzxy68BHxbWq7PcYi93Rv8LZSFtSb6Dp6A++EnvsXqFHljsAJcR/jxBcKCQv3wgDSPftNUANah/9+6ip8JyhQOac1viy2vZE5L/vfGLlwZF07v/flLhkf3uy/rrW3qW1wcCsc4Q0zxGof5SwH/BpNQSwdBobgS3KRdE4Bi3ftxqcpQ4gGu5+hkcvrQZZLvIQBPDgG6L2uEDfDSozWBtL1M+Lxeuuv7Wv8dE7txZPo4cJwm+2nnGwfdv5j7TFw9cT9jkmDIU09P0CUTyhiSAg2QheKIgBurBic7j78YIyT5DJMgfQHEn8EzX+Ernvh6ILPm0WN46/mDi4ZKh/5zK6yv9j67YG7u4XHdZ8ALX31ve1JSLvHurftTQDg+ciiAdHegXghbwZUCCVXLyutvedeWedIIMlDqBl0R9ngzJ/PoEOL3oCBjRRQY0ehoXwfU8ZBxdRN/rijt7zHr7zibfw5PMEuUozmm26Jb5yB9l4gZEZOF2IwPcQcFgTjr3LVZrEjUFNTkDIG95Ye1fVkVPT2VriAMxZ8x6S/Gz+dJCUWV6Bvoyp9ReBJgAAEABJREFUBv9fLLki2B6vu6a1b8XT5UJBbFvjU+3x8DWx5PKghPQXETWjXGy3wk6lTKzGeQ9bIWvaDqA53PUWAuTIiwtWGOymDEGj+UL4CYL4pAkHjutInPdVOijrJRZf/hUJhxbS6MenuDfAHJU1ITkar0Cd3BSOvyHH5BMmm7YDEFhxO82n4oQavBOAkKV5UAHe2B6PYEey8ToeOQcvZBlgLtqTDd9ui4epHombKHIQiTXaesuEDCjUEP8w4ekcT2RrZo5pxyRbX/fQzabkh8PGnPIiDjPg12dTVRa3+XWNRvTr3n442ttMwEB7InKVrukhQLzDTwOjEyTzookBKTOwLrKNHSYdFbYU7ACikd5TM+bAGuqKFKZ5hufSBHf18fmMeeAyGvhafXNPw5Mz3GTLzGvtrX8ilmh8q2Ec4pe2Xhjh0jLxM0aQAglSDq7lNxgLNapgBwDS/D8E8IZwxzDPj+r6QCr5TUMXZ8QSK24fk8SLyImB9r7ltxm6tlgp+S2B/O1PlVO+8kokKjRd3FWozQU5gGg4fpUQvkWqiB+fLZSQ6eRDQBAYeE7JdEssUf+vt/U0DIIXpsUAc9ieqP+0qYwriNu/M8fTEjjDMivqBWjoPyca6ryiENPydgAbQAmljM+aMlWIvhmbB1EHhZBsT0ROifWtbJuxhrpk2Kbk8o3E7ckIYhuiBl4AOMIBv+CkED/LnyM/EpfrNm8H0Le0c42uBZflqqAc0vn12eATgQ90JJa7+isv5cA1zRbU6hj4oF+fUw7m5myjjsFwMnTpW3LOcDhh3g4gEJgXM8z+w9nLfcMdUhxIZ/Ycf3Pv0p+UOxtO2b8xvuxHUjx/IgDSLRaCFwAM2Q8Bfe5t+XKRlwNYX7f9w8PGXtLhkY4oQEP/g6Dk2R19F+wkUrzFQQZauy55UZpDZwvh34KYVzV2EKWTqhBSxj5YH3non/PRmhdzGXPwi/kIn6lp+X5fQ/8DbYnwBbG+lX+fqXYWu123bH/tc+3x8Hk6VjwgUC92uJbim0iYIQeunejcePE5O4CmUOdnNRE4bjwh5RZH01Lfbo2HLjxstzq89TbOM5DlfmN8GZfFdc6rLz6NQgROaApv/XSuyHJyAKtOu7vCJ4JfNsv8qT9BVxmB/p90JBs/lSvBXjpnGGhP1H9SaP6fchk5o7E4tXAb1TH41Utz/Mm8nBzACXOO/4eMHPIBlO+9P7LtSn2ZpqI+AF4oSgbaeyPvV8r8SrasihKhE6CQBgSHfbNqTn1dLtpycgApGKQR7mxvKxeZMy6NQA0A8Us0BXUteKGoGYgll38RQXxZUG8NZmiY2iwFdMH+8dTpAKZ0AM3hrrfQvGvZvu6LzCKKH8USjRt4tzRXhRtAiZaWjVpLi9JWrbpbH2/lc5yG0wI/1lSaxkLWUaP2oxKFbwlsTQROaarrfPNUwiZ1ANmKgNp/GZKmW6eSNAPPI19FhPhGe7zug6VkXkt996ubI71XRkPd311fv+PGaKjnvr5wz3bjsVOfNx7rHFqwf07muIPHZ44/dGJ25f35FMfnOE1fuHs75xnJ2/1dlsUyS4kDmh34IKD4z3LtCXCbFVL/9lRPB07qAB6q7TtVSuM1pVTwVmFF6vYj4l9i8cbPWiXTDjl81W6qfeC4aF1yZXM4/psr6h5WqCr/CkrdqEBekzEOXqnAvJDujc8h/TyL4zNVGjLmIUgbB7Ir70uKo/M0zgPHKSXP4TyZbF55DctimSybdbAu1sm6KU/RLh2Jxs+QE/8Ll2XRgrQRmFLp1yTCa149mYpJHYBE9W5EUYZv/CEICPyhPV53MRRpaIEWrSm09YfwxI4eQP1poWCzUsZVafNgtnFLxV/ZUoQeaS104bzkRkgWOwmWzTpYF+tk3YyBsRSqwe58bfHQxQJ9fwZgW6DkQ14GoF4hpHzXZHkmdQB+X/UXlTInyz8jzyHgAUwPTUqcG4bzhyCjkd6LqdHdF2j8toGo/bMhD4UIS6Uph4GaKu3au7AO1kVaKlk3Y2AsjImxMUY6V1SLFAeupopeNL+j4BQ53Hb9/lkbJtNHvIx/OhrqviZtlB1n4NOqYWjAfHXrjuUvjs+MO7HRcPfXZmknPgfKvBcALxpIP089c3bOCO4FzGJgLECYGBtjZKxQRCHWc/ELgwPyFC7bIoLlCJSMcQioPD40kbIJHIBCTatoOXxfOFHeGRevCT8oCW8vll/d4Yc5WiI7PhgN9wwgiM+ZcnCOIoBA13oouqCAsTFGJKzNhJmxsw1QBIHLVAK8g8u4COA4BoHbsIYVb6M6M+6VYlwHsPqsB6oNc+BCgHHzwEwMiAJMmfpDa+LcG4vBvrWhLVfPmvWaYepm/0Apo1Jmf2uxFMoDgbFKwszY2Qa2pRg4bes99zeGOfwnLutiwJMvhsLSIxhy4AJu0+PlH9cB+IJVUU0ESqG2jWdTAXEKaLT4yY7kyjdRZlftXhvqWt4c6bnXJyp/mTYPEJzSXtgGtoVtYttctgY39Z33Bi5rKMpelD3saKJC+Cqq14wnfVwHQNMHN9DVcLz0MzJOwwBVB/VPh41Th7eOb2i+/UsBvWYrTb1ebGTfu3DVF1lkP9IVaAjYpoBevZVttEhwIWKyZWsq471c5oUIKMU8Jg0QSxj+5XjYxziAaLizUdC98HiJZ2KcJqjxS/PjsXjdfW7Zd9mSv7y6Odz7GN1EfzFtlP5VfyIes4PKSn2Rbb1sSfek89MTybAiflOi8R4J8hNc9lbIKwUZmgji2rqe+tFYxzgAVOIyU6ZHp5uxx1JmHqs5eOjHbhnYXNt5ebBi7l9NlVksab7dLRxO6WUbTbI1WFHxV7bdKb2j9cyac/BHUqYt/aXd0TqsPJ6uLO4FUDfsstFyxjgAJfSq0Ylm6nHQdwKgabbc8Mwlw27Y2FTbdaNCuJUGXIE6+7S4gcJ5nWQoss1sO3PgPAKAG+65ZFgZqZag73g31LuiUyhVM1rxGAeAkOlB1Eanm3HHCAIGjed/2L59ZR84HC6v765sjiRv0DTflQqyt6UOIygOdWw7c9Ac6buBOXEaVcdDFyWHMi/8CKkuwAwP3KYRtE4YFcY4gPZ4400a8q/ajEo5ww4V4sGgUf0lN8wKmKJLytS7TO/T6sAcSDn8Lr8put0oiwqzegP1SGb8E28CfNCerN8Io8IYB8DnDd/QApoq2c/7M3HVRSVdd43v37R92UtO2scv0ERDXc9IUEuAEDipu7h1cV9AncPcrF66xdE+OdcBA9QPuE4UK0fTxcVtGdMD88eTM64D6OhcsSeWqJ8rUB8YL1Opx9EU20ubEis/77QdCP4uBfJUVQaDfflyy5wwN7oY203NV1a+6W9JLv+cKYdm5JedNWrD3JZbd5zPn/MeQ40YE3NURHuiroa6R3fNrGeoldK14MeOMtP23ZYld1c3h3seASFcm/qy3UirFBBHzBVzZpXIXOQIUUl1Qs2YAZnDbfYPbYnbZk1m/6QOAABVLLnizVKZ30CcIimUQlDg02YPtvYuu9lJtMo//0fE4Vl8lXNSbynqYo6YK/DPc3Rqti2+9LdcN2bCrRm3VSnNb3YkV7wJYIOcrB7k1Krb4rWfBU2/zK/PnkxW0Z/z63Nh2NxzuZNAmyM9vwWUbwfvnj8P2hUoVFc1R3p/m0emaSfNGHtX+/Xi+smxfI3iNiqEuLwtUfuvueTNyQGwoFhP5PZ0ZuAfqCIPISBHldyaMQ89fmvywrudAt4c7l6rlLyCR7qd0jlT9DBnSplXRENbm5yyqaPvgv/LmP0l+XAQjrTJoVTm4Ovbeut/lytnOTsAFtjRV/9/ekYsEsK/i3w0R5XUqlD+2inAVyztOQfR30EOwCmVk+hRVD0ECPSBT6uCCt8CqAqcBNWBV2dX3q/wzQc+x2kQuFoocDswd0IEYy2RLTRr4gwaRHCsjlhlEbdFbpN6Bhdt6lv+53zkcknnkx74Qxnpwf7TqbLcL1DPK6+biXlQxBxMX+cUBlPXfkezDa61Ik0EQBdBoCvDdp+ovgmU/JIG+luH4eAZN3Wfrv2682T8VeeJ2ZX3b+r+tWbK/jMF+C7jtJTntwi4nWVoJAtcCoYcUkpV3OaU+szg8HVcV5zSN109AnV23PenqU1y28xXXt4OgBXc+uiFh6B36Srad6w7TboKXhA1kDD8gyzugqXknjFa2/19CcYiBKAFHA2IAjQMSGlm3tsar8XaZGNoY3zpVbG+FRs2JmrvuLX3/CcI0DgDQxtke2Ll462JZbdn08aXXsl5W0mGNI33kROQSLIpr6MLEYjMZXNt5w+cUMx1xFRDP0SqM07om0xHLufoCnM3t0XGnUv60WkKcgAspBXQbE/Uvw4Av65hACgQFvpfhAtS3z9o6J9xAlo0tOUSn171Ibp/dUJdVgcCcqMHn6i8Hkz12rZEWIv1Nf4cKGygEUjaFLQcyRvra/hZWzysKVOtoi759zTqEbDOgoQWkIm51PWaD64mbgvInneWStP3aVD0l3dOxzIoLdvm8Os0x/86bouFai7YARxR2MEPUUDq3bpWiUfiim2rEHqfnbc35QQuRN8306ZzT5YiCAWo38uNfmN82Udj25bb9lpzx7bl97bHa69pi2/ShPDdm9UNzgTmlDq7/+mEtmxdQexxQlchOritmZh6F7e9QvIfnWfaDoCFdSRW/EJCOjRy76Q4qmhWpG4rIt52zz2X8HeybcW1tvbBjwv0Ndiq5LBwQfd+tMapr98YS9Tx7Zg8fMqBzQbZFo+sYt0CfQlBWBxQCprw1TeFNn/Cbl1cV7jOIFrSPCyEy8+xVNPtbDrUEV8x7gc+8lVmmYXtvfV9G3vPRQTtJYDi6Qz4tTmQFn//Ftgc3rrsd3NpDvk6w4lfUULq6IO6sT1RX7dp28pem02bUDzrbk/URSSom6jIzQkTWnSCufVps7/91mV/mWuRyAnFpEXXt7juTJjA5hNjxSNRrL3IbYzb2tjzhcVY5gCOqB8amHMqeYFugb4jUS5uEVLGvgdu67nc9t82q9RO+VDGPES2Iq22LSqgzwdAuCiWaHg7jAQ3u1xZ3R2JhqsAfRcF9HmMKBvHO9avmP3Rk6Be82HrZR8r8baeDwxy3QEiG1wOAv2MopPa1mlWQ7HcAdz5xOJ0LLG8UcOKn+mi0mq8eckTqNFIjvhyXpkKS0wj1ea/F5Y191yIuHvvcw9WU/dvc+65nEnZEa/bvDfzVDWC2A02B5oX/AqpsNXTkvxs3eE6xPturdyGNBH4aSy5fAW3LatxWO4AADB7BdgYX/I+Q6XWu0mgVMYhH+gPgc2hOdTzC6DqYqcaIXQzlrjjhD+89M4BO/VMR/Yf+t40EEvefoJA3ebxCAnRUPevpoM1l7xcd6TKcLcul+SWp+G2Y0KmZWPvkvePCB9pWyP71vy3wQG8Aqwj0UAzFOIqisk6Bdo6uCjwa1W74MzHbP2Fn5YlD85DIbAlHi8AABAASURBVNZQRbHLNuZuZ3u8nu6pNtjcsKwwYYNsT9TrdHnm12sZuxVCj5HBXAuhXc7cH3PC6gOqOzrXIZud+2jYfIyA0kRxVSxe18bHdq22OgAG3R6vu0lIc4kugsN87NSKNDKdkgNbWlvX2zs4FVi4TCpzFgCCHYHuq3H2gR2nkmxbGhPJtWNRswgzY7dDOBDXzLnmn1sLNgauOxk5uIXrko1qxojmtmIoXLKJ2s6YkxZH2O4AGG/7tvMfMUx1qiZ8js2tEokgRMX1rN/O1ZB7b+AHVezRgcawOthwwzP/6KjztMIWxszYAdAAG4JSJqTVwRtsEH2MSK5DXJeOibTxQBO+bgDj1bf2NT5qo5qXRTviAFhbR19oZ1u8rkGATobZc7WEowIXWqw3tOWoKMt31y594HS6ylk+MstABfVgNNRv2NRb75jTZL1WroydbWBbrJR7RJZfn3fq6iUPLj5ybMeW65AmgnaIHiUTgXoaD1MbaWyN1+0addK2Q8ccwBEL2pP1Z9OA2Y98mr1fHx8ydm8+otOurdArvkVTRTaIR6DacF9bou59UOKBbUAU/IvGllvC3Pv8AdufDkwZex60HPxRAg+3he/HEvVLjop2ZNdxB8BWdSRXfNCQmU8g6DY9nosgAG8HG8O7T3u6QoA4h5yZ5VoEaFKapu1z3ZYDn0CgaRofYZsmOD2NaEXDc7jk3auerpiGkByy6r8DIKcM1ge66qeIn2s6kss/Yr30qSWKqZPYkyKWiHzHr8+i+x17xrZouHy7PchHpB6cv2euqdJnjRxZ9x9RAwlyU0dfo634rUM8tSS2hW1i26ZOnV8KpTJnHjy0x9YnAxUYO/JDlWtqBQGtpqs9Gf5erjmsTueaA7h08R2BtHlwHoD1nhVBZXTQ/wo2BjT0iwT6LdeAIGRHsrEZZlhgmxCF5TMy2TIw8GI76aJ+xl+5TlmvAyFtHFqw6rS7be7BTIzcNQdQPfs4Mtq05wNsqBmQztg6/y8h8ym6+kzMbIFnfKLqKwVmLfpsPgxa/rRktgxQfspO44OGfAG4TtmgRKE5e+H8mgCLdmN1zQEMDB0KKgXzrTdagV+ryRTydZR8sAR9C5bTlSGfLFOm1YQfUsZBWx/8mBKEjQlSRn8b22ilCi6DCn1ho5UyR8u6afvKl7hO2THeo5San0oZdDEcrdWZY9ccwKyqBT5NBKzvQwPCsLFvyE761iztPD9tHLRYBYJppvbx/bLFgotGHNtmmMP7gMoILAxp4wBEw5svsFDkGFE04zAIYH1z0agNVAarbGgHY0wYN8J6i8ZVMzbSlMqW7r9AHYTQ7xqr0boYTYPzJKStE0iSfDQtipp/Le3O6EXp/jVsq5VGclko0M6zUuZoWUL47xKojY624BhhyKa2kAs49xyAGl7CT3PlAjKfNAgCBFbEwcbg12uWWY09YxySsfit99sIuyhER3pveyBjHjKtBMNlEdBqllopc7QsoXxxROubC2MXZvrs0fqcOrbeolyRm3CGogmvXJPnmk6gD8x0v41vACo05PBxAAhWBkT9QYBrlZUyi1HWBrhWIegWP6SFMFImJNomozNyaLugumW1eG4DqKTl08m54nTPAaB2IoD19V3QQBpdXvpyJSDfdBsA0JTGyWBx0PVqmve3/nVPi2FaIA6VrleSrRaIOkqEKTOncNkcFWXpLkJmm0C/pTJHhClA9J0wsu/8f9ccgEBRbUP7p+6/H26lUVu7qHyopRURYYGV8hE1MM0B1z7tZaUtucgyzFQP25xL2lzTUH9sAZdNrunzTdfRd8FOzQ4HoAAQcDa4FFxzAAqkLU9vSZWxmcoWUEoutFKJoK6lEL6ycQBSyDjbbCWHVJ+oTFqsFDlGlqmsHfg9ogCUaekF5WW5Oey45wCknGfHLUDa5k9y79p1D+qiUs+B25yT+EQl7Nq7x8Zxi5yhOJIwdfCl7Wyzlcp0UaVx2Vgpc7Qs66d+WQO5LjBtmRFj6VOt7jkAUFXU+5kKX97naVTVpheMXoGiCWsf3NK1KrjnmUtK7p3/VxjJb+/OJ96SYpvzyzV5aqvLZHxtpuVlNNIG7Li3GN+C0bGuOQAAZceICtmnLC8kEvrycuahGlQWD16kjX0vyy+XnZSx11JTuUwW7lxoa32mxmpT3VLWXlHyYNZWwqbA4ZvifGGnqQtQWMbcclFTrSTnlVviHFOlzaL9zmeOFuSfLGO1zUpBxr+LyiZ/LLnnsP7rRqxboSq/R4EBUANbAl2gbZHrCS1+Bly7lZ4mNTjN/IVnd7EHIO3RjWDpAN1oamnqYhDA2gKz+tFYKIHgE1XWokQEX/pxKhtrxY6SZkvdQintnroaZcYrh/Y0wlfkT7KHNhmNtnanHqs5pNBiBxDQya1MwtRMPOX30SSQhYZxmew6bqG0UOQYUQj2dNUVCpvawhgTxkS45gAQwBZvjajZPqBiSmsnGgy6H1512v/a6rjGlLyLEfwxGJNsthKCbXP0x4DULC0jFk3tAGh1bRDINQcAqO8lw5kDS1e/VmOpvNHCFi5cpQw5aIyOn85xRg7CnHn1505HRinlDc4+6Vy22UrMhtlvctlYKXO0LL8+a3SUBccIArQ94FJwzQGQ0buAfR9YG4TtU6qtgCgIu3W4+elFIc2IdRKLXBLZKpWlPhQQuExawc6g2VW3hF5+DkCh3AM2dAGkSsPqpX863q6KcG5ri6Kwx0r5PHOpa8F6K2UWsyxdVDQoix0AzdHv5rKxy+6WxfctNO14zJzagFLSvd8ftIuwqeQqaTwPNngAdgBCzLLt3fANAEoTvmfB4mAaA3QLQOOLFsstPnEKTWOQbLUWmSb057hsrJX6ijSjMrBMKuvGfo5IRhAg0bS8PkGOwbVbAKnwYSTjweIgyUvrIrDMYrFHiUOli4qd5AeOipv+rgTjvA3wJboeTF9WMUtgG9lWazEq0EXVSwBIHQGwJei+CnIAdgzWI9A04DO2gM5BqGsOIKBX7EAbngWi7hQoNMM52F5wkpR5aLvV2H1atZ4MXXZ+waBKJGN86ZqVPq3G0vl0LouUedDWl6mkaYS5bllNM2PXqC1YLTdXea45gOH0UL9SZq44c04nSaaU6TflnKGAhAjmZgHWvsow8mis2VEAnJLKIrTMphFbrYOdLQtlWvyVoWPxmSrzRkl169hYC46UhHQK91sgqSARrjkAITIp6q7b8PVeCQF9rq3PhMcS5z3gt3xKSIEm/AuaQ52W3x8XVDNsyLQmsmWJJnwLAaztqXNZdCRX2vo9xQp9bjWAtISVo4WYKp1WMGDThwaO1jT+vmsOoDJ43DAg7hsf1nRiEdLmId/qpVtsmwlgdMPGrm4E5F3LVlOmQdNmr7NMYJEJCuDcFrbRSlhIZTCU2dVjpczRsrgucZ0C0gUWBwTYGwjowxaLzVmcaw5g7x5ICdAPgB1BmbrQxYl2iD4iU6H+X4jWv9BoqoF/O6Jjpm3tsI3LQBOBb9nJlebznwBUp+zQgaDv37XnkPXTCzmCdc0B3PnEGSmfqKb5dGu7g2y3AvQh4Km8b9eKQt5LtzCWi1dKak21XfY+0WI56qkFRkNdG9m2qVPml4LLQIrMvfnlyi81gnkq16n8cuWSWoFPq9l9j4sfg3HNAbREkqsz6lAD2NCtAgrkWZfQxrZF86f3I+qPWa2AB0YFYrQ5lJgxYwE8rkEOuZlts5ovLgMuC6vlHi0PQbOsLsExAYHbwLqGvjXHRDt44IoDWBveeq0uKm+RMmP5yxUj3CnaGJfRP9uW1s3nDyGoHWCDA5MgBU0Ofw9mSkDf9VmbLLeH3ArgDi4Ly0UfJZAcF9UlrlNHRVq0y23Ap4KbouGtGywSmZcYkVdqCxJHw91bUOGG4ewnodACieOLCOjzzh//jJWx/Z8J6HZ8hIIrm1rVHOr5sZVo3ZAVzdogLwGLR/7ZFuZeqv5/5X07V6pLNv7uIAK3BaXw2uZwzxY77RhPtmMO4LyTNwabIz33gZIr7KgMo40zZQqa65Oka/QZ647bE699PGXst+UxTqkMajLyH5tDXSX7klBLOB4GMP+RbbGO9VckpYx9z3UkL7L8NuwVDQBrG7qWc106Os6efQXU01jBbaTl5AeD9ugYK9URB9DS2HnCKcct3UndnYvIzLEobIgx5CBIc/gaG0QfIzKAc9+JqB0TZ9WBAunz6bN7W5ZstPapI6sATiKnvr7bp2lVcQXK+qkS0sucEzfvpF1bF5GRH+G6ZIWSqWQQVyClcREeN2tXtL7b1lmsI1hsdwDRSNdqMw2PZcxD1QD2dflhVFB0BdVF1XktLRvtaZ2H9aWG924TqB20q1dDVzll+l7z18PqSmZzqiH/xtjtAayAOc9oB2z7CTjG3QIbNU2rvIDrEjgYMuZAFRjwWFN4i+2Dg7Y6gKbara+jfs0t5Nns/UrHuIWDYJj9C7Unam19IKjjkRV7lDJvF2jLhY4tQwXyhHXheJoPSmFtDvdkFCj+vTtbPD4S10oad3Z0rqBpZPsY0SKLj6er/wIAW8yAyYICsxpB27Qu0vsPYGOwwwFk2Vof7vuGrgX/rBQPaNlowSSiBfpqUuqQ7dNp7Yn6tyPaQeUrxpkq7WsKbX1p1Wl32zRz8oquQvcYW1Oo8yWpDL1QGbnkE6BBe/L2q3JJO500BsA5Anx2fAYIcglKSUDQ/9RS99A3D6fPtq3D+5ZsLK+1LUu2+6Lh3l8ohM8Y0oZH/fMwW/LLG0r9Wx5ZCkyK5ObUtQVmzifbwhPmnzy0NpRYnk8mJ9KuDXUtZ2wAaqHd+hTKawE2SLv1UP35oqRbSSv0FCoj24aU+elouOfX3LYKlTNRPssdgOEf3AEg35kFPpFWx+IV0BTORU58cLM/Nfw9n8YXC1t7PJii6VOE9ANNoa5fHabR8qvCYbm5bLK6o6GuXyKoBxgbZcrG0daGJfvkHOwf2vt9G4QfI/LSxd8NBLS5FwPNxRxzwoWDkbak3m74Bh+2Wr1lDuDy2q2vIS8lia/T6Z7YapwFy0ub+2DB3NCnCxaQY8a7dpy/N20e+Bdd2Poi4mE0Shco3tEc7umiaUKaajsc7fCGdTeHezsRxdXUUGzt9rNpzG1KHvz0nx95va33/qyrqubCz6So7vB+MawjbUotioa7VXRZ1yKrMFniAKL1m+sqtKqnlDLI+9t6BczbbkX3UUqpy1etutv2CropufK/pEzF8wZZQAapDKC1QQH2NEd6/1SAiGlliUbifwQQ3VJlGgnHtGTlmlnKdPyWxEpbX/xhLFxXFNUZRXWHj4tpVcoEzRd8cu2SBy25DZy2A2gKdX1Ck9U9Gdmviomoo7EQsPqaQzWOzKWbSn3an70VOBqBffsKTFTS+Id1kYRaX9d3XVNoy4V2aYuGuy5YX7f9OpqRUCAzr5dgTLv+5IqVOTVk5jO5pp9OOq4rSqn66cg4Oq/V+zRNqHyBmq3RUPc9wVK7AAAQAElEQVSnpit7WgXYFOq6CRG+bchBQKC96aKxLb8Sfim+YZv4owRv6lv+57Qx8FNE7ahYe3cV3XeZMgUZc+jjpPcv1CMwoqFe6pbTUBlsKLiMNxzOy7KaIz0GAN5Ple/jpkqTRnKr4EwgmyBlHPz5LdvOc6SnE5Di64BQMG9gc0AA5DYHqL5FtwQbAQgtFBYKNrI53PtHug99myrCbtJoKrjbJDDwERpFrR59zo7jjr6G9wvQn6YmQgs4Grg8pMxoQmi/XBdJqr7at8ZbItt/Ew11/htdvd90ee29r5kIEI/jrK9LvInTch7OyzJYlpSGxjxOlNeueCJQCeJyU9+K94IDYdWSu6sR/de4YWu+5nFZI2BLc6iXbsfyzT2SPm8H0LLkwXnr67Y9ZKrMP0hFF4UROUX/3zAHwAwMf9wpoJrE1boIolP6Rusx5TDwSlNmtYbspzlz/LIp078P6gufurLhKfWO5X+n9Xlaeft3xXFBveYpU8rfA+CXOQ/nZRm8gkvBRxwqYa51Sv18f/XHDHPQKXXT1sNt0ITM61rqtj/csuShvH9wMS8HsHbZlnrT73/EkKklVLNpmTZ+BwXQtUTKbLfYCaU394W2U8NpRsyLYpug0SQdSBo0zNBtwiEYzuyCgdRztD5LK2+fy8ZlzEPZNIrSArhfvEjcGXK4ub233tZHfuGoIBVQHaG6clTcdHadyEslhVTXzjb9g49Fw52N+ejMuXauqd28QteD3dQ1WkhrPjqKJq1fn33murqtFzkFqCO5PCbAt1ETAfBCfgyMcKa3Mof55Sw8dRMNoAb0WWcVLsG9nNwmlZLzNVHR2RTZel6uSHJyAM3h+PsEalvIy+QqtyjTpYx9oMGsO5wE15YIX0EjZjRQQ37aScUlrQtBoNgYS0TWg4PBr82+k+uIgyotV2WYQwASH2yu7f1gLsIncQAqW2Ob6+Lf8Ws1PwGqxbkILO40CCnzQNX6um2OVqz0UP97BWpPIDo3M1Dc5TAxOuaIuRoeOOjIoN8RJM2hxHquGwDZag+lHRT4fDU/WBfuOfzE5EhbHs+mSRwAqqZQ55PSzHxs2LD9wavxsNkSh4A0hTL8HVuETyD01kcvPNSeqD8DlPn3CZJ40YcZUMp4nrlizg5HObJRkLmO64aVytyUlTL2gqnMDzXVdv4NACcc1BjXAVy6+PFANNT1NwRYNDOu/HBM0LDixGhoy1eOiXTgYDgz2ICAzyHqDmgrLRXMCXNTYUKd08jXhrZ8WRPBVzmt1359ii53cEo03P3c5fXd4z6jPq4DCFYd2E0jwaeoGdHtH0vzyEMUvmuaapPHjT1rX8wdOy55MZZcfgoAPkYreOEIA9T0iRPm5qbtK186EuvEluuAQP2jhhxwQp3jOrgNK2We5Ddg3J8fG+MAmkJbL0MUjjwwA24GJWcDDn3RDQha+kA99UJ+o6E3O8AcMBeCOHGjLLJ1gOuCK8odVIroa67tah6tcYwDoC7/BVJlRqebcccKJAT9J364qfaBpU4b17rjkv62RO07TDR/i4hOqy8afYgIkjhgLpgTp4E1L7n/XK4DyoaertO2TKVPKgMU4pjpwTEOABWmphI2U84PpV8EgYE2HvNww6aOeP2VgLhG1ypBked1A4MbOtnWEZtxbYw5cAFEtsx9gXauAy6od0clqjFte4wDAL3i95pw5MU5d0gYpRWFfhaNebx/VLRjh7F4462ZdGqxhr4nRRkMDiLZqJOtGUwt7kg03uIY0aMUVVYdfB8KX0k+9DPKlJwOBfpAU747Ryce4wBivaEtoMqnW2rKFAjUv7u+IW7jjz+Mpv3Y403bG55sT9SdoVB9w6/zV4WOPT9TjrK2IX6jjWzd1NPwpFt2rQ93XYCoXc9l7xYGp/UK1KE1Gb5/tN4xDoATSJn+sIbl0wsw1TBIE26AkeCa94vFGz6bTh88H9F/v579shB1lkcwlfB/BWwLovZAWg6dH4vXfdZFY7JlK1G/gcvcLhzFJlejtmyYwx8bD9e4DsBIpX/FgwbjZZiZcTQYpczFTbWb7yT7XG11HdtWbI4lIhfRtNQ/+bTZBKe0F582B9iWWKLhwo543WaXrVFra7fcIamsAbK+AMohSDBhOCiPXOCOMXlcB1D36AUDugg+UEbjUqD4U0ta8M3rI9uvPIYhlw46kiv/t3Lvi0FNVH5UCH1Y0D1caZSHAsYqQB9m7JV7XwiyLVAEYV1k+9t0reJSLusigOMQBAUaBjav2LqifzyF4zqADYAyIwd/J7KVbrxsMzPOpPEAQLhx9Vn3u/BDJmM5veGZS4bb4suub4/XBwGMb1GD2o/IRVaMVy8ERA0YIwj5rfZkfZCxsw1jLXM+hstUINyULWPn1bumUVAbNtTg7RuoTY8HQowXyXEdyeVfD+h5f1+As5b0mjEHQK8IPLt66RZbf1EoX5LaE8s/jak9p+gYeC11V7ZU+l8FmHUGbt6xKEDCwFiod7JFR/9rGWN7b8On87XPzvRcllSmf+OytVMPyy62NeCbDx2JFV+dCNeEDoAzDGX2fBtR492yWhWo2QFf5bj3TG4S0brjkv6N8dr7OvpWnPf3XX8KSiV/rmtVfeQQqLtdAQiTFidYEZB0aKKC2rsaZt10P/0/f9/1BHXzV5zH2BgjFFkI+II3UJnOKTJYtsNB1GAovfO7kymatMboGv4QlJz5jwWOYUiBqdJvbg7H7x1zqkgi7nnmH4c3JVe8d9es3fUAwVOpnC4Q6NsY0OaAT6sGnm8fgapGNgX9H8krUM/KZNmCdLAu1sm6NyVXvueeZy4ZLki8A5maw733mirzZvJYDmgrLhVKmQbZffiV4PGxTeoAds06+AyCeBbKMBB5QG7g4mi4+2vFbP4991xidPSFdrYlIg+2JcJX/Lb3LDQyg6ej0q4mJ/ADXZt1s0DxIIJ4BBTsAQRTEwHwa7OAb/F45X2O43OchtNyHs6LqP9AKXxnOr1/MctmHW2ki3WybijiwGWnQF7MZVnEMG2DJlB7dt/cwacmUzCpA+ACRvR/Ntvlm0zKDD2XrTjK/FxzuPcHpWRibFvjU+3J8K9jifoPt/YueVs7TcHVJhvO1c/66/H6GcsDu2fv870060XfizXPZVfe5zg+x2k4LefhvDGSEUvW/WrT9gtce3CnEO6zZUZlly3DQgQUkKeYsnCb1dD3BW7Dk+Ga1AFwxrZEbatUxm7eL8d1pBMsP7i2duuG0rUf1QYaBW5tXW+2tqLJlWK8lc9xGk4LgApKNHBZKZAfLFkDLOCdHN/ejfHQTVOJmtIBsABNVL+fJnl4tyxXqUwQiNdGS9oJlEfRcRlxWVEDKA+Dx7GS26qGwZzeb8nJAcDw83/URTANdIM4jr6yiFJkOwrt2mik90dlYXAJGtkcSfyQy4jLqgThWwSZH70Opg/5D/wxF4E5OYDWHZf0Z+TwdXxfkYvQmZqGewI0KfKBpnD3f85UG0vVrqZwzzelTP0zl5EbNhSLTk0EgNrq9+7cuvJgLphycgAsqCPZ+FlTpXMSyuln8kpdrH9pqUv+ZSbbWEq2raOyQICievjILf6kNPqpreb8o6E5OwA2SMOqL5fzbQBzwKtSBpgyfeG6SPK+y0IPnsRx3uo8A8z9ukjiPkllwWXiPIJi00jdfy34lXxQ5eUAnhb3f7dCn0/yy3l8lcynRSlJTiB1kR/0R6+s715AUd7iIANX1t+9wA++R8gRX8Rl4aDqIlWlIEBtc+ferkmf/BsNPi8H0NPzgcxwZve7da1qtJwyPVY0NKiqJFTvuqJ+u6M/ZFGmhFNPH+CK8Pb3SnXiLgWyuhh6pMVQFrqogqHM7vfxE6L54MnLAbDgUN/KX5nm4BO8760jDKSNA2CYqZ9GQ509IzHef5sY4B+r6TEg9dO0ecAmFaUp1pSDT0X6Vv5PvujzdgAbAKXAim8I9OWra0anlzQuAIB1zeHeZ5tCnVHwgqUMRENbm5ojvX9D4niEa0vFl7QwRB2EFvwmt818DcnbAbCCtkToZ0qaewAQvPAKAwokSJU+WaDeHg33fm2iX2N5JYe3NxUDzGE03P01RF+MBvtOYY6nylNe56kNKrW/rbf2x4XYXZADYEUo9PPo/kvyvrcezQCSE8iAQPyczzAfW1374JuPPuvt587AmtDWNzGHArXPyexvVVBlzz27IyndV6KUptTKQnEU7ADaE5HH/aLmNgCvUGCcQKPTNEAIJ1X6FtzZFO7aFF3Wt2icZF7UOAxEl3Utioa7O4L63N/TfNNJzOU4ybwoYkDXam5v7Wt8lHYLWgp2AKzt5viStX697L6zwKbnvKaMfYAK1igxtK053POrnDOWacLmUM+vlJDbQKm1zF2Z0pCT2RW++dDau+TynBJPkGhaDoBlmubB9cBVHLwwEQOH71srAfAdzeFe1Rzu/Nili7fM3B8AgPzCpYvvmMWcMDeA+A7KXXmYM9r1lokYGDL3XTXRuVzjp+0A2hINrZrwv0jjAbnqLNt0fB87sqrvVFYHdq8Jbfls2ZJx2PA1oc3/Wll94m6p1HdGuMkcPlP8G/cQKtBF5Qub4o1Tvu47FcZpOwBW4PNrEU0Eeddbc2RAqrTPJ4L/QVOGA82Rnuujkd5Tc8xa8snY1mayuSm0dcAnKr/OXJS8UQ4aoIlK0MDXYIVKSxzATVuXvYTg+5AVgMpJhimHyVxVKaXxER8Gn2kOxf+PGsWZLUu2++nEjFrYJrZtXaj3z2wr20wGVo5wQHvekjMDiHDNb+NnP59zhkkSWuIAWH5r/JwfIWp7eN9b82cgbR6kWQPjEk1UPGr6aMAwlPhZcyhxbv6SiisH20Drz9gmtk2C+Tq2tbhQlg4aRHHg3N5lln2izjIHADQQGEs0LNBwxl28wKmgQAJfERXIMyWk36Nr/u3N4d6d0XD8Q3z1XH3WIzVOYSlUD2NkrIy5Odyzk21gW9imw7YVKrqo8rkBRsMA1CZun7cB0LLnbyx0ACOUmGD8v5E97//0GFCQNg/xQ0ULEeT3EfBhX3Dw4XWRvr5opPeaN9beVTU9+dblZizRSPc1jI0xMlbGLJWxkG3wBoit4Vop49oNsMGyxs+oLHcAHYnGryJoPQJ1KK2ARQuXGhLdHighVeYkUw4tQ4Xfne9f3N8U6jzYFO6++W2RHVc3h7a+qbn+0bOblm/l97VtsaXp7K3zWQfrehvpZN2MgbGg0r7L2BijAsZq2ILBGqHFW9bj2YfUllCJvvZkw5fHOz+dOMsdAIPRModWSWW+xPulsPo07lmrfoFaKcClXkEahjP8oWZVA8pcn5YDv6TLwu+lsT8p0r6/ra975EA01PO3aKiz7W11D31+bWjL1auXbm24/My7p/xuAafhtJyH87KMKMlimaJC/xvrYF2sk3UDqBrGIlW6JLgbuTDJ/pEyLwnIRLHcpRnBC+xAa4sD4G8ICtDeFdDn2IF52jJpMAp09YmwxAAADBNJREFUmkpBof8eUfu8gbtf1ZFcUSOlvFTDwM5pK3BYgKKxg8Mq/VJlKjPm/lkKjFMARXNGpr5Ktv6ywl/TVVVz8q6rGp5Wb2/8q7qq4Rl1ZcOT2ZX3R+KeVpyG03IezssyWBbLlMqoJD3ZQZ6jdFJUaSwa+F8ylPHmjuTKGjX80omotM8L9N2p0xQ21wnIMTiZjJ+0RYR3t+5Y2m+HXlscAANtT9bfZRj9/yRQ58OiWBGEpMLOKEh9qDW+DGPx+ktp4PI/Yj0XvwAUOvqW/x4Tj70KURuiwxJeRrq4SpnUW8jQwOIQZGg8IWXshaHMThhMv0jbl7K9CL56D2VeOhy3EzgNp6XufDYvyxghYkTmyH7p/Rfo29mWjJxwS3LFXYyeLlIvxvoa/qM9UfeW1ngtSpn+Z00EM0h1BIokCGo7hup/f3ui8Q67INnmABgwnvnkL6kCxQHcqDwKBPqg0n8iAGCnX5v1AaUgRIXtb48v/yFMEFphvRlLNFRq6P9She+4CVJ50aXCQNC3AATon2xP1B0Pk4RYsvHHbfFaP4Kq9WtVHwDALVx3BNUh6oODG0GB7BOnP5n3Rz7ywWqrA2htpcaUXF6HKBy7oiJqZD+mfdqsXabKXP+brldjR3L5ipt7z/lJR1/jdjqZ09KWiGww0rvPBsQ9mJWZUzYvUZEwwGUmUH9hWO17VXuy/rpcYbUnlz90c+/Sn3Qkl5/HdUeq9He5LlH+NDpYD0hXKpZoDHEbIt22LbY6gCOopQbLdI1vH0EdibNyi4AQ0OeRSNwtwPc+UFi/sfec4zclV3wUphH4NUs9XXUmoviuJipYki34WbC3WsaA4rqGSv9ypmrorFhPQ/b2rlDpNF7wMa5LArBOw8B7Sc5OrmsIAuwJ/Jx/EBC0ZeBAsMuKY6Bv6ml4MmMMrBOo4zEnpnGAqAFSIQj0PQ4oWjN6/5nktRfy14pGrvRoSWNt3XHu3vZ43cdMmWoWwv+iwOIZ0wAvHMOAoO46Cv05U+KF7cnwtbc+cOGhYxIUfICKewY0bvTzjuSK402VPkMhbiR9jyPVQaS6CBYFgX7IQP9V7YnI4xaJnFSMIw6AEWzqW9lOrf8LANNrl4IKWafeBKL+dU3HU0VwOBRLNKxv32ovYR3J5TGR8p2GIL7g1/hN3unZAV6wkAEFPq0aaLzpnxcIdXossfQBC4WPEdXae+4THYmGK7jupTN4KoD2NV2rAq6bYxLnFcF1Sv2/TfHzp/2WX65qHXMADKgtUc/fdvuNJgJ8mNOKKLKFCwB/Fei7UQBe1tq7DNvj4c+19jT8rXXz+Y6NL9BUTLotEfnacGZfrS5q/piPHYTfW2xggG/NdK361uHhA2fEaCDvJz0Njr1PzHXvdzsa/hZLRL7Q2rsUqU/6Vg39vwHAZ9ghIdVdyDFwXULw/bY9Uf/VHLNYkkxYIiUPIbFE3TuF8N0+dU9Aga7RvZAStxmZwdNDyeWL2hN1b29NRChvHgptSHrLtvO3tcbPfSMNEC0X6LNBgydyagYQEEQ6ZQ4vosa35tYd59v+qXqYImxMRO5oS0TeEUo2np6WB18DCm7TqbeaS12nHu2dsWTd26dQYflpxx0AAMqNPRvWaKL6Jl3w4+w08UJMcXH6st0ofUCA/j9CBNcNv/jXqvZk/erYtsanNlA+KLIQSyzvak/UoRC+DwnQaHyAn5HhblyRAZ0xcBRo1HtE1J5Ege+NJRsDt/WteLrYzOO6uilx3jOEb/VzOx+u5LqM6PuZQG2A6zjXdUV1HgDpIlcFuqi6edesXavpWILDwQUHwBa2mm3xpVehgNcJFDuCvuMO0g1cX8oceHN7or66PVn/nvZ4qP225y8f5NTFvrbH637Ynmw4USnzixr6M1zAxY659PAhCNQzSqmPxBINi2Pxxp9DCYTNz60f4rpMPd/3tScaqtPpA29SSvZxnReAj6ISb6DBxbfdc88lrrw8IdzkcGPP0ruJlHNv6l40O9a3InTkKS03MU1HdyzZ8JWBQHqBwIr1CFq/LrJTh+CFwhnIXjFR7BYC14lgenZ7IvL9wqW5n3PT9gv+0NG3MsR1vj3ZePbG+JI/uYnKVQfgpuF26ebfZW9L1LaSM6gxVObdQlQ8RroMBI9qyDEgcYUAGV1UPZQ2+tfFEo0L2+ON7TzoBi6FmarWq5U2lmxHouEXe2bvPVfp2tmI+NMKfT4gajZqLG3RzE1AnwsgtOs1VXFWa7ytlqePS9uq4kbvOQCby4fv7fhBKLrVef9j8Gc/Ilyr0UCWzWpLTjxP51E3/0tmT0KPxes+2toXosG9DY4PipUccdME7DmAaRKYT/aeng9kRPypr0qZ4q+B5pN1xqc1ZcrA3ie/0grrzRlvbBEZ6DkAhwvjXGhRgILHBRzWXOTqEB7LclOEMGcyJM8BOFy6GwClhgFyAMphzcWtjgdLN0z9xExxG1GC6DwH4EKhSWU+C+BRfzT1qCRxgp5XPJoUB/a9WugAyaNVCPTdI7zZgJdpEajTtV/85eUIb8cxBjwH4BjVryhKZV7cqgt+DPqVuHLe00QQMsbwlmLkYKZj8hyACyV86/bXv4ReD+Bl5jVRAbdsX063AC9HeTsOMeA5AIeIHq3GMA/+Ab1xAED6Sxl77wcvuMKA5wBcoR1AQuZOmg50SXsRqUWuguq2IkJUVlCY/bIyuFiM1bTqmIbetwQ09IOmzfttsZTL0TjKYd9zAC6VspE5MGzIIce+ZuSSmVOqNeRwKpXalZoyoZfAFgY8B2ALrVML1Y30IIDYOXXKmZ0CEV4KyOqBmW1l8VrnOQCXyqZ1xyX9AX32CwDl/OyLAp82+4VWm372yqWiLSm1ngNwsbiGMrv+jlDOrwcLoBmAXVCEoVwgeQ7AxZL2a1W3CH4KzkUMbqoW6AOfqtzkJoZy1+05ABdrwMHUi7f7dP6NARdBuKjar1WD6Ttwh4sQyl615wBcrAJ37XjzXhoFdxGBu6oVKIj1jPwys7tIyle75wBcLnvTGLwXAKEcQ9rcv7kY7S4nTJ4DcLm0lZB/xDJ0AAgClBJ/BC+4yoDnAFylH0BH3/1Ak+Euw3BePdmsaz7q/Tiv2tP4CgPilV1vzw0G0pDepZQsuyfhlDLThpEu+weh3KhzR+v0HMDRbLiwXyn0nYBi0AXV7qrM2lx8DsBdUpzX7jkA5zk/RuNNPQ27faJyqLyeCFTgF1WDHX0X7DyGDO/AcQY8B+A45WMVGuahbVhGDwQhaJAx+x8BL7jOgOcAXC8CAIEVbaKMHIAQPtBFsLUIqC97CJ4DKIIqsHv/U20+raYIkDgDwSeqQEGm3RltuWspx5SeAyiCUr/nmab9aeNQESBxBoIhh6A1Xue9BOQM3ZNq8RzApPQ4dxJRls1nsU2V8Z4AdK5qTarJcwCT0uPcSaXUVue0ua6pnGx1nezJAHgOYDJ2HDyn68FtDqpzVZVPr467CmAc5eUa5TmAIil5mUk/RVDK4fNAKm0O/JVs9ZYiYMBzAEVQCAzhoH7wSQ19M94BCLLRBHicbfZW9xnwHID7ZZBFcFfPxS+YYLwEgDBzA/LvIey+NV73/My1sbQs8xxAMZWXzIRR6MbMfCxYgUDN1H0YKibKGUs5r54DKKLS52fjTTAvnYkPBWVtUqm3tnYtf7GIKC97KJ4DKLIqcEu88U9q//Nz/Nrsd9AV8xeIWp8uKqFCXwC8Fci/JsS3CcU0XMBYkK7w2Ud8X8YKILYhar8M6HPfnpY757Ynz78LvFBUDHgOoKiKYwRM61NvOHBz79m/aU80vDuWaAi1xpehse+pORIy6+j24DpEfLhCn/echr7ddHwIAYYpp0LUAVEDBC5WiqU9yK5QYHhFBpJMZNmkA0gpnSGd6hBjqCAsSJgUqO+YYLQwVsbckWysJfzv+m3PmTduSlyyn/J5S5ExwDWlyCB5cMZjgJ1Ce7yuvT1R/8lYonHJTT1nnpIeGlyEKrgEpRahO+yVflF9sQD/Wroef1IBXq+JCupBiNsBsBNB8dt3zwEAN8RBBEwDNWReR/aRv0lA5/BZin6U4ruowd/OMqhhf08BfFKQbNYhlTwPdS3CuhkDY2FMsUT9J2LxujbGSvlLYil3kP8fAAD//7HH6iYAAAAGSURBVAMAyTzxUhiUNjIAAAAASUVORK5CYII=" preserveAspectRatio="none"/><image width="10" height="10" id="L" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aeyde4xc133fz7l33sOXzNXDdGXLQOmGtotUCWWlBZwWbdMk0h+pmAqxU6uKlYoSl0tHKz6Wu5So0YO7XHIpqhK5guQ2dus2cRxEbovYbdAWBRw0qCsmAdrIbKE/XFi1LJuUbZGcncede0/P95IbcOm973tn7sx8B3M4d875vc7n3t93Z4e7s4bgjQRIYGwJUADG9tRz4yQgBAWAVwEJjDEBCsAYn3xufbwJYPcUAFDgIIExJUABGNMTz22TAAhQAECBgwTGlMBQCcC+ffvKuxtLE/s5yCCH1wCuzUajURoGLVmtcSgEoNF4pbZn9rn/Im760P82u9b5lh4rHOfJwMoNA1yTuDZ/qDb+nz2z83/UaHyhstpkeX7MuwDIfU8sHrxctJpSmn+3Z3XvEEpNKD3wyKEmyCAfDFavSavbvkNK+Q/eMy+1po6euj/PzY/aci0Ae2YX/pftOCdWrlzS17lCvRwkkHMC0r1W2ytNoZzeVz535OSv5LngnAqAklNPnPiXhiE/ppU1z/xYGwl4EnBsWxSr5X87/fw/f5+n0QAWrk+ZSwHYc/j4FmkY/8RxnOtr5TEJDB2Bln4l0LrwgxfyWnguBUAa4k/snpVXZqyLBEITwCvYgmn+3P05/d+B3AnAo4cX7jTNwk8BXGjKNCSBHBMoFIrbt/WqH85jibkTgGKp8HCPX/3zeK2wppgEOp22cKTxP2K6p+p2Y7DcCYB+4+SBG4vkcxIYdgKOY2+aOrr0i3nbR64EYPLwwpP6zb8NeYPEekggKQG8oe3Yvd9MGidt/9wIQKPRKBRKpWfsXi/tPTIeCeSCgJTy/ry9GZgbAfh+t/Ipy+rk4kSxCBLIhIAS4pZe9dVMYocIup5JbgRAKPX4egVyjgRGhYB+H0AYhvng3tn5rXnZUy4E4OHZxkdq9Q135gUK6yCBrAj0rK4wzOI/yip+1Li5EIAN1S1fXmlejlo77UlgKAn0nN5zeSl84AKgXw59pNVq7sgLENZBAlkTKJcqE48efu6+rPNcH9/reOACIE35GUMaQ/G7014QOU8CUQh0Oi1RqdaXovhkZTtwASiWqk/yx36zOr2Mm1cCnXbr9s81Tn580PUNVACmZhde6nbag2bA/CTQfwJSFntdNdP/xGszDkwApqefr8pC4V78hNTakviMBMaAgFKiWq9+Zl+jsSnr3frFH5gANDe3PySkyOVvSPkB4xoJpEVgpXlF9KzSv0krXpw4AxOAUs/8Rs+y4tRMHxIYDQL6VYAUxicG+SpgIAKw9+jiL0gpbxa8kcCYEzBN8xblVP7moDAMQgCkUHJfj7/0M6hzzrw5IoBXwaZR/MOsSgqK23cB0G/+VYTt3BtUGNdJYFwIWJZVmDq6+NlB7LfvAmDVrCVhyL7nHQRc5iSBMASU4win5zyolJJh7NO06WsjTjYaG4rlyqRj22nugbFIYOgJmIXC3374sflb+r2RvgqAYVcebbea/d4j85FA7gnYPVuUa+aX0yw0TKy+CoDdcz4XpijakMC4EVDKEYVy8e9MHXi2rz8b0zcBeHjm2C+WKpXbx+3Ecr8kEJZAt9MR5ob6Pw5rn4Zd3wSgVq3+i267nUbNjEECI0vA6naf6Ofm+iIA+xqLn+i027f1c2PMRQLDSMA0zfLk3PHfSlp7WP++CIBjqUekFKbgjQRIwJdAr2cJwzSf3r17d9HXMKXFzAVg9yuvFKu1+kMp1cswJDDyBHqWtam2bfsn+7HRzAWg8H/f/ff4rad+bIY5SGAUCOhXy7Lbteb6sZdMBeA3G8+/TxrmXUqpfuyFOUhgZAjU6hv/3lRjcVucDUXxyVQAar3eTillbj4DPQoY2pLAIAk0r1wWquN8PesaMhUAYciv2nYv6z0wPgmMJAH9uvmv7p479v4sN5eZAOw9svSgcpxalsUzNgmMMgFpGvWiYe7Kco+ZCMD993/FFMraY/OXfrI8d4w94gTwS3OlUuVMlG1Gtc1EAG798LdvFYZxd9RiaE8CJLCWQKfTFvuOnMjsfwQyEQBlOp/nO/9rTySfkUAcAvrbaGEL51O7d7+SyQ8GpS4ADx1qbCvX6/eg8Dgbpg8JkMBaAqZZ+Oty67vb186m8yx1AdhU3/S5VvNKOtUxCgmQgLB7ljCE/FoQijjrRhwnP59uu/Oo3zrXSIAEohHAt9PFUumOqSPP7YzmGWydqgDsmVv4p2ahsDk4LS1IgASiELC6HVEsb0j9g0PTFACpv1d5Eb/NFGVjtCUBEghHQP+PwGQ4y/BWqQnAbz1x6t6eZfHPfIdnT0sSiERASimmnjxxcj2nuHOpCYBld/fq+vr+scZxN04/Ehg2AvjBIOWo6TT/lFgqAvBY4/SW2saNvzRsQFkvCQwbAcexTceq3pdW3akIQKfb/m/Ny5fSqolxSIAEfAmoad/lCIuJBeDRwwt36Nf9d0TISVMSIIEEBCq1+k9PHjz2N1ZDJHlMLAAF07hHCMnf+hO8kUB/CKxcuSyMSukP08iWWACMQuElpZw0amEMEiCBkATsXu+Wqdn5nwpp7mmWSAD2Hjk+pwtJFMOzMi6QAAl4EtD/41a0hfGIp0HIhdjNu+/FF8tCiQf1u5IhU9GMBEggLQJKKVGpVh9LGi+2APTeufzXpGF8JGkB9CcBEohHoNNeEVNHl16M533VK7YACGF8mV/9r0LkvyQwCAJ4FeD0rH842Ti7IW7+WALwyMwzP12t1HaggLiJ6UcCJJCcgGkWbjft5p1xI8USgA0bNk+3Wvyd/7jQ6UcCaRBADPzynWX1/iuO44xYArDSWvm0EFLwRgIkMHgCxVLJfGTmuV+JU0lkAZicPf6IftlRipOMPiRAAukT6HU7olbf+Kk4kSMLgFL2UYd/7CMOa/qQQDYEpBSdduvuRqMRuZ8jO2zYtGWbcviTf9mcSUYlgXAEbrTSPfnBNz760cjfl0cWAAfNHznNjeXyOQmQQKoEDGle+Na3IndmZAHotlsdwTcABW8kkCsCSvzg5jfeUFFriiwAyhDLhmFGzUN7EiCBDAkUCub//P2vfCXy9+aRBWDCWDkkRGShyXDrDE0C40Xgxt2apilsx/53QsrIjRlZAPQ7jT2jUPjijUXwOQmQwGAI6P+Z++HysdkzcbJHFgAkeenpAw8VS+X/aBYKeMpBAiQwIAKGab6nit0PxU0fSwB0MvXi0/t/WTjqj/SxJWXkNx+1G+8kQAJxCEgp9at9PQzzrbPPzWxZbjRi/1x+XAFw6z5zbOaXjELlTiHNJSnEhY2bt4ibtk6Im97HQQa8BtK+BjZv2Sp043WFkP+qaBY/sXxsJvZXfnHtlkgAEOPss4+/sXzs0MHlhblbThyelPMHdsv5gxxkwGsg7Wvg+Mwj8uWFufLy/OEH/9mzB17X/Rf5TT/ts+aeWADWROMTEiCBoSJAARiq08ViSSBdAhSAdHkyGglkRiCLwBSALKgyJgkMCQEKwJCcKJZJAlkQoABkQZUxSWBICMQWgAcOnKzvnZ3fur+xNMFBBrwGsr0GvPiiB9GLcfUmsgDsffrkfY89ffr1TWXnvJLyfKtrnV/hIANeA32/BtB76EH0InoSvRlVCEILwCNPnNi+98jx101bvtZpt3Y6jn27UupmPSaEUhxkwGugz9cAek+Pm9GL6En0JnoUvRpWCEIJAAIWhPNnjqN2WlY3bGzakQAJ9JEAehM9il5Fz4ZJHUoACsr5HcdWG/g5AGGQ0oYE0iUQLZoS6FX0bBi/QAHA9xWmWdjJ5g+DkzYkkAcCSpi6Z9G7QdUECkBRmHN4aREUiOskQAL5IYCeRe8GVeQrAPjvBatr3RoUhOskQAL5I4DeRQ/7VeYrAJuKVkUpp+IXgGskQALZEUgSGb2LHvaL4SsAlXJJamcM/cA7CZDAkBGQ13rYs2xfAYBX4k8cQBAOEiCBvhMI07uBAtD3qpmQBEigbwQoAH1DzUQkEI1AP6wpAP2gzBwkkFMCFICcnhiWRQL9IEAB6Adl5iCBnBKgAOT0xLCsbAhIKYVhmkIK2ZRSvusOfWyYek5KkfQmpRSmWRD6tiKkvBh3rPETYgUxpUxen65rzZ0CsAYHn4wygUqtrrenXpNK3CWM0g5TKXfg2J0T6rWrNtosxr1SrQmh1NcL5eJHbcfYUSsVUxmIhZiI7eaIUZuXCwXAiwznR4aAYRiiUCi+2W6+t3N5fu5XzxybObd8bP9bLy3MXcDA8RnM6TXYwBY+IsJNSvm9K81LH19emLv3hSenz7+6ePg7pxoHLqYxEAsxERs5kCtCab6mFABfPFwcBQKGYb5Z3iTufPn40T8N2g9sYAufINvVdW0rludnt31+8egbq3NZPSIHciFnGjkoAGlQZIzcEsBL+p7V+vTSwYPNsEXCFj7wDfSRsist8YFAuwgGYUzdnDp3GFs/GwqAHx2uDTUB/VJZtFvN1/BVPepG4ANfxPD2VaJcLn/zzImZt71tsllBTuTWbzokSkABSISPznkmIPX3/qY0F+LWCF/E8PIvFEqi2+n8ttd61vPIjRqS5KEAJKFH31wTULbTdETh+3GLhC9iePmXKlVRbpV/z2s963nkRg1J8lAAktCjb74JSNE2nU47bpGur47h5V8slcTp04+3vNbjzEfxQe5iqRTF5SdsKQA/gYQTJDA+BCgA43Oux2+nSlRsoxz7E61cXx3DC5zV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61Hno9ojN2qI6ne9PQXgeho8HikCSunX79X6rj2Hn/nZqBuDT0X7Ioa3rxSdTufuqUOL27xtsllBTuQWItkvCFEABG+jTKC90hSFYvV3D5w8id8ECrVV2MIHvoEOSpVUUXw30C5lAzenzp00LAUgKUH6556A49jbO5fEn+OrelCxsIEtfIJsV9e1rZicW3j74ZlnPrY6l9UjciAXcqaRgwKQBkXGyDUBR78X0OtZ2yv1zecm5+b/YOrI4s7JI6du3zc7fzMGjt05vQYb2MInyqb0twrv31Df9BeTs/Nfe+zZ0zt2zxz/oNff9F9v3m8OsRATsZEDuaLU5mdLAfCjw7WRInD1Jb3cpaR4XTjd87aU7sCxOyfkrqs28bbdbq0IIeU9vY71LdNwzq90rVQGYiEmYrs5RHo3CkB6LBlpCAjor57CsW2hhKrr463u0MfunH7TMOkWdDxh2z2EqQmlJlIZQtQQE7EROM1BAUiTJmORwJARoAAM2QljuaNHYJA7ogAMkj5zk8CACVAABnwCmJ4EBkmAAjBI+sxNAgMmECgAyX7QcMC7Y3oSyDmBLMsL07u+AtDudJUuEEM/8E4CJDBkBNS1HvYs21cALlnFtpRG7E9U8czKBRIggcwJoHfRw36JfAXgplwr6AAAEABJREFUS0sHm8VSMfZnqvkl5hoJkEC2BNC76GG/LL4CAEdL2PPFYrLPHUMcDhIggbUEsnyGnkXvBuUIFICzTx38qm33zgkR5i0FwRsJkMDACUj8OPI59G5QKYECgAA9afy6YcorgiIgeCOBfBOQAr2KnhUhbqEE4JXnDr3ZE8bPGIY8h5cWIeLShARIoM8E0JvoUfQqejZM+lACgEAIePbY4btsU+0qV6rnDMN8S0p5QY+LQkoOMuA1EOEaSKNn0Ht6XEAvoifRm+hR9Cp6NswILQCrwfB9xQtPTd91qWPskErtqJaKO2ocZMBroO/XAHoPPYheRE+iN1f7NOxjZAFYDYz/Xji7MPfuqcaBixxkwGtgMNcAehC9uNqXUR9jC0DURLQnARLIHwEKQP7OCSsacQJ52h4FIE9ng7WQQJ8JUAD6DJzpSCBPBCgAeTobrIUE+kyAAtBn4Ew33gTytvtIAtBoNEp7njzxyb1HTnxhz+x889DCsppbelXNneQgA14Dfb8GdO+hB9GLbk/q3kSPRhGZSALwg27l29K2v6GU/Rs6Se3ypR+LH717UfzohxxkwGug79eA7j30IHoRPYneRI/q56HvoQRgsnHitn1HTyqlnG1KKYEROgMNSYAEMieAnrw6nG3oVfRsmKShBEC1e/+5Z1lh4tGGBEjAg0C/ptGr6Nkw+QIFYM/c8V+u1usfCxOMNiRAAvkggJ5F7wZVEygAxYJ5qrXSDIrDdRIggRwRQM+id4NK8hWA3Y1GTSmnHhSE6yRAAvkjgN5FD/tV5isA2rHWs3o1/cg7CZBAAgKDcL3Wu7796ysAG8UGIQxfk0HsizlJgATCENC96/awjy272wcOl0hg1AlQAEb9DHN/JOBDgALgA4dLJJAGgTzHoADk+eywNhLImAAFIGPADE8CeSZAAcjz2WFtJJAxgSEUACUKhaKobdgkNr9vwh04xpwQ6fwlc8Sq6/hbdHwMHGNOpHIb9vpTgTDAIP3lv2XrhLhJX0dxBnzTv/7Woh8uAZCyW6lU/9i2e591LnZrxw/ulhg4xhzWhLZZu8Vwz6SU2lAqaRj/XdnigUvWxfqCjo+BY8xhTQht49qK6DddG2pEragZtWPgGHNYy3X90XecL49B8D+wW87r6yjOWNC+qV5/65yNoREAwzCF2TM+fPqpx39+eX72i6dPP95a3Q+O3Tm9BhvYrq6FeVRKCbNQeKdgGx9cPnb4b52ZP/ivX200VlZ9cYw5rMEGtvBZXQ/ziJpQ22ldo1vrkNUfZo95thkk/6Rc0rj+vGowvBbyNC+l/N7ZYzPyzImZt4Pqgg1s4RNki3VtJ4ql0jvvXGxuf+nEzP/Tc37fRyjYwBY+8NX2gXdtN9T1B24w5wY54p+UVKzrzy9p7gWgUq0Jy7Z+wW8T663BB77rrV0/p7/4K9F27vr95caV6+f9jl1b7eP6+hnqNdSAWvRhpDt84Bvk5Naga3FrCjK+tu7aah/X99rcqD6AIVhG3R984Bvk5zLULF2mNxhn9dTNpXO6uRMmybUAaOUWndbK1z+/ePSNqPuED3wRw89XGvKb+qv6d/1s1luDD3zXW1udQ27UgFpW58I+wge+iOHngxpQi5/Nemvwge96a6MyB3ZgCJZR9wQf+CKGny8YgqWfTRZryIncSWPnWgDwfVt148b9cTcJX8Tw8sc7+4Yyz+p1v5f9enndu4IvYqy7qieRGzXow1h3+CKGlzNyowa9nkn9Ou5Q38EODONuAr6I4eWfkL9X2LDzgddfmEC5FgD9zvjK5feaf/lmXJgNXW8DX8S4fu7643KlKt7rfv+r189FOYYvYnj5IDdq8FoPmocvYnjZITdq8FoPmocvYgTZDes62IFh3Prhixhe/mAHhl7rWc8jN2pIkifXAqD/S2xlY7UQWwBcXyk9/fUbeeJLS0uxP+4IvojheQJ0brcGTwP/BddXx/CyQm7U4LUeNA9fxAiyG9p1zc5lGHMDrq+O4eUOdmC43no/5pAbNSTJlW8BSLIz+pIACQQSyLcAKFW73Ir/iUSur47hRcHqdsUDBw7UvdaD5uGLGJ52Ordbg6eB/4Lrq2N4WSE3avBaD5qHL2IE2Q3tumbnMoy5AddXx/ByBzsw9FrPeh65UUOSPLkWANMs1DZurvt+pJHf5uGLGF42nXZLbC7dep/XetA8fBHDyw65UYPXetA8fBHDyw65UYPXetA8fBEjyG5Y18EODOPWD1/E8PIHOzD0Ws96HrlRQ5I8uRYAx7FF6/LlU3E3CF/E8PLv9SzhSHuvXsfPAeuHSHcJX8Tw8kJu1OC1HjQPX8TwskNu1KDXM6lfxx3qO9iBYdxNwBcxvPy9+HvZpzwfeP2FyZdrAcCP25artXsennkm8t8lgA98EcMPhHLU3fsOLX7Az2a9NfjAd7211TnkRg2oZXUu7CN84IsYfj6oAbX42ay3Bh/4rrc2KnNgB4ZgGXVP8IEvYvj5giFY+tlksYacyJ00dq4FAJtrt1ZE0Sz+JxxHGfCBb5CPlEKKivH6/ZONDUG2q+uurfZxfVcnPR5RA2rxWPachg98PQ2uLbg16Frcmq7NBT24ttrH9Q0yHvJ1MATLqNuAD3yD/FyGmqXLNMg4pXU3l87p5k4YM/cCgP1pFX7/3iOLaurQ4jY89xuwgS18/OxW17Sd0G+k3HbbRP1Nrap/Rc9LPbzuEjawhQ98vQyvn9d2Q13/9XsZxuMc8U+KL9b155d0KAQAG3D0+wF2wfn29NPPf2NybuE3pqefr2IeA8funF6DDWwxH3ZIKYXd693WM53vTB45/idTcyc/c/0fVMAx5rAGG9hK6acTP5kZNaG2aV3j5BDW/5M7Gq6ZfvHHNTJ1w/WTlFQa159XDUMjAO4GlCq1261P6ndmv2BMlFYOn3xVYeAYc1gT2sa1jfiP/iqhPZRUjvNz0hRf2lScaM7q+Bg4xhzWhNA2Ks5P3iL8kNevtzDUd31t4BoxzUL/rp+lV9Wcvo7ijFntm+r1t87JGy4BcDcgBd59XblySbz3w4vuwDHmhP52XqRwQ6ymjv9jHR8Dx5hLIbQOMez16y0M9b3P/N+9KH6kr6M448faN/3rb+3JG0IBWLsBPiMBEohPgAIQnx09SWANgWF8QgEYxrPGmkkgJQIUgJRAMgwJDCMBCsAwnjXWTAIpEaAApASSYcabwLDu3lcALosrQjjOsO6NdZPAeBPQvev2sA8FXwHQfiuFYsHzE3X0Ou8kQAI5JXCtd33711cA8AcJpDRif2RWTrmwLBIYCwLoXfSw32Z9BQCOVs/eX63F/tAchOAggZEmkMfNoWfRu0G1BQrAy/OH/0Or2Yz8ufxBiblOAiSQHQH0LHo3KEOgACCArBT+fqFYxCEHCZBAzgmgV9GzYcoMJQDLjUPvvPTMQam/p3hb/yMwwgSnDQmQQH8IoCevDuNt9Cp6NkzmUAKwGuiWUvvDyjR/Xkrzi3puZeOmLeKmBH//PM7fTKfPhCCD/DAY6LnQvYceRC+iJ9Gb6FH9PPQ9kgA0Go3uy88e+uOzxw599uWFufqJ2Uk5f2C3nD/IQQa8Bvp+DejeQw+iF92e1L2JHg3d/dowkgBoe95JgARGiAAFYIROJrdCAlEJUACiEqM9CVwjMAoPFIBROIvcAwnEJEABiAmObiQwCgQoAKNwFrkHEohJILYAPHDgZH3v7PzW/Y2lCQ4yGLdrIC/7RQ+iF2P2v4gsAHufPnnfY0+ffn1T2TmvpDzf6lrnVzjIgNdA368B9B56EL2InkRvRhWC0ALwyBMntu89cvx105avddqtnY5j366UulmPCaEUBxnwGujzNYDe0+Nm9CJ6Er2JHkWvhhWCUAKAgAXh/JnjqJ2W1Q0bm3YkQAJ9JIDeRI+iV9GzYVKHEoCCcn7HsdUGIWL+SawwldCGBIaEQL7LVAK9ip4NU2egAOD7CtMs7GTzh8FJGxLIAwElTN2z6N2gagIFoCjMOby0CArEdRIggfwQQM+id4Mq8hUA/PeC1bVuDQrCdRIggfwRQO+ih/0q8xWATUWropRT8QvANRIYJwLDtFf0LnrYr2ZfAaiUS1I7Y+gH3kmABIaMgLzWw55l+woAvPi+PyhwkMDwEQjTu4ECMHzbZsUkQAJhCVAAwpKi3dgTGEUAFIBRPKvcEwmEJEABCAmKZiQwigQoAKN4VrknEghJgAIQEhTNRoMA/niGYZpCCtnUx++6Qx8bpp6T0nOTYReklMI0C0LfVoSUF1MZQqwgppTJ69N1rblTANbg4JNRJlCp1fX21GtSibuEUdphKuUOHLtzQr121UabxbhXqjUhlPp6oVz8qO0YO2qlYioDsRATsd0cMWrzcqEAeJHh/MgQMAxDFArFN9vN93Yuz8/96pljM+eWj+1/66WFuQsYOD6DOb0GG9jCR0S4SSm/d6V56ePLC3P3vvDk9PlXFw9/51TjwMU0BmIhJmIjB3JFKM3XlALgi4eLo0DAMMw3y5vEnS8fP/qnQfuBDWzhE2S7uq5txfL87LbPLx7N/K9oIwdyIedq/iSPFIAk9OibewJ4Sd+zWp9eOniwGbZY2MIHvvDxHVJ2pSU+4GuTwaKbU+dOGpoCkJQg/XNLQL9UFu1W8zV8VY9aJHzgixjevkqUy+Vvnjkx87a3TTYryInc+k2HRAkoAInw0TnPBKT+3t+U5kLcGuGLGF7+hUJJdDud3/Zaz3oeuVFDkjwUgCT06JtrAsp2mo4ofD9ukfBFDC//UqUqyq3y73mtZz2P3KghSR4KQBJ69M03ASnaptNpxy0SvkLH8PIvlkri9OnHW17rWc8jd7FUSpSGApAIH51JYLgJUACG+/yxej8CSlRsoxz7E61cXx3DK4XV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61nPIzdqSJKHApCEHn1zTUAp/fq9Wt+15/AzPxu1UPhUtC9iePtK0el07p46tLjN2yabFeREbqHfpRQJbhSABPDomn8C7ZWmKBSrv3vg5En8JlCogmELH/gGOihVUkXx3UC7lA3cnDp30rAUgKQE6Z97Ao5jb+9cEn+Or+pBxcIGtvAJsl1d17Zicm7h7YdnnvnY6lxWj8iBXMiZRg4KQBoUGSPXBBz9XkCvZ22v1Defm5yb/4OpI4s7J4+cun3f7PzNGDh25/QabGALnyib0t8qvH9DfdNfTM7Of+2xZ0/v2D1z/IP7G0sTaQzEQkzERg7kilKbny0FwI8O10aKwNWX9HKXkuJ14XTP21K6A8funJC7rtrE23a7tSKElPf0Ota3TMM5v9K1UhmIhZiI7eYQ6d0oAOmxZKQhIKC/egrHtoUSqq6Pt7pDH7tz+k3DpFvQ8YRt9xCmJpSaSGUIUUNMxKXOUcQAAAHhSURBVEbgNAcFIE2ajEUCQ0aAAjBkJ4zlZk9gnDJQAMbpbHOvJHADAQrADUD4lATGiQAFYJzONvdKAjcQCBSA9D+J/IYK+JQEckRglEoJ07u+AtDudJUGgqEfeCcBEhgyAupaD3uW7SsAl6xiW0oj9ieqeGblAgmQQOYE0LvoYb9EvgLwpaWDzWKpGPsz1fwSc40ESCBbAuhd9LBfFl8BgKMl7PliMdnnjiEOBwnkncAo1YeeRe8G7SlQAM4+dfCrtt07J0SYtxQEbyRAAgMnIPHjyOfQu0GlBAoAAvSk8euGKa8IioDgjQTyTUAK9Cp6VoS4hRKAV5479GZPGD9jGPIcXlqEiEsTEiCBPhNAb6JH0avo2TDpQwkAAiHg2WOH77JNtatcqZ4zDPMtKeUFPdL5G+hp/S11xuH5iHENiCH0Qe/pcQG9iJ5Eb6JH0avo2TAjtACsBsP3FS88NX3XpY6xQyq1o1oq7qhxkAGvgb5fA+g99CB6ET2J3lzt07CPkQVgNTD+e+Hswty7pxoHLnKQAa+BwVwD6EH04mpfRn2MLQBRE9GeBEggfwQoAPk7J6yozwTGOR0FYJzPPvc+9gQoAGN/CRDAOBOgAIzz2efex54ABWDsL4HxBjDuu///AAAA//8pEgg1AAAABklEQVQDANTsRLN50QRTAAAAAElFTkSuQmCC" preserveAspectRatio="none"/><filter id="a" filterUnits="objectBoundingBox" x="-.05" y="-.03" width="1.09" height="1.09"><feOffset result="offOut" in="SourceAlpha" dy="2"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="3"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="D"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="E"/><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="F"/><g id="b"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#F"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="G"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="H"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="I"/><path fill="#697986" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="J"/><path fill="#697986" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="K"/><g id="c"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.04,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.30222222222222,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.49333333333333,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.995555555555555,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,52.257777777777775,0)" xlink:href="#K"/></g><pattern id="d" patternUnits="userSpaceOnUse" x="-53.45" y="8.62" width="76.8" height="76.8"><use xlink:href="#L" transform="translate(0, 0) scale(7.68,7.68)"/></pattern><path fill="#6f7681" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="M"/><path fill="#6f7681" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="N"/><path fill="#6f7681" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="O"/><g id="e"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#O"/></g><path fill="#6f7681" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="P"/><path fill="#6f7681" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="Q"/><path fill="#6f7681" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="R"/><path fill="#6f7681" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="S"/><g id="f"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,5.333333333333333,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.871111111111112,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.40888888888889,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.586666666666666,0)" xlink:href="#S"/></g><filter id="g" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="T"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="U"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="V"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="W"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="X"/><g id="h"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#X"/></g><path fill="#697986" d="M375-529L38-1026h238c37 0 48 9 63 32l215 343c8-25 17-47 31-68l173-270c15-21 26-37 57-37h227L704-540 1056 0H818c-37 1-57-23-71-46L529-403c-6 24-14 44-25 60L312-46c-14 20-33 47-67 46H24" id="Y"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="Z"/><g id="i"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.373333333333328,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.94666666666666,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,37.54666666666665,0)" xlink:href="#Z"/></g><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="aa"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="ab"/><g id="j"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#H"/></g><pattern id="k" patternUnits="userSpaceOnUse" x="-613.16" y="1.66" width="88.84" height="91.9"><use xlink:href="#ac" transform="translate(-1.5316689899764242, 7.105427357601002e-15) scale(9.190013939858911,9.190013939858911)"/></pattern><g id="l"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#X"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ad"/><g id="m"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.675555555555547,0)" xlink:href="#V"/></g><g id="n"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#H"/></g><path fill="#6f7681" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="ae"/><path fill="#6f7681" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="af"/><path fill="#6f7681" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="ag"/><path fill="#6f7681" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="ah"/><path fill="#6f7681" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="ai"/><g id="o"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,11.644444444444444,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.85333333333333,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.044444444444444,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.54666666666667,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,46.80888888888889,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,54.577777777777776,0)" xlink:href="#af"/></g><path fill="#6f7681" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="aj"/><path fill="#6f7681" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="ak"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="al"/><path fill="#6f7681" d="M395-1486V0H148v-1486h247" id="am"/><g id="p"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.155555555555555,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.26222222222222,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.36888888888889,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.47555555555556,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.977777777777774,0)" xlink:href="#am"/></g><pattern id="q" patternUnits="userSpaceOnUse" x="-326.7" y="1.66" width="88.84" height="91.9"><use xlink:href="#ac" transform="translate(-1.531668989976481, 7.105427357601002e-15) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#697986" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="an"/><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ao"/><g id="r"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.72888888888888,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.608888888888877,0)" xlink:href="#ao"/></g><pattern id="s" patternUnits="userSpaceOnUse" x="-613.16" y="321.58" width="88.84" height="91.9"><use xlink:href="#ac" transform="translate(-1.5316689899764242, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ap"/><path fill="#6f7681" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="aq"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ar"/><path fill="#6f7681" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="as"/><path fill="#6f7681" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="at"/><path fill="#6f7681" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="au"/><g id="t"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,12.622222222222222,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.72888888888889,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.608888888888888,0)" xlink:href="#ar"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.715555555555554,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.217777777777776,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.324444444444445,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,66.20444444444445,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,71.02222222222223,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.50222222222222,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,88.8088888888889,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,95.68888888888891,0)" xlink:href="#af"/></g><g id="u"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.106666666666667,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,17.875555555555557,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,27.377777777777784,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.64,0)" xlink:href="#ai"/></g><g id="v"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,6.879999999999997,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.648888888888884,0)" xlink:href="#ao"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="av"/><g id="w"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.968888888888882,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.44888888888888,0)" xlink:href="#V"/></g><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aw"/><g id="x"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.479999999999997,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.58666666666666,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.69333333333332,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,38.79999999999998,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.3022222222222,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,56.782222222222195,0)" xlink:href="#X"/></g><path fill="#6f7681" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ax"/><path fill="#6f7681" d="M415-222h579V0H146v-1446h269v1224" id="ay"/><g id="y"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.96888888888889,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,25.546666666666667,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.73777777777778,0)" xlink:href="#Q"/></g><filter id="z" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><g id="A"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.533333333333328,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.453333333333322,0)" xlink:href="#F"/></g><g id="B"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.737777777777772,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,21.55555555555555,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.05777777777777,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.16444444444443,0)" xlink:href="#X"/></g><path fill="#697986" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="az"/><path fill="#697986" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="aA"/><path fill="#697986" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="aB"/><g id="C"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#az"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.115555555555538,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.933333333333316,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,44.71999999999998,0)" xlink:href="#aB"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/mcp-access/architecture-stdio.svg b/docs/img/mcp-access/architecture-stdio.svg
new file mode 100644
index 0000000000000..10204ff0f900f
--- /dev/null
+++ b/docs/img/mcp-access/architecture-stdio.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1264.83" height="503.25"><g transform="translate(1386.7635081265757 54.87397770989401)" lucid:page-tab-id="vEfyK7~VCnsd"><path d="M-1500-500H0V500h-1500z" fill="#fff"/><path d="M-253.44-49.87a3 3 0 0 1 3-3h122a3 3 0 0 1 3 3V71a3 3 0 0 1-3 3h-122a3 3 0 0 1-3-3z" stroke="#becacf" fill="#fff" filter="url(#a)"/><path d="M-253.44 92.7a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v16.76a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-253.4355135013716,86.6973905803361) translate(12.488888888888894 21.380000000000003)"/><use xlink:href="#c" transform="matrix(1,0,0,1,-253.4355135013716,86.6973905803361) translate(55.48444444444445 21.380000000000003)"/><path d="M-227.84-27.83h76.8v76.8h-76.8z" fill="url(#d)"/><path d="M-409.9 7.13h137.46M-409.87 7.13h-1.03" stroke="#697986" stroke-width="2" fill="none"/><path d="M-257.17 7.13l-14.27 4.63V2.5z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#e" transform="matrix(1,0,0,1,-357.4441819719518,11.12602229010555) translate(5.249444444444446 17.546666666666667)"/><use xlink:href="#f" transform="matrix(1,0,0,1,-357.4441819719518,11.12602229010555) translate(0.004999999999999005 38.879999999999995)"/><path d="M-806-46.87a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-806 93.13a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#h" transform="matrix(1,0,0,1,-806.0154678120387,87.12602228998958) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#i" transform="matrix(1,0,0,1,-806.0154678120387,87.12602228998958) translate(9.475555555555573 38.87999999999998)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-806.0154678120387,87.12602228998958) translate(59.937777777777775 38.87999999999998)"/><path d="M-787.55-28.8a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#k)"/><path d="M-519.55-46.87a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-519.55 92.04a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#l" transform="matrix(1,0,0,1,-519.5514704994794,86.04003558905015) translate(12.475555555555573 17.54666666666666)"/><use xlink:href="#m" transform="matrix(1,0,0,1,-519.5514704994794,86.04003558905015) translate(82.79555555555555 17.54666666666666)"/><use xlink:href="#n" transform="matrix(1,0,0,1,-519.5514704994794,86.04003558905015) translate(34.70666666666668 38.87999999999998)"/><path d="M-521.55 11.13H-659.5" stroke="#697986" stroke-width="2" fill="none"/><path d="M-520.55 12.1h-1.03v-1.95h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-674.78 11.13l14.27-4.64v9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#o" transform="matrix(1,0,0,1,-631.3234441557593,15.12602229010599) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#p" transform="matrix(1,0,0,1,-631.3234441557593,15.12602229010599) translate(5.147222222222222 38.879999999999995)"/><path d="M-501.1-28.8a6 6 0 0 1 6-6h76.85a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#q)"/><path d="M-806 273.05a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-806 413.05a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#h" transform="matrix(1,0,0,1,-806.0154678120387,407.0450354453069) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#r" transform="matrix(1,0,0,1,-806.0154678120387,407.0450354453069) translate(13.133333333333354 38.87999999999998)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-806.0154678120387,407.0450354453069) translate(56.28 38.87999999999998)"/><path d="M-787.55 291.13a6 6 0 0 1 6-6h76.83a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.83a6 6 0 0 1-6-6z" fill="url(#s)"/><path d="M-636.04 325.08l-.08 1.06-.26 1.06-.42 1-.57.95-.7.83-.84.7-.95.58-1 .42-1.07.26-1.06.08h-15.53v-1.95h15.45l.82-.06.77-.18.72-.3.68-.4.6-.52.5-.6.42-.68.3-.72.2-.77.05-.82V212.4h1.96zm-5.88-274.93l1.06.26 1 .43.95.57.82.7.7.84.58.94.42 1 .26 1.07.08 1.06v112.7H-638V57.1l-.05-.82-.2-.77-.3-.73-.4-.68-.5-.6-.6-.52-.7-.4-.7-.3-.78-.2-.82-.06h-32.97v-1.95h33.04z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-676 52.02h-1v-1.95h1z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-659.5 335.68l-14.28-4.63 14.27-4.64z" fill="#697986"/><path d="M-658.54 337.02l-18.4-5.97 18.4-5.98zm-12.08-5.97l10.13 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#t" transform="matrix(1,0,0,1,-689.6110733675939,169.7117194971543) translate(0 17.546666666666667)"/><use xlink:href="#u" transform="matrix(1,0,0,1,-689.6110733675939,169.7117194971543) translate(31.39611111111112 38.879999999999995)"/><path d="M-1085.4-46.87a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#g)"/><path d="M-1103.55 93.13a6 6 0 0 1 6-6h152.3a6 6 0 0 1 6 6v16.33a6 6 0 0 1-6 6h-152.3a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#v" transform="matrix(1,0,0,1,-1103.5495808695734,87.12602229018557) translate(18.108888888888913 21.379999999999995)"/><use xlink:href="#w" transform="matrix(1,0,0,1,-1103.5495808695734,87.12602229018557) translate(46.295555555555566 21.379999999999995)"/><use xlink:href="#x" transform="matrix(1,0,0,1,-1103.5495808695734,87.12602229018557) translate(83.22888888888889 21.379999999999995)"/><path d="M-993.48-17.06h-54.87c-3.06 0-5.73 2.66-5.73 5.75v43.35c0 3.32 2.47 5.75 5.53 5.75l25.44.45h29.88c3.07 0 5.73-2.66 5.73-5.76V-11.3c-.2-3.1-2.65-5.76-5.98-5.76zm-32.7 27.2l-11.12 7.75c-1.06.66-2.4.44-3.06-.45-.66-1.1-.46-2.43.47-3.1l8.4-5.97-8.4-5.97c-1.12-.65-1.32-1.98-.46-3.1.67-1.1 2-1.32 3.06-.43l11.13 7.74c.66.46.86 1.12.86 1.78 0 .67-.48 1.33-.88 1.77zm22.98 10.4h-17.7c-1.35 0-2.2-.88-2.2-2.2 0-1.33.85-2.2 2.2-2.2l17.7-.02c1.33 0 2.2.9 2.2 2.22 0 1.32-.87 2.2-2.2 2.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M-955.4 11.13h130.88" stroke="#697986" stroke-width="2" fill="none"/><path d="M-955.37 12.1h-1.03v-1.95h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-809.25 11.13l-14.27 4.63V6.5z" stroke="#697986" stroke-width="2" fill="#697986"/><g><use xlink:href="#y" transform="matrix(1,0,0,1,-903.344803076074,15.12602229022241) translate(0.004999999999999005 17.546666666666667)"/></g><g filter="url(#z)"><path d="M-1380.76-46.87a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M-1380.76 93.13a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#A" transform="matrix(1,0,0,1,-1380.7635081265757,87.126022290106) translate(18.480000000000018 17.54666666666666)"/><use xlink:href="#B" transform="matrix(1,0,0,1,-1380.7635081265757,87.126022290106) translate(61.47555555555556 17.54666666666666)"/><use xlink:href="#C" transform="matrix(1,0,0,1,-1380.7635081265757,87.126022290106) translate(38.97333333333334 38.87999999999998)"/></g><path d="M-1301.5-3.1c0 8.53-6.88 15.4-15.4 15.4-8.5 0-15.44-6.87-15.44-15.4 0-8.55 6.94-15.43 15.45-15.43 8.52 0 15.4 6.88 15.4 15.42zM-1344.2 36.04c0-10.5 8.52-18.98 19-18.98h14.2c10.5 0 19 8.48 19 18.98 0 2.6-2.13 4.75-4.74 4.75h-42.7c-2.6 0-4.75-2.15-4.75-4.76z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-1250.76 11.13h145.86" stroke="#697986" stroke-width="2" fill="none"/><path d="M-1250.74 12.1h-1.02v-1.95h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-1089.63 11.13l-14.27 4.63V6.5z" stroke="#697986" stroke-width="2" fill="#697986"/><defs><image width="10" height="10" id="L" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aeyde4xc133fz7l33sOXzNXDdGXLQOmGtotUCWWlBZwWbdMk0h+pmAqxU6uKlYoSl0tHKz6Wu5So0YO7XHIpqhK5guQ2dus2cRxEbovYbdAWBRw0qCsmAdrIbKE/XFi1LJuUbZGcncede0/P95IbcOm973tn7sx8B3M4d875vc7n3t93Z4e7s4bgjQRIYGwJUADG9tRz4yQgBAWAVwEJjDEBCsAYn3xufbwJYPcUAFDgIIExJUABGNMTz22TAAhQAECBgwTGlMBQCcC+ffvKuxtLE/s5yCCH1wCuzUajURoGLVmtcSgEoNF4pbZn9rn/Im760P82u9b5lh4rHOfJwMoNA1yTuDZ/qDb+nz2z83/UaHyhstpkeX7MuwDIfU8sHrxctJpSmn+3Z3XvEEpNKD3wyKEmyCAfDFavSavbvkNK+Q/eMy+1po6euj/PzY/aci0Ae2YX/pftOCdWrlzS17lCvRwkkHMC0r1W2ytNoZzeVz535OSv5LngnAqAklNPnPiXhiE/ppU1z/xYGwl4EnBsWxSr5X87/fw/f5+n0QAWrk+ZSwHYc/j4FmkY/8RxnOtr5TEJDB2Bln4l0LrwgxfyWnguBUAa4k/snpVXZqyLBEITwCvYgmn+3P05/d+B3AnAo4cX7jTNwk8BXGjKNCSBHBMoFIrbt/WqH85jibkTgGKp8HCPX/3zeK2wppgEOp22cKTxP2K6p+p2Y7DcCYB+4+SBG4vkcxIYdgKOY2+aOrr0i3nbR64EYPLwwpP6zb8NeYPEekggKQG8oe3Yvd9MGidt/9wIQKPRKBRKpWfsXi/tPTIeCeSCgJTy/ry9GZgbAfh+t/Ipy+rk4kSxCBLIhIAS4pZe9dVMYocIup5JbgRAKPX4egVyjgRGhYB+H0AYhvng3tn5rXnZUy4E4OHZxkdq9Q135gUK6yCBrAj0rK4wzOI/yip+1Li5EIAN1S1fXmlejlo77UlgKAn0nN5zeSl84AKgXw59pNVq7sgLENZBAlkTKJcqE48efu6+rPNcH9/reOACIE35GUMaQ/G7014QOU8CUQh0Oi1RqdaXovhkZTtwASiWqk/yx36zOr2Mm1cCnXbr9s81Tn580PUNVACmZhde6nbag2bA/CTQfwJSFntdNdP/xGszDkwApqefr8pC4V78hNTakviMBMaAgFKiWq9+Zl+jsSnr3frFH5gANDe3PySkyOVvSPkB4xoJpEVgpXlF9KzSv0krXpw4AxOAUs/8Rs+y4tRMHxIYDQL6VYAUxicG+SpgIAKw9+jiL0gpbxa8kcCYEzBN8xblVP7moDAMQgCkUHJfj7/0M6hzzrw5IoBXwaZR/MOsSgqK23cB0G/+VYTt3BtUGNdJYFwIWJZVmDq6+NlB7LfvAmDVrCVhyL7nHQRc5iSBMASU4win5zyolJJh7NO06WsjTjYaG4rlyqRj22nugbFIYOgJmIXC3374sflb+r2RvgqAYVcebbea/d4j85FA7gnYPVuUa+aX0yw0TKy+CoDdcz4XpijakMC4EVDKEYVy8e9MHXi2rz8b0zcBeHjm2C+WKpXbx+3Ecr8kEJZAt9MR5ob6Pw5rn4Zd3wSgVq3+i267nUbNjEECI0vA6naf6Ofm+iIA+xqLn+i027f1c2PMRQLDSMA0zfLk3PHfSlp7WP++CIBjqUekFKbgjQRIwJdAr2cJwzSf3r17d9HXMKXFzAVg9yuvFKu1+kMp1cswJDDyBHqWtam2bfsn+7HRzAWg8H/f/ff4rad+bIY5SGAUCOhXy7Lbteb6sZdMBeA3G8+/TxrmXUqpfuyFOUhgZAjU6hv/3lRjcVucDUXxyVQAar3eTillbj4DPQoY2pLAIAk0r1wWquN8PesaMhUAYciv2nYv6z0wPgmMJAH9uvmv7p479v4sN5eZAOw9svSgcpxalsUzNgmMMgFpGvWiYe7Kco+ZCMD993/FFMraY/OXfrI8d4w94gTwS3OlUuVMlG1Gtc1EAG798LdvFYZxd9RiaE8CJLCWQKfTFvuOnMjsfwQyEQBlOp/nO/9rTySfkUAcAvrbaGEL51O7d7+SyQ8GpS4ADx1qbCvX6/eg8Dgbpg8JkMBaAqZZ+Oty67vb186m8yx1AdhU3/S5VvNKOtUxCgmQgLB7ljCE/FoQijjrRhwnP59uu/Oo3zrXSIAEohHAt9PFUumOqSPP7YzmGWydqgDsmVv4p2ahsDk4LS1IgASiELC6HVEsb0j9g0PTFACpv1d5Eb/NFGVjtCUBEghHQP+PwGQ4y/BWqQnAbz1x6t6eZfHPfIdnT0sSiERASimmnjxxcj2nuHOpCYBld/fq+vr+scZxN04/Ehg2AvjBIOWo6TT/lFgqAvBY4/SW2saNvzRsQFkvCQwbAcexTceq3pdW3akIQKfb/m/Ny5fSqolxSIAEfAmoad/lCIuJBeDRwwt36Nf9d0TISVMSIIEEBCq1+k9PHjz2N1ZDJHlMLAAF07hHCMnf+hO8kUB/CKxcuSyMSukP08iWWACMQuElpZw0amEMEiCBkATsXu+Wqdn5nwpp7mmWSAD2Hjk+pwtJFMOzMi6QAAl4EtD/41a0hfGIp0HIhdjNu+/FF8tCiQf1u5IhU9GMBEggLQJKKVGpVh9LGi+2APTeufzXpGF8JGkB9CcBEohHoNNeEVNHl16M533VK7YACGF8mV/9r0LkvyQwCAJ4FeD0rH842Ti7IW7+WALwyMwzP12t1HaggLiJ6UcCJJCcgGkWbjft5p1xI8USgA0bNk+3Wvyd/7jQ6UcCaRBADPzynWX1/iuO44xYArDSWvm0EFLwRgIkMHgCxVLJfGTmuV+JU0lkAZicPf6IftlRipOMPiRAAukT6HU7olbf+Kk4kSMLgFL2UYd/7CMOa/qQQDYEpBSdduvuRqMRuZ8jO2zYtGWbcviTf9mcSUYlgXAEbrTSPfnBNz760cjfl0cWAAfNHznNjeXyOQmQQKoEDGle+Na3IndmZAHotlsdwTcABW8kkCsCSvzg5jfeUFFriiwAyhDLhmFGzUN7EiCBDAkUCub//P2vfCXy9+aRBWDCWDkkRGShyXDrDE0C40Xgxt2apilsx/53QsrIjRlZAPQ7jT2jUPjijUXwOQmQwGAI6P+Z++HysdkzcbJHFgAkeenpAw8VS+X/aBYKeMpBAiQwIAKGab6nit0PxU0fSwB0MvXi0/t/WTjqj/SxJWXkNx+1G+8kQAJxCEgp9at9PQzzrbPPzWxZbjRi/1x+XAFw6z5zbOaXjELlTiHNJSnEhY2bt4ibtk6Im97HQQa8BtK+BjZv2Sp043WFkP+qaBY/sXxsJvZXfnHtlkgAEOPss4+/sXzs0MHlhblbThyelPMHdsv5gxxkwGsg7Wvg+Mwj8uWFufLy/OEH/9mzB17X/Rf5TT/ts+aeWADWROMTEiCBoSJAARiq08ViSSBdAhSAdHkyGglkRiCLwBSALKgyJgkMCQEKwJCcKJZJAlkQoABkQZUxSWBICMQWgAcOnKzvnZ3fur+xNMFBBrwGsr0GvPiiB9GLcfUmsgDsffrkfY89ffr1TWXnvJLyfKtrnV/hIANeA32/BtB76EH0InoSvRlVCEILwCNPnNi+98jx101bvtZpt3Y6jn27UupmPSaEUhxkwGugz9cAek+Pm9GL6En0JnoUvRpWCEIJAAIWhPNnjqN2WlY3bGzakQAJ9JEAehM9il5Fz4ZJHUoACsr5HcdWG/g5AGGQ0oYE0iUQLZoS6FX0bBi/QAHA9xWmWdjJ5g+DkzYkkAcCSpi6Z9G7QdUECkBRmHN4aREUiOskQAL5IYCeRe8GVeQrAPjvBatr3RoUhOskQAL5I4DeRQ/7VeYrAJuKVkUpp+IXgGskQALZEUgSGb2LHvaL4SsAlXJJamcM/cA7CZDAkBGQ13rYs2xfAYBX4k8cQBAOEiCBvhMI07uBAtD3qpmQBEigbwQoAH1DzUQkEI1AP6wpAP2gzBwkkFMCFICcnhiWRQL9IEAB6Adl5iCBnBKgAOT0xLCsbAhIKYVhmkIK2ZRSvusOfWyYek5KkfQmpRSmWRD6tiKkvBh3rPETYgUxpUxen65rzZ0CsAYHn4wygUqtrrenXpNK3CWM0g5TKXfg2J0T6rWrNtosxr1SrQmh1NcL5eJHbcfYUSsVUxmIhZiI7eaIUZuXCwXAiwznR4aAYRiiUCi+2W6+t3N5fu5XzxybObd8bP9bLy3MXcDA8RnM6TXYwBY+IsJNSvm9K81LH19emLv3hSenz7+6ePg7pxoHLqYxEAsxERs5kCtCab6mFABfPFwcBQKGYb5Z3iTufPn40T8N2g9sYAufINvVdW0rludnt31+8egbq3NZPSIHciFnGjkoAGlQZIzcEsBL+p7V+vTSwYPNsEXCFj7wDfSRsist8YFAuwgGYUzdnDp3GFs/GwqAHx2uDTUB/VJZtFvN1/BVPepG4ANfxPD2VaJcLn/zzImZt71tsllBTuTWbzokSkABSISPznkmIPX3/qY0F+LWCF/E8PIvFEqi2+n8ttd61vPIjRqS5KEAJKFH31wTULbTdETh+3GLhC9iePmXKlVRbpV/z2s963nkRg1J8lAAktCjb74JSNE2nU47bpGur47h5V8slcTp04+3vNbjzEfxQe5iqRTF5SdsKQA/gYQTJDA+BCgA43Oux2+nSlRsoxz7E61cXx3DC5zV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61Hno9ojN2qI6ne9PQXgeho8HikCSunX79X6rj2Hn/nZqBuDT0X7Ioa3rxSdTufuqUOL27xtsllBTuQWItkvCFEABG+jTKC90hSFYvV3D5w8id8ECrVV2MIHvoEOSpVUUXw30C5lAzenzp00LAUgKUH6556A49jbO5fEn+OrelCxsIEtfIJsV9e1rZicW3j74ZlnPrY6l9UjciAXcqaRgwKQBkXGyDUBR78X0OtZ2yv1zecm5+b/YOrI4s7JI6du3zc7fzMGjt05vQYb2MInyqb0twrv31Df9BeTs/Nfe+zZ0zt2zxz/oNff9F9v3m8OsRATsZEDuaLU5mdLAfCjw7WRInD1Jb3cpaR4XTjd87aU7sCxOyfkrqs28bbdbq0IIeU9vY71LdNwzq90rVQGYiEmYrs5RHo3CkB6LBlpCAjor57CsW2hhKrr463u0MfunH7TMOkWdDxh2z2EqQmlJlIZQtQQE7EROM1BAUiTJmORwJARoAAM2QljuaNHYJA7ogAMkj5zk8CACVAABnwCmJ4EBkmAAjBI+sxNAgMmECgAyX7QcMC7Y3oSyDmBLMsL07u+AtDudJUuEEM/8E4CJDBkBNS1HvYs21cALlnFtpRG7E9U8czKBRIggcwJoHfRw36JfAXgplwr6AAAEABJREFUS0sHm8VSMfZnqvkl5hoJkEC2BNC76GG/LL4CAEdL2PPFYrLPHUMcDhIggbUEsnyGnkXvBuUIFICzTx38qm33zgkR5i0FwRsJkMDACUj8OPI59G5QKYECgAA9afy6YcorgiIgeCOBfBOQAr2KnhUhbqEE4JXnDr3ZE8bPGIY8h5cWIeLShARIoM8E0JvoUfQqejZM+lACgEAIePbY4btsU+0qV6rnDMN8S0p5QY+LQkoOMuA1EOEaSKNn0Ht6XEAvoifRm+hR9Cp6NswILQCrwfB9xQtPTd91qWPskErtqJaKO2ocZMBroO/XAHoPPYheRE+iN1f7NOxjZAFYDYz/Xji7MPfuqcaBixxkwGtgMNcAehC9uNqXUR9jC0DURLQnARLIHwEKQP7OCSsacQJ52h4FIE9ng7WQQJ8JUAD6DJzpSCBPBCgAeTobrIUE+kyAAtBn4Ew33gTytvtIAtBoNEp7njzxyb1HTnxhz+x889DCsppbelXNneQgA14Dfb8GdO+hB9GLbk/q3kSPRhGZSALwg27l29K2v6GU/Rs6Se3ypR+LH717UfzohxxkwGug79eA7j30IHoRPYneRI/q56HvoQRgsnHitn1HTyqlnG1KKYEROgMNSYAEMieAnrw6nG3oVfRsmKShBEC1e/+5Z1lh4tGGBEjAg0C/ptGr6Nkw+QIFYM/c8V+u1usfCxOMNiRAAvkggJ5F7wZVEygAxYJ5qrXSDIrDdRIggRwRQM+id4NK8hWA3Y1GTSmnHhSE6yRAAvkjgN5FD/tV5isA2rHWs3o1/cg7CZBAAgKDcL3Wu7796ysAG8UGIQxfk0HsizlJgATCENC96/awjy272wcOl0hg1AlQAEb9DHN/JOBDgALgA4dLJJAGgTzHoADk+eywNhLImAAFIGPADE8CeSZAAcjz2WFtJJAxgSEUACUKhaKobdgkNr9vwh04xpwQ6fwlc8Sq6/hbdHwMHGNOpHIb9vpTgTDAIP3lv2XrhLhJX0dxBnzTv/7Woh8uAZCyW6lU/9i2e591LnZrxw/ulhg4xhzWhLZZu8Vwz6SU2lAqaRj/XdnigUvWxfqCjo+BY8xhTQht49qK6DddG2pEragZtWPgGHNYy3X90XecL49B8D+wW87r6yjOWNC+qV5/65yNoREAwzCF2TM+fPqpx39+eX72i6dPP95a3Q+O3Tm9BhvYrq6FeVRKCbNQeKdgGx9cPnb4b52ZP/ivX200VlZ9cYw5rMEGtvBZXQ/ziJpQ22ldo1vrkNUfZo95thkk/6Rc0rj+vGowvBbyNC+l/N7ZYzPyzImZt4Pqgg1s4RNki3VtJ4ql0jvvXGxuf+nEzP/Tc37fRyjYwBY+8NX2gXdtN9T1B24w5wY54p+UVKzrzy9p7gWgUq0Jy7Z+wW8T663BB77rrV0/p7/4K9F27vr95caV6+f9jl1b7eP6+hnqNdSAWvRhpDt84Bvk5Naga3FrCjK+tu7aah/X99rcqD6AIVhG3R984Bvk5zLULF2mNxhn9dTNpXO6uRMmybUAaOUWndbK1z+/ePSNqPuED3wRw89XGvKb+qv6d/1s1luDD3zXW1udQ27UgFpW58I+wge+iOHngxpQi5/Nemvwge96a6MyB3ZgCJZR9wQf+CKGny8YgqWfTRZryIncSWPnWgDwfVt148b9cTcJX8Tw8sc7+4Yyz+p1v5f9enndu4IvYqy7qieRGzXow1h3+CKGlzNyowa9nkn9Ou5Q38EODONuAr6I4eWfkL9X2LDzgddfmEC5FgD9zvjK5feaf/lmXJgNXW8DX8S4fu7643KlKt7rfv+r189FOYYvYnj5IDdq8FoPmocvYnjZITdq8FoPmocvYgTZDes62IFh3Prhixhe/mAHhl7rWc8jN2pIkifXAqD/S2xlY7UQWwBcXyk9/fUbeeJLS0uxP+4IvojheQJ0brcGTwP/BddXx/CyQm7U4LUeNA9fxAiyG9p1zc5lGHMDrq+O4eUOdmC43no/5pAbNSTJlW8BSLIz+pIACQQSyLcAKFW73Ir/iUSur47hRcHqdsUDBw7UvdaD5uGLGJ52Ordbg6eB/4Lrq2N4WSE3avBaD5qHL2IE2Q3tumbnMoy5AddXx/ByBzsw9FrPeh65UUOSPLkWANMs1DZurvt+pJHf5uGLGF42nXZLbC7dep/XetA8fBHDyw65UYPXetA8fBHDyw65UYPXetA8fBEjyG5Y18EODOPWD1/E8PIHOzD0Ws96HrlRQ5I8uRYAx7FF6/LlU3E3CF/E8PLv9SzhSHuvXsfPAeuHSHcJX8Tw8kJu1OC1HjQPX8TwskNu1KDXM6lfxx3qO9iBYdxNwBcxvPy9+HvZpzwfeP2FyZdrAcCP25artXsennkm8t8lgA98EcMPhHLU3fsOLX7Az2a9NfjAd7211TnkRg2oZXUu7CN84IsYfj6oAbX42ay3Bh/4rrc2KnNgB4ZgGXVP8IEvYvj5giFY+tlksYacyJ00dq4FAJtrt1ZE0Sz+JxxHGfCBb5CPlEKKivH6/ZONDUG2q+uurfZxfVcnPR5RA2rxWPachg98PQ2uLbg16Frcmq7NBT24ttrH9Q0yHvJ1MATLqNuAD3yD/FyGmqXLNMg4pXU3l87p5k4YM/cCgP1pFX7/3iOLaurQ4jY89xuwgS18/OxW17Sd0G+k3HbbRP1Nrap/Rc9LPbzuEjawhQ98vQyvn9d2Q13/9XsZxuMc8U+KL9b155d0KAQAG3D0+wF2wfn29NPPf2NybuE3pqefr2IeA8funF6DDWwxH3ZIKYXd693WM53vTB45/idTcyc/c/0fVMAx5rAGG9hK6acTP5kZNaG2aV3j5BDW/5M7Gq6ZfvHHNTJ1w/WTlFQa159XDUMjAO4GlCq1261P6ndmv2BMlFYOn3xVYeAYc1gT2sa1jfiP/iqhPZRUjvNz0hRf2lScaM7q+Bg4xhzWhNA2Ks5P3iL8kNevtzDUd31t4BoxzUL/rp+lV9Wcvo7ijFntm+r1t87JGy4BcDcgBd59XblySbz3w4vuwDHmhP52XqRwQ6ymjv9jHR8Dx5hLIbQOMez16y0M9b3P/N+9KH6kr6M448faN/3rb+3JG0IBWLsBPiMBEohPgAIQnx09SWANgWF8QgEYxrPGmkkgJQIUgJRAMgwJDCMBCsAwnjXWTAIpEaAApASSYcabwLDu3lcALosrQjjOsO6NdZPAeBPQvev2sA8FXwHQfiuFYsHzE3X0Ou8kQAI5JXCtd33711cA8AcJpDRif2RWTrmwLBIYCwLoXfSw32Z9BQCOVs/eX63F/tAchOAggZEmkMfNoWfRu0G1BQrAy/OH/0Or2Yz8ufxBiblOAiSQHQH0LHo3KEOgACCArBT+fqFYxCEHCZBAzgmgV9GzYcoMJQDLjUPvvPTMQam/p3hb/yMwwgSnDQmQQH8IoCevDuNt9Cp6NkzmUAKwGuiWUvvDyjR/Xkrzi3puZeOmLeKmBH//PM7fTKfPhCCD/DAY6LnQvYceRC+iJ9Gb6FH9PPQ9kgA0Go3uy88e+uOzxw599uWFufqJ2Uk5f2C3nD/IQQa8Bvp+DejeQw+iF92e1L2JHg3d/dowkgBoe95JgARGiAAFYIROJrdCAlEJUACiEqM9CVwjMAoPFIBROIvcAwnEJEABiAmObiQwCgQoAKNwFrkHEohJILYAPHDgZH3v7PzW/Y2lCQ4yGLdrIC/7RQ+iF2P2v4gsAHufPnnfY0+ffn1T2TmvpDzf6lrnVzjIgNdA368B9B56EL2InkRvRhWC0ALwyBMntu89cvx105avddqtnY5j366UulmPCaEUBxnwGujzNYDe0+Nm9CJ6Er2JHkWvhhWCUAKAgAXh/JnjqJ2W1Q0bm3YkQAJ9JIDeRI+iV9GzYVKHEoCCcn7HsdUGIWL+SawwldCGBIaEQL7LVAK9ip4NU2egAOD7CtMs7GTzh8FJGxLIAwElTN2z6N2gagIFoCjMOby0CArEdRIggfwQQM+id4Mq8hUA/PeC1bVuDQrCdRIggfwRQO+ih/0q8xWATUWropRT8QvANRIYJwLDtFf0LnrYr2ZfAaiUS1I7Y+gH3kmABIaMgLzWw55l+woAvPi+PyhwkMDwEQjTu4ECMHzbZsUkQAJhCVAAwpKi3dgTGEUAFIBRPKvcEwmEJEABCAmKZiQwigQoAKN4VrknEghJgAIQEhTNRoMA/niGYZpCCtnUx++6Qx8bpp6T0nOTYReklMI0C0LfVoSUF1MZQqwgppTJ69N1rblTANbg4JNRJlCp1fX21GtSibuEUdphKuUOHLtzQr121UabxbhXqjUhlPp6oVz8qO0YO2qlYioDsRATsd0cMWrzcqEAeJHh/MgQMAxDFArFN9vN93Yuz8/96pljM+eWj+1/66WFuQsYOD6DOb0GG9jCR0S4SSm/d6V56ePLC3P3vvDk9PlXFw9/51TjwMU0BmIhJmIjB3JFKM3XlALgi4eLo0DAMMw3y5vEnS8fP/qnQfuBDWzhE2S7uq5txfL87LbPLx7N/K9oIwdyIedq/iSPFIAk9OibewJ4Sd+zWp9eOniwGbZY2MIHvvDxHVJ2pSU+4GuTwaKbU+dOGpoCkJQg/XNLQL9UFu1W8zV8VY9aJHzgixjevkqUy+Vvnjkx87a3TTYryInc+k2HRAkoAInw0TnPBKT+3t+U5kLcGuGLGF7+hUJJdDud3/Zaz3oeuVFDkjwUgCT06JtrAsp2mo4ofD9ukfBFDC//UqUqyq3y73mtZz2P3KghSR4KQBJ69M03ASnaptNpxy0SvkLH8PIvlkri9OnHW17rWc8jd7FUSpSGApAIH51JYLgJUACG+/yxej8CSlRsoxz7E61cXx3DK4XV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61nPIzdqSJKHApCEHn1zTUAp/fq9Wt+15/AzPxu1UPhUtC9iePtK0el07p46tLjN2yabFeREbqHfpRQJbhSABPDomn8C7ZWmKBSrv3vg5En8JlCogmELH/gGOihVUkXx3UC7lA3cnDp30rAUgKQE6Z97Ao5jb+9cEn+Or+pBxcIGtvAJsl1d17Zicm7h7YdnnvnY6lxWj8iBXMiZRg4KQBoUGSPXBBz9XkCvZ22v1Defm5yb/4OpI4s7J4+cun3f7PzNGDh25/QabGALnyib0t8qvH9DfdNfTM7Of+2xZ0/v2D1z/IP7G0sTaQzEQkzERg7kilKbny0FwI8O10aKwNWX9HKXkuJ14XTP21K6A8funJC7rtrE23a7tSKElPf0Ota3TMM5v9K1UhmIhZiI7eYQ6d0oAOmxZKQhIKC/egrHtoUSqq6Pt7pDH7tz+k3DpFvQ8YRt9xCmJpSaSGUIUUNMxKXOUcQAAAHhSURBVEbgNAcFIE2ajEUCQ0aAAjBkJ4zlZk9gnDJQAMbpbHOvJHADAQrADUD4lATGiQAFYJzONvdKAjcQCBSA9D+J/IYK+JQEckRglEoJ07u+AtDudJUGgqEfeCcBEhgyAupaD3uW7SsAl6xiW0oj9ieqeGblAgmQQOYE0LvoYb9EvgLwpaWDzWKpGPsz1fwSc40ESCBbAuhd9LBfFl8BgKMl7PliMdnnjiEOBwnkncAo1YeeRe8G7SlQAM4+dfCrtt07J0SYtxQEbyRAAgMnIPHjyOfQu0GlBAoAAvSk8euGKa8IioDgjQTyTUAK9Cp6VoS4hRKAV5479GZPGD9jGPIcXlqEiEsTEiCBPhNAb6JH0avo2TDpQwkAAiHg2WOH77JNtatcqZ4zDPMtKeUFPdL5G+hp/S11xuH5iHENiCH0Qe/pcQG9iJ5Eb6JH0avo2TAjtACsBsP3FS88NX3XpY6xQyq1o1oq7qhxkAGvgb5fA+g99CB6ET2J3lzt07CPkQVgNTD+e+Hswty7pxoHLnKQAa+BwVwD6EH04mpfRn2MLQBRE9GeBEggfwQoAPk7J6yozwTGOR0FYJzPPvc+9gQoAGN/CRDAOBOgAIzz2efex54ABWDsL4HxBjDuu///AAAA//8pEgg1AAAABklEQVQDANTsRLN50QRTAAAAAElFTkSuQmCC" preserveAspectRatio="none"/><image width="10" height="10" id="af" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9B4AcxZX2e9U9MzsblEUwYLAQSUg7MxskES18TtggaWe1wmBj+87pHHA8+xz+M7J99tk+n/EZ53CHExjt7qwAA8bhCAYkbZqZlRA52GCCctg0M91V/3uzEkgbZ2Y7zOx0bfd2d3XVe9/7qup1dVV3jwAvlCwDLUvuro7WJk9uru8+e03t5hVvq3vqoivqtkWbwp3/Eg1v/cG6SPIXzeGuO6Lhzs6m0NZHaH2O1n20DkZDnSnaSl4P7w82hTrp3BZO8wjn4bwsI0qyWCbLZh1rSBfrZN0thKFkCfSAg+cASqgSNIe3vKUlnPz3taHN265seOJZ5Z/9tMLhHcow4wLF5ozcd19GptpR4X8qhR80ZeqdUqlLlVKNZOZZtJ5E6xxagwqUn7bI6+H9IICic8hpzuI8nJdlsCyWybJZB+tinVndhIGxMCbGxhhJpreUCAOeAyjOgsL1dQ+tXxeOf7U50vMnukJnrmp4Wgmsvl2C+QUEbelwZvfJpsosAIAaBVBBW5TKAKVMUCDpkGJpjxo17Re6vCKDZbJs1kHSkM6wzhqTMDAWJEySsDFGxsqYGXtLOP7v68IPtYAXipIBzwEUWbE01XYtXV/3sMyYh242VfrzUhr/oEDpQ5mdYMgBkCpDiKn5AV+8abcoFsaistgYI2NVhJmxGyr9BVMd2kg2qdW1XdwLKQrEHggA5sBzAMxCkax8P61p/s0Z8wAh4kZFmxmxILBNfuHvurr2rqoZYdIMMcJzAEVUkKa/eouUqWooqqs7WBSQegipmgGcv9UigZ4YCxjwHIAFJFoh4tLIHQsRfUuo62yFuKKUwbYh6kuaah84rigBliEozwEUSaHPwpNON+VwkaCxD4ZUw6CJWYvt0+BJzoWBI2k8B3CECZe3UvnOQEB0GYYD6hE11DwH4ADTuajwHEAuLDmQxlSpsx1QUxQqMjC8pCiAeCC8B4GKpQ4gqPOLBYvtOJRaabsOT0FODHg9gJxosj+RArnKfi3FoQEBX1scSMoTxdFWew7gaDZc2l912v9WVOjzXNLuvNqAPhsuOOuWGuc1expHM+A5gNGMuHA8f07dFWnzkAua3VHJtp5c9Zp17mj3tB7NgOcAjmbDpX0JqejII74uAXBYrVQGpOWg936Aw7yPp85zAOOx4nCcD6vrFTUKh9W6po5t9YlZta4BKGPFo033HMBoRhw+bjnvoXmmHAgCIJRPQDDMwcrL67v5bcbyMbsILfUcgMuFIvuHjqMZgEqXYTiunm3WFS50XLGn8BgGPAdwDB3OH0g/LAAU/G6988pd1IgoAqh8ngNwsQxYtecAmAUXV82EldnvdriIwRXVSgHKdPk8/OQKyccqHe/IcwDjseJgnAR4oypDD8A2K4Q3Oki1p2ocBjwHMA4pTkYJ0N8AZegA2GYNA5eAF1xlwHMALtK/+qz7a/z6LBcRuKta16pgbfjuOe6iKG/tngNwsfwDwarL09nPf7kIwkXVGeMAaGLuZS5CKBvVExnqOYCJmHEgPgPDb5XScEBTcargJwJNc+jy4kRXHqg8B+BiOVdo8xcpMF1E4K5qtr1Cn/9qd1GUt3bPAbhU/lfXJqtSxv4TAMrpCUAYFRBSxsETmItRJ7xDhxjwHIBDRI9WM6yZlQjKexAGzOOYi9H8eMfWMTCZJM8BTMaOneeEP6iJYNl/I18XwUogLuyk2pM9MQOeA5iYG1vPmGb/ZeX0CvBEZDIHGbO/aaLzXry9DHgOwF5+J5QuIHCpUuU7AHiEGKUkaOi79Mixt3WWAc8BOMv3y9qo+38ZPw77ckSZ7iiQ4MOaN5Wp+babPZUCzwFMxZAN59+05PfzENEGyaUpkp1AS+Q+b0DUheLzHIALpM/2v3ol3fe6oLk4VRpyABDneZ8Kd6F4PAfgAukmDF0ivfv/l5lnLkyVLpvPor9seBHseA7AhULQReAUoHtfF1QXqUoeCPQTJ0UKr0Rh5QLbcwC5sGRhmg2wQaTl0FkACF44wgCCIYfP3ADKq49HKHFo6xHuENFH1DwESxCVOuPIsbcdYUApeeZD0Op5xRE6HPvvOQDHqB5RJCOL3y9ERdXIkff/CAO6qAiatYs+cOTY2zrDgOcAHOD5bY3bTlkX6v63lrptCpT6gSmHHNBaWioM4gSF+P66SFJFw1s/H61NnlxaFhQX2lzReA4gV6YKSLcmsvn1V9Q93JtKDz4uEb5smIMgy+gHQPKljB8LNuUwZdO+qnD4sbfVPbxlTWTLEorwFpsY8ByAxcS+e9XTFU2hzmhT7da/BcScP6bNAxFSEfAe+yUWclwOcxVMmQdWVGoLH4qGOnvXLuu6tKVlo5ajCC9Zjgy46gBWL72/YV24JxYNbX2GGk1sde39NDqeI/IiTBaNJN9zcN/ugwStHRBOyRi8641rER8FLgjDmd1A900RFPJ28/FFe5pqO99coLCiyLb6rN5XUV1vpwvE7mi4+3drw51hN4G55gBaIslfVvjndklQTQrwVETRVOlb+EhTaOuudXV932gOd73FTWLy0R2NdL2HCvMJIvNnCqQPqMrmk99LmxMDNHlizvbplXdGIz2bo6GeknmDMBrpfX1L5KEv0YXuucrq6r9TXY8Cwnyy+q1+URlfF07+lPYtW/IRRHU2n+RWpFViXaRvEw36XJ0x+2lMjN+IU9ltytjPChaY5tBnpJK3t9RtV83hnh9fXXtX1QYovjni1Ut6FkdDXUNKqp8pZZ4+cv/KJnirXQxkzAFQ0lgJKGPN4fij9fU/Jodrl7bC5G6ADWLVqrt1wvftKyIPm0pm/mjI/i8qgJNSxj6gupIVzFu2x1RD722uS3TQhcPx9ui4wuZw4ocAcg2QC4QpgsGFDer9Kf2k/mSoq299Xd/3onXJlVNks/302qXdp7fUbb/FH9AfVyArwLvi2875aAVKSRpQzZx5mrk83RTqvrml/snZo9M4fdwc6W1YX7fj28nQW3oXHlyYAZCfSMuDObQxBFSwdl2493qnMecAzjpITeHOf5Eq/X5TpnIWesRLAqhzM+bQh4VSm9dFEgPRcM/Hm2qTx126+I5AzsKmmfD99d2+pmWd7/P7g08YZv9qU/KI9TSFetmnwQC5X5Wm/MZ6JQ/tj4bjF/CVlyIcWVqWbPe3RHoXRpduvmZdJLlPgNaVMQ99gupqyKCLl8xjxsekNmEq40N0C/xJR8AfVuKYA4hGOi8WoP8nTDNkiZKpSgS4DkTq75XVJ8TJ814fPee+E6cpetLszfXJFXukeEJovp9k6NYFcujBgBccYgCB64VAcf+8fdXb3rKk8wQ7FbdE7lu4LpL4lvSn44Y0nkPd/11TDs8xLLggCPT919pQYnmh+PPN54gDiNZuOVnHyntNlaHboHwhjp9esndVSpcqc45S8iOBqpOep65gX3Oo5x0tdT2Lx8+Vf+zVtcmq5kj3FzWlbZEyc4rMXnHyl+PlsJ8BaoSgwDx7VnDOC9FQ1wesHB+INvQtao50Xdkc7urStZN2SmV8SqrMEgDlp33LjDOpjfg1fevqyP2vskzoJIIccQCIejJDXSK6atMyCZoCT/FtAk8XAZjLFKpfGWamjzw0zSbEP1OgyGy2prP/NH9QmI8qBV/KEH6KtAU/yfUWyxhA4IE2EvejReqCHW8kB077BS/r6uIfp3vzXSoztE0pvFEq2cB1Tdn0OjdVMOS6pquKRMGg88hoswNQGA133UONcl4emKaVdKRgMEhXgwWg4BtXNjylouHu25vCPe9bG46flqvwdXV9H6ioOm03efmTRmTmmtNLVwwM0OgA0H344jm63r++7qH1hzFR+zq8N8FmzdLOU6K1W98bjfTccmXDEwoUXmeq9AJKXulwPVgYDXf9kXoYU2ImbAUvtjqAdaHeJgTttYpGbMHxgHRfmIbhzC6ggnsLKOMnGsgnaS62P1rbtXoyOET8M6Y5/KNhY89kybxzJcBAhsZrDDl4M5VpkuBOeAvKDxg1hbbu03X9GYXwUyWN1cOZPVSHeMDa1jZIsMYuVGcBQXt9c23fZZBjKCSZbQ5gTe3WizStsp2uoIXgsiWPVIagGlCl68FbmkJdal1dcmNT7eaPrjrtfytYYXOkt6E53PusUupUAErJkSW5jmBH1ECgDzRRAT6tGgL6XAj6FkKl/3haT4QK34LsWuk/kY6Pz57jNJyW83BeRO0wAyMyDx+U1EbxBUip2uZw/Ekataf7doBVqzboTeEtH14X2X7j2tBW6dOr7gTAOVRfBRRJICyg675bm5ZtPc8uSLYY23Leg0FNaL9Km/worF3QC5ebyd7PSzDN4RZA7b9PmH/RUFPtlseQpnGkSp9cao0fAeFwSNN4y6Bfm30Q0fe8kuoWTav8t7QceI9hHDovPfjiq27sXoS/6TqN1lfjTd2nZ9ffdL2ajk9DPpcePPiqTGb/+dR9fi/nVVLeKlB/YUSmxq8x8rwbIP0d1lkSG0UOXarUIgD9IbrSbzux/+oMKPE9Uw5ciQCYoZ5CMZZ72jwEQtN//e5VT2cvUmBxEBbLy4qTQ/47EARdRaEEgqJBoz2AKM4ws9M4VB2KGrWiq7o/e+UWqA0g+lqFVvVPoPBSXVRFNBw47ebec2bHEnUndfQ1rt3Yc/a/35o8/39ifSu3xB6++IWpTIs93PBCx7YLNm/qO//nnLejb/ma9kT9q1imhuJU1gGaTrqC70HU2hDFYMA3P4upGBvQsfYiGPzaMYilfGsIUCq9Glx0cP+eW4+1xZojYY2YV6Q013Z+VCm1SqrMK5ElsKeKuDIg6sQgKto+Tw1wGx18fP/+XbPbEw3VsUTd+rbec/+XGurvW+NLd7TGL95F521ZWuN1u1hHR2/97zfGl/1PLNHQEks0Vg0bz84FJT+pa9XbGCMrRzxy68BHxbWq7PcYi93Rv8LZSFtSb6Dp6A++EnvsXqFHljsAJcR/jxBcKCQv3wgDSPftNUANah/9+6ip8JyhQOac1viy2vZE5L/vfGLlwZF07v/flLhkf3uy/rrW3qW1wcCsc4Q0zxGof5SwH/BpNQSwdBobgS3KRdE4Bi3ftxqcpQ4gGu5+hkcvrQZZLvIQBPDgG6L2uEDfDSozWBtL1M+Lxeuuv7Wv8dE7txZPo4cJwm+2nnGwfdv5j7TFw9cT9jkmDIU09P0CUTyhiSAg2QheKIgBurBic7j78YIyT5DJMgfQHEn8EzX+Ernvh6ILPm0WN46/mDi4ZKh/5zK6yv9j67YG7u4XHdZ8ALX31ve1JSLvHurftTQDg+ciiAdHegXghbwZUCCVXLyutvedeWedIIMlDqBl0R9ngzJ/PoEOL3oCBjRRQY0ehoXwfU8ZBxdRN/rijt7zHr7zibfw5PMEuUozmm26Jb5yB9l4gZEZOF2IwPcQcFgTjr3LVZrEjUFNTkDIG95Ye1fVkVPT2VriAMxZ8x6S/Gz+dJCUWV6Bvoyp9ReBJgAAEABJREFUBv9fLLki2B6vu6a1b8XT5UJBbFvjU+3x8DWx5PKghPQXETWjXGy3wk6lTKzGeQ9bIWvaDqA53PUWAuTIiwtWGOymDEGj+UL4CYL4pAkHjutInPdVOijrJRZf/hUJhxbS6MenuDfAHJU1ITkar0Cd3BSOvyHH5BMmm7YDEFhxO82n4oQavBOAkKV5UAHe2B6PYEey8ToeOQcvZBlgLtqTDd9ui4epHombKHIQiTXaesuEDCjUEP8w4ekcT2RrZo5pxyRbX/fQzabkh8PGnPIiDjPg12dTVRa3+XWNRvTr3n442ttMwEB7InKVrukhQLzDTwOjEyTzookBKTOwLrKNHSYdFbYU7ACikd5TM+bAGuqKFKZ5hufSBHf18fmMeeAyGvhafXNPw5Mz3GTLzGvtrX8ilmh8q2Ec4pe2Xhjh0jLxM0aQAglSDq7lNxgLNapgBwDS/D8E8IZwxzDPj+r6QCr5TUMXZ8QSK24fk8SLyImB9r7ltxm6tlgp+S2B/O1PlVO+8kokKjRd3FWozQU5gGg4fpUQvkWqiB+fLZSQ6eRDQBAYeE7JdEssUf+vt/U0DIIXpsUAc9ieqP+0qYwriNu/M8fTEjjDMivqBWjoPyca6ryiENPydgAbQAmljM+aMlWIvhmbB1EHhZBsT0ROifWtbJuxhrpk2Kbk8o3E7ckIYhuiBl4AOMIBv+CkED/LnyM/EpfrNm8H0Le0c42uBZflqqAc0vn12eATgQ90JJa7+isv5cA1zRbU6hj4oF+fUw7m5myjjsFwMnTpW3LOcDhh3g4gEJgXM8z+w9nLfcMdUhxIZ/Ycf3Pv0p+UOxtO2b8xvuxHUjx/IgDSLRaCFwAM2Q8Bfe5t+XKRlwNYX7f9w8PGXtLhkY4oQEP/g6Dk2R19F+wkUrzFQQZauy55UZpDZwvh34KYVzV2EKWTqhBSxj5YH3non/PRmhdzGXPwi/kIn6lp+X5fQ/8DbYnwBbG+lX+fqXYWu123bH/tc+3x8Hk6VjwgUC92uJbim0iYIQeunejcePE5O4CmUOdnNRE4bjwh5RZH01Lfbo2HLjxstzq89TbOM5DlfmN8GZfFdc6rLz6NQgROaApv/XSuyHJyAKtOu7vCJ4JfNsv8qT9BVxmB/p90JBs/lSvBXjpnGGhP1H9SaP6fchk5o7E4tXAb1TH41Utz/Mm8nBzACXOO/4eMHPIBlO+9P7LtSn2ZpqI+AF4oSgbaeyPvV8r8SrasihKhE6CQBgSHfbNqTn1dLtpycgApGKQR7mxvKxeZMy6NQA0A8Us0BXUteKGoGYgll38RQXxZUG8NZmiY2iwFdMH+8dTpAKZ0AM3hrrfQvGvZvu6LzCKKH8USjRt4tzRXhRtAiZaWjVpLi9JWrbpbH2/lc5yG0wI/1lSaxkLWUaP2oxKFbwlsTQROaarrfPNUwiZ1ANmKgNp/GZKmW6eSNAPPI19FhPhGe7zug6VkXkt996ubI71XRkPd311fv+PGaKjnvr5wz3bjsVOfNx7rHFqwf07muIPHZ44/dGJ25f35FMfnOE1fuHs75xnJ2/1dlsUyS4kDmh34IKD4z3LtCXCbFVL/9lRPB07qAB6q7TtVSuM1pVTwVmFF6vYj4l9i8cbPWiXTDjl81W6qfeC4aF1yZXM4/psr6h5WqCr/CkrdqEBekzEOXqnAvJDujc8h/TyL4zNVGjLmIUgbB7Ir70uKo/M0zgPHKSXP4TyZbF55DctimSybdbAu1sm6KU/RLh2Jxs+QE/8Ll2XRgrQRmFLp1yTCa149mYpJHYBE9W5EUYZv/CEICPyhPV53MRRpaIEWrSm09YfwxI4eQP1poWCzUsZVafNgtnFLxV/ZUoQeaS104bzkRkgWOwmWzTpYF+tk3YyBsRSqwe58bfHQxQJ9fwZgW6DkQ14GoF4hpHzXZHkmdQB+X/UXlTInyz8jzyHgAUwPTUqcG4bzhyCjkd6LqdHdF2j8toGo/bMhD4UIS6Uph4GaKu3au7AO1kVaKlk3Y2AsjImxMUY6V1SLFAeupopeNL+j4BQ53Hb9/lkbJtNHvIx/OhrqviZtlB1n4NOqYWjAfHXrjuUvjs+MO7HRcPfXZmknPgfKvBcALxpIP089c3bOCO4FzGJgLECYGBtjZKxQRCHWc/ELgwPyFC7bIoLlCJSMcQioPD40kbIJHIBCTatoOXxfOFHeGRevCT8oCW8vll/d4Yc5WiI7PhgN9wwgiM+ZcnCOIoBA13oouqCAsTFGJKzNhJmxsw1QBIHLVAK8g8u4COA4BoHbsIYVb6M6M+6VYlwHsPqsB6oNc+BCgHHzwEwMiAJMmfpDa+LcG4vBvrWhLVfPmvWaYepm/0Apo1Jmf2uxFMoDgbFKwszY2Qa2pRg4bes99zeGOfwnLutiwJMvhsLSIxhy4AJu0+PlH9cB+IJVUU0ESqG2jWdTAXEKaLT4yY7kyjdRZlftXhvqWt4c6bnXJyp/mTYPEJzSXtgGtoVtYttctgY39Z33Bi5rKMpelD3saKJC+Cqq14wnfVwHQNMHN9DVcLz0MzJOwwBVB/VPh41Th7eOb2i+/UsBvWYrTb1ebGTfu3DVF1lkP9IVaAjYpoBevZVttEhwIWKyZWsq471c5oUIKMU8Jg0QSxj+5XjYxziAaLizUdC98HiJZ2KcJqjxS/PjsXjdfW7Zd9mSv7y6Odz7GN1EfzFtlP5VfyIes4PKSn2Rbb1sSfek89MTybAiflOi8R4J8hNc9lbIKwUZmgji2rqe+tFYxzgAVOIyU6ZHp5uxx1JmHqs5eOjHbhnYXNt5ebBi7l9NlVksab7dLRxO6WUbTbI1WFHxV7bdKb2j9cyac/BHUqYt/aXd0TqsPJ6uLO4FUDfsstFyxjgAJfSq0Ylm6nHQdwKgabbc8Mwlw27Y2FTbdaNCuJUGXIE6+7S4gcJ5nWQoss1sO3PgPAKAG+65ZFgZqZag73g31LuiUyhVM1rxGAeAkOlB1Eanm3HHCAIGjed/2L59ZR84HC6v765sjiRv0DTflQqyt6UOIygOdWw7c9Ac6buBOXEaVcdDFyWHMi/8CKkuwAwP3KYRtE4YFcY4gPZ4400a8q/ajEo5ww4V4sGgUf0lN8wKmKJLytS7TO/T6sAcSDn8Lr8put0oiwqzegP1SGb8E28CfNCerN8Io8IYB8DnDd/QApoq2c/7M3HVRSVdd43v37R92UtO2scv0ERDXc9IUEuAEDipu7h1cV9AncPcrF66xdE+OdcBA9QPuE4UK0fTxcVtGdMD88eTM64D6OhcsSeWqJ8rUB8YL1Opx9EU20ubEis/77QdCP4uBfJUVQaDfflyy5wwN7oY203NV1a+6W9JLv+cKYdm5JedNWrD3JZbd5zPn/MeQ40YE3NURHuiroa6R3fNrGeoldK14MeOMtP23ZYld1c3h3seASFcm/qy3UirFBBHzBVzZpXIXOQIUUl1Qs2YAZnDbfYPbYnbZk1m/6QOAABVLLnizVKZ30CcIimUQlDg02YPtvYuu9lJtMo//0fE4Vl8lXNSbynqYo6YK/DPc3Rqti2+9LdcN2bCrRm3VSnNb3YkV7wJYIOcrB7k1Krb4rWfBU2/zK/PnkxW0Z/z63Nh2NxzuZNAmyM9vwWUbwfvnj8P2hUoVFc1R3p/m0emaSfNGHtX+/Xi+smxfI3iNiqEuLwtUfuvueTNyQGwoFhP5PZ0ZuAfqCIPISBHldyaMQ89fmvywrudAt4c7l6rlLyCR7qd0jlT9DBnSplXRENbm5yyqaPvgv/LmP0l+XAQjrTJoVTm4Ovbeut/lytnOTsAFtjRV/9/ekYsEsK/i3w0R5XUqlD+2inAVyztOQfR30EOwCmVk+hRVD0ECPSBT6uCCt8CqAqcBNWBV2dX3q/wzQc+x2kQuFoocDswd0IEYy2RLTRr4gwaRHCsjlhlEbdFbpN6Bhdt6lv+53zkcknnkx74Qxnpwf7TqbLcL1DPK6+biXlQxBxMX+cUBlPXfkezDa61Ik0EQBdBoCvDdp+ovgmU/JIG+luH4eAZN3Wfrv2682T8VeeJ2ZX3b+r+tWbK/jMF+C7jtJTntwi4nWVoJAtcCoYcUkpV3OaU+szg8HVcV5zSN109AnV23PenqU1y28xXXt4OgBXc+uiFh6B36Srad6w7TboKXhA1kDD8gyzugqXknjFa2/19CcYiBKAFHA2IAjQMSGlm3tsar8XaZGNoY3zpVbG+FRs2JmrvuLX3/CcI0DgDQxtke2Ll462JZbdn08aXXsl5W0mGNI33kROQSLIpr6MLEYjMZXNt5w+cUMx1xFRDP0SqM07om0xHLufoCnM3t0XGnUv60WkKcgAspBXQbE/Uvw4Av65hACgQFvpfhAtS3z9o6J9xAlo0tOUSn171Ibp/dUJdVgcCcqMHn6i8Hkz12rZEWIv1Nf4cKGygEUjaFLQcyRvra/hZWzysKVOtoi759zTqEbDOgoQWkIm51PWaD64mbgvInneWStP3aVD0l3dOxzIoLdvm8Os0x/86bouFai7YARxR2MEPUUDq3bpWiUfiim2rEHqfnbc35QQuRN8306ZzT5YiCAWo38uNfmN82Udj25bb9lpzx7bl97bHa69pi2/ShPDdm9UNzgTmlDq7/+mEtmxdQexxQlchOritmZh6F7e9QvIfnWfaDoCFdSRW/EJCOjRy76Q4qmhWpG4rIt52zz2X8HeybcW1tvbBjwv0Ndiq5LBwQfd+tMapr98YS9Tx7Zg8fMqBzQbZFo+sYt0CfQlBWBxQCprw1TeFNn/Cbl1cV7jOIFrSPCyEy8+xVNPtbDrUEV8x7gc+8lVmmYXtvfV9G3vPRQTtJYDi6Qz4tTmQFn//Ftgc3rrsd3NpDvk6w4lfUULq6IO6sT1RX7dp28pem02bUDzrbk/URSSom6jIzQkTWnSCufVps7/91mV/mWuRyAnFpEXXt7juTJjA5hNjxSNRrL3IbYzb2tjzhcVY5gCOqB8amHMqeYFugb4jUS5uEVLGvgdu67nc9t82q9RO+VDGPES2Iq22LSqgzwdAuCiWaHg7jAQ3u1xZ3R2JhqsAfRcF9HmMKBvHO9avmP3Rk6Be82HrZR8r8baeDwxy3QEiG1wOAv2MopPa1mlWQ7HcAdz5xOJ0LLG8UcOKn+mi0mq8eckTqNFIjvhyXpkKS0wj1ea/F5Y191yIuHvvcw9WU/dvc+65nEnZEa/bvDfzVDWC2A02B5oX/AqpsNXTkvxs3eE6xPturdyGNBH4aSy5fAW3LatxWO4AADB7BdgYX/I+Q6XWu0mgVMYhH+gPgc2hOdTzC6DqYqcaIXQzlrjjhD+89M4BO/VMR/Yf+t40EEvefoJA3ebxCAnRUPevpoM1l7xcd6TKcLcul+SWp+G2Y0KmZWPvkvePCB9pWyP71vy3wQG8Aqwj0UAzFOIqisk6Bdo6uCjwa1W74MzHbP2Fn5YlD85DIbAlHi8AABAASURBVNZQRbHLNuZuZ3u8nu6pNtjcsKwwYYNsT9TrdHnm12sZuxVCj5HBXAuhXc7cH3PC6gOqOzrXIZud+2jYfIyA0kRxVSxe18bHdq22OgAG3R6vu0lIc4kugsN87NSKNDKdkgNbWlvX2zs4FVi4TCpzFgCCHYHuq3H2gR2nkmxbGhPJtWNRswgzY7dDOBDXzLnmn1sLNgauOxk5uIXrko1qxojmtmIoXLKJ2s6YkxZH2O4AGG/7tvMfMUx1qiZ8js2tEokgRMX1rN/O1ZB7b+AHVezRgcawOthwwzP/6KjztMIWxszYAdAAG4JSJqTVwRtsEH2MSK5DXJeOibTxQBO+bgDj1bf2NT5qo5qXRTviAFhbR19oZ1u8rkGATobZc7WEowIXWqw3tOWoKMt31y594HS6ylk+MstABfVgNNRv2NRb75jTZL1WroydbWBbrJR7RJZfn3fq6iUPLj5ybMeW65AmgnaIHiUTgXoaD1MbaWyN1+0addK2Q8ccwBEL2pP1Z9OA2Y98mr1fHx8ydm8+otOurdArvkVTRTaIR6DacF9bou59UOKBbUAU/IvGllvC3Pv8AdufDkwZex60HPxRAg+3he/HEvVLjop2ZNdxB8BWdSRXfNCQmU8g6DY9nosgAG8HG8O7T3u6QoA4h5yZ5VoEaFKapu1z3ZYDn0CgaRofYZsmOD2NaEXDc7jk3auerpiGkByy6r8DIKcM1ge66qeIn2s6kss/Yr30qSWKqZPYkyKWiHzHr8+i+x17xrZouHy7PchHpB6cv2euqdJnjRxZ9x9RAwlyU0dfo634rUM8tSS2hW1i26ZOnV8KpTJnHjy0x9YnAxUYO/JDlWtqBQGtpqs9Gf5erjmsTueaA7h08R2BtHlwHoD1nhVBZXTQ/wo2BjT0iwT6LdeAIGRHsrEZZlhgmxCF5TMy2TIw8GI76aJ+xl+5TlmvAyFtHFqw6rS7be7BTIzcNQdQPfs4Mtq05wNsqBmQztg6/y8h8ym6+kzMbIFnfKLqKwVmLfpsPgxa/rRktgxQfspO44OGfAG4TtmgRKE5e+H8mgCLdmN1zQEMDB0KKgXzrTdagV+ryRTydZR8sAR9C5bTlSGfLFOm1YQfUsZBWx/8mBKEjQlSRn8b22ilCi6DCn1ho5UyR8u6afvKl7hO2THeo5San0oZdDEcrdWZY9ccwKyqBT5NBKzvQwPCsLFvyE761iztPD9tHLRYBYJppvbx/bLFgotGHNtmmMP7gMoILAxp4wBEw5svsFDkGFE04zAIYH1z0agNVAarbGgHY0wYN8J6i8ZVMzbSlMqW7r9AHYTQ7xqr0boYTYPzJKStE0iSfDQtipp/Le3O6EXp/jVsq5VGclko0M6zUuZoWUL47xKojY624BhhyKa2kAs49xyAGl7CT3PlAjKfNAgCBFbEwcbg12uWWY09YxySsfit99sIuyhER3pveyBjHjKtBMNlEdBqllopc7QsoXxxROubC2MXZvrs0fqcOrbeolyRm3CGogmvXJPnmk6gD8x0v41vACo05PBxAAhWBkT9QYBrlZUyi1HWBrhWIegWP6SFMFImJNomozNyaLugumW1eG4DqKTl08m54nTPAaB2IoD19V3QQBpdXvpyJSDfdBsA0JTGyWBx0PVqmve3/nVPi2FaIA6VrleSrRaIOkqEKTOncNkcFWXpLkJmm0C/pTJHhClA9J0wsu/8f9ccgEBRbUP7p+6/H26lUVu7qHyopRURYYGV8hE1MM0B1z7tZaUtucgyzFQP25xL2lzTUH9sAZdNrunzTdfRd8FOzQ4HoAAQcDa4FFxzAAqkLU9vSZWxmcoWUEoutFKJoK6lEL6ycQBSyDjbbCWHVJ+oTFqsFDlGlqmsHfg9ogCUaekF5WW5Oey45wCknGfHLUDa5k9y79p1D+qiUs+B25yT+EQl7Nq7x8Zxi5yhOJIwdfCl7Wyzlcp0UaVx2Vgpc7Qs66d+WQO5LjBtmRFj6VOt7jkAUFXU+5kKX97naVTVpheMXoGiCWsf3NK1KrjnmUtK7p3/VxjJb+/OJ96SYpvzyzV5aqvLZHxtpuVlNNIG7Li3GN+C0bGuOQAAZceICtmnLC8kEvrycuahGlQWD16kjX0vyy+XnZSx11JTuUwW7lxoa32mxmpT3VLWXlHyYNZWwqbA4ZvifGGnqQtQWMbcclFTrSTnlVviHFOlzaL9zmeOFuSfLGO1zUpBxr+LyiZ/LLnnsP7rRqxboSq/R4EBUANbAl2gbZHrCS1+Bly7lZ4mNTjN/IVnd7EHIO3RjWDpAN1oamnqYhDA2gKz+tFYKIHgE1XWokQEX/pxKhtrxY6SZkvdQintnroaZcYrh/Y0wlfkT7KHNhmNtnanHqs5pNBiBxDQya1MwtRMPOX30SSQhYZxmew6bqG0UOQYUQj2dNUVCpvawhgTxkS45gAQwBZvjajZPqBiSmsnGgy6H1512v/a6rjGlLyLEfwxGJNsthKCbXP0x4DULC0jFk3tAGh1bRDINQcAqO8lw5kDS1e/VmOpvNHCFi5cpQw5aIyOn85xRg7CnHn1505HRinlDc4+6Vy22UrMhtlvctlYKXO0LL8+a3SUBccIArQ94FJwzQGQ0buAfR9YG4TtU6qtgCgIu3W4+elFIc2IdRKLXBLZKpWlPhQQuExawc6g2VW3hF5+DkCh3AM2dAGkSsPqpX863q6KcG5ri6Kwx0r5PHOpa8F6K2UWsyxdVDQoix0AzdHv5rKxy+6WxfctNO14zJzagFLSvd8ftIuwqeQqaTwPNngAdgBCzLLt3fANAEoTvmfB4mAaA3QLQOOLFsstPnEKTWOQbLUWmSb057hsrJX6ijSjMrBMKuvGfo5IRhAg0bS8PkGOwbVbAKnwYSTjweIgyUvrIrDMYrFHiUOli4qd5AeOipv+rgTjvA3wJboeTF9WMUtgG9lWazEq0EXVSwBIHQGwJei+CnIAdgzWI9A04DO2gM5BqGsOIKBX7EAbngWi7hQoNMM52F5wkpR5aLvV2H1atZ4MXXZ+waBKJGN86ZqVPq3G0vl0LouUedDWl6mkaYS5bllNM2PXqC1YLTdXea45gOH0UL9SZq44c04nSaaU6TflnKGAhAjmZgHWvsow8mis2VEAnJLKIrTMphFbrYOdLQtlWvyVoWPxmSrzRkl169hYC46UhHQK91sgqSARrjkAITIp6q7b8PVeCQF9rq3PhMcS5z3gt3xKSIEm/AuaQ52W3x8XVDNsyLQmsmWJJnwLAaztqXNZdCRX2vo9xQp9bjWAtISVo4WYKp1WMGDThwaO1jT+vmsOoDJ43DAg7hsf1nRiEdLmId/qpVtsmwlgdMPGrm4E5F3LVlOmQdNmr7NMYJEJCuDcFrbRSlhIZTCU2dVjpczRsrgucZ0C0gUWBwTYGwjowxaLzVmcaw5g7x5ICdAPgB1BmbrQxYl2iD4iU6H+X4jWv9BoqoF/O6Jjpm3tsI3LQBOBb9nJlebznwBUp+zQgaDv37XnkPXTCzmCdc0B3PnEGSmfqKb5dGu7g2y3AvQh4Km8b9eKQt5LtzCWi1dKak21XfY+0WI56qkFRkNdG9m2qVPml4LLQIrMvfnlyi81gnkq16n8cuWSWoFPq9l9j4sfg3HNAbREkqsz6lAD2NCtAgrkWZfQxrZF86f3I+qPWa2AB0YFYrQ5lJgxYwE8rkEOuZlts5ovLgMuC6vlHi0PQbOsLsExAYHbwLqGvjXHRDt44IoDWBveeq0uKm+RMmP5yxUj3CnaGJfRP9uW1s3nDyGoHWCDA5MgBU0Ofw9mSkDf9VmbLLeH3ArgDi4Ly0UfJZAcF9UlrlNHRVq0y23Ap4KbouGtGywSmZcYkVdqCxJHw91bUOGG4ewnodACieOLCOjzzh//jJWx/Z8J6HZ8hIIrm1rVHOr5sZVo3ZAVzdogLwGLR/7ZFuZeqv5/5X07V6pLNv7uIAK3BaXw2uZwzxY77RhPtmMO4LyTNwabIz33gZIr7KgMo40zZQqa65Oka/QZ647bE699PGXst+UxTqkMajLyH5tDXSX7klBLOB4GMP+RbbGO9VckpYx9z3UkL7L8NuwVDQBrG7qWc106Os6efQXU01jBbaTl5AeD9ugYK9URB9DS2HnCKcct3UndnYvIzLEobIgx5CBIc/gaG0QfIzKAc9+JqB0TZ9WBAunz6bN7W5ZstPapI6sATiKnvr7bp2lVcQXK+qkS0sucEzfvpF1bF5GRH+G6ZIWSqWQQVyClcREeN2tXtL7b1lmsI1hsdwDRSNdqMw2PZcxD1QD2dflhVFB0BdVF1XktLRvtaZ2H9aWG924TqB20q1dDVzll+l7z18PqSmZzqiH/xtjtAayAOc9oB2z7CTjG3QIbNU2rvIDrEjgYMuZAFRjwWFN4i+2Dg7Y6gKbara+jfs0t5Nns/UrHuIWDYJj9C7Unam19IKjjkRV7lDJvF2jLhY4tQwXyhHXheJoPSmFtDvdkFCj+vTtbPD4S10oad3Z0rqBpZPsY0SKLj6er/wIAW8yAyYICsxpB27Qu0vsPYGOwwwFk2Vof7vuGrgX/rBQPaNlowSSiBfpqUuqQ7dNp7Yn6tyPaQeUrxpkq7WsKbX1p1Wl32zRz8oquQvcYW1Oo8yWpDL1QGbnkE6BBe/L2q3JJO500BsA5Anx2fAYIcglKSUDQ/9RS99A3D6fPtq3D+5ZsLK+1LUu2+6Lh3l8ohM8Y0oZH/fMwW/LLG0r9Wx5ZCkyK5ObUtQVmzifbwhPmnzy0NpRYnk8mJ9KuDXUtZ2wAaqHd+hTKawE2SLv1UP35oqRbSSv0FCoj24aU+elouOfX3LYKlTNRPssdgOEf3AEg35kFPpFWx+IV0BTORU58cLM/Nfw9n8YXC1t7PJii6VOE9ANNoa5fHabR8qvCYbm5bLK6o6GuXyKoBxgbZcrG0daGJfvkHOwf2vt9G4QfI/LSxd8NBLS5FwPNxRxzwoWDkbak3m74Bh+2Wr1lDuDy2q2vIS8lia/T6Z7YapwFy0ub+2DB3NCnCxaQY8a7dpy/N20e+Bdd2Poi4mE0Shco3tEc7umiaUKaajsc7fCGdTeHezsRxdXUUGzt9rNpzG1KHvz0nx95va33/qyrqubCz6So7vB+MawjbUotioa7VXRZ1yKrMFniAKL1m+sqtKqnlDLI+9t6BczbbkX3UUqpy1etutv2CropufK/pEzF8wZZQAapDKC1QQH2NEd6/1SAiGlliUbifwQQ3VJlGgnHtGTlmlnKdPyWxEpbX/xhLFxXFNUZRXWHj4tpVcoEzRd8cu2SBy25DZy2A2gKdX1Ck9U9Gdmviomoo7EQsPqaQzWOzKWbSn3an70VOBqBffsKTFTS+Id1kYRaX9d3XVNoy4V2aYuGuy5YX7f9OpqRUCAzr5dgTLv+5IqVOTVk5jO5pp9OOq4rSqn66cg4Oq/V+zRNqHyBmq3RUPc9wVK7AAAQAElEQVSnpit7WgXYFOq6CRG+bchBQKC96aKxLb8Sfim+YZv4owRv6lv+57Qx8FNE7ahYe3cV3XeZMgUZc+jjpPcv1CMwoqFe6pbTUBlsKLiMNxzOy7KaIz0GAN5Ple/jpkqTRnKr4EwgmyBlHPz5LdvOc6SnE5Di64BQMG9gc0AA5DYHqL5FtwQbAQgtFBYKNrI53PtHug99myrCbtJoKrjbJDDwERpFrR59zo7jjr6G9wvQn6YmQgs4Grg8pMxoQmi/XBdJqr7at8ZbItt/Ew11/htdvd90ee29r5kIEI/jrK9LvInTch7OyzJYlpSGxjxOlNeueCJQCeJyU9+K94IDYdWSu6sR/de4YWu+5nFZI2BLc6iXbsfyzT2SPm8H0LLkwXnr67Y9ZKrMP0hFF4UROUX/3zAHwAwMf9wpoJrE1boIolP6Rusx5TDwSlNmtYbspzlz/LIp078P6gufurLhKfWO5X+n9Xlaeft3xXFBveYpU8rfA+CXOQ/nZRm8gkvBRxwqYa51Sv18f/XHDHPQKXXT1sNt0ITM61rqtj/csuShvH9wMS8HsHbZlnrT73/EkKklVLNpmTZ+BwXQtUTKbLfYCaU394W2U8NpRsyLYpug0SQdSBo0zNBtwiEYzuyCgdRztD5LK2+fy8ZlzEPZNIrSArhfvEjcGXK4ub233tZHfuGoIBVQHaG6clTcdHadyEslhVTXzjb9g49Fw52N+ejMuXauqd28QteD3dQ1WkhrPjqKJq1fn33murqtFzkFqCO5PCbAt1ETAfBCfgyMcKa3Mof55Sw8dRMNoAb0WWcVLsG9nNwmlZLzNVHR2RTZel6uSHJyAM3h+PsEalvIy+QqtyjTpYx9oMGsO5wE15YIX0EjZjRQQ37aScUlrQtBoNgYS0TWg4PBr82+k+uIgyotV2WYQwASH2yu7f1gLsIncQAqW2Ob6+Lf8Ws1PwGqxbkILO40CCnzQNX6um2OVqz0UP97BWpPIDo3M1Dc5TAxOuaIuRoeOOjIoN8RJM2hxHquGwDZag+lHRT4fDU/WBfuOfzE5EhbHs+mSRwAqqZQ55PSzHxs2LD9wavxsNkSh4A0hTL8HVuETyD01kcvPNSeqD8DlPn3CZJ40YcZUMp4nrlizg5HObJRkLmO64aVytyUlTL2gqnMDzXVdv4NACcc1BjXAVy6+PFANNT1NwRYNDOu/HBM0LDixGhoy1eOiXTgYDgz2ICAzyHqDmgrLRXMCXNTYUKd08jXhrZ8WRPBVzmt1359ii53cEo03P3c5fXd4z6jPq4DCFYd2E0jwaeoGdHtH0vzyEMUvmuaapPHjT1rX8wdOy55MZZcfgoAPkYreOEIA9T0iRPm5qbtK186EuvEluuAQP2jhhxwQp3jOrgNK2We5Ddg3J8fG+MAmkJbL0MUjjwwA24GJWcDDn3RDQha+kA99UJ+o6E3O8AcMBeCOHGjLLJ1gOuCK8odVIroa67tah6tcYwDoC7/BVJlRqebcccKJAT9J364qfaBpU4b17rjkv62RO07TDR/i4hOqy8afYgIkjhgLpgTp4E1L7n/XK4DyoaertO2TKVPKgMU4pjpwTEOABWmphI2U84PpV8EgYE2HvNww6aOeP2VgLhG1ypBked1A4MbOtnWEZtxbYw5cAFEtsx9gXauAy6od0clqjFte4wDAL3i95pw5MU5d0gYpRWFfhaNebx/VLRjh7F4462ZdGqxhr4nRRkMDiLZqJOtGUwt7kg03uIY0aMUVVYdfB8KX0k+9DPKlJwOBfpAU747Ryce4wBivaEtoMqnW2rKFAjUv7u+IW7jjz+Mpv3Y403bG55sT9SdoVB9w6/zV4WOPT9TjrK2IX6jjWzd1NPwpFt2rQ93XYCoXc9l7xYGp/UK1KE1Gb5/tN4xDoATSJn+sIbl0wsw1TBIE26AkeCa94vFGz6bTh88H9F/v579shB1lkcwlfB/BWwLovZAWg6dH4vXfdZFY7JlK1G/gcvcLhzFJlejtmyYwx8bD9e4DsBIpX/FgwbjZZiZcTQYpczFTbWb7yT7XG11HdtWbI4lIhfRtNQ/+bTZBKe0F582B9iWWKLhwo543WaXrVFra7fcIamsAbK+AMohSDBhOCiPXOCOMXlcB1D36AUDugg+UEbjUqD4U0ta8M3rI9uvPIYhlw46kiv/t3Lvi0FNVH5UCH1Y0D1caZSHAsYqQB9m7JV7XwiyLVAEYV1k+9t0reJSLusigOMQBAUaBjav2LqifzyF4zqADYAyIwd/J7KVbrxsMzPOpPEAQLhx9Vn3u/BDJmM5veGZS4bb4suub4/XBwGMb1GD2o/IRVaMVy8ERA0YIwj5rfZkfZCxsw1jLXM+hstUINyULWPn1bumUVAbNtTg7RuoTY8HQowXyXEdyeVfD+h5f1+As5b0mjEHQK8IPLt66RZbf1EoX5LaE8s/jak9p+gYeC11V7ZU+l8FmHUGbt6xKEDCwFiod7JFR/9rGWN7b8On87XPzvRcllSmf+OytVMPyy62NeCbDx2JFV+dCNeEDoAzDGX2fBtR492yWhWo2QFf5bj3TG4S0brjkv6N8dr7OvpWnPf3XX8KSiV/rmtVfeQQqLtdAQiTFidYEZB0aKKC2rsaZt10P/0/f9/1BHXzV5zH2BgjFFkI+II3UJnOKTJYtsNB1GAovfO7kymatMboGv4QlJz5jwWOYUiBqdJvbg7H7x1zqkgi7nnmH4c3JVe8d9es3fUAwVOpnC4Q6NsY0OaAT6sGnm8fgapGNgX9H8krUM/KZNmCdLAu1sm6NyVXvueeZy4ZLki8A5maw733mirzZvJYDmgrLhVKmQbZffiV4PGxTeoAds06+AyCeBbKMBB5QG7g4mi4+2vFbP4991xidPSFdrYlIg+2JcJX/Lb3LDQyg6ej0q4mJ/ADXZt1s0DxIIJ4BBTsAQRTEwHwa7OAb/F45X2O43OchtNyHs6LqP9AKXxnOr1/MctmHW2ki3WybijiwGWnQF7MZVnEMG2DJlB7dt/cwacmUzCpA+ACRvR/Ntvlm0zKDD2XrTjK/FxzuPcHpWRibFvjU+3J8K9jifoPt/YueVs7TcHVJhvO1c/66/H6GcsDu2fv870060XfizXPZVfe5zg+x2k4LefhvDGSEUvW/WrT9gtce3CnEO6zZUZlly3DQgQUkKeYsnCb1dD3BW7Dk+Ga1AFwxrZEbatUxm7eL8d1pBMsP7i2duuG0rUf1QYaBW5tXW+2tqLJlWK8lc9xGk4LgApKNHBZKZAfLFkDLOCdHN/ejfHQTVOJmtIBsABNVL+fJnl4tyxXqUwQiNdGS9oJlEfRcRlxWVEDKA+Dx7GS26qGwZzeb8nJAcDw83/URTANdIM4jr6yiFJkOwrt2mik90dlYXAJGtkcSfyQy4jLqgThWwSZH70Opg/5D/wxF4E5OYDWHZf0Z+TwdXxfkYvQmZqGewI0KfKBpnD3f85UG0vVrqZwzzelTP0zl5EbNhSLTk0EgNrq9+7cuvJgLphycgAsqCPZ+FlTpXMSyuln8kpdrH9pqUv+ZSbbWEq2raOyQICievjILf6kNPqpreb8o6E5OwA2SMOqL5fzbQBzwKtSBpgyfeG6SPK+y0IPnsRx3uo8A8z9ukjiPkllwWXiPIJi00jdfy34lXxQ5eUAnhb3f7dCn0/yy3l8lcynRSlJTiB1kR/0R6+s715AUd7iIANX1t+9wA++R8gRX8Rl4aDqIlWlIEBtc+ferkmf/BsNPi8H0NPzgcxwZve7da1qtJwyPVY0NKiqJFTvuqJ+u6M/ZFGmhFNPH+CK8Pb3SnXiLgWyuhh6pMVQFrqogqHM7vfxE6L54MnLAbDgUN/KX5nm4BO8760jDKSNA2CYqZ9GQ509IzHef5sY4B+r6TEg9dO0ecAmFaUp1pSDT0X6Vv5PvujzdgAbAKXAim8I9OWra0anlzQuAIB1zeHeZ5tCnVHwgqUMRENbm5ojvX9D4niEa0vFl7QwRB2EFvwmt818DcnbAbCCtkToZ0qaewAQvPAKAwokSJU+WaDeHg33fm2iX2N5JYe3NxUDzGE03P01RF+MBvtOYY6nylNe56kNKrW/rbf2x4XYXZADYEUo9PPo/kvyvrcezQCSE8iAQPyczzAfW1374JuPPuvt587AmtDWNzGHArXPyexvVVBlzz27IyndV6KUptTKQnEU7ADaE5HH/aLmNgCvUGCcQKPTNEAIJ1X6FtzZFO7aFF3Wt2icZF7UOAxEl3Utioa7O4L63N/TfNNJzOU4ybwoYkDXam5v7Wt8lHYLWgp2AKzt5viStX697L6zwKbnvKaMfYAK1igxtK053POrnDOWacLmUM+vlJDbQKm1zF2Z0pCT2RW++dDau+TynBJPkGhaDoBlmubB9cBVHLwwEQOH71srAfAdzeFe1Rzu/Nili7fM3B8AgPzCpYvvmMWcMDeA+A7KXXmYM9r1lokYGDL3XTXRuVzjp+0A2hINrZrwv0jjAbnqLNt0fB87sqrvVFYHdq8Jbfls2ZJx2PA1oc3/Wll94m6p1HdGuMkcPlP8G/cQKtBF5Qub4o1Tvu47FcZpOwBW4PNrEU0Eeddbc2RAqrTPJ4L/QVOGA82Rnuujkd5Tc8xa8snY1mayuSm0dcAnKr/OXJS8UQ4aoIlK0MDXYIVKSxzATVuXvYTg+5AVgMpJhimHyVxVKaXxER8Gn2kOxf+PGsWZLUu2++nEjFrYJrZtXaj3z2wr20wGVo5wQHvekjMDiHDNb+NnP59zhkkSWuIAWH5r/JwfIWp7eN9b82cgbR6kWQPjEk1UPGr6aMAwlPhZcyhxbv6SiisH20Drz9gmtk2C+Tq2tbhQlg4aRHHg3N5lln2izjIHADQQGEs0LNBwxl28wKmgQAJfERXIMyWk36Nr/u3N4d6d0XD8Q3z1XH3WIzVOYSlUD2NkrIy5Odyzk21gW9imw7YVKrqo8rkBRsMA1CZun7cB0LLnbyx0ACOUmGD8v5E97//0GFCQNg/xQ0ULEeT3EfBhX3Dw4XWRvr5opPeaN9beVTU9+dblZizRSPc1jI0xMlbGLJWxkG3wBoit4Vop49oNsMGyxs+oLHcAHYnGryJoPQJ1KK2ARQuXGhLdHighVeYkUw4tQ4Xfne9f3N8U6jzYFO6++W2RHVc3h7a+qbn+0bOblm/l97VtsaXp7K3zWQfrehvpZN2MgbGg0r7L2BijAsZq2ILBGqHFW9bj2YfUllCJvvZkw5fHOz+dOMsdAIPRModWSWW+xPulsPo07lmrfoFaKcClXkEahjP8oWZVA8pcn5YDv6TLwu+lsT8p0r6/ra975EA01PO3aKiz7W11D31+bWjL1auXbm24/My7p/xuAafhtJyH87KMKMlimaJC/xvrYF2sk3UDqBrGIlW6JLgbuTDJ/pEyLwnIRLHcpRnBC+xAa4sD4G8ICtDeFdDn2IF52jJpMAp09YmwxAAADBNJREFUmkpBof8eUfu8gbtf1ZFcUSOlvFTDwM5pK3BYgKKxg8Mq/VJlKjPm/lkKjFMARXNGpr5Ktv6ywl/TVVVz8q6rGp5Wb2/8q7qq4Rl1ZcOT2ZX3R+KeVpyG03IezssyWBbLlMqoJD3ZQZ6jdFJUaSwa+F8ylPHmjuTKGjX80omotM8L9N2p0xQ21wnIMTiZjJ+0RYR3t+5Y2m+HXlscAANtT9bfZRj9/yRQ58OiWBGEpMLOKEh9qDW+DGPx+ktp4PI/Yj0XvwAUOvqW/x4Tj70KURuiwxJeRrq4SpnUW8jQwOIQZGg8IWXshaHMThhMv0jbl7K9CL56D2VeOhy3EzgNp6XufDYvyxghYkTmyH7p/Rfo29mWjJxwS3LFXYyeLlIvxvoa/qM9UfeW1ngtSpn+Z00EM0h1BIokCGo7hup/f3ui8Q67INnmABgwnvnkL6kCxQHcqDwKBPqg0n8iAGCnX5v1AaUgRIXtb48v/yFMEFphvRlLNFRq6P9She+4CVJ50aXCQNC3AATon2xP1B0Pk4RYsvHHbfFaP4Kq9WtVHwDALVx3BNUh6oODG0GB7BOnP5n3Rz7ywWqrA2htpcaUXF6HKBy7oiJqZD+mfdqsXabKXP+brldjR3L5ipt7z/lJR1/jdjqZ09KWiGww0rvPBsQ9mJWZUzYvUZEwwGUmUH9hWO17VXuy/rpcYbUnlz90c+/Sn3Qkl5/HdUeq9He5LlH+NDpYD0hXKpZoDHEbIt22LbY6gCOopQbLdI1vH0EdibNyi4AQ0OeRSNwtwPc+UFi/sfec4zclV3wUphH4NUs9XXUmoviuJipYki34WbC3WsaA4rqGSv9ypmrorFhPQ/b2rlDpNF7wMa5LArBOw8B7Sc5OrmsIAuwJ/Jx/EBC0ZeBAsMuKY6Bv6ml4MmMMrBOo4zEnpnGAqAFSIQj0PQ4oWjN6/5nktRfy14pGrvRoSWNt3XHu3vZ43cdMmWoWwv+iwOIZ0wAvHMOAoO46Cv05U+KF7cnwtbc+cOGhYxIUfICKewY0bvTzjuSK402VPkMhbiR9jyPVQaS6CBYFgX7IQP9V7YnI4xaJnFSMIw6AEWzqW9lOrf8LANNrl4IKWafeBKL+dU3HU0VwOBRLNKxv32ovYR3J5TGR8p2GIL7g1/hN3unZAV6wkAEFPq0aaLzpnxcIdXossfQBC4WPEdXae+4THYmGK7jupTN4KoD2NV2rAq6bYxLnFcF1Sv2/TfHzp/2WX65qHXMADKgtUc/fdvuNJgJ8mNOKKLKFCwB/Fei7UQBe1tq7DNvj4c+19jT8rXXz+Y6NL9BUTLotEfnacGZfrS5q/piPHYTfW2xggG/NdK361uHhA2fEaCDvJz0Njr1PzHXvdzsa/hZLRL7Q2rsUqU/6Vg39vwHAZ9ghIdVdyDFwXULw/bY9Uf/VHLNYkkxYIiUPIbFE3TuF8N0+dU9Aga7RvZAStxmZwdNDyeWL2hN1b29NRChvHgptSHrLtvO3tcbPfSMNEC0X6LNBgydyagYQEEQ6ZQ4vosa35tYd59v+qXqYImxMRO5oS0TeEUo2np6WB18DCm7TqbeaS12nHu2dsWTd26dQYflpxx0AAMqNPRvWaKL6Jl3w4+w08UJMcXH6st0ofUCA/j9CBNcNv/jXqvZk/erYtsanNlA+KLIQSyzvak/UoRC+DwnQaHyAn5HhblyRAZ0xcBRo1HtE1J5Ege+NJRsDt/WteLrYzOO6uilx3jOEb/VzOx+u5LqM6PuZQG2A6zjXdUV1HgDpIlcFuqi6edesXavpWILDwQUHwBa2mm3xpVehgNcJFDuCvuMO0g1cX8oceHN7or66PVn/nvZ4qP225y8f5NTFvrbH637Ynmw4USnzixr6M1zAxY659PAhCNQzSqmPxBINi2Pxxp9DCYTNz60f4rpMPd/3tScaqtPpA29SSvZxnReAj6ISb6DBxbfdc88lrrw8IdzkcGPP0ruJlHNv6l40O9a3InTkKS03MU1HdyzZ8JWBQHqBwIr1CFq/LrJTh+CFwhnIXjFR7BYC14lgenZ7IvL9wqW5n3PT9gv+0NG3MsR1vj3ZePbG+JI/uYnKVQfgpuF26ebfZW9L1LaSM6gxVObdQlQ8RroMBI9qyDEgcYUAGV1UPZQ2+tfFEo0L2+ON7TzoBi6FmarWq5U2lmxHouEXe2bvPVfp2tmI+NMKfT4gajZqLG3RzE1AnwsgtOs1VXFWa7ytlqePS9uq4kbvOQCby4fv7fhBKLrVef9j8Gc/Ilyr0UCWzWpLTjxP51E3/0tmT0KPxes+2toXosG9DY4PipUccdME7DmAaRKYT/aeng9kRPypr0qZ4q+B5pN1xqc1ZcrA3ie/0grrzRlvbBEZ6DkAhwvjXGhRgILHBRzWXOTqEB7LclOEMGcyJM8BOFy6GwClhgFyAMphzcWtjgdLN0z9xExxG1GC6DwH4EKhSWU+C+BRfzT1qCRxgp5XPJoUB/a9WugAyaNVCPTdI7zZgJdpEajTtV/85eUIb8cxBjwH4BjVryhKZV7cqgt+DPqVuHLe00QQMsbwlmLkYKZj8hyACyV86/bXv4ReD+Bl5jVRAbdsX063AC9HeTsOMeA5AIeIHq3GMA/+Ab1xAED6Sxl77wcvuMKA5wBcoR1AQuZOmg50SXsRqUWuguq2IkJUVlCY/bIyuFiM1bTqmIbetwQ09IOmzfttsZTL0TjKYd9zAC6VspE5MGzIIce+ZuSSmVOqNeRwKpXalZoyoZfAFgY8B2ALrVML1Y30IIDYOXXKmZ0CEV4KyOqBmW1l8VrnOQCXyqZ1xyX9AX32CwDl/OyLAp82+4VWm372yqWiLSm1ngNwsbiGMrv+jlDOrwcLoBmAXVCEoVwgeQ7AxZL2a1W3CH4KzkUMbqoW6AOfqtzkJoZy1+05ABdrwMHUi7f7dP6NARdBuKjar1WD6Ttwh4sQyl615wBcrAJ37XjzXhoFdxGBu6oVKIj1jPwys7tIyle75wBcLnvTGLwXAKEcQ9rcv7kY7S4nTJ4DcLm0lZB/xDJ0AAgClBJ/BC+4yoDnAFylH0BH3/1Ak+Euw3BePdmsaz7q/Tiv2tP4CgPilV1vzw0G0pDepZQsuyfhlDLThpEu+weh3KhzR+v0HMDRbLiwXyn0nYBi0AXV7qrM2lx8DsBdUpzX7jkA5zk/RuNNPQ27faJyqLyeCFTgF1WDHX0X7DyGDO/AcQY8B+A45WMVGuahbVhGDwQhaJAx+x8BL7jOgOcAXC8CAIEVbaKMHIAQPtBFsLUIqC97CJ4DKIIqsHv/U20+raYIkDgDwSeqQEGm3RltuWspx5SeAyiCUr/nmab9aeNQESBxBoIhh6A1Xue9BOQM3ZNq8RzApPQ4dxJRls1nsU2V8Z4AdK5qTarJcwCT0uPcSaXUVue0ua6pnGx1nezJAHgOYDJ2HDyn68FtDqpzVZVPr467CmAc5eUa5TmAIil5mUk/RVDK4fNAKm0O/JVs9ZYiYMBzAEVQCAzhoH7wSQ19M94BCLLRBHicbfZW9xnwHID7ZZBFcFfPxS+YYLwEgDBzA/LvIey+NV73/My1sbQs8xxAMZWXzIRR6MbMfCxYgUDN1H0YKibKGUs5r54DKKLS52fjTTAvnYkPBWVtUqm3tnYtf7GIKC97KJ4DKLIqcEu88U9q//Nz/Nrsd9AV8xeIWp8uKqFCXwC8Fci/JsS3CcU0XMBYkK7w2Ud8X8YKILYhar8M6HPfnpY757Ynz78LvFBUDHgOoKiKYwRM61NvOHBz79m/aU80vDuWaAi1xpehse+pORIy6+j24DpEfLhCn/echr7ddHwIAYYpp0LUAVEDBC5WiqU9yK5QYHhFBpJMZNmkA0gpnSGd6hBjqCAsSJgUqO+YYLQwVsbckWysJfzv+m3PmTduSlyyn/J5S5ExwDWlyCB5cMZjgJ1Ce7yuvT1R/8lYonHJTT1nnpIeGlyEKrgEpRahO+yVflF9sQD/Wroef1IBXq+JCupBiNsBsBNB8dt3zwEAN8RBBEwDNWReR/aRv0lA5/BZin6U4ruowd/OMqhhf08BfFKQbNYhlTwPdS3CuhkDY2FMsUT9J2LxujbGSvlLYil3kP8fAAD//7HH6iYAAAAGSURBVAMAyTzxUhiUNjIAAAAASUVORK5CYII=" preserveAspectRatio="none"/><filter id="a" filterUnits="objectBoundingBox" x="-.05" y="-.03" width="1.09" height="1.09"><feOffset result="offOut" in="SourceAlpha" dy="2"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="3"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="D"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="E"/><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="F"/><g id="b"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#F"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="G"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="H"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="I"/><path fill="#697986" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="J"/><path fill="#697986" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="K"/><g id="c"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.04,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.30222222222222,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.49333333333333,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.995555555555555,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,52.257777777777775,0)" xlink:href="#K"/></g><pattern id="d" patternUnits="userSpaceOnUse" x="-227.84" y="-27.83" width="76.8" height="76.8"><use xlink:href="#L" transform="translate(0, 0) scale(7.68,7.68)"/></pattern><path fill="#6f7681" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="M"/><path fill="#6f7681" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="N"/><path fill="#6f7681" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="O"/><g id="e"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#O"/></g><path fill="#6f7681" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="P"/><path fill="#6f7681" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="Q"/><path fill="#6f7681" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="R"/><path fill="#6f7681" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="S"/><path fill="#6f7681" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="T"/><path fill="#6f7681" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="U"/><path fill="#6f7681" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="V"/><g id="f"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,5.333333333333333,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,13.102222222222222,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.982222222222223,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.115555555555556,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.93333333333334,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.720000000000006,0)" xlink:href="#V"/></g><filter id="g" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="W"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="X"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="Y"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="Z"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="aa"/><g id="h"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#aa"/></g><path fill="#697986" d="M375-529L38-1026h238c37 0 48 9 63 32l215 343c8-25 17-47 31-68l173-270c15-21 26-37 57-37h227L704-540 1056 0H818c-37 1-57-23-71-46L529-403c-6 24-14 44-25 60L312-46c-14 20-33 47-67 46H24" id="ab"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="ac"/><g id="i"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#F"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.373333333333328,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.94666666666666,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,37.54666666666665,0)" xlink:href="#ac"/></g><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="ad"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="ae"/><g id="j"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#H"/></g><pattern id="k" patternUnits="userSpaceOnUse" x="-787.55" y="-34.79" width="88.84" height="91.9"><use xlink:href="#af" transform="translate(-1.5316689899764242, 7.105427357601002e-15) scale(9.190013939858911,9.190013939858911)"/></pattern><g id="l"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#aa"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ag"/><g id="m"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#Y"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.675555555555547,0)" xlink:href="#Y"/></g><g id="n"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#G"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#H"/></g><path fill="#6f7681" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="ah"/><path fill="#6f7681" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="ai"/><path fill="#6f7681" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="aj"/><path fill="#6f7681" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="ak"/><g id="o"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,11.644444444444444,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.85333333333333,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.044444444444444,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.54666666666667,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,46.80888888888889,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,54.577777777777776,0)" xlink:href="#ai"/></g><path fill="#6f7681" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="al"/><path fill="#6f7681" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="am"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="an"/><path fill="#6f7681" d="M395-1486V0H148v-1486h247" id="ao"/><g id="p"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.155555555555555,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.26222222222222,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.36888888888889,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.47555555555556,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.977777777777774,0)" xlink:href="#ao"/></g><pattern id="q" patternUnits="userSpaceOnUse" x="-501.09" y="-34.79" width="88.84" height="91.9"><use xlink:href="#af" transform="translate(-1.531668989976481, 7.105427357601002e-15) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#697986" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="ap"/><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aq"/><g id="r"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.72888888888888,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.608888888888877,0)" xlink:href="#aq"/></g><pattern id="s" patternUnits="userSpaceOnUse" x="-787.55" y="285.13" width="88.84" height="91.9"><use xlink:href="#af" transform="translate(-1.5316689899764242, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ar"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="as"/><path fill="#6f7681" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="at"/><path fill="#6f7681" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="au"/><g id="t"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ar"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,12.622222222222222,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.72888888888889,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.608888888888888,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.715555555555554,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.217777777777776,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.324444444444445,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,66.20444444444445,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,71.02222222222223,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.50222222222222,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,88.8088888888889,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,95.68888888888891,0)" xlink:href="#ai"/></g><g id="u"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.106666666666667,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,17.875555555555557,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,27.377777777777784,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.64,0)" xlink:href="#Q"/></g><g id="v"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,6.879999999999997,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.648888888888884,0)" xlink:href="#aq"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="av"/><g id="w"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.968888888888882,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.44888888888888,0)" xlink:href="#Y"/></g><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aw"/><g id="x"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.479999999999997,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.58666666666666,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.69333333333332,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,38.79999999999998,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.3022222222222,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,56.782222222222195,0)" xlink:href="#aa"/></g><path fill="#6f7681" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ax"/><path fill="#6f7681" d="M415-222h579V0H146v-1446h269v1224" id="ay"/><path fill="#6f7681" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="az"/><g id="y"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.96888888888889,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,25.546666666666667,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.73777777777778,0)" xlink:href="#az"/></g><filter id="z" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><g id="A"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#D"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.533333333333328,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.453333333333322,0)" xlink:href="#F"/></g><g id="B"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#E"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.737777777777772,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,21.55555555555555,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.05777777777777,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.16444444444443,0)" xlink:href="#aa"/></g><path fill="#697986" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="aA"/><path fill="#697986" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="aB"/><path fill="#697986" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="aC"/><g id="C"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.115555555555538,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.933333333333316,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,44.71999999999998,0)" xlink:href="#aC"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/mcp-access/architecture.svg b/docs/img/mcp-access/architecture.svg
new file mode 100644
index 0000000000000..40ad9c7af7c35
--- /dev/null
+++ b/docs/img/mcp-access/architecture.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1304.43" height="506.33"><g transform="translate(660.5068840230773 -401.97138346414374)" lucid:page-tab-id="vEfyK7~VCnsd"><path d="M-1000 0h2000v1000h-2000z" fill="#fff"/><path d="M-60.5 409.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-60.5 549.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-60.506884023077305,543.9713834641437) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#c" transform="matrix(1,0,0,1,-60.506884023077305,543.9713834641437) translate(9.475555555555573 38.87999999999998)"/><use xlink:href="#d" transform="matrix(1,0,0,1,-60.506884023077305,543.9713834641437) translate(59.937777777777775 38.87999999999998)"/><path d="M-42.04 428.05a6 6 0 0 1 6-6H40.8a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#e)"/><path d="M-339.9 409.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-358.04 549.97a6 6 0 0 1 6-6h152.3a6 6 0 0 1 6 6v16.33a6 6 0 0 1-6 6h-152.3a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#f" transform="matrix(1,0,0,1,-358.0409970806121,543.9713834642238) translate(18.108888888888913 21.379999999999995)"/><use xlink:href="#g" transform="matrix(1,0,0,1,-358.0409970806121,543.9713834642238) translate(46.295555555555566 21.379999999999995)"/><use xlink:href="#h" transform="matrix(1,0,0,1,-358.0409970806121,543.9713834642238) translate(83.22888888888889 21.379999999999995)"/><path d="M-247.97 439.8h-54.87c-3.06 0-5.73 2.64-5.73 5.74v43.36c0 3.32 2.47 5.75 5.53 5.75l25.44.44h29.9c3.06 0 5.72-2.66 5.72-5.76v-43.8c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.2l-11.12 7.74c-1.05.66-2.38.44-3.05-.44-.66-1.1-.46-2.44.47-3.1l8.4-5.97-8.4-5.98c-1.13-.66-1.33-2-.47-3.1.67-1.1 2-1.32 3.06-.43l11.13 7.74c.67.44.87 1.1.87 1.77 0 .66-.47 1.32-.87 1.77zm22.98 10.4h-17.7c-1.34 0-2.2-.9-2.2-2.22 0-1.32.86-2.2 2.2-2.2h17.7c1.34 0 2.2.88 2.2 2.2 0 1.33-.86 2.2-2.2 2.2z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M-209.9 467.97H-79" stroke="#697986" stroke-width="2" fill="none"/><path d="M-209.86 468.95h-1.03V467h1.04z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-63.74 467.97L-78 472.6v-9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#i" transform="matrix(1,0,0,1,-143.39068875207636,471.9713834642601) translate(0.004999999999999005 17.546666666666667)"/><path d="M-60.5 729.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M-60.5 869.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,-60.506884023077305,863.9713834641437) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#j" transform="matrix(1,0,0,1,-60.506884023077305,863.9713834641437) translate(13.133333333333354 38.87999999999998)"/><use xlink:href="#d" transform="matrix(1,0,0,1,-60.506884023077305,863.9713834641437) translate(56.28 38.87999999999998)"/><path d="M-42.04 748.05a6 6 0 0 1 6-6H40.8a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#k)"/><path d="M225.96 409.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#a)"/><path d="M225.96 549.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#b" transform="matrix(1,0,0,1,225.9571132894822,543.9713834641437) translate(30.555555555555564 17.54666666666666)"/><use xlink:href="#l" transform="matrix(1,0,0,1,225.9571132894822,543.9713834641437) translate(16.626666666666686 38.87999999999998)"/><use xlink:href="#d" transform="matrix(1,0,0,1,225.9571132894822,543.9713834641437) translate(52.78666666666667 38.87999999999998)"/><path d="M223.96 467.97H86" stroke="#697986" stroke-width="2" fill="none"/><path d="M224.96 468.95h-1.03V467h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M70.73 467.97L85 463.34v9.27z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#m" transform="matrix(1,0,0,1,114.18513963320227,471.9713834642602) translate(0.005000000000002558 17.546666666666667)"/><use xlink:href="#n" transform="matrix(1,0,0,1,114.18513963320227,471.9713834642602) translate(5.147222222222222 38.879999999999995)"/><path d="M244.42 428.05a6 6 0 0 1 6-6h76.84a6 6 0 0 1 6 6v79.9a6 6 0 0 1-6 6h-76.84a6 6 0 0 1-6-6z" fill="url(#o)"/><path d="M109.47 782l-.08 1.06-.27 1.07-.42 1-.56.94-.7.84-.84.72-.94.57-1 .4-1.08.26-1.05.1H87V787h15.45l.83-.07.77-.18.72-.3.67-.42.6-.5.52-.6.4-.68.3-.73.2-.76.06-.83V669.3h1.95zm-5.9-274.92l1.08.25 1 .42.94.58.83.7.7.84.58.93.43 1 .26 1.08.07 1.05v112.7h-1.95V514.02l-.07-.8-.18-.78-.3-.73-.4-.68-.53-.6-.6-.5-.67-.42-.72-.3-.77-.2-.83-.05H69.5V507h33.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M69.52 508.95H68.5V507h1.02z" fill="#697986"/><path stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M86 792.6l-14.27-4.63L86 783.34z" fill="#697986"/><path d="M86.97 793.95l-18.4-5.98 18.4-5.98zm-12.1-5.98l10.15 3.3v-6.6z" stroke="#697986" stroke-width=".05" fill="#697986"/><use xlink:href="#p" transform="matrix(1,0,0,1,55.897510421367485,626.6380675159911) translate(0 17.546666666666667)"/><use xlink:href="#q" transform="matrix(1,0,0,1,55.897510421367485,626.6380675159911) translate(31.39611111111112 38.879999999999995)"/><path d="M512.42 406.97a3 3 0 0 1 3-3h122a3 3 0 0 1 3 3v120.88a3 3 0 0 1-3 3h-122a3 3 0 0 1-3-3z" stroke="#becacf" fill="#fff" filter="url(#r)"/><path d="M512.42 549.54a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v16.76a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#s" transform="matrix(1,0,0,1,512.4211106020417,543.5427517544908) translate(12.488888888888894 21.380000000000003)"/><use xlink:href="#t" transform="matrix(1,0,0,1,512.4211106020417,543.5427517544908) translate(55.48444444444445 21.380000000000003)"/><path d="M538.02 429h76.8v76.8h-76.8z" fill="url(#u)"/><path d="M355.96 463.97h137.46" stroke="#697986" stroke-width="2" fill="none"/><path d="M355.98 464.95h-1.02V463h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M508.68 463.97l-14.26 4.64v-9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><use xlink:href="#v" transform="matrix(1,0,0,1,364.14577546479484,472.60663837988443) translate(29.10277777777776 17.546666666666667)"/><use xlink:href="#w" transform="matrix(1,0,0,1,364.14577546479484,472.60663837988443) translate(76.24055555555555 17.546666666666667)"/><use xlink:href="#x" transform="matrix(1,0,0,1,364.14577546479484,472.60663837988443) translate(0.0049999999999954525 38.879999999999995)"/><use xlink:href="#y" transform="matrix(1,0,0,1,364.14577546479484,472.60663837988443) translate(92.88499999999999 38.879999999999995)"/><path d="M-635.25 409.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff" filter="url(#z)"/><path d="M-635.25 549.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#A" transform="matrix(1,0,0,1,-635.2549243376145,543.9713834641437) translate(18.480000000000018 17.54666666666666)"/><use xlink:href="#B" transform="matrix(1,0,0,1,-635.2549243376145,543.9713834641437) translate(61.47555555555556 17.54666666666666)"/><use xlink:href="#C" transform="matrix(1,0,0,1,-635.2549243376145,543.9713834641437) translate(38.97333333333334 38.87999999999998)"/><path d="M-555.98 453.74c0 8.54-6.9 15.42-15.4 15.42s-15.45-6.88-15.45-15.43c0-8.54 6.94-15.42 15.45-15.42 8.5 0 15.4 6.9 15.4 15.44zM-598.68 492.9c0-10.5 8.5-19 19-19h14.2c10.5 0 19 8.5 19 19 0 2.6-2.14 4.73-4.75 4.73h-42.7c-2.6 0-4.75-2.13-4.75-4.74z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-505.25 467.97h145.86" stroke="#697986" stroke-width="2" fill="none"/><path d="M-505.23 468.95h-1.02V467h1.02z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-344.13 467.97l-14.26 4.64v-9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><g filter="url(#a)"><path d="M-339.25 729.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#ced4db" stroke-width="2" fill="#fff"/></g><path d="M-365.5 869.97a6 6 0 0 1 6-6h173a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-173a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#D" transform="matrix(1,0,0,1,-365.4899489955077,863.9713834643402) translate(42.731111111111126 17.54666666666666)"/><use xlink:href="#E" transform="matrix(1,0,0,1,-365.4899489955077,863.9713834643402) translate(83.69111111111111 17.54666666666666)"/><use xlink:href="#F" transform="matrix(1,0,0,1,-365.4899489955077,863.9713834643402) translate(2.3622222222222575 38.87999999999998)"/><use xlink:href="#G" transform="matrix(1,0,0,1,-365.4899489955077,863.9713834643402) translate(39.88222222222224 38.87999999999998)"/><use xlink:href="#H" transform="matrix(1,0,0,1,-365.4899489955077,863.9713834643402) translate(110.20222222222222 38.87999999999998)"/></g><path d="M-247.33 759.8h-54.87c-3.06 0-5.72 2.64-5.72 5.74v43.36c0 3.32 2.46 5.75 5.52 5.75l25.44.44h29.9c3.06 0 5.72-2.66 5.72-5.76v-43.8c-.2-3.1-2.66-5.75-6-5.75zm-32.7 27.2l-11.1 7.74c-1.08.66-2.4.44-3.08-.44-.67-1.1-.47-2.44.46-3.1l8.4-5.97-8.4-5.98c-1.13-.66-1.33-2-.47-3.1.66-1.1 2-1.32 3.06-.43l11.12 7.74c.66.44.86 1.1.86 1.77 0 .66-.46 1.32-.86 1.77zm22.98 10.4h-17.7c-1.35 0-2.2-.9-2.2-2.22 0-1.32.85-2.2 2.2-2.2h17.7c1.33 0 2.2.88 2.2 2.2 0 1.33-.87 2.22-2.2 2.22z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><g filter="url(#z)"><path d="M-634.6 729.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#becacf" stroke-width="2" fill="#fff"/></g><path d="M-660.5 869.97a6 6 0 0 1 6-6h168a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-168a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#A" transform="matrix(1,0,0,1,-660.5068840230773,863.9713834642602) translate(44.48000000000002 17.54666666666666)"/><use xlink:href="#B" transform="matrix(1,0,0,1,-660.5068840230773,863.9713834642602) translate(87.47555555555556 17.54666666666666)"/><use xlink:href="#I" transform="matrix(1,0,0,1,-660.5068840230773,863.9713834642602) translate(15.373333333333363 38.87999999999998)"/><use xlink:href="#J" transform="matrix(1,0,0,1,-660.5068840230773,863.9713834642602) translate(113.58666666666666 38.87999999999998)"/></g><path d="M-555.34 773.74c0 8.54-6.9 15.42-15.4 15.42s-15.45-6.88-15.45-15.42c0-8.55 6.95-15.43 15.46-15.43 8.5 0 15.4 6.9 15.4 15.44zM-598.04 812.9c0-10.5 8.5-19 19-19h14.2c10.5 0 19 8.5 19 19 0 2.6-2.14 4.73-4.75 4.73h-42.7c-2.6 0-4.74-2.13-4.74-4.74z" stroke="#000" stroke-opacity="0" fill="#697986"/><path d="M-504.6 787.97h145.85" stroke="#697986" stroke-width="2" fill="none"/><path d="M-504.6 788.95h-1V787h1z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-343.48 787.97l-14.27 4.64v-9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><path d="M-209.25 787.97h42.74a6 6 0 0 0 6-6v-308a6 6 0 0 1 6-6H-80" stroke="#697986" stroke-width="2" fill="none"/><path d="M-209.22 788.95h-1.03V787h1.03z" stroke="#697986" stroke-width=".05" fill="#697986"/><path d="M-64.74 467.97L-79 472.6v-9.26z" stroke="#697986" stroke-width="2" fill="#697986"/><defs><image width="10" height="10" id="az" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aeyde4xc133fz7l33sOXzNXDdGXLQOmGtotUCWWlBZwWbdMk0h+pmAqxU6uKlYoSl0tHKz6Wu5So0YO7XHIpqhK5guQ2dus2cRxEbovYbdAWBRw0qCsmAdrIbKE/XFi1LJuUbZGcncede0/P95IbcOm973tn7sx8B3M4d875vc7n3t93Z4e7s4bgjQRIYGwJUADG9tRz4yQgBAWAVwEJjDEBCsAYn3xufbwJYPcUAFDgIIExJUABGNMTz22TAAhQAECBgwTGlMBQCcC+ffvKuxtLE/s5yCCH1wCuzUajURoGLVmtcSgEoNF4pbZn9rn/Im760P82u9b5lh4rHOfJwMoNA1yTuDZ/qDb+nz2z83/UaHyhstpkeX7MuwDIfU8sHrxctJpSmn+3Z3XvEEpNKD3wyKEmyCAfDFavSavbvkNK+Q/eMy+1po6euj/PzY/aci0Ae2YX/pftOCdWrlzS17lCvRwkkHMC0r1W2ytNoZzeVz535OSv5LngnAqAklNPnPiXhiE/ppU1z/xYGwl4EnBsWxSr5X87/fw/f5+n0QAWrk+ZSwHYc/j4FmkY/8RxnOtr5TEJDB2Bln4l0LrwgxfyWnguBUAa4k/snpVXZqyLBEITwCvYgmn+3P05/d+B3AnAo4cX7jTNwk8BXGjKNCSBHBMoFIrbt/WqH85jibkTgGKp8HCPX/3zeK2wppgEOp22cKTxP2K6p+p2Y7DcCYB+4+SBG4vkcxIYdgKOY2+aOrr0i3nbR64EYPLwwpP6zb8NeYPEekggKQG8oe3Yvd9MGidt/9wIQKPRKBRKpWfsXi/tPTIeCeSCgJTy/ry9GZgbAfh+t/Ipy+rk4kSxCBLIhIAS4pZe9dVMYocIup5JbgRAKPX4egVyjgRGhYB+H0AYhvng3tn5rXnZUy4E4OHZxkdq9Q135gUK6yCBrAj0rK4wzOI/yip+1Li5EIAN1S1fXmlejlo77UlgKAn0nN5zeSl84AKgXw59pNVq7sgLENZBAlkTKJcqE48efu6+rPNcH9/reOACIE35GUMaQ/G7014QOU8CUQh0Oi1RqdaXovhkZTtwASiWqk/yx36zOr2Mm1cCnXbr9s81Tn580PUNVACmZhde6nbag2bA/CTQfwJSFntdNdP/xGszDkwApqefr8pC4V78hNTakviMBMaAgFKiWq9+Zl+jsSnr3frFH5gANDe3PySkyOVvSPkB4xoJpEVgpXlF9KzSv0krXpw4AxOAUs/8Rs+y4tRMHxIYDQL6VYAUxicG+SpgIAKw9+jiL0gpbxa8kcCYEzBN8xblVP7moDAMQgCkUHJfj7/0M6hzzrw5IoBXwaZR/MOsSgqK23cB0G/+VYTt3BtUGNdJYFwIWJZVmDq6+NlB7LfvAmDVrCVhyL7nHQRc5iSBMASU4win5zyolJJh7NO06WsjTjYaG4rlyqRj22nugbFIYOgJmIXC3374sflb+r2RvgqAYVcebbea/d4j85FA7gnYPVuUa+aX0yw0TKy+CoDdcz4XpijakMC4EVDKEYVy8e9MHXi2rz8b0zcBeHjm2C+WKpXbx+3Ecr8kEJZAt9MR5ob6Pw5rn4Zd3wSgVq3+i267nUbNjEECI0vA6naf6Ofm+iIA+xqLn+i027f1c2PMRQLDSMA0zfLk3PHfSlp7WP++CIBjqUekFKbgjQRIwJdAr2cJwzSf3r17d9HXMKXFzAVg9yuvFKu1+kMp1cswJDDyBHqWtam2bfsn+7HRzAWg8H/f/ff4rad+bIY5SGAUCOhXy7Lbteb6sZdMBeA3G8+/TxrmXUqpfuyFOUhgZAjU6hv/3lRjcVucDUXxyVQAar3eTillbj4DPQoY2pLAIAk0r1wWquN8PesaMhUAYciv2nYv6z0wPgmMJAH9uvmv7p479v4sN5eZAOw9svSgcpxalsUzNgmMMgFpGvWiYe7Kco+ZCMD993/FFMraY/OXfrI8d4w94gTwS3OlUuVMlG1Gtc1EAG798LdvFYZxd9RiaE8CJLCWQKfTFvuOnMjsfwQyEQBlOp/nO/9rTySfkUAcAvrbaGEL51O7d7+SyQ8GpS4ADx1qbCvX6/eg8Dgbpg8JkMBaAqZZ+Oty67vb186m8yx1AdhU3/S5VvNKOtUxCgmQgLB7ljCE/FoQijjrRhwnP59uu/Oo3zrXSIAEohHAt9PFUumOqSPP7YzmGWydqgDsmVv4p2ahsDk4LS1IgASiELC6HVEsb0j9g0PTFACpv1d5Eb/NFGVjtCUBEghHQP+PwGQ4y/BWqQnAbz1x6t6eZfHPfIdnT0sSiERASimmnjxxcj2nuHOpCYBld/fq+vr+scZxN04/Ehg2AvjBIOWo6TT/lFgqAvBY4/SW2saNvzRsQFkvCQwbAcexTceq3pdW3akIQKfb/m/Ny5fSqolxSIAEfAmoad/lCIuJBeDRwwt36Nf9d0TISVMSIIEEBCq1+k9PHjz2N1ZDJHlMLAAF07hHCMnf+hO8kUB/CKxcuSyMSukP08iWWACMQuElpZw0amEMEiCBkATsXu+Wqdn5nwpp7mmWSAD2Hjk+pwtJFMOzMi6QAAl4EtD/41a0hfGIp0HIhdjNu+/FF8tCiQf1u5IhU9GMBEggLQJKKVGpVh9LGi+2APTeufzXpGF8JGkB9CcBEohHoNNeEVNHl16M533VK7YACGF8mV/9r0LkvyQwCAJ4FeD0rH842Ti7IW7+WALwyMwzP12t1HaggLiJ6UcCJJCcgGkWbjft5p1xI8USgA0bNk+3Wvyd/7jQ6UcCaRBADPzynWX1/iuO44xYArDSWvm0EFLwRgIkMHgCxVLJfGTmuV+JU0lkAZicPf6IftlRipOMPiRAAukT6HU7olbf+Kk4kSMLgFL2UYd/7CMOa/qQQDYEpBSdduvuRqMRuZ8jO2zYtGWbcviTf9mcSUYlgXAEbrTSPfnBNz760cjfl0cWAAfNHznNjeXyOQmQQKoEDGle+Na3IndmZAHotlsdwTcABW8kkCsCSvzg5jfeUFFriiwAyhDLhmFGzUN7EiCBDAkUCub//P2vfCXy9+aRBWDCWDkkRGShyXDrDE0C40Xgxt2apilsx/53QsrIjRlZAPQ7jT2jUPjijUXwOQmQwGAI6P+Z++HysdkzcbJHFgAkeenpAw8VS+X/aBYKeMpBAiQwIAKGab6nit0PxU0fSwB0MvXi0/t/WTjqj/SxJWXkNx+1G+8kQAJxCEgp9at9PQzzrbPPzWxZbjRi/1x+XAFw6z5zbOaXjELlTiHNJSnEhY2bt4ibtk6Im97HQQa8BtK+BjZv2Sp043WFkP+qaBY/sXxsJvZXfnHtlkgAEOPss4+/sXzs0MHlhblbThyelPMHdsv5gxxkwGsg7Wvg+Mwj8uWFufLy/OEH/9mzB17X/Rf5TT/ts+aeWADWROMTEiCBoSJAARiq08ViSSBdAhSAdHkyGglkRiCLwBSALKgyJgkMCQEKwJCcKJZJAlkQoABkQZUxSWBICMQWgAcOnKzvnZ3fur+xNMFBBrwGsr0GvPiiB9GLcfUmsgDsffrkfY89ffr1TWXnvJLyfKtrnV/hIANeA32/BtB76EH0InoSvRlVCEILwCNPnNi+98jx101bvtZpt3Y6jn27UupmPSaEUhxkwGugz9cAek+Pm9GL6En0JnoUvRpWCEIJAAIWhPNnjqN2WlY3bGzakQAJ9JEAehM9il5Fz4ZJHUoACsr5HcdWG/g5AGGQ0oYE0iUQLZoS6FX0bBi/QAHA9xWmWdjJ5g+DkzYkkAcCSpi6Z9G7QdUECkBRmHN4aREUiOskQAL5IYCeRe8GVeQrAPjvBatr3RoUhOskQAL5I4DeRQ/7VeYrAJuKVkUpp+IXgGskQALZEUgSGb2LHvaL4SsAlXJJamcM/cA7CZDAkBGQ13rYs2xfAYBX4k8cQBAOEiCBvhMI07uBAtD3qpmQBEigbwQoAH1DzUQkEI1AP6wpAP2gzBwkkFMCFICcnhiWRQL9IEAB6Adl5iCBnBKgAOT0xLCsbAhIKYVhmkIK2ZRSvusOfWyYek5KkfQmpRSmWRD6tiKkvBh3rPETYgUxpUxen65rzZ0CsAYHn4wygUqtrrenXpNK3CWM0g5TKXfg2J0T6rWrNtosxr1SrQmh1NcL5eJHbcfYUSsVUxmIhZiI7eaIUZuXCwXAiwznR4aAYRiiUCi+2W6+t3N5fu5XzxybObd8bP9bLy3MXcDA8RnM6TXYwBY+IsJNSvm9K81LH19emLv3hSenz7+6ePg7pxoHLqYxEAsxERs5kCtCab6mFABfPFwcBQKGYb5Z3iTufPn40T8N2g9sYAufINvVdW0rludnt31+8egbq3NZPSIHciFnGjkoAGlQZIzcEsBL+p7V+vTSwYPNsEXCFj7wDfSRsist8YFAuwgGYUzdnDp3GFs/GwqAHx2uDTUB/VJZtFvN1/BVPepG4ANfxPD2VaJcLn/zzImZt71tsllBTuTWbzokSkABSISPznkmIPX3/qY0F+LWCF/E8PIvFEqi2+n8ttd61vPIjRqS5KEAJKFH31wTULbTdETh+3GLhC9iePmXKlVRbpV/z2s963nkRg1J8lAAktCjb74JSNE2nU47bpGur47h5V8slcTp04+3vNbjzEfxQe5iqRTF5SdsKQA/gYQTJDA+BCgA43Oux2+nSlRsoxz7E61cXx3DC5zV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61Hno9ojN2qI6ne9PQXgeho8HikCSunX79X6rj2Hn/nZqBuDT0X7Ioa3rxSdTufuqUOL27xtsllBTuQWItkvCFEABG+jTKC90hSFYvV3D5w8id8ECrVV2MIHvoEOSpVUUXw30C5lAzenzp00LAUgKUH6556A49jbO5fEn+OrelCxsIEtfIJsV9e1rZicW3j74ZlnPrY6l9UjciAXcqaRgwKQBkXGyDUBR78X0OtZ2yv1zecm5+b/YOrI4s7JI6du3zc7fzMGjt05vQYb2MInyqb0twrv31Df9BeTs/Nfe+zZ0zt2zxz/oNff9F9v3m8OsRATsZEDuaLU5mdLAfCjw7WRInD1Jb3cpaR4XTjd87aU7sCxOyfkrqs28bbdbq0IIeU9vY71LdNwzq90rVQGYiEmYrs5RHo3CkB6LBlpCAjor57CsW2hhKrr463u0MfunH7TMOkWdDxh2z2EqQmlJlIZQtQQE7EROM1BAUiTJmORwJARoAAM2QljuaNHYJA7ogAMkj5zk8CACVAABnwCmJ4EBkmAAjBI+sxNAgMmECgAyX7QcMC7Y3oSyDmBLMsL07u+AtDudJUuEEM/8E4CJDBkBNS1HvYs21cALlnFtpRG7E9U8czKBRIggcwJoHfRw36JfAXgplwr6AAAEABJREFUS0sHm8VSMfZnqvkl5hoJkEC2BNC76GG/LL4CAEdL2PPFYrLPHUMcDhIggbUEsnyGnkXvBuUIFICzTx38qm33zgkR5i0FwRsJkMDACUj8OPI59G5QKYECgAA9afy6YcorgiIgeCOBfBOQAr2KnhUhbqEE4JXnDr3ZE8bPGIY8h5cWIeLShARIoM8E0JvoUfQqejZM+lACgEAIePbY4btsU+0qV6rnDMN8S0p5QY+LQkoOMuA1EOEaSKNn0Ht6XEAvoifRm+hR9Cp6NswILQCrwfB9xQtPTd91qWPskErtqJaKO2ocZMBroO/XAHoPPYheRE+iN1f7NOxjZAFYDYz/Xji7MPfuqcaBixxkwGtgMNcAehC9uNqXUR9jC0DURLQnARLIHwEKQP7OCSsacQJ52h4FIE9ng7WQQJ8JUAD6DJzpSCBPBCgAeTobrIUE+kyAAtBn4Ew33gTytvtIAtBoNEp7njzxyb1HTnxhz+x889DCsppbelXNneQgA14Dfb8GdO+hB9GLbk/q3kSPRhGZSALwg27l29K2v6GU/Rs6Se3ypR+LH717UfzohxxkwGug79eA7j30IHoRPYneRI/q56HvoQRgsnHitn1HTyqlnG1KKYEROgMNSYAEMieAnrw6nG3oVfRsmKShBEC1e/+5Z1lh4tGGBEjAg0C/ptGr6Nkw+QIFYM/c8V+u1usfCxOMNiRAAvkggJ5F7wZVEygAxYJ5qrXSDIrDdRIggRwRQM+id4NK8hWA3Y1GTSmnHhSE6yRAAvkjgN5FD/tV5isA2rHWs3o1/cg7CZBAAgKDcL3Wu7796ysAG8UGIQxfk0HsizlJgATCENC96/awjy272wcOl0hg1AlQAEb9DHN/JOBDgALgA4dLJJAGgTzHoADk+eywNhLImAAFIGPADE8CeSZAAcjz2WFtJJAxgSEUACUKhaKobdgkNr9vwh04xpwQ6fwlc8Sq6/hbdHwMHGNOpHIb9vpTgTDAIP3lv2XrhLhJX0dxBnzTv/7Woh8uAZCyW6lU/9i2e591LnZrxw/ulhg4xhzWhLZZu8Vwz6SU2lAqaRj/XdnigUvWxfqCjo+BY8xhTQht49qK6DddG2pEragZtWPgGHNYy3X90XecL49B8D+wW87r6yjOWNC+qV5/65yNoREAwzCF2TM+fPqpx39+eX72i6dPP95a3Q+O3Tm9BhvYrq6FeVRKCbNQeKdgGx9cPnb4b52ZP/ivX200VlZ9cYw5rMEGtvBZXQ/ziJpQ22ldo1vrkNUfZo95thkk/6Rc0rj+vGowvBbyNC+l/N7ZYzPyzImZt4Pqgg1s4RNki3VtJ4ql0jvvXGxuf+nEzP/Tc37fRyjYwBY+8NX2gXdtN9T1B24w5wY54p+UVKzrzy9p7gWgUq0Jy7Z+wW8T663BB77rrV0/p7/4K9F27vr95caV6+f9jl1b7eP6+hnqNdSAWvRhpDt84Bvk5Naga3FrCjK+tu7aah/X99rcqD6AIVhG3R984Bvk5zLULF2mNxhn9dTNpXO6uRMmybUAaOUWndbK1z+/ePSNqPuED3wRw89XGvKb+qv6d/1s1luDD3zXW1udQ27UgFpW58I+wge+iOHngxpQi5/Nemvwge96a6MyB3ZgCJZR9wQf+CKGny8YgqWfTRZryIncSWPnWgDwfVt148b9cTcJX8Tw8sc7+4Yyz+p1v5f9enndu4IvYqy7qieRGzXow1h3+CKGlzNyowa9nkn9Ou5Q38EODONuAr6I4eWfkL9X2LDzgddfmEC5FgD9zvjK5feaf/lmXJgNXW8DX8S4fu7643KlKt7rfv+r189FOYYvYnj5IDdq8FoPmocvYnjZITdq8FoPmocvYgTZDes62IFh3Prhixhe/mAHhl7rWc8jN2pIkifXAqD/S2xlY7UQWwBcXyk9/fUbeeJLS0uxP+4IvojheQJ0brcGTwP/BddXx/CyQm7U4LUeNA9fxAiyG9p1zc5lGHMDrq+O4eUOdmC43no/5pAbNSTJlW8BSLIz+pIACQQSyLcAKFW73Ir/iUSur47hRcHqdsUDBw7UvdaD5uGLGJ52Ordbg6eB/4Lrq2N4WSE3avBaD5qHL2IE2Q3tumbnMoy5AddXx/ByBzsw9FrPeh65UUOSPLkWANMs1DZurvt+pJHf5uGLGF42nXZLbC7dep/XetA8fBHDyw65UYPXetA8fBHDyw65UYPXetA8fBEjyG5Y18EODOPWD1/E8PIHOzD0Ws96HrlRQ5I8uRYAx7FF6/LlU3E3CF/E8PLv9SzhSHuvXsfPAeuHSHcJX8Tw8kJu1OC1HjQPX8TwskNu1KDXM6lfxx3qO9iBYdxNwBcxvPy9+HvZpzwfeP2FyZdrAcCP25artXsennkm8t8lgA98EcMPhHLU3fsOLX7Az2a9NfjAd7211TnkRg2oZXUu7CN84IsYfj6oAbX42ay3Bh/4rrc2KnNgB4ZgGXVP8IEvYvj5giFY+tlksYacyJ00dq4FAJtrt1ZE0Sz+JxxHGfCBb5CPlEKKivH6/ZONDUG2q+uurfZxfVcnPR5RA2rxWPachg98PQ2uLbg16Frcmq7NBT24ttrH9Q0yHvJ1MATLqNuAD3yD/FyGmqXLNMg4pXU3l87p5k4YM/cCgP1pFX7/3iOLaurQ4jY89xuwgS18/OxW17Sd0G+k3HbbRP1Nrap/Rc9LPbzuEjawhQ98vQyvn9d2Q13/9XsZxuMc8U+KL9b155d0KAQAG3D0+wF2wfn29NPPf2NybuE3pqefr2IeA8funF6DDWwxH3ZIKYXd693WM53vTB45/idTcyc/c/0fVMAx5rAGG9hK6acTP5kZNaG2aV3j5BDW/5M7Gq6ZfvHHNTJ1w/WTlFQa159XDUMjAO4GlCq1261P6ndmv2BMlFYOn3xVYeAYc1gT2sa1jfiP/iqhPZRUjvNz0hRf2lScaM7q+Bg4xhzWhNA2Ks5P3iL8kNevtzDUd31t4BoxzUL/rp+lV9Wcvo7ijFntm+r1t87JGy4BcDcgBd59XblySbz3w4vuwDHmhP52XqRwQ6ymjv9jHR8Dx5hLIbQOMez16y0M9b3P/N+9KH6kr6M448faN/3rb+3JG0IBWLsBPiMBEohPgAIQnx09SWANgWF8QgEYxrPGmkkgJQIUgJRAMgwJDCMBCsAwnjXWTAIpEaAApASSYcabwLDu3lcALosrQjjOsO6NdZPAeBPQvev2sA8FXwHQfiuFYsHzE3X0Ou8kQAI5JXCtd33711cA8AcJpDRif2RWTrmwLBIYCwLoXfSw32Z9BQCOVs/eX63F/tAchOAggZEmkMfNoWfRu0G1BQrAy/OH/0Or2Yz8ufxBiblOAiSQHQH0LHo3KEOgACCArBT+fqFYxCEHCZBAzgmgV9GzYcoMJQDLjUPvvPTMQam/p3hb/yMwwgSnDQmQQH8IoCevDuNt9Cp6NkzmUAKwGuiWUvvDyjR/Xkrzi3puZeOmLeKmBH//PM7fTKfPhCCD/DAY6LnQvYceRC+iJ9Gb6FH9PPQ9kgA0Go3uy88e+uOzxw599uWFufqJ2Uk5f2C3nD/IQQa8Bvp+DejeQw+iF92e1L2JHg3d/dowkgBoe95JgARGiAAFYIROJrdCAlEJUACiEqM9CVwjMAoPFIBROIvcAwnEJEABiAmObiQwCgQoAKNwFrkHEohJILYAPHDgZH3v7PzW/Y2lCQ4yGLdrIC/7RQ+iF2P2v4gsAHufPnnfY0+ffn1T2TmvpDzf6lrnVzjIgNdA368B9B56EL2InkRvRhWC0ALwyBMntu89cvx105avddqtnY5j366UulmPCaEUBxnwGujzNYDe0+Nm9CJ6Er2JHkWvhhWCUAKAgAXh/JnjqJ2W1Q0bm3YkQAJ9JIDeRI+iV9GzYVKHEoCCcn7HsdUGIWL+SawwldCGBIaEQL7LVAK9ip4NU2egAOD7CtMs7GTzh8FJGxLIAwElTN2z6N2gagIFoCjMOby0CArEdRIggfwQQM+id4Mq8hUA/PeC1bVuDQrCdRIggfwRQO+ih/0q8xWATUWropRT8QvANRIYJwLDtFf0LnrYr2ZfAaiUS1I7Y+gH3kmABIaMgLzWw55l+woAvPi+PyhwkMDwEQjTu4ECMHzbZsUkQAJhCVAAwpKi3dgTGEUAFIBRPKvcEwmEJEABCAmKZiQwigQoAKN4VrknEghJgAIQEhTNRoMA/niGYZpCCtnUx++6Qx8bpp6T0nOTYReklMI0C0LfVoSUF1MZQqwgppTJ69N1rblTANbg4JNRJlCp1fX21GtSibuEUdphKuUOHLtzQr121UabxbhXqjUhlPp6oVz8qO0YO2qlYioDsRATsd0cMWrzcqEAeJHh/MgQMAxDFArFN9vN93Yuz8/96pljM+eWj+1/66WFuQsYOD6DOb0GG9jCR0S4SSm/d6V56ePLC3P3vvDk9PlXFw9/51TjwMU0BmIhJmIjB3JFKM3XlALgi4eLo0DAMMw3y5vEnS8fP/qnQfuBDWzhE2S7uq5txfL87LbPLx7N/K9oIwdyIedq/iSPFIAk9OibewJ4Sd+zWp9eOniwGbZY2MIHvvDxHVJ2pSU+4GuTwaKbU+dOGpoCkJQg/XNLQL9UFu1W8zV8VY9aJHzgixjevkqUy+Vvnjkx87a3TTYryInc+k2HRAkoAInw0TnPBKT+3t+U5kLcGuGLGF7+hUJJdDud3/Zaz3oeuVFDkjwUgCT06JtrAsp2mo4ofD9ukfBFDC//UqUqyq3y73mtZz2P3KghSR4KQBJ69M03ASnaptNpxy0SvkLH8PIvlkri9OnHW17rWc8jd7FUSpSGApAIH51JYLgJUACG+/yxej8CSlRsoxz7E61cXx3DK4XV7Yrp6eerXutZzyM3akiShwKQhB59c01AmkbdEL3Yn2kJX8Tw2mS33RKdaufXvNaznkdu1JAkDwUgCT365pqAchxhK3s2bpHwRQwv/16vK0rl8kNe61nPIzdqSJKHApCEHn1zTUAp/fq9Wt+15/AzPxu1UPhUtC9iePtK0el07p46tLjN2yabFeREbqHfpRQJbhSABPDomn8C7ZWmKBSrv3vg5En8JlCogmELH/gGOihVUkXx3UC7lA3cnDp30rAUgKQE6Z97Ao5jb+9cEn+Or+pBxcIGtvAJsl1d17Zicm7h7YdnnvnY6lxWj8iBXMiZRg4KQBoUGSPXBBz9XkCvZ22v1Defm5yb/4OpI4s7J4+cun3f7PzNGDh25/QabGALnyib0t8qvH9DfdNfTM7Of+2xZ0/v2D1z/IP7G0sTaQzEQkzERg7kilKbny0FwI8O10aKwNWX9HKXkuJ14XTP21K6A8funJC7rtrE23a7tSKElPf0Ota3TMM5v9K1UhmIhZiI7eYQ6d0oAOmxZKQhIKC/egrHtoUSqq6Pt7pDH7tz+k3DpFvQ8YRt9xCmJpSaSGUIUUNMxKXOUcQAAAHhSURBVEbgNAcFIE2ajEUCQ0aAAjBkJ4zlZk9gnDJQAMbpbHOvJHADAQrADUD4lATGiQAFYJzONvdKAjcQCBSA9D+J/IYK+JQEckRglEoJ07u+AtDudJUGgqEfeCcBEhgyAupaD3uW7SsAl6xiW0oj9ieqeGblAgmQQOYE0LvoYb9EvgLwpaWDzWKpGPsz1fwSc40ESCBbAuhd9LBfFl8BgKMl7PliMdnnjiEOBwnkncAo1YeeRe8G7SlQAM4+dfCrtt07J0SYtxQEbyRAAgMnIPHjyOfQu0GlBAoAAvSk8euGKa8IioDgjQTyTUAK9Cp6VoS4hRKAV5479GZPGD9jGPIcXlqEiEsTEiCBPhNAb6JH0avo2TDpQwkAAiHg2WOH77JNtatcqZ4zDPMtKeUFPdL5G+hp/S11xuH5iHENiCH0Qe/pcQG9iJ5Eb6JH0avo2TAjtACsBsP3FS88NX3XpY6xQyq1o1oq7qhxkAGvgb5fA+g99CB6ET2J3lzt07CPkQVgNTD+e+Hswty7pxoHLnKQAa+BwVwD6EH04mpfRn2MLQBRE9GeBEggfwQoAPk7J6yozwTGOR0FYJzPPvc+9gQoAGN/CRDAOBOgAIzz2efex54ABWDsL4HxBjDuu///AAAA//8pEgg1AAAABklEQVQDANTsRLN50QRTAAAAAElFTkSuQmCC" preserveAspectRatio="none"/><image width="10" height="10" id="Y" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9B4AcxZX2e9U9MzsblEUwYLAQSUg7MxskES18TtggaWe1wmBj+87pHHA8+xz+M7J99tk+n/EZ53CHExjt7qwAA8bhCAYkbZqZlRA52GCCctg0M91V/3uzEkgbZ2Y7zOx0bfd2d3XVe9/7qup1dVV3jwAvlCwDLUvuro7WJk9uru8+e03t5hVvq3vqoivqtkWbwp3/Eg1v/cG6SPIXzeGuO6Lhzs6m0NZHaH2O1n20DkZDnSnaSl4P7w82hTrp3BZO8wjn4bwsI0qyWCbLZh1rSBfrZN0thKFkCfSAg+cASqgSNIe3vKUlnPz3taHN265seOJZ5Z/9tMLhHcow4wLF5ozcd19GptpR4X8qhR80ZeqdUqlLlVKNZOZZtJ5E6xxagwqUn7bI6+H9IICic8hpzuI8nJdlsCyWybJZB+tinVndhIGxMCbGxhhJpreUCAOeAyjOgsL1dQ+tXxeOf7U50vMnukJnrmp4Wgmsvl2C+QUEbelwZvfJpsosAIAaBVBBW5TKAKVMUCDpkGJpjxo17Re6vCKDZbJs1kHSkM6wzhqTMDAWJEySsDFGxsqYGXtLOP7v68IPtYAXipIBzwEUWbE01XYtXV/3sMyYh242VfrzUhr/oEDpQ5mdYMgBkCpDiKn5AV+8abcoFsaistgYI2NVhJmxGyr9BVMd2kg2qdW1XdwLKQrEHggA5sBzAMxCkax8P61p/s0Z8wAh4kZFmxmxILBNfuHvurr2rqoZYdIMMcJzAEVUkKa/eouUqWooqqs7WBSQegipmgGcv9UigZ4YCxjwHIAFJFoh4tLIHQsRfUuo62yFuKKUwbYh6kuaah84rigBliEozwEUSaHPwpNON+VwkaCxD4ZUw6CJWYvt0+BJzoWBI2k8B3CECZe3UvnOQEB0GYYD6hE11DwH4ADTuajwHEAuLDmQxlSpsx1QUxQqMjC8pCiAeCC8B4GKpQ4gqPOLBYvtOJRaabsOT0FODHg9gJxosj+RArnKfi3FoQEBX1scSMoTxdFWew7gaDZc2l912v9WVOjzXNLuvNqAPhsuOOuWGuc1expHM+A5gNGMuHA8f07dFWnzkAua3VHJtp5c9Zp17mj3tB7NgOcAjmbDpX0JqejII74uAXBYrVQGpOWg936Aw7yPp85zAOOx4nCcD6vrFTUKh9W6po5t9YlZta4BKGPFo033HMBoRhw+bjnvoXmmHAgCIJRPQDDMwcrL67v5bcbyMbsILfUcgMuFIvuHjqMZgEqXYTiunm3WFS50XLGn8BgGPAdwDB3OH0g/LAAU/G6988pd1IgoAqh8ngNwsQxYtecAmAUXV82EldnvdriIwRXVSgHKdPk8/OQKyccqHe/IcwDjseJgnAR4oypDD8A2K4Q3Oki1p2ocBjwHMA4pTkYJ0N8AZegA2GYNA5eAF1xlwHMALtK/+qz7a/z6LBcRuKta16pgbfjuOe6iKG/tngNwsfwDwarL09nPf7kIwkXVGeMAaGLuZS5CKBvVExnqOYCJmHEgPgPDb5XScEBTcargJwJNc+jy4kRXHqg8B+BiOVdo8xcpMF1E4K5qtr1Cn/9qd1GUt3bPAbhU/lfXJqtSxv4TAMrpCUAYFRBSxsETmItRJ7xDhxjwHIBDRI9WM6yZlQjKexAGzOOYi9H8eMfWMTCZJM8BTMaOneeEP6iJYNl/I18XwUogLuyk2pM9MQOeA5iYG1vPmGb/ZeX0CvBEZDIHGbO/aaLzXry9DHgOwF5+J5QuIHCpUuU7AHiEGKUkaOi79Mixt3WWAc8BOMv3y9qo+38ZPw77ckSZ7iiQ4MOaN5Wp+babPZUCzwFMxZAN59+05PfzENEGyaUpkp1AS+Q+b0DUheLzHIALpM/2v3ol3fe6oLk4VRpyABDneZ8Kd6F4PAfgAukmDF0ivfv/l5lnLkyVLpvPor9seBHseA7AhULQReAUoHtfF1QXqUoeCPQTJ0UKr0Rh5QLbcwC5sGRhmg2wQaTl0FkACF44wgCCIYfP3ADKq49HKHFo6xHuENFH1DwESxCVOuPIsbcdYUApeeZD0Op5xRE6HPvvOQDHqB5RJCOL3y9ERdXIkff/CAO6qAiatYs+cOTY2zrDgOcAHOD5bY3bTlkX6v63lrptCpT6gSmHHNBaWioM4gSF+P66SFJFw1s/H61NnlxaFhQX2lzReA4gV6YKSLcmsvn1V9Q93JtKDz4uEb5smIMgy+gHQPKljB8LNuUwZdO+qnD4sbfVPbxlTWTLEorwFpsY8ByAxcS+e9XTFU2hzmhT7da/BcScP6bNAxFSEfAe+yUWclwOcxVMmQdWVGoLH4qGOnvXLuu6tKVlo5ajCC9Zjgy46gBWL72/YV24JxYNbX2GGk1sde39NDqeI/IiTBaNJN9zcN/ugwStHRBOyRi8641rER8FLgjDmd1A900RFPJ28/FFe5pqO99coLCiyLb6rN5XUV1vpwvE7mi4+3drw51hN4G55gBaIslfVvjndklQTQrwVETRVOlb+EhTaOuudXV932gOd73FTWLy0R2NdL2HCvMJIvNnCqQPqMrmk99LmxMDNHlizvbplXdGIz2bo6GeknmDMBrpfX1L5KEv0YXuucrq6r9TXY8Cwnyy+q1+URlfF07+lPYtW/IRRHU2n+RWpFViXaRvEw36XJ0x+2lMjN+IU9ltytjPChaY5tBnpJK3t9RtV83hnh9fXXtX1QYovjni1Ut6FkdDXUNKqp8pZZ4+cv/KJnirXQxkzAFQ0lgJKGPN4fij9fU/Jodrl7bC5G6ADWLVqrt1wvftKyIPm0pm/mjI/i8qgJNSxj6gupIVzFu2x1RD722uS3TQhcPx9ui4wuZw4ocAcg2QC4QpgsGFDer9Kf2k/mSoq299Xd/3onXJlVNks/302qXdp7fUbb/FH9AfVyArwLvi2875aAVKSRpQzZx5mrk83RTqvrml/snZo9M4fdwc6W1YX7fj28nQW3oXHlyYAZCfSMuDObQxBFSwdl2493qnMecAzjpITeHOf5Eq/X5TpnIWesRLAqhzM+bQh4VSm9dFEgPRcM/Hm2qTx126+I5AzsKmmfD99d2+pmWd7/P7g08YZv9qU/KI9TSFetmnwQC5X5Wm/MZ6JQ/tj4bjF/CVlyIcWVqWbPe3RHoXRpduvmZdJLlPgNaVMQ99gupqyKCLl8xjxsekNmEq40N0C/xJR8AfVuKYA4hGOi8WoP8nTDNkiZKpSgS4DkTq75XVJ8TJ814fPee+E6cpetLszfXJFXukeEJovp9k6NYFcujBgBccYgCB64VAcf+8fdXb3rKk8wQ7FbdE7lu4LpL4lvSn44Y0nkPd/11TDs8xLLggCPT919pQYnmh+PPN54gDiNZuOVnHyntNlaHboHwhjp9esndVSpcqc45S8iOBqpOep65gX3Oo5x0tdT2Lx8+Vf+zVtcmq5kj3FzWlbZEyc4rMXnHyl+PlsJ8BaoSgwDx7VnDOC9FQ1wesHB+INvQtao50Xdkc7urStZN2SmV8SqrMEgDlp33LjDOpjfg1fevqyP2vskzoJIIccQCIejJDXSK6atMyCZoCT/FtAk8XAZjLFKpfGWamjzw0zSbEP1OgyGy2prP/NH9QmI8qBV/KEH6KtAU/yfUWyxhA4IE2EvejReqCHW8kB077BS/r6uIfp3vzXSoztE0pvFEq2cB1Tdn0OjdVMOS6pquKRMGg88hoswNQGA133UONcl4emKaVdKRgMEhXgwWg4BtXNjylouHu25vCPe9bG46flqvwdXV9H6ioOm03efmTRmTmmtNLVwwM0OgA0H344jm63r++7qH1hzFR+zq8N8FmzdLOU6K1W98bjfTccmXDEwoUXmeq9AJKXulwPVgYDXf9kXoYU2ImbAUvtjqAdaHeJgTttYpGbMHxgHRfmIbhzC6ggnsLKOMnGsgnaS62P1rbtXoyOET8M6Y5/KNhY89kybxzJcBAhsZrDDl4M5VpkuBOeAvKDxg1hbbu03X9GYXwUyWN1cOZPVSHeMDa1jZIsMYuVGcBQXt9c23fZZBjKCSZbQ5gTe3WizStsp2uoIXgsiWPVIagGlCl68FbmkJdal1dcmNT7eaPrjrtfytYYXOkt6E53PusUupUAErJkSW5jmBH1ECgDzRRAT6tGgL6XAj6FkKl/3haT4QK34LsWuk/kY6Pz57jNJyW83BeRO0wAyMyDx+U1EbxBUip2uZw/Ekataf7doBVqzboTeEtH14X2X7j2tBW6dOr7gTAOVRfBRRJICyg675bm5ZtPc8uSLYY23Leg0FNaL9Km/worF3QC5ebyd7PSzDN4RZA7b9PmH/RUFPtlseQpnGkSp9cao0fAeFwSNN4y6Bfm30Q0fe8kuoWTav8t7QceI9hHDovPfjiq27sXoS/6TqN1lfjTd2nZ9ffdL2ajk9DPpcePPiqTGb/+dR9fi/nVVLeKlB/YUSmxq8x8rwbIP0d1lkSG0UOXarUIgD9IbrSbzux/+oMKPE9Uw5ciQCYoZ5CMZZ72jwEQtN//e5VT2cvUmBxEBbLy4qTQ/47EARdRaEEgqJBoz2AKM4ws9M4VB2KGrWiq7o/e+UWqA0g+lqFVvVPoPBSXVRFNBw47ebec2bHEnUndfQ1rt3Yc/a/35o8/39ifSu3xB6++IWpTIs93PBCx7YLNm/qO//nnLejb/ma9kT9q1imhuJU1gGaTrqC70HU2hDFYMA3P4upGBvQsfYiGPzaMYilfGsIUCq9Glx0cP+eW4+1xZojYY2YV6Q013Z+VCm1SqrMK5ElsKeKuDIg6sQgKto+Tw1wGx18fP/+XbPbEw3VsUTd+rbec/+XGurvW+NLd7TGL95F521ZWuN1u1hHR2/97zfGl/1PLNHQEks0Vg0bz84FJT+pa9XbGCMrRzxy68BHxbWq7PcYi93Rv8LZSFtSb6Dp6A++EnvsXqFHljsAJcR/jxBcKCQv3wgDSPftNUANah/9+6ip8JyhQOac1viy2vZE5L/vfGLlwZF07v/flLhkf3uy/rrW3qW1wcCsc4Q0zxGof5SwH/BpNQSwdBobgS3KRdE4Bi3ftxqcpQ4gGu5+hkcvrQZZLvIQBPDgG6L2uEDfDSozWBtL1M+Lxeuuv7Wv8dE7txZPo4cJwm+2nnGwfdv5j7TFw9cT9jkmDIU09P0CUTyhiSAg2QheKIgBurBic7j78YIyT5DJMgfQHEn8EzX+Ernvh6ILPm0WN46/mDi4ZKh/5zK6yv9j67YG7u4XHdZ8ALX31ve1JSLvHurftTQDg+ciiAdHegXghbwZUCCVXLyutvedeWedIIMlDqBl0R9ngzJ/PoEOL3oCBjRRQY0ehoXwfU8ZBxdRN/rijt7zHr7zibfw5PMEuUozmm26Jb5yB9l4gZEZOF2IwPcQcFgTjr3LVZrEjUFNTkDIG95Ye1fVkVPT2VriAMxZ8x6S/Gz+dJCUWV6Bvoyp9ReBJgAAEABJREFUBv9fLLki2B6vu6a1b8XT5UJBbFvjU+3x8DWx5PKghPQXETWjXGy3wk6lTKzGeQ9bIWvaDqA53PUWAuTIiwtWGOymDEGj+UL4CYL4pAkHjutInPdVOijrJRZf/hUJhxbS6MenuDfAHJU1ITkar0Cd3BSOvyHH5BMmm7YDEFhxO82n4oQavBOAkKV5UAHe2B6PYEey8ToeOQcvZBlgLtqTDd9ui4epHombKHIQiTXaesuEDCjUEP8w4ekcT2RrZo5pxyRbX/fQzabkh8PGnPIiDjPg12dTVRa3+XWNRvTr3n442ttMwEB7InKVrukhQLzDTwOjEyTzookBKTOwLrKNHSYdFbYU7ACikd5TM+bAGuqKFKZ5hufSBHf18fmMeeAyGvhafXNPw5Mz3GTLzGvtrX8ilmh8q2Ec4pe2Xhjh0jLxM0aQAglSDq7lNxgLNapgBwDS/D8E8IZwxzDPj+r6QCr5TUMXZ8QSK24fk8SLyImB9r7ltxm6tlgp+S2B/O1PlVO+8kokKjRd3FWozQU5gGg4fpUQvkWqiB+fLZSQ6eRDQBAYeE7JdEssUf+vt/U0DIIXpsUAc9ieqP+0qYwriNu/M8fTEjjDMivqBWjoPyca6ryiENPydgAbQAmljM+aMlWIvhmbB1EHhZBsT0ROifWtbJuxhrpk2Kbk8o3E7ckIYhuiBl4AOMIBv+CkED/LnyM/EpfrNm8H0Le0c42uBZflqqAc0vn12eATgQ90JJa7+isv5cA1zRbU6hj4oF+fUw7m5myjjsFwMnTpW3LOcDhh3g4gEJgXM8z+w9nLfcMdUhxIZ/Ycf3Pv0p+UOxtO2b8xvuxHUjx/IgDSLRaCFwAM2Q8Bfe5t+XKRlwNYX7f9w8PGXtLhkY4oQEP/g6Dk2R19F+wkUrzFQQZauy55UZpDZwvh34KYVzV2EKWTqhBSxj5YH3non/PRmhdzGXPwi/kIn6lp+X5fQ/8DbYnwBbG+lX+fqXYWu123bH/tc+3x8Hk6VjwgUC92uJbim0iYIQeunejcePE5O4CmUOdnNRE4bjwh5RZH01Lfbo2HLjxstzq89TbOM5DlfmN8GZfFdc6rLz6NQgROaApv/XSuyHJyAKtOu7vCJ4JfNsv8qT9BVxmB/p90JBs/lSvBXjpnGGhP1H9SaP6fchk5o7E4tXAb1TH41Utz/Mm8nBzACXOO/4eMHPIBlO+9P7LtSn2ZpqI+AF4oSgbaeyPvV8r8SrasihKhE6CQBgSHfbNqTn1dLtpycgApGKQR7mxvKxeZMy6NQA0A8Us0BXUteKGoGYgll38RQXxZUG8NZmiY2iwFdMH+8dTpAKZ0AM3hrrfQvGvZvu6LzCKKH8USjRt4tzRXhRtAiZaWjVpLi9JWrbpbH2/lc5yG0wI/1lSaxkLWUaP2oxKFbwlsTQROaarrfPNUwiZ1ANmKgNp/GZKmW6eSNAPPI19FhPhGe7zug6VkXkt996ubI71XRkPd311fv+PGaKjnvr5wz3bjsVOfNx7rHFqwf07muIPHZ44/dGJ25f35FMfnOE1fuHs75xnJ2/1dlsUyS4kDmh34IKD4z3LtCXCbFVL/9lRPB07qAB6q7TtVSuM1pVTwVmFF6vYj4l9i8cbPWiXTDjl81W6qfeC4aF1yZXM4/psr6h5WqCr/CkrdqEBekzEOXqnAvJDujc8h/TyL4zNVGjLmIUgbB7Ir70uKo/M0zgPHKSXP4TyZbF55DctimSybdbAu1sm6KU/RLh2Jxs+QE/8Ll2XRgrQRmFLp1yTCa149mYpJHYBE9W5EUYZv/CEICPyhPV53MRRpaIEWrSm09YfwxI4eQP1poWCzUsZVafNgtnFLxV/ZUoQeaS104bzkRkgWOwmWzTpYF+tk3YyBsRSqwe58bfHQxQJ9fwZgW6DkQ14GoF4hpHzXZHkmdQB+X/UXlTInyz8jzyHgAUwPTUqcG4bzhyCjkd6LqdHdF2j8toGo/bMhD4UIS6Uph4GaKu3au7AO1kVaKlk3Y2AsjImxMUY6V1SLFAeupopeNL+j4BQ53Hb9/lkbJtNHvIx/OhrqviZtlB1n4NOqYWjAfHXrjuUvjs+MO7HRcPfXZmknPgfKvBcALxpIP089c3bOCO4FzGJgLECYGBtjZKxQRCHWc/ELgwPyFC7bIoLlCJSMcQioPD40kbIJHIBCTatoOXxfOFHeGRevCT8oCW8vll/d4Yc5WiI7PhgN9wwgiM+ZcnCOIoBA13oouqCAsTFGJKzNhJmxsw1QBIHLVAK8g8u4COA4BoHbsIYVb6M6M+6VYlwHsPqsB6oNc+BCgHHzwEwMiAJMmfpDa+LcG4vBvrWhLVfPmvWaYepm/0Apo1Jmf2uxFMoDgbFKwszY2Qa2pRg4bes99zeGOfwnLutiwJMvhsLSIxhy4AJu0+PlH9cB+IJVUU0ESqG2jWdTAXEKaLT4yY7kyjdRZlftXhvqWt4c6bnXJyp/mTYPEJzSXtgGtoVtYttctgY39Z33Bi5rKMpelD3saKJC+Cqq14wnfVwHQNMHN9DVcLz0MzJOwwBVB/VPh41Th7eOb2i+/UsBvWYrTb1ebGTfu3DVF1lkP9IVaAjYpoBevZVttEhwIWKyZWsq471c5oUIKMU8Jg0QSxj+5XjYxziAaLizUdC98HiJZ2KcJqjxS/PjsXjdfW7Zd9mSv7y6Odz7GN1EfzFtlP5VfyIes4PKSn2Rbb1sSfek89MTybAiflOi8R4J8hNc9lbIKwUZmgji2rqe+tFYxzgAVOIyU6ZHp5uxx1JmHqs5eOjHbhnYXNt5ebBi7l9NlVksab7dLRxO6WUbTbI1WFHxV7bdKb2j9cyac/BHUqYt/aXd0TqsPJ6uLO4FUDfsstFyxjgAJfSq0Ylm6nHQdwKgabbc8Mwlw27Y2FTbdaNCuJUGXIE6+7S4gcJ5nWQoss1sO3PgPAKAG+65ZFgZqZag73g31LuiUyhVM1rxGAeAkOlB1Eanm3HHCAIGjed/2L59ZR84HC6v765sjiRv0DTflQqyt6UOIygOdWw7c9Ac6buBOXEaVcdDFyWHMi/8CKkuwAwP3KYRtE4YFcY4gPZ4400a8q/ajEo5ww4V4sGgUf0lN8wKmKJLytS7TO/T6sAcSDn8Lr8put0oiwqzegP1SGb8E28CfNCerN8Io8IYB8DnDd/QApoq2c/7M3HVRSVdd43v37R92UtO2scv0ERDXc9IUEuAEDipu7h1cV9AncPcrF66xdE+OdcBA9QPuE4UK0fTxcVtGdMD88eTM64D6OhcsSeWqJ8rUB8YL1Opx9EU20ubEis/77QdCP4uBfJUVQaDfflyy5wwN7oY203NV1a+6W9JLv+cKYdm5JedNWrD3JZbd5zPn/MeQ40YE3NURHuiroa6R3fNrGeoldK14MeOMtP23ZYld1c3h3seASFcm/qy3UirFBBHzBVzZpXIXOQIUUl1Qs2YAZnDbfYPbYnbZk1m/6QOAABVLLnizVKZ30CcIimUQlDg02YPtvYuu9lJtMo//0fE4Vl8lXNSbynqYo6YK/DPc3Rqti2+9LdcN2bCrRm3VSnNb3YkV7wJYIOcrB7k1Krb4rWfBU2/zK/PnkxW0Z/z63Nh2NxzuZNAmyM9vwWUbwfvnj8P2hUoVFc1R3p/m0emaSfNGHtX+/Xi+smxfI3iNiqEuLwtUfuvueTNyQGwoFhP5PZ0ZuAfqCIPISBHldyaMQ89fmvywrudAt4c7l6rlLyCR7qd0jlT9DBnSplXRENbm5yyqaPvgv/LmP0l+XAQjrTJoVTm4Ovbeut/lytnOTsAFtjRV/9/ekYsEsK/i3w0R5XUqlD+2inAVyztOQfR30EOwCmVk+hRVD0ECPSBT6uCCt8CqAqcBNWBV2dX3q/wzQc+x2kQuFoocDswd0IEYy2RLTRr4gwaRHCsjlhlEbdFbpN6Bhdt6lv+53zkcknnkx74Qxnpwf7TqbLcL1DPK6+biXlQxBxMX+cUBlPXfkezDa61Ik0EQBdBoCvDdp+ovgmU/JIG+luH4eAZN3Wfrv2682T8VeeJ2ZX3b+r+tWbK/jMF+C7jtJTntwi4nWVoJAtcCoYcUkpV3OaU+szg8HVcV5zSN109AnV23PenqU1y28xXXt4OgBXc+uiFh6B36Srad6w7TboKXhA1kDD8gyzugqXknjFa2/19CcYiBKAFHA2IAjQMSGlm3tsar8XaZGNoY3zpVbG+FRs2JmrvuLX3/CcI0DgDQxtke2Ll462JZbdn08aXXsl5W0mGNI33kROQSLIpr6MLEYjMZXNt5w+cUMx1xFRDP0SqM07om0xHLufoCnM3t0XGnUv60WkKcgAspBXQbE/Uvw4Av65hACgQFvpfhAtS3z9o6J9xAlo0tOUSn171Ibp/dUJdVgcCcqMHn6i8Hkz12rZEWIv1Nf4cKGygEUjaFLQcyRvra/hZWzysKVOtoi759zTqEbDOgoQWkIm51PWaD64mbgvInneWStP3aVD0l3dOxzIoLdvm8Os0x/86bouFai7YARxR2MEPUUDq3bpWiUfiim2rEHqfnbc35QQuRN8306ZzT5YiCAWo38uNfmN82Udj25bb9lpzx7bl97bHa69pi2/ShPDdm9UNzgTmlDq7/+mEtmxdQexxQlchOritmZh6F7e9QvIfnWfaDoCFdSRW/EJCOjRy76Q4qmhWpG4rIt52zz2X8HeybcW1tvbBjwv0Ndiq5LBwQfd+tMapr98YS9Tx7Zg8fMqBzQbZFo+sYt0CfQlBWBxQCprw1TeFNn/Cbl1cV7jOIFrSPCyEy8+xVNPtbDrUEV8x7gc+8lVmmYXtvfV9G3vPRQTtJYDi6Qz4tTmQFn//Ftgc3rrsd3NpDvk6w4lfUULq6IO6sT1RX7dp28pem02bUDzrbk/URSSom6jIzQkTWnSCufVps7/91mV/mWuRyAnFpEXXt7juTJjA5hNjxSNRrL3IbYzb2tjzhcVY5gCOqB8amHMqeYFugb4jUS5uEVLGvgdu67nc9t82q9RO+VDGPES2Iq22LSqgzwdAuCiWaHg7jAQ3u1xZ3R2JhqsAfRcF9HmMKBvHO9avmP3Rk6Be82HrZR8r8baeDwxy3QEiG1wOAv2MopPa1mlWQ7HcAdz5xOJ0LLG8UcOKn+mi0mq8eckTqNFIjvhyXpkKS0wj1ea/F5Y191yIuHvvcw9WU/dvc+65nEnZEa/bvDfzVDWC2A02B5oX/AqpsNXTkvxs3eE6xPturdyGNBH4aSy5fAW3LatxWO4AADB7BdgYX/I+Q6XWu0mgVMYhH+gPgc2hOdTzC6DqYqcaIXQzlrjjhD+89M4BO/VMR/Yf+t40EEvefoJA3ebxCAnRUPevpoM1l7xcd6TKcLcul+SWp+G2Y0KmZWPvkvePCB9pWyP71vy3wQG8Aqwj0UAzFOIqisk6Bdo6uCjwa1W74MzHbP2Fn5YlD85DIbAlHi8AABAASURBVNZQRbHLNuZuZ3u8nu6pNtjcsKwwYYNsT9TrdHnm12sZuxVCj5HBXAuhXc7cH3PC6gOqOzrXIZud+2jYfIyA0kRxVSxe18bHdq22OgAG3R6vu0lIc4kugsN87NSKNDKdkgNbWlvX2zs4FVi4TCpzFgCCHYHuq3H2gR2nkmxbGhPJtWNRswgzY7dDOBDXzLnmn1sLNgauOxk5uIXrko1qxojmtmIoXLKJ2s6YkxZH2O4AGG/7tvMfMUx1qiZ8js2tEokgRMX1rN/O1ZB7b+AHVezRgcawOthwwzP/6KjztMIWxszYAdAAG4JSJqTVwRtsEH2MSK5DXJeOibTxQBO+bgDj1bf2NT5qo5qXRTviAFhbR19oZ1u8rkGATobZc7WEowIXWqw3tOWoKMt31y594HS6ylk+MstABfVgNNRv2NRb75jTZL1WroydbWBbrJR7RJZfn3fq6iUPLj5ybMeW65AmgnaIHiUTgXoaD1MbaWyN1+0addK2Q8ccwBEL2pP1Z9OA2Y98mr1fHx8ydm8+otOurdArvkVTRTaIR6DacF9bou59UOKBbUAU/IvGllvC3Pv8AdufDkwZex60HPxRAg+3he/HEvVLjop2ZNdxB8BWdSRXfNCQmU8g6DY9nosgAG8HG8O7T3u6QoA4h5yZ5VoEaFKapu1z3ZYDn0CgaRofYZsmOD2NaEXDc7jk3auerpiGkByy6r8DIKcM1ge66qeIn2s6kss/Yr30qSWKqZPYkyKWiHzHr8+i+x17xrZouHy7PchHpB6cv2euqdJnjRxZ9x9RAwlyU0dfo634rUM8tSS2hW1i26ZOnV8KpTJnHjy0x9YnAxUYO/JDlWtqBQGtpqs9Gf5erjmsTueaA7h08R2BtHlwHoD1nhVBZXTQ/wo2BjT0iwT6LdeAIGRHsrEZZlhgmxCF5TMy2TIw8GI76aJ+xl+5TlmvAyFtHFqw6rS7be7BTIzcNQdQPfs4Mtq05wNsqBmQztg6/y8h8ym6+kzMbIFnfKLqKwVmLfpsPgxa/rRktgxQfspO44OGfAG4TtmgRKE5e+H8mgCLdmN1zQEMDB0KKgXzrTdagV+ryRTydZR8sAR9C5bTlSGfLFOm1YQfUsZBWx/8mBKEjQlSRn8b22ilCi6DCn1ho5UyR8u6afvKl7hO2THeo5San0oZdDEcrdWZY9ccwKyqBT5NBKzvQwPCsLFvyE761iztPD9tHLRYBYJppvbx/bLFgotGHNtmmMP7gMoILAxp4wBEw5svsFDkGFE04zAIYH1z0agNVAarbGgHY0wYN8J6i8ZVMzbSlMqW7r9AHYTQ7xqr0boYTYPzJKStE0iSfDQtipp/Le3O6EXp/jVsq5VGclko0M6zUuZoWUL47xKojY624BhhyKa2kAs49xyAGl7CT3PlAjKfNAgCBFbEwcbg12uWWY09YxySsfit99sIuyhER3pveyBjHjKtBMNlEdBqllopc7QsoXxxROubC2MXZvrs0fqcOrbeolyRm3CGogmvXJPnmk6gD8x0v41vACo05PBxAAhWBkT9QYBrlZUyi1HWBrhWIegWP6SFMFImJNomozNyaLugumW1eG4DqKTl08m54nTPAaB2IoD19V3QQBpdXvpyJSDfdBsA0JTGyWBx0PVqmve3/nVPi2FaIA6VrleSrRaIOkqEKTOncNkcFWXpLkJmm0C/pTJHhClA9J0wsu/8f9ccgEBRbUP7p+6/H26lUVu7qHyopRURYYGV8hE1MM0B1z7tZaUtucgyzFQP25xL2lzTUH9sAZdNrunzTdfRd8FOzQ4HoAAQcDa4FFxzAAqkLU9vSZWxmcoWUEoutFKJoK6lEL6ycQBSyDjbbCWHVJ+oTFqsFDlGlqmsHfg9ogCUaekF5WW5Oey45wCknGfHLUDa5k9y79p1D+qiUs+B25yT+EQl7Nq7x8Zxi5yhOJIwdfCl7Wyzlcp0UaVx2Vgpc7Qs66d+WQO5LjBtmRFj6VOt7jkAUFXU+5kKX97naVTVpheMXoGiCWsf3NK1KrjnmUtK7p3/VxjJb+/OJ96SYpvzyzV5aqvLZHxtpuVlNNIG7Li3GN+C0bGuOQAAZceICtmnLC8kEvrycuahGlQWD16kjX0vyy+XnZSx11JTuUwW7lxoa32mxmpT3VLWXlHyYNZWwqbA4ZvifGGnqQtQWMbcclFTrSTnlVviHFOlzaL9zmeOFuSfLGO1zUpBxr+LyiZ/LLnnsP7rRqxboSq/R4EBUANbAl2gbZHrCS1+Bly7lZ4mNTjN/IVnd7EHIO3RjWDpAN1oamnqYhDA2gKz+tFYKIHgE1XWokQEX/pxKhtrxY6SZkvdQintnroaZcYrh/Y0wlfkT7KHNhmNtnanHqs5pNBiBxDQya1MwtRMPOX30SSQhYZxmew6bqG0UOQYUQj2dNUVCpvawhgTxkS45gAQwBZvjajZPqBiSmsnGgy6H1512v/a6rjGlLyLEfwxGJNsthKCbXP0x4DULC0jFk3tAGh1bRDINQcAqO8lw5kDS1e/VmOpvNHCFi5cpQw5aIyOn85xRg7CnHn1505HRinlDc4+6Vy22UrMhtlvctlYKXO0LL8+a3SUBccIArQ94FJwzQGQ0buAfR9YG4TtU6qtgCgIu3W4+elFIc2IdRKLXBLZKpWlPhQQuExawc6g2VW3hF5+DkCh3AM2dAGkSsPqpX863q6KcG5ri6Kwx0r5PHOpa8F6K2UWsyxdVDQoix0AzdHv5rKxy+6WxfctNO14zJzagFLSvd8ftIuwqeQqaTwPNngAdgBCzLLt3fANAEoTvmfB4mAaA3QLQOOLFsstPnEKTWOQbLUWmSb057hsrJX6ijSjMrBMKuvGfo5IRhAg0bS8PkGOwbVbAKnwYSTjweIgyUvrIrDMYrFHiUOli4qd5AeOipv+rgTjvA3wJboeTF9WMUtgG9lWazEq0EXVSwBIHQGwJei+CnIAdgzWI9A04DO2gM5BqGsOIKBX7EAbngWi7hQoNMM52F5wkpR5aLvV2H1atZ4MXXZ+waBKJGN86ZqVPq3G0vl0LouUedDWl6mkaYS5bllNM2PXqC1YLTdXea45gOH0UL9SZq44c04nSaaU6TflnKGAhAjmZgHWvsow8mis2VEAnJLKIrTMphFbrYOdLQtlWvyVoWPxmSrzRkl169hYC46UhHQK91sgqSARrjkAITIp6q7b8PVeCQF9rq3PhMcS5z3gt3xKSIEm/AuaQ52W3x8XVDNsyLQmsmWJJnwLAaztqXNZdCRX2vo9xQp9bjWAtISVo4WYKp1WMGDThwaO1jT+vmsOoDJ43DAg7hsf1nRiEdLmId/qpVtsmwlgdMPGrm4E5F3LVlOmQdNmr7NMYJEJCuDcFrbRSlhIZTCU2dVjpczRsrgucZ0C0gUWBwTYGwjowxaLzVmcaw5g7x5ICdAPgB1BmbrQxYl2iD4iU6H+X4jWv9BoqoF/O6Jjpm3tsI3LQBOBb9nJlebznwBUp+zQgaDv37XnkPXTCzmCdc0B3PnEGSmfqKb5dGu7g2y3AvQh4Km8b9eKQt5LtzCWi1dKak21XfY+0WI56qkFRkNdG9m2qVPml4LLQIrMvfnlyi81gnkq16n8cuWSWoFPq9l9j4sfg3HNAbREkqsz6lAD2NCtAgrkWZfQxrZF86f3I+qPWa2AB0YFYrQ5lJgxYwE8rkEOuZlts5ovLgMuC6vlHi0PQbOsLsExAYHbwLqGvjXHRDt44IoDWBveeq0uKm+RMmP5yxUj3CnaGJfRP9uW1s3nDyGoHWCDA5MgBU0Ofw9mSkDf9VmbLLeH3ArgDi4Ly0UfJZAcF9UlrlNHRVq0y23Ap4KbouGtGywSmZcYkVdqCxJHw91bUOGG4ewnodACieOLCOjzzh//jJWx/Z8J6HZ8hIIrm1rVHOr5sZVo3ZAVzdogLwGLR/7ZFuZeqv5/5X07V6pLNv7uIAK3BaXw2uZwzxY77RhPtmMO4LyTNwabIz33gZIr7KgMo40zZQqa65Oka/QZ647bE699PGXst+UxTqkMajLyH5tDXSX7klBLOB4GMP+RbbGO9VckpYx9z3UkL7L8NuwVDQBrG7qWc106Os6efQXU01jBbaTl5AeD9ugYK9URB9DS2HnCKcct3UndnYvIzLEobIgx5CBIc/gaG0QfIzKAc9+JqB0TZ9WBAunz6bN7W5ZstPapI6sATiKnvr7bp2lVcQXK+qkS0sucEzfvpF1bF5GRH+G6ZIWSqWQQVyClcREeN2tXtL7b1lmsI1hsdwDRSNdqMw2PZcxD1QD2dflhVFB0BdVF1XktLRvtaZ2H9aWG924TqB20q1dDVzll+l7z18PqSmZzqiH/xtjtAayAOc9oB2z7CTjG3QIbNU2rvIDrEjgYMuZAFRjwWFN4i+2Dg7Y6gKbara+jfs0t5Nns/UrHuIWDYJj9C7Unam19IKjjkRV7lDJvF2jLhY4tQwXyhHXheJoPSmFtDvdkFCj+vTtbPD4S10oad3Z0rqBpZPsY0SKLj6er/wIAW8yAyYICsxpB27Qu0vsPYGOwwwFk2Vof7vuGrgX/rBQPaNlowSSiBfpqUuqQ7dNp7Yn6tyPaQeUrxpkq7WsKbX1p1Wl32zRz8oquQvcYW1Oo8yWpDL1QGbnkE6BBe/L2q3JJO500BsA5Anx2fAYIcglKSUDQ/9RS99A3D6fPtq3D+5ZsLK+1LUu2+6Lh3l8ohM8Y0oZH/fMwW/LLG0r9Wx5ZCkyK5ObUtQVmzifbwhPmnzy0NpRYnk8mJ9KuDXUtZ2wAaqHd+hTKawE2SLv1UP35oqRbSSv0FCoj24aU+elouOfX3LYKlTNRPssdgOEf3AEg35kFPpFWx+IV0BTORU58cLM/Nfw9n8YXC1t7PJii6VOE9ANNoa5fHabR8qvCYbm5bLK6o6GuXyKoBxgbZcrG0daGJfvkHOwf2vt9G4QfI/LSxd8NBLS5FwPNxRxzwoWDkbak3m74Bh+2Wr1lDuDy2q2vIS8lia/T6Z7YapwFy0ub+2DB3NCnCxaQY8a7dpy/N20e+Bdd2Poi4mE0Shco3tEc7umiaUKaajsc7fCGdTeHezsRxdXUUGzt9rNpzG1KHvz0nx95va33/qyrqubCz6So7vB+MawjbUotioa7VXRZ1yKrMFniAKL1m+sqtKqnlDLI+9t6BczbbkX3UUqpy1etutv2CropufK/pEzF8wZZQAapDKC1QQH2NEd6/1SAiGlliUbifwQQ3VJlGgnHtGTlmlnKdPyWxEpbX/xhLFxXFNUZRXWHj4tpVcoEzRd8cu2SBy25DZy2A2gKdX1Ck9U9Gdmviomoo7EQsPqaQzWOzKWbSn3an70VOBqBffsKTFTS+Id1kYRaX9d3XVNoy4V2aYuGuy5YX7f9OpqRUCAzr5dgTLv+5IqVOTVk5jO5pp9OOq4rSqn66cg4Oq/V+zRNqHyBmq3RUPc9wVK7AAAQAElEQVSnpit7WgXYFOq6CRG+bchBQKC96aKxLb8Sfim+YZv4owRv6lv+57Qx8FNE7ahYe3cV3XeZMgUZc+jjpPcv1CMwoqFe6pbTUBlsKLiMNxzOy7KaIz0GAN5Ple/jpkqTRnKr4EwgmyBlHPz5LdvOc6SnE5Di64BQMG9gc0AA5DYHqL5FtwQbAQgtFBYKNrI53PtHug99myrCbtJoKrjbJDDwERpFrR59zo7jjr6G9wvQn6YmQgs4Grg8pMxoQmi/XBdJqr7at8ZbItt/Ew11/htdvd90ee29r5kIEI/jrK9LvInTch7OyzJYlpSGxjxOlNeueCJQCeJyU9+K94IDYdWSu6sR/de4YWu+5nFZI2BLc6iXbsfyzT2SPm8H0LLkwXnr67Y9ZKrMP0hFF4UROUX/3zAHwAwMf9wpoJrE1boIolP6Rusx5TDwSlNmtYbspzlz/LIp078P6gufurLhKfWO5X+n9Xlaeft3xXFBveYpU8rfA+CXOQ/nZRm8gkvBRxwqYa51Sv18f/XHDHPQKXXT1sNt0ITM61rqtj/csuShvH9wMS8HsHbZlnrT73/EkKklVLNpmTZ+BwXQtUTKbLfYCaU394W2U8NpRsyLYpug0SQdSBo0zNBtwiEYzuyCgdRztD5LK2+fy8ZlzEPZNIrSArhfvEjcGXK4ub233tZHfuGoIBVQHaG6clTcdHadyEslhVTXzjb9g49Fw52N+ejMuXauqd28QteD3dQ1WkhrPjqKJq1fn33murqtFzkFqCO5PCbAt1ETAfBCfgyMcKa3Mof55Sw8dRMNoAb0WWcVLsG9nNwmlZLzNVHR2RTZel6uSHJyAM3h+PsEalvIy+QqtyjTpYx9oMGsO5wE15YIX0EjZjRQQ37aScUlrQtBoNgYS0TWg4PBr82+k+uIgyotV2WYQwASH2yu7f1gLsIncQAqW2Ob6+Lf8Ws1PwGqxbkILO40CCnzQNX6um2OVqz0UP97BWpPIDo3M1Dc5TAxOuaIuRoeOOjIoN8RJM2hxHquGwDZag+lHRT4fDU/WBfuOfzE5EhbHs+mSRwAqqZQ55PSzHxs2LD9wavxsNkSh4A0hTL8HVuETyD01kcvPNSeqD8DlPn3CZJ40YcZUMp4nrlizg5HObJRkLmO64aVytyUlTL2gqnMDzXVdv4NACcc1BjXAVy6+PFANNT1NwRYNDOu/HBM0LDixGhoy1eOiXTgYDgz2ICAzyHqDmgrLRXMCXNTYUKd08jXhrZ8WRPBVzmt1359ii53cEo03P3c5fXd4z6jPq4DCFYd2E0jwaeoGdHtH0vzyEMUvmuaapPHjT1rX8wdOy55MZZcfgoAPkYreOEIA9T0iRPm5qbtK186EuvEluuAQP2jhhxwQp3jOrgNK2We5Ddg3J8fG+MAmkJbL0MUjjwwA24GJWcDDn3RDQha+kA99UJ+o6E3O8AcMBeCOHGjLLJ1gOuCK8odVIroa67tah6tcYwDoC7/BVJlRqebcccKJAT9J364qfaBpU4b17rjkv62RO07TDR/i4hOqy8afYgIkjhgLpgTp4E1L7n/XK4DyoaertO2TKVPKgMU4pjpwTEOABWmphI2U84PpV8EgYE2HvNww6aOeP2VgLhG1ypBked1A4MbOtnWEZtxbYw5cAFEtsx9gXauAy6od0clqjFte4wDAL3i95pw5MU5d0gYpRWFfhaNebx/VLRjh7F4462ZdGqxhr4nRRkMDiLZqJOtGUwt7kg03uIY0aMUVVYdfB8KX0k+9DPKlJwOBfpAU747Ryce4wBivaEtoMqnW2rKFAjUv7u+IW7jjz+Mpv3Y403bG55sT9SdoVB9w6/zV4WOPT9TjrK2IX6jjWzd1NPwpFt2rQ93XYCoXc9l7xYGp/UK1KE1Gb5/tN4xDoATSJn+sIbl0wsw1TBIE26AkeCa94vFGz6bTh88H9F/v579shB1lkcwlfB/BWwLovZAWg6dH4vXfdZFY7JlK1G/gcvcLhzFJlejtmyYwx8bD9e4DsBIpX/FgwbjZZiZcTQYpczFTbWb7yT7XG11HdtWbI4lIhfRtNQ/+bTZBKe0F582B9iWWKLhwo543WaXrVFra7fcIamsAbK+AMohSDBhOCiPXOCOMXlcB1D36AUDugg+UEbjUqD4U0ta8M3rI9uvPIYhlw46kiv/t3Lvi0FNVH5UCH1Y0D1caZSHAsYqQB9m7JV7XwiyLVAEYV1k+9t0reJSLusigOMQBAUaBjav2LqifzyF4zqADYAyIwd/J7KVbrxsMzPOpPEAQLhx9Vn3u/BDJmM5veGZS4bb4suub4/XBwGMb1GD2o/IRVaMVy8ERA0YIwj5rfZkfZCxsw1jLXM+hstUINyULWPn1bumUVAbNtTg7RuoTY8HQowXyXEdyeVfD+h5f1+As5b0mjEHQK8IPLt66RZbf1EoX5LaE8s/jak9p+gYeC11V7ZU+l8FmHUGbt6xKEDCwFiod7JFR/9rGWN7b8On87XPzvRcllSmf+OytVMPyy62NeCbDx2JFV+dCNeEDoAzDGX2fBtR492yWhWo2QFf5bj3TG4S0brjkv6N8dr7OvpWnPf3XX8KSiV/rmtVfeQQqLtdAQiTFidYEZB0aKKC2rsaZt10P/0/f9/1BHXzV5zH2BgjFFkI+II3UJnOKTJYtsNB1GAovfO7kymatMboGv4QlJz5jwWOYUiBqdJvbg7H7x1zqkgi7nnmH4c3JVe8d9es3fUAwVOpnC4Q6NsY0OaAT6sGnm8fgapGNgX9H8krUM/KZNmCdLAu1sm6NyVXvueeZy4ZLki8A5maw733mirzZvJYDmgrLhVKmQbZffiV4PGxTeoAds06+AyCeBbKMBB5QG7g4mi4+2vFbP4991xidPSFdrYlIg+2JcJX/Lb3LDQyg6ej0q4mJ/ADXZt1s0DxIIJ4BBTsAQRTEwHwa7OAb/F45X2O43OchtNyHs6LqP9AKXxnOr1/MctmHW2ki3WybijiwGWnQF7MZVnEMG2DJlB7dt/cwacmUzCpA+ACRvR/Ntvlm0zKDD2XrTjK/FxzuPcHpWRibFvjU+3J8K9jifoPt/YueVs7TcHVJhvO1c/66/H6GcsDu2fv870060XfizXPZVfe5zg+x2k4LefhvDGSEUvW/WrT9gtce3CnEO6zZUZlly3DQgQUkKeYsnCb1dD3BW7Dk+Ga1AFwxrZEbatUxm7eL8d1pBMsP7i2duuG0rUf1QYaBW5tXW+2tqLJlWK8lc9xGk4LgApKNHBZKZAfLFkDLOCdHN/ejfHQTVOJmtIBsABNVL+fJnl4tyxXqUwQiNdGS9oJlEfRcRlxWVEDKA+Dx7GS26qGwZzeb8nJAcDw83/URTANdIM4jr6yiFJkOwrt2mik90dlYXAJGtkcSfyQy4jLqgThWwSZH70Opg/5D/wxF4E5OYDWHZf0Z+TwdXxfkYvQmZqGewI0KfKBpnD3f85UG0vVrqZwzzelTP0zl5EbNhSLTk0EgNrq9+7cuvJgLphycgAsqCPZ+FlTpXMSyuln8kpdrH9pqUv+ZSbbWEq2raOyQICievjILf6kNPqpreb8o6E5OwA2SMOqL5fzbQBzwKtSBpgyfeG6SPK+y0IPnsRx3uo8A8z9ukjiPkllwWXiPIJi00jdfy34lXxQ5eUAnhb3f7dCn0/yy3l8lcynRSlJTiB1kR/0R6+s715AUd7iIANX1t+9wA++R8gRX8Rl4aDqIlWlIEBtc+ferkmf/BsNPi8H0NPzgcxwZve7da1qtJwyPVY0NKiqJFTvuqJ+u6M/ZFGmhFNPH+CK8Pb3SnXiLgWyuhh6pMVQFrqogqHM7vfxE6L54MnLAbDgUN/KX5nm4BO8760jDKSNA2CYqZ9GQ509IzHef5sY4B+r6TEg9dO0ecAmFaUp1pSDT0X6Vv5PvujzdgAbAKXAim8I9OWra0anlzQuAIB1zeHeZ5tCnVHwgqUMRENbm5ojvX9D4niEa0vFl7QwRB2EFvwmt818DcnbAbCCtkToZ0qaewAQvPAKAwokSJU+WaDeHg33fm2iX2N5JYe3NxUDzGE03P01RF+MBvtOYY6nylNe56kNKrW/rbf2x4XYXZADYEUo9PPo/kvyvrcezQCSE8iAQPyczzAfW1374JuPPuvt587AmtDWNzGHArXPyexvVVBlzz27IyndV6KUptTKQnEU7ADaE5HH/aLmNgCvUGCcQKPTNEAIJ1X6FtzZFO7aFF3Wt2icZF7UOAxEl3Utioa7O4L63N/TfNNJzOU4ybwoYkDXam5v7Wt8lHYLWgp2AKzt5viStX697L6zwKbnvKaMfYAK1igxtK053POrnDOWacLmUM+vlJDbQKm1zF2Z0pCT2RW++dDau+TynBJPkGhaDoBlmubB9cBVHLwwEQOH71srAfAdzeFe1Rzu/Nili7fM3B8AgPzCpYvvmMWcMDeA+A7KXXmYM9r1lokYGDL3XTXRuVzjp+0A2hINrZrwv0jjAbnqLNt0fB87sqrvVFYHdq8Jbfls2ZJx2PA1oc3/Wll94m6p1HdGuMkcPlP8G/cQKtBF5Qub4o1Tvu47FcZpOwBW4PNrEU0Eeddbc2RAqrTPJ4L/QVOGA82Rnuujkd5Tc8xa8snY1mayuSm0dcAnKr/OXJS8UQ4aoIlK0MDXYIVKSxzATVuXvYTg+5AVgMpJhimHyVxVKaXxER8Gn2kOxf+PGsWZLUu2++nEjFrYJrZtXaj3z2wr20wGVo5wQHvekjMDiHDNb+NnP59zhkkSWuIAWH5r/JwfIWp7eN9b82cgbR6kWQPjEk1UPGr6aMAwlPhZcyhxbv6SiisH20Drz9gmtk2C+Tq2tbhQlg4aRHHg3N5lln2izjIHADQQGEs0LNBwxl28wKmgQAJfERXIMyWk36Nr/u3N4d6d0XD8Q3z1XH3WIzVOYSlUD2NkrIy5Odyzk21gW9imw7YVKrqo8rkBRsMA1CZun7cB0LLnbyx0ACOUmGD8v5E97//0GFCQNg/xQ0ULEeT3EfBhX3Dw4XWRvr5opPeaN9beVTU9+dblZizRSPc1jI0xMlbGLJWxkG3wBoit4Vop49oNsMGyxs+oLHcAHYnGryJoPQJ1KK2ARQuXGhLdHighVeYkUw4tQ4Xfne9f3N8U6jzYFO6++W2RHVc3h7a+qbn+0bOblm/l97VtsaXp7K3zWQfrehvpZN2MgbGg0r7L2BijAsZq2ILBGqHFW9bj2YfUllCJvvZkw5fHOz+dOMsdAIPRModWSWW+xPulsPo07lmrfoFaKcClXkEahjP8oWZVA8pcn5YDv6TLwu+lsT8p0r6/ra975EA01PO3aKiz7W11D31+bWjL1auXbm24/My7p/xuAafhtJyH87KMKMlimaJC/xvrYF2sk3UDqBrGIlW6JLgbuTDJ/pEyLwnIRLHcpRnBC+xAa4sD4G8ICtDeFdDn2IF52jJpMAp09YmwxAAADBNJREFUmkpBof8eUfu8gbtf1ZFcUSOlvFTDwM5pK3BYgKKxg8Mq/VJlKjPm/lkKjFMARXNGpr5Ktv6ywl/TVVVz8q6rGp5Wb2/8q7qq4Rl1ZcOT2ZX3R+KeVpyG03IezssyWBbLlMqoJD3ZQZ6jdFJUaSwa+F8ylPHmjuTKGjX80omotM8L9N2p0xQ21wnIMTiZjJ+0RYR3t+5Y2m+HXlscAANtT9bfZRj9/yRQ58OiWBGEpMLOKEh9qDW+DGPx+ktp4PI/Yj0XvwAUOvqW/x4Tj70KURuiwxJeRrq4SpnUW8jQwOIQZGg8IWXshaHMThhMv0jbl7K9CL56D2VeOhy3EzgNp6XufDYvyxghYkTmyH7p/Rfo29mWjJxwS3LFXYyeLlIvxvoa/qM9UfeW1ngtSpn+Z00EM0h1BIokCGo7hup/f3ui8Q67INnmABgwnvnkL6kCxQHcqDwKBPqg0n8iAGCnX5v1AaUgRIXtb48v/yFMEFphvRlLNFRq6P9She+4CVJ50aXCQNC3AATon2xP1B0Pk4RYsvHHbfFaP4Kq9WtVHwDALVx3BNUh6oODG0GB7BOnP5n3Rz7ywWqrA2htpcaUXF6HKBy7oiJqZD+mfdqsXabKXP+brldjR3L5ipt7z/lJR1/jdjqZ09KWiGww0rvPBsQ9mJWZUzYvUZEwwGUmUH9hWO17VXuy/rpcYbUnlz90c+/Sn3Qkl5/HdUeq9He5LlH+NDpYD0hXKpZoDHEbIt22LbY6gCOopQbLdI1vH0EdibNyi4AQ0OeRSNwtwPc+UFi/sfec4zclV3wUphH4NUs9XXUmoviuJipYki34WbC3WsaA4rqGSv9ypmrorFhPQ/b2rlDpNF7wMa5LArBOw8B7Sc5OrmsIAuwJ/Jx/EBC0ZeBAsMuKY6Bv6ml4MmMMrBOo4zEnpnGAqAFSIQj0PQ4oWjN6/5nktRfy14pGrvRoSWNt3XHu3vZ43cdMmWoWwv+iwOIZ0wAvHMOAoO46Cv05U+KF7cnwtbc+cOGhYxIUfICKewY0bvTzjuSK402VPkMhbiR9jyPVQaS6CBYFgX7IQP9V7YnI4xaJnFSMIw6AEWzqW9lOrf8LANNrl4IKWafeBKL+dU3HU0VwOBRLNKxv32ovYR3J5TGR8p2GIL7g1/hN3unZAV6wkAEFPq0aaLzpnxcIdXossfQBC4WPEdXae+4THYmGK7jupTN4KoD2NV2rAq6bYxLnFcF1Sv2/TfHzp/2WX65qHXMADKgtUc/fdvuNJgJ8mNOKKLKFCwB/Fei7UQBe1tq7DNvj4c+19jT8rXXz+Y6NL9BUTLotEfnacGZfrS5q/piPHYTfW2xggG/NdK361uHhA2fEaCDvJz0Njr1PzHXvdzsa/hZLRL7Q2rsUqU/6Vg39vwHAZ9ghIdVdyDFwXULw/bY9Uf/VHLNYkkxYIiUPIbFE3TuF8N0+dU9Aga7RvZAStxmZwdNDyeWL2hN1b29NRChvHgptSHrLtvO3tcbPfSMNEC0X6LNBgydyagYQEEQ6ZQ4vosa35tYd59v+qXqYImxMRO5oS0TeEUo2np6WB18DCm7TqbeaS12nHu2dsWTd26dQYflpxx0AAMqNPRvWaKL6Jl3w4+w08UJMcXH6st0ofUCA/j9CBNcNv/jXqvZk/erYtsanNlA+KLIQSyzvak/UoRC+DwnQaHyAn5HhblyRAZ0xcBRo1HtE1J5Ege+NJRsDt/WteLrYzOO6uilx3jOEb/VzOx+u5LqM6PuZQG2A6zjXdUV1HgDpIlcFuqi6edesXavpWILDwQUHwBa2mm3xpVehgNcJFDuCvuMO0g1cX8oceHN7or66PVn/nvZ4qP225y8f5NTFvrbH637Ynmw4USnzixr6M1zAxY659PAhCNQzSqmPxBINi2Pxxp9DCYTNz60f4rpMPd/3tScaqtPpA29SSvZxnReAj6ISb6DBxbfdc88lrrw8IdzkcGPP0ruJlHNv6l40O9a3InTkKS03MU1HdyzZ8JWBQHqBwIr1CFq/LrJTh+CFwhnIXjFR7BYC14lgenZ7IvL9wqW5n3PT9gv+0NG3MsR1vj3ZePbG+JI/uYnKVQfgpuF26ebfZW9L1LaSM6gxVObdQlQ8RroMBI9qyDEgcYUAGV1UPZQ2+tfFEo0L2+ON7TzoBi6FmarWq5U2lmxHouEXe2bvPVfp2tmI+NMKfT4gajZqLG3RzE1AnwsgtOs1VXFWa7ytlqePS9uq4kbvOQCby4fv7fhBKLrVef9j8Gc/Ilyr0UCWzWpLTjxP51E3/0tmT0KPxes+2toXosG9DY4PipUccdME7DmAaRKYT/aeng9kRPypr0qZ4q+B5pN1xqc1ZcrA3ie/0grrzRlvbBEZ6DkAhwvjXGhRgILHBRzWXOTqEB7LclOEMGcyJM8BOFy6GwClhgFyAMphzcWtjgdLN0z9xExxG1GC6DwH4EKhSWU+C+BRfzT1qCRxgp5XPJoUB/a9WugAyaNVCPTdI7zZgJdpEajTtV/85eUIb8cxBjwH4BjVryhKZV7cqgt+DPqVuHLe00QQMsbwlmLkYKZj8hyACyV86/bXv4ReD+Bl5jVRAbdsX063AC9HeTsOMeA5AIeIHq3GMA/+Ab1xAED6Sxl77wcvuMKA5wBcoR1AQuZOmg50SXsRqUWuguq2IkJUVlCY/bIyuFiM1bTqmIbetwQ09IOmzfttsZTL0TjKYd9zAC6VspE5MGzIIce+ZuSSmVOqNeRwKpXalZoyoZfAFgY8B2ALrVML1Y30IIDYOXXKmZ0CEV4KyOqBmW1l8VrnOQCXyqZ1xyX9AX32CwDl/OyLAp82+4VWm372yqWiLSm1ngNwsbiGMrv+jlDOrwcLoBmAXVCEoVwgeQ7AxZL2a1W3CH4KzkUMbqoW6AOfqtzkJoZy1+05ABdrwMHUi7f7dP6NARdBuKjar1WD6Ttwh4sQyl615wBcrAJ37XjzXhoFdxGBu6oVKIj1jPwys7tIyle75wBcLnvTGLwXAKEcQ9rcv7kY7S4nTJ4DcLm0lZB/xDJ0AAgClBJ/BC+4yoDnAFylH0BH3/1Ak+Euw3BePdmsaz7q/Tiv2tP4CgPilV1vzw0G0pDepZQsuyfhlDLThpEu+weh3KhzR+v0HMDRbLiwXyn0nYBi0AXV7qrM2lx8DsBdUpzX7jkA5zk/RuNNPQ27faJyqLyeCFTgF1WDHX0X7DyGDO/AcQY8B+A45WMVGuahbVhGDwQhaJAx+x8BL7jOgOcAXC8CAIEVbaKMHIAQPtBFsLUIqC97CJ4DKIIqsHv/U20+raYIkDgDwSeqQEGm3RltuWspx5SeAyiCUr/nmab9aeNQESBxBoIhh6A1Xue9BOQM3ZNq8RzApPQ4dxJRls1nsU2V8Z4AdK5qTarJcwCT0uPcSaXUVue0ua6pnGx1nezJAHgOYDJ2HDyn68FtDqpzVZVPr467CmAc5eUa5TmAIil5mUk/RVDK4fNAKm0O/JVs9ZYiYMBzAEVQCAzhoH7wSQ19M94BCLLRBHicbfZW9xnwHID7ZZBFcFfPxS+YYLwEgDBzA/LvIey+NV73/My1sbQs8xxAMZWXzIRR6MbMfCxYgUDN1H0YKibKGUs5r54DKKLS52fjTTAvnYkPBWVtUqm3tnYtf7GIKC97KJ4DKLIqcEu88U9q//Nz/Nrsd9AV8xeIWp8uKqFCXwC8Fci/JsS3CcU0XMBYkK7w2Ud8X8YKILYhar8M6HPfnpY757Ynz78LvFBUDHgOoKiKYwRM61NvOHBz79m/aU80vDuWaAi1xpehse+pORIy6+j24DpEfLhCn/echr7ddHwIAYYpp0LUAVEDBC5WiqU9yK5QYHhFBpJMZNmkA0gpnSGd6hBjqCAsSJgUqO+YYLQwVsbckWysJfzv+m3PmTduSlyyn/J5S5ExwDWlyCB5cMZjgJ1Ce7yuvT1R/8lYonHJTT1nnpIeGlyEKrgEpRahO+yVflF9sQD/Wroef1IBXq+JCupBiNsBsBNB8dt3zwEAN8RBBEwDNWReR/aRv0lA5/BZin6U4ruowd/OMqhhf08BfFKQbNYhlTwPdS3CuhkDY2FMsUT9J2LxujbGSvlLYil3kP8fAAD//7HH6iYAAAAGSURBVAMAyTzxUhiUNjIAAAAASUVORK5CYII=" preserveAspectRatio="none"/><filter id="a" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="K"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="L"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="M"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="N"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="O"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="P"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="Q"/><g id="b"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#Q"/></g><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="R"/><path fill="#697986" d="M375-529L38-1026h238c37 0 48 9 63 32l215 343c8-25 17-47 31-68l173-270c15-21 26-37 57-37h227L704-540 1056 0H818c-37 1-57-23-71-46L529-403c-6 24-14 44-25 60L312-46c-14 20-33 47-67 46H24" id="S"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="T"/><g id="c"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.373333333333328,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.94666666666666,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,37.54666666666665,0)" xlink:href="#T"/></g><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="U"/><path fill="#697986" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="V"/><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="W"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="X"/><g id="d"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.039999999999992,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.302222222222213,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.786666666666655,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,40.604444444444425,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,49.08444444444442,0)" xlink:href="#L"/></g><pattern id="e" patternUnits="userSpaceOnUse" x="-42.04" y="422.05" width="88.84" height="91.9"><use xlink:href="#Y" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#697986" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="Z"/><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aa"/><g id="f"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,6.879999999999997,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.648888888888884,0)" xlink:href="#aa"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ab"/><g id="g"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.968888888888882,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.44888888888888,0)" xlink:href="#N"/></g><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ac"/><g id="h"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.479999999999997,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.58666666666666,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.69333333333332,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,38.79999999999998,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.3022222222222,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,56.782222222222195,0)" xlink:href="#Q"/></g><path fill="#6f7681" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="ad"/><path fill="#6f7681" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="ae"/><path fill="#6f7681" d="M415-222h579V0H146v-1446h269v1224" id="af"/><path fill="#6f7681" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="ag"/><g id="i"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.96888888888889,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,25.546666666666667,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.73777777777778,0)" xlink:href="#ag"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ah"/><path fill="#697986" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="ai"/><g id="j"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#ai"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.72888888888888,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,29.608888888888877,0)" xlink:href="#aa"/></g><pattern id="k" patternUnits="userSpaceOnUse" x="-42.04" y="742.05" width="88.84" height="91.9"><use xlink:href="#Y" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><g id="l"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ah"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.675555555555547,0)" xlink:href="#N"/></g><path fill="#6f7681" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="aj"/><path fill="#6f7681" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="ak"/><path fill="#6f7681" d="M646 0H422L14-1026h205c36-1 62 20 71 46 75 215 159 421 226 642 9 30 15 61 21 92 13-66 27-126 50-186l203-548c9-25 34-46 68-46h195" id="al"/><path fill="#6f7681" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="am"/><path fill="#6f7681" d="M254-198c95 60 334 64 323-83-9-119-156-122-253-159C192-490 72-550 72-729c0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270C808-59 575 48 294 6 192-9 106-54 42-110c28-39 43-95 83-120 49-31 96 11 129 32" id="an"/><g id="m"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aj"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,11.644444444444444,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.85333333333333,0)" xlink:href="#al"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.044444444444444,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.54666666666667,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,46.80888888888889,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,54.577777777777776,0)" xlink:href="#ak"/></g><path fill="#6f7681" d="M457 16c-234 0-346-155-346-390v-652h247v652c0 121 55 198 174 197 102-1 168-51 226-107v-742h247V0c-80-9-199 29-214-45l-17-82C697-50 608 16 457 16" id="ao"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="ap"/><path fill="#6f7681" d="M395-1486V0H148v-1486h247" id="aq"/><g id="n"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.155555555555555,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.26222222222222,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.36888888888889,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.47555555555556,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.977777777777774,0)" xlink:href="#aq"/></g><pattern id="o" patternUnits="userSpaceOnUse" x="244.42" y="422.05" width="88.84" height="91.9"><use xlink:href="#Y" transform="translate(-1.531668989976481, 0) scale(9.190013939858911,9.190013939858911)"/></pattern><path fill="#6f7681" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="ar"/><path fill="#6f7681" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="as"/><path fill="#6f7681" d="M605-850c-102 1-168 52-226 108V0H132v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="at"/><path fill="#6f7681" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="au"/><path fill="#6f7681" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="av"/><path fill="#6f7681" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="aw"/><g id="p"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ar"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,12.622222222222222,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,22.72888888888889,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.608888888888888,0)" xlink:href="#at"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.715555555555554,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.217777777777776,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.324444444444445,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,66.20444444444445,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,71.02222222222223,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.50222222222222,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,88.8088888888889,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,95.68888888888891,0)" xlink:href="#ak"/></g><g id="q"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.106666666666667,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,17.875555555555557,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,27.377777777777784,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.64,0)" xlink:href="#an"/></g><filter id="r" filterUnits="objectBoundingBox" x="-.05" y="-.03" width="1.09" height="1.09"><feOffset result="offOut" in="SourceAlpha" dy="2"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="3"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M376-1057c5 39 7 82 7 123V0H146v-1446c85 3 182-6 258 6 17 7 27 20 36 37l432 803c23 42 41 90 60 136 19-47 38-95 61-138l428-801c15-33 41-43 90-43h203V0h-237c1-330-2-664 1-991 1-21 3-42 5-63l-437 820c-22 44-63 63-132 59-48-3-77-26-95-59" id="ax"/><path fill="#697986" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="ay"/><g id="s"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,16.533333333333335,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,28.453333333333333,0)" xlink:href="#R"/></g><g id="t"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.04,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.30222222222222,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.49333333333333,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,44.995555555555555,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,52.257777777777775,0)" xlink:href="#Z"/></g><pattern id="u" patternUnits="userSpaceOnUse" x="538.02" y="429.01" width="76.8" height="76.8"><use xlink:href="#az" transform="translate(0, 0) scale(7.68,7.68)"/></pattern><path fill="#6f7681" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="aA"/><path fill="#6f7681" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="aB"/><path fill="#6f7681" d="M221-3C132-8 80-62 80-152c0-85 58-133 145-135 137-3 173 141 135 270-37 126-112 227-205 301-28-24-89-65-42-112 45-45 92-100 108-175" id="aC"/><g id="v"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,7.768888888888889,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.648888888888889,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.782222222222224,0)" xlink:href="#au"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.6,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.70666666666666,0)" xlink:href="#aC"/></g><path fill="#6f7681" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="aD"/><g id="w"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.537777777777778,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.075555555555557,0)" xlink:href="#aD"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.253333333333334,0)" xlink:href="#aC"/></g><path fill="#6f7681" d="M638 15c-134 0-208-58-269-132-10 52-5 117-71 117H135v-1486h247v586c77-79 169-142 318-142 277 0 379 230 379 521 0 241-97 412-259 495-54 27-115 41-182 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 61 104 93 199 93 187 0 243-152 243-348" id="aE"/><g id="x"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,7.768888888888889,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,14.648888888888889,0)" xlink:href="#am"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,21.91111111111111,0)" xlink:href="#ak"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,31.413333333333334,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,40.72,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,55.68888888888889,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,64.99555555555555,0)" xlink:href="#aE"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,75.1288888888889,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,79.94666666666667,0)" xlink:href="#ak"/></g><path fill="#6f7681" d="M1366 0h-271v-632H417V0H146v-1446h271v622h678v-622h271V0" id="aF"/><path fill="#6f7681" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="aG"/><g id="y"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aF"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,13.44,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.017777777777777,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,34.595555555555556,0)" xlink:href="#aG"/></g><filter id="z" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><g id="A"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.533333333333328,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.453333333333322,0)" xlink:href="#R"/></g><g id="B"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,16.737777777777772,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,21.55555555555555,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.05777777777777,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.16444444444443,0)" xlink:href="#Q"/></g><path fill="#697986" d="M381 316C185 26 60-383 122-872c35-279 131-501 259-698 44 30 96 50 134 86 16 24 12 49-3 77-164 298-252 770-142 1185 35 132 78 259 143 374 20 35 10 87-22 97" id="aH"/><path fill="#697986" d="M502-1045c120-1 193 43 256 101v-542h247V0c-80-9-199 29-214-45l-20-99C693-58 601 15 441 15 163 15 61-217 61-510c0-241 98-411 259-494 54-27 115-41 182-41zM316-510c0 181 36 329 209 329 118 0 173-54 233-123v-460c-48-59-104-93-198-93-188 0-244 151-244 347" id="aI"/><path fill="#697986" d="M219-1570c196 289 321 700 259 1188-35 279-131 501-259 698-44-30-97-51-134-88-18-18-10-55 2-76 168-296 252-768 143-1184-35-133-78-260-142-375-22-41-9-79 21-97" id="aJ"/><g id="C"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#aI"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.115555555555538,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.933333333333316,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,44.71999999999998,0)" xlink:href="#aJ"/></g><path fill="#697986" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="aK"/><g id="D"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,4.817777777777776,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,14.924444444444438,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.404444444444437,0)" xlink:href="#aK"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.7111111111111,0)" xlink:href="#M"/></g><g id="E"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,10.05333333333333,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,17.315555555555548,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.88888888888888,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.48888888888887,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,41.30666666666665,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,50.80888888888888,0)" xlink:href="#Z"/></g><path fill="#697986" d="M221-3C132-8 80-62 80-152c0-85 58-133 145-135 137-3 173 141 135 270-37 126-112 227-205 301-28-24-89-65-42-112 45-45 92-100 108-175" id="aL"/><g id="F"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.21333333333333,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,30.088888888888874,0)" xlink:href="#aL"/></g><g id="G"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,8.764444444444441,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,18.26666666666666,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.084444444444436,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.58666666666666,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.639999999999986,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,52.74666666666665,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.00888888888887,0)" xlink:href="#Q"/></g><g id="H"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.919999999999995,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.026666666666657,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.13333333333332,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,42.23999999999998,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,51.742222222222196,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,60.22222222222219,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,67.1022222222222,0)" xlink:href="#aJ"/></g><path fill="#697986" d="M638 15c-134 0-208-58-269-132-10 52-5 117-71 117H135v-1486h247v586c77-79 169-142 318-142 277 0 379 230 379 521 0 241-97 412-259 495-54 27-115 41-182 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 61 104 93 199 93 187 0 243-152 243-348" id="aM"/><g id="I"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,5.333333333333331,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.102222222222217,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.98222222222221,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,27.244444444444433,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.746666666666655,0)" xlink:href="#aK"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,46.05333333333332,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,61.022222222222204,0)" xlink:href="#aK"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,70.32888888888887,0)" xlink:href="#aM"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,80.4622222222222,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,85.27999999999997,0)" xlink:href="#L"/></g><path fill="#697986" d="M1366 0h-271v-632H417V0H146v-1446h271v622h678v-622h271V0" id="aN"/><g id="J"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aN"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.439999999999994,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,24.017777777777763,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,34.59555555555554,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,45.70666666666665,0)" xlink:href="#aJ"/></g></defs></g></svg>
\ No newline at end of file
diff --git a/docs/img/mcp-access/demo-server-claude-desktop.png b/docs/img/mcp-access/demo-server-claude-desktop.png
new file mode 100644
index 0000000000000..81af1a4845233
Binary files /dev/null and b/docs/img/mcp-access/demo-server-claude-desktop.png differ
diff --git a/docs/img/mcp-access/github-claude.png b/docs/img/mcp-access/github-claude.png
new file mode 100644
index 0000000000000..52e0cb2f9a1f1
Binary files /dev/null and b/docs/img/mcp-access/github-claude.png differ
diff --git a/docs/img/mcp-access/grafana-claude.png b/docs/img/mcp-access/grafana-claude.png
new file mode 100644
index 0000000000000..beb06ff39a5d1
Binary files /dev/null and b/docs/img/mcp-access/grafana-claude.png differ
diff --git a/docs/img/mcp-access/grafana-create-sa.png b/docs/img/mcp-access/grafana-create-sa.png
new file mode 100644
index 0000000000000..a65b5fa2224bd
Binary files /dev/null and b/docs/img/mcp-access/grafana-create-sa.png differ
diff --git a/docs/img/mcp-access/notion-access.png b/docs/img/mcp-access/notion-access.png
new file mode 100644
index 0000000000000..eed6004f0138e
Binary files /dev/null and b/docs/img/mcp-access/notion-access.png differ
diff --git a/docs/img/mcp-access/notion-claude.png b/docs/img/mcp-access/notion-claude.png
new file mode 100644
index 0000000000000..c3c5ccaabd0b6
Binary files /dev/null and b/docs/img/mcp-access/notion-claude.png differ
diff --git a/docs/img/mcp-access/notion-integration.png b/docs/img/mcp-access/notion-integration.png
new file mode 100644
index 0000000000000..3a4920c96cc9b
Binary files /dev/null and b/docs/img/mcp-access/notion-integration.png differ
diff --git a/docs/img/mcp-access/troubleshoot-server-disconnected.png b/docs/img/mcp-access/troubleshoot-server-disconnected.png
new file mode 100644
index 0000000000000..d3d3e8de0d55e
Binary files /dev/null and b/docs/img/mcp-access/troubleshoot-server-disconnected.png differ
diff --git a/docs/img/mcp-access/troubleshoot-tsh-binary-enoent.png b/docs/img/mcp-access/troubleshoot-tsh-binary-enoent.png
new file mode 100644
index 0000000000000..0d53d97d5c5ba
Binary files /dev/null and b/docs/img/mcp-access/troubleshoot-tsh-binary-enoent.png differ
diff --git a/docs/img/mcp-access/vault-claude.png b/docs/img/mcp-access/vault-claude.png
new file mode 100644
index 0000000000000..ebdb6ba35c1ae
Binary files /dev/null and b/docs/img/mcp-access/vault-claude.png differ
diff --git a/docs/img/moderated-file-transfer-dialog.png b/docs/img/moderated-file-transfer-dialog.png
index 56aca6646d48d..fee90b78325dc 100644
Binary files a/docs/img/moderated-file-transfer-dialog.png and b/docs/img/moderated-file-transfer-dialog.png differ
diff --git a/docs/img/motd/teleport-with-updated-MOTD.png b/docs/img/motd/teleport-with-updated-MOTD.png
index 08705ebd429a1..dab35ae735337 100644
Binary files a/docs/img/motd/teleport-with-updated-MOTD.png and b/docs/img/motd/teleport-with-updated-MOTD.png differ
diff --git a/docs/img/new-ssh-server.png b/docs/img/new-ssh-server.png
index 0f3f7b79f280b..a4c66d3f7ec2d 100644
Binary files a/docs/img/new-ssh-server.png and b/docs/img/new-ssh-server.png differ
diff --git a/docs/img/notification.png b/docs/img/notification.png
index 0b48b94994b4f..75c7c361d3d29 100644
Binary files a/docs/img/notification.png and b/docs/img/notification.png differ
diff --git a/docs/img/oracle/oracle-join-dynamic-group@2x.png b/docs/img/oracle/oracle-join-dynamic-group@2x.png
index e78194f3bec1d..03468bfbc186b 100644
Binary files a/docs/img/oracle/oracle-join-dynamic-group@2x.png and b/docs/img/oracle/oracle-join-dynamic-group@2x.png differ
diff --git a/docs/img/oracle/oracle-join-policy@2x.png b/docs/img/oracle/oracle-join-policy@2x.png
index 8ff26e37917bc..a3f3d9a4bde53 100644
Binary files a/docs/img/oracle/oracle-join-policy@2x.png and b/docs/img/oracle/oracle-join-policy@2x.png differ
diff --git a/docs/img/quickstart/welcome.png b/docs/img/quickstart/welcome.png
index a6df65efc9a7d..e61d470617271 100644
Binary files a/docs/img/quickstart/welcome.png and b/docs/img/quickstart/welcome.png differ
diff --git a/docs/img/request-access.png b/docs/img/request-access.png
index aa577df57c2b5..a5b92eba05576 100644
Binary files a/docs/img/request-access.png and b/docs/img/request-access.png differ
diff --git a/docs/img/resource-health-check/database-health-warning-indicator.png b/docs/img/resource-health-check/database-health-warning-indicator.png
new file mode 100644
index 0000000000000..173c5c4edaf68
Binary files /dev/null and b/docs/img/resource-health-check/database-health-warning-indicator.png differ
diff --git a/docs/img/resource-health-check/kubernetes-health-warning.png b/docs/img/resource-health-check/kubernetes-health-warning.png
new file mode 100644
index 0000000000000..816f4a6a04ee8
Binary files /dev/null and b/docs/img/resource-health-check/kubernetes-health-warning.png differ
diff --git a/docs/img/sailpoint/plugin-connector.png b/docs/img/sailpoint/plugin-connector.png
new file mode 100644
index 0000000000000..3ddf11c69ec02
Binary files /dev/null and b/docs/img/sailpoint/plugin-connector.png differ
diff --git a/docs/img/sailpoint/plugin-install.png b/docs/img/sailpoint/plugin-install.png
new file mode 100644
index 0000000000000..37fcd6b85abcd
Binary files /dev/null and b/docs/img/sailpoint/plugin-install.png differ
diff --git a/docs/img/sailpoint/sailpoint-1.png b/docs/img/sailpoint/sailpoint-1.png
new file mode 100644
index 0000000000000..6ecc025e01cdc
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-1.png differ
diff --git a/docs/img/sailpoint/sailpoint-3.png b/docs/img/sailpoint/sailpoint-3.png
new file mode 100644
index 0000000000000..f178d75f8609f
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-3.png differ
diff --git a/docs/img/sailpoint/sailpoint-4.png b/docs/img/sailpoint/sailpoint-4.png
new file mode 100644
index 0000000000000..0f4fb3ab29e51
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-4.png differ
diff --git a/docs/img/sailpoint/sailpoint-5.png b/docs/img/sailpoint/sailpoint-5.png
new file mode 100644
index 0000000000000..ca185b24f63de
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-5.png differ
diff --git a/docs/img/sailpoint/sailpoint-6.png b/docs/img/sailpoint/sailpoint-6.png
new file mode 100644
index 0000000000000..2343097e6d7a9
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-6.png differ
diff --git a/docs/img/sailpoint/sailpoint-7.png b/docs/img/sailpoint/sailpoint-7.png
new file mode 100644
index 0000000000000..52a9635e3f748
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-7.png differ
diff --git a/docs/img/sailpoint/sailpoint-8.png b/docs/img/sailpoint/sailpoint-8.png
new file mode 100644
index 0000000000000..fcc656545c5a0
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-8.png differ
diff --git a/docs/img/sailpoint/sailpoint-9.png b/docs/img/sailpoint/sailpoint-9.png
new file mode 100644
index 0000000000000..dffce678a119d
Binary files /dev/null and b/docs/img/sailpoint/sailpoint-9.png differ
diff --git a/docs/img/sailpoint/sailspoint-scim-config.png b/docs/img/sailpoint/sailspoint-scim-config.png
new file mode 100644
index 0000000000000..b5eda60c1ac7a
Binary files /dev/null and b/docs/img/sailpoint/sailspoint-scim-config.png differ
diff --git a/docs/img/server-access/getting-started-diagram.png b/docs/img/server-access/getting-started-diagram.png
deleted file mode 100644
index e5c3e8f23534d..0000000000000
Binary files a/docs/img/server-access/getting-started-diagram.png and /dev/null differ
diff --git a/docs/img/server-access/linux-servers-hero.jpg b/docs/img/server-access/linux-servers-hero.jpg
new file mode 100644
index 0000000000000..0f8cbacf273b8
Binary files /dev/null and b/docs/img/server-access/linux-servers-hero.jpg differ
diff --git a/docs/img/server-access/openssh-proxy.png b/docs/img/server-access/openssh-proxy.png
deleted file mode 100644
index 7513260741b33..0000000000000
Binary files a/docs/img/server-access/openssh-proxy.png and /dev/null differ
diff --git a/docs/img/spacelift.png b/docs/img/spacelift.png
index d78e17ba3ea96..7549f646d24e8 100644
Binary files a/docs/img/spacelift.png and b/docs/img/spacelift.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-assign-group.png b/docs/img/sso/entraid/oidc/entra-id-assign-group.png
new file mode 100644
index 0000000000000..482174b61be12
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-assign-group.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-create-application.png b/docs/img/sso/entraid/oidc/entra-id-create-application.png
new file mode 100644
index 0000000000000..9ecb2126b5c13
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-create-application.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-create-group.png b/docs/img/sso/entraid/oidc/entra-id-create-group.png
new file mode 100644
index 0000000000000..19a10add362f7
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-create-group.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-oidc-client-credential.png b/docs/img/sso/entraid/oidc/entra-id-oidc-client-credential.png
new file mode 100644
index 0000000000000..4d8d4ba3dee84
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-oidc-client-credential.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-oidc-graph-permission.png b/docs/img/sso/entraid/oidc/entra-id-oidc-graph-permission.png
new file mode 100644
index 0000000000000..78a78cb9b5523
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-oidc-graph-permission.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-oidc-group-claim.png b/docs/img/sso/entraid/oidc/entra-id-oidc-group-claim.png
new file mode 100644
index 0000000000000..55c374a24fac7
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-oidc-group-claim.png differ
diff --git a/docs/img/sso/entraid/oidc/entra-id-oidc-redirect-uri.png b/docs/img/sso/entraid/oidc/entra-id-oidc-redirect-uri.png
new file mode 100644
index 0000000000000..f1c22c27ebbff
Binary files /dev/null and b/docs/img/sso/entraid/oidc/entra-id-oidc-redirect-uri.png differ
diff --git a/docs/img/sso/keycloak/Export SAML keys.png b/docs/img/sso/keycloak/Export SAML keys.png
deleted file mode 100644
index 99aa0da11cb64..0000000000000
Binary files a/docs/img/sso/keycloak/Export SAML keys.png and /dev/null differ
diff --git a/docs/img/team-diagram.png b/docs/img/team-diagram.png
deleted file mode 100644
index b62255ad30120..0000000000000
Binary files a/docs/img/team-diagram.png and /dev/null differ
diff --git a/docs/img/teleport-k8s-pod.png b/docs/img/teleport-k8s-pod.png
deleted file mode 100644
index ab9991fe9c8b1..0000000000000
Binary files a/docs/img/teleport-k8s-pod.png and /dev/null differ
diff --git a/docs/img/teleport-kubernetes-outside.png b/docs/img/teleport-kubernetes-outside.png
deleted file mode 100644
index 826a28263f292..0000000000000
Binary files a/docs/img/teleport-kubernetes-outside.png and /dev/null differ
diff --git a/docs/img/teleport-sso/bitbucket@2x.png b/docs/img/teleport-sso/bitbucket@2x.png
index e9f8f6d756f5c..93c7f31f65fab 100644
Binary files a/docs/img/teleport-sso/bitbucket@2x.png and b/docs/img/teleport-sso/bitbucket@2x.png differ
diff --git a/docs/img/teleport-sso/github@2x.png b/docs/img/teleport-sso/github@2x.png
index e3fe956dc751a..f38bc551fc067 100644
Binary files a/docs/img/teleport-sso/github@2x.png and b/docs/img/teleport-sso/github@2x.png differ
diff --git a/docs/img/teleport-sso/google@2x.png b/docs/img/teleport-sso/google@2x.png
index be600049e3b2a..aa7cd8d6fde99 100644
Binary files a/docs/img/teleport-sso/google@2x.png and b/docs/img/teleport-sso/google@2x.png differ
diff --git a/docs/img/teleport-sso/microsoft@2x.png b/docs/img/teleport-sso/microsoft@2x.png
index b13f26d038421..325ce8cfdf2be 100644
Binary files a/docs/img/teleport-sso/microsoft@2x.png and b/docs/img/teleport-sso/microsoft@2x.png differ
diff --git a/docs/img/teleport-sso/openId@2x.png b/docs/img/teleport-sso/openId@2x.png
index b4a8d5df5ad95..4fc5fac1ea370 100644
Binary files a/docs/img/teleport-sso/openId@2x.png and b/docs/img/teleport-sso/openId@2x.png differ
diff --git a/docs/img/upload_files_connect_drag_drop.png b/docs/img/upload_files_connect_drag_drop.png
index 2601ea640db29..f5d285f999335 100644
Binary files a/docs/img/upload_files_connect_drag_drop.png and b/docs/img/upload_files_connect_drag_drop.png differ
diff --git a/docs/img/use-teleport/connect-kube-access.png b/docs/img/use-teleport/connect-kube-access.png
index f510010f2c077..ee1db74123dd9 100644
Binary files a/docs/img/use-teleport/connect-kube-access.png and b/docs/img/use-teleport/connect-kube-access.png differ
diff --git a/docs/img/use-teleport/connect-kube-list.png b/docs/img/use-teleport/connect-kube-list.png
index 0c148f2fcc47f..f962b501dbd76 100644
Binary files a/docs/img/use-teleport/connect-kube-list.png and b/docs/img/use-teleport/connect-kube-list.png differ
diff --git a/docs/img/use-teleport/connect-mcp-http.png b/docs/img/use-teleport/connect-mcp-http.png
new file mode 100644
index 0000000000000..d9029ab02d2e9
Binary files /dev/null and b/docs/img/use-teleport/connect-mcp-http.png differ
diff --git a/docs/img/vnet/configure-ssh-clients.png b/docs/img/vnet/configure-ssh-clients.png
new file mode 100644
index 0000000000000..522856f80bfbb
Binary files /dev/null and b/docs/img/vnet/configure-ssh-clients.png differ
diff --git a/docs/img/vnet/how-it-works.svg b/docs/img/vnet/how-it-works.svg
index e37da9d95d0e8..c3f47d4d8d486 100644
--- a/docs/img/vnet/how-it-works.svg
+++ b/docs/img/vnet/how-it-works.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:lucid="lucid" width="1487.82" height="471.28"><g transform="translate(721 -3130.173498858219)" lucid:page-tab-id="0_0"><path d="M-1000 3000h2000v1000h-2000z" fill="#fff"/><path d="M-719 3177.43a8 8 0 0 1 8-8h581.87a8 8 0 0 1 8 8v220.15a8 8 0 0 1-8 8H-711a8 8 0 0 1-8-8z" stroke="#512fc9" stroke-width="2" fill="#fff"/><path d="M-720 3138.97h600v25.64h-600z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><use xlink:href="#a" transform="matrix(1,0,0,1,-715,3143.9677536428208) translate(240.448525 16.522380000000002)"/><use xlink:href="#b" transform="matrix(1,0,0,1,-715,3143.9677536428208) translate(285.395425 16.522380000000002)"/><path d="M-719 3183.53h283.18v8.46h-283.2z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><path d="M-700 3226a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M-700 3366a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#d" transform="matrix(1,0,0,1,-700,3360) translate(41.848888888888894 18.879999999999995)"/><path d="M-608.98 3266.34c0 8.2-6.7 14.88-14.87 14.88-8.26 0-14.87-6.67-14.87-14.88 0-8.2 6.6-14.87 14.87-14.87 8.18 0 14.87 6.67 14.87 14.88zM-643.7 3276.26c0 5.47-4.46 9.92-9.9 9.92-5.5 0-9.95-4.44-9.95-9.92 0-5.47 4.46-9.92 9.96-9.92 5.44 0 9.9 4.45 9.9 9.92zM-673.44 3305c0-7.65 6.24-13.86 13.9-13.86h11.9c7.65 0 13.82 6.2 13.82 13.85 0 1.93-1.56 3.47-3.42 3.47h-32.7c-1.94 0-3.5-1.54-3.5-3.48z" stroke="#000" stroke-opacity="0" fill="#512fc9"/><path d="M-643.26 3289.2c6.92 1.88 11.97 8.15 11.97 15.68 0 1.3-.43 2.56-1.18 3.6h28.92c2.46 0 4.46-2 4.46-4.46 0-9.86-7.95-17.84-17.84-17.84h-16.35c-3.7 0-7.13 1.08-9.96 3.02z" stroke="#000" stroke-opacity="0" fill="#512fc9"/><path d="M-510.82 3226a6 6 0 0 1 6-6h176.05a6 6 0 0 1 6 6v19.33a6 6 0 0 1-6 6h-176.05a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#e" transform="matrix(1,0,0,1,-505.8188784005588,3225) translate(0.3622222222222149 17.546666666666667)"/><path d="M-600.8 3440.08a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1-3 3h-26a3 3 0 0 1-3-3z" fill-opacity="0"/><path d="M-580.48 3437.08h8.67l.46.04.46.1.43.2.4.23.36.3.32.37.25.4.17.43.12.46.03.48v8.66m0 8.67v8.68l-.05.47-.1.46-.18.44-.25.4-.3.36-.37.3-.4.25-.43.18-.46.1-.47.05h-8.68m-8.66 0h-8.67l-.48-.04-.46-.1-.43-.2-.4-.23-.36-.3-.3-.36-.25-.4-.18-.43-.1-.45-.05-.47v-8.67m0-8.66v-8.66l.03-.47.1-.45.2-.43.24-.4.3-.36.36-.3.4-.25.43-.17.46-.1.47-.05h8.66" stroke="#00bfa5" stroke-width="2" fill="none"/><path d="M-710.82 3439.58a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1-3 3h-26a3 3 0 0 1-3-3z" fill-opacity="0"/><path d="M-690.5 3436.58h8.68l.47.04.46.1.44.2.4.23.36.3.3.37.25.4.18.43.1.46.05.48v8.66m0 8.67v8.68l-.04.47-.1.46-.2.44-.23.4-.3.36-.36.3-.4.25-.43.18-.45.1-.47.05h-8.67m-8.65 0h-8.67l-.47-.04-.45-.1-.43-.2-.4-.23-.36-.3-.3-.36-.25-.4-.17-.43-.1-.45-.05-.47v-8.67m0-8.66v-8.66l.04-.47.1-.45.2-.43.23-.4.3-.36.37-.3.4-.25.43-.17.46-.1.48-.05h8.67" stroke="#f50057" stroke-width="2" fill="none"/><path d="M-261.3 3226a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M-261.3 3366a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#f" transform="matrix(1,0,0,1,-261.3048767654043,3360) translate(42.777777777777786 18.879999999999995)"/><path d="M-177.5 3265.63h-39.6c-.85 0-1.4.55-1.4 1.4v5.65c0 .85.55 1.43 1.4 1.43h39.6c.84 0 1.4-.57 1.4-1.42v-5.66c0-.84-.56-1.4-1.4-1.4zm-8.48 5.66c-.85 0-1.45-.6-1.45-1.45 0-.84.6-1.4 1.45-1.4.84 0 1.4.56 1.4 1.4 0 .85-.56 1.44-1.4 1.44zm7.03 0h-2.8c-.84 0-1.44-.6-1.44-1.45 0-.84.6-1.4 1.46-1.4h2.8c.84 0 1.44.56 1.44 1.4 0 .85-.6 1.44-1.45 1.44zM-177.5 3279.77h-39.6c-.85 0-1.4.55-1.4 1.4v5.66c0 .85.55 1.4 1.4 1.4h18.4V3294.18c-1.28.4-2.12 1.4-2.55 2.53h-11.62c-.84 0-1.4.6-1.4 1.45 0 .84.56 1.4 1.4 1.4h11.62c.55 1.68 2.12 2.82 3.94 2.82 1.82 0 3.4-1.14 3.94-2.83H-181.74c.84 0 1.4-.55 1.4-1.4 0-.84-.56-1.43-1.4-1.43H-193.36c-.43-1.23-1.4-2.12-2.55-2.52V3288.23h18.4c.84 0 1.4-.55 1.4-1.4v-5.66c0-.85-.56-1.4-1.4-1.4zm-33.92 5.63c-.85 0-1.45-.56-1.45-1.4 0-.84.6-1.4 1.45-1.4.84 0 1.4.56 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.56-1.44-1.4 0-.84.6-1.4 1.44-1.4s1.4.56 1.4 1.4c0 .84-.56 1.4-1.4 1.4zm4.24 0c-.85 0-1.45-.56-1.45-1.4 0-.84.6-1.4 1.46-1.4.84 0 1.4.56 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm2.8-1.4c0-.84.6-1.4 1.44-1.4s1.4.56 1.4 1.4c0 .84-.56 1.4-1.4 1.4-.85 0-1.45-.56-1.45-1.4zm14.16 1.4c-.85 0-1.45-.56-1.45-1.4 0-.84.6-1.4 1.45-1.4.84 0 1.4.56 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm7.03 0h-2.8c-.84 0-1.44-.56-1.44-1.4 0-.84.6-1.4 1.46-1.4h2.8c.84 0 1.44.56 1.44 1.4 0 .84-.6 1.4-1.45 1.4z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#00bfa5"/><path d="M-569 3237.67h18.73m18.72 0h18.73" stroke="#f50057" stroke-width="4" fill="none"/><path d="M-568.95 3239.64H-571v-3.95h2.05zM-510.82 3239.64h-2.05v-3.95h2.05z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M-320.77 3237.67h39.47" stroke="#f50057" stroke-width="4" fill="none"/><path d="M-320.72 3239.64h-2.05v-3.95h2.05z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M-266.3 3237.67l-13 7.5v-15z" stroke="#f50057" stroke-width="4" fill="#f50057"/><path d="M-480.8 3253.25a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.33a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#g" transform="matrix(1,0,0,1,-475.79665617833655,3252.247992141838) translate(16.617777777777768 17.546666666666667)"/><path d="M-552 3264.9h23.06m23.07 0h23.07" stroke="#f50057" stroke-width="4" fill="none"/><path d="M-567 3264.9l13-7.5v15z" stroke="#f50057" stroke-width="4" fill="#f50057"/><path d="M-480.8 3266.9h-2.05v-3.96h2.05z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M-350.8 3264.9h28.83m28.84 0h28.82" stroke="#f50057" stroke-width="4" fill="none"/><path d="M-350.75 3266.9h-2.05v-3.96h2.06zM-262.3 3266.9h-2.06v-3.96h2.06z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M140 3179.17a8 8 0 0 1 8-8h599.04a8 8 0 0 1 8 8v413.28a8 8 0 0 1-8 8H148a8 8 0 0 1-8-8z" stroke="#512fc9" stroke-width="2" fill="#fff"/><path d="M140 3131.17h625.82v40H140z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><use xlink:href="#h" transform="matrix(1,0,0,1,145.000000000103,3136.173498858219) translate(229.83256999999998 22.147380000000002)"/><use xlink:href="#i" transform="matrix(1,0,0,1,145.000000000103,3136.173498858219) translate(300.41678 22.147380000000002)"/><path d="M140 3177.72h296.43v22.92H140z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><path d="M-100.2 3178.85a8 8 0 0 1 8-8H112a8 8 0 0 1 8 8v218.73a8 8 0 0 1-8 8H-92.2a8 8 0 0 1-8-8z" stroke="#512fc9" stroke-width="2" fill="#fff"/><path d="M8.37 3237.18a3 3 0 0 1 3-3h197.75a3 3 0 0 1 3 3v76.94a3 3 0 0 1-3 3H11.37a3 3 0 0 1-3-3zM-133.3 3237.8a3 3 0 0 1 3-3H5.36a3 3 0 0 1 3 3v74.07a3 3 0 0 1-3 3H-130.3a3 3 0 0 1-3-3z" stroke="#000" stroke-opacity="0" fill="#512fc9" fill-opacity=".07"/><path d="M50 3274.8c0 22.08-17.9 40-40 40s-40-17.92-40-40c0-22.1 17.9-40 40-40s40 17.9 40 40z" stroke="#00bfa5" stroke-width="4" fill="#fff" filter="url(#j)"/><path d="M29.8 3257.17H-9.8c-.85 0-1.4.55-1.4 1.4v5.66c0 .84.55 1.43 1.4 1.43h39.6c.85 0 1.4-.6 1.4-1.43v-5.66c0-.85-.55-1.4-1.4-1.4zm-8.48 5.66c-.85 0-1.44-.6-1.44-1.43 0-.85.6-1.4 1.44-1.4.85 0 1.4.55 1.4 1.4 0 .84-.55 1.43-1.4 1.43zm7.04 0h-2.8c-.85 0-1.44-.6-1.44-1.43 0-.85.6-1.4 1.44-1.4h2.8c.85 0 1.44.55 1.44 1.4 0 .84-.6 1.43-1.44 1.43zM29.8 3271.32H-9.8c-.85 0-1.4.55-1.4 1.4v5.65c0 .85.55 1.4 1.4 1.4H8.6V3285.72c-1.27.4-2.12 1.4-2.54 2.54H-5.56c-.85 0-1.4.6-1.4 1.43 0 .84.55 1.4 1.4 1.4H6.06c.55 1.68 2.12 2.82 3.94 2.82 1.82 0 3.4-1.14 3.94-2.83H25.56c.85 0 1.4-.56 1.4-1.4 0-.85-.55-1.44-1.4-1.44H13.94c-.42-1.25-1.4-2.13-2.54-2.54V3279.77h18.4c.85 0 1.4-.55 1.4-1.4v-5.66c0-.83-.55-1.38-1.4-1.38zm-33.92 5.62c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm2.8-1.4c0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4-.85 0-1.44-.55-1.44-1.4zm14.16 1.4c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm7.04 0h-2.8c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4h2.8c.85 0 1.44.56 1.44 1.4 0 .85-.6 1.4-1.44 1.4z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#00bfa5"/><path d="M-30 3329.92a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-68a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#k" transform="matrix(1,0,0,1,-30,3323.9167555475055) translate(10.008888888888897 18.879999999999995)"/><path d="M-130.3 3274.88h16.03m16.04 0h16.06l.02-.02v-.04h.02v-.02h31.15" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M-130.25 3276.85h-2.06v-3.95h2.05z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M-36 3274.8l-13 7.5v-15z" stroke="#00bfa5" stroke-width="4" fill="#00bfa5"/><path d="M-60 3217.84a6 6 0 0 1 6-6H74a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6H-54a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#l" transform="matrix(1,0,0,1,-60,3211.8429024563884) translate(18.604444444444468 18.019999999999996)"/><use xlink:href="#m" transform="matrix(1,0,0,1,-60,3211.8429024563884) translate(60.347777777777786 18.019999999999996)"/><path d="M71 3274.8h28.63m28.64 0h28.63" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M56 3274.8l13-7.5v15z" stroke="#00bfa5" stroke-width="4" fill="#00bfa5"/><path d="M158.9 3276.77h-2.05v-3.95h2.06z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M-561.42 3443.08a6 6 0 0 1 6-6h38.6a6 6 0 0 1 6 6v19.5a6 6 0 0 1-6 6h-38.6a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#n" transform="matrix(1,0,0,1,-556.4233200180361,3442.078786016449) translate(0 17.546666666666667)"/><path d="M-671.43 3443.08a6 6 0 0 1 6-6h41.23a6 6 0 0 1 6 6v19a6 6 0 0 1-6 6h-41.23a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#o" transform="matrix(1,0,0,1,-666.4339741663744,3442.078786016448) translate(0 17.546666666666667)"/><path d="M-480.8 3308.37a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.34a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#p" transform="matrix(1,0,0,1,-475.79665617833655,3307.3729796261614) translate(16.617777777777768 17.546666666666667)"/><path d="M-570 3320.04h14.53m14.54 0h29.06m14.54 0h14.53M-569.95 3320.04H-572" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M-480.8 3322h-2.05v-3.93h2.05z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M-350.8 3320.04h22.45m22.44 0h22.43" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M-350.75 3322h-2.05v-3.93h2.06z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M-268.48 3320.04l-13 7.5v-15z" stroke="#00bfa5" stroke-width="4" fill="#00bfa5"/><path d="M595.54 3411.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M595.54 3551.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#q" transform="matrix(1,0,0,1,595.5384840755543,3545.578786016564) translate(-18.977777777777746 18.879999999999995)"/><path d="M631.64 3455.18h55.6c1.44 0 2.5-1.43 1.87-2.9l-6.44-14.46c-.18-.8-1-1.24-1.6-1.24H638c-.62 0-1.42.43-1.86 1.24l-6.38 14.44c-.62 1.5.43 2.92 1.86 2.92zM688.5 3457.22h-57.92c-1.24 0-2.04.87-2.04 2.1v8.26c0 1.24.8 2.05 2.04 2.05h57.9c1.25 0 2.06-.8 2.06-2.05v-8.25c0-1.24-.8-2.1-2.05-2.1zm-12.4 8.3c-1.25 0-2.12-.86-2.12-2.1 0-1.24.87-2.04 2.1-2.04 1.25 0 2.06.8 2.06 2.05 0 1.24-.8 2.1-2.05 2.1zm10.28 0h-4.1c-1.23 0-2.1-.86-2.1-2.1 0-1.24.87-2.04 2.1-2.04h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.86 2.1-2.1 2.1zM688.5 3486.18h-57.92c-1.24 0-2.04.8-2.04 2.05v8.3c0 1.24.8 2.05 2.04 2.05h57.9c1.25 0 2.06-.8 2.06-2.05v-8.3c0-1.24-.8-2.05-2.05-2.05zm-12.4 8.25c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.05 2.1-2.05 1.25 0 2.06.8 2.06 2.05 0 1.24-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.05 0-1.24.87-2.05 2.1-2.05h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.86 2.05-2.1 2.05zM688.5 3471.73h-57.92c-1.24 0-2.04.8-2.04 2.05v8.24c0 1.24.8 2.1 2.04 2.1h57.9c1.25 0 2.06-.86 2.06-2.1v-8.24c0-1.24-.8-2.05-2.05-2.05zm-49.6 8.25c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm18.6 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.05 0-1.24.87-2.1 2.1-2.1h4.1c1.24 0 2.1.86 2.1 2.1 0 1.24-.86 2.05-2.1 2.05z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M593.54 3224.3a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M593.54 3364.3a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><use xlink:href="#r" transform="matrix(1,0,0,1,593.5384840755843,3358.288123278978) translate(11.248888888888906 18.879999999999995)"/><use xlink:href="#s" transform="matrix(1,0,0,1,593.5384840755843,3358.288123278978) translate(50.946666666666665 18.879999999999995)"/><path d="M629.64 3267.9h55.6c1.44 0 2.5-1.44 1.87-2.93l-6.44-14.44c-.18-.8-1-1.24-1.6-1.24H636c-.62 0-1.42.42-1.86 1.23l-6.38 14.44c-.62 1.5.43 2.92 1.86 2.92zM686.5 3269.93h-57.92c-1.24 0-2.04.87-2.04 2.1v8.26c0 1.23.8 2.03 2.04 2.03h57.9c1.25 0 2.06-.8 2.06-2.04v-8.26c0-1.24-.8-2.1-2.05-2.1zm-12.4 8.3c-1.25 0-2.12-.86-2.12-2.1 0-1.24.87-2.04 2.1-2.04 1.25 0 2.06.8 2.06 2.03 0 1.24-.8 2.1-2.05 2.1zm10.28 0h-4.1c-1.23 0-2.1-.86-2.1-2.1 0-1.24.87-2.04 2.1-2.04h4.1c1.24 0 2.1.8 2.1 2.03 0 1.24-.86 2.1-2.1 2.1zM686.5 3298.9h-57.92c-1.24 0-2.04.8-2.04 2.03v8.3c0 1.25.8 2.06 2.04 2.06h57.9c1.25 0 2.06-.82 2.06-2.06v-8.3c0-1.25-.8-2.05-2.05-2.05zm-12.4 8.23c-1.25 0-2.12-.8-2.12-2.04 0-1.25.87-2.06 2.1-2.06 1.25 0 2.06.8 2.06 2.05 0 1.23-.8 2.03-2.05 2.03zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.04 0-1.25.87-2.06 2.1-2.06h4.1c1.24 0 2.1.8 2.1 2.05 0 1.23-.86 2.03-2.1 2.03zM686.5 3284.44h-57.92c-1.24 0-2.04.8-2.04 2.05v8.23c0 1.24.8 2.1 2.04 2.1h57.9c1.25 0 2.06-.86 2.06-2.1v-8.24c0-1.25-.8-2.06-2.05-2.06zm-49.6 8.25c-1.25 0-2.12-.82-2.12-2.06 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm18.6 0c-1.25 0-2.12-.82-2.12-2.06 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1 0 1.24-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.82-2.1-2.06 0-1.24.87-2.1 2.1-2.1h4.1c1.24 0 2.1.86 2.1 2.1 0 1.24-.86 2.05-2.1 2.05z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#512fc9"/><path d="M345.5 3238.9a6 6 0 0 1 6-6h176.04a6 6 0 0 1 6 6v19.34a6 6 0 0 1-6 6H351.5a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#e" transform="matrix(1,0,0,1,350.4940396311397,3237.9121193498827) translate(0.3622222222222149 17.546666666666667)"/><path d="M290.9 3250.58h17.54m17.52 0h17.53" stroke="#f50057" stroke-width="4" fill="none"/><path d="M290.96 3252.55h-2.06v-3.95h2.06zM345.5 3252.55h-2.06v-3.95h2.05z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M535.54 3250.58h38" stroke="#f50057" stroke-width="4" fill="none"/><path d="M535.6 3252.55h-2.06v-3.95h2.05z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M588.54 3250.58l-13 7.5v-15z" stroke="#f50057" stroke-width="4" fill="#f50057"/><path d="M380 3271.18a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v17.67a6 6 0 0 1-6 6h-68a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#t" transform="matrix(1,0,0,1,385,3270.1825560342236) translate(2.928888888888885 17.546666666666667)"/><path d="M307.9 3281.9h23.36m23.37 0H378" stroke="#f50057" stroke-width="4" fill="none"/><path d="M292.9 3281.9l13-7.5v15z" stroke="#f50057" stroke-width="4" fill="#f50057"/><path d="M380 3283.9h-2.05v-3.96H380z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M462 3281.9h21.42m21.43 0h42.84m21.4 0h21.44" stroke="#f50057" stroke-width="4" fill="none"/><path d="M462.05 3283.9H460v-3.96h2.05zM592.54 3283.9h-2.05v-3.96h2.04z" stroke="#f50057" stroke-width=".05" fill="#f50057"/><path d="M380 3310.78a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v17.67a6 6 0 0 1-6 6h-68a6 6 0 0 1-6-6z" fill="#fff" fill-opacity="0"/><use xlink:href="#u" transform="matrix(1,0,0,1,385,3309.782780877255) translate(2.928888888888885 17.546666666666667)"/><path d="M290.9 3319.62h29.04m29.03 0H378" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M290.96 3321.6h-2.06v-3.96h2.06zM380 3321.6h-2.05v-3.96H380z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M462 3319.62h19.76m19.75 0h19.77l.94.07.92.2.87.37.8.5.7.6.62.72.5.8.36.86.22.92.07.94v23m0 23v45.97m0 23v22.98l.07.94.22.9.36.88.5.8.6.72.72.6.8.5.88.36.9.22.95.08h14.1m14.1 0h14.08" stroke="#00bfa5" stroke-width="4" fill="none"/><path d="M462.05 3321.6H460v-3.96h2.05z" stroke="#00bfa5" stroke-width=".05" fill="#00bfa5"/><path d="M590.54 3469.58l-13 7.5v-15z" stroke="#00bfa5" stroke-width="4" fill="#00bfa5"/><path d="M-127.6 3140.65h275.2v23.96h-275.2z" stroke="#000" stroke-opacity="0" stroke-width="2" fill="#fff" fill-opacity="0"/><use xlink:href="#v" transform="matrix(1,0,0,1,-122.59745280929874,3145.6519732101297) translate(59.16404499999999 16.522380000000002)"/><use xlink:href="#i" transform="matrix(1,0,0,1,-122.59745280929874,3145.6519732101297) translate(121.08530499999999 16.522380000000002)"/><path d="M159.9 3227.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" stroke="#512fc9" stroke-opacity=".2" stroke-width="2" fill="#fff" filter="url(#c)"/><path d="M159.9 3367.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1-6 6h-116a6 6 0 0 1-6-6z" fill="none"/><g><use xlink:href="#w" transform="matrix(1,0,0,1,159.9051989397222,3361.578786016564) translate(15.253333333333345 18.879999999999995)"/><use xlink:href="#x" transform="matrix(1,0,0,1,159.9051989397222,3361.578786016564) translate(53.528888888888886 18.879999999999995)"/></g><path d="M243.7 3267.2h-39.6c-.84 0-1.4.56-1.4 1.4v5.66c0 .85.56 1.43 1.4 1.43h39.6c.85 0 1.4-.6 1.4-1.44v-5.66c0-.84-.55-1.4-1.4-1.4zm-8.47 5.66c-.85 0-1.45-.58-1.45-1.43 0-.84.6-1.4 1.45-1.4.84 0 1.4.56 1.4 1.4 0 .85-.56 1.43-1.4 1.43zm7.03 0h-2.8c-.84 0-1.44-.58-1.44-1.43 0-.84.6-1.4 1.45-1.4h2.8c.84 0 1.44.56 1.44 1.4 0 .85-.6 1.43-1.44 1.43zM243.7 3281.35h-39.6c-.84 0-1.4.55-1.4 1.4v5.66c0 .85.56 1.4 1.4 1.4h18.4V3295.76c-1.27.4-2.1 1.4-2.54 2.53h-11.62c-.84 0-1.4.58-1.4 1.43 0 .84.56 1.4 1.4 1.4h11.62c.55 1.68 2.12 2.82 3.94 2.82 1.83 0 3.4-1.14 3.95-2.83H239.47c.84 0 1.4-.55 1.4-1.4 0-.84-.56-1.43-1.4-1.43H227.85c-.43-1.26-1.4-2.14-2.55-2.54V3289.8h18.4c.85 0 1.4-.55 1.4-1.4v-5.65c0-.85-.55-1.4-1.4-1.4zm-33.9 5.63c-.86 0-1.46-.56-1.46-1.4 0-.85.6-1.4 1.45-1.4.83 0 1.38.55 1.38 1.4 0 .84-.55 1.4-1.4 1.4zm4.23 0c-.85 0-1.44-.56-1.44-1.4 0-.85.58-1.4 1.43-1.4.84 0 1.4.55 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm4.24 0c-.85 0-1.45-.56-1.45-1.4 0-.85.6-1.4 1.45-1.4.84 0 1.4.55 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm2.8-1.4c0-.85.6-1.4 1.44-1.4.85 0 1.4.55 1.4 1.4 0 .84-.55 1.4-1.4 1.4-.84 0-1.44-.56-1.44-1.4zm14.16 1.4c-.85 0-1.45-.56-1.45-1.4 0-.85.6-1.4 1.45-1.4.84 0 1.4.55 1.4 1.4 0 .84-.56 1.4-1.4 1.4zm7.03 0h-2.8c-.84 0-1.44-.56-1.44-1.4 0-.85.6-1.4 1.45-1.4h2.8c.84 0 1.44.55 1.44 1.4 0 .84-.6 1.4-1.44 1.4z" stroke="#000" stroke-opacity="0" stroke-width="4.69" fill="#00bfa5"/><defs><path fill="#512fc9" d="M398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269v865" id="y"/><path fill="#512fc9" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="z"/><path fill="#512fc9" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="A"/><path fill="#512fc9" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="B"/><g id="a"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#y"/><use transform="matrix(0.00837,0,0,0.00837,12.186720000000001,0)" xlink:href="#z"/><use transform="matrix(0.00837,0,0,0.00837,21.167730000000002,0)" xlink:href="#A"/><use transform="matrix(0.00837,0,0,0.00837,30.751380000000008,0)" xlink:href="#B"/></g><path fill="#512fc9" d="M415-222h579V0H146v-1446h269v1224" id="C"/><path fill="#512fc9" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="D"/><path fill="#512fc9" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="E"/><path fill="#512fc9" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="F"/><path fill="#512fc9" d="M1480-1018c71 176 71 414 0 590-106 261-323 444-679 444S225-168 120-428c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zM801-214c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" id="G"/><g id="b"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#C"/><use transform="matrix(0.00837,0,0,0.00837,8.654580000000001,0)" xlink:href="#D"/><use transform="matrix(0.00837,0,0,0.00837,20.539980000000003,0)" xlink:href="#E"/><use transform="matrix(0.00837,0,0,0.00837,31.00248,0)" xlink:href="#F"/><use transform="matrix(0.00837,0,0,0.00837,40.30992,0)" xlink:href="#G"/><use transform="matrix(0.00837,0,0,0.00837,53.69355,0)" xlink:href="#E"/></g><filter id="c" filterUnits="objectBoundingBox" x="-.08" y="-.05" width="1.16" height="1.16"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#697986" d="M398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269v865" id="H"/><path fill="#697986" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="I"/><path fill="#697986" d="M1058-1446v214H417v401h505v207H417v409h641V0H146v-1446h912" id="J"/><path fill="#697986" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="K"/><g id="d"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#H"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.942222222222217,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.47999999999999,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,32.65777777777777,0)" xlink:href="#K"/></g><path fill="#f50057" d="M572-1057c257 0 406 153 406 409V0c-68-4-160 9-208-12-30-14-45-72-60-107C623-47 539 18 382 16 189 13 70-77 70-270c0-183 145-251 311-298 78-21 176-33 295-36 8-132-26-216-144-216-125 0-159 78-268 78-94 0-104-95-146-151 112-100 257-164 454-164zM366-285c-2 73 41 96 114 96 97 0 140-35 196-89v-144c-104 4-184 15-248 46-39 19-61 43-62 91" id="L"/><path fill="#f50057" d="M666 16c-111 3-175-34-236-85v398H120v-1366h192c78-3 80 73 99 128 76-81 169-148 323-148 201 0 299 140 348 307 38 128 40 313-4 439-63 179-182 321-412 327zm124-543c0-153-21-288-164-293-99-3-151 43-196 98v440c40 45 88 70 162 70 160 0 198-144 198-315" id="M"/><path fill="#f50057" d="M440-1037V0H130v-1037h310zm-154-466c113 0 190 70 190 182 0 111-79 180-190 180-109 0-184-71-184-180 0-110 74-182 184-182" id="N"/><path fill="#f50057" d="M236 14C129 14 60-51 60-157c0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" id="O"/><path fill="#f50057" d="M958-162C862-50 728 16 528 16 297 16 159-117 90-293c-49-124-51-307-4-437 70-194 223-323 484-323 177 0 287 60 380 153-36 45-67 98-109 136-73 33-113-34-174-50-21-5-46-11-77-11-169 4-215 131-220 304-6 205 103 354 302 295 57-17 74-74 140-74 25 0 42 10 56 27" id="P"/><path fill="#f50057" d="M366-1016c125-49 306-50 431 0 190 75 313 236 313 495 0 261-123 423-313 499-125 50-306 50-431 0C175-98 50-259 50-521c0-260 126-421 316-495zm4 497c0 183 45 305 212 305 163 0 208-124 208-305 0-182-44-304-208-304-167 0-212 121-212 304" id="Q"/><path fill="#f50057" d="M580-820c-67 0-112 34-150 70V0H120v-1037h192c68-3 78 56 93 108 65-66 139-123 267-124 134-1 209 79 249 178 61-110 169-178 333-178 248 0 368 145 368 394V0h-310v-659c0-107-46-161-138-161-89 1-146 65-146 161V0H718v-659c0-110-37-161-138-161" id="R"/><path fill="#f50057" d="M612-820c-81 1-134 39-182 81V0H120v-1037h192c70-3 79 59 94 112 74-70 159-128 302-128 236 0 352 157 352 394V0H750v-659c0-96-44-162-138-161" id="S"/><path fill="#f50057" d="M544 269c-20 41-37 60-98 60H214L414-91 0-1037h274c46-1 73 23 84 54 69 190 150 371 209 571 68-189 134-380 199-571 10-28 45-55 82-54h250" id="T"/><path fill="#f50057" d="M774-74c-71 55-172 90-290 90-196 0-304-108-304-303v-536c-70 1-146 12-146-61v-121l165-32 61-253c16-78 146-38 230-48v303h252v212H490v515c0 45 23 83 68 83 48 0 88-50 122 4" id="U"/><path fill="#f50057" d="M1024-162C926-48 781 16 578 16 325 16 169-111 94-299c-49-123-59-309-6-439 74-183 225-315 476-315 298 0 466 176 466 475 0 66-3 115-70 115H362c16 155 90 243 244 247 98 2 155-39 218-71 37-18 85-16 110 14zM752-643c-3-120-60-196-182-196-129 0-185 80-205 196h387" id="V"/><path fill="#f50057" d="M768-795c-14 65-88 29-146 29-81 0-145 43-192 130V0H120v-1037c73 2 156-8 222 4 64 11 52 105 69 166 65-96 144-190 283-190 47 0 85 11 114 34" id="W"/><path fill="#f50057" d="M440-1497V0H130v-1497h310" id="X"/><path fill="#f50057" d="M564-1101c10-146-196-154-298-95-28 16-47 35-82 35-29 0-49-13-64-37l-82-126c102-82 223-149 406-149 244 0 402 115 408 354 6 230-160 297-278 405-47 43-40 128-60 196H302c-4-86-47-189-3-262 72-120 253-139 265-321zM398 14c-107 0-176-65-176-171 0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" id="Y"/><g id="e"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.582222222222223,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,19.857777777777777,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.924444444444443,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,29.119999999999997,0)" xlink:href="#P"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,37.76,0)" xlink:href="#Q"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,48.07111111111111,0)" xlink:href="#R"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,63.37777777777777,0)" xlink:href="#M"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,73.65333333333334,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,83.23555555555558,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,93.19111111111113,0)" xlink:href="#T"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,101.7777777777778,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,105.97333333333337,0)" xlink:href="#N"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,111.04000000000002,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,121.35111111111114,0)" xlink:href="#U"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,128.46222222222224,0)" xlink:href="#V"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,138.13333333333335,0)" xlink:href="#W"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,145.4755555555556,0)" xlink:href="#S"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,155.7866666666667,0)" xlink:href="#L"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,165.36888888888888,0)" xlink:href="#X"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,170.43555555555557,0)" xlink:href="#Y"/></g><path fill="#697986" d="M4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217L831 0H588" id="Z"/><path fill="#697986" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="aa"/><path fill="#697986" d="M991-153C899-47 760 15 568 15 237 15 63-197 63-535c0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95H309c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zM778-631c-4-143-73-234-217-234-154 0-226 95-247 234h464" id="ab"/><path fill="#697986" d="M738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176H439v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" id="ac"/><g id="f"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.06222222222221,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.56444444444443,0)" xlink:href="#ac"/></g><path fill="#f50057" d="M252-224h280c2-282-4-570 3-848L370-935c-34 38-114 22-140-12l-98-130 454-381h256v1234h240V0H252v-224" id="ad"/><path fill="#f50057" d="M1079-1060c53 176 54 486 0 662-72 237-212 414-501 414-287 0-427-178-498-414-53-176-53-486 0-662 71-237 210-413 498-413s430 177 501 413zM659-254c162-89 162-477 122-722-22-135-65-248-203-248-137 0-179 115-200 248-38 243-40 632 120 722 52 29 109 29 161 0" id="ae"/><path fill="#f50057" d="M532-896c89-35 216-36 312-1 162 59 274 190 274 411 0 240-136 387-313 462-125 53-311 53-436 2C185-96 66-254 66-506c0-186 74-313 166-437l328-443c29-40 94-71 166-71h276c-157 187-313 374-470 561zm46 197c-139 0-214 93-214 235 0 148 69 235 218 235 140 0 226-93 226-234 0-150-82-236-230-236" id="af"/><path fill="#f50057" d="M1126-566c-12 87 37 230-60 231h-90V0H706v-335H120c-39 1-76-30-82-63L6-551l674-906h296v891h150zm-420 0c3-181-8-372 10-539L331-566h375" id="ag"/><path fill="#f50057" d="M86-1041c45-269 211-432 516-432 221 0 368 97 436 253 40 91 43 220 10 318-51 154-158 259-262 365L501-245c130-48 308-33 481-35 63-1 108 39 108 100V0H66c-2-94 2-169 54-222l420-423c101-110 202-200 212-395 7-138-99-209-232-170-58 17-99 60-118 117-22 66-66 96-152 81" id="ah"/><g id="g"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.311111111111112,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.622222222222224,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.933333333333337,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.128888888888895,0)" xlink:href="#af"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,45.440000000000005,0)" xlink:href="#ag"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,55.75111111111111,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.94666666666667,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,70.25777777777779,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,74.45333333333335,0)" xlink:href="#ah"/></g><path fill="#512fc9" d="M449 0H179v-1446h270V0" id="ai"/><path fill="#512fc9" d="M4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217L831 0H588" id="aj"/><g id="h"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#E"/><use transform="matrix(0.00837,0,0,0.00837,10.4625,0)" xlink:href="#B"/><use transform="matrix(0.00837,0,0,0.00837,21.4272,0)" xlink:href="#ai"/><use transform="matrix(0.00837,0,0,0.00837,26.68356,0)" xlink:href="#aj"/><use transform="matrix(0.00837,0,0,0.00837,37.154430000000005,0)" xlink:href="#D"/><use transform="matrix(0.00837,0,0,0.00837,47.80944000000001,0)" xlink:href="#F"/><use transform="matrix(0.00837,0,0,0.00837,57.76974000000001,0)" xlink:href="#A"/></g><path fill="#512fc9" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="ak"/><path fill="#512fc9" d="M12-1446h226c47 0 80 25 90 61 87 312 181 618 262 935 6 25 10 51 15 79 10-53 22-104 38-149l284-865c11-30 46-61 89-61 78 0 148-4 169 61l282 865c15 43 27 90 38 142 9-49 18-98 30-142l246-865c9-33 45-61 89-61h211L1632 0h-243c-113-359-232-713-341-1076C938-712 818-360 704 0H461" id="al"/><path fill="#512fc9" d="M424-840c74 2 135-1 169-44l399-505c32-39 58-57 122-57h232L859-845c-28 33-52 59-89 78 50 19 80 49 111 90L1383 0h-238c-63 0-84-18-111-53L625-587c-28-35-53-49-116-49h-85V0H155v-1447h269v607" id="am"/><g id="i"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#ak"/><use transform="matrix(0.00837,0,0,0.00837,12.65544,0)" xlink:href="#A"/><use transform="matrix(0.00837,0,0,0.00837,22.23909,0)" xlink:href="#F"/><use transform="matrix(0.00837,0,0,0.00837,32.19939,0)" xlink:href="#al"/><use transform="matrix(0.00837,0,0,0.00837,49.717800000000004,0)" xlink:href="#G"/><use transform="matrix(0.00837,0,0,0.00837,63.10143000000001,0)" xlink:href="#B"/><use transform="matrix(0.00837,0,0,0.00837,74.06613000000002,0)" xlink:href="#am"/></g><filter id="j" filterUnits="objectBoundingBox" x="-.13" y="-.07" width="1.25" height="1.25"><feOffset result="offOut" in="SourceAlpha" dy="4"/><feGaussianBlur result="blurOut" in="offOut" stdDeviation="5"/><feColorMatrix result="colorOut" in="blurOut" values="0 0 0 0 0 0 0 0 0 0.2996078431372549 0 0 0 0 0.25882352941176473 0 0 0 0.4 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path fill="#00bfa5" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="an"/><path fill="#00bfa5" d="M1153-1030c0 232-137 352-319 413 34 19 63 47 88 83L1284 0h-242c-51 0-80-22-101-54L637-517c-24-34-42-48-98-48H424V0H155v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228H424v480h168c180-3 298-77 298-252" id="ao"/><path fill="#00bfa5" d="M1480-1018c71 176 71 414 0 590-106 261-323 444-679 444S225-168 120-428c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zM801-214c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" id="ap"/><path fill="#00bfa5" d="M493-744L32-1446h268c38 0 48 9 63 32l329 531c7-19 15-35 25-51l301-475c15-25 34-37 57-37h258L867-755 1346 0h-269c-37 1-57-23-71-46L671-600c-5 15-12 29-19 42L331-46c-14 20-33 47-67 46H12" id="aq"/><path fill="#00bfa5" d="M789-562V0H520v-562L-7-1446h237c50 0 72 27 90 60 102 188 210 370 305 564 12 25 22 51 31 76 20-56 40-105 69-157l263-483c15-28 44-60 89-60h238" id="ar"/><g id="k"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#an"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,11.111111111111107,0)" xlink:href="#ao"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,22.328888888888883,0)" xlink:href="#ap"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.27555555555554,0)" xlink:href="#aq"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.34666666666665,0)" xlink:href="#ar"/></g><path fill="#697986" d="M565-850c-86 0-140 48-186 99V0H132v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389V0h-247v-653c1-123-52-197-169-197s-180 76-180 197V0H729v-653c0-127-46-197-164-197" id="as"/><path fill="#697986" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="at"/><path fill="#697986" d="M415-222h579V0H146v-1446h269v1224" id="au"/><g id="l"><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,0,0)" xlink:href="#as"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,13.097777777777772,0)" xlink:href="#at"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,22.353333333333325,0)" xlink:href="#au"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,30.395555555555543,0)" xlink:href="#I"/></g><g id="m"><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,0,0)" xlink:href="#at"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,9.255555555555551,0)" xlink:href="#H"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,20.57999999999999,0)" xlink:href="#aa"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,32.33999999999999,0)" xlink:href="#aa"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,44.09999999999998,0)" xlink:href="#J"/><use transform="matrix(0.007777777777777774,0,0,0.007777777777777774,53.00555555555553,0)" xlink:href="#au"/></g><path fill="#00bfa5" d="M1165-1446v221H730V0H461v-1225H24v-221h1141" id="av"/><path fill="#00bfa5" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="aw"/><g id="n"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#av"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,9.884444444444444,0)" xlink:href="#aw"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,21.80444444444444,0)" xlink:href="#an"/></g><path fill="#f50057" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="ax"/><path fill="#f50057" d="M377-1009c4 38 6 82 6 121V0H146v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237V0c-64-4-144 10-192-10-14-6-28-19-41-36" id="ay"/><path fill="#f50057" d="M519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" id="az"/><g id="o"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ax"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,13.28888888888889,0)" xlink:href="#ay"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,26.72888888888889,0)" xlink:href="#az"/></g><path fill="#00bfa5" d="M252-224h280c2-282-4-570 3-848L370-935c-34 38-114 22-140-12l-98-130 454-381h256v1234h240V0H252v-224" id="aA"/><path fill="#00bfa5" d="M1079-1060c53 176 54 486 0 662-72 237-212 414-501 414-287 0-427-178-498-414-53-176-53-486 0-662 71-237 210-413 498-413s430 177 501 413zM659-254c162-89 162-477 122-722-22-135-65-248-203-248-137 0-179 115-200 248-38 243-40 632 120 722 52 29 109 29 161 0" id="aB"/><path fill="#00bfa5" d="M236 14C129 14 60-51 60-157c0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" id="aC"/><path fill="#00bfa5" d="M532-896c89-35 216-36 312-1 162 59 274 190 274 411 0 240-136 387-313 462-125 53-311 53-436 2C185-96 66-254 66-506c0-186 74-313 166-437l328-443c29-40 94-71 166-71h276c-157 187-313 374-470 561zm46 197c-139 0-214 93-214 235 0 148 69 235 218 235 140 0 226-93 226-234 0-150-82-236-230-236" id="aD"/><path fill="#00bfa5" d="M1126-566c-12 87 37 230-60 231h-90V0H706v-335H120c-39 1-76-30-82-63L6-551l674-906h296v891h150zm-420 0c3-181-8-372 10-539L331-566h375" id="aE"/><path fill="#00bfa5" d="M86-1041c45-269 211-432 516-432 221 0 368 97 436 253 40 91 43 220 10 318-51 154-158 259-262 365L501-245c130-48 308-33 481-35 63-1 108 39 108 100V0H66c-2-94 2-169 54-222l420-423c101-110 202-200 212-395 7-138-99-209-232-170-58 17-99 60-118 117-22 66-66 96-152 81" id="aF"/><g id="p"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.311111111111112,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.622222222222224,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,30.933333333333337,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.128888888888895,0)" xlink:href="#aD"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,45.440000000000005,0)" xlink:href="#aE"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,55.75111111111111,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,59.94666666666667,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,70.25777777777779,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,74.45333333333335,0)" xlink:href="#aF"/></g><path fill="#697986" d="M556-1045c246 0 380 151 380 397V0c-79-6-181 23-196-53l-22-73C630-49 541 18 379 16 194 13 81-77 81-262c0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zM317-275c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" id="aG"/><path fill="#697986" d="M635 15C514 15 442-25 379-85v420H132v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" id="aH"/><path fill="#697986" d="M395-1026V0H148v-1026h247zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" id="aI"/><path fill="#697986" d="M225 14C133 14 73-43 73-136c0-92 60-151 152-151 91 0 151 60 151 151 0 92-59 150-151 150" id="aJ"/><path fill="#697986" d="M928-153C839-49 712 15 524 15c-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" id="aK"/><path fill="#697986" d="M361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530C241 15 61-185 61-515c0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" id="aL"/><path fill="#697986" d="M605-850c-102 1-168 52-226 108V0H132v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389V0H779v-653c0-121-55-198-174-197" id="aM"/><path fill="#697986" d="M496 282c-21 85-170 43-266 53L422-76 7-1026h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" id="aN"/><path fill="#697986" d="M604-806c-122 5-180 74-225 167V0H132v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" id="aO"/><path fill="#697986" d="M395-1486V0H148v-1486h247" id="aP"/><g id="q"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.306666666666663,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.359999999999992,0)" xlink:href="#aI"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,24.17777777777777,0)" xlink:href="#aJ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,28.17777777777777,0)" xlink:href="#aK"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,36.65777777777777,0)" xlink:href="#aL"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,46.76444444444443,0)" xlink:href="#as"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,61.733333333333306,0)" xlink:href="#aH"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,71.78666666666665,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,81.0933333333333,0)" xlink:href="#aM"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,90.87999999999997,0)" xlink:href="#aN"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,99.15555555555552,0)" xlink:href="#aJ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,103.15555555555551,0)" xlink:href="#aI"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,107.97333333333329,0)" xlink:href="#aM"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,118.07999999999996,0)" xlink:href="#ac"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,124.95999999999995,0)" xlink:href="#ab"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,134.46222222222218,0)" xlink:href="#aO"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,141.7244444444444,0)" xlink:href="#aM"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,151.83111111111106,0)" xlink:href="#aG"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,161.13777777777773,0)" xlink:href="#aP"/></g><path fill="#697986" d="M1377-1015c71 172 71 412 0 584C1271-174 1052 0 698 0H146v-1446h552c353 6 574 175 679 431zM698-214c307-9 457-198 457-509s-150-500-457-509H417v1018h281" id="aQ"/><g id="r"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aQ"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,13.288888888888884,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,26.72888888888888,0)" xlink:href="#I"/></g><g id="s"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#I"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,9.537777777777775,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,19.715555555555547,0)" xlink:href="#K"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,31.359999999999985,0)" xlink:href="#Z"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,43.982222222222205,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,54.159999999999975,0)" xlink:href="#K"/></g><g id="t"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.311111111111112,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.622222222222224,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.817777777777778,0)" xlink:href="#ae"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.12888888888889,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.324444444444445,0)" xlink:href="#ad"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.635555555555555,0)" xlink:href="#O"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,53.83111111111111,0)" xlink:href="#ad"/></g><g id="u"><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,0,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,10.311111111111112,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,20.622222222222224,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,24.817777777777778,0)" xlink:href="#aB"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,35.12888888888889,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,39.324444444444445,0)" xlink:href="#aA"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,49.635555555555555,0)" xlink:href="#aC"/><use transform="matrix(0.008888888888888889,0,0,0.008888888888888889,53.83111111111111,0)" xlink:href="#aA"/></g><path fill="#512fc9" d="M1177-1061c0 181-116 262-257 314 199 45 298 152 298 322C1218-130 997 0 692 0H146v-1446h499c307 3 532 89 532 385zM952-431c0-152-108-202-265-203H415v424h273c163-1 264-65 264-221zm-43-598c0-163-94-209-264-209H415v418h215c168-1 279-50 279-209" id="aR"/><path fill="#512fc9" d="M1284-209C1170-69 1008 19 759 16c-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" id="aS"/><g id="v"><use transform="matrix(0.00837,0,0,0.00837,0,0)" xlink:href="#E"/><use transform="matrix(0.00837,0,0,0.00837,10.4625,0)" xlink:href="#y"/><use transform="matrix(0.00837,0,0,0.00837,22.64922,0)" xlink:href="#aR"/><use transform="matrix(0.00837,0,0,0.00837,33.55533,0)" xlink:href="#C"/><use transform="matrix(0.00837,0,0,0.00837,42.20991,0)" xlink:href="#ai"/><use transform="matrix(0.00837,0,0,0.00837,47.46627,0)" xlink:href="#aS"/></g><path fill="#697986" d="M1417 0h-208c-47 1-77-28-90-61l-108-295H412L304-61c-11 30-46 61-89 61H6l568-1446h275zM481-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" id="aT"/><path fill="#697986" d="M1187-985c0 329-222 471-561 476H424V0H155v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253H424v519h202c184-1 292-85 292-266" id="aU"/><g id="w"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aT"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.622222222222216,0)" xlink:href="#aU"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,23.733333333333324,0)" xlink:href="#aU"/></g><path fill="#697986" d="M1341-140C1204-38 1028 20 789 16c-350-5-566-186-673-442-73-175-71-420-1-596 107-266 333-435 699-440 235-2 404 78 526 189l-78 122c-45 78-131 10-176-17-110-67-334-90-474-29-171 74-275 233-275 474 0 251 105 414 283 489 144 62 360 37 477-26v-263H916c-88 2-46-125-56-202h481v585" id="aV"/><g id="x"><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,0,0)" xlink:href="#aT"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,12.168888888888883,0)" xlink:href="#aV"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,25.02222222222221,0)" xlink:href="#J"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,35.19999999999999,0)" xlink:href="#aa"/><use transform="matrix(0.008888888888888885,0,0,0.008888888888888885,48.639999999999986,0)" xlink:href="#at"/></g></defs></g></svg>
\ No newline at end of file
+<svg height="468.01" width="1481.01" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><filter id="a" height="1.16" width="1.16" x="-.08" y="-.05"><feOffset dy="4" in="SourceAlpha" result="offOut"/><feGaussianBlur in="offOut" result="blurOut" stdDeviation="5"/><feColorMatrix in="blurOut" result="colorOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path id="b" d="m1165-1446v221h-435v1225h-269v-1225h-437v-221z" fill="#697986"/><path id="c" d="m1284-209c-114 140-276 228-525 225-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" fill="#697986"/><path id="d" d="m1187-985c0 329-222 471-561 476h-202v509h-269v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253h-202v519h202c184-1 292-85 292-266" fill="#697986"/><path id="e" d="m415-222h579v222h-848v-1446h269z" fill="#697986"/><path id="f" d="m1058-1446v214h-641v401h505v207h-505v409h641v215h-912v-1446z" fill="#697986"/><path id="g" d="m377-1009c4 38 6 82 6 121v888h-237v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237v1446c-64-4-144 10-192-10-14-6-28-19-41-36" fill="#697986"/><g id="h"><use transform="scale(.00888889)" xlink:href="#c"/><use transform="matrix(.00888889 0 0 .00888889 11.92 0)" xlink:href="#e"/><path d="m449 0h-270v-1446h270z" fill="#697986" transform="matrix(.00888889 0 0 .00888889 21.111111 0)"/><use transform="matrix(.00888889 0 0 .00888889 26.693333 0)" xlink:href="#f"/><use transform="matrix(.00888889 0 0 .00888889 36.871111 0)" xlink:href="#g"/><use transform="matrix(.00888889 0 0 .00888889 50.311111 0)" xlink:href="#b"/></g><path id="i" d="m572-1057c257 0 406 153 406 409v648c-68-4-160 9-208-12-30-14-45-72-60-107-87 72-171 137-328 135-193-3-312-93-312-286 0-183 145-251 311-298 78-21 176-33 295-36 8-132-26-216-144-216-125 0-159 78-268 78-94 0-104-95-146-151 112-100 257-164 454-164zm-206 772c-2 73 41 96 114 96 97 0 140-35 196-89v-144c-104 4-184 15-248 46-39 19-61 43-62 91" fill="#f50057"/><path id="j" d="m666 16c-111 3-175-34-236-85v398h-310v-1366h192c78-3 80 73 99 128 76-81 169-148 323-148 201 0 299 140 348 307 38 128 40 313-4 439-63 179-182 321-412 327zm124-543c0-153-21-288-164-293-99-3-151 43-196 98v440c40 45 88 70 162 70 160 0 198-144 198-315" fill="#f50057"/><path id="k" d="m440-1037v1037h-310v-1037zm-154-466c113 0 190 70 190 182 0 111-79 180-190 180-109 0-184-71-184-180 0-110 74-182 184-182" fill="#f50057"/><path id="l" d="m236 14c-107 0-176-65-176-171 0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" fill="#f50057"/><path id="m" d="m958-162c-96 112-230 178-430 178-231 0-369-133-438-309-49-124-51-307-4-437 70-194 223-323 484-323 177 0 287 60 380 153-36 45-67 98-109 136-73 33-113-34-174-50-21-5-46-11-77-11-169 4-215 131-220 304-6 205 103 354 302 295 57-17 74-74 140-74 25 0 42 10 56 27" fill="#f50057"/><path id="n" d="m366-1016c125-49 306-50 431 0 190 75 313 236 313 495 0 261-123 423-313 499-125 50-306 50-431 0-191-76-316-237-316-499 0-260 126-421 316-495zm4 497c0 183 45 305 212 305 163 0 208-124 208-305 0-182-44-304-208-304-167 0-212 121-212 304" fill="#f50057"/><path id="o" d="m580-820c-67 0-112 34-150 70v750h-310v-1037h192c68-3 78 56 93 108 65-66 139-123 267-124 134-1 209 79 249 178 61-110 169-178 333-178 248 0 368 145 368 394v659h-310v-659c0-107-46-161-138-161-89 1-146 65-146 161v659h-310v-659c0-110-37-161-138-161" fill="#f50057"/><path id="p" d="m612-820c-81 1-134 39-182 81v739h-310v-1037h192c70-3 79 59 94 112 74-70 159-128 302-128 236 0 352 157 352 394v659h-310v-659c0-96-44-162-138-161" fill="#f50057"/><path id="q" d="m544 269c-20 41-37 60-98 60h-232l200-420-414-946h274c46-1 73 23 84 54 69 190 150 371 209 571 68-189 134-380 199-571 10-28 45-55 82-54h250" fill="#f50057"/><path id="r" d="m774-74c-71 55-172 90-290 90-196 0-304-108-304-303v-536c-70 1-146 12-146-61v-121l165-32 61-253c16-78 146-38 230-48v303h252v212h-252v515c0 45 23 83 68 83 48 0 88-50 122 4" fill="#f50057"/><path id="s" d="m1024-162c-98 114-243 178-446 178-253 0-409-127-484-315-49-123-59-309-6-439 74-183 225-315 476-315 298 0 466 176 466 475 0 66-3 115-70 115h-598c16 155 90 243 244 247 98 2 155-39 218-71 37-18 85-16 110 14zm-272-481c-3-120-60-196-182-196-129 0-185 80-205 196z" fill="#f50057"/><path id="t" d="m768-795c-14 65-88 29-146 29-81 0-145 43-192 130v636h-310v-1037c73 2 156-8 222 4 64 11 52 105 69 166 65-96 144-190 283-190 47 0 85 11 114 34" fill="#f50057"/><path id="u" d="m440-1497v1497h-310v-1497z" fill="#f50057"/><path id="v" d="m564-1101c10-146-196-154-298-95-28 16-47 35-82 35-29 0-49-13-64-37l-82-126c102-82 223-149 406-149 244 0 402 115 408 354 6 230-160 297-278 405-47 43-40 128-60 196h-212c-4-86-47-189-3-262 72-120 253-139 265-321zm-166 1115c-107 0-176-65-176-171 0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" fill="#f50057"/><path id="w" d="m252-224h280c2-282-4-570 3-848l-165 137c-34 38-114 22-140-12l-98-130 454-381h256v1234h240v224h-830z" fill="#f50057"/><path id="x" d="m1079-1060c53 176 54 486 0 662-72 237-212 414-501 414-287 0-427-178-498-414-53-176-53-486 0-662 71-237 210-413 498-413s430 177 501 413zm-420 806c162-89 162-477 122-722-22-135-65-248-203-248-137 0-179 115-200 248-38 243-40 632 120 722 52 29 109 29 161 0" fill="#f50057"/><path id="y" d="m532-896c89-35 216-36 312-1 162 59 274 190 274 411 0 240-136 387-313 462-125 53-311 53-436 2-184-74-303-232-303-484 0-186 74-313 166-437l328-443c29-40 94-71 166-71h276c-157 187-313 374-470 561zm46 197c-139 0-214 93-214 235 0 148 69 235 218 235 140 0 226-93 226-234 0-150-82-236-230-236" fill="#f50057"/><path id="z" d="m1126-566c-12 87 37 230-60 231h-90v335h-270v-335h-586c-39 1-76-30-82-63l-32-153 674-906h296v891zm-420 0c3-181-8-372 10-539l-385 539z" fill="#f50057"/><filter id="A" height="1.25" width="1.25" x="-.13" y="-.07"><feOffset dy="4" in="SourceAlpha" result="offOut"/><feGaussianBlur in="offOut" result="blurOut" stdDeviation="5"/><feColorMatrix in="blurOut" result="colorOut" values="0 0 0 0 0 0 0 0 0 0.2996078431372549 0 0 0 0 0.25882352941176473 0 0 0 0.4 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter><path id="B" d="m1187-985c0 329-222 471-561 476h-202v509h-269v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253h-202v519h202c184-1 292-85 292-266" fill="#00bfa5"/><path id="C" d="m1153-1030c0 232-137 352-319 413 34 19 63 47 88 83l362 534h-242c-51 0-80-22-101-54l-304-463c-24-34-42-48-98-48h-115v565h-269v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228h-172v480h168c180-3 298-77 298-252" fill="#00bfa5"/><path id="D" d="m1480-1018c71 176 71 414 0 590-106 261-323 444-679 444s-576-184-681-444c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zm-679 804c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" fill="#00bfa5"/><path id="E" d="m493-744-461-702h268c38 0 48 9 63 32l329 531c7-19 15-35 25-51l301-475c15-25 34-37 57-37h258l-466 691 479 755h-269c-37 1-57-23-71-46l-335-554c-5 15-12 29-19 42l-321 512c-14 20-33 47-67 46h-252" fill="#00bfa5"/><path id="F" d="m789-562v562h-269v-562l-527-884h237c50 0 72 27 90 60 102 188 210 370 305 564 12 25 22 51 31 76 20-56 40-105 69-157l263-483c15-28 44-60 89-60h238" fill="#00bfa5"/><path id="G" d="m565-850c-86 0-140 48-186 99v751h-247v-1026c80 9 198-29 214 45l16 76c67-72 141-136 276-137 139-1 214 86 253 192 57-117 162-192 328-192 240 0 354 147 354 389v653h-247v-653c1-123-52-197-169-197s-180 76-180 197v653h-248v-653c0-127-46-197-164-197" fill="#697986"/><path id="H" d="m519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" fill="#697986"/><path id="I" d="m398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269z" fill="#697986"/><path id="J" d="m252-224h280c2-282-4-570 3-848l-165 137c-34 38-114 22-140-12l-98-130 454-381h256v1234h240v224h-830z" fill="#00bfa5"/><path id="K" d="m1079-1060c53 176 54 486 0 662-72 237-212 414-501 414-287 0-427-178-498-414-53-176-53-486 0-662 71-237 210-413 498-413s430 177 501 413zm-420 806c162-89 162-477 122-722-22-135-65-248-203-248-137 0-179 115-200 248-38 243-40 632 120 722 52 29 109 29 161 0" fill="#00bfa5"/><path id="L" d="m236 14c-107 0-176-65-176-171 0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" fill="#00bfa5"/><path id="M" d="m556-1045c246 0 380 151 380 397v648c-79-6-181 23-196-53l-22-73c-88 77-177 144-339 142-185-3-298-93-298-278 0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zm-239 770c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" fill="#697986"/><path id="N" d="m635 15c-121 0-193-40-256-100v420h-247v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" fill="#697986"/><path id="O" d="m395-1026v1026h-247v-1026zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" fill="#697986"/><path id="P" d="m225 14c-92 0-152-57-152-150 0-92 60-151 152-151 91 0 151 60 151 151 0 92-59 150-151 150" fill="#697986"/><path id="Q" d="m605-850c-102 1-168 52-226 108v742h-247v-1026c80 9 198-29 214 45l17 81c77-76 165-142 317-142 235 0 346 154 346 389v653h-247v-653c0-121-55-198-174-197" fill="#697986"/><path id="R" d="m1377-1015c71 172 71 412 0 584-106 257-325 431-679 431h-552v-1446h552c353 6 574 175 679 431zm-679 801c307-9 457-198 457-509s-150-500-457-509h-281v1018z" fill="#697986"/><path id="S" d="m1153-1030c0 232-137 352-319 413 34 19 63 47 88 83l362 534h-242c-51 0-80-22-101-54l-304-463c-24-34-42-48-98-48h-115v565h-269v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228h-172v480h168c180-3 298-77 298-252" fill="#697986"/><path id="T" d="m1187-985c0 329-222 471-561 476h-202v509h-269v-1446h471c337 4 561 134 561 461zm-269 0c0-176-112-253-292-253h-202v519h202c184-1 292-85 292-266" fill="#512fc9"/><path id="U" d="m398-581c6 222 109 364 330 364 220 0 331-140 331-363v-866h269v866c-5 286-141 466-350 552-142 59-358 59-500 0-210-86-349-266-349-552v-866h269z" fill="#512fc9"/><path id="V" d="m415-222h579v222h-848v-1446h269z" fill="#512fc9"/><path id="W" d="m449 0h-270v-1446h270z" fill="#512fc9"/><path id="X" d="m377-1009c4 38 6 82 6 121v888h-237v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237v1446c-64-4-144 10-192-10-14-6-28-19-41-36" fill="#512fc9"/><path id="Y" d="m1058-1446v214h-641v401h505v207h-505v409h641v215h-912v-1446z" fill="#512fc9"/><path id="Z" d="m1165-1446v221h-435v1225h-269v-1225h-437v-221z" fill="#512fc9"/><path id="aa" d="m12-1446h226c47 0 80 25 90 61 87 312 181 618 262 935 6 25 10 51 15 79 10-53 22-104 38-149l284-865c11-30 46-61 89-61 78 0 148-4 169 61l282 865c15 43 27 90 38 142 9-49 18-98 30-142l246-865c9-33 45-61 89-61h211l-449 1446h-243c-113-359-232-713-341-1076-110 364-230 716-344 1076h-243" fill="#512fc9"/><path id="ab" d="m1480-1018c71 176 71 414 0 590-106 261-323 444-679 444s-576-184-681-444c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zm-679 804c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" fill="#512fc9"/><path id="ac" d="m1153-1030c0 232-137 352-319 413 34 19 63 47 88 83l362 534h-242c-51 0-80-22-101-54l-304-463c-24-34-42-48-98-48h-115v565h-269v-1446h441c324 4 557 105 557 416zm-263 20c0-163-114-229-294-228h-172v480h168c180-3 298-77 298-252" fill="#512fc9"/><path id="ad" d="m424-840c74 2 135-1 169-44l399-505c32-39 58-57 122-57h232l-487 601c-28 33-52 59-89 78 50 19 80 49 111 90l502 677h-238c-63 0-84-18-111-53l-409-534c-28-35-53-49-116-49h-85v636h-269v-1447h269z" fill="#512fc9"/><path id="ae" d="m1417 0h-208c-47 1-77-28-90-61l-108-295h-599l-108 295c-11 30-46 61-89 61h-209l568-1446h275zm-936-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" fill="#697986"/><g id="af"><use transform="scale(.00888889)" xlink:href="#H"/><use transform="matrix(.00888889 0 0 .00888889 9.537778 0)" xlink:href="#H"/><path d="m1366 0h-271v-632h-678v632h-271v-1446h271v622h678v-622h271z" fill="#697986" transform="matrix(.00888889 0 0 .00888889 19.075556 0)"/></g><path id="ag" d="m519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" fill="#fc9432"/><path id="ah" d="m395-1486v1486h-247v-1486z" fill="#fc9432"/><path id="ai" d="m519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" fill="#1071e5"/><path id="aj" d="m395-1026v1026h-247v-1026zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" fill="#1071e5"/><path id="ak" d="m738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176h-270v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" fill="#1071e5"/><path id="al" d="m991-153c-92 106-231 168-423 168-331 0-505-212-505-550 0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95h-634c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zm-213-478c-4-143-73-234-217-234-154 0-226 95-247 234z" fill="#1071e5"/><path id="am" d="m604-806c-122 5-180 74-225 167v639h-247v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" fill="#1071e5"/><path id="an" d="m928-153c-89 104-216 168-404 168-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" fill="#1071e5"/><path id="ao" d="m56-725c5-259 241-361 518-318 104 16 188 63 250 124l-70 109c-15 22-27 35-60 35-81 0-126-60-222-60-69 0-122 24-122 85 0 75 88 87 152 109 156 54 328 97 328 304 0 247-181 353-436 353-158 0-284-54-372-128 35-48 58-109 103-146 116-42 152 74 285 65 73-5 130-23 130-90 0-78-87-92-154-113-167-53-334-109-330-329" fill="#f50057"/><path id="ap" d="m1079-1060c53 176 54 486 0 662-72 237-212 414-501 414-287 0-427-178-498-414-53-176-53-486 0-662 71-237 210-413 498-413s430 177 501 413zm-420 806c162-89 162-477 122-722-22-135-65-248-203-248-137 0-179 115-200 248-38 243-40 632 120 722 52 29 109 29 161 0" fill="#fc9432"/><path id="aq" d="m236 14c-107 0-176-65-176-171 0-105 70-171 176-171 105 0 176 66 176 171 0 106-70 171-176 171" fill="#fc9432"/><path id="ar" d="m1417 0h-208c-47 1-77-28-90-61l-108-295h-599l-108 295c-11 30-46 61-89 61h-209l568-1446h275zm-936-546h461c-77-218-163-424-231-651-66 230-154 432-230 651" fill="#512fc9"/><filter id="as" height="1.06" width="1.16" x="-.08" y="-.02"><feOffset dy="4" in="SourceAlpha" result="offOut"/><feGaussianBlur in="offOut" result="blurOut" stdDeviation="5"/><feColorMatrix in="blurOut" result="colorOut" values="0 0 0 0 0.03114186851211073 0 0 0 0 0.018069973087274125 0 0 0 0 0.07727797001153403 0 0 0 0.09803921568627451 0"/><feBlend in="SourceGraphic" in2="colorOut"/></filter></defs><g transform="translate(720.012358 -3173.355233)"><path d="m-281.16 3603a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1 -3 3h-26a3 3 0 0 1 -3-3z" fill="none"/><path d="m-260.83 3600h8.67a3 3 0 0 1 3 3v8.67m0 8.66v8.67a3 3 0 0 1 -3 3h-8.67m-8.67 0h-8.66a3 3 0 0 1 -3-3v-8.67m0-8.66v-8.67a3 3 0 0 1 3-3h8.66" fill="none" stroke="#1071e5" stroke-width="2"/><path d="m-719 3208a8 8 0 0 1 8-8h581.87a8 8 0 0 1 8 8v364a8 8 0 0 1 -8 8h-581.87a8 8 0 0 1 -8-8z" fill="#fff" stroke="#512fc9" stroke-width="2"/><path d="m-719 3222.7h283.18v13.6h-283.2z" fill="none"/><path d="m-700 3226a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m-700 3366a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-684.617778 3378.88)"><use transform="scale(.00888889)" xlink:href="#b"/><use transform="matrix(.00888889 0 0 .00888889 9.884444 0)" xlink:href="#c"/><use transform="matrix(.00888889 0 0 .00888889 21.804444 0)" xlink:href="#d"/></g><use transform="translate(-648.271111 3378.88)" xlink:href="#h"/><path d="m-608.98 3266.34c0 8.2-6.7 14.88-14.87 14.88-8.26 0-14.87-6.67-14.87-14.88 0-8.2 6.6-14.87 14.87-14.87 8.18 0 14.87 6.67 14.87 14.88zm-34.72 9.92c0 5.47-4.46 9.92-9.9 9.92-5.5 0-9.95-4.44-9.95-9.92 0-5.47 4.46-9.92 9.96-9.92 5.44 0 9.9 4.45 9.9 9.92zm-29.74 28.74c0-7.65 6.24-13.86 13.9-13.86h11.9c7.65 0 13.82 6.2 13.82 13.85 0 1.93-1.56 3.47-3.42 3.47h-32.7c-1.94 0-3.5-1.54-3.5-3.48z" fill="#512fc9"/><path d="m-643.26 3289.2c6.92 1.88 11.97 8.15 11.97 15.68 0 1.3-.43 2.56-1.18 3.6h28.92c2.46 0 4.46-2 4.46-4.46 0-9.86-7.95-17.84-17.84-17.84h-16.35c-3.7 0-7.13 1.08-9.96 3.02z" fill="#512fc9"/><path d="m-510.82 3226a6 6 0 0 1 6-6h176.05a6 6 0 0 1 6 6v19.33a6 6 0 0 1 -6 6h-176.05a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-505.456656 3242.546667)"><use transform="scale(.00888889)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 9.582222 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 19.857778 0)" xlink:href="#k"/><use transform="matrix(.00888889 0 0 .00888889 24.924444 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 29.12 0)" xlink:href="#m"/><use transform="matrix(.00888889 0 0 .00888889 37.76 0)" xlink:href="#n"/><use transform="matrix(.00888889 0 0 .00888889 48.071111 0)" xlink:href="#o"/><use transform="matrix(.00888889 0 0 .00888889 63.377778 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 73.653333 0)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 83.235556 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 93.191111 0)" xlink:href="#q"/><use transform="matrix(.00888889 0 0 .00888889 101.777778 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 105.973333 0)" xlink:href="#k"/><use transform="matrix(.00888889 0 0 .00888889 111.04 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 121.351111 0)" xlink:href="#r"/><use transform="matrix(.00888889 0 0 .00888889 128.462222 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 138.133333 0)" xlink:href="#t"/><use transform="matrix(.00888889 0 0 .00888889 145.475556 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 155.786667 0)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 165.368889 0)" xlink:href="#u"/><use transform="matrix(.00888889 0 0 .00888889 170.435556 0)" xlink:href="#v"/></g><path d="m-598.28 3604a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1 -3 3h-26a3 3 0 0 1 -3-3z" fill="none"/><path d="m-577.95 3601h8.67a3 3 0 0 1 3 3v8.67m0 8.66v8.67a3 3 0 0 1 -3 3h-8.67m-8.66 0h-8.68a3 3 0 0 1 -3-3v-8.67m0-8.66v-8.67a3 3 0 0 1 3-3h8.66" fill="none" stroke="#00bfa5" stroke-width="2"/><path d="m-569 3237.67h18.73m18.72 0h18.73" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-568.95 3239.64h-2.05v-3.95h2.05zm58.13 0h-2.05v-3.95h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m-320.77 3237.67h39.47" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-320.72 3239.64h-2.05v-3.95h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m-266.3 3237.67-13 7.5v-15z" fill="#f50057" stroke="#f50057" stroke-width="4"/><path d="m-480.8 3253.25a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.33a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-459.178878 3269.794659)"><use transform="scale(.00888889)" xlink:href="#w"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 30.933333 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 35.128889 0)" xlink:href="#y"/><use transform="matrix(.00888889 0 0 .00888889 45.44 0)" xlink:href="#z"/><use transform="matrix(.00888889 0 0 .00888889 55.751111 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 59.946667 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 70.257778 0)" xlink:href="#l"/><path d="m86-1041c45-269 211-432 516-432 221 0 368 97 436 253 40 91 43 220 10 318-51 154-158 259-262 365l-285 292c130-48 308-33 481-35 63-1 108 39 108 100v180h-1024c-2-94 2-169 54-222l420-423c101-110 202-200 212-395 7-138-99-209-232-170-58 17-99 60-118 117-22 66-66 96-152 81" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 74.453333 0)"/></g><g stroke="#f50057"><path d="m-552 3264.9h23.06m23.07 0h23.07" fill="none" stroke-width="4"/><path d="m-567 3264.9 13-7.5v15z" fill="#f50057" stroke-width="4"/><path d="m-480.8 3266.9h-2.05v-3.96h2.05z" fill="#f50057" stroke-width=".05"/><path d="m-350.8 3264.9h28.83m28.84 0h28.82" fill="none" stroke-width="4"/><path d="m-350.75 3266.9h-2.05v-3.96h2.06z" fill="#f50057" stroke-width=".05"/><path d="m-264.36 3264.9h2.06" fill="none" stroke-width="4"/></g><path d="m139.8 3208a8 8 0 0 1 8-8h604.2a8 8 0 0 1 8 8v364a8 8 0 0 1 -8 8h-604.2a8 8 0 0 1 -8-8z" fill="#fff" stroke="#512fc9" stroke-width="2"/><path d="m139.8 3205.8h298.9v20.28h-298.9z" fill="none"/><path d="m-100.2 3208a8 8 0 0 1 8-8h204.2a8 8 0 0 1 8 8v364a8 8 0 0 1 -8 8h-204.2a8 8 0 0 1 -8-8z" fill="#fff" stroke="#512fc9" stroke-width="2"/><path d="m-132.74 3235.9a3 3 0 0 1 3-3h292.5a3 3 0 0 1 3 3v77.77a3 3 0 0 1 -3 3h-292.5a3 3 0 0 1 -3-3z" fill="#512fc9" fill-opacity=".07"/><path d="m-130.3 3274.88h18.4m18.4 0h36.82m18.4 0h36.8m18.42 0h36.8m18.42 0h36.8m18.4 0h18.42m-276.03 0h-2.06" fill="none" stroke="#00bfa5" stroke-width="4"/><path d="m160.77 3274.88-13 7.5v-15z" fill="#00bfa5" stroke="#00bfa5" stroke-width="4"/><path d="m50 3274.8c0 22.08-17.9 40-40 40s-40-17.92-40-40c0-22.1 17.9-40 40-40s40 17.9 40 40z" fill="#fff" filter="url(#A)" stroke="#00bfa5" stroke-width="4"/><path d="m29.8 3257.17h-39.6c-.85 0-1.4.55-1.4 1.4v5.66c0 .84.55 1.43 1.4 1.43h39.6c.85 0 1.4-.6 1.4-1.43v-5.66c0-.85-.55-1.4-1.4-1.4zm-8.48 5.66c-.85 0-1.44-.6-1.44-1.43 0-.85.6-1.4 1.44-1.4.85 0 1.4.55 1.4 1.4 0 .84-.55 1.43-1.4 1.43zm7.04 0h-2.8c-.85 0-1.44-.6-1.44-1.43 0-.85.6-1.4 1.44-1.4h2.8c.85 0 1.44.55 1.44 1.4 0 .84-.6 1.43-1.44 1.43zm1.44 8.49h-39.6c-.85 0-1.4.55-1.4 1.4v5.65c0 .85.55 1.4 1.4 1.4h18.4v5.95c-1.27.4-2.12 1.4-2.54 2.54h-11.62c-.85 0-1.4.6-1.4 1.43 0 .84.55 1.4 1.4 1.4h11.62c.55 1.68 2.12 2.82 3.94 2.82s3.4-1.14 3.94-2.83h11.62c.85 0 1.4-.56 1.4-1.4 0-.85-.55-1.44-1.4-1.44h-11.62c-.42-1.25-1.4-2.13-2.54-2.54v-5.93h18.4c.85 0 1.4-.55 1.4-1.4v-5.66c0-.83-.55-1.38-1.4-1.38zm-33.92 5.62c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm2.8-1.4c0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4s-1.44-.55-1.44-1.4zm14.16 1.4c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4.85 0 1.4.56 1.4 1.4 0 .85-.55 1.4-1.4 1.4zm7.04 0h-2.8c-.85 0-1.44-.55-1.44-1.4 0-.84.6-1.4 1.44-1.4h2.8c.85 0 1.44.56 1.44 1.4 0 .85-.6 1.4-1.44 1.4z" fill="#00bfa5"/><path d="m-30 3329.92a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-68a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-19.991111 3342.796756)"><use transform="scale(.00888889)" xlink:href="#B"/><use transform="matrix(.00888889 0 0 .00888889 11.111111 0)" xlink:href="#C"/><use transform="matrix(.00888889 0 0 .00888889 22.328889 0)" xlink:href="#D"/><use transform="matrix(.00888889 0 0 .00888889 36.275556 0)" xlink:href="#E"/><use transform="matrix(.00888889 0 0 .00888889 48.346667 0)" xlink:href="#F"/></g><path d="m-60 3217.84a6 6 0 0 1 6-6h128a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-128a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-41.395556 3229.862902)"><use transform="scale(.00777778)" xlink:href="#G"/><use transform="matrix(.00777778 0 0 .00777778 13.097778 0)" xlink:href="#b"/><use transform="matrix(.00777778 0 0 .00777778 22.353333 0)" xlink:href="#e"/><use transform="matrix(.00777778 0 0 .00777778 30.395556 0)" xlink:href="#H"/></g><g transform="translate(.347778 3229.862902)"><use transform="scale(.00777778)" xlink:href="#b"/><use transform="matrix(.00777778 0 0 .00777778 9.255556 0)" xlink:href="#I"/><use transform="matrix(.00777778 0 0 .00777778 20.58 0)" xlink:href="#g"/><use transform="matrix(.00777778 0 0 .00777778 32.34 0)" xlink:href="#g"/><use transform="matrix(.00777778 0 0 .00777778 44.1 0)" xlink:href="#f"/><use transform="matrix(.00777778 0 0 .00777778 53.005556 0)" xlink:href="#e"/></g><path d="m-558.9 3607a6 6 0 0 1 6-6h38.6a6 6 0 0 1 6 6v19.5a6 6 0 0 1 -6 6h-38.6a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-553.89681 3623.546667)"><path d="m1165-1446v221h-435v1225h-269v-1225h-437v-221z" fill="#00bfa5" transform="scale(.00888889)"/><path d="m1284-209c-114 140-276 228-525 225-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 9.884444 0)"/><use transform="matrix(.00888889 0 0 .00888889 21.804444 0)" xlink:href="#B"/></g><path d="m-480.8 3308.37a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.34a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-459.178878 3324.919646)"><use transform="scale(.00888889)" xlink:href="#J"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#K"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#K"/><use transform="matrix(.00888889 0 0 .00888889 30.933333 0)" xlink:href="#L"/><path d="m532-896c89-35 216-36 312-1 162 59 274 190 274 411 0 240-136 387-313 462-125 53-311 53-436 2-184-74-303-232-303-484 0-186 74-313 166-437l328-443c29-40 94-71 166-71h276c-157 187-313 374-470 561zm46 197c-139 0-214 93-214 235 0 148 69 235 218 235 140 0 226-93 226-234 0-150-82-236-230-236" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 35.128889 0)"/><path d="m1126-566c-12 87 37 230-60 231h-90v335h-270v-335h-586c-39 1-76-30-82-63l-32-153 674-906h296v891zm-420 0c3-181-8-372 10-539l-385 539z" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 45.44 0)"/><use transform="matrix(.00888889 0 0 .00888889 55.751111 0)" xlink:href="#L"/><use transform="matrix(.00888889 0 0 .00888889 59.946667 0)" xlink:href="#K"/><use transform="matrix(.00888889 0 0 .00888889 70.257778 0)" xlink:href="#L"/><path d="m86-1041c45-269 211-432 516-432 221 0 368 97 436 253 40 91 43 220 10 318-51 154-158 259-262 365l-285 292c130-48 308-33 481-35 63-1 108 39 108 100v180h-1024c-2-94 2-169 54-222l420-423c101-110 202-200 212-395 7-138-99-209-232-170-58 17-99 60-118 117-22 66-66 96-152 81" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 74.453333 0)"/></g><path d="m-570 3320.04h14.53m14.54 0h29.06m14.54 0h14.53m-87.15 0h-2.05" fill="none" stroke="#00bfa5" stroke-width="4"/><path d="m-480.8 3322h-2.05v-3.93h2.05z" fill="#00bfa5" stroke="#00bfa5" stroke-width=".05"/><path d="m-350.8 3320.04h22.45m22.44 0h22.43" fill="none" stroke="#00bfa5" stroke-width="4"/><path d="m-350.75 3322h-2.05v-3.93h2.06z" fill="#00bfa5" stroke="#00bfa5" stroke-width=".05"/><path d="m-268.48 3320.04-13 7.5v-15z" fill="#00bfa5" stroke="#00bfa5" stroke-width="4"/><path d="m593.54 3406a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m593.54 3546a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(574.560706 3558.88)"><use transform="scale(.00888889)" xlink:href="#M"/><use transform="matrix(.00888889 0 0 .00888889 9.306667 0)" xlink:href="#N"/><use transform="matrix(.00888889 0 0 .00888889 19.36 0)" xlink:href="#O"/><use transform="matrix(.00888889 0 0 .00888889 24.177778 0)" xlink:href="#P"/><path d="m928-153c-89 104-216 168-404 168-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" fill="#697986" transform="matrix(.00888889 0 0 .00888889 28.177778 0)"/><path d="m361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530-329 0-509-200-509-530 0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" fill="#697986" transform="matrix(.00888889 0 0 .00888889 36.657778 0)"/><use transform="matrix(.00888889 0 0 .00888889 46.764444 0)" xlink:href="#G"/><use transform="matrix(.00888889 0 0 .00888889 61.733333 0)" xlink:href="#N"/><use transform="matrix(.00888889 0 0 .00888889 71.786667 0)" xlink:href="#M"/><use transform="matrix(.00888889 0 0 .00888889 81.093333 0)" xlink:href="#Q"/><path d="m496 282c-21 85-170 43-266 53l192-411-415-950h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" fill="#697986" transform="matrix(.00888889 0 0 .00888889 90.88 0)"/><use transform="matrix(.00888889 0 0 .00888889 99.155556 0)" xlink:href="#P"/><use transform="matrix(.00888889 0 0 .00888889 103.155556 0)" xlink:href="#O"/><use transform="matrix(.00888889 0 0 .00888889 107.973333 0)" xlink:href="#Q"/><g fill="#697986"><path d="m738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176h-270v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" transform="matrix(.00888889 0 0 .00888889 118.08 0)"/><path d="m991-153c-92 106-231 168-423 168-331 0-505-212-505-550 0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95h-634c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zm-213-478c-4-143-73-234-217-234-154 0-226 95-247 234z" transform="matrix(.00888889 0 0 .00888889 124.96 0)"/><path d="m604-806c-122 5-180 74-225 167v639h-247v-1026c83 11 206-35 218 62l15 124c63-106 147-205 295-205 51 0 93 12 126 35l-32 185c-4 23-15 33-40 33-33 0-65-16-110-14" transform="matrix(.00888889 0 0 .00888889 134.462222 0)"/></g><use transform="matrix(.00888889 0 0 .00888889 141.724444 0)" xlink:href="#Q"/><use transform="matrix(.00888889 0 0 .00888889 151.831111 0)" xlink:href="#M"/><path d="m395-1486v1486h-247v-1486z" fill="#697986" transform="matrix(.00888889 0 0 .00888889 161.137778 0)"/></g><path d="m629.64 3449.6h55.6c1.44 0 2.5-1.43 1.87-2.9l-6.44-14.46c-.18-.8-1-1.24-1.6-1.24h-43.07c-.62 0-1.42.43-1.86 1.24l-6.38 14.45c-.62 1.47.43 2.9 1.86 2.9zm56.86 2.05h-57.92c-1.24 0-2.04.86-2.04 2.1v8.25c0 1.24.8 2.05 2.04 2.05h57.9c1.25 0 2.06-.8 2.06-2.05v-8.25c0-1.24-.8-2.1-2.05-2.1zm-12.4 8.3c-1.25 0-2.12-.86-2.12-2.1s.87-2.05 2.1-2.05c1.25 0 2.06.8 2.06 2.05 0 1.24-.8 2.1-2.05 2.1zm10.28 0h-4.1c-1.23 0-2.1-.86-2.1-2.1s.87-2.05 2.1-2.05h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.86 2.1-2.1 2.1zm2.12 20.65h-57.92c-1.24 0-2.04.8-2.04 2.05v8.3c0 1.24.8 2.05 2.04 2.05h57.9c1.25 0 2.06-.8 2.06-2.05v-8.3c0-1.24-.8-2.05-2.05-2.05zm-12.4 8.25c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.05 2.1-2.05 1.25 0 2.06.8 2.06 2.05 0 1.24-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.05 0-1.24.87-2.05 2.1-2.05h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.86 2.05-2.1 2.05zm2.12-22.7h-57.92c-1.24 0-2.04.8-2.04 2.05v8.25c0 1.24.8 2.1 2.04 2.1h57.9c1.25 0 2.06-.86 2.06-2.1v-8.25c0-1.24-.8-2.05-2.05-2.05zm-49.6 8.25c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm18.6 0c-1.25 0-2.12-.8-2.12-2.05 0-1.24.87-2.1 2.1-2.1 1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.05 0-1.24.87-2.1 2.1-2.1h4.1c1.24 0 2.1.86 2.1 2.1s-.86 2.05-2.1 2.05z" fill="#512fc9"/><path d="m593.54 3224.3a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m593.54 3364.3a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(604.787373 3377.168123)"><use transform="scale(.00888889)" xlink:href="#R"/><use transform="matrix(.00888889 0 0 .00888889 13.288889 0)" xlink:href="#g"/><use transform="matrix(.00888889 0 0 .00888889 26.728889 0)" xlink:href="#H"/></g><g transform="translate(644.485151 3377.168123)"><use transform="scale(.00888889)" xlink:href="#H"/><use transform="matrix(.00888889 0 0 .00888889 9.537778 0)" xlink:href="#f"/><use transform="matrix(.00888889 0 0 .00888889 19.715556 0)" xlink:href="#S"/><path d="m4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217l-584 1446h-243" fill="#697986" transform="matrix(.00888889 0 0 .00888889 31.36 0)"/><use transform="matrix(.00888889 0 0 .00888889 43.982222 0)" xlink:href="#f"/><use transform="matrix(.00888889 0 0 .00888889 54.16 0)" xlink:href="#S"/></g><path d="m629.64 3267.9h55.6c1.44 0 2.5-1.44 1.87-2.93l-6.44-14.44c-.18-.8-1-1.24-1.6-1.24h-43.07c-.62 0-1.42.42-1.86 1.23l-6.38 14.44c-.62 1.5.43 2.92 1.86 2.92zm56.86 2.03h-57.92c-1.24 0-2.04.87-2.04 2.1v8.26c0 1.23.8 2.03 2.04 2.03h57.9c1.25 0 2.06-.8 2.06-2.04v-8.26c0-1.24-.8-2.1-2.05-2.1zm-12.4 8.3c-1.25 0-2.12-.86-2.12-2.1s.87-2.04 2.1-2.04c1.25 0 2.06.8 2.06 2.03 0 1.24-.8 2.1-2.05 2.1zm10.28 0h-4.1c-1.23 0-2.1-.86-2.1-2.1s.87-2.04 2.1-2.04h4.1c1.24 0 2.1.8 2.1 2.03 0 1.24-.86 2.1-2.1 2.1zm2.12 20.67h-57.92c-1.24 0-2.04.8-2.04 2.03v8.3c0 1.25.8 2.06 2.04 2.06h57.9c1.25 0 2.06-.82 2.06-2.06v-8.3c0-1.25-.8-2.05-2.05-2.05zm-12.4 8.23c-1.25 0-2.12-.8-2.12-2.04 0-1.25.87-2.06 2.1-2.06 1.25 0 2.06.8 2.06 2.05 0 1.23-.8 2.03-2.05 2.03zm10.28 0h-4.1c-1.23 0-2.1-.8-2.1-2.04 0-1.25.87-2.06 2.1-2.06h4.1c1.24 0 2.1.8 2.1 2.05 0 1.23-.86 2.03-2.1 2.03zm2.12-22.69h-57.92c-1.24 0-2.04.8-2.04 2.05v8.23c0 1.24.8 2.1 2.04 2.1h57.9c1.25 0 2.06-.86 2.06-2.1v-8.24c0-1.25-.8-2.06-2.05-2.06zm-49.6 8.25c-1.25 0-2.12-.82-2.12-2.06s.87-2.1 2.1-2.1c1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06s.87-2.1 2.1-2.1c1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06s.87-2.1 2.1-2.1c1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm6.2 0c-1.25 0-2.12-.82-2.12-2.06s.87-2.1 2.1-2.1c1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm18.6 0c-1.25 0-2.12-.82-2.12-2.06s.87-2.1 2.1-2.1c1.25 0 2.06.86 2.06 2.1s-.8 2.05-2.05 2.05zm10.28 0h-4.1c-1.23 0-2.1-.82-2.1-2.06s.87-2.1 2.1-2.1h4.1c1.24 0 2.1.86 2.1 2.1s-.86 2.05-2.1 2.05z" fill="#512fc9"/><path d="m345.5 3238.9a6 6 0 0 1 6-6h176.04a6 6 0 0 1 6 6v19.34a6 6 0 0 1 -6 6h-176.04a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(350.856262 3255.458786)"><use transform="scale(.00888889)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 9.582222 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 19.857778 0)" xlink:href="#k"/><use transform="matrix(.00888889 0 0 .00888889 24.924444 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 29.12 0)" xlink:href="#m"/><use transform="matrix(.00888889 0 0 .00888889 37.76 0)" xlink:href="#n"/><use transform="matrix(.00888889 0 0 .00888889 48.071111 0)" xlink:href="#o"/><use transform="matrix(.00888889 0 0 .00888889 63.377778 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 73.653333 0)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 83.235556 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 93.191111 0)" xlink:href="#q"/><use transform="matrix(.00888889 0 0 .00888889 101.777778 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 105.973333 0)" xlink:href="#k"/><use transform="matrix(.00888889 0 0 .00888889 111.04 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 121.351111 0)" xlink:href="#r"/><use transform="matrix(.00888889 0 0 .00888889 128.462222 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 138.133333 0)" xlink:href="#t"/><use transform="matrix(.00888889 0 0 .00888889 145.475556 0)" xlink:href="#p"/><use transform="matrix(.00888889 0 0 .00888889 155.786667 0)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 165.368889 0)" xlink:href="#u"/><use transform="matrix(.00888889 0 0 .00888889 170.435556 0)" xlink:href="#v"/></g><path d="m296.77 3250.58h15.57m15.58 0h15.57" fill="none" stroke="#f50057" stroke-width="4"/><path d="m296.82 3252.55h-2.05v-3.95h2.05zm48.68 0h-2.06v-3.95h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m535.54 3250.58h38" fill="none" stroke="#f50057" stroke-width="4"/><path d="m535.6 3252.55h-2.06v-3.95h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m588.54 3250.58-13 7.5v-15z" fill="#f50057" stroke="#f50057" stroke-width="4"/><path d="m380 3271.18a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v17.67a6 6 0 0 1 -6 6h-68a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(387.928889 3287.729223)"><use transform="scale(.00888889)" xlink:href="#w"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 24.817778 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 35.128889 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 39.324444 0)" xlink:href="#w"/><use transform="matrix(.00888889 0 0 .00888889 49.635556 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 53.831111 0)" xlink:href="#w"/></g><path d="m313.76 3281.9h21.4m21.43 0h21.41" fill="none" stroke="#f50057" stroke-width="4"/><path d="m298.77 3281.9 13-7.5v15z" fill="#f50057" stroke="#f50057" stroke-width="4"/><path d="m380 3283.9h-2.05v-3.96h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m462 3281.9h21.42m21.43 0h42.84m21.4 0h21.44" fill="none" stroke="#f50057" stroke-width="4"/><path d="m462.05 3283.9h-2.05v-3.96h2.05zm130.49 0h-2.05v-3.96h2.04z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m380 3310.78a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v17.67a6 6 0 0 1 -6 6h-68a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(387.928889 3327.329448)"><use transform="scale(.00888889)" xlink:href="#J"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#K"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#L"/><use transform="matrix(.00888889 0 0 .00888889 24.817778 0)" xlink:href="#K"/><use transform="matrix(.00888889 0 0 .00888889 35.128889 0)" xlink:href="#L"/><use transform="matrix(.00888889 0 0 .00888889 39.324444 0)" xlink:href="#J"/><use transform="matrix(.00888889 0 0 .00888889 49.635556 0)" xlink:href="#L"/><use transform="matrix(.00888889 0 0 .00888889 53.831111 0)" xlink:href="#J"/></g><path d="m296.77 3319.62h27.08m27.07 0h27.08" fill="none" stroke="#00bfa5" stroke-width="4"/><path d="m296.82 3321.6h-2.05v-3.96h2.05zm83.18 0h-2.05v-3.96h2.05z" fill="#00bfa5" stroke="#00bfa5" stroke-width=".05"/><path d="m462 3319.62h19.42m19.43 0h19.42a6 6 0 0 1 6 6v22.06m0 22.07v44.12m0 22.07v22.06a6 6 0 0 0 6 6h13.76m13.76 0h13.75" fill="none" stroke="#00bfa5" stroke-width="4"/><path d="m462.05 3321.6h-2.05v-3.96h2.05z" fill="#00bfa5" stroke="#00bfa5" stroke-width=".05"/><path d="m588.54 3464-13 7.5v-15z" fill="#00bfa5" stroke="#00bfa5" stroke-width="4"/><path d="m-100.66 3174.36h220.2v25.64h-220.2z" fill="none"/><g transform="translate(-64.000199 3195.877613)"><use transform="scale(.00837)" xlink:href="#T"/><use transform="matrix(.00837 0 0 .00837 10.4625 0)" xlink:href="#U"/><path d="m1177-1061c0 181-116 262-257 314 199 45 298 152 298 322 0 295-221 425-526 425h-546v-1446h499c307 3 532 89 532 385zm-225 630c0-152-108-202-265-203h-272v424h273c163-1 264-65 264-221zm-43-598c0-163-94-209-264-209h-230v418h215c168-1 279-50 279-209" fill="#512fc9" transform="matrix(.00837 0 0 .00837 22.64922 0)"/><use transform="matrix(.00837 0 0 .00837 33.55533 0)" xlink:href="#V"/><use transform="matrix(.00837 0 0 .00837 42.20991 0)" xlink:href="#W"/><path d="m1284-209c-114 140-276 228-525 225-347-4-553-182-649-442-66-178-66-423 6-596 108-261 330-435 688-440 220-3 375 79 488 188l-90 125c-16 32-68 39-102 12-71-55-162-101-298-96-304 11-465 201-465 510 0 241 101 401 267 477 125 58 330 39 424-24 42-17 97-111 150-54" fill="#512fc9" transform="matrix(.00837 0 0 .00837 47.46627 0)"/></g><g transform="translate(-2.078939 3195.877613)"><use transform="scale(.00837)" xlink:href="#X"/><use transform="matrix(.00837 0 0 .00837 12.65544 0)" xlink:href="#Y"/><use transform="matrix(.00837 0 0 .00837 22.23909 0)" xlink:href="#Z"/><use transform="matrix(.00837 0 0 .00837 32.19939 0)" xlink:href="#aa"/><use transform="matrix(.00837 0 0 .00837 49.7178 0)" xlink:href="#ab"/><use transform="matrix(.00837 0 0 .00837 63.10143 0)" xlink:href="#ac"/><use transform="matrix(.00837 0 0 .00837 74.06613 0)" xlink:href="#ad"/></g><path d="m165.77 3227.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m165.77 3367.58a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(181.022575 3380.458786)"><use transform="scale(.00888889)" xlink:href="#ae"/><use transform="matrix(.00888889 0 0 .00888889 12.622222 0)" xlink:href="#d"/><use transform="matrix(.00888889 0 0 .00888889 23.733333 0)" xlink:href="#d"/></g><g transform="translate(219.298131 3380.458786)"><use transform="scale(.00888889)" xlink:href="#ae"/><path d="m1341-140c-137 102-313 160-552 156-350-5-566-186-673-442-73-175-71-420-1-596 107-266 333-435 699-440 235-2 404 78 526 189l-78 122c-45 78-131 10-176-17-110-67-334-90-474-29-171 74-275 233-275 474 0 251 105 414 283 489 144 62 360 37 477-26v-263h-181c-88 2-46-125-56-202h481z" fill="#697986" transform="matrix(.00888889 0 0 .00888889 12.168889 0)"/><use transform="matrix(.00888889 0 0 .00888889 25.022222 0)" xlink:href="#f"/><use transform="matrix(.00888889 0 0 .00888889 35.2 0)" xlink:href="#g"/><use transform="matrix(.00888889 0 0 .00888889 48.64 0)" xlink:href="#b"/></g><path d="m249.57 3267.2h-39.6c-.85 0-1.4.56-1.4 1.4v5.66c0 .85.55 1.43 1.4 1.43h39.6c.85 0 1.4-.6 1.4-1.44v-5.66c0-.84-.55-1.4-1.4-1.4zm-8.48 5.66c-.86 0-1.45-.58-1.45-1.43 0-.84.6-1.4 1.44-1.4s1.4.56 1.4 1.4c0 .85-.56 1.43-1.4 1.43zm7.03 0h-2.8c-.85 0-1.44-.58-1.44-1.43 0-.84.58-1.4 1.43-1.4h2.8c.85 0 1.44.56 1.44 1.4 0 .85-.6 1.43-1.44 1.43zm1.45 8.49h-39.6c-.85 0-1.4.55-1.4 1.4v5.66c0 .85.55 1.4 1.4 1.4h18.4v5.95c-1.27.4-2.12 1.4-2.54 2.53h-11.63c-.84 0-1.4.58-1.4 1.43 0 .84.56 1.4 1.4 1.4h11.63c.55 1.68 2.12 2.82 3.94 2.82s3.4-1.14 3.94-2.83h11.63c.85 0 1.4-.55 1.4-1.4 0-.84-.55-1.43-1.4-1.43h-11.64c-.4-1.26-1.4-2.14-2.53-2.54v-5.94h18.4c.85 0 1.4-.55 1.4-1.4v-5.65c0-.85-.55-1.4-1.4-1.4zm-33.92 5.63c-.85 0-1.44-.56-1.44-1.4 0-.85.6-1.4 1.45-1.4s1.4.55 1.4 1.4c0 .84-.55 1.4-1.4 1.4zm4.24 0c-.86 0-1.45-.56-1.45-1.4 0-.85.6-1.4 1.44-1.4s1.4.55 1.4 1.4c0 .84-.56 1.4-1.4 1.4zm4.23 0c-.85 0-1.44-.56-1.44-1.4 0-.85.58-1.4 1.43-1.4s1.4.55 1.4 1.4c0 .84-.55 1.4-1.4 1.4zm2.8-1.4c0-.85.6-1.4 1.44-1.4.85 0 1.4.55 1.4 1.4 0 .84-.55 1.4-1.4 1.4s-1.44-.56-1.44-1.4zm14.16 1.4c-.86 0-1.45-.56-1.45-1.4 0-.85.6-1.4 1.44-1.4s1.4.55 1.4 1.4c0 .84-.56 1.4-1.4 1.4zm7.03 0h-2.8c-.85 0-1.44-.56-1.44-1.4 0-.85.58-1.4 1.43-1.4h2.8c.85 0 1.44.55 1.44 1.4 0 .84-.6 1.4-1.44 1.4z" fill="#00bfa5"/><path d="m-700 3414.65a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m-700 3554.65a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><use transform="translate(-684.417778 3567.526327)" xlink:href="#af"/><use transform="translate(-648.471111 3567.526327)" xlink:href="#h"/><path d="m-608.98 3455c0 8.2-6.7 14.87-14.87 14.87-8.26 0-14.87-6.67-14.87-14.88 0-8.22 6.6-14.9 14.87-14.9 8.18 0 14.87 6.68 14.87 14.9zm-34.72 9.9c0 5.48-4.46 9.93-9.9 9.93-5.5 0-9.95-4.45-9.95-9.92 0-5.46 4.46-9.9 9.96-9.9 5.44 0 9.9 4.44 9.9 9.9zm-29.74 28.74c0-7.64 6.24-13.85 13.9-13.85h11.9c7.65 0 13.82 6.2 13.82 13.84 0 1.93-1.56 3.47-3.42 3.47h-32.7c-1.94 0-3.5-1.53-3.5-3.46z" fill="#512fc9"/><path d="m-643.26 3477.85c6.92 1.88 11.97 8.15 11.97 15.67 0 1.3-.43 2.57-1.18 3.6h28.92c2.46 0 4.46-2 4.46-4.45 0-9.86-7.95-17.84-17.84-17.84h-16.35c-3.7 0-7.13 1.08-9.96 3.02z" fill="#512fc9"/><path d="m-498.97 3604.5a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1 -3 3h-26a3 3 0 0 1 -3-3z" fill="none"/><path d="m-478.63 3601.5h8.66a3 3 0 0 1 3 3v8.67m0 8.66v8.67a3 3 0 0 1 -3 3h-8.66m-8.67 0h-8.67a3 3 0 0 1 -3-3v-8.67m0-8.66v-8.67a3 3 0 0 1 3-3h8.67" fill="none" stroke="#fc9432" stroke-width="2"/><path d="m-700 3604.5a3 3 0 0 1 3-3h26a3 3 0 0 1 3 3v26a3 3 0 0 1 -3 3h-26a3 3 0 0 1 -3-3z" fill="none"/><path d="m-679.67 3601.5h8.67a3 3 0 0 1 3 3v8.67m0 8.66v8.67a3 3 0 0 1 -3 3h-8.67m-8.66 0h-8.67a3 3 0 0 1 -3-3v-8.67m0-8.66v-8.67a3 3 0 0 1 3-3h8.67" fill="none" stroke="#f50057" stroke-width="2"/><path d="m-569 3426.3h19.18m19.18 0h38.36m19.18 0h38.36m19.18 0h38.36m19.18 0h38.36m19.18 0h19.2" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-568.95 3428.3h-2.05v-3.96h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m-266.3 3426.3-13 7.5v-15z" fill="#f50057" stroke="#f50057" stroke-width="4"/><path d="m-133.3 3425.5a3 3 0 0 1 3-3h312.84a3 3 0 0 1 3 3v75.88a3 3 0 0 1 -3 3h-312.84a3 3 0 0 1 -3-3z" fill="#512fc9" fill-opacity=".07"/><path d="m-130.3 3463.52h18.4m18.4 0h36.82m18.4 0h36.8m18.42 0h36.8m18.42 0h36.8m18.4 0h18.42m-276.03 0h-2.06" fill="none" stroke="#1071e5" stroke-width="4"/><path d="m160.77 3463.52-13 7.5v-15z" fill="#1071e5" stroke="#1071e5" stroke-width="4"/><path d="m49.44 3463.44c0 22.1-17.9 40-40 40s-40-17.9-40-40 17.9-40 40-40 40 17.9 40 40z" fill="#fff" filter="url(#A)" stroke="#00bfa5" stroke-width="4"/><path d="m29.24 3445.82h-39.6c-.85 0-1.4.55-1.4 1.4v5.65c0 .85.55 1.43 1.4 1.43h39.6c.85 0 1.4-.58 1.4-1.43v-5.66c0-.83-.55-1.38-1.4-1.38zm-8.48 5.66c-.85 0-1.44-.6-1.44-1.44s.6-1.4 1.44-1.4c.85 0 1.4.56 1.4 1.4 0 .85-.55 1.44-1.4 1.44zm7.04 0h-2.8c-.85 0-1.44-.6-1.44-1.44s.6-1.4 1.44-1.4h2.8c.84 0 1.44.56 1.44 1.4 0 .85-.6 1.44-1.44 1.44zm1.44 8.48h-39.6c-.85 0-1.4.56-1.4 1.4v5.66c0 .84.55 1.4 1.4 1.4h18.4v5.95c-1.27.4-2.12 1.4-2.55 2.53h-11.62c-.85 0-1.4.6-1.4 1.44s.55 1.4 1.4 1.4h11.6c.56 1.68 2.13 2.82 3.96 2.82 1.82 0 3.4-1.14 3.94-2.83h11.63c.84 0 1.4-.55 1.4-1.4 0-.84-.55-1.43-1.4-1.43h-11.62c-.42-1.24-1.4-2.13-2.54-2.53v-5.95h18.4c.85 0 1.4-.56 1.4-1.4v-5.66c0-.84-.55-1.4-1.4-1.4zm-33.92 5.63c-.85 0-1.44-.57-1.44-1.4 0-.86.6-1.4 1.44-1.4.85 0 1.4.54 1.4 1.4 0 .84-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.57-1.44-1.4 0-.86.6-1.4 1.44-1.4.85 0 1.4.54 1.4 1.4 0 .84-.55 1.4-1.4 1.4zm4.24 0c-.85 0-1.44-.57-1.44-1.4 0-.86.6-1.4 1.44-1.4.85 0 1.4.54 1.4 1.4 0 .84-.55 1.4-1.4 1.4zm2.8-1.4c0-.86.6-1.4 1.44-1.4.85 0 1.4.54 1.4 1.4 0 .84-.55 1.4-1.4 1.4s-1.44-.57-1.44-1.4zm14.16 1.4c-.85 0-1.44-.57-1.44-1.4 0-.86.6-1.4 1.44-1.4.85 0 1.4.54 1.4 1.4 0 .84-.55 1.4-1.4 1.4zm7.04 0h-2.8c-.85 0-1.44-.57-1.44-1.4 0-.86.6-1.4 1.44-1.4h2.8c.84 0 1.44.54 1.44 1.4 0 .84-.6 1.4-1.44 1.4z" fill="#00bfa5"/><path d="m-30.56 3518.56a6 6 0 0 1 6-6h68a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-68a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-20.554162 3531.443083)"><use transform="scale(.00888889)" xlink:href="#B"/><use transform="matrix(.00888889 0 0 .00888889 11.111111 0)" xlink:href="#C"/><use transform="matrix(.00888889 0 0 .00888889 22.328889 0)" xlink:href="#D"/><use transform="matrix(.00888889 0 0 .00888889 36.275556 0)" xlink:href="#E"/><use transform="matrix(.00888889 0 0 .00888889 48.346667 0)" xlink:href="#F"/></g><path d="m-60.67 3406a6 6 0 0 1 6-6h128a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-128a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-42.064264 3418.02)"><use transform="scale(.00777778)" xlink:href="#G"/><use transform="matrix(.00777778 0 0 .00777778 13.097778 0)" xlink:href="#b"/><use transform="matrix(.00777778 0 0 .00777778 22.353333 0)" xlink:href="#e"/><use transform="matrix(.00777778 0 0 .00777778 30.395556 0)" xlink:href="#H"/></g><g transform="translate(-.320931 3418.02)"><use transform="scale(.00777778)" xlink:href="#b"/><use transform="matrix(.00777778 0 0 .00777778 9.255556 0)" xlink:href="#I"/><use transform="matrix(.00777778 0 0 .00777778 20.58 0)" xlink:href="#g"/><use transform="matrix(.00777778 0 0 .00777778 32.34 0)" xlink:href="#g"/><use transform="matrix(.00777778 0 0 .00777778 44.1 0)" xlink:href="#f"/><use transform="matrix(.00777778 0 0 .00777778 53.005556 0)" xlink:href="#e"/></g><path d="m-459.58 3607.5a6 6 0 0 1 6-6h159.03a6 6 0 0 1 6 6v27.87a6 6 0 0 1 -6 6h-159.03a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-454.581906 3624.046667)"><use transform="scale(.00888889)" xlink:href="#ag"/><use transform="matrix(.00888889 0 0 .00888889 9.537778 0)" xlink:href="#ag"/><path d="m1366 0h-271v-632h-678v632h-271v-1446h271v622h678v-622h271z" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 19.075556 0)"/></g><path d="m7-1026h196c35-1 64 19 71 46 60 241 137 465 181 722 68-246 151-481 220-724 17-60 103-44 175-46 35-1 61 20 69 46 70 242 148 477 212 725 47-256 125-482 189-723 21-78 165-35 255-46l-325 1026h-199c-21 0-37-15-46-44-67-218-136-432-201-652-5-20-10-39-13-58-8 41-17 80-29 119l-187 591c-9 29-27 44-54 44h-189" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -418.63524 3624.046667)"/><path d="m395-1026v1026h-247v-1026zm-123-457c96 0 160 62 160 158 0 94-65 155-160 155-93 0-156-62-156-155 0-95 61-158 156-158" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -404.573018 3624.046667)"/><path d="m738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176h-270v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -399.75524 3624.046667)"/><path d="m605-850c-102 1-168 52-226 108v742h-247v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389v653h-247v-653c0-121-55-198-174-197" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -392.87524 3624.046667)"/><g transform="translate(-379.337462 3624.046667)"><use transform="scale(.00888889)" xlink:href="#ah"/><g fill="#fc9432"><path d="m361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530-329 0-509-200-509-530 0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" transform="matrix(.00888889 0 0 .00888889 4.817778 0)"/><path d="m928-153c-89 104-216 168-404 168-227 0-358-131-424-305-47-123-49-306-4-434 67-190 213-318 465-318 165 0 270 58 357 143-29 37-52 81-86 112-71 26-104-41-170-55-24-5-52-12-86-12-192 5-260 143-260 339 0 194 67 336 254 342 98 3 148-38 200-79 26-20 67-17 87 9" transform="matrix(.00888889 0 0 .00888889 14.924444 0)"/><path d="m556-1045c246 0 380 151 380 397v648c-79-6-181 23-196-53l-22-73c-88 77-177 144-339 142-185-3-298-93-298-278 0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zm-239 770c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" transform="matrix(.00888889 0 0 .00888889 23.404444 0)"/></g><use transform="matrix(.00888889 0 0 .00888889 32.711111 0)" xlink:href="#ah"/></g><path d="m382-1486v851c54 1 89-1 115-33l255-315c22-25 41-43 86-43h226c-118 139-232 284-354 420-11 12-25 21-39 30 29 21 48 49 69 78l342 498h-223c-44-1-65-15-85-44l-261-389c-20-29-30-36-75-37h-56v470h-247v-1486z" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -338.377462 3624.046667)"/><path d="m991-153c-92 106-231 168-423 168-331 0-505-212-505-550 0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95h-634c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zm-213-478c-4-143-73-234-217-234-154 0-226 95-247 234z" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -329.106351 3624.046667)"/><path d="m496 282c-21 85-170 43-266 53l192-411-415-950h216c39-1 60 21 70 46 80 195 164 386 238 586 7 18 10 37 14 56 74-221 164-427 244-642 9-24 36-46 68-46h198" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -319.897462 3624.046667)"/><path d="m254-198c95 60 334 64 323-83-9-119-156-122-253-159-132-50-252-110-252-289 0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270 0 266-233 373-514 331-102-15-188-60-252-116 28-39 43-95 83-120 49-31 96 11 129 32" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 -310.413018 3624.046667)"/><path d="m-660.6 3608a6 6 0 0 1 6-6h41.22a6 6 0 0 1 6 6v19a6 6 0 0 1 -6 6h-41.24a6 6 0 0 1 -6-6z" fill="none"/><path d="m1377-1015c71 172 71 412 0 584-106 257-325 431-679 431h-552v-1446h552c353 6 574 175 679 431zm-679 801c307-9 457-198 457-509s-150-500-457-509h-281v1018z" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 -655.615096 3624.546667)"/><path d="m377-1009c4 38 6 82 6 121v888h-237v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237v1446c-64-4-144 10-192-10-14-6-28-19-41-36" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 -642.326207 3624.546667)"/><path d="m519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 -628.886207 3624.546667)"/><path d="m-241.78 3606a6 6 0 0 1 6-6h255.14a6 6 0 0 1 6 6v20.5a6 6 0 0 1 -6 6h-255.14a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-236.77905 3622.546667)"><use transform="scale(.00888889)" xlink:href="#ai"/><use transform="matrix(.00888889 0 0 .00888889 9.537778 0)" xlink:href="#ai"/><path d="m1366 0h-271v-632h-678v632h-271v-1446h271v622h678v-622h271z" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 19.075556 0)"/></g><g transform="translate(-200.832383 3622.546667)"><path d="m7-1026h196c35-1 64 19 71 46 60 241 137 465 181 722 68-246 151-481 220-724 17-60 103-44 175-46 35-1 61 20 69 46 70 242 148 477 212 725 47-256 125-482 189-723 21-78 165-35 255-46l-325 1026h-199c-21 0-37-15-46-44-67-218-136-432-201-652-5-20-10-39-13-58-8 41-17 80-29 119l-187 591c-9 29-27 44-54 44h-189" fill="#1071e5" transform="scale(.00888889)"/><use transform="matrix(.00888889 0 0 .00888889 14.062222 0)" xlink:href="#aj"/><use transform="matrix(.00888889 0 0 .00888889 18.88 0)" xlink:href="#ak"/><path d="m605-850c-102 1-168 52-226 108v742h-247v-1486h247v571c76-69 161-129 301-127 234 4 346 154 346 389v653h-247v-653c0-121-55-198-174-197" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 25.76 0)"/></g><g transform="translate(-161.534605 3622.546667)"><path d="m1165-1446v221h-435v1225h-269v-1225h-437v-221z" fill="#1071e5" transform="scale(.00888889)"/><use transform="matrix(.00888889 0 0 .00888889 8.764444 0)" xlink:href="#al"/><path d="m395-1486v1486h-247v-1486z" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 18.266667 0)"/><use transform="matrix(.00888889 0 0 .00888889 23.084444 0)" xlink:href="#al"/><path d="m635 15c-121 0-193-40-256-100v420h-247v-1361c64 5 145-11 192 11 33 24 28 86 42 129 78-86 174-159 331-159 277 0 379 232 379 524 0 241-96 412-258 495-54 27-116 41-183 41zm186-536c0-181-37-329-209-329-117 0-175 55-233 124v460c48 60 104 93 198 93 188 0 244-152 244-348" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 32.586667 0)"/><path d="m361-1005c121-49 297-49 417 0 184 74 298 236 298 490 0 330-178 530-506 530-329 0-509-200-509-530 0-254 115-416 300-490zm-45 492c0 201 65 338 254 338 188 0 251-137 251-338s-63-340-251-340c-189 0-254 139-254 340" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 42.64 0)"/><use transform="matrix(.00888889 0 0 .00888889 52.746667 0)" xlink:href="#am"/><use transform="matrix(.00888889 0 0 .00888889 60.008889 0)" xlink:href="#ak"/></g><g transform="translate(-91.214605 3622.546667)"><use transform="scale(.00888889)" xlink:href="#an"/><use transform="matrix(.00888889 0 0 .00888889 8.48 0)" xlink:href="#al"/><use transform="matrix(.00888889 0 0 .00888889 17.982222 0)" xlink:href="#am"/><use transform="matrix(.00888889 0 0 .00888889 25.244444 0)" xlink:href="#ak"/><use transform="matrix(.00888889 0 0 .00888889 32.124444 0)" xlink:href="#aj"/><path d="m601-1285c-158 0-198 102-186 268h267v176h-259v841h-247v-840c-61-14-153-3-153-76v-101h153c-17-292 113-454 383-454 47 0 91 6 132 19l-5 124c-1 41-44 43-85 43" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 36.942222 0)"/><use transform="matrix(.00888889 0 0 .00888889 43.173333 0)" xlink:href="#aj"/><use transform="matrix(.00888889 0 0 .00888889 47.991111 0)" xlink:href="#an"/><path d="m556-1045c246 0 380 151 380 397v648c-79-6-181 23-196-53l-22-73c-88 77-177 144-339 142-185-3-298-93-298-278 0-184 152-247 321-292 78-21 176-31 293-34 10-155-29-262-170-262-104 0-161 40-224 77-47 28-107 5-127-31l-45-79c118-108 260-162 427-162zm-239 770c-3 86 56 121 139 121 117 0 179-51 239-111v-173c-122 6-219 17-297 53-49 22-79 51-81 110" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 56.471111 0)"/><use transform="matrix(.00888889 0 0 .00888889 65.777778 0)" xlink:href="#ak"/><use transform="matrix(.00888889 0 0 .00888889 72.657778 0)" xlink:href="#al"/><path d="m254-198c95 60 334 64 323-83-9-119-156-122-253-159-132-50-252-110-252-289 0-214 163-309 387-313 145-3 264 55 338 127-26 36-45 82-77 111-69 21-111-33-176-48-103-23-247 0-238 102 11 114 156 118 251 155 126 49 251 100 251 270 0 266-233 373-514 331-102-15-188-60-252-116 28-39 43-95 83-120 49-31 96 11 129 32" fill="#1071e5" transform="matrix(.00888889 0 0 .00888889 82.16 0)"/></g><path d="m165.77 3406a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v116a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" filter="url(#a)" stroke="#512fc9" stroke-opacity=".2" stroke-width="2"/><path d="m165.77 3546a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v12a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><use transform="translate(186.235909 3558.88)" xlink:href="#af"/><g transform="translate(222.182575 3558.88)"><use transform="scale(.00888889)" xlink:href="#g"/><path d="m1480-1018c71 176 71 414 0 590-106 261-323 444-679 444s-576-184-681-444c-71-176-71-414 0-590 106-261 324-444 681-444 355 0 573 184 679 444zm-679 804c307 0 456-198 456-509s-149-510-456-510c-308 0-459 198-459 510s152 509 459 509" fill="#697986" transform="matrix(.00888889 0 0 .00888889 13.44 0)"/><use transform="matrix(.00888889 0 0 .00888889 27.653333 0)" xlink:href="#R"/><use transform="matrix(.00888889 0 0 .00888889 40.942222 0)" xlink:href="#f"/></g><path d="m201.87 3449.6h55.6c1.44 0 2.5-1.43 1.87-2.9l-6.44-14.46c-.2-.8-1-1.24-1.62-1.24h-43.03c-.62 0-1.42.43-1.85 1.24l-6.4 14.45c-.6 1.47.44 2.9 1.87 2.9zm56.85 2.05h-57.9c-1.25 0-2.05.86-2.05 2.1v8.25c0 1.24.8 2.05 2.04 2.05h57.92c1.24 0 2.05-.8 2.05-2.05v-8.25c0-1.24-.8-2.1-2.05-2.1zm-12.4 8.3c-1.24 0-2.1-.86-2.1-2.1s.86-2.05 2.1-2.05 2.05.8 2.05 2.05c0 1.24-.8 2.1-2.05 2.1zm10.3 0h-4.1c-1.24 0-2.1-.86-2.1-2.1s.86-2.05 2.1-2.05h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.87 2.1-2.1 2.1zm2.1 20.65h-57.9c-1.25 0-2.05.8-2.05 2.05v8.3c0 1.24.8 2.05 2.04 2.05h57.92c1.24 0 2.05-.8 2.05-2.05v-8.3c0-1.24-.8-2.05-2.05-2.05zm-12.4 8.25c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.05 2.1-2.05s2.05.8 2.05 2.05c0 1.24-.8 2.05-2.05 2.05zm10.3 0h-4.1c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.05 2.1-2.05h4.1c1.24 0 2.1.8 2.1 2.05 0 1.24-.87 2.05-2.1 2.05zm2.1-22.7h-57.9c-1.25 0-2.05.8-2.05 2.05v8.25c0 1.24.8 2.1 2.04 2.1h57.92c1.24 0 2.05-.86 2.05-2.1v-8.25c0-1.24-.8-2.05-2.05-2.05zm-49.6 8.25c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1s2.05.86 2.05 2.1-.8 2.05-2.05 2.05zm6.2 0c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1s2.05.86 2.05 2.1-.8 2.05-2.05 2.05zm6.2 0c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1s2.05.86 2.05 2.1-.8 2.05-2.05 2.05zm6.2 0c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1s2.05.86 2.05 2.1-.8 2.05-2.05 2.05zm18.6 0c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1s2.05.86 2.05 2.1-.8 2.05-2.05 2.05zm10.3 0h-4.1c-1.24 0-2.1-.8-2.1-2.05 0-1.24.86-2.1 2.1-2.1h4.1c1.24 0 2.1.86 2.1 2.1s-.87 2.05-2.1 2.05z" fill="#512fc9"/><path d="m-537.78 3414.65a6 6 0 0 1 6-6h228a6 6 0 0 1 6 6v19.33a6 6 0 0 1 -6 6h-228a6 6 0 0 1 -6-6z" fill="#fff"/><g transform="translate(-529.997632 3431.192994)"><use transform="scale(.00888889)" xlink:href="#ao"/><use transform="matrix(.00888889 0 0 .00888889 7.822222 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 17.493333 0)" xlink:href="#t"/><path d="m694 0h-282l-402-1037h258c43-1 77 23 86 54 69 227 146 446 203 684 58-239 142-456 211-684 10-29 42-55 82-54h246" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 24.835556 0)"/><use transform="matrix(.00888889 0 0 .00888889 34.311111 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 43.982222 0)" xlink:href="#t"/><use transform="matrix(.00888889 0 0 .00888889 50.08 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 54.275556 0)" xlink:href="#s"/><path d="m368-536-334-501h298c45 0 59 9 76 37l185 307c49-107 112-201 167-302 15-27 31-42 68-42h284l-334 487 348 550h-298c-46 1-70-26-86-54l-185-318c-6 22-16 42-27 60l-152 258c-16 26-40 55-82 54h-276" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 63.413333 0)"/><use transform="matrix(.00888889 0 0 .00888889 73.6 0)" xlink:href="#i"/><use transform="matrix(.00888889 0 0 .00888889 83.182222 0)" xlink:href="#o"/><use transform="matrix(.00888889 0 0 .00888889 98.488889 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 108.764444 0)" xlink:href="#u"/><use transform="matrix(.00888889 0 0 .00888889 113.831111 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 123.502222 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 127.697778 0)" xlink:href="#r"/><use transform="matrix(.00888889 0 0 .00888889 134.808889 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 144.48 0)" xlink:href="#u"/><use transform="matrix(.00888889 0 0 .00888889 149.546667 0)" xlink:href="#s"/><use transform="matrix(.00888889 0 0 .00888889 159.217778 0)" xlink:href="#j"/><use transform="matrix(.00888889 0 0 .00888889 169.493333 0)" xlink:href="#n"/><use transform="matrix(.00888889 0 0 .00888889 179.804444 0)" xlink:href="#t"/><use transform="matrix(.00888889 0 0 .00888889 187.146667 0)" xlink:href="#r"/><use transform="matrix(.00888889 0 0 .00888889 194.257778 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 198.453333 0)" xlink:href="#ao"/><path d="m612-820c-81 1-134 39-182 81v739h-310v-1497h310v551c73-60 149-110 278-107 236 5 352 157 352 394v659h-310v-659c0-96-44-162-138-161" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 206.275556 0)"/><use transform="matrix(.00888889 0 0 .00888889 216.586667 0)" xlink:href="#v"/></g><path d="m-479.8 3445.97a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.34a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-458.178912 3462.518252)"><use transform="scale(.00888889)" xlink:href="#w"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 30.933333 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 35.128889 0)" xlink:href="#y"/><use transform="matrix(.00888889 0 0 .00888889 45.44 0)" xlink:href="#z"/><use transform="matrix(.00888889 0 0 .00888889 55.751111 0)" xlink:href="#l"/><use transform="matrix(.00888889 0 0 .00888889 59.946667 0)" xlink:href="#x"/><use transform="matrix(.00888889 0 0 .00888889 70.257778 0)" xlink:href="#l"/><path d="m114-1041c45-269 211-432 516-432 212 0 355 88 422 233 21 45 30 94 30 145 2 183-80 277-216 323 161 56 242 166 242 329 0 307-208 452-512 459-308 7-443-159-522-390 80-24 165-97 266-58 18 7 29 21 38 37 53 91 95 158 214 158 155 0 236-120 200-281-25-110-146-118-296-120v-214c165-2 284-26 284-189 0-138-100-208-232-169-58 17-99 60-118 117-22 66-66 96-152 81" fill="#f50057" transform="matrix(.00888889 0 0 .00888889 74.453333 0)"/></g><path d="m-552 3457.64h23.4m23.4 0h23.4" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-567 3457.64 13-7.5v15z" fill="#f50057" stroke="#f50057" stroke-width="4"/><path d="m-479.8 3459.6h-2.05v-3.94h2.05z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m-349.8 3457.64h28.83m28.84 0h28.82" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-349.75 3459.6h-2.05v-3.94h2.06z" fill="#f50057" stroke="#f50057" stroke-width=".05"/><path d="m-263.36 3457.64h2.06" fill="none" stroke="#f50057" stroke-width="4"/><path d="m-479.8 3501.1a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v19.33a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><g transform="translate(-458.178912 3517.64324)"><path d="m252-224h280c2-282-4-570 3-848l-165 137c-34 38-114 22-140-12l-98-130 454-381h256v1234h240v224h-830z" fill="#fc9432" transform="scale(.00888889)"/><use transform="matrix(.00888889 0 0 .00888889 10.311111 0)" xlink:href="#ap"/><use transform="matrix(.00888889 0 0 .00888889 20.622222 0)" xlink:href="#ap"/><use transform="matrix(.00888889 0 0 .00888889 30.933333 0)" xlink:href="#aq"/><path d="m532-896c89-35 216-36 312-1 162 59 274 190 274 411 0 240-136 387-313 462-125 53-311 53-436 2-184-74-303-232-303-484 0-186 74-313 166-437l328-443c29-40 94-71 166-71h276c-157 187-313 374-470 561zm46 197c-139 0-214 93-214 235 0 148 69 235 218 235 140 0 226-93 226-234 0-150-82-236-230-236" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 35.128889 0)"/><path d="m1126-566c-12 87 37 230-60 231h-90v335h-270v-335h-586c-39 1-76-30-82-63l-32-153 674-906h296v891zm-420 0c3-181-8-372 10-539l-385 539z" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 45.44 0)"/><use transform="matrix(.00888889 0 0 .00888889 55.751111 0)" xlink:href="#aq"/><use transform="matrix(.00888889 0 0 .00888889 59.946667 0)" xlink:href="#ap"/><use transform="matrix(.00888889 0 0 .00888889 70.257778 0)" xlink:href="#aq"/><path d="m114-1041c45-269 211-432 516-432 212 0 355 88 422 233 21 45 30 94 30 145 2 183-80 277-216 323 161 56 242 166 242 329 0 307-208 452-512 459-308 7-443-159-522-390 80-24 165-97 266-58 18 7 29 21 38 37 53 91 95 158 214 158 155 0 236-120 200-281-25-110-146-118-296-120v-214c165-2 284-26 284-189 0-138-100-208-232-169-58 17-99 60-118 117-22 66-66 96-152 81" fill="#fc9432" transform="matrix(.00888889 0 0 .00888889 74.453333 0)"/></g><path d="m-569 3512.76h14.53m14.54 0h29.06m14.54 0h14.53m-87.15 0h-2.05" fill="none" stroke="#fc9432" stroke-width="4"/><path d="m-479.8 3514.74h-2.05v-3.95h2.05z" fill="#fc9432" stroke="#fc9432" stroke-width=".05"/><path d="m-349.8 3512.76h22.45m22.44 0h22.43" fill="none" stroke="#fc9432" stroke-width="4"/><path d="m-349.75 3514.74h-2.05v-3.95h2.06z" fill="#fc9432" stroke="#fc9432" stroke-width=".05"/><path d="m-267.48 3512.76-13 7.5v-15z" fill="#fc9432" stroke="#fc9432" stroke-width="4"/><path d="m-537.78 3174.36h220.2v25.64h-220.2z" fill="none"/><g transform="translate(-481.835774 3195.877613)"><use transform="scale(.00837)" xlink:href="#U"/><path d="m519-204c146 0 246-70 241-211-6-175-195-185-333-232-183-63-339-153-333-400 5-199 120-319 272-380 126-51 311-44 437 5 72 27 133 64 184 112l-66 127c-15 40-64 51-105 25-64-41-136-87-246-85-132 3-224 54-224 182 0 167 202 176 334 227 173 67 333 144 333 381 0 227-120 364-289 433-138 56-353 39-478-16-80-35-154-80-210-138l78-129c23-34 74-43 115-13 73 54 157 112 290 112" fill="#512fc9" transform="matrix(.00837 0 0 .00837 12.18672 0)"/><use transform="matrix(.00837 0 0 .00837 21.16773 0)" xlink:href="#Y"/><use transform="matrix(.00837 0 0 .00837 30.75138 0)" xlink:href="#ac"/></g><g transform="translate(-436.888874 3195.877613)"><use transform="scale(.00837)" xlink:href="#V"/><use transform="matrix(.00837 0 0 .00837 8.65458 0)" xlink:href="#ar"/><use transform="matrix(.00837 0 0 .00837 20.53998 0)" xlink:href="#T"/><use transform="matrix(.00837 0 0 .00837 31.00248 0)" xlink:href="#Z"/><use transform="matrix(.00837 0 0 .00837 40.30992 0)" xlink:href="#ab"/><use transform="matrix(.00837 0 0 .00837 53.69355 0)" xlink:href="#T"/></g><path d="m329.25 3174.36h220.2v25.64h-220.2z" fill="none"/><g transform="translate(361.577384 3195.877613)"><use transform="scale(.00837)" xlink:href="#T"/><use transform="matrix(.00837 0 0 .00837 10.4625 0)" xlink:href="#ac"/><use transform="matrix(.00837 0 0 .00837 21.4272 0)" xlink:href="#W"/><path d="m4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217l-584 1446h-243" fill="#512fc9" transform="matrix(.00837 0 0 .00837 26.68356 0)"/><use transform="matrix(.00837 0 0 .00837 37.15443 0)" xlink:href="#ar"/><use transform="matrix(.00837 0 0 .00837 47.80944 0)" xlink:href="#Z"/><use transform="matrix(.00837 0 0 .00837 57.76974 0)" xlink:href="#Y"/></g><g transform="translate(432.161594 3195.877613)"><use transform="scale(.00837)" xlink:href="#X"/><use transform="matrix(.00837 0 0 .00837 12.65544 0)" xlink:href="#Y"/><use transform="matrix(.00837 0 0 .00837 22.23909 0)" xlink:href="#Z"/><use transform="matrix(.00837 0 0 .00837 32.19939 0)" xlink:href="#aa"/><use transform="matrix(.00837 0 0 .00837 49.7178 0)" xlink:href="#ab"/><use transform="matrix(.00837 0 0 .00837 63.10143 0)" xlink:href="#ac"/><use transform="matrix(.00837 0 0 .00837 74.06613 0)" xlink:href="#ad"/></g><g filter="url(#as)"><path d="m-260 3228.7a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v299.58a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="#fff" stroke="#00bfa5" stroke-width="2"/></g><path d="m-261.3 3391.63a6 6 0 0 1 6-6h116a6 6 0 0 1 6 6v15.77a6 6 0 0 1 -6 6h-116a6 6 0 0 1 -6-6z" fill="none"/><path d="m4-1446h217c48-1 77 26 90 61 125 326 256 646 373 977 12 34 20 70 29 108 15-77 34-144 57-203l339-882c12-30 45-61 89-61h217l-584 1446h-243" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 -218.527099 3406.507284)"/><path d="m377-1009c4 38 6 82 6 121v888h-237v-1446c71 6 174-24 211 20 269 320 519 661 779 990-5-42-7-87-7-131v-879h237v1446c-64-4-144 10-192-10-14-6-28-19-41-36" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 -205.904877 3406.507284)"/><path d="m991-153c-92 106-231 168-423 168-331 0-505-212-505-550 0-237 116-392 287-467 61-27 129-40 206-40 287 0 444 174 444 465 0 54-3 95-57 95h-634c4 226 158 349 385 292 52-13 93-39 132-62 32-19 73-16 93 9zm-213-478c-4-143-73-234-217-234-154 0-226 95-247 234z" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 -192.464877 3406.507284)"/><path d="m738-75c-64 55-158 90-269 91-176 2-277-109-277-284v-573c-65-4-153 21-153-52v-98l165-27 52-280c10-66 115-35 183-42v323h270v176h-270v556c-1 59 32 101 88 102 48 1 68-25 104-34 19 1 25 9 33 22" fill="#00bfa5" transform="matrix(.00888889 0 0 .00888889 -182.962655 3406.507284)"/><path d="m-203.7 3359.1c.36 0 .7-.05 1.07-.1l1.33 3.1c-1.45 1.15-2.4 2.95-2.4 5 0 1.03.24 2.03.7 2.9l-5.12 4.57c-1.04-.68-2.25-1.08-3.58-1.08-3.53 0-6.4 2.87-6.4 6.4 0 3.5 2.87 6.4 6.4 6.4 3.54 0 6.4-2.9 6.4-6.4 0-1.05-.24-2.05-.7-2.93l5.12-4.56c1.04.7 2.24 1.1 3.57 1.1 1.45 0 2.82-.5 3.9-1.33l4.62 3.56c-.33.8-.54 1.64-.54 2.56 0 3.5 2.87 6.4 6.4 6.4 3.54 0 6.4-2.9 6.4-6.4.02-3.53-2.85-6.4-6.4-6.4-1.45 0-2.82.47-3.9 1.3l-4.62-3.55c.33-.8.54-1.64.54-2.56 0-.17 0-.3-.04-.45l2.66-.88c1.13 1.76 3.12 2.92 5.37 2.92 3.53 0 6.4-2.9 6.4-6.4 0-3.53-2.88-6.4-6.4-6.4-3.55 0-6.42 2.87-6.42 6.4 0 .15 0 .27.04.43l-2.66.88c-1.12-1.75-3.12-2.9-5.37-2.9-.38 0-.7.03-1.04.07l-1.38-3.08c1.46-1.17 2.4-2.97 2.4-5 0-3.53-2.86-6.4-6.4-6.4-3.53 0-6.4 2.87-6.4 6.4 0 3.5 2.87 6.4 6.4 6.4zm0-9.6c-1.76 0-3.2 1.43-3.2 3.2 0 1.75 1.44 3.2 3.2 3.2.45 0 .86-.1 1.24-.25l.04-.04h.04c1.12-.5 1.87-1.63 1.87-2.9 0-1.77-1.42-3.2-3.2-3.2zm17.6 28.8c0-.73.23-1.4.65-1.93v-.04c.04 0 .04-.04.04-.04.58-.73 1.5-1.2 2.5-1.2 1.78 0 3.2 1.43 3.2 3.2 0 1.75-1.42 3.2-3.2 3.2-1.76 0-3.2-1.45-3.2-3.2zm.15-14.97v-.09c-.12-.28-.16-.64-.16-.96 0-1.77 1.44-3.2 3.2-3.2 1.78 0 3.2 1.43 3.2 3.2 0 1.75-1.42 3.2-3.2 3.2-1.38 0-2.6-.9-3.05-2.17zm-12.7.84c-1.1.52-1.86 1.64-1.86 2.92 0 .8.28 1.5.78 2.07v.04l.04.05c.6.64 1.42 1.04 2.38 1.04 1 0 1.9-.5 2.5-1.2 0 0 0-.05.03-.05 0 0 0-.04.04-.04.38-.5.63-1.2.63-1.9 0-.37-.04-.7-.17-1v-.05c-.4-1.24-1.62-2.16-3.03-2.16-.46 0-.88.07-1.25.27h-.08zm-16.25 15.72c0-1.77 1.4-3.2 3.2-3.2 1.75 0 3.2 1.43 3.2 3.2 0 1.75-1.45 3.2-3.2 3.2-1.8 0-3.2-1.45-3.2-3.2z" fill="#00bfa5"/></g></svg>
\ No newline at end of file
diff --git a/docs/img/vnet/ssh-connect.png b/docs/img/vnet/ssh-connect.png
new file mode 100644
index 0000000000000..2baeee20e737f
Binary files /dev/null and b/docs/img/vnet/ssh-connect.png differ
diff --git a/docs/img/vnet/start-vnet.png b/docs/img/vnet/start-vnet.png
new file mode 100644
index 0000000000000..81d03e073624b
Binary files /dev/null and b/docs/img/vnet/start-vnet.png differ
diff --git a/docs/img/vscode/add-host.png b/docs/img/vscode/add-host.png
index ccb4fec84f72a..f11c81e59ab91 100644
Binary files a/docs/img/vscode/add-host.png and b/docs/img/vscode/add-host.png differ
diff --git a/docs/img/vscode/connected-editor.png b/docs/img/vscode/connected-editor.png
index 612022d52a198..9768efbc55d01 100644
Binary files a/docs/img/vscode/connected-editor.png and b/docs/img/vscode/connected-editor.png differ
diff --git a/docs/img/vscode/host-added-notification.png b/docs/img/vscode/host-added-notification.png
index 205f7b3521c82..42f5e1564b378 100644
Binary files a/docs/img/vscode/host-added-notification.png and b/docs/img/vscode/host-added-notification.png differ
diff --git a/docs/img/vscode/select-host-to-connect.png b/docs/img/vscode/select-host-to-connect.png
index 20d51869ef4c0..e30a08b2e2011 100644
Binary files a/docs/img/vscode/select-host-to-connect.png and b/docs/img/vscode/select-host-to-connect.png differ
diff --git a/docs/img/vscode/settings.png b/docs/img/vscode/settings.png
index b62225d710ce1..acf8dbd76cca3 100644
Binary files a/docs/img/vscode/settings.png and b/docs/img/vscode/settings.png differ
diff --git a/docs/img/vscode/window-indicator.png b/docs/img/vscode/window-indicator.png
index c93df22bea123..083f27bc6a45d 100644
Binary files a/docs/img/vscode/window-indicator.png and b/docs/img/vscode/window-indicator.png differ
diff --git a/docs/img/webui-active-session.png b/docs/img/webui-active-session.png
index 223232f949478..9f3c0edd9f754 100644
Binary files a/docs/img/webui-active-session.png and b/docs/img/webui-active-session.png differ
diff --git a/docs/img/webui_billing_cycle.png b/docs/img/webui_billing_cycle.png
index bfa7b31704107..701a18dacc058 100644
Binary files a/docs/img/webui_billing_cycle.png and b/docs/img/webui_billing_cycle.png differ
diff --git a/docs/pages/admin-guides/access-controls/access-controls.mdx b/docs/pages/admin-guides/access-controls/access-controls.mdx
deleted file mode 100644
index 2c4efb89c57a9..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-controls.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Access Controls
-description: How to provide role-based access control (RBAC) for servers, databases, Kubernetes clusters, and other resources in your infrastructure
-layout: tocless-doc
----
-
-Teleport's role-based access control (RBAC) enables you to set fine-grained
-policies for who can perform certain actions against specific resources. For
-example, you can allow analytics team members to SSH into a MongoDB read
-replica, but not the main database. You can also allow SREs to access a
-production server only when using a [trusted hardware
-device](./device-trust/guide.mdx), or if approved by someone else from the same
-team.
-
-<DocCardList />
-
diff --git a/docs/pages/admin-guides/access-controls/access-lists/access-lists.mdx b/docs/pages/admin-guides/access-controls/access-lists/access-lists.mdx
deleted file mode 100644
index 7e8706407b256..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-lists/access-lists.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Access Lists
-description: Use Access Lists in Teleport
-layout: tocless-doc
----
-
-Access Lists allow Teleport users to be granted long term access to resources
-managed within Teleport. With Access Lists, administrators and Access List
-owners can regularly audit and control membership to specific roles and
-traits, which then tie easily back into Teleport's existing RBAC system.
-
-[Getting Started with Access Lists](guide.mdx)
-
-[Nested Access Lists](nested-access-lists.mdx)
-
-[Access List Reference](../../../reference/access-controls/access-lists.mdx)
diff --git a/docs/pages/admin-guides/access-controls/access-lists/guide.mdx b/docs/pages/admin-guides/access-controls/access-lists/guide.mdx
deleted file mode 100644
index 9b2f9811da28c..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-lists/guide.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: Getting Started with Access Lists
-description: Learn how to use Access Lists to manage and audit long lived access to Teleport resources.
----
-
-This guide will help you:
-- Create an Access List
-- Assign a member to it
-- Verify permissions granted through the list membership
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A user with the preset `editor` role, which will have permissions to create Access Lists.
-
-## Step 1/4. Setting up the Application Service on the cluster for testing
-
-One of the easiest ways to get resources on the cluster for testing is to set up a Teleport Application Service
-instance with the debugging application enabled. To do this, add the following config to your `teleport.yaml`
-configuration:
-
-```yaml
-app_service:
-  enabled: true
-  debug_app: true
-```
-
-And restart Teleport. The "dumper" app should show up in the resource list.
-
-![Debug app](../../../../img/access-controls/access-lists/debug-app.png)
-
-## Step 2/4. Create a test user
-
-We need to create a simple test user that has only the `requester` role, which has no default access
-to anything within a cluster. This user will only be used for the purposes of this guide, so you may use
-another user if you so choose. If you would rather use your own user, skip to the next step.
-
-Navigate to the management pane and select "Users." Click on "Create New User" and fill in `test-user` as
-the name and select `requester` as the role.
-
-![Create Test User](../../../../img/access-controls/access-lists/create-test-user.png)
-
-Click "Save," and then navigate to the provided URL in order to set up the credentials for your test user.
-Try logging into the cluster with the test user to verify that no resources show up in the resources page.
-
-## Step 3/4. Create an Access List
-
-Next, we'll create a simple Access List that will grant the `access` role to its members.
-Login as the administrative user mentioned in the prerequisites. Click on "Add New" in the left pane, and then "Create an Access List."
-
-![Navigate to create new Access List](../../../../img/access-controls/access-lists/create-new-access-list.png)
-
-Here, fill in a title, description, and grant the `access` role. Select a date in the future for the next
-review date.
-
-![Fill out Access List Fields](../../../../img/access-controls/access-lists/fill-out-access-list-fields.png)
-
-Under "List Owners" select `editor` as a required role, then add your administrative user under "Add
-Eligible List Owners." By selecting `editor` as a required role, this will ensure that any owner of the list
-must have the `editor` role in order to actually manage the list. If the user loses this role later, they will
-not be able to manage the list, though they will still be reflected as an owner.
-
-![Select an owner](../../../../img/access-controls/access-lists/select-owner.png)
-
-Under "Members" select `requester` as a required role, then add your test user to the Access List. Similar to
-the owner requirements, this will ensure that any member of the list must have the `requester` role in order to
-be granted the access described in this list. If the user loses this role later, they will not be granted the
-roles or traits described in the Access List.
-
-![Add a member](../../../../img/access-controls/access-lists/add-member.png)
-
-Finally, click "Create Access List" at the bottom of the page.
-
-## Step 4/4. Login as the test user
-
-Again, login as the test user. When logging in now, you should now see the dumper application contained within
-the cluster, and should be able to interact with it as expected.
-
-## Next Steps
-
-- Familiarize yourself with the CLI tooling available for managing Access Lists in the [reference](../../../reference/access-controls/access-lists.mdx).
-- Learn how to work with nested Access Lists in the [nested Access Lists guide](./nested-access-lists.mdx).
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx
deleted file mode 100644
index 8dc6813f74e5a..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-title: Just-in-Time Access Request Plugins
-description: "Use Teleport's Access Request plugins to least-privilege access without sacrificing productivity."
-layout: tocless-doc
----
-
-Teleport Just-in-Time Access Requests allow users to receive temporary elevated
-privileges by seeking consent from one or more reviewers, depending on your
-configuration.
-
-With Teleport's Access Request plugins, users can manage Access Requests from
-within your organization's existing messaging and project management solutions.
-
-Access Request plugins are self-contained programs that connect to the Teleport
-Auth Service's gRPC API to listen for audit events relating to new or updated
-Access Requests. After processing an Access Request event, Access Request plugins
-interact with a third-party API (e.g., the Slack or PagerDuty APIs). 
-
-## Enrolling Access Request plugins in Teleport Cloud
-
-(!docs/pages/includes/plugins/enroll.mdx name="Access Request plugins"!)
-
-The following Access Request plugins are hosted on Teleport Cloud:
-
-- Discord
-- Jira
-- Mattermost
-- Opsgenie
-- PagerDuty
-- ServiceNow
-- Slack
-- Datadog
-
-## Self-hosting Access Request plugins
-
-You can host Teleport Access Request plugins yourself. Self-hosted Access
-Request plugins are the only way to manage Access Requests through a third-party
-communication platform if you are self-hosting Teleport. If you use Teleport
-Team or Teleport Enterprise Cloud, you can run self-hosted Access Request
-plugins for more control over configuration and architecture.
-
-Access Request plugins can run within private networks that are isolated from
-the Teleport Auth Service. To access the Auth Service API, they connect to the
-Proxy Service, which establishes a reverse tunnel for the plugin to access the
-Auth Service.
-
-You can run multiple instances of an Access Request plugin for high availability
-by deploying each instance in a separate availability zone. There is no need for
-additional configuration or load balancing, as plugins avoid creating duplicate
-requests to their third-party APIs.
-
-Learn how to deploy and configure a plugin for your organization's communication
-workflows by reading our setup guides:
-
-(!docs/pages/includes/access-request-integrations.mdx!)
-
-To read more about the architecture of an Access Request plugin, and start
-writing your own, read our [Access Request plugin development
-guide](../../api/access-plugin.mdx).
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx
deleted file mode 100644
index f4cd7ac743bbe..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx
+++ /dev/null
@@ -1,378 +0,0 @@
----
-title: Run the Discord Access Request Plugin
-description: How to set up Teleport's Discord plugin for privilege elevation approvals.
----
-
-import BotLogo from "/static/avatar_logo.png";
-
-This guide will explain how to set up Discord to receive Access Request messages
-from Teleport. Teleport's Discord integration notifies individuals and channels of
-Access Requests. Users can then approve and deny Access Requests from within
-Discord, making it easier to implement security best practices without
-compromising productivity.
-
-![The Discord Access Request plugin](../../../../img/enterprise/plugins/discord.png)
-
-<details>
-<summary>This integration is hosted on Teleport Cloud</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Discord integration"!)
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- Admin account on your Discord server. Installing a bot requires at least the
-  "manager server" permission.
-- Either a Linux host or Kubernetes cluster where you will run the Discord plugin.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/8. Define RBAC resources
-
-Before you set up the Discord plugin, you will need to enable Role Access Requests
-in your Teleport cluster.
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 2/8. Install the Teleport Discord plugin
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="discord"!)
-
-## Step 3/8. Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-## Step 4/8. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-discord-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-discord-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/8. Register a Discord app
-
-The Access Request plugin for Discord receives Access Request events from the
-Teleport Auth Service, formats them into Discord messages, and sends them to the
-Discord API to post them in your guild (Discord server). For this to work,
-you must register a new app with the Discord API.
-
-### Create your application
-
-Visit [https://discord.com/developers/applications](https://discord.com/developers/applications)
-to create a new Discord application. Click "New Application" and name the application "Teleport".
-
-Set the application icon ([download application icon here](../../../../img/sso/onelogin/teleport.png)).
-
-### Create the application bot
-
-Go to the "Bot" tab and choose "Add Bot". You can <a href={BotLogo}
-download>download</a> our avatar to set as your Bot icon. Un-check the "Public
-Bot" toggle as this bot should only be used within your Discord servers.
-Finally, press "Reset Token", copy and save the new token into a safe place.
-This token will be used by the Teleport plugin to authenticate against the
-Discord API.
-
-### Install and authorize the application in your Discord server
-
-Go to the "OAuth2" tab, open the "URL Generator" and check the "bot" and "Send Messages" permissions.
-
-![Set Discord permissions](../../../../img/enterprise/plugins/discord/discord-permissions.png)
-
-Copy and access the generated URL. Choose to install the application into the
-desired Discord server. If the server is not available in the
-dropdown list, it means you don't have sufficient rights. Ask a server
-administrator to grant you a role with the "manage server" permission.
-
-<Admonition type="note">
-The same application can be installed into multiple Discord servers. To
-do so, access the OAuth URL multiple times and choose different servers. You
-have to be admin on a Discord server to install the app into it.
-</Admonition>
-
-## Step 6/8. Configure the Teleport Discord plugin
-
-At this point, the Teleport Discord plugin has the credentials it needs to
-communicate with your Teleport cluster and the Discord API. In this step, you will
-configure the Discord plugin to use these credentials. You will also configure the
-plugin to notify the right Discord channels when it receives an Access Request
-update.
-
-### Create a config file
-
-<Tabs>
-<TabItem label="Executable or Docker">
-The Teleport Discord plugin uses a config file in TOML format. Generate a
-boilerplate config by running the following command (the plugin will not run
-unless the config file is in `/etc/teleport-discord.toml`):
-
-```code
-$ teleport-discord configure | sudo tee /etc/teleport-discord.toml > /dev/null
-```
-
-This should result in a config file like the one below:
-
-```toml
-(!examples/resources/plugins/teleport-discord.toml!)
-```
-</TabItem>
-<TabItem label="Helm Chart">
-The Discord Helm chart uses a YAML values file to configure the plugin.
-On your local workstation, create a file called `teleport-discord-helm.yaml`
-based on the following example:
-
-```toml
-(!examples/resources/plugins/teleport-discord-helm.yaml!)
-```
-
-</TabItem>
-</Tabs>
-
-### Edit the config file
-
-Open the configuration file created for the Teleport Discord plugin and update the following fields:
-
-**`[teleport]`**
-
-The Discord plugin uses this section to connect to the Teleport Auth Service.
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-**`[discord]`**
-
-`token`: Paste the bot token saved previously in this field.
-
-**`[role_to_recipients]`**
-
-The `role_to_recipients` map configures the channels that the Discord plugin will
-notify when a user requests access to a specific role. When the Discord plugin
-receives an Access Request from the Auth Service, it will look up the role being
-requested and identify the Discord channels to notify.
-
-Each channel is represented by a numeric ID. Channels can be public, private or
-direct messages between a user and the bot.
-To determine the numeric ID of a channel for the bot to notify, follow the instructions below:
-
-<Tabs>
-  <TabItem label="Public Channel">
-  
-    Open Discord in a web browser and navigate to the desired channel.
-    
-    The web browser URL should look like:
-    ```
-    https://discord.com/channels/<guild ID>/<channel ID>
-    ```
-    
-    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
-  </TabItem>
-  <TabItem label="Private Channel">
-    Open Discord in a web browser and navigate to the desired channel.
-    
-    In the channel list choose "Create invite", type "teleport" in the search field
-    and invite your Discord Teleport bot. The bot should now appear in the channel
-    member list.
-    
-    The web browser URL should look like:
-    ```
-    https://discord.com/channels/<guild ID>/<channel ID>
-    ```
-    
-    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
-  </TabItem>
-  <TabItem label="Direct Message">
-    To retrieve the channel ID of the private discussion between User A and the
-    Teleport bot, have User A send a direct message to the Teleport bot. This will
-    open a conversation between the user and the bot. Once the conversation is
-    initiated, the user can open the discussion page.
-    
-    The web browser URL should look like:
-    ```
-    https://discord.com/channels/@me/<channel ID>
-    ```
-    
-    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
-  </TabItem>
-</Tabs>
-
-In the `role_to_recipients` map, each key is the name of a Teleport role. Each
-value configures the Discord channel (or channels) to notify.
-
-The `role_to_recipients` map must also include an entry for `"*"`, which the
-plugin looks up if no other entry matches a given role name. In the example
-above, requests for roles aside from `dev` will notify the
-`security-team` channel.
-
-Configure the Discord plugin to notify you when a user requests the `editor` role
-by adding the following to your `role_to_recipients` config (replace
-`YOUR-CHANNEL-ID` with a valid channel ID):
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-Here is an example of a `role_to_recipients` map. Each value can be a single
-string or an array of strings:
-
-```toml
-[role_to_recipients]
-"*" = "YOUR-CHANNEL-ID"
-"editor" = "YOUR-CHANNEL-ID"
-```
-</TabItem>
-<TabItem label="Helm Chart">
-
-In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
-and uses the following format, where keys are strings and values are arrays of
-strings:
-
-```yaml
-roleToRecipients:
-  "*": ["YOUR-CHANNEL-ID"]
-  "editor": ["YOUR-CHANNEL-ID"]
-```
-</TabItem>
-</Tabs>
-
-The final configuration file should resemble the following:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-```toml
-(!examples/resources/plugins/teleport-discord.toml!)
-```
-</TabItem>
-<TabItem label="Helm Chart">
-```yaml
-(!examples/resources/plugins/teleport-discord-helm.yaml!)
-```
-</TabItem>
-</Tabs>
-
-## Step 7/8. Test your Discord app
-
-Once Teleport is running, you've created the Discord app, and the plugin is
-configured, you can now run the plugin and test the workflow.
-
-<Tabs>
-<TabItem label="Executable">
-Start the plugin:
-
-```code
-$ teleport-discord start
-```
-
-If everything works fine, the log output should look like this:
-
-```code
-$ teleport-discord start
-INFO   Starting Teleport Access Discord Plugin (=teleport.version=): discord/app.go:80
-INFO   Plugin is ready discord/app.go:101
-```
-</TabItem>
-<TabItem label="Docker">
-Start the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-discord.toml public.ecr.aws/gravitational/teleport-plugin-discord:(=teleport.version=) start
-```
-</TabItem>
-<TabItem label="Helm Chart">
-Install the plugin:
-
-```code
-$ helm upgrade --install teleport-plugin-discord teleport/teleport-plugin-discord --values teleport-discord-helm.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-discord
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-discord-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-discord
-```
-</TabItem>
-</Tabs>
-
-Create an Access Request and check if the plugin works as expected with the
-following steps.
-
-### Create an Access Request
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-The channel you configured earlier to review the request should receive a
-message from "Teleport" in Discord allowing them to visit a link in the Teleport
-Web UI and either approve or deny the request.
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-Once the request is resolved, the Discord bot will update the Access Request
-message with ✅ or ❌, depending on whether the request was approved or denied.
-
-<Admonition title="Auditing Access Requests">
-
-When the Discord plugin posts an Access Request notification to a channel, anyone
-with access to the channel can view the notification and follow the link. While
-users must be authorized via their Teleport roles to review Access Requests, you
-should still check the Teleport audit log to ensure that the right users are
-reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-## Step 8/8. Set up systemd
-
-This section is only relevant if you are running the Teleport Discord plugin on a
-Linux host.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd.  Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!examples/systemd/plugins/teleport-discord.service!)
-```
-
-Save this as `teleport-discord.service` in either `/usr/lib/systemd/system/` or
-another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-discord
-$ sudo systemctl start teleport-discord
-```
-
-## Next steps
-
-- Read our guides to configuring [Resource Access
-    Requests](../access-requests/resource-requests.mdx) and [Role Access
-    Requests](../access-requests/role-requests.mdx) so you can get the most out
-    of your Access Request plugins.
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx
deleted file mode 100644
index 8c0aebcba19b1..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx
+++ /dev/null
@@ -1,497 +0,0 @@
----
-title: Access Requests with Email
-description: How to set up the Teleport email plugin to notify users when another user requests elevated privileges.
----
-
-This guide will explain how to set up Teleport to send Just-in-Time Access
-Request notifications to users via email. Since all organizations use email for
-at least some of their communications, Teleport's email plugin makes it
-straightforward to integrate Access Requests into your existing workflows,
-letting you implement security best practices without compromising productivity.
-
-![The email Access Request plugin](../../../../img/enterprise/plugins/email.png)
-
-<details>
-<summary>This integration is hosted on Teleport Enterprise (Cloud)</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Email integration"!)
-
-![Enroll email plugin](../../../../img/enterprise/plugins/email/enroll-email.png)
-
-Configure and connect email integration by providing the following configuration
-values:
-
-**`Sender`**: Configures the sender address.
-
-**`Fallback Recipient`**: Configures the default recipient for Access Request
-notifications.
-
-**`Email Service`**: Selects the desired email service. Note: only `Mailgun` is
-supported for Teleport Enterprise (Cloud).
-
-![Configure Mailgun integration](../../../../img/enterprise/plugins/email/configure-mailgun.png)
-
-Complete Mailgun integration by providing the following Mailgun API
-configuration values:
-
-**`Domain`**: Configures the Mailgun sending domain.
-
-**`Mailgun Private Key`**: Configures the Mailgun API key.
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- Access to an SMTP service. The Teleport email plugin supports either Mailgun
-  or a generic SMTP service that authenticates via username and password.
-- Either a Linux host or Kubernetes cluster where you will run the email plugin.
-
-<Admonition type="warning" title="Protecting your email account">
-
-The Teleport plugin needs to use a username and password to authenticate to your
-SMTP service. To mitigate the risk of these credentials being leaked, you should
-set up a dedicated email account for the Teleport plugin and rotate the password
-regularly.
-
-</Admonition>
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/7. Define RBAC resources
-
-Before you set up the email plugin, enable Role Access Requests in your Teleport cluster.
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 2/7. Install the Teleport email plugin
-
-<details>
-<summary>Using a local SMTP server?</summary>
-
-If you are using a local SMTP server to test the plugin, you should install the
-plugin on your local machine to ensure the plugin can connect to the SMTP server 
-and perform any necessary DNS lookups to send email.
-
-Your Teleport cluster does *not* need to perform DNS lookups for your plugin
-because the plugin dials out to the Teleport Proxy Service or Teleport Auth Service. 
-
-</details>
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="email"!)
-
-## Step 3/7. Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-## Step 4/7. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-email-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-email-identity" !)
-</TabItem>
-</Tabs>
-
-## Step 5/7. Configure the plugin
-
-At this point, you have generated credentials that the email plugin will use to
-connect to Teleport. You will now configure the plugin to use these credentials
-to receive Access Request notifications from Teleport and email them to your
-chosen recipients.
-
-### Create a config file
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-The Teleport email plugin uses a configuration file in TOML format. Generate a
-boilerplate configuration by running the following command:
-
-```code
-$ teleport-email configure | sudo tee /etc/teleport-email.toml
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-The email plugin Helm Chart uses a YAML values file to configure the plugin.
-On your local workstation, create a file called `teleport-email-helm.yaml`
-based on the following example:
-
-```yaml
-(!examples/resources/plugins/teleport-email-helm.yaml!)
-```
-
-</TabItem>
-</Tabs>
-
-### Edit the configuration file
-
-Edit the configuration file for your environment. We will show you how to set
-each value below.
-
-### `[teleport]`
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-### `[mailgun]` or `[smtp]`
-
-Provide the credentials for your SMTP service depending on whether you are using
-Mailgun or SMTP service.
-
-<Tabs>
-<TabItem label="Mailgun">
-
-If you are deploying the email plugin on a Linux host:
-
-1. In the `mailgun` section, assign `domain` to the domain name and subdomain of
-   your Mailgun account. 
-1. Assign `mailgun.private_key` to your Mailgun private key.
-
-If you are deploying the email plugin on Kubernetes:
-
-1. Write your Mailgun private key to a local file called `mailgun-private-key`.
-1. Create a Kubernetes secret from the file:
-
-  ```code
-  $ kubectl -n teleport create secret generic mailgun-private-key --from-file=mailgun-private-key
-  ```
-
-1. Assign `mailgun.privateKeyFromSecret` to `mailgun-private-key`.
-
-</TabItem>
-<TabItem label="Generic SMTP Service">
-
-Assign `host` to the fully qualified domain name of your SMTP service, omitting
-the URL scheme and port. (If you're using a local SMTP server for testing, use
-`"localhost"` for `host`.) Assign `port` to the port of your SMTP service.
-
-If you are running the email plugin on a Linux host, fill in `username` and
-`password`.
-
-<Admonition type="tip">
-
-You can also save your password to a separate file and assign `password_file` to
-the file's path. The plugin reads the file and uses the file's content as the
-password.
-
-</Admonition>
-
-If you are deploying the email plugin on Kubernetes:
-
-1. Write your SMTP service's password a local file called `smtp-password.txt`.
-1. Create a Kubernetes secret from the file:
-
-  ```code
-  $ kubectl -n teleport create secret generic smtp-password --from-file=smtp-password
-  ```
-
-1. Assign `smtp.passwordFromSecret` to `smtp-password`.
-
-<details>
-<summary>Disabling TLS for testing</summary>
-
-If you are testing the email plugin against a trusted internal SMTP server where
-you would rather not use TLS—e.g., a local SMTP server on your development
-machine—you can assign the `starttls_policy` setting to `disabled` (always
-disable TLS) or `opportunistic` (disable TLS if the server does not advertise
-the `STARTTLS` extension). The default is to always enforce TLS, and you should
-leave this setting unassigned unless you know what you are doing and understand
-the risks.
-
-For Kubernetes deployments, `starttls_policy` is called `smtp.starttlsPolicy` in
-the Helm values file for the email plugin.
-
-</details>
-
-</TabItem>
-</Tabs>
-
-### `[delivery]`
-
-Assign `sender` to the email address from which you would like the Teleport
-plugin to send messages.
-
-### `[role_to_recipients]`
-
-The `role_to_recipients` map (`roleToRecipients` for Helm users) configures the
-recipients that the email plugin will notify when a user requests access to a
-specific role. When the plugin receives an Access Request from the Auth Service,
-it will look up the role being requested and identify the recipients to notify.
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-Here is an example of a `role_to_recipients` map. Each value can be a single
-string or an array of strings:
-
-```toml
-[role_to_recipients]
-"*" = ["security@example.com", "executive-team@example.com"]
-"dev" = "eng@example.com"
-"dba" = "mallory@example.com"
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
-and uses the following format, where keys are strings and values are arrays of
-strings:
-
-```yaml
-roleToRecipients:
-  "*": ["security@example.com", "executive-team@example.com"]
-  "dev": ["eng@example.com"]
-  "dba": ["mallory@example.com"]
-```
-
-</TabItem>
-</Tabs>
-
-In the `role_to_recipients` map, each key is the name of a Teleport role. Each
-value configures the recipients the plugin will email when it receives an Access
-Request for that role.  Each string must be an email address.
-
-The `role_to_recipients` map must also include an entry for `"*"`, which the
-plugin looks up if no other entry matches a given role name. In the example
-above, requests for roles aside from `dev` and `dba` will notify
-`security@example.com` and `executive-team@example.com`.
-
-<details>
-<summary>Suggested reviewers</summary>
-
-Users can suggest reviewers when they create an Access Request, e.g.,:
-
-```code
-$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
-```
-
-If an Access Request includes suggested reviewers, the email plugin will add
-these to the list of recipients to notify. If a suggested reviewer is an email
-address, the plugin will send a message to that recipient in addition to those
-configured in `role_to_recipients`.
-
-</details>
-
-Configure the email plugin to notify you when a user requests the `editor` role
-by adding the following to your `role_to_recipients` config, replacing
-`YOUR_EMAIL_ADDRESS` with the appropriate address: 
-
-<Tabs>
-<TabItem label="Executable or Docker" >
-```toml
-[role_to_recipients]
-"*" = "YOUR_EMAIL_ADDRESS"
-"editor" = "YOUR_EMAIL_ADDRESS"
-```
-</TabItem>
-<TabItem label="Helm Chart" >
-```yaml
-roleToRecipients:
-  "*": "YOUR_EMAIL_ADDRESS"
-  "editor": "YOUR_EMAIL_ADDRESS"
-```
-</TabItem>
-</Tabs>
-
-<details>
-<summary>Configuring recipients without role mapping</summary>
-
-If you do not plan to use role-to-recipient mapping, you can configure the
-Teleport email plugin to notify a static list of recipients for every Access
-Request event by using the `delivery.recipients` field:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-```toml
-[delivery]
-recipients = ["eng@exmaple.com", "dev@example.com"]
-```
-</TabItem>
-<TabItem label="Helm Chart">
-```yaml
-delivery:
-  recipients: ["eng@exmaple.com", "dev@example.com"]
-```
-</TabItem>
-</Tabs>
-
-If you use `delivery.recipients`, you must remove the `role_to_recipients`
-configuration section. Behind the scenes, `delivery.recipients` assigns the
-recipient list to a `role_to_recipients` mapping under the wildcard value `"*"`.
-
-</details>
-
-You configuration should resemble the following:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-```toml
-# /etc/teleport-email.toml
-[teleport]
-addr = "example.com:443"
-identity = "/var/lib/teleport/plugins/email/identity"
-refresh_identity = true
-
-[mailgun]
-domain = "sandbox123abc.mailgun.org" 
-private_key = "xoxb-fakekey62b0eac53565a38c8cc0316f6"
-
-# As an alternative, you can use SMTP server credentials:
-#
-# [smtp]
-# host = "smtp.gmail.com"
-# port = 587
-# username = "username@gmail.com"
-# password = ""
-# password_file = "/var/lib/teleport/plugins/email/smtp_password"
-# starttls_policy = "mandatory"
-
-[delivery]
-sender = "noreply@example.com" 
-
-[role_to_recipients]
-"*" = "eng@example.com"
-"editor" = ["admin@example.com", "execs@example.com"]
-
-[log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/email.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-```yaml
-# teleport-email-helm.yaml
-teleport:
-  address: "teleport.example.com:443"
-  identitySecretName: teleport-plugin-email-identity
-  identitySecretPath: identity
-
-mailgun:
-  domain: "sandbox123abc.mailgun.org" 
-  privateKeyFromSecret: "mailgun-private-key"
-
-# As an alternative, you can use SMTP server credentials:
-#
-# smtp:
-#   host: "smtp.gmail.com"
-#   port: 587
-#   username: "username@gmail.com"
-#   passwordFromSecret: "smtp-password"
-#   starttls_policy = "mandatory"
-
-delivery:
-  sender: "noreply@example.com" 
-
-roleToRecipients:
-  "*": "eng@example.com"
-  "editor": ["admin@example.com", "execs@example.com"]
-```
-
-</TabItem>
-</Tabs>
-
-## Step 6/7. Test the email plugin
-
-After finishing your configuration, you can now run the plugin and test your
-email-based Access Request flow:
-
-<Tabs>
-<TabItem label="Executable">
-
-```code
-$ teleport-email start
-```
-
-If everything works as expected, the log output should look like this:
-
-```code
-$ teleport-email start
-INFO   Starting Teleport Access Email Plugin (): email/app.go:80
-INFO   Plugin is ready email/app.go:101
-```
-</TabItem>
-<TabItem label="Docker">
-Start the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-email.toml public.ecr.aws/gravitational/teleport-plugin-email:(=teleport.version=) start
-```
-</TabItem>
-<TabItem label="Helm Chart">
-Install the plugin:
-
-```code
-$ helm upgrade --install teleport-plugin-email teleport/teleport-plugin-email --values teleport-email-helm.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-email
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-email-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-email
-```
-</TabItem>
-</Tabs>
-
-### Create an Access Request
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-The recipients you configured earlier should receive notifications of the
-request by email. 
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-## Step 7/7. Set up systemd
-
-This section is only relevant if you are running the Teleport email plugin on a
-Linux host.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd. Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!/examples/systemd/plugins/teleport-email.service!)
-```
-
-Save this as `teleport-email.service` in either `/usr/lib/systemd/system/` or
-another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-email
-$ sudo systemctl start teleport-email
-```
-
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx
deleted file mode 100644
index 16ada13273ffd..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx
+++ /dev/null
@@ -1,434 +0,0 @@
----
-title: Run the Jira Access Request Plugin
-description: How to set up the Teleport Jira plugin to notify users when another user requests elevated privileges.
----
-
-This guide explains how to set up the Teleport Access Request plugin for Jira.
-Teleport's Jira integration allows you to manage Access Requests as
-Jira issues.
-
-The Teleport Jira plugin synchronizes a Jira project board with the Access
-Requests processed by your Teleport cluster. When you change the status of an
-Access Request within Teleport, the plugin updates the board. And when you
-update the status of an Access Request on the board, the plugin notifies a Jira
-webhook run by the plugin, which modifies the Access Request in Teleport.
-
-<details>
-<summary>This integration is hosted on Teleport Cloud</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Mattermost integration"!)
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- A Jira account with permissions to create applications and webhooks.
-
-- A registered domain name for the Jira webhook. Jira notifies the webhook of
-  changes in your project board.
-
-- An environment where you will run the Jira plugin. This is either:
-
-  - A Linux virtual machine with ports `80` and `8081` open, plus a means of
-    accessing the host (e.g., OpenSSH with an SSH port exposed to your
-    workstation). 
-  - A Kubernetes cluster deployed via a cloud provider. This guide shows you how
-    to allow traffic to the Jira plugin via a `LoadBalancer` service, so your
-    environment must support services of this type.
-
-- A means of providing TLS credentials for the Jira webhook run by the plugin.
-  **TLS certificates must not be self signed.** For example, you can obtain TLS
-  credentials for the webhook with Let's Encrypt by using an [ACME
-  client](https://letsencrypt.org/docs/client-options/).
-
-  - If you run the plugin on a Linux server, you must provide TLS credentials to
-    a directory available to the plugin. 
-  - If you run the plugin on Kubernetes, you must write these credentials to a
-    secret that the plugin can read. This guide assumes that the name of the
-    secret is `teleport-plugin-jira-tls`.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/7. Define RBAC resources
-
-### Enable Role Access Requests
-
-Before you set up the Jira plugin, you need to enable Role Access Requests in
-your Teleport cluster.
-
-(!docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-### Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-update.mdx!)
-
-## Step 2/7. Install the Teleport Jira plugin
-
-Install the Teleport Jira plugin following the instructions below, which depend
-on whether you are deploying the plugin on a host (e.g., an EC2 instance) or a
-Kubernetes cluster.
-
-The Teleport Jira plugin must run on a host or Kubernetes cluster that can
-access both Jira and your Teleport Proxy Service (or Teleport Enterprise Cloud
-tenant).
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="jira"!)
-
-## Step 3/7. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-susceptible to exfiltration, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-slack-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-jira-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 4/7. Set up a Jira project
-
-In this section, you will create a Jira a project that the Teleport plugin can
-modify when a Teleport user creates or updates an Access Request. The plugin
-then uses the Jira webhook to monitor the state of the board and respond to any
-changes in the tickets it creates.
-
-### Create a project for managing Access Requests
-
-In Jira, find the top navigation bar and click **Projects** -> **Create
-project**. Select **Kanban** for the template, then **Use template**. Click
-**Select a company-managed project**.
-
-You'll see a screen where you can enter a name for your project. In this guide,
-we assume that your project is called "Teleport Access Requests", which
-receives the key `TAR` by default. 
-
-Make sure "Connect repositories, documents, and more" is unset, then click
-**Create project**.
-
-In the three-dots menu on the upper right of your new board, click **Board
-settings**, then click **Columns**. Edit the statuses in your board so it
-contains the following four:
-
-1. Pending
-1. Approved
-1. Denied
-1. Expired
-
-Create a column with the same name as each status. The result should be the
-following:
-
-![Jira board setup](../../../../img/enterprise/plugins/jira/board-setup.png)
-
-<Admonition type="warning">
-
-If your project board does not contain these (and only these) columns, each with
-a status of the same name, the Jira Access Request plugin will behave in
-unexpected ways. Remove all other columns and statuses.
-
-</Admonition>
-
-Click **Back to board** to review your changes.
-
-### Retrieve your Jira API token
-
-Obtain an API token that the Access Request plugin uses to make
-changes to your Jira project. Click the gear menu at the upper right of the
-screen, then click **Atlassian account settings**. Click **Security** >
-**Create and manage API tokens** > **Create API token**. 
-
-Choose any label and click **Copy**. Paste the API token into a convenient
-location (e.g., a password manager or local text document) so you can use it
-later in this guide when you configure the Jira plugin.
-
-### Set up a Jira webhook
-
-Now that you have generated an API key that the Teleport Jira plugin uses to
-manage your project, enable Jira to notify the Teleport Jira plugin when your
-project is updated by creating a webhook.
-
-Return to Jira. Click the gear menu on the upper right of the screen. Click
-**System** > **WebHooks** > **Create a WebHook**. 
-
-<Tabs>
-<TabItem label="Executable">
-
-Enter "Teleport Access Request Plugin" in the "Name" field. In the "URL" field,
-enter the domain name you created for the plugin earlier, plus port `8081`.
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-Enter "Teleport Access Request Plugin" in the "Name" field. In the "URL" field,
-enter the domain name you created for the plugin earlier, plus port `443`.
-
-</TabItem>
-</Tabs>
-
-The webhook needs to be notified only when an issue is created, updated, or
-deleted. You can leave all the other boxes empty.
-
-Click **Create**.
-
-## Step 5/7. Configure the Jira Access Request plugin
-
-Earlier, you retrieved credentials that the Jira plugin uses to connect to
-Teleport and the Jira API. You will now configure the plugin to use these
-credentials and run the Jira webhook at the address you configured earlier.
-
-### Create a configuration file
-
-<Tabs>
-<TabItem label="Executable or Docker">
-The Teleport Jira plugin uses a configuration file in TOML format. Generate a
-boilerplate configuration by running the following command (the plugin will not run
-unless the config file is in `/etc/teleport-jira.toml`):
-
-```code
-$ teleport-jira configure | sudo tee /etc/teleport-jira.toml > /dev/null
-```
-
-This should result in a configuration file like the one below:
-
-```toml
-(!examples/resources/plugins/teleport-jira-cloud.toml!)
-```
-</TabItem>
-<TabItem label="Helm chart">
-The Helm chart for the Jira plugin uses a YAML values file to configure the
-plugin. On your local workstation, create a file called
-`teleport-jira-helm.yaml` based on the following example:
-
-```yaml
-(!examples/resources/plugins/teleport-jira-helm-cloud.yaml!)
-```
-
-</TabItem>
-</Tabs>
-
-### Edit the configuration file
-
-Open the configuration file created for the Teleport Jira plugin and update the
-following fields:
-
-**`[teleport]`**
-
-The Jira plugin uses this section to connect to your Teleport cluster:
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-<Tabs>
-<TabItem label="Executable">
-
-### `jira`
-
-**url:** The URL of your Jira tenant, e.g., `https://[your-jira].atlassian.net`.
-
-**username:** The username you were logged in as when you created your API
-token.
-
-**api_token:** The Jira API token you retrieved earlier. 
-
-**project:** The project key for your project, which in our case is `TAR`.
-
-You can leave `issue_type` as `Task` or remove the field, as `Task` is the
-default.
-
-### `http`
-
-The `[http]` setting block describes how the plugin's webhook works. 
-
-**listen_addr** indicates the address that the plugin listens on, and defaults
-to `:8081`. If you opened port `8081` on your plugin host as we recommended
-earlier in the guide, you can leave this option unset.
-
-**public_addr** is the public address of your webhook. This is the domain name you
-added to the DNS A record you created earlier.
-
-**https_key_file** and **https_cert_file** correspond to the private key and
-certificate you obtained before following this guide. Use the following values,
-assigning <Var name="example.com" /> to the domain name you created for the
-plugin earlier:
-
-- **https_key_file:** 
-
-  ```code
-  $ /var/teleport-jira/tls/certificates/acme-v02.api.letsencrypt.org-directory/<Var name="example.com" />/<Var name="example.com" />.key
-  ```
-
-- **https_cert_file:** 
-
-  ```code
-  $ /var/teleport-jira/tls/certificates/acme-v02.api.letsencrypt.org-directory/<Var name="example.com" />/<Var name="example.com" />.crt
-  ```
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-### `jira`
-
-**url:** The URL of your Jira tenant, e.g., `https://[your-jira].atlassian.net`.
-
-**username:** The username you were logged in as when you created your API
-token. 
-
-**apiToken:** The API token you retrieved earlier.  
-
-**project:** The project key for your project, which in our case is `TAR`.
-
-You can leave `issueType` as `Task` or remove the field, as `Task` is the
-default.
-
-### `http`
-
-The `http` setting block describes how the plugin's webhook works. 
-
-**publicAddress:** The public address of your webhook. This is the domain name
-you created for your webhook. (We will create a DNS record for this domain name
-later.)
-
-**tlsFromSecret:** The name of a Kubernetes secret containing TLS credentials
-for the webhook. Use `teleport-plugin-jira-tls`.
-
-</TabItem>
-</Tabs>
-
-## Step 6/7. Run the Jira plugin
-
-After finishing your configuration, you can now run the plugin and test your
-Jira-based Access Request flow:
-
-<Tabs>
-<TabItem label="Executable">
-
-Run the following on your Linux host:
-
-```code
-$ sudo teleport-jira start
-INFO   Starting Teleport Jira Plugin 12.1.1: jira/app.go:112
-INFO   Plugin is ready jira/app.go:142
-```
-</TabItem>
-<TabItem label="Helm Chart">
-
-Install the Helm chart for the Teleport Jira plugin:
-
-```code
-$ helm install teleport-plugin-jira teleport/teleport-plugin-jira \
-  --namespace teleport \
-  --values values.yaml \
-  --version (=teleport.plugin.version=)
-```
-
-Create a DNS record that associates the webhook's domain name with the address
-of the load balancer created by the Jira plugin Helm chart.
-
-See whether the load balancer has a domain name or IP address:
-
-```code
-$ kubectl -n teleport get services/teleport-plugin-jira
-NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP                          PORT(S)                      AGE
-teleport-plugin-jira   LoadBalancer   10.100.135.75   abc123.us-west-2.elb.amazonaws.com   80:30625/TCP,443:31672/TCP   134m
-```
-
-If the `EXTERNAL-IP` field has a domain name for the value, create a `CNAME`
-record in which the domain name for your webhook points to the domain name of
-the load balancer.
-
-If the `EXTERNAL-IP` field's value is an IP address, create a DNS `A` record
-instead.
-
-You can then generate signed TLS credentials for the Jira plugin, which expects
-them to be written to a Kubernetes secret.
-
-</TabItem>
-</Tabs>
-
-### Check the status of the webhook
-
-Confirm that the Jira webhook has started serving by sending a GET request to
-the `/status` endpoint. If the webhook is running, it will return a `200` status
-code with no document body:
-
-<Tabs>
-<TabItem label="Executable">
-
-```code
-$ curl -v https://<Var name="example.com" />:8081/status 2>&1 | grep "^< HTTP/2"
-< HTTP/2 200
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-```code
-$ curl -v https://<Var name="example.com" />:443/status 2>&1 | grep "^< HTTP/2"
-< HTTP/2 200
-```
-
-</TabItem>
-</Tabs>
-
-### Create an Access Request
-
-Sign in to your cluster as the `myuser` user you created earlier and create an
-Access Request:
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-When you create the request, you will see a new task in the "Pending" column of the Access Requests board:
-
-![New Access Request](../../../../img/enterprise/plugins/jira/new-request.png)
-
-### Resolve the request
-
-Move the card corresponding to your new Access Request to the "Denied" column,
-then click the card and navigate to Teleport. You will see that the Access
-Request has been denied.
-
-<Admonition title="Auditing Access Requests">
-
-Anyone with access to the Jira project board can modify the status of Access
-Requests reflected on the board. You can check the Teleport audit log to ensure
-that the right users are reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-## Step 7/7. Set up systemd
-
-<Admonition type="tip">
-
-This step is only applicable if you are running the Teleport Jira plugin on a
-Linux machine.
-
-</Admonition>
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd. Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```txt
-(!examples/systemd/plugins/teleport-jira.service!)
-```
-
-Save this as `teleport-jira.service` or another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-```code
-$ sudo systemctl enable teleport-jira
-$ sudo systemctl start teleport-jira
-```
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx
deleted file mode 100644
index 9f0e7b24af90c..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx
+++ /dev/null
@@ -1,362 +0,0 @@
----
-title: Run the Mattermost Access Request plugin
-description: How to set up Teleport's Mattermost plugin for privilege elevation approvals.
----
-
-import BotLogo from "/static/avatar_logo.png";
-
-This guide explains how to integrate Access Requests with Mattermost, an open 
-source messaging platform. The Teleport Mattermost plugin notifies individuals of
-Access Requests. Users can then approve and deny Access Requests by following the
-message link, making it easier to implement security best practices without
-compromising productivity.
-
-![The Mattermost Access Request plugin](../../../../img/enterprise/plugins/mattermost/diagram.png)
-
-<details>
-<summary>This integration is hosted on Teleport Cloud</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Mattermost integration"!)
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- A Mattermost account with admin privileges. This plugin has been tested with
-  Mattermost v7.0.1.
-- Either a Linux host or Kubernetes cluster where you will run the Teleport Mattermost plugin.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/8. Define RBAC resources
-
-Before you set up the Teleport Mattermost plugin, you need to enable Role Access
-Requests in the Teleport Proxy Service or Teleport Auth Service.
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 2/8. Install the Teleport Mattermost plugin
-
-<Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-
-We recommend installing Teleport plugins on the same host as the Teleport Proxy
-Service. This is an ideal location as plugins have a low memory footprint, and
-require both public internet access and Teleport Auth Service access.
-
-</TabItem>
-
-<TabItem scope="cloud" label="Teleport Enterprise Cloud">
-
-Install the Teleport Mattermost plugin on a host that can access both your
-Teleport Proxy Service and your Mattermost deployment.
-
-</TabItem>
-
-</Tabs>
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="mattermost"!)
-
-## Step 3/8. Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-## Step 4/8. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-mattermost-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-mattermost-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/8. Register a Mattermost bot
-
-Now that you have generated the credentials your plugin needs to connect to your
-Teleport cluster, register your plugin with Mattermost so it can send Access
-Request messages to your workspace.
-
-In Mattermost, click the menu button in the upper left of the UI, then click
-System Console → Integrations → Bot Accounts.
-
-Set "Enable Bot Account Creation" to "true".
-
-![Enable Mattermost bots](../../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)
-
-This will allow you to create a new bot account for the Mattermost plugin.
-
-Go back to your team. In the menu on the upper left of the UI, click
-Integrations → Bot Accounts → Add Bot Account.
-
-Set the "Username", "Display Name", and "Description" fields according to how
-you would like the Mattermost plugin bot to appear in your workspace. Set "Role"
-to "Member".
-
-{/* lint ignore absolute-docs-links */}
-You can <a href={BotLogo} download>download</a> our avatar to set as your Bot
-Icon.
-
-Set "post:all" to "Enabled".
-
-![Enable Mattermost Bots](../../../../img/enterprise/plugins/mattermost/mattermost_bot.png)
-
-Click "Create Bot Account". We will use the resulting OAuth 2.0 token when we
-configure the Mattermost plugin.
-
-## Step 6/8. Configure the Mattermost plugin
-
-At this point, you have generated credentials that the Mattermost plugin will use
-to connect to Teleport and Mattermost. You will now configure the Mattermost
-plugin to use these credentials and post messages in the right channels for your
-workspace.
-
-<Tabs>
-<TabItem label="Executable or Docker">
-The Mattermost plugin uses a configuration file in TOML format. On the host where you
-will run the Mattermost plugin, generate a boilerplate configuration by running the
-following commands:
-
-```code
-$ teleport-mattermost configure > teleport-mattermost.toml
-$ sudo mv teleport-mattermost.toml /etc
-```
-</TabItem>
-<TabItem label="Helm Chart">
-The Mattermost Helm Chart uses a YAML values file to configure the plugin. On
-the host where you have Helm installed, create a file called
-`teleport-mattermost-helm.yaml` based on the following example:
-
-```yaml
-(!examples/resources/plugins/teleport-mattermost-helm-cloud.yaml!)
-```
-</TabItem>
-</Tabs>
-
-Edit the configuration as explained below:
-
-### `[teleport]`
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-### `[mattermost]`
-
-**`url`**: Include the scheme (`https://`) and fully qualified domain name of
-your Mattermost deployment.
-
-**`token`**: Find your Mattermost bot's OAuth 2.0 token. To do so, visit
-Mattermost. In the menu on the upper left of the UI, go to Integrations → Bot
-Accounts. Find the listing for the Teleport plugin and click "Create New Token".
-After you save the token, you will see a message with text in the format,
-"Access Token: TOKEN". Copy the token and paste it here.
-
-**`recipients`**: This field configures the channels that the Mattermost plugin
-will notify when it receives an Access Request message. The value is an array of
-strings, where each element is either:
-
-- The email address of a Mattermost user to notify via a direct message when the
-  plugin receives an Access Request event
-- A channel name in the format `team/channel`, where `/` separates the name
-  of the team and the name of the channel
-
-For example, this configuration will notify `first.last@example.com` and
-the `Town Square` channel in the `myteam` team of any Access Request events:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-```toml
-recipients = [
-  "myteam/Town Square",
-  "first.last@example.com"
-]
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-
-```yaml
-recipients:
-  - "myteam/Town Square"
-  - first.last@example.com
-```
-
-</TabItem>
-</Tabs>
-
-You will need to invite your Teleport plugin to any channel you add to the
-`recipients` list (aside from direct message channels). Visit Mattermost,
-navigate to each channel you want to invite the plugin to, and enter `/invite
-@teleport` (or the name of the bot you configured) into the message box.
-
-![Invite the bot](../../../../img/enterprise/plugins/mattermost/add-bot.png)
-
-<details>
-<summary>Suggested reviewers</summary>
-
-Users can also suggest reviewers when they create an Access Request, e.g.,:
-
-```code
-$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
-```
-
-If an Access Request includes suggested reviewers, the Mattermost plugin will
-add these to the list of channels to notify. If a suggested reviewer is an email
-address, the plugin will look up the direct message channel for that address
-and post a message in that channel.
-
-If `recipients` is empty, and the user requesting elevated privileges has not
-suggested any reviewers, the plugin will skip forwarding the Access Request to
-Mattermost.
-
-</details>
-
-The final configuration should look similar to this:
-
-<Tabs>
-<TabItem label="Executable or Docker" >
-```yaml
-# example mattermost configuration TOML file
-[teleport]
-auth_server = "myinstance.teleport.sh:443"                   # Teleport Cloud proxy HTTPS address
-identity = "/var/lib/teleport/plugins/mattermost/identity"   # Identity file path
-refresh_identity = true                                      # Refresh identity file on a periodic basis
-
-[mattermost]
-url = "https://mattermost.example.com" # Mattermost Server URL
-token = "api-token"                    # Mattermost Bot OAuth token
-recipients = [
-  "myteam/general",
-  "first.last@example.com"
-]
-
-[log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/mattermost.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
-
-```
-</TabItem>
-<TabItem label="Helm Chart">
-```yaml
-(!examples/resources/plugins/teleport-mattermost-helm-cloud.yaml!)
-```
-</TabItem>
-</Tabs>
-
-## Step 7/8. Test your Mattermost bot
-
-<Tabs>
-<TabItem label="Executable">
-After modifying your configuration, run the bot with the following command:
-
-```code
-$ teleport-mattermost start -d
-```
-
-The `-d` flag provides debug information to make sure the bot can connect to
-Mattermost, e.g.:
-
-```text
-DEBU   Checking Teleport server version mattermost/main.go:234
-DEBU   Starting a request watcher... mattermost/main.go:296
-DEBU   Starting Mattermost API health check... mattermost/main.go:186
-DEBU   Starting secure HTTPS server on :8081 utils/http.go:146
-DEBU   Watcher connected mattermost/main.go:260
-DEBU   Mattermost API health check finished ok mattermost/main.go:19
-```
-</TabItem>
-<TabItem label="Docker">
-
-Run the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-mattermost.toml public.ecr.aws/gravitational/teleport-plugin-mattermost:(=teleport.version=) start
-```
-</TabItem>
-<TabItem label="Helm Chart">
-After modifying your configuration, run the bot with the following command:
-
-```code
-$ helm upgrade --install teleport-plugin-mattermost teleport/teleport-plugin-mattermost --values teleport-mattermost-helm.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-mattermost
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-mattermost-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-mattermost
-```
-
-</TabItem>
-</Tabs>
-
-### Create an Access Request
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-The users and channels you configured earlier to review the request should
-receive a message from "Teleport" in Mattermost allowing them to visit a link in
-the Teleport Web UI and either approve or deny the request.
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-<Admonition type="info" title="Auditing Access Requests">
-
-When the Mattermost plugin posts an Access Request notification to a channel,
-anyone with access to the channel can view the notification and follow the link.
-While users must be authorized via their Teleport roles to review Access
-Requests, you should still check the Teleport audit log to ensure that the right
-users are reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-## Step 8/8. Set up systemd
-
-This section is only relevant if you are running the Teleport Mattermost plugin
-on a Linux host.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd. Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!examples/systemd/plugins/teleport-mattermost.service!)
-```
-
-Save this as `teleport-mattermost.service` in either `/usr/lib/systemd/system/` or
-another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-mattermost
-$ sudo systemctl start teleport-mattermost
-```
-
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx
deleted file mode 100644
index d53c4539efeb2..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx
+++ /dev/null
@@ -1,564 +0,0 @@
----
-title: Access Requests with Microsoft Teams
-description: How to set up Teleport's Microsoft Teams plugin for privilege elevation approvals.
----
-
-This guide will explain how to set up Microsoft Teams to receive Access Request messages
-from Teleport. Teleport's Microsoft Teams integration notifies individuals of
-Access Requests. Users can then approve and deny Access Requests by following the
-message link, making it easier to implement security best practices without
-compromising productivity.
-
-![The Microsoft Teams Access Request plugin](../../../../img/enterprise/plugins/msteams.png)
-
-<details>
-<summary>This integration is hosted on Teleport Enterprise (Cloud)</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Microsoft Teams integration"!)
-
-![Create Microsoft Teams Bot](../../../../img/enterprise/plugins/msteams/enroll-bot.png)
-
-Once enrolled you can download the required `app.zip` file from the integrations status page.
-
-![Download app.zip](../../../../img/enterprise/plugins/msteams/app-zip.png)
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- A Microsoft Teams License (Microsoft 365 Business).
-- Azure console access in the organization/directory holding the Microsoft Teams
-  License.
-- An Azure resource group in the same directory. This will host resources for
-  the Microsoft Teams Access Request plugin. You should have enough
-  permissions to create and edit Azure Bot Services in this resource group.
-- Someone with Global Admin rights on Microsoft Entra ID in order to grant
-  permissions to the plugin.
-- Someone with the `Teams administrator` role that can approve installation
-  requests for Microsoft Teams Apps.
-- Either an Azure virtual machine or Kubernetes cluster where you will run the
-  Teleport Microsoft Teams plugin.
-
-(!/docs/pages/includes/tctl.mdx!)
-
-## Step 1/9. Define RBAC resources
-
-Before you set up the Microsoft Teams plugin, you will need to enable Role Access Requests
-in your Teleport cluster. 
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 2/9. Install the Teleport Microsoft Teams plugin
-
-Install the Microsoft Teams plugin on your workstation. If you are deploying the
-plugin on Kubernetes, you will still need to install the plugin locally in order
-to generate an application archive to upload later in this guide.
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="msteams"!)
-
-## Step 3/9. Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-## Step 4/9. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-msteams-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-msteams-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/9. Register an Azure Bot
-
-The Access Request plugin for Microsoft Teams receives Access Request events from the
-Teleport Auth Service, formats them into Microsoft Teams messages, and sends them to the
-Microsoft Teams API to post them in your workspace. For this to work, you must register a
-new Azure Bot. Azure Bot is a managed service by Microsoft that allows to
-develop bots that interact with users through different channels, including
-Microsoft Teams.
-
-### Register a new Azure bot
-
-Visit [https://portal.azure.com/#create/Microsoft.AzureBot](https://portal.azure.com/#create/Microsoft.AzureBot)
-to create a new bot. Choose the bot handle so you can find the bot later in the Azure console (the bot handle will
-not be displayed to the user or used to configure the Microsoft Teams plugin). Also edit the Azure subscription,
-the resource group and the bot pricing tier.
-
-In the "Microsoft App ID" section choose "Single Tenant" and "Create new
-Microsoft App ID".
-
-![Create Azure Bot](../../../../img/enterprise/plugins/msteams/create-azure-bot.png)
-
-### Connect the bot to Microsoft Teams
-
-Once the bot is created, open its resource page on the Azure console and
-navigate to the "Channels" tab. Click "Microsoft Teams" and add the Microsoft Teams
-channel.
-
-The result should be as follows:
-
-![Add Bot Channel](../../../../img/enterprise/plugins/msteams/add-bot-channel.png)
-
-### Obtain information about your Microsoft App
-
-On the bot's "Configuration" tab, copy and keep in a safe place the values of
-"Microsoft App ID" and "App Tenant ID". Those two UUIDs will be used in the
-plugin configuration.
-
-Click the "Manage" link next to "Microsoft App ID". This will open the app management view.
-
-![Manage Bot App](../../../../img/enterprise/plugins/msteams/manage-bot-app.png)
-
-Then, go to the "Certificates & Secrets" section and choose to create a "New client secret".
-Use the "Copy" icon to copy the newly created secret and keep it with the
-previously recovered App ID and Tenant ID.
-
-The client secret will be used by the Teleport plugin to authenticate as the bot's app when
-searching users and posting messages.
-
-### Specify the permissions used by the app
-
-Still in the app management view ("Configuration", then "Manage" the Microsoft App ID),
-go to the "API permissions" tab.
-
-Add the following Microsoft Graph Application permissions:
-
-| Permission name | Reason |
-|---|---|
-| `AppCatalog.Read.All` | Used to list Teams Apps and check the app is installed. |
-| `User.Read.All` | Used to get notification recipients. |
-| `TeamsAppInstallation.ReadWriteSelfForUser.All` | Used to initiate communication with a user that never interacted with the Teams App before. |
-| `TeamsAppInstallation.ReadWriteSelfForTeam.All` | Used to discover if the app is installed in the Team. |
-
-At this point the app declares the required permissions but those have not been granted.
-
-If you are an admin, click "Grant admin consent for \<directory name\>". If you are not an admin,
-contact an admin user to grant the permissions.
-
-![Specify App Permissions](../../../../img/enterprise/plugins/msteams/specify-app-permissions.png)
-
-Once permissions have been approved, refresh the page and check the approval status.
-The result should be as follows:
-
-![Granted App Permissions](../../../../img/enterprise/plugins/msteams/granted-app-permissions.png)
-
-## Step 6/9. Configure the Teleport Microsoft Teams plugin
-
-At this point, the Teleport Microsoft Teams plugin has the credentials it needs to
-communicate with your Teleport cluster and Azure APIs, but the app has not been
-installed to Microsoft Teams yet.
-
-In this step, you will configure the Microsoft Teams plugin to use the Azure
-credentials and generate the Teams App package that will be used to install the
-Microsoft Teams App. You will also configure the plugin to notify
-the right Microsoft Teams users when it receives an Access Request update.
-
-### Generate a configuration file and assets
-
-Generate a configuration file for the plugin. The instructions depend on whether
-you are deploying the plugin on a virtual machine or Kubernetes:
-
-<Tabs>
-<TabItem label="Virtual Machine">
-
-The Teleport Microsoft Teams plugin uses a config file in TOML format.  The
-`configure` subcommand generates the directory
-`/var/lib/teleport/plugins/msteams/assets` containing the TOML configuration
-file and an `app.zip` file that will be used later to add the Teams App into the
-organization catalog.
-
-Run the following command on your virtual machine:
-
-```code
-$ export AZURE_APPID="your-appid"
-$ export AZURE_TENANTID="your-tenantid"
-$ export AZURE_APPSECRET="your-appsecret"
-$ teleport-msteams configure /var/lib/teleport/plugins/msteams/assets --appID "$AZURE_APPID" --tenantID "$AZURE_TENANTID" --appSecret "$AZURE_APPSECRET"
-```
-
-This should result in a config file like the one below:
-
-```toml
-(!examples/resources/plugins/teleport-msteams.toml!)
-```
-
-Copy the `/var/lib/teleport/plugins/msteams/assets/app.zip` file to your local
-computer. You will have to upload it to Microsoft Teams later.
-
-On the host where you will run the Microsoft Teams plugin, move the file
-`/var/lib/teleport/plugins/msteams/assets/teleport-msteams.toml` to
-`/etc/teleport-msteams.toml`. You can then edit the copy located in `/etc/`.
-
-</TabItem>
-<TabItem label="Kubernetes">
-
-Run the following command on your local machine:
-
-```code
-$ export AZURE_APPID="your-appid"
-$ export AZURE_TENANTID="your-tenantid"
-$ export AZURE_APPSECRET="your-appsecret"
-$ teleport-msteams configure /var/lib/teleport/plugins/msteams/assets --appID "$AZURE_APPID" --tenantID "$AZURE_TENANTID" --appSecret "$AZURE_APPSECRET"
-```
-
-This command generates an application archive at
-`/var/lib/teleport/plugins/msteams/assets/app.zip`. You will upload it to
-Microsoft Teams later in this guide.
-
-Create a file on your workstation called `teleport-msteams-helm.yaml` with the
-following content:
-
-```yaml
-(!examples/resources/plugins/teleport-msteams-helm.yaml!)
-```
-
-You will edit this file in the next section.
-
-</TabItem>
-</Tabs>
-
-<Admonition type="warning" title="Configure command">
-The `configure` command is not idempotent. It generates a new Microsoft Teams
-application UUID with each execution. It is not possible to use an `app.zip` and
-a TOML configuration generated by two different executions.
-</Admonition>
-
-### Edit the configuration file
-
-Edit the configuration file according to the instructions below.
-
-#### `[teleport]`
-
-The Microsoft Teams plugin uses this section to connect to your Teleport
-cluster.
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-#### `[msapi]`/`msTeams`
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-Make sure the `app_id`, `app_secret`, `tenant_id`, and `teams_app_id` fields are
-filled in with the correct information, which you obtained earlier in this
-guide.
-</TabItem>
-<TabItem label="Helm Chart">
-
-Make sure the `appID`, `tenantID`, and `teamsAppID` fields are filled in with
-the correct information, which you obtained earlier in this guide.
-
-</TabItem>
-</Tabs>
-
-#### `[role_to_recipients]`
-
-The `role_to_recipients` map (`roleToRecipients` for Helm users) configures the
-users and channels that the Microsoft Teams plugin will notify when a user
-requests access to a specific role. When the Microsoft Teams plugin receives an
-Access Request from the Auth Service, it will look up the role being requested
-and identify the Microsoft Teams users and channels to notify.
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-Here is an example of a `role_to_recipients` map. Each value can be a single
-string or an array of strings:
-
-```toml
-[role_to_recipients]
-"*" = "alice@example.com"
-"dev" = ["alice@example.com", "bob@example.com"]
-"dba" = "https://teams.microsoft.com/l/channel/19%3somerandomid%40thread.tacv2/ChannelName?groupId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-```
-</TabItem>
-<TabItem label="Helm Chart">
-
-In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
-and uses the following format, where keys are strings and values are arrays of
-strings:
-
-```toml
-roleToRecipients:
-  "*": "alice@example.com"
-  "dev": ["alice@example.com", "bob@example.com"]
-  "dba": "https://teams.microsoft.com/l/channel/19%3somerandomid%40thread.tacv2/ChannelName?groupId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-```
-</TabItem>
-</Tabs>
-
-In the `role_to_recipients` map, each key is the name of a Teleport role. Each
-value configures the Teams user (or users) to notify. Each string must be either
-the email address of a Microsoft Teams user or a channel URL.
-
-You can find the URL of a channel by opening the channel and clicking the button
-"Get link to channel":
-
-![Copy Teams Channel](../../../../img/enterprise/plugins/msteams/copy-teams-channel.png)
-
-The `role_to_recipients` map must also include an entry for `"*"`, which the
-plugin looks up if no other entry matches a given role name. In the example
-above, requests for roles aside from `dev` and `dba` will notify `alice@example.com`.
-
-<details>
-<summary>Suggested reviewers</summary>
-
-Users can suggest reviewers when they create an Access Request, e.g.,:
-
-```code
-$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
-```
-
-If an Access Request includes suggested reviewers, the Microsoft Teams plugin will add
-these to the list of channels to notify. If a suggested reviewer is an email
-address, the plugin will look up the direct message channel for that
-address and post a message in that channel.
-
-</details>
-
-Configure the Microsoft Teams plugin to notify you when a user requests the `editor` role
-by adding the following to your `role_to_recipients` config (replace
-`TELEPORT_USERNAME` with the email of the user you assigned the `editor-reviewer`
-role earlier):
-
-<Tabs>
-<TabItem label="Executable or Docker">
-
-```toml
-[role_to_recipients]
-"*" = "TELEPORT_USERNAME"
-"editor" = "TELEPORT_USERNAME"
-```
-</TabItem>
-<TabItem label="Helm Chart">
-
-```toml
-roleToRecipients:
-  "*": "TELEPORT_USERNAME"
-  "editor": "TELEPORT_USERNAME"
-```
-</TabItem>
-</Tabs>
-
-The final configuration file should resemble the following:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-```toml
-(!examples/resources/plugins/teleport-msteams.toml!)
-```
-</TabItem>
-<TabItem label="Helm Chart">
-```yaml
-(!examples/resources/plugins/teleport-msteams-helm.yaml!)
-```
-</TabItem>
-</Tabs>
-
-## Step 7/9. Add and configure the Teams App
-
-### Upload the Teams App
-
-Open Microsoft Teams and go to "Apps", "Manage your apps", then in the additional
-choices menu choose "Upload an App".
-
-![Upload Teams App](../../../../img/enterprise/plugins/msteams/upload-teams-app.png)
-
-If you're a Teams admin, choose "Upload an app to your org's app catalog".
-This will allow you to skip the approval step.
-If you're not a Microsoft Teams admin, choose "Submit an app to your org".
-
-Upload the `app.zip` file you generated earlier.
-
-### Approve the Teams App
-
-If you are not a Teams admin and chose "Submit an app to your org",
-you will have to ask a Teams admin to approve it.
-
-They can do so by connecting to the
-[Teams admin dashboard](https://admin.teams.microsoft.com/policies/manage-apps),
-searching "TeleBot", selecting it and choosing "Allow".
-
-![Upload Teams App](../../../../img/enterprise/plugins/msteams/allowed-teams-app.png)
-
-### Add the Teams App to a Team
-
-Once the app is approved it should appear in the "Apps built for your org" section.
-Add the newly uploaded app to a team. Open the app, click "Add to a team",
-choose the "General" channel of your team and click "Set up a bot".
-
-![Add Teams App](../../../../img/enterprise/plugins/msteams/add-teams-app.png)
-
-Note: Once an app is added to a team, it can post on all channels.
-
-## Step 8/9. Test the Teams App
-
-Once Teleport is running, you've created the Teams App, and the plugin is
-configured, you can now run the plugin and test the workflow.
-
-### Test Microsoft Teams connectivity
-
-Start the plugin in validation mode:
-
-```code
-$ teleport-msteams validate <email of your teams account>
-```
-
-If everything works fine, the log output should look like this:
-
-```text
-teleport-msteams v(=teleport.plugin.version=) go(=teleport.golang=)
-
- - Checking application xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx status...
- - Application found in the team app store (internal ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
- - User xxxxxx@xxxxxxxxx.xxx found: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- - Application installation ID for user: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
- - Chat ID for user: 19:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@unq.gbl.spaces
- - Chat web URL: https://teams.microsoft.com/l/chat/19%3Axxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%40unq.gbl.spaces/0?tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- - Hailing the user...
- - Message sent, ID: XXXXXXXXXXXXX
-
-Check your MS Teams!
-```
-
-The plugin should exit and you should have received two messages through Microsoft Teams.
-
-![Validate Bot Message](../../../../img/enterprise/plugins/msteams/validate-bot-message.png)
-
-### Start the MS Teams Plugin
-
-After you configured and validated the MS Teams plugin, you can now run the
-plugin and test the workflow.
-
-<Tabs>
-<TabItem label="Executable">
-
-Run the following command to start the Teleport MS Teams plugin.  The `-d` flag
-will provide debug information to ensure that the plugin can connect to MS Teams
-and your Teleport cluster:
-
-```code
-$ teleport-msteams start -d
-DEBU   DEBUG logging enabled msteams/main.go:120
-INFO   Starting Teleport MS Teams Plugin (=teleport.plugin.version=): msteams/app.go:74
-DEBU   Attempting GET teleport.example.com:443/webapi/find webclient/webclient.go:129
-DEBU   Checking Teleport server version msteams/app.go:242
-INFO   MS Teams app found in org app store id:292e2881-38ab-7777-8aa7-cefed1404a63 name:TeleBot msteams/app.go:179
-INFO   Preloading recipient data... msteams/app.go:185
-INFO   Recipient found, chat found chat_id:19:a8c06deb-aa2b-4db5-9c78-96e48f625aef_a36aec2e-f11c-4219-b79a-19UUUU57de70@unq.gbl.spaces kind:user recipient:jeff@example.com msteams/app.go:195
-INFO   Recipient data preloaded and cached. msteams/app.go:198
-DEBU   Watcher connected watcherjob/watcherjob.go:121
-INFO   Plugin is ready msteams/app.go:227
-```
-
-</TabItem>
-<TabItem label="Docker">
-Run the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-msteams.toml public.ecr.aws/gravitational/teleport-plugin-msteams:(=teleport.version=) start
-```
-
-</TabItem>
-<TabItem label="Helm Chart">
-Install the plugin:
-
-```code
-$ helm upgrade --install teleport-plugin-msteams teleport/teleport-plugin-msteams --values teleport-msteams-helm.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-msteams
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-msteams-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-msteams
-```
-
-</TabItem>
-</Tabs>
-
-### Create an Access Request
-
-Create an Access Request and check if the plugin works as expected with the
-following steps.
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-The user you configured earlier to review the request should receive a direct
-message from "TeleBot" in Microsoft Teams allowing them to visit a link in the Teleport
-Web UI and either approve or deny the request.
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-Once the request is resolved, the Microsoft Teams bot will update the Access Request message
-to reflect its new status.
-
-<Admonition title="Auditing Access Requests">
-
-When the Microsoft Teams plugin posts an Access Request notification to a channel, anyone
-with access to the channel can view the notification and follow the link. While
-users must be authorized via their Teleport roles to review Access Requests, you
-should still check the Teleport audit log to ensure that the right users are
-reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-## Step 9/9. Set up systemd
-
-This section is only relevant if you are running the Teleport Microsoft Teams
-plugin on a virtual machine.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd.  Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!examples/systemd/plugins/teleport-msteams.service!)
-```
-
-Save this as `teleport-msteams.service` in either `/usr/lib/systemd/system/` or
-another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-msteams
-$ sudo systemctl start teleport-msteams
-```
-
-## Next steps
-
-- Read our guides to configuring [Resource Access
-    Requests](../access-requests/resource-requests.mdx) and [Role Access
-    Requests](../access-requests/role-requests.mdx) so you can get the most out
-    of your Access Request plugins.
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx
deleted file mode 100644
index 1e5c2480e79c0..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx
+++ /dev/null
@@ -1,629 +0,0 @@
----
-title: Run the PagerDuty Access Request Plugin
-description: How to set up Teleport's PagerDuty plugin for privilege elevation approvals.
----
-
-With Teleport's PagerDuty integration, engineers can access the infrastructure
-they need to resolve incidents quickly—without longstanding admin permissions
-that can become a vector for attacks.
-
-Teleport's PagerDuty integration allows you to treat Teleport Role Access
-Requests as PagerDuty incidents, notify the appropriate on-call team, and
-approve or deny the requests via Teleport. You can also configure the plugin to
-approve Role Access Requests automatically if the user making the request is on
-the on-call team for a service affected by an incident.
-
-<details>
-<summary>This integration is hosted on Teleport Cloud</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the PagerDuty integration"!)
-
-</details>
-
-This guide will explain how to set up Teleport's Access Request plugin for
-PagerDuty.
-
-![PagerDuty plugin architecture](../../../../img/enterprise/plugins/pagerduty/diagram.png)
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- A PagerDuty account with the "Admin", "Global Admin", or "Account Owner"
-  roles. These roles are necessary for generating an API token that can list and
-  look up user profiles.
-
-  You can see your role by visiting your user page in PagerDuty, navigating to
-  the "Permissions & Teams" tab, and checking the value of the "Base Role"
-  field.
-
-- Either a Linux host or Kubernetes cluster where you will run the PagerDuty plugin.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/8. Create services
-
-To demonstrate the PagerDuty plugin, create two services in PagerDuty. For each
-service, fill in only the "Name" field and skip all other configuration screens,
-leaving options as the defaults:
-
-- `Teleport Access Request Notifications`
-- `My Critical Service`
-
-We will configure the PagerDuty plugin to create an incident in the `Teleport
-Access Request Notifications` service when certain users create an Access
-Request.
-
-For users on the on-call team for `My Critical Service` (in this case, your
-PagerDuty user), we will configure the PagerDuty plugin to approve Access
-Requests automatically, letting them investigate incidents on the service
-quickly.
-
-## Step 2/8. Define RBAC resources
-
-The Teleport PagerDuty plugin works by receiving Access Request events from the
-Teleport Auth Service and, based on these events, interacting with the PagerDuty
-API.
-
-In this section, we will show you how to configure the PagerDuty plugin by
-defining the following RBAC resources:
-
-- A role called `editor-requester`, which can request the built-in `editor`
-  role. We will configure this role to open a PagerDuty incident whenever a
-  user requests it, notifying the on-call team for the `Teleport Access Request
-  Notifications` service.
-- A role called `demo-role-requester`, which can request a role called
-  `demo-role`. We will configure the PagerDuty plugin to auto-approve this
-  request whenever the user making it is on the on-call team for `My Critical
-  Service`.
-- A user and role called `access-plugin` that the PagerDuty plugin will assume
-  in order to authenticate to the Teleport Auth Service. This role will have
-  permissions to approve Access Requests from users on the on-call team for `My
-  Critical Service` automatically.
-- A role called `access-plugin-impersonator` that allows you to generate signed
-  credentials that the PagerDuty plugin can use to authenticate with your
-  Teleport cluster.
-
-### `editor-requester`
-
-Create a file called `editor-request-rbac.yaml` with the following content,
-which defines a role called `editor-reviewer` that can review requests for the
-`editor` role, plus an `editor-requester` role that can request this role.
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: editor-reviewer
-spec:
-  allow:
-    review_requests:
-      roles: ['editor']
----
-kind: role
-version: v5
-metadata:
-  name: editor-requester
-spec:
-  allow:
-    request:
-      roles: ['editor']
-      thresholds:
-        - approve: 1
-          deny: 1
-      annotations:
-        pagerduty_notify_service: ["Teleport Access Request Notifications"]
-```
-
-The Teleport Auth Service *annotates* Access Request events with metadata based
-on the roles of the Teleport user submitting the Access Request. The PagerDuty
-plugin reads these annotations to determine how to respond to a new Access
-Request event.
-
-Whenever a user with the `editor-requester` role requests the `editor` role, the
-PagerDuty plugin will read the `pagerduty_notify_service` annotation and notify
-PagerDuty to open an incident in the specified service, `Teleport Access Request
-Notifications`, until someone with the `editor-reviewer` role approves or denies
-the request.
-
-Create the roles you defined:
-
-```code
-$ tctl create -f editor-request-rbac.yaml
-role 'editor-reviewer' has been created
-role 'editor-requester' has been created
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-### `demo-role-requester`
-
-Create a file called `demo-role-requester.yaml` with the following content:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: demo-role
----
-kind: role
-version: v5
-metadata:
-  name: demo-role-requester
-spec:
-  allow:
-    request:
-      roles: ['demo-role']
-      thresholds:
-        - approve: 1
-          deny: 1
-      annotations:
-        pagerduty_services: ["My Critical Service"]
-```
-
-Users with the `demo-role-requester` role can request the `demo-role` role. When
-such a user makes this request, the PagerDuty plugin will read the
-`pagerduty_services` annotation. If the user making the request is on the
-on-call team for a service listed as a value for the annotation, the plugin will
-approve the Access Request automatically.
-
-In this case, the PagerDuty plugin will approve any requests from users on the
-on-call team for `My Critical Service`.
-
-Create the resources:
-
-```code
-$ tctl create -f demo-role-requester.yaml;
-```
-
-<Admonition type="warning">
-
-For auto-approval to work, the user creating an Access Request must have a
-Teleport username that is also the email address associated with a PagerDuty
-account. In this guide, we will add the `demo-role-requester` role to your own
-Teleport account—which we assume is also your email address for PagerDuty—so you
-can request the `demo-role` role.
-
-</Admonition>
-
-### `access-plugin`
-
-Teleport's Access Request plugins authenticate to your Teleport cluster as a
-user with permissions to list, read, and update Access Requests. This way,
-plugins can retrieve Access Requests from the Teleport Auth Service, present
-them to reviewers, and modify them after a review.
-
-Define a user and role called `access-plugin` by adding the following content to
-a file called `access-plugin.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: access-plugin
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list', 'read']
-      - resources: ['access_plugin_data']
-        verbs: ['update']
-    review_requests:
-      roles: ['demo-role']
-      where: 'contains(request.system_annotations["pagerduty_services"], "My Critical Service")'
----
-kind: user
-metadata:
-  name: access-plugin
-spec:
-  roles: ['access-plugin']
-version: v2
-```
-
-Notice that the `access-plugin` role includes an `allow.review_requests.roles`
-field with `demo-role` as a value. This allows the plugin to review requests for
-the `demo-role` role.
-
-We are also restricting the `access-plugin` role to reviewing only Access
-Requests associated with `My Critical Service`. To do so, we have defined a
-*predicate expression* in the `review_requests.where` field. This expression
-indicates that the plugin *cannot* review requests for `demo-role` unless the
-request contains an annotation with the key `pagerduty_services` and the value
-`My Critical Service`.
-
-<details>
-<summary>How "where" conditions work</summary>
-
-The `where` field includes a predicate expression that determines whether a
-reviewer is allowed to review a specific request. You can include two functions
-in a predicate expression:
-
-|Function|Description|Example|
-|---|---|---|
-|`equals`|A field is equivalent to a value.|`equals(request.reason, "resolve an incident")`
-|`contains`|A list of strings includes a value.|`contains(reviewer.traits["team"], "devops")`|
-
-When you use the `where` field, you can include the following fields in your
-predicate expression:
-
-|Field|Type|Description|
-|---|---|---|
-|`reviewer.roles`|`[]string`|A list of the reviewer's Teleport role names|
-|`reviewer.traits`|`map[string][]string`|A map of the reviewer's Teleport traits by the name of the trait|
-|`request.roles`|`[]string`|A list of the Teleport roles a user is requesting|
-|`request.reason`|`string`|The reason attached to the request|
-|`request.system_annotations`| `map[string][]string`|A map of annotations for the request by annotation key, e.g., `pagerduty_services`|
-
-You can combine functions using the following operators:
-
-|Operator|Format|Description|
-|---|---|---|
-|`&&`|`function && function`|Evaluates to true if both functions evaluate to true|
-|`\|\|`|`function \|\| function`|Evaluates to true if either one or both functions evaluate to true|
-|`!`| `!function`|Evaluates to true if the function evaluates to false|
-
-An example of a function is `equals(request.reason, "resolve an incident")`. To
-configure an `allow` condition to match any Access Request that does not include
-the reason, "resolve an incident", you could use the function,
-`!equals(request.reason, "resolve an incident")`.
-
-</details>
-
-Create the user and role:
-
-```code
-$ tctl create -f access-plugin.yaml
-```
-
-### `access-plugin-impersonator`
-
-As with all Teleport users, the Teleport Auth Service authenticates the
-`access-plugin` user by issuing short-lived TLS credentials. In this case, we
-will need to request the credentials manually by *impersonating* the
-`access-plugin` role and user.
-
-If you are running a self-hosted Teleport Enterprise cluster and are using
-`tctl` from the Auth Service host, you will already have impersonation
-privileges.
-
-To grant your user impersonation privileges for `access-plugin`, define a role
-called `access-plugin-impersonator` by pasting the following YAML document into
-a file called `access-plugin-impersonator.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: access-plugin-impersonator
-spec:
-  allow:
-    impersonate:
-      roles:
-      - access-plugin
-      users:
-      - access-plugin
-```
-
-Create the `access-plugin-impersonator` role:
-
-```code
-$ tctl create -f access-plugin-impersonator.yaml
-```
-
-### Add roles to your user
-
-Later in this guide, your Teleport user will take three actions that require
-additional permissions:
-
-- Generate signed credentials that the PagerDuty plugin will use to connect to
-  your Teleport Cluster
-- Manually review an Access Request for the `editor` role
-- Create an Access Request for the `demo-role` role
-
-To grant these permissions to your user, give your user the `editor-reviewer`,
-`access-plugin-impersonator`, and `demo-role-requester` roles we defined
-earlier.
-
-Open your user definition in an editor:
-
-```code
-$ TELEPORT_USER=$(tsh status --format=json | jq -r .active.username)
-$ tctl edit users/${TELEPORT_USER?}
-```
-
-Edit the user to include the roles you just created:
-
-```diff
-  roles:
-   - access
-   - auditor
-   - editor
-+  - editor-reviewer
-+  - access-plugin-impersonator
-+  - demo-role-requester
-```
-
-Apply your changes by saving and closing the file in your editor.
-
-Log out of your Teleport cluster and log in again. You will now be able to
-review requests for the `editor` role, request the `demo-role` role, and
-generate signed certificates for the `access-plugin` role and user.
-
-### Create a user who will request access
-
-Create a user called `myuser` who has the `editor-requester` role. Later in this
-guide, you will create an Access Request as this user to test the PagerDuty
-plugin:
-
-```code
-$ tctl users add myuser --roles=editor-requester
-```
-
-`tctl` will print an invitation URL to your terminal. Visit the URL and log in
-as `myuser` for the first time, registering credentials as configured for your
-Teleport cluster.
-
-## Step 3/8. Install the Teleport PagerDuty plugin
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="pagerduty"!)
-
-## Step 4/8. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-pagerduty-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-pagerduty-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/8. Set up a PagerDuty API key
-
-Generate an API key that the PagerDuty plugin will use to create and modify
-incidents as well as list users, services, and on-call policies.
-
-In your PagerDuty dashboard, go to **Integrations → API Access Keys** and click
-**Create New API Key**. Add a key description, e.g., "Teleport integration".
-Leave "Read-only API Key" unchecked. Copy the key to a file on your local
-machine. We'll use the key in the plugin config file later.
-
-![Create an API
-key](../../../../img/enterprise/plugins/pagerduty/pagerduty-integrations.png)
-
-## Step 6/8. Configure the PagerDuty plugin
-
-At this point, you have generated credentials that the PagerDuty plugin will use
-to connect to Teleport and the PagerDuty API. You will now configure the
-PagerDuty plugin to use these credentials, plus adjust any settings required for
-your environment.
-
-<Tabs>
-  <TabItem label="Executable or Docker">
-Teleport's PagerDuty plugin has its own configuration file in TOML format. On
-the host where you will run the PagerDuty plugin, generate a boilerplate config
-by running the following commands:
-
-```code
-$ teleport-pagerduty configure > teleport-pagerduty.toml
-$ sudo mv teleport-pagerduty.toml /etc
-```
-  </TabItem>
-  <TabItem label="Helm Chart">
-The PagerDuty Helm Chart uses a YAML values file to configure the plugin. On
-the host where you have Helm installed, create a file called
-`teleport-pagerduty-values.yaml` based on the following example:
-
-```yaml
-teleport:
-  address: ""                 # Teleport Auth Service GRPC API address
-  identitySecretName: ""      # Identity secret name
-  identitySecretPath: ""      # Identity secret path
-
-pagerduty:
-  apiKey: ""                  # PagerDuty API Key
-  userEmail: ""               # PagerDuty bot user email (Could be admin email)
-```
-  </TabItem>
-</Tabs>
-
-<details>
-<summary>Saving the configuration to another location</summary>
-
-The PagerDuty plugin expects the configuration to be in
-`/etc/teleport-pagerduty.toml`, but you can override this with the `--config`
-flag when you run the plugin binary later in this guide.
-
-</details>
-
-Edit the configuration file in `/etc/teleport-pagerduty.toml` as explained
-below:
-
-### `[teleport]`
-
-The PagerDuty plugin uses this section to connect to your Teleport cluster:
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-### `[pagerduty]`
-
-Assign `api_key` to the PagerDuty API key you generated earlier.
-
-Assign `user_email` to the email address of a PagerDuty user on the account
-associated with your API key. When the PagerDuty plugin creates a new incident,
-PagerDuty will display this incident as created by that user.
-
-<details>
-<summary>Overriding annotation names</summary>
-
-This guide has assumed that the Teleport PagerDuty plugin uses
-`pagerduty_notify_service` annotation to determine which services to notify of
-new Access Request events and the `pagerduty_services` annotation to configure
-auto-approval.
-
-If you would like to use a different name for these annotations in your Teleport
-roles, you can assign the `pagerduty.notify_service` and `pagerduty.services`
-fields.
-
-</details>
-
-The final configuration should resemble the following:
-
-<Tabs>
-<TabItem label="Executable or Docker">
-```yaml
-(!examples/resources/plugins/teleport-pagerduty-cloud.toml!)
-```
-</TabItem>
-<TabItem label="Helm Chart" >
-```yaml
-(!examples/resources/plugins/teleport-pagerduty-helm-cloud.yaml!)
-```
-</TabItem>
-</Tabs>
-
-## Step 7/8. Test the PagerDuty plugin
-
-<Tabs>
-<TabItem label="Executable">
-After you configure the PagerDuty plugin, run the following command to start it.
-The `-d` flag will provide debug information to ensure that the plugin can
-connect to PagerDuty and your Teleport cluster:
-
-```code
-$ teleport-pagerduty start -d
-# DEBU   DEBUG logging enabled logrus/exported.go:117
-# INFO   Starting Teleport Access PagerDuty extension 0.1.0-dev.1: pagerduty/main.go:124
-# DEBU   Checking Teleport server version pagerduty/main.go:226
-# DEBU   Starting a request watcher... pagerduty/main.go:288
-# DEBU   Starting PagerDuty API health check... pagerduty/main.go:170
-# DEBU   Starting secure HTTPS server on :8081 utils/http.go:146
-# DEBU   Watcher connected pagerduty/main.go:252
-# DEBU   PagerDuty API health check finished ok pagerduty/main.go:176
-# DEBU   Setting up the webhook extensions pagerduty/main.go:178
-```
-</TabItem>
-<TabItem label="Docker">
-Run the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-pagerduty.toml public.ecr.aws/gravitational/teleport-plugin-pagerduty:(=teleport.version=) start
-```
-</TabItem>
-<TabItem label="Helm Chart">
-After modifying your configuration, run the bot with the following command:
-
-```code
-$ helm upgrade --install teleport-plugin-pagerduty teleport/teleport-plugin-pagerduty --values teleport-pagerduty-values.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-pagerduty
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-pagerduty-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-pagerduty
-```
-
-</TabItem>
-</Tabs>
-
-### Create an Access Request
-
-As the Teleport user `myuser`, create an Access Request for the `editor` role:
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-You should see a log resembling the following on your PagerDuty plugin host:
-
-```
-INFO   Successfully created PagerDuty incident pd_incident_id:00000000000000
-pd_service_name:Teleport Access Request Notifications
-request_id:00000000-0000-0000-0000-000000000000 request_op:put
-request_state:PENDING pagerduty/app.go:366
-```
-
-In PagerDuty, you will see a new incident containing information about the
-Access Request:
-
-![PagerDuty dashboard showing an Access
-Request](../../../../img/enterprise/plugins/pagerduty/new-access-req-incident.png)
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-<Admonition title="Auditing Access Requests">
-
-When the PagerDuty plugin sends a notification, anyone who receives the
-notification can follow the enclosed link to an Access Request URL. While users
-must be authorized via their Teleport roles to review Access Request, you
-should still check the Teleport audit log to ensure that the right users are
-reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-### Trigger an auto-approval
-
-As your Teleport user, create an Access Request for the `demo-role` role.
-
-You will see a log similar to the following on your PagerDuty plugin host:
-
-```
-INFO   Successfully submitted a request approval
-pd_user_email:myuser@example.com pd_user_name:My User
-request_id:00000000-0000-0000-0000-000000000000 request_op:put
-request_state:PENDING pagerduty/app.go:511
-```
-
-Your Access Request will appear as `APPROVED`:
-
-```code
-$ tsh requests ls
-ID                                   User               Roles     Created (UTC)       Status
------------------------------------- ------------------ --------- ------------------- --------
-00000000-0000-0000-0000-000000000000 myuser@example.com demo-role 12 Aug 22 18:30 UTC APPROVED
-```
-
-## Step 8/8. Set up systemd
-
-This section is only relevant if you are running the Teleport PagerDuty plugin
-on a Linux host.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd. Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!examples/systemd/plugins/teleport-pagerduty.service!)
-```
-
-Save this as `teleport-pagerduty.service` in either `/usr/lib/systemd/system/`
-or another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-pagerduty
-$ sudo systemctl start teleport-pagerduty
-```
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx b/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx
deleted file mode 100644
index 41bfe9056136a..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx
+++ /dev/null
@@ -1,412 +0,0 @@
----
-title: Run the Slack Access Request Plugin
-description: How to set up Teleport's Slack plugin for privilege elevation approvals.
----
-
-This guide will explain how to set up Slack to receive Access Request messages
-from Teleport. Teleport's Slack integration notifies individuals and channels of
-Access Requests. Users are then directed to log in to the Teleport cluster where
-they can approve and deny Access Requests, making it easier to implement security 
-best practices without compromising productivity.
-
-<details>
-<summary>This integration is hosted on Teleport Cloud</summary>
-
-(!docs/pages/includes/plugins/enroll.mdx name="the Slack integration"!)
-
-</details>
-
-![The Slack Access Request plugin](../../../../img/enterprise/plugins/slack/diagram.png)
-
-Here is an example of sending an Access Request via Teleport's Slack plugin:
-
-<video controls>
-  <source
-    src="../../../img/enterprise/plugins/slack/slack.mp4"
-    type="video/mp4"
-  />
-
-  <source
-    src="../../../img/enterprise/plugins/slack/slack.webm"
-    type="video/webm"
-  />
-
-  Your browser does not support the video tag.
-</video>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- Slack admin privileges to create an app and install it to your workspace. Your
-  Slack profile must have the "Workspace Owner" or "Workspace Admin" banner
-  below your profile picture.
-- Either a Linux host or Kubernetes cluster where you will run the Slack plugin.
-
-(!/docs/pages/includes/tctl.mdx!)
-
-## Step 1/8. Define RBAC resources
-
-Before you set up the Slack plugin, you will need to enable Role Access Requests
-in your Teleport cluster.
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 2/8. Install the Teleport Slack plugin
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="slack"!)
-
-## Step 3/8. Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-## Step 4/8. Export the access plugin identity
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-slack-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-slack-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/8. Register a Slack app
-
-The Access Request plugin for Slack receives Access Request events from the
-Teleport Auth Service, formats them into Slack messages, and sends them to the
-Slack API to post them in your workspace. For this to work, you must register a
-new app with the Slack API.
-
-### Create your app
-
-Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new
-Slack app. Click "Create an App", then "From scratch". Fill in the form as shown
-below:
-
-![Create Slack App](../../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)
-
-The "App Name" should be "Teleport". Click the "Development Slack Workspace"
-dropdown and choose the workspace where you would like to see Access Request
-messages.
-
-### Generate an OAuth token with scopes
-
-Next, configure your application to authenticate to the Slack API. We will do
-this by generating an OAuth token that the plugin will present to the Slack API.
-
-We will restrict the plugin to the narrowest possible permissions by using OAuth
-scopes. The Slack plugin needs to post messages to your workspace. It also needs
-to read usernames and email addresses in order to direct Access Request
-notifications from the Auth Service to the appropriate Teleport users in Slack.
-
-After creating your app, the Slack website will open a console where you can
-specify configuration options. On the sidebar menu under "Features", click
-"OAuth & Permissions".
-
-Scroll to the "Scopes" section and click "Add an OAuth Scope" for each of the
-following scopes:
-
-- `chat:write`
-- `incoming-webhook`
-- `users:read`
-- `users:read.email`
-
-The result should look like this:
-
-![API Scopes](../../../../img/enterprise/plugins/slack/api-scopes.png)
-
-After you have configured scopes for your plugin, scroll back to the top of the
-OAuth & Permissions page, find the "OAuth Tokens for Your Workspace" section,
-and click "Install to Workspace". You will see a summary of the permission you
-configured for the Slack plugin earlier.
-
-In "Where should Teleport post?", choose "Slackbot" as the default channel the
-plugin will post to. The plugin will post here when sending direct messages.
-Later in this guide, we will configure the plugin to post in other channels as
-well.
-
-After submitting this form, you will see an OAuth token in the "OAuth &
-Permissions" tab under "Tokens for Your Workspace":
-
-![OAuth Tokens](../../../../img/enterprise/plugins/slack/OAuth.png)
-
-You will use this token later when configuring the Slack plugin.
-
-## Step 6/8. Configure the Teleport Slack plugin
-
-At this point, the Teleport Slack plugin has the credentials it needs to
-communicate with your Teleport cluster and the Slack API. In this step, you will
-configure the Slack plugin to use these credentials. You will also configure the
-plugin to notify the right Slack channels when it receives an Access Request
-update.
-
-### Create a configuration file
-
-<Tabs>
-<TabItem label="Executable or Docker">
-The Teleport Slack plugin uses a configuration file in TOML format. Generate a
-boilerplate configuration by running the following command (the plugin will not run
-unless the config file is in `/etc/teleport-slack.toml`):
-
-```code
-$ teleport-slack configure | sudo tee /etc/teleport-slack.toml > /dev/null
-```
-
-This should result in a configuration file like the one below:
-
-```toml
-(!examples/resources/plugins/teleport-slack.toml!)
-```
-</TabItem>
-<TabItem label="Helm Chart">
-The Slack Helm Chart uses a YAML values file to configure the plugin.
-On your local workstation, create a file called `teleport-slack-helm.yaml`
-based on the following example:
-
-```toml
-(!examples/resources/plugins/teleport-slack-helm.yaml!)
-```
-
-</TabItem>
-</Tabs>
-
-### Edit the configuration file
-
-Open the configuration file created for the Teleport Slack plugin and update the following fields:
-
-**`[teleport]`**
-
-The Slack plugin uses this section to connect to your Teleport cluster:
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
-
-**`[slack]`**
-
-`token`: Open [`https://api.slack.com/apps`](https://api.slack.com/apps), find
-the Slack app you created earlier, navigate to the "OAuth & Permissions" tab,
-copy the "Bot User OAuth Token", and paste it into this field.
-
-**`[role_to_recipients]`**
-
-The `role_to_recipients` map configure the channels that the Slack plugin will
-notify when a user requests access to a specific role. When the Slack plugin
-receives an Access Request from the Auth Service, it will look up the role being
-requested and identify the Slack channels to notify.
-
-<Tabs>
-<TabItem label="Executable or Docker">
-Here is an example of a `role_to_recipients` map. Each value can be a
-single string or an array of strings:
-
-```toml
-[role_to_recipients]
-"*" = "admin-slack-channel"
-"dev" = ["dev-slack-channel", "admin-slack-channel"]
-"dba" = "alex@gmail.com"
-```
-</TabItem>
-<TabItem label="Helm Chart">
-In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
-and uses the following format, where keys are strings and values are arrays of
-strings:
-
-```yaml
-roleToRecipients:
-  "*": ["admin-slack-channel"]
-  "dev":
-    - "dev-slack-channel"
-    - "admin-slack-channel"
-  "dba": ["alex@gmail.com"]
-```
-</TabItem>
-</Tabs>
-
-In the `role_to_recipients` map, each key is the name of a Teleport role. Each
-value configures the Slack channel (or channels) to notify. Each string must be
-either the name of a Slack channel (including a user's direct message channel)
-or the email address of a Slack user. If the recipient is an email address, the
-Slack plugin will use that email address to look up a direct message channel.
-
-The `role_to_recipients` map must also include an entry for `"*"`, which the
-plugin looks up if no other entry matches a given role name. In the example
-above, requests for roles aside from `dev` and `dba` will notify the
-`admin-slack-channel` channel.
-
-<details>
-<summary>Suggested reviewers</summary>
-
-Users can suggest reviewers when they create an Access Request, e.g.,:
-
-```code
-$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
-```
-
-If an Access Request includes suggested reviewers, the Slack plugin will add
-these to the list of channels to notify. If a suggested reviewer is an email
-address, the plugin will look up the direct message channel for that
-address and post a message in that channel.
-
-</details>
-
-Configure the Slack plugin to notify you when a user requests the `editor` role
-by adding the following to your `role_to_recipients` config (replace
-`TELEPORT_USERNAME` with the user you assigned the `editor-reviewer` role
-earlier):
-
-<Tabs>
-<TabItem label="Executable or Docker">
-```toml
-[role_to_recipients]
-"*" = "access-requests"
-"editor" = "TELEPORT_USERNAME"
-```
-</TabItem>
-<TabItem label="Helm Chart">
-```yaml
-roleToRecipients:
-  "*": "access-requests"
-  "editor": "TELEPORT_USERNAME"
-```
-</TabItem>
-</Tabs>
-
-Either create an `access-requests` channel in your Slack workspace or rename the
-value of the `"*"` key to an existing channel.
-
-### Invite your Slack app
-
-Once you have configured the channels that the Slack plugin will notify when it
-receives an Access Request, you will need to ensure that the plugin can post in
-those channels.
-
-You have already configured the plugin to send direct messages as Slackbot. For
-any other channel you mention in your `role_to_recipients` map, you will need
-to invite the plugin to that channel. Navigate to each channel and enter `/invite
-@teleport` in the message box.
-
-## Step 7/8. Test your Slack app
-
-Once Teleport is running, you've created the Slack app, and the plugin is
-configured, you can now run the plugin and test the workflow.
-
-<Tabs>
-<TabItem label="Executable">
-Start the plugin:
-
-```code
-$ teleport-slack start
-```
-
-If everything works fine, the log output should look like this:
-
-```code
-$ teleport-slack start
-INFO   Starting Teleport Access Slack Plugin 7.2.1: slack/app.go:80
-INFO   Plugin is ready slack/app.go:101
-```
-</TabItem>
-<TabItem label="Docker">
-run the plugin:
-
-```code
-$ docker run -v <path-to-config>:/etc/teleport-slack.toml public.ecr.aws/gravitational/teleport-plugin-slack:(=teleport.version=) start
-```
-</TabItem>
-<TabItem label="Helm Chart">
-Install the plugin:
-
-```code
-$ helm upgrade --install teleport-plugin-slack teleport/teleport-plugin-slack --values teleport-slack-helm.yaml
-```
-
-To inspect the plugin's logs, use the following command:
-
-```code
-$ kubectl logs deploy/teleport-plugin-slack
-```
-
-Debug logs can be enabled by setting `log.severity` to `DEBUG` in
-`teleport-slack-helm.yaml` and executing the `helm upgrade ...` command
-above again. Then you can restart the plugin with the following command:
-
-```code
-$ kubectl rollout restart deployment teleport-plugin-slack
-```
-</TabItem>
-</Tabs>
-
-Create an Access Request and check if the plugin works as expected with the
-following steps.
-
-### Create an Access Request
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-The user you configured earlier to review the request should receive a direct
-message from "Teleport" in Slack allowing them to visit a link in the Teleport
-Web UI and either approve or deny the request.
-
-### Resolve the request
-
-(!docs/pages/includes/plugins/resolve-request.mdx!)
-
-Once the request is resolved, the Slack bot will add an emoji reaction of ✅ or
-❌ to the Slack message for the Access Request, depending on whether the request
-was approved or denied.
-
-<Admonition type="info" title="Auditing Access Requests">
-
-When the Slack plugin posts an Access Request notification to a channel, anyone
-with access to the channel can view the notification and follow the link. While
-users must be authorized via their Teleport roles to review Access Requests, you
-should still check the Teleport audit log to ensure that the right users are
-reviewing the right requests.
-
-When auditing Access Request reviews, check for events with the type `Access
-Request Reviewed` in the Teleport Web UI.
-
-</Admonition>
-
-## Step 8/8. Set up systemd
-
-This section is only relevant if you are running the Teleport Slack plugin on a
-Linux host.
-
-In production, we recommend starting the Teleport plugin daemon via an init
-system like systemd.  Here's the recommended Teleport plugin service unit file
-for systemd:
-
-```ini
-(!examples/systemd/plugins/teleport-slack.service!)
-```
-
-Save this as `teleport-slack.service` in either `/usr/lib/systemd/system/` or
-another [unit file load
-path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
-supported by systemd.
-
-Enable and start the plugin:
-
-```code
-$ sudo systemctl enable teleport-slack
-$ sudo systemctl start teleport-slack
-```
-
-## Next steps
-
-- Read our guides to configuring [Resource Access
-    Requests](../access-requests/resource-requests.mdx) and [Role Access
-    Requests](../access-requests/role-requests.mdx) so you can get the most out
-    of your Access Request plugins.
diff --git a/docs/pages/admin-guides/access-controls/access-requests/access-requests.mdx b/docs/pages/admin-guides/access-controls/access-requests/access-requests.mdx
deleted file mode 100644
index a05b91b1c3db7..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-requests/access-requests.mdx
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: Just-in-Time Access Requests
-description: Use just-in-time Access Requests to request elevated privileges.
-layout: tocless-doc
----
-
-Just-in-time Access Requests allow Teleport users to request access to a
-resource or role depending on need. The request can then be approved or denied
-based on a configurable number of approvers.
-
-You can use Access Requests to implement the principle of least privilege in
-your organization, leaving an attacker with no permanent admins to target. Users
-receive elevated privileges for a limited period of time. Request approvers can
-be configured with limited cluster access so they are not high value targets.
-
-Access Requests are designed to provide temporary permissions to users. If you
-want to grant longstanding permissions to a group of users, with the option to
-renew these permissions after a recurring interval (such as three months),
-consider [Access Lists](../access-lists/access-lists.mdx). 
-
-## See how Access Requests work
-
-Access Requests support two main use cases: **Role Access Requests**
-and **Resource Access Requests**.
-
-With Role Access Requests, engineers can request temporary credentials with
-elevated roles in order to perform critical system-wide tasks.
-
-[Get started with Role Access Requests](role-requests.mdx).
-
-With Resource Access Requests, engineers can easily get access to only the
-individual resources they need, when they need it.
-
-[Get started with Resource Access Requests](resource-requests.mdx).
-
-## Configure Access Requests
-
-You can configure all aspects of the Access Request lifecycle in Teleport,
-including:
-
-- When a user must make a request.
-- What permissions a user can request.
-- How long elevated permissions can last.
-- How many users can approve or deny different kinds of requests.
-
-Read the [Access Request
-Configuration](access-request-configuration.mdx) guide for an
-overview of the configuration options available for Access Requests.
-
-## Teleport Community Edition users
-
-Just-in-time Access Requests are a feature of Teleport Enterprise. Teleport
-Community Edition users can get a preview of how Access Requests work by
-requesting a role via the Teleport CLI. Full Access Request functionality,
-including Resource Access Requests managing Access Requests via the Web UI are
-available in Teleport Enterprise.
-
-For information on how to use Just-in-time Access Requests with Teleport Community 
-Edition, see [Teleport Community Access Requests](oss-role-requests.mdx).
-
-
diff --git a/docs/pages/admin-guides/access-controls/access-requests/automatic-reviews.mdx b/docs/pages/admin-guides/access-controls/access-requests/automatic-reviews.mdx
deleted file mode 100644
index 186cefe82bd8f..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-requests/automatic-reviews.mdx
+++ /dev/null
@@ -1,154 +0,0 @@
----
-title: Configure Automatic Reviews
-description: Describes how to configure Access Monitoring Rules for Automatic Reviews.
----
-
-Teleport supports automatic reviews of role Access Requests. This
-feature enables teams to enforce a zero standing privilege policy, while
-still allowing users to receive temporary access without manual approval.
-
-<Admonition type="note" title="resource access request support">
-  Automatic reviews is not currently supported with resource Access Requests.
-  This functionality will be enabled in a future Teleport release.
-</Admonition>
-
-## How it works
-
-Automatic reviews are triggered by Access Monitoring Rules. These rules instruct
-Teleport to monitor Access Requests and automatically submit a review
-when certain conditions (such as requested roles or user traits) are met.
-
-For example, an Access Monitoring Rule can perform an automatic Access Request
-approval when a user with the Teleport traits or IdP attribute `team: demo`
-requests access to the `access` role.
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- This feature requires Teleport Identity Governance.
-
-## Step 1/4. Create a requester role and user
-
-In this example, we'll first create:
-- A role named `demo-access-request`, which allows requesting access to the
-`access` role.
-- A user named `demo-access-requester`, assigned the above role.
-
-### Create the role
-
-Create a role configuration file named `demo-role.yaml`:
-```yaml
-# demo-role.yaml
-kind: role
-version: v7
-metadata:
-  name: demo-access-request
-spec:
-  allow:
-    request:
-      roles:
-      - access
-      search_as_roles:
-      - access
-```
-
-Create the role with:
-```code
-$ tctl create demo-role.yaml
-```
-
-### Create the user
-
-Use the following command to create the user and assign the role:
-```code
-$ tctl users add --roles=demo-access-request demo-access-requester
-```
-
-Alternatively, you can assign the role after creating the user:
-
-  (!docs/pages/includes/add-role-to-user.mdx role="demo-access-request" user="\`demo-access-requester\`"!)
-
-## Step 2/4. Assign user traits
-
-To allow automatic review rules to evaluate the requesting user, assign them
-traits via the Teleport Web UI.
-
-1. Go to **Zero Trust Access** -> **Users**
-2. Next to `demo-access-requester`, click **Options** -> **Edit...**
-3. Click **Add user trait**, and set:
-   - Key: `team`
-   - Value: `demo`
-4. Click **Save**
-5. Verify that the user has been updated with the desired trait.
-
-![Edit User Traits](../../../../img/access-controls/automatic-reviews/users-edit.png)
-
-When adding user traits, you can enter any keys and values. The user trait form
-does not support wildcard or regular expressions.
-
-<Admonition type="tip" title="SSO users">
-  Automatic reviews are compatible with SSO users and the attributes provided
-  by the IdP.
-</Admonition>
-
-## Step 3/4. Create Access Monitoring Rule
-
-Next, define the automatic review rule via the Teleport Web UI.
-
-1. Go to **Identity Governance** -> **Access Requests** -> **View Access Monitoring Rules**
-2. Click **Create Access Monitoring Rule** -> **Automatic Review Rule**
-3. Configure the rule and set:
-   - **Name of roles to match**: `access`
-   - **User Traits**: `team: demo`
-   - **Review decision**: `APPROVED`
-4. Click **Create Rule**
-
-![Create Automatic Review Rule Editor](../../../../img/access-controls/automatic-reviews/create-automatic-review-rule.png)
-
-This Access Monitoring Rule will ensure that Access Requests for the `access`
-role will be automatically reviewed for approval if the Teleport user traits
-requirements are satisfied. In this case, any user with the traits `team: demo`
-will satisfy the requirement.
-
-## Step 4/4. Verify automatic review rule
-
-To verify the new Access Monitoring Rule, create an Access Request via the Teleport
-Web UI.
-1. Log in as `demo-access-requester`
-2. Go to **Access Requests** and click **New Access Request**
-3. Change the request type from **Resources** to **Roles**
-4. Add the `access` role to the Access Request
-5. Click **Proceed to Request**, then **Submit Request**
-
-![Create Access Request](../../../../img/access-requests/new-role-request.png)
-
-At this point, the new Access Request should have been created, automatically
-reviewed, and transitioned into an `APPROVED` state. Navigate **Back to Listings**
-and verify the Access Request status. It might take a second for the review to
-process, so you may have to refresh the page.
-
-![View Access Requests](../../../../img/access-controls/automatic-reviews/view-access-requests.png)
-
-## Troubleshooting
-
-### Conflicting automatic review rules
-
-Automatic review rules can automatically approve or deny Access Requests based
-on the selected review decision. If an Access Request meets the conditions for
-both an approval rule and a denial rule, the denial rule takes precedence.
-
-### Resource access requests
-
-Automatic review rules are not currently supported for resource Access Requests.
-These rules will not be applied to any Access Requests that include a resource
-other than a role.
-
-## Next Steps
-
-- For more configuration options with Access Monitoring Rules, refer to the
-  [Access Monitoring Rules Reference](../../../reference/access-controls/access-monitoring-rules.mdx).
-- For configuration with Teleport Terraform Provider, refer to the
-  [Terraform Resources Index](../../../reference/terraform-provider/resources/access_monitoring_rule.mdx)
-- For configuration options with SSO, refer to the
-  [Single Sign-On Guides](../sso/sso.mdx)
diff --git a/docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx b/docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx
deleted file mode 100644
index 489d283b8cc13..0000000000000
--- a/docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx
+++ /dev/null
@@ -1,684 +0,0 @@
----
-title: Resource Access Requests
-description: Teleport allows users to request access to specific resources from the CLI or UI. Requests can be escalated via ChatOps or anywhere else via our flexible Authorization Workflow API.
-tocDepth: 3
----
-
-With Teleport Resource Access Requests, users can request access to specific
-resources without needing to know anything about the roles or RBAC controls used
-under the hood.
-The Access Request API makes it easy to dynamically approve or deny these
-requests.
-
-Just-in-time Access Requests are a feature of Teleport Enterprise.
-Teleport Community Edition users can get a preview of how Access Requests work by
-requesting a role via the Teleport CLI. Full Access Request functionality,
-including Resource Access Requests and an intuitive and searchable UI are
-available in Teleport Enterprise.
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/6. Grant roles to users
-
-The built-in `requester` and `reviewer` roles have permissions to, respectively,
-open and review Access Requests. Grant the `requester` and `reviewer` roles to
-existing users, or create new users to test this feature. Make sure the
-requester has a valid `login` so that they can view and access SSH nodes.
-
-For the rest of the guide we will assume that the `requester` role has been
-granted to a user named `alice` and the `reviewer` role has been granted to a
-user named `bob`.
-
-1. Assign the `requester` role to a user named `alice`:
-
-   (!docs/pages/includes/add-role-to-user.mdx role="requester" user="\`alice\`"!)
-
-1. Repeat these steps to assign the `reviewer` role to a user named `bob`.
-
-<Admonition type="tip">
-
-Consider defining custom roles to limit the scope of a requester or reviewer's
-permissions. Read the [Access Request
-Configuration](./access-request-configuration.mdx) guide for available options.
-
-</Admonition>
-
-## Step 2/6. Search for resources
-
-First, log in as `alice`.
-
-```code
-$ tsh login --proxy teleport.example.com --user alice
-```
-
-Notice that `tsh ls` returns an empty list, because `alice` does not have access to any resources by default.
-```code
-$ tsh ls
-Node Name Address Labels
---------- ------- ------
-```
-
-Then try searching for all available ssh nodes.
-
-```code
-$ tsh request search --kind node
-Name                                 Hostname    Labels       Resource ID
------------------------------------- ----------- ------------ ------------------------------------------------------
-b1168402-9340-421a-a344-af66a6675738 iot         test=test    /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738
-bbb56211-7b54-4f9e-bee9-b68ea156be5f node        test=test    /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f
-
-To request access to these resources, run
-> tsh request create --resource /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738 --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
-    --reason <request reason>
-```
-
-You can search for resources of kind `node`, `kube_cluster`, `db`, `app`, and
-`windows_desktop`. Teleport also supports searching and requesting access to
-resources within Kubernetes clusters.
-
-<details>
-<summary>List of supported Kubernetes resources</summary>
-
-Teleport supports searching and requesting access to the following Kubernetes resources:
-
-<Admonition
-  type="tip"
-  title="Resource Access Requests to Kubernetes Namespaces"
->
-
-Requesting access to a Kubernetes namespace allows you to access all resources
-in that namespace, including the supported Kubernetes resources listed below.
-However, it prevents you from access any resources belonging to another namespace.
-
-</Admonition>
-
-- `pod`
-- `secret`
-- `configmap`
-- `namespace`
-- `service`
-- `serviceaccount`
-- `kube_node`
-- `persistentvolume`
-- `persistentvolumeclaim`
-- `deployment`
-- `replicaset`
-- `statefulset`
-- `daemonset`
-- `clusterrole`
-- `kube_role`
-- `clusterrolebinding`
-- `rolebinding`
-- `cronjob`
-- `job`
-- `certificatesigningrequest`
-- `ingress`
-
-
-</details>
-
-Advanced filters and queries are supported. See our
-[filtering reference](../../../reference/cli/cli.mdx) for more information.
-
-Try narrowing your search to a specific resource you want to access.
-
-```code
-$ tsh request search --kind node --search iot
-Name                                 Hostname    Labels       Resource ID
------------------------------------- ----------- ------------ ------------------------------------------------------
-b1168402-9340-421a-a344-af66a6675738 iot         test=test    /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738
-
-To request access to these resources, run
-> tsh request create --resource /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738 \
-    --reason <request reason>
-```
-
-## Step 3/6. Request access to a resource
-
-Copy the command output by `tsh request search` in the previous step, optionally filling in a request reason.
-
-```code
-$ tsh request create --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
-    --reason "responding to incident 123"
-Creating request...
-Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
-Username:   alice
-Roles:      access
-Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
-Reason:     "responding to incident 123"
-Reviewers:  [none] (suggested)
-Status:     PENDING
-
-hint: use 'tsh login --request-id=<request-id>' to login with an approved request
-
-Waiting for request approval...
-
-```
-
-The command will automatically wait until the request is approved.
-
-## Step 4/6. Approve the Access Request
-
-First, log in as `bob`.
-
-```code
-$ tsh login --proxy teleport.example.com --user bob
-```
-
-Then list, review, and approve the Access Request.
-
-```code
-$ tsh request ls
-ID                                   User  Roles  Resources                   Created At (UTC)    Status
------------------------------------- ----- ------ --------------------------- ------------------- -------
-f406f5d8-3c2a-428f-8547-a1d091a4ddab alice access ["/teleport.example.... [+] 23 Jun 22 18:25 UTC PENDING
-
-[+] Requested resources truncated, use `tsh request show <request-id>` to view the full list
-
-hint: use 'tsh request show <request-id>' for additional details
-      use 'tsh login --request-id=<request-id>' to login with an approved request
-$ tsh request show f406f5d8-3c2a-428f-8547-a1d091a4ddab
-Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
-Username:   alice
-Roles:      access
-Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
-Reason:     "responding to incident 123"
-Reviewers:  [none] (suggested)
-Status:     PENDING
-
-hint: use 'tsh login --request-id=<request-id>' to login with an approved request
-$ tsh request review --approve f406f5d8-3c2a-428f-8547-a1d091a4ddab
-Successfully submitted review.  Request state: APPROVED
-```
-
-<Admonition type="tip">
-Check out our
-[Access Request Integrations](#integrating-with-an-external-tool)
-to notify the right people about new Access Requests.
-</Admonition>
-
-## Step 5/6. Access the requested resource
-
-`alice`'s `tsh request create` command should resolve now that the request has been approved.
-
-```code
-$ tsh request create --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
-    --reason "responding to incident 123"
-Creating request...
-Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
-Username:   alice
-Roles:      access
-Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
-Reason:     "responding to incident 123"
-Reviewers:  [none] (suggested)
-Status:     PENDING
-
-hint: use 'tsh login --request-id=<request-id>' to login with an approved request
-
-Waiting for request approval...
-
-Approval received, getting updated certificates...
-
-> Profile URL:        https://teleport.example.com
-  Logged in as:       alice
-  Active requests:    f406f5d8-3c2a-428f-8547-a1d091a4ddab
-  Cluster:            teleport.example.com
-  Roles:              access, requester
-  Logins:             alice
-  Kubernetes:         disabled
-  Allowed Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
-  Valid until:        2022-06-23 22:46:22 -0700 PDT [valid for 11h16m0s]
-  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-`alice` can now view and access the node.
-
-```code
-$ tsh ls
-Node Name Address   Labels
---------- --------- ---------
-iot       [::]:3022 test=test
-
-$ tsh ssh alice@iot
-iot:~ alice$
-```
-
-## Step 6/6. Resume regular access
-
-While logged in with a Resource Access Request, users will be blocked from access to any other resources.
-This is necessary because their certificate now contains an elevated role,
-so it is restricted to only allow access to the resources they were specifically approved for.
-Use the `tsh request drop` command to "drop" the request and resume regular access.
-
-```code
-$ tsh request drop
-```
-
-When you drop an Access Request, Teleport issues a new user certificate. The new
-certificate retains the expiration of the previous certificate. Once your
-session expires and you reauthenticate to Teleport, you receive a user
-certificate with your user's originally configured time to live.
-
-## Next Steps
-
-### Automatically request access for SSH
-
-Once you have configured Resource Access Requests,
-`tsh ssh` is able to automatically create a Resource Access Request for you when access is denied,
-allowing you to skip the `tsh request search` and `tsh request create` steps.
-
-```code
-$ tsh ssh alice@iot
-ERROR: access denied to alice connecting to iot on cluster teleport.example.com
-
-You do not currently have access to alice@iot, attempting to request access.
-
-Enter request reason: please
-Creating request...
-Request ID: ab43fc70-e893-471b-872e-ae65eb24fd76
-Username:   alice
-Roles:      access
-Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
-Reason:     "please"
-Reviewers:  [none] (suggested)
-Status:     PENDING
-
-hint: use 'tsh login --request-id=<request-id>' to login with an approved request
-
-Waiting for request approval...
-
-Approval received, reason="okay"
-Getting updated certificates...
-
-iot:~ alice$
-```
-
-### Restrict the resources a user can request access to
-
-In this guide, we showed you how to enable a user to search for resources to
-request access to. To do so, we assigned the user a Teleport role with the
-`search_as_roles` field set to the preset `access` role.
-
-You can impose further restrictions on the resources a user is allowed to
-search by assigning `search_as_roles` to a more limited role. Below, we will
-show you which permissions you must set to restrict a user's ability to search
-for different resources.
-
-To restrict access to a particular resource using a role similar to the ones
-below, edit one of the user's roles so the `search_as_roles` field includes the
-role you have created.
-
-For full details on how to use Teleport roles to configure RBAC, see the
-[Access Controls Reference](../../../reference/access-controls/roles.mdx).
-
-#### `node`
-
-You can restrict access to searching `node` resources by assigning values to the
-`node_labels` field in the `spec.allow` or `spec.deny` fields. The following
-role allows access to SSH Service instances with the `env:staging` label.
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: staging-access
-spec:
-  allow:
-    node_labels:
-      env: staging
-    logins:
-      - "{{internal.logins}}"
-  options:
-    # Only allows the requester to use this role for 1 hour from time of request.
-    max_session_ttl: 1h
-```
-
-#### `kube_cluster`
-
-You can restrict access to searching `kube_cluster` resources by assigning
-values to the `kubernetes_labels` field in the `spec.allow` or `spec.deny`
-fields.
-
-The following role allows access to Kubernetes clusters with the `env:staging`
-label:
-
-```yaml
-kind: role
-metadata:
-  name: kube-access
-version: v7
-spec:
-  allow:
-    kubernetes_labels:
-      'env': 'staging'
-    kubernetes_resources:
-      - kind: '*'
-        namespace: '*'
-        name: '*'
-  deny: {}
-```
-
-#### Kubernetes resources
-
-You can restrict access to Kubernetes resources by assigning values to the
-`kubernetes_resources` field in the `spec.allow` or `spec.deny` fields.
-
-The following role allows access to Kubernetes pods with the name `nginx` in any
-namespace, and all pods in the `dev` namespace:
-
-```yaml
-kind: role
-metadata:
-  name: kube-access
-version: v7
-spec:
-  allow:
-    kubernetes_labels:
-      '*':'*'
-    kubernetes_resources:
-      - kind: pod
-        namespace: "*"
-        name: "nginx*"
-      - kind: pod
-        namespace: "dev"
-        name: "*"
-    kubernetes_groups:
-      - viewers
-  deny: {}
-```
-
-##### Preventing unintended access to Kubernetes resources
-
-If you are setting up a Teleport role to enable just-in-time access to a
-specific Kubernetes resources, you should set the role's `kubernetes_groups` and
-`kubernetes_users` to a role that has no access to Kubernetes resource beside
-the Kubernetes resources that Teleport is able to restrict access for.
-
-This is because, if a user requests access to a Kubernetes pod, and the request
-is approved, the Teleport Kubernetes Service will use the `kubernetes_groups`
-and `kubernetes_users` fields in the role to add impersonation headers to the user's
-requests to a Kubernetes API server. Under these conditions, Teleport will be able
-to restrict access to all Kubernetes resources kinds mentioned above except for
-the desired `pod`. Teleport is also able to restrict access to namespaced-scoped
-custom resources but not cluster-scoped custom resources - CRDs resources that
-are cluster-scoped will be accessible to the user if the principals in the
-`kubernetes_users` and `kubernetes_groups` fields have access to them.
-
-Requesting access to a Kubernetes Namespace allows you to access all resources
-in that namespace but you won't be able to access any other supported resources
-in the cluster.
-
-##### Restrict Access Requests to specific Kubernetes resource kinds
-
-The `request.kubernetes_resources` field allows you to restrict what kinds of Kubernetes 
-resources a user can request access to. Configuring this field to any value will disallow
-requesting access to the entire Kubernetes cluster.
-
-If the `request.kubernetes_resources` field is not configured, then a user can request access 
-to any Kubernetes resources, including the entire Kubernetes cluster.
-
-The following role allows users to request access to Kubernetes namespaces. 
-Requests for Kubernetes resources other than `namespace` will not be allowed.
-
-```yaml
-kind: role
-metadata:
-  name: requester-kube-access
-version: v7
-spec:
-  allow:
-    request:
-      search_as_roles:
-        - "kube-access"
-      kubernetes_resources:
-        - kind: "namespace"
-```
-
-The following role allows users to request access only to Kubernetes namespaces and/or pods.
-
-```yaml
-kind: role
-metadata:
-  name: requester-kube-access
-version: v7
-spec:
-  allow:
-    request:
-      search_as_roles:
-        - "kube-access"
-      kubernetes_resources:
-        - kind: "namespace"
-        - kind: "pod"
-```
-
-The following role allows users to request access to any specific Kubernetes resources.
-
-```yaml
-kind: role
-metadata:
-  name: requester-kube-access
-version: v7
-spec:
-  allow:
-    request:
-      search_as_roles:
-        - "kube-access"
-      kubernetes_resources:
-        - kind: "*"
-```
-
-See related section about [Kubernetes Resources](../../../enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources) 
-to see a list of supported `kind` values.
-
-The `request.kubernetes_resources` field only restricts what `kinds` of Kubernetes resource requests are allowed.
-To control Kubernetes access to these resources see 
-[Preventing unintended access to Kubernetes resources](#preventing-unintended-access-to-kubernetes-resources) 
-section for more details.
-
-#### `db`
-
-You can restrict access to searching `db` resources by assigning values to the
-`db_labels` field in the `spec.allow` or `spec.deny` fields.
-
-The following role allows access to databases with the `environment:dev` or
-`environment:stage` labels:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: developer
-spec:
-  allow:
-    db_labels:
-      environment: ["dev", "stage"]
-
-    # Database account names this role can connect as.
-    db_users: ["viewer", "editor"]
-    db_names: ["*"]
-```
-
-#### `app`
-
-You can restrict access to searching `app` resources by assigning values to the
-`app_labels` field in the `spec.allow` or `spec.deny` fields.
-
-The following role allows access to all applications except for those in
-`env:prod`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  allow:
-    app_labels:
-      "*": "*"
-  deny:
-    app_labels:
-      env: "prod"
-```
-
-#### `windows_desktop`
-
-You can restrict access to searching `windows_desktop` resources by assigning
-values to the `windows_desktop_labels` field in the `spec.allow` or `spec.deny`
-fields.
-
-The following role allows access to all Windows desktops with the
-`environment:dev` or `environment:stage` labels.
-
-```yaml
-kind: role
-version: v4
-metadata:
-  name: developer
-spec:
-  allow:
-    windows_desktop_labels:
-      environment: ["dev", "stage"]
-
-    windows_desktop_logins: ["{{internal.windows_logins}}"]
-```
-
-### Request access to Kubernetes resources
-
-Teleport users can request access to a Kubernetes resources by running the following
-command, where <Var name="resource-id" /> is the ID of the resource:
-
-```code
-$ tsh request create <Var name="resource-id" />
-```
-
-#### Namespace-scoped resources
-
-For Kubernetes namespaced resources, the `resource-id` is in the following format:
-
-```
-/TELEPORT_CLUSTER/NAMESPACED_KIND/KUBE_CLUSTER/NAMESPACE/RESOURCE_NAME
-```
-
-Teleport supports the following namespaced resources: `pod`, `secret`, `configmap`,
-`service`, `serviceaccount`, `persistentvolumeclaim`, `deployment`, `replicaset`,
-`statefulset`, `daemonset`, `kube_role`, `rolebinding`, `cronjob`, `job`,
-`ingress`.
-
-For example, to request access to a pod called `nginx-1` in the `development`
-namespace, run the following command:
-
-```code
-$ tsh request create --resources /teleport.example.com/pod/mycluster/development/nginx-1
-```
-
-For the `NAMESPACE` and `RESOURCE_NAME` values, you can match ranges of characters by
-supplying a wildcard (`*`) or regular expression. Regular expressions must begin
-with `^` and end with `$`.
-
-For example, to create a request to access all pods in all namespaces that match
-the regular expression `/^nginx-[a-z0-9-]+$/`, run the following command:
-
-```code
-$ tsh request create --resources /teleport.example.com/pod/mycluster/*/^nginx-[a-z0-9-]+$
-```
-
-#### Cluster-scoped resources
-
-For Kubernetes cluster-scoped resources, the `resource-id` is in the following format:
-
-```
-/TELEPORT_CLUSTER/CLUSTER_WIDE_KIND/KUBE_CLUSTER/RESOURCE_NAME
-```
-
-Teleport supports the following cluster-wide resources: `namespace`, `kube_node`,
-`clusterrole`, `clusterrolebinding`, `persistentvolume`, `certificatesigningrequest`.
-
-For example, to request access to a namespace called `prod`, run the following command:
-
-```code
-$ tsh request create --resources /teleport.example.com/namespace/mycluster/prod
-```
-
-For the `RESOURCE_NAME` value, you can match ranges of characters by
-supplying a wildcard (`*`) or regular expression. Regular expressions must begin
-with `^` and end with `$`.
-
-For example, to create a request to access all namespaces prefixed with `dev` match
-the regular expression `/^dev-[a-z0-9-]+$/`, run the following command:
-
-```code
-$ tsh request create --resources /teleport.example.com/namespace/mycluster/^dev-[a-z0-9-]+$
-```
-
-Using cluster-scoped resource requests requires the role under `search_as_roles` to have the correct 
-permissions for the cluster-scoped resource.  This is an example of the required permissions to
-request access only to the namespace `prod` (and all resources within it):
-
-```yaml
-kind: role
-spec:
-  allow:
-    kubernetes_resources:
-    - kind: namespace
-      name: prod
-      verbs:
-      - '*'
-```
-
-#### Search for Kubernetes resources
-
-If a user has no access to a Kubernetes cluster, they can search the list of
-resources in the cluster by running the following command, replacing 
-<Var name="kube-cluster" /> with the name of the Kubernetes cluster and 
-<Var name="namespace" /> with the name of a Kubernetes namespace:
-
-```code
-$ tsh request search --kind=<kind> --kube-cluster=<Var name="kube-cluster" /> \
-[--kube-namespace=<Var name="namespace" />|--all-kube-namespaces]
-Name               Namespace Labels    Resource ID
------------------  --------- --------- ----------------------------------------------------------
-nginx-deployment-0 default   app=nginx /teleport.example.com/pod/local/default/nginx-deployment-0
-nginx-deployment-1 default   app=nginx /teleport.example.com/pod/local/default/nginx-deployment-1
-
-To request access to these resources, run
-> tsh request create --resource /teleport.example.com/pod/local/default/nginx-deployment-0 --resource /teleport.example.com/pod/local/default/nginx-deployment-1 \
-    --reason <request reason>
-```
-
-The list returned includes the name of the resource, the namespace it is in if
-applicable, its labels, and the resource ID.
-Resources included in the list are those that match the `kubernetes_resources`
-field in the user's `search_as_roles`. The user can then:
-
-- Request access to the resources by running the command provided by the `tsh request
-search` command.
-- Edit the command to request access to a subset of the resources.
-- Use a custom request with wildcards or regular expressions.
-
-`tsh request search --kind=<kind>` works even if the user has no permissions to interact
- with the desired Kubernetes cluster, but the user's `search_as_roles` values
-must allow access to the cluster. If the user is unsure of the name of the cluster,
-they can run the following command to search it:
-
-```code
-$ tsh request search --kind=kube_cluster
-Name  Hostname Labels Resource ID
------ -------- ------ ----------------------------------------
-local                 /teleport.example.com/kube_cluster/local
-
-```
-
-### Integrating with an external tool
-
-With Teleport's Access Request plugins, users can manage Access Requests from
-within your organization's existing messaging and project management solutions.
-
-(!docs/pages/includes/access-request-integrations.mdx!)
-
-## Next Steps
-
-- Learn more about [Access Lists](../access-lists/access-lists.mdx)
diff --git a/docs/pages/admin-guides/access-controls/compliance-frameworks/soc2.mdx b/docs/pages/admin-guides/access-controls/compliance-frameworks/soc2.mdx
deleted file mode 100644
index fe932d2098ac3..0000000000000
--- a/docs/pages/admin-guides/access-controls/compliance-frameworks/soc2.mdx
+++ /dev/null
@@ -1,96 +0,0 @@
----
-title: SOC 2 compliance for SSH, Kubernetes, and Databases
-description: How to configure SOC 2-compliant access to SSH, Kubernetes, databases, desktops, and web apps
-h1: SOC 2 Compliance for SSH, Kubernetes, Databases, Desktops, and Web Apps
----
-
-Teleport is designed to meet SOC 2 requirements for the purposes of accessing infrastructure, change management, and system operations. This document outlines a high
-level overview of how Teleport can be used to help your company to become SOC 2 compliant.
-
-<Admonition type="warning">
-
-  SOC 2 compliance features are only available for Teleport Enterprise and
-  Teleport Enterprise Cloud.
-
-</Admonition>
-
-## Achieving SOC 2 Compliance with Teleport
-SOC 2 or Service Organization Controls were developed by the American Institute of CPAs (AICPA). They are based on five trust services criteria: security, availability, processing integrity, confidentiality, and privacy.
-
-## What Key SOC 2 Controls does Teleport help achieve?
-Teleport helps with 4 of the 9 control areas.
-
-### CC6 Control Activities
-Teleport helps with separation of duties using RBAC and restricts access to authorized users
-- Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service.
-
-### CC6 Physical and Logical Access controls
-Teleport issues temporary security credentials according to the user's role.
-
-### CC7 System Operations
-Teleport helps audit and monitor access.
-
-- Audit events and session recordings are securely stored in a vault to prevent tampering.
-- Convert logins, executed commands, deployments and other events into structured audit logs.
-- Monitor, share and join interactive sessions in real-time from the CLI or browser.
-
-### CC8 Change Management
-Teleport helps users elevate their permissions during incidents, RBAC helps limit the need for approvals. The Teleport Slack integration allows for managers to quickly approve temporary SSH Access Requests.
-
-- Let engineers request elevated permissions on the fly without ever leaving the terminal
-- Approve or deny permission requests with ChatOps workflow via Slack or other supported platforms.
-- Extend and customize permission elevation workflow with a simple API and extendable plugin system.
-
-## What Specific Criteria does Teleport Help Satisfy? 
-
-Below is a table of principles and common points of focus listed by [AICPA's official "Trust Services Criteria" reference document](https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf) and how Teleport helps satisfy them.
-
-Each principle has many "Points of Focus" which will apply differently to different products and organizations, talk to an auditor to understand exactly which points of focus apply to your organization.
-
-| Principle Criteria | Point of Focus | Teleport Features |
-| --- | --- | --- |
-| CC6.1 - Restricts Logical Access | Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. | Teleport Enterprise supports robust [Role-based Access Controls (RBAC)](../access-controls.mdx) to: <ul> <li> Control which SSH nodes a user can or cannot access. </li> <li> Control cluster level configuration (session recording, configuration, etc.) </li> <li> Control which UNIX logins a user is allowed to use when logging into a server. </li></ul> |
-| CC6.1 - Identifies and Authenticates Users | Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. | Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service. Connecting locally or remotely is just as easy. |
-| CC6.1 - Considers Network Segmentation | Network segmentation permits unrelated portions of the entity&#39;s information system to be isolated from each other. | [Teleport enables beyond corp network segmentation](../../management/admin/trustedclusters.mdx) <br/><br/> [Connect to nodes behind Firewalls or create reverse tunnels to a proxy server](../../../faq.mdx) |
-| CC6.1 - Manages Points of Access | Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. | [Label Nodes to inventory and create rules](../../management/admin/labels.mdx) <br/><br/> [Create Labels from AWS Tags](../../management/guides/ec2-tags.mdx) <br/><br/>Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. |
-| CC6.1 - Restricts Access to Information Assets | Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. | [Teleport uses Certificates to grant access and create access control rules](../../../core-concepts.mdx) | 
-| CC6.1 - Manages Identification and Authentication | Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. | Teleport makes setting policies for SSH requirements easy since it works in the cloud and on premise with the same authentication security standards. | 
-| CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../../../enroll-resources/agents/join-token.mdx) | 
-| CC6.1 - Uses Encryption to Protect Data | The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. | Teleport Audit logs can use DynamoDB encryption at rest. | 
-| CC6.1 - Protects Encryption Keys | Processes are in place to protect encryption keys during generation, storage, use, and destruction. | Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically  | 
-| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system&#39;s asset owner or authorized custodian. | [Request Approval from the command line](../../../reference/cli/tctl.mdx) <br/><br/> [Build Approval Workflows with Access Requests](../access-requests/access-requests.mdx) <br/><br/> [Use Plugins to send approvals to tools like Slack or Jira](../access-requests/access-requests.mdx) |
-| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](../access-requests/access-requests.mdx) | 
-| CC6.2 - Reviews Appropriateness of Access Credentials | The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
-| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](../access-requests/access-requests.mdx) to get authorization from asset owners. | 
-| CC6.3 - Removes Access to Protected Information Assets | Processes are in place to remove access to protected information assets when an individual no longer requires access. | Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to [revoke access with the Access requests API](../../api/api.mdx) | 
-| CC6.3 - Uses Role-Based Access Controls | Role-based access control is utilized to support segregation of incompatible functions. | [Role based access control (&quot;RBAC&quot;) allows Teleport administrators to grant granular access permissions to users.](../access-controls.mdx) | 
-| CC6.3 - Reviews Access Roles and Rules | The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
-| CC6.6 - Restricts Access | The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted. | Teleport makes it easy to restrict access to common ports like 21, 22 and instead have users [tunnel to the server](../../../faq.mdx) using Teleport. [Teleport uses the following default ports.](../../../reference/networking.mdx) | 
-| CC6.6 - Protects Identification and Authentication Credentials | Identification and authentication credentials are protected during transmission outside system boundaries. | [Yes, Teleport protects credentials outside your network allowing for Zero Trust network architecture](https://goteleport.com/blog/applying-principles-of-zero-trust-to-ssh/) | 
-| CC6.6 - Requires Additional Authentication or Credentials | Additional authentication information or credentials are required when accessing the system from outside its boundaries. | [Yes, Teleport can manage MFA with TOTP, WebAuthn or U2F Standards or connect to your Identity Provider using SAML, OAUTH or OIDC](../sso/sso.mdx) |
-| CC6.6 - Implements Boundary Protection Systems | Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and are monitored to detect such attempts. | [Trusted clusters](../../management/admin/trustedclusters.mdx) | 
-| CC6.7 - Uses Encryption Technologies or Secure Communication Channels to Protect Data | Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points. | [Teleport has strong encryption including a FedRAMP compliant FIPS mode](./fedramp.mdx#start-teleport-in-fips-mode) |
-| CC7.2 - Implements Detection Policies, Procedures, and Tools | Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software. | [Teleport creates detailed SSH Audit Logs with Metadata](../../../reference/monitoring/audit.mdx) <br/><br/> [Use BPF Session Recording to catch malicious program execution](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) |
-| CC7.2 - Designs Detection Measures | Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software. | [Use Enhanced Session Recording to catch malicious program execution, capture TCP connections and log programs accessing files on the system the should not be accessing.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
-| CC7.3 - Communicates and Reviews Detected Security Events | Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary. | [Use Session recording to replay and review suspicious sessions](../../../reference/architecture/session-recording.mdx). | 
-| CC7.3 - Develops and Implements Procedures to Analyze Security Incidents | Procedures are in place to analyze security incidents and determine system impact. | [Analyze detailed logs and replay recorded sessions to determine impact. See exactly what files were accessed during an incident.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
-| CC7.4 - Contains Security Incidents | Procedures are in place to contain security incidents that actively threaten entity objectives. | [Use Teleport to quickly revoke access and contain an active incident](../../access-controls/guides/locking.mdx) <br/><br/> [Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.](../../../connect-your-client/tsh.mdx) |
-| CC7.4 - Ends Threats Posed by Security Incidents | Procedures are in place to mitigate the effects of ongoing security incidents. | [Use Teleport to quickly revoke access and contain an active incident](../../access-controls/guides/locking.mdx)   | 
-| CC7.4 - Obtains Understanding of Nature of Incident and Determines Containment Strategy | An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach. | [Use Teleport’s Session Recording and Replay along with logs to understand what actions led to an incident.](../../../reference/monitoring/audit.mdx) | 
-| CC7.4 - Evaluates the Effectiveness of Incident Response | The design of incident-response activities is evaluated for effectiveness on a periodic basis. | [Use audit logs and session recordings to find pain points in your incident response plan and improve effectiveness](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx). | 
-| CC7.4 - Periodically Evaluates Incidents | Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes. | [Use Session recording and audit logs to find patterns that lead to incidents.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx)  | 
-| CC7.5 - Determines Root Cause of the Event | The root cause of the event is determined. | [Use Session recording and audit logs to find root cause.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
-| CC7.5 - Improves Response and Recovery Procedures | Lessons learned are analyzed and the incident-response plan and recovery procedures are improved. | [Replay Session recordings at your &#39;after action review&#39; or postmortem meetings](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages changes throughout the system life cycle. | Enables a documented software development lifecycle through its integrations with [infrastructure as code tools](../../infrastructure-as-code/infrastructure-as-code.mdx). |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Authorizes Changes, Identifies and Evaluates System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations enable you to authorize changes using GitOps platforms. [Access Requests](../access-requests/access-requests.mdx) enable authorization for elevated privileges. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Designs and Develops Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow you to specify infrastructure access controls as code. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Documents Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow for documenting configuration changes in version control system logs, and a [notification system](../../../connect-your-client/notifications.mdx) allows you to inform end users of system changes. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tracks System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations and audit logging allow you to track the history of configuration changes and [Access Request](../access-requests/access-requests.mdx) approvals in a Teleport cluster. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Configures Software. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to track dynamic resource configurations. [Helm support](../../../reference/helm-reference/helm-reference.mdx) allows you to track configurations for Teleport services on Kubernetes. You can also use version control to manage Teleport [YAML configuration files](../../../reference/config.mdx).|
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tests System Changes. | Teleport's infrastructure as code support and [gRPC API](../../api/api.mdx) make it possible to set up staging environments and automated tests for changes in a Teleport configuration. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Approves System Changes. | [Access Requests](../access-requests/access-requests.mdx) allow approvals to proposed permissions changes, and infrastructure as code support enables you to set up an approval system for configurations. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Deploys System Changes. | [RBAC protections](../../../reference/access-controls/roles.mdx#rbac-for-dynamic-teleport-resources) for API resources allow you to restrict configuration changes to an authorized continuous deployment runner. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Identifies Changes in the Infrastructure, Data, Software, and Procedures Required to Remediate Incidents. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to revert changes. It is also possible for you to [back up the Auth Service backend](../../management/operations/backup-restore.mdx) on self-hosted clusters.|
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Creates Baseline Configuration of IT Technology. |[Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to set up a baseline configuration in a code repository. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Provides Changes Necessary in Emergency Situations. | Admins can use [Access Requests](../access-requests/access-requests.mdx) to obtain temporarily elevated permissions in order to provide changes in emergency situations. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages Patch Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables regular patch changes to configurations. |
diff --git a/docs/pages/admin-guides/access-controls/device-trust/guide.mdx b/docs/pages/admin-guides/access-controls/device-trust/guide.mdx
deleted file mode 100644
index 15433634493ac..0000000000000
--- a/docs/pages/admin-guides/access-controls/device-trust/guide.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Getting Started with Device Trust
-description: Get started with Teleport Device Trust
-videoBanner: gBQyj_X1LVw
----
-
-(!docs/pages/includes/device-trust/support-notice.mdx!)
-
-Device Trust requires two of the following steps to have been configured:
-
-- Device enforcement mode configured via either a role or a cluster-wide config.
-- Trusted device registered and enrolled with Teleport.
-
-In this guide, you will update an existing user profile to assign the preset `require-trusted-device`
-role and then enroll a trusted device into Teleport to access a resource (a test linux server)
-protected with Teleport.
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/device-trust/prereqs.mdx!)
-
-- User with `editor` role.
-  ```code
-  $ tsh status
-  > Profile URL:      (=clusterDefaults.clusterName=):443
-  Logged in as:       (=clusterDefaults.username=)
-  Cluster:            (=clusterDefaults.clusterName=)
-  Roles:              access, auditor, editor
-  Logins:             root, ubuntu, ec2-user
-  Kubernetes:         disabled
-  Valid until:        2023-08-22 03:30:24 -0400 EDT [valid for 11h52m0s]
-  Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
-  ```
-- Access to a linux server (any Linux server you can access via `tsh ssh` will do).
-  ```code
-  $ tsh ls
-  Node Name        Address        Labels
-  ---------------- -------------- --------------------------------------
-  (=clusterDefaults.nodeIP=) ⟵ Tunnel
-
-  # test connection to (=clusterDefaults.nodeIP=)
-  $ tsh ssh root@(=clusterDefaults.nodeIP=)
-  root@(=clusterDefaults.nodeIP=):~#
-  ```
-
-Once the above prerequisites are met, begin with the following step.
-
-## Step 1/2. Update user profile to enforce Device Trust
-
-To enforce Device Trust, a user must be assigned with a role with Device Trust mode "required".
-
-For this guide, we will use the preset `require-trusted-device` role to update current user profile.
-
-Open the user resource in your editor so we can update it with the preset `require-trusted-device` role.
-
-```code
-$ tctl edit users/(=clusterDefaults.username=)
-```
-
-Edit the profile:
-
-```diff
-kind: user
-metadata:
-  id: 1692716146877042322
-  name: (=clusterDefaults.username=)
-spec:
-  created_by:
-    time: "2023-08-14T13:42:22.291972449Z"
-  expires: "0001-01-01T00:00:00Z"
-  roles:
-  - access
-  - auditor
-  - editor
-+ - require-trusted-device # add this line
-  status:
-    is_locked: false
-  ...
-```
-
-Update the user by saving and closing the file in your editor.
-
-Now that the user profile is updated to enforce Device Trust, try to access the test server
-again.
-
-```code
-$ tsh logout; tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
-$ tsh ssh root@(=clusterDefaults.nodeIP=)
-ERROR: access denied to root connecting to (=clusterDefaults.nodeIP=):0
-```
-
-As you can verify from the above step, access to `(=clusterDefaults.nodeIP=)` ssh server,
-which was previously accessible, is now forbidden.
-
-## Step 2/2. Enroll device
-
-To access `(=clusterDefaults.nodeIP=)` server again, you will have to enroll your device.
-
-Enrolling your device is easy, and can be done using `tsh` client:
-
-```code
-$ tsh device enroll --current-device
-Device "(=devicetrust.asset_tag=)"/macOS registered and enrolled
-```
-
-<Admonition type="tip" title="self enrollment">
-  The `--current-device` flag tells `tsh` to enroll the current device. The user must have the preset `editor`
-  or `device-admin` role to be able to self-enroll their device. For users without the `editor` or
-  `device-admin` roles, a device admin must generate the an enrollment token, which can then be
-  used to enroll the device. Learn more about manual device enrollment in the
-  [device management guide](./device-management.mdx#register-a-trusted-device).
-</Admonition>
-
-Relogin to fetch updated certificate with device extension:
-
-```code
-$ tsh logout; tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
-
-$ tsh status
-> Profile URL:        (=clusterDefaults.clusterName=):443
-  Logged in as:       (=clusterDefaults.username=)
-  Cluster:            (=clusterDefaults.clusterName=):443
-  Roles:              access, auditor, editor
-  Logins:             root
-  Kubernetes:         enabled
-  Valid until:        2023-08-22 04:06:53 -0400 EDT [valid for 12h0m0s]
-  Extensions:         login-ip, ... teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
-```
-
-The presence of the `teleport-device-*` extensions shows that the device was successfully authenticated.
-
-Now, let's try to access server (`(=clusterDefaults.nodeIP=)`) again:
-
-```code
-$ tsh ssh root@(=clusterDefaults.nodeIP=)
-root@(=clusterDefaults.nodeIP=):~#
-```
-
-Congratulations! You have successfully configured a Trusted Device and accessed a resource protected with
-Device Trust enforcement.
-
-## Troubleshooting
-
-(!docs/pages/includes/device-trust/troubleshooting.mdx!)
-
-## Next steps
-
-- [Device Management](./device-management.mdx)
-- [Enforcing Device Trust](./enforcing-device-trust.mdx)
-- [Jamf Pro Integration](./jamf-integration.mdx)
-- The role we illustrated in this guide uses the `internal.logins` trait,
-  which Teleport replaces with values from the Teleport local user
-  database. For full details on how traits work in Teleport roles,
-  see the [Access Controls
-  Reference](../../../reference/access-controls/roles.mdx).
-
diff --git a/docs/pages/admin-guides/access-controls/getting-started.mdx b/docs/pages/admin-guides/access-controls/getting-started.mdx
deleted file mode 100644
index cd37227a1debb..0000000000000
--- a/docs/pages/admin-guides/access-controls/getting-started.mdx
+++ /dev/null
@@ -1,253 +0,0 @@
----
-title: Getting Started With Access Controls
-description: Get started using Access Controls.
----
-
-In Teleport, any local, SSO, or robot user can be assigned one or several roles.
-Roles govern access to databases, SSH servers, Kubernetes clusters, Windows
-desktops, and web apps.
-
-We will start with local users and preset roles, assign roles to SSO users, and
-wrap up with creating your own role.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-(!docs/pages/includes/permission-warning.mdx!)
-
-## Step 1/3. Add local users with preset roles
-
-Teleport provides several preset roles:
-
-(!docs/pages/includes/preset-roles-table.mdx!)
-
-<Tabs>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-Invite the local user Alice as cluster `editor`:
-
-```code
-$ tctl users add alice --roles=editor
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-Invite the local user Alice as cluster `editor` and `reviewer`:
-
-```code
-$ tctl users add alice --roles=editor,reviewer
-```
-</TabItem>
-
-</Tabs>
-
-Once Alice signs up, she will be able to edit cluster configuration. You can list
-users and their roles using `tctl users ls`.
-
-<Tabs>
-<TabItem scope={"oss"} label="Teleport Community Edition">
-```code
-$ tctl users ls
-
-# User                 Roles
-# -------------------- --------------
-# alice                editor
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-```code
-$ tctl users ls
-
-# User                 Roles
-# -------------------- --------------
-# alice                editor, reviewer
-```
-</TabItem>
-
-</Tabs>
-
-You can update the user's roles using the `tctl users update` command:
-
-<Tabs>
-<TabItem scope={"oss"} label="Teleport Community Edition">
-```code
-# Once Alice logs back in, she will be able to view audit logs
-$ tctl users update alice --set-roles=editor,auditor
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-```code
-# Once Alice logs back in, she will be able to view audit logs
-$ tctl users update alice --set-roles=editor,reviewer,auditor
-```
-</TabItem>
-
-</Tabs>
-
-Because Alice has two or more roles, permissions from those roles create a union. She
-will be able to act as a system administrator and auditor at the same time.
-
-## Step 2/3. Map SSO users to roles
-
-Next, follow the instructions to set up an authentication connector that maps
-users within your SSO solution to Teleport roles.
-
-### Teleport Enterprise
-
-Create a SAML or OIDC application that Teleport can integrate with, then
-create an authentication connector that maps users within your application to
-Teleport roles.
-
-<Tabs>
-<TabItem label="SAML">
-
-Follow our [SAML Okta Guide](./sso/okta.mdx) to
-create a SAML application.
-
-Save the file below as `okta.yaml` and update the `acs` field.
-Any member in Okta group `okta-admin` will assume a built-in role `admin`.
-
-```yaml
-kind: saml
-version: v2
-metadata:
-  name: okta
-spec:
-  acs: https://tele.example.com/v1/webapi/saml/acs
-  attributes_to_roles:
-  - {name: "groups", value: "okta-admin", roles: ["access"]}
-  entity_descriptor: |
-    <?xml !!! Make sure to shift all lines in XML descriptor
-    with 4 spaces, otherwise things will not work
-```
-
-Create the `saml` resource:
-
-```code
-$ tctl create okta.yaml
-```
-
-</TabItem>
-<TabItem label="OIDC">
-
-Follow our [OIDC guides](./sso/oidc.mdx#identity-providers) to
-create an OIDC application.
-
-Copy the YAML below to a file called `oidc.yaml` and edit the information to
-include the details of your OIDC application.
-
-```yaml
-(!examples/resources/oidc-connector.yaml!)
-```
-
-Create the `oidc` resource:
-
-```code
-$ tctl create okta.yaml
-```
-
-</TabItem>
-</Tabs>
-
-### Teleport Community Edition
-
-Save the file below as `github.yaml` and update the fields. You will need to
-set up a
-[GitHub OAuth 2.0 Connector](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/)
-app. Any member belonging to the GitHub organization `octocats` and on team
-`admin` will be able to assume the built-in role `access`.
-
-```yaml
-kind: github
-version: v3
-metadata:
-  # connector name that will be used with `tsh --auth=github login`
-  name: github
-spec:
-  # client ID of GitHub OAuth app
-  client_id: client-id
-  # client secret of GitHub OAuth app
-  client_secret: client-secret
-  # This name will be shown on UI login screen
-  display: GitHub
-  # Change tele.example.com to your domain name
-  redirect_url: https://tele.example.com:443/v1/webapi/github/callback
-  # Map github teams to teleport roles
-  teams_to_roles:
-    - organization: octocats # GitHub organization name
-      team: admin            # GitHub team name within that organization
-      # map github admin team to Teleport's "access" role
-      roles: ["access"]
-```
-
-Create the `github` resource:
-
-```code
-$ tctl create github.yaml
-```
-
-## Step 3/3. Create a custom role
-
-Let's create a custom role for interns. Interns will have access
-to test or staging SSH servers as `readonly` users. We will let them
-view some monitoring web applications and dev kubernetes cluster.
-
-Save this role as `interns.yaml`:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: interns
-spec:
-  allow:
-    # Logins configures SSH login principals
-    logins: ['readonly']
-    # Assigns users with this role to the built-in Kubernetes group "view"
-    kubernetes_groups: ["view"]
-    # Allow access to SSH nodes, Kubernetes clusters, apps or databases
-    # labeled with "staging" or "test"
-    node_labels:
-      'env': ['staging', 'test']
-    kubernetes_labels:
-      'env': 'dev'
-    kubernetes_resources:
-      - kind: *
-        namespace: "*"
-        name: "*"
-        verbs: ["*"]
-    app_labels:
-      'type': ['monitoring']
-  # The deny rules always override allow rules.
-  deny:
-    # deny access to any Node, database, app or Kubernetes cluster labeled
-    # as prod as any user.
-    node_labels:
-      'env': 'prod'
-    kubernetes_labels:
-      'env': 'prod'
-    kubernetes_resources:
-      - kind: "namespace"
-        name: "prod"
-    db_labels:
-      'env': 'prod'
-    app_labels:
-      'env': 'prod'
-```
-
-Create a role using the `tctl create -f` command:
-
-```code
-$ tctl create -f /tmp/interns.yaml
-# Get a list of all roles in the system
-$ tctl get roles --format text
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-## Next steps
-
-- [Mapping SSO and local users traits with role templates](./guides/role-templates.mdx)
-- [Create certs for CI/CD using impersonation](./guides/impersonation.mdx)
-
diff --git a/docs/pages/admin-guides/access-controls/guides/dual-authz.mdx b/docs/pages/admin-guides/access-controls/guides/dual-authz.mdx
deleted file mode 100644
index 84dc472803abd..0000000000000
--- a/docs/pages/admin-guides/access-controls/guides/dual-authz.mdx
+++ /dev/null
@@ -1,234 +0,0 @@
----
-title: Dual Authorization
-description: Dual Authorization for SSH and Kubernetes.
-videoBanner: b_iqJm_o15I
----
-
-You can set up Teleport to require the approval of multiple team members to perform some critical actions.
-Here are the most common scenarios:
-
-- Improve the security of your system and prevent one successful phishing attack from compromising your system.
-- Satisfy FedRAMP AC-3 Dual authorization control that requires approval of two authorized individuals.
-
-In this guide, we will set up Teleport's Just-in-Time Access Requests to require
-the approval of two team members for a privileged role `elevated-access`.
-
-The steps below describe how to use Teleport with Mattermost. You can also
-[integrate with many other providers](../access-requests/access-requests.mdx).
-
-<Admonition type="warning">
-
-Dual Authorization requires Teleport Enterprise.
-
-</Admonition>
-
-## Prerequisites
-
-- Mattermost installed.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-<Admonition
-  type="tip"
-  title="Running Mattermost locally with Docker"
->
-  ```code
-  $ docker run --name mattermost-preview -d --publish 8065:8065 --add-host dockerhost:127.0.0.1 mattermost/mattermost-preview
-  ```
-
-</Admonition>
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/2. Set up a Teleport bot
-
-### Create a bot within Mattermost
-
-Enable bot account creation in "System Console -> Integrations".
-
-Toggle `Enable Bot Account Creation`.
-
-![Enable bots](../../../../img/access-controls/dual-authz/mattermost-0-enable.png)
-
-Go back to your team settings, navigate to "Integrations -> Bot Accounts". Press "Add Bot Account".
-
-![Enable bots](../../../../img/access-controls/dual-authz/mattermost-1-bot.png)
-
-Add the "Post All" permission on the new account.
-
-![Enable bots](../../../../img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png)
-
-Create the bot and save the access token.
-
-### Set up RBAC for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-### Export the access-plugin identity files
-
-(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin"!)
-
-We'll reference the exported file(s) later when configuring the plugin.
-
-### Install the plugin
-
-(!docs/pages/includes/plugins/install-access-request.mdx name="mattermost"!)
-
-<Tabs>
-<TabItem label="Download">
-  Access Request Plugins are available as `amd64` or `arm64` Linux binaries for downloading.
-  Replace `ARCH` with your required version.
-
-  ```code
-  $ curl -L https://cdn.teleport.dev/teleport-access-mattermost-v(=teleport.plugin.version=)-linux-<Var name="ARCH" />-bin.tar.gz
-  $ tar -xzf teleport-access-mattermost-v(=teleport.plugin.version=)-linux-<Var name="ARCH" />-bin.tar.gz
-  $ cd teleport-access-mattermost
-  $ ./install
-  ```
-</TabItem>
-<TabItem label="From Source">
-  To install from source you need `git` and `go` installed. If you do not have Go
-  installed, visit the Go [downloads page](https://go.dev/dl/).
-
-  ```code
-  $ git clone https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
-  $ cd teleport/integrations/access/mattermost
-  $ git checkout v(=teleport.plugin.version=)
-  $ make build/teleport-mattermost
-  ```
-</TabItem>
-</Tabs>
-
-```code
-$ teleport-mattermost configure > /etc/teleport-mattermost.toml
-```
-
-Update the config with the Teleport address, Mattermost URL, and a bot token:
-
-```yaml
-(!examples/resources/plugins/teleport-mattermost-cloud.toml!)
-```
-
-## Step 2/2. Configure dual authorization
-
-In this section, we will use an example to show you how to require dual
-authorization for a user to assume a role.
-
-### Require dual authorization for a role
-
-Alice and Ivan are reviewers. They can approve requests for assuming role
-`elevated-access`. Bob is a DevOps engineer and can assume the `elevated-access` role if two members
-of the `reviewer` role approve the request.
-
-Create the following `elevated-access`, `dbreviewer` and `devops` roles:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dbreviewer
-spec:
-  allow:
-    review_requests:
-      roles: ['elevated-access']
----
-kind: role
-version: v5
-metadata:
-  name: devops
-spec:
-  allow:
-    request:
-      roles: ['elevated-access']
-      thresholds:
-        - approve: 2
-          deny: 1
----
-kind: role
-version: v5
-metadata:
-  name: elevated-access
-spec:
-  allow:
-    logins: ['root']
-    node_labels:
-      'env': 'prod'
-      'type': 'db'
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-The commands below create the local users Bob, Alice, and Ivan.
-
-```code
-$ tctl users add bob@example.com --roles=devops
-$ tctl users add alice@example.com --roles=dbreviewer
-$ tctl users add ivan@example.com --roles=dbreviewer
-```
-
-### Create an Access Request
-
-Bob does not have a role `elevated-access` assigned to him, but can create an Access Request for this role in the Web UI or CLI:
-
-<Tabs>
-<TabItem label="Web UI">
-  ![Role-Request](../../../../img/access-controls/dual-authz/role-new-request.png)
-  ![Request-Success](../../../../img/access-controls/dual-authz/request-success.png)
-</TabItem>
-<TabItem label="Terminal">
-  ```code
-  # Bob has to set valid emails of Alice and Ivan matching in Mattermost.
-  $ tsh request create --roles=elevated-access --reviewers=alice@example.com,ivan@example.com
-  ```
-</TabItem>
-</Tabs>
-
-The Web UI will notify the admin:
-
-![Mattermost-Request](../../../../img/access-controls/dual-authz/pending-access-request.png)
-
-The request can then be reviewed and approved through the Web UI or CLI:
-
-<Tabs>
-  <TabItem label="Web UI">
-    ![Teleport-Approve](../../../../img/access-controls/dual-authz/approve-new-request.png)
-  </TabItem>
-
-  <TabItem label="CLI">
-    ```code
-    $ tsh request list
-
-    # ID                                   User        Roles            Created  (UTC)       Status
-    # ------------------------------------ ----------  ---------------  -------------------  ------
-    # 0193496f-268c-727e-b696-600a868429ff test (Bob)  elevated-access  21 Nov 24 18:50 UTC  PENDING
-
-    $ tsh request review --approve --reason="Need to gain elevated-access for investigation" 0193496f-268c-727e-b696-600a868429ff
-    # Successfully submitted review.  Request state: APPROVED
-    ```
-  </TabItem>
-</Tabs>
-
-If the user has created a request using CLI, the role will be assumed once it has been approved, or they can assume the role using the Web UI.
-
-## Troubleshooting
-
-### Certificate errors in self-hosted deployments
-
-You may be getting certificate errors if Teleport's Auth Service is missing an address in the server certificate:
-
-```txt
-authentication handshake failed: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs
-```
-
-```txt
-x509: certificate is valid for,*.teleport.cluster.local, teleport.cluster.local, not example.com
-```
-
-To fix the problem, update the Auth Service with a public address, and restart Teleport:
-
-```yaml
-auth_service:
-  public_addr: ['localhost:3025', 'example.com:3025']
-```
diff --git a/docs/pages/admin-guides/access-controls/guides/guides.mdx b/docs/pages/admin-guides/access-controls/guides/guides.mdx
deleted file mode 100644
index 05c27ca3b84aa..0000000000000
--- a/docs/pages/admin-guides/access-controls/guides/guides.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Cluster Access and RBAC
-description: How to configure access to specific resources in your infrastructure or your Teleport cluster as a whole.
-layout: tocless-doc
----
-
-Teleport gives you fine-grained control over who can access resources in your
-infrastructure as well as how they can access those resources. Once you have
-deployed a Teleport cluster, configure access controls to achieve the right
-security policies for your organization.
-
-(!docs/pages/includes/access-control-guides.mdx!)
diff --git a/docs/pages/admin-guides/access-controls/guides/headless.mdx b/docs/pages/admin-guides/access-controls/guides/headless.mdx
deleted file mode 100644
index 3500b087800ac..0000000000000
--- a/docs/pages/admin-guides/access-controls/guides/headless.mdx
+++ /dev/null
@@ -1,215 +0,0 @@
----
-title: Headless WebAuthn
-description: Headless WebAuthn
----
-
-Headless WebAuthn provides a secure way to authenticate with WebAuthn from a
-machine without access to a WebAuthn device. This enables the use of WebAuthn
-features which are usually not usable in WebAuthn-incompatible environments.
-For example:
-
-- Logging into Teleport with WebAuthn from a remote dev box
-- Connecting to a Teleport SSH Service from a remote dev box with per-session MFA
-- Performing `tsh scp` from one Teleport SSH Service to another with per-session MFA
-- Logging into Teleport on a machine without a WebAuthn-compatible browser
-
-<Admonition type="note" title="Headless WebAuthn Support">
-  Headless WebAuthn only supports the following `tsh` commands:
-
-  - `tsh ls`
-  - `tsh ssh`
-  - `tsh scp`
-
-  In the future, Headless WebAuthn will be extended to other `tsh` commands.
-</Admonition>
-
-## Prerequisites
-
-- A Teleport cluster with WebAuthn configured.
-  See the [Harden your Cluster Against IdP Compromises](./webauthn.mdx) guide.
-- WebAuthn hardware device, such as YubiKey.
-- Machines for Headless WebAuthn activities have [Linux](../../../installation.mdx), [macOS](../../../installation.mdx) or [Windows](../../../installation.mdx) `tsh` binary installed.
-- Machines used to approve Headless WebAuthn requests have a Web browser with [WebAuthn support](
-  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) or `tsh` binary installed.
-- Optional: Teleport Connect for [seamless Headless WebAuthn approval](#optional-teleport-connect).
-
-## Step 1/3. Configuration
-
-A Teleport cluster capable of WebAuthn is automatically capable of
-Headless WebAuthn without any additional configuration.
-
-<details>
-<summary>Optional: make Headless WebAuthn the default auth connector</summary>
-
-To make Headless WebAuthn the default authentication method for your Teleport
-Cluster, add `connector_name: headless` to your cluster configuration.
-
-Create a `cap.yaml` file or get the existing configuration using
-`tctl get cluster_auth_preference`:
-
-```yaml
-kind: cluster_auth_preference
-version: v2
-metadata:
-  name: cluster-auth-preference
-spec:
-  type: local
-  second_factors: ["webauthn"]
-  webauthn:
-    rp_id: example.com
-  connector_name: headless # headless by default
-```
-
-Update the configuration:
-
-```code
-$ tctl create -f cap.yaml
-# cluster auth preference has been updated
-```
-</details>
-
-<details>
-<summary>Alternative: disable Headless WebAuthn</summary>
-
-Headless WebAuthn is enabled automatically when WebAuthn is configured. If you
-want to forbid Headless WebAuthn in your cluster, add `headless: false` to your
-configuration.
-
-Create a `cap.yaml` file or get the existing configuration using
-`tctl get cluster_auth_preference`:
-
-```yaml
-kind: cluster_auth_preference
-version: v2
-metadata:
-  name: cluster-auth-preference
-spec:
-  type: local
-  second_factors: ["webauthn"]
-  webauthn:
-    rp_id: example.com
-  headless: false # disable Headless WebAuthn
-```
-
-Update the configuration:
-
-```code
-$ tctl create -f cap.yaml
-# cluster auth preference has been updated
-```
-
-</details>
-
-## Step 2/3. Initiate Headless WebAuthn
-
-Run a headless `tsh` command with the `--headless` flag. This will initiate
-headless authentication, printing a URL and `tsh` command.
-
-```code
-$ tsh ls --headless --proxy=proxy.example.com --user=alice
-# Complete headless authentication in your local web browser:
-#
-# https://proxy.example.com:3080/web/headless/86172f78-af7c-5935-a7c1-ed06b94f17dc
-#
-# or execute this command in your local terminal:
-#
-# tsh headless approve --user=alice --proxy=proxy.example.com 86172f78-af7c-5935-a7c1-ed06b94f17dc
-```
-
-## Step 3/3. Approve Headless WebAuthn
-
-To approve the headless authentication, click or copy+paste the URL printed by
-`tsh` in your local web browser. You will be prompted to approve the log in with
-WebAuthn verification. Once approved, your initial `tsh --headless <command>`
-should continue as if you had logged in locally.
-
-Unlike a standard login session, headless sessions are only available for the
-lifetime of a single `tsh` request. This means that for each `tsh --headless`
-command, you will need to go through the Headless WebAuthn flow:
-
-### Example: Listing SSH servers
-```code
-$ tsh ls --headless --proxy=proxy.example.com --user=alice
-# Complete headless authentication in your local web browser:
-#
-# https://proxy.example.com:3080/web/headless/86172f78-af7c-5935-a7c1-ed06b94f17dc
-#
-# or execute this command in your local terminal:
-#
-# tsh headless approve --user=alice --proxy=proxy.example.com 86172f78-af7c-5935-a7c1-ed06b94f17dc
-# # User approves through link
-# Node Name Address        Labels
-# --------- -------------- -----------
-# server01  127.0.0.1:3022 arch=x86_64
-```
-
-### Example: Initiating an SSH session
-```code
-$ tsh ssh --headless --proxy=proxy.example.com --user=alice alice@server01
-# Complete headless authentication in your local web browser:
-#
-# https://proxy.example.com:3080/web/headless/864cccd9-2425-46d9-a9f2-636387e66ebf
-#
-# or execute this command in your local terminal:
-#
-# tsh headless approve --user=alice --proxy=proxy.example.com 864cccd9-2425-46d9-a9f2-636387e66ebf
-# # User approves through link and a ssh terminal starts
-alice@server01 $
-```
-
-<Admonition type="note">
-  The Teleport user, `--user` parameter, is the Teleport user requesting Headless WebAuthn activity.
-  If no `--user` parameter or environment variables set the OS user in the machine terminal is used.
-
-  The login username, `--login` parameter or login@hostname, for `tsh ssh` commands is the user
-  to open a SSH session as. If no login username for the SSH session is set the OS terminal username is used.
-  A Teleport user must have access to that login user for that server or they will receive
-  an access denied message. The user could receive an access denied message after being approved
-  for their Headless WebAuthn activity since the same access rights are granted or denied as if running from
-  your local terminal.
-</Admonition>
-
-## Optional: Teleport Connect
-
-Teleport Connect can also be used to approve Headless WebAuthn logins.  Teleport
-Connect will automatically detect the Headless WebAuthn login attempt and allow
-you to approve or cancel the request.
-
-![Headless Confirmation](../../../../img/headless/confirmation.png)
-
-You will be prompted to tap your MFA key to complete the approval process.
-
-![Headless WebAuthn Approval](../../../../img/headless/approval.png)
-
-## Troubleshooting
-
-### "WARN: Failed to lock system memory for headless login: ..."
-
-When using Headless WebAuthn, `tsh` does not write private key and certificate data
-to disk(`~/.tsh`). Instead, `tsh` holds these secrets in memory for the duration of
-the request. Additionally, it will try to lock the process memory to further protect
-the secrets from being stolen by other users on a shared machine.
-
-Below are some of the specific warning messages you may run into and how to fix them:
-
-#### "operation not permitted" OR "cannot allocate memory"
-
-In order to lock the process memory, your OS user must have permission to lock
-the amount of memory needed. Use `ulimit -l` to check your OS user's current limit.
-The exact amount of memory needed may vary from system to system, so we recommend
-updating your ulimit to unlimited, with either `ulimit -l unlimited` or by adding
-the line `<os_username> hard memlock unlimited` to your `/etc/security/limits.conf`.
-
-#### "memory locking is not supported on non-linux operating systems"
-
-The `mlockall` syscall is only supported on Linux operating systems. This means
-that on other operating systems, the memory lock attempt will always fail and
-output the warning. We recommend only using Headless WebAuthn on Linux machines
-for the best level of security on shared machines.
-
-#### Disable mlock
-
-If the above solutions are not feasible in your environment, you can also disable
-the memory locking requirement by setting the `--mlock` flag or `TELEPORT_MLOCK_MODE`
-environment variable to `off` or `best_effort`. This is not recommended in production
-environments on shared systems where a memory swap attack is possible.
diff --git a/docs/pages/admin-guides/access-controls/guides/per-session-mfa.mdx b/docs/pages/admin-guides/access-controls/guides/per-session-mfa.mdx
deleted file mode 100644
index d22683be7adcb..0000000000000
--- a/docs/pages/admin-guides/access-controls/guides/per-session-mfa.mdx
+++ /dev/null
@@ -1,219 +0,0 @@
----
-title: Per-session MFA
-description: Require MFA checks to initiate sessions.
-videoBanner: j8Ze7HhjFGw
----
-
-Teleport supports requiring additional multi-factor authentication checks
-when starting new:
-
-- SSH connections (a single `tsh ssh` call, Web UI SSH session or Teleport Connect SSH session)
-- Kubernetes sessions (a single `kubectl` call)
-- Database sessions (a single `tsh db connect` call)
-- Application sessions
-- Desktop sessions
-
-This is an advanced security feature that protects users against compromises of
-their on-disk Teleport certificates.
-
-<Admonition type="note">
-  In addition to per-session MFA, enable login MFA in your SSO provider and/or
-  for all [local Teleport
-  users](../../../reference/access-controls/authentication.mdx)
-  to improve security.
-</Admonition>
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- [WebAuthn configured](webauthn.mdx) on this cluster
-- Hardware device for multi-factor authentication, such as YubiKey or SoloKey
-- A Web browser with [WebAuthn support](
-  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
-  SSH or desktop sessions from the Teleport Web UI).
-
-<Admonition type="note" title="Per-session MFA with FIPS" scope="enterprise" scopeOnly>
-
-Teleport FIPS builds disable local users. To configure WebAuthn in order to use
-per-session MFA with FIPS builds, provide the following in your `teleport.yaml`:
-
-```yaml
-teleport:
-  auth_service:
-    local_auth: false
-    second_factors: ["webauthn"]
-    webauthn:
-      rp_id: teleport.example.com
-```
-
-</Admonition>
-
-## Configure per-session MFA
-
-Per-session MFA can be enforced cluster-wide or only for some specific roles.
-
-### Cluster-wide
-
-To enforce MFA checks for all roles, edit your cluster authentication
-configuration.
-
-Edit your `cluster_auth_preference` resource:
-
-```code
-$ tctl edit cap
-```
-
-Ensure that the resource contains the following content:
-
-```yaml
-kind: cluster_auth_preference
-metadata:
-  name: cluster-auth-preference
-spec:
-  require_session_mfa: true
-version: v2
-```
-
-Apply your changes by saving and closing the file in your editor.
-
-### Per role
-
-To enforce MFA checks for a specific role, update the role to contain:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: example-role-with-mfa
-spec:
-  options:
-    # require per-session MFA for this role
-    require_session_mfa: true
-  allow:
-    ...
-  deny:
-    ...
-```
-
-Role-specific enforcement only applies when accessing resources matching a
-role's `allow` section.
-
-### Roles example
-
-Let's walk through an example of setting up per-session MFA checks for roles.
-
-Jerry is an engineer with access to the company infrastructure. The
-infrastructure is split into development and production environments. Security
-engineer Olga wants to enforce MFA checks for accessing production servers.
-Development servers don't require this to reduce engineers' friction.
-
-Olga defines two Teleport roles: `access-dev` and `access-prod`:
-
-```yaml
-# access-dev.yaml
-kind: role
-version: v7
-metadata:
-  name: access-dev
-spec:
-  allow:
-    node_labels:
-      env: dev
-    logins:
-      - jerry
----
-# access-prod.yaml
-kind: role
-version: v7
-metadata:
-  name: access-prod
-spec:
-  options:
-    # require per-session MFA for production access
-    require_session_mfa: true
-  allow:
-    node_labels:
-      env: prod
-    logins:
-      - jerry
-  deny: {}
-```
-
-Olga then assigns both roles to all engineers, including Jerry.
-
-When Jerry logs into node `dev1.example.com` (with label `env: dev` as login `jerry`), nothing
-special happens:
-
-```code
-$ tsh ssh jerry@dev1.example.com
-
-# jerry@dev1.example.com >
-```
-
-But when Jerry logs into node `rod3.example.com` (with label `env: prod` as login `jerry`), he
-gets prompted for an MFA check:
-
-```code
-$ tsh ssh jerry@prod3.example.com
-# Tap any security key <tap>
-
-# jerry@prod3.example.com >
-```
-
-<Admonition title="OTP" type="tip">
-If you are using `tsh` in a constrained environment, you can tell it to use
-OTP by doing `tsh --mfa-mode=otp ssh prod3.example.com`.
-
-OTP can only be used with per-session MFA when using `tsh` or Teleport Connect to
-establish connections. A hardware MFA key is required for using per-session
-MFA with Teleport's Web UI.
-</Admonition>
-
-If per-session MFA was enabled cluster-wide, Jerry would be prompted for MFA
-even when logging into `dev1.example.com`.
-
-<Admonition title="Per-session MFA for Database Access" type="tip">
-
-The Teleport Database Service supports per-connection MFA. When Jerry connects
-to the database `prod-mysql-instance` (with label `env: prod`), he gets prompted
-for an MFA check for each `tsh db connect` or `tsh proxy db` call:
-
-```code
-$ tsh db connect prod-mysql-instance
-# Tap any security key
-
-# Welcome to the MySQL monitor.  Commands end with ; or \g.
-# Your MySQL connection id is 10002
-# Server version: 8.0.0-Teleport (Ubuntu)
-#
-# Copyright (c) 2000, 2021, Oracle and/or its affiliates.
-#
-# Oracle is a registered trademark of Oracle Corporation and/or its
-# affiliates. Other names may be trademarks of their respective
-# owners.
-#
-# Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
-#
-# mysql>
-```
-
-</Admonition>
-
-## Limitations
-
-Current limitations for this feature are:
-
-- For SSH connections besides the Web UI, the `tsh` or Teleport Connect client must be used for per-session MFA.
-  (The OpenSSH `ssh` client does not work with per-session MFA).
-- Only `kubectl` supports per-session WebAuthn authentication for Kubernetes.
-- For desktop access, only WebAuthn devices are supported.
-- When accessing a
-  [multi-port](../../../enroll-resources/application-access/guides/tcp.mdx#configuring-access-to-multiple-ports)
-  TCP application through [VNet](../../../connect-your-client/vnet.mdx), the first connection over
-  each port triggers an MFA check.
-
-## Next steps
-
-- [Require MFA for administrative actions](./mfa-for-admin-actions.mdx)
diff --git a/docs/pages/admin-guides/access-controls/guides/webauthn.mdx b/docs/pages/admin-guides/access-controls/guides/webauthn.mdx
deleted file mode 100644
index d7683e3249657..0000000000000
--- a/docs/pages/admin-guides/access-controls/guides/webauthn.mdx
+++ /dev/null
@@ -1,494 +0,0 @@
----
-title: Harden your Cluster Against IdP Compromises
-description: Implement cluster-wide hardening measures.
-videoBanner: vQgKkD4ZRDU
----
-
-This guide aims to help you fortify your identity infrastructure and mitigate the risks associated with IdP weaknesses.
-
-An IdP compromise occurs when an attacker gains unauthorized access to your identity management
-system, potentially allowing them to impersonate legitimate users, escalate privileges, or access
-sensitive information. This can happen through various means, such as exploiting software vulnerabilities,
-stealing credentials, or social engineering attacks.
-
-While many organizations have implemented basic security measures like single sign-on (SSO) and multi-factor authentication (MFA),
-these alone may not be sufficient to protect against sophisticated attacks targeting your IdP.
-Attackers are constantly evolving their techniques, and traditional security measures may have limitations
-or vulnerabilities that can be exploited.
-
-![IdP threat vector tree](../../../../img/access-controls/idp-graph.png)
-
-To enhance your defense against IdP compromises, we recommend implementing the following comprehensive security measures.
-
-## Set up cluster-wide WebAuthn
-Implement strong, phishing-resistant authentication across
-your entire infrastructure using WebAuthn standards. WebAuthn, a W3C standard and part of FIDO2,
-enables public-key cryptography for web authentication. Teleport supports WebAuthn as a multi-factor
-for logging into Teleport (via tsh login or Web UI) and accessing SSH nodes or Kubernetes clusters.
-It's compatible with hardware keys (e.g., YubiKeys, SoloKeys) and biometric authenticators like Touch ID and Windows Hello.
-
-### Prerequisites
-
-- A running Teleport cluster or Teleport Cloud, version 16 or later. If you want to get started with Teleport,
-[sign up](https://goteleport.com/signup) for a free trial.
-
-- The `tctl` admin tool and `tsh` client tool.
-
-  Visit [Installation](../../../installation.mdx) for instructions on downloading `tctl` and `tsh`.
-
-- WebAuthn hardware device, such as YubiKey or SoloKey
-
-- A Web browser with [WebAuthn support](https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-### Step 1/3. Enable WebAuthn support
-
-WebAuthn is disabled by default. To enable WebAuthn support, update your
-Teleport configuration as below:
-
-  Edit the `cluster_auth_preference` resource:
-
-  ```code
-  $ tctl edit cap
-  ```
-
- Update the `cluster_auth_preference` definition to include the following content:
-
-  ```yaml
-  kind: cluster_auth_preference
-  version: v2
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    type: local
-    # To enable WebAuthn support, include "webauthn" as a second factor method.
-    second_factors: ["webauthn"]
-    webauthn:
-      # Required, replace with proxy web address (example.com, example.teleport.sh).
-      # rp_id is the public domain of the Teleport Proxy Service, *excluding* protocol
-      # (https://) and port number.
-      rp_id: example.com
-      # Optional, attestation_allowed_cas is an optional allow list
-      # of certificate authorities.
-      attestation_allowed_cas:
-      # Entries can be paths to certificate files:
-      - "/path/to/allowed_ca.pem"
-      # Entries can also be inline certificates:
-      - |
-        -----BEGIN CERTIFICATE-----
-        ...
-        -----END CERTIFICATE-----
-      # Optional, attestation_denied_cas is an optional deny list
-      # of certificate authorities.
-      attestation_denied_cas:
-      # Entries can be paths to certificate files:
-      - "/path/to/denied_ca.pem"
-      # Entries can also be inline certificates:
-      - |
-        -----BEGIN CERTIFICATE-----
-        ...
-        -----END CERTIFICATE-----
-  ```
-
-  Save and exit the file. `tctl` will update the remote definition:
-
-  ```text
-  cluster auth preference has been updated
-  ```
-
-### `webauthn` fields definitions
-
-`rp_id` is the public domain of the Teleport Proxy Service, *excluding* protocol
-  (`https://`) and port number.
-
-`attestation_allowed_cas` is an optional allow list of certificate authorities
-(as local file paths or inline PEM certificate strings) for
-[device verification](
-https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
-
-This field allows you to restrict which device models and vendors you trust.
-Devices outside of the list will be rejected during registration. By default all
-devices are allowed. If you must use attestation, consider using
-`attestation_denied_cas` to forbid troublesome devices instead.
-
-`attestation_denied_cas` is an optional deny list of certificate authorities (as
-local file paths or inline PEM certificate strings) for [device verification](
-https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
-
-This field allows you to forbid specific device models and vendors, while
-allowing all others (provided they clear `attestation_allowed_cas` as well).
-Devices within this list will be rejected during registration. By default no
-devices are forbidden.
-
-### Step 2/3. Register WebAuthn devices as a user
-
-A user can register multiple WebAuthn devices using `tsh`:
-
-```code
-$ tsh mfa add
-# Choose device type [TOTP, WEBAUTHN]: webauthn
-# Enter device name: desktop yubikey
-# Tap any *registered* security key or enter a code from a *registered* OTP device:
-# Tap your *new* security key
-# MFA device "desktop yubikey" added.
-```
-
-### Step 3/3. Log in using WebAuthn
-
-Once a WebAuthn device is registered, the user will be prompted for it on login:
-
-```code
-$ tsh login --proxy=example.teleport.sh
-# Enter password for Teleport user codingllama:
-# Tap any security key or enter a code from a OTP device:
-# > Profile URL:        https://example.teleport.sh
-#   Logged in as:       codingllama
-#   Cluster:            example.teleport.sh
-#   Roles:              access, editor, reviewer
-#   Logins:             codingllama
-#   Kubernetes:         enabled
-#   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
-#   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-<Admonition type="note">
-  WebAuthn for logging in to Teleport is only required for [local users](
-  ../../../reference/access-controls/authentication.mdx#local-no-authentication-connector).
-  SSO users should configure multi-factor authentication in their SSO provider.
-</Admonition>
-
-## Configure per-session MFA
-Ensure that multi-factor authentication is required for each session, not just at initial login,
-to maintain continuous security. Teleport's per-session MFA enhances security by protecting
-against compromised on-disk certificates. It requires additional MFA checks when initiating new SSH, Kubernetes, database, or desktop sessions.
-
-Teleport supports requiring additional multi-factor authentication checks
-when starting new:
-
-- SSH connections (a single `tsh ssh` call, Web UI SSH session or Teleport Connect SSH session)
-- Kubernetes sessions (a single `kubectl` call)
-- Database sessions (a single `tsh db connect` call)
-- Application sessions
-- Desktop sessions
-
-<Admonition type="note">
-  In addition to per-session MFA, enable login MFA in your SSO provider and/or
-  for all [local Teleport
-  users](../../../reference/access-controls/authentication.mdx)
-  to improve security.
-</Admonition>
-
-To enforce MFA checks for all roles, edit your cluster authentication
-configuration:
-
-Edit your `cluster_auth_preference` resource:
-
-```code
-$ tctl edit cap
-```
-
-Ensure that the resource contains the following content:
-
-```yaml
-kind: cluster_auth_preference
-metadata:
-  name: cluster-auth-preference
-spec:
-  require_session_mfa: true
-version: v2
-```
-
-Save and close the file in your editor to apply your changes.
-
-
-### Per role
-
-To enforce MFA checks for a specific role, update the role to contain:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: example-role-with-mfa
-spec:
-  options:
-    # require per-session MFA for this role
-    require_session_mfa: true
-  allow:
-    ...
-  deny:
-    ...
-```
-
-## Implement cluster-wide Device Trust
-Develop a system to verify and manage trusted devices across your organization, reducing the risk
-of unauthorized access from unknown or compromised devices. Device Trust adds an extra layer of security by requiring the use of trusted devices
-for accessing protected resources, complementing user identity and role enforcement. This can be
-configured cluster-wide or via RBAC. Supported resources include apps (role-based only), SSH nodes,
-databases, Kubernetes clusters, and first MFA device enrollment. The latter helps prevent auto-provisioning of new users through compromised IdPs.
-
-<Admonition type="warning" title="Machine ID and Device Trust">
-
-  We do not currently support Machine ID and Device Trust. Requiring Device Trust
-  cluster-wide or for roles impersonated by Machine ID will prevent credentials
-  produced by Machine ID from being used to connect to resources.
-
-  As a work-around, configure Device Trust enforcement on a role-by-role basis and
-  ensure that it is not required for roles that you will impersonate using Machine ID.
-</Admonition>
-
-### Prerequisites
-
-(!docs/pages/includes/device-trust/prereqs.mdx!)
-
-The `tctl` tool is used to manage the device inventory. A device admin is
-responsible for managing devices, adding new devices to the inventory and
-removing devices that are no longer in use.
-
-<Admonition type="tip" title="Self enrollment">
-  Users with the preset `editor` or `device-admin` role
-  can register and enroll their device in a single step with the following command:
-  ```code
-  $ tsh device enroll --current-device
-  ```
-</Admonition>
-
-### Step 1/3. Register a trusted device
-
-Before you can enroll the device, you need to register it. To register
-a device, you first need to determine its serial number.
-
-Retrieve device serial number with `tsh` (must be run on the device you want to register):
-```code
-$ tsh device asset-tag
-(=devicetrust.asset_tag=)
-```
-<details>
-<summary>Manually retrieving device serial</summary>
-  <Tabs>
-  <TabItem label="macOS">
-    The serial number is visible under Apple menu -> "About This Mac" -> "Serial number".
-  </TabItem>
-
-  <TabItem label="Windows and Linux">
-    Windows and Linux devices can have multiple serial numbers depending on the
-    configuration made by the manufacturer.
-
-    Teleport will pick the first available value from the following:
-    - System asset tag
-    - System serial number
-    - Baseboard serial number
-
-    To find the value chosen by Teleport, run the following command:
-
-    ```code
-    $ tsh device asset-tag
-    (=devicetrust.asset_tag=)
-    ```
-  </TabItem>
-</Tabs>
-</details>
-
-Replace 
-<Var name="(=devicetrust.asset_tag=)" description="The serial number to be registered"/> 
-with the serial number of the device you wish to enroll, and
-<Var name="macos" /> with your operating system. Run the
-`tctl devices add` command:
-
-```code
-$ tctl devices add --os='<Var name="macos"/>' --asset-tag='<Var name="(=devicetrust.asset_tag=)"/>'
-Device <Var name="(=devicetrust.asset_tag=)"/>/macos added to the inventory
-```
-
-Use `tctl` to check that the device has been registered:
-
-```code
-$ tctl devices ls
-Asset Tag    OS    Enroll Status Device ID
------------- ----- ------------- ------------------------------------
-(=devicetrust.asset_tag=) macOS not enrolled  (=devicetrust.device_id=)
-```
-
-### Step 2/3. Create a device enrollment token
-
-A registered device becomes a trusted device after it goes through the
-enrollment ceremony. To enroll the device, a device enrollment token is
-necessary. The token is created by a device admin and sent to the person
-performing the enrollment off-band (for example, via a corporate chat).
-
-To create an enrollment token run the command below, where `--asset-tag` is
-the serial number of the device we want to enroll:
-
-```code
-$ tctl devices enroll --asset-tag="(=devicetrust.asset_tag=)"
-Run the command below on device "(=devicetrust.asset_tag=)" to enroll it:
-tsh device enroll --token=(=devicetrust.enroll_token=)
-```
-
-### Step 3/3. Enroll a trusted device
-
-To perform the enrollment ceremony, using the device specified above, type the
-command printed by `tctl devices enroll`:
-
-```code
-$ tsh device enroll --token=(=devicetrust.enroll_token=)
-Device "(=devicetrust.asset_tag=)"/macOS enrolled
-
-$ tsh logout
-$ tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=) # fetch new certificates
-Enter password for Teleport user (=clusterDefaults.username=):
-Tap any security key
-Detected security key tap
-> Profile URL:        (=clusterDefaults.clusterName=):443
-  Logged in as:       (=clusterDefaults.username=)
-  Cluster:            (=clusterDefaults.clusterName=)
-  Roles:              access, editor
-  Logins:             (=clusterDefaults.username=)
-  Kubernetes:         enabled
-  Valid until:        2023-06-23 02:47:05 -0300 -03 [valid for 12h0m0s]
-  Extensions:         teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
-```
-The presence of the `teleport-device-*` extensions shows that the device was
-successfully enrolled and authenticated. The device above is now a trusted device.
-
-### Auto-Enrollment
-
-Distributing enrollment tokens to many users can be challenging. To address that,
-Teleport supports auto-enrollment. When enabled, auto-enrollment automatically
-enrolls the user's device in their next Teleport (`tsh`) login.
-
-For auto-enrollment to work, the following conditions must be met:
-- A device must be registered. Registration may be [manual](#implement-cluster-wide-device-trust) or performed using an
-integration, like the [Jamf Pro integration](../device-trust/jamf-integration.mdx).
-- Auto-enrollment must be enabled in the cluster setting.
-
-### Step 1/2. Enable auto-enrollment in your cluster settings
-
-Modify the dynamic config resource using `tctl edit cluster_auth_preference`:
-
-```diff
-kind: cluster_auth_preference
-version: v2
-metadata:
-  name: cluster-auth-preference
-spec:
-  # ...
-  device_trust:
-    mode: "required"
-+   auto_enroll: true
-```
-
-### Step 2/2. Log out and back in
-
-Once enabled, users with their device registered in Teleport will have their
-device enrolled to Teleport in their next login.
-
-```code
-$ tsh logout
-All users logged out.
-$ tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
-Enter password for Teleport user (=clusterDefaults.username=):
-Tap any security key
-Detected security key tap
-> Profile URL:        (=clusterDefaults.clusterName=):443
-  Logged in as:       (=clusterDefaults.username=)
-  Cluster:            (=clusterDefaults.clusterName=)
-  Roles:              access, editor
-  Logins:             (=clusterDefaults.username=)
-  Kubernetes:         enabled
-  Valid until:        2023-06-23 02:47:05 -0300 -03 [valid for 12h0m0s]
-  Extensions:         teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
-```
-
-The presence of the `teleport-device-*` extensions shows that the device was
-successfully enrolled and authenticated.
-
-## Require MFA for administrative actions
-
-Add an extra layer of security for sensitive administrative operations by requiring multi-factor authentication
-for these high-privilege actions. Teleport enforces additional MFA verification for administrative
-actions across all clients (tctl, tsh, Web UI, and Connect). This feature adds an extra security
-layer by re-verifying user identity immediately before any admin action, mitigating risks from compromised admin accounts.
-
-By adopting these advanced security measures, you can create a robust defense against IdP compromises and significantly reduce your organization's attack surface.
-In the following sections, we'll dive deeper into each of these recommendations, providing step-by-step guidance on implementation and best practices.
-
-<Admonition type="warning">
-  When MFA for administrative actions is enabled, user certificates produced
-  with `tctl auth sign` will no longer be suitable for automation due to the
-  additional MFA checks.
-
-  We recommend using Machine ID to issue certificates for automated workflows,
-  which uses role impersonation that is not subject to MFA checks.
-
-  Certificates produced with `tctl auth sign` directly on an Auth Service instance using the super-admin
-  role are not subject to MFA checks to support legacy self-hosted setups.
-</Admonition>
-
-### Prerequisites
-
-- (!docs/pages/includes/tctl.mdx!)
-- [WebAuthn configured](#set-up-cluster-wide-WebAuthn) on this cluster
-- Multi-factor hardware device, such as YubiKey or SoloKey
-- A Web browser with [WebAuthn support](https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
-  SSH or desktop sessions from the Teleport Web UI).
-
-MFA for administrative actions is automatically enforced for clusters where WebAuthn is the only form of multi-factor allowed.
-
-<Admonition type="note">
-  In a future major version, Teleport may enforce MFA for administrative actions
-  for a wider range of cluster configurations.
-</Admonition>
-
-Examples of administrative actions include, but are not limited to:
-
-- Resetting or recovering user accounts
-- Inviting new users
-- Updating cluster configuration resources
-- Modifying access management resources
-- Approving Access Requests
-- Generating new join tokens
-- Impersonation
-- Creating new bots for Machine ID
-
-This is an advanced security feature that protects users against compromises of
-their on-disk Teleport certificates.
-
-### Step 1/2. Edit the resource
-
-  Edit the `cluster_auth_preference` resource:
-
-  ```code
-  $ tctl edit cap
-  ```
-
-Update the `cluster_auth_preference` definition to include the following content:
-
-  ```yaml
-  kind: cluster_auth_preference
-  version: v2
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    type: local
-    second_factors: ["webauthn"]
-    webauthn:
-      rp_id: example.com
-  ```
-
-  ### Step 2/2. Save and exit the file
-
-  The command `tctl` will update the remote definition:
-
-  ```text
-  cluster auth preference has been updated
-  ```
-
-## Next steps
-For additional cluster hardening measures, see:
-
-- [Passwordless Authentication](./passwordless.mdx): Provides passwordless and usernameless authentication.
-- [Locking](./locking.mdx): Lock access to active user sessions or hosts.
-- [Moderated Sessions](./joining-sessions.mdx): Require session auditors and allow fine-grained live session access.
-- [Hardware Key Support](./hardware-key-support.mdx): Enforce the use of hardware-based private keys.
diff --git a/docs/pages/admin-guides/access-controls/idps/idps.mdx b/docs/pages/admin-guides/access-controls/idps/idps.mdx
deleted file mode 100644
index 2c4daa37a4ae8..0000000000000
--- a/docs/pages/admin-guides/access-controls/idps/idps.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: Configure Teleport as an identity provider
-description: How to set up Teleport's identity provider functionality
----
-
-Users can authenticate to both internal and external applications
-through the use of a built in identity provider in Teleport.
-
-- [SAML Guide](saml-guide.mdx): A guide for setting up an example application to integration with the SAML identity provider.
-- [SAML Attribute Mapping](saml-attribute-mapping.mdx): A reference on how attribute mapping works in Teleport and how to
-use it to assert custom user attribute name and values in a SAML response.
-- [Use Teleport's SAML Provider to authenticate with Grafana](saml-grafana.mdx): Configure Grafana to authenticate using Teleport identities.
-- [SAML Reference](../../../reference/access-controls/saml-idp.mdx): A reference for Teleport's SAML identity provider.
diff --git a/docs/pages/admin-guides/access-controls/idps/saml-guide.mdx b/docs/pages/admin-guides/access-controls/idps/saml-guide.mdx
deleted file mode 100644
index 6efe5bec03768..0000000000000
--- a/docs/pages/admin-guides/access-controls/idps/saml-guide.mdx
+++ /dev/null
@@ -1,232 +0,0 @@
----
-title: Using Teleport as a SAML identity provider
-description: How to configure and use Teleport as a SAML identity provider.
-h1: Teleport as a SAML identity provider
----
-
-This guide details an example on how to use Teleport as a SAML identity provider
-(IdP). You can set up the Teleport SAML IdP to enable Teleport users to
-authenticate to external services through Teleport.
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- If you're new to SAML, consider reviewing our [SAML Identity Provider
-  Reference](../../../reference/access-controls/saml-idp.mdx) before proceeding.
-- User with permission to create service provider resource. The preset `editor` role has this permission.
-- SAML application (also known as a SAML service provider or SP) for testing. For this guide, we'll be using
-[RSA Simple Test Service Provider](https://sptest.iamshowcase.com/) - a free test service that
-lets us test Teleport SAML IdP. The test service has a protected page, which can be accessed only after a
-user is federated to the site with a valid SAML assertion flow.
-![iamshowcase protected page](../../../../img/access-controls/saml-idp/iamshowcase-protected-page.png)
-
-## Step 1/3. Add a service provider to Teleport
-
-To add a service provider to Teleport, you must configure a service provider
-metadata. This can be configured by either providing an **Entity ID** and **ACS URL** values of the
-service provider or by providing an entity descriptor value (also known as metadata file, which is an XML file)
-of the service provider.
-
-Below we'll show both of the configuration options.
-
-First, in the Web UI, under **Access Management**, click **Enroll New Resource** menu.
-In the search box, enter "saml", which will show the SAML application
-integration tile. Click the tile.
-
-![Enroll SAML app](../../../../img/access-controls/saml-idp/enroll-saml-app.png)
-
-The first configuration step, **Configure Service Provider with Teleport's Identity Provider Metadata**
-shows Teleport SAML IdP metadata values. For this guide, you can move to next step by clicking **Next** button
-which takes to **Add Service Provider To Teleport** step.
-
-### Option 1: Configure with Entity ID and ACS URL
-
-With this option, the minimum configuration values required to add a service provider are:
-1. **Entity ID:** The SAML metadata value or an endpoint of the service provider.
-1. **ACS URL:** The endpoint where users will be redirected after SAML authentication. ACS URL
-is also referred to as SAML SSO URL.
-
-To configure Simple Test Service Provider, the values you need to provide are the following:
-- **App Name:** `iamshowcase`
-- **SP Entity ID / Audience URI:** `iamshowcase`
-- **ACS URL / SP SSO URL:** `https://sptest.iamshowcase.com/acs`
-
-Click **Finish** button, the `iamshowcase` app is now added to Teleport.
-
-<details>
-<summary>Reference `tctl` based configuration</summary>
-
-The following `saml_idp_service_provider` spec is a reference for adding Simple Test
-Service Provider to Teleport:
-```yaml
-kind: saml_idp_service_provider
-metadata:
-  # The friendly name of the service provider. This is used to manage the
-  # service provider as well as in identity provider initiated SSO.
-  name: iamshowcase
-spec:
-  # entity_id is the metadata value or an endpoint of service provider
-  # that serves entity descriptor, aka SP metadata.
-  entity_id: iamshowcase
-  # acs_url is the endpoint where users will be redirected after
-  # SAML authentication.
-  acs_url: https://sptest.iamshowcase.com/acs
-version: v1
-```
-
-Add the spec to Teleport using `tctl`:
-
-```code
-$ tctl create iamshowcase.yaml
-# SAML IdP service provider 'iamshowcase' has been created.
-```
-</details>
-
-<Admonition type="note">
-With this configuration method, Teleport first tries to fetch an entity descriptor by
-querying the `entity_id` endpoint. If an entity descriptor is not found at that endpoint,
-Teleport will generate a new entity descriptor with the given `entity_id` and `acs_url` values.
-</Admonition>
-
-### Option 2: Configure with Entity Descriptor file
-
-If the service provider provides an option to download an entity descriptor file or you
-need more control over the entity descriptor, this is the recommended option to add a service provider
-to Teleport.
-
-With this option, you provide service provider entity descriptor file, which has all the details
-required to configure service provider metadata.
-
-![add entity descriptor](../../../../img/access-controls/saml-idp/add-entity-descriptor.png)
-
-In the **Add Service Provider To Teleport** page, provide a SAML service provider name (`iamshowcase`).
-Now click **+ Add Entity Descriptor (optional)** button, which will expand entity descriptor editor.
-Copy Simple Test Service Provider metadata file, which is available at the URL `https://sptest.iamshowcase.com/testsp_metadata.xml`
-and paste it to entity descriptor editor in Teleport Web UI.
-
-Click **Finish** button, the `iamshowcase` app is now added to Teleport.
-
-<details>
-<summary>Reference `tctl` based configuration</summary>
-
-First download the service provider metadata from Simple Test Service Provider as `iamshowcase.xml`:
-
-```code
-$ curl -o iamshowcase.xml https://sptest.iamshowcase.com/testsp_metadata.xml
-```
-
-Using the template below, create a file called `iamshowcase.yaml`. Assign the
-metadata you just downloaded to the `entity_descriptor` field in the
-`saml_idp_service_provider` object:
-
-```yaml
-kind: saml_idp_service_provider
-metadata:
-  # The friendly name of the service provider. This is used to manage the
-  # service provider as well as in identity provider initiated SSO.
-  name: iamshowcase
-spec:
-  # The entity_descriptor is the service provider XML.
-  entity_descriptor: |
-    <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"...
-version: v1
-```
-
-Add this to Teleport using `tctl`:
-
-```code
-$ tctl create iamshowcase.yaml
-# SAML IdP service provider 'samltest-id' has been created.
-```
-</details>
-
-<Admonition type="important">
-If an `entity_descriptor` is provided, its content takes preference over values provided in `entity_id` and `acs_url`.
-
-Teleport only tries to fetch or generate entity descriptor when service provider is created for the first time.
-Subsequent updates require an entity descriptor to be present in the service provider spec. As such, when updating
-service provider, you should first fetch the spec that is stored in Teleport and only then edit the configuration.
-```code
-# get service provider spec
-$ tctl get saml_idp_service_provider/<service provider name> > service-provider.yml
-```
-</Admonition>
-
-## Step 2/3. Configure the service provider to recognize Teleport's SAML IdP
-
-This step varies from service provider to service provider. Some service provider may ask to
-provide Teleport SAML IdP Entity ID, SSO URL and X.509 certificate. Other's may ask to upload
-an Teleport SAML IdP metadata file.
-
-You will find these values in the Teleport Web UI under the
-**Configure Service Provider with Teleport's Identity Provider Metadata** UI which is the first step
-shown in the SAML app enrollment flow.
-
-![Teleport IdP metadata](../../../../img/access-controls/saml-idp/teleport-idp-metadata.png)
-
-In the case of Simple Test Service Provider, which this guide is based on, the sample app is designed to grant access protected page
-for any well formatted IdP federated SAML assertion data.
-
-As such, when you click **Finish** button in the previous step, the protected page of the Simple Test Service Provider is
-already available to access under resources page.
-
-## Step 3/3. Verify access to iamshowcase protected page
-
-To verify everything works, navigate to **Resources** page in Teleport Web UI.
-
-![Access app](../../../../img/access-controls/saml-idp/access-app.png)
-
-The "iamshowcase" app will now appear under resources tile. Inside this tile,
-click **Login** button, which will now forward you to iamshowcase protected page.
-
-![Protected page access](../../../../img/access-controls/saml-idp/protected-page-access.png)
-
-This page shows Teleport user details along with other attributes such as roles are
-federated by Teleport SAML IdP.
-
-This demonstrates adding a service provider to Teleport configured with a working idp-initiated SSO login flow.
-
-## Recommended: Creating dedicated role to manage service provider
-
-For production, we recommend creating a dedicated role to manage service provider.
-
-To create a dedicated role, first, ensure you are logged into Teleport as a user that has
-permissions to read and modify `saml_idp_service_provider` objects. The default `editor` role
-has access to this already, but in case you are using a more customized configuration,
-create a role called `sp-manager.yaml` with the following contents:
-
-```yaml
-kind: role
-metadata:
-  name: sp-manager
-spec:
-  allow:
-    rules:
-    - resources:
-      - saml_idp_service_provider
-      verbs:
-      - list
-      - create
-      - read
-      - update
-      - delete
-version: v7
-```
-
-Create the role with `tctl`:
-
-```code
-$ tctl create sp-manager.yaml
-role 'saml-idp-service-provider-manager' has been created
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-Next, add the role to your user.
-
-(!docs/pages/includes/add-role-to-user.mdx role="sp-manager"!)
-
-## Next steps
-- Configure [SAML Attribute Mapping](./saml-attribute-mapping.mdx).
diff --git a/docs/pages/admin-guides/access-controls/login-rules/guide.mdx b/docs/pages/admin-guides/access-controls/login-rules/guide.mdx
deleted file mode 100644
index ce7662b381b65..0000000000000
--- a/docs/pages/admin-guides/access-controls/login-rules/guide.mdx
+++ /dev/null
@@ -1,287 +0,0 @@
----
-title: Set Up Login Rules 
-description: Set up Login Rules to transform user traits
----
-
-This guide will walk you through the process of writing, testing, and adding the
-first Login Rule to your Teleport cluster.
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-Before you get started you’ll need a running Teleport Enterprise or Cloud
-cluster on version `11.3.1` or greater.
-
-Login Rules only operate on SSO logins, so make sure you have
-configured an OIDC, SAML, or GitHub connector before you begin.
-Check the [Single Sign-On](../sso/sso.mdx) docs to learn how to set this up.
-
-## Step 1/5. Configure RBAC
-
-First, ensure you are logged into Teleport as a user that has permissions
-to read and modify `login_rule` resources. The preset `editor` role
-has access to this already, but in case you are using a more customized configuration,
-create a role called `loginrule-manager.yaml` with the following contents:
-
-```yaml
-kind: role
-metadata:
-  name: loginrule-manager
-spec:
-  allow:
-    rules:
-      - resources: [login_rule]
-        verbs: [list, create, read, update, delete]
-version: v7
-```
-
-Create the role with `tctl`:
-
-```code
-$ tctl create loginrule-manager.yaml
-role 'loginrule-manager' has been created
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-(!docs/pages/includes/add-role-to-user.mdx role="loginrule-manager" !)
-
-## Step 2/5. Draft your Login Rule resource
-
-The following example will give all users a new `logins` trait set to the value
-of their current `username` trait converted to lowercase.
-Copy this example rule to a file called `my_rule.yaml` to continue with the
-guide.
-
-```yaml
-# my_rule.yaml
-kind: login_rule
-version: v1
-metadata:
-  # Each Login Rule must have a unique name within the cluster.
-  name: my_rule
-
-  # expires is optional and usually should not be set for deployed login
-  # rules, but it can be useful to set an expiry a short time in the future
-  # while testing new Login Rules to prevent potentially locking yourself out of
-  # your Teleport cluster.
-  # expires: "2023-01-31T00:00:00-00:00"
-spec:
-  # priority orders the evaluation of Login Rules if multiple are present in the
-  # cluster, lower priorities are evaluated first.
-  priority: 0
-
-  # traits_expression is a predicate expression which will be evaluated to
-  # determine the final traits for each SSO user during login.
-  #
-  # This example expression sets the "logins" trait to the incoming "username"
-  # trait converted to lowercase.
-  traits_expression: 'external.put("logins", strings.lower(external["username"]))'
-```
-
-Each Login Rule resource must have either a `traits_map` or `traits_expression`
-field.
-In this guide we will use an example `traits_expression`.
-
-The `traits_expression` is a form of script which will be evaluated by your
-Teleport cluster at runtime to determine the traits for each SSO user who logs
-in.
-The expression can access the incoming traits for the user via the `external`
-variable.
-The `external` variable is a dictionary which maps trait keys to sets of values
-for that trait.
-
-## Step 3/5. Test the Login Rule
-
-The `tctl login_rule test` command can be used to experiment with new Login
-Rules to check their syntax and see exactly how they will operate on example
-incoming traits.
-
-Fetch your user's current traits and store them in `input.json`, then test your
-new Login Rule with that input.
-
-```code
-$ tctl get --format json users/<Var name="username"/> | jq 'first.spec.traits' > input.json
-$ tctl login_rule test --resource-file my_rule.yaml input.json
-access:
-- staging
-groups:
-- dbs
-- devs
-logins:
-- alice
-```
-
-This script will catch any syntax errors in your expressions.
-Make sure that all expected traits are present in the output.
-
-## Step 4/5. Create the Login Rule
-
-Use the following command to create the Login Rule in your cluster:
-
-```code
-$ tctl create my_rule.yaml
-```
-
-## Step 5/5. Try it out
-
-As a final step, log out of your cluster, then log in again and make sure your user received the
-expected traits and roles.
-You can check the traits and roles with the following command:
-
-```code
-$ tctl get --format json users/<Var name="username"/> | jq '{traits: first.spec.traits, roles: first.spec.roles}'
-{
-  "traits": {
-    "access": [
-      "staging"
-    ],
-    "groups": [
-      "dbs",
-      "devs"
-    ],
-    "logins": [
-      "alice"
-    ]
-  },
-  "roles": [
-    "access",
-    "editor",
-    "auditor"
-  ]
-}
-```
-
-## Troubleshooting
-
-The [`tctl sso test`](../../../reference/cli/tctl.mdx) command can be used to
-debug SSO logins and see exactly which traits are being sent by your SSO
-provider and how they are being mapped by your Login Rules.
-
-`tctl sso test` expects a connector spec.  Run the following command to debug
-with a connector currently installed in your cluster, replacing 
-<Var name="SSO connector name"/> with the name of the SSO connector you registered with
-Teleport: 
-
-```code
-$ tctl get connector/<Var name="SSO connector name"/> --with-secrets | tctl sso test
-```
-
-## Next steps
-
-To learn more about the Login Rule expression syntax, check out the
-[Login Rule Reference](../../../reference/access-controls/login-rules.mdx) page.
-
-Learn about the `tctl login_rule test` command by running the help command or
-checking the [reference page](../../../reference/cli/tctl.mdx).
-```code
-$ tctl help login_rule test
-```
-
-The following `tctl` resource commands are helpful for viewing and modifying the
-login rules currently installed in your cluster.
-
-Command | Description
-------- | -----------
-`tctl get login_rules` | Show all Login Rules installed in your cluster.
-`tctl get login_rule/<rule_name>` | Get a specific installed Login Rule.
-`tctl create login_rule.yaml` | Install a new Login Rule.
-`tctl create -f login_rule.yaml` | Overwrite an existing Login Rule.
-`tctl rm login_rule/<rule_name>` | Delete a Login Rule.
-
-## Example Login Rules
-
-### Set a trait to a static list of values defined per group
-
-```yaml
-kind: login_rule
-version: v1
-metadata:
-  name: example
-spec:
-  priority: 0
-  traits_expression: |
-    external.put("allow-env",
-      choose(
-        option(external.group.contains("dev"), set("dev", "staging")),
-        option(external.group.contains("qa"), set("qa", "staging")),
-        option(external.group.contains("admin"), set("dev", "qa", "staging", "prod")),
-        option(true, set()),
-      ))
-```
-
-### Use only specific traits provided by the OIDC/SAML provider
-
-To only keep the `groups` and `email` traits, with their original values:
-
-```yaml
-kind: login_rule
-version: v1
-metadata:
-  name: example
-spec:
-  priority: 0
-  traits_map:
-    groups:
-      - external.groups
-    email:
-      - external.email
-```
-
-### Remove a specific trait
-
-To remove a specific trait and keep the rest:
-
-```yaml
-kind: login_rule
-version: v1
-metadata:
-  name: example
-spec:
-  priority: 0
-  traits_expression: |
-    external.remove("big-trait")
-```
-
-### Extend a specific trait with extra values
-
-```yaml
-kind: login_rule
-version: v1
-metadata:
-  name: example
-spec:
-  priority: 0
-  traits_expression: |
-    external.add_values("logins", "ubuntu", "ec2-user")
-```
-
-### Use the output of one Login Rule in another rule
-
-```yaml
-kind: login_rule
-version: v1
-metadata:
-  name: set_groups
-spec:
-  priority: 0
-  traits_expression: |
-    external.put("groups",
-      ifelse(external.groups.contains("admins"),
-        external["groups"].add("superusers"),
-        external["groups"]))
----
-kind: login_rule
-version: v1
-metadata:
-  name: set_logins
-spec:
-  priority: 1
-  traits_expression: |
-    ifelse(external.groups.contains("superusers"),
-      external.add_values("logins", "root"),
-      external)
-```
diff --git a/docs/pages/admin-guides/access-controls/login-rules/login-rules.mdx b/docs/pages/admin-guides/access-controls/login-rules/login-rules.mdx
deleted file mode 100644
index f179a2a8b4ec9..0000000000000
--- a/docs/pages/admin-guides/access-controls/login-rules/login-rules.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-title: Login Rules 
-description: Transform User Traits with Login Rules
-layout: tocless-doc
----
-
-When users log in to your Teleport cluster with a configured SSO provider,
-**Login Rules** can transform the traits provided by your IdP to meet your needs
-for configuring access within Teleport.
-Login Rules are a feature of Teleport Enterprise.
-
-Some use cases for Login Rules are:
-
-- When you need to modify a user trait based on logical rules, like
-  "users in group `db-admins` should also be added to group `db-users`",
-  Login Rules provide a powerful expression language to make these changes
-  without needing to modify claims in your IdP.
-- When your IdP provides a large number of traits with many values, all of these
-  traits will be included in your user's SSH certificates and JWTs, which can
-  become too large for some third-party applications to handle.  Login Rules can
-  filter out unnecessary traits and keep just the ones you need.
-- When you have multiple [Role Templates](../guides/role-templates.mdx) repeating
-  the same logic to combine and transform external traits, consider using Login
-  Rules to consolidate the logic to one place and simplify your Roles.
-
-Login Rules can solve these problems without requiring changes to your
-organization's IdP.
-
-Login Rules use a predicate language to provide maximum flexibility when
-configuring your cluster.
-This allows you to write simple or complex expressions to define the traits your
-users should be granted.
-
-For example, you can convert the value of a `username` trait to lowercase and
-conditionally extend the value of a groups trait with the following
-snippet:
-```yaml
-traits_map:
-  username:
-    - 'strings.lower(external.username)'
-  groups:
-    - 'ifelse(external.groups.contains("db-admins"), external.groups.add("db-users"), external.groups)'
-```
-
-Check out the [Login Rules guide](guide.mdx) for a quick walkthrough
-that will show you how to write, test, and add the first Login Rule to your
-cluster. See [example Login Rules](guide.mdx) to
-learn how to address common use cases.
-
-When you're ready to take full advantage of Login Rules in your cluster, see the
-[Login Rules Reference](../../../reference/access-controls/login-rules.mdx) for details on the expression
-language that powers them.
-
-## FAQ
-
-### Which users do Login Rules apply to?
-
-Login Rules apply to all users logging in via OIDC, SAML, or GitHub.
-They do not apply to local Teleport users.
-
-### When are Login Rules evaluated?
-
-Login Rules are evaluated once during each user login, after receiving the
-claims or assertions from your IdP, before mapping claims/assertions to Teleport
-roles, and before generating user certificates.
-If Login Rules modify any traits used for role mapping, the role mapping will be
-affected.
-
-### Can I define custom helper functions for the predicate language?
-
-No, but if you have a use case which is not adequately met by the currently
-supported helper functions, please talk to support or submit a GitHub issue and
-we will consider adding helpers which are generally useful.
-
-### Can I have multiple Login Rules in a single cluster?
-
-Yes.
-All Login Rules installed in the cluster will first be sorted by priority and
-then evaluated in order.
-Each subsequent Login Rule will receive the full output of the previous rule as
-its input.
-It is strongly recommended to give each Login Rule a unique priority, but ties
-will be broken by sorting by the rule name.
diff --git a/docs/pages/admin-guides/access-controls/okta/okta.mdx b/docs/pages/admin-guides/access-controls/okta/okta.mdx
deleted file mode 100644
index 96e7eabea7aa4..0000000000000
--- a/docs/pages/admin-guides/access-controls/okta/okta.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-title: Enroll the Teleport Okta Integration
-description: Describes how to set up the Teleport Okta integration in order to grant Teleport users access to resources managed in Okta.
----
-
-The Teleport Okta integration can import and grant access to resources from an
-Okta organizations, such as user profiles, groups and applications. Teleport can
-provision user accounts based Okta users, Okta applications can be accessed
-through Teleport's application access UI, and access to these applications along
-with user groups can be managed by Teleport's RBAC along with Access Requests.
-
-This guide shows you how to set up the Teleport Okta integration.
-
-## How it works
-
-Enrolling the Okta integration is a guided process and contains four components:
-
-1. **Single sign-on (SSO) integration:** Configures Teleport authentication with Okta as an
-   identity provider.
-2. **System for Cross-domain Identity Management (SCIM) integration:** Uses the
-   [SCIM standard](https://developer.okta.com/docs/concepts/scim/) to
-   allow nearly instant provisioning of Okta users in Teleport. This is
-   available only if Teleport Identity Governance is enabled. The SCIM
-   integration is optional for enabling user, application, and group sync.
-3. **User sync:** Imports Okta users as Teleport users via a continuous
-   reconciliation loop. It is usually slower than SCIM, but but more reliable,
-   and does not require a publicly accessible Teleport cluster. Combined with
-   SCIM, it provides both speed and reliability.
-4. **Application and group sync:** imports Okta applications and groups as Teleport
-   Access Lists. This enables you to manage access to Okta applications and user
-   groups via Teleport RBAC, including Access Requests.
-
-The Okta SSO integration is required for all other components of the Okta
-integration. User sync is required for application and group sync.
-
-Teleport manages Okta application group assignments using a declarative state
-approach. If an assignment is created via Teleport and subsequently removed via
-the Okta UI, Teleport will re-evaluate and potentially overwrite Okta UI changes
-to align with the state defined by Teleport's RBAC configuration.
-
-## Get started
-
-To start the enrolment, visit the Teleport Web UI and click **Access** and then
-**Integrations** on the menu bar at the left of the screen. Then click **Enroll
-New Integration** and select **Okta** tile.
-
-![Enroll an Access Request plugin](../../../../img/enterprise/plugins/enroll.png)
-
-This will bring you to the SSO integration configuration screen. Read [Guided
-Okta SSO Integration](./guided-sso.mdx) for supplementary instructions as you
-work through the guided flow.
-
-## Guides
-
-For supplemental information on the guided process, such as instructions on
-making changes in Okta, review the documentation in this section:
-
-<DocCardList />
-
-## Managing integration components
-
-At any point in the guided flow, you can return to the integration status page
-to manage any component of the integration. To open the integration status page
-in the Teleport Web UI, navigate to **Access** -> **Integrations** and click
-anywhere on the Okta integration row.
-
-![Okta integration #1](../../../../img/enterprise/plugins/okta/okta-status-page-1.png)
-
-## Deleting the Okta integration
-
-You can delete the Okta integration by taking the following steps:
-
-1. Clean up user accounts created by the Okta integration. To do so, un-assign
-   all Okta users from the Okta SAML Application Teleport uses as its identity
-   provider, and wait for the sync process and/or SCIM provisioning to delete
-   the corresponding Teleport accounts. Once the Teleport accounts have been
-   automatically deleted you can proceed to delete the integration.
-
-1. Navigate to **Access** -> **Integrations** and click anywhere on the Okta
-   integration row to visit the integration status page. 
-
-1. Click **Delete Integration** .
-
-   ![Delete Okta integration](../../../../img/enterprise/plugins/okta/okta-delete-integration.png)
-
-1. Permanently delete the SAML connector created as part of the integration.
-   Navigate to the **Auth Connectors** page in the Teleport UI and select the
-   option to delete it.
-
-  The SAML connector created during the enrollment process is ***not*** deleted
-  when the hosted Okta integration is deleted, and will automatically be re-used
-  if the Okta integration is re-enrolled.
-
-1. Clean up Access Lists created by the Okta integration. These are not deleted
-   when the Okta integration is deleted. To delete Okta-sourced Access Lists,
-   run the following command:
-
-   ```code
-   $ tctl plugins cleanup okta
-   ```
-
-   If any Access Lists created by the integration are nested members or owners
-   of Teleport-created Access Lists, cleanup will fail. Any nested Access Lists
-   need to be unassigned before you can perform a cleanup.
-
-   <Admonition type="warning">
-   If the Okta integration is still active, removing Okta-sourced Access Lists
-   could revoke Okta access from users in your organization. Exercise caution
-   when cleaning up Access Lists.
-   </Admonition>
-
-Once the integration is deleted, you can manually remove any remaining user
-accounts with `tctl`.
diff --git a/docs/pages/admin-guides/access-controls/sso/adfs.mdx b/docs/pages/admin-guides/access-controls/sso/adfs.mdx
deleted file mode 100644
index d913d9df86e0f..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/adfs.mdx
+++ /dev/null
@@ -1,213 +0,0 @@
----
-title: SSO with Active Directory Federation Services
-description: How to configure Teleport access with Active Directory Federation Services
-h1: Single Sign-On with Active Directory Federation Services
----
-
-This guide will explain how to configure Active Directory Federation Services
-([ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services)) to be
-a single sign-on (SSO) provider to issue login credentials to specific groups
-of users. When used in combination with role based access control (RBAC), it
-allows Teleport administrators to define policies like:
-
-- Only members of "DBA" group can SSH into machines running PostgreSQL.
-- Developers must never SSH into production servers.
-
-## Prerequisites
-
-- ADFS installation with Admin access and users assigned to at least two groups.
-- Teleport role with access to maintaining `saml` resources.  This is available in the default `editor` role.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Configure ADFS
-
-You'll need to configure ADFS to export claims about a user (Claims Provider
-Trust in ADFS terminology) and you'll need to configure ADFS to trust
-Teleport (a Relying Party Trust in ADFS terminology).
-
-For Claims Provider Trust configuration, open the **AD FS** management window.
-Under **Claims Provider Trusts**, right-click on **Active Directory** and
-select **Edit Claim Rules**. You'll need to specify at least the following two
-incoming claims: `Name ID` and `Group`.
-
-- `Name ID` should be a mapping of the LDAP Attribute `E-Mail-Addresses` to
-  `Name ID`.
-
-  ![Name ID Configuration](../../../../img/adfs-1.png)
-
-- A group membership claim should be used to map users to roles (for example to
-  separate normal users and admins).
-
-  ![Group Configuration](../../../../img/adfs-2.png)
-
-- If you are using dynamic roles (see below), it may be useful to map the LDAP
-  Attribute `SAM-Account-Name` to `Windows account name`:
-
-  ![WAN Configuration](../../../../img/adfs-3.png)
-
-- And create another mapping of `E-Mail-Addresses` to `UPN`:
-
-  ![UPN Configuration](../../../../img/adfs-4.png)
-
-You'll also need to create a Relying Party Trust. Use the below information to
-help guide you through the Wizard.
-
-- Create a Relaying Party Trust:
-  ![Add a Claims Provider Trust](../../../../img/adfs-add-provider-trust.png)
-- Enter data about the relying party manually.
-- Set the display name to something along the lines of `Teleport`.
-- Skip the token encryption certificate.
-- Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to
-  `https://teleport.example.com/v1/webapi/saml/acs`, replacing the domain name
-  with your Teleport proxy URL.
-- Set the relying party trust identifier to
-  `https://teleport.example.com/v1/webapi/saml/acs` as well.
-- For access control policy select *"Permit everyone"*.
-
-Once the Relying Party Trust has been created, update the Claim Issuance Policy
-for it. Like before, make sure you send at least `Name ID` and `Group` claims to the
-relying party (Teleport). If you are using dynamic roles, it may be useful to
-map the LDAP Attribute `SAM-Account-Name` to *"Windows account name"* and create
-another mapping of `E-Mail-Addresses` to *"UPN"*.
-
-Lastly, ensure the user you create in Active Directory has an email address
-associated with it. To check this open Server Manager then
-*"Tools -> Active Directory Users and Computers"* and select the user and right
-click and open properties. Make sure the email address field is filled out.
-
-## Step 2/3. Create Teleport roles
-
-Let's create two Teleport roles: one for administrators and the other for
-normal users. You can create them using the `tctl create {file name}` CLI command
-or via the Web UI.
-
-```yaml
-# admin-role.yaml
-kind: "role"
-version: "v3"
-metadata:
-  name: "admin"
-spec:
-  options:
-    max_session_ttl: "8h0m0s"
-  allow:
-    logins: [ root ]
-    node_labels:
-      "*": "*"
-    rules:
-      - resources: ["*"]
-        verbs: ["*"]
-```
-
-```yaml
-# user-role.yaml
-kind: "role"
-version: "v3"
-metadata:
-  name: "dev"
-spec:
-  options:
-    # regular users can only be guests and their certificates will have a TTL of 1 hour:
-    max_session_ttl: "1h"
-  allow:
-    # only allow login as either ubuntu or the 'windowsaccountname' claim
-    logins: [ '{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}', ubuntu ]
-    node_labels:
-      "access": "relaxed"
-```
-
-This role declares:
-
-- Devs are only allowed to log in to nodes labeled `access: relaxed`.
-- Developers can log in as the `ubuntu` user.
-- Developers will not be able to see or replay past sessions or
-  re-configure the Teleport cluster.
-
-The login
-<nobr>`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`</nobr>
-configures Teleport to look at the
-`http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
-attribute and use that field as an allowed login for each user. Since the name
-of the attribute contains characters besides letters, numbers, and underscores,
-you must use double quotes (`"`) and square brackets (`[]`) around the name of
-the attribute.
-
-## Step 3/3. Create a SAML connector
-
-Create a SAML connector resource using `tctl`:
-
-```code
-$ tctl sso configure saml --acs https://teleport.example.com/v1/webapi/saml/acs \
-  --preset adfs \
-  --entity-descriptor https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml \
-  --attributes-to-roles http://schemas.xmlsoap.org/claims/Group,teleadmins,editor \
-  --attributes-to-roles http://schemas.xmlsoap.org/claims/Group,Users,access \
-  > adfs.yaml
-```
-
-The `acs` field should match the value you set in ADFS earlier and you can
-obtain the `entity_descriptor_url` from ADFS under *"ADFS -> Service -> Endpoints -> Metadata"*.
-
-The `attributes_to_roles` is used to map attributes to the Teleport roles you
-just created. In our situation, we are mapping the *"Group"* attribute whose full
-name is `http://schemas.xmlsoap.org/claims/Group` with a value of *"teleadmins"*
-to the *"editor"* role. Groups with the value *"users"* is being mapped to the
-*"users"* role.
-
-You can test this connector before applying it (`cat adfs.yaml | tctl sso test`),
-but until we complete the next step the authentication process will not complete.
-
-Apply the connector:
-
-```code
-$ tctl create -f adfs.yaml
-```
-
-### Export the signing key
-
-For the last step, you'll need to export the signing key:
-
-```code
-$ tctl saml export adfs > saml.cer
-```
-
-Copy `saml.cer`, to ADFS server, open the "Relying Party Trust" and add this
-file as one of the signature verification certificates:
-
-![adfs-add-teleport-cert.png](../../../../img/adfs-add-teleport-cert.png)
-
-The Web UI will now contain a new button: "Login with MS Active Directory". The CLI is
-the same as before:
-
-```code
-$ tsh --proxy=proxy.example.com login
-```
-
-This command will print the SSO login URL and try to open it
-automatically in a browser.
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  Teleport can use multiple SAML connectors. In this case a connector name
-  can be passed via `tsh login --auth=connector_name`
-</Admonition>
-
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
-
-## Next steps
-
-In the Teleport role we illustrated in this guide, `external` traits
-are replaced with values from the single sign-on provider that the user
-used to authenticate to Teleport. For full details on how traits
-work in Teleport roles, see the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
-
diff --git a/docs/pages/admin-guides/access-controls/sso/azuread.mdx b/docs/pages/admin-guides/access-controls/sso/azuread.mdx
deleted file mode 100644
index 886b18933517a..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/azuread.mdx
+++ /dev/null
@@ -1,418 +0,0 @@
----
-title: Teleport Authentication with Azure Active Directory (AD)
-description: How to configure Teleport access with Azure Active Directory.
----
-
-This guide will cover how to configure Microsoft Entra ID to issue credentials
-to specific groups of users with a SAML Authentication Connector. When used in
-combination with role-based access control (RBAC), it allows Teleport
-administrators to define policies like:
-
-- Only members of the "DBA" Microsoft Entra ID group can connect to PostgreSQL
-  databases.
-- Developers must never SSH into production servers.
-
-The following steps configure an example SAML authentication connector matching
-Microsoft Entra ID groups with security roles. You can choose to configure other
-options.
-
-## Prerequisites
-
-Before you get started, you’ll need:
-
-- A Microsoft Entra ID admin account with access to creating non-gallery
-  applications (P2 License).
-- To register one or more users in the directory.
-- To create at least two security groups in Microsoft Entra ID and assign one or
-  more users to each group.
-- A Teleport role with access to maintaining `saml` resources. This is available
-  in the default `editor` role.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Configure Microsoft Entra ID
-
-### Create an enterprise application
-
-1. Select **Azure AD -> Enterprise Applications**
-
-   ![Select Enterprise Applications From Manage](../../../../img/azuread/azuread-1-home.png)
-
-1. Select **New application**
-
-   ![Select New Applications From Manage](../../../../img/azuread/azuread-2-newapp.png)
-
-1. Select **Create your own application**, enter the application name (for example,
-   Teleport), and select **Integrate any other application you don't find in
-   the gallery (Non-gallery)**.
-
-   ![Select Non-gallery application](../../../../img/azuread/azuread-3-createnongalleryapp.png)
-
-1. Select **Properties** under **Manage** and set **Assignment required?** to **No**
-
-   ![Turn off user assignment](../../../../img/azuread/azuread-4-turnoffuserassign.png)
-
-   Click **Save** before proceeding to the next step.
-
-### Configure SAML
-
-1. Select **Single sign-on** under **Manage** and choose **SAML**
-
-   ![Select SAML](../../../../img/azuread/azuread-5-selectsaml.png)
-
-1. Edit the **Basic SAML Configuration**
-
-   ![Edit Basic SAML Configuration](../../../../img/azuread/azuread-6-editbasicsaml.png)
-
-1. Enter the URL for your Teleport Proxy Service host in the **Entity ID** and
-   **Reply URL**  fields, for example:
-
-   ```code
-   https://mytenant.teleport.sh:443/v1/webapi/saml/acs/ad
-   ```
-
-   ![Put in Entity ID and Reply URL](../../../../img/azuread/azuread-7-entityandreplyurl.png)
-
-   Click **Save** before proceeding to the next step.
-
-1. In **SAML Certificates** section, copy the **App Federation
-   Metadata URL** link and save it for use in our Teleport connector configuration:
-
-   ![Download Federation Metadata XML](../../../../img/azuread/azuread-9-fedmeatadataxml.png)
-
-### Edit attributes & claims
-
-1. Click on **Unique User Identifier (Name ID)** under **Required claim**.
-
-1. Change the "name identifier format" to **Default**. Make sure the source
-  attribute is `user.userprincipalname`.
-
-   ![Confirm Name Identifier](../../../../img/azuread/azuread-8a-nameidentifier.png)
-
-1. Add a group claim to make user security groups available to the connector:
-
-   ![Put in Security group claim](../../../../img/azuread/azuread-8b-groupclaim.png)
-
-1. (optional) Add a claim that transforms the format of the Azure AD username to lower case, in order to use it inside
-   Teleport roles as the `{{external.username}}` property.
-
-   Set the Source to "Transformation". In the new panel:
-
-   - Set the Transformation value to "Extract()"
-
-   - Set the Attribute name to `user.userprincipalname`.
-
-   - Set the Value to `@`.
-
-   - Click "Add Transformation" and set the Transformation to `ToLowercase()`.
-
-     ![Add a transformed username](../../../../img/azuread/azuread-8c-usernameclaim.png)
-
-## Step 2/3. Create a SAML connector
-
-Now, create a SAML connector resource using `tctl`.
-
-```code
-$ tctl sso configure saml --preset ad \
---entity-descriptor https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml\?appid\=b8d06e01... \
---attributes-to-roles http://schemas.microsoft.com/ws/2008/06/identity/claims/groups,41c94563...,dev \
---attributes-to-roles http://schemas.microsoft.com/ws/2008/06/identity/claims/groups,8adac502...,access > azure-connector.yaml
-```
-
-In the example above:
-
-- `--entity-descriptor` specifies the app federation metadata URL saved in the
-  previous step.
-- Each `--attributes-to-roles` specifies the name of the schema definition for groups,
-  groups, the UUID of an AD group, and the Teleport role that members of the group
-  will be assigned.
-
-The file `azure-connector.yaml` should now resemble the following:
-
-```yaml
-kind: saml
-metadata:
-  name: ad
-spec:
-  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
-  attributes_to_roles:
-  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
-    roles:
-    - dev
-    value: 41c94563...
-  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
-    roles:
-    - access
-    value: 8adac502...
-  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
-  cert: ""
-  display: Microsoft
-  entity_descriptor: ""
-  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
-  issuer: ""
-  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
-  sso: ""
-version: v2
-
-```
-
-With the connector in place on the cluster, you can test it with `tctl`:
-
-```code
-$ cat azure-connector.yaml | tctl sso test
-```
-
-Your browser should open and log you in to the Teleport cluster using your
-Azure AD credentials. If there are any problems, the CLI output will help you
-debug the connector configuration.
-
-
-To create the connector using the `tctl` tool, run the following command:
-
-```code
-$ tctl create -f azure-connector.yaml
-```
-
-## Step 3/3. Create a new Teleport role
-
-Create a Teleport role resource that will use external username data from the
-Azure AD connector to determine which Linux logins to allow on a host.
-
-Create a file called `dev.yaml` with the following content:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  options:
-    max_session_ttl: 24h
-  allow:
-    # only allow login as either ubuntu or the 'windowsaccountname' claim
-    logins: [ '{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}', ubuntu ]
-    node_labels:
-      access: relaxed
-```
-
-Users with the `dev` role are only allowed to log in to nodes with the `access:
-relaxed` Teleport label. They can log in as either `ubuntu` or a username that
-is passed in from the Azure AD connector using the `windowsaccountname`
-attribute.
-
-The login
-<nobr>`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`</nobr>
-configures Teleport to look at the
-`http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
-attribute and use that field as an allowed login for each user. Since the name
-of the attribute contains characters besides letters, numbers, and underscores,
-you must use double quotes (`"`) and square brackets (`[]`) around the name of
-the attribute.
-
-Create the role:
-
-```code
-$ tctl create dev.yaml
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
-## Token encryption (Optional)
-
-Azure AD's SAML token encryption encrypts the SAML assertions sent to Teleport
-during SSO redirect.
-
-Token encryption is an Azure Active Directory premium feature and requires a
-separate license. Since traffic between Azure AD and the Teleport Proxy Service
-already uses HTTPS, token encryption is optional. To determine whether you
-should enable token encryption, read the Azure AD
-[documentation](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption).
-
-### Set up Teleport token encryption
-
-Start with generating a public/private key and a certificate. You will set up
-the public certificate with Azure AD and the private key with Teleport.
-
-```code
-$ openssl req -nodes -new -x509 -keyout server.key -out server.cer
-```
-
-If you are modifying the existing connector, open it in your editor:
-
-```code
-$ tctl edit saml
-```
-
-You will notice that Teleport has generated a `signing_key_pair`. This key pair
-is used to sign responses.
-
-```yaml
-kind: saml
-metadata:
-  name: ad
-spec:
-  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  attributes_to_roles:
-  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
-    roles:
-    - editor
-    - access
-    - auditor
-    value: '*'
-  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  cert: ""
-  display: Microsoft
-  entity_descriptor:
-  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
-  issuer: https://sts.windows.net/your-id-here/
-  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  signing_key_pair:
-    cert: |
-      -----BEGIN CERTIFICATE-----
-      ...
-      -----END CERTIFICATE-----
-    private_key: |
-      -----BEGIN RSA PRIVATE KEY-----
-      ...
-      -----END RSA PRIVATE KEY-----
-  sso: https://login.microsoftonline.com/your-id-here/saml2
-version: v2
-```
-
-Add `assertion_key_pair` using the data from `server.key` and `server.cer`.
-
-```yaml
-kind: saml
-metadata:
-  name: azure-saml
-spec:
-  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  attributes_to_roles:
-  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
-    roles:
-    - editor
-    - access
-    - auditor
-    value: '*'
-  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  cert: ""
-  display: Microsoft
-  entity_descriptor:
-  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
-  issuer: https://sts.windows.net/your-id-here/
-  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  signing_key_pair:
-    cert: |
-      -----BEGIN CERTIFICATE-----
-      ...
-      -----END CERTIFICATE-----
-    private_key: |
-      -----BEGIN RSA PRIVATE KEY-----
-      ...
-      -----END RSA PRIVATE KEY-----
-  sso: https://login.microsoftonline.com/your-id-here/saml2
-version: v2
-```
-
-<Admonition
-  type="warning"
-  title="Warning"
->
-  Make sure to have the same indentation for all lines of the certificate and key, otherwise
-  Teleport will not parse the YAML file.
-</Admonition>
-
-After your edits, the file will look like this:
-
-```yaml
-kind: saml
-metadata:
-  name: azure-saml
-spec:
-  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  attributes_to_roles:
-  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
-    roles:
-    - editor
-    - access
-    - auditor
-    value: '*'
-  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  cert: ""
-  display: Microsoft
-  entity_descriptor:
-  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
-  issuer: https://sts.windows.net/your-id-here/
-  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
-  assertion_key_pair:
-    cert: |
-      -----BEGIN CERTIFICATE-----
-      New CERT
-      -----END CERTIFICATE-----
-    private_key: |
-      -----BEGIN RSA PRIVATE KEY-----
-      New private key
-      -----END RSA PRIVATE KEY-----
-  signing_key_pair:
-    cert: |
-      -----BEGIN CERTIFICATE-----
-      ...
-      -----END CERTIFICATE-----
-    private_key: |
-      -----BEGIN RSA PRIVATE KEY-----
-      ...
-      -----END RSA PRIVATE KEY-----
-  sso: https://login.microsoftonline.com/your-id-here/saml2
-version: v2
-```
-
-Update the connector by saving and closing the file in your editor.
-
-### Activate token encryption
-
-- Navigate to **Token Encryption**:
-
-![Navigate to token encryption](../../../../img/azuread/azuread-token-encryption-0.png)
-
-- Import certificate
-
-![Import certificate](../../../../img/azuread/azuread-token-encryption-1-import.png)
-
-- Activate it
-
-![Activate certificate](../../../../img/azuread/azuread-token-encryption-2-activate.png)
-
-If the SSO login with this connector is successful, the encryption works.
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
-
-### Failed to process SAML callback
-
-If you encounter a "Failed to process SAML callback" error, take a look at the audit log.
-
-```text
-Special characters are not allowed in resource names. Use a name composed only from
-alphanumeric characters, hyphens, and dots: /web/users/ops_example.com#EXT#@opsexample.onmicrosoft.com/params
-```
-
-The error above is caused by a Name ID format that is not compatible with Teleport's naming conventions.
-
-Change the Name ID format to use email instead:
-
-![Change NameID format to use email](../../../../img/azuread/azuread-nameid.png)
-
-## Further reading
-
-- [Teleport Configuration Resources Reference](../../../reference/resources.mdx)
-- In the Teleport role we illustrated in this guide, `external` traits
-  are replaced with values from the single sign-on provider that the
-  user used to authenticate to Teleport. For full details on how traits
-  work in Teleport roles, see the [Access Controls
-  Reference](../../../reference/access-controls/roles.mdx).
-
diff --git a/docs/pages/admin-guides/access-controls/sso/gitlab.mdx b/docs/pages/admin-guides/access-controls/sso/gitlab.mdx
deleted file mode 100644
index d4a43f9160067..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/gitlab.mdx
+++ /dev/null
@@ -1,229 +0,0 @@
----
-title: Authentication With GitLab as an SSO provider
-description: How to configure Teleport access using GitLab for SSO
-h1: Teleport SSO Authentication with GitLab
----
-
-This guide will cover how to configure [GitLab](https://www.gitlab.com/) to issue
-credentials to specific groups of users. When used in combination with role
-based access control (RBAC), it allows administrators to define policies
-like:
-
-- Only members of the "DBA" group can access PostgreSQL databases.
-- Only members of "ProductionKubernetes" can access production Kubernetes clusters
-- Developers must never SSH into production servers.
-
-## Prerequisites
-
-- At least two groups in GitLab with users assigned. In our examples below,
-  we'll assume a group named `company` with two subgroups, `admin` and `dev`.
-- Teleport role with access to maintaining `oidc` resources.  This is available
-  in the default `editor` role.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Configure GitLab
-
-You should have at least one group configured in GitLab to map to Teleport roles.
-In this example we use the names `gitlab-dev` and `gitlab-admin`.  Assign users
-to each of these groups.
-
-1. Create an application in one of your groups (**Group overview** ->
-   **Settings** -> **Applications**) that will allow using GitLab as an OAuth
-   provider to Teleport.
-
-   Settings:
-
-   - Redirect URL: `https://<proxy url>/v1/webapi/oidc/callback`.
-   - Check `Confidential`, `openid`, `profile`, and `email`.
-
-   ![Create App](../../../../img/sso/gitlab/gitlab-oidc-0.png)
-
-1. Collect the `Application ID` and `Secret` in the Application. These will be
-   used in the Teleport OIDC auth connector:
-
-   ![Collection Information](../../../../img/sso/gitlab/gitlab-oidc-1.png)
-
-1. Confirm the GitLab issuer address.
-
-   For GitLab.com, the issuer address is `https://gitlab.com`. This allows
-   Teleport to access the Open-ID configuration at
-   `https://gitlab.com/.well-known/openid-configuration`. If you are self
-   hosting the issuer address is the path to your GitLab instance.
-
-## Configure Teleport
-
-### Create a OIDC Connector
-
-Create an OIDC connector resource using `tctl`.
-
-On your workstation, create a file called `client-secret.txt` consisting only of
-your client secret.
-
-<Tabs>
-<TabItem label="GitLab.com">
-Replace the application ID and secret with the values from GitLab:
-
-```code
-$ tctl sso configure oidc --preset gitlab \
---id <APPLICATION-ID> \
---secret $( cat client-secret.txt) \
---claims-to-roles groups,company/admin,admin \
---claims-to-roles groups,company/dev,dev > oidc.yaml
-```
-
-</TabItem>
-<TabItem label="Self-hosted">
-Replace the application ID and secret with the values from GitLab, and replace
-`https://gitlab.company.com` with the path to your self-hosted GitLab instance:
-
-```code
-$ tctl sso configure oidc --preset gitlab \
---id <APPLICATION-ID> \
---issuer-url https://gitlab.company.com \
---secret $( cat client-secret.txt) \
---claims-to-roles groups,company/admin,admin \
---claims-to-roles groups,company/dev,dev > oidc.yaml
-```
-
-</TabItem>
-</Tabs>
-
-This example maps the two subgroups `admin` and `dev` of the parent group
-`company` to the `admin` and `dev` roles in Teleport, and creates the `oidc.yaml` file:
-
-```yaml
-kind: oidc
-metadata:
-  name: gitlab
-spec:
-  claims_to_roles:
-  - claim: groups
-    roles:
-    - admin
-    value: company/admin
-  - claim: groups
-    roles:
-    - dev
-    value: company/gitlab-dev
-  client_id: <APPLICATION-ID>
-  client_secret: <APPLICATION-SECRET>
-  display: GitLab
-  issuer_url: https://gitlab.com
-  prompt: none
-  redirect_url: https://teleport.example.com:443/v1/webapi/oidc/callback
-version: v3
-
-```
-
-Test the connector resource by piping the file to `tctl sso test`:
-
-```code
-$ cat oidc.yaml | tctl sso test
-```
-
-After authorizing the application in GitLab you should get a
-**Login Successful** message in your web browser. Otherwise, consult the output
-of the command to diagnose.
-
-Create the connector using `tctl` tool:
-
-```code
-$ tctl create -f oidc.yaml
-```
-
-## Create Teleport Roles
-
-We are going to create 2 roles, privileged role admin who is able to login as
-root and is capable of administrating the cluster and non-privileged dev.
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: admin
-spec:
-  options:
-    max_session_ttl: 24h
-  allow:
-    logins: [root]
-    node_labels:
-      "*": "*"
-    rules:
-      - resources: ["*"]
-        verbs: ["*"]
-```
-
-The developer role:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  options:
-    max_session_ttl: 24h
-  allow:
-    logins: [ "{{email.local(external.email)}}", ubuntu ]
-    node_labels:
-      access: relaxed
-```
-
-- Devs are only allowed to login to nodes labelled with `access: relaxed` label.
-- Developers can log in as `ubuntu` user
-- Notice the `{{external.email}}` login. It configures Teleport to look at the
-  *"email"* GitLab claim and use that field as an allowed login for each user.
-  The `email.local(external.trait)` function removes the `@domain` and preserves
-  the username prefix. For full details on how variable expansion works in
-  Teleport roles, see the [Access Controls
-  Reference](../../../reference/access-controls/roles.mdx).
-- Developers also do not have any "allow rules" i.e. they will not be able to
-  see/replay past sessions or re-configure the Teleport cluster.
-
-Create both roles on the Auth Service:
-
-```code
-$ tctl create -f admin.yaml
-$ tctl create -f dev.yaml
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-## Enable default OIDC authentication
-
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
-
-The Web UI will now contain a new button: "Login with GitLab". The CLI is
-the same as before:
-
-```code
-$ tsh --proxy=teleport.example.com login
-```
-
-This command will print the SSO login URL (and will try to open it
-automatically in a browser).
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  Teleport can use multiple OIDC/SAML connectors. In this case a connector name
-  can be passed via `tsh login --auth=connector_name`
-</Admonition>
-
-<Admonition
-  type="note"
-  title="IMPORTANT"
->
-  Teleport only supports sending party initiated flows for OIDC Connect. This
-  means you can not initiate login from your identity provider, you have to
-  initiate login from either the Teleport Web UI or CLI.
-</Admonition>
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
-
diff --git a/docs/pages/admin-guides/access-controls/sso/oidc.mdx b/docs/pages/admin-guides/access-controls/sso/oidc.mdx
deleted file mode 100644
index 84fd249c503dd..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/oidc.mdx
+++ /dev/null
@@ -1,297 +0,0 @@
----
-title: OAuth2 and OIDC authentication
-description: How to configure Teleport access with OAuth2 or OpenID connect (OIDC)
----
-
-This guide will explain how to configure an SSO provider using [OpenID
-Connect](http://openid.net/connect/) (also known as OIDC) to issue Teleport
-credentials to specific groups of users. When used in combination with role-based 
-access control (RBAC), OIDC allows Teleport administrators to define
-policies like:
-
-- Only members of the "DBA" group can connect to PostgreSQL databases.
-- Developers must never SSH into production servers.
-
-## Prerequisites
-
-- Admin access to the SSO/IdP being integrated with users assigned to groups/roles.
-- Teleport role with permission to maintain `oidc` resources. This permission is available
-  in the default `editor` role.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Identity Providers
-
-Register Teleport with the external identity provider you will be using and
-obtain your `client_id` and `client_secret`. This information should be
-documented on the identity providers website. Here are a few links:
-
-- [Auth0 Client Configuration](https://auth0.com/docs/applications)
-- [Google Identity Platform](https://developers.google.com/identity/protocols/OpenIDConnect)
-- [Keycloak Client Registration](https://www.keycloak.org/docs/latest/securing_apps/index.html#\_client_registration)
-
-<Admonition type="tip" title="Google Workspace">
-For Google Workspace, see [Teleport Authentication with Google Workspace](google-workspace.mdx)
-</Admonition>
-
-Save the relevant information from your identity provider. To make following
-this guide easier, you can add the Client ID here and it will be included in the
-example commands below:
-
-Client ID: <Var name="CLIENT-ID" description="The Client ID for your Teleport
-application, provided by your IdP"/>
-
-## OIDC Redirect URL
-
-OIDC relies on HTTP redirects to return control back to Teleport after
-authentication is complete. The redirect URL must be selected by a Teleport
-administrator in advance.
-
-The redirect URL for OIDC authentication in Teleport is <nobr>
-<Var name="mytenant.teleport.sh" description="Your Teleport Cloud tenant or Proxy
-Service address"/>`/v1/webapi/oidc/callback`</nobr>. 
-Replace <Var name="mytenant.teleport.sh" /> with your Teleport Cloud tenant or
-Proxy Service address.
-
-## OIDC connector configuration
-
-The next step is to add an OIDC connector to Teleport. The connectors are
-created, tested, and added or removed using `tctl` [resource
-commands](../../../reference/resources.mdx) or the Teleport Web UI.
-
-On your workstation, create a file called `client-secret.txt` consisting only of
-your client secret.
-
-To create a new connector, use `tctl sso configure`. The following example creates a
-connector resource file in YAML format named `oidc-connector.yaml`:
-
-```code
-$ tctl sso configure oidc --name <CONNECTOR-NAME> \
-  --issuer-url <PATH-TO-PROVIDER> \
-  --id <Var name="CLIENT-ID" /> \
-  --secret $(cat client-secret.txt) \
-  --claims-to-roles <CLAIM-KEY>,<CLAIM-VALUE>,access \
-  --claims-to-roles <CLAIM-KEY>,<CLAIM-VALUE>,editor > oidc-connector.yaml
-```
-
-- `--name`: Usually the name of the IdP, this is how the connector will be
-  identified in Teleport.
-- `--issuer-url`: This is the base path to the IdP's OIDC configuration endpoint,
-  excluding `.well-known/openid-configuration`. If, for example, the endpoint
-  is `https://example.com/.well-known/openid-configuration`, you would use
-  `https://example.com`.
-- `--id`: The client ID as defined in the IdP. Depending on your identity
-  provider this may be something you can define (for example, `teleport`), or may be an
-  assigned string.
-- `--secret`: The client token/secret provided by the IdP to authorize this client.
-- `--claims-to-roles`: A mapping of OIDC claims/values to be associated with
-  Teleport roles.
-
-For more information on these and all available flags, see the [tctl sso configure
-oidc](../../../reference/cli/tctl.mdx) section of the Teleport CLI
-Reference page.
-
-The file created should look like the example below. This connector requests
-the scope `<CLAIM-KEY>` from the identity provider, then maps the value to
-either the `access` or the `editor` role depending on the value returned for
-that key within the claims:
-
-```yaml
-(!examples/resources/oidc-connector.yaml!)
-```
-
-<details>
-<summary>Practical Example: Keycloak</summary>
-The following example was generated using Keycloak as the identity provider.
-Keycloak is being served at `keycloak.example.com`, and the Teleport Proxy
-Service is listening at `teleport.example.com`. In Keycloak, the client is
-named `teleport`. Under the `teleport-dedicated` client scope, we've added
-the "Group Membership" mapper:
-
-```yaml
-kind: oidc
-metadata:
-  name: keycloak
-spec:
-  claims_to_roles:
-  - claim: groups
-    roles:
-    - access
-    value: /users
-  - claim: groups
-    roles:
-    - editor
-    value: /admins
-  client_id: teleport
-  client_secret: abc123...
-  issuer_url: https://keycloak.example.com/realms/master
-  redirect_url: https://teleport.example.com:443/v1/webapi/oidc/callback
-version: v3
-
-```
-
-</details>
-
-Before applying the connector to your cluster, you can test that it's configured
-correctly:
-
-```code
-$ cat oidc-connector | tctl sso test
-```
-
-This should open up your web browser and attempt to log you in to the Teleport
-cluster through your IdP. If it fails, review the output of this command for
-troubleshooting details.
-
-<Admonition type="tip">
-The "[OIDC] Claims" section of the CLI output provides all the details of your
-user provided by the IdP. This is a good starting point while troubleshooting
-errors like `Failed to calculate user attributes.`
-</Admonition>
-
-After your tests are successful, create the connector:
-
-```code
-$ tctl create -f oidc-connector.yaml
-```
-
-### Optional: ACR Values
-
-Teleport supports sending Authentication Context Class Reference (ACR) values
-when obtaining an authorization code from an OIDC provider. By default ACR
-values are not set. However, if the `acr_values` field is set, Teleport expects
-to receive the same value in the `acr` claim, otherwise it will consider the
-callback invalid.
-
-In addition, Teleport supports OIDC provider specific ACR value processing
-which can be enabled by setting the `provider` field in OIDC configuration. At
-the moment, the only build-in support is for NetIQ.
-
-A example of using ACR values and provider specific processing is below:
-
-```yaml
-# example connector which uses ACR values
-kind: oidc
-version: v2
-metadata:
-  name: "oidc-connector"
-spec:
-  issuer_url: "https://oidc.example.com"
-  client_id: "xxxxxxxxxxxxxxxxxxxxxxx.example.com"
-  client_secret: "zzzzzzzzzzzzzzzzzzzzzzzz"
-  redirect_url: "https://mytenant.teleport.sh/v1/webapi/oidc/callback"
-  display: "Login with Example"
-  acr_values: "foo/bar"
-  provider: netiq
-  scope: [ "group" ]
-  claims_to_roles:
-     - claim: "group"
-       value: "editor"
-       roles: [ "editor" ]
-     - claim: "group"
-       value: "user"
-       roles: [ "access" ]
-```
-
-### Optional: Max age
-
-The `max_age` field controls the maximum age of users' sessions before they will
-be forced to reauthenticate. By default `max_age` is unset, meaning once a user
-authenticates using OIDC they will not have to reauthenticate unless the
-configured OIDC provider forces them to. This can be set to a duration of time
-to force users to reauthenticate more often. If `max_age` is set to zero
-seconds, users will be forced to reauthenticate with their OIDC provider every
-time they authenticate with Teleport.
-
-Note that the specified duration must be in whole seconds. `24h` works because that's
-the same as `1440s`, but `60s500ms` would not be allowed as that is 60.5 seconds.
-
-```yaml
-# Extra parts of OIDC yaml have been removed.
-spec:
-  max_age: 24h
-```
-
-Note that not all OIDC providers support setting `max_age`. Google and GitLab are
-both known not to support it and authentication with those providers will not work
-when the `max_age` field is set.
-
-### Optional: Prompt
-
-Set the Authorization Server prompt for the End-User for reauthentication and consent
-per the OIDC protocol. If no `prompt` value is set, Teleport uses `select_account` as
-default.
-
-```yaml
-# Extra parts of OIDC yaml have been removed.
-spec:
-  # Valid values as defined from https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-  # none: The Authorization Server must not display any authentication or consent user interface pages.
-  # select_account: The Authorization Server should prompt the End-User to select a user account.
-  # login: The Authorization Server should prompt the End-User for reauthentication.
-  # consent: The Authorization Server should prompt the End-User for consent before returning information to the Client.
-  prompt: 'login'
-```
-
-### Optional: Redirect URL and Timeout
-
-The redirect URL must be accessible by all user, optional redirect timeout.
-
-```yaml
-# Extra parts of OIDC yaml have been removed.
-spec:
-  redirect_url: https://<cluster-url>.example.com:3080/v1/webapi/oidc/callback
-  # Optional Redirect Timeout.
-  # redirect_timeout: 90s
-```
-
-### Optional: Disable email verification
-
-By default, Teleport validates the `email_verified` claim, and users who
-attempt to sign in without a verified email address are prevented from doing so:
-
-```text
-ERROR: SSO flow failed.
-identity provider callback failed with error: OIDC provider did not verify email.
-        email not verified by OIDC provider
-```
-
-For testing and other purposes, you can opt out of this behavior by enabling
-`allow_unverified_email` in your OIDC connector. This option weakens the overall
-security of the system, so we do not recommend enabling it.
-
-```yaml
-kind: oidc
-version: v2
-metadata:
-  name: connector
-spec:
-  allow_unverified_email: true
-```
-
-### Optional: Specify a claim to use as the username
-
-By default, Teleport will use the user's email as their Teleport username.
-
-You can define a `username_claim` to specify the claim that should be used as
-the username instead:
-
-```yaml
-kind: oidc
-version: v2
-metadata:
-  name: connector
-spec:
-  # Use the `preferred_username` claim as the user's Teleport username.
-  username_claim: preferred_username
-```
-
-## Enable default OIDC authentication
-
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/admin-guides/access-controls/sso/okta.mdx b/docs/pages/admin-guides/access-controls/sso/okta.mdx
deleted file mode 100644
index 80551cb62e8ef..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/okta.mdx
+++ /dev/null
@@ -1,335 +0,0 @@
----
-title: Authentication With Okta as an SSO Provider
-description: How to configure Teleport access using Okta for SSO
-videoBanner: SM4Am-i8cj4
----
-
-This guide covers how to configure [Okta](https://www.okta.com/) to provide
-single sign on (SSO) identities to Teleport Enterprise and Teleport Enterprise
-Cloud. When used in combination with role-based access control (RBAC), this allows
-Teleport administrators to define policies like:
-
-- Only members of the "DBA" group can access PostgreSQL databases.
-- Developers must never SSH into production servers.
-- Members of the HR group can view audit logs but not production environments.
-
-<details>
-<summary>Automated SSO connection with Okta integration</summary>
-
-In Teleport Enterprise Cloud and Self-Hosted Teleport Enterprise, Teleport can
-automatically configure an SSO connector for you when as part of [enrolling the
-hosted Okta integration](../okta/okta.mdx).
-
-You can enroll the Okta integration from the Teleport Web UI.
-
-Visit the Teleport Web UI, click **Add New** in the left sidebar and click **Integration**:
-
-![Enroll an Access Request plugin](../../../../img/enterprise/plugins/enroll.png)
-
-On the "Select Integration Type" menu, click the Okta tile. Teleport will then
-guide you through configuring the Okta integration.
-
-</details>
-
-## Prerequisites
-
-- An Okta account with admin access. Your account must include users and at
-  least two groups. If you don't already have Okta groups you want to assign to
-  Teleport roles don't worry, we'll create example groups below.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- A Teleport role with access to edit and maintain `saml` resources. This is
-  available in the default `editor` role.
-- (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
-
-## Step 1/4. Create & assign groups
-
-Okta indicates a user's group membership as a SAML assertion in the data it
-provides to Teleport. We will configure Teleport to assign the "dev" role to
-members of the `okta-dev` Okta group, and the prest "editor" role to members of
-the `okta-admin` group.
-
-If you already have Okta groups you want to assign to "dev" and "editor" roles in
-Teleport, you can skip to the [next step](#step-24-configure-okta).
-
-### Create Groups
-
-Create two groups: "okta-dev" and "okta-admin". In the Okta dashboard go to the
-navigation bar and click **Directory** -> **Groups**, then **Add group**:
-
-![Create Group Devs](../../../../img/sso/okta/okta-saml-2.1@2x.png)
-
-Repeat for the admin group:
-
-![Create Group Devs](../../../../img/sso/okta/okta-saml-2.2.png)
-
-## Step 2/4. Configure Okta
-
-In this section we will create an application in the Okta dashboard to allow our
-Teleport cluster to access Okta as an IdP provider. We'll also locate the
-address that Okta uses to provides their IdP metadata to Teleport.
-
-### Create Okta SAML 2.0 App
-
-From the main navigation menu, select **Applications** -> **Applications**, and click
-**Create App Integration**. Select SAML 2.0, then click **Next**.
-
-![Create APP](../../../../img/sso/okta/okta-saml-1.png)
-
-On the next screen (**General Settings**), provide a name and optional logo for
-your new app, then click **Next**. This will bring you to the **Configure SAML** section.
-
-### Configure the App
-
-Provide the following values to their respective fields:
-
-#### General
-
-Replace <Var name="example.teleport.sh:443" /> with your Teleport Proxy Service or Enterprise
-Cloud account domain and port (`443` by default).
-
-- Single sign on URL: 
-   
-  ```
-  https://<Var name="example.teleport.sh:443" />/v1/webapi/saml/acs/okta
-  ```
-
-- Audience URI (SP Entity ID):
-
-  ```
-  https://<Var name="example.teleport.sh:443" />/v1/webapi/saml/acs/okta
-  ```
-
-- Name ID format `EmailAddress`
-
-- Application username `Okta username`
-
-#### Attribute Statements
-
-- Name: `username`  | Name format: `Unspecified` | Value: `user.login`
-
-#### Group Attribute Statements
-
-We will map our Okta groups to SAML attribute statements (special signed metadata
-exposed via a SAML XML response), so that Teleport can discover a user's group
-membership and assign matching roles.
-
-- Name: `groups` | Name format: `Unspecified`
-- Filter: `Matches regex` |  `.*`
-
-The configuration page should now look like this:
-
-![Configure APP](../../../../img/sso/okta/setup-redirection.png)
-
-The "Matches regex" filter requires the literal string `.*` in order to match all
-content from the group attribute statement.
-
-Notice that we have set "NameID" to the email format and mapped the groups with
-a wildcard regex in the Group Attribute statements. We have also set the "Audience"
-and SSO URLs to the same value. This is so Teleport can read and use Okta users'
-email addresses to create their usernames in Teleport, instead of relying on additional
-name fields.
-
-Once you've filled the required fields, click **Next**, then finish the app creation wizard.
-
-### Group assignment
-
-From the **Assignments** tab of the new application page, click **Assign**.  Assign the user groups
-which can access to the app. Users being members of those groups will have the SSO access to
-Teleport once the Auth Connector is configured.
-
-![Configure APP](../../../../img/sso/okta/okta-saml-3.1.png)
-
-### Save IdP metadata path
-
-Okta provides an IdP metadata block, used by clients to identify and verify it
-as a trusted source of user identity.
-
-Since Okta serves this content over HTTPS we can configure Teleport to use this
-path instead of a local copy, which can go stale.
-
-From the app's **Sign On** tab, scroll down to **SAML Signing Certificates**.
-Click **Actions** for the SHA-2 entry, then "View IdP metadata":
-
-![View Okta IdP Metadata](../../../../img/sso/okta/okta-copy-metadata.png)
-
-Copy the URL to the metadata file for use in our Teleport configuration.
-
-<Admonition type="tip">
-You can also right click on the "View IdP metadata" link and select
-"Copy Link" or "Copy Link Address".
-</Admonition>
-
-## Step 3/4. Create a SAML connector
-
-Define an Okta SAML connector using `tctl`. Update this example command with
-the path to your metadata file, and edit the `--attributes-to-roles` values for
-custom group assignment to roles. See [tctl sso configure
-saml](../../../reference/cli/tctl.mdx) for a full reference of
-flags for this command:
-
-```code
-$ tctl sso configure saml --preset=okta \
---entity-descriptor "https://example.okta.com/app/000000/sso/saml/metadata" \
---attributes-to-roles=groups,okta-admin,editor \
---attributes-to-roles=groups,okta-dev,dev > okta-connector.yaml
-```
-
-The contents of `okta-connector.yaml` should resemble the following:
-
-```yaml
-kind: saml
-metadata:
-  name: okta
-spec:
-  acs: https://teleport.example.com:443/v1/webapi/saml/acs/okta
-  attributes_to_roles:
-  - name: groups
-    roles:
-    - editor
-    value: okta-admin
-  - name: groups
-    roles:
-    - dev
-    value: okta-dev
-  audience: https://teleport.example.com:443/v1/webapi/saml/acs/okta
-  cert: ""
-  display: "Okta"
-  entity_descriptor: ""
-  entity_descriptor_url: https://example.okta.com/app/000000/sso/saml/metadata
-  issuer: ""
-  service_provider_issuer: https://teleport.example.com:443/v1/webapi/saml/acs/okta
-  sso: ""
-version: v2
-```
-
-The `attributes_to_roles` field in the connector resource maps key/value-like attributes of
-the assertion from Okta into a list of Teleport roles to apply to the session.
-
-(!docs/pages/includes/sso/idp-initiated.mdx!)
-
-You can test the connector before applying it to your cluster. This is strongly
-encouraged to avoid interruption to active clusters:
-
-```code
-$ cat okta-connector.yaml | tctl sso test
-If browser window does not open automatically, open it by clicking on the link:
- http://127.0.0.1:52519/0222b1ca...
-Success! Logged in as: alice@example.com
---------------------------------------------------------------------------------
-Authentication details:
-   roles:
-   - editor
-   - dev
-   traits:
-     groups:
-     - Everyone
-     - okta-admin
-     - okta-dev
-     username:
-     - alice@example.com
-   username: alice@example.com
---------------------------------------------------------------------------------
-[SAML] Attributes to roles:
-- name: groups
-  roles:
-  - editor
-  value: okta-admin
-- name: groups
-  roles:
-  - dev
-  value: okta-dev
-
---------------------------------------------------------------------------------
-[SAML] Attributes statements:
-groups:
-- Everyone
-- okta-admin
-- okta-dev
-username:
-- alice@example.com
-
---------------------------------------------------------------------------------
-For more details repeat the command with --debug flag.
-```
-
-Create the connector using `tctl`:
-
-```code
-$ tctl create okta-connector.yaml
-```
-
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
-## Step 4/4. Create a developer Teleport role
-
-Now let's create the Teleport role that we will assign to members of the
-`okta-dev` group. Create the local file `dev.yaml` with the content below.
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  options:
-    max_session_ttl: 24h
-  allow:
-    logins: [ "{{email.local(external.username)}}", ubuntu ]
-    node_labels:
-      access: relaxed
-```
-
-Members of this role have are assigned several attributes:
-
-- they are only allowed to login to nodes labelled with `access: relaxed` label.
-- they can log in as `ubuntu` user or a user matching their email prefix.
-- they do not have any "allow rules" i.e. they will not be able to
-  see/replay past sessions or re-configure the Teleport cluster.
-
-Notice the `{{external.username}}` login. It configures Teleport to look at the
-*"username"* Okta claim and use that field as an allowed login for each user.
-This example uses email as the username format.  The
-`email.local(external.username)` function call will remove the `@domain` and
-leave the username prefix. For full details on how variable expansion works in
-Teleport roles, see the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
-
-Use `tctl` to create this role in the Teleport Auth Service:
-
-```code
-$ tctl create dev.yaml
-```
-
-We don't need to repeat this process for the "editor" role because this is a
-preset role that is available by default in all Teleport clusters.
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-## Testing
-
-The Web UI now contains a new "Okta" button at the login screen. To
-authenticate via the `tsh` CLI, specify the Proxy Service address and `tsh` will
-automatically use the default authentication type:
-
-```code
-$ tsh login --proxy=proxy.example.com
-```
-
-This command prints the SSO login URL (and will try to open it automatically
-in a browser).
-
-<Admonition  type="tip">
-Teleport can use multiple SAML connectors. In this case a connector name
-can be passed via the `--auth` flag. For the connector we created above:
-
-```code
-$ tsh login --proxy=proxy.example.com --auth=okta
-```
-
-</Admonition>
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/admin-guides/access-controls/sso/one-login.mdx b/docs/pages/admin-guides/access-controls/sso/one-login.mdx
deleted file mode 100644
index 8e9bf0355f182..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/one-login.mdx
+++ /dev/null
@@ -1,176 +0,0 @@
----
-title: Teleport Authentication with OneLogin as an SSO Provider
-description: How to configure Teleport access using OneLogin as an SSO provider
-h1: Teleport Authentication with OneLogin
----
-
-import SquareIcon from "@version/docs/img/sso/onelogin/teleport.png"
-import RectangleIcon from "@version/docs/img/sso/onelogin/teleportlogo@2x.png"
-
-This guide will explain how to configure [OneLogin](https://www.onelogin.com/)
-to issue Teleport credentials to specific groups of users. When used in
-combination with role based access control (RBAC) it allows SSH administrators
-to define policies like:
-
-- Only members of "DBA" group can connect to PostgreSQL databases.
-- Developers must never SSH into production servers.
-- ... and many others.
-
-## Prerequisites
-
-- A OneLogin account with admin access, and users assigned to at least two groups.
-- Teleport role with access to maintaining `saml` resources.  This is available
-  in the default `editor` role.
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Create Teleport application in OneLogin
-
-1. In the OneLogin control panel's main menu navigate to **Applications** ->
-   **Add App**. Using the search box, select "SAML Custom Connector (SP
-   Shibboleth)":
-
-   ![SAML Custom Connector (SP Shibboleth)](../../../../img/sso/onelogin/onelogin-saml-1.png)
-
-1. Define the new application:
-
-   ![SAML Config](../../../../img/sso/onelogin/onelogin-saml-1a.png)
-
-   You can find Teleport icons to upload from the following links:
-
-   - <a href={SquareIcon} download>Square Icon</a>
-   - <a href={RectangleIcon} download>Rectangular Icon</a>
-
-1. From the application's **Configuration** page, set the following values:
-
-   <Admonition type="tip">
-   Set <Var name="teleport.example.com:443" description="Your Teleport Proxy Service address and port, or cloud tenant." />
-   here with your Teleport Proxy Service address and port, or Teleport Enterprise
-   Cloud tenant (e.g. `company.teleport.sh:443`) to fill out the values below.
-   </Admonition>
-   
-   - **Login URL**:
-     - `https://`<Var name="teleport.example.com:443"/>`/web/login`
-   - **ACS (Consumer) URL**, **SAML Recipient**, **ACS (Consumer) URL Validator**, & **Audience**:
-     - `https://`<Var name="teleport.example.com:443"/>`/v1/webapi/saml/acs/onelogin`
-
-   ![Configure SAML](../../../../img/sso/onelogin/onelogin-saml-2.png)
-
-1. Teleport needs to assign groups to users. From the **Parameters** page,
-   configure the application with some parameters exposed as SAML attribute
-   statements:
-
-   ![New Field](../../../../img/sso/onelogin/onelogin-saml-3.png)
-   
-   ![New Field Group](../../../../img/sso/onelogin/onelogin-saml-4.png)
-   
-   <Admonition
-     type="warning"
-     title="Important"
-   >
-     Make sure to check `Include in SAML assertion` checkbox.
-   </Admonition>
-
-1. Add users to the application:
-
-   ![Add User](../../../../img/sso/onelogin/onelogin-saml-5.png)
-
-1. Obtain SAML metadata for your authentication connector. Once the application
-   is set up, navigate to the the **More Actions** menu and find the **SAML
-   Metadata** option:
-
-   ![Download XML](../../../../img/sso/onelogin/saml-download.png)
-
-   You can either left-click the option and download the XML document as a local
-   file or right-click the option and copy the link address. The Teleport Auth
-   Service either reads the provided document or queries the address to obtain
-   SAML metadata. We recommend copying the address so the Auth Service can use
-   the most up-to-date information.
-
-## Step 2/3. Create a SAML connector
-
-Create a SAML connector using `tctl`. Update <Var name="xml-path"/> to the URL
-of the XML document that you copied in the previous step. If you downloaded the
-XML document instead, use the path to the XML metadata file:
-
-```code
-$ tctl sso configure saml --preset onelogin \
---entity-descriptor <Var name="xml-path"/> \
---attributes-to-roles groups,admin,editor \
---attributes-to-roles groups,dev,access > onelogin.yaml
-```
-
-This will create `onelogin.yaml`, describing the connector resource:
-
-```yaml
-(!examples/resources/onelogin-connector.yaml!)
-```
-
-Test the newly created configuration:
-
-```code
-$ cat onelogin.yaml | tctl sso test
-```
-
-`tctl sso test` will open the browser and attempt to authenticate with OneLogin.
-If it succeeds the output will print what SAML attributes are received and mapped
-to Teleport roles. If the test fails, the output will help you troubleshoot your
-configuration.
-
-Create the connector using `tctl` tool:
-
-```code
-$ tctl create -f onelogin.yaml
-```
-
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
-## Step 3/3. Create a new Teleport role
-
-We are going to create a new that'll use external username data from OneLogin
-to map to a host linux login.
-
-In the role described below, Devs are only allowed to login to nodes labelled with
-`access: relaxed` Teleport label. Developers can log in as either `ubuntu` to a
-username that arrives in their assertions. Developers also do not have any
-rules needed to obtain admin access to Teleport.
-
-```yaml
-# dev.yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  options:
-    max_session_ttl: "24h"
-  allow:
-    logins: [ "{{external.username}}", ubuntu ]
-    node_labels:
-      access: relaxed
-```
-
-**Notice:** Replace `ubuntu` with linux login available on your servers!
-
-Create the role:
-
-```code
-$ tctl create -f dev.yaml
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-## Troubleshooting
-
-(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
-
-## Next steps
-
-In the Teleport role we illustrated in this guide, `external` traits
-are replaced with values from the single sign-on provider that the user
-used to authenticate to Teleport. For full details on how traits
-work in Teleport roles, see the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
-
diff --git a/docs/pages/admin-guides/access-controls/sso/sso.mdx b/docs/pages/admin-guides/access-controls/sso/sso.mdx
deleted file mode 100644
index d5f2382e21d6b..0000000000000
--- a/docs/pages/admin-guides/access-controls/sso/sso.mdx
+++ /dev/null
@@ -1,669 +0,0 @@
----
-title: Configure Single Sign-On
-description: How to set up single sign-on (SSO) for SSH using Teleport
----
-
-Teleport users can log in to servers, Kubernetes clusters, databases, web
-applications, and Windows desktops through their organization's Single Sign-On
-(SSO) provider.
-
-<DocCardList />
-
-## How Teleport uses SSO
-
-You can register your Teleport cluster as an application with your SSO provider.
-When a user signs in to Teleport, your SSO provider will execute its own
-authentication flow, then send an HTTP request to your Teleport cluster to
-indicate that authentication has completed.
-
-Teleport authenticates users to your infrastructure by issuing short-lived
-certificates. After a user completes an SSO authentication flow, Teleport issues
-a short-lived certificate to the user. Teleport also creates a temporary user on
-the Auth Service backend.
-
-### Temporary `user` resources
-
-After a user completes an SSO authentication flow, Teleport creates a temporary
-`user` resource for the user.
-
-When a user signs in to Teleport with `tsh login`, they can configure the TTL of
-the `user` Teleport creates. Teleport enforces a limit of 30 hours (the default
-is 12 hours).
-
-In the Teleport audit log, you will see an event of type `user.create` with
-information about the temporary user.
-
-<details>
-<summary>How can I inspect a temporary user resource?</summary>
-
-You can inspect a temporary `user` resource created via your SSO integration
-by using the `tctl` command:
-
-```code
-# Log in to your cluster with tsh so you can use tctl remotely
-$ tsh login --proxy=example.teleport.sh
-$ tctl get users/<username>
-```
-
-Here is an example of a temporary `user` resource created when the GitHub user
-`myuser` signed in to GitHub to authenticate to Teleport. This resource
-expires 12 hours after creation. The `created_by` field indicates that the
-resource was created by Teleport's GitHub SSO integration:
-
-```yaml
-kind: user
-metadata:
-  expires: "2022-06-15T04:02:34.586688054Z"
-  id: 0000000000000000000
-  name: myuser
-spec:
-  created_by:
-    connector:
-      id: github
-      identity: myuser
-      type: github
-    time: "2022-06-14T16:02:34.586688441Z"
-    user:
-      name: system
-  expires: "0001-01-01T00:00:00Z"
-  github_identities:
-  - connector_id: github
-    username: myuser
-  roles:
-  - editor
-  - access
-  - auditor
-  status:
-    is_locked: false
-    lock_expires: "0001-01-01T00:00:00Z"
-    locked_time: "0001-01-01T00:00:00Z"
-  traits:
-    github_teams:
-    - my-team
-    kubernetes_groups: null
-    kubernetes_users: null
-    logins:
-    - root
-version: v2
-```
-
-</details>
-
-### Certificates for SSO users
-
-Along with creating a temporary user, Teleport issues SSH and X.509 certificates
-to a successfully authenticated SSO user's machine. This enables SSO users to
-authenticate to your cluster without Teleport needing to create a permanent
-record of them.
-
-In the X.509 certificate, for example, the `Subject` field contains the same
-information defined in the temporary `user` resource. This enables Teleport to
-enforce RBAC rules for the authenticated user when they access resources in your
-cluster.
-
-This is a `Subject` field for a certificate that Teleport issued for the GitHub
-user `myuser`, who signed in to a Teleport cluster via the GitHub SSO
-integration:
-
-```
-Subject: L=myuser/street=teleport.example.com/postalCode={"github_teams":["my-team"],"kubernetes_groups":null,"kubernetes_users":null,"logins":["root"]}, O=access, O=editor, O=auditor, CN=myuser/1.3.9999.1.7=teleport.example.com
-```
-
-The user belongs to the GitHub team `my-team`, which this Teleport cluster maps
-to the `access`, `editor`, and `auditor` roles in Teleport. (Read the guide for
-your SSO provider to determine how to configure role mapping.)
-
-<details>
-<summary>Inspecting your certificate subject</summary>
-
-To inspect the contents of an X.509 certificate issued for your user after you
-sign in to Teleport via SSO, run the following commands:
-
-```code
-$ TELEPORT_CLUSTER=<your cluster>
-$ SSO_USER=<your username within your SSO provider>
-$ openssl x509 -text -in ~/.tsh/keys/${TELEPORT_CLUSTER}/${SSO_USER}-x509.pem | grep "Subject:"
-```
-
-You can inspect an SSH certificate issued for your Teleport user with the
-following command:
-
-```code
-$ ssh-keygen -L -f ~/.tsh/keys/${TELEPORT_CLUSTER}/${SSO_USER}-ssh/${TELEPORT_CLUSTER}-cert.pub
-```
-
-</details>
-
-### Multiple SSO providers
-
-Since Teleport creates temporary users and issues short-lived certificates when
-a user authenticates via SSO, it is straightforward to integrate Teleport with
-multiple SSO providers. Besides the temporary `user` resource, no persistent
-backend data in Teleport is tied to a user's account with the SSO provider.
-
-This also means that if one SSO provider becomes unavailable, the end user only
-needs to choose another SSO provider when signing in to Teleport. While the
-user may be locked out of their account with the first SSO provider, signing in
-via the second provider is sufficient for Teleport to issue a new certificate
-and grant the user access to your infrastructure.
-
-Note that if the username of an SSO user already belongs to a user registered
-locally with the Auth Service (i.e., created via `tctl users add`), the SSO
-login will fail.
-
-## Logging in via SSO
-
-Users can log in to Teleport via your SSO provider by executing a command
-similar to the following, using the `--auth` flag to specify the provider:
-
-```code
-# This command will automatically open the default web browser and take a user
-# through the login process with an SSO provider
-$ tsh login --proxy=proxy.example.com --auth=github
-```
-
-The command opens a browser window and shows a URL the user can visit in the
-terminal to complete their SSO flow:
-
-```text
-If browser window does not open automatically, open it by clicking on the link:
-http://127.0.0.1:45235/055a310a-1099-43ea-8cf6-ffc41d88ad1f
-```
-
-Teleport will wait for up to 3 minutes for a user to authenticate. If
-authentication succeeds, Teleport will retrieve SSH and X.509 certificates and
-store them in the `~/.tsh/keys/<clustername>` directory. The tool will also will
-add SSH cert to an SSH agent if there's one running.
-
-### Changing Callback Address
-
-The callback address can be changed if calling back to a remote machine
-instead of the local machine is required:
-
-```code
-# --bind-addr sets the host and port tsh will listen on, and --callback changes
-# what link is displayed to the user
-$ tsh login --proxy=proxy.example.com --auth=github --bind-addr=localhost:1234 --callback https://remote.machine:1234
-```
-
-For this to work the hostname or CIDR of the remote machine that will be used for
-the callback will need to be allowed via your auth connector's `client_redirect_settings`:
-
-```code
-kind: oidc
-metadata:
-  name: example-connector
-spec:
-  client_redirect_settings:
-    # a list of hostnames allowed for HTTPS client redirect URLs
-    # can be a regex pattern
-    allowed_https_hostnames:
-      - remote.machine
-      - '*.app.github.dev'
-      - '^\d+-[a-zA-Z0-9]+\.foo.internal$'
-    # a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-    insecure_allowed_cidr_ranges:
-      - '192.168.1.0/24'
-      - '2001:db8::/96'
-```
-
-## Configuring SSO for login
-
-Teleport works with SSO providers by relying on the concept of an
-**authentication connector**. An authentication connector is a configuration
-resource that controls how SSO users log in to Teleport—and which Teleport roles
-they will assume once they do.
-
-This means that you can apply fine-grained RBAC policies to your Teleport
-cluster without needing to change the solution you use for on– and offboarding
-users.
-
-### Supported connectors
-
-The following authentication connectors are supported:
-
-<Tabs>
-<TabItem scope={["cloud", "enterprise"]} label="Commercial">
-
-|Type|Description|
-|---|---|
-|None|If no authentication connector is created, Teleport will use local authentication based user information stored<br/> in the Auth Service backend. You can manage user data via the web UI Users page and the `tctl users` command. |
-|`saml`| The SAML connector type uses the [SAML protocol](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) to authenticate users and query their group membership.|
-|`oidc`| The OIDC connector type uses the [OpenID Connect protocol](https://en.wikipedia.org/wiki/OpenID_Connect) to authenticate users<br/> and query their group membership.|
-|`github`| The GitHub connector uses GitHub SSO to authenticate users and query their group membership.|
-
-</TabItem>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-
-|Type|Description|
-|---|---|
-|None|If no authentication connector is created, Teleport will use local authentication based user information stored in the Auth Service backend. You can manage user data via the web UI Users page and the `tctl users` command. |
-|`github`| The GitHub connector uses GitHub SSO to authenticate users and query their group membership.|
-
-</TabItem>
-
-</Tabs>
-
-### Creating an authentication connector
-
-Before you can create an authentication connector, you must enable
-authentication via that connector's protocol.
-
-To set the default authentication type as `saml`, `oidc`, or `github`,
-create a `cluster_auth_preference` resource.
-
-Create a file called `cap.yaml`:
-  ```yaml
-  kind: cluster_auth_preference
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    # Set as saml, oidc, or github
-    type: saml|oidc|github
-  version: v2
-  ```
-
-Create the resource:
-
-  ```code
-  # Log in to your cluster with tsh so you can run tctl commands.
-  $ tsh login --proxy=example.teleport.sh --user=myuser
-  $ tctl create -f cap.yaml
-  ```
-
-
-Next, define an authentication connector. Create a file called `connector.yaml`
-based on one of the following examples. Teleport Community Edition only supports
-GitHub as an SSO option.
-
-<Tabs>
-<TabItem label="Okta">
-
-```yaml
-(!/examples/resources/saml-connector.yaml!)
-```
-
-(!docs/pages/includes/sso/idp-initiated.mdx!)
-
-(!docs/pages/includes/sso/saml-slo.mdx!)
-
-You may use `entity_descriptor_url` in lieu of `entity_descriptor` to fetch
-the entity descriptor from your IDP.
-
-We recommend "pinning" the entity descriptor by including the XML rather than
-fetching from a URL.
-
-</TabItem>
-<TabItem label="OneLogin">
-
-```yaml
-(!/examples/resources/onelogin-connector.yaml!)
-```
-
-You may use `entity_descriptor_url`, in lieu of `entity_descriptor`, to fetch
-the entity descriptor from your IDP.
-
-We recommend "pinning" the entity descriptor by including the XML rather than
-fetching from a URL.
-
-</TabItem>
-<TabItem label="OIDC">
-
-```yaml
-(!/examples/resources/oidc-connector.yaml!)
-```
-
-</TabItem>
-<TabItem label="Google Workspace">
-
-```yaml
-(!/examples/resources/gworkspace-connector-inline.yaml!)
-```
-
-</TabItem>
-<TabItem label="ADFS">
-
-```yaml
-(!/examples/resources/adfs-connector.yaml!)
-```
-
-You may use `entity_descriptor_url`, in lieu of `entity_descriptor`, to fetch
-the entity descriptor from your IDP.
-
-We recommend "pinning" the entity descriptor by including the XML rather than
-fetching from a URL.
-
-</TabItem>
-<TabItem label="SAML">
-
-```yaml
-(!/examples/resources/saml-connector.yaml!)
-```
-
-(!docs/pages/includes/sso/idp-initiated.mdx!)
-
-(!docs/pages/includes/sso/saml-slo.mdx!)
-
-You may use `entity_descriptor_url`, in lieu of `entity_descriptor`, to fetch
-the entity descriptor from your IDP.
-
-We recommend "pinning" the entity descriptor by including the XML rather than
-fetching from a URL.
-
-</TabItem>
-<TabItem label="GitHub">
-
-```yaml
-(!/examples/resources/github.yaml!)
-```
-
-</TabItem>
-</Tabs>
-
-Create the connector:
-
-```code
-$ tctl create -f connector.yaml
-```
-
-### User logins
-
-Often it is required to restrict SSO users to their unique UNIX logins when they
-connect to Teleport Nodes. To support this:
-
-- Use the SSO provider to create a field called `unix_login` (you can use another name).
-- Make sure the `unix_login` field is exposed as a claim via SAML/OIDC.
-- Update a Teleport role to include the `{{external.unix_login}}` variable in the list of allowed logins:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: sso_user
-spec:
-  allow:
-    logins:
-    - '{{external.unix_login}}'
-    node_labels:
-      '*': '*'
-```
-
-### Provider-Specific Workarounds
-
-Certain SSO providers may require or benefit from changes to Teleport's SSO
-flow. These provider-specific changes can be enabled by setting the
-`spec.provider` property of the connector definition to one of the following
-values to match your identity provider:
-
-- `adfs` (SAML): Required for compatibility with Active Directory (ADFS); refer
-  to the full [ADFS guide](adfs.mdx) for details.
-- `netiq` (OIDC): Used to enable NetIQ-specific ACR value processing; refer to
-  the [OIDC guide](oidc.mdx) for details.
-- `ping` (SAML and OIDC): Required for compatibility with Ping Identity (including
-  PingOne and PingFederate).
-- `okta` (OIDC): Required when using Okta as an OIDC provider.
-
-At this time, the `spec.provider` field should not be set for any other identity providers.
-
-## Configuring SSO for MFA checks
-
-Teleport administrators can configure Teleport to delegate MFA checks to an
-SSO provider as an alternative to registering MFA devices directly with the Teleport cluster.
-This allows Teleport users to use MFA devices and custom flows configured in the SSO provider
-to carry out privileged actions in Teleport, such as:
-
-- [Per-session MFA](../guides/per-session-mfa.mdx)
-- [Moderated sessions](../guides/joining-sessions.mdx)
-- [Admin actions](../guides/mfa-for-admin-actions.mdx)
-
-Administrators may want to consider enabling this feature in order to:
-
-- Make all authentication (login and MFA) go through the IDP, reducing administrative overhead
-- Make custom MFA flows, such as prompting for 2 distinct devices for a single MFA check
-- Integrate with non-webauthn devices supported directly by your IDP
-
-<Admonition type="note">
-  SSO MFA is an enterprise feature. Only OIDC and SAML auth connectors are supported.
-</Admonition>
-
-### Configure the IDP App / Client
-
-There is no standardized MFA flow unlike there is with SAML/OIDC
-login, so each IDP may offer zero, one, or more ways to offer MFA checks.
-
-Generally, these offerings will fall under one of the following cases:
-
-1. Use a separate IDP app for MFA:
-
-You can create a separate IDP app with a custom MFA flow. For example, with
-Auth0 (OIDC), you can create a separate app with a custom [Auth0 Action](https://auth0.com/docs/customize/actions)
-which prompts for MFA for an active OIDC session.
-
-2. Use the same IDP app for MFA:
-
-Some IDPs provide a way to fork to different flows using the same IDP app.
-For example, with Okta (OIDC), you can provide `acr_values: ["phr"]` to
-[enforce phishing resistant authentication](https://developer.okta.com/docs/guides/step-up-authentication/main/#predefined-parameter-values).
-
-For a simpler approach, you could use the same IDP app for both login and MFA
-with no adjustments. For Teleport MFA checks, the user will be required to
-relogin through the IDP with username, password, and MFA if required.
-
-<Admonition type="warning">
-  While the customizability of SSO MFA presents multiple secure options previously
-  unavailable to administrators, it also presents the possibility of insecure
-  misconfigurations. Therefore, we strongly advice administrators to incorporate
-  strict, phishing-resistant checks with WebAuthn, Device Trust, or some similar
-  security features into their custom SSO MFA flow.
-</Admonition>
-
-### Updating your authentication connector to enable MFA checks
-
-Take the authentication connector file `connector.yaml` created in [Configuring SSO for login](#configuring-sso-for-login)
-and add MFA settings.
-
-<Tabs>
-<TabItem label="OIDC">
-
-```yaml
-(!examples/resources/oidc-connector-mfa.yaml!)
-```
-
-</TabItem>
-<TabItem label="SAML">
-
-```yaml
-(!examples/resources/saml-connector-mfa.yaml!)
-```
-
-You may use `entity_descriptor_url` in lieu of `entity_descriptor` to fetch
-the entity descriptor from your IDP.
-
-We recommend "pinning" the entity descriptor by including the XML rather than
-fetching from a URL.
-
-</TabItem>
-</Tabs>
-
-Update the connector:
-
-```code
-$ tctl create -f connector.yaml
-```
-
-### Allowing SSO as an MFA method in your cluster
-
-Before you can use the SSO MFA flow we created above, you need to enable SSO for
-multi-factor authentication in your cluster settings. Modify the dynamic config
-resource using the following command:
-
-```code
-$ tctl edit cluster_auth_preference
-```
-
-Make the following change:
-
-```diff
-kind: cluster_auth_preference
-version: v2
-metadata:
-  name: cluster-auth-preference
-spec:
-  # ...
-  second_factors:
-   - webauthn
-+  - sso
-```
-
-## Working with an external email identity
-
-Along with sending groups, an SSO provider will also provide a user's email address.
-In many organizations, the username that a person uses to log in to a system is the
-same as the first part of their email address, the "local" part.
-
-For example, `dave.smith@example.com` might log in with the username `dave.smith`.
-Teleport provides an easy way to extract the first part of an email address so
-it can be used as a username. This is the `{{email.local}}` function.
-
-If the email claim from the identity provider (which can be accessed via
-`{{external.email}}`) is sent and contains an email address, you can extract the
-"local" part of the email address before the @ sign like this:
-`{{email.local(external.email)}}`
-
-Here's how this looks in a Teleport role:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: sso_user
-spec:
-  allow:
-    logins:
-    # Extracts the local part of dave.smith@acme.com, so the login will
-    # now support dave.smith.
-    - '{{email.local(external.email)}}'
-    node_labels:
-      '*': '*'
-```
-
-## Working with multiple SSO providers
-
-Teleport can also support multiple connectors. For example, a Teleport
-administrator can define and create multiple connector resources using
-`tctl create` as shown above.
-
-To see all configured connectors, execute this command on the Auth Service:
-
-```code
-$ tctl get connectors
-```
-
-To delete/update connectors, use the usual `tctl rm` and `tctl create` commands
-as described in the [Resources Reference](../../../reference/resources.mdx).
-
-If multiple authentication connectors exist, the clients must supply a
-connector name to `tsh login` via `--auth` argument:
-
-```code
-# use "okta" SAML connector:
-$ tsh --proxy=proxy.example.com login --auth=okta
-
-# use local Teleport user DB:
-$ tsh --proxy=proxy.example.com login --auth=local --user=admin
-```
-
-Refer to the following guides to configure authentication connectors of both
-SAML and OIDC types:
-
-- [SSH Authentication with Okta](okta.mdx)
-- [SSH Authentication with OneLogin](one-login.mdx)
-- [SSH Authentication with ADFS](adfs.mdx)
-- [SSH Authentication with OAuth2 / OpenID Connect](oidc.mdx)
-
-## SSO customization
-
-Use the `display` field in an authentication connector to control the appearance
-of SSO buttons in the Teleport Web UI.
-
-| Provider | YAML | Example |
-| - | - | - |
-| GitHub | `display: GitHub` | ![github](../../../../img/teleport-sso/github@2x.png) |
-| Microsoft | `display: Microsoft` | ![microsoft](../../../../img/teleport-sso/microsoft@2x.png) |
-| Google | `display: Google` | ![google](../../../../img/teleport-sso/google@2x.png) |
-| BitBucket | `display: Bitbucket` | ![bitbucket](../../../../img/teleport-sso/bitbucket@2x.png) |
-| OpenID | `display: Okta` | ![Okta](../../../../img/teleport-sso/openId@2x.png) |
-
-## Troubleshooting
-
-Troubleshooting SSO configuration can be challenging. Usually a Teleport administrator
-must be able to:
-
-<Tabs>
-<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
-- Ensure that HTTP/TLS certificates are configured properly for both Teleport
-  proxy and the SSO provider.
-</TabItem>
-</Tabs>
-
-- Be able to see what SAML/OIDC claims and values are getting exported and passed
-  by the SSO provider to Teleport.
-- Be able to see how Teleport maps the received claims to role mappings as defined
-  in the connector.
-
-If something is not working, we recommend to:
-
-- Double-check the host names, tokens and TCP ports in a connector definition.
-
-### Using the Web UI
-
-If you get "access denied" or other login errors, the number one place to check is the Audit
-Log. You can access it in the **Activity** tab of the Teleport Web UI.
-
-![Audit Log Entry for SSO Login error](../../../../img/sso/teleportauditlogssofailed.png)
-
-Example of a user being denied because the role `clusteradmin` wasn't set up:
-
-```json
-{
-  "code": "T1001W",
-  "error": "role clusteradmin is not found",
-  "event": "user.login",
-  "message": "Failed to calculate user attributes.\n\trole clusteradmin is not found",
-  "method": "oidc",
-  "success": false,
-  "time": "2024-11-07T15:41:25.584Z",
-  "uid": "71e46f17-d611-48bb-bf5e-effd90016c13"
-}
-```
-
-### Teleport does not show the expected Nodes
-
-(!docs/pages/includes/node-logins.mdx!)
-
-When configuring SSO, ensure that the identity provider is populating each user's
-traits correctly. For a user to see a Node in Teleport, the result of populating a
- template variable in a role's `allow.logins` must match at least one of a user's
- `traits.logins`.
-
-In this example a user will have usernames `ubuntu`, `debian` and usernames from the SSO trait `logins` for Nodes that have a `env: dev` label.  If the SSO trait username is `bob` then the usernames would include `ubuntu`, `debian`, and `bob`.
-
-```yaml
-kind: role
-metadata:
-  name: example-role
-spec:
-  allow:
-    logins: ['{{external.logins}}', ubuntu, debian]
-    node_labels:
-      'env': 'dev'
-version: v5
-```
-
-## Next steps
-
-The roles we illustrated in this guide use `external` traits,
-which Teleport replaces with values from the single sign-on provider that the
-user used to authenticate with Teleport. For full details on how variable
-expansion works in Teleport roles, see the  [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
diff --git a/docs/pages/admin-guides/admin-guides.mdx b/docs/pages/admin-guides/admin-guides.mdx
deleted file mode 100644
index 6bf703cb6bbc2..0000000000000
--- a/docs/pages/admin-guides/admin-guides.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Teleport Admin Guides
-description: Provides step-by-step instructions for completing administrative tasks in Teleport.
----
-
-<DocCardList />
diff --git a/docs/pages/admin-guides/api/access-plugin.mdx b/docs/pages/admin-guides/api/access-plugin.mdx
deleted file mode 100644
index 3178ab6adb30c..0000000000000
--- a/docs/pages/admin-guides/api/access-plugin.mdx
+++ /dev/null
@@ -1,472 +0,0 @@
----
-title: How to Build an Access Request Plugin
-description: Manage Access Requests using custom workflows with the Teleport API
----
-
-With Teleport [Access Requests](../access-controls/access-requests/access-requests.mdx), you can
-assign Teleport users to less privileged roles by default and allow them to
-temporarily escalate their privileges. Reviewers can grant or deny Access
-Requests within your organization's existing communication workflows (e.g.,
-Slack, email, and PagerDuty) using [Access Request
-plugins](../access-controls/access-request-plugins/access-request-plugins.mdx).
-
-You can use Teleport's API client library to build an Access Request plugin that
-integrates with your organization's unique workflows. 
-
-In this guide, we will explore a number of Teleport's API client libraries by
-showing you how to write a plugin that lets you manage Access Requests via
-Google Sheets. The plugin lists new Access Requests in a Google Sheets
-spreadsheet, with links to allow or deny each request. 
-
-![The result of the plugin](../../../img/api/google-sheets.png)
-
-<Admonition type="danger">
-
-The plugin we will build in this guide is intended as a learning tool. **Do not
-connect it to your production Teleport cluster.**  Use a demo cluster instead.
-
-</Admonition>
-
-## Prerequisites
-
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
-
-- Go version (=teleport.golang=)+ installed on your workstation. See the [Go
-  download page](https://go.dev/dl/). You do not need to be familiar with Go to
-  complete this guide, though Go knowledge is required if you want to build your
-  own Access Request plugin.
-
-You will need the following in order to set up the demo plugin, which requires
-authenticating to the Google Sheets API:
-
-- A Google Cloud project with permissions to create service accounts.
-- A Google account that you will use to create a Google Sheets spreadsheet. We
-  will grant permissions to edit the spreadsheet to the service account used for
-  the plugin.
-
-<Admonition type="tip">
-
-Even if you do not plan to set up the demo project, you can follow this guide to see
-which libraries, types, and functions you can use to develop an Access Request
-plugin. 
-
-The demo is a minimal working example, and you can see fully fledged plugins in
-the
-[`gravitational/teleport`](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/integrations/access).
-repository on GitHub.
-
-</Admonition>
-
-## Step 1/5. Set up your Go project
-
-Download the source code for our minimal Access Request plugin:
-
-```code
-$ git clone https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
-$ cd teleport/examples/access-plugin-minimal
-```
-
-For the rest of this guide, we will show you how to set up this plugin and
-explore the way the plugin uses Teleport's API to integrate Access Requests with
-a particular workflow.
-
-## Step 2/5. Set up the Google Sheets API
-
-Access Request plugins typically communicate with two APIs. They receive Access
-Request events from the Teleport Auth Service's gRPC API, and use the data to
-interact with the API of your chosen messaging or collaboration tool.
-
-In this section, we will enable the Google Sheets API, create a Google Cloud
-service account for the plugin, and use the service account to authenticate the
-plugin to Google Sheets.
-
-### Enable the Google Sheets API
-
-Enable the Google Sheets API by visiting the following Google Cloud console URL:
-
-https://console.cloud.google.com/apis/enableflow?apiid=sheets.googleapis.com
-
-Ensure that your Google Cloud project is the one you intend to use. 
-
-Click **Next** > **Enable**.
-
-### Create a Google Cloud service account for the plugin
-
-Visit the following Google Cloud console URL:
-
-https://console.cloud.google.com/iam-admin/serviceaccounts
-
-Click **Create Service Account**.
-
-For **Service account name**, enter "Teleport Google Sheets Plugin". Google
-Cloud will populate the **Service account ID** field for you.
-
-Click **Create and Continue**. When prompted to grant roles to the service
-account, click **Continue** again. We will create our service account without
-roles. Skip the step to grant users access to the service account, clicking
-**Done**.
-
-The console will take you to the **Service accounts** view. Click the name of
-the service account you just created, then click the **Keys** tab. Click **Add
-Key**, then **Create new key**. Leave the **Key type** as "JSON" and click
-**Create**.
-
-Save your Google Cloud credentials file as `credentials.json` in your Go project
-directory.
-
-Your plugin will use this JSON file to authenticate to Google Sheets.
-
-### Create a Google Sheets spreadsheet
-
-Visit the following URL and make sure you are authenticated as the correct user:
-
-https://sheets.new
-
-Name your spreadsheet.
-
-Give the plugin access to the spreadsheet by clicking **Share**. In the **Add
-people and groups** field, enter
-`teleport-google-sheets-plugin@PROJECT_NAME.iam.gserviceaccount.com`, replacing
-`PROJECT_NAME` with the name of your project. Make sure that the service account
-has "Editor" permissions. Click **Share**, then **Share anyway** when prompted
-with a warning.
-
-By authenticating to Google Sheets with the service account you created, the
-plugin will have access to modify your spreadsheet.
-
-Next, ensure that the following is true within your spreadsheet:
-
-- There is only one sheet
-- The sheet includes the following columns:
-
-|ID|Created|User|Roles|Status|Link|
-|---|---|---|---|---|---|
-
-After we write our Access Request plugin, it will populate the spreadsheet with
-data automatically.
-
-## Step 3/5. Set up Teleport RBAC
-
-In this section, we will set up Teleport roles that enable creating and
-reviewing Access Requests, plus another Teleport role that can generate
-credentials for your Access Request plugin to authenticate to Teleport.
-
-### Create a user and role for the plugin
-
-(!docs/pages/includes/plugins/rbac-with-friendly-name.mdx!)
-
-(!/docs/pages/includes/plugins/rbac-impersonate.mdx!)
-
-### Export the access plugin identity
-
-You will use the `tctl auth sign` command to request the credentials that the
-`access-plugin` needs to connect to your Teleport cluster.
-
-The following `tctl auth sign` command impersonates the `access-plugin` user,
-generates signed credentials, and writes an identity file to the local
-directory:
-
-```code
-$ tctl auth sign --user=access-plugin --out=auth.pem
-```
-
-Teleport's Access Request plugins listen for new and updated Access Requests by
-connecting to the Teleport Auth Service's gRPC endpoint over TLS.
-
-The identity file, `auth.pem`, includes both TLS and SSH credentials. Your
-Access Request plugin uses the SSH credentials to connect to the Proxy Service,
-which establishes a reverse tunnel connection to the Auth Service. The plugin
-uses this reverse tunnel, along with your TLS credentials, to connect to the
-Auth Service's gRPC endpoint.
-
-You will refer to this file later when configuring the plugin.
-
-### Set up Role Access Requests
-
-In this guide, we will use our plugin to manage Role Access Requests. For this
-to work, we will set up Role Access Requests in your cluster.
-
-(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
-
-## Step 4/5. Write the Access Request plugin
-
-In this step, we will walk you through the structure of the Access Request
-plugin in `examples/access-plugin-minimal/main.go`. You can use the example here
-to write your own Access Request plugin.
-
-### Imports
-
-Here are the packages our Access Request plugin will import from Go's standard
-library:
-
-|Package|Description|
-|---|---|
-|`context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata. |
-|`errors`|Working with errors.|
-|`fmt`|Formatting data for printing, strings, or errors.|
-|`strings`|Manipulating strings.|
-
-The plugin imports the following third-party code:
-
-|Package|Description|
-|---|---|
-|`github.com/gravitational/teleport/api/client`|A library for authenticating to the Auth Service's gRPC API and making requests.|
-|`github.com/gravitational/teleport/api/types`|Types used in the Auth Service API, e.g., Access Requests.|
-|`github.com/gravitational/trace`|Presenting errors with more useful detail than the standard library provides.|
-|`google.golang.org/api/option`|Settings for configuring Google API clients.|
-|`google.golang.org/api/sheets/v4`|The Google Sheets API client library, aliased as `sheets` in our program.|
-|`google.golang.org/grpc`|The gRPC client and server library.|
-
-### Configuration
-
-First, we declare two constants that you need to configure for your environment:
-
-```go
-(!examples/access-plugin-minimal/config.go!)
-```
-
-`proxyAddr` indicates the hostname and port of your Teleport Proxy Service or
-Teleport Enterprise Cloud tenant. Assign it to the address of your own Proxy
-Service, e.g., `mytenant.teleport.sh:443`.
-
-Assign `spreadSheetID` to the ID of the spreadsheet you created earlier. To find
-the spreadsheet ID, visit your spreadsheet in Google Drive. The ID will be in
-the URL path segment called `SPREADSHEET_ID` below:
-
-```text
-https://docs.google.com/spreadsheets/d/SPREADHSEET_ID/edit#gid=0
-```
-
-### The `AccessRequestPlugin` type
-
-The `plugin.go` file declares types that we will use to organize our Access
-Request plugin code:
-
-```go
-(!examples/access-plugin-minimal/plugin.go!)
-```
-
-The `AccessRequestPlugin` type represents a generic Access Request plugin, and
-you can use this type to build your own plugin. It contains a Teleport API
-client and an `EventHandler`, any Go type that implements a `HandleEvent`
-method.
-
-In our case, the type that implements `HandleEvent` is `googleSheetsClient`, a
-struct type that contains an API client for Google Sheets.
-
-### Prepare row data
-
-Whether creating a new row of the spreadsheet or updating an existing one, we
-need a way to extract data from an Access Request in order to provide it to
-Google Sheets. We achieve this with the `makeRowData` method:
-
-```go
-(!examples/access-plugin-minimal/makerowdata.go!)
-```
-
-The `sheets.RowData` type makes extensive use of pointers to strings, so we
-introduce a utility function called `stringPtr` that returns the pointer to the
-provided string. This makes it easier to assign the values of cells in the
-`sheets.RowData` using chains of function calls.
-
-`makeRowData` is a method of the `googleSheetsClient` type. (The `*` before
-`googleSheetsClient` indicates that the method receives a *pointer* to a
-`googleSheetsClient`.) It takes a `types.AccessRequest`, which Teleport's API
-library uses to represent the fields within an Access Request.
-
-The Google Sheets client library defines a `sheets.RowData` type that we
-include in requests to update a spreadsheet. This function converts a
-`types.AccessRequest` into a `*sheets.RowData` (another pointer). 
-
-Access Requests have one of four states: approved, denied, pending, and none.
-We obtain the request states from Teleport's `types` library and map them to
-strings in the `requestStates` map.
-
-When extracting the data, we use the `types.AccessRequest.GetName()` method to
-retrieve the ID of the Access Request as a string we can include in the
-spreadsheet. 
-
-Users can review an Access Request by visiting a URL within the Teleport Web UI
-that corresponds to the request's ID. `makeRowData` assembles a `=HYPERLINK`
-formula that we can insert into the spreadsheet as a link to this URL.
-
-### Create a row
-
-The following function submits a request to the Google Sheets API to create a
-new row based on an incoming Access Request, using the data returned by
-`makeRowData`. It returns an error if the attempt to create a row failed:
-
-```go
-(!examples/access-plugin-minimal/createrow.go!)
-```
-
-`createRow` assembles a `sheets.BatchUpdateSpreadsheetRequest` and sends it to
-the Google Sheets API using `g.sheetsClient.BatchUpdate()`, returning errors
-encountered while sending the request.
-
-We log unexpected HTTP status codes without returning an error since these may
-be transient server-side issues. A production Access Request plugin would handle
-these situations in a more sophisticated way, e.g., storing the request so it
-can retry it later.
-
-### Update a row
-
-The code for updating a row is similar to the code for creating a new row: 
-
-```go
-(!examples/access-plugin-minimal/updaterow.go!)
-```
-
-The only difference between `updateRow` and `createRow` is that we send a
-`&sheets.UpdateCellsRequest` instead of a `&sheets.AppendCellsRequest`. This
-function takes the number of a row within the spreadsheet to update and sends a
-request to update that row with information from the provided Access Request.
-
-### Determine where to update the spreadsheet
-
-When our program receives an event that updates an Access Request, it needs a
-way to look up the row in the spreadsheet that corresponds to the Access Request
-so it can update the row:
-
-```go
-(!examples/access-plugin-minimal/updatespreadsheet.go!)
-```
-
-`updateSpreadSheet` takes a `types.AccessRequest`, gets the latest data from
-your spreadsheet, determines which row to update, and calls `updateRow`
-accordingly. It uses linear search to look up the first column within each row
-of the sheet and check whether that column matches the ID of the Access Request.
-It then calls `updateRow` with the Access Request and the row's number.
-
-### Handle incoming Access Requests
-
-The plugin calls a handler function when it receives an event. To set this up,
-we use the `Run` method of our generic `AccessRequestPlugin` type, which
-contains the main loop of the plugin:
-
-```go
-(!examples/access-plugin-minimal/watcherjob.go!)
-```
-
-As we described above, the `AccessRequestPlugin` type's `EventHandler` field is
-assigned to an interface with a `HandleEvent` method. In this case, the
-implementation is `*googleSheetsClient.HandleEvent`. This method checks whether
-an Access Request is in a pending state, i.e., whether the request is new. If
-so, it calls `createRow`. If not, it calls `updateSpreadsheet`.
-
-The Teleport API client type, `client.Client`, has a `NewWatcher` method that
-listens for new audit events from the Auth Service API via a gRPC stream. The
-second parameter of the method indicates the type of audit event to watch for,
-in this case, events having to do with Access Requests.
-
-The result of `NewWatcher`, a `types.Watcher`, enables `Run` to respond to new
-audit events by calling the `Events` method. This returns a Go **channel**, a
-runtime abstraction that allows concurrent routines to communicate. Another
-channel, returned by `Done`, indicates when the watcher has finished.
-
-In a `for` loop, the `Run` method receives from either the `Done` channel or
-`Events` channel, whichever is ready to send first. If it receives from the
-`Events` channel, it calls the `HandleEvent` method to process the event.
-
-### Initialize the API clients
-
-Now we have all the code we need to use the Teleport and Google Sheets API
-clients to listen for Access Request events and use them to maintain a
-spreadsheet. The final step is to start our program by initializing the API
-clients:
-
-```go
-(!examples/access-plugin-minimal/main.go!)
-```
-
-The `main` function, the entrypoint to our program, initializes an
-`AccessRequestPlugin` and `googleSheetsClient` and uses them run the plugin. 
-
-The function creates a Google Sheets API client by loading the credentials file
-you downloaded earlier at the relative path `credentials.json`.
-
-`client` is Teleport's library for setting up an API client. Our plugin does so
-by calling `client.LoadIdentityFile` to obtain a `client.Credentials`. It then
-uses the `client.Credentials` to call `client.New`, which connects to the
-Teleport Proxy Service specified in the `Addrs` field using the provided
-identity file.
-
-In this example, we are passing the `grpc.WithReturnConnectionError()` function
-call to `client.New`, which instructs the gRPC client to return more detailed
-connection errors.
-
-<Admonition type="warning">
-
-This program does not validate your credentials or Teleport cluster address.
-Make sure that: 
-
-- The identity file you exported earlier does not have an expired TTL
-- The value you supplied for the `proxyAddr` constant includes both the host
-  **and** the web port of your Teleport Proxy Service, e.g.,
-  `mytenant.teleport.sh:443`
-
-</Admonition>
-
-## Step 5/5. Test your plugin
-
-Run the plugin to forward Access Requests from your Teleport cluster to Google
-Sheets. Execute the following command from within
-`examples/access-plugin-minimal`:
-
-```code
-$ go run teleport-sheets
-```
-
-Now that the plugin is running, create an Access Request:
-
-(!docs/pages/includes/plugins/create-request.mdx!)
-
-You should see the new Access Request in your spreadsheet with the `PENDING`
-state.
-
-In your spreadsheet, click "View Access Request" next to your new request. Sign
-into the Teleport Web UI as your original user. When you submit your review,
-e.g., deny the request, the new status will appear within the spreadsheet.
-
-<Admonition type="danger">
-
-Access Request plugins must not enable reviewing Access Requests via the plugin,
-and must always refer a reviewer to the Teleport Web UI to complete the review.
-Otherwise, an unauthorized party could spoof traffic to the plugin and escalate
-privileges. 
-
-</Admonition>
-
-## Next steps
-
-In this guide, we showed you how to set up an Access Request plugin using
-Teleport's API client libraries. To go beyond the minimal plugin we demonstrate
-in this guide, you can use the Teleport API to set up more sophisticated
-workflows that take full advantage of your communication and project management
-tools. 
-
-### Manage state
-
-While the plugin we developed in this guide is stateless, updating Access
-Request information by searching all rows of a spreadsheet, real-world Access
-Request plugins typically need to manage state. You can use the
-[`plugindata`](https://pkg.go.dev/github.com/gravitational/teleport/api/types#PluginData)
-package to make it easier for your Access Request plugin to do this. 
-
-### Consult the examples
-
-Explore the
-[`gravitational/teleport`](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/integrations/access).
-repository on GitHub for examples of plugins developed at Teleport. You can see
-how these plugins use the packages we discuss in this guide, as well as how they
-add more complete functionality like configuration validation and state
-management.
-
-### Provision the plugin with short-lived credentials
-
-In this example, we used the `tctl auth sign` command to fetch credentials for
-the plugin. For production usage, we recommend provisioning short-lived
-credentials via Machine ID, which reduces the risk of these credentials becoming
-stolen. View our [Machine ID documentation](../../enroll-resources/machine-id/introduction.mdx) to
-learn more.
-
diff --git a/docs/pages/admin-guides/api/getting-started.mdx b/docs/pages/admin-guides/api/getting-started.mdx
deleted file mode 100644
index 34d8438868ec7..0000000000000
--- a/docs/pages/admin-guides/api/getting-started.mdx
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: API Getting Started Guide
-description: Get started working with the Teleport API programmatically using Go.
----
-
-In this getting started guide we will use the Teleport API Go client to connect
-to a Teleport Auth Service.
-
-Here are the steps we'll walkthrough:
-
-- Create an API user using a simple role-based authentication method.
-- Generate credentials for that user.
-- Create and connect a Go client to interact with Teleport's API.
-
-## Prerequisites
-
-- Install [Go](https://golang.org/doc/install) (=teleport.golang=)+ and Go development environment.
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Create a user
-
-(!docs/pages/includes/permission-warning.mdx!)
-
-<Admonition type="tip" title="Tip">
-  Read [API authorization](../../reference/architecture/api-architecture.mdx) to learn more about defining custom roles for your API client.
-</Admonition>
-
-Create a user `api-admin` with the built-in role `editor`:
-
-```code
-$ tctl users add api-admin --roles=editor
-```
-
-## Step 2/3. Generate client credentials
-
-Log in as the newly created user with `tsh`.
-
-```code
-# generate tsh profile
-$ tsh login --user=api-admin --proxy=tele.example.com
-```
-
-The [Profile Credentials loader](https://pkg.go.dev/github.com/gravitational/teleport/api/client#LoadProfile)
-will automatically retrieve Credentials from the current profile in the next step.
-
-## Step 3/3. Create a Go project
-
-Set up a new [Go module](https://golang.org/doc/tutorial/create-module) and import the `client` package:
-
-```code
-$ mkdir client-demo && cd client-demo
-$ go mod init client-demo
-$ go get github.com/gravitational/teleport/api/client
-```
-
-<Admonition type="tip" title="API Version">
-To ensure compatibility, you should use a version of Teleport's API library that matches
-the major version of Teleport running in your cluster.
-
-To find the pseudoversion appropriate for a go.mod file for a specific git tag,
-run the following command from the `teleport` repository:
-
-```code
-$ go list -f '{{.Version}}' -m "github.com/gravitational/teleport/api@$(git rev-parse v12.1.0)"
-v0.0.0-20230307032901-49a6de744a3a
-```
-</Admonition>
-
-Create a file called `main.go`, modifying the `Addrs` strings as needed:
-
-```go
-package main
-
-import (
-	"context"
-	"log"
-
-	"github.com/gravitational/teleport/api/client"
-)
-
-func main() {
-	ctx := context.Background()
-
-	clt, err := client.New(ctx, client.Config{
-		Addrs: []string{
-			// Teleport Cloud customers should use <tenantname>.teleport.sh
-			"tele.example.com:443",
-			"tele.example.com:3025",
-			"tele.example.com:3024",
-			"tele.example.com:3080",
- 		},
-		Credentials: []client.Credentials{
-			client.LoadProfile("", ""),
-		},
-	})
-
-	if err != nil {
-		log.Fatalf("failed to create client: %v", err)
-	}
-
-	defer clt.Close()
-	resp, err := clt.Ping(ctx)
-	if err != nil {
-		log.Fatalf("failed to ping server: %v", err)
-	}
-
-	log.Printf("Example success!")
-	log.Printf("Example server response: %s", resp)
-	log.Printf("Server version: %s", resp.ServerVersion)
-}
-```
-
-Now you can run the program and connect the client to the Teleport Auth Service to fetch the server version.
-
-```code
-$ go run main.go
-```
-
-## Next steps
-
-- Learn about [pkg.go.dev](https://pkg.go.dev/github.com/gravitational/teleport/api/client)
-- Learn how to use [the client](https://pkg.go.dev/github.com/gravitational/teleport/api/client#Client)
-- Learn how to [work with credentials](https://pkg.go.dev/github.com/gravitational/teleport/api/client#Credentials)
-- Read about Teleport [API architecture](../../reference/architecture/api-architecture.mdx) for an in-depth overview of the API and API clients.
-- Read [API authorization](../../reference/architecture/api-architecture.mdx) to learn more about defining custom roles for your API client.
-- Review the `client` [pkg.go reference documentation](https://pkg.go.dev/github.com/gravitational/teleport/api/client) for more information about working with the Teleport API programmatically.
-- Familiarize yourself with the [admin manual](../management/admin/admin.mdx) to make the best use of the API.
diff --git a/docs/pages/admin-guides/api/rbac.mdx b/docs/pages/admin-guides/api/rbac.mdx
deleted file mode 100644
index 63c6eb35ad3db..0000000000000
--- a/docs/pages/admin-guides/api/rbac.mdx
+++ /dev/null
@@ -1,987 +0,0 @@
----
-title: Generate Teleport Roles from an External RBAC System
-description: Use Teleport's API to automatically generate Teleport roles based on third-party RBAC policies
----
-
-You can use the Teleport gRPC API to generate roles automatically based on an
-external role-based access control (RBAC) system, such as GitHub or AWS Identity
-and Access Management.
-
-This is especially useful for:
-
-- Setting up a new Teleport cluster, since you can preserve your existing
-  authorization levels or categories while letting Teleport handle access
-  control.
-- Ensuring that your Teleport cluster stays up to date with the RBAC systems of
-  the infrastructure it manages access to. This way, Teleport roles do not
-  unexpectedly gain or lose permissions if your teams reconfigure your external
-  RBAC systems.
-
-In this guide, we will build a small demo application to show you how to
-generate Teleport roles using Teleport's API client library.
-
-<Admonition type="danger">
-
-The program we will build in this guide is intended as a learning tool. **Do not
-connect it to your production Teleport cluster.**  Use a demo cluster instead.
-
-</Admonition>
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- Go version (=teleport.golang=) or above installed on your workstation. See the
-  [Go download page](https://go.dev/dl/). You will not need to be familiar with
-  Go to complete this guide, though Go knowledge is required if you want to
-  build a production-ready Teleport client application.
-
-In a production scenario, you will already have a third-party RBAC solution to
-use as a basis for generating Teleport roles. In this guide, we will simulate
-this by deploying a local Kubernetes cluster using `minikube` and setting up
-some RBAC resources. We will then use this Kubernetes cluster to generate
-Teleport roles.
-
-To run the local demo environment, ensure that you have the following tools
-installed on your workstation:
-
-| Tool     | Purpose                          | Installation link                                             |
-|----------|----------------------------------|---------------------------------------------------------------|
-| minikube | Local Kubernetes deployment tool | [Install minikube](https://minikube.sigs.k8s.io/docs/start/)  |
-| Helm     | Kubernetes package manager       | [Install Helm](https://helm.sh/docs/intro/install/)           |
-| kubectl  | Kubernetes admin CLI             | [Install kubectl](https://kubernetes.io/docs/tasks/tools/)    |
-| Docker   | Required minikube driver         | [Get Started With Docker](https://www.docker.com/get-started) |
-<Admonition type="tip">
-
-Even if you do not plan to set up the demo project, you can follow this guide to
-see which libraries, types, and functions you can use to automatically generate
-Teleport roles based on an external RBAC system.
-
-</Admonition>
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/4. Set up your Kubernetes cluster
-
-In this step, we will launch a local Kubernetes cluster and set up role-based
-access controls within it. We will then use this Kubernetes cluster as a basis
-for generating Teleport roles.
-
-### Start minikube
-
-Start minikube with the Docker driver, which boots a local Kubernetes cluster on
-a single Docker container:
-
-```code
-$ minikube start --driver=docker
-```
-
-This command should start a local Kubernetes cluster and set your context (i.e.,
-the Kubernetes cluster you are currently interacting with) to `minikube`. To
-verify this, run the following command:
-
-```code
-$ kubectl config current-context
-minikube
-```
-
-### Define demo Kubernetes RBAC resources
-
-Next, we will set up RBAC resources in your local `minikube` cluster to use as a
-basis for generating Teleport roles.
-
-In Kubernetes, you can divide a cluster into logically isolated **namespaces**.
-A **role** defines a set of permissions for manipulating resources in a specific
-namespace. A **cluster role** is a role that applies to all namespaces in a
-cluster. You can use a **role binding** or **cluster role binding** to attach a
-role or cluster role to Kubernetes users and groups.
-
-Define a Kubernetes role and role binding that allows users in the
-`app-developer` group to read and list pods in the `app` namespace. Add the
-following to a file called `pod-reader.yaml`:
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: app
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: app
-  name: pod-reader
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: read-pods
-  namespace: app
-  annotations:
-    'create-teleport-role': 'true'
-subjects:
-- kind: Group
-  name: app-developer
-  apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: pod-reader
-  apiGroup: rbac.authorization.k8s.io
-```
-
-Create the resources:
-
-```code
-$ kubectl apply -f pod-reader.yaml
-namespace/app created
-role.rbac.authorization.k8s.io/pod-reader created
-rolebinding.rbac.authorization.k8s.io/read-pods created
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-Next, define a cluster role and cluster role binding that allow users in the
-`ops` group to read, create, and execute commands on pods in all namespaces. Add
-the following to a file called `pod-ops.yaml`:
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pod-ops
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "watch", "list", "create", "exec", "logs"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pod-ops
-  annotations:
-    'create-teleport-role': 'true'
-subjects:
-- kind: Group
-  name: ops
-  apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: pod-ops
-  apiGroup: rbac.authorization.k8s.io
-```
-
-Create the resources:
-
-```code
-$ kubectl apply -f pod-ops.yaml
-clusterrole.rbac.authorization.k8s.io/pod-ops created
-clusterrolebinding.rbac.authorization.k8s.io/pod-ops created
-```
-
-Later in this guide, we will show you how to automatically generate Teleport
-roles based on the Kubernetes RBAC resources you created.
-
-### Define RBAC resources for the client application
-
-Next, ensure that your API client can read the RBAC resources you created.
-Create a file called `rbac-sync.yaml` with the following content:
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: rbac-sync
-rules:
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"]
-  verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: rbac-sync
-subjects:
-- kind: User
-  name: sync-kubernetes-rbac
-  apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: rbac-sync
-  apiGroup: rbac.authorization.k8s.io
-```
-
-Apply the changes:
-
-```code
-$ kubectl apply -f rbac-sync.yaml
-clusterrole.rbac.authorization.k8s.io/rbac-sync created
-clusterrolebinding.rbac.authorization.k8s.io/rbac-sync created
-```
-
-## Step 2/4. Set up Teleport
-
-In this step, you will configure Teleport to enable your API client application
-to interact with your Kubernetes cluster.
-
-### Create a user and role for the client application
-
-Give the client application a Teleport user and role that can retrieve
-information about a Kubernetes cluster that is registered with Teleport,
-authenticate to the cluster, and create or update Teleport roles.
-
-Create a file called `sync-kubernetes-rbac.yaml` with the following content:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: sync-kubernetes-rbac
-spec:
-  allow:
-    kubernetes_labels:
-      '*': '*'
-    kubernetes_users:
-      - sync-kubernetes-rbac
-    kubernetes_resources:
-      - kind: pod
-        name: '*'
-        namespace: '*'
-    rules:
-      - resources: ['kubernetes_cluster']
-        verbs: ['read']
-      - resources: ['role']
-        verbs: ['create', 'update']
----
-kind: user
-metadata:
-  name: sync-kubernetes-rbac
-spec:
-  roles: ['sync-kubernetes-rbac']
-version: v2
-```
-
-Create the user and role:
-
-```code
-$ tctl create -f sync-kubernetes-rbac.yaml
-role 'sync-kubernetes-rbac' has been created
-user "sync-kubernetes-rbac" has been created
-```
-
-### Enable impersonation of the client application
-
-As with all Teleport users, the Teleport Auth Service authenticates the
-`sync-kubernetes-rbac` user by issuing short-lived TLS credentials. In this
-case, we will request the credentials manually by *impersonating* the
-`sync-kubernetes-rbac` role and user.
-
-If you are running a self-hosted Teleport Enterprise deployment and are using
-`tctl` from the Auth Service host, you will already have impersonation
-privileges.
-
-To grant your user impersonation privileges for `sync-kubernetes-rbac`, define a role
-called `sync-kubernetes-rbac-impersonator` by pasting the following YAML document into
-a file called `sync-kubernetes-rbac-impersonator.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: sync-kubernetes-rbac-impersonator
-spec:
-  allow:
-    impersonate:
-      roles:
-      - sync-kubernetes-rbac
-      users:
-      - sync-kubernetes-rbac
-```
-
-Create the `sync-kubernetes-rbac-impersonator` role:
-
-```code
-$ tctl create -f sync-kubernetes-rbac-impersonator.yaml
-```
-
-(!docs/pages/includes/add-role-to-user.mdx role="sync-kubernetes-rbac-impersonator"!)
-
-You will now be able to generate signed certificates for the `sync-kubernetes-rbac`
-role and user.
-
-### Install the Teleport Kubernetes Service
-
-We will enable your client application to communicate with your Kubernetes
-cluster via the Teleport Kubernetes Service, which forwards requests after
-authorizing them. While this step is not strictly necessary with a local
-`minikube` cluster, it demonstrates one way to use Teleport to securely access
-your external RBAC system's API.
-
-(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-Request a token that the Kubernetes Service will use to join your Teleport
-cluster:
-
-```code
-$ tctl tokens add --type=kube,app,discovery --format=text
-```
-
-Copy this token so you can use it when running the Teleport Kubernetes Service.
-
-Ensure that you are connected to the right Kubernetes cluster (logging into
-Teleport earlier will have changed your Kubernetes context):
-
-```code
-$ kubectl config use-context minikube
-Switched to context "minikube".
-```
-
-Install the Teleport Kubernetes Service in your cluster, assigning <Var
-name="proxy-address" /> to the host **and port** of your Teleport Proxy Service
-(e.g., `mytenant.teleport.sh:443`) and <Var name="token" /> to the token you
-requested earlier:
-
-```code
-$ helm install teleport-agent teleport/teleport-kube-agent \
-  --set kubeClusterName=minikube \
-  --set roles="kube\,app\,discovery" \
-  --set proxyAddr=<Var name="proxy-address" /> \
-  --set authToken=<Var name="token" /> \
-  --create-namespace \
-  --namespace=teleport-agent \
-  --set labels.environment=demo \
-  --version (=teleport.version=)
-```
-
-After a few seconds, verify that you have deployed the Teleport Kubernetes
-Service by running the following command:
-
-```code
-$ kubectl -n teleport-agent get pods
-```
-
-This should show that the Kubernetes Service is running:
-
-```text
-NAME               READY   STATUS    RESTARTS   AGE
-teleport-agent-0   1/1     Running   0          22s
-```
-
-`tsh` should indicate that the cluster has registered with Teleport:
-
-```code
-$ tsh kube ls
-Kube Cluster Name Labels           Selected
------------------ ---------------- --------
-minikube          environment=demo
-```
-
-## Step 3/4. Write the client application
-
-At this point, we have set up an external RBAC system to use for generating
-Teleport roles and configured Teleport to allow our API client to interact with
-our Kubernetes cluster and Teleport cluster. In this step, we will write our
-client application.
-
-### Set up your Go project
-
-Download the source code for the API client application:
-
-```code
-$ git clone --depth=1 https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
-$ cd teleport/examples/api-sync-roles
-```
-
-For the rest of this guide, we will show you how to set up the client
-application and explore the ways it uses Teleport's API to automatically
-generate Teleport roles.
-
-### Export identity files for the client application
-
-The `sync-kubernetes-rbac` user needs signed credentials in order to connect to
-your Teleport cluster as well as your Kubernetes cluster. You will use the `tctl
-auth sign` command to request these credentials for your API client.
-
-#### Connecting to your Teleport cluster
-
-The following `tctl auth sign` command impersonates the `sync-kubernetes-rbac`
-user, generates signed credentials, and writes an identity file to the local
-directory:
-
-```code
-$ tctl auth sign --user=sync-kubernetes-rbac --out=auth.pem
-```
-
-The identity file, `auth.pem`, includes both TLS and SSH credentials. Your
-client application uses the SSH credentials to connect to the Proxy Service,
-which establishes a reverse tunnel connection to the Auth Service. The client
-application uses this reverse tunnel, along with your TLS credentials, to
-connect to the Auth Service's gRPC endpoint.
-
-#### Connecting to the Kubernetes cluster
-
-You will also need to give the client application a way to authenticate to your
-Kubernetes cluster. To do this, use Teleport's certificate authority to sign
-credentials for the `sync-kubernetes-rbac` user. Your API client will present
-these credentials to authenticate to the Teleport Kubernetes Service, which will
-proxy requests to the Kubernetes cluster.
-
-Run the following command, ensuring that <Var name="proxy-address" /> includes
-the host and port of your Proxy Service:
-
-```code
-$ tctl auth sign --user=sync-kubernetes-rbac \
-  --kube-cluster-name=minikube \
-  --format=kubernetes \
-  --proxy=https://<Var name="proxy-address" /> \
-  --out=kubeconfig
-```
-
-### Imports
-
-In the `api-sync-roles` directory, open `main.go`, which contains the API client
-program we demonstrate in this guide.
-
-Here are the packages our client application imports from Go's standard library:
-
-|Package|Description|
-|---|---|
-| `context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata.|
-|`fmt`|Formatting data for printing, strings, or errors.|
-|`io`|Dealing with I/O operations, e.g., reading files or network sockets.|
-|`os`|Interacting with the operating system, e.g., to open files.|
-|`time`|Dealing with time. We will use this to define a timeout for connecting to the Auth Service along with a ticker for executing our discovery logic in a loop.|
-
-The client imports the following third-party code:
-
-|Package|Description|
-|---|---|
-|`github.com/gravitational/teleport/api/client`|A library for authenticating to the Auth Service's gRPC API and making requests, aliased as `teleport`.|
-|`github.com/gravitational/teleport/api/types`|Types used in the Auth Service API, e.g., Application Service records.|
-|`github.com/gravitational/trace`|Presenting errors with more useful detail than the standard library provides.|
-|`google.golang.org/grpc`|The gRPC client and server library.|
-|`k8s.io/api/rbac/v1`|The Kubernetes RBAC API client library.|
-|`k8s.io/apimachinery/pkg/apis/meta/v1`|Code common to Kubernetes' API client libraries.|
-|`k8s.io/client-go/kubernetes`|Setting up an general-purpose Kubernetes client.|
-|`k8s.io/client-go/kubernetes/typed/rbac/v1`|Types for the Kubernetes RBAC API.|
-|`k8s.io/client-go/tools/clientcmd`|Another general-purpose Kubernetes client library.|
-
-### Constants
-
-The program defines constants in a visible location so, later on, it's easier to
-make them configurable outside the program:
-
-```go
-const (
-	proxyAddr         string = ""
-	initTimeout              = time.Duration(30) * time.Second
-	identityFilePath  string = "auth.pem"
-	kubeconfigPath    string = "kubeconfig"
-	clusterName       string = "minikube"
-	roleAnnotationKey string = "create-teleport-role"
-)
-```
-
-We will use these constants later in the program. They define some values we may
-want to change later, including:
-
-|Constant|Description|
-|---|---|
-|`proxyAddr`|The host and port of the Teleport Proxy Service, e.g., `mytenant.teleport.sh:443`, which we will use to connect the client to your cluster. **Assign this to your own Proxy Service's host and port:** <Var name="proxy-address" /> |
-|`initTimeout`|The timeout for connecting to the Teleport cluster. We have defined this as 30 seconds.|
-|`identityFilePath`|The path to the Teleport identity file you created earlier.|
-|`clusterName`|The name of the Kubernetes cluster you will fetch RBAC resources from. In this guide, the cluster's name is `minikube`.|
-|`roleAnnotationKey`|In Kubernetes, annotations are arbitrary key/value pairs that you can add to resources. The role and cluster role bindings we created earlier have the annotation key we specify here so our client application can fetch them.|
-
-### Initializing a Kubernetes RBAC client
-
-To contact the Kubernetes API, we will need to set up an HTTP client. The client
-authenticates to the API using mutual TLS, loading a client certificate,
-certificate authority, and private key from the file at `kubeconfigPath`.
-Earlier in the guide, we requested this from the Teleport Auth Service.
-
-The program sets up a Kubernetes API client with the `getRBACClient` function:
-
-```go
-func getRBACClient() (v1.RbacV1Interface, error) {
-	f, err := os.Open(kubeconfigPath)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	kc, err := io.ReadAll(f)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	n, err := clientcmd.RESTConfigFromKubeConfig(kc)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c, err := kubernetes.NewForConfig(n)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return c.RbacV1(), nil
-}
-```
-
-`getRBACClient` opens and reads the Kubernetes credentials file at
-`kubeconfigPath`, then uses the file to set up a Kubernetes API client
-configuration (`clientcmd.RESTConfigFromKubeConfig(kc)`) and, with that, an HTTP
-client (`kubernetes.NewForConfig(n)`).
-
-Finally, it returns an interface to the Kubernetes API dedicated to role-based
-access controls, which the rest of the program uses to interact with your
-Kubernetes cluster.
-
-### Creating a Teleport role from a Kubernetes cluster role binding
-
-The `createTeleportRoleFromClusterRoleBinding` function creates a Teleport role
-from a Kubernetes cluster role binding by populating fields in the former based
-on fields in latter:
-
-```go
-func createTeleportRoleFromClusterRoleBinding(teleport *client.Client, k types.KubeCluster, r rbacv1.ClusterRoleBinding) error {
-	if e, ok := r.Annotations[roleAnnotationKey]; !ok || e != "true" {
-		return nil
-	}
-
-	role := types.RoleV6{}
-	role.SetMetadata(types.Metadata{
-		Name: k.GetName() + "-" + r.RoleRef.Name + "-" + "cluster",
-	})
-
-	b := k.GetStaticLabels()
-	labels := make(types.Labels)
-	for k, v := range b {
-		labels[k] = []string{v}
-	}
-	role.SetKubernetesLabels(types.Allow, labels)
-	role.SetKubeResources(types.Allow, []types.KubernetesResource{
-		types.KubernetesResource{
-			Kind:      "pod",
-			Namespace: "*",
-			Name:      "*",
-		},
-	})
-
-	var g []string
-	var u []string
-	for _, s := range r.Subjects {
-		if s.Kind == "User" || s.Kind == "ServiceAccount" {
-			u = append(u, s.Name)
-			continue
-		}
-		if s.Kind == "Group" {
-			g = append(g, s.Name)
-			continue
-		}
-	}
-	role.SetKubeGroups(types.Allow, g)
-	role.SetKubeUsers(types.Allow, u)
-	if err := teleport.UpsertRole(
-		context.Background(),
-		&role,
-	); err != nil {
-		return trace.Wrap(err)
-	}
-	fmt.Println("Upserted Teleport role:", role.GetName())
-	return nil
-}
-```
-
-To avoid unexpected behavior, this function ignores Kubernetes-managed roles and
-roles for internal systems like the Teleport Kubernetes Service. This function
-checks the cluster role binding's metadata for an annotation with a specific
-key, `roleAnnotationKey`, and ignores any resource where this key is not set to
-`"true"`.
-
-We also want a quick way to identify roles we created with this program. To do
-so, this function names all roles it generates based on cluster role bindings
-according to the following attributes:
-
-- Kubernetes cluster name
-- Kubernetes role name
-- The suffix `-cluster`.
-
-In our demo application, this function will create a Teleport role called
-`minikube-pod-ops-cluster`.
-
-The rest of the function assigns fields to a `types.RoleV6`, the Teleport API
-client's role type, based on the cluster role binding:
-
-|Role field|Purpose|How we assign it|
-|---|---|---|
-|`allow.kubernetes_labels`|Labels for Teleport-registered Kubernetes clusters that a user with this role is allowed to access.|Based on the Teleport-registered Kubernetes cluster that the cluster role binding belongs to.|
-|`allow.kubernetes_resources`|Kubernetes pods in specific namespaces that that a user with this role is allowed to access.|Allow access to all namespaces, since cluster role bindings are not restricted by namespace.|
-|`allow.kubernetes_users` and `allow.kubernetes_groups`|The Kubernetes groups and users that a Teleport user with this role will assume when interacting with the Kubernetes cluster.|Supply the names of any users or groups connected to the cluster role binding.|
-
-### Creating a Teleport role from a Kubernetes role binding
-
-As with cluster role bindings, this program will also create Teleport roles
-based on Kubernetes role bindings:
-
-```go
-func createTeleportRoleFromRoleBinding(teleport *client.Client, k types.KubeCluster, r rbacv1.RoleBinding) error {
-	if e, ok := r.Annotations[roleAnnotationKey]; !ok || e != "true" {
-		return nil
-	}
-
-	role := types.RoleV6{}
-	role.SetMetadata(types.Metadata{
-		Name: k.GetName() + "-" + r.RoleRef.Name + "-" + r.Namespace,
-	})
-
-	b := k.GetStaticLabels()
-	labels := make(types.Labels)
-	for k, v := range b {
-		labels[k] = []string{v}
-	}
-	role.SetKubernetesLabels(types.Allow, labels)
-	role.SetKubeResources(types.Allow, []types.KubernetesResource{
-		types.KubernetesResource{
-			Kind:      "pod",
-			Namespace: r.Namespace,
-			Name:      "*",
-		},
-	})
-	var g []string
-	var u []string
-	for _, s := range r.Subjects {
-		if s.Kind == "User" || s.Kind == "ServiceAccount" {
-			u = append(u, s.Name)
-			continue
-		}
-		if s.Kind == "Group" {
-			g = append(g, s.Name)
-			continue
-		}
-	}
-	role.SetKubeGroups(types.Allow, g)
-	role.SetKubeUsers(types.Allow, u)
-
-	if err := teleport.UpsertRole(
-		context.Background(),
-		&role,
-	); err != nil {
-		return trace.Wrap(err)
-	}
-	fmt.Println("Upserted Teleport role:", role.GetName())
-	return nil
-}
-```
-
-While the overall behavior of this function is the same as
-`createTeleportRoleFromClusterRoleBinding`, Kubernetes role bindings require
-some differences in how we assign fields to Teleport roles:
-
-- When setting the name of the role, we use the role binding's namespace as the
-  suffix, rather than `-cluster`, to indicate the namespace that this role
-  applies to.
-- In the role's `kubernetes_resources` field, the value has the same namespace
-  as the role binding, rather than applying to all namespaces.
-
-### Creating Teleport roles based on Kubernetes resources
-
-Now that we have functions to create Teleport roles based on individual
-Kubernetes RBAC resources, we can fetch all RBAC resources from our Kubernetes
-cluster and call these functions:
-
-```go
-func createTeleportRolesForKubeCluster(teleport *client.Client, k types.KubeCluster) error {
-	rbac, err := getRBACClient()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	crb, err := rbac.ClusterRoleBindings().List(
-		context.Background(),
-		metav1.ListOptions{},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	for _, i := range crb.Items {
-		if err := createTeleportRoleFromClusterRoleBinding(teleport, k, i); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	rb, err := rbac.RoleBindings("").List(
-		context.Background(),
-		metav1.ListOptions{},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	for _, i := range rb.Items {
-		if err := createTeleportRoleFromRoleBinding(teleport, k, i); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-	return nil
-}
-```
-
-`createTeleportRolesForKubeCluster` takes a Teleport client and a
-Teleport-registered Kubernetes cluster. It calls the `getRBACClient` function we
-defined earlier to set up a client for the Kubernetes cluster. It then:
-
-- Lists Kubernetes cluster role bindings and creates a Teleport role for each one.
-- Lists Kubernetes role bindings and creates a Teleport role for each one.
-
-### Initializing clients and start the application
-
-The functions we declared earlier require a Teleport API client and a
-Teleport-registered Kubernetes cluster, and we initialize these in the
-entrypoint of the program, the `main` function:
-
-```go
-func main() {
-	ctx, cancel := context.WithTimeout(context.Background(), initTimeout)
-	defer cancel()
-	creds := client.LoadIdentityFile(identityFilePath)
-
-	teleport, err := client.New(ctx, client.Config{
-		Addrs:       []string{proxyAddr},
-		Credentials: []client.Credentials{creds},
-	})
-	if err != nil {
-		panic(err)
-	}
-	fmt.Println("Connected to Teleport")
-
-	ks, err := teleport.GetKubernetesServers(context.Background())
-	if err != nil {
-		panic(err)
-	}
-	for _, k := range ks {
-		if k.GetCluster().GetName() != clusterName {
-			continue
-		}
-		fmt.Println("Retrieved Kubernetes cluster", clusterName)
-
-		if err := createTeleportRolesForKubeCluster(teleport, k.GetCluster()); err != nil {
-			panic(err)
-		}
-		fmt.Println("Created roles for Kubernetes cluster", clusterName)
-		return
-	}
-	panic("Unable to locate a Kubernetes Service instance for " + clusterName)
-}
-```
-
-`client` is Teleport's library for setting up an API client. Our program
-initializes a Teleport client by calling `client.LoadIdentityFile` to obtain a
-`client.Credentials`. It then uses the `client.Credentials` to call
-`client.New`, which connects to the Teleport Proxy Service specified in the
-`Addrs` field using the provided identity file.
-
-<Admonition type="warning">
-
-This program does not validate your credentials or Teleport cluster address.
-Make sure that:
-
-- The identity file you exported earlier does not have an expired TTL
-- The value you supplied to the `Addrs` field in `teleport.Config` includes both
-  the host **and** the web port of your Teleport Proxy Service, e.g.,
-  `mytenant.teleport.sh:443`
-
-</Admonition>
-
-After initializing a Teleport client, the `main` function fetches all Kubernetes
-servers registered with Teleport (`teleport.GetKubernetesServers`) and checks if
-there is a registered Kubernetes cluster that matches the one you specified.
-
-If a matching Kubernetes cluster exists, the code calls the
-`createTeleportRolesForKubeClusters` function we defined earlier. If not, the
-program prints an error message and a stack trace by calling Go's built-in
-`panic` function.
-
-## Step 4/4. Test your client application
-
-To test the client application, start it up from within its project directory:
-
-```code
-$ go run main.go
-```
-
-You should see the following output:
-
-```text
-Connected to Teleport
-Retrieved Kubernetes cluster minikube
-Upserted Teleport role: minikube-pod-ops-cluster
-Upserted Teleport role: minikube-pod-reader-app
-Created roles for Kubernetes cluster minikube
-```
-
-Examine the new `minikube-pod-ops-cluster` role by running the command below:
-
-```code
-$ tctl get roles/minikube-pod-ops-cluster
-```
-
-You should see output similar to the following:
-
-```yaml
-kind: role
-metadata:
-  id: 1678732494974032643
-  name: minikube-pod-ops-cluster
-spec:
-  allow:
-    kubernetes_groups:
-    - ops
-    kubernetes_labels:
-      environment: demo
-    kubernetes_resources:
-    - kind: pod
-      name: '*'
-      namespace: '*'
-  deny: {}
-  options:
-    cert_format: standard
-    create_host_user: false
-    desktop_clipboard: true
-    desktop_directory_sharing: true
-    enhanced_recording:
-    - command
-    - network
-    forward_agent: false
-    idp:
-      saml:
-        enabled: true
-    max_session_ttl: 30h0m0s
-    pin_source_ip: false
-    ssh_port_forwarding:
-      remote:
-        enabled: true
-      local:
-        enabled: true
-    record_session:
-      default: best_effort
-      desktop: true
-    ssh_file_copy: true
-version: v7
-```
-
-Compare this with the `minikube-pod-reader-app` role, which you can retrieve
-with the following command:
-
-```code
-$ tctl get roles/minikube-pod-reader-app
-```
-
-Here is the role we created:
-
-```yaml
-kind: role
-metadata:
-  id: 1678732495284493075
-  name: minikube-pod-reader-app
-spec:
-  allow:
-    kubernetes_groups:
-    - app-developer
-    kubernetes_labels:
-      environment: demo
-    kubernetes_resources:
-    - kind: pod
-      name: '*'
-      namespace: app
-  deny: {}
-  options:
-    cert_format: standard
-    create_host_user: false
-    desktop_clipboard: true
-    desktop_directory_sharing: true
-    enhanced_recording:
-    - command
-    - network
-    forward_agent: false
-    idp:
-      saml:
-        enabled: true
-    max_session_ttl: 30h0m0s
-    pin_source_ip: false
-    ssh_port_forwarding:
-      remote:
-        enabled: true
-      local:
-        enabled: true
-    record_session:
-      default: best_effort
-      desktop: true
-    ssh_file_copy: true
-version: v7
-```
-
-Since role bindings are namespaced, this role only allows access to pods in the
-`app` namespace, where this role binding was applied. The Kubernetes Service
-forwards traffic from users with this role using the `app-developer` Kubernetes
-group.
-
-## Next steps
-
-We have implemented a Teleport API client that generates Teleport roles based on
-the Kubernetes RBAC system. You can use Teleport's API to build similar
-applications that interact with other RBAC systems, such as GitHub teams or
-groups within your database management system.
-
-Here are some starting points for building out your client application.
-
-### Learn more about Teleport roles
-
-To write an effective client application that generates Teleport roles from an
-external RBAC solution, you should understand the role fields that apply to
-infrastructure resources you want to manage access to.
-
-See the links below for guides to fields related to different infrastructure
-resources:
-
-- [Servers](../../enroll-resources/server-access/rbac.mdx)
-- [Databases](../../enroll-resources/database-access/rbac.mdx)
-- [Kubernetes clusters](../../enroll-resources/kubernetes-access/controls.mdx)
-- [Windows Desktops](../../enroll-resources/desktop-access/rbac.mdx)
-- [Applications](../../enroll-resources/application-access/controls.mdx)
-
-For general guidance, read our [Access Controls
-Reference](../../reference/access-controls/roles.mdx).
-
-### Register your cloud provider with Teleport
-
-You can protect cloud provider APIs with Teleport and instruct your API client
-applications to connect to these APIs via the Teleport Application Service.
-Using Teleport-protected cloud provider APIs, you can generate Teleport roles
-based on your cloud provider's RBAC solution.
-
-Read our guides for how to set up the Teleport Application Service for cloud
-provider APIs:
-
-- [AWS](../../enroll-resources/application-access/cloud-apis/aws-console.mdx)
-- [Google Cloud](../../enroll-resources/application-access/cloud-apis/google-cloud.mdx)
-- [Azure](../../enroll-resources/application-access/cloud-apis/azure.mdx)
-
-### Consult examples
-
-The Teleport code repository contains [examples of production-ready Teleport API
-clients](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/examples/).
-While we currently do not maintain plugins that generate Teleport
-roles, you can use these examples to see how to implement configuration
-parsing, retries, and other tasks.
-
-### Provision the client application with short-lived credentials
-
-In this example, we used the `tctl auth sign` command to fetch credentials for
-the program you wrote. For production usage, we recommend provisioning
-short-lived credentials via Machine ID, which reduces the risk of these
-credentials becoming stolen. View our [Machine ID
-documentation](../../enroll-resources/machine-id/introduction.mdx) to learn more.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/access-graph/access-graph.mdx b/docs/pages/admin-guides/deploy-a-cluster/access-graph/access-graph.mdx
deleted file mode 100644
index ec7ccc5ce6a1d..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/access-graph/access-graph.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: "Self-Hosting Teleport Access Graph"
-description: Explains how to deploy Access Graph alongside a self-hosted Teleport cluster.
----
-
-If you run a self-hosted Teleport cluster, using Access Graph (part of
-Teleport Identity Security) requires running the Access Graph Service on your own
-infrastructure. The following guides show you how to deploy the Access Graph
-Service.
-
-<DocCardList />
diff --git a/docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted.mdx b/docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted.mdx
deleted file mode 100644
index 19a784b3c4576..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted.mdx
+++ /dev/null
@@ -1,138 +0,0 @@
----
-title: Run Teleport Identity Security on Self-Hosted Clusters
-description: Describes how to deploy Access Graph on self-hosted clusters.
----
-
-Identity Security with Access Graph on a self-hosted Teleport cluster requires setting up 
-Access Graph, a dedicated service which uses PostgreSQL as its backing storage and communicates 
-with Auth Service and Proxy Service to collect information about resources and access.
-
-This guide will help you set up the service and enable Access Graph in your Teleport cluster.
-
-## Prerequisites
-
-- A running Teleport Enterprise cluster v14.3.6 or later.
-- An updated `license.pem` with Identity Security enabled.
-- Docker version v(=docker.version=) or later.
-- A PostgreSQL database server v14 or later.
-  - Access Graph needs a dedicated [database](https://www.postgresql.org/docs/current/sql-createdatabase.html) to store its data.
-    The user that Access Graph connects to the database with needs to be the owner of this database, or have similar broad permissions:
-    at least the `CREATE TABLE` privilege on the `public` schema, and the `CREATE SCHEMA` privilege.
-  - Amazon RDS for PostgreSQL is supported.
-- A TLS certificate for the Access Graph service
-  - The TLS certificate must be issued for "server authentication" key usage,
-    and must list the IP or DNS name of the Access Graph service in an X.509 v3 `subjectAltName` extension.
-  - Starting from version 1.20.4 of the Access Graph service, the container runs as a non-root user by default.
-    Make sure the certificate files are readable by the user running the container. You can set correct permissions with the following command:
-    ```code
-    $ sudo chown 65532 /etc/access_graph/tls.key
-    ```
-- The node running the Access Graph service must be reachable from Teleport Auth Service and Proxy Service.
-
-<Admonition type="warning">
-    The deployment with Docker is suitable for testing and development purposes. For production deployments,
-    consider using the Access Graph Helm chart to deploy this service on Kubernetes.
-    Refer to [Helm chart for Access Graph](self-hosted-helm.mdx) for instructions.
-</Admonition>
-
-## Step 1/3. Set up Access Graph
-
-You will need a copy of your Teleport cluster's host certificate authority (CA) on the machine that hosts the Access Graph service.
-The service requires incoming connections to be authenticated via host certificates that the host CA issues to the Auth Service and Proxy Service.
-
-The host CA can be retrieved and saved into a file in one of the following ways:
-
-<Tabs>
-<TabItem label="Via curl">
-```code
-$ sudo mkdir /etc/access_graph
-$ curl -s 'https://<Var name="teleport.example.com" />/webapi/auth/export?type=tls-host' | sudo tee /etc/access_graph/teleport_host_ca.pem
-```
-</TabItem>
-
-<TabItem label="Via tctl">
-```code
-$ sudo mkdir /etc/access_graph
-$ tsh login --proxy=<Var name="teleport.example.com" />
-$ tctl get cert_authorities --format=json \
-    | jq -r '.[] | select(.spec.type == "host") | .spec.active_keys.tls[].cert' \
-    | base64 -d | sudo tee /etc/access_graph/teleport_host_ca.pem
-```
-</TabItem>
-</Tabs>
-
-Then, on the same machine, create a configuration file for the Access Graph service, similar to this:
-
-```yaml
-backend:
-  postgres:
-    # This uses the PostgreSQL connection URI format, see https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS
-    # A stricter `sslmode` value is strongly recommended,
-    # e.g. `sslmode=verify-full&sslrootcert=/etc/access_graph/my_postgres_ca.crt`.
-    # For a full reference on possible parameters see https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
-    connection: postgres://access_graph_user:my_password@db.example.com:5432/access_graph_db?sslmode=require
-
-    # When running on Amazon RDS, IAM auth via credentials set in the environment can be used as follows:
-    # iam:
-    #   aws_region: us-west-2
-
-# IP address (optional) and port for the Access Graph service to listen to.
-# This is the default value. This key can be omitted to listen on port 50051 on all interfaces.
-address: ":50051"
-
-tls:
-  # File paths of PEM-encoded TLS certificate and private key for the Access Graph server.
-  cert: /etc/access_graph/tls.crt
-  key: /etc/access_graph/tls.key
-
-# This lists the file paths for host CAs of Teleport clusters that are allowed to register with this Access Graph service.
-# Several paths can be included to allow several Teleport clusters to connect to the Access Graph service.
-registration_cas:
-  - /etc/access_graph/teleport_host_ca.pem # A full path to the file containing the Teleport cluster's host CA certificate.
-```
-
-Finally, start the Access Graph service using Docker as follows:
-
-```console
-$ docker run -p 50051:50051 -v <path-to-config>:/app/config.yaml -v /etc/access_graph:/etc/access_graph public.ecr.aws/gravitational/access-graph:(=access_graph.version=)
-```
-
-## Step 2/3. Update the Teleport Auth Service configuration
-
-In the YAML config for the Auth Service, add a new top-level section for Access Graph configuration.
-
-```yaml
-access_graph:
-  enabled: true
-  # host:port where the Access Graph service is listening
-  endpoint: access-graph.example.com:50051
-  # Specify a trusted CA we expect the Access Graph server certificate to be signed by.
-  # If not specified, the system trust store will be used.
-  ca: /etc/access_graph_ca.pem
-```
-
-Then, restart Auth Service instances, followed by Proxy Service instances.
-
-## Step 3/3. View the Access Graph in the Web UI
-
-You can find Access Graph in the "Access Management" tab in the Web UI.
-![Access Management menu item](../../../../img/access-graph/menu-item.png)
-
-To access the interface, your user must have a role that allows `list` and `read` verbs on the `access_graph` resource, e.g.:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: my-role
-spec:
-  allow:
-    rules:
-    - resources:
-      - access_graph
-      verbs:
-      - list
-      - read
-```
-
-The preset `editor` role has the required permissions by default.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deploy-a-cluster.mdx b/docs/pages/admin-guides/deploy-a-cluster/deploy-a-cluster.mdx
deleted file mode 100644
index b9bff221670f9..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/deploy-a-cluster.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Self-Hosting Teleport
-description: "Guides to running a self-hosted Teleport cluster in production."
----
-
-These guides show you how to run a self-hosted Teleport Enterprise cluster in
-production.
-
-## Dedicated account dashboard
-
-Teleport Enterprise subscriptions include a dedicated account dashboard with their preferred
-subdomain of [teleport.sh](https://teleport.sh). The dedicated account dashboard provides
-subscription administrators access to the license file, support links and Teleport Enterprise binary downloads.
-
-## Guides to self-hosting Teleport 
-
-<DocCardList />
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deployments/gcp.mdx b/docs/pages/admin-guides/deploy-a-cluster/deployments/gcp.mdx
deleted file mode 100644
index d106107bdbd7d..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/deployments/gcp.mdx
+++ /dev/null
@@ -1,352 +0,0 @@
----
-title: Running Teleport on GCP
-description: How to install and configure Teleport on GCP
----
-
-We've created this guide to give customers an overview of how to deploy a
-self-hosted Teleport cluster on [Google Cloud](https://cloud.google.com/gcp/)
-(GCP). This guide provides a high-level introduction to setting up and running
-Teleport in production.
-
-We have split this guide into:
-
-- [GCP Teleport Introduction](#gcp-teleport-introduction)
-- [GCP Quickstart](#gcp-quickstart)
-
-(!docs/pages/includes/cloud/call-to-action.mdx!)
-
-## GCP Teleport Introduction
-
-This guide will cover how to set up, configure and run Teleport on GCP.
-
-The following GCP Services are required to run Teleport in high availability mode:
-
-- [Compute Engine: VM Instances with Instance Groups](#compute-engine-vm-instances-with-instance-groups)
-- [Compute Engine: Health Checks](#compute-engine-health-checks)
-- [Storage: Cloud Firestore](#storage-cloud-firestore)
-- [Storage: Google Cloud Storage](#storage-google-cloud-storage)
-- [Network Services: Load Balancing](#network-services-load-balancing)
-- [Network Services: Cloud DNS](#network-services-cloud-dns)
-
-Other things needed:
-
-- [SSL Certificate](https://cloud.google.com/load-balancing/docs/ssl-certificates)
-
-Optional:
-
-- Management Tools: Cloud Deployment Manager
-- Logging: Stackdriver
-
-We recommend setting up Teleport in high availability mode.
-In high availability mode Firestore is used for cluster state and audit logs,
-and Google Cloud Storage is used for session recordings.
-
-![GCP Intro Image](../../../../img/gcp/gcp-teleport.svg)
-
-Throughout this guide, we'll make use of the following placeholder variables.
-Please replace them with values appropriate for your environment.
-
-| Name     | Example     | Description |
-| -------- | ----------- | ----------- |
-| `Example_GCP_PROJECT` | teleport-project | Your GCP project ID |
-| `Example_GCP_CREDENTIALS` | /var/lib/teleport/google.json | Path to service account credentials |
-| `Example_FIRESTORE_CLUSTER_STATE` | teleport-cluster-state | Name of the Firestore collection for Teleport cluster state |
-| `Example_FIRESTORE_AUDIT_LOGS` | teleport-audit-logs | Name of the Firestore collection for Teleport audit logs |
-| `Example_BUCKET_NAME` | teleport-session-recordings | Name of the GCS bucket for session recording storage |
-
-### Compute Engine: VM Instances with Instance Groups
-
-We recommend using `n1-standard-2` instances in production. It's best to separate
-Teleport Proxy Service and Auth Service instances using instance groups for each.
-
-### Compute Engine: Health Checks
-
-GCP relies heavily on [Health Checks](https://cloud.google.com/load-balancing/docs/health-checks),
-this is helpful when adding new instances to an instance group.
-
-To enable health checks in Teleport start with `teleport start --diag-addr=0.0.0.0:3000`
-see  [Admin Guide: Troubleshooting](../../management/admin/troubleshooting.mdx) for more information.
-
-### Storage: Cloud Firestore
-
-The [Firestore](https://cloud.google.com/firestore/) backend uses real-time
-updates to keep individual Auth Service instances in sync, and requires Firestore configured
-in native mode.
-
-To configure Teleport to store audit events in Firestore, add the following to
-the teleport section of your Auth Service's config file (by default it's `/etc/teleport.yaml`):
-
-```yaml
-teleport:
-  storage:
-    type: firestore
-    collection_name: Example_FIRESTORE_CLUSTER_STATE
-    project_id: Example_GCP_PROJECT
-    credentials_path: Example_GCP_CREDENTIALS
-    audit_events_uri: [ 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS' ]
-```
-
-<Admonition type="warning" title="Table Names">
-Be careful to ensure that `Example_FIRESTORE_CLUSTER_STATE` and `Example_FIRESTORE_AUDIT_LOGS`
-refer to *different* Firestore collections. The schema is different for each, and using the same
-collection for both types of data will result in errors.
-</Admonition>
-
-### Storage: Google Cloud Storage
-
-The Google Cloud Storage backend is used for Teleport session recordings.
-Teleport will try to create the bucket on startup if it doesn't already exist.
-If you prefer, you can create the bucket ahead of time. In this case, Teleport
-does not need permissions to create buckets.
-
-When creating the Bucket, we recommend setting it up as `Dual-region` with
-the `Standard` storage class. Provide access using a `Uniform` access control
-with a Google-managed key.
-
-When setting up `audit_sessions_uri` use the `gs://` prefix.
-
-```yaml
-storage:
-    ...
-    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
-    ...
-```
-
-### Network Services: Load Balancing
-
-Load Balancing is required for Proxy and SSH traffic. Use `TCP Load Balancing` as
-Teleport requires custom ports for SSH and Web Traffic.
-
-### Network Services: Cloud DNS
-
-Cloud DNS is used to set up the public URL of the Teleport Proxy.
-
-### Access: Service accounts
-
-The Teleport Auth Service will need to read and write to Firestore and
-Google Cloud Storage. For this you will need a Service Account with the
-correct permissions.
-
-If you want Teleport to be able to create its own GCS bucket, you'll need to
-create a role allowing the `storage.buckets.create` permission. You can skip
-this step if you choose to create the bucket before installing Teleport.
-
-To create this role, start by defining the role in a YAML file:
-
-```yaml
-# teleport_auth_role.yaml
-title: teleport_auth_role
-description: 'Teleport permissions for GCP'
-stage: ALPHA
-includedPermissions:
-# Allow Teleport to create the GCS bucket for session
-# recordings if it doesn't already exist.
-- storage.buckets.create
-```
-
-Create the role using this file:
-
-```code
-$ gcloud iam roles create teleport_auth_role \
-    --project Example_GCP_PROJECT \
-    --file teleport_auth_role.yaml \
-    --format yaml
-```
-
-Note the `name` field in the output which is the fully qualified name for the
-custom role and must be used in later steps.
-
-```code
-$ export IAM_ROLE=<role name output from above>
-```
-
-If you don't already have a GCP service account for your Teleport Auth Service
-you can create one with the following command, otherwise use your existing
-service account.
-
-```code
-$ gcloud iam service-accounts create teleport-auth-server \
-    --description="Service account for Teleport Auth Service" \
-    --display-name="Teleport Auth Service" \
-    --format=yaml
-```
-
-Note the `email` field in the output, this must be used as the identifier for
-the service account.
-
-```code
-$ export SERVICE_ACCOUNT=<email output from above command>
-```
-
-Lastly, bind the required IAM roles to your newly created service account.
-
-```code
-# our custom IAM role allows Teleport to create the GCS
-# bucket for session recordings if it doesn't already exist
-$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
-    --member=serviceAccount:$SERVICE_ACCOUNT \
-    --role=$IAM_ROLE
-
-# datastore.owner grants the required Firestore access
-$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
-    --member=serviceAccount:$SERVICE_ACCOUNT \
-    --role=roles/datastore.owner
-
-# storage.objectAdmin is needed to read/write/delete storage objects
-$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
-    --member=serviceAccount:$SERVICE_ACCOUNT \
-    --role=roles/storage.objectAdmin
-```
-
-**Download JSON Service Key**
-
-The credentials for this service account should be exported in JSON format
-and provided to Teleport throughout the remainder of this guide.
-
-![GCP Service Key](../../../../img/gcp/gcp-service-key.png)
-
-## GCP Quickstart
-
-### 1. Create Resources
-
-We recommend starting by creating the resources. We highly recommend creating these
-an infrastructure automation tool such as [Cloud Deployment Manager](https://cloud.google.com/deployment-manager/) or Terraform.
-
-### 2. Install & Configure Teleport
-
-Follow install instructions from our [installation page](../../../installation.mdx).
-
-We recommend configuring Teleport as per the below steps:
-
-<Tabs>
-	<TabItem label="Teleport Community Edition" scope="oss">
-**1. Configure Teleport Auth Service** using the below example `teleport.yaml`,and start it
-using [systemd](../../management/admin/daemon.mdx). The DEB/RPM installations will
-automatically include the `systemd` configuration.
-
-```yaml
-#
-# Sample Teleport configuration teleport.yaml file for Auth Service
-#
-teleport:
-  nodename: teleport-auth-server
-  data_dir: /var/lib/teleport
-  pid_file: /run/teleport.pid
-  log:
-    output: stderr
-    severity: DEBUG
-  storage:
-    type: firestore
-    collection_name: Example_FIRESTORE_CLUSTER_STATE
-    # Credentials: Path to google service account file, used for Firestore and Google Storage.
-    credentials_path: Example_GCP_CREDENTIALS
-    project_id: Example_GCP_PROJECT
-    audit_events_uri: 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
-    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
-auth_service:
-  enabled: true
-  tokens:
-    - "proxy:(= presets.tokens.first =)"
-    - "node:(= presets.tokens.second =)"
-proxy_service:
-  enabled: false
-ssh_service:
-  enabled: false
-```
-	</TabItem>
-	<TabItem label="Enterprise" label="Enterprise" scope={["enterprise"]}>
-**1. Configure Teleport Auth Service** using the below example `teleport.yaml`, and start it
-using [systemd](../../management/admin/daemon.mdx). The DEB/RPM installations will
-automatically include the `systemd` configuration.
-
-```yaml
-#
-# Sample Teleport configuration teleport.yaml file for Auth Service
-#
-teleport:
-  nodename: teleport-auth-server
-  data_dir: /var/lib/teleport
-  pid_file: /run/teleport.pid
-  log:
-    output: stderr
-    severity: DEBUG
-  storage:
-    type: firestore
-    collection_name: Example_FIRESTORE_CLUSTER_STATE
-    # Credentials: Path to google service account file, used for Firestore and Google Storage.
-    credentials_path: Example_GCP_CREDENTIALS
-    project_id: Example_GCP_PROJECT
-    audit_events_uri: 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
-    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
-auth_service:
-  enabled: true
-  license_file: /var/lib/teleport/license.pem
-  tokens:
-    - "proxy:(= presets.tokens.first =)"
-    - "node:(= presets.tokens.second =)"
-proxy_service:
-  enabled: false
-ssh_service:
-  enabled: false
-```
-
-(!docs/pages/includes/enterprise/obtainlicense.mdx!)
-
-Save your license file on the Auth Service instances at the path,
-`/var/lib/teleport/license.pem`.
-	</TabItem>
-</Tabs>
-
-**2. Set up Proxy**
-
-Save the following configuration file as `/etc/teleport.yaml` on the Proxy Server:
-
-```yaml
-# enable multiplexing all traffic on TCP port 443
-version: v3
-teleport:
-  auth_token: (= presets.tokens.first =)
-  # We recommend using a TCP load balancer pointed to the auth servers when
-  # setting up in High Availability mode.
-  auth_server: auth.example.com:3025
-# enable proxy service, disable auth and ssh
-ssh_service:
-  enabled: false
-auth_service:
-  enabled: false
-proxy_service:
-  enabled: true
-  web_listen_addr: 0.0.0.0:443
-  public_addr: teleport.example.com:443
-  # automatically get an ACME certificate for teleport.example.com (works for a single proxy)
-  acme:
-    enabled: true
-    email: example@email.com
-```
-
-**3. Set up Teleport Nodes**
-
-Save the following configuration file as `/etc/teleport.yaml` on the Node:
-
-```yaml
-version: v3
-teleport:
-  auth_token: (= presets.tokens.second =)
-  # Teleport Agents can be joined to the cluster via the Proxy Service's
-  # public address. This will establish a reverse tunnel between the Proxy
-  # Service and the agent that is used for all traffic.
-  proxy_server: teleport.example.com:443
-# enable the SSH Service and disable the Auth and Proxy Services
-ssh_service:
-  enabled: true
-auth_service:
-  enabled: false
-proxy_service:
-  enabled: false
-```
-
-**4. Add Users**
-
-Follow our [Local Users](../../management/admin/users.mdx) guide or integrate
-with [Google Workspace](../../access-controls/sso/google-workspace.mdx) to
-provide SSO access.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/aws.mdx b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/aws.mdx
deleted file mode 100644
index fe05757a6d763..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/aws.mdx
+++ /dev/null
@@ -1,681 +0,0 @@
----
-title: Running an HA Teleport cluster using AWS, EKS, and Helm
-description: Install and configure an HA Teleport cluster using an AWS EKS cluster
----
-
-In this guide, we'll use Teleport Helm charts to set up a high-availability Teleport cluster that runs on AWS EKS.
-
-<Admonition type="tip" title="Have an existing Teleport cluster?">
-If you are already running Teleport on another platform, you can use your
-existing Teleport deployment to access your Kubernetes cluster. [Follow our
-guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
-cluster to Teleport.
-</Admonition>
-
-(!docs/pages/includes/cloud/call-to-action.mdx!)
-
-## Prerequisites
-
-(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
-
-### Choose a Kubernetes namespace and Helm release name
-
-<Admonition type="note">
-  Before starting, setting your Kubernetes namespace and Helm release name here will
-  enable easier copy/pasting of commands for installation.
-
-  If you don't know what to put here, use `teleport` for both values.
-
-  Namespace: <Var name="namespace" description="Kubernetes namespace" />
-
-  Release name: <Var name="release-name" description="Helm release name" />
-</Admonition>
-
-## Step 1/7. Install Helm
-
-(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-install.mdx!)
-
-## Step 2/7. Add the Teleport Helm chart repository
-
-(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-## Step 3/7. Set up AWS IAM configuration
-
-For Teleport to be able to manage the DynamoDB tables, indexes, and the S3
-storage bucket it needs, you'll need to configure AWS IAM policies to allow
-access.
-
-<Admonition type="note">
-  Add these IAM policies to your AWS account and then grant it to the role associated with your EKS node group(s).
-</Admonition>
-
-### DynamoDB IAM policy
-
-(!docs/pages/includes/dynamodb-iam-policy.mdx!)
-
-### S3 IAM policy
-
-(!docs/pages/includes/s3-iam-policy.mdx!)
-
-## Step 4/7. Configure TLS certificates for Teleport
-
-We now need to configure TLS certificates for Teleport to secure its
-communications and allow external clients to connect.
-
-Depending on the approach you use for provisioning TLS certificates, the `teleport-cluster` chart can
-deploy either a Kubernetes `LoadBalancer` or Kubernetes `Ingress` to handle incoming connections to
-the Teleport Proxy Service.
-
-### Determining an approach
-
-There are three supported options when using AWS. You must choose only one of
-these options:
-
-| Approach | AWS Load Balancer Type | Kubernetes Traffic Destination | Can use an existing AWS LB? | Caveats |
-| - | - | - | - | - |
-| [Using `cert-manager`](#using-cert-manager) | Network Load Balancer (NLB) | `LoadBalancer` | No | Requires a Route 53 domain and an `Issuer` configured with IAM permissions to change DNS records for your domain |
-| [Using AWS Certificate Manager](#using-aws-certificate-manager) | Application Load Balancer (ALB) | `Ingress` | Yes | Requires a working instance of the AWS Load Balancer controller installed in your Kubernetes cluster |
-| [Using your own TLS credentials](#using-your-own-tls-credentials) | Network Load Balancer (NLB) | `LoadBalancer` | No | Requires you to independently manage the maintenance, renewal and trust of the TLS certificates securing Teleport's web listener |
-
-#### Using `cert-manager`
-
-You can use `cert-manager` to provision and automatically renew TLS credentials
-by completing ACME challenges via Let's Encrypt.
-
-You can also use `cert-manager` with AWS Private Certificate Authority (PCA) in EKS using the
-`aws-privateca-issuer` plugin.
-
-This method uses a Kubernetes `LoadBalancer`, which will provision an underlying AWS Network Load
-Balancer (NLB) to handle incoming traffic.
-
-#### Using AWS Certificate Manager
-
-You can use AWS Certificate Manager to handle TLS termination with AWS-managed certificates.
-
-This method uses a Kubernetes `Ingress`, which can provision an underlying AWS Application Load
-Balancer (ALB) to handle incoming traffic if one does not already exist. It also requires the
-installation and setup of the AWS Load Balancer controller.
-
-You should be aware of these potential limitations and differences when using Layer 7 load balancers with Teleport:
-
-- Connecting to Kubernetes clusters at the command line requires the use of the `tsh proxy kube` or
-  `tsh kubectl` commands and `tsh proxy db`/`tsh db connect` commands respectively. It is not
-  possible to connect `kubectl` directly to Teleport listeners without the use of `tsh` as a proxy client
-  in this mode.
-- Connecting to databases at the command line requires the use of the `tsh proxy db` or `tsh db connect`
-  commands. It is not possible to connect database clients directly to Teleport listeners without the use of `tsh`
-  as a proxy client in this mode.
-- The reason for both of these requirements is that Teleport uses X509 certificates for authentication, which requires
-  that it terminate all inbound TLS traffic itself on the Teleport proxy. This is not directly possible when using
-  a Layer 7 load balancer, so the `tsh` client implements this flow itself
-  [using ALPN connection upgrades](../../../reference/architecture/tls-routing.mdx).
-
-<Admonition type="warning">
-  Using ACM with an ALB also requires that your cluster has a fully functional installation of the AWS Load Balancer
-  controller with required IAM permissions. This guide provides more details below.
-</Admonition>
-
-#### Using your own TLS credentials
-
-With this approach, you are responsible for determining how to obtain a TLS
-certificate and private key for your Teleport cluster, and for renewing your
-credentials periodically. Use this approach if you would like to use a trusted
-internal certificate authority instead of Let's Encrypt or AWS Certificate
-Manager. This method uses a Kubernetes `LoadBalancer` and will provision an
-underlying AWS NLB.
-
-### Steps to follow
-
-Once you have chosen an approach based on the details above, select the correct tab below for instructions.
-
-<Tabs>
-<TabItem label="cert-manager">
-
-In this example, we are using multiple pods to create a High Availability
-Teleport cluster. As such, we will be using `cert-manager` to centrally
-provision TLS certificates using Let's Encrypt. These certificates will be
-mounted into each Teleport pod, and automatically renewed and kept up to date by
-`cert-manager`.
-
-If you are planning to use `cert-manager`, you will need to add one IAM policy to your cluster to enable it
-to update Route53 records.
-
-### Route53 IAM policy
-
-This policy allows `cert-manager` to use DNS01 Let's Encrypt challenges to provision TLS certificates for your Teleport cluster.
-
-You'll need to replace these values in the policy example below:
-
-| Placeholder value | Replace with |
-| - | - |
-| <Var name="Z0159221358P96JYAUAA4" /> | Route 53 hosted zone ID for the domain hosting your Teleport cluster |
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": "route53:GetChange",
-            "Resource": "arn:aws:route53:::change/*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": [
-                "route53:ChangeResourceRecordSets",
-                "route53:ListResourceRecordSets"
-            ],
-            "Resource": "arn:aws:route53:::hostedzone/<Var name="Z0159221358P96JYAUAA4" />"
-        }
-    ]
-}
-```
-
-### Installing cert-manager
-
-If you do not have `cert-manager` already configured in the Kubernetes cluster where you are installing Teleport,
-you should add the Jetstack Helm chart repository which hosts the `cert-manager` chart, and install the chart:
-
-```code
-$ helm repo add jetstack https://charts.jetstack.io
-$ helm repo update
-$ helm install cert-manager jetstack/cert-manager \
---create-namespace \
---namespace cert-manager \
---set installCRDs=true \
---set global.leaderElection.namespace=cert-manager \
---set extraArgs="{--issuer-ambient-credentials}" # required to automount ambient AWS credentials when using an Issuer
-```
-
-Once `cert-manager` is installed, you should create and add an `Issuer`.
-
-You'll need to replace these values in the `Issuer` example below:
-
-| Placeholder value | Replace with |
-| - | - |
-| <Var name="email@address.com" description="Email for Let's Encrypt" /> | An email address to receive communications from Let's Encrypt |
-| <Var name="example.com" description="Route 53 Hosted Zone" /> | The name of the Route 53 domain hosting your Teleport cluster |
-| <Var name="us-west-2" description="AWS Region"/> | AWS region where the cluster is running |
-| <Var name="Z0159221358P96JYAUAA4" description="Route 53 hosted zone id"/> | Route 53 hosted zone ID for the domain hosting your Teleport cluster |
-
-```yaml
-cat << EOF > aws-issuer.yaml
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: letsencrypt-production
-  namespace: teleport
-spec:
-  acme:
-    email: <Var name="email@address.com" />
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-production
-    solvers:
-    - selector:
-        dnsZones:
-          - "<Var name="example.com" />"
-      dns01:
-        route53:
-          region: <Var name="us-west-2" />
-          hostedZoneID: <Var name="Z0159221358P96JYAUAA4" />
-EOF
-```
-
-After you have created the `Issuer` and updated the values, add it to your cluster using `kubectl`:
-
-```code
-$ kubectl create namespace <Var name="namespace" />
-$ kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
-$ kubectl --namespace <Var name="namespace" /> create -f aws-issuer.yaml
-```
-
-</TabItem>
-<TabItem label="AWS Certificate Manager">
-In this step, you will configure Teleport to use AWS Certificate Manager (ACM)
-to provision your Teleport instances with TLS credentials.
-
-<Admonition type="warning" title="Prerequisite: Install and configure the AWS Load Balancer controller">
-  You must either follow the [AWS-maintained documentation on installing the AWS Load Balancer Controller](https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html)
-  or already have a working installation of the AWS LB controller before continuing with these instructions. Failure to do this will result in an unusable Teleport cluster.
-
-  Assuming you follow the AWS guide linked above, you can check whether the AWS LB controller is running in your cluster by looking
-  for pods with the `app.kubernetes.io/name=aws-load-balancer-controller` label:
-
-  ```code
-  $ kubectl get pods -A -l app.kubernetes.io/name=aws-load-balancer-controller
-  NAMESPACE     NAME                                            READY   STATUS    RESTARTS   AGE
-  kube-system   aws-load-balancer-controller-655f647b95-5vz56   1/1     Running   0          109d
-  kube-system   aws-load-balancer-controller-655f647b95-b4brx   1/1     Running   0          109d
-  ```
-
-  You can also check whether `alb` is registered as an `IngressClass` in your cluster:
-
-  ```code
-  $ kubectl get ingressclass
-  NAME    CONTROLLER             PARAMETERS   AGE
-  alb     ingress.k8s.aws/alb    <none>       109d
-  ```
-</Admonition>
-
-To use ACM to handle TLS, we will add annotations to the chart values in the section below specifying
-the ACM certificate ARN to use, the port it should be served on and other ALB configuration
-parameters.
-
-Replace <Var name="arn:aws:acm:us-west-2:1234567890:certificate/12345678-43c7-4dd1-a2f6-c495b91ebece"/>
-with your actual ACM certificate ARN.
-
-</TabItem>
-<TabItem label="Your own TLS credentials">
-
-You can configure the `teleport-cluster` Helm chart to secure the Teleport Web
-UI using existing TLS credentials within a Kubernetes secret.
-
-Use the following command to create your secret:
-
-```code
-$ kubectl -n <Var name="namespace" /> create secret tls my-tls-secret --cert=/path/to/cert/file --key=/path/to/key/file
-```
-
-Edit your `aws-values.yaml` file (created below) to refer to the name of your secret:
-
-```yaml
-  tls:
-    existingSecretName: my-tls-secret
-```
-
-</TabItem>
-</Tabs>
-
-## Step 5/7. Set values to configure the cluster
-
-If you run Teleport Enterprise, you will need to create a secret that contains
-your Teleport license information before you can install Teleport in your
-Kubernetes cluster. 
-
-(!docs/pages/includes//enterprise/obtainlicense.mdx!)
-
-Create a secret from your license file. Teleport will automatically discover
-this secret as long as your file is named `license.pem`.
-
-```code
-$ kubectl -n <Var name="namespace" /> create secret generic license --from-file=license.pem
-```
-
-Next, configure the `teleport-cluster` Helm chart to use the `aws` mode. Create
-a file called `aws-values.yaml` and write the values you've chosen above to it:
-
-<Tabs>
-<TabItem label="cert-manager">
-```yaml
-chartMode: aws
-clusterName: <Var name="teleport.example.com" />                 # Name of your cluster. Use the FQDN you intend to configure in DNS below.
-proxyListenerMode: multiplex
-aws:
-  region: <Var name="us-west-2" />                # AWS region
-  backendTable: <Var name="teleport-helm-backend" /> # DynamoDB table to use for the Teleport backend
-  auditLogTable: <Var name="teleport-helm-events" />             # DynamoDB table to use for the Teleport audit log (must be different to the backend table)
-  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  sessionRecordingBucket: <Var name="your-sessions-bucket" />  # S3 bucket to use for Teleport session recordings
-  backups: true                                   # Whether or not to turn on DynamoDB backups
-  dynamoAutoScaling: false                        # Whether Teleport should configure DynamoDB's autoscaling.
-highAvailability:
-  replicaCount: 2                                 # Number of replicas to configure
-  certManager:
-    enabled: true                                 # Enable cert-manager support to get TLS certificates
-    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
-# Indicate that this is a Teleport Enterprise deployment. Set to false for
-# Teleport Community Edition.
-enterprise: true                                  
-# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
-podSecurityPolicy:
-  enabled: false
-```
-<Admonition type="note">
-If using an AWS PCA with cert-manager, you will need to
-[ensure you set](../../../reference/helm-reference/teleport-cluster.mdx)
-`highAvailability.certManager.addCommonName: true` in your values file.  You will also need to get the certificate authority
-certificate for the CA (`aws acm-pca get-certificate-authority-certificate --certificate-authority-arn <arn>`),
-upload the full certificate chain to a secret, and
-[reference the secret](../../../reference/helm-reference/teleport-cluster.mdx)
-with `tls.existingCASecretName` in the values file.
-</Admonition>
-</TabItem>
-<TabItem label="AWS Certificate Manager">
-```yaml
-chartMode: aws
-clusterName: <Var name="teleport.example.com" />                 # Name of your cluster. Use the FQDN you intend to configure in DNS below.
-proxyListenerMode: multiplex
-service:
-  type: ClusterIP
-aws:
-  region: <Var name="us-west-2" />                # AWS region
-  backendTable: <Var name="teleport-helm-backend" /> # DynamoDB table to use for the Teleport backend
-  auditLogTable: <Var name="teleport-helm-events" />             # DynamoDB table to use for the Teleport audit log (must be different to the backend table)
-  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  sessionRecordingBucket: <Var name="your-sessions-bucket" />  # S3 bucket to use for Teleport session recordings
-  backups: true                                   # Whether or not to turn on DynamoDB backups
-  dynamoAutoScaling: false                        # Whether Teleport should configure DynamoDB's autoscaling.
-highAvailability:
-  replicaCount: 2                                 # Number of replicas to configure
-# Indicate that this is a Teleport Enterprise deployment. Set to false for
-# Teleport Community Edition.
-enterprise: true                                  
-ingress:
-  enabled: true
-  spec:
-    ingressClassName: alb
-annotations:
-  ingress:
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/backend-protocol: HTTPS
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=350
-    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
-    alb.ingress.kubernetes.io/success-codes: 200,301,302
-    # Replace with your AWS certificate ARN
-    alb.ingress.kubernetes.io/certificate-arn: "<Var name="arn:aws:acm:us-west-2:1234567890:certificate/12345678-43c7-4dd1-a2f6-c495b91ebece"/>"
-# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
-podSecurityPolicy:
-  enabled: false
-```
-
-To use an internal AWS Application Load Balancer (as opposed to an internet-facing ALB), you should
-edit the `alb.ingress.kubernetes.io/scheme` annotation:
-
-  ```yaml
-    alb.ingress.kubernetes.io/scheme: internal
-  ```
-
-To automatically redirect HTTP requests on port 80 to HTTPS requests on port 443, you
-can also optionally provide these two values under `annotations.ingress`:
-
-  ```yaml
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: '443'
-  ```
-
-</TabItem>
-</Tabs>
-
-Install the chart with the values from your `aws-values.yaml` file using this command:
-
-```code
-$ helm install <Var name="release-name" /> teleport/teleport-cluster \
-  --create-namespace \
-  --namespace <Var name="namespace" /> \
-  -f aws-values.yaml
-```
-
-<Admonition type="note">
-  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. You should use the fully-qualified domain name that you'll use for external access to your Teleport cluster.
-</Admonition>
-
-Once the chart is installed, you can use `kubectl` commands to view the deployment (example using `cert-manager`):
-
-```code
-$ kubectl --namespace <Var name="namespace" /> get all
-
-NAME                                 READY   STATUS    RESTARTS   AGE
-pod/teleport-auth-57989d4cbd-4q2ds   1/1     Running   0          22h
-pod/teleport-auth-57989d4cbd-rtrzn   1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
-
-NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP                         PORT(S)                                                                     AGE
-service/teleport            LoadBalancer   10.40.11.180   xxxxx.elb.us-east-1.amazonaws.com   443:30258/TCP                                                               22h
-service/teleport-auth       ClusterIP      10.40.8.251    <none>                              3025/TCP,3026/TCP                                                           22h
-service/teleport-auth-v11   ClusterIP      None           <none>                              <none>                                                                      22h
-service/teleport-auth-v12   ClusterIP      None           <none>                              <none>                                                                      22h
-
-NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
-deployment.apps/teleport-auth    2/2     2            2           22h
-deployment.apps/teleport-proxy   2/2     2            2           22h
-
-NAME                                       DESIRED   CURRENT   READY   AGE
-replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
-replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
-```
-
-## Step 6/7. Set up DNS
-
-You'll need to set up a DNS `A` record for `teleport.example.com`. In our example, this record is an alias to an ELB.
-
-<details>
-<summary>Enrolling applications with Teleport?</summary>
-
-(!docs/pages/includes/dns-app-access.mdx!)
-
-</details>
-
-Here's how to do this in a hosted zone with Amazon Route 53:
-
-<Tabs>
-<TabItem label="cert-manager">
-
-```code
-# Change these parameters if you altered them above
-$ NAMESPACE='<Var name="namespace" />'
-$ RELEASE_NAME='<Var name="release-name" />'
-
-# DNS settings (change as necessary)
-$ MYZONE_DNS='<Var name="example.com"/>'
-$ MYDNS='<Var name="teleport.example.com"/>'
-$ MY_CLUSTER_REGION='<Var name="us-west-2"/>'
-
-# Find AWS Zone ID and ELB Zone ID
-$ MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
-$ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "service/${RELEASE_NAME?}-proxy" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
-$ MYELB_NAME="${MYELB%%-*}"
-$ MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
-
-# Create a JSON file changeset for AWS.
-$ jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" \
-    '{
-        "Comment": "Create records",
-        "Changes": [
-          {
-            "Action": "CREATE",
-            "ResourceRecordSet": {
-              "Name": $dns,
-              "Type": "A",
-              "AliasTarget": {
-                "HostedZoneId": $elbz,
-                "DNSName": ("dualstack." + $elb),
-                "EvaluateTargetHealth": false
-              }
-            }
-          },
-          {
-            "Action": "CREATE",
-            "ResourceRecordSet": {
-              "Name": ("*." + $dns),
-              "Type": "A",
-              "AliasTarget": {
-                "HostedZoneId": $elbz,
-                "DNSName": ("dualstack." + $elb),
-                "EvaluateTargetHealth": false
-              }
-            }
-          }
-      ]
-    }' > myrecords.json
-
-# Review records before applying.
-$ cat myrecords.json | jq
-# Apply the records and capture change id
-$ CHANGEID="$(aws route53 change-resource-record-sets --hosted-zone-id "${MYZONE?}" --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')"
-
-# Verify that change has been applied
-$ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
-# "INSYNC"
-```
-
-</TabItem>
-<TabItem label="AWS Certificate Manager">
-
-```code
-# Change these parameters if you altered them above
-$ NAMESPACE='<Var name="namespace" />'
-$ RELEASE_NAME='<Var name="release-name" />'
-
-# DNS settings (change as necessary)
-$ MYZONE_DNS='<Var name="example.com"/>'
-$ MYDNS='<Var name="teleport.example.com"/>'
-$ MY_CLUSTER_REGION='<Var name="us-west-2"/>'
-
-# Find AWS Zone ID and Ingress Controller ALB Zone ID
-$ MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
-$ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "ingress/${RELEASE_NAME?}-proxy" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
-$ MYELB_ROOT="${MYELB%%.*}"
-$ MYELB_NAME="${MYELB_ROOT%-*}"
-$ MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
-
-# Create a JSON file changeset for AWS.
-$ jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" \
-    '{
-        "Comment": "Create records",
-        "Changes": [
-          {
-            "Action": "CREATE",
-            "ResourceRecordSet": {
-              "Name": $dns,
-              "Type": "A",
-              "AliasTarget": {
-                "HostedZoneId": $elbz,
-                "DNSName": ("dualstack." + $elb),
-                "EvaluateTargetHealth": false
-              }
-            }
-          },
-          {
-            "Action": "CREATE",
-            "ResourceRecordSet": {
-              "Name": ("*." + $dns),
-              "Type": "A",
-              "AliasTarget": {
-                "HostedZoneId": $elbz,
-                "DNSName": ("dualstack." + $elb),
-                "EvaluateTargetHealth": false
-              }
-            }
-          }
-      ]
-    }' > myrecords.json
-
-# Review records before applying.
-$ cat myrecords.json | jq
-# Apply the records and capture change id
-$ CHANGEID="$(aws route53 change-resource-record-sets --hosted-zone-id "${MYZONE?}" --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')"
-
-# Verify that change has been applied
-$ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
-# "INSYNC"
-```
-
-</TabItem>
-</Tabs>
-
-## Step 7/7. Create a Teleport user
-
-Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
-so we can run the command using `kubectl`:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-```code
-$ kubectl --namespace <Var name="namespace" /> exec deploy/<Var name="release-name" />-auth -- tctl users add test --roles=access,editor
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-```code
-$ kubectl --namespace <Var name="namespace" /> exec deploy/<Var name="release-name" />-auth -- tctl users add test --roles=access,editor,reviewer
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-</TabItem>
-</Tabs>
-
-Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
-
-### High Availability
-
-In this guide, we have configured two replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
-value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
-
-### Upgrading the cluster after deployment
-
-To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
-
-Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
-version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
-
-Here's an example where we set the chart to use 2 replicas:
-
-Edit your `aws-values.yaml` file from above and make the appropriate changes:
-
-```yaml
-highAvailability:
-  replicaCount: 2
-```
-
-Upgrade the deployment with the values from your `aws-values.yaml` file using this command:
-
-```code
-$ helm upgrade <Var name="release-name" /> teleport/teleport-cluster \
-  --namespace <Var name="namespace" /> \
-  -f aws-values.yaml
-```
-
-<Admonition type="note">
-  To change `chartMode`, `clusterName`, or any `aws` settings, you must first uninstall the existing chart and then install a new version with the appropriate values.
-</Admonition>
-
-Then perform a cluster upgrade with the new values:
-
-```code
-$ helm upgrade <Var name="release-name" /> teleport/teleport-cluster \
-  --namespace <Var name="namespace" /> \
-  -f aws-values.yaml
-```
-
-## Uninstalling Teleport
-
-To uninstall the `teleport-cluster` chart, use `helm uninstall <release-name>`. For example:
-
-```code
-$ helm --namespace <Var name="namespace" /> uninstall <Var name="release-name" />
-```
-
-### Uninstalling cert-manager
-
-If you want to remove the `cert-manager` installation later, you can use this command:
-
-```code
-$ helm --namespace cert-manager uninstall cert-manager
-```
-
-## Troubleshooting
-
-### AWS quotas
-
-(!docs/pages/includes/aws-quotas.mdx!)
-
-## Next steps
-
-Now that you have deployed a Teleport cluster, read the [Manage
-Access](../../access-controls/access-controls.mdx) section to get started enrolling
-users and setting up RBAC.
-
-See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
-
-Read the [`cert-manager` documentation](https://cert-manager.io/docs/).
-
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/azure.mdx b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/azure.mdx
deleted file mode 100644
index 7cb1e1721f90e..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/azure.mdx
+++ /dev/null
@@ -1,355 +0,0 @@
----
-title: Running an HA Teleport cluster using Microsoft Azure, AKS, and Helm
-description: Install and configure an HA Teleport cluster using a Microsoft Azure AKS cluster.
----
-
-In this guide, we'll go through how to set up a High Availability Teleport
-cluster with multiple replicas in Kubernetes using Teleport Helm charts and
-Microsoft Azure managed services (Kubernetes Services, Database for PostgreSQL,
-Blob Storage).
-
-<Admonition type="tip" title="Have an existing Teleport cluster?">
-If you are already running Teleport on another platform, you can use your
-existing Teleport deployment to access your Kubernetes cluster. [Follow our
-guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
-cluster to Teleport.
-</Admonition>
-
-(!docs/pages/includes/cloud/call-to-action.mdx!)
-
-## Prerequisites
-
-(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
-
-In addition, you will need `azure-cli` 2.51 or later to follow along these
-instructions. Reference the Azure docs on [how to install the Azure
-CLI](https://learn.microsoft.com/cli/azure/install-azure-cli).
-
-After installing it, make sure you are logged in by typing `az login`. This
-guide assumes that your user has permissions to create Azure Database for
-PostgreSQL instances, Azure Blob Storage accounts, and Managed Identities, and
-has the ability to add role assignments for those. You will also need an Azure
-DNS zone, and access to an AKS cluster with cert-manager
-[installed](https://cert-manager.io/docs/installation/) and configured to [issue
-certificates for said Azure DNS
-zone](https://cert-manager.io/docs/configuration/acme/dns01/azuredns/).
-
-In this guide we'll use [workload
-identity](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
-to authenticate Teleport to PostgreSQL and Blob Storage, so you'll need to
-[enable workload identity and the OIDC issuer in your AKS
-cluster](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#update-an-existing-aks-cluster)
-if they're not enabled already:
-
-```code
-$ az aks update --resource-group <Var name="aks-rg" /> --name <Var name="aks-name" /> --enable-oidc-issuer --enable-workload-identity
-```
-
-## Step 1/5. Add the Teleport Helm chart repository
-
-(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-## Step 2/5. Set up PostgreSQL and Blob Storage
-
-For convenience, we'll create all the resources necessary in a brand new
-resource group; if you want to use an existing one, you can skip this step.
-Assign <Var name="region" /> to your Azure region:
-
-```code
-$ az group create --name <Var name="teleport-rg" /> --location <Var name="region" />
-```
-
-We're going to need a Managed Identity for Teleport to use these services.
-
-```code
-$ az identity create --resource-group <Var name="teleport-rg" /> --name teleport-id
-```
-
-The recommended HA deployment of Teleport on Azure stores the cluster state and
-the audit log entries in a PostgreSQL instance. In this guide we'll create a
-publicly accessible one, but you can restrict it to your AKS cluster's IP
-address, or you can create it attached to the same virtual network that the
-cluster is using, instead.
-
-Depending on your region, you might be able to use `ZoneRedundant` high
-availability, or you might have to use `SameZone` high availability.
-
-```code
-$ az postgres flexible-server create --resource-group <Var name="teleport-rg" /> --name <Var name="teleport-pg" /> \
-    --active-directory-auth Enabled --password-auth Disabled \
-    --version 15 --high-availability SameZone --public-access All
-$ az postgres flexible-server parameter set --resource-group <Var name="teleport-rg" /> --name <Var name="teleport-pg" /> \
-    --name wal_level --value logical
-$ az postgres flexible-server restart --resource-group <Var name="teleport-rg" /> --name <Var name="teleport-pg" />
-$ az postgres flexible-server ad-admin create --resource-group <Var name="teleport-rg" /> --server-name <Var name="teleport-pg" /> \
-    --display-name <Var name="pguser" /> --type ServicePrincipal \
-    --object-id "$(az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query principalId -o tsv)"
-```
-
-Teleport will store session recordings in a Blob Storage account. Optionally,
-access can be restricted to just the AKS outbound address, or the account can be
-made part of the virtual network that the AKS cluster is using.
-
-```code
-$ az storage account create --resource-group <Var name="teleport-rg" /> --name "teleport-blob" \
-    --allow-blob-public-access false
-$ az role assignment create --role "Storage Blob Data Owner" --assignee-principal-type ServicePrincipal \
-    --assignee-object-id "$(az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query principalId -o tsv)" \
-    --scope "$(az storage account show --resource-group <Var name="teleport-rg" /> --name <Var name="teleportblob" /> --query id -o tsv)""
-```
-
-We'll use Workload Identity to authenticate to those services, so we'll add
-federated credentials for the Teleport service account used by the Auth Service.
-
-```code
-$ az identity federated-credential create --resource-group <Var name="teleport-rg" /> --identity-name teleport-id \
-    --name aks --audience api://AzureADTokenExchange \
-    --subject system:serviceaccount:<Var name="teleport-ns" />:<Var name="teleport-release" /> \
-    --issuer "$(az aks show --resource-group <Var name="aks-rg" /> --name <Var name="aks-name" /> --query oidcIssuerProfile.issuerUrl -o tsv)"
-```
-
-## Step 3/5. Set values to configure the cluster
-
-<details>
-<summary>License Secret</summary>
-
-Before you can install Teleport Enterprise in your Kubernetes cluster, you will need to
-create a secret that contains your Teleport license information.
-
-(!docs/pages/includes/enterprise/obtainlicense.mdx!)
-
-Create a secret from your license file. Teleport will automatically discover
-this secret as long as your file is named `license.pem`.
-
-```code
-$ kubectl create namespace <Var name="teleport-ns" />
-$ kubectl -n <Var name="teleport-ns" /> create secret generic license --from-file=license.pem
-```
-
-</details>
-
-Now we'll configure the `teleport-cluster` Helm chart to use the `azure` mode.
-
-First get the client ID for the `teleport-id` identity:
-```code
-$ az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query clientId -o tsv
-<Var name="teleport-client-id-uuid-123456789012" />
-```
-
-Then create a file called `azure-values.yaml` containing the values you've selected above:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-```yaml
-chartMode: azure
-# Name of your cluster. Use the FQDN you intend to configure in DNS later
-clusterName: teleport.example.com
-azure:
-  databaseHost: "<Var name="teleport-pg" />.postgres.database.azure.com"
-  databaseUser: "<Var name="pguser" />"
-  sessionRecordingStorageAccount: "<Var name="teleportblob" />.blob.core.windows.net"
-  # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  auditLogMirrorOnStdout: false
-  clientID: "<Var name="teleport-client-id-uuid-123456789012" />"
-highAvailability:
-  # Number of replicas to configure
-  replicaCount: 2
-  certManager:
-    # Enable cert-manager support to get TLS certificates
-    enabled: true
-    # Name of the cert-manager GlobalIssuer or Issuer to use
-    issuerName: letsencrypt-production
-    issuerKind: ClusterIssuer
-# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
-podSecurityPolicy:
-  enabled: false
-```
-
-</TabItem>
-<TabItem scope={["enterprise"]} label="Enterprise">
-
-```yaml
-chartMode: azure
-# Name of your cluster. Use the FQDN you intend to configure in DNS later
-clusterName: teleport.example.com
-azure:
-  databaseHost: "<Var name="teleport-pg" />.postgres.database.azure.com"
-  databaseUser: "<Var name="pguser" />"
-  sessionRecordingStorageAccount: "<Var name="teleportblob" />.blob.core.windows.net"
-  # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  auditLogMirrorOnStdout: false
-  clientID: "<Var name="teleport-client-id-uuid-123456789012" />"
-highAvailability:
-  # Number of replicas to configure
-  replicaCount: 2
-  certManager:
-    # Enable cert-manager support to get TLS certificates
-    enabled: true
-    # Name of the cert-manager GlobalIssuer or Issuer to use
-    issuerName: letsencrypt-production
-    issuerKind: ClusterIssuer
-# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
-podSecurityPolicy:
-  enabled: false
-# Indicate that this is a Teleport Enterprise deployment
-enterprise: true
-```
-
-</TabItem>
-</Tabs>
-
-Install the chart with the values from your `azure-values.yaml` file using this command:
-
-```code
-$ helm install <Var name="teleport-release" /> teleport/teleport-cluster \
-    --create-namespace --namespace <Var name="teleport-ns" /> \
-    --values azure-values.yaml
-```
-
-<Admonition type="note">
-  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. We recommend using the fully-qualified domain name that you'll use for external access to your Teleport cluster.
-</Admonition>
-
-Once the chart is installed, you can use `kubectl` commands to view the deployment:
-
-```code
-$ kubectl --namespace <Var name="teleport-ns" /> get all
-
-NAME                                 READY   STATUS    RESTARTS   AGE
-pod/teleport-auth-57989d4cb-4q2ds    1/1     Running   0          22h
-pod/teleport-auth-57989d4cb-rtrzn    1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
-
-NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                                                                     AGE
-service/teleport            LoadBalancer   10.40.11.180   34.138.177.11   443:30258/TCP,3023:31802/TCP,3026:32182/TCP,3024:30101/TCP,3036:30302/TCP   22h
-service/teleport-auth       ClusterIP      10.40.8.251    <none>          3025/TCP,3026/TCP                                                           22h
-service/teleport-auth-v13   ClusterIP      None           <none>          <none>                                                                      22h
-service/teleport-auth-v14   ClusterIP      None           <none>          <none>                                                                      22h
-
-NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
-deployment.apps/teleport-auth    2/2     2            2           22h
-deployment.apps/teleport-proxy   2/2     2            2           22h
-
-NAME                                       DESIRED   CURRENT   READY   AGE
-replicaset.apps/teleport-auth-57989d4cb    2         2         2       22h
-replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
-```
-
-## Step 4/5. Set up DNS
-
-We'll now set up DNS `A` records for `teleport.example.com` and
-`*.teleport.example.com`, using your Azure DNS zone rooted at `example.com`. If
-you're using a different DNS hosting service, follow their instructions instead.
-
-```code
-$ PREFIX=teleport
-$ ZONE=example.com
-$ ZONE_RG=dns-rg
-$ external_ip="$(kubectl --namespace <Var name="teleport-ns" /> get service/<Var name="teleport-release" /> -o jsonpath='{.status.loadBalancer.ingress[*].ip}')"
-$ az network dns record-set a add-record --resource-group ${ZONE_RG} --zone-name ${ZONE} --record-set-name ${PREFIX} --ipv4-address "${external_ip}"
-$ az network dns record-set a add-record --resource-group ${ZONE_RG} --zone-name ${ZONE} --record-set-name "*.${PREFIX}" --ipv4-address "${external_ip}"
-```
-
-## Step 5/5. Create a Teleport user
-
-Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
-so we can run the command using `kubectl`:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-```code
-$ kubectl --namespace <Var name="teleport-ns" /> exec deploy/<Var name="teleport-release" />-auth -- tctl users add test --roles=access,editor
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-
-</TabItem>
-<TabItem scope={["enterprise"]} label="Enterprise">
-
-```code
-$ kubectl --namespace <Var name="teleport-ns" /> exec deploy/<Var name="teleport-release" />-auth -- tctl users add test --roles=access,editor,reviewer
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-
-</TabItem>
-</Tabs>
-
-Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
-
-### High Availability
-
-In this guide, we have configured 2 replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
-value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
-
-## Upgrading the cluster after deployment
-
-To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
-
-Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
-version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
-
-If you want to use a different version of Teleport, pass the `--version` argument to Helm:
-
-```code
-$ helm upgrade --version 14.0.0 \
-  <Var name="teleport-release" /> teleport/teleport-cluster \
-  --namespace <Var name="teleport-ns" /> \
-  -f azure-values.yaml
-```
-
-Here's an example where we set the chart to use 3 replicas:
-
-<Tabs>
-  <TabItem label="Using values.yaml">
-  Edit your `azure-values.yaml` file from above and make the appropriate changes.
-
-  Upgrade the deployment with the values from your `azure-values.yaml` file using this command:
-
-  ```code
-  $ helm upgrade <Var name="teleport-release" /> teleport/teleport-cluster \
-    --namespace <Var name="teleport-ns" /> \
-    -f azure-values.yaml
-  ```
-
-  </TabItem>
-  <TabItem label="Using --set via CLI">
-  Run this command, editing your command line parameters as appropriate:
-
-  ```code
-  $ helm upgrade <Var name="teleport-release" /> teleport/teleport-cluster \
-    --namespace <Var name="teleport-ns" /> \
-    --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-<Admonition type="note">
-  To change `chartMode`, `clusterName` or any `azure` settings, you must first uninstall the existing chart and then install
-  a new version with the appropriate values.
-</Admonition>
-
-## Uninstalling Teleport
-
-To uninstall the `teleport-cluster` chart, use `helm uninstall`. For example:
-
-```code
-$ helm --namespace <Var name="teleport-ns" /> uninstall <Var name="teleport-release" />
-```
-
-## Next steps
-
-Now that you have deployed a Teleport cluster, read the [Manage
-Access](../../access-controls/access-controls.mdx) section to get started enrolling
-users and setting up RBAC.
-
-See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx
deleted file mode 100644
index a2fa03f6d4731..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx
+++ /dev/null
@@ -1,489 +0,0 @@
----
-title: Running an HA Teleport cluster using GCP, GKE, and Helm
-description: Install and configure an HA Teleport cluster using a Google Cloud GKE cluster.
----
-
-In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
-using Teleport Helm charts and Google Cloud Platform products (Firestore and Google Cloud Storage).
-
-If you are already running Teleport on another platform, you can use your
-existing Teleport deployment to access your Kubernetes cluster. [Follow our
-guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
-cluster to Teleport.
-
-(!docs/pages/includes/cloud/call-to-action.mdx!)
-
-## Prerequisites
-
-(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
-
-## Step 1/6. Add the Teleport Helm chart repository
-
-(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-<Admonition
-  type="note"
-  title="Note">
->
-  The steps below apply to Google Cloud Google Kubernetes Engine (GKE) Standard deployments.
-</Admonition>
-
-## Step 2/6. Google Cloud IAM configuration
-
-For Teleport to be able to create the Firestore collections, indexes, and the Google Cloud Storage bucket it needs,
-you'll need to configure a Google Cloud service account with permissions to use these services.
-
-### Create an IAM role granting the `storage.buckets.create` permission
-
-Go to the "Roles" section of Google Cloud IAM & Admin.
-
-1. Click the "Create Role" button at the top.
-
-   ![Roles section](../../../../img/helm/gcp/1-roles@1.5x.png)
-
-2. Fill in the details of a "Storage Bucket Creator" role (we suggest using the name `storage-bucket-creator-role`)
-
-   ![Create role](../../../../img/helm/gcp/2-createrole@1.5x.png)
-
-3. Click the "Add Permissions" button.
-
-   ![Storage bucket creator role](../../../../img/helm/gcp/3-addpermissions@1.5x.png)
-
-4. Use the "Filter" box to enter `storage.buckets.create` and select it in the list.
-
-   ![Filter the list](../../../../img/helm/gcp/4-storagebucketscreate@1.5x.png)
-
-5. Check the `storage.buckets.create` permission in the list and click the "Add" button to add it to the role.
-
-   ![Select storage.buckets.create](../../../../img/helm/gcp/5-select@1.5x.png)
-
-6. Once all these settings are entered successfully, click the "Create" button.
-
-   ![Create role](../../../../img/helm/gcp/6-createrole@1.5x.png)
-
-### Create an IAM role granting Cloud DNS permissions
-
-Go to the "Roles" section of Google Cloud IAM & Admin.
-
-1. Click the "Create Role" button at the top.
-
-   ![Roles section](../../../../img/helm/gcp/1-roles@1.5x.png)
-
-2. Fill in the details of a "DNS Updater" role (we suggest using the name `dns-updater-role`)
-
-   ![Create role](../../../../img/helm/gcp/13-dns-createrole@1.5x.png)
-
-3. Click the "Add Permissions" button.
-
-   ![DNS updater role](../../../../img/helm/gcp/3-addpermissions@1.5x.png)
-
-4. Use the "Filter" box to find each of the following permissions in the list
-   and add it.  You can type things like `dns.resourceRecordSets.*` to quickly
-   filter the list.
-
-   ```console
-   dns.resourceRecordSets.create
-   dns.resourceRecordSets.delete
-   dns.resourceRecordSets.list
-   dns.resourceRecordSets.update
-   dns.changes.create
-   dns.changes.get
-   dns.changes.list
-   dns.managedZones.list
-   ```
-
-5. Once all these settings are entered successfully, click the "Create" button.
-
-   ![Add DNS permissions](../../../../img/helm/gcp/14-dns-permissions-create@1.5x.png)
-
-### Create a service account for the Teleport Helm chart
-
-<Admonition type="note">
- If you already have a JSON private key for an appropriately-provisioned service account that you wish to use, you can skip this
- creation process and go to the ["Create the Kubernetes secret containing the JSON private key for the service account"](#create-the-kubernetes-secret-containing-the-json-private-key-for-the-service-account)
- section below.
-</Admonition>
-
-Go to the "Service Accounts" section of Google Cloud IAM & Admin.
-
-1. Click the "Create Service Account" button at the top.
-
-   ![Create service account](../../../../img/helm/gcp/7-serviceaccounts@1.5x.png)
-
-2. Enter details for the service account (we recommend using the name `teleport-helm`) and click the "Create" button.
-
-   ![Enter service account details](../../../../img/helm/gcp/8-createserviceaccount@1.5x.png)
-
-3. In the "Grant this service account access to project" section, add these four roles:
-
-| Role | Purpose |
-| - | - |
-| storage-bucket-creator-role | Role you just created allowing creation of storage buckets |
-| dns-updater-role | Role you just created allowing updates to Cloud DNS records |
-| Cloud Datastore Owner | Grants permissions to create Cloud Datastore collections |
-| Storage Object Admin | Allows read/write/delete of Google Cloud storage objects |
-
-![Add roles](../../../../img/helm/gcp/9-addroles@1.5x.png)
-
-4. Click the "continue" button to save these settings, then click the "create" button to create the service account.
-
-### Generate an access key for the service account
-
-Go back to the "Service Accounts" view in Google Cloud IAM & Admin.
-
-1. Click on the `teleport-helm` service account that you just created.
-
-   ![Click on the service account](../../../../img/helm/gcp/10-serviceaccountdetails@1.5x.png)
-
-2. Click the "Keys" tab at the top and click "Add Key". Choose "JSON" and click "Create".
-
-   ![Create JSON key](../../../../img/helm/gcp/11-createkey.png)
-
-3. The JSON private key will be downloaded to your computer. Take note of the filename (`bens-demos-24150b1a0a7f.json` in this example)
-   as you will need it shortly.
-
-   ![Private key saved](../../../../img/helm/gcp/12-privatekey@1.5x.png)
-
-#### Create the Kubernetes secret containing the JSON private key for the service account
-
-Find the path where the JSON private key was just saved (likely your browser's default "Downloads" directory).
-
-Use `kubectl` to create the `teleport` namespace, set its security policy, and
-create the secret using the path to the JSON private key:
-
-```code
-$ kubectl create namespace teleport
-namespace/teleport created
-$ kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
-namespace/teleport labeled
-$ kubectl --namespace teleport create secret generic teleport-gcp-credentials --from-file=gcp-credentials.json=/path/to/downloads/bens-demos-24150b1a0a7f.json
-secret/teleport-gcp-credentials created
-```
-
-<Admonition type="tip">
-  If you installed the Teleport chart into a specific namespace, the `teleport-gcp-credentials` secret you create must also be added to the same namespace.
-</Admonition>
-
-<Admonition type="note">
- The default name configured for the secret is `teleport-gcp-credentials`.
-
- If you already have a secret created, you can skip this creation process and specify the name of the secret using `gcp.credentialSecretName`.
-
- The credentials file stored in any secret used must have the key name `gcp-credentials.json`.
-</Admonition>
-
-## Step 3/6. Install and configure cert-manager
-
-Reference the [cert-manager docs](https://cert-manager.io/docs/).
-
-In this example, we are using multiple pods to create a High Availability Teleport cluster. As such, we will be using
-`cert-manager` to centrally provision TLS certificates using Let's Encrypt. These certificates will be mounted into each
-Teleport pod, and automatically renewed and kept up to date by `cert-manager`.
-
-If you do not have `cert-manager` already configured in the Kubernetes cluster where you are installing Teleport,
-you should add the Jetstack Helm chart repository which hosts the `cert-manager` chart, and install the chart:
-
-```code
-$ helm repo add jetstack https://charts.jetstack.io
-$ helm repo update
-$ helm install cert-manager jetstack/cert-manager \
---create-namespace \
---namespace cert-manager \
---set global.leaderElection.namespace=cert-manager \
---set installCRDs=true
-```
-
-Once `cert-manager` is installed, you should create and add an `Issuer`.
-
-You'll need to replace these values in the `Issuer` example below:
-
-| Placeholder value | Replace with |
-| - | - |
-| `email@address.com` | An email address to receive communications from Let's Encrypt |
-| `example.com` | The name of the Cloud DNS domain hosting your Teleport cluster |
-| `gcp-project-id` | GCP project ID where the Cloud DNS domain is registered |
-
-```yaml
-cat << EOF > gcp-issuer.yaml
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: letsencrypt-production
-  namespace: teleport
-spec:
-  acme:
-    email: email@address.com                                # Change this
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-production
-    solvers:
-    - selector:
-        dnsZones:
-          - "example.com"                                  # Change this
-      dns01:
-        cloudDNS:
-          project: gcp-project-id                          # Change this
-          serviceAccountSecretRef:
-            name: teleport-gcp-credentials
-            key: gcp-credentials.json
-EOF
-```
-
-<Admonition type="note">
-  The secret name under `serviceAccountSecretRef` here defaults to `teleport-gcp-credentials`.
-
-  If you have changed `gcp.credentialSecretName` in your chart values, you must also make sure it matches here.
-</Admonition>
-
-After you have created the `Issuer` and updated the values, add it to your cluster using `kubectl`:
-
-```code
-$ kubectl --namespace teleport create -f gcp-issuer.yaml
-```
-
-## Step 4/6. Set values to configure the cluster
-
-<details>
-<summary>License Secret</summary>
-
-Before you can install Teleport Enterprise in your Kubernetes cluster, you will need to
-create a secret that contains your Teleport license information.
-
-(!docs/pages/includes/enterprise/obtainlicense.mdx!)
-
-Create a secret from your license file. Teleport will automatically discover
-this secret as long as your file is named `license.pem`.
-
-```code
-$ kubectl -n teleport create secret generic license --from-file=license.pem
-```
-
-</details>
-
-<Admonition type="note">
-  If you are installing Teleport in a brand new GCP project, make sure you have enabled the
-  [Cloud Firestore API](https://console.cloud.google.com/apis/api/firestore.googleapis.com/overview)
-  and created a
-  [Firestore Database](https://console.cloud.google.com/firestore/welcome)
-  in your project before continuing.
-</Admonition>
-
-Next, configure the `teleport-cluster` Helm chart to use the `gcp` mode. Create a
-file called `gcp-values.yaml` file and write the values you've chosen above to
-it:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-
-```yaml
-chartMode: gcp
-clusterName: teleport.example.com                 # Name of your cluster. Use the FQDN you intend to configure in DNS below
-gcp:
-  projectId: gcpproj-123456                       # Google Cloud project ID
-  backendTable: teleport-helm-backend             # Firestore collection to use for the Teleport backend
-  auditLogTable: teleport-helm-events             # Firestore collection to use for the Teleport audit log (must be different to the backend collection)
-  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  sessionRecordingBucket: teleport-helm-sessions  # Google Cloud Storage bucket to use for Teleport session recordings
-highAvailability:
-  replicaCount: 2                                 # Number of replicas to configure
-  certManager:
-    enabled: true                                 # Enable cert-manager support to get TLS certificates
-    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
-
-# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
-podSecurityPolicy:
-  enabled: false
-```
-
-</TabItem>
-<TabItem scope={["enterprise"]} label="Teleport Enterprise">
-
-```yaml
-chartMode: gcp
-clusterName: teleport.example.com                 # Name of your cluster. Use the FQDN you intend to configure in DNS below
-gcp:
-  projectId: gcpproj-123456                       # Google Cloud project ID
-  backendTable: teleport-helm-backend             # Firestore collection to use for the Teleport backend
-  auditLogTable: teleport-helm-events             # Firestore collection to use for the Teleport audit log (must be different to the backend collection)
-  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
-  sessionRecordingBucket: teleport-helm-sessions  # Google Cloud Storage bucket to use for Teleport session recordings
-highAvailability:
-  replicaCount: 2                                 # Number of replicas to configure
-  certManager:
-    enabled: true                                 # Enable cert-manager support to get TLS certificates
-    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
-enterprise: true                                  # Indicate that this is a Teleport Enterprise deployment
-```
-
-</TabItem>
-
-</Tabs>
-
-Install the chart with the values from your `gcp-values.yaml` file using this command:
-
-```code
-$ helm install teleport teleport/teleport-cluster \
-  --create-namespace \
-  --namespace teleport \
-  -f gcp-values.yaml
-```
-
-<Admonition type="note">
-  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. We recommend using the fully-qualified domain name that you'll use for external access to your Teleport cluster.
-</Admonition>
-
-Once the chart is installed, you can use `kubectl` commands to view the deployment:
-
-```code
-$ kubectl --namespace teleport get all
-
-NAME                                 READY   STATUS    RESTARTS   AGE
-pod/teleport-auth-57989d4cbd-4q2ds   1/1     Running   0          22h
-pod/teleport-auth-57989d4cbd-rtrzn   1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
-pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
-
-NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                                                                     AGE
-service/teleport            LoadBalancer   10.40.11.180   34.138.177.11   443:30258/TCP,3023:31802/TCP,3026:32182/TCP,3024:30101/TCP,3036:30302/TCP   22h
-service/teleport-auth       ClusterIP      10.40.8.251    <none>          3025/TCP,3026/TCP                                                           22h
-service/teleport-auth-v11   ClusterIP      None           <none>          <none>                                                                      22h
-service/teleport-auth-v12   ClusterIP      None           <none>          <none>                                                                      22h
-
-NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
-deployment.apps/teleport-auth    2/2     2            2           22h
-deployment.apps/teleport-proxy   2/2     2            2           22h
-
-NAME                                       DESIRED   CURRENT   READY   AGE
-replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
-replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
-```
-
-## Step 5/6. Set up DNS
-
-You'll need to set up a DNS `A` record for `teleport.example.com`.
-
-<details>
-<summary>Enrolling applications with Teleport?</summary>
-
-(!docs/pages/includes/dns-app-access.mdx!)
-
-</details>
-
-Here's how to do this using Google Cloud DNS:
-
-```code
-# Change these parameters if you altered them above
-$ NAMESPACE=teleport
-$ RELEASE_NAME=teleport
-
-$ MYIP=$(kubectl --namespace ${NAMESPACE?} get service/${RELEASE_NAME?} -o jsonpath='{.status.loadBalancer.ingress[*].ip}')
-$ MYZONE="myzone"
-$ MYDNS="teleport.example.com"
-
-$ gcloud dns record-sets transaction start --zone="${MYZONE?}"
-$ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="300" --type="A" --zone="${MYZONE?}"
-$ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="300" --type="A" --zone="${MYZONE?}"
-$ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
-$ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
-```
-
-## Step 6/6. Create a Teleport user
-
-Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
-so we can run the command using `kubectl`:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-```code
-$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-```code
-$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor,reviewer
-
-User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
-```
-</TabItem>
-
-</Tabs>
-
-Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
-
-### High Availability
-
-In this guide, we have configured 2 replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
-value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
-
-## Upgrading the cluster after deployment
-
-To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
-
-Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
-version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
-
-If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../../../reference/helm-reference/teleport-cluster.mdx) value.
-
-Here's an example where we set the chart to use 3 replicas:
-
-<Tabs>
-  <TabItem label="Using values.yaml">
-  Edit your `gcp-values.yaml` file from above and make the appropriate changes.
-
-  Upgrade the deployment with the values from your `gcp-values.yaml` file using this command:
-
-  ```code
-  $ helm upgrade teleport teleport/teleport-cluster \
-    --namespace teleport \
-    -f gcp-values.yaml
-  ```
-
-  </TabItem>
-  <TabItem label="Using --set via CLI">
-  Run this command, editing your command line parameters as appropriate:
-
-  ```code
-  $ helm upgrade teleport teleport/teleport-cluster \
-    --namespace teleport \
-    --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-<Admonition type="note">
-  To change `chartMode`, `clusterName` or any `gcp` settings, you must first uninstall the existing chart and then install
-  a new version with the appropriate values.
-</Admonition>
-
-## Uninstalling Teleport
-
-To uninstall the `teleport-cluster` chart, use `helm uninstall <release-name>`. For example:
-
-```code
-$ helm --namespace teleport uninstall teleport
-```
-
-### Uninstalling cert-manager
-
-If you want to remove the `cert-manager` installation later, you can use this command:
-
-```code
-$ helm --namespace cert-manager uninstall cert-manager
-```
-
-## Next steps
-
-Now that you have deployed a Teleport cluster, read the [Manage
-Access](../../access-controls/access-controls.mdx) section to get started enrolling
-users and setting up RBAC.
-
-See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
-
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/helm-deployments.mdx b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/helm-deployments.mdx
deleted file mode 100644
index adc9f5791ec92..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/helm-deployments.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Guides for running Teleport using Helm
-description: How to install and configure Teleport in Kubernetes using Helm
-layout: tocless-doc
----
-
-The `teleport-cluster` Helm chart enables you deploy and manage a self-hosted,
-high-availability Teleport cluster. This chart launches the Teleport Auth
-Service, Teleport Proxy Service, and the Kubernetes infrastructure required to
-support these services. The guides in this section show you how to use the
-`teleport-cluster` Helm chart in your environment.
-
-You do not need to deploy the Auth Service and Proxy Service on Kubernetes in
-order to protect a Kubernetes cluster with Teleport, and it is possible to
-enroll a Kubernetes cluster on Teleport Cloud or by running the Teleport
-Kubernetes Service on a Linux server. For instructions on enrolling a Kubernetes
-cluster with Teleport, read the [Kubernetes
-Access](../../../enroll-resources/kubernetes-access/introduction.mdx) documentation.
-
-## Helm deployment guides
-
-These guides show you how to set up a full self-hosted Teleport deployment using
-our `teleport-cluster` Helm chart.
-
-- [Deploy Teleport on Kubernetes](kubernetes-cluster.mdx): Run a Teleport cluster in a Kubernetes cluster using
-  the default configuration. This deployment is a great starting point to try a self-hosted 
-  Teleport with minimal resources. 
-- [HA AWS Teleport Cluster](aws.mdx): Running an HA Teleport cluster in Kubernetes using an AWS EKS Cluster
-- [HA Azure Teleport Cluster](azure.mdx): Running an HA Teleport cluster in Kubernetes using an Azure AKS Cluster
-- [HA GCP Teleport Cluster](gcp.mdx): Running an HA Teleport cluster in Kubernetes using a Google Cloud GKE Cluster
-- [IBM Teleport Cluster](ibm.mdx): Running a replicated Teleport cluster in Kubernetes using and IBM Cloud IKS Cluster
-- [DigitalOcean Kubernetes Cluster](digitalocean.mdx):
-  Running Teleport on DigitalOcean Kubernetes.
-- [Custom Teleport config](custom.mdx): Running a Teleport cluster in Kubernetes with a custom Teleport config
-
-## Migration Guides
-
-- [Kubernetes 1.25 and PSP removal](migration-kubernetes-1-25-psp.mdx)
diff --git a/docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx b/docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx
deleted file mode 100644
index caaa50c913e94..0000000000000
--- a/docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx
+++ /dev/null
@@ -1,214 +0,0 @@
----
-title: Run a Self-Hosted Demo Cluster 
-description: This tutorial will guide you through the steps needed to install and run Teleport on a Linux server
-videoBanner: O0YOPpWsn8M
-tocDepth: 3
----
-
-See how a self-hosted Teleport deployment works by completing the tutorial
-below. This shows you how to spin up a single-instance Teleport cluster on a
-Linux server using Teleport Community Edition. Once you deploy the cluster, you
-can configure RBAC, register resources, and protect your small-scale demo
-environments or home lab.
-
-You can also get started right away with a production-ready Teleport cluster by
-signing up for a [free trial of Teleport Enterprise
-Cloud](https://goteleport.com/signup/).
-
-![Architecture of the setup you will complete in this
-guide](../../../img/linux-server-diagram.png)
-
-We will run the following Teleport services:
-
-- **Teleport Auth Service:** The certificate authority for your cluster. It
-  issues certificates and conducts authentication challenges. The Auth Service
-  is typically inaccessible outside your private network.
-- **Teleport Proxy Service:** The cluster frontend, which handles user requests,
-  forwards user credentials to the Auth Service, and communicates with Teleport
-  instances that enable access to specific resources in your infrastructure.
-- **Teleport SSH Service:** An SSH server implementation that takes advantage of
-  Teleport's short-lived certificates, sophisticated RBAC, session recording,
-  and other features.
-
-## Prerequisites
-
-You will need the following to deploy a demo Teleport cluster. If your
-environment doesn't meet the prerequisites, you can get started with Teleport by
-signing up for a [free trial of Teleport Enterprise
-Cloud](https://goteleport.com/signup/).
-
-If you want to get a feel for Teleport commands and capabilities without setting
-up any infrastructure, take a look at the browser-based [Teleport
-Labs](https://goteleport.com/labs).
-
-- A Linux host with only port `443` open to ingress traffic. You must be able
-  to install and run software on the host. Either configure access to the host
-  via SSH for the initial setup (and open an SSH port in addition port `443`)
-  or enter the commands in this guide into an Amazon EC2 [user data
-  script](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html),
-  Google Compute Engine [startup
-  script](https://cloud.google.com/compute/docs/instances/startup-scripts),
-  or similar.
-
-  For a quick demo environment you can use to follow this guide, consider
-  installing our DigitalOcean 1-Click droplet. View the installation page on
-  [DigitalOcean
-  Marketplace](https://marketplace.digitalocean.com/apps/teleport). Once your
-  droplet is ready, SSH into the droplet and follow the configuration wizard.
-
-- A multi-factor authenticator app such as [Authy](https://authy.com/download/),
-  [Google Authenticator](https://www.google.com/landing/2step/), or
-  [1Password](https://support.1password.com/one-time-passwords/).
-
-You must also have **one** of the following:
-- A registered domain name.
-- An authoritative DNS nameserver managed by your organization, plus an existing
-  certificate authority. If using this approach, ensure that your browser is
-  configured to use your organization's nameserver.
-
-## Step 1/4. Configure DNS
-
-Teleport uses TLS to provide secure access to its Proxy Service and Auth
-Service, and this requires a domain name that clients can use to verify
-Teleport's certificate. Set up two DNS `A` records, each pointing to the IP
-address of your Linux host. Assuming `teleport.example.com` is your domain name,
-set up records for:
-
-|Domain|Reason|
-|---|---|
-|`teleport.example.com`|Traffic to the Proxy Service from users and services.|
-|`*.teleport.example.com`|Traffic to web applications registered with Teleport. Teleport issues a subdomain of your cluster's domain name to each application.|
-
-## Step 2/4. Set up Teleport on your Linux host
-
-In this step, you will log into your Linux host, download the Teleport binary,
-generate a Teleport configuration file, and start the Teleport Auth Service,
-Proxy Service, and SSH Service on the host.
-
-### Install Teleport
-
-On your Linux host, run the following command to install the Teleport binary:
-
-```code
-$ curl (=teleport.teleport_install_script_url=) | bash -s (=teleport.version=)
-```
-
-### Configure Teleport
-
-Generate a configuration file for Teleport using the `teleport configure` command.
-This command requires information about a TLS certificate and private key.
-
-(!docs/pages/includes/tls-certificate-setup.mdx!)
-
-### Start Teleport
-
-(!docs/pages/includes/start-teleport.mdx!)
-
-Access the Teleport Web UI via HTTPS at the domain you created earlier at 
-<Var name="teleport.example.com" /> and accept the terms of using Teleport
-Community Edition.
-
-You should see a welcome screen similar to
-the following:
-
-![Teleport Welcome Screen](../../../img/quickstart/welcome.png)
-
-## Step 3/4. Create a Teleport user and set up multi-factor authentication
-
-In this step, we'll create a new Teleport user, `teleport-admin`, which is
-allowed to log into SSH hosts as any of the principals `root`, `ubuntu`, or
-`ec2-user`.
-
-On your Linux host, run the following command:
-
-```code
-# tctl is an administrative tool that is used to configure Teleport's auth service.
-$ sudo tctl users add teleport-admin --roles=editor,access --logins=root,ubuntu,ec2-user
-```
-
-The command prints a message similar to the following:
-
-```text
-User "teleport-admin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/123abc456def789ghi123abc456def78
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
-```
-
-Visit the provided URL in order to create your Teleport user.
-
-<Admonition
-  type="tip"
-  title="OS User Mappings"
->
-
-  The users that you specify in the `logins` flag (e.g., `root`, `ubuntu` and
-  `ec2-user` in our examples) must exist on your Linux host. Otherwise, you
-  will get authentication errors later in this tutorial.
-
-  If a user does not already exist, you can create it with `adduser <login>` or
-  use [host user creation](../../enroll-resources/server-access/guides/host-user-creation.mdx).
-
-  If you do not have the permission to create new users on the Linux host, run
-  `tctl users add teleport $(whoami)` to explicitly allow Teleport to
-  authenticate as the user that you have currently logged in as.
-
-</Admonition>
-
-Teleport enforces the use of multi-factor authentication by default. It supports
-one-time passwords (OTP) and multi-factor authenticators (WebAuthn). In this
-guide, you will need to enroll an OTP authenticator application using the QR
-code on the Teleport welcome screen.
-
-<details>
-<summary>Logging in via the CLI</summary>
-
-In addition to Teleport's Web UI, you can access resources in your
-infrastructure via the `tsh` client tool.
-
-Install `tsh` on your local workstation:
-
-(!docs/pages/includes/install-tsh.mdx!)
-
-Log in to receive short-lived certificates from Teleport. Replace 
-<Var name="teleport.example.com" /> with your Teleport cluster's public address
-as configured above:
-
-```code
-$ tsh login --proxy=<Var name="teleport.example.com" /> --user=teleport-admin
-> Profile URL:        https://teleport.example.com:443
-  Logged in as:       teleport-admin
-  Cluster:            teleport.example.com
-  Roles:              access, editor
-  Logins:             root, ubuntu, ec2-user
-  Kubernetes:         enabled
-  Valid until:        2022-04-26 03:04:46 -0400 EDT [valid for 12h0m0s]
-  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-</details>
-
-## Step 4/4. Enroll your infrastructure
-
-Once you finish setting up your user, you will see your SSH server in the
-Teleport Web UI:
-
-![Teleport Web UI showing an SSH server](../../../img/new-ssh-server.png)
-
-With Teleport, you can protect all of the resources in your infrastructure
-behind a single identity-aware access proxy, including servers, databases,
-applications, Kubernetes clusters, Windows desktops, and cloud provider APIs.
-
-To enroll a resource with Teleport, visit the Web UI and click **Enroll New
-Resource**. The Web UI will show you the steps you can take to enroll your new
-resource.
-
-## Next step: deploy Teleport Agents
-
-Teleport **Agents** proxy traffic to infrastructure resources like servers,
-databases, Kubernetes clusters, cloud provider APIs, and Windows desktops. 
-
-Step 4 showed you how to install agents manually, and you can also launch agents
-and enroll resources with them using infrastructure-as-code tools. For example,
-you can use Terraform to declare a pool of Teleport Agents and configure them to
-proxy your infrastructure. Read [Protect Infrastructure with Teleport](../../enroll-resources/agents/agents.mdx) to get started.
diff --git a/docs/pages/admin-guides/infrastructure-as-code/infrastructure-as-code.mdx b/docs/pages/admin-guides/infrastructure-as-code/infrastructure-as-code.mdx
deleted file mode 100644
index d4f35a4c5b572..0000000000000
--- a/docs/pages/admin-guides/infrastructure-as-code/infrastructure-as-code.mdx
+++ /dev/null
@@ -1,271 +0,0 @@
----
-title: Infrastructure as Code
-h1: Manage Teleport Resources with Infrastructure as Code
-description: An introduction to Teleport's dynamic resources, which make it possible to apply settings to remote clusters using infrastructure as code.
-tocDepth: 3
----
-
-This section explains how to manage Teleport's **dynamic resources**, which make
-it possible to adjust the behavior of your Teleport cluster as your
-infrastructure changes. The design of dynamic resources enables you to manage
-them using infrastructure as code tools, including Terraform, Helm, and the
-Teleport `tctl` client tool.
-
-## What is a dynamic resource?
-
-There are two ways to configure a Teleport cluster:
-
-- **Static configuration file:** At startup, a Teleport process reads a
-  configuration file from the local filesystem (the default path is
-  `/etc/teleport.yaml`). Static configuration settings control aspects of a
-  cluster that are not expected to change frequently, like the ports that
-  services listen on.
-- **Dynamic resources:** Dynamic resources control aspects of your cluster that
-  are likely to change over time, such as roles, local users, and registered
-  infrastructure resources.
-
-This approach makes it possible to incrementally adjust your Teleport
-configuration without restarting Teleport instances.
-
-![Architecture of dynamic resources](../../../img/dynamic-resources.png)
-
-A cluster is composed of different objects (i.e., resources) and there are three
-common operations that can be performed on them: `get` , `create` , and `remove`
-.
-
-Every resource in Teleport has three required fields:
-
-- `kind`: The type of resource
-- `name`: A required field in the `metadata` to uniquely identify the resource
-- `version`: The version of the resource format
-
-All other fields are specific to a resource.
-
-While Teleport Enterprise Cloud does not expose the static configuration file to
-operators, they do use a static configuration file for certain settings. Read
-how Teleport [reconciles static and dynamic
-resources](#reconciling-the-configuration-file-with-dynamic-resources) to
-understand how to see the values of static configuration settings that also
-appear in dynamic resources.
-
-When examining a dynamic resource, note that some of the fields you will see are
-used only internally and are not meant to be changed. Others are reserved for
-future use.
-
-## Managing dynamic resources
-
-Teleport provides three methods for applying dynamic resources: the `tctl`
-client tool, Teleport Terraform provider, and Kubernetes Operator.
-
-All three methods connect to the Teleport Auth Service's gRPC endpoint in order
-to manipulate cluster resources stored on the Auth Service backend. The design
-of Teleport's configuration interface makes it well suited for
-infrastructure-as-code and GitOps approaches.
-
-You can get started with `tctl`, the Terraform Provider, and the Kubernetes
-Operator by following: 
-- the ["Managing Users and Roles with IaC" guide](managing-resources/user-and-role.mdx)
-- the ["Creating Access Lists with IaC" guide](managing-resources/access-list.mdx)
-- the ["Registering Agentless OpenSSH Servers with IaC" guide](managing-resources/agentless-ssh-servers.mdx)
-
-For more information on Teleport roles, including the `internal.logins`
-trait we use in these example roles, see the [Access
-Controls Reference](../../reference/access-controls/roles.mdx).
-
-### YAML documents with `tctl`
-
-You can define resources as YAML documents and apply them using the `tctl`
-client tool. Here is an example of a `role` resource that allows access to
-servers with the label `env:test`:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: developer
-spec:
-  allow:
-    logins: ['ubuntu', 'debian', '{{internal.logins}}']
-    node_labels:
-      'env': 'test'
-```
-
-Since `tctl` works from the local filesystem, you can write commands that apply
-all configuration documents in a directory tree. See the [CLI
-reference](../../reference/cli/tctl.mdx) for more information on `tctl`.
-
-### Teleport Terraform provider
-
-Teleport's Terraform provider lets you manage your Teleport resources within the
-same infrastructure-as-code source as the rest of your infrastructure. There is
-a Terraform resource for each Teleport configuration resource. For example:
-
-```hcl
-resource "teleport_role" "developer" {
-  version = "v7"
-  metadata = {
-    name = "developer"
-  }
-
-  spec = {
-    allow = {
-      logins = ["ubuntu", "debian", "{{internal.logins}}"]
-
-      node_labels = {
-        key   = ["env"]
-        value = ["test"]
-      }
-    }
-  }
-}
-```
-
-[Get started with the Terraform
-provider](terraform-provider/terraform-provider.mdx).
-
-### Teleport Kubernetes Operator
-
-The Teleport Kubernetes Operator lets you apply Teleport resources as Kubernetes
-resources so you can manage your Teleport settings alongside the rest of your
-Kubernetes infrastructure. Here is an example of a `TeleportRoleV7` resource,
-which is equivalent to the two roles shown above:
-
-```yaml
-apiVersion: resources.teleport.dev/v1
-kind: TeleportRoleV7
-metadata:
-  name: developer
-spec:
-  allow:
-    logins: ['ubuntu', 'debian', '{{internal.logins}}']
-    node_labels:
-      'env': 'test'
-```
-
-[Get started with the Kubernetes Operator](teleport-operator/teleport-operator.mdx).
-
-## Reconciling the configuration file with dynamic resources
-
-Some dynamic resources assign the same settings as fields within
-Teleport's static configuration file. For these fields, the Teleport Auth
-Service reconciles static and dynamic configurations on startup and when you
-create or remove a Teleport resource.
-
-### Configuration resources that apply to static configuration fields
-
-There are four dynamic resources that share fields with the
-static configuration file:
-
-- `session_recording_config`
-- `cluster_auth_preference`
-- `cluster_networking_config`
-- `ui_config`
-
-#### `session_recording_config`
-
-|Dynamic resource field|Static configuration field|
-|---|---|
-|`spec.mode`|`auth_service.session_recording`|
-|`spec.proxy_checks_host_keys`|`auth_service.proxy_checks_host_keys`|
-
-#### `cluster_auth_preference`
-
-|Dynamic resource field|Static configuration field|
-|---|---|
-|`spec.type`|`auth_service.authentication.type`|
-|`spec.second_factor`|`auth_service.authentication.second_factor`|
-|`spec.second_factors`|`auth_service.authentication.second_factors`|
-|`spec.connector_name`|`auth_service.authentication.connector_name`
-|`spec.u2f`|`auth_service.authentication.u2f`|
-|`spec.disconnect_expired_cert`|`auth_service.disconnect_expired_cert`|
-|`spec.allow_local_auth`|`auth_service.authentication.local_auth`|
-|`spec.message_of_the_day`|`auth_service.message_of_the_day`|
-|`spec.locking_mode`|`auth_service.authentication.locking_mode`|
-|`spec.webauthn`|`auth_service.authentication.webauthn`|
-|`spec.require_session_mfa`|`auth_service.authentication.require_session_mfa`|
-|`spec.allow_passwordless`|`auth_service.authentication.passwordless`|
-|`spec.device_trust`|`auth_service.authentication.device_trust`|
-|`spec.idp`|`proxy_service.idp`|
-|`spec.allow_headless`|`auth_service.authentication.headless`|
-
-#### `cluster_networking_config`
-
-|Dynamic resource field|Static configuration field|
-|---|---|
-|`spec.client_idle_timeout`|`auth_service.client_idle_timeout`|
-|`spec.keep_alive_interval`|`auth_service.keep_alive_interval`|
-|`spec.keep_alive_count_max`|`auth_service.keep_alive_count_max`|
-|`spec.session_control_timeout`|`auth_service.session_control_timeout`|
-|`spec.idle_timeout_message`|`auth_service.client_idle_timeout_message`|
-|`spec.web_idle_timeout`|`auth_service.web_idle_timeout`|
-|`spec.proxy_listener_mode`|`auth_service.proxy_listener_mode`|
-|`spec.routing_strategy`|`auth_service.routing_strategy`|
-|`spec.tunnel_strategy`|`auth_service.tunnel_strategy`|
-|`spec.proxy_ping_interval`|`auth_service.proxy_ping_interval`|
-|`spec.case_insensitive_routing`|`auth_service.case_insensitive_routing`|
-
-#### `ui_config`
-
-| Dynamic resource field  | Static configuration field          |
-| ----------------------- | ----------------------------------- |
-| `spec.scrollback_lines` | `proxy_service.ui.scrollback_lines` |
-| `spec.show_resources`   | `proxy_service.ui.show_resources`   |
-
-### Origin labels
-
-The Teleport Auth Service applies the `teleport.dev/origin` label to
-configuration resources to indicate whether they originated from the static
-configuration file, a dynamic configuration resource, or the default value.
-
-Here are possible values of the `teleport.dev/origin` label:
-
-- `defaults`
-- `config-file`
-- `dynamic`
-- `terraform`
-- `kubernetes`
-
-When the Auth Service starts up, it looks up the values of static configuration
-fields that correspond to fields in dynamic configuration resources. If any of
-these have values, it creates the corresponding dynamic configuration resources
-and stores them in its backend.
-
-For any static configuration fields without a value, the Auth Service checks
-whether the backend contains the corresponding dynamic configuration resource.
-If not, it creates one with default values and the
-`teleport.dev/origin=defaults` label.
-
-If you attempt to create a dynamic configuration resource after the Auth Service
-has already loaded the configuration from a static configuration file, the Auth
-Service will return an error.
-
-If you remove a dynamic configuration resource, the Auth Service will restore
-its configuration fields to the default values and add the
-`teleport.dev/origin=defaults` label.
-
-<Admonition type="tip">
-
-Cloud-hosted Teleport deployments use configuration files, but these are not
-available for operators to modify. Users of Teleport Enterprise Cloud may see
-configuration resources with the `teleport.dev/origin=config-file` label.
-
-</Admonition>
-
-## Further reading
-
-### Configuration references
-
-- For a comprehensive reference of Teleport's static configuration options, read
-  the [Configuration Reference](../../reference/config.mdx).
-- To see the dynamic configuration resources available to apply, read the
-  [Configuration Resource Reference](../../reference/resources.mdx). There are also
-  dedicated configuration resource references for
-  [applications](../../reference/agent-services/application-access.mdx) and
-  [databases](../../reference/agent-services/database-access-reference/configuration.mdx).
-
-### Other ways to use the Teleport API
-
-The Teleport Kubernetes Operator, Terraform provider, and `tctl` are all clients
-of the Teleport Auth Service's gRPC API. To build your own API client to extend
-Teleport for your organization's needs, read our [API
-guides](../api/api.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx
deleted file mode 100644
index 5a7a41505ae19..0000000000000
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Configuring Teleport with Terraform
-description: How to manage dynamic resources using the Teleport Terraform provider.
-videoBanner: YgNHD4SS8dg
----
-
-The Teleport Terraform provider allows Teleport administrators to use Terraform to configure Teleport via
-dynamic resources.
-
-## Setup
-
-For instructions on managing users and roles via Terraform, read
-the ["Managing users and roles with IaC" guide](../managing-resources/user-and-role.mdx).
-
-The provider must obtain an identity to connect to Teleport. The method to obtain it depends on where the Terraform code
-is executed. You must pick the correct guide for your setup:
-
-| Guide                                                                                                               | Use-case                                                                                                                                                                                                         | How it works                                                                                                                           |
-|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
-| [Run the Teleport Terraform provider locally](local.mdx)                                       | You are getting started with the Teleport Terraform provider and managing Teleport resources with IaC.                                                                           | You use local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. |
-| [Run the Teleport Terraform provider on Terraform Cloud](terraform-cloud.mdx) | You're running on HCP Terraform (Terraform Cloud) or self-hosted Terraform Enterprise. | Terraform Cloud Workload Identity issues a proof of identity and the Teleport Terraform provider uses it to authenticate. |
-| [Run the Teleport Terraform provider in CI or a cloud VM](ci-or-cloud.mdx)                     | You already have a working Terraform module configuring Teleport and want to run it in CI to benefit from review and audit capabilities from your versioning system (e.g. git).                                  | You're using a proof provided by your runtime (CI engine, cloud provider) to prove your identity and join using MachineID.             |
-| [Run the Teleport Terraform provider on Spacelift](spacelift.mdx)                              | You already have a working Terraform module configuring Teleport and want to run it on the Spacelift platform.                                                                                                   | You're using a proof provided by Spacelift to prove your identity and join using MachineID.                                            |
-| [Run the Teleport Terraform provider from a server](dedicated-server.mdx)                      | You have working Terraform code and want to run it on a dedicated server. The server is long-lived, like a bastion or a task runner.                                                                             | You setup a MachineID daemon (`tbot`) that obtains and refreshes credentials for the Terraform provider.                               |
-| [Run the Teleport Terraform provider with long-lived credentials.](long-lived-credentials.mdx) | This method is discouraged as less secure than the others. This should be used when none of the other methods work in your case (short-lived CI environments that don't have dedicated Teleport join methods). | You sign one long lived certificate allowing the Terraform provider to connect to Teleport.                                            |
-
-## Resource guides
-
-Once you have a functional Teleport Terraform provider, you will want to configure your resources with it.
-
-The list of supported resources and their fields is available [in the Terraform
-reference](../../../reference/terraform-provider/terraform-provider.mdx).
-
-Some resources have their dedicated Infrastructure-as-Code (IaC) step-by step guides such as:
-- [Managing Users And Roles With IaC](../managing-resources/user-and-role.mdx)
-- [Creating Access Lists with IaC](../managing-resources/access-list.mdx)
-- [Registering Agentless OpenSSH Servers with IaC](../managing-resources/agentless-ssh-servers.mdx)
-
-Finally, you can [import your existing resources in Terraform](../managing-resources/import-existing-resources.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx
deleted file mode 100644
index f3cebf7b8c3fd..0000000000000
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx
+++ /dev/null
@@ -1,629 +0,0 @@
----
-title: "Part 1: Enroll Infrastructure with Terraform"
-h1: "Terraform Starter: Enroll Infrastructure"
-description: Explains how to deploy a pool of Teleport Agents so you can apply dynamic resources to enroll your infrastructure with Teleport.
----
-
-*This guide is Part One of the Teleport Terraform starter guide. Read the
-[overview](terraform-starter.mdx) for the scope and purpose of the Terraform
-starter guide.*
-
-This guide shows you how to use Terraform to enroll infrastructure resources
-with Teleport. You will:
-
-- Deploy a pool of Teleport Agents running on virtual machines.
-- Label resources enrolled by the Agents with `env:dev` and `env:prod` so that,
-  in [Part Two](rbac.mdx), you can configure Teleport roles to enable access to
-  these resources.
-
-## How it works
-
-An Agent is a Teleport instance configured to run one or more Teleport services
-in order to proxy infrastructure resources. For a brief architectural overview
-of how Agents run in a Teleport cluster, read the [Introduction to Teleport
-Agents](../../../enroll-resources/agents/agents.mdx).
-
-There are several methods you can use to join a Teleport Agent to your cluster,
-which we discuss in the [Joining Services to your
-Cluster](../../../enroll-resources/agents/agents.mdx) guide. In this guide, we will use
-the **join token** method, where the operator stores a secure token on the Auth
-Service, and an Agent presents the token in order to join a cluster.
-
-No matter which join method you use, it will involve the following Terraform
-resources:
-
-- Compute instances to run Teleport services
-- A join token for each compute instance in the Agent pool
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx version="16.2.0"!)
-
-<Admonition type="tip">
-
-We recommend following this guide on a fresh Teleport demo cluster so you can
-see how an Agent pool works. After you are familiar with the setup, apply the
-lessons from this guide to protect your infrastructure. You can get started with
-a demo cluster using:
-- A demo deployment on a [Linux server](../../../admin-guides/deploy-a-cluster/linux-demo.mdx)
-- A [Teleport Enterprise (Cloud) trial](https://goteleport.com/signup)
-
-</Admonition>
-
-- An AWS, Google Cloud, or Azure account with permissions to create virtual
-  machine instances.
-  
-- Cloud infrastructure that enables virtual machine instances to connect to the
-  Teleport Proxy Service. For example:
-  - An AWS subnet with a public NAT gateway or NAT instance
-  - Google Cloud NAT
-  - Azure NAT Gateway
-
-  In minimum-security demo clusters, you can also configure the VM instances you
-  deploy to have public IP addresses.
-
-- Terraform v(=terraform.version=) or higher.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Import the Terraform module
-
-In this step, you will download Terraform modules that show you how to get
-started enrolling Teleport resources. These modules are minimal examples of how
-Teleport Terraform resources work together to enable you to manage Teleport
-Agents. 
-
-After finishing this guide and becoming familiar with the setup, you should
-modify your Terraform configuration to accommodate your infrastructure in
-production.
-
-1. Navigate to your Terraform project directory.
-
-1. Fetch the Teleport code repository and copy the example Terraform
-   configuration for this project into your current working directory. The
-   following commands copy the appropriate child module for your cloud provider
-   into a subdirectory called `cloud` and HCL configurations for Teleport
-   resources into a subdirectory called `teleport`:
-
-   <Tabs>
-   <TabItem label="AWS">
-
-   ```code
-   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
-   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
-   $ cp -R teleport-clone/examples/terraform-starter/aws cloud
-   $ rm -rf teleport-clone
-   ```
-
-   </TabItem>
-   <TabItem label="Google Cloud">
-
-   ```code
-   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
-   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
-   $ cp -R teleport-clone/examples/terraform-starter/gcp cloud
-   $ rm -rf teleport-clone
-   ```
-
-   </TabItem>
-   <TabItem label="Azure">
-
-   ```code
-   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
-   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
-   $ cp -R teleport-clone/examples/terraform-starter/azure cloud
-   $ rm -rf teleport-clone
-   ```
-
-   </TabItem>
-   </Tabs>
-
-1. Create a file called `agent.tf` with the following content, which configures
-   the child modules you downloaded in the previous step:
-
-   <Tabs>
-   <TabItem label="AWS">
-   
-   ```hcl
-   module "agent_installation_dev" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "dev"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_installation_prod" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "prod"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_deployment" {
-     region           = ""
-     source           = "./cloud"
-     subnet_id        = ""
-     userdata_scripts = concat(
-       module.agent_installation_dev.userdata_scripts,
-       module.agent_installation_prod.userdata_scripts
-     )
-   }
-   ```
-   
-   </TabItem>
-   <TabItem label="Google Cloud">
-   
-   ```hcl
-   module "agent_installation_dev" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "dev"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_installation_prod" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "prod"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_deployment" {
-     gcp_zone         = "us-east1-b"
-     google_project   = ""
-     source           = "./cloud"
-     subnet_id        = ""
-     userdata_scripts = concat(
-       module.agent_installation_dev.userdata_scripts,
-       module.agent_installation_prod.userdata_scripts
-     )
-   }
-   ```
-   
-   </TabItem>
-   <TabItem label="Azure">
-   
-   ```hcl
-   module "agent_installation_dev" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "dev"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_installation_prod" {
-     source      = "./teleport"
-     agent_count = 1
-     agent_labels = {
-       env = "prod"
-     }
-     proxy_service_address = "teleport.example.com:443"
-     teleport_edition      = "cloud"
-     teleport_version      = "(=teleport.version=)"
-   }
-   
-   module "agent_deployment" {
-     azure_resource_group = ""
-     public_key_path      = ""
-     region               = "East US"
-     source               = "./cloud"
-     subnet_id            = ""
-     userdata_scripts     = concat(
-       module.agent_installation_dev.userdata_scripts,
-       module.agent_installation_prod.userdata_scripts
-     )
-   }
-   ```
-   
-   </TabItem>
-   </Tabs>
-
-Each of the `agent_installation_*` module blocks produces a number of
-installation scripts equal to the `agent_count` input. Each installation script
-runs the Teleport SSH Service with a Teleport join token, labeling the Agent
-with the key/value pairs specified in `agent_labels`. This configuration passes
-all installation scripts to the `agent_deployment` module in order to run them
-on virtual machines, launching one VM per script.
-
-As you scale your Teleport usage, you can increase this count to ease the load
-on each Agent. 
-
-Edit the `agent_installation_dev` and `agent_installation_prod` blocks in
-`agent.tf` as follows:
-
-1. Assign `proxy_service_address` to the host and HTTPS port of your Teleport
-   Proxy Service, e.g., `mytenant.teleport.sh:443`.
-
-   <Admonition type="tip">
-   
-   Make sure to include the port.
-   
-   </Admonition>
-
-1. Make sure `teleport_edition` matches your Teleport edition. Assign this to
-   `oss`, `cloud`, or `enterprise`. The default is `oss`.
-
-1. If needed, change the value of `teleport_version` to the version of Teleport
-   you want to run on your Agents. It must be either the same major version as
-   your Teleport cluster or one major version behind.
-
-Edit the `module "agent_deployment"` block in `agent.tf` as follows:
-
-1. If you are deploying your instance in a minimum-security demo environment and
-   do not have a NAT gateway, NAT instance, or other method for connecting your
-   instances to the Teleport Proxy Service, modify the `module` block to
-   associate a public IP address with each Agent instance: 
-
-   ```hcl
-   insecure_direct_access=true
-   ```
-
-1. Assign the remaining input variables depending on your cloud provider:
-
-   <Tabs>
-   <TabItem label="AWS">
-   
-   1. Assign `region` to the AWS region where you plan to deploy Teleport Agents,
-      such as `us-east-1`.
-   1. For `subnet_id`, include the ID of the subnet where you will deploy Teleport
-      Agents.
-   
-   </TabItem>
-   <TabItem label="Google Cloud">
-   
-   1. Assign `google_project` to the name of your Google Cloud project and
-      `gcp_zone` to the zone where you will deploy Agents, such as `us-east1-b`.
-
-   1. For `subnet_id`, include the name or URI of the Google Cloud subnet where you
-      will deploy the Teleport Agents.
-   
-      The subnet URI has the format:
-   
-      ```
-      projects/PROJECT_NAME/regions/REGION/subnetworks/SUBNET_NAME
-      ```
-   
-   </TabItem>
-   <TabItem label="Azure">
-   
-   1. Assign `azure_resource_group` to the name of the Azure resource group where
-      you are deploying Teleport Agents.
-   
-   1. The module uses `public_key_path` to pass validation, as Azure VMs must
-      include an RSA public key with at least 2048 bits. Once the module deploys
-      the VMs, a cloud-init script removes the public key and disables OpenSSH. Set
-      this input to the path to a valid public SSH key.
-   
-   1. Assign `region` to the Azure region where you plan to deploy Teleport Agents,
-      such as `East US`.
-   
-   1. For `subnet_id`, include the ID of the subnet where you will deploy Teleport
-      Agents. Use the following format:
-   
-      ```text
-      /subscriptions/SUBSCRIPTION/resourceGroups/RESOURCE_GROUP/providers/Microsoft.Network/virtualNetworks/NETWORK_NAME/subnets/SUBNET_NAME
-      ```
-   
-   </TabItem>
-   </Tabs>
-
-## Step 2/3. Add provider configurations
-
-In this step, you will configure the `terraform-starter` module for your
-Teleport cluster and cloud provider.
-
-In your Terraform project directory, ensure that the file called `provider.tf`
-includes the following content:
-
-<Tabs>
-<TabItem label="AWS">
-
-```hcl
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 4.0"
-    }
-
-    teleport = {
-      source  = "terraform.releases.teleport.dev/gravitational/teleport"
-      version = "~> (=teleport.major_version=).0"
-    }
-  }
-}
-
-provider "aws" {
-  region = AWS_REGION
-}
-
-provider "teleport" {
-  # Update addr to point to your Teleport Enterprise (Cloud) tenant URL's host:port
-  addr               = PROXY_SERVICE_ADDRESS
-}
-```
-
-Replace the following placeholders:
-
-| Placeholder           | Value                                                                        |
-|-----------------------|------------------------------------------------------------------------------|
-| AWS_REGION            | The AWS region where you will deploy Agents, e.g., `us-east-2`               |
-| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
-
-</TabItem>
-<TabItem label="Google Cloud">
-```hcl
-terraform {
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "~> 5.5.0"
-    }
-
-    teleport = {
-      source  = "terraform.releases.teleport.dev/gravitational/teleport"
-      version = "~> (=teleport.major_version=).0"
-    }
-  }
-}
-
-provider "google" {
-  project = GOOGLE_CLOUD_PROJECT
-  region  = GOOGLE_CLOUD_REGION
-}
-
-provider "teleport" {
-  # Update addr to point to your Teleport Enterprise (Cloud) tenant URL's host:port
-  addr               = PROXY_SERVICE_ADDRESS
-}
-```
-
-Replace the following placeholders:
-
-| Placeholder           | Value                                                                        |
-|-----------------------|------------------------------------------------------------------------------|
-| GOOGLE_CLOUD_PROJECT| Google Cloud project where you will deploy Agents. |
-| GOOGLE_CLOUD_REGION | Google Cloud region where you will deploy Agents. |
-| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
-
-
-</TabItem>
-<TabItem label="Azure">
-```hcl
-terraform {
-  required_providers {
-    azurerm = {
-      source  = "hashicorp/azurerm"
-      version = "~> 3.0.0"
-    }
-
-    teleport = {
-      source  = "terraform.releases.teleport.dev/gravitational/teleport"
-      version = "~> (=teleport.major_version=).0"
-    }
-  }
-}
-
-provider "teleport" {
-  # Update addr to point to your Teleport Cloud tenant URL's host:port
-  addr               = PROXY_SERVICE_ADDRESS
-}
-
-provider "azurerm" {
-  features {}
-}
-```
-
-Replace the following placeholders:
-
-|Placeholder|Value|
-|---|---|
-| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
-
-</TabItem>
-</Tabs>
-
-## Step 3/3. Verify the deployment
-
-In this step, you will create a Teleport bot to apply your Terraform
-configuration. The bot will exist for one hour and will be granted the default
-`terraform-provider` role that can edit every resource the TF provider supports.
-
-1. Navigate to your Terraform project directory and run the following command.
-   The `eval`command assigns environment variables in your shell to credentials
-   for the Teleport Terraform provider:
-
-   ```code
-   $ eval "$(tctl terraform env)"
-   🔑 Detecting if MFA is required
-   This is an admin-level action and requires MFA to complete
-   Tap any security key
-   Detected security key tap
-   ⚙️ Creating temporary bot "tctl-terraform-env-82ab1a2e" and its token
-   🤖 Using the temporary bot to obtain certificates
-   🚀 Certificates obtained, you can now use Terraform in this terminal for 1h0m0s
-   ```
-
-1. Make sure your cloud provider credentials are available to Terraform using
-   the standard approach for your organization.
-
-1. Apply the Terraform configuration:
-
-   ```code
-   $ terraform init
-   $ terraform apply
-   ```
-
-1. Once the `apply` command completes, run the following command to verify that
-   your Agents have deployed successfully. This command, which assumes that the
-   Agents have the `Node` role, lists all Teleport SSH Service instances with
-   the `role=agent-pool` label:
-
-   ```code
-   $ tsh ls role=agent-pool
-   Node Name                  Address    Labels
-   -------------------------- ---------- ---------------
-   ip-10-1-1-187.ec2.internal ⟵ Tunnel   role=agent-pool
-   ip-10-1-1-24.ec2.internal  ⟵ Tunnel   role=agent-pool
-   ```
-
-## Further reading: How the module works
-
-In this section, we explain the resources configured in the
-`terraform-starter` module.
-
-### Join token
-
-The `terraform-starter` module deploys one virtual machine instance for each
-Teleport Agent. Each Agent joins the cluster using a token. We create each token
-using the `teleport_provision_token` Terraform resource, specifying the token's
-value with a `random_string` resource:
-
-```hcl
-(!examples/terraform-starter/agent-installation/token.tf!)
-```
-
-When we apply the `teleport_provision_token` resources, the Teleport Terraform
-provider creates them on the Teleport Auth Service backend. 
-
-### User data script
-
-Each Teleport Agent deployed by the `terraform-starter` module loads a user
-data script that creates a Teleport configuration file for the Agent: 
-
-```text
-(!examples/terraform-starter/agent-installation/userdata!)
-```
-
-The configuration adds the `role: agent-pool` label to the Teleport SSH Service
-on each instance. This makes it easier to access hosts in the Agent pool later.
-It also adds the labels you configured using the `agent_labels` input of the
-module.
-
-The script makes Teleport the only option for accessing Agent instances by
-disabling OpenSSH on startup and deleting any authorized public keys.
-
-### Virtual machine instances
-
-Each cloud-specific child module of `terraform-starter` declares resources to
-deploy a virtual machine instance on your cloud provider:
-
-<Tabs>
-<TabItem label="AWS">
-
-`ec2-instance.tf` declares a data source for an Amazon Linux 2023 machine image
-and uses it to launch EC2 instances that run Teleport Agents with the
-`teleport_provision_token` resource:
-
-```hcl
-(!examples/terraform-starter/aws/ec2-instance.tf!)
-```
-
-</TabItem>
-<TabItem label="Google Cloud">
-
-`gcp-instance.tf` declares Google Compute Engine instances that use the
-`teleport_provision_token` to run Teleport Agents:
-
-```hcl
-(!examples/terraform-starter/gcp/gcp-instance.tf!)
-```
-
-</TabItem>
-<TabItem label="Azure">
-
-`azure-instance.tf` declares an Azure virtual machine resource to run Teleport
-Agents using the `teleport_provision_token` resource, plus the required network
-interface for each instance. 
-
-Note that while Azure VM instances require a user account, this module declares
-a temporary one to pass validation, but uses Teleport to enable access to the
-instances:
-
-```hcl
-(!examples/terraform-starter/azure/azure-instance.tf!)
-```
-
-</TabItem>
-</Tabs>
-
-## Next steps: More options for enrolling resources
-
-In Part One of the Terraform starter guide, we showed you how to use Terraform
-to deploy a pool of Teleport Agents in order to enroll infrastructure resources
-with Teleport. While the guide showed you how to enroll resources dynamically,
-by declaring Terraform resources for each infrastructure resource you want to
-enroll, you can protect more of your infrastructure with Teleport by:
-
-- Configuring Auto-Discovery
-- Configuring resource enrollment
-
-### Configure Auto-Discovery
-
-For a more scalable approach to enrolling resources than the one shown in this
-guide, configure the Teleport Discovery Service to automatically detect
-resources in your infrastructure and enroll them with the Teleport Auth Service.
-
-To configure the Teleport Discovery Service:
-
-1. Edit the userdata script run by the Agent instances managed in the Terraform
-   starter module. Follow the [Auto-Discovery
-   guides](../../../enroll-resources/auto-discovery/auto-discovery.mdx) guides
-   to configure the Discovery Service and enable your Agents to proxy the
-   resources that the service enrolls.
-1. Add the `Discovery` role to the join token resource you created earlier. In
-   this guide, the join token only has the `Node` role.
-1. Add roles to the join token resource that corresponds to the Agent services
-   you want to proxy discovered resources. The roles to add depend on the
-   resources you want to automatically enroll based on the [Auto-Discovery
-   guides](../../../enroll-resources/auto-discovery/auto-discovery.mdx) guides.
-
-### Enroll resources manually
-
-You can also enroll resources manually, instructing Agents to proxy specific
-endpoints in your infrastructure. For information about manual enrollment, read
-the documentation section for each kind of resource you would like to enroll:
-  
-- [Databases](../../../enroll-resources/database-access/database-access.mdx)
-- [Windows
-  desktops](../../../enroll-resources/desktop-access/desktop-access.mdx)
-- [Kubernetes
-  clusters](../../../enroll-resources/kubernetes-access/kubernetes-access.mdx)
-- [Linux servers](../../../enroll-resources/server-access/server-access.mdx)
-- [Web applications and cloud provider
-  APIs](../../../enroll-resources/application-access/application-access.mdx)
-
-Once you are familiar with the process of enrolling a resource manually, you can
-edit your Terraform module to:
-
-1. **Add token roles:** The token resource you created has only the `Node` role,
-   and you can add roles to authorize your Agents to proxy additional kinds of
-   resources. Consult a guide to enrolling resources manually to determine the
-   role to add to the token.
-1. **Change the userdata script** to enable additional Agent services additional
-   infrastructure resources for your Agents to proxy.
-1. **Deploy dynamic resources:** Consult the [Terraform provider
-   reference](../../../reference/terraform-provider/terraform-provider.mdx) for
-   Terraform resources that you can apply in order to enroll dynamic resources
-   in your infrastructure.
-
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/rbac.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/rbac.mdx
deleted file mode 100644
index 33fc3db56af9f..0000000000000
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/rbac.mdx
+++ /dev/null
@@ -1,566 +0,0 @@
----
-title: "Part 2: Configure Teleport RBAC with Terraform"
-h1: "Terraform Starter: Configure RBAC"
-description: Explains how to manage Teleport roles and authentication connectors with Terraform so you can implement the principle of least privilege in your infrastructure.
----
-
-*This guide is Part Two of the Teleport Terraform starter guide. Read the
-[overview](terraform-starter.mdx) for the scope and purpose of the Terraform
-starter guide.*
-
-In [Part One](enroll-resources.mdx) of this series, we showed you how to use
-Terraform to deploy Teleport Agents in order to enroll infrastructure resources
-with your Teleport cluster. While configuring Agents, you labeled them based on
-their environment, with some falling under `dev` and others under `prod`. 
-
-In this guide, you will configure your Teleport cluster to manage access to
-resources with the `dev` and `prod` labels in order to implement the principle
-of least privilege. 
-
-## How it works
-
-This guide shows you how to create:
-
-- A role that can access `prod` resources.
-- A role that can access `dev` resources and request access to `prod` resources.
-- An authentication connector that allows users to sign into your organization's
-  identity provider and automatically gain access to `dev` resources. 
-
-In this setup, the only way to access `prod` resources is with an Access
-Request, meaning that there are no standing credentials for accessing `prod`
-resources that an attacker can compromise.
-
-## Prerequisites
-
-This guide assumes that you have completed [Part 1: Enroll Infrastructure with
-Terraform](./enroll-resources.mdx).
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx version="16.2.0"!)
-
-- Resources enrolled with Teleport that include the `dev` and `prod` labels. We
-  show you how to enroll these resources using Terraform in Part One.
-- An identity provider that supports OIDC or SAML. You should have either:
-  - The ability to modify SAML attributes or OIDC claims in your organization.
-  - Pre-existing groups of users that you want to map to two levels of access:
-    the ability to connect to `dev` resources; and the ability to review Access
-    Requests for `prod` access.
-
-<Admonition type="tip">
-
-We recommend following this guide on the same Teleport demo cluster you used for
-Part One. After you are familiar with the setup, you can apply the lessons from
-this guide to manage RBAC with Terraform.
-
-</Admonition>
-
-- Terraform v(=terraform.version=) or higher.
-- (!docs/pages/includes/tctl.mdx!)
-- To help with troubleshooting, we recommend completing the setup steps in this
-  guide with a local user that has the preset `editor` and `auditor` roles. In
-  production, you can apply the lessons in this guide using a less privileged
-  user.
-
-## Step 1/4. Import Terraform modules
-
-In this step, you will download Terraform modules that show you how to get
-started managing Teleport RBAC. These modules are minimal examples of how
-Teleport Terraform resources work together to enable you to manage Teleport
-roles and authentication connectors. 
-
-After finishing this guide and becoming familiar with the setup, you should
-modify your Terraform configuration to accommodate your infrastructure in
-production.
-
-1. Navigate to the directory where you organized files for your root Terraform
-   module.
-
-1. Fetch the Teleport code repository and copy the example Terraform
-   configuration for this project into your current working directory. 
-
-   Since you will enable users to authenticate to Teleport through your
-   organization's identity provider (IdP), the modules depend on whether your
-   organization uses OIDC or SAML to communicate with services:
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   ```code
-   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
-   $ cp -R teleport-clone/examples/terraform-starter/env_role env_role
-   $ cp -R teleport-clone/examples/terraform-starter/oidc oidc
-   $ rm -rf teleport-clone
-   ```
-   </TabItem>
-   <TabItem label="SAML">
-
-   ```code
-   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
-   $ cp -R teleport-clone/examples/terraform-starter/env_role env_role
-   $ cp -R teleport-clone/examples/terraform-starter/saml saml
-   $ rm -rf teleport-clone
-   ```
-
-   </TabItem>
-   </Tabs>
-
-   Your project directory will include two new modules: 
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   |Name|Description|
-   |---|---|
-   |`env_role`|A module for a Teleport role that grants access to resources with a specific `env` label.|
-   |`oidc`|Teleport resources to configure an OIDC authentication connector and require that users authenticate with it.|
-
-   </TabItem>
-   <TabItem label="SAML">
-
-   |Name|Description|
-   |---|---|
-   |`env_role`|A module for a Teleport role that grants access to resources with a specific `env` label.|
-   |`saml`|Teleport resources to configure a SAML authentication connector and require that users authenticate with it.|
-
-   </TabItem>
-   </Tabs>
-
-1. Create a file called `rbac.tf` that includes the following `module` blocks: 
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   ```hcl
-   module "oidc" {
-     source               = "./oidc"
-     oidc_claims_to_roles = []
-     oidc_client_id       = ""
-     oidc_connector_name  = "Log in with OIDC"
-     oidc_redirect_url    = ""
-     oidc_secret          = ""
-     teleport_domain      = ""
-   }
-   
-   module "prod_role" {
-     source        = "./env_role"
-     env_label     = "prod"
-     principals    = {}
-     request_roles = []
-   }
-
-   module "dev_role" {
-     source        = "./env_role"
-     env_label     = "dev"
-     principals    = {}
-     request_roles = [module.prod_role.role_name]
-   }
-   ```
-   </TabItem>
-   <TabItem label="SAML">
-
-   ```hcl
-   module "saml" {
-     source                   = "./saml"
-     saml_connector_name      = "Log in with SAML"
-     saml_attributes_to_roles = []
-     saml_acs                 = ""
-     saml_entity_descriptor   = ""
-     teleport_domain          = ""
-   }
-   
-   module "prod_role" {
-     source        = "./env_role"
-     env_label     = "prod"
-     principals    = {}
-     request_roles = []
-   }
-   
-   module "dev_role" {
-     source        = "./env_role"
-     env_label     = "dev"
-     principals    = {}
-     request_roles = [module.prod_role.role_name]
-   }
-   ```
-   </TabItem>
-   </Tabs>
-
-Next, we will show you how to configure the two child modules, and walk you
-through the Terraform resources that they apply.
-
-## Step 2/4. Configure role principals
-
-Together, the `prod_role` and `dev_role` modules you declared in Step 1 create
-three Teleport roles:
-
-|Role|Description|
-|---|---|
-|`prod_access`|Allows access to infrastructure resources with the `env:prod` label.|
-|`dev_access`|Allows access to infrastructure resources with the `env:dev` label, and Access Requests for the `prod_access` role.|
-|`prod_reviewer`|Allows reviews of Access Requests for the `prod_access` role.|
-
-When Teleport users connect to resources in your infrastructure, they assume a
-principal, such as an operating system login or Kubernetes user, in order to
-interact with those resources. In this step, you will configure the `prod_role`
-and `dev_role` modules to grant access to principals in your infrastructure.
-
-In `rbac.tf`, edit the `prod_role` and `dev_role` blocks so that the
-`principals` field contains a mapping, similar to the example below. Use the
-list of keys below the example to configure the principals.
-
-```hcl
-module "prod_role" {
-  principals = {
-    KEY = "value"
-  }
-  // ...
-}
-
-// ...
-```
-
-|Key|Description|
-|---|---|
-|`aws_role_arns`|AWS role ARNs the user can access when authenticating to an AWS API.|
-|`azure_identities`|Azure identities the user can access when authenticating to an Azure API.|
-|`db_names`|Names of databases the user can access within a database server.|
-|`db_roles`|Roles the user can access on a database when they authenticate to a database server.|
-|`db_users`|Users the user can access on a database when they authenticate to a database server.|
-|`gcp_service_accounts`|Google Cloud service accounts the user can access when authenticating to a Google Cloud API.|
-|`kubernetes_groups`|Kubernetes groups the Teleport Database Service can impersonate when proxying requests from the user.|
-|`kubernetes_users`|Kubernetes users the Teleport Database Service can impersonate when proxying requests from the user.|
-|`logins`|Operating system logins the user can access when authenticating to a Linux server.|
-|`windows_desktop_logins`|Operating system logins the user can access when authenticating to a Windows desktop.|
-
-For example, the following configuration allows users with the `dev_access` role
-to assume the `dev` login on Linux hosts and the `developers` group on
-Kubernetes. `prod` users have more privileges and can assume the `root` login
-and `system:masters` Kubernetes group:
-
-```hcl
-module "dev_role" {
-  principals = {
-    logins            = ["dev"]
-    kubernetes_groups = ["developers"]
-  }
-  // ...
-}
-
-module "prod_role" {
-  principals = {
-    logins            = ["root"]
-    kubernetes_groups = ["system:masters"]
-  }
-  // ...
-}
-```
-
-## Step 3/4. [Optional] Configure the single sign-on connector
-
-In this step, you will configure your Terraform module to enable authentication
-through your organization's IdP. Configure the `saml` or `oidc` module you
-declared in Step 1 by following the instructions.
-
-<Admonition type="tip">
-
-You can skip this step for now if you want to assign the `dev_access` and
-`prod_access` roles to local Teleport users instead of single sign-on users. To
-do so, you can:
-
-- Import existing `teleport_user` resources and modify them to include the
-  `dev_access` and `prod_access` roles (see the
-  [documentation](../managing-resources/import-existing-resources.mdx)).
-- Create a new `teleport_user` resource that includes the roles
-  ([documentation](../managing-resources/user-and-role.mdx).
-
-If you plan to skip this step, make sure to remove the `module "saml"` or
-`module "oidc"` block from your Terraform configuration.
-
-</Admonition>
-
-1. Register your Teleport cluster with your IdP as a relying party. The
-   instructions depend on your IdP. 
-
-   The following guides show you how to set up your IdP to support the SAML or
-   OIDC authentication connector. **Read only the linked section**, since these
-   guides assume you are using `tctl` instead of Terraform to manage
-   authentication connectors:
-
-   - [AD FS](../../../admin-guides/access-controls/sso/adfs.mdx#step-13-configure-adfs)
-   - [GitLab](../../../admin-guides/access-controls/sso/gitlab.mdx#configure-gitlab)
-   - [Google
-     Workspace](../../../admin-guides/access-controls/sso/google-workspace.mdx#step-14-configure-google-workspace)
-   - [OneLogin](../../../admin-guides/access-controls/sso/one-login.mdx#step-13-create-teleport-application-in-onelogin)
-   - [Azure
-     AD](../../../admin-guides/access-controls/sso/azuread.mdx#step-13-configure-microsoft-entra-id)
-   - [Okta](../../../admin-guides/access-controls/sso/okta.mdx#step-24-configure-okta)
-
-1. Configure the redirect URL (for OIDC) or assertion consumer service (for SAML):
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   Set `oidc_redirect_url` to
-   `https://example.teleport.sh:443/v1/webapi/oidc/callback`, replacing
-   `example.teleport.sh` with the domain name of your Teleport cluster. 
-
-   Ensure that `oidc_redirect_url` matches match the URL you configured with
-   your IdP when registering your Teleport cluster as a relying party.
-
-   </TabItem>
-   <TabItem label="SAML">
-
-   Set `saml_acs` to `https://example.teleport.sh:443/v1/webapi/saml/acs`,
-   replacing `example.teleport.sh` with the domain name of your Teleport
-   cluster. 
-
-   Ensure that `saml_acs` matches the URL you configured with your IdP when
-   registering your Teleport cluster as a relying party.
-
-   </TabItem>
-   </Tabs>
-
-1. After you register Teleport as a relying party, your identity provider will
-   print information that you will use to configure the authentication
-   connector. Fill in the information depending on your provider type:
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   Fill in the `oidc_client_id` and `oidc_secret` with the client ID and secret
-   returned by the IdP.
-
-   </TabItem>
-   <TabItem label="SAML">
-
-   Assign `saml_entity_descriptor` to the contents of the XML document that
-   contains the SAML entity descriptor for the IdP.
-
-   </TabItem>
-   </Tabs>
-
-1. Assign `teleport_domain` to the domain name of your Teleport Proxy Service,
-   with no scheme or path, e.g., `example.teleport.sh`. The child module uses
-   this to configure WebAuthn for local users. This way, you can authenticate as
-   a local user as a fallback if you need to troubleshoot your single sign-on
-   authentication connector.
-
-1. Configure role mapping for your authentication connector. When a user
-   authenticates to Teleport through your organization's IdP, Teleport assigns
-   roles to the user based on your connector's role mapping configuration:
-
-   <Tabs>
-   <TabItem label="OIDC">
-
-   In this example, users with a `group` claim with the `developers` value
-   receive the `dev_access` role, while users with a `group` claim with the
-   value `admins` receive the `prod_reviewer` role:
-
-   ```hcl
-        oidc_claims_to_roles = [
-          {
-            claim = "group"
-            value = "developers"
-            roles = [
-              module.dev_role.role_name
-            ]
-          },
-          {
-            claim = "group"
-            value = "admins"
-            roles = module.dev_role.reviewer_role_names
-          }
-        ]
-   ```
-
-   Edit the `claim` value for each item in `oidc_claims_to_roles` to match the
-   name of an OIDC claim you have configured on your IdP. 
-
-   </TabItem>
-   <TabItem label="SAML">
-
-   In this example, users with a `group` attribute with the `developers` value
-   receive the `dev_access` role, while users with a `group` attribute with the
-   value `admins` receive the `prod_reviewer` role:
-
-   ```hcl
-        saml_attributes_to_roles = [
-          {
-            name  = "group"
-            value = "developers"
-            roles = [
-              module.dev_role.role_name
-            ]
-          },
-          {
-            name  = "group"
-            value = "admins"
-            roles = module.dev_role.reviewer_role_names
-          }
-        ]
-   ```
-
-   </TabItem>
-   </Tabs>
-
-## Step 4/4. Apply and verify changes
-
-In this step, you will create a Teleport bot to apply your Terraform
-configuration. The bot will exist for one hour and will be granted the default
-`terraform-provider` role that can edit every resource the TF provider supports.
-
-1. Navigate to your Terraform project directory and run the following command.
-   The `eval`command assigns environment variables in your shell to credentials
-   for the Teleport Terraform provider:
-
-   ```code
-   $ eval "$(tctl terraform env)"
-   🔑 Detecting if MFA is required
-   This is an admin-level action and requires MFA to complete
-   Tap any security key
-   Detected security key tap
-   ⚙️ Creating temporary bot "tctl-terraform-env-82ab1a2e" and its token
-   🤖 Using the temporary bot to obtain certificates
-   🚀 Certificates obtained, you can now use Terraform in this terminal for 1h0m0s
-   ```
-
-1. Make sure your cloud provider credentials are available to Terraform using
-   the standard approach for your organization.
-
-1. Apply the Terraform configuration:
-
-   ```code
-   $ terraform init
-   $ terraform apply
-   ```
-
-1. Open the Teleport Web UI in a browser and sign in to Teleport as a user on
-   your IdP with the `groups` trait assigned to the value that you mapped to the
-   role in your authentication connector. Your user should have the `dev_access`
-   role.
-
-   <Admonition type="tip">
-
-   If you receive errors logging in using your authentication connector, log in
-   as a local user with permissions to view the Teleport audit log. These is
-   available in the preset `auditor` role. Check for error messages in events
-   related with the "SSO Login" type.
-
-   </Admonition>
-
-1. Request access to the `prod_access` role through the Web UI. Visit the
-   "Access Requests" tab and click "New Request".
-
-1. Sign out of the Web UI and, as a user in a group that you mapped to the
-   `prod_access` role, sign in. In the "Access Requests" tab, you should be able
-   to see and resolve the Access Request you created.
-
-## Further reading: How the module works
-
-This section describes the resources managed by the `env_role`, `saml`, and
-`oidc` child modules. We encourage you to copy and customize these
-configurations in order to refine your settings and choose the best reusable
-interface for your environment.
-
-### The `env_access` role
-
-The `env_role` child module creates Teleport roles with the ability to access
-Teleport-protected resources with the `env` label:
-
-```hcl
-(!examples/terraform-starter/env_role/env_role.tf!)
-```
-
-The role hardcodes an `allow` rule with the ability to access applications,
-databases, Linux servers, Kubernetes clusters, and Windows desktops with the
-user-configured `env` label. 
-
-Since we cannot predict which principals are available in your infrastructure,
-this role leaves the `aws_role_arns`, `logins`, and other principal-related role
-attributes for the user to configure.
-
-The role also configures an `allow` rule that enables users to request access
-for the roles configured in the `request_roles` input variable.
-
-An `output` prints the name of the role to allow us to create a dependency
-relationship between this role and an authentication connector.
-
-### The `env_access_reviewer` role
-
-If `var.request_roles` in the `env_access` role is nonempty, the `env_role`
-module creates a role that can review those roles. This is a separate role to
-make permissions more composable:
-
-```hcl
-(!examples/terraform-starter/env_role/reviewer.tf!)
-```
-
-As with the `env_access` role, there is an output to print the name of the
-`env_access_reviewer` role to create a dependency relationship with the
-authentication connector.
-
-### Configuring an authentication connector
-
-The authentication connector resources are minimal. Beyond providing the
-attributes necessary to send and receive Teleport OIDC and SAML messages, the
-connectors configure role mappings based on user-provided values:
-
-<Tabs>
-<TabItem label="OIDC">
-
-```hcl
-(!examples/terraform-starter/oidc/oidc_connector.tf!)
-```
-</TabItem>
-<TabItem label="SAML">
-
-```hcl
-(!examples/terraform-starter/saml/saml.tf!)
-```
-
-</TabItem>
-</Tabs>
-
-Since the role mappings inputs are composite data types, we add a complex type
-definition when declaring the input variables for the `oidc` and `saml` child
-modules:
-
-<Tabs>
-<TabItem label="OIDC">
-
-```hcl
-(!examples/terraform-starter/oidc/inputs.tf!)
-```
-</TabItem>
-<TabItem label="SAML">
-
-```hcl
-(!examples/terraform-starter/saml/inputs.tf!)
-```
-</TabItem>
-</Tabs>
-
-For each authentication connector, we declare a cluster authentication
-preference that enables the connector. The cluster authentication preference
-enables local user login with WebAuthn as a secure fallback in case you need to
-troubleshoot the single sign-on provider.
-
-<Tabs>
-<TabItem label="OIDC">
-
-```hcl
-(!examples/terraform-starter/oidc/auth_pref.tf!)
-```
-</TabItem>
-<TabItem label="SAML">
-
-```hcl
-(!examples/terraform-starter/saml/auth_pref.tf!)
-```
-</TabItem>
-</Tabs>
-
-## Next steps
-
-Now that you have configured RBAC in your Terraform demo cluster, fine-tune your
-setup by reading the comprehensive [Terraform provider
-reference](../../../reference/terraform-provider/terraform-provider.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/terraform-starter.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/terraform-starter.mdx
deleted file mode 100644
index c82835f95fbd1..0000000000000
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-starter/terraform-starter.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: "Terraform Starter Setup"
-description: Provides an example to help you get started managing dynamic resources in a Teleport cluster using Terraform.
----
-
-The Terraform starter guide provides an example of a Terraform module that
-manages Teleport resources in production. The guide helps you to understand the
-Teleport resources to manage with Terraform in order to accomplish common
-Teleport setup tasks. You can use the example module as a starting point for
-managing a complete set of Teleport cluster resources.
-
-The guides in the Terraform starter module assume that you have [a working Terraform provider setup](../terraform-provider/terraform-provider.mdx) on your workstation.
-
-## Part One: Enroll resources
-
-In Part One of the Terraform starter module, we show you how to enroll resources
-such as Linux servers, databases, and Kubernetes clusters by deploying a pool of
-Teleport Agents on virtual machine instances. You can then declare dynamic
-infrastructure resources with Terraform or change the configuration file
-provided to each Agent.
-
-[Read Part One](enroll-resources.mdx).
-
-## Part Two: Configure RBAC
-
-Part Two of the Terraform starter module shows you how to configure Teleport
-role-based access controls to provide different levels of access to the
-resources you enrolled in Part One. It also configures Access Requests,
-available in Teleport Identity Governance, so that users authenticate with less privileged
-roles by default but can request access to more privileged roles. An
-authentication connector lets users authenticate to Teleport using a Single
-Sign-On provider.
-
-[Read Part Two](rbac.mdx).
-
diff --git a/docs/pages/admin-guides/management/admin/admin.mdx b/docs/pages/admin-guides/management/admin/admin.mdx
deleted file mode 100644
index 4e11195231369..0000000000000
--- a/docs/pages/admin-guides/management/admin/admin.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Cluster Administration Guides
-description: Teleport Cluster Administration Guides.
-layout: tocless-doc
----
-
-The guides in this section show you the fundamentals of setting up and running a
-Teleport cluster. You will learn how to run the `teleport` daemon, manage users
-and resources, and troubleshoot any issues that arise.
-
-If you already understand how to set up a Teleport cluster, consult the
-[Operations](../operations/operations.mdx) section so you can start conducting periodic
-cluster maintenance tasks.
-
-## Run Teleport
-
-- [Teleport Daemon](daemon.mdx): Set up Teleport as a daemon on Linux with systemd.
-- [Run Teleport with Self-Signed Certificates](self-signed-certs.mdx): Set up Teleport in a local
-environment without configuring TLS certificates.
-
-## Manage users and resources
-
-- [Trusted Clusters](trustedclusters.mdx): Connect multiple Teleport clusters using trusted clusters.
-- [Labels](labels.mdx): Manage resource metadata with labels.
-- [Local Users](users.mdx): Manage local user accounts.
-
-## Troubleshoot issues
-
-- [Troubleshooting](troubleshooting.mdx): Collect metrics and diagnostic information from Teleport.
-- [Uninstall Teleport](uninstall-teleport.mdx): Uninstall Teleport from your system.
diff --git a/docs/pages/admin-guides/management/admin/labels.mdx b/docs/pages/admin-guides/management/admin/labels.mdx
deleted file mode 100644
index 7cb0750dccba7..0000000000000
--- a/docs/pages/admin-guides/management/admin/labels.mdx
+++ /dev/null
@@ -1,384 +0,0 @@
----
-title: Add Labels to Resources
-description: How to assign static and command-based dynamic labels to Teleport resources.
----
-
-Teleport allows you to add arbitrary key-value pairs to applications, servers,
-databases, and other resources in your cluster. You can use labels to do 
-the following:
-
-- Filter the resources returned when running `tctl` and `tsh` commands.
-- Define roles that limit the resources Teleport users can access.
-
-This guide demonstrates how to add labels to enrolled server resources.
-However, you can follow similar steps to add labels to other types of resources.
-
-## How it works
-
-The labels you assign to resources can be **static labels**, **dynamic labels**, or **resource-based labels**.
-
-- Static labels are hardcoded in the Teleport configuration file and don't change 
-while the `teleport` process is running. For example, you might use a static label to identify 
-the resources in a `staging` or `production` environment.
-- Dynamic labels—also known as **commands-based labels**—allow you to generate labels at runtime. 
-With a dynamic label, the `teleport` process executes an external command on its host at 
-a configurable frequency and the output of the command becomes the label value.
-- Resource-based labels allow you to add labels to an instance without restarting the `teleport`
-process or editing the configuration file.
-
-You can add multiple static, dynamic, and resource-based labels for the same resource.
-However, you can't add static labels that use the same key with different values or use
-a static label to define multiple potential values.
-
-Dynamic labels are especially useful for decoupling a label value from the Teleport configuration. 
-For example, if you start Teleport on an Amazon EC2 instance, you can use a dynamic label to set the 
-`region` value based on the result from a command sent to the EC2 instance 
-[metadata API](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html).
-The dynamic label enables you to use the same configuration for each server in an Amazon Machine Image 
-but filter and limit access to the servers based on their AWS region.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- A Linux host where you will run a Teleport Agent. This guide shows you how to
-  apply labels to an instance of the Teleport SSH Service. You can use the
-  technique shown in the guide to label any Teleport-protected resource.
-
-(!docs/pages/includes/tctl.mdx!)
-
-## Step 1/2. Install Teleport
-
-1. Select a Linux server where you will run a Teleport Agent.
-
-1. (!docs/pages/includes/install-linux.mdx!)
-
-1. Generate an invitation token for the host.
-   
-   The invitation token is required for the local computer to join the Teleport cluster.  
-   The following example generates a new token that is valid for five minutes and can be used 
-   to enroll a server:
-   
-   ```code
-   $ tctl tokens add --ttl=5m --type=node
-   # The invite token: (=presets.tokens.first=)
-   ```
-
-1. List all generated non-expired tokens by running the following command:
-   
-   ```code
-   $ tctl tokens ls
-   # Token                            Type        Labels Expiry Time (UTC)               
-   # -------------------------------- ----------- ------ ------------------------------- 
-   # (=presets.tokens.first=) Node,Db,App        10 Aug 23 19:49 UTC (4m11s) 
-   ```
-
-1. Write the join token to a file on the host at `/tmp/token`:
-
-   ```code
-   $ echo (=presets.tokens.first=) | sudo tee /tmp/token
-   ```
-
-1. On the host where you plan to run the Agent, generate a configuration file
-   that enables the Teleport SSH Service. Replace `teleport.example.com` with
-   the host and port of your Teleport Proxy Service or Teleport Enterprise
-   (Cloud) account:
-
-   ```code
-   $ sudo teleport configure \
-     --token="/tmp/token" \
-     --roles=node \
-     --proxy=example.teleport.sh:443 \
-     -o file
-   ```
-
-## Step 2/2. Apply labels
-
-Follow any or all of the sections below to add different types of labels to
-your resource.
-
-### Apply a static label
-
-You can configure static labels by editing the Teleport configuration file, then
-starting Teleport.
-
-To add a static label:
-
-1. Open the Teleport configuration file, `/etc/teleport.yaml`, in an editor on the computer 
-where you installed the Teleport Agent.
-
-1. Locate the `labels` configuration under the `ssh_service` section.
-
-1. Add the static label key and value. 
-   For example, add `environment` as the label key and `dev` as the value:
-
-   ```yaml
-   ssh_service:
-     enabled: true
-     labels:
-       environment: dev
-   ```
-
-   The preceding example illustrates a simple value setting. However, you can also use static labels
-   to define more complex string values that include white space or punctuation marks. 
-   For example:
-
-   ```code
-   ssh_service:
-     enabled: true
-     labels:
-       location: San Francisco Bldg 301 4th floor
-   ```
-
-1. Save your changes and close the file.
-
-1. Start Teleport on the Linux host:
-
-   (!docs/pages/includes/start-teleport.mdx!)
-
-1. Verify that you have added the label by running the following command 
-on your local computer. 
-      
-   ```code
-   $ tsh ls --query 'labels["environment"]=="dev"'
-   ```
-
-   You should see output similar to the following:
-
-   ```code
-   Node Name        Address    Labels                                                                                                       
-   ---------------- ---------- ------------------------------------------
-   ip-192-168-13-57 ⟵ Tunnel   environment=dev,hostname=ip-192-168-13-57
-   ```
-
-   **Checking the status of your server**
-
-   If you don't see your server listed when you query for the label you added, you should verify that the 
-   SSH Service is running on the server. Check the log for the server to verify that there are 
-   messages similar to the following:
-   
-   ```text
-   2023-08-07T22:22:21Z INFO [NODE:1]    Service is starting in tunnel mode. pid:149932.1 service/service.go:2630
-   2023-08-07T22:22:21Z INFO [UPLOAD:1]  starting upload completer service pid:149932.1 service/service.go:2723
-   2023-08-07T22:22:21Z INFO [PROC:1]    The new service has started successfully. Starting syncing rotation status...
-   ```
-   
-   **Checking your user profile**
-   
-   If the SSH Service is running on the server, verify that your current Teleport user has a login on the local host.
-   You can check the status of your user account by running the following command:
-   
-   ```code
-   $ tsh status
-   ```
-      
-   You should see output similar to the following with at least one login listed for your current user:
-   
-   ```code
-   > Profile URL:        https://ajuba-aws.teledocs.click:443
-     Logged in as:       teleport-admin
-     Cluster:            teleport-aws.example.com
-     Roles:              access, editor
-     Logins:             root, ubuntu, ec2-user
-     Kubernetes:         enabled
-     Valid until:        2023-08-08 10:08:46 +0000 UTC [valid for 10h36m0s]
-     Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
-   ```
-   
-   If no valid logins have been assigned to the user, you should update your current user profile to include
-   at least one valid login.
-   
-   You can add logins to a user by running a command similar to the following:
-      
-   ```code
-   $ tctl users update myuser --set-logins=root
-   ```
-   
-   This example adds the `root` login to the `myuser` Teleport user.
-   For more information about managing logins for Teleport users, see [Local Users](./users.mdx).
-
-**Using hidden static labels**
-
-If you want to use labels for role-based access control but don't want to 
-display the labels in command output or the Teleport Web UI, you can define them 
-in a hidden namespace by prefixing the label key with `teleport.hidden/`.
-For example:
-
-
-```yaml
-ssh_service:
-  enabled: true
-  labels:
-    teleport.hidden/team-id: ai-lab-01
-``` 
-
-### Apply dynamic labels using commands
-
-As with static labels, you can apply dynamic labels by editing the
-Teleport configuration file, then restarting the Teleport service on your server.
-
-To add a command to generate a dynamic label:
-
-1. Stop the Teleport service running on your server.
-
-1. Open the Teleport configuration file—by default, `/etc/teleport.yaml`—in a text editor.
-
-1. Locate the `commands` configuration under the `ssh_service` section.
-
-1. Add a `command` array that runs the `uname` command with the `-p` argument to return the architecture of the 
-host server every one hour. 
-   
-   For example, add the `name`, `command`, and `period` fields as follows:
-
-   ```yaml
-   ...
-   ssh_service:
-     enabled: true
-     labels:
-       teleport.internal/resource-id: 1f2cdcc5-cde3-41fa-b390-bc872087821a
-       environment: dev
-     commands:
-     - name: hostname
-       command: [hostname]
-       period: 1m0s
-     - name: arch
-       command: [uname, -p]
-       period: 1h0m0s
-   ```
-   
-   In the `command` setting, the first element is a valid executable. 
-   Each subsequent element is an argument.
-   The following syntax is valid:
-
-   ```yaml
-   command: ["/bin/uname", "-m"]
-   ```
-   
-   The following syntax is not valid:
-
-   ```yaml
-   command: ["/bin/uname -m"]
-   ```
-   
-   For more complex commands, you can use single (') and double (") 
-   quotation marks interchangeably to create nested expressions. 
-   For example:
-
-   ```yaml
-   command: ["/bin/sh", "-c", "uname -a | egrep -o '[0-9]+\\.[0-9]+\\.[0-9]+'"]
-   ```
-   
-   In configuring commands, keep the following in mind:
-   
-   - The executable must be discoverable in the `$PATH` or specified using an absolute path. 
-   - You must set the executable permission bit on any file you use as a command. 
-   - Shell scripts must have a [shebang line](https://en.wikipedia.org/wiki/Shebang_\(Unix\)).
-   
-   The `period` setting specifies how frequently Teleport executes each command.
-   In this example, the `uname -p` command is executed every one hour (1h), zero minutes (0m),
-   and zero seconds (0s). This value can't be less than one minute.
-
-1. Save your changes and close the file.
-
-1. Start Teleport with the invitation token you saved in the `INVITE_TOKEN` environment variable:
-
-   ```code
-   $ sudo teleport start --token=${INVITE_TOKEN?}
-   ```
-
-1. Verify that you have added the label by running the following command on your local
-computer. Your Teleport user must be authorized to access the server.
-
-   ```code
-   $ tsh ls
-   ```
-
-   You should see output similar to the following with both the `arch` and `environment` labels displayed:
-
-   ```code
-   Node Name        Address        Labels                                                                                                                   
-   ---------------- -------------- ------------------------------------------------------
-   ip-192-168-13-57 ⟵ Tunnel       arch=x86_64,environment=dev,hostname=ip-192-168-13-57
-   ```
-
-### Apply resource-based labels
-
-Applying resource-based labels is only supported for servers.
-
-You can apply resource-based labels to a Teleport instance by creating a `server_info`
-resource for the instance. For a server with name `<name>`, its matching `server_info`
-should be named `si-<name>`.
-
-To add resource-based labels:
-
-1. Run `tctl get node/NODE_NAME` to get the name of the node resource to apply labels to.
-   You should get output similar to the following:
-
-   ```yaml
-   kind: node
-   metadata:
-      expires: "2024-01-12T00:41:17.355013266Z"
-      id: <id>
-      name: <name-uuid>
-      revision: <revision-uuid>
-   spec:
-      # ...
-   ```
-
-   Save the value of `metadata.name` for the next step.
-
-1. Create the file `server_info.yaml` and paste the following into it:
-
-   ```yaml
-   # server_info.yaml
-   kind: server_info
-   metadata:
-      name: si-<node-name>
-   spec:
-      new_labels:
-         "foo": "bar"
-   ```
-
-   Replace `<node-name>` with the resource name you saved in the previous step.
-   Run the following to create the `server_info` resource:
-
-   ```code
-   $ tctl create server_info.yaml
-   ```
-
-1. Verify that you have added the label by running the following command on your local
-computer. Your Teleport user must be authorized to access the server. Teleport
-applies labels from `server_info` resources gradually to prevent strain on the Auth Service in
-larger clusters, so it may take several minutes for the new labels to appear.
-
-   ```code
-   $ tsh ls
-   ```
-
-   You should see output similar to the following with the `dynamic/foo` label displayed:
-
-   ```code
-   Node Name        Address        Labels                                                                                                                   
-   ---------------- -------------- ------------------------------------------------------
-   ip-192-168-13-57 ⟵ Tunnel       dynamic/foo=bar,hostname=ip-192-168-13-57
-   ```
-
-<Admonition type="warning">
-   All resource-based labels created with `tctl` will have the
-   `dynamic/` prefix. This prefix forbids the label from being used in a
-   role's deny rules.
-</Admonition>
-
-To update resource-based labels, recreate the `server_info` resource with updated labels.
-
-## Next steps
-
-After you have labeled your resources, you can use the labels when running
-`tsh` and `tctl` commands to filter the resources that the commands return.
-For more information, see [Resource filtering](../../../reference/predicate-language.mdx).
-
-You can also use labels to limit the access that users in different roles have to
-
-specific classes of resources. For more information, see
-[Teleport Role Templates](../../access-controls/guides/role-templates.mdx).
-
diff --git a/docs/pages/admin-guides/management/admin/self-signed-certs.mdx b/docs/pages/admin-guides/management/admin/self-signed-certs.mdx
deleted file mode 100644
index 1aa8ff6889b0e..0000000000000
--- a/docs/pages/admin-guides/management/admin/self-signed-certs.mdx
+++ /dev/null
@@ -1,210 +0,0 @@
----
-title: Running Teleport with Self-Signed Certificates
-description: This guide shows you how to run Teleport using self-signed certificates, which is helpful for testing or demo environments.
----
-
-This guide explains how to evaluate Teleport in a
-non-production environment without having to configure TLS certificates.
-We will show you how to run Teleport with self-signed certificates and address
-problems caused by this configuration.
-
-The Teleport Proxy Service authenticates itself to clients via TLS x509 certificates.
-If certificates are not configured for the Proxy Service then it uses self-signed certificates,
-which clients will not trust by default.
-When visiting the cluster's Web UI, the certificate presented will not be trusted by your browser. In this case, 
-you will likely see a page warning you that the website is not trusted.
-
-Additionally, self-signed certificates can prevent `teleport`, `tsh`, and `tctl` from connecting
-to the Proxy Service.
-
-<Admonition type="warning" title="DO NOT USE THIS IN PRODUCTION">
-  **DO NOT USE SELF-SIGNED CERTIFICATES IN PRODUCTION**
-
-  Configuring your cluster to trust self-signed certificates
-  makes it easier for attackers to intercept communications
-  between the Proxy Service and clients, since there is no
-  way to verify the authenticity of the certificates.
-  It is therefore important to properly configure certificates
-  when using Teleport in a production environment.
-</Admonition>
-
-## Prerequisites
-
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-- A running Teleport cluster. For details on how to set this up, see our
-  [Getting Started](../../deploy-a-cluster/linux-demo.mdx) guide (skip TLS certificate setup).
-
-- A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
-For example, this Teleport Proxy Service configuration would use self-signed certs:
-
-  ```yaml
-  proxy_service:
-    enabled: true
-    # TLS certificate for the HTTPS connection.
-    https_keypairs: []
-    # Get an automatic certificate from letsencrypt.org using ACME.
-    acme: {}
-  ```
-
-- (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
-
-  See [Installation](../../../installation.mdx) for details.
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on how to set this up, see our Enterprise
-  [Getting Started](../../deploy-a-cluster/deploy-a-cluster.mdx) guide.
-
-- A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
-For example, this Teleport Proxy Service configuration would use self-signed certs:
-
-  ```yaml
-  proxy_service:
-    enabled: true
-    # TLS certificate for the HTTPS connection.
-    https_keypairs: []
-    # Get an automatic certificate from letsencrypt.org using ACME.
-    acme: {}
-  ```
-
-- (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
-
-</TabItem>
-</Tabs>
-
-## How to use self-signed certs with Teleport binaries and clients
-
-### `teleport`
-
-When running a Teleport service with `teleport`, if the service you are starting is configured to point to
-the Teleport Proxy Service endpoint and the Proxy Service is using self-signed certificates, then `teleport` will need
-to be run with the `--insecure` flag to disable verification of the
-Proxy Service TLS certificate. This is the case when:
-- The Teleport config file `proxy_server` setting is set to the Proxy Service endpoint:
-  - `proxy_server: "tele.example.com:443"` or
-  - `proxy_server: "tele.example.com:3080"`
-- Teleport is started with the `--auth-server` flag pointing to the Proxy Service endpoint:
-  - `teleport [app | db] start --auth-server=tele.example.com:443` or
-  - `teleport [app | db] start --auth-server=tele.example.com:3080`
-
-Instructions for disabling TLS certificate verification depend on how you are
-running Teleport: via the `teleport` CLI, using a Helm chart, or via systemd:
-<Tabs>
-
-    <TabItem label="Using the CLI">
-    When running `teleport` from the command line, pass the `--insecure` flag to disable
-    TLS certificate validation. For example:
-    ```sh
-    $ sudo teleport start -c /etc/teleport.yaml --insecure
-    $ sudo teleport app start -c /etc/teleport.yaml --insecure
-    $ sudo teleport db start -c /etc/teleport.yaml --insecure
-    ```
-    Without the `--insecure` flag, you will see an error message that looks like
-    `x509: “tele.example.com” certificate is not trusted`.
-    </TabItem>
-
-    <TabItem label="Helm chart">
-    If you are using the `teleport-cluster` Helm chart, set
-    [extraArgs](../../../reference/helm-reference/teleport-cluster.mdx)
-    to include the extra argument: `--insecure`.
-
-    Here is an example of the field within a values file:
-
-    ```yaml
-    extraArgs:
-    - "--insecure"
-    ```
-
-    When using the `--set` flag, use the following syntax:
-
-
-      ```text
-      --set "extraArgs={--insecure}"
-      ```
-    
-    If you are using the `teleport-kube-agent` chart, set the 
-    [insecureSkipProxyTLSVerify](../../../reference/helm-reference/teleport-kube-agent.mdx)
-    flag to `true`.
-
-    In a values file, this would appear as follows:
-
-    ```yaml
-    insecureSkipProxyTLSVerify: true
-    ```
-
-    When using the `--set` flag, use the following syntax:
-
-    ```text
-    --set insecureSkipProxyTLSVerify=true
-    ```
-    </TabItem>
-
-    <TabItem label="systemd">
-    Locate the `systemd` unit file for Teleport (called teleport.service) by running the following command:
-    ```sh
-    $ systemctl status teleport
-    ```
-    You will see output similar to the following, including the file path (`/lib/systemd/system/teleport.service`) that contains the unit file for the systemd configuration being applied:
-
-    ```code
-    ● teleport.service - Teleport Service
-        Loaded: loaded (/lib/systemd/system/teleport.service; disabled; vendor preset: enabled)
-        Active: inactive (dead)
-    ```
-
-    Edit the Teleport unit file to include `--insecure` in the `ExecStart` line, for example:
-    ```text
-    ExecStart=/usr/local/bin/teleport start --pid-file=/run/teleport.pid --insecure
-    ```
-    
-    After saving the unit file, you will need to reload the daemon for your changes to take effect:
-    ```sh
-    $ sudo systemctl daemon-reload
-    $ sudo systemctl restart teleport.service
-    ```
-    </TabItem>
-
-</Tabs>
-
-### `tctl`
-When running `tctl` remotely via the Teleport Proxy Service, if the Proxy Service is using self-signed 
-certificates, then `tctl` will not trust the certificate from the Proxy Service.
-To disable certificate verification use the `--insecure` flag when running `tctl` commands.
-
-`tctl` will determine how to connect to the Auth Service in a few ways:
-- loading configuration from a local profile after logging in with `tsh`
-- loading from a config file passed as an argument: `tctl -c /etc/teleport.yaml`
-- passing the `--auth-server` flag directly, as in:
-  - `tctl --auth-server=tele.example.com:443` or
-  - `tctl --auth-server=tele.example.com:3080`
-
-If any of these methods tries to connect via the Teleport Proxy Service, and the Proxy Service is using 
-self-signed certificates, then `tctl` will not trust the certificate from the Proxy Service and you will get an
-error message about
-untrusted or invalid certificates, unless `--insecure` is also passed to `tctl`.
-
-For example: `tctl status --insecure`
-
-### `tsh`
-When running `tsh`, you must specify the Teleport Proxy Service address for `tsh` to connect to.
-If the Teleport Proxy Service is using self-signed certificates, then `tsh` will not trust the Proxy Service 
-certificate.
-In order to use `tsh` in this case, you need to use the `--insecure` flag.
-
-For example: `tsh login --proxy=tele.example.com:443 --user=alice --insecure`
-
-### Teleport Connect
-
-Teleport Connect lets you [skip TLS certificate verification with the `--insecure`
-flag](../../../connect-your-client/teleport-connect.mdx).
-
-## Further reading
-
-- [Configuring Teleport TLS Certs](../../deploy-a-cluster/linux-demo.mdx#configure-teleport)
-- [Run Teleport as a systemd Daemon](./daemon.mdx)
-- [Teleport Proxy Service](../../../reference/architecture/proxy.mdx)
-- [Teleport Authentication](../../../reference/architecture/authentication.mdx)
diff --git a/docs/pages/admin-guides/management/admin/troubleshooting.mdx b/docs/pages/admin-guides/management/admin/troubleshooting.mdx
deleted file mode 100644
index 44f3c31ea542e..0000000000000
--- a/docs/pages/admin-guides/management/admin/troubleshooting.mdx
+++ /dev/null
@@ -1,231 +0,0 @@
----
-title: Troubleshooting
-description: Troubleshooting and Collecting Metrics of Teleport Processes
----
-
-In this guide, we will explain how to address issues or unexpected behavior in your
-Teleport cluster.
-
-You can use these steps to get more visibility into the `teleport` process so
-you can troubleshoot the Auth Service, Proxy Service, and Teleport Agent
-services such as the Application Service and Database Service.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Enable verbose logging
-
-To change log levels in Teleport, you can use either of the following methods:
-
-- Debug Service: Allows on-the-fly log level adjustments without restarting the
-  instance, which is ideal for troubleshooting sessions.
-- Updating configuration: Involves updating the Teleport configuration file and
-  restarting the instance.
-
-<Tabs>
-<TabItem label="Debug Service">
-The Teleport Debug Service allows administrators to dynamically manage log levels
-without restarting the instance. The service, enabled by default, ensures
-local-only access and must be consumed from inside the same instance.
-
-To change the instance log level use the `teleport debug set-log-level` command:
-
-```code
-$ teleport debug set-log-level DEBUG
-Changed log level from "INFO" to "DEBUG".
-
-$ kubectl -n teleport exec my-pod -- teleport debug set-log-level DEBUG
-Changed log level from "INFO" to "DEBUG".
-```
-
-If you're unsure what is the current level you can retrieve it using
-`teleport debug get-log-level`.
-
-After troubleshooting, remember to turn the log level back to avoid generating
-unnecessary logs.
-
-(!docs/pages/includes/diagnostics/teleport-debug-config.mdx!)
-</TabItem>
-
-<TabItem label="Updating configuration">
-To diagnose problems, you can configure the `teleport` process to run with
-verbose logging enabled by passing it the `-d` flag. `teleport` will write logs
-to stderr.
-
-Alternatively, you can set the log level from the Teleport configuration file:
-
-```yaml
-teleport:
-  log:
-    severity: DEBUG
-```
-
-Restart the `teleport` process to apply the modified log level. Logs will resemble
-the following (these logs were printed while joining a server to a cluster, then
-terminating the `teleport` process on the server):
-</TabItem>
-</Tabs>
-
-Debug logs include the file and line number of the code that emitted the log, so
-you can investigate (or report) what a `teleport` process was doing before it ran into
-problems. Here's an example:
-
-```
-DEBU [NODE:PROX] Agent connected to proxy: [aee1241f-0f6f-460e-8149-23c38709e46d.tele.example.com aee1241f-0f6f-460e-8149-23c38709e46d teleport-proxy-us-west-2-6db8db844c-ftmg9.tele.example.com teleport-proxy-us-west-2-6db8db844c-ftmg9 localhost 127.0.0.1 ::1 tele.example.com 100.92.90.42 remote.kube.proxy.teleport.cluster.local]. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:414
-DEBU [NODE:PROX] Changing state connecting -> connected. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:210
-DEBU [NODE:PROX] Discovery request channel opened: teleport-discovery. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:526
-DEBU [NODE:PROX] handleDiscovery requests channel. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:544
-DEBU [NODE:PROX] Pool is closing agent. leaseID:2 target:tele.example.com:11106 reversetunnel/agentpool.go:238
-DEBU [NODE:PROX] Pool is closing agent. leaseID:3 target:tele.example.com:11106 reversetunnel/agentpool.go:238
-```
-
-<Admonition
-  type="warning"
->
-  It is not recommended to run Teleport in production with verbose logging as it
-  generates a substantial amount of data.
-
-</Admonition>
-
-## Step 2/3. Generate a debug dump
-
-The `teleport` binary is a Go program. Go programs assign work to CPU threads
-using an abstraction called a **goroutine**. You can get a goroutine dump of a
-running `teleport` process by sending it a `USR1` signal.
-
-This is especially useful for troubleshooting a `teleport` process that appears
-stuck, since you can see which a goroutine is blocked and and why. For example,
-goroutines often communicate using **channels**, and a goroutine dump indicates
-whether a goroutine is waiting to send or receive on a channel.
-
-To generate a goroutine dump, send a `USR1` signal to a `teleport` process:
-
-```code
-$ kill -USR1 $(pidof teleport)
-```
-
-Teleport will print the debug information to `stderr`. Here what you will see in
-the logs:
-
-```txt
-INFO [PROC:1]    Got signal "user defined signal 1", logging diagnostic info to stderr. service/signals.go:99
-Runtime stats
-goroutines: 64
-OS threads: 10
-GOMAXPROCS: 2
-num CPU: 2
-...
-goroutines: 84
-...
-Goroutines
-goroutine 1 [running]:
-runtime/pprof.writeGoroutineStacks(0x3c2ffc0, 0xc0001a8010, 0xc001011a38, 0x4bcfb3)
-	/usr/local/go/src/runtime/pprof/pprof.go:693 +0x9f
-...
-```
-
-<Admonition type="tip">
-
-You can print a goroutine dump without enabling verbose logging.
-
-</Admonition>
-
-## Step 3/3. Ask for help
-
-Once you have collected verbose logs and a goroutine dump from your `teleport`
-binary, you can use this information to get help from the Teleport community and
-Support team.
-
-### Collect your Teleport version
-
-Determine the version of the `teleport` process you are investigating.
-
-```code
-$ teleport version
-Teleport v8.3.7 git:v8.3.7-0-ga8d066935 go1.17.3
-```
-
-You can also collect the versions of the Teleport Auth Service, Proxy
-Service, and client tools to rule out version compatibility issues.
-
-To see the version of the Auth Service and Proxy Service, run the following
-command:
-
-```code
-$ tctl status
-Cluster  mytenant.teleport.sh
-Version  (=cloud.version=)
-Host CA  never updated
-User CA  never updated
-Jwt CA   never updated
-CA pin   (=presets.ca_pin=)
-```
-
-Get the versions of your client tools:
-
-```code
-$ tctl version
-Teleport v9.0.4 git: go1.18
-$ tsh version
-Teleport v9.0.4 git: go1.18
-```
-
-### Pose your question
-
-<Tabs>
-<TabItem scope={["cloud", "enterprise","team"]} label="Commercial Teleport Editions">
-If you have a question or need assistance please submit a request
-through the [Teleport support portal](https://support.goteleport.com).
-
-</TabItem>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-If you need help, please ask on our [community forum](https://github.com/gravitational/teleport/discussions). You can also open an [issue on GitHub](https://github.com/gravitational/teleport/issues).
-
-For more information about Enterprise features reach out to [the Teleport sales team](https://goteleport.com/signup/enterprise/).
-You can also sign up for a [free trial](https://goteleport.com/signup) of Teleport Enterprise.
-</TabItem>
-</Tabs>
-
-## Further reading
-
-This guide showed how to investigate issues with the `teleport` process. To see
-how you can monitor more general health and performance data from your Teleport
-cluster, read our [Teleport Diagnostics](../diagnostics/monitoring.mdx) guides.
-
-For additional sources of Teleport support, please see the
-[Teleport Support and Education Center](https://goteleport.com/support/).
-
-## Common Issues
-
-### `teleport.cluster.local`
-
-It is common to see references to `teleport.cluster.local` within logs and
-errors in Teleport. This is a special value that is used within Teleport for two
-purposes and seeing it within your logs is not necessarily an indication that
-anything is incorrect.
-
-Firstly, Teleport uses this value within certificates (as a DNS Subject
-Alternative Name) issued to the Auth Service and Proxy Service. Teleport clients can
-then use this value to validate the service's certificates during the TLS
-handshake regardless of the service address as long as the client already has a
-copy of the cluster's certificate authorities. This is important as there are
-often multiple different ways that a client can connect to the Auth Service and
-these are not always via the same address.
-
-Secondly, this value is used by clients as part of the URL when making gRPC or
-HTTP requests to the Teleport API. This is because the Teleport API client uses
-special logic to open the connection to the Auth Service to make the request,
-rather than connecting to a single address as a typical client may do. This
-special logic is necessary for the client to be able to support connecting to a
-list of Auth Service instances or to be able to connect to the Auth Service through a
-tunnel via the Proxy Service. This means that `teleport.cluster.local` appears
-in log messages that show the URL of a request made to the Auth Service, and
-does not explicitly indicate that something is misconfigured.
-
-### `ssh: overflow reading version string` and/or `502: Bad Gateway` errors
-
-(!docs/pages/includes/tls-multiplexing-warnings.mdx!)
-
diff --git a/docs/pages/admin-guides/management/admin/trusted-cluster-address-lookup.mdx b/docs/pages/admin-guides/management/admin/trusted-cluster-address-lookup.mdx
deleted file mode 100644
index 02a022ad5133c..0000000000000
--- a/docs/pages/admin-guides/management/admin/trusted-cluster-address-lookup.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Commands to look up cluster addresses
-description: Suggests command-line tools and scripts to look up cluster addresses.
----
-
-If you aren't sure of what values to use for cluster settings such as the `tunnel_addr` 
-or `web_proxy_addr` in resource configuration files, you can often look up the information 
-using command-line tools that parse and extract machine-readable data from JSON files.
-One of the most common of these tools is `jq`.
-You can download `jq` for most operating systems from the 
-[jqlang](https://jqlang.github.io/jq/download/) website.
-
-After you download the program, you can run commands that use the jq program to look up 
-cluster addresses.
-
-To get cluster addresses:
-
-1. Set the `PROXY` environment variable to retrieve information about your Teleport cluster
-by replacing `teleport.example.com` with your Teleport cluster domain:
-   
-   ```code
-   $ PROXY=teleport.example.com
-   ```
-
-1. Extract the `tunnel_addr` for your cluster by running the following command:
-   
-   ```code
-   $ curl https://$PROXY/webapi/ping | jq 'if .proxy.tls_routing_enabled == true then .proxy.ssh.public_addr else .proxy.ssh.ssh_tunnel_public_addr end'      
-   ```
-
-1. Extract the `web_proxy_addr` for your cluster by running the following command:
-   
-   ```code
-   $ curl https://$PROXY/webapi/ping | jq .proxy.ssh.public_addr
-   ```
\ No newline at end of file
diff --git a/docs/pages/admin-guides/management/admin/uninstall-teleport.mdx b/docs/pages/admin-guides/management/admin/uninstall-teleport.mdx
deleted file mode 100644
index 3b2191e04cfdd..0000000000000
--- a/docs/pages/admin-guides/management/admin/uninstall-teleport.mdx
+++ /dev/null
@@ -1,298 +0,0 @@
----
-title: Uninstall Teleport
-description: How to remove Teleport from your system
----
-
-This guide explains how to uninstall Teleport completely including binaries, configurations and data.
-
-## Prerequisites
-
-- A system with Teleport installed.
-
-<Admonition type="warning">
-These instructions only apply to non-containerized installations of Teleport.
-
-If you are running Teleport in Kubernetes, you should uninstall the Helm chart release instead:
-
-```code
-# Example: uninstall the Helm release named 'teleport-kube-agent' in the 'teleport' namespace
-$ helm uninstall --namespace teleport teleport-kube-agent
-```
-
-If you are running Teleport in Docker, you should stop the Teleport Docker container:
-
-```code
-# Example: Stop the Docker container named 'teleport'
-$ docker stop teleport
-```
-</Admonition>
-
-## Step 1/3. Stop any running Teleport processes
-
-<Tabs>
-  <TabItem label="Linux">
-    Instruct `systemd` to stop the Teleport process, and disable it from automatically starting:
-
-    ```code
-    $ sudo systemctl stop teleport
-    $ sudo systemctl disable teleport
-    ```
-
-    If these `systemd` commands do not work, you can "kill" all the running Teleport processes instead:
-
-    ```code
-    $ sudo killall teleport
-    ```
-  </TabItem>
-  <TabItem label="macOS">
-
-    Instruct `launchd` to stop the Teleport process, and disable it from automatically starting:
-
-    ```code
-    $ sudo launchctl unload -w /Library/LaunchDaemons/com.goteleport.teleport.plist
-    $ sudo rm -f /Library/LaunchDaemons/com.goteleport.teleport.plist
-    ```
-
-   If these commands do not work, you can "kill" all the running Teleport processes instead:
-
-    ```code
-    $ sudo killall teleport
-    ```
-
-  </TabItem>
-  <TabItem label="Windows">
-
-    There are currently no long-running Teleport processes on Windows machines.
-
-  </TabItem>
-</Tabs>
-
-## Step 2/3. Remove Teleport binaries
-
-Follow the steps for your operating system to remove Teleport binaries.
-
-### Linux
-
-Follow the instructions for your Linux distribution:
-
-<Tabs>
-  <TabItem label="Debian/Ubuntu Linux (DEB)">
-
-  Uninstall the Teleport binary using APT:
-
-  ```code
-  $ sudo apt-get -y remove teleport-ent
-  ```
-
-  For Teleport Community Edition, use the following command:
-
-  ```code
-  $ sudo apt-get -y remove teleport
-  ```
-
-  Uninstall the Teleport APT repo:
-
-  ```code
-  $ sudo rm -f /etc/apt/sources.list.d/teleport.list
-  ```
-
-  <Admonition type="note" title="Uninstall standalone DEB package">
-  If the commands above do not work, you may have installed Teleport using a standalone DEB package. Remove it with:
-
-  ```code
-  # Use "teleport" instead of "teleport-ent" for Teleport Community Edition
-  $ sudo dpkg -r teleport-ent
-  ```
-  </Admonition>
-
-  </TabItem>
-  <TabItem label="Amazon Linux 2/RHEL (RPM)">
-
-  Uninstall the Teleport binary using YUM:
-
-  ```code
-  # Change the package name to "teleport" for Teleport Community Edition
-  $ sudo yum -y remove teleport-ent
-  # Optional: Use DNF on newer distributions
-  # $ sudo dnf -y remove teleport-ent
-  ```
-
-  Uninstall the Teleport YUM repo:
-
-  ```code
-  $ sudo rm -f /etc/yum.repos.d/teleport.repo
-  ```
-
-  <Admonition type="note" title="Uninstall standalone RPM package">
-  If the commands above do not work, you may have installed Teleport using a standalone RPM package. Remove it with:
-
-  ```code
-  # Use "teleport" for Teleport Community Edition
-  $ sudo rpm -e teleport-ent
-  ```
-  </Admonition>
-
-  </TabItem>
-  <TabItem label="SUSE Linux Enterprise Server (zypper)">
-
-  Uninstall the Teleport binary using zypper:
-
-  ```code
-  # Change the package name to "teleport" for Teleport Community Edition
-  $ sudo zypper -y remove teleport-ent
-  ```
-
-  Uninstall the Teleport zypper repo:
-
-  ```code
-  $ sudo zypper removerepo teleport
-  ```
-
-  </TabItem>
-  <TabItem label="Linux Tarball">
-
-  <Admonition type="note">
-  These are the default paths to the Teleport binaries. If you have changed these from the defaults on your system, substitute those paths here.
-  You can use `dirname $(which teleport)` to look this up automatically.
-  </Admonition>
-
-  Remove the Teleport binaries from the machine:
-
-  ```code
-  $ sudo rm -f /usr/local/bin/tbot
-  $ sudo rm -f /usr/local/bin/tctl
-  $ sudo rm -f /usr/local/bin/teleport
-  $ sudo rm -f /usr/local/bin/tsh
-  $ sudo rm -f /usr/local/bin/fdpass-teleport
-  ```
-
-  </TabItem>
-</Tabs>
-
-### macOS
-
-  <Admonition type="note">
-  These are the default paths to the Teleport binaries. If you have changed these from the defaults on your system, substitute those paths here.
-  You can use `dirname $(which teleport)` to look this up automatically.
-  </Admonition>
-
-  Remove the Teleport binaries and links to Teleport software from the machine:
-
-  ```code
-  $ sudo rm -f /usr/local/bin/tbot
-  $ sudo rm -f /usr/local/bin/tctl
-  $ sudo rm -f /usr/local/bin/teleport
-  $ sudo rm -f /usr/local/bin/tsh
-  $ sudo rm -f /usr/local/bin/fdpass-teleport
-  ```
-
-  <Admonition type="note" title="Uninstall macOS client tools">
-
-  You may have Teleport software in the `/Applications` folder if you:
-  - Installed from a macOS tarball for v17+ that includes `tsh.app` and `tctl.app`
-  - Installed the macOS `tsh` client-only package for v16 or older versions.
-  - Installed Teleport Connect for macOS  
-     
-  You can remove those with these commands:
-
-  ```code
-  $ sudo rm -rf /Applications/tsh.app
-  $ sudo rm -rf /Applications/tctl.app
-  $ sudo rm -rf /Applications/Teleport\ Connect.app
-  ```
-  </Admonition>
-
-### Windows
-
-  Remove the `tsh.exe` and `tctl.exe` binaries from the machine:
-
-  ```code
-  $ del C:\Path\To\tsh.exe
-  $ del C:\Path\To\tctl.exe
-  ```
-(!docs/pages/includes/uninstall-teleport-connect-windows.mdx!)
-
-(!docs/pages/includes/uninstall-windows-auth.mdx!)
-
-## Step 3/3. Remove Teleport data and configuration files
-
-<Tabs>
-  <TabItem label="Linux">
-    <Admonition type="note">
-    These are the default paths to the Teleport config files and data directory.
-    If you have changed these from the defaults on your system, substitute those paths here.
-    </Admonition>
-
-    Remove the Teleport config file:
-
-    ```code
-    $ sudo rm -f /etc/teleport.yaml
-    # Optional: Also remove the Machine ID config file, if you used it
-    # $ sudo rm -f /etc/tbot.yaml
-    ```
-
-    Remove the Teleport data directory:
-
-    ```code
-    $ sudo rm -rf /var/lib/teleport
-    ```
-
-     Optionally, also remove the global config file and local user data directory for `tsh`:
-
-    ```code
-    $ sudo rm -f /etc/tsh.yaml
-    $ rm -rf ~/.tsh
-    ```
-  </TabItem>
-  <TabItem label="MacOS">
-    <Admonition type="note">
-    These are the default paths to the Teleport config files and data directory.
-    If you have changed these from the defaults on your system, substitute those paths here.
-    </Admonition>
-
-    Remove the Teleport config file:
-
-    ```code
-    $ sudo rm -f /etc/teleport.yaml
-    # Optional: Also remove the Machine ID config file, if you used it
-    # $ sudo rm -f /etc/tbot.yaml
-    ```
-
-    Remove the Teleport data directory:
-
-    ```code
-    $ sudo rm -rf /var/lib/teleport
-    ```
-
-    Optionally, also remove:
-    - the global config file and local user data directory for `tsh`
-    - the local user data directory for Teleport Connect
-
-    ```code
-    # tsh
-    $ sudo rm -f /etc/tsh.yaml
-    $ rm -rf ~/.tsh
-    # Teleport Connect
-    $ rm -rf ~/Library/Application\ Support/Teleport\ Connect
-    ```
-  </TabItem>
-  <TabItem label="Windows">
-
-   Remove the local user data directory for `tsh`:
-
-   ```code
-   $ rmdir /s /q %USERPROFILE%\.tsh
-   ```
-
-   Optionally, also remove the local user data directory for Teleport Connect:
-
-   ```code
-   $ rmdir /s /q "%APPDATA%\Teleport Connect"
-   ```
-
-  </TabItem>
-</Tabs>
-
-Teleport is now removed from your system.
-
-Any Teleport services will stop appearing in your Teleport Web UI or the output of `tsh ls` once their last heartbeat has timed out. This usually occurs within 10-15 minutes of stopping the Teleport process.
diff --git a/docs/pages/admin-guides/management/admin/users.mdx b/docs/pages/admin-guides/management/admin/users.mdx
deleted file mode 100644
index 0ae4068bcc5e1..0000000000000
--- a/docs/pages/admin-guides/management/admin/users.mdx
+++ /dev/null
@@ -1,138 +0,0 @@
----
-title: Local Users
-description: Learn how to manage local users in Teleport. Local users are stored on the Auth Service instead of a third-party identity provider.
----
-
-In Teleport, **local users** are users managed directly via Teleport, rather
-than a third-party identity provider. All local users are stored in Teleport's
-cluster state backend, which contains the user's name, their roles and traits,
-and a bcrypt password hash.
-
-This guide shows you how to:
-
-- [Add local users](./users.mdx#adding-local-users)
-- [Edit existing users](./users.mdx#editing-users)
-- [Delete users](./users.mdx#deleting-users)
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Adding local users
-
-A user identity in Teleport exists in the scope of a cluster.
-A Teleport administrator creates Teleport user accounts and maps them to the roles they can use.
-
-Let's look at this table:
-
-| Teleport User | Allowed OS Logins | Description |
-| - | - | - |
-| `joe` | `joe`, `root` | Teleport user `joe` can log in to member Nodes as user `joe` or `root` on the OS. |
-| `bob` | `bob` | Teleport user `bob` can log in to member Nodes only as OS user `bob`. |
-| `kim` | | If no OS login is specified, it defaults to the same name as the Teleport user, `kim`. |
-
-Let's add a new user to Teleport using the `tctl` tool:
-
-<Tabs>
-<TabItem scope={["oss"]} label="Teleport Community Edition">
-```code
-$ tctl users add joe --logins=joe,root --roles=access,editor
-```
-</TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
-```code
-$ tctl users add joe --logins=joe,root --roles=access,editor,reviewer
-```
-</TabItem>
-
-</Tabs>
-
-Teleport generates an auto-expiring token (with a TTL of one hour) and prints
-the token URL, which must be used before the TTL expires.
-
-```code
-User "joe" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://<proxy_host>:443/web/invite/<token>
-
-NOTE: Make sure <proxy_host>:443 points at a Teleport proxy which users can access.
-```
-
-The user completes registration by visiting this URL in their web browser,
-picking a password, and configuring multi-factor authentication. If the
-credentials are correct, the Teleport Auth Service generates and signs a new
-certificate, and the client stores this key and will use it for subsequent
-logins.
-
-The key will automatically expire after 12 hours by default, after which
-the user will need to log back in with their credentials. This TTL can be
-configured to a different value.
-
-Once authenticated, the account will become visible via `tctl`:
-
-```code
-$ tctl users ls
-
-# User           Allowed Logins
-# ----           --------------
-# admin          admin,root
-# kim            kim
-# joe            joe,root
-```
-
-## Editing users
-
-Admins can edit user entries via `tctl`.
-
-For example, to see the full list of user records, an administrator can execute:
-
-```code
-$ tctl get users
-```
-
-To edit the user `joe`, run the following command:
-
-```code
-$ tctl edit user/joe
-```
-
-Make your changes, then save and close the file in your editor to apply them.
-
-## Deleting users
-
-Admins can delete a local user via `tctl`:
-
-```code
-$ tctl users rm joe
-```
-
-## Next steps
-
-<Tabs>
-<TabItem scope={["enterprise", "cloud"]} label="Teleport Enterprise/Enterprise Cloud">
-
-In addition to users, you can use `tctl` to manage roles and other dynamic
-resources. See our [Teleport Resources Reference](../../../reference/resources.mdx).
-
-For all available `tctl` commands and flags, see our [CLI Reference](../../../reference/cli/tctl.mdx).
-
-You can also configure Teleport so that users can log in using an SSO provider.
-For more information, see:
-
-- [Single Sign-On](../../access-controls/sso/sso.mdx)
-
-</TabItem>
-<TabItem label="Teleport Community Edition">
-
-In addition to users, you can use `tctl` to manage roles and other dynamic
-resources. See our [Teleport Resources Reference](../../../reference/resources.mdx).
-
-For all available `tctl` commands and flags, see our
-[CLI Reference](../../../reference/cli/tctl.mdx).
-
-You can also configure Teleport so that users can log in using GitHub. For more
-information, see [GitHub SSO](../../access-controls/sso/github-sso.mdx).
-
-</TabItem>
-</Tabs>
diff --git a/docs/pages/admin-guides/management/diagnostics/metrics.mdx b/docs/pages/admin-guides/management/diagnostics/metrics.mdx
deleted file mode 100644
index df6ced5db6cb9..0000000000000
--- a/docs/pages/admin-guides/management/diagnostics/metrics.mdx
+++ /dev/null
@@ -1,205 +0,0 @@
----
-title: Key Metrics for Self-Hosted Clusters
-description: Describes important metrics to monitor if you are self-hosting Teleport.
-tocDepth: 3
----
-
-This guide explains the metrics you should use to get started monitoring your
-self-hosted Teleport cluster, focusing on metrics reported by the Auth Service
-and Proxy Service. If you use Teleport Enterprise (Cloud), the Teleport team
-monitors and responds to these metrics for you.
-
-For a reference of all available metrics, see the [Teleport Metrics
-Reference](../../../reference/monitoring/metrics.mdx).
-
-This guide assumes that you already monitor compute resources on all instances
-that run the Teleport Auth Service and Proxy Service (e.g., CPU, memory, disk,
-bandwidth, and open file descriptors).
-
-## Enabling metrics
-
-(!docs/pages/includes/diagnostics/diag-addr-prereqs-tabs.mdx!)
-
-This will enable the `http://127.0.0.1:3000/metrics` endpoint, which serves the
-metrics that Teleport tracks. It is compatible with [Prometheus](https://prometheus.io/) collectors.
-
-## Backend operations
-
-A Teleport cluster cannot function if the Auth Service does not have a healthy
-cluster state backend. You need to track the ability of the Auth Service to read
-from and write to its backend. 
-
-The Auth Service can connect to [several possible
-backends](../../../reference/backends.mdx). In addition to Teleport backend
-metrics, you should set up monitoring for your backend of choice so that, if
-these metrics show problematic values, you can correlate them with metrics on
-your backend infrastructure.
-
-### Backend operation throughput and availability
-
-On each backend operation, the Auth Service increments a metric. Backend
-operation metrics have the following format:
-
-```text
-teleport_backend_<METRIC_NAME>[_failed]_total
-```
-
-If an operation results in an error, the Auth Service adds the `_failed` segment
-to the metric name. For example, successfully creating a record increments the
-`teleport_backend_write_requests_total` metric. If the create operation fails,
-the Auth Service increments `teleport_backend_write_requests_failed_total`
-instead.
-
-The following backend operation metrics are available:
-
-|Operation|Incremented metric name|
-|---|---|
-|Create an item|`write_requests`|
-|Modify an item, creating it if it does not exist|`write_requests`|
-|Update an item|`write_requests`|
-|Conditionally update an item if versions match|`write_requests`|
-|List a range of items|`batch_read_requests`|
-|Get a single item|`read_requests`|
-|Compare and swap items|`write_requests`|
-|Delete an item|`write_requests`|
-|Conditionally delete an item if versions match|`write_requests`|
-|Write a batch of updates atomically, failing the write if any update fails|Both `write_requests` and `atomic_write_requests`|
-|Delete a range of items|`batch_write_requests`|
-|Update the keepalive status of an item|`write_requests`|
-
-During failed backend writes, a Teleport process also increments the
-`backend_write_requests_failed_precondition_total` metric if the cause of the
-failure is expected. For example, the metric increments during a create
-operation if a record already exists, during an update or delete operation if
-the record is not found, and during an atomic write if the resource was modified
-concurrently. All of these conditions can hold in a well-functioning Teleport
-cluster. 
-
-`backend_write_requests_failed_precondition_total`  increments whenever
-`backend_write_requests_failed_total` increments, and you can use it to
-distinguish potentially expected write failures from unexpected, problematic
-ones.
-
-You can use backend operation metrics to define an availability formula, i.e.,
-the percentage of reads or writes that succeeded. For example, in Prometheus,
-you can define a query similar to the following. This takes the percentage of
-write requests that failed for unexpected reasons and subtracts it from 1 to get
-a percentage of successful writes:
-
-```
-1- (sum(rate(backend_write_requests_failed_total -sum(rate(teleport_backend_write_requests_failed_precondition_total)) / sum(rate(backend_write_requests_total))
-```
-
-If your backend begins to appear unavailable, you can investigate your backend
-infrastructure.
-
-### Backend operation performance
-
-To help you track backend operation performance, the Auth Service also exposes
-Prometheus [histogram metrics](https://prometheus.io/docs/practices/histograms/)
-for read and write operations:
-
-- `teleport_backend_read_seconds_bucket`
-- `teleport_backend_write_seconds_bucket`
-- `teleport_backend_batch_write_seconds_bucket`
-- `teleport_backend_batch_read_seconds_bucket`
-- `teleport_backend_atomic_write_seconds_bucket`
-
-The backend throughput metrics discussed in the previous section map on to
-latency metrics. Whenever the Auth Service increments one of the throughput
-metrics, it reports one of the corresponding latency metrics. See the table
-below for which throughput metrics map to which latency metrics. Each metric
-name excludes the standard prefixes and suffixes.
-
-|Throughput|Latency|
-|---|---|
-|`read_requests`|`read_seconds_bucket`|
-|`read_requests`|`write_seconds_bucket`|
-|`batch_read_requests`|`batch_write_seconds_bucket`|
-|`batch_write_requests`|`batch_read_seconds_bucket`|
-|`atomic_write_requests`|`atomic_write_seconds_bucket`|
-
-## Agents and connected resources
-
-To enable users to access most infrastructure with Teleport, you must join a
-[Teleport Agent](../../../enroll-resources/agents/agents.mdx) to your Teleport
-cluster and configure it to proxy your infrastructure. In a typical setup, an
-Agent establishes an SSH reverse tunnel with the Proxy Service. User traffic to
-Teleport-protected resources flows through the Proxy Service, an Agent, and
-finally the infrastructure resource the Agent proxies. Return traffic from the
-resource takes this path in reverse.
-
-### Number of connected resources by type
-
-Teleport-connected resources periodically send heartbeat (keepalive) messages to
-the Auth Service. The Auth Service uses these heartbeats to track the number of
-Teleport-protected resources by type with the `teleport_connected_resources`
-metric. 
-
-The Auth Service tracks this metric for the following resources:
-
-- SSH servers
-- Kubernetes clusters
-- Applications
-- Databases
-- Teleport Database Service instances
-- Windows desktops
-
-You can use this metric to:
-- Compare the number of resources that are protected by Teleport with those that
-  are not so you can plan your Teleport rollout, e.g., by configuring [Auto
-  Discovery](../../../enroll-resources/auto-discovery/auto-discovery.mdx).
-- Correlate changes in Teleport usage with resource utilization on Auth Service
-  and Proxy Service compute instances to determine scaling needs.
-
-You can include this query in your Grafana configuration to break this metric
-down by resource type:
-
-```text
-sum(teleport_connected_resources) by (type)
-```
-
-### Reverse tunnels by type
-
-Every Teleport service that starts up establishes an SSH reverse tunnel to the
-Proxy Service. (Self-hosted clusters can configure Agent services to connect to
-the Auth Service directly without establishing a reverse tunnel.) The Proxy
-Service tracks the number of reverse tunnels using the metric,
-`teleport_reverse_tunnels_connected`.
-
-With an improperly scaled Proxy Service pool, the Proxy Service can become a
-bottleneck for traffic to Teleport-protected resources. If Proxy Service
-instances display heavy utilization of compute resources while the number of
-connected infrastructure resources is high, you can consider scaling out your
-Proxy Service pool and using [Proxy Peering](../operations/proxy-peering.mdx).
-
-Use the following Grafana query to track the maximum number of reverse tunnels
-by type over a given interval:
-
-```text
-max(teleport_reverse_tunnels_connected) by (type))
-```
-
-## Teleport instance versions
-
-At regular intervals (around 7 seconds with jitter), the Auth Service refreshes
-its count of registered Teleport instances, including Agents and Teleport
-processes that run the Auth Service and Proxy Service. You can measure this
-count with the metric, `teleport_registered_servers`. To get the number of
-registered instances by version, you can use this query in Grafana:
-
-```text
-sum by (version)(teleport_registered_servers)
-```
-
-You can use this metric to tell how many of your registered Teleport instances
-are behind the version of the Auth Service and Proxy Service, which can help you
-identify any that are at risk of violating the Teleport [version compatibility
-guarantees](../../../upgrading/overview.mdx). 
-
-We strongly encourage self-hosted Teleport users to enroll their Agents in
-automatic updates. You can track the count of Teleport Agents that are not
-enrolled in automatic updates using the metric, `teleport_enrolled_in_upgrades`.
-[Read the documentation](../../../upgrading/agent-managed-updates.mdx) for how
-to enroll Agents in automatic updates.
-
diff --git a/docs/pages/admin-guides/management/diagnostics/monitoring.mdx b/docs/pages/admin-guides/management/diagnostics/monitoring.mdx
deleted file mode 100644
index 9f885f6974c41..0000000000000
--- a/docs/pages/admin-guides/management/diagnostics/monitoring.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Health Monitoring
-description: Monitoring health and readiness.
----
-
-Teleport provides health checking mechanisms in order to verify that it
-is healthy and ready to serve traffic. These can be used by things like
-Kubernetes probes to monitor the health of a Teleport process.
-
-## Enable health monitoring
-
-(!docs/pages/includes/diagnostics/diag-addr-prereqs-tabs.mdx!)
-
-Now you can collect monitoring information from several endpoints.
-
-## `/healthz`
-
-The `http://127.0.0.1:3000/healthz` endpoint responds with a body of
-`{"status":"ok"}` and an HTTP 200 OK status code if the process is running.
-
-This is a simple check, suitable for determining if the Teleport process is
-still running.
-
-## `/readyz`
-
-The `http://127.0.0.1:3000/readyz` endpoint is similar to `/healthz`, but its
-response includes information about the state of the process.
-
-The response body is a JSON object of the form:
-
-```
-{ "status": "a status message here"}
-```
-
-### `/readyz` and heartbeats
-
-If a Teleport component fails to execute its heartbeat procedure, it will enter
-a degraded state. Teleport will begin recovering from this state when a
-heartbeat completes successfully.
-
-The first successful heartbeat will transition Teleport into a recovering state.
-
-A second consecutive successful heartbeat will cause Teleport to transition to
-the OK state.
-
-Teleport heartbeats run approximately every 60 seconds when healthy, and failed
-heartbeats are retried approximately every 5 seconds. This means that depending
-on the timing of heartbeats, it can take 60-70 seconds after connectivity is
-restored for `/readyz` to start reporting healthy again.
-
-### Status codes
-
-The status code of the response can be one of:
-
-- HTTP 200 OK: Teleport is operating normally
-- HTTP 503 Service Unavailable: Teleport has encountered a connection error and
-  is running in a degraded state. This happens when a Teleport heartbeat fails.
-- HTTP 400 Bad Request: Teleport is either entering its initial startup phase or
-  has begun recovering from a degraded state.
-
-The same state information is also available via the `process_state` metric
-under the `/metrics` endpoint.
diff --git a/docs/pages/admin-guides/management/export-audit-events/datadog.mdx b/docs/pages/admin-guides/management/export-audit-events/datadog.mdx
deleted file mode 100644
index 097cf861a5a07..0000000000000
--- a/docs/pages/admin-guides/management/export-audit-events/datadog.mdx
+++ /dev/null
@@ -1,210 +0,0 @@
----
-title: Export Teleport Audit Events with Datadog
-description: How to configure the Teleport Event Handler plugin and Fluentd to send audit logs to Datadog
----
-
-Datadog is a SAAS monitoring and security platform. In this guide, we'll explain
-how to forward Teleport audit events to Datadog using Fluentd.
-
-## How it works
-
-The Teleport Event Handler authenticates to the Teleport Auth Service to receive
-audit events over a gRPC stream, then sends those events to Fluentd as JSON
-payloads over a secure channel established via mutual TLS:
-
-![Architecture of the setup shown in this guide](../../../../img/management/datadog-diagram.png)
-
-Since the Datadog Agent can only receive logs from remote sources as
-JSON-encoded bytes over a [TCP or UDP
-connection](https://docs.datadoghq.com/agent/logs/?tab=tailfiles#custom-log-collection),
-the Teleport Event Handler needs to send its HTTPS payloads without using the
-Datadog Agent. Fluentd handles authentication to the Datadog API.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
-
-- A [Datadog](https://www.datadoghq.com/) account.
-- A server, virtual machine, Kubernetes cluster, or Docker environment to run the
-  Event Handler. The instructions below assume a local Docker container for testing.
-- Fluentd version v(=fluentd.version=) or greater. The Teleport Event Handler
-  will create a new `fluent.conf` file you can integrate into an existing Fluentd
-  system, or use with a fresh setup.
-
-The instructions below demonstrate a local test of the Event Handler plugin on
-your workstation. You will need to adjust paths, ports, and domains for other
-environments.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/6. Install the Event Handler plugin
-
-The Teleport Event Handler runs alongside the Fluentd forwarder, receives events
-from Teleport's events API, and forwards them to Fluentd.
-
-(!docs/pages/includes/install-event-handler.mdx!)
-
-## Step 2/6. Generate a plugin configuration
-
-(!docs/pages/includes/configure-event-handler.mdx!)
-
-## Step 3/6. Create a user and role for reading audit events
-
-(!docs/pages/includes/plugins/event-handler-role-user.mdx!)
-
-## Step 4/6. Create teleport-event-handler credentials
-
-The Teleport Event Handler needs credentials to authenticate to the Teleport
-Auth Service. In this section, you will give the Event Handler access to these
-credentials.
-
-### Enable issuing of credentials for the Event Handler role
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/rbac-impersonate-event-handler.mdx!)
-</TabItem>
-</Tabs>
-
-### Export an identity file for the Event Handler plugin user
-
-Give the plugin access to a Teleport identity file. We recommend using Machine
-ID for this in order to produce short-lived identity files that are less
-dangerous if exfiltrated, though in demo deployments, you can generate
-longer-lived identity files with `tctl`:
-
-<Tabs>
-<TabItem label="Machine ID">
-(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
-</TabItem>
-<TabItem label="Long-lived identity files">
-(!docs/pages/includes/plugins/identity-export.mdx user="teleport-event-handler" secret="teleport-event-handler-identity"!)
-</TabItem>
-</Tabs>
-
-## Step 5/6. Install the Fluentd output plugin for Datadog
-
-In order for Fluentd to communicate with Datadog, it requires the [Fluentd output
-plugin for Datadog](https://github.com/DataDog/fluent-plugin-datadog). Install
-the plugin on your Fluentd host using either `gem` or the `td-agent`, if installed:
-
-```code
-# Using Gem
-$ gem install fluent-plugin-datadog
-
-# Using td-agent
-$ /usr/sbin/td-agent-gem install fluent-plugin-datadog
-```
-
-<Admonition type="tip" title="Testing Locally?">
-
-If you're running Fluentd in a local Docker container for testing, you can adjust
-the entrypoint to an interactive shell as the root user, so you can install the
-plugin before starting Fluentd:
-
-```code
-$ docker run -u $(id -u root):$(id -g root) -p 8888:8888 -v $(pwd):/keys -v \
-$(pwd)/fluent.conf:/fluentd/etc/fluent.conf --entrypoint=/bin/sh -i --tty  fluent/fluentd:edge
-# From the container shell:
-$ gem install fluent-plugin-datadog
-$ fluentd -c /fluentd/etc/fluent.conf
-```
-
-</Admonition>
-
-### Configure Fluentd
-
-1. Visit Datadog and generate an API key for Fluentd by following the [Datadog
-   documentation](https://docs.datadoghq.com/account_management/api-app-keys).
-
-1. Copy the API key and use it to add a new `<match>` block to `fluent.conf`:
-
-   ```ini
-   <match test.log>
-   
-     @type datadog
-     @id awesome_agent
-     api_key (=presets.tokens.first=)
-   
-     host http-intake.logs.us5.datadoghq.com
-   
-     # Optional parameters
-     dd_source teleport
-   
-   </match>
-   ```
-
-1. Edit your configuration as follows:
-
-   - Add your API key to the `api_key` field.
-   - Adjust the `host` value to match your Datadog site. See the Datadog [Log
-     Collection and
-     Integrations](https://docs.datadoghq.com/logs/log_collection/?tab=host)
-     guide to determine the correct value.
-   - `dd_source` is an optional field you can use to filter these logs in the
-     Datadog UI.
-   - Adjust `ca_path`, `cert_path` and `private_key_path` to point to the
-     credential files generated earlier. If you're testing locally, the Docker
-     command above already mounted the current working directory to `keys/` in
-     the container.
-
-1. Restart Fluentd after saving the changes to `fluent.conf`.
-
-## Step 6/6. Run the Teleport Event Handler plugin
-
-In this section, you will modify the Event Handler configuration you generated
-and run the Event Handler to test your configuration.
-
-### Configure the Event Handler
-
-In this section, you will configure the Teleport Event Handler for your
-environment.
-
-(!docs/pages/includes/plugins/finish-event-handler-config.mdx!)
-
-Next, modify the configuration file as follows:
-
-(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
-
-(!docs/pages/includes/plugins/machine-id-exporter-config.mdx!)
-
-### Start the Teleport Event Handler
-
-(!docs/pages/includes/start-event-handler.mdx!)
-
-The Logs view in Datadog should now report your Teleport cluster events:
-
-![Datadog Logs](../../../../img/management/datadog-logs.png)
-
-## Troubleshooting connection issues
-
-If the Teleport Event Handler is displaying error logs while connecting to your
-Teleport Cluster, ensure that:
-
-- The certificate the Teleport Event Handler is using to connect to your
-  Teleport cluster is not past its expiration date. This is the value of the
-  `--ttl` flag in the `tctl auth sign` command, which is 12 hours by default.
-- Ensure that in your Teleport Event Handler configuration file
-  (`teleport-event-handler.toml`), you have provided the correct host *and* port
-  for the Teleport Proxy Service.
-
-## Next steps
-
-- Read more about
-[impersonation](../../access-controls/guides/impersonation.mdx)
-here.
-- While this guide uses the `tctl auth sign` command to issue credentials for the
-Teleport Event Handler, production clusters should use Machine ID for safer,
-more reliable renewals. Read [our guide](../../../enroll-resources/machine-id/getting-started.mdx)
-to getting started with Machine ID.
-- To see all of the options you can set in the values file for the
-`teleport-plugin-event-handler` Helm chart, consult our [reference
-guide](../../../reference/helm-reference/teleport-plugin-event-handler.mdx).
-- Review the Fluentd output plugin for Datadog [README
-file](https://github.com/DataDog/fluent-plugin-datadog/blob/master/README.md)
-to learn how to customize the log format entering Datadog.
diff --git a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/guide.mdx b/docs/pages/admin-guides/management/guides/aws-iam-identity-center/guide.mdx
deleted file mode 100644
index 7d3774b3aa6b0..0000000000000
--- a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/guide.mdx
+++ /dev/null
@@ -1,323 +0,0 @@
----
-title: Getting Started with AWS IAM Identity Center integration
-description: Explains how to set up and use Teleport AWS IAM Identity Center integration.
----
-
-Teleport's integration with [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/)
-allows you to organize and manage your users' short- and long-term access to AWS
-accounts and their permissions.
-
-## Prerequisites
-
-- Teleport Enterprise or Teleport Enterprise Cloud cluster version 17.0 or higher.
-- Administrative access to AWS IAM Identity Center.
-
-Note that Identity Center integration requires using Teleport as an external
-identity source.
-
-As such, we recommend ensuring that all Identity Center users have access to
-your Teleport cluster before turning the integration on to avoid access
-interruption. If your Identity Center already uses external identity source,
-you can configure the corresponding [SSO connector](../../../access-controls/sso/sso.mdx)
-in Teleport or, if you're using Okta, enable the
-[Okta integration](../../../access-controls/okta/okta.mdx).
-
-## Step 1/6. Configure AWS integration
-
-Teleport provides a guided web UI based configuration flow for the Identity
-Center integration. To get started, navigate to the "Add new integration" page
-in your Teleport cluster control panel and select "AWS Identity Center".
-
-![Pick Identity Center integration](../../../../../img/identity-center/ic-pick-integration.png)
-
-During this step, you will set up Teleport as an OIDC identity provider for
-your AWS account and create an AWS role with the permissions required for the
-integration to function, such as fetching Identity Center accounts, users,
-groups, permission set assignments, and so on.
-
-<details>
-<summary>Full list of IAM permissions required by Identity Center integration</summary>
-```
-// ListAccounts
-organizations:ListAccounts
-organizations:ListAccountsForParent
-
-// ListGroupsAndMembers
-identitystore:ListUsers
-identitystore:ListGroups
-identitystore:ListGroupMemberships
-
-// ListPermissionSetsAndAssignments
-sso:DescribeInstance
-sso:DescribePermissionSet
-sso:ListPermissionSets
-sso:ListAccountAssignmentsForPrincipal
-sso:ListPermissionSetsProvisionedToAccount
-
-// CreateAndDeleteAccountAssignment
-sso:CreateAccountAssignment
-sso:DescribeAccountAssignmentCreationStatus
-sso:DeleteAccountAssignment
-sso:DescribeAccountAssignmentDeletionStatus
-iam:AttachRolePolicy
-iam:CreateRole
-iam:GetRole
-iam:ListAttachedRolePolicies
-iam:ListRolePolicies
-
-// AllowAccountAssignmentOnOwner
-iam:GetSAMLProvider
-
-// ListProvisionedRoles
-iam:ListRoles
-```
-</details>
-
-![Configure AWS integration](../../../../../img/identity-center/ic-step1.1.png)
-
-Enter required information such as Identity Center region, ARN and integration
-name, and execute the generated command in the Cloud Shell.
-
-After the script has run, fill out the ARN for the role created by the script.
-
-![Run script for AWS integration](../../../../../img/identity-center/ic-step1.2.png)
-
-## Step 2/6. Preview AWS resources
-
-On the next step, you are presented with the list of AWS accounts, groups, and
-permission sets that Teleport was able to find in your Identity Center.
-
-![Preview AWS resources](../../../../../img/identity-center/ic-step2.png)
-
-Pick the default owners that should be assigned to the Access Lists in Teleport.
-These resources will be imported into Teleport once the plugin is installed.
-
-## Step 3/6. Configure identity source
-
-<Admonition type="warning">
-After this step, Teleport will become your Identity Center's identity provider.
-
-To avoid access interruptions, we recommend making sure that all existing
-Identity Center users have access to your Teleport cluster by, for example, using
-the same [IdP](../../../access-controls/sso/sso.mdx) as your current Identity Center
-external identity source.
-</Admonition>
-
-Follow the instructions to change your Identity Center's identity source to
-Teleport.
-
-![Configure identity source](../../../../../img/identity-center/ic-step3.png)
-
-## Step 4/6. Enable SCIM
-
-The final step is to enable the SCIM endpoint in your Identity Center to
-allow Teleport to push user and group changes.
-
-![Enable SCIM](../../../../../img/identity-center/ic-step4.png)
-
-Make sure to test SCIM connection after enabling it.
-
-## Step 5/6. Verify the integration
-
-Navigate to the Access Lists view page in your cluster and make sure that all
-your Identity Center groups have been imported.
-
-<Admonition type="note">
-It may take a few minutes for the initial sync to complete.
-</Admonition>
-
-![Access Lists view](../../../../../img/identity-center/ic-lists.png)
-
-Imported Access Lists should show the same members as their corresponding
-Identity Center groups.
-
-## Step 6/6. Connect to AWS
-
-Once the integration is up and running, you will see an application named
-`aws-identity-center` among your resources:
-
-![Connect to AWS SSO portal](../../../../../img/identity-center/ic-app.png)
-
-Clicking the "Log In" button for this app takes you to your Identity Center
-SSO start page which you can use to pick a role and connect to your AWS account
-as usual.
-
-## Usage scenarios
-
-Let's take a look at some common usage scenarios enabled by the Identity Center
-integration.
-
-### Managing Account Assignments with Access Lists
-
-Teleport creates an Access List for each group imported from the Identity Center
-instance, with group members becoming Access List members. Default Access List 
-owners are configured during the initial integration enrollment flow and can be
-adjusted as necessary after the initial sync completes.
-
-Each imported Access List is automatically assigned a role (or a set of roles)
-that grant all members of that list access to all of the Account Assignments
-assigned to the corresponding AWS Identity Center group during the integration
-setup. 
-
-These Teleport-generated roles each represent a single Account Assignment, and
-are named using `<permission-set-name>-on-<account-name>-<account-id>` convention
-(e.g. `AdministratorAccess-on-MyAccount-012345678`). 
-
-<Admonition type="warning">
-These roles are considered system roles, and any edits or updates to them will
-be automatically reverted. 
-</Admonition>
-
-To give a user permission granted by an already-existing Identity Center synced
-Access List, an owner can add that user as a member which makes Teleport to add
-the user to its corresponding Identity Center group.
-
-<Admonition type="warning">
-Currently all existing Teleport users are synced to Identity Center. Label-based
-user filtering will be supported in a later release.
-</Admonition>
-
-Removing a member from an Identity Center synced Access List removes them
-from the corresponding Identity Center group effectively revoking privileges.
-
-In addition to membership changes, Teleport propagates changes in Access List
-grants back to Identity Center as well. For example, imagine an Access List with
-the roles `AdminAccess-on-my-account` and `ReadOnlyAccess-on-my-account`. If the
-Access List owner removes the `AdminAccess-on-my-account` role from the Access Lists,
-that change will be propagated back to AWS and the corresponding Identity Center
-group will have its assignments updated to remove the `AdminAccess` Permission 
-
-### Just-in-time Access with Resource Access Requests
-
-Teleport represents the imported AWS accounts as apps in the Teleport Resource
-View, with the permission sets available for each account bundled up inside the
-app. AWS accounts are treated the same as any other Teleport-managed resource, 
-so users can see what AWS permission sets they are allowed to request just by
-checking "Show requestable resources" in the resource view. 
-
-Users can then choose the specific Account Assignments they want access to by 
-selecting from the Permission Sets available to each AWS Account. Users
-can mix Permission Sets from multiple AWS Accounts, and even include other 
-Teleport-managed resources if necessary.
-
-![Selecting Identity Center resources](../../../../../img/identity-center/ic-select-ps.png)
-
-Once the used has selected their desired Account Assignments, the Access Request
-submission and review process is the same as for any other Teleport-managed
-resource. Assuming the Access Request is approved, Teleport will create the
-appropriate AWS Account Assignments in Identity Center to grant the requested
-access. These AWS Account Assignments will automatically be deleted when the
-Access Request expires.
-
-The user can access their temporary AWS Accounts and Roles from within Teleport
-by assuming the Access Request roles. 
-
-![Assumed Role granting Identity Center Account Assignments](../../../../../img/identity-center/ic-role-assumed.png)
-
-<Admonition type="warning">
-The AWS Account Assignments will exist for the lifetime of the Access Request,
-regardless of when the user assumes the associated role(s).
-</Admonition>
-
-### Just-in-time access with role Access Requests
-
-The Identity Center integration allows Teleport users to submit Access Requests for short-term privilege elevation.
-
-When an Access Request for a role granting Identity Center privileges is
-approved, Teleport creates an individual assignment for that user in the
-Identity Center. The assignment is deleted when the Access Request expires.
-
-### Long-term access with Access Requests
-
-If a user requests access to Account Assignments that can also be granted via an
-existing Access List, Teleport will offer the reviewer the option of *promoting*
-the Access Request to long-term access.
-
-![Promoting Access Request](../../../../../img/identity-center/ic-promote.png)
-
-When an Access Request is promoted to long-term access, the requesting user is
-added to the targeted Access List. This membership change is propagated to the
-corresponding Identity Center group, and the user is then granted their requested
-Account Assignments via group membership.
-
-### Creating custom Identity Center roles
-
-You can craft your own roles that bind Identity Center accounts to permission
-sets, for example:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: aws-dev-access
-spec:
-  allow:
-    account_assignments:
-    - account: "<account_id>" # AWS identity center account ID
-      # permission set ARN of AdministratorAccess
-      permission_set: arn:aws:sso:::permissionSet/ssoins-1234/ps-5678
-    - account: "<account_id>"
-      # permission set ARN of ReadOnlyAccess
-      permission_set: arn:aws:sso:::permissionSet/ssoins-1234/ps-8765 
-```
-
-These roles can be assigned to users and Access Lists or requested by users
-using Access Requests flow described above.
-
-## FAQ
-
-### Which Access Lists are synced to Identity Center?
-
-Teleport syncs all Access Lists that have AWS account and permission set rules
-among their role grants to Identity Center.
-
-### How does it work with nested Access Lists?
-
-Identity Center does not support nested groups. As such, Teleport recursively 
-flattens any [nested Access Lists](../../../access-controls/access-lists/nested-access-lists.mdx)
-into a single Identity Center group containing all members reachable from the 
-top-level Access List.
-
-The flattened Identity Center group will be kept updated as members are added to
-or removed from nested 
-
-### How do I uninstall the integration?
-
-<Admonition type="warning">
-Before fully removing the integration, make sure to remember to change the
-identity source in your Identity Center instance.
-</Admonition>
-
-Deleting the integration automatically removes all Teleport resources it used to manage its state, including:
-
-- Teleport roles created for AWS Identity Center account assignments.
-- Access Lists imported from AWS Identity Center groups.
-
-However, user-created resources remain intact, including:
-
-- Access Lists you created.
-- Roles you manually configured for account assignments.
-
-If an Access List grants permissions to a now-deleted integration role, or if a user
-has a deleted role assigned directly, you must manually remove those references.
-
-If you decide not to switch to Teleport, you can delete the Identity Center integration in two ways.
-
-You can remove the integration by navigating to your cluster's Integrations
-list and deleting both the integration named `AWS IAM Identity Center`. The AWS
-OIDC integration that was created during the first enrollment step will be
-automatically removed as well once the plugin is uninstalled.
-
-To clean up AWS resources created for the integration, remove the Identity
-Provider and its role from your AWS IAM console as well.
-
-## Next steps
-
-- Take a deeper dive into fundamental Teleport concepts used in Identity Center
-  integration such as [RBAC](../../../access-controls/guides/guides.mdx),
-  [JIT Access Requests](../../../access-controls/access-requests/access-requests.mdx),
-  [Access Lists](../../../access-controls/access-lists/access-lists.mdx) 
-  and the [Teleport SAML IdP](../../../access-controls/idps/idps.mdx).
-- Learn how to enable the [Okta integration](../../../access-controls/okta/okta.mdx)
-  to sync apps, users and groups from Okta in conjunction with Identity Center
-  integration.
diff --git a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx b/docs/pages/admin-guides/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx
deleted file mode 100644
index a5c4c3e69c96d..0000000000000
--- a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx
+++ /dev/null
@@ -1,334 +0,0 @@
----
-title: Migrating AWS IAM Identity Center from Okta to Teleport
-description: Explains how to migrate an Identity Center instance from Okta control to Teleport control.
-tocDepth: 3
----
-
-By default, the Teleport AWS IAM Identity Center integration:
-- Controls user and group provisioning into Identity Center,
-- Controls AWS account assignment provisioning into Identity Center, and
-- Authenticates user access to AWS console via Teleport SAML IdP.
-
-This is fine for most deployments, but can cause difficulties when integrating Teleport with
-an existing Okta-managed AWS IAM Identity Center configuration.
-
-This guide introduces a hybrid setup and a migration path to integrate Teleport in
-such an existing Okta-managed AWS IAM Identity Center configuration where Okta will
-continue working as an SSO provider to AWS console while Teleport manages user, group
-and AWS account assignment provisioning.
-
-### Migration Path
-
-#### Starting Point
-
-This is our starting configuration: Okta as sole Identity Source for Identity Center.
-
-![Migration Starting Point](../../../../../img/identity-center/ic-migrate-start.png)
-
-#### Midway
-
-This is the point where you can start migrating control of users and groups from
-Okta to Teleport. At this stage:
-
- - Okta provides SSO login for Identity Center.
- - Okta manages a subset of the Identity Center group membership (selected via Push Groups).
- - Okta and Teleport both control user provisioning via SCIM.
- - Teleport manages a second subset of Identity Center groups (selected via group filters during plugin installation).
- - Teleport controls Identity Center group account assignments for the Identity Center groups under its control.
- - Teleport controls direct Identity Center user account assignments for the Identity Center users under its control.
-
-![Migration Mid Point](../../../../../img/identity-center/ic-migrate-mid.png)
-
-#### Ending point
-
-Once Teleport is in control of all the users and groups you want to provision
-into Identity Center, the Okta Provisioning and Push Groups functions can be
-retired, leaving Okta only providing SSO login.
-
-![Migration End Point](../../../../../img/identity-center/ic-migrate-end.png)
-
-## Prerequisites
-
- - A working Teleport cluster.
- - An AWS role configured as per the [AWS IAM Identity Center guide](./guide.mdx#step-16-configure-aws-integration)
-   for the integration to use.
- - AWS credentials configured for the Teleport auth process to pick up and use
-   (e.g. as environment vars, system profiles, etc).
- - An Okta API token, with the following privileges:
-   - View users and their details.
-   - View groups and their details.
-   - View applications and their details.
- - The AWS IAM Identity Center ARN, AWS region, SCIM base address and SCIM bearer token.
-
-## Step 1/7. Install Okta SAML connector
-
-Install Okta SAML connector into Teleport as per the Teleport
-[Okta as an SSO provider](../../../access-controls/sso/okta.mdx) guide.
-
-<Admonition type="note">
- For the integration to function properly, both AWS IAM Identity Center and Teleport must view the
- same user set which can be achieved by using the same Okta SAML application for both Identity
- Center and Teleport SAML connector.
-
- If this is not possible, the most flexible approach we've found is having an
- an Okta Group for those users that should have Identity Center access, and then assigning
- both the Okta Identity Center App and the Okta SAML App used for Teleport SAML
- connector to that group. This ensures that the same user set is visible across
- both applications.
-</Admonition>
-
-You will need the Teleport SAML Connector Name and Okta SAML App ID in the next
-step.
-
-## Step 2/7. Install the Teleport Okta integration
-
-We will be using a very limited subset of the Teleport Okta integration in this
-deployment, disabling all features except periodic user synchronization. This
-configuration is not currently supported by the normal installation UI, so we
-will have to use `tctl` to install it:
-
-```console
-$ tctl plugins install okta \
-    --org ${OKTA_ORG_URL} \
-    --saml-connector ${TELEPORT_SAML_CONNECTOR_NAME} \
-    --app-id ${OKTA_SAML_APP_ID} \
-    --api-token ${OKTA_API_TOKEN} \
-    --no-scim \
-    --no-accesslist-sync \
-    --no-appgroup-sync
-```
-
-This will install the Okta integration and start the user sync service with a
-configuration that:
-- Imports Okta users assigned to the Okta App `${OKTA_SAML_APP_ID}`, and keeps
-  them synced with the upstream Okta organization.
-- Does *not* expose a SCIM service.
-- Does *not* attempt to sync or manage any other resources from Okta.
-
-You can monitor the state of the Okta integration in the Teleport Integrations UI.
-
-## Step 3/7. Wait for user sync
-
-To make sure everything is working, wait until the first Okta to Teleport user
-sync has occurred. You can verify this by either
- - Refreshing the user page and finding your Okta users, or
- - Checking the Okta integration status page.
-
-Once your Okta users are imported into Teleport, you can progress to the next
-step.
-
-## Step 4/7. Install the Teleport AWS IAM Identity Center integration
-
-Again, we need to install the plugin using `tctl`.
-
-```console
-$ tctl plugins install awsic \
-    --instance-arn ${IDENTITY_CENTER_INSTANCE_ARN} \
-    --instance-region ${IDENTITY_CENTER_INSTANCE_REGION} \
-    --use-system-credentials \
-    --assume-role-arn ${AWS_IAM_ROLE_ARN} \
-    --scim-url ${IDENTITY_CENTER_SCIM_BASE_URL} \
-    --scim-token ${IDENTITY_CENTER_SCIM_BEARER_TOKEN} \
-    --access-list-default-owner ${TELEPORT_ACCESS_LIST_DEFAULT_OWNER} \
-    --user-origin okta \
-    --account-name ${ACCOUNT_NAME_ALLOW_FILTER} \
-    --group-name ${GROUP_NAME_ALLOW_FILTER}
-```
-
-This will install the Teleport AWS IAM Identity Center integration with a
-Teleport configuration that:
-- Controls the AWS IAM Identity Center instance indicated by `--instance-arn`.
-- Uses the system AWS credentials to authenticate with AWS (from `--use-system-credentials`)
-  and assumes the IAM role indicated by `--assume-role-arn`.
-- Manages account assignments all AWS accounts that match the `${ACCOUNT_NAME_ALLOW_FILTER}`.
-- Provisions all users imported from Okta into AWS IAM Identity Center (from the `--user-origin okta` flag).
-- Only imports all groups matching `${GROUP_NAME_ALLOW_FILTER}` into Teleport as Access
-  Lists, with `${TELEPORT_ACCESS_LIST_DEFAULT_OWNER}` as the owner.
-
-<Admonition type="note">
-Note that the `tctl` installer currently only supports installations using
-system-level AWS credentials with `--use-system-credentials`.
-
-Using system-level credential is also the recommended way to provide AWS credential when
-configuring integration in the Teleport Enterprise self-hosted deployment.
-</Admonition>
-
-You can change the AWS account, group and user filters later by following the
-instructions in [Step 6](#step-67-expanding-teleport-integration-scope).
-
-During the installation process, Teleport will import all of the Identity Center
-groups that match its allow list (or all of them, if no allow list is defined)
-and create matching Access Lists, preserving the group membership and account
-assignments.
-
-<Admonition type="warning">
-Individual user account assignments will ***not*** be preserved during import. You
-will need to ensure these are preserved manually, or converted to group assignments
-prior to installation.
-</Admonition>
-
-### Group import control
-
-The Group import allow list is controlled by the `--group-name` option. You can
-specify multiple filters and a Group will be imported if matches _any_ of the
-supplied filters. Filters can be either literal names, globbed names or Go
-compatible regular expressions. To treat a filter as a regular expression,
-enclose it in a leading `^` and trailing `$`.
-
-Example filters:
- - `administrators`: The literal "administrators" group
- - `site-*`: Any group with the prefix `site-`
- - `^(?:[^a]|a[^w]|aw[^s]|aws[^\-]).*$`: Any group that does ***not*** have the prefix `aws-`
-
-Ensure that there is no overlap between the groups imported to Teleport and the
-groups you want Okta to maintain control over.
-
-<Admonition type="warning">
-Avoid creating an Access List with the same name as a Push Group managed by Okta.
-Teleport will attempt to adopt the group, and may change the group membership.
-Deleting the Teleport Access List and forcing a re-push from Okta should restore
-access.
-</Admonition>
-
-### User provisioning control
-
-Your Teleport cluster may have a mix of local Teleport users (e.g. a local Admin
-user) and users imported from Okta. By default, Teleport will try to provision
-_all_ Teleport users into Identity Center. You can control which users are
-provisioned by the Identity Center integration with the `--user-origin` and
-`--user-filter` arguments. In the example above, the `--user-origin okta` will
-restrict Teleport to only provisioning users that are synced from Okta, and
-excluding all local Teleport users.
-
-### AWS account import control
-
-By default, Teleport will take control of account assignments for all AWS Accounts
-managed by Identity Center. You can create an allow-list of AWS Accounts to
-import with the  `--account-name` and `--account-id` install options.
-
-The `--account-name` filters work like the `--group-name` filters above. The
-`--account-id` filters specify a literal AWS Account ID.
-
-Teleport will not create or delete account assignments on AWS accounts outside
-of its allow-list.
-
-## Step 5/7. Migrate AWS account assignments
-
-We're now at the midway point, and ready to migrate account assignments from the
-Okta-managed groups into new Teleport-managed Access Lists. To migrate groups,
-create a new Access List in Teleport (taking care not to use the same name as
-the existing Okta-managed Group) and create the appropriate memberships and
-account assignments.
-
-account assignments can be created on an Access List by assigning it the Account
-Assignment roles created by the Identity Center integration, assigning it a
-custom Teleport role that specifies a specific combination of access, or a
-combination of each.
-
-For more information, see the [Identity Center integration guide](./guide.mdx).
-
-## Step 6/7. Expanding Teleport integration scope
-
-Once you are satisfied with the way Teleport is handling the initial set of
-imported AWS resources, you can expand the scope of the Identity Center
-integration by editing the plugin import features.
-
-
-### Edit plugin spec with `tctl edit`
-
-<Admonition type="warning">
-This currently involves manually editing the Identity Center's integration
-resource using `tctl`, which is a dangerous operation. Please ensure you take a
-backup of the plugin resource so you can roll back if necessary.
-
-A guided editing workflow is currently under development.
-</Admonition>
-
-You can expand the scope of the Teleport Identity Center integration by editing
-the integration's plugin resource with `tctl`.
-
-```console
-$ tctl edit plugins/aws-identity-center
-```
-
-The plugin resource is a YAML document that looks something like this:
-
-```YAML
-kind: plugin
-version: v1
-metadata:
-  labels:
-    teleport.dev/hosted-plugin: "true"
-  name: aws-identity-center
-spec:
-  Settings:
-    aws_ic:
-      # Account import filters. An absent or empty list of filters implies "manage all AWS accounts"
-      aws_accounts_filters:
-      - Include:
-          id: "637423191929"
-      - Include:
-          id: "730335414865"
-      - Include:
-          id: "058264527036"
-      - Include:
-          name_regex: ^Staging-.*$
-
-      # User provisioning filters. An absent or empty list of filters implies "provision all users to AWS"
-      user_sync_filters:
-      - labels:
-          teleport.dev/origin: okta
-
-      # Group import filters. See notes below.
-      group_sync_filters:
-      - Include:
-          name_regex: '^Group #00\d+$'
-
-      access_list_default_owners:
-      - admin
-      arn: arn:aws:sso:::instance/ssoins-722326ecc902a06a
-      credentials_source: 2
-      integration_name: aws-identity-center
-      provisioning_spec:
-        base_url: https://scim.us-east-1.amazonaws.com/f3v9c6bc2ca-b104-4571-b669-f2eba522efe8/scim/v2
-      region: us-east-1
-```
-
-You can add or remove filters to the various filter sets. Once you save and quit
-the editor, `tctl` will replace the existing resource with your updated version.
-This will automatically restart the Identity Center Integration with the new
-filters.
-
-<Admonition type="note">
-As of Teleport 17.3, the `group_sync_filters` are only applied during the initial
-import at installation time, and there is no user accessible method of re-triggering
-the import. The only way to apply new group filters is to uninstall and re-install
-the plugin.
-
-A later release of Teleport will re-trigger a group import when it detects a
-change in the group import filters.
-</Admonition>
-
-### Re-install plugin
-
-A second alternative is to [uninstall](#deleting-the-aws-iam-identity-center-integration)
-and re-install the integration with the new parameters. Be warned that this may 
-result in user access disruptions while the integration is offline.
-
-## Step 7/7. Retire Okta group provisioning
-
-Once you are satisfied that an AWS IAM Identity Center group has been migrated to 
-Teleport control, you can remove the corresponding push Group from the Okta
-Identity Center integration.
-
-## Deleting the AWS IAM Identity Center integration
-
-Deleting the integration automatically removes all Teleport resources it used to manage its state.
-
-The impact of plugin deletion and general consideration is explained in the [AWS IAM Identity Center guide](./guide.mdx#how-do-i-uninstall-the-integration).
-
-Delete AWS IAM Identity Center plugin with `tctl`.
-
-```
-$ tctl plugins delete aws-identity-center
-```
diff --git a/docs/pages/admin-guides/management/guides/datadog.mdx b/docs/pages/admin-guides/management/guides/datadog.mdx
deleted file mode 100644
index b6ad1e0a0d74e..0000000000000
--- a/docs/pages/admin-guides/management/guides/datadog.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: Datadog Integration
-description: How to export Teleport metrics and logs to Datadog
-h1: Export Teleport metrics and logs to Datadog
----
-
-Datadog has an [officially maintained integration](https://docs.datadoghq.com/integrations/teleport/) for Teleport.
-
-The integration exports both metrics and logs to Datadog. The metrics are Datadog-native,
-not external metrics, which means they incur no extra usage charges to your Datadog account.
-The integration also includes a dashboard for monitoring your Teleport cluster.
-
-There is no installation required to use the integration, only changes to the Datadog
-Agent configuration. Please see the Datadog documentation linked above for how to activate
-the Teleport integration in Datadog.
-
-The Teleport Datadog integration includes log processing rules for
-text-formatted logs printed by an Auth Service instance. If you self-host
-Teleport, you can configure the Datadog Agent to tail these logs on an Auth
-Service host. 
-
-On Teleport Enterprise (Cloud), you must use the Teleport Event Handler to
-subscribe to audit logs from the Auth Service and forward them to Datadog using
-Fluentd. Read the [Teleport documentation](../export-audit-events/datadog.mdx)
-for how to configure audit log exporting using Datadog and the Event Handler.
diff --git a/docs/pages/admin-guides/management/guides/guides.mdx b/docs/pages/admin-guides/management/guides/guides.mdx
deleted file mode 100644
index 16d5acb1ad82c..0000000000000
--- a/docs/pages/admin-guides/management/guides/guides.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Integrations
-description: Miscellaneous guides for integrating Teleport with third-party tools.
-layout: tocless-doc
----
-
-You can integrate Teleport with third-party tools in order to complete various
-tasks in your cluster. These guides describe Teleport integrations that are not
-documented elsewhere:
-
-<DocCardList />
diff --git a/docs/pages/admin-guides/management/operations/operations.mdx b/docs/pages/admin-guides/management/operations/operations.mdx
deleted file mode 100644
index 63e025209bcba..0000000000000
--- a/docs/pages/admin-guides/management/operations/operations.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-title: Operations
-description: Teleport Operations - Scaling and High-Availability.
-layout: tocless-doc
----
-
-The guides in this section show you how to carry out common administration tasks
-on an already running Teleport cluster.
-
-For guides on the fundamentals of setting up your cluster, you should consult
-the [Cluster Administration Guides](../admin/admin.mdx) section.
-
-- [Scaling](scaling.mdx): How to configure Teleport for large-scale deployments.
-- [Backup and Restore](backup-restore.mdx): Backing up and restoring the cluster.
-- [CA Rotation](ca-rotation.mdx): Rotating Teleport certificate authorities.
-- [TLS Routing Migration](tls-routing.mdx): Migrating your Teleport cluster to single-port TLS routing mode.
-- [Proxy Peering Migration](proxy-peering.mdx): Migrating your Teleport cluster to Proxy Peering mode.
-- [Database CA Migrations](db-ca-migrations.mdx): Completing Teleport's Database CA migrations.
diff --git a/docs/pages/admin-guides/management/operations/proxy-peering.mdx b/docs/pages/admin-guides/management/operations/proxy-peering.mdx
deleted file mode 100644
index 33fbdd4f56655..0000000000000
--- a/docs/pages/admin-guides/management/operations/proxy-peering.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: Proxy Peering Migration
-description: How to upgrade an existing Teleport cluster to Proxy Peering mode.
----
-
-This guide shows you how to migrate your Teleport
-cluster to use Proxy Peering, which enables you to scale
-your Proxy Service instances horizontally by reducing the
-number of connections created between Teleport Proxy instances
-and Teleport services like the Database Service and Application Service.
-
-## Prerequisites
-
-An existing self-hosted Teleport Enterprise cluster. See the documentation on [self-hosting Teleport](../../deploy-a-cluster/deploy-a-cluster.mdx) to get started.
-
-Teleport Proxy Service instances must be able to reach each other over the network on port
-`3021` by default. Ensure there are no firewall policies that would block communication
-between instances.
-
-## Step 1/3. Enable Proxy Peering
-
-Update your cluster's Auth Service configuration to set the tunnel strategy type
-to `proxy_peering`.
-
-```yaml
-auth_service:
-    tunnel_strategy:
-        type: proxy_peering
-        agent_connection_count: 1
-```
-
-This setting will indicate to agents that they are only required to connect to 1
-Teleport Proxy instance as specified by the `agent_connection_count` field.
-
-For high availability, an `agent_connection_count` greater than 1 can be configured.
-This ensures an agent is still reachable if one of the Proxy Service instances it is connected to is not available.
-
-## Step 2/3. Restart the Auth Service
-
-Restart all Teleport Auth Service instances running in the cluster to apply the
-new Auth Service configuration.
-
-## Step 3/3. Restart the Proxy Services
-
-Restart all Teleport Proxy Service instances running in the cluster in order to
-start the services required for Proxy Peering.
-
diff --git a/docs/pages/admin-guides/management/security/revoking-access.mdx b/docs/pages/admin-guides/management/security/revoking-access.mdx
deleted file mode 100644
index 6a80cc471ef2c..0000000000000
--- a/docs/pages/admin-guides/management/security/revoking-access.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Revoking Access
-description: Learn how to revoke access before Teleport certificates expire
----
-
-Teleport's approach to using short-lived certificates for all infrastructure
-access means that it can generate large numbers of certificates every day. For
-this reason, Teleport does not support traditional certificate revocation.
-
-There are two options available for revoking access: CA rotations and Teleport locks.
-
-## CA rotations
-
-To generate a new certificate authority and invalidate user certificates issued
-by the current CA, run `tctl auth rotate --type=user`. This process will require
-that the newly generated CA certificate is uploaded to your entire fleet of
-OpenSSH servers. This can be a disruptive change, especially in environments
-that lack automation, so proceed with caution.
-
-See the [CA rotations guide](../operations/ca-rotation.mdx) for more details on
-how to execute the procedure.
-
-## Locks
-
-Teleport locks allow you to permanently or temporarily revoke access to a number
-of different "targets". Supported lock targets include: specific users, roles,
-servers, desktops, or MFA devices. After you create a lock, all existing
-sessions where the lock applies are terminated and new sessions are rejected
-while the lock remains in force.
-
-For more information, read our
-[Session and Identity Locking Guide](../../access-controls/guides/locking.mdx).
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/aws-sync.mdx b/docs/pages/admin-guides/teleport-policy/integrations/aws-sync.mdx
deleted file mode 100644
index c55ac3a6028e1..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/integrations/aws-sync.mdx
+++ /dev/null
@@ -1,194 +0,0 @@
----
-title: Discover AWS Access Patterns with Teleport Identity Security
-description: Describes how to import and visualize AWS accounts access patterns using Identity Security and Access Graph.
----
-
-Identity Security streamlines and centralizes access management across your entire infrastructure. You can view access relationships in seconds,
-viewing unified, up-to-date relationships and policies between all users, groups, and computing resources.
-
-Identity Security with Access Graph offers insights into access patterns within your AWS account. By scanning IAM
-permissions, users, groups, resources, and identities, it provides a visual representation and aids in
-enhancing the permission model within your AWS environment. This functionality enables you to address queries such as:
-
-- What resources are accessible to AWS users and roles?
-- Which resources can be reached via identities associated with EC2 instances?
-- What AWS resources can Teleport users access when connecting to EC2 nodes?
-
-Utilizing the Access Graph to analyze IAM permissions within an AWS account necessitates the setup of the Access Graph
-service, a Discovery Service, and integration with your AWS account.
-
-(!docs/pages/includes/policy/access-graph.mdx!)
-
-## How it works
-
-Access Graph discovers AWS access patterns, synchronizes various AWS resources,
-including IAM Policies, Groups, Users, User Groups, EC2 instances, EKS clusters, and RDS databases.
-These resources are then visualized using the graph representation detailed in the
-[Identity Security usage page](../policy-how-to-use.mdx).
-
-The importing process involves two primary steps:
-
-### Polling Cloud APIs
-
-The Teleport Discovery Service continuously scans the configured AWS accounts.
-At intervals of 15 minutes, it retrieves the following resources from your AWS account:
-
-- Users
-- Groups
-- User Groups
-- IAM Roles
-- IAM Policies
-- EC2 Instances
-- EKS Clusters
-- RDS Databases
-- S3 Buckets
-
-Once all the necessary resources are fetched, the Teleport Discovery Service pushes them to the
-Access Graph, ensuring that it remains updated with the latest information from your AWS environment.
-
-### Importing resources
-
-Identity Security’s Access Graph feature delves into the IAM policies, identities,
-and resources retrieved from your AWS account, crafting a
-graphical representation thereof.
-
-
-## Prerequisites
-
-- A running Teleport Enterprise cluster v14.3.9/v15.2.0 or later.
-- Identity Security enabled for your account.
-- For self-hosted clusters:
-  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
-  - A running Access Graph node v1.17.0 or later.
-Check the [Identity Security page](../teleport-policy.mdx) for details on
-how to set up Access Graph.
-  - The node running the Access Graph service must be reachable from the Teleport Auth Service.
-
-## Step 1/2. Configure Discovery Service (Self-hosted only)
-
-<Admonition type="warning">
-
-If you have a cloud-hosted Teleport Enterprise cluster, you can disregard
-this step, as cloud-hosted Teleport Enterprise already operates a properly configured
-Discovery Service within your cluster.
-</Admonition>
-
-To activate the Teleport Discovery Service, add a top level discovery_service section to the teleport.yaml
-config used by the Auth Service. This service monitors dynamic `discovery_config` resources that are set up
-with the `discovery_group` matching.
-
-<Var name="discovery-group" />.
-```yaml
-discovery_service:
-  enabled: true
-  discovery_group: <Var name="discovery-group" />
-```
-
-Notice that if you already operate a Discovery Service within your cluster,
-it's possible to reuse it as long as the following requirements are met:
-
-- On step 2, you match the `discovery_group` with the existing Discovery Service's
-`discovery_group`.
-- Access Graph service is reachable from the machine where Discovery Service runs.
-
-## Step 2/2. Set up Access Graph AWS Sync
-
-To initiate the setup wizard for configuring AWS Sync, access the Teleport UI,
-click the Policy sidebar button, and then click Integrations.
-
-Click the "Setup new integration" button, and then select "AWS". You'll be prompted
-to create a new Teleport AWS integration if you haven't configured one already.
-Alternatively, you can opt for a previously established integration.
-
-Upon selecting or creating the integration, you'll be instructed to execute a
-bash script within your AWS Cloud Shell to configure the necessary permissions.
-
-<details>
-<summary>List of IAM Policies required for AWS Sync</summary>
-
-The policy is designed with a set of read-only actions, enabling Teleport
-to access and retrieve information from resources within your AWS Account.
-
-The IAM policy includes the following directives:
-
-
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:DescribeInstances",
-        "ec2:DescribeImages",
-        "ec2:DescribeTags",
-        "ec2:DescribeSnapshots",
-        "ec2:DescribeKeyPairs",
-
-        "eks:ListClusters",
-        "eks:DescribeCluster",
-        "eks:ListAccessEntries",
-        "eks:ListAccessPolicies",
-        "eks:ListAssociatedAccessPolicies",
-        "eks:DescribeAccessEntry",
-
-        "rds:DescribeDBInstances",
-        "rds:DescribeDBClusters",
-        "rds:ListTagsForResource",
-        "rds:DescribeDBProxies",
-
-        "dynamodb:ListTables",
-        "dynamodb:DescribeTable",
-
-        "redshift:DescribeClusters",
-        "redshift:Describe*",
-
-        "s3:ListAllMyBuckets",
-        "s3:GetBucketPolicy",
-        "s3:ListBucket",
-        "s3:GetBucketLocation",
-        "s3:GetBucketTagging",
-        "s3:GetBucketPolicyStatus",
-        "s3:GetBucketAcl",
-
-        "iam:ListUsers",
-        "iam:GetUser",
-        "iam:ListRoles",
-        "iam:ListGroups",
-        "iam:ListPolicies",
-        "iam:ListGroupsForUser",
-        "iam:ListInstanceProfiles",
-        "iam:ListUserPolicies",
-        "iam:GetUserPolicy",
-        "iam:ListAttachedUserPolicies",
-        "iam:ListGroupPolicies",
-        "iam:GetGroupPolicy",
-        "iam:ListAttachedGroupPolicies",
-        "iam:GetPolicy",
-        "iam:GetPolicyVersion",
-        "iam:ListRolePolicies",
-        "iam:ListAttachedRolePolicies",
-        "iam:GetRolePolicy",
-        "iam:ListSAMLProviders",
-        "iam:GetSAMLProvider",
-        "iam:ListOpenIDConnectProviders",
-        "iam:GetOpenIDConnectProvider"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-
-```
-</details>
-
-
-Once the IAM Policy has been successfully linked to the IAM role
-utilized by Teleport, you'll be prompted to specify the regions from
-which Teleport should import resources. This selection solely pertains
-to regional resources and does not impact global resources such as S3
-Buckets, IAM Policies, or IAM Users.
-
-If you're operating a self-hosted cluster, you'll additionally need to
-provide input for the `discovery_group` configured during Step 1.
-
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/entra-id.mdx b/docs/pages/admin-guides/teleport-policy/integrations/entra-id.mdx
deleted file mode 100644
index 432764999dda4..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/integrations/entra-id.mdx
+++ /dev/null
@@ -1,533 +0,0 @@
----
-title: Analyze Entra ID policies with Teleport Identity Security
-description: Describes how to import and visualize Entra ID policies using Identity Security and Graph Explorer.
----
-
-The Microsoft Entra ID integration in Teleport Identity Governance synchronizes your Entra ID directory into your Teleport cluster,
-and offers insights into relationships in your Entra ID directory.
-Additionally, when Entra ID is used as an SSO identity provider, Identity Security visualizes
-SSO grants across your services.
-
-<Admonition type="note">
-SSO grant analysis is currently only supported in situations where Entra ID acts as the identity provider,
-and AWS accounts are set up as relying parties using AWS IAM role federation.
-
-Support for additional relying parties will be added in the future.
-</Admonition>
-
-## How it works
-
-Teleport continuously scans the connected Entra ID directory.
-At intervals of 5 minutes, it retrieves the following resources from your Entra ID directory:
-
-- Users
-- Groups
-- Users' memberships in groups
-- Enterprise applications
-
-Entra ID users and groups are imported into Teleport as users and Access Lists respectively.
-Once all the necessary resources are fetched, Teleport pushes them to the
-Graph Explorer, ensuring that it remains updated with the latest information.
-These resources are then visualized using the graph representation detailed in the
-[Identity Security usage page](../policy-how-to-use.mdx).
-
-## Prerequisites
-
-- A running Teleport Enterprise cluster v15.4.2/v16.0.0 or later.
-- Teleport Identity Governance and Identity Security enabled for your account.
-- For self-hosted clusters:
-  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
-  - A running Graph Explorer node v1.21.3 or later.
-Check the [Identity Security page](../teleport-policy.mdx) for details on
-how to set up Graph Explorer.
-  - The node running the Graph Explorer service must be reachable from the Teleport Auth Service.
-- Your user must have privileged administrator permissions in the Azure account
-- For OIDC setup, the Teleport cluster must be publicly accessible from the internet.
-- For air gapped clusters, `tctl` must be v16.4.7 or later.
-
-(!docs/pages/includes/policy/access-graph.mdx!)
-
-## Step 1/3. Choose a setup method
-
-To begin onboarding, select your preferred setup method. Teleport offers various methods based on your cluster
-configuration and user requirements.
-
-### Automatic setup with Teleport as an OIDC Provider for Entra ID
-
-<Admonition type="tip">
-This method is recommended and is required if you are a Teleport Enterprise (Cloud) customer.
-</Admonition>
-
-This method is suitable for Teleport clusters that are publicly accessible and lack Azure credentials on Auth
-Service nodes or pods.
-
-In this setup, Teleport is configured as an OpenID Connect (OIDC) identity provider, establishing a trusted
-connection with an Entra ID application created during setup. This trust allows Teleport to authenticate using
-the Entra ID application, accessing permissions tied to it without requiring additional credentials or managed
-identities.
-
-**Requirements:**
-- Direct bidirectional connectivity between Teleport and Azure is necessary for Azure to validate the OIDC
-tokens issued by Teleport.
-
-### Automatic setup with system credentials for Entra ID authentication
-
-Designed for air-gapped Teleport clusters that are not publicly accessible, this setup accommodates environments
-where Azure cannot validate OIDC tokens issued by Teleport.
-
-Instead, Teleport relies on Azure credentials available on the VMs where Teleport Auth Service is running.
-These credentials must have the following Entra ID permissions:
-
-- `Application.Read.All`
-- `Directory.Read.All`
-- `Policy.Read.All`
-
-**Requirements:**
-- Unidirectional connectivity from Teleport to Azure infrastructure.
-
-### Manual setup
-
-This setup describes how to manually configure Entra ID integration without relying on automated scripts
-to setup Entra ID Application.
-
-This guide covers the
-[**Automatic Setup with Teleport as OIDC Provider for Entra ID**](./entra-id.mdx#automatic-setup-with-teleport-as-an-oidc-provider-for-entra-id)
-and [**Automatic Setup with System Credentials**](./entra-id.mdx#automatic-setup-with-system-credentials-for-entra-id-authentication)
-setup but has a limitation of not being possible to enable the [Identity Security](../teleport-policy.mdx) integration.
-
-## Step 2/3. Configure the Entra ID integration
-
-
-<Tabs>
-<TabItem label="Teleport as OIDC provider" >
-
-### Start integration onboarding
-
-To start the onboarding process, access the Teleport Web UI, select "Add New" in the left-hand pane, choose "Integration" and then "Microsoft Entra ID".
-
-![Integration selection screen](../../../../img/access-graph/entra-id/integrations-page.png)
-
-In the onboarding wizard, choose a Teleport user that will be assigned as the default owner of Access Lists that are created for your Entra groups, and click "Next".
-
-![First step of the Entra ID integration onboarding](../../../../img/access-graph/entra-id/integration-wizard-step-1.png)
-
-### Grant permissions in Azure and finish onboarding
-
-The wizard will now provide you with a script that will set up the necessary permissions in Azure.
-
-![Second step of the Entra ID integration onboarding](../../../../img/access-graph/entra-id/integration-wizard-step-2.png)
-
-Open Azure Cloud Shell by navigating to <a href="https://shell.azure.com">shell.azure.com</a>,
-or by clicking the Cloud Shell icon in the Azure Portal.
-
-![Location of the Cloud Shell button in the Azure Portal](../../../../img/access-graph/entra-id/azure-cloud-shell-button.png)
-
-Make sure to use the Bash version of Cloud Shell.
-Once a Cloud Shell instance opens, paste the generated command.
-The command sets up your Teleport cluster as an enterprise application in the Entra ID directory,
-and grants Teleport read-only permissions to read your directory's data (such as users and groups in the directory).
-
-Once the script is done setting up the necessary permissions,
-it prints out the data required to finish the integration onboarding.
-
-![Output of the Entra ID onboarding script](../../../../img/access-graph/entra-id/onboarding-script-output.png)
-
-Back in the Teleport Web UI, fill out the required data and click "Finish".
-
-![Second step of the Entra ID integration onboarding with required fields filled in](../../../../img/access-graph/entra-id/integration-wizard-step-2-filled.png)
-
-</TabItem>
-
-<TabItem label="Automatic setup with system credentials" >
-
-### Assign permissions to the Azure identity of your Auth Service VMs
-
-To set up the Azure Identity with the necessary permissions:
-
-- `Application.Read.All`
-- `Directory.Read.All`
-- `Policy.Read.All`
-
-Go to your Azure Dashboard, find the identities linked to your Teleport Auth Service VMs,
-and copy the `Object (principal) ID`. Paste this value into `<Var name="Principal ID" />`.
-
-After obtaining the Principal ID, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/)
-in PowerShell mode and run the following script to assign the required permissions to `<Var name="Principal ID" />`.
-
-<details>
-<summary>Assign required permissions to Azure Identity</summary>
-
-```powershell
-
-# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
-Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'
-
-# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
-$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId '<Var name="Principal ID" />'
-
-# Set the Microsoft Graph enterprise application object.
-# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
-$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
-
-# Define the permission scopes that we want to assign to the managed identity.
-# These are Microsoft Graph API permissions required by the managed identity.
-$permissions = @(
-  "Application.Read.All"   # Permission to read applications in the directory
-  "Directory.Read.All"     # Permission to read directory data
-  "Policy.Read.All"        # Permission to read policies within the directory
-)
-
-# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
-# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
-$appRoles = $graphSPN.AppRoles |
-    Where-Object Value -in $permissions |
-    Where-Object AllowedMemberTypes -contains "Application"
-
-# Iterate over each app role to assign it to the managed identity.
-foreach ($appRole in $appRoles) {
-    # Define the parameters for the role assignment, including the managed identity's principal ID,
-    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
-    $bodyParam = @{
-        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
-        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
-        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
-    }
-
-    # Create a new app role assignment for the managed identity, granting it the specified permissions.
-    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
-}
-
-```
-
-</details>
-
-Your identity principal `<Var name="Principal ID" />` now has the necessary permissions to list Applications,
-Directories, and Policies.
-
-
-### Set up Entra ID and Teleport resources
-
-The Teleport `tctl` command provides an interactive guide to set up and configure Entra ID integration for air-gapped clusters.
-
-To use it, ensure you have `tctl` version v16.4.7 or later and select a default list of Access List owners.
-These specified Teleport users will become the owners of Access Lists imported by the Entra ID integration.
-`<Var name="Access List Owner"/>` must be an existing Teleport user.
-If you prefer multiple Access List owners, repeat the flag with each user, e.g., `--default-owner=owner1 --default-owner=owner2`.
-
-You'll also need to provide the Teleport Auth Service address as `<Var name="example.teleport.sh:443" />`.
-For clusters running in multiplex mode, this address will be the same as your proxy address.
-
-If your Teleport license does not include [Identity Security](../teleport-policy.mdx), include the `--no-access-graph` flag.
-
-```code
-$ tctl plugins install entraid \
-    --default-owner=<Var name="Access List Owner"/> \
-    --default-owner=someOtherOwner@teleport.sh  \
-    --use-system-credentials \
-    --auth-server <Var name="example.teleport.sh:443" />
-```
-
-To disable the Graph Explorer integration, add the `--no-access-graph` flag.
-
-Follow the detailed instructions provided by the `tctl plugins install entraid` guide to install and configure the Entra ID plugin.
-This guide will walk you through each step required to enable Entra ID integration within your Teleport environment.
-Be sure to follow each step in the `tctl plugins install entraid` guide closely to complete the installation and configuration.
-
-</TabItem>
-
-<TabItem label="Manual setup" >
-
-### Assign permissions to the Azure identity of your Auth Service VMs
-
-This step configures the Azure Identity on your Auth Service machine with the required Entra ID permissions.
-
-<Admonition type="warning">
-Follow this step only if you want to use system-available credentials to authenticate Teleport with Entra ID.
-If you intend to use Teleport as an OIDC provider for Entra ID, you can skip this step.
-</Admonition>
-
-
-- `Application.Read.All`
-- `Directory.Read.All`
-- `Policy.Read.All`
-
-Go to your Azure Dashboard, find the identities linked to your Teleport Auth Service VMs,
-and copy the `Object (principal) ID`. Paste this value into `<Var name="Principal ID" />`.
-
-After obtaining the Principal ID, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/)
-in PowerShell mode and run the following script to assign the required permissions to `<Var name="Principal ID" />`.
-
-<details>
-<summary>Assign required permissions to Azure Identity</summary>
-
-```powershell
-
-# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
-Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'
-
-# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
-$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId '<Var name="Principal ID" />'
-
-# Set the Microsoft Graph enterprise application object.
-# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
-$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
-
-# Define the permission scopes that we want to assign to the managed identity.
-# These are Microsoft Graph API permissions required by the managed identity.
-$permissions = @(
-  "Application.Read.All"   # Permission to read applications in the directory
-  "Directory.Read.All"     # Permission to read directory data
-  "Policy.Read.All"        # Permission to read policies within the directory
-)
-
-# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
-# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
-$appRoles = $graphSPN.AppRoles |
-    Where-Object Value -in $permissions |
-    Where-Object AllowedMemberTypes -contains "Application"
-
-# Iterate over each app role to assign it to the managed identity.
-foreach ($appRole in $appRoles) {
-    # Define the parameters for the role assignment, including the managed identity's principal ID,
-    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
-    $bodyParam = @{
-        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
-        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
-        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
-    }
-
-    # Create a new app role assignment for the managed identity, granting it the specified permissions.
-    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
-}
-
-```
-
-</details>
-
-Your identity principal `<Var name="Principal ID" />` now has the necessary permissions to list Applications,
-Directories, and Policies.
-
-
-### Set up an Entra ID application
-
-In this step, you will manually configure an Entra ID Enterprise Application to be used by the Teleport Auth Connector.
-
-We provide a PowerShell script that creates the specified application, assigns the token signing request, and sets up the necessary SAML parameters.
-
-To proceed, you need to define the following parameters:
-
-- `<Var name="Application name" />`: The Entra ID Application name, typically set to `Teleport your.cluster.address`.
-- `<Var name="example.teleport.sh:443" />`: Your Teleport Proxy address.
-- `<Var name="Auth Connector Name" />`: The Teleport Auth Connector name, usually set to `entra-id`.
-
-Once these parameters are defined, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/) in
-PowerShell mode, or use the session created in the previous step.
-
-<details>
-<summary>Create the Entra ID application</summary>
-
-```powershell
-# Connect to Microsoft Graph with required scopes for application creation and app role assignment permissions.
-Connect-MgGraph -Scopes "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"
-
-# Import the Microsoft Graph module for managing applications.
-Import-Module Microsoft.Graph.Applications
-
-# Define application parameters, including the display name.
-$params = @{
-	displayName = '<Var name="Application name" />'  # Set the display name of the new application.
-}
-
-# Set the SAML application template ID.
-# This ID corresponds to a non-gallery SAML application template.
-$applicationTemplateId = "8adf8e6e-67b2-4cf2-a259-e3dc5476c621"
-
-# Instantiate the application template to create a new application and its service principal.
-$app = Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId $applicationTemplateId -BodyParameter $params
-
-# Extract the Application ID, Object ID, and Service Principal ID of the newly created application.
-$appId = $app.Application.AppId       # The unique identifier for the application (client ID).
-$objectId = $app.Application.Id       # The unique object ID for the application in Azure AD.
-$servicePrincipal = $app.ServicePrincipal.Id  # The unique object ID for the service principal.
-
-# Define parameters for the token signing certificate used for SAML.
-$principalTokenSigningCertificateParams = @{
-	displayName = "CN=azure-sso"  # Common Name (CN) for the SAML token signing certificate.
-}
-
-# Add a token signing certificate to the service principal, which is required for SAML authentication.
-$cert = Add-MgServicePrincipalTokenSigningCertificate -ServicePrincipalId $servicePrincipal -BodyParameter $principalTokenSigningCertificateParams
-
-# Extract the thumbprint of the certificate, which will be used to configure SAML.
-$thumbprint = $cert.Thumbprint
-
-# Set additional SAML-specific properties for the service principal.
-$updateServicePrincipalParams = @{
-	preferredSingleSignOnMode = "saml"                    # Set SAML as the single sign-on mode.
-	preferredTokenSigningKeyThumbprint = $thumbprint      # Use the thumbprint of the added certificate for token signing.
-	appRoleAssignmentRequired = $false                    # Allow app access without explicit app role assignments.
-}
-
-# Update the service principal with the SAML configuration.
-Update-MgServicePrincipal -ServicePrincipalId $servicePrincipal -BodyParameter $updateServicePrincipalParams
-
-# Define the URL for the proxy (Teleport Auth Service address).
-# This URL will be used as the Redirect URI and Identifier URI.
-$proxyURL = 'https://<Var name="example.teleport.sh:443" />'.TrimEnd("/").TrimEnd(":443")  # Remove the default 443 port for standard formatting.
-$acsURL = $proxyURL+'/v1/webapi/saml/acs/<Var name="Auth Connector Name"/>'
-
-# Define web properties, including the redirect URI for SAML authentication.
-$web = @{
-	redirectUris = @($acsURL)  # Set the application's redirect URI.
-}
-
-# Update the application with the web properties and identifier URI.
-# This enables SAML-based authentication and includes security group claims.
-Update-MgApplication -ApplicationId $objectId -Web $web -IdentifierUris @($acsURL)
-# Define optional claims for the application to include group membership claims.
-$optionalClaims = [Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaims]::DeserializeFromDictionary(@{
-	AccessToken = @(
-      @{ Name = 'groups' }
-   )
-   IdToken = @(
-	  @{ Name = 'groups' }
-   )
-   Saml2Token = @(
-      @{ Name = 'groups' }
-   )
-})
-
-Update-MgApplication -ApplicationId $objectId -GroupMembershipClaims "SecurityGroup" -OptionalClaims $optionalClaims
-
-
-# Retrieve the tenant ID for display purposes.
-$tenant = Get-AzTenant
-
-# Output the Application ID, Tenant ID, and additional information for reference.
-Write-Output "-------------------------------------------------------" "Copy and paste the following details:" "Application ID (Client ID): $appId" "Tenant ID: $tenant" "-------------------------------------------------------"
-
-```
-
-</details>
-
-If your cluster is publicly accessible from the internet and you prefer or need to use OIDC rather
-than Auth Service system credentials, you can configure Teleport as an OIDC provider for the Entra
-ID application. If you have already assigned the necessary permissions to your Auth Service's Azure
-Identity, you may skip the following section.
-
-To configure Federated credentials for your application, run the following script in the same
-Azure Cloud Shell terminal used previously.
-
-<details>
-<summary>Create Federated Credentials for Entra ID Application"</summary>
-
-```powershell
-
-# Define the subject for the federated identity credential. This is a constant defined in Teleport.
-$subject = "teleport-azure"
-
-# Define the accepted audiences for the credential. It's a constant value.
-$audiences = @("api://AzureADTokenExchange")
-
-# Set the issuer to the Teleport cluster proxy URL.
-$issuer = $proxyURL
-
-# Define a unique name for the federated identity credential. This name is used for identification within the application.
-$name = "teleport-oidc"
-
-# Create a new federated identity credential for the application in Microsoft Graph.
-$credential = New-MgApplicationFederatedIdentityCredential -ApplicationId $objectId -Subject $subject -Audiences $audiences -Issuer $issuer -Name $name
-
-
-# Configure the required permissions for the application.
-
-# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
-$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId $servicePrincipal
-
-
-# Set the Microsoft Graph enterprise application object.
-# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
-$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
-
-# Define the permission scopes that we want to assign to the managed identity.
-# These are Microsoft Graph API permissions required by the managed identity.
-$permissions = @(
-  "Application.Read.All"   # Permission to read applications in the directory
-  "Directory.Read.All"     # Permission to read directory data
-  "Policy.Read.All"        # Permission to read policies within the directory
-)
-
-# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
-# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
-$appRoles = $graphSPN.AppRoles |
-    Where-Object Value -in $permissions |
-    Where-Object AllowedMemberTypes -contains "Application"
-
-# Iterate over each app role to assign it to the managed identity.
-foreach ($appRole in $appRoles) {
-    # Define the parameters for the role assignment, including the managed identity's principal ID,
-    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
-    $bodyParam = @{
-        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
-        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
-        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
-    }
-
-    # Create a new app role assignment for the managed identity, granting it the specified permissions.
-    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
-}
-
-```
-
-</details>
-
-### Set up Teleport resources
-
-The Teleport `tctl` command provides an interactive guide to set up and configure Entra ID integration for air-gapped clusters.
-
-To use it, ensure you have `tctl` version v16.4.7 or later and select a default list of Access List owners.
-These specified Teleport users will become the owners of Access Lists imported by the Entra ID integration.
-`<Var name="Access List Owner"/>` must be an existing Teleport user.
-If you prefer multiple Access List owners, repeat the flag with each user, e.g., `--default-owner=owner1 --default-owner=owner2`.
-
-You'll also need to provide the Teleport Auth Service address as `<Var name="example.teleport.sh:443"/>`.
-For clusters running in multiplex mode, this address will be the same as your proxy address.
-
-If you chose to use Teleport as the OIDC provider for Entra ID in the previous step, remove the `--use-system-credentials`
-flag from the command below.
-
-<Admonition type="note">
-Currently, when using manual mode, it is not possible to operate without the `--no-access-graph` flag.
-</Admonition>
-
-```code
-
-$ tctl plugins install entraid \
-    --default-owner=<Var name="Access List Owner"/> \
-    --default-owner=someOtherOwner@teleport.sh  \
-    --auth-connector-name="<Var name="Auth Connector Name"/>" \
-    --use-system-credentials \
-    --no-access-graph \
-    --manual-setup \
-    --auth-server <Var name="example.teleport.sh:443" />
-
-```
-
-Follow the detailed instructions provided by the `tctl plugins install entraid` guide to install and configure the Entra ID plugin.
-    </TabItem>
-</Tabs>
-
-## Step 3/3. Analyze Entra ID directory in Teleport Graph Explorer
-
-Shortly after the integration onboarding is finished,
-your Entra ID directory will be imported into your Teleport cluster and Graph Explorer.
-
-You can find Entra ID users and groups in the Graph Explorer UI. If you have Entra ID SSO set up for your AWS accounts,
-and the AWS accounts have been connected to Teleport,
-Graph Explorer will also show access to AWS resources granted to Entra ID identities.
-
-In the following example, Bob is assigned to group `AWS-Engineers` in Entra ID.
-This allows him to use SSO to assume the AWS IAM role `Engineers`,
-which in turn allows Bob to access two S3 buckets.
-
-![Example of an Entra ID user's access paths](../../../../img/access-graph/entra-id/entra-sso-path.png)
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/gitlab.mdx b/docs/pages/admin-guides/teleport-policy/integrations/gitlab.mdx
deleted file mode 100644
index 8e995f87a526e..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/integrations/gitlab.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Discover GitLab Access Patterns with Teleport Identity Security
-description: Describes how to synchronize GitLab access patterns using Identity Security and Access Graph.
----
-
-Gain insights into access patterns within your GitLab account using Identity Security with Access Graph. By scanning all
-permissions, users, groups, and projects, it provides a visual representation to help enhance the permission model within
-your GitLab environment. This functionality enables you to answer queries such as:
-
-- What projects are accessible to users?
-- Which users have write permissions to projects?
-
-(!docs/pages/includes/policy/access-graph.mdx!)
-
-## How it works
-
-Access Graph synchronizes various GitLab resources, including users, projects and groups.
-These resources are then visualized using the graph representation detailed in the
-[Access Graph page](../teleport-policy.mdx).
-
-The importing process involves two primary steps:
-
-### Polling GitLab APIs
-
-The Teleport cluster continuously scans the configured GitLab accounts and retrieves the following resources:
-
-- Users
-- Groups
-- Projects
-- Group memberships
-- Project memberships
-
-Once all the necessary resources are fetched, Teleport pushes them to the
-Access Graph, ensuring that it remains updated with the latest information from your GitLab instance.
-
-### Importing resources
-
-Identity Security’s Access Graph feature delves into the resources imported and their relationships, crafting a
-graphical representation thereof.
-
-## Prerequisites
-
-- A running Teleport Enterprise cluster v14.3.20/v15.3.1/v16.0.0 or later.
-- Identity Security enabled for your account.
-- A GitLab instance running GitLab v9.0 or later.
-- For self-hosted clusters:
-  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
-  - A running Access Graph node v1.21.4 or later.
-Check the [Identity Security page](../teleport-policy.mdx) for details on
-how to set up Access Graph.
-  - The node running the Access Graph service must be reachable from the Teleport Auth Service.
-
-## Step 1/3. Create GitLab token
-
-To set up the GitLab integration, you'll need to create a GitLab token with the following permissions:
-
-- `read_api`
-
-Navigate to your GitLab instance, access the User Settings, and select the Access Tokens option.
-Create a new token with the `read_api` scope and copy the generated token. For more information, refer to the
-[GitLab documentation](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html).
-
-The importer will use this token to fetch the necessary resources from your GitLab instance.
-
-<Admonition type="warning">
-
-    The GitLab importer will only fetch resources that the token has access to. Ensure that the user associated with
-    the token has the necessary permissions to access/view the resources you want to import.
-
-    If you're using a GitLab.com account, the importer will only fetch the users who are part of the organization or
-    have access to the projects that the token can access.
-
-    If you're using a self-hosted GitLab instance, the importer will fetch all resources that the token has access to,
-    including all users who are part of the instance.
-
-</Admonition>
-
-The token will be used in the next step to configure the GitLab Sync integration.
-
-## Step 2/3. Set up Access Graph GitLab Sync
-
-To initiate the setup wizard for configuring Gitlab Sync, access the Teleport UI,
-click the Policy sidebar button, and then click Integrations.
-
-Click the "Setup new integration" button, and then select "Gitlab". You'll be prompted
-to create a new Teleport Gitlab integration if you haven't configured one already.
-Alternatively, you can opt for a previously established integration.
-
-You'll be prompted to provide the GitLab token created in Step 1 and the GitLab instance domain.
-Once the token is successfully validated, you'll be able to see the resources imported in Access Graph.
-
-## Step 3/3. View GitLab resources in Access Graph
-
-After the GitLab resources are imported, you can view them in the Access Graph page.
-The graph representation will show the relationships between users, groups, and projects within your GitLab instance.
-
-Users can have permissions to access a Group or Project. When a user has access to a Group, they inherit permissions
-to all projects and sub-projects within that group.
-
-You can view the permissions granted to users, groups, and projects by clicking on the respective nodes in the graph.
-
-For example, to view the permissions granted to a user, click on the user node and select `View Access` from the context menu.
-This will display the permissions granted to the user and the resources they have access to.
-
-You can also run queries to fetch specific information from the Access Graph, such as:
-
-### Fetch All Projects Accessible to a User
-
-The following query fetches all projects accessible to a user <Var name="user" />:
-
-```sql
-SELECT * FROM access_path WHERE "identity" = '<Var name="user" />' AND source='Gitlab'
-```
-
-Additionally, you filter projects by the user's access level, `owner`, `maintainer`, `developer`, `guest`, or `reporter`
-by running the following query:
-
-```sql
-SELECT * FROM access_path WHERE "identity" = '<Var name="user" />' AND source='Gitlab' AND action='owner'
-```
-
-Change the `action` parameter to `maintainer`, `developer`, `guest`, or `reporter` to fetch the respective projects.
-
-### Fetch All Users with Write Access to a Project
-
-The following query fetches all users with read/write access to a project named <Var name="project" />:
-
-```sql
-SELECT * FROM access_path WHERE "resource" = '<Var name="project" />' AND source='Gitlab'
-```
-
-## Troubleshooting
-
-After setting up the GitLab integration, you can monitor the import process status on the Access Graph's Integrations page.
-If the import fails, an error message will help identify the issue.
-
-You can also check whether the import process is currently running or has completed successfully by viewing the status.
-
-If you encounter any `Unauthorized` errors, ensure that the GitLab token has the necessary permissions to access the resources
-and that the token is valid. If the token has expired, you'll need to create a new token and update the integration settings.
-
-If you encounter any other issues, please ensure that the Teleport cluster can reach the GitLab instance and that the
-GitLab APIs are accessible.
-
-If you're still facing issues, please inspect the error log on the Access Graph's Integrations page for more details.
-
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/integrations.mdx b/docs/pages/admin-guides/teleport-policy/integrations/integrations.mdx
deleted file mode 100644
index cb3c9e50e0e58..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/integrations/integrations.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Teleport Identity Security Integrations
-description: Integrations in Access Graph with Identity Security.
----
-
-Teleport can integrate with identity providers (IdPs) like Okta and AWS OIDC 
-which can then be used with Access Graph, providing a comprehensive, 
-interactive view of how users, roles, and resources are interconnected, 
-enabling administrators to better understand and control access policies.
-
-Read the following guides for information on using Teleport Identity Security Access Graph to
-visualize role-based access controls from third-party services:
-
-<DocCardList />
-
-## Viewing available integrations
-
-The Integrations page shows integrations that can be enabled or are already
-enabled in Access Graph.
-
-![Integrations](../../../../img/access-graph/integrations.png)
-
-Resources imported into Teleport through Teleport-enabled integrations are
-automatically imported into Identity Security without any additional
-configuration.
-
-To access the interface, your user must have a role that allows `list` and `read` verbs on the `access_graph` resource, e.g.:  
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: my-role
-spec:
-  allow:
-    rules:
-    - resources:
-      - access_graph
-      verbs:
-      - list
-      - read
-```
-
-The preset `editor` role has the required permissions by default.
-
-## Set up a new integration
-
-On the left sidebar, click **Policy**. Click the connection icon labeled Integrations: 
-![Connection view](../../../../img/access-graph/connection_view.png) 
-Select the "Set up new integration" button.
-
-Teleport can also import and grant access to resources from Okta organizations,
-such as user profiles, groups and applications. You can view connection data in
-Access Graph. Enroll the Teleport [Okta
-integration](../../access-controls/okta/okta.mdx) in your
-cluster.
-
diff --git a/docs/pages/admin-guides/teleport-policy/policy-connections.mdx b/docs/pages/admin-guides/teleport-policy/policy-connections.mdx
deleted file mode 100644
index 0f321977cbf00..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/policy-connections.mdx
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: Teleport Identity Security Connections
-description: Connections in Access Graph with Identity Security.
----
-
-Identity Security with Access Graph shows the relationships between users, roles, and resources. 
-It does this by showing paths between nodes. Paths are the relationships between nodes. 
-Paths always connect nodes in the following order:
-
-## Connecting to resources
-
-1. Users
-1. User Groups
-1. Actions
-1. Resource Groups
-1. Resources
-
-Graph paths can be divided into two categories:
-
-1. Allow paths
-
-![Allow Path](../../../img/access-graph/allow-path.png)
-
-Allow paths connect identities to resources. They show what an identity can access and what actions they can perform.
-
-2. Deny paths
-
-![Deny Path](../../../img/access-graph/deny-path.png)
-
-Deny paths connect identities to resources. They show what an identity cannot access and what actions they cannot perform. Deny paths take precedence over allow paths.
-
-## How resources and identities are represented
-
-Access Graph imports all resources and identities from Teleport and keeps them up to date, so every time you make a change
-to your Teleport resources, the Graph will reflect those changes.
-
-### Identities
-
-Users are created from Teleport Users.
-Local users are imported as soon as they are created.
-External users (created from authentication connectors for GitHub, SAML, etc.) are imported when they log in for the first time.
-
-### User Groups
-
-User Groups are created from Teleport roles and Access Requests. Roles create User Groups where the members
-are the users that have that role. Access requests create a temporary User Group where the members are the users that
-got the access through the accepted Access Request.
-
-### Actions
-
-Actions are created from Teleport roles. Actions can be divided into three
-categories:
-
-1. Allow Actions
-
-Allow Actions are created from Teleport roles. Allow Actions are the things that users can do. 
-For example, a user can SSH into a node.
-
-2. Deny Actions
-
-Deny Actions are created from Teleport roles. Deny Actions are the things that users cannot do. 
-For example, a user cannot SSH into a node. Deny Actions take precedence over Allow Actions.
-
-3. Temporary Actions
-
-Temporary Actions are created when a user is granted temporary access to a resource. 
-They are automatically deleted when the user's access expires. The temporary actions 
-can be identified by having `Temporary: true` property.
-
-#### Resource Groups
-
-Resource Groups are created from Teleport roles.
-
-### Database Access Controls
-
-Teleport supports [object-level permissions](../../enroll-resources/database-access/rbac.mdx#executing-database-object-permission-rules) for select database protocols.
-
-The database objects-level access information is automatically synchronized to Identity Security, making it possible to see who has particular levels of access to the different parts of the database.
-
-When you inspect a particular user's access, the Teleport Access Graph will automatically display the database objects that the user can access.
-
-![Overview of access including individual database objects](../../../img/access-graph/dac/overview.png)
-
-To see more details about a specific database object, simply select it.
-
-![Details of an individual database object](../../../img/access-graph/dac/db-object-details.png)
-
-In the graph, database objects are connected by multiple edges:
-
-1. There is exactly one edge connecting the object to its parent database resource. This edge has "contains" label.
-
-![Database object and parent database resource](../../../img/access-graph/dac/db-object-contains-relation.png)
-
-2. At least one edge shows the permissions associated with the object, such as `INSERT, SELECT, UPDATE`. If multiple roles grant permissions to the same object, additional edges of this type may be present. The permissions are presented as edge labels.
-
-![Specific object permissions](../../../img/access-graph/dac/db-object-permissions-label.png)
-
-#### Resources
-
-Resources are created from Teleport resources like nodes, databases, and Kubernetes clusters.
-
-## Next steps
-- Uncover [privileges, permissions, and construct SQL queries](./policy-how-to-use.mdx) in  Identity Security.
diff --git a/docs/pages/admin-guides/teleport-policy/policy-how-to-use.mdx b/docs/pages/admin-guides/teleport-policy/policy-how-to-use.mdx
deleted file mode 100644
index bbd5711fabda7..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/policy-how-to-use.mdx
+++ /dev/null
@@ -1,155 +0,0 @@
----
-title: How to use Teleport Identity Security
-description: Using Access Graph with Identity Security.
----
-
-Identity Security provides a framework for visualizing and managing access controls across an organization’s infrastructure.
-
-This interface enables administrators to efficiently identify and address potential security risks,
-such as overly broad permissions or conflicting roles, ensuring that access is granted
-on principles of least privilege.
-
-## How to use Identity Security
-
-Identity Security with Access Graph feature can help you to answer questions like:
-
-- Who can access a specific resource?
-
-Determine who has access to resources and understand the pathways that grant access:
-
-![Show Access Path Resource](../../../img/access-graph/show-access-path-resource.gif)
-
-- What resources can a specific user access?
-
-At a glance, you can view all the resources a user can access:
-
-![Show Access Path](../../../img/access-graph/show-access-path.gif)
-
-## Dashboard: Standing Privileges
-
-The Identity Security with Access Graph dashboard provides a high-level overview of standing privileges across 
-your infrastructure.  Standing privileges are the number of resources that an identity can access 
-without creating an Access Request. Details about standing privileges can be found by clicking on the
-user or bot. 
-
-![Standing Privileges](../../../img/access-graph/standing-privileges.png)
-
-## Graph View
-
-Graph view is the main view that shows the connections between identities and resources.
-
-By default, an aggregated view of access paths grouped by identity is shown.
-
-## Search
-
-To search for a graph node, use the search bar at the top of the page or press `/`.
-
-This will bring up the global search, where you can search for nodes, pages and access paths.
-
-![Search](../../../img/access-graph/search.png)
-
-Clicking on a node will open a drawer with more details about that node.
-
-![Node Information](../../../img/access-graph/node-information.png)
-
-Viewing a node's access path will open up the graph explorer view with the selected node.
-
-![Access Path](../../../img/access-graph/access-path.png)
-
-## Access path view
-
-A node's access path shows all the resources that the node can access.
-
-When viewing an access path, you can filter down the graph to show only the nodes that you are interested in.
-
-For example, if you are viewing a user's access path and want to see what access is given to that user through a certain role, you can right-click the role and select "Add to search".
-
-![Add to search](../../../img/access-graph/add-to-search.png)
-
-This will narrow down the graph to show you only the access paths that include that role.
-
-![Filtered access path](../../../img/access-graph/filtered-access-path.png)
-
-## Graph nodes
-
-Access Graph divides your infrastructure into six main components:
-
-1. Identities
-
-![Identity Node](../../../img/access-graph/identity-node.png)
-
-Identities are the actors that can access your infrastructure. They can be employees, contractors, machines or bots.
-
-The number on the right hand side shows **standing privileges**. The standing privileges metric indicates the number of
-resources that an identity can access without creating an Access Request.
-
-2. User Groups
-
-![Identity Group Node](../../../img/access-graph/identity-group-node.png)
-
-Identity Groups are collections of identities. They can be used to organize users
-based on their role or team, and they can be nested.
-
-3. Actions
-
-![Action Node](../../../img/access-graph/allow-action-node.png)
-
-Actions are the things that identities can or cannot do. Actions are related to resources.
-For example, a user can SSH into a node.
-
-4. Deny Actions
-
-![Deny Action Node](../../../img/access-graph/deny-action-node.png)
-
-Deny Actions are the things that identities cannot do. Deny Actions are related to resources.
-For example, a user cannot SSH into a node.
-
-5. Resource Groups
-
-![Resource Group Node](../../../img/access-graph/resource-group-node.png)
-
-Resource Groups are collections of resources. They can be used to organize resources based on their role or team.
-
-The number on the right hand side shows the number of resources that a resource group contains.
-
-6. Resources
-
-![Resource Node](../../../img/access-graph/resource-node.png)
-
-Resources are the things that users can or cannot access. They can be servers, databases, or Kubernetes clusters.
-
-## SQL Editor
-
-Access Graph allows creating SQL like queries to explore the graph.
-
-![SQL Editor](../../../img/access-graph/sql-editor.png)
-
-The query language allows to create different views of the graph, ex:
-
-Show only allowed paths:
-
-```sql
-SELECT * FROM access_path WHERE kind = 'ALLOWED';
-```
-
-Show only denied paths:
-```sql
-SELECT * FROM access_path WHERE kind = 'DENIED';
-```
-
-Show all access paths for a user:
-```sql
-SELECT * FROM access_path WHERE identity = 'bob';
-```
-
-Show all access paths for a user AND a resource:
-```sql
-SELECT * FROM access_path WHERE identity = 'bob' AND resource = 'postgres';
-```
-
-Show all access paths for resources with specific labels:
-```sql
-SELECT * FROM access_path WHERE resource_labels @> '{"key": "value"}';
-```
-
-You can view more SQL examples in the editor.
diff --git a/docs/pages/admin-guides/teleport-policy/teleport-policy.mdx b/docs/pages/admin-guides/teleport-policy/teleport-policy.mdx
deleted file mode 100644
index c2fade47f7eb3..0000000000000
--- a/docs/pages/admin-guides/teleport-policy/teleport-policy.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Teleport Identity Security
-description: A reference for Access Graph with Identity Security.
----
-
-Teleport Identity Security unifies management of access policies across your infrastructure.
-It hardens your access controls and visually shows up-to-date relationships and policies of all users, groups, and computing resources
-It can help you answer questions like:
-
-- What resources can a specific user access?
-- What users can access a specific resource?
-- What are the relationships between users, roles, and resources?
-
-## Getting started with Identity Security
-
-Identity Security is a separately licensed product and is available to Teleport Enterprise customers.
-Access Graph is a major capability of Identity Security that visually shows the relationships of
-policies of users, groups, and computing resources.
-
-To verify the availability of the Access Graph, ensure that the Policy icon is present in the navigation sidebar.
-
-<Admonition type="note">
-Note: For managed Enterprise customers, Identity Security is enabled by default.
-If you are a self-hosted Teleport customer, you will need to [deploy the Access Graph Service](../deploy-a-cluster/access-graph/access-graph.mdx) and ensure you have an updated
-`license.pem` with Identity Security enabled to use it.
-</Admonition>
-
-## Identity Security guides
-
-<DocCardList />
diff --git a/docs/pages/changelog.mdx b/docs/pages/changelog.mdx
index 3676469d022ac..6da111faf54d0 100644
--- a/docs/pages/changelog.mdx
+++ b/docs/pages/changelog.mdx
@@ -1,7 +1,13 @@
 ---
 title: Teleport Changelog
 description: The Changelog provides a comprehensive description of the changes introduced by each Teleport release.
+tags:
+ - reference
+ - platform-wide
 ---
+
 {/*lint disable absolute-docs-links*/}
 
+The Teleport changelog lists changes introduced by each version of Teleport. 
+
 (!CHANGELOG.md!)
diff --git a/docs/pages/reference/cloud-faq.mdx b/docs/pages/cloud-faq.mdx
similarity index 75%
rename from docs/pages/reference/cloud-faq.mdx
rename to docs/pages/cloud-faq.mdx
index 16197d3b97c7b..7c293df0b45ed 100644
--- a/docs/pages/reference/cloud-faq.mdx
+++ b/docs/pages/cloud-faq.mdx
@@ -1,12 +1,14 @@
 ---
 title: Teleport Enterprise Cloud FAQ
 description: Teleport cloud frequently asked questions.
-tocDepth: 3
+tags:
+ - faq
+ - platform-wide
 ---
 
 This page provides answers to frequently asked questions about Teleport
 Enterprise (Cloud). For a list of frequently asked questions about Teleport in
-general, see [Frequently Asked Questions](../faq.mdx).
+general, see [Frequently Asked Questions](faq.mdx).
 
 ## Billing and usage
 
@@ -26,7 +28,7 @@ If you plan to use S3 and DynamoDB as storage backends, we can provide data for
 
 ### How long will Teleport Enterprise Cloud retain my data?
 
-See our documentation on [data retention](architecture/teleport-cloud-architecture.mdx).
+See our documentation on [data retention](reference/architecture/teleport-cloud-architecture.mdx).
 
 ### Is an independent security audit available?
 
@@ -48,30 +50,39 @@ for customer data including session recordings and user records.
 
 ### Can I get a list of IP addresses that my infrastructure will need to allow connections to?
 
-See the [Public IP Address Allowlist](../ips.mdx) for the list of IP addresses used for inbound connections to Teleport Enterprise Cloud.
+See the [Public IP Address Allowlist](ips.mdx) for the list of IP addresses used for inbound connections to Teleport Enterprise Cloud.
 
 ### Can I configure a list of IP addresses which are allowed to connect to Teleport Enterprise Cloud?
 
 We do not have plans to offer support for inbound connection IP allowlists.
 
-We believe mTLS with strong user and [device identity](../admin-guides/access-controls/device-trust/guide.mdx) provides the best available
+We believe mTLS with strong user and [device identity](identity-governance/device-trust/guide.mdx) provides the best available
 security for client authentication.
 
 For customers that require IP-based control for compliance purposes, we do
 support IP Pinning. For more information see `pin_source_ip` in our [Teleport
-Access Controls Reference](access-controls/roles.mdx).
+Access Controls Reference](reference/access-controls/roles.mdx).
 
 ### Are internal connections encrypted / authenticated?
 
 Teleport components communicate with themselves using mTLS, with a separate certificate authority for each tenant. Connections to AWS services, such as DynamoDB and
 S3, are established using encryption provided by AWS, both at rest and in transit. Each tenant has its own credentials that isolate it to interacting with only its own data.
+
+### Is Teleport Enterprise (cloud-hosted) PCI compliant?
+
+Teleport Enterprise (cloud-hosted) is a PCI DSS (Payment Card Industry Data Security Standard) Level 1 compliant service provider. This means we have met the highest standards for data security set by the PCI Security Standards Council. Our compliance is verified through an annual assessment conducted by a Qualified Security Assessor (QSA). Our most recent Attestation of Compliance can be viewed at [trust.goteleport.com](https://trust.goteleport.com).
+
+Teleport Enterprise (cloud-hosted) can be used to meet multiple security requirements for PCI environments and provides customers details on how to secure their Cardholder Data Environment when using Teleport Enterprise (cloud-hosted). This includes a shared responsibilities matrix that outlines Teleport's, the customer's, and shared responsibilities.
+
+Additionally, Teleport takes reasonable steps to identify and remove sensitive data that could be inadvertently stored or transmitted on systems it controls.  Any cardholder data received from a customer is considered an "unintended channel."
+
 ## Connecting resources
 
 ### How do I add resources to Teleport Enterprise Cloud?
 
 You can connect servers, Kubernetes clusters, databases, desktops, and
 applications using [reverse
-tunnels](../enroll-resources/agents/agents.mdx).
+tunnels](enroll-resources/agents/agents.mdx).
 
 There is no need to open any ports on your infrastructure for inbound traffic.
 
@@ -85,7 +96,7 @@ If you plan on connecting more than 10,000 nodes or agents, please contact your
 ### Are dynamic node tokens available?
 
 After [connecting](#how-can-i-access-the-tctl-admin-tool) `tctl` to Teleport Enterprise Cloud, users can generate
-[dynamic tokens](../enroll-resources/agents/join-token.mdx):
+[dynamic tokens](enroll-resources/agents/join-token.mdx):
 
 ```code
 $ tctl nodes add --ttl=5m --roles=node,proxy --token=$(uuid)
@@ -95,7 +106,7 @@ $ tctl nodes add --ttl=5m --roles=node,proxy --token=$(uuid)
 
 ### How can I access the `tctl` admin tool?
 
-Find the appropriate download at [Installation](../installation.mdx).
+Find the appropriate download at [Installation](installation/installation.mdx).
 
 After downloading the tools, first log in to your cluster using `tsh`, then use `tctl` remotely:
 
@@ -117,15 +128,15 @@ $ tctl tokens add --type=node
 
 ### Is there a way to forward Teleport Enterprise Cloud audit events to my company's internal Security Information and Event Management (SIEM)?
 
-Yes. We recommend Teleport's [event handler plugin](../admin-guides/management/export-audit-events/fluentd.mdx) to export Teleport Enterprise Cloud audit events.
+Yes. We recommend Teleport's [event handler plugin](zero-trust-access/export-audit-events/fluentd.mdx) to export Teleport Enterprise Cloud audit events.
 
 ### Is it possible to store audit logs and session recordings in my own S3 bucket?
 
-Yes, you can configure [External Audit Storage](../admin-guides/management/external-audit-storage.mdx).
+Yes, you can configure [External Audit Storage](zero-trust-access/management/external-audit-storage.mdx).
 
-### Is it possible to enable proxy recording mode?
+### Is it possible to enable recording proxy mode?
 
-Proxy recording mode is disabled for cloud customers
+Recording proxy mode is disabled for Teleport Cloud customers.
 
 ### Is there a way to download session recordings for easy playback?
 
@@ -138,12 +149,12 @@ The ability to download recordings for offline viewing will be available in a fu
 If you have Teleport Agents connected to a Teleport Enterprise Cloud cluster
 that are more than one major version behind, you might experience compatibility
 issues unless your Teleport Agents are enrolled in automatic updates. See the [Upgrading
-Overview](../upgrading/overview.mdx) for more information.
+Overview](upgrading/overview.mdx) for more information.
 
 To get version information for your Teleport Agents, see [How can I find version information on
 connected agents?](#how-can-i-find-version-information-on-connected-agents).
 
-If you want more details about cluster updates, see [Cloud Cluster Updates](../upgrading/cloud-cluster-updates.mdx).
+If you want more details about cluster updates, see [Cloud Cluster Updates](upgrading/cloud-cluster-updates.mdx).
 
 For more information about automatic updates and compatibility issues, contact
 [Teleport support](https://goteleport.com/support/).
@@ -162,7 +173,7 @@ connected agents?](#how-can-i-find-version-information-on-connected-agents) for
 
 ### Are updates times configurable for Teleport Enterprise Cloud?
 
-Yes, see [Cloud Cluster Updates](../upgrading/cloud-cluster-updates.mdx#maintenance-windows) for further instruction.
+Yes, see [Cloud Cluster Updates](upgrading/cloud-cluster-updates.mdx#maintenance-windows) for further instruction.
 
 ### When are agents automatically updated?
 
@@ -174,7 +185,7 @@ update the software when new versions are found.
 If you enroll in automatic agent updates, Teleport Agents are automatically
 updated after your Teleport cluster is updated during your scheduled maintenance
 period. For more information, read the [Automatic Agent
-Updates](../upgrading/agent-managed-updates.mdx) guide.
+Updates](upgrading/agent-managed-updates/agent-managed-updates.mdx) guide.
 
 ### How can I find version information on connected agents?
 
@@ -236,7 +247,7 @@ than through a port allocated to that service.
 In this case, you can see that TLS routing is enabled, and that the Proxy
 Service's public web address (`ssh.public_addr`) is `example.teleport.sh:443`.
 
-Read more in our [TLS Routing](architecture/tls-routing.mdx) guide.
+Read more in our [TLS Routing](reference/architecture/tls-routing.mdx) guide.
 
 ### How does Teleport manage web certificates? Can I upload my own?
 
@@ -247,7 +258,7 @@ certificate or use a custom domain name.
 ### Where does Teleport Enterprise Cloud run?
 
 Teleport Cloud runs on Amazon Web Services (AWS). We run proxies in a variety
-of regions all over the world, and allow customers to [select the region](architecture/teleport-cloud-architecture.mdx) where the data is stored.
+of regions all over the world, and allow customers to [select the region](reference/architecture/teleport-cloud-architecture.mdx) where the data is stored.
 
 ### Are you using AWS-managed encryption keys, or CMKs via KMS?
 
@@ -257,7 +268,7 @@ We use AWS-managed keys. Currently there is no option to provide your own key.
 
 It's a Teleport-managed S3 bucket with AWS-managed keys by default.
 
-Configuring [External Audit Storage](../admin-guides/management/external-audit-storage.mdx) will allow
+Configuring [External Audit Storage](zero-trust-access/management/external-audit-storage.mdx) will allow
 you to use your own S3 bucket.
 
 ### Is IPv6 Supported for connections to Teleport Enterprise Cloud?
@@ -312,8 +323,41 @@ When you sign up for a Teleport Enterprise (Cloud) account and set up your first
 user within the account, the Teleport Web UI displays a set of recovery codes:
 
 ![Web UI view showing Teleport recovery
-codes](../../img/cloud/recovery-codes.png)
+codes](../img/cloud/recovery-codes.png)
 
 Save the recovery codes into a safe location, such as your organization's
 password manager. You can use these codes to reset your account if you lose
 your password or multi-factor authentication credentials.
+
+### How do I update my security and business contacts?
+
+Teleport Cloud users can configure up to 3 security contacts and 3 business contacts for their cluster. It's important to
+keep these up to date so that we always know who to notify of important updates and alerts.
+
+To do this, log in to your Teleport Cloud account with the email address of the user that created the initial Cloud tenant. Open
+the user dropdown menu on the top right of the navigation bar, and select "Help & Support," then scroll down until you see the contacts sections.
+Once you add a contact, they will receive an invitation email which they must accept within 14 days.
+
+![Web UI view showing security and business contacts options](../img/cloud/security-business-contacts.png)
+
+If you don't see the contacts lists on the Help & Support page, ensure that your user has the required permissions to see and update contacts. You
+can also create a separate role that grants these permissions and assign it to your user and any other desired users:
+
+```yaml
+version: v6
+kind: role
+metadata:
+  description: Edit Contacts
+  name: contact-editor
+spec:
+  allow:
+    rules:
+    - resources:
+      - contact
+      verbs:
+      - list
+      - create
+      - read
+      - update
+      - delete
+```
diff --git a/docs/pages/connect-your-client/connect-your-client.mdx b/docs/pages/connect-your-client/connect-your-client.mdx
index 6149a7098d5a1..0a710a2e8784e 100644
--- a/docs/pages/connect-your-client/connect-your-client.mdx
+++ b/docs/pages/connect-your-client/connect-your-client.mdx
@@ -1,6 +1,37 @@
 ---
 title: Teleport User Guides
+sidebar_label: User Guides
 description: Provides instructions to help users connect to infrastructure resources with Teleport.
+tags:
+ - platform-wide
 ---
 
-<DocCardList />
+The guides in this section explain how to access infrastructure resources
+protected by Teleport.
+
+## Teleport clients
+
+Teleport Connect is a graphical interface that allows you to access protected
+resources, often without needing a third-party client tool. For a similar
+experience within your browser, you can use the Teleport Web UI.
+
+Teleport provides a command-line tool, `tsh`, that allows you to access
+Teleport-protected resources using terminal-based workflows the same as a
+protected resource's native tooling.
+
+Read the [Introduction to Teleport
+Clients](./teleport-clients/teleport-clients.mdx).
+
+## MCP clients
+
+You can configure MCP clients like Cursor and Claude Desktop to securely access
+Teleport-protected resources.
+
+Read [MCP Clients](./model-context-protocol/model-context-protocol.mdx).
+
+## Third-party clients
+
+You can use Teleport-issued credentials to give your third-party client tools,
+including graphical clients and IDEs, access to Teleport-protected resources.
+Read [Third-Party Clients](./third-party/third-party.mdx).
+
diff --git a/docs/pages/connect-your-client/gui-clients.mdx b/docs/pages/connect-your-client/gui-clients.mdx
deleted file mode 100644
index efaf9cf27332b..0000000000000
--- a/docs/pages/connect-your-client/gui-clients.mdx
+++ /dev/null
@@ -1,656 +0,0 @@
----
-title: Database Access GUI Clients
-description: How to configure graphical database clients for Teleport database access.
----
-
-This guide describes how to configure popular graphical database clients to
-work with Teleport.
-
-## Setting up your Teleport environment
-
-### Prerequisites
-
-- A running Teleport cluster. If you want to get started with Teleport, [sign
-  up](https://goteleport.com/signup) for a free trial or [set up a demo
-  environment](../admin-guides/deploy-a-cluster/linux-demo.mdx).
-
-- The `tsh` client tool. Visit [Installation](../installation.mdx) for instructions on downloading
-  `tsh`. See the [Using Teleport Connect](./teleport-connect.mdx) guide for a graphical desktop client
-  that includes `tsh`.
-
-- To check that you can connect to your Teleport cluster, sign in with `tsh login`. For example:
-
-  ```code
-  $ tsh login --proxy=teleport.example.com --user=myuser@example.com
-  ```
-
-- The Teleport Database Service configured to access a database. See one of our
-  [guides](../enroll-resources/database-access/guides/guides.mdx) for how to set up the Teleport
-  Database Service for your database.
-
-### Get connection information
-
-Get information about the host and port where your database is available so you
-can configure your GUI client to access the database.
-
-#### Using a local proxy server
-
-Use the `tsh proxy db` command to start a local TLS proxy your GUI database
-client will be connecting to. This command requires that you use Teleport
-Enterprise (Cloud) or, if self-hosting Teleport, have enabled [TLS
-routing](../admin-guides/management/operations/tls-routing.mdx) mode.
-
-Run a command similar to the following::
-
-```code
-$ tsh proxy db <database-name>
-Started DB proxy on 127.0.0.1:61740
-
-Use following credentials to connect to the <database-name> proxy:
-  ca_file=/Users/r0mant/.tsh/keys/root.gravitational.io/certs.pem
-  cert_file=/Users/r0mant/.tsh/keys/root.gravitational.io/alice-db/root/<database-name>-x509.pem
-  key_file=/Users/r0mant/.tsh/keys/root.gravitational.io/alice
-```
-
-Use the displayed local proxy host/port and credentials paths when configuring
-your GUI client below. When entering the hostname, use `localhost` rather than
-`127.0.0.1`.
-
-Starting the local database proxy with the `--tunnel` flag will create an
-authenticated tunnel that you can use to connect to your database instances.
-You won't need to configure any credentials when connecting to this tunnel.
-
-Here is an example on how to start the proxy:
-
-```code
-# Start the local proxy.
-$ tsh proxy db --tunnel <database-name>
-Started authenticated tunnel for the <engine> database "<database-name>" in cluster "<cluster-name>" on 127.0.0.1:62652.
-```
-
-You can optionally specify the database name and the user to use by default
-when connecting to the database:
-
-```code
-$ tsh proxy db --db-user=my-database-user --db-name=my-schema --tunnel <database-name>
-```
-
-Now, you can connect to the address the proxy command returns. In our example it
-is `127.0.0.1:62652`.
-
-#### Using a remote host and port
-
-If you are self-hosting Teleport and not using [TLS
-routing](../admin-guides/management/operations/tls-routing.mdx), run the
-following command to see the database connection information:
-
-```code
-# View configuration for the database you're logged in to.
-$ tsh db config
-# View configuration for the specific database when you're logged into multiple.
-$ tsh db config example
-```
-
-It will display the path to your locally cached certificate and key files:
-
-```
-Name:      example
-Host:      teleport.example.com
-Port:      3080
-User:      postgres
-Database:  postgres
-CA:        /Users/alice/.tsh/keys/teleport.example.com/certs.pem
-Cert:      /Users/alice/.tsh/keys/teleport.example.com/alice-db/root/example-x509.pem
-Key:       /Users/alice/.tsh/keys/teleport.example.com/alice
-```
-
-The displayed `CA`, `Cert`, and `Key` files are used to connect through pgAdmin
-4, MySQL Workbench, and other graphical database clients that support mutual
-TLS authentication.
-
-## MongoDB Compass
-
-[Compass](https://www.mongodb.com/products/compass) is the official MongoDB
-graphical client.
-
-On the "New Connection" panel, click on "Fill in connection fields individually".
-
-![MongoDB Compass new connection](../../img/database-access/compass-new-connection@2x.png)
-
-On the "Hostname" tab, enter the hostname and port of the proxy you will use to
-access the database (see
-[Get connection information](./gui-clients.mdx#get-connection-information)).
-Leave "Authentication" as None.
-
-![MongoDB Compass hostname](../../img/database-access/compass-hostname@2x.png)
-
-On the "More Options" tab, set SSL to "Client and Server Validation" and set the
-CA as well as the client key and certificate. Note that a CA path must be
-provided and be able to validate the certificate presented by your Teleport
-Proxy Service's web endpoint.
-
-![MongoDB Compass more options](../../img/database-access/compass-more-options@2x.png)
-
-The following fields in the More Options tab must correspond to paths printed by
-the `tsh proxy db` command you ran earlier:
-
-|Field|Path|
-|---|---|
-|Certificate Authority|`ca_file`|
-|Client Certificate|`cert_file`|
-|Client Private Key|`key_file`|
-
-Click on the "Connect" button.
-
-## MySQL DBeaver
-
-Right-click in the "Database Navigator" menu in the main view and select Create > Connection:
-
-![DBeaver Add Server](../../img/database-access/dbeaver-add-server.png)
-
-In the search bar of the "Connect to a database" window that opens up, type "mysql", select the MySQL driver, and click "Next":
-
-![DBeaver Select Driver](../../img/database-access/dbeaver-select-driver.png)
-
-In the newly-opened "Connection Settings" tab, use the Host as `localhost` and
-Port as the one returned by the proxy command (`62652` in the example above):
-
-![DBeaver Select Configure Server](../../img/database-access/dbeaver-configure-server.png)
-
-In that same tab, set the username to match the one that you are connecting to
-using Teleport and uncheck the "Save password locally" box:
-
-![DBeaver Select Configure User](../../img/database-access/dbeaver-configure-user.png)
-
-Click the "Edit Driver Settings" button on the "Main" tab, check the "No
-Authentication" box, and click "Ok" to save:
-
-![DBeaver Driver Settings](../../img/database-access/dbeaver-driver-settings.png)
-
-Once you are back in the "Connection Settings" window, click "Ok" to finish and
-DBeaver should connect to the remote MySQL server automatically.
-
-## MySQL Workbench
-
-[MySQL Workbench](https://www.mysql.com/products/workbench/) is a GUI
-application that provides comprehensive MySQL administration and SQL development
-tools.
-
-In the MySQL Workbench "Setup New Connection" dialog, fill out "Connection
-Name", "Hostname", "Port", and "Username":
-
-![MySQL Workbench
-Parameters](../../img/database-access/workbench-parameters@2x.png)
-
-In the "SSL" tab, set "Use SSL" to `Require and Verify Identity` and enter the
-paths to your CA, certificate, and private key files (see
-[Get connection information](./gui-clients.mdx#get-connection-information)):
-
-![MySQL Workbench SSL](../../img/database-access/workbench-ssl@2x.png)
-
-The following fields in the SSL tab must correspond to paths printed by the `tsh
-proxy db` command you ran earlier:
-
-|Field|Path|
-|---|---|
-|SSL Key File|`key_file`|
-|SSL CERT File|`cert_file`|
-|SSL CA File|`ca_file`|
-
-Optionally, click "Test Connection" to verify connectivity:
-
-![MySQL Workbench Test](../../img/database-access/workbench-test@2x.png)
-
-Save the connection and connect to the database.
-
-## NoSQL Workbench
-
-From the NoSQL Workbench launch screen, click **Launch** next to **Amazon DynamoDB**.
-From the left-side menu select **Operation builder**, then **+ Add connection**.
-Choose the **DynamoDB local** tab, and point to your proxy's endpoint. This is
-`localhost:62652` in the example above. (See
-[Get connection information](./gui-clients.mdx#get-connection-information) for
-more information.)
-
-![DynamoDB local connection in NoSQL Workbench](../../img/database-access/nosql-workbench-connection.png)
-
-## SQL Server with Azure Data Studio
-
-In Azure Data Studio create a connection using your proxy's endpoint. This is
-`localhost,62652` in the example above. On a Windows machine, using an address in
- the format `127.0.0.1,62652` could be required instead of `localhost`. (See
-[Get connection information](./gui-clients.mdx#get-connection-information) for
-more information.)
-
-Create a connection with Microsoft SQL Server with these settings:
-
-|Connection Detail|Value|
-|---|---|
-|Server|`host`,`port` of proxy endpoint|
-|Authentication Type|SQL Login|
-|Password|empty|
-|Encrypt|`False`|
-
-Example:
-![Azure Data Studio connection options](../../img/database-access/azure-data-studio-connection.png)
-
-Click **Connect** to connect.
-
-## PostgreSQL DBeaver
-
-To connect to your PostgreSQL instance, use the authenticated proxy address.
-This is `127.0.0.1:62652` in the example above (see the “Authenticated Proxy”
-section on [Get connection information](./gui-clients.mdx#get-connection-information)
-for more information).
-
-Use the "Database native" authentication with an empty password:
-
-![DBeaver Postgres Configure
-Server](../../img/database-access/dbeaver-pg-configure-server.png)
-
-Clicking on "Test connection" should return a connection success message. Then,
-click on "Finish" to save the configuration.
-
-## PostgreSQL pgAdmin 4
-
-[pgAdmin 4](https://www.pgadmin.org/) is a popular graphical client for
-PostgreSQL servers.
-
-To configure a new connection, right-click on "Servers" in the main browser view
-and create a new server:
-
-![pgAdmin Add Server](../../img/database-access/pgadmin-add-server@2x.png)
-
-In the "General" tab of the new server dialog, enter the server connection name:
-
-![pgAdmin General](../../img/database-access/pgadmin-general@2x.png)
-
-In the "Connection" tab, fill in the hostname, port, user and database name from
-the configuration above:
-
-![pgAdmin Connection](../../img/database-access/pgadmin-connection@2x.png)
-
-In the "SSL" tab, set "SSL Mode" to `Verify-Full` and fill in paths for client
-certificate, key and root certificate from the configuration above:
-
-![pgAdmin SSL](../../img/database-access/pgadmin-ssl@2x.png)
-
-The following fields in the SSL tab must correspond to paths printed by the `tsh
-proxy db` command you ran earlier:
-
-|Field|Path|
-|---|---|
-|Client certificate|`cert_file`|
-|Client certificate key|`key_file`|
-|Root certificate|`ca_file`|
-
-Click "Save", and pgAdmin should immediately connect. If pgAdmin prompts you
-for password, leave the password field empty and click OK.
-
-## Microsoft SQL Server Management Studio
-
-In Microsoft SQL Server Management Studio connect to a database engine using
-your proxy's endpoint. This is `localhost,62652` in the example above. Using
-the IP `127.0.0.1,62652` connection could be required on a Windows machine
-instead of `localhost`. (See [Get connection information](./gui-clients.mdx#get-connection-information) for
-more information.)
-
-Create a connection with Microsoft SQL Server with these settings:
-
-|Connection Detail|Value|
-|---|---|
-|Server type|Database Engine|
-|Server name|`host`,`port` of proxy endpoint|
-|Authentication|SQL Server Authentication|
-|Password|empty|
-|Encryption|do not enable|
-
-Example:
-![Microsoft SQL Server Management Studio connection options](../../img/database-access/msft-sql-server-management-studio-connection.png)
-  
-Click Connect to connect.
-
-## Redis Insight
-
-<Admonition type="note">
-  Teleport's Redis Insight integration only supports Redis standalone instances.
-</Admonition>
-
-After opening Redis Insight click `ADD REDIS DATABASE`.
-
-![Redis Insight Startup Screen](../../img/database-access/guides/redis/redisinsight-startup.png)
-
-Now start a local proxy to your Redis instance:
-
-`tsh proxy db --db-user=alice redis-db-name`.
-
-Click `Add Database Manually`. Use `127.0.0.1` as the `Host`. Use the port printed by
-the `tsh` command you ran in [Get connection information](#get-connection-information).
-
-Provide your Redis username as `Username` and password as `Password`.
-
-![Redis Insight Configuration](../../img/database-access/guides/redis/redisinsight-add-config.png)
-
-Next, check the `Use TLS` and `Verify TLS Certificates` boxes. Copy the contents
-of the files at the paths returned by the `tsh proxy db` command you ran earlier
-and paste them into their corresponding fields. See the table below for the
-Redis Insight fields that correspond to each path:
-
-|Field|Path|
-|---|---|
-|CA Certificate|`ca_file`|
-|Client Certificate|`cert_file`|
-|Private Key|`key_file`|
-
-Click `Add Redis Database`.
-
-![Redis Insight TLS Configuration](../../img/database-access/guides/redis/redisinsight-tls-config.png)
-
-Congratulations! You have just connected to your Redis instance.
-
-![Redis Insight Connected](../../img/database-access/guides/redis/redisinsight-connected.png)
-
-## Snowflake: DBeaver
-
-The Snowflake integration works only in the authenticated proxy mode. Start a local proxy for connections to your Snowflake database by using the command below:
-```
-tsh proxy db --tunnel --port 2000 snowflake
-```
-
-Add a new database by clicking the "add" icon in the top-left corner:
-
-![DBeaver Main Screen](../../img/database-access/guides/snowflake/dbeaver-main-screen.png)
-
-In the search bar of the "Connect to a database" window that opens up, type "snowflake", select the Snowflake driver, and click "Next":
-
-![DBeaver Select Database](../../img/database-access/guides/snowflake/dbeaver-select-database.png)
-
-Set "Host" to `localhost` and "Port" to the port returned by the `tsh proxy db` command you ran earlier (`2000` in the example above).
-In the "Authentication" section set the "Username" to match the database username passed to Teleport with `--db-user`
-and enter any value (e.g., "teleport") in the "Password" field (the value of
- "Password" will be ignored when establishing a connection but is required by DBeaver to register your database):
-
-![DBeaver Main](../../img/database-access/guides/snowflake/dbeaver-main.png)
-
-Next, click the "Driver properties" tab and set "account" to any value (e.g., "teleport"; as with "Password", the value of
- "account" will be ignored when establishing a connection but is required by DBeaver to register your database). In "User properties", set "ssl" to `off`:
-
-![DBeaver Driver](../../img/database-access/guides/snowflake/dbeaver-driver.png)
-
-Teleport ignores the provided password and the account name as internally it uses values from the Database Agent configuration.
-SSL set to `off` disables only encryption on local machine. Connection to Snowflake is encrypted by Teleport.
-
-Now you can click on "Test Connection..." in the bottom-left corner:
-
-![DBeaver Success](../../img/database-access/guides/snowflake/dbeaver-success.png)
-
-Congratulations! You have just connected to your Snowflake instance.
-
-## Snowflake: JetBrains (IntelliJ, Goland, DataGrip, PyCharm, etc.)
-
-The Snowflake integration works only in the authenticated proxy mode. Start a local proxy for connections to your Snowflake database by using the command below:
-```
-tsh proxy db --tunnel --port 2000 snowflake
-```
-
-In "Database Explorer" click the "add" button, pick "Data Source", and then pick "Snowflake":
-
-![JetBrains Add Database](../../img/database-access/guides/snowflake/jetbrains-add-database.png)
-
-Next, set "Host" to `localhost` and "Port" to the port returned by the `tsh proxy db` command you ran earlier (`2000` in the example above).
-Set the "Username" to match the one that you are assuming when you connect to Snowflake
- via Teleport and enter any value (e.g., "teleport") in the "Password" field (the value of
- "Password" will be ignored but is required to create a data source in your IDE):
-
-![JetBrains General](../../img/database-access/guides/snowflake/jetbrains-general.png)
-
-Switch to the "Advanced" tab, set any value (e.g., "teleport") for "account", and add a new record named `ssl` with value `off` (as with "Password", "account" is ignored while establishing the connection but required by your IDE):
-
-![JetBrains Advanced](../../img/database-access/guides/snowflake/jetbrains-advanced.png)
-
-Teleport ignores the provided password and the account name as internally it uses values from the Database Agent configuration.
-Setting "SSL" to `off` only disables encryption on your local machine. The connection to Snowflake is encrypted by Teleport.
-
-Now you can click "Test Connection" to check your configuration.
-
-![JetBrains Success](../../img/database-access/guides/snowflake/jetbrains-success.png)
-
-Congratulations! You have just connected to your Snowflake instance.
-
-## SQL Server DataGrip
-
-In the DataGrip connection configuration menu, use your proxy's endpoint. This
-is `localhost:4242` in the example below. (See
-[Get connection information](./gui-clients.mdx#get-connection-information) for
-more information.)
-
-Select the "User & Password" authentication option and keep the "Password" field
-empty:
-
-![DataGrip connection options](../../img/database-access/guides/sqlserver/datagrip-connection@2x.png)
-
-Click "OK" to connect.
-
-## SQL Server DBeaver
-
-In the DBeaver connection configuration menu, use your proxy's endpoint. This is
-`localhost:62652` in the example above. (See
-[Get connection information](./gui-clients.mdx#get-connection-information) for
-more information.)
-
-Use the SQL Server Authentication option and keep the Password field empty:
-
-![DBeaver connection options](../../img/database-access/guides/sqlserver/dbeaver-connection@2x.png)
-
-Click OK to connect.
-
-## Cloud Spanner DataGrip
-
-(!docs/pages/includes/database-access/gui-clients/spanner-local-proxy.mdx!)
-
-From the DataGrip menu, click "File > New > Data Source from URL", then copy and
-paste the JDBC URL that was output by `tsh proxy db`:
-
-![Create DataGrip Spanner Data Source From JDBC URL](../../img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png)
-
-The "Google Cloud Spanner" driver should be automatically selected.
-Click "Ok".
-
-DataGrip does not need GCP credentials - those are already provided by Teleport.
-On the "General" tab of the new data source, select the "Authentication"
-dropdown setting and choose "No auth":
-
-![Choose No Auth For DataGrip Spanner Data Source](../../img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png)
-
-Click "Test connection" to ensure the connection is configured correctly, then
-click "Ok" to create the data source.
-
-(!docs/pages/includes/database-access/gui-clients/spanner-reuse-port-note.mdx!)
-
-## Cloud Spanner DBeaver
-
-(!docs/pages/includes/database-access/gui-clients/spanner-local-proxy.mdx!)
-
-From the menu, click "Database > Driver Manager":
-
-![Open DBeaver Driver Manager](../../img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png)
-
-Search for the "Google Cloud Spanner" driver, select it, and click the "Copy"
-button to make a custom driver configuration:
-
-![Copy DBeaver Google Spanner Driver](../../img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png)
-
-Give the custom driver a name, e.g. "Teleport Spanner", then set "URL Template"
-to this pattern string:
-
-```code
-jdbc:cloudspanner://127.0.0.1:{port}/projects/{server}/instances/{host}/databases/{database};usePlainText=true
-```
-
-![Create Custom DBeaver Google Spanner Driver](../../img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png)
-
-Click "Ok", then click "Close"
-
-From the menu, click "Database > New Connection from JDBC URL":
-
-Now copy the JDBC URL that was output by `tsh proxy db` and paste it:
-
-![Create DBeaver Spanner Connection From JDBC URL](../../img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png)
-
-Click "Proceed", then click "Finish".
-
-(!docs/pages/includes/database-access/gui-clients/spanner-reuse-port-note.mdx!)
-
-## Oracle graphical clients
-
-The Oracle integration works only in the authenticated proxy mode. Start a local proxy for connections to your Oracle database by using the command below:
-
-```
-> tsh proxy db --tunnel --port 11555 --db-user=<user> --db-name=<db-name> oracle
-
-Started authenticated tunnel for the Oracle database "oracle" in cluster "teleport.example.com" on 127.0.0.1:11555.
-```
-
-<Admonition type="tip">
-The command above uses the local port 11555, but you can choose any available port. Leaving `--port` empty will cause `tsh` to pick a random one.
-</Admonition>
-
-The local proxy supports TCP and TCPS modes. Different clients prefer different modes.
-
-TCP:
-- requires no username or password
-- generally easier to configure
-
-TCPS:
-- requires no username or password
-- depends on automatically created wallet
-- uses JDBC URL for configuration
-
-<Admonition type="warning">
-Teleport versions earlier than 17.2.0 support only a limited range of clients and only offer TCPS mode. `tsh` will automatically detect this situation and warn the user. We recommend updating to the latest version of Teleport to access full client support and additional connection options.
-</Admonition>
-
-### Oracle SQL Developer (standalone)
-
-In "Connections" click the "+" button for a new database connection:
-
-![Oracle SQL Developer Add Database Connection](../../img/database-access/guides/oracle/sql-developer-standalone-add-database.png)
-
-Next, set the name and username from the `--db-user` parameter. Set connection type to "Custom JDBC" and 
-set the "Custom JDBC URL" from the `tsh proxy db` command.
-
-![Oracle SQL Developer](../../img/database-access/guides/oracle/sql-developer-standalone-conn-details-tcps.png)
-
-Now you can click "Test" to check your configuration.
-
-![Oracle SQL Developer Success](../../img/database-access/guides/oracle/sql-developer-standalone-success.png)
-
-### Oracle SQL Developer (VS Code extension)
-
-Install the extension from [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Oracle.sql-developer).
-
-Both TCP and TCPS modes can be used.
-
-<Tabs>
-<TabItem label="TCP">
-
-Open the extension toolbar and click on "Create Connection" button.
-
-![SQL Developer (VS Code) Start](../../img/database-access/guides/oracle/sql-developer-vscode-start@2x.png)
-
-Enter the following connection details:
-
-| Field           | Value                  |
-|-----------------|------------------------|
-| Connection name | Choose unique name     |
-| User name       | `/`                    |
-| Password        | `/`                    |
-| Save Password   | Mark checkbox          |
-| Connection type | Basic                  |
-| Host name       | `localhost`            |
-| Port number     | `--port` flag value    |
-| Type            | Service Name           |
-| Service name    | `--db-name` flag value |
-
-Test and create the connection.
-
-![SQL Developer (VS Code) Connection Details (basic)](../../img/database-access/guides/oracle/sql-developer-vscode-conn-details-basic@2x.png)
-
-The new connection should appear on the list.
-
-![SQL Developer (VS Code) Connected (basic)](../../img/database-access/guides/oracle/sql-developer-vscode-connected-basic@2x.png)
-
-</TabItem>
-
-<TabItem label="TCPS">
-
-Open the extension toolbar and click on "Create Connection" button.
-
-![SQL Developer (VS Code) Start](../../img/database-access/guides/oracle/sql-developer-vscode-start@2x.png)
-
-Enter the following connection details:
-
-| Field            | Value                           |
-|------------------|---------------------------------|
-| Connection name  | (choose per your preference)    |
-| User name        | `/`                             |
-| Password         | `/`                             |
-| Save Password    | Mark the checkbox               |
-| Connection type  | "Custom JDBC"                   |
-| Custom JDBC URL  | Copy from `tsh proxy db` output |
-
-Test and create the connection.
-
-![SQL Developer (VS Code) Connection Details (JDBC)](../../img/database-access/guides/oracle/sql-developer-vscode-conn-details-jdbc@2x.png)
-
-The new connection should appear on the list.
-
-![SQL Developer (VS Code) Connected (JDBC)](../../img/database-access/guides/oracle/sql-developer-vscode-connected-jdbc@2x.png)
-
-
-</TabItem>
-</Tabs>
-
-### Toad
-
-Add new login record in the logins dialog.
-
-![Toad Add Login Record](../../img/database-access/guides/oracle/toad-add-login-record@2x.png)
-
-Enter the connection details in "Direct" tab:
-
-| Field           | Value                        |
-|-----------------|------------------------------|
-| Host name       | `127.0.0.1`                  |
-| Port number     | `--port` flag value          |
-| Service name    | `--db-name` flag value       |
-| User name       | `EXTERNAL`                   |
-| Password        | (leave empty)                |
-| Connection name | (choose per your preference) |
-
-Test the connection to verify the setup.
-
-![Toad Add Login Tested](../../img/database-access/guides/oracle/toad-add-login-tested@2x.png)
-
-The newly added login should appear on the login list.
-
-![Toad Login List](../../img/database-access/guides/oracle/toad-login-list@2x.png)
-
-<Admonition type="tip">
-You can also configure Toad to use an external Oracle client. Both native and external clients are supported.
-</Admonition>
-
-### DBeaver
-
-Click on the "New Database Connection" button.
-
-![DBeaver new connection button](../../img/database-access/guides/oracle/dbeaver-new-connection@2x.png)
-
-Select "Oracle" from the driver list. You may use the search toolbar to narrow down the list.
-![DBeaver connect to a database](../../img/database-access/guides/oracle/dbeaver-connect-to-a-database@2x.png)
-
-Choose "Custom" connection type and paste the JDBC connection string printed by `tsh proxy db`.
-![DBeaver JDBC details](../../img/database-access/guides/oracle/dbeaver-jdbc-details@2x.png)
-
-Test the connection to verify the setup. Finalize by clicking "Finish".
-
diff --git a/docs/pages/connect-your-client/introduction.mdx b/docs/pages/connect-your-client/introduction.mdx
deleted file mode 100644
index 27a44c6835074..0000000000000
--- a/docs/pages/connect-your-client/introduction.mdx
+++ /dev/null
@@ -1,348 +0,0 @@
----
-title: Introduction to Teleport Clients
-description: The basics of connecting to resources with Teleport
----
-
-This guide covers the basics of authenticating to Teleport and
-accessing resources. It's written for end-users of resources protected by
-Teleport, and includes links to more detailed documentation at the end.
-
-## Client tools
-
-### tsh
-
-`tsh` lets you authenticate to Teleport and list and connect to resources. After
-[downloading](https://goteleport.com/download/) and installing `tsh`, sign in to
-your Teleport cluster:
-
-<Tabs>
-<TabItem label="Local user">
-
-Authenticate to Teleport as a local user with `tsh login` by assigning <Var
-name="user"/> to your Teleport username and <Var name="teleport.example.com" />
-to the domain name of your Teleport cluster:
-
-```code
-$ tsh login --proxy=<Var name="teleport.example.com" description="Your Teleport Proxy Service or Teleport Cloud tenant address"/> --user=<Var name="user" description="Your Teleport username"/>
-Enter password for Teleport user alice:
-Tap any security key
-> Profile URL:        https://teleport.example.com:443
-  Logged in as:       alice
-  Cluster:            example.com
-  Roles:              access, requester
-  Logins:             ubuntu, ec2-user
-  Kubernetes:         enabled
-  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
-  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
-```
-
-</TabItem>
-<TabItem label="Single sign-on user">
-
-Authenticate to Teleport as a single sign-on (SSO) user by running `tsh login`
-and assigning <Var name="your-idp-connector" /> to the name of your
-authentication connector, if implemented by your administrators:
-
-```code
-$ tsh login --proxy=<Var name="teleport.example.com"/> --auth=<Var name="your-idp-connector" description="Your Identity Provider connection name, if implemented by your administrators"/>
-If browser window does not open automatically, open it by clicking on the link:
- http://127.0.0.1:49927/1d80e257-ec61-4ed2-9403-784f8d35b2fe
-> Profile URL:        https://teleport.example.com:443
-  Logged in as:       user@example.com
-  Cluster:            example.com
-  Roles:              access, requester
-  Logins:             ubuntu, ec2-user
-  Kubernetes:         enabled
-  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
-  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
-```
-
-Depending on how Teleport was configured for your network, you may not need
-the additional flags `--auth`. Your administrator should provide the details
-required for your particular use case.
-
-</TabItem>
-</Tabs>
-
-### Teleport Connect
-
-The Teleport Connect app provides all the same access to resources as `tsh` in
-a friendly graphic user interface. After [downloading](https://goteleport.com/download/)
-and installing Teleport Connect, you can log in and initiate sessions for
-server and database access within a single window.
-
-1. Click **CONNECT** to connect to the Teleport cluster:
-
-   ![A new instance of Teleport Connect](../../img/teleport-connect-init.png)
-
-1. Provide the address of your Teleport Cluster (e.g.
-   `https://example.teleport.sh`) and click **NEXT**.
-
-1. Teleport Connect will ask you for your username, password, and MFA.
-
-   If Teleport is integrated with an external Identity Provider (**IdP**), you might be
-   prompted to authenticate with that service in a browser window.
-
-1. Browse and connect to all the resources your user is permitted to access:
-
-   ![An example of Teleport Connect, populated with instances](../../img/use-teleport/connect-ui-overview@2x.png)
-
-### Web UI
-
-Teleport provides a web interface for users to interact with Teleport, e.g., by
-accessing resources or creating Access Requests. This is usually found at the
-same URL used to connect to Teleport with (e.g.  `https://example.teleport.sh`),
-but you should confirm the Web UI URL with the team that manages your Teleport
-deployment.
-
-The Web UI provides similar access to resources as Teleport Connect, and
-additional access to to Request and Activity logs for users with the right
-permissions.
-
-## Protocols
-
-### Server access (`ssh`)
-
-<Tabs>
-<TabItem label="tsh">
-
-`tsh ls` lists the servers you have access to through Teleport:
-
-```code
-$ tsh ls
-Node Name           Address         Labels
-------------------- --------------- ----------------------------
-server1.example.com 192.0.2.24:3022 access=servers,hostname=server1
-server2.example.com 192.0.2.32:3022 access=servers,hostname=server2
-```
-
-To connect to a server:
-
-```code
-$ tsh ssh ubuntu@server1.example.com
-ubuntu@server1:~$
-```
-
-</TabItem>
-<TabItem label="Teleport Connect">
-
-Under the **Servers** tab, click **CONNECT** next to the server you want to
-access. Select or type in a username available to your Teleport user.
-
-In a new tab, Teleport Connect will initiate the connection and provide a
-terminal environment.
-
-</TabItem>
-<TabItem label="Web UI">
-
-From the **Servers** menu, the Teleport Web UI will list all servers your user
-has permission to access. The **CONNECT** button will open a new tab with a
-terminal emulator to provide access to that server.
-
-</TabItem>
-</Tabs>
-
-### Kubernetes access (`kubectl`)
-
-<Tabs>
-<TabItem label="tsh">
-
-To see the Kubernetes clusters that you can access via Teleport, run the
-following command:
-
-```code
-$ tsh kube ls
- Kube Cluster Name Labels                      Selected
- ----------------- --------------------------- --------
- mycluster         env=dev
-```
-
-To log in to the cluster, run the following command, changing `mycluster` to the
-name of a Kubernetes cluster as it was listed in `tsh kube ls`:
-
-```code
-$ tsh kube login mycluster
-Logged into kubernetes cluster "mycluster". Try 'kubectl version' to test the
-connection.
-```
-
-When you log in to your Teleport cluster via `tsh kube login`, `tsh` updates
-your kubeconfig to point to your chosen Kubernetes cluster. You can then run
-`kubectl` commands against your cluster.
-
-</TabItem>
-<TabItem label="Teleport Connect">
-
-After logging in to a cluster in Teleport Connect, click the **Kubes** tab to
-see a list of Kubernetes clusters you can access.
-
-![Clusters you can access](../../img/use-teleport/connect-kube-list.png)
-
-Next to your chosen cluster, click **Connect**. Teleport Connect will
-open a terminal in a new tab and authenticate to the cluster. You can then run
-`kubectl` commands to interact with the cluster.
-
-![Connect to a cluster](../../img/use-teleport/connect-kube-access.png)
-</TabItem>
-<TabItem label="Web UI">
-
-In the Teleport Web UI, click the **Kubernetes** tab. You will see a list of
-Kubernetes clusters your Teleport user is authorized to connect to.
-
-![Available Kubernetes clusters](../../img/use-teleport/kubernetes-clusters.png)
-
-Find your chosen cluster and click **Connect**. You will see a modal window that
-lists the commands you can execute in your terminal to connect to the cluster
-via Teleport.
-
-![Connect to a Kubernetes
-cluster](../../img/use-teleport/kubernetes-login.png)
-
-</TabItem>
-</Tabs>
-
-### Transferring files
-
-<Tabs>
-<TabItem label="tsh scp">
-
-`tsh scp` will let you transfer files to servers behind Teleport:
-
-```code
-$ tsh scp some-file.ext server.example.com:
-some-file.ext   7% |███████                | (25/342 MB, 2.9 MB/s) [9s:1m48s]
-```
-</TabItem>
-<TabItem label="Teleport Connect">
-
-Teleport Connect allows you to transfer files to a remote server and runs on macOS, Linux and Windows. You can use the arrows in the top-left corner of an active SSH session to upload and download files:
-
-![Download with connect](../../img/download_files_connect.png)
-
-You can upload files from systems using drag and drop:
-
-![Drag and drop in Connect](../../img/upload_files_connect_drag_drop.png)
-
-</TabItem>
-<TabItem label="Web UI">
-
-You can use the arrows in the top-left corner of the Web UI to download files:
-
-![Arrows in Web UI](../../img/download_files_webui.png)
-
-Or you can upload using drag and drop:
-
-![Upload in Web UI](../../img/upload_files_webui.png)
-
-</TabItem>
-</Tabs>
-
-### Database access
-
-<Tabs>
-<TabItem label="tsh">
-
-`tsh db ls` will list the databases available to your user:
-
-```code
-$ tsh db ls
-Name                                               Description Allowed Users   Labels  Connect
------------------------------------------------    ----------- --------------- ------- -------------------------
-myelastic                                                      [alice elastic] env=dev
-mysql-server1 (user: alice, db: teleport_example)              [alice elastic] env=dev tsh db connect mysql-server1
-```
-
-To connect to a database server through `tsh`, you'll need a local client for
-that database. For example, to connect to a MySQL or MariaDB database, you'll
-need the [MySQL CLI](https://dev.mysql.com/doc/refman/8.0/en/mysql.html) client:
-
-```code
-$ tsh db connect --db-user=alice --db-name=teleport_example mysql-server1
-```
-
-In this example, `teleport_example` is a pre-existing database on the MySQL server:
-
-```sql
-SHOW DATABASES;
-+--------------------+
-| Database           |
-+--------------------+
-| information_schema |
-| mysql              |
-| performance_schema |
-| teleport_example   |
-+--------------------+
-4 rows in set (0.09 sec)
-```
-
-For other connection types, or to connect a graphic database client, you can
-create a local tunnel to point your software to:
-
-```code
-$ tsh proxy db myelastic --db-user=alice --tunnel
-Started authenticated tunnel for the Elasticsearch database "myelastic" in cluster "example.come" on 192.0.2.58:52669.
-
-Use one of the following commands to connect to the database:
-
-  * interactive SQL connection:
-
-  $ elasticsearch-sql-cli http://localhost:52669/
-
-  * run single request with curl:
-
-  $ curl http://localhost:52669/
-
-Database certificate renewed: valid until 2022-11-02T06:11:50Z [valid for 9h55m0s]
-```
-
-</TabItem>
-<TabItem label="Teleport Connect">
-
-In the **Databases** tab, select the database you want to access and click
-**CONNECT**. Select or type in a username available to your Teleport user.
-
-Teleport Connect will open a tunneled connection to the database. You can copy
-the port number and connect with a GUI app at `localhost`, or click **RUN** to
-initiate a CLI connection inside Teleport Connect:
-
-![Teleport Connect database connection](../../img/teleport-connect-mysql.png)
-
-</TabItem>
-<TabItem label="Web UI">
-
-The Teleport Web UI cannot provide direct connections to databases, but it will
-list those that are accessible to your user under **Databases** and provide
-`tsh` commands to connect from your local terminal environment.
-
-</TabItem>
-</Tabs>
-
-### Desktop access
-
-Desktop access is available through the Teleport Web UI.
-
-1. In your browser, navigate to your Teleport cluster (for example,
-`https://example.teleport.sh`).
-1. From the menu on the right, select **Desktops**.
-1. Next to the desktop you want to access, click **CONNECT**. Select
-or type in a username available to your Teleport user.
-1. Teleport will open a new browser tab or window and begin the RDP session.
-Note that you may need to wait a moment for Teleport to log you in as the specified user.
-
-## Next steps
-
-This guide covers the basic installation and access of Teleport for end users,
-but the rest of the Connect your Client section provides more detailed information.
-
-- `tsh` is the CLI tool for accessing resources through Teleport. With it,
-you can authenticate to Teleport, list available services, and connect to them
-either directly or through proxy tunnels.
-
-  Learn more about it from [Using the tsh Command Line Tool](./tsh.mdx).
-
-- Teleport Connect is a graphic utility for connecting to resources through
-  Teleport. You use it to connect to servers, databases, and Kubernetes
-  clusters. See [Using Teleport Connect](./teleport-connect.mdx).
-
-- [Access Teleport-protected databases with GUI clients](./gui-clients.mdx):
-  Details how to connect many popular database GUI clients through Teleport.
diff --git a/docs/pages/connect-your-client/model-context-protocol/database-access.mdx b/docs/pages/connect-your-client/model-context-protocol/database-access.mdx
new file mode 100644
index 0000000000000..89ac3802c71f0
--- /dev/null
+++ b/docs/pages/connect-your-client/model-context-protocol/database-access.mdx
@@ -0,0 +1,207 @@
+---
+title: Access Teleport Databases over MCP
+sidebar_label: Databases
+description: How to configure MCP clients to use Teleport databases as MCP servers.
+tags:
+ - mcp
+ - infrastructure-identity
+ - zero-trust
+ - how-to
+---
+
+This guide explains how to connect to your **PostgreSQL** Teleport databases with MCP clients.
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx clients="\`tsh\` client"!)
+
+- Teleport Database Service with a PostgreSQL database enrolled. See our [guides](../../enroll-resources/database-access/database-access.mdx)
+  for options on how to enroll PostgreSQL databases with Teleport, such as
+  the [AWS RDS PostgreSQL](../../enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx)
+  and [self-hosted PostgreSQL](../../enroll-resources/database-access/enrollment/self-hosted/postgres-self-hosted.mdx) guides.
+
+<Admonition type="warning" title="Security considerations">
+Since language models can execute any query on your database, we advise creating
+a database user with only the permissions you want the models to have. Setting
+up a user with read-only permissions will help prevent accidental changes to
+your database.
+
+Here's an example of how to create a PostgreSQL user with read-only access to
+the database:
+
+```sql
+CREATE ROLE mcp_read_only WITH LOGIN;
+GRANT CONNECT ON DATABASE my_database TO mcp_read_only;
+GRANT USAGE ON SCHEMA public TO mcp_read_only;
+GRANT SELECT ON my_table TO mcp_read_only;                     -- To grant read access to a single table.
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_read_only; -- To grant read access to all tables in the "public" schema.
+
+GRANT rds_iam TO mcp_read_only; -- If connecting to a PostgreSQL RDS database.
+```
+
+Remember that you will also need sufficient permissions on your Teleport user to
+access the database using this user.
+
+You can also set up fine-grained permissions for use with MCP using [Auto-user
+provisioning](../../enroll-resources/database-access/auto-user-provisioning/postgres.mdx)
+or [Database Access Controls](../../enroll-resources/database-access/rbac.mdx).
+</Admonition>
+
+## Step 1/2. Configure MCP clients
+
+First, sign in into your Teleport cluster using `tsh login`:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=myuser@example.com
+```
+
+Only databases that you have access to can be exposed as MCP servers. You can
+retrieve the list of databases and their connection options using `tsh db ls`:
+  
+```code
+$ tsh db ls
+# Name            Description          Allowed Users      Labels 
+# --------------- -------------------- ------------------ -------
+# postgres-dev    Development database [* postgres]       env=dev
+# postgres-prod   Production database  [mcp_read_only]    env=prod
+```
+
+Each database you want accessible through MCP must be configured with your MCP
+client individually. This is done using the `tsh mcp db config` command. Like
+`tsh db connect`, this command requires you to select the database user and
+database name that the MCP connections will use.
+
+This command can either generate a configuration file (using the `mcpServers`
+format) for manual MCP client updates or automatically update the MCP client
+configuration.
+
+<Tabs>
+<TabItem label="Claude Desktop">
+`tsh` can automatically update the Claude Desktop MCP configuration file to
+include Teleport's configuration:
+
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees --client-config=claude postgres-dev
+Added database "postgres-dev" on the client configuration at:
+~/Library/Application Support/Claude/claude_desktop_config.json
+
+Teleport database access MCP server is named "teleport-databases" in this configuration.
+
+You may need to restart your client to reload these new configurations.
+```
+
+You can also provide a custom path for your Claude Desktop MCPs configuration:
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees --client-config=/path/to/config.json postgres-dev
+```
+
+After updating the configuration, you need to restart the Claude Desktop app
+before using the newly added MCPs.
+</TabItem>
+
+<TabItem label="Cursor">
+`tsh` can automatically update the Global Cursor MCP servers to include
+Teleport's configuration:
+
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees --client-config=cursor postgres-dev
+Added database "postgres-dev" on the client configuration at:
+/your/home/path/.cursor/mcp.json
+
+Teleport database access MCP server is named "teleport-databases" in this configuration.
+
+You may need to restart your client to reload these new configurations.
+```
+
+You can also update a Cursor project MCP servers by providing the path to the
+file:
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees --config-client=/path/to/project/.cursor/mcp.json postgres-dev
+```
+</TabItem>
+
+<TabItem label="Others">
+Currently, `tsh` only supports generating the `mcpServers` format and some
+client-specific formats. Running the config command without any specific options
+will output the configuration used to start Teleport's STDIO MCP server. You can
+use this as a base and modify it to suit your MCP client needs.
+
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees postgres-dev
+Here is a sample JSON configuration for launching Teleport MCP servers:
+{
+  "mcpServers": {
+    "teleport-databases": {
+      "command": "tsh",
+      "args": [
+        "mcp",
+        "db",
+        "start",
+        "teleport://clusters/<Var name="teleport.example.com:443" />/databases/postgres-dev?dbName=employees&dbUser=postgres"
+      ]
+    }
+  }
+}
+
+If you already have an entry for "teleport-databases" server, add the following database resource URI to the command arguments list:
+teleport://clusters/<Var name="teleport.example.com:443" />/databases/postgres-dev?dbName=employees&dbUser=postgres
+```
+</TabItem>
+</Tabs>
+
+## Step 2/2. Access Teleport-protected resources over MCP
+
+After configuring your MCP client, the following tools will be available:
+
+- `teleport_list_databases`: Lists database resources accessible with Teleport tools.
+- `teleport_postgres_query` (PostgreSQL databases only): Executes SQL queries on a specified database through Teleport.
+
+Additionally, the served databases are available as MCP resources. You can
+attach them to the conversation to provide extra context. Behavior may vary
+among MCP clients.
+
+You can now use these tools to execute queries on your databases. Here is an
+example of testing the connection and retrieving the database version using
+Claude Desktop:
+
+![Database access usage example](../../../img/connect-your-client/model-context-protocol/usage-example-database-access.png)
+
+## Troubleshooting
+
+### Empty list of databases or missing `teleport_postgres_query` tool
+
+This occurs if the MCP server command (`tsh mcp db start`) has an invalid list
+of databases or options. Make sure the database URI list is correct. You can
+generate it using the `tsh mcp db config` command.
+
+In this case, you'll still be able to see and call `teleport_list_databases`,
+which will provide instructions on how to proceed.
+
+### Expired `tsh` session
+
+There must be a valid `tsh` session during the MCP server startup, or it won't
+start.
+
+If your session expires while the MCP server is running, the next tool calls
+will fail. You need to run `tsh login` again and retry the failed requests. In
+such cases, you don't have to restart the MCP client or the MCP server.
+
+### Access denied errors
+
+If, while executing queries, you receive access denied responses, verify that
+your user has permission to access the configured database. You can confirm by
+running `tsh db connect` before starting your MCP server.
+
+For example, if you configured your database with:
+
+```code
+$ tsh mcp db config --db-user=postgres --db-name=employees postgres-dev
+```
+
+You must be able to test your access by running:
+
+```code
+$ tsh db connect --db-user=postgres --db-name=employees postgres-dev
+```
diff --git a/docs/pages/connect-your-client/model-context-protocol/kube-access.mdx b/docs/pages/connect-your-client/model-context-protocol/kube-access.mdx
new file mode 100644
index 0000000000000..aef2bea72a35e
--- /dev/null
+++ b/docs/pages/connect-your-client/model-context-protocol/kube-access.mdx
@@ -0,0 +1,135 @@
+---
+title: Access Teleport Kubernetes clusters over MCP
+sidebar_label: Kubernetes Clusters
+description: How to configure MCP clients to use Teleport Kubernetes clusters as MCP servers.
+tags:
+ - mcp
+ - infrastructure-identity
+ - zero-trust
+ - how-to
+---
+
+This guide explains how to connect to Teleport Kubernetes Clusters with MCP clients.
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx clients="\`tsh\` client"!)
+- Kubernetes Clusters enrolled with Teleport. See our [guides](../../enroll-resources/kubernetes-access/getting-started.mdx).
+
+## Step 1/2. Configure MCP clients
+
+First, sign in into your Teleport cluster using `tsh login`:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=myuser@example.com
+```
+
+To list Kubernetes clusters available for you to access:
+```code
+$ tsh kube ls
+Kube Cluster Name Labels  Selected
+----------------- ------- --------
+minikube          env=dev *
+```
+
+Now log in to your Kubernetes cluster, replacing <Var name="minikube" /> with your our Kubernetes cluster name:
+```code
+$ tsh kube login <Var name="minikube" />
+Logged into Kubernetes cluster "minikube". Try 'kubectl version' to test the connection.
+```
+This command also updates your default Kubernetes config.
+
+Next, configure your MCP clients to use the
+[`kubernetes-mcp-server`](https://github.com/containers/kubernetes-mcp-server)
+MCP server.
+
+<Tabs>
+<TabItem label="Claude Desktop">
+
+Open your `claude_desktop_config.json` and add the MCP server to the list of
+mcpServers:
+
+```json
+{
+  "mcpServers": {
+    "kubernetes": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "kubernetes-mcp-server@latest"
+      ]
+    }
+  }
+}
+```
+</TabItem>
+
+<TabItem label="Cursor">
+
+You can install the extension by editing the `mcp.json` file:
+```json
+{
+  "mcpServers": {
+    "kubernetes-mcp-server": {
+      "command": "npx",
+      "args": ["-y", "kubernetes-mcp-server@latest"]
+    }
+  }
+}
+```
+
+</TabItem>
+
+<TabItem label="VS Code / VS Code Insiders">
+
+You can install the extension by running the following command:
+```code
+# For VS Code
+code --add-mcp '{"name":"kubernetes","command":"npx","args":["kubernetes-mcp-server@latest"]}'
+# For VS Code Insiders
+code-insiders --add-mcp '{"name":"kubernetes","command":"npx","args":["kubernetes-mcp-server@latest"]}'
+```
+</TabItem>
+</Tabs>
+
+## Step 2/2. Access Teleport-protected resources over MCP
+
+After configuring your MCP client, you will find Kubernetes and Helms tools from
+`kubernetes-mcp-server`.
+
+You can now use these tools to interact with your Kubernetes clusters via
+Teleport in your MCP clients:
+
+![Kube usage context](../../../img/connect-your-client/model-context-protocol/usage-kube-context.png)
+![Kube usage pod](../../../img/connect-your-client/model-context-protocol/usage-kube-pod.png)
+
+## Teleport behind TLS-terminating load balancers
+
+If your Teleport cluster is behind a TLS-terminating load balancer or reverse
+proxy, you can start a local proxy with `tsh`:
+```code
+$ tsh proxy kube -p 8888
+```
+
+Copy the `KUBECONFIG` path from the output of the command, and add it with the
+`--kubeconfig` flag in your MCP client configuration. For example:
+```json
+{
+  "mcpServers": {
+    "kubernetes-mcp-server": {
+      "command": "npx",
+      "args": ["-y", "kubernetes-mcp-server@latest", "--kubeconfig", "/path/to/your/tsh/localproxy-8888-kubeconfig"]
+    }
+  }
+}
+```
+
+Alternatively, you can use [Teleport Connect](../teleport-clients/teleport-connect.mdx) to run
+the local proxy to your Kubernetes cluster. You can find the `KUBECONFIG` path
+from the terminal in Teleport Connect:
+```code
+$ echo $KUBECONFIG
+/path/to/your/minikube-kubeconfig
+```
diff --git a/docs/pages/connect-your-client/model-context-protocol/mcp-access.mdx b/docs/pages/connect-your-client/model-context-protocol/mcp-access.mdx
new file mode 100644
index 0000000000000..3f46427a4e886
--- /dev/null
+++ b/docs/pages/connect-your-client/model-context-protocol/mcp-access.mdx
@@ -0,0 +1,199 @@
+---
+title: Access MCP Servers with Teleport
+sidebar_label: MCP Servers
+sidebar_position: 1
+description: How to configure MCP clients to use MCP servers served by Teleport.
+tags:
+ - mcp
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide explains how to configure MCP clients to access MCP servers served by
+Teleport.
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.1.0 or higher)" clients="\`tsh\` client"!)
+
+- Teleport MCP Access configured.
+
+  <details open>
+  <summary>Configure MCP Access</summary>
+
+  - [Quick-start with demo MCP server](../../enroll-resources/mcp-access/getting-started.mdx).
+  - [MCP Access with Stdio MCP Server](../../enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx)
+  </details>
+  
+## Step 1/2. Configure MCP clients
+
+First, sign in into your Teleport cluster using `tsh login`, assigning 
+<Var name="teleport.example.com" /> to the web address of the Teleport Proxy
+Service in your cluster:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" /> --user=myuser@example.com
+```
+
+You can now list the available MCP servers that you can use:
+
+```code
+$ tsh mcp ls
+Name           Description                                Type  Labels
+-------------- ------------------------------------------ ----- --------------------
+fs             Filesystem MCP Server                      stdio env=prod
+mcp-everything This MCP server attempts to exercise al... stdio env=dev,sandbox=true
+```
+
+The MCP client configuration can be created using the `tsh mcp config` command.
+You can choose which servers to configure by using the `--labels` flag to filter
+by labels or by specifying `--all`, which will configure all MCP servers you have
+access to.
+
+This command can either generate a configuration file (using the `mcpServers`
+format) for manual MCP client updates or automatically update the MCP client
+configuration.
+
+<Tabs>
+<TabItem label="Claude Desktop">
+`tsh` can automatically update the Claude Desktop MCP configuration file to
+include Teleport's configuration:
+
+```code
+$ tsh mcp config --all --client-config=claude
+Found MCP servers:
+fs
+mcp-everything
+
+Updated client configuration at:
+~/Library/Application Support/Claude/claude_desktop_config.json
+
+Teleport MCP servers will be prefixed with "teleport-mcp-" in this
+configuration.
+
+You may need to restart your client to reload these new configurations. If you
+encounter a "disconnected" error when tsh session expires, you may also need to
+restart your client after logging in a new tsh session.
+```
+
+You can also provide a custom path for your Claude Desktop MCPs configuration:
+```code
+$ tsh mcp config --all --config-client=/path/to/config.json
+```
+
+After updating the configuration, you need to restart the Claude Desktop app
+before using the newly added MCPs.
+</TabItem>
+
+<TabItem label="Cursor">
+`tsh` can automatically update the Global Cursor MCP servers to include
+Teleport's configuration:
+
+```code
+$ tsh mcp config --all --config-client=cursor
+Found MCP servers:
+fs
+mcp-everything
+
+Updated client configuration at:
+/your/home/path/.cursor/mcp.json
+
+Teleport MCP servers will be prefixed with "teleport-mcp-" in this
+configuration.
+
+You may need to restart your client to reload these new configurations. If you
+encounter a "disconnected" error when tsh session expires, you may also need to
+restart your client after logging in a new tsh session.
+```
+
+You can also update a Cursor project MCP servers by providing the path to the
+file:
+```code
+$ tsh mcp config --all --config-client=/path/to/project/.cursor/mcp.json
+```
+</TabItem>
+
+<TabItem label="Others">
+Currently, `tsh` only supports generating the `mcpServers` format and some
+client-specific formats. Running the config command without any specific options
+will output configuration used to start Teleport's STDIO MCP server. You can use
+this as a base and modify it to suit your MCP client needs.
+
+```code
+$ tsh mcp config --all
+Found MCP servers:
+fs
+mcp-everything
+
+Here is a sample JSON configuration for launching Teleport MCP servers:
+{
+  "mcpServers": {
+    "teleport-mcp-fs": {
+      "command": "tsh",
+      "args": ["mcp", "connect", "fs"]
+    },
+    "teleport-mcp-mcp-everything": {
+      "command": "tsh",
+      "args": ["mcp", "connect", "mcp-everything"]
+    }
+  }
+}
+```
+</TabItem>
+</Tabs>
+
+## Step 2/2. Use Teleport-protected MCP servers
+
+After configuring your MCP client, the MCP tools and resources should be
+available.
+
+You can now use the MCP servers as usual. Here is an example of using the
+`mcp-everything` server through Teleport with Claude Desktop:
+
+![MCP everything usage example](../../../img/connect-your-client/model-context-protocol/usage-example-everything.png)
+
+## Troubleshooting
+
+### Server is running but it has an empty list of tools
+
+Besides accessing the MCP servers, you also need permissions for the MCP tools
+they provide. You can see which tools are available for you by running
+`tsh mcp ls -v`.
+
+If you're missing tool permissions, reach out to your Teleport administrator to
+have them properly configured.
+
+### Expired `tsh` session
+
+There must be a valid `tsh` session during the MCP server startup, or it won't
+start.
+
+If your session expires while the MCP server is running, the next tool calls
+will fail. You need to run `tsh login` again and retry the failed requests. In
+such cases, you don't have to restart the MCP client or the MCP server.
+
+### `tsh mcp` commands not found
+
+If you're encountering an error like this when running the `tsh mcp` commands
+family:
+
+```
+ERROR: expected command but got "mcp"
+```
+
+This is caused by using an outdated version of `tsh`. The earliest version that
+includes the MCP commands is `18.1.0`, so you need to make sure you’re running
+at least this version. You can check your `tsh` version by running
+`tsh version`.
+
+### `tsh mcp ls` returns an empty list of servers
+
+Make sure your Teleport cluster has MCP access resources available and the
+correct permissions to reach them. [See our guides for enrollment instructions.](../../enroll-resources/mcp-access/mcp-access.mdx)
+
+### `tsh` path errors in your MCP clients
+
+(!docs/pages/includes/mcp-access/troubleshoot-tsh-binary-enoent.mdx!)
diff --git a/docs/pages/connect-your-client/model-context-protocol/model-context-protocol.mdx b/docs/pages/connect-your-client/model-context-protocol/model-context-protocol.mdx
new file mode 100644
index 0000000000000..02e4799204d24
--- /dev/null
+++ b/docs/pages/connect-your-client/model-context-protocol/model-context-protocol.mdx
@@ -0,0 +1,15 @@
+---
+title: "Securing Agentic AI with Teleport Zero Trust Access"
+sidebar_label: MCP
+description: "Access control and audit between LLMs and data sources or MCP servers."
+tags:
+ - conceptual
+ - zero-trust
+ - ai
+---
+
+Secure Large Language Model (LLM) interactions with infrastructure using Teleport's secure 
+[Model Context Protocol](https://goteleport.com/use-cases/secure-model-context-protocol/) (MCP), 
+delivering fine-grained access control and audit between LLMs and data sources or MCP servers.
+
+<DocCardList />
diff --git a/docs/pages/connect-your-client/notifications.mdx b/docs/pages/connect-your-client/teleport-clients/notifications.mdx
similarity index 92%
rename from docs/pages/connect-your-client/notifications.mdx
rename to docs/pages/connect-your-client/teleport-clients/notifications.mdx
index 7889638309534..a3a353c362ab2 100644
--- a/docs/pages/connect-your-client/notifications.mdx
+++ b/docs/pages/connect-your-client/teleport-clients/notifications.mdx
@@ -1,6 +1,10 @@
 ---
 title: Notifications
 description: Provides a detailed breakdown of Teleport's notification system.
+tags:
+ - conceptual
+ - platform-wide
+ - resiliency
 ---
 
 Teleport's notification system allows users to be notified of various events, updates, and warnings in real time.
@@ -16,7 +20,7 @@ You can mark the notification as read to acknowledge it, or hide it to have it n
 
 Some notifications may include quick action buttons which allow you perform actions directly from the notification, such as assuming granted roles from an approved Access Request notification.
 
-![Notification in the WebUI](../../img/notification.png)
+![Notification in the WebUI](../../../img/notification.png)
 
 ## Creating and managing notifications
 
@@ -47,4 +51,4 @@ ID                                   Created             Expires             Tit
 $ tctl notifications rm 3b8eb3d6-da9a-5353-aece-cbc885ecbf73
 ```
 
-For more detailed information on this family of commands, please refer to the [CLI Reference](../reference/cli/tctl.mdx#tctl-notifications-create).
+For more detailed information on this family of commands, please refer to the [CLI Reference](../../reference/cli/tctl.mdx#tctl-notifications-create).
diff --git a/docs/pages/connect-your-client/teleport-clients/request-access.mdx b/docs/pages/connect-your-client/teleport-clients/request-access.mdx
new file mode 100644
index 0000000000000..d9e9092274475
--- /dev/null
+++ b/docs/pages/connect-your-client/teleport-clients/request-access.mdx
@@ -0,0 +1,291 @@
+---
+title: Requesting Access to Roles and Resources
+description: Explains how to request access to resources that your Teleport user does not have permissions to access.
+sidebar_label: Access Requests
+tags:
+ - access-requests
+ - identity-governance
+ - privileged-access
+ - conceptual
+---
+
+If you cannot access a Teleport role or resource with your current Teleport
+permissions, you can create an Access Request to obtain elevated permissions for
+a limited time.
+
+This guide explains you how to use `tsh` to create Teleport Access Requests. 
+
+<Admonition type="tip">
+
+In Teleport Enterprise accounts with Identity Governance enabled, it is possible
+to create Access Requests in the Teleport Web UI and Teleport Connect.
+
+Access Requests can also be created in the Teleport Web UI and Teleport Connect.
+In the Teleport Web UI, navigate from the left sidebar to **Identity Governance > 
+Access Requests > New Request**. In Teleport Connect, either open a new tab
+with cluster resources by clicking on the new tab button or click the **Access
+Requests** button in the top right.
+
+</Admonition>
+
+## Requesting access to roles
+
+You can request access to one or more Teleport roles using the `tsh request
+create` command and the `--roles` flag, e.g.:
+
+```code
+$ tsh request create --roles "dev,analyst"
+```
+
+The command above creates an Access Request for the `dev` and `analyst` roles.
+
+## Requesting access to Teleport cluster resources
+
+In addition to Teleport roles, you can request access to individual Teleport
+resources, including resources within a Teleport-protected Kubernetes cluster. 
+
+To request access to a Teleport-protected infrastructure resource, you can
+search for possible resources, retrieve the ID of a resource to request access
+to, then create an Access Request for that resource ID.
+
+<Admonition type="tip">
+
+In the Teleport Web UI, you can view the resources you can request access to by
+navigating to **Resources** in the sidebar. 
+
+</Admonition>
+
+1. Search for a resource to request access to:
+
+   ```code
+   $ tsh request search --kind=<KIND>
+   ```
+
+   Substitute `--kind` with the kind of Teleport resource you would like to
+   request access to. This can be one of the following:
+
+   - `node`
+   - `kube_cluster`
+   - `kube_resource`
+   - `db`
+   - `app`
+   - `windows_desktop`
+
+1. Determine the ID of the resource to request access to. Resource IDs have the
+   following format:
+
+   ```
+   /CLUSTER_ADDRESS/TYPE/RESOURCE_NAME
+   ```
+
+   For example, assume that you have found the following Teleport-protected
+   server to request access to:
+
+   ```code
+   $ tsh request search --kind=node
+   Name                                 Hostname Labels Resource ID
+   ------------------------------------ -------- ------ ----------------------------------------------
+   00000000-0000-0000-0000-000000000000 myhost          /teleport.example.com/node/00000000-0000-00...
+   ```
+
+   While the resource ID on the right is clipped, you can use the format above
+   to infer that it is the following:
+
+   ```
+   /teleport.example.com/node/00000000-0000-0000-0000-000000000000
+   ```
+
+1. Request access to the resource by running the following command, inputting
+   the resource ID you found in the previous step:
+
+   ```code
+   $ tsh request create --resource RESOURCE_ID
+   ```
+
+## Requesting access to Kubernetes resources
+
+As with Teleport cluster resources, users can request access to a Kubernetes
+resources by running the following command, where <Var name="resource-id" /> is
+the ID of the resource:
+
+```code
+$ tsh request create <Var name="resource-id" />
+```
+
+### Namespace-scoped resources
+
+For Kubernetes namespaced resources, the `resource-id` is in the following format:
+
+```
+/TELEPORT_CLUSTER/kube:ns:NAMESPACED_PLURAL_KIND[.API_GROUP]/KUBE_CLUSTER/NAMESPACE/RESOURCE_NAME
+```
+
+The `API_GROUP` part is only required for resources that are part of the core
+Kubernetes group.
+
+<Admonition type="tip">
+You can run this command to list the namespaced Kubernetes resources,
+including their API groups:
+
+```code
+$ kubectl api-resources --namespaced=true -o name --sort-by=name
+```
+</Admonition>
+
+For example, to request access to a pod called `nginx-1` in the `dev`
+namespace, run the following command:
+
+```code
+$ tsh request create --resource /teleport.example.com/kube:ns:pods/mycluster/dev/nginx-1
+```
+
+And to request access to a deployment called `website` in the `prod`
+namespace, run the following command:
+
+```code
+$ tsh request create --resource /teleport.example.com/kube:ns:deployments.apps/mycluster/prod/website
+```
+
+For the `NAMESPACED_PLURAL_KIND` value you can use `*` to match all.
+For the `API_GROUP`, `NAMESPACE` and `RESOURCE_NAME`
+values, you can match ranges of characters by supplying a wildcard (`*`) or
+regular expression. Regular expressions must begin with `^` and end with `$`.
+
+For example, to create a request to access all pods in all namespaces that
+match the regular expression `/^nginx-[a-z0-9-]+$/`, run the following command:
+
+```code
+$ tsh request create --resource '/teleport.example.com/kube:ns:pods/mycluster/*/^nginx-[a-z0-9-]+$'
+```
+
+### Cluster-scoped resources
+
+For Kubernetes cluster-scoped resources, the `resource-id` is in the following
+format:
+
+```
+/TELEPORT_CLUSTER/kube:cw:CLUSTER_WIDE_PLURAL_KIND[.API_GROUP]/KUBE_CLUSTER/RESOURCE_NAME
+```
+
+The `API_GROUP` part is only required for resources that are part of the core
+kubernetes group.
+
+<Admonition type="tip">
+You can run this command to list the cluster-wide Kubernetes resources,
+including their API groups:
+
+```code
+$ kubectl api-resources --namespaced=false -o name --sort-by=name
+```
+</Admonition>
+
+For example, to request access to a namespace called `prod`, run the
+following command:
+
+```code
+$ tsh request create --resource /teleport.example.com/kube:cw:namespaces/mycluster/prod
+```
+
+Note that this will only grant access to the namespace resource itself, not to
+any namespaced resources within it.
+
+For the `CLUSTER_WIDE_PLURAL_KIND` value you can use `*` to match all.
+For the `API_GROUP` and `RESOURCE_NAME` value, you
+can match ranges of characters by supplying a wildcard (`*`) or regular
+expression. Regular expressions must begin with `^` and end with `$`.
+
+For example, to create a request to access all namespaces prefixed with `dev` match
+the regular expression `/^dev-[a-z0-9-]+$/`, run the following command:
+
+```code
+$ tsh request create --resource '/teleport.example.com/kube:cw:namespaces/mycluster/^dev-[a-z0-9-]+$'
+```
+
+### Wildcard requests
+
+You can request access to a namespace and all resources within it, as well as to all cluster-wide resources. To do so, you can use wildcards in the resource ID.
+
+For cluster-wide resources, the `kind` format as described above is
+`kube:cw:CLUSTER_WIDE_PLURAL_KIND[.API_GROUP]`.
+To request access to all cluster-wide resources you can request access to
+`kube:cw:*.*`. Where the first `*` represents the kind, and the second `*`
+represents the `api group`.
+
+For namespaced resources, the `kind` format is
+`kube:ns:NAMESPACED_PLURAL_KIND[.API_GROUP]`.
+To request access to all namespaced resources within a specific namespace, you
+can request access to `kube:ns:*.*`, where the first `*` represents the kind,
+and the second `*` represents the `api group`.
+
+For example, to request access to the `prod` namespace (cluster-wide) all
+resources within it (i.e., namespaced), you can run the following command:
+
+```code
+$ tsh request create \
+  --resource /teleport.example.com/kube:cw:namespaces/mycluster/prod \
+  --resource '/teleport.example.com/kube:ns:*.*/mycluster/prod/*'
+```
+
+Similarly, to request access to everything within a cluster, you can use the
+following command:
+
+```code
+$ tsh request create \
+  --resource '/teleport.example.com/kube:cw:*.*/mycluster/*' \
+  --resource '/teleport.example.com/kube:ns:*.*/mycluster/*/*'
+```
+
+which is equivalent to:
+
+```code
+$ tsh request create \
+  --resource /teleport.example.com/kube_cluster/mycluster
+```
+
+### Search for Kubernetes resources
+
+If a user has no access to a Kubernetes cluster, they can search the list of
+resources in the cluster by running the following command, replacing
+<Var name="kube-cluster" /> with the name of the Kubernetes cluster and
+<Var name="namespace" /> with the name of a Kubernetes namespace:
+
+```code
+$ tsh request search \
+    --kind=kube_resource --kube-kind=pods --kube-api-group='' \
+    --kube-cluster=<Var name="kube-cluster" /> \
+    [--kube-namespace=<Var name="namespace" />|--all-kube-namespaces]
+Name               Namespace Labels    Resource ID
+-----------------  --------- --------- ----------------------------------------------------------
+nginx-deployment-0 default   app=nginx /teleport.example.com/kube:ns:pods/local/default/nginx-deployment-0
+nginx-deployment-1 default   app=nginx /teleport.example.com/kube:ns:pods/local/default/nginx-deployment-1
+
+To request access to these resources, run
+> tsh request create \
+    --resource /teleport.example.com/kube:ns:pods/local/default/nginx-deployment-0 \
+    --resource /teleport.example.com/kube:ns:pods/local/default/nginx-deployment-1 \
+    --reason <request reason>
+```
+
+The list returned includes the name of the resource, the namespace it is in if
+applicable, its labels, and the resource ID.
+Resources included in the list are those that match the `kubernetes_resources`
+field in the user's `search_as_roles`. The user can then:
+
+- Request access to the resources by running the command provided by the `tsh request
+search` command.
+- Edit the command to request access to a subset of the resources.
+- Use a custom request with wildcards or regular expressions.
+
+`tsh request search --kind=kube_resource --kube-kind=<kind>
+--kube-api-group=<api_group>` works even if the user has no permissions to
+interact with the desired Kubernetes cluster, but the user's `search_as_roles`
+values must allow access to the cluster. If the user is unsure of the name of
+the cluster, they can run the following command to search it:
+
+```code
+$ tsh request search --kind=kube_cluster
+Name  Hostname Labels Resource ID
+----- -------- ------ ----------------------------------------
+local                 /teleport.example.com/kube_cluster/local
+
+```
diff --git a/docs/pages/connect-your-client/teleport-clients/teleport-clients.mdx b/docs/pages/connect-your-client/teleport-clients/teleport-clients.mdx
new file mode 100644
index 0000000000000..311cb090b1f4c
--- /dev/null
+++ b/docs/pages/connect-your-client/teleport-clients/teleport-clients.mdx
@@ -0,0 +1,359 @@
+---
+title: Introduction to Teleport Clients
+sidebar_label: Teleport Clients
+description: The basics of connecting to resources with Teleport
+tags:
+ - conceptual
+ - platform-wide
+---
+
+This guide covers the basics of authenticating to Teleport and
+accessing resources. It's written for end-users of resources protected by
+Teleport, and includes links to more detailed documentation at the end.
+
+## Client tools
+
+### tsh
+
+`tsh` lets you authenticate to Teleport and list and connect to resources. After
+[downloading](https://goteleport.com/download/) and installing `tsh`, sign in to
+your Teleport cluster:
+
+<Tabs>
+<TabItem label="Local user">
+
+Authenticate to Teleport as a local user with `tsh login` by assigning <Var
+name="user"/> to your Teleport username and <Var name="teleport.example.com" />
+to the domain name of your Teleport cluster:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" description="Your Teleport Proxy Service or Teleport Cloud tenant address"/> --user=<Var name="user" description="Your Teleport username"/>
+Enter password for Teleport user alice:
+Tap any security key
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       alice
+  Cluster:            example.com
+  Roles:              access, requester
+  Logins:             ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+```
+
+</TabItem>
+<TabItem label="Single sign-on user">
+
+Authenticate to Teleport as a single sign-on (SSO) user by running `tsh login`
+and assigning <Var name="your-idp-connector" /> to the name of your
+authentication connector, if implemented by your administrators:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com"/> --auth=<Var name="your-idp-connector" description="Your Identity Provider connection name, if implemented by your administrators"/>
+If browser window does not open automatically, open it by clicking on the link:
+ http://127.0.0.1:49927/1d80e257-ec61-4ed2-9403-784f8d35b2fe
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       user@example.com
+  Cluster:            example.com
+  Roles:              access, requester
+  Logins:             ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+```
+
+Depending on how Teleport was configured for your network, you may not need
+the additional flags `--auth`. Your administrator should provide the details
+required for your particular use case.
+
+</TabItem>
+</Tabs>
+
+### Teleport Connect
+
+The Teleport Connect app provides all the same access to resources as `tsh` in
+a friendly graphic user interface. After [downloading](https://goteleport.com/download/)
+and installing Teleport Connect, you can log in and initiate sessions for
+server and database access within a single window.
+
+1. Click **CONNECT** to connect to the Teleport cluster:
+
+   ![A new instance of Teleport Connect](../../../img/teleport-connect-init.png)
+
+1. Provide the address of your Teleport Cluster (e.g.
+   `https://example.teleport.sh`) and click **NEXT**.
+
+1. Teleport Connect will ask you for your username, password, and MFA.
+
+   If Teleport is integrated with an external Identity Provider (**IdP**), you might be
+   prompted to authenticate with that service in a browser window.
+
+1. Browse and connect to all the resources your user is permitted to access:
+
+   ![An example of Teleport Connect, populated with instances](../../../img/use-teleport/connect-ui-overview@2x.png)
+
+### Web UI
+
+Teleport provides a web interface for users to interact with Teleport, e.g., by
+accessing resources or creating Access Requests. This is usually found at the
+same URL used to connect to Teleport with (e.g.  `https://example.teleport.sh`),
+but you should confirm the Web UI URL with the team that manages your Teleport
+deployment.
+
+The Web UI provides similar access to resources as Teleport Connect, and
+additional access to to Request and Activity logs for users with the right
+permissions.
+
+## Connecting to resources
+
+This section provides an overview of some ways you can use Teleport client tools to connect to resources in your infrastructure.
+
+### Server access (`ssh`)
+
+<Tabs>
+<TabItem label="tsh">
+
+`tsh ls` lists the servers you have access to through Teleport:
+
+```code
+$ tsh ls
+Node Name           Address         Labels
+------------------- --------------- ----------------------------
+server1.example.com 192.0.2.24:3022 access=servers,hostname=server1
+server2.example.com 192.0.2.32:3022 access=servers,hostname=server2
+```
+
+To connect to a server:
+
+```code
+$ tsh ssh ubuntu@server1.example.com
+ubuntu@server1:~$
+```
+
+</TabItem>
+<TabItem label="Teleport Connect">
+
+Under the **Servers** tab, click **CONNECT** next to the server you want to
+access. Select or type in a username available to your Teleport user.
+
+In a new tab, Teleport Connect will initiate the connection and provide a
+terminal environment.
+
+</TabItem>
+<TabItem label="Web UI">
+
+From the **Servers** menu, the Teleport Web UI will list all servers your user
+has permission to access. The **CONNECT** button will open a new tab with a
+terminal emulator to provide access to that server.
+
+</TabItem>
+</Tabs>
+
+### Kubernetes access (`kubectl`)
+
+<Tabs>
+<TabItem label="tsh">
+
+To see the Kubernetes clusters that you can access via Teleport, run the
+following command:
+
+```code
+$ tsh kube ls
+ Kube Cluster Name Labels                      Selected
+ ----------------- --------------------------- --------
+ mycluster         env=dev
+```
+
+To log in to the cluster, run the following command, changing `mycluster` to the
+name of a Kubernetes cluster as it was listed in `tsh kube ls`:
+
+```code
+$ tsh kube login mycluster
+Logged into kubernetes cluster "mycluster". Try 'kubectl version' to test the
+connection.
+```
+
+When you log in to your Teleport cluster via `tsh kube login`, `tsh` updates
+your kubeconfig to point to your chosen Kubernetes cluster. You can then run
+`kubectl` commands against your cluster.
+
+</TabItem>
+<TabItem label="Teleport Connect">
+
+After logging in to a cluster in Teleport Connect, click the **Kubes** tab to
+see a list of Kubernetes clusters you can access.
+
+![Clusters you can access](../../../img/use-teleport/connect-kube-list.png)
+
+Next to your chosen cluster, click **Connect**. Teleport Connect will
+open a terminal in a new tab and authenticate to the cluster. You can then run
+`kubectl` commands to interact with the cluster.
+
+![Connect to a cluster](../../../img/use-teleport/connect-kube-access.png)
+</TabItem>
+<TabItem label="Web UI">
+
+In the Teleport Web UI, click the **Kubernetes** tab. You will see a list of
+Kubernetes clusters your Teleport user is authorized to connect to.
+
+![Available Kubernetes clusters](../../../img/use-teleport/kubernetes-clusters.png)
+
+Find your chosen cluster and click **Connect**. You will see a modal window that
+lists the commands you can execute in your terminal to connect to the cluster
+via Teleport.
+
+![Connect to a Kubernetes
+cluster](../../../img/use-teleport/kubernetes-login.png)
+
+</TabItem>
+</Tabs>
+
+### Transferring files
+
+<Tabs>
+<TabItem label="tsh scp">
+
+`tsh scp` will let you transfer files to servers behind Teleport:
+
+```code
+$ tsh scp some-file.ext server.example.com:
+some-file.ext   7% |███████                | (25/342 MB, 2.9 MB/s) [9s:1m48s]
+```
+</TabItem>
+<TabItem label="Teleport Connect">
+
+Teleport Connect allows you to transfer files to a remote server and runs on macOS, Linux and Windows. You can use the arrows in the top-left corner of an active SSH session to upload and download files:
+
+![Download with connect](../../../img/download_files_connect.png)
+
+You can upload files from systems using drag and drop:
+
+![Drag and drop in Connect](../../../img/upload_files_connect_drag_drop.png)
+
+</TabItem>
+<TabItem label="Web UI">
+
+You can use the arrows in the top-left corner of the Web UI to download files:
+
+![Arrows in Web UI](../../../img/download_files_webui.png)
+
+Or you can upload using drag and drop:
+
+![Upload in Web UI](../../../img/upload_files_webui.png)
+
+</TabItem>
+</Tabs>
+
+### Database access
+
+<Tabs>
+<TabItem label="tsh">
+
+`tsh db ls` will list the databases available to your user:
+
+```code
+$ tsh db ls
+Name                                               Description Allowed Users   Labels  Connect
+-----------------------------------------------    ----------- --------------- ------- -------------------------
+myelastic                                                      [alice elastic] env=dev
+mysql-server1 (user: alice, db: teleport_example)              [alice elastic] env=dev tsh db connect mysql-server1
+```
+
+To connect to a database server through `tsh`, you'll need a local client for
+that database. For example, to connect to a MySQL or MariaDB database, you'll
+need the [MySQL CLI](https://dev.mysql.com/doc/refman/8.0/en/mysql.html) client:
+
+```code
+$ tsh db connect --db-user=alice --db-name=teleport_example mysql-server1
+```
+
+In this example, `teleport_example` is a pre-existing database on the MySQL server:
+
+```sql
+SHOW DATABASES;
++--------------------+
+| Database           |
++--------------------+
+| information_schema |
+| mysql              |
+| performance_schema |
+| teleport_example   |
++--------------------+
+4 rows in set (0.09 sec)
+```
+
+For other connection types, or to connect a graphic database client, you can
+create a local tunnel to point your software to:
+
+```code
+$ tsh proxy db myelastic --db-user=alice --tunnel
+Started authenticated tunnel for the Elasticsearch database "myelastic" in cluster "example.come" on 192.0.2.58:52669.
+
+Use one of the following commands to connect to the database:
+
+  * interactive SQL connection:
+
+  $ elasticsearch-sql-cli http://localhost:52669/
+
+  * run single request with curl:
+
+  $ curl http://localhost:52669/
+
+Database certificate renewed: valid until 2022-11-02T06:11:50Z [valid for 9h55m0s]
+```
+
+</TabItem>
+<TabItem label="Teleport Connect">
+
+In the **Databases** tab, select the database you want to access and click
+**CONNECT**. Select or type in a username available to your Teleport user.
+
+Teleport Connect will open a tunneled connection to the database. You can copy
+the port number and connect with a GUI app at `localhost`, or click **RUN** to
+initiate a CLI connection inside Teleport Connect:
+
+![Teleport Connect database connection](../../../img/teleport-connect-mysql.png)
+
+</TabItem>
+<TabItem label="Web UI">
+
+The Teleport Web UI will show all databases a user has access to and only offers
+browser-based sessions for a select number of databases. For databases
+that can't be accessed from the browser, the Web UI will show the `tsh` commands
+that are needed to connect from a developer workstation.
+
+For more details on accessing databases directly from the browser, refer to
+[Starting a database session](./web-ui.mdx#starting-a-database-session) in 
+the Teleport Web UI.
+
+</TabItem>
+</Tabs>
+
+### Desktop access
+
+Desktop access is available through the Teleport Web UI.
+
+1. In your browser, navigate to your Teleport cluster (for example,
+`https://example.teleport.sh`).
+1. From the menu on the right, select **Desktops**.
+1. Next to the desktop you want to access, click **CONNECT**. Select
+or type in a username available to your Teleport user.
+1. Teleport will open a new browser tab or window and begin the RDP session.
+Note that you may need to wait a moment for Teleport to log you in as the specified user.
+
+## Next steps
+
+This guide covers the basic installation and access of Teleport for end users,
+but the rest of the Connect your Client section provides more detailed information.
+
+- `tsh` is the CLI tool for accessing resources through Teleport. With it,
+you can authenticate to Teleport, list available services, and connect to them
+either directly or through proxy tunnels.
+
+  Learn more about it from [Using the tsh Command Line Tool](./tsh.mdx).
+
+- Teleport Connect is a graphic utility for connecting to resources through
+  Teleport. You use it to connect to servers, databases, and Kubernetes
+  clusters. See [Using Teleport Connect](./teleport-connect.mdx).
+
+- [Access Teleport-protected databases with GUI clients](../third-party/gui-clients.mdx):
+  Details how to connect many popular database GUI clients through Teleport.
diff --git a/docs/pages/connect-your-client/teleport-connect.mdx b/docs/pages/connect-your-client/teleport-clients/teleport-connect.mdx
similarity index 76%
rename from docs/pages/connect-your-client/teleport-connect.mdx
rename to docs/pages/connect-your-client/teleport-clients/teleport-connect.mdx
index 27c14263f8b36..cad0e6ad61c62 100644
--- a/docs/pages/connect-your-client/teleport-connect.mdx
+++ b/docs/pages/connect-your-client/teleport-clients/teleport-connect.mdx
@@ -1,12 +1,17 @@
 ---
 title: Using Teleport Connect
+sidebar_label: Teleport Connect
+sidebar_position: 3
 description: Using Teleport Connect
+tags:
+ - conceptual
+ - platform-wide
 ---
 
-Teleport Connect provides easy and secure access to SSH servers, databases, applications, Windows desktops, and
-Kubernetes clusters.
+Teleport Connect provides easy and secure access to SSH servers, databases,
+applications, MCP servers, Windows desktops, and Kubernetes clusters.
 
-![resources tab in Teleport Connect](../../img/use-teleport/connect-cluster@2x.png)
+![resources tab in Teleport Connect](../../../img/use-teleport/connect-cluster@2x.png)
 
 ## Installation & upgrade
 
@@ -17,7 +22,7 @@ version. Teleport Connect supports macOS, Linux, and Windows.
 <TabItem label="macOS">
 Double-click the downloaded `.dmg` file and drag the Teleport Connect icon to the Applications folder.
 
-To upgrade Teleport Connect to a newer version, drag the new version to the Applications folder.
+To manually upgrade Teleport Connect to a newer version, drag the new version to the Applications folder.
 </TabItem>
 <TabItem label="Linux">
 Download the DEB (Debian-based distros) or RPM (RHEL-based distros) package and install it using
@@ -56,9 +61,90 @@ automatically handle the migration to a per-machine installation.
 </TabItem>
 </Tabs>
 
+### Managed updates
+
+Teleport Connect supports [Teleport Client Tool Managed Updates](../../upgrading/client-tools-managed-updates.mdx).
+When enabled in your cluster, the app checks for available updates at login,
+downloads them automatically, and prompts you to restart. On Windows and Linux,
+you may be asked to provide administrator credentials to complete the installation.
+
+You can also check for updates manually via "Check for Updates…" in the
+additional actions menu.
+
+<Admonition
+  type="warning"
+  title="Note"
+>
+  To use managed updates on Linux, make sure the app was installed with a package
+  manager. The `.tar.gz` distribution is not compatible with managed updates.
+</Admonition>
+
+#### Multiple clusters
+
+If you are connected to multiple clusters, Teleport Connect selects the highest client
+version that is compatible across all clusters according to [Teleport component compatibility rules](../../upgrading/overview.mdx#component-compatibility).
+If clusters require incompatible versions, or if you want a different cluster
+to manage updates, you can manually choose the cluster in the
+"Check for Updates…" dialog, available in the additional actions menu.
+
+<Admonition
+  type="note"
+  title="Note"
+>
+  Multi-cluster support differs between Teleport Connect and the tsh/tctl CLI tools.
+  The CLI tools can switch versions on the fly to match the one required by each cluster.
+  Teleport Connect, as an installed desktop application, can only run a single version at a time.
+</Admonition>
+
+#### Managed updates configuration
+
+Like the CLI tools, Teleport Connect respects the `TELEPORT_CDN_BASE_URL` and
+`TELEPORT_TOOLS_VERSION` environment variables.
+
+`TELEPORT_CDN_BASE_URL` lets you use custom builds or mirror the CDN in a private
+network (for example `https://example.com`).
+
+`TELEPORT_TOOLS_VERSION` controls client tool updates:
+- Set to `off` to completely disable managed updates.
+- Set to a specific version (e.g. `18.0.1`) to override the cluster-provided version
+(for example, to work around a known issue).
+
+To use an environment variable with Teleport Connect, open your terminal and launch
+the app from there, providing the variable.
+It will apply only for that session, so you can test settings or override
+cluster-provided updates without affecting your system-wide configuration.
+For a permanent setup, follow the instructions below:
+
+<Tabs>
+  <TabItem label="macOS">
+    To set the variable for your current login session, open the Terminal and type:
+    ```code
+    $ launchctl set env TELEPORT_TOOLS_VERSION X.Y.Z
+    ```
+    Then run Teleport Connect as usual. This setting persists until you log out.
+  </TabItem>
+  <TabItem label="Windows">
+    To set the variable permanently for your user account, open the Command Prompt and type:
+    ```code
+    $ setx TELEPORT_TOOLS_VERSION X.Y.Z
+    ```
+    Then run Teleport Connect as usual. To clear it, use:
+    ```code
+    $ setx TELEPORT_TOOLS_VERSION ""
+    ```
+  </TabItem>
+  <TabItem label="Linux">
+    To set the variable permanently for the app, prepend the environment variable to
+    the `Exec=` line in  `usr/share/applications/teleport-connect.desktop` file:
+    ```text
+    Exec=env TELEPORT_TOOLS_VERSION=X.Y.Z "/opt/Teleport Connect/teleport-connect" %U
+    ```
+  </TabItem>
+</Tabs>
+
 ## User interface
 
-![user interface of Teleport Connect](../../img/use-teleport/connect-ui-overview@2x.png)
+![user interface of Teleport Connect](../../../img/use-teleport/connect-ui-overview@2x.png)
 
 The top bar of Teleport Connect consists of:
 
@@ -76,6 +162,15 @@ The top bar of Teleport Connect consists of:
 The **status bar** at the bottom displays **cluster breadcrumbs** in the bottom left, indicating
 which cluster the current tab is bound to, and the **Share Feedback** button in the bottom right.
 
+### Background mode
+Teleport Connect can run in the background (via the menu bar or system tray),
+so you can continue using VNet and connections to databases, Kubernetes clusters,
+and apps without keeping the main window open.
+
+The first time you close the window, the app will ask you whether to run in background mode
+or quit when closing the window.
+To change this behavior later, see [the `runInBackground` configuration option](#configuration).
+
 ## Connecting to an SSH server
 
 1. Open a tab with cluster resources by clicking on the plus symbol at the right end of the tab bar.
@@ -87,6 +182,9 @@ A new tab will open with a shell session on the chosen server.
 
 Alternatively, you can look for the server in the search bar and press `Enter` to connect to it.
 
+If you'd prefer to connect to SSH servers with a third-party SSH client or your
+editor's Remote Development feature, read the [VNet guide](./vnet.mdx) to learn how.
+
 ## Opening a local terminal
 
 To open a terminal with a local shell session, either select "Open new terminal" from the additional
@@ -97,7 +195,7 @@ this by setting the environment variables `TELEPORT_PROXY` and `TELEPORT_CLUSTER
 Additionally, Teleport Connect prepends the `PATH` environment variable in the session with the
 directory containing the tsh binary, even if [tsh is not globally available](#using-tsh-outside-of-teleport-connect).
 
-When using [trusted clusters](../admin-guides/management/admin/trustedclusters.mdx), the cluster selector allows
+When using [trusted clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx), the cluster selector allows
 you to determine which cluster the shell session will be bound to. The selected cluster will be
 reflected in both the tab title and the status bar.
 
@@ -108,7 +206,7 @@ To switch to a different shell, right-click on a terminal tab (either a local te
 From the menu, choose a predefined shell (on Windows) or provide the path to a custom shell.
 
 The selected shell will be used only for that tab unless you choose to set it as the default.
-![Changing the terminal shell in Teleport Connect on Windows](../../img/use-teleport/connect-shell-switcher@2x.png)
+![Changing the terminal shell in Teleport Connect on Windows](../../../img/use-teleport/connect-shell-switcher@2x.png)
 
 The configuration is stored under `terminal.shell` and `terminal.customShell` config properties.
 For more details, refer to the [Configuration](#configuration) section.
@@ -145,8 +243,11 @@ A new tab will open with a new connection established between your device and th
 
 Alternatively, you can look for the database in the search bar and press `Enter` to connect to it.
 
-This connection will remain active until you click the Close Connection button or close Teleport
-Connect. The port number will persist between app restarts—you can set up your favorite client
+The connection is active while Teleport Connect is running.
+If [the background mode](#background-mode) is on, it remains active even after you close the window.
+To end the connection, click Close Connection or quit the app.
+
+The port number will persist between app restarts—you can set up your client
 without worrying about the port suddenly changing.
 
 ### With a GUI client
@@ -178,7 +279,7 @@ During a remote session, you can share your clipboard and a local directory, if
 Teleport Connect supports launching applications in the browser, as well as creating
 authenticated tunnels for web and TCP applications.
 
-When it comes to [cloud APIs secured with Teleport](../enroll-resources/application-access/cloud-apis/cloud-apis.mdx),
+When it comes to [cloud APIs secured with Teleport](../../enroll-resources/application-access/cloud-apis/cloud-apis.mdx),
 Teleport Connect supports launching the AWS console in the browser, but other CLI applications can
 be used only through tsh in [a local terminal tab](#opening-a-local-terminal).
 
@@ -235,14 +336,38 @@ press `Enter` to set up a connection to it.
 
 A new tab will open with a new connection established between your device and the application.
 
-This connection will remain active until you click the Close Connection button or close Teleport
-Connect. The port number will persist between app restarts—you can set up your favorite client
+The connection is active while Teleport Connect is running.
+If [the background mode](#background-mode) is on, it remains active even after you close the window.
+To end the connection, click Close Connection or quit the app.
+
+The port number will persist between app restarts—you can set up your client
 without worrying about the port suddenly changing.
 
 The application connection tab shows an example command that can be used to query the application.
 Requests sent under the displayed address will be proxied through an authenticated tunnel to the
 application.
 
+## Connecting to an MCP server
+
+Teleport Connect can set up an authenticated tunnel on a random port on your
+device to an MCP server in streamable-HTTP transport. All connections made to
+that tunnel will be authenticated with your credentials.
+
+1. Open a tab with cluster resources by clicking on the plus symbol at the end of the tab bar. You
+  can also press `Ctrl+Shift+T/Cmd+T` to achieve the same result.
+1. Click the Connect button of the MCP server resource.
+
+A new tab will open with a new connection established between your device and the MCP server.
+
+![MCP connection](../../../img/use-teleport/connect-mcp-http.png)
+
+The connection is active while Teleport Connect is running.
+If [the background mode](#background-mode) is on, it remains active even after you close the window.
+To end the connection, click Close Connection or quit the app.
+
+The port number will persist between app restarts—you can set up your client
+without worrying about the port suddenly changing.
+
 ## Connecting to multiple clusters
 
 Teleport Connect allows you to log in to multiple clusters at the same time. After logging in to
@@ -283,19 +408,19 @@ the lifecycle of the agent.
 {/* The permission to read and update users is needed during setup but not for regular usage,
 that's why it's not listed in the partial. */}
 - Permissions to read and update user objects in the backend (verbs `read` and `update` for [the
-  `user` resource](../reference/access-controls/roles.mdx)).
+  `user` resource](../../reference/access-controls/roles.mdx)).
 - Permissions to read, update, and create roles in the backend (verbs `read`, `update`, and `create`
-  for [the `role` resource](../reference/access-controls/roles.mdx)).
+  for [the `role` resource](../../reference/access-controls/roles.mdx)).
 
 The agent runs as the current system user, not as root. Some features are thus not available, such
-as logging in as other system users or [host user creation](../enroll-resources/server-access/guides/host-user-creation.mdx).
+as logging in as other system users or [host user creation](../../enroll-resources/server-access/guides/host-user-creation.mdx).
 
 ### Setup and usage
 
 To begin the setup, click on the laptop icon in the top left and select "Connect My Computer". The
 new tab will guide you through an interaction-free setup. Click "Connect" to start the setup.
 
-![Connect My Computer in the top bar](../../img/use-teleport/connect-my-computer-top-bar@2x.png)
+![Connect My Computer in the top bar](../../../img/use-teleport/connect-my-computer-top-bar@2x.png)
 
 The setup creates a new role in the cluster which grants access to your device as the current system
 user. The role is then added to your user object.
@@ -315,18 +440,20 @@ Next, the setup downloads a Teleport Agent for your platform and runs `teleport
 pointed at the current cluster. Once that is done, Connect My Computer starts the agent and waits
 for it to show up in the cluster as an SSH node.
 
-![Connect My Computer setup](../../img/use-teleport/connect-my-computer-setup@2x.png)
+![Connect My Computer setup](../../../img/use-teleport/connect-my-computer-setup@2x.png)
 
 After the agent joins the cluster, the tab transitions to showing the status of the agent. From
 here, you can connect to the node made available by the agent, stop and start the agent, as well as
 completely remove it. Manually logging out of the cluster will remove the agent as well.
 
-![Connect My Computer status](../../img/use-teleport/connect-my-computer-status@2x.png)
+![Connect My Computer status](../../../img/use-teleport/connect-my-computer-status@2x.png)
+
+Your computer will be shared while Teleport Connect is running.
+If [the background mode](#background-mode) is on, it remains shared even after you close the window.
+To stop sharing, quit the app or stop the agent through the Connect My Computer tab.
 
-Your computer will be shared while Teleport Connect is open. To stop sharing, close Teleport Connect
-or stop the agent through the Connect My Computer tab. Sharing will resume on app restart, unless
-you stop the agent before exiting. The agent stops immediately if Teleport Connect unexpectedly
-crashes.
+Sharing will resume on app restart, unless you stop the agent before exiting.
+The agent stops immediately if Teleport Connect unexpectedly crashes.
 
 ### Agent maintenance
 
@@ -400,7 +527,7 @@ INFO [AUTH]      Attempting registration via proxy server. auth/register.go:279
 ERRO [PROC:1]    Can not join the cluster as node, the token expired or not found. Regenerate the token and try again. pid:54364.1 service/connect.go:106
 ```
 
-During the setup, Connect My Computer creates [a join token](../enroll-resources/agents/join-token.mdx)
+During the setup, Connect My Computer creates [a join token](../../enroll-resources/agents/join-token.mdx)
 that is valid for up to five minutes. If the logs say that the token has expired, it most likely
 means that the initial attempt to join the cluster has failed and you started another one after more
 than five minutes.
@@ -419,7 +546,7 @@ the agent was successfully configured.
 If you wish to prevent cluster users from using Connect My Computer, make sure they don't have
 permissions to create new join tokens. This is controlled by the `create` verb for the `token`
 resource. Either deny this permission explicitly or do not grant it in the first place. See [Access
-Controls Reference Documentation](../reference/access-controls/roles.mdx) for more
+Controls Reference Documentation](../../reference/access-controls/roles.mdx) for more
 details. Denying this permission will hide the icon in the top bar.
 
 Users who already set up agents will still be able to manage those agents, even after the denying
@@ -428,7 +555,7 @@ a user set up an agent and then lock the user out of removing the agent.
 
 To instantly revoke access to agents that have already joined the cluster, look for nodes labeled
 with the `teleport.dev/connect-my-computer/owner` label and then [place
-locks](../admin-guides/access-controls/guides/locking.mdx) on those nodes.
+locks](../../identity-governance/locking.mdx) on those nodes.
 
 ```code
 $ tctl nodes ls -v --query='labels["teleport.dev/connect-my-computer/owner"] != ""'
@@ -440,11 +567,17 @@ $ tctl lock --server-id=SERVER_UUID --message="Using Connect My Computer is forb
 Teleport Connect ships with its own bundled version of tsh. Teleport Connect will always use this
 version of tsh for any actions performed within the app.
 
-Teleport Connect makes tsh available to use in your terminal of choice as well. Please note that at
-the moment tsh and Teleport Connect operate on different sets of profiles, as Teleport Connect sets
-a custom home location through [the `TELEPORT_HOME` environment
-variable](../reference/cli/tsh.mdx#tsh-environment-variables). For example, logging in to a new cluster
-through tsh will not make that cluster show up in Teleport Connect.
+The bundled tsh tool is also available to use directly in your terminal. By default, Teleport Connect and tsh share
+the same home directory, so any profiles you create or update in one tool are immediately reflected in the other.
+If you prefer a different directory, you can configure it via the `tshHome` property in [the configuration](#configuration).
+
+Teleport Connect actively monitors the tsh directory, so updates made with tsh (such as logging in, logging out,
+or adding new clusters) will automatically appear in the app.
+
+<Admonition type="note" title="Note">
+Older versions of Teleport Connect used a separate set of profiles stored in an internal tsh directory.
+On the first launch, the app will automatically migrate your profiles to the new location.
+</Admonition>
 
 <Tabs>
 <TabItem label="macOS">
@@ -468,7 +601,7 @@ installation directory to the `Path` user environment variable.
 
 Teleport Connect supports authenticating with hardware-based keys.
 Keys are generated and stored directly on a hardware device, providing greater security than storing
-them on a file system. For more details, see [Hardware Key Support guide](../admin-guides/access-controls/guides/hardware-key-support.mdx).
+them on a file system. For more details, see [Hardware Key Support guide](../../zero-trust-access/authentication/hardware-key-support.mdx).
 
 <Admonition type="note" title="PIV support">
   Hardware key support requires users to use a PIV-compatible hardware key.
@@ -478,7 +611,7 @@ them on a file system. For more details, see [Hardware Key Support guide](../adm
 To log in with a hardware key, your role or cluster configuration must enable it.
 Once enforced, Teleport Connect will require you to keep the hardware key plugged in and may also prompt for a tap and/or PIV PIN:
 
-![Logging in with a hardware key](../../img/use-teleport/connect-hardware-keys@2x.png)
+![Logging in with a hardware key](../../../img/use-teleport/connect-hardware-keys@2x.png)
 
 When logging in for the first time, you’ll be prompted to log in again immediately.
 
@@ -504,6 +637,8 @@ Below is the list of the supported config properties.
 |-------------------------------|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------|
 | `theme`                       | `system`                                                                                                             | Color theme for the app. Available modes: `light`, `dark`, `system`.                                       |
 | `skipVersionCheck`            | `false`                                                                                                              | Skips the version check and hides the version compatibility warning when logging in to a cluster.          |
+| `runInBackground` | `true` on macOS/Windows, `false` on Linux | Keeps the app running in the menu bar/system tray even when the main window is closed. On Linux, displaying the system tray icon may require installing shell extensions. |
+| `tshHome` | `~/.tsh` | Home location for tsh configuration and data. |
 | `terminal.fontFamily`         | `Menlo, Monaco, monospace` on macOS `Consolas, monospace` on Windows `'Droid Sans Mono', monospace` on Linux | Font family for the terminal.                                                                              |
 | `terminal.fontSize`           | `15`                                                                                                                 | Font size for the terminal.                                                                                |
 | `terminal.windowsBackend` | `auto` | `auto` uses modern [ConPTY](https://devblogs.microsoft.com/commandline/windows-command-line-introducing-the-windows-pseudo-console-conpty/) system if available, which requires Windows 10 (19H1) or above. Set to `winpty` to use winpty even if ConPTY is available. |
@@ -525,7 +660,7 @@ Below is the list of the supported config properties.
 | `keymap.openClusters`         | `Command+E` on macOS `Ctrl+Shift+E` on Windows/Linux                                                             | Shortcut to open the cluster selector.                                                                     |
 | `keymap.openProfiles`         | `Command+I` on macOS `Ctrl+Shift+I` on Windows/Linux                                                             | Shortcut to open the profile selector.                                                                     |
 | `keymap.openSearchBar`        | `Command+K` on macOS `Ctrl+Shift+K` on Windows/Linux                                                             | Shortcut to open the search bar.                                                                           |
-| `headless.skipConfirm`        | `false`                                                                                                              | Skips the confirmation prompt for Headless WebAuthn approval and instead prompts for WebAuthn immediately. |
+| `headless.skipConfirm`        | `false`                                                                                                              | Skips the confirmation prompt for Headless Authentication approval and instead prompts for MFA immediately. |
 | `ssh.noResume`                | `false`                                                                                                              | Disables SSH connection resumption.                                                                        |
 | `ssh.forwardAgent`            | `false`                                                                                                              | Enables agent forwarding.                                                                                  |
 | `sshAgent.addKeysToAgent`     | `auto`                                                                                                               | Controls how keys are added to a local SSH agent. "auto" adds the keys only if the agent supports SSH certificates, "no" never attempts to add them, "yes" always attempts to add them, "only" always attempts to add the keys to the agent but it does not save them on disk. |
@@ -556,6 +691,20 @@ Available key codes:
 - `,`, `.`, `/`, `\`, `` ` ``, `-`, `=`, `;`, `'`, `[`, `]`
 - `Space`, `Tab`, `CapsLock`, `NumLock`, `ScrollLock`, `Backspace`, `Delete`, `Insert`, `Enter`, `Up`, `Down`, `Left`, `Right`, `Home`, `End`, `PageUp`, `PageDown`, `Escape`, `IntlBackslash`
 
+### `tsh ssh` environment variables
+
+Under the hood, Teleport Connect uses `tsh ssh` to connect to SSH servers. As a result,
+Teleport Connect will respect many [tsh environment variables](../../reference/cli/tsh.mdx#tsh-environment-variables)
+related to `tsh ssh`. This can make it easier to share common settings between `tsh` and Teleport Connect.
+
+Below is a list of environment variables supported by Teleport Connect for SSH connections:
+
+| Property | Default | Allowed Value(s) | Description |
+|----------|---------|------------------|-------------|
+| `TELEPORT_MFA_MODE` | `auto` | `auto`, `cross-platform`, `platform`, `otp`, or `sso` | Preferred mode for MFA and Passwordless assertions. |
+| `TELEPORT_ADD_KEYS_TO_AGENT` | `auto` | `auto`, `no`, `yes`, or `only` | Controls how keys are added to a local SSH agent. "auto" adds the keys only if the agent supports SSH certificates, "no" never attempts to add them, "yes" always attempts to add them, "only" always attempts to add the keys to the agent but it does not save them on disk. |
+| `TELEPORT_NO_RESUME` | `false` | `true` or `false` | Disables SSH connection resumption. |
+
 ## Telemetry
 
 (!docs/pages/includes/teleport-connect-telemetry.mdx!)
@@ -582,27 +731,30 @@ To reset the state related to a particular cluster:
 1. Close Teleport Connect.
 1. Open Teleport Connect, then log back in to the cluster.
 
-To completely wipe all app state:
+To completely wipe all app state, close Teleport Connect and run the following commands:
 
-1. Close Teleport Connect.
-1. Remove the internal `tsh` folder and the `app_state.json` file to log out of all clusters and
-   clear all remembered tabs and connections.
+{/* TODO: DELETE IN 20.0.0: */}
+{/* Remove cleaning up the internal Teleport Connect/tsh directory from the commands. */}
+{/* Also remove the tsh home migration in Connect's main.ts */}
 
 <Tabs>
 <TabItem label="macOS">
 ```code
 $ rm -rf ~/Library/Application\ Support/Teleport\ Connect/{tsh,app_state.json}
+$ rm -rf ~/.tsh
 ```
 </TabItem>
 <TabItem label="Linux">
 ```code
 $ rm -rf ~/.config/Teleport\ Connect/{tsh,app_state.json}
+$ rm -rf ~/.tsh
 ```
 </TabItem>
 <TabItem label="Windows">
 ```code
-$ rmdir /s /q C:\Users\%UserName%\AppData\Roaming\"Teleport Connect"\tsh
 $ del C:\Users\%UserName%\AppData\Roaming\"Teleport Connect"\app_state.json
+$ rmdir /s /q C:\Users\%UserName%\AppData\Roaming\"Teleport Connect"\tsh
+$ rmdir /s /q C:\Users\%UserName%\.tsh
 ```
 </TabItem>
 </Tabs>
@@ -661,7 +813,7 @@ see them only after you restart the app.
 
 You can open Teleport Connect in insecure mode, which skips TLS certificate verification when
 talking to a Teleport Proxy Service. This is useful in [test environments with self-signed
-certificates](../admin-guides/management/admin/self-signed-certs.mdx) or for demo purposes. We do not recommend
+certificates](../../zero-trust-access/deploy-a-cluster/self-signed-certs.mdx) or for demo purposes. We do not recommend
 using this mode in production.
 
 <Tabs>
@@ -699,23 +851,35 @@ Remove Teleport Connect for macOS from the Applications directory with this comm
 $ sudo rm -rf /Applications/Teleport\ Connect.app
 ```
 
-To remove the local user data directory:
+To remove the local user data directory which holds app configuration, state, and logs:
 
 ```code
 $ rm -rf ~/Library/Application\ Support/Teleport\ Connect
 ```
 
+To remove the tsh directory which holds cluster credentials (note: this directory is also used by the tsh tool):
+
+```code
+$ rm -rf ~/.tsh
+```
+
 </TabItem>
 <TabItem label="Windows">
 
 (!docs/pages/includes/uninstall-teleport-connect-windows.mdx!)
 
-To remove the local user data directory:
+To remove the local user data directory which holds app configuration, state, and logs:
 
 ```powershell
 $ rmdir /s /q "%APPDATA%\Teleport Connect"
 ```
 
+To remove the tsh directory which holds cluster credentials (note: this directory is also used by the tsh tool):
+
+```code
+$ rmdir /s /q C:\Users\%UserName%\.tsh
+```
+
 </TabItem>
 <TabItem label="Linux">
 
@@ -731,6 +895,12 @@ For RPM installations uninstall Teleport Connect using YUM:
 $ sudo yum remove teleport-connect
 ```
 
+To remove the tsh directory which holds cluster credentials (note: this directory is also used by the tsh tool):
+
+```code
+$ rm -rf ~/.tsh
+```
+
 Installs based on a tarball should remove the
 `teleport-connect` directory and any copied/linked executables.
 
diff --git a/docs/pages/connect-your-client/teleport-clients/tsh.mdx b/docs/pages/connect-your-client/teleport-clients/tsh.mdx
new file mode 100644
index 0000000000000..cddc2727d080f
--- /dev/null
+++ b/docs/pages/connect-your-client/teleport-clients/tsh.mdx
@@ -0,0 +1,1196 @@
+---
+title: Using the tsh Command Line Tool
+sidebar_label: tsh
+sidebar_position: 1
+description: This reference shows you how to use Teleport's tsh tool to authenticate to a cluster, explore your infrastructure, and connect to a resource.
+tags:
+ - conceptual
+ - zero-trust
+---
+
+This guide shows you how to use the Teleport client tool `tsh` to connect to
+infrastructure resources in your cluster.
+
+You will learn how to:
+
+- List, access, and interact with Teleport-connected resources.
+- Share interactive shell sessions with colleagues or join someone else's
+  session.
+- List and replay recorded interactive sessions.
+
+In addition to this document, you can type `tsh` into your terminal for
+the CLI reference, or explore the [`tsh` CLI
+Reference](../../reference/cli/tsh.mdx#tsh-login) in the documentation.
+
+{/*TODO: update this to the Access Request user guide when this is available*/}
+
+You can also use `tsh` to manage Access Requests. For instructions, see
+[Access Requests](../../identity-governance/access-requests/access-requests.mdx).
+
+## Installing tsh
+
+Follow the instructions below to install the `tsh` binary.
+
+1. Determine the version of `tsh` to install. We recommend installing the same
+   major version as the version used in your Teleport cluster. Either:
+
+   - In the Web UI, select your username in the upper right, then click **Help &
+     Support**. You will see the version of your Teleport cluster under
+     **Cluster Information**.
+
+   - Use `curl` and `jq`. Replace <Var name="teleport.example.com" />
+     with your Proxy Service address (e.g. `mytenant.teleport.sh` for Teleport
+     Enterprise Cloud):
+   
+     ```code
+     $ curl https://<Var name="teleport.example.com" />/webapi/find | jq '.server_version'
+     "(=teleport.version=)"
+     ```
+
+1. Install a package the includes `tsh`:
+
+   (!docs/pages/includes/install-tsh.mdx!)
+
+## Basic usage
+
+`tsh` allows you to view infrastructure resources that you can access in
+Teleport and connect to those resources. This section shows you the main
+workflow for using `tsh` to access an infrastructure resource.
+
+### Log in to Teleport 
+
+Log in to your Teleport cluster, assigning <Var name="teleport.example.com" />
+to the domain name of the Teleport Proxy Service in your cluster and 
+<Var name="myuser" /> to your Teleport username:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" /> --user=<Var name="myuser" />
+```
+
+This command retrieves the user's certificates and saves them into 
+`~/.tsh/<Var name="teleport.example.com" />`.
+
+### List resources that you can access
+
+In a Teleport cluster, all Teleport Agents periodically ping the cluster's Auth
+Service and update their status. This allows Teleport users to see which
+Teleport-protected resources are online.
+
+This command lists all connected servers in the cluster that you have permission
+to access:
+
+```code
+$ tsh ls
+
+# Node Name     Address            Labels
+# ---------     -------            ------
+# turing        ⟵ Tunnel          os=linux
+# graviton      10.1.0.7:3022      os=osx
+```
+
+You can use `tsh` commands to list other kinds of resources. For more
+information, see the `tsh` reference entries for the following resource types:
+
+|Resource|Command|
+|---|---|
+|[Applications](../../reference/cli/tsh.mdx#tsh-apps-ls)|`tsh apps ls`|
+|[Databases](../../enroll-resources/database-access/reference/cli.mdx#tsh-db-ls)|`tsh db ls`|
+|[Kubernetes clusters](../../reference/cli/tsh.mdx#tsh-kube-ls)|`tsh kube ls`|
+|[Servers](../../reference/cli/tsh.mdx#tsh-ls)|`tsh ls`|
+
+Windows desktops are available to list in Teleport Connect and the Teleport Web
+UI.
+
+`tsh <resource> ls` commands can apply a filter based on the resource's
+labels.  For example, to only show servers with the `os` label set to `osx`,
+you can run the following command:
+
+```code
+$ tsh ls os=osx
+
+# Nodename      Address            Labels
+# ---------     -------            ------
+# graviton      10.1.0.7:3022      os=osx
+```
+
+<details>
+<summary>Not seeing resources?</summary>
+
+(!docs/pages/includes/node-logins.mdx!)
+
+</details>
+
+### Connect to a resource
+
+Once you have determined a resource to connect to, the next step is to access
+the resource with `tsh`, which handles authentication to your Teleport cluster
+and routing traffic to and from local clients.
+
+You can only connect to a Windows desktop using the Teleport Web UI or Teleport
+Connect.
+
+Select a resource type for instructions on connecting to the resource with
+`tsh`:
+
+<Tabs>
+<TabItem label="Servers">
+
+Run the `tsh ssh` command to connect to a server, specifying the login to assume
+on the server you are connecting to. The following command connects to the
+server `mynode` as user `root`:
+
+```code
+$ tsh ssh root@mynode
+```
+
+`tsh ssh` takes the same arguments and flags as the OpenSSH client. For more
+information on connecting to servers, see [Connecting to SSH
+servers](#connecting-to-ssh-servers).
+
+</TabItem>
+<TabItem label="Applications">
+
+You can access web applications registered with Teleport through Teleport
+Connect and the Teleport Web UI. 
+
+You can also use `tsh` to start a local proxy server and connect to your
+application with your client of choice. The local proxy manages Teleport-issued
+certificates automatically. This example connects to the app `myapp`:
+
+```code
+$ tsh proxy app myapp
+```
+
+You can avoid the need to manually start the local proxy for application clients
+by using VNet. See [Using VNet](./vnet.mdx) for instructions.
+
+For APIs protected with Teleport, use `tsh apps login` to receive a certificate
+authorized to access the application, which in this example, is `grafana`:
+
+ ```code
+ $ tsh apps login grafana
+ ```
+
+You can then access the application with a command like the following:
+
+```code
+$ curl \
+  --cert /Users/alice/.tsh/keys/teleport.example.com/alice-app/cluster-name/grafana-x509.pem \
+  --key /Users/alice/.tsh/keys/teleport.example.com/alice \
+  https://grafana.teleport.example.com:3080
+```
+
+Since the local proxy manages Teleport-issued application certificates
+automatically, we recommend that you use it instead of `tsh apps login` unless
+it is necessary to manually reference TLS credentials.
+
+For cloud APIs protected by Teleport, you can use the following `tsh` commands
+to execute a single API client command or start a local proxy that API client
+applications can proxy traffic through:
+
+|Cloud API|Single command|Local proxy|
+|---|---|---|
+|AWS|`tsh aws`|[tsh proxy aws](../../reference/cli/tsh.mdx#tsh-proxy-aws)|
+|Azure|[tsh az](../../enroll-resources/application-access/reference.mdx#tsh-az)|[tsh proxy azure](../../reference/cli/tsh.mdx#tsh-proxy-azure)|
+|Google-Cloud|[tsh gcloud](../../reference/cli/tsh.mdx#tsh-gcloud)|[tsh proxy gcloud](../../reference/cli/tsh.mdx#tsh-proxy-gcloud)|
+
+</TabItem>
+<TabItem label="Databases">
+
+To receive a certificate from Teleport signed for your database user and connect
+to the database, run the following command, assuming `mydb` is the name of the
+database registered with Teleport and `my-database-user` is the name of your
+database user:
+
+```code
+$ tsh db connect --db-user=my-database-user mydb
+```
+
+Once you have finished your database session, you can remove the certificate for
+the database by running the following command:
+
+```code
+$ tsh db logout
+```
+
+Some databases require `tsh` to start a local proxy server to forward traffic
+from your workstation. `tsh db connect` starts the local proxy if it needs to,
+but you can also start the proxy yourself. This is useful for running graphical
+database clients. For example, you can start a local proxy with an authenticated
+tunnel using the following command:
+
+```code
+$ tsh proxy db --tunnel mydb
+```
+
+For more information, see [GUI Clients](../third-party/gui-clients.mdx).
+
+</TabItem>
+<TabItem label="Kubernetes clusters">
+
+To access a Teleport-connected Kubernetes cluster, run the following command to
+update your kubeconfig with a certificate signed by Teleport. The following
+command logs in to the cluster mycluster:
+
+```code
+$ tsh kube login mycluster
+```
+
+Once you have logged into the cluster, run `tsh kubectl` to execute `kubectl`
+commands. Teleport can allow or deny access to specific Kubernetes cluster
+resources. `tsh kubectl` detects whether the command has failed due to
+insufficient permissions and, if so, submits an Access Request for the target
+Kubernetes resource.
+
+For example, the following command executes the `date` command in pod `my-pod`
+and submits an Access Request if the user does not have permissions to access
+that pod:
+
+```code
+$ tsh kubectl exec my-pod -- date
+```
+
+</TabItem>
+</Tabs>
+
+## Logging in
+
+To retrieve a user's certificate, execute:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Full form:
+$ tsh login --proxy=proxy_host:<https_proxy_port>
+
+# Using default ports:
+$ tsh login --proxy=work.example.com
+
+# Using custom HTTPS port:
+$ tsh login --proxy=work.example.com:5000
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Full form:
+$ tsh login --proxy=proxy_host:<https_proxy_port>
+
+$ tsh login --proxy=mytenant.teleport.sh
+```
+
+</TabItem>
+
+</Tabs>
+
+[CLI Docs - tsh login](../../reference/cli/tsh.mdx#tsh-login)
+
+| Port | Description |
+| - | - |
+| https_proxy_port | the HTTPS port the proxy host is listening to (defaults to `443` and `3080`). |
+
+The login command retrieves a user's certificate and stores it in `~/.tsh`
+directory as well as in the [ssh agent](https://en.wikipedia.org/wiki/Ssh-agent) if there is one running.
+
+This allows you to authenticate just once, maybe at the beginning of the day. Subsequent `tsh ssh` commands will run without asking for credentials until the temporary certificate expires. By default, Teleport issues user certificates with a time to live (TTL) of 12 hours.
+
+<Admonition
+  type="tip"
+  title="Tip"
+>
+  It is recommended to always use [`tsh login`](../../reference/cli/tsh.mdx#tsh-login) before using any other `tsh` commands. This allows users to omit `--proxy` flag in subsequent tsh commands. For example `tsh ssh user@host` will work.
+</Admonition>
+
+A Teleport cluster can be configured for multiple user identity sources. For example, a cluster may have a local user called `admin` while regular users should [authenticate via GitHub](../../zero-trust-access/sso/integrate-idp/github-sso.mdx). In this case, you have to pass `--auth` flag to `tsh login` to specify which identity storage to use:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Log in using the local Teleport 'admin' user:
+$ tsh --proxy=proxy.example.com --auth=local --user=admin login
+
+# Log in using GitHub as an SSO provider, assuming the GitHub connector is called "github"
+$ tsh --proxy=proxy.example.com --auth=github login
+
+# Don't open the system default browser when logging in
+$ tsh login --proxy=work.example.com --browser=none
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Log in using the local Teleport 'admin' user:
+$ tsh --proxy=mytenant.teleport.sh --auth=local --user=admin login
+
+# Log in using GitHub as an SSO provider, assuming the GitHub connector is called "github"
+$ tsh --proxy=mytenant.teleport.sh --auth=github login
+```
+
+</TabItem>
+
+</Tabs>
+
+When using an external identity provider to log in, `tsh` will need to open a
+web browser to complete the authentication flow. By default, `tsh` will use your
+system's default browser. If you wish to suppress this behavior, you can use the
+`--browser=none` flag:
+
+<Tabs>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Don't open the system default browser when logging in
+$ tsh login --proxy=mytenant.teleport.sh --browser=none
+```
+
+</TabItem>
+
+</Tabs>
+
+In this situation, a link will be printed on the screen. You can copy and paste this link into
+a browser of your choice to continue the login flow.
+
+[CLI Docs - tsh login](../../reference/cli/tsh.mdx#tsh-login)
+
+### Inspecting an SSH certificate
+
+To inspect the SSH certificates in `~/.tsh`, a user may execute the following
+command:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ tsh status
+
+# > Profile URL:  https://proxy.example.com:3080
+#   Logged in as: johndoe
+#  Cluster:      proxy.example.com
+#   Roles:        access, auditor, editor
+#   Logins:       root, admin, guest
+#   Kubernetes:   enabled
+#  Valid until:  2017-04-25 15:02:30 -0700 PDT [valid for 1h0m0s]
+#  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh status
+
+# > Profile URL:  https://mytenant.teleport.sh:443
+#   Logged in as: johndoe
+#  Cluster:      mytenant.teleport.sh
+#   Roles:        access, editor, auditor
+#   Logins:       root, admin, guest
+#   Kubernetes:   enabled
+#  Valid until:  2017-04-25 15:02:30 -0700 PDT [valid for 1h0m0s]
+#  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+</TabItem>
+
+</Tabs>
+
+[CLI Docs - tsh status](../../reference/cli/tsh.mdx#tsh-status)
+
+### Identity files
+
+[`tsh login`](../../reference/cli/tsh.mdx#tsh-login) can also save the user certificate into a
+file:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Authenticate the user against proxy.example.com and save the user
+# certificate to joe.pem
+$ tsh login --proxy=proxy.example.com --out=joe
+
+# Use joe.pem to log in to the server 'db'
+$ tsh ssh --proxy=proxy.example.com -i joe joe@db
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Authenticate the user against mytenant.teleport.sh and save the user
+# certificate to joe.pem
+$ tsh login --proxy=mytenant.teleport.sh --out=joe
+
+# Use joe.pem to log in to the server 'db'
+$ tsh ssh --proxy=mytenant.teleport.sh -i joe joe@db
+```
+
+</TabItem>
+
+</Tabs>
+
+By default, the `--out` flag will create an identity file suitable for `tsh -i`.
+If compatibility with OpenSSH is needed, `--format=openssh` must be specified.
+In this case, the identity will be saved into two files, `joe` and
+`joe-cert.pub`:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ tsh login --proxy=proxy.example.com --out=joe --format=openssh
+$ ls -lh
+
+# total 8.0K
+# -rw------- 1 joe staff 1.7K Aug 10 16:16 joe
+# -rw------- 1 joe staff 1.5K Aug 10 16:16 joe-cert.pub
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh --out=joe --format=openssh
+$ ls -lh
+
+# total 8.0K
+# -rw------- 1 joe staff 1.7K Aug 10 16:16 joe
+# -rw------- 1 joe staff 1.5K Aug 10 16:16 joe-cert.pub
+```
+
+</TabItem>
+
+</Tabs>
+
+### SSH certificates for automation
+
+Regular users of Teleport must request an auto-expiring SSH certificate, usually
+every day. This doesn't work for non-interactive scripts, like cron jobs or a
+CI/CD pipeline.
+
+The most secure way to generate certificates for automation purposes is to use
+[Machine & Workload Identity](../../machine-workload-identity/machine-workload-identity.mdx).
+This ensures that your automation is taking advantage of the security properties
+of short-lived credentials.
+
+If Machine & Workload Identity does not support your preferred CI/CD platform,
+you can create a local user for use in automation and request a long-lived
+certificate for that user.
+
+In this example, we're creating a certificate with a TTL of one hour for the
+`jenkins` user and storing it in a `jenkins.pem` file, which can be later used with
+`-i` (identity) flag for `tsh`.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+$ tctl auth sign --ttl=1h --user=jenkins --out=jenkins.pem
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Log in to your Teleport Cloud cluster so you can use tctl locally.
+$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
+$ tctl auth sign --ttl=1h --user=jenkins --out=jenkins.pem
+```
+
+</TabItem>
+
+</Tabs>
+
+[CLI Docs - tctl auth sign](../../reference/cli/tctl.mdx#tctl-auth-sign)
+
+Now `jenkins.pem` can be copied to the Jenkins server and passed to the `-i`
+(identity file) flag of `tsh`.
+
+`tctl auth sign` is an admin's equivalent of `tsh login --out` and allows for
+unrestricted certificate TTL values.
+
+## Connecting to SSH servers
+
+This section provides detailed information about using `tsh` to connect to SSH
+servers registered with your Teleport cluster.
+
+### User identities
+
+A user identity in Teleport exists in the scope of a cluster. The member nodes
+of a cluster may have multiple OS users on them. A Teleport administrator
+assigns allowed logins to every Teleport user account.
+
+When logging into a remote node, you will have to specify both the Teleport
+login and the OS login. A Teleport identity will have to be passed via the
+`--user` flag while the OS login will be passed as `login@host` using syntax
+compatible with the traditional `ssh` command.
+
+The following command authenticates against the 
+<Var name="teleport.example.com" /> cluster and logs into the server `node` as
+`root`:
+
+```code
+$ tsh ssh --proxy=<Var name="teleport.example.com" /> --user=joe root@node
+```
+
+### Proxy ports
+
+By default, the Teleport Proxy Service listens on port `3080`.
+
+If a Teleport Proxy Service instance is configured to listen on non-default
+ports, they must be specified via `--proxy` flag as shown:
+
+```code
+$ tsh --proxy=proxy.example.com:5000 <subcommand>
+```
+
+This `tsh` command will use port `5000` of the Proxy Service.
+
+### Port forwarding
+
+`tsh ssh` supports the OpenSSH `-L` flag which forwards incoming
+connections from localhost to the specified remote host:port. The syntax of `-L`
+flag is as follows, where "bind_ip" defaults to `127.0.0.1`:
+
+```code
+$ -L [bind_ip]:listen_port:remote_host:remote_port
+```
+
+Example:
+
+```code
+$ tsh ssh -L 5000:web.remote:80 node
+```
+
+This will connect to remote server `node` via the Proxy Service, then open a
+listening socket on `localhost:5000`. Finally, it will forward all incoming
+connections to `web.remote:80` via this SSH tunnel.
+
+It is often convenient to establish port forwarding, execute a local command
+which uses the connection, and then disconnect. You can do this with the `--local`
+flag.
+
+Example:
+
+```code
+$ tsh ssh -L 5000:google.com:80 --local node curl http://localhost:5000
+```
+
+This command:
+
+- Connects to `node`.
+- Binds the local port `5000` to port `80` on `google.com`.
+- Executes `curl` command locally, which results in `curl` hitting `google.com:80` via `node`.
+
+### SSH agent support
+
+If there is an [ssh agent](https://en.wikipedia.org/wiki/Ssh-agent) running,
+`tsh login` will store the user certificate in the agent. This can be verified
+via:
+
+```code
+$ ssh-add -L
+```
+
+The SSH agent can be used to feed the certificate to other SSH clients, for example
+to OpenSSH (`ssh`).
+
+If you wish to disable SSH agent integration, pass `--no-use-local-ssh-agent`
+to `tsh`. You can also set the `TELEPORT_USE_LOCAL_SSH_AGENT` environment
+variable to `false` in your shell profile to make this permanent.
+
+
+### SSH jump host
+
+While implementing `ProxyJump` for Teleport, we have extended the feature to `tsh`.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ tsh ssh -J proxy.example.com telenode
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh ssh -J mytenant.teleport.sh telenode
+```
+
+</TabItem>
+
+</Tabs>
+
+Known limitations:
+
+- Only one jump host is supported (`-J` supports chaining that Teleport does not utilize) and `tsh` will return with error in the case of two jump hosts, i.e. `-J proxy-1.example.com,proxy-2.example.com` will not work.
+- When `tsh ssh -J user@proxy` is used, it overrides the SSH proxy defined in the tsh profile, and port forwarding is used instead of the existing Teleport proxy subsystem.
+
+### Resolving server names
+
+`tsh` supports multiple methods to resolve remote Node names.
+
+- **Traditional**: by IP address or via DNS.
+- **Nodename setting**: the `teleport` daemon supports the` nodename` flag, which allows Teleport administrators to assign alternative Node names.
+- **Labels**: you can address a Node by `name=value` pair.
+
+If we have two Node, one with `os:linux` label and one Node with `os:osx`, we
+can log in to the OSX Node with:
+
+```code
+$ tsh ssh os=osx
+```
+
+This only works if there is only one remote node with the `os:osx` label, but
+you can still execute commands via SSH on multiple Nodes using labels as a
+selector. This command will update all system packages on machines that run
+Linux:
+
+```code
+$ tsh ssh os=ubuntu apt-get update -y
+```
+
+### Short-lived sessions
+
+The default TTL of a Teleport user certificate is 12 hours. This can be modified
+at login with the `--ttl` flag. This command logs you into the cluster with a
+very short-lived (1 minute) temporary certificate:
+
+```code
+$ tsh --ttl=1 login
+```
+
+You will be logged out after one minute, but if you want to log out immediately,
+you can always run:
+
+```code
+$ tsh logout
+```
+
+### Connecting to SSH clusters behind firewalls
+
+Teleport supports creating clusters of servers located behind firewalls
+**without any open listening TCP ports**.  This works by creating reverse SSH
+tunnels from behind-firewall environments into a Teleport Proxy Service you have access to.
+
+To learn more about setting up a trust relationship between clusters behind firewalls, see
+[Configure Trusted Clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx).
+
+<Admonition type="note" >
+  Trusted clusters are only available for self-hosted Teleport clusters.
+</Admonition>
+
+Assuming the Teleport Proxy Server called `work` is configured with a few trusted
+clusters, you can use the `tsh clusters` command to see a list of all the trusted clusters on the server:
+
+```code
+$ tsh --proxy=work clusters
+
+# Cluster Name     Status
+# ------------     ------
+# staging          online
+# production       offline
+```
+
+[CLI Docs - tsh clusters](../../reference/cli/tsh.mdx#tsh-clusters)
+
+Now you can use the `--cluster` flag with any `tsh` command. For example, to list SSH nodes that are members of the `production` cluster, simply run:
+
+```code
+$ tsh --proxy=work ls --cluster=production
+
+# Node Name     Node ID       Address            Labels
+# ---------     -------       -------            ------
+# db-1          xxxxxxxxx     10.0.20.31:3022    kernel:4.4
+# db-2          xxxxxxxxx     10.0.20.41:3022    kernel:4.2
+```
+
+Similarly, if you want to SSH into `db-1` inside the `production` cluster:
+
+```code
+$ tsh --proxy=work ssh --cluster=production db-1
+```
+
+This is possible even if Nodes in the `production` cluster are located behind a
+firewall without open ports. This works because the `production` cluster
+establishes a reverse SSH tunnel back into the Proxy Service called `work`, and
+this tunnel is used to establish inbound SSH connections.
+
+### X11 forwarding
+
+In order to run graphical programs within an SSH session, such as an IDE like
+Virtual Studio Code, you'll need to request X11 forwarding for the session with
+the `-X` flag.
+
+```code
+$ tsh ssh -X node01
+```
+
+X11 forwarding provides the server with secure access to your local X Server
+so that it can communicate directly with your local display and I/O devices.
+
+<Admonition type="note">
+  The `-Y` flag can be used to start Trusted X11 forwarding. This is needed
+  in order to enable more "unsafe" features, such as running clipboard or
+  screenshot utilities like `xclip`. However, it provides the server with
+  unmitigated access to your local X Server and puts your local machine at
+  risk of X11 attacks, so it should only be used with extreme caution.
+</Admonition>
+
+In order to use X11 forwarding, you'll need to enable it on the Teleport Node.
+You'll also need to ensure that your user has the `permit_x11_forwarding` role option:
+
+```code
+$ tsh status
+> Profile URL:        https://proxy.example.com:3080
+  Logged in as:       dev
+  ...
+  Extensions:         permit-X11-forwarding
+```
+
+
+## Interacting with SSH servers
+
+In this section, you will find details on interacting with SSH servers with
+`tsh`.
+
+### Interactive shell
+
+To launch an interactive shell on a remote Node or to execute a command, use
+`tsh ssh`.
+
+`tsh` tries to mimic the `ssh` experience as much as possible, so it supports
+the most popular `ssh` flags like `-p`, `-l` or `-L`. For example, if you have
+the following alias defined in your `~/.bashrc`: `alias ssh="tsh ssh"` then you
+can continue using familiar SSH syntax:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Have this alias configured, perhaps via ~/.bashrc
+$ alias ssh="/usr/local/bin/tsh ssh"
+
+# Login in to a cluster and retrieve your SSH certificate:
+$ tsh --proxy=proxy.example.com login
+
+# These commands execute `tsh ssh` under the hood:
+$ ssh user@node
+$ ssh -p 6122 user@node ls
+$ ssh -o ForwardAgent=yes user@node
+$ ssh -o AddKeysToAgent=yes user@node
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Have this alias configured, perhaps via ~/.bashrc
+$ alias ssh="/usr/local/bin/tsh ssh"
+
+# Login in to a cluster and retrieve your SSH certificate:
+$ tsh --proxy=mytenant.teleport.sh login
+
+# These commands execute `tsh ssh` under the hood:
+$ ssh user@node
+$ ssh -p 6122 user@node ls
+$ ssh -o ForwardAgent=yes user@node
+$ ssh -o AddKeysToAgent=yes user@node
+```
+
+</TabItem>
+</Tabs>
+
+### Copying files
+
+To securely copy files to and from cluster Nodes, use the `tsh scp` command. It
+is designed to mimic OpenSSH's `scp` command as much as possible:
+
+```code
+$ tsh scp example.txt root@node:/path/to/dest
+```
+
+Again, you may want to create a bash alias like `alias scp="tsh --proxy=work
+scp"` and use the familiar syntax:
+
+```code
+$ scp -P 61122 -r files root@node:/path/to/dest
+```
+
+Teleport supports both the SCP and SFTP protocols.
+OpenSSH `scp` or `sftp` commands can both be used in place of `tsh scp`
+if desired.
+
+### Sharing sessions
+
+Suppose you are trying to troubleshoot a problem on a remote server. Sometimes
+it makes sense to ask another team member for help. Traditionally, this could be
+done by letting them know which host you're on, having them SSH in, start a
+terminal multiplexer like `screen`, and join a session there.
+
+Teleport makes this more convenient. Let's log in to a server named `luna`
+and ask Teleport for our current session status:
+
+```code
+$ tsh ssh luna
+# on host luna
+$ teleport status
+
+# User ID    : joe, logged in as joe from 10.0.10.1 43026 3022
+# Session ID : 7645d523-60cb-436d-b732-99c5df14b7c4
+Session URL: https://work:3080/web/sessions/7645d523-60cb-436d-b732-99c5df14b7c4
+```
+
+Now you can invite another user account to the `work` cluster. You can share the
+URL for access through a web browser, or you can share the session ID, and the
+other user can join you through their terminal by typing:
+
+```code
+$ tsh join <session_ID>
+```
+
+<Admonition
+  type="tip"
+  title="Lacking permission?"
+>
+  Joining sessions requires special permissions that need to be set up by your cluster administrator.
+  Refer them to the [Moderated Sessions guide](../../zero-trust-access/authentication/joining-sessions.mdx) for more information on configuring join permissions.
+</Admonition>
+
+You can also list active sessions with the `tsh sessions ls` command.
+
+<Admonition type="note" scope={["oss", "enterprise"]}>
+  Joining sessions is not supported in recording proxy mode (where `session_recording` is set to `proxy`).
+</Admonition>
+
+## Proxying Git commands
+
+(!docs/pages/connect-your-client/includes/tsh-git.mdx!)
+
+## Debug logs
+
+Adding the `--debug` flag to a command or setting the `TELEPORT_DEBUG` env var to `1` makes tsh
+print debug logs to standard output.
+
+### Unified logging system on macOS
+
+On macOS, the `--os-log` flag can be used instead of `--debug` to send debug logs to [the unified
+logging system](https://support.apple.com/en-gb/guide/console/welcome/mac). This behavior can also be controlled through the `TELEPORT_OS_LOG` env var.
+
+To stream logs in a separate shell session:
+
+```code
+$ log stream --predicate 'subsystem CONTAINS "tsh"' --style syslog --level debug
+```
+
+To dump logs captured so far to a file:
+
+```code
+$ log show --predicate 'subsystem CONTAINS "tsh"' --style syslog --info --debug > tsh.log
+```
+
+The logs can also be inspected in [the Console
+app](https://support.apple.com/en-gb/guide/console/cnsl1012/1.1/mac/15.0). Info and debug logs are
+not shown by default, so make sure to select "Include Info Messages" and "Include Debug Messages"
+from the Action menu.
+
+## Examining recorded sessions
+
+You can use `tsh` to examine sessions that users have completed in resources
+protected by Teleport. This section explains how to list and play Teleport
+session recordings with `tsh`.
+
+To view the recording, select **Audit** in the Teleport Web UI, then click **Session Recordings** in the menu.
+
+### Listing recordings
+
+Run the following command to review recorded sessions:
+
+```code
+$ tsh recordings ls
+ID                                   Type Participants Hostname Timestamp
+------------------------------------ ---- ------------ -------- -------------------
+b0a04442-70dc-4be8-9308-7b7901d2d600 ssh  jeff         dev       Nov 26 16:36:16 UTC
+c0a02222-70dc-4be8-9308-7b7901d2d600 kube alice                  Nov 26 20:36:16 UTC
+d0a04442-70dc-4be8-9308-7b7901d2d600 ssh  navin        test      Nov 26 16:36:16 UTC
+```
+
+### Playing recordings
+
+To play a session recording, run the `tsh play` command with the ID of a session
+as returned by `tsh recordings ls`:
+
+```code
+$ tsh play c0a02222-70dc-4be8-9308-7b7901d2d600
+```
+
+You can also run `tsh play` with the path to a TAR file that contains a session
+recording:
+
+```code
+$ tsh play ./my-recording.tar
+```
+
+To retrieve a TAR file containing a session recording, you must have access to
+the session recording backend. This requires either a self-hosted Teleport
+cluster or [external audit
+storage](../../zero-trust-access/management/external-audit-storage.mdx).
+
+The `tsh play` command can print recordings in several formats, depending on the
+kind of resource the recorded session interacts with. To choose a format, use
+the `--format` flag of `tsh play`:
+
+| `--format` value | Supported resources | Description |
+|------------------|---------------------|-------------|
+| `pty` (default)  | Servers, Kubernetes clusters | `tsh` opens a pseudo-terminal to play each command executed in the session. |
+| `text` | Servers, Kubernetes clusters | `tsh` dumps the entire recording directly to standard out. Timing data is ignored. |
+| `json` | Servers, Kubernetes clusters, applications, databases | `tsh` prints a JSON-serialized list of audit events, separated by newlines. |
+| `yaml` | Servers, Kubernetes clusters, applications, databases | `tsh` prints a YAML-serialized list of audit events, separated by `---` characters. |
+
+The playback speed can be customized with the `--speed` flag, which must be
+one of `0.5x`, `1x`, `2x`, `4x`, or `8x`.
+
+```code
+tsh play --speed=8x UUID
+```
+
+Another way to speed up playback is to skip idle time in the recording with the
+`--skip-idle-time` flag. When enabled, tsh will respect the configured playback
+speed during active sections of the recording, but it will skip over larger periods
+of inactivity.
+
+## tsh configuration files
+
+You can use a configuration file to control the behavior of `tsh`. The scope of
+the configuration file depends on its location:
+
+- `/etc/tsh.yaml` is the default location for global, shared configuration
+  settings. You can override the location with the `TELEPORT_GLOBAL_TSH_CONFIG`
+  environment variable.
+- `$TELEPORT_HOME/config/config.yaml` is the default location for user-specific
+  configuration settings. The default location for `TELEPORT_HOME` is `~/.tsh`.
+
+`tsh` merges the settings from both configuration file locations, with the user
+configuration settings taking precedence.
+
+### Extra proxy headers
+
+The `tsh` configuration file enables you to specify HTTP headers to be
+included in requests to Teleport Proxy Servers with addresses matching
+the `proxy` field.
+
+```yaml
+add_headers:
+  - proxy: "*.example.com" # matching proxies will have headers included
+    headers: # headers are pairs to include in the http headers
+      foo: bar # Key/Value to be included in the http request
+```
+
+For example, adding HTTP headers can be useful if an intermediate HTTP proxy is
+in place that requires setting an authentication token:
+
+```yaml
+add_headers:
+  - proxy: "*.infra.corp.xyz"
+    headers:
+      "Authorization": "Bearer tokentokentoken"
+```
+
+### Aliases
+
+You can configure `tsh` to define aliases, custom commands and command-specific
+flag defaults. Using aliases, you can run frequently used `tsh` commands more
+easily. 
+
+Aliases allow you to define custom commands or change the default flag values
+for existing commands using the following syntax in `tsh` configuration files:
+
+```yaml
+aliases:
+    "<alias>": "<command>"
+```
+
+The `<alias>` can only be a top-level subcommand. In other words, you can define a `tsh mycommand` alias but not `tsh my command`.
+
+New command `tsh l`:
+
+```yaml
+aliases:
+    "l": "tsh login --auth=okta"
+```
+
+Make `tsh status` use JSON as a default format:
+
+```yaml
+aliases:
+    "status": "tsh status --format=json"
+```
+
+The alias can use an arbitrary number of arguments. If an argument variable `$N` is referenced, `tsh` will check that at least `N+1` arguments were given to the alias invocation. All arguments that were given but not referenced in the alias definition will be appended at the end.
+
+Define a custom command using `bash`. The `$0` and `$1` variables will be substituted with command arguments.
+
+```yaml
+aliases:
+    "connect": "bash -c 'tsh login $0 && tsh ssh $1'"
+```
+
+Define a custom login command where first argument specifies `--auth` option.
+
+```yaml
+aliases:
+    "ap": "tsh login --auth=$0 --proxy=teleport.example.com"
+```
+
+Given the configuration:
+
+```yaml
+aliases:
+    "example": "bash -c 'echo first=$0 $0-$1 $3'"
+```
+
+`tsh example 0 1 unused-2 3 unused-4` will expand to `bash -c 'echo first=0 0-1 3 unused-2 unused-4'`.
+
+An alias definition can also reference the `$TSH` variable. If you use the
+`$TSH` variable in an alias, `tsh` expands the variable to the absolute path of
+the current `tsh` executable. This behavior can be useful if there are multiple
+`tsh` versions installed, or the version you're currently using is not in the
+`PATH`:
+
+```yaml
+aliases:
+    "status": "$TSH status --format=json"
+```
+
+To troubleshoot aliases, set the `TELEPORT_DEBUG=1` environment variable. This will cause detailed logs to be printed to standard error:
+
+```code
+$ TELEPORT_DEBUG=1 tsh status
+DEBU [TSH]       Self re-exec command: tsh [status --format=json]. tsh/aliases.go:203
+...
+```
+
+### Proxy templates
+
+With proxy templates, `tsh` dynamically determines the address of the Teleport
+Proxy Service to connect to based on the address of the destination host in your
+`tsh ssh` or `tsh proxy ssh` command:
+
+```yaml
+proxy_templates:
+
+# Regular expression that the host server address `%h:%p` is matched against.
+# The "replace rules" below can reference capturing groups from this regular
+# expression (`$1`, `$2`, etc.).
+- template: '^(\w+)\.(\w+):([0-9]+)$' # <nodename>.<clustername>:<port>
+
+  # Optional web proxy address to use for proxy jump (`--jumphost`, `-J`).
+  #
+  # Proxy Jump can be used to reduce latency in regionally distributed trusted
+  # clusters by connecting to a leaf node through the leaf proxy instead of the
+  # root proxy.
+  proxy: "$2.eu.example.com:443"
+
+  # Optional cluster name to connect to (`--cluster`).
+  #
+  # Cluster can be used to connect to leaf nodes from the root proxy without
+  # first logging in to the leaf cluster. This may be useful in cases where
+  # proxy jump is not applicable, such as when the leaf clusters do not have
+  # their own public proxies.
+  cluster: "$2"
+
+  # Optional host server address to connect to (`%h:%p`).
+  #
+  # Port defaults to 3022 if not explicitly provided with `--port`.
+  # If provided, it will take precedence over host resolution via
+  # query or search.
+  host: "$1:$3"
+
+  # Optional predicate expression to resolve the target host with.
+  #
+  # Query by predicate expression similar to tsh ls --query.
+  # Has priority over search but will be ignored if a host is provided.
+  query: "labels.env == $1"
+
+  # Optional fuzzy search terms to resolve the target host with.
+  #
+  # Search by a list of comma separated keywords similar to tsh ls --search.
+  # Only applied if host and search are not provided.
+  search: "$1"
+
+# Multiple templates can be provided. They are evaluated in order and the first
+# match takes effect.
+- template: ...
+```
+
+In the configuration above, `query` accepts an predicate expression.  This has
+priority over search but will be ignored if a host is provided.  See the
+[predicate language
+documentation](../../reference/access-controls/predicate-language.mdx#resource-filtering) for
+predicate expression examples.
+
+`tsh -J {{proxy}} ssh` and `tsh -J {{proxy}} proxy ssh` will attempt to match the
+host server address `%h:%p` with the configured templates. For each replace rule set,
+the corresponding cli value will be set.
+
+If leaf certificates are required to connect to the node, `tsh` automatically
+retrieves leaf certificates from the root cluster:
+
+```code
+$ tsh ssh -J {{proxy}} node1.leaf1
+# becomes
+$ tsh ssh -J leaf1.eu.example.com:443 --cluster leaf1 node1
+```
+
+If there is no template matched, an error is returned.
+
+```code
+$ tsh ssh -J {{proxy}} node1.none.example.com
+ERROR: proxy jump contains {{proxy}} variable but did not match any of the templates in tsh config
+```
+
+If you don't explicitly provide the proxy variable `-J {{proxy}}`, `tsh` still
+attempts to match a template, but won't fail if there isn't a match.
+Additionally, `tsh` won't replace the `proxy` value if it's explicitly set by
+the client:
+
+```code
+$ tsh ssh -J leaf2.us.example.com:443 node1.leaf2
+# becomes
+$ tsh ssh -J leaf2.us.example.com:443 --cluster leaf2 node1
+```
+
+Proxy Templates can also be used with OpenSSH by setting the `ProxyCommand`
+in `~/.ssh/config` to use `tsh proxy ssh`.
+
+```txt
+Host *.example.com
+    Port 3022
+    ProxyCommand tsh proxy ssh -J {{proxy}} %r@%h:%p
+```
+
+As a result, you can use `tsh ssh` and `ssh` interchangeably.
+
+```code
+$ tsh ssh node1.leaf1
+# is equivalent to
+$ ssh node1.leaf1
+```
+
+## Uninstalling tsh
+
+To remove `tsh` and associated user data see
+[Uninstalling Teleport](../../installation/uninstall-teleport.mdx).
+
+## Further reading
+
+Read the [`tsh` CLI Reference](../../reference/cli/tsh.mdx) for all `tsh` commands
+and their options.
diff --git a/docs/pages/connect-your-client/teleport-clients/vnet.mdx b/docs/pages/connect-your-client/teleport-clients/vnet.mdx
new file mode 100644
index 0000000000000..475ec0a465818
--- /dev/null
+++ b/docs/pages/connect-your-client/teleport-clients/vnet.mdx
@@ -0,0 +1,361 @@
+---
+title: Using VNet
+sidebar_label: VNet
+description: Using VNet
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide explains how to use VNet to connect to TCP applications and SSH
+servers available through Teleport.
+
+## How it works
+
+VNet automatically proxies connections from your computer to TCP apps and SSH
+servers available through Teleport.
+A program on your device can securely connect to resources protected
+by Teleport without having to know about Teleport authentication details.
+Underneath, VNet authenticates the connection with your Teleport credentials and
+securely tunnels the connection.
+This is all done client-side – VNet sets up a local DNS name server that
+intercepts DNS requests for your Teleport resources and responds with a virtual IP
+address managed by VNet that will handle the connection.
+
+VNet's SSH support enables third-party SSH clients to connect to Teleport SSH
+servers with minimal configuration required, while still offering Teleport
+access controls and features like [Per-session MFA](../../zero-trust-access/authentication/per-session-mfa.mdx)
+and [Hardware Key Support](../../zero-trust-access/authentication/hardware-key-support.mdx).
+
+![Diagram showing VNet architecture](../../../img/vnet/how-it-works.svg)
+
+VNet delivers an experience like a VPN through this local virtual network,
+while maintaining all of Teleport's identity verification and zero trust
+features that traditional VPNs cannot provide.
+
+VNet is available on macOS and Windows in Teleport Connect and tsh, with plans
+for Linux support in a future version.
+
+<Admonition type="warning">
+VNet's VPN-like experience for app access means that any software running on
+the client machine can access Teleport apps at local DNS or IP addresses.
+
+**Avoid running VNet on shared or multi-user machines.**
+If multiple OS users share the same machine, any user could access Teleport TCP
+apps at their local VNet DNS or IP address.
+
+**Protect HTTP services behind VNet.**
+Untrusted websites can potentially use DNS rebinding attacks to bypass the
+browser’s Same-Origin Policy and issue plain HTTP requests to VNet IP addresses.
+If your Teleport cluster contains TCP apps serving plain HTTP APIs, it is
+strongly recommended to either avoid VNet or implement one or more of the
+following mitigations for DNS rebinding attacks:
+- upgrade these APIs to HTTPS or another protocol
+- enforce a Host header allowlist at the HTTP server
+- block browser access to HTTP websites
+</Admonition>
+
+## Prerequisites
+
+<Tabs>
+<TabItem label="macOS">
+- A client machine running macOS Ventura (13.0) or higher.
+- [Teleport Connect](teleport-connect.mdx), version 16.0.0 or higher.
+</TabItem>
+<TabItem label="Windows">
+- A client machine running Windows 10 or higher.
+- [Teleport Connect](teleport-connect.mdx), version 17.3.0 or higher.
+</TabItem>
+</Tabs>
+
+## Step 1/3. Start VNet
+
+Open Teleport Connect and log in to your cluster.
+See [Using Teleport Connect](./teleport-connect.mdx) if you haven't used the
+Teleport Connect app before.
+
+Open the **connection list** in the top left and click the icon to start VNet.
+Or, skip this step and VNet will start automatically when you click "Connect"
+on a TCP app or "Connect with VNet" on an SSH server.
+
+![VNet shown in connection list](../../../img/vnet/start-vnet.png)
+
+After VNet has been started once it will automatically start every time
+Teleport Connect is opened, unless you stop VNet before closing Teleport
+Connect.
+
+<details>
+<summary>First launch on macOS</summary>
+During the first launch, macOS will prompt you to enable a background item for tsh.app. VNet needs
+this background item in order to configure DNS on your device. To enable the background item, either
+interact with the system notification or go to System Settings > General > Login Items and look for
+tsh.app under "Allow in the Background".
+
+![VNet starting up](../../../img/use-teleport/vnet-starting@2x.png)
+</details>
+
+## Step 2/3. Connect to a TCP app
+
+Find the TCP app you want to connect to.
+TCP apps have `tcp://` as the protocol in their address.
+
+![Resource list in Teleport Connect with a TCP app hovered over](../../../img/use-teleport/vnet-resources-list@2x.png)
+
+Click "Connect" next to the TCP app.
+This will start VNet if it's not already running, and then copy the app's
+address to your clipboard.
+You can now connect to the application using the application client you would
+normally use to connect to it.
+
+```code
+$ psql postgres://postgres@tcp-app.teleport.example.com/postgres
+```
+
+As long as VNet is running in the background, clicking "Connect" next to each
+app is not necessary.
+You can directly connect to all of your TCP apps without any actions in
+Teleport Connect.
+
+<Admonition type="note" title="Support for multiple ports">
+Unless the application specifies [multiple
+ports](../../enroll-resources/application-access/protect-apps/tcp.mdx#configuring-access-to-multiple-ports),
+VNet proxies connections over any port used by the application client. For multi-port apps, the port
+number must match one of the target ports of the app. To see a list of target ports, click the
+three dot menu next to an application in Teleport Connect or execute `tsh apps ls`.
+
+If [per-session MFA](../../zero-trust-access/authentication/per-session-mfa.mdx) is enabled, the
+first connection over each port triggers an MFA check.
+</Admonition>
+
+## Step 3/3. Connect to an SSH server
+
+Find the SSH server you want to connect to, open the menu next to the "Connect"
+dropdown, and click "Connect with VNet".
+This will start VNet if it's not already running, and then copy the VNet
+address for the server to your clipboard.
+
+![SSH server in Teleport Connect with "Connect with VNet" menu open](../../../img/vnet/ssh-connect.png)
+
+There is a one-time configuration step required before SSH clients will be able
+to connect to Teleport SSH servers through VNet.
+When you click "Connect with VNet" on an SSH server, Teleport Connect will
+automatically check if this configuration is present and walk you through it if
+necessary.
+
+![SSH client configuration modal in Teleport Connect](../../../img/vnet/configure-ssh-clients.png)
+
+Once the configuration step is complete, any OpenSSH-compatible client that
+reads configuration options from `~/.ssh/config` should be able to connect to
+Teleport SSH servers.
+Try connecting with the standard `ssh` client or the Remote Development feature
+in editors like Visual Studio Code or Zed.
+
+```code
+$ ssh <username>@<hostname>.<clustername>
+```
+
+As long as VNet is running in the background, clicking "Connect with VNet" next
+to each SSH server is not necessary, you can directly connect to all of your
+Teleport SSH servers without any actions in Teleport Connect.
+
+## `tsh` support
+
+VNet is also available in `tsh` without running Teleport Connect.
+To use it, log in and then run `tsh vnet`.
+
+```code
+$ tsh login --proxy=teleport.example.com
+$ tsh vnet
+```
+
+While `tsh` support is available, Teleport Connect is the preferred application
+for running VNet.
+Teleport Connect offers better visibility for MFA prompts and cluster logins, and
+automatically runs diagnostics that are useful for troubleshooting.
+
+## Troubleshooting
+
+### Conflicting IPv4 ranges
+
+On the client computer, VNet uses IPv4 addresses from the CGNAT IP range `100.64.0.0/10` by
+default, and needs to configure addresses and routes for this range.
+This can conflict with other VPN-like applications, notably Tailscale also uses
+this range.
+
+If you are experiencing connectivity problems with VNet, check if you are
+running Tailscale or another VPN client, and try disabling it to see if the
+issue persists.
+To avoid the conflict and run VNet alongside Tailscale or another VPN client you
+can configure VNet to use a different IPv4 range, see our VNet configuration
+[guide](../../enroll-resources/application-access/vnet.mdx#configuring-ipv4-cidr-range).
+
+### Connecting to the app without VNet
+
+Sometimes connectivity issues are not related to VNet, and you can narrow that down by trying to
+connect to your app without VNet. Make sure your app appears in the Connect resources view, or the
+output of `tsh apps ls`. Turn off VNet and try creating a local proxy to your app (with debug
+logging enabled) with `tsh proxy app -d <app-name>`.
+
+### Timeouts when trying to reach a Teleport cluster
+
+If VNet doesn't have a chance to clean up before stopping, such as during sudden device shut down,
+it may leave leftover DNS configuration files in `/etc/resolver`. Those files tell your computer to
+talk to a DNS server operated by VNet when connecting to your cluster. But since VNet is no longer
+running, there's no DNS server to answer those calls.
+
+To clean up those files, simply start VNet again. Alternatively, you can remove the leftover files
+manually.
+
+### Verifying that VNet receives DNS queries
+
+Open Teleport Connect. From the Connections panel in the top left, select VNet. Make sure VNet is
+running, then select "Open Diag Report". Note the IPv6 prefix and the IPv4 CIDR range used by VNet.
+
+Send a query for a TCP app available in your cluster, replacing <Var
+name="tcp-app.teleport.example.com" /> with the name of your app:
+
+<Tabs>
+<TabItem label="macOS">
+```code
+$ dscacheutil -q host -a name <Var name="tcp-app.teleport.example.com" />
+name: tcp-app.teleport.example.com
+ipv6_address: fd60:67ec:4325::647a:547d
+
+name: tcp-app.teleport.example.com
+ip_address: 100.68.51.151
+```
+</TabItem>
+<TabItem label="Windows">
+```code
+# In PowerShell.
+$ Resolve-DnsName <Var name="tcp-app.teleport.example.com" />
+
+Name                                           Type   TTL   Section    IPAddress
+----                                           ----   ---   -------    ---------
+tcp-app.teleport.example.com                   AAAA   10    Answer     fd60:67ec:4325::647a:547d
+tcp-app.teleport.example.com                   A      10    Answer     100.68.51.151
+```
+</TabItem>
+</Tabs>
+
+The returned addresses should belong to ranges listed in the VNet diag report.
+
+Querying for anything other than an address of a TCP app should return the address belonging to the
+Proxy Service. Using macOS as an example:
+
+```code
+$ dscacheutil -q host -a name dashboard.teleport.example.com
+name: dashboard.teleport.example.com
+ipv6_address: 2606:2800:21f:cb07:6820:80da:af6b:8b2c
+
+name: dashboard.teleport.example.com
+ip_address: 93.184.215.14
+```
+
+Querying for any of those hostnames should result in some output being emitted in the debug logs of
+VNet (see [Submitting an issue](#submitting-an-issue) on how to enable debug logs).
+
+### Submitting an issue
+
+When [submitting an
+issue](https://github.com/gravitational/teleport/issues/new?assignees=&labels=bug,vnet&template=bug_report.md),
+make sure to include a VNet diag report and debug logs from VNet and Teleport Connect.
+
+To save a diag report to a file, open Teleport Connect. From the Connections panel in the top left
+select VNet, then "Open Diag Report". In the new tab with the report that was opened click the "Save
+Report to File" icon.
+
+To collect VNet and Teleport Connect logs use the instructions below:
+
+<Tabs>
+<TabItem label="macOS">
+To enable debug logs in VNet, first stop Teleport Connect and then run the following command. It
+enables debug logs just for the next invocation of VNet:
+
+```code
+$ sudo launchctl debug system/com.gravitational.teleport.tsh.vnetd --environment TELEPORT_DEBUG=1
+```
+
+Next, start capturing logs from VNet into a file:
+
+```code
+$ log stream --predicate 'subsystem ENDSWITH ".vnetd"' --style syslog --level debug > vnet.log
+```
+
+Then start Teleport Connect using the following command to enable debug logs for Teleport Connect:
+
+```code
+$ open -a "Teleport Connect" --args --connect-debug
+```
+
+Next, attempt to reproduce the issue with VNet.
+
+To gather logs from Teleport Connect, from the app menu select Help → Open Logs Directory which
+opens `~/Library/Application Support/Teleport Connect/logs` in Finder. Attach all files together
+with `vnet.log` produced in the earlier step.
+
+{/* TODO: DELETE IN 21.0.0 */}
+Before version 18.0.0, VNet logs were saved in `/var/log/vnet.log`.
+
+If the error is related to Teleport Connect not being able to start VNet or issues with code
+signing, searching through `/var/log/com.apple.xpc.launchd/launchd.log` for `tsh` soon after
+attempting to start VNet might also bring up relevant information:
+
+```code
+$ grep tsh /var/log/com.apple.xpc.launchd/launchd.log
+```
+</TabItem>
+<TabItem label="Windows">
+To enable debug logs in VNet, first stop Teleport Connect. Then in the Start menu look for Command
+Prompt and from the right click menu select Run as administrator. The following command enables
+debug logs in VNet and immediately closes the admin command prompt to prevent you from starting
+Teleport Connect as an admin by mistake.
+
+```code
+$ reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Services\TeleportVNet /v Environment /t REG_MULTI_SZ /d TELEPORT_DEBUG=1 /f && exit
+```
+
+Next, from the Start menu open the Run app. Execute the following to start Teleport Connect with
+debug logs enabled:
+
+```code
+$ "%PROGRAMFILES%\Teleport Connect\Teleport Connect.exe" --connect-debug
+```
+
+Next, attempt to reproduce the issue with VNet.
+
+Once that's done, execute the following command from the administrator Command Prompt to disable
+debug logs in VNet:
+
+```code
+$ reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\TeleportVNet /v Environment /f
+```
+
+The last step is collecting the logs. Let's start with the VNet logs. From the Start menu, open Event Viewer.
+From the sidebar on the left, select Event Viewer (Local) → Applications and Services Logs →
+Teleport. From the sidebar on the right, select "Save All Events As…". Save the logs as .evtx file.
+If Event Viewer asks about Display Information, choose "No display information".
+
+To gather logs from Teleport Connect, press `Alt` while in the app, then select Help → Open Logs
+Directory. This opens `C:\Users\%UserName%\AppData\Roaming\Teleport Connect\logs`. Attach all files
+together with the .evtx file from the previous step.
+
+Outside of submitting an issue, VNet logs can be quickly saved to a file with the following
+PowerShell command. However, when submitting an issue please attach the .evtx file instead.
+
+```code
+$ Get-WinEvent -LogName Teleport -FilterXPath "*[System[Provider[@Name='vnet']]]" -Oldest | Format-Table -Property TimeCreated,LevelDisplayName,Message -Wrap | Out-File vnet.log
+```
+
+{/* TODO: DELETE IN 21.0.0 */}
+Before version 18.0.0, VNet logs were saved in `C:\Program Files\Teleport Connect\resources\bin\logs.txt`.
+</TabItem>
+</Tabs>
+
+## Next steps
+
+- Read our VNet configuration [guide](../../enroll-resources/application-access/vnet.mdx)
+  to learn how to configure VNet access to your applications.
+- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
+- Read [RFD 207](https://github.com/gravitational/teleport/blob/master/rfd/0207-vnet-ssh.md) to learn how VNet SSH access works.
diff --git a/docs/pages/connect-your-client/web-ui.mdx b/docs/pages/connect-your-client/teleport-clients/web-ui.mdx
similarity index 78%
rename from docs/pages/connect-your-client/web-ui.mdx
rename to docs/pages/connect-your-client/teleport-clients/web-ui.mdx
index f122d81205f64..12c3899639bd2 100644
--- a/docs/pages/connect-your-client/web-ui.mdx
+++ b/docs/pages/connect-your-client/teleport-clients/web-ui.mdx
@@ -1,6 +1,11 @@
 ---
 title: Using the Web UI
+sidebar_label: Web UI
+sidebar_position: 2
 description: Using the Teleport Web UI
+tags:
+ - conceptual
+ - platform-wide
 ---
 The Teleport Web UI is a web-based visual interface from which you can access resources,
 view active sessions and recordings, create and review Access Requests,
@@ -22,11 +27,11 @@ From the active sessions list, click **Join** and select a participant mode to j
 - **As a Moderator** with permission to watch, pause, or terminate the session. You can view output and forcefully terminate
   or pause the session at any time, but can't send input. Moderated sessions are an enterprise-only feature.
 
-![joining an active session from the Web UI](../../img/webui-active-session.png)
+![joining an active session from the Web UI](../../../img/webui-active-session.png)
 
 You must have the `join_sessions` allow policy in a role you've been assigned to join sessions in any participant mode.
 For information about how to configure the `join_sessions` allow policy and participant modes for a role, see
-[Configure an allow policy](../admin-guides/access-controls/guides/joining-sessions.mdx).
+[Configure an allow policy](../../zero-trust-access/authentication/joining-sessions.mdx).
 
 ## Idle timeout
 
@@ -65,29 +70,29 @@ cluster networking configuration has been updated
 ## Starting a database session
 
 Starting from version `17.1`, users can establish database sessions using the
-Teleport Web UI. Currently, it is supported in PostgreSQL databases.
+Teleport Web UI. Support for database sessions in the Web UI was later expanded to include CockroachDB in `18.1.5` and MySQL/MariaDB databases in `18.2.0`.
 
 To start a new session, locate your database in the resources list and click
 "Connect".
 
-![Resources list](../../img/connect-your-client/webui-db-sessions/resources-list.png)
+![Resources list](../../../img/connect-your-client/webui-db-sessions/resources-list.png)
 
 For supported databases, the dialog will present the option to start
 the session in your browser.
 
-![Resources list database connect dialog](../../img/connect-your-client/webui-db-sessions/resources-connect-dialog.png)
+![Resources list database connect dialog](../../../img/connect-your-client/webui-db-sessions/resources-connect-dialog.png)
 
 After clicking on the "Connect in the browser" button, a new tab will open with
 a form. Teleport will pre-fill this form based on your permissions, but you can
 adjust the options as needed.
 
-![New database session connect dialog](../../img/connect-your-client/webui-db-sessions/connect-dialog.png)
+![New database session connect dialog](../../../img/connect-your-client/webui-db-sessions/connect-dialog.png)
 
 If your user has wildcard permissions (*), you can type custom values into the
 form fields. This allows flexibility in selecting specific databases or
 credentials.
 
-![New database session connect dialog with custom values](../../img/connect-your-client/webui-db-sessions/connect-dialog-custom.png)
+![New database session connect dialog with custom values](../../../img/connect-your-client/webui-db-sessions/connect-dialog-custom.png)
 
 Once you've filled in the session details, click the "Connect" button. Your
 session will start, and a terminal interface will appear in the browser.
@@ -96,17 +101,17 @@ The browser-based terminal allows you to execute queries and interact with your
 database. Follow the on-screen instructions to see available commands and
 limitations.
 
-![Database session terminal](../../img/connect-your-client/webui-db-sessions/session-terminal.png)
+![Database session terminal](../../../img/connect-your-client/webui-db-sessions/session-terminal.png)
 
 <Admonition type="note" title="Database CLI compatibility">
   While the terminal interface provided in the Teleport Web UI is designed to
   resemble popular database CLIs such as `psql`, it is a custom implementation
   with some differences and limitations:
-  - **Feature Set:** Not all features available in `psql` are implemented.
+  - **Feature Set:** Not all features available in popular CLI tools are implemented.
     For instance, scripting capabilities, query cancellation, or informational
-    commands like `\d` or `\dt` are currently unsupported.
+    commands like `\d` or `\dt` from `psql` are currently not supported.
   - **Error Handling:** Error messages and diagnostics might differ from what
-    users are accustomed to in `psql`.
+    users are accustomed to.
 
   These distinctions are designed to maintain a lightweight and secure interface
   directly in your browser. For more complex operations, you may prefer
diff --git a/docs/pages/connect-your-client/third-party/ansible.mdx b/docs/pages/connect-your-client/third-party/ansible.mdx
new file mode 100644
index 0000000000000..c17056a023c83
--- /dev/null
+++ b/docs/pages/connect-your-client/third-party/ansible.mdx
@@ -0,0 +1,173 @@
+---
+title: Ansible
+description: Using Teleport with Ansible
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+Ansible uses the OpenSSH client by default. Teleport supports SSH protocol and
+works as SSH jumphost.
+
+In this guide we will configure OpenSSH client to work with Teleport Proxy
+and run a sample ansible playbook.
+
+## How it works
+
+In the setup we describe in this guide, you generate an OpenSSH configuration
+that uses a Teleport-issued SSH certificate to connect to Teleport-protected
+servers. You then provide this OpenSSH configuration to your Ansible host, along
+with an inventory of Teleport-protected servers. Ansible then uses the OpenSSH
+configuration to present the Teleport-issued credentials in order to manage your
+servers.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- `ssh` openssh tool
+- `ansible` >= (=ansible.min_version=)
+- Optional tool `jq` to process `JSON` output.
+
+## Step 1/3. Login and configure SSH
+
+Log into Teleport with `tsh`:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" />
+```
+
+Generate `openssh` configuration using `tsh config` shortcut:
+
+```code
+$ tsh config > ssh.cfg
+```
+
+<Admonition type="tip">
+You can edit matching patterns used in `ssh.cfg` if something
+is not working out of the box.
+</Admonition>
+
+## Step 2/3. Configure Ansible
+
+Create a folder `ansible` where we will collect all generated files:
+
+```code
+$ mkdir -p ansible
+# Copy the openssh configuration from the previous step to the ansible dir
+$ cp ssh.cfg ansible/
+$ cd ansible
+```
+
+Create a file `ansible.cfg`:
+
+```
+[defaults]
+host_key_checking = True
+inventory=./hosts
+remote_tmp=/tmp
+
+[ssh_connection]
+scp_if_ssh = True
+ssh_args = -F ./ssh.cfg
+```
+
+You can create an inventory file `hosts` manually or use a script below to generate it from your environment. Set your
+cluster name (e.g. `teleport.example.com` or in the form `mytenant.teleport.sh` for Teleport Enterprise Cloud)
+and this script will generate the host names to match the `openssh` configuration:
+
+```code
+$ tsh ls --format=json | jq '.[].spec.hostname + ".<Var name="teleport.example.com" />"' > hosts
+```
+
+## Step 3/3. Run a playbook
+
+Finally, let's create a simple ansible playbook `playbook.yaml`.
+
+The playbook below runs `hostname` on all hosts. Make sure to set the `remote_user` parameter
+to a valid SSH username that works with the target host and is allowed by Teleport:
+
+```yaml
+- hosts: all
+  remote_user: ubuntu
+  tasks:
+    - name: "hostname"
+      command: "hostname"
+```
+
+From the folder `ansible`, run the ansible playbook:
+
+```code
+$ ansible-playbook playbook.yaml
+
+# PLAY [all] *****************************************************************************************************************************************
+# TASK [Gathering Facts] *****************************************************************************************************************************
+#
+# ok: [terminal]
+#
+# TASK [hostname] ************************************************************************************************************************************
+# changed: [terminal]
+#
+# PLAY RECAP *****************************************************************************************************************************************
+# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+You are all set. You are now using short-lived SSH certificates and Teleport can now record
+all ansible commands in the audit log.
+
+## Troubleshooting
+
+In cases where Ansible cannot connect, you may see an error like this:
+
+```txt
+example.host | UNREACHABLE! => {
+    "changed": false,
+    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname example.host: Name or service not known",
+    "unreachable": true
+}
+```
+
+You can examine and tweak patterns matching the inventory hosts in `ssh.cfg`.
+
+Try the SSH connection using `ssh.cfg` with verbose mode to inspect the error:
+
+```code
+$ ssh -vvv -F ./ssh.cfg root@example.host
+```
+
+If `ssh` works, try running the playbook with verbose mode on:
+
+```code
+$ ansible-playbook -vvvv playbook.yaml
+```
+
+If your hostnames contain uppercase characters (like `MYHOSTNAME`), please note that Teleport's internal hostname matching
+is case sensitive by default, which can also lead to seeing this error.
+
+If this is the case, you can work around this by requesting that your Teleport
+administrator enable case-insensitive routing at the cluster level. For admins,
+is possible to enable case-insensitive routing using the following instructions:
+
+<Tabs>
+<TabItem label="Self-hosted Teleport">
+
+Edit your `/etc/teleport.yaml` config file on all servers running the Teleport `auth_service`, then restart Teleport on each.
+
+```yaml
+auth_service:
+  case_insensitive_routing: true
+```
+
+</TabItem>
+<TabItem label="Managed Teleport Enterprise/Cloud">
+
+Run `tctl edit cluster_networking_config` to add the following specification, then save and exit.
+
+```yaml
+spec:
+  case_insensitive_routing: true
+```
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/connect-your-client/third-party/gui-clients.mdx b/docs/pages/connect-your-client/third-party/gui-clients.mdx
new file mode 100644
index 0000000000000..7d2583131ac13
--- /dev/null
+++ b/docs/pages/connect-your-client/third-party/gui-clients.mdx
@@ -0,0 +1,699 @@
+---
+title: Database GUI Clients
+description: How to configure graphical database clients for Teleport database access.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide describes how to configure popular graphical database clients to
+work with Teleport.
+
+If you are using Teleport Connect to access your database, you can follow the
+instructions in the app to connect your GUI client. See [Using Teleport
+Connect](../teleport-clients/teleport-connect.mdx#connecting-to-a-database).
+
+## Prerequisites
+
+- A running Teleport cluster. If you want to get started with Teleport, [sign
+  up](https://goteleport.com/signup) for a free trial or [set up a demo
+  environment](../../get-started/deploy-community.mdx).
+
+- The `tsh` client tool. Visit [Installation](../../installation/installation.mdx) for instructions on downloading
+  `tsh`. See the [Using Teleport Connect](../teleport-clients/teleport-connect.mdx) guide for a graphical desktop client
+  that includes `tsh`.
+
+- To check that you can connect to your Teleport cluster, sign in with `tsh login`. For example:
+
+  ```code
+  $ tsh login --proxy=teleport.example.com --user=myuser@example.com
+  ```
+
+- The Teleport Database Service configured to access a database. See one of our
+  [guides](../../enroll-resources/database-access/guides/guides.mdx) for how to set up the Teleport
+  Database Service for your database.
+
+## How GUI clients access Teleport-protected databases
+
+In a typical setup, clients accessing a database protected by Teleport send
+traffic to the Teleport Proxy Service in the database's native protocol, and the
+Proxy Service forwards the traffic to and from the protected database. End users
+use TLS certificates to authenticate with Teleport-protected databases. 
+
+GUI clients need to present a certificate to the Teleport Database Service and
+check the database server certificate issued by a Teleport-protected database.
+There are three ways to do this:
+
+- **Authenticated tunnel (recommended):** `tsh` or Teleport Connect starts a
+  local proxy. A database GUI client establishes an unauthenticated connection
+  with the local proxy. Before forwarding the connection to the
+  Teleport-protected database, the local proxy automatically secures the
+  connection with the Teleport user's client certificate.
+- **Unauthenticated local proxy:** `tsh` starts a local proxy that routes
+  connections to the Teleport-protected database, but the proxy itself doesn't
+  handle authentication. The user configures a database GUI client to provide
+  the user certificate, private key, and CA certificate at paths printed by
+  `tsh`. (Teleport Connect can start an authenticated tunnel but not an
+  unauthenticated local proxy.)
+- **Using a remote host and port:** For self-hosted clusters with TLS
+  multiplexing disabled on the Teleport Proxy Service, you can configure GUI
+  clients to communicate with a port on the Proxy Service reserved for traffic
+  in the protected database's protocol. We recommend TLS multiplexing for a
+  typical Teleport cluster, and it is enabled by default on Teleport Cloud.
+
+To access a Teleport-protected database with a GUI client, you will need to
+retrieve connection information to pass to your client.
+
+Determine the database to access by listing databases you can connect to:
+
+```code
+$ tsh db ls
+# Name
+# -------------------
+# database-name
+```
+
+Replace <Var name="database-name" /> with the name of the database you want to
+connect to.
+
+### Authenticated tunnel
+
+To start the local authenticated tunnel, run the following command, 
+
+```code
+$ tsh proxy db --tunnel <Var name="database-name" />
+Started authenticated tunnel for the <engine> database "<Var name="database-name" />" in cluster "<cluster-name>" on 127.0.0.1:62652.
+```
+
+Starting the local database proxy with the `--tunnel` flag will create an
+authenticated tunnel that you can use to connect to your database instances.
+
+You can optionally specify the database name and the user to use by default
+when connecting to the database:
+
+```code
+$ tsh proxy db --db-user=my-database-user --db-name=my-schema --tunnel <Var name="database-name" />
+```
+
+Now, you can connect to the address the proxy command returns. In our example it
+is `127.0.0.1:62652`.
+
+
+### Local proxy server
+
+Use the `tsh proxy db` command to start a local TLS proxy your GUI database
+client will be connecting to.
+
+Run a command similar to the following::
+
+```code
+$ tsh proxy db <Var name="database-name" />
+Started DB proxy on 127.0.0.1:61740
+
+Use following credentials to connect to the <Var name="database-name" /> proxy:
+  ca_file=/Users/r0mant/.tsh/keys/root.gravitational.io/certs.pem
+  cert_file=/Users/r0mant/.tsh/keys/root.gravitational.io/alice-db/root/<Var name="database-name" />-x509.pem
+  key_file=/Users/r0mant/.tsh/keys/root.gravitational.io/alice
+```
+
+Use the displayed local proxy host/port and credentials paths when configuring
+your GUI client below. When entering the hostname, use `localhost` rather than
+`127.0.0.1`.
+
+### Remote host and port
+
+If you are self-hosting Teleport and not using [TLS
+routing](../../zero-trust-access/deploy-a-cluster/tls-routing.mdx), run the
+following command to see the database connection information:
+
+```code
+# View configuration for the database you're logged in to.
+$ tsh db config
+# View configuration for the specific database when you're logged into multiple.
+$ tsh db config example
+```
+
+It will display the path to your locally cached certificate and key files:
+
+```
+Name:      example
+Host:      teleport.example.com
+Port:      3080
+User:      postgres
+Database:  postgres
+CA:        /Users/alice/.tsh/keys/teleport.example.com/certs.pem
+Cert:      /Users/alice/.tsh/keys/teleport.example.com/alice-db/root/example-x509.pem
+Key:       /Users/alice/.tsh/keys/teleport.example.com/alice
+```
+
+The displayed `CA`, `Cert`, and `Key` files are used to connect through pgAdmin
+4, MySQL Workbench, and other graphical database clients that support mutual
+TLS authentication.
+
+## MongoDB Compass
+
+[Compass](https://www.mongodb.com/products/compass) is the official MongoDB
+graphical client.
+
+On the "New Connection" panel, click on "Fill in connection fields individually".
+
+![MongoDB Compass new connection](../../../img/database-access/compass-new-connection@2x.png)
+
+On the "Hostname" tab, enter the hostname and port of the proxy you will use to
+access the database (see
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases)).
+Leave "Authentication" as None.
+
+![MongoDB Compass hostname](../../../img/database-access/compass-hostname@2x.png)
+
+On the "More Options" tab, set SSL to "Client and Server Validation" and set the
+CA as well as the client key and certificate. Note that a CA path must be
+provided and be able to validate the certificate presented by your Teleport
+Proxy Service's web endpoint.
+
+![MongoDB Compass more options](../../../img/database-access/compass-more-options@2x.png)
+
+The following fields in the More Options tab must correspond to paths printed by
+the `tsh proxy db` command you ran earlier:
+
+|Field|Path|
+|---|---|
+|Certificate Authority|`ca_file`|
+|Client Certificate|`cert_file`|
+|Client Private Key|`key_file`|
+
+Click on the "Connect" button.
+
+## MySQL DBeaver
+
+Right-click in the "Database Navigator" menu in the main view and select Create > Connection:
+
+![DBeaver Add Server](../../../img/database-access/dbeaver-add-server.png)
+
+In the search bar of the "Connect to a database" window that opens up, type "mysql", select the MySQL driver, and click "Next":
+
+![DBeaver Select Driver](../../../img/database-access/dbeaver-select-driver.png)
+
+In the newly-opened "Connection Settings" tab, use the Host as `localhost` and
+Port as the one returned by the proxy command (`62652` in the example above):
+
+![DBeaver Select Configure Server](../../../img/database-access/dbeaver-configure-server.png)
+
+In that same tab, set the username to match the one that you are connecting to
+using Teleport and uncheck the "Save password locally" box:
+
+![DBeaver Select Configure User](../../../img/database-access/dbeaver-configure-user.png)
+
+Click the "Edit Driver Settings" button on the "Main" tab, check the "No
+Authentication" box, and click "Ok" to save:
+
+![DBeaver Driver Settings](../../../img/database-access/dbeaver-driver-settings.png)
+
+Once you are back in the "Connection Settings" window, click "Ok" to finish and
+DBeaver should connect to the remote MySQL server automatically.
+
+## MySQL Workbench
+
+[MySQL Workbench](https://www.mysql.com/products/workbench/) is a GUI
+application that provides comprehensive MySQL administration and SQL development
+tools.
+
+In the MySQL Workbench "Setup New Connection" dialog, fill out "Connection
+Name", "Hostname", "Port", and "Username":
+
+![MySQL Workbench
+Parameters](../../../img/database-access/workbench-parameters@2x.png)
+
+In the "SSL" tab, set "Use SSL" to `Require and Verify Identity` and enter the
+paths to your CA, certificate, and private key files (see
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases)):
+
+![MySQL Workbench SSL](../../../img/database-access/workbench-ssl@2x.png)
+
+The following fields in the SSL tab must correspond to paths printed by the `tsh
+proxy db` command you ran earlier:
+
+|Field|Path|
+|---|---|
+|SSL Key File|`key_file`|
+|SSL CERT File|`cert_file`|
+|SSL CA File|`ca_file`|
+
+Optionally, click "Test Connection" to verify connectivity:
+
+![MySQL Workbench Test](../../../img/database-access/workbench-test@2x.png)
+
+Save the connection and connect to the database.
+
+## NoSQL Workbench
+
+From the NoSQL Workbench launch screen, click **Launch** next to **Amazon DynamoDB**.
+From the left-side menu select **Operation builder**, then **+ Add connection**.
+Choose the **DynamoDB local** tab, and point to your proxy's endpoint. This is
+`localhost:62652` in the example above. (See
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases) for
+more information.)
+
+![DynamoDB local connection in NoSQL Workbench](../../../img/database-access/nosql-workbench-connection.png)
+
+## SQL Server with Azure Data Studio
+
+In Azure Data Studio create a connection using your proxy's endpoint. This is
+`localhost,62652` in the example above. On a Windows machine, using an address in
+ the format `127.0.0.1,62652` could be required instead of `localhost`. (See
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases) for
+more information.)
+
+Create a connection with Microsoft SQL Server with these settings:
+
+|Connection Detail|Value|
+|---|---|
+|Server|`host`,`port` of proxy endpoint|
+|Authentication Type|SQL Login|
+|Password|empty|
+|Encrypt|`False`|
+
+Example:
+![Azure Data Studio connection options](../../../img/database-access/azure-data-studio-connection.png)
+
+Click **Connect** to connect.
+
+## PostgreSQL DBeaver
+
+To connect to your PostgreSQL instance, use the authenticated proxy address.
+This is `127.0.0.1:62652` in the example above (see the “Authenticated Proxy”
+section on [Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases)
+for more information).
+
+Use the "Database native" authentication with an empty password:
+
+![DBeaver Postgres Configure
+Server](../../../img/database-access/dbeaver-pg-configure-server.png)
+
+Clicking on "Test connection" should return a connection success message. Then,
+click on "Finish" to save the configuration.
+
+## PostgreSQL pgAdmin 4
+
+[pgAdmin 4](https://www.pgadmin.org/) is a popular graphical client for
+PostgreSQL servers.
+
+To configure a new connection, right-click on "Servers" in the main browser view
+and create a new server:
+
+![pgAdmin Add Server](../../../img/database-access/pgadmin-add-server@2x.png)
+
+In the "General" tab of the new server dialog, enter the server connection name:
+
+![pgAdmin General](../../../img/database-access/pgadmin-general@2x.png)
+
+In the "Connection" tab, fill in the hostname, port, user and database name from
+the configuration above:
+
+![pgAdmin Connection](../../../img/database-access/pgadmin-connection@2x.png)
+
+In the "SSL" tab, set "SSL Mode" to `Verify-Full` and fill in paths for client
+certificate, key and root certificate from the configuration above:
+
+![pgAdmin SSL](../../../img/database-access/pgadmin-ssl@2x.png)
+
+The following fields in the SSL tab must correspond to paths printed by the `tsh
+proxy db` command you ran earlier:
+
+|Field|Path|
+|---|---|
+|Client certificate|`cert_file`|
+|Client certificate key|`key_file`|
+|Root certificate|`ca_file`|
+
+Click "Save", and pgAdmin should immediately connect. If pgAdmin prompts you
+for password, leave the password field empty and click OK.
+
+## Microsoft SQL Server Management Studio
+
+In Microsoft SQL Server Management Studio connect to a database engine using
+your proxy's endpoint. This is `localhost,62652` in the example above. Using
+the IP `127.0.0.1,62652` connection could be required on a Windows machine
+instead of `localhost`. (See [Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases) for
+more information.)
+
+Create a connection with Microsoft SQL Server with these settings:
+
+|Connection Detail|Value|
+|---|---|
+|Server type|Database Engine|
+|Server name|`host`,`port` of proxy endpoint|
+|Authentication|SQL Server Authentication|
+|Password|empty|
+|Encryption|do not enable|
+
+Example:
+![Microsoft SQL Server Management Studio connection options](../../../img/database-access/msft-sql-server-management-studio-connection.png)
+  
+Click Connect to connect.
+
+## Redis Insight
+
+<Admonition type="note">
+  Teleport's Redis Insight integration only supports Redis standalone instances.
+</Admonition>
+
+After opening Redis Insight click `ADD REDIS DATABASE`.
+
+![Redis Insight Startup Screen](../../../img/database-access/guides/redis/redisinsight-startup.png)
+
+Now start a local proxy to your Redis instance:
+
+`tsh proxy db --db-user=alice redis-db-name`.
+
+Click `Add Database Manually`. Use `127.0.0.1` as the `Host`. Use the port printed by
+the `tsh` command you ran in [Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases).
+
+Provide your Redis username as `Username` and password as `Password`.
+
+![Redis Insight Configuration](../../../img/database-access/guides/redis/redisinsight-add-config.png)
+
+Next, check the `Use TLS` and `Verify TLS Certificates` boxes. Copy the contents
+of the files at the paths returned by the `tsh proxy db` command you ran earlier
+and paste them into their corresponding fields. See the table below for the
+Redis Insight fields that correspond to each path:
+
+|Field|Path|
+|---|---|
+|CA Certificate|`ca_file`|
+|Client Certificate|`cert_file`|
+|Private Key|`key_file`|
+
+Click `Add Redis Database`.
+
+![Redis Insight TLS Configuration](../../../img/database-access/guides/redis/redisinsight-tls-config.png)
+
+Congratulations! You have just connected to your Redis instance.
+
+![Redis Insight Connected](../../../img/database-access/guides/redis/redisinsight-connected.png)
+
+## Snowflake: DBeaver
+
+The Snowflake integration works only in the authenticated proxy mode. Start a local proxy for connections to your Snowflake database by using the command below:
+```
+tsh proxy db --tunnel --port 2000 snowflake
+```
+
+Add a new database by clicking the "add" icon in the top-left corner:
+
+![DBeaver Main Screen](../../../img/database-access/guides/snowflake/dbeaver-main-screen.png)
+
+In the search bar of the "Connect to a database" window that opens up, type "snowflake", select the Snowflake driver, and click "Next":
+
+![DBeaver Select Database](../../../img/database-access/guides/snowflake/dbeaver-select-database.png)
+
+Set "Host" to `localhost` and "Port" to the port returned by the `tsh proxy db` command you ran earlier (`2000` in the example above).
+In the "Authentication" section set the "Username" to match the database username passed to Teleport with `--db-user`
+and enter any value (e.g., "teleport") in the "Password" field (the value of
+ "Password" will be ignored when establishing a connection but is required by DBeaver to register your database):
+
+![DBeaver Main](../../../img/database-access/guides/snowflake/dbeaver-main.png)
+
+Next, click the "Driver properties" tab and set "account" to any value (e.g., "teleport"; as with "Password", the value of
+ "account" will be ignored when establishing a connection but is required by DBeaver to register your database). In "User properties", set "ssl" to `off`:
+
+![DBeaver Driver](../../../img/database-access/guides/snowflake/dbeaver-driver.png)
+
+Teleport ignores the provided password and the account name as internally it uses values from the Database Agent configuration.
+SSL set to `off` disables only encryption on local machine. Connection to Snowflake is encrypted by Teleport.
+
+Now you can click on "Test Connection..." in the bottom-left corner:
+
+![DBeaver Success](../../../img/database-access/guides/snowflake/dbeaver-success.png)
+
+Congratulations! You have just connected to your Snowflake instance.
+
+## Snowflake: JetBrains (IntelliJ, Goland, DataGrip, PyCharm, etc.)
+
+The Snowflake integration works only in the authenticated proxy mode. Start a local proxy for connections to your Snowflake database by using the command below:
+```
+tsh proxy db --tunnel --port 2000 snowflake
+```
+
+In "Database Explorer" click the "add" button, pick "Data Source", and then pick "Snowflake":
+
+![JetBrains Add Database](../../../img/database-access/guides/snowflake/jetbrains-add-database.png)
+
+Next, set "Host" to `localhost` and "Port" to the port returned by the `tsh proxy db` command you ran earlier (`2000` in the example above).
+Set the "Username" to match the one that you are assuming when you connect to Snowflake
+ via Teleport and enter any value (e.g., "teleport") in the "Password" field (the value of
+ "Password" will be ignored but is required to create a data source in your IDE):
+
+![JetBrains General](../../../img/database-access/guides/snowflake/jetbrains-general.png)
+
+Switch to the "Advanced" tab, set any value (e.g., "teleport") for "account", and add a new record named `ssl` with value `off` (as with "Password", "account" is ignored while establishing the connection but required by your IDE):
+
+![JetBrains Advanced](../../../img/database-access/guides/snowflake/jetbrains-advanced.png)
+
+Teleport ignores the provided password and the account name as internally it uses values from the Database Agent configuration.
+Setting "SSL" to `off` only disables encryption on your local machine. The connection to Snowflake is encrypted by Teleport.
+
+Now you can click "Test Connection" to check your configuration.
+
+![JetBrains Success](../../../img/database-access/guides/snowflake/jetbrains-success.png)
+
+Congratulations! You have just connected to your Snowflake instance.
+
+## SQL Server DataGrip
+
+In the DataGrip connection configuration menu, use your proxy's endpoint. This
+is `localhost:4242` in the example below. (See
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases) for
+more information.)
+
+Select the "User & Password" authentication option and keep the "Password" field
+empty:
+
+![DataGrip connection options](../../../img/database-access/guides/sqlserver/datagrip-connection@2x.png)
+
+Click "OK" to connect.
+
+## SQL Server DBeaver
+
+In the DBeaver connection configuration menu, use your proxy's endpoint. This is
+`localhost:62652` in the example above. (See
+[Get connection information](./gui-clients.mdx#how-gui-clients-access-teleport-protected-databases) for
+more information.)
+
+Use the SQL Server Authentication option and keep the Password field empty:
+
+![DBeaver connection options](../../../img/database-access/guides/sqlserver/dbeaver-connection@2x.png)
+
+Click OK to connect.
+
+## Cloud Spanner DataGrip
+
+(!docs/pages/includes/database-access/gui-clients/spanner-local-proxy.mdx!)
+
+From the DataGrip menu, click "File > New > Data Source from URL", then copy and
+paste the JDBC URL that was output by `tsh proxy db`:
+
+![Create DataGrip Spanner Data Source From JDBC URL](../../../img/database-access/spanner-gui/datagrip-data-source-from-jdbc-url@2x.png)
+
+The "Google Cloud Spanner" driver should be automatically selected.
+Click "Ok".
+
+DataGrip does not need GCP credentials - those are already provided by Teleport.
+On the "General" tab of the new data source, select the "Authentication"
+dropdown setting and choose "No auth":
+
+![Choose No Auth For DataGrip Spanner Data Source](../../../img/database-access/spanner-gui/datagrip-choose-no-auth@2x.png)
+
+Click "Test connection" to ensure the connection is configured correctly, then
+click "Ok" to create the data source.
+
+(!docs/pages/includes/database-access/gui-clients/spanner-reuse-port-note.mdx!)
+
+## Cloud Spanner DBeaver
+
+(!docs/pages/includes/database-access/gui-clients/spanner-local-proxy.mdx!)
+
+From the menu, click "Database > Driver Manager":
+
+![Open DBeaver Driver Manager](../../../img/database-access/spanner-gui/dbeaver-open-driver-manager@2x.png)
+
+Search for the "Google Cloud Spanner" driver, select it, and click the "Copy"
+button to make a custom driver configuration:
+
+![Copy DBeaver Google Spanner Driver](../../../img/database-access/spanner-gui/dbeaver-copy-spanner-driver@2x.png)
+
+Give the custom driver a name, e.g. "Teleport Spanner", then set "URL Template"
+to this pattern string:
+
+```code
+jdbc:cloudspanner://127.0.0.1:{port}/projects/{server}/instances/{host}/databases/{database};usePlainText=true
+```
+
+![Create Custom DBeaver Google Spanner Driver](../../../img/database-access/spanner-gui/dbeaver-create-spanner-driver@2x.png)
+
+Click "Ok", then click "Close"
+
+From the menu, click "Database > New Connection from JDBC URL":
+
+Now copy the JDBC URL that was output by `tsh proxy db` and paste it:
+
+![Create DBeaver Spanner Connection From JDBC URL](../../../img/database-access/spanner-gui/dbeaver-connection-from-jdbc-url@2x.png)
+
+Click "Proceed", then click "Finish".
+
+(!docs/pages/includes/database-access/gui-clients/spanner-reuse-port-note.mdx!)
+
+## Oracle graphical clients
+
+The Oracle integration works only in the authenticated proxy mode. Start a local proxy for connections to your Oracle database by using the command below:
+
+```
+> tsh proxy db --tunnel --port 11555 --db-user=<user> --db-name=<db-name> oracle
+
+Started authenticated tunnel for the Oracle database "oracle" in cluster "teleport.example.com" on 127.0.0.1:11555.
+```
+
+<Admonition type="tip">
+The command above uses the local port 11555, but you can choose any available port. Leaving `--port` empty will cause `tsh` to pick a random one.
+</Admonition>
+
+The local proxy supports TCP and TCPS modes. Different clients prefer different modes.
+
+TCP:
+- requires no username or password
+- generally easier to configure
+
+TCPS:
+- requires no username or password
+- depends on automatically created wallet
+- uses JDBC URL for configuration
+
+<Admonition type="warning">
+Teleport versions earlier than 17.2.0 support only a limited range of clients and only offer TCPS mode. `tsh` will automatically detect this situation and warn the user. We recommend updating to the latest version of Teleport to access full client support and additional connection options.
+</Admonition>
+
+### Oracle SQL Developer (standalone)
+
+In "Connections" click the "+" button for a new database connection:
+
+![Oracle SQL Developer Add Database Connection](../../../img/database-access/guides/oracle/sql-developer-standalone-add-database.png)
+
+Next, set the name and username from the `--db-user` parameter. Set connection type to "Custom JDBC" and 
+set the "Custom JDBC URL" from the `tsh proxy db` command.
+
+![Oracle SQL Developer](../../../img/database-access/guides/oracle/sql-developer-standalone-conn-details-tcps.png)
+
+Now you can click "Test" to check your configuration.
+
+![Oracle SQL Developer Success](../../../img/database-access/guides/oracle/sql-developer-standalone-success.png)
+
+### Oracle SQL Developer (VS Code extension)
+
+Install the extension from [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Oracle.sql-developer).
+
+Both TCP and TCPS modes can be used.
+
+<Tabs>
+<TabItem label="TCP">
+
+Open the extension toolbar and click on "Create Connection" button.
+
+![SQL Developer (VS Code) Start](../../../img/database-access/guides/oracle/sql-developer-vscode-start@2x.png)
+
+Enter the following connection details:
+
+| Field           | Value                  |
+|-----------------|------------------------|
+| Connection name | Choose unique name     |
+| User name       | `/`                    |
+| Password        | `/`                    |
+| Save Password   | Mark checkbox          |
+| Connection type | Basic                  |
+| Host name       | `localhost`            |
+| Port number     | `--port` flag value    |
+| Type            | Service Name           |
+| Service name    | `--db-name` flag value |
+
+Test and create the connection.
+
+![SQL Developer (VS Code) Connection Details (basic)](../../../img/database-access/guides/oracle/sql-developer-vscode-conn-details-basic@2x.png)
+
+The new connection should appear on the list.
+
+![SQL Developer (VS Code) Connected (basic)](../../../img/database-access/guides/oracle/sql-developer-vscode-connected-basic@2x.png)
+
+</TabItem>
+
+<TabItem label="TCPS">
+
+Open the extension toolbar and click on "Create Connection" button.
+
+![SQL Developer (VS Code) Start](../../../img/database-access/guides/oracle/sql-developer-vscode-start@2x.png)
+
+Enter the following connection details:
+
+| Field            | Value                           |
+|------------------|---------------------------------|
+| Connection name  | (choose per your preference)    |
+| User name        | `/`                             |
+| Password         | `/`                             |
+| Save Password    | Mark the checkbox               |
+| Connection type  | "Custom JDBC"                   |
+| Custom JDBC URL  | Copy from `tsh proxy db` output |
+
+Test and create the connection.
+
+![SQL Developer (VS Code) Connection Details (JDBC)](../../../img/database-access/guides/oracle/sql-developer-vscode-conn-details-jdbc@2x.png)
+
+The new connection should appear on the list.
+
+![SQL Developer (VS Code) Connected (JDBC)](../../../img/database-access/guides/oracle/sql-developer-vscode-connected-jdbc@2x.png)
+
+
+</TabItem>
+</Tabs>
+
+### Toad
+
+Add new login record in the logins dialog.
+
+![Toad Add Login Record](../../../img/database-access/guides/oracle/toad-add-login-record@2x.png)
+
+Enter the connection details in "Direct" tab:
+
+| Field           | Value                        |
+|-----------------|------------------------------|
+| Host name       | `127.0.0.1`                  |
+| Port number     | `--port` flag value          |
+| Service name    | `--db-name` flag value       |
+| User name       | `EXTERNAL`                   |
+| Password        | (leave empty)                |
+| Connection name | (choose per your preference) |
+
+Test the connection to verify the setup.
+
+![Toad Add Login Tested](../../../img/database-access/guides/oracle/toad-add-login-tested@2x.png)
+
+The newly added login should appear on the login list.
+
+![Toad Login List](../../../img/database-access/guides/oracle/toad-login-list@2x.png)
+
+<Admonition type="tip">
+You can also configure Toad to use an external Oracle client. Both native and external clients are supported.
+</Admonition>
+
+### DBeaver
+
+Click on the "New Database Connection" button.
+
+![DBeaver new connection button](../../../img/database-access/guides/oracle/dbeaver-new-connection@2x.png)
+
+Select "Oracle" from the driver list. You may use the search toolbar to narrow down the list.
+![DBeaver connect to a database](../../../img/database-access/guides/oracle/dbeaver-connect-to-a-database@2x.png)
+
+Choose "Custom" connection type and paste the JDBC connection string printed by `tsh proxy db`.
+![DBeaver JDBC details](../../../img/database-access/guides/oracle/dbeaver-jdbc-details@2x.png)
+
+Test the connection to verify the setup. Finalize by clicking "Finish".
+
diff --git a/docs/pages/enroll-resources/server-access/guides/jetbrains-sftp.mdx b/docs/pages/connect-your-client/third-party/jetbrains-sftp.mdx
similarity index 77%
rename from docs/pages/enroll-resources/server-access/guides/jetbrains-sftp.mdx
rename to docs/pages/connect-your-client/third-party/jetbrains-sftp.mdx
index 922ed0b06c3de..507fef80cbd0b 100644
--- a/docs/pages/enroll-resources/server-access/guides/jetbrains-sftp.mdx
+++ b/docs/pages/connect-your-client/third-party/jetbrains-sftp.mdx
@@ -1,7 +1,10 @@
 ---
 title: JetBrains SFTP
 description: How to use a JetBrains IDE to manipulate files on a remote host with Teleport
-h1: SFTP with JetBrains IDE
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 JetBrain's IDEs, like PyCharm, GoLand, and IntelliJ, allow browsing, copying, and editing files on a remote server
@@ -10,13 +13,20 @@ machine without using a third-party client.
 
 This guide explains how to use Teleport and a JetBrains IDE to access files with SFTP.
 
+## How it works
+
+JetBrains IDEs can use the local SSH client to access a remote server. You can
+use Teleport to generate a configuration for your local SSH client that
+instructs the client to connect to a Teleport-protected Linux server using a
+Teleport-issued OpenSSH certificate. 
+
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs-not-admin.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx clients="\`tsh\` client"!)
 
 - JetBrains IDE like PyCharm, IntelliJ, GoLand etc. See [Products](https://www.jetbrains.com/products/#type=ide) for a full list of JetBrains IDEs.
 - One or more Teleport SSH Service instances. If you have not yet done this,
-  read the [getting started guide](../getting-started.mdx) to
+  read the [getting started guide](../../enroll-resources/server-access/getting-started.mdx) to
   learn how.
 
 ## Step 1/3. First-time setup
@@ -67,7 +77,7 @@ $ ssh user@[server name].[cluster name]
 
 <Admonition type="note">
   Include the port number for OpenSSH servers, by default `22`, or you can experience an error.
-  See the [OpenSSH guide](../openssh/openssh.mdx) for more information.
+  See the [OpenSSH guide](../../enroll-resources/server-access/openssh/openssh.mdx) for more information.
   Example connecting to a OpenSSH server:
 
   ```code
@@ -79,19 +89,19 @@ $ ssh user@[server name].[cluster name]
 
 After opening your IDE go to `Tools` -> `Deployment` -> `Browse Remote Host`.
 
-![Deployment](../../../../img/jetbrains-sftp/deployment-main.png)
+![Deployment](../../../img/jetbrains-sftp/deployment-main.png)
 
 Then click the plus sign in the top-left corner to add a new server.
 
-![Add server](../../../../img/jetbrains-sftp/add-server.png)
+![Add server](../../../img/jetbrains-sftp/add-server.png)
 
 Enter a name for your new server.
 
-![New Deployment](../../../../img/jetbrains-sftp/deployment-added.png)
+![New Deployment](../../../img/jetbrains-sftp/deployment-added.png)
 
 Click the three dots next to `SSH configuration` as in the picture above.
 
-![SSH Configuration](../../../../img/jetbrains-sftp/ssh-configurations.png)
+![SSH Configuration](../../../img/jetbrains-sftp/ssh-configurations.png)
 
 Create a new configuration by clicking the plus sign on the top left and providing:
 
@@ -102,13 +112,13 @@ Create a new configuration by clicking the plus sign on the top left and providi
 As an `Authentication type` pick `OpenSSH config and authentication agent`.
 Next, you can click `Test Connection`.
 
-![Successfully Connected](../../../../img/jetbrains-sftp/successfully-connected.png)
+![Successfully Connected](../../../img/jetbrains-sftp/successfully-connected.png)
 
 ## Step 3/3. Browse a remote host
 
 After closing the SSH configuration window, you should see `Remote Host` menu in your IDE.
 
-![Browse window](../../../../img/jetbrains-sftp/browse-window.png)
+![Browse window](../../../img/jetbrains-sftp/browse-window.png)
 
 <Admonition type="note">
   Teleport's certificates expire fairly quickly, after which SSH
@@ -129,7 +139,7 @@ After closing the SSH configuration window, you should see `Remote Host` menu in
 ### Using OpenSSH clients
 
 This guide makes use of `tsh config`; refer to the
-[dedicated guide](../openssh/openssh.mdx) for additional information.
+[dedicated guide](../../enroll-resources/server-access/openssh/openssh.mdx) for additional information.
 
 ## Further reading
 - [JetBrains - Create a remote server configuration](https://www.jetbrains.com/help/idea/creating-a-remote-server-configuration.html#overload)
diff --git a/docs/pages/connect-your-client/putty-winscp.mdx b/docs/pages/connect-your-client/third-party/putty-winscp.mdx
similarity index 93%
rename from docs/pages/connect-your-client/putty-winscp.mdx
rename to docs/pages/connect-your-client/third-party/putty-winscp.mdx
index c5621639181ab..dffcf04a72644 100644
--- a/docs/pages/connect-your-client/putty-winscp.mdx
+++ b/docs/pages/connect-your-client/third-party/putty-winscp.mdx
@@ -1,10 +1,16 @@
 ---
 title: Using PuTTY and WinSCP with Teleport
+sidebar_label: PuTTY and WinSCP
 description: This reference shows you how to use PuTTY to connect to SSH nodes and WinSCP to transfer files through Teleport
+tags:
+ - conceptual
+ - platform-wide
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide will show you how to use the Teleport client tool `tsh` to add saved sessions for use
-with [PuTTY](https://www.putty.org/), and then how to use PuTTY as a client to connect to SSH nodes.
+with [PuTTY](https://putty.software/), and then how to use PuTTY as a client to connect to SSH nodes.
 
 It will also show you how to optionally use these saved sessions with [WinSCP](https://winscp.net) to transfer
 files from SSH nodes using SFTP.
@@ -19,7 +25,8 @@ You will learn how to:
 
 - A client machine running Windows 10 or higher. You can only use `tsh` to save PuTTY sessions on Windows.
 
-- The Teleport `tsh.exe` client, version 14.0.3 or higher. To download the `tsh.exe` client, run the following command:
+- The Teleport `tsh.exe` client. To download the `tsh.exe` client, run the
+  following command:
 
   ```code
   $ curl.exe -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
@@ -79,7 +86,7 @@ Added PuTTY session for ubuntu@ip-172-31-30-140 [proxy:teleport.example.com]
 If you don't provide a login to this command, your local Windows username is used instead.
 
 If you are adding a session for a registered OpenSSH node within your cluster (added with
-[`teleport join openssh`](../enroll-resources/server-access/openssh/openssh-agentless.mdx)), you must specify the `sshd` port
+[`teleport join openssh`](../../enroll-resources/server-access/openssh/openssh-agentless.mdx)), you must specify the `sshd` port
 (usually 22) when adding a session with `tsh puttyconfig`:
 
 ```code
@@ -131,11 +138,11 @@ If you don't provide a login to this command, your local Windows username is use
 
 1. Start PuTTY to see the saved sessions available for your cluster.
 
-![Main PuTTY window](../../img/connect-your-client/putty-window.png)
+![Main PuTTY window](../../../img/connect-your-client/putty-window.png)
 
 2. Double-click a session to connect to the host through Teleport.
 
-![PuTTY console](../../img/connect-your-client/putty-console.png)
+![PuTTY console](../../../img/connect-your-client/putty-console.png)
 
 After you connect to the host, Teleport generates an audit log entry for the session's start,
 and appears in the list of "Active Sessions" within Teleport.
@@ -188,18 +195,18 @@ transfer files to and from it.
 If you don't see the Site Manager "Login" dialog appear with a list of sessions to connect to when WinSCP starts,
 click the **Tabs** menu, choose **Sites**, then **Site Manager...** to show it.
 
-![WinSCP Site Manager window](../../img/connect-your-client/winscp-1.png)
+![WinSCP Site Manager window](../../../img/connect-your-client/winscp-1.png)
 
 2. Click the **Tools** button at the bottom left, and choose **Import Sites**.
 
-![Click 'Tools', then choose 'Import Sites...'](../../img/connect-your-client/winscp-2.png)
+![Click 'Tools', then choose 'Import Sites...'](../../../img/connect-your-client/winscp-2.png)
 
 3. Check the box next to any saved PuTTY sessions that you wish to import into WinSCP for use, then click the "OK" button.
 
 If you don't see sessions matching the hosts that you want to connect to, close this box and run `tsh puttyconfig <user>@<host>`
 from a terminal [as described above](#summary) to add the sessions, then repeat this step.
 
-![Choose PuTTY sessions to import and click OK](../../img/connect-your-client/winscp-3.png)
+![Choose PuTTY sessions to import and click OK](../../../img/connect-your-client/winscp-3.png)
 
 4. To tell WinSCP it should trust and load saved Host CAs from PuTTY, click **Tools** again at the bottom left,
 then choose **Preferences...**
@@ -208,17 +215,17 @@ then choose **Preferences...**
   You can skip steps 4 and 5 if you've completed the process as this user on this PC before.
 </Admonition>
 
-![Click 'Tools', then choose 'Preferences...'](../../img/connect-your-client/winscp-4.png)
+![Click 'Tools', then choose 'Preferences...'](../../../img/connect-your-client/winscp-4.png)
 
 5. Click the **Security** section at the left, then check the **Load authorities from PuTTY** checkbox under
 the *Trusted host certification authorities* section and click **OK** to exit.
 
-![Click 'Security', Check 'Load authorities from PuTTY' then click OK](../../img/connect-your-client/winscp-5.png)
+![Click 'Security', Check 'Load authorities from PuTTY' then click OK](../../../img/connect-your-client/winscp-5.png)
 
 6. Choose the host to connect to from the list at the left-hand side and click **Login**. You can also start the session
 by double clicking on its name if you like.
 
-![Choose the host from the list and click Login](../../img/connect-your-client/winscp-6.png)
+![Choose the host from the list and click Login](../../../img/connect-your-client/winscp-6.png)
 
 Uploading or downloading files using WinSCP through Teleport will generate audit events.
 
@@ -269,7 +276,7 @@ Yes, WinSCP version 6.2 and higher support validation using SSH host certificate
 
 No, PuTTY calls `tsh proxy ssh` which uses the default authentication method configured for the Teleport cluster.
 
-For more information about Teleport authentication, see [Authentication options](../reference/access-controls/authentication.mdx).
+For more information about Teleport authentication, see [Authentication options](../../reference/access-controls/authentication.mdx).
 
 Advanced users can use the Registry Editor to modify the PuTTY proxy command themselves under the `ProxyTelnetCommand`
 key. Note that if you re-run `tsh puttyconfig` for the given hostname, this command is overwritten.
@@ -359,9 +366,9 @@ If this error appears during normal day-to-day operation, this is a bug and shou
 ## Uninstalling tsh
 
 To remove `tsh` and associated user data see
-[Uninstalling Teleport](../admin-guides/management/admin/uninstall-teleport.mdx).
+[Uninstalling Teleport](../../installation/uninstall-teleport.mdx).
 
 ## Further reading
-- [CLI Reference](../reference/cli/tsh.mdx#tsh-puttyconfig).
+- [CLI Reference](../../reference/cli/tsh.mdx#tsh-puttyconfig).
 
 
diff --git a/docs/pages/connect-your-client/third-party/third-party.mdx b/docs/pages/connect-your-client/third-party/third-party.mdx
new file mode 100644
index 0000000000000..0bd569fc0fd3e
--- /dev/null
+++ b/docs/pages/connect-your-client/third-party/third-party.mdx
@@ -0,0 +1,12 @@
+---
+title: Connect Third-Party Clients with Teleport
+sidebar_label: Third-Party Tooling
+description: Explains how to use the third-party client tools you are already familiar with to access infrastructure protected by Teleport.
+---
+
+Teleport works with the tooling that you already use to access infrastructure.
+The guides in this section show you how to use Teleport-issued credentials to
+access protected resources with third-party clients, including:
+
+<DocCardList kind="labelOnly" />
+
diff --git a/docs/pages/enroll-resources/server-access/guides/vscode.mdx b/docs/pages/connect-your-client/third-party/vscode.mdx
similarity index 81%
rename from docs/pages/enroll-resources/server-access/guides/vscode.mdx
rename to docs/pages/connect-your-client/third-party/vscode.mdx
index 50a8ad43a4e3d..46fc0e60c9351 100644
--- a/docs/pages/enroll-resources/server-access/guides/vscode.mdx
+++ b/docs/pages/connect-your-client/third-party/vscode.mdx
@@ -1,21 +1,31 @@
 ---
 title: Visual Studio Code
 description: How to use Visual Studio Code's Remote Development plugin with Teleport
-h1: Remote Development With Visual Studio Code
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide explains how to use Teleport and Visual Studio Code's remote SSH extension.
 
+## How it works
+
+The Visual Studio Code Remote - SSH extension uses the local SSH client to
+access a remote server. You can use Teleport to generate a configuration for
+your local SSH client that instructs the client to connect to a
+Teleport-protected Linux server using a Teleport-issued OpenSSH certificate. 
+
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs-not-admin.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx clients="\`tsh\` client"!)
 
 - OpenSSH client.
 - Visual Studio Code with the [Remote - SSH extension](https://code.visualstudio.com/docs/remote/ssh#_system-requirements)
   for the Remote - SSH extension.
 - One or more Teleport Agents running the Teleport SSH Service. If you have not yet
   done this, read the
-  [getting started guide](../getting-started.mdx) to learn how.
+  [getting started guide](../../enroll-resources/server-access/getting-started.mdx) to learn how.
 
 <Admonition type="note">
 Linux and macOS clients should rely on their operating system-provided OpenSSH
@@ -92,13 +102,13 @@ When you see this error, re-run `tsh login` to refresh your local certificate.
 Install the [Remote - SSH extension][remote-ssh] in your local VS Code instance.
 A new "Window Indicator" (icon with two arrows) should appear in the bottom left of your VS Code window.
 
-![Window Indicator in bottom left corner of VS Code](../../../../img/vscode/window-indicator.png)
+![Window Indicator in bottom left corner of VS Code](../../../img/vscode/window-indicator.png)
 
 Prior to connecting with a host, set the `Remote.SSH: Use Local Server` setting
 to false in the extension setting. You can search for
 `@ext:ms-vscode-remote.remote-ssh ` to find the plugin-specific settings.
 
-![Remote SSH Extension VS Code Settings](../../../../img/vscode/settings.png)
+![Remote SSH Extension VS Code Settings](../../../img/vscode/settings.png)
 
 To connect, click on the icon with two arrows and select "Connect to Host...".
 Select "+ Add New SSH Host..."
@@ -109,7 +119,7 @@ For each host you wish to remotely develop on, add an entry like the following:
 alice@node000.foo.example.com
 ```
 
-![Input box to add new Node](../../../../img/vscode/add-host.png)
+![Input box to add new Node](../../../img/vscode/add-host.png)
 
 When prompted to choose which SSH Configuration file to update select the one we generated during Step 1.
 
@@ -121,18 +131,18 @@ Start a Remote Development session by either:
 
 1. Clicking "Connect" on the notification that opens after adding a new host.
 
-![Notification of "Host added" that has connect button](../../../../img/vscode/host-added-notification.png)
+![Notification of "Host added" that has connect button](../../../img/vscode/host-added-notification.png)
 
 2. Clicking on the Window Indicator again and selecting "Connect to Host".
 You should see the host you just added and any others in your Configuration file in the drop down.
 
-![Connecting to a Teleport host in VS Code](../../../../img/vscode/select-host-to-connect.png)
+![Connecting to a Teleport host in VS Code](../../../img/vscode/select-host-to-connect.png)
 
 On first connect, you'll be prompted to configure the remote OS. Select the
 proper platform and VS Code will install its server-side component. When it
 completes, you should be left with a working editor:
 
-![VS Code connected to a Teleport Node](../../../../img/vscode/connected-editor.png)
+![VS Code connected to a Teleport Node](../../../img/vscode/connected-editor.png)
 
 The Window Indicator in the bottom left highlights the currently connected remote host.
 
@@ -142,14 +152,14 @@ The Window Indicator in the bottom left highlights the currently connected remot
 
 It's possible to remotely develop on any OpenSSH host joined to a Teleport
 cluster so long as its host OS is supported by VS Code. Refer to the
-[OpenSSH guide](../openssh/openssh.mdx) to configure the remote host to authenticate via
+[OpenSSH guide](../../enroll-resources/server-access/openssh/openssh.mdx) to configure the remote host to authenticate via
 Teleport certificates, after which the procedure outlined above can be used to
 connect to the host in VS Code.
 
 ### Using OpenSSH clients
 
 This guide makes use of `tsh config`; refer to the
-[dedicated guide](../openssh/openssh.mdx) for additional information.
+[dedicated guide](../../enroll-resources/server-access/openssh/openssh.mdx) for additional information.
 
 ## Further reading
 - [VS Code Remote Development](https://code.visualstudio.com/docs/remote/remote-overview)
diff --git a/docs/pages/connect-your-client/tsh.mdx b/docs/pages/connect-your-client/tsh.mdx
deleted file mode 100644
index 54035be7f35c6..0000000000000
--- a/docs/pages/connect-your-client/tsh.mdx
+++ /dev/null
@@ -1,1167 +0,0 @@
----
-title: Using the tsh Command Line Tool
-description: This reference shows you how to use Teleport's tsh tool to authenticate to a cluster, explore your infrastructure, and connect to a resource.
----
-
-This guide will show you how to use the Teleport client tool, `tsh`.
-
-You will learn how to:
-
-- Log in to an interactive shell on remote cluster nodes.
-- Copy files to and from cluster nodes.
-- Connect to SSH clusters behind firewalls without any open ports using SSH
-  reverse tunnels.
-- Explore a cluster and execute commands on specific nodes in the cluster.
-- Share interactive shell sessions with colleagues or join someone else's session.
-- List and replay recorded interactive sessions.
-
-In addition to this document, you can always simply type `tsh` into your
-terminal for the CLI reference.
-
-## Introduction
-
-For the impatient, here's an example of how a user would typically use
-[`tsh`](../reference/cli/tsh.mdx):
-
-<Tabs>
-<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
-
-```code
-# Log into a Teleport cluster. This command retrieves the user's certificates
-# and saves them into ~/.tsh/teleport.example.com
-$ tsh login --proxy=teleport.example.com
-
-# SSH into a Node as usual
-$ tsh ssh user@node
-
-# `tsh ssh` takes the same arguments as the OpenSSH client:
-$ tsh ssh -o ForwardAgent=yes user@node
-$ tsh ssh -o AddKeysToAgent=yes user@node
-
-# You can even create a convenient symlink:
-$ ln -s /path/to/tsh /path/to/ssh
-
-# ... and now your 'ssh' command is calling Teleport's `tsh ssh`
-$ ssh user@host
-
-# This command removes SSH certificates from a user's machine:
-$ tsh logout
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Login into a Teleport cluster. This command retrieves the user's certificates
-# and saves them into ~/.tsh/mytenant.teleport.sh
-$ tsh login --proxy=mytenant.teleport.sh
-
-# SSH into a Node as usual
-$ tsh ssh user@node
-
-# `tsh ssh` takes the same arguments as the OpenSSH client:
-$ tsh ssh -o ForwardAgent=yes user@node
-$ tsh ssh -o AddKeysToAgent=yes user@node
-
-# You can even create a convenient symlink:
-$ ln -s /path/to/tsh /path/to/ssh
-
-# ... and now your 'ssh' command is calling Teleport's `tsh ssh`
-$ ssh user@host
-
-# This command removes SSH certificates from a user's machine:
-$ tsh logout
-```
-
-</TabItem>
-
-</Tabs>
-
-In other words, Teleport was designed to be fully compatible with existing
-SSH-based workflows and does not require users to learn anything new, other than
-to call [`tsh login`](../reference/cli/tsh.mdx#tsh-login) in the beginning.
-
-## Installing tsh
-
-Follow the instructions below to install the `tsh` binary.
-
-We recommend installing `tsh` of the same major version as the version used in
-your Teleport cluster.
-
-To find the version number, either:
-
-- In the Web UI, select your username in the upper right, then click
-  **Help & Support**. You will see the version of your Teleport
-  cluster under **CLUSTER INFORMATION**.
-
-- Use `curl` and `jq`. Replace <Var name="teleport.example.com" />
-  with your Proxy Service address (e.g. `mytenant.teleport.sh` for Teleport
-  Enterprise Cloud):
-
-  ```code
-  $ curl https://<Var name="teleport.example.com" />/webapi/find | jq '.server_version'
-  "(=teleport.version=)"
-  ```
-
-(!docs/pages/includes/install-tsh.mdx!)
-
-## User identities
-
-A user identity in Teleport exists in the scope of a cluster. The member nodes
-of a cluster may have multiple OS users on them. A Teleport administrator
-assigns allowed logins to every Teleport user account.
-
-When logging into a remote node, you will have to specify both the Teleport
-login and the OS login. A Teleport identity will have to be passed via the
-`--user` flag while the OS login will be passed as `login@host` using syntax
-compatible with the traditional `ssh` command.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Authenticate against the "work" cluster as joe and then
-# log into the node as root:
-$ tsh ssh --proxy=work.example.com --user=joe root@node
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Authenticate against the "work" cluster as joe and then
-# log into the node as root:
-$ tsh ssh --proxy=mytenant.teleport.sh --user=joe root@node
-```
-
-</TabItem>
-
-</Tabs>
-
-[CLI Docs - tsh ssh](../reference/cli/tsh.mdx#tsh-ssh)
-
-## Logging in
-
-To retrieve a user's certificate, execute:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Full form:
-$ tsh login --proxy=proxy_host:<https_proxy_port>
-
-# Using default ports:
-$ tsh login --proxy=work.example.com
-
-# Using custom HTTPS port:
-$ tsh login --proxy=work.example.com:5000
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Full form:
-$ tsh login --proxy=proxy_host:<https_proxy_port>
-
-$ tsh login --proxy=mytenant.teleport.sh
-```
-
-</TabItem>
-
-</Tabs>
-
-[CLI Docs - tsh login](../reference/cli/tsh.mdx#tsh-login)
-
-| Port | Description |
-| - | - |
-| https_proxy_port | the HTTPS port the proxy host is listening to (defaults to `443` and `3080`). |
-
-The login command retrieves a user's certificate and stores it in `~/.tsh`
-directory as well as in the [ssh agent](https://en.wikipedia.org/wiki/Ssh-agent) if there is one running.
-
-This allows you to authenticate just once, maybe at the beginning of the day. Subsequent `tsh ssh` commands will run without asking for credentials until the temporary certificate expires. By default, Teleport issues user certificates with a time to live (TTL) of 12 hours.
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  It is recommended to always use [`tsh login`](../reference/cli/tsh.mdx#tsh-login) before using any other `tsh` commands. This allows users to omit `--proxy` flag in subsequent tsh commands. For example `tsh ssh user@host` will work.
-</Admonition>
-
-A Teleport cluster can be configured for multiple user identity sources. For example, a cluster may have a local user called `admin` while regular users should [authenticate via GitHub](../admin-guides/access-controls/sso/github-sso.mdx). In this case, you have to pass `--auth` flag to `tsh login` to specify which identity storage to use:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Log in using the local Teleport 'admin' user:
-$ tsh --proxy=proxy.example.com --auth=local --user=admin login
-
-# Log in using GitHub as an SSO provider, assuming the GitHub connector is called "github"
-$ tsh --proxy=proxy.example.com --auth=github login
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Log in using the local Teleport 'admin' user:
-$ tsh --proxy=mytenant.teleport.sh --auth=local --user=admin login
-
-# Log in using GitHub as an SSO provider, assuming the GitHub connector is called "github"
-$ tsh --proxy=mytenant.teleport.sh --auth=github login
-```
-
-</TabItem>
-
-</Tabs>
-
-When using an external identity provider to log in, `tsh` will need to open a
-web browser to complete the authentication flow. By default, `tsh` will use your
-system's default browser. If you wish to suppress this behavior, you can use the
-`--browser=none` flag:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Don't open the system default browser when logging in
-$ tsh login --proxy=work.example.com --browser=none
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Don't open the system default browser when logging in
-$ tsh login --proxy=mytenant.teleport.sh --browser=none
-```
-
-</TabItem>
-
-</Tabs>
-
-In this situation, a link will be printed on the screen. You can copy and paste this link into
-a browser of your choice to continue the login flow.
-
-[CLI Docs - tsh login](../reference/cli/tsh.mdx#tsh-login)
-
-### Inspecting an SSH certificate
-
-To inspect the SSH certificates in `~/.tsh`, a user may execute the following
-command:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ tsh status
-
-# > Profile URL:  https://proxy.example.com:3080
-#   Logged in as: johndoe
-#  Cluster:      proxy.example.com
-#   Roles:        access, auditor, editor
-#   Logins:       root, admin, guest
-#   Kubernetes:   enabled
-#  Valid until:  2017-04-25 15:02:30 -0700 PDT [valid for 1h0m0s]
-#  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ tsh status
-
-# > Profile URL:  https://mytenant.teleport.sh:443
-#   Logged in as: johndoe
-#  Cluster:      mytenant.teleport.sh
-#   Roles:        access, editor, auditor
-#   Logins:       root, admin, guest
-#   Kubernetes:   enabled
-#  Valid until:  2017-04-25 15:02:30 -0700 PDT [valid for 1h0m0s]
-#  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-</TabItem>
-
-</Tabs>
-
-[CLI Docs - tsh status](../reference/cli/tsh.mdx#tsh-status)
-
-### SSH agent support
-
-If there is an [ssh agent](https://en.wikipedia.org/wiki/Ssh-agent) running,
-`tsh login` will store the user certificate in the agent. This can be verified
-via:
-
-```code
-$ ssh-add -L
-```
-
-The SSH agent can be used to feed the certificate to other SSH clients, for example
-to OpenSSH (`ssh`).
-
-If you wish to disable SSH agent integration, pass `--no-use-local-ssh-agent`
-to `tsh`. You can also set the `TELEPORT_USE_LOCAL_SSH_AGENT` environment
-variable to `false` in your shell profile to make this permanent.
-
-### Identity files
-
-[`tsh login`](../reference/cli/tsh.mdx#tsh-login) can also save the user certificate into a
-file:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Authenticate the user against proxy.example.com and save the user
-# certificate to joe.pem
-$ tsh login --proxy=proxy.example.com --out=joe
-
-# Use joe.pem to log in to the server 'db'
-$ tsh ssh --proxy=proxy.example.com -i joe joe@db
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Authenticate the user against mytenant.teleport.sh and save the user
-# certificate to joe.pem
-$ tsh login --proxy=mytenant.teleport.sh --out=joe
-
-# Use joe.pem to log in to the server 'db'
-$ tsh ssh --proxy=mytenant.teleport.sh -i joe joe@db
-```
-
-</TabItem>
-
-</Tabs>
-
-By default, the `--out` flag will create an identity file suitable for `tsh -i`.
-If compatibility with OpenSSH is needed, `--format=openssh` must be specified.
-In this case, the identity will be saved into two files, `joe` and
-`joe-cert.pub`:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ tsh login --proxy=proxy.example.com --out=joe --format=openssh
-$ ls -lh
-
-# total 8.0K
-# -rw------- 1 joe staff 1.7K Aug 10 16:16 joe
-# -rw------- 1 joe staff 1.5K Aug 10 16:16 joe-cert.pub
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ tsh login --proxy=mytenant.teleport.sh --out=joe --format=openssh
-$ ls -lh
-
-# total 8.0K
-# -rw------- 1 joe staff 1.7K Aug 10 16:16 joe
-# -rw------- 1 joe staff 1.5K Aug 10 16:16 joe-cert.pub
-```
-
-</TabItem>
-
-</Tabs>
-
-### SSH certificates for automation
-
-Regular users of Teleport must request an auto-expiring SSH certificate, usually
-every day. This doesn't work for non-interactive scripts, like cron jobs or a
-CI/CD pipeline.
-
-The most secure way to generate certificates for automation purposes is to use
-[Machine ID](../enroll-resources/machine-id/introduction.mdx). This ensures that your automation
-is taking advantage of the security properties of short-lived credentials.
-
-If Machine ID does not support your preferred CI/CD platform, you can create a
-local user for use in automation and request a long-lived certificate for that
-user.
-
-In this example, we're creating a certificate with a TTL of one hour for the
-`jenkins` user and storing it in a `jenkins.pem` file, which can be later used with
-`-i` (identity) flag for `tsh`.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-# You can also run tctl on your Auth Service host without running "tsh login"
-# first.
-$ tsh login --proxy=teleport.example.com --user=myuser
-$ tctl auth sign --ttl=1h --user=jenkins --out=jenkins.pem
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Log in to your Teleport Cloud cluster so you can use tctl locally.
-$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
-$ tctl auth sign --ttl=1h --user=jenkins --out=jenkins.pem
-```
-
-</TabItem>
-
-</Tabs>
-
-[CLI Docs - tctl auth sign](../reference/cli/tctl.mdx#tctl-auth-sign)
-
-Now `jenkins.pem` can be copied to the Jenkins server and passed to the `-i`
-(identity file) flag of `tsh`.
-
-`tctl auth sign` is an admin's equivalent of `tsh login --out` and allows for
-unrestricted certificate TTL values.
-
-## Exploring the cluster
-
-In a Teleport cluster, all Nodes periodically ping the cluster's Auth Service
-and update their status. This allows Teleport users to see which Nodes are
-online with the `tsh ls` command:
-
-```code
-# This command lists all Nodes in the cluster you logged into via "tsh login":
-$ tsh ls
-
-# Node Name     Address            Labels
-# ---------     -------            ------
-# turing        ⟵ Tunnel          os=linux
-# graviton      10.1.0.7:3022      os=osx
-```
-
-[CLI Docs - tsh ls](../reference/cli/tsh.mdx#tsh-ls)
-
-`tsh ls` can apply a filter based on the node labels.
-
-```code
-# Only show Nodes with os label set to 'osx':
-$ tsh ls os=osx
-
-# Nodename      Address            Labels
-# ---------     -------            ------
-# graviton      10.1.0.7:3022      os=osx
-```
-
-[CLI Docs -tsh ls](../reference/cli/tsh.mdx#tsh-ls)
-
-<details>
-<summary>Not seeing Nodes?</summary>
-
-(!docs/pages/includes/node-logins.mdx!)
-
-</details>
-
-## Interactive shell
-
-To launch an interactive shell on a remote Node or to execute a command, use
-`tsh ssh`.
-
-`tsh` tries to mimic the `ssh` experience as much as possible, so it supports
-the most popular `ssh` flags like `-p`, `-l` or `-L`. For example, if you have
-the following alias defined in your `~/.bashrc`: `alias ssh="tsh ssh"` then you
-can continue using familiar SSH syntax:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Have this alias configured, perhaps via ~/.bashrc
-$ alias ssh="/usr/local/bin/tsh ssh"
-
-# Login in to a cluster and retrieve your SSH certificate:
-$ tsh --proxy=proxy.example.com login
-
-# These commands execute `tsh ssh` under the hood:
-$ ssh user@node
-$ ssh -p 6122 user@node ls
-$ ssh -o ForwardAgent=yes user@node
-$ ssh -o AddKeysToAgent=yes user@node
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Have this alias configured, perhaps via ~/.bashrc
-$ alias ssh="/usr/local/bin/tsh ssh"
-
-# Login in to a cluster and retrieve your SSH certificate:
-$ tsh --proxy=mytenant.teleport.sh login
-
-# These commands execute `tsh ssh` under the hood:
-$ ssh user@node
-$ ssh -p 6122 user@node ls
-$ ssh -o ForwardAgent=yes user@node
-$ ssh -o AddKeysToAgent=yes user@node
-```
-
-</TabItem>
-
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-### Proxy ports
-
-By default, the Teleport Proxy Service listens on port `3080`.
-
-If a Teleport Proxy Service instance is configured to listen on non-default
-ports, they must be specified via `--proxy` flag as shown:
-
-```code
-$ tsh --proxy=proxy.example.com:5000 <subcommand>
-```
-
-This `tsh` command will use port `5000` of the Proxy Service.
-
-</TabItem>
-
-</Tabs>
-
-### Port forwarding
-
-`tsh ssh` supports the OpenSSH `-L` flag which forwards incoming
-connections from localhost to the specified remote host:port. The syntax of `-L`
-flag is as follows, where "bind_ip" defaults to `127.0.0.1`:
-
-```code
-$ -L [bind_ip]:listen_port:remote_host:remote_port
-```
-
-Example:
-
-```code
-$ tsh ssh -L 5000:web.remote:80 node
-```
-
-This will connect to remote server `node` via the Proxy Service, then open a
-listening socket on `localhost:5000`. Finally, it will forward all incoming
-connections to `web.remote:80` via this SSH tunnel.
-
-It is often convenient to establish port forwarding, execute a local command
-which uses the connection, and then disconnect. You can do this with the `--local`
-flag.
-
-Example:
-
-```code
-$ tsh ssh -L 5000:google.com:80 --local node curl http://localhost:5000
-```
-
-This command:
-
-- Connects to `node`.
-- Binds the local port `5000` to port `80` on `google.com`.
-- Executes `curl` command locally, which results in `curl` hitting `google.com:80` via `node`.
-
-### SSH jump host
-
-While implementing `ProxyJump` for Teleport, we have extended the feature to `tsh`.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ tsh ssh -J proxy.example.com telenode
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ tsh ssh -J mytenant.teleport.sh telenode
-```
-
-</TabItem>
-
-</Tabs>
-
-Known limitations:
-
-- Only one jump host is supported (`-J` supports chaining that Teleport does not utilize) and `tsh` will return with error in the case of two jump hosts, i.e. `-J proxy-1.example.com,proxy-2.example.com` will not work.
-- When `tsh ssh -J user@proxy` is used, it overrides the SSH proxy defined in the tsh profile, and port forwarding is used instead of the existing Teleport proxy subsystem.
-
-### Resolving Node names
-
-`tsh` supports multiple methods to resolve remote Node names.
-
-- **Traditional**: by IP address or via DNS.
-- **Nodename setting**: the `teleport` daemon supports the` nodename` flag, which allows Teleport administrators to assign alternative Node names.
-- **Labels**: you can address a Node by `name=value` pair.
-
-If we have two Node, one with `os:linux` label and one Node with `os:osx`, we
-can log in to the OSX Node with:
-
-```code
-$ tsh ssh os=osx
-```
-
-This only works if there is only one remote node with the `os:osx` label, but
-you can still execute commands via SSH on multiple Nodes using labels as a
-selector. This command will update all system packages on machines that run
-Linux:
-
-```code
-$ tsh ssh os=ubuntu apt-get update -y
-```
-
-### Short-lived sessions
-
-The default TTL of a Teleport user certificate is 12 hours. This can be modified
-at login with the `--ttl` flag. This command logs you into the cluster with a
-very short-lived (1 minute) temporary certificate:
-
-```code
-$ tsh --ttl=1 login
-```
-
-You will be logged out after one minute, but if you want to log out immediately,
-you can always run:
-
-```code
-$ tsh logout
-```
-
-## Copying files
-
-To securely copy files to and from cluster Nodes, use the `tsh scp` command. It
-is designed to mimic OpenSSH's `scp` command as much as possible:
-
-```code
-$ tsh scp example.txt root@node:/path/to/dest
-```
-
-Again, you may want to create a bash alias like `alias scp="tsh --proxy=work
-scp"` and use the familiar syntax:
-
-```code
-$ scp -P 61122 -r files root@node:/path/to/dest
-```
-
-Teleport supports both the SCP and SFTP protocols.
-OpenSSH `scp` or `sftp` commands can both be used in place of `tsh scp`
-if desired.
-
-## Sharing sessions
-
-Suppose you are trying to troubleshoot a problem on a remote server. Sometimes
-it makes sense to ask another team member for help. Traditionally, this could be
-done by letting them know which host you're on, having them SSH in, start a
-terminal multiplexer like `screen`, and join a session there.
-
-Teleport makes this more convenient. Let's log in to a server named `luna`
-and ask Teleport for our current session status:
-
-```code
-$ tsh ssh luna
-# on host luna
-$ teleport status
-
-# User ID    : joe, logged in as joe from 10.0.10.1 43026 3022
-# Session ID : 7645d523-60cb-436d-b732-99c5df14b7c4
-Session URL: https://work:3080/web/sessions/7645d523-60cb-436d-b732-99c5df14b7c4
-```
-
-Now you can invite another user account to the `work` cluster. You can share the
-URL for access through a web browser, or you can share the session ID, and the
-other user can join you through their terminal by typing:
-
-```code
-$ tsh join <session_ID>
-```
-
-<Admonition
-  type="tip"
-  title="Lacking permission?"
->
-  Joining sessions requires special permissions that need to be set up by your cluster administrator.
-  Refer them to the [Moderated Sessions guide](../admin-guides/access-controls/guides/joining-sessions.mdx) for more information on configuring join permissions.
-</Admonition>
-
-You can also list active sessions with the `tsh sessions ls` command.
-
-<Admonition type="note" scope={["oss", "enterprise"]}>
-  Joining sessions is not supported in recording proxy mode (where `session_recording` is set to `proxy`).
-</Admonition>
-
-## Connecting to SSH clusters behind firewalls
-
-Teleport supports creating clusters of servers located behind firewalls
-**without any open listening TCP ports**.  This works by creating reverse SSH
-tunnels from behind-firewall environments into a Teleport Proxy Service you have access to.
-
-To learn more about setting up a trust relationship between clusters behind firewalls, see
-[Configure Trusted Clusters](../admin-guides/management/admin/trustedclusters.mdx).
-
-<Admonition type="note" >
-  Trusted clusters are only available for self-hosted Teleport clusters.
-</Admonition>
-
-Assuming the Teleport Proxy Server called `work` is configured with a few trusted
-clusters, you can use the `tsh clusters` command to see a list of all the trusted clusters on the server:
-
-```code
-$ tsh --proxy=work clusters
-
-# Cluster Name     Status
-# ------------     ------
-# staging          online
-# production       offline
-```
-
-[CLI Docs - tsh clusters](../reference/cli/tsh.mdx#tsh-clusters)
-
-Now you can use the `--cluster` flag with any `tsh` command. For example, to list SSH nodes that are members of the `production` cluster, simply run:
-
-```code
-$ tsh --proxy=work ls --cluster=production
-
-# Node Name     Node ID       Address            Labels
-# ---------     -------       -------            ------
-# db-1          xxxxxxxxx     10.0.20.31:3022    kernel:4.4
-# db-2          xxxxxxxxx     10.0.20.41:3022    kernel:4.2
-```
-
-Similarly, if you want to SSH into `db-1` inside the `production` cluster:
-
-```code
-$ tsh --proxy=work ssh --cluster=production db-1
-```
-
-This is possible even if Nodes in the `production` cluster are located behind a
-firewall without open ports. This works because the `production` cluster
-establishes a reverse SSH tunnel back into the Proxy Service called `work`, and
-this tunnel is used to establish inbound SSH connections.
-
-## X11 forwarding
-
-In order to run graphical programs within an SSH session, such as an IDE like
-Virtual Studio Code, you'll need to request X11 forwarding for the session with
-the `-X` flag.
-
-```code
-$ tsh ssh -X node01
-```
-
-X11 forwarding provides the server with secure access to your local X Server
-so that it can communicate directly with your local display and I/O devices.
-
-<Admonition type="note">
-  The `-Y` flag can be used to start Trusted X11 forwarding. This is needed
-  in order to enable more "unsafe" features, such as running clipboard or
-  screenshot utilities like `xclip`. However, it provides the server with
-  unmitigated access to your local X Server and puts your local machine at
-  risk of X11 attacks, so it should only be used with extreme caution.
-</Admonition>
-
-In order to use X11 forwarding, you'll need to enable it on the Teleport Node.
-You'll also need to ensure that your user has the `permit_x11_forwarding` role option:
-
-```code
-$ tsh status
-> Profile URL:        https://proxy.example.com:3080
-  Logged in as:       dev
-  ...
-  Extensions:         permit-X11-forwarding
-```
-
-## Proxying Git commands
-
-(!docs/pages/connect-your-client/includes/tsh-git.mdx!)
-
-## Custom aliases and defaults
-
-You can configure `tsh` to define aliases, custom commands and command-specific flag defaults. Using aliases, you can run frequently used `tsh` commands more easily.
-
-Aliases are defined in configuration files using the following syntax:
-
-```yaml
-aliases:
-    "<alias>": "<command>"
-```
-
-The `<alias>` can only be a top-level subcommand. In other words, you can define `tsh mycommand` alias but not `tsh my command`.
-
-`tsh` loads two kinds of configuration files:
-
-- global: set via the `$TELEPORT_GLOBAL_TSH_CONFIG` env var if not provided it will default to `/etc/tsh.yaml` on non-Windows operating systems.
-- user-specific: `$TELEPORT_HOME/config/config.yaml`, which by default resolves to `~/.tsh/config/config.yaml`.
-
-`tsh` merges the user-specific config with the global config. In case of conflicts (i.e. same alias defined in both files), the user-specific config has higher priority.
-
-In either of those files you can add define an alias such as:
-
-```yaml
-aliases:
-    "l": "tsh login --auth=okta"
-```
-
-From now on, `tsh l` will resolve to `tsh login --auth=okta`.
-
-You can also change the defaults for regular `tsh` commands:
-
-```yaml
-aliases:
-    "status": "tsh status --format=json"
-```
-
-Calling external programs other than `tsh` is also possible:
-
-```yaml
-aliases:
-    "connect": "bash -c 'tsh login $0 && tsh ssh $1'"
-```
-
-The example above demonstrates the usage of variables `$0` and `$1`. They represent arguments provided to the alias. With the definition above, `tsh connect foo bar` resolves to `bash -c 'tsh login foo && tsh ssh bar'`.
-
-The alias can use as many arguments as needed. If the alias is invoked with too few arguments, `tsh` will report an error. Conversely, providing additional arguments is *not* an error. `tsh` will append any additional arguments to the end of an alias definition.
-
-Given the configuration:
-
-```yaml
-aliases:
-    "example": "bash -c 'echo first=$0 $0-$1 $3'"
-```
-
-`tsh example 0 1 unused-2 3 unused-4` will expand to `bash -c 'echo first=0 0-1 3 unused-2 unused-4'`.
-
-You can also add the `$TSH` variable to an alias definition. When invoking the alias, `tsh` will expand this to the absolute path to current `tsh` executable. This can be useful if there are multiple `tsh` versions installed, or the currently used version is not in `PATH`.
-
-```yaml
-aliases:
-    "status": "$TSH status --format=json"
-```
-
-The alias substitution happens before the command line flags are fully parsed. This means that it is not affected by the `--debug` flag. To troubleshoot your aliases, set the `TELEPORT_DEBUG=1` environment variable instead. This will cause the `tsh` logs to be printed to the console:
-
-```code
-$ TELEPORT_DEBUG=1 tsh status
-DEBU [TSH]       Self re-exec command: tsh [status --format=json]. tsh/aliases.go:203
-...
-```
-
-## Debug logs
-
-Adding the `--debug` flag to a command or setting the `TELEPORT_DEBUG` env var to `1` makes tsh
-print debug logs to standard output.
-
-### Unified logging system on macOS
-
-On macOS, the `--os-log` flag can be used instead of `--debug` to send debug logs to [the unified
-logging system](https://support.apple.com/en-gb/guide/console/welcome/mac). This behavior can also be controlled through the `TELEPORT_OS_LOG` env var.
-
-To stream logs in a separate shell session:
-
-```code
-$ log stream --predicate 'subsystem CONTAINS "tsh"' --style syslog --level debug
-```
-
-To dump logs captured so far to a file:
-
-```code
-$ log show --predicate 'subsystem CONTAINS "tsh"' --style syslog --info --debug > tsh.log
-```
-
-The logs can also be inspected in [the Console
-app](https://support.apple.com/en-gb/guide/console/cnsl1012/1.1/mac/15.0). Info and debug logs are
-not shown by default, so make sure to select "Include Info Messages" and "Include Debug Messages"
-from the Action menu.
-
-## Examining recorded sessions
-
-You can use `tsh` to examine sessions that users have completed in resources
-protected by Teleport. This section explains how to list and play Teleport
-session recordings with `tsh`.
-
-Note that you can also play session recordings in the Teleport Web UI. To do so,
-navigate to the **Access Management** tab on the top sidebar and view the
-**Session Recordings** tab on the left sidebar.
-
-### Listing recordings
-
-Run the following command to review recorded sessions:
-
-```code
-$ tsh recordings ls
-ID                                   Type Participants Hostname Timestamp
------------------------------------- ---- ------------ -------- -------------------
-b0a04442-70dc-4be8-9308-7b7901d2d600 ssh  jeff         dev       Nov 26 16:36:16 UTC
-c0a02222-70dc-4be8-9308-7b7901d2d600 kube alice                  Nov 26 20:36:16 UTC
-d0a04442-70dc-4be8-9308-7b7901d2d600 ssh  navin        test      Nov 26 16:36:16 UTC
-```
-
-### Playing recordings
-
-To play a session recording, run the `tsh play` command with the ID of a session
-as returned by `tsh recordings ls`:
-
-```code
-$ tsh play c0a02222-70dc-4be8-9308-7b7901d2d600
-```
-
-You can also run `tsh play` with the path to a TAR file that contains a session
-recording:
-
-```code
-$ tsh play ./my-recording.tar
-```
-
-To retrieve a TAR file containing a session recording, you must have access to
-the session recording backend. This requires either a self-hosted Teleport
-cluster or [external audit
-storage](../admin-guides/management/external-audit-storage.mdx).
-
-The `tsh play` command can print recordings in several formats, depending on the
-kind of resource the recorded session interacts with. To choose a format, use
-the `--format` flag of `tsh play`:
-
-| `--format` value | Supported resources | Description |
-|------------------|---------------------|-------------|
-| `pty` (default)  | Servers, Kubernetes clusters | `tsh` opens a pseudo-terminal to play each command executed in the session. |
-| `text` | Servers, Kubernetes clusters | `tsh` dumps the entire recording directly to standard out. Timing data is ignored. |
-| `json` | Servers, Kubernetes clusters, applications, databases | `tsh` prints a JSON-serialized list of audit events, separated by newlines. |
-| `yaml` | Servers, Kubernetes clusters, applications, databases | `tsh` prints a YAML-serialized list of audit events, separated by `---` characters. |
-
-The playback speed can be customized with the `--speed` flag, which must be
-one of `0.5x`, `1x`, `2x`, `4x`, or `8x`.
-
-```code
-tsh play --speed=8x UUID
-```
-
-Another way to speed up playback is to skip idle time in the recording with the
-`--skip-idle-time` flag. When enabled, tsh will respect the configured playback
-speed during active sections of the recording, but it will skip over larger periods
-of inactivity.
-
-## tsh configuration files
-
-You can use a configuration file to control the behavior of `tsh`. The scope of
-the configuration file depends on its location:
-
-- `/etc/tsh.yaml` is the default location for global, shared configuration
-  settings. You can override the location with the `TELEPORT_GLOBAL_TSH_CONFIG`
-  environment variable.
-- `$TELEPORT_HOME/config/config.yaml` is the default location for user-specific
-  configuration settings. The default location for `TELEPORT_HOME` is `~/.tsh`.
-
-`tsh` merges the settings from both configuration file locations, with the user
-configuration settings taking precedence.
-
-### Extra proxy headers
-
-The `tsh` configuration file enables you to specify HTTP headers to be
-included in requests to Teleport Proxy Servers with addresses matching
-the `proxy` field.
-
-```yaml
-add_headers:
-  - proxy: "*.example.com" # matching proxies will have headers included
-    headers: # headers are pairs to include in the http headers
-      foo: bar # Key/Value to be included in the http request
-```
-
-For example, adding HTTP headers can be useful if an intermediate HTTP proxy is
-in place that requires setting an authentication token:
-
-```yaml
-add_headers:
-  - proxy: "*.infra.corp.xyz"
-    headers:
-      "Authorization": "Bearer tokentokentoken"
-```
-
-### Aliases
-
-Aliases allow you to define custom commands or change the default flag values for existing commands using the following syntax:
-
-```yaml
-aliases:
-    "<alias>": "<command>"
-```
-
-The `<alias>` can only be a top-level subcommand. In other words, you can define a `tsh mycommand` alias but not `tsh my command`.
-
-New command `tsh l`:
-
-```yaml
-aliases:
-    "l": "tsh login --auth=okta"
-```
-
-Make `tsh status` use JSON as a default format:
-
-```yaml
-aliases:
-    "status": "tsh status --format=json"
-```
-
-The alias can use an arbitrary number of arguments. If an argument variable `$N` is referenced, `tsh` will check that at least `N+1` arguments were given to the alias invocation. All arguments that were given but not referenced in the alias definition will be appended at the end.
-
-Define a custom command using `bash`. The `$0` and `$1` variables will be substituted with command arguments.
-
-```yaml
-aliases:
-    "connect": "bash -c 'tsh login $0 && tsh ssh $1'"
-```
-
-Define a custom login command where first argument specifies `--auth` option.
-
-```yaml
-aliases:
-    "ap": "tsh login --auth=$0 --proxy=teleport.example.com"
-```
-
-Given the configuration:
-
-```yaml
-aliases:
-    "example": "bash -c 'echo first=$0 $0-$1 $3'"
-```
-
-`tsh example 0 1 unused-2 3 unused-4` will expand to `bash -c 'echo first=0 0-1 3 unused-2 unused-4'`.
-
-An alias definition can also reference the `$TSH` variable. If you use the
-`$TSH` variable in an alias, `tsh` expands the variable to the absolute path of
-the current `tsh` executable. This behavior can be useful if there are multiple
-`tsh` versions installed, or the version you're currently using is not in the
-`PATH`:
-
-```yaml
-aliases:
-    "status": "$TSH status --format=json"
-```
-
-To troubleshoot aliases, set the `TELEPORT_DEBUG=1` environment variable. This will cause detailed logs to be printed to standard error:
-
-```code
-$ TELEPORT_DEBUG=1 tsh status
-DEBU [TSH]       Self re-exec command: tsh [status --format=json]. tsh/aliases.go:203
-...
-```
-
-### Proxy templates
-
-With proxy templates, `tsh` dynamically determines the address of the Teleport
-Proxy Service to connect to based on the address of the destination host in your
-`tsh ssh` or `tsh proxy ssh` command:
-
-```yaml
-proxy_templates:
-
-# Regular expression that the host server address `%h:%p` is matched against.
-# The "replace rules" below can reference capturing groups from this regular
-# expression (`$1`, `$2`, etc.).
-- template: '^(\w+)\.(\w+):([0-9]+)$' # <nodename>.<clustername>:<port>
-
-  # Optional web proxy address to use for proxy jump (`--jumphost`, `-J`).
-  #
-  # Proxy Jump can be used to reduce latency in regionally distributed trusted
-  # clusters by connecting to a leaf node through the leaf proxy instead of the
-  # root proxy.
-  proxy: "$2.eu.example.com:443"
-
-  # Optional cluster name to connect to (`--cluster`).
-  #
-  # Cluster can be used to connect to leaf nodes from the root proxy without
-  # first logging in to the leaf cluster. This may be useful in cases where
-  # proxy jump is not applicable, such as when the leaf clusters do not have
-  # their own public proxies.
-  cluster: "$2"
-
-  # Optional host server address to connect to (`%h:%p`).
-  #
-  # Port defaults to 3022 if not explicitly provided with `--port`.
-  # If provided, it will take precedence over host resolution via
-  # query or search.
-  host: "$1:$3"
-
-  # Optional predicate expression to resolve the target host with.
-  #
-  # Query by predicate expression similar to tsh ls --query.
-  # Has priority over search but will be ignored if a host is provided.
-  query: "labels.env == $1"
-
-  # Optional fuzzy search terms to resolve the target host with.
-  #
-  # Search by a list of comma separated keywords similar to tsh ls --search.
-  # Only applied if host and search are not provided.
-  search: "$1"
-
-# Multiple templates can be provided. They are evaluated in order and the first
-# match takes effect.
-- template: ...
-```
-
-In the configuration above, `query` accepts an predicate expression.  This has
-priority over search but will be ignored if a host is provided.  See the
-[predicate language
-documentation](../reference/predicate-language.mdx#resource-filtering) for
-predicate expression examples.
-
-`tsh -J {{proxy}} ssh` and `tsh -J {{proxy}} proxy ssh` will attempt to match the
-host server address `%h:%p` with the configured templates. For each replace rule set,
-the corresponding cli value will be set.
-
-If leaf certificates are required to connect to the node, `tsh` automatically
-retrieves leaf certificates from the root cluster:
-
-```code
-$ tsh ssh -J {{proxy}} node1.leaf1
-# becomes
-$ tsh ssh -J leaf1.eu.example.com:443 --cluster leaf1 node1
-```
-
-If there is no template matched, an error is returned.
-
-```code
-$ tsh ssh -J {{proxy}} node1.none.example.com
-ERROR: proxy jump contains {{proxy}} variable but did not match any of the templates in tsh config
-```
-
-If you don't explicitly provide the proxy variable `-J {{proxy}}`, `tsh` still
-attempts to match a template, but won't fail if there isn't a match.
-Additionally, `tsh` won't replace the `proxy` value if it's explicitly set by
-the client:
-
-```code
-$ tsh ssh -J leaf2.us.example.com:443 node1.leaf2
-# becomes
-$ tsh ssh -J leaf2.us.example.com:443 --cluster leaf2 node1
-```
-
-Proxy Templates can also be used with OpenSSH by setting the `ProxyCommand`
-in `~/.ssh/config` to use `tsh proxy ssh`.
-
-```txt
-Host *.example.com
-    Port 3022
-    ProxyCommand tsh proxy ssh -J {{proxy}} %r@%h:%p
-```
-
-As a result, you can use `tsh ssh` and `ssh` interchangeably.
-
-```code
-$ tsh ssh node1.leaf1
-# is equivalent to
-$ ssh node1.leaf1
-```
-
-## Uninstalling tsh
-
-To remove `tsh` and associated user data see
-[Uninstalling Teleport](../admin-guides/management/admin/uninstall-teleport.mdx).
-
-## Further reading
-
-Read the [`tsh` CLI Reference](../reference/cli/tsh.mdx) for all `tsh` commands
-and their options.
diff --git a/docs/pages/connect-your-client/vnet.mdx b/docs/pages/connect-your-client/vnet.mdx
deleted file mode 100644
index a11ba1566dba6..0000000000000
--- a/docs/pages/connect-your-client/vnet.mdx
+++ /dev/null
@@ -1,234 +0,0 @@
----
-title: Using VNet
-description: Using VNet
----
-
-This guide explains how to use VNet to connect to TCP applications available through Teleport.
-
-## How it works
-
-VNet automatically proxies connections from your computer to TCP apps available
-through Teleport.
-A program on your device can securely connect to internal applications protected
-by Teleport without having to know about Teleport authentication details.
-Underneath, VNet authenticates the connection with your Teleport credentials and
-securely tunnels the TCP connection to your application.
-This is all done client-side – VNet sets up a local DNS name server that
-intercepts DNS requests for your internal apps and responds with a virtual IP
-address managed by VNet that will forward the connection to your application.
-
-![Diagram showing VNet architecture](../../img/vnet/how-it-works.svg)
-
-VNet is available on macOS and Windows in Teleport Connect and tsh, with plans
-for Linux support in a future version.
-
-## Prerequisites
-
-<Tabs>
-<TabItem label="macOS">
-- A client machine running macOS Ventura (13.0) or higher.
-- [Teleport Connect](teleport-connect.mdx), version 16.0.0 or higher.
-</TabItem>
-<TabItem label="Windows">
-- A client machine running Windows 10 or higher.
-- [Teleport Connect](teleport-connect.mdx), version 17.3.0 or higher.
-</TabItem>
-</Tabs>
-
-## Step 1/3. Start Teleport Connect
-
-Open Teleport Connect and log in to the cluster. Find the TCP app you want to connect to. TCP apps
-have `tcp://` as the protocol in their addresses.
-
-![Resource list in Teleport Connect with a TCP hovered over](../../img/use-teleport/vnet-resources-list@2x.png)
-
-## Step 2/3. Start VNet
-
-Click "Connect" next to the TCP app. This starts VNet if it's not already running. Alternatively,
-you can start VNet through the connection list in the top left.
-
-<details>
-<summary>First launch on macOS</summary>
-During the first launch, macOS will prompt you to enable a background item for tsh.app. VNet needs
-this background item in order to configure DNS on your device. To enable the background item, either
-interact with the system notification or go to System Settings > General > Login Items and look for
-tsh.app under "Allow in the Background".
-
-![VNet starting up](../../img/use-teleport/vnet-starting@2x.png)
-</details>
-
-## Step 3/3. Connect
-
-Once VNet is running, you can connect to the application using the application client you would
-normally use to connect to it.
-
-```code
-$ psql postgres://postgres@tcp-app.teleport.example.com/postgres
-```
-
-<Admonition type="note" title="Support for multiple ports">
-Unless the application specifies [multiple
-ports](../enroll-resources/application-access/guides/tcp.mdx#configuring-access-to-multiple-ports),
-VNet proxies connections over any port used by the application client. For multi-port apps, the port
-number must match one of the target ports of the app. To see a list of target ports, click the
-three dot menu next to an application in Teleport Connect or execute `tsh apps ls`.
-
-If [per-session MFA](../admin-guides/access-controls/guides/per-session-mfa.mdx) is enabled, the
-first connection over each port triggers an MFA check.
-</Admonition>
-
-VNet is going to automatically start on the next Teleport Connect launch, unless you stop VNet
-before closing Teleport Connect.
-
-## `tsh` support
-
-VNet is available in `tsh` as well. Using it involves logging into the cluster and executing the
-command `tsh vnet`.
-
-```code
-$ tsh login --proxy=teleport.example.com
-$ tsh vnet
-```
-
-## Troubleshooting
-
-### Conflicting IPv4 ranges
-
-On the client computer, VNet uses IPv4 addresses from the CGNAT IP range `100.64.0.0/10` by
-default, and needs to configure addresses and routes for this range.
-This can conflict with other VPN-like applications, notably Tailscale also uses
-this range.
-
-If you are experiencing connectivity problems with VNet, check if you are
-running Tailscale or another VPN client, and try disabling it to see if the
-issue persists.
-To avoid the conflict and run VNet alongside Tailscale or another VPN client you
-can configure VNet to use a different IPv4 range, see our VNet configuration
-[guide](../enroll-resources/application-access/guides/vnet.mdx#configuring-ipv4-cidr-range).
-
-### Connecting to the app without VNet
-
-Sometimes connectivity issues are not related to VNet, and you can narrow that down by trying to
-connect to your app without VNet. Make sure your app appears in the Connect resources view, or the
-output of `tsh apps ls`. Turn off VNet and try creating a local proxy to your app (with debug
-logging enabled) with `tsh proxy app -d <app-name>`.
-
-### Timeouts when trying to reach a Teleport cluster
-
-If VNet doesn't have a chance to clean up before stopping, such as during sudden device shut down,
-it may leave leftover DNS configuration files in `/etc/resolver`. Those files tell your computer to
-talk to a DNS server operated by VNet when connecting to your cluster. But since VNet is no longer
-running, there's no DNS server to answer those calls.
-
-To clean up those files, simply start VNet again. Alternatively, you can remove the leftover files
-manually.
-
-### Verifying that VNet receives DNS queries
-
-Start VNet with `tsh vnet -d`. Look at `/var/log/vnet.log` and note the IPv6 and IPv4 CIDR range used by VNet.
-
-```code
-From tsh vnet -d:
-INFO [VNET]      Running Teleport VNet. ipv6_prefix:fd60:67ec:4325:: vnet/vnet.go:317
-
-From /var/log/vnet.log:
-INFO  Setting an IP route for the VNet. netmask:100.64.0.0/10 vnet/osconfig_darwin.go:47
-```
-
-Send a query for a TCP app available in your cluster, replacing <Var
-name="tcp-app.teleport.example.com" /> with the name of your app:
-
-```code
-$ dscacheutil -q host -a name <Var name="tcp-app.teleport.example.com" />
-name: tcp-app.teleport.example.com
-ipv6_address: fd60:67ec:4325::647a:547d
-
-name: tcp-app.teleport.example.com
-ip_address: 100.68.51.151
-```
-
-The addresses reported by `dscacheutil` should belong to ranges reported by VNet above.
-
-Querying for anything other than an address of a TCP app should return the address belonging to the
-Proxy Service.
-
-```code
-$ dscacheutil -q host -a name dashboard.teleport.example.com
-name: dashboard.teleport.example.com
-ipv6_address: 2606:2800:21f:cb07:6820:80da:af6b:8b2c
-
-name: dashboard.teleport.example.com
-ip_address: 93.184.215.14
-```
-
-Querying for both addresses should result in some output being emitted by `tsh vnet -d`.
-
-### Submitting an issue
-
-When [submitting an
-issue](https://github.com/gravitational/teleport/issues/new?assignees=&labels=bug,vnet&template=bug_report.md),
-make sure to include VNet logs as well as [Teleport Connect
-logs](teleport-connect.mdx#submitting-an-issue).
-
-You can collect VNet logs using the instructions below:
-
-<Tabs>
-<TabItem label="macOS">
-Logs from the VNet daemon are sent to [the unified logging system](https://support.apple.com/en-gb/guide/console/welcome/mac).
-
-To stream logs:
-
-```code
-$ log stream --predicate 'subsystem ENDSWITH ".vnetd"' --style syslog --level info
-```
-
-To dump logs captured so far to a file:
-
-```code
-$ log show --predicate 'subsystem ENDSWITH ".vnetd"' --style syslog --info > vnet.log
-```
-
-The logs can also be inspected in [the Console
-app](https://support.apple.com/en-gb/guide/console/cnsl1012/1.1/mac/15.0). Info logs are not shown
-by default, so make sure to select "Include Info Messages" from the Action menu.
-
-At the moment it's not possible to enable debug logs in the VNet daemon.
-
-{/* TODO: DELETE IN 21.0.0 */}
-Before version 18.0.0, VNet logs were saved in `/var/log/vnet.log`.
-
-If the error is related to Teleport Connect not being able to start VNet or issues with code
-signing, searching through `/var/log/com.apple.xpc.launchd/launchd.log` for `tsh` soon after
-attempting to start VNet might also bring up relevant information:
-
-```code
-$ grep tsh /var/log/com.apple.xpc.launchd/launchd.log
-```
-</TabItem>
-<TabItem label="Windows">
-Logs are saved to a custom log in Event Log called Teleport. To browse them, open [Event
-Viewer](https://learn.microsoft.com/en-us/shows/inside/event-viewer), select "Applications and
-Services Logs" in the sidebar on the left and choose "Teleport".
-
-To save them to a file, select "Save All Events As…" from the sidebar on the right.
-
-Alternatively, you can save them to a file with a PowerShell command:
-
-```code
-$ Get-WinEvent -LogName Teleport -FilterXPath "*[System[Provider[@Name='vnet']]]" -Oldest | Format-Table -Property TimeCreated,LevelDisplayName,Message -Wrap | Out-File vnet.log
-```
-
-To enable debug logs, search for "Edit the system environment variables" in the Start Menu. Select
-"Environment Variables…" and then add a new _system_ variable with the name `TELEPORT_DEBUG` and the
-value set to `1`, then restart VNet.
-
-{/* TODO: DELETE IN 21.0.0 */}
-Before version 18.0.0, VNet logs were saved in `C:\Program Files\Teleport Connect\resources\bin\logs.txt`.
-</TabItem>
-</Tabs>
-
-## Next steps
-
-- Read our VNet configuration [guide](../enroll-resources/application-access/guides/vnet.mdx)
-  to learn how to configure VNet access to your applications.
-- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
diff --git a/docs/pages/core-concepts.mdx b/docs/pages/core-concepts.mdx
index 591997f3cb574..358e1e104c834 100644
--- a/docs/pages/core-concepts.mdx
+++ b/docs/pages/core-concepts.mdx
@@ -1,6 +1,9 @@
 ---
 title: Teleport Core Concepts
 description: Learn the key components that make up Teleport.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Here are the core concepts that describe a Teleport deployment. You will see
@@ -17,7 +20,7 @@ within your infrastructure, such as Kubernetes clusters and Windows desktops.
 A minimal Teleport cluster consists of the **Teleport Auth Service** and
 **Teleport Proxy Service**. In a demo environment, you can run these two
 services from a single `teleport` process on a [Linux
-host](admin-guides/deploy-a-cluster/linux-demo.mdx).
+host](./get-started/deploy-community.mdx).
 
 ### Teleport Auth Service
 
@@ -29,9 +32,10 @@ issues certificates to clients and maintains an audit log.
 The Auth Service is the only component of a cluster that has to be connected to
 a backend, which it uses to store cluster state and the certificate authorities'
 private keys. **Teleport services** are stateless and interact with the Auth
-Service via a gRPC API.
+Service via a gRPC API. You can run multiple Auth Service instances in a cluster for high availability.
 
-You can run multiple Auth Service instances in a cluster for high availability.
+As part of the Teleport control plane, the Auth Service is a core system that manages identity, access, and trust within your cluster. 
+If you are a Teleport Cloud customer, this service is fully managed for you.
 
 Read our guides to how [authorization](reference/architecture/authorization.mdx) and
 [authentication](reference/architecture/authentication.mdx) work in Teleport.
@@ -46,61 +50,86 @@ Services**, which can run in private networks. This means that, in the Proxy
 Service's minimal configuration, you can expose only port `443` to the internet
 and run the rest of your infrastructure in private networks.
 
-You can also configure clients to bypass Proxy Service instances and connect to
-resources with Teleport-issued certificates directly.
+As a key component of the Teleport control plane, the Proxy Service handles secure routing and session recording 
+for all incoming connections. For Teleport Cloud users, the Proxy Service is fully managed and hosted by Teleport.
 
-Read our guide to [how the Teleport Proxy Service
-works](reference/architecture/proxy.mdx).
+Read our guide to [how the Teleport Proxy Service works](reference/architecture/proxy.mdx).
 
 ## Teleport services
 
 A **Teleport service** manages access to resources in your infrastructure, such
-as Kubernetes clusters, Windows desktops, internal web applications, and
-databases.
+as Kubernetes clusters, Windows desktops, internal web applications, etc.
 
-A single running `teleport` process can run one or more **Teleport services**,
-depending on the user's configuration. Read about all subcommands of `teleport`
-in our [CLI Reference](./reference/cli/teleport.mdx).
+Each Teleport process can run one or more services. Different services enable different Teleport functions. For example, the SSH Service provides SSH access
+to a resource, and the Database Service proxies connections to databases. Read about all subcommands of `teleport` in our [CLI Reference](./reference/cli/teleport.mdx). 
+
+### Teleport SSH Service
+
+An SSH server implementation that allows users to execute commands on remote
+machines while taking advantage of Teleport's built-in access controls,
+auditing, and session recording. The SSH service is enabled by default.
+
+Read more about the [Teleport SSH Service](./enroll-resources/server-access/server-access.mdx).
+
+### Teleport Kubernetes Service
+
+Proxies HTTP traffic to the Kubernetes API server. Use for Access control and session tracking for Kubernetes.
+
+Read more about the [Teleport Kubernetes
+Service](./enroll-resources/kubernetes-access/introduction.mdx)
 
 ### Teleport Application Service
 
 Proxies HTTP and TCP traffic to user-configured endpoints, e.g., internal web
-applications or the AWS Console.
+applications or the AWS Console. Protect your internal tools and dashboards.
 
 Read more about the [Teleport Application
-Service](./enroll-resources/application-access/introduction.mdx).
+Service](./enroll-resources/application-access/application-access.mdx).
 
 ### Teleport Database Service
 
 Proxies TCP traffic in the native protocols of popular databases, including
-PostgreSQL and MySQL.
+PostgreSQL and MySQL. Use to enforce role-based access to databases with full audit logging.
 
 Read more about the [Teleport Database
 Service](./enroll-resources/database-access/database-access.mdx).
 
+### Teleport Discovery Service
+
+The Teleport Discovery Service automates the process of finding and enrolling cloud resources such as AWS EC2 instances and Azure VMs into a 
+Teleport cluster. It continuously scans supported cloud environments and adds matching resources based on configured rules, 
+reducing the need for manual node registration. 
+
+Read more about the [Teleport Discovery Service](./enroll-resources/auto-discovery/auto-discovery.mdx).
+
 ### Teleport Desktop Service
 
-Proxies Remote Desktop Protocol traffic to Windows desktops.
+Proxies Remote Desktop Protocol (RDP) traffic to Windows desktops. Enables access control and session recording for Windows systems
 
 Read more about the [Teleport Desktop
 Service](./enroll-resources/desktop-access/introduction.mdx).
 
-### Teleport Kubernetes Service
+### Teleport Jamf Service
 
-Proxies HTTP traffic to the Kubernetes API server.
+The Jamf Service integrates with Jamf to enrolls trusted devices for macOS endpoints. 
+Before a user is granted access, Teleport checks the device's compliance status with Jamf. 
+This service is ideal for organizations that need to verify macOS device posture as part of 
+their access control strategy, ensuring only trusted devices are allowed to connect. 
+[Read more about the Jamf Service](./identity-governance/device-trust/jamf-integration.mdx).
 
-Read more about the [Teleport Kubernetes
-Service](./enroll-resources/kubernetes-access/introduction.mdx)
+### Teleport Debug Service
 
-### Teleport SSH Service
+Provides internal diagnostics, exposing metrics, performance profiling tools, and debugging endpoints. 
+It is designed for measuring performance, troubleshooting scenarios, and enabling operators to change the logging level without restarting teleport. 
+This can be helpful for analyzing bottlenecks, or diagnosing unexpected behavior in a controlled environment. The debug service is exposed locally by default.
+[Read more about the Debug Service](zero-trust-access/management/diagnostics/troubleshooting.mdx#step-13-enable-verbose-logging).
 
-An SSH server implementation that allows users to execute commands on remote
-machines while taking advantage of Teleport's built-in access controls,
-auditing, and session recording.
+## Agent
 
-Read more about the [Teleport SSH Service](./enroll-resources/server-access/introduction.mdx).
+A Teleport instance that runs one or more services to provide access to infrastructure resources. 
+It can be hosted separately from the resources it manages, but all agents must run within the same network as their target resources.
 
-### Machine ID
+## Machine & Workload Identity
 
 Allows machines and services—called bot users—to communicate securely with
 resources in your infrastructure by automatically provisioning and renewing
@@ -110,17 +139,15 @@ Bot users can connect to resources in your infrastructure without relying
 on static credentials (e.g., certificates and private keys) that become more
 vulnerable to attacks the longer they remain in use.
 
-Unlike other **Teleport services**, Machine ID runs via the `tbot` binary,
-rather than the `teleport` binary.
+Unlike other **Teleport services**, Machine & Workload Identity runs via the
+`tbot` binary, rather than the `teleport` binary.
 
-Read more in our [Machine ID guide](./enroll-resources/machine-id/introduction.mdx).
+### `tbot`
 
-### Agent
+`tbot` is a lightweight agent designed to provision short-lived credentials to workloads and automation systems like CI/CD pipelines. 
+It enables secure machine and workload authentication without relying on long-lived secrets. This makes it ideal for infrastructure automation and Zero Trust deployments.
 
-An instance of a **Teleport service** is called an **agent**. For all Teleport
-services besides the **Teleport SSH Service**, an agent can enable access to
-multiple resources, and can run on a separate host from the resources it enables
-access to. All agents must run in the same network as their target resources.
+Read more in our [Machine & Workload Identity documentation](./machine-workload-identity/machine-workload-identity.mdx).
 
 ## Teleport editions
 
@@ -143,7 +170,7 @@ and **Proxy Service**, including upgrades and certificate management. Each
 customer account, known as a **Teleport Enterprise Cloud tenant**, has its own
 subdomain of `.teleport.sh`, e.g., `mytenant.teleport.sh`.
 
-Read more in our [Teleport Enterprise (Cloud) getting started guide](./get-started.mdx).
+Read more in our [Teleport Enterprise (Cloud) getting started guide](./get-started/deploy-cloud.mdx).
 
 ### Teleport Enterprise
 
@@ -153,7 +180,7 @@ advanced security needs, such as support for Federal Information Processing
 Standards (FIPS) and a hardware security module (HSM). Teleport Enterprise
 includes a support agreement with Teleport.
 
-[Read the documentation](admin-guides/deploy-a-cluster/deploy-a-cluster.mdx) on
+[Read the documentation](zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx) on
 self-hosting Teleport.
 
 ### Teleport Community Edition
@@ -167,7 +194,7 @@ A **configuration resource** is a document stored on the **Teleport Auth
 Service** backend that specifies settings for your **Teleport cluster**.
 Examples include **roles**, **local users**, and **authentication connectors**
 
-Read more in our [resource reference](./reference/resources.mdx).
+Read more in our [resource reference](reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx).
 
 ### Role
 
@@ -176,7 +203,7 @@ privileges within a cluster. Teleport's role-based access control (RBAC) is
 restrictive by default, and a user needs explicit permissions before they can
 access a resource or perform management tasks on a cluster.
 
-Read our [guide to Teleport roles](admin-guides/access-controls/guides/role-templates.mdx).
+Read our [guide to Teleport roles](zero-trust-access/rbac-get-started/role-templates.mdx).
 
 ### Teleport users
 
@@ -196,7 +223,7 @@ subject of the certificate—including its username and Teleport roles—to
 authorize the user.
 
 Read more about [local users](reference/access-controls/authentication.mdx) and how [SSO
-authentication works in Teleport](admin-guides/access-controls/sso/sso.mdx).
+authentication works in Teleport](zero-trust-access/sso/sso.mdx).
 
 ### Authentication connector
 
@@ -216,6 +243,36 @@ users, roles, and resources, but the trust relationship allows users with certai
 in the root cluster to be mapped to roles and permissions defined in the leaf cluster.
 
 For more information about how to configure a trust relationship between clusters,
-see [Configure Trusted Clusters](admin-guides/management/admin/trustedclusters.mdx).
-For an overview of the architecture used in a trusted cluster relationship, see
-[Trusted Cluster Architecture](reference/architecture/trustedclusters.mdx).
+see [Configure Trusted Clusters](zero-trust-access/deploy-a-cluster/trustedclusters.mdx). For an overview of the architecture used in a trusted cluster relationship, see [Trusted Cluster Architecture](reference/architecture/trustedclusters.mdx).
+
+## Teleport clients
+
+A **Teleport client** connects to a Teleport cluster to authenticate, request access, or interact with resources such as servers, databases, Kubernetes clusters, desktops, or internal web apps. Clients use short-lived certificates and Teleport’s Role-Based Access Control (RBAC) to ensure secure, auditable access. All clients rely on the Teleport Auth Service to verify identity and issue credentials, and they may connect through the Proxy Service when accessing resources behind firewalls or in private networks.
+
+### `tsh`
+
+`tsh` is the command-line tool used by Teleport users to authenticate, connect to infrastructure resources, and manage active sessions. 
+It supports SSH, Kubernetes, databases, and applications. This tool is commonly used by engineers and operators who prefer terminal-based workflows.
+
+### `tctl`
+
+`tctl` is the administrative command-line interface for managing a Teleport cluster. It allows administrators to configure roles, manage users, and work with resources such as tokens, trusted clusters, and audit logs. 
+It's typically used during initial cluster setup and for ongoing administrative tasks.
+
+### Teleport Connect
+
+**Teleport Connect** is a graphical desktop application that provides an intuitive interface for accessing infrastructure resources such as 
+servers, databases, applications, and desktops. It's ideal for engineers who prefer GUI-based access for their day-to-day tasks, offering the same secure, certificate-based access as other Teleport clients.
+
+### Teleport Kubernetes Operator
+
+The Teleport Kubernetes Operator is a controller that runs in your Kubernetes cluster to automate the configuration of Teleport resources, 
+such as users, roles, and Access Requests, using Kubernetes custom resources.
+
+### Teleport Terraform Provider
+
+The Teleport Terraform Provider allows you to manage Teleport resources such as users, roles, and connectors using Terraform. 
+It enables infrastructure-as-code workflows for configuring access and automating resource provisioning in Teleport.
+
+Further reading:
+- [Introduction to Teleport clients](./connect-your-client/connect-your-client.mdx) Authenticate to Teleport and access protected resources. Designed for end users with links to additional documentation.
diff --git a/docs/pages/enroll-resources/agents/add-service-to-agent.mdx b/docs/pages/enroll-resources/agents/add-service-to-agent.mdx
index 71a674f26f3a8..82f7c52bbf61e 100644
--- a/docs/pages/enroll-resources/agents/add-service-to-agent.mdx
+++ b/docs/pages/enroll-resources/agents/add-service-to-agent.mdx
@@ -1,6 +1,11 @@
 ---
 title: Enable a New Service on an Agent
+sidebar_label: Enabling a New Service
 description: Explains how to edit the services that are running on a Teleport Agent.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 A single Teleport Agent can run multiple services. This guide shows you how to
@@ -249,18 +254,18 @@ While this guide shows you how to create a token using `tctl`, you can also
 manage tokens using the Teleport Terraform provider or Kubernetes operator. See
 the following documentation for information on the token resource:
 - [Terraform
-  provider](../../reference/terraform-provider/resources/provision_token.mdx)
+  provider](../../reference/infrastructure-as-code/terraform-provider/resources/provision_token.mdx)
 - [Kubernetes
-  operator](../../reference/operator-resources/resources-teleport-dev-provisiontokens.mdx)
+  operator](../../reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens.mdx)
 
 You can set up a system to automate the process of assigning join tokens to
 agents, ensuring that all Teleport services you run have the correct join
 token permissions. Here are examples in the documentation:
 - [Enroll Infrastructure with
-  Terraform](../../admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx):
+  Terraform](../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx):
   Using Terraform to launch Teleport Agent instances that depend on join token
   resources.
 - [Automatically Register Resources with
-  Teleport](../../admin-guides/api/automatically-register-agents.mdx): Writing a
+  Teleport](../../zero-trust-access/api/automatically-register-agents.mdx): Writing a
   compute platform client that automatically creates join tokens and launches
   Teleport Agents with them.
diff --git a/docs/pages/enroll-resources/agents/agents.mdx b/docs/pages/enroll-resources/agents/agents.mdx
index 0026eed4c4a08..4bd3d73f28f47 100644
--- a/docs/pages/enroll-resources/agents/agents.mdx
+++ b/docs/pages/enroll-resources/agents/agents.mdx
@@ -1,6 +1,11 @@
 ---
 title: Joining Teleport Agents
 description: Deploy Agents to enroll resources in your infrastructure with Teleport. You can run multiple Teleport services per Agent.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+sidebar_position: 8
 ---
 
 You can use Teleport to protect infrastructure resources like servers and
@@ -17,7 +22,7 @@ the services that run on it.
 ![Diagram showing the architecture of an Agent pool](../../../img/agent-pool-diagram.png)
 
 Read our guide for how to use Terraform to [deploy a pool of
-Agents](../../admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx). 
+Agents](../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx). 
 
 For more information on the architecture of Teleport Agents, read
 [Teleport Agent Architecture](../../reference/architecture/agents.mdx).
diff --git a/docs/pages/enroll-resources/agents/argocd-helm.mdx b/docs/pages/enroll-resources/agents/argocd-helm.mdx
new file mode 100644
index 0000000000000..a6ae876b82011
--- /dev/null
+++ b/docs/pages/enroll-resources/agents/argocd-helm.mdx
@@ -0,0 +1,177 @@
+---
+title: Running Teleport Agents using Helm via ArgoCD
+sidebar_label: Argo CD
+description: How to install and configure Teleport Kubernetes agent using Helm and ArgoCD
+tags:
+ - ci-cd
+ - platform-wide
+ - how-to
+---
+
+Teleport can provide secure, unified access to your Kubernetes clusters. This
+guide will show you how to deploy Teleport Kubernetes agent on a Kubernetes cluster using Helm
+and ArgoCD.
+
+## How it works
+
+Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This is used to orchestrate large deployments, and avoid the Kubernetes resources to drift from the desired deployment.
+
+Teleport has [an official Helm chart (`teleport-kube-agent`)](../../reference/helm-reference/teleport-kube-agent.mdx) that deploys a Teleport Agent in a Kubernetes cluster. The agent can be configured to run several services, but by default it runs the `kubernetes_service` to provide access to the Kubernetes API via Teleport.
+
+This guide leverages ArgoCD's native Helm support to deploy the Teleport Agent using the `teleport-kube-agent` Helm chart.
+
+## Prerequisites
+
+- An existing Kubernetes cluster you wish to provide access to via Teleport.
+- (!docs/pages/includes/tctl.mdx!)
+- An existing ArgoCD instance (version 2.10 or greater) that can deploy to the
+  above Kubernetes cluster.
+- The `tsh` client tool v(=teleport.version=)+ installed on your workstation.
+  You can download this from our [installation page](../../installation/installation.mdx).
+  
+## Step 1/3. Generate a join token
+
+Teleport agents use a join token to obtain certificates and connect to Teleport. See [joining docs](../../reference/deployment/join-methods.mdx) for more information.
+The token is only used to join initially, the Teleport Kube agent will store its
+certificates in Kubernetes and won't need a token to join again in the future.
+In this section, we will create a token for the agent to join the Teleport cluster.
+```code
+$ tctl tokens add --type=kube,app --ttl=5m
+```
+
+You can specify the following token types:
+
+(!docs/pages/includes/token-types.mdx!)
+
+See the `teleport-kube-agent` [chart
+reference](../../reference/helm-reference/teleport-kube-agent.mdx#roles) for the
+roles and token types that the chart supports.
+
+## Step 2/3. Configure and deploy the `teleport-kube-agent` Helm chart via ArgoCD
+
+1. Create a namespace for Teleport and configure its Pod Security Admission,
+   which enforces security standards on pods in the namespace:
+
+   ```code
+   $ kubectl create namespace teleport
+   namespace/teleport created
+   
+   $ kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
+   namespace/teleport labeled
+   ```
+
+2. Create a new ArgoCD application using the following as a template.
+
+``` yaml
+project: default
+source:
+  repoURL: 'https://charts.releases.teleport.dev'
+  targetRevision: (=teleport.version=)
+  helm:
+    values: |-
+      roles: kube,app
+      authToken: $YOUR_AUTH_TOKEN
+      proxyAddr: $YOUR_PROXY_ADDRESS
+      kubeClusterName: $YOUR_KUBE_CLUSTER_NAME
+
+      highAvailability:
+          replicaCount: 2
+          podDisruptionBudget:
+              enabled: true
+              minAvailable: 1
+  chart: teleport-kube-agent
+destination:
+  server: 'https://kubernetes.default.svc'
+  namespace: teleport
+# This section is used to allow the teleport-kube-agent-updater to update the agent
+# without ArgoCD reverting the update.
+ignoreDifferences:
+  - group: apps
+    kind: StatefulSet
+    name: $YOUR_APPLICATION_NAME
+    namespace: teleport
+    jqPathExpressions:
+      - '.spec.template.spec.containers[] | select(.name == "teleport").image'
+```
+
+3. Sync your changes to apply the configuration using the following command:
+```bash
+$ argocd app sync $YOUR_APPLICATION_NAME
+```
+4. To verify setup, navigate to the 'Resources' page in your Teleport
+   cluster to confirm the Kubernetes cluster is registered.
+
+## Step 3/3. Manage access to your new resource
+
+In this step, we'll create a Teleport role called `kube-access`
+that allows users to send requests to any Teleport-protected Kubernetes
+cluster as a member of the `viewers` group. The Teleport Kubernetes Service
+will impersonate the `viewers` group when proxying requests from those users.
+
+1. Create a file called `kube-access.yaml` with the following content:
+
+   ```yaml
+   kind: role
+   metadata:
+     name: kube-access
+   version: v7
+   spec:
+     allow:
+       kubernetes_labels:
+         '*': '*'
+       kubernetes_resources:
+         - kind: '*'
+           namespace: '*'
+           name: '*'
+           verbs: ['*']
+       kubernetes_groups:
+       - viewers
+     deny: {}
+   ```
+
+1. Apply your changes:
+
+   ```code
+   $ tctl create -f kube-access.yaml
+   ```
+
+   (!docs/pages/includes/create-role-using-web.mdx!)
+
+1. (!docs/pages/includes/add-role-to-user.mdx role="kube-access"!)
+
+While you have authorized the `kube-access` role to access Kubernetes clusters
+as a member of the `viewers` group, this group does not yet have permissions
+within its Kubernetes cluster. To assign these permissions, create a Kubernetes
+`RoleBinding` or `ClusterRoleBindings` that grants permission to the `viewers`
+group.
+
+1. Create a file called `viewers-bind.yaml` with the following contents:
+
+   ```yaml
+   apiVersion: rbac.authorization.k8s.io/v1
+   kind: ClusterRoleBinding
+   metadata:
+     name: viewers-crb
+   subjects:
+   - kind: Group
+     # Bind the group "viewers" to the kubernetes_groups assigned in the "kube-access" role
+     name: viewers
+     apiGroup: rbac.authorization.k8s.io
+   roleRef:
+     kind: ClusterRole
+     # "view" is a default ClusterRole that grants read-only access to resources
+     # See: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
+     name: view
+     apiGroup: rbac.authorization.k8s.io
+   ```
+
+1. Apply the `ClusterRoleBinding` with `kubectl`:
+
+   ```code
+   $ kubectl apply -f viewers-bind.yaml
+   ```
+
+Your Teleport user now has permissions to assume membership in the `viewers`
+group when accessing your Kubernetes cluster, and the `viewers` group now has
+permissions to view resources in the cluster.
+
diff --git a/docs/pages/enroll-resources/agents/aws-ec2.mdx b/docs/pages/enroll-resources/agents/aws-ec2.mdx
index a3e795c535404..4414ef5f58a6e 100644
--- a/docs/pages/enroll-resources/agents/aws-ec2.mdx
+++ b/docs/pages/enroll-resources/agents/aws-ec2.mdx
@@ -1,6 +1,12 @@
 ---
 title: Joining Services via AWS EC2 Identity Document
+sidebar_label: EC2 Identity Document
 description: Use the EC2 join method to add services to your Teleport cluster on AWS
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 This guide explains how to use the **EC2 join method** to configure Teleport
@@ -37,7 +43,7 @@ Teleport processes joining the cluster.
 
 ## Prerequisites
 
-(!docs/pages/includes/self-hosted-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="self-hosted Teleport"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 - An AWS EC2 instance to host a Teleport process, with the Teleport binary
diff --git a/docs/pages/enroll-resources/agents/aws-iam.mdx b/docs/pages/enroll-resources/agents/aws-iam.mdx
index aaa6aac84b6a1..6611ef9cf6338 100644
--- a/docs/pages/enroll-resources/agents/aws-iam.mdx
+++ b/docs/pages/enroll-resources/agents/aws-iam.mdx
@@ -1,6 +1,12 @@
 ---
 title: Joining Services via AWS IAM Role
+sidebar_label: IAM Role
 description: Use the IAM join method to add services to your Teleport cluster on AWS
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 This guide explains how to use the **IAM join method** to configure Teleport
@@ -36,9 +42,6 @@ pre-signed `sts:GetCallerIdentity` request to the Teleport Auth Service. The
 service's identity must match an allow rule configured in your AWS service
 joining token.
 
-Support for joining a cluster with the Proxy Service behind a layer 7 load
-balancer or reverse proxy is available in Teleport 13.0+.
-
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
diff --git a/docs/pages/enroll-resources/agents/azure.mdx b/docs/pages/enroll-resources/agents/azure.mdx
index c2c91234dba3f..ce9bdace79079 100644
--- a/docs/pages/enroll-resources/agents/azure.mdx
+++ b/docs/pages/enroll-resources/agents/azure.mdx
@@ -1,6 +1,12 @@
 ---
 title: Joining Services via Azure Managed Identity
+sidebar_label: Azure Managed Identity
 description: Use the Azure join method to join Teleport services to your Teleport cluster on Azure
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 This guide will explain how to use the **Azure join method** to configure
@@ -8,12 +14,18 @@ Teleport instances to join your Teleport cluster without sharing any secrets
 when they are running in an Azure Virtual Machine.
 
 The Azure join method is available to any Teleport process running in an
-Azure Virtual Machine. Support for joining a cluster with the Proxy Service
-behind a layer 7 load balancer or reverse proxy is available in Teleport 13.0+.
+Azure Virtual Machine.
 
 For other methods of joining a Teleport process to a cluster, see [Joining
 Teleport Services to a Cluster](agents.mdx).
 
+## How it works
+
+Under the hood, Teleport processes prove that they are running in your Azure
+subscription by sending a signed attested data document and access token to the
+Teleport Auth Service. The VM's identity must match an allow rule configured in
+your Azure joining token.
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
@@ -21,24 +33,61 @@ Teleport Services to a Cluster](agents.mdx).
 - An Azure Virtual Machine running Linux with the Teleport binary installed. The
   Virtual Machine must have a [Managed
   Identity](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
-  assigned to it with permission to read virtual machine info.
+  assigned to it.
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/5. Set up a Managed Identity
 
 Every virtual machine hosting a Teleport process using the Azure method to join
-your Teleport cluster needs a Managed Identity assigned to it. The identity
-requires the `Microsoft.Compute/virtualMachines/read` permission so Teleport can
-look up the virtual machine. No other permissions are required.
+your Teleport cluster needs a Managed Identity assigned to it.
 
-(!docs/pages/includes/server-access/azure-join-managed-identity.mdx!)
+<Tabs>
+<TabItem label="Azure Portal">
 
-## Step 2/5. Create the Azure joining token
+To set up a Managed Identity:
+1. Navigate to [Virtual machines view](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
+if you're hosting Teleport on an Azure VM,
+or navigate to [Virtual machine scale sets view](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachineScaleSets)
+if you're hosting Teleport on an Azure VMSS.
+2. Select the VM or VMSS hosting your Teleport Service.
+3. In the right-side panel, click the **Security/Identity** tab.
+4. Under the **Identity** section, select the **System assigned** tab.
+5. Toggle the **Status** switch to **On**.
+6. Click **Save**.
+
+If you're using VMSS and it is configured with manual upgrade mode, you must
+update the VM instances for the identity changes to take effect:
+- Click the **Instances** tab in the right panel.
+- Select the VM instances to update.
+- Click **Restart**.
+
+</TabItem>
+<TabItem label="Azure CLI">
+
+To attach a system-assigned identity to a regular VM, run:
+
+```code
+$ az vm identity assign --resource-group <resource-group> --name <vm-name>
+```
+
+To attach a system-assigned identity to an Azure VMSS, run:
 
-Under the hood, Teleport processes will prove that they are running in your
-Azure subscription by sending a signed attested data document and access token
-to the Teleport Auth Service. The VM's identity must match an allow rule
-configured in your Azure joining token.
+```code
+$ az vmss identity assign --resource-group <resource-group> --name <vmss-name>
+```
+
+If you're using VMSS and it is configured with manual upgrade mode, you must
+update the VM instances for the identity changes to take effect. Run the following
+command to propagate the identity change:
+
+```code
+$ az vmss update-instances --resource-group <resource-group> --name <vmss-name> --instance-ids *
+```
+
+</TabItem>
+</Tabs>
+
+## Step 2/5. Create the Azure joining token
 
 Create the following `token.yaml` with an `allow` rule specifying your Azure
 subscription and the resource group that your VM's identity must match.
@@ -77,7 +126,8 @@ teleport:
     token_name: azure-token
     method: azure
     azure:
-      # client_id is the client ID of the managed identity created in Step 1.
+      # client_id is the client ID of a user-assigned managed identity.
+      # Omit this value when using a system-assigned managed identity.
       client_id: 11111111-1111-1111-1111-111111111111
   proxy_server: teleport.example.com:443
 ssh_service:
diff --git a/docs/pages/enroll-resources/agents/gcp.mdx b/docs/pages/enroll-resources/agents/gcp.mdx
index 21ab337506e95..e90b2a9834354 100644
--- a/docs/pages/enroll-resources/agents/gcp.mdx
+++ b/docs/pages/enroll-resources/agents/gcp.mdx
@@ -1,18 +1,30 @@
 ---
 title: Join Services with GCP
+sidebar_label: Google Cloud
 description: Use the GCP join method to add services to your Teleport cluster.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 This guide will explain how to use the **GCP join method** to configure Teleport
 processes to join your Teleport cluster without sharing any secrets when they
 are running in a GCP VM.
 
+## How it works
+
 The GCP join method is available to any Teleport process running on a GCP VM.
 The VM must have a
 [service account](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
 assigned to it (the default service account is fine). No IAM roles are required
 on the Teleport process joining the cluster.
 
+Under the hood, services prove that they are running in your GCP project by
+sending a signed ID token which matches an allow rule configured in your GCP
+joining token.
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
@@ -26,10 +38,6 @@ on the Teleport process joining the cluster.
 Configure your Teleport Auth Service with a special dynamic token which will
 allow services from your GCP projects to join your Teleport cluster.
 
-Under the hood, services will prove that they are running in your GCP project
-by sending a signed ID token which matches an allow rule configured in your GCP
-joining token.
-
 Create the following `token.yaml` file with a `gcp.allow` rule specifying your GCP
 project ID(s), service account(s), and location(s) in which your GCP instances
 will run:
diff --git a/docs/pages/enroll-resources/agents/join-token.mdx b/docs/pages/enroll-resources/agents/join-token.mdx
index c2fc4c43d9d6d..b5572a31f8104 100644
--- a/docs/pages/enroll-resources/agents/join-token.mdx
+++ b/docs/pages/enroll-resources/agents/join-token.mdx
@@ -1,8 +1,15 @@
 ---
 title: Join Services with a Secure Token
+sidebar_label: Secure Token
 description: This guide shows you how to join a Teleport instance to your cluster using a join token in order to proxy access to resources in your infrastructure.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 In this guide, we will show you how to register a Teleport process running one
 or more services to your cluster by presenting a **join token**.
 
@@ -24,8 +31,7 @@ relationship with the Teleport cluster.
   accessing resources in your infrastructure.
 
   <details>
-  <summary>tip" title="Running multiple Proxy Service instances behind</summary>
-  load balancer" >
+  <summary>Running multiple Proxy Service instances behind a load balancer</summary>
 
   The join token method works if a cluster includes a single Proxy Service
   instance as well as multiple Proxy Service instances behind a load balancer
@@ -100,13 +106,14 @@ the `tctl tokens add` output.
 
 Here are all the values we support for `--type` flag when creating a join token:
 
-(!docs/pages/includes/token-types.mdx)
+(!docs/pages/includes/token-types.mdx!)
 
 </details>
 
 Administrators can generate tokens as they are needed. A Teleport process can
 use a token multiple times until its time to live (TTL) expires, with the
-exception of tokens with the `bot` type, which are used by Machine ID.
+exception of tokens with the `bot` type, which are used by Machine & Workload
+Identity.
 
 To list all of the tokens you have generated, run the following command:
 
@@ -120,7 +127,7 @@ Token                            Type Labels Expiry Time (UTC)
 <details>
 <summary>An insecure alternative: static tokens</summary>
 
-<Admonition type="Danger">
+<Admonition type="danger">
 Use short-lived tokens instead of long-lived static tokens.
 Static tokens are easier to steal, guess, and leak.
 </Admonition>
@@ -329,4 +336,4 @@ $ tctl tokens rm <Var name="token-to-delete"/>
 ## Next steps
 
 - If you have workloads split across different networks or clouds, we recommend
-  setting up trusted clusters. Read how to get started in [Configure Trusted Clusters](../../admin-guides/management/admin/trustedclusters.mdx).
+  setting up trusted clusters. Read how to get started in [Configure Trusted Clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx).
diff --git a/docs/pages/enroll-resources/agents/kubernetes.mdx b/docs/pages/enroll-resources/agents/kubernetes.mdx
index 345f41d5f5aa2..45ae40db5b6ef 100644
--- a/docs/pages/enroll-resources/agents/kubernetes.mdx
+++ b/docs/pages/enroll-resources/agents/kubernetes.mdx
@@ -1,6 +1,11 @@
 ---
 title: Joining Services via Kubernetes ServiceAccount Token
+sidebar_label: Kubernetes Token
 description: Use Kubernetes ServiceAccount tokens to join services running in the same Kubernetes cluster as the Auth Service.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide will explain how to use the **Kubernetes join method** to configure
@@ -29,7 +34,7 @@ as the Auth Service.
 ## Prerequisites
 
 - A running Teleport cluster in Kubernetes. For details on how to set this up,
-  see [Guides for running Teleport using Helm](../../admin-guides/deploy-a-cluster/helm-deployments/helm-deployments.mdx).
+  see [Guides for running Teleport using Helm](../../zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx).
 - Editor access to the Kubernetes cluster running the Teleport cluster.
   You must be able to create Namespaces and Deployments.
 - A Teleport user with `access` role, or any other role that allows access to
@@ -243,6 +248,6 @@ namespace "teleport-agent" deleted
 {/* vale messaging.protocol-products = NO */}
 - The possible values for `teleport-kube-agent` chart are documented
   [in its reference](../../reference/helm-reference/teleport-kube-agent.mdx).
-- See [Application Access Guides](../application-access/guides/guides.mdx)
+- See [Application Access guides](../application-access/application-access.mdx)
 - See [Database Access Guides](../database-access/guides/guides.mdx)
 {/* vale messaging.protocol-products = YES */}
diff --git a/docs/pages/enroll-resources/agents/oracle.mdx b/docs/pages/enroll-resources/agents/oracle.mdx
index d20b1d9c120a4..204111a7a1d50 100644
--- a/docs/pages/enroll-resources/agents/oracle.mdx
+++ b/docs/pages/enroll-resources/agents/oracle.mdx
@@ -1,18 +1,38 @@
 ---
 title: Join Services with Oracle Cloud
+sidebar_label: Oracle Cloud
 description: Use the Oracle join method to add services to your Teleport cluster.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide will explain how to use the **Oracle join method** to configure
 Teleport processes to join your Teleport cluster without sharing any secrets
 when they are running in an Oracle Cloud Infrastructure (OCI) Compute instance.
 
+## How it works
+
 The Oracle join method is available to any Teleport process running on an
 OCI Compute instance.
 
+Under the hood, services prove that they are running in your OCI tenant by
+sending their signed OCI instance identity certificate to the Auth Service,
+along with a cryptographic signature proving ownership of the instance's
+private key.
+The Auth Service verifies the instance identity certificate was signed by
+Oracle's root CAs and that the signature is valid.
+The certificate verifies the instance's tenancy, compartment, and instance ID
+and matches them against rules configured in an Oracle joining token.
+
+Instances running a version older than Teleport v18.4.0 do not send the
+instance identity certificate, instead they send a presigned
+self-authentication request to the OCI API for the Auth Service to execute.
+
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs.mdx version="17.3.0"!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v17.3.0 or higher)"!)
 
 - An OCI Compute instance to host a Teleport service.
 - (!docs/pages/includes/tctl.mdx!)
@@ -22,13 +42,11 @@ OCI Compute instance.
 Configure your Teleport Auth Service with a special dynamic token which will
 allow services from your OCI tenants to join your Teleport cluster.
 
-Under the hood, services will prove that they are running in your OCI
-tenant by sending a presigned self-authentication request to the OCI API
-for the Auth Service to execute.
-
 Create the following `token.yaml` file with an `oracle.allow` rule specifying
 the Oracle tenant(s), compartment(s), and region(s) in which your OCI
-Compute instances will run:
+Compute instances will run.
+In Teleport v18.4.0 or higher you can also specify exact compute instance OCIDs
+that will be allowed.
 
 (!docs/pages/includes/provision-token/oracle-spec.mdx!)
 
@@ -40,14 +58,20 @@ $ tctl create token.yaml
 
 ## Step 2/5. Configure permissions
 
-Every OCI Compute instance needs permission to authenticate itself with the
-Oracle Cloud API so the presigned request can succeed.
+On Teleport versions older than v18.4.0, every OCI compute instance needs IAM
+permissions to authenticate itself with the Oracle Cloud API.
+Newer Teleport versions do not require any permissions.
+The permissions are only required if either the Auth Service or the joining
+instance is running a Teleport version older than v18.4.0.
+
+<details>
+<summary>Configuring OCI IAM Permissions</summary>
 
 ### Create a dynamic group
 
 In the OCI console, navigate to
 [Identity/Domains](https://cloud.oracle.com/identity/domains).
-Select your domain, then select **Dynamic groups**. Click **Create dynamic
+Select the currently active domain, then select **Dynamic groups**. Click **Create dynamic
 group**. Create a group with the following matching rule, assigning 
 <Var name="compartment-id" /> to the OCID of the compartment your instance is
 in:
@@ -78,6 +102,8 @@ Allow dynamic-group '<Var name="identity-domain" />'/'join-teleport' to inspect
 
 ![Create policy](../../../img/oracle/oracle-join-policy@2x.png)
 
+</details>
+
 ## Step 3/5. Install Teleport
 
 Install Teleport on your OCI Compute instance.
@@ -116,3 +142,11 @@ proxy_service:
 
 Once you have started Teleport, confirm that your service is able to connect to
 and join your cluster.
+
+## Troubleshooting
+
+### Join fails with error `oci api error: Not Found`
+
+This error likely means that the instance does not have the required permissions.
+Check if the identity domain you created the dynamic group in has the Compute
+service active; if it doesn't, try creating the group in a domain that does.
diff --git a/docs/pages/enroll-resources/application-access/application-access.mdx b/docs/pages/enroll-resources/application-access/application-access.mdx
index 203fe2dc590ad..4ce3991e3bac6 100644
--- a/docs/pages/enroll-resources/application-access/application-access.mdx
+++ b/docs/pages/enroll-resources/application-access/application-access.mdx
@@ -1,6 +1,115 @@
 ---
 title: Applications
-description: Guides to using Teleport to protect web applications, cloud provider APIs, and more.
+description: Protect applications with Teleport by deploying the Teleport Application Service.
+template: doc-page
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
-<DocCardList />
+import DocHero from "@site/src/components/Pages/Landing/DocHero";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+import Resources from "@site/src/components/Pages/Homepage/Resources";
+
+import userCheckSvg from "@site/src/components/Icon/svg/user-check.svg";
+import slidersHorizontalSvg from "@site/src/components/Icon/svg/sliders-horizontal.svg";
+import graphSvg from "@site/src/components/Icon/svg/graph.svg";
+import questionSvg from "@site/src/components/Icon/svg/question2.svg";
+
+<DocHero
+  title="Enroll your first application"
+  youtubeVideoId="cvW4b96aPL0"
+  ctaLinks={[
+    {
+      title: "Get started with application access",
+      href: "./getting-started/",
+      variant: "secondary",
+      arrow: true,
+    },
+  ]}
+  links={[
+    {
+      title: "Role-based access control",
+      description: "Set up granular access policies for applications connected to Teleport.",
+      href: "./controls/",
+      icon: userCheckSvg,
+    }, 
+    {
+      title: "Configure Teleport as an IdP",
+      description: "Securely log into internal and external apps with Teleport as an identity provider.",
+      href: "../../identity-governance/idps/",
+      icon: slidersHorizontalSvg,
+    },
+    {
+      title: "VNet: Build without VPNs",
+      description: "Secure app and SSH access with no VPNs or proxies",
+      href: "./guides/vnet/",
+      icon: graphSvg,
+    }, 
+    {
+      title: "Troubleshooting",
+      description: "Common application access problems and their solutions.",
+      href: "./troubleshooting-apps/",
+      icon: questionSvg,
+    },
+  ]}
+>
+Teleport provides secure access to applications and cloud provider APIs with RBAC, audit logging, and just-in-time access. 
+
+The Teleport Application Service enables secure connections to private networks, supports Teleport JWTs for authentication, and provides guidance on app enrollment and access control configuration.
+
+Note that it is also possible to secure applications with Teleport Identity
+Governance by setting up Teleport as an IdP. See [Using the Teleport SAML
+IdP](../../identity-governance/idps/usage/usage.mdx).
+</DocHero>
+
+<UseCasesList
+  title="Enrolling applications"
+  variant="doc"
+  desktopColumnsCount={2}
+  useCases={[
+    {
+      title: "Cloud provider APIs",
+      description: "Secure access to cloud APIs, consoles, and CLI tools with Teleport RBAC.",
+      href: "./cloud-apis/",
+    },
+    {
+      title: "Web apps",
+      description: "Connect a web application to manage and control access, set up RBAC, audit logging and more.",
+      href: "./protect-apps/connecting-apps/",
+    }, 
+    {
+      title: "TCP apps",
+      description: "Connect to services not natively supported by Teleport, like SMTP servers and databases.",
+      href: "./protect-apps/tcp/",
+    },
+    {
+      title: "REST APIs",
+      description: "Use Teleport to access REST APIs with tools like curl or Postman.",
+      href: "./protect-apps/api-access/",
+    },
+  ]}
+/>
+
+<UseCasesList
+  title="Application access guides"
+  variant="doc"
+  desktopColumnsCount={3}
+  useCases={[ 
+    {
+      title: "Dynamic app registration",
+      description: "Admin can register new apps without updating static configuration files.",
+      href: "./configuration/dynamic-registration/",
+    },
+    {
+      title: "High availability app access",
+      description: "Configure the Teleport Application Service for high availability.",
+      href: "./configuration/ha/",
+    },
+    {
+      title: "JWT authentication",
+      description: "Secure web apps with Teleport-signed JWTs for identity-based access.",
+      href: "./jwt/",
+    }
+  ]}
+/>
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere.mdx
new file mode 100644
index 0000000000000..6c8d4eb5e6ee8
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere.mdx
@@ -0,0 +1,366 @@
+---
+title: AWS Console and CLI Access with Roles Anywhere
+sidebar_label: AWS (via Roles Anywhere)
+description: How to use AWS IAM Roles Anywhere with Teleport for AWS Console and CLI access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+Teleport integrates with AWS IAM Roles Anywhere to provide AWS Console and CLI access.
+This allows you to take advantage of Teleport role-based access controls, just-in-time Access Requests and other Teleport Zero Trust Access and Identity Governance capabilities to manage access to your AWS infrastructure.
+
+If you're already using AWS IAM Roles Anywhere and looking to protect access to your AWS environment with Teleport, while ensuring full compatibility with all AWS API based tooling (such as CLI tools or terraform), this guide provides a recommended way for you to do that.
+If you're looking to provide AWS CLI access to your users with audit capture by going through Teleport proxy, or Roles Anywhere are not adopted at your organization, take a look at the guide for [agent-based AWS access](aws-console.mdx) instead.
+
+This guide will explain how to:
+
+- Configure AWS Console and CLI access with Teleport using Roles Anywhere
+- Access the AWS Management Console
+- Access the AWS Command Line Interface (CLI)
+- Access applications using AWS SDKs
+
+## How it works
+
+Teleport uses AWS IAM Roles Anywhere to issue temporary credentials for assuming target IAM roles.
+
+Access is managed through Teleport's RBAC policies, ensuring credentials are only generated for authorized users and roles.
+No additional service is required, as it runs in the control plane (Proxy and Auth Services).
+
+For web console access, you can navigate to the resources page in Teleport Web UI and click on the AWS Application which is named after the Roles Anywhere profile.
+
+For CLI and SDK based access, you must use `tsh` to obtain AWS credentials.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- Permissions in AWS to:
+  - create IAM Roles Anywhere trust anchor
+  - create IAM Roles Anywhere profiles
+  - create IAM roles
+- `aws` command line interface (CLI) tool in PATH. Read the AWS documentation to
+  [install or update the latest version of the AWS
+  CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html).
+
+## Step 1/4. Configure AWS IAM Roles Anywhere integration
+
+In this section, you will configure AWS IAM resources to allow Teleport to issue AWS credentials.
+
+Navigate to the Teleport Web UI, click on Enroll New Resource in the Resources listing page, and follow the guide after clicking on AWS CLI/Console Access tile.
+
+<details>
+  <summary>Manually configure the integration</summary>
+
+  You will create the following resources in AWS:
+
+  | Name                                 | Resource                        | Function                                                                                  |
+  |--------------------------------------|---------------------------------|-------------------------------------------------------------------------------------------|
+  | `TeleportRolesAnywhereIntegrationCA` | IAM Roles Anywhere trust anchor | Allow access from Teleport into AWS.                                                      |
+  | `TeleportRolesAnywhereProfileSync`   | IAM role                        | Allows Teleport to iterate over AWS Roles Anywhere profiles and import them as resources. |
+  | `TeleportRolesAnywhereProfileSync`   | IAM Roles Anywhere profile      | Allows access to `TeleportRolesAnywhereProfileSync` IAM role.                             |
+
+  ### Create an IAM Roles Anywhere Trust Anchor
+
+  First, you will create an IAM Roles Anywhere Trust Anchor which trusts the Teleport's AWS Roles Anywhere CA.
+
+  1. Obtain the Teleport certificate:
+     ```code
+     $ tctl auth export --type awsra
+     -----BEGIN CERTIFICATE-----
+     MIIDqjCCApKgAwIBAgIQMIK8/WiQ/rUOrjlmB0IHVTANBgkqhkiG9w0BAQsFADBv
+     ...
+     -----END CERTIFICATE-----
+     ```
+  1. Navigate to [Create a trust anchor](https://console.aws.amazon.com/rolesanywhere/home/trust-anchors/create) page.
+    Name the trust anchor `TeleportRolesAnywhereIntegrationCA` and add the Teleport's `awsra` CA certificate you obtained in the previous step as an External certificate bundle.
+  1. Copy the Trust Anchor ARN <Var name="Trust Anchor ARN" />
+
+  ### Set up Profile Sync
+
+  Next, you will create the required AWS resources to enable the profile sync.
+
+  1. Navigate to [Create Role](https://console.aws.amazon.com/iam/home?#/roles/create) and create a new IAM role called `TeleportRolesAnywhereProfileSync`.
+    Trust policy must include the Roles Anywhere service principal:
+    ```json
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Principal": {
+                    "Service": "rolesanywhere.amazonaws.com"
+                },
+                "Action": [
+                    "sts:AssumeRole",
+                    "sts:SetSourceIdentity",
+                    "sts:TagSession"
+                ]
+            }
+        ]
+    }
+    ```
+  1. Copy the IAM role ARN <Var name="Role ARN" />
+  1. Navigate to the [TeleportRolesAnywhereProfileSync Role](https://console.aws.amazon.com/iam/home?#/roles/details/TeleportRolesAnywhereProfileSync) and create a new inline policy:
+    ```json
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "RolesAnywhereProfileSync",
+                "Effect": "Allow",
+                "Action": [
+                    "rolesanywhere:ListProfiles",
+                    "rolesanywhere:ListTagsForResource",
+                    "rolesanywhere:ImportCrl",
+                    "iam:GetRole"
+                ],
+                "Resource": [
+                    "*"
+                ]
+            }
+        ]
+    }
+    ```
+
+  1. Now, navigate to the [Create a Profile](https://console.aws.amazon.com/rolesanywhere/home/profiles/create) page and name it `TeleportRolesAnywhereProfileSync`.
+    Add the role created in the last step (`TeleportRolesAnywhereProfileSync`) and create the Profile.
+  1. Copy the Profile ARN <Var name="Profile ARN" />
+
+  ### Create a Teleport AWS IAM Roles Anywhere integration
+  Now that the required AWS resources are created, you can create a Teleport AWS IAM Roles Anywhere integration.
+
+  1. Write the following contents to a file called `roles-anywhere-integration.yaml`:
+    ```yaml
+    kind: integration
+    sub_kind: aws-ra
+    version: v1
+    metadata:
+      name: <Var name="Integration Name" />
+    spec:
+      aws_ra:
+        trust_anchor_arn: <Var name="Trust Anchor ARN" />
+        profile_sync_config:
+          enabled: true
+          profile_arn: <Var name="Profile ARN" />
+          role_arn: <Var name="Role ARN" />
+    ```
+
+  1. Create the integration with the following command:
+    ```code
+    $ tctl create -f roles-anywhere-integration.yaml
+    ```
+
+  Teleport will now start syncing AWS IAM Roles Anywhere profiles as AWS applications, every 5 minutes.
+</details>
+
+## Step 2/4. Create an AWS IAM Roles Anywhere profile and assign IAM roles
+
+Now, you will create an example profile and role so that you can test the integration.
+
+If you are already leveraging AWS IAM Roles Anywhere profiles, you can skip this step.
+
+1. Navigate to [Create role](https://console.aws.amazon.com/iam/home?#/roles/create) and create a new IAM role called `ExampleReadOnlyAccess`.
+  Trust policy must include the Roles Anywhere service principal:
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Principal": {
+                  "Service": "rolesanywhere.amazonaws.com"
+              },
+              "Action": [
+                  "sts:AssumeRole",
+                  "sts:SetSourceIdentity",
+                  "sts:TagSession"
+              ]
+          }
+      ]
+  }
+  ```
+
+  Add the AWS-managed `ReadOnlyAccess` policy to the role.
+  Copy the role ARN <Var name="Read Only Role ARN" />.
+
+1. Now, navigate to [Create a Profile](https://console.aws.amazon.com/rolesanywhere/home/profiles/create) page and name it `ExampleReadOnlyAccess`.
+  Add the role created in the last step (`ExampleReadOnlyAccess`) and create the Profile.
+  
+  Copy the Profile ARN <Var name="Read Only Profile ARN" />.
+
+## Step 3/4. Set up access
+Now you need to grant your users access to the imported AWS profiles/roles.
+You will create a Teleport role which will grant access to the `ExampleReadOnlyAccess` Profile and associated IAM role.
+
+  <Tabs>
+    <TabItem label="Web UI">
+    Open your Teleport cluster Web UI, select the "Zero Trust Access" and then "Roles".
+
+    Click the "Create New Role" button, set the role name to `aws-ro-access`.
+    Next, add an Application Access entry, in the Resources section, with the following:
+    - Labels: `teleport.dev/aws-roles-anywhere-profile-arn': '<Var name="Read Only Profile ARN" />'`
+    - AWS Role ARNs: <Var name="Read Only Role ARN" />
+
+    Proceed to the next steps and create the role.
+    </TabItem>
+
+    <TabItem label="Via tctl">
+      1. Create a file named `example-read-only-access-role.yaml` with the following contents:
+        ```yaml
+        kind: role
+        version: v8
+        metadata:
+          name: aws-ro-access
+        spec:
+          allow:
+            app_labels:
+              'teleport.dev/aws-roles-anywhere-profile-arn': '<Var name="Read Only Profile ARN" />'
+            aws_role_arns:
+            - <Var name="Read Only Role ARN" />
+        ```
+
+      1. Create the role with the following command:
+        ```code
+        $ tctl create -f example-read-only-access-role.yaml
+        ```
+    </TabItem>
+  </Tabs>
+
+Assign the Role to the users you want to allow access. You can also assign it to an [Access List](../../../identity-governance/access-lists/guide.mdx) or use it in conjunction with [Access Requests](../../../identity-governance/access-requests/access-requests.mdx).
+
+## Step 4/4. Access AWS resources
+
+Now that you have configured the Integration and set up the Role, users can access AWS resources through Teleport.
+
+### Access AWS Management Console
+
+1. Visit the home page of the Teleport Web UI and click **Resources**.
+   If the Integration found any profiles as expected, the Web UI will display the name of the Profile.
+   If you don't see any profiles, see the [Troubleshooting](#troubleshooting) section.
+
+1. Click the **Launch** button for the AWS Console application, then click on the role you would like to assume when signing in to the AWS Console:
+
+   ![IAM role selector](../../../../img/application-access/iam-role-selector.png)
+
+1. You will get redirected to the AWS Management Console, signed in with the selected role.
+   You should see your Teleport user name as a federated login assigned to `ExampleReadOnlyRole` in the top-right corner of the AWS Console:
+
+   ![Federated login](../../../../img/application-access/federated-login@2x.png)
+
+### Access AWS using AWS CLI or other AWS SDK based tools
+
+#### Obtain the credentials
+On your desktop, log into the AWS App Profile that was synced:
+
+```code
+$ tsh apps login --aws-role arn:aws:iam::278576220453:role/ExampleReadOnlyAccess example-read-only-access
+Logged into AWS app "example-read-only-access".
+
+Your IAM role:
+    arn:aws:iam::123456789012:role/ExampleReadOnlyAccess
+
+Example AWS CLI commands:
+    aws --profile example-read-only-access s3 ls
+    AWS_PROFILE=example-read-only-access aws s3 ls
+```
+
+#### Access AWS using AWS CLI
+You can now access all your AWS resources from the command line using the `aws` command line tool.
+
+You need to pass the `--profile` flag or export the `AWS_PROFILE` environment variable with the name of the profile you created earlier.
+
+```code
+$ aws --profile example-read-only-access s3 ls
+...
+```
+
+#### Access AWS from Terraform
+Using Terraform requires you to set the profile in the provider.
+```hcl
+provider "aws" {
+  profile = "example-read-only-access"
+  // ...
+}
+```
+
+Setting the `AWS_PROFILE` environment variable is also an option.
+
+## Troubleshooting
+
+Read this section if you run into issues while following this guide.
+
+### Missing Profiles in Resources page
+If you don't see the expected AWS profiles in the Teleport Web UI, check the following:
+
+1. Ensure the profile sync configuration is enabled and the `profile_name_filters` are set accordingly (set it to `*` if you want to import all the profiles):
+
+   ```code
+   $ tctl get integration/<Var name="Integration Name" />
+   ...
+   spec:
+     aws_ra:
+       profile_sync_config:
+         enabled: true
+         profile_arn: arn:aws:rolesanywhere:eu-west-2:123456789012:profile/5c659b8f-7ca3-48ef-a1aa-14c9c93506ee
+         profile_name_filters:
+         - MarcoRA-*
+         role_arn: arn:aws:iam::123456789012:role/TeleportRolesAnywhereProfileSync
+       trust_anchor_arn: arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/69a0c3f8-3157-49b2-85dd-75bdef828a68
+   ```
+
+1. You can get the integration status summary by running the following command:
+
+   ```code
+   $ tctl get integration/<Var name="Integration Name" />
+   ...
+   status:
+     aws_ra:
+       last_profile_sync:
+         end_time: "2025-07-23T15:46:27.475629Z"
+         error_message: ""
+         start_time: "2025-07-23T15:46:26.334536Z"
+         status: SUCCESS
+         synced_profiles: 4
+   ```
+
+   Look for any error message you might have.
+
+1. Ensure that your Teleport role allows you access to all the expected profiles.
+   AWS app resources have a specific label which you can use to control access: `teleport.dev/aws-roles-anywhere-profile-arn`.
+   Set it to `*` to allow access to all profiles, like so:
+
+   ```yaml
+   kind: role
+   spec:
+     allow:
+       app_labels:
+         'teleport.dev/aws-roles-anywhere-profile-arn': '*'
+   ```
+
+## Next steps
+
+Now that you know how to set up Teleport to protect access to the AWS Management Console and APIs, you can tailor your setup to the needs of your organization.
+
+### Refine your AWS IAM role mapping
+
+The `aws_role_arns` field supports template variables so they can be populated dynamically when a user authenticates to Teleport.
+
+For example, you can configure your identity provider to define a SAML attribute or OIDC claim called `aws_role_arns`, then use this field to list each user's permitted AWS role ARNs on your IdP.
+If you define a Teleport role to mention the `{{external.aws_role_arns}}` variable, the Auth Service will fill in the user's permitted ARNs based on data from the IdP:
+
+```yaml
+    aws_role_arns:
+    - {{external.aws_role_arns}}
+```
+
+See the [Access Controls Reference](../../../reference/access-controls/roles.mdx) for all of the variables and functions you can use in the `aws_role_arns` field.
+
+### Create Roles to grant access to a specific profile and IAM roles
+
+You can create multiple Teleport roles to grant access to the profiles and IAM roles for each Profile.
+
+See [Role Access Requests](../../../identity-governance/access-requests/role-requests.mdx) to learn more about creating Roles and how to access them using Access Requests.
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx
index 88eec03347ea5..9d8bdb92cf8ea 100644
--- a/docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/aws-console.mdx
@@ -1,8 +1,19 @@
 ---
-title: Access AWS With Teleport Application Access
+title: Access AWS with the Teleport Application Service
+sidebar_label: AWS (via Teleport Agent)
 description: How to access AWS with Teleport application access.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
+<Admonition type="tip">
+If you're using AWS IAM Roles Anywhere, see the [corresponding guide](aws-console-roles-anywhere.mdx) that provides
+the recommended way to manage access to AWS Console and CLI-based tooling.
+</Admonition>
+
 You can protect the AWS Management Console and AWS APIs with Teleport. This
 makes it possible to manage access to AWS infrastructure with Teleport features
 like Access Requests, Access Lists, and identity locking. You can also configure
@@ -829,7 +840,7 @@ for all of the variables and functions you can use in the `aws_role_arns` field.
 You can deploy a pool of Teleport Agents to run the Teleport Application
 Service, then enroll an AWS application in your Teleport cluster as a dynamic
 resource. Read more about [dynamically registering
-applications](../guides/dynamic-registration.mdx).
+applications](../configuration/dynamic-registration.mdx).
 
 ### Choose an alternative agent join method
 
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-console.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-console.mdx
new file mode 100644
index 0000000000000..c1adcd6666f30
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-console.mdx
@@ -0,0 +1,204 @@
+---
+title: Protect AWS CLI and Console Access with Teleport
+description: Access AWS CLI and Console using AWS OIDC integration.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+Teleport integrates with AWS IAM Identity Provider to provide AWS CLI and Console access.
+This allows you to take advantage of Teleport role-based access controls, just-in-time Access Requests and other Teleport Zero Trust Access and Identity Governance capabilities to manage access to your AWS infrastructure.
+
+<Admonition type="tip">
+If you're using AWS IAM Roles Anywhere, see the [corresponding guide](../../../enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere.mdx) that provides
+the recommended way to manage access to AWS Console and CLI-based tooling.
+
+If you're looking to provide AWS CLI access to your users with audit capture by going through Teleport but you don't have a public cluster, or Roles Anywhere is not adopted at your organization, take a look at the guide for [agent-based AWS access](../../../enroll-resources/application-access/cloud-apis/aws-console.mdx) instead.
+</Admonition>
+
+You can set up access using the "AWS CLI/Console Access via AWS OIDC IdP" enrollment wizard from the Teleport Web UI or you can follow this guide to set it up manually.
+
+## How it works
+
+Setting up access to AWS CLI and Console requires an [AWS OIDC integration](./awsoidc-integration.mdx).
+The AWS OIDC integration creates and configures an AWS IAM OpenID Connect Identity Provider (OIDC IdP) and an AWS IAM role that your Teleport cluster can assume.
+
+The enrollment wizard adds permissions to the AWS OIDC integration IAM role, so that users can assume other existing IAM Roles.
+
+## Prerequisites
+
+- A running Teleport cluster
+- A Teleport user with the preset `editor` role.
+- An AWS account and permissions to create IAM Identity Providers and roles
+
+## Step 1/6. Create an AWS OIDC Integration
+
+The enrollment wizard is available in the "Add New Resource" panel of the Teleport Web UI:
+
+![Screenshot of AWS CLI/Console Access via AWS OIDC IdP enrollment wizard tile](../../../../img/aws/enroll-aws-access-awsoidc.png)
+
+The Teleport Web UI walks you through the steps to set up an AWS OIDC integration (if you don't have one already), configure IAM permissions and set up access to AWS IAM Roles.
+
+Set the <Var name="integration-iam-role"/> field to the IAM Role name created by the AWS OIDC integration.
+
+## Step 2/6. Allow the Integration to assume other IAM Roles
+
+The wizard instructs you to run a script, which will configure the necessary permissions for the AWS OIDC integration IAM role to assume other IAM Roles.
+
+The script adds the following Inline Policy to the integration's IAM Role:
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "sts:AssumeRole",
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "iam:ResourceTag/teleport.dev/integration": "true"
+                }
+            }
+        }
+    ]
+}
+```
+
+## Step 3/6. Add the Trust Relationship to all IAM Roles
+
+Only AWS IAM Roles with the tag `teleport.dev/integration=true` and whose Trust Relationship allows the integration role to assume them, can be used by Teleport users to access AWS Console and CLI.
+
+The Trust Relationship of all the target IAM Roles must include the following statement:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="integration-iam-role"/>"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+## Step 4/6. Create AWS CLI/Console App in Teleport
+
+The enrollment wizard creates an AWS App resource in Teleport which allows users to access the AWS Console and CLI.
+You can do it manually by creating the resource using `tctl`:
+
+  1. Set the <Var name="teleport-url"/> to the public address of your Teleport cluster (eg, `teleport.example.com`).
+  1. Set the <Var name="random-uuid"/> with a randomly generated UUID.
+  1. Write the following contents to a file called `<Var name="integration-name"/>_app_access.yaml`:
+    ```yaml
+    kind: app_server
+    metadata:
+      name: <Var name="integration-name"/>
+    spec:
+      app:
+        kind: app
+        metadata:
+          labels:
+            aws_account_id: "<Var name="aws-account-id"/>"
+          name: <Var name="integration-name"/>
+        spec:
+          cloud: AWS
+          uri: https://console.aws.amazon.com/
+          integration: <Var name="integration-name"/>
+          public_addr: <Var name="integration-name"/>.<Var name="teleport-url"/>
+        version: v3
+      host_id: <Var name="random-uuid"/>
+    version: v3
+    ```
+
+  1. Create the AWS App with the following command:
+    ```code
+    $ tctl create -f <Var name="integration-name"/>_app_access.yaml
+    ```
+
+You can add other labels in `spec.app.metadata.labels` in order to further customize access controls.
+
+## Step 5/6. Set up access
+
+The next step will ask you to enter any AWS Role ARNs you would like to access using Teleport.
+
+This will add the AWS Role ARNs to your Teleport user profile, allowing you to assume them when accessing the AWS App.
+
+<Admonition type="tip" title="SSO users">
+  This step is not applicable for SSO Users.
+  In this case you should map the AWS Role ARNs through your Identity Provider, using [role templates](../../../zero-trust-access/rbac-get-started/role-templates.mdx#sso-users).
+</Admonition>
+
+In order to provide access to other users, you must create a Teleport Role that:
+- includes the list of AWS Role ARNs in the `aws_role_arns` field
+- includes the appropriate `app_labels` matcher to allow access to the AWS App created in the previous step (ie, `aws_account_id: <Var name="aws-account-id"/>`)
+
+As an example, if you want to provide access to the AWS Role `<Var name="aws-iam-target-role"/>`:
+
+  1. Write the following contents to a file called `aws_access_<Var name="aws-iam-target-role"/>.yaml`:
+    ```yaml
+    kind: role
+    metadata:
+      name: aws_access_<Var name="aws-iam-target-role"/>
+    spec:
+      allow:
+        app_labels:
+          aws_account_id: "<Var name="aws-account-id"/>"
+        aws_role_arns:
+        - arn:aws:iam::<Var name="aws-account-id"/>:role/<Var name="aws-iam-target-role"/>
+    version: v8
+    ```
+
+  1. Create the AWS App with the following command:
+    ```code
+    $ tctl create -f aws_access_<Var name="aws-iam-target-role"/>.yaml
+    ```
+
+Assign this role to users and they will be able to assume the <Var name="aws-iam-target-role"/> AWS IAM Role using the CLI or the Management Console.
+
+## Step 6/6. Access AWS Console and CLI
+
+You can now access the AWS Console using the Teleport Web UI by clicking on the AWS App created in the previous step.
+
+## Troubleshooting
+
+### AWS App is not listed or IAM Roles list is empty
+
+Your user must have both RBAC permissions to access the AWS Console:
+- App Labels (`app_labels`) must match the labels defined in the AWS App
+- AWS Role ARNs (`aws_role_arns`) must include at least one of the allowed IAM Roles
+
+### Failure when trying to access a specific IAM Role
+
+This can happen when the target IAM Role (the role that you chose when accessing the AWS App) does not meet the requirements mentioned above:
+- it must have the tag `teleport.dev/integration=true`
+- its Trust Relationship must allow the AWS OIDC integration IAM Role to assume it
+
+See step 3 for more details.
+
+## Next steps
+
+Now that you know how to set up Teleport to protect access to the AWS Management Console and APIs, you can tailor your setup to the needs of your organization.
+
+### Refine your AWS IAM role mapping
+
+The `aws_role_arns` field supports template variables so they can be populated dynamically when a user authenticates to Teleport.
+
+For example, you can configure your identity provider to define a SAML attribute or OIDC claim called `aws_role_arns`, then use this field to list each user's permitted AWS role ARNs on your IdP.
+If you define a Teleport role to mention the `{{external.aws_role_arns}}` variable, the Auth Service will fill in the user's permitted ARNs based on data from the IdP:
+
+```yaml
+    aws_role_arns:
+    - {{external.aws_role_arns}}
+```
+
+### Create Teleport Roles to grant access to a specific profile and IAM roles
+
+You can create multiple Teleport roles to grant access to the profiles and IAM roles for each Profile.
+
+See [Role Access Requests](../../../identity-governance/access-requests/role-requests.mdx) to learn more about creating Roles and how to access them using Access Requests.
diff --git a/docs/pages/admin-guides/management/guides/awsoidc-integration-rds.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx
similarity index 99%
rename from docs/pages/admin-guides/management/guides/awsoidc-integration-rds.mdx
rename to docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx
index 1cee52d9333f6..fe31bd43f87f7 100644
--- a/docs/pages/admin-guides/management/guides/awsoidc-integration-rds.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration-rds.mdx
@@ -1,7 +1,11 @@
 ---
 title: AWS RDS Enrollment Wizard
 description: Enroll AWS RDS databases with your Teleport cluster using an enrollment wizard.
-tocDepth: 3
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 The AWS RDS enrollment wizard is available in your Teleport cluster Web UI as
@@ -82,7 +86,7 @@ Teleport users to connect to the database(s) it proxies.
 
 This is a serverless HA approach to deploying the Teleport Database Service.
 It does not require any allowed inbound traffic from the internet and supports
-[automatic agent upgrades](../../../upgrading/agent-managed-updates.mdx).
+[automatic agent upgrades](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx).
 
 The Teleport Database Service instances are configured to use
 [dynamic database registration](../../../enroll-resources/database-access/guides/dynamic-registration.mdx)
diff --git a/docs/pages/admin-guides/management/guides/awsoidc-integration.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration.mdx
similarity index 85%
rename from docs/pages/admin-guides/management/guides/awsoidc-integration.mdx
rename to docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration.mdx
index 37571f4dbd3f6..b07944614a327 100644
--- a/docs/pages/admin-guides/management/guides/awsoidc-integration.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/awsoidc-integration.mdx
@@ -1,20 +1,25 @@
 ---
 title: AWS OIDC Integration
 description: How to connect your AWS account with Teleport and provide access to AWS resources.
+tags:
+ - how-to
+ - platform-wide
+ - aws
 ---
 
 This guide explains how to set up the Teleport AWS OIDC integration.
 
 With the AWS OIDC integration you will no longer need to deploy Teleport Agents in AWS manually for most use cases.
 The following features use an AWS OIDC integration to interact with AWS:
-- [External Audit Storage](../external-audit-storage.mdx)
+- [External Audit Storage](../../../zero-trust-access/management/external-audit-storage.mdx)
 - [RDS Enrollment](./awsoidc-integration-rds.mdx)
 - EC2 Enrollment
-- [Access Graph AWS Sync](../../teleport-policy/integrations/aws-sync.mdx)
+- [Access Graph AWS Sync](../../../identity-security/integrations/aws-sync.mdx)
+- [Protect AWS CLI and Console access with Teleport](./awsoidc-integration-console.mdx)
 
 It targets users who would prefer a more manual approach or to manage the integration with Infrastructure as Code tools.
 
-As an alternative to this guide, you can use the Teleport Web UI (Access Management / Enroll New Integration).
+As an alternative to this guide, you can use the Teleport Web UI. In the left-hand pane, click **Add New** -> **Integration**.
 
 ## How it works
 Teleport is added as an [OpenID Connect identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) to establish trust with your AWS account and assume a configured IAM role in order to access AWS resources.
@@ -26,7 +31,7 @@ $ curl https://<Var name="teleport.example.com" />/.well-known/openid-configurat
 The integration requires no extra configuration or services to run.
 
 Initially, no policy is added to the IAM role, but users are asked to add them the first time they are trying to use a given feature.
-For example, when setting up [External Audit Storage](../external-audit-storage.mdx), you will be asked to add the required policies to this IAM role.
+For example, when setting up [External Audit Storage](../../../zero-trust-access/management/external-audit-storage.mdx), you will be asked to add the required policies to this IAM role.
 
 AWS resources created by the integration are tagged so that you can search and export them using the [AWS Resource Groups / Tag Editor](https://console.aws.amazon.com/resource-groups/tag-editor/find-resources).
 The following tags are applied:
@@ -41,6 +46,7 @@ teleport.dev/integration  <Var name="my-integration"/>
 - A running Teleport cluster.
 - AWS Account with permissions to create IAM Identity Providers and roles
 
+
 ## Step 1/4. Configure RBAC
 
 To configure the integration you will need the following allow rules in one of your Teleport roles.
@@ -85,7 +91,7 @@ teleport.dev/integration  <Var name="my-integration"/>
 ## Step 3/4. Create IAM role
 An IAM role must be created to assign the required policies to the integration <Var name="iam-role"/>.
 
-This IAM role is created without any policy, as those are added depending on the feature you would like to use, for example when setting up [Access Graph AWS Sync](../../teleport-policy/integrations/aws-sync.mdx).
+This IAM role is created without any policy, as those are added depending on the feature you would like to use, for example when setting up [Access Graph AWS Sync](../../../identity-security/integrations/aws-sync.mdx).
 However, it must be configured to allow the Identity Provider to assume it.
 To achieve this, add the following Trust Relationship:
 ```json
@@ -140,5 +146,5 @@ After the set up is complete, you can now use the "Enroll New Resource" flow in
 ## Next steps
 
 Now that you have an integration, you can use the following features:
-- [Access Graph AWS Sync](../../teleport-policy/integrations/aws-sync.mdx)
-- [External Audit Storage](../external-audit-storage.mdx)
+- [Access Graph AWS Sync](../../../identity-security/integrations/aws-sync.mdx)
+- [External Audit Storage](../../../zero-trust-access/management/external-audit-storage.mdx)
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/azure-aks-workload-id.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/azure-aks-workload-id.mdx
index 46182e246f83c..880db7c9501fe 100644
--- a/docs/pages/enroll-resources/application-access/cloud-apis/azure-aks-workload-id.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/azure-aks-workload-id.mdx
@@ -1,6 +1,12 @@
 ---
 title: "Protect Azure CLIs with Teleport Application Access on AKS"
+sidebar_label: Azure (using AKS)
 description: How to enable secure access to Azure CLIs on Azure Kubernetes Service with Workload Identity.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 (!docs/pages/includes/application-access/azure-intro.mdx!)
@@ -18,7 +24,7 @@ In this guide, you will:
 
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs.mdx version="15.2.4"!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v15.2.4 or higher)"!)
 - An Azure Kubernetes Service (AKS) cluster and admin permissions to manage the
   cluster.
 - The ability to manage user-assigned Azure managed identities, role policies,
@@ -226,8 +232,8 @@ teleport-azure-access-agent-0   1/1     Running   0          99s
   your Teleport users can only manage Azure resources temporarily, with no
   longstanding admin roles for attackers to hijack. View our documentation on
   [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and
-  [Access Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and
+  [Access Request plugins](../../../identity-governance/access-requests/plugins/plugins.mdx).
 - Consult the Azure documentation for information about [Azure managed
   identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
   and how to [manage user-assigned managed
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx
index 3218ce6b2680b..356f410dce4b9 100644
--- a/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/azure.mdx
@@ -1,6 +1,13 @@
 ---
-title: "Protect Azure CLIs with Teleport Application Access"
+title: Protect Azure CLIs and APIs with Teleport
+sidebar_label: Azure
 description: How to enable secure access to Azure CLIs.
+tags:
+ - teleport-as-idp
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 (!docs/pages/includes/application-access/azure-intro.mdx!)
@@ -8,13 +15,22 @@ description: How to enable secure access to Azure CLIs.
 In this guide, you will:
 
 1. Create an Azure managed identity for user access and attach it your VM.
-1. Deploy a Teleport Application Service with an Azure app in your Teleport cluster.
+1. Deploy the Teleport Application Service with an Azure app in your Teleport cluster.
 1. Assume the managed identity and run `az` commands via `tsh`.
 
 ## How it works
 
 (!docs/pages/includes/application-access/azure-how-it-works.mdx deployment="on an Azure VM" credential="managed identities"!)
 
+Alternatively, you can use the [Teleport SAML IdP](../../../identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx)-based
+integration to manage access to Azure Portal and CLI applications.  In this
+approach, users [interactively sign in](
+https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively)
+to Azure portal and CLI tools, and Azure services tag audit logs on behalf of
+Teleport user account, providing more visibility into how Teleport users are
+interacting with Azure. It is also the only supported method to manage access to
+the Azure portal.
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
@@ -223,8 +239,8 @@ Application Service host.
   your Teleport users can only manage Azure resources temporarily, with no
   longstanding admin roles for attackers to hijack. View our documentation on
   [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and
-  [Access Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and
+  [Access Request plugins](../../../identity-governance/access-requests/plugins/plugins.mdx).
 - Consult the Azure documentation for information about [Azure managed
   identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
   and how to [manage user-assigned managed
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/cloud-apis.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/cloud-apis.mdx
index fac714a736b3d..5caf17eb714fb 100644
--- a/docs/pages/enroll-resources/application-access/cloud-apis/cloud-apis.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/cloud-apis.mdx
@@ -1,6 +1,11 @@
 ---
 title: "Securing Access to Cloud APIs"
+sidebar_position: 2
+sidebar_label: Cloud APIs
 description: "How to use Teleport to achieve secure access while managing your cloud-based infrastructure."
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 You can use Teleport to provide secure access to your cloud provider's APIs.
@@ -15,8 +20,10 @@ longstanding admin accounts to target.
 
 Learn how to protect your cloud provider APIs with Teleport:
 
-- [AWS (console and CLI applications)](aws-console.mdx)
+- [AWS Console and CLI access](aws-console-roles-anywhere.mdx)
+- [AWS Console and CLI access via Teleport Agent](aws-console.mdx)
 - [Azure CLI applications](azure.mdx)
 - [Azure CLI applications (AKS with Workload ID deployment)](azure-aks-workload-id.mdx)
 - [Google Cloud CLI applications](google-cloud.mdx)
-- [GCP Web Console Access with Workforce Identity Federation and Teleport SAML IdP](../../../admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation.mdx)
+- [GCP Web Console Access with Workforce Identity Federation and Teleport SAML IdP](../../../identity-governance/idps/usage/saml-gcp-workforce-identity-federation.mdx)
+
diff --git a/docs/pages/admin-guides/management/guides/github-integration.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/github-integration.mdx
similarity index 89%
rename from docs/pages/admin-guides/management/guides/github-integration.mdx
rename to docs/pages/enroll-resources/application-access/cloud-apis/github-integration.mdx
index 8bf3d60bb92d4..5892be5b1bd18 100644
--- a/docs/pages/admin-guides/management/guides/github-integration.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/github-integration.mdx
@@ -1,6 +1,10 @@
 ---
 title: Proxy Git Commands with Teleport for GitHub
 description:  How to use Teleport's short-lived SSH certificates with the GitHub Certificate Authority.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can proxy Git commands and use short-lived SSH certificates to
@@ -37,9 +41,14 @@ continue to access GitHub through their browsers.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx version="17.2"!)
-- Access to GitHub Enterprise and permissions to modify GitHub's SSH certificate
-  authorities and configure OAuth applications.
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v17.2 or higher)"!)
+- Access to GitHub Enterprise Cloud and permissions to modify GitHub's SSH
+  certificate authorities and configure OAuth applications.
+  <Admonition type="info" title="GitHub Enterprise compatibility">
+  GitHub integration requires a GitHub Enterprise plan and is currently
+  supported for **GitHub Enterprise Cloud**. Support for **GitHub Enterprise
+  Server (self-hosted)** is not available as of the current release.
+  </Admonition>
 - (!docs/pages/includes/tctl.mdx!)
 - Git locally installed
 
diff --git a/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx b/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx
index 32789636e0665..72323a6c1f098 100644
--- a/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx
+++ b/docs/pages/enroll-resources/application-access/cloud-apis/google-cloud.mdx
@@ -1,6 +1,12 @@
 ---
 title: "Protect Google Cloud API Access with Teleport"
+sidebar_label: Google Cloud
 description: How to enable secure access to Google Cloud APIs.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 You can use Teleport to manage access to CLI tools that interact with Google
@@ -643,8 +649,8 @@ command.
   ensure that your Teleport users can only manage Google Cloud resources
   temporarily, with no longstanding admin roles for attackers to hijack. View
   our documentation on [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and [Access
-  Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and [Access
+  Request plugins](../../../identity-governance/access-requests/plugins/plugins.mdx).
 - You can proxy any `gcloud` or `gsutil` command via Teleport. For a full
   reference of commands, view the Google Cloud documentation for
   [`gcloud`](https://cloud.google.com/sdk/gcloud/reference) and
diff --git a/docs/pages/enroll-resources/application-access/configuration/configuration.mdx b/docs/pages/enroll-resources/application-access/configuration/configuration.mdx
new file mode 100644
index 0000000000000..903966f95d408
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/configuration/configuration.mdx
@@ -0,0 +1,11 @@
+---
+title: Teleport Application Service Configuration
+sidebar_label: Configuration Guides
+description: Provides instructions for configuring the Teleport Application Service
+---
+
+The guides in this section show you how to configure the Teleport Application
+Service, which proxies traffic to and from Teleport-protected applications.
+
+<DocCardList />
+
diff --git a/docs/pages/enroll-resources/application-access/controls.mdx b/docs/pages/enroll-resources/application-access/configuration/controls.mdx
similarity index 80%
rename from docs/pages/enroll-resources/application-access/controls.mdx
rename to docs/pages/enroll-resources/application-access/configuration/controls.mdx
index fcf9e0142762d..5f966621324da 100644
--- a/docs/pages/enroll-resources/application-access/controls.mdx
+++ b/docs/pages/enroll-resources/application-access/configuration/controls.mdx
@@ -1,6 +1,11 @@
 ---
 title: Application Access Role-Based Access Control
+sidebar_label: Access Controls
 description: Role-Based Access Control (RBAC) for Teleport application access.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This article describes access control concepts particularly relevant to the
@@ -127,24 +132,23 @@ This command uses the `--set-azure-identities` flag to add Azure identities to a
 user. The value of this flag is a comma-separated list of Azure identity URIs.
 
 See our [Azure
-CLI](./cloud-apis/azure.mdx#step-34-enable-your-user-to-access-azure-clis) guide
+CLI](../cloud-apis/azure.mdx#step-34-enable-your-user-to-access-azure-clis) guide
 for more information on enabling access to Azure managed identities.
 
 ## Next steps
 
-- View access controls [Getting Started](../../admin-guides/access-controls/getting-started.mdx)
-  and other available [guides](../../admin-guides/access-controls/guides/guides.mdx).
+- View the access controls [Getting Started](../../../zero-trust-access/rbac-get-started/role-demo.mdx) guide
+  and other available
+  [guides](../../../zero-trust-access/authentication/authentication.mdx).
 - For full details on how Teleport populates the `internal` and `external`
   traits we illustrated in this guide, see the [Access
-  Controls Reference](../../reference/access-controls/roles.mdx).
-- View access controls [Getting Started](../../admin-guides/access-controls/getting-started.mdx)
-  and other available [guides](../../admin-guides/access-controls/guides/guides.mdx).
-- Learn about using [JWT tokens](./jwt/introduction.mdx) to implement access
+  Controls Reference](../../../reference/access-controls/roles.mdx).
+- Learn about using [JWT tokens](../jwt/introduction.mdx) to implement access
   controls in your application.
 - Integrate with your identity provider:
-  - [OIDC](../../admin-guides/access-controls/sso/oidc.mdx)
-  - [ADFS](../../admin-guides/access-controls/sso/adfs.mdx)
-  - [Microsoft Entra ID](../../admin-guides/access-controls/sso/azuread.mdx)
-  - [Google Workspace](../../admin-guides/access-controls/sso/google-workspace.mdx)
-  - [Onelogin](../../admin-guides/access-controls/sso/one-login.mdx)
-  - [Okta](../../admin-guides/access-controls/sso/okta.mdx)
+  - [OIDC](../../../zero-trust-access/sso/integrate-idp/oidc.mdx)
+  - [ADFS](../../../zero-trust-access/sso/integrate-idp/adfs.mdx)
+  - [Microsoft Entra ID](../../../zero-trust-access/sso/integrate-idp/entra-id.mdx)
+  - [Google Workspace](../../../zero-trust-access/sso/integrate-idp/google-workspace.mdx)
+  - [Onelogin](../../../zero-trust-access/sso/integrate-idp/one-login.mdx)
+  - [Okta](../../../zero-trust-access/sso/integrate-idp/okta.mdx)
diff --git a/docs/pages/enroll-resources/application-access/configuration/dynamic-registration.mdx b/docs/pages/enroll-resources/application-access/configuration/dynamic-registration.mdx
new file mode 100644
index 0000000000000..4c224249f91da
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/configuration/dynamic-registration.mdx
@@ -0,0 +1,121 @@
+---
+title: Dynamic App Registration
+sidebar_label: Dynamic Registration
+description: Register/unregister apps without restarting Teleport.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
+---
+
+Dynamic app registration allows Teleport administrators to register new apps (or
+update/unregister existing ones) without having to update the static
+configuration files read by Teleport Application Service instances. 
+
+Application Service instances periodically query the Teleport Auth Service for
+`app` resources, each of which includes the information that the Application
+Service needs to proxy an application. 
+
+Dynamic registration is useful for managing pools of Application Service
+instances. And behind the scenes, the Teleport Discovery Service uses dynamic
+registration to [register Kubernetes
+applications](../../auto-discovery/kubernetes-applications/kubernetes-applications.mdx).
+
+## Required permissions
+
+(!docs/pages/includes/application-access/dynamic-app-permissions.mdx!)
+
+## Enabling dynamic registration
+
+(!docs/pages/includes/application-access/dynamic-app-config.mdx!)
+
+## Creating an app resource
+
+Configure Teleport to proxy an application dynamically by creating an `app`
+resource. The following example configures Teleport to proxy the application
+called `example` at `localhost:4321`, making it available at the public address
+`test.example.com`:
+
+```yaml
+kind: app
+version: v3
+metadata:
+  name: example
+  description: "Example app"
+  labels:
+    env: test
+spec:
+  uri: http://localhost:4321
+  public_addr: test.example.com
+```
+
+See the full app resource spec [reference](../reference.mdx).
+
+The user creating the dynamic registration needs to have a role with access to the 
+application labels and the `app` resource.  In this example role the user can only
+create and maintain application services labeled `env: test`.
+
+```yaml
+kind: role
+metadata:
+  name: dynamicappregexample
+spec:
+  allow:
+    app_labels:      
+      env: test
+    rules:
+    - resources:
+      - app
+      verbs:
+      - list
+      - create
+      - read
+      - update
+      - delete
+version: v5
+```
+
+To create an application resource, run:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+$ tctl create app.yaml
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Log in to your Teleport cluster so you can use tctl remotely.
+$ tsh login --proxy=mytenant.teleport.sh --user=myuser
+$ tctl create app.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+After the resource has been created, it will appear among the list of available
+apps (in `tsh apps ls` or UI) as long as at least one Application Service
+instance picks it up according to its label selectors.
+
+To update an existing application resource, run:
+
+```code
+$ tctl create -f app.yaml
+```
+
+If the updated resource's labels no longer match a particular app agent, it
+will unregister and stop proxying it.
+
+To delete an application resource, run:
+
+```code
+$ tctl rm app/example
+```
diff --git a/docs/pages/enroll-resources/application-access/guides/ha.mdx b/docs/pages/enroll-resources/application-access/configuration/ha.mdx
similarity index 96%
rename from docs/pages/enroll-resources/application-access/guides/ha.mdx
rename to docs/pages/enroll-resources/application-access/configuration/ha.mdx
index 407ffa6e9c92b..b7b4f2065825f 100644
--- a/docs/pages/enroll-resources/application-access/guides/ha.mdx
+++ b/docs/pages/enroll-resources/application-access/configuration/ha.mdx
@@ -1,6 +1,11 @@
 ---
 title: Application Access High Availability (HA)
+sidebar_label: High Availability
 description: How to configure Teleport application access in a Highly Available (HA) configuration.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 You can deploy the Application Service in a Highly Available (HA) configuration
diff --git a/docs/pages/enroll-resources/application-access/getting-started.mdx b/docs/pages/enroll-resources/application-access/getting-started.mdx
index 3fe1756f69c93..2c1152e3ad510 100644
--- a/docs/pages/enroll-resources/application-access/getting-started.mdx
+++ b/docs/pages/enroll-resources/application-access/getting-started.mdx
@@ -1,7 +1,12 @@
 ---
 title: Protect a Web Application with Teleport
+sidebar_label: Getting Started
 description: Provides instructions to set up the Teleport Application Service and enable secure access to a web application.
 videoBanner: cvW4b96aPL0
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This tutorial demonstrates how to configure secure access to an application 
@@ -138,7 +143,7 @@ $ helm install example-grafana grafana/grafana \
 
 <Tabs>
 <TabItem label="Docker">
-Select a Teleport edition, then follow the [Installation](../../installation.mdx) instructions 
+Select a Teleport edition, then follow the [Installation](../../installation/installation.mdx) instructions 
 for your environment.
 
 To install on Linux:
@@ -238,8 +243,8 @@ You are prompted to sign in if you haven't already been authenticated.
 
 Learn more about protecting applications with Teleport in the following topics:
 
-- [Connecting applications](./guides/connecting-apps.mdx).
+- [Connecting applications](protect-apps/connecting-apps.mdx).
 - Integrating with [JWT tokens](./jwt/introduction.mdx).
-- Accessing applications with [RESTful APIs](./guides/api-access.mdx).
-- Setting configuration options AND running CLI commands in the [Application Service reference](../../reference/agent-services/application-access.mdx).
+- Accessing applications with [RESTful APIs](protect-apps/api-access.mdx).
+- Setting configuration options AND running CLI commands in the [Application Service reference](reference.mdx).
 - Using the Let's Encrypt [ACME protocol](https://letsencrypt.org/how-it-works/).
diff --git a/docs/pages/enroll-resources/application-access/guides/dynamic-registration.mdx b/docs/pages/enroll-resources/application-access/guides/dynamic-registration.mdx
deleted file mode 100644
index 178621494f739..0000000000000
--- a/docs/pages/enroll-resources/application-access/guides/dynamic-registration.mdx
+++ /dev/null
@@ -1,149 +0,0 @@
----
-title: Dynamic App Registration
-description: Register/unregister apps without restarting Teleport.
----
-
-Dynamic app registration allows Teleport administrators to register new apps (or
-update/unregister existing ones) without having to update the static
-configuration files read by Teleport Application Service instances. 
-
-Application Service instances periodically query the Teleport Auth Service for
-`app` resources, each of which includes the information that the Application
-Service needs to proxy an application. 
-
-Dynamic registration is useful for [managing pools of Application Service
-instances](../../../admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx). And behind the scenes, the
-Teleport Discovery Service uses dynamic registration to [register Kubernetes
-applications](../../auto-discovery/kubernetes-applications/kubernetes-applications.mdx).
-
-## Required permissions
-
-In order to interact with dynamically registered applications, a user must have
-a Teleport role with permissions to manage `app` resources. 
-
-In the following example, a role allows a user to perform all possible
-operations against `app` resources:
-
-```yaml
-allow:
-  rules:
-    - resources:
-        - app
-      verbs: [list, create, read, update, delete]
-```
-
-## Enabling dynamic registration
-
-To enable dynamic registration, include a `resources` section in your Application
-Service configuration with a list of resource label selectors you'd like this
-service to monitor for registering:
-
-```yaml
-app_service:
-  enabled: true
-  resources:
-  - labels:
-      "*": "*"
-```
-
-You can use a wildcard selector to register all dynamic app resources in the cluster
-on the Application Service or provide a specific set of labels for a subset:
-
-```yaml
-resources:
-- labels:
-    "env": "prod"
-- labels:
-    "env": "test"
-```
-
-## Creating an app resource
-
-Configure Teleport to proxy an application dynamically by creating an `app`
-resource. The following example configures Teleport to proxy the application
-called `example` at `localhost:4321`, making it available at the public address
-`test.example.com`:
-
-```yaml
-kind: app
-version: v3
-metadata:
-  name: example
-  description: "Example app"
-  labels:
-    env: test
-spec:
-  uri: http://localhost:4321
-  public_addr: test.example.com
-```
-
-See the full app resource spec [reference](../../../reference/agent-services/application-access.mdx).
-
-The user creating the dynamic registration needs to have a role with access to the 
-application labels and the `app` resource.  In this example role the user can only
-create and maintain application services labeled `env: test`.
-
-```yaml
-kind: role
-metadata:
-  name: dynamicappregexample
-spec:
-  allow:
-    app_labels:      
-      env: test
-    rules:
-    - resources:
-      - app
-      verbs:
-      - list
-      - create
-      - read
-      - update
-      - delete
-version: v5
-```
-
-To create an application resource, run:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-# You can also run tctl on your Auth Service host without running "tsh login"
-# first.
-$ tsh login --proxy=teleport.example.com --user=myuser
-$ tctl create app.yaml
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Log in to your Teleport cluster so you can use tctl remotely.
-$ tsh login --proxy=mytenant.teleport.sh --user=myuser
-$ tctl create app.yaml
-```
-
-</TabItem>
-
-</Tabs>
-
-After the resource has been created, it will appear among the list of available
-apps (in `tsh apps ls` or UI) as long as at least one Application Service
-instance picks it up according to its label selectors.
-
-To update an existing application resource, run:
-
-```code
-$ tctl create -f app.yaml
-```
-
-If the updated resource's labels no longer match a particular app agent, it
-will unregister and stop proxying it.
-
-To delete an application resource, run:
-
-```code
-$ tctl rm app/example
-```
diff --git a/docs/pages/enroll-resources/application-access/guides/guides.mdx b/docs/pages/enroll-resources/application-access/guides/guides.mdx
deleted file mode 100644
index ecade5b582e83..0000000000000
--- a/docs/pages/enroll-resources/application-access/guides/guides.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-title: Application Access Guides
-description: Guides for configuring Teleport application access.
-layout: tocless-doc
----
-
-These guides explain how to use the Teleport Application Service, which allows
-your teams to connect to applications within private networks with fine-grained
-RBAC and audit logging.
-
-Manage access to internal applications:
-
-- [Web App Access](connecting-apps.mdx): How to access web apps with Teleport.
-- [TCP App Access](tcp.mdx): How to access plain TCP apps with Teleport.
-- [VNet](vnet.mdx): How to configure VNet to support applications with custom public addresses.
-- [API Access](api-access.mdx): How to access REST APIs with Teleport.
-- [Dynamic Registration](dynamic-registration.mdx): Register/unregister apps without restarting Teleport.
-- [Amazon Athena Access](amazon-athena.mdx): How to access Amazon Athena with Teleport.
-- [Amazon DynamoDB Access](dynamodb.mdx): How to access Amazon DynamoDB as an application.
-- [Application Service HA](ha.mdx): How to configure the Teleport Application Service for high availability. 
diff --git a/docs/pages/enroll-resources/application-access/guides/tcp.mdx b/docs/pages/enroll-resources/application-access/guides/tcp.mdx
deleted file mode 100644
index 4bfc4171bc66f..0000000000000
--- a/docs/pages/enroll-resources/application-access/guides/tcp.mdx
+++ /dev/null
@@ -1,203 +0,0 @@
----
-title: TCP Application Access
-description: How to configure Teleport for accessing plain TCP apps
----
-
-Teleport can provide access to any TCP-based application. This allows users to
-connect to applications which Teleport doesn't natively support such as SMTP
-servers or databases not yet natively supported by the Teleport Database
-Service.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- TCP application to connect to. In this guide we'll use a PostgreSQL running
-  in Docker as an example. You can also use any TCP-based application you may
-  already have.
-- Host where you will run the Teleport Application Service.
-
-We will assume your Teleport cluster is accessible at `teleport.example.com`
-and `*.teleport.example.com`. You can substitute the address of your Teleport
-Proxy Service. (For Teleport Cloud customers, this will be similar to
-`mytenant.teleport.sh`.)
-
-<Admonition type="note">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Admonition>
-
-## Step 1/4. Start PostgreSQL container
-
-Skip this step if you already have an application you'd like to connect to.
-
-Start a PostgreSQL server in a Docker container:
-
-```code
-$ docker run --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=<pass> -d postgres
-```
-
-## Step 2/4. Start Teleport Application Service
-
-Teleport Application Service requires a valid auth token to join the cluster.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-To generate one, run the following command on your Auth Service node:
-
-```code
-$ tctl tokens add --type=app
-```
-
-Next, create a Teleport user with the `access` role that will allow it to
-connect to cluster applications:
-
-```code
-$ tctl users add --roles=access alice
-```
-</TabItem>
-
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-To generate one, log into your Cloud tenant and run the following command:
-
-```code
-$ tsh login --proxy=mytenant.teleport.sh
-$ tctl tokens add --type=app
-```
-</TabItem>
-
-</Tabs>
-
-Save the generated token in `/tmp/token` on the node where Application Service
-will run.
-
-Now, install Teleport on the Application Service node. It must be able to reach
-both your Teleport Proxy and the TCP application it's going to proxy.
-
-(!docs/pages/includes/install-linux.mdx!)
-
-Create the Application Service configuration file `/etc/teleport.yaml` with
-the following contents:
-
-```yaml
-version: v3
-teleport:
-  auth_token: "/tmp/token"
-  proxy_server: teleport.example.com:3080
-auth_service:
-  enabled: false
-ssh_service:
-  enabled: false
-proxy_service:
-  enabled: false
-app_service:
-  enabled: true
-  apps:
-  - name: "tcp-app"
-    uri: tcp://localhost:5432
-```
-
-Note that the URI scheme must be `tcp://` in order for Teleport to recognize
-this as a TCP application.
-
-(!docs/pages/includes/start-teleport.mdx!)
-
-## Step 3/4. Start app proxy
-
-Log into your Teleport cluster and view available applications:
-
-```code
-$ tsh login --proxy=teleport.example.com
-$ tsh apps ls
-Application Description   Type Public Address                   Labels
------------ ------------- ---- -------------------------------- -----------
-tcp-app                   TCP  tcp-app.root.gravitational.io
-```
-
-Your TCP application should show up and be denoted with a `TCP` type.
-
-Now log into the application:
-
-```code
-$ tsh apps login tcp-app
-Logged into TCP app tcp-app. Start the local TCP proxy for it:
-
-  tsh proxy app tcp-app
-
-Then connect to the application through this proxy.
-```
-
-Next, start a local proxy for it:
-
-```code
-$ tsh proxy app tcp-app
-Proxying connections to tcp-app on 127.0.0.1:55868
-```
-
-The `tsh proxy app` command will set up a listener that will proxy all connections to
-the target application.
-
-## Step 4/4. Connect
-
-Once the local proxy is running, you can connect to the application using the
-application client you would normally use to connect to it:
-
-```code
-$ psql postgres://postgres@localhost:55868/postgres
-```
-
-## Next steps
-
-### Configuring access to multiple ports
-
-By default, the Application Service proxies connections to the `uri` field from the application
-specification. However, Teleport can enable access to multiple ports of a TCP application. An
-application specification in this case needs to have no port number in the `uri` field and a new
-field called `tcp_ports` with a list of ports.
-
-For example, let's take tcp-app from the steps above and add access to port 8080 and port range
-31276-32300. The Application Service definition should look like this:
-
-```yaml
-app_service:
-  enabled: true
-  apps:
-  - name: "tcp-app"
-    uri: tcp://localhost # No port in the URI
-    tcp_ports:
-    - port: 5432 # PostgreSQL
-    - port: 8080 # HTTP server
-    - port: 31276
-      end_port: 32300 # Inclusive end of range
-```
-
-To access the app, [start VNet](../../../connect-your-client/vnet.mdx) and point an application
-client towards the target port:
-
-```code
-$ curl -I http://tcp-app.teleport.example.com:8080
-HTTP/1.1 200 OK
-
-$ psql postgres://postgres@tcp-app.teleport.example.com:5432/postgres
-```
-
-<Admonition type="warning">
-There is no RBAC for TCP ports – a user that has access to an application can connect to any port in
-the specification. We&nbsp;strongly recommend specifying only the necessary ports instead of defining a
-wide port range that happens to include ports that are meant to be available.
-</Admonition>
-
-{/* TODO: DELETE IN 19.0.0. At this point all compatible servers and clients are going
-to support multiple ports. */}
-
-Support for multiple ports is available in Teleport v17.1+. Connections from Teleport clients that
-do not support multiple ports are routed to the first port from the application specification. An
-Application Service that does not support multiple ports will not be able to handle traffic to a
-multi-port application if it receives such application through [dynamic
-registration](./dynamic-registration.mdx) from an Auth Service.
-
-### Further reading
-
-- Learn about [access controls](../controls.mdx) for applications.
-- Learn how to [connect to TCP apps with VNet](../../../connect-your-client/vnet.mdx) and
-  [configure VNet for custom `public_addr`](vnet.mdx).
diff --git a/docs/pages/enroll-resources/application-access/guides/vnet.mdx b/docs/pages/enroll-resources/application-access/guides/vnet.mdx
deleted file mode 100644
index 6510f1bf8391e..0000000000000
--- a/docs/pages/enroll-resources/application-access/guides/vnet.mdx
+++ /dev/null
@@ -1,170 +0,0 @@
----
-title: VNet
-description: How to configure custom DNS zones for VNet
----
-
-VNet automatically proxies connections made to TCP applications available under the public address
-of a Proxy Service. This guide explains how to configure VNet to support apps with [custom public
-addresses](connecting-apps.mdx#customize-public-address).
-
-## How it works
-
-Let's assume that a user has logged in to a cluster through a Proxy Service available at
-`teleport.example.com`. There's a leaf cluster associated with that cluster. It has its own Proxy
-Service available at `leaf.example.com`. Once started, VNet captures DNS queries for both of those
-domains and their subdomains.
-
-Type A and AAAA queries are matched against `public_addr` of applications registered in both
-clusters. If there's a match and the application is registered as a TCP application, VNet responds
-with a virtual IP address over which the connection will be proxied to the app. In any other
-case, the query is forwarded to the default DNS name server used by the OS.
-
-If you want VNet to forward connections to an app that has a custom `public_addr` set, you need
-to first update the VNet config in the Auth Service to include a matching DNS zone.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx version="16.0.0"!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A TCP application connected to the cluster.
-- A domain name under your control.
-
-{/* vale messaging.protocol-products = NO */}
-In this guide, we'll use the example app from [TCP Application Access guide](tcp.mdx) and make it
-available through VNet at <Var name="public_addr" initial="tcp-app.company.test"/> with
-<Var name="suffix" initial="company.test" /> as the custom DNS zone.
-{/* vale messaging.protocol-products = YES */}
-
-## Step 1/3. Configure custom DNS zone
-
-Edit the VNet config:
-
-```code
-$ tctl edit vnet_config
-```
-
-Add a custom DNS zone. In our case the `public_addr` of the app is going to be
-`tcp-app.company.test`, so we're going to set `company.test` as `suffix`. The `spec` section of the
-config should include the `custom_dns_zones` field:
-
-```diff
-kind: vnet_config
-metadata:
-  name: vnet-config
-  # …
-spec:
-+ custom_dns_zones:
-+ - suffix: <Var name="suffix" />
-  # …
-version: v1
-```
-
-<Admonition type="note" title="Relationship between suffix and public_addr">
-`suffix` doesn't have to point to a domain that's exactly one level above the `public_addr` of an
-app. Any level of nesting works. For example, you can have an app under `tcp-app.foo.bar.qux.test`
-and the suffix can be set to `bar.qux.test`.
-</Admonition>
-
-## Step 2/3. Set `public_addr` of the app
-
-Set `public_addr` field of the application in the Application Service configuration file
-`/etc/teleport.yaml` and restart the `teleport` daemon.
-
-```diff
-version: v3
-# …
-app_service:
-  # …
-  apps:
-  - name: "tcp-app"
-    uri: tcp://localhost:5432
-+   public_addr: "<Var name="public_addr" />"
-```
-
-## Step 3/3. Connect
-
-Once you [start VNet](../../../connect-your-client/vnet.mdx), you should be able to connect to the
-application over the custom `public_addr` using the application client you would normally use to
-connect to it. You might need to restart VNet if it was already running while you were making
-changes to the cluster.
-
-```code
-$ psql postgres://postgres@tcp-app.company.test/postgres
-```
-
-## Next steps
-
-### Configuring IPv4 CIDR range
-
-Each cluster has a configurable IPv4 CIDR range which VNet uses when assigning IP addresses to
-applications from that cluster. Root and leaf clusters can use different ranges. The default is
-`100.64.0.0/10` and it can be changed by setting the `ipv4_cidr_range` field of the VNet config.
-
-Edit the VNet config:
-
-```code
-$ tctl edit vnet_config
-```
-
-Edit the `ipv4_cidr_range` field in the `spec` section of the config:
-
-```diff
-kind: vnet_config
-metadata:
-  name: vnet-config
-  # …
-spec:
-+ ipv4_cidr_range: "100.64.0.0/10"
-  # …
-version: v1
-```
-
-<Admonition type="note" title="IPv4 address of the TUN device">
-When starting, VNet needs to assign an IPv4 address for its virtual network device. To pick an
-address, [VNet arbitrarily chooses a root
-cluster](https://github.com/gravitational/teleport/issues/43343) that the user is logged in to and
-picks an address from the range used by that cluster. If your cluster uses a custom range, but your
-users are logged in to other clusters that are not under your control, this might cause VNet to pick
-an address for the TUN device from a range offered by one of those clusters.
-</Admonition>
-
-### Configuring leaf cluster apps
-
-To make a [leaf cluster](../../../admin-guides/management/admin/trustedclusters.mdx) app accessible over a custom
-`public_addr`, you need to follow the same steps while being logged in directly to the leaf cluster.
-
-```code
-$ tsh login --proxy=leaf.example.com --user=email@example.com
-```
-
-### Accessing web apps through VNet
-
-VNet does not officially support [web apps](connecting-apps.mdx) yet. However, technically any web
-app is [a TCP app](tcp.mdx), so they can be made available over VNet as well. You'll need to change
-`uri` of your application in the Application Service configuration file to use `tcp://` instead of
-`http://`. There's also a couple of caveats:
-
-- The Teleport Web UI uses [HSTS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).
-  If the application is going to be served from a subdomain of a Proxy Service, it means that the
-  application will not be accessible in browsers over plain HTTP, even with VNet running. It's
-  possible to work around this by setting a custom `public_addr` as explained above in this guide.
-- If the application needs to be accessible over HTTPS, it must handle TLS connections and return [a valid
-  cert](connecting-apps.mdx#step-23-optional-configure-tls-and-dns-for-your-web-applications) for the domain it is served on.
-- [JWT Token](../jwt/introduction.mdx), [redirect](connecting-apps.mdx#rewrite-redirect) and
-  [header rewrites](connecting-apps.mdx#headers-passthrough) are not available for TCP apps.
-- Teleport records the start and the end of a session for TCP apps in the audit log, but [session
-  chunks](../../../reference/architecture/session-recording.mdx) are not captured.
-
-When accessing an HTTP API through VNet, the same caveats apply as above, with one main exception.
-Since API clients don't need to respect HSTS, the API itself does not need to be served over HTTPS.
-
-The important thing to understand is that VNet doesn't do anything extra with a connection, other
-than passing it through a Teleport Proxy Service. Which application layer protocol is going to be
-used depends solely on the app itself and its clients.
-
-### Further reading
-
-- Read our VNet usage [guide](../../../connect-your-client/vnet.mdx) for end-users
-  accessing your applications with VNet.
-- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
diff --git a/docs/pages/enroll-resources/application-access/introduction.mdx b/docs/pages/enroll-resources/application-access/introduction.mdx
deleted file mode 100644
index bdfabb5fd0963..0000000000000
--- a/docs/pages/enroll-resources/application-access/introduction.mdx
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: Introduction to Enrolling Applications
-description: How to set up Teleport to protect applications and cloud provider APIs
----
-
-Teleport can provide secure access to applications and cloud provider APIs.
-
-Examples include: 
-
-- The AWS and GCP management consoles.
-- The `aws`, `gcloud`, `gsutil`, and `az` CLIs.
-- Applications configured for single sign-on through Okta.
-- Internal control panels.
-- Tools, such as wikis, that are available only when connected to a VPN.
-- Infrastructure dashboards, such as Kubernetes or Grafana.
-- Developer tools, such as Jenkins, GitLab, or Opsgenie.
-
-![Application access architecture](../../../img/application-access/architecture.svg)
-
-If you are running applications on Kubernetes, you can [enroll them in your
-Teleport cluster automatically](../auto-discovery/kubernetes-applications/kubernetes-applications.mdx).
-
-Teleport protects applications through the Teleport Application Service, which
-is a Teleport Agent service. For more information on agent services, read
-[Teleport Agent Architecture](../../reference/architecture/agents.mdx). You can also learn
-how to deploy a [pool of Teleport Agents](../agents/agents.mdx) to run
-multiple agent services.
-
-## Getting started
-
-Learn how to register an application with Teleport in our [getting started
-guide](./getting-started.mdx).
-
-## Cloud provider APIs
-
-You can use Teleport to provide secure access to your cloud provider's APIs.
-This means that you can prevent unauthorized usage of management consoles and
-CLI tools with the same RBAC system you use to protect your infrastructure.
-
-- [AWS Console and CLI Applications](./cloud-apis/aws-console.mdx): How to access
-  AWS Management Console, AWS CLI, and AWS SDKs with Teleport.
-- [Google Cloud Web Console](../../admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation.mdx): How to access the Google Cloud web console with Teleport.
-- [Google Cloud CLI Applications](./cloud-apis/google-cloud.mdx): How to access
-  Google Cloud CLI applications and SDKs with Teleport.
-- [Azure CLI Applications](./cloud-apis/azure.mdx): How to access Azure CLI
-  applications and SDKs with Teleport.
-
-## Internal applications
-
-You can use Teleport to enable secure access to internal applications. For
-example, a load balancer might display network telemetry through a control panel
-but might lack the ability to authenticate with and be accessed by resources
-outside your private network.
-
-Teleport lets team members access these resources securely, even outside a
-private network, with no shared secrets.
-
-These guides explain how to protect internal applications with Teleport:
-
-- [Web App Access](./guides/connecting-apps.mdx): How to access web apps with Teleport.
-- [TCP App Access](./guides/tcp.mdx): How to access plain TCP apps with Teleport.
-- [API Access](./guides/api-access.mdx): How to access REST APIs with Teleport.
-- [Dynamic Registration](./guides/dynamic-registration.mdx): Register/unregister apps without restarting Teleport.
-- [Interactive Lab](https://goteleport.com/labs/): Try Teleport using our guided Teleport application access lab.
-
-## Teleport-signed JSON Web Tokens
-
-These guides explain how web apps registered with Teleport can use
-Teleport-signed JSON web tokens to implement authentication and authorization.
-
-- [Introduction](./jwt/introduction.mdx): Introduction to JWT tokens with application access.
-- [Elasticsearch](./jwt/elasticsearch.mdx): How to use JWT authentication with Elasticsearch.
diff --git a/docs/pages/enroll-resources/application-access/jwt/elasticsearch.mdx b/docs/pages/enroll-resources/application-access/jwt/elasticsearch.mdx
index bbc437b919610..1cedfa26a5fa7 100644
--- a/docs/pages/enroll-resources/application-access/jwt/elasticsearch.mdx
+++ b/docs/pages/enroll-resources/application-access/jwt/elasticsearch.mdx
@@ -1,8 +1,15 @@
 ---
-title: Using JWT authentication with Elasticsearch
-description: How to use JWT authentication with Elasticsearch
+title: Using JWT Authentication with Elasticsearch
+sidebar_label: Elasticsearch
+description: How to use JWT Authentication with Elasticsearch
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 This guide will help you configure Elasticsearch [JWT authentication](https://www.elastic.co/guide/en/elasticsearch/reference/current/jwt-realm.html)
 with Teleport.
 
@@ -11,7 +18,7 @@ with Teleport.
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
-- Running [Application Service](../guides/connecting-apps.mdx).
+- Running [Application Service](../protect-apps/connecting-apps.mdx).
 - Elasticsearch cluster version >= `8.2.0`.
 
 ## Step 1/3. Enable a JWT realm in Elasticsearch
@@ -20,7 +27,7 @@ Update your Elasticsearch configuration file, `elasticsearch.yaml`, to enable a
 JWT realm:
 
 ```yaml
-xpack.security.authc.realms.jwt.jwt1:
+xpack.security.authc.realms.jwt.teleport:
   order: 1
   client_authentication.type: none
   pkc_jwkset_path: https://proxy.example.com/.well-known/jwks.json
@@ -30,6 +37,18 @@ xpack.security.authc.realms.jwt.jwt1:
   allowed_audiences: ["https://elasticsearch.example.com:9200"]
 ```
 
+<Admonition type="tip" title="Elastic Cloud">
+For **hosted deployments** in Elastic Cloud, you can configure the same settings
+by editing your deployment.
+
+Go to "Manage user settings and extensions" for "Elasticsearch", then add the
+configuration snippet above under "User Settings". You may have to use an order
+number bigger than 1.
+
+Please note that Elastic Cloud **Serverless** projects do not support connecting
+external realms, and therefore cannot be configured with JWT authentication.
+</Admonition>
+
 Let's take a closer look at the parameters and their values:
 
 - Set `client_authentication.type` to `none`, otherwise Elasticsearch requires
@@ -40,7 +59,7 @@ Let's take a closer look at the parameters and their values:
   it instead of using a URL.
 - Set `claims.principal` and `claims.groups` to `sub` and `roles` respectively.
   These are the claims Teleport uses to pass user and role information in JWT
-  tokens. Keep in mind that **users and roles must exist** in Elasticsearch.
+  tokens.
 - Set `allowed_issuer` to the name of your Teleport cluster.
 - Set `allowed_audiences` to the URL which Teleport Application Service will
   use to connect to Elasticsearch.
@@ -48,14 +67,33 @@ Let's take a closer look at the parameters and their values:
 <Admonition title="Elasticsearch role mapping" type="note">
   Note that when using JWT authentication, you cannot map user roles using the
   standard Elasticsearch `role_mapping.yml` file. Instead, you need to set the
-  role mapping using the API. See [JWT realm authorization](https://www.elastic.co/guide/en/elasticsearch/reference/current/jwt-realm.html#jwt-authorization)
+  role mapping using the API.
+
+  For example, you can create the following mapping to map Teleport's `access` role
+  to `superuser` role in Elasticsearch:
+  ```
+  PUT /_security/role_mapping/teleport_access
+  {
+    "roles": [ "superuser" ],
+    "rules": {
+      "all": [
+        { "field": { "realm.name": "teleport" } },
+        { "field": { "groups": "access" } }
+      ]
+    },
+    "enabled": true
+  }
+  ```
+  
+  See [JWT realm
+  authorization](https://www.elastic.co/guide/en/elasticsearch/reference/current/jwt-realm.html#jwt-authorization)
   for details.
 </Admonition>
 
 ## Step 2/3. Register an Elasticsearch application in Teleport
 
-In your Teleport App Service configuration file, `teleport.yaml`, register an
-entry for Elasticsearch:
+In your Teleport Application Service configuration file, `teleport.yaml`,
+register an entry for Elasticsearch:
 
 ```yaml
 app_service:
@@ -68,10 +106,6 @@ app_service:
       - "Authorization: Bearer {{internal.jwt}}"
 ```
 
-<Admonition type="tip">
-  You can also use [dynamic registration](../guides/dynamic-registration.mdx).
-</Admonition>
-
 Elasticsearch requires a JWT token to be passed inside the `Authorization`
 header. The header rewrite configuration above will replace the `{{internal.jwt}}`
 template variable with a Teleport-signed JWT token in each request.
@@ -102,12 +136,13 @@ $ curl \
   --cacert ~/.tsh/keys/teleport.example.com/cas/root.pem \
   --cert ~/.tsh/keys/teleport.example.com/alice-app/example-cluster/elastic-x509.pem \
   --key ~/.tsh/keys/teleport.example.com/alice \
-  https://elastic.teleport.example.com/_security/user | jq
+  https://elastic.teleport.example.com/_security/_authenticate | jq
 ```
 
 ## Next steps
 
 - Get more information about integrating with [Teleport JWT tokens](./introduction.mdx).
-- Learn more about [accessing APIs](../guides/api-access.mdx) with the Teleport
+- See the [dynamic registration](../configuration/dynamic-registration.mdx) guide.
+- Learn more about [accessing APIs](../protect-apps/api-access.mdx) with the Teleport
   Application Service.
-- Take a look at application-related [Access Controls](../controls.mdx).
+- Take a look at application-related [Access Controls](../configuration/controls.mdx).
diff --git a/docs/pages/enroll-resources/application-access/jwt/grafana.mdx b/docs/pages/enroll-resources/application-access/jwt/grafana.mdx
new file mode 100644
index 0000000000000..e1dbaaca4c82d
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/jwt/grafana.mdx
@@ -0,0 +1,133 @@
+---
+title: Using JWT Authentication with Grafana
+sidebar_label: Grafana
+description: How to use JWT Authentication with Grafana
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide will help you configure Grafana [JWT
+authentication](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/jwt/)
+with Teleport.
+
+## How it works
+
+Teleport issues short-lived JWTs and injects them into each proxied request to
+Grafana. Grafana is configured to trust Teleport’s JWT signer, allowing it to
+verify the user’s identity and retrieve role information from the
+Teleport-signed token.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- Running [Application Service](../protect-apps/connecting-apps.mdx).
+- Access to main config of your Grafana instance
+
+## Step 1/3. Configure JWT authentication in Grafana
+
+(!docs/pages/includes/application-access/jwt-grafana-config.mdx!)
+
+## Step 2/3. Register a Grafana application in Teleport
+
+You can register the Grafana application in Teleport by defining it in your
+Teleport Application Service configuration, or by using dynamic registration
+with `tctl` or Terraform. Assign <Var name="app URI"
+initial="http://grafana.example.com:3000"/> to the domain of your Grafana
+instance:
+
+<Tabs>
+<TabItem label="Static configuration">
+Add an application entry in your Teleport Application Service configuration
+file, `teleport.yaml`:
+```yaml
+app_service:
+  enabled: true
+  apps:
+  - name: "grafana"
+    uri: <Var name="app URI"/>
+    rewrite:
+      headers:
+      - "Authorization: Bearer {{internal.jwt}}"
+```
+Restart the Teleport Application service.
+</TabItem>
+
+<TabItem label="tctl">
+Create an `app` resource definition file named `app-grafana.yaml`:
+```yaml
+# app-grafana.yaml
+kind: app
+version: v3
+metadata:
+  name: grafana
+spec:
+  uri: <Var name="app URI"/>
+  rewrite:
+    headers:
+    - name: "Authorization"
+      value: "Bearer {{internal.jwt}}"
+```
+
+Create the `app` resource with:
+```code
+$ tctl create -f app-grafana.yaml
+```
+</TabItem>
+
+<TabItem label="Terraform">
+Create a `teleport_app` resource in terraform:
+```hcl
+resource "teleport_app" "grafana" {
+  version = "v3"
+  metadata = {
+    name = "grafana"
+    labels = {
+      "teleport.dev/origin" = "dynamic"
+    }
+  }
+
+  spec = {
+    uri = "<Var name="app URI"/>"
+    rewrite = {
+      headers = [{
+        name  = "Authorization"
+        value = "Bearer {{internal.jwt}}"
+      }]
+    }
+  }
+}
+```
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+
+</Tabs>
+
+
+The header rewrite configuration above will replace the `{{internal.jwt}}`
+template variable with a Teleport-signed JWT token in each request.
+
+## Step 3/3. Connect to Grafana
+
+Log in to your Teleport cluster in your browser at https://<Var
+name="teleport.example.com" />.
+
+In the **Resources** tab, locate the `grafana` application and click **Launch**.
+
+Grafana will open and you should be automatically logged in as your Teleport
+user. You can verify this by clicking your profile icon in the upper-right
+corner.
+
+## Next steps
+
+- Get more information about integrating with [Teleport JWT tokens](./introduction.mdx).
+- See the [dynamic registration](../configuration/dynamic-registration.mdx) guide.
+- Learn more about [accessing APIs](../protect-apps/api-access.mdx) with the Teleport
+  Application Service.
+- Take a look at application-related [Access Controls](../configuration/controls.mdx).
diff --git a/docs/pages/enroll-resources/application-access/jwt/introduction.mdx b/docs/pages/enroll-resources/application-access/jwt/introduction.mdx
index f6485908584ad..e808247550b13 100644
--- a/docs/pages/enroll-resources/application-access/jwt/introduction.mdx
+++ b/docs/pages/enroll-resources/application-access/jwt/introduction.mdx
@@ -1,86 +1,18 @@
 ---
 title: Use JWT Tokens With Application Access
+sidebar_label: JWT Tokens
 description: How to use JWT tokens for authentication with Teleport application access.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
-Teleport sends a JWT token signed with Teleport's authority with each request
-to a target application in a `Teleport-Jwt-Assertion` header.
-
-You can use the JWT token to get information about the authenticated Teleport
-user, its roles, and its traits. This allows you to:
-
-- Map Teleport identity/roles/traits onto the identity/roles/traits of your web application.
-- Trust Teleport identity to automatically sign in users into your application.
-
-## Introduction to JWTs
-
-JSON Web Token (JWT) is an open standard that defines a secure way to transfer
-information between parties as a JSON Object.
-
-For an in-depth explanation please visit [https://jwt.io/introduction/](https://jwt.io/introduction/).
-
-Teleport JWTs include three sections:
-
-- Header
-- Payload
-- Signature
-
-### Header
-
-*Example Header*
-
-```json
-{
-  "alg": "RS256",
-  "typ": "JWT"
-}
-```
-
-### Payload
-
-*Example Payload*
-
-```json
-{
-  "aud": [
-    "http://127.0.0.1:34679"
-  ],
-  "iss": "aws",
-  "nbf": 1603835795,
-  "sub": "alice",
-  // Teleport user name.
-  "username": "alice"
-  // Teleport user roles.
-  "roles": [
-    "admin"
-  ],
-  // Teleport user traits.
-  "traits": {
-    "logins": [
-      "root",
-      "ubuntu",
-      "ec2-user"
-    ]
-  },
-  // Teleport identity expiration.
-  "exp": 1603943800,
-}
-```
-
-The JWT will be sent with the header: `Teleport-Jwt-Assertion`.
-
-*Example Teleport JWT Assertion*
-
-```json
-eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsiaHR0cDovLzEyNy4wLjAuMTozNDY3OSJdLCJleHAiOjE2MDM5NDM4MDAsImlzcyI6ImF3cyIsIm5iZiI6MTYwMzgzNTc5NSwicm9sZXMiOlsiYWRtaW4iXSwic3ViIjoiYmVuYXJlbnQiLCJ1c2VybmFtZSI6ImJlbmFyZW50In0.PZGUyFfhEWl22EDniWRLmKAjb3fL0D4cTmkxEfb-Q30hVMzVhka5WB8AUsPsLPVhTzsQ6Nkk1DnXHdz6oxrqDDfumuRrDnpJpjiXj_l0D3bExrchN61enzBHxSD13VkRIqP1V6l4i8yt8kXDIBWc-QejLTodA_GtczkDfnnpuAfaxIbD7jEwF27KI4kZu7uES9LMu2iCLdV9ZqarA-6HeDhXPA37OJ3P6eVQzYpgaOBYro5brEiVpuJLr1yA0gncmR4FqmhCpCj-KmHi2vmjmJAuuHId6HZoEZJjC9IAsNlrSA4GHH9j82o7FF1F4J2s38bRy3wZv46MT8X8-QBSpg
-```
+(!docs/pages/includes/application-access/jwt-intro.mdx!)
 
 ## Inject JWT
 
-You can inject a JWT token into any header using [headers passthrough](../guides/connecting-apps.mdx#headers-passthrough)
-configuration and the `{{internal.jwt}}` template variable. This variable will
-be replaced with JWT token signed by Teleport JWT CA containing user identity
-information like described above.
+(!docs/pages/includes/application-access/jwt-inject.mdx!)
 
 For example:
 
@@ -95,23 +27,7 @@ For example:
 
 ## Validate JWT
 
-Teleport provides a JSON Web Key Set (`jwks`) endpoint to verify that the JWT
-can be trusted. This endpoint is `https://[cluster-name]:3080/.well-known/jwks.json`:
-
-*Example jwks.json*
-
-```json
-{
-  "keys": [
-    {
-      "kty": "RSA",
-      "n": "xk-0VSVZY76QGqeN9TD-FJp32s8jZrpsalnRoFwlZ_JwPbbd5-_bPKcz8o2tv1eJS0Ll6ePxRCyK68Jz2UC4V4RiYaqJCRq_qVpDQMB1sQ7p9M-8qvT82FJ-Rv-W4RNe3xRmBSFDYdXaFm51Uk8OIYfv-oZ0kGptKpkNY390aJOzjHPH2MqSvhk9Xn8GwM8kEbpSllavdJCRPCeNVGJXiSCsWrOA_wsv_jqBP6g3UOA9GnI8R6HR14OxV3C184vb3NxIqxtrW0C4W6UtSbMDcKcNCgajq2l56pHO8In5GoPCrHqlo379LE5QqpXeeHj8uqcjeGdxXTuPrRq1AuBpvQ",
-      "e": "AQAB",
-      "alg": "RS256"
-    }
-  ]
-}
-```
+(!docs/pages/includes/application-access/jwt-validate.mdx!)
 
 See the example Go program used to validate Teleport's JWT tokens on our
 [GitHub](https://github.com/gravitational/teleport/blob/v(=teleport.version=)/examples/jwt/verify-jwt.go).
@@ -123,3 +39,8 @@ Many existing web applications and APIs support JWT authentication.
 The following guides are currently available showing how to configure it:
 
 - [ElasticSearch](./elasticsearch.mdx)
+- [Grafana](./grafana.mdx)
+
+## Troubleshooting
+
+(!docs/pages/includes/application-access/jwt-configure-claims.mdx!)
diff --git a/docs/pages/enroll-resources/application-access/jwt/jwt.mdx b/docs/pages/enroll-resources/application-access/jwt/jwt.mdx
index aab990bf03f89..3b8fae471dd47 100644
--- a/docs/pages/enroll-resources/application-access/jwt/jwt.mdx
+++ b/docs/pages/enroll-resources/application-access/jwt/jwt.mdx
@@ -1,7 +1,12 @@
 ---
 title: Application Access JWT Authentication
+sidebar_label: JWT Applications
+sidebar_position: 4
 description: Guides for using Teleport application access JWT authentication.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 These guides explain how web apps behind the Teleport Application Service can
@@ -10,3 +15,4 @@ authorization.
 
 - [Introduction](introduction.mdx): Introduction to JWT tokens with application access.
 - [Elasticsearch](elasticsearch.mdx): How to use JWT authentication with Elasticsearch.
+- [Grafana](grafana.mdx): How to use JWT authentication with Grafana.
diff --git a/docs/pages/enroll-resources/application-access/guides/amazon-athena.mdx b/docs/pages/enroll-resources/application-access/protect-apps/amazon-athena.mdx
similarity index 98%
rename from docs/pages/enroll-resources/application-access/guides/amazon-athena.mdx
rename to docs/pages/enroll-resources/application-access/protect-apps/amazon-athena.mdx
index 58a7245ebb7c0..277f834445803 100644
--- a/docs/pages/enroll-resources/application-access/guides/amazon-athena.mdx
+++ b/docs/pages/enroll-resources/application-access/protect-apps/amazon-athena.mdx
@@ -1,8 +1,16 @@
 ---
 title: Amazon Athena Access
+sidebar_label: Amazon Athena
 description: How to access Amazon Athena with Teleport
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 You can set up secure access to Amazon Athena using Teleport's support for the
 [AWS CLI and Console](../cloud-apis/aws-console.mdx).
 
diff --git a/docs/pages/enroll-resources/application-access/guides/api-access.mdx b/docs/pages/enroll-resources/application-access/protect-apps/api-access.mdx
similarity index 98%
rename from docs/pages/enroll-resources/application-access/guides/api-access.mdx
rename to docs/pages/enroll-resources/application-access/protect-apps/api-access.mdx
index 3265a88febc8c..17299076bb564 100644
--- a/docs/pages/enroll-resources/application-access/guides/api-access.mdx
+++ b/docs/pages/enroll-resources/application-access/protect-apps/api-access.mdx
@@ -1,6 +1,11 @@
 ---
 title: Access REST APIs With Teleport Application Access
+sidebar_label: REST APIs
 description: How to access REST APIs with Teleport application access.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The Teleport Application Service can be used to access applications' (REST or
diff --git a/docs/pages/enroll-resources/application-access/guides/connecting-apps.mdx b/docs/pages/enroll-resources/application-access/protect-apps/connecting-apps.mdx
similarity index 93%
rename from docs/pages/enroll-resources/application-access/guides/connecting-apps.mdx
rename to docs/pages/enroll-resources/application-access/protect-apps/connecting-apps.mdx
index 0146edf094867..c708627239a3c 100644
--- a/docs/pages/enroll-resources/application-access/guides/connecting-apps.mdx
+++ b/docs/pages/enroll-resources/application-access/protect-apps/connecting-apps.mdx
@@ -1,6 +1,11 @@
 ---
 title: Web Application Access
+sidebar_label: Web Applications
 description: In this getting started guide, learn how to connect an application to your Teleport cluster by running the Teleport Application Service.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide shows you how to enroll a web application with your Teleport cluster
@@ -14,7 +19,7 @@ Application Service, which uses a join token to establish trust with the
 Teleport Auth Service. Users visit Teleport-protected web applications through
 the Teleport Web UI. The Teleport Proxy Service routes browser traffic to the
 Teleport Application Service, which forwards HTTP requests to and from target
-applications. 
+applications.
 
 ## Prerequisites
 
@@ -35,7 +40,7 @@ target application, then deploy a Teleport Agent to run the service.
 ### Generate a token
 
 A join token is required to authorize a Teleport Application Service to
-join the cluster. 
+join the cluster.
 
 1. Generate a short-lived join token. Make sure to change `app-name` to the name
    of your application and `app-uri` to the application's domain name and port:
@@ -154,6 +159,7 @@ header or move this page.
 */}
 
 An application name should make a valid sub-domain (\<=63 characters, no spaces, only `a-z 0-9 -` allowed).
+It should also be unique across root and leaf clusters if you are deploying in a trusted clusters environment.
 
 After Teleport is running, users can access the app at `app-name.proxy_public_addr.com`
 e.g. `grafana.teleport.example.com`. You can also override `public_addr` e.g
@@ -192,6 +198,7 @@ address. To override the public address, specify the `public_addr` field:
 ```yaml
 - name: "jira"
   uri: "https://localhost:8001"
+  # The public address must be a unique DNS name and not conflict with the Teleport cluster's public addresses.
   public_addr: "jira.example.com"
 ```
 
@@ -321,7 +328,7 @@ rewritten:
 - Any header matching the pattern `X-Forwarded-*`
 
 Rewritten header values support the same templating variables as
-[role templates](../../../admin-guides/access-controls/guides/role-templates.mdx). In the
+[role templates](../../../zero-trust-access/rbac-get-started/role-templates.mdx). In the
 example above, `X-Internal-Trait` header will be populated with the value of
 internal user trait `logins` and `X-External-Trait` header will get the value of
 the user's external `env` trait coming from the identity provider.
@@ -336,29 +343,7 @@ Controls Reference](../../../reference/access-controls/roles.mdx).
 
 ### Configuring the JWT token
 
-By default, Teleport includes a user's roles and traits in the JWT
-generated for application access. If your application doesn't care
-about these values, or you are encountering an error due to exceeding
-the size limit of HTTP headers, you can configure Teleport to omit
-this information from the token.
-
-```yaml
-- name: "dashboard"
-  uri: https://localhost:4321
-  public_addr: dashboard.example.com
-  rewrite:
-    # Specify whether to include roles or traits in the JWT.
-    # Options:
-    # - roles-and-traits: include both roles and traits
-    # - roles: include only roles
-    # - traits: include only traits
-    # - none: exclude both roles and traits from the JWT token
-    # Default: roles-and-traits
-    jwt_claims: roles-and-traits
-    headers:
-    # Inject header with Teleport-signed JWT token.
-    - "Authorization: Bearer {{internal.jwt}}"
-```
+(!docs/pages/includes/application-access/jwt-configure-claims.mdx!)
 
 ### Backends-for-Frontends support
 
@@ -461,4 +446,4 @@ do so by hitting the `/teleport-logout` endpoint:
 ## Next steps
 
 - Learn how to [configure web apps as TCP apps to access them through
-  VNet](vnet.mdx#accessing-web-apps-through-vnet).
+  VNet](../vnet.mdx#accessing-web-apps-through-vnet).
diff --git a/docs/pages/enroll-resources/application-access/guides/dynamodb.mdx b/docs/pages/enroll-resources/application-access/protect-apps/dynamodb.mdx
similarity index 96%
rename from docs/pages/enroll-resources/application-access/guides/dynamodb.mdx
rename to docs/pages/enroll-resources/application-access/protect-apps/dynamodb.mdx
index ea9bb72f6a801..1e1cbac34d1b8 100644
--- a/docs/pages/enroll-resources/application-access/guides/dynamodb.mdx
+++ b/docs/pages/enroll-resources/application-access/protect-apps/dynamodb.mdx
@@ -1,6 +1,12 @@
 ---
 title: Amazon DynamoDB using the Teleport Application Service
+sidebar_label: Amazon DynamoDB
 description: How to access Amazon DynamoDB through the Teleport Application Service
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 You can configure the Teleport Application Service to enable secure access to
@@ -28,7 +34,7 @@ The Teleport Application Service enables secure access to DynamoDB via its
 [integration](../cloud-apis/aws-console.mdx) with the AWS management console and
 API. This is an alternative to accessing DynamoDB through the Teleport Database
 service, as described in our [Protect Amazon DynamoDB with
-Teleport](../../database-access/enroll-aws-databases/aws-dynamodb.mdx) guide.
+Teleport](../../database-access/enrollment/aws/aws-dynamodb.mdx) guide.
 
 <Admonition type="warning">
 The Application Service's integration with AWS is not designed specifically for
diff --git a/docs/pages/enroll-resources/application-access/protect-apps/protect-apps.mdx b/docs/pages/enroll-resources/application-access/protect-apps/protect-apps.mdx
new file mode 100644
index 0000000000000..a2f5267fca4d5
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/protect-apps/protect-apps.mdx
@@ -0,0 +1,11 @@
+---
+title: Protecting Applications with Teleport
+sidebar_label: Internal Applications
+sidebar_position: 3
+description: Provides step-by-step instructions to protecting different kinds of applications with Teleport.
+---
+
+The guides in this section show you how to enroll specific kinds of applications
+with your Teleport cluster, including the following:
+
+<DocCardList kind="labelOnly" />
diff --git a/docs/pages/enroll-resources/application-access/protect-apps/tcp.mdx b/docs/pages/enroll-resources/application-access/protect-apps/tcp.mdx
new file mode 100644
index 0000000000000..b40c8b4f4da74
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/protect-apps/tcp.mdx
@@ -0,0 +1,231 @@
+---
+title: TCP Application Access
+sidebar_label: TCP Applications
+description: How to configure Teleport for accessing plain TCP apps
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+Teleport can provide access to any TCP-based application. This allows users to
+connect to applications which Teleport doesn't natively support such as SMTP
+servers or databases not yet natively supported by the Teleport Database
+Service.
+
+## How it works
+
+A Teleport administrator configures the Teleport Application Service to proxy a
+TCP application. The end user starts a local proxy that authenticates to the
+Teleport Proxy Service using mutual TLS. The Proxy Service forwards traffic from
+the local proxy to and from the Teleport Application Service, which in turn
+proxies traffic to and from a Teleport-protected TCP application. 
+
+As with any Teleport-protected resource, the TCP application needs to be in the
+same network as the agent (the Teleport Application Service), but the agent and
+the Teleport-protected resource can run in a separate network from the Teleport
+Proxy Service.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- TCP application to connect to. In this guide we'll use a PostgreSQL running
+  in Docker as an example. You can also use any TCP-based application you may
+  already have.
+- Host where you will run the Teleport Application Service.
+
+We will assume your Teleport cluster is accessible at `teleport.example.com`.
+You can substitute the address of your Teleport Proxy Service. (For Teleport
+Cloud customers, this will be similar to `example.teleport.sh`.)
+
+## Step 1/4. Start PostgreSQL container
+
+Skip this step if you already have an application you'd like to connect to.
+
+Start a PostgreSQL server in a Docker container:
+
+```code
+$ docker run --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=<pass> -d postgres
+```
+
+## Step 2/4. Start Teleport Application Service
+
+Teleport Application Service requires a valid auth token to join the cluster.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+To generate one, run the following command on your Auth Service node:
+
+```code
+$ tctl tokens add --type=app
+```
+
+Next, create a Teleport user with the `access` role that will allow it to
+connect to cluster applications:
+
+```code
+$ tctl users add --roles=access alice
+```
+</TabItem>
+
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+To generate one, log into your Cloud tenant and run the following command:
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh
+$ tctl tokens add --type=app
+```
+</TabItem>
+
+</Tabs>
+
+Save the generated token in `/tmp/token` on the node where Application Service
+will run.
+
+Now, install Teleport on the Application Service node. It must be able to reach
+both your Teleport Proxy and the TCP application it's going to proxy.
+
+(!docs/pages/includes/install-linux.mdx!)
+
+Create the Application Service configuration file `/etc/teleport.yaml` with
+the following contents:
+
+```yaml
+version: v3
+teleport:
+  auth_token: "/tmp/token"
+  proxy_server: teleport.example.com:3080
+auth_service:
+  enabled: false
+ssh_service:
+  enabled: false
+proxy_service:
+  enabled: false
+app_service:
+  enabled: true
+  apps:
+  - name: "tcp-app"
+    uri: tcp://localhost:5432
+```
+
+Note that the URI scheme must be `tcp://` in order for Teleport to recognize
+this as a TCP application.
+
+(!docs/pages/includes/start-teleport.mdx!)
+
+## Step 3/4. Start app proxy
+
+Log into your Teleport cluster and view available applications:
+
+```code
+$ tsh login --proxy=teleport.example.com
+$ tsh apps ls
+Application Description   Type Public Address                   Labels
+----------- ------------- ---- -------------------------------- -----------
+tcp-app                   TCP  tcp-app.teleport.example.com
+```
+
+Your TCP application should show up and be denoted with a `TCP` type.
+
+Now log into the application:
+
+```code
+$ tsh apps login tcp-app
+Logged into TCP app tcp-app. Start the local TCP proxy for it:
+
+  tsh proxy app tcp-app
+
+Then connect to the application through this proxy.
+```
+
+Next, start a local proxy for it:
+
+```code
+$ tsh proxy app tcp-app
+Proxying connections to tcp-app on 127.0.0.1:55868
+```
+
+The `tsh proxy app` command will set up a listener that will proxy all connections to
+the target application.
+
+## Step 4/4. Connect
+
+Once the local proxy is running, you can connect to the application using the
+application client you would normally use to connect to it:
+
+```code
+$ psql postgres://postgres@localhost:55868/postgres
+```
+
+## Next steps
+
+### Configuring access to multiple ports
+
+By default, the Application Service proxies connections to the `uri` field from the application
+specification. However, Teleport can enable access to multiple ports of a TCP application. An
+application specification in this case needs to have no port number in the `uri` field and a new
+field called `tcp_ports` with a list of ports.
+
+For example, let's take tcp-app from the steps above and add access to port 8080 and port range
+31276-32300. The Application Service definition should look like this:
+
+```yaml
+app_service:
+  enabled: true
+  apps:
+  - name: "tcp-app"
+    uri: tcp://localhost # No port in the URI
+    tcp_ports:
+    - port: 5432 # PostgreSQL
+    - port: 8080 # HTTP server
+    - port: 31276
+      end_port: 32300 # Inclusive end of range
+```
+
+To access the app, [start VNet](../../../connect-your-client/teleport-clients/vnet.mdx) and point an application
+client towards the target port:
+
+```code
+# Use 8080 for the HTTP server.
+$ curl -I http://tcp-app.teleport.example.com:8080
+HTTP/1.1 200 OK
+
+# Use 5432 for postgres.
+$ psql postgres://postgres@tcp-app.teleport.example.com:5432/postgres
+```
+
+Without VNet, use `tsh proxy app` and specify the target port after the listening port. All
+connections made to the proxy will be routed to that target port.
+
+```code
+# Use 12345 as the listening port and 8080 as the target port.
+$ tsh proxy app tcp-app --port 12345:8080
+Proxying connections to tcp-app:8080 on 127.0.0.1:12345
+
+# Use a random listening port and 5432 as the target port.
+$ tsh proxy app tcp-app --port 0:5432
+Proxying connections to tcp-app:5432 on 127.0.0.1:65060
+```
+
+<Admonition type="warning">
+There is no RBAC for TCP ports – a user that has access to an application can connect to any port in
+the specification. We&nbsp;strongly recommend specifying only the necessary ports instead of defining a
+wide port range that happens to include ports that are meant to be available.
+</Admonition>
+
+{/* TODO: DELETE IN 19.0.0. At this point all compatible servers and clients are going
+to support multiple ports. */}
+
+Support for multiple ports is available in Teleport v17.1+. Connections from Teleport clients that
+do not support multiple ports are routed to the first port from the application specification. An
+Application Service that does not support multiple ports will not be able to handle traffic to a
+multi-port application if it receives such application through [dynamic
+registration](../configuration/dynamic-registration.mdx) from an Auth Service.
+
+### Further reading
+
+- Learn about [access controls](../configuration/controls.mdx) for applications.
+- Learn how to [connect to TCP apps with VNet](../../../connect-your-client/teleport-clients/vnet.mdx) and
+  [configure VNet for custom `public_addr`](../vnet.mdx).
diff --git a/docs/pages/enroll-resources/application-access/reference.mdx b/docs/pages/enroll-resources/application-access/reference.mdx
new file mode 100644
index 0000000000000..08e3e11a27635
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/reference.mdx
@@ -0,0 +1,238 @@
+---
+title: Teleport Application Service Reference
+sidebar_label: Reference
+description: Configuration and CLI reference documentation for Teleport application access.
+sidebar_position: 8
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide describes interfaces and options for interacting with the Teleport
+Application Service, including the static configuration file for the `teleport`
+binary, the dynamic `app` resource, and `tsh apps` commands.
+
+## Configuration
+
+(!docs/pages/includes/backup-warning.mdx!)
+
+The following snippet shows the full YAML configuration of an Application Service
+appearing in the `teleport.yaml` configuration file:
+
+```yaml
+app_service:
+  # Enables application proxy service.
+  enabled: true
+  # Teleport provides a small debug app called "dumper" that can be used
+  # to make sure application access is working correctly. It outputs JWTs,
+  #  so it can be useful when extending your application.
+  debug_app: true
+  # Matchers for application resources created with "tctl create" command.
+  resources:
+  - labels:
+      "*": "*"
+  # This section contains definitions of all applications proxied by this
+  # service. It can contain multiple items.
+  apps:
+    # Name of the application. Used for identification purposes.
+  - name: "grafana"
+    # Free-form application description.
+    description: "This is an internal Grafana instance"
+    # URI and port the application is available at.
+    uri: "http://localhost:3000"
+    # Optional application public address to override.
+    public_addr: "grafana.teleport.example.com"
+    # Rewrites section.
+    rewrite:
+      # Specify whether to include roles or traits in the JWT.
+      # Options:
+      # - roles-and-traits: include both roles and traits
+      # - roles: include only roles
+      # - traits: include only traits
+      # - none: exclude both roles and traits from the JWT token
+      # Default: roles-and-traits
+      jwt_claims: roles-and-traits
+      # Rewrite the "Location" header on redirect responses replacing the
+      # host with the public address of this application.
+      redirect:
+      - "grafana.internal.dev"
+      # Headers passthrough configuration.
+      headers:
+      - "X-Custom-Header: example"
+      - "X-External-Trait: {{external.env}}"
+    # Disable application certificate validation.
+    insecure_skip_verify: true
+    # Optional static labels to assign to the app. Used in RBAC.
+    labels:
+      env: "prod"
+    # Optional dynamic labels to assign to the app. Used in RBAC.
+    commands:
+    - name: "hostname"
+      command: ["hostname"]
+      period: 1m0s
+    # Optional AWS-specific configurations.
+    aws:
+      # External ID used when assuming AWS roles for this application.
+      external_id: "example-external-id"
+  - name: "azure-cli"
+    # Optional: For access to cloud provider APIs, specify the cloud provider.
+    # Allowed values are "AWS", "Azure", and "GCP".
+    cloud: "Azure"
+```
+
+For full details on configuring Teleport roles, including how Teleport
+populates the `external` traits, see the [Access Controls
+Reference](../../reference/access-controls/roles.mdx).
+
+## Application resource
+
+Full YAML spec of application resources managed by `tctl` resource commands:
+
+```yaml
+kind: app
+version: v3
+metadata:
+  # Application name.
+  name: example
+  # Application description.
+  description: "Example application"
+  # Application static labels.
+  labels:
+    env: local
+spec:
+  # URI and port application is available at.
+  uri: http://localhost:4321
+  # Optional application public address.
+  public_addr: test.example.com
+  # Disable application certificate validation.
+  insecure_skip_verify: true
+  # Rewrites configuration.
+  rewrite:
+    # Rewrite the "Location" header on redirect responses replacing the
+    # host with the public address of this application.
+    redirect:
+    - "grafana.internal.dev"
+    # Headers passthrough configuration.
+    headers:
+    - name: "X-Custom-Header"
+      value: "example"
+    - name: "X-External-Trait"
+      value: "{{external.env}}"
+  # Optional dynamic labels.
+  dynamic_labels:
+  - name: "hostname"
+    command: ["hostname"]
+    period: 1m0s
+```
+
+You can create a new `app` resource by running the following commands, which
+assume that you have created a YAML file called `app.yaml` with your configuration:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+# Create the resource
+$ tctl create -f app.yaml
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+$ tsh login --proxy=mytenant.teleport.sh --user=myuser
+# Create the resource.
+$ tctl create -f app.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+## CLI
+
+This section shows CLI commands relevant for application access.
+
+### tsh apps ls
+
+Lists available applications.
+
+```code
+$ tsh apps ls
+```
+
+### tsh apps login
+
+Retrieves short-lived X.509 certificate for CLI application access.
+
+```code
+$ tsh apps login grafana
+```
+
+| Flag | Description |
+| - | - |
+| `--aws-role` | For AWS CLI access, the role ARN or role name of an AWS IAM role. |
+| `--azure-identity` | For Azure CLI access, the name or URI of an Azure managed identity to use for accessing the Azure CLI. |
+
+### tsh apps logout
+
+Removes CLI application access certificate.
+
+```code
+# Log out of a particular app.
+$ tsh apps logout grafana
+
+# Log out of all apps.
+$ tsh apps logout
+```
+
+### tsh apps config
+
+Prints application connection information.
+
+```code
+# Print app information in a table form.
+$ tsh apps config
+
+# Print information for a particular app.
+$ tsh apps config grafana
+
+# Print an example curl command.
+$ tsh apps config --format=curl
+
+# Construct a curl command.
+$ curl $(tsh apps config --format=uri) \
+  --cacert $(tsh apps config --format=ca) \
+  --cert $(tsh apps config --format=cert) \
+  --key $(tsh apps config --format=key)
+```
+
+| Flag | Description |
+| - | - |
+| `--format` | Optional print format, one of: `uri` to print app address, `ca` to print CA cert path, `cert` to print cert path, `key` print key path, `curl` to print example curl command.|
+
+### tsh az
+
+Run an Azure CLI command via the Teleport Application Service:
+
+```code
+$ tsh az <command>
+```
+
+`<command>`: A valid command within the `az` CLI, including arguments and flags.
+See the [Azure
+documentation](https://learn.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest)
+for the full list of `az` CLI commands.
+
+To run this command, one of the user's roles must include the
+`spec.allow.azure_identities` field with one of the identities used by the
+Application Service. To learn how to set up secure access to Azure via Teleport,
+read [Protect the Azure CLI with Teleport Application
+Access](../../enroll-resources/application-access/cloud-apis/azure.mdx).
+
diff --git a/docs/pages/enroll-resources/application-access/troubleshooting-apps.mdx b/docs/pages/enroll-resources/application-access/troubleshooting-apps.mdx
index 1407f5d75b584..784413b44681b 100644
--- a/docs/pages/enroll-resources/application-access/troubleshooting-apps.mdx
+++ b/docs/pages/enroll-resources/application-access/troubleshooting-apps.mdx
@@ -1,6 +1,11 @@
 ---
 title: Troubleshooting Application Access
+sidebar_label: Troubleshooting
 description: Describes common issues and solutions for access to applications protected by Teleport.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This section describes common issues that you might encounter in managing access to applications
@@ -197,7 +202,7 @@ likely to exceed the limit.
 {/* vale messaging.protocol-products = NO */}
 This configuration is available under the `jwt_claims` property of the
 application's `rewrite` configuration. See
-[Web Application Access](./guides/connecting-apps.mdx#configuring-the-jwt-token)
+[Web Application Access](protect-apps/connecting-apps.mdx#configuring-the-jwt-token)
 for details.
 {/* vale messaging.protocol-products = YES */}
 
diff --git a/docs/pages/enroll-resources/application-access/vnet.mdx b/docs/pages/enroll-resources/application-access/vnet.mdx
new file mode 100644
index 0000000000000..9b9ccaa8b94ad
--- /dev/null
+++ b/docs/pages/enroll-resources/application-access/vnet.mdx
@@ -0,0 +1,185 @@
+---
+title: VNet
+description: How to configure custom DNS zones for VNet
+sidebar_position: 5
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+VNet automatically proxies connections made to TCP applications available under the public address
+of a Proxy Service. This guide explains how to configure VNet to support apps with [custom public
+addresses](protect-apps/connecting-apps.mdx#customize-public-address).
+
+## How it works
+
+Let's assume that a user has logged in to a cluster through a Proxy Service available at
+`teleport.example.com`. There's a leaf cluster associated with that cluster. It has its own Proxy
+Service available at `leaf.example.com`. Once started, VNet captures DNS queries for both of those
+domains and their subdomains.
+
+Type A and AAAA queries are matched against `public_addr` of applications registered in both
+clusters. If there's a match and the application is registered as a TCP application, VNet responds
+with a virtual IP address over which the connection will be proxied to the app. In any other
+case, the query is forwarded to the default DNS name server used by the OS.
+
+If you want VNet to forward connections to an app that has a custom `public_addr` set, you need
+to first update the VNet config in the Auth Service to include a matching DNS zone.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v16.0.0 or higher)"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A TCP application connected to the cluster.
+- A domain name under your control.
+
+{/* vale messaging.protocol-products = NO */}
+In this guide, we'll use the example app from [TCP Application Access guide](protect-apps/tcp.mdx) and make it
+available through VNet at <Var name="public_addr" initial="tcp-app.company.test"/> with
+<Var name="suffix" initial="company.test" /> as the custom DNS zone.
+{/* vale messaging.protocol-products = YES */}
+
+## Step 1/3. Configure custom DNS zone
+
+Edit the VNet config:
+
+```code
+$ tctl edit vnet_config
+```
+
+Add a custom DNS zone. In our case the `public_addr` of the app is going to be
+`tcp-app.company.test`, so we're going to set `company.test` as `suffix`. The `spec` section of the
+config should include the `custom_dns_zones` field:
+
+```diff
+kind: vnet_config
+metadata:
+  name: vnet-config
+  # …
+spec:
++ custom_dns_zones:
++ - suffix: <Var name="suffix" />
+  # …
+version: v1
+```
+
+<Admonition type="note" title="Relationship between suffix and public_addr">
+`suffix` doesn't have to point to a domain that's exactly one level above the `public_addr` of an
+app. Any level of nesting works. For example, you can have an app under `tcp-app.foo.bar.qux.test`
+and the suffix can be set to `bar.qux.test`.
+</Admonition>
+
+## Step 2/3. Set `public_addr` of the app
+
+Set `public_addr` field of the application in the Application Service configuration file
+`/etc/teleport.yaml` and restart the `teleport` daemon.
+
+```diff
+version: v3
+# …
+app_service:
+  # …
+  apps:
+  - name: "tcp-app"
+    uri: tcp://localhost:5432
++   public_addr: "<Var name="public_addr" />"
+```
+
+## Step 3/3. Connect
+
+Once you [start VNet](../../connect-your-client/teleport-clients/vnet.mdx), you should be able to connect to the
+application over the custom `public_addr` using the application client you would normally use to
+connect to it. You might need to restart VNet if it was already running while you were making
+changes to the cluster.
+
+```code
+$ psql postgres://postgres@tcp-app.company.test/postgres
+```
+
+## Next steps
+
+### Configuring IPv4 CIDR range
+
+Each cluster has a configurable IPv4 CIDR range which VNet uses when assigning IP addresses to
+applications from that cluster. Root and leaf clusters can use different ranges. The default is
+`100.64.0.0/10` and it can be changed by setting the `ipv4_cidr_range` field of the VNet config.
+
+Edit the VNet config:
+
+```code
+$ tctl edit vnet_config
+```
+
+Edit the `ipv4_cidr_range` field in the `spec` section of the config:
+
+```diff
+kind: vnet_config
+metadata:
+  name: vnet-config
+  # …
+spec:
++ ipv4_cidr_range: "100.64.0.0/10"
+  # …
+version: v1
+```
+
+<Admonition type="note" title="IPv4 address of the TUN device">
+When starting, VNet needs to assign an IPv4 address for its virtual network device. To pick an
+address, [VNet arbitrarily chooses a root
+cluster](https://github.com/gravitational/teleport/issues/43343) that the user is logged in to and
+picks an address from the range used by that cluster. If your cluster uses a custom range, but your
+users are logged in to other clusters that are not under your control, this might cause VNet to pick
+an address for the TUN device from a range offered by one of those clusters.
+</Admonition>
+
+### Configuring leaf cluster apps
+
+To make a [leaf cluster](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) app accessible over a custom
+`public_addr`, you need to follow the same steps while being logged in directly to the leaf cluster.
+
+```code
+$ tsh login --proxy=leaf.example.com --user=email@example.com
+```
+
+### Accessing web apps through VNet
+
+VNet does not officially support [web apps](protect-apps/connecting-apps.mdx) yet.
+However, since all web apps are served over TCP, it's possible to convert a web
+app to [a TCP app](protect-apps/tcp.mdx) to make it available via VNet.
+You'll need to change the `uri` of the application to use `tcp://` instead of `https://`.
+
+Exposing plain HTTP web apps or APIs via VNet is not recommended.
+Untrusted websites can potentially use DNS rebinding attacks to bypass the
+browser’s Same-Origin Policy and issue plain HTTP requests to VNet IP addresses.
+It is strongly recommended to either avoid VNet for plain HTTP access or
+implement one or more of the following mitigations for DNS rebinding attacks:
+- upgrade these APIs to HTTPS or another protocol
+- enforce a Host header allowlist at the HTTP server
+- block browser access to HTTP websites
+
+There are a few more caveats when converting a Teleport web app to a TCP app:
+
+- The Teleport Web UI uses [HSTS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).
+  If the application is going to be served from a subdomain of a Proxy Service
+  it must use HTTPS, it will not be accessible in browsers over plain HTTP.
+  It's possible to work around this by setting a custom `public_addr` as explained
+  above in this guide to an address that is not a subdomain of the proxy address.
+- HTTPS Applications must handle their own TLS connections and have
+  a valid certificate for the app `public_addr`.
+- [JWT Tokens](jwt/introduction.mdx), [redirects](protect-apps/connecting-apps.mdx#rewrite-redirect) and
+  [header rewrites](protect-apps/connecting-apps.mdx#headers-passthrough) are not available for TCP apps.
+- Teleport records the start and the end of a session for TCP apps in the audit log, but [session
+  chunks](../../reference/architecture/session-recording.mdx) are not captured.
+
+The important thing to understand is that VNet doesn't do anything extra with a
+TCP connection, it tunnels it directly to the target application's `uri`.
+The application layer protocol is determined solely by the app itself and its
+clients.
+
+### Further reading
+
+- Read our VNet usage [guide](../../connect-your-client/teleport-clients/vnet.mdx) for end-users
+  accessing your applications with VNet.
+- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
diff --git a/docs/pages/enroll-resources/auto-discovery/auto-discovery.mdx b/docs/pages/enroll-resources/auto-discovery/auto-discovery.mdx
index 46f3c5ca15c6a..6ec1b23e7ef7f 100644
--- a/docs/pages/enroll-resources/auto-discovery/auto-discovery.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/auto-discovery.mdx
@@ -1,20 +1,125 @@
 ---
-title: Teleport Auto-Discovery
-description: "Learn how to use the Teleport Discovery Service, which automatically enrolls resources by query APIs"
+title: Auto-Discovery
+description: "Automatically detect and enroll resources in your infrastructure"
+template: doc-page
+tags:
+ - zero-trust
+ - infrastructure-identity
+sidebar_position: 1
 ---
 
-The Teleport Discovery Service automatically detects resources in your
-infrastructure and enrolls them in your Teleport cluster. When you deploy
-servers, databases, and Kubernetes clusters, Teleport enables secure access to
-these resources with no further configuration. This lets you decouple the need
-to protect your infrastructure resources from the work of deploying and managing
-them.
+import DocHero from "@site/src/components/Pages/Landing/DocHero";
+import EnrollmentMethods, { Method } from "@site/src/components/Pages/Landing/EnrollmentMethods/EnrollmentMethods";
 
-The Discovery Service runs on [Teleport Agents](../agents/agents.mdx). It
-periodically queries cloud provider APIs to list resources in your
-infrastructure. It then reconciles these resources with Teleport resources
-registered on the Auth Service backend.
+import autoDiscoveryImg from "@version/docs/img/auto-discovery/auto-discovery-hero.jpg";
+import databaseAccessImg from "@site/src/components/Icon/teleport-svg/database-access.svg";
+import kubernetesClustersSvg from "@site/src/components/Icon/teleport-svg/kubernetes-clusters.svg";
+import linuxServersSvg from "@site/src/components/Icon/teleport-svg/linux-servers.svg";
+import kubernetesSvg from "@site/src/components/Icon/svg/kubernetes2.svg";
 
-Set up Teleport auto-discovery for resources in your infrastructure:
+<DocHero
+  title="Automatically discover and connect to resources"
+  image={autoDiscoveryImg}
+>
+Streamline infrastructure security with the Teleport Discovery Service. When you deploy servers, databases, and Kubernetes clusters, the service enables secure access to them with no further configuration needed.
 
-<DocCardList />
+[Teleport Agents](../agents/agents.mdx) power the Discovery Service, automatically syncing resources with the Auth Service.
+</DocHero>
+
+<EnrollmentMethods title="Auto-discovery guides">
+<Method
+title="Databases"
+icon={databaseAccessImg}
+href="./databases/"
+tagLists={
+  [
+    {
+      tags: 
+        [
+          {
+            name: "AWS",
+            href: "./databases/aws/",
+            icon: "aws",
+          },
+          {
+            name: "Azure",
+            href: "../database-access/enrollment/azure/",
+            icon: "azure",
+          },
+        ] 
+    },
+  ]
+}
+>
+  Automatically discover and register databases in your cluster.
+</Method>
+<Method
+title="Servers"
+icon={linuxServersSvg}
+href="./servers/"
+tagLists={
+  [
+    {
+      tags: 
+        [
+          {
+            name: "Amazon EC2",
+            href: "./servers/ec2-discovery/",
+            icon: "ec2",
+          },
+          {
+            name: "Google Compute Engine",
+            href: "./servers/gcp-discovery/",
+            icon: "googleCloud",
+          },
+         {
+            name: "Azure Virtual Machines",
+            href: "./servers/azure-discovery/",
+            icon: "azure",
+          },
+        ] 
+    },
+  ]
+}
+>
+  Connect to your cloud provider to automatically find and enroll servers.
+</Method>
+<Method
+title="Kubernetes clusters"
+icon={kubernetesClustersSvg}
+href="./kubernetes/"
+tagLists={
+  [
+    {
+      tags: 
+        [
+          {
+            name: "AWS",
+            href: "./kubernetes/aws/",
+            icon: "aws",
+          },
+          {
+            name: "Azure",
+            href: "./kubernetes/azure/",
+            icon: "azure",
+          },
+          {
+            name: "Google Cloud",
+            href: "./kubernetes/google-cloud/",
+            icon: "googleCloud",
+          },
+        ]
+    },
+  ]
+}
+>
+  Enable automatic detection and enrollment of cloud-hosted Kubernetes clusters.
+</Method>
+<Method
+title="Kubernetes services as Teleport apps"
+icon={kubernetesSvg}
+href="./kubernetes-applications/"
+>
+  Teleport can automatically detect applications running in your Kubernetes clusters and register them with Teleport for secure access.
+</Method>
+</EnrollmentMethods>
diff --git a/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx b/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx
index f016509abb173..c3fefec31a1e5 100644
--- a/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/databases/aws.mdx
@@ -1,6 +1,12 @@
 ---
 title: AWS Database Discovery
+sidebar_label: AWS
 description: How to configure Teleport to auto-discover AWS databases.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 Teleport can be configured to discover AWS-hosted databases automatically and
@@ -251,15 +257,14 @@ resources in your Teleport cluster.
 In this case, it will match auto-discovered AWS databases in the
 <Var name="us-east-1"/> region
 from any AWS account (`"*"` is a wildcard and it can be used as a label key and/or value).
-You can make it match more specific databases by adjusting the label selectors.
 
-<Admonition type="tip">
+(!docs/pages/includes/discovery/db-label-warning.mdx!)
+
 The AWS tags attached to AWS databases are imported as Teleport `db` labels
 in addition to some other identifying metadata.
 Refer to
-[Database Labels Reference](../../../reference/agent-services/database-access-reference/labels.mdx)
+[Database Labels Reference](../../database-access/reference/labels.mdx)
 for more information about available database labels.
-</Admonition>
 
 ### Generate a join token
 
@@ -292,7 +297,7 @@ Additional Teleport RBAC configuration and possibly IAM configuration may also
 be required to connect to the discovered databases via Teleport.
 
 Refer to the appropriate guide in
-[Enroll AWS Databases](../../database-access/enroll-aws-databases/enroll-aws-databases.mdx)
+[Enroll AWS Databases](../../database-access/enrollment/aws/aws.mdx)
 for information about database user provisioning and configuration.
 </Admonition>
 
@@ -300,9 +305,9 @@ for information about database user provisioning and configuration.
 - Learn about [Dynamic Registration](../../database-access/guides/dynamic-registration.mdx) by the
   Teleport Database Service.
 - Get started by [connecting](../../database-access/guides/guides.mdx) your database.
-- Connect AWS databases in [external AWS accounts](../../database-access/enroll-aws-databases/aws-cross-account.mdx).
+- Connect AWS databases in [external AWS accounts](../../database-access/enrollment/aws/aws-cross-account.mdx).
 - Refer to the appropriate guide in
-[Enroll AWS Databases](../../database-access/enroll-aws-databases/enroll-aws-databases.mdx)
+[Enroll AWS Databases](../../database-access/enrollment/aws/aws.mdx)
 for information about database user provisioning and configuration.
 
 ## Troubleshooting
diff --git a/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx b/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx
index 1b1e0e6e62e14..a8d0b5226d602 100644
--- a/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/databases/databases.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Discovery
+sidebar_label: Databases
 description: Detailed guides for configuring database discovery.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can be configured to discover databases automatically and register
@@ -9,7 +14,7 @@ them with your Teleport cluster.
 ## Supported clouds
 
 - [AWS](aws.mdx): Discovery for AWS databases.
-- [Azure](../../database-access/enroll-azure-databases/enroll-azure-databases.mdx): Discovery for Azure databases.
+- [Azure](../../database-access/enrollment/azure/azure.mdx): Discovery for Azure databases.
 {/* TODO(gavin): Add an Azure discovery guide and permission reference */}
 
 ## Architecture overview
@@ -87,7 +92,8 @@ discovery_service:
       # 'rdsproxy' - Amazon RDS Proxy databases.
       # 'redshift' - Amazon Redshift databases.
       # 'redshift-serverless' - Amazon Redshift Serverless databases.
-      # 'elasticache' - Amazon ElastiCache Redis databases.
+      # 'elasticache' - Amazon ElastiCache Redis and Valkey databases.
+      # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
       # 'memorydb' - Amazon MemoryDB Redis databases.
       # 'opensearch' - Amazon OpenSearch Redis databases.
       # 'docdb' - Amazon DocumentDB databases.
@@ -146,7 +152,7 @@ Here's how it works in detail:
 
 For more information about Discovery Service configuration, refer to
 [one of the guides above](#supported-clouds) or the
-[Discovery Service Config File Reference](../../../reference/config.mdx).
+[Discovery Service Config File Reference](../../../reference/deployment/config.mdx).
 
 ## How the Database Service works
 
@@ -186,6 +192,10 @@ db_service:
         "teleport.dev/cloud": "AWS"
         # Specific to AWS. This is the AWS account ID.
         "account-id": "123456789012"
+        # Use specific label selectors so each Database Service only matches
+        # databases it can actually reach.
+        "env": "staging"
+        "vpc-id": "vpc-id-123"
       aws:
         # This is an optional AWS role ARN to assume when forwarding connections
         # to AWS databases.
@@ -212,10 +222,13 @@ Here's how it works in detail:
 1. **Label matching:** The Database Service monitors `db` resources and the
   first label selector in `db_service.resources[].labels` that matches a `db`
   will be used. If no selector matches, then the `db` resource is ignored.
-1. **Permissions:** The Database Service will assume the identity configured in
+
+  (!docs/pages/includes/discovery/db-label-warning.mdx!)
+
+2. **Permissions:** The Database Service will assume the identity configured in
   the label selector that matched. If the selector does not specify an identity,
   then the Database Service will use its own identity.
-1. **Connection:** The Database Service, acting as either its own identity or
+3. **Connection:** The Database Service, acting as either its own identity or
   the identity it assumed, will retrieve credentials to authenticate to the
   database and use those credentials to act as a proxy for an authorized
   Teleport user.
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/get-started.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/get-started.mdx
index 9cd71ba61a1c1..5060a718873f0 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/get-started.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/get-started.mdx
@@ -1,6 +1,11 @@
 ---
 title: Get Started with Kubernetes Application Discovery
+sidebar_label: Get Started
 description: Detailed guide for configuring Kubernetes Application Discovery.
+tags:
+ - get-started
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can automatically detect applications running in your Kubernetes
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/kubernetes-applications.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/kubernetes-applications.mdx
index 13c1d8339bdff..f613f68fccb02 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/kubernetes-applications.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/kubernetes-applications.mdx
@@ -1,6 +1,10 @@
 ---
 title: "Enroll Kubernetes Services as Teleport Applications"
+sidebar_label: Kubernetes Services
 description: "Teleport can automatically detect applications running in your Kubernetes clusters and register them with Teleport for secure access."
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can automatically detect applications running in your Kubernetes
@@ -20,6 +24,6 @@ traffic to them.
   application discovery with the `teleport-kube-agent` Helm chart.
 - [Architecture](../../../reference/architecture/kubernetes-applications-architecture.mdx): Learn how
   automatic application discovery works.
-- [Reference](../../../reference/agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx): Consult this guide
+- [Reference](reference.mdx): Consult this guide
   for options and Kubernetes annotations you can use to configure automatic
   Kubernetes application discovery.
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx
new file mode 100644
index 0000000000000..f8c79637a660e
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes-applications/reference.mdx
@@ -0,0 +1,171 @@
+---
+title: Kubernetes Application Discovery Reference
+sidebar_label: Configuration Reference
+description: This guide is a comprehensive reference of configuration options for automatically enrolling Kubernetes applications with Teleport.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+Kubernetes Application Discovery involves the Teleport Discovery Service,
+Teleport Application Service, and annotations on Kubernetes services. This guide
+shows you how to configure each of these to manage Kubernetes Application
+Discovery in your Kubernetes cluster.
+
+## Configuring Teleport Agent Helm chart
+
+You can configure scope of services discovery by setting value `kubernetesDiscovery` of the chart. For more information
+please see [helm chart documentation](../../../reference/helm-reference/teleport-kube-agent.mdx).
+
+`values.yaml` example:
+
+```yaml
+kubernetesDiscovery:
+- types: ["app"]
+  namespaces: [ "toronto", "porto" ]
+  labels:
+    env: staging
+- types: ["app"]
+  namespaces: [ "seattle", "oakland" ]
+  labels:
+    env: testing
+```
+
+## Configuring Kubernetes Apps Discovery manually
+
+While the `teleport-kube-agent` Helm chart will set up configuration for you
+automatically, you can also configure the required services manually. To do so,
+adjust the configuration files for the Teleport Application Service and Teleport
+Discovery Service, then restart the agents running these services.
+
+Configuration for the Discovery Service is controlled by the `kubernetes` field,
+example:
+
+(!docs/pages/includes/discovery/discovery-group.mdx!)
+
+```yaml
+# This section configures the Discovery Service
+discovery_service:
+  enabled: true
+  discovery_group: main-cluster
+  kubernetes:
+  - types: ["app"]
+    namespaces: [ "toronto", "porto" ]
+    labels:
+      env: staging
+  - types: ["app"]
+    namespaces: [ "seattle", "oakland" ]
+    labels:
+      env: testing
+```
+
+Configuration for the Application Service is controlled by the `resources` field, example:
+
+```yaml
+app_service:
+  enabled: true
+  resources:
+  - labels:
+    "teleport.dev/kubernetes-cluster": "main-cluster"
+    "teleport.dev/origin": "discovery-kubernetes"
+```
+
+Label `teleport.dev/kubernetes-cluster` should match value of `discovery_group` field in the Discovery Service config.
+
+For more information you can take a look at [`discovery_service`](../../../reference/deployment/config.mdx) and [`app_service`](../../../reference/deployment/config.mdx) configuration references.
+
+## Annotations
+
+Kubernetes annotations on services can be used to fine tune transformation of services to apps.
+All annotations are optional - they will override default behaviour, but they are not required for import of services.
+
+### `teleport.dev/discovery-type`
+
+Controls what type this service is considered to be. If annotation is missing,
+by default all services are considered to be of "app" type. If matchers in the Discovery Service
+config match service type it will be imported. Currently the only supported value is
+`app`, which means Teleport application will be imported from this service. In the future there are plans to expand to database importing.
+
+### `teleport.dev/protocol`
+
+Controls protocol for the uri of the Teleport app we create. If annotation is not set,
+heuristics will be used to try to determine protocol of an exposed port.
+If all heuristics didn't work, the port will be skipped. For app to be imported with `tcp` protocol, the
+service should have explicit annotation `teleport.dev/protocol: "tcp"`
+
+### `teleport.dev/port`
+
+Controls preferred port for the Kubernetes service, only this one will be used even if service
+has multiple exposed ports. Its value should be one of the exposed service ports; otherwise, the app will not be imported.
+Value can be matched either by numeric value or by the name of the port defined on the service.
+
+### `teleport.dev/name`
+
+Controls resulting app name. If present it will override default app name pattern
+`$SERVICE_NAME-$NAMESPACE-$KUBE_CLUSTER_NAME`. If multiple ports are exposed, resulting apps will have port names added
+as a suffix to the annotation value, as `$APP_NAME-$PORT1_NAME`, `$APP_NAME-$PORT2_NAME` etc, where `$APP_NAME` is the name
+set by the annotation.
+
+### `teleport.dev/description`
+
+Overrides the default description of the discovered app.
+
+### `teleport.dev/insecure-skip-verify`
+
+Controls whether TLS certificate verification should be skipped for this app.
+If present and set to `true`, TLS certificate verification will be skipped.
+
+```yaml
+annotations:
+  teleport.dev/insecure-skip-verify: "true"
+```
+
+### `teleport.dev/ignore`
+
+Controls whether this service should be ignored by the Discovery Service.
+This annotation is useful when you want to exclude a service from being imported as an app
+when it matches the Discovery Service config. For example, you may want to exclude a service
+that shares the same labels as another services that you want to import as apps.
+
+```yaml
+annotations:
+  teleport.dev/ignore: "true"
+```
+
+### `teleport.dev/app-rewrite`
+
+Controls rewrite configuration for Teleport app, if needed. It should
+contain full rewrite configuration in YAML format, same as one would use when configuring an app with dynamic registration syntax (see [documentation](../../../enroll-resources/application-access/protect-apps/connecting-apps.mdx)).
+
+```yaml
+annotations:
+  teleport.dev/app-rewrite: |
+    redirect:
+    - "localhost"
+    - "jenkins.internal.dev"
+    headers:
+    - name: "X-Custom-Header"
+      value: "example"
+    - name: "Authorization"
+      value: "Bearer {{internal.jwt}}"
+```
+
+### `teleport.dev/public-addr`
+
+Controls the public address for the Teleport app we create if needed.
+
+```yaml
+annotations:
+  teleport.dev/public-addr: "custom.teleport.dev"
+```
+
+### `teleport.dev/path`
+
+The path is appended to the URI generated for the Teleport app for cases where
+an application is served on a sub-path of an HTTP service.
+
+```yaml
+annotations:
+  teleport.dev/path: "foo/bar"
+```
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes/aws.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes/aws.mdx
index 93db37bf55cd5..16ff99eef04b6 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes/aws.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes/aws.mdx
@@ -1,6 +1,12 @@
 ---
 title: Teleport EKS Auto-Discovery
+sidebar_label: Elastic Kubernetes Service
 description: How to configure auto-discovery of AWS EKS clusters in Teleport.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 EKS Auto-Discovery can automatically
@@ -269,6 +275,13 @@ and create the `ClusterRole` and `ClusterRoleBinding` resources during cluster p
 
 ## Step 3/3. Configure Teleport to discover EKS clusters
 
+### Install Teleport
+
+Install Teleport on the host you are using to run the Kubernetes Service and
+Discovery Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
 ### Get a join token
 
 Teleport EKS Auto-Discovery requires a valid Teleport auth token for the Discovery and
@@ -277,11 +290,15 @@ command against your Teleport Auth Service and save it in `/tmp/token` on the
 machine that will run Kubernetes Discovery:
 
 ```code
-$ tctl tokens add --type=discovery,kube
+$ tctl tokens add --type=discovery,kube --format=text
+(=presets.tokens.first=)
 ```
 
 ### Configure the Teleport Kubernetes and Discovery Services
 
+On the host running the Kubernetes Service and Discovery Service, create a
+Teleport configuration file with the following content at `/etc/teleport.yaml`:
+
 (!docs/pages/includes/discovery/discovery-group.mdx!)
 
 Enabling EKS Auto-Discovery requires that the `discovery_service.aws` section
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes/azure.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes/azure.mdx
index 5cdc53acfbadd..49ab2c4e7c014 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes/azure.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes/azure.mdx
@@ -1,6 +1,12 @@
 ---
 title: Teleport AKS Auto-Discovery
+sidebar_label: Azure Kubernetes Service
 description: Auto-Discovery of AKS clusters in Azure cloud.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 AKS Auto-Discovery can automatically
@@ -211,15 +217,30 @@ associated with Teleport identity.
 
 ## Step 2/2. Configure Teleport to discover AKS clusters
 
+### Install Teleport
+
+Install Teleport on the host you are using to run the Kubernetes Service and
+Discovery Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+### Get a join token
+
 Teleport AKS Auto-Discovery requires a valid auth token for the Discovery and
 Kubernetes services to join the cluster. Generate one by running the following
 command against your Teleport Auth Service and save it in `/tmp/token` on the
 machine that will run Kubernetes Discovery:
 
 ```code
-$ tctl tokens add --type=discovery,kube
+$ tctl tokens add --type=discovery,kube --format=text
+(=presets.tokens.first=)
 ```
 
+### Configure the Kubernetes Service and Discovery Service
+
+On the host running the Kubernetes Service and Discovery Service, create a
+Teleport configuration file with the following content at `/etc/teleport.yaml`:
+
 Enabling AKS Auto-Discovery requires that the `discovery_service.azure` section
 include at least one entry and that `discovery_service.azure.types` include `aks`.
 It also requires configuring the `kubernetes_service.resources.tags` to use the same
@@ -262,6 +283,8 @@ kubernetes_service:
 Once you have added this configuration, start Teleport. AKS clusters matching the tags and regions
 specified in the Azure section will be added to the Teleport cluster automatically.
 
+(!docs/pages/includes/start-teleport.mdx service="the Kubernetes and Discovery Services"!)
+
 ## Troubleshooting
 
 (!docs/pages/includes/discovery/discovery-service-troubleshooting.mdx resourceKind="Kubernetes cluster" tctlResource="kube_cluster" !)
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes/google-cloud.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes/google-cloud.mdx
index bbe985f34abe2..5c86acbd870c4 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes/google-cloud.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes/google-cloud.mdx
@@ -1,6 +1,12 @@
 ---
 title: Teleport GKE Auto-Discovery
+sidebar_label: Google Kubernetes Engine
 description: How to configure auto-discovery of Google Kubernetes Engine clusters in Teleport.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 The Teleport Discovery Service can automatically register your Google Kubernetes
diff --git a/docs/pages/enroll-resources/auto-discovery/kubernetes/kubernetes.mdx b/docs/pages/enroll-resources/auto-discovery/kubernetes/kubernetes.mdx
index 11dec8351b1d6..0bedb0be774bd 100644
--- a/docs/pages/enroll-resources/auto-discovery/kubernetes/kubernetes.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/kubernetes/kubernetes.mdx
@@ -1,6 +1,11 @@
 ---
-title: Kubernetes Clusters Discovery
+title: Kubernetes Cluster Discovery
+sidebar_label: Kubernetes Clusters
 description: Detailed guides for configuring Kubernetes Clusters Discovery.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Kubernetes Clusters Discovery allows Kubernetes clusters
diff --git a/docs/pages/reference/agent-services/auto-discovery-reference/aws-iam.mdx b/docs/pages/enroll-resources/auto-discovery/reference/aws-iam.mdx
similarity index 83%
rename from docs/pages/reference/agent-services/auto-discovery-reference/aws-iam.mdx
rename to docs/pages/enroll-resources/auto-discovery/reference/aws-iam.mdx
index b92cb31801650..463fc439e6eb0 100644
--- a/docs/pages/reference/agent-services/auto-discovery-reference/aws-iam.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/reference/aws-iam.mdx
@@ -1,7 +1,11 @@
 ---
 title: Discovery Service AWS IAM Reference
+sidebar_label: Discovery Service AWS IAM
 description: AWS IAM permissions for the Teleport Discovery Service.
-tocDepth: 3
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The Teleport Discovery Service requires AWS IAM permissions to discover AWS
@@ -30,10 +34,14 @@ type of AWS resource.
 
 (!docs/pages/includes/discovery/reference/aws-iam/dynamodb.mdx!)
 
-### ElastiCache for Redis
+### ElastiCache for Redis and Valkey
 
 (!docs/pages/includes/discovery/reference/aws-iam/elasticache.mdx!)
 
+### ElastiCache Serverless for Redis and Valkey
+
+(!docs/pages/includes/discovery/reference/aws-iam/elasticache-serverless.mdx!)
+
 ### Keyspaces
 
 (!docs/pages/includes/discovery/reference/aws-iam/keyspaces.mdx!)
diff --git a/docs/pages/enroll-resources/auto-discovery/reference/labels.mdx b/docs/pages/enroll-resources/auto-discovery/reference/labels.mdx
new file mode 100644
index 0000000000000..255349fc1b96d
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/reference/labels.mdx
@@ -0,0 +1,139 @@
+---
+title: Labels
+sidebar_label: Labels
+description: Learn about resource labels applied during auto-discovery
+---
+
+Cloud resources such as AWS EC2 instances, EKS clusters, RDS databases and similar
+resources in Azure and Google Cloud enrolled in a Teleport cluster during
+auto-discovery get a set of default labels applied to them which can then be
+used in RBAC.
+
+## AWS
+
+### EC2 instances
+
+See the AWS EC2 auto-discovery [guide](../../../enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx).
+
+| Label                      | Description                                          |
+|----------------------------|------------------------------------------------------|
+| `teleport.dev/account-id`  | AWS account ID where the the EC2 instance is running |
+| `teleport.dev/instance-id` | AWS EC2 instance ID                                  |
+
+### Databases
+
+See the AWS Databases auto-discovery [guide](../../../enroll-resources/auto-discovery/databases/aws.mdx).
+
+| Label                                          | Description                                                                                                       |
+|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|
+| `account-id`                                   | ID of the AWS account the resource resides in.                                                                    |
+| `endpoint-type`                                | Type of the endpoint. See [`endpoint-type`](../../database-access/reference/labels.mdx#endpoint-type) for more details. |
+| `engine-version`                               | Database engine version, if available.                                                                            |
+| `engine`                                       | Amazon RDS: engine type of the RDS instance.<br/>Amazon RDS Proxy: engine family of the proxy.                    |
+| `namespace`                                    | Amazon Redshift Serverless namespace name.                                                                        |
+| `region`                                       | AWS region.                                                                                                       |
+| `vpc-id`                                       | ID of the Amazon VPC the resource resides in, if available.                                                       |
+| `workgroup`                                    | Amazon Redshift Serverless workgroup name.                                                                        |
+| `teleport.dev/cloud`                           | Always `AWS`.                                                                                                     |
+| `teleport.dev/discovery-type`                  | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "rds", "redshift", etc.            |
+| `teleport.dev/origin`                          | Always `cloud`.                                                                                                   |
+| `teleport.internal/discovered-name`            | Original Database name.                                                                                           |
+| `teleport.internal/discovery-config-name`      | Name of the discovery config name. Absent when using matchers defined in Discovery Service configuration.         |
+| `teleport.internal/discovery-group-name`       | The name of the discovery group present in the Discovery Service configuration                                    |
+| `teleport.internal/discovery-integration-name` | Integration name used to fetch the Database. Absent when using ambient credentials.                               |
+
+### Kubernetes clusters
+
+See the AWS EKS auto-discovery [guide](../../../enroll-resources/auto-discovery/kubernetes/aws.mdx).
+
+| Label                                          | Description                                                                                               |
+|------------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| `account-id`                                   | ID of the AWS account the resource resides in.                                                            |
+| `region`                                       | AWS region.                                                                                               |
+| `teleport.dev/cloud`                           | Always `AWS`.                                                                                             |
+| `teleport.dev/discovery-type`                  | Always `eks`.                                                                                             |
+| `teleport.dev/origin`                          | Always `cloud`.                                                                                           |
+| `teleport.internal/aws-arn`                    | Contains the AWS ARN for the resource.                                                                    |
+| `teleport.internal/discovered-name`            | Original EKS Cluster name.                                                                                |
+| `teleport.internal/discovery-config-name`      | Name of the discovery config name. Absent when using matchers defined in Discovery Service configuration. |
+| `teleport.internal/discovery-group-name`       | The name of the discovery group present in the Discovery Service configuration                            |
+| `teleport.internal/discovery-integration-name` | Integration name used to fetch the Kubernetes cluster. Absent when using ambient credentials.             |
+
+## Azure
+
+### VMs
+
+See the Azure VM auto-discovery [guide](../../../enroll-resources/auto-discovery/servers/azure-discovery.mdx).
+
+| Label                               | Description                                   |
+|-------------------------------------|-----------------------------------------------|
+| `teleport.internal/region`          | Azure region where the VM is running          |
+| `teleport.internal/resource-group`  | Azure resource group the VM belongs to        |
+| `teleport.internal/subscription-id` | Azure subscription ID where the VM is running |
+| `teleport.internal/vm-id`           | Azure VM ID                                   |
+
+
+### Databases
+
+See the Azure Databases auto-discovery [guide](../../database-access/enrollment/azure/azure.mdx).
+
+| Label                                     | Description                                                                                                   |
+|-------------------------------------------|---------------------------------------------------------------------------------------------------------------|
+| `endpoint-type`                           | For Azure Redis Enterprise, one of `EnterpriseCluster`, `OSSCluster`.                                         |
+| `engine-version`                          | Database engine version, if available.                                                                        |
+| `engine`                                  | Resource type of the resource ID.                                                                             |
+| `region`                                  | Azure location.                                                                                               |
+| `replication-role`                        | The replication role of an Azure DB Flexible server, e.g. "Source" or "Replica".                              |
+| `resource-group`                          | Azure resource group.                                                                                         |
+| `source-server`                           | The source server for replica Azure DB Flexible servers. This is the source (primary) database resource name. |
+| `subscription-id`                         | Azure subscription ID.                                                                                        |
+| `teleport.dev/cloud`                      | Always `Azure`.                                                                                               |
+| `teleport.dev/discovery-type`             | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "mysql", "postgres", etc.      |
+| `teleport.dev/origin`                     | Always `cloud`.                                                                                               |
+| `teleport.internal/discovered-name`       | Original Database name.                                                                                       |
+| `teleport.internal/discovery-config-name` | Name of the discovery config name. Absent when using matchers defined in Discovery Service configuration.     |
+| `teleport.internal/discovery-group-name`  | The name of the discovery group present in the Discovery Service configuration                                |
+
+### Kubernetes clusters
+
+See the Azure AKS auto-discovery [guide](../../../enroll-resources/auto-discovery/kubernetes/azure.mdx).
+
+| Label                                     | Description                                                                                               |
+|-------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| `region`                                  | Azure location.                                                                                           |
+| `resource-group`                          | Azure resource group.                                                                                     |
+| `subscription-id`                         | Azure subscription ID.                                                                                    |
+| `teleport.dev/cloud`                      | Always `Azure`.                                                                                           |
+| `teleport.dev/discovery-type`             | Always `aks`.                                                                                             |
+| `teleport.dev/origin`                     | Always `cloud`.                                                                                           |
+| `teleport.internal/discovered-name`       | Original AKS Cluster name.                                                                                |
+| `teleport.internal/discovery-config-name` | Name of the discovery config name. Absent when using matchers defined in Discovery Service configuration. |
+| `teleport.internal/discovery-group-name`  | The name of the discovery group present in the Discovery Service configuration                            |
+
+## Google Cloud
+
+### VMs
+
+See the GCP VM auto-discovery [guide](../../../enroll-resources/auto-discovery/servers/gcp-discovery.mdx).
+
+| Label                          | Description                         |
+|--------------------------------|-------------------------------------|
+| `teleport.dev/project-id`      | GCP project ID the VM is running in |
+| `teleport.internal/name`       | GCP VM name                         |
+| `teleport.internal/project-id` | GCP project ID the VM is running in |
+| `teleport.internal/zone`       | GCP zone where the VM is running    |
+
+### Kubernetes clusters
+
+See the Azure AKS auto-discovery [guide](../../../enroll-resources/auto-discovery/kubernetes/google-cloud.mdx).
+
+| Label                                     | Description                                                                                               |
+|-------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| `location`                                | GCP location where the GKE is running in.                                                                 |
+| `project-id`                              | GCP project ID where the GKE is running in.                                                               |
+| `teleport.dev/cloud`                      | Always `GCP`.                                                                                             |
+| `teleport.dev/discovery-type`             | Always `gke`.                                                                                             |
+| `teleport.dev/origin`                     | Always `cloud`.                                                                                           |
+| `teleport.internal/discovered-name`       | Original GKE Cluster name.                                                                                |
+| `teleport.internal/discovery-config-name` | Name of the discovery config name. Absent when using matchers defined in Discovery Service configuration. |
+| `teleport.internal/discovery-group-name`  | The name of the discovery group present in the Discovery Service configuration                            |
diff --git a/docs/pages/enroll-resources/auto-discovery/reference/reference.mdx b/docs/pages/enroll-resources/auto-discovery/reference/reference.mdx
new file mode 100644
index 0000000000000..536b44ea2f15a
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/reference/reference.mdx
@@ -0,0 +1,11 @@
+---
+title: Auto-Discovery Reference
+sidebar_label: Reference
+description: Configuration reference for the Teleport Discovery Service.
+sidebar_position: 5
+tags:
+ - zero-trust
+ - infrastructure-identity
+---
+
+<DocCardList />
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/azure-discovery.mdx b/docs/pages/enroll-resources/auto-discovery/servers/azure-discovery.mdx
index c83203f2073f0..fca90b846138f 100644
--- a/docs/pages/enroll-resources/auto-discovery/servers/azure-discovery.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/servers/azure-discovery.mdx
@@ -1,8 +1,19 @@
 ---
 title: Automatically Discover Azure Virtual Machines 
+sidebar_label: Azure Virtual Machines
 description: How to configure Teleport to automatically enroll Azure virtual machines.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
+This guide shows you how to set up automatic server discovery for Azure virtual
+machines.
+
+## How it works
+
 The Teleport Discovery Service can connect to Azure and automatically
 discover and enroll virtual machines matching configured labels. It will then
 execute a script on these discovered instances that will install Teleport,
@@ -19,7 +30,7 @@ Ubuntu/Debian/RHEL if making use of the default Teleport install script. (For
 other Linux distributions, you can install Teleport manually.)
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/6. Create an Azure invite token
+## Step 1/5. Create an Azure invite token
 
 When discovering Azure virtual machines, Teleport makes use of Azure invite tokens for
 authenticating joining SSH Service instances.
@@ -56,7 +67,7 @@ Add the token to the Teleport cluster with:
 $ tctl create -f token.yaml
 ```
 
-## Step 2/6. Configure IAM permissions for Teleport
+## Step 2/5. Configure IAM permissions for Teleport
 
 The Teleport Discovery Service needs Azure IAM permissions to discover and register Azure virtual machines.
 
@@ -68,10 +79,10 @@ resources:
 - The Discovery Service can run on an Azure VM with attached managed identity. This
   is the recommended way of deploying the Discovery Service in production since
   it eliminates the need to manage Azure credentials.
-- The Discovery Service can be registered as an Azure AD application (via AD's "App
-  registrations") and configured with its credentials. This is only recommended
-  for development and testing purposes since it requires Azure credentials to
-  be present in the Discovery Service's environment.
+- The Discovery Service can be registered as a Microsoft Entra ID application
+  and configured with its credentials. This is only recommended for development
+  and testing purposes since it requires Azure credentials to be present in the
+  Discovery Service's environment.
 
 <Tabs>
 <TabItem label="Using managed identity">
@@ -99,14 +110,14 @@ resources:
 </TabItem>
 <TabItem label="Using app registrations">
   <Admonition type="note">
-    Registering the Discovery Service as Azure AD application is suitable for
-    test and development scenarios, or if your Discovery Service does not run on
-    an Azure VM. For production scenarios prefer to use the managed identity
-    approach.
+    Registering the Discovery Service as a Microsoft Entra ID application is
+    suitable for test and development scenarios, or if your Discovery Service
+    does not run on an Azure VM. For production scenarios prefer to use the
+    managed identity approach.
   </Admonition>
 
   Go to the [App registrations](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps)
-  page of your Azure Active Directory and click on *New registration*:
+  page in Microsoft Entra ID and click on *New registration*:
 
   ![App registrations](../../../../img/azure/app-registrations@2x.png)
 
@@ -192,7 +203,7 @@ and replace the subscription in `assignableScopes` with your own subscription id
 
 (!docs/pages/includes/server-access/azure-assign-service-principal.mdx!)
 
-## Step 3/6. Set up managed identities for discovered nodes
+## Step 3/5. Set up managed identities for discovered nodes
 
 Every Azure VM to be discovered must have a managed identity assigned to it
 with at least the `Microsoft.Compute/virtualMachines/read` permission.
@@ -202,7 +213,7 @@ with at least the `Microsoft.Compute/virtualMachines/read` permission.
 If the VMs to be discovered have more than one managed identity assigned to
 them, save the client ID of the identity you just created for step 5.
 
-## Step 4/6. Install the Teleport Discovery Service
+## Step 4/5. Install the Teleport Discovery Service
 
 <Admonition type="tip">
 
@@ -215,7 +226,7 @@ Install Teleport on the virtual machine that will run the Discovery Service:
 
 (!docs/pages/includes/install-linux.mdx!)
 
-## Step 5/6. Configure Teleport to discover Azure instances
+## Step 5/5. Configure Teleport to discover Azure instances
 
 If you are running the Discovery Service on its own host, the service requires a
 valid invite token to connect to the cluster. Generate one by running the
@@ -270,12 +281,13 @@ discovery_service:
   specifically the regions and tags you want to associate with the Discovery
   Service.
 
-## Step 6/6. [Optional] Customize the default installer script
+## Auto-discovery labels
+
+(!docs/pages/includes/auto-discovery/auto-discovery-labels.mdx!)
 
-(!docs/pages/includes/server-access/custom-installer.mdx cloud="Azure" matcher="azure" matchTypes="[\"vm\"]"!)
+## Advanced configuration
 
-If `client_id` is set in the Discovery Service config, custom installers will
-also have the `{{ .AzureClientID }}` templating option.
+(!docs/pages/includes/auto-discovery/azure-vm-advanced-config.mdx!)
 
 ## Troubleshooting
 
@@ -304,4 +316,4 @@ logs can be found on the targeted VM at
 - Read [Joining Nodes via Azure Managed Identity](../../agents/azure.mdx)
   for more information on Azure tokens.
 - Full documentation on Azure discovery configuration can be found through the [
-  config file reference documentation](../../../reference/config.mdx).
+  config file reference documentation](../../../reference/deployment/config.mdx).
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery.mdx
deleted file mode 100644
index 837d692eba8d5..0000000000000
--- a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery.mdx
+++ /dev/null
@@ -1,365 +0,0 @@
----
-title: Server Auto-Discovery for Amazon EC2
-description: How to configure Teleport to automatically enroll EC2 instances.
----
-
-This guide shows you how to configure Teleport to automatically enroll EC2
-instances in your cluster.
-
-## How it works
-
-In the setup we describe in this guide, the Teleport Discovery Service connects
-to Amazon EC2 and reconciles the servers enrolled on the Auth Service backend
-with servers it lists from the EC2 API. If an EC2 instance matches a configured
-label and is not enrolled in your cluster, the Discovery Service executes a
-script on these discovered instances using AWS Systems Manager that installs
-Teleport, starts it and joins the cluster using the [IAM join method](
-../../agents/aws-iam.mdx).
-
-The Teleport Discovery Service uses an IAM invite token with a long time-to-live
-(TTL), so that new instances can be discovered and added to the Teleport cluster
-for the lifetime of the token.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- AWS account with EC2 instances and permissions to create and attach IAM
-policies.
-- EC2 instances running Ubuntu/Debian/RHEL/Amazon Linux 2/Amazon Linux 2023 and SSM agent version 3.1 or greater if making use of the
-default Teleport install script. (For other Linux distributions, you can
-install Teleport manually.)
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/7. Create an EC2 invite token
-
-When discovering EC2 instances, Teleport makes use of IAM invite tokens for
-authenticating joining Nodes.
-
-Create a file called `token.yaml`:
-
-```yaml
-# token.yaml
-kind: token
-version: v2
-metadata:
-  # the token name is not a secret because instances must prove that they are
-  # running in your AWS account to use this token
-  name: aws-discovery-iam-token
-spec:
-  # use the minimal set of roles required (e.g. Node, App, Kube, DB, WindowsDesktop)
-  roles: [Node]
-
-  # set the join method allowed for this token
-  join_method: iam
-
-  allow:
-  # specify the AWS account which Nodes may join from
-  - aws_account: "123456789"
-```
-
-Assign the `aws_account` field to your AWS account number.
-Add the token to the Teleport cluster with:
-
-```code
-$ tctl create -f token.yaml
-```
-
-## Step 2/7. Define an IAM policy
-
-The `teleport discovery bootstrap` command will automate the process of
-defining and implementing IAM policies required to make auto-discovery work. It
-requires only a single pre-defined policy, attached to the EC2 instance running
-the command:
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "iam:GetPolicy",
-                "iam:TagPolicy",
-                "iam:ListPolicyVersions",
-                "iam:CreatePolicyVersion",
-                "iam:CreatePolicy",
-                "ssm:CreateDocument",
-                "iam:DeletePolicyVersion",
-                "iam:AttachRolePolicy",
-                "iam:PutRolePermissionsBoundary"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-```
-
-Create this policy and apply it to the Node (EC2 instance) that will run the Discovery Service.
-
-## Step 3/7. Install Teleport on the Discovery Node
-
-<Admonition type="tip">
-
-If you plan on running the Discovery Service on the same Node already running
-another Teleport service (Auth or Proxy, for example), you can skip this step.
-
-</Admonition>
-
-Install Teleport on the EC2 instance that will run the Discovery Service:
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 4/7. Configure Teleport to discover EC2 instances
-
-If you are running the Discovery Service on its own host, the service requires a
-valid invite token to connect to the cluster. Generate one by running the
-following command against your Teleport Auth Service:
-
-```code
-$ tctl tokens add --type=discovery
-```
-
-Save the generated token in `/tmp/token` on the Node (EC2 instance) that will
-run the Discovery Service.
-
-In order to enable EC2 instance discovery the `discovery_service.aws` section
-of `teleport.yaml` must include at least one entry:
-
-(!docs/pages/includes/discovery/discovery-group.mdx!)
-
-```yaml
-version: v3
-teleport:
-  join_params:
-    token_name: "/tmp/token"
-    method: token
-  proxy_server: "<Var name="teleport.example.com:443" />"
-auth_service:
-  enabled: false
-proxy_service:
-  enabled: false
-ssh_service:
-  enabled: false
-discovery_service:
-  enabled: true
-  discovery_group: "aws-prod"
-  aws:
-   - types: ["ec2"]
-     regions: ["us-east-1","us-west-1"]
-     install:
-        join_params:
-          token_name: aws-discovery-iam-token
-          method: iam
-     tags:
-       "env": "prod" # Match EC2 instances where tag:env=prod
-```
-
-- Edit the `teleport.auth_servers` key to match your Auth Service or Proxy Service's URI
-  and port.
-- Adjust the keys under `discovery_service.aws` to match your EC2 environment,
-  specifically the regions and tags you want to associate with the Discovery
-  Service.
-
-## Step 5/7. Bootstrap the Discovery Service AWS configuration
-
-On the same Node as above, run `teleport discovery bootstrap`. This command
-will generate and display the additional IAM policies and AWS Systems Manager (SSM) documents
-required to enable the Discovery Service:
-
-```code
-$ sudo teleport discovery bootstrap
-Reading configuration at "/etc/teleport.yaml"...
-
-AWS
-1. Create IAM Policy "TeleportEC2Discovery":
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ec2:DescribeInstances",
-                "ssm:DescribeInstanceInformation",
-                "ssm:GetCommandInvocation",
-                "ssm:ListCommandInvocations",
-                "ssm:SendCommand"
-            ],
-            "Resource": [
-                "*"
-            ]
-        }
-    ]
-}
-
-2. Create IAM Policy "TeleportEC2DiscoveryBoundary":
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ec2:DescribeInstances",
-                "ssm:DescribeInstanceInformation",
-                "ssm:GetCommandInvocation",
-                "ssm:ListCommandInvocations",
-                "ssm:SendCommand"
-            ],
-            "Resource": [
-                "*"
-            ]
-        }
-    ]
-}
-
-3. Create SSM Document "TeleportDiscoveryInstaller":
-
-schemaVersion: '2.2'
-description: aws:runShellScript
-parameters:
-  token:
-    type: String
-    description: "(Required) The Teleport invite token to use when joining the cluster."
-  scriptName:
-    type: String
-    description: "(Required) The Teleport installer script to use when joining the cluster."
-mainSteps:
-- action: aws:downloadContent
-  name: downloadContent
-  inputs:
-    sourceType: "HTTP"
-    destinationPath: "/tmp/installTeleport.sh"
-    sourceInfo:
-      url: "https://<Var name="teleport.example.com:443" />/webapi/scripts/installer/{{ scriptName }}"
-- action: aws:runShellScript
-  name: runShellScript
-  inputs:
-    timeoutSeconds: '300'
-    runCommand:
-      - /bin/sh /tmp/installTeleport.sh "{{ token }}"
-
-4. Attach IAM policies to "yourUser-discovery-role".
-
-Confirm? [y/N]: y
-```
-
-Review the policies and confirm:
-
-```code
-Confirm? [y/N]: y
-✅[AWS] Create IAM Policy "TeleportEC2Discovery"... done.
-✅[AWS] Create IAM Policy "TeleportEC2DiscoveryBoundary"... done.
-✅[AWS] Create IAM SSM Document "TeleportDiscoveryInstaller"... done.
-✅[AWS] Attach IAM policies to "alex-discovery-role"... done.
-```
-
-All EC2 instances that are to be added to the Teleport cluster by the
-Discovery Service must include the `AmazonSSMManagedInstanceCore` IAM policy
-in order to receive commands from the Discovery Service.
-
-This policy includes the following permissions:
-
-```js
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ssm:DescribeAssociation",
-                "ssm:GetDeployablePatchSnapshotForInstance",
-                "ssm:GetDocument",
-                "ssm:DescribeDocument",
-                "ssm:GetManifest",
-                "ssm:GetParameter",
-                "ssm:GetParameters",
-                "ssm:ListAssociations",
-                "ssm:ListInstanceAssociations",
-                "ssm:PutInventory",
-                "ssm:PutComplianceItems",
-                "ssm:PutConfigurePackageResult",
-                "ssm:UpdateAssociationStatus",
-                "ssm:UpdateInstanceAssociationStatus",
-                "ssm:UpdateInstanceInformation"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ssmmessages:CreateControlChannel",
-                "ssmmessages:CreateDataChannel",
-                "ssmmessages:OpenControlChannel",
-                "ssmmessages:OpenDataChannel"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ec2messages:AcknowledgeMessage",
-                "ec2messages:DeleteMessage",
-                "ec2messages:FailMessage",
-                "ec2messages:GetEndpoint",
-                "ec2messages:GetMessages",
-                "ec2messages:SendReply"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-```
-
-## Step 6/7. [Optional] Customize the default installer script
-
-(!docs/pages/includes/server-access/custom-installer.mdx cloud="AWS" matcher="aws" matchTypes="[\"ec2\"]"!)
-
-## Step 7/7. Start Teleport
-
-(!docs/pages/includes/aws-credentials.mdx service="the Discovery Service"!)
-
-(!docs/pages/includes/start-teleport.mdx service="the Discovery Service"!)
-
-Once you have started the Discovery Service, EC2 instances matching the tags you
-specified earlier will begin to be added to the Teleport cluster automatically.
-
-## Troubleshooting
-
-If Installs are showing failed or instances are failing to appear check the
-Command history in AWS System Manager -> Node Management -> Run Command.
-Select the instance-id of the Target to review Errors.
-
-### `cannot unmarshal object into Go struct field`
-
-If you encounter an error similar to the following:
-
-```text
-invalid format in plugin properties map[destinationPath:/tmp/installTeleport.sh sourceInfo:map[url:[https://example.teleport.sh:443/webapi/scripts/installer/preprod-installer](https://example.teleport.sh/webapi/scripts/installer/preprod-installer)] sourceType:HTTP];
-error json: cannot unmarshal object into Go struct field DownloadContentPlugin.sourceInfo of type string
-```
-
-It is likely that you're running an older SSM agent version. Upgrade to SSM agent version 3.1 or greater to resolve.
-
-### `InvalidInstanceId: Instances [[i-123]] not in a valid state for account 456`
-
-The following problems can cause this error:
-- The Discovery Service doesn't have permission to access the managed node.
-- AWS Systems Manager Agent (SSM Agent) isn't running. Verify that SSM Agent is running.
-- SSM Agent isn't registered with the SSM endpoint. Try reinstalling SSM Agent.
-- The discovered instance does not have permission to receive SSM
-  commands, verify the instance includes the AmazonSSMManagedInstanceCore IAM policy.
-
-See SSM RunCommand error codes and troubleshooting information in AWS documentation for more details:
-- https://docs.aws.amazon.com/systems-manager/latest/userguide/troubleshooting-managed-instances.html
-- https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html#API_SendCommand_Errors
-
-## Next steps
-
-- Read [Joining Nodes via AWS IAM
-  Role](../../agents/aws-iam.mdx)
-for more information on IAM Invite Tokens.
-- Information on IAM best practices on EC2 instances managed by Systems
-Manager can be found for in the [AWS Cloud Operations & Migrations Blog
-](https://aws.amazon.com/blogs/mt/applying-managed-instance-policy-best-practices/).
-- Full documentation on EC2 discovery configuration can be found through the [
-config file reference documentation](../../../reference/config.mdx).
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx
new file mode 100644
index 0000000000000..8550fe4236f74
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-guided.mdx
@@ -0,0 +1,255 @@
+---
+title: Guided EC2 Auto-Discovery Configuration
+sidebar_label: Guided
+description: How to configure Teleport EC2 auto-discovery using Teleport to configure permissions
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+This guide shows you how to configure Teleport to automatically enroll EC2
+instances in your cluster, with permissions configured by Teleport.
+
+## How it works
+
+The Teleport Discovery Service runs on an EC2 instance and queries the AWS API
+to list instances in your AWS account. For any new EC2 instance that you deploy,
+the Discovery Service uses AWS Systems Manager to install Teleport on the
+instance and join it to the cluster as a Teleport-protected server. `teleport`
+commands allow you to create IAM policies that enable the Discovery Service to
+enroll EC2 instances as servers in your Teleport cluster.
+
+To manually configure IAM policies and SSM documents instead, read [Manual EC2
+Auto-Discovery Configuration](ec2-discovery-manual.mdx).
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with EC2 instances and permissions to create and attach IAM
+policies.
+- EC2 instances running Ubuntu/Debian/RHEL/Amazon Linux 2/Amazon Linux 2023 and SSM agent version 3.1 or greater if making use of the
+default Teleport install script. (For other Linux distributions, you can
+install Teleport manually.)
+- (!docs/pages/includes/tctl.mdx!)
+
+All EC2 instances that are to be added to the Teleport cluster by the Discovery
+Service must include the `AmazonSSMManagedInstanceCore` IAM policy in order to
+receive commands from the Discovery Service. For a list of permissions included
+in the policy, see the [AWS
+documentation](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html).
+
+## Step 1/6. Create an EC2 invite token
+
+(!docs/pages/includes/auto-discovery/ec2-invite-token.mdx!)
+
+## Step 2/6. Configure IAM policies
+
+The `teleport discovery bootstrap` command will automate the process of
+defining and implementing IAM policies required to make auto-discovery work. It
+requires only a single pre-defined policy, attached to the EC2 instance running
+the command:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "iam:GetPolicy",
+                "iam:TagPolicy",
+                "iam:ListPolicyVersions",
+                "iam:CreatePolicyVersion",
+                "iam:CreatePolicy",
+                "iam:GetRole",
+                "ssm:CreateDocument",
+                "iam:DeletePolicyVersion",
+                "iam:AttachRolePolicy",
+                "iam:PutRolePermissionsBoundary"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```
+
+Create this policy and apply it to the Node (EC2 instance) that will run the Discovery Service.
+
+## Step 3/6. Install Teleport on the Discovery Node
+
+<Admonition type="tip">
+
+If you plan on running the Discovery Service on the same Node already running
+another Teleport service (Auth or Proxy, for example), you can skip this step.
+
+</Admonition>
+
+Install Teleport on the EC2 instance that will run the Discovery Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 4/6. Configure Teleport to discover EC2 instances
+
+(!docs/pages/includes/auto-discovery/ec2-config.mdx!)
+
+## Step 5/6. Bootstrap the Discovery Service AWS configuration
+
+On the same Node as above, run `teleport discovery bootstrap`. This command
+will generate and display the additional IAM policies and AWS Systems Manager (SSM) documents
+required to enable the Discovery Service:
+
+```code
+$ sudo teleport discovery bootstrap
+Reading configuration at "/etc/teleport.yaml"...
+# ...
+```
+
+This will add the following additional permissions to the Discovery Service's
+role:
+
+- `account:ListRegions`
+- `ec2:DescribeInstances`
+- `ssm:DescribeInstanceInformation`
+- `ssm:GetCommandInvocation`
+- `ssm:ListCommandInvocations`
+- `ssm:SendCommand`
+
+
+Review the policies and confirm:
+
+```code
+# ...
+Confirm? [y/N]: y
+✅[AWS] Create IAM Policy "TeleportEC2Discovery"... done.
+✅[AWS] Create IAM Policy "TeleportEC2DiscoveryBoundary"... done.
+✅[AWS] Create IAM SSM Document "AWS-RunShellScript"... done.
+✅[AWS] Attach IAM policies to "alex-discovery-role"... done.
+```
+
+## Step 6/6. Start Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Discovery Service"!)
+
+(!docs/pages/includes/start-teleport.mdx service="the Discovery Service"!)
+
+Once you have started the Discovery Service, EC2 instances matching the tags you
+specified earlier will begin to be added to the Teleport cluster automatically.
+
+## Discovering instances in multiple AWS accounts
+
+To discover EC2 instances in AWS accounts other than the account your Teleport
+Discovery Service is running in, Teleport must have permission to assume an IAM
+role in each of those accounts. This guide assumes you have finished the main
+EC2 discovery guide above and should be repeated for each AWS account you want
+to discover instances from.
+
+### Step 1/5. Update EC2 invite token
+
+(!docs/pages/includes/auto-discovery/ec2-cross-account-token.mdx!)
+
+### Step 2/5. Configure IAM permissions
+
+In the destination account, create a new role and note its ARN. Create the
+following IAM policy and attach it to the new role:
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "iam:GetPolicy",
+                "iam:TagPolicy",
+                "iam:ListPolicyVersions",
+                "iam:CreatePolicyVersion",
+                "iam:CreatePolicy",
+                "iam:GetRole",
+                "ssm:CreateDocument",
+                "iam:DeletePolicyVersion",
+                "iam:AttachRolePolicy",
+                "iam:PutRolePermissionsBoundary"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```
+
+Edit the trust policy of the new role to allow the Discovery Service to assume
+it, adding the <Var name="Discovery Service role's ARN" />:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "<Var name="Discovery Service role's ARN" />"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+Create the following policy in the Discovery Service's account and attach it
+to the Discovery Service's role, adding the <Var name="new role ARN" />:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "sts:AssumeRole",
+            "Resource": "<Var name="new role ARN" />"
+        }
+    ]
+}
+```
+
+### Step 3/5. Update Teleport configuration
+
+(!docs/pages/includes/auto-discovery/ec2-cross-account-config.mdx!)
+
+### Step 4/5. Bootstrap the Discovery Service AWS configuration
+
+When all of your accounts are ready, run `teleport discovery bootstrap` again
+to generate the remaining IAM policies and SSM documents. For each
+distinct `assume_role_arn`/`external_id`, Teleport will assume that role and
+attach the new policies to it (unless overridden by `--attach-to-user` or `--attach-to-role`).
+
+```code
+$ sudo teleport discovery bootstrap
+```
+
+### Step 5/5. Restart Teleport
+
+Restart the Teleport service to start discovering new instances:
+
+```code
+$ sudo systemd restart teleport
+```
+
+You can check the status of the Discovery Service with `systemctl status teleport`
+and view its logs with `journalctl -fu teleport`.
+
+## Auto-discovery labels
+
+(!docs/pages/includes/auto-discovery/auto-discovery-labels.mdx!)
+
+## Advanced configuration
+
+(!docs/pages/includes/auto-discovery/aws-ec2-advanced-config.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/auto-discovery/ec2-troubleshooting.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/auto-discovery/ec2-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx
new file mode 100644
index 0000000000000..8d7e4a24b3ef7
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual.mdx
@@ -0,0 +1,238 @@
+---
+title: Manual EC2 Auto-Discovery Configuration
+sidebar_label: Manual
+description: How to configure Teleport EC2 auto-discovery with manually configured permissions
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+This guide shows you how to configure Teleport to automatically enroll EC2
+instances in your cluster, with permissions configured manually.
+
+## How it works
+
+The Teleport Discovery Service runs on an EC2 instance and queries the AWS API
+to list instances in your AWS account. For any new EC2 instance that you deploy,
+the Discovery Service uses AWS Systems Manager (SSM) to install Teleport on the
+instance and join it to the cluster as a Teleport-protected server. In addition
+to deploying the Teleport Discovery Service, the procedure shown in this guide
+includes manually editing IAM policies and SSM documents.
+
+To automatically bootstrap IAM policies instead, read [Guided EC2 Auto-Discovery
+Configuration](ec2-discovery-guided.mdx).
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with EC2 instances and permissions to create and attach IAM
+policies.
+- EC2 instances running Ubuntu/Debian/RHEL/Amazon Linux 2/Amazon Linux 2023 and SSM agent version 3.1 or greater if making use of the
+default Teleport install script. (For other Linux distributions, you can
+install Teleport manually.)
+- (!docs/pages/includes/tctl.mdx!)
+
+All EC2 instances that are to be added to the Teleport cluster by the Discovery
+Service must include the `AmazonSSMManagedInstanceCore` IAM policy in order to
+receive commands from the Discovery Service. For a list of permissions included
+in the policy, see the [AWS
+documentation](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html).
+
+## Step 1/5. Create an EC2 invite token
+
+(!docs/pages/includes/auto-discovery/ec2-invite-token.mdx!)
+
+## Step 2/5. Configure IAM policies
+
+Create the following policy and attach it to the EC2 instance that will run
+the Discovery Service:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "account:ListRegions",
+                "ec2:DescribeInstances",
+                "ssm:DescribeInstanceInformation",
+                "ssm:GetCommandInvocation",
+                "ssm:ListCommandInvocations",
+                "ssm:SendCommand"
+            ],
+            "Resource": [
+                "*"
+            ]
+        }
+    ]
+}
+```
+
+## Step 3/5. Install Teleport on the Discovery Node
+
+<Admonition type="tip">
+
+If you plan on running the Discovery Service on the same Node already running
+another Teleport service (Auth or Proxy, for example), you can skip this step.
+
+</Admonition>
+
+Install Teleport on the EC2 instance that will run the Discovery Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 4/5. Configure Teleport to discover EC2 instances
+
+(!docs/pages/includes/auto-discovery/ec2-config.mdx!)
+
+## Step 5/5. Start Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Discovery Service"!)
+
+(!docs/pages/includes/start-teleport.mdx service="the Discovery Service"!)
+
+Once you have started the Discovery Service, EC2 instances matching the tags you
+specified earlier will begin to be added to the Teleport cluster automatically.
+
+## Discovering instances in multiple AWS accounts
+
+To discover EC2 instances in AWS accounts other than the account your Teleport
+Discovery Service is running in, Teleport must have permission to assume an IAM
+role in each of those accounts. This guide assumes you have finished the main
+EC2 discovery guide above and should be repeated for each AWS account you want
+to discover instances from.
+
+### Step 1/5. Update EC2 invite token
+
+(!docs/pages/includes/auto-discovery/ec2-cross-account-token.mdx!)
+
+### Step 2/5. Configure IAM permissions
+
+In the destination account, create a new role and note its ARN. Create the
+following IAM policy and attach it to the new role:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "account:ListRegions",
+                "ec2:DescribeInstances",
+                "ssm:DescribeInstanceInformation",
+                "ssm:GetCommandInvocation",
+                "ssm:ListCommandInvocations",
+                "ssm:SendCommand"
+            ],
+            "Resource": [
+                "*"
+            ]
+        }
+    ]
+}
+```
+
+Edit the trust policy of the new role to allow the Discovery Service
+to assume it, including the <Var name="Discovery Service role's ARN" />:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "<Var name="Discovery Service role's ARN" />"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+Create the following policy in the Discovery Service's account and attach it
+to the Discovery Service's role, adding the <Var name="new role ARN" />:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "sts:AssumeRole",
+            "Resource": "<Var name="new role ARN" />"
+        }
+    ]
+}
+```
+
+### Step 3/5. Create SSM Documents
+
+In each region you plan to discover instances in, create the following SSM document
+in the AWS Systems Manager and name it `TeleportDiscoveryInstaller`:
+
+```yaml
+schemaVersion: '2.2'
+description: aws:runShellScript
+parameters:
+  token:
+    type: String
+    description: "(Required) The Teleport invite token to use when joining the cluster."
+  scriptName:
+    type: String
+    description: "(Required) The Teleport installer script to use when joining the cluster."
+  env:
+    type: String
+    description: "Environment variables exported to the script. Format 'ENV=var FOO=bar'"
+    default: "X=$X"
+mainSteps:
+- action: aws:downloadContent
+  name: downloadContent
+  inputs:
+    sourceType: "HTTP"
+    destinationPath: "/tmp/installTeleport.sh"
+    sourceInfo:
+      url: "https://<Var name="teleport.example.com:443" />/webapi/scripts/installer/{{ scriptName }}"
+- action: aws:runShellScript
+  name: runShellScript
+  inputs:
+    timeoutSeconds: '300'
+    runCommand:
+      -  export {{ env }}; /bin/sh /tmp/installTeleport.sh "{{ token }}"
+```
+
+### Step 4/5. Update Teleport configuration
+
+(!docs/pages/includes/auto-discovery/ec2-cross-account-config.mdx!)
+
+### Step 5/5. Restart Teleport
+
+Restart the Teleport service to start discovering new instances:
+
+```code
+$ sudo systemd restart teleport
+```
+
+You can check the status of the Discovery Service with `systemctl status teleport`
+and view its logs with `journalctl -fu teleport`.
+
+## Auto-discovery labels
+
+(!docs/pages/includes/auto-discovery/auto-discovery-labels.mdx!)
+
+## Advanced configuration
+
+(!docs/pages/includes/auto-discovery/aws-ec2-advanced-config.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/auto-discovery/ec2-troubleshooting.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/auto-discovery/ec2-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx
new file mode 100644
index 0000000000000..2f0c76b36f2dc
--- /dev/null
+++ b/docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx
@@ -0,0 +1,40 @@
+---
+title: Server Auto-Discovery for Amazon EC2
+sidebar_label: Amazon EC2
+description: How to configure Teleport to automatically enroll EC2 instances.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+This guide shows you how to configure Teleport to automatically enroll EC2
+instances in your cluster.
+
+## How it works
+
+In the setup we describe in this guide, the Teleport Discovery Service connects
+to Amazon EC2 and reconciles the servers enrolled on the Auth Service backend
+with servers it lists from the EC2 API. If an EC2 instance matches a configured
+label and is not enrolled in your cluster, the Discovery Service executes a
+script on these discovered instances using AWS Systems Manager that installs
+Teleport, starts it and joins the cluster using the [IAM join method](
+../../../agents/aws-iam.mdx).
+
+The Teleport Discovery Service uses an IAM invite token with a long time-to-live
+(TTL), so that new instances can be discovered and added to the Teleport cluster
+for the lifetime of the token.
+
+## Choosing guided or manual EC2 auto-discovery configuration
+
+In the guided EC2 auto-discovery configuration process, Teleport generates
+its own policies and SSM documents for the Discovery Service to use.
+
+If you want to have more control over the policies and SSM documents used,
+manual configuration may be suitable for you.
+
+## Guides
+
+- [Guided EC2 Auto-Discovery Configuration](ec2-discovery-guided.mdx)
+- [Manual EC2 Auto-Discovery Configuration](ec2-discovery-manual.mdx)
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/gcp-discovery.mdx b/docs/pages/enroll-resources/auto-discovery/servers/gcp-discovery.mdx
index 8d795275c0729..256b1329cf6ac 100644
--- a/docs/pages/enroll-resources/auto-discovery/servers/gcp-discovery.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/servers/gcp-discovery.mdx
@@ -1,8 +1,19 @@
 ---
 title: Automatically Discover GCP Compute Instances
+sidebar_label: Google Compute Engine
 description: How to configure Teleport to automatically enroll GCP compute instances.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
+This guide shows you how to set up automatic server discovery for Google Compute
+Engine virtual machines.
+
+## How it works
+
 The Teleport Discovery Service can connect to GCP and automatically
 discover and enroll GCP Compute Engine instances matching configured labels. It will then
 execute a script on these discovered instances that will install Teleport,
@@ -18,7 +29,7 @@ Ubuntu/Debian/RHEL if making use of the default Teleport install script. (For
 other Linux distributions, you can install Teleport manually.)
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/6. Create a GCP invite token
+## Step 1/5. Create a GCP invite token
 
 When discovering GCP compute instances, Teleport makes use of GCP invite tokens for
 authenticating joining SSH Service instances.
@@ -59,7 +70,7 @@ Add the token to the Teleport cluster with:
 $ tctl create -f token.yaml
 ```
 
-## Step 2/6. Configure IAM permissions for Teleport
+## Step 2/5. Configure IAM permissions for Teleport
 
 Create a service account that will give Teleport IAM permissions needed to
 discover instances.
@@ -150,7 +161,7 @@ discover instances.
 </TabItem>
 </Tabs>
 
-## Step 3/6. Configure instances to be discovered
+## Step 3/5. Configure instances to be discovered
 
 Ensure that each instance to be discovered has a service account assigned to
 it. No permissions are required on the service account. To check if an instance
@@ -204,7 +215,7 @@ the host keys to the guest attributes below:
 </TabItem>
 </Tabs>
 
-## Step 4/6. Install the Teleport Discovery Service
+## Step 4/5. Install the Teleport Discovery Service
 
 <Admonition type="tip">
 
@@ -217,7 +228,7 @@ Install Teleport on the virtual machine that will run the Discovery Service.
 
 (!docs/pages/includes/install-linux.mdx!)
 
-## Step 5/6. Configure Teleport to discover GCP compute instances
+## Step 5/5. Configure Teleport to discover GCP compute instances
 
 If you are running the Discovery Service on its own host, the service requires a
 valid invite token to connect to the cluster. Generate one by running the
@@ -285,13 +296,17 @@ instance and assign the service account to that instance. Refer to
 [Set Up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc)
 for details on alternate methods.
 
-## Step 6/6. [Optional] Customize the default installer script
+## Auto-discovery labels
+
+(!docs/pages/includes/auto-discovery/auto-discovery-labels.mdx!)
+
+## Advanced configuration
 
-(!docs/pages/includes/server-access/custom-installer.mdx cloud="GCP" matcher="gcp" matchTypes="[\"gce\"]"!)
+(!docs/pages/includes/auto-discovery/gcp-vm-advanced-config.mdx!)
 
 ## Next steps
 
 - Read [Joining Services via GCP](../../agents/gcp.mdx)
   for more information on GCP tokens.
 - Full documentation on GCP discovery configuration can be found through the [
-  config file reference documentation](../../../reference/config.mdx).
+  config file reference documentation](../../../reference/deployment/config.mdx).
diff --git a/docs/pages/enroll-resources/auto-discovery/servers/servers.mdx b/docs/pages/enroll-resources/auto-discovery/servers/servers.mdx
index 331471111a59f..c4ac9ccc5e2fa 100644
--- a/docs/pages/enroll-resources/auto-discovery/servers/servers.mdx
+++ b/docs/pages/enroll-resources/auto-discovery/servers/servers.mdx
@@ -1,6 +1,10 @@
 ---
 title: Server Auto-Discovery
+sidebar_label: Linux Servers
 description: You can set up the Teleport Discovery Service to automatically enroll servers in your infrastructure.
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The Teleport Discovery Service can connect to your cloud provider and
@@ -10,6 +14,6 @@ Teleport, start it and join the cluster.
 
 Learn how to set up auto-discovery for servers in your cloud:
 
-- [Amazon EC2](ec2-discovery.mdx)
+- [Amazon EC2](ec2-discovery/ec2-discovery.mdx)
 - [Google Compute Engine](gcp-discovery.mdx)
 - [Azure Virtual Machines](azure-discovery.mdx)
diff --git a/docs/pages/enroll-resources/automatic-labels/automatic-labels.mdx b/docs/pages/enroll-resources/automatic-labels/automatic-labels.mdx
new file mode 100644
index 0000000000000..aef1f0a7f5929
--- /dev/null
+++ b/docs/pages/enroll-resources/automatic-labels/automatic-labels.mdx
@@ -0,0 +1,13 @@
+---
+title: Automatically Label Teleport Agents
+sidebar_label: Automatic Labels
+sidebar_position: 9
+description: Provides information on labeling Teleport Agents automatically by integrating with your cloud provider.
+---
+
+When running on a virtual machine in your cloud provider, Teleport will
+automatically detect and import the cloud provider's tags as Teleport labels for
+protected resources. Read the following guides for information on configuring
+automatic labeling:
+
+<DocCardList />
diff --git a/docs/pages/admin-guides/management/guides/ec2-tags.mdx b/docs/pages/enroll-resources/automatic-labels/ec2-tags.mdx
similarity index 89%
rename from docs/pages/admin-guides/management/guides/ec2-tags.mdx
rename to docs/pages/enroll-resources/automatic-labels/ec2-tags.mdx
index 9baa413faf673..0cde0731fb165 100644
--- a/docs/pages/admin-guides/management/guides/ec2-tags.mdx
+++ b/docs/pages/enroll-resources/automatic-labels/ec2-tags.mdx
@@ -1,7 +1,12 @@
 ---
 title: EC2 Tags as Teleport Node Labels
+sidebar_label: EC2
 description: How to set up Teleport Node labels based on EC2 tags
-h1: Sync EC2 Tags and Teleport Node Labels
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 When running on an AWS EC2 instance, Teleport will automatically detect and import EC2 tags as
@@ -28,7 +33,7 @@ fakehost.example.com 127.0.0.1:3022 env=example,hostname=ip-172-31-53-70,aws/Nam
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 - One Teleport Agent running on an Amazon EC2 instance. See
-  [our guides](../../../enroll-resources/agents/agents.mdx) for how to set up Teleport Agents.
+  [our guides](../agents/agents.mdx) for how to set up Teleport Agents.
 
 ## Enable tags in instance metadata
 
@@ -50,17 +55,17 @@ To launch a new instance with instance metadata tags enabled:
 1. Ensure that `Metadata accessible` is not disabled.
 1. Enable `Allow tags in metadata`.
 
-  ![Advanced Options](../../../../img/aws/launch-instance-advanced-options.png)
+  ![Advanced Options](../../../img/aws/launch-instance-advanced-options.png)
 
 To modify an existing instance to enable instance metadata tags:
 
 1. From the instance summary, go to `Actions > Instance Settings > Allow tags in instance metadata`.
 
-  ![Instance Settings](../../../../img/aws/instance-settings.png)
+  ![Instance Settings](../../../img/aws/instance-settings.png)
 
 1. Enable `Allow`.
 
-  ![Allow Tags](../../../../img/aws/allow-tags.png)
+  ![Allow Tags](../../../img/aws/allow-tags.png)
 
 ### AWS CLI
 
diff --git a/docs/pages/admin-guides/management/guides/gcp-tags.mdx b/docs/pages/enroll-resources/automatic-labels/gcp-tags.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/guides/gcp-tags.mdx
rename to docs/pages/enroll-resources/automatic-labels/gcp-tags.mdx
index 2461d21469a47..ac0fdf2e4107d 100644
--- a/docs/pages/admin-guides/management/guides/gcp-tags.mdx
+++ b/docs/pages/enroll-resources/automatic-labels/gcp-tags.mdx
@@ -1,7 +1,12 @@
 ---
 title: GCP Tags and Labels as Teleport Agent Labels
+sidebar_label: Google Cloud
 description: How to set up Teleport Agent labels based on GCP tags and labels
-h1: Sync GCP Tags/Labels and Teleport Agent labels
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 When running on an Google Compute Engine instance, Teleport will automatically detect and import GCP
@@ -36,7 +41,7 @@ fakehost.example.com 127.0.0.1:3022 gcp/label/testing=yes,gcp/tag/environment=st
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 - One Teleport Agent running on a GCP Compute instance. See
-  [our guides](../../../enroll-resources/agents/agents.mdx) for how to set up Teleport Agents.
+  [our guides](../agents/agents.mdx) for how to set up Teleport Agents.
 
 ## Configure service account on instances with Teleport nodes
 
diff --git a/docs/pages/admin-guides/management/guides/oracle-tags.mdx b/docs/pages/enroll-resources/automatic-labels/oracle-tags.mdx
similarity index 93%
rename from docs/pages/admin-guides/management/guides/oracle-tags.mdx
rename to docs/pages/enroll-resources/automatic-labels/oracle-tags.mdx
index 48263c1c57545..7d734d9ef856f 100644
--- a/docs/pages/admin-guides/management/guides/oracle-tags.mdx
+++ b/docs/pages/enroll-resources/automatic-labels/oracle-tags.mdx
@@ -1,7 +1,11 @@
 ---
 title: Oracle Cloud Tags as Teleport Agent Labels
+sidebar_label: Oracle
 description: How to set up Teleport Agent labels based on Oracle Cloud tags
-h1: Sync Oracle Cloud tags and Teleport Agent labels
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 When running on an Oracle Cloud (OCI) Compute instance, Teleport will
@@ -28,4 +32,4 @@ fakehost.example.com 127.0.0.1:3022 oracle/testing=yes,oracle/definedTagNamespac
 <Admonition type="note">
   For services that manage multiple resources (such as the Database Service), each resource will receive the
   same tags from Oracle.
-</Admonition>
\ No newline at end of file
+</Admonition>
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/auto-user-provisioning.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/auto-user-provisioning.mdx
index cfe99bfb4c339..f0eb7132b7e0c 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/auto-user-provisioning.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/auto-user-provisioning.mdx
@@ -1,6 +1,10 @@
 ---
 title: Database Automatic User Provisioning 
+sidebar_label: Auto User Provisioning
 description: Configure automatic user provisioning for databases.
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/auto-user-provisioning/intro.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
index 65d4a9dc29a7d..ab31bf41790dc 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
@@ -1,14 +1,22 @@
 ---
 title: Amazon Redshift Automatic User Provisioning
+sidebar_label: Amazon Redshift
 description: Configure automatic user provisioning for Amazon Redshift.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 (!docs/pages/includes/database-access/auto-user-provisioning/intro.mdx!)
 
 ## Prerequisites
 
-- Teleport cluster v14.1.3 or higher with a configured [Amazon
-  Redshift](../enroll-aws-databases/postgres-redshift.mdx) database.
+- Teleport cluster with a configured [Amazon
+  Redshift](../enrollment/aws/postgres-redshift.mdx) database.
 - Ability to connect to and create user accounts in the target database.
 
 <Admonition type="note" title="Supported services">
@@ -50,6 +58,8 @@ Users created within the database will:
 
 (!docs/pages/includes/database-access/auto-user-provisioning/connect.mdx gui="pgAdmin"!)
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
+
 ## Troubleshooting
 
 ### Use your mapped remote username error
@@ -62,6 +72,6 @@ Users created within the database will:
 
 ## Next steps
 
-- Connect using your [GUI database client](../../../connect-your-client/gui-clients.mdx).
-- Learn about [role templating](../../../admin-guides/access-controls/guides/role-templates.mdx).
+- Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
+- Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
 - Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
index 7d9e09c95ea0f..7949d247c0436 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
@@ -1,14 +1,21 @@
 ---
 title: MariaDB Automatic User Provisioning 
+sidebar_label: MariaDB
 description: Configure automatic user provisioning for MariaDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 (!docs/pages/includes/database-access/auto-user-provisioning/intro.mdx!)
 
 ## Prerequisites
 
-- Teleport cluster v14.1.3 or higher with a configured [self-hosted
-  MariaDB](../enroll-self-hosted-databases/mysql-self-hosted.mdx) or [RDS MariaDB](../enroll-aws-databases/rds.mdx)
+- Teleport cluster with a configured [self-hosted
+  MariaDB](../enrollment/self-hosted/mysql-self-hosted.mdx) or [RDS MariaDB](../enrollment/aws/rds/mysql-postgres-mariadb.mdx)
   database.
 - Ability to connect to and create user accounts in the target database.
 
@@ -29,8 +36,8 @@ The admin user must have privileges within the database to create users and
 grant them privileges. The admin user must also have privileges to monitor user
 processes and role assignments.
 
-In addition, a schema is required for the admin user to log into by default.
-This schema is also used to store custom user attributes and stored procedures.
+In addition, a database is required for the admin user to log into by default.
+This database is also used to store custom user attributes and stored procedures.
 
 <Tabs>
 <TabItem label="RDS MariaDB">
@@ -47,9 +54,7 @@ CREATE DATABASE IF NOT EXISTS `teleport`;
 GRANT ALL ON `teleport`.* TO 'teleport-admin' WITH GRANT OPTION;
 ```
 
-Note that Teleport uses `teleport` as the name of the default schema but the
-name is configurable in the Teleport database definition. Replace the database
-name in the last two lines if you wish to use another database name.
+(!docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx!)
 
 <Admonition type="warning" title ="Role Admin">
 In order for the admin user to grant a role to a database user, they must be
@@ -83,9 +88,7 @@ CREATE DATABASE IF NOT EXISTS `teleport`;
 GRANT ALL ON `teleport`.* TO 'teleport-admin' WITH GRANT OPTION;
 ```
 
-Note that Teleport uses `teleport` as the name of the default schema but the
-name is configurable in the Teleport database definition. Replace the database
-name in the last two lines if you wish to use another database name.
+(!docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx!)
 
 <Admonition type="warning" title ="Role Admin">
 In order for the admin user to grant a role to a database user, they must be
@@ -154,6 +157,8 @@ database queries in the Teleport Audit Logs, when the Teleport username is over
 
 (!docs/pages/includes/database-access/auto-user-provisioning/connect.mdx gui="MySQL Workbench"!)
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="MariaDB"!)
+
 ## Troubleshooting
 
 ### Use your mapped remote username error
@@ -162,6 +167,6 @@ database queries in the Teleport Audit Logs, when the Teleport username is over
 
 ## Next steps
 
-- Connect using your [GUI database client](../../../connect-your-client/gui-clients.mdx).
-- Learn about [role templating](../../../admin-guides/access-controls/guides/role-templates.mdx).
+- Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
+- Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
 - Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
index 02c1f6bc839b6..8b612291733ef 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
@@ -1,15 +1,22 @@
 ---
 title: MongoDB Automatic User Provisioning 
+sidebar_label: MongoDB
 description: Configure automatic user provisioning for MongoDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 (!docs/pages/includes/database-access/auto-user-provisioning/intro.mdx!)
 
 ## Prerequisites
 
-- Teleport cluster v14.3 or above.
+- A Teleport cluster.
 - A self-hosted MongoDB database enrolled with your Teleport cluster. Follow
-  the [Teleport documentation](../enroll-self-hosted-databases/mongodb-self-hosted.mdx) to learn how
+  the [Teleport documentation](../enrollment/self-hosted/mongodb-self-hosted.mdx) to learn how
   to enroll your database.
   Your MongoDB database must have Role-Based Access Control (RBAC) enabled by
   setting
@@ -133,6 +140,6 @@ Users created within the database will:
 
 ## Next steps
 - Learn more about MongoDB [built-in roles](https://www.mongodb.com/docs/manual/reference/built-in-roles/) and [User-Defined Roles](https://www.mongodb.com/docs/manual/core/security-user-defined-roles/).
-- Connect using your [GUI database client](../../../connect-your-client/gui-clients.mdx).
-- Learn about [role templating](../../../admin-guides/access-controls/guides/role-templates.mdx).
+- Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
+- Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
 - Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
index cd357833cac52..774c5dfae6d0d 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
@@ -1,6 +1,11 @@
 ---
 title: MySQL Automatic User Provisioning
+sidebar_label: MySQL
 description: Configure automatic user provisioning for MySQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can automatically create an account in your MySQL database when a
@@ -28,8 +33,8 @@ stripping its privileges.
 
 ## Prerequisites
 
-- Teleport cluster v14.1 or higher with a configured [self-hosted
-  MySQL](../enroll-self-hosted-databases/mysql-self-hosted.mdx) or [RDS MySQL](../enroll-aws-databases/rds.mdx)
+- Teleport cluster with a configured [self-hosted
+  MySQL](../enrollment/self-hosted/mysql-self-hosted.mdx) or [RDS MySQL](../enrollment/aws/rds/mysql-postgres-mariadb.mdx)
   database.
 - Ability to connect to and create user accounts in the target database.
 - Automatic user provisioning is not compatible with MySQL versions lower than
@@ -49,8 +54,8 @@ The admin user must have privileges within the database to create users and
 grant them privileges. The admin user must also have privileges to monitor user
 processes and role assignments.
 
-In addition, a schema is required for the admin user to log into by default.
-Stored procedures are also created and executed from this schema.
+In addition, a database is required for the admin user to log into by default.
+Stored procedures are also created and executed from this database.
 
 <Tabs>
 <TabItem label="RDS MySQL">
@@ -64,6 +69,9 @@ GRANT PROCESS, ROLE_ADMIN, CREATE USER ON *.* TO 'teleport-admin' ;
 CREATE DATABASE IF NOT EXISTS `teleport`;
 GRANT ALTER ROUTINE, CREATE ROUTINE, EXECUTE ON `teleport`.* TO 'teleport-admin' ;
 ```
+
+(!docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx!)
+
 </TabItem>
 
 <TabItem label="Self-hosted MySQL">
@@ -76,13 +84,16 @@ GRANT PROCESS, ROLE_ADMIN, CREATE USER ON *.* TO 'teleport-admin' ;
 CREATE DATABASE IF NOT EXISTS `teleport`;
 GRANT ALTER ROUTINE, CREATE ROUTINE, EXECUTE ON `teleport`.* TO 'teleport-admin' ;
 ```
+
+(!docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx!)
+
 </TabItem>
 </Tabs>
 
 Users created by Teleport will be assigned the `teleport-auto-user` role in the
 database, which will be created automatically if it doesn't exist.
 
-(!docs/pages/includes/database-access/auto-user-provisioning/db-definition.mdx protocol="mysql" uri="localhost:3306" !)
+(!docs/pages/includes/database-access/auto-user-provisioning/db-definition-default-dbname.mdx protocol="mysql" uri="localhost:3306" !)
 
 ## Step 2/3. Configure a Teleport role
 
@@ -122,6 +133,8 @@ database queries in the Teleport Audit Logs, when the Teleport username is over
 
 (!docs/pages/includes/database-access/auto-user-provisioning/connect.mdx gui="MySQL Workbench"!)
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="MySQL"!)
+
 ## Troubleshooting
 
 ### Access denied to database error
@@ -154,6 +167,6 @@ endpoints. Please use auto-user provisioning on the primary endpoints.
 
 ## Next steps
 
-- Connect using your [GUI database client](../../../connect-your-client/gui-clients.mdx).
-- Learn about [role templating](../../../admin-guides/access-controls/guides/role-templates.mdx).
+- Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
+- Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
 - Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
index 46f44bf3306ca..dc2386b1a666f 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
@@ -1,15 +1,22 @@
 ---
 title: PostgreSQL Automatic User Provisioning
+sidebar_label: PostgreSQL
 description: Configure automatic user provisioning for PostgreSQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 (!docs/pages/includes/database-access/auto-user-provisioning/intro.mdx!)
 
 ## Prerequisites
 
 - Teleport cluster with a configured [self-hosted
-  PostgreSQL](../enroll-self-hosted-databases/postgres-self-hosted.mdx) or [RDS
-  PostgreSQL](../enroll-aws-databases/rds.mdx) database. To configure
+  PostgreSQL](../enrollment/self-hosted/postgres-self-hosted.mdx) or [RDS
+  PostgreSQL](../enrollment/aws/rds/mysql-postgres-mariadb.mdx) database. To configure
   permissions for database objects like tables, your cluster must be on version
   v15.2 or above.
 - Ability to connect to and create user accounts in the target database.
@@ -77,7 +84,7 @@ hostssl all             all             ::/0                    cert
 hostssl all             all             0.0.0.0/0               cert
 ```
 
-Refer to the [self-hosted PostgreSQL guide](../enroll-self-hosted-databases/postgres-self-hosted.mdx#step-35-configure-your-postgresql-server)
+Refer to the [self-hosted PostgreSQL guide](../enrollment/self-hosted/postgres-self-hosted.mdx#step-35-configure-your-postgresql-server)
 to ensure that your configuration is correct.
 </TabItem>
 </Tabs>
@@ -189,6 +196,8 @@ Users created within the database will:
 
 (!docs/pages/includes/database-access/auto-user-provisioning/connect.mdx gui="pgAdmin"!)
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
+
 ## Troubleshooting
 
 ### User does not have CONNECT privilege error
@@ -292,9 +301,9 @@ admin user through Teleport.
 ## Next steps
 
 - Connect using your [GUI database
-  client](../../../connect-your-client/gui-clients.mdx).
+  client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role
-  templating](../../../admin-guides/access-controls/guides/role-templates.mdx).
+  templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
 - Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
 - Read database permission management [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0151-database-permission-management.md).
 - The `internal.db_roles` traits we illustrated in this guide
diff --git a/docs/pages/enroll-resources/database-access/database-access.mdx b/docs/pages/enroll-resources/database-access/database-access.mdx
index ae59ffb853911..4cba98dba409d 100644
--- a/docs/pages/enroll-resources/database-access/database-access.mdx
+++ b/docs/pages/enroll-resources/database-access/database-access.mdx
@@ -1,6 +1,9 @@
 ---
 title: Databases
 description: Teleport database access introduction, demo and resources.
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can provide secure connections to your databases while improving both
@@ -11,7 +14,7 @@ Some of the things you can do with database access:
 - Enable users to retrieve short-lived database certificates using a Single Sign-On
   flow, thus maintaining their organization-wide identity.
 - Configure role-based access controls for databases and implement custom
-  [Access Request](../../admin-guides/access-controls/access-requests/access-requests.mdx) workflows.
+  [Access Request](../../identity-governance/access-requests/access-requests.mdx) workflows.
 - Capture database activity in the Teleport audit log.
 
 Teleport protects databases through the Teleport Database Service, which is a
@@ -22,4 +25,25 @@ agent services.
 
 ![Architecture diagram for enrolling databases with Teleport](../../../img/database-access/architecture.svg)
 
-<DocCardList />
+## Getting started
+
+- [Getting Started Guide](./getting-started.mdx): Getting started with Teleport database access and AWS Aurora PostgreSQL.
+
+## Guides
+
+- [Enroll AWS Databases (section)](./enrollment/aws/): Provides instructions on protecting databases in your AWS-managed infrastructure with Teleport.
+- [Enroll Azure Databases (section)](./enrollment/azure/): Provides instructions on protecting databases in your Azure-managed infrastructure with Teleport.
+- [Enroll Google Cloud Databases (section)](./enrollment/google-cloud/): Provides instructions on protecting databases in your Google Cloud-managed infrastructure with Teleport.
+- [Enroll Cloud-Hosted Database Platforms (section)](./enrollment/managed/): Provides instructions on protecting managed databases in your infrastructure with Teleport.
+- [Enroll Self-Hosted Databases (section)](./enrollment/self-hosted/): Provides instructions on protecting self-hosted databases in your infrastructure with Teleport.
+- [Database Automatic User Provisioning (section)](./auto-user-provisioning/): Configure automatic user provisioning for databases.
+
+## Configuration & management
+
+- [Access Controls](./rbac.mdx): Role-based access control (RBAC) for Teleport database access.
+- [Using the Teleport Database Service (section)](./guides/): Guides to possibilities for running the Teleport Database Service.
+
+## Troubleshooting & support
+
+- [FAQ](./faq.mdx): Frequently asked questions about enrolling databases with Teleport.
+- [Troubleshooting](./troubleshooting.mdx): Common issues and resolutions for enrolling databases with Teleport.
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/enroll-aws-databases.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/enroll-aws-databases.mdx
deleted file mode 100644
index 595f4176c0114..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/enroll-aws-databases.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Enroll AWS Databases
-description: "Provides instructions on protecting databases in your AWS-managed infrastructure with Teleport."
----
-
-The guides in this section show you how to protect AWS-managed databases with
-Teleport.
-
-You can configure Teleport to discover databases in your AWS account and enroll
-them with your cluster automatically. Read more about setting up
-[Database Auto-Discovery](../../auto-discovery/databases/databases.mdx).
-
-It is also possible to protect databases across your AWS accounts. Read the
-instructions in [AWS Cross-Account Database
-Access](aws-cross-account.mdx).
-
-Read the following guides for how to protect a specific AWS-managed database
-with Teleport:
-
-- [Amazon DocumentDB](aws-docdb.mdx)
-- [Amazon DynamoDB](aws-dynamodb.mdx)
-- [Amazon ElastiCache and MemoryDB for Redis](redis-aws.mdx)
-- [Amazon Keyspaces (Apache Cassandra)](aws-cassandra-keyspaces.mdx)
-- [Amazon OpenSearch](aws-opensearch.mdx)
-- [Amazon RDS Oracle](rds-oracle.mdx)
-- [Amazon RDS Proxy MySQL](rds-proxy-mysql.mdx)
-- [Amazon RDS Proxy for Microsoft SQL Server](rds-proxy-sqlserver.mdx)
-- [Amazon RDS Proxy for PostgreSQL](rds-proxy-postgres.mdx)
-- [Amazon RDS and Aurora](rds.mdx)
-- [Amazon RDS for SQL Server](sql-server-ad.mdx)
-- [Amazon Redshift Serverless](redshift-serverless.mdx)
-- [Amazon Redshift](postgres-redshift.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/postgres-redshift.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/postgres-redshift.mdx
deleted file mode 100644
index a69c5b3e1da90..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/postgres-redshift.mdx
+++ /dev/null
@@ -1,233 +0,0 @@
----
-title: Database Access with Redshift on AWS
-description: How to configure Teleport database access with Amazon Redshift PostgreSQL.
-videoBanner: UFhT52d5bYg
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon Redshift" dbConfigure="with IAM authentication"!)
-
-## How it works
-
-(!docs/pages/includes/database-access/how-it-works/iam.mdx db="Amazon Redshift" cloud="AWS"!)
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Redshift with a self-hosted Teleport cluster](../../../../img/database-access/guides/redshift_selfhosted.png)
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Redshift with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/redshift_cloud.png)
-</TabItem>
-
-</Tabs>
-
-(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon Redshift cluster" providerType="AWS"!)
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- AWS account with a Redshift cluster and permissions to create and attach IAM
-  policies.
-- Command-line client `psql` installed and added to your system's `PATH` environment variable.
-- A host, e.g., an EC2 instance, where you will run the Teleport Database
-  Service.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/6. Create a Teleport user
-
-(!docs/pages/includes/database-access/create-user.mdx!)
-
-## Step 2/6. Create a Database Service configuration
-
-(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
-
-(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
-
-(!docs/pages/includes/install-linux.mdx!)
-
-On the node that is running the Database Service, create a configuration file.
-Assign `CLUSTER_URI` to the domain name and port of the cluster:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ sudo teleport db configure create \
-   -o file \
-   --name="redshift-postgres" \
-   --proxy=teleport.example.com:443 \
-   --protocol=postgres \
-   --token=/tmp/token \
-   --uri=${CLUSTER_URI?}
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ sudo teleport db configure create \
-   -o file \
-   --name="redshift-postgres" \
-   --proxy=mytenant.teleport.sh:443 \
-   --protocol=postgres \
-   --token=/tmp/token \
-   --uri=${CLUSTER_URI?}
-```
-
-</TabItem>
-
-</Tabs>
-
-The command will generate a Database Service configuration to proxy your AWS
-Redshift cluster place it at the `/etc/teleport.yaml` location.
-
-## Step 3/6. Create an IAM Role for user access (optional) 
-
-Redshift supports two methods of IAM authentication, both of which Teleport
-also supports.
-
-First is IAM authentication as a database user. In this method, the Teleport
-Database Service generates a temporary IAM authentication token for a database
-user that already exists in the Redshift database. If you choose to use this
-method, you can skip this step as no additional IAM roles are required.
-
-The second method is to authenticate as an IAM role. In this case, the Teleport
-Database Service assumes an IAM role to authenticate with Redshift. Redshift
-then maps that IAM role to a database username and creates that database user
-if it doesn't already exist in the database.
-
-If you choose the second method, create the AWS IAM role to provide user access
-to the Redshift database. Go to IAM -> Access Management ->
-[Roles](https://console.aws.amazon.com/iamv2/home#/roles), and click "Create Role".
-
-![Create Role Step 1](../../../../img/database-access/guides/keyspaces/create-role-step1.png)
-
-Skip "Add permissions" for now, enter a role name, and press "Create role".
-
-Once the role is created, find the role, and add the following inline policy to
-the IAM role:
-![Create Role Step 1](../../../../img/database-access/guides/create-redshift-iam-role-policy.png)
-
-Or in JSON format:
-```json
-{
-	"Version": "2012-10-17",
-	"Statement": [
-		{
-			"Effect": "Allow",
-			"Action": "redshift:GetClusterCredentialsWithIAM",
-			"Resource": "arn:aws:redshift:us-east-1:123456789012:dbname:my-redshift/*"
-		}
-	]
-}
-```
-
-Replace `123456789012` and `my-redshift` with your AWS account ID and your
-Redshift database's cluster ID. 
-
-## Step 4/6. Configure IAM permissions for the Database Service
-
-(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="Redshift databases" !)
-
-### Create an IAM role for Teleport
-
-(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
-
-### Grant permissions
-
-Attach the following AWS IAM permissions to the Database Service IAM role:
-
-(!docs/pages/includes/database-access/reference/aws-iam/redshift/access-policy.mdx dbUserRole="example-iam-role" !)
-
-## Step 5/6. Start the Database Service
-
-(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
-
-The Database Service will proxy the Amazon Redshift cluster with the ID you
-specified earlier. Keep in mind that AWS IAM changes may not propagate
-immediately and can take a few minutes to come into effect.
-
-## Step 6/6. Connect
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-Once the Database Service has started and joined the cluster, log in to see the
-registered databases. Replace `--proxy` with the address of your Teleport Proxy
-Service.
-
-```code
-$ tsh login --proxy=teleport.example.com --user=alice
-$ tsh db ls
-# Name        Description                    Labels
-# ----------- ------------------------------ --------
-# my-redshift                                ...
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-Once the Database Service has started and joined the cluster, log in to see the
-registered databases. Replace `--proxy` with the address of your Teleport Cloud
-tenant.
-
-```code
-$ tsh login --proxy=mytenant.teleport.sh --user=alice
-$ tsh db ls
-# Name        Description                    Labels
-# ----------- ------------------------------ --------
-# my-redshift                                ...
-```
-
-</TabItem>
-
-</Tabs>
-
-To retrieve credentials for a database and connect to it:
-
-<Tabs>
-<TabItem label="Authenticate as database users">
-```code
-$ tsh db connect --db-user=alice --db-name=dev my-redshift
-```
-
-<Admonition type="note" title="Database users must exist">
-  Teleport does not currently use the auto-create option when generating
-  tokens for Redshift databases. Users must exist in the database.
-</Admonition>
-</TabItem>
-
-<TabItem label="Authenticate as IAM roles">
-
-```code
-$ tsh db connect --db-user=role/example-iam-role --db-name=dev my-redshift
-```
-</TabItem>
-</Tabs>
-
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
-
-To log out of the database and remove credentials:
-
-```code
-$ tsh db logout my-redshift
-```
-
-## Troubleshooting
-
-(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
-
-(!docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx!)
-
-(!docs/pages/includes/database-access/pg-cancel-request-limitation.mdx PIDQuery="SELECT pid,starttime,duration,trim(user_name) AS user,trim(query) AS query FROM stv_recents WHERE status = 'Running';"!)
-
-(!docs/pages/includes/database-access/psql-ssl-syscall-error.mdx!)
-
-## Next steps
-
-- Learn more about [using IAM authentication to generate database user
-  credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for Amazon Redshift.
-- Learn how to [restrict access](../rbac.mdx) to certain users and databases.
-- View the [High Availability (HA)](../guides/ha.mdx) guide.
-- Take a look at the YAML configuration [reference](../../../reference/agent-services/database-access-reference/configuration.mdx).
-
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-mysql.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-mysql.mdx
deleted file mode 100644
index f1c4811410d89..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-mysql.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Database Access with AWS RDS Proxy for MariaDB/MySQL
-description: How to configure Teleport database access with AWS RDS Proxy for MariaDB/MySQL.
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for MariaDB or MySQL" dbConfigure="with IAM authentication"!)
-
-(!docs/pages/includes/database-access/rds-proxy.mdx protocol="mysql" !)
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres.mdx
deleted file mode 100644
index 4199e4b3c7193..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Database Access with AWS RDS Proxy for PostgreSQL
-description: How to configure Teleport database access with AWS RDS Proxy for PostgreSQL
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for PostgreSQL" dbConfigure="with IAM authentication"!)
-
-(!docs/pages/includes/database-access/rds-proxy.mdx protocol="postgres"!)
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-sqlserver.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-sqlserver.mdx
deleted file mode 100644
index ea03c13e01e28..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-proxy-sqlserver.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Database Access with AWS RDS Proxy for Microsoft SQL Server
-description: How to configure Teleport database access with AWS RDS Proxy for Microsoft SQL Server
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for Microsoft SQL Server" dbConfigure="with IAM authentication"!)
-
-(!docs/pages/includes/database-access/rds-proxy.mdx protocol="sqlserver" !)
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx
deleted file mode 100644
index e3fa7c345c1bc..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds.mdx
+++ /dev/null
@@ -1,341 +0,0 @@
----
-title: Database Access with AWS RDS and Aurora
-h1: Database Access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB
-description: How to configure Teleport database access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB.
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS or Aurora" dbConfigure="with IAM authentication"!)
-
-## How it works
-
-(!docs/pages/includes/database-access/how-it-works/iam.mdx db="RDS" cloud="AWS"!)
-
-<Tabs>
-<TabItem label="Self-Hosted">
-![Teleport Architecture RDS Self-Hosted](../../../../img/database-access/guides/rds_selfhosted.png)
-</TabItem>
-<TabItem label="Cloud-Hosted">
-![Teleport Architecture RDS Cloud-Hosted](../../../../img/database-access/guides/rds_cloud.png)
-</TabItem>
-
-</Tabs>
-
-<Admonition type="note" title="Supported versions">
-
-The following products are not compatible with Teleport as they don't support
-IAM authentication:
-
-    - Aurora Serverless v1.
-    - RDS MariaDB versions lower than 10.6.
-
-We recommend upgrading Aurora Serverless v1 to [Aurora Serverless
-v2](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.html),
-which supports IAM authentication.
-
-</Admonition>
-
-(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="RDS" providerType="AWS" !)
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- AWS account with RDS and Aurora databases and permissions to create and attach
-  IAM policies.
-  <Admonition type="warning" title="IAM authentication">
-  Your RDS and Aurora databases must have password and IAM authentication
-  enabled.
-
-  If IAM authentication is not enabled on the target RDS and Aurora databases,
-  the Database Service will attempt to enable IAM authentication by modifying
-  them using respective APIs.
-  </Admonition>
-- A Linux host or Amazon Elastic Kubernetes Service cluster where you will run
-  the Teleport Database Service, which proxies connections to your RDS
-  databases. 
-- (!docs/pages/includes/tctl.mdx!)
-
-If you plan to run the Teleport Database Service on Kubernetes, you will need
-the following:
-
- - The `aws` CLI in your PATH. Install it by following the [AWS
-   documentation](https://aws.amazon.com/cli/).
-
- - An IAM OIDC provider running in your Kubernetes cluster. See the [AWS
-   documentation](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
-   for how to create an IAM OIDC provider.
-
-   To check whether you have an IAM OIDC provider running in your cluster, run
-   the following `aws` command, assigning <Var name="eks-region" /> to the
-   region where your EKS cluster is running and <Var name="cluster-name" /> to
-   the name of your Kubernetes cluster:
-
-   ```code
-   $ aws --region=<Var name="eks-region" /> eks describe-cluster --name <Var name="cluster-name"/> --query "cluster.identity.oidc.issuer" --output text
-   ```
-
-   If you have an IAM OIDC provider associated with your cluster, this command
-   will print its ID.
-
- - The [`jq` CLI tool](https://jqlang.github.io/jq/), which we use to process
-   JSON data in this guide.
-
-## Step 1/6. Create a Teleport user
-
-(!docs/pages/includes/database-access/create-user.mdx!)
-
-## Step 2/6. Create a Database Service configuration
-
-In this section, you will configure the Teleport Database Service. To do so, you
-will:
-
-- Create a join token for the service to demonstrate trust with your Teleport
-  cluster.
-- Set up your package manager so you can install and run the Database Service.
-- Generate a configuration for the Database Service.
-
-### Create a join token
-
-Establish trust between the Teleport Database Service and your Teleport cluster
-by creating a join token.
-
-Generate a join token by running the following command on your workstation: 
-
-```code
-$ tctl tokens add --type=db
-```
-
-The next step depends on how you plan to run the Teleport Database Service:
-
-<Tabs>
-<TabItem label="Linux Server">
-
-Save the token in a file called `/tmp/token` on the host that will run the
-Database Service.
-
-</TabItem>
-<TabItem label="Kubernetes Cluster">
-
-Later in this guide, you will use this join token when configuring the Teleport
-Database Service.
-
-</TabItem>
-</Tabs>
-
-(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
-
-### Prepare your environment
-
-Next, get your environment ready to run the Teleport Database Service:
-
-<Tabs>
-<TabItem label="Linux Host">
-
-(!docs/pages/includes/install-linux.mdx!)
-
-Provide the following information and then generate a configuration file for the
-Teleport Database Service:
-- <Var name="example.teleport.sh:443" /> The host **and port** of your Teleport
-Proxy Service or cloud-hosted Teleport Enterprise site
-- <Var name="protocol" /> The protocol of the database you want to proxy, either
-`mysql` or `postgres`
-- <Var name="endpoint:port" /> The endpoint **and port** of the database - the
-cluster endpoint for Aurora or the instance endpoint for an RDS instance, e.g.
-`myrds.us-east-1.rds.amazonaws.com:5432`
-
-```code
-$ sudo teleport db configure create \
-   -o file \
-   --name=rds-example \
-   --proxy=<Var name="example.teleport.sh:443" />  \
-   --protocol=<Var name="protocol" /> \
-   --uri=<Var name="endpoint:port" /> \
-   --labels=env=dev \
-   --token=/tmp/token
-```
-
-The command will generate a Teleport Database Service configuration file and
-place it at the `/etc/teleport.yaml` location.
-
-</TabItem>
-<TabItem label="Kubernetes Cluster">
-
-(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-</TabItem>
-</Tabs>
-
-## Step 3/6. Create IAM policies for Teleport
-
-(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="RDS instances and Aurora clusters" !)
-
-### Create an IAM role for Teleport
-
-(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
-
-### Grant permissions
-
-Attach the following AWS IAM permissions to the Database Service IAM role:
-
-(!docs/pages/includes/database-access/reference/aws-iam/rds/access-policy.mdx!)
-
-## Step 4/6. Start the Database Service
-
-Start the Teleport Database Service in your environment:
-
-<Tabs>
-<TabItem label="Linux Host">
-
-(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
-
-</TabItem>
-<TabItem label="Kubernetes Cluster">
-
-Retrieve the join token you created earlier in this guide by running the
-following command and copying a token with the `Db` type:
-
-```code
-$ tctl tokens ls
-Token                            Type Labels Expiry Time (UTC)
--------------------------------- ---- ------ ----------------------------
-(=presets.tokens.first=) Db          14 Jun 23 21:21 UTC (20m15s)
-```
-
-Create a Helm values file called `values.yaml`, assigning <Var name="token" />
-to the value of the join token you retrieved above, <Var
-name="example.teleport.sh:443" /> to the host **and port** of your Teleport
-Proxy Service, and <Var name="endpoint:port" /> to the host **and port** of your
-RDS database (e.g., `myrds.us-east-1.rds.amazonaws.com:5432`). Assign <Var
-name="aws-account" /> to your AWS account ID. Set `enterprise` to false if you
-are using Teleport Community Edition:
-
-```yaml
-authToken: <Var name="token" />
-proxyAddr: <Var name="example.teleport.sh:443" />
-roles: db
-enterprise: true
-databases:
-- name: example
-  uri: "<Var name="endpoint:port" />"
-  protocol: <Var name="protocol" />
-  static_labels:
-    env: dev
-annotations:
-  serviceAccount:
-    eks.amazonaws.com/role-arn: arn:aws:iam::<Var name="aws-account" />:role/teleport-rds-role
-```
-
-Get the version of Teleport to install. If you have automatic agent updates enabled in your cluster, query the latest Teleport version that is compatible with the updater:
-
-```code
-$ TELEPORT_VERSION="$(curl https://<Var name="example.teleport.sh:443" />/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-```
-
-Otherwise, get the version of your Teleport cluster:
-
-```code
-$ TELEPORT_VERSION="$(curl https://<Var name="example.teleport.sh:443" />/v1/webapi/ping | jq -r '.server_version')"
-```
-
-
-Install the Helm chart for Teleport Agent services, `teleport-kube-agent`:
-
-```code
-$ helm -n teleport-agent install teleport-kube-agent teleport/teleport-kube-agent \
-  --values values.yaml --create-namespace --version $TELEPORT_VERSION
-```
-
-Make sure that the Teleport Agent pod is running. You should see one
-`teleport-kube-agent` pod with a single ready container:
-
-```code
-$ kubectl -n teleport-agent get pods
-NAME                    READY   STATUS    RESTARTS   AGE
-teleport-kube-agent-0   1/1     Running   0          32s
-```
-
-</TabItem>
-</Tabs>
-
-## Step 5/6. Create a database IAM user
-
-Database users must allow IAM authentication in order to be used with Database
-Access for RDS. See below how to enable it for the user `alice` on your database
-engine. In the next step, we will authenticate to the database as the `alice`
-user via the user's Teleport account.
-
-<Tabs>
-  <TabItem label="PostgreSQL">
-  PostgreSQL users must have a `rds_iam` role:
-
-  ```sql
-  CREATE USER alice;
-  GRANT rds_iam TO alice;
-  ```
-  </TabItem>
-  <TabItem label="MySQL/MariaDB">
-  MySQL and MariaDB users must have the RDS authentication plugin enabled:
-
-  ```sql
-  CREATE USER alice IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
-  ```
-
-  Created user may not have access to anything by default so let's grant it
-  some permissions:
-
-  ```sql
-  GRANT ALL ON `%`.* TO 'alice'@'%';
-  ```
-  </TabItem>
-</Tabs>
-
-See [Creating a database account using IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html)
-for more information.
-
-## Step 6/6. Connect
-
-Once the Database Service has started and joined the cluster, log in as the
-`alice` user you created earlier to see the registered databases:
-
-```code
-$ tsh login --proxy=<Var name="example.teleport.sh:443" /> --user=alice
-$ tsh db ls
-# Name        Description Labels
-# ----------- ----------- --------
-# rds-example             env=dev
-```
-
-Retrieve credentials for the database and connect to it as the `alice` user:
-
-```code
-$ tsh db connect --db-user=alice --db-name=postgres rds-example
-```
-
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
-
-<Admonition type="note" title="Note">
-  The appropriate database command-line client (`psql`, `mysql`, `mariadb`) should be
-  available in `PATH` in order to be able to connect.
-</Admonition>
-
-Log out of the database and remove credentials:
-
-```code
-$ tsh db logout rds-example
-```
-
-## Troubleshooting
-
-(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
-
-(!docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx!)
-
-(!docs/pages/includes/database-access/pg-cancel-request-limitation.mdx!)
-
-(!docs/pages/includes/database-access/psql-ssl-syscall-error.mdx!)
-
-## Next steps
-
-(!docs/pages/includes/database-access/guides-next-steps.mdx!)
-- Set up [automatic database user provisioning](../auto-user-provisioning/auto-user-provisioning.mdx).
-
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/redis-aws.mdx b/docs/pages/enroll-resources/database-access/enroll-aws-databases/redis-aws.mdx
deleted file mode 100644
index 7a515fb40b7df..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/redis-aws.mdx
+++ /dev/null
@@ -1,356 +0,0 @@
----
-title: Database Access with Amazon ElastiCache and Amazon MemoryDB for Redis
-description: How to configure Teleport database access with Amazon ElastiCache and Amazon MemoryDB for Redis.
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon ElastiCache or MemoryDB for Redis" dbConfigure="with IAM authentication"!)
-
-## How it works
-
-The Teleport Database Service proxies traffic from users to Amazon ElastiCache or
-MemoryDB for Redis. Authentication between the Database Service and the
-AWS-hosted Redis database can take one of two forms:
-
-- **IAM authentication (preferred):** The Teleport Database Service connects to
-  the database using a short-lived AWS IAM authentication token. AWS IAM
-  authentication is available for ElastiCache and MemoryDB with Redis version
-  7.0 or above.
-- **Managing users:** The Teleport Database Service manages users in a Redis
-  access control list, rotates their passwords every 15 minutes, and saves these
-  passwords in AWS Secrets Manager. The Database Service automatically sends an
-  `AUTH` command with the saved password when connecting the client to the Redis
-  server.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll RDS with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/redis_elasticache_selfhosted.png)
-</TabItem>
-<TabItem scope={["cloud","team"]} label="Teleport Cloud">
-![Enroll RDS with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/redis_elasticache_cloud.png)
-</TabItem>
-
-</Tabs>
-
-(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon Elasticache or MemoryDB cluster" providerType="AWS"!)
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- AWS account with at least one ElastiCache or MemoryDB for Redis cluster. 
-  **In-transit encryption via (TLS) must be enabled**.
-- Permissions to create and attach IAM policies.
-- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.
-- A host, e.g., an EC2 instance, where you will run the Teleport Database
-  Service.
-- [Redis ACL](https://redis.io/docs/manual/security/acl/) enabled for your
-  ElastiCache or MemoryDB for Redis cluster.
-- (!docs/pages/includes/database-access/aws-auto-discovery-prerequisite.mdx!)
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/6. Create a Teleport user
-
-(!docs/pages/includes/database-access/create-user.mdx!)
-
-## Step 2/6. Create a Database Service configuration
-
-(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
-
-(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
-
-(!docs/pages/includes/install-linux.mdx!)
-
-Create the Database Service configuration:
-
-<Tabs>
-  <TabItem label="ElastiCache">
-
-  Change `example.teleport.sh:443` to the host and port of your Teleport Proxy
-  Service. Set `ELASTICACHE_URI` to the domain name and port of your ElastiCache
-  database:
-
-  ```code
-  $ ELASTICACHE_URI=""
-  $ sudo teleport db configure create \
-     -o file \
-     --name="elasticache" \
-     --proxy=example.teleport.sh:443 \
-     --protocol="redis" \
-     --uri=${ELASTICACHE_URI?} \
-     --token=/tmp/token
-  ```
-  </TabItem>
-  <TabItem label="MemoryDB">
-
-  Change `example.teleport.sh:443` to the host and port of your Teleport Proxy
-  Service. Set `MEMORYDB_URI` to the domain name and port of your ElastiCache
-  database:
-
-  ```code
-  $ MEMORYDB_URI=""
-  $ sudo teleport db configure create \
-     -o file \
-     --name="memorydb" \
-     --proxy=example.teleport.sh:443 \
-     --protocol="redis" \ \
-     --uri=${MEMORYDB_URI} \
-     --token=/tmp/token
-  ```
-  </TabItem>
-</Tabs>
-
-The command will generate a Database Service configuration and place it at the
-`/etc/teleport.yaml` location.
-
-## Step 3/6. Create an IAM role for Teleport
-
-(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="ElastiCache or MemoryDB databases" !)
-
-### Create an IAM role for Teleport
-
-(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
-
-### Grant permissions
-
-Attach the following AWS IAM permissions to the Database Service IAM role:
-
-<Tabs>
-<TabItem label="ElastiCache">
-
-(!docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx!)
-
-</TabItem>
-<TabItem label="MemoryDB">
-
-(!docs/pages/includes/database-access/reference/aws-iam/memorydb/access-policy.mdx!)
-
-</TabItem>
-</Tabs>
-
-## Step 4/6. Start the Database Service
-
-(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
-
-## Step 5/6. Configure authentication for ElastiCache or MemoryDB users
-
-Configure authentication for your AWS-hosted Redis database. The steps to follow
-depend on whether you want to enable the Teleport Database Service to use IAM
-authentication with ElastiCache, IAM authentication with MemoryDB, or
-authentication based on managing passwords via AWS Secrets Manager:
-
-<Tabs>
-<TabItem label="ElastiCache IAM user">
-
-To enable Redis ACL, please see [Authenticating users with Role-Based Access
-Control for
-ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html).
-
-Some additional limitations apply when using IAM authentication - for more
-information, see:
-[ElastiCache Auth IAM Limits](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html#auth-iam-limits).
-
-There are a few requirements for configuring an ElastiCache IAM-enabled user:
-- the user must have identical username and user id properties.
-- the user must have authentication mode set to "IAM".
-- the user must be attached to an ElastiCache user group.
-
-Create an ElastiCache IAM-enabled user.
-The following example creates an ElastiCache user with the access string
-`on ~* +@all` that represents an active user with access to all available keys
-and commands:
-```code
-$ aws elasticache create-user \
-  --user-name iam-user-01 \
-  --user-id iam-user-01 \
-  --authentication-mode Type=iam \
-  --engine redis \
-  --access-string "on ~* +@all"
-```
-
-<Admonition type="note" title="Access Strings">
-You may prefer a less permissive access string for your ElastiCache users.
-For more information about ElastiCache access strings, please see:
-[ElastiCache Cluster RBAC Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Access-string).
-</Admonition>
-
-Create an ElastiCache user group and attach it to your ElastiCache replication
-group:
-```code
-$ aws elasticache create-user-group \
-  --user-group-id iam-user-group-01 \
-  --engine redis \
-  --user-ids default iam-user-01
-$ aws elasticache modify-replication-group \
-  --replication-group-id replication-group-01 \
-  --user-group-ids-to-add iam-user-group-01
-```
-
-Once the ElastiCache user has been created, verify that the user is configured
-to satisfy the requirements for IAM authentication:
-
-![ElastiCache IAM-enabled User](../../../../img/database-access/guides/redis/redis-aws-iam-user@2x.png)
-
-</TabItem>
-
-<TabItem label="MemoryDB IAM user">
-
-It is highly recommended to use a different ACL than the preset `open-access`
-ACL which allows all access using the `default` user.
-
-If you do not have another MemoryDB ACL yet, create one:
-```code
-$ aws memorydb create-acl --acl-name my-acl
-```
-
-Make sure the ACL is attached to your MemoryDB cluster:
-```code
-$ aws memorydb update-cluster --cluster-name my-memorydb --acl-name my-acl
-```
-
-Now create an MemoryDB IAM-enabled user:
-```code
-$ aws memorydb create-user \
-  --user-name iam-user-01 \
-  --authentication-mode Type=iam \
-  --access-string "on ~* +@all"
-```
-
-<Admonition type="note" title="Access Strings">
-The above example creates a MemoryDB user with the access string `on ~* +@all`
-that represents an active user with access to all available keys and commands.
-
-You may prefer a less permissive access string for your MemoryDB users. For
-more information about access strings, please see: [Specifying Permissions
-Using an Access
-String](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html#access-string).
-</Admonition>
-
-Then add this user to the ACL attached to your MemoryDB cluster:
-```code
-$ aws memorydb update-acl --user-names-to-add iam-user-01 --acl-name my-acl
-```
-
-</TabItem>
-<TabItem label="Teleport-managed user">
-
-To enable Redis ACL, please see [Authenticating users with Role-Based Access
-Control for
-ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html)
-and [Authenticating users with Access Control Lists for
-MemoryDB](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
-
-Once an ElastiCache or MemoryDB user is created with the desired access, add an
-AWS resource tag `teleport.dev/managed` with the value `true` to this user:
-
-![Managed User Tag](../../../../img/database-access/guides/redis/redis-aws-managed-user-tag.png)
-
-The Database Service will automatically discover this user if it is associated
-with a registered database. Keep in mind that it may take the Database Service
-some time (up to 20 minutes) to discover this user once the tag is added.
-
-</TabItem>
-</Tabs>
-
-If you choose not to use the above options, Teleport will not automatically
-authenticate with the Redis server.
-
-You can either set up a "no password" configuration for your ElastiCache or
-MemoryDB user, or manually enter an `AUTH` command with the password you have
-configured after a successful client connection. However, it is strongly
-advised to use one of the first two options or a strong password for better
-security.
-
-## Step 6/6. Connect
-
-Once the Database Service has started and joined the cluster, log in to see the
-registered databases:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-```code
-$ tsh login --proxy=teleport.example.com --user=alice
-$ tsh db ls
-# Name                        Description                                               Labels
-# --------------------------- --------------------------------------------------------- --------
-# my-cluster-mode-elasticache                                                           ...
-# my-elasticache                                                                        ...
-# my-elasticache-reader                                                                 ...
-# my-memorydb                                                                           ...
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ tsh login --proxy=mytenant.teleport.sh --user=alice
-$ tsh db ls
-# Name                        Description                                               Labels
-# --------------------------- --------------------------------------------------------- --------
-# my-cluster-mode-elasticache                                                           ...
-# my-elasticache                                                                        ...
-# my-elasticache-reader                                                                 ...
-# my-memorydb                                                                           ...
-```
-
-</TabItem>
-
-</Tabs>
-
-To retrieve credentials for a database and connect to it:
-
-```code
-$ tsh db connect --db-user=my-database-user my-elasticache
-```
-
-If flag `--db-user` is not provided, Teleport logs in as the `default` user.
-
-Now, depending on the authentication configurations, you may need to send an
-`AUTH` command to authenticate with the Redis server:
-
-<Tabs>
-  <TabItem label="Redis with ACL">
-    The Database Service automatically authenticates Teleport-managed and
-    IAM-enabled users with the Redis server. No `AUTH` command is required
-    after successful connection.
-
-    If you are connecting as a user that is not managed by Teleport and is not
-    IAM-enabled, the connection normally starts as the `default` user.
-    Now you can authenticate the database user with its password:
-
-    ```
-    AUTH my-database-user <USER_PASSWORD>
-    ```
-  </TabItem>
-
-  <TabItem label="Redis with AUTH token">
-    Now you can authenticate with the shared AUTH token:
-
-    ```
-    AUTH <SHARED_AUTH_TOKEN>
-    ```
-  </TabItem>
-
-  <TabItem label="Redis without AUTH">
-    For Redis deployments without the ACL system or legacy `requirepass`
-    directive enabled, no `AUTH` command is required.
-  </TabItem>
-
-</Tabs>
-
-To log out of the database and remove credentials:
-
-```code
-# Remove credentials for a particular database instance.
-$ tsh db logout my-elasticache
-# Remove credentials for all database instances.
-$ tsh db logout
-```
-
-## Troubleshooting
-
-(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
-
-## Next steps
-
-(!docs/pages/includes/database-access/guides-next-steps.mdx!)
-
diff --git a/docs/pages/enroll-resources/database-access/enroll-azure-databases/enroll-azure-databases.mdx b/docs/pages/enroll-resources/database-access/enroll-azure-databases/enroll-azure-databases.mdx
deleted file mode 100644
index 13afa45e52f94..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-azure-databases/enroll-azure-databases.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Enroll Azure Databases
-description: "Provides instructions on protecting databases in your Azure-managed infrastructure with Teleport."
----
-
-You can protect Azure-managed databases with Teleport. Learn how to enroll the
-following databases:
-
-- [Azure SQL Server](azure-sql-server-ad.mdx)
-- [Azure Database for PostgreSQL or MySQL Server](azure-postgres-mysql.mdx)
-- [Azure Redis](azure-redis.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/enroll-google-cloud-databases.mdx b/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/enroll-google-cloud-databases.mdx
deleted file mode 100644
index f46814237b8dc..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/enroll-google-cloud-databases.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Enroll Google Cloud Databases
-description: "Provides instructions on protecting databases in your Google Cloud-managed infrastructure with Teleport."
----
-
-You can protect databases hosted on Google Cloud with Teleport. Read the
-following guides for instructions on enrolling a specific database:
-
-- [PostgreSQL on Google Cloud SQL](postgres-cloudsql.mdx)
-- [MySQL on Google Cloud SQL](mysql-cloudsql.mdx)
-- [Cloud Spanner](spanner.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-managed-databases/enroll-managed-databases.mdx b/docs/pages/enroll-resources/database-access/enroll-managed-databases/enroll-managed-databases.mdx
deleted file mode 100644
index 0987c878f5504..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-managed-databases/enroll-managed-databases.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Enroll Cloud-Hosted Database Platforms
-description: "Provides instructions on protecting managed databases in your infrastructure with Teleport."
----
-
-Teleport can protect databases that are managed as a dedicated cloud platform.
-Learn how to enroll the following databases in your Teleport cluster:
-
-- [MongoDB Atlas](mongodb-atlas.mdx)
-- [Oracle Exadata](oracle-exadata.mdx)
-- [Snowflake](snowflake.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-managed-databases/snowflake.mdx b/docs/pages/enroll-resources/database-access/enroll-managed-databases/snowflake.mdx
deleted file mode 100644
index 6d760138869b5..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-managed-databases/snowflake.mdx
+++ /dev/null
@@ -1,149 +0,0 @@
----
-title: Database Access with Snowflake
-description: How to configure Teleport database access with Snowflake.
----
-
-(!docs/pages/includes/database-access/db-introduction.mdx dbType="Snowflake" dbConfigure="with key pair authentication"!)
-
-## How it works
-
-The Teleport Database Service communicates with Snowflake using HTTP messages
-that contain JSON web tokens signed by the Teleport certificate authority for
-database clients. Snowflake is configured to trust the Teleport database client
-CA. When a user connects to Snowflake via Teleport, the Database Service
-forwards the user's requests to Snowflake as Teleport-authenticated messages.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-  ![Enroll Snowflake with a self-hosted Teleport cluster](../../../../img/database-access/guides/snowflake_selfhosted.png)
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-  ![Enroll Snowflake with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/snowflake_cloud.png)
-</TabItem>
-
-</Tabs>
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- Snowflake account with `SECURITYADMIN` role or higher.
-
-- `snowsql` installed and added to your system's `PATH` environment variable.
-
-- A host where you will run the Teleport Database Service.
-
-  See [Installation](../../../installation.mdx) for details.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/5. Set up the Teleport Database Service
-
-(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
-
-Install and configure Teleport where you will run the Teleport Database Service:
-
-<Tabs>
-<TabItem label="Linux Server">
-
-(!docs/pages/includes/install-linux.mdx!)
-
-(!docs/pages/includes/database-access/db-configure-start.mdx dbName="example-snowflake" dbProtocol="snowflake" databaseAddress="abc12345.snowflakecomputing.com" !)
-
-</TabItem>
-<TabItem label="Kubernetes Cluster">
-  Teleport provides Helm charts for installing the Teleport Database Service in Kubernetes Clusters.
-
-  (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-  (!docs/pages/includes/database-access/db-helm-install.mdx dbName="example-snowflake" dbProtocol="snowflake" databaseAddress="abc12345.snowflakecomputing.com" !)
-</TabItem>
-</Tabs>
-
-(!docs/pages/includes/database-access/multiple-instances-tip.mdx !)
-
-## Step 2/5. Create a Teleport user
-
-(!docs/pages/includes/database-access/create-user.mdx!)
-
-## Step 3/5. Export a public key
-
-Use the `tctl auth sign` command below to export a public key for your Snowflake user:
-
-```code
-$ tctl auth sign --format=snowflake --out=server
-```
-
-The command will create a `server.pub` file with Teleport's public key. Teleport will use the corresponding private key to
-generate a JWT (JSON Web Token) that will be used to authenticate to Snowflake.
-
-
-## Step 4/5. Add the public key to your Snowflake user
-
-Use the public key you generated earlier to enable key pair authentication.
-
-Log in to your Snowflake instance and execute the SQL statement below:
-
-```sql
-alter user alice set rsa_public_key='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3dHYw4LJCcZzdbhb3hV...LwIDAQAB';
-```
-
-In this statement, `alice` is the name of the Snowflake user and the `rsa_public_key` is the key generated earlier without
-the PEM header/footer (first and the last line).
-
-You can use the `describe user` command to verify the user's public key:
-
-```sql
-desc user alice;
-```
-
-See the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-4-assign-the-public-key-to-a-snowflake-user)
-for more details.
-
-## Step 5/5. Connect
-
-Log in to your Teleport cluster and see the available databases:
-
-<Tabs>
-  <TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-    ```code
-    $ tsh login --proxy=teleport.example.com --user=alice
-    $ tsh db ls
-    # Name              Description         Labels
-    # ----------------- ------------------- --------
-    # example-snowflake Example Snowflake ❄ env=dev
-    ```
-  </TabItem>
-  <TabItem scope={["cloud","team"]} label="Cloud-Hosted">
-    ```code
-    $ tsh login --proxy=mytenant.teleport.sh --user=alice
-    $ tsh db ls
-    # Name              Description         Labels
-    # ----------------- ------------------- --------
-    # example-snowflake Example Snowflake ❄ env=dev
-    ```
-  </TabItem>
-</Tabs>
-
-To retrieve credentials for a database and connect to it:
-
-```code
-$ tsh db connect --db-user=alice --db-name=SNOWFLAKE_SAMPLE_DATA example-snowflake
-```
-
-The `snowsql` command-line client should be available in the system `PATH` in order to be
-able to connect.
-
-To log out of the database and remove credentials:
-
-```code
-# Remove credentials for a particular database instance.
-$ tsh db logout example-snowflake
-# Remove credentials for all database instances.
-$ tsh db logout
-```
-
-## Next steps
-
-(!docs/pages/includes/database-access/guides-next-steps.mdx!)
-
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/enroll-self-hosted-databases.mdx b/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/enroll-self-hosted-databases.mdx
deleted file mode 100644
index bdbecd8478fc4..0000000000000
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/enroll-self-hosted-databases.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: Enroll Self-Hosted Databases
-description: "Provides instructions on protecting self-hosted databases in your infrastructure with Teleport."
----
-
-You can protect self-hosted databases with Teleport. Learn how to enroll your
-database in your Teleport cluster with the following guides:
-
-- [Cassandra and
-  ScyllaDB](cassandra-self-hosted.mdx)
-- [ClickHouse](clickhouse-self-hosted.mdx)
-- [CockroachDB](cockroachdb-self-hosted.mdx)
-- [Elastic](elastic.mdx)
-- [MongoDB](mongodb-self-hosted.mdx)
-- [MySQL](mysql-self-hosted.mdx)
-- [Oracle](oracle-self-hosted.mdx)
-- [PostgreSQL](postgres-self-hosted.mdx)
-- [Redis Cluster](redis-cluster.mdx)
-- [Redis](redis.mdx)
-- [SQL Server with PKINIT
-  authentication](sql-server-ad-pkinit.mdx)
-- [Vitess](vitess.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cassandra-keyspaces.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-cassandra-keyspaces.mdx
similarity index 91%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cassandra-keyspaces.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/aws-cassandra-keyspaces.mdx
index 312f211c2d1ae..ca6164a1252e0 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cassandra-keyspaces.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-cassandra-keyspaces.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Amazon Keyspaces (Apache Cassandra)
+sidebar_label: Keyspaces (Apache Cassandra)
 description: How to configure Teleport database access with Amazon Keyspaces (Apache Cassandra)
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon Keyspaces (Apache Cassandra)" dbConfigure="with IAM authentication"!)
@@ -11,10 +17,10 @@ description: How to configure Teleport database access with Amazon Keyspaces (Ap
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Redis with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/cassandra_keyspaces_selfhosted.png)
+![Enroll Redis with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/cassandra_keyspaces_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Redis with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/cassandra_keyspaces_cloud.png)
+![Enroll Redis with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/cassandra_keyspaces_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -90,7 +96,7 @@ Create an AWS IAM Role that will be used as your Keyspaces user.
 Go to the IAM -> Access Management -> [Roles](https://console.aws.amazon.com/iamv2/home#/roles).
 Press Create Role.
 
-![Create Role Step 1](../../../../img/database-access/guides/keyspaces/create-role-step1.png)
+![Create Role Step 1](../../../../../img/database-access/guides/keyspaces/create-role-step1.png)
 AWS provides the `AmazonKeyspacesReadOnlyAccess` and `AmazonKeyspacesFullAccess` IAM policies that you can incorporate into your Keyspaces user's role.
 You can choose `AmazonKeyspacesReadOnlyAccess` for read-only access to Amazon Keyspaces or `AmazonKeyspacesFullAccess` for full access.
 
@@ -101,9 +107,9 @@ You can choose `AmazonKeyspacesReadOnlyAccess` for read-only access to Amazon Ke
   You can also create your own custom Amazon Keyspaces Permissions Policies: [Amazon Keyspaces identity-based policy examples](https://docs.aws.amazon.com/keyspaces/latest/devguide/security_iam_id-based-policy-examples.html).
 </Admonition>
 
-![Create Role Step 1](../../../../img/database-access/guides/keyspaces/create-role-step2.png)
+![Create Role Step 1](../../../../../img/database-access/guides/keyspaces/create-role-step2.png)
 Enter a role name and press "Create role".
-![Create Role Step 1](../../../../img/database-access/guides/keyspaces/create-role-step3.png)
+![Create Role Step 1](../../../../../img/database-access/guides/keyspaces/create-role-step3.png)
 
 ## Step 4/5. Give Teleport permissions to assume roles
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cross-account.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-cross-account.mdx
similarity index 95%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cross-account.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/aws-cross-account.mdx
index 8675ba1f76589..fa72de4e556bc 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-cross-account.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-cross-account.mdx
@@ -1,6 +1,13 @@
 ---
 title: AWS Cross-Account Database Access
+sidebar_label: Cross-Account
+sidebar_position: 1
 description: How to connect AWS databases in external AWS accounts to Teleport.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 You can deploy the Teleport Database Service with AWS IAM credentials in one
@@ -31,7 +38,7 @@ Teleport Database Service to connect to the databases.
 This guide does not cover AWS network configuration, because it depends on your
 specific AWS network setup and the kind(s) of AWS databases you wish to connect
 to Teleport. For more information, see [how to connect your
-database](enroll-aws-databases.mdx).
+database](aws.mdx).
 </Admonition>
 
 ## Teleport configuration
@@ -60,7 +67,7 @@ Modify your Teleport Database Service configuration file to assume an external
 AWS IAM role when it is discovering AWS databases.
 
 ```yaml
-# This example configuration will discover AWS RDS databases in us-west-1
+# This example configuration will discover Amazon RDS databases in us-west-1
 # within AWS account `222222222222` by assuming the external AWS IAM role
 # "example-role".
 db_service:
@@ -137,7 +144,7 @@ Save the configuration to a file like `database.yaml` and create it with `tctl`:
 $ tctl create database.yaml
 ```
 For more information about database registration using dynamic database
-resources, see: [Dynamic Registration](../guides/dynamic-registration.mdx).
+resources, see: [Dynamic Registration](../../guides/dynamic-registration.mdx).
 
 </TabItem>
 </Tabs>
@@ -227,4 +234,4 @@ role, then the trust policy might look like:
 
 ## Next steps
 
-- Get started by [connecting](../guides/guides.mdx) your database.
+- Get started by [connecting](../../guides/guides.mdx) your database.
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-docdb.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx
similarity index 92%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-docdb.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx
index 2c921395bb4c1..1953bdd94391c 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-docdb.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-docdb.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Amazon DocumentDB
+sidebar_label: DocumentDB
 description: How to access Amazon DocumentDB with Teleport database access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon DocumentDB" dbConfigure="with IAM authentication"!)
@@ -11,10 +17,10 @@ description: How to access Amazon DocumentDB with Teleport database access
 
 <Tabs>
 <TabItem label="Self-Hosted">
-![Teleport Architecture DocumentDB Access Self-Hosted](../../../../img/database-access/guides/docdb_selfhosted.svg)
+![Teleport Architecture DocumentDB Access Self-Hosted](../../../../../img/database-access/guides/docdb_selfhosted.svg)
 </TabItem>
 <TabItem label="Cloud-Hosted">
-![Teleport Architecture DocumentDB Cloud](../../../../img/database-access/guides/docdb_cloud.svg)
+![Teleport Architecture DocumentDB Cloud](../../../../../img/database-access/guides/docdb_cloud.svg)
 </TabItem>
 
 </Tabs>
@@ -113,12 +119,12 @@ page](https://console.aws.amazon.com/iamv2/home#/roles) of the AWS Console,
 then press "Create Role". Under **Trusted entity type** select "AWS service".
 Under **Use case** select "EC2" or the intended use case, then click **Next**.
 
-![Create Role Step 1](../../../../img/database-access/guides/dynamodb-create-ec2-role.png)
+![Create Role Step 1](../../../../../img/database-access/guides/dynamodb-create-ec2-role.png)
 
 On the "Add Permissions" page, find and select the
 `TeleportDatabaseAccessDocumentDB` policy that is created in the previous step.
 
-![Create Role Step 2](../../../../img/database-access/guides/docdb-create-role-select-policy.png)
+![Create Role Step 2](../../../../../img/database-access/guides/docdb-create-role-select-policy.png)
 
 Click "Next" and give the role a name. In this guide,  we will use the example
 name `TeleportDatabaseService` for this role. Once you have chosen a name,
@@ -143,7 +149,7 @@ Navigate back to the Roles page on the AWS Web Console and create a new role.
 Select the "AWS account" option, which creates a default trust policy to allow
 other entities in this account to assume this role:
 
-![Create Role Step 1](../../../../img/database-access/guides/dynamodb-create-role-1.png)
+![Create Role Step 1](../../../../../img/database-access/guides/dynamodb-create-role-1.png)
 
 Skip the "Add Permissions" page by clicking "Next", and give the role a name.
 In this guide, we will use the example "teleport-docdb-user" for this role.
@@ -151,7 +157,7 @@ In this guide, we will use the example "teleport-docdb-user" for this role.
 Now click **Add new tag** at Step 3, use `TeleportDatabaseService` for the key
 and `Allowed` for the value. Then click **Create Role** to complete the process.
 
-![Create Role Step 3](../../../../img/database-access/guides/aws-create-role-add-tags.png)
+![Create Role Step 3](../../../../../img/database-access/guides/aws-create-role-add-tags.png)
 
 ### Create a DocumentDB user
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-dynamodb.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-dynamodb.mdx
similarity index 91%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-dynamodb.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/aws-dynamodb.mdx
index 7d46c867a6d4d..57529284a2cf5 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-dynamodb.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-dynamodb.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Amazon DynamoDB
+sidebar_label: DynamoDB
 description: How to access Amazon DynamoDB with Teleport database access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon DynamoDB" dbConfigure="with IAM authentication"!)
@@ -16,10 +22,10 @@ request with credentials from AWS, then forwards it to the DynamoDB API.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![DynamoDB Self-Hosted](../../../../img/database-access/guides/aws-dynamodb_selfhosted.png)
+![DynamoDB Self-Hosted](../../../../../img/database-access/guides/aws-dynamodb_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![DynamoDB Cloud](../../../../img/database-access/guides/aws-dynamodb_cloud.png)
+![DynamoDB Cloud](../../../../../img/database-access/guides/aws-dynamodb_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -56,7 +62,7 @@ Visit the [IAM > Roles page](https://console.aws.amazon.com/iamv2/home#/roles) o
 the AWS Console, then press "Create Role". Under **Trusted entity type** select
 "AWS service". Under **Use case** select "EC2", then click **Next**.
 
-![Create Role to Identify EC2 Instance](../../../../img/database-access/guides/dynamodb-create-ec2-role.png)
+![Create Role to Identify EC2 Instance](../../../../../img/database-access/guides/dynamodb-create-ec2-role.png)
 
 On the "Add Permissions" page, you can simply click **Next** since this role does not require any permissions. In this guide, we will use the example name `TeleportDatabaseService` for this role. Once you have chosen a name, click **Create Role** to complete the process.
 
@@ -66,11 +72,11 @@ Navigate back to the Roles page and create a new role. Select the "AWS account"
 option, which creates a default trust policy to allow other entities in this
 account to assume this role:
 
-![Create Role Step 1](../../../../img/database-access/guides/dynamodb-create-role-1.png)
+![Create Role Step 1](../../../../../img/database-access/guides/dynamodb-create-role-1.png)
 
 Click **Next**. Find the AWS-managed policy `AmazonDynamoDBFullAccess` and then select the policy:
 
-![Create Role Step 2](../../../../img/database-access/guides/dynamodb-create-role-2.png)
+![Create Role Step 2](../../../../../img/database-access/guides/dynamodb-create-role-2.png)
 
 <Admonition type="note" title="Apply least-privilege permissions">
 The `AmazonDynamoDBFullAccess` policy may grant more permissions than desired.
@@ -219,7 +225,7 @@ $ aws dynamodb list-tables --endpoint-url=http://localhost:8000
 ```
 
 {/* vale messaging.protocol-products = NO */}
-You can also connect to this database from the AWS NoSQL Workbench, as documented in our [Database Access GUI Clients](../../../connect-your-client/gui-clients.mdx#nosql-workbench) guide.
+You can also connect to this database from the AWS NoSQL Workbench, as documented in our [Database Access GUI Clients](../../../../connect-your-client/third-party/gui-clients.mdx#nosql-workbench) guide.
 {/* vale messaging.protocol-products = YES */}
 
 You can also use this tunnel for programmatic access. The example below uses the `boto3` SDK from AWS:
@@ -238,7 +244,7 @@ Type "help", "copyright", "credits" or "license" for more information.
 
 ## Next Steps
 
-- See [Dynamic Database Registration](../guides/dynamic-registration.mdx) to
+- See [Dynamic Database Registration](../../guides/dynamic-registration.mdx) to
   learn how to use resource labels to keep Teleport up to date with accessible
   databases in your infrastructure.
 
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/aws-memorydb.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-memorydb.mdx
new file mode 100644
index 0000000000000..41e2d5f41800a
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-memorydb.mdx
@@ -0,0 +1,212 @@
+---
+title: Database Access with Amazon MemoryDB
+sidebar_label: MemoryDB
+description: How to configure Teleport database access with Amazon MemoryDB
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon MemoryDB for Redis and Valkey" dbConfigure="with IAM authentication"!)
+
+## How it works
+
+(!docs/pages/includes/database-access/aws-redis-how-it-works.mdx dbType="Amazon MemoryDB"!)
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+![Enroll MemoryDB with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/aws_memorydb_selfhosted.png)
+</TabItem>
+<TabItem scope={["cloud","team"]} label="Teleport Cloud">
+![Enroll MemoryDB with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/aws_memorydb_cloud.png)
+</TabItem>
+
+</Tabs>
+
+(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon MemoryDB" providerType="AWS"!)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with an MemoryDB for Redis or Valkey cluster.
+  **In-transit encryption via (TLS) must be enabled**.
+- Permissions to create and attach IAM policies.
+- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.
+- A host, e.g., an EC2 instance, where you will run the Teleport Database
+  Service.
+- [ACL](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html) enabled for your
+  MemoryDB cluster.
+- (!docs/pages/includes/database-access/aws-auto-discovery-prerequisite.mdx!)
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/6. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 2/6. Create a Database Service configuration
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+(!docs/pages/includes/install-linux.mdx!)
+
+Create the Database Service configuration:
+```code
+$ MEMORYDB_URI=""
+$ sudo teleport db configure create \
+   -o file \
+   --name="memorydb" \
+   --proxy=example.teleport.sh:443 \
+   --protocol="redis" \ \
+   --uri=${MEMORYDB_URI} \
+   --token=/tmp/token
+```
+
+Change `example.teleport.sh:443` to the host and port of your Teleport Proxy
+Service. Set `MEMORYDB_URI` to the domain name and port of your MemoryDB
+database.
+
+The command will generate a Database Service configuration and place it at the
+`/etc/teleport.yaml` location.
+
+## Step 3/6. Create an IAM role for Teleport
+
+(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="MemoryDB databases" !)
+
+### Create an IAM role for Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Grant permissions
+
+(!docs/pages/includes/database-access/reference/aws-iam/memorydb/access-policy.mdx!)
+
+## Step 4/6. Start the Database Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
+
+## Step 5/6. Configure authentication for MemoryDB users
+
+Configure authentication for your MemoryDB database. The steps to follow
+depend on whether you want to enable the Teleport Database Service to use IAM
+authentication with MemoryDB, or authentication based on managing passwords
+via AWS Secrets Manager:
+
+<Tabs>
+<TabItem label="MemoryDB IAM user">
+
+It is highly recommended to use a different ACL than the preset `open-access`
+ACL which allows all access using the `default` user.
+
+If you do not have another MemoryDB ACL yet, create one:
+```code
+$ aws memorydb create-acl --acl-name my-acl
+```
+
+Make sure the ACL is attached to your MemoryDB cluster:
+```code
+$ aws memorydb update-cluster --cluster-name my-memorydb --acl-name my-acl
+```
+
+Now create an MemoryDB IAM-enabled user:
+```code
+$ aws memorydb create-user \
+  --user-name iam-user-01 \
+  --authentication-mode Type=iam \
+  --access-string "on ~* +@all"
+```
+
+<Admonition type="note" title="Access Strings">
+The above example creates a MemoryDB user with the access string `on ~* +@all`
+that represents an active user with access to all available keys and commands.
+
+You may prefer a less permissive access string for your MemoryDB users. For
+more information about access strings, please see: [Specifying Permissions
+Using an Access
+String](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html#access-string).
+</Admonition>
+
+Then add this user to the ACL attached to your MemoryDB cluster:
+```code
+$ aws memorydb update-acl --user-names-to-add iam-user-01 --acl-name my-acl
+```
+
+</TabItem>
+<TabItem label="Teleport-managed user">
+
+To enable ACL, please see [Authenticating users with Access Control Lists for
+MemoryDB](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
+
+Once an MemoryDB user is created with the desired access, add an AWS resource
+tag `teleport.dev/managed` with the value `true` to this user:
+
+![Managed User Tag](../../../../../img/database-access/guides/redis/redis-aws-managed-user-tag.png)
+
+The Database Service will automatically discover this user if it is associated
+with a registered database. Keep in mind that it may take the Database Service
+some time (up to 20 minutes) to discover this user once the tag is added.
+
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/aws-redis-no-auth.mdx dbType="MemoryDB"!)
+
+## Step 6/6. Connect
+
+Once the Database Service has started and joined the cluster, log in to see the
+registered databases:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+```code
+$ tsh login --proxy=teleport.example.com --user=alice
+$ tsh db ls
+# Name        Description Labels
+# ----------- ----------- --------
+# my-memorydb             ...
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
+$ tsh db ls
+# Name        Description Labels
+# ----------- ----------- --------
+# my-memorydb             ...
+```
+
+</TabItem>
+
+</Tabs>
+
+To retrieve credentials for a database and connect to it:
+
+```code
+$ tsh db connect --db-user=my-database-user my-memorydb
+```
+
+(!docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx!)
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance.
+$ tsh db logout my-memorydb
+# Remove credentials for all database instances.
+$ tsh db logout
+```
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
+
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-opensearch.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-opensearch.mdx
similarity index 90%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-opensearch.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/aws-opensearch.mdx
index 54afd5e0efd52..b5e6062363074 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/aws-opensearch.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws-opensearch.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Amazon OpenSearch
+sidebar_label: OpenSearch
 description: How to access Amazon OpenSearch with Teleport database access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon OpenSearch" dbConfigure="via REST API with IAM Authentication"!)
@@ -17,10 +23,10 @@ requests with AWS credentials, and forwards them to the OpenSearch API.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![OpenSearch Self-Hosted](../../../../img/database-access/guides/aws-opensearch/opensearch_selfhosted.png)
+![OpenSearch Self-Hosted](../../../../../img/database-access/guides/aws-opensearch/opensearch_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![OpenSearch Cloud](../../../../img/database-access/guides/aws-opensearch/opensearch_cloud.png)
+![OpenSearch Cloud](../../../../../img/database-access/guides/aws-opensearch/opensearch_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -48,6 +54,13 @@ and uses an EC2 instance to serve the Teleport Database Service. The level of
 access provided may not suit your needs, or may not fit your organization's
 access conventions. You should adjust the AWS IAM permissions to fit your needs.
 
+<Admonition type="tip" title="Dashboard in private network">
+To access the OpenSearch Dashboard deployed within private VPC subnets using
+Teleport, you can enroll the Dashboard as a [Web
+application](../../../application-access/protect-apps/connecting-apps.mdx)
+in Teleport.
+</Admonition>
+
 ## Step 1/4. Create IAM roles for OpenSearch Managed Cluster access
 
 The setup described in this guide requires two IAM roles:
@@ -62,7 +75,7 @@ Visit the [IAM > Roles page](https://console.aws.amazon.com/iamv2/home#/roles) o
 the AWS Console, then press "Create Role". Under **Trusted entity type** select
 "AWS service". Under **Use case** select "EC2", then click **Next**.
 
-![Create Role to Identify EC2 Instance](../../../../img/database-access/guides/aws-opensearch/create-ec2-role.png)
+![Create Role to Identify EC2 Instance](../../../../../img/database-access/guides/aws-opensearch/create-ec2-role.png)
 
 On the "Add Permissions" page, you can simply click **Next** since this role
 does not require any permissions. In this guide, we will use the example name
@@ -75,7 +88,7 @@ Navigate back to the Roles page and create a new role. Select the "AWS account"
 option, which creates a default trust policy to allow other entities in this
 account to assume this role:
 
-![Create Role Step 1](../../../../img/database-access/guides/aws-opensearch/create-role-1.png)
+![Create Role Step 1](../../../../../img/database-access/guides/aws-opensearch/create-role-1.png)
 
 Click **Next**. On the next page, enter a role name. In this guide we'll use
 the example name `ExampleTeleportOpenSearchRole` for this role.
@@ -112,18 +125,18 @@ where the IAM role or user is mapped to the OpenSearch role.
 In order to configure Role Mapping log into OpenSearch Domain Dashboard using
 the master user and go to the `Security` settings:
 
-![Select Get Started](../../../../img/database-access/guides/aws-opensearch/01-opensearch_get_started.png)
+![Select Get Started](../../../../../img/database-access/guides/aws-opensearch/01-opensearch_get_started.png)
 
 Create a new role with least privilege permissions, or select an existing one.
 For the purpose of this example the `readall` OpenSearch role will be used.
 Select the OpenSearch role and go to the `Mapped users` tab:
 
-![Mapped User](../../../../img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png)
+![Mapped User](../../../../../img/database-access/guides/aws-opensearch/02-opensearch_mapped_users.png)
 
 Add mapping between the OpenSearch role and AWS IAM `ExampleTeleportOpenSearchRole`
 role created in the previous step.
 
-![IAM Role mapping](../../../../img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png)
+![IAM Role mapping](../../../../../img/database-access/guides/aws-opensearch/03-opensearch_iam_role_mapping.png)
 
 Finally, click the **Map** button to apply the settings.
 
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/aws.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/aws.mdx
new file mode 100644
index 0000000000000..de1ad878ebe3d
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/aws.mdx
@@ -0,0 +1,39 @@
+---
+title: Enroll AWS Databases
+sidebar_label: AWS
+description: "Provides instructions on protecting databases in your AWS-managed infrastructure with Teleport."
+tags:
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+The guides in this section show you how to protect AWS-managed databases with
+Teleport.
+
+You can configure Teleport to discover databases in your AWS account and enroll
+them with your cluster automatically. Read more about setting up
+[Database Auto-Discovery](../../../auto-discovery/databases/databases.mdx).
+
+It is also possible to protect databases across your AWS accounts. Read the
+instructions in [AWS Cross-Account Database
+Access](aws-cross-account.mdx).
+
+Read the following guides for how to protect a specific AWS-managed database
+with Teleport:
+
+- [Amazon DocumentDB](aws-docdb.mdx)
+- [Amazon DynamoDB](aws-dynamodb.mdx)
+- [Amazon ElastiCache for Redis and Valkey](redis-aws.mdx)
+- [Amazon ElastiCache Serverless for Redis and Valkey](elasticache-serverless.mdx)
+- [Amazon MemoryDB](aws-memorydb.mdx)
+- [Amazon Keyspaces (Apache Cassandra)](aws-cassandra-keyspaces.mdx)
+- [Amazon OpenSearch](aws-opensearch.mdx)
+- [Amazon RDS Oracle](rds/rds-oracle.mdx)
+- [Amazon RDS Proxy MySQL](rds-proxy/rds-proxy-mysql.mdx)
+- [Amazon RDS Proxy for Microsoft SQL Server](rds-proxy/rds-proxy-sqlserver.mdx)
+- [Amazon RDS Proxy for PostgreSQL](rds-proxy/rds-proxy-postgres.mdx)
+- [Amazon RDS and Aurora](rds/mysql-postgres-mariadb.mdx)
+- [Amazon RDS for SQL Server](rds/sql-server-ad.mdx)
+- [Amazon Redshift Serverless](redshift-serverless.mdx)
+- [Amazon Redshift](postgres-redshift.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/elasticache-serverless.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/elasticache-serverless.mdx
new file mode 100644
index 0000000000000..e9aad78f9bfae
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/elasticache-serverless.mdx
@@ -0,0 +1,208 @@
+---
+title: Database Access with Amazon ElastiCache Serverless for Redis and Valkey
+sidebar_label: ElastiCache Serverless
+description: How to configure Teleport database access with Amazon ElastiCache Serverless for Redis and Valkey.
+tags:
+ - how-to
+ - zero-trust
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon ElastiCache Serverless" dbConfigure="with IAM authentication"!)
+
+## How it works
+
+The Teleport Database Service connects on user behalf using IAM authentication and proxies traffic from users to Amazon ElastiCache Serverless.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+![Enroll ElastiCache Serverless with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/elasticache_serverless_selfhosted.png)
+</TabItem>
+<TabItem scope={["cloud","team"]} label="Teleport Cloud">
+![Enroll ElastiCache Serverless with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/elasticache_serverless_cloud.png)
+</TabItem>
+
+</Tabs>
+
+(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon Elasticache Serverless cache" providerType="AWS"!)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with an ElastiCache Serverless for Redis or Valkey cache.
+- Permissions to create and attach IAM policies.
+- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.
+- A host, e.g., an EC2 instance, where you will run the Teleport Database
+  Service.
+- (!docs/pages/includes/database-access/aws-auto-discovery-prerequisite.mdx!)
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/6. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 2/6. Create a Database Service configuration
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+(!docs/pages/includes/install-linux.mdx!)
+
+Create the Database Service configuration:
+```code
+$ ELASTICACHE_SERVERLESS_URI=""
+$ sudo teleport db configure create \
+   -o file \
+   --name="elasticache-serverless" \
+   --proxy=example.teleport.sh:443 \
+   --protocol="redis" \
+   --uri=${ELASTICACHE_SERVERLESS_URI?} \
+   --token=/tmp/token
+```
+
+Change `example.teleport.sh:443` to the host and port of your Teleport Proxy
+Service. Set `ELASTICACHE_SERVERLESS_URI` to the domain name and port of your ElastiCache
+database.
+
+The command will generate a Database Service configuration and place it at the
+`/etc/teleport.yaml` location.
+
+## Step 3/6. Create an IAM role for Teleport
+
+(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="ElastiCache Serverless caches" !)
+
+### Create an IAM role for Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Grant permissions
+
+(!docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx!)
+
+## Step 4/6. Start the Database Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
+
+## Step 5/6. Configure authentication for ElastiCache users
+
+Configure authentication for your ElastiCache Serverless database.
+
+To enable ACL, please see [Authenticating users with Role-Based Access
+Control for
+ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html).
+
+<Admonition type="warning">
+ElastiCache Serverless Redis OSS will automatically create a default user with no password.
+We strongly recommend that you take steps to disable the default user.
+The automatically created default user cannot be modified or deleted and you cannot remove the default user name from an ElastiCache Redis OSS user group.
+To disable the default user:
+1. create a new user with the user name "default" and a unique (i.e., not "default") user ID.
+2. *replace* the default user in your ElastiCache user group with the new default user.
+
+We recommend setting a strong password on your customized default user (IAM authentication is not possible for the default user) and using an access string that is not permissive.
+For example, the access string `off -@all` will disable logins and deny all Redis privileges to the default user.
+
+See [Applying RBAC](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html#rbac-using) for more information.
+</Admonition>
+
+Some additional limitations apply when using IAM authentication - for more
+information, see:
+[ElastiCache Auth IAM Limits](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html#auth-iam-limits).
+
+There are a few requirements for configuring an ElastiCache IAM-enabled user:
+- the user must have identical username and user id properties.
+- the user must have authentication mode set to "IAM".
+- the user must be attached to an ElastiCache user group.
+
+Create an ElastiCache IAM-enabled user.
+The following example creates an ElastiCache user with the access string
+`on ~* +@all` that represents an active user with access to all available keys
+and commands:
+```code
+$ aws elasticache create-user \
+  --user-name iam-user-01 \
+  --user-id iam-user-01 \
+  --authentication-mode Type=iam \
+  --engine redis \
+  --access-string "on ~* +@all"
+```
+
+<Admonition type="note" title="Access Strings">
+You may prefer a less permissive access string for your ElastiCache users.
+For more information about ElastiCache access strings, please see:
+[ElastiCache Cluster RBAC Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Access-string).
+</Admonition>
+
+Create an ElastiCache user group and attach it to your ElastiCache Serverless cache:
+```code
+$ aws elasticache create-user-group \
+  --user-group-id iam-user-group-01 \
+  --engine redis \
+  --user-ids default iam-user-01
+$ aws elasticache modify-serverless-cache \
+    --serverless-cache-name serverless-cache-1 \
+    --user-group-id "iam-user-group-01"
+```
+
+Once the ElastiCache user has been created, verify that the user is configured
+to satisfy the requirements for IAM authentication:
+
+![ElastiCache IAM-enabled User](../../../../../img/database-access/guides/redis/redis-aws-iam-user@2x.png)
+
+(!docs/pages/includes/database-access/aws-redis-no-auth.mdx dbType="ElastiCache Serverless"!)
+
+## Step 6/6. Connect
+
+Once the Database Service has started and joined the cluster, log in to see the
+registered databases:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+```code
+$ tsh login --proxy=teleport.example.com --user=alice
+$ tsh db ls
+Name                Description Allowed Users Labels
+------------------- ----------- ------------- -----------------------
+my-serverless-cache             [*]           account_id=123456789012
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
+$ tsh db ls
+Name                Description Allowed Users Labels
+------------------- ----------- ------------- -----------------------
+my-serverless-cache             [*]           account_id=123456789012
+```
+
+</TabItem>
+
+</Tabs>
+
+To retrieve credentials for a database and connect to it:
+
+```code
+$ tsh db connect --db-user=my-database-user my-serverless-cache
+```
+
+(!docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx!)
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance.
+$ tsh db logout my-serverless-cache
+# Remove credentials for all database instances.
+$ tsh db logout
+```
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/postgres-redshift.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/postgres-redshift.mdx
new file mode 100644
index 0000000000000..4af888b101b6a
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/postgres-redshift.mdx
@@ -0,0 +1,208 @@
+---
+title: Database Access with Amazon Redshift
+sidebar_label: Redshift
+description: How to configure Teleport database access with Amazon Redshift.
+videoBanner: UFhT52d5bYg
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon Redshift" dbConfigure="with IAM authentication"!)
+
+## How it works
+
+(!docs/pages/includes/database-access/how-it-works/iam.mdx db="Amazon Redshift" cloud="AWS"!)
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+![Enroll Redshift with a self-hosted Teleport cluster](../../../../../img/database-access/guides/redshift_selfhosted.png)
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+![Enroll Redshift with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/redshift_cloud.png)
+</TabItem>
+
+</Tabs>
+
+(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon Redshift cluster" providerType="AWS"!)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with a Redshift cluster and permissions to create and attach IAM
+  policies.
+- Command-line client `psql` installed and added to your system's `PATH` environment variable.
+- A host, e.g., an EC2 instance, where you will run the Teleport Database
+  Service.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/5. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 2/5. Create a Database Service configuration
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+(!docs/pages/includes/install-linux.mdx!)
+
+On the node that is running the Database Service, create a configuration file.
+Assign `CLUSTER_URI` to the domain name and port of the cluster:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ sudo teleport db configure create \
+   -o file \
+   --name="redshift-postgres" \
+   --proxy=teleport.example.com:443 \
+   --protocol=postgres \
+   --token=/tmp/token \
+   --uri=${CLUSTER_URI?}
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ sudo teleport db configure create \
+   -o file \
+   --name="redshift-postgres" \
+   --proxy=mytenant.teleport.sh:443 \
+   --protocol=postgres \
+   --token=/tmp/token \
+   --uri=${CLUSTER_URI?}
+```
+
+</TabItem>
+
+</Tabs>
+
+The command will generate a Database Service configuration to proxy your AWS
+Redshift cluster place it at the `/etc/teleport.yaml` location.
+
+## Step 3/5. Configure IAM permissions for the Database Service
+
+(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="Redshift databases" !)
+
+### Create an IAM role for Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Grant permissions
+
+Attach the following AWS IAM permissions to the Database Service IAM role:
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift/access-policy.mdx dbUserRole="redshift-user-role" !)
+
+## Step 4/5. Start the Database Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
+
+The Database Service will proxy the Amazon Redshift cluster with the ID you
+specified earlier. Keep in mind that AWS IAM changes may not propagate
+immediately and can take a few minutes to come into effect.
+
+## Step 5/5. Connect
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+Once the Database Service has started and joined the cluster, log in to see the
+registered databases. Replace `--proxy` with the address of your Teleport Proxy
+Service.
+
+```code
+$ tsh login --proxy=teleport.example.com --user=alice
+$ tsh db ls
+# Name        Description                    Labels
+# ----------- ------------------------------ --------
+# my-redshift                                ...
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+Once the Database Service has started and joined the cluster, log in to see the
+registered databases. Replace `--proxy` with the address of your Teleport Cloud
+tenant.
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
+$ tsh db ls
+# Name        Description                    Labels
+# ----------- ------------------------------ --------
+# my-redshift                                ...
+```
+
+</TabItem>
+
+</Tabs>
+
+To retrieve credentials for a database and connect to it:
+
+```code
+$ tsh db connect --db-user=alice --db-name=dev my-redshift
+```
+
+<Admonition type="note" title="Database users must exist">
+  Teleport does not currently use the auto-create option when generating
+  tokens for Redshift databases. Users must exist in the database.
+</Admonition>
+
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
+
+To log out of the database and remove credentials:
+
+```code
+$ tsh db logout my-redshift
+```
+
+## Authenticate Redshift with as an IAM role
+
+Amazon Redshift supports two methods of IAM-based authentication, and Teleport
+is compatible with both.
+
+**First method: Authenticate as a Database User (Default)**
+
+In this method, the Teleport Database Service generates a temporary IAM
+authentication token for an existing database user in Redshift. This user must
+already exist in the Redshift database. Teleport uses this method by default.
+
+**Second method: Authenticate as an IAM Role**
+
+In this alternative method, the Teleport Database Service assumes an AWS IAM
+role to authenticate to Redshift. Redshift maps the IAM role to a database user
+and automatically creates that user if it doesn't already exist. If you use this
+method, you must first create an AWS IAM role that grants access to the Redshift
+database.
+
+If you use this method, you must first create an AWS IAM role that grants access
+to the Redshift database.
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx dbUserRole="redshift-user-role"!)
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
+
+(!docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx!)
+
+(!docs/pages/includes/database-access/pg-cancel-request-limitation.mdx PIDQuery="SELECT pid,starttime,duration,trim(user_name) AS user,trim(query) AS query FROM stv_recents WHERE status = 'Running';"!)
+
+(!docs/pages/includes/database-access/psql-ssl-syscall-error.mdx!)
+
+## Next steps
+
+- Learn more about [using IAM authentication to generate database user
+  credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for Amazon Redshift.
+- Learn how to [restrict access](../../rbac.mdx) to certain users and databases.
+- View the [High Availability (HA)](../../guides/ha.mdx) guide.
+- Take a look at the YAML configuration [reference](../../reference/configuration.mdx).
+
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-mysql.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-mysql.mdx
new file mode 100644
index 0000000000000..6dc2c2f7df71c
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-mysql.mdx
@@ -0,0 +1,14 @@
+---
+title: Database Access with Amazon RDS Proxy for MariaDB/MySQL
+sidebar_label: MariaDB/MySQL
+description: How to configure Teleport database access with Amazon RDS Proxy for MariaDB/MySQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for MariaDB or MySQL" dbConfigure="with IAM authentication"!)
+
+(!docs/pages/includes/database-access/rds-proxy.mdx protocol="mysql" !)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres.mdx
new file mode 100644
index 0000000000000..51f8d2dc56be2
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres.mdx
@@ -0,0 +1,14 @@
+---
+title: Database Access with Amazon RDS Proxy for PostgreSQL
+sidebar_label: PostgreSQL
+description: How to configure Teleport database access with Amazon RDS Proxy for PostgreSQL
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for PostgreSQL" dbConfigure="with IAM authentication"!)
+
+(!docs/pages/includes/database-access/rds-proxy.mdx protocol="postgres"!)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver.mdx
new file mode 100644
index 0000000000000..36d4779ee193a
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver.mdx
@@ -0,0 +1,14 @@
+---
+title: Database Access with Amazon RDS Proxy for SQL Server
+sidebar_label: SQL Server
+description: How to configure Teleport database access with Amazon RDS Proxy for SQL Server
+tags:
+ - how-to
+ - zero-trust
+ - aws
+ - infrastructure-identity
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS proxy for Microsoft SQL Server" dbConfigure="with IAM authentication"!)
+
+(!docs/pages/includes/database-access/rds-proxy.mdx protocol="sqlserver" !)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy.mdx
new file mode 100644
index 0000000000000..f7c82b2f4e2ef
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy.mdx
@@ -0,0 +1,11 @@
+---
+title: Protecting Amazon RDS Proxy
+sidebar_label: RDS Proxy
+description: Provides guidance on enrolling Amazon RDS Proxy databases with Teleport.
+---
+
+The guides in this section show you how to enroll Amazon RDS Proxy databases
+with Teleport. For RDS databases, see [Protecting Amazon RDS
+Databases](../rds/rds.mdx):
+
+<DocCardList kind="labelOnly"/>
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx
new file mode 100644
index 0000000000000..800c19948a1a1
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx
@@ -0,0 +1,335 @@
+---
+title: Database Access with Amazon RDS and Aurora for PostgreSQL/MySQL/MariaDB
+sidebar_label: PostgreSQL/MySQL/MariaDB
+description: How to configure Teleport database access with Amazon RDS and Aurora for PostgreSQL, MySQL and MariaDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS or Aurora" dbConfigure="with IAM authentication"!)
+
+## How it works
+
+(!docs/pages/includes/database-access/how-it-works/iam.mdx db="RDS" cloud="AWS"!)
+
+<Tabs>
+<TabItem label="Self-Hosted">
+![Teleport Architecture RDS Self-Hosted](../../../../../../img/database-access/guides/rds_selfhosted.png)
+</TabItem>
+<TabItem label="Cloud-Hosted">
+![Teleport Architecture RDS Cloud-Hosted](../../../../../../img/database-access/guides/rds_cloud.png)
+</TabItem>
+
+</Tabs>
+
+<Admonition type="note" title="Supported versions">
+
+The following products are not compatible with Teleport as they don't support
+IAM authentication:
+
+    - Aurora Serverless v1.
+    - RDS MariaDB versions lower than 10.6.
+
+We recommend upgrading Aurora Serverless v1 to [Aurora Serverless
+v2](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.html),
+which supports IAM authentication.
+
+</Admonition>
+
+(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="RDS" providerType="AWS" !)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with RDS and Aurora databases and permissions to create and attach
+  IAM policies.
+  <Admonition type="warning" title="IAM authentication">
+  Your RDS and Aurora databases must have password and IAM authentication
+  enabled.
+
+  If IAM authentication is not enabled on the target RDS and Aurora databases,
+  the Database Service will attempt to enable IAM authentication by modifying
+  them using respective APIs.
+  </Admonition>
+- A Linux host or Amazon Elastic Kubernetes Service cluster where you will run
+  the Teleport Database Service, which proxies connections to your RDS
+  databases. 
+- (!docs/pages/includes/tctl.mdx!)
+
+If you plan to run the Teleport Database Service on Kubernetes, you will need
+the following:
+
+ - The `aws` CLI in your PATH. Install it by following the [AWS
+   documentation](https://aws.amazon.com/cli/).
+
+ - An IAM OIDC provider running in your Kubernetes cluster. See the [AWS
+   documentation](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
+   for how to create an IAM OIDC provider.
+
+   To check whether you have an IAM OIDC provider running in your cluster, run
+   the following `aws` command, assigning <Var name="eks-region" /> to the
+   region where your EKS cluster is running and <Var name="cluster-name" /> to
+   the name of your Kubernetes cluster:
+
+   ```code
+   $ aws --region=<Var name="eks-region" /> eks describe-cluster --name <Var name="cluster-name"/> --query "cluster.identity.oidc.issuer" --output text
+   ```
+
+   If you have an IAM OIDC provider associated with your cluster, this command
+   will print its ID.
+
+ - The [`jq` CLI tool](https://jqlang.github.io/jq/), which we use to process
+   JSON data in this guide.
+
+## Step 1/6. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 2/6. Create a Database Service configuration
+
+In this section, you will configure the Teleport Database Service. To do so, you
+will:
+
+- Create a join token for the service to demonstrate trust with your Teleport
+  cluster.
+- Set up your package manager so you can install and run the Database Service.
+- Generate a configuration for the Database Service.
+
+### Create a join token
+
+Establish trust between the Teleport Database Service and your Teleport cluster
+by creating a join token.
+
+Generate a join token by running the following command on your workstation: 
+
+```code
+$ tctl tokens add --type=db
+```
+
+The next step depends on how you plan to run the Teleport Database Service:
+
+<Tabs>
+<TabItem label="Linux Server">
+
+Save the token in a file called `/tmp/token` on the host that will run the
+Database Service.
+
+</TabItem>
+<TabItem label="Kubernetes Cluster">
+
+Later in this guide, you will use this join token when configuring the Teleport
+Database Service.
+
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+### Prepare your environment
+
+Next, get your environment ready to run the Teleport Database Service:
+
+<Tabs>
+<TabItem label="Linux Host">
+
+(!docs/pages/includes/install-linux.mdx!)
+
+Provide the following information and then generate a configuration file for the
+Teleport Database Service:
+- <Var name="example.teleport.sh:443" /> The host **and port** of your Teleport
+Proxy Service or cloud-hosted Teleport Enterprise site
+- <Var name="protocol" /> The protocol of the database you want to proxy, either
+`mysql` or `postgres`
+- <Var name="endpoint:port" /> The endpoint **and port** of the database - the
+cluster endpoint for Aurora or the instance endpoint for an RDS instance, e.g.
+`myrds.us-east-1.rds.amazonaws.com:5432`
+
+```code
+$ sudo teleport db configure create \
+   -o file \
+   --name=rds-example \
+   --proxy=<Var name="example.teleport.sh:443" />  \
+   --protocol=<Var name="protocol" /> \
+   --uri=<Var name="endpoint:port" /> \
+   --labels=env=dev \
+   --token=/tmp/token
+```
+
+The command will generate a Teleport Database Service configuration file and
+place it at the `/etc/teleport.yaml` location.
+
+</TabItem>
+<TabItem label="Kubernetes Cluster">
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+</TabItem>
+</Tabs>
+
+## Step 3/6. Create IAM policies for Teleport
+
+(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="RDS instances and Aurora clusters" !)
+
+### Create an IAM role for Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Grant permissions
+
+Attach the following AWS IAM permissions to the Database Service IAM role:
+
+(!docs/pages/includes/database-access/reference/aws-iam/rds/access-policy.mdx!)
+
+## Step 4/6. Start the Database Service
+
+Start the Teleport Database Service in your environment:
+
+<Tabs>
+<TabItem label="Linux Host">
+
+(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
+
+</TabItem>
+<TabItem label="Kubernetes Cluster">
+
+Retrieve the join token you created earlier in this guide by running the
+following command and copying a token with the `Db` type:
+
+```code
+$ tctl tokens ls
+Token                            Type Labels Expiry Time (UTC)
+-------------------------------- ---- ------ ----------------------------
+(=presets.tokens.first=) Db          14 Jun 23 21:21 UTC (20m15s)
+```
+
+Create a Helm values file called `values.yaml`, assigning <Var name="token" />
+to the value of the join token you retrieved above, <Var
+name="example.teleport.sh:443" /> to the host **and port** of your Teleport
+Proxy Service, and <Var name="endpoint:port" /> to the host **and port** of your
+RDS database (e.g., `myrds.us-east-1.rds.amazonaws.com:5432`). Assign <Var
+name="aws-account" /> to your AWS account ID. Set `enterprise` to false if you
+are using Teleport Community Edition:
+
+```yaml
+authToken: <Var name="token" />
+proxyAddr: <Var name="example.teleport.sh:443" />
+roles: db
+enterprise: true
+databases:
+- name: example
+  uri: "<Var name="endpoint:port" />"
+  protocol: <Var name="protocol" />
+  static_labels:
+    env: dev
+annotations:
+  serviceAccount:
+    eks.amazonaws.com/role-arn: arn:aws:iam::<Var name="aws-account" />:role/teleport-rds-role
+```
+
+Get the version of Teleport to install. If you have automatic agent updates enabled in your cluster, query the latest Teleport version that is compatible with the updater:
+
+```code
+$ TELEPORT_VERSION="$(curl https://<Var name="example.teleport.sh:443" />/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
+```
+
+Otherwise, get the version of your Teleport cluster:
+
+```code
+$ TELEPORT_VERSION="$(curl https://<Var name="example.teleport.sh:443" />/v1/webapi/ping | jq -r '.server_version')"
+```
+
+
+Install the Helm chart for Teleport Agent services, `teleport-kube-agent`:
+
+```code
+$ helm -n teleport-agent install teleport-kube-agent teleport/teleport-kube-agent \
+  --values values.yaml --create-namespace --version $TELEPORT_VERSION
+```
+
+Make sure that the Teleport Agent pod is running. You should see one
+`teleport-kube-agent` pod with a single ready container:
+
+```code
+$ kubectl -n teleport-agent get pods
+NAME                    READY   STATUS    RESTARTS   AGE
+teleport-kube-agent-0   1/1     Running   0          32s
+```
+
+</TabItem>
+</Tabs>
+
+## Step 5/6. Create a database IAM user
+
+Database users must allow IAM authentication in order to be used with Database
+Access for RDS. See below how to enable it for the user `alice` on your database
+engine. In the next step, we will authenticate to the database as the `alice`
+user via the user's Teleport account.
+
+<Tabs>
+  <TabItem label="PostgreSQL">
+  PostgreSQL users must have a `rds_iam` role:
+
+  ```sql
+  CREATE USER alice;
+  GRANT rds_iam TO alice;
+  ```
+  </TabItem>
+  <TabItem label="MySQL/MariaDB">
+  MySQL and MariaDB users must have the RDS authentication plugin enabled:
+
+  ```sql
+  CREATE USER alice IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
+  ```
+
+  Created user may not have access to anything by default so let's grant it
+  some permissions:
+
+  ```sql
+  GRANT ALL ON `%`.* TO 'alice'@'%';
+  ```
+  </TabItem>
+</Tabs>
+
+See [Creating a database account using IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html)
+for more information.
+
+## Step 6/6. Connect
+
+Once the Database Service has started and joined the cluster, log in as the
+`alice` user you created earlier to see the registered databases:
+
+```code
+$ tsh login --proxy=<Var name="example.teleport.sh:443" /> --user=alice
+$ tsh db ls
+# Name        Description Labels
+# ----------- ----------- --------
+# rds-example             env=dev
+```
+
+(!docs/pages/includes/database-access/pg-mysql-connect.mdx dbUser="alice" dbService="rds-example"!)
+
+Log out of the database and remove credentials:
+
+```code
+$ tsh db logout rds-example
+```
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
+
+(!docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx!)
+
+(!docs/pages/includes/database-access/pg-cancel-request-limitation.mdx!)
+
+(!docs/pages/includes/database-access/psql-ssl-syscall-error.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
+- Set up [automatic database user provisioning](../../../auto-user-provisioning/auto-user-provisioning.mdx).
+
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-oracle.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds-oracle.mdx
similarity index 83%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-oracle.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds-oracle.mdx
index 6bcdb8591d00e..c04d9732927dd 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/rds-oracle.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds-oracle.mdx
@@ -1,6 +1,12 @@
 ---
-title: Database Access with AWS RDS Oracle with Kerberos Authentication
-description: How to configure Teleport Database Access with AWS RDS Oracle with Kerberos authentication.
+title: Database Access with Amazon RDS Oracle with Kerberos Authentication
+sidebar_label: Oracle
+description: How to enroll Amazon RDS Oracle in your Teleport cluster with Kerberos authentication.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon RDS for Oracle" dbConfigure="with Kerberos authentication"!)
@@ -16,7 +22,7 @@ Database Service forwards user traffic to the database.
 
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v17.4.0 or higher)"!)
 
 - An Amazon RDS for Oracle database instance.
 - An AWS Directory Service Managed Microsoft AD.
@@ -29,8 +35,8 @@ Database Service forwards user traffic to the database.
 
 Before configuring Teleport, ensure your Oracle RDS instance has Kerberos authentication and TLS properly configured:
 
-1. Follow the [AWS RDS Oracle Kerberos Setup guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.html) to enable Kerberos authentication on your instance.
-2. Enable TLS on your Oracle RDS instance by following the [AWS RDS Oracle SSL Setup documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html). Ensure `SQLNET.SSL_VERSION` is set to `1.2` for optimal security. Make note of the SSL port choice; in the rest of the guide we will assume it is 2484. Also ensure `SQLNET.CIPHER_SUITE` parameter includes a supported value, for example `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.
+1. Follow the [Amazon RDS Oracle Kerberos Setup guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.html) to enable Kerberos authentication on your instance.
+2. Enable TLS on your Oracle RDS instance by following the [Amazon RDS Oracle SSL Setup documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html). Ensure `SQLNET.SSL_VERSION` is set to `1.2` for optimal security. Make note of the SSL port choice; in the rest of the guide we will assume it is 2484. Also ensure `SQLNET.CIPHER_SUITE` parameter includes a supported value, for example `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.
 
 <Admonition type="note">
   Verify connectivity between your Teleport Database Service host and the Oracle RDS instance before proceeding.
@@ -216,7 +222,7 @@ be merged into the same `teleport.keytab` file.
 
   To check if the user has any SPNs assigned, go to the user's page in AWS Console and locate the "Account settings - optional" section.
 
-  ![AWS AD Set SPN](../../../../img/database-access/guides/aws_ad_set_spn.png)
+  ![AWS AD Set SPN](../../../../../../img/database-access/guides/aws_ad_set_spn.png)
 
   Alternatively, run the following command on the
   Windows machine joined to your Active Directory domain:
@@ -385,7 +391,7 @@ Other clients can use:
   - a custom JDBC connection string: 'jdbc:oracle:thin:@tcps://localhost:12345/ORCL?TNS_ADMIN=/home/alice/.tsh/keys/teleport.example.com/alice-db/teleport.example.com/oracle-wallet'
 ```
 
-This method also enables use of various graphical clients, as explained in [Oracle graphical clients](../../../connect-your-client/gui-clients.mdx#oracle-graphical-clients) section.
+This method also enables use of various graphical clients, as explained in [Oracle graphical clients](../../../../../connect-your-client/third-party/gui-clients.mdx#oracle-graphical-clients) section.
 
 ## Next steps
 
@@ -393,24 +399,7 @@ This method also enables use of various graphical clients, as explained in [Orac
 
 ## Troubleshooting
 
-### Connection hangs or is refused
-
-The Teleport Database Service needs connectivity to your database endpoints. That may require enabling inbound traffic on the database from the Database Service on the same VPC or routing rules from another VPC. Verify the connection using `SQLcl` or another database client.
-
-```code
-$ sql -L test/test@oracle-instance.aabbccddeegg.eu-central-1.rds.amazonaws.com:2484
-```
-
-### Teleport can reach RDS Oracle instance, but TLS negotiation fails (handshake failure)
-
-Ensure that `SQLNET.SSL_VERSION` parameter enables `TLS 1.2` version. TLS 1.0 is rejected by Teleport due to known weaknesses. See [AWS RDS Oracle SSL Setup documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html) for more information.
-
-Teleport also rejects the following weak cipher suites:
-- `SSL_RSA_WITH_AES_256_CBC_SHA`
-- `SSL_RSA_WITH_AES_256_CBC_SHA256`
-- `SSL_RSA_WITH_AES_256_GCM_SHA384`
-
-Ensure that `SQLNET.CIPHER_SUITE` parameter contains at least one supported cipher suite. We recommend using `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` cipher suite. Note that this parameter can contain multiple suites separated by a comma, so the compatible cipher suite can always be appended to the list.
+(!docs/pages/includes/database-access/oracle-troubleshooting.mdx!)
 
 ### Username not recognized
 
@@ -423,8 +412,8 @@ Installation-specific configuration variations may lead to different values, how
 
 ## Further reading
 
-- [AWS RDS Oracle Kerberos Setup](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.html).
-- [AWS RDS Oracle SSL Setup](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html).
-- [AWS RDS Oracle auditing](https://aws.amazon.com/blogs/database/part-1-security-auditing-in-amazon-rds-for-oracle/).
+- [Amazon RDS Oracle Kerberos Setup](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.html).
+- [Amazon RDS Oracle SSL Setup](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html).
+- [Amazon RDS Oracle auditing](https://aws.amazon.com/blogs/database/part-1-security-auditing-in-amazon-rds-for-oracle/).
 - [Manually join a Linux instance](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html) in the AWS documentation.
 - [Introduction to `adutil`](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-ad-auth-adutil-introduction) in the Microsoft documentation.
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds.mdx
new file mode 100644
index 0000000000000..3100eab047c53
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/rds.mdx
@@ -0,0 +1,11 @@
+---
+title: Protecting Amazon RDS and Aurora Databases
+sidebar_label: RDS and Aurora
+description: Guides for protecting Amazon RDS databases with Teleport
+---
+
+The guides in this section show you how to protect Amazon RDS and Aurora
+databases with Teleport. For RDS Proxy databases, see [Protecting Amazon RDS
+Proxy Databases](../rds-proxy/rds-proxy.mdx):
+
+<DocCardList kind="labelOnly"/>
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/sql-server-ad.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/sql-server-ad.mdx
similarity index 95%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/sql-server-ad.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/rds/sql-server-ad.mdx
index 402a6cbdbf84b..b90897eca1248 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/sql-server-ad.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/rds/sql-server-ad.mdx
@@ -1,7 +1,13 @@
 ---
-title: Database Access with Microsoft SQL Server with Active Directory authentication
-description: How to configure Teleport database access with Microsoft SQL Server with Active Directory authentication.
+title: Database Access with Amazon RDS for Microsoft SQL Server with Active Directory Authentication
+sidebar_label: SQL Server
+description: How to configure Teleport database access with RDS for SQL Server with Active Directory authentication.
 videoBanner: k2wz79XCexY
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Microsoft SQL Server" dbConfigure="with Active Directory authentication"!)
@@ -20,10 +26,10 @@ Database Service forwards user traffic to the database.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Database access with SQL Server and AD authentication](../../../../img/database-access/sql-server-ad-1.png)
+![Database access with SQL Server and AD authentication](../../../../../../img/database-access/sql-server-ad-1.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Database access with SQL Server and AD authentication](../../../../img/database-access/sql-server-ad-2.png)
+![Database access with SQL Server and AD authentication](../../../../../../img/database-access/sql-server-ad-2.png)
 </TabItem>
 </Tabs>
 
@@ -248,7 +254,7 @@ endpoint.
     --ad-spn=MSSQLSvc/sqlserver.example.com:1433 \
     --labels=env=dev
   ```
-  
+
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
 
@@ -287,7 +293,7 @@ Provide Active Directory parameters:
 You can use `ldapsearch` command to see the SPNs registered for your SQL
 Server. Typically, they take a form of `MSSQLSvc/<name>.<ad-domain>:<port>`.
 
-For example, an AWS RDS SQL Server named `sqlserver` and joined to an AWS managed
+For example, an Amazon RDS SQL Server named `sqlserver` and joined to an AWS managed
 Active Directory domain `EXAMPLE.COM` will have the following SPNs registered:
 
 ```code
@@ -305,7 +311,7 @@ Alternatively, you can look SPNs up in the Attribute Editor of the Active Direct
 Users and Computers dialog on your AD-joined Windows machine. The RDS SQL Server
 object typically resides under the AWS Reserved / RDS path:
 
-![SPN](../../../../img/database-access/guides/sqlserver/spn@2x.png)
+![SPN](../../../../../../img/database-access/guides/sqlserver/spn@2x.png)
 
 <Admonition type="tip">
   If you don't see Attribute Editor tab, make sure that "View > Advanced Features"
@@ -402,7 +408,7 @@ following:
 +   tls:
 +     # Point it to your Database CA PEM certificate.
 +     ca_cert_file: "rdsca.pem"
-+     # If your database certificate has an empty CN filed, you must change
++     # If your database certificate has an empty CN field, you must change
 +     # the TLS mode to only verify the CA.
 +     mode: verify-ca
 ```
@@ -419,4 +425,3 @@ skipping TLS verification in production environments.
 
 - [Manually join a Linux instance](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html) in the AWS documentation.
 - [Introduction to `adutil`](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-ad-auth-adutil-introduction) in the Microsoft documentation.
-
diff --git a/docs/pages/enroll-resources/database-access/enrollment/aws/redis-aws.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/redis-aws.mdx
new file mode 100644
index 0000000000000..dbfd0a121a7a4
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/redis-aws.mdx
@@ -0,0 +1,230 @@
+---
+title: Database Access with Amazon ElastiCache for Redis and Valkey
+sidebar_label: ElastiCache
+description: How to configure Teleport database access with Amazon ElastiCache for Redis and Valkey.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon ElastiCache" dbConfigure="with IAM authentication"!)
+
+## How it works
+
+(!docs/pages/includes/database-access/aws-redis-how-it-works.mdx dbType="Amazon ElastiCache"!)
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+![Enroll ElastiCache with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/redis_elasticache_selfhosted.png)
+</TabItem>
+<TabItem scope={["cloud","team"]} label="Teleport Cloud">
+![Enroll ElastiCache with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/redis_elasticache_cloud.png)
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="Amazon Elasticache cluster" providerType="AWS"!)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- AWS account with an ElastiCache for Redis or Valkey cluster.
+  **In-transit encryption via (TLS) must be enabled**.
+- Permissions to create and attach IAM policies.
+- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.
+- A host, e.g., an EC2 instance, where you will run the Teleport Database
+  Service.
+- [ACL](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html) enabled for your
+  ElastiCache cluster.
+- (!docs/pages/includes/database-access/aws-auto-discovery-prerequisite.mdx!)
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/6. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 2/6. Create a Database Service configuration
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+(!docs/pages/includes/install-linux.mdx!)
+
+Create the Database Service configuration:
+```code
+$ ELASTICACHE_URI=""
+$ sudo teleport db configure create \
+   -o file \
+   --name="elasticache" \
+   --proxy=example.teleport.sh:443 \
+   --protocol="redis" \
+   --uri=${ELASTICACHE_URI?} \
+   --token=/tmp/token
+```
+
+Change `example.teleport.sh:443` to the host and port of your Teleport Proxy
+Service. Set `ELASTICACHE_URI` to the domain name and port of your ElastiCache
+database.
+
+The command will generate a Database Service configuration and place it at the
+`/etc/teleport.yaml` location.
+
+## Step 3/6. Create an IAM role for Teleport
+
+(!docs/pages/includes/database-access/create-iam-role-step-description.mdx accessFor="ElastiCache databases" !)
+
+### Create an IAM role for Teleport
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Grant permissions
+
+(!docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx!)
+
+## Step 4/6. Start the Database Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)
+
+## Step 5/6. Configure authentication for ElastiCache users
+
+Configure authentication for your ElastiCache database. The steps to follow
+depend on whether you want to enable the Teleport Database Service to use IAM
+authentication with ElastiCache, or authentication based on managing passwords
+via AWS Secrets Manager:
+
+<Tabs>
+<TabItem label="ElastiCache IAM user">
+
+To enable ACL, please see [Authenticating users with Role-Based Access
+Control for
+ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html).
+
+Some additional limitations apply when using IAM authentication - for more
+information, see:
+[ElastiCache Auth IAM Limits](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html#auth-iam-limits).
+
+There are a few requirements for configuring an ElastiCache IAM-enabled user:
+- the user must have identical username and user id properties.
+- the user must have authentication mode set to "IAM".
+- the user must be attached to an ElastiCache user group.
+
+Create an ElastiCache IAM-enabled user.
+The following example creates an ElastiCache user with the access string
+`on ~* +@all` that represents an active user with access to all available keys
+and commands:
+```code
+$ aws elasticache create-user \
+  --user-name iam-user-01 \
+  --user-id iam-user-01 \
+  --authentication-mode Type=iam \
+  --engine redis \
+  --access-string "on ~* +@all"
+```
+
+<Admonition type="note" title="Access Strings">
+You may prefer a less permissive access string for your ElastiCache users.
+For more information about ElastiCache access strings, please see:
+[ElastiCache Cluster RBAC Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Access-string).
+</Admonition>
+
+Create an ElastiCache user group and attach it to your ElastiCache replication
+group:
+```code
+$ aws elasticache create-user-group \
+  --user-group-id iam-user-group-01 \
+  --engine redis \
+  --user-ids default iam-user-01
+$ aws elasticache modify-replication-group \
+  --replication-group-id replication-group-01 \
+  --user-group-ids-to-add iam-user-group-01
+```
+
+Once the ElastiCache user has been created, verify that the user is configured
+to satisfy the requirements for IAM authentication:
+
+![ElastiCache IAM-enabled User](../../../../../img/database-access/guides/redis/redis-aws-iam-user@2x.png)
+
+</TabItem>
+
+<TabItem label="Teleport-managed user">
+
+To enable ACL, please see [Authenticating users with Role-Based Access
+Control for
+ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html).
+
+Once an ElastiCache user is created with the desired access, add an AWS resource
+tag `teleport.dev/managed` with the value `true` to this user:
+
+![Managed User Tag](../../../../../img/database-access/guides/redis/redis-aws-managed-user-tag.png)
+
+The Database Service will automatically discover this user if it is associated
+with a registered database. Keep in mind that it may take the Database Service
+some time (up to 20 minutes) to discover this user once the tag is added.
+
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/aws-redis-no-auth.mdx dbType="ElastiCache"!)
+
+## Step 6/6. Connect
+
+Once the Database Service has started and joined the cluster, log in to see the
+registered databases:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+```code
+$ tsh login --proxy=teleport.example.com --user=alice
+$ tsh db ls
+# Name                        Description Labels
+# --------------------------- ----------- --------
+# my-cluster-mode-elasticache             ...
+# my-elasticache                          ...
+# my-elasticache-reader                   ...
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
+$ tsh db ls
+# Name                        Description Labels
+# --------------------------- ----------- --------
+# my-cluster-mode-elasticache             ...
+# my-elasticache                          ...
+# my-elasticache-reader                   ...
+```
+
+</TabItem>
+
+</Tabs>
+
+To retrieve credentials for a database and connect to it:
+
+```code
+$ tsh db connect --db-user=my-database-user my-elasticache
+```
+
+(!docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx!)
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance.
+$ tsh db logout my-elasticache
+# Remove credentials for all database instances.
+$ tsh db logout
+```
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
+
diff --git a/docs/pages/enroll-resources/database-access/enroll-aws-databases/redshift-serverless.mdx b/docs/pages/enroll-resources/database-access/enrollment/aws/redshift-serverless.mdx
similarity index 92%
rename from docs/pages/enroll-resources/database-access/enroll-aws-databases/redshift-serverless.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/aws/redshift-serverless.mdx
index 9e76bc6703b07..1f13068bab298 100644
--- a/docs/pages/enroll-resources/database-access/enroll-aws-databases/redshift-serverless.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/aws/redshift-serverless.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Amazon Redshift Serverless
+sidebar_label: Redshift Serverless
 description: How to configure Teleport database access with Amazon Redshift Serverless.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - aws
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Amazon Redshift Serverless" dbConfigure="with IAM authentication"!)
@@ -16,10 +22,10 @@ This guide will help you to:
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Redshift with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/redshift_selfhosted_serverless.png)
+![Enroll Redshift with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/redshift_selfhosted_serverless.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Redshift with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/redshift_cloud_serverless.png)
+![Enroll Redshift with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/redshift_cloud_serverless.png)
 </TabItem>
 
 </Tabs>
@@ -203,9 +209,9 @@ Service or cloud tenant:
 ```code
 $ tsh login --proxy=mytenant.teleport.sh --user=alice
 $ tsh db ls
-Name        Description                    Labels
------------ ------------------------------ --------
-my-redshift                                ...
+Name        Description Labels
+----------- ----------- ------
+my-redshift             ...
 ```
 
 To connect to the Redshift Serverless instance:
@@ -221,7 +227,7 @@ Type "help" for help.
 dev=>
 ```
 
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
 
 To log out of the database and remove credentials:
 
@@ -259,7 +265,7 @@ prior to logging in as this new IAM role to avoid or resolve user permission iss
 
 - Learn more about [using IAM authentication to generate database user
   credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for Amazon Redshift.
-- Learn how to [restrict access](../rbac.mdx) to certain users and databases.
-- View the [High Availability (HA)](../guides/ha.mdx) guide.
-- Take a look at the YAML configuration [reference](../../../reference/agent-services/database-access-reference/configuration.mdx).
+- Learn how to [restrict access](../../rbac.mdx) to certain users and databases.
+- View the [High Availability (HA)](../../guides/ha.mdx) guide.
+- Take a look at the YAML configuration [reference](../../reference/configuration.mdx).
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-postgres-mysql.mdx
similarity index 87%
rename from docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/azure/azure-postgres-mysql.mdx
index 427a3712fc406..c80d19e1e69d3 100644
--- a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-postgres-mysql.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Azure PostgreSQL and MySQL
+sidebar_label: PostgreSQL/MySQL
 description: How to configure Teleport database access with Azure Database for PostgreSQL and MySQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Azure PostgreSQL or MySQL" dbConfigure="with Microsoft Entra ID-based authentication"!)
@@ -18,10 +24,10 @@ database.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enrolling Azure PostgreSQL/MySQL with a self-hosted Teleport cluster](../../../../img/database-access/guides/azure_selfhosted.png)
+![Enrolling Azure PostgreSQL/MySQL with a self-hosted Teleport cluster](../../../../../img/database-access/guides/azure_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enrolling Azure PostgreSQL/MySQL with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/azure_cloud.png)
+![Enrolling Azure PostgreSQL/MySQL with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/azure_cloud.png)
 </TabItem>
 </Tabs>
 
@@ -30,7 +36,7 @@ database.
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - Deployed Azure Database for PostgreSQL or MySQL server.
-- Azure Active Directory administrative privileges.
+- Microsoft Entra ID administrative privileges.
 - A host, e.g., an Azure VM instance, where you will run the Teleport Database
   Service.
 - (!docs/pages/includes/tctl.mdx!)
@@ -39,7 +45,7 @@ database.
 ## Step 1/5. Configure Azure service principal
 
 To authenticate with PostgreSQL or MySQL databases, Teleport Database Service
-needs to obtain access tokens from Azure AD.
+needs to obtain access tokens from Microsoft Entra ID.
 
 (!docs/pages/includes/database-access/azure-configure-service-principal.mdx!)
 
@@ -94,11 +100,11 @@ more information.
 Go to the [Subscriptions](https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBlade) page and select a subscription.
 
 Click on *Access control (IAM)* in the subscription and select *Add > Add custom role*:
-![IAM custom role](../../../../img/azure/add-custom-role@2x.png)
+![IAM custom role](../../../../../img/azure/add-custom-role@2x.png)
 
 In the custom role creation page, click the *JSON* tab and click *Edit*, then paste the JSON example
 and replace the subscription in "assignableScopes" with your own subscription id:
-![Create JSON role](../../../../img/database-access/guides/azure/create-role-from-json@2x.png)
+![Create JSON role](../../../../../img/database-access/guides/azure/create-role-from-json@2x.png)
 
 ### Create a role assignment for the Teleport Database Service principal
 
@@ -107,42 +113,42 @@ and replace the subscription in "assignableScopes" with your own subscription id
 ## Step 3/5. Create Azure database users
 
 To let Teleport connect to your Azure database authenticating as a service
-principal, you need to create Azure AD users authenticated by that principal in the database.
+principal, you need to create Entra ID users authenticated by that principal in the database.
 
-### Assign Azure AD administrator
+### Assign Entra ID administrator
 
-Only the Azure AD administrator for the database can connect to it and create
-Azure AD users.
+Only the Entra ID administrator for the database can connect to it and create
+Entra ID users.
 
 <Tabs>
 <TabItem label="MySQL Flexible">
 Go to your database's **Authentication** page and set the AD
 admin using the edit button:
 
-![Set AD admin](../../../../img/database-access/guides/azure/set-ad-admin.png)
+![Set AD admin](../../../../../img/database-access/guides/azure/set-ad-admin.png)
 
 </TabItem>
 <TabItem label="PostgreSQL Flexible">
 Go to your database's **Authentication** page and set the AD
-admin by selecting **+ Add Azure AD Admins**:
+admin by selecting **+ Add Entra ID Admins**:
 
-![Set AD admin](../../../../img/database-access/guides/azure/set-ad-admin-postgres.png)
+![Set AD admin](../../../../../img/database-access/guides/azure/set-ad-admin-postgres.png)
 
 </TabItem>
 <TabItem label="Single server">
 Go to your database's *Active Directory admin* page
 and set the AD admin using the *Set admin* button:
 
-![Set AD admin](../../../../img/database-access/guides/azure/set-ad-admin@2x.png)
+![Set AD admin](../../../../../img/database-access/guides/azure/set-ad-admin@2x.png)
 
 </TabItem>
 </Tabs>
 
-<Admonition type="note" title="Azure AD Admin">
-Only one Azure user (or group) can be set as an Azure AD admin for the database.
-If the Azure AD admin is removed from the server, all Azure AD logins will be disabled for the server.
-Adding a new Azure AD admin from the same tenant will re-enable Azure AD logins.
-Refer to [Use Azure Active Directory for authenticating with PostgreSQL](https://docs.microsoft.com/en-us/azure/postgresql/single-server/concepts-azure-ad-authentication)
+<Admonition type="note" title="Entra ID Admin">
+Only one Azure user (or group) can be set as an Entra ID admin for the database.
+If the Entra ID admin is removed from the server, all Entra ID logins will be disabled for the server.
+Adding a new Entra ID admin from the same tenant will re-enable Entra ID logins.
+Refer to [Use Microsoft Entra ID for authenticating with PostgreSQL](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/security-entra-concepts)
 for more information.
 </Admonition>
 
@@ -407,31 +413,7 @@ $ tsh db ls
 
 </Tabs>
 
-To retrieve credentials for a database and connect to it:
-
-<Tabs>
-<TabItem label="MySQL">
-
-```code
-$ tsh db connect --db-user=teleport azure-db
-```
-
-</TabItem>
-<TabItem label="PostgreSQL">
-
-```code
-$ tsh db connect --db-user=teleport --db-name=postgres azure-db
-```
-
-</TabItem>
-</Tabs>
-
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
-
-<Admonition type="note">
-The appropriate database command-line client (`psql`, `mysql`) should be
-available in the `PATH` of the machine you're running `tsh db connect` from.
-</Admonition>
+(!docs/pages/includes/database-access/pg-mysql-connect.mdx dbUser="teleport" dbService="azure-db"!)
 
 To log out of the database and remove credentials:
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-redis.mdx b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-redis.mdx
similarity index 93%
rename from docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-redis.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/azure/azure-redis.mdx
index f6c93bc18edf2..899380b6b04ee 100644
--- a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-redis.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-redis.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Azure Cache for Redis
+sidebar_label: Azure Cache for Redis
 description: How to configure Teleport database access with Azure Cache for Redis
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Azure Cache for Redis" dbConfigure="with Microsoft Entra ID-based authentication"!)
@@ -9,16 +15,16 @@ description: How to configure Teleport database access with Azure Cache for Redi
 
 The Teleport Database Service proxies traffic between Teleport users and Azure
 Cache for Redis. When a user connects to the database via Teleport, the Database
-Service obtains an access token from Microsoft Entra ID (formerly Azure AD) and
-authenticates to Azure as a principal with permissions to manage the database.
+Service obtains an access token from Microsoft Entra ID and authenticates to
+Azure as a principal with permissions to manage the database.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Azure Cache for Redis with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/azure/redis-self-hosted.png)
+![Enroll Azure Cache for Redis with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/azure/redis-self-hosted.png)
 </TabItem>
 
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Azure Cache for Redis with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/azure/redis-cloud.png)
+![Enroll Azure Cache for Redis with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/azure/redis-cloud.png)
 </TabItem>
 
 </Tabs>
@@ -139,11 +145,11 @@ you want to further limit the `assignableScopes`, you can use a resource group
 Now go to the [Subscriptions](https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBlade) page and select a subscription.
 
 Click on *Access control (IAM)* in the subscription and select *Add > Add custom role*:
-![IAM custom role](../../../../img/azure/add-custom-role@2x.png)
+![IAM custom role](../../../../../img/azure/add-custom-role@2x.png)
 
 In the custom role creation page, click the *JSON* tab and click *Edit*, then paste the JSON example
 and replace the subscription in `assignableScopes` with your own subscription id:
-![Create JSON role](../../../../img/database-access/guides/azure/redis-create-role-from-json.png)
+![Create JSON role](../../../../../img/database-access/guides/azure/redis-create-role-from-json.png)
 
 ### Create a role assignment for the Teleport Database Service principal
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-sql-server-ad.mdx
similarity index 86%
rename from docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/azure/azure-sql-server-ad.mdx
index 4e5927768e31e..8850fda0786cf 100644
--- a/docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/azure/azure-sql-server-ad.mdx
@@ -1,6 +1,12 @@
 ---
-title: Database Access with SQL Server on Azure
+title: Database Access with Azure SQL Server
+sidebar_label: SQL Server
 description: How to configure Teleport database access with Azure SQL Server using Microsoft Entra authentication.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - azure
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Azure SQL Server" dbConfigure="with Microsoft Entra ID-based authentication"!)
@@ -8,18 +14,18 @@ description: How to configure Teleport database access with Azure SQL Server usi
 ## How it works
 
 The Teleport Database Service runs on an Azure virtual machine with an attached
-Azure identity with permissions to retrieve authentication tokens from
-Microsoft Entra ID. When a user connects to SQL Server with Teleport, the Teleport
-Database service authenticates with Azure AD, then uses an authentication token
-to connect to SQL Server. The Database Service then forwards user traffic to the
-database.
+Azure identity with permissions to retrieve authentication tokens from Microsoft
+Entra ID. When a user connects to SQL Server with Teleport, the Teleport
+Database service authenticates with Microsoft Entra ID, then uses an
+authentication token to connect to SQL Server. The Database Service then
+forwards user traffic to the database.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Access Azure SQL Server Microsoft Entra Self-Hosted](../../../../img/database-access/guides/sqlserver/sql-aad.png)
+![Access Azure SQL Server Microsoft Entra Self-Hosted](../../../../../img/database-access/guides/sqlserver/sql-aad.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Access Azure SQL Server Microsoft Entra Cloud](../../../../img/database-access/guides/sqlserver/cloud-sql-aad.png)
+![Access Azure SQL Server Microsoft Entra Cloud](../../../../../img/database-access/guides/sqlserver/cloud-sql-aad.png)
 </TabItem>
 
 </Tabs>
@@ -49,7 +55,7 @@ Select **Microsoft Entra ID** under "Settings" in the left-hand column.
 Select **Set Admin**, and choose an account that will be added as an admin
 login to SQL Server.
 
-![Azure SQL Server Microsoft Entra admin page](../../../../img/database-access/guides/sqlserver/azure-set-ad-admin.png)
+![Azure SQL Server Microsoft Entra admin page](../../../../../img/database-access/guides/sqlserver/azure-set-ad-admin.png)
 
 ## Step 3/8. Configure IAM permissions for Teleport
 
@@ -104,13 +110,13 @@ page and select a subscription.
 Click on **Access control (IAM)** in the subscription and select **Add** >
 **Add custom role**:
 
-![IAM custom role](../../../../img/azure/add-custom-role@2x.png)
+![IAM custom role](../../../../../img/azure/add-custom-role@2x.png)
 
 In the custom role creation page, click the **JSON** tab and click **Edit**,
 then paste the JSON example and replace the subscription in `assignableScopes`
 with your own subscription id:
 
-![Create JSON role](../../../../img/database-access/guides/sqlserver/create-role-from-json.png)
+![Create JSON role](../../../../../img/database-access/guides/sqlserver/create-role-from-json.png)
 
 ## Step 4/8. Configure virtual machine identities
 
@@ -118,7 +124,7 @@ In the Teleport Database Service virtual machine's **Identity**
 section, enable the system assigned identity. This is used by Teleport to access
 Azure APIs.
 
-![System assigned identity page](../../../../img/database-access/guides/sqlserver/system-managed-identity.png)
+![System assigned identity page](../../../../../img/database-access/guides/sqlserver/system-managed-identity.png)
 
 To grant Teleport permissions, the custom role you created must be assigned to
 the virtual machine system assigned identity. On the same page, click on the **Azure
@@ -134,8 +140,8 @@ for more information about Azure scopes and creating role assignments.
 
 ### Login identities
 
-The Teleport Database Service needs access tokens from Azure AD to authenticate with
-SQL Server databases.
+The Teleport Database Service needs access tokens from Microsoft Entra ID to
+authenticate with SQL Server databases.
 
 It uses the managed identities attached to its Virtual Machine to fetch the
 authentication token.
@@ -144,19 +150,19 @@ To create a new user-assigned managed identity, go to the **Managed Identities**
 page in your [Azure Portal](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.ManagedIdentity%2FuserAssignedIdentities)
 and click on *Create*. Choose a name and resource group for it and create:
 
-![Azure Create user managed identity page](../../../../img/database-access/guides/sqlserver/azure-user-managed-identity.png)
+![Azure Create user managed identity page](../../../../../img/database-access/guides/sqlserver/azure-user-managed-identity.png)
 
 Next, go to the **Teleport Database Service virtual machine instance**,
 **Identity** section, select **User assigned**, and add the identity we just
 created:
 
-![Azure Virtual machine user managed identities page](../../../../img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png)
+![Azure Virtual machine user managed identities page](../../../../../img/database-access/guides/sqlserver/azure-attach-managed-identity-vm.png)
 
 ## Step 5/8. Enable managed identities login on SQL Server
 
-Azure AD SQL Server integration uses database-level authentication (contained
-users), meaning we must create a user for our identities on each database we
-want to access.
+The Microsoft Entra ID SQL Server integration uses database-level authentication
+(contained users), meaning we must create a user for our identities on each
+database we want to access.
 
 To create contained users for the identities, connect to your SQL server using
 its Activity Directory Admin and execute the query:
diff --git a/docs/pages/enroll-resources/database-access/enrollment/azure/azure.mdx b/docs/pages/enroll-resources/database-access/enrollment/azure/azure.mdx
new file mode 100644
index 0000000000000..2d7df2349ac5f
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/azure/azure.mdx
@@ -0,0 +1,16 @@
+---
+title: Enroll Azure Databases
+sidebar_label: Azure
+description: "Provides instructions on protecting databases in your Azure-managed infrastructure with Teleport."
+tags:
+ - zero-trust
+ - infrastructure-identity
+ - azure
+---
+
+You can protect Azure-managed databases with Teleport. Learn how to enroll the
+following databases:
+
+- [Azure SQL Server](azure-sql-server-ad.mdx)
+- [Azure Database for PostgreSQL or MySQL Server](azure-postgres-mysql.mdx)
+- [Azure Redis](azure-redis.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/enrollment.mdx b/docs/pages/enroll-resources/database-access/enrollment/enrollment.mdx
new file mode 100644
index 0000000000000..93f69c0c131db
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/enrollment.mdx
@@ -0,0 +1,13 @@
+---
+title: Database Enrollment Guides
+sidebar_label: Enrollment Guides
+sidebar_position: 2
+description: Provides instructions on enrolling databases with your Teleport cluster for secure access, authentication, authorization, and audit.
+---
+
+The guides in this section show you how to enroll your database with Teleport
+for secure access, authentication, authorization, and audit.
+
+Teleport supports the following kinds of databases:
+
+<DocCardList kind="labelOnly" />
diff --git a/docs/pages/enroll-resources/database-access/enrollment/google-cloud/alloydb.mdx b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/alloydb.mdx
new file mode 100644
index 0000000000000..4f9b51410d2de
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/alloydb.mdx
@@ -0,0 +1,417 @@
+---
+title: Database Access with AlloyDB
+sidebar_label: AlloyDB
+description: How to configure Teleport database access with AlloyDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="AlloyDB" dbConfigure="with a service account"!)
+
+## How it works
+
+(!docs/pages/includes/database-access/how-it-works/iam.mdx db="AlloyDB" cloud="Google Cloud"!)
+
+![Teleport Architecture for AlloyDB Access](../../../../../img/database-access/guides/alloydb/architecture.png)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- Google Cloud account with an AlloyDB cluster and instance deployed. Ensure that your instance is configured to use [IAM database authentication](https://cloud.google.com/alloydb/docs/database-users/manage-iam-auth).
+- Command-line client `psql` installed and added to your system's `PATH` environment variable.
+- A host, e.g., a Compute Engine instance, where you will run the Teleport Database Service.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/5: Configure GCP IAM 
+### IAM setup: roles for the database user and database service
+
+To grant Teleport access to your AlloyDB instances, you need to create two service accounts:
+- `teleport-db-service`: for the Teleport Database Service to access AlloyDB metadata.
+- `alloydb-user`: for end-users to authenticate to the database.
+
+### Create a service account for the Teleport Database Service
+
+A GCP service account will be used by the Teleport Database Service to create
+ephemeral access tokens for *other* GCP service accounts when it's acting on the
+behalf of authorized Teleport users.
+
+Go to the [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)
+page and create a service account:
+
+![Create System Service Account](../../../../../img/database-access/guides/alloydb/create-system-service-account.png)
+
+The Teleport Database Service needs permissions to call Google Cloud APIs to fetch
+database connection information and generate client certificates.
+
+Assign the predefined
+[`roles/alloydb.client` (Cloud AlloyDB Client)](https://cloud.google.com/alloydb/docs/reference/iam-roles-permissions)
+role to the `teleport-db-service` service account. This role grants the
+necessary permissions.
+
+![Grant permissions to user Service Account](../../../../../img/database-access/guides/alloydb/system-service-account-permissions.png)
+
+### Create a service account for a database user
+
+<Admonition type="note">
+  If you already have a standard GCP service account for database access, you can use it instead of creating a new one. Ensure it has the required permissions listed below.
+</Admonition>
+
+Teleport uses service accounts to connect to AlloyDB databases.
+
+Go to the IAM & Admin [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)
+page and create a new service account named `alloydb-user`:
+
+![Create User Service Account](../../../../../img/database-access/guides/alloydb/create-user-service-account.png)
+
+Click "Create and continue".
+
+Assign the following [predefined roles](https://cloud.google.com/alloydb/docs/reference/iam-roles-permissions) to the `alloydb-user` service account:
+
+* Cloud AlloyDB Database User (`roles/alloydb.databaseUser`)
+* Cloud AlloyDB Client (`roles/alloydb.client`)
+* [Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`)](https://cloud.google.com/service-usage/docs/access-control#serviceusage.serviceUsageConsumer)
+
+![Grant permissions to user Service Account](../../../../../img/database-access/guides/alloydb/user-service-account-permissions.png)
+
+### Grant access to the service account
+
+The Teleport Database Service must be able to impersonate this service account.
+Navigate to the `alloydb-user` service account overview page and select the
+"Principals with Access" tab:
+
+![Select Principals with Access Tab](../../../../../img/database-access/guides/alloydb/user-service-account-principals-with-access.png)
+
+Click "Grant Access" and add the `teleport-db-service` principal ID.
+Select the "Service Account Token Creator" role and save the change:
+
+![Grant Service Account Token Creator to Database Service](../../../../../img/database-access/guides/alloydb/user-service-account-grant-access.png)
+
+
+## Step 2/5: Database configuration
+
+<details>
+  <summary>Enabling IAM Authentication</summary>
+
+Teleport uses [IAM database authentication](https://cloud.google.com/alloydb/docs/database-users/manage-iam-auth)
+with AlloyDB instances.
+
+Ensure that your instance is configured to use IAM authentication. Navigate to your instance settings and check 
+the presence of the `alloydb.iam_authentication` flag under Advanced Configuration Options section.
+
+![Enable IAM Authentication](../../../../../img/database-access/guides/alloydb/flag-iam-authentication-on.png)
+</details>
+
+### Create a database user
+
+<Admonition type="note">
+  If your AlloyDB instance already has an IAM user configured for your designated service account, you can skip this step.
+</Admonition>
+
+Go to the Users page of your AlloyDB instance and add a new user
+account. In the sidebar, choose "Cloud IAM" authentication type and add the
+`alloydb-user` service account that you created earlier.
+
+![Add AlloyDB User Account](../../../../../img/database-access/guides/alloydb/add-user-account.png)
+
+Press "Add" and your Users table should look similar to this:
+
+![AlloyDB User Accounts Table](../../../../../img/database-access/guides/alloydb/user-account-added.png)
+
+## Step 3/5: Create a host for the Database Service
+
+<Admonition type="note">
+  If you already have a host running the Teleport Database Service, you can skip this step. Just ensure that the host is configured with the `teleport-db-service` service account's credentials, either by attaching the service account (for GCE) or through workload identity.
+</Admonition>
+
+Create a Google Compute Engine (GCE) instance where you will run the Teleport Database Service.
+
+When creating the instance, in the "Security" section, attach the `teleport-db-service` service account you created earlier. This allows the Teleport Database Service to authenticate with Google Cloud APIs.
+
+<details>
+  <summary>Attaching a service account to an existing GCE instance</summary>
+<Tabs>
+<TabItem label="Google Cloud Console">
+
+If you have an existing GCE instance, you can attach the service account through the Google Cloud Console.
+
+1. Navigate to the [VM instances](https://console.cloud.google.com/compute/instances) page and open your instance.
+2. Stop the instance. Wait for it to fully stop.
+3. Edit the instance details. 
+4. Find the **Service account** dropdown in the **Identity and API access** section.
+5. Select the `teleport-db-service` service account. 
+6. Save the changes and restart the instance.
+
+</TabItem>
+<TabItem label="gcloud CLI">
+
+If you have an existing GCE instance, you can attach the service account using the `gcloud` command-line tool.
+
+Set the variables: 
+- <Var name="instance-name" /> instance name
+- <Var name="zone" /> instance zone
+- <Var name="project-id" /> GCP project ID
+
+
+First, stop the instance:
+```code
+$ gcloud compute instances stop <Var name="instance-name" /> --zone=<Var name="zone" />
+```
+
+Then, set the service account:
+```code
+$ gcloud compute instances set-service-account <Var name="instance-name" />                 \
+    --service-account=teleport-db-service@<Var name="project-id" />.iam.gserviceaccount.com \
+    --zone=<Var name="zone" />
+```
+
+Restart the instance:
+```code
+$ gcloud compute instances start <Var name="instance-name" /> --zone=<Var name="zone" />
+```
+
+Verify the instance is now running with the specified service account:
+```code
+$ gcloud compute instances describe <Var name="instance-name" /> --zone=<Var name="zone" /> \
+   --format="yaml(status,serviceAccounts)"
+```
+
+</TabItem>
+</Tabs>
+</details>
+
+If you are running the Teleport Database Service on a different host, you will need to provide credentials to the service. We recommend using [workload identity](https://cloud.google.com/iam/docs/workload-identity-federation).
+
+<details>
+  <summary>Using service account keys (insecure)</summary>
+
+Alternatively, go to that service account's Keys tab and create a new key.
+
+Make sure to choose JSON format.
+
+Save the file. Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to
+point to the JSON credentials file you downloaded earlier. For example, if you
+use `systemd` to start `teleport`, then you should edit the service's
+`EnvironmentFile` to include the env var:
+```code
+$ echo 'GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json' | sudo tee -a /etc/default/teleport
+```
+
+<Admonition type="warning">
+A service account key can be a security risk - we only describe using a key in
+this guide for simplicity.
+We do not recommend using service account keys in production.
+See [authentication](https://cloud.google.com/docs/authentication#service-accounts)
+in the Google Cloud documentation for more information about service account
+authentication methods.
+</Admonition>
+</details>
+
+## Step 4/5: Configure Teleport
+### Install the Teleport Database Service
+
+(!docs/pages/includes/install-linux.mdx!)
+
+### Create a join token
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+### Configure and start the Database Service
+
+In the command below, replace `<Var name="teleport.example.com:443" />` with the
+host and port of your Teleport Proxy Service or Enterprise Cloud site, and
+replace `<Var name="connection-uri" />` with your AlloyDB connection URI.
+
+The connection URI has the format `projects/PROJECT/locations/REGION/clusters/CLUSTER/instances/INSTANCE`.
+You can copy it from the AlloyDB instance details page in the Google Cloud
+console.
+
+![AlloyDB Connection URI](../../../../../img/database-access/guides/alloydb/connection-uri.png)
+
+Run the command as follows. Make sure to include the mandatory `alloydb://` prefix in the specified URI.
+
+```code
+$ sudo teleport db configure create \
+   -o file \
+   --name=alloydb \
+   --protocol=postgres \
+   --labels=env=dev \
+   --token=/tmp/token \
+   --proxy=<Var name="teleport.example.com:443" />  \
+   --uri=alloydb://<Var name="connection-uri" />
+```
+
+This command will generate a Teleport Database Service configuration file and
+save it to `/etc/teleport.yaml`.
+
+<Admonition type="tip" title="Choose how Teleport connects to AlloyDB">
+By default, Teleport uses [_private_](https://cloud.google.com/alloydb/docs/about-private-services-access) AlloyDB endpoint. To change this to either [public](https://cloud.google.com/alloydb/docs/connect-public-ip) or [PSC](https://cloud.google.com/alloydb/docs/about-private-service-connect) endpoints, update the `endpoint_type` field:
+
+```yaml
+db_service:
+  resources:
+    - name: alloydb
+      protocol: postgres
+      uri: alloydb://projects/PROJECT/locations/REGION/clusters/CLUSTER/instances/INSTANCE
+      gcp:
+        alloydb:
+          # one of: private | public | psc (default: private)
+          endpoint_type: private
+      static_labels:
+        env: dev
+```
+</Admonition>
+
+<details>
+<summary>Dynamic resource</summary>
+
+As an alternative to configuring the database in `teleport.yaml`, you can create a dynamic database resource. This allows you to add or update databases without restarting the Database Service.
+
+Create a file named `alloydb.yaml` with the following content:
+
+```yaml
+kind: db
+version: v3
+metadata:
+  name: alloydb-dynamic
+  labels:
+    env: dev
+spec:
+  protocol: "postgres"
+  uri: "alloydb://<Var name="connection-uri" />"
+  gcp:
+    alloydb:
+      # one of: private | public | psc (default: private)
+      endpoint_type: private
+```
+
+Replace `<Var name="connection-uri" />` with your AlloyDB connection URI.
+
+Create the resource:
+
+```code
+$ tctl create -f alloydb.yaml
+```
+
+</details>
+
+Finally, start the Teleport Database Service:
+
+(!docs/pages/includes/start-teleport.mdx service="the Teleport Database Service"!)
+
+## Step 5/5: Connect to your database
+### Grant access to the database
+
+<Admonition type="note">
+  The following commands create a new Teleport user and role. If you have an existing Teleport user and a role that grants access to resources with the `env: dev` label, you can skip these steps.
+</Admonition>
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+### Connect
+
+Once the Database Service has joined the cluster, log in to see the available
+databases:
+
+```code
+$ tsh login --proxy=teleport.example.com --user=alice
+$ tsh db ls
+# Name    Description Labels
+# ------- ----------- -------
+# alloydb GCP AlloyDB env=dev
+```
+
+<Admonition
+  type="note"
+>
+You will only be able to see databases that your Teleport role has
+access to. See our [RBAC](../../rbac.mdx) guide for more details.
+</Admonition>
+
+When connecting to the database, use the name of the database's service account
+that you added as an IAM database user earlier,
+minus the `.gserviceaccount.com` suffix. The database user name is shown on
+the Users page of your AlloyDB instance.
+
+In the command below, replace `<Var name="project-id" />` with your Google Cloud
+project ID. Retrieve credentials for the `alloydb` example database and connect
+to it:
+
+```code
+$ tsh db connect --db-user=alloydb-user@<Var name="project-id"/>.iam --db-name=postgres alloydb
+```
+
+<Admonition type="tip" title="Tip">
+  Starting from version `17.1`, you can now [access your PostgreSQL databases using the Web UI.](../../../../connect-your-client/teleport-clients/web-ui.mdx#starting-a-database-session)
+</Admonition>
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance:
+$ tsh db logout alloydb
+# Or remove credentials for all databases:
+$ tsh db logout
+```
+
+## Optional: least-privilege access
+
+When possible, enforce least-privilege by defining custom IAM roles that grant only the required permissions.
+
+### Custom role for the Teleport Database Service
+
+The Teleport Database Service, running as the `teleport-db-service` service account, needs permissions to access the AlloyDB instance.
+
+Create a custom role with the following permissions:
+
+```ini
+# Used to generate client certificate
+alloydb.clusters.generateClientCertificate
+# Used to fetch connection information
+alloydb.instances.connect
+```
+
+For impersonating the `alloydb-user` service account, the built-in "Service Account Token Creator" IAM role
+is broader than necessary. To restrict permissions for that service account, create a custom role 
+that includes only:
+
+```ini
+iam.serviceAccounts.getAccessToken
+```
+
+### Custom role for the database user
+
+The `alloydb-user` service account used for database access requires permissions to connect 
+to the instance and authenticate as a database user. Create a custom role with:
+
+```ini
+alloydb.instances.connect
+alloydb.users.login
+serviceusage.services.use
+```
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/gcp-troubleshooting.mdx!)
+
+(!docs/pages/includes/database-access/pg-cancel-request-limitation.mdx!)
+
+(!docs/pages/includes/database-access/psql-ssl-syscall-error.mdx!)
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
+
+{/* lint ignore list-item-spacing remark-lint */}
+- Learn more about [managing IAM authentication](https://cloud.google.com/alloydb/docs/database-users/manage-iam-auth) for AlloyDB.
+
+{/* lint ignore list-item-spacing remark-lint */}
+- Learn more about [authenticating as a service
+  account](https://cloud.google.com/docs/authentication#service-accounts) in
+  Google Cloud.
+
+{/* lint ignore list-item-spacing remark-lint */}
+- Learn more about AlloyDB [Auth Proxy](https://cloud.google.com/alloydb/docs/auth-proxy/connect#required-iam-permissions).
diff --git a/docs/pages/enroll-resources/database-access/enrollment/google-cloud/google-cloud.mdx b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/google-cloud.mdx
new file mode 100644
index 0000000000000..489ef18556aaa
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/google-cloud.mdx
@@ -0,0 +1,17 @@
+---
+title: Enroll Google Cloud Databases
+sidebar_label: Google Cloud
+description: "Provides instructions on protecting databases in your Google Cloud-managed infrastructure with Teleport."
+tags:
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
+---
+
+You can protect databases hosted on Google Cloud with Teleport. Read the
+following guides for instructions on enrolling a specific database:
+
+- [PostgreSQL on Google Cloud SQL](postgres-cloudsql.mdx)
+- [MySQL on Google Cloud SQL](mysql-cloudsql.mdx)
+- [Cloud Spanner](spanner.mdx)
+- [AlloyDB](alloydb.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/mysql-cloudsql.mdx b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/mysql-cloudsql.mdx
similarity index 94%
rename from docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/mysql-cloudsql.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/google-cloud/mysql-cloudsql.mdx
index ee6302d62f2a8..29ca7859d251d 100644
--- a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/mysql-cloudsql.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/mysql-cloudsql.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Cloud SQL for MySQL
+sidebar_label: MySQL
 description: How to configure Teleport database access with Cloud SQL for MySQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="MySQL on Google Cloud SQL" dbConfigure="with a service account"!)
@@ -11,10 +17,10 @@ description: How to configure Teleport database access with Cloud SQL for MySQL.
 
 <Tabs>
 <TabItem label="Self-Hosted">
-![Self-Hosted Teleport Architecture for Cloud SQL Access](../../../../img/database-access/guides/cloudsql_selfhosted.png)
+![Self-Hosted Teleport Architecture for Cloud SQL Access](../../../../../img/database-access/guides/cloudsql_selfhosted.png)
 </TabItem>
 <TabItem label="Cloud-Hosted">
-![Cloud-Hosted Teleport Architecture for Cloud SQL Access](../../../../img/database-access/guides/cloudsql_cloud.png)
+![Cloud-Hosted Teleport Architecture for Cloud SQL Access](../../../../../img/database-access/guides/cloudsql_cloud.png)
 </TabItem>
 </Tabs>
 
@@ -108,7 +114,7 @@ account. In the sidebar, choose "Cloud IAM" authentication type and add the
 "cloudsql-user" service account you created in
 [the second step](#step-29-create-a-service-account-for-a-database-user):
 
-![Add Cloud SQL User Account](../../../../img/database-access/guides/cloudsql/add-user-account-mysql@2x.png)
+![Add Cloud SQL User Account](../../../../../img/database-access/guides/cloudsql/add-user-account-mysql@2x.png)
 
 Press "Add". See [Creating and managing IAM
 users](https://cloud.google.com/sql/docs/mysql/add-manage-iam-users) in Google
@@ -179,7 +185,7 @@ $ tsh db ls
   type="note"
 >
 You will only be able to see databases that your Teleport role has
-access to. See our [RBAC](../rbac.mdx) guide for more details.
+access to. See our [RBAC](../../rbac.mdx) guide for more details.
 </Admonition>
 
 When connecting to the database, use either the database user name or the
@@ -195,6 +201,8 @@ $ tsh db connect --db-user=cloudsql-user --db-name=mysql cloudsql
 $ tsh db connect --db-user=cloudsql-user@<Var name="project-id"/>.iam.gserviceaccount.com --db-name=mysql cloudsql
 ```
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="MySQL"!)
+
 To log out of the database and remove credentials:
 
 ```code
diff --git a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/postgres-cloudsql.mdx b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/postgres-cloudsql.mdx
similarity index 90%
rename from docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/postgres-cloudsql.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/google-cloud/postgres-cloudsql.mdx
index 172ca2d2a6ee4..918fe46d6ede6 100644
--- a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/postgres-cloudsql.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/postgres-cloudsql.mdx
@@ -1,7 +1,13 @@
 ---
 title: Database Access with Cloud SQL for PostgreSQL 
+sidebar_label: PostgreSQL
 description: How to configure Teleport database access with Cloud SQL for PostgreSQL.
 videoBanner: br9LZ3ZXqCk
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="PostgreSQL on Google Cloud SQL" dbConfigure="with a service account"!)
@@ -12,10 +18,10 @@ videoBanner: br9LZ3ZXqCk
 
 <Tabs>
 <TabItem label="Self-Hosted">
-![Self-Hosted Teleport Architecture for Cloud SQL Access](../../../../img/database-access/guides/cloudsql_selfhosted.png)
+![Self-Hosted Teleport Architecture for Cloud SQL Access](../../../../../img/database-access/guides/cloudsql_selfhosted.png)
 </TabItem>
 <TabItem label="Cloud-Hosted">
-![Cloud-Hosted Teleport Architecture for Cloud SQL Access](../../../../img/database-access/guides/cloudsql_cloud.png)
+![Cloud-Hosted Teleport Architecture for Cloud SQL Access](../../../../../img/database-access/guides/cloudsql_cloud.png)
 </TabItem>
 </Tabs>
 
@@ -61,11 +67,11 @@ account. In the sidebar, choose "Cloud IAM" authentication type and add the
 "cloudsql-user" service account that you created in
 [the second step](#step-29-create-a-service-account-for-a-database-user):
 
-![Add Cloud SQL User Account](../../../../img/database-access/guides/cloudsql/add-user-account@2x.png)
+![Add Cloud SQL User Account](../../../../../img/database-access/guides/cloudsql/add-user-account@2x.png)
 
 Press "Add" and your Users table should look similar to this:
 
-![Cloud SQL User Accounts Table](../../../../img/database-access/guides/cloudsql/user-accounts@2x.png)
+![Cloud SQL User Accounts Table](../../../../../img/database-access/guides/cloudsql/user-accounts@2x.png)
 
 See [Creating and managing IAM users](https://cloud.google.com/sql/docs/postgres/create-manage-iam-users)
 in Google Cloud documentation for more info.
@@ -135,7 +141,7 @@ $ tsh db ls
   type="note"
 >
 You will only be able to see databases that your Teleport role has
-access to. See our [RBAC](../rbac.mdx) guide for more details.
+access to. See our [RBAC](../../rbac.mdx) guide for more details.
 </Admonition>
 
 When connecting to the database, use the name of the database's service account
@@ -150,7 +156,7 @@ assigning <Var name="project-id" /> to your Google Cloud project ID:
 $ tsh db connect --db-user=cloudsql-user@<Var name="project-id"/>.iam --db-name=postgres cloudsql
 ```
 
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
 
 To log out of the database and remove credentials:
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/spanner.mdx b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/spanner.mdx
similarity index 87%
rename from docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/spanner.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/google-cloud/spanner.mdx
index 81d222a0c52a3..8421cac87cac9 100644
--- a/docs/pages/enroll-resources/database-access/enroll-google-cloud-databases/spanner.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/google-cloud/spanner.mdx
@@ -1,6 +1,12 @@
 ---
 title: Database Access with Cloud Spanner
+sidebar_label: Spanner
 description: How to configure Teleport database access with GCP's Cloud Spanner.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+ - google-cloud
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Cloud Spanner" dbConfigure="with a service account"!)
@@ -12,11 +18,11 @@ description: How to configure Teleport database access with GCP's Cloud Spanner.
 <Tabs>
 
 <TabItem label="Self-Hosted">
-![Self-Hosted Teleport Architecture for Cloud Spanner Access](../../../../img/database-access/guides/spanner_selfhosted.png)
+![Self-Hosted Teleport Architecture for Cloud Spanner Access](../../../../../img/database-access/guides/spanner_selfhosted.png)
 </TabItem>
 
 <TabItem label="Cloud-Hosted">
-![Cloud-Hosted Teleport Architecture for Cloud Spanner Access](../../../../img/database-access/guides/spanner_cloud.png)
+![Cloud-Hosted Teleport Architecture for Cloud Spanner Access](../../../../../img/database-access/guides/spanner_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -52,7 +58,7 @@ Teleport users, but for this guide we will just create one.
 Go to the IAM & Admin [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)
 page and create a new service account named "spanner-user":
 
-![Create Service Account](../../../../img/database-access/guides/spanner/create-spanner-user@2x.png)
+![Create Service Account](../../../../../img/database-access/guides/spanner/create-spanner-user@2x.png)
 
 Ignore the optional steps - just click "Done".
 Rather than granting access at the project level, we will grant this service
@@ -64,12 +70,12 @@ Navigate to the
 [Spanner instance overview page](https://console.cloud.google.com/spanner/instances)
 and check the box of your Spanner instance, then click "Permissions".
 
-![Open Cloud Spanner Instance Permissions](../../../../img/database-access/guides/spanner/select-instance@2x.png)
+![Open Cloud Spanner Instance Permissions](../../../../../img/database-access/guides/spanner/select-instance@2x.png)
 
 In the permissions blade, click "Add Principal" then add the "spanner-user" service
 account as a principal and assign it the "Cloud Spanner Database User" role:
 
-![Grant Cloud Spanner Database User to Service Account](../../../../img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png)
+![Grant Cloud Spanner Database User to Service Account](../../../../../img/database-access/guides/spanner/grant-service-account-access-to-instance@2x.png)
 
 Click "Save".
 
@@ -87,12 +93,12 @@ The Teleport Database Service must be able to impersonate this service account.
 Navigate to the "spanner-user" service account overview page and select the
 "permissions" tab:
 
-![Select Service Account Permissions Tab](../../../../img/database-access/guides/spanner/service-account-permissions-tab@2x.png)
+![Select Service Account Permissions Tab](../../../../../img/database-access/guides/spanner/service-account-permissions-tab@2x.png)
 
 Click "Grant Access" and add the "teleport-db-service" principal ID.
 Select the "Service Account Token Creator" role and save the change:
 
-![Grant Service Account Token Creator to Database Service](../../../../img/database-access/guides/spanner/grant-token-creator@2x.png)
+![Grant Service Account Token Creator to Database Service](../../../../../img/database-access/guides/spanner/grant-token-creator@2x.png)
 
 <Admonition type="note" title="Service account permissions">
   The "Service Account Token Creator" IAM role includes more permissions than
@@ -181,7 +187,7 @@ spanner-example GCP Cloud Spanner [*]           env=dev
   type="note"
 >
 You will only be able to see databases that your Teleport role has
-access to. See our [RBAC](../rbac.mdx) guide for more details.
+access to. See our [RBAC](../../rbac.mdx) guide for more details.
 </Admonition>
 
 When connecting to the database, use the name of the service account
@@ -212,7 +218,7 @@ $ tsh db logout
 
 (!docs/pages/includes/database-access/guides-next-steps.mdx!)
 
-- Learn how to [connect with a GUI client](../../../connect-your-client/gui-clients.mdx#cloud-spanner-datagrip).
+- Learn how to [connect with a GUI client](../../../../connect-your-client/third-party/gui-clients.mdx#cloud-spanner-datagrip).
 - Learn more about [authenticating as a service
   account](https://cloud.google.com/docs/authentication#service-accounts) in
   Google Cloud.
diff --git a/docs/pages/enroll-resources/database-access/enrollment/managed/managed.mdx b/docs/pages/enroll-resources/database-access/enrollment/managed/managed.mdx
new file mode 100644
index 0000000000000..c317912d8c545
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/managed/managed.mdx
@@ -0,0 +1,15 @@
+---
+title: Enroll Managed Databases
+sidebar_label: Managed Databases
+description: "Provides instructions on protecting managed databases in your infrastructure with Teleport."
+tags:
+ - zero-trust
+ - infrastructure-identity
+---
+
+Teleport can protect databases that are managed as a dedicated cloud platform.
+Learn how to enroll the following databases in your Teleport cluster:
+
+- [MongoDB Atlas](mongodb-atlas.mdx)
+- [Oracle Exadata](oracle-exadata.mdx)
+- [Snowflake](snowflake.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-managed-databases/mongodb-atlas.mdx b/docs/pages/enroll-resources/database-access/enrollment/managed/mongodb-atlas.mdx
similarity index 92%
rename from docs/pages/enroll-resources/database-access/enroll-managed-databases/mongodb-atlas.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/managed/mongodb-atlas.mdx
index b8706cba57d77..c5b50e05a11ea 100644
--- a/docs/pages/enroll-resources/database-access/enroll-managed-databases/mongodb-atlas.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/managed/mongodb-atlas.mdx
@@ -1,7 +1,12 @@
 ---
 title: Database Access with MongoDB Atlas
+sidebar_label: MongoDB Atlas
 description: How to configure Teleport database access with MongoDB Atlas.
 videoBanner: mu_ZKTjnFJ8
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="MongoDB Atlas" dbConfigure="with either mutual TLS or AWS IAM authentication"!)
@@ -23,10 +28,10 @@ or AWS IAM:
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll MongoDB with a self-hosted Teleport cluster](../../../../img/database-access/guides/mongodbatlas_selfhosted.png)
+![Enroll MongoDB with a self-hosted Teleport cluster](../../../../../img/database-access/guides/mongodbatlas_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll MongoDB with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/mongodbatlas_cloud.png)
+![Enroll MongoDB with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/mongodbatlas_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -101,7 +106,7 @@ db_service:
 
 (!docs/pages/includes/start-teleport.mdx service="the Teleport Database Service"!)
 
-See the full [YAML reference](../../../reference/agent-services/database-access-reference/configuration.mdx) for details.
+See the full [YAML reference](../../reference/configuration.mdx) for details.
 
 </TabItem>
 </Tabs>
@@ -112,12 +117,12 @@ See below for details on how to configure the Teleport Database Service.
 
 You will need to provide your Atlas cluster's connection endpoint for the `db_service.databases[*].uri` configuration option or `--uri` CLI flag. You can find this via the Connect dialog on the Database Deployments overview page:
 
-![Connect](../../../../img/database-access/guides/atlas/atlas-connect-btn@2x.png)
+![Connect](../../../../../img/database-access/guides/atlas/atlas-connect-btn@2x.png)
 
 Go through the "Setup connection security" step and select "Connect with the
 MongoDB shell" to view the connection string:
 
-![Connection string](../../../../img/database-access/guides/atlas/atlas-connect@2x.png)
+![Connection string](../../../../../img/database-access/guides/atlas/atlas-connect@2x.png)
 
 Use only the scheme and hostname parts of the connection string in the URI:
 
@@ -154,7 +159,7 @@ You can discard the other `mongo.crt` file.
 Go to the Security / Advanced configuration section of your Atlas cluster and
 toggle "Self-managed X.509 Authentication" on:
 
-![X.509](../../../../img/database-access/guides/atlas/atlas-self-managed-x509@2x.png)
+![X.509](../../../../../img/database-access/guides/atlas/atlas-self-managed-x509@2x.png)
 
 Paste the contents of `mongo.cas` file in the Certificate Authority edit box and
 click Save.
@@ -166,7 +171,7 @@ On the Security / Database Access page add a new database user with Certificate
 authentication method:
 {/*vale messaging.protocol-products = YES*/}
 
-![Add user](../../../../img/database-access/guides/atlas/atlas-add-user@2x.png)
+![Add user](../../../../../img/database-access/guides/atlas/atlas-add-user@2x.png)
 
 Make sure to specify the user as `CN=<user>` as shown above since MongoDB
 treats the entire certificate subject as a username. When connecting to a
@@ -224,7 +229,7 @@ User Privileges** section, give the user sufficient privileges to access the
 desired database data.
 {/*vale messaging.protocol-products = YES*/}
 
-![Create AWS IAM database user](../../../../img/database-access/guides/atlas/atlas-add-aws-iam-user.png)
+![Create AWS IAM database user](../../../../../img/database-access/guides/atlas/atlas-add-aws-iam-user.png)
 
 Please note that Teleport does not support authentication using AWS IAM users;
 it exclusively supports authentication using AWS IAM roles.
diff --git a/docs/pages/enroll-resources/database-access/enroll-managed-databases/oracle-exadata.mdx b/docs/pages/enroll-resources/database-access/enrollment/managed/oracle-exadata.mdx
similarity index 96%
rename from docs/pages/enroll-resources/database-access/enroll-managed-databases/oracle-exadata.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/managed/oracle-exadata.mdx
index a5355bb632861..28f8a1ff1779c 100644
--- a/docs/pages/enroll-resources/database-access/enroll-managed-databases/oracle-exadata.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/managed/oracle-exadata.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Oracle Exadata
+sidebar_label: Oracle Exadata
 description: How to configure Teleport database access with Oracle Exadata.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Oracle Exadata" dbConfigure="with mTLS authentication"!)
@@ -11,16 +16,16 @@ description: How to configure Teleport database access with Oracle Exadata.
 
 <Tabs>
 <TabItem scope={["enterprise"]} label="Teleport Enterprise (Self-Hosted)">
-![Enroll Oracle with a self-hosted Teleport cluster](../../../../img/database-access/guides/oracle_selfhosted.png)
+![Enroll Oracle with a self-hosted Teleport cluster](../../../../../img/database-access/guides/oracle_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise (Cloud)">
-![Enroll Oracle with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/oracle_selfhosted_cloud.png)
+![Enroll Oracle with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/oracle_selfhosted_cloud.png)
 </TabItem>
 </Tabs>
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 - Oracle Exadata server instance 19c or later.
 - The `sqlcl` [Oracle client](https://www.oracle.com/pl/database/sqldeveloper/technologies/sqlcl/) installed and added to your system's `PATH` environment variable or any GUI client that supports JDBC
   Oracle thin client.
@@ -171,7 +176,7 @@ Install and configure Teleport where you will run the Teleport Database Service:
 <Tabs>
 <TabItem label="Linux Server">
 
-(!docs/pages/includes/install-linux-enterprise.mdx!)
+(!docs/pages/includes/install-linux.mdx!)
 
 On the host where you will run the Teleport Database Service, start Teleport
 with the appropriate configuration.
@@ -389,6 +394,14 @@ $ tsh db logout oracle
 $ tsh db logout
 ```
 
+## (Optional) Configure additional hostnames
+
+(!docs/pages/includes/database-access/oracle-multihost.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/oracle-troubleshooting.mdx!)
+
 ## Next steps
 
 (!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/enrollment/managed/snowflake.mdx b/docs/pages/enroll-resources/database-access/enrollment/managed/snowflake.mdx
new file mode 100644
index 0000000000000..fd6598765c4e0
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/managed/snowflake.mdx
@@ -0,0 +1,194 @@
+---
+title: Database Access with Snowflake
+sidebar_label: Snowflake
+description: How to configure Teleport database access with Snowflake.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+(!docs/pages/includes/database-access/db-introduction.mdx dbType="Snowflake" dbConfigure="with key pair authentication"!)
+
+## How it works
+
+The Teleport Database Service communicates with Snowflake using HTTP messages
+that contain JSON web tokens signed by the Teleport certificate authority for
+database clients. Snowflake is configured to trust the Teleport database client
+CA. When a user connects to Snowflake via Teleport, the Database Service
+forwards the user's requests to Snowflake as Teleport-authenticated messages.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+  ![Enroll Snowflake with a self-hosted Teleport cluster](../../../../../img/database-access/guides/snowflake_selfhosted.png)
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+  ![Enroll Snowflake with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/snowflake_cloud.png)
+</TabItem>
+
+</Tabs>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- Snowflake account with `SECURITYADMIN` role or higher.
+
+- `snowsql` installed and added to your system's `PATH` environment variable.
+
+- A host where you will run the Teleport Database Service.
+
+  See [Installation](../../../../installation/installation.mdx) for details.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/5. Set up the Teleport Database Service
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
+
+Install and configure Teleport where you will run the Teleport Database Service:
+
+<Tabs>
+<TabItem label="Linux Server">
+
+(!docs/pages/includes/install-linux.mdx!)
+
+(!docs/pages/includes/database-access/db-configure-start.mdx dbName="example-snowflake" dbProtocol="snowflake" databaseAddress="abc12345.snowflakecomputing.com" !)
+
+</TabItem>
+<TabItem label="Kubernetes Cluster">
+  Teleport provides Helm charts for installing the Teleport Database Service in Kubernetes Clusters.
+
+  (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+  (!docs/pages/includes/database-access/db-helm-install.mdx dbName="example-snowflake" dbProtocol="snowflake" databaseAddress="abc12345.snowflakecomputing.com" !)
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/multiple-instances-tip.mdx !)
+
+## Step 2/5. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 3/5. Export a public key
+
+Use the `tctl auth sign` command below to export a public key for your Snowflake user:
+
+```code
+$ tctl auth sign --format=snowflake --out=server
+```
+
+The command will create a `server.pub` file with Teleport's public key. Teleport will use the corresponding private key to
+generate a JWT (JSON Web Token) that will be used to authenticate to Snowflake.
+
+
+## Step 4/5. Add the public key to your Snowflake user
+
+Use the public key you generated earlier to enable key pair authentication.
+
+Log in to your Snowflake instance and execute the SQL statement below:
+
+```sql
+alter user alice set rsa_public_key='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3dHYw4LJCcZzdbhb3hV...LwIDAQAB';
+```
+
+In this statement, `alice` is the name of the Snowflake user and the `rsa_public_key` is the key generated earlier without
+the PEM header/footer (first and the last line).
+
+You can use the `describe user` command to verify the user's public key:
+
+```sql
+desc user alice;
+```
+
+See the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-4-assign-the-public-key-to-a-snowflake-user)
+for more details.
+
+## Step 5/5. Connect
+
+Log in to your Teleport cluster and see the available databases:
+
+<Tabs>
+
+  <TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+    ```code
+    $ tsh login --proxy=teleport.example.com --user=alice
+    $ tsh db ls
+    # Name              Description         Labels
+    # ----------------- ------------------- --------
+    # example-snowflake Example Snowflake ❄ env=dev
+    ```
+  </TabItem>
+  <TabItem scope={["cloud","team"]} label="Cloud-Hosted">
+    ```code
+    $ tsh login --proxy=mytenant.teleport.sh --user=alice
+    $ tsh db ls
+    # Name              Description         Labels
+    # ----------------- ------------------- --------
+    # example-snowflake Example Snowflake ❄ env=dev
+    ```
+  </TabItem>
+</Tabs>
+
+To retrieve credentials for a database and connect to it:
+
+```code
+$ tsh db connect --db-user=alice --db-name=SNOWFLAKE_SAMPLE_DATA example-snowflake
+```
+
+The `snowsql` command-line client should be available in the system `PATH` in order to be
+able to connect.
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance.
+$ tsh db logout example-snowflake
+# Remove credentials for all database instances.
+$ tsh db logout
+```
+
+## Access Snowsight via Teleport
+
+The Teleport Database Service provides CLI and programmatic access to Snowflake
+databases, but it does not provide direct access to the Snowsight web interface.
+To enable Snowsight access, you can configure it as a SAML application in
+Teleport, allowing Teleport to act as the Identity Provider (IdP) for Snowsight.
+
+<Admonition type="note">
+When Teleport is configured as the IdP for Snowsight, it only handles SAML
+authentication. Snowsight activity is not audited or recorded through Teleport.
+</Admonition>
+
+Follow [Using Teleport as a SAML identity
+provider](../../../../identity-governance/idps/saml-guide.mdx) and [Configuring
+Snowflake to use federated
+authentication](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-security-integration)
+to setup Teleport as an IDP.
+
+Here is an example of the security integration to be created in your Snowflake database:
+```sql
+CREATE SECURITY INTEGRATION teleport_idp
+  TYPE = saml2
+  ENABLED = true
+  SAML2_ISSUER = 'https://teleport.example.com/enterprise/saml-idp/metadata'
+  SAML2_SSO_URL = 'https://teleport.example.com/enterprise/saml-idp/sso'
+  SAML2_PROVIDER = 'custom'
+  SAML2_X509_CERT = 'MII...'
+  SAML2_ENABLE_SP_INITIATED = true
+  SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'Teleport Login'
+```
+
+Replace the URLs and X.509 certificate with the values generated during the
+enrollment flow in the Teleport Web UI. After creating the integration, describe
+the integration to obtain the Snowflake URLs that must be configured in
+Teleport.
+
+By default, Teleport passes your Teleport username as the Snowsight account
+name. For custom mappings, see [SAML Idp Attribute
+Mapping](../../../../identity-governance/idps/saml-attribute-mapping.mdx).
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cassandra-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/cassandra-self-hosted.mdx
similarity index 96%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cassandra-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/cassandra-self-hosted.mdx
index 33109fbe865be..8a78dd0e1368c 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cassandra-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/cassandra-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Cassandra and ScyllaDB
+sidebar_label: Cassandra/ScyllaDB
 description: How to configure Teleport database access with Cassandra and ScyllaDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="Cassandra or ScyllaDB"!)
@@ -11,10 +16,10 @@ description: How to configure Teleport database access with Cassandra and Scylla
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Cassandra with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/cassandra_selfhosted.png)
+![Enroll Cassandra with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/cassandra_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Cassandra with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/cassandra_cloud.png)
+![Enroll Cassandra with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/cassandra_cloud.png)
 </TabItem>
 
 </Tabs>
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/clickhouse-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/clickhouse-self-hosted.mdx
similarity index 97%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/clickhouse-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/clickhouse-self-hosted.mdx
index a69e23b764261..a770542c3c189 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/clickhouse-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/clickhouse-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with ClickHouse
+sidebar_label: ClickHouse
 description: How to configure Teleport database access with ClickHouse.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The Teleport Clickhouse integration allows you to enroll ClickHouse databases
@@ -27,10 +32,10 @@ include audit logs for database query activity.
 
 <Tabs>
 <TabItem label="Self-Hosted">
-![Enroll ClickHouse with a self-hosted Teleport cluster](../../../../img/database-access/guides/clickhouse_selfhosted_selfhosted.png)
+![Enroll ClickHouse with a self-hosted Teleport cluster](../../../../../img/database-access/guides/clickhouse_selfhosted_selfhosted.png)
 </TabItem>
 <TabItem label="Teleport Cloud">
-![Enroll ClickHouse with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/clickhouse_selfhosted_cloud.png)
+![Enroll ClickHouse with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/clickhouse_selfhosted_cloud.png)
 </TabItem>
 </Tabs>
 
@@ -191,7 +196,7 @@ databases:
   - name: example-clickhouse
     uri: clickhouse.example.com:8443
     protocol: <Var name="protocol" />
-labels:
+tags:
   env: dev
 ```
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cockroachdb-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/cockroachdb-self-hosted.mdx
similarity index 96%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cockroachdb-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/cockroachdb-self-hosted.mdx
index f458944ba330c..d295767076f00 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/cockroachdb-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/cockroachdb-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Self-Hosted CockroachDB
+sidebar_label: CockroachDB
 description: How to configure Teleport database access with self-hosted CockroachDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="CockroachDB"!)
@@ -11,10 +16,10 @@ description: How to configure Teleport database access with self-hosted Cockroac
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enrolling a CockroachDB instance with a self-hosted Teleport cluster](../../../../img/database-access/guides/cockroachdb_selfhosted.png)
+![Enrolling a CockroachDB instance with a self-hosted Teleport cluster](../../../../../img/database-access/guides/cockroachdb_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enrolling a CockroachDB instance with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/cockroachdb_cloud.png)
+![Enrolling a CockroachDB instance with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/cockroachdb_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -251,6 +256,8 @@ $ tsh db connect --db-user=alice roach
   in order to be able to connect.
 </Admonition>
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="CockroachDB"!)
+
 To log out of the database and remove credentials:
 
 ```code
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/elastic.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/elastic.mdx
similarity index 94%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/elastic.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/elastic.mdx
index a9657ca408cc9..67ebce48c9eaf 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/elastic.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/elastic.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Elasticsearch
+sidebar_label: Elasticsearch
 description: How to configure Teleport database access with Elasticsearch.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="Elasticsearch"!)
@@ -17,7 +22,7 @@ description: How to configure Teleport database access with Elasticsearch.
 
 - A host where you will run the Teleport Database Service.
 
-  See [Installation](../../../installation.mdx) for details.
+  See [Installation](../../../../installation/installation.mdx) for details.
 
 - Optional: a certificate authority that issues certificates for
   your self-hosted database.
@@ -76,7 +81,7 @@ $ curl -u elastic:your_elasticsearch_password -X POST "https://elasticsearch.exa
 <details>
 <summary>Role Mapping with wildcards</summary>
 
-In a scenario where Teleport is using [single sign-on](../../../admin-guides/access-controls/sso/sso.mdx) you may want to define a mapping for all users to a role:
+In a scenario where Teleport is using [single sign-on](../../../../zero-trust-access/sso/sso.mdx) you may want to define a mapping for all users to a role:
 
 ```code
 $ curl -u elastic:your_elasticsearch_password -X POST "https://elasticsearch.example.com:9200/_security/role_mapping/mapping1?pretty" -H 'Content-Type: application/json' -d'
@@ -183,7 +188,7 @@ Use one of the following commands to connect to the database:
 
 Note the assigned port, and provide it to your GUI client:
 
-![ElasticVue](../../../../img/database-access/guides/elasticvue.png)
+![ElasticVue](../../../../../img/database-access/guides/elasticvue.png)
 
 ## Next steps
 
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/mongodb-self-hosted.mdx
similarity index 97%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/mongodb-self-hosted.mdx
index 98172a9ae3ab3..55a199d05af64 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/mongodb-self-hosted.mdx
@@ -1,7 +1,12 @@
 ---
 title: Database Access with Self-Hosted MongoDB
+sidebar_label: MongoDB
 description: How to configure Teleport database access with self-hosted MongoDB.
 videoBanner: 6lgVObxoLkc
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="MongoDB"!)
@@ -12,10 +17,10 @@ videoBanner: 6lgVObxoLkc
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll MongoDB with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/mongodb_selfhosted.png)
+![Enroll MongoDB with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/mongodb_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll MongoDB with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/mongodb_cloud.png)
+![Enroll MongoDB with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/mongodb_cloud.png)
 </TabItem>
 
 </Tabs>
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mysql-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/mysql-self-hosted.mdx
similarity index 92%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mysql-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/mysql-self-hosted.mdx
index 28dec6dd7c06c..7a362a83bff0b 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mysql-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/mysql-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
-title: Database Access with Self-Hosted MySQL/MariaDB
+title: Database Access with Self-Hosted MySQL or MariaDB
+sidebar_label: MySQL/MariaDB
 description: How to configure Teleport database access with self-hosted MySQL/MariaDB.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="MySQL or MariaDB"!)
@@ -11,10 +16,10 @@ description: How to configure Teleport database access with self-hosted MySQL/Ma
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll MySQL with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/mysql_selfhosted.png)
+![Enroll MySQL with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/mysql_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll MySQL with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/mysql_cloud.png)
+![Enroll MySQL with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/mysql_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -180,12 +185,12 @@ $ tsh db ls
 </Tabs>
 
 Note that you will only be able to see databases your role has access to. See
-the [RBAC](../rbac.mdx) guide for more details.
+the [RBAC](../../rbac.mdx) guide for more details.
 
 To retrieve credentials for a database and connect to it:
 
 ```code
-$ tsh db connect --db-user=root --db-name=mysql example-mysql
+$ tsh db connect --db-user=alice --db-name=mysql example-mysql
 ```
 
 <Admonition type="note" title="Note">
@@ -193,6 +198,8 @@ $ tsh db connect --db-user=root --db-name=mysql example-mysql
   able to connect. `mariadb` is a default command-line client for MySQL and MariaDB.
 </Admonition>
 
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="MySQL or MariaDB"!)
+
 To log out of the database and remove credentials:
 
 ```code
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/oracle-self-hosted.mdx
similarity index 94%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/oracle-self-hosted.mdx
index dfcc91c0c6949..18a5d86852586 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/oracle-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Oracle
+sidebar_label: Oracle
 description: How to configure Teleport database access with Oracle.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="Oracle"!)
@@ -11,17 +16,17 @@ description: How to configure Teleport database access with Oracle.
 
 <Tabs>
 <TabItem scope={["enterprise"]} label="Teleport Enterprise">
-![Enroll Oracle with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/oracle_selfhosted.png)
+![Enroll Oracle with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/oracle_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Oracle with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/oracle_selfhosted_cloud.png)
+![Enroll Oracle with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/oracle_selfhosted_cloud.png)
 </TabItem>
 
 </Tabs>
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 - Self-hosted Oracle server instance 18c or later.
 - The `sqlcl` [Oracle client](https://www.oracle.com/pl/database/sqldeveloper/technologies/sqlcl/) installed and added to your system's `PATH` environment variable or any GUI client that supports JDBC
   Oracle thin client.
@@ -34,7 +39,7 @@ description: How to configure Teleport database access with Oracle.
 
 <Admonition type="tip">
 
-To modify an existing user to provide access to the Database Service, see [Database Access Controls](../../database-access/rbac.mdx)
+To modify an existing user to provide access to the Database Service, see [Database Access Controls](../../rbac.mdx)
 
 </Admonition>
 
@@ -59,7 +64,7 @@ $ tctl users add \
 </Admonition>
 
 For more detailed information about database access controls and how to restrict
-access see [RBAC](../../database-access/rbac.mdx) documentation.
+access see [RBAC](../../rbac.mdx) documentation.
 
 ## Step 2/6. Create a certificate/key pair and Teleport Oracle Wallet
 
@@ -154,7 +159,7 @@ Install and configure Teleport where you will run the Teleport Database Service:
 <Tabs>
 <TabItem label="Linux Server">
 
-(!docs/pages/includes/install-linux-enterprise.mdx!)
+(!docs/pages/includes/install-linux.mdx!)
 
 (!docs/pages/includes/database-access/self-hosted-config-start.mdx dbName="oracle" dbProtocol="oracle" databaseAddress="oracle.example.com:2484" dbName="oracle" !)
 
@@ -258,6 +263,14 @@ $ tsh db logout oracle
 $ tsh db logout
 ```
 
+## (Optional) Configure additional hostnames
+
+(!docs/pages/includes/database-access/oracle-multihost.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/database-access/oracle-troubleshooting.mdx!)
+
 ## Next steps
 
 (!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/postgres-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/postgres-self-hosted.mdx
similarity index 91%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/postgres-self-hosted.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/postgres-self-hosted.mdx
index f334094884305..672c4c92f0730 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/postgres-self-hosted.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/postgres-self-hosted.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Self-Hosted PostgreSQL
+sidebar_label: PostgreSQL
 description: How to configure Teleport database access with self-hosted PostgreSQL.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="PostgreSQL"!)
@@ -11,10 +16,10 @@ description: How to configure Teleport database access with self-hosted PostgreS
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll PostgreSQL with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/postgresqlselfhosted_selfhosted.png)
+![Enroll PostgreSQL with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/postgresqlselfhosted_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll PostgreSQL with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/postgresqlselfhosted_cloud.png)
+![Enroll PostgreSQL with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/postgresqlselfhosted_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -134,7 +139,7 @@ $ tsh db ls
 </Tabs>
 
 Note that you will only be able to see databases your role has access to. See
-[RBAC](../rbac.mdx) section for more details.
+[RBAC](../../rbac.mdx) section for more details.
 
 To retrieve credentials for a database and connect to it:
 
@@ -142,7 +147,7 @@ To retrieve credentials for a database and connect to it:
 $ tsh db connect --db-user=postgres --db-name=postgres example-postgres
 ```
 
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
 
 To log out of the database and remove credentials:
 
@@ -161,6 +166,6 @@ $ tsh db logout
 
 ## Next steps
 
-- Set up [automatic database user provisioning](../auto-user-provisioning/postgres.mdx).
+- Set up [automatic database user provisioning](../../auto-user-provisioning/postgres.mdx).
 
 (!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis-cluster.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis-cluster.mdx
similarity index 97%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis-cluster.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis-cluster.mdx
index 4b243746d97c0..ab1ab28e11e54 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis-cluster.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis-cluster.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Redis Cluster
+sidebar_label: Redis Cluster
 description: How to configure Teleport database access with Redis Cluster.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 {/* vale messaging.protocol-products = NO */}
@@ -15,10 +20,10 @@ If you want to configure Redis Standalone, please read [Database Access with Red
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Redis Cluster with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/rediscluster_selfhosted.png)
+![Enroll Redis Cluster with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/rediscluster_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud","team"]} label="Teleport Cloud">
-![Enroll Redis Cluster with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/rediscluster_cloud.png)
+![Enroll Redis Cluster with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/rediscluster_cloud.png)
 </TabItem>
 
 </Tabs>
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis.mdx
similarity index 93%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis.mdx
index 257dec7d7f58c..e9833c11236a0 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/redis.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/redis.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Redis
+sidebar_label: Redis
 description: How to configure Teleport database access with Redis.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 {/* vale messaging.protocol-products = NO */}
@@ -15,10 +20,10 @@ If you want to configure Redis Cluster, please read [Database Access with Redis
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Redis with a Self-Hosted Teleport Cluster](../../../../img/database-access/guides/redis_selfhosted.png)
+![Enroll Redis with a Self-Hosted Teleport Cluster](../../../../../img/database-access/guides/redis_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud","team"]} label="Teleport Cloud">
-![Enroll Redis with a Cloud-Hosted Teleport Cluster](../../../../img/database-access/guides/redis_cloud.png)
+![Enroll Redis with a Cloud-Hosted Teleport Cluster](../../../../../img/database-access/guides/redis_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -37,7 +42,7 @@ If you want to configure Redis Cluster, please read [Database Access with Redis
 
 - A host where you will run the Teleport Database Service.
 
-  See [Installation](../../../installation.mdx) for details.
+  See [Installation](../../../../installation/installation.mdx) for details.
 
 - Optional: a certificate authority that issues certificates for
   your self-hosted database.
@@ -121,4 +126,3 @@ returns the <nobr>`ERR Teleport: not supported by Teleport`</nobr> error.
 ## Next steps
 
 (!docs/pages/includes/database-access/guides-next-steps.mdx!)
-
diff --git a/docs/pages/enroll-resources/database-access/enrollment/self-hosted/self-hosted.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/self-hosted.mdx
new file mode 100644
index 0000000000000..ed48343eff95b
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/self-hosted.mdx
@@ -0,0 +1,26 @@
+---
+title: Enroll Self-Hosted Databases
+sidebar_label: Self-Hosted Databases
+description: "Provides instructions on protecting self-hosted databases in your infrastructure with Teleport."
+tags:
+ - zero-trust
+ - infrastructure-identity
+---
+
+You can protect self-hosted databases with Teleport. Learn how to enroll your
+database in your Teleport cluster with the following guides:
+
+- [Cassandra and
+  ScyllaDB](cassandra-self-hosted.mdx)
+- [ClickHouse](clickhouse-self-hosted.mdx)
+- [CockroachDB](cockroachdb-self-hosted.mdx)
+- [Elastic](elastic.mdx)
+- [MongoDB](mongodb-self-hosted.mdx)
+- [MySQL](mysql-self-hosted.mdx)
+- [Oracle](oracle-self-hosted.mdx)
+- [PostgreSQL](postgres-self-hosted.mdx)
+- [Redis Cluster](redis-cluster.mdx)
+- [Redis](redis.mdx)
+- [SQL Server with PKINIT
+  authentication](sql-server-ad-pkinit.mdx)
+- [Vitess](vitess.mdx)
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/sql-server-ad-pkinit.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/sql-server-ad-pkinit.mdx
similarity index 94%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/sql-server-ad-pkinit.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/sql-server-ad-pkinit.mdx
index a49beca8985e3..c557920555d61 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/sql-server-ad-pkinit.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/sql-server-ad-pkinit.mdx
@@ -1,6 +1,11 @@
 ---
 title: Microsoft SQL Server access with PKINIT authentication
+sidebar_label: SQL Server
 description: How to configure Microsoft SQL Server access with Active Directory PKINIT authentication.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="Microsoft SQL Server" dbConfigure="with PKINIT authentication"!)
@@ -17,10 +22,10 @@ Teleport Database Service forwards user traffic to the database.
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Database access with SQL Server and AD authentication](../../../../img/database-access/sql-server-ad-1.png)
+![Database access with SQL Server and AD authentication](../../../../../img/database-access/sql-server-ad-1.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Database access with SQL Server and AD authentication](../../../../img/database-access/sql-server-ad-2.png)
+![Database access with SQL Server and AD authentication](../../../../../img/database-access/sql-server-ad-2.png)
 </TabItem>
 </Tabs>
 
@@ -86,6 +91,13 @@ You will need to repeat these steps if you rotate Teleport's database certificat
    $ tctl auth crl --type=db_client > db-ca.crl
    ```
 
+   If you use HSM, there are multiple CRLs that have to be exported.
+   This can be done by running:
+
+   ```code
+   $ tctl auth crl --type=db_client --out=<file_prefix>
+   ```
+
 1. Transfer the `db-ca.cer` and `db-ca.crl` files to a Windows machine where you can manage your group policy.
 
 ### Create a GPO and import the Teleport CA
@@ -119,7 +131,7 @@ You will need to repeat these steps if you rotate Teleport's database certificat
 
 1. Click through the wizard, selecting your CA file (`db-ca.cer`).
 
-  ![Import Teleport CA](../../../../img/desktop-access/ca.png)
+  ![Import Teleport CA](../../../../../img/desktop-access/ca.png)
 
 ### Enable smart card service
 
@@ -134,7 +146,7 @@ Teleport performs certificate-based authentication by emulating a smart card.
 1. Double click on `Smart Card`, select `Define this policy setting` and switch
    to `Automatic` then click `OK`.
 
-  ![Enable Smartcard](../../../../img/desktop-access/smartcard.png)
+  ![Enable Smartcard](../../../../../img/desktop-access/smartcard.png)
 
 <Admonition type="note" title="gpupdate.exe">
   You will be modifying GPOs, and sometimes GPO modifications can take some time
@@ -169,6 +181,12 @@ Teleport CRL to your Active Directory domain (using the path to the exported
 certutil -dspublish -f <PathToCRLFile.crl> TeleportDB
 ```
 
+If you use HSM, run commands printed at the end of the CRL export. They will be in the form of:
+
+```powershell
+certutil -dspublish -f <PathToCRLFile.crl> TeleportDB <CRLCommonName>
+```
+
 <Admonition type="tip">
   To avoid waiting until the certificate propagates, you can force the CA
   retrieval from LDAP after importing the CA and CRL with the command:
@@ -384,7 +402,7 @@ db_service:
 +     tls:
 +       # Point it to your Database CA PEM certificate.
 +       ca_cert_file: "rdsca.pem"
-+       # If your database certificate has an empty CN filed, you must change
++       # If your database certificate has an empty CN field, you must change
 +       # the TLS mode to only verify the CA.
 +       mode: verify-ca
       ad:
@@ -402,4 +420,3 @@ skipping TLS verification in production environments.
 ## Further reading
 
 - [Kerberos PKINIT authentication](https://web.mit.edu/kerberos/krb5-1.13/doc/admin/pkinit.html).
-
diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/vitess.mdx b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/vitess.mdx
similarity index 96%
rename from docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/vitess.mdx
rename to docs/pages/enroll-resources/database-access/enrollment/self-hosted/vitess.mdx
index 21e4df1440e61..ff2db3208532f 100644
--- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/vitess.mdx
+++ b/docs/pages/enroll-resources/database-access/enrollment/self-hosted/vitess.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access with Vitess (MySQL protocol)
+sidebar_label: Vitess (MySQL protocol)
 description: How to configure Teleport database access for Vitess (MySQL protocol)
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="Vitess (MySQL)"!)
@@ -11,10 +16,10 @@ description: How to configure Teleport database access for Vitess (MySQL protoco
 
 <Tabs>
 <TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-![Enroll Vitess with a self-hosted Teleport cluster](../../../../img/database-access/guides/vitess_selfhosted.png)
+![Enroll Vitess with a self-hosted Teleport cluster](../../../../../img/database-access/guides/vitess_selfhosted.png)
 </TabItem>
 <TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-![Enroll Vitess with a cloud-hosted Teleport cluster](../../../../img/database-access/guides/vitess_cloud.png)
+![Enroll Vitess with a cloud-hosted Teleport cluster](../../../../../img/database-access/guides/vitess_cloud.png)
 </TabItem>
 
 </Tabs>
@@ -184,7 +189,7 @@ $ tsh db ls
 </Tabs>
 
 Note that you will only be able to see databases your role has access to. See
-the [RBAC](../rbac.mdx) guide for more details.
+the [RBAC](../../rbac.mdx) guide for more details.
 
 To retrieve credentials for a database and connect to it:
 
diff --git a/docs/pages/enroll-resources/database-access/faq.mdx b/docs/pages/enroll-resources/database-access/faq.mdx
index 7fcbcb5bcf44d..fc1acefffa05e 100644
--- a/docs/pages/enroll-resources/database-access/faq.mdx
+++ b/docs/pages/enroll-resources/database-access/faq.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access FAQ
+sidebar_label: FAQ
 description: Frequently asked questions about Teleport database access.
+tags:
+ - faq
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This page provides the answers to common questions about enrolling databases
@@ -22,7 +27,7 @@ The Teleport Database Service currently supports the following protocols:
 - Oracle
 - OpenSearch
 - PostgreSQL
-- Redis
+- Redis and Valkey
 - Snowflake
 
 For PostgreSQL, Oracle and MySQL, the following Cloud-hosted versions are supported in addition to self-hosted deployments:
@@ -57,7 +62,7 @@ The following PostgreSQL protocol features aren't currently supported:
 When configuring the Teleport Proxy Service, administrators can set the
 `postgres_public_addr` and `mysql_public_addr` configuration fields to public
 addresses over which respective database clients should connect. See
-[Proxy Configuration](../../reference/agent-services/database-access-reference/configuration.mdx) for
+[Proxy Configuration](reference/configuration.mdx) for
 more details.
 
 This is useful when the Teleport Web UI is running behind an L7 load balancer
@@ -84,7 +89,7 @@ should work.
 
 Standard command-line clients such as `psql`, `mysql`, `mongo` or `mongosh` are
 supported. There are also instructions for configuring select
-[graphical clients](../../connect-your-client/gui-clients.mdx).
+[graphical clients](../../connect-your-client/third-party/gui-clients.mdx).
 
 ## When will you support X database?
 
@@ -98,14 +103,14 @@ to register your interest.
 ## Can I provide a custom CA certificate?
 
 Yes, you can pass custom CA certificate by using a
-[configuration file](../../reference/agent-services/database-access-reference/configuration.mdx)
+[configuration file](reference/configuration.mdx)
 (look at `ca_cert_file`).
 
 ## Can I provide a custom DNS name for Teleport generated CA?
 
 Yes, use `server_name` under the `tls` section in your Teleport configuration
 file. Please look on our reference
-[configuration file](../../reference/agent-services/database-access-reference/configuration.mdx)
+[configuration file](reference/configuration.mdx)
 for more details.
 
 ## Can I disable CA verification when connecting to a database?
@@ -115,7 +120,7 @@ person-in-the-middle attacks and makes sure that you
 are connected to the database that you intended to. 
 
 Teleport also allows you to edit your
-[configuration file](../../reference/agent-services/database-access-reference/configuration.mdx)
+[configuration file](reference/configuration.mdx)
 to provide a custom CA certificate (`ca_cert_file`) or custom DNS name
 (`server_name`), which is more secure. 
 
@@ -123,7 +128,7 @@ If none of the above options work for you and you still want to disable the CA
 check, you can use `mode` under the `tls` option in the Teleport configuration file.
 
 For more details please refer to the reference
-[configuration file](../../reference/agent-services/database-access-reference/configuration.mdx).
+[configuration file](reference/configuration.mdx).
 
 ## Can I disable read-only and custom endpoints from auto-discovered databases?
 
@@ -142,5 +147,5 @@ match:
         - "instance"
 ```
 
-See [labels reference](../../reference/agent-services/database-access-reference/labels.mdx) for a full list of Teleport
+See [labels reference](reference/labels.mdx) for a full list of Teleport
 generated labels and values.
diff --git a/docs/pages/enroll-resources/database-access/getting-started.mdx b/docs/pages/enroll-resources/database-access/getting-started.mdx
index 09f6b97d260f9..d5ddbbbfd2220 100644
--- a/docs/pages/enroll-resources/database-access/getting-started.mdx
+++ b/docs/pages/enroll-resources/database-access/getting-started.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access Getting Started Guide
+sidebar_label: Getting Started
 description: Getting started with Teleport database access and AWS Aurora PostgreSQL.
+tags:
+ - get-started
+ - zero-trust
+ - infrastructure-identity
 ---
 
 (!docs/pages/includes/database-access/db-introduction.mdx dbType="PostgreSQL Amazon Aurora" dbConfigure="with IAM authentication"!)
@@ -246,7 +251,7 @@ For the next steps, dive deeper into the topics relevant to your Database
 Access use-case, for example:
 
 - Check out configuration [guides](guides/guides.mdx).
-- Learn how to configure [GUI clients](../../connect-your-client/gui-clients.mdx).
+- Learn how to configure [GUI clients](../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about database access [role-based access control](./rbac.mdx).
 - See [frequently asked questions](./faq.mdx).
 
diff --git a/docs/pages/enroll-resources/database-access/guides/dynamic-registration.mdx b/docs/pages/enroll-resources/database-access/guides/dynamic-registration.mdx
index bf9e5adbcec99..6df298b07ed33 100644
--- a/docs/pages/enroll-resources/database-access/guides/dynamic-registration.mdx
+++ b/docs/pages/enroll-resources/database-access/guides/dynamic-registration.mdx
@@ -1,6 +1,11 @@
 ---
 title: Dynamic Database Registration
+sidebar_label: Dynamic Registration
 description: Register/unregister databases without restarting Teleport.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Dynamic database registration allows Teleport administrators to register new
@@ -97,7 +102,7 @@ spec:
 version: v5
 ```
 
-See the full database resource spec [reference](../../../reference/agent-services/database-access-reference/configuration.mdx).
+See the full database resource spec [reference](../reference/configuration.mdx).
 
 To create a database resource, run:
 
@@ -128,10 +133,10 @@ $ tctl rm db/example
 
 Aside from `tctl`, dynamic resources can also be added by:
 - [Auto-Discovery](../../auto-discovery/databases/databases.mdx)
-- [Terraform Provider](../../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
-- [Kubernetes Operator](../../../admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx)
-- [Teleport API](../../../admin-guides/api/api.mdx)
+- [Terraform Provider](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+- [Kubernetes Operator](../../../zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx)
+- [Teleport API](../../../zero-trust-access/api/api.mdx)
 
-See [Using Dynamic Resources](../../../admin-guides/infrastructure-as-code/infrastructure-as-code.mdx) to learn
+See [Using Dynamic Resources](../../../zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx) to learn
 more about managing Teleport's dynamic resources in general.
 
diff --git a/docs/pages/enroll-resources/database-access/guides/guides.mdx b/docs/pages/enroll-resources/database-access/guides/guides.mdx
index 4bd860491828c..ddbd22346cacf 100644
--- a/docs/pages/enroll-resources/database-access/guides/guides.mdx
+++ b/docs/pages/enroll-resources/database-access/guides/guides.mdx
@@ -1,7 +1,11 @@
 ---
 title: Using the Teleport Database Service
+sidebar_label: Configuration Guides
 description: Guides to possibilities for running the Teleport Database Service.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The Teleport Database Service proxies connections to databases protected by
@@ -13,6 +17,7 @@ enrolling databases:
   databases.
 - [Dynamic Registration](dynamic-registration.mdx): Learn how to enroll
   databases without re-deploying the Teleport Database Service.
+- [Health Checks](health-checks.mdx): Learn how to configure Teleport database health checks and view health information.
 
 The Teleport Database Service is one service that you can run on an a Teleport
 **agent.** Read the [Teleport Agents](../../agents/agents.mdx)
diff --git a/docs/pages/enroll-resources/database-access/guides/ha.mdx b/docs/pages/enroll-resources/database-access/guides/ha.mdx
index 6493d054bc87c..487ff8226adc1 100644
--- a/docs/pages/enroll-resources/database-access/guides/ha.mdx
+++ b/docs/pages/enroll-resources/database-access/guides/ha.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access High Availability (HA)
+sidebar_label: High Availability
 description: How to configure Teleport database access in a Highly Available (HA) configuration.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 You can deploy the Teleport Database Service in a Highly Available (HA)
diff --git a/docs/pages/enroll-resources/database-access/guides/health-checks.mdx b/docs/pages/enroll-resources/database-access/guides/health-checks.mdx
new file mode 100644
index 0000000000000..586559a508d08
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/guides/health-checks.mdx
@@ -0,0 +1,266 @@
+---
+title: Teleport Database Health Checks
+sidebar_label: Health Checks
+description: How to configure Teleport database health checks and view target health information.
+tags:
+- conceptual
+- zero-trust
+- infrastructure-identity
+---
+
+This documentation explains how to manage database health checks.
+Available in Teleport 18, database health checks are used to monitor connectivity from Teleport Database Service instances to databases enrolled in a Teleport cluster.
+
+Why monitor database connectivity with health checks?
+
+- **Observability**: Discover networking problems before a user attempts to connect to a database. Unhealthy databases are highlighted in the Teleport web UI and can be discovered programmatically through your Teleport cluster's API.
+- **High Availability**: Multiple Teleport Database Service instances can be deployed to proxy connections to the same enrolled databases. Teleport prioritizes routing user connections through Database Service instances that can reach the database endpoint over those that cannot.
+
+## How it works
+
+When a user connects to a database through Teleport, the connection is routed via a Teleport Database Service.
+The Database Service must be able to reach the database's endpoint to proxy the connection.
+
+Teleport Database Service instances will perform regular health checks for databases that match a global `health_check_config` resource's label selectors.
+If no `health_check_config` matches a database, then health checks will not be enabled for that database.
+
+To perform a health check, Teleport Database Service instances will attempt to establish a TCP connection to the database's endpoint and report whether the connection succeeded.
+
+<Admonition type="note">
+Only TCP health checks are available at this time.
+</Admonition>
+
+When a database is registered, it will initially have an "unknown" health status.
+If health checks are disabled, then the health status will remain "unknown".
+If health checks are enabled, then the first health check result will determine the database's health status: either "healthy" or "unhealthy".
+
+After the first health check for a database, its health status will only change once the number of consecutive passing or failing health checks reaches a configurable threshold.
+
+## Configuration
+
+Teleport's `health_check_config` resource determines which databases will have health checks enabled and what settings will be used for those checks:
+
+```yaml
+kind: health_check_config
+version: v1
+metadata:
+  name: example
+  description: Example healthcheck configuration
+spec:
+  # interval is the time between each health check. Default 30s.
+  interval: 30s
+  # timeout is the health check connection establishment timeout. Default 5s.
+  timeout: 5s
+  # healthy_threshold is the number of consecutive passing health checks
+  # after which a target's health status becomes "healthy". Default 2.
+  healthy_threshold: 2
+  # unhealthy_threshold is the number of consecutive failing health checks
+  # after which a target's health status becomes "unhealthy". Default 1.
+  unhealthy_threshold: 1
+  # match is used to select databases that these settings apply to.
+  # Databases are matched by label selectors and at least one label selector
+  # must be set.
+  # If multiple `health_check_config` databases match the same database, then
+  # the matching health check configs are sorted by name and only the first
+  # config applies.
+  match:
+    # db_labels matches database labels. An empty value is ignored.
+    # If db_labels_expression is also set, then the match result is the logical
+    # AND of both.
+    db_labels:
+      - name: env
+        values:
+          - dev
+          - staging
+    # db_labels_expression is a label predicate expression to match databases.
+    # An empty value is ignored.
+    # If db_labels is also set, then the match result is the logical AND of both.
+    db_labels_expression: 'labels["owner"] == "database-team"'
+```
+
+There can be multiple `health_check_config` in a cluster and each config can provide different settings for different sets of databases.
+If more than one `health_check_config` matches the same database, then the matching health check configs are sorted, in ascending order by name, and only the first config applies (e.g., the name "00-my-config" has greater precedence than "10-my-config").
+
+### Managing configuration
+
+Use `tctl` to manage `health_check_config` resources in your cluster.
+
+A preset default `health_check_config` is created starting in Teleport 18.
+The default config enables TCP health checks for all enrolled databases.
+
+Try viewing the default configuration with `tctl`:
+
+```code
+$ tctl get health_check_config/default
+kind: health_check_config
+metadata:
+  description: Enables all health checks by default
+  labels:
+    teleport.internal/resource-type: preset
+  name: default
+  namespace: default
+spec:
+  match:
+    db_labels:
+    - name: '*'
+      values:
+      - '*'
+version: v1
+```
+
+You can create your own health check config with `tctl create`:
+
+```code
+$ tctl create health_check_config.yaml
+```
+
+Or update an existing config interactively with `tctl edit`:
+
+```code
+$ tctl edit health_check_config/example
+```
+
+To delete a health check config, run:
+
+```code
+$ tctl rm health_check_config/example
+```
+
+When a config is created, updated, or deleted, all Teleport Database Service instances will reevaluate which health check config matches and applies for each of the registered databases they proxy.
+
+## Target health
+
+Target health information is reported by Teleport Database Service instances in `db_server` heartbeat objects for each database that they proxy.
+Among the information is a health status field.
+There are three health statuses:
+
+- "unknown": Health checks for this database are disabled or still initializing
+- "healthy": The Teleport service is able to reach the database's endpoint. 
+- "unhealthy": The Teleport service is not able to reach the database's endpoint. 
+
+<Admonition type="note">
+Teleport Database Service instances running a version of Teleport that does not support health checks will not report target health information for the databases that they proxy.
+</Admonition>
+
+You can use `tctl` to view target health information in `db_server.status.target_health`, for example:
+
+```code
+$ tctl get db_server/example-postgres-db | yq -y .status
+target_health:
+  # address is the database address.
+  address: "localhost:5432",
+  # message is additional information meant for a user.
+  message: "1 health check failed"
+  # protocol is the health check connection protocol, such as "TCP".
+  protocol: "TCP",
+  # status is the health status, one of "unknown", "healthy", or "unhealthy".
+  status: "unhealthy",
+  # transition_reason is a unique reason for the last transition: one of "initialized", "disabled", "threshold_reached", or "internal_error".
+  transition_reason: "threshold_reached",
+  # transition_timestamp is the time that the last status transition occurred.
+  transition_timestamp: "2025-06-09T22:40:24.147753Z",
+  # transition_error shows the health check error observed when the transition to "unhealthy" happened.
+  transition_error: "dial tcp 127.0.0.1:5432: connect: connection refused",
+```
+
+## Troubleshooting
+
+The Teleport web UI will highlight unhealthy databases.
+You can click on a highlighted database to view some health check failure details or other warnings:
+
+![Health warning indicator in web UI](../../../../img/resource-health-check/database-health-warning-indicator.png)
+
+In this AWS RDS database example the health check error is a connection dial timeout, which is commonly caused by AWS security groups blocking connections to the database.
+
+You can use `tctl` to view more information about the affected Teleport Database Service.
+For example, the affected Teleport Database Service instances in the screenshot were deployed using the [Teleport AWS RDS enrollment wizard](../../application-access/cloud-apis/awsoidc-integration-rds.mdx), which is indicated by the `teleport.dev/awsoidc-agent` label:
+
+```code
+$ tctl get db_service/22c8ecba-69fc-4c15-b94e-e8815236b9f0
+kind: db_service
+metadata:
+  expires: "2025-06-29T03:55:52Z"
+  labels:
+    teleport.dev/awsoidc-agent: "true"
+  name: 22c8ecba-69fc-4c15-b94e-e8815236b9f0
+  revision: 089129ef-52e2-4a8f-8451-c1e91879c14e
+spec:
+  hostname: ip-192-168-0-107.ca-central-1.compute.internal
+  resources:
+  - aws: {}
+    labels:
+      account-id: "111111111111"
+      region: ca-central-1
+      vpc-id: vpc-abc123abc123abc12
+version: v1
+```
+  
+Refer to the [Database Service troubleshooting guide](../troubleshooting.mdx) for general troubleshooting steps.
+
+## FAQ
+
+### Why are MySQL health checks disabled?
+
+MySQL tracks connection errors for each remote host that tries to connect to the database.
+Each TCP health check is counted as a connection error and eventually MySQL will
+block a host when `sum_connect_errors >= max_connect_errors`.
+As a result, TCP health checks eventually cause MySQL databases to block Teleport.
+
+To re-enable TCP health checks:
+- set `max_connect_errors` to its maximum value on the database to effectively disable the automatic host blocking.
+- set the environment variable `TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS=1` on your Teleport Database Service instance(s).
+
+<Admonition type="warning">
+[MySQL documentation](https://dev.mysql.com/doc/refman/8.4/en/host-cache.html#:~:text=The%20value%20of%20the%20max_connect_errors,host%20from%20further%20connection%20requests) notes:
+> The value of the max_connect_errors system variable determines how many successive interrupted connection requests the server permits before blocking a host. After max_connect_errors failed requests without a successful connection, the server assumes that something is wrong (for example, that someone is trying to break in), and blocks the host from further connection requests.
+
+Setting `max_connect_errors` to its maximum value will effectively disable MySQL's host blocking feature.
+See https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_max_connect_errors
+</Admonition>
+
+### How to disable database health checks?
+
+You can disable health checks for databases by updating your cluster's `health_check_config` resources to only match specific databases.
+
+For example, update the default preset configuration to match only databases with the label `"healthcheck": "enabled"`:
+
+```code
+$ tctl create <<EOF
+kind: health_check_config
+metadata:
+  description: Enables all health checks by default
+  labels:
+    teleport.internal/resource-type: preset
+  name: default
+  namespace: default
+spec:
+  match:
+    db_labels:
+    - name: healthcheck
+      values:
+      - enabled
+version: v1
+EOF
+```
+
+### Do health checks respect proxy environment variables?
+
+Health checks will respect HTTP proxy environment variables for the following Teleport database protocols:
+
+- `clickhouse-http`
+- `dynamodb`
+- `opensearch`
+
+The following environment variables in both uppercase and lowercase form are supported:
+
+- `http_proxy`
+- `https_proxy`
+- `no_proxy`
+
+If HTTP proxy environment variables configure a proxy for a database endpoint, then TCP health checks will dial the proxy rather than the endpoint.
+
+### How can I list all unhealthy databases?
+
+```code
+$ tctl db ls --query 'health.status == "unhealthy"' 
+```
diff --git a/docs/pages/enroll-resources/database-access/rbac.mdx b/docs/pages/enroll-resources/database-access/rbac.mdx
index 668d83af711c7..c32efe1cf205e 100644
--- a/docs/pages/enroll-resources/database-access/rbac.mdx
+++ b/docs/pages/enroll-resources/database-access/rbac.mdx
@@ -1,6 +1,11 @@
 ---
 title: Database Access Controls
+sidebar_label: Access Controls
 description: Role-based access control (RBAC) for Teleport database access.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 **Database Access Controls** is a Teleport feature that lets you configure
@@ -27,7 +32,7 @@ The Database Service grants object-level permissions for the duration of a
 connection and revokes them automatically when the connection ends.
 
 For a more general description of Teleport roles and examples see
-[RBAC](../../admin-guides/access-controls/access-controls.mdx), as this section focuses on
+[RBAC](../../zero-trust-access/authentication/authentication.mdx), as this section focuses on
 configuring RBAC for database access.
 
 <Admonition type="warning">
@@ -64,8 +69,8 @@ spec:
     # Note, this is not the same as the "name" field in "db_service", this is
     # the database names within a particular database instance.
     #
-    # Also note, this setting has effect only for PostgreSQL. It does not
-    # currently have any effect on MySQL databases/schemas.
+    # Also note, database names are only enforced for PostgreSQL, MongoDB, and
+    # Cloud Spanner databases.
     db_names: ["main", "metrics", "postgres"]
 ```
 
@@ -112,6 +117,9 @@ disconnects from the current one and establishes a new connection. During a
 PostgreSQL connection attempt, `db_names` field is checked against the name
 of the logical database that the user is connecting to.
 
+Similar to PostgreSQL, Teleport also enforces `db_names` for MongoDB and Cloud
+Spanner databases.
+
 In MySQL a logical "database" and a "schema" are synonyms for each other, and
 the scope of permissions a user has once connected is determined by the permission
 grants set on the account within the database. As such, `db_names` role field
@@ -122,7 +130,7 @@ is not currently enforced on MySQL connection attempts.
 Similar to other role fields, `db_*` fields support templating variables.
 
 The `external.xyz` traits are replaced with values from external [single
-sign-on](../../admin-guides/access-controls/sso/sso.mdx) providers. For OIDC, they will be
+sign-on](../../zero-trust-access/sso/sso.mdx) providers. For OIDC, they will be
 replaced with the value of an "xyz" claim. For SAML, they are replaced 
 with an "xyz" assertion value. 
 
diff --git a/docs/pages/enroll-resources/database-access/reference/audit.mdx b/docs/pages/enroll-resources/database-access/reference/audit.mdx
new file mode 100644
index 0000000000000..04c74780365de
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/audit.mdx
@@ -0,0 +1,163 @@
+---
+title: Database Access Audit Events Reference
+sidebar_label: Audit Events
+description: Audit events reference for Teleport database access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+
+(!docs/pages/includes/database-access/db-audit-events.mdx!)
+
+## db.session.start (TDB00I/W)
+
+Emitted when a client successfully connects to a database, or when a connection
+attempt fails due to access denied.
+
+Successful connection event:
+
+```json
+{
+  "cluster_name": "root", // Teleport cluster name.
+  "code": "TDB00I", // Event code.
+  "db_name": "test", // Database/schema name.
+  "db_protocol": "postgres", // Database protocol.
+  "db_service": "local", // Database service name.
+  "db_uri": "localhost:5432", // Database server endpoint.
+  "db_user": "postgres", // Database account name.
+  "ei": 0, // Event index within the session.
+  "event": "db.session.start", // Event name.
+  "namespace": "default", // Event namespace, always "default".
+  "server_id": "05ff66c9-a948-42f4-af0e-a1b6ba62561e", // Database Service host ID.
+  "sid": "63b6fa11-cd44-477b-911a-602b75ab13b5", // Unique database session ID.
+  "success": true, // Indicates successful connection.
+  "time": "2021-04-27T23:00:26.014Z", // Event timestamp.
+  "uid": "eac5b6c8-384a-4471-9559-e135834b1ab0", // Unique event ID.
+  "user": "alice" // Teleport user name.
+}
+```
+
+Access denied event:
+
+```json
+{
+  "cluster_name": "root", // Teleport cluster name.
+  "code": "TDB00W", // Event code.
+  "db_name": "test", // Database/schema name user attempted to connect to.
+  "db_protocol": "postgres", // Database protocol.
+  "db_service": "local", // Database service name.
+  "db_uri": "localhost:5432", // Database server endpoint.
+  "db_user": "superuser", // Database account name user attempted to log in as.
+  "ei": 0, // Event index within the session.
+  "error": "access to database denied", // Connection error.
+  "event": "db.session.start", // Event name.
+  "message": "access to database denied", // Detailed error message.
+  "namespace": "default", // Event namespace, always "default".
+  "server_id": "05ff66c9-a948-42f4-af0e-a1b6ba62561e", // Database Service host ID.
+  "sid": "d18388e5-cc7c-4624-b22b-d36db60d0c50", // Unique database session ID.
+  "success": false, // Indicates unsuccessful connection.
+  "time": "2021-04-27T23:03:05.226Z", // Event timestamp.
+  "uid": "507fe008-99a4-4247-8603-6ba03408d047", // Unique event ID.
+  "user": "alice" // Teleport user name.
+}
+```
+
+## db.session.end (TDB01I)
+
+Emitted when a client disconnects from the database.
+
+```json
+{
+  "cluster_name": "root", // Teleport cluster name.
+  "code": "TDB01I", // Event code.
+  "db_name": "test", // Database/schema name.
+  "db_protocol": "postgres", // Database protocol.
+  "db_service": "local", // Database service name.
+  "db_uri": "localhost:5432", // Database server endpoint.
+  "db_user": "postgres", // Database account name.
+  "ei": 3, // Event index within the session.
+  "event": "db.session.end", // Event name.
+  "sid": "63b6fa11-cd44-477b-911a-602b75ab13b5", // Unique database session ID.
+  "time": "2021-04-27T23:00:30.046Z", // Event timestamp.
+  "uid": "a626b22d-bbd0-40ef-9896-b7ff365664b0", // Unique event ID.
+  "user": "alice" // Teleport user name.
+}
+```
+
+## db.session.query (TDB02I)
+
+Emitted when a client executes a SQL query.
+
+```json
+{
+  "cluster_name": "root", // Teleport cluster name.
+  "code": "TDB02I", // Event code.
+  "db_name": "test", // Database/schema name.
+  "db_protocol": "postgres", // Database protocol.
+  "db_query": "INSERT INTO public.test (id,\"timestamp\",json)\n\tVALUES ($1,$2,$3)", // Query text.
+  "db_query_parameters": [ // Query parameters (for prepared statements).
+    "test-id",
+    "2022-04-02 17:50:20-07",
+    "{\"k\": \"v\"}"
+  ],
+  "db_service": "local", // Database service name.
+  "db_uri": "localhost:5432", // Database server endpoint.
+  "db_user": "postgres", // Database account name.
+  "ei": 29, // Event index within the session.
+  "event": "db.session.query", // Event name.
+  "sid": "691e6f70-3c31-4412-90aa-fe0558abb212", // Unique database session ID.
+  "time": "2021-04-27T23:04:57.395Z", // Event timestamp.
+  "uid": "9f7b4179-b9cf-4302-bb7c-1408e404823f", // Unique event ID.
+  "user": "alice" // Teleport user name.
+}
+```
+
+## db.session.spanner.rpc (TSPN001I/W)
+
+Emitted when a client executes a remote procedure call (RPC), or when an RPC
+execution attempt fails due to access denied.
+
+```json
+{
+  "args": { // RPC arguments (specific to the "procedure" below).
+    "query_options": {},
+    "request_options": {},
+    "seqno": 1,
+    "session": "projects/project-id/instances/instance-id/databases/dev-db/sessions/ABCDEF1234567890",
+    "sql": "select * from TestTable",
+    "transaction": {
+      "Selector": {
+        "SingleUse": {
+          "Mode": {
+            "ReadOnly": {
+              "TimestampBound": {
+                "Strong": true
+              },
+              "return_read_timestamp": true
+            }
+          }
+        }
+      }
+    }
+  },
+  "cluster_name": "root", // Teleport cluster name.
+  "code": "TSPN001I", // Event code.
+  "db_name": "dev-db", // Database name.
+  "db_origin": "dynamic", // Teleport database service config origin.
+  "db_protocol": "spanner", // Database protocol.
+  "db_service": "teleport-spanner", // Database service name.
+  "db_type": "spanner", // Database type.
+  "db_uri": "spanner.googleapis.com:443", // Database service endpoint.
+  "db_user": "some-user", // Database account name, (a GCP IAM service account name without its @<project>.iam.gserviceaccount.com suffix).
+  "ei": 29, // Event index within the session.
+  "event": "db.session.spanner.rpc", // Event name.
+  "procedure": "ExecuteStreamingSql", // Name of the remote procedure call (RPC).
+  "sid": "406b9883-0e16-42f2-9d0b-b3bd956f9cd4", // Unique database session ID.
+  "success": true, // The RPC was allowed by Teleport RBAC.
+  "time": "2024-03-13T00:02:44.739Z", // Event timestamp.
+  "uid": "e0625e79-9399-4ea3-aa8b-dba1eb98658d", // Unique event ID.
+  "user": "alice@example.com" // Teleport user name.
+}
+```
diff --git a/docs/pages/enroll-resources/database-access/reference/aws.mdx b/docs/pages/enroll-resources/database-access/reference/aws.mdx
new file mode 100644
index 0000000000000..f0e031013b097
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/aws.mdx
@@ -0,0 +1,114 @@
+---
+title: Database Access AWS IAM Reference
+sidebar_label: AWS IAM Policies
+description: AWS IAM policies for Teleport database access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+The Teleport Database Service requires IAM permissions for various tasks
+depending on the database type and setup, such as discovering endpoints and
+metadata of the database servers, generating IAM authentication tokens, and
+assuming IAM roles.
+
+You can generate IAM permissions with the [`teleport db configure aws
+print-iam`](cli.mdx)
+command. For example, the following command would generate and print the IAM
+policies:
+
+```code
+$ teleport db configure aws print-iam --types rds,redshift --role teleport-db-service-role
+```
+
+To learn more about IAM permissions for a specific type of database, refer to
+the related section below.
+
+## DocumentDB
+
+(!docs/pages/includes/database-access/reference/aws-iam/documentdb/access-policy.mdx dbUserRole="documentdb-user-role"!)
+
+### IAM role as a DocumentDB database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/documentdb/role-as-user-policy.mdx!)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="documentdb-user-role"!)
+
+## DynamoDB
+
+(!docs/pages/includes/database-access/reference/aws-iam/dynamodb/access-policy.mdx dbUserRole="dynamodb-user-role"!)
+
+### IAM role as a DynamoDB database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/dynamodb/role-as-user-policy.mdx!)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="dynamodb-user-role"!)
+
+## ElastiCache for Redis and Valkey
+
+(!docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx!)
+
+### ElastiCache managed users
+
+(!docs/pages/includes/database-access/reference/aws-iam/redis/auto-password-access-policy.mdx dbType="ElastiCache" permissionType="elasticache" updateUserPermission="ModifyUser" listTagsPermission="ListTagsForResource"!)
+
+## ElastiCache Serverless for Redis and Valkey
+
+(!docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx!)
+
+## Keyspaces
+
+(!docs/pages/includes/database-access/reference/aws-iam/keyspaces/access-policy.mdx dbUserRole="keyspaces-user-role"!)
+
+### IAM role as a Keyspaces database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/keyspaces/role-as-user-policy.mdx!)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="keyspaces-user-role"!)
+
+## MemoryDB
+
+(!docs/pages/includes/database-access/reference/aws-iam/memorydb/access-policy.mdx!)
+
+### MemoryDB managed users
+
+(!docs/pages/includes/database-access/reference/aws-iam/redis/auto-password-access-policy.mdx dbType="MemoryDB" permissionType="memorydb" updateUserPermission="UpdateUser" listTagsPermission="ListTags"!)
+
+## OpenSearch
+
+(!docs/pages/includes/database-access/reference/aws-iam/opensearch/access-policy.mdx dbUserRole="opensearch-user-role"!)
+
+### IAM role as an OpenSearch database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/opensearch/role-as-user-policy.mdx!)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="opensearch-user-role"!)
+
+## RDS
+
+(!docs/pages/includes/database-access/reference/aws-iam/rds/access-policy.mdx!)
+
+## RDS Proxy
+
+(!docs/pages/includes/database-access/reference/aws-iam/rds-proxy/access-policy.mdx!)
+
+## Redshift
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift/access-policy.mdx dbUserRole="redshift-user-role"!)
+
+### IAM role as a Redshift database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx dbUserRole="redshift-user-role"!)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="redshift-user-role"!)
+
+## Redshift Serverless
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift-serverless/access-policy.mdx dbUserRole="redshift-serverless-user-role"!)
+
+### IAM role as a Redshift Serverless database user
+
+(!docs/pages/includes/database-access/reference/aws-iam/redshift-serverless/role-as-user-policy.mdx dbUserRole="redshift-serverless-user-role" !)
+
+(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="redshift-serverless-user-role"!)
diff --git a/docs/pages/enroll-resources/database-access/reference/cli.mdx b/docs/pages/enroll-resources/database-access/reference/cli.mdx
new file mode 100644
index 0000000000000..c1bffc276ff23
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/cli.mdx
@@ -0,0 +1,437 @@
+---
+title: Database Access CLI Reference
+sidebar_label: CLI Commands
+description: CLI reference for Teleport database access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+This reference shows you how to run common commands for managing Teleport
+the Database Service, including:
+
+- The `teleport` daemon command, which is executed on the host where you
+  will run the Teleport Database Service.
+
+- The `tctl` administration tool, which you use to manage `db` resources that
+  represent databases known to your Teleport cluster.
+
+  (!docs/pages/includes/tctl.mdx!)
+
+- The `tsh` client tool, which end-users run in order to access databases in
+  your cluster.
+
+## teleport db start
+
+Starts Teleport Database Service.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ teleport db start \
+    --token=/path/to/token \
+    --auth-server=proxy.example.com:443 \
+    --name=example \
+    --protocol=postgres \
+    --uri=postgres.example.com:5432
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ teleport db start \
+    --token=/path/to/token \
+    --auth-server=mytenant.teleport.sh:443 \
+    --name=example \
+    --protocol=postgres \
+    --uri=postgres.mytenant.teleport.sh:5432
+```
+
+</TabItem>
+
+</Tabs>
+
+| Flag | Description |
+| - | - |
+| `-d/--debug` | Enable verbose logging to stderr. |
+| `--pid-file` | Full path to the PID file. By default no PID file will be created. |
+| `--auth-server` | Address of the Teleport Proxy Service. |
+| `--token` | Invitation token to register with the Auth Service. |
+| `--ca-pin` | CA pin to validate the Auth Service. |
+| `-c/--config` | Path to a configuration file (default `/etc/teleport.yaml`). |
+| `--labels` | Comma-separated list of labels for this node, for example `env=dev,app=web`. |
+| `--fips` | Start Teleport in FedRAMP/FIPS mode. |
+| `--name` | Name of the proxied database. |
+| `--description` | Description of the proxied database. |
+| `--protocol` | Proxied database protocol. Supported are: `postgres` and `mysql`. |
+| `--uri` | Address the proxied database is reachable at. |
+| `--ca-cert` | Database CA certificate path. |
+| `--aws-region` | (Only for RDS, Aurora or Redshift) AWS region RDS, Aurora or Redshift database instance is running in. |
+| `--aws-redshift-cluster-id` | (Only for Redshift) Redshift database cluster identifier. |
+| `--gcp-project-id` | (Only for Cloud SQL) GCP Cloud SQL project identifier. |
+| `--gcp-instance-id` | (Only for Cloud SQL) GCP Cloud SQL instance identifier.|
+
+## teleport db configure create
+
+Creates a sample Database Service configuration.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
+$ teleport db configure create \
+  --token=/tmp/token \
+  --proxy=proxy.example.com:443 \
+  --name=example \
+  --protocol=postgres \
+  --uri=postgres://postgres.example.com:5432 \
+  --labels=env=prod
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
+$ teleport db configure create \
+  --token=/tmp/token \
+  --proxy=mytenant.teleport.sh:443 \
+  --name=example \
+  --protocol=postgres \
+  --uri=postgres://postgres.mytenant.teleport.sh:5432 \
+  --labels=env=prod
+```
+
+</TabItem>
+
+</Tabs>
+
+| Flag | Description |
+| - | - |
+| `--proxy` | Teleport Proxy Service address to connect to. Default: `0.0.0.0:3080`. |
+| `--token` | Invitation token to register with the Auth Service. Default: none. |
+| `--rds-discovery` | List of AWS regions in which the agent will discover RDS/Aurora instances. |
+| `--rdsproxy-discovery` | List of AWS regions in which the agent will discover RDS Proxies. |
+| `--redshift-discovery` | List of AWS regions in which the agent will discover Redshift instances. |
+| `--redshift-serverless-discovery` | List of AWS regions in which the agent will discover Redshift Serverless instances. |
+| `--elasticache-discovery` | List of AWS regions in which the agent will discover ElastiCache Redis and Valkey clusters. |
+| `elasticache-serverless-discovery` | List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches. |
+| `--aws-tags` | (Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it |
+| `--memorydb-discovery` | List of AWS regions in which the agent will discover MemoryDB clusters. |
+| `--azure-mysql-discovery` | List of Azure regions in which the agent will discover MySQL servers. |
+| `--azure-postgres-discovery` | List of Azure regions in which the agent will discover Postgres servers. |
+| `--azure-redis-discovery` | List of Azure regions in which the agent will discover Azure Cache For Redis servers. |
+| `--azure-subscription` | List of Azure subscription IDs for Azure discoveries. Default is "*". |
+| `--azure-resource-group` | List of Azure resource groups for Azure discoveries. Default is "*". |
+| `--azure-tags` | (Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it |
+| `--ca-pin` | CA pin to validate the Auth Service (can be repeated for multiple pins). |
+| `--name` | Name of the proxied database. |
+| `--protocol` | Proxied database protocol. Refer to the [configuration](./configuration.mdx#database-service-configuration) reference for supported values. |
+| `--uri` | Address the proxied database is reachable at. |
+| `--labels` | Comma-separated list of labels for the database, for example env=dev,dept=it |
+| `-o/--output` | Write to stdout with `--output=stdout`, the default config file with `--output=file`, or a custom path with `--output=file:///path` |
+| `--dynamic-resources-labels` | Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching. |
+
+## teleport db configure bootstrap
+
+Bootstrap the necessary configuration for the Database Service. It reads the
+provided configuration to determine what will be bootstrapped.
+
+```code
+$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
+$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
+$ teleport db configure bootstrap -c /etc/teleport.yaml --manual
+```
+
+| Flag | Description |
+| - | - |
+| `-c/--config` | Path to a configuration file. Default: `/etc/teleport.yaml`. |
+| `--manual` | When executed in "manual" mode, this command will print the instructions to complete the configuration instead of applying them directly. |
+| `--policy-name` | Name of the Teleport Database Service policy. Default: `DatabaseAccess` |
+| `--confirm` | Do not prompt the user and auto-confirm all actions. |
+| `--attach-to-role` | Role name to attach the policy to. Mutually exclusive with `--attach-to-user`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
+| `--attach-to-user` | User name to attach the policy to. Mutually exclusive with `--attach-to-role`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
+
+## teleport db configure aws print-iam
+
+Print the necessary IAM permissions required for the Database Service based on
+provided database types.
+
+```code
+$ teleport db configure aws print-iam --types rds
+$ teleport db configure aws print-iam --types rds,redshift --role my-db-service-role
+$ teleport db configure aws print-iam --types redshift-serverless --assumes-roles my-access-role --policy
+```
+
+| Flag | Description |
+| - | - |
+| `-r/--types` | Comma-separated list of database types to include in the policy. Any of `rds`, `rdsproxy`, `redshift`, `redshift-serverless`, `elasticache`, `elasticache-serverless`, `memorydb`, `keyspace`, `dynamodb`, `opensearch`. |
+| `--role` | IAM role name to attach policy to. Mutually exclusive with --user. |
+| `--user` | IAM user name to attach policy to. Mutually exclusive with --role. |
+| `--[no-]policy` | Only print an IAM policy document. |
+| `--[no-]boundary` | Only print an IAM boundary policy document. |
+| `--assumes-roles` | Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account. |
+
+## tctl auth sign
+
+When invoked with a `--format=db` (or `--format=mongodb` for MongoDB) flag,
+produces a CA certificate, a client certificate and a private key file used for
+configuring the Database Service with self-hosted database instances.
+
+<Admonition type="note" title="Note">
+  For database formats, `tctl` must be run on an Auth Service host or the remote
+  user must be be able to impersonate the built-in `Db` role and user. See the
+  [impersonation guide](../../../zero-trust-access/authentication/impersonation.mdx)
+  for details on how to allow impersonation.
+</Admonition>
+
+```code
+$ tctl auth sign --format=db --host=db.example.com --out=db --ttl=2190h
+$ tctl auth sign --format=db --host=host1,localhost,127.0.0.1 --out=db --ttl=2190h
+```
+
+In this example, `db.example.com` is the hostname where the Teleport Database
+Service can reach the database server. The second example assumes a
+database running on the same host as Teleport.
+
+| Flag | Description |
+| - | - |
+| `--format` | When given value `db`, produces secrets in database compatible format. Use `mongodb` when generating MongoDB secrets. |
+| `--host` | Comma-separated SANs to encode in the certificate. Must contain the hostname Teleport will use to connect to the database. |
+| `--out` | Name prefix for output files. |
+| `--ttl` | Certificate validity period. |
+
+<details>
+<summary>Setting up RBAC for signing database certificates</summary>
+
+The `tctl` user must have permissions to impersonate the Teleport Database
+Service role, `Db`, in order to generate a signed database certificate. To add
+these impersonation privileges to your Teleport user, run the following
+commands.
+
+First, define a role that can impersonate the `Db` user. Add the following
+content to a file called `db-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: db-impersonator
+spec:
+  options:
+  allow:
+    impersonate:
+      users: ['Db']
+      roles: ['Db']
+```
+
+Create the role:
+
+```code
+$ tctl create -f db-impersonator.yaml
+```
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+Open your Teleport user's dynamic configuration resource in your editor so you
+can add the `db-impersonator` role:
+
+```code
+$ TELEPORT_USER=<your user>
+$ tctl edit user/${TELEPORT_USER?}
+```
+
+Add the `db-impersonator` role:
+
+```diff
+spec:
+   - access
+   - auditor
+   - editor
++  - db-impersonator
+   status:
+     is_locked: false
+```
+
+Update your user by saving and closing the file in your editor.
+
+Log out of your Teleport cluster and log in again. You will now be able to run
+`tctl auth sign` for database-specific certificate formats.
+
+</details>
+
+(!docs/pages/includes/database-access/ttl-note.mdx!)
+
+## tctl db ls
+
+Administrative command to list all databases registered with the cluster.
+
+```code
+$ tctl db ls
+$ tctl db ls --format=yaml
+```
+
+| Flag | Description |
+| - | - |
+| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `text`. |
+
+## tctl get db
+
+Prints the list of all configured database resources.
+
+| Flag | Description |
+| - | - |
+| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `yaml`. |
+
+## tctl get db/database-resource-name
+
+Prints details about `database-resource-name` database resource.
+
+| Flag | Description |
+| - | - |
+| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `yaml`. |
+
+## tctl rm db/database-resource-name
+
+Removes database resource called `database-resource-name`.
+
+## tsh db ls
+
+Lists the databases available to the user based on
+[RBAC](../../../enroll-resources/database-access/rbac.mdx) and their connection
+information.
+
+```code
+# List all databases.
+$ tsh db ls
+# Search databases with keywords.
+$ tsh db ls --search foo,bar
+# Filter databases with labels.
+$ tsh db ls key1=value1,key2=value2
+# List databases from all clusters with extra fields.
+$ tsh db ls --all -v
+# Get database names using "jq".
+$ tsh db ls --format json  | jq -r '.[].metadata.name'
+```
+
+| Flag | Description |
+| - | - |
+| `--search` | List of comma separated search keywords or phrases enclosed in quotations (e.g. `--search=foo,bar,"some phrase"`). |
+| `--query`  | Query by predicate language enclosed in single quotes. (e.g. `--query='labels["key1"] == "value1" && labels["key2"] != "value2"')`. |
+| `--format` | Format output (`text`, `json`, `yaml`). |
+
+## tsh db login
+
+Retrieves database credentials.
+
+```code
+$ tsh db login example
+$ tsh db login --db-user=postgres --db-name=postgres example
+```
+
+| Flag | Description |
+| - | - |
+| `--db-user` | The database user to log in as. |
+| `--db-name` | The database name to log in to. |
+| `--db-roles` | Comma-separated list of database roles to use for auto-provisioned user. If not provided, all database roles will be assigned. |
+
+(!docs/pages/includes/db-user-name-flags.mdx!)
+
+## tsh db logout
+
+Removes database credentials.
+
+```code
+$ tsh db logout example
+$ tsh db logout
+```
+
+## tsh db connect
+
+Connect to a database using its CLI client.
+
+```code
+# Short syntax when only logged into a single database.
+$ tsh db connect
+# Specify database service to connect to explicitly.
+$ tsh db connect example
+# Provide database user and name to connect to.
+$ tsh db connect --db-user=alice --db-name=db example
+# Select a subset of allowed database roles.
+$ tsh db connect --db-user=alice --db-name=db --db-roles reader example
+```
+
+<Admonition type="note" title="Note">
+  Respective database CLI clients (`psql`, `mysql`, `mongo` or `mongosh`) should be
+  available in PATH.
+</Admonition>
+
+| Flag | Description |
+| - | - |
+| `--db-user` | The database user to log in as. |
+| `--db-name` | The database name to log in to. |
+| `--db-roles` | Comma-separated list of database roles to use for auto-provisioned user. If not provided, all database roles will be assigned. |
+
+(!docs/pages/includes/db-user-name-flags.mdx!)
+
+## tsh db exec
+
+Execute database commands on target database services.
+```code
+# Search databases with labels.
+$ tsh db exec "source my_script.sql" --db-user mysql --labels key1=value1,key2=value2
+# Search databases with keywords.
+$ tsh db exec "select 1" --db-user mysql --db-name mysql --search foo,bar
+# Execute a command on specified target databases without confirmation.
+$ tsh db exec "select @@hostname" --db-user mysql --dbs mydb1,mydb2,mydb3 --no-confirm
+# Run commands in parallel, and save outputs to files.
+$ tsh db exec "select 1" --db-user mysql --labels env=dev --parallel=5 --output-dir=exec-outputs
+```
+
+<Admonition type="note" title="Note">
+  Currently only PostgreSQL and MySQL databases are supported. Respective
+  database CLI clients (`psql`, `mysql`) should be available in PATH.
+</Admonition>
+
+{/* vale messaging.capitalization = NO */}
+
+| Flag | Description |
+| - | - |
+| `--db-user` | The database user to log in as. |
+| `--db-name` | The database name to log in to. |
+| `--db-roles` | List of comma separate database roles to use for auto-provisioned user. |
+| `--dbs` |  List of comma separated target database services. Mutually exclusive with `--search` or `--labels`. |
+| `--search` | List of comma separated search keywords or phrases enclosed in quotations (e.g. `--search=foo,bar,"some phrase"`). |
+| `--labels` | List of comma separated labels to filter by labels (e.g. `key1=value1,key2=value2`). |
+| `--output-dir` | Directory to store command output per target database service. A summary is saved as "summary.json". |
+| `--[no-]confirm` | Confirm selected database services before executing command. |
+
+{/* vale messaging.capitalization = YES */}
+
+## tsh db env
+
+Outputs environment variables for a particular database.
+
+```code
+$ tsh db env
+$ tsh db env example
+$ eval $(tsh db env)
+```
+
+## tsh db config
+
+Prints database connection information. Useful when configuring GUI clients.
+
+```code
+$ tsh db config
+$ tsh db config example
+$ tsh db config --format=cmd example
+```
+
+| Flag | Description |
+| - | - |
+| `--format` | Output format: `text` is default, `cmd` to print native database client connect command. |
diff --git a/docs/pages/enroll-resources/database-access/reference/configuration.mdx b/docs/pages/enroll-resources/database-access/reference/configuration.mdx
new file mode 100644
index 0000000000000..3e8976fa00b48
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/configuration.mdx
@@ -0,0 +1,130 @@
+---
+title: Database Access Configuration Reference
+sidebar_label: Configuration
+description: Configuration reference for Teleport database access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+This guide explains configuration options for the Teleport Database Service,
+which proxies user traffic between Teleport users and protected databases. 
+
+## Database service configuration
+
+The following snippet shows full YAML configuration of a Database Service
+appearing in `teleport.yaml` configuration file:
+
+```yaml
+(!docs/pages/includes/config-reference/database-config.yaml!)
+```
+
+## Proxy configuration
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+The following Proxy service configuration is relevant for database access:
+
+<Admonition
+type="warning"
+title="TLS for database connections"
+>
+The `--insecure-no-tls` `tsh` flag is only supported for MySQL/MariaDB and PostgreSQL
+connections using a unique port, specified with `mysql_public_addr` or `postgres_public_addr`.
+</Admonition>
+
+```yaml
+proxy_service:
+  enabled: true
+  # Database proxy is listening on the regular web proxy port.
+  web_listen_addr: "0.0.0.0:443"
+  # MySQL proxy is listening on a separate port and needs to be enabled
+  # on the proxy server.
+  mysql_listen_addr: "0.0.0.0:3036"
+  # MySQL Server version allows you to overwrite the default Teleport Proxy Service MySQL version (8.0.0-Teleport)
+  # Note that if the MySQL client connection is using TLS Routing the dynamic MySQL Server Version takes
+  # precedence over the mysql_server_version proxy settings.
+  # mysql_server_version: "8.0.4"
+  # Postgres proxy listening address. If provided, proxy will use a separate listener
+  # instead of multiplexing Postgres protocol on web_listener_addr.
+  # postgres_listen_addr: "0.0.0.0:5432"
+  # Mongo proxy listening address. If provided, proxy will use a separate listener
+  # instead of multiplexing Mongo protocol on web_listener_addr.
+  # mongo_listen_addr: "0.0.0.0:27017"
+  # By default database clients will be connecting to the Proxy over this
+  # hostname. To override public address for specific database protocols
+  # use postgres_public_addr and mysql_public_addr.
+  public_addr: "teleport.example.com:443"
+  # Address advertised to MySQL clients. If not set, public_addr is used.
+  mysql_public_addr: "mysql.teleport.example.com:3306"
+  # Address advertised to PostgreSQL clients. If not set, public_addr is used.
+  postgres_public_addr: "postgres.teleport.example.com:443"
+  # Address advertised to Mongo clients. If not set, public_addr is used.
+  mongo_public_addr: "mongo.teleport.example.com:443"
+```
+
+</TabItem>
+<TabItem label="Cloud-Hosted">
+
+Teleport Enterprise Cloud automatically configures the Teleport Proxy Service
+with the following settings that are relevant to database access. This reference
+configuration uses `example.teleport.sh` in place of your Teleport Enterprise
+Cloud tenant address:
+
+```yaml
+proxy_service:
+  enabled: true
+  # Database proxy is listening on the regular web proxy port.
+  web_listen_addr: "0.0.0.0:3080"
+  # MySQL proxy is listening on a separate port.
+  mysql_listen_addr: "0.0.0.0:3036"
+  # Database clients will connect to the Proxy Service over this hostname.
+  public_addr: "mytenant.teleport.sh:443"
+  # Address advertised to MySQL clients.
+  mysql_public_addr: "mytenant.teleport.sh:3036"
+  # Address advertised to PostgreSQL clients.
+  postgres_public_addr: "mytenant.teleport.sh:443"
+  # Address advertised to Mongo clients. If not set, public_addr is used.
+  mongo_public_addr: "mongo.teleport.example.com:443
+```
+
+</TabItem>
+</Tabs>
+
+## Database resource
+
+Full YAML spec of database resources managed by `tctl` resource commands:
+
+(!docs/pages/includes/reference/resources/db.mdx!)
+
+You can create a new `db` resource by running the following commands, which
+assume that you have created a YAML file called `db.yaml` with your configuration:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+# Create the resource
+$ tctl create -f db.yaml
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+
+```code
+# Log in to your Teleport cluster so you can use tctl from your local machine.
+$ tsh login --proxy=mytenant.teleport.sh --user=myuser
+# Create the resource
+$ tctl create -f db.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
diff --git a/docs/pages/enroll-resources/database-access/reference/labels.mdx b/docs/pages/enroll-resources/database-access/reference/labels.mdx
new file mode 100644
index 0000000000000..96831240a3cbf
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/labels.mdx
@@ -0,0 +1,84 @@
+---
+title: Database Labels Reference
+sidebar_label: Labels
+description: Database labels reference for Teleport database access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+Teleport assigns system-defined labels to protected databases. This guide
+describes the system-defined labels and how Teleport uses them.
+
+## Origin
+
+All registered databases have a predefined `teleport.dev/origin` label with one
+of the following values:
+
+| Label Value | Description |
+| - | - |
+| `cloud`   | database resources created by auto-discovery. |
+| `config`  | database resources manually defined in the `database_service.databases` section of `teleport.yaml`. |
+| `dynamic` | database resources created through [dynamic registration](../../../enroll-resources/database-access/guides/dynamic-registration.mdx) like `tcl create` command. |
+
+## Auto-discovery
+
+The labels of auto-discovered databases primarily come from the tags that are
+assigned to the original cloud resources, such as the resources tags of an
+Amazon RDS instance. 
+
+The following tags will override Teleport's default behavior if assigned to the
+original cloud resources:
+
+| Tag name | Description |
+| - | - |
+| `TeleportDatabaseName`                   | Overrides the name of the discovered database. |
+| `teleport.dev/database_name`             | (AWS only, legacy) Overrides the name of the discovered database. `TeleportDatabaseName` is preferred. |
+| `teleport.dev/db-admin`                  | (AWS only) Specifies the name of the admin user for Automatic User Provisioning. |
+| `teleport.dev/db-admin-default-database` | (AWS only) Overrides the default database the admin user logs into for Automatic User Provisioning. |
+
+Additionally, Teleport will generate certain labels derived from the cloud
+resource attributes:
+
+| Label name | Description |
+| - | - |
+| `account-id`       | ID of the AWS account the resource resides in. |
+| `endpoint-type`    | Type of the endpoint. See section below for more details. |
+| `engine`           | Amazon RDS: engine type of the RDS instance or Aurora cluster.<br/>Amazon RDS Proxy: engine family of the proxy.<br/>Azure-hosted databases: resource type of the resource ID. |
+| `engine-version`   | Database engine version, if available. |
+| `namespace`        | Amazon Redshift Serverless namespace name. |
+| `region`           | AWS region or Azure location. |
+| `replication-role` | The replication role of an Azure DB Flexible server. |
+| `source-server`    | The source server of an Azure DB Flexible server replica. |
+| `vpc-id`           | ID of the Amazon VPC the resource resides in. Available for RDS, ElastiCache and MemoryDB databases. |
+| `workgroup`        | Amazon Redshift Serverless workgroup name. |
+| `teleport.dev/discovery-type` | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "rds", "redshift", etc. |
+
+### `endpoint-type`
+
+The following values are used to indicate the type of the database endpoint:
+
+| Database Type | Values |
+| - | - |
+| Amazon RDS instance              | `instance` |
+| Amazon RDS Aurora cluster        | one of `primary`, `reader`, `custom` |
+| Amazon RDS Proxy                 | one of `READ_WRITE`, `READ_ONLY` (custom endpoints only) |
+| Amazon Redshift Serverless       | one of `workgroup`, `vpc-endpoint` |
+| Amazon ElastiCache               | one of `configuration`, `primary`, `reader`, `node` |
+| Amazon MemoryDB                  | one of `cluster`, `node` |
+| Amazon OpenSearch                | one of `default`, `custom`, `vpc` |
+| Azure Redis Enterprise           | one of `EnterpriseCluster`, `OSSCluster` |
+
+## Manual and dynamic registration
+
+Static labels and dynamic labels can be specified in `labels` and
+`dynamic_labels` fields respectively in database definition. See
+[Configuration](./configuration.mdx) for reference.
+
+## Database Service on Amazon EC2
+
+All registered databases can inherit the labels converted from the tags of the
+EC2 instance running the Teleport Database Service. Labels created this way
+will have the `aws/` prefix. See [Sync EC2
+Tags](../../../enroll-resources/automatic-labels/ec2-tags.mdx) for more details.
diff --git a/docs/pages/enroll-resources/database-access/reference/reference.mdx b/docs/pages/enroll-resources/database-access/reference/reference.mdx
new file mode 100644
index 0000000000000..a918dbc14725f
--- /dev/null
+++ b/docs/pages/enroll-resources/database-access/reference/reference.mdx
@@ -0,0 +1,15 @@
+---
+title: Database Access Reference
+sidebar_label: Reference
+sidebar_position: 8
+description: Configuration and CLI reference for the Teleport Database Service.
+tags:
+ - zero-trust
+ - infrastructure-identity
+---
+
+- [Configuration](configuration.mdx)
+- [CLI](cli.mdx)
+- [Audit Events](audit.mdx)
+- [AWS IAM](aws.mdx)
+- [Database Labels](labels.mdx)
diff --git a/docs/pages/enroll-resources/database-access/troubleshooting.mdx b/docs/pages/enroll-resources/database-access/troubleshooting.mdx
index 4aadd877c5808..908433e654fa5 100644
--- a/docs/pages/enroll-resources/database-access/troubleshooting.mdx
+++ b/docs/pages/enroll-resources/database-access/troubleshooting.mdx
@@ -1,12 +1,23 @@
 ---
 title: Troubleshooting Database Access
-description: Common issues and resolutions for Teleport's Database Access
+sidebar_label: Troubleshooting
+description: Common issues and resolutions for protecting databases with Teleport.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Common issues and resolution steps.
 
 ## Connection attempts fail
 
+### Timeout errors
+
+Attempts to connect to the database fail with a message similar to **"dial tcp ... i/o timeout"**.
+
+(!docs/pages/includes/database-access/connection-timeout-troubleshooting.mdx!)
+
 ### Certificate expired or is not yet valid
 
 Attempts to connect to the database fail, and the error message returned is
@@ -35,16 +46,16 @@ Service can reach the PostgreSQL server.
 Each database uses a different format. You can check your database guide for more
 details and examples:
 
-- [PostgreSQL](./enroll-self-hosted-databases/postgres-self-hosted.mdx#step-25-create-a-certificatekey-pair)
-- [MySQL/MariaDB](./enroll-self-hosted-databases/mysql-self-hosted.mdx#step-24-create-a-certificatekey-pair)
-- [MongoDB](./enroll-self-hosted-databases/mongodb-self-hosted.mdx#set-up-mutual-tls)
-- [CockroachDB](./enroll-self-hosted-databases/cockroachdb-self-hosted.mdx#set-up-mutual-tls)
-- [Redis](./enroll-self-hosted-databases/redis.mdx#step-45-set-up-mutual-tls)
-- [Redis Cluster](./enroll-self-hosted-databases/redis-cluster.mdx#step-46-set-up-mutual-tls)
+- [PostgreSQL](enrollment/self-hosted/postgres-self-hosted.mdx#step-25-create-a-certificatekey-pair)
+- [MySQL/MariaDB](enrollment/self-hosted/mysql-self-hosted.mdx#step-24-create-a-certificatekey-pair)
+- [MongoDB](enrollment/self-hosted/mongodb-self-hosted.mdx#set-up-mutual-tls)
+- [CockroachDB](enrollment/self-hosted/cockroachdb-self-hosted.mdx#set-up-mutual-tls)
+- [Redis](enrollment/self-hosted/redis.mdx#step-45-set-up-mutual-tls)
+- [Redis Cluster](enrollment/self-hosted/redis-cluster.mdx#step-46-set-up-mutual-tls)
 
 After the new certificate is issued, update your database to make it take effect.
 
-## Access to db denied
+### Access to db denied
 
 Attempts to connect to the database fail with an error message
 similar to: **"access to db denied"**.
@@ -146,17 +157,17 @@ This example is intentionally simple; we could have configured Alice's permissio
 For more detailed information about database access controls and how to restrict
 access see the [RBAC](../database-access/rbac.mdx) documentation.
 
-## Connection to MySQL database results in "Unknown system variable 'query_cache_size'" error
+### Connection to MySQL database results in "Unknown system variable 'query_cache_size'" error
 
 When TLS Routing is disable by default, the Teleport Proxy Service returns `8.0.0-Teleport` as the MySQL server version. In some cases, like connecting with a GUI Client, this can result in obtaining an `Unknown system variable 'query_cache_size'` error that indicates that MySQL capabilities were not properly negotiated between the MySQL client and server.
 
 One way to solve this issue is to [use the TLS Routing
-feature](../../admin-guides/management/operations/tls-routing.mdx), where the Teleport Proxy
+feature](../../zero-trust-access/deploy-a-cluster/tls-routing.mdx), where the Teleport Proxy
 Service propagates the correct MySQL server version via TLS Routing extensions.
 
 If migration to TLS Routing is not possible, another way to bypass this error is
 to use the [Teleport local proxy
-command](../../connect-your-client/gui-clients.mdx#get-connection-information),
+command](../../connect-your-client/third-party/gui-clients.mdx#how-gui-clients-access-teleport-protected-databases),
 which allows you to establish a TLS Routing connection to the Teleport Proxy
 Service even if TLS Routing was not enabled on the Teleport cluster.
 
diff --git a/docs/pages/enroll-resources/desktop-access/active-directory.mdx b/docs/pages/enroll-resources/desktop-access/active-directory.mdx
index 113882b977ea8..b0bb96efb3454 100644
--- a/docs/pages/enroll-resources/desktop-access/active-directory.mdx
+++ b/docs/pages/enroll-resources/desktop-access/active-directory.mdx
@@ -1,8 +1,12 @@
 ---
-title: Configure access for Active Directory manually
+title: Configure Access for Active Directory Manually
+sidebar_label: Manual Registration
 description: Explains how to manually connect Teleport to an Active Directory domain.
 videoBanner: YvMqgcq0MTQ
-tocDepth: 3
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide demonstrates how to connect an Active Directory domain and how to log
@@ -17,33 +21,15 @@ Service for Microsoft Entra ID.
 
 To complete the steps in this guide, verify your environment meets the following requirements:
 
-- Access to a running Teleport cluster, `tctl` admin tool, and `tsh` client tool
-  version >= (=teleport.version=).
-
-  You can verify the tools you have installed by running the following commands:
-
-  ```code
-  $ tctl version
-  # Teleport Enterprise v(=teleport.version=) go(=teleport.golang=)
-
-  $ tsh version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  You can download these tools by following the appropriate [Installation
-  instructions](../../installation.mdx#linux) for the Teleport
-  edition you use.
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - A Linux server to run the Teleport Windows Desktop Service.
   You can use an existing server that runs the Teleport Agent for other resources.
-
 - An Active Directory domain that is configured for LDAPS. Because Teleport requires an
   encrypted LDAP connection, you should verify that your domain uses Active Directory
   Certificate Services or a non-Microsoft certification authority (CA) to issue LDAPS
   certificates.
-
 - Administrative access to a domain controller.
-
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Option 1: Automated configuration
@@ -599,7 +585,8 @@ To configure Teleport to protect access to Windows desktops:
    windows_desktop_service:
      enabled: true
      ldap:
-       # Port must be included for the addr.
+       # Address (including port) of an LDAP server.
+       # Can be omitted if `locate_server` is enabled.
        # LDAPS port is 636 by default (example.com:636)
        addr: "$LDAP_SERVER_ADDRESS"
        domain: "$LDAP_DOMAIN_NAME"
@@ -618,7 +605,48 @@ To configure Teleport to protect access to Windows desktops:
    ```
 
    For a detailed description of the configuration fields, see
-   [Desktop Configuration Reference](../../reference/agent-services/desktop-access-reference/configuration.mdx).
+   [Desktop Configuration Reference](reference/configuration.mdx).
+
+1. Configure LDAP server selection.
+
+   To find desktops to connect to in Active Directory, Teleport must be given the
+   address of an LDAP server. There are two ways to specify the LDAP server, either
+   by providing a single LDAP server address in the `addr` field, or by enabling
+   `locate_server` to automatically discover the LDAP server from DNS SRV records.
+
+   If you opt to use `addr`, for the best results, the address should point to a
+   highly-available endpoint to avoid downtime. The port for LDAPS should also be
+   included, which is typically 636.
+
+   <details>
+   <summary>Example of using the addr field</summary>
+   ```yaml
+   windows_desktop_service:
+      enabled: true
+      ldap:
+         addr: ldap.example.com:636
+         domain: example.com
+   ```
+   </details>
+
+   Alternatively, you can enable `locate_server` to automatically discover an
+   LDAP server from the DNS SRV records of your specified `domain`. This is useful
+   if you have multiple LDAP servers for high availability and load balancing.
+   Optionally, you can specify a `site` to limit the discovery to a specific
+   Active Directory site.
+
+   <details>
+   <summary>Example of using locate_server</summary>
+   ```yaml
+   windows_desktop_service:
+      enabled: true
+      ldap:
+         locate_server:
+            enabled: true
+            site: "my-site" # optional
+         domain: example.com
+   ```
+   </details>
 
 1. (!docs/pages/includes/start-teleport.mdx service="the Teleport Desktop Service"!)
 
@@ -684,7 +712,7 @@ To connect to a Windows desktop:
 In Active Directory environments, Teleport can be configured to discover hosts
 via LDAP. LDAP discovery is enabled by adding one or more discovery configs to
 the `discovery_configs` field in the Teleport Windows Desktop Service
-configuration. You can set `base_dn` to a wildcard `'*` to search from the root
+configuration. You can set `base_dn` to a wildcard `'*'` to search from the root
 of the domain, or you can specify an alternate base distinguished name to search
 from.
 
@@ -813,34 +841,79 @@ In order to perform NLA, Teleport's `windows_desktop_service` needs to be able
 to make an outbound Kerberos connection to a key distribution center (KDC). This
 is most commonly performed on TCP port 88.
 
-By default, Teleport will assume that a KDC is available on the same host that
-is specified in the `ldap` configuration's `addr` field, using the default
-Kerberos port.
+Teleport determines the address of the KDC by checking the following (in order of priority):
+
+1. If `kdc_address` is set, Teleport will use this address.
+1. As of version 18.3.1, if `locate_server` is enabled and `kdc_address` is
+   not set, Teleport will attempt to discover the KDC address via DNS SRV records.
+1. If neither `locate_server` or `kdc_address` is specified, Teleport will
+   assume that a KDC is available on the same host that is specified in the
+   `ldap` configuration's `addr` field.
 
-For example, with the following configuration, Teleport will attempt to perform
-NLA against `example.com:88`.
+For example, you can set the KDC address by specifying the `kdc_address`
+in your Teleport configuration file.
 
 ```yaml
 windows_desktop_service:
     enabled: true
-    ldap:
-      addr: example.com:636
+    kdc_address: kdc.example.com   # defaults to port 88 if unspecified
 ```
 
-Alternatively, you can override the KDC address by specifying the `kdc_address`
-in your Teleport configuration file.
+If you're using the `locate_server` option, Teleport will perform a DNS
+SRV lookup on the provided `domain` (e.g. `_kerberos._tcp.my-site._sites.example.com`).
+NLA will be performed against the highest-priority and reachable KDC.
+
+```yaml
+windows_desktop_service:
+   enabled: true
+    
+   locate_server: 
+      enabled: true
+      site: "my-site" # optional
+   domain: example.com
+```
+
+If server location is disabled and `kdc_address` isn't specified, with the following configuration, 
+Teleport will attempt to perform NLA against `example.com:88`.
 
 ```yaml
 windows_desktop_service:
     enabled: true
-    kdc_address: kdc.example.com   # defaults to port 88 if unspecified
+
+    ldap:
+      addr: example.com:636
 ```
 
 To enable NLA, set the `TELEPORT_ENABLE_RDP_NLA` environment variable to `yes`
-on any hosts running the Teleport's `windows_desktop_service`. Note that NLA is
-only supported when connecting to hosts that are part of an Active Directory
-domain. Teleport will not perform NLA when connecting to hosts as a local
-Windows user.
+on any hosts running the Teleport's `windows_desktop_service`. The process for
+setting an environment variable varies depending on the environment in which you
+are running Teleport.
+
+If you're running Teleport in Kubernetes, you'll need to
+[edit the Pod configuration](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/).
+
+If you're running Teleport as a systemd service, then you'll want to create a
+systemd override using `systemctl edit teleport`:
+
+```
+$ sudo systemctl edit teleport
+```
+
+This will open a text editor where you can insert an override for the environment:
+
+```
+### Editing /etc/systemd/system/teleport.service.d/override.conf
+### Anything between here and the comment below will become the contents of the drop-in file
+
+[Service]
+Environment="TELEPORT_ENABLE_RDP_NLA=yes"
+```
+
+Note that NLA is only supported when connecting to hosts that are part of an
+Active Directory domain. Teleport will not perform NLA when connecting to hosts
+as a local Windows user.
+
+NLA is not supported when Teleport runs in FIPS mode.
 
 ### Computer Name
 
diff --git a/docs/pages/enroll-resources/desktop-access/desktop-access.mdx b/docs/pages/enroll-resources/desktop-access/desktop-access.mdx
index 71eb5a11e1cb6..a906b7c857cc5 100644
--- a/docs/pages/enroll-resources/desktop-access/desktop-access.mdx
+++ b/docs/pages/enroll-resources/desktop-access/desktop-access.mdx
@@ -1,6 +1,107 @@
 ---
 title: Windows Desktops
-description: Guides to protecting Windows desktops with Teleport
+description: Protect Windows Resources with Teleport's passwordless access and other features.
+sidebar_position: 7
+template: doc-page
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
-<DocCardList />
+import DocHero from "@site/src/components/Pages/Landing/DocHero";
+import Resources from "@site/src/components/Pages/Homepage/Resources";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+
+import userCheckSvg from "@site/src/components/Icon/svg/user-check.svg";
+import questionSvg from "@site/src/components/Icon/svg/question2.svg";
+import slidersHorizontalSvg from "@site/src/components/Icon/svg/sliders-horizontal.svg";
+import keyholeSvg from "@site/src/components/Icon/svg/keyhole.svg";
+import activeDirectorySvg from "@site/src/components/Icon/svg/active-directory.svg";
+import windowsSvg from "@site/src/components/Icon/svg/windows2.svg";
+import windowsDesktopsSvg from "@site/src/components/Icon/teleport-svg/windows-desktops.svg";
+import folderNotchOpenSvg from "@site/src/components/Icon/svg/folder-notch-open.svg";
+
+<DocHero
+  title="Configure access for local Windows users"
+  youtubeVideoId={
+    // cspell:disable-next-line
+    "n2h0GisWdss"
+  }
+  ctaLinks={[
+    {
+      title: "Get started with Windows access",
+      href: "./getting-started/",
+      variant: "secondary",
+      arrow: true,
+    },
+  ]}
+  linksDesktopColumnCount={3}
+  links={[
+    {
+      title: "Windows desktop RBAC",
+      description: "Set up granular access policies for Windows desktops connected to Teleport.",
+      href: "./rbac/",
+      icon: userCheckSvg,
+    }, 
+    {
+      title: "Desktop config options",
+      description: "Configure access, audit events, sessions recordings, user creation and more.",
+      href: "../../reference/agent-services/desktop-access-reference/",
+      icon: slidersHorizontalSvg,
+    },
+    {
+      title: "Troubleshooting",
+      description: "Common Windows desktop access issues with Teleport and their solutions.",
+      href: "./troubleshooting/",
+      icon: questionSvg,
+    },
+  ]}
+>
+Provide secure, passwordless access to Microsoft Windows desktops and servers, backed by short-lived certificates, role-based access controls, clipboard and directory sharing, session recordings, and detailed audit logs.
+</DocHero>
+{/*vale messaging.protocol-products = NO*/}
+<Resources
+  title="Access guides"
+  variant="doc"
+  desktopColumnsCount={3}
+  resources={[
+    {
+      title: "Intro to Windows desktop access",
+      description: "Windows desktop and server access with clipboard and file sharing, session recording, and audit logs.",
+      iconComponent: keyholeSvg,
+      href: "./introduction/"
+    },
+    {
+      title: "Active Directory",
+      description: "Connect an Active Directory domain and log into a Windows Desktop from the connected domain.",
+      iconComponent: activeDirectorySvg,
+      href: "./active-directory/"
+    },
+    {
+      title: "Local Windows users",
+      description: "Provide secure, passwordless access to Microsoft Windows desktops for local Windows users.",
+      iconComponent: windowsSvg,
+      href: "./getting-started/"
+    },
+  ]}
+/>
+{/*vale messaging.protocol-products = YES*/}
+<Resources
+  title="Common tasks and config settings"
+  variant="doc"
+  desktopColumnsCount={2}
+  resources={[
+    {
+      title: "Dynamic Windows desktop registration",
+      description: "Add, update or remove desktops without changing the static configuration files used for Teleport Windows Desktop Service instances.",
+      iconComponent: windowsDesktopsSvg,
+      href: "./dynamic-registration/"
+    },
+    {
+      title: "Directory sharing",
+      description: "Securely move files between your local machine and a remote desktop, and apply file changes without extra steps and without compromising security.",
+      iconComponent: folderNotchOpenSvg,
+      href: "./directory-sharing/"
+    },
+  ]}
+/>
diff --git a/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx b/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
index a07d985740f49..5633108c3c61f 100644
--- a/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
+++ b/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
@@ -1,6 +1,10 @@
 ---
 title: Directory Sharing
 description: Teleport desktop Directory Sharing lets you easily send files to a remote desktop.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Directory Sharing is a Teleport feature of that makes it easy to move files
@@ -186,11 +190,11 @@ $ tctl create -f role.yaml
 Directory Sharing is a powerful tool for editing files on remote desktops, and
 you'll want to make sure you have a comprehensive audit trail so you can conduct
 a post-incident retrospective or investigate unintended usage. Learn how to set
-up [session recording for desktop access](../../reference/agent-services/desktop-access-reference/sessions.mdx).
+up [session recording for desktop access](reference/sessions.mdx).
 
 Aside from Directory Sharing, the Teleport Desktop Service also enables you to
 share the contents of your clipboard with a remote desktop. Learn how to use
-[Clipboard Sharing](../../reference/agent-services/desktop-access-reference/clipboard.mdx).
+[Clipboard Sharing](reference/clipboard.mdx).
 
 ### How Directory Sharing works
 
@@ -239,4 +243,4 @@ Teleport Connect establishes a secure mTLS connection to the Teleport Proxy Serv
 which forwards traffic to and from the relevant Teleport Desktop Service instance.
 
 Just like the Web UI, Teleport Connect uses the Teleport Desktop Protocol (TDP)
-to communicate with the Teleport Desktop Service, which then connects to the remote desktop via RDP.
\ No newline at end of file
+to communicate with the Teleport Desktop Service, which then connects to the remote desktop via RDP.
diff --git a/docs/pages/enroll-resources/desktop-access/dynamic-registration.mdx b/docs/pages/enroll-resources/desktop-access/dynamic-registration.mdx
index b1a9adcc12a38..2611133726a2b 100644
--- a/docs/pages/enroll-resources/desktop-access/dynamic-registration.mdx
+++ b/docs/pages/enroll-resources/desktop-access/dynamic-registration.mdx
@@ -1,6 +1,11 @@
 ---
 title: Dynamic Windows Desktop Registration
+sidebar_label: Dynamic Registration
 description: Register/unregister Windows desktops without restarting Teleport.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Dynamic Windows desktop registration allows Teleport administrators to register
diff --git a/docs/pages/enroll-resources/desktop-access/getting-started.mdx b/docs/pages/enroll-resources/desktop-access/getting-started.mdx
index 7b2e20764115a..b20f09c298ce4 100644
--- a/docs/pages/enroll-resources/desktop-access/getting-started.mdx
+++ b/docs/pages/enroll-resources/desktop-access/getting-started.mdx
@@ -1,7 +1,12 @@
 ---
-title: Configure access for local Windows users
+title: Configure Access for Local Windows Users
+sidebar_label: Local Windows Users
 description: Use Teleport to configure passwordless access for local Windows users.
 videoBanner: 9DyKQbg4ORc
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide demonstrates how to configure Teleport to provide secure, passwordless access
@@ -14,6 +19,20 @@ Community Edition will not allow connections to any of them.
 
 Teleport Enterprise users can have unlimited number of desktops.
 
+## How it works
+
+The Teleport Desktop Service proxies traffic between the Teleport Proxy Service
+and remote Windows desktops in your infrastructure. Teleport users connect to a
+Windows desktop using Teleport Connect or the Teleport Web UI. These graphical
+clients use the proprietary Teleport Desktop Protocol to send traffic to and
+receive traffic from the Teleport Desktop Service, which converts TDP messages
+to and from Remote Desktop Protocol messages.
+
+To access a remote desktop, a Teleport user must have a role with the
+appropriate permissions for that desktop. An administrator configures the
+desktop to trust the Teleport certificate authority, and the Windows Desktop
+Service uses certificate-based authentication to access the desktop.
+
 ## Prerequisites
 
 To complete the steps in this guide, verify your environment meets the following requirements:
@@ -134,7 +153,7 @@ Windows Desktop Service by running the following command:
    ```
 
    If Teleport isn't installed on the Linux server, follow the appropriate [Installation
-instructions](../../installation.mdx#linux) for your environment.
+instructions](../../installation/linux.mdx) for your environment.
 
 1. Configure the `/etc/teleport.yaml` file on the Linux server with settings similar to the
 following for the Windows Desktop Service:
@@ -253,7 +272,7 @@ To configure a role for desktop access:
 
    Depending on how you configure role-based access controls for Windows, Teleport can create local user logins
    automatically from the `windows_desktop_logins` you specify. For more information about enabling Teleport
-   to create local Windows logins, see [Automatic User Creation](../../reference/agent-services/desktop-access-reference/user-creation.mdx).
+   to create local Windows logins, see [Automatic User Creation](reference/user-creation.mdx).
 
 1. Apply the new role to your cluster by running the following command:
 
@@ -301,6 +320,6 @@ Windows login to use for the connection.
 ## Next steps
 
 For more general information about how to create, assign, and update roles, see [Access Controls
-Getting Started](../../admin-guides/access-controls/getting-started.mdx).
+Getting Started](../../zero-trust-access/rbac-get-started/role-demo.mdx).
 For more specific information about configuring Windows-specific role permissions, see
 [Role-Based Access Control for Desktops](./rbac.mdx).
diff --git a/docs/pages/enroll-resources/desktop-access/introduction.mdx b/docs/pages/enroll-resources/desktop-access/introduction.mdx
index 7368b52c9e01d..e6e029b5118cf 100644
--- a/docs/pages/enroll-resources/desktop-access/introduction.mdx
+++ b/docs/pages/enroll-resources/desktop-access/introduction.mdx
@@ -1,7 +1,12 @@
 ---
 title: Manage Access to Windows Resources
+sidebar_label: Introduction
 description: Demonstrates how you can manage access to Windows desktops with Teleport.
 videoBanner: n2h0GisWdss
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 The topics in this guide describe how to configure Teleport to provide secure, passwordless
@@ -75,13 +80,13 @@ Windows-specific configuration settings, role-based permissions, and audit event
 
 {/* vale messaging.protocol-products = NO */}
 - [Role-Based Access Control for Desktops](./rbac.mdx)
-- [Clipboard Sharing](../../reference/agent-services/desktop-access-reference/clipboard.mdx)
+- [Clipboard Sharing](reference/clipboard.mdx)
 - [Directory Sharing](./directory-sharing.mdx)
 - [Dynamic Registration](./dynamic-registration.mdx)
-- [Session Recording and Playback](../../reference/agent-services/desktop-access-reference/sessions.mdx)
+- [Session Recording and Playback](reference/sessions.mdx)
 - [Troubleshooting Desktop Access](./troubleshooting.mdx)
-- [Desktop Access Audit Events Reference](../../reference/agent-services/desktop-access-reference/audit.mdx)
-- [Desktop Access Configuration Reference](../../reference/agent-services/desktop-access-reference/configuration.mdx)
-- [Desktop Access CLI Reference](../../reference/agent-services/desktop-access-reference/cli.mdx)
+- [Desktop Access Audit Events Reference](reference/audit.mdx)
+- [Desktop Access Configuration Reference](reference/configuration.mdx)
+- [Desktop Access CLI Reference](reference/cli.mdx)
 {/* vale messaging.protocol-products = YES */}
 
diff --git a/docs/pages/enroll-resources/desktop-access/rbac.mdx b/docs/pages/enroll-resources/desktop-access/rbac.mdx
index 9c32cab48f1e5..da66a0897acd9 100644
--- a/docs/pages/enroll-resources/desktop-access/rbac.mdx
+++ b/docs/pages/enroll-resources/desktop-access/rbac.mdx
@@ -1,6 +1,11 @@
 ---
 title: Role-Based Access Control for Desktops
+sidebar_label: Access Controls
 description: Role-based access control (RBAC) for desktops protected by Teleport.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 Teleport's RBAC allows administrators to set up granular access policies for
diff --git a/docs/pages/enroll-resources/desktop-access/reference/audit.mdx b/docs/pages/enroll-resources/desktop-access/reference/audit.mdx
new file mode 100644
index 0000000000000..9ae79a0c24c41
--- /dev/null
+++ b/docs/pages/enroll-resources/desktop-access/reference/audit.mdx
@@ -0,0 +1,255 @@
+---
+title: Desktop Access Audit Events Reference
+sidebar_label: Audit Events
+description: Audit events reference for Teleport desktop access.
+tags:
+ - reference
+ - zero-trust
+ - audit
+---
+
+This guide lists the structures and field names of audit events related to
+connecting to remote desktops with Teleport. Use this guide to understand
+desktop-related audit events and configure your log management solutions if you
+are [exporting audit
+events](../../../zero-trust-access/export-audit-events/export-audit-events.mdx).
+
+## windows.desktop.session.start (TDP00I/W)
+
+Emitted when a client successfully connects to a desktop or when a connection
+attempt fails because access was denied.
+
+Successful connection event:
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP00I",
+  "desktop_addr": "192.168.1.206:3389",
+  "desktop_labels": {
+    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
+    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
+    "teleport.dev/is_domain_controller": "true",
+    "teleport.dev/origin": "dynamic",
+    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
+    "teleport.dev/os_version": "6.3 (9600)",
+    "teleport.dev/windows_domain": "teleport.example.com"
+  },
+  "ei": 0,
+  "event": "windows.desktop.session.start",
+  "login": "administrator",
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "success": true,
+  "time": "2022-02-16T16:43:30.459Z",
+  "uid": "1605346b-d90b-4df7-8148-67a3e2d85673",
+  "user": "alice",
+  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
+  "windows_domain": "teleport.example.com",
+  "windows_user": "administrator"
+}
+```
+
+Access denied event:
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP00W",
+  "desktop_addr": "192.168.1.206:3389",
+  "desktop_labels": {
+    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
+    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
+    "teleport.dev/is_domain_controller": "true",
+    "teleport.dev/origin": "dynamic",
+    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
+    "teleport.dev/os_version": "6.3 (9600)",
+    "teleport.dev/windows_domain": "teleport.example.com"
+  },
+  "ei": 0,
+  "error": "access to desktop denied", // Connection error
+  "event": "windows.desktop.session.start",
+  "message": "access to desktop denied", // Detailed error message.
+  "login": "administrator",
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "success": false, // Indicates unsuccessful connection
+  "time": "2022-02-16T16:43:30.459Z",
+  "uid": "1605346b-d90b-4df7-8148-67a3e2d85673",
+  "user": "alice",
+  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
+  "windows_domain": "teleport.example.com",
+  "windows_user": "administrator"
+}
+```
+
+## windows.desktop.session.end (TDP01I)
+
+Emitted when a client disconnects from the desktop.
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDP01I",
+  "desktop_addr": "192.168.1.206:3389",
+  "desktop_labels": {
+    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
+    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
+    "teleport.dev/is_domain_controller": "true",
+    "teleport.dev/origin": "dynamic",
+    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
+    "teleport.dev/os_version": "6.3 (9600)",
+    "teleport.dev/windows_domain": "teleport.example.com"
+  },
+  "desktop_name": "WIN-I44F9TN11M3-teleport-example-com",
+  "ei": 0,
+  "event": "windows.desktop.session.end",
+  "login": "administrator",
+  "participants": ["alice"],
+  "recorded": true,
+  "session_start": "2022-02-16T16:43:30.459Z",
+  "session_stop": "2022-02-16T16:46:50.894Z",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "time": "2022-02-16T16:46:50.895Z",
+  "uid": "c7956a81-597f-4452-90d7-800506f7a05b",
+  "user": "alice",
+  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
+  "windows_domain": "teleport.example.com",
+  "windows_user": "administrator"
+}
+```
+
+## desktop.clipboard.send (TDP02I)
+
+Emitted when clipboard data is sent from a user's workstation to Teleport. In
+order to avoid capturing sensitive data, the event only records the number of
+bytes that were sent.
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP02I",
+  "desktop_addr": "192.168.1.206:3389",
+  "ei": 0,
+  "event": "desktop.clipboard.send",
+  "length": 4, // number of bytes sent
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "time": "2022-02-16T16:43:40.010217Z",
+  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
+  "user": "alice"
+}
+```
+
+## desktop.clipboard.receive (TDP03I)
+
+Emitted when Teleport receives clipboard data from a remote desktop. In order to
+avoid capturing sensitive data, the event only records the number of bytes that
+were received.
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP03I",
+  "desktop_addr": "192.168.1.206:3389",
+  "ei": 0,
+  "event": "desktop.clipboard.receive",
+  "length": 4, // number of bytes received
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "time": "2022-02-16T16:43:40.010217Z",
+  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
+  "user": "alice"
+}
+```
+
+## desktop.directory.share (TDP04I/W)
+
+Emitted when Teleport starts sharing a directory on a local machine to the remote desktop.
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP04I", // TDP04W if the operation failed
+  "desktop_addr": "192.168.1.206:3389",
+  "directory_id": 2,
+  "directory_name": "local-files",
+  "ei": 0,
+  "event": "desktop.directory.share",
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "success": true, // false if the operation failed
+  "time": "2022-10-21T22:36:27.314409Z",
+  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
+  "user": "alice"
+}
+```
+
+## desktop.directory.read (TDP05I/W)
+
+This event is part of the directory sharing feature, and is emitted when
+Teleport reads data from a file on the user's local machine and sends it
+to the remote Windows desktop.
+
+In order to avoid capturing sensitive data, the event only records the offset
+from the start of the file from which the read began and the number of bytes
+that were sent.
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP05I", // TDP05W if the operation failed
+  "desktop_addr": "192.168.1.206:3389",
+  "directory_id": 2,
+  "directory_name": "local-files",
+  "ei": 0,
+  "event": "desktop.directory.read",
+  "file_path": "powershell-scripts/a-script.ps1", // relative path from the root of the shared directory (local-files in this case)
+  "length": 734, // the number of bytes read
+  "offset": 0, // the offset from the start of the file from which the read began
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "success": true, // false if the operation failed
+  "time": "2022-10-21T22:36:27.314409Z",
+  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
+  "user": "alice"
+}
+```
+
+## desktop.directory.write (TDP06I/W)
+
+This event is part of the directory sharing feature, and is emitted when
+Teleport reads writes from the remote desktop to a file on the user's local
+machine.
+
+In order to avoid capturing sensitive data, the event only records the offset
+from the start of the file from which the write began and the number of bytes
+that were written.
+
+```json
+{
+  "addr.remote": "192.168.1.206:3389",
+  "cluster_name": "root",
+  "code": "TDP06I", // TDP06W if the operation failed
+  "desktop_addr": "192.168.1.206:3389",
+  "directory_id": 2,
+  "directory_name": "local-files",
+  "ei": 0,
+  "event": "desktop.directory.read",
+  "file_path": "powershell-scripts/a-script.ps1", // relative path from the root of the shared directory (local-files in this case)
+  "length": 734, // the number of bytes written
+  "offset": 0, // the offset from the start of the file from which the write began
+  "proto": "tdp",
+  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
+  "success": true, // false if the operation failed
+  "time": "2022-10-21T22:36:27.314409Z",
+  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
+  "user": "alice"
+}
+```
diff --git a/docs/pages/enroll-resources/desktop-access/reference/cli.mdx b/docs/pages/enroll-resources/desktop-access/reference/cli.mdx
new file mode 100644
index 0000000000000..759fc733d1ce2
--- /dev/null
+++ b/docs/pages/enroll-resources/desktop-access/reference/cli.mdx
@@ -0,0 +1,32 @@
+---
+title: Desktop Access CLI Reference
+sidebar_label: CLI Commands
+description: CLI reference for Teleport desktop access.
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+The following `tctl` commands are used to manage the Teleport Windows Desktop
+Service.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+Generate a join token for a Windows Desktop Service:
+
+```sh
+$ tctl tokens add --type=WindowsDesktop
+```
+
+List registered Windows Desktop Services:
+
+```sh
+$ tctl get windows_desktop_service
+```
+
+List registered Windows desktops:
+
+```sh
+$ tctl get windows_desktop
+```
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/clipboard.mdx b/docs/pages/enroll-resources/desktop-access/reference/clipboard.mdx
similarity index 95%
rename from docs/pages/reference/agent-services/desktop-access-reference/clipboard.mdx
rename to docs/pages/enroll-resources/desktop-access/reference/clipboard.mdx
index 8a884684b013e..f8532a86eefda 100644
--- a/docs/pages/reference/agent-services/desktop-access-reference/clipboard.mdx
+++ b/docs/pages/enroll-resources/desktop-access/reference/clipboard.mdx
@@ -1,6 +1,10 @@
 ---
 title: Clipboard Sharing
 description: Using Clipboard Sharing with Teleport desktop access.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport supports copying and pasting text between your browser and a remote
diff --git a/docs/pages/enroll-resources/desktop-access/reference/configuration.mdx b/docs/pages/enroll-resources/desktop-access/reference/configuration.mdx
new file mode 100644
index 0000000000000..505bf00f6830b
--- /dev/null
+++ b/docs/pages/enroll-resources/desktop-access/reference/configuration.mdx
@@ -0,0 +1,73 @@
+---
+title: Desktop Access Configuration Reference
+sidebar_label: Configuration
+description: Configuration reference for Teleport desktop access.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
+---
+
+`teleport.yaml` fields related to desktop access:
+
+```yaml
+# Main service responsible for desktop access.
+#
+# You can have multiple Desktop Service instances in your cluster (but not in the
+# same teleport.yaml), connected to the same or different Active Directory
+# domains.
+(!docs/pages/includes/config-reference/desktop-config.yaml!)
+```
+
+## Deployment
+
+The Windows Desktop Service can be deployed in two modes.
+
+### Direct mode
+
+In *direct* mode, Windows Desktop Services registers directly with the Teleport
+Auth Service, and listens for desktop connections from the Teleport Proxy. To
+enable direct mode, set `windows_desktop_service.listen_addr` in
+`teleport.yaml`, and ensure that `teleport.auth_server` points directly at the
+Auth Service.
+
+Direct mode requires network connectivity both:
+
+- from the Teleport Proxy to the Windows Desktop Service.
+- from the Windows Desktop Service to the Auth Service.
+
+For these reasons direct mode is not available in Teleport cloud, only
+self-hosted Teleport clusters.
+
+### IoT mode (reverse tunnel)
+
+In *IoT mode*, Windows Desktop Service only needs to be able to make an outbound
+connection to a Teleport Proxy. The Windows Desktop Service establishes a
+reverse tunnel to the proxy, and both registration with the Auth Service and
+desktop sessions are performed over this tunnel. To enable this mode, ensure
+that `windows_desktop_service.listen_addr` is *unset*, and point
+`teleport.proxy_server` at a Teleport Proxy.
+
+## Screen size
+
+By default, Teleport will set the screen size of the remote desktop session
+based on the size of your browser window. In some cases, you may wish to
+configure specific hosts to use a specific screen size. To do this, set the
+`screen_size` attribute on the `windows_desktop` resource:
+
+```yaml
+kind: windows_desktop
+metadata:
+  name: fixed-screen-size
+spec:
+  host_id: 307e091b-7f6b-42e0-b78d-3362ad10b55d
+  addr: 192.168.1.153:3389
+  non_ad: true
+
+  # Optional - ensures that all sessions use the same screen size,
+  # no matter what the size of the browser window is.
+  # Leave blank to use the size of the browser window.
+  screen_size:
+    width: 1024
+    height: 768
+```
diff --git a/docs/pages/enroll-resources/desktop-access/reference/reference.mdx b/docs/pages/enroll-resources/desktop-access/reference/reference.mdx
new file mode 100644
index 0000000000000..3f11742c37d5c
--- /dev/null
+++ b/docs/pages/enroll-resources/desktop-access/reference/reference.mdx
@@ -0,0 +1,18 @@
+---
+title: Desktop Access Reference
+sidebar_label: Reference
+description: Comprehensive guides to configuring and auditing desktop access.
+sidebar_position: 8
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
+---
+
+- [Configuration](configuration.mdx): Configure Teleport desktop access.
+- [Audit](audit.mdx): Desktop access audit events.
+- [Clipboard](clipboard.mdx): Share your clipboard with a remote desktop.
+- [Session Recording](sessions.mdx): Desktop session recording and playback
+- [CLI](cli.mdx): Relevant `tctl` commands
+- [Scaling](../../../reference/deployment/scaling.mdx): Tips on scaling to many concurrent users.
+- [User creation](user-creation.mdx): Automatic user creation
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/sessions.mdx b/docs/pages/enroll-resources/desktop-access/reference/sessions.mdx
similarity index 92%
rename from docs/pages/reference/agent-services/desktop-access-reference/sessions.mdx
rename to docs/pages/enroll-resources/desktop-access/reference/sessions.mdx
index 01d8ddceadf51..c375368ca8441 100644
--- a/docs/pages/reference/agent-services/desktop-access-reference/sessions.mdx
+++ b/docs/pages/enroll-resources/desktop-access/reference/sessions.mdx
@@ -1,6 +1,11 @@
 ---
 title: Session Recording and Playback
 description: Recording and playing back Teleport desktop access sessions.
+tags:
+ - session-recording
+ - conceptual
+ - zero-trust
+ - audit
 ---
 
 Teleport supports recording and playback of desktop sessions.
@@ -53,7 +58,7 @@ being recorded. In other words, *all* of the roles applied to a user must
 explicitly disable recording to prevent the session from being recorded.
 
 See the
-[Access Controls Reference](../../access-controls/roles.mdx)
+[Access Controls Reference](../../../reference/access-controls/roles.mdx)
 for all possible settings in the `record_session` section.
 
 ## Playback
@@ -80,5 +85,5 @@ saved to disk. If disk space is a concern, we recommend using sync recording and
 configuring a cloud storage solution such as S3.
 
 Refer to the `storage` section of the [Teleport Configuration
-Reference](../../../reference/config.mdx) for more information on session
+Reference](../../../reference/deployment/config.mdx) for more information on session
 logging and recording management.
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/user-creation.mdx b/docs/pages/enroll-resources/desktop-access/reference/user-creation.mdx
similarity index 98%
rename from docs/pages/reference/agent-services/desktop-access-reference/user-creation.mdx
rename to docs/pages/enroll-resources/desktop-access/reference/user-creation.mdx
index cb06b0b3933d6..d5f71ab46791e 100644
--- a/docs/pages/reference/agent-services/desktop-access-reference/user-creation.mdx
+++ b/docs/pages/enroll-resources/desktop-access/reference/user-creation.mdx
@@ -1,6 +1,10 @@
 ---
 title: Automatic User Creation
 description: Using Automatic User Creation with Teleport desktop access.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport's Desktop Service can be configured to automatically create local
diff --git a/docs/pages/enroll-resources/desktop-access/troubleshooting.mdx b/docs/pages/enroll-resources/desktop-access/troubleshooting.mdx
index ca2888f84954d..b7f632b132919 100644
--- a/docs/pages/enroll-resources/desktop-access/troubleshooting.mdx
+++ b/docs/pages/enroll-resources/desktop-access/troubleshooting.mdx
@@ -1,6 +1,11 @@
 ---
 title: Troubleshooting Desktop Access
+sidebar_label: Troubleshooting
 description: Common issues and resolutions for Teleport's desktop access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Common issues and resolution steps.
diff --git a/docs/pages/enroll-resources/enroll-resources.mdx b/docs/pages/enroll-resources/enroll-resources.mdx
index 21df75ded60c1..5e95406729fa1 100644
--- a/docs/pages/enroll-resources/enroll-resources.mdx
+++ b/docs/pages/enroll-resources/enroll-resources.mdx
@@ -1,29 +1,260 @@
 ---
 title: Enrolling Teleport Resources
 description: Provides step-by-step instructions for enrolling servers, databases, and other infrastructure resources with your Teleport cluster.
+template: "landing-page"
+tags:
+ - conceptual
+ - zero-trust
 ---
 
-You can use Teleport to protect infrastructure resources like servers,
-databases, and Kubernetes clusters. Once an infrastructure resource is protected
-by Teleport, you can restrict access to the resource using the Teleport
-[role-based access controls
-system](../admin-guides/access-controls/access-controls.mdx) and use Teleport
-features like session recordings and audit events to understand how your users
-interact with the resource.
+import LandingHero from '@site/src/components/Pages/Landing/LandingHero';
+import EnrollmentMethods, { Method } from "@site/src/components/Pages/Landing/EnrollmentMethods/EnrollmentMethods";
+import ResourceGrid from "@site/src/components/Pages/Landing/ResourceGrid";
 
-To enroll a resource with Teleport, you deploy a Teleport Agent, an instance of
-the `teleport` binary configured to run certain services, such as the Teleport
-SSH Service and Teleport Database Service. You then configure the Agent to proxy
-a resource by querying a service discovery API (Auto Discovery), using a
-[dynamic Teleport
-resource](../admin-guides/infrastructure-as-code/infrastructure-as-code.mdx), or
-naming the resource in the Agent's configuration file. Read more about [Teleport
-Agent architecture](../reference/architecture/agents.mdx).
+import enrollResourcesImg from '@version/docs/img/enroll-resources/enroll-resources-hero.png';
+import bookOpenSvg from "@site/src/components/Icon/teleport-svg/book-open.svg";
+import magicWandSvg from "@site/src/components/Icon/teleport-svg/magic-wand.svg";
+import terminalWindowSvg from "@site/src/components/Icon/teleport-svg/terminal-window.svg";
+import applicationSvg from "@site/src/components/Icon/teleport-svg/application.svg";
+import linuxServersSvg from "@site/src/components/Icon/teleport-svg/linux-servers.svg";
+import databaseSvg from "@site/src/components/Icon/teleport-svg/database-access.svg";
+import kubernetesClustersSvg from "@site/src/components/Icon/teleport-svg/kubernetes-clusters.svg";
+import windowsDesktopsSvg from "@site/src/components/Icon/teleport-svg/windows-desktops.svg";
+import mcpAndAiSvg from "@site/src/components/Icon/teleport-svg/mcp-and-ai.svg";
 
-You can also create a Teleport bot user and set up Machine ID to enable service
-accounts to access Teleport-protected resources.
+<LandingHero
+  title="Enroll Resources"
+  image={enrollResourcesImg}
+  linksTitle="Enrollment Methods"
+  linksColumnCount={2}
+  links={[
+    {
+      title: "Infrastructure as a Code",
+      description: "Manage resources as code with Terraform, Kubernetes operator, and tctl",
+      href: "../zero-trust-access/infrastructure-as-code/managing-resources/",
+      icon: terminalWindowSvg,
+    },
+    {
+      title: "Auto-Discovery",
+      description: "Automatically discover and enroll resources",
+      href: "./auto-discovery/",
+      icon: magicWandSvg,
+    },
+  ]}
+>
+Teleport protects infrastructure resources such as servers, databases, and Kubernetes clusters by enforcing strong access controls and auditability. Once a resource is enrolled with Teleport, you can manage access to it using the Teleport role-based access control (RBAC) system, allowing you to define which users or teams can connect and what actions they are permitted to perform.
+- [Learn about Teleport Agents](../reference/architecture/agents.mdx)
+- [Restrict access to resources with RBAC](../zero-trust-access/rbac-get-started/rbac-get-started.mdx)
+</LandingHero>
 
-Read the following documentation for more information on enrolling
-infrastructure resources with Teleport:
+<EnrollmentMethods>
+<Method
+title="Applications"
+icon={applicationSvg}
+href="./application-access/"
+tagLists={
+  [
+    {
+      tags: 
+        [
+          {
+            name: "Cloud consoles",
+            href: "./application-access/cloud-apis/",
+            icon: "cloud3",
+          },
+          {
+            name: "Web apps",
+            href: "./application-access/protect-apps/connecting-apps/",
+            icon: "appWindow",
+          },
+          {
+            name: "TCP apps",
+            href: "./application-access/protect-apps/tcp/",
+            icon: "tcp",
+          },
+          {
+            name: "more",
+            href: "./application-access/configuration/",
+            arrow: true,
+          }
+        ] 
+    },
+  ]
+}
+>
+Secure access to web applications, TCP apps, cloud provider consoles and CLIs, and more.
+</Method>
+<Method
+title="Databases"
+icon={databaseSvg}
+href="./database-access/"
+tagLists={
+  [
+    {
+      tags: 
+        [
+          {
+            name: "AWS",
+            href: "./database-access/enrollment/aws/",
+            icon: "aws",
+          },
+          {
+            name: "Azure",
+            href: "./database-access/enrollment/azure/",
+            icon: "azure",
+          },
+         {
+            name: "Google Cloud",
+            href: "./database-access/enrollment/google-cloud/",
+            icon: "googleCloud",
+          },
+          {
+            name: "more",
+            href: "./database-access/",
+            arrow: true,
+          }
+        ] 
+    },
+  ]
+}
+>
+Secure, auditable access to cloud and self-hosted databases.
+</Method>
+<Method
+title="Kubernetes Clusters"
+icon={kubernetesClustersSvg}
+href="./kubernetes-access/"
+tagLists={
+  [
+    {
+      title: "Kubernetes Clusters Guides",
+      tags: 
+        [
+          {
+            name: "Enroll Kubernetes clusters",
+            href: "./kubernetes-access/getting-started/",
+          },
+          {
+            name: "Access controls",
+            href: "./kubernetes-access/controls/",
+          },
+        ] 
+    },
+  ]
+}
+>
+Protect Kubernetes clusters with SSO integration, RBAC, and session recordings.
+</Method>
+<Method
+title="Windows Desktop"
+icon={windowsDesktopsSvg}
+href="./desktop-access/"
+tagLists={
+  [
+    {
+      title: "Windows Desktops Access Guides",
+      tags: 
+        [
+          {
+            name: "Local Windows users",
+            href: "./desktop-access/getting-started/",
+          },
+          {
+            name: "Active Directory",
+            href: "./desktop-access/active-directory/",
+          },
+        ] 
+    },
+  ]
+}
+>
+Passwordless access to Windows Desktops and servers for domain users and local users.
+</Method>
+<Method
+title="SSH Servers"
+icon={linuxServersSvg}
+href="./server-access/"
+tagLists={
+  [
+    {
+      title: "Server Access Guides",
+      tags: 
+        [
+          {
+            name: "Get started guide",
+            href: "./server-access/getting-started/",
+          },
+          {
+            name: "Agentless OpenSSH",
+            href: "./server-access/openssh/openssh-agentless/",
+          },
+          {
+            name: "more",
+            href: "./server-access/guides/",
+            arrow: true,
+          }
+        ] 
+    },
+  ]
+}
+>
+Streamline SSH access, reduce configuration overhead, and provide auditability.
+</Method>
+<Method
+title="MCP Servers"
+icon={mcpAndAiSvg}
+href="./mcp-access/"
+tagLists={
+  [
+    {
+      title: "MCP Server Guides",
+      tags: 
+        [
+          {
+            name: "Get Started Guide",
+            href: "./mcp-access/getting-started/",
+          },
+          {
+            name: "Configure MCP clients",
+            href: "./mcp-access/rbac/",
+          },
+          {
+            name: "DB access for MCP",
+            href: "../connect-your-client/model-context-protocol/database-access/",
+          },
+        ] 
+    },
+  ]
+}
+>
+Secure the vibes with access controls and auditability for all Model Context Protocol access.
+</Method>
+</EnrollmentMethods>
 
-<DocCardList />
+<ResourceGrid
+  title="Auto-Discovery Guides"
+  resources={[
+    {
+      title: 'Databases',
+      iconComponent: databaseSvg,
+      href: './auto-discovery/databases/'
+    },
+    {
+      title: 'Servers',
+      iconComponent: linuxServersSvg,
+      href: './auto-discovery/servers/'
+    },
+    {
+      title: 'Kubernetes Clusters',
+      iconComponent: kubernetesClustersSvg,
+      href: './auto-discovery/kubernetes/'
+    },
+    {
+      title: 'Kube services as apps',
+      iconComponent: applicationSvg,
+      href: './auto-discovery/kubernetes-applications/'
+    },
+  ]}
+>
+Automatically detect and enroll resources in your Teleport cluster with the Teleport Discovery Service.
+</ResourceGrid>
diff --git a/docs/pages/enroll-resources/kubernetes-access/controls.mdx b/docs/pages/enroll-resources/kubernetes-access/controls.mdx
index 033675d0c5bef..88a92dab44e66 100644
--- a/docs/pages/enroll-resources/kubernetes-access/controls.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/controls.mdx
@@ -1,6 +1,11 @@
 ---
 title: Teleport Kubernetes Access Controls
+sidebar_label: Access Controls Reference
 description: How the Teleport Kubernetes Service applies RBAC to manage access to Kubernetes
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 This guide explains the way the Teleport Kubernetes Service applies role-based
@@ -39,21 +44,21 @@ version: v8
 spec:
   allow:
     kubernetes_labels:
-      'region': '*'
-      'platform': 'minikube'
+      region: '*'
+      platform: minikube
     kubernetes_resources:
       - kind: pods
-        namespace: "production"
-        name: "^webapp-[a-z0-9-]+$"
-        api_group: ""
+        namespace: production
+        name: '^webapp-[a-z0-9-]+$'
+        api_group: ''
       - kind: pods
-        namespace: "development"
-        name: "*"
-        api_group: ""
+        namespace: development
+        name: '*'
+        api_group: ''
       - kind: deployments
-        namespace: "development"
-        name: "*"
-        api_group: "apps"
+        namespace: development
+        name: '*'
+        api_group: apps
     kubernetes_groups:
     - developers
     kubernetes_users:
@@ -71,12 +76,12 @@ using a role's  `kubernetes_labels` field.
 kind: role
 metadata:
   name: kube-access
-version: v7
+version: v8
 spec:
   allow:
     kubernetes_labels:
-      'region': '*'
-      'environment': 'development'
+      region: '*'
+      environment: development
       # ...
   deny: {}
 ```
@@ -88,7 +93,7 @@ or more label *values* (i.e., either a string or a list).
 
 If both the key and the value of a label are wildcards, `*`, the Teleport
 Kubernetes Service allows the user to access Kubernetes clusters with all
-labels:
+tags:
 
 ```yaml
 spec:
@@ -140,8 +145,8 @@ Here is an example:
 spec:
   allow:
     kubernetes_labels:
-      'region': 'us-east-*'
-      'team': '^data-eng-[a-z-]+$'
+      region: 'us-east-*'
+      team: '^data-eng-[a-z-]+$'
     # ...
 ```
 
@@ -161,8 +166,8 @@ clusters with the `region:us-east-2` label and either the `development` or
 spec:
   allow:
     kubernetes_labels:
-      'region': 'us-east-*'
-      'environment': ['development', 'staging']
+      region: 'us-east-*'
+      environment: ['development', 'staging']
     # ...
 ```
 
@@ -316,8 +321,8 @@ determines this from the `kubernetes_users` and `kubernetes_groups` fields in a
 user's roles.
 
 If a user has exactly one value in `kubernetes_users`, the Teleport Kubernetes
-Service impersonates that user. If there are no values in `kubernetes_users`,
-the Kubernetes Service uses the user's Teleport username.
+Service impersonates that user. If there are no values or a wildcard (`*`) in
+`kubernetes_users`, the Kubernetes Service uses the user's Teleport username.
 
 The Kubernetes Service will deny a request if a user has multiple
 `kubernetes_users` and has not specified one when authenticating to a cluster
@@ -326,6 +331,16 @@ The Kubernetes Service will deny a request if a user has multiple
 If the user has not specified a Kubernetes group to impersonate, the Kubernetes
 Service uses all values within `kubernetes_groups`.
 
+<Admonition type="warning">
+    When impersonating a less privileged user, remember that unless you're
+    also manually impersonating specific groups (e.g. using `--as-groups` flag),
+    the Kubernetes Service will automatically impersonate any groups within
+    `kubernetes_groups`.
+
+    This can be confusing because you will have the combined permissions of both
+    the user and any automatically-impersonated groups.
+</Admonition>
+
 With the `kube-access` role above, after you authenticate to Teleport, the
 Kubernetes Service uses impersonation headers to forward requests to the API
 server with the `developers` group and the `myuser` Kubernetes user.
@@ -478,10 +493,51 @@ spec:
       - myuser
 ```
 
+#### Configuring just-in-time access
+
+If you are setting up a Teleport role to enable just-in-time access to a
+specific Kubernetes resources, you should set the role's `kubernetes_groups` and
+`kubernetes_users` to a principal with a role that has no access to Kubernetes
+resource beside the Kubernetes resources that Teleport is able to restrict
+access for.
+
+This is because, if a user requests access to a Kubernetes pod, and the request
+is approved, the Teleport Kubernetes Service will use the `kubernetes_groups`
+and `kubernetes_users` fields in the role to add impersonation headers to the user's
+requests to a Kubernetes API server. Under these conditions, Teleport will be able
+to restrict access to all supported Kubernetes resources kinds except for
+the desired `pod`. 
+
+Teleport is also able to restrict access to namespaced-scoped custom resources
+but not cluster-scoped custom resources. CRDs resources that are cluster scoped
+will be accessible to the user if the principals in the `kubernetes_users` and
+`kubernetes_groups` fields have access to them.
+
+Requesting access to a Kubernetes Namespace allows you to access all resources
+in that namespace but you won't be able to access any other supported resources
+in the cluster.
+
 ### `kubernetes_resources`
 
 The `kubernetes_resources` field enables a Teleport role to configure access to
-specific resources in a Kubernetes cluster:
+specific resources in a Kubernetes cluster.
+
+The value of this field is a list of mappings, where each mapping is described as follows:
+
+#### Role V8
+
+<Admonition type="warning">
+Role V8 added support for managing access to any kubernetes resource kind, including custom resource definitions (CRDs).
+To do so it has multiple changes to the way the `kubernetes_resources` section is handled compared to prior role versions:
+
+- the `kind` field must always specify the plural form of the resource kind
+- the `api_group` field must be set for resources not found in the core API group
+- `kind: namespaces` now matches namespace resources, it no longer matches resources within the namespace
+- the `namespace` field when set and with a value of anything but `*` will not match cluster-wide resources.
+
+As this behavior differs from earlier role versions, if you migrate a role to V8 from a previous version you will
+likely need to adjust the `kubernetes_resources` section.
+</Admonition>
 
 ```yaml
 kind: role
@@ -491,30 +547,168 @@ version: v8
 spec:
   allow:
     kubernetes_labels:
-      '*':'*'
+      "*": "*"
     kubernetes_resources:
       - kind: pods
-        namespace: "production"
-        name: "webapp"
-        verbs: ['*']
         api_group: ""
+        namespace: production
+        name: webapp
+        verbs: ["*"]
+      - kind: deployments
+        api_group: apps
+        namespace: development
+        name: "*"
     # ...
 ```
 
-The value of this field is a list of mappings, where each mapping has four
-fields:
+- `kind`: The kind of resource to enable access to. It can be `*` or
+  the plural form of the kind (e.g. `pods`, `deployments`, `cronjobs`, `mycustomresources`).
+  If the resource has a group, it must be specified in the `api_group` field, for example,
+  while `pods` doesn't need a group, `deployments` require the `api_group` field be set to `apps`.
+  <Admonition type="tip">
+  The full list of available resources, along with their api group can be found by running the following command:
+
+  ```bash
+  kubectl api-resources --namespaced=true -o=name
+  kubectl api-resources --namespaced=false -o=name
+  ```
+
+  - If the line has a `.`, then the kind is the first element before the `.` and the api group is everything after the first `.`.
+  - If the line doesn't have a `.`, then the kind is the full element and there is no api group.
+  </Admonition>
+
+  <Admonition type="warning">
+  - The `namespaces` kind doesn't include all the namespaced resources, it only covers the namespace itself.
+    This behavior is different from earlier role versions where it covered the resource itself and everything in the namespace,
+    which means that if you migrate an existing role to V8 from a prior version you will likely need to adjust the `kubernetes_resources` section.
+  - The kind, including `*` now enforces the `namespace` field. To match a cluster-wide resource, the `namespace` field must be empty or `*`.
+    This behavior is different from earlier role versions where it included cluster-wide resources regardless of the `namespace` field.
+  </Admonition>
+
+- `api_group`: The API group of the resource. In `kube-access`, in the example above, the `pods` resource being in a core resource
+  has `""` for api_group, the value is set to `apps` for the `deployments` resource kind. A wildcard can be used to match any API groups.
+
+- `namespace`: The Kubernetes namespace in which to allow access to a resource. Must be empty or `*` for cluster-wide resources. Any other value,
+  including other wildcards, will only match namespaced resources.
+  In the `kube-access` role, we are allowing access to a pod in the `production` namespace.
+
+  <Admonition type="tip">
+  Note that when using the wildcard `*`, it will match any resources, including cluster-wide ones (based on kind/api_group).
+  Using empty string `""` will match only cluster-wide resources.
+  Any other value, like `^.+$` will only match namespaced resources and exclude cluster-wide resources.
+  </Admonition>
+
+
+- `name`: The name of the pod to allow access to. In `kube-access`, this is
+  the `webapp` pod.
+
+- `verbs`: The operations to allow on the resource. Currently, Teleport supports:
+
+  | Verb | Grants access to |
+  | ---- | ----------- |
+  | `*` | All operations |
+  | `get` | Read a resource |
+  | `list` | List resources |
+  | `create` | Create a resource |
+  | `update` | Update a resource |
+  | `patch` | Patch a resource |
+  | `delete` | Delete a resource |
+  | `deletecollection` | Delete a collection of resources |
+  | `watch` | Watch resources |
+  | `portforward` | Create portforward requests for Pods |
+  | `exec` | Execute commands in Pods |
+
+For the `namespace`, `name` and `api_group` fields, you can add a wildcard character
+(`*`) to replace any sequence of characters. For example, `name: "pod-*-*"`
+matches pods named `pod-1-a` and `pod-2-c`. As with `kubernetes_labels`, if a
+value begins with `^` and ends in `$`, the Kubernetes Service will treat it as a
+regular expression using Go's `re2` syntax (see the `re2`
+[README](https://github.com/google/re2/wiki/Syntax)).
+
+<Admonition type="tip">
+For a user to access a pod named in a role's `kubernetes_resources` field, the user
+must be assigned a Teleport role that contains at least one value within
+`kubernetes_groups` or `kubernetes_users`. Teleport does not alter Kubernetes
+roles to allow or deny access. Read the next section for an explanation of how the
+Kubernetes Service evaluates Teleport roles in order to allow or deny access to
+pods in a cluster.
+</Admonition>
+
+#### Role V7
+
+<Admonition type="tip">
+Role V7 added support for more `kind` values. It uses singular names while later role
+versions use the plural form.
+</Admonition>
+
+<Admonition type="warning">
+The wildcard (`*`) and `namespace` kinds have special meaning, when using those, pay extra
+attention to the intent and the difference of behavior with later versions.
+</Admonition>
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v7
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      - kind: pod
+        namespace: production
+        name: webapp
+        verbs: ["*"]
+    # ...
+```
 
 - `kind`: The kind of resource to enable access to. Currently, Teleport supports
 the following kinds:
 
+  <Admonition type="warning">
+  The `*` kind behavior slightly differs from later versions. In V7, it allows access to all resources
+  including the cluster-wide ones regardless of the `namespace` field.
+  In later role versions, the `namespace` field is enforced, which means that when upgrading you may need to adjust
+  your resources, especially on the deny side.
+  </Admonition>
+  <Admonition type="warning">
+  The `namespace` kind covers the `namespace` resource as well as all resources within it.
+  This behavior is different from later role versions where it only covers the resource itself which means that
+  when upgrading you may need to adjust your resources, especially on the deny side.
+  </Admonition>
+
   | Kind | Grants access to |
   | ---- | ----------- |
-  | `*` | All resources |
-  | `<arbitrary string>` | Resource plural name (e.g. pods, deployments, cronjobs, mycustomresources) |
+  | `*` | All resources, including cluster-wide ones regardless of the `namespace` field |
+  | `pod` | Pods |
+  | `secret` | Secrets |
+  | `configmap` | ConfigMaps |
+  | `namespace` | Namespaces and all resources within. |
+  | `service` | Services |
+  | `serviceaccount` | ServiceAccounts |
+  | `kube_node` | Nodes |
+  | `persistentvolume` | PersistentVolumes |
+  | `persistentvolumeclaim` | PersistentVolumeClaims |
+  | `deployment` | Deployments |
+  | `replicaset` | ReplicaSets |
+  | `statefulset` | StatefulSets |
+  | `daemonset` | DaemonSets |
+  | `clusterrole` | ClusterRoles |
+  | `kube_role` | Roles |
+  | `clusterrolebinding` | ClusterRoleBindings |
+  | `rolebinding` | RoleBindings |
+  | `cronjob` | CronJobs |
+  | `job` | Jobs |
+  | `certificatesigningrequest` | CertificateSigningRequests |
+  | `ingress` | Ingresses |
 
 - `namespace`: The Kubernetes namespace in which to allow access to a resource.
   In the `kube-access` role, we are allowing access to a pod in the
   `production` namespace.
+  Note that when the `kind` field is set to `*`, the `namespace` field is ignored,
+  which is a different behavior from later role versions where the `namespace` field is
+  enforced.
 
 - `name`: The name of the pod to allow access to. In `kube-access`, this is
   the `webapp` pod.
@@ -535,17 +729,60 @@ the following kinds:
   | `portforward` | Create portforward requests for Pods |
   | `exec` | Execute commands in Pods |
 
-- `api_group`: The API group of the resource. In `kube-access`, this is the
-  `""` for `pods` or `apps` for `deployments`. A wildcard can be used to match any API groups.
+For both the `namespace` and `name` fields, you can add a wildcard character
+(`*`) to replace any sequence of characters. For example, `name: "pod-*-*"`
+matches pods named `pod-1-a` and `pod-2-c`. As with `kubernetes_labels`, if a
+value begins with `^` and ends in `$`, the Kubernetes Service will treat it as a
+regular expression using Go's `re2` syntax (see the `re2`
+[README](https://github.com/google/re2/wiki/Syntax)).
+
+<Admonition type="tip">
+For a user to access a pod named in a role's `kubernetes_resources` field, the user
+must be assigned a Teleport role that contains at least one value within
+`kubernetes_groups` or `kubernetes_users`. Teleport does not alter Kubernetes
+roles to allow or deny access. Read the next section for an explanation of how the
+Kubernetes Service evaluates Teleport roles in order to allow or deny access to
+pods in a cluster.
+</Admonition>
+
+#### Role V6
+
+<Admonition type="tip">
+Role V6 introduced the support for the `kubernetes_resources` field, but was restricted
+to only allow access to pods with kind 'pod'. Later role versions extended support to additional resources.
+</Admonition>
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v6
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      - kind: pod
+        namespace: production
+        name: webapp
+    # ...
+```
+
+- `kind`: The kind of resource to enable access to. The only supported value is `pod`.
+- `namespace`: The Kubernetes namespace in which to allow access to a resource.
+  In the `kube-access` role, we are allowing access to a pod in the
+  `production` namespace.
+- `name`: The name of the pod to allow access to. In `kube-access`, this is
+  the `webapp` pod.
 
-For both the `namespace`, `name` and `api_group` fields, you can add a wildcard character
+For both the `namespace` and `name` fields, you can add a wildcard character
 (`*`) to replace any sequence of characters. For example, `name: "pod-*-*"`
 matches pods named `pod-1-a` and `pod-2-c`. As with `kubernetes_labels`, if a
 value begins with `^` and ends in `$`, the Kubernetes Service will treat it as a
 regular expression using Go's `re2` syntax (see the `re2`
 [README](https://github.com/google/re2/wiki/Syntax)).
 
-<Admonition type="tip" >
+<Admonition type="tip">
 For a user to access a pod named in a role's `kubernetes_resources` field, the user
 must be assigned a Teleport role that contains at least one value within
 `kubernetes_groups` or `kubernetes_users`. Teleport does not alter Kubernetes
@@ -554,6 +791,206 @@ Kubernetes Service evaluates Teleport roles in order to allow or deny access to
 pods in a cluster.
 </Admonition>
 
+#### Examples
+
+##### Full access to namespaced resources except to production
+
+The following roles will grant full access to all namespaced resources in all namespaces
+except the `production` one, where no resources will be accessible.
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v7
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      # In v7, namespace means everything in the namespace.
+      - kind: namespace  # v7 uses singular.
+        name: "*"
+        verbs: ["*"]
+  deny:
+    kubernetes_resources:
+      - kind: namespace  # v7 uses singular.
+        name: production
+        verbs: ["*"]
+    # ...
+```
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      # Grant access to namespaced resources in all namespaces.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: "^.+$"  # Match any namespaced resource, will not match cluster-wide resources.
+        verbs: ["*"]
+      # Grant access to the namespace resource itself.
+      - kind: namespaces  # In v8, namespaces mean the namespace itself. As it is considered a cluster-wide resource, it must be added separately.
+        name: "*"
+        verbs: ["*"]
+  deny:
+    kubernetes_resources:
+      # Deny access to namespaced resources in the production namespace.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: production
+        verbs: ["*"]
+      # Deny access to the namespace resource itself.
+      - kind: namespaces  # v8 uses plural.
+        name: production
+        verbs: ["*"]
+    # ...
+```
+
+Alternatively, this could also be used:
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      # Grant full access on everything.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: "*"  # In v8, '*' will match both namespaced and cluster-wide resources.
+        verbs: ["*"]
+  deny:
+    kubernetes_resources:
+      # Deny access to cluster-wide resources.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: ""  # Empty namespace means only cluster-wide resources will match.
+        verbs: ["*"]
+      # Deny access to namespaced resources in the production namespace.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: production
+        verbs: ["*"]
+      # Deny access to the namespace resource itself.
+      - kind: namespaces  # v8 uses plural.
+        name: production
+        verbs: ["*"]
+    # ...
+```
+
+
+##### Full access to dev namespace and all cluster-wide resources except clusterroles
+
+The following roles will grant access to all resources in the `dev` namespace and all cluster-wide resources
+except `clusterroles`.
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v7
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      # In v7, "*" includes cluster-wide resources regardless of the namespace.
+      - kind: "*"
+        name: "*"
+        namespace: dev
+        verbs: ["*"]
+  deny:
+    kubernetes_resources:
+      - kind: clusterrole  # v7 uses singular.
+        name: "*"
+        verbs: ["*"]
+    # ...
+```
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      # Grant access to all resources in the dev namespace.
+      # In v8, "*" doesn't include cluster-wide resources if the namespace is set.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: dev
+        verbs: ["*"]
+      # Grant access to all cluster-wide resources.
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: ""  # Empty namespace means only cluster-wide resources will match.
+        verbs: ["*"]
+  deny:
+    kubernetes_resources:
+      - kind: clusterroles  # v8 uses plural.
+        api_group: "*"
+        name: "*"
+    # ...
+```
+
+##### Full access to everything
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v7
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      - kind: "*"
+        name: "*"
+        namespace: "*"
+        verbs: ["*"]
+    # ...
+```
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      "*": "*"
+    kubernetes_resources:
+      - kind: "*"
+        api_group: "*"
+        name: "*"
+        namespace: "*"  # Wildcard '*' will match both namespaced and cluster-wide resources.
+        verbs: ["*"]
+    # ...
+```
+
 ## How the Kubernetes Service evaluates Teleport roles
 
 When a Teleport user makes a request to a Kubernetes cluster's API server, the
@@ -648,7 +1085,7 @@ version: v7
 spec:
   allow:
     kubernetes_labels:
-      - "region": "us-east-2"
+      "region": "us-east-2"
     kubernetes_resources:
       - kind: pod
         namespace: "development"
diff --git a/docs/pages/enroll-resources/kubernetes-access/faq.mdx b/docs/pages/enroll-resources/kubernetes-access/faq.mdx
index 64626b6b363b9..ae71adaa88de1 100644
--- a/docs/pages/enroll-resources/kubernetes-access/faq.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/faq.mdx
@@ -1,6 +1,11 @@
 ---
 title: Kubernetes Access FAQ
-description: Frequently asked questions about Teleport Kubernetes Access
+sidebar_label: FAQ
+description: Frequently asked questions about protecting Kubernetes clusters with Teleport.
+tags:
+ - faq
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This page offers answers to frequently asked questions about Teleport's
diff --git a/docs/pages/enroll-resources/kubernetes-access/getting-started.mdx b/docs/pages/enroll-resources/kubernetes-access/getting-started.mdx
index 554cd44489112..2db7a7980a543 100644
--- a/docs/pages/enroll-resources/kubernetes-access/getting-started.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/getting-started.mdx
@@ -1,7 +1,12 @@
 ---
-title: Enroll a Kubernetes Cluster
+title: Get Started with Enrolling a Kubernetes Cluster
+sidebar_label: Getting Started
 description: Demonstrates how to enroll a Kubernetes cluster as a resource protected by Teleport.
 videoBanner: 3AUGrOZ5me0
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This guide demonstrates how to enroll a Kubernetes cluster as a Teleport
@@ -22,21 +27,7 @@ For information about other ways to enroll and discover Kubernetes clusters, see
 
 ## Prerequisites
 
-- Access to a running Teleport cluster, `tctl` admin tool, and `tsh` client tool, 
-  version >= (=teleport.version=). 
-
-  You can verify the tools you have installed by running the following commands:
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-
-  $ tsh version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-  
-  You can download these tools by following the appropriate [Installation 
-  instructions](../../installation.mdx#linux) for your environment.
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 (!docs/pages/includes/kubernetes-access/helm-k8s.mdx!)
 
diff --git a/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx b/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx
new file mode 100644
index 0000000000000..4b773df7598a3
--- /dev/null
+++ b/docs/pages/enroll-resources/kubernetes-access/health-checks.mdx
@@ -0,0 +1,267 @@
+---
+title: Teleport Kubernetes Health Checks
+sidebar_label: Health Checks
+sidebar_position: 6
+description: How to configure Teleport Kubernetes health checks and view health.
+tags:
+- conceptual
+- zero-trust
+- infrastructure-identity
+---
+
+This documentation provides an overview of Kubernetes cluster health checks with Teleport. Teleport Kubernetes Service instances periodically check the connectivity and permissions of enrolled Kubernetes clusters. 
+
+Kubernetes cluster health checks are available in Teleport version (= kubernetes.health_check_min_version =) and later.
+
+Teleport Kubernetes health checks provide:
+
+- **Observability**: Discover network and permission issues before users do. Unhealthy Kubernetes clusters are visible in a Teleport UI, command line tool, or Prometheus metrics.
+- **High Availability**: Automatically route and distribute connections to healthy Kubernetes clusters in a high-availability configuration.
+
+## How Kubernetes health checks work
+
+The Teleport Kubernetes Service checks Kubernetes permissions and health endpoint to determine whether a Kubernetes cluster is both up and usable with Teleport.
+
+Four Kubernetes RBAC permissions are routinely checked with the Kubernetes [SelfSubjectAccessReview](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1/) API. The permissions are part of minimum requirements for Teleport to work with a Kubernetes cluster. The checked permissions are:
+- Impersonate users
+- Impersonate groups
+- Impersonate service accounts
+- Get pods
+
+If a permission can't be checked, the Kubernetes cluster's [/readyz](https://kubernetes.io/docs/reference/using-api/health-checks/) endpoint is called to further distinguish connection errors and Kubernetes component errors.
+
+## Health states
+
+A Kubernetes cluster is in a `healthy`, `unhealthy`, or `unknown` state.
+- `healthy` indicates a Kubernetes cluster's health was checked and is fine
+- `unhealthy` indicates a Kubernetes cluster's health was checked and is not usable for some reason
+- `unknown` indicates a Kubernetes cluster has been excluded from health checks, or the first health check is initializing
+
+<Admonition type="warning">
+
+`unknown` Kubernetes clusters may be unhealthy.
+
+`unknown` Kubernetes clusters are not checked for health due to:
+- Running a pre-(= kubernetes.health_check_min_version =) version of Teleport Kubernetes Service instances
+- Explicitly disabling `health_check_config`
+- Explicitly configuring `health_check_config` labels to exclude a Kubernetes cluster
+</Admonition>
+
+## Viewing health
+
+Kubernetes cluster health is viewed through the Teleport web UI, desktop Connect UI, `tctl` CLI tool, or Prometheus metrics.
+
+### Teleport Web UI and Teleport Connect
+
+The Teleport web and Connect UI highlight unhealthy Kubernetes clusters.
+
+Clicking a highlighted Kubernetes cluster shows details of an unhealthy Kubernetes cluster.
+
+![Kubernetes health warning in the UI](../../../img/resource-health-check/kubernetes-health-warning.png)
+
+It may take approximately `5m` for a health change to be reported.
+{/* TODO(gavin): delete this line when we fix health status reporting delay */}
+
+Click the circular arrow refresh icon to get the latest health status. 
+
+### Teleport `tctl` CLI
+
+The Teleport `tctl` CLI tool searches and displays unhealthy Kubernetes clusters.
+```code
+tctl kube ls --query 'health.status == "unhealthy"' 
+```
+
+Run `tctl get kube_server/<your-kube-server-name>` for an overview of Kubernetes cluster health for a specific Kubernetes service.
+```yaml
+kind: kube_server
+...
+status:
+  target_health:
+    address: 192.168.106.2:58458
+    message: 1 health check passed
+    protocol: http
+    status: healthy
+    transition_reason: threshold_reached
+    transition_timestamp: "2025-10-13T19:26:58.842855Z"
+version: v3
+```
+
+### Teleport Prometheus metrics
+
+Health check metrics offer a high-level view of Kubernetes cluster health. The total number of Kubernetes clusters in a `healthy`, `unhealthy`, or `unknown` state are monitored with gauge metrics `teleport_resources_health_status_healthy`, `teleport_resources_health_status_unhealthy`, and `teleport_resources_health_status_unknown`.
+
+- `teleport_resources_health_status_healthy{type="kubernetes"}` is the total number of _healthy_ Kubernetes clusters
+- `teleport_resources_health_status_unhealthy{type="kubernetes"}` is the total number of _unhealthy_ Kubernetes clusters
+- `teleport_resources_health_status_unknown{type="kubernetes"}` is the total number of Kubernetes clusters in an _unknown_ state
+
+A [PromQL](https://prometheus.io/docs/prometheus/latest/querying/basics/) expression may be used to determine the total number of Kubernetes clusters.
+```promql
+teleport_resources_health_status_healthy{type="kubernetes"} +
+teleport_resources_health_status_unhealthy{type="kubernetes"} +
+teleport_resources_health_status_unknown{type="kubernetes"}
+```
+
+A PromQL expression may be used to detect the presence of unhealthy Kubernetes clusters.
+```promql
+teleport_resources_health_status_unhealthy{type="kubernetes"} > 0
+```
+
+<Admonition type="note">
+Prometheus metrics don't distinguish which cluster is unhealthy.
+
+To determine which cluster is unhealthy, use the Teleport Web UI, Teleport Connect, or the following `tctl` command:
+
+```code
+$ tctl kube ls --query 'health.status == "unhealthy"'
+```
+</Admonition>
+
+Health check metrics may also be viewed with the Teleport diagnostic endpoint `http://<diagnostic-address>/metrics`.
+```text
+# HELP teleport_resources_health_status_healthy Number of healthy resources
+# TYPE teleport_resources_health_status_healthy gauge
+teleport_resources_health_status_healthy{type="kubernetes"} 99972
+# HELP teleport_resources_health_status_unhealthy Number of unhealthy resources
+# TYPE teleport_resources_health_status_unhealthy gauge
+teleport_resources_health_status_unhealthy{type="kubernetes"} 3
+# HELP teleport_resources_health_status_unknown Number of resources in an unknown health state
+# TYPE teleport_resources_health_status_unknown gauge
+teleport_resources_health_status_unknown{type="kubernetes"} 25
+```
+
+Diagnostic endpoint metrics are disabled by default. See [Monitoring your Teleport deployment](../../zero-trust-access/management/diagnostics/diagnostics.mdx) to learn how to enable diagnostic metrics.
+
+## Configuring health checks
+
+The Teleport `tctl` CLI tool enables reading, adding, editing, and deleting `health_check_config` resources.
+
+`health_check_config` resources offer a way to configure and selectively apply health checks to Kubernetes clusters.
+
+An example `health_check_config`.
+```yaml
+kind: health_check_config
+version: v1
+metadata:
+  name: example
+  description: Example healthcheck configuration
+spec:
+  # interval is the time between each health check. Default 30s.
+  interval: 30s
+  # timeout is the health check connection establishment timeout. Default 5s.
+  timeout: 5s
+  # healthy_threshold is the number of consecutive passing health checks
+  # after which a target's health status becomes "healthy". Default 2.
+  healthy_threshold: 2
+  # unhealthy_threshold is the number of consecutive failing health checks
+  # after which a target's health status becomes "unhealthy". Default 1.
+  unhealthy_threshold: 1
+  # match is used to select Kubernetes clusters that apply these settings.
+  # Kubernetes clusters are matched by label selectors and at least one label selector
+  # must be set.
+  # If multiple `health_check_config` resources match the same Kubernetes cluster,
+  # the matching health check configs are sorted by name and only the first
+  # config applies.
+  match:
+    # disable all labels and expressions for all resources in this config
+    disable: false
+    # kubernetes_labels matches Kubernetes cluster labels. An empty value is ignored.
+    # If kubernetes_labels_expression is also set, then the match result is the logical
+    # AND of both.
+    kubernetes_labels:
+      - name: env
+        values:
+          - dev
+          - staging
+    # kubernetes_labels_expression is a label predicate expression to match Kubernetes clusters.
+    # An empty value is ignored.
+    # If kubernetes_labels is also set, then the match result is the logical AND of both.
+    kubernetes_labels_expression: 'labels["owner"] == "platform-team"'
+```
+
+A `default-kube` `health_check_config` is introduced in version (= kubernetes.health_check_min_version =), and enables all Kubernetes clusters to participate in health checks.
+```yaml
+kind: health_check_config
+metadata:
+  description: Enables all health checks by default
+  name: default-kube
+spec:
+  match:
+    kubernetes_labels:
+    - name: '*'
+      values:
+      - '*'
+version: v1
+```
+
+`default-kube` may be disabled, but not permanently deleted. Deleting with `tctl rm health_check_config/default-kube` has the effect of resetting the config to its default settings and matching all Kubernetes clusters.
+
+A different `default` `health_check_config` also exists, and focuses on matching databases for health checks.
+
+Multiple different `health_check_config` resources may be created for different groups of Kubernetes clusters. When multiple `health_check_config` match the same Kubernetes cluster, configs are sorted in ascending order by name, and only the first config applies (e.g., the name "00-my-config" has greater precedence than "10-my-config").
+
+## Disabling Kubernetes health checks
+
+Set the `match.disabled` field to `true` on any `health_check_config`. 
+
+For example, use `tctl edit health_check_config/default-kube`
+```yaml
+kind: health_check_config
+metadata:
+  description: Enables all health checks by default
+  name: default-kube
+spec:
+  match:
+    disable: true
+    kubernetes_labels:
+    - name: '*'
+      values:
+      - '*'
+version: v1
+```
+
+Any defined labels, such as `kubernetes_labels`, are ignored when `disable: true`.
+
+## `tctl` health check commands
+
+Read the default health check config with `tctl get`:
+```bash
+$ tctl get health_check_config/default-kube
+```
+
+Create a new health check config with `tctl create`:
+```bash
+$ tctl create health_check_config.yaml
+```
+
+Update an existing config interactively with `tctl edit`:
+```bash
+$ tctl edit health_check_config/default-kube
+```
+
+Delete a health check config with `tctl rm`:
+```bash
+$ tctl rm health_check_config/example
+```
+
+Teleport Kubernetes Service instances are notified of changes to `health_check_config`, and reevaluate whether a Kubernetes cluster participates in health checks, applying any changes.
+
+## FAQ
+
+### What guidance is there for troubleshooting unhealthy Kubernetes clusters?
+
+See the [Kubernetes Service troubleshooting guide](./troubleshooting.mdx) for specific errors returned by health checks.
+
+### Do health check metrics show which Kubernetes cluster is unhealthy?
+
+No. A specific Kubernetes cluster's health cannot be determined from the `teleport_resources_health_status_*` health metrics.
+
+Only the quantity of unhealthy Kubernetes clusters are available from metrics.
+
+### How do I configure health checks for high-availability?
+
+No additional configuration is needed.
+
+Health-based connection routing is automatic when multiple Teleport Kubernetes Service instances are proxying to the same Kubernetes cluster.
+
+Configuring high-availability with multiple Teleport Kubernetes Service instances proxying the same Kubernetes cluster would be needed.
+
diff --git a/docs/pages/enroll-resources/kubernetes-access/introduction.mdx b/docs/pages/enroll-resources/kubernetes-access/introduction.mdx
index 5af6b08f073af..9e671fa2a08e0 100644
--- a/docs/pages/enroll-resources/kubernetes-access/introduction.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/introduction.mdx
@@ -1,6 +1,11 @@
 ---
 title: Introduction to Enrolling Kubernetes Clusters
+sidebar_label: Introduction
 description: Learn how Teleport can protect your Kubernetes clusters with RBAC, audit logging, and more.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport provides secure access to Kubernetes clusters:
@@ -15,7 +20,7 @@ Teleport provides secure access to Kubernetes clusters:
 The guides in this section show you how to protect Kubernetes clusters with
 Teleport. For instructions on self-hosting Teleport Community Edition or
 Teleport Enterprise on Kubernetes, see the [Kubernetes Deployment
-Guides](../../admin-guides/deploy-a-cluster/helm-deployments/helm-deployments.mdx).
+Guides](../../zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx).
 
 Here is an example of using Teleport to access a Kubernetes cluster, execute
 commands, and view your `kubectl`  activity in Teleport's audit log:
diff --git a/docs/pages/enroll-resources/kubernetes-access/kubernetes-access.mdx b/docs/pages/enroll-resources/kubernetes-access/kubernetes-access.mdx
index eb25b21adae4d..ff884038fec96 100644
--- a/docs/pages/enroll-resources/kubernetes-access/kubernetes-access.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/kubernetes-access.mdx
@@ -1,6 +1,129 @@
 ---
 title: Kubernetes Clusters
-description: Guides to protecting Kubernetes clusters with Teleport
+description: Protect Kubernetes clusters with granular role-based access controls, audit logging, and session recording.
+template: doc-page
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
-<DocCardList />
+import DocHero, { DocHeroProps } from "@site/src/components/Pages/Landing/DocHero";
+import Resources from "@site/src/components/Pages/Homepage/Resources";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+
+import noteSvg from "@site/src/components/Icon/svg/note2.svg";
+import questionSvg from "@site/src/components/Icon/svg/question2.svg";
+import identificationBadgeSvg from "@site/src/components/Icon/svg/identification-badge.svg";
+import listChecksSvg from "@site/src/components/Icon/svg/list-checks.svg";
+import kubernetesClustersSvg from "@site/src/components/Icon/teleport-svg/kubernetes-clusters.svg";
+import iamSvg from "@site/src/components/Icon/svg/awsIdentity.svg";
+import kubernetesSvg from "@site/src/components/Icon/svg/kubernetes2.svg";
+import awsSvg from "@site/src/components/Icon/teleport-svg/aws.svg";
+import gcpSvg from "@site/src/components/Icon/teleport-svg/gcp.svg";
+import azureSvg from "@site/src/components/Icon/teleport-svg/azure.svg";
+
+{/*vale messaging.protocol-products = NO*/}
+<DocHero
+  title="Enroll your first Kubernetes cluster"
+  youtubeVideoId={
+    // cspell:disable-next-line
+    "rQiloHM2oRQ"
+  }
+  ctaLinks={[
+    {
+      title: "Get started with Kubernetes access",
+      href: "./getting-started/",
+      variant: "secondary",
+      arrow: true,
+    },
+  ]}
+  links={[
+    {
+      title: "Kubernetes Access overview",
+      description: "Securely access Kubernetes clusters with SSO, RBAC and audit logging.",
+      href: "./introduction/",
+      icon: noteSvg,
+    }, 
+    {
+      title: "Troubleshooting",
+      description: "Common Kubernetes access issues and their solutions.",
+      href: "./troubleshooting/",
+      icon: questionSvg,
+    },
+  ]}
+>
+{/*vale messaging.protocol-products = YES*/}
+Log in with SSO and securely access enrolled Kubernetes clusters. Manage access within clusters with granular RBAC down to specific cluster resources, and achieve compliance needs with session recordings and detailed audit logs.
+</DocHero>
+
+<Resources
+  title="Access controls"
+  variant="doc"
+  desktopColumnsCount={2}
+  resources={[
+    {
+      title: "RBAC for Kubernetes",
+      description: "Learn how Teleport's Kubernetes Service intercepts API requests and enforces access with Teleport roles.",
+      iconComponent: identificationBadgeSvg,
+      href: "./controls/"
+    },
+    {
+      title: "Configure and set up",
+      description: "Set up Teleport roles to manage Kubernetes access with a hands-on example using a local Kubernetes cluster.",
+      iconComponent: listChecksSvg,
+      href: "./manage-access/"
+    },
+  ]}
+/>
+
+<Resources
+  title="Auto-discover Kubernetes clusters"
+  variant="doc"
+  desktopColumnsCount={3}
+  resources={[
+    {
+      title: "Azure Kubernetes Service (AKS) auto-discovery",
+      description: "Automatically discover any AKS cluster and enroll it in Teleport.",
+      iconComponent: azureSvg,
+      href: "../auto-discovery/kubernetes/azure/"
+    },
+    {
+      title: "Elastic Kubernetes Service (EKS) auto-discovery",
+      description: "Automatically discover any EKS cluster and enroll it in Teleport",
+      iconComponent: awsSvg,
+      href: "../auto-discovery/kubernetes/aws/"
+    },
+    {
+      title: "Google Kubernetes Engine (GKE) auto-discovery",
+      description: "Automatically register your GKE clusters with Teleport",
+      iconComponent: gcpSvg,
+      href: "../auto-discovery/kubernetes/google-cloud/"
+    },
+  ]}
+/>
+
+<Resources
+  title="Additional registration options"
+  variant="doc"
+  desktopColumnsCount={3}
+  resources={[
+    {
+      title: "Dynamic Kubernetes registration",
+      description: "Manage clusters without changing each service's configuration files.",
+      iconComponent: kubernetesClustersSvg,
+      href: "./register-clusters/dynamic-registration/"
+    },
+    {
+      title: "Using AWS IAM joining",
+      description: "Use an AWS IAM identity to automatically enroll a Kubernetes cluster with Teleport.",
+      iconComponent: iamSvg,
+      href: "./register-clusters/iam-joining/"
+    },
+    {
+      title: "Using a static kubeconfig",
+      description: "Run Teleport Kubernetes Service on a Linux host outside the cluster to manage access.",
+      iconComponent: kubernetesSvg,
+      href: "./register-clusters/static-kubeconfig/"
+    },
+  ]}
+/>
\ No newline at end of file
diff --git a/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx b/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx
index b837ca3c54626..2dc23551c167f 100644
--- a/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/manage-access.mdx
@@ -1,6 +1,11 @@
 ---
 title: Setting Up Access Controls for Kubernetes
+sidebar_label: Access Controls Guide
 description: How to configure Teleport roles to access clusters, groups, users, and resources in Kubernetes.
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
 ---
 
 The Teleport Kubernetes Service is a proxy that sits between Kubernetes users
@@ -452,8 +457,8 @@ RBAC configurations.
 
 Now that you know how to configure Teleport's RBAC system to control access to
 Kubernetes clusters, learn how to set up [Resource Access
-Requests](../../admin-guides/access-controls/access-requests/resource-requests.mdx)
+Requests](../../identity-governance/access-requests/resource-requests.mdx)
 for just-in-time access and [Access Request
-plugins](../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx) so you can manage
+plugins](../../identity-governance/access-requests/plugins/plugins.mdx) so you can manage
 access with your communication workflow of choice.
 
diff --git a/docs/pages/enroll-resources/kubernetes-access/register-clusters/dynamic-registration.mdx b/docs/pages/enroll-resources/kubernetes-access/register-clusters/dynamic-registration.mdx
index efdaa8fb77b4e..b3988e2df69d2 100644
--- a/docs/pages/enroll-resources/kubernetes-access/register-clusters/dynamic-registration.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/register-clusters/dynamic-registration.mdx
@@ -1,6 +1,10 @@
 ---
 title: Dynamic Kubernetes Cluster Registration
 description: Register and unregister Kubernetes clusters without restarting a Teleport Kubernetes Service instance.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 With dynamic Kubernetes cluster registration, you can manage the Kubernetes
@@ -15,6 +19,17 @@ In this guide, we will show you how to set up dynamic Kubernetes cluster
 registration, then create, list, update, and delete Kubernetes clusters via
 `tctl`.
 
+## How it works
+
+The Teleport Kubernetes Service proxies traffic from Teleport users to a
+Kubernetes API server so you can take advantage of passwordless authentication,
+role-based access controls, audit logging, and other Teleport features in order
+to manage access to Kubernetes. 
+
+In this step, you will install the Teleport Kubernetes Service on a Linux host
+and configure it to access any Kubernetes cluster you register with your
+Teleport cluster. 
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
@@ -36,14 +51,8 @@ registration, then create, list, update, and delete Kubernetes clusters via
 
 ## Step 1/3. Set up the Teleport Kubernetes Service
 
-The Teleport Kubernetes Service proxies traffic from Teleport users to a
-Kubernetes API server so you can take advantage of passwordless authentication,
-role-based access controls, audit logging, and other Teleport features in order
-to manage access to Kubernetes. 
-
-In this step, you will install the Teleport Kubernetes Service on a Linux host
-and configure it to access any Kubernetes cluster you register with your
-Teleport cluster. 
+This step shows you how to install the Teleport Kubernetes Service on a Linux
+server.
 
 ### Get a join token
 
diff --git a/docs/pages/enroll-resources/kubernetes-access/register-clusters/iam-joining.mdx b/docs/pages/enroll-resources/kubernetes-access/register-clusters/iam-joining.mdx
index 34bbe75aab12c..42cd85453a0a7 100644
--- a/docs/pages/enroll-resources/kubernetes-access/register-clusters/iam-joining.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/register-clusters/iam-joining.mdx
@@ -1,6 +1,10 @@
 ---
 title: Register a Kubernetes Cluster using IAM Joining
 description: Connecting a Kubernetes cluster to Teleport with IAM joining.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 In this guide, we will show you how to register a Kubernetes cluster with
diff --git a/docs/pages/enroll-resources/kubernetes-access/register-clusters/register-clusters.mdx b/docs/pages/enroll-resources/kubernetes-access/register-clusters/register-clusters.mdx
index 00ce72a418f68..a3291eda9c260 100644
--- a/docs/pages/enroll-resources/kubernetes-access/register-clusters/register-clusters.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/register-clusters/register-clusters.mdx
@@ -1,7 +1,12 @@
 ---
 title: Registering Kubernetes Clusters with Teleport
+sidebar_label: Registering Clusters
+sidebar_position: 3
 description: How to manually add a Kubernetes cluster to Teleport after creating it.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 In some cases, you will want to register a Kubernetes cluster with Teleport
diff --git a/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx b/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx
index 46975242971f9..4b186351b9e04 100644
--- a/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/register-clusters/static-kubeconfig.mdx
@@ -1,6 +1,10 @@
 ---
 title: Register a Kubernetes Cluster with a Static kubeconfig
 description: Connecting standalone Teleport installations to Kubernetes clusters.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 While you can register a Kubernetes cluster with Teleport by running the
diff --git a/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx b/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx
index 4bd3c67668e08..74b8b33eb5933 100644
--- a/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx
+++ b/docs/pages/enroll-resources/kubernetes-access/troubleshooting.mdx
@@ -1,6 +1,11 @@
 ---
 title: Kubernetes Access Troubleshooting
+sidebar_label: Troubleshooting
 description: Troubleshooting common issues with Kubernetes access
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This page describes common issues with Kubernetes and how to resolve them.
@@ -175,7 +180,7 @@ joinParams:
   method: "token"
   tokenName: "${TOKEN}"
 kubeClusterName: "${CLUSTER}"
-labels:
+tags:
   "type" : "autopilot"
 EOF
 # Install the helm chart with the values.yaml setting
@@ -271,4 +276,139 @@ resource with the `create` verb, update it to allow the `get` verb as well:
 ```
 
 Once the `ClusterRole` is updated, you should be able to exec into Pods using
-`kubectl` version 1.30 or later.
\ No newline at end of file
+`kubectl` version 1.30 or later.
+
+## Health Check: Unable to contact the Kubernetes cluster
+
+### Symptoms
+
+A Kubernetes cluster is reported as `unhealthy`, and all calls between Teleport and the Kubernetes cluster API fail.
+
+### Explanation
+
+A Teleport Kubernetes Service performed multiple health checks on a Kubernetes cluster and did not receive a response.
+
+Calls to Kubernetes cluster API endpoints `/selfsubjectaccessreviews` and `/readyz` returned errors without HTTP status codes.
+
+### Resolution
+
+Examine the Kubernetes cluster and network for root causes.
+
+Check the state of the Kubernetes cluster.
+```bash
+kubectl cluster-info
+kubectl get --raw /readyz
+```
+
+Check network and firewall rules.
+- Is the network configured properly?
+- Check security groups
+- Check network policies
+
+## Health Check: Missing required Kubernetes permissions
+
+### Symptoms
+
+A Kubernetes cluster is reported as `unhealthy`, and is missing one or more Kubernetes permissions such as `impersonate users`, `impersonate groups`, `impersonate service accounts` and/or `get pods`.
+
+### Explanation
+
+A Teleport Kubernetes Service performed a health check on a Kubernetes cluster, and received a response saying required Kubernetes cluster capabilities are denied.
+
+The Kubernetes cluster is missing a `ClusterRole`, or is configured with a partial `ClusterRole`. Teleport requires four Kubernetes [SelfSubjectAccessReview](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1/) permissions:
+- Impersonate users
+- Impersonate groups
+- Impersonate service accounts
+- Get pods
+
+### Resolution
+
+Add a `ClusterRole` and `ClusterRoleBinding` to the Kubernetes cluster with the four permissions.
+
+```bash
+$ kubectl config use-context <your-kube-context>
+kubectl apply -f - <<EOF
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: teleport-impersonation
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - users
+      - groups
+      - serviceaccounts
+    verbs:
+      - impersonate
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - "authorization.k8s.io"
+    resources:
+      - selfsubjectaccessreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: teleport
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: teleport-impersonation
+subjects:
+  - kind: ServiceAccount
+    name: teleport-serviceaccount
+    namespace: default
+EOF
+```
+
+Your `ClusterRoleBinding` might vary.
+
+Also see [enabling impersonation](./controls.mdx) in Teleport Kubernetes.
+
+## Health Check: Unhealthy Kubernetes cluster detected with status code
+
+### Symptoms
+
+A Kubernetes cluster is reported as `unhealthy`, and Teleport received a response from the Kubernetes cluster with an error status code.
+
+### Explanation
+
+A Teleport Kubernetes Service performed multiple health checks on a Kubernetes cluster and received responses.
+
+A call to the permission endpoint `/selfsubjectaccessreviews` failed, and a call to the Kubernetes cluster `/readyz` endpoint returned a response with an error status code. The error status code indicates that a component in the Kubernetes cluster is in an unhealthy state.
+
+### Resolution
+
+Diagnose the Kubernetes cluster error status code with `kubectl`.
+```bash
+kubectl cluster-info
+kubectl get --raw /readyz
+```
+
+## Health Check: Unable to check Kubernetes permissions
+
+### Symptoms
+
+A Kubernetes cluster is reported as `unhealthy`, and Teleport received mixed responses from health check endpoints.
+
+### Explanation
+
+A Teleport Kubernetes Service performed multiple health checks on a Kubernetes cluster and received responses.
+
+A call to the permission endpoint `/selfsubjectaccessreviews` failed, and a call to the Kubernetes cluster `/readyz` succeeded. Kubernetes cluster components are operational and something is blocking calls to the Kubernetes [SelfSubjectAccessReview](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1/) API.
+
+### Resolution
+
+Diagnose the Kubernetes cluster with `kubectl`.
+```bash
+kubectl cluster-info
+kubectl get --raw /readyz
+```
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/access-guides.mdx b/docs/pages/enroll-resources/machine-id/access-guides/access-guides.mdx
deleted file mode 100644
index 74effcf288a11..0000000000000
--- a/docs/pages/enroll-resources/machine-id/access-guides/access-guides.mdx
+++ /dev/null
@@ -1,26 +0,0 @@
----
-title: Access your Infrastructure with Machine ID
-description: How to use Machine ID to enable secure access to Teleport resources.
-layout: tocless-doc
----
-
-These guides cover how to configure a deployed Machine ID to produce credentials
-that can be used for machine to machine access to different Teleport resources.
-
-It is a pre-requisite of these guides that Machine ID has been configured for
-your platform, see the [Deploy Machine ID](../deployment/deployment.mdx) guides for information
-on how to do so.
-
-## Resource Access
-
-- [SSH servers](ssh.mdx): How to use Machine ID to access servers via SSH.
-- [Kubernetes clusters](kubernetes.mdx): How to use Machine ID to access Kubernetes clusters.
-- [Databases](databases.mdx): How to use Machine ID to access database servers.
-- [Applications](applications.mdx): How to use Machine ID to access applications.
-
-## Specific Tools
-
-- [tctl](tctl.mdx): How to use Machine ID with `tctl` to manage your Teleport configuration.
-- [Teleport Terraform provider](../../../admin-guides/infrastructure-as-code/terraform-provider/dedicated-server.mdx): How to use Machine ID with the Teleport Terraform provider to manage your Teleport configuration as IaC.
-- [Ansible](ansible.mdx): How to use Machine ID with Ansible.
-- [SPIFFE](../../workload-identity/getting-started.mdx): How to use Machine ID to issue SPIFFE certificates.
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/ansible.mdx b/docs/pages/enroll-resources/machine-id/access-guides/ansible.mdx
deleted file mode 100644
index 55e4fa6a07f61..0000000000000
--- a/docs/pages/enroll-resources/machine-id/access-guides/ansible.mdx
+++ /dev/null
@@ -1,267 +0,0 @@
----
-title: Machine ID with Ansible
-description: How to use Machine ID with Ansible
----
-
-Ansible is a common tool for managing fleets of Linux hosts via SSH. In order to
-connect to the hosts, it requires a form of authentication. Machine ID can be
-used to provide short-lived certificates to Ansible that allow it to connect
-to SSH nodes enrolled in Teleport in a secure and auditable manner.
-
-In this guide, you will configure the Machine ID agent, `tbot`, to produce
-credentials and an OpenSSH configuration, and then configure Ansible to use
-these to connect to your SSH nodes through the Teleport Proxy Service.
-
-## Prerequisites
-
-You will need the following tools to use Teleport with Ansible.
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- `ssh` OpenSSH tool
-
-- `ansible` >= (=ansible.min_version=)
-
-- Optional: [`jq`](https://stedolan.github.io/jq/) to process `JSON` output
-
-- `tbot` must already be installed and configured on the machine that will
-  run Ansible. For more information, see the
-  [deployment guides](../deployment/deployment.mdx).
-
-- If you followed the above guide, note the `--destination-dir=/opt/machine-id`
-  flag, which defines the directory where SSH certificates and OpenSSH configuration
-  used by Ansible will be written.
-
-  In particular, you will be using the `/opt/machine-id/ssh_config` file in your
-  Ansible configuration to define how Ansible should connect to Teleport Nodes.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/4. Configure RBAC
-
-As Ansible will use the credentials produced by `tbot` to connect to the SSH
-nodes, you first need to configure Teleport to grant the bot access. This is
-done by creating a role that grants the necessary permissions and then assigning
-this role to a Bot.
-
-In this example, access will be granted to all SSH nodes for the username
-<Var name="root" />. Ensure that you set this to a username that is available
-across your SSH nodes and that will have the appropriate privileges to manage
-your nodes.
-
-Create a file called `role.yaml` with the following content:
-
-```yaml
-kind: role
-version: v6
-metadata:
-  name: example-role
-spec:
-  allow:
-    # Allow login to the user 'root'.
-    logins: ['<Var name="root" />']
-    # Allow connection to any node. Adjust these labels to match only nodes
-    # that Ansible needs to access.
-    node_labels:
-      '*': '*'
-```
-
-Replace `example-role` with a descriptive name related to your use case.
-
-For production use, you should use labels to restrict this access to only the
-hosts that Ansible will need to access. This is known as the principal of
-least privilege and reduces damage that exfiltrated credentials can do.
-
-Use `tctl create -f ./role.yaml` to create the role.
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-Now, use `tctl bots update` to add the role to the Bot. Replace `example`
-with the name of the Bot you created in the deployment guide and `example-role`
-with the name of the role you just created:
-
-```code
-$ tctl bots update example --add-roles example-role
-```
-
-## Step 2/4. Configure the `tbot` output
-
-Now, `tbot` needs to be configured with an output that will produce the
-credentials and SSH configuration that is needed by Ansible. For SSH,
-we use the `identity` output type.
-
-Outputs must be configured with a destination. In this example, the `directory`
-destination will be used. This will write these credentials to a specified
-directory on disk. Ensure that this directory can be written to by the Linux
-user that `tbot` runs as, and that it can be read by the Linux user that Ansible
-will run as.
-
-Modify your `tbot` configuration to add an `identity` output:
-
-```yaml
-outputs:
-- type: identity
-  destination:
-    type: directory
-    # For this guide, /opt/machine-id is used as the destination directory.
-    # You may wish to customize this. Multiple outputs cannot share the same
-    # destination.
-    path: /opt/machine-id
-```
-
-If operating `tbot` as a background service, restart it. If running `tbot` in
-one-shot mode, it must be executed before you attempt to execute the Ansible
-playbook.
-
-You should now see several files under `/opt/machine-id`:
-
-- `ssh_config`: this can be used with Ansible or OpenSSH to configure them to
-use the Teleport Proxy Service with the correct credentials when making connections.
-- `known_hosts`: this contains the Teleport SSH host CAs and allows the SSH
-client to validate a host's certificate.
-- `key-cert.pub`: this is an SSH certificate signed by the Teleport SSH user
-CA.
-- `key`: this is the private key needed to use the SSH certificate.
-
-Next, Ansible will be configured to use these files when making connections.
-
-## Step 3/4. Configure Ansible
-
-Create a folder named `ansible` where all Ansible files will be collected.
-
-```code
-$ mkdir -p ansible
-$ cd ansible
-```
-
-Create a file called `ansible.cfg`. We will configure Ansible
-to run the OpenSSH client with the configuration file generated
-by Machine ID, `/opt/machine-id/ssh_config`. Note, `example.com` here is the
-name of your Teleport cluster.
-
-```code
-[defaults]
-host_key_checking = True
-inventory=./hosts
-remote_tmp=/tmp
-
-[ssh_connection]
-scp_if_ssh = True
-ssh_args = -F /opt/machine-id/ssh_config
-```
-
-You can then create an inventory file called `hosts`. This should refer to the
-hosts using their hostname as registered in Teleport and the name of your
-Teleport cluster should be appended to this. For example, if your cluster is
-called `teleport.example.com` and your host is called `node1`, the entry in
-`hosts` would be `node1.teleport.example.com`.
-
-You can generate an inventory file for all your nodes that meets this
-requirement with a script like the following:
-
-```code
-# Source tsh env to get the name of the current Teleport cluster.
-$ eval "$( tsh env )"
-# You can modify the `tsh ls` command to filter nodes based ont he label.
-$ tsh ls --format=json | jq --arg cluster $TELEPORT_CLUSTER -r '.[].spec.hostname + "." + $cluster' > hosts
-```
-
-<details>
-<summary>Not seeing Nodes?</summary>
-
-(!docs/pages/includes/node-logins.mdx!)
-
-</details>
-
-## Step 4/4. Run a playbook
-
-Finally, let's create a simple Ansible playbook, `playbook.yaml`. The example
-playbook below runs `hostname` on all hosts.
-
-```yaml
-- hosts: all
-  remote_user: <Var name="root" />
-  tasks:
-    - name: "hostname"
-      command: "hostname"
-```
-
-From the folder `ansible`, run the Ansible playbook:
-
-```code
-$ ansible-playbook playbook.yaml
-
-# PLAY [all] *****************************************************************************************************************************************
-# TASK [Gathering Facts] *****************************************************************************************************************************
-#
-# ok: [terminal]
-#
-# TASK [hostname] ************************************************************************************************************************************
-# changed: [terminal]
-#
-# PLAY RECAP *****************************************************************************************************************************************
-# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-```
-
-You are all set. You have provided your machine with short-lived certificates
-tied to a machine identity that can be rotated, audited, and controlled with
-all the familiar access controls.
-
-## Troubleshooting
-
-In case if Ansible cannot connect, you may see error like this one:
-
-```txt
-example.host | UNREACHABLE! => {
-    "changed": false,
-    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname node-name: Name or service not known",
-    "unreachable": true
-}
-```
-
-You can examine and tweak patterns matching the inventory hosts in `ssh_config`.
-
-Try the SSH connection using `ssh_config` with verbose mode to inspect the error:
-
-```code
-$ ssh -vvv -F /opt/machine-id/ssh_config <Var name="root" />@node-name.example.com
-```
-
-If `ssh` works, try running the playbook with verbose mode on:
-
-```code
-$ ansible-playbook -vvv playbook.yaml
-```
-
-If your hostnames contain uppercase characters (like `MYHOSTNAME`), please note that Teleport's internal hostname matching
-is case sensitive by default, which can also lead to seeing this error.
-
-If this is the case, you can work around this by enabling case-insensitive routing at the cluster level.
-
-<Tabs>
-<TabItem label="Self-hosted Teleport">
-
-Edit your `/etc/teleport.yaml` config file on all servers running the Teleport `auth_service`, then restart Teleport on each.
-
-```yaml
-auth_service:
-  case_insensitive_routing: true
-```
-
-</TabItem>
-<TabItem label="Managed Teleport Enterprise/Cloud">
-
-Run `tctl edit cluster_networking_config` to add the following specification, then save and exit.
-
-```yaml
-spec:
-  case_insensitive_routing: true
-```
-
-</TabItem>
-</Tabs>
-
-## Next steps
-
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/kubernetes.mdx b/docs/pages/enroll-resources/machine-id/access-guides/kubernetes.mdx
deleted file mode 100644
index fa31db21ad6f7..0000000000000
--- a/docs/pages/enroll-resources/machine-id/access-guides/kubernetes.mdx
+++ /dev/null
@@ -1,209 +0,0 @@
----
-title: Machine ID with Kubernetes Access
-description: How to use Machine ID to access Kubernetes clusters
----
-
-Teleport protects and controls access to Kubernetes
-clusters. Machine ID can be used to grant machines secure, short-lived
-access to these clusters.
-
-In this guide, you will configure `tbot` to produce credentials that can be
-used to access a Kubernetes cluster enrolled with your Teleport cluster.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- If you have not already connected your Kubernetes cluster to Teleport, follow
-  [Enroll a Kubernetes Cluster](../../kubernetes-access/getting-started.mdx).
-- (!docs/pages/includes/tctl.mdx!)
-- To configure the Kubernetes cluster, your client system will need to have
-  `kubectl` installed. See the
-  [Kubernetes documentation](https://kubernetes.io/docs/tasks/tools/) for
-  installation instructions.
-- `tbot` must already be installed and configured on the machine that will
-  access Kubernetes clusters. For more information, see the
-  [deployment guides](../deployment/deployment.mdx).
-- To demonstrate connecting to the Kubernetes cluster, the machine that will
-  access Kubernetes clusters will need to have `kubectl` installed. See the
-  [Kubernetes documentation](https://kubernetes.io/docs/tasks/tools/) for
-  installation instructions.
-
-## Step 1/3. Configure Teleport and Kubernetes RBAC
-
-First, we need to configure the RBAC for both Teleport and Kubernetes in order
-to grant the bot the correct level of access.
-
-When forwarding requests to the Kubernetes API on behalf of a bot, the
-Teleport Proxy attaches the groups configured (using `kubernetes_groups`) in the
-bot's Teleport roles to the request. These groups are then used to configure a
-RoleBinding or ClusterRoleBinding in Kubernetes to grant specific permissions
-within the Kubernetes cluster to the bot.
-
-For the purpose of this guide, we will bind the `editor` group to the default
-`edit` ClusterRole that is preconfigured in most Kubernetes clusters to give
-the bot read and write access to resources in all the cluster namespaces.
-
-When configuring this for a production environment, you should consider:
-
-- If RoleBinding should be used instead of ClusterRoleBinding to limit the
-  bot's access to a specific namespace.
-- If a Role should be created that grants the bot the least privileges
-  necessary rather than using a pre-existing general Role such as `edit`.
-
-To bind the `editor` group to the `edit` Cluster Role, execute:
-
-```code
-$ kubectl create clusterrolebinding teleport-editor-edit \
-  --clusterrole=edit \
-  --group=editor
-```
-
-With the appropriate RoleBinding configured in Kubernetes to grant access to
-a specific group, you now need to add this group to the role that the bot
-will impersonate when producing credentials. You also need to grant the bot
-access through Teleport to the cluster itself. This is done by creating a
-role that grants the necessary permissions and then assigning this role to a
-Bot.
-
-Create a file called `role.yaml` with the following content:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: example-role
-spec:
-  allow:
-    kubernetes_labels:
-      '*': '*'
-    kubernetes_groups:
-    - editor
-    kubernetes_resources:
-    - kind: "*"
-      namespace: "*"
-      name: "*"
-      verbs: ["*"]
-```
-
-Replace `example-role` with a descriptive name related to your use case.
-
-Adjust the `allow` field for your environment:
-
-- `kubernetes_labels` should be adjusted to grant access to only the clusters
-  that the bot will need to access. The value shown, `'*': '*'` will grant
-  access to all Kubernetes clusters.
-- `editor` must match the name of the group you specified in the
-  RoleBinding or ClusterRoleBinding.
-- `kubernetes_resources` can be used to apply additional restrictions to what
-  the bot can access within the Kubernetes cluster. These restrictions are
-  layered upon the RBAC configured within the Kubernetes role itself.
-
-Use `tctl create -f ./role.yaml` to create the role.
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-Now, use `tctl bots update` to add the role to the Bot. Replace `example`
-with the name of the Bot you created in the deployment guide and `example-role`
-with the name of the role you just created:
-
-```code
-$ tctl bots update example --add-roles example-role
-```
-
-## Step 2/3. Configure a Kubernetes `tbot` output
-
-Now, `tbot` needs to be configured with an output to produce the Kubernetes
-credentials and client configuration file. This is done using the
-`kubernetes/v2` output type.
-
-The Kubernetes clusters you wish to make available must be specified using
-entries in the `selectors` list. In this example, `example-k8s-cluster` will be
-selected using a name selector, and all clusters with the label
-`environment=dev` will be selected as well.
-
-Outputs must also be configured with a destination. In this example, the
-`directory` type will be used. This will write artifacts to a specified
-directory on disk. Ensure that this directory can be written to by the Linux
-user that `tbot` runs as, and that it can be read by the Linux user that will
-be accessing the Kubernetes cluster.
-
-Modify your `tbot` configuration to add a `kubernetes/v2` output:
-
-```yaml
-outputs:
-  - type: kubernetes/v2
-    selectors:
-      # Specify the name of the Kubernetes cluster you wish the credentials to
-      # grant access to. Note that wildcards are not supported.
-      - name: example-k8s-cluster
-
-      # Specify a label selector to dynamically select many clusters at once.
-      # All labels in a selector must match for a cluster to be selected, and
-      # multiple separate selectors can be specified if desired. Note that
-      # wildcards are not supported.
-      - labels:
-          environment: dev
-    destination:
-      type: directory
-          # For this guide, /opt/machine-id is used as the destination directory.
-          # You may wish to customize this. Multiple outputs cannot share the same
-          # destination.
-      path: /opt/machine-id
-```
-
-Ensure you replace `example-k8s-cluster` with the name of the Kubernetes cluster
-as registered in Teleport and adjust `/opt/machine-id` if you wish.
-
-If operating `tbot` as a background service, restart it. If running `tbot` in
-one-shot mode, it must be executed before you attempt to use the credentials.
-
-## Step 3/3. Connect to your Kubernetes cluster with the Machine ID identity
-
-Once `tbot` has been run with the new output configured, a file called
-`kubeconfig.yaml` should have been generated in the destination directory
-you specified. This contains all the information necessary for `kubectl` to
-connect to the Kubernetes cluster through the Teleport Proxy.
-
-To use `kubeconfig.yaml` with `kubectl`, the `--kubeconfig` flag or `KUBECONFIG`
-environment variable can be provided to `kubectl`:
-
-```code
-$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml get pods -A
-# Or, set the KUBECONFIG environment variable:
-$ export KUBECONFIG=/opt/machine-id/kubeconfig.yaml
-$ kubectl get pods -A
-```
-
-If you selected multiple clusters, they will be exposed as separate contexts
-within the generated `kubeconfig.yaml`, and will be named following the format
-`$teleportClusterName-$kubeClusterName`. To target a specific cluster, use the
-`--context` flag:
-
-```code
-$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml --context=example.teleport.sh-my-kube-cluster get pods -A
-```
-
-Note that the first selected cluster in `tbot.yaml` will be used as the default
-context. If using label selectors, the default context may vary over time if
-clusters are added or removed in Teleport.
-
-If new matching clusters are added or removed in Teleport, `kubeconfig.yaml`
-will be regenerated to reflect the change on the bot's next certificate renewal.
-If needed, the `tbot` process can be restarted or signaled (`pkill -USR1 tbot`)
-to trigger an immediate reload. Note that modifications to `kubeconfig.yaml`,
-such as changes to the `current-context` field, will be overwritten.
-
-Whilst this guide has demonstrated `kubeconfig.yaml` being used with `kubectl`,
-this format is compatible with most Kubernetes tools including:
-
-- Helm
-- Lens
-- ArgoCD
-
-## Next steps
-
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- Read the [Teleport Kubernetes RBAC guide](../../kubernetes-access/controls.mdx)
-  for more details on controlling Kubernetes access.
diff --git a/docs/pages/enroll-resources/machine-id/deployment/aws.mdx b/docs/pages/enroll-resources/machine-id/deployment/aws.mdx
deleted file mode 100644
index 0ab78b1f7a3e9..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/aws.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-title: Deploying Machine ID on AWS
-description: How to install and configure Machine ID on an AWS EC2 instance
----
-
-This guide explains how to deploy Machine ID on Amazon Web Services by running
-the `tbot` binary and joining it to your Teleport cluster.
-
-## How it works
-
-On AWS, virtual machines can be assigned an IAM role, which they can assume in
-order to request a signed document that includes information about the machine.
-The Teleport `iam` join method instructs the Machine ID bot to request this
-signed document from AWS using the assigned identity and send it to the Teleport
-Auth Service for verification. This allows the bot to join the cluster without
-the exchange of a long-lived secret.
-
-While this guide focuses on deploying Machine ID on an EC2 instance, it is also
-possible to use the `iam` join method with workloads running on an EKS
-Kubernetes cluster. To do so, you must configure [IAM Roles for Service Accounts
-(IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
-for the cluster and the Kubernetes service account that will be used by the
-`tbot` pod. See the [Kubernetes platform guide](kubernetes.mdx) for further
-guidance on deploying Machine ID as a workload on Kubernetes.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- An AWS IAM role that you wish to grant access to your Teleport cluster. This
-  role must be granted `sts:GetCallerIdentity`. In this guide, this role will
-  be named `teleport-bot-role`.
-- An AWS EC2 virtual machine that you wish to install Machine ID onto configured
-  with the IAM role attached.
-
-## Step 1/5. Install `tbot`
-
-**This step is completed on the AWS EC2 instance.**
-
-First, `tbot` needs to be installed on the VM that you wish to use Machine ID
-on.
-
-Download and install the appropriate Teleport package for your platform:
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 2/5. Create a Bot
-
-**This step is completed on your local machine.**
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 3/5. Create a join token
-
-**This step is completed on your local machine.**
-
-Create `bot-token.yaml`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  # name will be specified in the `tbot` to use this token
-  name: example-bot
-spec:
-  roles: [Bot]
-  # bot_name should match the name of the bot created earlier in this guide.
-  bot_name: example
-  join_method: iam
-  # Restrict the AWS account and (optionally) ARN that can use this token.
-  # This information can be obtained from running the
-  # "aws sts get-caller-identity" command from the CLI.
-  allow:
-    - aws_account: "111111111111"
-      aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-bot-role/i-*"
-```
-
-Replace:
-
-- `111111111111` with the ID of your AWS account.
-- `teleport-bot-role` with the name of the AWS IAM role you created and assigned
-  to the EC2 instance.
-- `example` with the name of the bot you created in the second step.
-- `i-*` indicates that any instance with the specified role can use the join
-  method. If you wish to restrict this to an individual instance, replace `i-*`
-  with the full instance ID.
-
-Use `tctl` to apply this file:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-## Step 4/5. Configure `tbot`
-
-**This step is completed on the AWS EC2 instance.**
-
-Create `/etc/tbot.yaml`:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: iam
-  token: example-bot
-storage:
-  type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy Service or
-  Auth Service. Prefer using the address of a Teleport Proxy Service instance.
-- `example-bot` with the name of the token you created in the second step.
-
-(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
-
-## Step 5/5. Configure outputs
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## Next steps
-
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/azure.mdx b/docs/pages/enroll-resources/machine-id/deployment/azure.mdx
deleted file mode 100644
index 6a8e46a950f72..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/azure.mdx
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: Deploying Machine ID on Azure
-description: How to install and configure Machine ID on an Azure VM
----
-
-In this guide, you will install Machine ID's agent, `tbot` on an Azure VM. The
-bot will be configured to use the `azure` delegated joining method to
-authenticate to your Teleport cluster. This eliminates the need for long-lived
-secrets.
-
-## How it works
-
-On the Azure platform, virtual machines can be assigned a managed identity. The
-Azure platform will then make available to the virtual machine an attested
-data document and JWT that allows the virtual machine to act as this identity.
-This identity can be validated by a third party by attempting to use this token
-to fetch its own identity from the Azure identity service.
-
-The `azure` join method instructs the bot to use this attested data document and
-JWT to prove its identity to the Teleport Auth Service. This allows joining to
-occur without the use of a long-lived secret.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- An Azure managed identity with a role granting the
-  `Microsoft.Compute/virtualMachines/read` permission. You will need to know
-  the UID of this identity.
-- An Azure VM you wish to install Machine ID onto with the managed identity
-  configured as a user-assigned managed identity.
-
-## Step 1/5. Install `tbot`
-
-**This step is completed on the Azure VM.**
-
-First, `tbot` needs to be installed on the VM that you wish to use Machine ID
-on.
-
-Download and install the appropriate Teleport package for your platform:
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 2/5. Create a Bot
-
-**This step is completed on your local machine.**
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 3/5. Create a join token
-
-**This step is completed on your local machine.**
-
-Create `bot-token.yaml`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  # name will be specified in the `tbot` to use this token
-  name: example-bot
-spec:
-  roles: [Bot]
-  # bot_name should match the name of the bot created earlier in this guide.
-  bot_name: example
-  join_method: azure
-  azure:
-    allow:
-      # subscription should be the UID of an Azure subscription. Only VMs within
-      # this subscription will be able to join.
-    - subscription: 11111111-1111-1111-1111-111111111111
-      # resource_groups allows joining to be restricted to VMs in a specific
-      # resource group. It can be omitted to allow joining from any VM within
-      # a subscription.
-      resource_groups: ["group1"]
-```
-
-Replace:
-
-- `11111111-1111-1111-1111-111111111111` with the UID of your Azure subscription
-- `example` with the name of the bot you created in the second step
-- `group1` with the name of the resource group that the VM resides within or
-  omit this entirely to allow joining from any VM within the subscription
-
-Use `tctl` to apply this file:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-## Step 4/5. Configure `tbot`
-
-**This step is completed on the Azure VM.**
-
-Create `/etc/tbot.yaml`:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: azure
-  token: example-bot
-  azure :
-    client_id: 22222222-2222-2222-2222-222222222222
-storage:
-  type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
-  Auth Service. Prefer using the address of a Teleport Proxy.
-- `22222222-2222-2222-2222-222222222222` with the ID of the Azure managed
-  identity that has been assigned to the VM.
-- `example-bot` with the name of the token you created in the second step.
-
-(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
-
-## Step 5/5. Configure outputs
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## Next steps
-
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/deployment.mdx b/docs/pages/enroll-resources/machine-id/deployment/deployment.mdx
deleted file mode 100644
index 82880a240447a..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/deployment.mdx
+++ /dev/null
@@ -1,77 +0,0 @@
----
-title: Deploy Machine ID
-description: Explains how to deploy Machine ID on your platform and join it to your Teleport cluster.
-tocDepth: 3
----
-
-The first step to set up Machine ID is to deploy the `tbot` binary and join a
-Machine ID bot to your Teleport cluster. You can run the `tbot` binary on a
-number of platforms, from AWS and GitHub Actions to a generic Linux server or
-Kubernetes cluster. This guide shows you how to deploy Machine ID on your
-infrastructure.
-
-## Choosing a deployment method
-
-There are two considerations to make when determining how to deploy Machine ID on
-your infrastructure.
-
-### Your infrastructure
-
-The `tbot` binary runs as a container or on a Linux virtual machine. If you run
-`tbot` on GitHub Actions, you can use one of the ready-made [Teleport GitHub
-Actions workflows](https://github.com/teleport-actions).
-
-### Join method
-
-Machine ID joins your Teleport cluster by using one of the following
-authentication methods:
-
-- **Platform-signed document:** The platform that hosts `tbot`, such as a
-  Kubernetes cluster or Amazon EC2 instance, provides a signed identity document
-  that Teleport can verify using the platform's certificate authority. This is
-  the recommended approach because it avoids the use of shared secrets.
-- **Static join token:** Your Teleport client tool generates a string and stores
-  it on the Teleport Auth Service. Machine ID provides this string when it first
-  connects to your Teleport cluster, demonstrating to the Auth Service that it
-  belongs in the cluster. From then on, Machine ID authenticates to your
-  Teleport cluster with a renewable certificate.
-
-## Deployment guides
-
-The guides in this section show you how to deploy Machine ID and join it
-to your cluster. Choose a guide based on the platform where you intend to run
-Machine ID.
-
-If a specific guide does not exist for your platform, the [Linux
-guide](linux.mdx) is compatible with most platforms. For
-custom approaches, you can also read the [Machine ID Reference](../../../reference/machine-id/machine-id.mdx)
-and [Architecture](../../../reference/architecture/machine-id-architecture.mdx) to plan your deployment.
-
-### Self-hosted infrastructure
-
-Read the following guides for how to deploy Machine ID on your cloud platform or
-on-prem infrastructure.
-
-| Platform                                  | Installation method                             | Join method                                         |
-|-------------------------------------------|-------------------------------------------------|-----------------------------------------------------|
-| [Linux](linux.mdx)           | Package manager or TAR archive                  | Static join token                                   |
-| [Linux (TPM)](linux-tpm.mdx) | Package manager or TAR archive                  | Attestation from TPM 2.0                            |
-| [GCP](gcp.mdx)               | Package manager, TAR archive, or Kubernetes pod | Identity document signed by GCP                     |
-| [AWS](aws.mdx)               | Package manager, TAR archive, or Kubernetes pod | Identity document signed by AWS                     |
-| [Azure](azure.mdx)           | Package manager or TAR archive                  | Identity document signed by Azure                   |
-| [Kubernetes](kubernetes.mdx) | Kubernetes pod                                  | Identity document signed by your Kubernetes cluster |
-
-### CI/CD
-
-Read the following guides for how to deploy Machine ID on a continuous
-integration and continuous deployment platform
-
-| Platform                                                                                            | Installation method                                           | Join method                        |
-|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------|------------------------------------|
-| [Bitbucket Pipelines](bitbucket.mdx)                                                   | TAR archive                                                   | Bitbucket-signed identity document |
-| [CircleCI](circleci.mdx)                                                               | TAR archive                                                   | CircleCI-signed identity document  |
-| [GitLab](gitlab.mdx)                                                                   | TAR archive                                                   | GitLab-signed identity document    |
-| [GitHub Actions](github-actions.mdx)                                                   | Teleport job available through the GitHub Actions marketplace | GitHub-signed identity document.   |
-| [Jenkins](jenkins.mdx)                                                                 | Package manager or TAR archive                                | Static join token                  |
-| [Spacelift](../../../admin-guides/infrastructure-as-code/terraform-provider/spacelift.mdx)             | Docker Image                                                  | Spacelift-signed identity document |
-| [Terraform Cloud](../../../admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx) | Teleport Terraform Provider via Teleport's Terraform Registry | Terraform Cloud-signed identity document |
diff --git a/docs/pages/enroll-resources/machine-id/deployment/gcp.mdx b/docs/pages/enroll-resources/machine-id/deployment/gcp.mdx
deleted file mode 100644
index 0cafa3203fb5d..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/gcp.mdx
+++ /dev/null
@@ -1,133 +0,0 @@
----
-title: Deploying Machine ID on GCP
-description: How to install and configure Machine ID on a GCP VM
----
-
-This guide explains how to deploy Machine ID on Google Cloud Platform (GCP) by
-running the `tbot` binary and joining it to your Teleport cluster.
-
-## How it works
-
-On GCP, virtual machines can be assigned a service account. These machines can
-then request a signed JSON web token from GCP, which allows third parties to
-verify information about them, including their service accounts, using the GCP
-public key. The Teleport `gcp` join method instructs a Machine ID bot to use
-this service account JWT to prove its identity to the Teleport Auth Service and
-join your Teleport cluster without using long-lived secrets.
-
-Whilst the guide on this page focuses explicitly on deploying Machine ID on a
-GCP Virtual Machine, it is also possible to use the `gcp` join method with
-workloads  running on Google Kubernetes Engine. To do so, you must configure
-[GCP Workload
-Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
-for the cluster and the Kubernetes service account that will be used by the
-`tbot` pod. See the [Kubernetes platform guide](kubernetes.mdx) for further
-guidance on deploying Machine ID as a workload on Kubernetes.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A GCP service account you wish to grant access to your Teleport cluster that
-  is not the GCP compute default service account.
-- A GCP Compute Engine VM that you wish to install Machine ID onto that has
-  been configured with the GCP service account.
-
-## Step 1/5. Install `tbot`
-
-**This step is completed on the GCP VM.**
-
-First, `tbot` needs to be installed on the VM that you wish to use Machine ID
-on.
-
-Download and install the appropriate Teleport package for your platform:
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 2/5. Create a Bot
-
-**This step is completed on your local machine.**
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 3/5. Create a join token
-
-**This step is completed on your local machine.**
-
-Create `bot-token.yaml`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  # name will be specified in the `tbot` to use this token
-  name: example-bot
-spec:
-  roles: [Bot]
-  # bot_name should match the name of the bot created earlier in this guide.
-  bot_name: example
-  join_method: gcp
-  gcp:
-    # allow specifies the rules by which the Auth Service determines if `tbot`
-    # should be allowed to join.
-    allow:
-    - project_ids:
-        - my-project-123456
-      service_accounts:
-        # This should be the full "name" of a GCP service account. The default
-        # compute service account is not supported.
-        - my-service-account@my-project-123456.iam.gserviceaccount.com
-```
-
-Replace:
-
-- `my-project-123456` with the ID of your GCP project
-- `example` with the name of the bot you created in the second step.
-- `my-service-account@my-project-123456.iam.gserviceaccount.com` with the email
-  of the service account configured in the previous step. The default compute
-  service account is not supported.
-
-Use `tctl` to apply this file:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-## Step 4/5. Configure `tbot`
-
-**This step is completed on the GCP VM.**
-
-Create `/etc/tbot.yaml`:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: gcp
-  token: example-bot
-storage:
-  type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
-  Auth Service. Prefer using the address of a Teleport Proxy.
-- `example-bot` with the name of the token you created in the second step.
-
-(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
-
-## Step 5/5. Configure outputs
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## Next steps
-
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/github-actions.mdx b/docs/pages/enroll-resources/machine-id/deployment/github-actions.mdx
deleted file mode 100644
index 0da1e8563e35f..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/github-actions.mdx
+++ /dev/null
@@ -1,449 +0,0 @@
----
-title: Deploying Machine ID on GitHub Actions
-description: How to install and configure Machine ID on GitHub Actions
----
-
-GitHub Actions is a popular CI/CD platform that works as a part of the larger
-GitHub ecosystem. Teleport Machine ID allows GitHub Actions to securely interact
-with Teleport protected resources without the need for long-lived credentials.
-
-Teleport supports secure joining on both GitHub-hosted and self-hosted GitHub
-Actions runners as well as GitHub Enterprise Server.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- Your user should have the privileges to create token resources.
-- A GitHub repository with GitHub Actions enabled. This guide uses the example
-  `gravitational/example` repo, however this value should be replaced with
-  your own unique repo.
-
-## Step 1/3. Create a Bot
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 2/3. Create a join token for GitHub Actions
-
-In order to allow your GitHub Actions workflow to authenticate with your
-Teleport cluster, you'll first need to create a join token. These tokens set out
-criteria by which the Auth Service decides whether to allow a bot or node
-to join.
-
-In this example, you will create a join token that grants access to any
-GitHub Actions run within a specific GitHub repository. In production, you may
-wish to further restrict these rules to ensure that access can only occur
-when CI is running against a specific branch. You can find a full list of the
-available rules on the
-[GitHub Actions reference page.](../../../reference/machine-id/github-actions.mdx)
-
-Create a file named `bot-token.yaml`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  name: example-bot
-spec:
-  # The Bot role indicates that this token grants access to a bot user, rather
-  # than allowing a node to join. This role is built in to Teleport.
-  roles: [Bot]
-  join_method: github
-  # The bot_name indicates which bot user this token grants access to. This
-  # should match the name of the bot that you created in the previous step.
-  bot_name: example
-  github:
-    # allow specifies rules that control which GitHub Actions runs will be
-    # granted access. Those not matching any allow rule will be denied.
-    allow:
-    # repository should include the name of the owner of the repository.
-    - repository: gravitational/example
-```
-
-Replace `gravitational/example` with the name of the repository that `tbot`
-will run within. You may also choose to change the name of the bot and token
-to more accurately describe your use-case.
-
-<Admonition type="note" title="Using GitHub Enterprise?">
-**Enterprise Server**
-
-If you are using self-hosted Teleport Enterprise you are able to permit
-workflows within GitHub Enterprise Server instances to authenticate using the
-GitHub join method.
-
-The Teleport Auth Service must be able to connect to the GitHub Enterprise
-Server.
-
-To configure this, set `spec.github.enterprise_server_host` to the hostname of
-the GHES instance.
-
-For example:
-```yaml
-spec:
-  github:
-    enterprise_server_host: ghes.example.com
-```
-
-**Enterprise Cloud**
-
-If you have enabled `include_enterprise_slug` in your GitHub Enterprise
-Cloud configuration, you will need to set `spec.github.enterprise_slug` to
-the slug of your GitHub Enterprise organization.
-
-For example:
-```yaml
-spec:
-  github:
-    enterprise_slug: my-enterprise
-```
-
-Read more about `include_enterprise_slug` on the GitHub guide to
-[customizing the issuer value for an enterprise](https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise).
-</Admonition>
-
-Once the resource file has been written, create the token with `tctl`:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-Check that token `example-bot` has been created with the following
-command:
-
-```code
-$ tctl tokens ls
-Token       Type Labels Expiry Time (UTC)
------------ ---- ------ ----------------------------------------------
-example-bot Bot         01 Jan 00 00:00 UTC (2562047h47m16.854775807s)
-```
-
-## Step 3/3. Configure a GitHub Actions Workflow
-
-Now that the bot has been successfully created, you now need to configure your
-GitHub Action's workflow to authenticate as this bot and then use the
-credentials produced by `tbot`. To help with this, Teleport publishes
-several easy-to-use GitHub Actions that can be used within your workflow.
-
-It is also possible to manually configure `tbot` rather than using one of the
-Teleport GitHub Actions. This involves more configuration but allows for
-precise control of `tbot` and allows for implementations that are not possible
-with the actions.
-
-What follows is examples demonstrating two of the GitHub Actions available as
-well as showing how to manually configure `tbot` for use with GitHub Actions.
-
-### Example: `teleport-actions/auth`
-
-The `teleport-actions/auth` action generates a versatile identity output that
-can be used for SSH and for administrative actions against a Teleport cluster.
-Environment variables are configured by this action and these automatically
-configure `tsh` and `tctl` to use this identity.
-
-This example shows using the credentials to:
-
-- List the SSH nodes available using `tsh`
-- List the SSH nodes available using `tctl`
-- Connect to an SSH node using `tsh`
-- Connect to an SSH node using OpenSSH's `ssh`
-
-First, you'll need to adjust the role you assigned to the bot to grant it access
-to SSH. This example grants access to root on all nodes. In a production setup,
-it would be a good idea to restrict this to only the nodes that the bot would
-need.
-
-Use `tctl edit role/example-bot` to add the following to the role:
-
-```yaml
-spec:
-  allow:
-    # Allow login to the Linux user 'root'.
-    logins: ['root']
-    # Allow connection to any node. Adjust these labels to match only nodes
-    # that ansible needs to access.
-    node_labels:
-      '*': '*'
-```
-
-With that privileges granted, you can now create the GitHub Actions workflow.
-Create `.github/workflows/example.yaml`:
-
-```yaml
-# This is a basic workflow to help you get started.
-# It will take the following action whenever a push is made to the "main" branch.
-on:
-  push:
-    branches:
-    - main
-jobs:
-  demo:
-    permissions:
-      # The "id-token: write" permission is required or Machine ID will not be
-      # able to authenticate with the cluster.
-      id-token: write
-      contents: read
-    # The name of the workflow, and the Linux distro to be used to perform the
-    # required steps.
-    name: example
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Fetch Teleport binaries
-      uses: teleport-actions/setup@v1
-      with:
-        version: (=teleport.version=)
-    - name: Fetch credentials using Machine ID
-      id: auth
-      uses: teleport-actions/auth@v2
-      with:
-        # Use the address of the auth/proxy server for your own cluster.
-        proxy: example.teleport.sh:443
-        # Use the name of the join token resource you created in step 1.
-        token: example-bot
-        # Specify the length of time that the generated credentials should be
-        # valid for. This is optional and defaults to "1h"
-        certificate-ttl: 1h
-        # Enable the submission of anonymous usage telemetry. This
-        # helps us shape the future development of `tbot`. You can disable this
-        # by omitting this.
-        anonymous-telemetry: 1
-    - name: List nodes (tsh)
-      # Enters a command from the cluster, in this case "tsh ls" using Machine
-      # ID credentials to list remote SSH nodes.
-      run: tsh ls
-    - name: List nodes (tctl)
-      run: tctl nodes ls
-    - name: Run hostname via SSH (tsh)
-      # Ensure that `root` matches the username of a remote SSH username, and
-      # that hostname matches an SSH host name that is a part of the Teleport
-      # cluster configured for access.
-      run: tsh ssh root@example-node hostname
-    - name: Run hostname via SSH (OpenSSH)
-      run: ssh -F ${{ steps.auth.outputs.ssh-config }} root@example-node.example.teleport.sh hostname
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or cloud
-  tenant.
-- `example-bot` with the name of the token you created in a previous step.
-- `example-node` with the name of a Teleport SSH node that you wish to connect
-  to.
-- `root` with the name of a user on the node that you are connecting to and that
-  you have granted the bot access to.
-
-Add, commit, and push your changes to the `main` branch of the repository.
-
-Navigate to the **Actions** tab of your GitHub repository in your web browser.
-Select the **Workflow** that has now been created and triggered by the change,
-and select the `example` job. The GitHub Actions workflow may take some time
-to complete, and will resemble the following once successful.
-
-![GitHub Actions](../../../../img/machine-id/github-actions.png)
-
-Expand the **List nodes** step of the action, and the output will
-list all nodes in the cluster, from the perspective of the
-Machine ID bot using the command `tsh ls`.
-
-### Example: `teleport-actions/auth-k8s`
-
-The `teleport-actions/auth-k8s` action generates a Kubernetes output that
-contains the necessary credentials and config for a Kubernetes client to connect
-to a Kubernetes cluster enrolled in Teleport. The action emits the necessary
-environment variable to automatically configure these clients.
-
-In this example, the `teleport-actions/auth-k8s` action will be used to list
-all the pods contained within the cluster, but this could just as easily be
-modified to deploy to a Kubernetes cluster with `kubectl` or `helm`.
-
-First, you'll need to adjust the role you assigned to the bot to grant it access
-to the Kubernetes cluster. This example will grant the bot access to all
-clusters with the group `editor`. For more detailed instructions on setting
-up Kubernetes RBAC, see the Kubernetes access guide.
-
-Use `tctl edit role/example-bot` to add the following rule to the Teleport role:
-
-```yaml
-spec:
-  allow:
-    kubernetes_labels:
-      '*': '*'
-    kubernetes_resources:
-    - kind: pod
-      namespace: "*"
-      name: "*"
-    kubernetes_groups:
-    - editor
-```
-
-<Admonition type="note">
-This example assumes the role is version `v6`. If you are using a `v7`+ role
-you will need to include `verbs: ["get", "list"]` for the `kind: pod` section
-in `kubernetes_resources`. Otherwise the example `kubectl get pods -A` execution
-will be denied.
-</Admonition>
-
-With that privileges granted, you can now create the GitHub Actions workflow.
-Create `.github/workflows/example.yaml`:
-
-```yaml
-# This is a basic workflow to help you get started, modify it for your needs.
-on:
-  push:
-    branches:
-    - main
-jobs:
-  demo:
-    permissions:
-      # The "id-token: write" permission is required or Machine ID will not be
-      # able to authenticate with the cluster.
-      id-token: write
-      contents: read
-    name: example
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Fetch kubectl
-      uses: azure/setup-kubectl@v3
-    - name: Fetch Teleport binaries
-      uses: teleport-actions/setup@v1
-      with:
-        version: (=teleport.version=)
-    - name: Fetch credentials using Machine ID
-      uses: teleport-actions/auth-k8s@v2
-      with:
-        # Use the address of the auth/proxy server for your own cluster.
-        proxy: example.teleport.sh:443
-        # Use the name of the join token resource you created in step 1.
-        token: example-bot
-        # Use the name of your Kubernetes cluster
-        kubernetes-cluster: my-kubernetes-cluster
-        # Enable the submission of anonymous usage telemetry. This helps us
-        # shape the future development of `tbot`. You can disable this by
-        # omitting this.
-        anonymous-telemetry: 1
-    - name: List pods
-      run: kubectl get pods -A
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or cloud
-  tenant.
-- `example-bot` with the name of the token you created in a previous step.
-- `my-kubernetes-cluster` with the name of your Kubernetes cluster.
-
-The `auth-k8s` action sets the `KUBECONFIG` for future steps to the credentials
-it has fetched from Teleport. This means that most existing tooling for
-Kubernetes (e.g `kubectl` and `helm`) can use your cluster with no additional
-configuration.
-
-Add, commit, and push this new workflow file to the default branch of your
-repository.
-
-Navigate to the **Actions** tab of your GitHub repository in your web browser.
-Select the **Workflow** that has now been created and triggered by the change,
-and select the `example` job.
-
-Expand the **List pods** step of the action, where you can then confirm that the
-output shows a list of all the pods within your Kubernetes cluster.
-
-### Example: Manual configuration
-
-To configure `tbot` manually, a YAML file will be used. In this example we'll
-commit this to the repository, but this could be generated or created by the
-CI pipeline itself.
-
-Create `tbot.yaml` within your repository:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: github
-  token: example-bot
-oneshot: true
-storage:
-  type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
-  Auth Service. Prefer using the address of a Teleport Proxy.
-- `example-bot` with the name of the token you created in the first step.
-
-Now you can define a GitHub Actions workflow that will start `tbot` with this
-configuration.
-
-Create `.github/workflows/example-action.yaml`:
-
-```yaml
-# This is a basic workflow to help you get started.
-# It will take the following action whenever a push is made to the "main" branch.
-on:
-  push:
-    branches:
-    - main
-jobs:
-  demo:
-    permissions:
-      # The "id-token: write" permission is required or Machine ID will not be
-      # able to authenticate with the cluster.
-      id-token: write
-      contents: read
-    # The name of the workflow, and the Linux distro to be used to perform the
-    # required steps.
-    name: guide-demo
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Fetch Teleport binaries
-      uses: teleport-actions/setup@v1
-      with:
-        version: (=teleport.version=)
-    - name: Execute Machine ID
-      env:
-        # TELEPORT_ANONYMOUS_TELEMETRY enables the submission of anonymous
-        # usage telemetry. This helps us shape the future development of
-        # tbot. You can disable this by omitting this.
-        TELEPORT_ANONYMOUS_TELEMETRY: 1
-      run: tbot start -c ./tbot.yaml --oneshot
-```
-
-Add, commit, and push these two files to the repository. Check the GitHub
-Actions UI to ensure that the workflow has succeeded.
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## A note on security implications and risk
-
-Once `teleport-actions/auth` has been used in a workflow job, all successive
-steps in that job will have access to the credentials which grant access to your
-Teleport cluster as the bot. Where possible, run as few steps as necessary after
-this action has been used. It may be a good idea to break your workflow up into
-multiple jobs in order to segregate these credentials from other code running in
-your CI/CD pipeline.
-
-Most importantly, ensure that the role you assign to your GitHub Actions bot has
-access to only the resources in your Teleport cluster that your CI/CD needs to
-interact with.
-
-## Next steps
-
-- Check out the GitHub Actions for more usage information:
-  - [teleport-actions/setup](https://github.com/teleport-actions/setup)
-  - [teleport-actions/auth](https://github.com/teleport-actions/auth)
-  - [teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
-  - [teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
-- For more information about the `github` join method, read the [GitHub Actions
-  reference page](../../../reference/machine-id/github-actions.mdx)
-- Find out more about GitHub Actions itself, read
-  [their documentation](https://docs.github.com/en/actions).
-- [More information about `anonymous-telemetry`.](../../../reference/machine-id/telemetry.mdx)
-
diff --git a/docs/pages/enroll-resources/machine-id/deployment/gitlab.mdx b/docs/pages/enroll-resources/machine-id/deployment/gitlab.mdx
deleted file mode 100644
index 7974c35f1b637..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/gitlab.mdx
+++ /dev/null
@@ -1,178 +0,0 @@
----
-title: Deploying Machine ID on GitLab CI
-description: How to install and configure Machine ID on GitLab CI
----
-
-In this guide, you will use Teleport Machine ID to allow a GitLab pipeline to
-securely connect to a Teleport SSH node without the need for long-lived secrets.
-
-Machine ID for GitLab works with GitLab's cloud-hosted option and with
-self-hosted GitLab installations. **The minimum supported GitLab version is
-15.7**.
-
-This mitigates the risk of long-lived secrets such as passwords or SSH private
-keys being exfiltrated from your GitLab organization and provides many of
-the other benefits of Teleport such as auditing and finely-grained access
-control.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A GitLab project to connect to Teleport. This can either be on GitLab's
-cloud-hosted offering (gitlab.com) or on a self-hosted GitLab instance. **When
-using a self-hosted GitLab instance, your Teleport Auth Service must be able to
-connect to your GitLab instance and your GitLab instance must be configured with
-a valid TLS certificate.**
-
-## Step 1/4. Create a Bot
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 2/4. Create a join token
-
-To allow GitLab CI to authenticate to your Teleport cluster, you'll first need
-to create a join token. A GitLab join token contains allow rules that describe
-which pipelines can use that token in order to join the Teleport cluster. A rule
-can contain multiple fields, and any pipeline that matches all the fields
-within a single rule is granted access.
-
-In this example, you will create a token with a rule that grants access to any
-GitLab CI job within a specific GitLab project. Determine the fully qualified
-path of your GitLab project. This will include your username (or group) and the
-name of your project, e.g `my-user/my-project`.
-
-Create a file named `bot-token.yaml`. Ensure you substitute any values as
-suggested by the comments in this example:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  name: example-bot
-spec:
-  # The Bot role indicates that this token grants access to a bot user, rather
-  # than allowing a node to join. This role is built in to Teleport.
-  roles: [Bot]
-  join_method: gitlab
-  # The bot_name indicates which bot user this token grants access to. This
-  # should match the name of the bot that you created in step 1.
-  bot_name: example
-  gitlab:
-    # domain should be the domain of your GitLab instance. If you are using
-    # GitLab's cloud hosted offering, omit this field entirely.
-    domain: gitlab.example.com
-    # allow specifies rules that control which GitLab tokens will be accepted
-    # by Teleport. Tokens not matching any allow rule will be denied.
-    allow:
-        # project_path should be the fully qualified path of your GitLab
-        # project that you determined earlier. This will grant access to any
-        # GitLab CI run in that project.
-      - project_path: my-user/my-project
-```
-
-You can find a full list of the token configuration options for GitLab joining
-on the
-[GitLab CI reference page.](../../../reference/machine-id/gitlab.mdx)
-
-Apply this to your Teleport cluster using `tctl`:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-## Step 3/4. Configure a GitLab Pipeline
-
-With the bot and join token created, you can now configure a GitLab pipeline
-that sets up `tbot` to use these.
-
-To configure `tbot`, a YAML file will be used. In this example we'll store this
-within the repository itself, but this could be generated or created by the
-CI pipeline itself.
-
-Create `tbot.yaml` within your repository:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: gitlab
-  token: example-bot
-oneshot: true
-storage:
-  type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
-  Auth Service. Prefer using the address of a Teleport Proxy.
-- `example-bot` with the name of the token you created in the second step
-
-Now, the GitLab CI pipeline can be defined. Before the pipeline can use `tbot`,
-it must be available within the environment. For this example, we'll show
-downloading `tbot` as part of the CI step, but in a production implementation
-you may wish to build a docker image that contains this binary to avoid
-depending on the Teleport CDN.
-
-Create `.gitlab-ci.yml`  within your repository:
-
-```yaml
-stages:
-  - deploy
-
-deploy-job:
-  stage: deploy
-  # id_tokens configures ID Tokens that GitLab will automatically inject into
-  # the environment of your GitLab run.
-  #
-  # See https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html
-  # for further explanation of the id_tokens configuration in GitLab.
-  id_tokens:
-    TBOT_GITLAB_JWT:
-      # aud for TBOT_GITLAB_JWT must be configured with the name of your
-      # Teleport cluster. This is not necessarily the address of your Teleport
-      # cluster and will not include a port or scheme (http/https)
-      #
-      # This helps the Teleport Auth Service know that the token is intended for
-      # it, and not a different service or Teleport cluster.
-      aud: teleport.example.com
-  script:
-    - cd /tmp
-    - 'curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz'
-    - tar -xvf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-    - sudo ./teleport/install
-    - 'TELEPORT_ANONYMOUS_TELEMETRY=1 tbot start -c tbot.yaml'
-```
-
-Replace `teleport.example.com` with the name of your Teleport cluster. This
-is not necessarily the address of your Teleport cluster and will not include
-a port or scheme (e.g. http/https).
-
-`TELEPORT_ANONYMOUS_TELEMETRY` enables the submission of anonymous usage
-telemetry. This helps us shape the future development of `tbot`. You can disable
-this by omitting this.
-
-Commit and push these two files to the repository.
-
-Check your GitLab CI status, and examine the log results from the commit for
-failure.
-
-## Step 4/4. Configure outputs
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## Further steps
-
-- For more information about GitLab joining, read the
-  [GitLab CI reference page.](../../../reference/machine-id/gitlab.mdx)
-- For more information about GitLab itself, read
-  [their documentation](https://docs.gitlab.com/ee/ci/).
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/jenkins.mdx b/docs/pages/enroll-resources/machine-id/deployment/jenkins.mdx
deleted file mode 100644
index 02a19406addbb..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/jenkins.mdx
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Deploying Machine ID on Jenkins
-description: How to install and configure Machine ID on Jenkins
----
-
-Jenkins is an open source automation server that is frequently used to build
-Continuous Integration and Continuous Delivery (CI/CD) pipelines.
-
-In this guide, we will demonstrate how to migrate existing Jenkins pipelines to
-utilize Machine ID with minimal changes.
-
-## Prerequisites
-
-You will need the following tools to use Teleport with Jenkins.
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- `ssh` OpenSSH tool
-- Jenkins
-- (!docs/pages/includes/tctl.mdx!)
-
-## Architecture
-
-Before we begin, it should be noted that Jenkins is a tool that is notoriously
-difficult to secure. Machine ID is one part of securing your infrastructure,
-but it alone is not sufficient. Below we will provide some basic guidance which
-can help improve the security posture of your Jenkins installation.
-
-### Single-host deployments
-
-The simplest Jenkins deployments have the
-controller (process that stores configuration, plugins, UI) and agents (process
-that executes tasks) run on the same host. This deployment model is simple to
-get started with, however any compromise of the `jenkins` user within a single
-pipeline can lead to the compromise of your entire CI/CD infrastructure.
-
-### Multihost deployments
-
-A slightly more complex, but more secure deployment
-is running your Jenkins controllers and agents on different hosts and pinning
-workloads to specific agents. This is an improvement over the simple deployment
-because you can limit the blast radius of the compromise of a single pipeline
-to a subset of your CI/CD infrastructure instead of all of your infrastructure.
-
-### Best practices
-
-We strongly encourage the use of the second deployment model whenever possible,
-with ephemeral hosts and IAM joining when possible. When using Machine ID with
-this model, create and run Machine ID bots per-host and pin particular
-pipelines to a worker. This will allow you to give each pipeline the minimal
-scope for server access, reduce the blast radius if one pipeline is
-compromised, and allow you to remotely audit and lock pipelines if you detect
-malicious behavior.
-
-  ![Jenkins Deployments](../../../../img/machine-id/jenkins.png)
-
-## Step 1/2 Configure and start Machine ID
-
-First, determine if you would like to create a new role for Machine ID or use
-an existing role. You can run `tctl get roles` to examine your existing roles.
-
-In the example below, create a file called `api-workers.yaml` with the content below
-to create a new role called `api-workers` that will allow you to log in to Nodes
-with the label `group: api` and Linux user `jenkins`.
-
-```
-kind: "role"
-version: "v3"
-metadata:
-  name: "api-workers"
-spec:
-  allow:
-    logins: ["jenkins"]
-    node_labels:
-      "group": "api"
-```
-
-<Tabs>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-On your client machine, log in to Teleport using `tsh` before using `tctl`.
-
-```code
-$ tctl create -f api-workers.yaml
-$ tctl bots add jenkins --roles=api-workers
-```
-</TabItem>
-<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
-Connect to the Teleport Auth Service and use `tctl` to examine what roles exist on
-your system.
-
-```code
-$ tctl create -f api-workers.yaml
-$ tctl bots add jenkins --roles=api-workers
-```
-</TabItem>
-
-</Tabs>
-
-Machine ID allows you to use Linux Access Control Lists (ACLs) to control
-access to certificates on disk. You will use this to limit the access Jenkins
-has to the short-lived certificates Machine ID issues.
-
-In the example that follows, you will create a Linux user called `teleport` to
-run Machine ID but short-lived certificates will be written to disk as the
-Linux user `jenkins`.
-
-```code
-$ sudo adduser \
-    --disabled-password \
-    --no-create-home \
-    --shell=/bin/false \
-    --gecos "" \
-    teleport
-```
-
-Create and initialize the directories you will need using the `tbot init`
-command.
-
-```code
-$ sudo tbot init \
-    --destination-dir=/opt/machine-id \
-    --bot-user=teleport \
-    --owner=teleport:teleport \
-    --reader-user=jenkins
-```
-
-(!docs/pages/includes/machine-id/machine-id-init-bot-data.mdx!)
-
-Next, you need to start Machine ID in the background of each Jenkins worker.
-
-First create a configuration file for Machine ID at `/etc/tbot.yaml`.
-
-```yaml
-version: v2
-# Replace "example.teleport.sh:443" with the address of your Teleport Proxy or
-# Teleport Cloud tenant.
-proxy_server: "example.teleport.sh:443"
-onboarding:
-  join_method: "token"
-  # Replace the token field with the name of the token that was output when you
-  # ran `tctl bots add`.
-  token: "00000000000000000000000000000000"
-storage:
-  type: directory
-  path: /var/lib/teleport/bot
-outputs:
-  - type: identity
-    destination:
-      type: directory
-      path: /opt/machine-id
-```
-
-### Create a `tbot` systemd unit file
-
-(!docs/pages/includes/machine-id/daemon.mdx!)
-
-## Step 2/2. Update and run Jenkins pipelines
-
-Using Machine ID within a Jenkins pipeline is now a one-line change. For
-example, if you want to run the `hostname` command on a remote host, add the
-following to your Jenkins pipeline.
-
-```
-steps {
-  sh "ssh -F /opt/machine-id/ssh_config root@node-name.example.com hostname"
-}
-```
-
-You are all set. You have provided Jenkins with short-lived certificates tied
-to a machine identity that can be rotated, audited, and controlled with access controls.
-
-## Next steps
-
-[More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
-
diff --git a/docs/pages/enroll-resources/machine-id/deployment/kubernetes.mdx b/docs/pages/enroll-resources/machine-id/deployment/kubernetes.mdx
deleted file mode 100644
index 1d737a3cb0a7b..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/kubernetes.mdx
+++ /dev/null
@@ -1,367 +0,0 @@
----
-title: Deploying Machine ID on Kubernetes
-description: How to install and configure Machine ID on Kubernetes
----
-
-This guide shows you how to deploy the Machine ID daemon `tbot`, on a Kubernetes
-cluster.
-
-## How it works
-
-In the setup we demonstrate in this guide, `tbot` runs as a Kubernetes
-deployment. It writes output credentials to a Kubernetes secret, which can then
-be mounted in the pods that need to use the credentials. While `tbot` can also
-run as a sidecar within the same pod as the service that needs to use the
-credentials it generates, we recommend running `tbot` as a standalone deployment
-due the limited support Kubernetes has for sidecars.
-
-In this guide, we demonstrate the `kubernetes` join method, in which `tbot`
-proves its identity to the Teleport Auth Service by presenting a JSON web token
-(JWT) signed by the Kubernetes API server. This JWT contains identifies the
-service account, the pod and the namespace in which `tbot` is running. The
-Teleport Auth Service checks the signature of the JWT against the Kubernetes
-cluster's public signing key.
-
-<details>
-<summary>Using another join method</summary>
-
-When deploying `tbot` to a Teleport cluster, it is generally recommended to use
-the `kubernetes` join method. This will work with most Kubernetes clusters.
-The guide that follows will demonstrate configuring this join method.
-
-However, when using certain cloud Kubernetes services, it is possible to use the
-join method associated with that platform rather than the `kubernetes` join
-method. This may be beneficial if you wish to manage the joining of `tbot`
-within the Kubernetes clusters and on standard VMs on the same platform with
-a single join token. These services are:
-
-- Google Kubernetes Engine: Where
-  [GCP Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
-  is configured for the cluster, it is possible to use the `gcp` join method.
-  See the [GCP Platform Guide](./gcp.mdx) for further information.
-- Amazon Elastic Kubernetes Service: Where
-  [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
-  is configured for the cluster, it is possible to use the `iam` join method.
-  See the [AWS Platform Guide](./aws.mdx) for further information.
-
-</details>
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A Kubernetes cluster with support for Token Request Projection (which
-  graduated to a generally available feature in Kubernetes 1.20).
-- `kubectl` authenticated with the ability to create resources in the cluster
-  you wish to deploy `tbot` into.
-
-The examples in this guide will install a `tbot` deployment in the `default`
-Namespace of the Kubernetes cluster. Adjust references to `default` to the
-Namespace you wish to use.
-
-## Step 1/5. Prepare Kubernetes RBAC
-
-In order to prepare the Kubernetes cluster for Machine ID, several Kubernetes
-RBAC resources must be created.
-
-A ServiceAccount will be created and later assigned to the Pod that will run
-`tbot`. This creates a static identity that we can allow access to join the
-Teleport Cluster and also provides an identity to which we can assign Kubernetes
-privileges.
-
-A Role granting the ability to read and write to secrets in the Namespace will
-be created and then assigned to the ServiceAccount using a RoleBinding. This
-will allow the `tbot` Pod to read and write credentials to a Secret.
-
-Create a file called `k8s-rbac.yaml`:
-
-```yaml
-# This ServiceAccount will be used to give the `tbot` pods a discrete identity
-# which can be validated by the Teleport Auth Service.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tbot
-  namespace: default
----
-# This role grants the ability to manage secrets within the namespace - this is
-# necessary for the `kubernetes_secret` destination to work correctly.
-#
-# You may wish to add the `resourceNames` field to the role to further restrict
-# this access in sensitive environments.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: secrets-admin
-  namespace: default
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["*"]
----
-# Bind the role to the service account created for tbot.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tbot-secrets-admin
-  namespace: default
-subjects:
-  - kind: ServiceAccount
-    name: tbot
-roleRef:
-  kind: Role
-  name:  secrets-admin
-  apiGroup: rbac.authorization.k8s.io
-```
-
-Apply this file to your Kubernetes cluster:
-
-```code
-$ kubectl apply -f ./k8s-rbac.yaml
-```
-
-## Step 2/5. Create a Bot
-
-(!docs/pages/includes/machine-id/create-a-bot.mdx!)
-
-## Step 3/5. Create a join token
-
-Next, a join token needs to be configured. This will be used by `tbot` to join
-the cluster. As the `kubernetes` join method will be used, the public key of the
-Kubernetes cluster must first be determined. The public key used to sign JWTs
-is exposed on the "JWKS" endpoint of the Kubernetes API server. This public key
-can then be used by the Teleport Auth  to verify that the Service Account JWT
-presented by `tbot` is signed legitimately by the Kubernetes cluster.
-
-Run the following commands to determine the JWKS formatted public key:
-
-```code
-$ kubectl proxy -p 8080
-$ curl http://localhost:8080/openid/v1/jwks
-{"keys":[--snip--]}%
-```
-
-Create `bot-token.yaml`, ensuring you insert the value from the JWKS endpoint
-in `spec.kubernetes.static_jwks.jwks`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  # name will be specified in the `tbot` to use this token
-  name: example-bot
-spec:
-  roles: [Bot]
-  # bot_name should match the name of the bot created earlier in this guide.
-  bot_name: example
-  join_method: kubernetes
-  kubernetes:
-    # static_jwks configures the Auth Service to validate the JWT presented by
-    # `tbot` using the public key from a statically configured JWKS.
-    type: static_jwks
-    static_jwks:
-      jwks: |
-        # Place the data returned by the curl command here
-        {"keys":[--snip--]}
-    # allow specifies the rules by which the Auth Service determines if `tbot`
-    # should be allowed to join.
-    allow:
-    - service_account: "default:tbot" # service_account
-```
-
-Use `tctl` to apply this file:
-
-```code
-$ tctl create -f bot-token.yaml
-```
-
-## Step 4/5. Create a `tbot` deployment
-
-First, a ConfigMap will be created to contain the configuration file for `tbot`.
-This will then be mounted into the Pod.
-
-Create `k8s-deployment-config.yaml`, replacing the value of `token` with the
-name of the token you created earlier and the value of `proxy_server` with the
-address of your Teleport Proxy Service:
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tbot-config
-  namespace: default
-data:
-  tbot.yaml: |
-    version: v2
-    onboarding:
-      join_method: kubernetes
-      # ensure token is set to the name of the join token you created earlier
-      token: bot-kubernetes
-    storage:
-      # a memory destination is used for the bots own state since the kubernetes
-      # join method does not require persistence.
-      type: memory
-    # ensure this is configured to the address of your Teleport Proxy Service.
-    proxy_server: example.teleport.sh:443
-    # outputs will be filled in during the completion of an access guide.
-    outputs: []
-```
-
-Apply this file to your Kubernetes cluster:
-
-```code
-$ kubectl apply -f k8s-deployment-config.yaml
-```
-
-With the ConfigMap created, you can now create the `tbot` deployment itself.
-
-Create `k8s-deployment.yaml`:
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tbot
-  namespace: default
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: tbot
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: tbot
-    spec:
-      containers:
-        - name: tbot
-          image: public.ecr.aws/gravitational/tbot-distroless:(=teleport.version=)
-          args:
-            - start
-            - -c
-            - /config/tbot.yaml
-          env:
-            # POD_NAMESPACE is required for the kubernetes_secret` destination
-            # type to work correctly.
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            # KUBERNETES_TOKEN_PATH specifies the path to the service account
-            # JWT to use for joining.
-            # This path is based on the configuration of the volume and
-            # volumeMount.
-            - name: KUBERNETES_TOKEN_PATH
-              value: /var/run/secrets/tokens/join-sa-token
-            # TELEPORT_ANONYMOUS_TELEMETRY enables the submission of anonymous
-            # usage telemetry.  This helps us shape the future development of
-            # `tbot`. You can disable this by omitting this.
-            - name: TELEPORT_ANONYMOUS_TELEMETRY
-              value: "1"
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /var/run/secrets/tokens
-              name: join-sa-token
-      serviceAccountName: tbot
-      volumes:
-        - name: config
-          configMap:
-            name: tbot-config
-        - name: join-sa-token
-          projected:
-            sources:
-              - serviceAccountToken:
-                  path: join-sa-token
-                  # 600 seconds is the minimum that Kubernetes supports. We
-                  # recommend this value is used.
-                  expirationSeconds: 600
-                  # `example.teleport.sh` must be replaced with the name of
-                  # your Teleport cluster.
-                  audience: example.teleport.sh
-```
-
-Replace `example.teleport.sh` with the name of your Teleport cluster - this is
-not necessarily the public address (the port should not be included).
-
-This is an example manifest, consider modifying it to fit within the conventions
-of deployments to your clusters (e.g customizing labels).
-
-<Admonition type="warning" title="FIPS Compliance">
-The default `tbot-distroless` image does not contain the FIPS-compliant
-binaries. If you operate in an environment where FIPS compliance is required,
-please use the `tbot-fips-distroless` image instead.
-</Admonition>
-
-Apply this file to your Kubernetes cluster:
-
-```code
-$ kubectl apply -f ./k8s-deployment.yaml
-```
-
-Use `kubectl` to verify that the deployment is healthy:
-
-```code
-$ kubectl describe deployment/tbot
-$ kubectl logs deployment/tbot
-```
-
-With this complete, `tbot` is now successfully deployed to your cluster.
-However, it is not yet producing any useful output.
-
-## Step 5/5. Configure outputs
-
-Follow one of the [access guides](../access-guides/access-guides.mdx) to configure an output
-that meets your access needs.
-
-In order to adjust the access guides to work well with Kubernetes, use the
-Kubernetes Secret destination type. This will write the generated artifacts
-to a specified Kubernetes Secret, for example:
-
-```yaml
-outputs:
-  - type: identity
-    destination:
-      type: kubernetes_secret
-      name: identity-output
-```
-
-The output can then be consumed by mounting this secret within another pod:
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: tsh
-  namespace: default
-spec:
-  containers:
-    - name: tsh
-      image: public.ecr.aws/gravitational/teleport-distroless:(=teleport.version=)
-      command:
-        - tsh
-      args:
-       - -i
-       - /identity-output/identity
-       - --proxy
-       - example.teleport.sh:443
-       - ls
-      volumeMounts:
-        - name: identity-output
-          mountPath: /identity-output
-  volumes:
-    - name: identity-output
-      secret:
-        secretName: identity-output
-```
-
-## Next steps
-
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/linux.mdx b/docs/pages/enroll-resources/machine-id/deployment/linux.mdx
deleted file mode 100644
index b96c847510473..0000000000000
--- a/docs/pages/enroll-resources/machine-id/deployment/linux.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-title: Deploying Machine ID on Linux
-description: How to install and configure Machine ID on a Linux host
----
-
-This page explains how to deploy Machine ID on a Linux host.
-
-## How it works
-
-The process in which `tbot` initially authenticates with the Teleport cluster is
-known as joining. A join method is a specific technique for the bot to prove its
-identity.
-
-On platforms where there is no form of identity available to the machine, the
-only available join method is `token`. The `token` join method is special as
-it is the only join method that relies on a shared secret. In order to mitigate
-the risks associated with this, the `token` join method is single use and it
-is not possible to use the same token multiple times.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- A Linux host that you wish to install Machine ID onto.
-- A Linux user on that host that you wish Machine ID to run as. In the guide,
-  we will use `teleport` for this.
-
-## Step 1/4. Install `tbot`
-
-**This step is completed on the Linux host.**
-
-First, `tbot` needs to be installed on the VM that you wish to use Machine ID
-on.
-
-Download the appropriate Teleport package for your platform:
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 2/4. Create a bot user
-
-**This step is completed on your local machine.**
-
-Create the bot:
-
-```code
-$ tctl bots add example
-```
-
-A join token will be included in the results of `tctl bots add`, record this
-value as it will be needed when configuring `tbot`.
-
-## Step 3/4. Configure `tbot`
-
-**This step is completed on the Linux host.**
-
-Create `/etc/tbot.yaml`:
-
-```yaml
-version: v2
-proxy_server: example.teleport.sh:443
-onboarding:
-  join_method: token
-  token: (=presets.tokens.first=)
-storage:
-  type: directory
-  path: /var/lib/teleport/bot
-# outputs will be filled in during the completion of an access guide.
-outputs: []
-```
-
-Replace:
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
-  Auth Service. Prefer using the address of a Teleport Proxy.
-- `(=presets.tokens.first=)` with the token that was returned by `tctl bots add`
-  in the previous step.
-
-<Admonition type="note">
-The first time that `tbot` runs, this token will be exchanged for a certificate
-that the bot uses for authentication. At this point, the token is invalidated.
-This means you may remove the token from the configuration file after the first
-run has completed, but there is no tangible security benefit to doing so.
-</Admonition>
-
-### Prepare the storage directory
-
-When using the `token` join method, `tbot` must be able to persist its state
-across restarts. The destination used to persist this state is known as the
-bot's "storage destination". In this guide, the directory
-`/var/lib/teleport/bot` will be used.
-
-As this directory will store the bots sensitive credentials, it is important
-to protect it. To do this, you will configure the directory to only be
-accessible to the Linux user which `tbot` will run as.
-
-Execute the following, replacing `teleport` with the Linux user that you will
-run `tbot` as:
-
-```code
-# Make the bot directory and assign ownership to teleport user
-$ sudo mkdir -p /var/lib/teleport/bot
-$ sudo chown teleport:teleport /var/lib/teleport/bot
-```
-
-### Create a systemd service
-
-(!docs/pages/includes/machine-id/daemon.mdx!)
-
-## Step 4/4. Configure outputs
-
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
-
-## Next steps
-
-- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
-  your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/faq.mdx b/docs/pages/enroll-resources/machine-id/faq.mdx
deleted file mode 100644
index 474b19d0ff7eb..0000000000000
--- a/docs/pages/enroll-resources/machine-id/faq.mdx
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: Machine ID FAQ
-description: Frequently asked questions about Teleport Machine ID
----
-
-This page provides answers to frequently asked questions about Machine ID. For a
-list of frequently asked questions about Teleport in general, see [Frequently
-Asked Questions](../../faq.mdx).
-
-## Can Machine ID be used within CI/CD jobs?
-
-On CI/CD platforms where your workflow runs in an ephemeral environment (e.g
-no persistent state exists between individual workflow runs), Machine ID works
-best where a supported join method exists. These are:
-
-- GitHub Actions
-- CircleCI
-- GitLab
-- AWS
-- GCP
-- Azure
-- Kubernetes
-- Spacelift
-- Terraform Cloud
-
-On CI/CD platforms where you control the runner environment (e.g self-hosted
-Jenkins runner), Machine ID can run as a daemon on the runner and the generated
-credentials can be mounted into the environment of your individual workflow
-runs.
-
-## Can Machine ID be used with Trusted Clusters ?
-
-You can use Machine ID for SSH access in trusted leaf clusters.
-
-We currently do not support access to applications, databases, or Kubernetes
-clusters in leaf clusters.
-
-## Should I define allowed logins as user traits or within roles?
-
-When defining the logins that your bot will be allowed to use, there are two
-options:
-
-- Directly adding the login to the `logins` section of the role that your bot
-  will impersonate.
-- Adding the login to the logins trait of the bot user, and impersonating a role
-  that includes the `{{ internal.logins }}` role variable. This is usually done
-  by providing the `--logins` parameter when creating the bot.
-
-For simpler scenarios — where you only expect the bot to use a single output
-or role — you can add the login to the logins trait of the bot user. This
-approach allows you to leverage default roles like `access`.
-
-For situations where your bot is producing certificates for different roles in
-different outputs, it is important to consider whether using a login trait
-grants access to resources that you didn't intend. To prevent a login trait from
-granting access you didn't intend, we recommend that you create bespoke roles
-that explicitly specify the logins that should be included in the certificates.
-
-## Can Machine ID be used with per-session MFA?
-
-We do not currently support Machine ID and per-session MFA. Enabling per-session
-MFA globally, or for roles impersonated by Machine ID, will prevent credentials
-produced by Machine ID from being used to connect to resources.
-
-As a work-around, ensure that per-session MFA is enforced on individual roles
-rather than enforced globally, and that it is not enforced for roles that you
-will impersonate using Machine ID.
-
-## Can Machine ID be used with Device Trust?
-
-We do not currently support Machine ID and Device Trust. Requiring Device
-Trust cluster-wide or for roles impersonated by Machine ID will prevent
-credentials produced by Machine ID from being used to connect to resources.
-
-As a work-around, configure Device Trust enforcement on a role-by-role basis
-and ensure that it is not required for roles that you will impersonate using
-Machine ID.
-
-## Can Machine ID be used to generate long-lived certificates?
-
-Machine ID cannot currently be used to generate certificates valid for longer
-than 24 hours, and requests for longer certificates using the `credential_ttl`
-parameter will be reduced to this 24 hour limit.
-
-This limit serves multiple purposes. For one, it encourages security best
-practices by only ever issuing very short lived certificates. Additionally, as
-Machine ID allows for certificate renewal, this limit helps to prevent further
-exploitation should a Machine ID identity be compromised: an attacker could use
-a stolen renewable certificate to request very long lived certificates and
-maintain access for a much longer period.
-
-If your use case absolutely requires long-lived certificates,
-[`tctl auth sign`](../../reference/cli/tctl.mdx#tctl-auth-sign) can
-alternatively be used, however this loses the security benefits of Machine ID's
-short-lived renewable certificates.
-
-## Can Machine ID be used to connect to multiple Kubernetes clusters?
-
-This is possible in Teleport v17.2.7 or higher, using the new `kubernetes/v2`
-output type in `tbot`. This service can expose many clusters at once via
-contexts in the generated `kubeconfig.yaml`, and if label selectors are used,
-will dynamically add contexts as clusters are added and removed in Teleport.
-
-Note that both `tbot` and the Teleport Proxy need to be running v17.2.7 to take
-advantage of this functionality.
-
-Refer to the
-[CLI reference](../../reference/cli/tbot.mdx#tbot-start-kubernetesv2) and
-[config reference](../../reference/machine-id/configuration.mdx#kubernetesv2)
-for more information.
-
-## Does `tbot` support Windows?
-
-Yes, the `tbot` binary is available for Windows. It can be found in the client
-tools archive that also includes `tsh` and `tctl`. See the
-[Installing Teleport guide](../../installation.mdx) for further information.
-
-However, there are a few limitations to be aware of:
-
-- Functionality that relies on Unix Domain Sockets (e.g. SSH multiplexer,
-  SPIFFE Workload API etc.) is not available.
-- Functionality relating to the configuration of Symlink protection on directory
-  destinations is not available.
-- Functionality relating to the management of ACLs on directory destinations is
-  not available.
-- Most delegated join methods are unlikely to function correctly.
-
-In some circumstances, it can be more practical to run `tbot` within Windows
-Subsystem for Linux rather than running it natively on Windows. This will depend
-on where the tools that will consume the output of `tbot` are running.
\ No newline at end of file
diff --git a/docs/pages/enroll-resources/machine-id/getting-started.mdx b/docs/pages/enroll-resources/machine-id/getting-started.mdx
deleted file mode 100644
index 7cfd4b9a5cd6e..0000000000000
--- a/docs/pages/enroll-resources/machine-id/getting-started.mdx
+++ /dev/null
@@ -1,226 +0,0 @@
----
-title: Machine ID Getting Started Guide
-description: Getting started with Teleport Machine ID
----
-
-In this getting started guide, you will configure Machine ID to issue
-certificates that enable a bot user to connect to a remote host.
-
-Here's an overview of what you will do:
-
-- Download and install `tbot` on the host that will run Machine ID.
-- Create a bot user.
-- Start Machine ID.
-- Use certificates issued by Machine ID to connect to a remote machine with SSH.
-
-This guide covers configuring Machine ID for development and learning purposes.
-For a production-ready configuration of Machine ID, visit the [Deploying Machine
-ID](deployment/deployment.mdx) guides.
-
-## Prerequisites
-
-- A host that you wish to assign an identity to using Machine ID.
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-(!/docs/pages/includes/tctl.mdx!)
-
-## Step 1/4. Download and install Teleport
-
-In this step, you will be downloading and installing Teleport binaries onto the
-machine you wish to assign an identity to.
-
-Each Teleport package hosted on our downloads page ships with several useful
-binaries, including `teleport`, `tctl`, `tsh`,`tbot`, and `fdpass-teleport`:
-
-- `teleport` is the daemon used to initialize a Teleport cluster; this binary is not used in this guide
-- `tctl` is the administrative tool you will use to create the bot user (step 1/4)
-- `tsh` is the client tool you will use to log in to the Teleport Cluster (steps 2/4 and 4/4)
-- `tbot` is the Machine ID tool you will use to associate a bot user with a machine (step 3/4)
-- `fdpass-teleport` is used to integrate Machine ID with OpenSSH to enable higher performance and reduced resource consumption when establishing SSH connections; this binary is not used in this guide
-
-Download the appropriate Teleport package for your platform: 
-
-(!docs/pages/includes/install-linux.mdx!)
-
-## Step 2/4. Create a Bot
-
-In Teleport, a **Bot** represents an identity for a machine. This is similar to
-how a user represents the identity of a human. Like users, bots are assigned
-roles to manage their access to resources. However, unlike users, bots do not
-authenticate using a username and password or SSO. Instead, they initially
-authenticate in a process called joining.
-
-Teleport supports a number of secure join methods specific to the platform the
-bot is running on, but for the purposes of this guide, we will use the simpler
-`token` join method. You can follow a deployment guide later to learn about the
-secure join methods available for your platform.
-
-Before you create a bot user, you need to determine which role(s) you want to
-assign to it. You can use the `tctl` command below to examine what roles exist
-on your system.
-
-On your client machine, log in to Teleport using `tsh`, then use `tctl` to examine
-what roles exist on your system.
-
-```code
-$ tctl get roles --format=text
-```
-
-You will see something like the output below on a fresh install of Teleport with the
-default roles—your cluster may have different roles. In this example, let's
-assume you want to give the bot the `access` role to allow it to connect to
-machines within your cluster.
-
-```
-Role    Allowed to login as                           Node Labels Access to resources
-------- --------------------------------------------- ----------- ----------------------------------------
-access  {{internal.logins}}                           <all nodes> event:list,read,session:read,list
-auditor no-login-6566121f-b602-47f1-a118-c9c618ee5aec             session:list,read,event:list,read
-editor                                                            user:list,create,read,update,delete,...
-```
-
-The `internal.logins` trait is replaced with values from the Teleport local user
-database. For full details on how traits work in Teleport roles, see the
-[Access Controls
-Reference](../../reference/access-controls/roles.mdx).
-
-Assuming that you are using the default `access` role, ensure that you use the 
-`--logins` flag when adding your bot to specify the SSH logins that you wish to 
-allow the bot to access on hosts. For our example, we will be using `root`.
-
-Use `tctl bots add` to create our bot:
-
-```code
-$ tctl bots add robot --roles=access --logins=root
-```
-
-## Step 3/4. Start Machine ID
-
-Now start Machine ID using the `tbot` binary. The `tbot start` command will
-start running Machine ID in a loop, writing renewable certificates to
-`/var/lib/teleport/bot` and the short-lived certificates your application will
-use to `/opt/machine-id`.
-
-In a production environment you will want to run Machine ID in the background
-using a service manager like systemd. However, in this guide you will run it in
-the foreground to better understand how it works.
-
-```code
-$ export TELEPORT_ANONYMOUS_TELEMETRY=1
-$ sudo tbot start \
- --data-dir=/var/lib/teleport/bot \
- --destination-dir=/opt/machine-id \
- --token=(=presets.tokens.first=) \
- --join-method=token \
- --proxy-server=example.teleport.sh:443
-```
-
-`TELEPORT_ANONYMOUS_TELEMETRY` enables the submission of anonymous usage
-telemetry. This helps us shape the future development of `tbot`. You can disable
-this by omitting this.
-
-Replace the following fields with values from your own cluster.
-
-- `token` is the token output by the `tctl bots add` command or the name of your IAM method token.
-- `destination-dir` is where Machine ID writes user certificates that can be used by applications and tools.
-- `data-dir` is where Machine ID writes its private data, including its own short-lived renewable certificates. These should not be used by applications and tools.
-- `proxy-server` is the address of your Teleport Proxy service, for example `example.teleport.sh:443`.
-
-Now that Machine ID has successfully started, let's investigate the
-`/opt/machine-id` directory to see what was written to disk.
-
-```code
-$ tree /opt/machine-id
-machine-id
-├── identity
-├── key
-├── key-cert.pub
-├── key.pub
-├── known_hosts
-├── ssh_config
-├── teleport-database-ca.crt
-├── teleport-host-ca.crt
-├── teleport-user-ca.crt
-└── tlscert
-
-0 directories, 10 files
-```
-
-This directory contains private key material in the `key.*` files, SSH
-certificates in the `identity` file, X.509 certificates in the `tls*` and
-`*.crt` files, OpenSSH configuration in the `ssh_config` and
-`known_hosts` files to make it easy to integrate Machine ID with external
- applications and tools.
-
-## Step 4/4. Use certificates issued by Machine ID
-
-To use Machine ID, find a host that you want to connect to within your cluster
-using `tsh ls`. You might see output like the following on your system.
-
-```code
-$ tsh ls
-Node Name Address        Labels
---------- -------------- -----------------------------
-node-name  127.0.0.1:3022 arch=x86_64,group=api-servers
-```
-
-<details>
-<summary>Not seeing Nodes?</summary>
-
-(!docs/pages/includes/node-logins.mdx!)
-
-</details>
-
-To use Machine ID with the OpenSSH integration, run the following command to
-connect to `node-name` within cluster `example.com`.
-
-```code
-$ ssh -F /opt/machine-id/ssh_config root@node-name.example.com
-```
-
-In addition to the `ssh` client you can use `tsh`. Replace the `--proxy` parameter
-with your proxy address. 
-
-```code
-$ tsh ssh --proxy=mytenant.teleport.sh -i /opt/machine-id/identity root@node-name
-```
-
-<Admonition type="note" title="Roles must have logins defined">
-  The below error can occur when the bot does not have permission to log in to
-  a node as the requested user:
-
-  ```code
-  $ ssh -F /opt/machine-id/ssh_config root@node-name.example.com
-  root@node-name: Permission denied (publickey).
-  kex_exchange_identification: Connection closed by remote host
-  ```
-  This can happen in two circumstances:
-  - The user you are trying to log in as is not specified under `logins` in the
-   role you are using
-  - If you have used `--logins` when creating the bot user, the role the bot is 
-  impersonating does not have the `{{ internal.logins }}` variable specified.
-
-  If you have been following along with the `access` role, do the following.
-
-  - Export the role by running `tctl get roles/access > access.yaml`
-  - Edit the `logins` field in `access.yaml`
-  - Update the role by running `tctl create -f access.yaml`
-</Admonition>
-
-Now you can replace any invocations of `ssh` with the above command to provide
-your applications and tools a machine identity that can be rotated, audited,
-and controlled with access controls.
-
-## Next Steps
-
-- Read the [architecture overview](../../reference/architecture/machine-id-architecture.mdx) to learn about how
-  Machine ID works in more detail.
-- Check out the [deployment guides](deployment/deployment.mdx) to learn about
-  configuring `tbot` in a production-ready way for your platform.
-- Check out the [access guides](access-guides/access-guides.mdx) to learn about configuring
-  `tbot` for different use cases than SSH.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
-  all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-id/telemetry.mdx)
-
diff --git a/docs/pages/enroll-resources/machine-id/introduction.mdx b/docs/pages/enroll-resources/machine-id/introduction.mdx
deleted file mode 100644
index e5e39aff21dfe..0000000000000
--- a/docs/pages/enroll-resources/machine-id/introduction.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-title: Introduction to Machine ID
-description: Teleport Machine ID introduction, demo and resources.
-videoBanner: QWd0eqIa9mA
-tocDepth: 3
----
-
-Teleport Machine ID enables machines, such as CI/CD workflows, to securely
-authenticate with your Teleport cluster in order to connect to resources and
-configure the cluster itself. This is sometimes referred to as
-machine-to-machine access.
-
-Machine ID supports a number of use cases and platforms, but is commonly used
-for:
-
-- Granting CI/CD workflows access to resources such as SSH servers,
-  Kubernetes clusters, databases and applications that are protected by Teleport
-  in order to deploy changes.
-- Granting SecOps tooling access to resources in order to run security analysis
-  against them.
-- Creating and renewing credentials for custom scripts that use `tctl` or
-  the Teleport API in order to control Teleport configuration.
-
-## Concepts
-
-Read this section to understand the high-level architecture of a Machine ID
-setup. For a more in-depth overview, check out the [architecture
-page](../../reference/architecture/machine-id-architecture.mdx).
-
-![Machine ID architecture](../../../img/machine-id/architecture-diagram.png)
-
-### Bots
-
-Machine ID provides machines with an identity that can authenticate to the
-Teleport cluster. This identity is known as a **bot**. Bots share a number of
-similarities with human users:
-
-- Access controlled by roles assigned to them in Teleport
-- Access to resources recorded in audit logs
-- Identity encoded in an x.509 client certificate which is signed by the
-  Teleport Auth Service and which can then be used for access.
-
-### Join tokens
-
-Unlike a human Teleport user, a bot does not "log in" using a static username
-and password. Instead, a bot authenticates to Teleport with a **join token**,
-which is configured within Teleport and specifies which bot user it grants
-access to and what sort of proof (known as the **join method**) is needed to use
-this join token. This proof is typically an identity issued to the machine by
-the platform it runs on (e.g. AWS IAM).
-
-Multiple join tokens may be created for a single bot to allow joining with
-different join methods.
-
-### Bot Instances
-
-Each time a new `tbot` client joins from scratch, it creates a new server-side
-Bot Instance. Bot Instances keep track of individual `tbot` installations over
-time, even as they renew their certificates or rejoin. These server-side
-resources also record the most recent authentication attempts, as well as
-bot heartbeats.
-
-Many Bot Instances can exist concurrently for a given Bot, regardless of their
-join method.
-
-Bot Instances can be inspected with:
-- `tctl get bot_instance` to list all instances
-- `tctl get bot_instance/$botName` to list all instances associated with a
-  particular Bot
-- `tctl get bot_instance/$botName/$id` to show a single bot instance by its bot
-  name and ID
-
-### tbot
-
-Machine ID is used through an agent called `tbot`. `tbot` authenticates with the
-Teleport Cluster and then generates credentials and configuration files for
-other tools to use to connect to Teleport resources using the bot's identity.
-
-### Artifacts
-
-The files generated by `tbot` are referred to as its **artifacts**. Artifacts
-can be a number of things from credentials, such as signed certificates, to
-configuration files that will automatically configure a tool (such as `kubectl`)
-to use Teleport. This behaviour is controlled by configuring `tbot`'s
-**outputs**. An output specifies what should be generated and where it should be
-saved.
-
-## Get started
-
-For a quickstart non-production introduction to Machine ID, read the
-[Getting Started Guide](./getting-started.mdx).
-
-## Deploy to production
-
-Production-ready guidance on deploying Machine ID is broken out into two parts:
-
-- [Deploying Machine ID](deployment/deployment.mdx): How to install and configure
-  Machine ID for a specific platform.
-- [Access your Infrastructure with Machine ID](access-guides/access-guides.mdx): How to use Machine ID to access
-  Teleport and Teleport resources.
-
-## Further reading
-
-- [Workload Identity](../workload-identity/introduction.mdx): Information on Teleport Workload
-  Identity for SPIFFE, a feature for issuing short-lived identities intended
-  for workload to workload communication.
-- [Frequently Asked Questions](./faq.mdx): Commonly asked questions.
-- [Troubleshooting Guide](./troubleshooting.mdx): Common issues and how to solve
-  them.
-- [Architecture](../../reference/architecture/machine-id-architecture.mdx): A technical deep-dive into how Machine ID
-  works.
-- [Reference](../../reference/machine-id/machine-id.mdx): Complete documentation of available
-  configuration options.
-- [Manifesto](./manifesto.mdx): Our vision for Machine Identity and the
-  direction Machine ID and Workload ID are heading in.
diff --git a/docs/pages/enroll-resources/machine-id/machine-id.mdx b/docs/pages/enroll-resources/machine-id/machine-id.mdx
deleted file mode 100644
index dd01e00691b4c..0000000000000
--- a/docs/pages/enroll-resources/machine-id/machine-id.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Machine ID
-description: Guides to using Machine ID, which allows you to provide secure access to your infrastructure from automated services.
----
-
-<DocCardList />
diff --git a/docs/pages/enroll-resources/machine-id/troubleshooting.mdx b/docs/pages/enroll-resources/machine-id/troubleshooting.mdx
deleted file mode 100644
index e963ef7f9e446..0000000000000
--- a/docs/pages/enroll-resources/machine-id/troubleshooting.mdx
+++ /dev/null
@@ -1,354 +0,0 @@
----
-title: Machine ID Troubleshooting Guide
-description: Troubleshooting common issues with Machine ID
----
-
-This page provides resolution steps for issues that you may come across when
-setting up Machine ID.
-
-## A bot failed to renew a certificate due to a "generation mismatch"
-
-### Symptoms
-
-The bot will log an error like this:
-
-```text
-ERROR: renewable cert generation mismatch: stored=3, presented=2
-```
-
-Subsequent connection attempts by the bot may see errors like the following:
-```text
-ERROR: failed direct dial to auth server: auth API: access denied [00]
-"\tauth API: access denied [00], failed dial to auth server through reverse tunnel: Get \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://example.com:3025/webapi/find\": x509: cannot validate certificate for example.com because it doesn't contain any IP SANs"
-"\tGet \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://example.com:3025/webapi/find\": x509: cannot validate certificate for example.com because it doesn't contain any IP SANs"
-```
-
-In particular, note the message `auth API: access denied`.
-
-In self-hosted Teleport deployments, the Teleport Auth Service will also provide
-some additional context:
-
-```text
-[AUTH]      WARN lock targeting User:"bot-example" is in force: The bot user "bot-example" has been locked due to a certificate generation mismatch, possibly indicating a stolen certificate. auth/apiserver.go:224
-```
-
-### Explanation
-
-<Admonition type="note">
-This applies only to bots using the `token` join method, which makes use of
-one-time use shared secrets. Provider-specific join methods, such as GitHub,
-AWS IAM, etc will not be locked in this fashion unless another instance of the
-bot uses `token` joining.
-</Admonition>
-
-Machine ID (with token-based joining) uses a certificate generation counter to
-detect potentially stolen renewable certificates. Each time a bot fetches a new
-renewable certificate, the Auth Service increments the counter, stores it on the
-backend, and embeds a copy of the counter in the certificate.
-
-If the counter embedded in your bot certificate doesn't match the counter
-stored in Teleport's Auth Service, the renewal will fail and the bot user will
-be automatically [locked](../../admin-guides/access-controls/guides/locking.mdx).
-
-Renewable certificates are exclusively stored in the bot's internal data
-directory, by default `/var/lib/teleport/bot`. It's possible to trigger this by
-accident if multiple bots are started using the same internal data directory, or
-if this internal data is otherwise being shared between multiple `tbot`
-processes.
-
-Additionally, if a bot fails to save its freshly renewed certificates (for
-example, due to a filesystem error) and crashes, it will attempt a renewal
-with old certificates and trigger a lock.
-
-### Resolution
-
-Before unlocking the bot, try to determine if either of the two scenarios
-described above apply. If the certificates were stolen, there may be
-underlying security concerns that need to be addressed.
-
-Otherwise, first ensure only one `tbot` process is using the internal data
-directory. Multiple bots can be run on a single system, but separate data
-directories must be configured for each.
-
-Additionally, ensure the internal data is not being shared with or copied to any
-other nodes, for example via a shared NFS volume. If you'd like to share
-certificates between nodes, only copy or share content from destination
-directories (usually `/opt/machine-id`) rather than the internal data directory
-(by default, `/var/lib/teleport/bot`).
-
-Once you have addressed the underlying cause, follow these steps to reset a
-locked bot:
- 1. Remove the lock on the bot's user
- 1. Reset the bot's generation counter by creating a new bot instance
-
-To remove the lock, first find and remove the lock targeting the bot user. For
-this example, we'll assume the bot is named `example`, which will have an
-associated Teleport user named `bot-example`:
-
-```code
-$ tctl get locks
-kind: lock
-metadata:
-  id: 1658359514703080513
-  name: 5cee949f-5203-4f3b-9805-dac35d798a16
-spec:
-  message: The bot user "bot-example" has been locked due to a certificate generation
-    mismatch, possibly indicating a stolen certificate.
-  target:
-    user: bot-example
-version: v2
-
-$ tctl rm lock/5cee949f-5203-4f3b-9805-dac35d798a16
-```
-
-Next, use `tctl bots instances add` to generate a new join token for the
-preexisting bot `example`:
-```code
-$ tctl bots instances add example
-```
-
-Finally, reconfigure the local `tbot` instance with the new token and restart
-it. It will detect the new token and automatically reset its internal data
-directory. The bot will be issued a new bot instance UUID once connected, and
-the generation counter will be reset.
-
-## `tbot` shows a "bad certificate error" at startup
-
-### Symptoms
-
-Restarting a `tbot` process outputs a log like the following:
-
-```text
-INFO [TBOT]      Successfully loaded bot identity, valid: after=2022-07-21T21:49:26Z, before=2022-07-21T22:50:26Z, duration=1h1m0s | kind=tls, renewable=true, disallow-reissue=false, roles=[bot-test], principals=[-teleport-internal-join], generation=2 tbot/tbot.go:281
-ERRO [TBOT]      Identity has expired. The renewal is likely to fail. (expires: 2022-07-21T22:50:26Z, current time: 2022-07-25T20:18:33Z) tbot/tbot.go:415
-WARN [TBOT]      Note: onboarding config ignored as identity was loaded from persistent storage tbot/tbot.go:288
-ERRO [TBOT]      Failed to resolve tunnel address Get "https://auth.example.com:3025/webapi/find": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs reversetunnel/transport.go:90
-ERRO [TBOT]      Failed to resolve tunnel address Get "https://auth.example.com:3025/webapi/find": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs reversetunnel/transport.go:90
-ERROR: failed direct dial to auth server: Get "https://teleport.cluster.local/v2/configuration/name": remote error: tls: bad certificate
-"\tGet \"https://teleport.cluster.local/v2/configuration/name\": remote error: tls: bad certificate, failed dial to auth server through reverse tunnel: Get \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://auth.example.com:3025/webapi/find\": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs"
-"\tGet \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://auth.example.com:3025/webapi/find\": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs"
-```
-
-In particular, note the log line: "Identity has expired. The renewal is likely to
-fail."
-
-### Explanation
-
-Token-joined bots are unable to reauthenticate to the Teleport Auth Service once
-their certificates have expired. Tokens in token-based joining (as opposed to
-AWS IAM and other join methods) can only be used once, so when the bot's
-internal certificates expire, it will not be able to connect.
-
-When a bot's identity expires, certain parameters associated with the bot on the
-Auth Service must be reset and a new joining token must be issued. The simplest
-way to accomplish this is by removing and recreating the bot, which purges all
-server-side data and issues a new joining token.
-
-### Resolution
-
-Use `tctl bots instances add` to create a new one-time use token for the bot:
-
-```code
-$ tctl bots instances add example
-```
-
-Copy the resulting join token into the existing bot config—either the
-`--token` CLI flag or the `onboarding.token` parameter in `tbot.yaml`—and
-restart the bot. It will detect the new token and rejoin the cluster as normal.
-
-## SSH connections fail with `ssh: handshake failed: ssh: unable to authenticate`
-
-### Symptoms
-
-When attempting to connect to a node via SSH, connections fail with an error
-like the following:
-
-```code
-$ ssh -F /opt/machine-id/ssh_config bob@node.example.com
-ERROR: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-ERROR: unable to execute tsh
-executing `tsh proxy`
-exit status 1
-
-kex_exchange_identification: Connection closed by remote host
-Connection closed by UNKNOWN port 65535
-```
-
-In particular, note the `ssh: unable to authenticate` message.
-
-### Explanation
-
-This can occur when attempting to log into the node as a user not listed as a
-principal on the SSH certificate.
-
-You can verify this by viewing the `tbot` logs and looking for the log message
-when impersonated certificates for the matching outputs were renewed.
-
-In the following example, the only principal listed for the identity in
-`/opt/machine-id` is `alice` (via the `access` role):
-```text
-INFO [TBOT]      Successfully renewed impersonated certificates for directory /opt/machine-id, valid: after=2022-07-21T21:49:26Z, before=2022-07-21T22:50:26Z, duration=1h1m0s | kind=tls, renewable=false, disallow-reissue=true, roles=[access], principals=[alice -teleport-internal-join], generation=0 tbot/renew.go:630
-```
-
-However, the SSH command attempted to log in as `bob`.
-
-### Resolution
-
-Ensure the bot identity is allowed to log in as the requested user by taking any
-of the following actions:
-
- - Changing the SSH command to log in as an allowed user
- - Modifying the `access` role to allow the `alice` principal
- - Adding a role granting login via the `bob` principal
-
-Note that if roles are added or modified, the certificates will need to be
-renewed for the changes to take effect. The bot will renew certificates on its
-own after the renewal interval (by default, 20 minutes), but you can trigger a
-renewal immediately by either restarting the `tbot` process or sending it a
-reload signal:
-
-```code
-## If using systemd, you can restart the process:
-$ systemctl restart machine-id
-## Alternatively, you can send `tbot` a reload signal directly:
-$ pkill -sigusr1 tbot
-```
-
-## Database requests fail with `database "example" not found`, but the database exists
-
-### Symptoms
-
-When requesting certificates for Teleport-protected
-[databases](../database-access/database-access.mdx), the certificate request
-fails with an error like the following:
-
-```text
-ERROR: Failed to generate impersonated certs for directory /opt/machine-id: database "example" not found
-database "example" not found
-```
-
-However, the database exists and can be seen by regular users via `tsh`:
-
-```code
-$ tsh db ls
-Name       Description Allowed Users Labels  Connect
----------- ----------- ------------- ------- -------
-example                [alice]       env=dev
-```
-
-### Explanation
-
-Unlike regular Teleport users, Machine ID bot users are granted only minimal
-Teleport [RBAC permissions](../../reference/access-controls/roles.mdx) and are not
-allowed to view or list databases by default unless granted permission via one
-or more roles.
-
-### Resolution
-
-{/* vale messaging.protocol-products = NO */}
-Per the [Machine ID Database Access Guide](./access-guides/databases.mdx), ensure at
-least one role providing database permissions has been granted to the
-output listed in the error.
-{/* vale messaging.protocol-products = YES */}
-
-For example, note the `rules` section in the following example role:
-```yaml
-kind: role
-version: v5
-metadata:
-  name: machine-id-db
-spec:
-  allow:
-    db_labels:
-      '*': '*'
-    db_names: [example]
-    db_users: [alice]
-    rules:
-      - resources: [db_server, db]
-        verbs: [read, list]
-```
-
-Ensure the bot has a role that grants it at least these RBAC rules. If desired
-you can examine bot roles with `tctl` to ensure the necessary `rules` have been
-granted:
-
-```code
-$ tctl get role/machine-id-db
-```
-
-If the role is missing database permissions, it can be modified in your text
-editor:
-
-```code
-$ tctl edit role/machine-id-db
-```
-
-Edit the role, then save and close the file to apply your changes.
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-<Admonition type="note">
-By default, outputs (like `/opt/machine-id`) are granted all roles provided
-to the bot via `tctl bots add --roles=...`, but it's possible to grant only a
-subset of these roles using the `roles: ...` parameter in `tbot.yaml`.
-
-If permissions are unexpectedly missing, ensure `tbot.yaml` requests your
-database role, either by relying on default behavior or adding the role to the
-`roles: ...` list.
-</Admonition>
-
-Once fixed, restart or reload the `tbot` clients for the updated role to take
-effect.
-
-If the bot was not granted the role initially, the simplest solution is to
-delete and recreate the bot, being sure to include the role in the `--roles=...`
-flag:
-
-```code
-$ tctl bots rm example
-$ tctl bots add example --roles=foo,bar,machine-id-db
-```
-
-## Destination kubernetes_secret: `identity-output` must be a directory in exec plugin mode
-
-By default, when outputting a Kubernetes identity, `tbot` outputs make use of a Kubernetes exec
-plugin to always provide the latest version of the credentials.
-
-When outputting a Kubernetes identity to a Kubernetes secret, however, it is important to disable
-the use of the `exec` plugin by adding `disable_exec_plugin: true` to the output. This means that
-a static `kubeconfig` file with embedded short-lived credentials is written instead:
-
-```yaml
-outputs:
-  - type: kubernetes
-    # Specify the name of the Kubernetes cluster you wish the credentials to
-    # grant access to.
-    kubernetes_cluster: example-k8s-cluster
-    # Required when outputting a Kubernetes identity to a Kubernetes secret.
-    disable_exec_plugin: true
-    destination:
-      type: kubernetes_secret
-      # For this guide, identity-output is used as the secret name.
-      # You may wish to customize this. Multiple outputs cannot share the same
-      # destination.
-      name: identity-output
-```
-
-Failure to add the `disable_exec_plugin` flag will result in a warning being displayed:
-`Destination kubernetes_secret: identity-output must be a directory in exec plugin mode`.
-
-## Configuring `tbot` for split DNS proxies
-
-When you have deployed your Proxy Service in such a way that it is
-accessible via two different DNS names, e.g an internal and external address,
-you may find that a `tbot` that is configured to use one of these addresses may
-attempt to use the other address and that this may cause connections to fail.
-
-This is because `tbot` queries an auto-configuration endpoint exposed by the
-Proxy Service to determine the canonical address to use when connecting.
-
-To fix this, set a variable of `TBOT_USE_PROXY_ADDR=yes` in the environment of the
-`tbot` process. This configures `tbot` to prefer using the address that you have
-explicitly provided. This only functions correctly in cases where TLS
-routing/multiplexing is enabled for the Teleport cluster.
diff --git a/docs/pages/enroll-resources/mcp-access/dynamic-registration.mdx b/docs/pages/enroll-resources/mcp-access/dynamic-registration.mdx
new file mode 100644
index 0000000000000..805f7b8cc65d5
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/dynamic-registration.mdx
@@ -0,0 +1,81 @@
+---
+title: Dynamic MCP Server Registration
+sidebar_label: Dynamic Server Registration
+sidebar_position: 5
+description: Register/unregister MCP servers without restarting Teleport.
+tags:
+- how-to
+- zero-trust
+- mcp
+---
+
+Dynamic MCP server registration allows Teleport administrators to register new
+MCP servers (or update/unregister existing ones) without having to update the
+static configuration files read by Teleport Application Service instances.
+
+The MCP server resources are registered as `app` resources in the Teleport
+backend. Application Service instances periodically query the Teleport Auth
+Service for `app` resources, each of which includes the information that the
+Application Service needs to proxy an application.
+
+## Required permissions
+
+(!docs/pages/includes/application-access/dynamic-app-permissions.mdx!)
+
+## Enabling dynamic registration
+
+(!docs/pages/includes/application-access/dynamic-app-config.mdx!)
+
+## Creating a MCP server
+
+The following example configures Teleport to proxy the "Everything" MCP server
+by launching it through docker:
+```yaml
+kind: app
+version: v3
+metadata:
+  name: everything
+  description: The Everything MCP server
+  labels:
+    env: dev
+spec:
+  mcp:
+    # Command to launch stdio-based MCP servers.
+    command: "docker"
+    # Args to execute with the command.
+    args: ["run", "-i", "--rm", "mcp/everything"]
+    # Name of the host user account under which the command will be
+    # executed. Required for stdio-based MCP servers.
+    run_as_host_user: "docker"
+```
+
+See the full resource spec [reference](reference.mdx).
+
+To create the resource, run:
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+$ tctl create mcp_server.yaml
+```
+
+After the resource has been created, it will appear among the list of available
+MCP servers (in `tsh mcp ls` or UI) as long as at least one Application Service
+instance picks it up according to its label selectors.
+
+To update an existing application resource, run:
+
+```code
+$ tctl create -f mcp_server.yaml
+```
+
+If the updated resource's labels no longer match a particular app agent, it
+will unregister and stop proxying it.
+
+To delete the resource, run:
+
+```code
+$ tctl rm app/everything
+```
diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/enrolling-mcp-servers.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/enrolling-mcp-servers.mdx
new file mode 100644
index 0000000000000..ea951bf378ba6
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/enrolling-mcp-servers.mdx
@@ -0,0 +1,7 @@
+---
+title: Protecting MCP Servers
+sidebar_label: Enrollment Guides
+description: Provides guidance on enrolling various kinds of MCP servers with Teleport.
+---
+
+<DocCardList />
diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx
new file mode 100644
index 0000000000000..cf83505622cf2
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/sse.mdx
@@ -0,0 +1,80 @@
+---
+title: MCP Access with SSE MCP Server
+sidebar_label: SSE
+description: How to access MCP server with SSE transport.
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+Teleport can provide secure access to MCP servers with SSE transport.
+
+This guides shows you how to:
+
+- Enroll a MCP server with SSE transport in your Teleport cluster.
+- Connect to the SSE MCP server via Teleport.
+
+## How it works
+
+![How it works](../../../../img/mcp-access/architecture-sse.svg)
+
+Users can configure their MCP clients such as Claude Desktop to start an MCP
+server using `tsh`. Once successfully authorized, `tsh` establishes a session
+with the Application Service.
+
+The Teleport Application Service first starts an SSE connection to the remote MCP server
+defined in the application definition. Teleport then proxies the MCP protocol
+between the client and the remote MCP server, applying additional role-based
+access controls such as filtering which tools are available to the user. While
+proxying, Teleport also logs MCP protocol requests as audit events, providing
+visibility into user activity.
+
+<Admonition type="warning">
+HTTP with SSE transport has been deprecated in MCP specification version
+2025-03-26. It is recommended to update your MCP server to use the
+streamable-HTTP transport instead.
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)"!)
+- A host, e.g., an EC2 instance, where you will run the Teleport Application
+  Service.
+- The endpoint of the SSE MCP server <Var name="MCP endpoint" initial="http://my-sse-server/sse" />.
+
+## Step 1/3. Configure the Teleport Application Service
+
+(!docs/pages/includes/mcp-access/configure-app-service.mdx extraAppScheme="sse+" !)
+
+## Step 2/3. Configure your Teleport user
+
+(!docs/pages/includes/mcp-access/configure-user-rbac.mdx!)
+
+## Step 3/3. Connect
+
+Log in to Teleport with the user we've just created, <Var name="my_user" />:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=<Var name="my_user" />
+```
+
+Now we can inspect available MCP servers:
+
+```code
+$ tsh mcp ls
+Name       Description           Type  Labels
+---------- --------------------- ----- ----------
+everything everything MCP server SSE   env=dev
+```
+
+(!docs/pages/includes/mcp-access/tsh-mcp-config.mdx!)
+
+## Next Steps
+
+Learn more about protecting MCP servers with Teleport in the following topics:
+
+- [MCP Access Control](../rbac.mdx).
+- [JWT Authentication to MCP server](../jwt.mdx)
+- [Register MCP servers dynamically](../dynamic-registration.mdx)
+- Configuration and CLI [reference](../reference.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx
new file mode 100644
index 0000000000000..a671f0e41d3cf
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx
@@ -0,0 +1,160 @@
+---
+title: MCP Access with Stdio MCP Server
+sidebar_label: Stdio
+description: How to access MCP server with stdio transport.
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+Teleport can provide secure access to MCP servers with stdio transport.
+
+This guides shows you how to:
+
+- Enroll a MCP server with stdio transport in your Teleport cluster.
+- Connect to the stdio MCP server via Teleport.
+
+## How it works
+
+![How it works](../../../../img/mcp-access/architecture-stdio.svg)
+
+Users can configure their MCP clients such as Claude Desktop to start an MCP
+server using `tsh`. Once successfully authorized, `tsh` establishes a session
+with the Application Service.
+
+The Teleport Application Service starts the MCP server using the command and arguments
+defined by Teleport administrators in the app definition. Teleport then proxies
+the connection between the client and the remote MCP server, applying additional
+role-based access controls such as filtering which tools are available to the
+user. While proxying, Teleport also logs MCP protocol requests as audit events,
+providing visibility into user activity.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.1.0 or higher)"!)
+- A host, e.g., an EC2 instance, where you will run the Teleport Application
+  Service.
+- Tools on the same host that can launch stdio-based MCP servers like `npx`
+  or `docker`.
+
+## Step 1/3. Configure the Teleport Application Service
+
+You can update an existing Application Service or create a new one to enable the
+the MCP server.
+
+<Tabs>
+
+<TabItem label="Update an existing service">
+
+If you already have an existing Application Service running, you can add a MCP
+server in your YAML configuration:
+```yaml
+app_service:
+  enabled: true
+  apps:
+  - name: "everything"
+    labels:
+      env: dev
+    description:
+    mcp:
+      # Command to launch stdio-based MCP servers.
+      command: "docker"
+      # Args to execute with the command.
+      args: ["run", "-i", "--rm", "mcp/everything"]
+      # Name of the host user account under which the command will be
+      # executed. Required for stdio-based MCP servers.
+      run_as_host_user: "docker"
+```
+
+Replace the MCP details with the MCP server you desire to run then restart the Application Service.
+
+</TabItem>
+<TabItem label="Create a new service">
+
+{/* lint ignore heading-increment remark-lint */}
+#### Get a join token
+(!docs/pages/includes/tctl-token.mdx serviceName="Application" tokenType="app" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+#### Install the Teleport Application Service
+Install Teleport on the host where you will run the Teleport Application Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+#### Configure the Teleport Application service
+
+On the host where you will run the Teleport Application Service, create a file
+at `/etc/teleport.yaml` with the following content:
+```yaml
+version: v3
+teleport:
+  join_params:
+    token_name: "/tmp/token"
+    method: token
+  proxy_server: "<Var name="teleport.example.com:443" />"
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+app_service:
+  enabled: true
+  apps:
+  - name: "everything"
+    labels:
+      env: dev
+    description:
+    mcp:
+      # Command to launch stdio-based MCP servers.
+      command: "docker"
+      # Args to execute with the command.
+      args: ["run", "-i", "--rm", "mcp/everything"]
+      # Name of the host user account under which the command will be
+      # executed. Required for stdio-based MCP servers.
+      run_as_host_user: "docker"
+```
+
+Replace <Var name="teleport.example.com:443" /> with the host and port of your Teleport Proxy
+Service or Teleport Cloud tenant, and replace the MCP details with the MCP
+server you desire to run.
+
+#### Start the Teleport Application Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Application Service"!)
+
+</TabItem>
+</Tabs>
+
+## Step 2/3. Configure your Teleport user
+
+(!docs/pages/includes/mcp-access/configure-user-rbac.mdx!)
+
+## Step 3/3. Connect
+
+Log in to Teleport with the user we've just created, <Var name="my_user" />:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=<Var name="my_user" />
+```
+
+Now we can inspect available MCP servers:
+
+```code
+$ tsh mcp ls
+Name       Description           Type  Labels
+---------- --------------------- ----- ----------
+everything everything MCP server stdio env=dev
+```
+
+(!docs/pages/includes/mcp-access/tsh-mcp-config.mdx!)
+
+## Next Steps
+
+Learn more about protecting MCP servers with Teleport in the following topics:
+
+- [MCP Access Control](../rbac.mdx).
+- [Register MCP servers dynamically](../dynamic-registration.mdx)
+- Configuration and CLI [reference](../reference.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx
new file mode 100644
index 0000000000000..22978552dea4b
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/enrolling-mcp-servers/streamable-http.mdx
@@ -0,0 +1,96 @@
+---
+title: MCP Access with Streamable-HTTP MCP Server
+sidebar_label: Streamable-HTTP
+description: How to access MCP server with streamable-HTTP transport.
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+Teleport can provide secure access to MCP servers with streamable-HTTP transport.
+
+This guides shows you how to:
+
+- Enroll a MCP server with streamable-HTTP transport in your Teleport cluster.
+- Connect to the stdio MCP server via Teleport.
+
+## How it works
+
+![How it works](../../../../img/mcp-access/architecture-http.svg)
+
+Users can configure their MCP clients such as Claude Desktop to start an MCP
+server using `tsh`. Once successfully authorized, `tsh` establishes a session
+with the Application Service.
+
+Teleport proxies the MCP protocol between the client and the remote MCP server,
+applying additional role-based access controls such as filtering which tools are
+available to the user. While proxying, Teleport also logs MCP protocol requests
+as audit events, providing visibility into user activity.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)"!)
+- A host, e.g., an EC2 instance, where you will run the Teleport Application
+  Service.
+- The endpoint of the streamable-HTTP MCP server <Var name="MCP endpoint" initial="http://my-http-server/mcp" />.
+
+## Step 1/3. Configure the Teleport Application Service
+
+(!docs/pages/includes/mcp-access/configure-app-service.mdx!)
+
+## Step 2/3. Configure your Teleport user
+
+(!docs/pages/includes/mcp-access/configure-user-rbac.mdx!)
+
+## Step 3/3. Connect
+
+Log in to Teleport with the user we've just created, <Var name="my_user" />:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=<Var name="my_user" />
+```
+
+Now we can inspect available MCP servers:
+
+```code
+$ tsh mcp ls
+Name       Description           Type            Labels
+---------- --------------------- --------------- ----------
+everything everything MCP server Streamable HTTP env=dev
+```
+
+(!docs/pages/includes/mcp-access/tsh-mcp-config.mdx!)
+
+## Connect with streamable-HTTP client
+
+The `tsh mcp connect` command demonstrated above can be used by any stdio MCP
+client to start a MCP session, and Teleport automatically handles the transport
+conversion to the remote MCP server.
+
+However, if you wish to connect to the MCP server in streamable-HTTP transport,
+you can start a local proxy that creates an authenticated tunnel to the remote
+MCP server:
+```code
+$ tsh proxy mcp everything -p 8888
+Proxying connections to everything on 127.0.0.1:8888
+```
+
+Then, connect to the MCP server locally with a MCP client that supports
+streamable-HTTP, for example:
+```code
+$ npx @modelcontextprotocol/inspector --transport http --cli --method tools/list http://127.0.0.1:8888
+```
+
+Alternatively, instead of `tsh`, you can use [Teleport
+Connect](../../../connect-your-client/teleport-clients/teleport-connect.mdx#connecting-to-an-mcp-server) which can maintain
+the local proxies in the background.
+
+## Next Steps
+
+Learn more about protecting MCP servers with Teleport in the following topics:
+
+- [MCP Access Control](../rbac.mdx).
+- [JWT Authentication to MCP server](../jwt.mdx)
+- [Register MCP servers dynamically](../dynamic-registration.mdx)
+- Configuration and CLI [reference](../reference.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/getting-started.mdx b/docs/pages/enroll-resources/mcp-access/getting-started.mdx
new file mode 100644
index 0000000000000..eb27b96e1dc5d
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/getting-started.mdx
@@ -0,0 +1,140 @@
+---
+title: MCP Access Getting Started Guide
+sidebar_label: Getting Started
+sidebar_position: 1
+description: Getting started with Teleport MCP access.
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+Teleport can provide secure connections to your MCP (Model Context Protocol)
+servers while improving both access control and visibility.
+
+This guides shows you how to:
+
+- Enroll the Teleport demo MCP server in your Teleport cluster.
+- Connect to the MCP server via Teleport.
+
+## How it works
+
+![How it works](../../../img/mcp-access/architecture-demo.svg)
+
+The Teleport Application Service includes a built-in demo MCP server designed to
+showcase how MCP access works.
+
+Users can configure their MCP clients such as Claude Desktop to start an MCP
+server using `tsh`. Once successfully authorized, `tsh` establishes a session
+with the Application Service.
+
+Once the session is established, the Application Service starts the in-memory
+demo MCP server. Teleport then proxies the connection between the client and the
+remote MCP server, applying additional role-based access controls such as
+filtering which tools are available to the user. While proxying, Teleport also
+logs MCP protocol requests as audit events, providing visibility into user
+activity.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.1.0 or higher)"!)
+- A host, e.g., an EC2 instance, where you will run the Teleport Applications
+  Service.
+
+## Step 1/3. Configure the Teleport Application Service
+
+You can update an existing Application Service or create a new one to enable the
+demo MCP server.
+
+<Tabs>
+
+<TabItem label="Update an existing service">
+
+If you already have an existing Application Service running, you can enable the
+demo MCP server by adding the following in your YAML configuration:
+```diff
+app_service:
+  enabled: true
++  mcp_demo_server: true
+...
+```
+
+Now restart the Application Service.
+
+</TabItem>
+<TabItem label="Create a new service">
+
+{/* lint ignore heading-increment remark-lint */}
+#### Get a join token
+(!docs/pages/includes/tctl-token.mdx serviceName="Application" tokenType="app" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+#### Install the Teleport Application Service
+Install Teleport on the host where you will run the Teleport Application Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+#### Configure the Teleport Application service
+
+On the host where you will run the Teleport Application Service, create a
+configuration file:
+```code
+$ sudo teleport configure \
+   -o file \
+   --roles=app \
+   --proxy=<Var name="teleport.example.com:443" /> \
+   --token=/tmp/token \
+   --mcp-demo-server
+```
+
+The command will generate an Application Service configuration to proxy the demo
+MCP server and save the configuration to `/etc/teleport.yaml`.
+
+#### Start the Teleport Application Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Application Service"!)
+</TabItem>
+</Tabs>
+
+## Step 2/3. Configure your Teleport user
+
+(!docs/pages/includes/mcp-access/configure-user-rbac.mdx!)
+
+## Step 3/3. Connect
+
+Log in to Teleport with the user we've just created, <Var name="my_user" />:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com:443" /> --user=<Var name="my_user" />
+```
+
+Now we can inspect available MCP servers:
+
+```code
+$ tsh mcp ls
+Name              Description                                                       Type  Labels
+----------------- ----------------------------------------------------------------- ----- ------
+teleport-mcp-demo A demo MCP server that shows current user and session information stdio
+```
+
+(!docs/pages/includes/mcp-access/tsh-mcp-config.mdx appName="teleport-mcp-demo" !)
+
+The demo MCP server consists of several tools:
+- `teleport_user_info`: Shows basic information about your Teleport user.
+- `teleport_session_info`: Shows information about this MCP session.
+- `teleport_demo_info`: Shows information about this Teleport Demo MCP server.
+
+You can interact with it using sample questions like "can you show some details
+on this Teleport demo?":
+
+![Demo Server Claude Desktop](../../../img/mcp-access/demo-server-claude-desktop.png)
+
+
+## Next Steps
+
+Learn more about protecting MCP servers with Teleport in the following topics:
+
+- [MCP Access Control](rbac.mdx).
+- Configuration and CLI [reference](reference.mdx).
+- Audit events [reference](../../reference/deployment/monitoring/audit.mdx#event-types).
diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx
new file mode 100644
index 0000000000000..b57359b7b1c0d
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/integration-guides/github.mdx
@@ -0,0 +1,121 @@
+---
+title: Connect a GitHub MCP Server to Teleport
+sidebar_label: GitHub
+description: Set up a GitHub MCP server for access through Teleport
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+(!docs/pages/includes/mcp-access/integration-intro.mdx serviceName="GitHub" !)
+
+## How it works
+
+The [GitHub MCP server](https://github.com/github/github-mcp-server) uses a
+personal access token of a service account to access GitHub and
+[`mcp-proxy`](https://github.com/sparfenyuk/mcp-proxy) exposes it to the
+Teleport Application Service over a streamable-HTTP endpoint by translating the
+original transport. Teleport proxies all client requests to the server, which
+interacts with GitHub using the permissions granted to the service account.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)" clients="\`tsh\` client"!)
+- Access to a service account to your GitHub organization.
+- A host to run the MCP server that is reachable by the Teleport Application Service.
+- A running Teleport Application Service. If you have not yet done this, follow
+  the [Getting Started guide](../getting-started.mdx).
+- A Teleport user with sufficient permissions (e.g. role `mcp-user`) to access
+  MCP servers.
+
+## Step 1/3. Create a personal access token
+
+Log in to GitHub using your service account. Navigate to Settings > Developer
+Settings > Personal access tokens, then click **Generate new token**.
+
+When creating the token, grant only the minimal permissions needed. Avoid broad
+scopes such as write or admin access unless absolutely required.
+
+Once the token is created, save it for use in the next step.
+
+## Step 2/3. Run the GitHub MCP server
+
+First, install `mcp-proxy` on the host that will run the MCP server:
+```code
+# Option 1: With uv (recommended)
+$ uv tool install mcp-proxy
+
+# Option 2: With pipx (alternative)
+$ pipx install mcp-proxy
+```
+
+Now start the GitHub MCP server behind `mcp-proxy`, using the personal access
+token <Var name="github_personal_access_token" />:
+```code
+$ mcp-proxy \
+  --host <Var name="MCP_HOST" initial_value="localhost"/>  --port 8000 \
+  -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=<Var name="github_personal_access_token" /> \
+  ghcr.io/github/github-mcp-server
+```
+
+Replace `<Var name="MCP_HOST"/>` with the hostname of the host machine running
+the MCP server. The host must be reachable by the Teleport Application
+Service.
+
+After starting, `mcp-proxy` exposes a streamable-HTTP endpoint at `http://<Var
+name="MCP_HOST" initial="localhost" />:8000/mcp`.
+
+## Step 3/3. Connect via Teleport
+
+(!docs/pages/includes/mcp-access/integration-teleport-app.mdx service="github" serviceName="GitHub" port="8000"!)
+
+(!docs/pages/includes/mcp-access/integration-limit-tools.mdx!)
+```yaml
+kind: role
+version: v8
+metadata:
+  name: github-mcp-readonly
+spec:
+  allow:
+    app_labels:
+      'service': 'github'
+    mcp:
+      tools:
+      - ^(get|search|list)_.*$
+      - ^.*_read$
+```
+
+(!docs/pages/includes/mcp-access/integration-tsh.mdx service="github" serviceName="GitHub" !)
+
+![Grafana Claude](../../../../img/mcp-access/github-claude.png)
+
+## Connect to GitHub without service account
+
+Instead of using a service account's personal access token, you can require each
+Teleport user to supply their own token from the client side. This removes the
+need to run an `mcp-proxy`, allowing you to use the official MCP server directly
+when configuring your MCP server:
+```yaml
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "github-mcp"
+    uri: "mcp+https://api.githubcopilot.com/mcp/"
+    labels:
+      env: dev
+      service: github
+```
+
+When configuring the MCP client, use your own personal access token as a bearer
+token for the `Authorization` header:
+```code
+$ tsh mcp config github-mcp --client-config claude --header "Authorization: Bearer <Var name="github_personal_access_token" />"
+```
+
+## Next steps
+
+- Review [Enroll a Streamable-HTTP MCP Server](../enrolling-mcp-servers/streamable-http.mdx).
+- See the [dynamic registration](../dynamic-registration.mdx) guide.
+- Learn more about [github-mcp-server](https://github.com/github/github-mcp-server).
+- Connect your [MCP clients](../../../connect-your-client/model-context-protocol/mcp-access.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/grafana.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/grafana.mdx
new file mode 100644
index 0000000000000..75547c37af080
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/integration-guides/grafana.mdx
@@ -0,0 +1,137 @@
+---
+title: Connect a Grafana MCP Server to Teleport
+sidebar_label: Grafana
+description: Set up a Grafana MCP server for access through Teleport
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+(!docs/pages/includes/mcp-access/integration-intro.mdx serviceName="Grafana" !)
+
+## How it works
+
+The [Grafana MCP server](https://github.com/grafana/mcp-grafana)
+forwards JWT tokens signed by Teleport to access Grafana and runs on a local
+endpoint reachable by the Teleport Application Service. Teleport proxies all
+client requests to the server, which interacts with Grafana using permissions
+mapped by [JWT authentication](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/jwt/).
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)" clients="\`tsh\` client"!)
+- Ability to configure your Grafana instance.
+- A host to run the MCP server that is reachable by the Teleport Application Service.
+- A running Teleport Application Service. If you have not yet done this, follow
+  the [Getting Started guide](../getting-started.mdx).
+- A Teleport user with sufficient permissions (e.g. role `mcp-user`) to access
+  MCP servers.
+
+## Step 1/3. Configure JWT authentication in Grafana
+
+(!docs/pages/includes/application-access/jwt-grafana-config.mdx!)
+
+## Step 2/3. Run the Grafana MCP server
+
+The Grafana MCP Server can be run either as a compiled binary or via the
+official Docker image:
+
+<Tabs>
+<TabItem label="mcp-grafana binary">
+Run the MCP server in streamable-HTTP transport. Assign  <Var name="GRAFANA_URL"
+initial_value="https://your-grafana-instance-url"/> to the URL of your Grafana
+instance and <Var name="MCP_HOST" initial_value="localhost" /> to the hostname
+of the host machine running the MCP server:
+```code
+$ export GRAFANA_URL=<Var name="GRAFANA_URL" initial_value="https://your-grafana-instance-url" />
+$ ./mcp-grafana --transport streamable-http --address <Var name="MCP_HOST" initial_value="localhost" />:8000
+```
+</TabItem>
+
+<TabItem label="Docker">
+Run the MCP server in streamable-HTTP transport. Assign <Var name="GRAFANA_URL"
+initial_value="https://your-grafana-instance-url"/> to the URL of your Grafana
+instance:
+```code
+$ docker run -d -p 8000:8000 \
+  -e GRAFANA_URL=<Var name="GRAFANA_URL" initial_value="https://your-grafana-instance-url" /> \
+  mcp/grafana --transport streamable-http
+```
+</TabItem>
+</Tabs>
+
+The Grafana MCP Server now exposes a streamable-HTTP endpoint at `http://<Var name="MCP_HOST"/>:8000/mcp`.
+
+## Step 3/3. Connect via Teleport
+
+(!docs/pages/includes/mcp-access/integration-teleport-app-rewrite.mdx service="grafana" serviceName="Grafana" port="8000" headerName="X-Grafana-API-Key" headerValue="&#123;&#123;internal.jwt&#125;&#125;" !)
+
+The header rewrite configuration above will replace the `{{internal.jwt}}`
+template variable with a Teleport-signed JWT token in each request. The Grafana
+MCP server will use this token as a bearer token in "Authorization" header when
+connecting to Grafana.
+
+(!docs/pages/includes/mcp-access/integration-limit-tools.mdx!)
+```yaml
+kind: role
+version: v8
+metadata:
+  name: grafana-mcp-readonly
+spec:
+  allow:
+    app_labels:
+      'service': 'grafana'
+    mcp:
+      tools:
+      - ^(get|query|list|search|find)_.*$
+```
+
+(!docs/pages/includes/mcp-access/integration-tsh.mdx service="grafana" serviceName="Grafana" !)
+
+![Grafana Claude](../../../../img/mcp-access/grafana-claude.png)
+
+## Connect to Grafana using a service account
+
+Instead of accessing Grafana with JWT authentication, you can also use a service
+account.
+
+Navigate to Administrators > Users and Accounts > Service Accounts, and then
+click **Create Service Account**:
+
+![Grafana Service Account](../../../../img/mcp-access/grafana-create-sa.png)
+
+Assign the **Viewer** role to keep the service account limited to read-only
+access.
+
+After the service account is created, click **Add service account
+token** to generate a new token. Use this token <Var
+name="SERVICE_ACCOUNT_TOKEN" initial_value="your_service_account_token"/> when
+starting the Grafana MCP server:
+```code
+$ docker run -d -p 8000:8000 \
+  -e GRAFANA_URL=<Var name="GRAFANA_URL" /> \
+  -e GRAFANA_SERVICE_ACCOUNT_TOKEN=<Var name="SERVICE_ACCOUNT_TOKEN"/> \
+  mcp/grafana --transport streamable-http
+```
+
+Lastly, you don’t need to configure any header rewrites in the Teleport
+application:
+```yaml
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "grafana-mcp"
+    uri: "mcp+http://<Var name="MCP_HOST"/>:8000/mcp"
+    labels:
+      env: dev
+      service: grafana
+```
+
+## Next steps
+
+- Read more on accessing Grafana through Teleport with [JWT authentication](../../application-access/jwt/grafana.mdx).
+- Review [Enroll a Streamable-HTTP MCP Server](../enrolling-mcp-servers/streamable-http.mdx).
+- See the [dynamic registration](../dynamic-registration.mdx) guide.
+- Learn more about [mcp-grafana](https://github.com/grafana/mcp-grafana).
+- Connect your [MCP clients](../../../connect-your-client/model-context-protocol/mcp-access.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/integration-guides.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/integration-guides.mdx
new file mode 100644
index 0000000000000..d7c8ecaa3d4a2
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/integration-guides/integration-guides.mdx
@@ -0,0 +1,15 @@
+---
+title: MCP Server Integration Guides
+sidebar_label: Integration Guides
+description: How to configure popular services and connect their MCP servers through Teleport.
+sidebar_position: 6
+tags:
+ - mcp
+ - zero-trust
+---
+
+
+Guides on how to configure popular services with the credentials and transports
+required to run their MCP servers and connect them through Teleport.
+
+<DocCardList />
diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/notion.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/notion.mdx
new file mode 100644
index 0000000000000..10323869773a0
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/integration-guides/notion.mdx
@@ -0,0 +1,97 @@
+---
+title: Connect a Notion MCP Server to Teleport
+sidebar_label: Notion
+description: Set up a Notion MCP server for access through Teleport
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+(!docs/pages/includes/mcp-access/integration-intro.mdx serviceName="Notion" !)
+
+## How it works
+
+The [Notion MCP server](https://github.com/makenotion/notion-mcp-server)
+uses an integration token to access Notion and runs on a local endpoint
+reachable by the Teleport Application Service. Teleport proxies all client
+requests to the server, which interacts with Notion using the permissions
+granted to the integration.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)" clients="\`tsh\` client"!)
+- Access to your Notion workspace and sufficient privileges to manage integrations.
+- A host to run the MCP server that is reachable by the Teleport Application Service.
+- A running Teleport Application Service. If you have not yet done this, follow
+  the [Getting Started guide](../getting-started.mdx).
+- A Teleport user with sufficient permissions (e.g. role `mcp-user`) to access
+  MCP servers.
+
+## Step 1/3. Create an integration in Notion
+
+Go to https://www.notion.so/profile/integrations and create a new **internal
+integration**.
+
+![Notion integration](../../../../img/mcp-access/notion-integration.png)
+
+To limit the scope available to LLMs, disable all permissions except "Read
+Content" in the "Capabilities" section.
+
+Next, open "Access" tab and select the pages you want the integration to be able
+to access.
+
+![Notion access](../../../../img/mcp-access/notion-access.png)
+
+Finally, return to the "Configuration" tab, copy the "Internal Integration
+Secret" for use in the next step.
+
+## Step 2/3. Run the Notion MCP server
+
+Start the Notion MCP server using your Notion integration token <Var
+name="ntn_your_internal_integration_secret" />:
+```code
+$ export NOTION_TOKEN=<Var name="ntn_your_internal_integration_secret" />
+$ npx @notionhq/notion-mcp-server --transport http --port 8000 --auth-token teleport-local-connection
+```
+
+The MCP server listens on all network interfaces by default. Run it on a private
+network and ensure the hostname <Var name="MCP_HOST" initial="localhost" /> is
+reachable by the Teleport Application Service.
+
+The `--auth-token` value is the shared secret Teleport uses to authenticate to
+the MCP server. Since the MCP server is not publicly accessible, using a fixed
+value is acceptable.
+
+## Step 3/3. Connect via Teleport
+
+(!docs/pages/includes/mcp-access/integration-teleport-app.mdx service="notion" serviceName="Notion" port="8000" !)
+
+(!docs/pages/includes/mcp-access/integration-limit-tools.mdx!)
+```yaml
+kind: role
+version: v8
+metadata:
+  name: notion-mcp-readonly
+spec:
+  allow:
+    app_labels:
+      'service': 'notion'
+    mcp:
+      tools:
+      - API-get-*
+      - API-retrieve-*
+      - API-post-database-query
+      - API-post-search
+```
+
+(!docs/pages/includes/mcp-access/integration-tsh.mdx service="notion" serviceName="Notion" !)
+
+![Notion Claude](../../../../img/mcp-access/notion-claude.png)
+
+## Next steps
+
+- Review [Enroll a Streamable-HTTP MCP Server](../enrolling-mcp-servers/streamable-http.mdx).
+- See the [dynamic registration](../dynamic-registration.mdx) guide.
+- Learn more about [notion-mcp-server](https://github.com/makenotion/notion-mcp-server).
+- Connect your [MCP clients](../../../connect-your-client/model-context-protocol/mcp-access.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/integration-guides/vault.mdx b/docs/pages/enroll-resources/mcp-access/integration-guides/vault.mdx
new file mode 100644
index 0000000000000..8771ad828986e
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/integration-guides/vault.mdx
@@ -0,0 +1,125 @@
+---
+title: Connect a HashiCorp Vault MCP Server to Teleport
+sidebar_label: HashiCorp Vault
+description: Set up a HashiCorp Vault MCP server for access through Teleport
+tags:
+- how-to
+- mcp
+- zero-trust
+---
+
+(!docs/pages/includes/mcp-access/integration-intro.mdx serviceName="HashiCorp Vault" !)
+
+## How it works
+
+The [HashiCorp Vault MCP server](https://github.com/hashicorp/vault-mcp-server)
+uses a service token to access HashiCorp Vault and runs on a local endpoint
+reachable by the Teleport Application Service. Teleport proxies all client
+requests to the server, which interacts with HashiCorp Vault using the
+permissions granted by the policy bound to the token.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v18.3.0 or higher)" clients="\`tsh\` client"!)
+- Access to your Vault instance and sufficient privileges to manage policies.
+- A host to run the MCP server that is reachable by the Teleport Application Service.
+- A running Teleport Application Service. If you have not yet done this, follow
+  the [Getting Started guide](../getting-started.mdx).
+- A Teleport user with sufficient permissions (e.g. role `mcp-user`) to access
+  MCP servers.
+
+## Step 1/3. Create a policy in Vault
+
+First, create a policy file:
+```code
+$ cat > mcp-readonly.hcl <<EOF
+# Read/list all secrets and metadata stored in the KV v2 engine at "secret/"
+path "secret/data/*" {
+  capabilities = ["read", "list"]
+}
+path "secret/metadata/*" {
+  capabilities = ["read", "list"]
+}
+EOF
+```
+This example grants read-only access to all secrets stored under the `secret/` KV
+v2 engine. You can tighten or expand these paths depending on your needs.
+
+To load the policy into Vault:
+```code
+$ vault policy write mcp-readonly mcp-readonly.hcl
+```
+
+Once the policy created, generate a Vault token that the MCP server will use:
+```code
+$ vault token create -policy="mcp-readonly" -display-name="teleport-mcp-service" -ttl=720h
+```
+
+Copy the result token for use in the next step.
+
+## Step 2/3. Run the Vault MCP server
+
+The Vault MCP Server can be run either as a compiled binary or via the official
+Docker image:
+
+<Tabs>
+<TabItem label="vault-mcp-server binary">
+To start the MCP server in streamable-HTTP mode:
+```code
+$ export TRANSPORT_MODE=http
+$ export TRANSPORT_HOST=<Var name="MCP_HOST" initial="localhost" /> # or listen to a network that is reachable by Teleport
+$ export VAULT_ADDR=<Var name="VAULT_ADDR" initial_value="https://your-vault-address:8200" />
+$ export VAULT_TOKEN=<Var name="VAULT_TOKEN" initial_value="your_vault_token"/>
+$ ./vault-mcp-server
+```
+
+Replace `<Var name="MCP_HOST"/>` with the hostname of the host machine running
+the MCP server. The host must be reachable by the Teleport Application
+Service.
+</TabItem>
+
+<TabItem label="docker">
+To start the MCP server in streamable-HTTP mode:
+```code
+$ docker run -d -p 8080:8080 \
+  -e TRANSPORT_MODE=http \
+  -e TRANSPORT_HOST=0.0.0.0 \
+  -e VAULT_ADDR=<Var name="VAULT_ADDR" initial_value="https://your-vault-address:8200" /> \
+  -e VAULT_TOKEN=<Var name="VAULT_TOKEN" initial_value="your_vault_token"/> \
+  --name vault-teleport-mcp hashicorp/vault-mcp-server
+```
+</TabItem>
+</Tabs>
+
+After starting, the Vault MCP Server exposes a streamable-HTTP endpoint at
+`http://<Var name="MCP_HOST" initial="localhost" />:8080/mcp`.
+
+## Step 3/3. Connect via Teleport
+
+(!docs/pages/includes/mcp-access/integration-teleport-app.mdx service="vault"  serviceName="Vault" port="8080" !)
+
+(!docs/pages/includes/mcp-access/integration-limit-tools.mdx!)
+```yaml
+kind: role
+version: v8
+metadata:
+  name: vault-mcp-readonly
+spec:
+  allow:
+    app_labels:
+      'service': 'vault'
+    mcp:
+      tools:
+      - ^(get|list)_.*$
+```
+
+(!docs/pages/includes/mcp-access/integration-tsh.mdx service="vault" serviceName="Vault" !)
+
+![Vault Claude](../../../../img/mcp-access/vault-claude.png)
+
+## Next steps
+
+- Review [Enroll a Streamable-HTTP MCP Server](../enrolling-mcp-servers/streamable-http.mdx).
+- See the [dynamic registration](../dynamic-registration.mdx) guide.
+- Learn more about [vault-mcp-server](https://github.com/hashicorp/vault-mcp-server).
+- Connect your [MCP clients](../../../connect-your-client/model-context-protocol/mcp-access.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/jwt.mdx b/docs/pages/enroll-resources/mcp-access/jwt.mdx
new file mode 100644
index 0000000000000..777d02056dc4f
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/jwt.mdx
@@ -0,0 +1,37 @@
+---
+title: JWT Authentication to MCP Servers
+sidebar_label: JWT Authentication
+sidebar_position: 4
+description: How to use Teleport JWT to authenticate your MCP servers
+tags:
+- conceptual
+- mcp
+- zero-trust
+---
+
+(!docs/pages/includes/application-access/jwt-intro.mdx appType="MCP server" !)
+
+## Inject JWT
+
+(!docs/pages/includes/application-access/jwt-inject.mdx!)
+
+For example:
+
+```yaml
+- name: "my-mcp-server"
+  uri: mcp+http://localhost:4321
+  rewrite:
+    headers:
+    - "Authorization: Bearer {{internal.jwt}}"
+```
+
+## Validate JWT
+
+(!docs/pages/includes/application-access/jwt-validate.mdx!)
+
+See the example Go program used to validate Teleport's JWT tokens on our
+[GitHub](https://github.com/gravitational/teleport/blob/v(=teleport.version=)/examples/mcp-servers/).
+
+## Troubleshooting
+
+(!docs/pages/includes/application-access/jwt-configure-claims.mdx appType="MCP server" appScheme="mcp+http" !)
diff --git a/docs/pages/enroll-resources/mcp-access/mcp-access.mdx b/docs/pages/enroll-resources/mcp-access/mcp-access.mdx
new file mode 100644
index 0000000000000..20ff4b023fba4
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/mcp-access.mdx
@@ -0,0 +1,135 @@
+---
+title: MCP Servers
+description: Protect Model Context Protocol (MCP) servers with Teleport's access controls and auditing capabilities 
+template: doc-page
+tags:
+ - mcp
+ - zero-trust
+---
+
+import DocHero from "@site/src/components/Pages/Landing/DocHero";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+import Resources from "@site/src/components/Pages/Homepage/Resources";
+
+import userCheckSvg from "@site/src/components/Icon/svg/user-check.svg";
+import questionSvg from "@site/src/components/Icon/svg/question2.svg";
+import databaseSvg from "@site/src/components/Icon/teleport-svg/database.svg";
+import kubernetesSvg from "@site/src/components/Icon/svg/kubernetes2.svg";
+import githubSvg from "@site/src/components/Icon/svg/github.svg";
+import vaultSvg from "@site/src/components/Icon/svg/hashicorp-vault.svg";
+import notionSvg from "@site/src/components/Icon/svg/notion.svg";
+import grafanaSvg from "@site/src/components/Icon/svg/grafana.svg";
+
+<DocHero
+  title="Enroll your first MCP server"
+  youtubeVideoId="JdiNX4pIUaU"
+  ctaLinks={[
+    {
+      title: "Get started with MCP servers",
+      href: "./getting-started/",
+      variant: "secondary",
+      arrow: true,
+    },
+  ]}
+  links={[
+    {
+      title: "MCP access controls",
+      description: "Use Teleport's role-based access control (RBAC) system to set up granular permissions for authenticating to MCP servers connected to Teleport.",
+      href: "./rbac/",
+      icon: userCheckSvg,
+    },
+    {
+      title: "Troubleshooting",
+      description: "Understand common issues that you might encounter in managing access to MCP servers with Teleport and how to work around or resolve them.",
+      href: "./troubleshooting/",
+      icon: questionSvg,
+    },
+  ]}
+>
+{/* vale messaging.protocol-products = NO */}
+Connect an MCP server with the Teleport Application Service, configure and assign a role granting MCP permissions, and connect and query the server with the Teleport CLI or your AI platform of choice.
+</DocHero>
+
+<UseCasesList
+  title="MCP server access"
+  description="Connect to and query MCP servers with the AI platform of your choice"
+  desktopColumnsCount={2}
+  variant="doc"
+  useCases={[
+    {
+      title: "Enroll a streamable-HTTP MCP server",
+      description: "Enroll an MCP server with streamable-HTTP transport into your Teleport cluster and connect to it through Teleport.",
+      href: "./enrolling-mcp-servers/streamable-http/",
+    },  
+    {
+      title: "Enroll an stdio MCP server",
+      description: "Enroll an MCP server with stdio transport into your Teleport cluster and connect to it through Teleport.",
+      href: "./enrolling-mcp-servers/stdio/",
+    },  
+    {
+      title: "Enroll an SSE MCP server",
+      description: "Enroll an MCP server with SSE (Server-Sent Events) transport into your Teleport cluster and connect to it through Teleport.",
+      href: "./enrolling-mcp-servers/sse/",
+    },  
+    {
+      title: "JWT authentication to MCP server",
+      description: "Authenticate Teleport to an MCP server with JWTs signed by Teleport's CA, carrying user identity, roles, and traits.",
+      href: "./jwt/",
+    },  
+    {
+      title: "Dynamic MCP server registration",
+      description: "Register MCP servers (or update existing ones) without having to update the static configuration files read by Teleport Application Service instances.",
+      href: "./dynamic-registration/",
+    },
+    {
+      title: "Configure MCP clients",
+      description: "Configure MCP clients such as Claude Desktop or Cursor to access MCP servers.",
+      href: "../../connect-your-client/model-context-protocol/mcp-access/",
+    },
+  ]}
+/>
+{/* vale messaging.protocol-products = YES */}
+
+<Resources
+  title="Integrate MCP with your services"
+  desktopColumnsCount={2}
+  variant="doc"
+  resources={[
+    {
+      title: "Databases",
+      description: "Connect Teleport databases over MCP",
+      href: "../../connect-your-client/model-context-protocol/database-access/",
+      iconComponent: databaseSvg,
+    },
+    {
+      title: "Kubernetes Clusters",
+      description: "Connect Teleport Kubernetes Clusters over MCP",
+      href: "../../connect-your-client/model-context-protocol/kube-access/",
+      iconComponent: kubernetesSvg,
+    },
+    {
+      title: "GitHub",
+      description: "Connect GitHub over MCP",
+      href: "./integration-guides/github/",
+      iconComponent: githubSvg,
+    },
+    {
+      title: "Grafana",
+      description: "Connect Grafana over MCP",
+      href: "./integration-guides/grafana/",
+      iconComponent: grafanaSvg,
+    },
+    {
+      title: "Hashicorp Vault",
+      description: "Connect Hashicorp Vault over MCP",
+      href: "./integration-guides/vault/",
+      iconComponent: vaultSvg,
+    },
+    {
+      title: "Notion",
+      description: "Connect Notion over MCP",
+      href: "./integration-guides/notion/",
+      iconComponent: notionSvg,
+    },
+  ]}
+/>
diff --git a/docs/pages/enroll-resources/mcp-access/rbac.mdx b/docs/pages/enroll-resources/mcp-access/rbac.mdx
new file mode 100644
index 0000000000000..e5b660a7c1b8c
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/rbac.mdx
@@ -0,0 +1,118 @@
+---
+title: MCP Access Controls
+sidebar_label: Access Controls
+sidebar_position: 2
+description: Role-based access control (RBAC) for Teleport MCP access.
+tags:
+- conceptual
+- mcp
+- zero-trust
+---
+
+You can use Teleport's role-based access control (RBAC) system to set up
+granular permissions for authenticating to MCP servers connected to Teleport.
+
+## Role configuration
+
+Teleport's `role` resource provides the following options for controlling MCP
+access:
+```yaml
+kind: role
+version: v8
+metadata:
+  name: mcp-developer
+spec:
+  allow:
+    # app_labels: a user with this role will be allowed to connect to
+    # MCP servers with labels matching below.
+    app_labels:
+      "env": "dev"
+
+    # app_labels_expression: optional field which has the same purpose of the
+    # matching app_labels fields, but support predicate expressions instead of
+    # label matchers.
+    app_labels_expression: 'labels["env"] == "staging"'
+
+    # mcp: defines MCP servers related permissions.
+    mcp:
+      # tools: list of tools allowed for this role.
+      #
+      # No tools are allowed if not specified.
+      # Each entry can be a literal string, a glob pattern, or a regular
+      # expression (must start with '^' and end with '$'). A wildcard '*' allows
+      # all tools.
+      # This value field also supports variable interpolation.
+      tools:
+      - search-files
+      - slack_*
+      - ^(get|list|read).*$
+      - "{{internal.mcp_tools}}"
+      - "{{external.mcp_tools}}"
+
+  deny:
+    mcp:
+      # tools: list of tools denied for this role.
+      tools:
+      - slack_post_message
+```
+
+<Admonition
+  type="note"
+  title="Deny Rules"
+>
+  Deny rules will match greedily. In the example above, `slack_post_message` is
+  denied even `role.allow.mcp.tools` matches it.
+</Admonition>
+
+## Template variables
+
+Similar to other role fields, `app_labels` and `mcp` fields support templating
+variables.
+
+The `external.xyz` traits are replaced with values from external [single
+sign-on](../../zero-trust-access/sso/sso.mdx) providers. For OIDC,
+they will be replaced with the value of an "xyz" claim. For SAML, they are
+replaced with an "xyz" assertion value.
+
+For full details on how traits work in Teleport roles, see the [Access Controls
+Reference](../../reference/access-controls/roles.mdx).
+
+For example, here is what a role may look like if you want to assign allowed
+tools from the user's Okta `mcp_tools` assertion:
+
+```yaml
+spec:
+  allow:
+    mcp:
+      tools:
+      - "{{external.mcp_tools}}"
+```
+
+The `{{internal.mcp_tools}}` variables permit sharing allowed MCP tools with
+remote clusters. They will be replaced with the respective properties of a
+remote user connecting from a root cluster.
+
+For example, suppose a user in the root cluster has the following role:
+
+```yaml
+spec:
+  allow:
+    mcp:
+      tools:
+      - "slack_*"
+```
+
+The role on the leaf cluster can be set up to use the same tools allowed from
+the root cluster:
+
+```yaml
+spec:
+  allow:
+    mcp:
+      tools:
+      - "{{internal.mcp_tools}}"
+```
+
+For full details on how variable expansion works in Teleport roles, see the
+[Access Controls
+Reference](../../reference/access-controls/roles.mdx).
diff --git a/docs/pages/enroll-resources/mcp-access/reference.mdx b/docs/pages/enroll-resources/mcp-access/reference.mdx
new file mode 100644
index 0000000000000..8f3c28f5ff1f2
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/reference.mdx
@@ -0,0 +1,203 @@
+---
+title: MCP Access Reference
+sidebar_label: Reference
+description: Configuration and CLI reference for Teleport MCP access.
+sidebar_position: 8
+tags:
+- reference
+- zero-trust
+- mcp
+---
+
+This guide describes interfaces and options for interacting with the Teleport
+Application Service for MCP access, including the static configuration file for
+the `teleport` binary, and `tsh mcp` commands.
+
+## Configuration
+
+(!docs/pages/includes/backup-warning.mdx!)
+
+The following snippet shows the full YAML configuration of an Application Service
+appearing in the `teleport.yaml` configuration file:
+
+```yaml
+app_service:
+  # Enables application proxy service.
+  enabled: true
+  # Enables the builtin Teleport demo MCP server that shows current user and
+  # session information. To access it, this MCP server uses the app label
+  # "teleport.internal/resource-type" with the value "demo".
+  mcp_demo_server: true
+  # This section contains definitions of all applications proxied by this
+  # service. It can contain multiple items.
+  apps:
+  # Name of the application. Used for identification purposes.
+  - name: "mcp-everything"
+    # Endpoint URI of the target MCP server.
+    # Use "mcp+http://" and "mcp+https://" as scheme for streamable HTTP MCP servers.
+    # Use "mcp+sse+http://" and "mcp+sse+https://" as scheme for SSE MCP servers.
+    # Leave it empty or use "mcp+stdio://" for stdio MCP servers.
+    uri: "mcp+http://localhost:12345/mcp"
+    # Free-form application description.
+    description: "Example Everything MCP server"
+    # Static labels to assign to the app. Used in RBAC.
+    labels:
+      env: "prod"
+
+    # Contains MCP server-related configurations.
+    mcp:
+      # Command to launch stdio-based MCP servers.
+      command: "docker"
+      # Args to execute with the command.
+      args: ["run", "-i", "--rm", "mcp/everything"]
+      # Name of the host user account under which the command will be
+      # executed. Required for stdio-based MCP servers.
+      run_as_host_user: "docker"
+
+    # Disable TLS validation for SSE and streamable HTTP MCP servers.
+    insecure_skip_verify: true
+    # Rewrites section for SSE and streamable HTTP MCP servers.
+    rewrite:
+      # Specify whether to include roles or traits in the JWT.
+      # Options:
+      # - roles-and-traits: include both roles and traits
+      # - roles: include only roles
+      # - traits: include only traits
+      # - none: exclude both roles and traits from the JWT token
+      # Default: roles-and-traits
+      jwt_claims: roles-and-traits
+      # Headers passthrough configuration.
+      headers:
+      - "Authorization: Bearer {{internal.jwt}}"
+      - "X-Custom-Header: example"
+      - "X-External-Trait: {{external.env}}"
+```
+
+## Resource
+
+The MCP server resources are registered as `app` resources in the Teleport
+backend. Here is the spec of MCP server resources managed by `tctl` resource
+command:
+
+```yaml
+kind: app
+version: v3
+metadata:
+  # MCP server name
+  name: everything
+  # MCP server description.
+  description: The Everything MCP server
+  # MCP server labels.
+  labels:
+    env: local
+spec:
+  # Endpoint URI of the target MCP server.
+  # Use "mcp+http://" and "mcp+https://" as scheme for streamable HTTP MCP servers.
+  # Use "mcp+sse+http://" and "mcp+sse+https://" as scheme for SSE MCP servers.
+  # Leave it empty or use "mcp+stdio://" for stdio MCP servers.
+  uri: "mcp+http://localhost:12345/mcp"
+
+  mcp:
+    # Command to launch stdio-based MCP servers.
+    command: "docker"
+    # Args to execute with the command.
+    args: ["run", "-i", "--rm", "mcp/everything"]
+    # Name of the host user account under which the command will be
+    # executed. Required for stdio-based MCP servers.
+    run_as_host_user: "docker"
+
+  # Disable TLS validation for SSE and streamable HTTP MCP servers.
+  insecure_skip_verify: true
+  # Rewrites section for SSE and streamable HTTP MCP servers.
+  rewrite:
+    # Specify whether to include roles or traits in the JWT.
+    # Options:
+    # - roles-and-traits: include both roles and traits
+    # - roles: include only roles
+    # - traits: include only traits
+    # - none: exclude both roles and traits from the JWT token
+    # Default: roles-and-traits
+    jwt_claims: roles-and-traits
+    # Headers passthrough configuration.
+    headers:
+    - "Authorization: Bearer {{internal.jwt}}"
+    - "X-Custom-Header: example"
+    - "X-External-Trait: {{external.env}}"
+```
+
+## CLI
+
+This section shows CLI commands relevant for MCP access.
+
+### tsh mcp ls
+
+Lists available MCP servers.
+
+```code
+# List all MCP servers.
+$ tsh mcp ls
+# Search MCP servers with keywords.
+$ tsh mcp ls --search foo,bar
+# Filter MCP servers with labels.
+$ tsh mcp ls key1=value1,key2=value2
+# Get MCP server names using "jq".
+$ tsh mcp ls --format json  | jq -r '.[].metadata.name'
+```
+
+| Flag | Description |
+| - | - |
+| `--search` | List of comma separated search keywords or phrases enclosed in quotations (e.g. `--search=foo,bar,"some phrase"`). |
+| `--query`  | Query by predicate language enclosed in single quotes. (e.g. `--query='labels["key1"] == "value1" && labels["key2"] != "value2"')`. |
+| `--format` | Format output (`text`, `json`, `yaml`). |
+
+### tsh mcp config
+
+Print client configuration details or update the configuration directly.
+
+```code
+# Print sample configuration for a MCP server app
+$ tsh mcp config my-mcp-server-app
+# Print sample configuration for a streamable HTTP MCP server with custom headers
+$ tsh mcp config my-mcp-server-app -H "Header1: value1" -H "Header2: value2"
+# Add all MCP servers to Claude Desktop
+$ tsh mcp config --all --client-config=claude
+# Search MCP servers with labels and add to the specified JSON file
+$ tsh mcp config --labels env=dev --client-config=my-config.json`
+```
+
+| Flag | Description |
+| - | - |
+| `--all` | Select all MCP servers. Mutually exclusive with `--labels` or `--query`.|
+| `--labels`  | List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).|
+| `--query`  | Query by predicate language enclosed in single quotes. (e.g. `--query='labels["key1"] == "value1" && labels["key2"] != "value2"')`. |
+| `--client-config` | If specified, update the specified client config. `claude` for default Claude Desktop config, or specify a JSON file path. Can also be set with environment variable `TELEPORT_MCP_CLIENT_CONFIG`.",
+| `--json-format` |	Format the JSON file (`pretty`, `compact`, `auto`, `none`). `auto` saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable `TELEPORT_MCP_CONFIG_JSON_FORMAT`. Default is `auto`.",
+| `-H`, `--header` | Extra custom headers used for streamable HTTP MCP servers.|
+
+### tsh mcp connect
+
+Used by AI tools such as Claude Desktop to connect to an MCP server via
+Teleport.
+
+<Admonition type="tip">
+`tsh mcp config` can print sample configuration or update your AI tools
+directly. This eliminates the need to manually construct the tsh mcp connect
+command.
+</Admonition>
+
+```code
+$ tsh mcp connect mcp-everything
+```
+
+`tsh` debug logs are enabled by default and can be disabled by the environment
+variable `TELEPORT_DEBUG=false`. You can also specify the `--no-debug` flag when
+generating sample configurations with `tsh mcp config`.
+
+### tsh proxy mcp
+
+Starts a local proxy for MCP connections. Only supported for target MCP servers
+with streamable HTTP transport.
+
+```code
+$ tsh proxy mcp my-streamable-http-mcp-server
+```
diff --git a/docs/pages/enroll-resources/mcp-access/troubleshooting.mdx b/docs/pages/enroll-resources/mcp-access/troubleshooting.mdx
new file mode 100644
index 0000000000000..8f2ade4a59035
--- /dev/null
+++ b/docs/pages/enroll-resources/mcp-access/troubleshooting.mdx
@@ -0,0 +1,99 @@
+---
+title: Troubleshooting MCP Access
+sidebar_label: Troubleshooting
+sidebar_position: 7
+description: Describes common issues and solutions for access to MCP servers protected by Teleport.
+tags:
+- conceptual
+- zero-trust
+- mcp
+---
+
+This section describes common issues that you might encounter in managing access
+to MCP servers with Teleport and how to work around or resolve them.
+
+## Disabled MCP server or tools missing from the MCP server
+
+By default, no MCP tools are allowed by your Teleport roles. You can check if
+any tool is allowed by running `tsh mcp ls`:
+
+```code
+$ tsh mcp ls
+Name              Description                                        Type  Allowed Tools Labels
+----------------- -------------------------------------------------- ----- ------------- ------
+teleport-mcp-demo A demo MCP server that shows current user and s... stdio (none) [!]
+
+[!] Warning: you do not have access to any tools on the MCP server.
+Please contact your Teleport administrator to ensure your Teleport role has
+appropriate 'allow.mcp.tools' set. For details on MCP access RBAC, see:
+https://goteleport.com/docs/enroll-resources/mcp-access/rbac/
+```
+
+If a user is assigned the `access` preset role, by default the available MCP
+tools are controlled by the `{{internal.mcp_tools}}` source in the role
+definition. This value can be populated through user traits:
+
+```yaml
+kind: role
+metadata:
+  name: access
+spec:
+  allow:
+    mcp:
+      tools:
+      - "{{internal.mcp_tools}}"
+```
+
+You can configure this user trait with `tctl`, assigning it to the Teleport user
+<Var name="my_user" />:
+
+```code
+$ tctl users update <Var name="my_user" /> --set-mcp-tools "*"
+```
+
+Alternatively you can assign your Teleport user the preset role `mcp-user` which
+allows access to all MCP servers and their tools. You can also define a custom
+role that explicitly specifies the allowed MCP tools and assigns them to your
+Teleport user. See [RBAC](./rbac.mdx) for more details.
+
+## Server disconnected when starting the MCP server
+
+You may encounter a "Server disconnected" error or similar errors when your MCP
+client starts the MCP server.
+
+![Server disconnected error](../../../img/mcp-access/troubleshoot-server-disconnected.png)
+
+First, make sure your client configuration is correct and your `tsh` session is
+active. See [connect MCP
+clients](../../connect-your-client/model-context-protocol/mcp-access.mdx) for
+more details.
+
+If the problem persists, follow your MCP client's specific guideline to find the
+debug logs of the MCP server execution.
+
+If you encounter a "Lost server connection" error in the debug log, or the `tsh`
+command exits immediately, it usually indicates that the command used to launch
+the stdio MCP server on the Teleport Application Service instance has failed to
+execute properly.
+
+To confirm this, check the Application Service logs for any warnings that
+indicate a failure to start the MCP server process — commonly an
+`exec.ExitError`, but it may also include other related execution or runtime
+errors. These typically appear shortly after the client connection is
+established:
+```
+WARN [APP:SERVICE] Failed to handle client connection. error:[
+ERROR REPORT:
+Original Error: *exec.ExitError exit status 1
+```
+
+To fix the issue, ensure that the Teleport app definition used to start the MCP
+server is configured correctly. You can test it by manually running the
+`app.mcp.command` and `app.mcp.args` directly on the host where the Teleport
+Application Service is running — without using Teleport. Also, make sure the
+host user set for `mcp.run_as_host_user` exists on the host  and has the
+necessary permissions to execute the configured command.
+
+## `tsh` path errors in your MCP clients
+
+(!docs/pages/includes/mcp-access/troubleshoot-tsh-binary-enoent.mdx!)
diff --git a/docs/pages/enroll-resources/server-access/getting-started.mdx b/docs/pages/enroll-resources/server-access/getting-started.mdx
index 8ac9c99c92f9f..289486a6c819e 100644
--- a/docs/pages/enroll-resources/server-access/getting-started.mdx
+++ b/docs/pages/enroll-resources/server-access/getting-started.mdx
@@ -1,7 +1,12 @@
 ---
 title: Server Access Getting Started Guide
+sidebar_label: Getting Started
 description: Getting started with Teleport server access.
 videoBanner: LnaRP0xKWRI
+tags:
+ - get-started
+ - zero-trust
+ - infrastructure-identity
 ---
 
 You can protect a server with Teleport by running the Teleport SSH Service on
@@ -30,14 +35,12 @@ per the instructions in this guide. Do not run the SSH Service as a Kubernetes
 pod, as there is no guarantee that the SSH Service pod is running on a server
 that a user intends to access.
 
-![Teleport Bastion](../../../img/server-access/getting-started-diagram.png)
-
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
-- One host running a Linux environment (such as Ubuntu 20.04, CentOS 8.0, or
-  Debian 10). This will serve as a Teleport Node.
+- One host running a Linux environment (such as Amazon Linux, Ubuntu, CentOS Stream, or
+  Debian). This will serve as a Teleport Node.
 - (!docs/pages/includes/tctl.mdx!)
 
 (!docs/pages/includes/permission-warning.mdx!)
@@ -370,9 +373,9 @@ further Getting Started exercises.
 - While this guide shows you how to create a local user in order to access a
   server, you can also enable Teleport users to authenticate through a single
   sign-on provider. Read the
-  [documentation](../../admin-guides/access-controls/sso/sso.mdx) to learn more.
+  [documentation](../../zero-trust-access/sso/sso.mdx) to learn more.
 - Learn more about Teleport `tsh` through the [reference documentation](../../reference/cli/tsh.mdx#tsh-ssh).
-- For a complete list of ports used by Teleport, read the [Networking Guide](../../reference/networking.mdx).
+- For a complete list of ports used by Teleport, read the [Networking Guide](../../reference/deployment/networking.mdx).
 
 ## Resources
 
@@ -380,5 +383,5 @@ further Getting Started exercises.
 - [Announcing Teleport SSH Server](https://goteleport.com/blog/announcing-teleport-ssh-server/)
 - [How to SSH properly](https://goteleport.com/blog/how-to-ssh-properly/)
 - Consider whether [OpenSSH or Teleport SSH](https://goteleport.com/blog/openssh-vs-teleport/) is right for you.
-- [Labels](../../admin-guides/management/admin/labels.mdx)
+- [Labels](../../zero-trust-access/rbac-get-started/labels.mdx)
 
diff --git a/docs/pages/enroll-resources/server-access/guides/ansible.mdx b/docs/pages/enroll-resources/server-access/guides/ansible.mdx
deleted file mode 100644
index 7f117b73a9722..0000000000000
--- a/docs/pages/enroll-resources/server-access/guides/ansible.mdx
+++ /dev/null
@@ -1,159 +0,0 @@
----
-title: Ansible
-description: Using Teleport with Ansible
----
-
-Ansible uses the OpenSSH client by default. Teleport supports SSH protocol and
-works as SSH jumphost.
-
-In this guide we will configure OpenSSH client to work with Teleport Proxy
-and run a sample ansible playbook.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- `ssh` openssh tool
-- `ansible` >= (=ansible.min_version=)
-- Optional tool `jq` to process `JSON` output.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Login and configure SSH
-
-Log into Teleport with `tsh`:
-
-```code
-$ tsh login --proxy=<Var name="teleport.example.com" />
-```
-
-Generate `openssh` configuration using `tsh config` shortcut:
-
-```code
-$ tsh config > ssh.cfg
-```
-
-<Admonition type="tip">
-You can edit matching patterns used in `ssh.cfg` if something
-is not working out of the box.
-</Admonition>
-
-## Step 2/3. Configure Ansible
-
-Create a folder `ansible` where we will collect all generated files:
-
-```code
-$ mkdir -p ansible
-# Copy the openssh configuration from the previous step to the ansible dir
-$ cp ssh.cfg ansible/
-$ cd ansible
-```
-
-Create a file `ansible.cfg`:
-
-```
-[defaults]
-host_key_checking = True
-inventory=./hosts
-remote_tmp=/tmp
-
-[ssh_connection]
-scp_if_ssh = True
-ssh_args = -F ./ssh.cfg
-```
-
-You can create an inventory file `hosts` manually or use a script below to generate it from your environment. Set your
-cluster name (e.g. `teleport.example.com` or in the form `mytenant.teleport.sh` for Teleport Enterprise Cloud)
-and this script will generate the host names to match the `openssh` configuration:
-
-```code
-$ tsh ls --format=json | jq '.[].spec.hostname + ".<Var name="teleport.example.com" />"' > hosts
-```
-
-## Step 3/3. Run a playbook
-
-Finally, let's create a simple ansible playbook `playbook.yaml`.
-
-The playbook below runs `hostname` on all hosts. Make sure to set the `remote_user` parameter
-to a valid SSH username that works with the target host and is allowed by Teleport:
-
-```yaml
-- hosts: all
-  remote_user: ubuntu
-  tasks:
-    - name: "hostname"
-      command: "hostname"
-```
-
-From the folder `ansible`, run the ansible playbook:
-
-```code
-$ ansible-playbook playbook.yaml
-
-# PLAY [all] *****************************************************************************************************************************************
-# TASK [Gathering Facts] *****************************************************************************************************************************
-#
-# ok: [terminal]
-#
-# TASK [hostname] ************************************************************************************************************************************
-# changed: [terminal]
-#
-# PLAY RECAP *****************************************************************************************************************************************
-# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-```
-
-You are all set. You are now using short-lived SSH certificates and Teleport can now record
-all ansible commands in the audit log.
-
-## Troubleshooting
-
-In cases where Ansible cannot connect, you may see an error like this:
-
-```txt
-example.host | UNREACHABLE! => {
-    "changed": false,
-    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname example.host: Name or service not known",
-    "unreachable": true
-}
-```
-
-You can examine and tweak patterns matching the inventory hosts in `ssh.cfg`.
-
-Try the SSH connection using `ssh.cfg` with verbose mode to inspect the error:
-
-```code
-$ ssh -vvv -F ./ssh.cfg root@example.host
-```
-
-If `ssh` works, try running the playbook with verbose mode on:
-
-```code
-$ ansible-playbook -vvvv playbook.yaml
-```
-
-If your hostnames contain uppercase characters (like `MYHOSTNAME`), please note that Teleport's internal hostname matching
-is case sensitive by default, which can also lead to seeing this error.
-
-If this is the case, you can work around this by enabling case-insensitive routing at the cluster level.
-
-<Tabs>
-<TabItem label="Self-hosted Teleport">
-
-Edit your `/etc/teleport.yaml` config file on all servers running the Teleport `auth_service`, then restart Teleport on each.
-
-```yaml
-auth_service:
-  case_insensitive_routing: true
-```
-
-</TabItem>
-<TabItem label="Managed Teleport Enterprise/Cloud">
-
-Run `tctl edit cluster_networking_config` to add the following specification, then save and exit.
-
-```yaml
-spec:
-  case_insensitive_routing: true
-```
-
-</TabItem>
-</Tabs>
diff --git a/docs/pages/enroll-resources/server-access/guides/auditd.mdx b/docs/pages/enroll-resources/server-access/guides/auditd.mdx
index e2a375f276f59..97da1e682d6d4 100644
--- a/docs/pages/enroll-resources/server-access/guides/auditd.mdx
+++ b/docs/pages/enroll-resources/server-access/guides/auditd.mdx
@@ -1,9 +1,15 @@
 ---
 title: Configure SSH with the Linux Auditing System
+sidebar_label: Linux Auditing System
 description: How to configure Teleport SSH with auditd (Linux Auditing System).
-h1: Linux Auditing System (auditd)
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 You can configure Teleport's SSH Service to integrate with the Linux Auditing System (auditd).
 
 ## Prerequisites
diff --git a/docs/pages/enroll-resources/server-access/guides/bpf-session-recording.mdx b/docs/pages/enroll-resources/server-access/guides/bpf-session-recording.mdx
index 97b9cb59c8dbb..5b68fc58eda0b 100644
--- a/docs/pages/enroll-resources/server-access/guides/bpf-session-recording.mdx
+++ b/docs/pages/enroll-resources/server-access/guides/bpf-session-recording.mdx
@@ -1,10 +1,16 @@
 ---
 title: Enhanced Session Recording for SSH with BPF
 description: How to record your SSH session commands using BPF.
-h1: Enhanced Session Recording with BPF
 videoBanner: 8uO5H-iYw5A
+tags:
+ - session-recording
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 This guide explains Enhanced Session Recording for SSH with BPF and how to set
 it up in your Teleport cluster.
 
@@ -44,7 +50,7 @@ session). Also, a local user with both monitored and unmonitored console
 sessions or ptrace privileges may not be fully captured in recordings.
 
 Commands executed via daemons (systemd, crond, atd, etc.) could be outside of
-the recorded session scope. Proper network-based restrictions for ingress
+the recorded session scope. Proper network-based restrictions for egress
 traffic must also be implemented to prevent possible unauthorized data transfer.
 
 Additionally, certain forensic information such as full binary paths
@@ -402,4 +408,4 @@ ends will also include the `"enhanced_recording": true` field, similar to the fo
 - Read more about
   [session recording](../../../reference/architecture/session-recording.mdx).
 - See all configuration options for Enhanced Session Recording in our
-  [Configuration Reference](../../../reference/config.mdx).
+  [Configuration Reference](../../../reference/deployment/config.mdx).
diff --git a/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/encrypted-session-recordings.mdx b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/encrypted-session-recordings.mdx
new file mode 100644
index 0000000000000..ab676aaf05984
--- /dev/null
+++ b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/encrypted-session-recordings.mdx
@@ -0,0 +1,160 @@
+---
+title: Encrypted Session Recordings
+description: How to enable encrypted session recordings using your CA key backend.
+tags:
+ - session-recording
+ - how-to
+ - zero-trust
+ - resiliency
+---
+
+Encrypted session recordings allow Teleport users to enable at-rest encryption
+of their session recording data. This guide explains how to setup encrypted
+session recordings.
+
+## How it works
+
+When encrypted recordings are enabled, Teleport will encrypt session recording
+data before saving it to disk or long-term storage. Encryption keys are
+provisioned using the same key storage backend configured for CAs defined by
+the `ca_key_params` section of the Teleport Auth Service configuration file. In
+`node-sync` and `proxy-sync` session recording modes, session recording events
+are sent directly to the Teleport Auth Service where they are encrypted prior
+to being written to long term storage. In `node` and `proxy` session recording
+modes, session recording events are encrypted locally at the Teleport-protected
+server or Proxy Service instance before being written to disk for future upload
+to the Auth Service.
+
+Decryption of session recordings for replay is always facilitated by the
+Teleport Auth Service regardless of the session recording mode. This means
+replays can be viewed using the Teleport Web UI, or by using `tsh play`
+with a valid session ID. Replaying session recording files directly using
+`tsh play` is not possible for encrypted files.
+
+## Step 1/2. Configure Teleport
+
+In this section, you will configure Teleport to encrypt session recordings
+using the configured key storage backend.
+
+### Enable recording encryption
+
+Encrypted session recordings can be enabled through the Teleport Auth
+Service configuration file.
+
+You can edit the Auth Service configuration file as follows:
+
+```yaml
+# snippet from teleport.yaml
+auth_service:
+  session_recording_config:
+    encryption:
+      enabled: yes
+```
+
+### Optional step: Configure key storage backend
+
+Session recording encryption keys are provisioned using the same key storage
+backend configured for CAs. Software keys stored in Teleport's backend storage
+are the default, but other backends can also be configured:
+
+- [AWS KMS](../../../../zero-trust-access/deploy-a-cluster/private-keys/aws-kms.mdx)
+- [Google Cloud KMS](../../../../zero-trust-access/deploy-a-cluster/private-keys/gcp-kms.mdx)
+- [HSM](../../../../zero-trust-access/deploy-a-cluster/hsm.mdx)
+
+If your cluster is already configured to use any of these backends, you should
+ensure Teleport has permission to use their decryption functions. For example,
+the AWS KMS backend will require adding the `kms:Decrypt` action to Teleport's
+role policy.
+
+It is required that all Teleport Auth Service instances have access to the
+exact same encryption keys in order to ensure all recorded sessions are always
+replayable. This means shared access to keys in AWS KMS and GCP KMS backends,
+or a shared, networked HSM for PKCS#11 backends.
+
+<Admonition type="note">
+Before enabling encrypted recordings with an HSM backend, make sure OAEP
+decryption is permitted for generated keys. For YubiHSM2, the authkey used
+should have `decrypt-oaep` included in both its capabilities and delegated
+capabilities. For other PKCS#11 HSMs, the `CKM_DECRYPT` mechanism must be
+enabled.
+</Admonition>
+
+## Step 2/2. Confirm new recordings are encrypted
+
+It is possible to confirm that session recordings are now encrypted by
+capturing a new recording and downloading the resulting `.tar` file from your
+[audit sessions backend](../../../../reference/architecture/session-recording.mdx#storage).
+Replaying the session file directly with `tsh play` should fail and replaying
+using the session ID should succeed.
+
+## Manual Encryption Key Management
+
+Encrypted session recordings require at least one active key which will be used
+during encryption at recording time and decryption at replay time. Once an
+active key has been rotated, meaning it is no longer used during encryption, it
+should become a rotated key. Rotated keys can only be used for decryption
+during replay in order to maintain access to historical recordings.
+
+By default, Teleport will automatically provision and manage these keys.
+However there may be cases where automatic management is not possible or
+desired, such as environments where Teleport lacks sufficient privileges to
+manage keys directly. For this reason, Teleport can be configured to use
+externally managed keys.
+
+Manual encryption key management enables explicit configuration of active
+and rotated keys by defining what type of key storage backend they are found in
+and the labels identifying the specific keys to be used.
+
+<Admonition type="warning">
+Manual encryption key management places all responsibility and complexity of
+managing keys on the administrator. This comes with much more risk of a
+misconfiguration impacting Teleport's ability to record or replay sessions.
+It's for this reason that Teleport Cloud does not allow use of manual
+encryption key management. Consider using the default automatic key management
+unless your usage explicitly requires manual key management.
+</Admonition>
+
+### Configuration
+
+This example enables `manual_key_management` with one active key and one
+rotated key configured. Both expect a PKCS#11 compliant HSM as the key storage
+backend and each have their own label used to identify the keys within the HSM.
+
+```yaml
+encryption:
+  enabled: yes
+  manual_key_management:
+    enabled: yes
+    active_keys:
+      - type: pkcs11
+        label: 'session_recordings_002'
+    rotated_keys:
+      - type: pkcs11
+        label: 'session_recordings_001'
+```
+
+Teleport will search the HSM for the keys described in both `active_keys` and
+`rotated_keys`. The active keys will be used during encryption and replay of
+any new session recordings. The rotated keys will be used during replay of
+historical session recordings, but will not be used during any encryption
+operations. For PKCS#11 backends it is required that keys also have an ID
+assigned in addition to the label used during key lookup. The ID is not
+included in the `manual_key_management` configuration, but the private and
+public keys for a single pair must be assigned the same ID.
+
+As mentioned previously, it is important that all Teleport Auth Service
+instances have access to the same keys. Degraded availability of replays should
+be expected if unshared keys are used.
+
+<Admonition type="warning">
+Session recording encryption relies on a form of envelope encryption using OAEP
+with 4096-bit RSA key pairs. This means RSA 4096 is the only key type eligible
+for use with `manual_key_management`. It is also important that these keys are
+permitted to be used for decryption. What this means varies per key storage
+backend, but generally must be defined when the key is first provisioned.
+</Admonition>
+
+## Related reading
+
+- [Rotating Session Recording Encryption Keys](./rotating-keys.mdx)
+- [Rotating Manual Session Recording Encryption Keys](./rotating-manual-keys.mdx)
diff --git a/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-keys.mdx b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-keys.mdx
new file mode 100644
index 0000000000000..0c616a8eeb684
--- /dev/null
+++ b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-keys.mdx
@@ -0,0 +1,87 @@
+---
+title: Rotating Session Recording Encryption Keys
+sidebar_label: Key Rotation (Automatic)
+description: How to rotate automatically provisioned session recording encryption keys.
+tags:
+  - session-recording
+  - how-to
+  - zero-trust
+  - resiliency
+---
+
+This guide explains how to rotate encryption keys for session recordings using
+the automatic method. In this approach, the Teleport Auth Service manages the
+selection and labeling of encryption keys for you.
+
+For instructions on manually rotating encryption keys for session recordings,
+see [Rotating Manual Session Recording Encryption
+Keys](rotating-manual-keys.mdx).
+
+## How it works
+
+Session recording encryption keys are rotated using `tctl`. Rotation is a
+two-phase process that requires initiating a rotation and then completing that
+rotation. It is also possible to roll back an in-progress rotation in the event
+that the previous key state needs to be restored.
+
+## Prerequisites
+
+This guide assumes that you have followed the setup instructions in [Encrypted
+Session Recordings](encrypted-session-recordings.mdx).
+
+## Step 1/3. Initiate a rotation
+
+First a rotation must be initiated. This will provision a new key and add
+it to the list of active keys, which means newly captured recordings will be
+replayable using both the original key and the new key. This is done with:
+
+```code
+$ tctl recordings encryption rotate
+```
+
+If a rotation is already in progress, then the `rotate` subcommand will result
+in an error.
+
+## Step 2/3. Confirm rotation is in progress
+
+Printing the status of the active encryption keys informs whether or not a
+rotation is in progress. It also shows which key will be rotating out.
+
+```code
+$ tctl recordings encryption status
+Rotation in progress
+Key Pair Fingerprint                                             State
+---------------------------------------------------------------- --------
+48303729235b962c69940fe4cc9d47fcd6f5dd3bcbd149a6d4944098ce01b84c rotating
+8a8581543c70cd2ed5e993080670aefec2c620ef792730f020cb463350adeccb active
+```
+
+It is also possible for a key to be in an `inaccessible` state, which means at
+least one Teleport Auth Service instance does not have access to the key. In
+this case the rotation should be rolled back and the Teleport Auth Service
+instances should be diagnosed for connection or permission issues while
+accessing the key backend. For example, this could be the result of an
+improperly configured security group or IAM role when using the AWS KMS key
+backend.
+
+## Step 3/3. Complete rotation
+
+Completing a key rotation will retain the rotated key for future replay of
+historical session recordings. All recordings captured after completion will
+only be replayable using the new key. You can complete the rotation with:
+
+```code
+$ tctl recordings encryption complete-rotation
+```
+
+If any key is in an `inaccessible` state, then attempting to complete the
+rotation will result in an error.
+
+### Rollback
+
+If an in progress rotation needs to be rolled back for any reason it can be
+reverted to the previous state using:
+
+```code
+$ tctl recordings encryption rollback-rotation
+```
diff --git a/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-manual-keys.mdx b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-manual-keys.mdx
new file mode 100644
index 0000000000000..f4a7d4a517ca2
--- /dev/null
+++ b/docs/pages/enroll-resources/server-access/guides/encrypted-session-recordings/rotating-manual-keys.mdx
@@ -0,0 +1,95 @@
+---
+title: Rotating Manual Session Recording Encryption Keys
+sidebar_label: Key Rotation (Manual)
+description: How to rotate private keys for encrypted session recordings while designating certain keys only for decryption.
+tags:
+  - session-recording
+  - how-to
+  - zero-trust
+  - resiliency
+---
+
+This guide explains how to rotate encryption keys for session recordings.
+
+For instructions on using the automatic approach, see [Rotating Session
+Recording Encryption Keys](rotating-keys.mdx).
+
+## How it works
+
+In the manual approach to session recording key management, a user provides the
+Auth Service with the types and labels of keys used to encrypt Teleport session
+recordings. In this way, the user has control over the keys the Auth Service
+uses to encrypt session recordings, as well as rotated keys that the Auth
+Service no longer uses for encryption, but that are available for decrypting
+stored session recordings.
+
+## Prerequisites
+
+This guide assumes that you have followed the setup instructions in [Encrypted
+Session Recordings](encrypted-session-recordings.mdx).
+
+Although Manual Key Management leaves key rotation entirely up to the
+administrator, the `manual_key_management` configuration can be leveraged to help facilitate rotations.
+
+As an example, we will assume an existing Teleport Auth Service configured to
+use a PKCS#11 compatible HSM with an active key identified by the label
+`session_recording_001`:
+
+<Admonition type="note">
+All configuration examples are reduced to the `encryption` configuration block
+for brevity since the available options are identical between the Teleport Auth
+Service configuration file and the dynamic `session_recording_config` resource.
+</Admonition>
+
+```yaml
+encryption:
+  enabled: yes
+  manual_key_management:
+    enabled: yes
+    active_keys:
+      - type: pkcs11
+        label: 'session_recordings_001'
+```
+
+## Step 1/2. Add the new key
+
+A new key can be added to the the list of active keys:
+
+```yaml
+encryption:
+  enabled: yes
+  manual_key_management:
+    enabled: yes
+    active_keys:
+      - type: pkcs11
+        label: 'session_recordings_002'
+      - type: pkcs11
+        label: 'session_recordings_001'
+```
+
+This configuration expects a second key to be accessible using the
+`session_recordings_002` label. Teleport maintains a cache of references to
+accessible keys that is periodically updated, but it is best practice to ensure
+the key exists prior to updating the `manual_key_management` configuration.
+
+## Step 2/2. Rotate the old key
+
+The old key can be moved out of the active set of encryption keys and into the
+set of rotated keys:
+
+```yaml
+encryption:
+  enabled: yes
+  manual_key_management:
+    enabled: yes
+    active_keys:
+      - type: pkcs11
+        label: 'session_recordings_002'
+    rotated_keys:
+      - type: pkcs11
+        label: 'session_recordings_001'
+```
+
+All new recordings will now be encrypted using the key labeled by
+`session_recordings_002`, and historical recordings encrypted using
+`session_recordings_001` will remain replayable.
diff --git a/docs/pages/enroll-resources/server-access/guides/guides.mdx b/docs/pages/enroll-resources/server-access/guides/guides.mdx
index c7ba23b463bf7..0578cb863dafd 100644
--- a/docs/pages/enroll-resources/server-access/guides/guides.mdx
+++ b/docs/pages/enroll-resources/server-access/guides/guides.mdx
@@ -1,18 +1,11 @@
 ---
-title: Server Access Guides
+title: Server Access Configuration Guides
+sidebar_label: Configuration Guides
 description: Teleport server access guides.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
-- [Using Teleport with PAM](ssh-pam.mdx): How to configure Teleport SSH with PAM (Pluggable Authentication Modules).
-- [Agentless OpenSSH Integration](../openssh/openssh-agentless.mdx): How to use Teleport in agentless mode on systems with OpenSSH and `sshd`.
-- [Agentless OpenSSH Integration (Manual Installation)](../openssh/openssh-manual-install.mdx): How to use Teleport in agentless mode
-  on systems with OpenSSH and `sshd` that can't run `teleport`.
-- [Recording Proxy Mode](recording-proxy-mode.mdx): How to use Teleport Recording Proxy Mode to capture activity on OpenSSH servers.
-- [BPF Session Recording](bpf-session-recording.mdx): How to use BPF to record SSH session commands, modified files and network connections.
-- [Visual Studio Code](vscode.mdx): How to remotely develop with Visual Studio Code and Teleport.
-- [JetBrains SFTP](jetbrains-sftp.mdx): How to use a JetBrains IDE to access SFTP with Teleport.
-- [Host User Creation](host-user-creation.mdx): How to configure Teleport to automatically create transient host users.
-- [Linux Auditing System](auditd.mdx): How to integrate Teleport with the Linux Auditing System (auditd).
-- [Using Teleport with Ansible](ansible.mdx): How to use Ansible with
-  Teleport-issued SSH credentials.
+<DocCardList />
diff --git a/docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx b/docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx
index e3a8e67f03f47..5fbc54666931e 100644
--- a/docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx
+++ b/docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx
@@ -1,6 +1,11 @@
 ---
 title: Configure Teleport to Create Host Users
+sidebar_label: Host User Creation
 description: How to configure Teleport to automatically create transient host users.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport's SSH Service can be configured to automatically create local Unix users
@@ -478,6 +483,6 @@ on the hosts.
 ## Next steps
 
 - Configure automatic user provisioning for [database access](../../database-access/auto-user-provisioning/auto-user-provisioning.mdx).
-- Configure automatic user provisioning for [desktop access](../../../reference/agent-services/desktop-access-reference/user-creation.mdx).
-- Configure automatic user provisioning with [Terraform](../../../reference/terraform-provider/resources/role.mdx).
+- Configure automatic user provisioning for [desktop access](../../desktop-access/reference/user-creation.mdx).
+- Configure automatic user provisioning with [Terraform](../../../reference/infrastructure-as-code/terraform-provider/resources/role.mdx).
 Note when using the terraform provider that some values may be different than described in this guide.
diff --git a/docs/pages/enroll-resources/server-access/guides/recording-proxy-mode.mdx b/docs/pages/enroll-resources/server-access/guides/recording-proxy-mode.mdx
deleted file mode 100644
index d949139b05d97..0000000000000
--- a/docs/pages/enroll-resources/server-access/guides/recording-proxy-mode.mdx
+++ /dev/null
@@ -1,213 +0,0 @@
----
-title: Teleport Recording Proxy Mode
-description: Use Recording Proxy Mode to capture OpenSSH server activity
----
-
-Teleport Recording Proxy Mode was added to allow Teleport users
-to enable session recording for servers running `sshd`, which is helpful
-when gradually transitioning large server fleets to Teleport.
-
-![Teleport OpenSSH Recording Proxy](../../../../img/server-access/openssh-proxy.png)
-
-<Admonition type="warning">
-
-Teleport Cloud only supports session recording at the Node level. If you are
-interested in setting up session recording, read our
-[getting started guide](../getting-started.mdx) so you can start
-replacing your OpenSSH servers with Teleport Agents.
-
-</Admonition>
-
-We consider Recording Proxy Mode to be less secure than recording at the Node
-level for two reasons:
-
-- It grants additional privileges to the Teleport Proxy Service. In the default Node Recording mode, the Proxy Service stores no secrets and cannot "see" the decrypted data. This makes a Proxy Server less critical to the security of the overall cluster. But if an attacker gains physical access to a Proxy Server running in Proxy Recording mode, they will be able to see the decrypted traffic and client keys stored in the Proxy Server's process memory.
-- Recording Proxy Mode requires the use of SSH agent forwarding. Agent forwarding is required because without it, a Proxy Server will not be able to establish a second connection to the destination node.
-
-The Teleport Proxy Service should be available to clients and set up with TLS.
-
-## Prerequisites
-
-(!docs/pages/includes/self-hosted-prereqs-tabs.mdx!)
-
-- A host where you will run an OpenSSH server.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Configure Teleport
-
-(!docs/pages/includes/permission-warning.mdx!)
-
-(!docs/pages/includes/backup-warning.mdx!)
-
-### Enable Proxy Recording Mode
-
-To enable session recording for `sshd` nodes, the cluster must be switched to
-Recording Proxy Mode. In this mode, the recording will be done on the Proxy level.
-
-Edit the Auth Service configuration file as follows:
-
-```yaml
-# snippet from /etc/teleport.yaml
-auth_service:
-   # Session Recording must be set to Proxy to work with OpenSSH
-   session_recording: "proxy"  # can also be "off" and "node" (default)
-```
-
-### Optional insecure step: Disable strict host checking
-
-When in recording mode, Teleport will check that the host certificate of any
-Node a user connects to is signed by a Teleport CA. By default, this is a strict
-check. If the Node presents just a key or a certificate signed by a different
-CA, Teleport will reject this connection with the error message:
-
-```text
-ssh: handshake failed: remote host presented a public key, expected a host
-certificate
-```
-
-You can disable strict host checks as shown below. However, this opens the
-possibility for Person-in-the-Middle attacks and is not recommended.
-
-```yaml
-# snippet from /etc/teleport.yaml
-auth_service:
-  proxy_checks_host_keys: false
-```
-
-## Step 2/3. Configure `sshd`
-
-`sshd` must be told to allow users to log in with certificates generated
-by the Teleport User CA. Start by exporting the Teleport CA public key.
-
-On your Teleport Node, export the Teleport Certificate Authority certificate
-into a file and update your SSH configuration to trust Teleport's CA. Assign <Var name="proxy" /> to the address of your Teleport Proxy Service:
-
-```code
-$ curl 'https://<Var name="proxy"/>/webapi/auth/export?type=user' | sed s/cert-authority\ // > teleport_user_ca.pub
-$ sudo mv ./teleport_user_ca.pub /etc/ssh/teleport_user_ca.pub
-$ echo "TrustedUserCAKeys /etc/ssh/teleport_user_ca.pub" | sudo tee -a /etc/ssh/sshd_config
-```
-
-Restart `sshd`.
-
-Now, `sshd` will trust users who present a Teleport-issued certificate.
-The next step is to configure host authentication.
-
-The recommended solution is to ask Teleport to issue valid host certificates for
-all OpenSSH nodes. To generate a host certificate, run this command:
-
-```code
-# Creating host certs, with an array of every host to be accessed.
-# Wildcard certs aren't supported by OpenSSH. The domain must be fully 
-# qualified.
-# Management of the host certificates can become complex. This is another
-# reason we recommend using Teleport SSH on nodes.
-$ tctl auth sign \
-      --host=api.example.com,ssh.example.com,64.225.88.175,64.225.88.178 \
-      --format=openssh \
-      --out=api.example.com
-
-The credentials have been written to api.example.com, api.example.com-cert.pub
-
-# You can use ssh-keygen to verify the contents.
-$ ssh-keygen -L -f api.example.com-cert.pub
-#api.example.com-cert.pub:
-#        Type: ssh-rsa-cert-v01@openssh.com host certificate
-#        Public key: RSA-CERT SHA256:ireEc5HWFjhYPUhmztaFud7EgsopO8l+GpxNMd3wMSk
-#        Signing CA: RSA SHA256:/6HSHsoU5u+r85M26Ut+M9gl+HventwSwrbTvP/cmvo
-#        Key ID: ""
-#        Serial: 0
-#        Valid: after 2020-07-29T20:26:24
-#        Principals:
-#               api.example.com
-#               ssh.example.com
-#               64.225.88.175
-#               64.225.88.178
-#        Critical Options: (none)
-#        Extensions:
-#                x-teleport-authority UNKNOWN OPTION (len 47)
-#                x-teleport-role UNKNOWN OPTION (len 8)
-```
-
-Then add the following lines to `/etc/ssh/sshd_config` on all OpenSSH nodes, and
-restart `sshd`.
-
-```yaml
-HostKey /etc/ssh/api.example.com
-HostCertificate /etc/ssh/api.example.com-cert.pub
-```
-
-## Step 3/3. Use Proxy Recording Mode
-
-Now you can use the `tsh ssh` command to log in to any `sshd` node in the
-cluster, and the session will be recorded.
-
-```code
-# tsh ssh to use default ssh port:22
-$ tsh ssh --port=22 user@host.example.com
-# Example for a Amazon EC2 Host
-# tsh ssh --port=22 ec2-user@ec2-54-EXAMPLE.us-west-2.compute.amazonaws.com
-```
-
-If you want to use the OpenSSH `ssh` client for logging into `sshd` servers behind a proxy
-in "recording mode", you have to tell the `ssh` client to use a jump host and
-enable SSH agent forwarding, otherwise, a recording proxy will not be able to
-terminate the SSH connection to record it:
-
-```code
-# Note that agent forwarding is enabled twice: one from a client to a proxy
-# (mandatory if using a recording proxy), and then optionally from a proxy
-# to the end server if you want your agent running on the end server
-$ ssh -o "ForwardAgent yes" \
-    -o "ProxyCommand ssh -o 'ForwardAgent yes' -p 3023 %r@p.example.com -s proxy:%h:%p" \
-    user@host.example.com
-```
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  To avoid typing all this and use the usual `ssh user@host.example.com`, users can update their `~/.ssh/config` file.
-</Admonition>
-
-Verify that a Teleport certificate is loaded into the agent after
-logging in:
-
-```code
-# Login as Joe
-$ tsh login --proxy=proxy.example.com --user=joe
-# see if the certificate is present (look for "teleport:joe") at the end of the cert
-$ ssh-add -L
-```
-
-<Admonition
-  type="warning"
-  title="GNOME Keyring SSH Agent and GPG Agent"
->
-  It is well known that the Gnome Keyring SSH agent, used by many popular Linux desktops like Ubuntu, and `gpg-agent` from GnuPG do not support SSH
-  certificates. We recommend using the `ssh-agent` from OpenSSH.
-  
-  Alternatively, you can disable the SSH agent integration entirely using the
-  `--no-use-local-ssh-agent` flag or `TELEPORT_USE_LOCAL_SSH_AGENT=false`
-  environment variable with `tsh`.
-</Admonition>
-
-## OpenSSH rate limiting
-
-When using a Teleport proxy in "recording mode", be aware of OpenSSH's built-in
-rate-limiting. On large numbers of Proxy Service connections, you may encounter errors
-like:
-
-```txt
-channel 0: open failed: connect failed: ssh: handshake failed: EOF
-```
-
-See the `MaxStartups` setting in `man sshd_config`. This setting means that by
-default, OpenSSH only allows 10 unauthenticated connections at a time and starts
-dropping connections 30% of the time when the number of connections goes over 10.
-When it hits 100 authentication connections, all new connections are
-dropped.
-
-To increase the concurrency level, increase the value to something like
-`MaxStartups 50:30:100`. This allows 50 concurrent connections and a max of 100.
-
diff --git a/docs/pages/enroll-resources/server-access/guides/ssh-pam.mdx b/docs/pages/enroll-resources/server-access/guides/ssh-pam.mdx
index 587a1debebf22..5ed5ae28475f5 100644
--- a/docs/pages/enroll-resources/server-access/guides/ssh-pam.mdx
+++ b/docs/pages/enroll-resources/server-access/guides/ssh-pam.mdx
@@ -1,7 +1,10 @@
 ---
 title: Configure SSH with Pluggable Authentication Modules
+sidebar_label: Pluggable Authentication Modules
 description: How to configure Teleport SSH with PAM (Pluggable Authentication Modules).
-h1: Pluggable Authentication Modules (PAM)
+tags:
+ - conceptual
+ - zero-trust
 ---
 
 Teleport's SSH Service can be configured to integrate with
diff --git a/docs/pages/enroll-resources/server-access/introduction.mdx b/docs/pages/enroll-resources/server-access/introduction.mdx
deleted file mode 100644
index 821083e112682..0000000000000
--- a/docs/pages/enroll-resources/server-access/introduction.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Introduction to Enrolling Servers
-description: Teleport server access features and introduction.
-videoBanner: EsEvO5ndNDI
----
-
-Teleport consolidates SSH access across all environments, decreases
-configuration complexity, supports industry best practices and compliance while
-giving complete visibility over all sessions and events.
-
-Teleport server access is designed for the following kinds of scenarios:
-
-- When up to a vast number of clusters must be managed using the command-line (`tsh`) or programmatically (through the Teleport API) and you want to simplify your stack, security, and configuration complexity.
-- When security team members must track and audit every user session. 
-- When Teleport users require a complete, dedicated, and secure SSH option (Teleport Node running in SSH mode) and more than a certificate authority (Teleport Auth) with proxy (Teleport Proxy).
-- When resource and network security must be maximized: SSH certificates over secret keys, multi-factor authentication (MFA), Single Sign-On (SSO), and short-lived certificates.
-
-![Server access architecture](../../../img/server-access/architecture.png)
-
-Teleport protects servers through the Teleport SSH Service, which is a Teleport
-agent service. For more information on agent services, read [Teleport Agent
-Architecture](../../reference/architecture/agents.mdx). You can also learn how to deploy a
-[pool of Teleport Agents](../agents/agents.mdx) to run multiple agent
-services.
-
-## Getting started
-
-- [Get started](getting-started.mdx): Get started using Teleport server access
-  in 10 minutes. Server access for most common SSH use-cases.
-
-## Enrolling OpenSSH servers
-
-You can protect OpenSSH servers with Teleport, which makes it easier to protect
-legacy infrastructure, using an [agentless architecture](openssh/openssh-agentless.mdx).
-Read the [Teleport OpenSSH guides](openssh/openssh.mdx) to learn more.
-
-## Guides
-
-- [Using Teleport with PAM](./guides/ssh-pam.mdx): How to configure Teleport SSH with PAM (Pluggable Authentication Modules).
-- [Recording Proxy Mode](./guides/recording-proxy-mode.mdx): How to use Teleport Recording Proxy Mode to capture activity on OpenSSH servers.
-- [BPF Session Recording](./guides/bpf-session-recording.mdx): How to use BPF to record SSH session commands, modified files and network connections.
-- [Visual Studio Code](./guides/vscode.mdx): How to remotely develop with Visual Studio Code and Teleport.
diff --git a/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx b/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
index b04e0dfe1b331..a291c88b07f78 100644
--- a/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
+++ b/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
@@ -3,6 +3,10 @@ title: Using Teleport with OpenSSH in agentless mode
 description: This guide shows you how to set up Teleport in agentless mode to enable secure access to OpenSSH servers so you can protect systems that do not run a Teleport binary.
 keywords: [openssh, teleport, agentless]
 videoBanner: x0eYFUEIOrM
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 In this guide, we will show you how to configure Teleport in agentless mode and
@@ -14,22 +18,24 @@ Using Teleport and OpenSSH has the advantage of getting you up
 and running, but in the long run, we would recommend replacing `sshd` with `teleport`.
 `teleport` SSH servers have support for multiple features that are incompatible with OpenSSH:
 
-- RBAC and resource filtering based on [dynamically updated labels](../../../admin-guides/management/admin/labels.mdx)
-- [Session recording without SSH connection termination](../guides/recording-proxy-mode.mdx)
-- [Session sharing](../../../connect-your-client/tsh.mdx)
+- RBAC and resource filtering based on [dynamically updated labels](../../../zero-trust-access/rbac-get-started/labels.mdx)
+- [Session recording without SSH connection termination](../../../reference/architecture/session-recording.mdx#record-at-the-proxy-service)
+- [Session sharing](../../../zero-trust-access/authentication/joining-sessions.mdx)
 - [Advanced session recording](../guides/bpf-session-recording.mdx)
 
 ## How it works
 
-Teleport supports OpenSSH by proxying SSH connections through the Proxy Service. When a Teleport user requests to connect to an OpenSSH node, the Proxy Service checks the user's Teleport roles.
+At a high level, Teleport supports OpenSSH servers by proxying SSH connections through the Proxy Service.
+The OpenSSH server will be set up to trust connections from the Proxy Service rather than trusting direct
+connections from users. This ensures that all connections to OpenSSH servers go through the
+Proxy Service, where session IO and audit events can be recorded and RBAC can be enforced.
 
-If the RBAC checks succeed, the Proxy Service authenticates to the OpenSSH node with a dynamically generated certificate signed by a Teleport CA. This allows the
-Proxy Service to record and audit connections to OpenSSH nodes.
-
-The Proxy Service prevents Teleport users from bypassing auditing by requiring
-a certificate signed by a Teleport CA that only the Auth Service possesses.
-
-In this setup, the Teleport SSH Service performs RBAC checks as well as audits and records sessions on its host, which eliminates the need for connection termination when recording SSH sessions.
+For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/master/rfd/0098-registered-openssh-nodes.md)
+Below are some key details from the RFD:
+- The Proxy Service is uniquely able to request certificates signed by the Auth Service with the Teleport OpenSSH CA on behalf of users, and the OpenSSH server is set up to only trust certificates signed by this CA. Therefore, in order to connect to an OpenSSH server, a user must connect through the Proxy Service to request and use an OpenSSH certificate.
+- Before connecting the user to the OpenSSH server, the Proxy Service performs RBAC checks to see if the user should be allowed to access it.
+- In order to record the session and its audit events, the Proxy Service terminates (decrypts) the client SSH connection, and establishes its own connection to the OpenSSH server. It then acts as a pipe between the two connections, recording events and IO as it proceeds.
+  - See [Recording Proxy Mode](../../../reference/architecture/session-recording.mdx#record-at-the-proxy-service) for more details.
 
 <Admonition
   type="tip"
@@ -60,22 +66,6 @@ In this setup, the Teleport SSH Service performs RBAC checks as well as audits a
   Teleport Proxy Service host.
 - (!docs/pages/includes/tctl.mdx!)
 
-### Upgrading to v14 from legacy OpenSSH nodes
-
-  If you have previously configured OpenSSH nodes to trust a Teleport CA without
-  registering them and you upgrade your Teleport cluster to Teleport 14, you won't
-  be able to connect to them anymore by default. This is because open dialing to
-  OpenSSH servers not registered with the cluster is no longer allowed in Teleport 14.
-  To ensure that you will retain access to your OpenSSH nodes you will need to follow
-  this guide to register every OpenSSH node with Teleport that you previously
-  configured. This must be done *before* your Teleport cluster is upgraded to Teleport 14.
-
-  If you are having issues registering OpenSSH nodes or need to upgrade your
-  Teleport cluster to Teleport 14 before registering all of your OpenSSH nodes, you can
-  pass the `TELEPORT_UNSTABLE_UNLISTED_AGENT_DIALING` environment variable to your
-  Proxy Service and set it to `yes`. This will allow connections to unregistered
-  OpenSSH nodes but will be removed in Teleport v15.
-
 ## Step 1/3. Configure `sshd`
 
 Teleport only allows access to resources in your infrastructure via Teleport
@@ -363,3 +353,21 @@ $ ssh -F ssh_config_teleport ${USER?}@node2.leafcluster.${CLUSTER}
   qualified domain name, rather than an IP address.
 
 </Admonition>
+
+### OpenSSH rate limiting
+
+Be aware of OpenSSH's built-in rate-limiting. On large numbers of Proxy Service connections, you may encounter errors like:
+
+```txt
+channel 0: open failed: connect failed: ssh: handshake failed: EOF
+```
+
+See the `MaxStartups` setting in `man sshd_config`. This setting means that by
+default, OpenSSH only allows 10 unauthenticated connections at a time and starts
+dropping connections 30% of the time when the number of connections goes over 10.
+When it hits 100 authentication connections, all new connections are
+dropped.
+
+To increase the concurrency level, increase the value to something like
+`MaxStartups 50:30:100`. This allows 50 concurrent connections and a max of 100.
+
diff --git a/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx b/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
index a50e9970a9c90..1971fb53445b7 100644
--- a/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
+++ b/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
@@ -2,6 +2,10 @@
 title: Using Teleport with OpenSSH in agentless mode (manual installation)
 description: This guide shows you how to set up Teleport to enable secure access to OpenSSH servers so you can protect legacy systems that do not run a Teleport binary.
 videoBanner: x0eYFUEIOrM
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 In this guide, we will show you how to configure the OpenSSH server `sshd` to
@@ -12,22 +16,24 @@ Using Teleport and OpenSSH has the advantage of getting you up
 and running, but in the long run, we would recommend replacing `sshd` with `teleport`.
 `teleport` SSH servers have support for multiple features that are incompatible with OpenSSH:
 
-- RBAC and resource filtering based on [dynamically updated labels](../../../admin-guides/management/admin/labels.mdx)
-- [Session recording without SSH connection termination](../guides/recording-proxy-mode.mdx)
-- [Session sharing](../../../connect-your-client/tsh.mdx)
+- RBAC and resource filtering based on [dynamically updated labels](../../../zero-trust-access/rbac-get-started/labels.mdx)
+- [Session recording without SSH connection termination](../../../reference/architecture/session-recording.mdx#record-at-the-proxy-service)
+- [Session sharing](../../../connect-your-client/teleport-clients/tsh.mdx)
 - [Advanced session recording](../guides/bpf-session-recording.mdx)
 
 ## How it works
 
-Teleport supports OpenSSH by proxying SSH connections through the Proxy Service. When a Teleport user requests to connect to an OpenSSH node, the Proxy Service checks the user's Teleport roles.
+At a high level, Teleport supports OpenSSH servers by proxying SSH connections through the Proxy Service.
+The OpenSSH server will be set up to trust connections from the Proxy Service rather than trusting direct
+connections from users. This ensures that all connections to OpenSSH servers go through the
+Proxy Service, where session IO and audit events can be recorded and RBAC can be enforced.
 
-If the RBAC checks succeed, the Proxy Service authenticates to the OpenSSH node with a dynamically generated certificate signed by a Teleport CA. This allows the
-Proxy Service to record and audit connections to OpenSSH nodes.
-
-The Proxy Service prevents Teleport users from bypassing auditing by requiring
-a certificate signed by a Teleport CA that only the Auth Service possesses.
-
-In this setup, the Teleport SSH Service performs RBAC checks as well as audits and records sessions on its host, which eliminates the need for connection termination when recording SSH sessions.
+For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/master/rfd/0098-registered-openssh-nodes.md)
+Below are some key details from the RFD:
+- The Proxy Service is uniquely able to request certificates signed by the Auth Service with the Teleport OpenSSH CA on behalf of users, and the OpenSSH server is set up to only trust certificates signed by this CA. Therefore, in order to connect to an OpenSSH server, a user must connect through the Proxy to request and use an OpenSSH certificate.
+- Before connecting the user to the OpenSSH server, the Proxy Service performs RBAC checks to see if the user should be allowed to access it.
+- In order to record the session and its audit events, the Proxy Service terminates (decrypts) the client SSH connection, and establishes its own connection to the OpenSSH server. It then acts as a pipe between the two connections, recording events and IO as it proceeds.
+  - See [Recording Proxy Mode](../../../reference/architecture/session-recording.mdx#record-at-the-proxy-service) for more details.
 
 <Admonition
   type="tip"
@@ -58,23 +64,6 @@ In this setup, the Teleport SSH Service performs RBAC checks as well as audits a
   Teleport Proxy Service host.
 - (!docs/pages/includes/tctl.mdx!)
 
-### Upgrading to v14 from legacy OpenSSH nodes
-
-  If you have previously configured OpenSSH nodes to trust a Teleport CA without
-  registering them and you upgrade your Teleport cluster to Teleport 14, you won't
-  be able to connect to them anymore by default. This is because open dialing to
-  OpenSSH servers not registered with the cluster is no longer allowed in Teleport 14.
-  To ensure that you will retain access to your OpenSSH nodes you will need to follow
-  this guide to register every OpenSSH node with Teleport that you previously
-  configured. This must be done *before* your Teleport cluster is upgraded to Teleport 14.
-
-  If you are having issues registering OpenSSH nodes or need to upgrade your
-  Teleport cluster to Teleport 14 before registering all of your OpenSSH nodes, you can
-  pass the `TELEPORT_UNSTABLE_UNLISTED_AGENT_DIALING` environment variable to your
-  Proxy Service and set it to `yes`. This will allow connections to unregistered
-  OpenSSH nodes but will be removed in Teleport v15.
-
-
 ## Step 1/5. Add a node resource to your Teleport cluster
 
 When you request an SSH connection to a OpenSSH node, Teleport needs to be able
@@ -113,7 +102,7 @@ $ tctl create openssh-node-resource.yaml
 <Admonition type="note">
   This step can be done with Infrastructure-as-Code (IaC) tools (tctl,
   Terraform, or Kubernetes Operator). This is described [in the OpenSSH server
-  IaC guide](../../../admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx).
+  IaC guide](../../../zero-trust-access/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx).
 </Admonition>
 
 ## Step 2/5. Configure `sshd` to trust the Teleport CA
@@ -549,3 +538,21 @@ $ ssh -F ssh_config_teleport ${USER?}@node2.leafcluster.${CLUSTER}
   qualified domain name, rather than an IP address.
 
 </Admonition>
+
+### OpenSSH rate limiting
+
+Be aware of OpenSSH's built-in rate-limiting. On large numbers of Proxy Service connections, you may encounter errors like:
+
+```txt
+channel 0: open failed: connect failed: ssh: handshake failed: EOF
+```
+
+See the `MaxStartups` setting in `man sshd_config`. This setting means that by
+default, OpenSSH only allows 10 unauthenticated connections at a time and starts
+dropping connections 30% of the time when the number of connections goes over 10.
+When it hits 100 authentication connections, all new connections are
+dropped.
+
+To increase the concurrency level, increase the value to something like
+`MaxStartups 50:30:100`. This allows 50 concurrent connections and a max of 100.
+
diff --git a/docs/pages/enroll-resources/server-access/openssh/openssh.mdx b/docs/pages/enroll-resources/server-access/openssh/openssh.mdx
index 2af40693b1fc5..bcbd82d5397d3 100644
--- a/docs/pages/enroll-resources/server-access/openssh/openssh.mdx
+++ b/docs/pages/enroll-resources/server-access/openssh/openssh.mdx
@@ -1,7 +1,11 @@
 ---
-title: OpenSSH Guides
+title: Enrolling OpenSSH Servers with Teleport
+sidebar_label: OpenSSH Servers
 description: Teleport Agentless OpenSSH integration guides.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
 - [Agentless OpenSSH Integration](openssh-agentless.mdx): How to use Teleport in agentless mode on systems with OpenSSH and `sshd`.
diff --git a/docs/pages/enroll-resources/server-access/rbac.mdx b/docs/pages/enroll-resources/server-access/rbac.mdx
index 918acb372cbf0..1b074f2ec2ae8 100644
--- a/docs/pages/enroll-resources/server-access/rbac.mdx
+++ b/docs/pages/enroll-resources/server-access/rbac.mdx
@@ -1,6 +1,11 @@
 ---
 title: Access Controls for Servers
+sidebar_label: Access Controls
 description: Role-based access control (RBAC) for Teleport server access.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 You can use Teleport's role-based access control (RBAC) system to set up
@@ -11,7 +16,7 @@ everything, the QA team and engineers have full access to staging servers, and
 engineers can gain temporary access to production servers in case of
 emergency.*
 
-For a more general description of Teleport roles and examples see our [Access Controls guides](../../admin-guides/access-controls/access-controls.mdx), as
+For a more general description of Teleport roles and examples see our [Access Controls guides](../../zero-trust-access/authentication/authentication.mdx), as
 this section focuses on configuring RBAC for servers connected to Teleport.
 
 ## Role configuration
@@ -71,7 +76,7 @@ spec:
 
 Similar to role fields for accessing other resources in Teleport, server-related fields support template variables.
 
-Variables with the format `{{external.xyz}}` are replaced with values from external [SSO](../../admin-guides/access-controls/sso/sso.mdx)
+Variables with the format `{{external.xyz}}` are replaced with values from external [SSO](../../zero-trust-access/sso/sso.mdx)
 providers. For OIDC logins, `{{external.xyz}}` refers to the "xyz" claim; for
 SAML logins, `{{external.xyz}}` refers to the "xyz" assertion.
 
diff --git a/docs/pages/enroll-resources/server-access/server-access.mdx b/docs/pages/enroll-resources/server-access/server-access.mdx
index a32e58bd8e97f..2ef7b9ec605f3 100644
--- a/docs/pages/enroll-resources/server-access/server-access.mdx
+++ b/docs/pages/enroll-resources/server-access/server-access.mdx
@@ -1,6 +1,134 @@
 ---
 title: Linux Servers
-description: Guides to protecting Linux servers with Teleport, including OpenSSH servers.
+description: Securely connect to Linux servers via SSH
+template: "doc-page"
+tags:
+ - zero-trust
+ - infrastructure-identity
 ---
 
-<DocCardList />
+import DocHero from "@site/src/components/Pages/Landing/DocHero";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+import Resources from "@site/src/components/Pages/Homepage/Resources";
+
+import linuxServersImg from "@version/docs/img/server-access/linux-servers-hero.jpg";
+import userCheckSvg from "@site/src/components/Icon/svg/user-check.svg";
+import questionSvg from "@site/src/components/Icon/svg/question2.svg";
+import linuxServersSvg from "@site/src/components/Icon/teleport-svg/linux-servers.svg";
+import cliSvg from "@site/src/components/Icon/teleport-svg/cli.svg";
+import vscodeSvg from "@site/src/components/Icon/svg/vscode.svg";
+import jetbrainsSvg from "@site/src/components/Icon/svg/jetbrains.svg";
+import ansibleSvg from "@site/src/components/Icon/svg/ansible.svg";
+import teleportSvg from "@site/src/components/Icon/teleport-svg/teleport.svg";
+import linuxSvg from "@site/src/components/Icon/svg/linux.svg";
+import playCircleSvg from "@site/src/components/Icon/svg/play-circle.svg";
+import addUserSvg from "@site/src/components/Icon/svg/add-user.svg";
+
+<DocHero
+  title="Enroll your first Linux server"
+  image={linuxServersImg}
+  ctaLinks={[
+    {
+      title: "Get started with server access",
+      href: "./getting-started/",
+      variant: "secondary",
+      arrow: true,
+    },
+  ]}
+  links={[
+    {
+      title: "Access controls for servers",
+      description: "Teleport's role-based access control (RBAC) system to set up granular permissions for authenticating to Linux servers connected to Teleport.",
+      href: "./rbac/",
+      icon: userCheckSvg,
+    },
+    {
+      title: "Troubleshooting",
+      description: "Common issues you might encounter in managing access to servers with Teleport and how to resolve them.",
+      href: "./troubleshooting-server/",
+      icon: questionSvg,
+    },
+  ]}
+>
+Consolidates SSH access across all environments, decreases configuration complexity, supports industry best practices and compliance while giving complete visibility over all sessions and events.
+
+Teleport protects servers through the Teleport SSH Service, which is a Teleport Agent service. For more information on agent services, read [Teleport Agent Architecture](../../reference/architecture/agents.mdx).
+</DocHero>
+
+<Resources
+  title="Enrollment options"
+  variant="doc"
+  desktopColumnsCount={2}
+  resources={[
+    {
+      title: "SSH server access",
+      description: "Secure a server by running the Teleport SSH Service and enrolling it in your cluster.",
+      iconComponent: linuxServersSvg,
+      href: "./getting-started/"
+    },
+    {
+      title: "Agentless OpenSSH",
+      description: "Use Teleport in agentless mode with existing OpenSSH servers.",
+      iconComponent: cliSvg,
+      href: "./openssh/"
+    },
+  ]}
+/>
+
+<Resources
+  title="Developer experience"
+  variant="doc"
+  desktopColumnsCount={3}
+  resources={[
+    {
+      title: "Visual Studio Code",
+      description: "Remotely develop with Visual Studio Code and Teleport.",
+      iconComponent: vscodeSvg,
+      href: "../../connect-your-client/third-party/vscode/"
+    },
+    {
+      title: "JetBrains SFTP",
+      description: "Use a JetBrains IDE to access SFTP with Teleport.",
+      iconComponent: jetbrainsSvg,
+      href: "../../connect-your-client/third-party/jetbrains-sftp/"
+    },
+    {
+      title: "Ansible",
+      description: "Run Ansible playbooks with Teleport-issued SSH certificates.",
+      iconComponent: ansibleSvg,
+      href: "../../connect-your-client/third-party/ansible/"
+    },
+  ]}
+/>
+
+<Resources
+  title="Agent configuration"
+  variant="doc"
+  desktopColumnsCount={3}
+  resources={[
+    {
+      title: "Teleport with PAM",
+      description: "Configure Teleport SSH with PAM (Pluggable Authentication Modules).",
+      iconComponent: teleportSvg,
+      href: "./guides/ssh-pam/"
+    },
+    {
+      title: "Linux Auditing System",
+      description: "Integrate Teleport with the Linux Auditing System (auditd).",
+      iconComponent: linuxSvg,
+      href: "./guides/auditd/"
+    },
+    {
+      title: "Enhanced Session Recording with BPF",
+      description: "Use BPF to record SSH session commands, modified files and network connections.",
+      iconComponent: playCircleSvg,
+      href: "./guides/bpf-session-recording/"
+    },
+    {
+      title: "Automatic host user creation",
+      description: "Create local host users on login with fine-grained access controls.",
+      iconComponent: addUserSvg,
+      href: "./guides/host-user-creation/"
+    },
+  ]}
+/>
diff --git a/docs/pages/enroll-resources/server-access/troubleshooting-server.mdx b/docs/pages/enroll-resources/server-access/troubleshooting-server.mdx
index e1754859994bd..9bc3c9d5263ac 100644
--- a/docs/pages/enroll-resources/server-access/troubleshooting-server.mdx
+++ b/docs/pages/enroll-resources/server-access/troubleshooting-server.mdx
@@ -1,6 +1,11 @@
 ---
 title: Troubleshooting Server Access
+sidebar_label: Troubleshooting
 description: Describes common issues and solutions for access to servers.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 This section describes common issues that you might encounter in managing access to servers
@@ -69,7 +74,7 @@ provider don't see any of the logins they need to access remote resources.
 To fix this issue, you should check that the configuration of your auth connectors assigns logins to
 your single sign-on users or modify the traits in the Teleport roles assigned to users through their
 group membership in the external identity provider.
-For more information about using traits in roles, see [Role Templates](../../admin-guides/access-controls/guides/role-templates.mdx).
+For more information about using traits in roles, see [Role Templates](../../zero-trust-access/rbac-get-started/role-templates.mdx).
 
 ## Offline servers are included in the server list
 
@@ -140,7 +145,7 @@ spec:
 ```
 
 For more information about moderated sessions and session sharing, see
-[Joining Sessions](../../admin-guides/access-controls/guides/joining-sessions.mdx).
+[Joining Sessions](../../zero-trust-access/authentication/joining-sessions.mdx).
 
 ## Unable to connect to agentless OpenSSH server as root
 
diff --git a/docs/pages/enroll-resources/workload-identity/getting-started.mdx b/docs/pages/enroll-resources/workload-identity/getting-started.mdx
deleted file mode 100644
index 6c2a0f35febec..0000000000000
--- a/docs/pages/enroll-resources/workload-identity/getting-started.mdx
+++ /dev/null
@@ -1,251 +0,0 @@
----
-title: Getting Started with Workload Identity
-description: Getting started with Teleport Workload Identity for SPIFFE and Machine ID
----
-
-Teleport's Workload Identity issues flexible short-lived identities intended
-for workloads. It is compatible with the industry-standard SPIFFE specification
-meaning that it can be used in place of other SPIFFE compatible identity
-providers.
-
-In this guide, you'll configure the RBAC necessary to allow a Bot to issue
-workload identity credentials and then configure `tbot` to expose a SPIFFE
-Workload API endpoint. You can then connect your workloads to this endpoint to
-receive SPIFFE SVID-compatible workload identity credentials.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- (!docs/pages/includes/tctl.mdx!)
-- `tbot` must already be installed and configured on the host where the
-  workloads which need to access Teleport Workload Identity will run. For more
-  information, see the [deployment guides](../machine-id/deployment/deployment.mdx).
-
-## Step 1/4. Configure Workload Identity
-
-First, you will need to create a Workload Identity resource.
-
-This resource is the primary way that Teleport Workload Identity is configured.
-Each Workload Identity resource represents the configuration of an identity for a
-specific workload or a template to be used when representing the identity of a
-group of workloads. The Workload Identity resource specifies a number of key
-things, including:
-
-- The name of the Workload Identity, which will be needed when issuing it.
-- The SPIFFE ID that will be included in credentials issued for this
-  WorkloadIdentity.
-- Any rules around when this Workload Identity can be used to issue credentials.
-
-Before proceeding, you'll want to determine the SPIFFE ID path that your
-workload will use. In our example, we'll use `/svc/foo`. We provide more
-guidance on choosing a SPIFFE ID structure in the
-[Best Practices](./best-practices.mdx) guide.
-
-Create a new file called `workload-identity.yaml`:
-
-```yaml
-kind: workload_identity
-version: v1
-metadata:
-  name: example-workload-identity
-  labels:
-    example: getting-started
-spec:
-  spiffe:
-    id: /svc/foo
-```
-
-Replace:
-
-- `example-workload-identity` with a name that describes your use-case.
-- `/svc/foo` with the SPIFFE ID path you have decided on issuing.
-
-Use `tctl create -f ./workload-identity.yaml` to create the Workload Identity.
-
-Now, you'll need to create a role that will grant access to the Workload Identity
-that you have just created. As with other Teleport resources, access is granted
-by specifying label matchers on the role that will match the labels on the
-resource itself.
-
-In addition to granting access to the resource, we will also need to grant the
-ability to read and list the Workload Identity resource type.
-
-Create `workload-identity-issuer-role.yaml`:
-
-```yaml
-kind: role
-version: v6
-metadata:
-  name: example-workload-identity-issuer
-spec:
-  allow:
-    workload_identity_labels:
-      example: ["getting-started"]
-    rules:
-    - resources:
-      - workload_identity
-      verbs:
-      - list
-      - read
-```
-
-Use `tctl create -f ./workload-identity-issuer-role.yaml` to create the role.
-
-Now, use `tctl bots update` to add the role to the Bot. Replace `example-bot`
-with the name of the Bot you created in the deployment guide and
-`example-workload-identity-issuer` with the name of the role you just created:
-
-```code
-$ tctl bots update example-bot --add-roles example-workload-identity-issuer
-```
-
-### Configuring DNS SANs
-
-In some cases, you may wish to configure DNS SANs which should be included in
-the X509 certificates issued by the Workload API. This is useful in cases
-where the client may not be SPIFFE aware and will check the DNS SAN rather than
-the SPIFFE URI during the TLS handshake.
-
-Modify your `workload-identity.yaml` resource definition to include the
-`spec.spiffe.x509.dns_sans` field, replacing `example.com` with the DNS name you
-require:
-
-```yaml
-kind: workload_identity
-version: v1
-metadata:
-  name: example-workload-identity
-  labels:
-    example: getting-started
-spec:
-  spiffe:
-    id: /svc/foo
-    x509:
-      dns_sans:
-      - example.com
-```
-
-Use `tctl create -f ./workload-identity.yaml` to update the WorkloadIdentity
-resource with your changes.
-
-## Step 2/4. Configure `workload-identity-api` service in `tbot`
-
-To set up a SPIFFE Workload API endpoint with `tbot`, we configure an instance
-of the `workload-identity-api` service.
-
-First, determine where you wish this socket to be created. In our example,
-we'll use `/opt/machine-id/workload.sock`. You may wish to choose a directory
-that is only accessible by the processes that will need to connect to the
-Workload API.
-
-Modify your `tbot` configuration file to include the `workload-identity-api`
-service:
-
-```yaml
-services:
-- type: workload-identity-api
-  listen: unix:///opt/machine-id/workload.sock
-  selector:
-    name: example-workload-identity
-```
-
-Replace:
-
-- `/opt/machine-id/workload.sock` with the path to the socket you wish to create.
-- `example-workload-identity` with the name of the Workload Identity resource you
-  created earlier.
-
-Start or restart your `tbot` instance to apply the new configuration
-
-### Configuring Unix Workload Attestation
-
-By default, an SVID listed under the Workload API service will be issued to any
-workload that connects to the Workload API. You may wish to restrict which SVIDs
-are issued based on certain characteristics of the workload. This is known as
-Workload Attestation.
-
-When using the Unix listener, `tbot` supports workload attestation based on
-three characteristics of the workload process:
-
-- `uid`: The UID of the user that the workload process is running as.
-- `gid`: The primary GID of the user that the workload process is running as.
-- `pid`: The PID of the workload process.
-
-Within a Workload Identity, you can configure rules based on the attributes
-determined via workload attestation. Each rule contains a number of tests and
-all tests must pass for the rule to pass. At least one rule must pass for the
-Workload Identity to be allowed to issue a credential.
-
-For example, to configure a Workload Identity to be issued only to workloads that
-are running as the user with ID 1000 or running as a user with a primary group
-ID of 50:
-
-```yaml
-kind: workload_identity
-version: v1
-metadata:
-  name: example-workload-identity
-  labels:
-    example: getting-started
-spec:
-  rules:
-    allow:
-    - conditions:
-      - attribute: workload.unix.uid
-        eq:
-          value: 1000
-    - conditions:
-      - attribute: workload.unix.gid
-        eq:
-          value: 50
-  spiffe:
-    id: /svc/foo
-```
-
-## Step 3/4. Testing the Workload API with `tbot spiffe-inspect`
-
-The `tbot` binary includes a `spiffe-inspect` command that can be used to
-test the configuration of the Workload API. This command will connect to the
-Workload API and request SVIDs, whilst providing debug information.
-
-Before configuring your workload to use the Workload API, we recommend using
-this command to ensure that the Workload API is behaving as expected.
-
-Use the `spiffe-inspect` command with `--path` to specify the path to the
-Workload API socket, replacing `/opt/machine-id/workload.sock` with the path you
-configured in the previous step:
-
-```code
-$ tbot spiffe-inspect --path unix:///opt/machine-id/workload.sock
-INFO [TBOT]      Inspecting SPIFFE Workload API Endpoint unix:///opt/machine-id/workload.sock tbot/spiffe.go:31
-INFO [TBOT]      Received X.509 SVID context from Workload API bundles_count:1 svids_count:1 tbot/spiffe.go:46
-SVIDS
-- spiffe://example.teleport.sh/svc/foo
-  - Expiry: 2024-03-20 10:55:52 +0000 UTC
-Trust Bundles
-- example.teleport.sh
-```
-
-## Step 4/4. Configuring your workload to use the Workload API
-
-Now that you know that the Workload API is behaving as expected, you can
-configure your workload to use it. The exact steps will depend on the workload.
-
-In cases where you have used the SPIFFE SDKs, you can configure the
-`SPIFFE_ENDPOINT_SOCKET` environment variable to point to the socket created by
-`tbot`.
-
-See the [Best Practices](./best-practices.mdx) guide for more information on
-integrating SPIFFE with your workloads.
-
-## Next steps
-
-- [Workload Identity Overview](./introduction.mdx): Overview of Teleport
-Workload Identity.
-- [Best Practices](./best-practices.mdx): Best practices for using Workload
-Identity in Production.
-- Read the [Workload Identity reference](../../reference/workload-identity/workload-identity-resource.mdx)
-to explore the configuration of the Workload Identity resource.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
-all the available configuration options for `tbot`.
diff --git a/docs/pages/enroll-resources/workload-identity/introduction.mdx b/docs/pages/enroll-resources/workload-identity/introduction.mdx
deleted file mode 100644
index d728f7f288f53..0000000000000
--- a/docs/pages/enroll-resources/workload-identity/introduction.mdx
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: Introduction to Workload Identity
-description: Describes Teleport Workload Identity, which securely issues flexible, short-lived cryptographic identities to workloads and non-human identities.
----
-
-Teleport Workload Identity securely issues short-lived cryptographic identities
-to workloads. It is a flexible foundation for workload identity across your 
-infrastructure, creating a uniform way for your workloads to authenticate 
-regardless of where they are running.
-
-The flexible nature of Teleport Workload Identity enables it to be used for a
-range of purposes, including:
-
-- Workload authentication to third-party APIs on cloud platforms such as AWS, 
-  GCP and Azure.
-- Providing X.509 certificates for mutual TLS authentication between workloads
-  within your infrastructure as part of a Zero Trust strategy.
-- Workload authentication between services within your infrastructure. 
-
-Teleport Workload Identity is compatible with the open-source
-[Secure Production Identity Framework For Everyone (SPIFFE)](./spiffe.mdx)
-standard. This enables interoperability between workload identity
-implementations and also provides a wealth of off-the-shelf tools and SDKs to
-simplify integration with your workloads. 
-
-There's a whole host of benefits to adopting Teleport Workload Identity, but
-here's some of the key ones:
-
-- Eliminate the use of long-lived shared secrets within your infrastructure, and
-  reduce the risk of exfiltration and time spent by engineers creating and 
-  rotating these secrets.
-- Establish an out of the box universal form of identity for your workloads,
-  enabling your engineers to get on with building new services without needing 
-  to think about how they'll authenticate.
-- Converge on a first-class form of identity for your workloads, simplifying
-  infrastructure by reducing the number of different ways workloads authenticate.
-
-## How it works
-
-Teleport Workload Identity establishes a root certificate authority within your
-Teleport cluster that will be responsible for issuing the short-lived JWTs and
-X509 certificates to workloads.
-
-These identities are also known as SPIFFE Verifiable Identity Documents (SVIDs)
-and contain the identity of the workload encoded as a URI, also known as a 
-SPIFFE ID. The structure of this SPIFFE ID is up to you and can encode any
-information you need to uniquely identify your workload.
-
-The ability to request these identities is controlled by Teleport's Role-Based
-Access Control system. Users and Bots are granted roles which will allow them to
-request identities with specific SPIFFE IDs.
-
-The `tbot` agent is installed in close proximity to workloads which require an
-identity. It manages the process of requesting and renewing the identities for
-the workloads. The `tbot` agent authenticates to the Teleport cluster using one
-of our support join methods, which in many cases enable it to authenticate 
-on the basis of federated trust rather than the use of long-lived secrets.
-
-Workloads can receive their identities in one of two ways:
-
-- The `tbot` agent can write these identities to a directory on the local
-  filesystem, or, to a Kubernetes secret.
-- The `tbot` agent can expose a SPIFFE Workload API. A standardized gRPC API
-  that allows workloads to request their identities directly from the `tbot`
-  agent.
-
-When using the Workload API, the `tbot` agent can perform an additional process
-called Workload Attestation. This allows the issuance of identities to be 
-restricted to specific workloads. For example, you can restrict an identity to
-only be issued to a Linux process with a specific UID or GID, or restrict an
-identity to only be issued to a specific Kubernetes pod. The Workload
-Attestation process eliminates the need for a "bootstrapping" secret to be 
-provided to the workloads.
-
-![Workload ID overview](../../../img/workload-identity/intro-diagram.png)
-
-Once the workload has its identity, it can be used for a range of purposes. The
-X.509 certificates can be used to establish Mutual TLS, and the JWTs can be used
-to authenticate with a range of third-party APIs.
-
-## Teleport Workload Identity vs Machine ID
-
-Teleport Machine ID issues short-lived credentials to workloads to enable them
-to access resources secured by the Teleport cluster. The credentials issued are
-only compatible with Teleport itself, and access to resources must be through
-the Teleport Proxy.
-
-Teleport Workload Identity issues cryptographic identities that are compatible
-with the popular SPIFFE standard for interoperable workload identity. These 
-identities are flexible enough to be used for a range of purposes. The 
-Teleport Proxy is not used for securing workload-to-workload communication.
-
-## Next steps
-
-Learn more about Teleport Workload Identity:
-
-- [SPIFFE](./spiffe.mdx): Learn about the SPIFFE specification and how it is implemented by Teleport Workload Identity.
-- [Federation](./federation.mdx): Learn about using Federation to allow workloads to trust workloads from other trust domains.
-- [JWT SVIDs](./jwt-svids.mdx): Learn about the short-lived JWTs issued by Workload Identity.
-- [Best Practices](./best-practices.mdx): Best practices for using Workload Identity in Production.
-- [Workload Identity Resource](../../reference/workload-identity/workload-identity-resource.mdx): The full reference for the Workload Identity resource.
-- [Workload Identity API and Workload Attestation](../../reference/workload-identity/workload-identity-api-and-workload-attestation.mdx): To learn more about the Workload Identity API and Workload Attestation.
-
-Learn how to configure Teleport Workload Identity for specific use-cases:
-
-- [Getting Started](./getting-started.mdx): How to configure Teleport for Workload Identity.
-- [TSH Support](./tsh.mdx): How to use `tsh` with Workload Identity to issue SVIDs to users.
-- [AWS Roles Anywhere](./aws-roles-anywhere.mdx): Configuring AWS to accept Workload Identity certificates as authentication using AWS Roles Anywhere.
-- [AWS OIDC Federation](./aws-oidc-federation.mdx): Configuring AWS to accept Workload Identity JWTs as authentication using AWS OIDC Federation.
-- [GCP Workload Identity Federation](./gcp-workload-identity-federation-jwt.mdx): Configuring GCP to accept Workload Identity JWTs as authentication using GCP Workload Identity Federation.
-- [Azure Federated Credentials](./azure-federated-credentials.mdx): Configuring Azure to accept Workload Identity JWTs as authentication using Azure Federated Credentials.
-
-### Other resources
-
-- [SPIFFE Specification](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE.md): The official SPIFFE specification. Useful for understanding the SPIFFE ID and SVID formats.
-- [Solving The Bottom Turtle](https://spiffe.io/pdf/Solving-the-bottom-turtle-SPIFFE-SPIRE-Book.pdf): A book covering the fundamentals and details of SPIFFE.
diff --git a/docs/pages/enroll-resources/workload-identity/tsh.mdx b/docs/pages/enroll-resources/workload-identity/tsh.mdx
deleted file mode 100644
index be97b9124c1d0..0000000000000
--- a/docs/pages/enroll-resources/workload-identity/tsh.mdx
+++ /dev/null
@@ -1,88 +0,0 @@
----
-title: Workload Identity and tsh
-description: Issuing SPIFFE SVIDs using Workload Identity and tsh
----
-
-In some scenarios, you may wish to issue a SPIFFE SVID manually, without using
-Machine ID. This can be useful in scenarios where you need to impersonate a
-service for the purposes of debugging or could provide a mechanism for providing
-human access to services which use SPIFFE SVIDs for authentication.
-
-In this guide, you will use the `tsh` tool to issue a SPIFFE SVID.
-
-## Prerequisites
-
-- A role configured to allow issuing SPIFFE SVIDs and this role assigned to
-  your user. See [Getting Started](./getting-started.mdx) for more information.
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-## Step 1/2. Using `tsh` to issue a SPIFFE X509 SVID
-
-First, determine where you wish to write the SPIFFE SVID. If you wish to write
-these into a directory, you must first create it. In our example, we will write
-the SVID to a directory called `svid`.
-
-Next, determine which workload identity resource you'll use to issue the X509
-SVID. In our example, we'll use a workload identity called
-`my-workload-identity`.
-
-Issue the SVID specifying the output directory using `--output` and the name of
-the workload identity resource using `--name-selector`:
-
-```sh
-$ tsh workload-identity issue-x509 --output ./svid --name-selector my-workload-identity
-```
-
-Additionally, flags can be used to further customize the SVID:
-
-| `flag`             | Description                                                                                                         |
-|--------------------|---------------------------------------------------------------------------------------------------------------------|
-| `--credential-ttl` | Sets the Time To Live for the resulting X509 SVID. Specify duration using `s`, `m` and `h`, e.g `12h` for 12 hours. |
-
-### Using headless authentication to issue a SVID on a remote host
-
-In some scenarios, you may wish to use `tsh` to issue a SVID on a host you have
-SSHed into, without logging into Teleport on that host. This can be particularly
-useful in scenarios where authentication may not be possible, for example, when
-you authenticate using a hardware token.
-
-In this case, you can use the headless authentication feature of `tsh`. This
-provides a prompt for you to authenticate the command on the remote machine,
-using your local `tsh` client.
-
-To use headless authentication, we provide the `--headless` flag, and must
-also specify the `--proxy` and `--user` flags:
-
-```sh
-$ tsh --proxy=example.teleport.sh \
-  --user example \
-  --headless \
-  workload-identity issue-x509 \
-  --output . \
-  --name-selector my-workload-identity
-```
-
-## Step 2/2. Using the output SVID
-
-Once the SVID has been issued, you can configure your workload to use it. This
-will differ depending on the workload.
-
-When written to disk, the SVID will be written as three files:
-
-| `file`            | Description                                                                                                                                                                    |
-|-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `svid_key.pem`    | The private key for the X509 SVID. This is PEM wrapped and marshalled in PKCS8 format.                                                                                         |
-| `svid.pem`        | The X509 SVID itself. This is PEM wrapped and DER encoded.                                                                                                                     |
-| `svid_bundle.pem` | The SPIFFE trust bundle. A concatenated list of X509 certificates for the certificate authorities within the trust domain. These are individually PEM wrapped and DER encoded. |
-
-## Next steps
-
-- [Workload Identity Overview](./introduction.mdx): Overview of Teleport
-Workload Identity.
-- [Getting Started](./getting-started.mdx): How to configure Teleport for
-Workload Identity.
-- [Best Practices](./best-practices.mdx): Best practices for using Workload
-Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
-all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/workload-attestation.mdx b/docs/pages/enroll-resources/workload-identity/workload-attestation.mdx
deleted file mode 100644
index 077e9894e9c1e..0000000000000
--- a/docs/pages/enroll-resources/workload-identity/workload-attestation.mdx
+++ /dev/null
@@ -1,247 +0,0 @@
----
-title: Workload Attestation
-description: An overview of the Teleport Workload Identity Workload Attestation feature.
----
-
-Workload Attestation is the process completed by `tbot` to assert the identity
-of a workload that has connected to the Workload API and requested certificates.
-The information gathered during attestation is used to decide which, if any,
-SPIFFE IDs should be encoded into an SVID and issued to the workload.
-
-Workload Attestors are the individual components that perform this attestation.
-They use the process ID of the workload to gather information about the workload
-from platform-specific APIs. For example, the Kubernetes Workload Attestor
-queries the local Kubelet API to determine which Kubernetes pod the process
-belongs to.
-
-The result of the attestation process is known as attestation metadata. This
-attestation metadata is referred to by the rules you configured for `tbot`'s
-Workload API service. For example, you may state that only workloads running in
-a specific Kubernetes namespace should be issued a specific SPIFFE ID.
-
-Additionally, this metadata is included in the log messages output by `tbot`
-when it issues an SVID. This allows you to audit the issuance of SVIDs and
-understand why a specific SPIFFE ID was issued to a workload.
-
-## Unix
-
-The Unix Workload Attestor is the most basic attestor and allows you to restrict
-the issuance of SVIDs to specific Unix processes based on a range of criteria.
-
-### Attestation Metadata
-
-The following metadata is produced by the Unix Workload Attestor and is
-available to be used when configuring rules for `tbot`'s Workload API service:
-
-| Field             | Description                                                                  |
-|-------------------|------------------------------------------------------------------------------|
-| `unix.attested`   | Indicates that the workload has been attested by the Unix Workload Attestor. |
-| `unix.pid`        | The process ID of the attested workload.                                     |
-| `unix.uid`        | The effective user ID of the attested workload.                              |
-| `unix.gid`        | The effective primary group ID of the attested workload.                     |
-
-### Support for non-standard procfs mounting
-
-To resolve information about a process from the PID, the Unix Workload Attestor
-reads information from the procfs filesystem. By default, it expects procfs to
-be mounted at `/proc`.
-
-If procfs is mounted at a different location, you must configure the Unix
-Workload Attestor to read from that alternative location by setting the
-`HOST_PROC` environment variable.
-
-This is a sensitive configuration option, and you should ensure that it is
-set correctly or not set at all. If misconfigured, an attacker could provide
-falsified information about processes, and this could lead to the issuance of
-SVIDs to unauthorized workloads.
-
-## Kubernetes
-
-The Kubernetes Workload Attestor allows you to restrict the issuance of SVIDs
-to specific Kubernetes workloads based on a range of criteria.
-
-It works by first determining the pod ID for a given process ID and then by
-querying the local kubelet API for details about that pod.
-
-### Attestation Metadata
-
-The following metadata is produced by the Kubernetes Workload Attestor and is
-available to be used when configuring rules for `tbot`'s Workload API service:
-
-| Field                        | Description                                                                        |
-|------------------------------|------------------------------------------------------------------------------------|
-| `kubernetes.attested`      | Indicates that the workload has been attested by the Kubernetes Workload Attestor. |
-| `kubernetes.namespace`       | The namespace of the Kubernetes Pod.                                               |
-| `kubernetes.service_account` | The service account of the Kubernetes Pod.                                         |
-| `kubernetes.pod_name`        | The name of the Kubernetes Pod.                                                    |
-
-### Deployment Guidance
-
-To use Kubernetes Workload Attestation, `tbot` must be deployed as a daemon
-set. This is because the unix domain socket can only be accessed by pods on the
-same node as the agent. Additionally, the daemon set must have the `hostPID`
-property set to `true` to allow the agent to access information about
-processes within other containers.
-
-The daemon set must also have a service account assigned that allows it to query
-the Kubelet API. This is an example role with the required RBAC:
-
-```yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: tbot
-rules:
-  - resources: ["pods","nodes","nodes/proxy"]
-    apiGroups: [""]
-    verbs: ["get"]
-```
-
-Mapping the Workload API Unix domain socket into the containers of workloads
-can be done in two ways:
-
-- Directly configuring a hostPath volume for the `tbot` daemonset and workloads
-  which will need to connect to it.
-- Using [spiffe-csi-driver](https://github.com/spiffe/spiffe-csi).
-
-Example manifests for required Kubernetes resources:
-
-```yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: tbot
-rules:
-  - resources: ["pods","nodes","nodes/proxy"]
-    apiGroups: [""]
-    verbs: ["get"]
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: tbot
-subjects:
-  - kind: ServiceAccount
-    name: tbot
-    namespace: default
-roleRef:
-  kind: ClusterRole
-  name: tbot
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tbot
-  namespace: default
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tbot-config
-  namespace: default
-data:
-  tbot.yaml: |
-    version: v2
-    onboarding:
-      join_method: kubernetes
-      # replace with the name of a join token you have created.
-      token: example-token
-    storage:
-      type: memory
-    # ensure this is configured to the address of your Teleport Proxy Service.
-    proxy_server: example.teleport.sh:443
-    services:
-      - type: spiffe-workload-api
-        listen: unix:///run/tbot/sockets/workload.sock
-        attestor:
-          kubernetes:
-            enabled: true
-            kubelet:
-              # skip verification of the Kubelet API certificate as this is not
-              # usually issued by the cluster CA.
-              skip_verify: true
-        # replace the svid entries with the SPIFFE IDs that you wish to issue,
-        # using the `rules` blocks to restrict these to specific Kubernetes
-        # workloads.
-        svids:
-          - path: /my-service
-            rules:
-              - kubernetes:
-                  namespace: default
-                  service_account: example-sa
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: tbot
-spec:
-  selector:
-      matchLabels:
-        app: tbot
-  template:
-    metadata:
-      labels:
-        app: tbot
-    spec:
-      securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-      hostPID: true
-      containers:
-        - name: tbot
-          image: public.ecr.aws/gravitational/tbot-distroless:(=teleport.version=)
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            privileged: true
-          args:
-            - start
-            - -c
-            - /config/tbot.yaml
-            - --log-format
-            - json
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /var/run/secrets/tokens
-              name: join-sa-token
-            - name: tbot-sockets
-              mountPath: /run/tbot/sockets
-              readOnly: false
-          env:
-            - name: TELEPORT_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: KUBERNETES_TOKEN_PATH
-              value: /var/run/secrets/tokens/join-sa-token
-      serviceAccountName: tbot
-      volumes:
-        - name: tbot-sockets
-          hostPath:
-            path: /run/tbot/sockets
-            type: DirectoryOrCreate
-        - name: config
-          configMap:
-            name: tbot-config
-        - name: join-sa-token
-          projected:
-            sources:
-              - serviceAccountToken:
-                  path: join-sa-token
-                  # 600 seconds is the minimum that Kubernetes supports. We
-                  # recommend this value is used.
-                  expirationSeconds: 600
-                  # `example.teleport.sh` must be replaced with the name of
-                  # your Teleport cluster.
-                  audience: example.teleport.sh
-```
-
-## Next steps
-
-- [Workload Identity Overview](./introduction.mdx): Overview of Teleport
-Workload Identity.
-- [Best Practices](./best-practices.mdx): Best practices for using Workload
-Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
-all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/workload-identity.mdx b/docs/pages/enroll-resources/workload-identity/workload-identity.mdx
deleted file mode 100644
index 0f58d4bb583cd..0000000000000
--- a/docs/pages/enroll-resources/workload-identity/workload-identity.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Workload Identity
-description: Securely issue flexible short-lived identities to your workloads
----
-
-<DocCardList />
diff --git a/docs/pages/faq.mdx b/docs/pages/faq.mdx
index 46ead150441dd..5d48f22d538bb 100644
--- a/docs/pages/faq.mdx
+++ b/docs/pages/faq.mdx
@@ -1,12 +1,14 @@
 ---
 title: Teleport FAQ
 description: Frequently Asked Questions About Using Teleport
-h1: Teleport FAQ
+tags:
+  - faq
+  - platform-wide
 ---
 
 This page includes answers to frequently asked questions about setting up,
 managing, and using Teleport. If you are new to Teleport, read our [Getting
-Started Guide](get-started.mdx).
+Started Guide](./get-started/get-started.mdx).
 
 ## Can I use Teleport in production today?
 
@@ -18,7 +20,7 @@ the stability of Teleport from a security perspective.
 ## Can I connect to nodes behind a firewall?
 
 Yes, Teleport supports reverse SSH tunnels out of the box. To configure
-behind-firewall clusters, see [Configure Trusted Clusters](admin-guides/management/admin/trustedclusters.mdx).
+behind-firewall clusters, see [Configure Trusted Clusters](zero-trust-access/deploy-a-cluster/trustedclusters.mdx).
 
 ## How is Teleport's Community Edition different from Enterprise?
 
@@ -72,7 +74,7 @@ look at [Using OpenSSH Guide](enroll-resources/server-access/openssh/openssh-age
 
 ## Can I copy files from one Teleport node to another?
 
-Yes, Teleport supports [Headless WebAuthn authentication](admin-guides/access-controls/guides/headless.mdx),
+Yes, Teleport supports [Headless Authentication](zero-trust-access/authentication/headless.mdx),
 which allows you to perform operations like `tsh ssh` or `tsh scp` from remote systems where you
 are not logged in to Teleport or may not have access to a browser.
 
@@ -105,7 +107,7 @@ Yes. You can copy and paste using a mouse.
 
 ## What TCP ports does Teleport use?
 
-Please refer to our [Networking](./reference/networking.mdx) guide.
+Please refer to our [Networking](reference/deployment/networking.mdx) guide.
 
 ## Does Teleport support authentication via OIDC, SAML, or Active Directory?
 
@@ -122,7 +124,7 @@ To get a new certificate with the new role set, the user will need to log out
 and log back in.
 
 Revocation of Teleport access should be done with Teleport's
-[session and identity locks](./admin-guides/access-controls/guides/locking.mdx),
+[session and identity locks](identity-governance/locking.mdx),
 not by removing roles.
 
 ## Does Teleport support provisioning users via SCIM?
@@ -131,9 +133,14 @@ Teleport supports [SCIM](https://scim.cloud/) provisioning for Okta via the
 hosted Okta integration, available in the Enterprise (Cloud) and Enterprise
 (Self-Hosted) versions of Teleport.
 
-Refer to the [hosted Okta integration guide](./admin-guides/access-controls/okta/okta.mdx)
+Refer to the [hosted Okta integration guide](identity-governance/integrations/okta/okta.mdx)
 for details on setting up and configuring SCIM support.
 
+You can also set up Teleport to integrate with a SCIM provider to automatically
+synchronize SCIM group memberships with Teleport Access Lists. For details, see
+the [SCIM integration
+documentation](identity-governance/integrations/scim/scim.mdx).
+
 ## Why do I see an alert that some agents are out of date?
 
 Teleport monitors the inventory of all cluster components and compares their
@@ -198,4 +205,18 @@ editions of Teleport.
 
 (!docs/pages/includes/teleport-connect-telemetry.mdx!)
 
-If you no longer want to send usage data, see [disabling telemetry](./connect-your-client/teleport-connect.mdx#disabling-telemetry).
+If you no longer want to send usage data, see [disabling telemetry](connect-your-client/teleport-clients/teleport-connect.mdx#disabling-telemetry).
+
+### How do I update my security and business contacts?
+
+Teleport Enterprise Self-Hosted users can configure up to 3 security contacts and 3 business contacts for their cluster. It's important to
+keep these up to date so that we always know who to notify of important updates and alerts.
+
+To do this, log in to your Teleport License dashboard with the email address of the user that created the dashboard initially. Open
+the user dropdown menu on the top right of the navigation bar, and select "Help & Support," then scroll down until you see the contacts sections.
+Once you add a contact, they will receive an invitation email which they must accept within 14 days.
+
+![Web UI view showing security and business contacts options](../img/cloud/security-business-contacts.png)
+
+If you don't see the contacts lists on the Help & Support page, ensure that you are logged into the Teleport License dashboard and not your self-hosted cluster,
+and ensure that your user has the `dashboard-admin` role. Users with the `dashboard-user` role cannot edit contacts.
diff --git a/docs/pages/feature-matrix.mdx b/docs/pages/feature-matrix.mdx
index 40efe790e9152..cbac1abb88ddb 100644
--- a/docs/pages/feature-matrix.mdx
+++ b/docs/pages/feature-matrix.mdx
@@ -1,6 +1,9 @@
 ---
 title: Teleport Feature Matrix
 description: Provides a comparison of features available in Teleport products.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 The Teleport feature matrix lists capabilities of the Teleport Infrastructure
@@ -65,34 +68,35 @@ across distributed infrastructures.
 |  | **Enterprise (Cloud)** | **Enterprise (Self-Hosted)** | **Community Edition** |
 |---|:---:|:---:|:---:|
 |**User identity.** Authenticate users without passwords:||||
-| [Single Sign-On](./admin-guides/access-controls/sso/sso.mdx)| GitHub, Google Workspace, Microsoft Entra ID, Okta, OIDC, SAML, Teleport | GitHub, Google Workspace, Microsoft Entra ID, Okta, OIDC, SAML, Teleport | GitHub |
-| User & Group Provisioning & Deprovisioning (SCIM & Custom Protocols), including Okta and Entra | Available In Teleport Identity Governance | Available In Teleport Identity Governance | ✖ |
-| [Hardware Private Key Support](./admin-guides/access-controls/guides/hardware-key-support.mdx) (e.g., via YubiKey) | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
+| [Single Sign-On](zero-trust-access/sso/sso.mdx)| GitHub, Google Workspace, Microsoft Entra ID, Okta, SailPoint, OIDC, SAML, Teleport | GitHub, Google Workspace, Microsoft Entra ID, Okta, SailPoint, OIDC, SAML, Teleport | GitHub |
+| User & Group Provisioning & Deprovisioning (SCIM & Custom Protocols), including Okta, Microsoft Entra ID, and SailPoint | Available In Teleport Identity Governance | Available In Teleport Identity Governance | ✖ |
+| [Hardware Private Key Support](zero-trust-access/authentication/hardware-key-support.mdx) (e.g., via YubiKey) | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
+| [Per-Session MFA](zero-trust-access/authentication/per-session-mfa.mdx)| ✔ | ✔ | ✔ |
 |**Resource identity.** Assign a cryptographic identity to every Teleport Protected Resource:||||
-| Protecting: [Applications](./enroll-resources/application-access/getting-started.mdx), [Databases](./enroll-resources/database-access/getting-started.mdx), [Kubernetes Clusters](./enroll-resources/kubernetes-access/getting-started.mdx), [Linux Servers](./enroll-resources/server-access/getting-started.mdx), [Windows Servers](./enroll-resources/desktop-access/introduction.mdx), [Windows Desktops](./enroll-resources/desktop-access/introduction.mdx), Cloud Consoles & Resources (AWS, Azure, GCP), [GitHub](./admin-guides/management/guides/github-integration.mdx) | ✔ | ✔ | ✔ (does not include Oracle support) |
+| Protecting: [MCP Servers](./enroll-resources/mcp-access/mcp-access.mdx), [Applications](./enroll-resources/application-access/getting-started.mdx), [Databases](./enroll-resources/database-access/getting-started.mdx), [Kubernetes Clusters](./enroll-resources/kubernetes-access/getting-started.mdx), [Linux Servers](./enroll-resources/server-access/getting-started.mdx), [Windows Servers](./enroll-resources/desktop-access/introduction.mdx), [Windows Desktops](./enroll-resources/desktop-access/introduction.mdx), Cloud Consoles & Resources (AWS, Azure, GCP), [GitHub](enroll-resources/application-access/cloud-apis/github-integration.mdx) | ✔ | ✔ | ✔ (does not include Oracle support) |
 |**Secure remote access.** Zero-trust, auditable access to your infrastructure:||||
 | Dynamic, self-updating inventory | ✔ | ✔ | ✔ |
-| Supports SSH, RDP, Kubernetes, Databases, AWS, Azure, GCP API and CLI, Web applications and services, TCP endpoints for Linux, Windows and MacOS. | ✔ | ✔ | ✔ |
-| [Machines](./enroll-resources/machine-id/machine-id.mdx) and [workloads](./enroll-resources/workload-identity/introduction.mdx#teleport-workload-identity-vs-machine-id) | Available in Teleport Machine & Workload Identity | Available in Teleport Machine & Workload Identity | Available in Teleport Machine & Workload Identity |
+| Supports MCP servers, SSH, RDP, Kubernetes, Databases, AWS, Azure, GCP API and CLI, Web applications and services, TCP endpoints for Linux, Windows and MacOS. | ✔ | ✔ | ✔ |
+| [Machines](machine-workload-identity/machine-workload-identity.mdx) and [workloads](machine-workload-identity/workload-identity/introduction.mdx) | Available in Teleport Machine & Workload Identity | Available in Teleport Machine & Workload Identity | Available in Teleport Machine & Workload Identity |
 | Agentless Integration with [OpenSSH Servers](./enroll-resources/server-access/openssh/openssh-agentless.mdx) | ✔ | ✔ | ✔ |
-| [IP-Based Restrictions](./admin-guides/access-controls/guides/ip-pinning.mdx) | ✔ | ✔ | ✖ |
-| [Teleport VNet](./connect-your-client/vnet.mdx) | ✔ | ✔ | ✔ |
+| [IP-Based Restrictions](zero-trust-access/authentication/ip-pinning.mdx) | ✔ | ✔ | ✖ |
+| [Teleport VNet](connect-your-client/teleport-clients/vnet.mdx) | ✔ | ✔ | ✔ |
 |**Short-lived privileges.** Ephemeral authorization granted through short-lived certificates:||||
-| [Role-Based Access Control](./admin-guides/access-controls/guides/role-templates.mdx) | ✔ | ✔ | ✔ |
-| [Just-in-Time Access Requests & Reviews](./admin-guides/access-controls/access-requests/resource-requests.mdx) | Available in Teleport Identity Governance | Available in Teleport Identity Governance | Only can request roles through CLI  |
+| [Role-Based Access Control](zero-trust-access/rbac-get-started/role-templates.mdx) | ✔ | ✔ | ✔ |
+| [Just-in-Time Access Requests & Reviews](identity-governance/access-requests/resource-requests.mdx) | Available in Teleport Identity Governance | Available in Teleport Identity Governance | Only can request roles through CLI  |
 |**Session recording and interactive controls.** Record, replay, join, and moderate interactive sessions:||||
 | [Session Recording with Playback](./reference/architecture/session-recording.mdx) | ✔ | ✔ | ✔ |
 | [Enhanced Session Recording](./enroll-resources/server-access/guides/bpf-session-recording.mdx) | ✔ | ✔ | ✔ |
-| [Recording Proxy Mode](./enroll-resources/server-access/guides/recording-proxy-mode.mdx) | ✖ | ✔ | ✔ |
+| [Recording Proxy Mode](./reference/architecture/session-recording.mdx#record-at-the-proxy-service) | ✖ | ✔ | ✔ |
 | Live Sessions View | SSH, Kubernetes, Desktops, Databases | SSH, Kubernetes, Desktops, Databases | SSH, Kubernetes, Desktops, Databases |
 | Protocol-Level Events, for all supported resources | ✔ | ✔ | ✔ |
-| [Dual Authorization](./admin-guides/access-controls/guides/dual-authz.mdx) | ✔ | ✔ | ✖ |
-| [Session Sharing & Moderation](./admin-guides/access-controls/guides/joining-sessions.mdx) | ✔ | ✔ | ✖ |
+| [Dual Authorization](identity-governance/access-requests/access-requests.mdx) | ✔ | ✔ | ✖ |
+| [Session Sharing & Moderation](zero-trust-access/authentication/joining-sessions.mdx) | ✔ | ✔ | ✖ |
 |**Identity-based audit events:** ||||
-| [Structured Audit Logs](./reference/monitoring/audit.mdx) | ✔ | ✔ | ✔ |
-| [Export to SIEM](./admin-guides/management/export-audit-events/export-audit-events.mdx) | ✔ | ✔ | ✔ |
+| [Structured Audit Logs](reference/deployment/monitoring/audit.mdx) | ✔ | ✔ | ✔ |
+| [Export to SIEM](zero-trust-access/export-audit-events/export-audit-events.mdx) | ✔ | ✔ | ✔ |
 |**Regulatory standards and frameworks:**||||
-| [FedRAMP Control](./admin-guides/access-controls/compliance-frameworks/fedramp.mdx) | ✖ | ✔ | ✖ |
+| [FedRAMP Control](zero-trust-access/compliance-frameworks/fedramp.mdx) | ✖ | ✔ | ✖ |
 | FIPS-compliant binaries for FedRAMP (Low, Moderate, High) | ✖ | ✔ | ✖ |
 | DORA, SOX, ISO, NIS2, PCI DSS, SOC 2, HIPAA, NIST  | ✔ | ✔ | Limited |
 
@@ -105,7 +109,7 @@ certificates, access control, and auditability.
 |  | **Enterprise (Cloud)** | **Enterprise (Self-Hosted)** | **Community Edition** |
 |---|:---:|:---:|:---:|
 | **Service Discovery:** Live inventory of machine and workload identities for CI/CD jobs, microservices, and others | ✔ | ✔ | ✔ |
-|**Issuance:** Provisions cryptographic identities for [machines](./enroll-resources/machine-id/getting-started.mdx) and [workloads](./enroll-resources/workload-identity/getting-started.mdx), eliminating anonymous computing and the need for static over-privileged users and automating certificate rotation | ✔ | ✔ | ✔ |
+|**Issuance:** Provisions cryptographic identities for [machines](machine-workload-identity/getting-started.mdx) and [workloads](machine-workload-identity/workload-identity/getting-started.mdx), eliminating anonymous computing and the need for static over-privileged users and automating certificate rotation | ✔ | ✔ | ✔ |
 |**Secretless Authentication:** Eliminates the need for API keys and long-term secrets with short-lived certificates.| ✔ | ✔ | ✔ |
 |**Ephemeral Authorization:** With granular ABAC/RBAC for workload interactions | ✔ | ✔ | ✔ |
 |**Auditability:** Audit data, exportable to SIEMs, for compliance reporting & reviews | ✔ | ✔ | ✔ |
@@ -122,15 +126,15 @@ and non-human identities.
 
 |  | **Enterprise (Cloud)** | **Enterprise (Self-Hosted)** | **Community Edition** |
 |---|:---:|:---:|:---:|
-| [JIT Access Requests](./admin-guides/access-controls/guides/dual-authz.mdx): Grant only those privileges necessary to complete the task at hand. Remove the need for super-privileged accounts. | ✔ | ✔ | Only can request roles through CLI  |
+| [JIT Access Requests](identity-governance/access-requests/access-requests.mdx): Grant only those privileges necessary to complete the task at hand. Remove the need for super-privileged accounts. | ✔ | ✔ | Only can request roles through CLI  |
 | Automatic Access Requests & Approvals: Automate pre-defined workflows based on RBAC, ABAC, or context-based authorization. | ✔ | ✔ | ✖ |
-| [Access Lists & Access Reviews](./admin-guides/access-controls/access-lists/access-lists.mdx): Review access requests using Slack, PagerDuty, Microsoft Teams, Jira and ServiceNow. Assign managers, automate mandatory reviews, and implement custom review logic using our API and Go SDK. Integrates with AWS Identity Center. | ✔ | ✔ | ✖ |
-| [Session & Identity Locks](./admin-guides/access-controls/guides/locking.mdx): Lock suspicious or compromised identities and stop all their activity across all protocols and services. | ✔ | ✔ | ✖ |
-| [Device Trust](./admin-guides/access-controls/device-trust/guide.mdx): Require an up-to-date, registered device for each authentication. Teleport uses TPMs and secure enclaves to give every device a cryptographic identity. Restrict further by resource or MDM-authorization. | ✔ | ✔ | ✖ |
-| User & Group Provisioning & Deprovisioning (SCIM & Custom Protocols), including Okta and Entra | ✔ | ✔ | ✖ |
-| [Access Monitoring & Response](./admin-guides/access-controls/access-monitoring.mdx): Detect overly broad privileges and inspect sessions that are not using strong protection, such as multi-factor authentication or device trust. Alert on access violations and purge unused permissions with automated access rules. | ✔ | ✔ | ✖ |
-| [Okta integration](./admin-guides/access-controls/okta/okta.mdx): Configure Teleport to import and grant access to Okta applications and user groups. | ✔ | ✔ | ✖ |
-| Microsoft Entra ID directory synchronization and SSO [integration](./admin-guides/access-controls/sso/azuread.mdx) | ✔ | ✔ | ✖ |
+| [Access Lists & Access Reviews](identity-governance/access-lists/access-lists.mdx): Review access requests using Slack, PagerDuty, Microsoft Teams, Jira and ServiceNow. Assign managers, automate mandatory reviews, and implement custom review logic using our API and Go SDK. Integrates with AWS Identity Center. | ✔ | ✔ | ✖ |
+| [Session & Identity Locks](identity-governance/locking.mdx): Lock suspicious or compromised identities and stop all their activity across all protocols and services. | ✔ | ✔ | ✖ |
+| [Device Trust](identity-governance/device-trust/guide.mdx): Require an up-to-date, registered device for each authentication. Teleport uses TPMs and secure enclaves to give every device a cryptographic identity. Restrict further by resource or MDM-authorization. | ✔ | ✔ | ✖ |
+| User & Group Provisioning & Deprovisioning (SCIM & Custom Protocols), including Okta, Microsoft Entra ID, and SailPoint | ✔ | ✔ | ✖ |
+| [Access Monitoring & Response](identity-governance/access-monitoring.mdx): Detect overly broad privileges and inspect sessions that are not using strong protection, such as multi-factor authentication or device trust. Alert on access violations and purge unused permissions with automated access rules. | ✔ | ✔ | ✖ |
+| [Okta integration](identity-governance/integrations/okta/okta.mdx): Configure Teleport to import and grant access to Okta applications and user groups. | ✔ | ✔ | ✖ |
+| Microsoft Entra ID directory synchronization and SSO [integration](zero-trust-access/sso/integrate-idp/entra-id.mdx) | ✔ | ✔ | ✖ |
 
 ## Teleport Identity Security
 
@@ -143,7 +147,9 @@ and non-human identities.
 | Discover standing privileges  | ✔ | ✔ | ✖ |
 | Analyze  shadow access and drift of security posture | ✔ | ✔ | ✖ |
 | Investigate identity vulnerabilities and potential exposures | ✔ | ✔ | ✖ |
-| Monitor critical assets with [Crown Jewel](./admin-guides/teleport-policy/crown-jewels.mdx) Alerting | ✔ | ✔ | ✖ |
+| Monitor critical assets with [Crown Jewel](identity-security/usage/crown-jewels.mdx) Alerting | ✔ | ✔ | ✖ |
+| [Session Recording Summaries](identity-security/session-summaries.mdx) | ✔ | ✔ | ✖ |
+| Identity Activity Center | ✖ | ✔ | ✖ |
 
 ## Platform integrations, management, licensing, and deployment
 
@@ -155,12 +161,12 @@ and non-human identities.
 | Security Information & Event Management (SIEM): Elastic, Splunk, Panther, and anything else that integrates with Fluentd | ✔ | ✔ | ✔ |
 | ITSM: ServiceNow, JIRA | ✔ | ✔ | ✖ |
 | Access Request Integration: Slack, Teams, Discord, Mattermost, PagerDuty, Opsgenie, Email | ✔ | ✔ | ✔ |
-| [Hardware Private Key Support](./admin-guides/access-controls/guides/hardware-key-support.mdx) (e.g., via YubiKey) | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
-| [Hardware Security Module support](./admin-guides/deploy-a-cluster/hsm.mdx) for encryption at rest | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
+| [Hardware Private Key Support](zero-trust-access/authentication/hardware-key-support.mdx) (e.g., via YubiKey) | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
+| [Hardware Security Module support](zero-trust-access/deploy-a-cluster/hsm.mdx) for encryption at rest | ✔ (External-connected HSM/KMS coming soon) | ✔ | ✖ |
 | **Management and licensing:** ||||
 | Annual or multi-year contracts, volume discounts | ✔ | ✔ | ✖ |
 | Anonymized Usage Tracking | ✔ | ✔ | Opt-in |
-| [Backend support](./reference/backends.mdx) | All data is stored in DynamoDB and S3 with server-side encryption. | Any S3-compatible storage for session records, many managed backends for custom audit log storage | Any S3-compatible storage for session records, many managed backends for custom audit log storage. |
+| [Backend support](reference/deployment/backends.mdx) | All data is stored in DynamoDB and S3 with server-side encryption. | Any S3-compatible storage for session records, many managed backends for custom audit log storage | Any S3-compatible storage for session records, many managed backends for custom audit log storage. |
 | Multi-region failover using Cockroach DB | ✔ | ✔ | ✖ |
 | Data storage location | Data is stored in Teleport's AWS infrastructure with audit logs/sessions optionally in customer AWS accounts. Proxy Service instances are deployed across the world for low-latency access. | Can store data anywhere in the world, on most managed cloud backends | Can store data anywhere in the world, on most managed cloud backends |
 | License | Commercial | Commercial | Commercial for binaries, with restrictions: Free usage for companies with \<100 employees and \<US$10M annual revenue. Code on GitHub distributed via AGPL-3.0  |
@@ -170,6 +176,6 @@ and non-human identities.
 | **Deployment options:** ||||
 | Teleport cloud deployment | ✔ | ✖ | ✖ |
 | Self-hosted deployment| ✖ | ✔ | ✔ |
-| Multi-Region High Availability | ✔ (Teleport service) | ✔ (Customer-implemented, via a [supported blueprint](./admin-guides/deploy-a-cluster/multi-region-blueprint.mdx)) | ✖ |
+| Multi-Region High Availability | ✔ (Teleport service) | ✔ (Customer-implemented, via a [supported blueprint](zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint.mdx)) | ✖ |
 | FIPS-compliant binaries available for FedRAMP, including Low, Moderate & High | ✖ | ✔ | ✖ |
 
diff --git a/docs/pages/get-started.mdx b/docs/pages/get-started.mdx
deleted file mode 100644
index e0e867a6cc622..0000000000000
--- a/docs/pages/get-started.mdx
+++ /dev/null
@@ -1,250 +0,0 @@
----
-title: "Get Started with Teleport"
-description: "Shows you how to set up a Teleport Enterprise (Cloud) account and protect your first resource with Teleport."
-tocDepth: 3
----
-
-Teleport Enterprise helps organizations provide secure access to their
-infrastructure with minimal configuration and cluster management. 
-
-After you start a [free trial](https://goteleport.com/signup) of Teleport
-Enterprise (Cloud), you can set up role-based access control (RBAC), enable
-single sign-on, and prevent unauthorized use of organization resources.
-
-This guide explains how to register a local server with a Teleport Enterprise
-(Cloud) account. After you register the server, you can access it through the
-Teleport Web UI in a browser or using the terminal. You can also record your
-sessions, so you can review them later.
-
-## How it works
-
-With Teleport Enterprise (Cloud), the Teleport Auth Service and Teleport Proxy
-Service are managed for you as cloud-based services. These services provide you
-with immediate access to a scalable and fault-tolerant certificate authority and
-reverse proxy that you don't need to manage or maintain. You can focus on
-enrolling the resources you want to protect and configuring secure role-based
-access for private and public networks across the globe.
-
-## Prerequisites
-
-- A Teleport Enterprise (Cloud) account. You can sign up for a free trial at the
-  following page:
-
-  https://goteleport.com/signup/
-
-  After you sign up, you receive an email invitation to activate your account.
-  Use this account to authenticate your identity when you access the Teleport
-  Enterprise (Cloud) cluster.
-
-- For following this guide, Docker installed on your workstation. 
-
-  This guide illustrates how to register a server with Teleport Enterprise Cloud
-  using a Docker container and the Teleport SSH Service. Docker is only required
-  for the local demo environment used in this guide. You can find installation
-  instructions for Docker on [Docker's
-  website](https://docs.docker.com/get-docker/). If you want to register servers
-  in Teleport without using Docker, see the getting started guide for
-  [server access](enroll-resources/server-access/getting-started.mdx).
-
-- The `tsh` client tool. `tsh` is included in the same packages and archives as
-  the `teleport` binary. See the [Installation Guide](installation.mdx) for how
-  to install Teleport on your operating system.
-  
-  This guide only requires the `tsh` client tool to access a server from a
-  terminal. If you don't install the `tsh` client tool, you can access the
-  server in Teleport Enterprise (Cloud) using the Web UI through your browser.
-
-## Step 1/5. Spin up a server
-
-To spin up a new server using Docker:
-
-1. Open a terminal on your workstation.
-
-1. Start a Docker container on your workstation to prepare a server that you want enroll 
-as a resource in your Teleport Enterprise (Cloud) cluster:
-   
-   ```code
-   $ docker run --interactive --tty ubuntu:24.04 /bin/bash
-   ```
-   
-   This command starts a new shell session in a container running Ubuntu 24.04.
-
-1. Run the following command to install `curl` and `telnet` from the package management repository:
-   
-   ```code
-   $ apt update && apt install -y curl telnet
-   ```
-   
-   The script that installs Teleport in this guide requires both `curl` and `telnet` to be installed.
-   
-   Keep the new shell open in your terminal.
-
-## Step 2/5. Install the Teleport SSH Service
-
-To install the Teleport SSH Service on your server:
-
-1. Open a browser and go to the address for your Teleport cluster. For example,
-   if your Teleport account is `example`, open `https://example.teleport.sh`.
-
-1. Sign in with the credentials you used to activate your Teleport account.
-   
-   The first time you sign in, you are prompted to add your first resource: 
-   
-   ![Add your first resource](../img/cloud/getting-started/add-my-first-resource@2x.png)
-
-1. Click **Add my first resource**, and you will see the option to enroll
-   resources in your Teleport cluster.
-
-1. Type *server* in the search box to filter the list of resources:
-   
-   ![Select resource type](../img/cloud/getting-started/choose-resource@2x.png)
-
-1. Click **Ubuntu 18.04+** to register the server in the Docker container.
-   
-   After you select the resource type, the Web UI prompts you for your
-   multi-factor authentication device, then displays a script to install and
-   configure the Teleport SSH Service. For example:
-   
-   ![Configure resource](../img/cloud/getting-started/paste-script@2x.png)
-   
-1. The Teleport installation script uses `sudo`, which is not installed on your
-   Docker container. Before copying the command to run the installation script,
-   you need to alias `sudo` in the container terminal shell session.
-
-   In the terminal with the container shell session, alias `sudo` by running 
-the following command:
-   
-   ```code
-   $ alias sudo=""
-   ```
-
-1. Copy the command to run the installation script from the Teleport Web UI and paste it 
-into the container shell session.
-   
-   Leave the script running in the shell. After Teleport is installed on the server, 
-   you'll see a message in the Web UI that your new Teleport instance was successfully detected:
-   
-   ![Connected successfully](../img/cloud/getting-started/successfully-connected@2x.png)
-   
-   To continue, click **Next**.
-
-1. Confirm that you want to authenticate as the `root` user and click **Next**:
-   
-   ![Choose your user](../img/cloud/getting-started/set-up-access@2x.png)
-
-1. Respond to the MFA prompt again, then click **Test Connection** to verify
-   access to the server.
-   
-   ![Start session](../img/cloud/getting-started/test-connection@2x.png)
-
-## Step 3/5. Start a session
-
-To start a session on the server you just added to Teleport:
-
-1. Click **Start Session** to start an interactive session.
-   
-   You should see a terminal prompt in a new browser window. Your Teleport 
-   account routes your SSH connection through the Teleport Proxy Service, which
-   connects to your container through a reverse tunnel. 
-   Reverse tunnels allow Teleport to manage access to resources like Kubernetes 
-   clusters and remote desktops, even if these resources are running on private networks.
-      
-   If you get an error connecting to your container, interrupt the `teleport` process in 
-   the container shell with **Ctrl-C**, then run `teleport start` to restart the process.
-       
-1. Execute some commands in your terminal. 
-
-1. Enter the `exit` command to end the remote interactive session. Close the
-   browser tab.
-
-1. In the last step of **Enroll New Resource**, click **Finish**.
-
-1. Click **Browse existing resources** to see your new server listed in the Teleport Web UI.
-
-## Step 4/5. Play back your session
-
-As Teleport proxies SSH connections to registered servers, it records the
-commands that users execute during their sessions so operators can play them
-back later to investigate issues.
-
-To play back a session in the Teleport Web UI:
-
-1. Find the left sidebar and navigate to **Audit > Session Recordings**.
-
-1. In the sidebar, under **Activity**, click **Session Recordings**.
-   
-   You will see the recording for your interactive session from the previous
-   step listed.  For example:
-   
-   ![Session
-   recordings](../img/cloud/getting-started/session-recordings@2x.png)
-
-1. Click **Play** to see a full recording of your session.
-
-## Step 5/5. Access the server from the command line
-
-To access the server using commands in a terminal:
-
-1. Open a new terminal window.
-
-1. Sign in to your Teleport cluster by running the `tsh login` command  with the
-   URL of your cluster and the name of your Teleport user, assigning 
-   <Var name="example" /> to your account subdomain and <Var name="username" /> to
-   your Teleport username:
-   
-   ```code
-   $ tsh login --proxy=<Var name="example" />.teleport.sh --user=<Var name="username" />
-   ```
-   
-   When prompted, authenticate using your password, authenticator app, or hardware key.
-   The command displays information about your Teleport cluster and account. For example:
-   
-   ```code
-   > Profile URL:      https://example.teleport.sh:443
-     Logged in as:       admin@teleport.example.com
-     Cluster:            example.teleport.sh
-     Roles:              access, auditor, editor
-     Logins:             root
-     Kubernetes:         enabled
-     Valid until:        2023-07-08 01:35:20 -0700 PDT [valid for 12h0m0s]
-     Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
-   ```
-
-1. List the servers your Teleport user can access. 
-   
-   ```code
-   $ tsh ls
-   ```
-
-   You should see the name of the container you just registered. For example:
-    
-   ```code
-   Node Name    Address    Labels
-   ------------ ---------  ----------------------------------------------------------------------------------------
-   b6c1072b5af5 ⟵ Tunnel  
-   ```
-
-1. Access your server as the `root` user, assigning <Var name="node-name" /> to
-   the name of the server as displayed by `tsh ls`:
-
-   ```code
-   $ tsh ssh root@<Var name="node-name" />
-   ```
-
-## Next steps
-
-This guide introduced how you can use Teleport Enterprise (Cloud) to protect your
-infrastructure by demonstrating how to register a server with your Teleport
-cluster. 
-
-You can provide secure access to more of your infrastructure through Teleport by
-deploying one or more Teleport **Agents** and configuring role-based access
-control for users. 
-
-Agents proxy traffic to all of your infrastructure resources—including servers,
-databases, Kubernetes clusters, cloud provider APIs, and Windows desktops.
-Role-based access control ensures that only authorized users are allowed access
-to those resources.
-
-To learn more information about deploying agents, see [Deploy Teleport Agents 
-with Terraform](admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx).
diff --git a/docs/pages/get-started/access.mdx b/docs/pages/get-started/access.mdx
new file mode 100644
index 0000000000000..0b0bf278478e4
--- /dev/null
+++ b/docs/pages/get-started/access.mdx
@@ -0,0 +1,65 @@
+---
+title: "Step 3 - Set Up Access Controls"
+description: "Configure identity-based access controls in your Teleport cluster."
+toc_max_heading_level: 2
+tags:
+  - get-started
+---
+
+import Button from '@site/src/components/Button';
+import Icon from '@site/src/components/Icon';
+
+Teleport uses **Role-Based Access Control (RBAC)** to determine who can access what across your infrastructure.
+
+Every Teleport user is assigned one or more roles. These roles define the user's permissions, such as:
+
+- What infrastructure resources they can access
+- Whether they can request temporary access
+- Whether they can edit cluster settings or view session recordings
+
+You can assign roles when creating users or manage them later in the Teleport Web UI.
+
+## Preset roles
+
+You were able to connect to your Ubuntu server in Step 2 because of the preset roles assigned to your user account when you created your cluster.
+
+To see which roles you currently have:
+
+1. In the Teleport Web UI, navigate to **Zero Trust Access** > **Users**
+2. Find your user, select **Options** > **Edit**
+3. Under **User Roles**, you'll see the roles assigned to you
+
+You likely have at least the `access` and `editor` roles assigned. The `access` role is what granted you permission to SSH into your server.
+
+Teleport includes several preset roles to help you get started:
+
+| **Role**                      | **Description**                                                                 |
+|------------------------------|---------------------------------------------------------------------------------|
+| `access`                     | Grants access to infrastructure resources.                                     |
+| `editor`                     | Allows editing cluster configuration (e.g., roles, connectors).                |
+| `auditor`                    | Grants read-only access to audit logs, events, and session recordings.         |
+
+<details>
+<summary>View the full list of preset roles including Enterprise</summary>
+
+(!docs/pages/includes/preset-roles-table.mdx!)
+
+</details>
+
+You can view all available roles by navigating to **Zero Trust Access** > **Roles** in the Web UI.
+
+## Custom roles
+
+Organizations often require custom roles to enforce least-privilege access and follow internal security policies. By creating custom roles, you can align Teleport's access controls with your company's structure and security policies.
+
+For instructions on creating custom roles and assigning roles to users, follow along with our [Getting Started with Teleport Access Controls](../zero-trust-access/rbac-get-started/role-demo.mdx) demo guide. 
+
+For mapping SSO users to roles, refer to our guide on [Configuring Single Sign-On](../zero-trust-access/sso/sso.mdx#how-teleport-uses-sso) for more information.
+
+## Next steps
+
+In the final step of the Getting Started guide, we'll cover how to monitor activity and use audit logs to strengthen security and ensure compliance.
+
+<div style={{ marginTop: 'var(--m-4)' }}>
+  <Button style={{ padding: '0 var(--m-2)' }} as="link" href="../audit/" variant="primary" shape="lg">Step 4 - Monitor Audit Logs <Icon name="arrowRight" inline size="sm"/> </Button>
+</div>
\ No newline at end of file
diff --git a/docs/pages/get-started/audit.mdx b/docs/pages/get-started/audit.mdx
new file mode 100644
index 0000000000000..3907bcd6dbf76
--- /dev/null
+++ b/docs/pages/get-started/audit.mdx
@@ -0,0 +1,98 @@
+---
+title: "Step 4 - Monitor Audit Logs"
+description: "Explore audit logging features in your Teleport cluster."
+toc_max_heading_level: 2
+tags:
+  - get-started
+---
+
+import Icon from '@site/src/components/Icon';
+
+Teleport logs cluster activity by emitting various events into its audit log.
+
+This can be viewed in the Teleport Web UI by clicking on **Audit** > **Audit Log** in the left sidebar.
+
+Here you'll see events like successful logins along with metadata such as event type, remote IP address, timestamp, and the identity involved. Click on **Details** to see the complete event information in JSON format.
+
+![View audit log](../../img/get-started/get-started-audit-log@2x.png)
+
+## View your SSH session recording
+
+In addition to recording structured events in its audit log, Teleport can also capture full session recordings for SSH, desktop, or Kubernetes shell sessions.
+
+Remember when you connected to your Ubuntu server via SSH in Step 2? That entire session was recorded.
+
+To view the recording:
+
+1. Click on **Audit** > **Session Recordings** in the left sidebar
+2. Find your recent SSH session to your Ubuntu server
+3. Click the **Play** button to watch a full playback of everything you typed and the server's responses
+
+This is especially useful for security audits, compliance requirements, and troubleshooting.
+
+For a more in-depth look at how Teleport's audit system works, including event types and descriptions, storage options, and exporting events, see our [Audit Events and Records guide](../reference/deployment/monitoring/audit.mdx).
+
+
+## What's next?
+
+You've now explored the core steps of getting started with Teleport. However, this is only skimming the surface of what Teleport has to offer.
+
+### Enroll other resource types
+
+In this guide, you enrolled an Ubuntu Linux server. Teleport supports many other resource types that you can enroll using similar workflows:
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="applications" size="xl" />,
+      to: "../../enroll-resources/application-access/",
+      name: "Applications",
+    },
+    {
+      icon: <Icon name="linuxServers" size="xl" />,
+      to: "../../enroll-resources/server-access/",
+      name: "Linux Servers",
+    },
+    {
+      icon: <Icon name="databases" size="xl" />,
+      to: "../../enroll-resources/database-access/",
+      name: "Databases",
+    },
+    {
+      icon: <Icon name="kubernetesClusters" size="xl" />,
+      to: "../../enroll-resources/kubernetes-access/",
+      name: "Kubernetes Clusters",
+    },
+    {
+      icon: <Icon name="windowsDesktops" size="xl" />,
+      to: "../../enroll-resources/desktop-access/",
+      name: "Windows Desktops",
+    },
+    {
+      icon: <Icon name="autoDiscovery" size="xl" />,
+      to: "../../enroll-resources/auto-discovery/",
+      name: "Auto-Discovery of Resources",
+    },
+    {
+      icon: <Icon name="cloudProviders" size="xl" />,
+      to: "../../enroll-resources/application-access/cloud-apis/",
+      name: "Cloud Providers",
+    },
+    {
+      icon: <Icon name="mcpAndAi" size="xl" />,
+      to: "../../enroll-resources/mcp-access/",
+      name: "MCP and AI Agents",
+    },
+  ]}
+/>
+
+### Explore additional features
+
+You can use the search above to locate content that best fits your specific situation or scroll through our many product use cases listed on our [documentation homepage](../index.mdx).
+
+Here are a few places to start:
+
+- Explore just-in-time access with [Access Requests](../identity-governance/access-requests/access-requests.mdx) or longer-term, auditable access management with [Access Lists](../identity-governance/access-lists/access-lists.mdx)
+- Automate onboarding using [Terraform](../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx) or the [Kubernetes Operator](../zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx)
+- Integrate Teleport with your [SSO provider](../zero-trust-access/sso/sso.mdx) or even configure Teleport as an [IDP](../identity-governance/idps/idps.mdx)
+- Learn how to use [Teleport's API libraries](../zero-trust-access/api/api.mdx) to automate setup tasks such as registering agents with an external service discovery API, generating roles from an external RBAC system, or writing [Access Request plugins](../identity-governance/access-requests/plugins/plugins.mdx).
\ No newline at end of file
diff --git a/docs/pages/get-started/connect.mdx b/docs/pages/get-started/connect.mdx
new file mode 100644
index 0000000000000..ff11f1be93139
--- /dev/null
+++ b/docs/pages/get-started/connect.mdx
@@ -0,0 +1,124 @@
+---
+title: "Step 2 - Connect Infrastructure"
+description: "Enroll the resources you want to protect with your Teleport cluster."
+toc_max_heading_level: 2
+tags:
+  - get-started
+---
+
+import Button from '@site/src/components/Button';
+import Icon from '@site/src/components/Icon';
+
+After deploying your Teleport cluster, the next step is to enroll the infrastructure resources you want to secure.
+
+Teleport supports a wide range of resource types, including Linux servers, MCP servers,Kubernetes clusters, databases, internal web apps, and cloud provider APIs. You can enroll these through the Teleport Web UI's guided setup workflows.
+
+## Demo: Enroll an Ubuntu server
+
+To help you understand the enrollment process, let's walk through enrolling an Ubuntu Linux server as a hands-on example.
+
+**What you'll need for this demo:**
+
+- An Ubuntu Linux server that you can SSH into (physical server, VM or cloud instance like EC2, or homelab server), OR
+- Docker installed on your workstation (to create a temporary demo server)
+
+If you don't have an Ubuntu server available, expand the section below for instructions to create a demo server using Docker.
+
+<details>
+  <summary>Create a demo Ubuntu server with Docker</summary>
+
+  To follow along with this guide, you can spin up a new Ubuntu server using Docker:
+
+1. Open a terminal on your workstation.
+
+1. Start a Docker container to create a server that you can enroll as a resource in your Teleport cluster:
+
+   ```code
+   $ docker run --interactive --tty ubuntu:24.04 /bin/bash
+   ```
+
+   This command starts a new shell session in a container running Ubuntu 24.04.
+
+1. Run the following command to install `curl` and `telnet`:
+
+   ```code
+   $ apt update && apt install -y curl telnet
+   ```
+
+   The Teleport installation script requires both `curl` and `telnet` to be installed.
+
+1. Create an alias for `sudo` since it's not installed on the Docker container:
+
+   ```code
+   $ alias sudo=""
+   ```
+
+   The Teleport installation script uses `sudo`, so this alias allows the script to run without errors.
+
+   Keep this shell open. You'll use it in the next steps.
+
+</details>
+
+### Enroll your Ubuntu server
+
+You can enroll resources through the Teleport Web UI using guided setup workflows.
+
+![Enroll a resource](../../img/get-started/get-started-enroll-resources@2x.png)
+
+Follow these steps to enroll your Ubuntu Linux server:
+
+1. In the Teleport Web UI, click **Enroll New Resource**, or navigate to **Add New** > **Resource** in the left sidebar.
+2. Select **Ubuntu** from the list of resource types.
+3. (Optional) Add labels like `env: staging` or `cloud: aws` for filtering or restricting access later.
+4. Run the install script that Teleport provides on your Ubuntu server (or in your Docker container) to install the Teleport SSH Service. 
+5. Wait for the installation to complete. You should see a notification in the Teleport Web UI confirming the agent was successfully detected.
+6. Add `ubuntu` as an OS user you will use to connect to the server and test your connection to verify that the server is accessible before you finish the guided setup.
+
+Now you'll see your Ubuntu server listed under Resources in your Teleport Web UI. Click on the Connect button to SSH into the server.
+
+<Checkpoint
+  title="Verify server enrollment"
+  description="Confirm that your Ubuntu server appears in the Teleport Web UI and that you can connect to it via SSH."
+>
+  Here are some troubleshooting tips:
+  - If the server doesn't appear, verify the Teleport Agent is running on the server with `systemctl status teleport`.
+  - Ensure the server can reach your Teleport cluster over the network (check firewalls and security groups).
+  - Check the agent logs for errors: `journalctl -u teleport`.
+</Checkpoint>
+
+<details>
+  <summary>How does passwordless SSH work?</summary>
+
+When you click **Connect** and choose the `ubuntu` user, here's what happens under the hood:
+
+1. **Short-lived certificate authentication** - Teleport's Auth Service uses the short-lived identity certificate it issued when you logged in (typically valid for 12 hours). This certificate is signed by Teleport's internal Certificate Authority (CA) and includes your roles and allowed logins, defining exactly what you can access.
+2. **The server trusts Teleport's CA** - When the Ubuntu server was enrolled, the Teleport Agent configured it to trust certificates signed by Teleport's CA instead of static SSH keys.
+3. **Certificate-based access** - Your client presents that certificate, the server validates it against the trusted CA, and access is granted, with authorization enforced by the roles encoded in your certificate.
+
+Teleport handles all the PKI complexity behind the scenes with automatic certificate issuance and expiration.
+
+</details>
+
+### Alternative: Enroll using the CLI
+
+{/* vale messaging.protocol-products = NO */}
+While the Web UI provides a guided experience, you can also enroll servers using the Teleport CLI as demonstrated in the [Server Access Getting Started Guide](../enroll-resources/server-access/getting-started.mdx).
+{/* vale messaging.protocol-products = YES */}
+
+## Enroll other resource types
+
+While this step focuses on Ubuntu servers for demonstration purposes, you can enroll many other resource types through the same Web UI or CLI workflow:
+
+- **Applications** - Internal web apps and cloud provider APIs
+- **Databases** - PostgreSQL, MySQL, MongoDB, and more
+- **Kubernetes clusters** - EKS, GKE, AKS, or self-hosted
+- **Windows Desktops** - RDP access to Windows machines
+- **And more** - See detailed enrollment guides for all resource types at the end of this guide
+
+## Next step: Set up access controls
+
+In the next step of the Getting Started guide, we'll discuss role-based access control (RBAC) so you can control **who** can connect to your newly enrolled server and **what actions** they can take once connected.
+
+<div style={{ marginTop: 'var(--m-4)' }}>
+  <Button style={{ padding: '0 var(--m-2)' }} as="link" href="../access/" variant="primary" shape="lg">Step 3 - Configure Access Controls <Icon name="arrowRight" inline size="sm"/></Button>
+</div>
\ No newline at end of file
diff --git a/docs/pages/get-started/deploy-cloud.mdx b/docs/pages/get-started/deploy-cloud.mdx
new file mode 100644
index 0000000000000..b7622ea7b5328
--- /dev/null
+++ b/docs/pages/get-started/deploy-cloud.mdx
@@ -0,0 +1,31 @@
+---
+title: "Step 1 - Sign up for Teleport Enterprise Cloud"
+description: "Sign up for Teleport Enterprise Cloud and deploy your hosted cluster."
+toc_max_heading_level: 2
+tags:
+  - get-started
+  - platform-wide
+---
+
+import Button from '@site/src/components/Button';
+
+Teleport Enterprise Cloud is the **fastest and easiest way to get started**.  
+
+Infrastructure and certificates are managed for you. All that's left is deploying agents to enroll your resources.
+
+To get started, simply sign up for a 14-day free trial. We'll automatically provision and manage a fully featured Teleport cluster in a dedicated tenant with a unique `example.teleport.sh` domain.
+
+**To deploy your cluster:**
+
+1. Go to [goteleport.com/signup](https://goteleport.com/signup)
+2. Follow the sign-up steps to launch your cluster
+
+When setup is finished, you'll have a production-grade Teleport cluster configured with secure defaults, automatic updates, and built-in scalability.
+
+## Next step: Connect infrastructure
+
+At this point, you've launched your own Teleport Enterprise Cloud cluster and created a user in the process. You can now move on to the next step of connecting your infrastructure.
+
+<div style={{ marginTop: 'var(--m-4)' }}>
+  <Button style={{ padding: '0 var(--m-2)' }} as="link" href="../connect/" variant="primary" shape="lg">Step 2 - Connect infrastructure <Icon name="arrowRight" inline size="sm"/> </Button>
+</div>
\ No newline at end of file
diff --git a/docs/pages/get-started/deploy-community.mdx b/docs/pages/get-started/deploy-community.mdx
new file mode 100644
index 0000000000000..3704b1d38bb2f
--- /dev/null
+++ b/docs/pages/get-started/deploy-community.mdx
@@ -0,0 +1,385 @@
+---
+title: "Step 1 - Deploy Teleport Community Edition"
+description: "Deploy a self-hosted Teleport Community Edition cluster using the Linux demo."
+tags:
+  - get-started
+  - platform-wide
+---
+
+import Button from '@site/src/components/Button';
+
+This guide will walk you through deploying Teleport Community Edition. 
+
+You'll spin up a single-instance Teleport cluster on a Linux server, ideal for small-scale demos or home lab environments. Once deployed, you can move ahead in the guide to connecting your infrastructure, setting up role-based access control (RBAC), and auditing your access.
+
+## How it works
+
+The Teleport cluster consists of two services:
+
+- **Teleport Auth Service:** The certificate authority for your cluster. It
+  issues certificates and conducts authentication challenges. The Auth Service
+  is typically inaccessible outside your private network.
+- **Teleport Proxy Service:** The cluster frontend, which handles user requests,
+  forwards user credentials to the Auth Service, and communicates with Teleport
+  instances that enable access to specific resources in your infrastructure.
+
+![Architecture of the setup you will complete in this
+guide](../../img/linux-server-diagram.png)
+
+You can read more about the architecture of Teleport in the [Core Concepts](../core-concepts.mdx) page.
+
+## Prerequisites
+
+You will need the following to deploy a demo Teleport cluster. If your
+environment doesn't meet the prerequisites, you can get started with Teleport by
+signing up for a [free trial of Teleport Enterprise
+Cloud](https://goteleport.com/signup/) and jumping ahead to [Step 2: Connect infrastructure](./connect.mdx).
+
+Also, if you want to get a feel for Teleport commands and capabilities without setting
+up any infrastructure, take a look at the browser-based [Teleport
+Labs](https://goteleport.com/labs).
+
+As for this guide, you can work through it with either a remote virtual machine (e.g., an Amazon
+EC2 instance) or a local Docker container. Make sure you have met the following
+requirements for your platform:
+
+<Tabs>
+<TabItem label="Remote virtual machine">
+
+- A Linux host with only port `443` open to ingress traffic. You must be able to
+  install and run software on the host. Either configure access to the host via
+  SSH for the initial setup (and open an SSH port in addition to port `443`) or
+  enter the commands in this guide into an Amazon EC2 [user data
+  script](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html),
+  Google Compute Engine [startup
+  script](https://cloud.google.com/compute/docs/instances/startup-scripts), or
+  similar.
+
+You must also have **one** of the following:
+- A registered domain name.
+- An authoritative DNS nameserver managed by your organization, plus an existing
+  certificate authority. If using this approach, ensure that your browser is
+  configured to use your organization's nameserver.
+</TabItem>
+<TabItem label="Local Docker container">
+
+1. Install [mkcert](https://github.com/FiloSottile/mkcert) so you can set up a
+   local certificate authority and create a certificate for running the Teleport
+   Web UI with HTTPS.
+
+1. Install the mkcert CA:
+
+   ```code
+   $ mkcert -install
+   ```
+
+1. Create a directory on your workstation in which to place TLS credentials for
+   Teleport:
+
+   ```code
+   $ mkdir teleport-tls
+   ```
+
+1. Generate a certificate and private key for Teleport:
+
+   ```code
+   $ cd teleport-tls
+   $ mkcert localhost
+   ```
+
+1. Add the mkcert CA certificate to the `teleport-tls` directory so your Docker
+   container can access it:
+
+   ```code
+   $ cp "$(mkcert -CAROOT)/rootCA.pem" .
+   ```
+
+1. Start a local Docker container where you can follow the remaining
+   instructions in this guide:
+
+   ```code
+   $ docker run -it -v .:/etc/teleport-tls -p 3080:443 ubuntu:22.04
+   ```
+
+1. Make sure `curl` is installed on your container:
+
+   ```code
+   $ apt-get update && apt-get install -y curl
+   ```
+
+1. On the container, move the mkcert CA certificate into the directory where
+   your container stores CA certs (installing `curl` sets this up for you). When
+   starting, Teleport verifies its TLS certificate against the CA:
+
+   ```code
+   $ cp /etc/teleport-tls/rootCA.pem /etc/ssl/certs/mkcertCA.pem
+   ```
+
+</TabItem>
+</Tabs>
+
+Finally, you will need a multi-factor authenticator app such as
+[Authy](https://authy.com/download/), [Google
+Authenticator](https://www.google.com/landing/2step/), or
+[1Password](https://support.1password.com/one-time-passwords/).
+
+## Step 1/4. Configure DNS
+
+If you are following this guide with a local Docker container, you can skip to
+[Step 2](#step-24-set-up-teleport-on-your-linux-host).
+
+If you are following this guide with a virtual machine, set up two DNS `A`
+records, each pointing to the IP address of your Linux host. Assuming
+`teleport.example.com` is your domain name, set up records for:
+
+|Domain|Reason|
+|---|---|
+|`teleport.example.com`|Traffic to the Proxy Service from users and services.|
+|`*.teleport.example.com`|Traffic to web applications registered with Teleport. Teleport issues a subdomain of your cluster's domain name to each application.|
+
+## Step 2/4. Set up Teleport on your Linux host
+
+In this step, you will log into your Linux host, download the Teleport binary,
+generate a Teleport configuration file, and start the Teleport Auth Service,
+Proxy Service, and SSH Service on the host.
+
+### Install Teleport
+
+On your Linux host or container, run the following command to install the
+Teleport binary:
+
+```code
+$ curl (=teleport.teleport_install_script_url=) | bash -s (=teleport.version=)
+```
+
+### Configure Teleport
+
+Generate a configuration file for Teleport using the `teleport configure` command.
+This command requires information about a TLS certificate and private key.
+
+The instructions depend on whether you are running Teleport on the public
+internet, a local container, or a private network:
+
+<Tabs>
+
+  <TabItem label="Public internet deployment with Let's Encrypt">
+    Let's Encrypt verifies that you control the domain name of your Teleport cluster
+    by communicating with the HTTPS server listening on port 443 of your Teleport
+    Proxy Service.
+
+    You can configure the Teleport Proxy Service to complete the Let's Encrypt
+    verification process when it starts up.
+
+    On the host where you will start the Teleport Auth Service and Proxy Service,
+    run the following `teleport configure` command. Assign 
+    <Var name="teleport.example.com" /> to the
+    domain name of your Teleport cluster and <Var name="user@example.com" /> to
+    an email address used for notifications (you can use any domain):
+
+    ```code
+    $ sudo teleport configure -o file \
+        --acme --acme-email=<Var name="user@example.com" description="Your email address to register with Let's Encrypt for TLS certificates" /> \
+        --cluster-name=<Var name="teleport.example.com" description="The domain name of your Teleport cluster" />
+    ```
+
+    Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
+  </TabItem>
+  <TabItem label="Docker container">
+
+  The Docker container you started while beginning this guide mounts the
+  `teleport-tls` directory in `/etc/`, including a TLS certificate and private
+  key for Teleport.
+
+  On the container, run the following `teleport configure` command: 
+
+  ```code
+  $ teleport configure -o file \
+      --cluster-name=localhost \
+      --public-addr=localhost:443 \
+      --cert-file=/etc/teleport-tls/localhost.pem \
+      --key-file=/etc/teleport-tls/localhost-key.pem
+  ```
+  </TabItem>
+  <TabItem label="Private network deployment">
+  On your Teleport host, place a valid private key and a certificate chain in `/var/lib/teleport/privkey.pem`
+  and `/var/lib/teleport/fullchain.pem` respectively.
+
+  The leaf certificate must have a subject that corresponds to the domain of your Teleport host, e.g., `*.teleport.example.com`.
+
+  On the host where you will start the Teleport Auth Service and Proxy Service,
+  run the following `teleport configure` command. Assign <Var
+  name="teleport.example.com" /> to the domain name of your Teleport cluster.
+
+  ```code
+  $ sudo teleport configure -o file \
+      --cluster-name=<Var name="teleport.example.com" /> \
+      --public-addr=<Var name="teleport.example.com" />:443 \
+      --cert-file=/var/lib/teleport/fullchain.pem \
+      --key-file=/var/lib/teleport/privkey.pem
+  ```
+  </TabItem>
+</Tabs>
+
+### Start Teleport
+
+1. Start Teleport on your virtual machine or container by following the
+   instructions below:
+
+   <Tabs>
+   <TabItem label="Virtual machine">
+   
+   Enable and start the Teleport systemd service:
+   
+   ```code
+   $ sudo systemctl enable teleport
+   $ sudo systemctl start teleport
+   ```
+   
+   </TabItem>
+   <TabItem label="Local container">
+   
+   Run the following command:
+   
+   ```code
+   $ teleport start --config="/etc/teleport.yaml"
+   ```
+   
+   </TabItem>
+   </Tabs>
+
+1. Access the Teleport Web UI via HTTPS at the domain you created earlier at
+   <Var name="teleport.example.com" /> and accept the terms of using Teleport
+   Community Edition.
+
+   If you are running Teleport on a local Docker container, visit
+   https://localhost:3080.
+
+   You should see a welcome screen similar to the following:
+
+   ![Teleport Welcome Screen](../../img/quickstart/welcome.png)
+
+<Checkpoint
+  title="Verify Teleport is running"
+  description="Confirm that you can access the Teleport Web UI and see the welcome screen."
+>
+  Here are some troubleshooting tips:
+  - Ensure that Teleport is running on your host (`systemctl status teleport` on a VM, or check that the `teleport start` command is still running in your container).
+  - Verify that port 443 (or 3080 for Docker) is accessible and not blocked by a firewall.
+  - Check the Teleport logs for errors: `sudo journalctl -u teleport` on a VM, or review the terminal output in your container.
+</Checkpoint>
+
+## Step 3/4. Create a Teleport user and set up multi-factor authentication
+
+In this step, we'll create a new Teleport user, `teleport-admin`, which is
+allowed to log into SSH hosts as any of the principals `root`, `ubuntu`, or
+`ec2-user`.
+
+1. If you are following this guide on a local container, open another terminal and
+   access your container:
+
+   ```code
+   $ docker exec -it <CONTAINER_ID> /bin/bash
+   ```
+
+1. On your VM or container, run the following command (remove `sudo` if using a
+   local container). `tctl` is a client tool for configuring the Teleport Auth
+   Service:
+
+   ```code
+   $ sudo tctl users add teleport-admin --roles=editor,access --logins=root,ubuntu,ec2-user
+   ```
+
+   The command prints a message similar to the following:
+   
+   ```text
+   User "teleport-admin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+   https://teleport.example.com:443/web/invite/123abc456def789ghi123abc456def78
+   
+   NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
+   ```
+
+   If using a local container, replace the host and port with `localhost:3080`.
+
+1. Visit the provided URL in order to create your Teleport user.
+
+   <Admonition
+     type="tip"
+     title="OS User Mappings"
+   >
+   
+     The users that you specify in the `logins` flag (e.g., `root`, `ubuntu` and
+     `ec2-user` in our examples) must exist on your Linux host. Otherwise, you
+     will get authentication errors later in this tutorial.
+   
+     If a user does not already exist, you can create it with `adduser <login>` or
+     use [host user creation](../enroll-resources/server-access/guides/host-user-creation.mdx).
+   
+     If you do not have the permission to create new users on the Linux host, run
+     `tctl users update teleport-admin --logins=root,ubuntu,ec2-user,$(whoami)` to explicitly allow Teleport to
+     authenticate as the user that you have currently logged in as.
+   
+   </Admonition>
+
+1. Teleport enforces the use of multi-factor authentication by default. It
+   supports one-time passwords (OTP) and multi-factor authenticators (WebAuthn).
+   In this guide, you will need to enroll an OTP authenticator application using
+   the QR code on the Teleport welcome screen.
+
+<details>
+<summary>Logging in via the CLI</summary>
+
+In addition to Teleport's Web UI, you can access resources in your
+infrastructure via the `tsh` client tool.
+
+Install `tsh` on your local workstation:
+
+(!docs/pages/includes/install-tsh.mdx!)
+
+Log in to receive short-lived certificates from Teleport. Replace 
+<Var name="teleport.example.com" /> with your Teleport cluster's public address
+as configured above:
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" /> --user=teleport-admin
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       teleport-admin
+  Cluster:            teleport.example.com
+  Roles:              access, editor
+  Logins:             root, ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-04-26 03:04:46 -0400 EDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+</details>
+
+## Step 4/4. Access your server with Teleport
+
+Now that you have Teleport running and a user configured, you can access your Linux server through the Teleport Web UI (it will be automatically enrolled since Teleport is running on it).
+
+![Teleport Web UI showing an SSH server](../../img/new-ssh-server.png)
+
+Click on `Connect` to access it via the web-based terminal, or use Teleport's [`tsh` CLI tool](../connect-your-client/teleport-clients/tsh.mdx) to SSH into it:
+
+```code
+$ tsh ssh root@<server-name>
+```
+
+<Checkpoint
+  title="Verify server access"
+  description="Confirm that you can authenticate and connect to your Linux server through the Teleport Web UI or via tsh ssh."
+>
+  Here are some troubleshooting tips:
+  - Ensure the user you created has the correct logins assigned (e.g., `root`, `ubuntu`, `ec2-user`) that match existing OS users on the host.
+  - If you receive a permission denied error, verify that the login user exists on the Linux host or create it with `adduser <login>`.
+  - Check that your MFA device is properly enrolled and that you're completing the authentication challenge.
+</Checkpoint>
+
+## Next step: deploy Teleport Agents
+
+At this point, you've launched your own Teleport Community Edition cluster and created a user. You can now move on to the next step of connecting your infrastructure.
+
+<div style={{ marginTop: 'var(--m-4)' }}>
+<Button style={{ padding: '0 var(--m-2)' }} as="link" href="../connect/" variant="primary" shape="lg">Step 2 - Connect infrastructure <Icon name="arrowRight" inline size="sm"/> </Button>
+</div>
+
diff --git a/docs/pages/get-started/get-started.mdx b/docs/pages/get-started/get-started.mdx
new file mode 100644
index 0000000000000..5816a579f8f20
--- /dev/null
+++ b/docs/pages/get-started/get-started.mdx
@@ -0,0 +1,59 @@
+---
+title: "Get Started with Teleport"
+description: "Learn how to deploy a cluster, connect infrastructure, set up access controls, and review audit logs."
+template: no-toc
+tags:
+  - get-started
+---
+
+import Button from '@site/src/components/Button';
+import Icon from '@site/src/components/Icon';
+import TeleportEditionsGrid from '@site/src/components/Pages/GetStarted/TeleportEditionsGrid';
+import TeleportEditionCard from '@site/src/components/Pages/GetStarted/TeleportEditionCard';
+import FeatureMatrixBanner from '@site/src/components/Pages/GetStarted/FeatureMatrixBanner';
+
+Teleport is an identity-based access platform that secures servers, Kubernetes clusters, databases, internal applications, and desktops using short-lived certificates, detailed audit logging, and fine-grained role-based access controls tied to your SSO provider (e.g., Okta, GitHub, Google Workspace).
+
+This guide walks you through four essential steps to get you up and running.
+
+## Choose your Teleport edition
+
+There are several editions of Teleport that differ in their feature sets, deployment options, and support.
+
+Before choosing one, ask yourself:
+
+- Am I looking to evaluate Teleport quickly or explore the full feature set without provisioning infrastructure? → **Enterprise Cloud**
+- Do I need to deploy and manage Teleport in my own environment for compliance reasons? → **Enterprise Self-Hosted**
+- Do I prefer to self-host Teleport locally to test features or use it for free? → **Community Edition**
+
+<TeleportEditionsGrid>
+  <TeleportEditionCard
+    title="Enterprise Cloud"
+    iconName="teleportEnterpriseCloud"
+    href="./deploy-cloud/"
+    subtitle="Managed and hosted by Teleport"
+    id="enterprise-cloud"
+  >
+    <p>We handle infrastructure, upgrades, and certificates. Each customer receives a dedicated .teleport.sh subdomain (e.g., example.teleport.sh).</p>
+  </TeleportEditionCard>
+
+  <TeleportEditionCard
+    title="Enterprise Self-Hosted"
+    iconName="teleportEnterpriseSelfHosted"
+    href="https://goteleport.com/contact-us/"
+    subtitle="Hosted and managed by you"
+    id="enterprise-self-hosted"
+  >
+    <p>A paid plan for organizations requiring strict compliance, with features like FIPS support. A valid license is required, so use this option to contact our team.</p>
+  </TeleportEditionCard>
+
+  <TeleportEditionCard
+    title="Community Edition"
+    iconName="teleportCommunity"
+    href="./deploy-community/"
+    subtitle="Free and open source"
+    id="community-edition"
+  >
+    <p>Includes core features like secure SSH, Kubernetes, databases, and app access. Best for hobbyists, homelabs, or small teams securing small-scale infrastructure.</p>
+  </TeleportEditionCard>
+</TeleportEditionsGrid>
diff --git a/docs/pages/identity-governance/access-lists/access-lists.mdx b/docs/pages/identity-governance/access-lists/access-lists.mdx
new file mode 100644
index 0000000000000..665d7493de3fe
--- /dev/null
+++ b/docs/pages/identity-governance/access-lists/access-lists.mdx
@@ -0,0 +1,22 @@
+---
+title: Access Lists
+description: Use Access Lists in Teleport
+template: "no-toc"
+sidebar_position: 3
+tags:
+ - identity-governance
+enterprise: Identity Governance
+---
+
+Access Lists allow Teleport users to be granted long term access to resources
+managed within Teleport. With Access Lists, administrators and Access List
+owners can regularly audit and control membership to specific roles and
+traits, which then tie easily back into Teleport's existing RBAC system.
+
+[Getting Started with Access Lists](guide.mdx)
+
+[Nested Access Lists](nested-access-lists.mdx)
+
+[Reviewing Access Requests](reviewing-access-requests.mdx)
+
+[Access List Reference](../../reference/access-controls/access-lists.mdx)
diff --git a/docs/pages/identity-governance/access-lists/guide.mdx b/docs/pages/identity-governance/access-lists/guide.mdx
new file mode 100644
index 0000000000000..0566ae8dd1a6f
--- /dev/null
+++ b/docs/pages/identity-governance/access-lists/guide.mdx
@@ -0,0 +1,92 @@
+---
+title: Getting Started with Access Lists
+sidebar_label: Getting Started
+description: Learn how to use Access Lists to manage and audit long lived access to Teleport resources.
+tags:
+ - get-started
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+{/* lint disable page-structure remark-lint */}
+
+This guide will help you:
+- Create an Access List
+- Assign a member to it
+- Verify permissions granted through the list membership
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A user with the preset `editor` role, which will have permissions to create Access Lists.
+
+## Step 1/4. Setting up the Application Service on the cluster for testing
+
+One of the easiest ways to get resources on the cluster for testing is to set up a Teleport Application Service
+instance with the debugging application enabled. To do this, add the following config to your `teleport.yaml`
+configuration:
+
+```yaml
+app_service:
+  enabled: true
+  debug_app: true
+```
+
+And restart Teleport. The "dumper" app should show up in the resource list.
+
+![Debug app](../../../img/access-controls/access-lists/debug-app.png)
+
+## Step 2/4. Create a test user
+
+We need to create a simple test user that has only the `requester` role, which has no default access
+to anything within a cluster. This user will only be used for the purposes of this guide, so you may use
+another user if you so choose. If you would rather use your own user, skip to the next step.
+
+To create a user, first navigate to Zero Trust Access in the left pane and click Users. Click on "Enroll Users" and fill in `test-user` as
+the name and select `requester` as the role.
+
+![Create Test User](../../../img/access-controls/access-lists/create-test-user.png)
+
+Click "Save," and then navigate to the provided URL in order to set up the credentials for your test user.
+Try logging into the cluster with the test user to verify that no resources show up in the resources page.
+
+## Step 3/4. Create an Access List
+
+Next, we'll create a simple Access List that will grant the `access` role to its members.
+Login as the administrative user mentioned in the prerequisites. Click on "Add New" in the left pane, and then "Create an Access List."
+
+![Navigate to create new Access List](../../../img/access-controls/access-lists/create-new-access-list.png)
+
+Here, fill in a title, description, and grant the `access` role. Select a date in the future for the next
+review date.
+
+![Fill out Access List Fields](../../../img/access-controls/access-lists/fill-out-access-list-fields.png)
+
+Under "List Owners" select `editor` as a required role, then add your administrative user under "Add
+Eligible List Owners." By selecting `editor` as a required role, this will ensure that any owner of the list
+must have the `editor` role in order to actually manage the list. If the user loses this role later, they will
+not be able to manage the list, though they will still be reflected as an owner.
+
+![Select an owner](../../../img/access-controls/access-lists/select-owner.png)
+
+Under "Members" select `requester` as a required role, then add your test user to the Access List. Similar to
+the owner requirements, this will ensure that any member of the list must have the `requester` role in order to
+be granted the access described in this list. If the user loses this role later, they will not be granted the
+roles or traits described in the Access List.
+
+![Add a member](../../../img/access-controls/access-lists/add-member.png)
+
+Finally, click "Create Access List" at the bottom of the page.
+
+## Step 4/4. Login as the test user
+
+Again, login as the test user. When logging in now, you should now see the dumper application contained within
+the cluster, and should be able to interact with it as expected.
+
+## Next Steps
+
+- Familiarize yourself with the CLI tooling available for managing Access Lists in the [reference](../../reference/access-controls/access-lists.mdx).
+- Learn how to work with nested Access Lists in the [nested Access Lists guide](./nested-access-lists.mdx).
diff --git a/docs/pages/admin-guides/access-controls/access-lists/nested-access-lists.mdx b/docs/pages/identity-governance/access-lists/nested-access-lists.mdx
similarity index 87%
rename from docs/pages/admin-guides/access-controls/access-lists/nested-access-lists.mdx
rename to docs/pages/identity-governance/access-lists/nested-access-lists.mdx
index 057c4335c75de..5809c722e2716 100644
--- a/docs/pages/admin-guides/access-controls/access-lists/nested-access-lists.mdx
+++ b/docs/pages/identity-governance/access-lists/nested-access-lists.mdx
@@ -1,6 +1,11 @@
 ---
 title: Nested Access Lists
 description: Learn how to use nested Access Lists to manage complex permissions and grant inheritance in Teleport.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 Nested Access Lists allow inclusion of an Access List as a member or owner of another Access List.
@@ -29,11 +34,11 @@ Inheritance is recursive – members of "Engineering Team" can themselves be Acc
 with their own members, and so on. However, circular nesting is not allowed, and nesting is limited
 to a maximum depth of 10 levels.
 
-For more information, see the [Access Lists reference](../../../reference/access-controls/access-lists.mdx).
+For more information, see the [Access Lists reference](../../reference/access-controls/access-lists.mdx).
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v17.0.1 or higher)"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 - A user with the default `editor` role or equivalent permissions (ability to read, create, and manage Access Lists).
@@ -79,5 +84,5 @@ the "dumper" app should be visible to the user.
 
 ## Next Steps
 
-- Review the [Access Lists reference](../../../reference/access-controls/access-lists.mdx) for more detailed information on Access Lists' nesting and inheritance.
-- Learn how nested Access Lists work with Okta/SCIM synchronization in [Synchronization with Okta and SCIM](../okta/app-and-group-sync.mdx).
+- Review the [Access Lists reference](../../reference/access-controls/access-lists.mdx) for more detailed information on Access Lists' nesting and inheritance.
+- Learn how nested Access Lists work with Okta/SCIM synchronization in [Synchronization with Okta and SCIM](../integrations/okta/app-and-group-sync.mdx).
diff --git a/docs/pages/identity-governance/access-lists/reviewing-access-requests.mdx b/docs/pages/identity-governance/access-lists/reviewing-access-requests.mdx
new file mode 100644
index 0000000000000..cdf24a412f5a9
--- /dev/null
+++ b/docs/pages/identity-governance/access-lists/reviewing-access-requests.mdx
@@ -0,0 +1,139 @@
+---
+title: Reviewing Access Requests
+description: Learn how Access List owners review Access Requests
+tags:
+ - get-started
+ - identity-governance
+ - privileged-access
+ - access-requests
+enterprise: Identity Governance
+---
+
+Access List owners can be automatically assigned as suggested reviewers to
+resource-based Access Requests that include resources granted by their Access
+List.
+
+In this guide we will walk through an example and the configuration of this
+use-case.
+
+## How it works
+
+We will create an Access List that grants users access to certain resources and
+allows its owners to review Access Requests to those resources.
+
+Then, we will issue an Access Request to those resources to verify that the list
+owners are prepopulated as suggested reviewers.
+
+## Prerequisites
+
+- Teleport cluster with a connected resource e.g. an SSH node.
+- Teleport user (`admin` in this guide) with an `editor` role to perform configuration.
+- Teleport user (`alice` in this guide) acting as an Access Request reviewer.
+- Teleport user (`bob` in this guide) acting as a low-privileged requester user.
+
+## Step 1/5. Create roles
+
+As an `admin` user, let's create 3 roles:
+
+- Role that grants access to SSH nodes with a label `env:prod`
+- Role that allows users to request access to SSH nodes with that label
+- Role that allows users to review Access Requests for SSH nodes with that label
+
+The `ssh-access` role allows access to SSH nodes with the label `env: prod`:
+
+```yaml
+kind: role
+version: v8
+metadata:
+  name: ssh-access
+spec:
+  allow:
+    logins:
+    - ubuntu
+    node_labels:
+      'env': 'prod'
+```
+
+The `ssh-access-requester` role allows to request access to such SSH nodes:
+
+```yaml
+kind: role
+version: v8
+metadata:
+  name: ssh-access-requester
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - ssh-access
+```
+
+The `ssh-access-reviewer` role allows to review such Access Requests:
+
+```yaml
+kind: role
+version: v8
+metadata:
+  name: ssh-access-reviewer
+spec:
+  allow:
+    review_requests:
+      roles:
+      - ssh-access
+      preview_as_roles:
+      - ssh-access
+```
+
+## Step 2/5. Assign requester role
+
+As an `admin` user, assign the `ssh-access-requester` role to `bob`.
+
+![bob user roles](../../../img/identity-governance/access-lists/bob-user-roles.png)
+
+This role will allow `bob` to issue Access Requests to SSH nodes with `env: prod`
+labels.
+
+## Step 3/5. Create an Access List
+
+Now, as an `admin` user, let's create an Access List that grants access to the
+SSH nodes (via `ssh-access` member role grant) and allows its owners to review
+requests to these SSH nodes (via `ssh-access-reviewer` owner role grant).
+
+On the Identity Governance / Access Lists web UI page select "Create New Access
+List" and create a new one with the following parameters:
+
+- List name: `SSH Access`
+- Permissions granted to list owners: `ssh-access-reviewer`
+- Permissions granted to list members: `ssh-access`
+- List owner: `alice`
+
+![access list owners](../../../img/identity-governance/access-lists/ssh-access-list-owners.png)
+
+You can fill out the rest of the parameters as desired.
+
+## Step 4/5. Submit an Access Request
+
+Once you log into Teleport as `bob`, you should be able to see your SSH node(-s)
+as requestable resources.
+
+On the Access Request checkout dialog, you should see that `alice` has been
+prepopulated as a suggested reviewer because she is an owner of the access
+list that grants access to the requested SSH node.
+
+![alice is suggested reviewer](../../../img/identity-governance/access-lists/bob-submit-request.png)
+
+Submit the request.
+
+## Step 5/5. Review the Access Request
+
+Once the request is submitted, log in as `alice` and go to the Identity Governance /
+Access Requests page to see `bob`'s pending request and review it:
+
+![alice is suggested reviewer](../../../img/identity-governance/access-lists/alice-review-request.png)
+
+That's it! `alice` as an owner of the "SSH Access" list has successfully reviewed
+`bob`'s request to an SSH node that's granted by her Access List.
+
+## Next steps
+
+- Learn more about [Resource Access Requests](../access-requests/resource-requests.mdx).
diff --git a/docs/pages/identity-governance/access-lists/terraform.mdx b/docs/pages/identity-governance/access-lists/terraform.mdx
new file mode 100644
index 0000000000000..86582d7fbb38a
--- /dev/null
+++ b/docs/pages/identity-governance/access-lists/terraform.mdx
@@ -0,0 +1,350 @@
+---
+title: Managing Access Lists with Terraform
+sidebar_label: Managing with Terraform
+description: Learn how to manage Access Lists and their members with Terraform.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+You can manage Access List and their members using Terraform. This guide will help you:
+
+- Understand how to manage Access Lists with Terraform
+- Understand the difference between Access Lists managed by Teleport vs Terraform
+- Understand how to manage Access List members with Terraform
+
+
+## How it works
+
+We will create a simple organization structure represented with Access Lists using
+Terraform. It will consist of:
+
+- Access List representing a team
+- Access List representing access to a resource (staging database)
+- assigning the team access to the resource
+- (optionally) assigning Okta and/or Entra ID group access to the resource
+
+Access List management with Terraform is done using 2 Terraform resources:
+`teleport_access_list` and `teleport_access_list_member`.
+
+There are some nuances to members management. This is where concept of *Access List type* comes
+into play. There are 2 key Access List types: *default* and *static*.
+
+### Access List of default type
+
+The default Access List has the `.spec.type` field unset, or set to null or an empty string. Those are
+regular Access Lists, like those created in the web UI. And as a consequence:
+
+- They require auditing. Even though `.spec.audit` is not required, to be specified in the
+  Terraform resource, the default value will be set and those lists have to be periodically
+  reviewed in the web UI.
+- Their members can be only managed with with the web UI and `tctl`. The source of truth
+  for these lists is Teleport so you cannot manage their members with Terraform.
+
+
+### Access List of static type
+
+Access List of type static, have `.spec.type` set to "static". They differ from the default Access Lists:
+
+- They don't support audit. `.spec.audit` field can be set, but it's ignored by Teleport.
+- Their members can be managed by Terraform.
+
+For static Access Lists, the source of truth for the membership is external (provisioned by
+Terraform) so audit is not supported. The members should be reviewed at source, which are the
+Terraform data sources or manifests and this process has to be external to Teleport.
+
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v18.2.0 or higher)"!)
+- Teleport [Terraform provider set up with credentials](../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+
+
+## Step 1/6. Create an Access List for a team
+
+First let's define a role, because Access List validation requires a role to be specified. Because
+this Access List represents a team and shouldn't grant any permissions on its own, let's create a
+noop role for it:
+
+```hcl
+resource "teleport_role" "noop" {
+  version = "v7"
+  metadata = {
+    name = "noop"
+  }
+}
+```
+
+And a static Access Lists representing a dev team with some user members:
+
+```hcl
+resource "teleport_access_list" "developers" {
+  depends_on = [ teleport_role.noop ] # roles can't be deleted if they are in use
+  header = {
+    version = "v1"
+    metadata = {
+      name = "developers"
+    }
+  }
+  spec = {
+    type = "static" # type must be set to "static" to manage members with Terraform
+    title       = "Developers"
+    description = "Dev team."
+    owners = [
+      { name = "admin" },
+    ]
+    grants = {
+      roles = ["noop"]
+    }
+  }
+}
+
+resource "teleport_access_list_member" "developers_alice" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "alice" # Teleport user name
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.developers.id # assign to "Developers" Access List
+    membership_kind = 1 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+
+resource "teleport_access_list_member" "developers_bob" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "bob"
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.developers.id
+    membership_kind = 1 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+Note that the Developers list is just a container for the users which belong to a single team in
+the org. On its own it doesn't grant any permissions to its members, as it assigns only the "noop"
+role, but it is possible to nest this list in another Access List to inherit the permissions. That
+will be shown in the follow up step.
+
+
+## Step 2/6. Create an Access Lists granting database access
+
+Now let's create an Access List representing access:
+
+```hcl
+resource "teleport_role" "db_access_staging" {
+  version = "v7"
+  metadata = {
+    name = "db_access_staging"
+  }
+  spec = {
+    allow = {
+      db_users = ["viewer"]
+      db_names = ["*"]
+      db_labels = {
+        env = "staging"
+      }
+    }
+  }
+}
+
+resource "teleport_access_list" "db_access_staging" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "db_access_staging"
+    }
+  }
+  spec = {
+    type = "static" # static, so members can be assigned with Terraform
+    title       = "Staging DBs access"
+    description = "Read-only access to staging databases"
+    owners = [
+      { name = "admin" },
+    ]
+    grants = {
+      roles = [teleport_role.db_access_staging.id]
+    }
+  }
+}
+```
+
+
+## Step 3/6. Give access to the team
+
+Knowing that nested Access Lists inherit grants of the parent Access list, giving "Developers" team
+"Staging DBs access" is now as simple as creating a nested Access List membership:
+
+```hcl
+resource "teleport_access_list_member" "db_access_staging_developers" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = teleport_access_list.developers.id
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.db_access_staging.id
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+Once "Developers" Access List is a member of "Staging DBs access" Access Lists, "Developers" list
+inherits grants of the "Staging DBs access" and in effect developers are granted access to the
+staging databases.
+
+
+## Step 4/6. Give access to a team managed in the web UI
+
+This step will show how Access Lists of the default type can be employed in the structure. As a
+quick reminder, the default Access Lists are supposed to be managed with the web UI and they
+require periodic reviews performed by the list owners. The default Access List members cannot be
+manged with Terraform, but the lists themselves can be created/modified and imported to Terraform.
+
+Let's create a default Access List representing another team "DB Administrators" reusing the "noop"
+role created in the previous steps:
+
+```hcl
+resource "teleport_access_list" "dbas" {
+  depends_on = [ teleport_role.noop ] # roles can't be deleted if they are in use
+  header = {
+    version = "v1"
+    metadata = {
+      name = "dbas"
+    }
+  }
+  spec = {
+    # type is skipped, this is a regular Access List
+    title       = "DBAs"
+    description = "DB Administrators team."
+    owners = [
+      { name = "admin" },
+    ]
+    grants = {
+      roles = ["noop"]
+    }
+    # audit settings can be skipped, the values below are the defaults
+    audit = {
+      recurrence = {
+        frequency    = 6 # every 6 months
+        day_of_month = 1 # first day of the month
+      }
+    }
+  }
+}
+```
+
+The new "DBAs" team members can be managed using the web UI. Teleport user `admin`, as the Access List
+owner, will be automatically granted permissions to manage members of this list. `admin` will be
+also required to review this list in the web UI every 6 months as defined in the *audit* section.
+Because Access List members are separate resources in Teleport, modifying the members won't affect
+the Teleport state for the `"teleport_access_list" "dbas"` resource.
+
+Now, let's give "DBAs" the "Staging DBs access":
+
+```hcl
+resource "teleport_access_list_member" "db_access_staging_dbas" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = teleport_access_list.dbas.id
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.db_access_staging.id
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+
+## Step 5/6. (optional) Give access to a Okta group
+
+The Okta integration allows [synchronizing Okta groups and apps](../integrations/okta/app-and-group-sync.mdx) as
+Teleport Access Lists. 
+
+To give permissions to the Okta group represented as an Access List in Teleport, navigate to the Okta
+Access List in the web UI, and from its URL (e.g.
+`https://example.teleport.sh/web/accesslists/00gt3c8z9ukePm5uF697`) copy the last path segment. In
+this case `00gt3c8z9ukePm5uF697` - this is the name of the Okta Access List resource in Teleport.
+
+Now to give the Okta group members "Staging DBs access" permissions, create the nested Access List
+membership:
+
+```hcl
+resource "teleport_access_list_member" "db_access_staging_okta_group" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "00gt3c8z9ukePm5uF697"
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.db_access_staging
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+## Step 6/6. (optional) Give access to an Entra ID group
+
+Entra ID integration allows [synchronizing groups](../integrations/entra-id/entra-id.mdx) as
+Teleport Access Lists. 
+
+To give permissions to Entra ID group represented as Access List in Teleport navigate to the Entra
+ID Access List in the web UI, and from its URL (e.g.
+`https://example.teleport.sh/web/accesslists/b1a6a594-a4ac-51d1-a6f6-1746a413a79a`) copy the last
+path segment. In this case `b1a6a594-a4ac-51d1-a6f6-1746a413a79a` - this is the name of the Entra
+ID Access List resource in Teleport.
+
+Now to give the Entra ID group members "Staging DBs access" permissions, create the nested Access
+List membership:
+
+```hcl
+resource "teleport_access_list_member" "db_access_staging_entra_id_group" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "b1a6a594-a4ac-51d1-a6f6-1746a413a79a"
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.db_access_staging
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+## FAQ
+
+### Can I import my existing Access List into Terraform and start managing its members with IaC?
+
+This is usually not the case. Any Access List can be imported, but Access Lists created in the UI
+are not static type, so their members can't be managed with Terraform. The same applies to Access
+Lists created by an integration (e.g. [Okta](../integrations/okta/app-and-group-sync.mdx) or [Entra
+ID](../integrations/entra-id/entra-id.mdx)). An existing static list created by another Terraform setup (with
+a different state) could be imported and then its members can be managed by Terraform, but that's
+rather a rare use-case.
+
+The recommended solution is to create a static Access List managed with Terraform and make this
+list a member of the existing Access List. That way the members of the static Access List managed
+with Terraform will inherit the grants of the existing Access List.
+
+
+## Next Steps
+
+- Learn how [nested Access Lists](./nested-access-lists.mdx) grants inheritance work.
+- Familiarize yourself with
+  [teleport_access_list](../../reference/infrastructure-as-code/terraform-provider/resources/access_list.mdx) and
+  [teleport_access_list_member](../../reference/infrastructure-as-code/terraform-provider/resources/access_list_member.mdx)
+  Terraform resources.
+
diff --git a/docs/pages/admin-guides/access-controls/access-monitoring.mdx b/docs/pages/identity-governance/access-monitoring.mdx
similarity index 95%
rename from docs/pages/admin-guides/access-controls/access-monitoring.mdx
rename to docs/pages/identity-governance/access-monitoring.mdx
index 0289d8f2e4662..557ee38b5e5f3 100644
--- a/docs/pages/admin-guides/access-controls/access-monitoring.mdx
+++ b/docs/pages/identity-governance/access-monitoring.mdx
@@ -1,6 +1,12 @@
 ---
-title: Getting Started with Access Monitoring
+title: Access Monitoring
 description: Learn how to use Access Monitoring.
+sidebar_position: 6
+tags:
+ - how-to
+ - identity-governance
+ - access-risks
+enterprise: Identity Governance
 ---
 
 Access Monitoring allows users to understand and analyze the access patterns in a Teleport cluster.
@@ -22,8 +28,8 @@ Users are able to write their own custom access monitoring queries by querying t
 </Admonition>
 
 ## Prerequisites
-- Teleport v14 or later.
-- For self-hosted Teleport the [Amazon Athena Backend](../../reference/backends.mdx) is required.
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+- For self-hosted Teleport the [Amazon Athena Backend](../reference/deployment/backends.mdx) is required.
 
 
 ### Configuration
@@ -243,7 +249,7 @@ WHERE
   command LIKE '%/etc/passwd%';
 ```
 
-![exec passwd](../../../img/access-monitoring/exec_passwd.png)
+![exec passwd](../../img/access-monitoring/exec_passwd.png)
 
 - Select the count of unique IP addresses associated with each user cert over different event dates:
 ```sql
@@ -343,7 +349,7 @@ ORDER BY
     event_date
 ```
 
-![privileged access report](../../../img/access-monitoring/privileged_access_report.png)
+![privileged access report](../../img/access-monitoring/privileged_access_report.png)
 
 
 **Suggestion:**  Set up Access Requests, Device Trust and per-session MFA.
@@ -475,7 +481,7 @@ ORDER BY
     event_date
 ```
 
-**Suggestion:**  Use short lived certificates less than a working day. Check out Machine ID to get short lived certificates for your automation.
+**Suggestion:**  Use short lived certificates less than a working day. Check out Machine & Workload Identity to get short lived certificates for your automation.
 
 ### Long-lived join tokens
 
@@ -499,7 +505,7 @@ ORDER BY
     event_date
 ```
 
-**Suggestion:**  Use short-lived tokens to reduce risk of compromise or [delegated](../../reference/join-methods.mdx) joining when possible.
+**Suggestion:**  Use short-lived tokens to reduce risk of compromise or [delegated](../reference/deployment/join-methods.mdx) joining when possible.
 
 ### Root SSH sessions
 
diff --git a/docs/pages/admin-guides/access-controls/access-requests/access-request-configuration.mdx b/docs/pages/identity-governance/access-requests/access-request-configuration.mdx
similarity index 87%
rename from docs/pages/admin-guides/access-controls/access-requests/access-request-configuration.mdx
rename to docs/pages/identity-governance/access-requests/access-request-configuration.mdx
index a98b16246faf5..a60d4732e2d52 100644
--- a/docs/pages/admin-guides/access-controls/access-requests/access-request-configuration.mdx
+++ b/docs/pages/identity-governance/access-requests/access-request-configuration.mdx
@@ -1,7 +1,14 @@
 ---
 title: Configure Access Requests
+sidebar_label: Configuration
+sidebar_position: 6
 description: Describes the options available for configuring just-in-time access to roles and resources in your Teleport cluster.
-tocDepth: 3
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 This guide explains the considerations you should make when configuring Teleport
@@ -95,7 +102,7 @@ A role matcher can include the following values:
 
 To add the values of `claims_to_roles` to the lists of role matchers, the Auth
 Service evaluates template expressions with the user's traits. See the [Role
-Templates](../guides/role-templates.mdx#templating-in-access-requests) for more
+Templates](../../zero-trust-access/rbac-get-started/role-templates.mdx) for more
 information on how Teleport executes template expressions with user traits in
 the `claims_to_roles` field.
 
@@ -167,7 +174,7 @@ privileges:
 1. Calculate the maximum duration of elevated privileges if the Access Request
    were granted. This is the lowest value of:
    - The `--max-duration` flag of the [`tsh request
-     create`](../../../reference/cli/tsh.mdx) command (if the
+     create`](../../reference/cli/tsh.mdx) command (if the
      user creating the request provides this flag).
    - The lowest value of the `request.max_duration` field included in one of
      the user's requested roles.
@@ -176,7 +183,7 @@ privileges:
    lowest value of:
    - The requested session expiration time, which is the value of the
      `--session-ttl` flag of [`tsh request
-     create`](../../../reference/cli/tsh.mdx).
+     create`](../../reference/cli/tsh.mdx).
    - The remaining time in the user's current Teleport session.
    - The lowest value of the `options.max_session_ttl` field in the user's
      requested roles.
@@ -190,8 +197,8 @@ privileges:
 When creating or reviewing Access Requests, you can specify the earliest time
 that a user can assume elevated privileges by using the `--assume-start-time`
 flag. This flag is available for the
-[`tsh request create`](../../../reference/cli/tsh.mdx) and [`tsh request
-review`](../../../reference/cli/tsh.mdx) commands. The format accepted
+[`tsh request create`](../../reference/cli/tsh.mdx) and [`tsh request
+review`](../../reference/cli/tsh.mdx) commands. The format accepted
 is defined in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339), e.g, `2023-12-12T23:20:50.52Z`.
 The time specified must be in the future.
 
@@ -235,7 +242,7 @@ valid while it awaits approval:
 
 1. Begin with with the base expiration of the Access Request, which a user can
    set with the `--request-ttl` flag of the [`tsh request
-   create`](../../../reference/cli/tsh.mdx) command. If this is
+   create`](../../reference/cli/tsh.mdx) command. If this is
    unset, the request TTL is one hour.
 1. If the user's Teleport session is due to expire before the base expiration
    time, Teleport sets the Access Request expiration to the end of the Teleport
@@ -296,7 +303,7 @@ user:
 
 ## Requiring request reasons
 
-The `allow.request.reason.mode` field controls whether a reason is required when users submit
+The `spec.allow.request.reason.mode` field controls whether a reason is required when users submit
 Access Requests.
 
 Allowed values are:
@@ -306,6 +313,9 @@ Allowed values are:
 | `optional` | The default. The user does not need to provide a reason when making a request. |
 | `required` | The user must provide a non-empty reason when making a request. |
 
+You can specify a scoped prompt to remind the user to provide a reason for specific requestable
+roles or resources using `spec.allow.request.reason.prompt`.
+
 Example:
 
 ```yaml
@@ -322,12 +332,67 @@ spec:
         - 'root-node-access'
       reason:
         mode: 'required'
+        prompt: 'Please give a reason for accessing node resources'
 ```
 
-If a user with "node-requester" role assigned makes an Access Request for "node-access" role or any
-resource allowed by "root-node-access" they will be required to provide a reason. If a user's
+If a user with `node-requester` role assigned makes an Access Request for `node-access` role or any
+resource allowed by `root-node-access` they will be required to provide a reason. If a user's
 role set includes multiple roles governing Access Requests to the same roles and resources,
-"require" mode takes precedence.
+`required` mode takes precedence.
+
+## Custom request reason prompts
+
+It is possible to specify custom request prompts for a user:
+
+- for requestable resources or roles specified by a single role
+- for all Access Requests made by the user
+
+To specify a scoped prompt for requestable resources specified by a single role, set
+`spec.allow.request.reason.prompt` to a non-empty string. This will affect only Access Requests that
+contain the specific resource or role.
+
+A custom global request prompt can be specified by assigning the user a role
+with `spec.options.request_prompt` set to non-empty string. This global prompt will apply for
+all Access Requests made by the user.
+
+If multiple global prompts and scoped prompts apply to the same Access Request, all
+prompts will be listed in alphabetical order within the request reason form.
+
+Example:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: k8s-requester
+spec:
+  allow:
+    request:
+      search_as_roles:
+        - 'k8s-viewer'
+      reason:
+        # If a user is assigned this role, the prompt below will be displayed
+        # when any resource allowed by k8s-viewer role is requested.
+        prompt: 'Please give a reason for accessing kubernetes resources'
+```
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: employee
+spec:
+  allow: {}
+  options:
+    # If a user is assigned this role, the prompt below will be displayed for
+    # all access requests made by this user.
+    request_prompt: 'Please provide your ticket ID'
+```
+
+If a user assigned with `k8s-requester` and `employee` roles makes an Access Request
+for resources searchable as `k8s-viewer`, they will be prompted with the text
+"Please give a reason for accessing kubernetes resources" on the first line and
+"Please provide your ticket ID" on the second line, in alphabetical order.
 
 ## Review thresholds
 
@@ -385,7 +450,7 @@ the request has met the criteria specified in one of the thresholds in
 `allow.request.thresholds` associated with that role.
 
 The value of `filter` is an expression that uses the Teleport [predicate
-language](../../../reference/predicate-language.mdx).
+language](../../reference/access-controls/predicate-language.mdx).
 
 For example, the following configuration includes four thresholds, three of which
 have filters:
@@ -486,6 +551,17 @@ While Teleport will accept a role with a nonempty
 `deny.request.suggested_reviewers` field, it only considers the
 `allow.request.suggested_reviewers` field when evaluating Access Requests.
 
+### Access List owners as suggested reviewers
+
+For resource-based Access Requests, owners of the Access Lists that grant access
+to the requested resources are automatically added as suggested reviewers.
+
+Note that those owners still need to have an appropriate Teleport role that
+allows them to review such Access Requests.
+
+You can learn more about this use-case in the [Reviewing Access Requests](../access-lists/reviewing-access-requests.mdx)
+guide.
+
 ## Roles that a reviewer can grant access to
 
 Teleport users must be authorized to review Access Requests for a particular
@@ -505,7 +581,7 @@ following role fields:
 
 The Auth Service evaluates the `claims_to_roles` field using template
 expressions with the user's traits. See the [Role
-Templates](../guides/role-templates.mdx#templating-in-access-requests) for more
+Templates](../../zero-trust-access/rbac-get-started/role-templates.mdx) for more
 information on how Teleport executes template expressions with user traits in
 the `claims_to_roles` field.
 
@@ -673,7 +749,7 @@ pagerduty_services:
 
 ### Reading annotations in custom plugins
 
-If you [write your own Access Request plugin](../../api/access-plugin.mdx), the
+If you [write your own Access Request plugin](plugins/how-to-build.mdx), the
 program can access system annotations using a function similar to the following:
 
 ```go
@@ -694,4 +770,4 @@ Requests with the key `my-annotation`.
 
 For a full description of the configuration options within a Teleport role,
 refer to the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
+Reference](../../reference/access-controls/roles.mdx).
diff --git a/docs/pages/identity-governance/access-requests/access-requests.mdx b/docs/pages/identity-governance/access-requests/access-requests.mdx
new file mode 100644
index 0000000000000..ad8afbf829bc1
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/access-requests.mdx
@@ -0,0 +1,73 @@
+---
+title: Just-in-Time Access Requests
+sidebar_label: Access Requests
+description: Use just-in-time Access Requests to request elevated privileges.
+template: "no-toc"
+sidebar_position: 2
+tags:
+ - access-requests
+ - conceptual
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+Just-in-time Access Requests allow Teleport users to request access to a
+resource or role depending on need. The request can then be approved or denied
+based on a configurable number of approvers. Access Requests enable your
+organization to implement security best practices, including:
+
+- **Dual authorization:** Two reviewers must grant access before a user can
+  receive elevated permissions. This satisfies the FedRAMP AC-3 dual
+  authorization control that requires approval of two authorized individuals.
+- **Principle of least privilege:** You can configure Access Requests to give an
+  attacker no permanent admin roles target.  Users receive elevated privileges
+  for a limited period of time. Request approvers can be configured with limited
+  cluster access so they are not high value targets.
+
+Access Requests are designed to provide temporary permissions to users. If you
+want to grant longstanding permissions to a group of users, with the option to
+renew these permissions after a recurring interval (such as three months),
+consider [Access Lists](../access-lists/access-lists.mdx). 
+
+## See how Access Requests work
+
+Access Requests support two main use cases: **Role Access Requests**
+and **Resource Access Requests**.
+
+With Role Access Requests, engineers can request temporary credentials with
+elevated roles in order to perform critical system-wide tasks.
+
+[Get started with Role Access Requests](role-requests.mdx).
+
+With Resource Access Requests, engineers can easily get access to only the
+individual resources they need, when they need it.
+
+[Get started with Resource Access Requests](resource-requests.mdx).
+
+## Configure Access Requests
+
+You can configure all aspects of the Access Request lifecycle in Teleport,
+including:
+
+- When a user must make a request.
+- What permissions a user can request.
+- How long elevated permissions can last.
+- How many users can approve or deny different kinds of requests.
+
+Read the [Access Request
+Configuration](access-request-configuration.mdx) guide for an
+overview of the configuration options available for Access Requests.
+
+## Teleport Community Edition users
+
+Just-in-time Access Requests are a feature of Teleport Enterprise. Teleport
+Community Edition users can get a preview of how Access Requests work by
+requesting a role via the Teleport CLI. Full Access Request functionality,
+including Resource Access Requests managing Access Requests via the Web UI are
+available in Teleport Enterprise.
+
+For information on how to use Just-in-time Access Requests with Teleport Community 
+Edition, see [Teleport Community Access Requests](oss-role-requests.mdx).
+
+
diff --git a/docs/pages/identity-governance/access-requests/automatic-reviews.mdx b/docs/pages/identity-governance/access-requests/automatic-reviews.mdx
new file mode 100644
index 0000000000000..3b744d4f71570
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/automatic-reviews.mdx
@@ -0,0 +1,435 @@
+---
+title: Configure Automatic Reviews
+sidebar_label: Automatic Reviews
+sidebar_position: 3
+description: Describes how to configure Access Automation Rules for Automatic Reviews.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+Teleport supports automatic reviews of Access Requests. This
+feature enables teams to enforce a zero standing privilege policy, while
+still allowing users to receive temporary access without manual approval.
+
+In this guide, we'll walk through how to configure Teleport RBAC and demonstrate
+example use cases for automatic reviews:
+
+- Automatically approve role requests from users on a specific team.
+- Automatically approve resource requests from users on a specific team.
+
+## How it works
+
+Automatic reviews are triggered by Access Automation Rules. These rules instruct
+Teleport to monitor Access Requests and automatically submit a review
+when certain conditions (such as requested roles, user traits, or resource labels)
+are met.
+
+For example, an Access Automation Rule can perform an automatic Access Request
+approval when a user with the Teleport traits or IdP attribute `team: demo`
+requests access to the `access` role.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v18.2.8 or higher)"!)
+
+- This feature requires Teleport Identity Governance.
+- This guide requires at least one labeled SSH server.
+- If you're following along with the Terraform steps, first setup the
+[Teleport Terraform Provider](../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+
+## Step 1/3. Create a requester role and user
+
+In this example, we'll first create:
+
+- A role named `demo-access-request`, which allows users to request access to the
+`access` role and any resources that the `access` role can access.
+- A user named `demo-access-requester`, assigned the above role.
+### Create the role
+
+Create a `role` configuration file named `demo-role.yaml`:
+
+```yaml
+# demo-role.yaml
+kind: role
+version: v7
+metadata:
+  name: demo-access-request
+spec:
+  allow:
+    request:
+      roles:
+        - access
+      search_as_roles:
+        - access
+```
+
+Create the role with:
+```code
+$ tctl create demo-role.yaml
+```
+
+### Create the user
+
+Use the following command to create the user and assign the role:
+```code
+$ tctl users add --roles=demo-access-request demo-access-requester
+```
+
+Alternatively, you can assign the role after creating the user:
+
+  (!docs/pages/includes/add-role-to-user.mdx role="demo-access-request" user="\`demo-access-requester\`"!)
+
+## Step 2/3. Assign user traits
+
+To allow automatic review rules to evaluate the requesting user, assign them
+traits via the Teleport Web UI:
+
+1. Go to **Zero Trust Access** -> **Users**
+2. Next to `demo-access-requester`, click **Options** -> **Edit...**
+3. Click **Add user trait**, and set:
+   - Key: `team`
+   - Value: `demo`
+4. Click **Save**
+5. Verify that the user has been updated with the desired trait
+
+![Edit User Traits](../../../img/access-controls/automatic-reviews/users-edit.png)
+
+When adding user traits, you can enter any keys and values. The user trait form
+does not support wildcard or regular expressions.
+
+<Admonition type="tip" title="SSO users">
+  Automatic reviews are compatible with SSO users and the attributes provided
+  by the IdP.
+</Admonition>
+
+## Step 3/3. Configure automatic reviews
+
+Now that you've created a user and assigned them traits, you're ready to
+configure automatic review rules.
+
+Access Automation Rules leverage the user traits, resource labels, and schedules
+to determine whether requests can be automatically approved. In this step, you'll
+configure one or more kinds of automatic review rules to demonstrate how Teleport
+can automatically approve access.
+
+### Role-based automatic reviews
+
+To demonstrate how role requests from a specific team can be automatically
+approved, create the following Access Automation Rule:
+
+<Tabs>
+<TabItem label="Via Web UI">
+1. Go to **Identity Governance** -> **Access Requests** -> **Set Up Access Automation Rules**
+2. Click **Create New Access Automation Rule** -> **Automatic Review Rule**
+3. Configure the rule and set:
+   - **Name of requested roles to match**: `access`
+   - **User Traits to match**: `team: demo`
+   - **Review decision**: `APPROVED`
+4. Click **Create Rule**
+</TabItem>
+<TabItem label="Via tctl">
+Create an `access_monitoring_rule` configuration file named `demo-rule.yaml`:
+
+```yaml
+# demo-rule.yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: demo-rule
+spec:
+  automatic_review:
+    decision: APPROVED
+    integration: builtin
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    contains_any(user.traits["team"], set("demo"))
+  desired_state: reviewed
+  subjects:
+    - access_request
+```
+
+Create the access_monitoring_rule with:
+```code
+$ tctl create -f demo-rule.yaml
+```
+</TabItem>
+<TabItem label="Via Terraform">
+Create an `access_monitoring_rule` configuration file named `demo-rule.tf`:
+
+```hcl
+# demo-rule.tf
+resource "teleport_access_monitoring_rule" "demo-rule" {
+  version = "v1"
+  metadata = {
+    name = "demo-rule"
+  }
+  spec = {
+    automatic_review = {
+      decision    = "APPROVED"
+      integration = "builtin"
+    }
+    condition     = <<-EOT
+      contains_all(set("access"), access_request.spec.roles) &&
+      contains_any(user.traits["team"], set("demo"))
+    EOT
+    desired_state = "reviewed"
+    subjects      = ["access_request"]
+  }
+}
+```
+
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+</Tabs>
+
+This rule automatically approves Access Requests for the `access` role if the
+user has the trait `team: demo`.
+
+To verify the new automatic review rule, create an Access Request via the Teleport
+Web UI:
+
+1. Log in as `demo-access-requester`
+2. Go to **Identity Governance** -> **Access Requests** and click **New Access Request**
+3. Change the request type from **Resources** to **Roles**
+4. Add the `access` role to the Access Request
+5. Click **Proceed to Request**, then **Submit Request**
+
+At this point, the new Access Request should have been created, automatically
+reviewed, and transitioned into an `APPROVED` state. Navigate **Back to Listings**
+and verify the Access Request status. It might take a second for the review to
+process, so you may have to refresh the page.
+
+### Resource-based automatic reviews
+
+Before creating an Access Automation Rule, ensure that you have at least one
+labeled SSH server connected to your Teleport cluster:
+
+```code
+# List your SSH servers to identify available labels:
+$ tsh ls
+Node Name   Address    Labels
+----------- ---------- -------------------------------
+teleport-00 ⟵ Tunnel  env=demo
+```
+
+To demonstrate how resource requests from a specific team can be automatically
+approved, create the following Access Automation Rule:
+
+<Tabs>
+<TabItem label="Via Web UI">
+1. Go to **Identity Governance** -> **Access Requests** -> **Set Up Access Automation Rules**
+2. Click **Create New Access Automation Rule** -> **Automatic Review Rule**
+3. Configure the rule and set:
+   - **Name of requested roles to match**: `access`
+   - **Resource labels to match**: `env: demo`
+   - **User Traits to match**: `team: demo`
+   - **Review decision**: `APPROVED`
+4. Click **Create Rule**
+</TabItem>
+<TabItem label="Via tctl">
+Create an `access_monitoring_rule` configuration file named `demo-rule.yaml`:
+
+```yaml
+# demo-rule.yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: demo-rule
+spec:
+  automatic_review:
+    decision: APPROVED
+    integration: builtin
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    contains_any(user.traits["team"], set("demo")) &&
+    access_request.spec.resource_labels_intersection["env"].contains("demo")
+  desired_state: reviewed
+  subjects:
+    - access_request
+```
+
+Create the access_monitoring_rule with:
+```code
+$ tctl create -f demo-rule.yaml
+```
+</TabItem>
+<TabItem label="Via Terraform">
+Create an `access_monitoring_rule` configuration file named `demo-rule.tf`:
+
+```hcl
+# demo-rule.tf
+resource "teleport_access_monitoring_rule" "demo-rule" {
+  version = "v1"
+  metadata = {
+    name = "demo-rule"
+  }
+  spec = {
+    automatic_review = {
+      decision    = "APPROVED"
+      integration = "builtin"
+    }
+    condition     = <<-EOT
+      contains_all(set("access"), access_request.spec.roles) &&
+      contains_any(user.traits["team"], set("demo")) &&
+      access_request.spec.resource_labels_intersection["env"].contains("demo")
+    EOT
+    desired_state = "reviewed"
+    subjects      = ["access_request"]
+  }
+}
+```
+
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+</Tabs>
+
+This rule automatically approves Access Requests for the `access` role and
+resources labeled `env: demo` if the user has the trait `team: demo`.
+
+To verify the new automatic review rule, create an Access Request via the Teleport
+Web UI:
+
+1. Log in as `demo-access-requester`
+2. Go to **Identity Governance** -> **Access Requests** and click **New Access Request**
+3. Add the SSH server you'd like to request access to
+4. Click **Proceed to Request**, then **Submit Request**
+
+At this point, the new Access Request should have been created, automatically
+reviewed, and transitioned into an `APPROVED` state. Navigate **Back to Listings**
+and verify the Access Request status. It might take a second for the review to
+process, so you may have to refresh the page.
+
+### Schedule-based automatic reviews
+
+To demonstrate how role requests can be automatically approved during a
+specified schedule, create the following Access Automation Rule:
+
+<Tabs>
+<TabItem label="Via Web UI">
+1. Go to **Identity Governance** -> **Access Requests** -> **Set Up Access Automation Rules**
+2. Click **Create New Access Automation Rule** -> **Automatic Review Rule**
+3. Configure the rule and set:
+   - **Name of requested roles to match**: `access`
+   - **User Traits to match**: `team: demo`
+   - **Review decision**: `APPROVED`
+4. Configure the schedule:
+   - Enable **For specified times only**
+   - Select the desired **Time Zone**
+   - Choose the desired weekdays
+   - Set the schedule for each selected weekday
+5. Click **Create Rule**
+
+For example, to enable automatic reviews at any time on Mondays, the schedule
+editor would appear as follows:
+
+![Schedule Editor](../../../img/access-controls/automatic-reviews/schedule-editor.png)
+</TabItem>
+<TabItem label="Via tctl">
+Create an `access_monitoring_rule` configuration file named `demo-rule.yaml`:
+
+```yaml
+# demo-rule.yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: demo-rule
+spec:
+  automatic_review:
+    decision: APPROVED
+    integration: builtin
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    contains_any(user.traits["team"], set("demo"))
+  desired_state: reviewed
+  subjects:
+    - access_request
+  schedules:
+    default:
+      time:
+        timezone: America/Los_Angeles
+        shifts:
+          - weekday: Monday
+            start: "00:00"
+            end: "23:59"
+```
+
+Create the access_monitoring_rule with:
+```code
+$ tctl create -f demo-rule.yaml
+```
+</TabItem>
+<TabItem label="Via Terraform">
+Create an `access_monitoring_rule` configuration file named `demo-rule.tf`:
+
+```hcl
+# demo-rule.tf
+resource "teleport_access_monitoring_rule" "demo-rule" {
+  version = "v1"
+  metadata = {
+    name = "demo-rule"
+  }
+  spec = {
+    automatic_review = {
+      decision    = "APPROVED"
+      integration = "builtin"
+    }
+    condition     = <<-EOT
+      contains_all(set("access"), access_request.spec.roles) &&
+      contains_any(user.traits["team"], set("demo"))
+    EOT
+    desired_state = "reviewed"
+    subjects      = ["access_request"]
+    schedules = {
+      default = {
+        time = {
+          timezone = "America/Los_Angeles"
+          shifts = [
+            {
+              weekday : "Monday"
+              start : "00:00"
+              end : "23:59"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
+```
+
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+</Tabs>
+
+## Troubleshooting
+
+### Conflicting automatic review rules
+
+Automatic review rules can automatically approve or deny Access Requests based
+on the selected review decision. If an Access Request meets the conditions for
+both an approval rule and a denial rule, the denial rule takes precedence.
+
+## Next Steps
+
+- Access Automation Rules are configured using an underlying `access_monitoring_rule`
+  resource. For more details about the `access_monitoring_rule` resource, refer to the
+  [Access Monitoring Rules Reference](../../reference/access-controls/access-monitoring-rules.mdx).
+- For configuration with Teleport Terraform Provider, refer to the
+  [Terraform Resources Index](../../reference/infrastructure-as-code/terraform-provider/resources/access_monitoring_rule.mdx)
+- For configuration options with SSO, refer to the
+  [Single Sign-On Guides](../../zero-trust-access/sso/sso.mdx).
+- For more details about managing resource labels, refer to the
+  [Add Labels to Resources Guide](../../zero-trust-access/rbac-get-started/labels.mdx).
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/notification-routing-rules.mdx b/docs/pages/identity-governance/access-requests/notification-routing-rules.mdx
similarity index 81%
rename from docs/pages/admin-guides/access-controls/access-request-plugins/notification-routing-rules.mdx
rename to docs/pages/identity-governance/access-requests/notification-routing-rules.mdx
index 15b85449dd8b5..782dc6cbb6ad2 100644
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/notification-routing-rules.mdx
+++ b/docs/pages/identity-governance/access-requests/notification-routing-rules.mdx
@@ -1,6 +1,14 @@
 ---
-title: Routing Access Request notifications
+title: Routing Access Request Notifications
+sidebar_label: Notification Routing Rules
 description: How to set up Teleport's Access Monitoring Rules to route Access Request notifications
+sidebar_position: 4
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 With Teleport's Access Monitoring Rules, Access Request notifications can be
@@ -19,29 +27,13 @@ the the AMR and uses it to process incoming events.
 Plugins implement AMR handling logic separately from one another. Currently,
 only a subset of hosted plugins support notification routing rules. We are
 working on extending support to the rest of hosted plugins. Keep an eye on
-Teleport [changelog](../../../changelog.mdx) to learn about new plugins.
+Teleport [changelog](../../changelog.mdx) to learn about new plugins.
 
 ## Prerequisites
 
-- A managed Teleport Enterprise account.
-
-- The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=).
-
-  You can verify the tools you have installed by running the following commands:
-
-  ```code
-  $ tctl version
-  # Teleport Enterprise v(=teleport.version=) go(=teleport.golang=)
-  
-  $ tsh version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  You can download these tools by following the appropriate [Installation 
-  instructions](../../../installation.mdx) for your environment and Teleport edition.
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise Cloud"!)
 
 - At least one of the Teleport Access Plugins that support Access Monitoring Rules is enrolled.
-
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/2. Create an Access Monitoring Rule
@@ -55,11 +47,11 @@ You can define an Access Request notification rule in two ways:
 To create an Access Monitoring Rule via the Web UI, first navigate to
 the Access Request page and click on `View Notification Routing Rules`.
 
-![View Notification Routing Rules](../../../../img/enterprise/plugins/access_monitoring_rules/view_routing_rules.png)
+![View Notification Routing Rules](../../../img/enterprise/plugins/access_monitoring_rules/view_routing_rules.png)
 
 Then click `Create Notification Rule`.
 
-![Create Access Monitoring Rule](../../../../img/enterprise/plugins/access_monitoring_rules/access_monitoring_rule_ui.png)
+![Create Access Monitoring Rule](../../../img/enterprise/plugins/access_monitoring_rules/access_monitoring_rule_ui.png)
 
 If a plugin that supports Access Monitoring Rule based routing is not enrolled
 the UI will prompt you to enroll one.
diff --git a/docs/pages/admin-guides/access-controls/access-requests/oss-role-requests.mdx b/docs/pages/identity-governance/access-requests/oss-role-requests.mdx
similarity index 97%
rename from docs/pages/admin-guides/access-controls/access-requests/oss-role-requests.mdx
rename to docs/pages/identity-governance/access-requests/oss-role-requests.mdx
index 8e38f342e2709..02ed28c37848a 100644
--- a/docs/pages/admin-guides/access-controls/access-requests/oss-role-requests.mdx
+++ b/docs/pages/identity-governance/access-requests/oss-role-requests.mdx
@@ -1,6 +1,13 @@
 ---
 title: Teleport Community Edition Role Access Requests
+sidebar_label: Teleport Community Edition
+sidebar_position: 7
 description: Teleport Community Edition allows users to request access to roles from the CLI.
+tags:
+ - access-requests
+ - conceptual
+ - identity-governance
+ - privileged-access
 ---
 
 Just-in-time Access Requests are a feature of Teleport Enterprise.
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx b/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx
similarity index 92%
rename from docs/pages/admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx
rename to docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx
index f28fec38048e6..270fc0b487aa6 100644
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx
+++ b/docs/pages/identity-governance/access-requests/plugins/datadog-hosted.mdx
@@ -1,6 +1,13 @@
 ---
 title: Access Requests with Datadog Incident Management
+sidebar_label: Datadog
 description: How to set up Teleport's Datadog Incident Management plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 With Teleport's Datadog Incident Management integration, engineers can access the
@@ -24,7 +31,7 @@ may approve the Access Request automatically.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v17.0.1 or higher)"!)
 
 - A Datadog account with the role "Datadog Admin Role". The admin role is required to
   create a Service Account and generate required credentials for the plugin.
@@ -59,7 +66,7 @@ For the purpose of this guide, we will define an `editor-requester` role, which
 can request the built-in `editor` role, and an `editor-reviewer` role that can
 review requests for the `editor` role.
 
-In the Teleport WebUI navigate to **Access -> Roles**. Then select **Create New
+In the Teleport Web UI navigate to **Zero Trust Access -> Roles**. Then select **Create New
 Role** and create the desired roles.
 
 
@@ -90,12 +97,12 @@ spec:
 
 First, assign yourself the `editor-reviewer` role. This will allow your user to
 review Access Requests for the `editor` role. To edit your user roles navigate to
-**Management -> Access -> Users**, then for your user select **Options -> Edit**
+**Zero Trust Access -> Users**, then for your user select **Options -> Edit**
 and add the `editor-reviewer` role.
 
 Next, create a user called `myuser@example.com` who has the `editor-requester` role.
 Later in this guide, you will create an Access Request as this user to test the
-Datadog plugin. To this user, navigate to **Management -> Access -> Users**. Then
+Datadog plugin. To this user, navigate to **Zero Trust Access -> Users**. Then
 select **Enroll Users** and create a user with the `editor-requester` role.
 
 You should end up with two users that look like this:
@@ -137,9 +144,8 @@ to create a new Application key. Copy the Application key to paste in a later st
 ## Step 4/6. Enroll the Datadog Incident Management plugin
 
 At this point, you're now ready to enroll the Datadog Incident Management plugin.
-Navigate to **Access Management -> Enroll New Integration -> Datadog**.
 
-![Select enrollment](../../../../img/enterprise/plugins/datadog/select-enrollment.png)
+(!docs/pages/includes/plugins/enroll.mdx name="the Datadog Incident Management"!)
 
 Provide the API and Application keys generated above. Select the desired API endpoint.
 Then provide the Datadog team handle, that you created earlier, as the fallback recipient.
@@ -148,9 +154,7 @@ This should be "teleport-access".
 The fallback recipient will be the default recipient for notifications. The recipient
 can be a Datadog user email, or a Datadog team handle. You can configure more custom
 notification routing rules afterwards using
-[Access Monitoring Rules](./notification-routing-rules.mdx).
-
-![Datadog enrollment](../../../../img/enterprise/plugins/datadog/datadog-enrollment.png)
+[Access Monitoring Rules](../notification-routing-rules.mdx).
 
 If the recipient is a Datadog team, the team name will be added to the Datadog incident
 teams attribute.
@@ -259,5 +263,5 @@ that the Teleport username matches the Datadog on-call user email.
 
 ## Next steps
 
-- Read our guide on [Routing Access Request notifications](./notification-routing-rules.mdx)
+- Read our guide on [Routing Access Request notifications](../notification-routing-rules.mdx)
   to configure custom notification routing rules for your plugin.
diff --git a/docs/pages/identity-governance/access-requests/plugins/discord.mdx b/docs/pages/identity-governance/access-requests/plugins/discord.mdx
new file mode 100644
index 0000000000000..a7ca17354dc03
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/discord.mdx
@@ -0,0 +1,410 @@
+---
+title: Run the Discord Access Request Plugin
+sidebar_label: Discord
+description: How to set up Teleport's Discord plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+import BotLogo from "/static/avatar_logo.png";
+import AppIcon from "@version/docs/img/sso/onelogin/teleport.png";
+
+This guide will explain how to set up Discord to receive Access Request messages
+from Teleport. Teleport's Discord integration notifies individuals and channels of
+Access Requests. Users can then approve and deny Access Requests from within
+Discord, making it easier to implement security best practices without
+compromising productivity.
+
+![The Discord Access Request plugin](../../../../img/enterprise/plugins/discord.png)
+
+<details>
+<summary>This integration is hosted on Teleport Cloud</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Discord integration"!)
+
+</details>
+
+## How it works
+
+The Teleport Discord plugin authenticates to your Discord server as well as the
+Teleport Auth Service, and listens for audit events from the Teleport Auth
+Service related to Access Requests. When a user creates an Access Request, the
+plugin sends a message on Discord to reviewers of the request, including a link
+that each reviewer can follow in order to review the request in the Teleport Web
+UI. You can configure the reviewers the plugin will notify based on the role
+targeted by the Access Request.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- Admin account on your Discord server. Installing a bot requires at least the
+  "manager server" permission.
+- Either a Linux host or Kubernetes cluster where you will run the Discord plugin.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/8. Define RBAC resources
+
+Before you set up the Discord plugin, you will need to enable Role Access Requests
+in your Teleport cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/8. Define a Teleport Discord plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/8. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-discord-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-discord-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/8. Install the Teleport Discord plugin
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="discord"!)
+
+## Step 5/8. Register a Discord app
+
+The Access Request plugin for Discord receives Access Request events from the
+Teleport Auth Service, formats them into Discord messages, and sends them to the
+Discord API to post them in your guild (Discord server). For this to work,
+you must register a new app with the Discord API.
+
+### Create your application
+
+1. Visit
+   [https://discord.com/developers/applications](https://discord.com/developers/applications)
+   to create a new Discord application. Click "New Application" and name the
+   application "Teleport".
+1. <a href={AppIcon} download>Download the application icon.</a>
+1. Set the application icon.
+
+### Create the application bot
+
+Go to the "Bot" tab and choose "Add Bot". You can <a href={BotLogo}
+download>download</a> our avatar to set as your Bot icon. Un-check the "Public
+Bot" toggle as this bot should only be used within your Discord servers.
+Finally, press "Reset Token", copy and save the new token into a safe place.
+This token will be used by the Teleport plugin to authenticate against the
+Discord API.
+
+### Install and authorize the application in your Discord server
+
+Go to the "OAuth2" tab, open the "URL Generator" and check the following
+permissions:
+
+- bot
+- View Channels
+- Send Messages
+
+Copy and access the generated URL. Choose to install the application into the
+desired Discord server. If the server is not available in the
+dropdown list, it means you don't have sufficient rights. Ask a server
+administrator to grant you a role with the "manage server" permission.
+
+<Admonition type="note">
+The same application can be installed into multiple Discord servers. To
+do so, access the OAuth URL multiple times and choose different servers. You
+have to be admin on a Discord server to install the app into it.
+</Admonition>
+
+## Step 6/8. Configure the Teleport Discord plugin
+
+At this point, the Teleport Discord plugin has the credentials it needs to
+communicate with your Teleport cluster and the Discord API. In this step, you will
+configure the Discord plugin to use these credentials. You will also configure the
+plugin to notify the right Discord channels when it receives an Access Request
+update.
+
+### Create a config file
+
+<Tabs>
+<TabItem label="Executable or Docker">
+The Teleport Discord plugin uses a config file in TOML format. Generate a
+boilerplate config by running the following command (the plugin will not run
+unless the config file is in `/etc/teleport-discord.toml`):
+
+```code
+$ teleport-discord configure | sudo tee /etc/teleport-discord.toml > /dev/null
+```
+
+This should result in a config file like the one below:
+
+```toml
+(!examples/resources/plugins/teleport-discord.toml!)
+```
+</TabItem>
+<TabItem label="Helm Chart">
+The Discord Helm chart uses a YAML values file to configure the plugin.
+On your local workstation, create a file called `teleport-discord-helm.yaml`
+based on the following example:
+
+```toml
+(!examples/resources/plugins/teleport-discord-helm.yaml!)
+```
+
+</TabItem>
+</Tabs>
+
+### Edit the config file
+
+Open the configuration file created for the Teleport Discord plugin and update the following fields:
+
+**`[teleport]`**
+
+The Discord plugin uses this section to connect to the Teleport Auth Service.
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+**`[discord]`**
+
+`token`: Paste the bot token saved previously in this field.
+
+**`[role_to_recipients]`**
+
+The `role_to_recipients` map configures the channels that the Discord plugin will
+notify when a user requests access to a specific role. When the Discord plugin
+receives an Access Request from the Auth Service, it will look up the role being
+requested and identify the Discord channels to notify.
+
+Each channel is represented by a numeric ID. Channels can be public, private or
+direct messages between a user and the bot.
+To determine the numeric ID of a channel for the bot to notify, follow the instructions below:
+
+<Tabs>
+  <TabItem label="Public Channel">
+  
+    Open Discord in a web browser and navigate to the desired channel.
+    
+    The web browser URL should look like:
+    ```
+    https://discord.com/channels/<guild ID>/<channel ID>
+    ```
+    
+    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
+  </TabItem>
+  <TabItem label="Private Channel">
+    Open Discord in a web browser and navigate to the desired channel.
+    
+    In the channel list choose "Create invite", type "teleport" in the search field
+    and invite your Discord Teleport bot. The bot should now appear in the channel
+    member list.
+    
+    The web browser URL should look like:
+    ```
+    https://discord.com/channels/<guild ID>/<channel ID>
+    ```
+    
+    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
+  </TabItem>
+  <TabItem label="Direct Message">
+    To retrieve the channel ID of the private discussion between User A and the
+    Teleport bot, have User A send a direct message to the Teleport bot. This will
+    open a conversation between the user and the bot. Once the conversation is
+    initiated, the user can open the discussion page.
+    
+    The web browser URL should look like:
+    ```
+    https://discord.com/channels/@me/<channel ID>
+    ```
+    
+    Copy the last part of the URL (everything after the last `/`), which is the channel ID.
+  </TabItem>
+</Tabs>
+
+In the `role_to_recipients` map, each key is the name of a Teleport role. Each
+value configures the Discord channel (or channels) to notify.
+
+The `role_to_recipients` map must also include an entry for `"*"`, which the
+plugin looks up if no other entry matches a given role name. In the example
+above, requests for roles aside from `dev` will notify the
+`security-team` channel.
+
+Configure the Discord plugin to notify you when a user requests the `editor` role
+by adding the following to your `role_to_recipients` config (replace
+`YOUR-CHANNEL-ID` with a valid channel ID):
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+Here is an example of a `role_to_recipients` map. Each value can be a single
+string or an array of strings:
+
+```toml
+[role_to_recipients]
+"*" = "YOUR-CHANNEL-ID"
+"editor" = "YOUR-CHANNEL-ID"
+```
+</TabItem>
+<TabItem label="Helm Chart">
+
+In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
+and uses the following format, where keys are strings and values are arrays of
+strings:
+
+```yaml
+roleToRecipients:
+  "*": ["YOUR-CHANNEL-ID"]
+  "editor": ["YOUR-CHANNEL-ID"]
+```
+</TabItem>
+</Tabs>
+
+The final configuration file should resemble the following:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+```toml
+(!examples/resources/plugins/teleport-discord.toml!)
+```
+</TabItem>
+<TabItem label="Helm Chart">
+```yaml
+(!examples/resources/plugins/teleport-discord-helm.yaml!)
+```
+</TabItem>
+</Tabs>
+
+## Step 7/8. Test your Discord app
+
+Once Teleport is running, you've created the Discord app, and the plugin is
+configured, you can now run the plugin and test the workflow.
+
+<Tabs>
+<TabItem label="Executable">
+Start the plugin:
+
+```code
+$ teleport-discord start
+```
+
+If everything works fine, the log output should look like this:
+
+```code
+$ teleport-discord start
+INFO   Starting Teleport Access Discord Plugin (=teleport.version=): discord/app.go:80
+INFO   Plugin is ready discord/app.go:101
+```
+</TabItem>
+<TabItem label="Docker">
+Start the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-discord.toml public.ecr.aws/gravitational/teleport-plugin-discord:(=teleport.version=) start
+```
+</TabItem>
+<TabItem label="Helm Chart">
+Install the plugin:
+
+```code
+$ helm upgrade --install teleport-plugin-discord teleport/teleport-plugin-discord --values teleport-discord-helm.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-discord
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-discord-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-discord
+```
+</TabItem>
+</Tabs>
+
+Create an Access Request and check if the plugin works as expected with the
+following steps.
+
+### Create an Access Request
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+The channel you configured earlier to review the request should receive a
+message from "Teleport" in Discord allowing them to visit a link in the Teleport
+Web UI and either approve or deny the request.
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+Once the request is resolved, the Discord bot will update the Access Request
+message with ✅ or ❌, depending on whether the request was approved or denied.
+
+<Admonition type="warning" title="Auditing Access Requests">
+
+When the Discord plugin posts an Access Request notification to a channel, anyone
+with access to the channel can view the notification and follow the link. While
+users must be authorized via their Teleport roles to review Access Requests, you
+should still check the Teleport audit log to ensure that the right users are
+reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+## Step 8/8. Set up systemd
+
+This section is only relevant if you are running the Teleport Discord plugin on a
+Linux host.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd.  Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!examples/systemd/plugins/teleport-discord.service!)
+```
+
+Save this as `teleport-discord.service` in either `/usr/lib/systemd/system/` or
+another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-discord
+$ sudo systemctl start teleport-discord
+```
+
+## Next steps
+
+- Read our guides to configuring [Resource Access
+    Requests](../resource-requests.mdx) and [Role Access
+    Requests](../role-requests.mdx) so you can get the most out
+    of your Access Request plugins.
diff --git a/docs/pages/identity-governance/access-requests/plugins/email.mdx b/docs/pages/identity-governance/access-requests/plugins/email.mdx
new file mode 100644
index 0000000000000..245900159551f
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/email.mdx
@@ -0,0 +1,528 @@
+---
+title: Access Requests with Email
+sidebar_label: Email
+description: How to set up the Teleport email plugin to notify users when another user requests elevated privileges.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide will explain how to set up Teleport to send Just-in-Time Access
+Request notifications to users via email. Since all organizations use email for
+at least some of their communications, Teleport's email plugin makes it
+straightforward to integrate Access Requests into your existing workflows,
+letting you implement security best practices without compromising productivity.
+
+![The email Access Request plugin](../../../../img/enterprise/plugins/email.png)
+
+<details>
+<summary>This integration is hosted on Teleport Enterprise (Cloud)</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Email integration"!)
+
+![Enroll email plugin](../../../../img/enterprise/plugins/email/enroll-email.png)
+
+Configure and connect email integration by providing the following configuration
+values:
+
+**`Sender`**: Configures the sender address.
+
+**`Fallback Recipient`**: Configures the default recipient for Access Request
+notifications.
+
+**`Email Service`**: Selects the desired email service. Note: only `Mailgun` is
+supported for Teleport Enterprise (Cloud).
+
+![Configure Mailgun integration](../../../../img/enterprise/plugins/email/configure-mailgun.png)
+
+Complete Mailgun integration by providing the following Mailgun API
+configuration values:
+
+**`Domain`**: Configures the Mailgun sending domain.
+
+**`Mailgun Private Key`**: Configures the Mailgun API key.
+
+</details>
+
+## How it works
+
+The Teleport email plugin authenticates to a third-party SMTP service as well as
+the Teleport Auth Service, and listens for audit events from the Teleport Auth
+Service related to Access Requests. When a user creates an Access Request, the
+plugin sends an email to reviewers of the request, including a link that each
+reviewer can follow in order to review the request in the Teleport Web UI. You
+can configure the reviewers the plugin will notify based on the role targeted by
+the Access Request.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- Access to an SMTP service. The Teleport email plugin supports either Mailgun
+  or a generic SMTP service that authenticates via username and password.
+- Either a Linux host or Kubernetes cluster where you will run the email plugin.
+
+<Admonition type="warning" title="Protecting your email account">
+
+The Teleport plugin needs to use a username and password to authenticate to your
+SMTP service. To mitigate the risk of these credentials being leaked, you should
+set up a dedicated email account for the Teleport plugin and rotate the password
+regularly.
+
+</Admonition>
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/7. Define RBAC resources
+
+Before you set up the email plugin, you will need to enable Role Access Requests
+in your Teleport cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/7. Define a Teleport email plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/7. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-email-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-email-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/7. Install the Teleport email plugin
+
+In this step, you'll install the Teleport email plugin on a host that has network
+access to your SMTP server. This host can be any system capable of reaching both
+your Teleport cluster and the SMTP server used for sending emails.
+
+<details>
+<summary>Using a local SMTP server?</summary>
+
+If you are using a local SMTP server to test the plugin, you should install the
+plugin on your local machine to ensure the plugin can connect to the SMTP server
+and perform any necessary DNS lookups to send email.
+
+Your Teleport cluster does *not* need to perform DNS lookups for your plugin
+because the plugin dials out to the Teleport Proxy Service or Teleport Auth Service.
+
+</details>
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="email"!)
+
+## Step 5/7. Configure the plugin
+
+At this point, you have generated credentials that the email plugin will use to
+connect to Teleport. You will now configure the plugin to use these credentials
+to receive Access Request notifications from Teleport and email them to your
+chosen recipients.
+
+### Create a config file
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+The Teleport email plugin uses a configuration file in TOML format. Generate a
+boilerplate configuration by running the following command:
+
+```code
+$ teleport-email configure | sudo tee /etc/teleport-email.toml
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+The email plugin Helm Chart uses a YAML values file to configure the plugin.
+On your local workstation, create a file called `teleport-email-helm.yaml`
+based on the following example:
+
+```yaml
+(!examples/resources/plugins/teleport-email-helm.yaml!)
+```
+
+</TabItem>
+</Tabs>
+
+### Edit the configuration file
+
+Edit the configuration file for your environment. We will show you how to set
+each value below.
+
+### `[teleport]`
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+### `[mailgun]` or `[smtp]`
+
+Provide the credentials for your SMTP service depending on whether you are using
+Mailgun or SMTP service.
+
+<Tabs>
+<TabItem label="Mailgun">
+
+If you are deploying the email plugin on a Linux host:
+
+1. In the `mailgun` section, assign `domain` to the domain name and subdomain of
+   your Mailgun account. 
+1. Assign `mailgun.private_key` to your Mailgun private key.
+
+If you are deploying the email plugin on Kubernetes:
+
+1. Write your Mailgun private key to a local file called `mailgun-private-key`.
+1. Create a Kubernetes secret from the file:
+
+  ```code
+  $ kubectl -n teleport create secret generic mailgun-private-key --from-file=mailgun-private-key
+  ```
+
+1. Assign `mailgun.privateKeyFromSecret` to `mailgun-private-key`.
+
+</TabItem>
+<TabItem label="Generic SMTP Service">
+
+Assign `host` to the fully qualified domain name of your SMTP service, omitting
+the URL scheme and port. (If you're using a local SMTP server for testing, use
+`"localhost"` for `host`.) Assign `port` to the port of your SMTP service.
+
+If you are running the email plugin on a Linux host, fill in `username` and
+`password`.
+
+<Admonition type="tip">
+
+You can also save your password to a separate file and assign `password_file` to
+the file's path. The plugin reads the file and uses the file's content as the
+password.
+
+</Admonition>
+
+If you are deploying the email plugin on Kubernetes:
+
+1. Write your SMTP service's password a local file called `smtp-password.txt`.
+1. Create a Kubernetes secret from the file:
+
+  ```code
+  $ kubectl -n teleport create secret generic smtp-password --from-file=smtp-password
+  ```
+
+1. Assign `smtp.passwordFromSecret` to `smtp-password`.
+
+<details>
+<summary>Disabling TLS for testing</summary>
+
+If you are testing the email plugin against a trusted internal SMTP server where
+you would rather not use TLS—e.g., a local SMTP server on your development
+machine—you can assign the `starttls_policy` setting to `disabled` (always
+disable TLS) or `opportunistic` (disable TLS if the server does not advertise
+the `STARTTLS` extension). The default is to always enforce TLS, and you should
+leave this setting unassigned unless you know what you are doing and understand
+the risks.
+
+For Kubernetes deployments, `starttls_policy` is called `smtp.starttlsPolicy` in
+the Helm values file for the email plugin.
+
+</details>
+
+</TabItem>
+</Tabs>
+
+### `[delivery]`
+
+Assign `sender` to the email address from which you would like the Teleport
+plugin to send messages.
+
+### `[role_to_recipients]`
+
+The `role_to_recipients` map (`roleToRecipients` for Helm users) configures the
+recipients that the email plugin will notify when a user requests access to a
+specific role. When the plugin receives an Access Request from the Auth Service,
+it will look up the role being requested and identify the recipients to notify.
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+Here is an example of a `role_to_recipients` map. Each value can be a single
+string or an array of strings:
+
+```toml
+[role_to_recipients]
+"*" = ["security@example.com", "executive-team@example.com"]
+"dev" = "eng@example.com"
+"dba" = "mallory@example.com"
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
+and uses the following format, where keys are strings and values are arrays of
+strings:
+
+```yaml
+roleToRecipients:
+  "*": ["security@example.com", "executive-team@example.com"]
+  "dev": ["eng@example.com"]
+  "dba": ["mallory@example.com"]
+```
+
+</TabItem>
+</Tabs>
+
+In the `role_to_recipients` map, each key is the name of a Teleport role. Each
+value configures the recipients the plugin will email when it receives an Access
+Request for that role.  Each string must be an email address.
+
+The `role_to_recipients` map must also include an entry for `"*"`, which the
+plugin looks up if no other entry matches a given role name. In the example
+above, requests for roles aside from `dev` and `dba` will notify
+`security@example.com` and `executive-team@example.com`.
+
+<details>
+<summary>Suggested reviewers</summary>
+
+Users can suggest reviewers when they create an Access Request, e.g.,:
+
+```code
+$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
+```
+
+If an Access Request includes suggested reviewers, the email plugin will add
+these to the list of recipients to notify. If a suggested reviewer is an email
+address, the plugin will send a message to that recipient in addition to those
+configured in `role_to_recipients`.
+
+</details>
+
+Configure the email plugin to notify you when a user requests the `editor` role
+by adding the following to your `role_to_recipients` config, replacing
+`YOUR_EMAIL_ADDRESS` with the appropriate address: 
+
+<Tabs>
+<TabItem label="Executable or Docker" >
+```toml
+[role_to_recipients]
+"*" = "YOUR_EMAIL_ADDRESS"
+"editor" = "YOUR_EMAIL_ADDRESS"
+```
+</TabItem>
+<TabItem label="Helm Chart" >
+```yaml
+roleToRecipients:
+  "*": "YOUR_EMAIL_ADDRESS"
+  "editor": "YOUR_EMAIL_ADDRESS"
+```
+</TabItem>
+</Tabs>
+
+<details>
+<summary>Configuring recipients without role mapping</summary>
+
+If you do not plan to use role-to-recipient mapping, you can configure the
+Teleport email plugin to notify a static list of recipients for every Access
+Request event by using the `delivery.recipients` field:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+```toml
+[delivery]
+recipients = ["eng@exmaple.com", "dev@example.com"]
+```
+</TabItem>
+<TabItem label="Helm Chart">
+```yaml
+delivery:
+  recipients: ["eng@exmaple.com", "dev@example.com"]
+```
+</TabItem>
+</Tabs>
+
+If you use `delivery.recipients`, you must remove the `role_to_recipients`
+configuration section. Behind the scenes, `delivery.recipients` assigns the
+recipient list to a `role_to_recipients` mapping under the wildcard value `"*"`.
+
+</details>
+
+You configuration should resemble the following:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+```toml
+# /etc/teleport-email.toml
+[teleport]
+addr = "example.com:443"
+identity = "/var/lib/teleport/plugins/email/identity"
+refresh_identity = true
+
+[mailgun]
+domain = "sandbox123abc.mailgun.org" 
+private_key = "xoxb-fakekey62b0eac53565a38c8cc0316f6"
+
+# As an alternative, you can use SMTP server credentials:
+#
+# [smtp]
+# host = "smtp.gmail.com"
+# port = 587
+# username = "username@gmail.com"
+# password = ""
+# password_file = "/var/lib/teleport/plugins/email/smtp_password"
+# starttls_policy = "mandatory"
+
+[delivery]
+sender = "noreply@example.com" 
+
+[role_to_recipients]
+"*" = "eng@example.com"
+"editor" = ["admin@example.com", "execs@example.com"]
+
+[log]
+output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/email.log"
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+```yaml
+# teleport-email-helm.yaml
+teleport:
+  address: "teleport.example.com:443"
+  identitySecretName: teleport-plugin-email-identity
+  identitySecretPath: identity
+
+mailgun:
+  domain: "sandbox123abc.mailgun.org" 
+  privateKeyFromSecret: "mailgun-private-key"
+
+# As an alternative, you can use SMTP server credentials:
+#
+# smtp:
+#   host: "smtp.gmail.com"
+#   port: 587
+#   username: "username@gmail.com"
+#   passwordFromSecret: "smtp-password"
+#   starttls_policy = "mandatory"
+
+delivery:
+  sender: "noreply@example.com" 
+
+roleToRecipients:
+  "*": "eng@example.com"
+  "editor": ["admin@example.com", "execs@example.com"]
+```
+
+</TabItem>
+</Tabs>
+
+## Step 6/7. Test the email plugin
+
+After finishing your configuration, you can now run the plugin and test your
+email-based Access Request flow:
+
+<Tabs>
+<TabItem label="Executable">
+
+```code
+$ teleport-email start
+```
+
+If everything works as expected, the log output should look like this:
+
+```code
+$ teleport-email start
+INFO   Starting Teleport Access Email Plugin (): email/app.go:80
+INFO   Plugin is ready email/app.go:101
+```
+</TabItem>
+<TabItem label="Docker">
+Start the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-email.toml public.ecr.aws/gravitational/teleport-plugin-email:(=teleport.version=) start
+```
+</TabItem>
+<TabItem label="Helm Chart">
+Install the plugin:
+
+```code
+$ helm upgrade --install teleport-plugin-email teleport/teleport-plugin-email --values teleport-email-helm.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-email
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-email-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-email
+```
+</TabItem>
+</Tabs>
+
+### Create an Access Request
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+The recipients you configured earlier should receive notifications of the
+request by email. 
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+## Step 7/7. Set up systemd
+
+This section is only relevant if you are running the Teleport email plugin on a
+Linux host.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd. Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!/examples/systemd/plugins/teleport-email.service!)
+```
+
+Save this as `teleport-email.service` in either `/usr/lib/systemd/system/` or
+another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-email
+$ sudo systemctl start teleport-email
+```
+
diff --git a/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx b/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx
new file mode 100644
index 0000000000000..18ab0b65d4ace
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/how-to-build.mdx
@@ -0,0 +1,503 @@
+---
+title: How to Build an Access Request Plugin
+sidebar_position: 11
+description: Manage Access Requests using custom workflows with the Teleport API
+tags:
+ - access-requests
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Identity Governance
+---
+
+With Teleport [Access Requests](../access-requests.mdx), you can
+assign Teleport users to less privileged roles by default and allow them to
+temporarily escalate their privileges. Reviewers can grant or deny Access
+Requests within your organization's existing communication workflows (e.g.,
+Slack, email, and PagerDuty) using [Access Request
+plugins](plugins.mdx).
+
+You can use Teleport's API client library to build an Access Request plugin that
+integrates with your organization's unique workflows. 
+
+In this guide, we will explore a number of Teleport's API client libraries by
+showing you how to write a plugin that lets you manage Access Requests via
+Google Sheets. The plugin lists new Access Requests in a Google Sheets
+spreadsheet, with links to allow or deny each request. 
+
+![The result of the plugin](../../../../img/api/google-sheets.png)
+
+## How it works
+
+A Teleport Access Request plugin authenticates to the Teleport Auth Service gRPC
+API and receives messages when the Auth Service creates or updates an Access
+Request. The plugin then interacts with a third-party API based on the Access
+Request notifications it receives. The Teleport API client library includes
+methods for authenticating to the API using a Teleport identity file, as well as
+for receiving audit events from the Auth Service in order to perform some
+action.
+
+<Admonition type="danger">
+
+The plugin we will build in this guide is intended as a learning tool. **Do not
+connect it to your production Teleport cluster.**  Use a demo cluster instead.
+
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- Go version (=teleport.golang=)+ installed on your workstation. See the [Go
+  download page](https://go.dev/dl/). You do not need to be familiar with Go to
+  complete this guide, though Go knowledge is required if you want to build your
+  own Access Request plugin.
+
+You will need the following in order to set up the demo plugin, which requires
+authenticating to the Google Sheets API:
+
+- A Google Cloud project with permissions to create service accounts.
+- A Google account that you will use to create a Google Sheets spreadsheet. We
+  will grant permissions to edit the spreadsheet to the service account used for
+  the plugin.
+
+<Admonition type="tip">
+
+Even if you do not plan to set up the demo project, you can follow this guide to see
+which libraries, types, and functions you can use to develop an Access Request
+plugin. 
+
+The demo is a minimal working example, and you can see fully fledged plugins in
+the
+[`gravitational/teleport`](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/integrations/access).
+repository on GitHub.
+
+</Admonition>
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+## Step 1/5. Set up your Go project
+
+Download the source code for our minimal Access Request plugin:
+
+```code
+$ git clone https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
+$ cd teleport/examples/access-plugin-minimal
+```
+
+For the rest of this guide, we will show you how to set up this plugin and
+explore the way the plugin uses Teleport's API to integrate Access Requests with
+a particular workflow.
+
+## Step 2/5. Set up the Google Sheets API
+
+Access Request plugins typically communicate with two APIs. They receive Access
+Request events from the Teleport Auth Service's gRPC API, and use the data to
+interact with the API of your chosen messaging or collaboration tool.
+
+In this section, we will enable the Google Sheets API, create a Google Cloud
+service account for the plugin, and use the service account to authenticate the
+plugin to Google Sheets.
+
+### Enable the Google Sheets API
+
+Enable the Google Sheets API by visiting the following Google Cloud console URL:
+
+https://console.cloud.google.com/apis/enableflow?apiid=sheets.googleapis.com
+
+Ensure that your Google Cloud project is the one you intend to use. 
+
+Click **Next** > **Enable**.
+
+### Create a Google Cloud service account for the plugin
+
+Visit the following Google Cloud console URL:
+
+https://console.cloud.google.com/iam-admin/serviceaccounts
+
+Click **Create Service Account**.
+
+For **Service account name**, enter "Teleport Google Sheets Plugin". Google
+Cloud will populate the **Service account ID** field for you.
+
+Click **Create and Continue**. When prompted to grant roles to the service
+account, click **Continue** again. We will create our service account without
+roles. Skip the step to grant users access to the service account, clicking
+**Done**.
+
+The console will take you to the **Service accounts** view. Click the name of
+the service account you just created, then click the **Keys** tab. Click **Add
+Key**, then **Create new key**. Leave the **Key type** as "JSON" and click
+**Create**.
+
+Save your Google Cloud credentials file as `credentials.json` in your Go project
+directory.
+
+Your plugin will use this JSON file to authenticate to Google Sheets.
+
+### Create a Google Sheets spreadsheet
+
+Visit the following URL and make sure you are authenticated as the correct user:
+
+https://sheets.new
+
+Name your spreadsheet.
+
+Give the plugin access to the spreadsheet by clicking **Share**. In the **Add
+people and groups** field, enter
+`teleport-google-sheets-plugin@PROJECT_NAME.iam.gserviceaccount.com`, replacing
+`PROJECT_NAME` with the name of your project. Make sure that the service account
+has "Editor" permissions. Click **Share**, then **Share anyway** when prompted
+with a warning.
+
+By authenticating to Google Sheets with the service account you created, the
+plugin will have access to modify your spreadsheet.
+
+Next, ensure that the following is true within your spreadsheet:
+
+- There is only one sheet
+- The sheet includes the following columns:
+
+|ID|Created|User|Roles|Status|Link|
+|---|---|---|---|---|---|
+
+After we write our Access Request plugin, it will populate the spreadsheet with
+data automatically.
+
+## Step 3/5. Set up Teleport RBAC
+
+In this section, we will set up Teleport roles that enable creating and
+reviewing Access Requests, plus another Teleport role that can generate
+credentials for your Access Request plugin to authenticate to Teleport.
+
+### Set up RBAC for the plugin
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+### Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-identity"!)
+</TabItem>
+</Tabs>
+
+Teleport's Access Request plugins listen for new and updated Access Requests by
+connecting to the Teleport Auth Service's gRPC endpoint over TLS.
+
+The identity file includes both TLS and SSH credentials. Your
+Access Request plugin uses the SSH credentials to connect to the Proxy Service,
+which establishes a reverse tunnel connection to the Auth Service. The plugin
+uses this reverse tunnel, along with your TLS credentials, to connect to the
+Auth Service's gRPC endpoint.
+
+You will refer to this file later when configuring the plugin.
+
+### Set up Role Access Requests
+
+In this guide, we will use our plugin to manage Role Access Requests. For this
+to work, we will set up Role Access Requests in your cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 4/5. Write the Access Request plugin
+
+In this step, we will walk you through the structure of the Access Request
+plugin in `examples/access-plugin-minimal/main.go`. You can use the example here
+to write your own Access Request plugin.
+
+### Imports
+
+Here are the packages our Access Request plugin will import from Go's standard
+library:
+
+|Package|Description|
+|---|---|
+|`context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata. |
+|`errors`|Working with errors.|
+|`fmt`|Formatting data for printing, strings, or errors.|
+|`strings`|Manipulating strings.|
+
+The plugin imports the following third-party code:
+
+|Package|Description|
+|---|---|
+|`github.com/gravitational/teleport/api/client`|A library for authenticating to the Auth Service's gRPC API and making requests.|
+|`github.com/gravitational/teleport/api/types`|Types used in the Auth Service API, e.g., Access Requests.|
+|`github.com/gravitational/trace`|Presenting errors with more useful detail than the standard library provides.|
+|`google.golang.org/api/option`|Settings for configuring Google API clients.|
+|`google.golang.org/api/sheets/v4`|The Google Sheets API client library, aliased as `sheets` in our program.|
+|`google.golang.org/grpc`|The gRPC client and server library.|
+
+### Configuration
+
+First, we declare two constants that you need to configure for your environment:
+
+```go
+(!examples/access-plugin-minimal/config.go!)
+```
+
+`proxyAddr` indicates the hostname and port of your Teleport Proxy Service or
+Teleport Enterprise Cloud tenant. Assign it to the address of your own Proxy
+Service, e.g., `mytenant.teleport.sh:443`.
+
+Assign `spreadSheetID` to the ID of the spreadsheet you created earlier. To find
+the spreadsheet ID, visit your spreadsheet in Google Drive. The ID will be in
+the URL path segment called `SPREADSHEET_ID` below:
+
+```text
+https://docs.google.com/spreadsheets/d/SPREADHSEET_ID/edit#gid=0
+```
+
+### The `AccessRequestPlugin` type
+
+The `plugin.go` file declares types that we will use to organize our Access
+Request plugin code:
+
+```go
+(!examples/access-plugin-minimal/plugin.go!)
+```
+
+The `AccessRequestPlugin` type represents a generic Access Request plugin, and
+you can use this type to build your own plugin. It contains a Teleport API
+client and an `EventHandler`, any Go type that implements a `HandleEvent`
+method.
+
+In our case, the type that implements `HandleEvent` is `googleSheetsClient`, a
+struct type that contains an API client for Google Sheets.
+
+### Prepare row data
+
+Whether creating a new row of the spreadsheet or updating an existing one, we
+need a way to extract data from an Access Request in order to provide it to
+Google Sheets. We achieve this with the `makeRowData` method:
+
+```go
+(!examples/access-plugin-minimal/makerowdata.go!)
+```
+
+The `sheets.RowData` type makes extensive use of pointers to strings, so we
+introduce a utility function called `stringPtr` that returns the pointer to the
+provided string. This makes it easier to assign the values of cells in the
+`sheets.RowData` using chains of function calls.
+
+`makeRowData` is a method of the `googleSheetsClient` type. (The `*` before
+`googleSheetsClient` indicates that the method receives a *pointer* to a
+`googleSheetsClient`.) It takes a `types.AccessRequest`, which Teleport's API
+library uses to represent the fields within an Access Request.
+
+The Google Sheets client library defines a `sheets.RowData` type that we
+include in requests to update a spreadsheet. This function converts a
+`types.AccessRequest` into a `*sheets.RowData` (another pointer). 
+
+Access Requests have one of four states: approved, denied, pending, and none.
+We obtain the request states from Teleport's `types` library and map them to
+strings in the `requestStates` map.
+
+When extracting the data, we use the `types.AccessRequest.GetName()` method to
+retrieve the ID of the Access Request as a string we can include in the
+spreadsheet. 
+
+Users can review an Access Request by visiting a URL within the Teleport Web UI
+that corresponds to the request's ID. `makeRowData` assembles a `=HYPERLINK`
+formula that we can insert into the spreadsheet as a link to this URL.
+
+### Create a row
+
+The following function submits a request to the Google Sheets API to create a
+new row based on an incoming Access Request, using the data returned by
+`makeRowData`. It returns an error if the attempt to create a row failed:
+
+```go
+(!examples/access-plugin-minimal/createrow.go!)
+```
+
+`createRow` assembles a `sheets.BatchUpdateSpreadsheetRequest` and sends it to
+the Google Sheets API using `g.sheetsClient.BatchUpdate()`, returning errors
+encountered while sending the request.
+
+We log unexpected HTTP status codes without returning an error since these may
+be transient server-side issues. A production Access Request plugin would handle
+these situations in a more sophisticated way, e.g., storing the request so it
+can retry it later.
+
+### Update a row
+
+The code for updating a row is similar to the code for creating a new row: 
+
+```go
+(!examples/access-plugin-minimal/updaterow.go!)
+```
+
+The only difference between `updateRow` and `createRow` is that we send a
+`&sheets.UpdateCellsRequest` instead of a `&sheets.AppendCellsRequest`. This
+function takes the number of a row within the spreadsheet to update and sends a
+request to update that row with information from the provided Access Request.
+
+### Determine where to update the spreadsheet
+
+When our program receives an event that updates an Access Request, it needs a
+way to look up the row in the spreadsheet that corresponds to the Access Request
+so it can update the row:
+
+```go
+(!examples/access-plugin-minimal/updatespreadsheet.go!)
+```
+
+`updateSpreadSheet` takes a `types.AccessRequest`, gets the latest data from
+your spreadsheet, determines which row to update, and calls `updateRow`
+accordingly. It uses linear search to look up the first column within each row
+of the sheet and check whether that column matches the ID of the Access Request.
+It then calls `updateRow` with the Access Request and the row's number.
+
+### Handle incoming Access Requests
+
+The plugin calls a handler function when it receives an event. To set this up,
+we use the `Run` method of our generic `AccessRequestPlugin` type, which
+contains the main loop of the plugin:
+
+```go
+(!examples/access-plugin-minimal/watcherjob.go!)
+```
+
+As we described above, the `AccessRequestPlugin` type's `EventHandler` field is
+assigned to an interface with a `HandleEvent` method. In this case, the
+implementation is `*googleSheetsClient.HandleEvent`. This method checks whether
+an Access Request is in a pending state, i.e., whether the request is new. If
+so, it calls `createRow`. If not, it calls `updateSpreadsheet`.
+
+The Teleport API client type, `client.Client`, has a `NewWatcher` method that
+listens for new audit events from the Auth Service API via a gRPC stream. The
+second parameter of the method indicates the type of audit event to watch for,
+in this case, events having to do with Access Requests.
+
+The result of `NewWatcher`, a `types.Watcher`, enables `Run` to respond to new
+audit events by calling the `Events` method. This returns a Go **channel**, a
+runtime abstraction that allows concurrent routines to communicate. Another
+channel, returned by `Done`, indicates when the watcher has finished.
+
+In a `for` loop, the `Run` method receives from either the `Done` channel or
+`Events` channel, whichever is ready to send first. If it receives from the
+`Events` channel, it calls the `HandleEvent` method to process the event.
+
+### Initialize the API clients
+
+Now we have all the code we need to use the Teleport and Google Sheets API
+clients to listen for Access Request events and use them to maintain a
+spreadsheet. The final step is to start our program by initializing the API
+clients:
+
+```go
+(!examples/access-plugin-minimal/main.go!)
+```
+
+The `main` function, the entrypoint to our program, initializes an
+`AccessRequestPlugin` and `googleSheetsClient` and uses them run the plugin. 
+
+The function creates a Google Sheets API client by loading the credentials file
+you downloaded earlier at the relative path `credentials.json`.
+
+`client` is Teleport's library for setting up an API client. Our plugin does so
+by calling `client.LoadIdentityFile` to obtain a `client.Credentials`. It then
+uses the `client.Credentials` to call `client.New`, which connects to the
+Teleport Proxy Service specified in the `Addrs` field using the provided
+identity file.
+
+In this example, we are passing the `grpc.WithReturnConnectionError()` function
+call to `client.New`, which instructs the gRPC client to return more detailed
+connection errors.
+
+<Admonition type="warning">
+
+This program does not validate your credentials or Teleport cluster address.
+Make sure that: 
+
+- The identity file you exported earlier does not have an expired TTL
+- The value you supplied for the `proxyAddr` constant includes both the host
+  **and** the web port of your Teleport Proxy Service, e.g.,
+  `mytenant.teleport.sh:443`
+
+</Admonition>
+
+## Step 5/5. Test your plugin
+
+Run the plugin to forward Access Requests from your Teleport cluster to Google
+Sheets. Execute the following command from within
+`examples/access-plugin-minimal`:
+
+```code
+$ go run teleport-sheets
+```
+
+Now that the plugin is running, create an Access Request:
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+You should see the new Access Request in your spreadsheet with the `PENDING`
+state.
+
+In your spreadsheet, click "View Access Request" next to your new request. Sign
+into the Teleport Web UI as your original user. When you submit your review,
+e.g., deny the request, the new status will appear within the spreadsheet.
+
+<Admonition type="danger">
+
+Access Request plugins must not enable reviewing Access Requests via the plugin,
+and must always refer a reviewer to the Teleport Web UI to complete the review.
+Otherwise, an unauthorized party could spoof traffic to the plugin and escalate
+privileges. 
+
+</Admonition>
+
+## Next steps
+
+In this guide, we showed you how to set up an Access Request plugin using
+Teleport's API client libraries. To go beyond the minimal plugin we demonstrate
+in this guide, you can use the Teleport API to set up more sophisticated
+workflows that take full advantage of your communication and project management
+tools. 
+
+### Manage state
+
+While the plugin we developed in this guide is stateless, updating Access
+Request information by searching all rows of a spreadsheet, real-world Access
+Request plugins typically need to manage state. You can use the
+[`plugindata`](https://pkg.go.dev/github.com/gravitational/teleport/api/types#PluginData)
+package to make it easier for your Access Request plugin to do this. 
+
+### Consult the examples
+
+Explore the
+[`gravitational/teleport`](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/integrations/access).
+repository on GitHub for examples of plugins developed at Teleport. You can see
+how these plugins use the packages we discuss in this guide, as well as how they
+add more complete functionality like configuration validation and state
+management.
+
+### Provision the plugin with short-lived credentials
+
+In this example, we used the `tctl auth sign` command to fetch credentials for
+the plugin. For production usage, we recommend provisioning short-lived
+credentials via Machine & Workload Identity, which reduces the risk of these credentials becoming
+stolen. View our [Machine & Workload Identity documentation](../../../machine-workload-identity/machine-workload-identity.mdx) to
+learn more.
+
diff --git a/docs/pages/identity-governance/access-requests/plugins/jira.mdx b/docs/pages/identity-governance/access-requests/plugins/jira.mdx
new file mode 100644
index 0000000000000..786583a8da99d
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/jira.mdx
@@ -0,0 +1,452 @@
+---
+title: Run the Jira Access Request Plugin
+sidebar_label: Jira
+description: How to set up the Teleport Jira plugin to notify users when another user requests elevated privileges.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide explains how to set up the Teleport Access Request plugin for Jira.
+Teleport's Jira integration allows you to manage Access Requests as
+Jira issues.
+
+<details>
+<summary>This integration is hosted on Teleport Cloud</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Jira integration"!)
+
+</details>
+
+## How it works
+
+The Teleport Jira plugin synchronizes a Jira project board with the Access
+Requests processed by your Teleport cluster. When you change the status of an
+Access Request within Teleport, the plugin updates the board. And when you
+update the status of an Access Request on the board, the plugin notifies a Jira
+webhook run by the plugin, which modifies the Access Request in Teleport.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- A Jira account with permissions to create applications and webhooks.
+
+- A registered domain name for the Jira webhook. Jira notifies the webhook of
+  changes in your project board.
+
+- An environment where you will run the Jira plugin. This is either:
+
+  - A Linux virtual machine with ports `80` and `8081` open, plus a means of
+    accessing the host (e.g., OpenSSH with an SSH port exposed to your
+    workstation). 
+  - A Kubernetes cluster deployed via a cloud provider. This guide shows you how
+    to allow traffic to the Jira plugin via a `LoadBalancer` service, so your
+    environment must support services of this type.
+
+- A means of providing TLS credentials for the Jira webhook run by the plugin.
+  **TLS certificates must not be self signed.** For example, you can obtain TLS
+  credentials for the webhook with Let's Encrypt by using an [ACME
+  client](https://letsencrypt.org/docs/client-options/).
+
+  - If you run the plugin on a Linux server, you must provide TLS credentials to
+    a directory available to the plugin. 
+  - If you run the plugin on Kubernetes, you must write these credentials to a
+    secret that the plugin can read. This guide assumes that the name of the
+    secret is `teleport-plugin-jira-tls`.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/8. Define RBAC resources
+
+Before you set up the Jira plugin, you need to enable Role Access Requests in
+your Teleport cluster.
+
+(!docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/8. Define a Teleport Jira plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/8. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-jira-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-jira-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/8. Install the Teleport Jira plugin
+
+Install the Teleport Jira plugin following the instructions below, which depend
+on whether you are deploying the plugin on a host (e.g., an EC2 instance) or a
+Kubernetes cluster.
+
+The Teleport Jira plugin must run on a host or Kubernetes cluster that can
+access both Jira and your Teleport Proxy Service (or Teleport Enterprise Cloud
+tenant).
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="jira"!)
+
+## Step 5/8. Set up a Jira project
+
+In this section, you will create a Jira a project that the Teleport plugin can
+modify when a Teleport user creates or updates an Access Request. The plugin
+then uses the Jira webhook to monitor the state of the board and respond to any
+changes in the tickets it creates.
+
+### Create a project for managing Access Requests
+
+In Jira, find the top navigation bar and click **Projects** -> **Create
+project**. Select **Kanban** for the template, then **Use template**. Click
+**Select a company-managed project**.
+
+You'll see a screen where you can enter a name for your project. In this guide,
+we assume that your project is called "Teleport Access Requests", which
+receives the key `TAR` by default. 
+
+Make sure "Connect repositories, documents, and more" is unset, then click
+**Create project**.
+
+In the three-dots menu on the upper right of your new board, click **Board
+settings**, then click **Columns**. Edit the statuses in your board so it
+contains the following four:
+
+1. Pending
+1. Approved
+1. Denied
+1. Expired
+
+Create a column with the same name as each status. The result should be the
+following:
+
+![Jira board setup](../../../../img/enterprise/plugins/jira/board-setup.png)
+
+<Admonition type="warning">
+
+If your project board does not contain these (and only these) columns, each with
+a status of the same name, the Jira Access Request plugin will behave in
+unexpected ways. Remove all other columns and statuses.
+
+</Admonition>
+
+Click **Back to board** to review your changes.
+
+### Retrieve your Jira API token
+
+Obtain an API token that the Access Request plugin uses to make
+changes to your Jira project. Click the gear menu at the upper right of the
+screen, then click **Atlassian account settings**. Click **Security** >
+**Create and manage API tokens** > **Create API token**. 
+
+Choose any label and click **Copy**. Paste the API token into a convenient
+location (e.g., a password manager or local text document) so you can use it
+later in this guide when you configure the Jira plugin.
+
+### Set up a Jira webhook
+
+Now that you have generated an API key that the Teleport Jira plugin uses to
+manage your project, enable Jira to notify the Teleport Jira plugin when your
+project is updated by creating a webhook.
+
+Return to Jira. Click the gear menu on the upper right of the screen. Click
+**System** > **WebHooks** > **Create a WebHook**. 
+
+<Tabs>
+<TabItem label="Executable">
+
+Enter "Teleport Access Request Plugin" in the "Name" field. In the "URL" field,
+enter the domain name you created for the plugin earlier, plus port `8081`.
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+Enter "Teleport Access Request Plugin" in the "Name" field. In the "URL" field,
+enter the domain name you created for the plugin earlier, plus port `443`.
+
+</TabItem>
+</Tabs>
+
+The webhook needs to be notified only when an issue is created, updated, or
+deleted. You can leave all the other boxes empty.
+
+Click **Create**.
+
+## Step 6/8. Configure the Jira Access Request plugin
+
+Earlier, you retrieved credentials that the Jira plugin uses to connect to
+Teleport and the Jira API. You will now configure the plugin to use these
+credentials and run the Jira webhook at the address you configured earlier.
+
+### Create a configuration file
+
+<Tabs>
+<TabItem label="Executable or Docker">
+The Teleport Jira plugin uses a configuration file in TOML format. Generate a
+boilerplate configuration by running the following command (the plugin will not run
+unless the config file is in `/etc/teleport-jira.toml`):
+
+```code
+$ teleport-jira configure | sudo tee /etc/teleport-jira.toml > /dev/null
+```
+
+This should result in a configuration file like the one below:
+
+```toml
+(!examples/resources/plugins/teleport-jira-cloud.toml!)
+```
+</TabItem>
+<TabItem label="Helm chart">
+The Helm chart for the Jira plugin uses a YAML values file to configure the
+plugin. On your local workstation, create a file called
+`teleport-jira-helm.yaml` based on the following example:
+
+```yaml
+(!examples/resources/plugins/teleport-jira-helm-cloud.yaml!)
+```
+
+</TabItem>
+</Tabs>
+
+### Edit the configuration file
+
+Open the configuration file created for the Teleport Jira plugin and update the
+following fields:
+
+**`[teleport]`**
+
+The Jira plugin uses this section to connect to your Teleport cluster:
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+<Tabs>
+<TabItem label="Executable">
+
+### `jira`
+
+**url:** The URL of your Jira tenant, e.g., `https://[your-jira].atlassian.net`.
+
+**username:** The username you were logged in as when you created your API
+token.
+
+**api_token:** The Jira API token you retrieved earlier. 
+
+**project:** The project key for your project, which in our case is `TAR`.
+
+You can leave `issue_type` as `Task` or remove the field, as `Task` is the
+default.
+
+### `http`
+
+The `[http]` setting block describes how the plugin's webhook works. 
+
+**listen_addr** indicates the address that the plugin listens on, and defaults
+to `:8081`. If you opened port `8081` on your plugin host as we recommended
+earlier in the guide, you can leave this option unset.
+
+**public_addr** is the public address of your webhook. This is the domain name you
+added to the DNS A record you created earlier.
+
+**https_key_file** and **https_cert_file** correspond to the private key and
+certificate you obtained before following this guide. Use the following values,
+assigning <Var name="example.com" /> to the domain name you created for the
+plugin earlier:
+
+- **https_key_file:** 
+
+  ```code
+  $ /var/teleport-jira/tls/certificates/acme-v02.api.letsencrypt.org-directory/<Var name="example.com" />/<Var name="example.com" />.key
+  ```
+
+- **https_cert_file:** 
+
+  ```code
+  $ /var/teleport-jira/tls/certificates/acme-v02.api.letsencrypt.org-directory/<Var name="example.com" />/<Var name="example.com" />.crt
+  ```
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+### `jira`
+
+**url:** The URL of your Jira tenant, e.g., `https://[your-jira].atlassian.net`.
+
+**username:** The username you were logged in as when you created your API
+token. 
+
+**apiToken:** The API token you retrieved earlier.  
+
+**project:** The project key for your project, which in our case is `TAR`.
+
+You can leave `issueType` as `Task` or remove the field, as `Task` is the
+default.
+
+### `http`
+
+The `http` setting block describes how the plugin's webhook works. 
+
+**publicAddress:** The public address of your webhook. This is the domain name
+you created for your webhook. (We will create a DNS record for this domain name
+later.)
+
+**tlsFromSecret:** The name of a Kubernetes secret containing TLS credentials
+for the webhook. Use `teleport-plugin-jira-tls`.
+
+</TabItem>
+</Tabs>
+
+## Step 7/8. Run the Jira plugin
+
+After finishing your configuration, you can now run the plugin and test your
+Jira-based Access Request flow:
+
+<Tabs>
+<TabItem label="Executable">
+
+Run the following on your Linux host:
+
+```code
+$ sudo teleport-jira start
+INFO   Starting Teleport Jira Plugin 12.1.1: jira/app.go:112
+INFO   Plugin is ready jira/app.go:142
+```
+</TabItem>
+<TabItem label="Helm Chart">
+
+Install the Helm chart for the Teleport Jira plugin:
+
+```code
+$ helm install teleport-plugin-jira teleport/teleport-plugin-jira \
+  --namespace teleport \
+  --values values.yaml \
+  --version (=teleport.plugin.version=)
+```
+
+Create a DNS record that associates the webhook's domain name with the address
+of the load balancer created by the Jira plugin Helm chart.
+
+See whether the load balancer has a domain name or IP address:
+
+```code
+$ kubectl -n teleport get services/teleport-plugin-jira
+NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP                          PORT(S)                      AGE
+teleport-plugin-jira   LoadBalancer   10.100.135.75   abc123.us-west-2.elb.amazonaws.com   80:30625/TCP,443:31672/TCP   134m
+```
+
+If the `EXTERNAL-IP` field has a domain name for the value, create a `CNAME`
+record in which the domain name for your webhook points to the domain name of
+the load balancer.
+
+If the `EXTERNAL-IP` field's value is an IP address, create a DNS `A` record
+instead.
+
+You can then generate signed TLS credentials for the Jira plugin, which expects
+them to be written to a Kubernetes secret.
+
+</TabItem>
+</Tabs>
+
+### Check the status of the webhook
+
+Confirm that the Jira webhook has started serving by sending a GET request to
+the `/status` endpoint. If the webhook is running, it will return a `200` status
+code with no document body:
+
+<Tabs>
+<TabItem label="Executable">
+
+```code
+$ curl -v https://<Var name="example.com" />:8081/status 2>&1 | grep "^< HTTP/2"
+< HTTP/2 200
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+```code
+$ curl -v https://<Var name="example.com" />:443/status 2>&1 | grep "^< HTTP/2"
+< HTTP/2 200
+```
+
+</TabItem>
+</Tabs>
+
+### Create an Access Request
+
+Sign in to your cluster as the `myuser` user you created earlier and create an
+Access Request:
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+When you create the request, you will see a new task in the "Pending" column of the Access Requests board:
+
+![New Access Request](../../../../img/enterprise/plugins/jira/new-request.png)
+
+### Resolve the request
+
+Move the card corresponding to your new Access Request to the "Denied" column,
+then click the card and navigate to Teleport. You will see that the Access
+Request has been denied.
+
+<Admonition type="warning" title="Auditing Access Requests">
+
+Anyone with access to the Jira project board can modify the status of Access
+Requests reflected on the board. You can check the Teleport audit log to ensure
+that the right users are reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+## Step 8/8. Set up systemd
+
+<Admonition type="tip">
+
+This step is only applicable if you are running the Teleport Jira plugin on a
+Linux machine.
+
+</Admonition>
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd. Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```txt
+(!examples/systemd/plugins/teleport-jira.service!)
+```
+
+Save this as `teleport-jira.service` or another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+```code
+$ sudo systemctl enable teleport-jira
+$ sudo systemctl start teleport-jira
+```
diff --git a/docs/pages/identity-governance/access-requests/plugins/mattermost.mdx b/docs/pages/identity-governance/access-requests/plugins/mattermost.mdx
new file mode 100644
index 0000000000000..5b86b07f8fb4c
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/mattermost.mdx
@@ -0,0 +1,382 @@
+---
+title: Run the Mattermost Access Request plugin
+sidebar_label: Mattermost
+description: How to set up Teleport's Mattermost plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+import BotLogo from "/static/avatar_logo.png";
+
+This guide explains how to integrate Access Requests with Mattermost, an open 
+source messaging platform. 
+
+<details>
+<summary>This integration is hosted on Teleport Cloud</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Mattermost integration"!)
+
+</details>
+
+## How it works
+
+The Teleport Mattermost plugin notifies individuals of Access Requests. Users
+can then approve and deny Access Requests by following the message link, making
+it easier to implement security best practices without compromising
+productivity.
+
+![The Mattermost Access Request plugin](../../../../img/enterprise/plugins/mattermost/diagram.png)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- A Mattermost account with admin privileges. This plugin has been tested with
+  Mattermost v7.0.1.
+- Either a Linux host or Kubernetes cluster where you will run the Teleport Mattermost plugin.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/8. Define RBAC resources
+
+Before you set up the Mattermost plugin, you will need to enable Role Access Requests
+in your Teleport cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/8. Define a Teleport Mattermost plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/8. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-mattermost-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-mattermost-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/8. Install the Teleport Mattermost plugin
+
+<Tabs>
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+
+We recommend installing Teleport plugins on the same host as the Teleport Proxy
+Service. This is an ideal location as plugins have a low memory footprint, and
+require both public internet access and Teleport Auth Service access.
+
+</TabItem>
+
+<TabItem scope="cloud" label="Teleport Enterprise Cloud">
+
+Install the Teleport Mattermost plugin on a host that can access both your
+Teleport Proxy Service and your Mattermost deployment.
+
+</TabItem>
+
+</Tabs>
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="mattermost"!)
+
+## Step 5/8. Register a Mattermost bot
+
+Now that you have generated the credentials your plugin needs to connect to your
+Teleport cluster, register your plugin with Mattermost so it can send Access
+Request messages to your workspace.
+
+In Mattermost, click the menu button in the upper left of the UI, then click
+System Console → Integrations → Bot Accounts.
+
+Set "Enable Bot Account Creation" to "true".
+
+![Enable Mattermost bots](../../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)
+
+This will allow you to create a new bot account for the Mattermost plugin.
+
+Go back to your team. In the menu on the upper left of the UI, click
+Integrations → Bot Accounts → Add Bot Account.
+
+Set the "Username", "Display Name", and "Description" fields according to how
+you would like the Mattermost plugin bot to appear in your workspace. Set "Role"
+to "Member".
+
+{/* lint ignore absolute-docs-links */}
+You can <a href={BotLogo} download>download</a> our avatar to set as your Bot
+Icon.
+
+Set "post:all" to "Enabled".
+
+![Enable Mattermost Bots](../../../../img/enterprise/plugins/mattermost/mattermost_bot.png)
+
+Click "Create Bot Account". We will use the resulting OAuth 2.0 token when we
+configure the Mattermost plugin.
+
+## Step 6/8. Configure the Mattermost plugin
+
+At this point, you have generated credentials that the Mattermost plugin will use
+to connect to Teleport and Mattermost. You will now configure the Mattermost
+plugin to use these credentials and post messages in the right channels for your
+workspace.
+
+<Tabs>
+<TabItem label="Executable or Docker">
+The Mattermost plugin uses a configuration file in TOML format. On the host where you
+will run the Mattermost plugin, generate a boilerplate configuration by running the
+following commands:
+
+```code
+$ teleport-mattermost configure > teleport-mattermost.toml
+$ sudo mv teleport-mattermost.toml /etc
+```
+</TabItem>
+<TabItem label="Helm Chart">
+The Mattermost Helm Chart uses a YAML values file to configure the plugin. On
+the host where you have Helm installed, create a file called
+`teleport-mattermost-helm.yaml` based on the following example:
+
+```yaml
+(!examples/resources/plugins/teleport-mattermost-helm-cloud.yaml!)
+```
+</TabItem>
+</Tabs>
+
+Edit the configuration as explained below:
+
+### `[teleport]`
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+### `[mattermost]`
+
+**`url`**: Include the scheme (`https://`) and fully qualified domain name of
+your Mattermost deployment.
+
+**`token`**: Find your Mattermost bot's OAuth 2.0 token. To do so, visit
+Mattermost. In the menu on the upper left of the UI, go to Integrations → Bot
+Accounts. Find the listing for the Teleport plugin and click "Create New Token".
+After you save the token, you will see a message with text in the format,
+"Access Token: TOKEN". Copy the token and paste it here.
+
+**`recipients`**: This field configures the channels that the Mattermost plugin
+will notify when it receives an Access Request message. The value is an array of
+strings, where each element is either:
+
+- The email address of a Mattermost user to notify via a direct message when the
+  plugin receives an Access Request event
+- A channel name in the format `team/channel`, where `/` separates the name
+  of the team and the name of the channel
+
+For example, this configuration will notify `first.last@example.com` and
+the `Town Square` channel in the `myteam` team of any Access Request events:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+```toml
+recipients = [
+  "myteam/Town Square",
+  "first.last@example.com"
+]
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+
+```yaml
+recipients:
+  - "myteam/Town Square"
+  - first.last@example.com
+```
+
+</TabItem>
+</Tabs>
+
+You will need to invite your Teleport plugin to any channel you add to the
+`recipients` list (aside from direct message channels). Visit Mattermost,
+navigate to each channel you want to invite the plugin to, and enter `/invite
+@teleport` (or the name of the bot you configured) into the message box.
+
+![Invite the bot](../../../../img/enterprise/plugins/mattermost/add-bot.png)
+
+<details>
+<summary>Suggested reviewers</summary>
+
+Users can also suggest reviewers when they create an Access Request, e.g.,:
+
+```code
+$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
+```
+
+If an Access Request includes suggested reviewers, the Mattermost plugin will
+add these to the list of channels to notify. If a suggested reviewer is an email
+address, the plugin will look up the direct message channel for that address
+and post a message in that channel.
+
+If `recipients` is empty, and the user requesting elevated privileges has not
+suggested any reviewers, the plugin will skip forwarding the Access Request to
+Mattermost.
+
+</details>
+
+The final configuration should look similar to this:
+
+<Tabs>
+<TabItem label="Executable or Docker" >
+```yaml
+# example mattermost configuration TOML file
+[teleport]
+auth_server = "myinstance.teleport.sh:443"                   # Teleport Cloud proxy HTTPS address
+identity = "/var/lib/teleport/plugins/mattermost/identity"   # Identity file path
+refresh_identity = true                                      # Refresh identity file on a periodic basis
+
+[mattermost]
+url = "https://mattermost.example.com" # Mattermost Server URL
+token = "api-token"                    # Mattermost Bot OAuth token
+recipients = [
+  "myteam/general",
+  "first.last@example.com"
+]
+
+[log]
+output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/mattermost.log"
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+
+```
+</TabItem>
+<TabItem label="Helm Chart">
+```yaml
+(!examples/resources/plugins/teleport-mattermost-helm-cloud.yaml!)
+```
+</TabItem>
+</Tabs>
+
+## Step 7/8. Test your Mattermost bot
+
+<Tabs>
+<TabItem label="Executable">
+After modifying your configuration, run the bot with the following command:
+
+```code
+$ teleport-mattermost start -d
+```
+
+The `-d` flag provides debug information to make sure the bot can connect to
+Mattermost, e.g.:
+
+```text
+DEBU   Checking Teleport server version mattermost/main.go:234
+DEBU   Starting a request watcher... mattermost/main.go:296
+DEBU   Starting Mattermost API health check... mattermost/main.go:186
+DEBU   Starting secure HTTPS server on :8081 utils/http.go:146
+DEBU   Watcher connected mattermost/main.go:260
+DEBU   Mattermost API health check finished ok mattermost/main.go:19
+```
+</TabItem>
+<TabItem label="Docker">
+
+Run the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-mattermost.toml public.ecr.aws/gravitational/teleport-plugin-mattermost:(=teleport.version=) start
+```
+</TabItem>
+<TabItem label="Helm Chart">
+After modifying your configuration, run the bot with the following command:
+
+```code
+$ helm upgrade --install teleport-plugin-mattermost teleport/teleport-plugin-mattermost --values teleport-mattermost-helm.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-mattermost
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-mattermost-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-mattermost
+```
+
+</TabItem>
+</Tabs>
+
+### Create an Access Request
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+The users and channels you configured earlier to review the request should
+receive a message from "Teleport" in Mattermost allowing them to visit a link in
+the Teleport Web UI and either approve or deny the request.
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+<Admonition type="info" title="Auditing Access Requests">
+
+When the Mattermost plugin posts an Access Request notification to a channel,
+anyone with access to the channel can view the notification and follow the link.
+While users must be authorized via their Teleport roles to review Access
+Requests, you should still check the Teleport audit log to ensure that the right
+users are reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+## Step 8/8. Set up systemd
+
+This section is only relevant if you are running the Teleport Mattermost plugin
+on a Linux host.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd. Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!examples/systemd/plugins/teleport-mattermost.service!)
+```
+
+Save this as `teleport-mattermost.service` in either `/usr/lib/systemd/system/` or
+another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-mattermost
+$ sudo systemctl start teleport-mattermost
+```
+
diff --git a/docs/pages/identity-governance/access-requests/plugins/msteams.mdx b/docs/pages/identity-governance/access-requests/plugins/msteams.mdx
new file mode 100644
index 0000000000000..d5127d327a372
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/msteams.mdx
@@ -0,0 +1,584 @@
+---
+title: Access Requests with Microsoft Teams
+sidebar_label: Microsoft Teams
+description: How to set up Teleport's Microsoft Teams plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide will explain how to set up Microsoft Teams to receive Access Request messages
+from Teleport.
+
+<details>
+<summary>This integration is hosted on Teleport Enterprise (Cloud)</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Microsoft Teams integration"!)
+
+![Create Microsoft Teams Bot](../../../../img/enterprise/plugins/msteams/enroll-bot.png)
+
+Once enrolled you can download the required `app.zip` file from the integrations status page.
+
+![Download app.zip](../../../../img/enterprise/plugins/msteams/app-zip.png)
+
+</details>
+
+## How it works
+
+Teleport's Microsoft Teams integration notifies individuals of Access Requests.
+Users can then approve and deny Access Requests by following the message link,
+making it easier to implement security best practices without compromising
+productivity.
+
+![The Microsoft Teams Access Request plugin](../../../../img/enterprise/plugins/msteams.png)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- A Microsoft Teams License (Microsoft 365 Business).
+- Azure console access in the organization/directory holding the Microsoft Teams
+  License.
+- An Azure resource group in the same directory. This will host resources for
+  the Microsoft Teams Access Request plugin. You should have enough
+  permissions to create and edit Azure Bot Services in this resource group.
+- Someone with Global Admin rights on Microsoft Entra ID in order to grant
+  permissions to the plugin.
+- Someone with the `Teams administrator` role that can approve installation
+  requests for Microsoft Teams Apps.
+- Either an Azure virtual machine or Kubernetes cluster where you will run the
+  Teleport Microsoft Teams plugin.
+
+(!/docs/pages/includes/tctl.mdx!)
+
+## Step 1/9. Define RBAC resources
+
+Before you set up the Microsoft Teams plugin, you will need to enable Role Access Requests
+in your Teleport cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/9. Define a Teleport Microsoft Teams plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/9. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-msteams-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-msteams-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/9. Install the Teleport Microsoft Teams plugin
+
+Install the Microsoft Teams plugin on your workstation. If you are deploying the
+plugin on Kubernetes, you will still need to install the plugin locally in order
+to generate an application archive to upload later in this guide.
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="msteams"!)
+
+## Step 5/9. Register an Azure Bot
+
+The Access Request plugin for Microsoft Teams receives Access Request events from the
+Teleport Auth Service, formats them into Microsoft Teams messages, and sends them to the
+Microsoft Teams API to post them in your workspace. For this to work, you must register a
+new Azure Bot. Azure Bot is a managed service by Microsoft that allows to
+develop bots that interact with users through different channels, including
+Microsoft Teams.
+
+### Register a new Azure bot
+
+Visit [https://portal.azure.com/#create/Microsoft.AzureBot](https://portal.azure.com/#create/Microsoft.AzureBot)
+to create a new bot. Choose the bot handle so you can find the bot later in the Azure console (the bot handle will
+not be displayed to the user or used to configure the Microsoft Teams plugin). Also edit the Azure subscription,
+the resource group and the bot pricing tier.
+
+In the "Microsoft App ID" section choose "Single Tenant" and "Create new
+Microsoft App ID".
+
+![Create Azure Bot](../../../../img/enterprise/plugins/msteams/create-azure-bot.png)
+
+### Connect the bot to Microsoft Teams
+
+Once the bot is created, open its resource page on the Azure console and
+navigate to the "Channels" tab. Click "Microsoft Teams" and add the Microsoft Teams
+channel.
+
+The result should be as follows:
+
+![Add Bot Channel](../../../../img/enterprise/plugins/msteams/add-bot-channel.png)
+
+### Obtain information about your Microsoft App
+
+On the bot's "Configuration" tab, copy and keep in a safe place the values of
+"Microsoft App ID" and "App Tenant ID". Those two UUIDs will be used in the
+plugin configuration.
+
+Click the "Manage" link next to "Microsoft App ID". This will open the app management view.
+
+![Manage Bot App](../../../../img/enterprise/plugins/msteams/manage-bot-app.png)
+
+Then, go to the "Certificates & Secrets" section and choose to create a "New client secret".
+Use the "Copy" icon to copy the newly created secret and keep it with the
+previously recovered App ID and Tenant ID.
+
+The client secret will be used by the Teleport plugin to authenticate as the bot's app when
+searching users and posting messages.
+
+### Specify the permissions used by the app
+
+Still in the app management view ("Configuration", then "Manage" the Microsoft App ID),
+go to the "API permissions" tab.
+
+Add the following Microsoft Graph Application permissions:
+
+| Permission name | Reason |
+|---|---|
+| `AppCatalog.Read.All` | Used to list Teams Apps and check the app is installed. |
+| `User.Read.All` | Used to get notification recipients. |
+| `TeamsAppInstallation.ReadWriteSelfForUser.All` | Used to initiate communication with a user that never interacted with the Teams App before. |
+| `TeamsAppInstallation.ReadWriteSelfForTeam.All` | Used to discover if the app is installed in the Team. |
+
+At this point the app declares the required permissions but those have not been granted.
+
+If you are an admin, click "Grant admin consent for \<directory name\>". If you are not an admin,
+contact an admin user to grant the permissions.
+
+![Specify App Permissions](../../../../img/enterprise/plugins/msteams/specify-app-permissions.png)
+
+Once permissions have been approved, refresh the page and check the approval status.
+The result should be as follows:
+
+![Granted App Permissions](../../../../img/enterprise/plugins/msteams/granted-app-permissions.png)
+
+## Step 6/9. Configure the Teleport Microsoft Teams plugin
+
+At this point, the Teleport Microsoft Teams plugin has the credentials it needs to
+communicate with your Teleport cluster and Azure APIs, but the app has not been
+installed to Microsoft Teams yet.
+
+In this step, you will configure the Microsoft Teams plugin to use the Azure
+credentials and generate the Teams App package that will be used to install the
+Microsoft Teams App. You will also configure the plugin to notify
+the right Microsoft Teams users when it receives an Access Request update.
+
+### Generate a configuration file and assets
+
+Generate a configuration file for the plugin. The instructions depend on whether
+you are deploying the plugin on a virtual machine or Kubernetes:
+
+<Tabs>
+<TabItem label="Virtual Machine">
+
+The Teleport Microsoft Teams plugin uses a config file in TOML format.  The
+`configure` subcommand generates the directory
+`/var/lib/teleport/plugins/msteams/assets` containing the TOML configuration
+file and an `app.zip` file that will be used later to add the Teams App into the
+organization catalog.
+
+Run the following command on your virtual machine:
+
+```code
+$ export AZURE_APPID="your-appid"
+$ export AZURE_TENANTID="your-tenantid"
+$ export AZURE_APPSECRET="your-appsecret"
+$ teleport-msteams configure /var/lib/teleport/plugins/msteams/assets --appID "$AZURE_APPID" --tenantID "$AZURE_TENANTID" --appSecret "$AZURE_APPSECRET"
+```
+
+This should result in a config file like the one below:
+
+```toml
+(!examples/resources/plugins/teleport-msteams.toml!)
+```
+
+Copy the `/var/lib/teleport/plugins/msteams/assets/app.zip` file to your local
+computer. You will have to upload it to Microsoft Teams later.
+
+On the host where you will run the Microsoft Teams plugin, move the file
+`/var/lib/teleport/plugins/msteams/assets/teleport-msteams.toml` to
+`/etc/teleport-msteams.toml`. You can then edit the copy located in `/etc/`.
+
+</TabItem>
+<TabItem label="Kubernetes">
+
+Run the following command on your local machine:
+
+```code
+$ export AZURE_APPID="your-appid"
+$ export AZURE_TENANTID="your-tenantid"
+$ export AZURE_APPSECRET="your-appsecret"
+$ teleport-msteams configure /var/lib/teleport/plugins/msteams/assets --appID "$AZURE_APPID" --tenantID "$AZURE_TENANTID" --appSecret "$AZURE_APPSECRET"
+```
+
+This command generates an application archive at
+`/var/lib/teleport/plugins/msteams/assets/app.zip`. You will upload it to
+Microsoft Teams later in this guide.
+
+Create a file on your workstation called `teleport-msteams-helm.yaml` with the
+following content:
+
+```yaml
+(!examples/resources/plugins/teleport-msteams-helm.yaml!)
+```
+
+You will edit this file in the next section.
+
+</TabItem>
+</Tabs>
+
+<Admonition type="warning" title="Configure command">
+The `configure` command is not idempotent. It generates a new Microsoft Teams
+application UUID with each execution. It is not possible to use an `app.zip` and
+a TOML configuration generated by two different executions.
+</Admonition>
+
+### Edit the configuration file
+
+Edit the configuration file according to the instructions below.
+
+#### `[teleport]`
+
+The Microsoft Teams plugin uses this section to connect to your Teleport
+cluster.
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+#### `[msapi]`/`msTeams`
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+Make sure the `app_id`, `app_secret`, `tenant_id`, and `teams_app_id` fields are
+filled in with the correct information, which you obtained earlier in this
+guide.
+</TabItem>
+<TabItem label="Helm Chart">
+
+Make sure the `appID`, `tenantID`, and `teamsAppID` fields are filled in with
+the correct information, which you obtained earlier in this guide.
+
+</TabItem>
+</Tabs>
+
+#### `[role_to_recipients]`
+
+The `role_to_recipients` map (`roleToRecipients` for Helm users) configures the
+users and channels that the Microsoft Teams plugin will notify when a user
+requests access to a specific role. When the Microsoft Teams plugin receives an
+Access Request from the Auth Service, it will look up the role being requested
+and identify the Microsoft Teams users and channels to notify.
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+Here is an example of a `role_to_recipients` map. Each value can be a single
+string or an array of strings:
+
+```toml
+[role_to_recipients]
+"*" = "alice@example.com"
+"dev" = ["alice@example.com", "bob@example.com"]
+"dba" = "https://teams.microsoft.com/l/channel/19%3somerandomid%40thread.tacv2/ChannelName?groupId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+```
+</TabItem>
+<TabItem label="Helm Chart">
+
+In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
+and uses the following format, where keys are strings and values are arrays of
+strings:
+
+```toml
+roleToRecipients:
+  "*": "alice@example.com"
+  "dev": ["alice@example.com", "bob@example.com"]
+  "dba": "https://teams.microsoft.com/l/channel/19%3somerandomid%40thread.tacv2/ChannelName?groupId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+```
+</TabItem>
+</Tabs>
+
+In the `role_to_recipients` map, each key is the name of a Teleport role. Each
+value configures the Teams user (or users) to notify. Each string must be either
+the email address of a Microsoft Teams user or a channel URL.
+
+You can find the URL of a channel by opening the channel and clicking the button
+"Get link to channel":
+
+![Copy Teams Channel](../../../../img/enterprise/plugins/msteams/copy-teams-channel.png)
+
+The `role_to_recipients` map must also include an entry for `"*"`, which the
+plugin looks up if no other entry matches a given role name. In the example
+above, requests for roles aside from `dev` and `dba` will notify `alice@example.com`.
+
+<details>
+<summary>Suggested reviewers</summary>
+
+Users can suggest reviewers when they create an Access Request, e.g.,:
+
+```code
+$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
+```
+
+If an Access Request includes suggested reviewers, the Microsoft Teams plugin will add
+these to the list of channels to notify. If a suggested reviewer is an email
+address, the plugin will look up the direct message channel for that
+address and post a message in that channel.
+
+</details>
+
+Configure the Microsoft Teams plugin to notify you when a user requests the `editor` role
+by adding the following to your `role_to_recipients` config (replace
+`TELEPORT_USERNAME` with the email of the user you assigned the `editor-reviewer`
+role earlier):
+
+<Tabs>
+<TabItem label="Executable or Docker">
+
+```toml
+[role_to_recipients]
+"*" = "TELEPORT_USERNAME"
+"editor" = "TELEPORT_USERNAME"
+```
+</TabItem>
+<TabItem label="Helm Chart">
+
+```toml
+roleToRecipients:
+  "*": "TELEPORT_USERNAME"
+  "editor": "TELEPORT_USERNAME"
+```
+</TabItem>
+</Tabs>
+
+The final configuration file should resemble the following:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+```toml
+(!examples/resources/plugins/teleport-msteams.toml!)
+```
+</TabItem>
+<TabItem label="Helm Chart">
+```yaml
+(!examples/resources/plugins/teleport-msteams-helm.yaml!)
+```
+</TabItem>
+</Tabs>
+
+## Step 7/9. Add and configure the Teams App
+
+### Upload the Teams App
+
+Open Microsoft Teams and go to "Apps", "Manage your apps", then in the additional
+choices menu choose "Upload an App".
+
+![Upload Teams App](../../../../img/enterprise/plugins/msteams/upload-teams-app.png)
+
+If you're a Teams admin, choose "Upload an app to your org's app catalog".
+This will allow you to skip the approval step.
+If you're not a Microsoft Teams admin, choose "Submit an app to your org".
+
+Upload the `app.zip` file you generated earlier.
+
+### Approve the Teams App
+
+If you are not a Teams admin and chose "Submit an app to your org",
+you will have to ask a Teams admin to approve it.
+
+They can do so by connecting to the
+[Teams admin dashboard](https://admin.teams.microsoft.com/policies/manage-apps),
+searching "TeleBot", selecting it and choosing "Allow".
+
+![Upload Teams App](../../../../img/enterprise/plugins/msteams/allowed-teams-app.png)
+
+### Add the Teams App to a Team
+
+Once the app is approved it should appear in the "Apps built for your org" section.
+Add the newly uploaded app to a team. Open the app, click "Add to a team",
+choose the "General" channel of your team and click "Set up a bot".
+
+![Add Teams App](../../../../img/enterprise/plugins/msteams/add-teams-app.png)
+
+Note: Once an app is added to a team, it can post on all channels.
+
+## Step 8/9. Test the Teams App
+
+Once Teleport is running, you've created the Teams App, and the plugin is
+configured, you can now run the plugin and test the workflow.
+
+### Test Microsoft Teams connectivity
+
+Start the plugin in validation mode:
+
+```code
+$ teleport-msteams validate <email of your teams account>
+```
+
+If everything works fine, the log output should look like this:
+
+```text
+teleport-msteams v(=teleport.plugin.version=) go(=teleport.golang=)
+
+ - Checking application xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx status...
+ - Application found in the team app store (internal ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
+ - User xxxxxx@xxxxxxxxx.xxx found: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+ - Application installation ID for user: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ - Chat ID for user: 19:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@unq.gbl.spaces
+ - Chat web URL: https://teams.microsoft.com/l/chat/19%3Axxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%40unq.gbl.spaces/0?tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+ - Hailing the user...
+ - Message sent, ID: XXXXXXXXXXXXX
+
+Check your MS Teams!
+```
+
+The plugin should exit and you should have received two messages through Microsoft Teams.
+
+![Validate Bot Message](../../../../img/enterprise/plugins/msteams/validate-bot-message.png)
+
+### Start the MS Teams Plugin
+
+After you configured and validated the MS Teams plugin, you can now run the
+plugin and test the workflow.
+
+<Tabs>
+<TabItem label="Executable">
+
+Run the following command to start the Teleport MS Teams plugin.  The `-d` flag
+will provide debug information to ensure that the plugin can connect to MS Teams
+and your Teleport cluster:
+
+```code
+$ teleport-msteams start -d
+DEBU   DEBUG logging enabled msteams/main.go:120
+INFO   Starting Teleport MS Teams Plugin (=teleport.plugin.version=): msteams/app.go:74
+DEBU   Attempting GET teleport.example.com:443/webapi/find webclient/webclient.go:129
+DEBU   Checking Teleport server version msteams/app.go:242
+INFO   MS Teams app found in org app store id:292e2881-38ab-7777-8aa7-cefed1404a63 name:TeleBot msteams/app.go:179
+INFO   Preloading recipient data... msteams/app.go:185
+INFO   Recipient found, chat found chat_id:19:a8c06deb-aa2b-4db5-9c78-96e48f625aef_a36aec2e-f11c-4219-b79a-19UUUU57de70@unq.gbl.spaces kind:user recipient:jeff@example.com msteams/app.go:195
+INFO   Recipient data preloaded and cached. msteams/app.go:198
+DEBU   Watcher connected watcherjob/watcherjob.go:121
+INFO   Plugin is ready msteams/app.go:227
+```
+
+</TabItem>
+<TabItem label="Docker">
+Run the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-msteams.toml public.ecr.aws/gravitational/teleport-plugin-msteams:(=teleport.version=) start
+```
+
+</TabItem>
+<TabItem label="Helm Chart">
+Install the plugin:
+
+```code
+$ helm upgrade --install teleport-plugin-msteams teleport/teleport-plugin-msteams --values teleport-msteams-helm.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-msteams
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-msteams-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-msteams
+```
+
+</TabItem>
+</Tabs>
+
+### Create an Access Request
+
+Create an Access Request and check if the plugin works as expected with the
+following steps.
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+The user you configured earlier to review the request should receive a direct
+message from "TeleBot" in Microsoft Teams allowing them to visit a link in the Teleport
+Web UI and either approve or deny the request.
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+Once the request is resolved, the Microsoft Teams bot will update the Access Request message
+to reflect its new status.
+
+<Admonition type="warning" title="Auditing Access Requests">
+
+When the Microsoft Teams plugin posts an Access Request notification to a channel, anyone
+with access to the channel can view the notification and follow the link. While
+users must be authorized via their Teleport roles to review Access Requests, you
+should still check the Teleport audit log to ensure that the right users are
+reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+## Step 9/9. Set up systemd
+
+This section is only relevant if you are running the Teleport Microsoft Teams
+plugin on a virtual machine.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd.  Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!examples/systemd/plugins/teleport-msteams.service!)
+```
+
+Save this as `teleport-msteams.service` in either `/usr/lib/systemd/system/` or
+another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-msteams
+$ sudo systemctl start teleport-msteams
+```
+
+## Next steps
+
+- Read our guides to configuring [Resource Access
+    Requests](../resource-requests.mdx) and [Role Access
+    Requests](../role-requests.mdx) so you can get the most out
+    of your Access Request plugins.
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx b/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx
similarity index 80%
rename from docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx
rename to docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx
index 344eb2f806d76..52881599cbcb6 100644
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx
+++ b/docs/pages/identity-governance/access-requests/plugins/opsgenie.mdx
@@ -1,8 +1,17 @@
 ---
 title: Access Requests with Opsgenie
+sidebar_label: Opsgenie
 description: How to set up Teleport's Opsgenie plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 With Teleport's Opsgenie integration, engineers can access the infrastructure
 they need to resolve alerts quickly, without longstanding admin permissions
 that can become a vector for attacks.
@@ -18,26 +27,10 @@ Opsgenie.
 
 ## Prerequisites
 
-- A Teleport Enterprise Cloud account.
-
-- The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=). 
-  
-  You can verify the tools you have installed by running the following commands:
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  
-  $ tsh version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  You can download these tools by following the appropriate [Installation 
-  instructions](../../../installation.mdx) for your environment and Teleport edition.
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise Cloud"!)
 
 - An Opsgenie account with the ability to create API keys with the 'read' and
   'create and update' access rights.
-
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/5. Create services
@@ -89,13 +82,7 @@ Create a user called `myuser` who has the `requester` role. Later in this
 guide, you will create an Access Request as this user to test the Opsgenie
 plugin:
 
-To create a user first navigate to Management -> Access -> Users
-
-![Add user one](../../../../img/enterprise/plugins/opsgenie/add-user-one.png)
-
-Then select 'Create New User' and create a user with the requester role.
-
-![Add user two](../../../../img/enterprise/plugins/opsgenie/add-user-two.png)
+To create a user, first navigate to Zero Trust Access -> Users.
 
 ## Step 3/5. Set up an Opsgenie API key
 
@@ -109,10 +96,9 @@ See https://support.atlassian.com/opsgenie/docs/create-a-default-api-integration
 ## Step 4/5. Configure the Opsgenie plugin
 
 At this point, you have generated credentials that the Opsgenie plugin will use
-to connect to the Opsgenie API. To configure the plugin to use this API key navigate
-to Management -> Integrations -> Enroll New Integration.
-
-![Integrations page](../../../../img/enterprise/plugins/opsgenie/opsgenie-integration-page.png)
+to connect to the Opsgenie API. To configure the plugin to use this API key, 
+navigate to **Add New** in the Web UI; in the left pane, click **Integration**.
+Click the Opsgenie tile.
 
 ## Step 5/5. Test the Opsgenie plugin
 
diff --git a/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx b/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx
new file mode 100644
index 0000000000000..ea9706a5c57a7
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/pagerduty.mdx
@@ -0,0 +1,636 @@
+---
+title: Run the PagerDuty Access Request Plugin
+sidebar_label: PagerDuty
+description: How to set up Teleport's PagerDuty plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+With Teleport's PagerDuty integration, engineers can access the infrastructure
+they need to resolve incidents quickly—without longstanding admin permissions
+that can become a vector for attacks. This guide explains how to set up
+Teleport's Access Request plugin for PagerDuty.
+
+## How it works
+
+Teleport's PagerDuty integration allows you to treat Teleport Role Access
+Requests as PagerDuty incidents, notify the appropriate on-call team, and
+approve or deny the requests via Teleport. You can also configure the plugin to
+approve Role Access Requests automatically if the user making the request is on
+the on-call team for a service affected by an incident.
+
+<details>
+<summary>This integration is hosted on Teleport Cloud</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the PagerDuty integration"!)
+
+</details>
+
+![PagerDuty plugin architecture](../../../../img/enterprise/plugins/pagerduty/diagram.png)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- A PagerDuty account with the "Admin", "Global Admin", or "Account Owner"
+  roles. These roles are necessary for generating an API token that can list and
+  look up user profiles.
+
+  You can see your role by visiting your user page in PagerDuty, navigating to
+  the "Permissions & Teams" tab, and checking the value of the "Base Role"
+  field.
+
+- Either a Linux host or Kubernetes cluster where you will run the PagerDuty plugin.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/8. Create services
+
+To demonstrate the PagerDuty plugin, create two services in PagerDuty. For each
+service, fill in only the "Name" field and skip all other configuration screens,
+leaving options as the defaults:
+
+- `Teleport Access Request Notifications`
+- `My Critical Service`
+
+We will configure the PagerDuty plugin to create an incident in the `Teleport
+Access Request Notifications` service when certain users create an Access
+Request.
+
+For users on the on-call team for `My Critical Service` (in this case, your
+PagerDuty user), we will configure the PagerDuty plugin to approve Access
+Requests automatically, letting them investigate incidents on the service
+quickly.
+
+## Step 2/8. Define RBAC resources
+
+The Teleport PagerDuty plugin works by receiving Access Request events from the
+Teleport Auth Service and, based on these events, interacting with the PagerDuty
+API.
+
+In this section, we will show you how to configure the PagerDuty plugin by
+defining the following RBAC resources:
+
+- A role called `editor-requester`, which can request the built-in `editor`
+  role. We will configure this role to open a PagerDuty incident whenever a
+  user requests it, notifying the on-call team for the `Teleport Access Request
+  Notifications` service.
+- A role called `demo-role-requester`, which can request a role called
+  `demo-role`. We will configure the PagerDuty plugin to auto-approve this
+  request whenever the user making it is on the on-call team for `My Critical
+  Service`.
+- A user and role called `access-plugin` that the PagerDuty plugin will assume
+  in order to authenticate to the Teleport Auth Service. This role will have
+  permissions to approve Access Requests from users on the on-call team for `My
+  Critical Service` automatically.
+- A role called `access-plugin-impersonator` that allows you to generate signed
+  credentials that the PagerDuty plugin can use to authenticate with your
+  Teleport cluster.
+
+### `editor-requester`
+
+Create a file called `editor-request-rbac.yaml` with the following content,
+which defines a role called `editor-reviewer` that can review requests for the
+`editor` role, plus an `editor-requester` role that can request this role.
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: editor-reviewer
+spec:
+  allow:
+    review_requests:
+      roles: ['editor']
+---
+kind: role
+version: v5
+metadata:
+  name: editor-requester
+spec:
+  allow:
+    request:
+      roles: ['editor']
+      thresholds:
+        - approve: 1
+          deny: 1
+      annotations:
+        pagerduty_notify_service: ["Teleport Access Request Notifications"]
+```
+
+The Teleport Auth Service *annotates* Access Request events with metadata based
+on the roles of the Teleport user submitting the Access Request. The PagerDuty
+plugin reads these annotations to determine how to respond to a new Access
+Request event.
+
+Whenever a user with the `editor-requester` role requests the `editor` role, the
+PagerDuty plugin will read the `pagerduty_notify_service` annotation and notify
+PagerDuty to open an incident in the specified service, `Teleport Access Request
+Notifications`, until someone with the `editor-reviewer` role approves or denies
+the request.
+
+Create the roles you defined:
+
+```code
+$ tctl create -f editor-request-rbac.yaml
+role 'editor-reviewer' has been created
+role 'editor-requester' has been created
+```
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+### `demo-role-requester`
+
+Create a file called `demo-role-requester.yaml` with the following content:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: demo-role
+---
+kind: role
+version: v5
+metadata:
+  name: demo-role-requester
+spec:
+  allow:
+    request:
+      roles: ['demo-role']
+      thresholds:
+        - approve: 1
+          deny: 1
+      annotations:
+        pagerduty_services: ["My Critical Service"]
+```
+
+Users with the `demo-role-requester` role can request the `demo-role` role. When
+such a user makes this request, the PagerDuty plugin will read the
+`pagerduty_services` annotation. If the user making the request is on the
+on-call team for a service listed as a value for the annotation, the plugin will
+approve the Access Request automatically.
+
+In this case, the PagerDuty plugin will approve any requests from users on the
+on-call team for `My Critical Service`.
+
+Create the resources:
+
+```code
+$ tctl create -f demo-role-requester.yaml;
+```
+
+<Admonition type="warning">
+
+For auto-approval to work, the user creating an Access Request must have a
+Teleport username that is also the email address associated with a PagerDuty
+account. In this guide, we will add the `demo-role-requester` role to your own
+Teleport account—which we assume is also your email address for PagerDuty—so you
+can request the `demo-role` role.
+
+</Admonition>
+
+### `access-plugin`
+
+Teleport's Access Request plugins authenticate to your Teleport cluster as a
+user with permissions to list, read, and update Access Requests. This way,
+plugins can retrieve Access Requests from the Teleport Auth Service, present
+them to reviewers, and modify them after a review.
+
+Define a user and role called `access-plugin` by adding the following content to
+a file called `access-plugin.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: access-plugin
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list', 'read']
+      - resources: ['access_plugin_data']
+        verbs: ['update']
+    review_requests:
+      roles: ['demo-role']
+      where: 'contains(request.system_annotations["pagerduty_services"], "My Critical Service")'
+---
+kind: user
+metadata:
+  name: access-plugin
+spec:
+  roles: ['access-plugin']
+version: v2
+```
+
+Notice that the `access-plugin` role includes an `allow.review_requests.roles`
+field with `demo-role` as a value. This allows the plugin to review requests for
+the `demo-role` role.
+
+We are also restricting the `access-plugin` role to reviewing only Access
+Requests associated with `My Critical Service`. To do so, we have defined a
+*predicate expression* in the `review_requests.where` field. This expression
+indicates that the plugin *cannot* review requests for `demo-role` unless the
+request contains an annotation with the key `pagerduty_services` and the value
+`My Critical Service`.
+
+<details>
+<summary>How "where" conditions work</summary>
+
+The `where` field includes a predicate expression that determines whether a
+reviewer is allowed to review a specific request. You can include two functions
+in a predicate expression:
+
+|Function|Description|Example|
+|---|---|---|
+|`equals`|A field is equivalent to a value.|`equals(request.reason, "resolve an incident")`
+|`contains`|A list of strings includes a value.|`contains(reviewer.traits["team"], "devops")`|
+
+When you use the `where` field, you can include the following fields in your
+predicate expression:
+
+|Field|Type|Description|
+|---|---|---|
+|`reviewer.roles`|`[]string`|A list of the reviewer's Teleport role names|
+|`reviewer.traits`|`map[string][]string`|A map of the reviewer's Teleport traits by the name of the trait|
+|`request.roles`|`[]string`|A list of the Teleport roles a user is requesting|
+|`request.reason`|`string`|The reason attached to the request|
+|`request.system_annotations`| `map[string][]string`|A map of annotations for the request by annotation key, e.g., `pagerduty_services`|
+
+You can combine functions using the following operators:
+
+|Operator|Format|Description|
+|---|---|---|
+|`&&`|`function && function`|Evaluates to true if both functions evaluate to true|
+|`\|\|`|`function \|\| function`|Evaluates to true if either one or both functions evaluate to true|
+|`!`| `!function`|Evaluates to true if the function evaluates to false|
+
+An example of a function is `equals(request.reason, "resolve an incident")`. To
+configure an `allow` condition to match any Access Request that does not include
+the reason, "resolve an incident", you could use the function,
+`!equals(request.reason, "resolve an incident")`.
+
+</details>
+
+Create the user and role:
+
+```code
+$ tctl create -f access-plugin.yaml
+```
+
+### `access-plugin-impersonator`
+
+As with all Teleport users, the Teleport Auth Service authenticates the
+`access-plugin` user by issuing short-lived TLS credentials. In this case, we
+will need to request the credentials manually by *impersonating* the
+`access-plugin` role and user.
+
+If you are running a self-hosted Teleport Enterprise cluster and are using
+`tctl` from the Auth Service host, you will already have impersonation
+privileges.
+
+To grant your user impersonation privileges for `access-plugin`, define a role
+called `access-plugin-impersonator` by pasting the following YAML document into
+a file called `access-plugin-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: access-plugin-impersonator
+spec:
+  allow:
+    impersonate:
+      roles:
+      - access-plugin
+      users:
+      - access-plugin
+```
+
+Create the `access-plugin-impersonator` role:
+
+```code
+$ tctl create -f access-plugin-impersonator.yaml
+```
+
+### Add roles to your user
+
+Later in this guide, your Teleport user will take three actions that require
+additional permissions:
+
+- Generate signed credentials that the PagerDuty plugin will use to connect to
+  your Teleport Cluster
+- Manually review an Access Request for the `editor` role
+- Create an Access Request for the `demo-role` role
+
+To grant these permissions to your user, give your user the `editor-reviewer`,
+`access-plugin-impersonator`, and `demo-role-requester` roles we defined
+earlier.
+
+Open your user definition in an editor:
+
+```code
+$ TELEPORT_USER=$(tsh status --format=json | jq -r .active.username)
+$ tctl edit users/${TELEPORT_USER?}
+```
+
+Edit the user to include the roles you just created:
+
+```diff
+  roles:
+   - access
+   - auditor
+   - editor
++  - editor-reviewer
++  - access-plugin-impersonator
++  - demo-role-requester
+```
+
+Apply your changes by saving and closing the file in your editor.
+
+Log out of your Teleport cluster and log in again. You will now be able to
+review requests for the `editor` role, request the `demo-role` role, and
+generate signed certificates for the `access-plugin` role and user.
+
+### Create a user who will request access
+
+Create a user called `myuser` who has the `editor-requester` role. Later in this
+guide, you will create an Access Request as this user to test the PagerDuty
+plugin:
+
+```code
+$ tctl users add myuser --roles=editor-requester
+```
+
+`tctl` will print an invitation URL to your terminal. Visit the URL and log in
+as `myuser` for the first time, registering credentials as configured for your
+Teleport cluster.
+
+## Step 3/8. Install the Teleport PagerDuty plugin
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="pagerduty"!)
+
+## Step 4/8. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-pagerduty-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-pagerduty-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 5/8. Set up a PagerDuty API key
+
+Generate an API key that the PagerDuty plugin will use to create and modify
+incidents as well as list users, services, and on-call policies.
+
+In your PagerDuty dashboard, go to **Integrations → API Access Keys** and click
+**Create New API Key**. Add a key description, e.g., "Teleport integration".
+Leave "Read-only API Key" unchecked. Copy the key to a file on your local
+machine. We'll use the key in the plugin config file later.
+
+![Create an API
+key](../../../../img/enterprise/plugins/pagerduty/pagerduty-integrations.png)
+
+## Step 6/8. Configure the PagerDuty plugin
+
+At this point, you have generated credentials that the PagerDuty plugin will use
+to connect to Teleport and the PagerDuty API. You will now configure the
+PagerDuty plugin to use these credentials, plus adjust any settings required for
+your environment.
+
+<Tabs>
+  <TabItem label="Executable or Docker">
+Teleport's PagerDuty plugin has its own configuration file in TOML format. On
+the host where you will run the PagerDuty plugin, generate a boilerplate config
+by running the following commands:
+
+```code
+$ teleport-pagerduty configure > teleport-pagerduty.toml
+$ sudo mv teleport-pagerduty.toml /etc
+```
+  </TabItem>
+  <TabItem label="Helm Chart">
+The PagerDuty Helm Chart uses a YAML values file to configure the plugin. On
+the host where you have Helm installed, create a file called
+`teleport-pagerduty-values.yaml` based on the following example:
+
+```yaml
+teleport:
+  address: ""                 # Teleport Auth Service GRPC API address
+  identitySecretName: ""      # Identity secret name
+  identitySecretPath: ""      # Identity secret path
+
+pagerduty:
+  apiKey: ""                  # PagerDuty API Key
+  userEmail: ""               # PagerDuty bot user email (Could be admin email)
+```
+  </TabItem>
+</Tabs>
+
+<details>
+<summary>Saving the configuration to another location</summary>
+
+The PagerDuty plugin expects the configuration to be in
+`/etc/teleport-pagerduty.toml`, but you can override this with the `--config`
+flag when you run the plugin binary later in this guide.
+
+</details>
+
+Edit the configuration file in `/etc/teleport-pagerduty.toml` as explained
+below:
+
+### `[teleport]`
+
+The PagerDuty plugin uses this section to connect to your Teleport cluster:
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+### `[pagerduty]`
+
+Assign `api_key` to the PagerDuty API key you generated earlier.
+
+Assign `user_email` to the email address of a PagerDuty user on the account
+associated with your API key. When the PagerDuty plugin creates a new incident,
+PagerDuty will display this incident as created by that user.
+
+<details>
+<summary>Overriding annotation names</summary>
+
+This guide has assumed that the Teleport PagerDuty plugin uses
+`pagerduty_notify_service` annotation to determine which services to notify of
+new Access Request events and the `pagerduty_services` annotation to configure
+auto-approval.
+
+If you would like to use a different name for these annotations in your Teleport
+roles, you can assign the `pagerduty.notify_service` and `pagerduty.services`
+fields.
+
+</details>
+
+The final configuration should resemble the following:
+
+<Tabs>
+<TabItem label="Executable or Docker">
+```yaml
+(!examples/resources/plugins/teleport-pagerduty-cloud.toml!)
+```
+</TabItem>
+<TabItem label="Helm Chart" >
+```yaml
+(!examples/resources/plugins/teleport-pagerduty-helm-cloud.yaml!)
+```
+</TabItem>
+</Tabs>
+
+## Step 7/8. Test the PagerDuty plugin
+
+<Tabs>
+<TabItem label="Executable">
+After you configure the PagerDuty plugin, run the following command to start it.
+The `-d` flag will provide debug information to ensure that the plugin can
+connect to PagerDuty and your Teleport cluster:
+
+```code
+$ teleport-pagerduty start -d
+# DEBU   DEBUG logging enabled logrus/exported.go:117
+# INFO   Starting Teleport Access PagerDuty extension 0.1.0-dev.1: pagerduty/main.go:124
+# DEBU   Checking Teleport server version pagerduty/main.go:226
+# DEBU   Starting a request watcher... pagerduty/main.go:288
+# DEBU   Starting PagerDuty API health check... pagerduty/main.go:170
+# DEBU   Starting secure HTTPS server on :8081 utils/http.go:146
+# DEBU   Watcher connected pagerduty/main.go:252
+# DEBU   PagerDuty API health check finished ok pagerduty/main.go:176
+# DEBU   Setting up the webhook extensions pagerduty/main.go:178
+```
+</TabItem>
+<TabItem label="Docker">
+Run the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-pagerduty.toml public.ecr.aws/gravitational/teleport-plugin-pagerduty:(=teleport.version=) start
+```
+</TabItem>
+<TabItem label="Helm Chart">
+After modifying your configuration, run the bot with the following command:
+
+```code
+$ helm upgrade --install teleport-plugin-pagerduty teleport/teleport-plugin-pagerduty --values teleport-pagerduty-values.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-pagerduty
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-pagerduty-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-pagerduty
+```
+
+</TabItem>
+</Tabs>
+
+### Create an Access Request
+
+As the Teleport user `myuser`, create an Access Request for the `editor` role:
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+You should see a log resembling the following on your PagerDuty plugin host:
+
+```
+INFO   Successfully created PagerDuty incident pd_incident_id:00000000000000
+pd_service_name:Teleport Access Request Notifications
+request_id:00000000-0000-0000-0000-000000000000 request_op:put
+request_state:PENDING pagerduty/app.go:366
+```
+
+In PagerDuty, you will see a new incident containing information about the
+Access Request:
+
+![PagerDuty dashboard showing an Access
+Request](../../../../img/enterprise/plugins/pagerduty/new-access-req-incident.png)
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+<Admonition type="warning" title="Auditing Access Requests">
+
+When the PagerDuty plugin sends a notification, anyone who receives the
+notification can follow the enclosed link to an Access Request URL. While users
+must be authorized via their Teleport roles to review Access Request, you
+should still check the Teleport audit log to ensure that the right users are
+reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+### Trigger an auto-approval
+
+As your Teleport user, create an Access Request for the `demo-role` role.
+
+You will see a log similar to the following on your PagerDuty plugin host:
+
+```
+INFO   Successfully submitted a request approval
+pd_user_email:myuser@example.com pd_user_name:My User
+request_id:00000000-0000-0000-0000-000000000000 request_op:put
+request_state:PENDING pagerduty/app.go:511
+```
+
+Your Access Request will appear as `APPROVED`:
+
+```code
+$ tsh requests ls
+ID                                   User               Roles     Created (UTC)       Status
+------------------------------------ ------------------ --------- ------------------- --------
+00000000-0000-0000-0000-000000000000 myuser@example.com demo-role 12 Aug 22 18:30 UTC APPROVED
+```
+
+## Step 8/8. Set up systemd
+
+This section is only relevant if you are running the Teleport PagerDuty plugin
+on a Linux host.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd. Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!examples/systemd/plugins/teleport-pagerduty.service!)
+```
+
+Save this as `teleport-pagerduty.service` in either `/usr/lib/systemd/system/`
+or another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-pagerduty
+$ sudo systemctl start teleport-pagerduty
+```
diff --git a/docs/pages/identity-governance/access-requests/plugins/plugins.mdx b/docs/pages/identity-governance/access-requests/plugins/plugins.mdx
new file mode 100644
index 0000000000000..f5125dd71f20f
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/plugins.mdx
@@ -0,0 +1,69 @@
+---
+title: Just-in-Time Access Request Plugins
+description: "Use Teleport's Access Request plugins to least-privilege access without sacrificing productivity."
+sidebar_label: Plugins
+template: "no-toc"
+sidebar_position: 5
+tags:
+ - access-requests
+ - conceptual
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+Teleport Just-in-Time Access Requests allow users to receive temporary elevated
+privileges by seeking consent from one or more reviewers, depending on your
+configuration.
+
+With Teleport's Access Request plugins, users can manage Access Requests from
+within your organization's existing messaging and project management solutions.
+
+Access Request plugins are self-contained programs that connect to the Teleport
+Auth Service's gRPC API to listen for audit events relating to new or updated
+Access Requests. After processing an Access Request event, Access Request plugins
+interact with a third-party API (e.g., the Slack or PagerDuty APIs). 
+
+## Enrolling Access Request plugins in Teleport Cloud
+
+(!docs/pages/includes/plugins/enroll.mdx name="Access Request plugins"!)
+
+The following Access Request plugins are hosted on Teleport Cloud:
+
+- Datadog
+- Discord
+- Email
+- Jira
+- Mattermost
+- Microsoft Teams
+- Opsgenie
+- PagerDuty
+- ServiceNow
+- Slack
+
+## Self-hosting Access Request plugins
+
+You can host Teleport Access Request plugins yourself. Self-hosted Access
+Request plugins are the only way to manage Access Requests through a third-party
+communication platform if you are self-hosting Teleport. If you use Teleport
+Team or Teleport Enterprise Cloud, you can run self-hosted Access Request
+plugins for more control over configuration and architecture.
+
+Access Request plugins can run within private networks that are isolated from
+the Teleport Auth Service. To access the Auth Service API, they connect to the
+Proxy Service, which establishes a reverse tunnel for the plugin to access the
+Auth Service.
+
+You can run multiple instances of an Access Request plugin for high availability
+by deploying each instance in a separate availability zone. There is no need for
+additional configuration or load balancing, as plugins avoid creating duplicate
+requests to their third-party APIs.
+
+Learn how to deploy and configure a plugin for your organization's communication
+workflows by reading our setup guides:
+
+(!docs/pages/includes/access-request-integrations.mdx!)
+
+To read more about the architecture of an Access Request plugin, and start
+writing your own, read our [Access Request plugin development
+guide](how-to-build.mdx).
diff --git a/docs/pages/admin-guides/access-controls/access-request-plugins/servicenow.mdx b/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx
similarity index 93%
rename from docs/pages/admin-guides/access-controls/access-request-plugins/servicenow.mdx
rename to docs/pages/identity-governance/access-requests/plugins/servicenow.mdx
index 3428590972661..7f3332e61a01a 100644
--- a/docs/pages/admin-guides/access-controls/access-request-plugins/servicenow.mdx
+++ b/docs/pages/identity-governance/access-requests/plugins/servicenow.mdx
@@ -1,8 +1,17 @@
 ---
 title: Access Requests with ServiceNow
+sidebar_label: ServiceNow
 description: How to set up Teleport's ServiceNow plugin for privilege elevation approvals.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 With Teleport's ServiceNow integration, engineers can access the infrastructure
 they need to resolve incidents quickly, without granting longstanding admin permissions
 that can become a vector for attacks.
@@ -18,7 +27,7 @@ ServiceNow.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - An ServiceNow account with access to read and write to and from the 'incident' table.
 - (!docs/pages/includes/tctl.mdx!)
diff --git a/docs/pages/identity-governance/access-requests/plugins/slack.mdx b/docs/pages/identity-governance/access-requests/plugins/slack.mdx
new file mode 100644
index 0000000000000..61f9bf17080c0
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/plugins/slack.mdx
@@ -0,0 +1,435 @@
+---
+title: Run the Slack Access Request Plugin
+description: How to set up Teleport's Slack plugin for privilege elevation approvals.
+sidebar_label: Slack
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+import SlackVideoMp4 from "@version/docs/img/enterprise/plugins/slack/slack.mp4"
+import SlackVideoWebm from "@version/docs/img/enterprise/plugins/slack/slack.webm"
+
+This guide will explain how to set up Slack to receive Access Request messages
+from Teleport. 
+
+<details>
+<summary>This integration is hosted on Teleport Cloud</summary>
+
+(!docs/pages/includes/plugins/enroll.mdx name="the Slack integration"!)
+
+</details>
+
+## How it works
+
+Teleport's Slack integration notifies individuals and channels of
+Access Requests. Users are then directed to log in to the Teleport cluster where
+they can approve and deny Access Requests, making it easier to implement security 
+best practices without compromising productivity.
+
+![The Slack Access Request plugin](../../../../img/enterprise/plugins/slack/diagram.png)
+
+Here is an example of sending an Access Request via Teleport's Slack plugin:
+
+<video controls width="100%" height="100%">
+  <source
+    src={SlackVideoMp4}
+    type="video/mp4"
+  />
+
+  <source
+    src={SlackVideoWebm}
+    type="video/webm"
+  />
+
+  Your browser does not support the video tag.
+</video>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- Slack admin privileges to create an app and install it to your workspace. Your
+  Slack profile must have the "Workspace Owner" or "Workspace Admin" banner
+  below your profile picture.
+- Either a Linux host or Kubernetes cluster where you will run the Slack plugin.
+
+(!/docs/pages/includes/tctl.mdx!)
+
+## Step 1/8. Define RBAC resources
+
+Before you set up the Slack plugin, you will need to enable Role Access Requests
+in your Teleport cluster.
+
+(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)
+
+## Step 2/8. Define a Teleport Slack plugin user
+
+The required permissions for the plugin are configured in the preset `access-plugin`
+role. To generate credentials for the plugin, define either a Machine ID bot user
+or a regular Teleport user.
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate.mdx!)
+</TabItem>
+</Tabs>
+
+## Step 3/8. Export the access plugin identity
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-plugin-slack-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="access-plugin" secret="teleport-plugin-slack-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 4/8. Install the Teleport Slack plugin
+
+(!docs/pages/includes/plugins/install-access-request.mdx name="slack"!)
+
+## Step 5/8. Register a Slack app
+
+The Access Request plugin for Slack receives Access Request events from the
+Teleport Auth Service, formats them into Slack messages, and sends them to the
+Slack API to post them in your workspace. For this to work, you must register a
+new app with the Slack API.
+
+### Create your app
+
+Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new
+Slack app. Click "Create an App", then "From scratch". Fill in the form as shown
+below:
+
+![Create Slack App](../../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)
+
+The "App Name" should be "Teleport". Click the "Development Slack Workspace"
+dropdown and choose the workspace where you would like to see Access Request
+messages.
+
+### Generate an OAuth token with scopes
+
+Next, configure your application to authenticate to the Slack API. We will do
+this by generating an OAuth token that the plugin will present to the Slack API.
+
+We will restrict the plugin to the narrowest possible permissions by using OAuth
+scopes. The Slack plugin needs to post messages to your workspace. It also needs
+to read usernames and email addresses in order to direct Access Request
+notifications from the Auth Service to the appropriate Teleport users in Slack.
+
+After creating your app, the Slack website will open a console where you can
+specify configuration options. On the sidebar menu under "Features", click
+"OAuth & Permissions".
+
+Scroll to the "Scopes" section and click "Add an OAuth Scope" for each of the
+following scopes:
+
+- `chat:write`
+- `incoming-webhook`
+- `users:read`
+- `users:read.email`
+
+The result should look like this:
+
+![API Scopes](../../../../img/enterprise/plugins/slack/api-scopes.png)
+
+After you have configured scopes for your plugin, scroll back to the top of the
+OAuth & Permissions page, find the "OAuth Tokens for Your Workspace" section,
+and click "Install to Workspace". You will see a summary of the permission you
+configured for the Slack plugin earlier.
+
+In "Where should Teleport post?", choose "Slackbot" as the default channel the
+plugin will post to. The plugin will post here when sending direct messages.
+Later in this guide, we will configure the plugin to post in other channels as
+well.
+
+After submitting this form, you will see an OAuth token in the "OAuth &
+Permissions" tab under "Tokens for Your Workspace":
+
+![OAuth Tokens](../../../../img/enterprise/plugins/slack/OAuth.png)
+
+You will use this token later when configuring the Slack plugin.
+
+## Step 6/8. Configure the Teleport Slack plugin
+
+At this point, the Teleport Slack plugin has the credentials it needs to
+communicate with your Teleport cluster and the Slack API. In this step, you will
+configure the Slack plugin to use these credentials. You will also configure the
+plugin to notify the right Slack channels when it receives an Access Request
+update.
+
+### Create a configuration file
+
+<Tabs>
+<TabItem label="Executable or Docker">
+The Teleport Slack plugin uses a configuration file in TOML format. Generate a
+boilerplate configuration by running the following command (the plugin will not run
+unless the config file is in `/etc/teleport-slack.toml`):
+
+```code
+$ teleport-slack configure | sudo tee /etc/teleport-slack.toml > /dev/null
+```
+
+This should result in a configuration file like the one below:
+
+```toml
+(!examples/resources/plugins/teleport-slack.toml!)
+```
+</TabItem>
+<TabItem label="Helm Chart">
+The Slack Helm Chart uses a YAML values file to configure the plugin.
+On your local workstation, create a file called `teleport-slack-helm.yaml`
+based on the following example:
+
+```toml
+(!examples/resources/plugins/teleport-slack-helm.yaml!)
+```
+
+</TabItem>
+</Tabs>
+
+### Edit the configuration file
+
+Open the configuration file created for the Teleport Slack plugin and update the following fields:
+
+**`[teleport]`**
+
+The Slack plugin uses this section to connect to your Teleport cluster:
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/refresh-plugin-identity.mdx!)
+
+**`[slack]`**
+
+`token`: Open [`https://api.slack.com/apps`](https://api.slack.com/apps), find
+the Slack app you created earlier, navigate to the "OAuth & Permissions" tab,
+copy the "Bot User OAuth Token", and paste it into this field.
+
+**`[role_to_recipients]`**
+
+The `role_to_recipients` map configure the channels that the Slack plugin will
+notify when a user requests access to a specific role. When the Slack plugin
+receives an Access Request from the Auth Service, it will look up the role being
+requested and identify the Slack channels to notify.
+
+<Tabs>
+<TabItem label="Executable or Docker">
+Here is an example of a `role_to_recipients` map. Each value can be a
+single string or an array of strings:
+
+```toml
+[role_to_recipients]
+"*" = "admin-slack-channel"
+"dev" = ["dev-slack-channel", "admin-slack-channel"]
+"dba" = "alex@gmail.com"
+```
+</TabItem>
+<TabItem label="Helm Chart">
+In the Helm chart, the `role_to_recipients` field is called `roleToRecipients`
+and uses the following format, where keys are strings and values are arrays of
+strings:
+
+```yaml
+roleToRecipients:
+  "*": ["admin-slack-channel"]
+  "dev":
+    - "dev-slack-channel"
+    - "admin-slack-channel"
+  "dba": ["alex@gmail.com"]
+```
+</TabItem>
+</Tabs>
+
+In the `role_to_recipients` map, each key is the name of a Teleport role. Each
+value configures the Slack channel (or channels) to notify. Each string must be
+either the name of a Slack channel (including a user's direct message channel)
+or the email address of a Slack user. If the recipient is an email address, the
+Slack plugin will use that email address to look up a direct message channel.
+
+The `role_to_recipients` map must also include an entry for `"*"`, which the
+plugin looks up if no other entry matches a given role name. In the example
+above, requests for roles aside from `dev` and `dba` will notify the
+`admin-slack-channel` channel.
+
+<details>
+<summary>Suggested reviewers</summary>
+
+Users can suggest reviewers when they create an Access Request, e.g.,:
+
+```code
+$ tsh request create --roles=dbadmin --reviewers=alice@example.com,ivan@example.com
+```
+
+If an Access Request includes suggested reviewers, the Slack plugin will add
+these to the list of channels to notify. If a suggested reviewer is an email
+address, the plugin will look up the direct message channel for that
+address and post a message in that channel.
+
+</details>
+
+Configure the Slack plugin to notify you when a user requests the `editor` role
+by adding the following to your `role_to_recipients` config (replace
+`TELEPORT_USERNAME` with the user you assigned the `editor-reviewer` role
+earlier):
+
+<Tabs>
+<TabItem label="Executable or Docker">
+```toml
+[role_to_recipients]
+"*" = "access-requests"
+"editor" = "TELEPORT_USERNAME"
+```
+</TabItem>
+<TabItem label="Helm Chart">
+```yaml
+roleToRecipients:
+  "*": "access-requests"
+  "editor": "TELEPORT_USERNAME"
+```
+</TabItem>
+</Tabs>
+
+Either create an `access-requests` channel in your Slack workspace or rename the
+value of the `"*"` key to an existing channel.
+
+### Invite your Slack app
+
+Once you have configured the channels that the Slack plugin will notify when it
+receives an Access Request, you will need to ensure that the plugin can post in
+those channels.
+
+You have already configured the plugin to send direct messages as Slackbot. For
+any other channel you mention in your `role_to_recipients` map, you will need
+to invite the plugin to that channel. Navigate to each channel and enter `/invite
+@teleport` in the message box.
+
+## Step 7/8. Test your Slack app
+
+Once Teleport is running, you've created the Slack app, and the plugin is
+configured, you can now run the plugin and test the workflow.
+
+<Tabs>
+<TabItem label="Executable">
+Start the plugin:
+
+```code
+$ teleport-slack start
+```
+
+If everything works fine, the log output should look like this:
+
+```code
+$ teleport-slack start
+INFO   Starting Teleport Access Slack Plugin 7.2.1: slack/app.go:80
+INFO   Plugin is ready slack/app.go:101
+```
+</TabItem>
+<TabItem label="Docker">
+run the plugin:
+
+```code
+$ docker run -v <path-to-config>:/etc/teleport-slack.toml public.ecr.aws/gravitational/teleport-plugin-slack:(=teleport.version=) start
+```
+</TabItem>
+<TabItem label="Helm Chart">
+Install the plugin:
+
+```code
+$ helm upgrade --install teleport-plugin-slack teleport/teleport-plugin-slack --values teleport-slack-helm.yaml
+```
+
+To inspect the plugin's logs, use the following command:
+
+```code
+$ kubectl logs deploy/teleport-plugin-slack
+```
+
+Debug logs can be enabled by setting `log.severity` to `DEBUG` in
+`teleport-slack-helm.yaml` and executing the `helm upgrade ...` command
+above again. Then you can restart the plugin with the following command:
+
+```code
+$ kubectl rollout restart deployment teleport-plugin-slack
+```
+</TabItem>
+</Tabs>
+
+Create an Access Request and check if the plugin works as expected with the
+following steps.
+
+### Create an Access Request
+
+(!docs/pages/includes/plugins/create-request.mdx!)
+
+The user you configured earlier to review the request should receive a direct
+message from "Teleport" in Slack allowing them to visit a link in the Teleport
+Web UI and either approve or deny the request.
+
+### Resolve the request
+
+(!docs/pages/includes/plugins/resolve-request.mdx!)
+
+Once the request is resolved, the Slack bot will add an emoji reaction of ✅ or
+❌ to the Slack message for the Access Request, depending on whether the request
+was approved or denied.
+
+<Admonition type="info" title="Auditing Access Requests">
+
+When the Slack plugin posts an Access Request notification to a channel, anyone
+with access to the channel can view the notification and follow the link. While
+users must be authorized via their Teleport roles to review Access Requests, you
+should still check the Teleport audit log to ensure that the right users are
+reviewing the right requests.
+
+When auditing Access Request reviews, check for events with the type `Access
+Request Reviewed` in the Teleport Web UI.
+
+</Admonition>
+
+## Step 8/8. Set up systemd
+
+This section is only relevant if you are running the Teleport Slack plugin on a
+Linux host.
+
+In production, we recommend starting the Teleport plugin daemon via an init
+system like systemd.  Here's the recommended Teleport plugin service unit file
+for systemd:
+
+```ini
+(!examples/systemd/plugins/teleport-slack.service!)
+```
+
+Save this as `teleport-slack.service` in either `/usr/lib/systemd/system/` or
+another [unit file load
+path](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Unit%20File%20Load%20Path)
+supported by systemd.
+
+Enable and start the plugin:
+
+```code
+$ sudo systemctl enable teleport-slack
+$ sudo systemctl start teleport-slack
+```
+
+## Next steps
+
+- Read our guides to configuring [Resource Access
+    Requests](../resource-requests.mdx) and [Role Access
+    Requests](../role-requests.mdx) so you can get the most out
+    of your Access Request plugins.
diff --git a/docs/pages/identity-governance/access-requests/resource-requests.mdx b/docs/pages/identity-governance/access-requests/resource-requests.mdx
new file mode 100644
index 0000000000000..974045ce26bd4
--- /dev/null
+++ b/docs/pages/identity-governance/access-requests/resource-requests.mdx
@@ -0,0 +1,506 @@
+---
+title: Resource Access Requests
+sidebar_label: Resource Requests
+sidebar_position: 2
+description: Teleport allows users to request access to specific resources from the CLI or UI. Requests can be escalated via ChatOps or anywhere else via our flexible Authorization Workflow API.
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+{/* lint disable page-structure remark-lint */}
+
+With Teleport Resource Access Requests, users can request access to specific
+resources without needing to know anything about the roles or RBAC controls used
+under the hood.
+The Access Request API makes it easy to dynamically approve or deny these
+requests.
+
+Just-in-time Access Requests are a feature of Teleport Enterprise.
+Teleport Community Edition users can get a preview of how Access Requests work by
+requesting a role via the Teleport CLI. Full Access Request functionality,
+including Resource Access Requests and an intuitive and searchable UI are
+available in Teleport Enterprise.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/6. Grant roles to users
+
+The built-in `requester` and `reviewer` roles have permissions to, respectively,
+open and review Access Requests. Grant the `requester` and `reviewer` roles to
+existing users, or create new users to test this feature. Make sure the
+requester has a valid `login` so that they can view and access SSH nodes.
+
+For the rest of the guide we will assume that the `requester` role has been
+granted to a user named `alice` and the `reviewer` role has been granted to a
+user named `bob`.
+
+1. Assign the `requester` role to a user named `alice`:
+
+   (!docs/pages/includes/add-role-to-user.mdx role="requester" user="\`alice\`"!)
+
+1. Repeat these steps to assign the `reviewer` role to a user named `bob`.
+
+<Admonition type="tip">
+
+Consider defining custom roles to limit the scope of a requester or reviewer's
+permissions. Read the [Access Request
+Configuration](./access-request-configuration.mdx) guide for available options.
+
+</Admonition>
+
+## Step 2/6. Search for resources
+
+First, log in as `alice`.
+
+```code
+$ tsh login --proxy teleport.example.com --user alice
+```
+
+Notice that `tsh ls` returns an empty list, because `alice` does not have access to any resources by default.
+```code
+$ tsh ls
+Node Name Address Labels
+--------- ------- ------
+```
+
+Then try searching for all available ssh nodes.
+
+```code
+$ tsh request search --kind node
+Name                                 Hostname    Labels       Resource ID
+------------------------------------ ----------- ------------ ------------------------------------------------------
+b1168402-9340-421a-a344-af66a6675738 iot         test=test    /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738
+bbb56211-7b54-4f9e-bee9-b68ea156be5f node        test=test    /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f
+
+To request access to these resources, run
+> tsh request create --resource /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738 --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
+    --reason <request reason>
+```
+
+You can search for resources of kind `node`, `kube_cluster`, `db`, `app`, and
+`windows_desktop`. Teleport also supports searching and requesting access to
+resources within Kubernetes clusters with kind `kube_resource`.
+
+Advanced filters and queries are supported. See our
+[filtering reference](../../reference/cli/cli.mdx) for more information.
+
+Try narrowing your search to a specific resource you want to access.
+
+```code
+$ tsh request search --kind node --search iot
+Name                                 Hostname    Labels       Resource ID
+------------------------------------ ----------- ------------ ------------------------------------------------------
+b1168402-9340-421a-a344-af66a6675738 iot         test=test    /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738
+
+To request access to these resources, run
+> tsh request create --resource /teleport.example.com/node/b1168402-9340-421a-a344-af66a6675738 \
+    --reason <request reason>
+```
+
+## Step 3/6. Request access to a resource
+
+Copy the command output by `tsh request search` in the previous step, optionally filling in a request reason.
+
+```code
+$ tsh request create --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
+    --reason "responding to incident 123"
+Creating request...
+Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
+Username:   alice
+Roles:      access
+Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
+Reason:     "responding to incident 123"
+Reviewers:  [none] (suggested)
+Status:     PENDING
+
+hint: use 'tsh login --request-id=<request-id>' to login with an approved request
+
+Waiting for request approval...
+
+```
+
+The command will automatically wait until the request is approved.
+
+## Step 4/6. Approve the Access Request
+
+First, log in as `bob`.
+
+```code
+$ tsh login --proxy teleport.example.com --user bob
+```
+
+Then list, review, and approve the Access Request.
+
+```code
+$ tsh request ls
+ID                                   User  Roles  Resources                   Created At (UTC)    Status
+------------------------------------ ----- ------ --------------------------- ------------------- -------
+f406f5d8-3c2a-428f-8547-a1d091a4ddab alice access ["/teleport.example.... [+] 23 Jun 22 18:25 UTC PENDING
+
+[+] Requested resources truncated, use `tsh request show <request-id>` to view the full list
+
+hint: use 'tsh request show <request-id>' for additional details
+      use 'tsh login --request-id=<request-id>' to login with an approved request
+$ tsh request show f406f5d8-3c2a-428f-8547-a1d091a4ddab
+Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
+Username:   alice
+Roles:      access
+Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
+Reason:     "responding to incident 123"
+Reviewers:  [none] (suggested)
+Status:     PENDING
+
+hint: use 'tsh login --request-id=<request-id>' to login with an approved request
+$ tsh request review --approve f406f5d8-3c2a-428f-8547-a1d091a4ddab
+Successfully submitted review.  Request state: APPROVED
+```
+
+<Admonition type="tip">
+Check out our [Access Request
+integrations](plugins/plugins.mdx) to notify
+the right people about new Access Requests.
+</Admonition>
+
+## Step 5/6. Access the requested resource
+
+`alice`'s `tsh request create` command should resolve now that the request has been approved.
+
+```code
+$ tsh request create --resource /teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f \
+    --reason "responding to incident 123"
+Creating request...
+Request ID: f406f5d8-3c2a-428f-8547-a1d091a4ddab
+Username:   alice
+Roles:      access
+Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
+Reason:     "responding to incident 123"
+Reviewers:  [none] (suggested)
+Status:     PENDING
+
+hint: use 'tsh login --request-id=<request-id>' to login with an approved request
+
+Waiting for request approval...
+
+Approval received, getting updated certificates...
+
+> Profile URL:        https://teleport.example.com
+  Logged in as:       alice
+  Active requests:    f406f5d8-3c2a-428f-8547-a1d091a4ddab
+  Cluster:            teleport.example.com
+  Roles:              access, requester
+  Logins:             alice
+  Kubernetes:         disabled
+  Allowed Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
+  Valid until:        2022-06-23 22:46:22 -0700 PDT [valid for 11h16m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+`alice` can now view and access the node.
+
+```code
+$ tsh ls
+Node Name Address   Labels
+--------- --------- ---------
+iot       [::]:3022 test=test
+
+$ tsh ssh alice@iot
+iot:~ alice$
+```
+
+## Step 6/6. Resume regular access
+
+While logged in with a Resource Access Request, users will be blocked from access to any other resources.
+This is necessary because their certificate now contains an elevated role,
+so it is restricted to only allow access to the resources they were specifically approved for.
+Use the `tsh request drop` command to "drop" the request and resume regular access.
+
+```code
+$ tsh request drop
+```
+
+Once you have configured Resource Access Requests, `tsh ssh` is able to
+automatically create a Resource Access Request for you when access is denied,
+allowing you to skip the `tsh request search` and `tsh request create` steps.
+
+```code
+$ tsh ssh alice@iot
+ERROR: access denied to alice connecting to iot on cluster teleport.example.com
+
+You do not currently have access to alice@iot, attempting to request access.
+
+Enter request reason: please
+Creating request...
+Request ID: ab43fc70-e893-471b-872e-ae65eb24fd76
+Username:   alice
+Roles:      access
+Resources:  ["/teleport.example.com/node/bbb56211-7b54-4f9e-bee9-b68ea156be5f"]
+Reason:     "please"
+Reviewers:  [none] (suggested)
+Status:     PENDING
+
+hint: use 'tsh login --request-id=<request-id>' to login with an approved request
+
+Waiting for request approval...
+
+Approval received, reason="okay"
+Getting updated certificates...
+
+iot:~ alice$
+```
+
+## Restricting the resources a user can request access to
+
+In this guide, we showed you how to enable a user to search for resources to
+request access to. To do so, we assigned the user a Teleport role with the
+`search_as_roles` field set to the preset `access` role.
+
+You can impose further restrictions on the resources a user is allowed to
+search by assigning `search_as_roles` to a more limited role. Below, we will
+show you which permissions you must set to restrict a user's ability to search
+for different resources.
+
+To restrict access to a particular resource using a role similar to the ones
+below, edit one of the user's roles so the `search_as_roles` field includes the
+role you have created.
+
+For full details on how to use Teleport roles to configure RBAC, see the
+[Access Controls Reference](../../reference/access-controls/roles.mdx).
+
+### `node`
+
+You can restrict access to searching `node` resources by assigning values to the
+`node_labels` field in the `spec.allow` or `spec.deny` fields. The following
+role allows access to SSH Service instances with the `env:staging` label.
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: staging-access
+spec:
+  allow:
+    node_labels:
+      env: staging
+    logins:
+      - '{{internal.logins}}'
+  options:
+    # Only allows the requester to use this role for 1 hour from time of request.
+    max_session_ttl: 1h
+```
+
+### `kube_cluster`
+
+You can restrict access to searching `kube_cluster` resources by assigning
+values to the `kubernetes_labels` field in the `spec.allow` or `spec.deny`
+fields.
+
+The following role allows access to Kubernetes clusters with the `env:staging`
+label:
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      env: staging
+    kubernetes_resources:
+      - kind: '*'
+        namespace: '*'
+        name: '*'
+        api_group: '*'
+  deny: {}
+```
+
+### Kubernetes resources
+
+You can restrict access to Kubernetes resources by assigning values to the
+`kubernetes_resources` field in the `spec.allow` or `spec.deny` fields.
+
+The following role allows access to Kubernetes pods with the name `nginx` in any
+namespace, and all pods in the `dev` namespace:
+
+```yaml
+kind: role
+metadata:
+  name: kube-access
+version: v8
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+      - kind: pods
+        namespace: '*'
+        name: 'nginx*'
+        api_group: ''
+      - kind: pods
+        namespace: dev
+        name: '*'
+        api_group: ''
+    kubernetes_groups:
+      - viewers
+  deny: {}
+```
+
+The `request.kubernetes_resources` field allows you to restrict what kinds of Kubernetes
+resources a user can request access to. Configuring this field to any value will disallow
+requesting access to the entire Kubernetes cluster.
+
+If the `request.kubernetes_resources` field is not configured, then a user can request access
+to any Kubernetes resources, including the entire Kubernetes cluster.
+
+The following role allows users to request access to Kubernetes namespaces.
+Requests for Kubernetes resources other than `pods` will not be allowed.
+
+```yaml
+kind: role
+metadata:
+  name: requester-kube-access
+version: v8
+spec:
+  allow:
+    request:
+      search_as_roles:
+        - kube-access
+      kubernetes_resources:
+        - kind: pods
+          api_group: ''
+```
+
+The following role allows users to request access only to Kubernetes deployments and/or pods.
+
+```yaml
+kind: role
+metadata:
+  name: requester-kube-access
+version: v8
+spec:
+  allow:
+    request:
+      search_as_roles:
+        - kube-access
+      kubernetes_resources:
+        - kind: deployments
+          api_group: apps
+        - kind: pods
+          api_group: ''
+```
+
+The following role allows users to request access to any specific Kubernetes resources.
+
+```yaml
+kind: role
+metadata:
+  name: requester-kube-access
+version: v8
+spec:
+  allow:
+    request:
+      search_as_roles:
+        - kube-access
+      kubernetes_resources:
+        - kind: '*'
+          api_group: '*'
+```
+
+The `request.kubernetes_resources` field only restricts what
+`kind` / `api_group` of Kubernetes resource requests are allowed.
+To control Kubernetes access to these resources see
+[Kubernetes Resources](../../enroll-resources/kubernetes-access/controls.mdx)
+section for more details.
+
+### `db`
+
+You can restrict access to searching `db` resources by assigning values to the
+`db_labels` field in the `spec.allow` or `spec.deny` fields.
+
+The following role allows access to databases with the `env:dev` or
+`env:staging` labels:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: developer
+spec:
+  allow:
+    db_labels:
+      env: ["dev", "staging"]
+
+    # Database account names this role can connect as.
+    db_users: ["viewer", "editor"]
+    db_names: ["*"]
+```
+
+### `app`
+
+You can restrict access to searching `app` resources by assigning values to the
+`app_labels` field in the `spec.allow` or `spec.deny` fields.
+
+The following role allows access to all applications except for those in
+`env:prod`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: dev
+spec:
+  allow:
+    app_labels:
+      "*": "*"
+  deny:
+    app_labels:
+      env: "prod"
+```
+
+### `windows_desktop`
+
+You can restrict access to searching `windows_desktop` resources by assigning
+values to the `windows_desktop_labels` field in the `spec.allow` or `spec.deny`
+fields.
+
+The following role allows access to all Windows desktops with the
+`env:dev` or `env:staging` labels.
+
+```yaml
+kind: role
+version: v4
+metadata:
+  name: developer
+spec:
+  allow:
+    windows_desktop_labels:
+      env: ["dev", "staging"]
+
+    windows_desktop_logins: ["{{internal.windows_logins}}"]
+```
+
+## Next steps
+
+- Read about all of the ways you can configure Access Requests in the [Access
+  Request Configuration Guide](access-request-configuration.mdx). For example,
+  you can configure the `search_as_roles` fields in a user's role to restrict
+  the resources the user has access to list in order to request access.
+- With Teleport's Access Request plugins, users can manage Access Requests from
+  within your organization's existing messaging and project management
+  solutions. Read the documentation on [Access Request
+  plugins](../access-requests/plugins/plugins.mdx).
+- For more information about creating and managing Access Requests as an end
+  user, read [Request Access to Roles and
+  Resources](../../connect-your-client/teleport-clients/request-access.mdx).
+- Learn about [Access Lists](../access-lists/access-lists.mdx), which allow you
+  to assign elevated privileges to a list of Teleport users for a limited time.
+
+
diff --git a/docs/pages/admin-guides/access-controls/access-requests/role-requests.mdx b/docs/pages/identity-governance/access-requests/role-requests.mdx
similarity index 94%
rename from docs/pages/admin-guides/access-controls/access-requests/role-requests.mdx
rename to docs/pages/identity-governance/access-requests/role-requests.mdx
index e4e255e030168..2109414b7fa63 100644
--- a/docs/pages/admin-guides/access-controls/access-requests/role-requests.mdx
+++ b/docs/pages/identity-governance/access-requests/role-requests.mdx
@@ -1,7 +1,14 @@
 ---
 title: Role Access Requests
+sidebar_position: 1
+sidebar_label: Role Requests
 description: Use Just-in-time Access Requests to request new roles with elevated privileges.
-h1: Teleport Role Access Requests
+tags:
+ - access-requests
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 Teleport's Just-in-time Access Requests allow users to request access to
@@ -10,7 +17,7 @@ via ChatOps or anywhere else via our flexible Authorization Workflow API.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
@@ -98,12 +105,12 @@ You can not mix the two. For more information on how to request access to
 specific resources, see the
 [Resource Access Requests Guide](./resource-requests.mdx).
 
-![New Request](../../../../img/access-requests/new-role-request.png)
+![New Request](../../../img/access-requests/new-role-request.png)
 
 When all desired roles have been added, click **PROCEED TO REQUEST**, where you
 can review and submit the request.
 
-![Submit Request](../../../../img/access-requests/submit-request.png)
+![Submit Request](../../../img/access-requests/submit-request.png)
 
 ## Reviewing Access Requests via the Web UI
 
diff --git a/docs/pages/admin-guides/access-controls/device-trust/device-management.mdx b/docs/pages/identity-governance/device-trust/device-management.mdx
similarity index 88%
rename from docs/pages/admin-guides/access-controls/device-trust/device-management.mdx
rename to docs/pages/identity-governance/device-trust/device-management.mdx
index 1f47615f73f5a..f81481fc2c1c6 100644
--- a/docs/pages/admin-guides/access-controls/device-trust/device-management.mdx
+++ b/docs/pages/identity-governance/device-trust/device-management.mdx
@@ -1,6 +1,12 @@
 ---
 title: Manage Trusted Devices
+sidebar_label: Management
 description: Learn how to manage Trusted Devices
+tags:
+ - conceptual
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
 ---
 
 This guide provides instructions for performing Device Trust management
@@ -9,7 +15,7 @@ token, and removing a trusted device.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 (!docs/pages/includes/device-trust/prereqs.mdx!)
 
@@ -27,9 +33,9 @@ removing devices that are no longer in use.
   ```
 </Admonition>
 
-<Admonition type="tip" title="Sync with Jamf Pro">
-Teleport supports device synchronization with [Jamf Pro](./jamf-integration.mdx). Once configured, devices
-are automatically updated in Teleport's device inventory.
+<Admonition type="tip" title="Sync from an MDM">
+Teleport supports device synchronization through [MDM integrations](device-trust.mdx#mdm-integrations).
+Once configured, devices are automatically updated in Teleport's device inventory.
 </Admonition>
 
 Before you can enroll the device, you need to register it. To register
@@ -81,9 +87,9 @@ Use `tctl` to check that the device has been registered:
 
 ```code
 $ tctl devices ls
-Asset Tag    OS    Enroll Status Device ID
------------- ----- ------------- ------------------------------------
-(=devicetrust.asset_tag=) macOS not enrolled  (=devicetrust.device_id=)
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+(=devicetrust.asset_tag=) macOS        not enrolled        (=devicetrust.device_id=)
 ```
 
 ## Create a device enrollment token
@@ -136,8 +142,8 @@ enrolls the user's device in their next Teleport (`tsh`) login.
 
 For auto-enrollment to work, the following conditions must be met:
 - A device must be registered. Registration may be
-[manual](#register-a-trusted-device) or performed using an
-integration, like the [Jamf Pro integration](./jamf-integration.mdx).
+[manual](#register-a-trusted-device) or performed using [an MDM
+integration](./device-trust.mdx#mdm-integrations).
 - Auto-enrollment must be enabled in the cluster setting.
 
 Enable auto-enrollment in your cluster settings. To do so, modify the dynamic
@@ -194,9 +200,9 @@ A device that is no longer in use may be removed using `tctl devices rm
 First, find a device to delete:
 ```code
 $ tctl devices ls
-Asset Tag    OS    Enroll Status Device ID
------------- ----- ------------- ------------------------------------
-C00AA0AAAA0A macOS enrolled      c9cbb327-68a8-497e-b820-6a4b2bf58269
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+C00AA0AAAA0A macOS        enrolled      alice c9cbb327-68a8-497e-b820-6a4b2bf58269
 ```
 
 Now use asset-tag or device id to delete a device:
@@ -270,3 +276,4 @@ Save and close your editor to apply your changes.
 
 - [Device Trust Enforcement](./enforcing-device-trust.mdx)
 - [Jamf Pro Integration](./jamf-integration.mdx)
+- [Microsoft Intune Integration](./intune-integration.mdx)
diff --git a/docs/pages/admin-guides/access-controls/device-trust/device-trust.mdx b/docs/pages/identity-governance/device-trust/device-trust.mdx
similarity index 85%
rename from docs/pages/admin-guides/access-controls/device-trust/device-trust.mdx
rename to docs/pages/identity-governance/device-trust/device-trust.mdx
index dafb8c7683e16..33e0fad71af50 100644
--- a/docs/pages/admin-guides/access-controls/device-trust/device-trust.mdx
+++ b/docs/pages/identity-governance/device-trust/device-trust.mdx
@@ -1,14 +1,16 @@
 ---
 title: Device Trust
 description: Teleport Device Trust Concepts
-layout: tocless-doc
+template: "no-toc"
 videoBanner: gBQyj_X1LVw
+sidebar_position: 5
+tags:
+ - conceptual
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
 ---
 
-(!docs/pages/includes/device-trust/support-notice.mdx!)
-
-## Concepts
-
 Device Trust allows Teleport admins to enforce the use of trusted devices.
 Resources protected by the device mode "required" will enforce the use of a
 trusted device, in addition to establishing the user's identity and enforcing
@@ -23,6 +25,8 @@ Device Trust requires two of the following steps to have been configured:
 Categorically, we define these two requirements as Trusted Device management
 and Device Trust enforcement.
 
+(!docs/pages/includes/device-trust/support-notice.mdx!)
+
 ## Trusted Device management
 
 Device management is divided into two separate phases: inventory management and
@@ -69,10 +73,11 @@ the better the ongoing guarantees that the device itself is trustworthy.
 
 ## Device Trust enforcement
 
-Enforcing Device Trust means configuring Teleport with Device Trust mode, i.e. applying
-`device_trust_mode: required` rule, which tells Teleport Auth Service to only allow access
-with a trusted and an authenticated device, in addition to establishing the user's identity and enforcing
-the necessary roles.
+Enforcing Device Trust means configuring Teleport with Device Trust mode, i.e.
+applying a `device_trust_mode: required` or `device_trust_mode: required-for-humans`
+rule, which tells Teleport Auth Service to only allow access with a trusted and
+an authenticated device, in addition to establishing the user's identity and
+enforcing the necessary roles.
 
 Teleport supports two methods for device enforcement: Role-based
 enforcement and Cluster-wide enforcement.
@@ -80,9 +85,15 @@ enforcement and Cluster-wide enforcement.
 - **Role-based enforcement** can be used to enforce Device Trust at role level, using RBAC.
 - **Cluster-wide enforcement** can be used to enforce Device Trust at cluster level.
 
+## MDM integrations
+
+Device Trust currently supports syncing devices from [Jamf Pro](jamf-integration.mdx) and [Microsoft
+Intune](intune-integration.mdx).
+
 ## Guides
 
 - [Getting Started with Device Trust](guide.mdx)
 - [Device Management](device-management.mdx)
 - [Enforcing Device Trust](enforcing-device-trust.mdx)
 - [Jamf Pro Integration](jamf-integration.mdx)
+- [Microsoft Intune Integration](intune-integration.mdx)
diff --git a/docs/pages/admin-guides/access-controls/device-trust/enforcing-device-trust.mdx b/docs/pages/identity-governance/device-trust/enforcing-device-trust.mdx
similarity index 83%
rename from docs/pages/admin-guides/access-controls/device-trust/enforcing-device-trust.mdx
rename to docs/pages/identity-governance/device-trust/enforcing-device-trust.mdx
index 566cc9132339a..0c8b999d82fa9 100644
--- a/docs/pages/admin-guides/access-controls/device-trust/enforcing-device-trust.mdx
+++ b/docs/pages/identity-governance/device-trust/enforcing-device-trust.mdx
@@ -1,7 +1,13 @@
 ---
 title: Enforce Device Trust
+sidebar_label: Enforcement
 description: Learn how to enforce trusted devices with Teleport
 videoBanner: gBQyj_X1LVw
+tags:
+ - conceptual
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
 ---
 
 <Admonition type="note" title="Supported Resources">
@@ -29,9 +35,12 @@ by the `device_trust_mode` authentication setting:
 - `required` - enables device authentication and device-aware audit.
   Additionally, it requires a trusted device for all SSH, Database and
   Kubernetes connections.
+- `required-for-humans` - enables device authentication and device-aware audit.
+  Additionally, it requires a trusted device for all SSH, Database and
+  Kubernetes connections, for human users only (bots are exempt).
 
 ### Prerequisites
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 (!docs/pages/includes/device-trust/prereqs.mdx!)
 
@@ -45,12 +54,12 @@ instructions.
 Role-based configuration enforces trusted device access at the role level. It
 can be configured with the `spec.options.device_trust_mode` option and
 applies to the resources in its `allow` rules. It
-works similarly to [`require_session_mfa`](../guides/per-session-mfa.mdx).
+works similarly to [`require_session_mfa`](../../zero-trust-access/authentication/per-session-mfa.mdx).
 
 To enforce authenticated device checks for a specific role when a user accesses
 databases, Kubernetes clusters, and servers with Teleport, update the role with
-the `device_trust_mode` field assigned to `"required"`. The following example
-updates the preset `require-trusted-device` role:
+the `device_trust_mode` field assigned to `"required"` or `"required-for-humans"`.
+The following example updates the preset `require-trusted-device` role:
 
 ```yaml
 kind: role
@@ -132,7 +141,7 @@ ERROR: ssh: rejected: administratively prohibited (unauthorized device)
 
 <Admonition type="tip" title="Trusted Clusters">
 It is possible to use [trusted
-clusters](../../management/admin/trustedclusters.mdx) to limit the impact of
+clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) to limit the impact of
 device mode `required`. A leaf cluster in mode `required` will enforce access to
 all of its resources, without imposing the same restrictions to the root
 cluster. Likewise, a root cluster will not enforce Device Trust on resources in
@@ -146,10 +155,10 @@ enforcement](#role-based-trusted-device-enforcement).
 
 To access apps protected by Device Trust using the Web UI (Teleport v16 or
 later), make sure your device is [registered and enrolled](
-./device-management.mdx#register-a-trusted-device), install [Teleport Connect](../../../connect-your-client/teleport-connect.mdx), and
+./device-management.mdx#register-a-trusted-device), install [Teleport Connect](../../connect-your-client/teleport-clients/teleport-connect.mdx), and
 follow the instructions during login.
 
-Alternatively, you may use [tsh proxy app](../../../reference/cli/tsh.mdx) or the certificates issued by
+Alternatively, you may use [tsh proxy app](../../reference/cli/tsh.mdx) or the certificates issued by
 `tsh app login`.
 
 As an example, to enforce Device Trust for all `env:production` apps, save the
@@ -198,7 +207,7 @@ enforcement]( #role-based-trusted-device-enforcement).
 
 To access desktops protected by Device Trust make sure your device is
 [registered and enrolled](./device-management.mdx#register-a-trusted-device),
-install [Teleport Connect](../../../connect-your-client/teleport-connect.mdx), and
+install [Teleport Connect](../../connect-your-client/teleport-clients/teleport-connect.mdx), and
 follow the instructions during login.
 
 As an example, to enforce Device Trust for all `env:production` desktops, save
@@ -244,7 +253,7 @@ device.
 
 ## Locking a device
 
-Similar to [session and identity locking](../guides/locking.mdx), a device can
+Similar to [session and identity locking](../locking.mdx), a device can
 be locked using `tctl lock`.
 
 Locking blocks certificate issuance and ongoing or future accesses originating
@@ -255,9 +264,9 @@ Find a device ID to lock:
 
 ```code
 $ tctl devices ls
-Asset Tag     OS    Enroll Status   Device ID
------------- -----  ------------- ------------------------------------
-(=devicetrust.asset_tag=)  macOS  enrolled     (=devicetrust.device_id=)
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+(=devicetrust.asset_tag=) macOS        enrolled      alice (=devicetrust.device_id=)
 ```
 
 Lock a device:
@@ -282,3 +291,4 @@ ERROR: ssh: rejected: administratively prohibited (lock targeting Device:"(=devi
 ## Next steps
 - [Device Management](./device-management.mdx)
 - [Jamf Pro Integration](./jamf-integration.mdx)
+- [Microsoft Intune Integration](./intune-integration.mdx)
diff --git a/docs/pages/identity-governance/device-trust/guide.mdx b/docs/pages/identity-governance/device-trust/guide.mdx
new file mode 100644
index 0000000000000..ab5bd7dc35b19
--- /dev/null
+++ b/docs/pages/identity-governance/device-trust/guide.mdx
@@ -0,0 +1,167 @@
+---
+title: Getting Started with Device Trust
+sidebar_label: Getting Started
+description: Get started with Teleport Device Trust
+videoBanner: gBQyj_X1LVw
+tags:
+ - get-started
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
+---
+
+{/* lint disable page-structure remark-lint */}
+
+(!docs/pages/includes/device-trust/support-notice.mdx!)
+
+Device Trust requires two of the following steps to have been configured:
+
+- Device enforcement mode configured via either a role or a cluster-wide config.
+- Trusted device registered and enrolled with Teleport.
+
+In this guide, you will update an existing user profile to assign the preset `require-trusted-device`
+role and then enroll a trusted device into Teleport to access a resource (a test linux server)
+protected with Teleport.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/device-trust/prereqs.mdx!)
+
+- User with `editor` role.
+  ```code
+  $ tsh status
+  > Profile URL:      (=clusterDefaults.clusterName=):443
+  Logged in as:       (=clusterDefaults.username=)
+  Cluster:            (=clusterDefaults.clusterName=)
+  Roles:              access, auditor, editor
+  Logins:             root, ubuntu, ec2-user
+  Kubernetes:         disabled
+  Valid until:        2023-08-22 03:30:24 -0400 EDT [valid for 11h52m0s]
+  Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+  ```
+- Access to a linux server (any Linux server you can access via `tsh ssh` will do).
+  ```code
+  $ tsh ls
+  Node Name        Address        Labels
+  ---------------- -------------- --------------------------------------
+  (=clusterDefaults.nodeIP=) ⟵ Tunnel
+
+  # test connection to (=clusterDefaults.nodeIP=)
+  $ tsh ssh root@(=clusterDefaults.nodeIP=)
+  root@(=clusterDefaults.nodeIP=):~#
+  ```
+
+Once the above prerequisites are met, begin with the following step.
+
+## Step 1/2. Update user profile to enforce Device Trust
+
+To enforce Device Trust, a user must be assigned with a role with Device Trust mode "required".
+
+For this guide, we will use the preset `require-trusted-device` role to update current user profile.
+
+Open the user resource in your editor so we can update it with the preset `require-trusted-device` role.
+
+```code
+$ tctl edit users/(=clusterDefaults.username=)
+```
+
+Edit the profile:
+
+```diff
+kind: user
+metadata:
+  id: 1692716146877042322
+  name: (=clusterDefaults.username=)
+spec:
+  created_by:
+    time: "2023-08-14T13:42:22.291972449Z"
+  expires: "0001-01-01T00:00:00Z"
+  roles:
+  - access
+  - auditor
+  - editor
++ - require-trusted-device # add this line
+  status:
+    is_locked: false
+  ...
+```
+
+Update the user by saving and closing the file in your editor.
+
+Now that the user profile is updated to enforce Device Trust, try to access the test server
+again.
+
+```code
+$ tsh logout; tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
+$ tsh ssh root@(=clusterDefaults.nodeIP=)
+ERROR: access denied to root connecting to (=clusterDefaults.nodeIP=):0
+```
+
+As you can verify from the above step, access to `(=clusterDefaults.nodeIP=)` ssh server,
+which was previously accessible, is now forbidden.
+
+## Step 2/2. Enroll device
+
+To access `(=clusterDefaults.nodeIP=)` server again, you will have to enroll your device.
+
+Enrolling your device is easy, and can be done using `tsh` client:
+
+```code
+$ tsh device enroll --current-device
+Device "(=devicetrust.asset_tag=)"/macOS registered and enrolled
+```
+
+<Admonition type="tip" title="self enrollment">
+  The `--current-device` flag tells `tsh` to enroll the current device. The user must have the preset `editor`
+  or `device-admin` role to be able to self-enroll their device. For users without the `editor` or
+  `device-admin` roles, a device admin must generate the an enrollment token, which can then be
+  used to enroll the device. Learn more about manual device enrollment in the
+  [device management guide](./device-management.mdx#register-a-trusted-device).
+</Admonition>
+
+Relogin to fetch updated certificate with device extension:
+
+```code
+$ tsh logout; tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
+
+$ tsh status
+> Profile URL:        (=clusterDefaults.clusterName=):443
+  Logged in as:       (=clusterDefaults.username=)
+  Cluster:            (=clusterDefaults.clusterName=):443
+  Roles:              access, auditor, editor
+  Logins:             root
+  Kubernetes:         enabled
+  Valid until:        2023-08-22 04:06:53 -0400 EDT [valid for 12h0m0s]
+  Extensions:         login-ip, ... teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
+```
+
+The presence of the `teleport-device-*` extensions shows that the device was successfully authenticated.
+
+Now, let's try to access server (`(=clusterDefaults.nodeIP=)`) again:
+
+```code
+$ tsh ssh root@(=clusterDefaults.nodeIP=)
+root@(=clusterDefaults.nodeIP=):~#
+```
+
+Congratulations! You have successfully configured a Trusted Device and accessed a resource protected with
+Device Trust enforcement.
+
+## Troubleshooting
+
+(!docs/pages/includes/device-trust/troubleshooting.mdx!)
+
+## Next steps
+
+- [Device Management](./device-management.mdx)
+- [Enforcing Device Trust](./enforcing-device-trust.mdx)
+- [Jamf Pro Integration](./jamf-integration.mdx)
+- [Microsoft Intune Integration](./intune-integration.mdx)
+- The role we illustrated in this guide uses the `internal.logins` trait,
+  which Teleport replaces with values from the Teleport local user
+  database. For full details on how traits work in Teleport roles,
+  see the [Access Controls
+  Reference](../../reference/access-controls/roles.mdx).
+
diff --git a/docs/pages/identity-governance/device-trust/intune-integration.mdx b/docs/pages/identity-governance/device-trust/intune-integration.mdx
new file mode 100644
index 0000000000000..4ecd0ff933cf5
--- /dev/null
+++ b/docs/pages/identity-governance/device-trust/intune-integration.mdx
@@ -0,0 +1,188 @@
+---
+title: Microsoft Intune Integration
+description: Sync your Microsoft Intune inventory into Teleport
+# Positioning the two integration guides together until we can create a
+# docs subsection/subdirectory for Device Trust integrations
+sidebar_position: 5
+tags:
+ - how-to
+ - identity-governance
+ - azure
+ - resiliency
+enterprise: Identity Governance
+---
+
+The Device Trust Microsoft Intune integration lets you automatically sync your managed devices from
+Intune into Teleport. This guide explains how to set up the integration.
+
+## How it works
+
+The Teleport Intune integration periodically reads your managed device inventory from Microsoft
+Intune and syncs it to Teleport. It performs both incremental (called "partial") and full syncs,
+as well as removals from Teleport if a device is removed from Intune.
+
+Syncing devices from Intune is an **inventory management** step, equivalent to
+automatically running the corresponding `tctl devices add` commands.
+
+See the [Device Trust guide](device-trust.mdx) for fundamental Device Trust concepts
+and behavior.
+
+<Admonition type="note">
+The Microsoft Intune integration is available exclusively as a hosted plugin through the
+Teleport Web UI. Running it as a standalone service is not currently supported.
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+(!docs/pages/includes/device-trust/prereqs.mdx!)
+- Access to Microsoft Entra ID with Global Administrator or Application Administrator permissions.
+- An active Microsoft Intune subscription with managed devices.
+
+## Step 1/3. Register an application in Microsoft Entra ID
+
+Create and configure an application in Microsoft Entra ID that Teleport will use to access your
+Intune data:
+
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with an account
+   that has Global Administrator or Application Administrator permissions.
+2. Navigate to Entra ID > App registrations and select New registration.
+3. Configure the application:
+   - Name: enter a descriptive name (e.g., "Teleport Intune Integration").
+   - Supported account types: select "Accounts in this organizational directory only".
+   - Redirect URI: leave this blank and click "Register".
+4. Once created, copy the Application (client) ID from the Overview page. You'll need this
+   when configuring the integration in Teleport.
+
+In case of problems with the above instructions, follow [the official docs for registering an
+application](https://learn.microsoft.com/en-us/graph/auth-register-app-v2).
+
+## Step 2/3. Configure API permissions and create client secret
+
+Grant the application permission to read Intune managed devices:
+
+1. In your registered application, navigate to API permissions > Add a permission.
+2. Select Microsoft Graph > Application permissions.
+3. Search for and add the `DeviceManagementManagedDevices.Read.All` permission.
+4. Click "Grant admin consent" for your organization and confirm.
+
+In case of problems with the above instructions, follow [the official docs for granting application
+permission](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#application-permission-to-microsoft-graph).
+
+<Admonition type="note">
+The consent must be granted by a Global Administrator or Privileged Role Administrator. Failure to
+grant this permission will result in an error from the Graph API.
+</Admonition>
+
+To create a client secret:
+
+1. In your registered application, navigate to Certificates & secrets > Client secrets.
+2. Click New client secret.
+3. Add a description and select an expiration period (we recommend setting a reminder to rotate
+   the secret before it expires).
+4. Click "Add" and copy the Value (not the Secret ID).
+
+In case of problems with the above instructions, follow [the official docs for adding a client
+secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret).
+
+## Step 3/3. Configure the Intune integration in Teleport
+
+1. Follow [the official docs to find your tenant
+   identifier](https://learn.microsoft.com/en-us/partner-center/account-settings/find-ids-and-domain-names#find-the-microsoft-entra-tenant-id-and-primary-domain-name)
+   (e.g., `contoso.onmicrosoft.com` or the tenant GUID).
+2. In the Web UI, navigate to Add New > Integration and select "Microsoft Intune".
+3. Fill in the required information:
+   - Primary domain or Microsoft Entra tenant ID: enter your tenant identifier.
+   - Application (client) ID: Paste the Application ID you copied in Step 1.
+   - Client secret value: Paste the client secret value you copied in Step 2.
+4. Click "Connect Microsoft Intune" to complete the setup.
+
+The integration will begin syncing devices from your Intune inventory within two minutes. Depending
+on the size of your inventory, the initial sync may take a few minutes to complete.
+
+## How syncing works
+
+### Sync schedule
+
+The Intune integration uses the following fixed schedule that starts when the integration is
+installed, updated, or when the Auth Service is restarted:
+
+- Full sync: every 24 hours – fetches all devices from Intune, reconciles the complete
+  inventory and removes missing devices.
+- Partial sync: every 6 hours between full syncs – fetches only devices that have been modified in
+  Intune since the last sync.
+
+The integration tracks the last sync time from Intune to fetch only changed devices during partial
+syncs.
+
+### Device requirements
+
+For a device to be synced, it must have a serial number, its device registration state must be set
+to "registered" and its operating system must be either macOS, Windows, or Linux.
+
+### Device ownership and removal
+
+When syncing inventory, the Intune integration claims ownership of all synced devices.
+This can be verified by inspecting a device's `source` field:
+
+```yaml
+# tctl get device/mydevice
+kind: device
+metadata:
+  name: 20ec6373-9e8e-46e0-8f1c-47ad6b06a768
+spec:
+  asset_tag: mydevice
+  os_type: macos
+  # ...
+  source:
+    name: intune
+    origin: intune
+  update_time: "2023-06-21T19:44:40.40601Z"
+version: v1
+```
+
+During full syncs, devices that are no longer present in Intune or have mismatched properties
+(different serial number or OS type for the same Intune device ID) will be automatically removed
+from Teleport's inventory.
+
+<Admonition type="note">
+Only devices synced by Intune are subject to automatic deletion. Devices added manually via `tctl
+devices add` or synced from other sources won't be deleted by the Intune integration.
+</Admonition>
+
+For immediate removal of unwanted devices, first lock the device in Teleport,
+then remove it from Intune:
+
+```code
+$ tctl devices lock --asset-tag=SERIAL_NUMBER --message='reason for locking'
+Created a lock with name "a2f1491c-4a3e-4daf-9c83-2fe931668076".
+```
+
+Manual removal via `tctl devices rm` is possible, but note that if the device is still in the Intune
+inventory, it'll be recreated during the next sync.
+
+## Monitoring the integration
+
+After configuration, you can monitor the integration status in the Web UI. Navigate to Zero Trust
+Access > Integrations. If the integration status indicates an error, check the Auth Service logs for
+errors from the Intune integration.
+
+You can also verify synced devices using the command line:
+
+```code
+$ tctl devices ls
+Asset Tag    OS      Source Enroll Status Owner Device ID
+------------ ------- ------ ------------- ----- ------------------------------------
+CXXXXXXXXX17 macOS   Intune not enrolled        20ec6373-9e8e-46e0-8f1c-47ad6b06a768
+CXXXXXXXXX2T macOS   Intune not enrolled        79755778-7cbe-4e2c-83ec-7eaa3d4d7e36
+CXXXXXXXXX3T Windows Intune not enrolled        665e59d5-393a-4894-841d-edad06329717
+CXXXXXXXXX4T macOS   Intune not enrolled        dd032e90-bfb0-47d5-bce5-e57545f6788f
+CXXXXXXXXX5T Windows Intune not enrolled        bf189863-a94a-40dc-9013-d96f8dada2f1
+(...)
+```
+
+## Next steps
+
+Automatically enroll synced devices on user login with
+[auto-enrollment](./device-management.mdx#auto-enrollment).
diff --git a/docs/pages/admin-guides/access-controls/device-trust/jamf-integration.mdx b/docs/pages/identity-governance/device-trust/jamf-integration.mdx
similarity index 90%
rename from docs/pages/admin-guides/access-controls/device-trust/jamf-integration.mdx
rename to docs/pages/identity-governance/device-trust/jamf-integration.mdx
index d229c8f3deef2..46e7751fa7346 100644
--- a/docs/pages/admin-guides/access-controls/device-trust/jamf-integration.mdx
+++ b/docs/pages/identity-governance/device-trust/jamf-integration.mdx
@@ -1,9 +1,17 @@
 ---
 title: Jamf Pro Integration
 description: Sync your Jamf Pro inventory into Teleport
+# Positioning the two integration guides together until we can create a
+# docs subsection/subdirectory for Device Trust integrations
+sidebar_position: 4
+tags:
+ - how-to
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
 ---
 
-Device Trust Jamf Pro integration lets you automatically sync your Jamf Pro computer
+The Device Trust Jamf Pro integration lets you automatically sync your Jamf Pro computer
 inventory into Teleport.
 
 ## How it works
@@ -28,7 +36,7 @@ and behavior.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 (!docs/pages/includes/device-trust/prereqs.mdx!)
 
@@ -84,9 +92,9 @@ try to recreate your API client.
   <details>
   <summary>Configure Jamf hosted plugin</summary>
     Select the Jamf plugin:
-    ![Select Jamf plugin](../../../../img/access-controls/device-trust/select-jamf.png)
+    ![Select Jamf plugin](../../../img/access-controls/device-trust/select-jamf.png)
     Fill in the required information and click "Connect Jamf" button:
-    ![Configure Jamf plugin](../../../../img/access-controls/device-trust/hosted-jamf.png)
+    ![Configure Jamf plugin](../../../img/access-controls/device-trust/hosted-jamf.png)
   </details>
 </Admonition>
 
@@ -183,13 +191,13 @@ devices ls`:
 
 ```code
 $ tctl devices ls
-Asset Tag    OS      Enroll Status Device ID
------------- ------- ------------- ------------------------------------
-CXXXXXXXXX17 macOS   not enrolled  20ec6373-9e8e-46e0-8f1c-47ad6b06a768
-CXXXXXXXXX2T macOS   not enrolled  79755778-7cbe-4e2c-83ec-7eaa3d4d7e36
-CXXXXXXXXX3T macOS   not enrolled  665e59d5-393a-4894-841d-edad06329717
-CXXXXXXXXX4T macOS   not enrolled  dd032e90-bfb0-47d5-bce5-e57545f6788f
-CXXXXXXXXX5T macOS   not enrolled  bf189863-a94a-40dc-9013-d96f8dada2f1
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+CXXXXXXXXX17 macOS Jamf   not enrolled        20ec6373-9e8e-46e0-8f1c-47ad6b06a768
+CXXXXXXXXX2T macOS Jamf   not enrolled        79755778-7cbe-4e2c-83ec-7eaa3d4d7e36
+CXXXXXXXXX3T macOS Jamf   not enrolled        665e59d5-393a-4894-841d-edad06329717
+CXXXXXXXXX4T macOS Jamf   not enrolled        dd032e90-bfb0-47d5-bce5-e57545f6788f
+CXXXXXXXXX5T macOS Jamf   not enrolled        bf189863-a94a-40dc-9013-d96f8dada2f1
 (...)
 ```
 
@@ -364,10 +372,10 @@ Create a readonly Jamf user for inventory sync.
    Take note of the user and password.
 
    User account setup: ![Jamf user setup](
-   ../../../../img/access-controls/device-trust/jamf-setup-1.png)
+   ../../../img/access-controls/device-trust/jamf-setup-1.png)
 
    Privileges setup: ![Jamf privileges setup](
-   ../../../../img/access-controls/device-trust/jamf-setup-2.png)
+   ../../../img/access-controls/device-trust/jamf-setup-2.png)
 
 ## Next steps
 
diff --git a/docs/pages/identity-governance/identity-gov-use-cases.mdx b/docs/pages/identity-governance/identity-gov-use-cases.mdx
new file mode 100644
index 0000000000000..2f8b160bb788e
--- /dev/null
+++ b/docs/pages/identity-governance/identity-gov-use-cases.mdx
@@ -0,0 +1,70 @@
+---
+title: Identity Governance in Action
+sidebar_label: Use Cases
+description: Common use cases with Teleport Identity Governance
+sidebar_position: 1
+tags:
+ - identity-governance
+enterprise: Identity Governance
+---
+
+Teleport Identity Governance helps organizations strengthen security and compliance by centralizing 
+how access is granted, monitored, and enforced across infrastructure and applications. 
+The following use cases highlight practical ways to apply Teleport's governance features, from integrating 
+with device and identity providers, and extending controls into external services. 
+Each scenario links to detailed guides so you can quickly put these capabilities into practice.
+
+## Identity integrations
+
+Teleport supports multiple identity options so you can plug into your existing stack or make Teleport your source of truth. 
+
+Integrate with IdPs like **AWS IAM Identity Center**, **Okta,** **Microsoft Entra ID**, or **SailPoint** to sync groups to Teleport roles. 
+If you prefer, you can also run **Teleport as an identity provider**, issuing 
+short-lived credentials and federating access to downstream apps and services. 
+
+These integrations enable centralized onboarding/off-boarding, group-to-role mapping, and consistent policy enforcement across all your resources.
+
+- [**AWS IAM Identity Center**](integrations/aws-iam-identity-center/aws-iam-identity-center.mdx)
+- [**Okta Integration**](integrations/okta/okta.mdx)
+- [**Entra ID Integration**](integrations/entra-id/getting-started.mdx)
+- [**Teleport Identity Provider**](./idps/idps.mdx)
+- [**SailPoint SCIM Integration**](integrations/scim/sailpoint.mdx)
+
+## Just-in-time Access Requests
+
+[Grant temporary access when it's needed](./access-requests/access-requests.mdx).
+Developers request elevated roles only for the specific task and duration required. 
+Approvals are tracked in the audit log, and Teleport issues short-lived certificates 
+so access automatically expires without manual cleanup.
+
+## Just-in-time Access Request plugins
+
+[Manage requests via third-party tools](access-requests/plugins/plugins.mdx).
+Plugins enforce your reviewer policies, post status updates, and keep a complete, auditable trail. 
+You can receive Access Request notifications where your team already works, such as Slack, Microsoft Teams, PagerDuty, Jira, ServiceNow, and more.
+
+## Access Lists
+
+[Grant auditable access by user group](./access-lists/access-lists.mdx).
+Define membership-based access with owners, eligibility rules, and time-boxed enrollment. 
+Access Lists map groups to Teleport roles, require periodic reviews, and provide a clear record of who had access and why.
+
+## Device Trust
+
+[Enforce trusted registered device access](./device-trust/device-trust.mdx).
+Device identity can help block access from unknown or non-compliant workstations by policy.
+
+## Session and Identity Locking
+
+[Lock compromised users and resources](./locking.mdx).
+Instantly quarantine a user, device, or node to cut off access in an incident. Locks terminate active sessions, 
+prevent new certificate issuance, and are fully scoped and time-limited for safe rollback.
+
+## Further reading
+
+- Read about all of the ways you can configure Access Requests in the 
+[Access Request Configuration Guide](../identity-governance/access-requests/access-request-configuration.mdx).
+- To read more about the architecture of an Access Request plugin, and start writing your own, 
+read our [Access Request plugin development guide](access-requests/plugins/how-to-build.mdx).
+- Learn how [nested Access Lists](../identity-governance/access-lists/nested-access-lists.mdx) grants inheritance work.
+- Learn how [SCIM](integrations/scim/scim.mdx) (System for Cross-domain Identity Management) integration supports automated user management.
diff --git a/docs/pages/identity-governance/identity-governance.mdx b/docs/pages/identity-governance/identity-governance.mdx
new file mode 100644
index 0000000000000..17fd003e87955
--- /dev/null
+++ b/docs/pages/identity-governance/identity-governance.mdx
@@ -0,0 +1,188 @@
+---
+title: Teleport Identity Governance
+description: Provides guides on Teleport Identity Governance.
+template: "landing-page"
+tags:
+ - identity-governance
+enterprise: Identity Governance
+---
+
+import LandingHero from '@site/src/components/Pages/Landing/LandingHero';
+import Integrations from "@site/src/components/Pages/Homepage/Integrations";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+
+import identityGovernanceImg from '@version/docs/img/identity-governance/identity-governance-hero.png';
+import oktaSvg from "@site/src/components/Icon/teleport-svg/okta.svg";
+import arrowRightSvg from "@site/src/components/Icon/teleport-svg/arrow-right.svg";
+import msEntraIdSvg from "@site/src/components/Icon/svg/ms-entra-id.svg";
+import slackSvg from "@site/src/components/Icon/teleport-svg/slack.svg";
+import jiraSvg from "@site/src/components/Icon/svg/jira.svg";
+import pagerDutySvg from "@site/src/components/Icon/svg/pagerduty.svg";
+import terraformSvg from "@site/src/components/Icon/svg/terraform.svg";
+import awsIdentityCenterSvg from "@site/src/components/Icon/svg/aws-identity-center.svg";
+import gcpSvg from "@site/src/components/Icon/svg/googleCloud.svg";
+import grafanaSvg from "@site/src/components/Icon/svg/grafana.svg";
+import jamfProSvg from "@site/src/components/Icon/teleport-svg/jamf-pro.svg";
+
+<LandingHero
+  title="Identity Governance"
+  youtubeVideoId="9zo1mV2uZKE"
+  image={identityGovernanceImg}
+>
+  Manage on-demand access, privileges, and compliance for all your infrastructure.
+
+  ## Grant on-demand access with role and resource requests
+  Provide your organization access with the right level of access granularity. Configure all aspects of the Access Request lifecycle in Teleport.
+</LandingHero>
+
+<UseCasesList
+  title="Identity Governance use cases"
+  useCases={[
+    {
+      title: "Request temporary elevated access",
+      description: "Eliminate standing privileges and get access as needed",
+      href: "./access-requests/",
+    },  
+    {
+      title: "Manage standing access for teams",
+      description: "Use Access Lists for group-based access",
+      href: "./access-lists/",
+    },
+    {
+      title: "Require managed devices for access",
+      description: "Ensure users are using trusted devices",
+      href: "./device-trust/",
+    },  
+    {
+      title: "Monitor for risky access",
+      description: "Identify risky access patterns and behaviors",
+      href: "./access-monitoring/",
+    },
+    {
+      title: "Instantly lock identities and sessions",
+      description: "Lock compromised users and resources",
+      href: "./locking/",
+    },
+  ]}
+/>
+
+<Integrations
+  title="Integrate your stack for greater efficiency and security"
+  desktopColumnsCount={3}
+  noBackgroundColor={true}
+  integrations={[
+    {
+      title: "Okta",
+      description: "Sync Okta users, apps, and groups with Teleport",
+      href: "./integrations/okta/",
+      iconColor: "#0000001A",
+      iconComponent: oktaSvg,
+    },
+    {
+      title: "Microsoft Entra ID",
+      description: "Sync Entra ID users and groups to Teleport",
+      href: "./integrations/entra-id/",
+      iconColor: "#0078D41A",
+      iconComponent: msEntraIdSvg,
+    },
+    {
+      title: "Slack",
+      description: "Post Access Requests to your organization's Slack workspace",
+      href: "./access-requests/plugins/slack/",
+      iconColor: "#ECB22E1A",
+      iconComponent: slackSvg,
+    },
+    {
+      title: "Jira",
+      description: "Manage Access Requests as Jira issues",
+      href: "./access-requests/plugins/jira/",
+      iconColor: "#0078D41A",
+      iconComponent: jiraSvg,
+    },
+    {
+      title: "Jamf Pro",
+      description: "Automatically sync your Jamf inventory with Teleport's trusted devices",
+      href: "./device-trust/jamf-integration/",
+      iconColor: "#788EB11A",
+      iconComponent: jamfProSvg,
+    },
+    {
+      title: "PagerDuty",
+      description: "Manage Access Requests through PagerDuty incidents",
+      href: "./access-requests/plugins/pagerduty/",
+      iconColor: "#06AC381A",
+      iconComponent: pagerDutySvg,
+    },
+    {
+      title: "Terraform",
+      description: "Manage team Access Lists with Infrastructure as Code (IaC) using Terraform",
+      href: "./access-lists/terraform/",
+      iconColor: "#512FC91A",
+      iconComponent: terraformSvg,
+    },
+    {
+      title: "AWS Identity Center",
+      description: "Organize and manage users' short- and long-term access to AWS accounts and permissions",
+      href: "./integrations/aws-iam-identity-center/",
+      iconColor: "#EA43351A",
+      iconComponent: awsIdentityCenterSvg,
+    },
+    {
+      title: "Access Request plugins",
+      href: "./access-requests/plugins/",
+      iconComponent: arrowRightSvg,
+    },
+  ]}
+    additionalLinks={{
+      title: "Set up your first integration:",
+      links: [
+        {
+          title: "Getting started: Integrate with your IdP(s)",
+          href: "./integrations/"
+        },
+      ]
+  }}
+/>
+
+<Integrations
+  title="Make Teleport your SAML identity provider"
+  layout="row"
+  desktopColumnsCount={3}
+  noBackgroundColor={true}
+  integrations={[
+    {
+      title: "Azure Portal & CLI",
+      description: "Integrate the Teleport SAML IdP with Microsoft Entra External ID",
+      href: "./idps/usage/saml-microsoft-entra-external-id/",
+      iconColor: "#0000001A",
+      iconComponent: msEntraIdSvg,
+    },
+    {
+      title: "Google Cloud Console & API",
+      description: "Use Google Cloud Workforce Identity Federation to provision access",
+      href: "./idps/usage/saml-gcp-workforce-identity-federation/",
+      iconColor: "#34A8530D",
+      iconComponent: gcpSvg,
+    },
+    {
+      title: "Grafana",
+      description: "Configure employee access to Grafana Enterprise instances",
+      href: "./idps/usage/saml-grafana/",
+      iconColor: "#F15B2A0D",
+      iconComponent: grafanaSvg,
+    },
+  ]}
+  additionalLinks={{
+    title: "Turn Teleport into your SAML IdP:",
+    links: [
+      {
+        title: "Getting started: Log in to external services with Teleport",
+        href: "./idps/saml-guide/"
+      },
+      {
+        title: "About SAML IdP attribute mapping",
+        href: "./idps/saml-attribute-mapping/"
+      },
+    ]
+  }}
+/>
diff --git a/docs/pages/identity-governance/idps/idps.mdx b/docs/pages/identity-governance/idps/idps.mdx
new file mode 100644
index 0000000000000..301493a83cd6f
--- /dev/null
+++ b/docs/pages/identity-governance/idps/idps.mdx
@@ -0,0 +1,15 @@
+---
+title: Configure Teleport as an Identity Provider
+sidebar_label: Teleport as an IdP
+description: How to set up Teleport's identity provider functionality
+tags:
+ - identity-governance
+ - infrastructure-identity
+enterprise: Identity Governance
+---
+
+Users can authenticate to both internal and external applications
+through the use of a built in identity provider in Teleport.
+
+<DocCardList />
+- [SAML Reference](../../reference/access-controls/saml-idp.mdx): A reference for Teleport's SAML identity provider.
diff --git a/docs/pages/admin-guides/access-controls/idps/saml-attribute-mapping.mdx b/docs/pages/identity-governance/idps/saml-attribute-mapping.mdx
similarity index 94%
rename from docs/pages/admin-guides/access-controls/idps/saml-attribute-mapping.mdx
rename to docs/pages/identity-governance/idps/saml-attribute-mapping.mdx
index 25a485b253975..2d394b94215fd 100644
--- a/docs/pages/admin-guides/access-controls/idps/saml-attribute-mapping.mdx
+++ b/docs/pages/identity-governance/idps/saml-attribute-mapping.mdx
@@ -1,13 +1,19 @@
 ---
 title: SAML IdP Attribute Mapping
+sidebar_label: Attribute Mapping
 description: How to map user attributes to custom SAML response
-h1: SAML Attribute Mapping
+tags:
+ - teleport-as-idp
+ - conceptual
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 Attribute mapping configures Teleport SAML Identity Provider to assert custom user attributes in SAML response.
 The Teleport SAML IdP supports three configurable fields for attribute mapping:
 - `name`: Name of the outgoing attribute. Required. Name should be unique across attribute mapping.
-- `value`: Value defined using a [predicate expression](../../../reference/predicate-language.mdx), which can reference
+- `value`: Value defined using a [predicate expression](../../reference/access-controls/predicate-language.mdx), which can reference
 Teleport usernames, roles or traits. Required.
 - `name_format`: SAML attribute name format. Optional. The following formats are supported:
   - `unspecified`: value equals to `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified`. Used as a default value.
@@ -36,11 +42,11 @@ spec:
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 - (!docs/pages/includes/tctl.mdx!)
 - Teleport user with permission to create a service provider resource. The preset `editor` role has this permission.
 - If you're new to SAML, consider reviewing our [SAML Identity Provider
-  Reference](../../../reference/access-controls/saml-idp.mdx) before proceeding.
+  Reference](../../reference/access-controls/saml-idp.mdx) before proceeding.
 
 ## Predicate expressions
 
diff --git a/docs/pages/identity-governance/idps/saml-guide.mdx b/docs/pages/identity-governance/idps/saml-guide.mdx
new file mode 100644
index 0000000000000..702f755553211
--- /dev/null
+++ b/docs/pages/identity-governance/idps/saml-guide.mdx
@@ -0,0 +1,265 @@
+---
+title: Using Teleport as a SAML Identity Provider
+sidebar_label: Getting Started
+description: How to configure and use Teleport as a SAML identity provider.
+sidebar_position: 1
+tags:
+ - teleport-as-idp
+ - how-to
+ - identity-governance
+ - infrastructure-identity
+enterprise: Identity Governance
+---
+
+This guide details an example on how to use Teleport as a SAML identity provider
+(IdP). You can set up the Teleport SAML IdP to enable Teleport users to
+authenticate to external services through Teleport.
+
+## How it works
+
+On Teleport Enterprise deployments, the Teleport SAML IdP runs as part of the
+Teleport Proxy Service and exposes paths of the Proxy Service HTTP API that
+implement a SAML IdP. You can register a third-party application with the IdP by
+creating a Teleport dynamic resource, the SAML IdP service provider, that
+includes information about the application.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- If you're new to SAML, consider reviewing our [SAML Identity Provider
+  Reference](../../reference/access-controls/saml-idp.mdx) before proceeding.
+- SAML application (also known as a SAML service provider or SP) for testing. 
+  For this guide, we'll be using [RSA Simple Test Service Provider](https://sptest.iamshowcase.com/) - 
+  a free service that lets us test the Teleport SAML IdP. The test service 
+  has a protected page, which can be accessed only after a user is federated to 
+  the site with a valid SAML assertion flow. Below in this guide, we will refer 
+  to this application as the "IAMShowcase" app. 
+![iamshowcase protected page](../../../img/access-controls/saml-idp/rsa-simplesp-protected-page.png)
+
+## Step 1/4. Create a role
+
+As a first step, we will create a role which will grant permissions to manage 
+a `saml_idp_service_provider` resource for the IAMShowcase app. 
+The role will also grant permission to log in to this application 
+by authenticating with Teleport. We will name this role as `saml-admin`.
+
+In the Teleport Web UI, from the side the navigation menu, select **Zero Trust Access > Roles** 
+menu. From the **Roles** UI, click `Create New Role` button. 
+
+Enter "saml-admin" as a role name and then click the `Next: Resources` button to 
+move to the "Resources" tab. 
+
+{/* vale off */}
+In the **Resources** tab, open the dropdown menu by clicking on the `+ Add Teleport Resource Access` 
+button, then select **Application Access**. Enter "env" as the label key and "saml-test" 
+as the label value. In the Step 3 of this guide below, we will create a SAML service 
+provider resource with this matching label value `env: saml-test`, limiting 
+scope of the permissions granted by this role.
+
+![Configure app label](../../../img/access-controls/saml-idp/step-1-create-role-app-label.png)
+
+Click `Next: Admin Rules` button to move to the **Admin Rules** tab.
+
+In the **Admin Rules** tab, click `+ Add New` button. In the **Teleport Resources**
+input box, search and select the `saml_idp_service_provider` resource. 
+And then in the **Permissions** section, check `read, list, create, update, delete`
+permissions.
+
+![Configure service provider rule verbs](../../../img/access-controls/saml-idp/step-1-create-role-saml-resource.png)
+
+Click `Next: Options` button to move to next step and then click `Create Role`
+button to create a new role.
+
+<details>
+
+<summary>Reference YAML spec for the `saml-admin` role.</summary>
+```yaml
+kind: role
+metadata:
+  name: saml-admin
+spec:
+  allow:
+    app_labels:
+      env: saml-test
+    rules:
+    - resources:
+      - saml_idp_service_provider
+      verbs:
+      - read
+      - list
+      - create
+      - update
+      - delete
+version: v8
+```
+</details>
+
+(!docs/pages/includes/add-role-to-user.mdx role="saml-admin"!) 
+
+## Step 2/4. Configure the service provider
+
+This step involves configuring the SAML service provider with the Teleport SAML IdP metadata.
+
+You can obtain the Teleport SAML IdP metadata values from the SAML application 
+setup wizard, which is available in the Teleport Web UI.
+
+In the Teleport Web UI, select **Add New > Resource** menu, and search for 
+"saml application". Choose the "SAML Application (Generic)" tile. 
+
+![Enroll SAML app](../../../img/access-controls/saml-idp/step-2-find-saml-discover-tile.png)
+
+As a first step of the SAML Application setup wizard, the Teleport Web UI displays
+the Teleport SAML IdP metadata values. 
+
+The process of SAML service provider configuration varies from service provider 
+to service provider. Some service provider may ask to provide Teleport SAML IdP's 
+entity ID, SSO URL and X.509 certificate explicitly. Other's may ask to upload 
+the Teleport SAML IdP metadata (SAML entity descriptor) file .
+
+![Teleport IdP metadata](../../../img/access-controls/saml-idp/step-2-copy-metadata.png)
+
+In the case of IAMShowcase app, which this guide is 
+based on, it is designed to grant access protected page for any well formatted 
+IdP federated SAML assertion data.
+
+As such, we will move to the next step in the setup wizard to add the IAMShowcase app to Teleport.
+
+## Step 3/4. Add a service provider to Teleport
+
+To add a service provider to Teleport, you must configure a service provider
+metadata. This can be configured by either providing an entity ID and ACS URL 
+values of the service provider or by providing an entity descriptor value 
+(also known as metadata file, which is an XML file) of the service provider.
+
+Below we'll show both of the configuration options.
+
+### Option 1: Configure with entity ID and ACS URL
+
+With this configuration method, Teleport first tries to fetch an entity 
+descriptor by querying the entity ID endpoint. If an entity descriptor is not 
+found at that endpoint, Teleport will generate a new entity descriptor with the 
+given entity ID and ACS URL values.
+
+To configure the IAMShowcase app, the values you 
+need to provide are the following:
+- **App Name:** `IAMShowcase`.
+- **SP Entity ID / Audience URI:** `IAMShowcase`. The SAML metadata value or an 
+  endpoint of the service provider.
+- **ACS URL / SP SSO URL:** `https://sptest.iamshowcase.com/acs`. The endpoint 
+  where users will be redirected after SAML authentication. ACS URL is also 
+  referred to as SAML SSO URL.
+- **Label:** `env: saml-test`. Label will be used in RBAC.
+
+![add service provider](../../../img/access-controls/saml-idp/step-3-add-service-provider.png)
+
+Click `Finish` button. The "IAMShowcase" app is now added to Teleport.
+
+### Option 2: Configure with Entity Descriptor file
+
+With this option, you provide the service provider entity descriptor file, which 
+has all the details required to configure service provider metadata.
+
+If the service provider provides an option to download its entity descriptor file 
+or you need more control over the entity descriptor, this is the recommended 
+option to add a service provider to Teleport.
+
+To configure the IAMShowcase app, the values you need to provide are the following:
+- **App Name:** `IAMShowcase`.
+- **Entity Descriptor:** Entity descriptor for the IAMShowcase app 
+  which is available in this URL: `https://sptest.iamshowcase.com/testsp_metadata.xml`.
+- **Label:** `env: saml-test`.
+
+![add service provider with entity descriptor](../../../img/access-controls/saml-idp/step-3-add-service-provider-ed.png)
+
+Click `Finish` button. The "IAMShowcase" app is now added to Teleport.
+
+<Admonition type="important">
+If an entity descriptor is provided, its content takes preference over values 
+provided for entity ID and ACS URL.
+</Admonition>
+
+## Step 4/4. Verify access to the protected page
+
+To verify everything works, navigate to the **Resources** page in the Teleport Web UI 
+and search for the "IAMShowcase" app.
+
+![Access app](../../../img/access-controls/saml-idp/step-4-login.png)
+
+From the "IAMShowcase" app tile, click the `Log in` button, which will forward 
+you to the IAMShowcase app's protected page with a SAML assertion data signed by 
+the Teleport SAML IdP.
+
+![Protected page access](../../../img/access-controls/saml-idp/step-4-service-provider-authenticated-page.png)
+
+This page shows Teleport user details along with other attributes such as role 
+names that are federated by the Teleport SAML IdP, confirming a successful SAML 
+service provider configuration in Teleport.
+
+
+## Manage SAML IdP service provider resource using `tctl`
+
+Examples of managing a `saml_idp_service_provider` resource using `tctl`.
+
+### Create a `saml_idp_service_provider` resource
+
+First, create a Teleport resource spec file with the following `saml_idp_service_provider`
+resource spec:
+
+```yaml
+cat > iamshowcase.yaml << EOF
+kind: saml_idp_service_provider
+metadata:
+  labels:
+    env: saml-test
+  # The resource name of the service provider.
+  name: IAMShowcase
+spec:
+  acs_url: https://sptest.iamshowcase.com/acs
+  entity_id: IAMShowcase
+version: v1
+EOF
+```
+
+Next, create a Teleport resource using the `tctl create` command:
+
+```code
+$ tctl create iamshowcase.yaml
+# SAML IdP service provider 'IAMShowcase' has been created.
+```
+
+### Update a `saml_idp_service_provider` resource
+
+To update the resource, first, get the latest copy of the resource spec 
+from the Teleport cluster.
+```code
+$ tctl get saml_idp_service_provider/IAMShowcase > iamshowcase.yaml
+```
+
+Then modify the spec by updating the `iamshowcase.yaml`, save it, and then update 
+the Teleport resource by using the `tctl create -f` command:
+```code
+$ tctl create -f iamshowcase.yaml 
+```
+
+### List `saml_idp_service_provider` resources
+To list a specific service provider:
+```code
+$ tctl get saml_idp_service_provider/IAMShowcase 
+```
+
+To list all the service providers:
+```code
+$ tctl get saml_idp_service_provider 
+```
+
+### Delete a `saml_idp_service_provider` resource
+```code
+$ tctl rm saml_idp_service_provider/IAMShowcase 
+```
+
+## Next steps
+
+- Learn how to [control access](saml-idp-rbac.mdx) to the SAML IdP service provider resource.
+- Configure [SAML Attribute Mapping](./saml-attribute-mapping.mdx).
diff --git a/docs/pages/identity-governance/idps/saml-idp-rbac.mdx b/docs/pages/identity-governance/idps/saml-idp-rbac.mdx
new file mode 100644
index 0000000000000..64c6647d93893
--- /dev/null
+++ b/docs/pages/identity-governance/idps/saml-idp-rbac.mdx
@@ -0,0 +1,169 @@
+---
+title: SAML Application Access Control
+sidebar_label: Access Controls
+description: Learn how to manage access to a SAML service provider (SAML applications).
+sidebar_position: 2
+tags:
+ - identity-governance
+enterprise: Identity Governance
+---
+
+This page explains how access to a SAML IdP service provider resource (SAML application)
+can be managed in Teleport. 
+
+If you are new to the Teleport SAML IdP, start by learning how to configure [Teleport as 
+an SAML IdP](saml-guide.mdx).
+
+## How it works 
+
+User access to the SAML IdP service provider resource can be categorized into two different 
+use cases:
+- **Managing a SAML IdP service provider resource.** For example, when a Teleport administrator 
+  attempts to create or update a SAML IdP service provider resource.
+- **Logging in to the SAML service provider.** For example, when a Teleport user attempts to
+  log in to the SAML IdP service provider by authenticating with Teleport. 
+
+In both the cases, access can be configured by using a Teleport role 
+with an allow/deny rule targeting the `saml_idp_service_provider` resource and label matchers
+matching role `app_labels` with the `saml_idp_service_provider` resource labels. 
+
+
+## RBAC behavior between different Teleport role versions
+
+The Teleport SAML IdP applies different RBAC logic to the service provider resource in
+role version 8 versus role version 7 and below. 
+
+In role version 7 and below, the following access controls are applied to the `saml_idp_service_provider`
+resource access: 
+
+- Role option that enables the IdP: `spec.options.idp.saml.enabled: true/false`.
+- Cluster auth preference that enables the IdP: `spec.idp.saml.enabled: true/false`.
+- Resource rule `spec.allow/deny.rules.resources.saml_idp_service_provider`. Applicable only
+  to admin actions. 
+  - Allow rules with `read,list` verbs are applied implicitly. 
+  - Deny rules with `read,list` verbs gets precedence over implicit allow. 
+- Per session MFA: `spec.options.require_session_mfa: true/false`.
+
+Teleport role version 8 (released with Teleport version 18.0) introduced the following RBAC changes:
+- Label matchers based on `app_labels`.
+- Resource rule with verbs targeting `saml_idp_service_provider` is now applicable to both resource 
+  access and admin actions. 
+- Device Trust for SAML IdP session.
+
+The role option `spec.options.idp.saml.enabled: true/false` is no longer supported starting 
+role version 8.
+
+Per session MFA is supported in all role versions.
+
+
+## RBAC precedence
+
+Users can be assigned with both the newer role (version 8) and the older versioned roles 
+(version 7 and below) at the same time. If a user is assigned with both role version 7 and 8, 
+deny rules of the version 8 takes precedence.
+
+For example,
+- If role version 7 denies access, access is denied.
+- If role version 7 allows access but role version 8 denies access, access is denied. 
+- If role version 7 allows access but role version 8 does not explicitly allow access 
+  (via matching app labels), access is denied. 
+- If role version 7 allows access and role version 8 also allows access, access is allowed.
+
+The table below shows a few more examples of applicable RBAC, when two roles with version 7 and 8 each are assigned to the user.
+
+| Role v7                                                                    | Role v8                                                    |  Result           |
+|----------------------------------------------------------------------------|------------------------------------------------------------|-------------------|
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: false</pre>      | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ❌ no access.      |
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>deny:<br/>  app_labels:<br/>     * : *</pre>          | ❌ no access       |  
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>allow:<br/>  app_labels:<br/>    * : *<br/>deny:<br/>  rules:<br/>    resources:<br/>    - saml_idp_service_provider<br/>    verbs:<br/>    - read<br/>    - list</pre>          | ❌ no access     | 
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ✅ full access     | 
+| No version 7 role assigned to the user                                     | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ✅ full access     | 
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>allow:<br/>  app_labels:<br/>    env : dev</pre>      | ✅ access to SAML app matching `env:dev` resource label       |  
+| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | No version 8 role assigned to the user           | ✅ full access     | 
+
+<Admonition type="important" title="Admin Actions">
+ `saml_idp_service_provider` resource does not yet support MFA and Device Trust for admin actions. 
+</Admonition>
+
+## Role examples
+
+Examples of Teleport role that grants permissions to either access or manage 
+the SAML IdP service provider resource. 
+
+### Role to manage SAML IdP service provider resource
+
+In this case, the role needs to target `saml_idp_service_provider` resource with 
+either `create,update,read,list,delete` or all of them as needed. 
+
+The role should also grants access to the `app_labels` that matches with the 
+resource label configured for the `saml_idp_service_provider` resource. 
+
+`saml_idp_service_provider` resource access verb
+```yaml
+kind: role
+version: v8
+metadata:
+  name: saml-resource-manager
+spec:
+  allow:
+    app_labels:
+      'env': 'dev' # This label must match with the saml_idp_service_provider resource label
+    rules:
+    - resources:
+      - saml_idp_service_provider
+      verbs:
+      - read
+      - list
+      - create
+      - update
+      - delete
+```
+
+### Role to allow users to log in to a SAML IdP service provider 
+
+In this case, at minimum, user needs `read,list` access to the `saml_idp_service_provider` 
+resource and must have an `app_labels` value matching with the resource label defined for 
+the `saml_idp_service_provider` resource. 
+
+Resource labels matching role `app_labels`.
+```yaml 
+kind: role
+version: v8
+metadata:
+  name: saml-access
+spec:
+  allow:
+    app_labels:
+      'env': 'dev' # This label must match with the saml_idp_service_provider resource label
+    rules:
+    - resources:
+      - saml_idp_service_provider
+      verbs:
+      - read
+      - list
+options:
+    device_trust_mode: required
+    require_session_mfa: true
+```
+
+
+## Disabling SAML identity provider at cluster level
+
+To disable access to the identity provider at the cluster level, create
+or update the `cluster_auth_preference` object with the following setting:
+
+```yaml
+kind: cluster_auth_preference
+metadata:
+  name: cluster-auth-preference
+spec:
+  ...
+  idp:
+    saml:
+      enabled: false
+  ...
+version: v2
+```
+
+This will disable access to the SAML identity provider for all users regardless
+of their role level permissions.
diff --git a/docs/pages/admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation.mdx b/docs/pages/identity-governance/idps/usage/saml-gcp-workforce-identity-federation.mdx
similarity index 96%
rename from docs/pages/admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation.mdx
rename to docs/pages/identity-governance/idps/usage/saml-gcp-workforce-identity-federation.mdx
index 262bd3a4519a1..831eb7d3d67da 100644
--- a/docs/pages/admin-guides/access-controls/idps/saml-gcp-workforce-identity-federation.mdx
+++ b/docs/pages/identity-governance/idps/usage/saml-gcp-workforce-identity-federation.mdx
@@ -1,9 +1,18 @@
 ---
-title: Access GCP Web Console and API with federated authentication
+title: GCP Workforce Identity Federation with Teleport SAML IdP
+sidebar_label: GCP Workforce Identity Federation
 description: Manage Google Cloud Platform (GCP) web console access with Teleport SAML IdP.
-h1: GCP Workforce Identity Federation with Teleport SAML IdP
+tags:
+ - teleport-as-idp
+ - how-to
+ - identity-governance
+ - google-cloud
+ - infrastructure-identity
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 GCP Workforce Identity Federation enables provisioning access to GCP web console and APIs
 for identities that are not managed within Google Workspace Admin or GCP Cloud Identity.
 
@@ -17,10 +26,9 @@ process.
 This guide details how to integrate GCP workforce Identity Federation service with Teleport
 SAML IdP, so users can sign in into GCP web console by authenticating with Teleport.
 
-
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 - If you're new to SAML, consider reviewing our [SAML Identity Provider
@@ -39,7 +47,7 @@ pool provider to help you quickly get started with the integration.
 ## Guided configuration flow
 Create a workforce pool and pool provider with the script generated by Teleport.
 
-In the Web UI, under **Access Management**, click **Enroll New Resource** menu.
+In the Web UI, under **Add New** in the left pane, click **Resource** menu.
 In the search box, enter “workforce”, which will show the Workforce Identity Federation
 integration tile. Click the tile.
 ![Test the IdP](../../../../img/access-controls/saml-idp/gcp-workforce/gcp-workforce-tile.png)
@@ -141,7 +149,7 @@ granular access control to GCP resources.
 Attribute mapping allows to map user identity and traits available in the SAML assertion data
 created by Teleport to GCP identity.
 
-GCP attribute mapping is similar to [Teleport SAML IdP attribute mapping](./saml-attribute-mapping.mdx)
+GCP attribute mapping is similar to [Teleport SAML IdP attribute mapping](../saml-attribute-mapping.mdx)
 with a slight difference that you use [Google CEL](https://github.com/google/cel-spec/blob/master/doc/langdef.md)
 instead of predicate expression to map attributes.
 
diff --git a/docs/pages/admin-guides/access-controls/idps/saml-grafana.mdx b/docs/pages/identity-governance/idps/usage/saml-grafana.mdx
similarity index 87%
rename from docs/pages/admin-guides/access-controls/idps/saml-grafana.mdx
rename to docs/pages/identity-governance/idps/usage/saml-grafana.mdx
index 284b5e7a8a0df..958a63d80b624 100644
--- a/docs/pages/admin-guides/access-controls/idps/saml-grafana.mdx
+++ b/docs/pages/identity-governance/idps/usage/saml-grafana.mdx
@@ -1,6 +1,13 @@
 ---
-title: Use Teleport's SAML Provider to authenticate with Grafana
+title: Use Teleport's SAML Provider to Authenticate with Grafana
+sidebar_label: Grafana Authentication
 description: Configure Grafana to use identities provided by Teleport.
+tags:
+ - teleport-as-idp
+ - how-to
+ - identity-governance
+ - infrastructure-identity
+enterprise: Identity Governance
 ---
 
 Grafana is an open source observability platform. Their enterprise version supports
@@ -10,12 +17,20 @@ and Grafana to accept the identities it provides.
 Note that Teleport can act as an identity provider to any SAML-compatible service,
 not just those running behind the Teleport App Service.
 
+## How it works
+
+Grafana enables users to authenticate using SAML. You can export SAML IdP
+metadata from Teleport, then provide it to your Grafana configuration file in
+order to instruct Grafana to trust the Teleport IdP's certificate authority.
+Your Teleport cluster then uses a SAML IdP service provider resource  to provide
+information about your Grafana deployment to the Teleport SAML IdP.
+
 ## Prerequisites
 
 - An instance of Grafana Enterprise, with edit access to `grafana.ini`.
   - A trusted certificate authority to create TLS certificates/keys for the SAML connection.
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
diff --git a/docs/pages/admin-guides/access-controls/idps/saml-microsoft-entra-external-id.mdx b/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx
similarity index 89%
rename from docs/pages/admin-guides/access-controls/idps/saml-microsoft-entra-external-id.mdx
rename to docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx
index 1d8e795359378..2be6f917dd0d1 100644
--- a/docs/pages/admin-guides/access-controls/idps/saml-microsoft-entra-external-id.mdx
+++ b/docs/pages/identity-governance/idps/usage/saml-microsoft-entra-external-id.mdx
@@ -1,14 +1,45 @@
 ---
 title: Access Azure Portal and CLI 
 description: Access Azure Portal and CLI by authenticating with Teleport SAML IdP
+tags:
+ - teleport-as-idp
+ - how-to
+ - identity-governance
+ - azure
+ - infrastructure-identity
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 This guide explains how to integrate the Teleport SAML IdP with [Microsoft Entra External ID](https://learn.microsoft.com/en-us/entra/external-id/)
 so that users can access Azure Portal and the Azure CLI by authenticating with Teleport.
 
+## How it works
+
+An administrator configures the [Teleport SAML IdP](../saml-guide.mdx) as an
+external IdP in Microsoft Entra External ID, and configures users who are to be
+granted access to Azure as external users. As long as the accounts of these
+users are associated with a domain that is assigned to the Teleport SAML IdP,
+these users can access Azure portal and CLI tools by authenticating with
+Teleport.
+
+Authentication is based on the [interactive sign-in](
+https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively) 
+process. User audit events in Azure are tagged on behalf of Teleport user account,
+providing better audit visibility.
+
+Alternatively, you can also manage access to Azure API and CLI by deploying the 
+[Teleport Application Service](../../../enroll-resources/application-access/cloud-apis/azure.mdx). 
+This approach supports access based on [managed identity](
+https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-managed-identity), 
+which may be suitable for automated access. The downside to this approach is that it cannot
+be used to provision access to Azure portal and the audit logs are not tied to the 
+Teleport user account, limiting user account visibility on the the audit events.
+
 ## Prerequisites
 
-- A running Teleport Enterprise cluster version (=teleport.version=) or above. If you
+- A running Teleport Enterprise cluster v17.5.1 or higher. If you
   want to get started with Teleport, [sign up](https://goteleport.com/signup)
   for a free trial.
 - If you're new to SAML, consider reviewing our [SAML identity provider (IdP)](../../../reference/access-controls/saml-idp.mdx) 
diff --git a/docs/pages/identity-governance/idps/usage/usage.mdx b/docs/pages/identity-governance/idps/usage/usage.mdx
new file mode 100644
index 0000000000000..d000ab93bfaef
--- /dev/null
+++ b/docs/pages/identity-governance/idps/usage/usage.mdx
@@ -0,0 +1,12 @@
+---
+title: Using the Teleport SAML IdP
+sidebar_label: Usage
+description: Explains how to enable Teleport users to authenticate to external services using the Teleport SAML IdP.
+enterprise: Identity Governance
+---
+
+The guides in this section explain how to set up the Teleport SAML IdP to enable
+Teleport users to authenticate to external services via Teleport:
+
+<DocCardList kind="labelOnly" />
+
diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx
new file mode 100644
index 0000000000000..a39713b192396
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/advanced-options.mdx
@@ -0,0 +1,78 @@
+---
+title: Advanced Identity Center Options
+sidebar_label: Advanced Options
+description: Describes advanced Identity Center use cases.
+tags:
+ - conceptual
+ - identity-governance
+enterprise: Identity Governance
+---
+
+The Identity Center Integration can be configured to handle various advanced use
+cases that are ot necessarily supported by the default installation flow. This
+guide describes these advanced options and use cases.
+
+## Disabling Account Assignment role creation
+
+By default, the AWS Identity Center integration will create a Teleport role for
+every possible combination of AWS Account and Permission Set managed by your AWS
+Identity Center instance. If your Identity Center controls a large number of AWS
+Accounts and/or Permission Sets, this may end up creating so many roles that it
+starts to affect Teleport's performance.
+
+To avoid creating these Account Assignment roles, you can create the AWS IC 
+integration with this feature disabled by specifying `--roles-sync-mode NONE`
+when creating the integration with `tctl`, for example:
+
+<Admonition type="note">
+Setting the Roles Sync Mode is only available when installing the Identity Center
+integration via `tctl`. 
+
+Role Sync Mode `NONE` is only available during installation. The Roles Sync Mode
+can be changed to `ALL` later, but you can't go back the other way.
+</Admonition>
+
+```console
+$ tctl plugins install awsic \
+    --instance-arn ${IDENTITY_CENTER_INSTANCE_ARN} \
+    --instance-region ${IDENTITY_CENTER_INSTANCE_REGION} \
+    --use-system-credentials \
+    --assume-role-arn ${AWS_IAM_ROLE_ARN} \
+    --scim-url ${IDENTITY_CENTER_SCIM_BASE_URL} \
+    --scim-token ${IDENTITY_CENTER_SCIM_BEARER_TOKEN} \
+    --access-list-default-owner ${TELEPORT_ACCESS_LIST_DEFAULT_OWNER} \
+    --roles-sync-mode NONE
+```
+
+### Roles Sync Modes
+
+The Roles Sync Mode controls whether the IC integration will create Account
+Assignment roles for each possible AWS Account Assignment. There are currently
+two possible values: `ALL` (create roles for all possible Account Assignments)
+and `NONE` (do not create roles for _any_ possible Account Assignment).
+
+<Admonition type="warning">
+The integration's Group Import process uses these Account Assignment roles to
+provision access for the Access Lists it creates. In order to prevent the integration
+from creating invalid Access Lists, setting the Roles Sync Mode to `NONE` also 
+requires that integration's Group Import filter contain a single exclude-all clause.
+
+Teleport enforces this restriction, preventing the accidental creation of an invalid
+configuration.
+</Admonition>
+
+### Switching Roles Sync Modes
+
+After installation you can switch the Roles Sync Mode from `NONE` to `ALL` using
+`tctl plugins edit`.
+
+```console
+$ tctl plugins edit awsic --roles-sync-mode ALL
+```
+
+<Admonition type="warning">
+Moving from Roles Sync Mode `ALL` to `NONE` may cause Teleport to potentially
+delete in-use roles, so that transition is not allowed.
+
+Currently the only way to move back to `NONE` is deleting and re-installing the integration.
+</Admonition>
diff --git a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/aws-iam-identity-center.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/aws-iam-identity-center.mdx
similarity index 83%
rename from docs/pages/admin-guides/management/guides/aws-iam-identity-center/aws-iam-identity-center.mdx
rename to docs/pages/identity-governance/integrations/aws-iam-identity-center/aws-iam-identity-center.mdx
index 7450ac2b00f3e..b54dabf9eba5d 100644
--- a/docs/pages/admin-guides/management/guides/aws-iam-identity-center/aws-iam-identity-center.mdx
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/aws-iam-identity-center.mdx
@@ -1,6 +1,12 @@
 ---
 title: AWS IAM Identity Center
 description: Provides an overview of the Teleport AWS IAM Identity Center integration.
+tags:
+ - conceptual
+ - identity-governance
+ - privileged-access
+ - aws
+enterprise: Identity Governance
 ---
 
 Teleport's integration with [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/)
@@ -11,9 +17,9 @@ With the AWS Identity Center integration, you can manage AWS access by granting
 
 ## How it works
 
-The Identity Center integration builds on top of Teleport's [role-based access controls](../../../access-controls/guides/guides.mdx),
-[just-in-time Access Requests](../../../access-controls/access-requests/access-requests.mdx)
-and [Access Lists](../../../access-controls/access-lists/access-lists.mdx) to manage
+The Identity Center integration builds on top of Teleport's [role-based access controls](../../../index.mdx),
+[just-in-time Access Requests](../../access-requests/access-requests.mdx)
+and [Access Lists](../../access-lists/access-lists.mdx) to manage
 the creation and deletion of Identity Center _Account Assignments_. 
 
 An _account assignment_ is the combination of a specific AWS Permission Set on a 
@@ -53,3 +59,6 @@ user and automatically unassign once the Access Request expires.
 
 - [Getting Started with AWS IAM Identity Center integration](guide.mdx)
 - [Migrating Okta-managed AWS IAM Identity Center integration to Teleport](migrating-identity-center-from-okta-to-teleport.mdx)
+- [Using the AWS CLI tools with Teleport and AWS IAM Identity Center](using-aws-cli.mdx)
+- [Advanced Identity Center Options](advanced-options.mdx)
+- [Rotating the AWS IAM Identity Center SCIM Token](maintenance.mdx)
diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx
new file mode 100644
index 0000000000000..196198efddae4
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/guide.mdx
@@ -0,0 +1,475 @@
+---
+title: Getting Started with AWS IAM Identity Center integration
+sidebar_label: Getting Started
+description: Explains how to set up and use Teleport AWS IAM Identity Center integration.
+tags:
+ - teleport-as-idp
+ - how-to
+ - identity-governance
+ - privileged-access
+ - aws
+enterprise: Identity Governance
+---
+
+Teleport's integration with [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/)
+allows you to organize and manage your users' short- and long-term access to AWS
+accounts and their permissions.
+
+## How it works
+
+The Teleport Web UI provides a guided configuration flow for the Identity Center
+integration. The AWS IAM Identity Center integration fetches Identity Center
+accounts, users, groups, permission set assignments, and other data. To enable
+the integration, you set up Teleport as an OIDC identity provider for your AWS
+account and create an AWS role with the permissions required for the integration
+to function. You then enable the SCIM endpoint in AWS Identity Center to allow
+Teleport to push user and group changes.
+
+## Prerequisites
+
+- Teleport Enterprise or Teleport Enterprise Cloud cluster version 17.0 or higher.
+- Administrative access to AWS IAM Identity Center.
+- Teleport preset `editor` role or equivalent to configure plugin resource, integration 
+  resource and SAML IdP service provider resource. If you are using [role version 8](../../../reference/access-controls/roles.mdx#role-versions) 
+  to manage access (which is the default role version since Teleport version 18.0), 
+  ensure that your role allows `app_labels` for the AWS IAM Identity Center 
+  resource `'teleport.dev/origin': 'aws-identity-center'`.
+
+Note that Identity Center integration requires using Teleport as an external
+identity source.
+
+As such, we recommend ensuring that all Identity Center users have access to
+your Teleport cluster before turning the integration on to avoid access
+interruption. If your Identity Center already uses external identity source,
+you can configure the corresponding [SSO connector](../../../zero-trust-access/sso/sso.mdx)
+in Teleport or, if you're using Okta, enable the
+[Okta integration](../okta/okta.mdx).
+
+## Step 1/7. Configure AWS integration
+
+To get started, navigate to the "Add new integration" page in your Teleport
+cluster control panel and select "AWS Identity Center".
+
+![Pick Identity Center integration](../../../../img/identity-center/ic-pick-integration.png)
+
+Next, you will generate a script that creates an AWS IAM role for the
+integration.
+
+<details>
+<summary>Full list of IAM permissions required by Identity Center integration</summary>
+```
+// ListAccounts
+organizations:ListAccounts
+organizations:ListAccountsForParent
+
+// ListGroupsAndMembers
+identitystore:ListUsers
+identitystore:ListGroups
+identitystore:ListGroupMemberships
+
+// ListPermissionSetsAndAssignments
+sso:DescribeInstance
+sso:DescribePermissionSet
+sso:ListPermissionSets
+sso:ListAccountAssignmentsForPrincipal
+sso:ListPermissionSetsProvisionedToAccount
+
+// CreateAndDeleteAccountAssignment
+sso:CreateAccountAssignment
+sso:DescribeAccountAssignmentCreationStatus
+sso:DeleteAccountAssignment
+sso:DescribeAccountAssignmentDeletionStatus
+iam:AttachRolePolicy
+iam:CreateRole
+iam:GetRole
+iam:ListAttachedRolePolicies
+iam:ListRolePolicies
+
+// AllowAccountAssignmentOnOwner
+iam:GetSAMLProvider
+
+// ListProvisionedRoles
+iam:ListRoles
+```
+</details>
+
+![Configure AWS integration](../../../../img/identity-center/ic-step1.1.png)
+
+Enter required information such as Identity Center region, ARN and integration
+name, and execute the generated command in the Cloud Shell.
+
+After the script has run, fill out the ARN for the role created by the script.
+
+![Run script for AWS integration](../../../../img/identity-center/ic-step1.2.png)
+
+## Step 2/7. Preview AWS resources
+
+On the next step, you are presented with the list of AWS accounts, groups, and
+permission sets that Teleport was able to find in your Identity Center.
+
+![Preview AWS resources](../../../../img/identity-center/ic-step2.png)
+
+Pick the default owners that should be assigned to the Access Lists in Teleport.
+These resources will be imported into Teleport once the plugin is installed.
+
+## Step 3/7. Configure identity source
+
+<Admonition type="warning">
+After this step, Teleport will become your Identity Center's identity provider.
+
+To avoid access interruptions, we recommend making sure that all existing
+Identity Center users have access to your Teleport cluster by, for example, using
+the same [IdP](../../../zero-trust-access/sso/sso.mdx) as your current Identity Center
+external identity source.
+</Admonition>
+
+In this step, you will configure Teleport as an SAML IdP for the AWS IAM Identity 
+Center. 
+
+You will also configure AWS IAM Identity Center as an SAML service provider in 
+Teleport.
+
+Follow the instructions to change your Identity Center's identity source to
+Teleport.
+
+![Configure identity source](../../../../img/identity-center/ic-step3.png)
+
+## Step 4/7. Enable SCIM
+
+The final step is to enable the SCIM endpoint in your Identity Center to
+allow Teleport to push user and group changes.
+
+![Enable SCIM](../../../../img/identity-center/ic-step4.png)
+
+Make sure to test SCIM connection after enabling it.
+
+## Step 5/7. Verify the integration
+
+Navigate to the Access Lists view page in your cluster and make sure that all
+your Identity Center groups have been imported.
+
+<Admonition type="note">
+It may take a few minutes for the initial sync to complete.
+</Admonition>
+
+![Access Lists view](../../../../img/identity-center/ic-lists.png)
+
+Imported Access Lists should show the same members as their corresponding
+Identity Center groups.
+
+## Step 6/7. Configure access
+
+You need two kinds of Teleport role permissions to access the AWS accounts:
+- A permission that allows access to the SAML service provider which logs you into the 
+  AWS Console. You configured this SAML service provider for the AWS IAM Identity Center
+  in Step 3.
+- A permission that allows access to the AWS account and permission set. 
+
+### Configure access to the SAML service provider
+
+First, we will configure an access to the SAML service provider that logs you 
+into the AWS Console.
+
+In the Teleport Web UI, from side navigation menu, select "Zero Trust Access > Roles".
+From the "Roles" UI, click "Create New Role" button. Switch to the YAML editor.
+![Teleport role editor YAML mode](../../../../img/igs/entraid/entra-teleport-role-yaml-editor.png)
+
+Copy the role spec shown below and paste it in the role editor to create a new role.
+```yaml
+kind: role
+version: v8
+metadata:
+  name: identity-center-access
+spec:
+  allow:
+    app_labels:
+      'teleport.dev/origin': 'aws-identity-center'
+```
+
+Notice that in the role spec above, the `app_labels` defines a `'teleport.dev/origin': 'aws-identity-center'`
+label. This is the default resource label which Teleport assigns to the SAML service 
+provider resource created for the AWS IAM Identity Center. 
+
+Grant this role to the users so they can log in to the AWS Console. Note that users
+still needs access to the AWS account and permission set, which is explained below. 
+
+### Configure access to the AWS account and permission set
+
+Once you ensure that users have access to the SAML service provider created for the 
+AWS IAM Identity Center, the next step is to grant permission to the 
+AWS accounts and permission sets.
+
+When the Teleport AWS IAM Identity Center integration service is run for the first time, 
+Teleport preserves the current state of the group-based account and permission set
+assignments that exists in your AWS IAM Identity Center instance. If a user has 
+had an access to an AWS account based on their membership to a group, they will 
+continue to have that access.
+
+If you want to configure a new sets of AWS account access for a user, you will 
+have to grant them an account assignment role. An account assignment role defines 
+an `account_assignment` rule that binds an AWS account with the AWS permission set. 
+
+Teleport creates an account assignment role for each of the cartesian product of 
+the AWS account and a permission set which is available in your AWS IAM Identity 
+Center instance. These roles have the following role name format: 
+`<permission-set-name>-on-<account-name>-<account-id>` (e.g. `AdministratorAccess-on-MyAccount-012345678`).
+
+You may use these auto-generated roles, or create an entirely new role that defines
+an `account_assignment` rule. Below is an example of such a role, which allows
+access to the two different AWS accounts and permission sets.
+
+```yaml
+kind: role
+version: v8
+metadata:
+  name: identity-center-access
+spec:
+  allow:
+    app_labels:
+      'teleport.dev/origin': 'aws-identity-center'
+    account_assignments:
+    - account: "<account_id>" # AWS identity center account ID
+      # permission set ARN of AdministratorAccess
+      permission_set: arn:aws:sso:::permissionSet/ssoins-1234/ps-5678
+    - account: "<account_id>"
+      # permission set ARN of ReadOnlyAccess
+      permission_set: arn:aws:sso:::permissionSet/ssoins-1234/ps-8765 
+```
+
+This role can then be granted to the users either by a direct assignment, 
+Access List role grants or by using the Access Request workflow.
+
+## Step 7/7. Connect to AWS
+
+Once the integration is up and running, and you have the required permissions,
+you will see an application named `aws-identity-center` among your resources:
+
+![Connect to AWS SSO portal](../../../../img/identity-center/ic-app.png)
+
+Clicking the "Log In" button for this app takes you to your Identity Center
+SSO start page which you can use to pick a role and connect to your AWS account
+as usual.
+
+## Usage scenarios
+
+Let's take a look at some common usage scenarios enabled by the Identity Center
+integration.
+
+### Managing Account Assignments with Access Lists
+
+Teleport creates an Access List for each group imported from the Identity Center
+instance, with group members becoming Access List members. Default Access List 
+owners are configured during the initial integration enrollment flow and can be
+adjusted as necessary after the initial sync completes.
+
+Each imported Access List is automatically assigned a role (or a set of roles)
+that grant all members of that list access to all of the Account Assignments
+assigned to the corresponding AWS Identity Center group during the integration
+setup. 
+
+These Teleport-generated roles each represent a single Account Assignment, and
+are named using `<permission-set-name>-on-<account-name>-<account-id>` convention
+(e.g. `AdministratorAccess-on-MyAccount-012345678`). 
+
+<Admonition type="warning">
+These roles are considered system roles, and any edits or updates to them will
+be automatically reverted. 
+</Admonition>
+
+To give a user permission granted by an already-existing Identity Center synced
+Access List, an owner can add that user as a member which makes Teleport to add
+the user to its corresponding Identity Center group.
+
+<Admonition type="warning">
+Currently all existing Teleport users are synced to Identity Center. Label-based
+user filtering will be supported in a later release.
+</Admonition>
+
+Removing a member from an Identity Center synced Access List removes them
+from the corresponding Identity Center group effectively revoking privileges.
+
+In addition to membership changes, Teleport propagates changes in Access List
+grants back to Identity Center as well. For example, imagine an Access List with
+the roles `AdminAccess-on-my-account` and `ReadOnlyAccess-on-my-account`. If the
+Access List owner removes the `AdminAccess-on-my-account` role from the Access Lists,
+that change will be propagated back to AWS and the corresponding Identity Center
+group will have its assignments updated to remove the `AdminAccess` Permission 
+
+### Just-in-time Access with Resource Access Requests
+
+Teleport represents the imported AWS accounts as apps in the Teleport Resource
+View, with the permission sets available for each account bundled up inside the
+app. AWS accounts are treated the same as any other Teleport-managed resource, 
+so users can see what AWS permission sets they are allowed to request just by
+checking "Show requestable resources" in the resource view. 
+
+Users can then choose the specific Account Assignments they want access to by 
+selecting from the Permission Sets available to each AWS Account. Users
+can mix Permission Sets from multiple AWS Accounts, and even include other 
+Teleport-managed resources if necessary.
+
+![Selecting Identity Center resources](../../../../img/identity-center/ic-select-ps.png)
+
+Once the used has selected their desired Account Assignments, the Access Request
+submission and review process is the same as for any other Teleport-managed
+resource. Assuming the Access Request is approved, Teleport will create the
+appropriate AWS Account Assignments in Identity Center to grant the requested
+access. These AWS Account Assignments will automatically be deleted when the
+Access Request expires.
+
+The user can access their temporary AWS Accounts and Roles from within Teleport
+by assuming the Access Request roles. 
+
+![Assumed Role granting Identity Center Account Assignments](../../../../img/identity-center/ic-role-assumed.png)
+
+<Admonition type="warning">
+The AWS Account Assignments will exist for the lifetime of the Access Request,
+regardless of when the user assumes the associated role(s).
+</Admonition>
+
+### Just-in-time access with role Access Requests
+
+The Identity Center integration allows Teleport users to submit Access Requests for short-term privilege elevation.
+
+When an Access Request for a role granting Identity Center privileges is
+approved, Teleport creates an individual assignment for that user in the
+Identity Center. The assignment is deleted when the Access Request expires.
+
+### Long-term access with Access Requests
+
+If a user requests access to Account Assignments that can also be granted via an
+existing Access List, Teleport will offer the reviewer the option of *promoting*
+the Access Request to long-term access.
+
+![Promoting Access Request](../../../../img/identity-center/ic-promote.png)
+
+When an Access Request is promoted to long-term access, the requesting user is
+added to the targeted Access List. This membership change is propagated to the
+corresponding Identity Center group, and the user is then granted their requested
+Account Assignments via group membership.
+
+## FAQ
+
+### Which Access Lists are synced to Identity Center?
+
+Teleport syncs all Access Lists that have AWS account and permission set rules
+among their role grants to Identity Center.
+
+### How does it work with nested Access Lists?
+
+Identity Center does not support nested groups. As such, Teleport recursively 
+flattens any [nested Access Lists](../../access-lists/nested-access-lists.mdx)
+into a single Identity Center group containing all members reachable from the 
+top-level Access List.
+
+The flattened Identity Center group will be kept updated as members are added to
+or removed from nested 
+
+### How do I uninstall the integration?
+
+<Admonition type="warning">
+Before fully removing the integration, make sure to remember to change the
+identity source in your Identity Center instance.
+</Admonition>
+
+Deleting the integration automatically removes all Teleport resources it used to manage its state, including:
+
+- Teleport roles created for AWS Identity Center account assignments.
+- Access Lists imported from AWS Identity Center groups.
+
+However, user-created resources remain intact, including:
+
+- Access Lists you created.
+- Roles you manually configured for account assignments.
+
+If an Access List grants permissions to a now-deleted integration role, or if a user
+has a deleted role assigned directly, you must manually remove those references.
+
+If you decide not to switch to Teleport, you can delete the Identity Center integration in two ways.
+
+You can remove the integration by navigating to your cluster's Integrations
+list and deleting both the integration named `AWS IAM Identity Center`. The AWS
+OIDC integration that was created during the first enrollment step will be
+automatically removed as well once the plugin is uninstalled.
+
+To clean up AWS resources created for the integration, remove the Identity
+Provider and its role from your AWS IAM console as well.
+
+## Troubleshooting
+
+### Access forbidden during AWS account login
+
+This may happen if the user does not have access to the SAML IdP service provider 
+resource created for the AWS IAM Identity Center. 
+
+First, check the SAML IdP audit event which can be found in the Teleport Audit Log UI. 
+
+![Assumed Role granting Identity Center Account Assignments](../../../../img/identity-center/ic-saml-login-audit-log.png)
+
+More detail on the error message can be found by clicking on the "Details" button.
+
+Example of a failed login audit log due to missing permission:
+```
+{
+  "cluster_name": "example.teleport.sh",
+  "code": "TSI000I",
+  "ei": 0,
+  "error": "access to saml_idp_service_provider denied. User does not have permissions. ",
+  "event": "saml.idp.auth",
+  "service_provider_entity_id": "https://ca-central-1.signin.aws.amazon.com/platform/saml/d-xxxxxx",
+  "sid": "",
+  "success": false,
+  "time": "2025-09-03T04:36:40.123Z",
+  "uid": "7523b6cc-313e-4f56-9f58-3f1b91075c4d",
+  "user": "example-user"
+}
+```
+
+To resolve RBAC errors, first, identify what roles are assigned to the user. 
+
+If the user has been assigned with a Teleport role of version 8, 
+the role must define `app_labels` matching the `teleport.dev/origin: aws-identity-center`
+label.
+
+```yaml
+kind: role
+version: v8
+metadata:
+  name: ic-access-example
+spec:
+  allow:
+    app_labels:
+      'teleport.dev/origin': 'aws-identity-center'
+```
+
+If the role requires Device Trust, the user must have a device authenticated 
+Teleport web session.
+
+If the role requires a session MFA, the user must authorize the login flow with MFA.
+
+If the user is assigned with a Teleport role version 7 or below, 
+check if the IdP role option is not disabled: 
+```yaml
+kind: role
+version: v7
+metadata:
+  name: ic-access-example
+spec:
+  options:
+    idp:
+      saml:
+        enabled: true # idp must be enabled.
+```
+
+
+## Next steps
+
+- Take a deeper dive into fundamental Teleport concepts used in Identity Center
+  integration such as
+  [RBAC](../../../zero-trust-access/authentication/authentication.mdx),
+  [JIT Access Requests](../../access-requests/access-requests.mdx),
+  [Access Lists](../../access-lists/access-lists.mdx)
+  and the [Teleport SAML IdP](../../idps/idps.mdx).
+- Learn how to enable the [Okta integration](../okta/okta.mdx)
+  to sync apps, users and groups from Okta in conjunction with Identity Center
+  integration.
diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/maintenance.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/maintenance.mdx
new file mode 100644
index 0000000000000..86b13663f5b76
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/maintenance.mdx
@@ -0,0 +1,53 @@
+---
+title: Rotating the AWS IAM Identity Center SCIM token
+sidebar_label: SCIM Token Rotation
+description: How to update the AWS IAM Identity Center SCIM token in Teleport
+tags:
+ - identity-governance
+ - how-to
+ - aws
+enterprise: Identity Governance
+---
+
+This guide will show you how to rotate the SCIM bearer token in Teleport using `tctl`. 
+
+## How it works
+
+Teleport provisions AWS users and groups into AWS IAM Identity Center via 
+[SCIM](https://scim.org/). The Teleport SCIM client authenticates itself to AWS 
+IAM Identity Center using a bearer token. By their nature bearer tokens need to be 
+rotated occasionally to maintain security.
+
+## Generating the token
+
+You can generate the new SCIM bearer token by following the AWS IAM Identity Center
+[Rotate an access token](https://docs.aws.amazon.com/singlesignon/latest/userguide/rotate-token.html)
+user guide.
+
+Be sure to capture the token value displayed at the end of the AWS token creation
+flow, as AWS will not display it again.
+
+## Rotating the token
+
+<Admonition type="warning">
+This functionality is only available in `tctl` and cannot yet be done in the Teleport UI.
+</Admonition>
+
+```shell
+$ tctl plugins rotate awsic ${TOKEN}
+```
+
+Once the SCIM token is updated Teleport will check to see if the actual token
+value has changed. If so, Teleport will automatically restart the Identity Center
+integration for it to pick up and use the new token.
+
+## Disabling token validation
+
+By default, `tctl` will validate that the supplied token can be used to successfully
+authenticate with the configured SCIM service. If, for example, the target SCIM
+is unavailable and you want to force the token rotation you can disable the token
+validation with the `--no-validate-token` flag. 
+
+```shell
+$ tctl plugins rotate awsic --no-validate-token ${TOKEN}
+```
diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx
new file mode 100644
index 0000000000000..8c286aa9475eb
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx
@@ -0,0 +1,482 @@
+---
+title: Migrating AWS IAM Identity Center from Okta to Teleport
+sidebar_label: Okta to Teleport Migration
+description: Explains how to migrate an Identity Center instance from Okta control to Teleport control.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+ - aws
+enterprise: Identity Governance
+---
+
+This guide describes how to introduce Teleport into an existing Okta-managed AWS
+IAM Identity Center configuration. It specifically describes two scenarios: one where 
+Teleport shares control of your Identity Center managed resources in conjunction
+with Okta, and another where Teleport replaces Okta as the Identity Center SSO
+Provider and user provisioner
+
+## How it works
+
+You can introduce Teleport into an existing Okta-managed AWS IAM Identity Center
+instance in one of two ways:
+- **Partial hand-off** (also called _Hybrid mode_): Keep Okta as the User provisioner
+and SSO provider for the AWS IAM Identity Center instance, but delegate account
+assignment and (some) Identity Center group provisioning to Teleport, or
+- **Full hand-off**: Fully transfer the control of AWS IAM Identity Center from
+Okta to Teleport, including user provisioning, group provisioning, account assignment provisioning and SAML SSO.
+
+For simplicity, we recommend full hand-off. 
+
+In both cases, the AWS IAM Identity Center SCIM bearer token must be shared with
+Teleport, as Teleport uses SCIM even in Partial hand-off mode to provision Identity
+Center groups and manage Group membership.
+
+## Prerequisites
+
+- A Teleport cluster.
+- An AWS role configured as per the [AWS IAM Identity Center guide](./guide.mdx#step-17-configure-aws-integration)
+  for the integration to use.
+- AWS credentials configured for the Teleport Auth Service to pick up and use
+  (e.g. as environment vars, system profiles, etc).
+- An Okta API token, with the following privileges:
+  - View users and their details.
+  - View groups and their details.
+  - View applications and their details.
+- The AWS IAM Identity Center ARN, AWS region, SCIM base address and SCIM bearer token.
+
+## Partial hand-off (Hybrid setup)
+
+We will start by setting up Teleport, Okta and Identity Center in a Partial hand-off
+configuration, covering
+- integrating Okta and Teleport, ensuring that all users Okta users provisioned 
+  into Identity Center are also provisioned into Teleport,
+- configuring Teleport to manage groups and account assignments in Identity Center
+- setting up Teleport group import rules so that Identity Center groups managed
+  by Okta are not overridden by Teleport.
+
+Once this initial setup is complete you can either run in Partial hand-off mode indefinitely, or
+use the Partial hand-off configuration as a stepping stone towards a full hand-off integration.
+
+<Admonition type="warning" title="Teleport will not disable locked or deactivated Teleport users in AWS">
+Given the nature of a Partial hand-off configuration it is trivial for the external
+IdP (in this case, Okta) to re-activate an AWS user deactivated by Teleport, without
+Teleport being aware of it.
+
+To avoid confusion, when in a Partial hand-off configuration Teleport assumes that
+_all_ user-related provisioning will be managed by the external IdP, including
+deactivating and re-activating users as necessary. Teleport will **not** propagate
+Teleport user locks to Identity Center users, nor strip an Identity Center user's 
+account assignments or group memberships in response to a Teleport lock.
+
+To prevent a deactivated user accessing AWS resources, they need to be forbidden
+from logging in to AWS via the external IdP SSO provider.
+</Admonition>
+
+<Admonition type="tip" title="Note">
+  If you already have an Okta integration set up in Teleport, can ensure that users and groups 
+  that exist in AWS IAM Identity Center are already synced to Teleport, and want Teleport to fully 
+  control AWS IAM Identity Center, you can switch to Teleport right away, without the need for migration. 
+
+  See [Getting Started with AWS IAM Identity Center integration](./guide.mdx).
+</Admonition>
+
+### Starting Point
+
+This is our starting configuration: Okta as sole Identity Source for Identity Center.
+
+![Migration Starting Point](../../../../img/identity-center/ic-migrate-start.png)
+
+### Destination
+
+At this point Okta remains in control of User provisioning and SSO, while 
+Teleport controls Identity Center groups and account assignments. 
+
+![Partial Hand-Off configuration](../../../../img/identity-center/ic-migrate-mid.png)
+
+Specifically:
+ - Okta provides SSO login for Identity Center.
+ - Okta manages a subset of the Identity Center group membership (selected via Push Groups in Okta).
+ - Okta controls user provisioning via SCIM.
+ - Teleport manages a second subset of Identity Center groups (selected via group filters during plugin installation).
+ - Teleport controls Identity Center group account assignments for the Identity Center groups under its control.
+ - Teleport controls direct Identity Center user account assignments for the Identity Center users under its control.
+
+### Step 1/6. Install Okta SAML connector
+
+Install Okta SAML connector into Teleport as per the Teleport
+[Okta as an SSO provider](../../../zero-trust-access/sso/integrate-idp/okta.mdx) guide.
+
+<Admonition type="note">
+ For the integration to function properly, both AWS IAM Identity Center and Teleport must view the
+ same user set which can be achieved by using the same Okta SAML application for both Identity
+ Center and Teleport SAML connector.
+
+ If this is not possible, the most flexible approach we've found is having an
+ an Okta Group for those users that should have Identity Center access, and then assigning
+ both the Okta Identity Center App and the Okta SAML App used for Teleport SAML
+ connector to that group. This ensures that the same user set is visible across
+ both applications.
+</Admonition>
+
+You will need the Teleport SAML Connector Name and Okta SAML App ID in the next
+step.
+
+### Step 2/6. Install the Teleport Okta integration
+
+We will be using a very limited subset of the Teleport Okta integration in this
+deployment, disabling all features except periodic user synchronization. This
+configuration is not currently supported by the normal installation UI, so we
+will have to use `tctl` to install it:
+
+```console
+$ tctl plugins install okta \
+    --org ${OKTA_ORG_URL} \
+    --saml-connector ${TELEPORT_SAML_CONNECTOR_NAME} \
+    --app-id ${OKTA_SAML_APP_ID} \
+    --api-token ${OKTA_API_TOKEN} \
+    --no-scim \
+    --no-accesslist-sync \
+    --no-appgroup-sync
+```
+
+This will install the Okta integration and start the user sync service with a
+configuration that:
+- Imports Okta users assigned to the Okta App `${OKTA_SAML_APP_ID}`, and keeps
+  them synced with the upstream Okta organization.
+- Does *not* expose a SCIM service.
+- Does *not* attempt to sync or manage any other resources from Okta.
+
+You can monitor the state of the Okta integration in the Teleport Integrations UI.
+
+### Step 3/6. Wait for user sync
+
+To make sure everything is working, wait until the first Okta to Teleport user
+sync has occurred. You can verify this by either
+ - Refreshing the user page and finding your Okta users, or
+ - Checking the Okta integration status page.
+
+Once your Okta users are imported into Teleport, you can progress to the next
+step.
+
+### Step 4/6. Install the Teleport AWS IAM Identity Center integration
+
+Again, we need to install the plugin using `tctl`.
+
+```console
+$ tctl plugins install awsic \
+    --instance-arn ${IDENTITY_CENTER_INSTANCE_ARN} \
+    --instance-region ${IDENTITY_CENTER_INSTANCE_REGION} \
+    --use-system-credentials \
+    --assume-role-arn ${AWS_IAM_ROLE_ARN} \
+    --scim-url ${IDENTITY_CENTER_SCIM_BASE_URL} \
+    --scim-token ${IDENTITY_CENTER_SCIM_BEARER_TOKEN} \
+    --access-list-default-owner ${TELEPORT_ACCESS_LIST_DEFAULT_OWNER} \
+    --user-origin okta \
+    --account-name ${ACCOUNT_NAME_ALLOW_FILTER} \
+    --group-name ${GROUP_NAME_ALLOW_FILTER}
+```
+
+This will install the Teleport AWS IAM Identity Center integration with a
+Teleport configuration that:
+- Controls the AWS IAM Identity Center instance indicated by `--instance-arn`.
+- Uses the system AWS credentials to authenticate with AWS (from `--use-system-credentials`)
+  and assumes the IAM role indicated by `--assume-role-arn`.
+- Manages account assignments all AWS accounts that match the `${ACCOUNT_NAME_ALLOW_FILTER}`.
+- Provisions all users imported from Okta into AWS IAM Identity Center (from the `--user-origin okta` flag).
+- Only imports all groups matching `${GROUP_NAME_ALLOW_FILTER}` into Teleport as Access
+  Lists, with `${TELEPORT_ACCESS_LIST_DEFAULT_OWNER}` as the owner.
+
+<Admonition type="note">
+Note that the `tctl` installer currently only supports installations using
+system-level AWS credentials with `--use-system-credentials`.
+
+Using system-level credential is also the recommended way to provide AWS credential when
+configuring integration in the Teleport Enterprise self-hosted deployment.
+</Admonition>
+
+You can change the AWS account, group and user filters later by following the
+instructions in the [Extending the Integration](#extending-the-integration) section
+below.
+
+During the installation process, Teleport will import all of the Identity Center
+groups that match its allow list (or all of them, if no allow list is defined)
+and create matching Access Lists, preserving the group membership and account
+assignments.
+
+For more installation options, such as disabling the creation of Teleport Roles
+for each Account Assignments, see the [Advanced Options](./advanced-options.mdx) guide.
+
+<Admonition type="warning">
+Individual user account assignments will ***not*** be preserved during import. You
+will need to ensure these are preserved manually, or converted to group assignments
+prior to installation.
+</Admonition>
+
+#### Group import control
+
+The Group import allow list is controlled by the `--group-name` option. You can
+specify multiple filters and a Group will be imported if matches _any_ of the
+supplied filters. Filters can be either literal names, globbed names or Go
+compatible regular expressions. To treat a filter as a regular expression,
+enclose it in a leading `^` and trailing `$`.
+
+Example filters:
+ - `administrators`: The literal "administrators" group
+ - `site-*`: Any group with the prefix `site-`
+ - `^(?:[^a]|a[^w]|aw[^s]|aws[^\-]).*$`: Any group that does ***not*** have the prefix `aws-`
+
+Ensure that there is no overlap between the groups imported to Teleport and the
+groups you want Okta to maintain control over.
+
+<Admonition type="warning">
+Avoid creating an Access List with the same name as a Push Group managed by Okta.
+Teleport will attempt to adopt the group, and may change the group membership.
+Deleting the Teleport Access List and forcing a re-push from Okta should restore
+access.
+</Admonition>
+
+#### User provisioning control
+
+Your Teleport cluster may have a mix of local Teleport users (e.g. a local Admin
+user) and users imported from Okta. By default, Teleport will try to provision
+_all_ Teleport users into Identity Center. You can control which users are
+provisioned by the Identity Center integration with the `--user-origin` and
+`--user-filter` arguments. In the example above, the `--user-origin okta` will
+restrict Teleport to only provisioning users that are synced from Okta, and
+excluding all local Teleport users.
+
+#### AWS account import control
+
+By default, Teleport will take control of account assignments for all AWS Accounts
+managed by Identity Center. You can create an allow-list of AWS Accounts to
+import with the  `--account-name` and `--account-id` install options.
+
+The `--account-name` filters work like the `--group-name` filters above. The
+`--account-id` filters specify a literal AWS Account ID.
+
+Teleport will not create or delete account assignments on AWS accounts outside
+of its allow-list.
+
+### Step 5/6. Migrate AWS account
+
+We have now configured the Teleport Identity Center integration in partial hand-off
+mode, and ready to migrate account assignments from Okta-managed groups into new
+Teleport-managed Access Lists. To migrate groups, create a new Access List in 
+Teleport (taking care _not_ to use the same name as the existing Okta-managed Group) 
+and create the appropriate memberships and account assignments.
+
+Account assignments can be created on an Access List by assigning it the Account
+Assignment roles created by the Identity Center integration, assigning it a
+custom Teleport role that specifies a specific combination of access, or a
+combination of each.
+
+For more information, see the [Identity Center integration guide](./guide.mdx).
+
+### Step 6/6. Retire Okta group provisioning
+
+Once you are satisfied that an AWS IAM Identity Center group has been migrated to 
+Teleport control, you can remove the corresponding push Group from the Okta
+Identity Center integration.
+
+## Full hand-off
+
+Teleport, Okta and Identity Center are now running in partial hand-off mode. It is
+perfectly fine to continue running Teleport this way indefinitely, but you can also
+use the Partial hand-off configuration as a stepping stone towards a full
+hand-off integration. 
+
+Moving from Partial- to Full hand-off fully transfers control of AWS users and
+groups to Teleport, including SSO login.
+
+![Full hand-off configuration](../../../../img/identity-center/ic-migrate-end.png)
+
+<Admonition type="note">
+Teleport generally has much less information about users than Okta, so when Teleport
+takes over user provisioning from Okta it may strip user attributes from your
+Identity Center users.
+
+Please ensure that your AWS security policies do not rely on any user attributes
+beyond the username and ID.
+</Admonition>
+
+### Step 1/4. Create a Teleport SAML IdP Service Provider
+
+To operate in Full hand-off mode Teleport needs to be the Identity Source for
+your AWS Identity Center instance by providing SAML authentication for your users.
+To do this we need to create a Teleport SAML Service Provider configured for your
+Identity Center instance.
+
+#### Obtain the Identity Center SAML Metadata
+
+You can get the Identity Center SAML metadata file from AWS by following the AWS 
+[How To Connect to an External Identity Provider](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-connect-idp.html)
+guide. Once you have the metadata file you will need to pause configuring AWS
+and switch back to Teleport.
+
+#### Create the Teleport SAML Service Provider
+
+Create a SAML Service Provider in Teleport following the (Using Teleport as a SAML
+Identity Provider)[../idps/saml-guide.mdx] guide. Use the Identity Center SAML
+Metadata file from the previous step to provide the Identity Center metadata to
+Teleport.
+
+While creating the Teleport SAML service provider, download the Teleport IdP metadata
+when offered. You will need this to finish configuring the Identity Source in
+Identity Center.
+
+### Step 2/4. Configure Identity Center to use Teleport as its Identity Source
+
+Once you have created the Teleport SAML Service Provider you can finish configuring 
+the new Identity Center Identity Source. Continue following the AWS [How To Connect to an External Identity Provider](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-connect-idp.html)
+guide, uploading the Teleport IdP Metadata file when prompted. 
+
+### Step 3/4. Switch Teleport to Full hand-off Mode
+
+Teleport uses the absence of a SAML service provider name in the Identity Center
+configuration to trigger running in Partial hand-off mode. To switch Teleport to
+Full hand-off mode we need to link the Identity Center integration and the 
+SAML Service Provider created in the previous step.
+
+This can currently only be done by manually editing the integration configuration
+with `tctl`.
+
+<Admonition type="warning">
+Manually editing the Identity Center's plugin resource using `tctl` is a
+dangerous operation. Please ensure you take a backup of the plugin resource in
+order to roll back if necessary.
+
+A guided editing workflow is currently under development.
+</Admonition>
+
+The plugin resource is a YAML document describing the Identity Center integration 
+configuration. Running `tctl edit` will fetch the resource and open it your
+configured editor, for example:
+
+```console
+$ tctl edit plugins/aws-identity-center
+```
+
+To enable Full hand-off mode, set the `saml_idp_service_provider_name` field in
+the `aws_ic` block to the name of the SAML Service Provider created in (Step 1)[#step-14-create-a-teleport-saml-idp-service-provider] above. 
+
+```YAML
+kind: plugin
+version: v1
+metadata:
+  labels:
+    teleport.dev/hosted-plugin: "true"
+  name: aws-identity-center
+spec:
+  Settings:
+    aws_ic:
+      arn: arn:aws:sso:::instance/ssoins-722326ecc902a06a
+      access_list_default_owners:
+        - admin
+      credentials:
+        system:
+          assumeRoleArn: arn:aws:iam::637423191929:role/idc-integration
+      provisioning_spec:
+        base_url: https://scim.us-east-1.amazonaws.com/f3v9c6bc2ca-b104-4571-b669-f2eba522efe8/scim/v2
+      region: us-east-1
+
+      # add or edit this to match your SAML Service Provider name
+      saml_idp_service_provider_name: aws-identity-center-sso
+```
+
+Saving and closing the resource editor will update the Identity Center config and
+restart the Identity Center integration in Full Hand-Off mode. 
+
+### Step 4/4. Retire Okta Identity Center integration
+
+Once Teleport has full control over provisioning into Identity Center, you can
+deactivate the Identity Center integration in Okta. Leaving the Okta Identity
+Center integration in place will cause Teleport and Okta to both try and control
+the user information 
+
+## Extending the integration 
+
+You can add or remove filters to the various filter sets with `tctl edit`. 
+
+<Admonition type="warning">
+This currently involves manually editing the Identity Center Integration's plugin
+resource using `tctl`, which is a dangerous operation. Please ensure you take a
+backup of the plugin resource in order to roll back if necessary.
+
+A guided editing workflow is currently under development.
+</Admonition>
+
+```
+$ tctl edit plugins/aws-identity-center
+```
+
+Once you save and quit the editor, `tctl` will replace the existing resource
+with your updated version. This will automatically restart the Identity Center
+Integration with the new filters.
+
+```YAML
+kind: plugin
+version: v1
+metadata:
+  labels:
+    teleport.dev/hosted-plugin: "true"
+  name: aws-identity-center
+spec:
+  Settings:
+    aws_ic:
+      arn: arn:aws:sso:::instance/ssoins-722326ecc902a06a
+      access_list_default_owners:
+        - admin
+      credentials:
+        system:
+          assumeRoleArn: arn:aws:iam::637423191929:role/idc-integration
+      provisioning_spec:
+        base_url: https://scim.us-east-1.amazonaws.com/f3v9c6bc2ca-b104-4571-b669-f2eba522efe8/scim/v2
+      region: us-east-1
+
+      # Account import filters. An absent or empty list of filters implies 
+      # "manage all AWS accounts"      
+      aws_accounts_filters:
+      - Include:
+          id: "058264527036"
+      - Include:
+          name_regex: ^Staging-.*$
+
+      # User provisioning filters. An absent or empty list of filters implies 
+      # "provision all users to AWS"
+      user_sync_filters:
+      - labels:
+          teleport.dev/origin: okta
+
+      # Group import filters, as per the "Group import control" section above
+      group_sync_filters:
+      - Include:
+          name_regex: '^Group #00\d+$'
+```
+
+Saving the updated resource and quitting the editor will update the remote
+configuration and restart the Identity Center integration with the new settings.
+
+Any change to the `group_sync_filters` field will also trigger a new group import
+cycle, which may be time consuming for Identity Center instances with lots of
+users and groups.
+
+## Deleting the AWS IAM Identity Center integration
+
+Deleting the integration automatically removes all Teleport resources it used to manage its state.
+
+The impact of plugin deletion and general consideration is explained in the [AWS IAM Identity Center guide](./guide.mdx#how-do-i-uninstall-the-integration).
+
+Delete AWS IAM Identity Center plugin with `tctl`.
+
+```
+$ tctl plugins delete aws-identity-center
+```
+## Next Steps
+
+- Take a deeper dive into fundamental Teleport concepts used in Identity Center
+  integration such as
+  [RBAC](../../../zero-trust-access/authentication/authentication.mdx),
+  [JIT Access Requests](../../access-requests/access-requests.mdx) and 
+  [Access Lists](../../access-lists/access-lists.mdx).
+- See how to [use Teleport-managed account assignments with the AWS command-line tools](./using-aws-cli.mdx). 
diff --git a/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx b/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx
new file mode 100644
index 0000000000000..1e256c1d0d15a
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/aws-iam-identity-center/using-aws-cli.mdx
@@ -0,0 +1,213 @@
+---
+title: Using the AWS CLI tools with Teleport and AWS IAM Identity Center
+sidebar_label: AWS CLI Access
+description: Explains how to use the AWS IAM Identity Center integration to protect AWS CLI tools with Teleport.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+ - aws
+enterprise: Identity Governance
+---
+
+This guide will show you how to configure the `aws` command-line tool to use
+access granted via Teleport and AWS Identity Center.
+
+## How it works
+
+For a deep dive into how Teleport manages AWS Identity Center access works you can
+read the main [AWS IAM Identity Center guide](./aws-iam-identity-center.mdx). For the 
+purposes of this guide, it's enough to understand that Teleport manages the creation
+and deletion of AWS Account Assignments based on a users's Account Assignment grants,
+either from their standing Teleport Roles, Access List membership or approved
+Access Requests. 
+
+You can access these Teleport-managed Accounts and Permission Set assignments
+with the AWS CLI tools by using `sso` login and AWS profiles.
+
+## Prerequisites
+
+Before you begin, you will need:
+
+ * A Teleport-managed AWS Identity Center organization. See our [getting started guide](./guide.mdx)
+   for setting up an Identity Center integration.
+ * The AWS CLI tools, installed as per the AWS [installation guide](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)
+ * The SSO Start URL and AWS Region for your Identity Center organization. Ask your AWS administrator for the appropriate values.
+
+## Step 1/2. Configure the AWS SSO Session
+
+This step configures the AWS CLI tools to use SSO for authentication. You can
+either configure this manually, or via the `aws configure sso-session` wizard.
+
+<Tabs>
+<TabItem label="Wizard">
+Invoke the AWS SSO configuration wizard by running the following command and
+answering the questions asked by the wizard.  
+
+```shell
+$ aws configure sso-session
+```
+
+You will need to pick a name for the SSO session; this is just a local name for
+this particular SSO configuration. For this example we are using `my-identity-center`. 
+
+```shell
+$ aws configure sso-session
+SSO session name: my-identity-center
+SSO start URL [None]: https://d-12234567890.awsapps.com/start
+SSO region [None]: us-east-1
+SSO registration scopes [sso:account:access]:
+```
+</TabItem>
+<TabItem label="Manual Configuration">
+You can configure SSO authentication manually by editing your `.aws/config` file. The above example would look like this:
+
+```ini
+[sso-session my-identity-center]
+sso_start_url = https://d-12234567890.awsapps.com/start
+sso_region = us-east-1
+sso_registration_scopes = sso:account:access
+```
+</TabItem>
+</Tabs>
+
+### Testing the SSO Session
+
+To test the SSO configuration, try logging into AWS via SSO.
+
+```shell
+$ aws sso login --sso-session my-identity-center
+```
+
+This will launch a browser-based flow that will log you into AWS via Teleport
+and ask you confirm the AWS CLI tool's access to AWS using your account.
+
+## Step 2/2. Creating AWS Profiles
+
+You will need to create a separate AWS CLI profile for each AWS Account and Permission Set
+you want to access. These profiles will reference the SSO Session created above,
+which tells the AWS tools to use SSO authentication when the profile is active.
+
+Again you can do this either via an `aws configure` wizard, or editing your `/.aws/config` file directly.
+
+<Admonition type="tip">
+You can create as many profiles as you like, so repeat this step for as many AWS
+Account / Permission Set pairs that you need.
+</Admonition>
+
+<Tabs>
+<TabItem label="Wizard">
+To create a profile that uses given SSO session, invoke the SSO configuration 
+wizard with the following commands, and answering the questions it asks:
+
+```shell
+$ aws configure sso
+```
+
+The wizard asks several questions about the profile to create, but for our
+purposes, only selecting the AWS Account and Role are important. 
+
+Firstly, select the AWS account this profile will use. The wizard will offer you
+a list of available AWS accounts based on your current Account Assignments, if
+you are only permitted to use a single AWS account, the wizard automatically
+picks that and skips the question.
+
+```shell
+There are 2 AWS accounts available to you.
+> Staging, my.login@example.com (058264527036)
+  Production, my.login@example.com (637423191929)
+```
+
+Next, select the AWS Role to assume when this profile is active. Identity Center
+Permission Sets are provisioned onto AWS accounts as Roles, so select the role
+with the same name as the Permission Set you want to use.
+
+```shell
+There are 3 roles available to you.
+  SecurityAudit
+> AdministratorAccess
+  PowerUserAccess
+```
+
+Again, if only one option is available the wizard will automatically select that
+and skip the question.
+
+After several generic AWS profile questions (e.g. default AWS region, default
+output format, etc), the wizard will ask for the profile name. For this example,
+given that the profile will use the `AdminAccess` role on the `Staging` account
+we will call it `admin-on-staging`.
+</TabItem>
+<TabItem label="Manual Configuration">
+While helpful, the `aws configure sso` wizard requires currently-assigned Accounts
+and Permission Sets to work with. You can pre-configure an AWS profile to use
+Account Assignments that you currently do not have access to by editing your 
+`~/.aws/config` file and adding the profile directly.
+
+For example, the `admin-on-staging` profile we created above looks like this:
+
+```ini
+[profile admin-on-staging]
+sso_session = my-identity-center
+sso_account_id = 058264527036
+sso_role_name = AdministratorAccess
+region = us-east-1
+```
+</TabItem>
+</Tabs>
+
+### Testing the profile
+
+You can test the profile by running `aws sts get-caller-identity` and verifying
+the returned user ID and assumed Role. For example:
+
+```shell
+$ aws sts get-caller-identity --profile admin-on-staging
+{
+    "UserId": "AROA123456789AEXAMPLE:my.login@example.com",
+    "Account": "058264527036",
+    "Arn": "arn:aws:sts::058264527036:assumed-role/AWSReservedSSO_AdministratorAccess_69450ffeac834ef7/my.login@example.com"
+}
+```
+
+Once you have validate that the profile is configured correctly, you can use the
+`--profile` argument in any `aws` subcommand select it and use the corresponding
+Identity Center Account assignment in that operation.
+
+<Admonition type="info">
+You can also use this profile with other tools that support the standard AWS client
+environment variables. Set the profile by setting the `AWS_PROFILE` environment
+variable. For example:
+
+
+```shell
+$ AWS_PROFILE=admin-on-staging ./some-aws-tool
+```
+</Admonition>
+
+## Troubleshooting 
+
+### "Invalid Callback" error
+
+If AWS presents you with an "invalid Callback URL" error message, the most likely 
+problem is an incorrect AWS region in your `sso-session` configuration. 
+
+### "Error loading SSO Token" error
+
+The AWS cache directory has probably been deleted. Log in again with `aws sso login --sso-session ${SSO_SESSION_NAME}`, 
+where `${SSO_SESSION_NAME}` is the name of your configured SSO session.
+
+## Next Steps
+
+- Learn how to request [Just-in-Time access to an Account Assignment](./guide.mdx#just-in-time-access-with-resource-access-requests).
+- Take a deeper dive into fundamental Teleport concepts used in Identity Center
+  integration such as [RBAC](../../../zero-trust-access/authentication/authentication.mdx),
+  [JIT Access Requests](../../access-requests/access-requests.mdx), and
+  [Access Lists](../../access-lists/access-lists.mdx).
+- Learn how Teleport uses RBAC, JIT Access Requests and Access Lists to manage AWS
+  Identity Center Account Assignments in the [AWS IAM Identity Center guide](./aws-iam-identity-center.mdx)
+
+## Further reading
+
+For a broader introduction to using the AWS CLI with IAM Identity Center, see the
+AWS [Configuring IAM Identity Center authentication with the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html#cli-configure-sso-configure)
+guide.
diff --git a/docs/pages/identity-governance/integrations/entra-id/advanced-options.mdx b/docs/pages/identity-governance/integrations/entra-id/advanced-options.mdx
new file mode 100644
index 0000000000000..7b1881715d835
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/advanced-options.mdx
@@ -0,0 +1,86 @@
+---
+title: Advanced Entra ID Integration Options
+sidebar_label: Advanced Options
+description: Advanced Teleport Entra ID integration configuration options.
+sidebar_position: 4
+tags:
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This page lists advanced configuration options related to the
+Teleport Entra ID integration. 
+
+## Group filters
+
+By default, all the groups that exists in the Microsoft Entra ID directory gets 
+imported to Teleport. 
+
+This import behavior can be controlled by using the group filters, which can 
+include or exclude certain groups based on their matching group object ID or group 
+display name. 
+
+Group filter can only be configured using `tctl` and the ability to configure it 
+using Teleport Web UI is in the works.
+
+
+### Group filter precedence
+
+- If no filters are configured, all the groups are imported (default behavior).
+- If an include filter is defined, only the matching group is imported. 
+- If a group is matched in both the include filter and exclude filter, exclude 
+filter gets precedence. 
+
+
+### Configure group filters during installation
+
+Example to configure group filters during installation:
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=admin \
+    --no-access-graph \
+    --use-system-credentials \
+    --manual-setup \
+    --group-id 25f9c527-2314-414c-a75d-ef7efabcc99b \
+    --group-name "admin*" \
+    --exclude-group-id 080b50c3-1c98-4d8e-a54e-20143dbd4f99 \
+    --exclude-group-name "fin*" 
+```
+- `--group-id`: Include group matching the specified group ID. 
+  Multiple flags allowed.
+- `--group-name`: Include groups matching the specified group name regex. 
+  Multiple flags allowed.
+- `--exclude-group-id`. Exclude group matching the specified group ID. 
+  Multiple flags allowed.
+- `--exclude-group-name`. Exclude groups matching the specified group name regex. 
+  Multiple flags allowed.
+
+### Updating group filters
+Group filters can be updated using `group_filters` flag, which is available in 
+the `sync_settings` of the Teleport Entra ID plugin resource spec. 
+
+Reference configuration spec:
+```yaml
+kind: plugin
+metadata:
+  name: entra-id
+spec:
+  Settings:
+    entra_id:
+      sync_settings:
+        ... # other settings omitted for brevity
+        group_filters:
+        - id: 080b50c3-1c98-4d8e-a54e-20143dbd4f99
+        - id: 45f9c527-2314-414c-a75d-ef7efabcc99b
+        - id: 35f9c527-2314-414c-a75d-ef7efabcc99b
+        - nameRegex: 'admin*'
+        - excludeId: 080b50c52-1c98-4d8e-a54e-20143dbd4f99
+        - excludeNameRegex: 'finance*'
+version: v1
+```
+
+The plugin spec can be edited using the `tctl edit plugins/entra-id` command.
diff --git a/docs/pages/identity-governance/integrations/entra-id/configure-access.mdx b/docs/pages/identity-governance/integrations/entra-id/configure-access.mdx
new file mode 100644
index 0000000000000..e0b488d85eb63
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/configure-access.mdx
@@ -0,0 +1,171 @@
+---
+title: Configure Teleport Access for Entra ID Users
+sidebar_label: Group Import
+description: Learn how to map Entra ID groups to Teleport roles with Nested Access Lists.
+sidebar_position: 3
+tags:
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide shows how to setup access for Entra ID imported users based on their Entra
+group memberships using Teleport's Nested Access Lists. 
+
+## How it works
+
+In a Nested Access List setup, the child Access List inherits roles and traits that
+are granted by the parent Access List. 
+
+By utilizing this feature, we can add an Entra ID imported Access List as a member of 
+another Access List to grant Teleport roles to its members. 
+
+For demonstration, this guide uses Grafana as a reference application to which we 
+want to configure access for Entra ID users. This application is enrolled 
+in Teleport with a resource label `env: monitor`. 
+![Grafana app enrolled in Teleport](../../../../img/igs/entraid/entra-teleport-grafana-app.png)
+
+We will have two user groups created in Entra ID: `ad-app-admin` and 
+`ad-app-support`. We want members of these groups to have a permanent 
+access and an ability to request access to Grafana respectively. You 
+may also use existing Entra ID groups instead.
+
+We will then create two roles in Teleport. One will allow access to Grafana 
+application while the other role will allow requesting access to the role that 
+grants access to Grafana application. 
+
+These roles will then be assigned to the Access List to grant roles and traits 
+to the Entra ID imported groups. 
+
+![Entra ID to Teleport role mapping](../../../../img/igs/entraid/entra-teleport-role-mapping.png)
+
+## Prerequisites
+
+- Teleport user with preset `editor` or an equivalent role that allows to 
+read and write Auth Connector, plugins, roles and Access Lists. 
+- Permission to create groups in Entra ID.
+- [Entra ID integration](getting-started.mdx) configured in your Teleport cluster. 
+- For demonstration, this guide references a Grafana application. You may use any other 
+[resource](../../../enroll-resources/enroll-resources.mdx) type to get started. 
+
+## Step 1/3. Create groups in Entra ID
+
+<Admonition type="info" title="New Group">
+  You may skip this step if you are using an existing Entra ID 
+  groups to follow through this guide.
+</Admonition>
+
+In the Azure portal, select the "Groups" menu under "Azure services". 
+
+From the "Groups" page, click the "New group" button to create a new user group 
+named `ad-app-support`. You may add desired users to this group. 
+
+![Entra ID create group](../../../../img/igs/entraid/entra-create-group.png)
+
+Repeat the steps and create another user group named `ad-app-admin`.
+
+Every 5 minutes, Teleport imports groups from Entra ID and creates 
+an Access List for each of the imported groups. Teleport will also preserve respective 
+group members as an Access List member.
+
+## Step 2/3. Create roles in Teleport
+
+First, create a role template that grants access to Grafana. 
+
+In the Teleport Web UI, from side navigation menu, select "Zero Trust Access > Roles".
+From the "Roles" UI, click "Create New Role" button. Switch to the YAML editor.
+![Teleport role editor YAML mode](../../../../img/igs/entraid/entra-teleport-role-yaml-editor.png)
+
+Copy the role spec shown below and paste it in the role editor to create a new role.
+```yaml
+kind: role
+version: v8
+metadata:
+  name: app-monitor
+spec:
+  allow:
+    app_labels:
+      env: '{{external.apps}}'
+```
+
+The role is configured with allowed `app_labels` that matches 
+label key `env` and a label value `'{{external.apps}}'`, which will be derived from 
+user's `apps` trait. As long as the label value configured in the application resource 
+label, and the value configured in the user `apps` trait matches, this role will grant 
+access to that application. 
+
+Using trait template to define label makes this role scalable as user traits are dynamically
+configurable. You can learn more about traits and role templates [in this guide](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
+
+When user authenticates with Entra ID, the SAML attributes (or claims if you are using OIDC) 
+that are available in the user SSO response are preserved as user traits. Additionally, you 
+can also grant traits to user using Access List. As you will see in the next step below, 
+this guide will use Access List to grant trait to the user.
+
+
+Repeat the role creation step in the UI to create another role that allows 
+requesting access to the `app-monitor` role. 
+
+We name this role as `support-team`.
+```yaml
+kind: role
+version: v8
+metadata:
+  name: support-team
+spec:
+  allow:
+    request: 
+      roles: 
+        - app-monitor
+```
+
+<Admonition type="tip" title="Role resource label">
+  In the example role `app-monitor`, the allow `app_labels` 
+  rule we defined applies to the application resources. You may need to reference 
+  a different [resource label](../../../reference/access-controls/roles.mdx#example-role-specification) 
+  rule if you are following through this guide with a different kind of resource.  
+</Admonition>
+
+## Step 3/3. Create a Nested Access List
+
+Assuming Teleport has already imported new groups we created in Entra ID, 
+we will now create new Access Lists for short-term (Just-In-Time) 
+and long-term access management. The Entra ID imported groups will then be added as a member to 
+these new Access Lists.
+
+In the Teleport Web UI, from the side-navigation menu, select “Identity Governance > Access List”.
+
+Next, click the “Create New Access List” button and enter Access List details as follows. 
+
+- **Title**: Short-term access
+- **Deadline for First Review**: Select a future date.
+- **Member Role Grants**: `support-team`
+- **Member Trait Grants**: `apps: monitor`
+- **Owners**: Add yourself or any appropriate users as owners.
+- **Members**: `ad-app-support`. This is the Access List created for the Entra ID group of the same name. 
+
+![Teleport short term access list](../../../../img/igs/entraid/entra-teleport-acl-short-term.png)
+
+This Access List grants `support-team` role and a trait `apps: monitor` to its members.
+Effectively, allowing its members to request access to the `app-monitor` role.
+
+Create another Access List that will grant its members with a long-term access to Grafana
+based on a direct-assigned `app-monitor` role. 
+- **Title**: Long-term access
+- **Deadline for First Review**: Select a future date.
+- **Member Role Grants**: `app-monitor`
+- **Member Trait Grants**: `apps: monitor`
+- **Owners**: Add yourself or any appropriate users as owners.
+- **Members**: `ad-app-admin`. This is the Access List created for the Entra ID group of the same name. 
+
+![Teleport long term access list](../../../../img/igs/entraid/entra-teleport-acl-long-term.png)
+
+This Access List grants `app-monitor` role and a trait `apps: monitor` to its members.
+Effectively, allowing its members to access application resource via the `app-monitor` role.
+
+## Next steps
+
+- Learn more about [Access List](../../access-lists/access-lists.mdx) and [Nested Access List](../../access-lists/nested-access-lists.mdx) management.
+- Learn more about [Role and Resource Access Request](../../access-requests/access-requests.mdx).
+- Learn more about [role templates](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
diff --git a/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx b/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx
new file mode 100644
index 0000000000000..9503e35106516
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/entra-id.mdx
@@ -0,0 +1,80 @@
+---
+title: Entra ID Integration
+sidebar_label: Microsoft Entra ID
+description: Describes how Entra ID integration works in Teleport.
+tags:
+ - teleport-as-idp
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+The Entra ID integration enables the following features in Teleport:
+
+1. **Single Sign-On (SSO):** Configures Teleport authentication with Entra ID as an
+   identity provider.
+2. **User sync:** Periodic import of Entra ID users as Teleport users.
+3. **Group sync:** Periodic import of Entra ID groups as Teleport
+   Access Lists. 
+4. **Integration with Teleport Identity Security (Optional):** Lets you analyze user access 
+paths and policies from the Teleport Identity Security product. If enabled, Teleport imports 
+enterprise applications as well. 
+
+## How it works
+
+To configure SSO, Teleport uses an Entra ID enterprise application where 
+Teleport must be set up as an SAML service provider. 
+
+To import users and groups from Entra ID, Teleport must be configured with 
+a credential to authenticate with the Microsoft Graph API. 
+
+### Choosing the Microsoft Graph API authentication method
+
+Teleport supports two types of authentication mechanisms to authenticate with the
+Microsoft Graph API: OIDC IdP and system credentials. 
+
+#### Teleport as an OIDC Provider for Entra ID 
+
+In this setup, Teleport is configured as an OpenID Connect (OIDC) identity provider 
+for the Entra ID enterprise application. 
+Teleport OIDC IdP then generates a short-lived credential for the Microsoft Graph API
+client configured for Entra ID. Authorization is limited to the API permission 
+configured in the Entra ID enterprise application. 
+
+Direct bidirectional connectivity between Teleport and Entra ID is necessary for 
+Entra ID to validate the OIDC tokens issued by Teleport.
+
+For a Teleport cloud cluster, OIDC IdP based authentication is the only supported
+authentication method. 
+
+#### System credentials
+
+In this setup, Teleport relies on the Microsoft Graph API credentials available where the 
+Teleport Auth Service is running. The setup typically involves configuring a managed identity
+for Teleport Auth Service and assigning that managed identity with the Microsoft Graph API 
+permissions required by the Teleport Entra ID integration.
+
+This method is best suited for an air-gapped Teleport clusters where the Teleport Proxy Service
+is not publicly accessible.
+
+### Choosing guided or manual Entra ID configuration method
+
+In the guided Entra ID configuration process, Teleport generates a configuration 
+script, which configures your Entra ID tenant with the properties that are required
+for the Teleport Entra ID integration. 
+
+If you want to have more control over the Entra ID configuration, a manual
+Entra ID configuration may be suitable for you. In this case, you update the Entra ID
+tenant with the properties that are required for Teleport Entra ID integration. 
+
+The Web UI only supports guided Entra ID configuration with Teleport as OIDC IdP 
+authentication method. `tctl` supports both the guided and manual Entra ID 
+configuration methods, for both Teleport as OIDC IdP and system credential based setup. 
+
+
+## Guides
+
+- [Getting Started with the Entra ID Integration](getting-started.mdx)
+- [Configure the Entra ID Integration using Azure Portal](setup/manual-installation.mdx)
+- [Configure the Entra ID Integration using Terraform](setup/terraform.mdx)
diff --git a/docs/pages/identity-governance/integrations/entra-id/faq.mdx b/docs/pages/identity-governance/integrations/entra-id/faq.mdx
new file mode 100644
index 0000000000000..f65ffdac4a760
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/faq.mdx
@@ -0,0 +1,52 @@
+---
+title: Entra ID Integration FAQ
+description: Frequently asked questions on the Teleport Entra ID integration.
+sidebar_label: FAQ
+sidebar_position: 5
+tags:
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This page provides answers to frequently asked questions about Teleport Entra ID integration. 
+
+## What resources are imported to Teleport?
+
+Teleport imports users, user groups and its members from the Microsoft Entra ID 
+directory.
+
+If Teleport Identity Security integration is enabled, Teleport will import 
+applications and policies as well. 
+
+You can control which groups from Microsoft Entra ID gets imported to Teleport 
+by configuring [group filters](advanced-options.mdx#group-filters). 
+
+## How does it work with nested Access Lists?
+
+If an Entra ID group is assigned as a member to another group, Teleport preserves this assignment 
+as a nested Access List. 
+
+However, note that Teleport does not support recursive groups where group A is a member of group B
+and group B is also a member of group A.
+
+## What permissions does Teleport need to authenticate with the Microsoft Graph API?
+
+At minimum, Teleport needs read access to users, groups and the main enterprise application 
+for which the integration is configured.
+```code 
+- Application.ReadWrite.OwnedBy
+- Group.Read.All
+- User.Read.All
+```
+
+If you enable the Identity Security integration, you will need a broader set of permissions.
+```code
+- Application.Read.All # instead of Application.ReadWrite.OwnedBy
+- Directory.Read.All # instead of User.Read.All and Group.Read.All
+- Policy.Read.All
+```
+
+By default, the guided configuration script sets up a broader scoped permission, which 
+is required by the Identity Security product to perform policy and access path analysis.
diff --git a/docs/pages/identity-governance/integrations/entra-id/getting-started.mdx b/docs/pages/identity-governance/integrations/entra-id/getting-started.mdx
new file mode 100644
index 0000000000000..29981482c88a2
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/getting-started.mdx
@@ -0,0 +1,192 @@
+---
+title: Getting Started with the Entra ID Integration
+sidebar_label: Getting Started
+description: Describes how to set up the Teleport Entra ID integration in Teleport.
+tags:
+ - how-to
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+
+This guide shows how to configure Entra ID integration in a guided configuration set up. 
+
+Teleport will generate a script that will configure your Entra ID tenant with the 
+properties required for the Teleport Entra ID integration.
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+- Your user must have privileged administrator permissions in the Microsoft Entra ID tenant.
+- Choose Microsoft Graph API [authentication method](entra-id.mdx#choosing-the-microsoft-graph-api-authentication-method). 
+
+## Step 1/3: Generate configuration script
+<Tabs groupId="entra-guided">
+<TabItem default label="Teleport as OIDC provider (Web UI)" name="entra-oidc-ui">
+
+In the Teleport Web UI, from the side-navigation, select “Add New > Integration”.
+
+Next, select the “Microsoft Entra ID” tile. 
+
+In the Teleport Microsoft Entra ID configuration UI, you will notice a default
+integration name “entra-id” is already populated for you. You will need to select 
+Teleport user(s) that will be assigned as the default owner of Access Lists that 
+are created for your Entra ID groups. 
+
+![Entra ID Integration](../../../../img/igs/entraid/entra-default-owners.png)
+
+In the next step, you will be provided with a Entra ID configuration script.
+
+</TabItem>
+
+<TabItem label="Teleport as OIDC provider (tctl)" name="entra-oidc-tctl">
+
+To begin integration, run the `tctl plugins install entraid` command.
+
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=<Var name="Access List Owner"/> \
+    --auth-server <Var name="example.teleport.sh:443" /> 
+```
+
+The `--name` flag specifies the resource name of the Entra ID plugin. 
+The `--auth-connector-name` flag specifies the name of the auth connector this integration will create.
+The `--default-owner` flag specifies default owners for the Access Lists that will be created
+in Teleport based on the groups imported from the Entra ID.
+
+The command will generate a configuration script in the current directory 
+from where the `tctl` is invoked. 
+
+</TabItem>
+
+<TabItem label="System credential (tctl)" name="entra-system-cred-tctl">
+
+You will need to grant Azure Identity with the necessary permissions required for the Entra ID
+integration.
+
+In the Azure Portal, find the identities linked to your Teleport Auth Service,
+and copy the Principal ID of the identity you wish to update with the new permissions.
+
+After obtaining the Principal ID, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/)
+in PowerShell mode and run the following script to assign the required permissions to `<Var name="Principal ID" />`.
+
+<details>
+<summary>Assign required permissions to Azure Identity</summary>
+
+```powershell
+# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
+Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'
+
+# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
+$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId '<Var name="Principal ID" />'
+
+# Set the Microsoft Graph enterprise application object.
+# This is a service principal object representing Microsoft Graph in Entra ID with a specific app ID.
+$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+
+# Define the permission scopes that we want to assign to the managed identity.
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.ReadWrite.OwnedBy"   # Permission to read application
+  "Group.Read.All"     # Permission to read groups
+  "User.Read.All"        # Permission to read users
+)
+
+# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $graphSPN.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+
+# Iterate over each app role to assign it to the managed identity.
+foreach ($appRole in $appRoles) {
+    # Define the parameters for the role assignment, including the managed identity's principal ID,
+    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
+    $bodyParam = @{
+        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
+        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
+        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
+    }
+
+    # Create a new app role assignment for the managed identity, granting it the specified permissions.
+    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
+}
+
+```
+
+</details>
+
+Your identity principal `<Var name="Principal ID" />` now has the necessary permissions to list Applications,
+Directories, and Policies.
+
+Now, to begin integration, run the `tctl plugins install entraid` command.
+
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=<Var name="Access List Owner"/> \
+    --auth-server <Var name="example.teleport.sh:443" /> \
+    --use-system-credentials 
+```
+
+The `--name` flag specifies the resource name of the Entra ID plugin. 
+The `--auth-connector-name` flag specifies the name of the auth connector this integration will create.
+The `--default-owner` flag specifies default owners for the Access Lists that will be created
+in Teleport based on the groups imported from the Entra ID.
+The `--use-system-credentials` flag specifies the plugin will use the system credential configured
+for the Auth Service.
+
+The command will generate a configuration script in the current directory 
+from where the `tctl` is invoked. 
+
+</TabItem>
+</Tabs>
+
+## Step 2/3: Configure Entra ID
+
+(!docs/pages/includes/identity-governance/azure-shell.mdx!)
+
+## Step 3/3: Finish plugin installation
+
+<Tabs groupId="entra-guided">
+<TabItem default label="Teleport as OIDC provider (Web UI)" name="entra-oidc-ui">
+
+Copy the Entra ID tenant ID and enterprise application client ID from the script output
+and enter it in the Web UI to finish the integration.
+
+![Entra ID Integration](../../../../img/igs/entraid/entra-finish.png)
+
+</TabItem>
+
+<TabItem label="Teleport as OIDC provider (tctl)" name="entra-oidc-tctl">
+
+Copy the Entra ID tenant ID and enterprise application client ID from the script output
+and enter it in the `tctl` to finish the integration.
+
+</TabItem>
+
+<TabItem label="System credential (tctl)" name="entra-system-cred-tctl">
+
+Copy the Entra ID tenant ID and enterprise application client ID from the script output
+and enter it in the `tctl` to finish the integration.
+
+</TabItem>
+</Tabs>
+
+The integration is now configured and the Teleport Entra ID service will start 
+importing resources from Entra ID to Teleport.
+
+## Next steps
+
+- [Configure Access](configure-access.mdx) for Entra ID users.
+- Configure [group filters](advanced-options.mdx#group-filters). 
+- Learn more about [Access List](../../access-lists/access-lists.mdx) management.
+- Take a deeper look into setting up [Entra ID auth connector](../../../zero-trust-access/sso/integrate-idp/entra-id.mdx). 
+- Learn how the [Identity Security integration with Entra ID](../../../identity-security/integrations/entra-id.mdx) works. 
+- See [FAQs](faq.mdx) related to the Teleport Entra ID integration. 
diff --git a/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx b/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx
new file mode 100644
index 0000000000000..f6b6cbfce28e9
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx
@@ -0,0 +1,121 @@
+---
+title: Configure the Entra ID Integration using Azure Portal
+sidebar_label: Azure Portal
+description: Describes how to manually set up Entra ID for the Teleport Entra ID integration.
+tags:
+ - how-to
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide shows manual Entra ID configuration steps to set up Teleport Entra ID integration.
+See [getting started with Entra ID integration](../getting-started.mdx) for a guided Entra ID configuration. 
+
+The set up is based on the [OIDC IdP authentication method](../entra-id.mdx#choosing-the-microsoft-graph-api-authentication-method).
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+- Teleport Identity Governance enabled for your Teleport cluster.
+- Your user must have privileged administrator permissions in the Microsoft Entra ID tenant.
+
+## Step 1/5. Create enterprise application
+
+In the Azure Portal, under “Azure services”, select “Enterprise applications”.
+Click on `+ New Application` button, then click `+ Create your own application` button.
+Enter a name for your application and create the application.
+
+![Entra ID Integration](../../../../../img/igs/entraid/entra-create-enterprise-app.png)
+
+
+## Step 2/5. Configure SSO
+
+Open the newly created enterprise application.
+
+Under “Manage” menu select “Single sign-on”. In this configuration UI, you will need to set up Teleport
+as an SAML servicer provider.
+
+Click edit button to configure  “Basic SAML Configuration”.
+Enter the SAML assertion endpoint as Entity ID and ACS URL value.
+- **Entity ID and ACS URL:** SAML ACS endpoint of your Teleport cluster. 
+E.g. `https://example.teleport.sh/v1/webapi/saml/acs/entra-id`
+
+For “Attributes & Claims”, attributes with user will already be available for you but you will need to 
+add a `groups` claim. 
+
+![Entra ID Integration](../../../../../img/igs/entraid/entra-sso-config.png)
+
+
+## Step 3/5. Configure OIDC IdP
+
+Under “App registrations” from Azure services menu, find and open your enterprise
+application created in step 1.
+
+Select “Manage > Certificates & secrets” and then select “Federated credentials“.
+Click `+ Add credential` button.
+
+Under “Add a credential” UI, configure credential with the following values:
+- **Federated credential scenario:** Other issuer
+
+Under “Connect your account”, configure the following values:
+- **Issuer:** `https://example.teleport.sh` (replace this value with your Teleport cluster proxy address)
+- **Type:** Explicit subject identifier
+- **Value:** teleport-azure
+
+Under “Credential details”, configure the following values:
+- **Name:** teleport-oidc
+- **Description:** Teleport OIDC Identity Provider
+
+![Entra ID Integration](../../../../../img/igs/entraid/entra-setup-oidc.png)
+
+## Step 4/5. Configure API permissions
+
+Under the same App registration UI for your enterprise application, select “Manage > API permissions”.
+
+You can add a new graph permission by clicking on `+ Add a permission` button and then selecting 
+“Microsoft Graph > Application permissions”.
+
+The following permissions need to be added to the application. 
+- `Application.ReadWrite.OwnedBy`
+- `Group.Read.All`
+- `User.Read.All`
+
+![Entra ID Integration](../../../../../img/igs/entraid/entra-api-permission.png)
+
+
+## Step 5/5. Install the Entra ID plugin
+
+Now run the `tctl plugins install entraid` command, including the name of the
+<Var name="Access List owner"/>:
+
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=<Var name="Access List owner"/> \
+    --no-access-graph \
+    --manual-setup
+```
+
+The `--name` flag specifies the resource name of the Entra ID plugin. 
+The `--auth-connector-name` flag specifies the name of the auth connector this integration will create.
+The `--default-owner` flag specifies default owners for the Access Lists that will be created
+in Teleport based on the groups imported from the Entra ID.
+The `--manual-setup` flag specifies a manual Entra ID configuration is selected by the user.
+
+`tctl` will then prompt for Entra ID tenant ID and application ID of the enterprise 
+application created in step 1.
+
+After you enter these values, Entra ID plugin will be installed with the OIDC IdP based authentication method.
+
+## Next steps
+
+- [Configure Access](../configure-access.mdx) for Entra ID users.
+- Configure [group filters](../advanced-options.mdx#group-filters). 
+- Learn more about [Access List](../../../access-lists/access-lists.mdx) management.
+- Take a deeper look into setting up [Entra ID auth connector](../../../../zero-trust-access/sso/integrate-idp/entra-id.mdx). 
+- Learn how the [Identity Security integration with Entra ID](../../../../identity-security/integrations/entra-id.mdx) works. 
+- See [FAQs](../faq.mdx) related to the Teleport Entra ID integration. 
diff --git a/docs/pages/identity-governance/integrations/entra-id/setup/setup.mdx b/docs/pages/identity-governance/integrations/entra-id/setup/setup.mdx
new file mode 100644
index 0000000000000..e873e446f4971
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/setup/setup.mdx
@@ -0,0 +1,8 @@
+---
+title: Setting up the Microsoft Entra ID Integration
+sidebar_label: Setup
+description: Provides instructions for setting up the Microsoft Entra ID integration using various methods.
+enterprise: Identity Governance
+---
+
+<DocCardList />
diff --git a/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx b/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx
new file mode 100644
index 0000000000000..c09a3ad54ba64
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx
@@ -0,0 +1,237 @@
+---
+title:  Configure the Entra ID Integration using Terraform
+description: Describes how to set up the Teleport Entra ID integration using Terraform
+sidebar_label: Terraform
+tags:
+ - teleport-as-idp
+ - infrastructure-as-code
+ - how-to
+ - identity-governance
+ - azure
+ - privileged-access
+enterprise: Identity Governance
+---
+
+This guide shows you how to integrate Teleport with Microsoft Entra ID using Terraform and `tctl`.
+You will configure the Entra ID side of the configuration using Terraform and install the Entra ID 
+plugin in Teleport using `tctl`. 
+
+For other supported configuration methods, see the following guides:
+- [Getting Started with the Entra ID Integration](../getting-started.mdx)
+- [Configure the Entra ID Integration using Azure Portal](manual-installation.mdx)
+
+## How it works
+
+If you are new to the Teleport Entra ID integration, start by reading [how the
+integration works](../entra-id.mdx). The `entra-id-integration` Terraform module
+sets up the integration by deploying a Microsoft Entra ID enterprise application and
+configuring it as a SAML identity provider for your Teleport cluster in order to
+enable authentication to Teleport via Microsoft Entra ID. 
+
+The module also assigns permissions to the Teleport Auth Service to fetch user
+and group data from Microsoft Entra ID in order to synchronize it with Teleport
+RBAC resources. Depending on your configuration, the Terraform module either
+does this by using system credentials (Microsoft Graph API permission IDs) or
+using Teleport as an OIDC IdP.
+
+## Prerequisites
+
+- Teleport Identity Governance enabled for your Teleport cluster.
+- Your user must have privileged administrator permissions in Microsoft Azure and Entra ID tenant.
+
+## Step 1/3. Prepare Terraform
+
+Clone the Teleport Entra ID integration example module, which is available in the Teleport Github 
+[repository](https://github.com/gravitational/teleport/tree/master/examples/terraform/entra-id-integration).
+
+The example provides a configurable Terraform module to set up Entra ID tenant with attributes that are 
+required for the Teleport Entra ID integration. The module is based on the `azuread` [provider](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs).
+
+The example expects an authenticated Azure CLI session available in your environment.
+The `azuread` provider expects tenant-level access, so the Azure CLI must be authenticated using 
+the `--allow-no-subscriptions` flag.
+```
+$ az login --allow-no-subscriptions
+```
+
+## Step 2/3. Configure and apply
+
+The example Terraform module provides Entra ID configuration options are based on the 
+Microsoft Graph API authentication method you wish to configure for the Teleport Entra ID integration. 
+
+Teleport supports two types of Microsoft Graph API authentication methods:
+Teleport as an OIDC IdP and system credentials. 
+
+Setting up Teleport as an OIDC IdP option is the only supported method if you are using Teleport Cloud.
+If you have a self-hosted Teleport Cluster, you must ensure that the Teleport Proxy Service is publicly accessible.
+
+Alternatively, using system credentials setup is best suited if you have a self-hosted Teleport cluster 
+or when the Teleport Proxy Service is not publicly accessible. You can learn more about the differences 
+on these authentication methods on this [page](../entra-id.mdx#choosing-the-microsoft-graph-api-authentication-method).
+
+At minimum, the Terraform example expects the following input variables:
+- `app_name`: Name of the enterprise application that will be created in Entra ID.
+- `proxy_service_address`: Teleport Proxy Service host, e.g., `example.teleport.sh`.
+- `certificate_expiry_date`: SAML assertion signing certificate expiry date. 
+   E.g., `2026-05-01T01:02:03Z`. Note that an expired certificate will prevent users from 
+   signing in to Teleport. If it expires, you will need to update this value in Terraform, 
+   as well as in the SAML-based Teleport Auth Connector created for the Entra ID. 
+
+<Tabs>
+<TabItem default label="Teleport as an OIDC provider" name="entra-oidc">
+
+Create `tfvars` with your inputs.
+
+```bash
+cat > variables.auto.tfvars << EOF
+app_name                = "<Var name="Enterprise app name"/>"
+proxy_service_address   = "<Var name="Teleport Proxy host"/>"
+certificate_expiry_date = "<Var name="SAML certificate expiry"/>"
+EOF
+```
+
+Applying this plan will perform the following actions:
+- Create an enterprise application.
+- Set up SAML SSO for Teleport.
+- Grant Microsoft Graph API permissions necessary for the Teleport Entra ID integration.
+- Setup Teleport as an OIDC-based federated credential provider. 
+
+After you configure `tfvars`, apply the plan.
+```bash
+$ terraform plan 
+
+$ terraform apply 
+```
+
+</TabItem>
+<TabItem label="System credential" name="entra-system-cred">
+
+You need additional input variables to set up managed identity.
+- `use_system_credentials`: Configures the Terraform module to plan for resources required 
+   for the system credential setup. Value must be `true`.
+- `graph_permission_ids`: Permission IDs of the Microsoft Graph API permissions required for the integration:
+  - `Application.ReadWrite.OwnedBy`
+  - `Group.Read.All`
+  - `User.Read.All`
+- `managed_id`:  Principal ID of the managed identity which is assigned to the Teleport Auth Service.
+
+The simplest way to retrieve the permission IDs is to run the PowerShell script in your Azure Cloud Shell.
+A working PowerShell script is provided below. 
+<details>
+<summary>PowerShell script</summary>
+
+```powershell
+Connect-AzureAD
+# This is a service principal object representing Microsoft Graph in Entra ID with a specific app ID.
+$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.ReadWrite.OwnedBy"   # Permission to read application
+  "Group.Read.All"     # Permission to read groups in the directory
+  "User.Read.All"        # Permission to read users in the directory
+)
+# Filter and find the app roles in the Microsoft Graph service principal that matches with permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $GraphServicePrincipal.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+# Print ID of each of the three permissions.
+foreach ($appRole in $appRoles) {
+  "{0} : {1}" -f $appRole.Value, $appRole.Id 
+}
+```
+
+</details>
+
+Once you have the permission IDs and the principal ID of the managed identity
+ready, create `tfvars` with your inputs. Assign values to the variables below:
+
+- <Var name="Permission IDs"/> 
+- <Var name="Principal ID of the managed identity"/>
+
+Enter the following command to populate your `tfvars` file:
+
+```bash
+cat > variables.auto.tfvars << EOF
+app_name                = "<Var name="Enterprise app name"/>"
+proxy_service_address   = "<Var name="Teleport Proxy host"/>"
+certificate_expiry_date = "<Var name="SAML certificate expiry"/>"
+use_system_credentials   = true
+graph_permission_ids    = [<Var name="Permission IDs"/>]
+managed_id              = "<Var name="Principal ID of the managed identity"/>"
+EOF
+```
+
+Applying this plan will perform the following actions:
+- Create an enterprise application.
+- Set up SAML SSO for Teleport.
+- Grant Microsoft Graph API permissions to the managed identity. Permissions 
+  are based on the permission IDs which we configured above.
+
+After you configure `tfvars`, apply the plan.
+```bash
+$ terraform plan 
+
+$ terraform apply 
+```
+
+</TabItem>
+</Tabs>
+
+Once the changes are applied, the Terraform module will produce an application client ID and 
+Entra ID tenant ID values as an output. You will need these values in the next step.
+
+Entra ID is now configured with the required attributes needed for the Teleport Entra ID integration.
+
+## Step 3/3. Install the Entra ID plugin
+
+To complete the integration setup, install the Entra ID plugin in Teleport.
+The plugin can be installed with the `tctl plugins install entraid` command.
+
+<Tabs>
+<TabItem default label="Teleport as an OIDC provider" name="entra-oidc">
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=<Var name="Access List Owner"/> \
+    --no-access-graph \
+    --manual-setup
+```
+</TabItem>
+
+<TabItem label="System credential" name="entra-system-cred">
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=<Var name="Access List Owner"/> \
+    --no-access-graph \
+    --use-system-credentials \
+    --manual-setup
+```
+</TabItem>
+</Tabs>
+
+- `--name` flag specifies the resource name of the Entra ID plugin.
+- `--auth-connector-name` flag specifies the name of the auth connector this integration will create.
+- `--default-owner` flag specifies default owners for the Access Lists that will be created
+in Teleport based on the groups imported from the Entra ID.
+- `--no-access-graph` flag specifies Identity Security integration is to be skipped.
+- `--use-system-credentials` flag specifies to use system credential configured using Managed Identity. Use this flag only 
+if you with to set up system credential based authentication.
+- `--manual-setup` flag specifies a manual Entra ID configuration is selected by the user.
+
+`tctl` will then prompt for an Entra ID tenant ID and an application client ID of the enterprise 
+application created by using Terraform in step 2.
+
+After you enter these values, the installation command will create a SAML Auth Connector in Teleport, along with the 
+plugin service that imports users and groups from Entra ID to Teleport.
+
+## Next steps
+
+- Learn how to [configure access](../configure-access.mdx) for Entra ID users.
+- Configure [group filters](../advanced-options.mdx#group-filters). 
+- Take a deeper look into setting up [Entra ID auth connector](../../../../zero-trust-access/sso/integrate-idp/entra-id.mdx). 
+- Learn how the [Identity Security integration with Entra ID](../../../../identity-security/integrations/entra-id.mdx) works. 
+- See [FAQs](../faq.mdx) related to the Teleport Entra ID integration. 
diff --git a/docs/pages/identity-governance/integrations/integrations.mdx b/docs/pages/identity-governance/integrations/integrations.mdx
new file mode 100644
index 0000000000000..01e8c5c54aa80
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/integrations.mdx
@@ -0,0 +1,20 @@
+---
+title: Identity Governance Integrations
+sidebar_label: Integrations
+description: Shows you how to sync Teleport RBAC resources with third-party tools and services.
+tags:
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+You can configure Teleport to sync role-based access control (RBAC) configurations with
+third-party software, such as AWS IAM Identity Center, Microsoft Entra ID, and
+Okta. Teleport creates resources such as roles and Access Lists based on
+resources it retrieves from the integration. This way, you can manage all access
+controls in your infrastructure from a single platform.
+
+Read the following guides for how to configure the Identity Governance
+integration for your third-party solution:
+
+<DocCardList />
diff --git a/docs/pages/admin-guides/access-controls/okta/app-and-group-sync.mdx b/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx
similarity index 92%
rename from docs/pages/admin-guides/access-controls/okta/app-and-group-sync.mdx
rename to docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx
index dbc70815b839c..8bd760d7a4136 100644
--- a/docs/pages/admin-guides/access-controls/okta/app-and-group-sync.mdx
+++ b/docs/pages/identity-governance/integrations/okta/app-and-group-sync.mdx
@@ -1,6 +1,12 @@
 ---
 title: Okta App and Group Sync
+sidebar_label: App and Group Sync
 description: Explains how to enable the Okta app and group sync integration, which imports Okta configurations into the Teleport RBAC system.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 Okta has its own permissions system that doesn't directly map into Teleport. This
@@ -26,6 +32,13 @@ application:
 - An Access List representing membership to the group/application.
 - Members for the Access List.
 
+All synchronized Okta users are assigned a builtin `okta-requester` role which allows to request
+access to the synchronized resources. This role assignment can be disabled with
+`--no-assign-default-roles` flag when creating the integration with `tctl` or can be disabled with
+`tctl edit plugins/okta` by setting `okta.sync_settings.disable_assign_default_roles: true`.
+Note that unless the connector was created manually, this role is also assigned by default in the
+auth connector role mapping and needs to be updated there for the change to take effect.
+
 It should be noted that the Access List sync waits until the Okta groups and Okta applications
 has finished syncing as Teleport resources, so it may not start synchronizing immediately on startup.
 
@@ -36,13 +49,13 @@ List will be removed from Teleport on the next sync.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - Teleport Identity Governance enabled on your account.
 
 - An Okta authentication connector. 
 
-  <Admonition>
+  <Admonition type="important">
   Before following the guided app and group sync integration flow, you must have
   completed the following:
   - [Guided Okta single sign-on flow](./guided-sso.mdx).
diff --git a/docs/pages/admin-guides/access-controls/okta/guided-sso.mdx b/docs/pages/identity-governance/integrations/okta/guided-sso.mdx
similarity index 93%
rename from docs/pages/admin-guides/access-controls/okta/guided-sso.mdx
rename to docs/pages/identity-governance/integrations/okta/guided-sso.mdx
index 77f3bd6878b90..07007975fd160 100644
--- a/docs/pages/admin-guides/access-controls/okta/guided-sso.mdx
+++ b/docs/pages/identity-governance/integrations/okta/guided-sso.mdx
@@ -1,8 +1,16 @@
 ---
 title: Guided Okta SSO Integration
+sidebar_label: Guided SSO Integration
 description: Explains how to enroll Okta in your Teleport cluster as an identity provider for single sign-on using the guided flow.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 The Teleport Okta SSO integration allows Teleport users to authenticate using
 Okta as an identity provider. Teleport. The guided enrollment flow for the Okta
 SSO integration is part of the [guided Okta integration](./okta.mdx). This
@@ -12,11 +20,11 @@ perform required actions within Okta.
 If you do not plan to enroll additional components of the guided Okta
 integration, you can set up only the Okta SSO integration - called an
 authentication connector - by following [Authentication With Okta as an SSO
-Provider](../../../admin-guides/access-controls/sso/okta.mdx).
+Provider](../../../zero-trust-access/sso/integrate-idp/okta.mdx).
  
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - Familiarity with the [Okta guided integration flow](./okta.mdx).
 
@@ -28,7 +36,7 @@ Provider](../../../admin-guides/access-controls/sso/okta.mdx).
   the integration is hardcoded as `okta`. If you have a connector named `okta`
   and you'd like to use a different one, you'll have to create your connector
   manually following [Authentication With Okta as an SSO Provider
-  ](../../../admin-guides/access-controls/sso/okta.mdx).
+  ](../../../zero-trust-access/sso/integrate-idp/okta.mdx).
 
 - (!docs/pages/includes/tctl.mdx!)
 
diff --git a/docs/pages/identity-governance/integrations/okta/okta.mdx b/docs/pages/identity-governance/integrations/okta/okta.mdx
new file mode 100644
index 0000000000000..14807a2d34ecd
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/okta/okta.mdx
@@ -0,0 +1,135 @@
+---
+title: Enroll the Teleport Okta Integration
+sidebar_label: Okta
+description: Describes how to set up the Teleport Okta integration in order to grant Teleport users access to resources managed in Okta.
+sidebar_position: 4
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
+---
+
+The Teleport Okta integration can import and grant access to resources from an
+Okta organizations, such as user profiles, groups and applications. Teleport can
+provision user accounts based Okta users, Okta applications can be accessed
+through Teleport's application access UI, and access to these applications along
+with user groups can be managed by Teleport's RBAC along with Access Requests.
+
+This guide shows you how to set up the Teleport Okta integration.
+
+## How it works
+
+Enrolling the Okta integration is a guided process and contains four components:
+
+1. **Single sign-on (SSO) integration:** Configures Teleport authentication with Okta as an
+   identity provider.
+2. **System for Cross-domain Identity Management (SCIM) integration:** Uses the
+   [SCIM standard](https://developer.okta.com/docs/concepts/scim/) to
+   allow nearly instant provisioning of Okta users in Teleport. This is
+   available only if Teleport Identity Governance is enabled. The SCIM
+   integration is optional for enabling user, application, and group sync.
+3. **User sync:** Imports Okta users as Teleport users via a continuous
+   reconciliation loop. It is usually slower than SCIM, but but more reliable,
+   and does not require a publicly accessible Teleport cluster. Combined with
+   SCIM, it provides both speed and reliability.
+4. **Application and group sync:** imports Okta applications and groups as Teleport
+   Access Lists. This enables you to manage access to Okta applications and user
+   groups via Teleport RBAC, including Access Requests.
+
+The Okta SSO integration is required for all other components of the Okta
+integration. User sync is required for application and group sync.
+
+Teleport manages Okta application group assignments using a declarative state
+approach. If an assignment is created via Teleport and subsequently removed via
+the Okta UI, Teleport will re-evaluate and potentially overwrite Okta UI changes
+to align with the state defined by Teleport's RBAC configuration.
+
+## Get started
+
+To start the enrolment, visit the Teleport Web UI. From the left sidebar,
+navigate to **Add New** -> **Integration**. Select the **Okta** tile.
+
+![Enroll an integration](../../../../img/enterprise/plugins/enroll.png)
+
+This will bring you to the SSO integration configuration screen. Read [Guided
+Okta SSO Integration](./guided-sso.mdx) for supplementary instructions as you
+work through the guided flow.
+
+## Guides
+
+For supplemental information on the guided process, such as instructions on
+making changes in Okta, review the documentation in this section:
+
+<DocCardList />
+
+## Syncing System Logs and API Keys with Teleport Identity Security Activity Center
+
+(!docs/pages/includes/policy/identity-activity-center.mdx!)
+
+### How Teleport Identity Security's Okta Integration works
+
+Identity Activity Center automatically retrieves Okta System Logs through
+minute-by-minute polling, then processes and standardizes this data
+before storing it for long-term analysis and retention.
+
+Additionally, the Okta integration maps access paths for existing
+Okta API keys, tracking which users own them and what permissions
+they have within the organization.
+
+### How to enable Identity Security's Okta Integration
+
+Users with an existing Okta setup in Teleport can enable the Identity
+Security Integration directly from the status page.
+When configuring a new integration, the setup wizard provides a
+dedicated Identity Security step with guided configuration instructions.
+
+## Managing integration components
+
+At any point in the guided flow, you can return to the integration status page
+to manage any component of the integration. To open the integration status page
+in the Teleport Web UI, navigate to **Zero Trust Access** -> **Integrations** and
+click anywhere on the Okta integration row.
+
+![Okta integration #1](../../../../img/enterprise/plugins/okta/okta-status-page-1.png)
+
+## Deleting the Okta integration
+
+You can delete the Okta integration by taking the following steps:
+
+1. Clean up user accounts created by the Okta integration. To do so, un-assign
+   all Okta users from the Okta SAML Application Teleport uses as its identity
+   provider, and wait for the sync process and/or SCIM provisioning to delete
+   the corresponding Teleport accounts. Once the Teleport accounts have been
+   automatically deleted you can proceed to delete the integration.
+
+2. Navigate to **Zero Trust Access** -> **Integrations** and click anywhere on the Okta
+   integration row to visit the integration status page.
+
+3. Click **Delete Integration**.  
+   ![Delete Okta integration](../../../../img/enterprise/plugins/okta/okta-delete-integration.png)
+
+4. Permanently delete the SAML connector created as part of the integration.
+   Navigate to the **Auth Connectors** page in the Teleport UI and select the
+   option to delete it. The SAML connector created during the enrollment process
+   is ***not*** deleted when the hosted Okta integration is deleted, and will
+   automatically be re-used if the Okta integration is re-enrolled.
+
+5. Clean up Access Lists created by the Okta integration. These are not deleted
+   when the Okta integration is deleted. To delete Okta-sourced Access Lists,
+   run the following command:
+
+   ```code
+   $ tctl plugins cleanup okta
+
+If any Access Lists created by the integration are nested members or owners
+of Teleport-created Access Lists, cleanup will fail. Any nested Access Lists
+need to be unassigned before you can perform a cleanup.
+
+<Admonition type="warning">
+If the Okta integration is still active, removing Okta-sourced Access Lists
+could revoke Okta access from users in your organization. Exercise caution
+when cleaning up Access Lists.
+</Admonition>
+
+Once the integration is deleted, you can manually remove any remaining user accounts with `tctl`.
diff --git a/docs/pages/identity-governance/integrations/okta/reference.mdx b/docs/pages/identity-governance/integrations/okta/reference.mdx
new file mode 100644
index 0000000000000..f307d1138f0eb
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/okta/reference.mdx
@@ -0,0 +1,116 @@
+---
+title: Okta Service Reference
+sidebar_label: Reference
+description: Configuration and CLI reference documentation for Teleport Okta service.
+sidebar_position: 5
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+enterprise: Identity Governance
+---
+
+This guide describes interfaces and options for configuring the Teleport Okta
+Service, including Okta import rules, Okta assignments, and `tctl` commands. It
+also includes troubleshooting instructions.
+
+## Okta Import Rule resources
+
+Full YAML spec of Okta import rule resources managed by `tctl` resource commands:
+
+(!docs/pages/includes/okta-import-rule.mdx!)
+
+You can create a new `okta_import_rule` resource by running the following commands, which
+assume that you have created a YAML file called `okta-import-rule.yaml` with your configuration:
+
+```code
+# Log in to your cluster with tsh so you can use tctl from your local machine.
+# You can also run tctl on your Auth Service host without running "tsh login"
+# first.
+$ tsh login --proxy=teleport.example.com --user=myuser
+# Create the resource
+$ tctl create -f okta-import-rule.yaml
+```
+
+## Okta Assignment resources
+
+These objects are internally facing and are not intended to be modified by users. However,
+you can query them for informational or debugging purposes.
+
+Full YAML spec of Okta assignment resources queried by `tctl` resource commands:
+
+```yaml
+kind: okta_assignment
+version: v1
+metadata:
+  name: test-assignment
+spec:
+  # The user that the Okta assignment is granting access for.
+  user: test-user@test.user
+  # The list of targets to grant access to.
+  targets:
+  # An application target.
+  - type: application
+    id: "123456"
+  # A group target.
+  - type: group
+    id: "234567"
+  # The current status of the Okta assignment.
+  status: pending
+```
+
+## CLI
+
+This section shows CLI commands relevant for managing Okta Service behaviors.
+
+### tctl get okta_import_rules
+
+Lists available Okta import rules.
+
+```code
+$ tctl get okta_import_rules
+```
+
+### tctl get okta_import_rules/NAME
+
+Gets an individual Okta import rule.
+
+```code
+$ tctl get okta_import_rules/my-import-rule
+```
+
+### tctl rm okta_import_rules/NAME
+
+Removes an individual Okta import rule.
+
+```code
+$ tctl rm okta_import_rules/my-import-rule
+```
+
+### tctl get okta_assignments
+
+Lists available Okta assignments.
+
+```code
+$ tctl get okta_assignments
+```
+
+### tctl get okta_assignments/NAME
+
+Gets an individual Okta assignment.
+
+```code
+$ tctl get okta_assignments/my-assignment
+```
+
+## Troubleshooting
+
+### No Okta groups or applications seen in the Teleport UI
+
+If the Teleport applications UI isn't displaying any Okta applications, ensure
+that the Okta API token and endpoint are correct in the Okta service.
+
+If they are, double check the user permissions and ensure that the user has
+appropriate resource and label level access to the groups and applications. You
+may need to tweak the `app_labels` and `group_labels` sections of a role in order
+to see these resources.
diff --git a/docs/pages/admin-guides/access-controls/okta/scim-integration.mdx b/docs/pages/identity-governance/integrations/okta/scim-integration.mdx
similarity index 96%
rename from docs/pages/admin-guides/access-controls/okta/scim-integration.mdx
rename to docs/pages/identity-governance/integrations/okta/scim-integration.mdx
index aae45233102fa..a5a8cb492fc74 100644
--- a/docs/pages/admin-guides/access-controls/okta/scim-integration.mdx
+++ b/docs/pages/identity-governance/integrations/okta/scim-integration.mdx
@@ -1,6 +1,12 @@
 ---
 title: Okta SCIM Integration
+sidebar_label: SCIM Integration
 description: Explains how to use the guided integration enrollment flow to enable the Okta SCIM integration, which allows Teleport to immediately reflect changes in Okta.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
 The SCIM (System for Cross-domain Identity Management) integration enables automated user management,
@@ -43,13 +49,13 @@ Okta does not send SCIM updates to Teleport when a user is suspended. Even thoug
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - Teleport Identity Governance enabled on your account.
 
 - An Okta authentication connector. 
 
-  <Admonition>
+  <Admonition type="important">
   Before following the guided SCIM integration flow, you must have completed the
   [guided Okta single sign-on flow](./guided-sso.mdx).
   </Admonition>
diff --git a/docs/pages/admin-guides/access-controls/okta/user-sync.mdx b/docs/pages/identity-governance/integrations/okta/user-sync.mdx
similarity index 96%
rename from docs/pages/admin-guides/access-controls/okta/user-sync.mdx
rename to docs/pages/identity-governance/integrations/okta/user-sync.mdx
index c68fdd55f0ae2..93b564fa5be61 100644
--- a/docs/pages/admin-guides/access-controls/okta/user-sync.mdx
+++ b/docs/pages/identity-governance/integrations/okta/user-sync.mdx
@@ -1,8 +1,16 @@
 ---
 title: Okta User Sync
+sidebar_label: User Sync
 description: Explains how to set up Okta user sync with the guided integration flow.
+tags:
+ - how-to
+ - identity-governance
+ - privileged-access
+enterprise: Identity Governance
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 Okta user sync imports Okta users as Teleport users via a continuous
 reconciliation loop. User sync works in tandem with the Teleport [SCIM
 integration](./scim-integration.mdx#how-it-works). 
@@ -19,11 +27,11 @@ integration enrollment flow.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise (v17.3.0 or higher)"!)
 
 - An Okta authentication connector. 
 
-  <Admonition>
+  <Admonition type="important">
   Before following the guided user sync integration flow, you must have
   completed the [guided Okta single sign-on flow](./guided-sso.mdx).
   </Admonition>
@@ -40,7 +48,7 @@ group assignments in Okta and can make changes within Okta based on your
 Teleport RBAC configuration. To limit the scope of the integration, ensure that:
 
 - In the Teleport roles you have assigned to users, no role contains an
-  [app_labels](../../../enroll-resources/application-access/controls.mdx#configuring-application-labels-in-roles) field
+  [app_labels](../../../enroll-resources/application-access/configuration/controls.mdx) field
   with a wildcard value. Since Teleport uses this field to govern access to Okta
   applications, wildcard values will grant Teleport users access to all Okta
   applications. 
diff --git a/docs/pages/identity-governance/integrations/scim/sailpoint.mdx b/docs/pages/identity-governance/integrations/scim/sailpoint.mdx
new file mode 100644
index 0000000000000..183c020c0ddff
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/scim/sailpoint.mdx
@@ -0,0 +1,79 @@
+---
+title: SCIM SailPoint Integration
+sidebar_label: SailPoint
+description: How to Configure SCIM Connector in SailPoint to manage Access List membership
+tags:
+- how-to
+- identity-governance
+- privileged-access
+enterprise: Identity Governance
+---
+
+
+SailPoint provides a SCIM identity management connector that allows you to manage Teleport Access List membership
+through SailPoint IdentityNow or SailPoint IdentityIQ.
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+- Teleport SCIM plugin setup: [SCIM Plugin Installation](./scim.mdx)
+
+## Step 1/2: Configure a SCIM 2.0 Teleport connector in SailPoint
+
+To integrate Teleport with SailPoint using SCIM, you need to configure a SCIM connector in SailPoint IdentityNow or SailPoint IdentityIQ.
+The exact configuration steps may vary slightly depending on your version of SailPoint, but the general process is as follows.
+
+### Configure SCIM in SailPoint
+
+Create a new SCIM connector in SailPoint at: Applications > Application Definition > Add New Application.
+Select **SCIM 2.0** as the application type and provide the required configuration details:
+
+![SailPoint Connector Details](../../../../img/sailpoint/sailpoint-1.png)
+
+Navigate to the Teleport SCIM Integration page and copy the OAuth 2.0 details and the SCIM base URL.
+<Admonition type="info">
+    If the Teleport SCIM integration has not been set up, follow the [SCIM Plugin Installation](./scim.mdx)  guide before proceeding.
+</Admonition>
+
+In the SailPoint SCIM application configuration view, populate the configuration settings using the values obtained from the Teleport SCIM integration:
+* SCIM Base URL: Paste the SCIM Base URL copied from SCIM Teleport Integration page
+* Authentication Type: Pick "OAuth 2.0"
+* Token URL: Paste the Token UR copied from SCIM Teleport Integration page
+* Grant Type: Pick "Client Credentials"
+* Client ID: The Client ID copied from SCIM Teleport Integration page
+
+Click **Test Connection** to verify that the connection is successful:
+
+![SailPoint SCIM Oauth](../../../../img/sailpoint/sailspoint-scim-config.png)
+
+### Configure SCIM schema discovery
+
+Under  **Configuration -> Schema**, click **Discover Schema Attributes** on both the **Accounts** and **Groups** tabs to retrieve the schema attributes:
+![Account Schema Discovery](../../../../img/sailpoint/sailpoint-3.png)
+![Group Schema Discovery](../../../../img/sailpoint/sailpoint-4.png)
+Go to the **Provisioning Policy** section, and create a **Create Policy** that maps the `userName` SCIM attribute to the user’s email address:
+![User Provisioning settings](../../../../img/sailpoint/sailpoint-5.png)
+Save all changes.
+
+#### Configure SCIM group aggregation in SailPoint
+
+
+SailPoint group aggregation enables the retrieval of SCIM-type Access Lists into SailPoint as Application Group Entitlements.
+This allows you to import Teleport Access Lists into SailPoint and manage membership directly through SailPoint with the changes being reflected in Teleport Access Lists.
+
+Navigate to **Setup > Tasks -> New Task -> Group Aggregation** in SailPoint.
+![Select Aggregation](../../../../img/sailpoint/sailpoint-6.png)
+Select the **Teleport SCIM Connector**, then click **Save and Execute** to run the aggregation task.
+![Configure Aggregation](../../../../img/sailpoint/sailpoint-7.png)
+If the aggregation completes successfully,
+you should see the imported Access Lists `type: "scim"` from Teleport in SailPoint under: **Applications > Entitlement Catalog**
+
+![Aggregation Result](../../../../img/sailpoint/sailpoint-8.png)
+
+## Step 2/2: Submit Access Requests to SailPoint Group Entitlement (Optional)
+
+Go to **Manage > Manage User Access > Manage User Access** in SailPoint.
+Submit an Access Request for a mapped Access List (as represented by a group
+entitlement in SailPoint).
+![Access request](../../../../img/sailpoint/sailpoint-9.png)
+Once the request is approved, the user will be added to the appropriate Access List in Teleport.
diff --git a/docs/pages/identity-governance/integrations/scim/scim.mdx b/docs/pages/identity-governance/integrations/scim/scim.mdx
new file mode 100644
index 0000000000000..eecd24856712f
--- /dev/null
+++ b/docs/pages/identity-governance/integrations/scim/scim.mdx
@@ -0,0 +1,117 @@
+---
+title: SCIM Integration
+sidebar_label: SCIM
+description: How to manage Access List membership using SCIM integration
+tags:
+- how-to
+- identity-governance
+- privileged-access
+enterprise: Identity Governance
+---
+
+The SCIM integration between **SCIM providers** and **Teleport** enables automated
+synchronization of SCIM group memberships and Teleport Access List memberships.
+This integration supports centralized identity governance in
+external Identity Management System (like SailPoint) while Teleport enforces
+fine-grained access controls defined by Access Lists membership grants types.
+
+User permissions in Teleport are defined through Access Lists. While role definitions
+live in Teleport, group membership is dynamically managed by SCIM Provider via SCIM group
+membership. This ensures users have up-to-date access aligned with organizational
+policies.
+
+## How it works
+
+The SCIM integration uses a 1:1 mapping between SCIM group and Teleport
+Access Lists
+
+- Each SCIM group `displayName` must match the `spec.title` of a Teleport
+Access List.
+- SCIM-type Access Lists must be created in advance in Teleport. In this guide we're creating them using Terraform.
+- Only Access Lists of type `scim` can be managed by SCIM providers.
+- Role assignments are handled in Teleport, while group membership is delegated to External Identity Management System (like SailPoint).
+
+## Prerequisites
+- Teleport Enterprise v17.6.1, v18.0.3 or higher.
+- Teleport Terraform Provider v17.6.1, v18.0.3 or higher.
+- A running Teleport cluster with SSO enabled (e.g. Okta SAML connector)
+- Identity Management System (like SailPoint) with SCIM support
+- SCIM Provider with OAuth 2.0 Client Credentials grant type support
+
+## Step 1/3: Create an SCIM-Managed Access List in Teleport
+
+Create a new Access List in Teleport using Terraform. Be sure to set `type = "scim"`
+and match `spec.title` to the name of `displayName` of  SCIM group that we be provided to Teleport:
+
+
+```hcl
+resource "teleport_access_list" "acl-group-requester" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "scim-group-requester"
+    }
+  }
+  spec = {
+    title = "GroupRequester"
+    type = "scim"
+    grants = {
+      roles  = ["requester"]
+      traits = []
+    }
+    owners = [
+      {
+        name = "alice"
+      }
+    ]
+    membership_requires = {
+      roles = []
+    }
+    ownership_requires = {
+      roles = []
+    }
+    audit = {
+      recurrence = {
+        frequency    = 3
+        day_of_month = 15
+      }
+    }
+  }
+}
+```
+
+<Admonition type="info">
+    The SCIM group name (displayName) in SCIM Provider must exactly match
+    `spec.title` in the Teleport Access List.
+</Admonition>
+
+
+## Step 2/3. Configure SCIM Integration
+Teleport provides a guided Web UI-based configuration flow for the SCIM integration.
+
+In the Teleport Web UI, go to **"Add new integration"** and select **SCIM**.
+
+![Plugin Install](../../../../img/sailpoint/plugin-install.png)
+
+
+Select the **SAML connector** to associate SCIM-provisioned users with SSO logins.
+
+- By default, SSO users in Teleport are ephemeral.
+- SCIM provisioning ensures users are persistently created and managed by External Identity management system via SCIM protocol.
+
+![Connector Selection](../../../../img/sailpoint/plugin-connector.png)
+
+
+Click **Continue** to proceed to the **SCIM Credentials** screen.
+
+- Teleport uses OAuth 2.0 Bearer Tokens for SCIM authentication.
+- Copy the **Client ID**, **Client Secret**, and **Base URL** — you'll use them
+  when configuring your Identity Provider in the next step.
+
+## Step 3/3. Configure SCIM integration with your Identity Management SCIM provider
+
+SCIM configuration may differ depending on your IdP. The integration has been officially tested with the following providers:
+
+- [SailPoint Teleport SCIM connector setup](./sailpoint.mdx)
+
+In case of other SCIM providers, please refer to their documentation for setting up a SCIM integration.
diff --git a/docs/pages/admin-guides/access-controls/guides/locking.mdx b/docs/pages/identity-governance/locking.mdx
similarity index 79%
rename from docs/pages/admin-guides/access-controls/guides/locking.mdx
rename to docs/pages/identity-governance/locking.mdx
index c8232f8ee82e2..d29f4911fa907 100644
--- a/docs/pages/admin-guides/access-controls/guides/locking.mdx
+++ b/docs/pages/identity-governance/locking.mdx
@@ -1,6 +1,11 @@
 ---
 title: Session and Identity Locking
 description: How to lock compromised users or agents
+tags:
+ - how-to
+ - identity-governance
+ - resiliency
+enterprise: Identity Governance
 ---
 
 System administrators can disable a compromised user or Teleport Agent—or
@@ -14,15 +19,24 @@ matching the lock's target.
 A lock can target the following objects or attributes:
 
 - a Teleport user by the user's name
-- a Teleport [RBAC](../../../reference/access-controls/roles.mdx) role by the role's name
-- a Teleport [trusted device](
-  ../device-trust/enforcing-device-trust.mdx#locking-a-device) by the device ID
+- a Teleport [RBAC](../reference/access-controls/roles.mdx) role by the role's name
+- a Teleport [trusted device](device-trust/enforcing-device-trust.mdx#locking-a-device) by the device ID
 - an MFA device by the device's UUID
 - an OS/UNIX login
 - a Teleport Agent by the Agent's server UUID (effectively unregistering it from the
   cluster)
 - a Windows desktop by the desktop's name
-- an [Access Request](../access-requests/access-requests.mdx) by UUID
+- an [Access Request](access-requests/access-requests.mdx) by UUID
+- a bot instance ID (for Machine & Workload Identity bots)
+- a join token name (for Machine & Workload Identity bots using a [delegated join method](../reference/deployment/join-methods.mdx#delegated-join-methods))
+
+## How it works
+
+A lock is a dynamic Teleport resource stored on the Teleport Auth Service
+backend. Teleport services implement a lock watcher that subscribes to Auth
+Service events related to lock creation. When these services receive a
+notification that the a lock has been created or modified, they enact safeguards
+to prevent various operations, e.g., preventing access from a locked user.
 
 ## Prerequisites
 
@@ -84,6 +98,29 @@ with one of the following options:
   # Created a lock with name "dc7cee9d-fe5e-4534-a90d-db770f0234a1".
   ```
   </TabItem>
+  <TabItem label="Machine & Workload Identity Bot">
+  The most appropriate locking target for a Machine & Workload Identity bot
+  depends on its join method.
+
+  For [delegated join methods](../reference/deployment/join-methods.mdx#secret-vs-delegated),
+  it's best to target the specific join token the bot is using to join:
+  ```code
+  $ tctl lock --join-token=example-token-name
+  ```
+
+  The join token name cannot be targeted for bots joined using the `token` join
+  method, so it's best to use the
+  [bot instance ID](../reference/architecture/machine-id-architecture.mdx#bot-instances):
+  ```code
+  $ tctl lock --bot-instance-id aabbccdd-1234-5678-0000-3b04d7d03acc
+  ```
+
+  In all cases, you may also target the bot user, which will lock all instances
+  of a bot that share the same underlying user:
+  ```code
+  $ tctl lock --user bot-example
+  ```
+  </TabItem>
 </Tabs>
 
 <details>
@@ -161,7 +198,7 @@ spec:
 ```
 
 The `kind: lock` resources can also be created and updated using `tctl create`
-as per usual. See the [Admin Guide](../../../reference/resources.mdx) for more
+as per usual. See the [Admin Guide](../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx) for more
 details.
 </details>
 
@@ -210,7 +247,7 @@ auth_service:
 
 Restart or redeploy the Auth Service for the change to take effect.
 
-If not, edit your cluster authentication preference resource: 
+If not, edit your cluster authentication preference resource:
 
 ```code
 $ tctl edit cap
diff --git a/docs/pages/identity-security/access-graph/access-graph.mdx b/docs/pages/identity-security/access-graph/access-graph.mdx
new file mode 100644
index 0000000000000..40b6bb952b514
--- /dev/null
+++ b/docs/pages/identity-security/access-graph/access-graph.mdx
@@ -0,0 +1,28 @@
+---
+title: "Self-Hosting Teleport Identity Security"
+sidebar_label: Self-Host Teleport Identity Security
+description: Explains how to deploy Access Graph alongside a self-hosted Teleport cluster.
+tags:
+ - identity-security
+ - access-risks
+sidebar_position: 4
+enterprise: Identity Security
+---
+
+If you run a self-hosted Teleport cluster, using Teleport Identity Security
+requires running the **Teleport Access Graph Service** on your own
+infrastructure. 
+
+By default, the Access Graph Service enables access path exploration features,
+including the Dashboard, Browse, Crown Jewels, Graph Explorer, and SQL Editor
+views.
+
+If you enable **Teleport Identity Activity Center** on the Access Graph Service
+and deploy its supporting infrastructure, Teleport Identity Security will
+provide audit log centralization and querying, including the Browse and Alerts
+views.
+
+The following guides show you how to deploy the Access Graph Service and support
+Identity Activity Center on your own infrastructure:
+
+<DocCardList />
diff --git a/docs/pages/identity-security/access-graph/identity-activity-center.mdx b/docs/pages/identity-security/access-graph/identity-activity-center.mdx
new file mode 100644
index 0000000000000..a6455789ddbca
--- /dev/null
+++ b/docs/pages/identity-security/access-graph/identity-activity-center.mdx
@@ -0,0 +1,259 @@
+---
+title: "Self-Hosting Identity Activity Center"
+sidebar_label: Identity Activity Center
+description: Explains how to enable Identity Activity Center.
+tags:
+ - how-to
+ - identity-security
+ - aws
+ - access-risks
+enterprise: Identity Security
+---
+
+In this guide, you will set up the infrastructure required
+to enable the Identity Activity Center in Teleport's Identity Security product.
+Identity Activity Center allows you to centralize audit logs and access paths from various sources
+for enhanced visibility and management.
+
+(!docs/pages/includes/policy/identity-activity-center.mdx!)
+
+Identity Activity Center is a feature of [Teleport Identity Security](https://goteleport.com/platform/identity-security/)
+product that is only available to Teleport Enterprise customers.
+
+## How it works
+
+Teleport Identity Security uses an AWS SQS queue to publish and consume audit logs.
+When deployed in high-availability mode, Teleport Identity Security elects a leader
+that's responsible for consuming messages from the queue, converting and enhancing
+them with metadata such as location, and writing them as Parquet files in the
+long-term S3 bucket.
+
+Amazon Athena powers a query engine in the Identity Activity Center. To specify
+the schema and retrieve data from Parquet files kept in the long-term S3 bucket,
+Amazon Athena makes use of an AWS Glue Table. With this configuration, audit
+logs can be efficiently queried and analyzed, leading to improved insights and
+simplified data management for identity security.
+
+## Prerequisites
+- A running Teleport Enterprise cluster v18.0.0 or later.
+- An updated Teleport Enterprise license file with Teleport Identity Security enabled.
+- A PostgreSQL database server v14 or later.
+  - Access Graph needs a dedicated [database](https://www.postgresql.org/docs/current/sql-createdatabase.html) to store its data.
+    The user that Teleport connects to the database with needs to be the owner of this database, or have similar broad permissions:
+    at least the `CREATE TABLE` privilege on the `public` schema, and the `CREATE SCHEMA` privilege.
+  - Amazon RDS for PostgreSQL is supported.
+- A TLS certificate for the Access Graph service
+- A running Access Graph node v1.28.0 or later.
+  Check the [Identity Security page](../identity-security.mdx) for details on
+  how to set up Access Graph.
+
+
+<Admonition type="note">
+
+The Identity Activity Center is currently supported only for self-hosted clusters.
+Teleport Enterprise Cloud support is planned for release later this year.
+
+</Admonition>
+
+## Step 1/4. Infrastructure setup
+
+You can set up the required infrastructure to support the Identity Activity Center with the
+following Terraform script.
+
+<details>
+<summary>Terraform script</summary>
+
+Below is a list of the required variables along with their descriptions,
+which are necessary for the Terraform script to execute.
+
+- <Var name="eu-central-1"/> is the name of the region where infrastructure should be created.
+- <Var name="example-sqs-queue"/> is the name of the AWS SQS queue.
+- <Var name="example-sqs-dlq"/> is the name of the AWS SQS dead-letter queue.
+- <Var name="example-kms-key"/> is the name of the AWS KMS encryption key used to encrypt S3 bucket files and SQS messages.
+- <Var name="example-long-term-bucket"/> is the long-term S3 bucket used to store the events.
+- <Var name="example-transient-bucket"/> is the transient S3 bucket used to store temporary files such as query results and large files.
+- <Var name="example-db"/> is the name of the AWS Glue database.
+- <Var name="example-table"/> is the name of the AWS Glue table.
+- <Var name="example-workgroup"/> is the name of the Amazon Athena Workgroup.
+- <Var name="aws-account-id"/> is the AWS account id.
+
+Define the variables using the script below or configure them in your
+Teleport IaC script.
+
+```bash
+cat > variables.auto.tfvars << EOF
+aws_region                = "<Var name="eu-central-1"/>"
+iac_sqs_queue_name        = "<Var name="example-sqs-queue"/>"
+iac_sqs_dlq_name          = "<Var name="example-sqs-dlq"/>"
+iac_kms_key_alias         = "<Var name="example-kms-key"/>"
+iac_long_term_bucket_name = "<Var name="example-long-term-bucket"/>"
+iac_transient_bucket_name = "<Var name="example-transient-bucket"/>"
+iac_database_name         = "<Var name="example-db"/>"
+iac_table_name            = "<Var name="example-table"/>"
+iac_workgroup             = "<Var name="example-workgroup"/>"
+EOF
+```
+
+Execute the following Terraform script to create the required infrastructure.
+
+### `variables.tf`
+
+`variables.tf` file includes the description of the required Terraform variables.
+
+```hcl
+(!examples/identity-activity-center/variables.tf!)
+```
+
+### `identity_activity_center.tf`
+
+`identity_activity_center.tf` file includes the declaration of every resource
+that Terraform will create and manage. This includes AWS KMS keys, AWS S3 Buckets
+for transient and long-term storage, and AWS Glue table and database.
+
+```hcl
+(!examples/identity-activity-center/identity_activity_center.tf!)
+```
+
+### `policy.tf`
+
+`policy.tf` includes the declaration of the AWS IAM policy that must
+be attached to the AWS identity that the Identity Security service runs as,
+enabling it to access the resources and execute queries. If using an E2 instance
+for Identity Security, attach the policy to the instance role. If using ECS or EKS,
+attach the policy to the task or pod role.
+
+```hcl
+(!examples/identity-activity-center/policy.tf!)
+```
+
+The Terraform script will output two variables:
+
+- `identity_activity_center_iam_policy`: AWS IAM policy required for Identity Security to connect to AWS resources. Attach the policy to the Identity Security AWS IAM role.
+- `identity_activity_center_yaml`: YAML configuration to append to the Identity Security configuration or Helm chart values.
+
+</details>
+
+## Step 2/4. Configure MaxMind GeoIP City database (optional)
+
+<Admonition type="note">
+
+MaxMind GeoIP database configuration is optional, but we do recommend it for geolocation tracking.
+
+</Admonition>
+
+
+To enrich audit events with GeoIP details such as country, city, region, latitude,
+and longitude based on IP addresses, we strongly recommend using the
+[MaxMind GeoIP City database](https://www.maxmind.com/en/geoip-databases).
+
+MaxMind provides both free and paid versions of its GeoIP City database.
+The free version is less accurate and updated less frequently compared to
+the paid version. You can find instructions for downloading the free
+version or purchasing the paid version on the
+[MaxMind Developer website](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data/).
+
+<Tabs>
+<TabItem label="Self-hosted cluster" >
+
+To configure enhanced location details for self-hosted clusters, upload the database file to the machine where
+Identity Security runs. You will specify its location in the config file below.
+
+</TabItem>
+
+<TabItem label="Self-hosted cluster using Helm Chart">
+
+To configure enhanced location details for self-hosted clusters installed using the Helm Chart, first create
+the secret that contains the IP database:
+
+```bash
+$ kubectl create secret generic maxmind-geoip-city-db --from-file=GeoLite2-City.mmdb
+
+```
+</TabItem>
+</Tabs>
+
+
+## Step 3/4. Modify Identity Security configuration
+
+<Tabs>
+<TabItem label="Self-hosted cluster" >
+
+To configure it for self-hosted clusters, update the Identity Security configuration and
+append the following section:
+
+```yaml
+# Configuration for Teleport Access Graph service.
+# Example: /etc/access_graph/config.yaml
+# Add the following section to enable Identity Activity Center.
+# ...
+identity_activity_center:
+  region: <Var name="eu-central-1"/>
+  database: <Var name="example-db"/>
+  table: <Var name="example-table"/>
+  s3: s3://<Var name="example-long-term-bucket"/>/data/
+  s3_results: s3://<Var name="example-transient-bucket"/>/results/
+  s3_large_files: s3://<Var name="example-transient-bucket"/>/large_files
+  workgroup: <Var name="example-workgroup"/>
+  sqs_queue_url: https://sqs.<Var name="eu-central-1"/>.amazonaws.com/<Var name="aws-account-id"/>/<Var name="example-sqs-queue"/>
+  maxmind_geoip_city_db_path: /path/to/geoIp-city.mmdb # optional
+# ...
+```
+
+</TabItem>
+
+<TabItem label="Self-hosted cluster using Helm Chart">
+
+To configure it for self-hosted clusters installed using the Helm Chart, update your
+Helm chart values with the following details:
+
+```yaml
+
+# optional
+ volumes:
+ - name: maxmind-geoip-city-db
+   secret:
+     secretName: maxmind-geoip-city-db
+     optional: false
+
+# optional
+ volumeMounts:
+ - name: maxmind-geoip-city-db
+   mountPath: "/etc/maxmindGeoIP/"
+   readOnly: true
+
+identity_activity_center:
+  enabled: true
+  region: <Var name="eu-central-1"/>
+  database: <Var name="example-db"/>
+  table: <Var name="example-table"/>
+  s3: s3://<Var name="example-long-term-bucket"/>/data/
+  s3_results: s3://<Var name="example-transient-bucket"/>/results/
+  s3_large_files: s3://<Var name="example-transient-bucket"/>/large_files
+  workgroup: <Var name="example-workgroup"/>
+  sqs_queue_url: https://sqs.<Var name="eu-central-1"/>.amazonaws.com/<Var name="aws-account-id"/>/<Var name="example-sqs-queue"/>
+  maxmind_geoip_city_db_path: "/etc/maxmindGeoIP/GeoLite2-City.mmdb" # optional
+```
+
+Run `helm upgrade` to re-deploy Identity Security.
+
+</TabItem>
+</Tabs>
+
+
+## Step 4/4. Restart Identity Security
+
+<Tabs>
+<TabItem label="Self-hosted cluster" >
+
+The final step is to restart the Identity Security docker process or restart the process
+so it can reload the latest configuration.
+
+</TabItem>
+
+<TabItem label="Self-hosted cluster using Helm Chart">
+
+The final step is to wait for the Identity Security Deployment to complete the rollout
+of the new replicas.
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted-helm.mdx b/docs/pages/identity-security/access-graph/self-hosted-helm.mdx
similarity index 86%
rename from docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted-helm.mdx
rename to docs/pages/identity-security/access-graph/self-hosted-helm.mdx
index 525198d853b25..8fbad3873312c 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/access-graph/self-hosted-helm.mdx
+++ b/docs/pages/identity-security/access-graph/self-hosted-helm.mdx
@@ -1,6 +1,12 @@
 ---
 title: Run Teleport Identity Security with Access Graph on Self-Hosted Clusters with Helm
+sidebar_label: Helm
 description: How to deploy Access Graph on self-hosted clusters using Helm.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
 ---
 
 Using Teleport Identity Security with Access Graph on a self-hosted Teleport cluster requires
@@ -11,20 +17,31 @@ to collect information about resources and access.
 This guide will help you set up the Access Graph service in a Kubernetes cluster using a Helm Chart,
 and enable the Access Graph feature in your Teleport cluster.
 
-The full listing of supported parameters can be found in the [Helm chart reference](../../../reference/helm-reference/teleport-access-graph.mdx).
+The full listing of supported parameters can be found in the [Helm chart reference](../../reference/helm-reference/teleport-access-graph.mdx).
 
 Access Graph is a feature of the [Identity Security](https://goteleport.com/platform/policy/) product that is only available
 to Teleport Enterprise customers.
 
+## How it works
+
+Unlike Teleport services like the Auth Service, Proxy Service, and agent
+services, Teleport Access Graph does not run from the `teleport` binary, but as
+a separate piece of software available from Teleport as a container image.
+Teleport Access Graph uses TLS credentials to authenticate to the Teleport Auth
+Service. It must also connect to PostgreSQL for its backing storage. After
+obtaining credentials from your Teleport cluster, you create a configuration
+file for Teleport Access Graph and install the `teleport-access-graph` Helm
+chart.
+
 ## Prerequisites
 
 - Kubernetes >= v1.21
 - Helm >= (=helm.version=)
-- A running Teleport Enterprise cluster v14.3.6 or later.
+- A running Teleport Enterprise cluster v18.0.0 or later.
   - For the purposes of this guide, we assume that the Teleport cluster is set up
-    [using the `teleport-cluster` Helm chart](../helm-deployments/helm-deployments.mdx)
+    [using the `teleport-cluster` Helm chart](../../zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx)
     in the same Kubernetes cluster that will be used to deploy Access Graph.
-- An updated `license.pem` with Identity Security enabled.
+- An updated Teleport Enterprise license file with Teleport Identity Security enabled.
 - A PostgreSQL database server v14 or later.
   - Access Graph needs a dedicated [database](https://www.postgresql.org/docs/current/sql-createdatabase.html) to store its data.
     The user that Teleport connects to the database with needs to be the owner of this database, or have similar broad permissions:
@@ -152,7 +169,7 @@ the Auth Service configuration needs to be updated with:
 - The path to the CA which issued the Access Graph service TLS certificate.
   - This path must refer to a volume containing the CA, mounted on the Teleport pods.
   - Specifying the CA certificate file can be skipped if you are using a CA that is already trusted by the Teleport cluster
-    (e.g. via the [`tls.existingCASecretName` option](../../../reference/helm-reference/teleport-cluster.mdx)),
+    (e.g. via the [`tls.existingCASecretName` option](../../reference/helm-reference/teleport-cluster.mdx)),
     or if the certificate was issued by a CA included in the [Mozilla CA Certificate List](https://wiki.mozilla.org/CA/Included_Certificates).
 
 Create a ConfigMap containing the CA certificate as follows:
@@ -205,10 +222,10 @@ $ kubectl -n <Var name="teleport-cluster-namespace" /> rollout restart deploymen
 $ kubectl -n <Var name="teleport-cluster-namespace" /> rollout status deployment/teleport-proxy  # Wait for the deployment to succeed
 ```
 
-## Step 4/4. View the Access Graph in the Web UI
+## Step 4/4. View Access Graph data in the Graph Explorer
 
-You can find the Access Graph in the "Access Management" tab in the Web UI.
-![Access Management menu item](../../../../img/access-graph/menu-item.png)
+In order to visualize the data from the Access Graph service, use the Graph Explorer in the Web UI. 
+Click **Identity Security** --> **Graph Explorer** and then select a resource to view in the Graph Explorer. 
 
 To access the interface, your user must have a role that allows `list` and `read` verbs on the `access_graph` resource, e.g.:
 
@@ -228,3 +245,8 @@ spec:
 ```
 
 The preset `editor` role has the required permissions by default.
+
+
+## Next steps
+
+- Configure [Identity Activity Center](./identity-activity-center.mdx)
diff --git a/docs/pages/identity-security/access-graph/self-hosted.mdx b/docs/pages/identity-security/access-graph/self-hosted.mdx
new file mode 100644
index 0000000000000..0707853ca9e0a
--- /dev/null
+++ b/docs/pages/identity-security/access-graph/self-hosted.mdx
@@ -0,0 +1,170 @@
+---
+title: Run Teleport Identity Security on Self-Hosted Clusters
+sidebar_label: Docker 
+description: Describes how to deploy Access Graph on self-hosted clusters.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+This guide shows you how to set up Teleport Access Graph in a self-hosted
+Teleport cluster.
+
+## How it works
+
+Unlike Teleport services like the Auth Service, Proxy Service, and agent
+services, Teleport Access Graph does not run from the `teleport` binary, but as
+a separate piece of software available from Teleport as a container image.
+Teleport Access Graph uses TLS credentials to authenticate to the Teleport Auth
+Service. It must also connect to PostgreSQL for its backing storage. After
+obtaining credentials from your Teleport cluster, you create a configuration
+file for Teleport Access Graph and start a container that loads the
+configuration file and Teleport credentials.
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster.
+- An updated Teleport Enterprise license file with Teleport Identity Security enabled.
+- Docker version v(=docker.version=) or later.
+- A PostgreSQL database server v14 or later.
+  - Access Graph needs a dedicated [database](https://www.postgresql.org/docs/current/sql-createdatabase.html) to store its data.
+    The user that Access Graph connects to the database with needs to be the owner of this database, or have similar broad permissions:
+    at least the `CREATE TABLE` privilege on the `public` schema, and the `CREATE SCHEMA` privilege.
+  - Amazon RDS for PostgreSQL is supported.
+- A TLS certificate for the Access Graph service
+  - The TLS certificate must be issued for "server authentication" key usage,
+    and must list the IP or DNS name of the Access Graph service in an X.509 v3 `subjectAltName` extension.
+  - Starting from version 1.20.4 of the Access Graph service, the container runs as a non-root user by default.
+    Make sure the certificate files are readable by the user running the container. You can set correct permissions with the following command:
+    ```code
+    $ sudo chown 65532 /etc/access_graph/tls.key
+    ```
+- The node running the Access Graph service must be reachable from Teleport Auth Service and Proxy Service.
+
+<Admonition type="warning">
+    The deployment with Docker is suitable for testing and development purposes. For production deployments,
+    consider using the Access Graph Helm chart to deploy this service on Kubernetes.
+    Refer to [Helm chart for Access Graph](self-hosted-helm.mdx) for instructions.
+</Admonition>
+
+## Step 1/3. Set up Access Graph
+
+You will need a copy of your Teleport cluster's host certificate authority (CA) on the machine that hosts the Access Graph service.
+The service requires incoming connections to be authenticated via host certificates that the host CA issues to the Auth Service and Proxy Service.
+
+The host CA can be retrieved and saved into a file in one of the following ways:
+
+<Tabs>
+<TabItem label="Via curl">
+```code
+$ sudo mkdir /etc/access_graph
+$ curl -s 'https://<Var name="teleport.example.com" />/webapi/auth/export?type=tls-host' | sudo tee /etc/access_graph/teleport_host_ca.pem
+```
+</TabItem>
+
+<TabItem label="Via tctl">
+```code
+$ sudo mkdir /etc/access_graph
+$ tsh login --proxy=<Var name="teleport.example.com" />
+$ tctl get cert_authorities --format=json \
+    | jq -r '.[] | select(.spec.type == "host") | .spec.active_keys.tls[].cert' \
+    | base64 -d | sudo tee /etc/access_graph/teleport_host_ca.pem
+```
+</TabItem>
+</Tabs>
+
+Then, on the same machine, create a configuration file for the Access Graph service, similar to this:
+
+```yaml
+# Configuration for Teleport Access Graph service.
+# Example: /etc/access_graph/config.yaml
+backend:
+  postgres:
+    # This uses the PostgreSQL connection URI format, see https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS
+    # A stricter `sslmode` value is strongly recommended,
+    # e.g. `sslmode=verify-full&sslrootcert=/etc/access_graph/my_postgres_ca.crt`.
+    # For a full reference on possible parameters see https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
+    connection: postgres://access_graph_user:my_password@db.example.com:5432/access_graph_db?sslmode=require
+
+    # When running on Amazon RDS, IAM auth via credentials set in the environment can be used as follows:
+    # iam:
+    #   aws_region: us-west-2
+
+# IP address (optional) and port for the Access Graph service to listen to.
+# This is the default value. This key can be omitted to listen on port 50051 on all interfaces.
+address: ":50051"
+
+# Example Identity Activity Center configuration.
+# identity_activity_center:
+#   region: eu-central-1
+#   database: example-db
+#   table: example-table
+#   s3: s3://example-long-term-bucket/data/
+#   s3_results: s3://example-transient-bucket/results/
+#   s3_large_files: s3://example-transient-bucket/large_files
+#   workgroup: example-workgroup
+#   sqs_queue_url: https://sqs.eu-central-1.amazonaws.com/aws-account-id/example-sqs-queue
+#   maxmind_geoip_city_db_path: "/etc/maxmindGeoIP/GeoLite2-City.mmdb" # optional
+
+tls:
+  # File paths of PEM-encoded TLS certificate and private key for the Access Graph server.
+  cert: /etc/access_graph/tls.crt
+  key: /etc/access_graph/tls.key
+
+# This lists the file paths for host CAs of Teleport clusters that are allowed to register with this Access Graph service.
+# Several paths can be included to allow several Teleport clusters to connect to the Access Graph service.
+registration_cas:
+  - /etc/access_graph/teleport_host_ca.pem # A full path to the file containing the Teleport cluster's host CA certificate.
+```
+
+Finally, start the Access Graph service using Docker as follows:
+
+```console
+$ docker run -p 50051:50051 -v <path-to-config>:/app/config.yaml -v /etc/access_graph:/etc/access_graph public.ecr.aws/gravitational/access-graph:(=access_graph.version=)
+```
+
+## Step 2/3. Update the Teleport Auth Service configuration
+
+In the YAML config for the Auth Service, add a new top-level section for Access Graph configuration.
+
+```yaml
+access_graph:
+  enabled: true
+  # host:port where the Access Graph service is listening
+  endpoint: access-graph.example.com:50051
+  # Specify a trusted CA we expect the Access Graph server certificate to be signed by.
+  # If not specified, the system trust store will be used.
+  ca: /etc/access_graph_ca.pem
+```
+
+Then, restart Auth Service instances, followed by Proxy Service instances.
+
+## Step 3/3. View Access Graph data in the Graph Explorer
+
+In order to visualize the data from the Access Graph service, use the Graph Explorer in the Web UI. 
+Click **Identity Security** --> **Graph Explorer** and then select a resource to view in the Graph Explorer. 
+
+To access the interface, your user must have a role that allows `list` and `read` verbs on the `access_graph` resource, e.g.:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: my-role
+spec:
+  allow:
+    rules:
+    - resources:
+      - access_graph
+      verbs:
+      - list
+      - read
+```
+
+The preset `editor` role has the required permissions by default.
+
+## Next steps
+
+- Configure [Identity Activity Center](./identity-activity-center.mdx)
diff --git a/docs/pages/identity-security/identity-security.mdx b/docs/pages/identity-security/identity-security.mdx
new file mode 100644
index 0000000000000..91898996bfd10
--- /dev/null
+++ b/docs/pages/identity-security/identity-security.mdx
@@ -0,0 +1,142 @@
+---
+title: Teleport Identity Security
+description: An overview of Teleport Identity Security.
+template: landing-page
+tags:
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+import LandingHero from '@site/src/components/Pages/Landing/LandingHero';
+import TextWithMedia from "@site/src/components/Pages/Landing/TextWithMedia";
+import UseCasesList from "@site/src/components/Pages/Landing/UseCasesList";
+import Integrations from "@site/src/components/Pages/Homepage/Integrations";
+
+import identitySecurityImg from '@version/docs/img/identity-security/identity-security-hero.png';
+import bookOpenSvg from "@site/src/components/Icon/teleport-svg/book-open.svg";
+import identificationBadgeSvg from "@site/src/components/Icon/teleport-svg/identification-badge.svg";
+import listBulletsSvg from "@site/src/components/Icon/teleport-svg/list-bullets.svg";
+import verifySvg from "@site/src/components/Icon/teleport-svg/verify.svg";
+import githubSvg from "@site/src/components/Icon/svg/github.svg";
+import awsSvg from "@site/src/components/Icon/teleport-svg/aws.svg";
+import oktaSvg from "@site/src/components/Icon/teleport-svg/okta.svg";
+import teleportSvg from "@site/src/components/Icon/teleport-svg/teleport.svg";
+import video from "@site/src/components/Pages/Landing/TextWithMedia/identity-security.mp4";
+
+<LandingHero
+  title="Teleport Identity Security"
+  youtubeVideoId="JJftMAwMld8"
+  links={[
+    {
+      title: "Self-Hosting Guide",
+      description: "Deploy Identity Security in a self-hosted cluster (enabled by default for managed Enterprise customers)",
+      href: "./access-graph/",
+      icon: identificationBadgeSvg,
+    },
+    {
+      title: "Key Concepts",
+      description: "Understand Access Graph visualization, Crown Jewels, and access relationships",
+      href: "./usage/",
+      icon: listBulletsSvg,
+    },
+  ]}
+>
+  Teleport Identity Security centralizes access policy across your infrastructure, consolidates disparate identity audit logs, discovers shadow access, and alerts on access anomalies. It helps you quickly answer:
+  - What resources can a specific user access?
+  - What actions do users perform when connecting to systems?
+  - How are users, roles, and resources connected?
+  - Can users gain access to resources outside of defined RBAC policies?
+  - Can users interact with resources in ways that bypass audit logging?
+
+</LandingHero>
+
+<UseCasesList
+  title="Use cases"
+  useCases={[
+    {
+      title: "Expose hidden access risks",
+      description: "Scan for insecure SSH keys and access paths",
+      href: "./integrations/ssh-keys-scan/",
+    },  
+    {
+      title: "Identify over-privileged users",
+      description: "Identify users with excessive standing privileges",
+      href: "./usage/dashboard/",
+    },
+    {
+      title: "Monitor changes to critical resources",
+      description: "Monitor, alert on, and visualize access changes",
+      href: "./usage/crown-jewels/",
+    },  
+    {
+      title: "Alert on anomalous activity",
+      description: "AI alerting on risky access patterns in your infrastructure",
+      href: "./usage/alerts/",
+    },
+    {
+      title: "Unify logs from key systems",
+      description: "Unify logs from Okta, AWS, GitHub, and more",
+      href: './integrations/',
+    },  
+    {
+      title: "Query roles, groups, and permissions",
+      description: "Create custom-tailored queries w/the SQL Editor",
+      href: "./usage/sql-editor",
+    },
+  ]}
+/>
+
+<TextWithMedia
+  title="Visualize access relationships"
+  videoSrc={video}
+>
+  Use Graph Explorer to explore real-time identity-to-resource paths, quickly spotting where access is allowed or denied. Run custom SQL queries using [SQL Editor](./usage/sql-editor.mdx) to analyze
+  [connections](./usage/graph-explorer.mdx) (identities, user group, and actions).
+
+  **[View Standing Privileges](./usage/dashboard.mdx)**  
+  **[Set up Crown Jewels](./usage/crown-jewels.mdx)**  
+  **[Manage Audit Events](./integrations/teleport.mdx)**
+</TextWithMedia>
+
+<Integrations
+  title="Integrations"
+  integrations={[
+    {
+      title: 'GitHub',
+      description: 'Connect GitHub and stream audit logs, map permissions, and track user behavior to stay ahead of access issues.',
+      href: './integrations/github/',
+      iconColor: '#0000001A',
+      iconComponent: githubSvg,
+    },
+    {
+      title: 'Okta',
+      description: 'Integrate your Okta account to visualize your access policies, user roles, and group memberships.',
+      href: '../identity-governance/integrations/okta/',
+      iconColor: '#0000001A',
+      iconComponent: oktaSvg,
+    },
+    {
+      title: 'AWS',
+      description: 'Leverage the power of Access Graph by connecting AWS account to visualize IAM roles, policies, and access relationships.',
+      href: './integrations/aws-sync/',
+      iconColor: '#E87B0C1A',
+      iconComponent: awsSvg,
+    },
+    {
+      title: 'Teleport',
+      description: 'Connect Teleport audit logs to trace the full identity chain from authentication through resource access, enabling ...',
+      href: './integrations/teleport/',
+      iconColor: '#512FC91A',
+      iconComponent: teleportSvg,
+    },
+  ]}
+  mainLink={
+    {
+      title: "View all Integrations",
+      href: "./integrations/"
+    }
+  }
+  desktopColumnsCount={4}
+  noBackgroundColor={true}
+/>
diff --git a/docs/pages/identity-security/integrations/aws-sync.mdx b/docs/pages/identity-security/integrations/aws-sync.mdx
new file mode 100644
index 0000000000000..9cd051d0ba5a5
--- /dev/null
+++ b/docs/pages/identity-security/integrations/aws-sync.mdx
@@ -0,0 +1,378 @@
+---
+title: Discover AWS Access Patterns with Teleport Identity Security
+sidebar_label: AWS
+description: Describes how to import and visualize AWS accounts access patterns using Identity Security.
+tags:
+ - conceptual
+ - identity-security
+ - aws
+ - access-risks
+enterprise: Identity Security
+---
+
+Identity Security streamlines and centralizes access management across your entire infrastructure. You can view access relationships in seconds,
+viewing unified, up-to-date relationships and policies between all users, groups, and computing resources.
+
+Identity Security with Access Graph offers insights into access patterns within your AWS account. By scanning IAM
+permissions, users, groups, resources, and identities, it provides a visual representation and aids in
+enhancing the permission model within your AWS environment. This functionality enables you to address queries such as:
+
+- What resources are accessible to AWS users and roles?
+- Which resources can be reached via identities associated with EC2 instances?
+- What AWS resources can Teleport users access when connecting to EC2 nodes?
+
+Identity Security also offers CloudTrail data ingestion, EKS (Kubernetes) API server audit log ingestion, analysis for
+threats and correlation with other services such as Okta and GitHub Actions.
+
+Utilizing the Access Graph to analyze IAM permissions within an AWS account necessitates the setup of the Access Graph
+service, a Discovery Service, and integration with your AWS account.
+
+(!docs/pages/includes/policy/access-graph.mdx!)
+
+## How it works
+
+Access Graph discovers AWS access patterns, synchronizes various AWS resources,
+including IAM Policies, Groups, Users, User Groups, EC2 instances, EKS clusters, RDS databases, and KMS keys.
+These resources are then visualized using the graph representation detailed in the
+[Identity Security usage page](../usage/usage.mdx).
+
+The importing process involves three primary steps:
+
+### Polling Cloud APIs
+
+The Teleport Discovery Service continuously scans the configured AWS accounts.
+At intervals of 15 minutes, it retrieves the following resources from your AWS account:
+
+- Users
+- Groups
+- User Groups
+- IAM Roles
+- IAM Policies
+- EC2 Instances
+- EKS Clusters
+- RDS Databases
+- S3 Buckets
+- KMS Keys
+
+Once all the necessary resources are fetched, the Teleport Discovery Service pushes them to the
+Access Graph, ensuring that it remains updated with the latest information from your AWS environment.
+
+### Importing resources
+
+Identity Security’s Access Graph feature delves into the IAM policies, identities,
+and resources retrieved from your AWS account, crafting a
+graphical representation thereof.
+
+
+### Importing AWS CloudTrail logs (optional)
+
+If CloudTrail is configured to log activity in your AWS account, it delivers log files to an S3 bucket.
+Identity Activity Center can process trail data in near real time. Enabling Amazon SNS notifications
+in the CloudTrail allows a new notification to be sent whenever a new log file is written.
+This SNS topic is subscribed to an SQS queue, which acts as a buffer for incoming notifications.
+
+Teleport subscribes to the SQS queue using its AWS integration and polls for new messages at regular
+intervals. Each message contains metadata about the new object in S3, such as the bucket name and
+object key. Teleport uses this information to fetch the corresponding CloudTrail log file directly
+from S3.
+
+Once the file is downloaded, Teleport parses the CloudTrail events and processes them for audit and
+security purposes. This allows Identity Activity Center to provide continuous visibility into
+activity across AWS services, including login attempts, API calls, and changes to infrastructure.
+
+
+### Importing Amazon EKS API Server audit logs (optional)
+
+If EKS is configured to log API server audit logs to CloudWatch Logs, Identity Activity Center can
+process these logs in near real time. Teleport will fetch these logs continuously, parsing them for
+audit and security purposes. This allows Identity Activity Center to provide continuous visibility
+into activity within your EKS clusters.
+
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster v18.0.0 or later.
+- Identity Security enabled for your account.
+- For self-hosted clusters:
+  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
+  - A running Access Graph node v1.28.0 or later.
+Check the [Identity Security page](../identity-security.mdx) for details on
+how to set up Access Graph.
+  - The node running the Access Graph service must be reachable from the Teleport Auth Service.
+  - AWS CloudTrail setup with notifications being sent to a SNS topic.
+  - AWS SQS queue receiving raw messages from CloudTrail SNS notifications.
+
+## Step 1/4. Configure Discovery Service (Self-hosted only)
+
+<Admonition type="warning">
+
+If you have a cloud-hosted Teleport Enterprise cluster, you can disregard
+this step, as cloud-hosted Teleport Enterprise already operates a properly configured
+Discovery Service within your cluster.
+</Admonition>
+
+To activate the Teleport Discovery Service, add a top level discovery_service section to the teleport.yaml
+config used by the Auth Service. This service monitors dynamic `discovery_config` resources that are set up
+with the `discovery_group` matching.
+
+<Var name="discovery-group" />.
+```yaml
+discovery_service:
+  enabled: true
+  discovery_group: <Var name="discovery-group" />
+```
+
+Notice that if you already operate a Discovery Service within your cluster,
+it's possible to reuse it as long as the following requirements are met:
+
+- On step 2, you match the `discovery_group` with the existing Discovery Service's
+`discovery_group`.
+- Access Graph service is reachable from the machine where Discovery Service runs.
+
+## Step 2/4. Integrate CloudTrail Events for Identity Activity Center (optional)
+
+To enable the Identity Activity Center CloudTrail integration, you can use an existing
+CloudTrail trail or create a new one. Trails can be scoped to a single AWS account or
+configured as an AWS Organization trail to collect events from multiple accounts.
+If you already have an existing trail, we recommend using it to reduce the costs.
+
+For near real-time access to CloudTrail data, Amazon SNS notifications must be enabled for
+your trail. If SNS notifications are not already configured, go to your trail settings,
+enable **SNS notification delivery**, and create a new SNS topic.
+
+![Show Trail Settings](../../../img/access-graph/aws/trail-settings.png)
+
+After setting up the SNS topic, create a new Standard Amazon SQS queue and subscribe it
+to the SNS topic you just created. The queue must be uniquely used for trail SNS notifications.
+When configuring the subscription, make sure to enable
+the **Enable raw message delivery** option. This setting is required—without it, Identity
+Activity Center won't be able to parse the notifications correctly.
+
+![Show SNS Settings](../../../img/access-graph/aws/sns-settings.png)
+
+Although optional, enabling KMS encryption for both the SQS queue and the target S3 bucket
+is strongly recommended. Be sure to configure the necessary KMS key permissions in the
+following step so that Identity Security can successfully decrypt messages from SQS
+and access CloudTrail logs in the S3 bucket.
+
+## Step 3/4. Integrate Amazon EKS CloudWatch Audit Logs for Identity Activity Center (optional)
+
+To set up near real-time access to EKS API server audit logs, use the AWS web console to
+navigate to the EKS cluster configuration. From the "Observability" tab, in the "Control plane logs"
+section, click the "Manage" button. Then select the "Audit" checkbox to send control plane logs
+to CloudWatch Logs.
+
+![Show EKS Audit Settings](../../../img/access-graph/aws/eks-audit-settings.png)
+
+The default setup performed in step 4 matches all EKS clusters in the configured AWS regions. If
+you want to be more selective about which EKS cluster to fetch logs from, you can create a
+`discovery_config` resource with tags to match the tags on the EKS clusters. Those clusters that
+match the tags will have the API server audit logs fetched from CloudWatch Logs and imported into
+Identity Activity Center.
+
+- <Var name="resource-name" />: The name of the `discovery_config` resource.
+- <Var name="discovery-group" />: The `discovery_group` name matching the existing Discovery Service's `discovery_group` (as described in step 1).
+- <Var name="regions" />: A list of AWS regions in which to discover EKS clusters.
+- <Var name="tag-name" />: The name of a tag that EKS clusters must match, or `"*"` for any tag.
+- <Var name="tag-value" />: The value or list of values that the named tag must have to match, or `"*"` for any value. If a list, only one of the values needs to match.
+
+```yaml
+kind: discovery_config
+version: v1
+metadata:
+  name: <Var name="resource-name" />
+spec:
+  discovery_group: <Var name="discovery-group" />
+  access_graph:
+    aws:
+      - regions: [<Var name="regions" />]
+        eks_audit_logs:
+          tags:
+            <Var name="tag-name" />: <Var name="tag-value" />
+            ...
+```
+
+1. Place this YAML configuration in a file <Var name="discovery_config.yaml" />
+1. Apply this configuration file to your cluster, assigning <Var name="teleport.example.com" />
+   to the domain name of your Teleport Proxy Service in your cluster:
+   ```code
+   $ tctl create --proxy=<Var name="teleport.example.com" /> -f <Var name="discovery_config.yaml" />
+   ```
+
+This will configure Teleport to fetch audit logs for EKS clusters in the specified regions where
+the EKS clusters match the specified tags. The last seven days of logs will be imported and then
+continuously as long as the EKS cluster tags match the discovery configuration.
+
+## Step 4/4. Set up Access Graph AWS Sync
+
+To initiate the setup wizard for configuring AWS Sync, access the Teleport UI,
+click the Identity Security sidebar button, and then click Integrations.
+
+Click the "Setup new integration" button, and then select "AWS". You'll be prompted
+to create a new Teleport AWS integration if you haven't configured one already.
+Alternatively, you can opt for a previously established integration.
+
+Upon selecting or creating the integration, you'll be instructed to execute a
+bash script within your AWS Cloud Shell to configure the necessary permissions.
+
+<details>
+<summary>List of IAM Policies required for AWS Sync</summary>
+
+The policy is designed with a set of read-only actions, enabling Teleport
+to access and retrieve information from resources within your AWS Account.
+
+The IAM policy includes the following directives:
+
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeInstances",
+        "ec2:DescribeImages",
+        "ec2:DescribeTags",
+        "ec2:DescribeSnapshots",
+        "ec2:DescribeKeyPairs",
+
+        "eks:ListClusters",
+        "eks:DescribeCluster",
+        "eks:ListAccessEntries",
+        "eks:ListAccessPolicies",
+        "eks:ListAssociatedAccessPolicies",
+        "eks:DescribeAccessEntry",
+
+        "rds:DescribeDBInstances",
+        "rds:DescribeDBClusters",
+        "rds:ListTagsForResource",
+        "rds:DescribeDBProxies",
+
+        "dynamodb:ListTables",
+        "dynamodb:DescribeTable",
+
+        "redshift:DescribeClusters",
+        "redshift:Describe*",
+
+        "s3:ListAllMyBuckets",
+        "s3:GetBucketPolicy",
+        "s3:ListBucket",
+        "s3:GetBucketLocation",
+        "s3:GetBucketTagging",
+        "s3:GetBucketPolicyStatus",
+        "s3:GetBucketAcl",
+
+        "iam:ListUsers",
+        "iam:GetUser",
+        "iam:ListRoles",
+        "iam:ListGroups",
+        "iam:ListPolicies",
+        "iam:ListGroupsForUser",
+        "iam:ListInstanceProfiles",
+        "iam:ListUserPolicies",
+        "iam:GetUserPolicy",
+        "iam:ListAttachedUserPolicies",
+        "iam:ListGroupPolicies",
+        "iam:GetGroupPolicy",
+        "iam:ListAttachedGroupPolicies",
+        "iam:GetPolicy",
+        "iam:GetPolicyVersion",
+        "iam:ListRolePolicies",
+        "iam:ListAttachedRolePolicies",
+        "iam:GetRolePolicy",
+        "iam:ListSAMLProviders",
+        "iam:GetSAMLProvider",
+        "iam:ListOpenIDConnectProviders",
+        "iam:GetOpenIDConnectProvider",
+
+        "kms:ListKeys",
+        "kms:DescribeKey",
+        "kms:ListResourceTags",
+        "kms:ListAliases",
+        "kms:GetKeyPolicy"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+
+```
+
+If Identity Activity Center is enabled, the following extra configurations are required for CloudTrail
+integration:
+
+- <Var name="aws-sqs-queue"/>: The ARN of the Amazon SQS queue subscribed to the SNS topic that receives CloudTrail notifications.
+- <Var name="aws-s3-trail-bucket"/>: The arn of the Amazon S3 bucket where CloudTrail delivers its log files.
+- <Var name="aws-sqs-kms-queue-key"/>: The ARN of the AWS KMS key used to encrypt messages in the SQS queue.
+- <Var name="aws-s3-kms-key"/>: The ARN of the AWS KMS key used to encrypt objects in the S3 bucket that stores CloudTrail logs.
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:SendMessage"
+      ],
+      "Resource": "<Var name="aws-sqs-queue"/>"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "s3:ListBucket",
+        "s3:ListBucketVersions",
+        "s3:GetBucketLocation"
+      ],
+      "Resource": "<Var name="aws-s3-trail-bucket"/>"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+          "kms:Decrypt",
+          "kms:DescribeKey",
+          "kms:GenerateDataKey",
+          "kms:GenerateDataKeyWithoutPlaintext",
+      ],
+      "Resources": [
+        "<Var name="aws-sqs-kms-queue-key"/>",
+        "<Var name="aws-s3-kms-key"/>",
+      ]
+    }
+  ]
+}
+```
+
+If EKS Audit Log integration is enabled, the IAM policy includes the following directives:
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "logs:FilterLogEvents"
+      ],
+      "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*"
+    }
+  ]
+}
+```
+
+</details>
+
+
+Once the IAM Policy has been successfully linked to the IAM role
+utilized by Teleport, you'll be prompted to specify the regions from
+which Teleport should import resources. This selection solely pertains
+to regional resources and does not impact global resources such as S3
+Buckets, IAM Policies, or IAM Users.
+
+If you're operating a self-hosted cluster, you'll additionally need to
+provide input for the `discovery_group` configured during Step 1.
+
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/azure-sync.mdx b/docs/pages/identity-security/integrations/azure-sync.mdx
similarity index 96%
rename from docs/pages/admin-guides/teleport-policy/integrations/azure-sync.mdx
rename to docs/pages/identity-security/integrations/azure-sync.mdx
index 93b64c9da4702..ecf476a4e44a4 100644
--- a/docs/pages/admin-guides/teleport-policy/integrations/azure-sync.mdx
+++ b/docs/pages/identity-security/integrations/azure-sync.mdx
@@ -1,6 +1,13 @@
 ---
 title: Discover Azure Access Patterns with Teleport Identity Security
-description: Describes how to import and visualize Azure subscription access patterns using Identity Security and Access Graph.
+sidebar_label: Azure
+description: Describes how to import and visualize Azure subscription access patterns using Identity Security.
+tags:
+ - how-to
+ - identity-security
+ - azure
+ - access-risks
+enterprise: Identity Security
 ---
 
 Identity Security streamlines and centralizes access management across your entire infrastructure. You can view access
@@ -25,7 +32,7 @@ Graph service, a Discovery Service, and integration with your Azure subscription
 Access Graph discovers Azure access patterns, synchronizes various Azure resources,
 including users, groups, service principals, and role definitions.
 These resources are then visualized using the graph representation detailed in the
-[Identity Security usage page](../policy-how-to-use.mdx).
+[Identity Security usage page](../usage/usage.mdx).
 
 The importing process involves two primary steps:
 
@@ -54,7 +61,7 @@ Identity Security’s Access Graph feature visualizes the resources retrieved fr
 - Identity Security enabled for your account.
 - For self-hosted clusters:
   - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
-  - A running Access Graph node v1.27.0 or later. Check the [Identity Security page](../teleport-policy.mdx) for details on
+  - A running Access Graph node v1.27.0 or later. Check the [Identity Security page](../identity-security.mdx) for details on
 how to set up Access Graph.
   - The node running the Access Graph service must be reachable from the Teleport Auth Service.
 
diff --git a/docs/pages/identity-security/integrations/entra-id.mdx b/docs/pages/identity-security/integrations/entra-id.mdx
new file mode 100644
index 0000000000000..b0fdb364076ab
--- /dev/null
+++ b/docs/pages/identity-security/integrations/entra-id.mdx
@@ -0,0 +1,540 @@
+---
+title: Analyze Entra ID policies with Teleport Identity Security
+sidebar_label: Microsoft Entra ID
+description: Describes how to import and visualize Entra ID policies using Identity Security and Graph Explorer.
+tags:
+ - how-to
+ - identity-security
+ - azure
+ - access-risks
+enterprise: Identity Security
+---
+
+The Microsoft Entra ID integration in Teleport Identity Governance synchronizes your Entra ID directory into your Teleport cluster,
+and offers insights into relationships in your Entra ID directory.
+Additionally, when Entra ID is used as an SSO identity provider, Identity Security visualizes
+SSO grants across your services.
+
+<Admonition type="note">
+SSO grant analysis is currently only supported in situations where Entra ID acts as the identity provider,
+and AWS accounts are set up as relying parties using AWS IAM role federation.
+
+Support for additional relying parties will be added in the future.
+</Admonition>
+
+## How it works
+
+Teleport continuously scans the connected Entra ID directory.
+At intervals of 5 minutes, it retrieves the following resources from your Entra ID directory:
+
+- Users
+- Groups
+- Users' memberships in groups
+- Enterprise applications
+
+Entra ID users and groups are imported into Teleport as users and Access Lists respectively.
+Once all the necessary resources are fetched, Teleport pushes them to the
+Graph Explorer, ensuring that it remains updated with the latest information.
+These resources are then visualized using the graph representation detailed in the
+[Identity Security usage page](../usage/usage.mdx).
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster v15.4.2/v16.0.0 or later.
+- Teleport Identity Governance and Identity Security enabled for your account.
+- For self-hosted clusters:
+  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
+  - A running Graph Explorer node v1.21.3 or later.
+Check the [Identity Security page](../identity-security.mdx) for details on
+how to set up Graph Explorer.
+  - The node running the Graph Explorer service must be reachable from the Teleport Auth Service.
+- Your user must have privileged administrator permissions in the Azure account
+- For OIDC setup, the Teleport cluster must be publicly accessible from the internet.
+- For air gapped clusters, `tctl` must be v16.4.7 or later.
+
+(!docs/pages/includes/policy/access-graph.mdx!)
+
+## Step 1/3. Choose a setup method
+
+To begin onboarding, select your preferred setup method. Teleport offers various methods based on your cluster
+configuration and user requirements.
+
+### Automatic setup with Teleport as an OIDC Provider for Entra ID
+
+<Admonition type="tip">
+This method is recommended and is required if you are a Teleport Enterprise (Cloud) customer.
+</Admonition>
+
+This method is suitable for Teleport clusters that are publicly accessible and lack Azure credentials on Auth
+Service nodes or pods.
+
+In this setup, Teleport is configured as an OpenID Connect (OIDC) identity provider, establishing a trusted
+connection with an Entra ID application created during setup. This trust allows Teleport to authenticate using
+the Entra ID application, accessing permissions tied to it without requiring additional credentials or managed
+identities.
+
+**Requirements:**
+- Direct bidirectional connectivity between Teleport and Azure is necessary for Azure to validate the OIDC
+tokens issued by Teleport.
+
+### Automatic setup with system credentials for Entra ID authentication
+
+Designed for air-gapped Teleport clusters that are not publicly accessible, this setup accommodates environments
+where Azure cannot validate OIDC tokens issued by Teleport.
+
+Instead, Teleport relies on Azure credentials available on the VMs where Teleport Auth Service is running.
+These credentials must have the following Entra ID permissions:
+
+- `Application.Read.All`
+- `Directory.Read.All`
+- `Policy.Read.All`
+
+**Requirements:**
+- Unidirectional connectivity from Teleport to Azure infrastructure.
+
+### Manual setup
+
+This setup describes how to manually configure Entra ID integration without relying on automated scripts
+to setup Entra ID Application.
+
+This guide covers the
+[**Automatic Setup with Teleport as OIDC Provider for Entra ID**](./entra-id.mdx#automatic-setup-with-teleport-as-an-oidc-provider-for-entra-id)
+and [**Automatic Setup with System Credentials**](./entra-id.mdx#automatic-setup-with-system-credentials-for-entra-id-authentication)
+setup but has a limitation of not being possible to enable the [Identity Security](../identity-security.mdx) integration.
+
+## Step 2/3. Configure the Entra ID integration
+
+
+<Tabs>
+<TabItem label="Teleport as OIDC provider" >
+
+### Start integration onboarding
+
+To start the onboarding process, access the Teleport Web UI, select "Add New" in the left-hand pane, choose "Integration" and then "Microsoft Entra ID".
+
+![Integration selection screen](../../../img/access-graph/entra-id/integrations-page.png)
+
+In the onboarding wizard, choose a Teleport user that will be assigned as the default owner of Access Lists that are created for your Entra groups, and click "Next".
+
+![First step of the Entra ID integration onboarding](../../../img/access-graph/entra-id/integration-wizard-step-1.png)
+
+### Grant permissions in Azure and finish onboarding
+
+The wizard will now provide you with a script that will set up the necessary permissions in Azure.
+
+![Second step of the Entra ID integration onboarding](../../../img/access-graph/entra-id/integration-wizard-step-2.png)
+
+Open Azure Cloud Shell by navigating to <a href="https://shell.azure.com">shell.azure.com</a>,
+or by clicking the Cloud Shell icon in the Azure Portal.
+
+![Location of the Cloud Shell button in the Azure Portal](../../../img/access-graph/entra-id/azure-cloud-shell-button.png)
+
+Make sure to use the Bash version of Cloud Shell.
+Once a Cloud Shell instance opens, paste the generated command.
+The command sets up your Teleport cluster as an enterprise application in the Entra ID directory,
+and grants Teleport read-only permissions to read your directory's data (such as users and groups in the directory).
+
+Once the script is done setting up the necessary permissions,
+it prints out the data required to finish the integration onboarding.
+
+![Output of the Entra ID onboarding script](../../../img/access-graph/entra-id/onboarding-script-output.png)
+
+Back in the Teleport Web UI, fill out the required data and click "Finish".
+
+![Second step of the Entra ID integration onboarding with required fields filled in](../../../img/access-graph/entra-id/integration-wizard-step-2-filled.png)
+
+</TabItem>
+
+<TabItem label="Automatic setup with system credentials" >
+
+### Assign permissions to the Azure identity of your Auth Service VMs
+
+To set up the Azure Identity with the necessary permissions:
+
+- `Application.Read.All`
+- `Directory.Read.All`
+- `Policy.Read.All`
+
+Go to your Azure Dashboard, find the identities linked to your Teleport Auth Service VMs,
+and copy the `Object (principal) ID`. Paste this value into `<Var name="Principal ID" />`.
+
+After obtaining the Principal ID, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/)
+in PowerShell mode and run the following script to assign the required permissions to `<Var name="Principal ID" />`.
+
+<details>
+<summary>Assign required permissions to Azure Identity</summary>
+
+```powershell
+
+# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
+Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'
+
+# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
+$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId '<Var name="Principal ID" />'
+
+# Set the Microsoft Graph enterprise application object.
+# This is a service principal object representing Microsoft Graph in Entra ID with a specific app ID.
+$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+
+# Define the permission scopes that we want to assign to the managed identity.
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.Read.All"   # Permission to read applications in the directory
+  "Directory.Read.All"     # Permission to read directory data
+  "Policy.Read.All"        # Permission to read policies within the directory
+)
+
+# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $graphSPN.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+
+# Iterate over each app role to assign it to the managed identity.
+foreach ($appRole in $appRoles) {
+    # Define the parameters for the role assignment, including the managed identity's principal ID,
+    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
+    $bodyParam = @{
+        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
+        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
+        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
+    }
+
+    # Create a new app role assignment for the managed identity, granting it the specified permissions.
+    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
+}
+
+```
+
+</details>
+
+Your identity principal `<Var name="Principal ID" />` now has the necessary permissions to list Applications,
+Directories, and Policies.
+
+
+### Set up Entra ID and Teleport resources
+
+The Teleport `tctl` command provides an interactive guide to set up and configure Entra ID integration for air-gapped clusters.
+
+To use it, ensure you have `tctl` version v16.4.7 or later and select a default list of Access List owners.
+These specified Teleport users will become the owners of Access Lists imported by the Entra ID integration.
+`<Var name="Access List Owner"/>` must be an existing Teleport user.
+If you prefer multiple Access List owners, repeat the flag with each user, e.g., `--default-owner=owner1 --default-owner=owner2`.
+
+You'll also need to provide the Teleport Auth Service address as `<Var name="example.teleport.sh:443" />`.
+For clusters running in multiplex mode, this address will be the same as your proxy address.
+
+If your Teleport license does not include [Identity Security](../identity-security.mdx), include the `--no-access-graph` flag.
+
+```code
+$ tctl plugins install entraid \
+    --default-owner=<Var name="Access List Owner"/> \
+    --default-owner=someOtherOwner@teleport.sh  \
+    --use-system-credentials \
+    --auth-server <Var name="example.teleport.sh:443" />
+```
+
+To disable the Graph Explorer integration, add the `--no-access-graph` flag.
+
+Follow the detailed instructions provided by the `tctl plugins install entraid` guide to install and configure the Entra ID plugin.
+This guide will walk you through each step required to enable Entra ID integration within your Teleport environment.
+Be sure to follow each step in the `tctl plugins install entraid` guide closely to complete the installation and configuration.
+
+</TabItem>
+
+<TabItem label="Manual setup" >
+
+### Assign permissions to the Azure identity of your Auth Service VMs
+
+This step configures the Azure Identity on your Auth Service machine with the required Entra ID permissions.
+
+<Admonition type="warning">
+Follow this step only if you want to use system-available credentials to authenticate Teleport with Entra ID.
+If you intend to use Teleport as an OIDC provider for Entra ID, you can skip this step.
+</Admonition>
+
+
+- `Application.Read.All`
+- `Directory.Read.All`
+- `Policy.Read.All`
+
+Go to your Azure Dashboard, find the identities linked to your Teleport Auth Service VMs,
+and copy the `Object (principal) ID`. Paste this value into `<Var name="Principal ID" />`.
+
+After obtaining the Principal ID, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/)
+in PowerShell mode and run the following script to assign the required permissions to `<Var name="Principal ID" />`.
+
+<details>
+<summary>Assign required permissions to Azure Identity</summary>
+
+```powershell
+
+# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
+Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'
+
+# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
+$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId '<Var name="Principal ID" />'
+
+# Set the Microsoft Graph enterprise application object.
+# This is a service principal object representing Microsoft Graph in Entra ID with a specific app ID.
+$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+
+# Define the permission scopes that we want to assign to the managed identity.
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.Read.All"   # Permission to read applications in the directory
+  "Directory.Read.All"     # Permission to read directory data
+  "Policy.Read.All"        # Permission to read policies within the directory
+)
+
+# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $graphSPN.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+
+# Iterate over each app role to assign it to the managed identity.
+foreach ($appRole in $appRoles) {
+    # Define the parameters for the role assignment, including the managed identity's principal ID,
+    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
+    $bodyParam = @{
+        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
+        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
+        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
+    }
+
+    # Create a new app role assignment for the managed identity, granting it the specified permissions.
+    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
+}
+
+```
+
+</details>
+
+Your identity principal `<Var name="Principal ID" />` now has the necessary permissions to list Applications,
+Directories, and Policies.
+
+
+### Set up an Entra ID application
+
+In this step, you will manually configure an Entra ID Enterprise Application to be used by the Teleport Auth Connector.
+
+We provide a PowerShell script that creates the specified application, assigns the token signing request, and sets up the necessary SAML parameters.
+
+To proceed, you need to define the following parameters:
+
+- `<Var name="Application name" />`: The Entra ID Application name, typically set to `Teleport your.cluster.address`.
+- `<Var name="example.teleport.sh:443" />`: Your Teleport Proxy address.
+- `<Var name="Auth Connector Name" />`: The Teleport Auth Connector name, usually set to `entra-id`.
+
+Once these parameters are defined, open the [Azure Cloud Shell](https://portal.azure.com/#cloudshell/) in
+PowerShell mode, or use the session created in the previous step.
+
+<details>
+<summary>Create the Entra ID application</summary>
+
+```powershell
+# Connect to Microsoft Graph with required scopes for application creation and app role assignment permissions.
+Connect-MgGraph -Scopes "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"
+
+# Import the Microsoft Graph module for managing applications.
+Import-Module Microsoft.Graph.Applications
+
+# Define application parameters, including the display name.
+$params = @{
+	displayName = '<Var name="Application name" />'  # Set the display name of the new application.
+}
+
+# Set the SAML application template ID.
+# This ID corresponds to a non-gallery SAML application template.
+$applicationTemplateId = "8adf8e6e-67b2-4cf2-a259-e3dc5476c621"
+
+# Instantiate the application template to create a new application and its service principal.
+$app = Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId $applicationTemplateId -BodyParameter $params
+
+# Extract the Application ID, Object ID, and Service Principal ID of the newly created application.
+$appId = $app.Application.AppId       # The unique identifier for the application (client ID).
+$objectId = $app.Application.Id       # The unique object ID for the application in Entra ID.
+$servicePrincipal = $app.ServicePrincipal.Id  # The unique object ID for the service principal.
+
+# Define parameters for the token signing certificate used for SAML.
+$principalTokenSigningCertificateParams = @{
+	displayName = "CN=azure-sso"  # Common Name (CN) for the SAML token signing certificate.
+}
+
+# Add a token signing certificate to the service principal, which is required for SAML authentication.
+$cert = Add-MgServicePrincipalTokenSigningCertificate -ServicePrincipalId $servicePrincipal -BodyParameter $principalTokenSigningCertificateParams
+
+# Extract the thumbprint of the certificate, which will be used to configure SAML.
+$thumbprint = $cert.Thumbprint
+
+# Set additional SAML-specific properties for the service principal.
+$updateServicePrincipalParams = @{
+	preferredSingleSignOnMode = "saml"                    # Set SAML as the single sign-on mode.
+	preferredTokenSigningKeyThumbprint = $thumbprint      # Use the thumbprint of the added certificate for token signing.
+	appRoleAssignmentRequired = $false                    # Allow app access without explicit app role assignments.
+}
+
+# Update the service principal with the SAML configuration.
+Update-MgServicePrincipal -ServicePrincipalId $servicePrincipal -BodyParameter $updateServicePrincipalParams
+
+# Define the URL for the proxy (Teleport Auth Service address).
+# This URL will be used as the Redirect URI and Identifier URI.
+$proxyURL = 'https://<Var name="example.teleport.sh:443" />'.TrimEnd("/").TrimEnd(":443")  # Remove the default 443 port for standard formatting.
+$acsURL = $proxyURL+'/v1/webapi/saml/acs/<Var name="Auth Connector Name"/>'
+
+# Define web properties, including the redirect URI for SAML authentication.
+$web = @{
+	redirectUris = @($acsURL)  # Set the application's redirect URI.
+}
+
+# Update the application with the web properties and identifier URI.
+# This enables SAML-based authentication and includes security group claims.
+Update-MgApplication -ApplicationId $objectId -Web $web -IdentifierUris @($acsURL)
+# Define optional claims for the application to include group membership claims.
+$optionalClaims = [Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaims]::DeserializeFromDictionary(@{
+	AccessToken = @(
+      @{ Name = 'groups' }
+   )
+   IdToken = @(
+	  @{ Name = 'groups' }
+   )
+   Saml2Token = @(
+      @{ Name = 'groups' }
+   )
+})
+
+Update-MgApplication -ApplicationId $objectId -GroupMembershipClaims "SecurityGroup" -OptionalClaims $optionalClaims
+
+
+# Retrieve the tenant ID for display purposes.
+$tenant = Get-AzTenant
+
+# Output the Application ID, Tenant ID, and additional information for reference.
+Write-Output "-------------------------------------------------------" "Copy and paste the following details:" "Application ID (Client ID): $appId" "Tenant ID: $tenant" "-------------------------------------------------------"
+
+```
+
+</details>
+
+If your cluster is publicly accessible from the internet and you prefer or need to use OIDC rather
+than Auth Service system credentials, you can configure Teleport as an OIDC provider for the Entra
+ID application. If you have already assigned the necessary permissions to your Auth Service's Azure
+Identity, you may skip the following section.
+
+To configure Federated credentials for your application, run the following script in the same
+Azure Cloud Shell terminal used previously.
+
+<details>
+<summary>Create Federated Credentials for Entra ID Application"</summary>
+
+```powershell
+
+# Define the subject for the federated identity credential. This is a constant defined in Teleport.
+$subject = "teleport-azure"
+
+# Define the accepted audiences for the credential. It's a constant value.
+$audiences = @("api://AzureADTokenExchange")
+
+# Set the issuer to the Teleport cluster proxy URL.
+$issuer = $proxyURL
+
+# Define a unique name for the federated identity credential. This name is used for identification within the application.
+$name = "teleport-oidc"
+
+# Create a new federated identity credential for the application in Microsoft Graph.
+$credential = New-MgApplicationFederatedIdentityCredential -ApplicationId $objectId -Subject $subject -Audiences $audiences -Issuer $issuer -Name $name
+
+
+# Configure the required permissions for the application.
+
+# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
+$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId $servicePrincipal
+
+
+# Set the Microsoft Graph enterprise application object.
+# This is a service principal object representing Microsoft Graph in Entra ID with a specific app ID.
+$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+
+# Define the permission scopes that we want to assign to the managed identity.
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.Read.All"   # Permission to read applications in the directory
+  "Directory.Read.All"     # Permission to read directory data
+  "Policy.Read.All"        # Permission to read policies within the directory
+)
+
+# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $graphSPN.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+
+# Iterate over each app role to assign it to the managed identity.
+foreach ($appRole in $appRoles) {
+    # Define the parameters for the role assignment, including the managed identity's principal ID,
+    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
+    $bodyParam = @{
+        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
+        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
+        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
+    }
+
+    # Create a new app role assignment for the managed identity, granting it the specified permissions.
+    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
+}
+
+```
+
+</details>
+
+### Set up Teleport resources
+
+The Teleport `tctl` command provides an interactive guide to set up and configure Entra ID integration for air-gapped clusters.
+
+To use it, ensure you have `tctl` version v16.4.7 or later and select a default list of Access List owners.
+These specified Teleport users will become the owners of Access Lists imported by the Entra ID integration.
+`<Var name="Access List Owner"/>` must be an existing Teleport user.
+If you prefer multiple Access List owners, repeat the flag with each user, e.g., `--default-owner=owner1 --default-owner=owner2`.
+
+You'll also need to provide the Teleport Auth Service address as `<Var name="example.teleport.sh:443"/>`.
+For clusters running in multiplex mode, this address will be the same as your proxy address.
+
+If you chose to use Teleport as the OIDC provider for Entra ID in the previous step, remove the `--use-system-credentials`
+flag from the command below.
+
+<Admonition type="note">
+Currently, when using manual mode, it is not possible to operate without the `--no-access-graph` flag.
+</Admonition>
+
+```code
+
+$ tctl plugins install entraid \
+    --default-owner=<Var name="Access List Owner"/> \
+    --default-owner=someOtherOwner@teleport.sh  \
+    --auth-connector-name="<Var name="Auth Connector Name"/>" \
+    --use-system-credentials \
+    --no-access-graph \
+    --manual-setup \
+    --auth-server <Var name="example.teleport.sh:443" />
+
+```
+
+Follow the detailed instructions provided by the `tctl plugins install entraid` guide to install and configure the Entra ID plugin.
+    </TabItem>
+</Tabs>
+
+## Step 3/3. Analyze Entra ID directory in Teleport Graph Explorer
+
+Shortly after the integration onboarding is finished,
+your Entra ID directory will be imported into your Teleport cluster and Graph Explorer.
+
+You can find Entra ID users and groups in the Graph Explorer UI. If you have Entra ID SSO set up for your AWS accounts,
+and the AWS accounts have been connected to Teleport,
+Graph Explorer will also show access to AWS resources granted to Entra ID identities.
+
+In the following example, Bob is assigned to group `AWS-Engineers` in Entra ID.
+This allows him to use SSO to assume the AWS IAM role `Engineers`,
+which in turn allows Bob to access two S3 buckets.
+
+![Example of an Entra ID user's access paths](../../../img/access-graph/entra-id/entra-sso-path.png)
diff --git a/docs/pages/identity-security/integrations/github.mdx b/docs/pages/identity-security/integrations/github.mdx
new file mode 100644
index 0000000000000..ec01c3f70a752
--- /dev/null
+++ b/docs/pages/identity-security/integrations/github.mdx
@@ -0,0 +1,86 @@
+---
+title: Analyze and Correlate GitHub Audit Logs and Access Paths
+sidebar_label: GitHub
+description: Describes how to import and correlate GitHub Audit Logs and Access Paths using Identity Security.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+This guide walks you through configuring Identity Security to import
+GitHub Audit Logs, providing enhanced visibility and alerts for suspicious activities.
+
+(!docs/pages/includes/policy/identity-activity-center.mdx!)
+
+Identity Activity Center is a feature of [Teleport Identity Security](https://goteleport.com/platform/identity-security/)
+product that is only available to Teleport Enterprise customers.
+
+## How it works
+
+Identity Activity Center retrieves GitHub Audit Logs through
+a polling mechanism that executes every minute, standardizing,
+analyzing, and storing them for long-term retention.
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster v18.0.0 or later.
+- Identity Security enabled for your account.
+- For self-hosted clusters:
+  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
+  - A running Access Graph node v1.28.0 or later with Identity Activity Center enabled.
+Check the [Identity Security page](../identity-security.mdx) for details on
+how to set up Access Graph and enable Identity Activity Center.
+- GitHub admin access to an organization.
+
+## Step 1/2. Create a GitHub application
+
+Identity Activity Center accesses your GitHub organization through a GitHub application.
+
+Throughout this guide, you will create a GitHub application, configure the required permissions,
+generate a Private Key, and finally install it into your organization.
+
+First, navigate to your GitHub organization page and select **Settings**. On the left menu,
+expand **Developer settings** and select **GitHub Apps**. In the top-right corner, select
+**New GitHub App**.
+
+Fill in the application name, deactivate **Webhook**, and select the requested permissions:
+
+
+* Repository permissions
+  - Metadata: Read-only
+* Organization permissions
+  - Administration: Read-only
+  - Custom organization roles: Read-only
+  - Custom repository roles: Read-only
+  - Members: Read-only
+  - Personal access token requests: Read-only
+  - Personal access tokens: Read-only
+
+Once selected, click the **Create GitHub App** button. Navigate to the newly created App settings
+and click the **Generate Private Key** button. Clicking this button will trigger a private key
+file download. Save the file for later. Also copy the **Client ID** displayed in
+the App's **About** section.
+
+To restrict access to specific IPs, you can configure the **IP allow list** section
+to allow access only from the Teleport Auth Service’s IP addresses.
+
+Finally, select **Install App** and install the application into the desired organization.
+
+
+## Step 2/2. Set up Audit Log and Access Path Sync
+
+To initiate the setup wizard for configuring GitHub sync, access the Teleport UI,
+click the Identity Security sidebar button, and then click **Integrations**.
+
+Click the **Setup new integration** button, and then select **GitHub**. You'll be prompted
+to create a new Identity Activity Center GitHub integration. During the setup process, you
+will be asked to provide:
+
+- Organization name
+- Private Key downloaded in the previous step
+- Client ID copied in the previous step
+
+Once you complete all the steps, the **Investigations** tab in Identity Security will begin displaying
+GitHub Audit Logs and Access Paths after a few minutes.
diff --git a/docs/pages/identity-security/integrations/gitlab.mdx b/docs/pages/identity-security/integrations/gitlab.mdx
new file mode 100644
index 0000000000000..9e30c2daf5b6d
--- /dev/null
+++ b/docs/pages/identity-security/integrations/gitlab.mdx
@@ -0,0 +1,152 @@
+---
+title: Discover GitLab Access Patterns with Teleport Identity Security
+sidebar_label: GitLab
+description: Describes how to synchronize GitLab access patterns using Identity Security.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+Gain insights into access patterns within your GitLab account using Identity Security with Access Graph. By scanning all
+permissions, users, groups, and projects, it provides a visual representation to help enhance the permission model within
+your GitLab environment. This functionality enables you to answer queries such as:
+
+- What projects are accessible to users?
+- Which users have write permissions to projects?
+
+(!docs/pages/includes/policy/access-graph.mdx!)
+
+## How it works
+
+Access Graph synchronizes various GitLab resources, including users, projects and groups.
+These resources are then visualized using the graph representation detailed in the
+[Access Graph page](../identity-security.mdx).
+
+The importing process involves two primary steps:
+
+### Polling GitLab APIs
+
+The Teleport cluster continuously scans the configured GitLab accounts and retrieves the following resources:
+
+- Users
+- Groups
+- Projects
+- Group memberships
+- Project memberships
+
+Once all the necessary resources are fetched, Teleport pushes them to the
+Access Graph, ensuring that it remains updated with the latest information from your GitLab instance.
+
+### Importing resources
+
+Identity Security’s Access Graph feature delves into the resources imported and their relationships, crafting a
+graphical representation thereof.
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster v15.3.1 or later.
+- Identity Security enabled for your account.
+- A GitLab instance running GitLab v9.0 or later.
+- For self-hosted clusters:
+  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
+  - A running Access Graph node v1.21.4 or later.
+Check the [Identity Security page](../identity-security.mdx) for details on
+how to set up Access Graph.
+  - The node running the Access Graph service must be reachable from the Teleport Auth Service.
+
+## Step 1/3. Create GitLab token
+
+To set up the GitLab integration, you'll need to create a GitLab token with the following permissions:
+
+- `read_api`
+
+Navigate to your GitLab instance, access the User Settings, and select the Access Tokens option.
+Create a new token with the `read_api` scope and copy the generated token. For more information, refer to the
+[GitLab documentation](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html).
+
+The importer will use this token to fetch the necessary resources from your GitLab instance.
+
+<Admonition type="warning">
+
+    The GitLab importer will only fetch resources that the token has access to. Ensure that the user associated with
+    the token has the necessary permissions to access/view the resources you want to import.
+
+    If you're using a GitLab.com account, the importer will only fetch the users who are part of the organization or
+    have access to the projects that the token can access.
+
+    If you're using a self-hosted GitLab instance, the importer will fetch all resources that the token has access to,
+    including all users who are part of the instance.
+
+</Admonition>
+
+The token will be used in the next step to configure the GitLab Sync integration.
+
+## Step 2/3. Set up Access Graph GitLab Sync
+
+To initiate the setup wizard for configuring Gitlab Sync, access the Teleport UI,
+click the Identity Security sidebar button, and then click Integrations.
+
+Click the "Setup new integration" button, and then select "Gitlab". You'll be prompted
+to create a new Teleport Gitlab integration if you haven't configured one already.
+Alternatively, you can opt for a previously established integration.
+
+You'll be prompted to provide the GitLab token created in Step 1 and the GitLab instance domain.
+Once the token is successfully validated, you'll be able to see the resources imported in Access Graph.
+
+## Step 3/3. View GitLab resources in Access Graph
+
+After the GitLab resources are imported, you can view them in the Access Graph page.
+The graph representation will show the relationships between users, groups, and projects within your GitLab instance.
+
+Users can have permissions to access a Group or Project. When a user has access to a Group, they inherit permissions
+to all projects and sub-projects within that group.
+
+You can view the permissions granted to users, groups, and projects by clicking on the respective nodes in the graph.
+
+For example, to view the permissions granted to a user, click on the user node and select `View Access` from the context menu.
+This will display the permissions granted to the user and the resources they have access to.
+
+You can also run queries to fetch specific information from the Access Graph, such as:
+
+### Fetch All Projects Accessible to a User
+
+The following query fetches all projects accessible to a user <Var name="user" />:
+
+```sql
+SELECT * FROM access_path WHERE "identity" = '<Var name="user" />' AND source='Gitlab'
+```
+
+Additionally, you filter projects by the user's access level, `owner`, `maintainer`, `developer`, `guest`, or `reporter`
+by running the following query:
+
+```sql
+SELECT * FROM access_path WHERE "identity" = '<Var name="user" />' AND source='Gitlab' AND action='owner'
+```
+
+Change the `action` parameter to `maintainer`, `developer`, `guest`, or `reporter` to fetch the respective projects.
+
+### Fetch All Users with Write Access to a Project
+
+The following query fetches all users with read/write access to a project named <Var name="project" />:
+
+```sql
+SELECT * FROM access_path WHERE "resource" = '<Var name="project" />' AND source='Gitlab'
+```
+
+## Troubleshooting
+
+After setting up the GitLab integration, you can monitor the import process status on the Access Graph's Integrations page.
+If the import fails, an error message will help identify the issue.
+
+You can also check whether the import process is currently running or has completed successfully by viewing the status.
+
+If you encounter any `Unauthorized` errors, ensure that the GitLab token has the necessary permissions to access the resources
+and that the token is valid. If the token has expired, you'll need to create a new token and update the integration settings.
+
+If you encounter any other issues, please ensure that the Teleport cluster can reach the GitLab instance and that the
+GitLab APIs are accessible.
+
+If you're still facing issues, please inspect the error log on the Access Graph's Integrations page for more details.
+
diff --git a/docs/pages/identity-security/integrations/integrations.mdx b/docs/pages/identity-security/integrations/integrations.mdx
new file mode 100644
index 0000000000000..9774c2ab2f975
--- /dev/null
+++ b/docs/pages/identity-security/integrations/integrations.mdx
@@ -0,0 +1,62 @@
+---
+title: Teleport Identity Security Integrations
+sidebar_label: Integrate your Infrastructure
+description: Integrations in Teleport Identity Security.
+tags:
+ - conceptual
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+Teleport can integrate with identity providers (IdPs) like Okta and AWS OIDC
+which can then be used with Identity Security, providing a comprehensive,
+interactive view of how users, roles, and resources are interconnected, enabling
+administrators to better understand and control access policies.
+
+Read the following guides for information on using Teleport Identity Security to
+visualize role-based access controls from third-party services:
+
+<DocCardList />
+
+## Viewing available integrations
+
+The Integrations page shows integrations that can be enabled or are already
+enabled in Access Graph. Press the **Setup New Integration** button from that page
+to see the available integrations.
+
+Resources imported into Teleport through Teleport-enabled integrations are
+automatically imported into Identity Security without any additional
+configuration.
+
+To access the interface, your user must have a role that allows `list` and `read` verbs on the `access_graph` resource, e.g.:  
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: my-role
+spec:
+  allow:
+    rules:
+    - resources:
+      - access_graph
+      verbs:
+      - list
+      - read
+```
+
+The preset `editor` role has the required permissions by default.
+
+## Set up a new integration
+
+On the left sidebar, click **Identity Security**. Click the connection icon labeled Integrations: 
+![Connection view](../../../img/access-graph/connection_view.png) 
+Select the "Set up new integration" button.
+
+Teleport can also import and grant access to resources from Okta organizations,
+such as user profiles, groups and applications. You can view connection data in
+Access Graph. Enroll the Teleport [Okta
+integration](../../identity-governance/integrations/okta/okta.mdx) in your
+cluster.
+
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/netiq.mdx b/docs/pages/identity-security/integrations/netiq.mdx
similarity index 94%
rename from docs/pages/admin-guides/teleport-policy/integrations/netiq.mdx
rename to docs/pages/identity-security/integrations/netiq.mdx
index ad5e919de5bb3..a6ff61887ac65 100644
--- a/docs/pages/admin-guides/teleport-policy/integrations/netiq.mdx
+++ b/docs/pages/identity-security/integrations/netiq.mdx
@@ -1,6 +1,12 @@
 ---
 title: Discover NetIQ Access Patterns with Teleport Identity Security
-description: Describes how to synchronize OpenTex NetIQ access patterns using Identity Security and Access Graph.
+sidebar_label: NetIQ
+description: Describes how to synchronize OpenTex NetIQ access patterns using Identity Security.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
 ---
 
 Gain insights into your NetIQ organization
@@ -21,7 +27,7 @@ If enabled, Identity Security options can be found under the **Policy** section
 
 Access Graph synchronizes various NetIQ resources, including users, resources, roles, and groups.
 These resources are then visualized in a graph representation, detailed in the
-[Access Graph page](../teleport-policy.mdx).  
+[Access Graph page](../identity-security.mdx).  
 
 The import process involves two primary steps:  
 
@@ -54,7 +60,7 @@ to visualize access structures effectively.
 - For self-hosted clusters:
   - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
   - A running Access Graph node v1.27.0 or later.
-Check the [Identity Security page](../teleport-policy.mdx) for details on
+Check the [Identity Security page](../identity-security.mdx) for details on
 how to set up Access Graph.
   - The node running the Access Graph service must be reachable from the Teleport Auth Service.
 
diff --git a/docs/pages/admin-guides/teleport-policy/integrations/ssh-keys-scan.mdx b/docs/pages/identity-security/integrations/ssh-keys-scan.mdx
similarity index 92%
rename from docs/pages/admin-guides/teleport-policy/integrations/ssh-keys-scan.mdx
rename to docs/pages/identity-security/integrations/ssh-keys-scan.mdx
index 0906363da4452..835ee5cfccf19 100644
--- a/docs/pages/admin-guides/teleport-policy/integrations/ssh-keys-scan.mdx
+++ b/docs/pages/identity-security/integrations/ssh-keys-scan.mdx
@@ -1,6 +1,12 @@
 ---
 title: Discover Insecure SSH Access with Teleport Identity Security
-description: Describes how to enable SSH Key Scanning using Identity Security and Access Graph.
+sidebar_label: SSH Keys
+description: Describes how to enable SSH Key Scanning using Identity Security to identity access patterns that use long-lived SSH keys.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
 ---
 
 Using Identity Security with Access Graph, you can gain insights on how SSH keys are used within your environment. By scanning
@@ -20,7 +26,7 @@ This functionality gives you insights into the following areas:
 Access Graph synchronizes various resources, including SSH authorized keys and private keys.
 
 These resources are then visualized using the graph representation detailed in the
-[Access Graph page](../teleport-policy.mdx).
+[Access Graph page](../identity-security.mdx).
 
 ### Importing SSH authorized keys
 
@@ -42,7 +48,7 @@ Teleport's `tsh` CLI tool can scan users' laptops for SSH private keys.
 It goes through the specified directories, defaulting to `/Users` on macOS, `/home` on Linux, and `C:\Users` on Windows,
 by peeking into files to identify SSH private keys.
 
-The `tsh` tool authenticates with the Teleport cluster through the [Device Trust](../../access-controls/device-trust/device-trust.mdx) feature,
+The `tsh` tool authenticates with the Teleport cluster through the [Device Trust](../../identity-governance/device-trust/device-trust.mdx) feature,
 which guarantees that only enrolled devices can submit private keys to the cluster. By utilizing the device's Secure
 Enclave or TPM private key, it confirms that the device is the same one that was enrolled, enabling Teleport to trust
 and accept the private key reports without requiring further authentication or credentials thus allowing scanning operations
@@ -68,12 +74,12 @@ It also never sends the private key path or any other sensitive information.
 - A running Teleport Enterprise cluster v15.4.16/v16.2.0 or later.
 - Identity Security enabled for your account.
 - A Linux/macOS server running the Teleport SSH Service.
-- Devices enrolled in the [Teleport Device Trust feature](../../access-controls/device-trust/device-trust.mdx).
+- Devices enrolled in the [Teleport Device Trust feature](../../identity-governance/device-trust/device-trust.mdx).
 - For Jamf Pro integration, devices must be enrolled in Jamf Pro and have the signed `tsh` binary installed.
 - For self-hosted clusters:
   - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
   - A running Access Graph node v1.22.0 or later.
-Check the [Identity Security page](../teleport-policy.mdx) for details on
+Check the [Identity Security page](../identity-security.mdx) for details on
 how to set up Access Graph.
   - The node running the Access Graph service must be reachable from the Teleport Auth Service.
 
@@ -106,7 +112,7 @@ and local users.
 
 ## Step 2/3. Scan for SSH private keys
 
-On devices enrolled in the Teleport, you can use the `tsh` CLI tool to scan for SSH private keys. Check [Device Trust](../../access-controls/device-trust/device-trust.mdx)
+On devices enrolled in the Teleport, you can use the `tsh` CLI tool to scan for SSH private keys. Check [Device Trust](../../identity-governance/device-trust/device-trust.mdx)
 for details on how to enroll devices in Teleport, specially if you are using Jamf Pro.
 
 To scan for SSH private keys, run the following command from any enrolled device:
@@ -174,7 +180,7 @@ Below are a few example queries demonstrating how the `ssh_keys` view can be use
 ## Jamf Pro Integration
 
 If you are using Jamf Pro to manage your devices, you can integrate it with Teleport to automate the device enrollment
-process and periodically scan for SSH private keys. Check the [Jamf Pro Integration](../../access-controls/device-trust/jamf-integration.mdx)
+process and periodically scan for SSH private keys. Check the [Jamf Pro Integration](../../identity-governance/device-trust/jamf-integration.mdx)
 page for details on how to set up the device enrollment and scanning process.
 
 On your Jamf Pro page navigate to Settings > Scripts and create a new script command that runs the `tsh scan keys` command
@@ -189,7 +195,7 @@ periodically. The policy should run the command with the required flags and sche
 You can also setup the policy to not run during certain hours or days to avoid disrupting the user experience
 given that the command may consume system resources during the scan.
 
-![Example of a recurring Jamf Pro](../../../../img/access-graph/jamf-pro.png)
+![Example of a recurring Jamf Pro](../../../img/access-graph/jamf-pro.png)
 
 <Admonition type="warning">
     `tsh` must be installed on the devices to run the scan. If the `tsh` binary is not installed, consider distributing it
@@ -204,11 +210,11 @@ Cluster. The keys will be imported and displayed in the Access Graph.
 ### `"device not enrolled"` error
 
 If you see the `device not enrolled` error when running the `tsh scan keys` command, it means that the device is not enrolled
-in the Teleport Device Trust feature. Check the [Device Trust](../../access-controls/device-trust/device-trust.mdx) page for details on how to enroll devices
+in the Teleport Device Trust feature. Check the [Device Trust](../../identity-governance/device-trust/device-trust.mdx) page for details on how to enroll devices
 in Teleport.
 
 ### `"binary missing signature or entitlements"` error
 
 A signed and notarized `tsh` binary is necessary to enroll and use a trusted
-device. [Download the macOS tsh installer](../../../installation.mdx#macos) to fix
+device. [Download the macOS tsh installer](../../installation/installation.mdx) to fix
 the problem.
diff --git a/docs/pages/identity-security/integrations/teleport.mdx b/docs/pages/identity-security/integrations/teleport.mdx
new file mode 100644
index 0000000000000..18b70b106caa7
--- /dev/null
+++ b/docs/pages/identity-security/integrations/teleport.mdx
@@ -0,0 +1,130 @@
+---
+title: Analyze and Correlate Teleport Audit Logs
+sidebar_label: Teleport Audit Logs
+description: Describes how to import and correlate Teleport Audit Logs using Identity Security.
+tags:
+ - how-to
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+In this guide, you will configure your Teleport cluster to forward
+Audit Logs to Identity Security product for better visibility
+and alerts on suspicious activities.
+
+(!docs/pages/includes/policy/identity-activity-center.mdx!)
+
+Identity Activity Center is a feature of [Teleport Identity Security](https://goteleport.com/platform/identity-security/)
+product that is only available to Teleport Enterprise customers.
+
+## How it works
+
+Your Teleport cluster will continuously monitor incoming Audit Logs and
+forward them to Identity Security, where they will be ingested, standardized,
+analyzed, and stored for long-term retention.
+
+## Prerequisites
+
+- A running Teleport Enterprise cluster v18.0.0 or later.
+- Identity Security enabled for your account.
+- For self-hosted clusters:
+  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
+  - A running Access Graph node v1.28.0 or later with Identity Activity Center enabled.
+Check the [Identity Security page](../identity-security.mdx) for details on
+how to set up Access Graph and enable Identity Activity Center.
+
+
+## Step 1/1. Enable Teleport Audit Log export
+
+This section will guide you through the process of configuring your Teleport cluster to
+export audit logs to Teleport Identity Security.
+
+<Admonition type="note">
+
+`start_date` parameter is optional. When not set, it will default to 10 days prior to the first successful
+audit log export. This parameter can't be modified afterwards.
+
+</Admonition>
+
+Please select the deployment mode used to deploy your cluster.
+
+<Tabs>
+<TabItem label="Self-hosted cluster">
+
+When running a self-hosted cluster, edit each one of your Teleport Auth Service
+instances' configuration files, by default `/etc/teleport.yaml`, and merge the
+following YAML snippet:
+
+```yaml
+access_graph:
+    # <...>
+
+    audit_log:
+        # enables Audit Log export from Teleport
+        enabled: true
+        # start_date is an optional field. It defines the date when
+        # Identity Activity Center should ingest the Teleport Logs.
+        # If not defined, it defaults to 10 days prior to the first init.
+        #
+        # start_date: "2025-06-01T00:00:00Z"
+
+```
+
+Once completed, restart your Teleport Auth Service with:
+
+```bash
+$ sudo systemctl restart teleport
+```
+
+</TabItem>
+
+<TabItem label="Self-hosted cluster using Helm Chart">
+
+When the Teleport cluster was installed using `teleport-cluster` Helm chart, update the values for the deployment
+and include the following details:
+
+```yaml
+auth:
+  teleportConfig:
+    # <...>
+
+    # Add a section for configuring the Access Graph connection.
+    access_graph:
+        # <...>
+        audit_log:
+            # enables Audit Log export from Teleport
+            enabled: true
+            # start_date is an optional field. It defines the date when
+            # Identity Activity Center should ingest the Teleport Logs.
+            # If not defined, it defaults to 10 days prior to the first init.
+            #
+            # start_date: "2025-06-01T00:00:00Z"
+
+
+```
+
+`start_date` parameter is optional. When not set, it will default to 10 days prior to the first successful
+audit log export. This parameter can't be modified afterwards.
+
+If not using the `teleport-cluster` Helm chart, you will need to do the equivalent changes to your Teleport cluster deployment:
+- Add the `access_graph:` section at the top-level of the YAML config file for the Teleport Auth Service.
+- Mount the created ConfigMap as a volume so that the Auth Service can read the CA certificate.
+
+Finally, redeploy the Helm chart (assuming the values are stored in
+`values-teleport.yaml`).  Once the Auth Service changes succeed, restart the
+Proxy Service. Assign <Var name="teleport-cluster-deployment-name" /> to the
+name of your `teleport-cluster` deployment:
+
+```code
+$ helm upgrade -n <Var name="teleport-cluster-namespace" /> -f values-teleport.yaml \
+  --version <version> <Var name="teleport-cluster-deployment-name" /> teleport/teleport-cluster
+$ kubectl -n <Var name="teleport-cluster-namespace" /> rollout status deployment/teleport-auth   # Wait for the deployment to succeed
+$ kubectl -n <Var name="teleport-cluster-namespace" /> rollout restart deployment/teleport-proxy
+$ kubectl -n <Var name="teleport-cluster-namespace" /> rollout status deployment/teleport-proxy  # Wait for the deployment to succeed
+```
+
+</TabItem>
+</Tabs>
+
+
diff --git a/docs/pages/identity-security/session-summaries.mdx b/docs/pages/identity-security/session-summaries.mdx
new file mode 100644
index 0000000000000..597ba53e2f8ca
--- /dev/null
+++ b/docs/pages/identity-security/session-summaries.mdx
@@ -0,0 +1,637 @@
+---
+title: Session Recording Summaries
+sidebar_label: Summarize Session Recordings with AI
+description: Describes how to use Teleport Identity security to summarize session recordings with a language model.
+tags:
+  - session-recording
+  - conceptual
+  - identity-security
+  - ai
+enterprise: Identity Security
+---
+
+Teleport Identity Security allows you to generate and view session recording
+summaries for shell and database sessions. This allows you to see at a glance
+what your users do and estimate legitimacy of their actions before digging
+deeper and reviewing the entire recording.
+
+<Admonition type="note">
+**Session Recording Summaries and AI Usage**
+Session Recording Summaries are available to Teleport Enterprise customers with Teleport Identity Security.
+
+**Important**: AI-powered summarization is **disabled by default** in all
+Teleport deployments (both self-hosted and cloud). No AI processing occurs
+unless you explicitly enable this feature. This ensures you have complete
+control over whether and how AI is used with your session recordings.
+
+When you choose to enable summarization, the following options are available:
+
+| Integration mode | Self-hosted Teleport Enterprise | Teleport Enterprise Cloud |
+| --- | --- | --- |
+| Using OpenAI with your own OpenAI key | ✅ | ✅ |
+| Using OpenAI-compatible LLM gateways such as LiteLLM  | ✅ | ✅ (*) |
+| Using Amazon Bedrock models provided by your own AWS account | ✅ | ❌ (**) |
+| Using an Amazon Bedrock model provided by Teleport | ❌ | ❌ (**) |
+
+(*) In case of Teleport Cloud, the Teleport Auth Service must be able to reach
+the LLM gateway. It means the gateway needs to be publicly accessible and
+properly secured. Access to the gateway should be guarded by the equivalent of
+OpenAI API key (e.g. LiteLLM master key).
+
+(**) Amazon Bedrock will be available in Teleport Enterprise
+Cloud later this year.
+
+Existing customers will never have AI features automatically enabled without explicit consent.
+Learn more about the features included in [Teleport Identity Security](https://goteleport.com/platform/identity-security/).
+</Admonition>
+
+## How it works
+
+Teleport can automatically summarize any recorded interactive SSH or Kubernetes
+session, as well as any recorded database session.
+
+After each session finishes, Teleport decides if it should be summarized by
+matching it against a set of policies which route sessions to LLMs. Exactly
+which sessions are summarized and which model is used can be decided on using
+session, resource, and user metadata, such as session kind, session
+participants, resource labels, user traits, etc.
+
+If a match is found, Teleport proceeds to summarize the session recording. It
+uses an inference model configuration indicated by the policy to generate a
+summary using an external inference provider, such as OpenAI or Amazon Bedrock.
+There is no way to run this process on demand.
+
+There are three fundamental concepts to that underpin session summarization:
+
+- **Inference providers** (OpenAI, Amazon Bedrock) do the heavy lifting of
+  summarization.
+- **Inference models** indicate *how* sessions get summarized: they are
+  Teleport configuration resources that provide model settings.
+- **Inference policies** indicate *what* gets summarized and which inference
+  model is used in given case.
+
+<Admonition type="warning">
+This feature is powered by AI leveraging a Large Language Model, and as such,
+its accuracy may vary.
+
+Teleport doesn't currently support any spend controls; controlling the LLM
+token budget is your responsibility.
+</Admonition>
+
+
+## Prerequisites
+
+- A running Teleport Enterprise (Self-Hosted) cluster v18.2.0 or later with Identity 
+  Security enabled.
+- Access to an LLM API. This can be:
+  - OpenAI or OpenAI-compatible inference API, either public or self-hosted.
+  - Amazon Bedrock (available in self-hosted mode only; see the availability
+    table above).
+
+## Step 1/5: Configure access to inference configuration
+
+In order to manage the summary inference configuration, you need a write access
+to `inference_model`, `inference_secret`, and `inference_policy` resources,
+which is granted by default through the preset `editor` role.
+
+Alternatively, you can create a new role to make sure you have
+access to all necessary resources. To create a new role:
+
+1. Create a `summarizer-admin.yaml` file with the following content:
+
+   ```yaml
+   kind: role
+   metadata:
+     name: summarizer-admin
+   spec:
+     allow:
+       rules:
+       - resources:
+         - inference_model
+         - inference_secret
+         - inference_policy
+         verbs:
+         - read
+         - list
+         - create
+         - update
+         - delete
+   version: v7
+   ```
+
+1. Apply your changes:
+
+   ```code
+   $ tctl create -f summarizer-admin.yaml
+   ```
+
+   (!docs/pages/includes/create-role-using-web.mdx!)
+
+1. (!docs/pages/includes/add-role-to-user.mdx role="summarizer-admin"!)
+
+## Step 2/5 : Configure the inference model
+
+In this step, you will create an `inference_model` resource. It tells Teleport
+how to summarize a session by pointing it to a large language model (LLM) API.
+In particular, it contains an API-specific model name. Note that the *Teleport
+inference model name* and *API-specific model name* are two different things.
+This allows, for example, using the same model from providers like OpenAI or
+Amazon Bedrock with different temperature settings, or routing to different API
+gateways by creating multiple Teleport inference models that reference the same
+underlying API-specific model name
+
+<Tabs>
+<TabItem label="OpenAI">
+To communicate with OpenAI, an inference model needs an API key. It's stored
+separately in an `inference_secret` resource and referenced by the
+`inference_model`'s `spec.openai.api_key_secret_ref` field.
+
+<Admonition type="warning">
+To protect your API key, once written, an `inference_secret` value cannot be
+retrieved through `tctl` or Teleport API. It can only be updated or deleted.
+</Admonition>
+
+1. Create an `inference-model.yaml` file with the following content:
+
+   ```yaml
+   kind: inference_model
+   version: v1
+   metadata:
+     name: shell-summary-model
+   spec:
+     openai:
+       # In this scenario, where we connect to OpenAI directly, openai_model_id
+       # needs to be a valid OpenAI model name.
+       openai_model_id: gpt-4o
+       # This value refers to the `inference_secret` resource name.
+       api_key_secret_ref: openai-key
+     # It's a good idea to limit the session length to prevent incurring cost for
+     # sessions that were too long anyway to fit in the model's context window.
+     # If unset, defaults to 200kB. See the Limitations section for more details.
+     max_session_length_bytes: 190000
+
+   ---
+
+   kind: inference_secret
+   version: v1
+   metadata:
+     name: openai-key
+   spec:
+     value: '<paste-your-openai-api-key-here>'
+   ```
+
+1. Apply your changes:
+
+   ```code
+   $ tctl create -f inference-model.yaml
+   ```
+
+</TabItem>
+
+<TabItem label="Amazon Bedrock">
+
+### Pick a model
+
+Depending on the model that you'd like to use, you may need to use an existing
+inference profile in Amazon Bedrock (not to be confused with Teleport inference
+policy) or create a new one. If the model in question supports on-demand
+invocation, an inference profile is not required. As of time of writing, Claude
+3.5 Haiku and Claude 3.5 Sonnet are examples of models that don't require
+creating Amazon Bedrock inference profiles and can be used as is. Use the
+following command to list models that support on-demand invocation:
+
+```sh
+aws bedrock list-foundation-models --by-inference-type=ON_DEMAND --query='modelSummaries[*].modelId'
+```
+
+Refer to Amazon Bedrock documentation for details on inference pricing for
+various models.
+
+### Find or create an Amazon Bedrock inference profile
+
+If you'd like to use a model that doesn't support on-demand invocation, you
+need to first find a system-defined inference profile for that model or create
+your own one. If the model supports on-demand invocation, you can skip this
+part.
+
+To pick a system-defined inference profile for the model of your choosing,
+start by listing all available models and pick a model ARN.
+
+```sh
+aws bedrock list-foundation-models --query='modelSummaries[*].modelArn'
+```
+
+Next, find an inference profile for that model, replacing <Var
+name="bedrock-model-arn"/> with the model ARN:
+
+```sh
+aws bedrock list-inference-profiles --query "inferenceProfileSummaries[?contains(@.models[*].modelArn, '<Var name="bedrock-model-arn"/>')].inferenceProfileArn"
+```
+
+Now that you have an inference profile ARN, you can move on to creating the
+actual model configuration on the Teleport side.
+
+### Ensure that Teleport can invoke models
+
+The Teleport Auth Service must be able to read AWS credentials in order to
+authenticate to Amazon Bedrock.
+
+(!docs/pages/includes/aws-credentials.mdx service="the Teleport Auth Service"!)
+
+In case of invoking a model directly, attach the following AWS IAM policy (not
+to be confused with Teleport inference policy) to the IAM role that is used by
+Teleport to authenticate to Amazon Bedrock:
+
+```yaml
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "bedrock:InvokeModel",
+      "Resource": "<Var name="bedrock-model-arn"/>"
+    }
+  ]
+}
+```
+
+Replace <Var name="bedrock-model-arn"/> with the ARN of the Amazon Bedrock
+model.
+
+If you're using an inference profile, the `Resource` field must instead specify
+the inference profile ARN, as well as ARNS of *all* of the models that given
+inference profile may end up calling. These can be given either as an array of
+specific elements or using wildcards. For more details, see [the Amazon Bedrock
+documentation on prerequisites for using inference
+profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html).
+
+The exact procedure for attaching this policy is different depending on the
+details of your infrastructure; for example, if you are running Teleport on an
+EC2 instance, you should navigate to that instance in the AWS Console, and
+modify the role specified in the **IAM Role** section of the instance summary.
+(If there's no IAM role set, use **Actions -> Security -> Modify IAM role**.) 
+
+### Create an `inference_model` resource
+
+1. Create an `inference-model.yaml` file with the following content:
+
+   ```yaml
+   kind: inference_model
+   version: v1
+   metadata:
+     name: shell-summary-model
+   spec:
+     bedrock:
+       # Indicates a region where the inference will be performed. See below
+       # for more details.
+       region: <Var name="region"/>
+       bedrock_model_id: <Var name="bedrock-model-or-inference-profile-arn"/>
+     # It's a good idea to limit the session length to prevent incurring cost for
+     # sessions that were too long anyway to fit in the model's context window.
+     # If unset, defaults to 200kB. See the Limitations section for more details.
+     max_session_length_bytes: 190000
+   ```
+   
+   Replace <Var name="bedrock-model-or-inference-profile-arn"/> with an ARN of
+   the Amazon Bedrock foundation model or an inference profile. A Bedrock model
+   ID can also be used.
+
+   If a foundation model is directly invoked (i.e. `bedrock_model_id` points to
+   a model, not an inference profile), <Var name="region"/> should be replaced
+   with one of the supported regions for a given model. Consult the [table of
+   model support by AWS
+   region](https://docs.aws.amazon.com/bedrock/latest/userguide/models-regions.html)
+   from the official AWS documentation.
+   
+   If `bedrock_model_id` refers to an inference profile, <Var name="region"/>
+   needs to point to a region specified in the inference profile ARN.
+
+1. Apply your changes:
+
+   ```code
+   $ tctl create -f inference-model.yaml
+   ```
+
+</TabItem>
+</Tabs>
+
+## Step 3/5: Set up an inference policy
+
+In this step, you will add an `inference_policy` resource that routes sessions
+to inference models using session kinds and optional custom filters. Only one
+policy is allowed to match a given session to guarantee that its recording will
+be summarized at most once. Policies are checked in alphabetical order of names
+and the first one that matches is used. Here are some example scenarios that
+can be expressed using inference policies:
+
+- Only summarize sessions to your production resources using resource labels.
+- Use different models for summarizing shell and database sessions.
+
+See [Session matching examples](#session-matching-examples) for details on how
+to configure Teleport to achieve these goals.
+
+To create the required configuration resources:
+
+1. Create an `inference-policy.yaml` file with the following content:
+
+   ```yaml
+   kind: inference_policy
+   version: v1
+   metadata:
+     name: shell-sessions
+     description: Summarize all sessions using OpenAI
+   spec:
+     # Session kinds affected by this policy. Allowed values: "ssh", "k8s", "db".
+     kinds:
+     - ssh
+     - k8s
+     - db
+     # Name of the `inference_model` resource that will be used for summarizing
+     # these sessions.
+     model: shell-summary-model
+   ```
+
+1. Create the inference policy in the backend:
+
+   ```code
+   $ tctl create -f inference-policy.yaml
+   ```
+
+For full description of the inference configuration resources, see appropriate
+sections of [Teleport Resources Reference](../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx):
+
+- [`inference_model`](../reference/infrastructure-as-code/teleport-resources/inference-model.mdx)
+- [`inference_secret`](../reference/infrastructure-as-code/teleport-resources/inference-secret.mdx) (only for OpenAI and compatible APIs)
+- [`inference_policy`](../reference/infrastructure-as-code/teleport-resources/inference-policy.mdx)
+
+## Step 4/5: Configure access to session summaries
+
+Every user who has access to
+[given session recording](../reference/access-controls/roles.mdx#rbac-for-session-recordings)
+also has access to its summary through a `session` resource kind. The preset
+`access` role allows users to only view their sessions; in order to allow a
+user to view all recordings and summaries, it's easiest to use the preset
+`auditor` role.
+
+You can either use the built-in roles or create a new one to make sure you have
+access to all recordings. To create a new role:
+
+1. Create a `summary-auditor.yaml` file with the following content:
+
+   ```yaml
+   kind: role
+   metadata:
+     name: summary-auditor
+   spec:
+     allow:
+       rules:
+       - resources:
+         - session
+         verbs:
+         - read
+         - list
+   version: v7
+   ```
+
+1. Apply your changes:
+
+   ```code
+   $ tctl create -f summary-auditor.yaml
+   ```
+
+1. (!docs/pages/includes/add-role-to-user.mdx role="summary-auditor"!)
+
+## Step 5/5: Conduct a session and view its summary
+
+That's it! We are ready to conduct a test session. Connect to any of your
+cluster resources using `tsh ssh`, `kubectl exec`, `tsh db connect`, or a web
+terminal. Start an interactive session and execute any command, quit the
+session, and go to **Audit -> Session Recordings**. You should see the
+corresponding recording tile with a summary button
+![summary button](../../img/identity-security/summary-button.png). Clicking the
+summary button will show the summary.
+
+![Session recording list screen with a summary visible](../../img/identity-security/rec-list-with-summary.png)
+
+<Admonition type="info">
+It can take a while to generate a summary, and the time depends on multiple
+factors, including session size, model, and its temperature. Usually it should
+appear up to a minute after the session is uploaded to the Auth service.
+</Admonition>
+
+## Limitations
+
+Currently, Teleport doesn't attempt to summarize sessions that are larger than
+the model's context window. If after tokenization, the session turns out to be
+larger than that, OpenAI will simply reject the request; the input tokens used
+will be wasted. To prevent this, Teleport allows you to customize the maximum
+size of session that may be sent to the inference provider by using the
+`spec.max_session_length_bytes` field of the `inference_model` resource. Note
+that there's no way to provide an exact number of bytes for a given model here;
+in our experiments, we observed between 2 and 4 bytes per token, depending on
+the model and input.
+
+## Selecting sessions to summarize
+
+Indiscriminately summarizing all sessions in your cluster can increase
+costs, so it's recommended to be specific about which sessions will be
+summarized and which model will be used for inference. One of these mechanisms
+— selecting sessions by kind — was mentioned already in the above example. In
+addition to matching by kind, it's also possible to add a custom filter to each
+inference policy, which can be used to summarize only sessions that target
+production resources, are attended by certain users, etc.
+
+Filters are expressed using the [Teleport predicate language](#predicate-language).
+If an inference policy contains a filter, it will match only sessions that
+match one of the indicated kinds *and* the specified filter.
+
+### Session matching examples
+
+A typical case would be to pick only production resources for summarizing. The
+following example policy only matches Kubernetes sessions in any of the
+production clusters, picked by matching cluster labels:
+
+```yaml
+kind: inference_policy
+version: v1
+metadata:
+  name: prod-k8s-sessions
+  description: Summarize production Kubernetes sessions
+spec:
+  kinds:
+  - k8s
+  filter: 'equals(resource.metadata.labels["env"], "prod")'
+  model: shell-summary-model
+```
+
+The following example uses two policies to route shell and database sessions to
+two different models. It assumes that there are two `inference_model` resources
+created: `database-summary-model` and `shell-summary-model`.
+
+```yaml
+kind: inference_policy
+version: v1
+metadata:
+  name: shell-policy
+spec:
+  kinds: ['ssh', 'k8s']
+  model: shell-summary-model
+
+---
+
+kind: inference_policy
+version: v1
+metadata:
+  name: db-policy
+spec:
+  kinds: ['db']
+  model: db-summary-model
+```
+
+### Predicate Language
+
+Inference policy filters are expressed using Teleport predicate language. In
+this case, the language supports the following operators:
+
+| Operator | Meaning                             | Example                                                  |
+| -------- | ----------------------------------- | -------------------------------------------------------- |
+| &&       | and (all conditions must match)     | `contains(field1, field2) && equals(field2, "val")`      |
+| \|\|     | or (any one condition should match) | `contains(field1, field2) \|\| contains(field1, "val2")` |
+| !        | not (used with functions)           | `!equals(field1, field2)`                                |
+| ==       | equal to                            | `resource.metadata.labels["env"] == "prod"`              |
+| !=       | not equal to                        | `resource.metadata.labels["env"] != "prod"`              |
+
+The language also supports the following functions:
+
+| Functions                         | Return type | Description                                                                                                                                |
+| --------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `all_end_with(a, suffix)`         | `Boolean`   | If `a` is a list, returns true if all strings in the `a` end with `suffix`. If `a` is a string, returns true if `a` ends with `suffix`.    |
+| `all_equal(a, b)`                 | `Boolean`   | If `a` is a list, returns true if all items in `a` are equal to `b`. If `a` is a string, returns true if it's equal to `b`.                |
+| `contains(list, item)`            | `Boolean`   | Returns true if `item` is included in the `list`                                                                                           |
+| `contains_all(list, items)`       | `Boolean`   | Returns true if all `items` are included in the `list`                                                                                     |
+| `contains_any(list, items)`       | `Boolean`   | Returns true if any of `items` is included in the `list`                                                                                   |
+| `equals(a, b)`                    | `Boolean`   | Returns true if value `a` is equal to `b`                                                                                                  |
+| `has_prefix(s, prefix)`           | `Boolean`   | Returns true if string `s` starts with `prefix`                                                                                            |
+| `is_subset(a, item1, item2, ...)` | `Boolean`   | If `a` is a list, returns true if `list(item1, item2, ...)` is a subset of `a`. If `a` is a string, returns true if the list contains `a`. |
+| `set(value1, value2, ...)`        | `[]string`  | Returns a list of strings                                                                                                                  |
+
+It's possible to build predicates using information about target resource,
+session, and user.
+
+| Field                            | Meaning                                                                                                                                                         | Example                                           |
+| -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| resource                         | Resource that this session connects to (server, Kubernetes cluster, or database)                                                                                |                                                   |
+| resource.kind                    | Resource kind                                                                                                                                                   | `resource.kind == "node"`                         |
+| resource.metadata.labels         | Resource labels                                                                                                                                                 | `equals(resource.metadata.labels["env"], "prod")` |
+| resource.metadata.name           | Resource name. In case of SSH servers, it's the server ID.                                                                                                      | `resource.name == "production-cluster"`           |
+| resource.spec.addr               | Server address (SSH sessions only)                                                                                                                              | `resource.spec.addr == "123.123.123.123:3022"`    |
+| resource.spec.db_protocol        | Database protocol (database sessions only). See [DB resource reference](../reference/infrastructure-as-code/teleport-resources/db.mdx) for supported values.    | `resource.spec.protocol == "postgres"`            |
+| resource.spec.hostname           | Server hostname (SSH sessions only)                                                                                                                             | `resource.spec.hostname == "dummy-host"`          |
+| resource.spec.uri                | Database URI (database sessions only)                                                                                                                           | `has_prefix(resource.spec.uri, "db-host")`        |
+| session                          | The session that is being matched. This object supports all the fields of `session.end` and `db.session.end` events, so we only name the most useful ones here. |                                                   |
+| session.cluster_name             | Name of the Teleport cluster                                                                                                                                    | `cluster_name == "teleport.example.com"`          |
+| session.db_name                  | Name of database (the underlying one, not the Teleport resource; database sessions only)                                                                        | `session.db_name == "orders"`                     |
+| session.db_service               | Database service name (database sessions only)                                                                                                                  | `session.db_service == "prod-db-service"`         |
+| session.kubernetes_groups        | List of Kubernetes groups (Kubernetes sessions only)                                                                                                            | `contains(session.kubernetes_groups, "viewers")`  |
+| session.kubernetes_node_name     | Name of node that runs the pod (Kubernetes sessions only)                                                                                                       | `session.kubernetes_node_name == "node1"`         |
+| session.kubernetes_pod_name      | Name of the pod (Kubernetes sessions only)                                                                                                                      | `session.kubernetes_pod_name == "some-pod"`       |
+| session.kubernetes_pod_namespace | Namespace that contains the pod (Kubernetes sessions only)                                                                                                      | `session.kubernetes_pod_namespace == "default"`   |
+| session.kubernetes_users         | List of Kubernetes usernames (Kubernetes sessions only)                                                                                                         | `contains(session.kubernetes_users, "admin")`     |
+| session.participants             | Users that participated in the session (SSH and Kubernetes sessions only)                                                                                       | `contains(session.participants, "alice")`         |
+| user                             | User that created the session.                                                                                                                                  |                                                   |
+| user.metadata.name               | User's name                                                                                                                                                     | `is_subset(user.metadata.name, "alice", "bob")`   |
+| user.spec.roles                  | User's roles                                                                                                                                                    | `contains(user.spec.roles, "intern")`             |
+| user.spec.traits                 | User's traits                                                                                                                                                   | `contains(user.spec.traits["teams"], "alpha")`    |
+
+## Using LiteLLM and other OpenAI-compatible proxies
+
+Although the only officially supported inference provider is currently OpenAI,
+it's also possible to use any OpenAI-compatible API for this purpose. For
+example, you may want to route some or all sessions to another provider or even
+host your language models on premises. One way to do it is using LiteLLM.
+Here's what you need to do:
+
+1. Set up [LiteLLM Proxy Server (LLM
+   Gateway)](https://docs.litellm.ai/docs/#litellm-proxy-server-llm-gateway) on a
+   host accessible from the Teleport Auth server.
+2. Add a model of your choice to the LiteLLM configuration. In this example,
+   let's call it `my-custom-model`.
+3. Configure a Teleport inference model. Use `spec.openai.base_url` property to
+   point Teleport to your LiteLLM instance and put `my-custom-model` in
+   `spec.openai.openai_model_id`.
+4. Add an `inference_secret` containing your LiteLLM master key.
+
+Here is an example configuration:
+
+```yaml
+kind: inference_model
+version: v1
+metadata:
+  name: lite-llm-summary-model
+spec:
+  openai:
+    # In case of LiteLLM Proxy, the openai_model_id is the public model name as
+    # configured in LiteLLM.
+    openai_model_id: my-custom-model
+    api_key_secret_ref: lite-llm-master-key
+    base_url: http://llm-host:4000/
+
+---
+
+kind: inference_secret
+version: v1
+metadata:
+  name: lite-llm-master-key
+spec:
+  # In case of LiteLLM, the API key is *not* your OpenAI key; instead, use your
+  # LiteLLM master key.
+  value: '<paste-your-master-key-here>'
+```
+
+## Monitoring
+
+Teleport exposes a couple of useful Prometheus metrics that can be used to
+monitor the session summarizer. Metrics are labeled by inference model name,
+and in case of OpenAI errors — additionally with the OpenAI API error code. See
+the [Teleport Metrics
+reference](../reference/deployment/monitoring/metrics.mdx#session-recording-summarizer)
+for details.
+
+## Troubleshooting
+
+### Amazon Bedrock fails to invoke a model with on-demand throughput
+
+**Problem:** Summarization fails with "ValidationException: Invocation of model
+ID *[model-id]* with on-demand throughput isn’t supported. Retry your request
+with the ID or ARN of an inference profile that contains this model."
+
+**Solution:** Use an Amazon Bedrock inference profile instead of a model ID in
+the `inference_model` resource.
+
+### Amazon Bedrock model identifier is invalid
+
+**Problem:** Summarization fails with "ValidationException: The provided model
+identifier is invalid." 
+
+**Solution:** One possible reason is a mismatch between the `region` declared
+in the `inference_model` resource and available regions for the given model or
+inference profile. Make sure that the region is supported.
+
+### Amazon Bedrock denies access to a model or inference policy
+
+**Problem:** Summarization fails with "AccessDeniedException: User: *[user]* is
+not authorized to perform: bedrock:InvokeModel on resource: *[resource-arn]*
+because no identity-based policy allows the bedrock:InvokeModel action"
+
+**Solution:** First, make sure that the AWS IAM role used by Teleport has a
+policy attached that allows the `InvokeModel` action on the model or inference
+policy that you specified in Teleport configuration (`inference_model`
+resource). Then make sure that if you're using an Amazon Bedrock inference
+profile, the policy references not only the inference profile itself, but also
+all Amazon Bedrock models that this inference profile is associated with. Use
+the following command to fetch details of the inference profile, replacing <Var
+name="bedrock-inference-profile-arn"/> with the inference profile ARN:
+
+```sh
+aws bedrock get-inference-profile --inference-profile-identifier="<Var name="bedrock-inference-profile-arn"/>"
+```
diff --git a/docs/pages/identity-security/usage/alerts.mdx b/docs/pages/identity-security/usage/alerts.mdx
new file mode 100644
index 0000000000000..07ac28643ccba
--- /dev/null
+++ b/docs/pages/identity-security/usage/alerts.mdx
@@ -0,0 +1,147 @@
+---
+title: Identity Security Alerts
+sidebar_label: Alerts
+description: Describes the pre-built security detections that trigger alerts in Teleport Identity Security.
+tags:
+ - identity-security
+enterprise: Identity Security
+---
+
+Teleport Identity Security provides pre-built security detections that automatically create alerts for suspicious identity-related activities across your infrastructure. These detections monitor events from Teleport and integrated services like AWS, GitHub, and Okta to identify potential security risks.
+
+Teleport Identity Security alerts help you detect and respond to security threats by monitoring for:
+- Unusual authentication patterns
+- Privilege escalations
+- Configuration changes that affect security
+- Account compromises
+- Policy violations
+
+All detections are pre-configured and currently cannot be modified. The severity levels (Critical, High, Medium, Low) are defined by the Identity Security team based on the potential impact of each detection.
+
+![Alerts](../../../img/access-graph/alerts.png)
+
+To view active alerts, navigate to **Identity Security** > **Alerts** in the Teleport Web UI.
+
+<Admonition type="tip">
+
+Teleport Identity Security Alerts and the Investigate view are currently only available in self-hosted AWS Teleport Enterprise deployments.  They will be coming to Teleport Enterprise Cloud in Q4 2025.
+
+</Admonition>
+
+## Detection categories
+
+Each category below represents an integrated service where Teleport monitors for security events and suspicious activities pulled from various integration audit logs. The detections within each category are further organized by severity level to help you prioritize your security response efforts.
+
+### AWS detections
+
+Teleport Identity Security monitors your AWS infrastructure for critical to low security events. Set up AWS detections: [AWS Settings](../integrations/aws-sync.mdx)
+
+
+#### Critical and high severity
+- Root account activities (console login, access key creation, general activity)
+- Security settings deletions (CloudTrail, GuardDuty, flow logs)
+- EBS encryption disabled
+- DB snapshots made public
+- Exposed credential policy modifications
+- Login profile updates
+
+#### Medium and low severity
+- IAM user creation
+- DB snapshot attribute modifications
+- AWS key deletion or disabling
+
+
+### GitHub detections
+
+Monitor your GitHub organizations and repositories for security-relevant changes:
+
+#### Critical and high severity
+- Organization security updates (SAML, MFA, OAuth restrictions)
+- Protected branch policy overrides or deletions
+- Repository access and visibility changes
+- Secret scanning alerts
+- Organization member updates
+
+#### Medium and low severity
+- Repository member updates
+- Organization moderator additions
+- Integration installations
+
+#### Advanced Security Detections
+The system includes 26 sub-types of GitHub advanced security change detections that monitor for modifications to security features like Dependabot alerts if enabled in your GitHub plan and organization. About GitHub Advanced Security: [GitHub Docs](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security)
+
+Set up GitHub detections: [GitHub Settings](../integrations/github.mdx)
+
+### Okta detections
+
+Track identity and access management events in your Okta environment:
+
+#### High severity
+- Admin MFA disabled
+- All MFA factors reset
+- OAuth token reuse patterns
+- Rate limit violations
+- Sign-on policy evaluations
+- IDP lifecycle changes
+- API token creation/revocation
+- Security threat events
+
+#### Medium severity
+- Excessive MFA failures
+- Multiple password reset attempts
+- Dormant account access
+- Support-initiated password or MFA resets
+
+### Teleport detections
+
+Monitor Teleport-specific security events:
+
+#### High severity
+- Root SSH session initiation
+- Authentication without MFA for local accounts
+- Unusual authentication failure patterns
+- Role creation/updates/deletions
+- Connector updates
+- Unusual session commands
+
+Set up Teleport detections: [Teleport Settings](../integrations/teleport.mdx)
+
+### Cross-platform detections
+
+####  High severity
+- Impossible travel detection (GitHub, Okta, Teleport). Triggers when login attempts occur from multiple geographic locations within a timeframe that makes legitimate travel physically impossible
+
+### Current Capabilities
+- View alerts across all integrated systems - Access a unified dashboard in the Teleport Identity Security  that displays all security alerts from AWS, GitHub, Okta, and Teleport in a single view, eliminating the need to check multiple platforms separately.
+- Filter by severity level - Narrow down the alerts list to show only Critical, High, Medium, or Low severity events, helping you prioritize which security issues to investigate first.
+- Investigate related events - View associated events, graph and context in the Investigate view, allowing you to understand the full scope of the security incident and trace related activities across your infrastructure.
+
+## Frequently asked questions
+
+### Are these detections available in Teleport Cloud?
+No, Identity Activity Center detections are only available in self-hosted Teleport Enterprise deployments. They will be coming to Teleport Enterprise Cloud in Q4 2025.
+
+### Can I write my own detections?
+No, detections are currently pre-configured per integration and cannot be customized.
+
+### Can I resolve an alert?
+Not currently, but we plan to add workflows to resolve, acknowledge, and mute alert types in future updates.
+
+### What determines the severity level?
+Severity levels are defined by the Identity Security Team based on the potential security impact. Feedback on severity assignments is welcome.
+
+### Can I forward these events to another service?
+This feature is planned for future release.
+
+### How can I request new detection types?
+For new detection requests based on customer needs, [reach out to the Identity Security Team](https://goteleport.com/contact-us/). Customer feedback is welcomed and helps prioritize new detection development.
+
+## How do I deploy Identity Security Alerts?
+Teleport Identity Security is a separately licensed product available to Teleport Enterprise customers. Alerts and Investigate view are only available in AWS self-hosted deployments. To deploy Identity Security, follow the instructions in [Self-Host Teleport Security - Identity Activity Center](../access-graph/identity-activity-center.mdx).
+
+
+## Next steps
+
+
+- Review the [Investigate](./investigate.mdx) documentation to learn about exploring identity-related activity
+- Configure [integrations](../integrations/integrations.mdx) to expand detection coverage
\ No newline at end of file
diff --git a/docs/pages/admin-guides/teleport-policy/crown-jewels.mdx b/docs/pages/identity-security/usage/crown-jewels.mdx
similarity index 83%
rename from docs/pages/admin-guides/teleport-policy/crown-jewels.mdx
rename to docs/pages/identity-security/usage/crown-jewels.mdx
index fceab3bea9096..3f5ba748d5eb1 100644
--- a/docs/pages/admin-guides/teleport-policy/crown-jewels.mdx
+++ b/docs/pages/identity-security/usage/crown-jewels.mdx
@@ -1,11 +1,19 @@
 ---
-title: See permission changes with Access Graph Crown Jewels
+title: See Permission Changes with Access Graph Crown Jewels
+sidebar_label: Crown Jewels
 description: Describes how to use Access Graph Crown Jewels to see permission changes in Teleport.
+tags:
+ - conceptual
+ - identity-security
+ - access-risks
+enterprise: Identity Security
 ---
 
-Access Graph's Crown Jewel feature allows you to track changes to access for
+Access Graph's Crown Jewels feature allows you to track changes to access for
 your most sensitive users or resources. When you mark a resource as a Crown
 Jewel, Teleport emits audit events any time access to that resource changes.
+With Crown Jewels, you can prevent changes in your organization's access
+controls from unintentionally allowing accessing to a resource.
 
 This guide shows you how to configure Crown Jewels, how to mark resources as
 Crown Jewels, and how to see permission changes for these resources.
@@ -15,7 +23,7 @@ Crown Jewels, and how to see permission changes for these resources.
 <Admonition type="tip">
 
 For an improved experience, we recommend using Crown Jewels in conjunction with Teleport local users or integrating with
-[Okta](../access-controls/okta/okta.mdx) or [Microsoft Entra ID](./integrations/entra-id.mdx).
+[Okta](../../identity-governance/integrations/okta/okta.mdx) or [Microsoft Entra ID](../integrations/entra-id.mdx).
 This setup helps minimize the number of access path change entries generated when highly privileged ephemeral users
 log in via Teleport Auth Connectors.
 
@@ -24,7 +32,7 @@ log in via Teleport Auth Connectors.
 - A running Teleport Enterprise cluster v16.2.0 or later.
 - For self-hosted clusters, an updated `license.pem` with Teleport Identity Security enabled.
 - For self-hosted clusters, a running Access Graph node v1.24.0 or later.
-Check [Access Graph page](teleport-policy.mdx) for details on
+Check [Access Graph page](../identity-security.mdx) for details on
 how to set up Access Graph.
 
 (!docs/pages/includes/policy/access-graph.mdx!)
@@ -99,4 +107,4 @@ Here is what an example audit event looks like:
 ```
 
 You can export the audit event using the event handler.
-The setup is described [here](../management/export-audit-events/export-audit-events.mdx).
+The setup is described [here](../../zero-trust-access/export-audit-events/export-audit-events.mdx).
diff --git a/docs/pages/identity-security/usage/dashboard.mdx b/docs/pages/identity-security/usage/dashboard.mdx
new file mode 100644
index 0000000000000..d4764aca296bf
--- /dev/null
+++ b/docs/pages/identity-security/usage/dashboard.mdx
@@ -0,0 +1,28 @@
+---
+title: Uncover Identity Risks with the Standing Privileges Dashboard
+sidebar_label: Standing Privileges
+description: Describes the Standing Privileges Dashboard feature of Teleport Identity Security
+tags:
+ - identity-security
+ - access-risks
+ - conceptual
+enterprise: Identity Security
+---
+
+The standing privileges dashboard provides an overview of resources that an
+identity can access without creating an Access Request. Standing privileges
+allow an attacker to access infrastructure resources with compromised
+credentials, and you can use the standing privileges dashboard as a guide for
+reducing the attack surface of your infrastructure. 
+
+Teleport Identity Security sources standing privileges from Teleport roles as
+well as [integrations](../integrations/integrations.mdx), counting
+Teleport-protected resources as well as access controls and resources from your
+cloud provider and third-party solutions.
+
+To visit the standing privileges dashboard, navigate to **Identity Security** >
+**Dashboard**.
+
+You can explore details about standing privileges can be clicking on a user or bot:
+
+![Standing Privileges](../../../img/access-graph/standing-privileges.png)
diff --git a/docs/pages/identity-security/usage/graph-explorer.mdx b/docs/pages/identity-security/usage/graph-explorer.mdx
new file mode 100644
index 0000000000000..4e7de69e74b05
--- /dev/null
+++ b/docs/pages/identity-security/usage/graph-explorer.mdx
@@ -0,0 +1,164 @@
+---
+title: Visualize Access Controls with Graph Explorer
+sidebar_label: Graph Explorer
+description: Describes the Graph Explorer view of Teleport Access Graph.
+tags:
+ - identity-security
+ - access-risks
+ - conceptual
+enterprise: Identity Security
+---
+
+The Graph Explorer view in Teleport Access Graph reveals access patterns within
+your infrastructure. You can see which infrastructure resources different
+identities have access to, and which identities have access to a single
+resource. You can reveal identities with excessive permissions and resources
+with unexpected sources of access, helping you protecting your infrastructure
+against identity-based attacks.
+
+The Graph Explorer displays access controls from multiple systems in a single
+view, including Teleport roles and access controls from cloud providers, code
+repositories, and other [integrations](../integrations/integrations.mdx).
+
+## Using Graph Explorer
+
+To begin using Graph Explorer:
+
+1. From the left sidebar, navigate to **Identity Security** > **Graph
+   Explorer**.
+1. From the main dropdown menu, select an identity, role, or resource to view.
+
+![Show Access Path Resource](../../../img/access-graph/show-access-path-resource.gif)
+
+From there, you can view more information about an access path or continue
+exploring using the search bar.
+
+### Drill down to an access path
+
+In Graph Explorer, a node's access path shows all the resources that the node can access.
+
+When viewing an access path, you can filter down the graph to show only the nodes that you are interested in.
+
+For example, if you are viewing a user's access path and want to see what access is given to that user through a certain role, you can right-click the role and select "Add to search".
+
+![Add to search](../../../img/access-graph/add-to-search.png)
+
+This will narrow down the graph to show you only the access paths that include that role.
+
+![Filtered access path](../../../img/access-graph/filtered-access-path.png)
+
+### Using the search bar
+
+To search for a graph node, use the search bar at the top of the page or press `/`.
+
+This will bring up the global search, where you can search for nodes, pages and access paths.
+
+![Search](../../../img/access-graph/search.png)
+
+Clicking on a node will open a drawer with more details about that node.
+
+![Node Information](../../../img/access-graph/node-information.png)
+
+Viewing a node's access path will open up the graph explorer view with the selected node.
+
+![Access Path](../../../img/access-graph/access-path.png)
+
+
+## Graph nodes
+
+Access Graph divides your infrastructure into six main components:
+
+### Identities
+
+![Identity Node](../../../img/access-graph/identity-node.png)
+
+Identities are the actors that can access your infrastructure. They can be employees, contractors, machines or bots.
+
+Users are created from Teleport Users.  Local users are imported as soon as they
+are created.  External users (created from authentication connectors for GitHub,
+SAML, etc.) are imported when they log in for the first time.
+
+The number on the right hand side shows **standing privileges**. The standing privileges metric indicates the number of
+resources that an identity can access without creating an Access Request.
+
+### User groups
+
+![Identity Group Node](../../../img/access-graph/identity-group-node.png)
+
+Identity Groups are collections of identities. They can be used to organize users
+based on their role or team, and they can be nested.
+
+User Groups are created from Teleport roles and Access Requests. Roles create
+User Groups where the members are the users that have that role. Access requests
+create a temporary User Group where the members are the users that got the
+access through the accepted Access Request.
+
+### Actions
+
+![Action Node](../../../img/access-graph/allow-action-node.png)
+
+Actions are the things that identities can or cannot do. Actions are related to resources.
+For example, a user can SSH into a node.
+
+Allow paths connect identities to resources. They show what an identity can access and what actions they can perform.
+
+![Allow Path](../../../img/access-graph/allow-path.png)
+
+### Deny actions
+
+![Deny Action Node](../../../img/access-graph/deny-action-node.png)
+
+Deny Actions are the things that identities cannot do. Deny Actions are related to resources.
+For example, a user cannot SSH into a node.
+
+Deny paths connect identities to resources. They show what an identity cannot
+access and what actions they cannot perform. Deny paths take precedence over
+allow paths.
+
+![Deny Path](../../../img/access-graph/deny-path.png)
+
+### Temporary actions
+
+Temporary Actions are created when a user is granted temporary access to a resource. 
+They are automatically deleted when the user's access expires. The temporary actions 
+can be identified by having `Temporary: true` property.
+
+### Resource groups
+
+![Resource Group Node](../../../img/access-graph/resource-group-node.png)
+
+Resource Groups are collections of resources. They can be used to organize resources based on their role or team.
+
+The number on the right hand side shows the number of resources that a resource group contains.
+
+### Resources
+
+![Resource Node](../../../img/access-graph/resource-node.png)
+
+Resources are the things that users can or cannot access. They can be servers, databases, or Kubernetes clusters.
+
+### Database Access Controls
+
+Teleport supports [object-level permissions](../../enroll-resources/database-access/rbac.mdx) for select database protocols.
+
+The database objects-level access information is automatically synchronized to Identity Security, making it possible to see who has particular levels of access to the different parts of the database.
+
+When you inspect a particular user's access, the Teleport Access Graph will automatically display the database objects that the user can access.
+
+![Overview of access including individual database objects](../../../img/access-graph/dac/overview.png)
+
+To see more details about a specific database object, simply select it.
+
+![Details of an individual database object](../../../img/access-graph/dac/db-object-details.png)
+
+In the graph, database objects are connected by multiple edges:
+
+1. There is exactly one edge connecting the object to its parent database resource. This edge has "contains" label.
+
+   ![Database object and parent database resource](../../../img/access-graph/dac/db-object-contains-relation.png)
+
+2. At least one edge shows the permissions associated with the object, such as `INSERT, SELECT, UPDATE`. If multiple roles grant permissions to the same object, additional edges of this type may be present. The permissions are presented as edge labels.
+
+   ![Specific object permissions](../../../img/access-graph/dac/db-object-permissions-label.png)
+
+
diff --git a/docs/pages/identity-security/usage/investigate.mdx b/docs/pages/identity-security/usage/investigate.mdx
new file mode 100644
index 0000000000000..4352ce18e92e5
--- /dev/null
+++ b/docs/pages/identity-security/usage/investigate.mdx
@@ -0,0 +1,25 @@
+---
+title: Investigate Identity-Related Security Risks
+sidebar_label: Investigate
+description: Describes the Investigate view, which helps you explore identity-related activity from across your infrastructure.
+tags:
+ - identity-security
+ - access-risks
+ - conceptual
+enterprise: Identity Security
+---
+
+The Investigate dashboard provides an overview of recent identity activity
+across your infrastructure, helping you investigate security risks and
+incidents. You can see Teleport audit events related to identity, such as
+certificate issuance and multi-factory authentication challenges, as well as
+events from [integrations](../integrations/integrations.mdx) such as GitHub and
+AWS. Because Identity Activity Center visualizes events from multiple
+integrations at once, you can investigate identity-related incidents that
+involve pivoting from one system to another.
+
+![Investigate](../../../img/access-graph/investigate.png)
+
+To visit the Investigate dashboard, open the Teleport Web UI and navigate to
+**Identity Security** > **Investigate**.
+
diff --git a/docs/pages/identity-security/usage/sql-editor.mdx b/docs/pages/identity-security/usage/sql-editor.mdx
new file mode 100644
index 0000000000000..e095bb51afe82
--- /dev/null
+++ b/docs/pages/identity-security/usage/sql-editor.mdx
@@ -0,0 +1,54 @@
+---
+title: Explore Access Paths with the SQL Editor
+sidebar_label: SQL Editor
+description: Describes the SQL Editor view of Teleport Access Graph.
+tags:
+ - identity-security
+ - access-risks
+ - conceptual
+enterprise: Identity Security
+---
+
+The Access Graph SQL Editor allows you to view nodes and edges within Access
+Graph that satisfy specific criteria. This helps you make sense of the access
+paths between identities and resources in your infrastructure so you can
+pinpoint and remediate access control issues. In the SQL Editor, you can enter
+SQL-like queries to explore selected nodes and edges within the graph.
+
+![SQL Editor](../../../img/access-graph/sql-editor.png)
+
+The query language allows to create different views of the graph.
+
+Show only allowed paths:
+
+```sql
+SELECT * FROM access_path WHERE kind = 'ALLOWED';
+```
+
+Show only denied paths:
+```sql
+SELECT * FROM access_path WHERE kind = 'DENIED';
+```
+
+Show all access paths for a user:
+```sql
+SELECT * FROM access_path WHERE identity = 'bob';
+```
+
+Show all access paths for a user AND a resource:
+```sql
+SELECT * FROM access_path WHERE identity = 'bob' AND resource = 'postgres';
+```
+
+Show all access paths for resources with specific labels:
+```sql
+SELECT * FROM access_path WHERE resource_labels @> '{"key": "value"}';
+```
+
+Show all SSH Keys from SSH Key Scanning:
+
+```sql
+SELECT * FROM ssh_keys;
+```
+
+You can view more SQL examples in the editor.
diff --git a/docs/pages/identity-security/usage/usage.mdx b/docs/pages/identity-security/usage/usage.mdx
new file mode 100644
index 0000000000000..cea6e3e8e8839
--- /dev/null
+++ b/docs/pages/identity-security/usage/usage.mdx
@@ -0,0 +1,25 @@
+---
+title: Explore Access Paths and Activity
+description: Explore identity risks and access pathways with dashboards, graph visualization, and SQL queries.
+tags:
+ - conceptual
+ - identity-security
+ - access-risks
+enterprise: Identity Security
+---
+
+Teleport Identity Security helps teams expose and eliminate hidden risk in their infrastructure. 
+
+These are some use cases for Teleport Identity Security:  
+
+- Find users with the highest standing privilege with the Standing Privilege Dashboard.
+- Visually understand which resources a user can access and which users and bots can access a resource. 
+- Quickly query key access pathways with SQL Editor.
+- Know when access pathways change for a critical asset with Crown Jewel Alerting.
+- Investigate identity breaches by correlating audit logs from across your
+  infrastructure.
+
+## Guides
+
+<DocCardList />
+
diff --git a/docs/pages/includes/access-control-guides.mdx b/docs/pages/includes/access-control-guides.mdx
deleted file mode 100644
index 81587d59ca502..0000000000000
--- a/docs/pages/includes/access-control-guides.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
-- [Dual Authorization](../admin-guides/access-controls/guides/dual-authz.mdx): Protect access to critical resources with dual authorization.
-- [Role Templates](../admin-guides/access-controls/guides/role-templates.mdx): Set up Dynamic Access Policies with Role Templates.
-- [Impersonating Teleport Users](../admin-guides/access-controls/guides/impersonation.mdx): Create certificates for CI/CD with impersonation.
-- [Passwordless](../admin-guides/access-controls/guides/passwordless.mdx): Use passwordless authentication.
-- [Multi-Factor: WebAuthn](../admin-guides/access-controls/guides/webauthn.mdx): Add multi-factor authentication through WebAuthn.
-- [Per-Session MFA](../admin-guides/access-controls/guides/per-session-mfa.mdx): Per-session multi-mactor authentication.
-- [MFA for Administrative Actions](../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx): Multi-mactor authentication for admin actions.
-- [Locking](../admin-guides/access-controls/guides/locking.mdx): Lock access to active user sessions or hosts.
-- [Joining Sessions](../admin-guides/access-controls/guides/joining-sessions.mdx): Configure access to existing sessions.
-- [Hardware Key Support](../admin-guides/access-controls/guides/hardware-key-support.mdx): Enforce the use of hardware-based private keys.
-- [Device Trust](../admin-guides/access-controls/device-trust/guide.mdx): Register and enforce trusted devices.
-- [Headless WebAuthn](../admin-guides/access-controls/guides/headless.mdx): Login with Webauthn from a remote device.
-- [IP Pinning](../admin-guides/access-controls/guides/ip-pinning.mdx): Pin a user's certificates to a login IP address.
diff --git a/docs/pages/includes/access-monitoring-events.mdx b/docs/pages/includes/access-monitoring-events.mdx
new file mode 100644
index 0000000000000..7a75160499d77
--- /dev/null
+++ b/docs/pages/includes/access-monitoring-events.mdx
@@ -0,0 +1,1559 @@
+{/*generated file. DO NOT EDIT.*/}
+{/*To generate, run make access-monitoring-reference*/}
+{/*vale messaging.capitalization = NO*/}
+{/*vale messaging.consistent-terms = NO*/}
+
+## access_list.create
+
+`access_list.create` is emitted when an access list is created.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cluster_name,code,ei from access_list_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.delete
+
+`access_list.delete` is emitted when an access list is deleted.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cluster_name,code,ei from access_list_delete limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.member.create
+
+`access_list.member.create` is emitted when an access list member is created.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_list_name,cluster_name,code from access_list_member_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_list_name|varchar|The name of the access list the members are being added to or removed from|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|members|array(row(joined_on varchar, member_name varchar, reason varchar, removed_on varchar))|All members affected by the access list membership change|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.member.delete
+
+`access_list.member.delete` is emitted when an access list member is deleted.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_list_name,cluster_name,code from access_list_member_delete limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_list_name|varchar|The name of the access list the members are being added to or removed from|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|members|array(row(joined_on varchar, member_name varchar, reason varchar, removed_on varchar))|All members affected by the access list membership change|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.member.update
+
+`access_list.member.update` is emitted when an access list member is updated.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_list_name,cluster_name,code from access_list_member_update limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_list_name|varchar|The name of the access list the members are being added to or removed from|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|members|array(row(joined_on varchar, member_name varchar, reason varchar, removed_on varchar))|All members affected by the access list membership change|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.review
+
+`access_list.review` is emitted when an access list is reviewed.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cluster_name,code,ei from access_list_review limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|membership_requirements_changed_roles|array(varchar)|The roles that changed as part of a review|
+|membership_requirements_changed_traits_key|varchar||
+|membership_requirements_changed_traits_value|varchar||
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|removed_members|array(varchar)|The members that were removed as part of the review|
+|review_day_of_month_changed|varchar|Populated if the review day of month has changed|
+|review_frequency_changed|varchar|Populated if the review frequency has changed|
+|review_id|varchar|The ID of the review|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_list.update
+
+`access_list.update` is emitted when an access list is updated.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cluster_name,code,ei from access_list_update limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|name|varchar|A resource name|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+
+## access_request.create
+
+`access_request.create` is emitted when access request has been created or updated.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,assume_start_time,aws_role_arn from access_request_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|assume_start_time|varchar|The time the requested roles can be assumed|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|delegator|varchar|Used by teleport plugins to indicate the identity which caused them to update state|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|id|varchar|Access request ID|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|max_duration|varchar|Indicates how long the access should be granted for|
+|name|varchar|A resource name|
+|promoted_access_list_name|varchar|The name of the access list that this request was promoted to. This field is only populated when the request is in the PROMOTED state|
+|proposed_state|varchar|The state proposed by a review (only used in the access_request.review event variant)|
+|reason|varchar|An optional description of why the request is being created or updated|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|resource_ids|array(row(cluster varchar, kind varchar, name varchar, sub_resource varchar))|The set of resources to which access is being requested|
+|reviewer|varchar|The author of the review (only used in the access_request.review event variant)|
+|roles|array(varchar)|A list of roles for the user|
+|state|varchar|Access request state (in the access_request.review variant of the event this represents the post-review state of the request)|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## access_request.review
+
+`access_request.review` is emitted when access request has been created or updated.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,assume_start_time,aws_role_arn from access_request_review limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|assume_start_time|varchar|The time the requested roles can be assumed|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|delegator|varchar|Used by teleport plugins to indicate the identity which caused them to update state|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|id|varchar|Access request ID|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|max_duration|varchar|Indicates how long the access should be granted for|
+|name|varchar|A resource name|
+|promoted_access_list_name|varchar|The name of the access list that this request was promoted to. This field is only populated when the request is in the PROMOTED state|
+|proposed_state|varchar|The state proposed by a review (only used in the access_request.review event variant)|
+|reason|varchar|An optional description of why the request is being created or updated|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|resource_ids|array(row(cluster varchar, kind varchar, name varchar, sub_resource varchar))|The set of resources to which access is being requested|
+|reviewer|varchar|The author of the review (only used in the access_request.review event variant)|
+|roles|array(varchar)|A list of roles for the user|
+|state|varchar|Access request state (in the access_request.review variant of the event this represents the post-review state of the request)|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## auth
+
+`auth` is emitted upon a failed or successfull authentication attempt.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from auth limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## bot.join
+
+`bot.join` records a bot join event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select bot_name,cluster_name,code from bot_join limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|bot_name|varchar|The name of the bot which has joined|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|method|varchar|The event field indicating what join method was used|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|token_name|varchar|The name of the provision token used to join|
+|uid|varchar|A unique event identifier|
+
+## cert.create
+
+`cert.create` is emitted when a certificate is issued.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cert_type,cluster_name,code from cert_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cert_type|varchar|The type of certificate that was just issued|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|identity_access_requests|array(varchar)|A list of UUIDs of active requests for this Identity|
+|identity_allowed_resource_ids|array(row(cluster varchar, kind varchar, name varchar, sub_resource varchar))|The list of resources which the identity will be allowed to access. An empty list indicates that no resource-specific restrictions will be applied|
+|identity_aws_role_arns|array(varchar)|A list of allowed AWS role ARNs user can assume|
+|identity_azure_identities|array(varchar)|A list of allowed Azure identities user can assume|
+|identity_client_ip|varchar|An observed IP of the client that this Identity represents|
+|identity_database_names|array(varchar)|A list of allowed database names|
+|identity_database_users|array(varchar)|A list of allowed database users|
+|identity_disallow_reissue|boolean|A flag that, if set, instructs the auth server to deny any attempts to reissue new certificates while authenticated with this certificate|
+|identity_expires|varchar|Specifies whenever the session will expire|
+|identity_gcp_service_accounts|array(varchar)|A list of allowed GCP service accounts user can assume|
+|identity_impersonator|varchar|A username of a user impersonating this user|
+|identity_kubernetes_cluster|varchar|Specifies the target kubernetes cluster for TLS identities. This can be empty on older Teleport clients|
+|identity_kubernetes_groups|array(varchar)|A list of Kubernetes groups allowed|
+|identity_kubernetes_users|array(varchar)|A list of Kubernetes users allowed|
+|identity_logins|array(varchar)|A list of Unix logins allowed|
+|identity_mfa_device_uuid|varchar|The UUID of an MFA device when this Identity was confirmed immediately after an MFA check|
+|identity_prev_identity_expires|varchar|The expiry time of the identity/cert that this identity/cert was derived from. It is used to determine a session's hard deadline in cases where both require_session_mfa and disconnect_expired_cert are enabled. See https://github.com/gravitational/teleport/issues/18544|
+|identity_private_key_policy|varchar|The private key policy of the user's private key|
+|identity_roles|array(varchar)|A list of groups (Teleport roles) encoded in the identity|
+|identity_route_to_app_aws_role_arn|varchar|The AWS role to assume when accessing AWS API|
+|identity_route_to_app_azure_identity|varchar|The Azure identity ot assume when accessing Azure API|
+|identity_route_to_app_cluster_name|varchar|The cluster where the application resides|
+|identity_route_to_app_gcp_service_account|varchar|The GCP service account to assume when accessing GCP API|
+|identity_route_to_app_name|varchar|The application name certificate is being requested for|
+|identity_route_to_app_public_addr|varchar|The application public address|
+|identity_route_to_app_session_id|varchar|The ID of the application session|
+|identity_route_to_cluster|varchar|Specifies the target cluster if present in the session|
+|identity_route_to_database_database|varchar|An optional database name to embed|
+|identity_route_to_database_protocol|varchar|The type of the database the cert is for|
+|identity_route_to_database_service_name|varchar|The Teleport database proxy service name the cert is for|
+|identity_route_to_database_username|varchar|An optional database username to embed|
+|identity_teleport_cluster|varchar|The name of the teleport cluster that this identity originated from. For TLS certs this may not be the same as cert issuer, in case of multi-hop requests that originate from a remote cluster|
+|identity_usage|array(varchar)|A list of usage restrictions encoded in the identity|
+|identity_user|varchar|A username or name of the node connection|
+|time|varchar|Event time|
+|uid|varchar|A unique event identifier|
+
+## db.session.query
+
+`db.session.query` is emitted when a user executes a database query.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from db_session_query limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|db_aws_redshift_cluster_id|varchar|Cluster ID for Redshift databases|
+|db_aws_region|varchar|AWS regions for AWS hosted databases|
+|db_gcp_instance_id|varchar|Instance ID for GCP hosted databases|
+|db_gcp_project_id|varchar|Project ID for GCP hosted databases|
+|db_labels_key|varchar||
+|db_labels_value|varchar||
+|db_name|varchar|The name of the database a user is connecting to|
+|db_origin|varchar|The database origin source|
+|db_protocol|varchar|The database type, e.g. postgres or mysql|
+|db_query|varchar|The executed query string|
+|db_query_parameters|array(varchar)|The query parameters for prepared statements|
+|db_roles|array(varchar)|A list of database roles for auto-provisioned users|
+|db_service|varchar|The name of the database service proxying the database|
+|db_type|varchar|The database type|
+|db_uri|varchar|The database URI to connect to|
+|db_user|varchar|The database username used to connect|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|sid|varchar|A unique UUID of the session|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## db.session.query.failed
+
+`db.session.query.failed` is emitted when a user executes a database query.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from db_session_query_failed limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|db_aws_redshift_cluster_id|varchar|Cluster ID for Redshift databases|
+|db_aws_region|varchar|AWS regions for AWS hosted databases|
+|db_gcp_instance_id|varchar|Instance ID for GCP hosted databases|
+|db_gcp_project_id|varchar|Project ID for GCP hosted databases|
+|db_labels_key|varchar||
+|db_labels_value|varchar||
+|db_name|varchar|The name of the database a user is connecting to|
+|db_origin|varchar|The database origin source|
+|db_protocol|varchar|The database type, e.g. postgres or mysql|
+|db_query|varchar|The executed query string|
+|db_query_parameters|array(varchar)|The query parameters for prepared statements|
+|db_roles|array(varchar)|A list of database roles for auto-provisioned users|
+|db_service|varchar|The name of the database service proxying the database|
+|db_type|varchar|The database type|
+|db_uri|varchar|The database URI to connect to|
+|db_user|varchar|The database username used to connect|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|sid|varchar|A unique UUID of the session|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## db.session.start
+
+`db.session.start` is emitted when a user connects to a database.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from db_session_start limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|db_aws_redshift_cluster_id|varchar|Cluster ID for Redshift databases|
+|db_aws_region|varchar|AWS regions for AWS hosted databases|
+|db_gcp_instance_id|varchar|Instance ID for GCP hosted databases|
+|db_gcp_project_id|varchar|Project ID for GCP hosted databases|
+|db_labels_key|varchar||
+|db_labels_value|varchar||
+|db_name|varchar|The name of the database a user is connecting to|
+|db_origin|varchar|The database origin source|
+|db_protocol|varchar|The database type, e.g. postgres or mysql|
+|db_roles|array(varchar)|A list of database roles for auto-provisioned users|
+|db_service|varchar|The name of the database service proxying the database|
+|db_type|varchar|The database type|
+|db_uri|varchar|The database URI to connect to|
+|db_user|varchar|The database username used to connect|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|namespace|varchar|A namespace of the server event|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|sid|varchar|A unique UUID of the session|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## device.authenticate
+
+`device.authenticate` is a device-related event. See the "lib/events.Device*Event" and "lib/events.Device*Code" for the various event types and codes, respectively. Replaces the previous [DeviceEvent] proto, presenting a more standard event interface with various embeds.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from device_authenticate limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|device_asset_tag|varchar|Inventory identifier|
+|device_credential_id|varchar|Credential identifier|
+|device_device_id|varchar|Of the device|
+|device_device_origin|integer|Origin|
+|device_os_type|integer|Of the device|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## device.enroll
+
+`device.enroll` is a device-related event. See the "lib/events.Device*Event" and "lib/events.Device*Code" for the various event types and codes, respectively. Replaces the previous [DeviceEvent] proto, presenting a more standard event interface with various embeds.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from device_enroll limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|device_asset_tag|varchar|Inventory identifier|
+|device_credential_id|varchar|Credential identifier|
+|device_device_id|varchar|Of the device|
+|device_device_origin|integer|Origin|
+|device_os_type|integer|Of the device|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## exec
+
+`exec` specifies command exec event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from exec limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|command|varchar|The executed command name|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|exitCode|varchar|Specifies command exit code|
+|exitError|varchar|An optional exit error, set if command has failed|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|kubernetes_cluster|varchar|A kubernetes cluster name|
+|kubernetes_container_image|varchar|The image of the container within the pod|
+|kubernetes_container_name|varchar|The name of the container within the pod|
+|kubernetes_groups|array(varchar)|A list of kubernetes groups for the user|
+|kubernetes_labels_key|varchar||
+|kubernetes_labels_value|varchar||
+|kubernetes_node_name|varchar|The node that runs the pod|
+|kubernetes_pod_name|varchar|The name of the pod|
+|kubernetes_pod_namespace|varchar|The namespace of the pod|
+|kubernetes_users|array(varchar)|A list of kubernetes usernames for the user|
+|login|varchar|OS login|
+|namespace|varchar|A namespace of the server event|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|sid|varchar|A unique UUID of the session|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## instance.join
+
+`instance.join` records an instance join event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select cluster_name,code,ei from instance_join limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|host_id|varchar|The unique host ID of the instance which attempted to join|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|method|varchar|The event field indicating what join method was used|
+|node_name|varchar|The name of the instance which attempted to join|
+|role|varchar|The role that the node requested when attempting to join|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|token_expires|varchar|Contain information about token expiration time. In case of static token the TokenExpiration time is to the Unix epoch start time|
+|token_name|varchar|The name of the token used to join. This will be omitted for the 'token' join method where the token name is a secret value|
+|uid|varchar|A unique event identifier|
+
+## join_token.create
+
+`join_token.create` event is emitted when a provisioning token (a.k.a. join token) of any role is created.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from join_token_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|join_method|varchar||
+|login|varchar|OS login|
+|name|varchar|A resource name|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|roles|array(varchar)||
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## kube.request
+
+`kube.request` specifies a Kubernetes API request event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from kube_request limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|kubernetes_cluster|varchar|A kubernetes cluster name|
+|kubernetes_groups|array(varchar)|A list of kubernetes groups for the user|
+|kubernetes_labels_key|varchar||
+|kubernetes_labels_value|varchar||
+|kubernetes_users|array(varchar)|A list of kubernetes usernames for the user|
+|login|varchar|OS login|
+|namespace|varchar|A namespace of the server event|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|request_path|varchar|The raw request URL path|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|resource_api_group|varchar|The resource API group|
+|resource_kind|varchar|The API resource kind (e.g. "pod", "service", etc)|
+|resource_name|varchar|The API resource name|
+|resource_namespace|varchar|The resource namespace|
+|response_code|integer|The HTTP response code for this request|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|sid|varchar|A unique UUID of the session|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|verb|varchar|The HTTP verb used for this request (e.g. GET, POST, etc)|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## lock.created
+
+`lock.created` is emitted when a lock is created/updated. Locks are used to restrict access to a Teleport environment by disabling interactions involving a user, an RBAC role, a node, etc. See rfd/0009-locking.md for more details.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from lock_created limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|name|varchar|A resource name|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|target_access_request|varchar|Specifies the UUID of an access request|
+|target_device|varchar|The device ID of a trusted device. Requires Teleport Enterprise|
+|target_login|varchar|Specifies the name of a local UNIX user|
+|target_mfa_device|varchar|Specifies the UUID of a user MFA device|
+|target_node|varchar|Specifies the UUID of a Teleport node. A matching node is also prevented from heartbeating to the auth server. DEPRECATED: use ServerID instead|
+|target_role|varchar|Specifies the name of an RBAC role known to the root cluster. In remote clusters, this constraint is evaluated before translating to local roles|
+|target_server_id|varchar|The host id of the Teleport instance|
+|target_user|varchar|Specifies the name of a Teleport user|
+|target_windows_desktop|varchar|Specifies the name of a Windows desktop|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## lock.deleted
+
+`lock.deleted` is emitted when a lock is deleted.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from lock_deleted limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|name|varchar|A resource name|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## recovery_code.used
+
+`recovery_code.used` is emitted when a user's recovery code was used successfully or unsuccessfully.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from recovery_code_used limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## reset_password_token.create
+
+`reset_password_token.create` is emitted when a user token is created.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from reset_password_token_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|name|varchar|A resource name|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## saml.idp.auth
+
+`saml.idp.auth` is emitted when a user has attempted to authorize against the SAML IdP.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from saml_idp_auth limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|service_provider_entity_id|varchar|The entity ID of the service provider|
+|service_provider_shortcut|varchar|The shortcut name of a service provider|
+|sid|varchar|A unique UUID of the session|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## session.command
+
+`session.command` is a session command event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,argv,aws_role_arn from session_command limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|argv|array(varchar)|The list of arguments to the program. Note, the first element does not contain the name of the process|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cgroup_id|integer|The internal cgroupv2 ID of the event|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|namespace|varchar|A namespace of the server event|
+|path|varchar|The full path to the executable|
+|pid|integer|The ID of the process|
+|ppid|integer|The PID of the parent process|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|program|varchar|Name of the executable|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|return_code|integer|The return code of execve|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|sid|varchar|A unique UUID of the session|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## session.join
+
+`session.join` emitted when another user joins a session.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from session_join limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|kubernetes_cluster|varchar|A kubernetes cluster name|
+|kubernetes_groups|array(varchar)|A list of kubernetes groups for the user|
+|kubernetes_labels_key|varchar||
+|kubernetes_labels_value|varchar||
+|kubernetes_users|array(varchar)|A list of kubernetes usernames for the user|
+|login|varchar|OS login|
+|namespace|varchar|A namespace of the server event|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|sid|varchar|A unique UUID of the session|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## session.rejected
+
+`session.rejected` event happens when a user hits a session control restriction.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from session_rejected limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|max|integer|An event field specifying a maximal value (e.g. the value of `max_connections` for a `session.rejected` event)|
+|namespace|varchar|A namespace of the server event|
+|proto|varchar|Specifies protocol that was captured|
+|reason|varchar|A field that specifies reason for event, e.g. in disconnect event it explains why server disconnected the client|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## session.start
+
+`session.start` is a session start event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from session_start limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|forwarded_by|varchar|Tells us if the metadata was sent by the node itself or by another node in it's place. We can't verify emit permissions fully for these events so care should be taken with them|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|initial_command|array(varchar)|The command used to start this session|
+|kubernetes_cluster|varchar|A kubernetes cluster name|
+|kubernetes_container_image|varchar|The image of the container within the pod|
+|kubernetes_container_name|varchar|The name of the container within the pod|
+|kubernetes_groups|array(varchar)|A list of kubernetes groups for the user|
+|kubernetes_labels_key|varchar||
+|kubernetes_labels_value|varchar||
+|kubernetes_node_name|varchar|The node that runs the pod|
+|kubernetes_pod_name|varchar|The name of the pod|
+|kubernetes_pod_namespace|varchar|The namespace of the pod|
+|kubernetes_users|array(varchar)|A list of kubernetes usernames for the user|
+|login|varchar|OS login|
+|namespace|varchar|A namespace of the server event|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|server_addr|varchar|The address of the server the session occurred on|
+|server_hostname|varchar|The hostname of the server the session occurred on|
+|server_id|varchar|The UUID of the server the session occurred on|
+|server_labels_key|varchar||
+|server_labels_value|varchar||
+|server_sub_kind|varchar|The sub kind of the server the session occurred on|
+|session_recording|varchar|The type of session recording|
+|sid|varchar|A unique UUID of the session|
+|size|varchar|Expressed as 'W:H'|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## user.create
+
+`user.create` is emitted when the user is created or upserted.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from user_create limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|connector|varchar|The connector used to create the user|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|expires|varchar|Set if resource expires|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|name|varchar|A resource name|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|roles|array(varchar)|A list of roles for the user|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|ttl|varchar|A TTL of reset password token represented as duration, e.g. "10m" used for compatibility purposes for some events, Expires should be used instead as it's more useful (contains exact expiration date/time)|
+|uid|varchar|A unique event identifier|
+|updated_by|varchar|If set indicates the user who modified the resource|
+|user|varchar|Teleport user name|
+
+## user.login
+
+`user.login` records a successfully or failed user login event.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from user_login limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|applied_login_rules|array(varchar)|Stores the name of each login rule that was applied during the login|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|method|varchar|The event field indicating how the login was performed|
+|mfa_device_mfa_device_name|varchar|The user-specified name of the MFA device|
+|mfa_device_mfa_device_type|varchar|The type of this MFA device|
+|mfa_device_mfa_device_uuid|varchar|The UUID of the MFA device generated by Teleport|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|user_agent|varchar|Identifies the type of client that attempted the event|
+
+## user.password_change
+
+`user.password_change` is emitted when the user changes their own password.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from user_password_change limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+
+## windows.desktop.session.end
+
+`windows.desktop.session.end` is emitted when a user ends a Windows desktop session.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,aws_role_arn,azure_identity from windows_desktop_session_end limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|desktop_addr|varchar|The address of the desktop being accessed|
+|desktop_labels_key|varchar||
+|desktop_labels_value|varchar||
+|desktop_name|varchar|The name of the desktop resource|
+|ei|integer|A monotonically incremented index in the event sequence|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|participants|array(varchar)|A list of participants in the session|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|recorded|boolean|True if the session was recorded, false otherwise|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|session_start|varchar|The timestamp at which the session began|
+|session_stop|varchar|The timestamp at which the session ended|
+|sid|varchar|A unique UUID of the session|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|windows_desktop_service|varchar|The name of the service proxying the RDP session|
+|windows_domain|varchar|The Active Directory domain of the desktop being accessed|
+|windows_user|varchar|The Windows username used to connect|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+## windows.desktop.session.start
+
+`windows.desktop.session.start` is emitted when a user connects to a desktop.
+
+Example query:
+
+```code
+$ tctl audit query exec \
+  'select access_requests,addr_local,addr_remote from windows_desktop_session_start limit 1'
+```
+
+Columns:
+
+|SQL Name|Type|Description|
+|---|---|---|
+|access_requests|array(varchar)|The IDs of access requests created by the user|
+|addr_local|varchar|A target address on the host|
+|addr_remote|varchar|A client (user's) address|
+|allow_user_creation|boolean|Indicates whether automatic local user creation is allowed for this session|
+|aws_role_arn|varchar|AWS IAM role user assumes when accessing AWS console|
+|azure_identity|varchar|The Azure identity user assumes when accessing Azure API|
+|cluster_name|varchar|Identifies the originating teleport cluster|
+|code|varchar|A unique event code|
+|desktop_addr|varchar|The address of the desktop being accessed|
+|desktop_labels_key|varchar||
+|desktop_labels_value|varchar||
+|desktop_name|varchar|The name of the desktop resource|
+|ei|integer|A monotonically incremented index in the event sequence|
+|error|varchar|Includes system error message for the failed attempt|
+|event|varchar|The event type|
+|gcp_service_account|varchar|The GCP service account user assumes when accessing GCP API|
+|impersonator|varchar|A user acting on behalf of another user|
+|login|varchar|OS login|
+|message|varchar|A user-friendly message for successfull or unsuccessfull auth attempt|
+|private_key_policy|varchar|The private key policy of the private key used to start this session|
+|proto|varchar|Specifies protocol that was captured|
+|required_private_key_policy|varchar|The private key policy enforced for this login|
+|sid|varchar|A unique UUID of the session|
+|success|boolean|Indicates the success or failure of the operation|
+|time|varchar|Event time|
+|trusted_device_asset_tag|varchar|Inventory identifier|
+|trusted_device_credential_id|varchar|Credential identifier|
+|trusted_device_device_id|varchar|Of the device|
+|trusted_device_device_origin|integer|Origin|
+|trusted_device_os_type|integer|Of the device|
+|uid|varchar|A unique event identifier|
+|user|varchar|Teleport user name|
+|windows_desktop_service|varchar|The name of the service proxying the RDP session|
+|windows_domain|varchar|The Active Directory domain of the desktop being accessed|
+|windows_user|varchar|The Windows username used to connect|
+|with_mfa|varchar|A UUID of an MFA device used to start this session|
+
+
+{/*vale messaging.capitalization = YES*/}
+{/*vale messaging.consistent-terms = YES*/}
diff --git a/docs/pages/includes/access-request-integrations.mdx b/docs/pages/includes/access-request-integrations.mdx
index 7cd736084610c..62f170b1f54cf 100644
--- a/docs/pages/includes/access-request-integrations.mdx
+++ b/docs/pages/includes/access-request-integrations.mdx
@@ -1,12 +1,12 @@
 | Integration | Type | Setup Instructions |
 | - | - | - |
-| Slack | Messaging | [Set up Slack](../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) |
-| Mattermost | Messaging | [Set up Mattermost](../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) |
-| Microsoft Teams | Messaging | [Set up Microsoft Teams](../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) |
-| Jira | Project Board | [Set up Jira](../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) |
-| PagerDuty | Schedule | [Set up PagerDuty](../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) |
-| Email | Messaging | [Set up email](../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) |
-| Discord | Messaging | [Set up Discord](../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) |
-| OpsGenie | Incident Management | [Set up OpsGenie](../admin-guides/access-controls/access-request-plugins/opsgenie.mdx) |
-| ServiceNow | Workflow | [Set up ServiceNow](../admin-guides/access-controls/access-request-plugins/servicenow.mdx) |
-| Datadog | Incident Management | [Set up Datadog](../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) |
+| Slack | Messaging | [Set up Slack](../identity-governance/access-requests/plugins/slack.mdx) |
+| Mattermost | Messaging | [Set up Mattermost](../identity-governance/access-requests/plugins/mattermost.mdx) |
+| Microsoft Teams | Messaging | [Set up Microsoft Teams](../identity-governance/access-requests/plugins/msteams.mdx) |
+| Jira | Project Board | [Set up Jira](../identity-governance/access-requests/plugins/jira.mdx) |
+| PagerDuty | Schedule | [Set up PagerDuty](../identity-governance/access-requests/plugins/pagerduty.mdx) |
+| Email | Messaging | [Set up email](../identity-governance/access-requests/plugins/email.mdx) |
+| Discord | Messaging | [Set up Discord](../identity-governance/access-requests/plugins/discord.mdx) |
+| OpsGenie | Incident Management | [Set up OpsGenie](../identity-governance/access-requests/plugins/opsgenie.mdx) |
+| ServiceNow | Workflow | [Set up ServiceNow](../identity-governance/access-requests/plugins/servicenow.mdx) |
+| Datadog | Incident Management | [Set up Datadog](../identity-governance/access-requests/plugins/datadog-hosted.mdx) |
diff --git a/docs/pages/includes/application-access/aws-database-role-mapping.mdx b/docs/pages/includes/application-access/aws-database-role-mapping.mdx
index f482ba2f1caa3..90cc80537a07f 100644
--- a/docs/pages/includes/application-access/aws-database-role-mapping.mdx
+++ b/docs/pages/includes/application-access/aws-database-role-mapping.mdx
@@ -83,7 +83,7 @@ examples:
   </TabItem>
 </Tabs>
 
-See [Role Templates](../../admin-guides/access-controls/guides/role-templates.mdx) for
+See [Role Templates](../../zero-trust-access/rbac-get-started/role-templates.mdx) for
 details.
 </details>
 
diff --git a/docs/pages/includes/application-access/aws-database-start-app-service.mdx b/docs/pages/includes/application-access/aws-database-start-app-service.mdx
index d0838200ede9c..bcb989d171fd3 100644
--- a/docs/pages/includes/application-access/aws-database-start-app-service.mdx
+++ b/docs/pages/includes/application-access/aws-database-start-app-service.mdx
@@ -23,7 +23,7 @@ Replace `https://console.aws.amazon.com` with
 ### Install and start Teleport
 
 Install Teleport on the host where you will run the Teleport Application
-Service. See our [Installation](../../installation.mdx) page for options
+Service. See our [Installation](../../installation/installation.mdx) page for options
 besides Linux servers.
 
 (!docs/pages/includes/install-linux.mdx!)
diff --git a/docs/pages/includes/application-access/dynamic-app-config.mdx b/docs/pages/includes/application-access/dynamic-app-config.mdx
new file mode 100644
index 0000000000000..2f2caea8e0c96
--- /dev/null
+++ b/docs/pages/includes/application-access/dynamic-app-config.mdx
@@ -0,0 +1,22 @@
+To enable dynamic registration, include a `resources` section in your Application
+Service configuration with a list of resource label selectors you'd like this
+service to monitor for registering:
+
+```yaml
+app_service:
+  enabled: true
+  resources:
+  - labels:
+      "*": "*"
+```
+
+You can use a wildcard selector to register all dynamic app resources in the cluster
+on the Application Service or provide a specific set of labels for a subset:
+
+```yaml
+resources:
+- labels:
+    "env": "prod"
+- labels:
+    "env": "test"
+```
diff --git a/docs/pages/includes/application-access/dynamic-app-permissions.mdx b/docs/pages/includes/application-access/dynamic-app-permissions.mdx
new file mode 100644
index 0000000000000..5ad226a6e4495
--- /dev/null
+++ b/docs/pages/includes/application-access/dynamic-app-permissions.mdx
@@ -0,0 +1,13 @@
+In order to interact with dynamically registered applications, a user must have
+a Teleport role with permissions to manage `app` resources.
+
+In the following example, a role allows a user to perform all possible
+operations against `app` resources:
+
+```yaml
+allow:
+  rules:
+    - resources:
+        - app
+      verbs: [list, create, read, update, delete]
+```
diff --git a/docs/pages/includes/application-access/jwt-configure-claims.mdx b/docs/pages/includes/application-access/jwt-configure-claims.mdx
new file mode 100644
index 0000000000000..f6900e3e4d7c1
--- /dev/null
+++ b/docs/pages/includes/application-access/jwt-configure-claims.mdx
@@ -0,0 +1,26 @@
+{{ appType="web application" appScheme="https" }}
+
+By default, Teleport includes a user's roles and traits in the JWT generated for
+application access, and the `Teleport-Jwt-Assertion` header is sent along with
+every request that Teleport makes to an upstream {{ appType }}.
+
+If your {{ appType }} doesn't care about these values, or you are encountering an
+error due to exceeding the size limit of HTTP headers, you can configure
+Teleport to omit this information from the token.
+
+```yaml
+- name: "dashboard"
+  uri: {{ appScheme }}://localhost:4321
+  rewrite:
+    # Specify whether to include roles or traits in the JWT.
+    # Options:
+    # - roles-and-traits: include both roles and traits
+    # - roles: include only roles
+    # - traits: include only traits
+    # - none: exclude both roles and traits from the JWT token
+    # Default: roles-and-traits
+    jwt_claims: roles-and-traits
+    headers:
+    # Inject header with Teleport-signed JWT token.
+    - "Authorization: Bearer {{internal.jwt}}"
+```
diff --git a/docs/pages/includes/application-access/jwt-grafana-config.mdx b/docs/pages/includes/application-access/jwt-grafana-config.mdx
new file mode 100644
index 0000000000000..546f44fbc6153
--- /dev/null
+++ b/docs/pages/includes/application-access/jwt-grafana-config.mdx
@@ -0,0 +1,31 @@
+Add an `auth.jwt` section in Grafana’s main configuration file. Replace <Var
+name="teleport.example.com" /> with the domain name of your Teleport cluster:
+```ini
+[auth.jwt]
+enabled = true
+
+# HTTP header to look into to get a JWT token.
+header_name = Authorization
+
+# JSON Web Key Set (JWKS) URL from your Teleport cluster.
+jwk_set_url = https://<Var name="teleport.example.com" />/.well-known/jwks.json
+
+# Teleport username can be found in "sub" or "username" claims.
+username_claim = sub
+
+# Map Teleport users to Grafana organization roles based on their Teleport
+# roles. Adjust accordingly.
+#
+# In this example, if the user's Teleport role list (the "roles" claim) contains
+# "editor", assign them the Grafana "Editor" role. All other users get the
+# "Viewer" role.
+#
+# Teleport user traits are also available in the "traits" claim and can be
+# used in expressions in the same way as roles.
+role_attribute_path = contains(roles[*], 'editor') && 'Editor' || 'Viewer'
+
+# auto-create users if they are not already matched.
+auto_sign_up = true
+```
+
+Restart your Grafana instance after updating the config.
diff --git a/docs/pages/includes/application-access/jwt-inject.mdx b/docs/pages/includes/application-access/jwt-inject.mdx
new file mode 100644
index 0000000000000..322b4c273f195
--- /dev/null
+++ b/docs/pages/includes/application-access/jwt-inject.mdx
@@ -0,0 +1,5 @@
+You can inject a JWT token into any header using [headers passthrough](../../enroll-resources/application-access/protect-apps/connecting-apps.mdx#headers-passthrough)
+configuration and the `{{internal.jwt}}` template variable. This variable will
+be replaced with JWT token signed by Teleport JWT CA containing user identity
+information like described above.
+
diff --git a/docs/pages/includes/application-access/jwt-intro.mdx b/docs/pages/includes/application-access/jwt-intro.mdx
new file mode 100644
index 0000000000000..8c3efc802b1f5
--- /dev/null
+++ b/docs/pages/includes/application-access/jwt-intro.mdx
@@ -0,0 +1,73 @@
+{{ appType="application" }}
+
+Teleport sends a JWT token signed with Teleport's authority with each request
+to a target {{ appType }} in a `Teleport-Jwt-Assertion` header.
+
+You can use the JWT token to get information about the authenticated Teleport
+user, its roles, and its traits. This allows you to:
+
+- Map Teleport identity/roles/traits onto the identity/roles/traits of your web application.
+- Trust Teleport identity to automatically sign in users into your application.
+
+## Introduction to JWTs
+
+JSON Web Token (JWT) is an open standard that defines a secure way to transfer
+information between parties as a JSON Object.
+
+For an in-depth explanation please visit [https://jwt.io/introduction/](https://jwt.io/introduction/).
+
+Teleport JWTs include three sections:
+
+- Header
+- Payload
+- Signature
+
+### Header
+
+*Example Header*
+
+```json
+{
+  "alg": "RS256",
+  "typ": "JWT"
+}
+```
+
+### Payload
+
+*Example Payload*
+
+```json
+{
+  "aud": [
+    "http://127.0.0.1:34679"
+  ],
+  "iss": "aws",
+  "nbf": 1603835795,
+  "sub": "alice",
+  // Teleport user name.
+  "username": "alice"
+  // Teleport user roles.
+  "roles": [
+    "admin"
+  ],
+  // Teleport user traits.
+  "traits": {
+    "logins": [
+      "root",
+      "ubuntu",
+      "ec2-user"
+    ]
+  },
+  // Teleport identity expiration.
+  "exp": 1603943800,
+}
+```
+
+The JWT will be sent with the header: `Teleport-Jwt-Assertion`.
+
+*Example Teleport JWT Assertion*
+
+```json
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsiaHR0cDovLzEyNy4wLjAuMTozNDY3OSJdLCJleHAiOjE2MDM5NDM4MDAsImlzcyI6ImF3cyIsIm5iZiI6MTYwMzgzNTc5NSwicm9sZXMiOlsiYWRtaW4iXSwic3ViIjoiYmVuYXJlbnQiLCJ1c2VybmFtZSI6ImJlbmFyZW50In0.PZGUyFfhEWl22EDniWRLmKAjb3fL0D4cTmkxEfb-Q30hVMzVhka5WB8AUsPsLPVhTzsQ6Nkk1DnXHdz6oxrqDDfumuRrDnpJpjiXj_l0D3bExrchN61enzBHxSD13VkRIqP1V6l4i8yt8kXDIBWc-QejLTodA_GtczkDfnnpuAfaxIbD7jEwF27KI4kZu7uES9LMu2iCLdV9ZqarA-6HeDhXPA37OJ3P6eVQzYpgaOBYro5brEiVpuJLr1yA0gncmR4FqmhCpCj-KmHi2vmjmJAuuHId6HZoEZJjC9IAsNlrSA4GHH9j82o7FF1F4J2s38bRy3wZv46MT8X8-QBSpg
+```
diff --git a/docs/pages/includes/application-access/jwt-validate.mdx b/docs/pages/includes/application-access/jwt-validate.mdx
new file mode 100644
index 0000000000000..2d3b43b6ece67
--- /dev/null
+++ b/docs/pages/includes/application-access/jwt-validate.mdx
@@ -0,0 +1,17 @@
+Teleport provides a JSON Web Key Set (`jwks`) endpoint to verify that the JWT
+can be trusted. This endpoint is `https://[cluster-name]/.well-known/jwks.json`:
+
+*Example jwks.json*
+
+```json
+{
+  "keys": [
+    {
+      "kty": "RSA",
+      "n": "xk-0VSVZY76QGqeN9TD-FJp32s8jZrpsalnRoFwlZ_JwPbbd5-_bPKcz8o2tv1eJS0Ll6ePxRCyK68Jz2UC4V4RiYaqJCRq_qVpDQMB1sQ7p9M-8qvT82FJ-Rv-W4RNe3xRmBSFDYdXaFm51Uk8OIYfv-oZ0kGptKpkNY390aJOzjHPH2MqSvhk9Xn8GwM8kEbpSllavdJCRPCeNVGJXiSCsWrOA_wsv_jqBP6g3UOA9GnI8R6HR14OxV3C184vb3NxIqxtrW0C4W6UtSbMDcKcNCgajq2l56pHO8In5GoPCrHqlo379LE5QqpXeeHj8uqcjeGdxXTuPrRq1AuBpvQ",
+      "e": "AQAB",
+      "alg": "RS256"
+    }
+  ]
+}
+```
diff --git a/docs/pages/includes/auto-discovery/auto-discovery-labels.mdx b/docs/pages/includes/auto-discovery/auto-discovery-labels.mdx
new file mode 100644
index 0000000000000..09071d5967627
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/auto-discovery-labels.mdx
@@ -0,0 +1,3 @@
+Teleport applies a set of default labels to resources on AWS, Azure, and Google
+Cloud that join a cluster via auto-discovery. See the auto-discovery labels
+[reference](../../enroll-resources/auto-discovery/reference/labels.mdx)
diff --git a/docs/pages/includes/auto-discovery/aws-ec2-advanced-config.mdx b/docs/pages/includes/auto-discovery/aws-ec2-advanced-config.mdx
new file mode 100644
index 0000000000000..4c81cd1f977d0
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/aws-ec2-advanced-config.mdx
@@ -0,0 +1,93 @@
+{/* this comment is here to make the includes below render */}
+
+(!docs/pages/includes/auto-discovery/server-advanced-config.mdx matcher="aws"!)
+
+### Use a custom installation script
+
+(!docs/pages/includes/server-access/custom-installer.mdx matcher="aws"!) 
+
+### Use a custom SSM Document
+
+When executing the installation script on discovered EC2 instances, the Discovery Service uses an SSM document.
+
+The default `AWS-RunShellScript` SSM document works in most cases and is always available in AWS.
+
+However, if you need to customize the installation process for your environment, you can create a custom SSM Document and configure the Discovery Service to use it during installation.
+
+The custom document's parameters must include `env`, `scriptName` and `token`.
+
+The recommended approach is to use the following document and customize it as needed:
+
+```yaml
+schemaVersion: '2.2'
+description: aws:runShellScript
+parameters:
+  token:
+    type: String
+    description: "(Required) The Teleport invite token to use when joining the cluster."
+  scriptName:
+    type: String
+    description: "(Required) The Teleport installer script to use when joining the cluster."
+  env:
+    type: String
+    description: "Environment variables exported to the script. Format 'ENV=var FOO=bar'"
+    default: "X=$X"
+mainSteps:
+- action: aws:downloadContent
+  name: downloadContent
+  inputs:
+    sourceType: "HTTP"
+    destinationPath: "/tmp/installTeleport.sh"
+    sourceInfo:
+      url: "https://<Var name="teleport.example.com:443" />/webapi/scripts/installer/{{ scriptName }}"
+- action: aws:runShellScript
+  name: runShellScript
+  inputs:
+    timeoutSeconds: '300'
+    runCommand:
+      - export {{ env }}; /bin/sh /tmp/installTeleport.sh "{{ token }}"
+```
+
+Create this document using AWS Systems Manager in each region where you plan to discover instances.
+
+Edit your Discovery Service configuration to use the custom SSM Document, by setting the `ssm.document_name` key:
+
+```yaml
+# teleport.yaml
+version: v3
+# ...
+discovery_service:
+  enabled: true
+  aws:
+   - ssm:
+       document_name: "TeleportDiscoveryInstaller"
+```
+
+### Discover instances in all active regions
+
+The Discovery Service can be configured to scan all active AWS regions for EC2 instances.
+
+Edit the AWS matcher and set the `regions` key to wildcard (`*`):
+
+```yaml
+# teleport.yaml
+version: v3
+# ...
+discovery_service:
+  enabled: true
+  aws:
+   - regions: ["*"]
+     # other fields
+```
+
+Add the necessary IAM permissions to allow the Discovery Service to list regions:
+```json
+{
+    "Effect": "Allow",
+    "Action": [
+        // existing permissions
+        "account:ListRegions"
+    ],
+    "Resource": "*"
+}
+```
diff --git a/docs/pages/includes/auto-discovery/azure-vm-advanced-config.mdx b/docs/pages/includes/auto-discovery/azure-vm-advanced-config.mdx
new file mode 100644
index 0000000000000..6bb99ceffda45
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/azure-vm-advanced-config.mdx
@@ -0,0 +1,10 @@
+{/* this comment is here to make the includes below render */}
+
+(!docs/pages/includes/auto-discovery/server-advanced-config.mdx matcher="azure"!)
+
+### Use a custom installation script
+
+(!docs/pages/includes/server-access/custom-installer.mdx matcher="azure"!)
+
+If `client_id` is set in the Discovery Service config, custom installers will
+also have the `{{ .AzureClientID }}` templating option.
diff --git a/docs/pages/includes/auto-discovery/ec2-config.mdx b/docs/pages/includes/auto-discovery/ec2-config.mdx
new file mode 100644
index 0000000000000..a0949c1809d6d
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-config.mdx
@@ -0,0 +1,51 @@
+If you are running the Discovery Service on its own host, the service requires a
+valid invite token to connect to the cluster. Generate one by running the
+following command against your Teleport Auth Service:
+
+```code
+$ tctl tokens add --type=discovery
+```
+
+Save the generated token in `/tmp/token` on the Node (EC2 instance) that will
+run the Discovery Service.
+
+In order to enable EC2 instance discovery the `discovery_service.aws` section
+of `teleport.yaml` must include at least one entry:
+
+(!docs/pages/includes/discovery/discovery-group.mdx!)
+
+```yaml
+# teleport.yaml
+version: v3
+teleport:
+  join_params:
+    token_name: "/tmp/token"
+    method: token
+  proxy_server: "<Var name="teleport.example.com:443" />"
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+discovery_service:
+  enabled: true
+  discovery_group: "aws-prod"
+  aws:
+   - types: ["ec2"]
+     regions: ["us-east-1","us-west-1"]
+     ssm:
+       document_name: "AWS-RunShellScript"
+     install:
+        join_params:
+          token_name: aws-discovery-iam-token
+          method: iam
+     tags:
+       "env": "prod" # Match EC2 instances where tag:env=prod
+```
+
+- Edit the `teleport.proxy_server` key to match your Proxy Service's URI
+  and port.
+- Adjust the keys under `discovery_service.aws` to match your EC2 environment,
+  specifically the regions and tags you want to associate with the Discovery
+  Service.
diff --git a/docs/pages/includes/auto-discovery/ec2-cross-account-config.mdx b/docs/pages/includes/auto-discovery/ec2-cross-account-config.mdx
new file mode 100644
index 0000000000000..94a2a1a7a77a2
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-cross-account-config.mdx
@@ -0,0 +1,33 @@
+Add an entry to the `discovery_service.aws` section of your `teleport.yaml`
+file, assigning <Var name="role ARN" /> to the ARN of the IAM role to assume and
+<Var name="optional external ID" /> to an optional external ID:
+
+```yaml
+# teleport.yaml
+# ...
+discovery_service:
+  enabled: true
+  discovery_group: "aws-prod"
+  aws:
+  - types: ["ec2"]
+    ssm:
+      document_name: "AWS-RunShellScript"
+    # Add new entry after existing entries
+  - types: ["ec2"]
+    regions: ["us-east-1","us-west-1"]
+    install:
+      join_params:
+        token_name: aws-discovery-iam-token
+        method: iam
+    ssm:
+      document_name: "AWS-RunShellScript"
+    tags:
+      "env": "prod" # Match EC2 instances where tag:env=prod
+    assume_role_arn: "<Var name="role ARN" />"
+    external_id: "<Var name="optional external ID" />"
+  - types: ["ec2"]
+    ssm:
+      document_name: "AWS-RunShellScript"
+    # Add a new entry for each account.
+    # ...
+```
\ No newline at end of file
diff --git a/docs/pages/includes/auto-discovery/ec2-cross-account-token.mdx b/docs/pages/includes/auto-discovery/ec2-cross-account-token.mdx
new file mode 100644
index 0000000000000..3f4edc94c1770
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-cross-account-token.mdx
@@ -0,0 +1,18 @@
+Add a new entry to `spec.allow` in `token.yaml` and set `aws_account` to the
+account number of the new account, including the 
+<Var name="destination AWS account ID" />:
+
+```diff
+# token.yaml
+kind: token
+version: v2
+metadata:
+  name: aws-discovery-iam-token
+spec:
+  roles: [Node]
+  join_method: iam
+  allow:
+  - aws_account: "123456789012"
+    # Existing entry...
++ - aws_account: "<Var name="destination AWS account ID" />"
+```
diff --git a/docs/pages/includes/auto-discovery/ec2-invite-token.mdx b/docs/pages/includes/auto-discovery/ec2-invite-token.mdx
new file mode 100644
index 0000000000000..163562f841029
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-invite-token.mdx
@@ -0,0 +1,31 @@
+When discovering EC2 instances, Teleport makes use of IAM invite tokens for
+authenticating joining Nodes.
+
+Create a file called `token.yaml`:
+
+```yaml
+# token.yaml
+kind: token
+version: v2
+metadata:
+  # the token name is not a secret because instances must prove that they are
+  # running in your AWS account to use this token
+  name: aws-discovery-iam-token
+spec:
+  # use the minimal set of roles required (e.g. Node, App, Kube, DB, WindowsDesktop)
+  roles: [Node]
+
+  # set the join method allowed for this token
+  join_method: iam
+
+  allow:
+  # specify the AWS account which Nodes may join from
+  - aws_account: "123456789"
+```
+
+Assign the `aws_account` field to your AWS account number.
+Add the token to the Teleport cluster with:
+
+```code
+$ tctl create -f token.yaml
+```
\ No newline at end of file
diff --git a/docs/pages/includes/auto-discovery/ec2-next-steps.mdx b/docs/pages/includes/auto-discovery/ec2-next-steps.mdx
new file mode 100644
index 0000000000000..6c3047a92e1c9
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-next-steps.mdx
@@ -0,0 +1,8 @@
+- Read [Joining Nodes via AWS IAM
+  Role](../../enroll-resources/agents/aws-iam.mdx)
+for more information on IAM Invite Tokens.
+- Information on IAM best practices on EC2 instances managed by Systems
+Manager can be found in the [AWS Cloud Operations & Migrations Blog
+](https://aws.amazon.com/blogs/mt/applying-managed-instance-policy-best-practices/).
+- Full documentation on EC2 discovery configuration can be found through the [
+config file reference documentation](../../reference/deployment/config.mdx).
\ No newline at end of file
diff --git a/docs/pages/includes/auto-discovery/ec2-troubleshooting.mdx b/docs/pages/includes/auto-discovery/ec2-troubleshooting.mdx
new file mode 100644
index 0000000000000..1229a2e13af10
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/ec2-troubleshooting.mdx
@@ -0,0 +1,27 @@
+If Installs are showing failed or instances are failing to appear check the
+Command history in AWS System Manager -> Node Management -> Run Command.
+Select the instance-id of the Target to review Errors.
+
+### `cannot unmarshal object into Go struct field`
+
+If you encounter an error similar to the following:
+
+```text
+invalid format in plugin properties map[destinationPath:/tmp/installTeleport.sh sourceInfo:map[url:[https://example.teleport.sh:443/webapi/scripts/installer/preprod-installer](https://example.teleport.sh/webapi/scripts/installer/preprod-installer)] sourceType:HTTP];
+error json: cannot unmarshal object into Go struct field DownloadContentPlugin.sourceInfo of type string
+```
+
+It is likely that you're running an older SSM agent version. Upgrade to SSM agent version 3.1 or greater to resolve.
+
+### `InvalidInstanceId: Instances [[i-123]] not in a valid state for account 456`
+
+The following problems can cause this error:
+- The Discovery Service doesn't have permission to access the managed node.
+- AWS Systems Manager Agent (SSM Agent) isn't running. Verify that SSM Agent is running.
+- SSM Agent isn't registered with the SSM endpoint. Try reinstalling SSM Agent.
+- The discovered instance does not have permission to receive SSM
+  commands, verify the instance includes the AmazonSSMManagedInstanceCore IAM policy.
+
+See SSM RunCommand error codes and troubleshooting information in AWS documentation for more details:
+- https://docs.aws.amazon.com/systems-manager/latest/userguide/troubleshooting-managed-instances.html
+- https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html#API_SendCommand_Errors
\ No newline at end of file
diff --git a/docs/pages/includes/auto-discovery/gcp-vm-advanced-config.mdx b/docs/pages/includes/auto-discovery/gcp-vm-advanced-config.mdx
new file mode 100644
index 0000000000000..41aa03596a314
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/gcp-vm-advanced-config.mdx
@@ -0,0 +1,7 @@
+{/* this comment is here to make the includes below render */}
+
+(!docs/pages/includes/auto-discovery/server-advanced-config.mdx matcher="gcp"!)
+
+### Use a custom installation script
+
+(!docs/pages/includes/server-access/custom-installer.mdx matcher="gcp"!)
\ No newline at end of file
diff --git a/docs/pages/includes/auto-discovery/server-advanced-config.mdx b/docs/pages/includes/auto-discovery/server-advanced-config.mdx
new file mode 100644
index 0000000000000..76962af9503b2
--- /dev/null
+++ b/docs/pages/includes/auto-discovery/server-advanced-config.mdx
@@ -0,0 +1,61 @@
+{{ matcher="bar" }}
+
+This section covers configuration options for discovering and enrolling servers.
+
+### Install multiple Teleport agents on the same instance
+
+When using blue-green deployments or other multiple clusters setups, you might want to access your instances from different clusters.
+
+Teleport supports installing and running multiple agents on the same instance, using a suffixed installation which allows you to isolate each installation.
+
+To configure the Discovery Service to use a suffixed installation, specify the `install.suffix` key in your Discovery Service configuration:
+
+```yaml
+# teleport.yaml
+version: v3
+# ...
+discovery_service:
+  enabled: true
+  {{ matcher }}:
+   - install:
+       suffix: "blue-cluster"
+``` 
+
+Requires [agent managed updates](../../upgrading/agent-managed-updates/agent-managed-updates.mdx) to be enabled.
+
+### Define the group for Managed Updates
+
+If you are using Teleport [Agent managed updates](../../upgrading/agent-managed-updates/agent-managed-updates.mdx), you can configure the update group so that you can control which instances get updated together.
+
+To set the update group, specify the `install.update_group` key in your Discovery Service configuration:
+
+```yaml
+# teleport.yaml
+version: v3
+# ...
+discovery_service:
+  enabled: true
+  {{ matcher }}:
+   - install:
+       update_group: "update-group-1"
+```
+
+### Configure HTTP Proxy during installation
+
+For instances which require a proxy to access the installation files, you can configure HTTP Proxy settings in the Discovery Service.
+
+You must set the `install.http_proxy_settings` key in your configuration:
+
+```yaml
+# teleport.yaml
+version: v3
+# ...
+discovery_service:
+  enabled: true
+  {{ matcher }}:
+   - install:
+       http_proxy_settings:
+         https_proxy: http://172.31.5.130:3128
+         http_proxy: http://172.31.5.130:3128
+         no_proxy: my-local-domain
+``` 
\ No newline at end of file
diff --git a/docs/pages/includes/client-cluster-compatibility.mdx b/docs/pages/includes/client-cluster-compatibility.mdx
new file mode 100644
index 0000000000000..8ed5bd4857ac1
--- /dev/null
+++ b/docs/pages/includes/client-cluster-compatibility.mdx
@@ -0,0 +1,4 @@
+*For best results, Teleport clients (tsh, tctl, tbot) should be the same major
+version as the cluster they are connecting to. Teleport servers are compatible
+with clients that are on the same major version or one major version older.
+Teleport servers do not support clients that are on a newer major version. See our [Upgrading](../upgrading/upgrading.mdx) guide for more information.*
\ No newline at end of file
diff --git a/docs/pages/includes/cloud/install-linux-cloud.mdx b/docs/pages/includes/cloud/install-linux-cloud.mdx
deleted file mode 100644
index e5b168bccc12d..0000000000000
--- a/docs/pages/includes/cloud/install-linux-cloud.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
-  <Tabs>
-  <TabItem label="Debian 9+/Ubuntu 16.04+ (apt)">
-
-  Add the Teleport repository to your repository list:
-
-  ```code
-  $ sudo mkdir -p /etc/apt/keyrings
-  # Download Teleport's PGP public key
-  $ sudo curl https://apt.releases.teleport.dev/gpg \
-  -o /etc/apt/keyrings/teleport-archive-keyring.asc
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport APT repository for cloud.
-  $ echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \
-  https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/cloud" \
-  | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-
-  # Provide your Teleport domain to query the latest compatible Teleport version
-  $ export TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-  $ export TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-
-  # Update the repo and install Teleport and the Teleport updater
-  $ sudo apt-get update
-  $ sudo apt-get install "teleport-ent=$TELEPORT_VERSION" teleport-ent-updater
-  ```
-
-  </TabItem>
-  <TabItem label="Amazon Linux 2/RHEL 7/CentOS 7 (yum)">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport YUM repository for cloud.
-  # First, get the OS major version from $VERSION_ID so this fetches the correct
-  # package version.
-  $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-  $ sudo yum install -y yum-utils
-  $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport-yum.repo")"
-
-  # Provide your Teleport domain to query the latest compatible Teleport version
-  $ export TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-  $ export TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-
-  # Install Teleport and the Teleport updater
-  $ sudo yum install "teleport-ent-$TELEPORT_VERSION" teleport-ent-updater
-
-  ```
-
-  </TabItem>
-  <TabItem label="Amazon Linux 2023/RHEL 8+ (dnf)">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport YUM repository for cloud.
-  # First, get the OS major version from $VERSION_ID so this fetches the correct
-  # package version.
-  $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-  # Use the dnf config manager plugin to add the teleport RPM repo
-  $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport-yum.repo")"
-
-  # Provide your Teleport domain to query the latest compatible Teleport version
-  $ export TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-  $ export TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-  
-  # Install Teleport and the Teleport updater
-  $ sudo dnf install "teleport-ent-$TELEPORT_VERSION" teleport-ent-updater
-  
-  ```
-
-  </TabItem>
-  <TabItem label="SLES 12 SP5+ and 15 SP5+ (zypper)">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport Zypper repository for cloud.
-  # First, get the OS major version from $VERSION_ID so this fetches the correct
-  # package version.
-  $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-  # Use Zypper to add the teleport RPM repo
-  $ sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport-zypper.repo")
-
-  # Provide your Teleport domain to query the latest compatible Teleport version
-  $ export TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-  $ export TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-  
-  # Install Teleport and the Teleport updater
-  $ sudo zypper install "teleport-ent-$TELEPORT_VERSION" teleport-ent-updater
-  ```
-
-  </TabItem>
-  </Tabs>
diff --git a/docs/pages/includes/commercial-prereqs-tabs.mdx b/docs/pages/includes/commercial-prereqs-tabs.mdx
deleted file mode 100644
index f42fa807a28cb..0000000000000
--- a/docs/pages/includes/commercial-prereqs-tabs.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-{{ version="(=teleport.version=)" }}
-
-- A running Teleport Enterprise cluster version {{ version }} or above. If you
-  want to get started with Teleport, [sign up](https://goteleport.com/signup)
-  for a free trial.
-
-- The `tctl` admin tool and `tsh` client tool.
-
-  Visit [Installation](../installation.mdx) for instructions on downloading
-  `tctl` and `tsh`.
diff --git a/docs/pages/includes/compatibility.mdx b/docs/pages/includes/compatibility.mdx
index 2c6f8c7ab8ca3..ecc68ce3bc797 100644
--- a/docs/pages/includes/compatibility.mdx
+++ b/docs/pages/includes/compatibility.mdx
@@ -4,12 +4,15 @@ When running multiple `teleport` binaries within a cluster, the following rules
 apply:
 
 - Servers support clients that are one major version behind, but do not support
-  clients that are on a newer major version. For example, an 8.x.x Proxy Service
-  instance is compatible with 7.x.x agents and 7.x.x `tsh`, but we don't
-  guarantee that a 9.x.x agent will work with an 8.x.x Proxy Service instance.
-  This also means you must not attempt to upgrade from 6.x.x straight to 8.x.x.
-  You must upgrade to 7.x.x first.
+  clients that are on a newer major version. For example, an 17.x.x Proxy
+  Service instance is compatible with 16.x.x agents and 16.x.x `tsh`, but a
+  17.x.x agent will not work with an 16.x.x Proxy Service instance. This also
+  means you must not attempt to upgrade from 16.x.x straight to 18.x.x. You must
+  upgrade to 17.x.x first.
 - Proxy Service instances and agents do not support Auth Service instances that
   are on an older major version, and will fail to connect to older Auth Service
-  instances by default. For example, an 8.x.x Proxy Service or agent is not
-  compatible with an 7.x.x Auth Service.
+  instances by default. For example, an 18.x.x Proxy Service or agent is not
+  compatible with an 17.x.x Auth Service.
+- Auth Service instances should always be the first component of the cluster that
+  is upgraded, and you must upgrade all Auth Service instances to the target version
+  before proceeding to upgrade Proxy Service instances, other agents, and client tools (tsh, tctl, tbot, Connect, etc).
diff --git a/docs/pages/includes/config-reference/app-service.yaml b/docs/pages/includes/config-reference/app-service.yaml
index 348f6764975b0..56c5383d39121 100644
--- a/docs/pages/includes/config-reference/app-service.yaml
+++ b/docs/pages/includes/config-reference/app-service.yaml
@@ -5,6 +5,10 @@ app_service:
     # Application Service is working correctly. The app outputs JWTs so it can
     # be useful when extending your application.
     debug_app: true
+    # Enables the builtin Teleport demo MCP server that shows current user and
+    # session information. To access it, this MCP server uses the app label
+    # "teleport.internal/resource-type" with the value "demo".
+    mcp_demo_server: true
 
     # Matchers for dynamic application resources
     #
@@ -103,3 +107,13 @@ app_service:
         ## Default: roles-and-traits
         # jwt_claims: roles-and-traits
 
+      # Contains MCP server-related configurations.
+      mcp:
+        # Command to launch stdio-based MCP servers.
+        command: "docker"
+        # Args to execute with the command.
+        args: ["run", "-i", "--rm", "mcp/everything"]
+        # Name of the host user account under which the command will be
+        # executed. Required for stdio-based MCP servers.
+        run_as_host_user: "docker"
+
diff --git a/docs/pages/includes/config-reference/auth-service.yaml b/docs/pages/includes/config-reference/auth-service.yaml
index 4281b00b6ddab..47f84d3179d7c 100644
--- a/docs/pages/includes/config-reference/auth-service.yaml
+++ b/docs/pages/includes/config-reference/auth-service.yaml
@@ -258,6 +258,9 @@ auth_service:
       # - 'required' - enables device authentication and device-aware audit.
       #   Additionally, it requires a trusted device for all SSH, Database
       #   and Kubernetes connections.
+      # - 'required-for-humans' - enables device authentication and device-aware
+      #   audit. Additionally, it requires a trusted device for all SSH, Database
+      #   and Kubernetes connections, for human users only (bots are exempt).
       mode: optional # always "off" for Teleport Community Edition
 
     # Determines the default time to live for user certificates
@@ -312,29 +315,66 @@ auth_service:
   # We recommend to use tools like `pwgen` to generate sufficiently random
   # tokens of 32+ byte length.
   tokens:
-    - "proxy,node:xxxxx"
-    - "auth:yyyy"
-
-  # Optional setting for configuring session recording. Possible values are:
-  #    "node"      : (default) sessions will be recorded on the node
-  #                  and periodically cleaned up after they are uploaded
-  #                  to the storage service.
-  #    "node-sync" : session recordings will be streamed from
-  #                  node -> auth -> storage service without being stored on
-  #                  disk at all.
-  #    "proxy"     : sessions will be recorded on the proxy and periodically
-  #                  cleaned up after they are uploaded to the storage service.
-  #    "proxy-sync : session recordings will be streamed from
-  #                  proxy -> auth -> storage service without being stored on
-  #                  disk at all.
-  #    "off"   : session recording is turned off
-  #
-  session_recording: "node"
-
-  # This setting determines if a Teleport proxy performs strict host key
-  # checks.
-  # Only applicable if session_recording=proxy
-  proxy_checks_host_keys: yes
+    - 'proxy,node:xxxxx'
+    - 'auth:yyyy'
+
+  # Optional configuration for session recording.
+  session_recording_config:
+    # Recording mode that should be use for session recordings. Possible
+    # values are:
+    #    "node"      : (default) sessions will be recorded on the node
+    #                  and periodically cleaned up after they are uploaded
+    #                  to the storage service.
+    #    "node-sync" : session recordings will be streamed from
+    #                  node -> auth -> storage service without being stored on
+    #                  disk at all.
+    #    "proxy"     : sessions will be recorded on the Teleport Proxy Service
+    #                  and periodically cleaned up after they are uploaded to
+    #                  the storage service.
+    #    "proxy-sync : session recordings will be streamed from
+    #                  proxy -> auth -> storage service without being stored on
+    #                  disk at all.
+    #    "off"   : session recording is turned off
+    #
+    mode: 'node'
+    # This setting determines if a Teleport Proxy Service instance performs
+    # strict host key checks.
+    # Only applicable if session_recording=proxy
+    proxy_checks_host_keys: yes
+    # Optional configuration for encrypting session recordings.
+    encryption:
+      # Determines whether or not session recordings should be encrypted at
+      # rest. By default, all encryption keys required will be provisioned
+      # using the key storage backend defined in ca_key_params.
+      enabled: yes
+      # Optional configuration allowing for manually managing encryption keys
+      # instead of relying on automatic key provisioning and management.
+      manual_key_management:
+        # Determine whether or not manual key management should be used.
+        enabled: yes
+        # The list of key labels that should be used to find active encryption
+        # keys. These support encrypting new session recordings and are each a
+        # pair of key backend type and label value to use during key lookup.
+        # Possible values for 'type' match the possible keys in ca_key_params,
+        # which are:
+        #   "pkcs11"  : PKCS#11 compliant HSM
+        #   "aws_kms" : AWS KMS
+        #   "gcp_kms" : Google Cloud KMS
+        #
+        # Label values are used to identify the key(s) within the key backend.
+        # For "pkcs11" keys these are expected to map directly to labels within
+        # the HSM. For 'aws_kms' keys, both ARN or ID values are valid. For
+        # 'gcp_kms' the full key version name is expected.
+        active_keys:
+          - type: pkcs11
+            label: "session_recording"
+        # The list of key labels that should be used to find rotated encryption
+        # keys. These allow for replaying historical session recordings
+        # encrypted with keys that are no longer active. Individual list
+        # elements share the format described above for "active_keys".
+        rotated_keys:
+          - type: pkcs11
+            label: "rotated_session_recording"
 
   # Determines if sessions to cluster resources are forcefully terminated after
   # no activity from a client (idle client).
@@ -373,8 +413,8 @@ auth_service:
   # unlikely that you'll need to change this.
   # session_control_timeout: 2m
 
-  # Determines the routing strategy used to connect to nodes. Can be
-  # 'unambiguous_match' (default), or 'most_recent'.
+  # Determines the routing strategy used to connect to nodes when connecting via 
+  # node name. Can be 'unambiguous_match' (default), or 'most_recent'.
   routing_strategy: unambiguous_match
 
   # License file to start auth server with. Note that this setting is ignored
diff --git a/docs/pages/includes/config-reference/database-config.yaml b/docs/pages/includes/config-reference/database-config.yaml
index be80ab1cdd55c..18f7fe72a4f56 100644
--- a/docs/pages/includes/config-reference/database-config.yaml
+++ b/docs/pages/includes/config-reference/database-config.yaml
@@ -5,26 +5,35 @@ db_service:
   # Matchers for database resources created with "tctl create" command or by the
   # discovery service.
   resources:
+    # Resource labels to match.
+    #
+    # Use specific label selectors so each Database Service instance only
+    # matches databases it can actually reach.
   - labels:
-      "*": "*"
+      "env": "staging"
     # Optional AWS role that the Database Service will assume to access the
     # databases.
     aws:
       assume_role_arn: "arn:aws:iam::123456789012:role/example-role-name"
       external_id: "example-external-id"
 
-  # Matchers for registering AWS-hosted databases.
+  # Matchers for registering AWS-hosted databases by performing auto-discovery
+  # on the Database Service.
+  #
+  # NOTE: for most deployments, it is recommended to use the Discovery Service
+  # to register AWS databases instead of Database Service–based discovery.
   aws:
     # Database types. Valid options are:
     # 'rds' - discovers and registers Amazon RDS and Aurora databases.
     # 'rdsproxy' - discovers and registers Amazon RDS Proxy databases.
     # 'redshift' - discovers and registers Amazon Redshift databases.
     # 'redshift-serverless' - discovers and registers Amazon Redshift Serverless databases.
-    # 'elasticache' - discovers and registers Amazon ElastiCache Redis databases.
-    # 'memorydb' - discovers and registers Amazon MemoryDB Redis databases.
+    # 'elasticache' - discovers and registers Amazon ElastiCache Redis and Valkey databases.
+    # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
+    # 'memorydb' - discovers and registers Amazon MemoryDB databases.
     # 'opensearch' - discovers and registers Amazon OpenSearch databases.
     # 'docdb' - discovers and registers Amazon DocumentDB databases.
-  - types: ["rds", "rdsproxy","redshift", "redshift-serverless", "elasticache", "memorydb", "opensearch"]
+  - types: ["rds", "rdsproxy","redshift", "redshift-serverless", "elasticache", "elasticache-serverless", "memorydb", "opensearch", "docdb"]
     # AWS regions to register databases from.
     regions: ["us-west-1", "us-east-2"]
     # Optional AWS role that the Database Service will assume to discover
@@ -36,10 +45,17 @@ db_service:
     # a role in an external AWS account.
     external_id: "example-external-id"
     # AWS resource tags to match when registering databases.
+    #
+    # Use specific tag selectors so each Database Service instance only matches
+    # databases it can actually reach.
     tags:
-      "*": "*"
+      "env": "staging"
 
-  # Matchers for registering Azure-hosted databases.
+  # Matchers for registering Azure-hosted databases by performing auto-discovery
+  # on the Database Service.
+  #
+  # NOTE: for most deployments, it is recommended to use the Discovery Service
+  # to register AWS databases instead of Database Service–based discovery.
   azure:
     # Database types. Valid options are:
     # 'mysql' - discovers and registers Azure MySQL databases.
@@ -58,8 +74,11 @@ db_service:
     # '*' - discovers databases in all resource groups within configured subscription(s) (default).
     resource_groups: ["group1", "group2"]
     # Azure resource tags to match when registering databases.
+    #
+    # Use specific tag selectors so each Database Service instance only matches
+    # databases it can actually reach.
     tags:
-      "*": "*"
+      "env": "staging"
 
   # Lists statically registered databases proxied by this agent.
   databases:
@@ -116,6 +135,13 @@ db_service:
       # When this option is set the Database Agent doesn't try to check the MySQL server version.
       server_version: 8.0.28
 
+    # Oracle only options.
+    oracle:
+      # Randomize host order per connection attempt to spread load. Optional.
+      shuffle_hostnames: true
+      # Retries per host on network errors only; non-network errors stop (default: 2). Optional.
+      retry_count: 5            
+
     # Optional admin user configuration for Automatic User Provisioning.
     admin_user:
       # Name of the admin user.
@@ -180,6 +206,12 @@ db_service:
       project_id: "xxx-1234"
       # Cloud SQL instance ID.
       instance_id: "example"
+      # AlloyDB-specific configuration.
+      alloydb:
+        # Endpoint type. Valid types: "private" (default), "public", "PSC".
+        endpoint_type: "private"
+        # Endpoint override. IP address or hostname to be used instead of automatically resolved endpoint.
+        endpoint_override: "11.22.33.44"
 
     # Settings specific to Active Directory authentication e.g. for SQL Server.
     ad:
diff --git a/docs/pages/includes/config-reference/desktop-config.yaml b/docs/pages/includes/config-reference/desktop-config.yaml
index 236e43b6b144d..bd2aab8e8e814 100644
--- a/docs/pages/includes/config-reference/desktop-config.yaml
+++ b/docs/pages/includes/config-reference/desktop-config.yaml
@@ -19,6 +19,13 @@ windows_desktop_service:
     # For best results, this address should point to a highly-available
     # endpoint rather than a single domain controller.
     addr: "$LDAP_SERVER_ADDRESS"
+    # locate_server gets a list of available LDAP servers from the AD 
+    # domain's SRV records. When enabled, addr is ignored.
+    locate_server: 
+      enabled: true
+      # Optional: Site is the logical AD site that locate_server should return.
+      # Ignored if locate_server is false.
+      site: "$LDAP_SITE_NAME"
     # Optional: the server name to use when validating the LDAP server's
     # certificate. Useful in cases where addr is an IP but the server
     # presents a cert with some other hostname.
@@ -69,8 +76,9 @@ windows_desktop_service:
   pki_domain: root.example.com
 
   # (optional) Configures the address of the Kerberos Key Distribution Center,
-  # which is used to support RDP Network Level Authentication (NLA).
-  # If empty, the LDAP address will be used instead.
+  # which is used to support RDP Network Level Authentication (NLA). When set,
+  # this field takes priority over locate_server. If empty and locate_server
+  # is disabled, the LDAP address will be used instead.
   #
   # example: kdc.example.com:88.
   # The port is optional and defaults to port 88 if unspecified.
@@ -112,6 +120,10 @@ windows_desktop_service:
   # (optional) interval at which to run desktop discovery
   discovery_interval: 10m
 
+  # (optional) interval at which to publish CRLs
+  # Defaults to 5m if unspecified
+  publish_crl_interval: 10m
+
   # (optional) configure a set of label selectors for dynamic registration.
   # If specified, this service will monitor the cluster for dynamic_windows_desktop
   # and automatically proxy connections for desktops with matching labels.
diff --git a/docs/pages/includes/config-reference/identity-security.yaml b/docs/pages/includes/config-reference/identity-security.yaml
new file mode 100644
index 0000000000000..d71b67dd21f89
--- /dev/null
+++ b/docs/pages/includes/config-reference/identity-security.yaml
@@ -0,0 +1,166 @@
+# IP and the port for Teleport Identity Security to bind to.
+address: 0.0.0.0:8080
+
+# Registration CA certificates for the Identity Security service.
+# These are used to verify the authenticity of the Teleport clusters
+# when they register with the Identity Security service.
+# The Identity Security service uses these certificates to ensure that
+# only trusted Teleport clusters can register and communicate with it.
+# You can specify multiple CA certificates if you have multiple Teleport clusters
+# that need to register with the Identity Security service.
+# The certificates should be the Teleport Host CA certificate and be in the
+# PEM format.
+registration_cas:
+  - /var/is/teleport-host-ca.pem
+  - /var/is/teleport-host-ca2.pem
+
+# TLS certificate for the HTTPS/gRPC connections. Configuring these properly is
+# critical for security.
+tls:
+  cert: /var/lib/teleport/identity_security_cert.pem
+  key: /var/lib/teleport/identity_security_key.pem
+
+# Teleport Identity Security service storage configuration.
+backend:
+  # postgres defines connection parameters for the PostgreSQL database
+  # used by the Identity Security service to store its data.
+  # If you use a PostgreSQL cluster, you must ensure to define
+  # the connection string to connect to the primary node (the writer).
+  postgres:
+    # Address and port for the PostgreSQL database to connect to.
+    # This is used to store the Identity Security service data.
+    # The database should be running and accessible from the Identity Security service.
+    # If you do not need a PostgreSQL database, you can disable this feature.
+    connection: postgres://teleport:teleport_password@localhost:5432/identity_security?sslmode=disable
+
+    # Maximum number of connections to the PostgreSQL database.
+    max_conns: 20
+
+    # Minimum number of connections to the PostgreSQL database.
+    min_conns: 10
+
+    # Maximum time a connection can be open before it is closed.
+    max_conn_lifetime: 24h
+
+    # Maximum time a connection can be idle before it is closed.
+    max_conn_idle_time: 10m
+
+    # Health check period for the PostgreSQL database.
+    health_check_period: 10s
+
+    # Maximum connection lifetime jitter in seconds.
+    max_conn_lifetime_jitter: 10s
+
+    # If you want to use IAM authentication instead of password authentication,
+    # you can uncomment the following section and provide the AWS region.
+    #
+    # iam:
+    #   aws_region: us-west-2
+
+  # postgres_read_replica defines connection parameters for the PostgreSQL read replica
+  # used by the Identity Security service to store its data.
+  # postgres_read_replica:
+  #   Address and port for the PostgreSQL database to connect to.
+  #   This is used to store the Identity Security service data.
+  #   The database should be running and accessible from the Identity Security service.
+  #   If you do not need a PostgreSQL database, you can disable this feature.
+  #   connection: postgres://teleport:teleport_password@localhost:5432/identity_security?sslmode=disable
+
+  #  Maximum number of connections to the PostgreSQL database.
+  #  max_conns: 20
+
+  #  Minimum number of connections to the PostgreSQL database.
+  #  min_conns: 10
+
+  #  Maximum time a connection can be open before it is closed.
+  #  max_conn_lifetime: 24h
+
+  #  Maximum time a connection can be idle before it is closed.
+  #  max_conn_idle_time: 10m
+
+  #  Health check period for the PostgreSQL database.
+  #  health_check_period: 10s
+
+  #  Maximum connection lifetime jitter in seconds.
+  #  max_conn_lifetime_jitter: 10s
+
+  #  If you want to use IAM authentication instead of password authentication,
+  #  you can uncomment the following section and provide the AWS region.
+  #  iam:
+  #    aws_region: us-west-2
+
+# Teleport Identity Security Identity Activity Center configuration.
+identity_activity_center:
+  # region defines the AWS region where the Identity Activity Center is deployed.
+  region: eu-central-1
+  # The AWS Athena database and table used by the Identity Activity Center.
+  # This is used to query the Identity Activity Center data.
+  database: identity_activity_center
+  # The AWS Athena table used by the Identity Activity Center.
+  # This is used to query the Identity Activity Center data.
+  # The table should be created in the Athena database specified above.
+  table: identity_activity_center_table
+  # The S3 long-term bucket used by the Identity Activity Center to store its data.
+  # This must be the same bucket used by the Athena database and table.
+  s3: s3://long-term-bucket/data/
+  # Transient S3 bucket location used by the Identity Activity Center to store temporary data
+  # such as query results.
+  s3_results: s3://transient-bucket/results/
+  # Transient S3 bucket location used by the Identity Activity Center to store large files.
+  s3_large_files: s3://transient-bucket/large_files
+  # Workgroup name used by the Identity Activity Center to execute Athena queries.
+  workgroup: identity-activity-center-workgroup
+  # AWS SQS queue URL used by the Identity Activity Center to send notifications
+  # between the Teleport Identity Security replicas.
+  sqs_queue_url: https://sqs.eu-central-1.amazonaws.com/123456789/example-queue
+  # MaxMind GeoIP database path used by the Identity Activity Center
+  # to enrich the Identity Activity Center data with geolocation information.
+  # This is optional.
+  maxmind_geoip_city_db_path: /path/to/geoIp-city.mmdb
+
+# Teleport Identity Security metrics endpoint configuration.
+metrics:
+  # Enable Teleport Identity Security Metrics. This is used to collect
+  # and expose metrics about the Identity Security service such as
+  # the number of requests, errors, and latency.
+  # This is useful for monitoring and alerting purposes.
+  # If you do not need these metrics, you can disable this feature.
+  enabled: true
+
+  # Address and port for Teleport Identity Security Metrics to bind to.
+  address: 0.0.0.0:3000
+
+  # TLS configuration for the metrics endpoint.
+  # If you do not need TLS for the metrics endpoint, you can disable it.
+  # tls:
+  #   cert: /var/lib/is/identity_security_metrics_cert.pem
+  #   key: /var/lib/is/identity_security_metrics_key.pem
+
+  # Teleport Identity Security profiling endpoint configuration.
+  # This is used to collect profiling data about the Identity Security service.
+  pprof: false
+
+# Teleport Identity Security tracing configuration.
+# This is used to collect distributed tracing data about the Identity Security service.
+# If you do not need tracing, you can disable this feature.
+tracing:
+  # Enable Teleport Identity Security Tracing. This is used to collect
+  # and export tracing data about the Identity Security service.
+  enabled: false
+  # Exporter URL for the tracing data.
+  # This should be the URL of the OpenTelemetry Collector or any other
+  # compatible tracing backend.
+  # The URL should include the protocol (e.g., "otlp://") and the address
+  # of the tracing backend (e.g., "localhost:4317").
+  exporter_url: "otlp://localhost:4317"
+  # Sampling rate for the tracing data. This controls how many traces are sampled
+  # per million requests.
+  # A value of 1000 means that 1000 traces will be sampled per million requests
+  # i.e. 10%.
+  sampling_rate_per_million: 1000
+
+# Logging configuration.
+log:
+  # Possible severity values are DEBUG, INFO (default), WARN,
+  # and ERROR.
+  level: debug
diff --git a/docs/pages/includes/config-reference/instance-wide.yaml b/docs/pages/includes/config-reference/instance-wide.yaml
index ae423f2c1a2c9..51a5a36835dd2 100644
--- a/docs/pages/includes/config-reference/instance-wide.yaml
+++ b/docs/pages/includes/config-reference/instance-wide.yaml
@@ -92,16 +92,38 @@ teleport:
     # point to a Load Balancer.
     proxy_server: teleport-proxy.example.com:443
 
+    # Relay tunnel address and port to connect to, if set. Used by some services
+    # to open additional tunnels to a Relay group if Teleport is configured to
+    # connect to a Proxy Server. If a Relay group consists of more than one
+    # Relay Service instance, the address should point to a Load Balancer.
+    # Used in Teleport v18.3.0 and later for the SSH service.
+    relay_server: teleport-relay.example.com:3042
+
     # cache:
     #  # The cache is enabled by default, it can be disabled with this flag
     #  enabled: true
 
+    # The duration (in string form) of the delay between receiving a termination
+    # signal and the beginning of the shutdown procedures. It can be used to
+    # give time to load balancers to stop routing connections to the Teleport
+    # instance while the instance is still capable of handling them. If unset or
+    # negative, no delay is applied.
+    #shutdown_delay: "0s"
+
     # Teleport can limit the number of connections coming from each client
     # IP address to avoid abuse. Note that these limits are enforced separately
     # for each service (SSH, Kubernetes, etc.)
     connection_limits:
         max_connections: 1000
 
+    # Auth Service connection configuration.
+    # These settings can be tweaked to control how aggresively the Proxy or Agent instances will retry to connect. In addition
+    # each instance will apply jitter.
+    # auth_connection_config:
+    #     upper_limit_between_retries: "90s"  # Cannot be lower than 10s
+    #     initial_connection_delay: "9s"      # When unset upper_limit_between_retries / 10
+    #     backoff_step_duration: "18s"        # When unset upper_limit_between_retries / 5
+
     # Logging configuration. Possible output values to disk via
     # '/var/lib/teleport/teleport.log',
     # 'stdout', 'stderr' and 'syslog'. Possible severity values are DEBUG, INFO (default), WARN,
diff --git a/docs/pages/includes/config-reference/relay-service.yaml b/docs/pages/includes/config-reference/relay-service.yaml
new file mode 100644
index 0000000000000..72a1cd7861d8d
--- /dev/null
+++ b/docs/pages/includes/config-reference/relay-service.yaml
@@ -0,0 +1,49 @@
+relay_service:
+  # Enables the Relay Service, defaults to false.
+  enabled: true
+
+  # The name of the Relay group. All Relay Service instances that are accessible
+  # behind the same Load Balancer must use the same name, and other Relay
+  # Service instances in the same Teleport cluster must use a different name.
+  relay_group: groupname
+
+  # The amount of distinct tunnels that other Teleport agents will open when
+  # using this Relay group. The target connection count should be no bigger than
+  # the amount of distinct Relay Service instances behind the Load Balancer.
+  target_connection_count: 2
+
+  # A list of hostnames or IP addresses that agents and clients can use to
+  # connect to the Relay group. Most setups will only need one.
+  public_hostnames:
+    - relay-group.example.com
+
+  # The listen address and port for the transport server of the Relay Service,
+  # used by clients to access resources through the Relay.
+  transport_listen_addr: 0.0.0.0:3040
+
+  # Whether or not the transport server should expect a PROXY protocol v2 header
+  # for incoming connections. If set, anything with the ability to connect
+  # directly to the transport listener will be able to spoof the source of
+  # network connections. Defaults to false.
+  #transport_proxy_protocol: true
+
+  # The listen address and port for the peer server of the Relay Service, used
+  # by other Relay Service instances of the same Relay group to forward
+  # connections between instances.
+  peer_listen_addr: 0.0.0.0:3041
+
+  # The address and port that other Relay Service instances of the same group should use
+  # to connect to the peer server. Defaults to the first available private IP
+  # address found in the system's network interfaces.
+  #peer_public_addr: 1.2.3.4:3041
+
+  # The listen address and port for the tunnel server of the Relay Service, used
+  # by agents to discover the Relay group configuration and open tunnels to the
+  # Relay.
+  tunnel_listen_addr: 0.0.0.0:3042
+
+  # Whether or not the tunnel server should expect a PROXY protocol v2 header
+  # for incoming connections. If set, anything with the ability to connect
+  # directly to the tunnel listener will be able to spoof the source of network
+  # connections. Defaults to false.
+  #tunnel_proxy_protocol: true
diff --git a/docs/pages/includes/config-reference/ssh-service.yaml b/docs/pages/includes/config-reference/ssh-service.yaml
index d7965552b563c..d8b38d2a9b2df 100644
--- a/docs/pages/includes/config-reference/ssh-service.yaml
+++ b/docs/pages/includes/config-reference/ssh-service.yaml
@@ -1,6 +1,6 @@
 ssh_service:
-    # Turns 'ssh' role on. Default is true
-    enabled: true
+  # Turns 'ssh' role on. Default is true
+  enabled: true
 
   # IP and the port for SSH service to bind to.
   listen_addr: 0.0.0.0:3022
diff --git a/docs/pages/includes/database-access/alternative-methods-join.mdx b/docs/pages/includes/database-access/alternative-methods-join.mdx
index da316944bd776..2de0dd2aa4fcd 100644
--- a/docs/pages/includes/database-access/alternative-methods-join.mdx
+++ b/docs/pages/includes/database-access/alternative-methods-join.mdx
@@ -5,7 +5,7 @@ For users with a lot of infrastructure in AWS, or who might create or recreate
 many instances, consider alternative methods for joining new EC2 instances running
 Teleport:
 
-- [Configure Teleport to Automatically Enroll EC2 instances](../../enroll-resources/auto-discovery/servers/ec2-discovery.mdx)
+- [Configure Teleport to Automatically Enroll EC2 instances](../../enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx)
 - [Joining Teleport Services via AWS IAM
   Role](../../enroll-resources/agents/aws-iam.mdx)
 - [Joining Teleport Services via AWS EC2 Identity Document](../../enroll-resources/agents/aws-ec2.mdx)
diff --git a/docs/pages/includes/database-access/auto-user-provisioning/connect.mdx b/docs/pages/includes/database-access/auto-user-provisioning/connect.mdx
index 891efcc664187..2d55518cc26ec 100644
--- a/docs/pages/includes/database-access/auto-user-provisioning/connect.mdx
+++ b/docs/pages/includes/database-access/auto-user-provisioning/connect.mdx
@@ -2,8 +2,6 @@
 
 Now, log into your Teleport cluster and connect to the database:
 
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
-
 ```code
 $ tsh login --proxy=teleport.example.com
 $ tsh db connect --db-name <database> example
diff --git a/docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx b/docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx
new file mode 100644
index 0000000000000..9c01c83a737bc
--- /dev/null
+++ b/docs/pages/includes/database-access/auto-user-provisioning/mysql-default-database-note.mdx
@@ -0,0 +1,3 @@
+Note that Teleport uses `teleport` as the name of the default database but the
+name is configurable in the Teleport database definition. Replace the database
+name in the last two lines if you wish to use another database name.
\ No newline at end of file
diff --git a/docs/pages/includes/database-access/aws-db-iam-policy-picker.mdx b/docs/pages/includes/database-access/aws-db-iam-policy-picker.mdx
index b160db76e0c36..420f38fc1e532 100644
--- a/docs/pages/includes/database-access/aws-db-iam-policy-picker.mdx
+++ b/docs/pages/includes/database-access/aws-db-iam-policy-picker.mdx
@@ -11,10 +11,15 @@
 (!docs/pages/includes/database-access/reference/aws-iam/dynamodb/access-policy.mdx dbUserRole="DatabaseUserRole" !)
 
 </TabItem>
-<TabItem label="ElastiCache Redis">
+<TabItem label="ElastiCache">
 
 (!docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx!)
 
+</TabItem>
+<TabItem label="ElastiCache Serverless">
+
+(!docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx!)
+
 </TabItem>
 <TabItem label="Keyspaces">
 
diff --git a/docs/pages/includes/database-access/aws-redis-how-it-works.mdx b/docs/pages/includes/database-access/aws-redis-how-it-works.mdx
new file mode 100644
index 0000000000000..af10499808470
--- /dev/null
+++ b/docs/pages/includes/database-access/aws-redis-how-it-works.mdx
@@ -0,0 +1,12 @@
+The Teleport Database Service proxies traffic from users to {{ dbType }}
+for Redis and Valkey. Authentication between the Database Service and the
+{{ dbType }} database can take one of two forms:
+
+- **IAM authentication (preferred):** The Teleport Database Service connects to
+  the database using a short-lived AWS IAM authentication token. AWS IAM
+  authentication is available for {{ dbType }} with engine version 7.0 or above.
+- **Managing users:** The Teleport Database Service manages users in a access
+  control list, rotates their passwords every 15 minutes, and saves these
+  passwords in AWS Secrets Manager. The Database Service automatically sends an
+  `AUTH` command with the saved password when connecting the client to the
+  {{ dbType }} server.
diff --git a/docs/pages/includes/database-access/aws-redis-no-auth.mdx b/docs/pages/includes/database-access/aws-redis-no-auth.mdx
new file mode 100644
index 0000000000000..9695628d96a4f
--- /dev/null
+++ b/docs/pages/includes/database-access/aws-redis-no-auth.mdx
@@ -0,0 +1,7 @@
+If you choose not to use the above options, Teleport will not automatically
+authenticate with the database.
+
+You can either set up a "no password" configuration for your {{ dbType }} user,
+or manually enter an `AUTH` command with the password you have configured after
+a successful client connection. However, it is strongly advised to use one of
+the first two options or a strong password for better security.
diff --git a/docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx b/docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx
new file mode 100644
index 0000000000000..e4e22930168db
--- /dev/null
+++ b/docs/pages/includes/database-access/aws-redis-tsh-db-user-auth.mdx
@@ -0,0 +1,34 @@
+If flag `--db-user` is not provided, Teleport logs in as the `default` user.
+
+Now, depending on the authentication configurations, you may need to send an
+`AUTH` command to authenticate with the Redis server:
+
+<Tabs>
+  <TabItem label="Redis with ACL">
+    The Database Service automatically authenticates Teleport-managed and
+    IAM-enabled users with the database. No `AUTH` command is required after
+    successful connection.
+
+    If you are connecting as a user that is not managed by Teleport and is not
+    IAM-enabled, the connection normally starts as the `default` user.
+    Now you can authenticate the database user with its password:
+
+    ```
+    AUTH my-database-user <USER_PASSWORD>
+    ```
+  </TabItem>
+
+  <TabItem label="Redis with AUTH token">
+    Now you can authenticate with the shared AUTH token:
+
+    ```
+    AUTH <SHARED_AUTH_TOKEN>
+    ```
+  </TabItem>
+
+  <TabItem label="Redis without AUTH">
+    For Redis or Valkey deployments without the ACL system or legacy
+    `requirepass` directive enabled, no `AUTH` command is required.
+  </TabItem>
+
+</Tabs>
diff --git a/docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx b/docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx
index 7821678f87026..d2b2deabdc0a8 100644
--- a/docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx
+++ b/docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx
@@ -79,7 +79,7 @@ You can reduce the policy size by separating them into multiple IAM roles. Use
   <Admonition type="tip" title="Auto-discovery labels">
   Teleport generates certain labels derived from the cloud resource attributes
   during discovery. See [Auto-Discovery
-  labels](../../reference/agent-services/database-access-reference/labels.mdx)
+  labels](../../enroll-resources/database-access/reference/labels.mdx)
   /labels/#auto-discovery)
   for more details.
   </Admonition>
@@ -207,7 +207,7 @@ the IAM identity of the host running the Database Service.
 
 The `assume_role_arn` is not limited to the same AWS account so you can also
 use this feature for [AWS Cross-Account
-Access](../../enroll-resources/database-access/enroll-aws-databases/aws-cross-account.mdx).
+Access](../../enroll-resources/database-access/enrollment/aws/aws-cross-account.mdx).
 
 </details>
 
diff --git a/docs/pages/includes/database-access/aws-troubleshooting.mdx b/docs/pages/includes/database-access/aws-troubleshooting.mdx
index 0782c1f794494..a27abe97dd9aa 100644
--- a/docs/pages/includes/database-access/aws-troubleshooting.mdx
+++ b/docs/pages/includes/database-access/aws-troubleshooting.mdx
@@ -12,14 +12,7 @@ AWS provides instructions to rotate your [SSL/TLS certificate](https://docs.aws.
 
 ### Timeout errors
 
-The Teleport Database Service needs connectivity to your database endpoints. That may require
-enabling inbound traffic on the database from the Database Service on the same VPC or routing rules from another VPC. Using the `nc`
-program you can verify connections to databases:
-
-```code
-$ nc -zv postgres-instance-1.sadas.us-east-1.rds.amazonaws.com 5432
-# Connection to postgres-instance-1.sadas.us-east-1.rds.amazonaws.com (172.31.24.172) 5432 port [tcp/postgresql] succeeded!
-```
+(!docs/pages/includes/database-access/connection-timeout-troubleshooting.mdx!)
 
 ### Not authorized to perform `sts:AssumeRole`
 
diff --git a/docs/pages/includes/database-access/cloudsql_service_credentials.mdx b/docs/pages/includes/database-access/cloudsql_service_credentials.mdx
index 349c776b49541..90b5599386f43 100644
--- a/docs/pages/includes/database-access/cloudsql_service_credentials.mdx
+++ b/docs/pages/includes/database-access/cloudsql_service_credentials.mdx
@@ -6,6 +6,8 @@ If the Teleport Database Service is hosted on a GCE instance, you can
 For non-GCE deployments of Teleport, we recommend using
 [workload identity](https://cloud.google.com/iam/docs/workload-identity-federation).
 
+<details>
+  <summary>Using service account keys (insecure)</summary>
 Alternatively, go to that service account's Keys tab and create a new key:
 
 ![Service Account Keys](../../../img/database-access/guides/cloudsql/service-account-keys@2x.png)
@@ -30,3 +32,5 @@ See [authentication](https://cloud.google.com/docs/authentication#service-accoun
 in the Google Cloud documentation for more information about service account
 authentication methods.
 </Admonition>
+
+</details>
\ No newline at end of file
diff --git a/docs/pages/includes/database-access/connection-timeout-troubleshooting.mdx b/docs/pages/includes/database-access/connection-timeout-troubleshooting.mdx
new file mode 100644
index 0000000000000..ba04e92dbdb5b
--- /dev/null
+++ b/docs/pages/includes/database-access/connection-timeout-troubleshooting.mdx
@@ -0,0 +1,59 @@
+The Teleport Database Service requires connectivity to your database endpoints.
+
+Check that firewall rules (e.g., AWS security groups) allow connectivity between the Teleport Database Service and the database endpoint.
+- Inbound firewall rules for the database must allow connections from the Teleport Database Service.
+- Outbound firewall rules for the Teleport Database Service must allow connections to the database endpoint.
+
+<Admonition type="tip">
+On the same host as the Teleport Database Service, try running `nc` to check if it can reach the database port.
+
+- Database host: <Var name="database-host" initial="postgres-instance-1.sadas.us-east-1.rds.amazonaws.com" />
+- Database port: <Var name="database-port" initial="5432" />
+
+```code
+$ nc -zv <Var name="database-host" /> <Var name="database-port" />
+# Connection to postgres-instance-1.sadas.us-east-1.rds.amazonaws.com (172.31.24.172) 5432 port [tcp/postgresql] succeeded!
+```
+</Admonition>
+
+<details>
+<summary>Debugging connection timeout errors in AWS</summary>
+
+For deployments in AWS, it may be helpful to use [AWS Reachability Analyzer](https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html) to analyze the network path between the Teleport Database Service and the database.
+
+1. Identify the Elastic Network Interface (ENI) associated with the Teleport Database Service host. This can be found in the [EC2 console](https://console.aws.amazon.com/ec2/home?NIC).
+2. Identify the private IP address of the database.
+3. Create and analyze a network path:
+    - Set the path source to the ENI associated with the Teleport Database Service host.
+    - Set the path destination to the database IP.
+4. Check the analysis results to identify reachability issues.
+
+</details>
+
+If your database is registered dynamically or via auto-discovery, repeat the
+above connectivity test for *every** Teleport Database Service instance that
+proxies this database. To list all Teleport Database Service instances
+associated with a given database, run the `tctl get db_server/<db_name>`
+command. For example:
+```
+$ tctl get db_server/postgres-instance-1 --format json | jq '.[] | {hostname: .spec.hostname, host_id: .spec.host_id, version: .spec.version, target_health: .status.target_health}'
+{
+  "hostname": "ip-10-0-0-111.ca-central-1.compute.internal",
+  "host_id": "e5e670ac-a7b8-44ef-b373-6296d87f50e8",
+  "version": "18.3.0",
+  "target_health": {
+    "status": "unhealthy",
+    ...
+  }
+}
+{
+  "hostname": "ip-10-0-0-222.ca-central-1.compute.internal",
+  ...
+}
+```
+
+If any of the Database Service instances listed here **should not** proxy the
+database, (for example, a Database Service instance in a different VPC or AWS
+region without connectivity), locate and update their configurations so they
+only receive or discover databases they can reach. In most cases, you can
+achieve this by refining your tag filters, such as adding the a `vpc-id` label.
\ No newline at end of file
diff --git a/docs/pages/includes/database-access/db-access-webui-ad.mdx b/docs/pages/includes/database-access/db-access-webui-ad.mdx
new file mode 100644
index 0000000000000..159d52cd65e94
--- /dev/null
+++ b/docs/pages/includes/database-access/db-access-webui-ad.mdx
@@ -0,0 +1,4 @@
+{{ dbType="MySQL" }}
+<Admonition type="tip" title="Tip">
+    You can also [access your {{ dbType }} databases using the Web UI.](../../connect-your-client/teleport-clients/web-ui.mdx#starting-a-database-session)
+</Admonition>
diff --git a/docs/pages/includes/database-access/db-audit-events.mdx b/docs/pages/includes/database-access/db-audit-events.mdx
index 08ebe62f09243..8c45c3e86e2c6 100644
--- a/docs/pages/includes/database-access/db-audit-events.mdx
+++ b/docs/pages/includes/database-access/db-audit-events.mdx
@@ -5,35 +5,52 @@ with the `tsh play` command.
 Database session ID will be in a UUID format (ex: `307b49d6-56c7-4d20-8cf0-5bc5348a7101`)
 See the audit log to get a database session ID with a key of `sid`.
 
-Example:
+PostgreSQL database recordings are available in interactive format:
+
+```code
+$ tsh play 307b49d6-56c7-4d20-8cf0-5bc5348a7101
+Session started to database "postgres-database" at Mon Jul 20 20:00 UTC
+
+postgres=> SELECT * FROM products;
+SUCCESS
+(10 rows affected)
+
+postgres=> INSERT INTO products (name, price) VALUES ('Phone', 150.00);
+ERROR: permission denied for table products (SQLSTATE 42501)
+
+Session ended at Mon Jul 20 20:30 UTC
+```
+
+All database protocols recordings are supported in JSON format (`--format json`):
 ```code
 $ tsh play --format json 307b49d6-56c7-4d20-8cf0-5bc5348a7101
 ```
 
 ```json
-    {
-        "cluster_name": "teleport.example.com",
-        "code": "TDB02I",
-        "db_name": "example",
-        "db_origin": "dynamic",
-        "db_protocol": "postgres",
-        "db_query": "select * from sample;",
-        "db_roles": [
-            "access"
-        ],
-        "db_service": "example",
-        "db_type": "rds",
-        "db_uri": "databases-1.us-east-1.rds.amazonaws.com:5432",
-        "db_user": "alice",
-        "ei": 2,
-        "event": "db.session.query",
-        "sid": "307b49d6-56c7-4d20-8cf0-5bc5348a7101",
-        "success": true,
-        "time": "2023-10-06T10:58:32.88Z",
-        "uid": "a649d925-9dac-44cc-bd04-4387c295580f",
-        "user": "alice"
-    }
+{
+    "cluster_name": "teleport.example.com",
+    "code": "TDB02I",
+    "db_name": "example",
+    "db_origin": "dynamic",
+    "db_protocol": "postgres",
+    "db_query": "select * from sample;",
+    "db_roles": [
+        "access"
+    ],
+    "db_service": "example",
+    "db_type": "rds",
+    "db_uri": "databases-1.us-east-1.rds.amazonaws.com:5432",
+    "db_user": "alice",
+    "ei": 2,
+    "event": "db.session.query",
+    "sid": "307b49d6-56c7-4d20-8cf0-5bc5348a7101",
+    "success": true,
+    "time": "2023-10-06T10:58:32.88Z",
+    "uid": "a649d925-9dac-44cc-bd04-4387c295580f",
+    "user": "alice"
+}
 ```
 
-The audit log is viewable under **Audit** in the left-hand pane via the Web UI for users with permission to the `event` resources. Database sessions do not appear
-in the session recordings page.
+The audit log is viewable under **Audit** in the left-hand pane via the Web UI
+for users with permission to the `event` resources. Database sessions are listed
+on the session recordings page, but only PostgreSQL sessions are playable.
diff --git a/docs/pages/includes/database-access/guides-next-steps.mdx b/docs/pages/includes/database-access/guides-next-steps.mdx
index 15d9e76bea8f9..2a7dc6dccaf1b 100644
--- a/docs/pages/includes/database-access/guides-next-steps.mdx
+++ b/docs/pages/includes/database-access/guides-next-steps.mdx
@@ -5,7 +5,7 @@
 - View the [High Availability (HA)](../../enroll-resources/database-access/guides/ha.mdx) guide.
 
 {/* lint ignore list-item-spacing remark-lint */}
-- Take a look at the YAML configuration [reference](../../reference/agent-services/database-access-reference/configuration.mdx).
+- Take a look at the YAML configuration [reference](../../enroll-resources/database-access/reference/configuration.mdx).
 
 {/* lint ignore list-item-spacing remark-lint */}
-- See the full CLI [reference](../../reference/agent-services/database-access-reference/cli.mdx).
+- See the full CLI [reference](../../enroll-resources/database-access/reference/cli.mdx).
diff --git a/docs/pages/includes/database-access/oracle-multihost.mdx b/docs/pages/includes/database-access/oracle-multihost.mdx
new file mode 100644
index 0000000000000..b67751decf14d
--- /dev/null
+++ b/docs/pages/includes/database-access/oracle-multihost.mdx
@@ -0,0 +1,27 @@
+In some deployments the same logical database is reachable via multiple hostnames with different characteristics, for example:
+
+* replicated databases
+* hostnames that traverse different network paths
+
+If this applies to your setup, list all hosts in order of preference to improve connection resiliency.
+
+If a TCP dial error occurs for a host, the next host in the list is tried automatically. Non-network errors (e.g., certificate or authentication failures) are not retried and do not advance to the next host.
+
+By default, hosts are attempted in the listed order. Retries cycle through the list and wrap to the start as needed (e.g., `host1 → host2 → host3 → host1 → ...`). To randomize the sequence per connection attempt, set `shuffle_hostnames`; the same cyclic pattern then applies to that randomized order.
+
+`retry_count` controls the number of retries per host after the initial attempt on a network error. The default is `2`, so there are 3 total attempts per host (1 initial + 2 retries) before moving to the next host in sequence.
+
+This setup supports failover and basic load-balancing for new connections: enabling `shuffle_hostnames` spreads initial connection attempts across hosts (load-balancing), while retries automatically move to the next host if the current one is unreachable (failover).
+
+```yaml
+- name: oracle
+  protocol: oracle
+  uri: host1:2484,host2:2484,host3:2484  # Multiple hosts; dials in sequence and wraps (host1 → host2 → host3 → host1 ...). Dialing sequence can be randomized with `shuffle_hostnames`.
+  static_labels:
+    env: dev
+  oracle:
+    # Randomize host order per connection attempt to spread load. Optional.
+    shuffle_hostnames: true
+    # Retries per host on network errors only; non-network errors stop (default: 2). Optional.
+    retry_count: 5            
+```
diff --git a/docs/pages/includes/database-access/oracle-troubleshooting.mdx b/docs/pages/includes/database-access/oracle-troubleshooting.mdx
new file mode 100644
index 0000000000000..1593a64226a5b
--- /dev/null
+++ b/docs/pages/includes/database-access/oracle-troubleshooting.mdx
@@ -0,0 +1,194 @@
+### Connection hangs or is refused
+
+A common issue when connecting to an Oracle database is a connection timeout or refusal. This typically indicates a networking problem where the Teleport Database Service cannot reach the Oracle database endpoint.
+Verify that network routing and access controls, such as firewalls and VPC security groups, allow traffic to flow from the Database Service host to the database endpoint.
+
+You can validate connectivity using a native Oracle client, which helps confirm whether the issue is with Teleport or the underlying network configuration. For example, using Oracle SQLcl:
+
+```bash
+# Example: Oracle SQLcl
+sql -L myuser/mypassword@oracle-instance.example.com:2484
+```
+
+Network connectivity issues are often detected by automated [health checks](../../enroll-resources/database-access/guides/health-checks.mdx).
+
+To check the health status of all registered databases:
+
+```bash
+# All databases
+tctl db ls --format=json | jq -r '.[] | [.metadata.name, .status.target_health]'
+```
+
+An unhealthy database will have output similar to the following:
+
+```json
+...
+  "oracle",
+  {
+    "address": "11.22.33.44:2484",
+    "protocol": "TCP",
+    "status": "unhealthy",
+    "transition_timestamp": "2025-09-25T09:47:39.435973Z",
+    "transition_reason": "threshold_reached",
+    "transition_error": "dial tcp 11.22.33.44:2484: i/o timeout",
+    "message": "1 health check failed"
+  }
+...
+```
+
+### TLS negotiation fails
+
+Properly configuring TLS on an Oracle database can be challenging. Different underlying issues can result in the same error message, such as the following from Teleport:
+
+```
+Original Error: *tls.permanentError remote error: tls: handshake failure
+```
+
+Or you might see the following in the Oracle logs:
+
+```
+ORA-00609: could not attach to incoming connection
+ORA-28860: Fatal SSL error
+```
+
+To identify the root cause, follow the debugging steps in the sections below. The output of the following `openssl` command can help diagnose many common TLS issues. Capture the output and use it as you follow the debugging steps.
+
+```
+> openssl s_client -connect oracle.example.com:2484 -showcerts
+```
+
+#### Wrong server certificate
+
+Teleport rejects connections to databases with untrusted server certificates. If you are using Teleport to issue certificates, ensure that the server certificate was issued by the Teleport Database CA. An invalid server certificate will prevent Teleport from establishing a secure connection.
+
+You can view the Teleport Database CA certificate with the following command:
+
+```
+tctl auth export --type=db | openssl x509 -issuer -noout
+...
+issuer=O=teleport.example.com, CN=teleport.example.com, serialNumber=200129862304303044762346177566738813560
+```
+
+Compare the `issuer` in the server certificate with the `issuer` of the Teleport Database CA certificate. The `openssl s_client` command from the previous section will show you the server certificate:
+
+
+```
+# openssl s_client output:
+...
+Server certificate
+subject=CN=oracle.example.com
+issuer=O=teleport.example.com, CN=teleport.example.com, serialNumber=200129862304303044762346177566738813560
+...
+```
+
+You can also inspect the Oracle wallet directly using the `orapki` utility to verify the server certificate.
+
+```bash
+# Prompt for wallet password
+orapki wallet display -complete -wallet /path/to/wallet
+```
+
+The "User Certificates" section of the output should contain the server's certificate. Its `Issuer` should match the `Subject` of the Teleport Database CA.
+
+```
+User Certificates:
+Subject:        CN=oracle.example.com
+Issuer:         SERIALNUMBER=200129862304303044762346177566738813560,CN=teleport.example.com,O=teleport.example.com
+Serial Number:  ...
+```
+
+#### Wrong client certificate
+
+If the Oracle server rejects client certificates presented by the Teleport Database Service, you should verify that the Oracle database trusts the Teleport Database User CA.
+
+You can view the Teleport Database User CA with this command:
+
+```
+tctl auth export --type=db-client | openssl x509 -issuer -noout
+issuer=O=teleport.example.com, CN=teleport.example.com, serialNumber=183359545647055551607366887578713393931
+```
+
+Compare the Teleport Database User CA with the list of CAs trusted by the Oracle database. The `openssl s_client` command from earlier will show the list of CAs the Oracle database trusts:
+
+```
+# openssl s_client output:
+...
+---
+Acceptable client certificate CA names
+O=teleport.example.com, CN=teleport.example.com, serialNumber=183359545647055551607366887578713393931
+```
+
+Ensure that the Teleport Database User CA certificate has been added to the correct wallet and that the Oracle server configuration references this wallet.
+
+You can also inspect the Oracle wallet directly using the `orapki` utility to verify that the Teleport Database User CA is trusted.
+
+```bash
+# Prompt for wallet password
+orapki wallet display -complete -wallet /path/to/wallet
+```
+
+The "Trusted Certificates" section of the output should contain the Teleport Database User CA. Its `Issuer` should match the `issuer` of the Teleport Database User CA.
+
+```
+Trusted Certificates:
+Subject:        SERIALNUMBER=183359545647055551607366887578713393931,CN=teleport.example.com,O=teleport.example.com
+Issuer:         SERIALNUMBER=183359545647055551607366887578713393931,CN=teleport.example.com,O=teleport.example.com
+Serial Number:  ...
+```
+
+#### Wrong TLS version
+
+Teleport rejects connections that use TLS 1.0 or 1.1 due to known weaknesses. Ensure that the `SSL_VERSION` parameter in your Oracle configuration is set to `1.2` or higher to enable TLS 1.2 or a newer version.
+
+#### No common cipher suites
+
+Ensure that the `SQLNET.CIPHER_SUITE` parameter in your Oracle configuration contains modern TLS cipher suites that match the configured TLS version.
+The following cipher suites are secure and widely supported across different Oracle versions.
+
+For TLS 1.2:
+- `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`
+- `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`
+
+For TLS 1.3:
+- `TLS_AES_128_GCM_SHA256`
+- `TLS_AES_256_GCM_SHA384`
+
+### `Must be logged on to the server` error
+
+The following error indicates that the login procedure has failed:
+
+```
+ORA-17430: Must be logged on to the server.
+```
+
+This is most commonly caused by the Oracle database enforcing native encryption or data-integrity checksums on a TCPS endpoint. 
+Teleport uses TLS for transport security, and does not support native Oracle encryption.
+
+To disable the redundant encryption requirement for the TCPS endpoint, add the following line to your `sqlnet.ora` file:
+
+`SQLNET.IGNORE_ANO_ENCRYPTION_FOR_TCPS=TRUE`
+
+Make sure to use an up-to-date version of the Oracle database. In older versions, this setting may not disable data-integrity checksums, which will lead to continued failures.
+
+### Invalid username
+
+An incorrectly specified username will result in the following error:
+
+```
+ORA-01017: invalid username/password; logon denied
+```
+
+When using TLS-based authentication, Oracle maps the Common Name (CN) from the client certificate to an external user in the database. Verify the `EXTERNAL_NAME` for your user in the `dba_users` table. It should be in the format `cn=<name>`, where `<name>` matches the value of the `--db-user` flag used in the `tsh db login` command.
+
+You can query the `dba_users` table to check the `EXTERNAL_NAME` of your users:
+
+```sql
+SQL> SELECT username, authentication_type, external_name
+  2  FROM   dba_users
+  3  WHERE  authentication_type = 'EXTERNAL'
+  4  ORDER  BY 1;
+
+USERNAME      AUTHENTICATION_TYPE    EXTERNAL_NAME
+_____________ ______________________ ________________
+ALICE         EXTERNAL               cn=alice
+```
\ No newline at end of file
diff --git a/docs/pages/includes/database-access/pg-access-webui.mdx b/docs/pages/includes/database-access/pg-access-webui.mdx
deleted file mode 100644
index 5f6f7cddb4b33..0000000000000
--- a/docs/pages/includes/database-access/pg-access-webui.mdx
+++ /dev/null
@@ -1,3 +0,0 @@
-<Admonition type="tip" title="Tip">
-  Starting from version `17.1`, you can now [access your PostgreSQL databases using the Web UI.](../../connect-your-client/web-ui.mdx#starting-a-database-session)
-</Admonition>
diff --git a/docs/pages/includes/database-access/pg-cancel-request-limitation.mdx b/docs/pages/includes/database-access/pg-cancel-request-limitation.mdx
index cb64d4c5931bf..2e27188aab672 100644
--- a/docs/pages/includes/database-access/pg-cancel-request-limitation.mdx
+++ b/docs/pages/includes/database-access/pg-cancel-request-limitation.mdx
@@ -2,24 +2,24 @@
 ### Unable to cancel a query
 
 If you use a PostgreSQL cli client like `psql`, and you try to cancel a query
-with `ctrl+c`, but it doesn't cancel the query, then you need to connect using a
+with `Ctrl+C`, but it doesn't cancel the query, then you need to connect using a
 tsh local proxy instead.
 When `psql` cancels a query, it establishes a new connection without TLS
 certificates, however Teleport requires TLS certificates not only for
 authentication, but also to route database connections.
 
 If you
-[enable TLS Routing in Teleport](../../admin-guides/management/operations/tls-routing.mdx)
+[enable TLS Routing in Teleport](../../zero-trust-access/deploy-a-cluster/tls-routing.mdx)
 then `tsh db connect` will automatically start a local proxy for every
 connection.
 Alternatively, you can connect via
-[Teleport Connect](../../connect-your-client/teleport-connect.mdx)
+[Teleport Connect](../../connect-your-client/teleport-clients/teleport-connect.mdx)
 which also uses a local proxy.
 Otherwise, you need to start a tsh local proxy manually using `tsh proxy db`
 and connect via the local proxy.
 
 If you have already started a long-running query in a `psql` session that you
-cannot cancel with ctrl+c, you can start a new client session to cancel that
+cannot cancel with `Ctrl+C`, you can start a new client session to cancel that
 query manually:
 
 First, find the query's process identifier (PID):
diff --git a/docs/pages/includes/database-access/pg-mysql-connect.mdx b/docs/pages/includes/database-access/pg-mysql-connect.mdx
new file mode 100644
index 0000000000000..6dfe949d8c479
--- /dev/null
+++ b/docs/pages/includes/database-access/pg-mysql-connect.mdx
@@ -0,0 +1,35 @@
+{{ dbUser="alice" dbService="example-db" pgSchema="postgres" mySchema="mysql" }}
+{/* this comment is here to make the includes below render */}
+
+<Tabs>
+<TabItem label="MySQL/MariaDB">
+
+Retrieve credentials for the database and connect to it as the `{{ dbUser }}` user:
+
+```code
+$ tsh db connect --db-user={{ dbUser }} --db-name={{ mySchema }} {{ dbService }}
+```
+
+<Admonition type="note" title="Note">
+  Either the `mysql` or the `mariadb` client must be available on `PATH` to connect.
+</Admonition>
+
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="MySQL or MariaDB"!)
+
+</TabItem>
+<TabItem label="PostgreSQL">
+
+Retrieve credentials for the database and connect to it as the `{{ dbUser }}` user:
+
+```code
+$ tsh db connect --db-user={{ dbUser }} --db-name={{ pgSchema }} {{ dbService }}
+```
+
+<Admonition type="note" title="Note">
+  The `psql` client must be available on `PATH` to connect.
+</Admonition>
+
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL"!)
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/includes/database-access/rds-proxy.mdx b/docs/pages/includes/database-access/rds-proxy.mdx
index dccbc48e02bc9..4804e4d56c416 100644
--- a/docs/pages/includes/database-access/rds-proxy.mdx
+++ b/docs/pages/includes/database-access/rds-proxy.mdx
@@ -1,3 +1,4 @@
+{/* this comment is here to make the includes below render */}
 ## How it works
 
 (!docs/pages/includes/database-access/how-it-works/iam.mdx db="RDS Proxy" cloud="AWS"!)
@@ -14,9 +15,9 @@
 
 <Admonition type="note" title="Supported Engine Family">
 Teleport currently supports RDS Proxy instances with engine family
-[PostgreSQL](../../enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres.mdx),
-[MariaDB/MySQL](../../enroll-resources/database-access/enroll-aws-databases/rds-proxy-postgres.mdx) or
-[Microsoft SQL Server](../../enroll-resources/database-access/enroll-aws-databases/rds-proxy-sqlserver.mdx).
+[PostgreSQL](../../enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres.mdx),
+[MariaDB/MySQL](../../enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-postgres.mdx) or
+[Microsoft SQL Server](../../enroll-resources/database-access/enrollment/aws/rds-proxy/rds-proxy-sqlserver.mdx).
 </Admonition>
 
 (!docs/pages/includes/database-access/auto-discovery-tip.mdx dbType="RDS Proxy" providerType="AWS"!)
@@ -184,7 +185,7 @@ Retrieve credentials for the database and connect to it as the `alice` user:
 $ tsh db connect --db-user=alice --db-name=dev rds-proxy
 ```
 
-(!docs/pages/includes/database-access/pg-access-webui.mdx!)
+(!docs/pages/includes/database-access/db-access-webui-ad.mdx dbType="PostgreSQL and MySQL"!)
 
 To log out of the database and remove credentials:
 
diff --git a/docs/pages/includes/database-access/reference/auto-discovery-unavailable.mdx b/docs/pages/includes/database-access/reference/auto-discovery-unavailable.mdx
index 501ae4b5cf739..768f5e9f958fa 100644
--- a/docs/pages/includes/database-access/reference/auto-discovery-unavailable.mdx
+++ b/docs/pages/includes/database-access/reference/auto-discovery-unavailable.mdx
@@ -5,6 +5,6 @@ Database discovery is not available for {{ dbType }}.
 To register a {{ dbType }} database with your Teleport cluster, you must
 configure the database manually via static config or dynamic `db` resource.
 
-See the [database access reference](../../../reference/agent-services/database-access-reference/configuration.mdx) for more
+See the [database access reference](../../../enroll-resources/database-access/reference/configuration.mdx) for more
 information.
 </details>
diff --git a/docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx b/docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx
new file mode 100644
index 0000000000000..be6945fce3dec
--- /dev/null
+++ b/docs/pages/includes/database-access/reference/aws-iam/elasticache-serverless/access-policy.mdx
@@ -0,0 +1,48 @@
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "ElastiCacheServerlessFetchMetadata",
+            "Effect": "Allow",
+            "Action": "elasticache:DescribeServerlessCaches",
+            "Resource": "*"
+        },
+        {
+            "Sid": "ElastiCacheServerlessDescribeUsers",
+            "Effect": "Allow",
+            "Action": "elasticache:DescribeUsers",
+            "Resource": "*"
+        },
+        {
+            "Sid": "ElastiCacheServerlessConnect",
+            "Effect": "Allow",
+            "Action": "elasticache:Connect",
+            "Resource": "*"
+        }
+    ]
+}
+```
+
+| Statement | Purpose |
+| ---------- | ------- |
+|`ElastiCacheServerlessFetchMetadata` | Automatically import AWS metadata about the database. |
+|`ElastiCacheServerlessDescribeUsers` | Determine whether a user is compatible with IAM authentication. |
+|`ElastiCacheServerlessConnect` | Connect using IAM authentication. |
+
+<Details>
+You can reduce the scope of the `ElastiCacheServerlessConnect` statement by
+updating it to only allow specific ElastiCache Serverless caches and IAM users.
+The resource ARN you can specify has the following formats:
+
+```code
+arn:aws:elasticache:{Region}:{AccountID}:serverlesscache:{CacheName}
+arn:aws:elasticache:{Region}:{AccountID}:user:{UserName}
+```
+
+See
+[Authenticating with IAM for
+ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html)
+for more information.
+</Details>
+
diff --git a/docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx b/docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx
index b57a042fda1c9..1cba533470ee6 100644
--- a/docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx
+++ b/docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx
@@ -1,4 +1,4 @@
-ElastiCache supports IAM authentication for Redis engine version
+ElastiCache supports IAM authentication for Redis and Valkey engine version
 7.0 or above.
 This is the recommended way to configure Teleport access to ElastiCache.
 
diff --git a/docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx b/docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx
index 96bf433c84797..ed5ff75417e90 100644
--- a/docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx
+++ b/docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx
@@ -27,7 +27,7 @@ Teleport users can connect as that role by specifying "role/\{RoleName\}" as a
 database user, e.g.
 
 ```code
-$ tsh db connect redshift-example-db --db-user=role/{{ dbUserRole }}
+$ tsh db connect my-redshift --db-user=role/{{ dbUserRole }}
 ```
 
 See
diff --git a/docs/pages/includes/database-access/self-hosted-config-start.mdx b/docs/pages/includes/database-access/self-hosted-config-start.mdx
index 6ea01b701f9bf..786e1fd684e17 100644
--- a/docs/pages/includes/database-access/self-hosted-config-start.mdx
+++ b/docs/pages/includes/database-access/self-hosted-config-start.mdx
@@ -47,7 +47,7 @@ To configure the Teleport Database Service to trust a custom CA:
 
 
 If your database servers use certificates that are signed by a public CA such
-as ComodoCA or DigiCert, you can use the `trust_system_cert_pool` option
+as ComodoCA or DigiCert, you can use the `trust-system-cert-pool` option
 without exporting the CA:
 ```code
 $ sudo teleport db configure create \
@@ -57,7 +57,7 @@ $ sudo teleport db configure create \
    --name={{ dbName }} \
    --protocol={{ dbProtocol }} \
    --uri={{ databaseAddress }} \
-   --trust_system_cert_pool \
+   --trust-system-cert-pool \
    --labels=env=dev
 ```
 
diff --git a/docs/pages/includes/database-access/split-db-ca-details.mdx b/docs/pages/includes/database-access/split-db-ca-details.mdx
index e1c8b230f6818..d2301341c61d0 100644
--- a/docs/pages/includes/database-access/split-db-ca-details.mdx
+++ b/docs/pages/includes/database-access/split-db-ca-details.mdx
@@ -23,6 +23,6 @@ in Teleport versions
 (= db_client_ca.released_version.v15 =).
 
 See 
-[Database CA Migrations](../../admin-guides/management/operations/db-ca-migrations.mdx)
+[Database CA Migrations](../../zero-trust-access/management/security/db-ca-migrations.mdx)
 for more information.
 </details>
diff --git a/docs/pages/includes/database-access/sql-server-connect-note.mdx b/docs/pages/includes/database-access/sql-server-connect-note.mdx
index c6bb7b5da1f91..ca35fa46d58ea 100644
--- a/docs/pages/includes/database-access/sql-server-connect-note.mdx
+++ b/docs/pages/includes/database-access/sql-server-connect-note.mdx
@@ -11,6 +11,6 @@ your SQL Server client:
 $ tsh proxy db --db-user=teleport --tunnel sqlserver
 ```
 
-Read the [Database GUI Clients](../../connect-your-client/gui-clients.mdx#sql-server-with-azure-data-studio) 
+Read the [Database GUI Clients](../../connect-your-client/third-party/gui-clients.mdx#sql-server-with-azure-data-studio) 
 guide for how to connect your DB GUI client to the local proxy.
 </Admonition>
diff --git a/docs/pages/includes/device-trust/prereqs.mdx b/docs/pages/includes/device-trust/prereqs.mdx
index 0ad4cc364b1f7..77ce5df1a708b 100644
--- a/docs/pages/includes/device-trust/prereqs.mdx
+++ b/docs/pages/includes/device-trust/prereqs.mdx
@@ -1,22 +1,22 @@
 - To enroll a macOS device, you need:
   - A signed and notarized `tsh` binary.
-    [Download the macOS tsh installer](../../installation.mdx#macos).
+    [Download the macOS tsh installer](../../installation/macos.mdx).
 - To enroll a Windows device, you need:
   - A device with TPM 2.0.
   - A user with administrator privileges. This is only required during enrollment.
-  - The `tsh` client. [Download the Windows tsh installer](../../installation.mdx#windows-tsh-tbot-and-tctl-clients-only).
+  - The `tsh` client. [Download the Windows tsh installer](../../installation/windows.mdx).
 - To enroll a Linux device, you need:
   - A device with TPM 2.0.
   - A user with permissions to use the /dev/tpmrm0 device (typically done by
     assigning the `tss` group to the user).
-  - The `tsh` client. [Install tsh for Linux](../../installation.mdx#linux).
+  - The `tsh` client. [Install tsh for Linux](../../installation/linux.mdx).
 
     WSL users should use the Windows binary instead.
-    [Download the Windows tsh installer](../../installation.mdx#windows-tsh-tbot-and-tctl-clients-only).
+    [Download the Windows tsh installer](../../installation/windows.mdx).
 
 - To authenticate a Web UI session you need [Teleport Connect](
-  ../../connect-your-client/teleport-connect.mdx#installation--upgrade)
+  ../../connect-your-client/teleport-clients/teleport-connect.mdx#installation--upgrade)
 - Correct end-user IP propagation to your Teleport deployment:
-  [X-Forwarded-For header](../../reference/config.mdx#proxy-service) (L7 load
+  [X-Forwarded-For header](../../reference/deployment/config.mdx#proxy-service) (L7 load
   balancer) or [PROXY protocol](
-  ../../admin-guides/management/security/proxy-protocol.mdx) (L4 load balancer)
+  ../../zero-trust-access/management/security/proxy-protocol.mdx) (L4 load balancer)
diff --git a/docs/pages/includes/device-trust/troubleshooting.mdx b/docs/pages/includes/device-trust/troubleshooting.mdx
index 9e8435e87ad98..1dd5be27cc649 100644
--- a/docs/pages/includes/device-trust/troubleshooting.mdx
+++ b/docs/pages/includes/device-trust/troubleshooting.mdx
@@ -1,14 +1,14 @@
 ### "binary missing signature or entitlements" on `tsh device enroll`
 
 A signed and notarized `tsh` binary is necessary to enroll and use a a trusted
-device. [Download the macOS tsh installer](../../installation.mdx#macos) to fix
+device. [Download the macOS tsh installer](../../installation/macos.mdx) to fix
 the problem.
 
 ### "unauthorized device" errors using a trusted device
 
 A trusted device needs to be registered and enrolled before it is recognized by
-Teleport as such. Follow the [registration](../../admin-guides/access-controls/device-trust/device-management.mdx) and
-[enrollment](../../admin-guides/access-controls/device-trust/device-management.mdx) steps
+Teleport as such. Follow the [registration](../../identity-governance/device-trust/device-management.mdx#register-a-trusted-device) and
+[enrollment](../../identity-governance/device-trust/device-management.mdx#enroll-a-trusted-device) steps
 and make sure to `tsh logout` and `tsh login` after enrollment is done.
 
 ### "Failed to open the TPM device" on Linux
@@ -27,7 +27,7 @@ https://github.com/tpm2-software/tpm2-tss/blob/ede63dd1ac1f0a46029d457304edcac21
 Auto-enrollment ceremonies, due to their automated nature, are stricter than
 regular enrollment. Additional auto-enrollment checks include:
 
-1. Verifying device profile data, such as data originated from Jamf, against the
+1. Verifying device profile data, such as data originated from an MDM service, against the
    actual device
 2. Verifying that the device is not enrolled by another user (auto-enroll cannot
    take devices that are already enrolled)
@@ -49,7 +49,7 @@ Follow the instructions in the [Web UI troubleshooting section](
 #web-ui-fails-to-authenticate-trusted-device) below (Teleport v16 or later).
 
 Alternatively, you may use one of the tsh commands described by
-[App Access support](../../admin-guides/access-controls/device-trust/enforcing-device-trust.mdx).
+[App Access support](../../identity-governance/device-trust/enforcing-device-trust.mdx).
 For example, for an app called `myapp`, run `tsh proxy app myapp -p 8888`, then
 open http://localhost:8888 in your browser.
 
@@ -69,10 +69,9 @@ The Web UI attempts to authenticate your device using Teleport Connect during
 login. If you are not asked to authenticate your device immediately after login,
 follow the steps below:
 
-1. Make sure your device is [registered and enrolled](
-   ../../admin-guides/access-controls/device-trust/device-management.mdx#register-a-trusted-device)
+1. Make sure your device is [registered and enrolled](../../identity-governance/device-trust/device-management.mdx#register-a-trusted-device)
 2. Install [Teleport Connect](
-   ../../connect-your-client/teleport-connect.mdx#installation--upgrade).
+   ../../connect-your-client/teleport-clients/teleport-connect.mdx#installation--upgrade).
    Use the DEB or RPM packages on Linux (the tarball doesn't register the custom
    URL handler).
 3. Make sure Teleport Connect can access the same resource you are trying to
@@ -92,9 +91,9 @@ device web authentication ceremony failed. In this case it's likely that
 end-user IPs are not propagated correctly to your Teleport deployment.
 
 * L7 load balancer: make sure it propagates the [X-Forwarded-For header](
-  ../../reference/config.mdx#proxy-service)
+  ../../reference/deployment/config.mdx#proxy-service)
 * L4 load balancer: enable [PROXY protocol](
-  ../../admin-guides/management/security/proxy-protocol.mdx)
+  ../../zero-trust-access/management/security/proxy-protocol.mdx)
 
 ### Checking Device Trust authorization status in the web UI
 
diff --git a/docs/pages/includes/discovery/aws-db-discovery-config-picker.mdx b/docs/pages/includes/discovery/aws-db-discovery-config-picker.mdx
index 173f9c78b7ede..1aa11fcd60c5b 100644
--- a/docs/pages/includes/discovery/aws-db-discovery-config-picker.mdx
+++ b/docs/pages/includes/discovery/aws-db-discovery-config-picker.mdx
@@ -11,10 +11,15 @@
 (!docs/pages/includes/database-access/reference/auto-discovery-unavailable.mdx dbType="DynamoDB"!)
 
 </TabItem>
-<TabItem label="ElastiCache Redis">
+<TabItem label="ElastiCache">
 
 (!docs/pages/includes/discovery/aws-db-discovery-config.mdx matcherType="elasticache" !)
 
+</TabItem>
+<TabItem label="ElastiCache Serverless">
+
+(!docs/pages/includes/discovery/aws-db-discovery-config.mdx matcherType="elasticache-serverless" !)
+
 </TabItem>
 <TabItem label="Keyspaces">
 
diff --git a/docs/pages/includes/discovery/aws-db-discovery-config.mdx b/docs/pages/includes/discovery/aws-db-discovery-config.mdx
index 72d8e1f351fd9..343221c49304a 100644
--- a/docs/pages/includes/discovery/aws-db-discovery-config.mdx
+++ b/docs/pages/includes/discovery/aws-db-discovery-config.mdx
@@ -15,8 +15,9 @@ spec:
   aws:
     # Database types. Valid options are:
     # 'docdb' - discovers and registers Amazon DocumentDB databases.
-    # 'elasticache' - discovers Amazon ElastiCache Redis databases.
-    # 'memorydb' - discovers Amazon MemoryDB Redis databases.
+    # 'elasticache' - discovers Amazon ElastiCache Redis and Valkey databases.
+    # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
+    # 'memorydb' - discovers Amazon MemoryDB databases.
     # 'opensearch' - discovers Amazon OpenSearch Redis databases.
     # 'rds' - discovers Amazon RDS and Aurora databases.
     # 'rdsproxy' - discovers Amazon RDS Proxy databases.
diff --git a/docs/pages/includes/discovery/aws-db-iam-policy-picker.mdx b/docs/pages/includes/discovery/aws-db-iam-policy-picker.mdx
index c4e27274d66e6..bdfff66c56727 100644
--- a/docs/pages/includes/discovery/aws-db-iam-policy-picker.mdx
+++ b/docs/pages/includes/discovery/aws-db-iam-policy-picker.mdx
@@ -11,10 +11,15 @@
 (!docs/pages/includes/discovery/reference/aws-iam/dynamodb.mdx!)
 
 </TabItem>
-<TabItem label="ElastiCache Redis">
+<TabItem label="ElastiCache">
 
 (!docs/pages/includes/discovery/reference/aws-iam/elasticache.mdx!)
 
+</TabItem>
+<TabItem label="ElastiCache Serverless">
+
+(!docs/pages/includes/discovery/reference/aws-iam/elasticache-serverless.mdx!)
+
 </TabItem>
 <TabItem label="Keyspaces">
 
diff --git a/docs/pages/includes/discovery/database-service-troubleshooting.mdx b/docs/pages/includes/discovery/database-service-troubleshooting.mdx
index 8786e37d0de31..bb2f003d6d2a2 100644
--- a/docs/pages/includes/discovery/database-service-troubleshooting.mdx
+++ b/docs/pages/includes/discovery/database-service-troubleshooting.mdx
@@ -40,7 +40,7 @@ spec:
 <Admonition type="note">
 This section assumes you have already provisioned a database user and configured
 Teleport RBAC for that database user by following a specific guide in 
-[Enroll AWS Databases](../../enroll-resources/database-access/enroll-aws-databases/enroll-aws-databases.mdx).
+[Enroll AWS Databases](../../enroll-resources/database-access/enrollment/aws/aws.mdx).
 </Admonition>
 
 If there are connection errors when you try to connect to a database, then
@@ -68,5 +68,5 @@ guide](../../enroll-resources/database-access/troubleshooting.mdx) for more
 general troubleshooting steps.
 
 Additionally, a guide specific to the type of database in
-[Enroll AWS Databases](../../enroll-resources/database-access/enroll-aws-databases/enroll-aws-databases.mdx).
+[Enroll AWS Databases](../../enroll-resources/database-access/enrollment/aws/aws.mdx).
 may have more specific troubleshooting information.
diff --git a/docs/pages/includes/discovery/db-label-warning.mdx b/docs/pages/includes/discovery/db-label-warning.mdx
new file mode 100644
index 0000000000000..780f9f05891dc
--- /dev/null
+++ b/docs/pages/includes/discovery/db-label-warning.mdx
@@ -0,0 +1,6 @@
+
+<Admonition type="warning">
+Use more specific label selectors when needed so that a Database Service
+instance only matches databases it can actually reach. Broad selectors can
+cause unreachable databases to be registered and lead to connection failures.
+</Admonition>
\ No newline at end of file
diff --git a/docs/pages/includes/discovery/discovery-config.yaml b/docs/pages/includes/discovery/discovery-config.yaml
index 4deb99c5d69da..f9542c66111bb 100644
--- a/docs/pages/includes/discovery/discovery-config.yaml
+++ b/docs/pages/includes/discovery/discovery-config.yaml
@@ -22,9 +22,11 @@ discovery_service:
       # 'rdsproxy' - Amazon RDS Proxy databases.
       # 'redshift' - Amazon Redshift databases.
       # 'redshift-serverless' - Amazon Redshift Serverless databases.
-      # 'elasticache' - Amazon ElastiCache Redis databases.
-      # 'memorydb' - Amazon MemoryDB Redis databases.
+      # 'elasticache' - Amazon ElastiCache Redis and Valkey databases.
+      # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
+      # 'memorydb' - Amazon MemoryDB databases.
       # 'opensearch' - Amazon OpenSearch Redis databases.
+      # 'docdb' - Amazon DocumentDB databases.
     - types: ["ec2"]
       # AWS regions to search for resources from
       regions: ["us-east-1","us-west-1"]
@@ -38,8 +40,7 @@ discovery_service:
       # Optional AWS external ID that the Discovery Service will use to assume
       # a role in an external AWS account.
       external_id: "example-external-id"
-      # Optional section: install is used to provide parameters to the AWS SSM document.
-      # If the install section isn't provided, the below defaults are used.
+      # Optional section: install is used to provide parameters to the installer script.
       # Only applicable for EC2 discovery.
       install:
         join_params:
@@ -49,13 +50,29 @@ discovery_service:
         # script_name is the name of the Teleport install script to use.
         # Optional, defaults to: "default-installer".
         script_name: "default-installer"
+        # Optional: adds a suffix to teleport installation, allowing for multiple agent installations.
+        # Requires managed updates to be enabled.
+        # Supported characters are alphanumeric characters and `-`.
+        suffix: "<suffix>"
+        # Optional: when using managed updates, set the update group of the installation.
+        # Supported characters are alphanumeric characters and `-`.
+        update_group: "<update-group>"
+        # Optional: proxy settings for the install script.
+        # Sets the http_proxy, HTTP_PROXY, https_proxy, HTTPS_PROXY, no_proxy, and NO_PROXY
+        # environment variables for the install script.
+        http_proxy_settings:
+          https_proxy: http://172.31.5.130:3128
+          http_proxy: http://172.31.5.130:3128
+          no_proxy: my-local-domain
       # Optional section: ssm is used to configure which AWS SSM document to use
       # If the ssm section isnt provided the below defaults are used.
       ssm:
         # document_name is the name of the SSM document that should be
         # executed when installing teleport on matching nodes
+        # Can be set to "AWS-RunShellScript" which is a pre-defined SSM Document,
+        # removing the need to create a custom SSM Document in each region.
         # Optional, defaults to: "TeleportDiscoveryInstaller".
-        document_name: "TeleportDiscoveryInstaller"
+        document_name: "AWS-RunShellScript"
       # Optional role for which the Discovery Service should create the EKS access entry.
       # If not set, the Discovery Service will attempt to create the access
       # entry using its own identity.
@@ -83,6 +100,30 @@ discovery_service:
       # '*' - discovers resources in all resource groups within configured subscription(s) (default).
       # Any resource_groups: `az group list -o table`
       resource_groups: ["group1", "group2"]
+      # Optional section: install is used to provide parameters to the Teleport installation in Azure VMs.
+      # Only applicable for VM discovery.
+      install:
+        join_params:
+          # token_name is the name of the Teleport invite token to use.
+          # Optional, defaults to: "azure-discovery-token".
+          token_name:  "azure-discovery-token"
+        # script_name is the name of the Teleport install script to use.
+        # Optional, defaults to: "default-installer".
+        script_name: "default-installer"
+        # Optional: adds a suffix to teleport installation, allowing for multiple agent installations.
+        # Requires managed updates to be enabled.
+        # Supported characters are alphanumeric characters and `-`.
+        suffix: "<suffix>"
+        # Optional: when using managed updates, set the update group of the installation.
+        # Supported characters are alphanumeric characters and `-`.
+        update_group: "<update-group>"
+        # Optional proxy settings for the install script.
+        # Sets the http_proxy, HTTP_PROXY, https_proxy, HTTPS_PROXY, no_proxy, and NO_PROXY
+        # environment variables for the install script.
+        http_proxy_settings:
+          https_proxy: http://172.31.5.130:3128
+          http_proxy: http://172.31.5.130:3128
+          no_proxy: my-local-domain
       # Azure resource tag filters used to match resources.
       tags:
         "*": "*"
@@ -102,6 +143,30 @@ discovery_service:
         # Email addresses of service accounts that instances can join with.
         # If empty, any service account is allowed.
         service_accounts: []
+        # Optional section: install is used to provide parameters to the Teleport installation in Google Cloud VMs.
+        # Only applicable for VM discovery.
+        install:
+          join_params:
+            # token_name is the name of the Teleport invite token to use.
+            # Optional, defaults to: "gcp-discovery-token".
+            token_name:  "gcp-discovery-token"
+          # script_name is the name of the Teleport install script to use.
+          # Optional, defaults to: "default-installer".
+          script_name: "default-installer"
+          # Optional: adds a suffix to teleport installation, allowing for multiple agent installations.
+          # Requires managed updates to be enabled.
+          # Supported characters are alphanumeric characters and `-`.
+          suffix: "<suffix>"
+          # Optional: when using managed updates, set the update group of the installation.
+          # Supported characters are alphanumeric characters and `-`.
+          update_group: "<update-group>"
+          # Optional proxy settings for the install script.
+          # Sets the http_proxy, HTTP_PROXY, https_proxy, HTTPS_PROXY, no_proxy, and NO_PROXY
+          # environment variables for the install script.
+          http_proxy_settings:
+            https_proxy: http://172.31.5.130:3128
+            http_proxy: http://172.31.5.130:3128
+            no_proxy: my-local-domain
         # GCP resource label filters used to match resources.
         labels:
           "*": "*"
diff --git a/docs/pages/includes/discovery/reference/aws-iam/elasticache-serverless.mdx b/docs/pages/includes/discovery/reference/aws-iam/elasticache-serverless.mdx
new file mode 100644
index 0000000000000..73c5d4608d8b0
--- /dev/null
+++ b/docs/pages/includes/discovery/reference/aws-iam/elasticache-serverless.mdx
@@ -0,0 +1,27 @@
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "ElastiCacheServerlessDiscovery",
+            "Effect": "Allow",
+            "Action": "elasticache:DescribeServerlessCaches",
+            "Resource": "*"
+        },
+        {
+            "Sid": "ElastiCacheServerlessFetchMetadata",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeSubnets",
+                "elasticache:ListTagsForResource"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```
+
+| Statement | Purpose |
+| --------- | ------- |
+| `ElastiCacheServerlessDiscovery` | Discover ElastiCache Serverless caches. |
+| `ElastiCacheServerlessFetchMetadata` | Import AWS tags and other metadata for each database as Teleport database labels. |
diff --git a/docs/pages/includes/dynamodb-iam-policy.mdx b/docs/pages/includes/dynamodb-iam-policy.mdx
index f44dd4fd61ef3..c2f113919115a 100644
--- a/docs/pages/includes/dynamodb-iam-policy.mdx
+++ b/docs/pages/includes/dynamodb-iam-policy.mdx
@@ -7,7 +7,7 @@ depends on whether you expect to create a table yourself or enable the Auth
 Service to create and configure one for you:
 
 <Tabs>
-<TabItem label="Manage a Table Yourself">
+<TabItem label="Self-Managed">
 
 If you choose to manage DynamoDB tables yourself, you must take the following
 steps, which we will explain in more detail below:
@@ -44,7 +44,15 @@ The audit event table must have the following attribute definitions:
 |`CreatedAtDate`|`S`|
 |`CreatedAt`|`N`|
 
-The table must also have the following key schema elements:
+The table must have the following key schema elements:
+
+|Name|Type|
+|---|---|
+|`SessionID`|`HASH`|
+|`EventIndex`|`RANGE`|
+
+The table must also have a global secondary index named `timesearchV2` with the
+following key schema elements:
 
 |Name|Type|
 |---|---|
@@ -125,7 +133,7 @@ Note that you can omit the `dynamodb:UpdateContinuousBackups` permission if
 disabling continuous backups.
 
 </TabItem>
-<TabItem label="Auth Service Creates a Table">
+<TabItem label="Created by the Auth Service">
 
 You'll need to replace these values in the policy example below:
 
diff --git a/docs/pages/includes/edition-prereqs-tabs-not-admin.mdx b/docs/pages/includes/edition-prereqs-tabs-not-admin.mdx
deleted file mode 100644
index 844f19ac5c8f9..0000000000000
--- a/docs/pages/includes/edition-prereqs-tabs-not-admin.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-{{ version="(=teleport.version=)" }}
-
-- A running Teleport cluster version {{ version }} or above. If you want to get started with Teleport, [sign
-  up](https://goteleport.com/signup) for a free trial or [set up a demo
-  environment](../admin-guides/deploy-a-cluster/linux-demo.mdx).
-
-- The `tsh` client tool.
-
-  Visit [Installation](../installation.mdx) for instructions on downloading
-  `tsh`.
diff --git a/docs/pages/includes/edition-prereqs-tabs.mdx b/docs/pages/includes/edition-prereqs-tabs.mdx
index 3de3e9dd732ee..46031d0989e82 100644
--- a/docs/pages/includes/edition-prereqs-tabs.mdx
+++ b/docs/pages/includes/edition-prereqs-tabs.mdx
@@ -1,10 +1,71 @@
-{{ version="(=teleport.version=)" }}
+{{ edition="Teleport" clients="`tctl` and `tsh` clients" }}
 
-- A running Teleport cluster version {{ version }} or above. If you want to get started with Teleport, [sign
-  up](https://goteleport.com/signup) for a free trial or [set up a demo
-  environment](../admin-guides/deploy-a-cluster/linux-demo.mdx).
+- A running {{ edition }} cluster. If you want to get started with Teleport,
+  [sign up](https://goteleport.com/signup) for a free trial or [set up a demo
+  environment](../get-started/deploy-community.mdx).
 
-- The `tctl` admin tool and `tsh` client tool.
+- The {{ clients }}.
 
-  Visit [Installation](../installation.mdx) for instructions on downloading
-  `tctl` and `tsh`.
+  <details>
+  <summary>Installing {{ clients }}</summary>
+
+  1. Determine the version of your Teleport cluster. The {{ clients }} must be
+     at most one major version behind your Teleport cluster version. Send a GET
+     request to the Proxy Service at `/v1/webapi/find` and use a JSON query tool
+     to obtain your cluster version. Replace <Var name="teleport.example.com:443" />
+     with the web address of your Teleport Proxy Service:
+  
+     ```code
+     $ TELEPORT_DOMAIN=<Var name="teleport.example.com:443" />
+     $ TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"
+     ```
+
+  1. Follow the instructions for your platform to install {{ clients }}:
+
+     <Tabs>
+       <TabItem label="Mac">
+     
+         Download the signed macOS .pkg installer for Teleport, which includes the {{ clients }}:
+     
+         ```code
+         $ curl -O https://cdn.teleport.dev/teleport-${TELEPORT_VERSION?}.pkg
+         ```
+   
+         In Finder double-click the `pkg` file to begin installation.
+     
+         <Admonition type="danger">
+           Using Homebrew to install Teleport is not supported. The Teleport package in
+           Homebrew is not maintained by Teleport and we can't guarantee its reliability or
+           security.
+         </Admonition>
+     
+       </TabItem>
+     
+       <TabItem label="Windows - Powershell">
+     
+         ```code
+         $ curl.exe -O https://cdn.teleport.dev/teleport-v${TELEPORT_VERSION?}-windows-amd64-bin.zip
+         # Unzip the archive and move the {{ clients }} to your %PATH%
+         # NOTE: Do not place the {{ clients }} in the System32 directory, as this can cause issues when using WinSCP.
+         # Use %SystemRoot% (C:\Windows) or %USERPROFILE% (C:\Users\<username>) instead.
+         ```
+     
+       </TabItem>
+     
+       <TabItem label="Linux">
+     
+         All of the Teleport binaries in Linux installations include the {{ clients }}.  For more
+         options (including RPM/DEB packages and downloads for i386/ARM/ARM64) see
+         our [installation page](../installation/installation.mdx).
+     
+         ```code
+         $ curl -O https://cdn.teleport.dev/teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
+         $ tar -xzf teleport-v${TELEPORT_VERSION?}-linux-amd64-bin.tar.gz
+         $ cd teleport
+         $ sudo ./install
+         # Teleport binaries have been copied to /usr/local/bin
+         ```
+       </TabItem>
+     </Tabs>
+  
+  </details>
diff --git a/docs/pages/includes/ent-vs-community-faq.mdx b/docs/pages/includes/ent-vs-community-faq.mdx
index 8da3cc463335e..d955e23dcc6bf 100644
--- a/docs/pages/includes/ent-vs-community-faq.mdx
+++ b/docs/pages/includes/ent-vs-community-faq.mdx
@@ -18,5 +18,5 @@ $ teleport version
 # Teleport v(=teleport.version=) go(=teleport.golang=)
 ```
 
-See the [Installation](../installation.mdx) guide for details on installing to specific platforms
+See the [Installation](../installation/installation.mdx) guide for details on installing to specific platforms
 with Enterprise or Teleport Community Edition releases. 
diff --git a/docs/pages/includes/enterprise/oidcauthentication.mdx b/docs/pages/includes/enterprise/oidcauthentication.mdx
deleted file mode 100644
index 136102ea83651..0000000000000
--- a/docs/pages/includes/enterprise/oidcauthentication.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
-Configure Teleport to use OIDC authentication as the default instead of the local
-user database. 
-
-Edit your `cluster_auth_preference` resource:
-
-```code
-$ tctl edit cap
-```
-
-In your editor, ensure that the file contains the following content:
-
-```yaml
-kind: cluster_auth_preference
-metadata:
-  name: cluster-auth-preference
-spec:    
-  type: oidc
-version: v2
-```
diff --git a/docs/pages/includes/enterprise/samlauthentication.mdx b/docs/pages/includes/enterprise/samlauthentication.mdx
deleted file mode 100644
index 9fcd1e9db5362..0000000000000
--- a/docs/pages/includes/enterprise/samlauthentication.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
-### Enable default SAML authentication
-
-Configure Teleport to use SAML authentication as the default instead of the local
-user database.
-
-Use `tctl` to edit the `cluster_auth_preference` value:
-
-```code
-$ tctl edit cluster_auth_preference
-```
-
-Set the value of `spec.type` to `saml`:
-
-```yaml
-kind: cluster_auth_preference
-metadata:
-  ...
-  name: cluster-auth-preference
-spec:
-  ...
-  type: saml
-  ...
-version: v2
-```
-
-After you save and exit the editor, `tctl` will update the resource:
-
-```text
-cluster auth preference has been updated
-```
-
-<Admonition type="tip">
-
-If you need to log in again before configuring your SAML provider, use the flag <nobr>`--auth=local`</nobr>.
-
-</Admonition>
-
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-datadog.mdx b/docs/pages/includes/helm-reference/zz_generated.access-datadog.mdx
index cc90d24bab68e..7cd2459db2d0c 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-datadog.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-datadog.mdx
@@ -46,7 +46,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Datadog Incident Management](../../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) guide
+Datadog Incident Management](../../identity-governance/access-requests/plugins/datadog-hosted.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -251,7 +251,7 @@ teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
 | `string` | `"kubernetes"` |
 
 `tbot.joinMethod` describes how tbot joins the Teleport cluster.
-See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
 
 ## `annotations`
 
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-discord.mdx b/docs/pages/includes/helm-reference/zz_generated.access-discord.mdx
index d8d15de12a3e4..85c800c779ff1 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-discord.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-discord.mdx
@@ -20,6 +20,8 @@ proxy servers.
 For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
 
 ### `teleport.identitySecretName`
 
@@ -43,7 +45,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Discord](../../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) guide
+Discord](../../identity-governance/access-requests/plugins/discord.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -145,6 +147,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the Discord plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the Discord plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-email.mdx b/docs/pages/includes/helm-reference/zz_generated.access-email.mdx
index 7d5e0c4cb8f89..e995138597439 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-email.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-email.mdx
@@ -20,6 +20,8 @@ proxy servers.
 For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
 
 ### `teleport.identitySecretName`
 
@@ -43,7 +45,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Email](../../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) guide
+Email](../../identity-governance/access-requests/plugins/email.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -265,6 +267,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the mail plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the mail plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-jira.mdx b/docs/pages/includes/helm-reference/zz_generated.access-jira.mdx
index fc28bd73352c0..e81e8cb037073 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-jira.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-jira.mdx
@@ -20,6 +20,8 @@ proxy servers.
 For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
 
 ### `teleport.identityFromSecret`
 
@@ -43,7 +45,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Jira](../../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) guide
+Jira](../../identity-governance/access-requests/plugins/jira.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -213,6 +215,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the Jira plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the Jira plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-mattermost.mdx b/docs/pages/includes/helm-reference/zz_generated.access-mattermost.mdx
index 53f7f570761e9..8af5e5a5aaf07 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-mattermost.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-mattermost.mdx
@@ -20,6 +20,8 @@ proxy servers.
 For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
 
 ### `teleport.identitySecretName`
 
@@ -43,7 +45,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Mattermost](../../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) guide
+Mattermost](../../identity-governance/access-requests/plugins/mattermost.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -141,6 +143,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the Mattermost plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the Mattermost plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-msteams.mdx b/docs/pages/includes/helm-reference/zz_generated.access-msteams.mdx
index 4d1dcb05c21ea..af8ce41fa0da8 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-msteams.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-msteams.mdx
@@ -20,6 +20,8 @@ proxy servers.
 For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
 
 ### `teleport.identitySecretName`
 
@@ -43,7 +45,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Microsoft Teams](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) guide
+Microsoft Teams](../../identity-governance/access-requests/plugins/msteams.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -72,7 +74,7 @@ You can pass the MsTeams appSecret:
 | `string` | `""` |
 
 `msTeams.appID` is the Azure app ID used by the plugin.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
 
 This value is mandatory.
 
@@ -83,7 +85,7 @@ This value is mandatory.
 | `string` | `""` |
 
 `msTeams.tenantID` is the Azure tenant ID used by the plugin and Microsoft Teams.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
 
 This value is mandatory.
 
@@ -94,7 +96,7 @@ This value is mandatory.
 | `string` | `""` |
 
 `msTeams.teamsAppID` is the MsTeams app ID used by the plugin.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
 
 This value is mandatory.
 
@@ -177,6 +179,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the MS Teams plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the MS Teams plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-pagerduty.mdx b/docs/pages/includes/helm-reference/zz_generated.access-pagerduty.mdx
index 5acf238939fa7..a6f2bdb2f38e1 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-pagerduty.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-pagerduty.mdx
@@ -21,6 +21,9 @@ For example:
   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   - joining an Auth: `teleport-auth.example.com:3025`
 
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
+
 ### `teleport.identitySecretName`
 
 | Type | Default |
@@ -43,7 +46,7 @@ data:
 ```
 
 Check out the [Access Requests with
-PagerDuty](../../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) guide
+PagerDuty](../../identity-governance/access-requests/plugins/pagerduty.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -132,6 +135,77 @@ The value can also be set to a file path (such as `/var/log/teleport.log`)
 to write logs to a file. Bear in mind that a few service startup messages
 will still go to `stderr` for resilience.
 
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the PagerDuty plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the PagerDuty plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
 ## `annotations`
 
 `annotations` contains annotations to apply to the different Kubernetes
diff --git a/docs/pages/includes/helm-reference/zz_generated.access-slack.mdx b/docs/pages/includes/helm-reference/zz_generated.access-slack.mdx
index 5252bc39f1d62..b0a9a8447d182 100644
--- a/docs/pages/includes/helm-reference/zz_generated.access-slack.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.access-slack.mdx
@@ -46,7 +46,7 @@ data:
 ```
 
 Check out the [Access Requests with
-Slack](../../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) guide
+Slack](../../identity-governance/access-requests/plugins/slack.mdx) guide
 for more information about how to acquire these credentials.
 
 ### `teleport.identitySecretPath`
@@ -216,7 +216,7 @@ teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
 | `string` | `"kubernetes"` |
 
 `tbot.joinMethod` describes how tbot joins the Teleport cluster.
-See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
 
 ## `annotations`
 
diff --git a/docs/pages/includes/helm-reference/zz_generated.event-handler.mdx b/docs/pages/includes/helm-reference/zz_generated.event-handler.mdx
new file mode 100644
index 0000000000000..ef51324c1ad5e
--- /dev/null
+++ b/docs/pages/includes/helm-reference/zz_generated.event-handler.mdx
@@ -0,0 +1,618 @@
+
+{/* Generated file. Do not edit.*/}
+{/* Generate this file by navigating to examples/chart and running  make render-chart-ref*/}
+## `teleport`
+
+`teleport` contains the configuration describing how the plugin connects to
+your Teleport cluster.
+
+### `teleport.address`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`teleport.address` is the address of the Teleport cluster the plugin
+connects to. The address must contain both the domain name and the port of
+the Teleport cluster. It can be either the address of the auth servers or the
+proxy servers.
+
+For example:
+  - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
+  - joining an Auth: `teleport-auth.example.com:3025`
+
+When the address is empty, `tbot.teleportProxyAddress`
+or `tbot.teleportAuthAddress` will be used if they are set.
+
+### `teleport.identitySecretName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`teleport.identitySecretName` is the name of the Kubernetes secret
+that contains the credentials for the connection to your Teleport cluster.
+
+The secret should be in the following format:
+
+```yaml
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: teleport-plugin-event-handler-identity
+data:
+  auth_id: #...
+```
+
+Check out the [Export Events with Fluentd]
+(../../zero-trust-access/export-audit-events/fluentd.mdx) guide
+for more information about how to acquire these credentials.
+
+### `teleport.identitySecretPath`
+
+| Type | Default |
+|------|---------|
+| `string` | `"auth_id"` |
+
+`teleport.identitySecretPath` is the key in the Kubernetes secret
+specified by `teleport.identitySecretName` that holds the credentials for
+the connection to your Teleport cluster. If the secret has the path,
+`"auth_id"`, you can omit this field.
+
+## `eventHandler`
+
+`eventHandler` contains the configuration used by the plugin to forward Teleport events.
+
+### `eventHandler.storagePath`
+
+| Type | Default |
+|------|---------|
+| `string` | `"/var/lib/teleport/plugins/event-handler/storage"` |
+
+`eventHandler.storagePath` is the storage directory for the event handler.
+
+### `eventHandler.timeout`
+
+| Type | Default |
+|------|---------|
+| `string` | `"10s"` |
+
+`eventHandler.timeout` is the polling timeout.
+
+### `eventHandler.batch`
+
+| Type | Default |
+|------|---------|
+| `int` | `20` |
+
+`eventHandler.batch` is the fetch batch size.
+
+### `eventHandler.windowSize`
+
+| Type | Default |
+|------|---------|
+| `string` | `"24h"` |
+
+`eventHandler.windowSize` configures the duration of the time window for the event handler
+to request events from Teleport. By default, this is set to 24 hours.
+Reduce the window size if the events backend cannot manage the event volume
+for the default window size.
+The window size should be specified as a duration string, parsed by Go's time.ParseDuration.
+
+### `eventHandler.debug`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`eventHandler.debug` enables debug logging.
+
+### `eventHandler.types`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`eventHandler.types` is the list of event types to forward.
+When unset, the event handler forwards all events.
+
+### `eventHandler.skipEventTypes`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`eventHandler.skipEventTypes` is the list of audit event types to skip.
+
+### `eventHandler.skipSessionTypes`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`eventHandler.skipSessionTypes` is the list of session recording event types to skip.
+When unset, the event handler skips noisy and binary events.
+
+See the [Teleport-event-handler README](https://github.com/gravitational/teleport/blob/1d2bd5eb8fc3500deb7d7108f6835efde98b7b24/integrations/event-handler/README.md)
+for a list of default skipped events.
+
+### `eventHandler.startTime`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`eventHandler.startTime` is the start time to start ingestion from (RFC3339 format).
+
+### `eventHandler.dryRun`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`eventHandler.dryRun` enables dry run without sending events to fluentd.
+
+### `eventHandler.concurrency`
+
+| Type | Default |
+|------|---------|
+| `int` | `5` |
+
+`eventHandler.concurrency` is the number of concurrent sessions to process. By default, this is set to 5.
+
+#### `eventHandler.lock.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`eventHandler.lock.enabled` controls whether user auto-locking is enabled.
+
+#### `eventHandler.lock.failedAttemptsCount`
+
+| Type | Default |
+|------|---------|
+| `int` | `3` |
+
+`eventHandler.lock.failedAttemptsCount` is the number of failed attempts in the `lockPeriod` which
+triggers locking. By default, this is set to 3.
+
+#### `eventHandler.lock.period`
+
+| Type | Default |
+|------|---------|
+| `string` | `"1m"` |
+
+`eventHandler.lock.period` is the time period where `lock-failed-attempts-count` failed attempts
+will trigger locking. By default, this is set to 1 minute.
+
+#### `eventHandler.lock.for`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`eventHandler.lock.for` is the time period for which user gets lock.
+
+## `fluentd`
+
+`fluentd` contains the configuration for the fluentd forwarder.
+
+### `fluentd.url`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`fluentd.url` is the Fluentd URL where the events will be sent.
+
+### `fluentd.sessionUrl`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`fluentd.sessionUrl` is the Fluentd URL where the session logs will be sent.
+
+#### `fluentd.certificate.secretName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`fluentd.certificate.secretName` is the secret containing the credentials to connect to Fluentd.
+It must contain the CA certificate, the client key and the client certificate.
+
+#### `fluentd.certificate.caPath`
+
+| Type | Default |
+|------|---------|
+| `string` | `"ca.crt"` |
+
+`fluentd.certificate.caPath` is the name of the key which contains the CA certificate inside the secret.
+
+#### `fluentd.certificate.certPath`
+
+| Type | Default |
+|------|---------|
+| `string` | `"client.crt"` |
+
+`fluentd.certificate.certPath` is the name of the key which contains the client's certificate inside the secret.
+
+#### `fluentd.certificate.keyPath`
+
+| Type | Default |
+|------|---------|
+| `string` | `"client.key"` |
+
+`fluentd.certificate.keyPath` is the name of the key which contains the client's private key inside the secret.
+
+### `fluentd.maxConnections`
+
+| Type | Default |
+|------|---------|
+| `int` | `0` |
+
+`fluentd.maxConnections` is the maximum number of connections to Fluentd. By default, or when set to 0,
+this becomes `eventHandler.concurrency` * 2.
+
+## `tbot`
+
+`tbot` controls the optional tbot deployment that obtains and renews
+credentials for the plugin to connect to Teleport.
+Only default and mandatory values are described here, see the tbot chart reference
+for the full list of supported values.
+
+### `tbot.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`tbot.enabled` controls if tbot should be deployed with the event handler plugin.
+
+### `tbot.clusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.clusterName` is the name of the Teleport cluster tbot and the event handler plugin will join.
+Setting this value is mandatory when tbot is enabled.
+
+### `tbot.teleportProxyAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportProxyAddress` is the teleport Proxy Service address the bot will connect to.
+This must contain the port number, usually 443 or 3080 for Proxy Service.
+Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+This is mandatory to connect to Teleport Enterprise (Cloud).
+
+This setting is mutually exclusive with `teleportAuthAddress`.
+
+For example:
+```yaml
+tbot:
+  teleportProxyAddress: "test.teleport.sh:443"
+```
+
+### `tbot.teleportAuthAddress`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tbot.teleportAuthAddress` is the teleport Auth Service address the bot will connect to.
+This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+Helm release and have direct access to the Auth Service.
+Else, you should prefer connecting via the Proxy Service.
+
+This setting is mutually exclusive with `teleportProxyAddress`.
+
+For example:
+```yaml
+teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+```
+
+### `tbot.joinMethod`
+
+| Type | Default |
+|------|---------|
+| `string` | `"kubernetes"` |
+
+`tbot.joinMethod` describes how tbot joins the Teleport cluster.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+
+## `annotations`
+
+`annotations` contains annotations to apply to the different Kubernetes
+objects created by the chart. See [the Kubernetes annotation
+documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+for more details.
+
+### `annotations.config`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.config` are annotations to set on the ConfigMap.
+
+### `annotations.deployment`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.deployment` are annotations to set on the Deployment.
+
+### `annotations.pod`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.pod` are annotations to set on the Pods.
+
+## `extraLabels`
+
+`extraLabels` contains additional Kubernetes labels to apply on the resources
+created by the chart. See [the Kubernetes label documentation
+](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+for more information.
+
+### `extraLabels.config`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.config` are labels to set on the ConfigMap.
+
+### `extraLabels.deployment`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.deployment` are labels to set on the Deployment.
+
+### `extraLabels.pod`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.pod` are labels to set on the Pods.
+
+## `image`
+
+`image` sets the container image used for plugin pods created by the chart.
+
+You can override this to use your own plugin image rather than a Teleport-published image.
+
+### `image.repository`
+
+| Type | Default |
+|------|---------|
+| `string` | `"public.ecr.aws/gravitational/teleport-plugin-event-handler"` |
+
+`image.repository` is the image repository.
+
+### `image.pullPolicy`
+
+| Type | Default |
+|------|---------|
+| `string` | `"IfNotPresent"` |
+
+`image.pullPolicy` is the [Kubernetes image pull policy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy).
+
+### `image.tag`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`image.tag` Overrides the image tag whose default is the chart appVersion.
+
+Normally, the version of the Teleport plugin matches the
+version of the chart. If you install chart version 15.0.0, you'll use
+the plugin version 15.0.0. Upgrading the plugin is done by upgrading the chart.
+
+<Admonition type="warning">
+`image.tag` is intended for development and custom tags. This MUST NOT be
+used to control the plugin version in a typical deployment. This
+chart is designed to run a specific plugin version. You will face
+compatibility issues trying to run a different version with it.
+
+If you want to run the Teleport plugin version `X.Y.Z`, you should use
+`helm install --version X.Y.Z` instead.
+</Admonition>
+
+## `imagePullSecrets`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`imagePullSecrets` is a list of secrets containing authorization tokens
+which can be optionally used to access a private Docker registry.
+
+See the [Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) for more details.
+
+## `nameOverride`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`nameOverride` optionally overrides the name of the chart, used
+together with the release name when giving a name to resources.
+
+## `fullnameOverride`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`fullnameOverride` optionally overrides the full name of resources.
+
+## `podSecurityContext`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`podSecurityContext` sets the pod security context for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+for more details.
+
+To unset the security context, set it to `null` or `~`.
+
+## `securityContext`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`securityContext` sets the container security context for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
+for more details.
+
+To unset the security context, set it to `null` or `~`.
+
+## `resources`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`resources` sets the resource requests/limits for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+for more details.
+
+## `nodeSelector`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`nodeSelector` sets the node selector for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
+for more details.
+
+## `tls`
+
+`tls` contains settings for mounting your own TLS material in the event-handler pod.
+The event-handler does not expose a TLS server, so this is only used to trust CAs.
+
+### `tls.existingCASecretName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tls.existingCASecretName` sets the `SSL_CERT_FILE` environment
+variable to load a trusted CA or bundle in PEM format into Teleport pods.
+The injected CA will be used to validate TLS communications with the Proxy
+Service.
+
+You must create a secret containing the CA certs in the same namespace as Teleport using a command like:
+
+```code
+$ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
+```
+
+### `tls.existingCASecretKeyName`
+
+| Type | Default |
+|------|---------|
+| `string` | `"ca.pem"` |
+
+`tls.existingCASecretKeyName` determines which key in the CA secret
+will be used as a trusted CA bundle file.
+
+## `tolerations`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`tolerations` sets the tolerations for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+for more details.
+
+## `affinity`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`affinity` sets the affinities for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+for more details.
+
+## `volumes`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`volumes` sets the volumes mounted into the main event-handler pod.
+See [the Kubernetes volume
+documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+details.
+
+For example:
+```yaml
+- name: storage
+  persistentVolumeClaim:
+    claimName: teleport-plugin-event-handler
+```
+
+## `volumeMounts`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`volumeMounts` sets the volume mounts for the main event-handler container.
+See [the Kubernetes volume
+documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+details.
+
+For example:
+```yaml
+- name: storage
+  mountPath: "/var/lib/teleport/plugins/event-handler/storage"
+```
+
+## `extraArgs`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraArgs` contains extra arguments to pass to `teleport-plugin start` for
+the main event-handler container.
+
+## `extraEnv`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraEnv` contains extra environment variables to set in the main
+event-handler container.
+
+For example:
+```yaml
+extraEnv:
+  - name: HTTPS_PROXY
+    value: "http://username:password@my.proxy.host:3128"
+```
diff --git a/docs/pages/includes/helm-reference/zz_generated.tbot.mdx b/docs/pages/includes/helm-reference/zz_generated.tbot.mdx
index d9a5e36600eec..9236240bffb94 100644
--- a/docs/pages/includes/helm-reference/zz_generated.tbot.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.tbot.mdx
@@ -35,7 +35,7 @@ This must contain the port number, usually 443 or 3080 for Proxy Service.
 Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
 This is mandatory to connect to Teleport Enterprise (Cloud)
 
-This setting is mutually exclusive with teleportProxyAddress and is ignored if `customConfig` is set.
+This setting is mutually exclusive with teleportProxyAddress and is ignored if `tbotConfig` is set.
 
 For example:
 ```yaml
@@ -54,7 +54,7 @@ should be used when you are deploying the bot in the same Kubernetes cluster tha
 Helm release and have direct access to the Auth Service.
 Else, you should prefer connecting via the Proxy Service.
 
-This setting is mutually exclusive with teleportProxyAddress and is ignored if `customConfig` is set.
+This setting is mutually exclusive with teleportProxyAddress and is ignored if `tbotConfig` is set.
 
 For example:
 ```yaml
@@ -64,7 +64,7 @@ teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
 ## `defaultOutput`
 
 `defaultOutput` controls the default output configured for the tbot agent.
-Ignored if `customConfig` is set.
+Ignored if `tbotConfig` is set.
 
 ### `defaultOutput.enabled`
 
@@ -74,6 +74,127 @@ Ignored if `customConfig` is set.
 
 `defaultOutput.enabled` controls whether the default output is enabled.
 
+## `argocd`
+
+`argocd` configures tbot to synchronize Teleport-managed Kubernetes clusters
+to Argo CD.
+Ignored if `tbotConfig` is set.
+
+### `argocd.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`argocd.enabled` controls whether the Argo CD output is enabled.
+
+### `argocd.clusterSelectors`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`argocd.clusterSelectors` determines which Kubernetes clusters will
+be synchronized to Argo CD.
+
+For example:
+```yaml
+clusterSelectors:
+  - name: my-cluster-1
+  - labels:
+      environment: production
+```
+
+### `argocd.secretNamespace`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`argocd.secretNamespace` determines to which Kubernetes namespace
+cluster secrets will be written (it must be the namespace in which Argo CD
+is running). Defaults to the current namespace.
+
+### `argocd.secretNamePrefix`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`argocd.secretNamePrefix` overrides the string that cluster secret
+names will be prefixed with. Defaults to "teleport.argocd-cluster".
+
+### `argocd.secretLabels`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`argocd.secretLabels` provides a set of labels that will be applied
+to cluster secrets. Label values can be Go template strings (rendered by tbot,
+not Helm) with the following variables:
+
+  - \{\{.ClusterName\}\} - Name of the Teleport cluster
+  - \{\{.KubeName\}\} - Name of the Kubernetes cluster resource
+  - \{\{.Labels\}\} - Map of labels applied to the Kubernetes cluster
+    resource that can be indexed using `\{\{index .Labels "key"\}\}`
+
+If the label value is empty, the label will not be added to the secret.
+
+### `argocd.secretAnnotations`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`argocd.secretAnnotations` provides a set of annotations that will
+be applied to cluster secrets.
+
+### `argocd.project`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`argocd.project` sets the Argo CD project with which the Kubernetes
+clusters will be associated.
+
+### `argocd.namespaces`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`argocd.namespaces` controls which Kubernetes namespaces the Argo CD
+clusters will be allowed to operate on.
+
+### `argocd.clusterResources`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`argocd.clusterResources` determines whether the Argo CD cluster is
+allowed to operate on cluster-scoped resources (only when `argocd.namespaces`
+is non-empty).
+
+### `argocd.clusterNameTemplate`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`argocd.clusterNameTemplate` determines the format of cluster names
+in Argo CD. It is a Go template string (rendered by tbot, not Helm) that
+supports the following variables:
+
+  - \{\{.ClusterName\}\} - Name of the Teleport cluster
+  - \{\{.KubeName\}\} - Name of the Kubernetes cluster resource
+  - \{\{.Labels\}\} - Map of labels applied to the Kubernetes cluster
+    resource that can be indexed using `\{\{index .Labels "key"\}\}`
+
+By default, the following template will be used: "\{\{.ClusterName\}\}-\{\{.KubeName\}\}".
+
 ## `persistence`
 
 `persistence` controls how the tbot agent stores its data.
@@ -102,7 +223,7 @@ use the more specific configuration values throughout this chart.
 
 `outputs` contains additional outputs to configure for the tbot agent.
 These should be in the same format as the `outputs` field in the tbot.yaml.
-Ignored if `customConfig` is set.
+Ignored if `tbotConfig` is set.
 
 ## `services`
 
@@ -112,7 +233,7 @@ Ignored if `customConfig` is set.
 
 `services` contains additional services to configure for the tbot agent.
 These should be in the same format as the `services` field in the tbot.yaml.
-Ignored if `customConfig` is set.
+Ignored if `tbotConfig` is set.
 
 ## `joinMethod`
 
@@ -121,8 +242,8 @@ Ignored if `customConfig` is set.
 | `string` | `"kubernetes"` |
 
 `joinMethod` describes how tbot joins the Teleport cluster.
-See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
-Ignored if `customConfig` is set.
+See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+Ignored if `tbotConfig` is set.
 
 ## `token`
 
@@ -132,7 +253,7 @@ Ignored if `customConfig` is set.
 
 `token` is the name of the token used by tbot to join the Teleport cluster.
 This value is not sensitive unless the `joinMethod` is set to `"token"`.
-Ignored if `customConfig` is set.
+Ignored if `tbotConfig` is set.
 
 ## `teleportVersionOverride`
 
@@ -462,3 +583,15 @@ See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-po
 for more details.
 
 By default, this is unset.
+
+## `podSecurityContext`
+
+| Type | Default |
+|------|---------|
+| `object` | `null` |
+
+`podSecurityContext` sets the pod security context for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+for more details.
+
+By default, this is unset.
diff --git a/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx b/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
index 67e3f1a95c4d3..e846c48b32b78 100644
--- a/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
@@ -41,6 +41,21 @@ Here are a few examples:
 | Teleport Cloud cluster        | `example.teleport.sh:443`           |
 | `teleport-cluster` Helm chart | `teleport.example.com:443`          |
 
+## `relayAddr`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`relayAddr` defines the optional address of the Teleport Relay
+Service tunnel endpoint that this agent should use.
+
+If set, the agent will open reverse tunnels to the specified Relay in addition
+to the tunnels to the control plane, for the protocols supported by the Relay.
+
+relayAddr is available starting from Teleport v18.5.0, taking effect for the
+Kubernetes service.
+
 ## `enterprise`
 
 | Type | Default |
@@ -93,14 +108,14 @@ Its usage should be preferred.
 `joinParams.method` controls which join method will be used by the
 instance to join the Teleport cluster.
 
-See [the join method reference](../../reference/join-methods.mdx) for the list of possible
+See [the join method reference](../../reference/deployment/join-methods.mdx) for the list of possible
 values, the implications of each join method, and guides to set up each method.
 
 Common join-methods for the `teleport-kube-agent` are:
 - `token`: the most basic one, with regular ephemeral secret tokens
 - `kubernetes`: either the `in-cluster` variant (if the agent runs in the
-  same Kubernetes cluster as the `teleport-cluster` chart) or the `JWKS`
-  variant (works in every Kubernetes cluster, regardless of the Teleport Auth
+  same Kubernetes cluster as the `teleport-cluster` chart) or the `JWKS/OIDC`
+  variants (work in every Kubernetes cluster, regardless of the Teleport Auth
   Service location).
 
 ### `joinParams.tokenName`
@@ -112,7 +127,7 @@ Common join-methods for the `teleport-kube-agent` are:
 `joinParams.tokenName` controls which token is used by the agent to
 join the Teleport cluster.
 
-When `joinParams.method` is [a delegated join method](../../reference/join-methods.mdx#delegated-join-methods),
+When `joinParams.method` is [a delegated join method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
 the value is not sensitive.
 
 When `joinParams.method` is `token` (by default), `joinParams.tokenName`
@@ -124,6 +139,21 @@ If method is `token`, `joinParams.tokenName` can be empty if the token
 is provided through an existing Kubernetes Secret, see
 [`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
 
+If method is `kubernetes`, you must set [`teleportClusterName`](#teleportClusterName).
+
+## `teleportClusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`teleportClusterName` is the name of the joined Teleport cluster.
+Setting this value is required when joining via the
+[Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
+
+When this value is set, the chart mounts a kubernetes service account token
+via a projected volume and configures Teleport to use it for joining.
+
 ## `kubeClusterName`
 
 | Type | Default |
@@ -143,7 +173,7 @@ This setting is required if the chart `roles` contains `kube`.
 | `list` | `[]` |
 
 `apps` is a static list of applications that should be proxied by
-the agent. See [the Teleport Application access documentation](../../reference/agent-services/application-access.mdx#configuration)
+the agent. See [the Teleport Application access documentation](../../enroll-resources/application-access/reference.mdx#configuration)
 for more details.
 
 Proxied applications can be defined statically (through this value) or dynamically
@@ -168,7 +198,7 @@ apps:
 <Admonition type="tip" title="Supported values">
   You can see a list of all the supported values that can be used in a Teleport
   Application Service configuration in the [Application Service Configuration
-  Reference](../../reference/agent-services/application-access.mdx#configuration).
+  Reference](../../enroll-resources/application-access/reference.mdx#configuration).
 </Admonition>
 
 ## `appResources`
@@ -179,7 +209,7 @@ apps:
 
 `appResources` is a set of labels the agent will monitor. Any application
 matching those labels will be proxied by the agent. See [the Teleport
-Application access documentation](../../enroll-resources/application-access/introduction.mdx)
+Application access documentation](../../enroll-resources/application-access/application-access.mdx)
 for more details.
 
 Proxied applications can be defined statically (through [`apps`](#apps)) or
@@ -198,7 +228,7 @@ appResources:
 
 <Admonition type="tip" title="Example">
 Once `appResources` is set, you can dynamically register application with
-`tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/guides/dynamic-registration.mdx).
+`tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/configuration/dynamic-registration.mdx).
 </Admonition>
 
 ## `clusterDomain`
@@ -221,7 +251,7 @@ to match your cluster domain if it is different from the default value `cluster.
 `awsDatabases` configures AWS database auto-discovery.
 
 <Admonition type="note" title="IAM roles">
-  For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport).
+  For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx#step-36-create-iam-policies-for-teleport).
   After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
 
   ```yaml
@@ -266,7 +296,7 @@ annotations:
 
 `azureDatabases` configures Azure database auto-discovery.
 <Admonition type="note" title="Azure IAM">
-  For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-25-configure-iam-permissions-for-teleport).
+  For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enrollment/azure/azure-postgres-mysql.mdx#step-25-configure-iam-permissions-for-teleport).
 
   After configuring a service principal with appropriate IAM permissions, you must pass credentials to the pods.
   The easiest way is to use an Azure client secret.
@@ -372,7 +402,7 @@ databases:
 ```
 
 <Admonition type="tip" title="Supported values">
-  You can see a list of all the supported [values which can be used in a Teleport Database Service configuration here](../../reference/agent-services/database-access-reference/configuration.mdx).
+  You can see a list of all the supported [values which can be used in a Teleport Database Service configuration here](../../enroll-resources/database-access/reference/configuration.mdx).
 </Admonition>
 
 <Admonition type="tip" title="Trusting Database CA">
@@ -617,7 +647,7 @@ which does not have valid TLS certificates for testing.
 Teleport pods. The configuration will be merged with the chart-generated
 configuration and will take precedence in case of conflict.
 
-See the [Teleport Configuration Reference](../../reference/config.mdx) for the list of supported fields.
+See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
 
 ```yaml
 teleportConfig:
@@ -675,9 +705,14 @@ You must create a secret containing the CA certs in the same namespace as Telepo
 $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
 
-<Admonition type="warning" title="Root CA filename">
-  The key containing the root CA in the secret must be `ca.pem`.
-</Admonition>
+### `tls.existingCASecretKeyName`
+
+| Type | Default |
+|------|---------|
+| `string` | `"ca.pem"` |
+
+`tls.existingCASecretKeyName` determines which key in the CA secret
+will be used as a trusted CA bundle file.
 
 ## `updater`
 
@@ -779,7 +814,7 @@ It is also used as a failover when fetching the version using the webapi protoco
 | `string` | `""` |
 
 `updater.group` is the update group used when fetching the version using the webapi protocol.
-When unset, the group defaults to `update.releaseChannel`.
+When unset, the group defaults to `default`.
 
 ### `updater.image`
 
@@ -893,7 +928,7 @@ PodSecurityPolicy resources (PSP) have been removed in Kubernetes 1.25
 and replaced since 1.23 by PodSecurityAdmission (PSA). If you are running on
 Kubernetes 1.23 or later, it is recommended to disable PSPs and use PSAs.
 The steps are documented in the
-[PSP removal guide](../../admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
+[PSP removal guide](../../zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
 
 This value will be removed in a future chart version.
 
@@ -919,7 +954,7 @@ This is only used when the [`roles`](#roles) contains `kube`.
   To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
   To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
 
-  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../admin-guides/management/admin/labels.mdx).
+  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../zero-trust-access/rbac-get-started/labels.mdx).
 </Admonition>
 
 For example:
@@ -1020,7 +1055,7 @@ available pod specified on the PodDisruptionBudget.
 This CRD is managed by the prometheus-operator and allows workload to
 get monitored. To use this value, you need to run a `prometheus-operator`
 in the cluster for this value to take effect.
-See https://prometheus-operator.dev/docs/prologue/introduction/
+See https://prometheus-operator.dev/docs/getting-started/introduction/
 
 ### `podMonitor.enabled`
 
@@ -1173,7 +1208,7 @@ Teleport-published image.
 By default, the image contains only the Teleport application and its runtime
 dependencies, and does not contain a shell.
 This setting only takes effect when [`enterprise`](#enterprise) is `true`.
-When running an enterprise version, you must use [`image`](#image) instead.
+When running an OSS version, you must use [`image`](#image) instead.
 
 ## `imagePullSecrets`
 
@@ -1393,7 +1428,7 @@ Possible values are `text` (default) or `json`.
 
 `log.extraFields` sets the fields used in logging for the Teleport process.
 
-See the [Teleport config file reference](../../reference/config.mdx) for
+See the [Teleport config file reference](../../reference/deployment/config.mdx) for
 more details on possible values for `extra_fields`.
 
 ## `affinity`
@@ -1406,6 +1441,42 @@ more details on possible values for `extra_fields`.
 See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
 for more details.
 
+## `disableTopologySpreadConstraints`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`disableTopologySpreadConstraints` turns off the topology spread constraints.
+The feature is automatically turned off on Kubernetes versions below 1.18.
+
+## `topologySpreadConstraints`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`topologySpreadConstraints` sets the topology spread constraints for any pods created by the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+for more details.
+
+When unset, the chart defaults to a soft topology spread constraint
+that tries to spread pods across hosts and zones.
+
+```
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels: # dynamically computed
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels: # dynamically computed
+```
+
 ## `dnsConfig`
 
 | Type | Default |
@@ -1754,6 +1825,23 @@ initContainers:
 See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
 for more details.
 
+## `goMemLimitRatio`
+
+| Type | Default |
+|------|---------|
+| `float` | `0.9` |
+
+`goMemLimitRatio` configures the GOMEMLIMIT env var set by the chart.
+GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+below a given threshold. This is a best-effort attempt, but this helps
+to prevent OOMs in case of bursts.
+
+When the memory limits are set and goMemLimitRatio is non-zero,
+the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+The value must be between 0 and 1.
+Set to 0 to unset GOMEMLIMIT.
+This has no effect if GOMEMLIMIT is already set through `extraEnv`.
+
 ## `initSecurityContext`
 
 | Type | Default |
diff --git a/docs/pages/includes/helm-reference/zz_generated.teleport-operator.mdx b/docs/pages/includes/helm-reference/zz_generated.teleport-operator.mdx
index 09fd0fb3a48c6..9a77cba007ba3 100644
--- a/docs/pages/includes/helm-reference/zz_generated.teleport-operator.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.teleport-operator.mdx
@@ -75,7 +75,7 @@ method. `kubernetes` is the most common one.
 
 `teleportClusterName` is the name of the joined Teleport cluster.
 Setting this value is required when joining via the
-[Kubernetes JWKS](../../reference/join-methods.mdx#kubernetes-jwks) join method.
+[Kubernetes JWKS](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
 
 ## `token`
 
@@ -151,7 +151,7 @@ put on the `Pod` resources created by the chart.
 `annotations.serviceAccount` contains the Kubernetes annotations
 put on the `Deployment` resource created by the chart.
 
-## `annotations`
+## `labels`
 
 ### `labels.deployment`
 
@@ -218,6 +218,22 @@ is false and the operator must use an existing `ServiceAccount`.
 This value can be set to `false` when deploying in constrained environments
 where the user deploying the operator is not allowed to edit RBAC resources.
 
+## `extraEnv`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraEnv` contains extra environment to be configured on the pod.
+
+## `extraArgs`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraArgs` contains extra arguments to pass to the operator
+
 ## `imagePullPolicy`
 
 | Type | Default |
@@ -328,6 +344,15 @@ command such as:
 $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
 
+### `tls.existingCASecretKeyName`
+
+| Type | Default |
+|------|---------|
+| `string` | `"ca.pem"` |
+
+`tls.existingCASecretKeyName` determines which key in the CA secret
+will be used as a trusted CA bundle file.
+
 ## `podSecurityContext`
 
 | Type | Default |
diff --git a/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx b/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx
new file mode 100644
index 0000000000000..672a3da2b37cd
--- /dev/null
+++ b/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx
@@ -0,0 +1,914 @@
+
+{/* Generated file. Do not edit.*/}
+{/* Generate this file by navigating to examples/chart and running  make render-chart-ref*/}
+## `relayGroup`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`relayGroup` sets the internal identifier for the group of Relay
+instances reachable through the same load balancer. Should be unique in the
+whole Teleport cluster.
+
+## `publicHostnames`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`publicHostnames` a list of hostnames that this Relay group is publicly
+reachable at by clients.
+
+```
+publicHostnames:
+  - relay.example.com
+```
+
+## `targetConnectionCount`
+
+| Type | Default |
+|------|---------|
+| `int` | `2` |
+
+`targetConnectionCount` the amount of tunnel connections that agents
+will open to distinct Relay instances. It should not be bigger than the
+replica count.
+
+## `proxyAddr`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`proxyAddr` provides the public-facing Teleport Proxy Service
+endpoint which should be used to join the cluster. This is the same URL used
+to access the web UI of your Teleport cluster. The port used is usually either
+3080 or 443.
+
+Here are a few examples:
+
+| Deployment method             | Example `proxy_service.public_addr` |
+|-------------------------------|-------------------------------------|
+| On-prem Teleport cluster      | `teleport.example.com:3080`         |
+| Teleport Cloud cluster        | `example.teleport.sh:443`           |
+| `teleport-cluster` Helm chart | `teleport.example.com:443`          |
+
+## `enterprise`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`enterprise` controls if the `teleport-relay` chart should deploy the
+OSS version or the enterprise version of the container image. This must be set
+to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise
+clusters to allow the agent to leverage enterprise features.
+
+## `joinParams`
+
+`joinParams` controls how the Teleport Agent joins the Teleport cluster.
+These sub-values must be configured for the agent to connect to a cluster.
+
+The token used must grant the `Relay` role, and should be valid for the
+lifetime of the Helm release.
+
+### `joinParams.method`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`joinParams.method` controls which join method will be used by the
+instance to join the Teleport cluster.
+
+See [the join method reference](../../reference/deployment/join-methods.mdx)
+for the list of possible values, the implications of each join method, and
+guides to set up each method.
+
+Common join-methods for the `teleport-relay` are:
+- `token`: the most basic one, with regular ephemeral secret tokens
+- `kubernetes`: either the `in-cluster` variant (if the agent runs in the
+  same Kubernetes cluster as the `teleport-cluster` chart) or the
+  `JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the
+  Teleport Auth Service location).
+
+### `joinParams.tokenName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`joinParams.tokenName` controls which token is used by the agent to
+join the Teleport cluster.
+
+When `joinParams.method` is [a delegated join
+method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
+the value is not sensitive.
+
+When `joinParams.method` is `token` (by default), `joinParams.tokenName`
+contains the secret token itself. In this case, the value is sensitive and
+is automatically stored in a Kubernetes Secret instead of being directly
+included in the agent's configuration.
+
+If method is `token`, `joinParams.tokenName` can be empty if the token is
+provided through an existing Kubernetes Secret, see
+[`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
+
+If method is `kubernetes`, you must set
+[`teleportClusterName`](#teleportClusterName).
+
+## `teleportClusterName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`teleportClusterName` is the name of the joined Teleport cluster.
+Setting this value is required when joining via the
+[Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
+
+When this value is set, the chart mounts a kubernetes service account token
+via a projected volume and configures Teleport to use it for joining.
+
+## `joinTokenSecret`
+
+`joinTokenSecret` manages the join token secret creation and its name. See
+the [`joinParams`](#joinParams) section for more details.
+
+### `joinTokenSecret.create`
+
+| Type | Default |
+|------|---------|
+| `bool` | `true` |
+
+`joinTokenSecret.create` controls whether the chart creates the
+Kubernetes `Secret` containing the Teleport join token. If false, you must
+create a Kubernetes Secret with the configured name in the Helm release
+namespace.
+
+### `joinTokenSecret.name`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`joinTokenSecret.name` is the name of the Kubernetes Secret
+containing the Teleport join token used by the chart.
+
+If `joinTokenSecret.create` is `false`, the chart will not attempt to create
+the secret itself. Instead, it will read the value from an existing secret.
+`joinTokenSecret.name` configures the name of this secret. This allows you
+to configure this secret externally and avoid having a plaintext join token
+stored in your Teleport chart values.
+
+To create your own join token secret, you can use a command like this:
+
+```code
+$ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token=<replace-with-actual-token>
+```
+
+<Admonition type="note">
+
+  The key used for the auth token inside the secret must be `auth-token`, as
+  in the command above.
+
+</Admonition>
+
+```yaml
+joinTokenSecret:
+  create: false
+  name: my-token-secret
+
+joinParams:
+  method: "token"
+  tokenName: ""
+```
+
+## `proxyProtocol`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`proxyProtocol` controls whether or not the connections coming from the
+load balancer will include a PROXY protocol v2 header.
+
+## `log`
+
+`log` controls the agent logging.
+
+### `log.level`
+
+| Type | Default |
+|------|---------|
+| `string` | `"INFO"` |
+
+`log.level` is the log level for the Teleport process.
+Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+
+The default is `INFO`, which is recommended in production.
+`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+
+### `log.format`
+
+| Type | Default |
+|------|---------|
+| `string` | `"json"` |
+
+`log.format` sets the log output format for the Teleport process.
+Possible values are `text` or `json`.
+
+## `preStopDelay`
+
+| Type | Default |
+|------|---------|
+| `string` | `"30s"` |
+
+`preStopDelay` the optional time that will pass between the pod
+entering the Terminating state and the Teleport instance getting signaled to
+begin its shutdown advertisement. Useful to allow load balancers to stop
+routing connections to the terminating pod.
+
+## `shutdownDelay`
+
+| Type | Default |
+|------|---------|
+| `string` | `"30s"` |
+
+`shutdownDelay` the optional time that the Teleport instance will
+wait after advertising its shutdown and before it will stop serving new
+inbound connections.
+
+## `terminationGracePeriodSeconds`
+
+| Type | Default |
+|------|---------|
+| `int` | `90` |
+
+`terminationGracePeriodSeconds` the time allotted to a Teleport instance
+pod for termination. It should be longer than the sum of
+[`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay).
+
+## `highAvailability`
+
+`highAvailability` contains settings controlling the availability of the
+Teleport Agent deployed by the chart.
+
+The availability can be increased by:
+- running more replicas with `replicaCount`
+- requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity`
+- by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`.
+
+Even with highAvailability settings Restarting/rolling-out pods can still cause
+disruption for established long-lived sessions.
+
+### `highAvailability.replicaCount`
+
+| Type | Default |
+|------|---------|
+| `int` | `2` |
+
+`highAvailability.replicaCount` is the number of agent replicas
+deployed by the Chart.
+
+Set to a number higher than `1` for a high availability mode where multiple
+Teleport pods will be deployed.
+
+<Admonition type="tip" title="Sizing guidelines">
+
+  As a rough guide, we recommend configuring one replica per distinct
+  availability zone where your cluster has worker nodes.
+
+  2 replicas/availability zones will be fine for smaller workloads. 3-5
+  replicas/availability zones will be more appropriate for bigger clusters
+  with more traffic.
+
+</Admonition>
+
+### `highAvailability.podDisruptionBudget`
+
+`highAvailability.podDisruptionBudget` controls how the chart creates and
+configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not
+delete all agent replicas at the same time.
+
+#### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`highAvailability.podDisruptionBudget.enabled` makes the chart create
+a Kubernetes PodDisruptionBudget for the agent pods.
+
+#### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default |
+|------|---------|
+| `intOrString` | `1` |
+
+`highAvailability.podDisruptionBudget.minAvailable` is the
+minimum available pod count specified on the PodDisruptionBudget.
+
+## `resources`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`resources` sets the resource requests/limits for any pods created by
+the chart. See [the Kubernetes
+documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+for more details.
+
+## `goMemLimitRatio`
+
+| Type | Default |
+|------|---------|
+| `float` | `0.9` |
+
+`goMemLimitRatio` configures the GOMEMLIMIT env var set by the chart.
+GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+below a given threshold. This is a best-effort attempt, but this helps
+to prevent OOMs in case of bursts.
+
+When the memory limits are set and goMemLimitRatio is non-zero,
+the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+The value must be between 0 and 1.
+Set to 0 to unset GOMEMLIMIT.
+This has no effect if GOMEMLIMIT is already set through `extraEnv`.
+
+## `service`
+
+`service` options for the Service that points to the Teleport Relay
+instances.
+
+### `service.type`
+
+| Type | Default |
+|------|---------|
+| `string` | `"LoadBalancer"` |
+
+`service.type` the type of the Service. Unless you have specific
+needs, it should probably be set to LoadBalancer.
+
+### `service.spec`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`service.spec` any additional entries here will be added to the
+Service spec.
+
+```
+spec:
+  loadBalancerIP: "1.2.3.4"
+  loadBalancerClass: service.k8s.aws/nlb
+```
+
+## `serviceAccount`
+
+`serviceAccount` contains settings related to the Kubernetes service account
+used by pods.
+
+### `serviceAccount.create`
+
+| Type | Default |
+|------|---------|
+| `bool` | `true` |
+
+`serviceAccount.create` specifies whether a `ServiceAccount` should
+be created or if an existing one should be used.
+
+### `serviceAccount.name`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`serviceAccount.name` the name of the `ServiceAccount` to use. If
+not set and serviceAccount.create is true, the name is generated using the
+release name. If create is false, the name will be used to reference an
+existing service account.
+
+## `extraLabels`
+
+`extraLabels` contains additional Kubernetes labels to apply on the resources
+created by the chart. See [the Kubernetes label documentation
+](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+for more information.
+
+### `extraLabels.config`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.config` are labels to set on the ConfigMap.
+
+### `extraLabels.deployment`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.deployment` are labels to set on the Deployment.
+
+### `extraLabels.pod`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.pod` are labels to set on the Pods.
+
+### `extraLabels.podDisruptionBudget`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.podDisruptionBudget` are labels to set on the
+PodDisruptionBudget.
+
+### `extraLabels.secret`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.secret` are labels to set on the Secret.
+
+### `extraLabels.service`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.service` are labels to set on the Service.
+
+### `extraLabels.serviceAccount`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`extraLabels.serviceAccount` are labels to set on the
+ServiceAccount.
+
+## `annotations`
+
+`annotations` contains annotations to apply to the different Kubernetes
+objects created by the chart. See [the Kubernetes annotation
+documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+for more details.
+
+### `annotations.config`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.config` are annotations to set on the ConfigMap.
+
+### `annotations.deployment`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.deployment` are annotations to set on the Deployment.
+
+### `annotations.pod`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.pod` are annotations to set on the Pods.
+
+### `annotations.podDisruptionBudget`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.podDisruptionBudget` are annotations to set on the
+podDisruptionBudget.
+
+### `annotations.secret`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.secret` are annotations to set on the Secret.
+
+### `annotations.service`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.service` are annotations to set on the Service.
+
+### `annotations.serviceAccount`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`annotations.serviceAccount` are annotations to set on the
+ServiceAccount.
+
+## `image`
+
+| Type | Default |
+|------|---------|
+| `string` | `"public.ecr.aws/gravitational/teleport-distroless"` |
+
+`image` sets the container image used for Teleport Community Edition
+Agent pods created by the chart.
+
+You can override this to use your own Teleport image rather than a
+Teleport-published image.
+
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
+
+This setting only takes effect when [`enterprise`](#enterprise) is `false`.
+When running an enterprise version, you must use
+[`enterpriseImage`](#enterpriseImage) instead.
+
+## `enterpriseImage`
+
+| Type | Default |
+|------|---------|
+| `string` | `"public.ecr.aws/gravitational/teleport-ent-distroless"` |
+
+`enterpriseImage` sets the container image used for Teleport Enterprise
+agent pods created by the chart.
+
+You can override this to use your own Teleport image rather than a
+Teleport-published image.
+
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
+
+This setting only takes effect when [`enterprise`](#enterprise) is `true`.
+When running an OSS version, you must use [`image`](#image) instead.
+
+## `imagePullSecrets`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`imagePullSecrets` is a list of secrets containing authorization tokens
+which can be optionally used to access a private Docker registry.
+
+See the [Kubernetes
+reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
+for more details.
+
+## `imagePullPolicy`
+
+| Type | Default |
+|------|---------|
+| `string` | `"IfNotPresent"` |
+
+`imagePullPolicy` sets the pull policy for any pods created by the
+chart. See [the Kubernetes
+documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+for more details.
+
+## `topologySpreadConstraints`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`topologySpreadConstraints` sets the topology spread constraints for
+any pods created by the chart. See [the Kubernetes
+documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+for more details.
+
+When unset, the chart defaults to a soft topology spread constraint that tries
+to spread pods across hosts and zones.
+
+```
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels: # dynamically computed
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels: # dynamically computed
+```
+
+## `disableTopologySpreadConstraints`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`disableTopologySpreadConstraints` turns off the default topology
+spread constraints.
+
+## `affinity`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`affinity` sets the affinities for any pods created by the chart. See
+[the Kubernetes
+documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+for more details.
+
+## `tolerations`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`tolerations` sets the tolerations for any pods created by the chart.
+See [the Kubernetes
+documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+for more details.
+
+## `teleportConfig`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`teleportConfig` contains YAML teleport configuration to pass to the
+Teleport pods. The configuration will be merged with the chart-generated
+configuration and will take precedence in case of conflict.
+
+See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
+
+## `extraArgs`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraArgs` contains extra arguments to pass to `teleport start` for
+the main Teleport container.
+
+## `extraEnv`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraEnv` contains extra environment variables to set in the main
+Teleport container.
+
+For example:
+```yaml
+extraEnv:
+  - name: HTTPS_PROXY
+    value: "http://username:password@my.proxy.host:3128"
+```
+
+## `extraVolumes`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraVolumes` contains extra volumes to mount into the Teleport pods.
+See [the Kubernetes volume
+documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+details.
+
+For example:
+```yaml
+extraVolumes:
+- name: myvolume
+  secret:
+    secretName: testSecret
+```
+
+## `extraVolumeMounts`
+
+| Type | Default |
+|------|---------|
+| `list` | `[]` |
+
+`extraVolumeMounts` contains extra volumes mounts for the main Teleport
+container. See [the Kubernetes volume
+documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+details.
+
+For example:
+```yaml
+extraVolumesMounts:
+- name: myvolume
+  mountPath: /path/on/host
+```
+
+## `dnsConfig`
+
+| Type | Default |
+|------|---------|
+| `object` | `{}` |
+
+`dnsConfig` contains custom Pod DNS Configuration for the agent pods.
+This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
+only use FQDNs to refer to remote hosts.
+
+See [the Kubernetes pod DNS documentation
+](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config)
+for more information.
+
+For example:
+```yaml
+ nameservers:
+   - 1.2.3.4
+ searches:
+   - ns1.svc.cluster-domain.example
+   - my.dns.search.suffix
+ options:
+   - name: ndots
+     value: "2"
+```
+
+## `dnsPolicy`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`dnsPolicy` sets the Pod's DNS Policy
+
+See [the Kubernetes pod DNS documentation
+](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
+for more information.
+
+## `hostAliases`
+
+`hostAliases` sets Host aliases in the Teleport Pod. See [the Kubernetes
+hosts file
+documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
+for more details.
+
+For example:
+```yaml
+hostAliases:
+  - ip: "127.0.0.1"
+    hostnames:
+      - "foo.local"
+      - "bar.local"
+  - ip: "10.1.2.3"
+    hostnames:
+      - "foo.remote"
+      - "bar.remote"
+```
+
+## `tls`
+
+`tls` contains settings for mounting your own TLS material in the agent pod.
+
+### `tls.existingCASecretName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`tls.existingCASecretName` sets the `SSL_CERT_FILE` environment
+variable to load a trusted CA or bundle in PEM format into Teleport pods.
+The injected CA will be used to validate TLS communications with the Proxy
+Service.
+
+You must create a secret containing the CA certs in the same namespace as
+Teleport using a command like:
+
+```code
+$ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
+```
+
+### `tls.existingCASecretKeyName`
+
+| Type | Default |
+|------|---------|
+| `string` | `"ca.pem"` |
+
+`tls.existingCASecretKeyName` determines which key in the CA secret
+will be used as a trusted CA bundle file.
+
+## `insecureSkipProxyTLSVerify`
+
+| Type | Default |
+|------|---------|
+| `bool` | `false` |
+
+`insecureSkipProxyTLSVerify` disables TLS verification of the TLS
+certificate presented by the Proxy Service.
+
+This can be used for joining a Teleport instance to a Teleport cluster which
+does not have valid TLS certificates for testing.
+
+<Admonition type="warning">
+
+  Using a self-signed TLS certificate and disabling TLS verification is OK for
+  testing, but is not viable when running a production Teleport cluster as it
+  will drastically reduce security. You must configure valid TLS certificates
+  on your Teleport cluster for production workloads.
+
+  One option might be to use Teleport's built-in [ACME
+  support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable
+  [cert-manager
+  support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager).
+
+</Admonition>
+
+## `securityContext`
+
+| Type | Default |
+|------|---------|
+| `object` | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` |
+
+`securityContext` sets the container security context for any pods
+created by the chart. See [the Kubernetes
+documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
+for more details.
+
+The default value is compatible with [the restricted
+PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
+
+To unset the security context, set it to `null` or `~`.
+
+## `podSecurityContext`
+
+| Type | Default |
+|------|---------|
+| `object` | `{"fsGroup":65532}` |
+
+`podSecurityContext` sets the pod security context for any pods
+created by the chart. See [the Kubernetes
+documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+for more details.
+
+To unset the security context, set it to `null` or `~`.
+
+## `priorityClassName`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`priorityClassName` sets the priority class used by any pods created by the chart.
+The user is responsible for creating the `PriorityClass` resource before deploying the chart.
+See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
+for more details.
+
+## `nameOverride`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`nameOverride` optionally overrides the name of the chart, used
+together with the release name when giving a name to resources.
+
+## `fullnameOverride`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`fullnameOverride` optionally overrides the full name of resources.
+
+## `teleportVersionOverride`
+
+| Type | Default |
+|------|---------|
+| `string` | `""` |
+
+`teleportVersionOverride` controls the Teleport Kubernetes Operator
+image version deployed by the chart.
+
+Normally, the version of the Teleport Kubernetes Operator matches the version
+of the chart. If you install chart version 15.0.0, you'll use Teleport version
+15.0.0. Upgrading the agent is done by upgrading the chart.
+
+<Admonition type="warning">
+
+  `teleportVersionOverride` is intended for development and MUST NOT be used
+  to control the Teleport version in a typical deployment. This chart is
+  designed to run a specific Teleport version. You will face compatibility
+  issues trying to run a different Teleport version with it.
+
+  If you want to run Teleport version `X.Y.Z`, you should use `helm install
+  --version X.Y.Z` instead.
+
+</Admonition>
diff --git a/docs/pages/includes/identity-governance/azure-shell.mdx b/docs/pages/includes/identity-governance/azure-shell.mdx
new file mode 100644
index 0000000000000..4cc7e469e19f2
--- /dev/null
+++ b/docs/pages/includes/identity-governance/azure-shell.mdx
@@ -0,0 +1,25 @@
+Open Azure Cloud Shell by navigating to <a href="https://shell.azure.com">shell.azure.com</a>,
+or by clicking the Cloud Shell icon in the Azure Portal. Make sure to use the bash version of Cloud Shell.
+Once a Cloud Shell instance opens, paste the Teleport generated bash script that downloads the Teleport binary in your 
+Azure Shell and run the `teleport integration configure azure-oidc` command. 
+The command performs the following actions:
+- Creates an enterprise application.
+- Configures Teleport as an OIDC IdP for the application.
+- Assigns read-only Microsoft Graph API permissions to read your directory's data (such as users and groups).
+- Configures authentication by setting up a Teleport SAML service provider.
+
+```code
+# Azure Shell
+$ bash -c "$(curl 'https://example.teleport.sh/webapi/scripts/integrations/configure/azureoidc.sh?authConnectorName=entra-id')"
+
+> teleport integration configure azure-oidc --proxy-public-addr=https://example.teleport.sh --auth-connector-name=entra-id 
+...
+Success! Use the following information to finish the integration onboarding in Teleport:
+Tenant ID: entra-tenant-id
+Client ID: enterprise-app-id
+Success! You can now go back to the Teleport Web UI to use the integration with Azure.
+```
+
+Once the script is done setting up the Entra ID tenant with the necessary properties that are 
+required for the Teleport Entra ID integration, it prints out the Entra ID tenant ID
+and the client ID of the enterprise application set up by the script. 
\ No newline at end of file
diff --git a/docs/pages/includes/install-linux-ent-self-hosted.mdx b/docs/pages/includes/install-linux-ent-self-hosted.mdx
deleted file mode 100644
index f128bf2526595..0000000000000
--- a/docs/pages/includes/install-linux-ent-self-hosted.mdx
+++ /dev/null
@@ -1,176 +0,0 @@
-{{ to-install="teleport-ent" }}
-The easiest installation method, for Teleport versions 17.3 and above, is the
-cluster install script. It will use the best version, edition, and installation
-mode for your cluster.
-
-1. Assign <Var name="teleport.example.com:443"/> to your Teleport cluster hostname.
-   This should contain you cluster hostname and port, but not the scheme (https://).
-
-1. Run your cluster's install script:
-
-   ```code
-   $ curl "https://<Var name="teleport.example.com:443"/>/scripts/install.sh" | sudo bash
-   ```
-
-The other installation methods are:
-<Tabs>
-<TabItem label="Debian 9+/Ubuntu 16.04+ (apt)">
-
-```code
-$ sudo mkdir -p /etc/apt/keyrings
-# Download Teleport's PGP public key
-$ sudo curl https://apt.releases.teleport.dev/gpg \
--o /etc/apt/keyrings/teleport-archive-keyring.asc
-# Source variables about OS version
-$ source /etc/os-release
-# Add the Teleport APT repository for v(=teleport.major_version=). You'll need to update this
-# file for each major release of Teleport.
-$ echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \
-https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v(=teleport.major_version=)" \
-| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-
-$ sudo apt-get update
-$ sudo apt-get install {{ to-install }}
-```
-
-For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-```code
-$ sudo apt-get install teleport-ent-fips
-```
-
-</TabItem>
-<TabItem label="Amazon Linux 2/RHEL 7 (yum)">
-
-```code
-# Source variables about OS version
-$ source /etc/os-release
-# Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
-# file for each major release of Teleport.
-# First, get the major version from $VERSION_ID so this fetches the correct
-# package version.
-$ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-$ sudo yum install -y yum-utils
-$ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport.repo")"
-$ sudo yum install {{ to-install }}
-#
-# Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-# echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-```
-
-For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-```code
-$ sudo yum install teleport-ent-fips
-```
-
-</TabItem>
-<TabItem label="Amazon Linux 2/RHEL 7 (zypper)">
-
-```code
-# Source variables about OS version
-$ source /etc/os-release
-# Add the Teleport Zypper repository for v(=teleport.major_version=). You'll need to update this
-# file for each major release of Teleport.
-# First, get the OS major version from $VERSION_ID so this fetches the correct
-# package version.
-$ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-# Use zypper to add the teleport RPM repo
-$ sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport-zypper.repo")
-$ sudo yum install {{ to-install }}
-#
-# Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-# echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-```
-
-For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-```code
-$ sudo yum install teleport-ent-fips
-```
-
-</TabItem>
-<TabItem label="Amazon Linux 2023/RHEL 8+ (dnf)">
-
-```code
-# Source variables about OS version
-$ source /etc/os-release
-# Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
-# file for each major release of Teleport.
-# First, get the major version from $VERSION_ID so this fetches the correct
-# package version.
-$ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-# Use the dnf config manager plugin to add the teleport RPM repo
-$ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport.repo")"
-
-# Install teleport
-$ sudo dnf install {{ to-install }}
-
-# Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-# echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-```
-
-For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-```code
-$ sudo dnf install teleport-ent-fips
-```
-
-</TabItem>
-<TabItem label="SLES 12 SP5+ and 15 SP5+ (zypper)">
-
-```code
-# Source variables about OS version
-$ source /etc/os-release
-# Add the Teleport Zypper repository.
-# First, get the OS major version from $VERSION_ID so this fetches the correct
-# package version.
-$ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-# Use Zypper to add the teleport RPM repo
-$ sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport-zypper.repo")
-
-# Install teleport
-$ sudo zypper install {{ to-install }}
-```
-
-For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-```code
-$ sudo zypper install teleport-ent-fips
-```
-
-</TabItem>
-
-<TabItem label="Tarball" >
-
-In the example commands below, update `$SYSTEM_ARCH` with the appropriate
-value (`amd64`, `arm64`, or `arm`). All example commands using this variable
-will update after one is filled out.
-
-```code
-$ curl https://cdn.teleport.dev/teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz.sha256
-# <checksum> <filename>
-$ curl -O https://cdn.teleport.dev/teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-$ shasum -a 256 teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-# Verify that the checksums match
-$ tar -xvf teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-$ cd teleport-ent
-$ sudo ./install
-```
-
-For FedRAMP/FIPS-compliant installations of Teleport Enterprise, package URLs
-will be slightly different:
-
-```code
-$ curl https://cdn.teleport.dev/teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-fips-bin.tar.gz.sha256
-# <checksum> <filename>
-$ curl -O https://cdn.teleport.dev/teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-fips-bin.tar.gz
-$ shasum -a 256 teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-fips-bin.tar.gz
-# Verify that the checksums match
-$ tar -xvf teleport-ent-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-fips-bin.tar.gz
-$ cd teleport-ent
-$ sudo ./install
-```
-
-</TabItem>
-</Tabs>
diff --git a/docs/pages/includes/install-linux-enterprise.mdx b/docs/pages/includes/install-linux-enterprise.mdx
deleted file mode 100644
index ea7a5dc6c9cfa..0000000000000
--- a/docs/pages/includes/install-linux-enterprise.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
-Install Teleport on your Linux server:
-
-1. Assign <Var name="edition" /> to one of the following, depending on your
-   Teleport edition:
-
-   | Edition                           | Value        |
-   |-----------------------------------|--------------|
-   | Teleport Enterprise Cloud         | `cloud`      |
-   | Teleport Enterprise (Self-Hosted) | `enterprise` |
-
-1. Get the version of Teleport to install. If you have automatic agent updates
-   enabled in your cluster, query the latest Teleport version that is compatible
-   with the updater:
-
-   ```code
-   $ TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-   $ TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-   ```
-   
-   Otherwise, get the version of your Teleport cluster:
-   
-   ```code 
-   $ TELEPORT_DOMAIN=<Var name="example.teleport.com" />
-   $ TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/ping | jq -r '.server_version')"
-   ```
-
-1. Install Teleport on your Linux server:
-
-   ```code
-   $ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION} <Var name="edition" />
-   ```
-
-   The installation script detects the package manager on your Linux server and
-   uses it to install Teleport binaries. To customize your installation, learn
-   about the Teleport package repositories in the [installation
-   guide](../installation.mdx#linux).
-
diff --git a/docs/pages/includes/install-linux.mdx b/docs/pages/includes/install-linux.mdx
index 9fbfcc55dbc23..c55f235cfd873 100644
--- a/docs/pages/includes/install-linux.mdx
+++ b/docs/pages/includes/install-linux.mdx
@@ -1,8 +1,7 @@
 To install a Teleport Agent on your Linux server:
 
-The easiest installation method, for *Teleport versions 17.3 and above*, is the
-cluster install script. It will use the best version, edition, and installation
-mode for your cluster.
+The recommended installation method is the cluster install script.
+It will select the correct version, edition, and installation mode for your cluster.
 
 1. Assign <Var name="teleport.example.com:443"/> to your Teleport cluster
    hostname and port, but not the scheme (https://).
@@ -12,41 +11,3 @@ mode for your cluster.
    ```code
    $ curl "https://<Var name="teleport.example.com:443"/>/scripts/install.sh" | sudo bash
    ```
-
-On *older Teleport versions*:
-
-1. Assign <Var name="edition" /> to one of the following, depending on your
-   Teleport edition:
-
-   | Edition                           | Value        |
-   |-----------------------------------|--------------|
-   | Teleport Enterprise Cloud         | `cloud`      |
-   | Teleport Enterprise (Self-Hosted) | `enterprise` |
-   | Teleport Community Edition        | `oss`        |
-
-1. Get the version of Teleport to install. If you have automatic agent updates
-   enabled in your cluster, query the latest Teleport version that is compatible
-   with the updater:
-
-   ```code
-   $ TELEPORT_DOMAIN=<Var name="example.teleport.com:443" />
-   $ TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"
-   ```
-
-   Otherwise, get the version of your Teleport cluster:
-
-   ```code
-   $ TELEPORT_DOMAIN=<Var name="example.teleport.com:443" />
-   $ TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/ping | jq -r '.server_version')"
-   ```
-
-1. Install Teleport on your Linux server:
-
-   ```code
-   $ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION} <Var name="edition" />
-   ```
-
-   The installation script detects the package manager on your Linux server and
-   uses it to install Teleport binaries. To customize your installation, learn
-   about the Teleport package repositories in the [installation
-   guide](../installation.mdx#linux).
diff --git a/docs/pages/includes/install-tsh.mdx b/docs/pages/includes/install-tsh.mdx
index 977fc912414b1..3a0b1087af6fc 100644
--- a/docs/pages/includes/install-tsh.mdx
+++ b/docs/pages/includes/install-tsh.mdx
@@ -1,36 +1,37 @@
 <Tabs>
   <TabItem label="Mac">
-    Download the signed macOS .pkg installer for Teleport including `tsh`. In Finder double-click the `pkg` file to install it:
+
+    Download the signed macOS .pkg installer for Teleport, which includes `tsh`.
+    In Finder double-click the `pkg` file to begin installation:
 
     ```code
     $ curl -O https://cdn.teleport.dev/teleport-(=teleport.version=).pkg
     ```
 
-  </TabItem>
-
-  <TabItem label="Mac - Homebrew">
     <Admonition type="danger">
       Using Homebrew to install Teleport is not supported. The Teleport package in
       Homebrew is not maintained by Teleport and we can't guarantee its reliability or
       security.
-
-      We recommend the use of our [own Teleport packages](https://goteleport.com/download?os=mac)
-      for any installations on macOS.
     </Admonition>
+
   </TabItem>
 
   <TabItem label="Windows - Powershell">
+
     ```code
     $ curl.exe -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
-    # Unzip the archive and move `tsh.exe` to your %PATH%
+    # Unzip the archive and move tsh.exe to your %PATH%
     # NOTE: Do not place tsh.exe in the System32 directory, as this can cause issues when using WinSCP.
     # Use %SystemRoot% (C:\Windows) or %USERPROFILE% (C:\Users\<username>) instead.
     ```
+
   </TabItem>
 
   <TabItem label="Linux">
-    `tsh` is included with all of the Teleport binaries in Linux installations.
-    For more options (including RPM/DEB packages and downloads for i386/ARM/ARM64) please see our [installation page](../installation.mdx).
+
+    All of the Teleport binaries in Linux installations include `tsh`. For more
+    options (including RPM/DEB packages and downloads for i386/ARM/ARM64) see
+    our [installation page](../installation/installation.mdx).
 
     ```code
     $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
diff --git a/docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx b/docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx
index d8242619da2e1..e2335ace682af 100644
--- a/docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx
+++ b/docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx
@@ -1,13 +1,10 @@
-Set up the Teleport Helm repository.
-
-Allow Helm to install charts that are hosted in the Teleport Helm repository:
+Configure Helm to fetch Teleport charts from the Teleport Helm repository:
 
 ```code
 $ helm repo add teleport (=teleport.helm_repo_url=)
 ```
 
-Update the cache of charts from the remote repository so you can upgrade to all
-available releases:
+Refresh the local Helm cache by fetching the latest charts:
 
 ```code
 $ helm repo update
diff --git a/docs/pages/includes/machine-id/common-output-config.yaml b/docs/pages/includes/machine-id/common-output-config.yaml
index 37a2f0ec37b8e..df32295a9afcf 100644
--- a/docs/pages/includes/machine-id/common-output-config.yaml
+++ b/docs/pages/includes/machine-id/common-output-config.yaml
@@ -25,3 +25,8 @@ roles:
 # on the next invocation, but don't want long-lived workload certificates on-disk.
 credential_ttl: 30m
 renewal_interval: 15m
+
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
diff --git a/docs/pages/includes/machine-id/configure-outputs.mdx b/docs/pages/includes/machine-id/configure-outputs.mdx
deleted file mode 100644
index b002290094ddc..0000000000000
--- a/docs/pages/includes/machine-id/configure-outputs.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-You have now prepared the base configuration for `tbot`. At this point, it
-identifies itself to the Teleport cluster and renews its own credentials but
-does not output any credentials for other applications to use.
-
-Follow one of the [access
-guides](../../enroll-resources/machine-id/access-guides/access-guides.mdx) to
-configure an output that meets your access needs.
diff --git a/docs/pages/includes/machine-id/configure-services.mdx b/docs/pages/includes/machine-id/configure-services.mdx
new file mode 100644
index 0000000000000..c2b9c56d6b487
--- /dev/null
+++ b/docs/pages/includes/machine-id/configure-services.mdx
@@ -0,0 +1,7 @@
+You have now prepared the base configuration for `tbot`. At this point, it
+identifies itself to the Teleport cluster and renews its own credentials but
+does not output any credentials for other applications to use.
+
+Follow one of the [access
+guides](../../machine-workload-identity/access-guides/access-guides.mdx) to
+configure a service that meets your access needs.
diff --git a/docs/pages/includes/machine-id/daemon.mdx b/docs/pages/includes/machine-id/daemon.mdx
index 424d3a9f0e544..909c039411b97 100644
--- a/docs/pages/includes/machine-id/daemon.mdx
+++ b/docs/pages/includes/machine-id/daemon.mdx
@@ -1,13 +1,35 @@
 By default, `tbot` will run in daemon mode. However, this must then be
 configured as a service within the service manager on the Linux host. The
 service manager will start `tbot` on boot and ensure it is restarted if it
-fails. For this guide, systemd will be demonstrated but `tbot` should be
+fails.
+
+**If tbot was installed using the Teleport install script or `teleport-update`
+command, the `tbot` systemd service is automatically created for you.**
+
+After `tbot.yaml` is created, enable and start the service::
+
+```code
+$ sudo systemctl enable tbot --now
+```
+
+Check the service has started successfully:
+
+```code
+$ sudo systemctl status tbot
+```
+
+Service properties like `User` and `Group` may be configured using `systemctl edit tbot`.`
+
+**If tbot was installed manually, service configuration will need to be
+performed manually as well.**
+
+For this guide, systemd will be demonstrated but `tbot` should be
 compatible with all common alternatives.
 
 Use `tbot install systemd` to generate a systemd service file:
 
 ```code
-$ tbot install systemd \
+$ sudo tbot install systemd \
    --write \
    --config /etc/tbot.yaml \
    --user teleport \
@@ -32,12 +54,11 @@ service:
 
 ```code
 $ sudo systemctl daemon-reload
-$ sudo systemctl enable tbot
-$ sudo systemctl start tbot
+$ sudo systemctl enable tbot --now
 ```
 
 Check the service has started successfully:
 
 ```code
 $ sudo systemctl status tbot
-```
\ No newline at end of file
+```
diff --git a/docs/pages/includes/machine-id/machine-id-init-bot-data.mdx b/docs/pages/includes/machine-id/machine-id-init-bot-data.mdx
index 37a6fd86222c1..43086e2eabba5 100644
--- a/docs/pages/includes/machine-id/machine-id-init-bot-data.mdx
+++ b/docs/pages/includes/machine-id/machine-id-init-bot-data.mdx
@@ -1,4 +1,5 @@
-Create the bot data directory and grant permissions to access it to the Linux user (in our example, `teleport`) which `tbot` will run as.
+Create the bot data directory and grant permissions to access it to the Linux
+user (in our example, `teleport`) which `tbot` will run as.
 
 ```code
 # Make the bot directory and assign ownership to teleport user
diff --git a/docs/pages/includes/machine-id/mongodb/mongodb.go b/docs/pages/includes/machine-id/mongodb/mongodb.go
index 9712712fffcaf..2d4c58422dc84 100644
--- a/docs/pages/includes/machine-id/mongodb/mongodb.go
+++ b/docs/pages/includes/machine-id/mongodb/mongodb.go
@@ -1,5 +1,5 @@
 // This example program demonstrates how to connect to a MongoDB database
-// using certificates issued by Teleport Machine ID.
+// using certificates issued by Teleport Machine & Workload Identity.
 
 package main
 
diff --git a/docs/pages/includes/machine-id/plugin-prerequisites.mdx b/docs/pages/includes/machine-id/plugin-prerequisites.mdx
index 22d43626da035..fb1139657b9ea 100644
--- a/docs/pages/includes/machine-id/plugin-prerequisites.mdx
+++ b/docs/pages/includes/machine-id/plugin-prerequisites.mdx
@@ -1,5 +1,5 @@
-**Recommended:** Configure Machine ID to provide short-lived Teleport
-credentials to the plugin. Before following this guide, follow a Machine ID
-[deployment guide](../../enroll-resources/machine-id/deployment/deployment.mdx)
+**Recommended:** Configure Machine & Workload Identity to provide short-lived
+Teleport credentials to the plugin. Before following this guide, follow a
+Machine & Workload Identity [deployment guide](../../machine-workload-identity/deployment/deployment.mdx)
 to run the `tbot` binary on your infrastructure.
 
diff --git a/docs/pages/includes/machine-id/postgresql/postgresql.go b/docs/pages/includes/machine-id/postgresql/postgresql.go
index bdb9c3f0d6019..6f9252cd71967 100644
--- a/docs/pages/includes/machine-id/postgresql/postgresql.go
+++ b/docs/pages/includes/machine-id/postgresql/postgresql.go
@@ -1,5 +1,5 @@
 // This example program demonstrates how to connect to a Postgres database
-// using certificates issued by Teleport Machine ID.
+// using certificates issued by Teleport Machine & Workload Identity.
 
 package main
 
diff --git a/docs/pages/includes/mcp-access/configure-app-service.mdx b/docs/pages/includes/mcp-access/configure-app-service.mdx
new file mode 100644
index 0000000000000..2d24da8c22180
--- /dev/null
+++ b/docs/pages/includes/mcp-access/configure-app-service.mdx
@@ -0,0 +1,75 @@
+{{ extraAppScheme="" }}
+
+You can update an existing Application Service or create a new one to enable the
+the MCP server.
+
+<Tabs>
+
+<TabItem label="Update an existing service">
+
+If you already have an existing Application Service running, you can add a MCP
+server in your YAML configuration:
+```yaml
+app_service:
+  enabled: true
+  apps:
+  - name: "everything"
+    uri: "mcp+{{extraAppScheme}}<Var name="MCP endpoint" />"
+    labels:
+      env: dev
+    description:
+```
+
+</TabItem>
+<TabItem label="Create a new service">
+
+{/* lint ignore heading-increment remark-lint */}
+#### Get a Join Token
+
+(!docs/pages/includes/tctl-token.mdx serviceName="Application" tokenType="app" tokenFile="/tmp/token"!)
+
+(!docs/pages/includes/database-access/alternative-methods-join.mdx!)
+
+#### Install the Teleport Application Service
+
+Install Teleport on the host where you will run the Teleport Application Service:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+#### Configure the Teleport Application Service
+
+On the host where you will run the Teleport Application Service, create a file
+at `/etc/teleport.yaml` with the following content:
+```yaml
+version: v3
+teleport:
+  join_params:
+    token_name: "/tmp/token"
+    method: token
+  proxy_server: "<Var name="teleport.example.com:443" />"
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+app_service:
+  enabled: true
+  apps:
+  - name: "everything"
+    uri: "mcp+{{extraAppScheme}}<Var name="MCP endpoint" />"
+    labels:
+      env: dev
+    description:
+```
+
+Replace <Var name="teleport.example.com:443" /> with the host and port of your Teleport Proxy
+Service or Teleport Cloud tenant, and replace the MCP details with the MCP
+server you desire to run.
+
+#### Start the Teleport Application Service
+
+(!docs/pages/includes/start-teleport.mdx service="the Application Service"!)
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/includes/mcp-access/configure-user-rbac.mdx b/docs/pages/includes/mcp-access/configure-user-rbac.mdx
new file mode 100644
index 0000000000000..cad558334e185
--- /dev/null
+++ b/docs/pages/includes/mcp-access/configure-user-rbac.mdx
@@ -0,0 +1,43 @@
+In this step, you will grant your Teleport user access to all MCP servers and
+their MCP tools.
+
+<Tabs>
+
+<TabItem label="Configure an existing user">
+
+If you have an existing Teleport user, assign the preset role `mcp-user` to
+that user. The `mcp-user` role allows access to all MCP servers and their tools:
+```yaml
+kind: role
+version: v8
+metadata:
+  description: Access to MCP servers
+  labels:
+    teleport.internal/resource-type: preset
+  name: mcp-user
+spec:
+  allow:
+    app_labels:
+      'teleport.internal/app-sub-kind': 'mcp'
+    mcp:
+      tools:
+      - '*'
+```
+
+Alternatively, add the above allow permissions to an existing Teleport role.
+
+</TabItem>
+
+<TabItem label="Create a new user">
+
+Create a new local user called <Var name="my_user" /> with MCP access:
+
+```code
+$ tctl users add <Var name="my_user" /> --roles=mcp-user
+```
+
+</TabItem>
+</Tabs>
+
+
+(!docs/pages/includes/create-role-using-web.mdx!)
diff --git a/docs/pages/includes/mcp-access/integration-intro.mdx b/docs/pages/includes/mcp-access/integration-intro.mdx
new file mode 100644
index 0000000000000..29b94752baa7b
--- /dev/null
+++ b/docs/pages/includes/mcp-access/integration-intro.mdx
@@ -0,0 +1,7 @@
+Teleport can provide secure access to MCP servers via Teleport Application
+Service.
+
+In this guide, you will:
+1. Configure your {{ serviceName }} service for access by the MCP server.
+1. Run the {{ serviceName }} MCP Server.
+1. Enroll the MCP server into your Teleport cluster and connect to it.
diff --git a/docs/pages/includes/mcp-access/integration-limit-tools.mdx b/docs/pages/includes/mcp-access/integration-limit-tools.mdx
new file mode 100644
index 0000000000000..a6724a6a7a0ce
--- /dev/null
+++ b/docs/pages/includes/mcp-access/integration-limit-tools.mdx
@@ -0,0 +1,5 @@
+To grant access to the MCP server and all its tools, assign the preset
+`mcp-user` role to your Teleport user.
+
+Optionally, you can limit which MCP tools the user can access by adjusting the
+`mcp.tools` list in their role. For example:
\ No newline at end of file
diff --git a/docs/pages/includes/mcp-access/integration-teleport-app-rewrite.mdx b/docs/pages/includes/mcp-access/integration-teleport-app-rewrite.mdx
new file mode 100644
index 0000000000000..1ca5a65e82a06
--- /dev/null
+++ b/docs/pages/includes/mcp-access/integration-teleport-app-rewrite.mdx
@@ -0,0 +1,83 @@
+You can register an MCP application in Teleport by defining it in your Teleport
+Application Service configuration, or by using dynamic registration with `tctl`
+or Terraform:
+
+<Tabs>
+<TabItem label="Static configuration">
+Replace <Var name="MCP_HOST"/> with the host running the {{serviceName}} MCP server:
+```yaml
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "{{service}}-mcp"
+    uri: "mcp+http://<Var name="MCP_HOST"/>:{{port}}/mcp"
+    labels:
+      env: dev
+      service: {{service}}
+    rewrite:
+      headers:
+      - "{{headerName}}: {{headerValue}}"
+```
+
+Restart the Application Service.
+</TabItem>
+
+<TabItem label="tctl">
+Create an `app` resource definition file named `app-{{service}}-mcp.yaml`. Replace
+<Var name="MCP_HOST" /> with the host running the {{serviceName}} MCP server:
+```yaml
+# app-{{service}}-mcp.yaml
+kind: app
+version: v3
+metadata:
+  name: {{service}}-mcp
+  labels:
+    env: dev
+    service: {{service}}
+  rewrite:
+    headers:
+    - name: "{{headerName}}"
+      value: "{{headerValue}}"
+spec:
+  uri: "mcp+http://<Var name="MCP_HOST" />:{{port}}/mcp"
+```
+
+Create the `app` resource with:
+```code
+$ tctl create -f app-{{service}}-app.yaml
+```
+</TabItem>
+
+<TabItem label="Terraform">
+Create a `teleport_app` resource in terraform. Replace <Var name="MCP_HOST" />
+with the host running the {{serviceName}} MCP server:
+```hcl
+resource "teleport_app" "grafana" {
+  version = "v3"
+  metadata = {
+    name = "grafana"
+    labels = {
+      "teleport.dev/origin" = "dynamic"
+      "env"                 = "dev"
+      "service"             = "{{service}}"
+    }
+  }
+
+  spec = {
+    uri = "mcp+http://<Var name="MCP_HOST" />:{{port}}/mcp"
+    rewrite = {
+      headers = [{
+        name  = "{{headerName}}"
+        value = "{{headerValue}}"
+      }]
+    }
+  }
+}
+```
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+
+</Tabs>
\ No newline at end of file
diff --git a/docs/pages/includes/mcp-access/integration-teleport-app.mdx b/docs/pages/includes/mcp-access/integration-teleport-app.mdx
new file mode 100644
index 0000000000000..25fcd4000cf5a
--- /dev/null
+++ b/docs/pages/includes/mcp-access/integration-teleport-app.mdx
@@ -0,0 +1,70 @@
+You can register an MCP application in Teleport by defining it in your Teleport
+Application Service configuration, or by using dynamic registration with `tctl`
+or Terraform:
+
+<Tabs>
+<TabItem label="Static configuration">
+Replace <Var name="MCP_HOST"/> with the host running the {{serviceName}} MCP server:
+```yaml
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "{{service}}-mcp"
+    uri: "mcp+http://<Var name="MCP_HOST"/>:{{port}}/mcp"
+    labels:
+      env: dev
+      service: {{service}}
+```
+
+Restart the Application Service.
+</TabItem>
+
+<TabItem label="tctl">
+Create an `app` resource definition file named `app-{{service}}-mcp.yaml`. Replace
+<Var name="MCP_HOST" /> with the host running the {{serviceName}} MCP server:
+```yaml
+# app-{{service}}-mcp.yaml
+kind: app
+version: v3
+metadata:
+  name: {{service}}-mcp
+  labels:
+    env: dev
+    service: {{service}}
+spec:
+  uri: "mcp+http://<Var name="MCP_HOST" />:{{port}}/mcp"
+```
+
+Create the `app` resource with:
+```code
+$ tctl create -f app-{{service}}-app.yaml
+```
+</TabItem>
+
+<TabItem label="Terraform">
+Create a `teleport_app` resource in terraform. Replace <Var name="MCP_HOST" />
+with the host running the {{serviceName}} MCP server:
+```hcl
+resource "teleport_app" "grafana" {
+  version = "v3"
+  metadata = {
+    name = "grafana"
+    labels = {
+      "teleport.dev/origin" = "dynamic"
+      "env"                 = "dev"
+      "service"             = "{{service}}"
+    }
+  }
+
+  spec = {
+    uri = "mcp+http://<Var name="MCP_HOST" />:{{port}}/mcp"
+  }
+}
+```
+Apply the configuration:
+```code
+$ terraform apply
+```
+</TabItem>
+
+</Tabs>
diff --git a/docs/pages/includes/mcp-access/integration-tsh.mdx b/docs/pages/includes/mcp-access/integration-tsh.mdx
new file mode 100644
index 0000000000000..74f4217c18ad4
--- /dev/null
+++ b/docs/pages/includes/mcp-access/integration-tsh.mdx
@@ -0,0 +1,10 @@
+
+Now wait until the application appears in `tsh mcp ls`, then configure your MCP
+clients to access the MCP server, for example:
+```code
+$ tsh mcp config {{service}}-mcp --client-config claude
+```
+
+After configuring your MCP client, you will find {{serviceName}}-related tools from
+`teleport-mcp-{{service}}-mcp`. You can now use these tools to interactive with
+{{serviceName}} via Teleport in your MCP clients:
diff --git a/docs/pages/includes/mcp-access/troubleshoot-tsh-binary-enoent.mdx b/docs/pages/includes/mcp-access/troubleshoot-tsh-binary-enoent.mdx
new file mode 100644
index 0000000000000..58794acb930fc
--- /dev/null
+++ b/docs/pages/includes/mcp-access/troubleshoot-tsh-binary-enoent.mdx
@@ -0,0 +1,33 @@
+When starting your MCP client, you might see an error such as `spawn <tsh-path>
+ENOENT` or `command not found`:
+
+![ENOENT error](../../../img/mcp-access/troubleshoot-tsh-binary-enoent.png)
+
+This error indicates the path to the `tsh` binary is misconfigured in the
+client’s settings. To fix it, re-run the `tsh mcp config` command to update the
+path, or manually correct it in the client’s configuration file. See [connect
+MCP clients](../../connect-your-client/model-context-protocol/mcp-access.mdx)
+for more details.
+
+This issue can also occur due to a bug from the managed update feature, which
+has been fixed in version 18.2.3. If your Teleport cluster has managed update
+enabled for tools, check your `tsh` version by:
+```code
+$ tsh version
+Teleport v18.2.3 git:v18.2.3-0-xxxxxxxx go1.24.7
+Proxy version: 18.2.0
+Proxy: teleport.example.com:443
+Re-executed from version: 18.2.0
+```
+
+The first line shows the version of the `tsh` binary from the managed update,
+and the last line shows the version from your original installation. Both
+versions must be at least `18.2.3` to fully resolve this issue.
+
+If the version shown on the first line is outdated, contact your Teleport
+administrator to raise the version for tools update. If the version shown in the
+"Re-executed from version" is outdated, find the `tsh` binary from your original
+installation (e.g. `which tsh`), uninstall it and install a newer release.
+
+Once `tsh` has been updated, re-run the `tsh mcp config` commands to reconfigure
+your MCP client.
diff --git a/docs/pages/includes/mcp-access/tsh-mcp-config.mdx b/docs/pages/includes/mcp-access/tsh-mcp-config.mdx
new file mode 100644
index 0000000000000..8f7e99a74decd
--- /dev/null
+++ b/docs/pages/includes/mcp-access/tsh-mcp-config.mdx
@@ -0,0 +1,28 @@
+{{ appName="everything" }}
+
+To show configurations for your MCP client to connect:
+
+```code
+$ tsh mcp config {{ appName }}
+Found MCP servers:
+everything
+
+Here is a sample JSON configuration for launching Teleport MCP servers:
+{
+  "mcpServers": {
+    "teleport-mcp-{{ appName }}": {
+      "command": "/path/to/tsh",
+      "args": ["mcp", "connect", "{{ appName }}"]
+    }
+  }
+}
+
+Tip: You can use this command to update your MCP servers configuration file automatically.
+- For Claude Desktop, use --client-config=claude to update the default configuration.
+- For Cursor, use --client-config=cursor to update the global MCP servers configuration.
+In addition, you can use --client-config=<path> to specify a config file location that is compatible with the "mcpServers" mapping.
+For example, you can update a Cursor project using --client-config=<path-to-project>/.cursor/mcp.json
+```
+
+Once your MCP client configuration is updated, you will see
+`teleport-mcp-{{ appName }}` MCP server with allowed tools appear in your MCP client.
diff --git a/docs/pages/includes/metrics.mdx b/docs/pages/includes/metrics.mdx
index d3ff005ac946b..4b9ed5e3c2bca 100644
--- a/docs/pages/includes/metrics.mdx
+++ b/docs/pages/includes/metrics.mdx
@@ -59,7 +59,7 @@
 | `teleport_audit_parquetlog_last_processed_timestamp`     | gauge     | Teleport Audit Log  | Number of last processing time in Parquet-format audit log.                                        |
 | `teleport_audit_parquetlog_age_oldest_processed_message` | gauge     | Teleport Audit Log  | Number of age of oldest event in Parquet-format audit log.                                         |
 | `teleport_audit_parquetlog_errors_from_collect_count`    | counter   | Teleport Audit Log  | Number of collect failures in Parquet-format audit log.                                            |
-| `teleport_connected_resources`                           | gauge     | Teleport Auth       | Number and type of resources connected via keepalives.                                            x |
+| `teleport_connected_resources`                           | gauge     | Teleport Auth       | Number and type of resources connected via keepalives.                                             |
 | `teleport_postgres_events_backend_write_requests`        | counter   | Postgres (Events)   | Number of write requests to postgres events, labeled with the request `status` (success or failure). |
 | `teleport_postgres_events_backend_batch_read_requests`   | counter   | Postgres (Events)   | Number of batch read requests to postgres events, labeled with the request `status` (success or failure). |
 | `teleport_postgres_events_backend_batch_delete_requests` | counter   | Postgres (Events)   | Number of batch delete requests to postgres events, labeled with the request `status` (success or failure). |
@@ -70,10 +70,39 @@
 | `teleport_registered_servers_by_install_methods`         | gauge     | Teleport Auth       | The number of Teleport services that are connected to an Auth Service instance grouped by install methods. |
 | `teleport_roles_total`                                   | gauge     | Teleport Auth       | The number of roles that exist in the cluster.                                                     |
 | `teleport_migrations`                                    | gauge     | Teleport Auth       | Tracks for each migration if it is active (1) or not (0).                                          |
+| `teleport_bot_instances`                                 | gauge     | Teleport Auth       | The number of bot instances across the entire cluster grouped by version.                          |
 | `user_login_total`                                       | counter   | Teleport Auth       | Number of user logins.                                                                             |
 | `watcher_event_sizes`                                    | histogram | cache               | Overall size of events emitted.                                                                    |
 | `watcher_events`                                         | histogram | cache               | Per resource size of events emitted.                                                               |
 
+## Session recording summarizer
+
+These metrics are exported by the Auth Service. They are all labeled with an
+`inference_model_name` label, which is the `metadata.name` field of
+corresponding `inference_model` resource.
+
+### General metrics 
+
+These metrics apply to all inference providers.
+
+| Name                                             | Type    | Component     | Description                                               |
+| ------------------------------------------------ | ------- | ------------- | --------------------------------------------------------- |
+| `teleport_summarizer_summarizations_total`       | counter | Teleport Auth | Total number of summarization jobs started                |
+| `teleport_summarizer_summarization_errors`       | counter | Teleport Auth | Number of failed summarization jobs                       |
+| `teleport_summarizer_summarization_jobs_pending` | gauge   | Teleport Auth | Number of summarization jobs currently awaiting execution |
+| `teleport_summarizer_summarization_jobs_running` | gauge   | Teleport Auth | Number of summarization jobs currently being executed     |
+
+### OpenAI-specific metrics
+
+These metrics apply to jobs executed using OpenAI inference provider, including
+OpenAI-compatible proxies.
+
+| Name | Type | Component | Description |
+| --------------------------------------------------- | ------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `teleport_summarizer_openai_api_requests`           | counter | Teleport Auth | Total number of OpenAI API requests                                                                                              |
+| `teleport_summarizer_openai_api_errors`             | counter | Teleport Auth | Number of errors returned by the OpenAI API. Additionally labeled with `api_error_code` which denotes the OpenAI API error code. |
+| `teleport_summarizer_openai_api_requests_in_flight` | gauge   | Teleport Auth | Number of OpenAI requests currently awaiting response                                                                            |
+
 ## Enhanced Session Recording / BPF
 
 | Name                      | Type    | Component | Description                    |
@@ -221,6 +250,14 @@ The following table identifies all metrics available for incoming connections.
 | `teleport_cache_stale_events` | counter | Teleport | Number of stale events received by a Teleport service cache. A high percentage of stale events can indicate a degraded backend. |
 | `tx` | counter | Teleport | Number of bytes transmitted during an SSH connection. |
 
+## Teleport Health Checks
+
+| Name                                         | Type  | Component             | Description                                     |
+|----------------------------------------------|-------|-----------------------|-------------------------------------------------|
+| `teleport_resources_health_status_healthy`   | gauge | Teleport Health Check | Number of healthy resources.                    |
+| `teleport_resources_health_status_unhealthy` | gauge | Teleport Health Check | Number of unhealthy resources.                  |
+| `teleport_resources_health_status_unknown`   | gauge | Teleport Health Check | Number of resources in an unknown health state. |
+
 ## Go runtime metrics
 
 These metrics are surfaced by the Go runtime and are not specific to Teleport.
diff --git a/docs/pages/includes/node-logins.mdx b/docs/pages/includes/node-logins.mdx
index 097fe9d35c4f6..73917a18357b5 100644
--- a/docs/pages/includes/node-logins.mdx
+++ b/docs/pages/includes/node-logins.mdx
@@ -1,14 +1,16 @@
-When Teleport's Auth Service receives a request to list Teleport Nodes (e.g., to
-display Nodes in the Web UI or via `tsh ls`), it only returns the Nodes that the
-current user is authorized to view.
+When the Teleport Auth Service receives a request to list Teleport-connected
+resources (e.g., to display resources in the Web UI or via `tsh ls`), it only
+returns the resources that the current user is authorized to view.
 
-For each Node in the user's Teleport cluster, the Auth Service applies the
-following checks in order and, if one check fails, hides the Node from the user:
+For each resource in the user's Teleport cluster, the Auth Service applies the
+following checks in order and, if one check fails, hides the resource from the
+user:
 
-- None of the user's roles contain a `deny` rule that matches the Node's labels.
+- None of the user's roles contain a `deny` rule that matches the resource's
+  labels.
 - At least one of the user's roles contains an `allow` rule that matches the
-  Node's labels.
+  resource's labels.
 
-If you are not seeing Nodes when expected, make sure that your user's roles
-include the appropriate `allow` and `deny` rules as documented in the
-[Access Controls Reference](../reference/access-controls/roles.mdx).
+If you are not seeing resources when expected, make sure that your user's roles
+include the appropriate `allow` and `deny` rules as documented in the [Access
+Controls Reference](../reference/access-controls/roles.mdx).
diff --git a/docs/pages/includes/okta-create-saml-connector.mdx b/docs/pages/includes/okta-create-saml-connector.mdx
deleted file mode 100644
index c7d81d1dcb489..0000000000000
--- a/docs/pages/includes/okta-create-saml-connector.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
-### Create Okta SAML 2.0 App
-
-From the main navigation menu, select **Applications** -> **Applications**, and click
-**Create App Integration**. Select SAML 2.0, then click **Next**.
-
-![Create APP](../../img/sso/okta/okta-saml-1.png)
-
-On the next screen (**General Settings**), provide a name and optional logo for
-your new app, then click **Next**. This will bring you to the **Configure SAML** section.
-
-### Configure the App
-
-Provide the following values to their respective fields:
-
-#### General
-
-- Single sign on URL: `https://<cluster-url>:<port>/v1/webapi/saml/acs/okta`
-- Audience URI (SP Entity ID): <nobr>`https://<cluster-url>:<port>/v1/webapi/saml/acs/okta`</nobr>
-- Name ID format `EmailAddress`
-- Application username `Okta username`
-
-Replace `<cluster-url>` with your Teleport Proxy Service address or Enterprise
-Cloud tenant (e.g. `mytenant.teleport.sh`). Replace `<port>` with your Proxy
-Service listening port (`443` by default).
-
-#### Attribute Statements
-
-- Name: `username`  | Name format: `Unspecified` | Value: `user.login`
-
-#### Group Attribute Statements
-
-We will map our Okta groups to SAML attribute statements (special signed metadata
-exposed via a SAML XML response), so that Teleport can discover a user's group
-membership and assign matching roles.
-
-- Name: `groups` | Name format: `Unspecified`
-- Filter: `Matches regex` |  `.*`
-
-The configuration page should now look like this:
-
-![Configure APP](../../img/sso/okta/setup-redirection.png)
-
-<Admonition type="warning" >
-The "Matches regex" filter requires the literal string `.*` in order to match all
-content from the group attribute statement.
-</Admonition>
-
-<Admonition type="tip">
-Notice that we have set "NameID" to the email format and mapped the groups with
-a wildcard regex in the Group Attribute statements. We have also set the "Audience"
-and SSO URLs to the same value. This is so Teleport can read and use Okta users'
-email addresses to create their usernames in Teleport, instead of relying on additional
-name fields.
-</Admonition>
-
-Once you've filled the required fields, click **Next**, then finish the app creation wizard.
-
-### Group assignment
-
-From the **Assignments** tab of the new application page, click **Assign**.  Assign the user groups
-which can access to the app. Users being members of those groups will have the SSO access to
-Teleport once the Auth Connector is configured.
-
-![Configure APP](../../img/sso/okta/okta-saml-3.1.png)
diff --git a/docs/pages/includes/plugins/enroll.mdx b/docs/pages/includes/plugins/enroll.mdx
index 0a4e8e15b9eab..87619e05e5078 100644
--- a/docs/pages/includes/plugins/enroll.mdx
+++ b/docs/pages/includes/plugins/enroll.mdx
@@ -2,13 +2,11 @@
 In Teleport Enterprise Cloud, Teleport manages {{ name }} for you, and you can
 enroll {{ name }} from the Teleport Web UI.
 
-Visit the Teleport Web UI and on the left sidebar, click **Access** followed
-by **Integrations**. Then click **Enroll New Integration** to visit the
-"Enroll New Integration" page:
+Visit the Teleport Web UI and on the left sidebar, click **Add New** followed
+by **Integration**:
 
 ![Enroll an Access Request plugin](../../../img/enterprise/plugins/enroll.png)
 
 On the "Select Integration Type" menu, click the tile for your integration. You
 will see a page with instructions to set up the integration, as well as a form
 that you can use to configure the integration.
-
diff --git a/docs/pages/includes/plugins/finish-event-handler-config.mdx b/docs/pages/includes/plugins/finish-event-handler-config.mdx
index 795ba52253461..be6edf5dc1e5f 100644
--- a/docs/pages/includes/plugins/finish-event-handler-config.mdx
+++ b/docs/pages/includes/plugins/finish-event-handler-config.mdx
@@ -8,10 +8,9 @@ the Fluentd event handler. This file includes setting similar to the following:
 storage = "./storage"
 timeout = "10s"
 batch = 20
-namespace = "default"
 # The window size configures the duration of the time window for the event handler
 # to request events from Teleport. By default, this is set to 24 hours.
-# Reduce the window size if the events backend cannot manage the event volume 
+# Reduce the window size if the events backend cannot manage the event volume
 # for the default window size.
 # The window size should be specified as a duration string, parsed by Go's time.ParseDuration.
 window-size = "24h"
@@ -20,16 +19,16 @@ window-size = "24h"
 # and new Access Requests, you can assign this field to
 # "user.login,access_request.create".
 types = ""
-# skip-event-types is a comma-separated list of types of events to skip. For
-# example, to forward all audit events except for new app deletion events, you
-# can include the following assignment:
-# skip-event-types = "app.delete"
-skip-event-types: []
-# skip-session-types is a comma-separated list of session event types to skip.
+# skip-event-types is a comma-separated list of audit log event types to skip.
+# For example, to forward all audit events except for new app deletion events,
+# you can include the following assignment:
+# skip-event-types = ["app.delete"]
+skip-event-types = []
+# skip-session-types is a comma-separated list of session recording event types to skip.
 # For example, to forward all session events except for malformed SQL packet
 # events, you can include the following assignment:
-# skip-session-types = "db.session.malformed_packet"
-skip-session-types: []
+# skip-session-types = ["db.session.malformed_packet"]
+skip-session-types = []
 
 [forward.fluentd]
 ca = "/home/bob/event-handler/ca.crt"
@@ -39,7 +38,7 @@ url = "https://fluentd.example.com:8888/test.log"
 session-url = "https://fluentd.example.com:8888/session"
 
 [teleport]
-addr = "example.teleport.com:443"
+addr = "teleport.example.com:443"
 identity = "identity"
 ```
 
@@ -56,10 +55,9 @@ eventHandler:
   storagePath: "./storage"
   timeout: "10s"
   batch: 20
-  namespace: "default"
   # The window size configures the duration of the time window for the event handler
   # to request events from Teleport. By default, this is set to 24 hours.
-  # Reduce the window size if the events backend cannot manage the event volume 
+  # Reduce the window size if the events backend cannot manage the event volume
   # for the default window size.
   # The window size should be specified as a duration string, parsed by Go's time.ParseDuration.
   windowSize: "24h"
@@ -68,18 +66,18 @@ eventHandler:
   # and new Access Requests, you can assign this field to:
   # ["user.login", "access_request.create"]
   types: []
-  # skipEventTypes lists types of events to skip. For example, to forward all
+  # skipEventTypes lists types of audit events to skip. For example, to forward all
   # audit events except for new app deletion events, you can assign this to:
   # ["app.delete"]
   skipEventTypes: []
-  # skipSessionTypes lists session event types to skip. For example, to forward
-  # all session events except for malformed SQL packet events, you can assign
-  # this to:
+  # skipSessionTypes lists types of session recording events to skip. For example,
+  # to forward all session events except for malformed SQL packet events,
+  # you can assign this to:
   # ["db.session.malformed_packet"]
   skipSessionTypes: []
 
 teleport:
-  address: "example.teleport.com:443"
+  address: "teleport.example.com:443"
   identitySecretName: teleport-event-handler-identity
   identitySecretPath: identity
 
@@ -98,4 +96,3 @@ persistentVolumeClaim:
 
 </TabItem>
 </Tabs>
-
diff --git a/docs/pages/includes/plugins/identity-export.mdx b/docs/pages/includes/plugins/identity-export.mdx
index 5c6ad9a57a602..a6d2d42c45788 100644
--- a/docs/pages/includes/plugins/identity-export.mdx
+++ b/docs/pages/includes/plugins/identity-export.mdx
@@ -25,9 +25,9 @@ Auth Service's gRPC endpoint.
 
   By default, `tctl auth sign` produces certificates with a relatively short
   lifetime. For production deployments, we suggest using [Machine
-  ID](../../enroll-resources/machine-id/introduction.mdx) to programmatically issue and renew
-  certificates for your plugin. See our Machine ID [getting started
-  guide](../../enroll-resources/machine-id/getting-started.mdx) to learn more.
+  & Workload Identity](../../machine-workload-identity/introduction.mdx) to programmatically issue and renew
+  certificates for your plugin. See our Machine & Workload Identity [getting started
+  guide](../../machine-workload-identity/getting-started.mdx) to learn more.
 
   Note that you cannot issue certificates that are valid longer than your existing credentials.
   For example, to issue certificates with a 1000-hour TTL, you must be logged in with a session that is
diff --git a/docs/pages/includes/plugins/install-access-request.mdx b/docs/pages/includes/plugins/install-access-request.mdx
index dc67e1abdc61c..accd634714fb4 100644
--- a/docs/pages/includes/plugins/install-access-request.mdx
+++ b/docs/pages/includes/plugins/install-access-request.mdx
@@ -29,7 +29,7 @@ Make sure the plugin is installed by running the following command:
 
 ```code
 $ docker run public.ecr.aws/gravitational/teleport-plugin-{{ name }}:(=teleport.plugin.version=) version
-teleport-{{ name }} v(=teleport.plugin.version=) git:teleport-{{ name }}-v(=teleport.plugin.version=)-(=teleport.git=) (=teleport.golang=)
+teleport-{{ name }} v(=teleport.plugin.version=) (=teleport.golang=)
 ```
 
 For a list of available tags, visit [Amazon ECR Public Gallery](https://gallery.ecr.aws/gravitational/teleport-plugin-{{ name }}).
diff --git a/docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx b/docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx
index d664c756d0d81..ce0ac8571b227 100644
--- a/docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx
+++ b/docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx
@@ -1,5 +1,5 @@
-With the role created, you now need to allow the Machine ID bot to produce
-credentials for this role.
+With the role created, you now need to allow the Machine & Workload Identity bot
+to produce credentials for this role.
 
 This can be done with `tctl`, replacing `my-bot` with the name of your bot:
 
diff --git a/docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx b/docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx
new file mode 100644
index 0000000000000..960257059df29
--- /dev/null
+++ b/docs/pages/includes/plugins/rbac-impersonate-machine-id.mdx
@@ -0,0 +1,10 @@
+If you haven't set up a Machine ID bot yet, refer to the
+[deployment guide](../../machine-workload-identity/deployment/deployment.mdx)
+to run the `tbot` binary on your infrastructure.
+
+Next, allow the Machine ID bot to generate credentials for the `access-plugin`
+role. You can do this using `tctl`, replacing `my-bot` with the name of your bot:
+
+```code
+$ tctl bots update my-bot --add-roles access-plugin
+```
diff --git a/docs/pages/includes/plugins/rbac-impersonate.mdx b/docs/pages/includes/plugins/rbac-impersonate.mdx
index c1cf00bcca4d9..b3284675f9f4f 100644
--- a/docs/pages/includes/plugins/rbac-impersonate.mdx
+++ b/docs/pages/includes/plugins/rbac-impersonate.mdx
@@ -7,11 +7,18 @@ If you are running a self-hosted Teleport Enterprise deployment and are using
 `tctl` from the Auth Service host, you will already have impersonation
 privileges.
 
-To grant your user impersonation privileges for `access-plugin`, define a role
-called `access-plugin-impersonator` by pasting the following YAML document into
-a file called `access-plugin-impersonator.yaml`:
+To grant your user impersonation privileges for `access-plugin`, define a user
+named `access-plugin` and a role named `access-plugin-impersonator` by adding
+the following YAML document into a file called `access-plugin-impersonator.yaml`:
 
 ```yaml
+kind: user
+metadata:
+  name: access-plugin
+spec:
+  roles: ['access-plugin']
+version: v2
+---
 kind: role
 version: v7
 metadata:
@@ -25,18 +32,18 @@ spec:
       - access-plugin
 ```
 
-Create the `access-plugin-impersonator` role: 
+Create the user and role:
 
 ```code
 $ tctl create -f access-plugin-impersonator.yaml
+user "access-plugin" has been created
+role "access-plugin-impersonator" has been created
 ```
 
 (!docs/pages/includes/create-role-using-web.mdx!)
 
-If you are providing identity files to the plugin with Machine ID, assign the
-`access-plugin` role to the Machine ID bot user. Otherwise, assign this role to
-the user you plan to use to generate credentials for the `access-plugin` role
-and user:
+Assign this role to the user you plan to use to generate credentials for the
+`access-plugin` role and user:
 
 (!docs/pages/includes/add-role-to-user.mdx role="access-plugin-impersonator"!)
 
diff --git a/docs/pages/includes/plugins/rbac-with-friendly-name.mdx b/docs/pages/includes/plugins/rbac-with-friendly-name.mdx
deleted file mode 100644
index b277ddd2887ad..0000000000000
--- a/docs/pages/includes/plugins/rbac-with-friendly-name.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
-Teleport's Access Request plugins authenticate to your Teleport cluster as a
-user with permissions to list and read Access Requests. This way, plugins can
-retrieve Access Requests from the Teleport Auth Service and present them to
-reviewers.
-
-Define a user and role called `access-plugin` by adding the following content to
-a file called `access-plugin.yaml`:
-
-```yaml
-kind: role
-version: v7
-metadata:
-  name: access-plugin
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list', 'read']
-      - resources: ['access_plugin_data']
-        verbs: ['update']
-
-      # Optional: Required to use access monitoring rules.
-      - resources: ['access_monitoring_rule']
-        verbs: ['list', 'read']
-
-      # Optional: In order to provide access list review reminders, permissions to list and read access lists
-      # are necessary. This is currently only supported for a subset of plugins.
-      - resources: ['access_list']
-        verbs: ['list', 'read']
-
-      # Optional: To display logins permitted by roles, the plugin also needs
-      # permission to read the role resource.
-      - resources: ['role']
-        verbs: ['read']
-      # Optional: To have the users traits apply when evaluating the roles,
-      # the plugin also needs permission to read users.
-      - resources: ['user']
-        verbs: ['read']
-
-    # Optional: To display user-friendly names in resource-based Access
-    # Requests instead of resource IDs, the plugin also needs permission
-    # to list the resources being requested. Include this along with the
-    # list-access-request-resources role definition.
-    review_requests:
-      preview_as_roles:
-        - list-access-request-resources
----
-kind: user
-metadata:
-  name: access-plugin
-spec:
-  roles: ['access-plugin']
-version: v2
----
-# Optional, for displaying friendly names of resources. Resource types and
-# labels can be further limited to only the resources that access can be
-# requested to.
-kind: role
-version: v7
-metadata:
-  name: list-access-request-resources
-spec:
-  allow:
-    rules:
-      - resources: ['node', 'app', 'db', 'kube_cluster']
-        verbs: ['list', 'read']
-    node_labels:
-      '*': '*'
-    kubernetes_labels:
-      '*': '*'
-    db_labels:
-      '*': '*'
-    app_labels:
-      '*': '*'
-    group_labels:
-      '*': '*'
-```
-
-Create the user and role:
-
-```code
-$ tctl create -f access-plugin.yaml
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
\ No newline at end of file
diff --git a/docs/pages/includes/plugins/tbot-identity.mdx b/docs/pages/includes/plugins/tbot-identity.mdx
index 0583f9bab5644..8f1ca5d44f6c0 100644
--- a/docs/pages/includes/plugins/tbot-identity.mdx
+++ b/docs/pages/includes/plugins/tbot-identity.mdx
@@ -15,7 +15,7 @@ If running `tbot` on a Linux server, use the `directory` output to write
 identity files to the `/opt/machine-id` directory:
 
 ```yaml
-outputs:
+services:
 - type: identity
   destination:
     type: directory
@@ -29,7 +29,7 @@ If running `tbot` on Kubernetes, write the identity file to Kubernetes secret
 instead:
 
 ```yaml
-outputs:
+services:
   - type: identity
     destination:
       type: kubernetes_secret
diff --git a/docs/pages/includes/policy/access-graph.mdx b/docs/pages/includes/policy/access-graph.mdx
index dd3d698e7d96f..21c01106aa396 100644
--- a/docs/pages/includes/policy/access-graph.mdx
+++ b/docs/pages/includes/policy/access-graph.mdx
@@ -2,4 +2,4 @@ Access Graph is a feature of the [Teleport Identity Security](https://goteleport
 Teleport Enterprise edition customers.
 
 To verify that Access Graph is set up correctly for your cluster, sign in to the Teleport Web UI, click the
-Policy sidebar button, and then the Browse menu item. Identities, resources, etc. should be listed.
+Identity Security sidebar button, and then the Browse menu item. Identities, resources, etc. should be listed.
diff --git a/docs/pages/includes/policy/identity-activity-center.mdx b/docs/pages/includes/policy/identity-activity-center.mdx
new file mode 100644
index 0000000000000..88a93b164c899
--- /dev/null
+++ b/docs/pages/includes/policy/identity-activity-center.mdx
@@ -0,0 +1,13 @@
+Teleport Identity Activity Center is a centralized data platform that enhances visibility, allows to
+search and analyze activity from both human and non-human identities across multiple data sources.
+
+It provides a rich visualization layer that maps access policies
+across services such as AWS, GitHub, Okta, and Teleport with the real-time
+activity from those identities.
+
+Built to assist security and operations teams, Identity Activity Center combines activities
+from the same identity across different platforms improving the correlation of identity-based
+events across platforms and expedites investigations. 
+Through an intelligent alerting engine that detects irregularities in audit logs, emphasizes
+odd behavior, and describes the access levels each identity has across corporate services,
+it offers contextual insights during incident response.
\ No newline at end of file
diff --git a/docs/pages/includes/preset-roles-table.mdx b/docs/pages/includes/preset-roles-table.mdx
index c3a2e1a9d829c..2fa271c192535 100644
--- a/docs/pages/includes/preset-roles-table.mdx
+++ b/docs/pages/includes/preset-roles-table.mdx
@@ -3,11 +3,13 @@
 | `access`| Allows access to cluster resources. |  |
 | `editor` | Allows editing of cluster configuration settings. |  |
 | `auditor`| Allows reading cluster events, audit logs, and playing back session records. |  |
+| `access-plugin` | Enables self-hosted Access Request plugin features. |  |
+| `list-access-request-resources` | Allows reading Access Request resources. |  |
 | `requester`| Allows a user to create Access Requests. | ✔ |
 | `reviewer`| Allows review of Access Requests. | ✔ |
 | `group-access`| Allows access to all user groups. | ✔ |
 | `device-admin`| Used to manage trusted devices. | ✔ |
 | `device-enroll`| Used to grant device enrollment powers to users. | ✔ |
 | `require-trusted-device`| Requires trusted device access to resources. | ✔ |
-| `terraform-provider`| Allows the Teleport Terraform provider to configure all of its supported Teleport resources. | ✔ |
+| `terraform-provider`| Allows the Teleport Terraform provider to configure all of its supported Teleport resources. |  |
 
diff --git a/docs/pages/includes/provision-token/bound-keypair-spec.mdx b/docs/pages/includes/provision-token/bound-keypair-spec.mdx
new file mode 100644
index 0000000000000..2e4d38b383d54
--- /dev/null
+++ b/docs/pages/includes/provision-token/bound-keypair-spec.mdx
@@ -0,0 +1,65 @@
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example-token
+spec:
+  roles: [Bot]
+  join_method: bound_keypair
+  bot_name: example
+
+  # Fields related to the bound keypair joining process.
+  bound_keypair:
+    # Fields related to the initial join attempt.
+    onboarding:
+      # If set to a public key in SSH authorized_keys format, the
+      # joining client must have the corresponding private key to join. This
+      # keypair may be created using `tbot keypair create`. If set,
+      # `registration_secret` and `must_register_before` are ignored.
+      initial_public_key: ""
+
+      # If set to a secret string value, a client may use this secret to perform
+      # the first join without pre-registering a public key in
+      # `initial_public_key`. If unset and no `initial_public_key` is provided,
+      # a random value will be generated automatically into
+      # `.status.bound_keypair.registration_secret`.
+      registration_secret: ""
+
+      # If set to an RFC 3339 timestamp, attempts to register via
+      # `registration_secret` will be denied once the timestamp has elapsed. If
+      # more time is needed, this field can be edited to extend the registration
+      # period.
+      must_register_before: ""
+
+    # Fields related to recovery after certificates have expired.
+    recovery:
+      # The maximum number of allowed recovery attempts. This value may
+      # be raised or lowered after creation to allow additional recovery
+      # attempts should the initial limit be exhausted. If `mode` is set to
+      # `standard`, recovery attempts will only be allowed if
+      # `.status.bound_keypair.recovery_count` is less than this limit. This
+      # limit is not enforced if `mode` is set to `relaxed` or `insecure`. This
+      # value must be at least 1 to allow for the initial join during
+      # onboarding, which counts as a recovery.
+      limit: 1
+
+      # The recovery rule enforcement mode. Valid values:
+      # - standard (or unset): all configured rules enforced. The recovery limit
+      #   and client join state are required and verified. This is the most
+      #   secure recovery mode.
+      # - relaxed: recovery limit is not enforced, but client join state is
+      #   still required. This effectively allows unlimited recovery attempts,
+      #   but client join state still helps mitigate stolen credentials.
+      # - insecure: neither the recovery limit nor client join state are
+      #   enforced. This allows any client with the private key to join freely.
+      #   This is less secure, but can be useful in certain situations, like in
+      #   otherwise unsupported CI/CD providers. This mode should be used with
+      #   care, and RBAC rules should be configured to heavily restrict which
+      #   resources this identity can access.
+      mode: "standard"
+
+    # If set to an RFC 3339 timestamp, once elapsed, a keypair rotation will be
+    # forced on next join if it has not already been rotated. The most recent
+    # rotation is recorded in `.status.bound_keypair.last_rotated_at`.
+    rotate_after: ""
+```
\ No newline at end of file
diff --git a/docs/pages/includes/provision-token/circleci-spec.mdx b/docs/pages/includes/provision-token/circleci-spec.mdx
index 2928a82a2c952..fc8b724441e41 100644
--- a/docs/pages/includes/provision-token/circleci-spec.mdx
+++ b/docs/pages/includes/provision-token/circleci-spec.mdx
@@ -12,8 +12,8 @@ spec:
     # allow specifies the rules by which the Auth Service determines if `tbot`
     # should be allowed to join.
     allow:
-      - # CircleCI context id. See the CircleCI MachineID guide to learn
-        # how to create a context and recover its ID.
+      - # CircleCI context id. See the CircleCI Machine & Workload Identity
+        # guide to learn how to create a context and recover its ID.
         context_id: 00000000-0000-0000-0000-000000000000
         # CircleCI projectID.
         project_id: 1234
diff --git a/docs/pages/includes/provision-token/env0-spec.mdx b/docs/pages/includes/provision-token/env0-spec.mdx
new file mode 100644
index 0000000000000..7175739a8f275
--- /dev/null
+++ b/docs/pages/includes/provision-token/env0-spec.mdx
@@ -0,0 +1,52 @@
+```yaml
+kind: token
+version: v2
+metadata:
+  name: env0
+spec:
+  roles: [Bot]
+  join_method: env0
+
+  # This must match a bot name, created either with `tctl bots add` or by
+  # creating a `bot` resource.
+  bot_name: env0
+
+  env0:
+    allow:
+      # organization_id and one of either project_name or project_id must be
+      # set. All other fields are optional and only checked if set.
+      # For more information on possible values, see Env0's documentation:
+      # https://docs.envzero.com/guides/integrations/oidc-integrations#format-of-the-openid-connect-id-token
+      - organization_id: "00000000-0000-0000-0000-000000000000"
+
+        # A unique project identifier. Either this field or `project_name` must
+        # be set.
+        project_id: "00000000-0000-0000-0000-000000000000"
+
+        # The project name. Either this field or `project_id` must be set.
+        project_name: ExampleProject
+
+        # A unique template identifier.
+        template_id: "00000000-0000-0000-0000-000000000000"
+
+        # The template name, optional.
+        template_name: ExampleTemplate
+
+        # The unique environment ID.
+        environment_id: "00000000-0000-0000-0000-000000000000"
+
+        # The environment name.
+        environment_name: ExampleEnvironment
+
+        # The workspace name.
+        workspace_name: WorkspaceName
+
+        # The deployment type, including "deploy", "destroy", "prPlan", "task"
+        deployment_type: ""
+
+        # The email address of the user that started the deployment.
+        deployer_email: ""
+
+        # A custom value provided via the `ENV0_OIDC_TAG` environment variable
+        env0_tag: ""
+```
diff --git a/docs/pages/includes/provision-token/github-spec.mdx b/docs/pages/includes/provision-token/github-spec.mdx
index 9e86dfa0694df..3a0a947f7d2c9 100644
--- a/docs/pages/includes/provision-token/github-spec.mdx
+++ b/docs/pages/includes/provision-token/github-spec.mdx
@@ -6,8 +6,8 @@ metadata:
   # token, this name should be specified.
   name: github-token
 spec:
-  # For Machine ID and GitHub joining, roles will always be "Bot" and
-  # join_method will always be "github".
+  # For Machine & Workload Identity via GitHub joining, roles will always be
+  # "Bot" and  join_method will always be "github".
   roles: [Bot]
   join_method: github
 
@@ -72,7 +72,7 @@ spec:
         # whether by committing or by directly despatching the workflow.
         actor: octocat
         # ref is the git ref that triggered the action run.
-        ref: ref/heads/main
+        ref: refs/heads/main
         # ref_type is the type of the git ref that triggered the action run.
         ref_type: branch
         # sub is a concatenated string of various attributes of the workflow 
diff --git a/docs/pages/includes/provision-token/kubernetes-oidc-spec.mdx b/docs/pages/includes/provision-token/kubernetes-oidc-spec.mdx
new file mode 100644
index 0000000000000..5adf61e19d539
--- /dev/null
+++ b/docs/pages/includes/provision-token/kubernetes-oidc-spec.mdx
@@ -0,0 +1,21 @@
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example
+spec:
+  roles: [App]
+  join_method: kubernetes
+  kubernetes:
+    # oidc configures the Auth Service to validate the JWT presented by `tbot`
+    # using the public keys published by the configured OIDC issuer.
+    type: oidc
+    oidc:
+      # Issuer must be a fully-qualified HTTPS URL and may vary between
+      # providers.
+      issuer: https://oidc.eks.us-west-2.amazonaws.com/id/my-cluster
+    # allow specifies the rules by which the Auth Service determines if the node
+    # should be allowed to join.
+    allow:
+      - service_account: "namespace:serviceaccount"
+```
diff --git a/docs/pages/includes/provision-token/oracle-spec.mdx b/docs/pages/includes/provision-token/oracle-spec.mdx
index 9987f0a16b2d0..96ce5ecd538ae 100644
--- a/docs/pages/includes/provision-token/oracle-spec.mdx
+++ b/docs/pages/includes/provision-token/oracle-spec.mdx
@@ -16,12 +16,16 @@ spec:
   oracle:
     allow:
       # OCID of the tenancy to allow instances to join from. Required.
-      - tenancy: "ocid1.tenancy.oc1..<unique ID>"
+      - tenancy: "ocid1.tenancy.oc1..<unique_ID>"
         # (Optional) OCIDs of compartments to allow instances to join from. Only the direct parent
         # compartment applies; i.e. nested compartments are not taken into account.
         # If empty, instances can join from any compartment in the tenancy.
-        parent_compartments: ["ocid1.compartment.oc1...<unique_ID>"]
+        parent_compartments: ["ocid1.compartment.oc1..<unique_ID>"]
         # (Optional) Regions to allow instances to join from. Both full names ("us-phoenix-1")
         # and abbreviations ("phx") are allowed. If empty, instances can join from any region.
         regions: ["example-region"]
-```
\ No newline at end of file
+        # (Optional) OCIDs of specific compute instances that should be allowed to join.
+        # If empty, any instance matching the other fields is allowed.
+        # The instances field is supported in Teleport v18.4.0+.
+        instances: ["ocid1.instance.oc1.<region>.<unique_ID>"]
+```
diff --git a/docs/pages/includes/provision-token/spacelift-spec.mdx b/docs/pages/includes/provision-token/spacelift-spec.mdx
index a147e1ff0f17f..a51f0efdf316f 100644
--- a/docs/pages/includes/provision-token/spacelift-spec.mdx
+++ b/docs/pages/includes/provision-token/spacelift-spec.mdx
@@ -14,14 +14,24 @@ spec:
   spacelift:
     # hostname should be the hostname of your Spacelift tenant.
     hostname: example.app.spacelift.io
+    # enable_glob_matching enables glob-style matching for the allow rules.
+    enable_glob_matching: true
     # allow specifies rules that control which Spacelift executions will be
     # granted access. Those not matching any allow rule will be denied.
     allow:
       # space_id identifies the space that the module or stack resides within.
+      #
+      # This field supports glob-style matching when the enable_glob_matching field is true:
+      # - Use '*' to match zero or more characters.
+      # - Use '?' to match any single character.
     - space_id: root
       # caller_type is the type of caller_id. This must be `stack` or `module`.
       caller_type: stack
       # caller_id is the id of the caller. e.g the name of the stack or module.
+      #
+      # This field supports glob-style matching when the enable_glob_matching field is true:
+      # - Use '*' to match zero or more characters.
+      # - Use '?' to match any single character.
       caller_id: my-stack
       # scope is the scope of the token - either `read` or `write`.
       # See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
diff --git a/docs/pages/includes/provision-token/terraform-spec.mdx b/docs/pages/includes/provision-token/terraform-spec.mdx
index 2660faccf142b..24742fba098df 100644
--- a/docs/pages/includes/provision-token/terraform-spec.mdx
+++ b/docs/pages/includes/provision-token/terraform-spec.mdx
@@ -5,13 +5,13 @@ metadata:
   name: terraform
 spec:
   roles: [Bot]
-  join_method: terraform
+  join_method: terraform_cloud
 
   # This must match a bot name, created either with `tctl bots add` or by
   # creating a `bot` resource.
   bot_name: terraform
 
-  terraform:
+  terraform_cloud:
     # Manually override the expected audience. If unset, defaults to the
     # Teleport cluster name. It is not recommended to override this value.
     audience: ''
diff --git a/docs/pages/includes/provision-token/tpm-spec.mdx b/docs/pages/includes/provision-token/tpm-spec.mdx
index 5ba8a6b021061..b5df1ed6eecf9 100644
--- a/docs/pages/includes/provision-token/tpm-spec.mdx
+++ b/docs/pages/includes/provision-token/tpm-spec.mdx
@@ -6,8 +6,8 @@ metadata:
   # token, this name should be specified.
   name: tpm-token
 spec:
-  # For Machine ID and TPM joining, roles will always be "Bot" and
-  # join_method will always be "tpm".
+  # For Machine & Workload Identity via TPM joining, roles will always be "Bot"
+  # and join_method will always be "tpm".
   roles: [Bot]
   join_method: tpm
 
diff --git a/docs/pages/includes/reference/resources/autoupdate_agent_report.mdx b/docs/pages/includes/reference/resources/autoupdate_agent_report.mdx
new file mode 100644
index 0000000000000..9413d4fc0baac
--- /dev/null
+++ b/docs/pages/includes/reference/resources/autoupdate_agent_report.mdx
@@ -0,0 +1,40 @@
+```yaml
+kind: autoupdate_agent_report
+version: v1
+metadata:
+  # Instance ID of the auth that generated the report.
+  name: auth1
+spec:
+  # When the report was generated.
+  timestamp: 2025-05-28T11:22:41.924956-04:00
+  # Map of the agent groups seen by the auth.
+  groups:
+    dev:
+      # Map of the agent versions seen for this group by the auth.
+      versions:
+        "1.2.3":
+          # Number of registered agents with this version.
+          count: 15
+        "1.2.4":
+          count: 2
+        "1.2.5":
+          count: 34
+    stage:
+      versions:
+        "1.2.3":
+          count: 15
+        "1.2.4":
+          count: 125
+    prod:
+      versions:
+        "1.2.5":
+          count: 1543
+  # List of agents omitted from the report.
+  omitted:
+    - count: 120
+      reason: "version is pinned"
+    - count: 12
+      reason: "managed update v1 updater does not support agent reports"
+    - count: 42
+      reason: "updater version predates agent report"
+```
diff --git a/docs/pages/includes/reference/resources/autoupdate_agent_rollout.mdx b/docs/pages/includes/reference/resources/autoupdate_agent_rollout.mdx
new file mode 100644
index 0000000000000..2334b53fd4514
--- /dev/null
+++ b/docs/pages/includes/reference/resources/autoupdate_agent_rollout.mdx
@@ -0,0 +1,109 @@
+```yaml
+kind: autoupdate_agent_rollout
+metadata:
+  # autoupdate_agent_rollout is a singleton resource. There can be only one instance
+  # of this resource in the Teleport cluster, and it must be named `autoupdate-agent-rollout`.
+  name: autoupdate-agent-rollout
+spec:
+  # start_version is the version used to install new agents before their
+  # group's scheduled update time. Agents never update to the start_version
+  # automatically, but may be required to via "teleport-update update --now".
+  start_version: v17.2.0
+
+  # target_version is the version that agents update to during their group's
+  # scheduled update time. New agents also use this version after their group's
+  # scheduled update time.
+  target_version: v17.2.1
+
+  # schedule used to roll out updates.
+  # The regular schedule is defined in the autoupdate_config resource.
+  # The immediate schedule updates all agents to target_version immediately.
+  # Possible values: "regular" or "immediate"
+  schedule: regular
+
+  # autoupdate_mode allows users to enable, disable, or suspend agent updates at the
+  # cluster level. Disable agent automatic updates only if self-managed
+  # updates are in place. This value may also be set in autoupdate_config.
+  # If set in both places, disabled overrides suspended, which overrides enabled.
+  # Possible values: "enabled", "disabled", "suspended"
+  autoupdate_mode: enabled
+
+  # strategy used to roll out updates to agents.
+  # The halt-on-error strategy ensures that groups earlier in the schedule are
+  # given the opportunity to update to the target_version before groups that are
+  # later in the schedule. (Currently, the schedule must be stopped manually by
+  # setting the mode to "suspended" or "disabled". In the future, errors will be
+  # detected automatically).
+  # The time-based strategy ensure that each group updates within a defined
+  # time window, with no dependence between groups.
+  # Possible values: "halt-on-error" or "time-based"
+  # Default: "halt-on-error"
+  strategy: halt-on-error
+
+  # maintenance_window_duration configures the duration after the start_hour
+  # when updates may occur. Only valid for the time-based strategy.
+  # maintenance_window_duration: 1h
+
+status:
+
+  # groups contains the status for each group in the currently executing schedule.
+  groups:
+
+    # name of each group, configured locally via "teleport-update enable --group"
+    - name: staging
+
+      # start_time of the group
+      start_time: 0001-01-01T00:00:00Z
+
+      # state of the group
+      # Possible values: unstarted, active, done, rolledback
+      state: active
+
+      # last_update_time of this group's status
+      last_update_time: 0001-01-01T00:00:00Z
+
+      # last_update_reason of this group's status
+      last_update_reason: "new version"
+
+      # days that the update may occur on, from autoupdate_config
+      # Possible values: "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun", and "*"
+      config_days: [ "Mon", "Tue", "Wed", "Thu" ]
+
+      # start_hour of the update, in UTC, from autoupdate_config
+      config_start_hour: 4
+
+    - name: production
+
+      # ...
+
+      # config_wait_hours is specific number of hours after the previous group that this
+      # group may execute after, from autoupdate_config.
+      config_wait_hours: 24
+
+      # canary_count is the number of agents selected to update and verify before the rest
+      # of the group. Only present for the halt-on-error schedule.
+      canary_count: 1
+
+      # canaries describes the status of the selected canaries for this group.
+      canaries:
+
+        # updater_id is the unique ID of the updater that is managing the canary.
+        - updater_id: 3c6bcc1b-1992-4abc-a6f1-43f8f1b9ff05
+
+          # host_id is the unique host ID of the agent that is being updated.
+          host_id: c757ad82-95f2-4416-ae9d-a20ffd9b5a54
+
+          # hostname is the hostname of the agent that is being updated.
+          hostname: prod43
+
+          # success is true if the canary was updated successfully.
+          success: true
+
+
+  # start_time of the rollout
+  start_time: 0001-01-01T00:00:00Z
+
+  # state of the entire rollout
+  # Possible values: unstarted, active, done, rolledback
+  state: active
+```
diff --git a/docs/pages/includes/reference/resources/autoupdate_config.mdx b/docs/pages/includes/reference/resources/autoupdate_config.mdx
new file mode 100644
index 0000000000000..08e82e708204e
--- /dev/null
+++ b/docs/pages/includes/reference/resources/autoupdate_config.mdx
@@ -0,0 +1,72 @@
+```yaml
+kind: autoupdate_config
+metadata:
+  # autoupdate_config is a singleton resource. There can be only one instance
+  # of this resource in the Teleport cluster, and it must be named `autoupdate-config`.
+  name: autoupdate-config
+spec:
+  agents:
+    # mode allows users to enable, disable, or suspend agent updates at the
+    # cluster level. Disable agent automatic updates only if self-managed
+    # updates are in place. This value may also be set in autoupdate_version.
+    # If set in both places, disabled overrides suspended, which overrides enabled.
+    # Possible values: "enabled", "disabled", "suspended"
+    # Default: "disabled" (unless specified in autoupdate_version)
+    mode: enabled
+
+    # strategy used to roll out updates to agents. Applies to every group.
+    # The halt-on-error strategy ensures that groups earlier in the schedule are
+    # given the opportunity to update to the target_version before groups that are
+    # later in the schedule. (Currently, the schedule must be stopped manually by
+    # setting the mode to "suspended" or "disabled". In the future, errors will be
+    # detected automatically).
+    # The time-based strategy ensure that each group updates within a defined
+    # time window, with no dependence between groups.
+    # Possible values: "halt-on-error" or "time-based"
+    # Default: "halt-on-error"
+    strategy: halt-on-error
+
+    # maintenance_window_duration configures the duration after the start_hour
+    # when updates may occur. Only valid for the time-based strategy.
+    # maintenance_window_duration: 1h
+
+    # schedules define groups of agents with different update times.
+    # Currently, only the regular schedule is configurable.
+    schedules:
+      regular:
+
+        # name of each group, configured locally via "teleport-update enable --group".
+        # Agents presenting a missing or empty group are placed in the last group in the list.
+        - name: staging
+
+          # start_hour of the update, in UTC
+          start_hour: 4
+
+          # days that the update may occur on
+          # Days are not configurable for most Enterprise cloud-hosted users.
+          # Possible values: "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun", and "*"
+          # Default: [ "Mon", "Tue", "Wed", "Thu" ]
+          days: [ "Mon", "Tue", "Wed", "Thu" ]
+
+        - name: production
+          start_hour: 5
+
+          # wait_hours ensures that the group executes at least a specific number of hours
+          # after the previous group. Only valid for the halt-on-error schedule.
+          # Default: 0
+          wait_hours: 24
+
+          # canary_count specifies the number of agents to update and verify before the rest
+          # of the group. Only valid for the halt-on-error schedule.
+          # Possible values: 0-5
+          # Default: 0
+          canary_count: 5
+
+  tools:
+    # mode allows users to enable or disable client tool updates at the
+    # cluster level. Disable client tool automatic updates only if self-managed
+    # updates are in place.
+    # Possible values: "enabled" or "disabled"
+    # Default: "disabled"
+    mode: enabled
+```
diff --git a/docs/pages/includes/reference/resources/autoupdate_version.mdx b/docs/pages/includes/reference/resources/autoupdate_version.mdx
new file mode 100644
index 0000000000000..995ab8109abd4
--- /dev/null
+++ b/docs/pages/includes/reference/resources/autoupdate_version.mdx
@@ -0,0 +1,40 @@
+```yaml
+kind: autoupdate_version
+metadata:
+  # autoupdate_version is a singleton resource. There can be only one instance
+  # of this resource in the Teleport cluster, and it must be named `autoupdate-version`.
+  name: autoupdate-version
+spec:
+  agents:
+    # start_version is the version used to install new agents before their
+    # group's scheduled update time. Agents never update to the start_version
+    # automatically, but may be required to via "teleport-update update --now".
+    start_version: v17.2.0
+
+    # target_version is the version that agents update to during their group's
+    # scheduled update time. New agents also use this version after their group's
+    # scheduled update time.
+    target_version: v17.2.1
+
+    # schedule used to roll out updates.
+    # The regular schedule is defined in the autoupdate_config resource.
+    # The immediate schedule updates all agents to target_version immediately.
+    # Possible values: "regular" or "immediate"
+    # Default: "regular"
+    schedule: regular
+
+    # mode allows users to enable, disable, or suspend agent updates at the
+    # cluster level. Disable agent automatic updates only if self-managed
+    # updates are in place. This value may also be set in autoupdate_config.
+    # If set in both places, disabled overrides suspended, which overrides enabled.
+    # Possible values: "enabled", "disabled", "suspended"
+    # Default: "disabled" (unless specified in autoupdate_config)
+    mode: enabled
+
+  tools:
+    # target_version is the semver version of client tools the cluster will advertise.
+    # Client tools such as tsh and tctl will update to this version at login if the
+    # mode set in autoupdate_config is set to enabled.
+    # Default: cluster version
+    target_version: v17.2.1
+```
diff --git a/docs/pages/includes/reference/resources/db.mdx b/docs/pages/includes/reference/resources/db.mdx
new file mode 100644
index 0000000000000..33efa3ecddab9
--- /dev/null
+++ b/docs/pages/includes/reference/resources/db.mdx
@@ -0,0 +1,130 @@
+```yaml
+kind: db
+version: v3
+metadata:
+  # Database resource name.
+  name: example
+
+  # Database resource description.
+  description: "Example database"
+
+  # Database resource static labels.
+  labels:
+    env: example
+
+spec:
+  # Database protocol. Valid options are:
+  # "cassandra"
+  # "clickhouse"
+  # "clickhouse-http"
+  # "cockroachdb"
+  # "dynamodb"
+  # "elasticsearch"
+  # "mongodb"
+  # "mysql"
+  # "oracle"
+  # "postgres"
+  # "redis"
+  # "snowflake"
+  # "spanner"
+  # "sqlserver"
+  protocol: "postgres"
+
+  # Database connection endpoint.
+  uri: "localhost:5432"
+
+  # Optional TLS configuration.
+  tls:
+    # TLS verification mode. Valid options are:
+    # 'verify-full' - performs full certificate validation (default).
+    # 'verify-ca' - the same as `verify-full`, but skips the server name validation.
+    # 'insecure' - accepts any certificate provided by database (not recommended).
+    mode: verify-full
+    # Optional database DNS server name. It allows to override the DNS name on
+    # a client certificate when connecting to a database.
+    # Use only with 'verify-full' mode.
+    server_name: db.example.com
+    # Optional CA for validating the database certificate.
+    ca_cert: |
+      -----BEGIN CERTIFICATE-----
+      ...
+      -----END CERTIFICATE-----
+    # Optional configuration that allows Teleport to trust certificate
+    # authorities available on the host system. If not set (by default),
+    # Teleport only trusts self-signed databases with TLS certificates signed
+    # by Teleport's Database Server CA or the ca_cert specified in this TLS
+    # setting. For cloud-hosted databases, Teleport downloads the corresponding
+    # required CAs for validation.
+    trust_system_cert_pool: false
+
+  # Database admin user for automatic user provisioning.
+  admin_user:
+    # Database admin user name.
+    name: "teleport-admin"
+
+  # MySQL only options.
+  mysql:
+    # The MySQL server version reported by the Teleport Proxy Service.
+    # Teleport uses this string when reporting the server version to a 
+    # connecting client.
+    #
+    # When this option is not set, the Database Service will try to connect to
+    # a MySQL instance on startup and fetch the server version. Otherwise, 
+    # it will use the provided value without connecting to a database. 
+    #
+    # In both cases, the MySQL server version reported to a client will be 
+    # updated on the first successful connection made by a user.
+    # Teleport uses that string instead of default '8.0.0-Teleport' version when reporting
+    # the server version to a connecting client. When this option is not set, the Database Service will try
+    # to connect to MySQL instance on startup and fetch the server version.
+    # Otherwise, it will use the provided value without connecting to a database.
+    # In both cases MySQL server version reported to a client will be updated on the first successful
+    # connection made by a user.
+    server_version: 8.0.28
+
+  # Oracle only options.
+  oracle:
+    # Randomize host order per connection attempt to spread load. Optional.
+    shuffle_hostnames: true
+    # Retries per host on network errors only; non-network errors stop (default: 2). Optional.
+    retry_count: 5            
+
+  # Optional AWS configuration for RDS/Aurora/Redshift. Can be auto-detected from the endpoint.
+  aws:
+    # Region the database is deployed in.
+    region: "us-east-1"
+    # Optional AWS role that the Database Service will assume to access
+    # this database.
+    assume_role_arn: "arn:aws:iam::123456789012:role/example-role-name"
+    # Optional AWS external ID that the Database Service will use to assume
+    # a role in an external AWS account.
+    external_id: "example-external-id"
+    # Redshift specific configuration.
+    redshift:
+      # Redshift cluster identifier.
+      cluster_id: "redshift-cluster-1"
+
+  # GCP configuration (required for Cloud SQL and Spanner databases).
+  gcp:
+    # GCP project ID.
+    project_id: "xxx-1234"
+    # Cloud SQL instance ID.
+    instance_id: "example"
+
+  # Settings specific to Active Directory authentication e.g. for SQL Server.
+  ad:
+    # Path to Kerberos keytab file.
+    keytab_file: /path/to/keytab
+    # Active Directory domain name.
+    domain: EXAMPLE.COM
+    # Service Principal Name to obtain Kerberos tickets for.
+    spn: MSSQLSvc/ec2amaz-4kn05du.dbadir.teleportdemo.net:1433
+    # Optional path to Kerberos configuration file. Defaults to /etc/krb5.conf.
+    krb5_file: /etc/krb5.conf
+
+  # Optional dynamic labels.
+  dynamic_labels:
+  - name: "hostname"
+    command: ["hostname"]
+    period: 1m0s
+```
\ No newline at end of file
diff --git a/docs/pages/includes/role-spec.mdx b/docs/pages/includes/role-spec.mdx
index 7dbaeb884305a..8417c10a6f455 100644
--- a/docs/pages/includes/role-spec.mdx
+++ b/docs/pages/includes/role-spec.mdx
@@ -1,6 +1,6 @@
 ```yaml
 kind: role
-version: v7
+version: v8
 metadata:
   name: example
   description: This is an example role.
@@ -49,7 +49,7 @@ spec:
     # clients and servers through the proxy
     permit_x11_forwarding: true
     # device_trust_mode enforces authenticated device access for assigned user of this role.
-    device_trust_mode: optional|required|off
+    device_trust_mode: optional|required|required-for-humans|off
     # require_session_mfa require per-session MFA for any assigned user of this role
     require_session_mfa: true
     # mfa_verification_interval optionally defines the maximum duration that can elapse between successive MFA verifications.
@@ -103,6 +103,8 @@ spec:
     # Defaults to true if unspecified.
     # If one or more of the user's roles has disabled directory sharing, then it will be disabled.
     desktop_directory_sharing: true
+    # Specify whether this role supports auto-provisioning of local Windows users.
+    create_desktop_user: true
     # enterprise-only: when enabled, the source IP that was used to log in is embedded in the user
     # certificates, preventing a compromised certificate from being used on another
     # network. The default is false.
@@ -171,6 +173,16 @@ spec:
       "ALL = (root) NOPASSWD: /usr/bin/systemctl restart nginx.service"
     ]
 
+    # List of local Windows groups the created user will be added to.
+    # Any that don't already exist are created. Only applies when
+    # create_desktop_user is 'true'.
+    desktop_groups:
+    - developers
+    # to make the newly-created user an administrator
+    - Administrators
+    # IdP trait templating is also supported
+    - '{{external.desktop_groups}}'
+
     # kubernetes_groups specifies Kubernetes groups a user with this role will assume.
     # You can refer to a SAML/OIDC trait via the 'external' property bag.
     # This allows you to specify Kubernetes group membership in an identity manager:
@@ -199,12 +211,15 @@ spec:
     kubernetes_resources:
         # The resource kind. Teleport currently supports:
         # - * (all resources)
-        # - namespaces (including all resources kinds in the namespace)
         # - <arbitrary string> (Resource plural name, e.g. pods, deployments, cronjobs, mycustomresources)
       - kind: '*'
+        # The resource name of the Kubernetes cluster in which to allow access
+        # to the resources you specify with 'name' and 'kind'.
+        api_group: '*'
         # The name of the Kubernetes namespace in which to allow access the
         # resources you specify with 'name' and 'kind'.
-        # The wildcard character '*' matches any sequence of characters.
+        # The wildcard character '*' matches any sequence of characters for namespaced
+        # resource. If set, global resources will not match.
         # If the value begins with '^' and ends with '$', the Kubernetes
         # Service will treat it as a regular expression.
         namespace: '*'
@@ -227,21 +242,30 @@ spec:
         # - exec - allows users to execute commands in a pod
         # - portforward - allows users to forward ports from a pod
         verbs: ['*']
-        # The resource name of the Kubernetes cluster in which to allow access
-        # to the resources you specify with 'name' and 'kind'.
-        api_group: '*'
 
-    # Functions transform variables.
+    # Database account names this role can connect as.
+    #
+    # Supports role templating with traits.
     db_users: ['{{email.local(external.email)}}']
+    # Database names this role will be able to connect to. Database names are
+    # only enforced for PostgreSQL, MongoDB, and Cloud Spanner databases.
+    #
+    # Supports role templating with traits.
     db_names: ['{{external.db_names}}']
+    # Label selectors for database instances this role has access to.
+    #
+    # Supports role templating with traits.
     db_labels:
       'env': '{{regexp.replace(external.env, "^(staging)$", "$1")}}'
 
-    # List of database roles to grant. Mutually exclusive with 'db_permissions'.
+    # List of database roles to grant to the auto-provisioned user. Mutually
+    # exclusive with 'db_permissions'.
+    #
+    # Supports role templating with traits.
     db_roles: ['{{external.db_roles}}']
 
-    # Grant all possible Postgres permissions for all tables.
-    # List of database permissions to grant. Mutually exclusive with 'db_roles'.
+    # List of database permissions to grant to the auto-provisioned user.
+    # Mutually exclusive with 'db_roles'.
     db_permissions:
     - match:
         object_kind: table
@@ -282,8 +306,11 @@ spec:
 
     # workload_identity_labels: a user/bot with this role will be allowed to
     # issue Workload Identities with labels matching below.
+    #
+    # Supports role templating with traits.
     workload_identity_labels:
       'env': 'prod'
+      'team': '{{external.team}}'
 
     # node_labels_expression has the same purpose as node_labels but
     # supports predicate expressions to configure custom logic.
@@ -366,6 +393,9 @@ spec:
         # is required for all Access Requests requesting roles or resources allowed by
         # this role. It applies only to users who have this role assigned.
         mode: "optional"
+        # 'prompt' is a custom message prompted to the user for the requested roles or resources searchable
+	      # as other roles. This is only applied to the requested roles and resources specifying the prompt.
+        prompt: I am a reason prompt specific to a requested role or resource
 
       # thresholds specifies minimum amount of approvers and deniers,
       # defaults to 1 for both (enterprise-only)
@@ -465,6 +495,22 @@ spec:
     - orgs:
       - my-org
 
+    # mcp: defines MCP servers related permissions.
+    mcp:
+      # tools: list of tools allowed for this role.
+      #
+      # No tools are allowed if not specified.
+      # Each entry can be a literal string, a glob pattern, or a regular
+      # expression (must start with '^' and end with '$'). A wildcard '*' allows
+      # all tools.
+      # This value field also supports variable interpolation.
+      tools:
+      - search-files
+      - slack_*
+      - ^(get|list|read).*$
+      - "{{internal.mcp_tools}}"
+      - "{{external.mcp_tools}}"
+
     # rules allow a user holding this role to modify other resources
     # matching the expressions below
     # supported resources:
@@ -487,6 +533,8 @@ spec:
     # instance           - a Teleport instance
     # event              - structured audit logging event
     #
+    # workload_identity     - config for Machine & Workload Identity SVIDS
+    # bot                   - config for Machine & Workload Identity bots
     #
     # lock                  - lock resource.
     # network_restrictions  - restrictions for SSH sessions
diff --git a/docs/pages/includes/s3-iam-policy.mdx b/docs/pages/includes/s3-iam-policy.mdx
index dc968e697eaea..f0abc3cb24e00 100644
--- a/docs/pages/includes/s3-iam-policy.mdx
+++ b/docs/pages/includes/s3-iam-policy.mdx
@@ -7,7 +7,7 @@ recording bucket depends on whether you expect to create the bucket yourself or
 enable the Auth Service to create and configure it for you:
 
 <Tabs>
-<TabItem label="Manage the Bucket Yourself">
+<TabItem label="Self-Managed">
 
 Note that Teleport will only use S3 buckets with versioning enabled. This
 ensures that a session log cannot be permanently altered or deleted, as
@@ -53,7 +53,7 @@ You'll need to replace these values in the policy example below:
 ```
 
 </TabItem>
-<TabItem label="Auth Service Creates a Bucket">
+<TabItem label="Created by the Auth Service">
 
 You'll need to replace these values in the policy example below:
 
diff --git a/docs/pages/includes/self-hosted-helm-dns.mdx b/docs/pages/includes/self-hosted-helm-dns.mdx
new file mode 100644
index 0000000000000..9aeae85c4f9a8
--- /dev/null
+++ b/docs/pages/includes/self-hosted-helm-dns.mdx
@@ -0,0 +1,59 @@
+The `teleport-cluster` Helm chart exposes the Proxy Service to traffic from the
+internet using a Kubernetes service that sets up an external load balancer with
+your cloud provider.
+
+Obtain the address of your load balancer by following the instructions below.
+
+1. Get information about the Proxy Service load balancer:
+
+   ```code
+   $ kubectl get services/teleport-cluster
+   NAME              TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)                        AGE
+   teleport-cluster  LoadBalancer   10.4.4.73    192.0.2.0        443:31204/TCP                  89s
+   ```
+   
+   The `teleport-cluster` service directs traffic to the Teleport Proxy Service.
+   Notice the `EXTERNAL-IP` field, which shows you the IP address or domain name of
+   the cloud-hosted load balancer. For example, on AWS, you may see a domain name
+   resembling the following:
+   
+   ```text
+   00000000000000000000000000000000-0000000000.us-east-2.elb.amazonaws.com
+   ```
+
+1. Set up two DNS records: `teleport.example.com` for all traffic and
+   `*.teleport.example.com` for any web applications you will register with
+   Teleport. We are assuming that your domain name is `example.com` and
+   `teleport` is the subdomain you have assigned to your Teleport cluster.
+
+   Depending on whether the `EXTERNAL-IP` column above points to an IP address or a
+   domain name, the records will have the following details:
+   
+   <Tabs>
+   <TabItem label="IP Address">
+   
+   |Record Type|Domain Name|Value|
+   |---|---|---|
+   |A|`teleport.example.com`|The IP address of your load balancer|
+   |A|`*.teleport.example.com`|The IP address of your load balancer|
+   
+   </TabItem>
+   <TabItem label="Domain Name">
+   
+   |Record Type|Domain Name|Value|
+   |---|---|---|
+   |CNAME|`teleport.example.com`|The domain name of your load balancer|
+   |CNAME|`*.teleport.example.com`|The domain name of your load balancer|
+   
+   </TabItem>
+   </Tabs>
+
+1. Once you create the records, use the following command to confirm that your
+   Teleport cluster is running, assigning <Var name="clusterName" />  to the
+   name of your cluster:
+
+   ```code
+   $ curl https://<Var name="clusterName" />/webapi/ping
+   {"auth":{"type":"local","second_factor":"on","preferred_local_mfa":"webauthn","allow_passwordless":true,"allow_headless":true,"local":{"name":""},"webauthn":{"rp_id":"teleport.example.com"},"private_key_policy":"none","device_trust":{},"has_motd":false},"proxy":{"kube":{"enabled":true,"listen_addr":"0.0.0.0:3026"},"ssh":{"listen_addr":"[::]:3023","tunnel_listen_addr":"0.0.0.0:3024","web_listen_addr":"0.0.0.0:3080","public_addr":"teleport.example.com:443"},"db":{"mysql_listen_addr":"0.0.0.0:3036"},"tls_routing_enabled":false},"server_version":"(=teleport.version=)","min_client_version":"12.0.0","cluster_name":"teleport.example.com","automatic_upgrades":false}
+   ```
+
diff --git a/docs/pages/includes/self-hosted-prereqs-tabs.mdx b/docs/pages/includes/self-hosted-prereqs-tabs.mdx
deleted file mode 100644
index c84cd7e33d49a..0000000000000
--- a/docs/pages/includes/self-hosted-prereqs-tabs.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-- A running self-hosted Teleport cluster. If you want to get started with
-  self-hosted Teleport Enterprise, [contact
-  Sales](https://goteleport.com/contact-us/). You can also [set up a demo
-  environment](../admin-guides/deploy-a-cluster/linux-demo.mdx) with Teleport Community Edition.
-
-- The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=).
-
-  Visit [Installation](../installation.mdx) for instructions on downloading
-  `tctl` and `tsh`.
diff --git a/docs/pages/includes/server-access/custom-installer-aws.yaml b/docs/pages/includes/server-access/custom-installer-aws.yaml
new file mode 100644
index 0000000000000..ad37619180ac4
--- /dev/null
+++ b/docs/pages/includes/server-access/custom-installer-aws.yaml
@@ -0,0 +1,19 @@
+discovery_service:
+  # ...
+  aws:
+    - types: ["ec2"]
+      tags:
+       - "env": "prod"
+      regions: ["us-west1", "us-east1"]
+      install:
+        script_name: "default-installer"
+      ssm:
+        document_name: "AWS-RunShellScript"
+    - types: ["ec2"]
+      tags:
+       - "env": "devel"
+      regions: ["us-west1", "us-east1"]
+      install:
+        script_name: "devel-installer"
+      ssm:
+        document_name: "AWS-RunShellScript"
\ No newline at end of file
diff --git a/docs/pages/includes/server-access/custom-installer-azure.yaml b/docs/pages/includes/server-access/custom-installer-azure.yaml
new file mode 100644
index 0000000000000..dd9def0a07b81
--- /dev/null
+++ b/docs/pages/includes/server-access/custom-installer-azure.yaml
@@ -0,0 +1,13 @@
+discovery_service:
+  # ...
+  azure:
+    - types: ["vm"]
+      tags:
+       - "env": "prod"
+      install: # optional section when default-installer is used.
+        script_name: "default-installer"
+    - types: ["vm"]
+      tags:
+       - "env": "devel"
+      install:
+        script_name: "devel-installer"
\ No newline at end of file
diff --git a/docs/pages/includes/server-access/custom-installer-gcp.yaml b/docs/pages/includes/server-access/custom-installer-gcp.yaml
new file mode 100644
index 0000000000000..e6558b14d7c52
--- /dev/null
+++ b/docs/pages/includes/server-access/custom-installer-gcp.yaml
@@ -0,0 +1,13 @@
+discovery_service:
+  # ...
+  gcp:
+    - types: ["gce"]
+      tags:
+       - "env": "prod"
+      install: # optional section when default-installer is used.
+        script_name: "default-installer"
+    - types: ["gce"]
+      tags:
+       - "env": "devel"
+      install:
+        script_name: "devel-installer"
\ No newline at end of file
diff --git a/docs/pages/includes/server-access/custom-installer.mdx b/docs/pages/includes/server-access/custom-installer.mdx
index 2bc0983c022f9..b842c0c2c479e 100644
--- a/docs/pages/includes/server-access/custom-installer.mdx
+++ b/docs/pages/includes/server-access/custom-installer.mdx
@@ -1,4 +1,4 @@
-{{ cloud="foo" matcher="bar" matchTypes="baz" }}
+{{ matcher="bar" }}
 To customize an installer, your user must have a role that allows `list`, `create`, `read` and `update` verbs on the `installer` resource.
 
 Create a file called `installer-manager.yaml` with the following content:
@@ -40,19 +40,7 @@ Multiple `installer` resources can exist and be specified in the
 `teleport.yaml`:
 
 ```yaml
-discovery_service:
-  # ...
-  {{ matcher }}:
-    - types: {{ matchTypes }}
-      tags:
-       - "env": "prod"
-      install: # optional section when default-installer is used.
-        script_name: "default-installer"
-    - types: {{ matchTypes }}
-      tags:
-       - "env": "devel"
-      install:
-        script_name: "devel-installer"
+(!docs/pages/includes/server-access/custom-installer-{{ matcher }}.yaml!)
 ```
 
 ---
@@ -64,10 +52,10 @@ The `installer` resource has the following templating options:
 - `{{ .PublicProxyAddr }}`: the public address of the Teleport Proxy Service to
 connect to.
 - `{{ .RepoChannel }}`: Optional package repository (apt/yum) channel name.
-Has format `<channel>/<version>` e.g. stable/v(=teleport.major_version=). See [installation](../../installation.mdx#linux) for more details.
+Has format `<channel>/<version>` e.g. stable/v(=teleport.major_version=). See [installation](../../installation/linux.mdx) for more details.
 - `{{ .AutomaticUpgrades }}`: indicates whether Automatic Updates are enabled or disabled.
   Its value is either `true` or `false`. See
-  [Automatic Agent Updates](../../upgrading/agent-managed-updates.mdx)
+  [Automatic Agent Updates](../../upgrading/agent-managed-updates/agent-managed-updates.mdx)
   for more information.
 - `{{ .TeleportPackage }}`: the Teleport package to use.
   Its value is either `teleport-ent` or `teleport` depending on whether the
diff --git a/docs/pages/includes/sso/cap.mdx b/docs/pages/includes/sso/cap.mdx
new file mode 100644
index 0000000000000..e6c007a785063
--- /dev/null
+++ b/docs/pages/includes/sso/cap.mdx
@@ -0,0 +1,59 @@
+Edit your cluster authentication preferences so you can make the authentication
+connector you configured in this guide the default authentication method for
+your Teleport cluster.
+
+Open the Teleport Web UI. From the left sidebar, navigate to **Zero Trust
+Access** > **Auth Connectors**. Find the connector you would like to make the
+default and, from its three-dot menu, select **Set as default**. 
+
+If you are managing your Teleport resources as configuration files, you can
+choose a default authentication connector using a dynamic resource. In this
+case, use `tctl` to edit the `cluster_auth_preference` value:
+
+```code
+$ tctl edit cluster_auth_preference
+```
+
+Set the value of `spec.type` to `{{ type }}`:
+
+```yaml
+kind: cluster_auth_preference
+metadata:
+  ...
+  name: cluster-auth-preference
+spec:
+  ...
+  type: {{ type }}
+  ...
+version: v2
+```
+
+After you save and exit the editor, `tctl` will update the resource:
+
+```text
+cluster auth preference has been updated
+```
+
+<details>
+<summary>Additional ways to edit cluster auth preferences</summary>
+
+The cluster auth preference is available as a Teleport Terraform provider
+resource. Find a list of configuration options in the [Cluster Auth Preferences
+Resource
+Reference](../../reference/infrastructure-as-code/teleport-resources/cluster-auth-preferences.mdx).
+
+If you self-host Teleport, you can edit your Teleport Auth Service configuration
+file to include the following:
+
+```yaml
+# Snippet from /etc/teleport.yaml
+auth_service:
+  authentication:
+    type: {{ type }}
+```
+
+</details>
+
+If you need to log in again before configuring your identity provider, use the
+flag <nobr>`--auth=local`</nobr>.
+
diff --git a/docs/pages/includes/sso/change-callback.mdx b/docs/pages/includes/sso/change-callback.mdx
new file mode 100644
index 0000000000000..0e14b70a77e64
--- /dev/null
+++ b/docs/pages/includes/sso/change-callback.mdx
@@ -0,0 +1,29 @@
+The callback address can be changed if calling back to a remote machine
+instead of the local machine is required:
+
+```code
+# --bind-addr sets the host and port tsh will listen on, and --callback changes
+# what link is displayed to the user
+$ tsh login --proxy=proxy.example.com --auth=github --bind-addr=localhost:1234 --callback https://remote.machine:1234
+```
+
+For this to work the hostname or CIDR of the remote machine that will be used for
+the callback will need to be allowed via your auth connector's `client_redirect_settings`:
+
+```yaml
+kind: oidc
+metadata:
+  name: example-connector
+spec:
+  client_redirect_settings:
+    # a list of hostnames allowed for HTTPS client redirect URLs
+    # can be a regex pattern
+    allowed_https_hostnames:
+      - remote.machine
+      - '*.app.github.dev'
+      - '^\d+-[a-zA-Z0-9]+\.foo.internal$'
+    # a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+    insecure_allowed_cidr_ranges:
+      - '192.168.1.0/24'
+      - '2001:db8::/96'
+```
diff --git a/docs/pages/includes/sso/how-it-works.mdx b/docs/pages/includes/sso/how-it-works.mdx
new file mode 100644
index 0000000000000..be69066ac0fe0
--- /dev/null
+++ b/docs/pages/includes/sso/how-it-works.mdx
@@ -0,0 +1,18 @@
+{{ idp="your SSO provider" }}
+
+You can register your Teleport cluster as an application with {{ idp }}, then
+create an **authentication connector** resource that provides Teleport with
+information about your application. When a user signs in to Teleport, {{ idp }}
+executes its own authentication flow, then sends an HTTP request to your
+Teleport cluster to indicate that authentication has completed.
+
+Teleport authenticates users to your infrastructure by issuing short-lived
+certificates. After a user completes an SSO authentication flow, Teleport issues
+short-lived TLS and SSH certificates to the user. Teleport also creates a
+temporary user on the Auth Service backend. 
+
+Teleport roles are encoded in the user's certificates. To assign Teleport roles
+to the user, the Auth Service inspects the **role mapping** within the
+authentication connector, which associates user data on {{ idp }} with the names
+of one or more Teleport roles.
+
diff --git a/docs/pages/includes/sso/next-step-traits.mdx b/docs/pages/includes/sso/next-step-traits.mdx
new file mode 100644
index 0000000000000..ec99f1cc37898
--- /dev/null
+++ b/docs/pages/includes/sso/next-step-traits.mdx
@@ -0,0 +1,43 @@
+Now that you have connected Teleport to your identity provider, you can
+customize the way Teleport includes IdP data in Teleport roles.
+
+With **role templates**, you can include user data from your IdP directly in
+Teleport roles. If you use the `external` template variable in the value of a
+role field, Teleport passes that value from your IdP. In this example, all of
+the role options you can use for allowing users to assume certain principals on
+remote systems come from your IdP:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: sso-users
+spec:
+  allow:
+    logins: ['{{external.logins}}']
+    aws_role_arns: ['{{external.aws_role_arns}}']
+    azure_identities: ['{{external.azure_identities}}']
+    db_names: ['{{external.db_names}}']
+    db_roles: ['{{external.db_roles}}']
+    db_users: ['{{external.db_users}}']
+    desktop_groups: ['{{external.desktop_groups}}']
+    gcp_service_accounts: ['{{external.gcp_service_accounts}}']
+    host_groups: ['{{external.host_groups}}']
+    host_sudoers: ['{{external.host_sudoers}}']
+    kubernetes_groups: ['{{external.kubernetes_groups}}']
+    kubernetes_users: ['{{external.kubernetes_users}}']
+    windows_desktop_logins: ['{{external.windows_desktop_logins}}']
+```
+
+For more information on using the `external` template variable, see [Role
+Templates](../../zero-trust-access/rbac-get-started/role-templates.mdx).
+
+For an explanation of the fields listed above, see the [Role
+Reference](../../reference/access-controls/roles.mdx).
+
+If you need to transform your IdP user data before you include it in Teleport
+roles, you can do so using **Login Rules**. Login Rules allow you to include
+external traits within Teleport roles even if your IdP provides user data in a
+different format than the one expected by Teleport. Read more about [Login
+Rules](../../zero-trust-access/sso/login-rules/login-rules.mdx).
+
diff --git a/docs/pages/includes/sso/role-mapping.mdx b/docs/pages/includes/sso/role-mapping.mdx
new file mode 100644
index 0000000000000..cca00c4d5e766
--- /dev/null
+++ b/docs/pages/includes/sso/role-mapping.mdx
@@ -0,0 +1,28 @@
+When a user authenticates to Teleport, the Teleport Auth Service issues SSH and
+TLS certificates to the user that contain the user's Teleport roles. 
+
+For SSO authentication connectors, the Auth Service determines which roles to
+encode in the certificate by reading the authentication connector's **role
+mapping**. The role mapping indicates which Teleport roles to assign based on
+data that your identity provider stores about the user.
+
+When you configure an authentication connector using the `tctl` CLI, a role
+mapping takes the following format:
+
+```text
+<{{fieldType}}_name>,<{{fieldType}}_value>,<teleport_role_1>,<teleport_role_2>,...,<teleport_role_n>
+```
+
+For example, the following role mapping means that any user with the {{fieldType}}
+`group` with the value `admin` receives the Teleport roles `editor` and
+`auditor`:
+
+```text
+group,admin,editor,auditor
+```
+
+For the purpose of this guide, assign two separate role mappings:
+
+- A more permissive role mapping: <Var name="mapping_1" initial="group,admins,auditor,editor" />
+- A more restrictive role mapping: <Var name="mapping_2" initial="group,users,access" />
+
diff --git a/docs/pages/includes/sso/username-claim.mdx b/docs/pages/includes/sso/username-claim.mdx
new file mode 100644
index 0000000000000..fb2d292c10a8f
--- /dev/null
+++ b/docs/pages/includes/sso/username-claim.mdx
@@ -0,0 +1,24 @@
+By default, Teleport expects an `email` claim to be present in the OIDC claim. 
+The value from the `email` claim is used as a username in Teleport. If you wish 
+to use another claim to configure username, you can override the 
+default expected `email` claim with the `username_claim` field in the auth 
+connector spec. 
+
+The example below shows configuring the `username_claim` field with `preferred_username`
+value. This will configure Teleport to query `preferred_username` claim instead 
+of the `email` claim.:
+
+```yaml
+kind: oidc
+metadata:
+  # ...
+spec:
+  # ...
+  username_claim: preferred_username
+```
+
+<Admonition type="warning" title="Username claim">
+  Ensure that the claim value you use to configure `username_claim` is a uniquely
+  identifiable value for the user. 
+</Admonition>
+
diff --git a/docs/pages/includes/start-event-handler.mdx b/docs/pages/includes/start-event-handler.mdx
index 96594c5e6f64e..06cd03e104cb4 100644
--- a/docs/pages/includes/start-event-handler.mdx
+++ b/docs/pages/includes/start-event-handler.mdx
@@ -28,8 +28,9 @@ PIDFile=/run/teleport-event-handler.pid
 WantedBy=multi-user.target
 ```
 
-If you are not using Machine ID to provide short-lived credentials to the Event
-Handler, you can remove the `--teleport-refresh-enabled true` flag.
+If you are not using Machine & Workload Identity to provide short-lived
+credentials to the Event Handler, you can remove the
+`--teleport-refresh-enabled true` flag.
 
 Enable and start the plugin:
 
diff --git a/docs/pages/includes/tctl-get-resources.mdx b/docs/pages/includes/tctl-get-resources.mdx
new file mode 100644
index 0000000000000..9c14cdff1510c
--- /dev/null
+++ b/docs/pages/includes/tctl-get-resources.mdx
@@ -0,0 +1,77 @@
+- `access_graph_settings`
+- `access_list`
+- `access_monitoring_rule`
+- `access_request`
+- `app`
+- `app_server`
+- `audit_query`
+- `auth_server`
+- `autoupdate_agent_report`
+- `autoupdate_agent_rollout`
+- `autoupdate_bot_instance_report`
+- `autoupdate_config`
+- `autoupdate_version`
+- `bot`
+- `bot_instance`
+- `cert_authority`
+- `cluster_auth_preference`
+- `cluster_maintenance_config`
+- `cluster_networking_config`
+- `connectors`
+- `crown_jewel`
+- `db`
+- `db_object`
+- `db_object_import_rule`
+- `db_server`
+- `db_service`
+- `device`
+- `discovery_config`
+- `dynamic_windows_desktop`
+- `external_audit_storage`
+- `git_server`
+- `github`
+- `health_check_config`
+- `inference_model`
+- `inference_policy`
+- `inference_secret`
+- `installer`
+- `integration`
+- `kube_cluster`
+- `kube_server`
+- `lock`
+- `login_rule`
+- `namespace`
+- `network_restrictions`
+- `node`
+- `oidc`
+- `okta_assignment`
+- `okta_import_rule`
+- `plugin`
+- `proxy`
+- `relay_server`
+- `remote_cluster`
+- `role`
+- `saml`
+- `saml_idp_service_provider`
+- `scoped_role`
+- `scoped_role_assignment`
+- `security_report`
+- `semaphore`
+- `server_info`
+- `session_recording_config`
+- `sigstore_policy`
+- `spiffe_federation`
+- `static_host_user`
+- `token`
+- `trusted_cluster`
+- `tunnel`
+- `ui_config`
+- `user`
+- `user_group`
+- `user_task`
+- `vnet_config`
+- `windows_desktop`
+- `windows_desktop_service`
+- `workload_identity`
+- `workload_identity_x509_issuer_override`
+- `workload_identity_x509_revocation`
diff --git a/docs/pages/includes/tctl-tsh-prerequisite.mdx b/docs/pages/includes/tctl-tsh-prerequisite.mdx
deleted file mode 100644
index 64e278a57ed24..0000000000000
--- a/docs/pages/includes/tctl-tsh-prerequisite.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-The `tctl` and `tsh` client tools version >= (=teleport.version=). Read
-[Installation](../installation.mdx) for how to install these.
diff --git a/docs/pages/includes/tls-certificate-setup.mdx b/docs/pages/includes/tls-certificate-setup.mdx
deleted file mode 100644
index 9d823347f1611..0000000000000
--- a/docs/pages/includes/tls-certificate-setup.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
-If you are running Teleport on the internet, we recommend using Let's Encrypt to
-receive your key and certificate automatically. For private networks or custom
-deployments, use your own private key and certificate.
-<Tabs>
-
-  <TabItem label="Public internet deployment with Let's Encrypt">
-    Let's Encrypt verifies that you control the domain name of your Teleport cluster
-    by communicating with the HTTPS server listening on port 443 of your Teleport
-    Proxy Service.
-
-    You can configure the Teleport Proxy Service to complete the Let's Encrypt
-    verification process when it starts up.
-
-    On the host where you will start the Teleport Auth Service and Proxy Service,
-    run the following `teleport configure` command. Assign 
-    <Var name="teleport.example.com" /> to the
-    domain name of your Teleport cluster and <Var name="user@example.com" /> to
-    an email address used for notifications (you can use any domain):
-
-    ```code
-    $ sudo teleport configure -o file \
-        --acme --acme-email=<Var name="user@example.com" description="Your email address to register with Let's Encrypt for TLS certificates" /> \
-        --cluster-name=<Var name="teleport.example.com" description="The domain name of your Teleport cluster" />
-    ```
-
-    Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
-  </TabItem>
-
-  <TabItem label="Private network deployment">
-  On your Teleport host, place a valid private key and a certificate chain in `/var/lib/teleport/privkey.pem`
-  and `/var/lib/teleport/fullchain.pem` respectively.
-
-  The leaf certificate must have a subject that corresponds to the domain of your Teleport host, e.g., `*.teleport.example.com`.
-
-  On the host where you will start the Teleport Auth Service and Proxy Service,
-  run the following `teleport configure` command. Assign <Var
-  name="teleport.example.com" /> to the domain name of your Teleport cluster.
-
-  ```code
-  $ sudo teleport configure -o file \
-      --cluster-name=<Var name="teleport.example.com" /> \
-      --public-addr=<Var name="teleport.example.com" />:443 \
-      --cert-file=/var/lib/teleport/fullchain.pem \
-      --key-file=/var/lib/teleport/privkey.pem
-  ```
-  </TabItem>
-
-</Tabs>
diff --git a/docs/pages/includes/token-types.mdx b/docs/pages/includes/token-types.mdx
index fee31c63ebb8a..22302480ab43b 100644
--- a/docs/pages/includes/token-types.mdx
+++ b/docs/pages/includes/token-types.mdx
@@ -1,12 +1,12 @@
-| Role             | Teleport Service        |
-| ---------------- | ----------------------- |
-| `app`            | Application Service     |
-| `auth`           | Auth Service            |
-| `bot`            | Machine ID              |
-| `db`             | Database Service        |
-| `discovery`      | Discovery Service       |
-| `kube`           | Kubernetes Service      |
-| `node`           | SSH Service             |
-| `proxy`          | Proxy Service           |
-| `windowsdesktop` | Windows Desktop Service |
+| Role             | Teleport Service                |
+| ---------------- | ------------------------------- |
+| `app`            | Application Service             |
+| `auth`           | Auth Service                    |
+| `bot`            | Machine & Workload Identity Bot |
+| `db`             | Database Service                |
+| `discovery`      | Discovery Service               |
+| `kube`           | Kubernetes Service              |
+| `node`           | SSH Service                     |
+| `proxy`          | Proxy Service                   |
+| `windowsdesktop` | Windows Desktop Service         |
 
diff --git a/docs/pages/includes/tpm-joining-background.mdx b/docs/pages/includes/tpm-joining-background.mdx
index 24d537245cdea..d9137b1bdab9a 100644
--- a/docs/pages/includes/tpm-joining-background.mdx
+++ b/docs/pages/includes/tpm-joining-background.mdx
@@ -28,5 +28,5 @@ such as Ansible to query the TPMs across your fleet and then generate join
 tokens.
 
 <Admonition type="warning">
-The `tpm` join method is currently not compatible with FIPS 140-2.
+The `tpm` join method is currently not compatible with FIPS.
 </Admonition>
diff --git a/docs/pages/includes/uninstall-teleport-binaries.mdx b/docs/pages/includes/uninstall-teleport-binaries.mdx
new file mode 100644
index 0000000000000..8d3775c71dc80
--- /dev/null
+++ b/docs/pages/includes/uninstall-teleport-binaries.mdx
@@ -0,0 +1,8 @@
+  ```code
+  $ sudo rm -f /usr/local/bin/tbot
+  $ sudo rm -f /usr/local/bin/tctl
+  $ sudo rm -f /usr/local/bin/teleport
+  $ sudo rm -f /usr/local/bin/tsh
+  $ sudo rm -f /usr/local/bin/fdpass-teleport
+  $ sudo rm -f /usr/local/bin/teleport-update
+  ```
\ No newline at end of file
diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx
index a6b3c8acc1d57..e39911710a80c 100644
--- a/docs/pages/index.mdx
+++ b/docs/pages/index.mdx
@@ -1,99 +1,430 @@
 ---
-h1: Introduction to Teleport
-title: "Introduction to the Teleport Infrastructure Identity Platform"
+title: "The Teleport Infrastructure Identity Platform"
 description: Read an overview of the Teleport Access Platform. Learn how to implement Zero Trust Security across all your infrastructure for enhanced protection and streamlined access control.
-tocDepth: 3
+template: "landing-page"
 ---
 
-Teleport is the easiest, most secure way to access and protect all your infrastructure.
+import DocsHeader, { DocsHeaderProps } from "@site/src/components/Pages/Homepage/DocsHeader";
+import Products, { ProductProps } from "@site/src/components/Pages/Homepage/Products/Products";
+import VersionHighlights from "@site/src/components/Pages/Homepage/VersionHighlights";
+import Resources, { ResourcesProps } from "@site/src/components/Pages/Homepage/Resources";
+import Integrations, { IntegrationsProps } from "@site/src/components/Pages/Homepage/Integrations";
+import GetStarted from "@site/src/components/Pages/Homepage/GetStarted";
 
-The Teleport Infrastructure Identity Platform implements trusted computing at
-scale, with unified cryptographic identities for humans, machines and workloads,
-endpoints, infrastructure assets, and AI agents. 
+import applicationSvg from "@site/src/components/Icon/teleport-svg/application.svg";
+import linuxServersSvg from "@site/src/components/Icon/teleport-svg/linux-servers.svg";
+import databaseSvg from "@site/src/components/Icon/teleport-svg/database-access.svg";
+import kubernetesClustersSvg from "@site/src/components/Icon/teleport-svg/kubernetes-clusters.svg";
+import windowsDesktopsSvg from "@site/src/components/Icon/teleport-svg/windows-desktops.svg";
+import autoDiscoverySvg from "@site/src/components/Icon/teleport-svg/auto-discovery.svg";
+import cloudProvidersSvg from "@site/src/components/Icon/teleport-svg/cloud-providers.svg";
+import mcpAndAiSvg from "@site/src/components/Icon/teleport-svg/mcp-and-ai.svg";
+import awsSvg from "@site/src/components/Icon/teleport-svg/aws.svg";
+import gcpSvg from "@site/src/components/Icon/teleport-svg/gcp.svg";
+import azureSvg from "@site/src/components/Icon/teleport-svg/azure.svg";
+import oktaSvg from "@site/src/components/Icon/teleport-svg/okta.svg";
+import slackSvg from "@site/src/components/Icon/teleport-svg/slack.svg";
+import pagerDutySvg from "@site/src/components/Icon/teleport-svg/pagerduty.svg";
+import jamfProSvg from "@site/src/components/Icon/teleport-svg/jamf-pro.svg";
+import jenkinsSvg from "@site/src/components/Icon/teleport-svg/jenkins.svg";
+import snowflakeSvg from "@site/src/components/Icon/teleport-svg/snowflake.svg";
+import arrowRightSvg from "@site/src/components/Icon/teleport-svg/arrow-right.svg";
+import zeroTrustSvg from "@site/src/components/Icon/teleport-svg/zero-trust.svg";
+import mwiSvg from "@site/src/components/Icon/teleport-svg/mwi.svg";
+import identityGovernanceSvg from "@site/src/components/Icon/teleport-svg/identity-governance.svg";
+import identitySecuritySvg from "@site/src/components/Icon/teleport-svg/identity-security.svg";
+import bookOpenSvg from "@site/src/components/Icon/teleport-svg/book-open.svg";
+import flowArrowSvg from "@site/src/components/Icon/teleport-svg/flow-arrow.svg";
+import identificationBadgeSvg from "@site/src/components/Icon/teleport-svg/identification-badge.svg";
+import listBulletsSvg from "@site/src/components/Icon/teleport-svg/list-bullets.svg";
 
-## Products
+{/* lint disable page-structure remark-lint */}
 
-The Teleport Infrastructure Identity Platform consists of four products.
+<DocsHeader
+  quickActions={[
+    { 
+      label: "Enroll Kubernetes cluster", 
+      href: "./enroll-resources/kubernetes-access/getting-started/" 
+    },
+    { 
+      label: "Set up SSO with GitHub", 
+      href: "./zero-trust-access/sso/integrate-idp/github-sso/" 
+    },
+    { 
+      label: "Set up Slack Access Request Plugin", 
+      href: "./identity-governance/access-requests/plugins/slack/" 
+    }
+  ]}
+/>
 
-- [Teleport Zero Trust Access](#teleport-zero-trust-access)
-- [Teleport Machine & Workload Identity](#teleport-machine--workload-identity)
-- [Teleport Identity Governance](#teleport-identity-governance)
-- [Teleport Identity Security](#teleport-identity-security)
+<GetStarted
+  youtubeVideoId="BJWbSqiDLeU"
+  steps={[
+    {
+      title: "Step 1: Deploy a Teleport cluster",
+      description: "Select an edition and deploy a Teleport cluster. ",
+      href: "./get-started/",
+    },
+    {
+      title: "Step 2: Connect your infrastructure",
+      description: "Connect and protect your infrastructure with your Teleport cluster.",
+      href: "./get-started/connect/",
+    },
+    {
+      title: "Step 3: Manage access",
+      description: "Configure role-based access controls for your team.",
+      href: "./get-started/access/",
+    },
+    {
+      title: "Step 4: Review a detailed audit log",
+      description: "Collect detailed events generated by humans and machines across your infrastructure.",
+      href: "./get-started/audit/",
+    },
+  ]}
+  links={[
+    {
+      title: "Installation guide",
+      description: "How to install Teleport binaries/clients on your platform.",
+      href: "./installation/",
+      iconComponent: bookOpenSvg,
+    },
+    {
+      title: "Architecture",
+      description: "Understand how Teleport components work together.",
+      href: "./reference/architecture/",
+      iconComponent: flowArrowSvg,
+    },
+    {
+      title: "User guides",
+      description: "Accessing infrastructure with Teleport tools and interfaces.",
+      href: "./connect-your-client/",
+      iconComponent: identificationBadgeSvg,
+    },
+    {
+      title: "References",
+      description: "Comprehensive guides for configuring Teleport components.",
+      href: "./reference/",
+      iconComponent: listBulletsSvg,
+    },
+  ]}
+/>
 
-### Teleport Zero Trust Access
+<Products
+  productCategories={[
+    {
+      id: 'zero-trust-access',
+      title: 'Zero Trust Access',
+      href: './zero-trust-access/',
+      description: 'Easy access to all your infrastructure on a foundation of cryptographic identity',
+      iconColor: '#EEEAFA',
+      iconComponent: zeroTrustSvg,
+      features: [
+        {
+          title: 'Enroll and Protect Your Infrastructure',
+          description: 'Apps, servers, databases, Kubernetes clusters, desktops, & more',
+          href: './enroll-resources/'
+        },
+        {
+          title: 'VNet: Build without VPNs',
+          description: 'Secure app & SSH access with no VPNs or proxies',
+          href: './enroll-resources/application-access/vnet/'
+        },
+        {
+          title: 'Secure MCP (Protect the Vibes)',
+          description: 'Secure MCP integration with granular audit trail',
+          href: './connect-your-client/model-context-protocol/'
+        },
+        {
+          title: 'Role-Based Access Control (RBAC)',
+          description: 'Govern infrastructure access with granular permissions',
+          href: './zero-trust-access/rbac-get-started/'
+        },
+        {
+          title: 'Passwordless Authentication',
+          description: 'Log in securely using biometrics',
+          href: './zero-trust-access/authentication/passwordless'
+        },
+        {
+          title: 'Integrate with SSO Providers',
+          description: 'Connect Okta, Entra ID, Google, and more',
+          href: './zero-trust-access/sso/'
+        },
+        {
+          title: 'Structured Audit Export',
+          description: 'Forward audit logs to SIEMs like Splunk and Datadog',
+          href: './zero-trust-access/export-audit-events/'
+        },
+        {
+          title: 'Identity-Based Audit Events',
+          description: 'Detailed audit logs for every user action',
+          href: './reference/deployment/monitoring/audit/'
+        },
+        {
+          title: 'Session Recording and Playback',
+          description: 'Record a detailed review of what took place',
+          href: './reference/architecture/session-recording/'
+        },
+        {
+          title: 'Session Sharing and Moderation',
+          description: 'Require a moderator for privileged sessions',
+          href: './zero-trust-access/authentication/joining-sessions/'
+        },
+        {
+          title: 'Manage Clusters with IaC',
+          description: 'Create, update, and manage Teleport in declarative code.',
+          href: './zero-trust-access/infrastructure-as-code/'
+        }
+      ]
+    },
+    {
+      id: 'machine-workload-identity',
+      title: 'Machine and Workload Identity',
+      href: './machine-workload-identity/',
+      description: 'Replace long-lived secrets with identity-based authentication and authorization',
+      iconColor: '#EEEAFA',
+      iconComponent: mwiSvg,
+      features: [
+        {
+          title: 'Intro to Machine & Workload ID',
+          description: 'Replace long-lived secrets with identity-based auth',
+          href: './machine-workload-identity/'
+        },
+        {
+          title: 'Deploy CI/CD Pipelines',
+          description: 'Replace long-lived secrets in CI/CD pipelines',
+          href: './machine-workload-identity/deployment/#cicd'
+        },
+        {
+          title: 'Secure Infrastructure as Code',
+          description: 'Manage IaC workflows in Terraform and Pulumi',
+          href: './zero-trust-access/infrastructure-as-code/terraform-provider/'
+        },
+        {
+          title: 'Hybrid & Multi-Cloud Authentication',
+          description: 'Universal identities across cloud platforms',
+          href: './machine-workload-identity/use-cases/hybrid-multi-mwi/'
+        },
+        {
+          title: 'Workload to Workload Authentication',
+          description: 'Service-to-service auth with mTLS',
+          href: './machine-workload-identity/use-cases/workload-mwi/'
+        },
+        {
+          title: 'Identity Management for AI Agents',
+          description: 'RBAC for autonomous agents and processes',
+          href: './machine-workload-identity/workload-identity/introduction/'
+        }
+      ]
+    },
+    {
+      id: 'identity-governance',
+      title: 'Identity Governance',
+      href: './identity-governance/',
+      description: 'Manage on-demand access, privileges, and compliance for all your infrastructure.',
+      iconColor: '#EEEAFA',
+      iconComponent: identityGovernanceSvg,
+      features: [
+        {
+          title: 'Request Temporary Elevated Access',
+          description: 'Eliminate standing privileges w/ just-in-time access',
+          href: './identity-governance/access-requests/'
+        },
+        {
+          title: 'Manage Standing Access for Teams',
+          description: 'Sync IdP groups to roles w/ automated reviews',
+          href: './identity-governance/integrations/okta/app-and-group-sync/'
+        },
+        {
+          title: 'Require Managed Devices for Access',
+          description: 'Guarantee access only from trusted devices',
+          href: './identity-governance/device-trust/'
+        },
+        {
+          title: 'Instantly Lock Identities & Sessions',
+          description: 'Lock compromised users and resources',
+          href: './identity-governance/locking/'
+        },
+        {
+          title: 'Integrate with your Identity Provider(s)',
+          description: 'Okta, Entra ID, and Sailpoint with SCIM group sync',
+          href: './identity-governance/integrations/'
+        },
+        {
+          title: 'Configure Teleport as an Identity Provider',
+          description: 'Use Teleport as a SAML IdP to 3rd-party apps',
+          href: './identity-governance/idps/'
+        },
+      ]
+    },
+    {
+      id: 'identity-security',
+      title: 'Identity Security',
+      href: './identity-security/',
+      description: 'Visualize access paths and identify security risks across your infrastructure',
+      iconColor: '#EEEAFA',
+      iconComponent: identitySecuritySvg,
+      features: [
+        {
+          title: 'Expose Hidden Access Risks',
+          description: 'Scan for SSH keys, repo access, and more',
+          href: './identity-security/integrations/ssh-keys-scan'
+        },
+        {
+          title: 'Identify Over-Privileged Users',
+          description: 'Identify users with excessive standing privileges',
+          href: './identity-security/usage/dashboard'
+        },
+        {
+          title: 'Monitor Changes to Critical Resources',
+          description: 'Monitor, alert on, and visualize access changes',
+          href: './identity-security/usage/crown-jewels'
+        },
+        {
+          title: 'Centralize Visibility Across Systems',
+          description: 'Centralize visibility into identities and access across Okta, AWS, GitHub, and more',
+          href: './identity-security/integrations/'
+        },
+        {
+          title: 'Query Roles, Groups, & Permissions',
+          description: 'Create custom tailored queries w/the SQL Editor',
+          href: './identity-security/usage/sql-editor'
+        }
+      ]
+    }
+  ]}
+/>
 
-Teleport Zero Trust Access uses cryptographic identity to provide engineers with
-just-in-time, least-privileged access to applications, servers, databases,
-Kubernetes clusters, and other resources across distributed infrastructure. 
+<VersionHighlights
+  title="What's new in version 18"
+  highlights={[
+    {
+      title: "MCP server access",
+      description: "Teleport now provides the ability to connect to stdio-based MCP servers with connection proxying and audit logging support.",
+      tag: "Zero Trust Access",
+      href: "./connect-your-client/model-context-protocol/mcp-access/",
+    },
+    {
+      title: "MCP for database access",
+      description: "Teleport now allows MCP clients such as Claude Desktop to execute queries in Teleport-protected databases.",
+      tag: "Zero Trust Access",
+      href: "./connect-your-client/model-context-protocol/database-access/",
+    },
+  ]}
+/>
 
-Get started with Teleport Zero Trust Access:
+<Resources
+  resources={[
+    {
+      title: 'Applications',
+      description: 'Protect web apps, TCP apps, and Cloud APIs',
+      iconComponent: applicationSvg,
+      href: './enroll-resources/application-access/'
+    },
+    {
+      title: 'Linux Servers',
+      description: 'Secure Linux servers and OpenSSH servers',
+      iconComponent: linuxServersSvg,
+      href: './enroll-resources/server-access/'
+    },
+    {
+      title: 'Databases',
+      description: 'AWS, Azure, Google Cloud, cloud DB platforms, & more',
+      iconComponent: databaseSvg,
+      href: './enroll-resources/database-access/'
+    },
+    {
+      title: 'Kubernetes Clusters',
+      description: 'Kubernetes clusters and the apps running in them',
+      iconComponent: kubernetesClustersSvg,
+      href: './enroll-resources/kubernetes-access/'
+    },
+    {
+      title: 'Windows Desktops',
+      description: 'With or without Active Directory',
+      iconComponent: windowsDesktopsSvg,
+      href: './enroll-resources/desktop-access/'
+    },
+    {
+      title: 'Auto-Discovery of Resources',
+      description: 'SSH servers, databases, Kubernetes clusters and apps',
+      iconComponent: autoDiscoverySvg,
+      href: './enroll-resources/auto-discovery/'
+    },
+    {
+      title: 'Cloud Providers',
+      description: 'AWS, Azure, and Google Cloud consoles and CLI',
+      iconComponent: cloudProvidersSvg,
+      href: './enroll-resources/application-access/cloud-apis/'
+    },
+    {
+      title: 'MCP and AI Agents',
+      description: 'Secure agentic AI connections to databases & MCP servers',
+      iconComponent: mcpAndAiSvg,
+      href: './enroll-resources/mcp-access/'
+    }
+  ]}
+/>
 
-- [Enroll resources](enroll-resources/agents/agents.mdx) to protect with Teleport using
-  cryptographic identity.
-- [Set up passwordless authentication](admin-guides/access-controls/guides/passwordless.mdx)
-  to enable users to access resources with hardware keys, including biometric
-  credentials like Touch ID and YubiKey Bio.
-- [Integrate your Single Sign-On provider](admin-guides/access-controls/sso/sso.mdx): Allow users
-  to access infrastructure resources with IdPs like Okta.
-- [Use Teleport as an identity provider](admin-guides/access-controls/idps/saml-guide.mdx) to
-  authenticate to external services.
-
-### Teleport Machine & Workload Identity
-
-Teleport Machine & Workload Identity is a solution for non-human identity
-management and access control, improving infrastructure resiliency by securing
-system and data access between machines and workloads.
-
-Get started with Teleport Machine & Workload Identity:
-
-- [Issue and govern identities for automated systems](enroll-resources/machine-id/introduction.mdx) using Teleport Machine Identity.
-- Replace long-lived API keys and environment secrets that are vulnerable to breaches, mistakes, and exfiltration with short-lived cryptographic identities using x.509 certificates or JWTs via [Teleport Workload Identity](enroll-resources/workload-identity/introduction.mdx).
-
-### Teleport Identity Governance
-
-Teleport Identity Governance hardens and monitors identities for both human and
-non-human identities, improving resiliency of infrastructure from compromise due
-to human factor or identity attacks.
-
-Get started with Teleport Identity Governance:
-
-- [Access Requests](admin-guides/access-controls/access-requests/access-requests.mdx): Temporarily
-  provision minimal privileges to complete a task.
-- [Access Lists](admin-guides/access-controls/access-lists/access-lists.mdx): Regularly audit and
-  control membership to specific roles and traits, which then tie easily back
-  into Teleport's existing RBAC system.
-- [Device Trust](admin-guides/access-controls/device-trust/device-trust.mdx): Require an up-to-date,
-  registered device for each authentication by giving every device a
-  cryptographic identity. 
-- [Session & Identity Locks](admin-guides/access-controls/guides/locking.mdx): Lock
-  suspicious or compromised identities and stop all their activity across all
-  protocols and services.
-- [Access Monitoring](admin-guides/access-controls/access-monitoring.mdx): Detect overly
-  broad privileges and inspect sessions that are not using strong protection,
-  such as multi-factor authentication and Device Trust.
-
-### Teleport Identity Security
-
-**Teleport Identity Security** secures identities and access policies across all
-of your infrastructure. It detects standing privileges and eliminates shadow
-access and blind spots. 
-
-- Get started with [Teleport Identity Security](admin-guides/teleport-policy/teleport-policy.mdx).
-- Define [Crown Jewels](admin-guides/teleport-policy/crown-jewels.mdx) so you can track changes to your most sensitive users and resources.
-- Enable [Teleport Identity Security integrations](admin-guides/teleport-policy/integrations/integrations.mdx) so you can identify [insecure SSH key distributions](admin-guides/teleport-policy/integrations/ssh-keys-scan.mdx), and import RBAC rules from AWS, Entra ID, and other sources to visualize your entire RBAC configuration on a single screen. 
-
-## Architecture
-
-The Teleport Infrastructure Identity Platform consists of a certificate authority and
-identity-aware access proxy that run either on the Teleport-managed cloud or, in
-special cases, a self-hosted private network. 
-
-Teleport Agents, which can run on Linux servers or Kubernetes, proxy access to
-infrastructure resources and cloud provider APIs. Users authenticate to
-infrastructure resources through Teleport Agents using short-lived certificates.
-Teleport Agents enforce role-based access controls by using certificates that embed user attributes.
-
-Learn more:
-
-- [Teleport Core Concepts](./core-concepts.mdx)
-- [Architecture Guides](./reference/architecture/architecture.mdx)
+<Integrations 
+  integrations={[
+    {
+      title: 'AWS',
+      href: 'https://goteleport.com/integrations#aws',
+      iconColor: '#FF99001A',
+      iconComponent: awsSvg,
+    },
+    {
+      title: 'GCP',
+      href: 'https://goteleport.com/integrations#google-cloud-platform-(gcp)',
+      iconColor: '#EA43351A',
+      iconComponent: gcpSvg,
+    },
+    {
+      title: 'Azure',
+      href: 'https://goteleport.com/integrations#microsoft-azure',
+      iconColor: '#0078D41A',
+      iconComponent: azureSvg,
+    },
+    {
+      title: 'Okta',
+      href: './identity-governance/integrations/okta/',
+      iconColor: '#0000001A',
+      iconComponent: oktaSvg,
+    },
+    {
+      title: 'Slack',
+      href: './identity-governance/access-requests/plugins/slack/',
+      iconColor: '#ECB22E1A',
+      iconComponent: slackSvg,
+    },
+    {
+      title: 'PagerDuty',
+      href: './identity-governance/access-requests/plugins/pagerduty/',
+      iconColor: '#06AC381A',
+      iconComponent: pagerDutySvg,
+    },
+    {
+      title: 'Jamf Pro',
+      href: './identity-governance/device-trust/jamf-integration/',
+      iconColor: '#788EB11A',
+      iconComponent: jamfProSvg,
+    },
+    {
+      title: 'Jenkins',
+      href: './machine-workload-identity/deployment/jenkins/',
+      iconColor: '#D338331A',
+      iconComponent: jenkinsSvg,
+    },
+    {
+      title: 'Snowflake',
+      href: './enroll-resources/database-access/enrollment/managed/snowflake/',
+      iconColor: '#29B5E81A',
+      iconComponent: snowflakeSvg,
+    }, 
+    {
+      title: 'View all Integrations',
+      href: 'https://goteleport.com/integrations',
+      iconComponent: arrowRightSvg,
+    },
+  ]}
+/>
diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx
deleted file mode 100644
index d5eb374bb10a3..0000000000000
--- a/docs/pages/installation.mdx
+++ /dev/null
@@ -1,959 +0,0 @@
----
-title: Installing Teleport
-description: How to install Teleport and Teleport's client tools on your platform, including binaries and instructions for Docker and Helm.
-h1: Installation
-videoBanner: fjk29wqXm1A
-tocDepth: 3
----
-
-This guide shows you how to install Teleport binaries on your platform,
-including:
-- `teleport`
-- `teleport-update`
-- `tsh`
-- `tctl`
-- `tbot`
-- `fdpass-teleport`
-
-If you are new to Teleport, we recommend following our [getting started
-guide](./get-started.mdx).
-
-For best results, Teleport clients (`tsh`, `tctl`, `tbot`) should be the same major
-version as the cluster they are connecting to. Teleport servers are compatible
-with clients that are on the same major version or one major version older.
-Teleport servers do not support clients that are on a newer major version.
-
-See our [Upgrading](upgrading/upgrading.mdx) guide for more information.
-
-
-## Operating system support
-
-Teleport is officially supported on the platforms listed below. It is worth
-noting that the open-source community has been successful in building and
-running Teleport on UNIX variants other than Linux \[1].
-
-| Operating System | `teleport` Daemon | `tctl` Admin Tool | `tsh` and Teleport Connect User Clients [2] | Web UI (via the browser) | `tbot` Daemon |
-| - | - | - | - | - | - |
-| Linux v2.6.23+ (RHEL/CentOS 7+, Rocky Linux 8+, Amazon Linux 2+, Amazon Linux 2023+, Ubuntu 16.04+, Debian 9+, SLES 12 SP 5+, and SLES 15 SP 5+) \[3] | yes | yes | yes | yes | yes |
-| macOS 11+  (Big Sur)| yes | yes | yes | yes | yes |
-| Windows 10+ (rev. 1607) \[4] | no | yes | yes | yes | yes |
-
-\[1] *Teleport is written in Go and many of these system requirements are due to the requirements
-of the [Go toolchain](https://github.com/golang/go/wiki/MinimumRequirements)*.
-
-\[2] *`tsh` is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See
-  [Using Teleport Connect](connect-your-client/teleport-connect.mdx) for usage and installation*.
-
-\[3] *Enhanced Session Recording requires Linux kernel v5.8+*.
-
-\[4] *Teleport server does not run on Windows yet, but `tsh`, `tbot`, `tctl`, and Teleport Connect (the Teleport desktop clients)
-support most features on Windows 10 and later.*
-
-## Linux
-
-This section shows you how to install Teleport binaries on a single Linux
-server.
-
-Teleport maintains DEB and RPM package repositories for different operating
-systems, platforms, and Teleport versions. A server that installs Teleport from
-a DEB or RPM package must have systemd installed. You can also download TAR
-archives containing Teleport binaries. All installations include `teleport`,
-`teleport-update`, `tsh`, `tctl`, `fdpass-teleport` and `tbot`.
-
-### Recommended installation steps
-
-If you are starting out with Teleport, we recommend beginning with a [Teleport
-Cloud](https://goteleport.com/signup/) account. From there, the only Teleport
-components you need to deploy yourself are Teleport Agents. You can deploy
-agents by:
-- Following the instructions in the Teleport Web UI at `/web/discover`, where
-  you can select a resource to enroll in your Teleport cluster and retrieve an
-  installation script to run on Linux hosts.
-- Using the example Terraform module for deploying agents in [Deploy Agents with
-  Terraform](admin-guides/infrastructure-as-code/terraform-starter/enroll-resources.mdx).
-- Running the [one-line installation script](#one-line-installation-script) on
-  each Linux server where you want to install a Teleport Agent.
-
-If you are running a self-hosted Teleport Enterprise cluster, read our guidance
-in [Deploying a High-Availability Teleport
-Cluster](admin-guides/deploy-a-cluster/deploy-a-cluster.mdx), which provides full requirements
-and Terraform modules for deploying Teleport Enterprise on your infrastructure.
-
-Self-hosted Teleport Enterprise clusters require a license file. Read [Teleport
-Enterprise License File](admin-guides/deploy-a-cluster/license.mdx)
-for how to manage this.
-
-### Teleport configuration file
-
-Note that the methods for installing Teleport on a Linux server do not generate
-a Teleport configuration file for you. You must create the file before starting
-Teleport on your server. If you install Teleport with the one-line installation
-script or a package manager, you must create your configuration file at
-`/etc/teleport.yaml`.
-
-See the following guides for help setting up a configuration file:
-
-- [Enroll Resources](./enroll-resources/enroll-resources.mdx): Guides to setting
-  up Teleport Agents in order to enroll infrastructure resources in your cluster. These
-  guides include examples of setting up Teleport configuration files.
-- [Self-Hosted Demo
-  Cluster](./admin-guides/deploy-a-cluster/deploy-a-cluster.mdx): If you are
-  deploying the Teleport Auth Service and Proxy Service, read this guide for an
-  example of a configuration file.
-- [Teleport Configuration Reference](./reference/config.mdx): A guide to all
-  configuration fields.
-
-### One-line installation script
-
-You can run a one-line command to install Teleport binaries on a Linux server.
-The command takes the Teleport version and edition to install, then uses
-information about the operating system where it runs to choose a package manager
-and install Teleport.
-
-The easiest installation method, for Teleport versions 17.3 and above, is the
-cluster install script. It will use the best version, edition, and installation
-mode for your cluster.
-
-1. Assign <Var name="example.teleport.sh:443"/> to your Teleport cluster hostname and Web UI port.
-   This should contain you cluster hostname and port, but not the scheme (https://).
-1. Run your cluster's install script:
-   ```code
-   $ curl "https://<Var name="example.teleport.sh:443"/>/scripts/install.sh" | sudo bash
-   ```
-
-If you are running older Teleport versions you must manually assign environment
-variables based on your edition:
-
-<Tabs>
-<TabItem label="Teleport Enterprise (Managed)">
-
-The following commands show you how to determine the Teleport version to install
-by querying your Teleport Cloud account. This way, the Teleport installation has
-the same major version as the service that manages automatic updates. Assign
-<Var name="example.teleport.sh" /> to your Teleport cluster address:
-
-```code
-$ TELEPORT_EDITION="cloud"
-$ TELEPORT_DOMAIN=<Var name="example.teleport.sh" />
-$ TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/stable/cloud/version | sed 's/v//')"
-```
-
-</TabItem>
-<TabItem label="Teleport Enterprise (Self-Hosted)">
-
-```code
-$ TELEPORT_EDITION="enterprise"
-$ TELEPORT_VERSION="(=teleport.version=)"
-```
-
-</TabItem>
-<TabItem label="Teleport Community Edition">
-
-```code
-$ TELEPORT_EDITION="oss"
-$ TELEPORT_VERSION="(=teleport.version=)"
-```
-
-</TabItem>
-</Tabs>
-
-Then, download and run the generic installation script on the server where you
-want to install Teleport:
-
-```code
-$ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION?} ${TELEPORT_EDITION?}
-```
-
-### Package repositories
-
-The [one-line installation script](#one-line-installation-script) automatically
-detects a package manager on the local system and uses it to install Teleport
-from an upstream repository.
-
-If your system does not support the one-line installation script, read the
-instructions in this section for instructions on working with Teleport package
-repositories.
-
-1. Assign the following environment variables in the terminal where you will run
-   Teleport installation commands, indicating the package and version to
-   install:
-
-   <Tabs>
-   <TabItem label="Teleport Enterprise (Managed)">
-
-   Teleport Cloud installations must include the automatic agent updater. The
-   following commands show you how to determine the Teleport version to install
-   by querying your Teleport Cloud account. This way, the Teleport installation
-   has the same major version as the service that conducts automatic updates:
-
-   ```code
-   $ export TELEPORT_DOMAIN=<Var name="example.teleport.sh" />
-   $ export TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/stable/cloud/version | sed 's/v//')"
-   $ export TELEPORT_PKG="teleport-ent-${TELEPORT_VERSION?} teleport-ent-updater"
-   $ export TELEPORT_CHANNEL=stable/cloud
-   ```
-
-   If you are installing Teleport on Debian or Ubuntu, `TELEPORT_PKG` is
-   slightly different:
-
-   ```code
-   $ export TELEPORT_PKG="teleport-ent=${TELEPORT_VERSION?} teleport-ent-updater"
-   ```
-
-   </TabItem>
-   <TabItem label="Teleport Enterprise (Self-Hosted)">
-
-   ```code
-   $ export TELEPORT_PKG=teleport-ent
-   $ export TELEPORT_VERSION=v(=teleport.major_version=)
-   $ export TELEPORT_CHANNEL=stable/${TELEPORT_VERSION?}
-   ```
-
-   For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
-
-   ```code
-   $ export TELEPORT_PKG=teleport-ent-fips
-   ```
-
-   </TabItem>
-   <TabItem label="Teleport Community Edition">
-
-   ```code
-   $ export TELEPORT_PKG=teleport
-   $ export TELEPORT_VERSION=v(=teleport.major_version=)
-   $ export TELEPORT_CHANNEL=stable/${TELEPORT_VERSION?}
-   ```
-
-   </TabItem>
-   </Tabs>
-
-1. Teleport maintains DEB and RPM package repositories for different Linux
-   distributions based on variables defined in `/etc/os-release` on Linux
-   systems. Source this file to define the variables:
-
-   ```code
-   $ source /etc/os-release
-   ```
-
-1. Make sure the value of the `ID` environment variable is supported.
-
-   The Teleport DEB and RPM repositories don't expose packages for all
-   distribution variants. When installing Teleport using RPM repositories, you
-   may need to replace the `ID` variable set in `/etc/os-release` with `ID_LIKE`
-   to install packages of the closest supported distribution.
-
-   Currently supported distributions (and `ID` values) are:
-
-   | Distribution | Version              | `ID` value in `/etc/os-release` |
-   |--------------|----------------------|---------------------------------|
-   | Amazon Linux | 2 and 2023           | `amzn`                          |
-   | CentOS       | >= 7                 | `centos`                        |
-   | Debian       | >= 9                 | `debian`                        |
-   | RHEL         | >= 7                 | `rhel`                          |
-   | Rocky Linux  | >= 8                 | `rocky`                         |
-   | SLES         | >= 12 SP5, >= 15 SP5 | `sles`                          |
-   | Ubuntu       | >= 16.04             | `ubuntu`                        |
-
-   Note that [Enhanced Session
-   Recording](./enroll-resources/server-access/guides/bpf-session-recording.mdx) requires Linux
-   kernel version 5.8+. This means that it requires more recent OS versions than
-   other Teleport features:
-
-   | Distribution | Version                  |
-   |--------------|--------------------------|
-   | Amazon Linux | 2 (post 11/2021), 2023   |
-   | CentOS/RHEL  | 9+                       |
-   | Rocky Linux  | 8+                       |
-   | Debian       | 11, or 10 with backports |
-   | Ubuntu       | 20.042+                  |
-
-   If the value of `ID` is not in the list above, look up the space-separated
-   values of the `ID_LIKE` variable you sourced from `/etc/os-release` and see
-   if one of them appears in the list.
-
-1. Follow the instructions for your package manager:
-
-   <Tabs>
-   <TabItem label="apt">
-
-   ```code
-   $ sudo mkdir -p /etc/apt/keyrings
-   # Download the Teleport PGP public key
-   $ sudo curl https://apt.releases.teleport.dev/gpg \
-   -o /etc/apt/keyrings/teleport-archive-keyring.asc
-   # Add the Teleport APT repository. You'll need to update this file for each
-   # major release of Teleport.
-   $ echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \
-   https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} \
-   ${TELEPORT_CHANNEL?}" \
-   | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-
-   $ sudo apt-get update
-   $ sudo apt-get install ${TELEPORT_PKG?}
-   ```
-
-   </TabItem>
-
-   <TabItem label="yum">
-
-   ```code
-   # Add the Teleport YUM repository. You'll need to update this file for each
-   # major release of Teleport.
-   # First, get the major version from $VERSION_ID so this fetches the correct
-   # package version.
-   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-   $ sudo yum install -y yum-utils
-   $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport.repo")"
-   $ sudo yum install ${TELEPORT_PKG?}
-   #
-   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-   ```
-
-   </TabItem>
-
-   <TabItem label="zypper">
-
-   ```code
-   # Add the Teleport Zypper repository. You'll need to update this file for each
-   # major release of Teleport.
-   # First, get the OS major version from $VERSION_ID so this fetches the correct
-   # package version.
-   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-   # Use zypper to add the teleport RPM repo
-   $ sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport-zypper.repo")
-   $ sudo zypper --gpg-auto-import-keys refresh teleport
-   $ sudo zypper install ${TELEPORT_PKG?}
-   #
-   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-   ```
-
-   </TabItem>
-
-   <TabItem label="dnf">
-
-   ```code
-   # Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
-   # file for each major release of Teleport.
-   # First, get the major version from $VERSION_ID so this fetches the correct
-   # package version.
-   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
-   # Install dnf config-manager
-   $ sudo yum install -y yum-utils
-   # Use the dnf config manager plugin to add the teleport RPM repo
-   $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport.repo")"
-
-   # Install teleport
-   $ sudo dnf install ${TELEPORT_PKG}
-
-   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-   ```
-
-   </TabItem>
-   </Tabs>
-
-### Downloading packages and TAR archives
-
-Teleport maintains TAR archives as well as DEB and RPM packages for
-Linux-compatible binaries at `https://cdn.teleport.dev`. This section explains
-how to install Teleport by manually downloading a release.
-
-The original (v1) Teleport updater is not compatible with this method.
-If you use cloud-hosted Teleport, you must use `teleport-update` to manage
-your Teleport installation. We recommend using the [one-line installation
-script](#one-line-installation-script).
-
-1. In your terminal, assign environment variables that you will use to download
-   your intended archive.
-
-   For Teleport Community Edition, the Teleport package is called `teleport`:
-
-   ```code
-   $ TELEPORT_PKG=teleport
-   ```
-
-   For self-hosted Teleport Enterprise deployments, the package is called
-   `teleport-ent`:
-
-   ```code
-   $ TELEPORT_PKG=teleport-ent
-   ```
-
-1. Specify your system Teleport version and system architecture by assigning an
-   environment variable:
-
-   ```code
-   $ TELEPORT_VERSION=(=teleport.version=)
-   $ SYSTEM_ARCH=""
-   ```
-
-   The following architecture values are available:
-
-   - `amd64` (`x86_64` if downloading an RPM package)
-   - `arm64`
-   - `arm`
-   - `386` (`i386` if downloading a DEB or RPM package)
-
-1. Run the following commands to download a Teleport package or archive, unpack
-   it, and install binaries:
-
-   <Tabs>
-   <TabItem label="TAR">
-
-   ```code
-   $ curl https://cdn.teleport.dev/${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz
-   $ shasum --check -a 256 ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz
-   $ tar -xvf ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz
-   $ cd ${TELEPORT_PKG?}
-   $ sudo ./teleport-update enable --proxy example.teleport.sh # or sudo ./install for static installation
-   ```
-   </TabItem>
-   <TabItem label="DEB">
-
-   ```code
-   $ curl https://cdn.teleport.dev/${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb
-   $ shasum --check -a 256 ${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb
-   $ sudo dpkg -i ${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb
-   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
-   ```
-
-   </TabItem>
-   <TabItem label="RPM">
-
-   ```code
-   $ curl https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
-   $ shasum --check -a 256 https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
-   # Or use yum localinstall, dnf localinstall etc.
-   $ sudo rpm -i https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
-   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
-   ```
-
-   </TabItem>
-   </Tabs>
-
-   For FedRAMP/FIPS-compliant installations of Teleport Enterprise, package URLs
-   are slightly different:
-
-   <Tabs>
-   <TabItem label="TAR">
-
-   ```code
-   $ curl https://cdn.teleport.dev/teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz
-   $ shasum --check -a 256 teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz
-   $ tar -xvf teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz
-   $ cd teleport-ent
-   $ sudo ./teleport-update enable --proxy example.teleport.sh # or sudo ./install for static installation
-   ```
-   </TabItem>
-   <TabItem label="DEB">
-
-   FIPS builds are only available for the `arm64` and `amd64` system
-   architectures.
-
-   ```code
-   $ curl https://cdn.teleport.dev/teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb
-   $ shasum --check -a 256 teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb
-   $ sudo dpkg -i teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb
-   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
-   ```
-
-   </TabItem>
-   <TabItem label="RPM">
-
-   FIPS builds are only available for the `arm64` and `x86_64` system
-   architectures.
-
-   ```code
-   $ curl https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm.sha256
-   # <checksum> <filename>
-   $ curl -O https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm
-   $ shasum --check -a 256 https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm
-   # Or use yum localinstall, dnf localinstall etc.
-   $ sudo rpm -i https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm
-   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
-   ```
-
-   </TabItem>
-   </Tabs>
-
-### From your browser
-
-For Teleport Community Edition, check the
-[Downloads](https://goteleport.com/download/) page for the most up-to-date
-information.
-
-On cloud-hosted Teleport Enterprise you can visit a download page in the Web UI. Select the user name
-in the upper right and select Downloads from the menu.
-
-Customers who self-host Teleport Enterprise can access Enterprise downloads and their license
-file from their [dedicated account dashboard](./admin-guides/deploy-a-cluster/license.mdx).
-
-## Docker
-
-### Images
-
-We provide a pre-built Docker image for every version of Teleport. This section
-describes the available Docker images.
-
-These images are hosted on [Amazon ECR
-Public](https://gallery.ecr.aws/gravitational).
-
-#### Image suffixes
-
-For each of the image names listed in this section, you can specify attributes
-of the image by appending a suffix to the repository name or tag.
-
-Images with the `-distroless` suffix within the repository name include only the
-`teleport` binary and its runtime dependencies, with no shell or utility
-applications. An example is `public.ecr.aws/gravitational/teleport-distroless`
-for Teleport Community Edition.
-
-Images with the `*-distroless-debug` suffix within the repository name include a
-Busybox shell and tool suite in addition to Teleport, and are intended for
-troubleshooting deployments only. They are not intended for production use. An
-example is `public.ecr.aws/gravitational/teleport-distroless-debug`.
-
-`*-distroless` and `*-distroless-debug` images support multiple architectures
-natively, and do not require (or support) image suffixes. You can specify an
-architecture using the `--platform` flag of `docker pull` to pull the `arm`,
-`arm64` or `amd64` version of an image.
-
-#### Version tags
-
-Images point to a static version of Teleport. Use the image's tag to specify
-either:
-
-- The major, minor, and patch version (e.g., `(=teleport.version=)` for the
-  latest version of Teleport Community Edition).
-- The major version only, which implies the latest minor and patch numbers for
-  that major version. For example, `(=teleport.major_version=)` implies
-  `(=teleport.version=)`.
-
-<Tabs>
-<TabItem label="Teleport Enterprise (Managed)" scope={["team", "cloud"]}>
-
-| Image name | Includes troubleshooting tools | Image base |
-| - | - | - |
-| `public.ecr.aws/gravitational/teleport-ent-distroless:(=cloud.version=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-| `public.ecr.aws/gravitational/teleport-ent-distroless-debug:(=cloud.version=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-
-For testing, we always recommend that you use the latest Cloud release version of
-Teleport Enterprise, which is currently `public.ecr.aws/gravitational/teleport-ent-distroless:(=cloud.version=)`.
-
-</TabItem>
-<TabItem label="Teleport Enterprise (Self-Hosted)" scope={["enterprise"]}>
-
-| Image name | Includes troubleshooting tools | Image base |
-| - | - | - |
-| `(=teleport.latest_ent_docker_image=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-| `(=teleport.latest_ent_debug_docker_image=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-
-We also provide the following images for FIPS builds of Teleport Enterprise:
-
-| Image name | Includes troubleshooting tools | Image base |
-| - | - | - |
-| `public.ecr.aws/gravitational/teleport-ent-fips-distroless:(=teleport.version=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-| `public.ecr.aws/gravitational/teleport-ent-fips-distroless-debug:(=teleport.version=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-
-For testing, we always recommend that you use the latest release version of
-Teleport Enterprise, which is currently `(=teleport.latest_ent_docker_image=)`.
-
-</TabItem>
-<TabItem label="Teleport Community Edition" scope={["oss"]}>
-
-|Image name|Troubleshooting Tools?|Image base|
-|-|-|-|
-|`(=teleport.latest_oss_docker_image=)`|No|[Distroless Debian 12](https://github.com/GoogleContainerTools/distroless)|
-|`(=teleport.latest_oss_debug_docker_image=)`|Yes|[Distroless Debian 12](https://github.com/GoogleContainerTools/distroless)|
-
-For testing, we always recommend that you use the latest release version of
-Teleport, which is currently `(=teleport.latest_oss_docker_image=)`.
-
-</TabItem>
-</Tabs>
-
-#### Interacting with distroless images
-
-Since version 15, Teleport images are based on Google's [Distroless](https://github.com/GoogleContainerTools/distroless) images.
-Those images don't contain any shell.
-
-To execute Teleport commands on containers based on these images, run commands similar to the following:
-
-```code
-# in docker
-$ docker run -i my-container tctl status
-
-# in Kubernetes
-$ kubectl exec -i my-pod -- tctl status
-
-# sending local files via stdin
-$ kubectl exec -i my-pod -- tctl create -f < my-local-file.yaml
-
-# retrieving the teleport service config file from the configmap
-$ kubectl get configmap teleport-cluster-auth -o jsonpath="{.data['teleport\.yaml']}"
-
-# retrieving output via stdout and tar
-$ kubectl exec -i my-pod -- tctl auth sign --user admin --format tls --ttl 10m --tar -o admin| tar xv -C local
-$ ls -l local
-total 24
--rw-------  1 trent  staff  1318 Jul 24 15:52 admin.cas
--rw-------  1 trent  staff  1895 Jul 24 15:52 admin.crt
--rw-------  1 trent  staff  1679 Jul 24 15:52 admin.key
-```
-
-Alternatively, you can use the debug variant of the image, which contains [busybox](https://www.busybox.net/about.html) and a minimal shell invocable via `busybox sh`:
-
-```code
-$ docker run -it --entrypoint="" (=teleport.latest_oss_debug_docker_image=) busybox sh
-```
-
-#### Machine ID (tbot)
-
-We also provide a slimmed down distroless image that only contains the `tbot`
-binary for use with Teleport Machine ID.
-
-| Image name                                                               | FIPS Support | Image base                                                                 |
-|--------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------|
-| `public.ecr.aws/gravitational/tbot-distroless:(=teleport.version=)`      | No           | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-| `public.ecr.aws/gravitational/tbot-fips-distroless:(=teleport.version=)` | Yes          | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
-
-The version tagging follows the same pattern as the main `teleport-distroless`
-image.
-
-Whilst the `teleport-distroless` image also includes `tbot`, using the `tbot`
-specific image should be preferred for Machine ID deployments. This image is
-smaller, improving pull times, and has a smaller attack surface. In addition,
-the image is customized in order to improve the experience of running `tbot` in a
-container environment.
-
-To learn more, read the
-[Deploying Machine ID on Kubernetes](./enroll-resources/machine-id/deployment/kubernetes.mdx)
-guide.
-
-### Running Teleport on Docker
-
-When running a container from one of the images listed above, consider the
-container equivalent to running the `teleport` binary. The Teleport container
-requires access to a file system and network ports.
-
-#### Configuration
-
-Teleport processes read their configuration from a local file path, which is
-`/etc/teleport.yaml` by default. Make sure this file path is mounted to your
-Teleport container.
-
-#### Data directory
-
-All Teleport processes read from and write to a data directory, which by default
-is `/var/lib/teleport`. Make sure the data directory is mounted to your Teleport
-container.
-
-#### License file
-
-If your Teleport Enterprise container runs the Auth Service, you will need to
-give it access to a license file at the path named in the configuration, which
-is `/var/lib/teleport/license.pem` by default. Make sure a license exists at
-this location in the Teleport container's data directory.
-
-#### Other file paths
-
-Depending on the configuration settings you assign on your Teleport container,
-you will need to make sure that any file paths you name are mounted on the
-container.
-
-For example, if you are running the Teleport Proxy Service on a container, you
-need to mount the directory containing TLS credentials to your Teleport
-container, then assign the following fields in the container's configuration
-file to the appropriate paths:
-
-```yaml
-proxy_service:
-  https_keypairs:
-  - key_file: /my/path/key.pem
-    cert_file: /my/path/cert.pem
-```
-
-See the Teleport [Configuration Reference](reference/config.mdx) for whether a
-field you would like to assign requires a file path.
-
-#### Ports
-
-A single Teleport process can run multiple services, each of which listens on a
-specific set of ports depending on your configuration. See our [Networking
-Reference](reference/networking.mdx#ports) for the ports on your Teleport
-container to expose.
-
-#### Extracting certificates from distroless images
-
-Extracting certificates created with `tctl auth sign` from a container running
-a distroless image can be tricky due to the absence of a shell and other OS tools.
-
-Where possible you should log into the Teleport cluster using `tsh` and use
-`tctl auth sign` locally to generate certificates. This way the action will be
-logged against your Teleport user and be subject to all of the usual Teleport
-RBAC policies in your cluster.
-
-If this is not possible, use `tctl auth sign --tar` to collect all the files
-generated by `tctl auth sign` into a `tar` archive, which is streamed directly
-to `stdout`. The resulting certificates are never stored on the container
-filesystem. You can either pipe this output directly to `tar`, or redirect it
-to a local file for later use.
-
-For example:
-
-```code
-$ docker exec ${TELEPORT_CONTAINER} \
-  tctl auth sign --user alice --format tls -o alice.local --tar | tar xv
-x alice.local.crt
-x alice.local.key
-x alice.local.cas
-```
-
-### Example of running a Teleport container
-
-In this example, we will show you how to run the Teleport Auth Service and Proxy
-Service on a local Docker container using Teleport Community Edition.
-
-Since this container uses a self-signed certificate, we do not recommend using
-this configuration to protect any infrastructure outside your workstation. You
-can, however, join other local Docker containers to it using the [token
-method](enroll-resources/agents/join-token.mdx).
-
-First, create directories in your home directory to mount to the container. The
-Teleport container will write its configuration and data to these directories:
-
-```code
-$ mkdir -p ~/teleport/config ~/teleport/data
-```
-
-Run `teleport configure` from the Teleport container to generate a configuration
-file. This sets the container's name to `localhost` so your browser can trust
-the Proxy Service's self-signed TLS certificate:
-
-```code
-$ docker run --hostname localhost --rm \
-  --entrypoint=/usr/local/bin/teleport \
-  <Var name="(=teleport.latest_oss_docker_image=)" /> configure --roles=proxy,auth > ~/teleport/config/teleport.yaml
-```
-
-Start Teleport on your container:
-
-```code
-$ docker run --hostname localhost --name teleport \
-  -v ~/teleport/config:/etc/teleport \
-  -v ~/teleport/data:/var/lib/teleport \
-  -p 3025:3025 -p 3080:3080 \
-  <Var name="(=teleport.latest_oss_docker_image=)" />
-```
-
-From there, open another terminal and make sure your Teleport container's web
-API is functioning as intended:
-
-```code
-$ curl --insecure https://localhost:3080/webapi/ping
-```
-
-You should see JSON output similar to the following:
-
-```json
-{
-  "auth": {
-    "type": "local",
-    "second_factor": "otp",
-    "preferred_local_mfa": "otp",
-    "local": {
-      "name": ""
-    },
-    "private_key_policy": "none",
-    "device_trust_disabled": true,
-    "has_motd": false
-  },
-  "proxy": {
-    "kube": {
-      "enabled": true,
-      "listen_addr": "0.0.0.0:3080"
-    },
-    "ssh": {
-      "listen_addr": "0.0.0.0:3080",
-      "tunnel_listen_addr": "0.0.0.0:3080",
-      "web_listen_addr": "0.0.0.0:3080"
-    },
-    "db": {
-      "postgres_listen_addr": "0.0.0.0:3080",
-      "mysql_listen_addr": "0.0.0.0:3080"
-    },
-    "tls_routing_enabled": true
-  },
-  "server_version": "12.1.5",
-  "min_client_version": "11.0.0",
-  "cluster_name": "localhost",
-  "automatic_upgrades": false
-}
-```
-
-We are using the `--insecure` flag to trust Teleport's self-signed certificate.
-In production, you will want to provision TLS credentials to the Proxy Service
-from a trusted CA, e.g., Let's Encrypt.
-
-### Upgrading Teleport on Docker
-
-To upgrade a Teleport container running on Docker:
-
-1. Leave the container's data directory in place.
-1. Stop the container.
-1. Run a new container with an image based on a newer Teleport version, mounting
-   the data directory as you did while running the container initially. As long
-   as the data directory contains the same content as before the upgrade, the
-   Teleport container does not need to re-join the cluster.
-
-## Amazon EC2
-
-We provide pre-built `amd64` and `arm64` Amazon Linux 2023 based EC2 AMIs with
-Teleport pre-installed.
-
-These images are primarily intended for deploying a Teleport cluster using our
-[reference Terraform code](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform).
-
-See the [AWS Single-Instance Deployment](admin-guides/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx)
-and the [Running Teleport Enterprise in High Availability mode on AWS using Terraform](admin-guides/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx)
-guide for detailed usage examples.
-
-In order to use these AMIs outside of the reference Terraform, you can configure
-the Teleport installation by setting configuration variables in the
-`/etc/teleport.d/conf` file on the EC2 instance. See the [Starter Cluster Configuration Template](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster/data.tpl)
-for a list of the available configuration options.
-
-The image names all include the build timestamp (shown as `$TIMESTAMP` in the
-table below), and are tagged for easier searching.
-
-| Image name | Edition | Architecture | FIPS support | AMI Tags |
-| - | - | - | - | - |
-| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
-| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
-| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
-| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
-| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
-| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
-
-These AMIs are owned by AWS account ID `146628656107`.
-
-All images are based on Amazon Linux 2023 and have been hardened using the
-Amazon EC2 ImageBuilder [STIG](https://public.cyber.mil/stigs/) hardening
-component.
-
-Teleport AMIs are automatically published to all [non-opt-in AWS regions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions).
-
-## Helm
-
-Teleport maintains Helm charts for services and plugins, including self-hosted
-Auth Service and Proxy service deployments, Teleport Agents, the Event Handler,
-and Access Request plugins.
-
-Consult the [Helm chart reference](reference/helm-reference/helm-reference.mdx)
-for documentation on all available Helm charts.
-
-## macOS
-
-<Tabs>
-<TabItem label="Teleport Enterprise (Managed)">
-
-(!docs/pages/includes/cloud/install-macos.mdx!)
-
-</TabItem>
-<TabItem label="Teleport Enterprise (Self-Hosted)">
-
-(!docs/pages/includes/enterprise/install-macos.mdx!)
-
-</TabItem>
-<TabItem label="Teleport Community Edition">
-
-You can download one of the following .pkg installers for macOS:
-
-  |Link|Binaries|
-  |-|-|
-  |[`teleport-(=teleport.version=).pkg`](https://cdn.teleport.dev/teleport-(=teleport.version=).pkg)|`teleport`<br/>`tctl`<br/>`tsh`<br/>`tbot`<br/>`fdpass-teleport`|
-
-  You can also fetch an installer via the command line:
-
-  ```code
-  $ curl -O https://cdn.teleport.dev/teleport-(=teleport.version=).pkg
-  # Installs on Macintosh HD
-  $ sudo installer -pkg teleport-(=teleport.version=).pkg -target /
-  # Password:
-  # installer: Package name is teleport-(=teleport.version=)
-  # installer: Upgrading at base path /
-  # installer: The upgrade was successful.
-  $ which teleport
-  # /usr/local/bin/teleport
-  ```
-
-<Admonition type="danger">
-
-We do not recommend using Homebrew to install Teleport.  The Teleport package in
-Homebrew is not maintained by Teleport and we can't guarantee its reliability or
-security.
-
-</Admonition>
-
-</TabItem>
-</Tabs>
-
-## Windows (`tsh`, `tbot`, and `tctl` clients only)
-
-(!docs/pages/includes/install-windows.mdx!)
-
-## Building from source
-
-Teleport is written in Go, and currently requires **go v(=teleport.golang=)** or
-newer. Detailed instructions for building from source are available in the
-[README](https://github.com/gravitational/teleport#building-teleport).
-
-## Checksums
-
-If you want to verify the integrity of a Teleport binary, SHA256 checksums are
-available for all downloads on our
-[downloads page](https://goteleport.com/download/).
-
-![Teleport Checksum](../img/teleport-sha.png)
-
-If you download Teleport via an automated system, you can programmatically
-obtain the checksum by adding `.sha256` to the download link. This is the method
-shown in the installation examples.
-
-```code
-$ export version=v(=teleport.version=)
-# 'darwin' 'linux' or 'windows'
-$ export os=linux
-# '386' 'arm' on linux or 'amd64' for all distros
-$ export arch=amd64
-$ curl https://cdn.teleport.dev/teleport-$version-$os-$arch-bin.tar.gz.sha256
-# <checksum> <filename>
-```
-
-## Uninstalling Teleport
-
-If you wish to uninstall Teleport at any time, see our documentation on [Uninstalling Teleport](admin-guides/management/admin/uninstall-teleport.mdx).
-
-## Next steps
-
-Now that you know how to install Teleport, you can enable access to all of your
-infrastructure. Get started with enrolling resources in your Teleport cluster:
-
-- [SSH servers](enroll-resources/server-access/introduction.mdx)
-- [Kubernetes clusters](enroll-resources/kubernetes-access/introduction.mdx)
-- [Databases](enroll-resources/database-access/database-access.mdx)
-- [Applications](enroll-resources/application-access/introduction.mdx)
-- [Remote desktops](enroll-resources/desktop-access/introduction.mdx)
-- [Machine ID](enroll-resources/machine-id/introduction.mdx)
diff --git a/docs/pages/installation/amazon-ec2.mdx b/docs/pages/installation/amazon-ec2.mdx
new file mode 100644
index 0000000000000..f60b432232fab
--- /dev/null
+++ b/docs/pages/installation/amazon-ec2.mdx
@@ -0,0 +1,45 @@
+---
+title: Installing Teleport on Amazon EC2
+description: Deploy Teleport on Amazon EC2 using pre-built AMIs with Teleport pre-installed, either with Terraform or manual configuration.
+tags:
+ - platform-wide
+ - reference
+ - aws
+---
+
+We provide pre-built `amd64` and `arm64` Amazon Linux 2023 based EC2 AMIs with
+Teleport pre-installed.
+
+## Installing Teleport as a cluster
+
+These images are primarily intended for deploying a Teleport cluster using our
+[reference Terraform code](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform).
+
+See the [AWS Single-Instance Deployment](../zero-trust-access/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx)
+and the [Running Teleport Enterprise in High Availability mode on AWS using Terraform](../zero-trust-access/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx)
+guide for detailed usage examples.
+
+In order to use these AMIs outside of the reference Terraform, you can configure
+the Teleport installation by setting configuration variables in the
+`/etc/teleport.d/conf` file on the EC2 instance. See the [Starter Cluster Configuration Template](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster/data.tpl)
+for a list of the available configuration options.
+
+The image names all include the build timestamp (shown as `$TIMESTAMP` in the
+table below), and are tagged for easier searching.
+
+| Image name | Edition | Architecture | FIPS support | AMI Tags |
+| - | - | - | - | - |
+| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
+| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` |
+| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
+| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` |
+
+These AMIs are owned by AWS account ID `146628656107`.
+
+All images are based on Amazon Linux 2023 and have been hardened using the
+Amazon EC2 ImageBuilder [STIG](https://public.cyber.mil/stigs/) hardening
+component.
+
+Teleport AMIs are automatically published to all [non-opt-in AWS regions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions).
diff --git a/docs/pages/installation/amazon-ecs.mdx b/docs/pages/installation/amazon-ecs.mdx
new file mode 100644
index 0000000000000..8e0a819641b28
--- /dev/null
+++ b/docs/pages/installation/amazon-ecs.mdx
@@ -0,0 +1,248 @@
+---
+title: Installing Teleport on Amazon ECS using Terraform
+description: How to install and run Teleport Agents on Amazon ECS
+tags:
+ - platform-wide
+ - reference
+---
+
+Using Amazon ECS and Terraform allows you to easily deploy and manage Teleport Agents that are closer to your AWS resources.
+
+This flow is ideal when you want to automatically discover and secure access to your EKS clusters, RDS databases or other supported AWS resources.
+
+## How it works
+A Terraform module deploys a Teleport Agent on Amazon ECS and keeps it up to date.
+Re-applying the Terraform configuration ensures the Teleport Agent's version stays up to date.
+
+You have to create or re-use an IAM Join Token so the Agent is able to join the cluster.
+
+You will need to configure the Teleport services you want to run (e.g., the Discovery Service or Database Service), and then pick the subnets and security groups which allow access to the resources you want to access.
+
+After deploying, the Agent is part of your cluster and starts discovering resources or proxying requests.
+
+You can customize the Agent configuration and re-deploy it as needed.
+
+## Prerequisites
+The following set up is required:
+- Install [`terraform`](https://developer.hashicorp.com/terraform/install)
+- [Configure AWS credentials](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration)
+- Create Teleport [IAM Join Token](../reference/deployment/join-methods.mdx#aws-iam-role-iam) so that your agent can securely join the Teleport cluster
+
+## Step 1/3. Download the Terraform module
+
+Download the source code for our example:
+```code
+$ git clone https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
+$ cd teleport/examples/aws/terraform/ecs-agent
+```
+
+## Step 2/3. Configure the deployment
+The file `variables.tf` contains all the configurable parameters for the Teleport Agent deployment, ensure you review and create a `.tfvars` file that overrides the default values.
+
+
+<Tabs>
+  <TabItem label="Auto Discover Amazon EKS clusters">
+  In order to Auto Discover and access Amazon EKS clusters, start with the following configuration:
+  
+  ```hcl
+  teleport_proxy_server = "proxy.example.com:443"
+
+  // AWS Region where the Teleport Agent is deployed
+  aws_region = "eu-south-2"
+
+  // ECS cluster name to use.
+  ecs_cluster = "teleport-ecs-guide"
+
+  // ECS Service networking configuration.
+  // Ensure this allows connectivity to the target EKS Clusters.
+  teleport_agent_subnets         = ["subnet-123"]
+  teleport_agent_security_groups = ["sg-456"]
+
+  // Default tags to add to AWS resources when creating them.
+  default_tags = {
+    "DeployedBy" = "TeleportAmazonECSGuide"
+  }
+
+  // Teleport Agent configuration.
+  teleport_agent_config = {
+    version = "v3"
+    teleport = {
+      join_params = {
+        // Create a new IAM Join Token that allows joining from your AWS Account.
+        // Ensure it allows Discovery and Kubernetes system roles.
+        token_name = "token-ecs-guide"
+        method     = "iam"
+      }
+      proxy_server = "proxy.example.com:443"
+      log = {
+        severity = "DEBUG"
+      }
+    }
+    auth_service = {
+      enabled = "no"
+    }
+    proxy_service = {
+      enabled = "no"
+    }
+    ssh_service = {
+      enabled = "no"
+    }
+    discovery_service = {
+      enabled         = "yes"
+      discovery_group = "discover-eks"
+      aws = [
+        {
+          types   = ["eks"]
+          regions = ["eu-south-2"]
+          tags = [
+            { "*" = "*" }
+          ]
+        }
+      ]
+    }
+    kubernetes_service = {
+      enabled = "yes"
+      resources = [
+        {
+          labels = {
+            "region"                                 = "eu-south-2"
+            "account-id"                             = data.aws_caller_identity.current.account_id
+            "teleport.dev/cloud"                     = "AWS"
+            "teleport.dev/discovery-type"            = "eks"
+            "teleport.internal/discovery-group-name" = "discover-eks"
+          }
+        }
+      ]
+    }
+  }
+
+  // Depending on your use case, you may want to allow additional permissions for the IAM Role which will be assumed by the agent.
+  ecs_taskrole = "ecs-guide-teleport_agent_role"
+  ecs_taskrole_policy = {
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid = "EKSDiscovery"
+        Action = [
+          "eks:DescribeCluster",
+          "eks:ListClusters"
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+      {
+        Sid = "EKSManageAccess"
+        Action = [
+          "eks:AssociateAccessPolicy",
+          "eks:CreateAccessEntry",
+          "eks:DeleteAccessEntry",
+          "eks:DescribeAccessEntry",
+          "eks:TagResource",
+          "eks:UpdateAccessEntry"
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  }
+  ecs_executionrole = "ecs-guide-teleport_agent_executionrole"
+  ```
+  </TabItem>
+  
+  <TabItem label="Basic deployment example">
+  Here's an example of a basic ECS Teleport Agent configuration you can use to tailor to your use-case.
+  ```hcl
+  teleport_proxy_server = "proxy.example.com:443"
+
+  // AWS Region where the Teleport Agent is deployed
+  aws_region = "eu-south-2"
+
+  // ECS cluster name to use.
+  ecs_cluster = "teleport-ecs-guide"
+
+  // ECS Service networking configuration.
+  teleport_agent_subnets         = ["subnet-123"]
+  teleport_agent_security_groups = ["sg-456"]
+
+  // Default tags to add to AWS resources when creating them.
+  default_tags = {
+    "DeployedBy" = "TeleportAmazonECSGuide"
+  }
+
+  // Teleport Agent configuration.
+  teleport_agent_config = {
+    version = "v3"
+    teleport = {
+      join_params = {
+        // Create a new IAM Join Token that allows joining from your AWS Account.
+        token_name = "token-ecs-guide"
+        method     = "iam"
+      }
+      // Teleport Proxy server endpoint.
+      proxy_server = "proxy.example.com:443"
+      log = {
+        severity = "DEBUG"
+      }
+    }
+    auth_service = {
+      enabled = "no"
+    }
+    proxy_service = {
+      enabled = "no"
+    }
+    ssh_service = {
+      enabled = "yes"
+    }
+  }
+
+  // Depending on your use case, you may want to allow additional permissions for the IAM Role which will be assumed by the agent.
+  ecs_taskrole = "ecs-guide-teleport_agent_role"
+  ecs_taskrole_policy = {
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "sts:GetCallerIdentity",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  }
+  ecs_executionrole = "ecs-guide-teleport_agent_executionrole"
+  ```
+  </TabItem>
+</Tabs>
+
+The deployment will create the following AWS resources:
+- IAM Role with the required permission for accessing AWS APIs
+- IAM Role to allow log stream of the Teleport Agent into CloudWatch
+- ECS Task Definition which runs a Teleport Agent
+- ECS Cluster and an ECS Service which runs the Task Definition above
+
+You should edit the `teleport_agent_config` and `ecs_taskrole_policy` variables and adapt it to your needs.
+
+Save the `.tfvars` file as `my-deployment.tfvars` and use it in the next step.
+
+## Step 3/3. Initialize and apply the Terraform configuration
+Applying the configuration will create the resources and deploy the Teleport Agent.
+
+```bash
+$ terraform init
+$ terraform apply -var-file=my-deployment.tfvars
+```
+
+After deployment, the agent should be part of your Teleport cluster.
+
+<Admonition type="note" title="Keep your agent up to date">
+  Run `terraform apply ...` regularly to ensure the deployed Teleport Agent version is updated.
+</Admonition>
+
+## Troubleshooting
+
+Navigate to the [Amazon ECS console](https://console.aws.amazon.com/ecs/v2/clusters), select the Cluster and Service, and look for the logs tab which are stored in [CloudWatch](https://console.aws.amazon.com/cloudwatch/home?#logsV2:log-groups).
+
+## Next steps
+Use this guide as a starting point for implementing Auto Discovery for AWS resources:
+- [EKS clusters](../enroll-resources/auto-discovery/kubernetes/aws.mdx)
+- [AWS databases](../enroll-resources/database-access/enrollment/aws/aws.mdx)
diff --git a/docs/pages/installation/docker.mdx b/docs/pages/installation/docker.mdx
new file mode 100644
index 0000000000000..7c2cf35c641c3
--- /dev/null
+++ b/docs/pages/installation/docker.mdx
@@ -0,0 +1,327 @@
+---
+title: Installing Teleport on Docker
+description: How to install and run Teleport on Docker using our pre-built images from Amazon ECR Public, with details on configuration, data persistence, and networking.
+tags:
+- reference
+- platform-wide
+---
+
+Docker provides a convenient way to deploy Teleport in containerized environments, offering consistent deployment across platforms and simplified dependency management. Teleport's pre-built Docker images are optimized for different use cases, from production deployments to development and troubleshooting scenarios. 
+
+In this installation guide, you'll learn how to choose the right image, configure your containers, and run Teleport services with Docker.
+
+## Images
+
+We provide a pre-built Docker image for every version of Teleport. This section
+describes the available Docker images.
+
+These images are hosted on [Amazon ECR
+Public](https://gallery.ecr.aws/gravitational).
+
+### Image suffixes
+
+For each of the image names listed in this section, you can specify attributes
+of the image by appending a suffix to the repository name or tag.
+
+Images with the `-distroless` suffix within the repository name include only the
+`teleport` binary and its runtime dependencies, with no shell or utility
+applications. An example is `public.ecr.aws/gravitational/teleport-distroless`
+for Teleport Community Edition.
+
+Images with the `*-distroless-debug` suffix within the repository name include a
+Busybox shell and tool suite in addition to Teleport, and are intended for
+troubleshooting deployments only. They are not intended for production use. An
+example is `public.ecr.aws/gravitational/teleport-distroless-debug`.
+
+`*-distroless` and `*-distroless-debug` images support multiple architectures
+natively, and do not require (or support) image suffixes. You can specify an
+architecture using the `--platform` flag of `docker pull` to pull the `arm`,
+`arm64` or `amd64` version of an image.
+
+### Version tags
+
+Images point to a static version of Teleport. Use the image's tag to specify
+either:
+
+- The major, minor, and patch version (e.g., `(=teleport.version=)` for the
+  latest version of Teleport Community Edition).
+- The major version only, which implies the latest minor and patch numbers for
+  that major version. For example, `(=teleport.major_version=)` implies
+  `(=teleport.version=)`.
+
+<Tabs>
+<TabItem label="Teleport Enterprise (Managed)" scope={["team", "cloud"]}>
+
+| Image name | Includes troubleshooting tools | Image base |
+| - | - | - |
+| `public.ecr.aws/gravitational/teleport-ent-distroless:(=cloud.version=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+| `public.ecr.aws/gravitational/teleport-ent-distroless-debug:(=cloud.version=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+
+For testing, we always recommend that you use the latest Cloud release version of
+Teleport Enterprise, which is currently `public.ecr.aws/gravitational/teleport-ent-distroless:(=cloud.version=)`.
+
+</TabItem>
+<TabItem label="Teleport Enterprise (Self-Hosted)" scope={["enterprise"]}>
+
+| Image name | Includes troubleshooting tools | Image base |
+| - | - | - |
+| `(=teleport.latest_ent_docker_image=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+| `(=teleport.latest_ent_debug_docker_image=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+
+We also provide the following images for FIPS builds of Teleport Enterprise:
+
+| Image name | Includes troubleshooting tools | Image base |
+| - | - | - |
+| `public.ecr.aws/gravitational/teleport-ent-fips-distroless:(=teleport.version=)` | No | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+| `public.ecr.aws/gravitational/teleport-ent-fips-distroless-debug:(=teleport.version=)` | Yes | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+
+For testing, we always recommend that you use the latest release version of
+Teleport Enterprise, which is currently `(=teleport.latest_ent_docker_image=)`.
+
+</TabItem>
+<TabItem label="Teleport Community Edition" scope={["oss"]}>
+
+|Image name|Troubleshooting Tools?|Image base|
+|-|-|-|
+|`(=teleport.latest_oss_docker_image=)`|No|[Distroless Debian 12](https://github.com/GoogleContainerTools/distroless)|
+|`(=teleport.latest_oss_debug_docker_image=)`|Yes|[Distroless Debian 12](https://github.com/GoogleContainerTools/distroless)|
+
+For testing, we always recommend that you use the latest release version of
+Teleport, which is currently `(=teleport.latest_oss_docker_image=)`.
+
+</TabItem>
+</Tabs>
+
+### Interacting with distroless images
+
+Since version 15, Teleport images are based on Google's [Distroless](https://github.com/GoogleContainerTools/distroless) images.
+Those images don't contain any shell.
+
+To execute Teleport commands on containers based on these images, run commands similar to the following:
+
+```code
+# in docker
+$ docker run -i my-container tctl status
+
+# in Kubernetes
+$ kubectl exec -i my-pod -- tctl status
+
+# sending local files via stdin
+$ kubectl exec -i my-pod -- tctl create -f < my-local-file.yaml
+
+# retrieving the teleport service config file from the configmap
+$ kubectl get configmap teleport-cluster-auth -o jsonpath="{.data['teleport\.yaml']}"
+
+# retrieving output via stdout and tar
+$ kubectl exec -i my-pod -- tctl auth sign --user admin --format tls --ttl 10m --tar -o admin| tar xv -C local
+$ ls -l local
+total 24
+-rw-------  1 trent  staff  1318 Jul 24 15:52 admin.cas
+-rw-------  1 trent  staff  1895 Jul 24 15:52 admin.crt
+-rw-------  1 trent  staff  1679 Jul 24 15:52 admin.key
+```
+
+Alternatively, you can use the debug variant of the image, which contains [busybox](https://www.busybox.net/about.html) and a minimal shell invocable via `busybox sh`:
+
+```code
+$ docker run -it --entrypoint="" (=teleport.latest_oss_debug_docker_image=) busybox sh
+```
+
+### Machine & Workload Identity (tbot)
+
+We also provide a slimmed down distroless image that only contains the `tbot`
+binary for use with Teleport Machine & Workload Identity.
+
+| Image name                                                               | FIPS Support | Image base                                                                 |
+|--------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------|
+| `public.ecr.aws/gravitational/tbot-distroless:(=teleport.version=)`      | No           | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+| `public.ecr.aws/gravitational/tbot-fips-distroless:(=teleport.version=)` | Yes          | [Distroless Debian 12](https://github.com/GoogleContainerTools/distroless) |
+
+The version tagging follows the same pattern as the main `teleport-distroless`
+image.
+
+Whilst the `teleport-distroless` image also includes `tbot`, using the `tbot`
+specific image should be preferred for Machine & Workload Identity deployments.
+This image is smaller, improving pull times, and has a smaller attack surface.
+In addition, the image is customized in order to improve the experience of
+running `tbot` in a container environment.
+
+To learn more, read the
+[Deploying Machine & Workload Identity on Kubernetes](../machine-workload-identity/deployment/kubernetes.mdx)
+guide.
+
+## Running Teleport on Docker
+
+When running a container from one of the images listed above, consider the
+container equivalent to running the `teleport` binary. The Teleport container
+requires access to a file system and network ports.
+
+### Configuration
+
+Teleport processes read their configuration from a local file path, which is
+`/etc/teleport.yaml` by default. Make sure this file path is mounted to your
+Teleport container.
+
+### Data directory
+
+All Teleport processes read from and write to a data directory, which by default
+is `/var/lib/teleport`. Make sure the data directory is mounted to your Teleport
+container.
+
+### License file
+
+If your Teleport Enterprise container runs the Auth Service, you will need to
+give it access to a license file at the path named in the configuration, which
+is `/var/lib/teleport/license.pem` by default. Make sure a license exists at
+this location in the Teleport container's data directory.
+
+### Other file paths
+
+Depending on the configuration settings you assign on your Teleport container,
+you will need to make sure that any file paths you name are mounted on the
+container.
+
+For example, if you are running the Teleport Proxy Service on a container, you
+need to mount the directory containing TLS credentials to your Teleport
+container, then assign the following fields in the container's configuration
+file to the appropriate paths:
+
+```yaml
+proxy_service:
+  https_keypairs:
+  - key_file: /my/path/key.pem
+    cert_file: /my/path/cert.pem
+```
+
+See the Teleport [Configuration Reference](../reference/deployment/config.mdx) for whether a
+field you would like to assign requires a file path.
+
+### Ports
+
+A single Teleport process can run multiple services, each of which listens on a
+specific set of ports depending on your configuration. See our [Networking
+Reference](../reference/deployment/networking.mdx#ports) for the ports on your Teleport
+container to expose.
+
+### Extracting certificates from distroless images
+
+Extracting certificates created with `tctl auth sign` from a container running
+a distroless image can be tricky due to the absence of a shell and other OS tools.
+
+Where possible you should log into the Teleport cluster using `tsh` and use
+`tctl auth sign` locally to generate certificates. This way the action will be
+logged against your Teleport user and be subject to all of the usual Teleport
+RBAC policies in your cluster.
+
+If this is not possible, use `tctl auth sign --tar` to collect all the files
+generated by `tctl auth sign` into a `tar` archive, which is streamed directly
+to `stdout`. The resulting certificates are never stored on the container
+filesystem. You can either pipe this output directly to `tar`, or redirect it
+to a local file for later use.
+
+For example:
+
+```code
+$ docker exec ${TELEPORT_CONTAINER} \
+  tctl auth sign --user alice --format tls -o alice.local --tar | tar xv
+x alice.local.crt
+x alice.local.key
+x alice.local.cas
+```
+
+## Example of running a Teleport container
+
+In this example, we will show you how to run the Teleport Auth Service and Proxy
+Service on a local Docker container using Teleport Community Edition.
+
+Since this container uses a self-signed certificate, we do not recommend using
+this configuration to protect any infrastructure outside your workstation. You
+can, however, join other local Docker containers to it using the [token
+method](../enroll-resources/agents/join-token.mdx).
+
+First, create directories in your home directory to mount to the container. The
+Teleport container will write its configuration and data to these directories:
+
+```code
+$ mkdir -p ~/teleport/config ~/teleport/data
+```
+
+Run `teleport configure` from the Teleport container to generate a configuration
+file. This sets the container's name to `localhost` so your browser can trust
+the Proxy Service's self-signed TLS certificate:
+
+```code
+$ docker run --hostname localhost --rm \
+  --entrypoint=/usr/local/bin/teleport \
+  <Var name="(=teleport.latest_oss_docker_image=)" /> configure --roles=proxy,auth > ~/teleport/config/teleport.yaml
+```
+
+Start Teleport on your container:
+
+```code
+$ docker run --hostname localhost --name teleport \
+  -v ~/teleport/config:/etc/teleport \
+  -v ~/teleport/data:/var/lib/teleport \
+  -p 3025:3025 -p 3080:3080 \
+  <Var name="(=teleport.latest_oss_docker_image=)" />
+```
+
+From there, open another terminal and make sure your Teleport container's web
+API is functioning as intended:
+
+```code
+$ curl --insecure https://localhost:3080/webapi/ping | jq
+```
+
+You should see JSON output similar to the following:
+
+```json
+{
+  "auth": {
+    "type": "local",
+    "second_factor": "otp",
+    "preferred_local_mfa": "otp",
+    "local": {
+      "name": ""
+    },
+    "private_key_policy": "none",
+    "device_trust_disabled": true,
+    "has_motd": false
+  },
+  "proxy": {
+    "kube": {
+      "enabled": true,
+      "listen_addr": "0.0.0.0:3080"
+    },
+    "ssh": {
+      "listen_addr": "0.0.0.0:3080",
+      "tunnel_listen_addr": "0.0.0.0:3080",
+      "web_listen_addr": "0.0.0.0:3080"
+    },
+    "db": {
+      "postgres_listen_addr": "0.0.0.0:3080",
+      "mysql_listen_addr": "0.0.0.0:3080"
+    },
+    "tls_routing_enabled": true
+  },
+  "server_version": "12.1.5",
+  "min_client_version": "11.0.0",
+  "cluster_name": "localhost",
+  "automatic_upgrades": false
+}
+```
+
+We are using the `--insecure` flag to trust Teleport's self-signed certificate.
+In production, you will want to provision TLS credentials to the Proxy Service
+from a trusted CA, e.g., Let's Encrypt.
+
+## Upgrading Teleport on Docker
+
+To upgrade a Teleport container running on Docker:
+
+1. Leave the container's data directory in place.
+1. Stop the container.
+1. Run a new container with an image based on a newer Teleport version, mounting
+   the data directory as you did while running the container initially. As long
+   as the data directory contains the same content as before the upgrade, the
+   Teleport container does not need to re-join the cluster.
diff --git a/docs/pages/installation/helm.mdx b/docs/pages/installation/helm.mdx
new file mode 100644
index 0000000000000..9f844efc65b06
--- /dev/null
+++ b/docs/pages/installation/helm.mdx
@@ -0,0 +1,42 @@
+---
+title: Installing Teleport using Helm
+description: How to install Teleport on Kubernetes using our official Helm charts, with instructions for deploying a Teleport cluster or enrolling a remote Kubernetes cluster as an agent.
+tags:
+- reference
+- platform-wide
+---
+
+Teleport maintains Helm charts for services and plugins, including self-hosted
+Auth Service and Proxy Service deployments, Teleport Agents, the Event Handler,
+and Access Request plugins.
+
+## Installing Teleport as a cluster
+
+The `teleport-cluster` Helm chart deploys the `teleport` daemon on Kubernetes
+with preset configurations for the Auth Service and Proxy Service, with support
+for additional Teleport service configurations.
+
+See [Guides for running Teleport using
+Helm](../zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx)
+for instructions on using the `teleport-cluster` chart to deploy a Teleport
+cluster on your Kubernetes platform.
+
+See the [Helm chart reference
+guide](../reference/helm-reference/teleport-cluster.mdx) for available options.
+
+## Installing Teleport as an agent
+
+The `teleport-kube-agent` chart configures a Teleport Agent that runs in a
+remote Kubernetes cluster to provide access to resources in your infrastructure.
+
+The easiest way to deploy an agent in Kubernetes is in the Teleport Web UI at
+`web/discover`, where a guide will lead you through a series of configuration
+steps and populate the full `helm install` command for you.
+
+See the [Helm chart reference
+guide](../reference/helm-reference/teleport-kube-agent.mdx) for all available
+options as well as example deployments for the various types of agents.
+
+## Other Helm charts
+
+Consult the [Helm chart reference](../reference/helm-reference/helm-reference.mdx) for documentation on all available Helm charts.
diff --git a/docs/pages/installation/installation.mdx b/docs/pages/installation/installation.mdx
new file mode 100644
index 0000000000000..abe69268cb168
--- /dev/null
+++ b/docs/pages/installation/installation.mdx
@@ -0,0 +1,101 @@
+---
+title: Installing Teleport
+description: How to install Teleport and Teleport's client tools on your platform, including binaries and instructions for Docker and Helm.
+videoBanner: fjk29wqXm1A
+tags:
+- reference
+- platform-wide
+---
+
+Whether you are installing Teleport as a cluster or as an agent that talks to the cluster, the Teleport binary is the same. The difference is only in how you [configure it](../reference/deployment/config.mdx), which you will need to do after installation. Before choosing an installation method below, you should identify your particular use case. There are three:
+
+1. **Installing Teleport as a cluster:** Install a self-hosted Teleport cluster to provide secure, identity-based access to all your infrastructure. If you are running Teleport Enterprise Cloud, you will not need this use case, as the cluster is managed for you.
+2. **Installing Teleport as an agent:** Install a Teleport Agent on your infrastructure resource to enroll it with your cluster for centralized access management.
+3. **Installing Teleport as a client:** For interacting with and managing your clusters via CLI and Teleport Connect.
+
+These use cases will be addressed in each platform page.
+
+### Choose your platform to install Teleport
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="linux" size="xl" />,
+      to: "./linux",
+      name: "Linux",
+    },
+    {
+      icon: <Icon name="docker" size="xl" />,
+      to: "./docker",
+      name: "Docker",
+    },
+    {
+      icon: <Icon name="ec2" size="xl" />,
+      to: "./amazon-ec2",
+      name: "Amazon EC2",
+    },
+    {
+      icon: <Icon name="ecs" size="xl" />,
+      to: "./amazon-ecs",
+      name: "Amazon ECS",
+    },
+    {
+      icon: <Icon name="kubernetes2" size="xl" />,
+      to: "./helm",
+      name: "Helm",
+    },
+    {
+      icon: <Icon name="apple" size="xl" />,
+      to: "./macos",
+      name: "macOS",
+    },
+    {
+      icon: <Icon name="windows" size="xl" />,
+      to: "./windows",
+      name: "Windows",
+    },
+    {
+      icon: <Icon name="laptop" size="xl" />,
+      to: "./source",
+      name: "From Source",
+    }
+  ]}
+/>
+
+## Checksums
+
+If you want to verify the integrity of a Teleport binary, SHA256 checksums are
+available for all downloads on our
+[downloads page](https://goteleport.com/download/).
+
+![Teleport Checksum](../../img/teleport-sha.png)
+
+If you download Teleport via an automated system, you can programmatically
+obtain the checksum by adding `.sha256` to the download link. This is the method
+shown in the installation examples.
+
+```code
+$ export version=v(=teleport.version=)
+# 'darwin' 'linux' or 'windows'
+$ export os=linux
+# '386' 'arm' on linux or 'amd64' for all distros
+$ export arch=amd64
+$ curl https://cdn.teleport.dev/teleport-$version-$os-$arch-bin.tar.gz.sha256
+# <checksum> <filename>
+```
+
+## Uninstalling Teleport
+
+If you wish to uninstall Teleport at any time, see our documentation on [Uninstalling Teleport](uninstall-teleport.mdx).
+
+## Next steps
+
+Now that you know how to install Teleport, you can enable access to all of your
+infrastructure. Get started with enrolling resources in your Teleport cluster:
+
+- [SSH servers](../enroll-resources/server-access/server-access.mdx)
+- [Kubernetes clusters](../enroll-resources/kubernetes-access/introduction.mdx)
+- [Databases](../enroll-resources/database-access/database-access.mdx)
+- [Applications](../enroll-resources/application-access/application-access.mdx)
+- [Remote desktops](../enroll-resources/desktop-access/introduction.mdx)
+- [Machine & Workload Identity](../machine-workload-identity/introduction.mdx)
diff --git a/docs/pages/installation/linux.mdx b/docs/pages/installation/linux.mdx
new file mode 100644
index 0000000000000..6bc386a55a6cb
--- /dev/null
+++ b/docs/pages/installation/linux.mdx
@@ -0,0 +1,436 @@
+---
+title: Installing Teleport on Linux
+description: How to install Teleport on Linux using our package repositories, TAR archives, or our one-line installation script for various distributions.
+tags:
+- reference
+- platform-wide
+---
+
+Teleport maintains DEB and RPM package repositories for different operating
+systems, platforms, and Teleport versions. A server that installs Teleport from
+a DEB or RPM package must have systemd installed. You can also download TAR
+archives containing Teleport binaries.
+
+Note that Teleport agents should always use the one-line installation script
+or `teleport-update` binary to install Teleport. Otherwise, they will fall
+out-of-date, become incompatible with the cluster, and eventually disconnect.
+
+## Operating system support
+| Operating System | `teleport` Daemon | `tctl` Admin Tool | `tsh` and Teleport Connect User Clients [1] | Web UI (via the browser) | `tbot` Daemon |
+| - | - | - | - | - | - |
+| Linux 3.2+ (RHEL/CentOS 7+, Rocky Linux 8+, Amazon Linux 2+, Amazon Linux 2023+, Ubuntu 16.04+, Debian 9+, SLES 12 SP 5+, and SLES 15 SP 5+) \[2] | yes | yes | yes \[3] | yes | yes |
+
+\[1] *`tsh` is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See [Using Teleport Connect](../connect-your-client/teleport-clients/teleport-connect.mdx) for usage and installation.*
+
+\[2] *Enhanced Session Recording requires Linux kernel v5.8+.*
+
+\[3] *Teleport Connect on Linux requires glibc 2.28+ present in Ubuntu 20.04+, Debian 10+, Fedora 37+.*
+
+(!docs/pages/includes/client-cluster-compatibility.mdx!)
+
+## Installing Teleport as a cluster
+
+If you are starting out with Teleport, we recommend beginning with a [Teleport Cloud](https://goteleport.com/signup/) account. From there, the only Teleport components you need to deploy yourself are Teleport Agents, which is discussed in the [next section](#installing-teleport-as-an-agent).
+
+If you are self-hosting a Teleport cluster, please take a look at our [Linux Demo](../get-started/deploy-community.mdx) for the Teleport Community Edition or our [Self-Hosting Teleport](../zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx) section in the docs for more information on Teleport Enterprise Self-Hosted.
+
+<Tabs>
+<TabItem label="Teleport Enterprise Cloud (Managed)">
+
+Teleport Enterprise Cloud is provisioned and managed for you so there are no install steps. The only Teleport
+components you need to deploy yourself are Teleport Agents.
+</TabItem>
+<TabItem label="Teleport Enterprise (Self-Hosted)">
+
+```code
+$ TELEPORT_EDITION="enterprise"
+$ TELEPORT_VERSION="(=teleport.version=)"
+```
+
+Then, download and run the generic installation script on the server where you
+want to install Teleport:
+
+```code
+$ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION?} ${TELEPORT_EDITION?}
+```
+
+</TabItem>
+<TabItem label="Teleport Community Edition">
+
+```code
+$ TELEPORT_EDITION="oss"
+$ TELEPORT_VERSION="(=teleport.version=)"
+```
+
+Then, download and run the generic installation script on the server where you
+want to install Teleport:
+
+```code
+$ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION?} ${TELEPORT_EDITION?}
+```
+
+</TabItem>
+</Tabs>
+
+### Cluster configuration
+
+The above methods for installing Teleport on a Linux server do not generate a Teleport configuration file for you. For this, we have a `teleport configure` CLI command or you can create one manually.
+
+See the following guides for help setting up a configuration file:
+
+- [Teleport Configuration Reference](../reference/deployment/config.mdx): This will provide you with the command you need to generate and populate the `/etc/config.yaml` file as well as further configuration options for your cluster.
+- [Self-Hosted Demo Cluster](../zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx): If you are deploying the Teleport Auth Service and Proxy Service, read this guide for an example of a configuration file.
+
+## Installing Teleport as an agent
+
+The easiest way to install Teleport as an agent is through the WebUI at `/web/discover`, where you can select a resource to enroll with your Teleport cluster and retrieve an "all-in-one" installation script to run on Linux hosts.
+
+### One-line installation script
+
+Outside of the Web UI, you can run our one-line cluster install script on your Linux server where you are deploying Teleport as an agent. This script will detect and use the best version, edition, and installation mode for your cluster.
+
+1. Assign <Var name="example.teleport.sh:443"/> to your Teleport cluster hostname and Web UI port.
+   This should contain you cluster hostname and port, but not the scheme (https://).
+2. Run your cluster's install script:
+   ```code
+   $ curl "https://<Var name="example.teleport.sh:443"/>/scripts/install.sh" | sudo bash
+   ```
+
+You can also use the example Terraform module for deploying agents in [Deploy
+Agents with
+Terraform](../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx).
+
+### Agent configuration
+
+Outside of deploying Teleport as an agent in the WebUI, the methods for installing Teleport on a Linux server do not generate a Teleport configuration file for you. You will need to generate one prior to starting the Teleport service.
+
+See the following guides for examples of setting up a configuration file:
+
+- [Enroll Resources](../enroll-resources/enroll-resources.mdx): Guides to setting
+  up Teleport Agents in order to enroll infrastructure resources in your cluster. These
+  guides include examples of setting up Teleport configuration files.
+- [Self-Hosted Demo
+  Cluster](../zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx): If you are
+  deploying the Teleport Auth Service and Proxy Service, read this guide for an
+  example of a configuration file.
+- [Teleport Configuration Reference](../reference/deployment/config.mdx): A guide to all
+  configuration fields.
+
+## Other Install Methods
+
+### Package repositories
+
+The [one-line-installation-script](#one-line-installation-script) automatically
+detects a package manager on the local system and uses it to install Teleport
+from an upstream repository.
+
+If your system does not support the one-line installation script, read the
+instructions in this section for instructions on working with Teleport package
+repositories.
+
+Note that Teleport agents should always use the one-line installation script
+or `teleport-update` binary to install Teleport. Otherwise, they will fall
+out-of-date, become incompatible with the cluster, and eventually disconnect.
+
+1. Assign the following environment variables in the terminal where you will run
+   Teleport installation commands, indicating the package and version to
+   install:
+
+   <Tabs>
+   <TabItem label="Teleport Enterprise (Self-Hosted)">
+
+   ```code
+   $ export TELEPORT_PKG=teleport-ent
+   $ export TELEPORT_VERSION=v(=teleport.major_version=)
+   $ export TELEPORT_CHANNEL=stable/${TELEPORT_VERSION?}
+   ```
+
+   For FedRAMP/FIPS-compliant installations, install the `teleport-ent-fips` package instead:
+
+   ```code
+   $ export TELEPORT_PKG=teleport-ent-fips
+   ```
+
+   </TabItem>
+   <TabItem label="Teleport Community Edition">
+
+   ```code
+   $ export TELEPORT_PKG=teleport
+   $ export TELEPORT_VERSION=v(=teleport.major_version=)
+   $ export TELEPORT_CHANNEL=stable/${TELEPORT_VERSION?}
+   ```
+
+   </TabItem>
+   </Tabs>
+
+1. Teleport maintains DEB and RPM package repositories for different Linux
+   distributions based on variables defined in `/etc/os-release` on Linux
+   systems. Source this file to define the variables:
+
+   ```code
+   $ source /etc/os-release
+   ```
+
+1. Make sure the value of the `ID` environment variable is supported.
+
+   The Teleport DEB and RPM repositories don't expose packages for all
+   distribution variants. When installing Teleport using RPM repositories, you
+   may need to replace the `ID` variable set in `/etc/os-release` with `ID_LIKE`
+   to install packages of the closest supported distribution.
+
+   Currently supported distributions (and `ID` values) are:
+
+   | Distribution | Version              | `ID` value in `/etc/os-release` |
+   |--------------|----------------------|---------------------------------|
+   | Amazon Linux | 2 and 2023           | `amzn`                          |
+   | CentOS       | >= 7                 | `centos`                        |
+   | Debian       | >= 9                 | `debian`                        |
+   | RHEL         | >= 7                 | `rhel`                          |
+   | Rocky Linux  | >= 8                 | `rocky`                         |
+   | SLES         | >= 12 SP5, >= 15 SP5 | `sles`                          |
+   | Ubuntu       | >= 16.04             | `ubuntu`                        |
+
+   Note that [Enhanced Session
+   Recording](../enroll-resources/server-access/guides/bpf-session-recording.mdx) requires Linux
+   kernel version 5.8+. This means that it requires more recent OS versions than
+   other Teleport features:
+
+   | Distribution | Version                  |
+   |--------------|--------------------------|
+   | Amazon Linux | 2 (post 11/2021), 2023   |
+   | CentOS/RHEL  | 9+                       |
+   | Rocky Linux  | 8+                       |
+   | Debian       | 11, or 10 with backports |
+   | Ubuntu       | 20.042+                  |
+
+   If the value of `ID` is not in the list above, look up the space-separated
+   values of the `ID_LIKE` variable you sourced from `/etc/os-release` and see
+   if one of them appears in the list.
+
+1. Follow the instructions for your package manager:
+
+   <Tabs>
+   <TabItem label="apt">
+
+   ```code
+   $ sudo mkdir -p /etc/apt/keyrings
+   # Download the Teleport PGP public key
+   $ sudo curl https://apt.releases.teleport.dev/gpg \
+   -o /etc/apt/keyrings/teleport-archive-keyring.asc
+   # Add the Teleport APT repository. You'll need to update this file for each
+   # major release of Teleport.
+   $ echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \
+   https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} \
+   ${TELEPORT_CHANNEL?}" \
+   | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
+
+   $ sudo apt-get update
+   $ sudo apt-get install ${TELEPORT_PKG?}
+   ```
+
+   </TabItem>
+
+   <TabItem label="yum">
+
+   ```code
+   # Add the Teleport YUM repository. You'll need to update this file for each
+   # major release of Teleport.
+   # First, get the major version from $VERSION_ID so this fetches the correct
+   # package version.
+   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
+   $ sudo yum install -y yum-utils
+   $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport.repo")"
+   $ sudo yum install ${TELEPORT_PKG?}
+   #
+   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
+   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
+   ```
+
+   </TabItem>
+
+   <TabItem label="zypper">
+
+   ```code
+   # Add the Teleport Zypper repository. You'll need to update this file for each
+   # major release of Teleport.
+   # First, get the OS major version from $VERSION_ID so this fetches the correct
+   # package version.
+   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
+   # Use zypper to add the teleport RPM repo
+   $ sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport-zypper.repo")
+   $ sudo zypper --gpg-auto-import-keys refresh teleport
+   $ sudo zypper install ${TELEPORT_PKG?}
+   #
+   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
+   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
+   ```
+
+   </TabItem>
+
+   <TabItem label="dnf">
+
+   ```code
+   # Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
+   # file for each major release of Teleport.
+   # First, get the major version from $VERSION_ID so this fetches the correct
+   # package version.
+   $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
+   # Install dnf config-manager
+   $ sudo yum install -y yum-utils
+   # Use the dnf config manager plugin to add the teleport RPM repo
+   $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/${TELEPORT_CHANNEL?}/teleport.repo")"
+
+   # Install teleport
+   $ sudo dnf install ${TELEPORT_PKG}
+
+   # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
+   # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
+   ```
+
+   </TabItem>
+   </Tabs>
+
+### Downloading packages and TAR archives
+
+Teleport maintains TAR archives as well as DEB and RPM packages for
+Linux-compatible binaries at `https://cdn.teleport.dev`. This section explains
+how to install Teleport by manually downloading a release.
+
+Note that Teleport agents should always use the one-line installation script
+or `teleport-update` binary to install Teleport. Otherwise, they will fall
+out-of-date, become incompatible with the cluster, and eventually disconnect.
+
+1. In your terminal, assign environment variables that you will use to download
+   your intended archive.
+
+   For Teleport Community Edition, the Teleport package is called `teleport`:
+
+   ```code
+   $ TELEPORT_PKG=teleport
+   ```
+
+   For self-hosted Teleport Enterprise deployments, the package is called
+   `teleport-ent`:
+
+   ```code
+   $ TELEPORT_PKG=teleport-ent
+   ```
+
+1. Specify your system Teleport version and system architecture by assigning an
+   environment variable:
+
+   ```code
+   $ TELEPORT_VERSION=(=teleport.version=)
+   $ SYSTEM_ARCH=""
+   ```
+
+   The following architecture values are available:
+
+   - `amd64` (`x86_64` if downloading an RPM package)
+   - `arm64`
+   - `arm`
+   - `386` (`i386` if downloading a DEB or RPM package)
+
+1. Run the following commands to download a Teleport package or archive, unpack
+   it, and install binaries:
+
+   <Tabs>
+   <TabItem label="TAR">
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz.sha256
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz
+   $ shasum --check --algorithm 256 < ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz.sha256
+   # ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz: OK
+   $ tar -xvf ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-bin.tar.gz
+   $ cd ${TELEPORT_PKG?}
+   $ sudo ./teleport-update enable --proxy example.teleport.sh # or sudo ./install for static installation
+   ```
+   </TabItem>
+   <TabItem label="DEB">
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb.sha256
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb
+   $ shasum --check --algorithm 256 < ${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb.sha256
+   # ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}.deb: OK
+   $ sudo dpkg -i ${TELEPORT_PKG?}_${TELEPORT_VERSION?}_${SYSTEM_ARCH?}.deb
+   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
+   ```
+
+   </TabItem>
+   <TabItem label="RPM">
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm.sha256
+   $ curl -O https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
+   $ shasum --check --algorithm 256 < ${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm.sha256
+   # ${TELEPORT_PKG?}-v${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.deb: OK
+   $ shasum --check -a 256 https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
+   # Or use yum localinstall, dnf localinstall etc.
+   $ sudo rpm -i https://cdn.teleport.dev/${TELEPORT_PKG?}-${TELEPORT_VERSION?}-1.${SYSTEM_ARCH?}.rpm
+   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
+   ```
+
+   </TabItem>
+   </Tabs>
+
+   For FedRAMP/FIPS-compliant installations of Teleport Enterprise, package URLs
+   are slightly different:
+
+   <Tabs>
+   <TabItem label="TAR">
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz.sha256
+   $ curl -O https://cdn.teleport.dev/teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz
+   $ shasum --check --algorithm 256 < teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz.sha256
+   # teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz: OK
+   $ tar -xvf teleport-ent-v${TELEPORT_VERSION?}-linux-${SYSTEM_ARCH?}-fips-bin.tar.gz
+   $ cd teleport-ent
+   $ sudo ./teleport-update enable --proxy example.teleport.sh # or sudo ./install for static installation
+   ```
+   </TabItem>
+   <TabItem label="DEB">
+
+   FIPS builds are only available for the `arm64` and `amd64` system
+   architectures.
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb.sha256
+   $ curl -O https://cdn.teleport.dev/teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb
+   $ shasum --check --algorithm 256 < teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb.sha256
+   # teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb: OK
+   $ sudo dpkg -i teleport-ent_${TELEPORT_VERSION}-fips_${SYSTEM_ARCH}.deb
+   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
+   ```
+
+   </TabItem>
+   <TabItem label="RPM">
+
+   FIPS builds are only available for the `arm64` and `x86_64` system
+   architectures.
+
+   ```code
+   $ curl -O https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm.sha256
+   $ curl -O https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm
+   $ shasum --check --algorithm 256 < teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm.sha256
+   # Or use yum localinstall, dnf localinstall etc.
+   $ sudo rpm -i https://cdn.teleport.dev/teleport-ent-${TELEPORT_VERSION?}-1-fips.${SYSTEM_ARCH?}.rpm
+   $ sudo teleport-update enable --proxy example.teleport.sh # enable Managed Updates
+   ```
+
+   </TabItem>
+   </Tabs>
+
+### From your browser
+
+For Teleport Community Edition, check the
+[Downloads](https://goteleport.com/download/) page for the most up-to-date
+information.
+
+On cloud-hosted Teleport Enterprise you can visit a download page in the Web UI. Select the user name
+in the upper right and select Downloads from the menu.
+
+Customers who self-host Teleport Enterprise can access Enterprise downloads and their license
+file from their [dedicated account dashboard](../zero-trust-access/deploy-a-cluster/license.mdx).
diff --git a/docs/pages/installation/macos.mdx b/docs/pages/installation/macos.mdx
new file mode 100644
index 0000000000000..64c422970592c
--- /dev/null
+++ b/docs/pages/installation/macos.mdx
@@ -0,0 +1,69 @@
+---
+title: Installing Teleport on macOS
+description: How to install Teleport on macOS using our official PKG installers for both Intel and Apple Silicon.
+tags:
+- reference
+- platform-wide
+---
+
+This guide explains how to install Teleport on macOS. 
+
+For an overview of Teleport installation methods and supported platforms, see
+[Installation](./installation.mdx).
+
+
+## Operating system support
+| Operating System | `teleport` Daemon | `tctl` Admin Tool | `tsh` and Teleport Connect User Clients [1] | Web UI (via the browser) | `tbot` Daemon |
+| - | - | - | - | - | - |
+| macOS 11+  (Big Sur)| yes | yes | yes | yes | yes |
+
+\[1] *`tsh` is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See
+  [Using Teleport Connect](../connect-your-client/teleport-clients/teleport-connect.mdx) for usage and installation*.
+
+(!docs/pages/includes/client-cluster-compatibility.mdx!)
+
+## Installing Teleport
+
+<Tabs>
+<TabItem label="Teleport Enterprise (Managed)">
+
+(!docs/pages/includes/cloud/install-macos.mdx!)
+
+</TabItem>
+<TabItem label="Teleport Enterprise (Self-Hosted)">
+
+(!docs/pages/includes/enterprise/install-macos.mdx!)
+
+</TabItem>
+<TabItem label="Teleport Community Edition">
+
+You can download one of the following .pkg installers for macOS:
+
+  |Link|Binaries|
+  |-|-|
+  |[`teleport-(=teleport.version=).pkg`](https://cdn.teleport.dev/teleport-(=teleport.version=).pkg)|`teleport`<br/>`tctl`<br/>`tsh`<br/>`tbot`<br/>`fdpass-teleport`|
+
+  You can also fetch an installer via the command line:
+
+  ```code
+  $ curl -O https://cdn.teleport.dev/teleport-(=teleport.version=).pkg
+  # Installs on Macintosh HD
+  $ sudo installer -pkg teleport-(=teleport.version=).pkg -target /
+  # Password:
+  # installer: Package name is teleport-(=teleport.version=)
+  # installer: Upgrading at base path /
+  # installer: The upgrade was successful.
+  $ which teleport
+  # /usr/local/bin/teleport
+  ```
+
+<Admonition type="danger">
+
+We do not recommend using Homebrew to install Teleport.  The Teleport package in
+Homebrew is not maintained by Teleport and we can't guarantee its reliability or
+security.
+
+</Admonition>
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/installation/source.mdx b/docs/pages/installation/source.mdx
new file mode 100644
index 0000000000000..c488aa0ace084
--- /dev/null
+++ b/docs/pages/installation/source.mdx
@@ -0,0 +1,10 @@
+---
+title: Building Teleport From Source
+description: How to build Teleport from source using Go and detailed instructions for building from source.
+tags:
+- platform-wide
+---
+
+Teleport is written in Go, and currently requires **go v(=teleport.golang=)** or
+newer. Detailed instructions for building from source are available in the
+[README](https://github.com/gravitational/teleport#building-teleport).
diff --git a/docs/pages/installation/uninstall-teleport.mdx b/docs/pages/installation/uninstall-teleport.mdx
new file mode 100644
index 0000000000000..a3d17043219a0
--- /dev/null
+++ b/docs/pages/installation/uninstall-teleport.mdx
@@ -0,0 +1,351 @@
+---
+title: Uninstall Teleport
+description: How to remove Teleport from your system
+sidebar_position: 8
+tags:
+ - how-to
+ - platform-wide
+---
+
+This guide explains how to uninstall Teleport completely including binaries, configurations and data.
+
+## How it works
+
+On a single host, a Teleport installation involves the following components,
+which you must remove in order to uninstall Teleport:
+
+- A daemon configuration to launch Teleport on system start
+- Teleport binaries
+- The Teleport data directory and configuration file
+
+Uninstalling Teleport is a separate operation from tearing down a Teleport
+cluster, which depends on how you deployed the Teleport Auth Service, Proxy
+Service, and other Teleport cluster components.
+
+## Prerequisites
+
+- A system with Teleport installed.
+
+<Admonition type="warning">
+These instructions only apply to non-containerized installations of Teleport.
+
+If you are running Teleport in Kubernetes, you should uninstall the Helm chart release instead:
+
+```code
+# Example: uninstall the Helm release named 'teleport-kube-agent' in the 'teleport' namespace
+$ helm uninstall --namespace teleport teleport-kube-agent
+```
+
+If you are running Teleport in Docker, you should stop the Teleport Docker container:
+
+```code
+# Example: Stop the Docker container named 'teleport'
+$ docker stop teleport
+```
+</Admonition>
+
+## Step 1/3. Stop any running Teleport processes
+
+<Tabs>
+  <TabItem label="Linux">
+    Instruct `systemd` to stop the Teleport process, and disable it from automatically starting:
+
+    ```code
+    $ sudo systemctl stop teleport
+    $ sudo systemctl disable teleport
+    ```
+
+    If these `systemd` commands do not work, you can "kill" all the running Teleport processes instead:
+
+    ```code
+    $ sudo killall teleport
+    ```
+  </TabItem>
+  <TabItem label="macOS">
+
+    Instruct `launchd` to stop the Teleport process, and disable it from automatically starting:
+
+    ```code
+    $ sudo launchctl unload -w /Library/LaunchDaemons/com.goteleport.teleport.plist
+    $ sudo rm -f /Library/LaunchDaemons/com.goteleport.teleport.plist
+    ```
+
+   If these commands do not work, you can "kill" all the running Teleport processes instead:
+
+    ```code
+    $ sudo killall teleport
+    ```
+
+  </TabItem>
+  <TabItem label="Windows">
+
+    There are currently no long-running Teleport processes on Windows machines.
+
+  </TabItem>
+</Tabs>
+
+## Step 2/3. Remove Teleport binaries
+
+Follow the steps for your operating system to remove Teleport binaries.
+
+### Linux
+
+First, uninstall the Teleport automatic updater (`teleport-update`) and the Teleport versions it potentially installed:
+
+  ```code
+  teleport-update uninstall
+  ```
+
+Then, follow the instructions for your Linux distribution:
+
+<Tabs>
+  <TabItem label="Debian/Ubuntu Linux (DEB)">
+
+  Uninstall the Teleport binary using APT:
+
+  ```code
+  $ sudo apt-get -y remove teleport-ent
+  ```
+
+  For Teleport Community Edition, use the following command:
+
+  ```code
+  $ sudo apt-get -y remove teleport
+  ```
+
+  Uninstall the Teleport APT repo:
+
+  ```code
+  $ sudo rm -f /etc/apt/sources.list.d/teleport.list
+  ```
+
+  <Admonition type="note" title="Uninstall standalone DEB package">
+  If the commands above do not work, you may have installed Teleport using a standalone DEB package. Remove it with:
+
+  ```code
+  # Use "teleport" instead of "teleport-ent" for Teleport Community Edition
+  $ sudo dpkg -r teleport-ent
+  ```
+  </Admonition>
+
+  </TabItem>
+  <TabItem label="Amazon Linux 2/RHEL (RPM)">
+
+  Uninstall the Teleport binary using YUM:
+
+  ```code
+  # Change the package name to "teleport" for Teleport Community Edition
+  $ sudo yum -y remove teleport-ent
+  # Optional: Use DNF on newer distributions
+  # $ sudo dnf -y remove teleport-ent
+  ```
+
+  Uninstall the Teleport YUM repo:
+
+  ```code
+  $ sudo rm -f /etc/yum.repos.d/teleport.repo
+  ```
+
+  <Admonition type="note" title="Uninstall standalone RPM package">
+  If the commands above do not work, you may have installed Teleport using a standalone RPM package. Remove it with:
+
+  ```code
+  # Use "teleport" for Teleport Community Edition
+  $ sudo rpm -e teleport-ent
+  ```
+  </Admonition>
+
+  </TabItem>
+  <TabItem label="SUSE Linux Enterprise Server (zypper)">
+
+  Uninstall the Teleport binary using zypper:
+
+  ```code
+  # Change the package name to "teleport" for Teleport Community Edition
+  $ sudo zypper -y remove teleport-ent
+  ```
+
+  Uninstall the Teleport zypper repo:
+
+  ```code
+  $ sudo zypper removerepo teleport
+  ```
+
+  </TabItem>
+  <TabItem label="Linux Tarball">
+
+  <Admonition type="note">
+  These are the default paths to the Teleport binaries. If you have changed these from the defaults on your system, substitute those paths here.
+  You can use `dirname $(which teleport)` to look this up automatically.
+  </Admonition>
+
+  Then, remove the Teleport binaries from the machine:
+
+  (!docs/pages/includes/uninstall-teleport-binaries.mdx!)
+
+  </TabItem>
+</Tabs>
+
+### macOS
+
+  <Admonition type="note">
+  These are the default paths to the Teleport binaries. If you have changed these from the defaults on your system, substitute those paths here.
+  You can use `dirname $(which teleport)` to look this up automatically.
+  </Admonition>
+
+  Remove the Teleport binaries and links to Teleport software from the machine:
+
+  (!docs/pages/includes/uninstall-teleport-binaries.mdx!)
+
+  <Admonition type="note" title="Uninstall macOS client tools">
+
+  You may have Teleport software in the `/Applications` folder if you:
+  - Installed from a macOS tarball for v17+ that includes `tsh.app` and `tctl.app`
+  - Installed the macOS `tsh` client-only package for v16 or older versions.
+  - Installed Teleport Connect for macOS
+
+  You can remove those with these commands:
+
+  ```code
+  $ sudo rm -rf /Applications/tsh.app
+  $ sudo rm -rf /Applications/tctl.app
+  $ sudo rm -rf /Applications/Teleport\ Connect.app
+  ```
+  </Admonition>
+
+### Windows
+
+  Remove the `tsh.exe`, `tctl.exe`, and `tbot.exe` binaries from the machine:
+
+  ```code
+  $ del C:\Path\To\tsh.exe
+  $ del C:\Path\To\tctl.exe
+  $ del C:\Path\To\tbot.exe
+  ```
+(!docs/pages/includes/uninstall-teleport-connect-windows.mdx!)
+
+(!docs/pages/includes/uninstall-windows-auth.mdx!)
+
+## Step 3/3. Remove Teleport data and configuration files
+
+<Tabs>
+  <TabItem label="Linux">
+    <Admonition type="note">
+    These are the default paths to the Teleport config files and data directory.
+    If you have changed these from the defaults on your system, substitute those paths here.
+    </Admonition>
+
+    Remove the Teleport config file:
+
+    ```code
+    $ sudo rm -f /etc/teleport.yaml
+    # Optional: Also remove the tbot config file, if you used it
+    # $ sudo rm -f /etc/tbot.yaml
+    ```
+
+    Remove the Teleport data directory:
+
+    ```code
+    $ sudo rm -rf /var/lib/teleport
+    ```
+
+     Optionally, also remove the global config file and local user data directory for `tsh`:
+
+    ```code
+    $ sudo rm -f /etc/tsh.yaml
+    $ rm -rf ~/.tsh
+    ```
+  </TabItem>
+  <TabItem label="MacOS">
+    <Admonition type="note">
+    These are the default paths to the Teleport config files and data directory.
+    If you have changed these from the defaults on your system, substitute those paths here.
+    </Admonition>
+
+    Remove the Teleport config file:
+
+    ```code
+    $ sudo rm -f /etc/teleport.yaml
+    # Optional: Also remove the tbot config file, if you used it
+    # $ sudo rm -f /etc/tbot.yaml
+    ```
+
+    Remove the Teleport data directory:
+
+    ```code
+    $ sudo rm -rf /var/lib/teleport
+    ```
+
+    Optionally, also remove:
+    - the global config file and local user data directory for `tsh`
+    - the local user data directory for Teleport Connect
+
+    ```code
+    # tsh
+    $ sudo rm -f /etc/tsh.yaml
+    $ rm -rf ~/.tsh
+    # Teleport Connect
+    $ rm -rf ~/Library/Application\ Support/Teleport\ Connect
+    ```
+  </TabItem>
+  <TabItem label="Windows">
+
+   Remove the local user data directory for `tsh`:
+
+   ```code
+   $ rmdir /s /q %USERPROFILE%\.tsh
+   ```
+
+   Optionally, also remove the local user data directory for Teleport Connect:
+
+   ```code
+   $ rmdir /s /q "%APPDATA%\Teleport Connect"
+   ```
+
+  </TabItem>
+</Tabs>
+
+Teleport is now removed from your system.
+
+Any Teleport services will stop appearing in your Teleport Web UI or the output of `tsh ls` once their last heartbeat has timed out. This usually occurs within 10-15 minutes of stopping the Teleport process.
+
+## Troubleshooting
+
+### Error with "Teleport system symlinks creation"
+
+If you have manually installed Teleport binaries from a tarball into the `/usr/local/bin` directory on your system,
+you may see an error similar to the following when trying to install the `teleport` or `teleport-ent` RPM/DEB package:
+
+```
+Setting up teleport-ent (18.5.0) ...
+Teleport system symlinks creation...
+2025-12-12T16:34:56.715-04:00 INFO [UPDATER]   Validating binary name:fdpass-teleport agent/validate.go:68
+2025-12-12T16:34:56.716-04:00 INFO [UPDATER]   Binary does not support version command name:fdpass-teleport agent/validate.go:79
+2025-12-12T16:34:56.716-04:00 ERRO [UPDATER]   Command failed. error:[
+ERROR REPORT:
+Original Error: *errors.errorString file present
+Stack Trace:
+	github.com/gravitational/teleport/lib/autoupdate/agent/installer.go:875 github.com/gravitational/teleport/lib/autoupdate/agent.needsLink
+	github.com/gravitational/teleport/lib/autoupdate/agent/installer.go:835 github.com/gravitational/teleport/lib/autoupdate/agent.(*LocalInstaller).tryLinks
+	github.com/gravitational/teleport/lib/autoupdate/agent/installer.go:483 github.com/gravitational/teleport/lib/autoupdate/agent.(*LocalInstaller).TryLinkSystem
+	github.com/gravitational/teleport/lib/autoupdate/agent/updater.go:1401 github.com/gravitational/teleport/lib/autoupdate/agent.(*Updater).LinkPackage
+	github.com/gravitational/teleport/tool/teleport-update/main.go:443 main.cmdLinkPackage	github.com/gravitational/teleport/tool/teleport-update/main.go:251 main.Run
+	github.com/gravitational/teleport/tool/teleport-update/main.go:73 main.main
+	runtime/proc.go:283 runtime.main
+	runtime/asm_amd64.s:1700 runtime.goexit
+User Message: failed to link system package installation
+	error evaluating link for fdpass-teleport
+		refusing to replace file at /usr/local/bin/fdpass-teleport
+			file present] teleport-update/main.go:271
+dpkg: error processing package teleport-ent (--configure):
+ installed teleport-ent package post-installation script subprocess returned error exit status 1
+Errors were encountered while processing:
+ teleport-ent
+needrestart is being skipped since dpkg has failed
+E: Sub-process /usr/bin/dpkg returned an error code (1)
+```
+
+This error can be resolved by running the following commands to remove any previously-installed versions of the binaries,
+and then re-running the package installation using your original command.
+
+(!docs/pages/includes/uninstall-teleport-binaries.mdx!)
\ No newline at end of file
diff --git a/docs/pages/installation/windows.mdx b/docs/pages/installation/windows.mdx
new file mode 100644
index 0000000000000..19786edb42db4
--- /dev/null
+++ b/docs/pages/installation/windows.mdx
@@ -0,0 +1,27 @@
+---
+title: Installing Teleport on Windows
+description: How to install Teleport's client tools (tsh, tctl, tbot) and Teleport Connect on Windows.
+tags:
+- reference
+- platform-wide
+---
+
+This guide explains how to install Teleport on a Windows system. 
+
+For an overview of Teleport installation methods and supported platforms, see
+[Installation](./installation.mdx).
+
+## Operating system support
+| Operating System | `teleport` Daemon | `tctl` Admin Tool | `tsh` and Teleport Connect User Clients [1] | Web UI (via the browser) | `tbot` Daemon |
+| - | - | - | - | - | - |
+| Windows 10+ (rev. 1607) \[2] | no | yes | yes | yes | yes |
+
+\[1] *`tsh` is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See [Using Teleport Connect](../connect-your-client/teleport-clients/teleport-connect.mdx) for usage and installation*.
+
+\[2] *Teleport server does not run on Windows yet, but `tsh`, `tbot`, `tctl`, and Teleport Connect (the Teleport desktop clients) support most features on Windows 10 and later.*
+
+(!docs/pages/includes/client-cluster-compatibility.mdx!)
+
+## Installing Teleport CLI tooling
+
+(!docs/pages/includes/install-windows.mdx!)
diff --git a/docs/pages/ips.mdx b/docs/pages/ips.mdx
index 78a35ed5a3763..2a2d7389d3dcf 100644
--- a/docs/pages/ips.mdx
+++ b/docs/pages/ips.mdx
@@ -1,10 +1,28 @@
 ---
 title: Public IP Address Allowlist
 description: Restrict outbound network connections from your infrastructure to cloud-hosted Teleport Enterprise.
-tocDepth: 3
+tags:
+ - reference
+ - platform-wide
 ---
 
-Teleport Agents connected to cloud-hosted Teleport Enterprise clusters must be allowed to connect to the following IP addresses in order to join the Teleport cluster.
+Teleport Cloud maintains a list of IP addresses it uses for ingress. If your environment restricts outbound traffic,
+you can allowlist these IPs in your firewall or proxy configuration to ensure that Teleport Agents can connect to your cluster.
+While not required for most deployments, this configuration can be useful in environments where outbound
+connections are blocked by default, for example, when firewalls deny all internet access unless explicitly allowed.
+
+## Using the allowlist
+
+Teleport Cloud does **not** provide stable egress IPs for traffic from the Auth
+Service and Proxy Service. 
+
+If you are a Teleport Cloud customer and plan to use the allowlist of ingress
+IPs, please open a support ticket to let us know. This allows us to provide
+advance notice whenever the list is updated.
+
+## Teleport Cloud ingress IPs
+
+Teleport Cloud uses the following IP addresses for ingress:
 
 ```
 3.7.23.103/32
@@ -30,14 +48,20 @@ Teleport Agents connected to cloud-hosted Teleport Enterprise clusters must be a
 54.185.13.106/32
 ```
 
-This list may be used to allowlist outbound network connections from Teleport Agents to cloud-hosted Teleport Enterprise.
+## Teleport Agent update domains
+
+To receive Teleport Agent updates, nodes must be able to reach the
+following domains via HTTPS during the update.
+
+```
+apt.releases.teleport.dev
+yum.releases.teleport.dev
+cdn.teleport.dev
+```
 
-Allowlisting these IPs is not a required or recommended configuration for Teleport Agents, but it may be useful in environments that require restrictions to outbound network connections.
-For example, this list may be used to configure firewalls that sit in front of Teleport Agents, when those firewalls block access to the public internet by default.
+## Modifications to the list
 
-<Admonition type="warning">
-Note that IP addresses may be added or removed from the above list over time.
-</Admonition>
+IP addresses may be added or removed from the above list over time.
 
 When this list is modified, we will provide at least two weeks notice by:
 1. Updating the Changelog below.
@@ -45,18 +69,6 @@ When this list is modified, we will provide at least two weeks notice by:
 1. Providing a [Status Page](https://status.teleport.sh/) update.
 1. Reaching out directly to Enterprise customers that have requested advanced notice.
 
-<Admonition type="warning">
-If you are Teleport Enterprise customer and plan to employ this allowlist, please let us know by opening a support ticket.
-</Admonition>
-
-Additionally, to receive Teleport Agent updates, nodes must be able to reach the following domains via HTTPS during the update.
-
-```
-apt.releases.teleport.dev
-yum.releases.teleport.dev
-cdn.teleport.dev
-```
-
 ## Changelog
 
 - 2025-04-07: Add new IPs
diff --git a/docs/pages/machine-workload-identity/access-guides/access-guides.mdx b/docs/pages/machine-workload-identity/access-guides/access-guides.mdx
new file mode 100644
index 0000000000000..463ff08cf05b2
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/access-guides.mdx
@@ -0,0 +1,35 @@
+---
+title: Access Infrastructure using tbot
+description: How to use Machine & Workload Identity to enable secure access to Teleport resources.
+template: "no-toc"
+tags:
+ - mwi
+ - infrastructure-identity
+---
+
+These guides cover how to configure a deployed `tbot` instance to produce
+credentials that can be used for machine to machine access to different Teleport
+resources.
+
+It is a pre-requisite of these guides that Machine & Workload Identity has been
+configured for your platform, see the
+[Deploy Machine & Workload Identity](../deployment/deployment.mdx) guides for
+information on how to do so.
+
+## Resource Access
+
+- [SSH servers](ssh.mdx): How to use Machine & Workload Identity to access servers via SSH.
+- [Kubernetes clusters](kubernetes.mdx): How to use Machine & Workload Identity to access Kubernetes clusters.
+- [Databases](databases.mdx): How to use Machine & Workload Identity to access database servers.
+- [Applications](applications.mdx): How to use Machine & Workload Identity to access applications.
+- [MCP servers](mcp.mdx): How to use Machine & Workload Identity to access MCP servers.
+
+## Specific Tools
+
+- [tctl](tctl.mdx): How to use Machine & Workload Identity with `tctl` to manage your Teleport configuration.
+- [Teleport Terraform provider](../../zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server.mdx): How to use Machine & Workload Identity with the Teleport Terraform provider to manage your Teleport configuration as IaC.
+- [Ansible](ansible.mdx): How to use Machine & Workload Identity with Ansible.
+- [Ansible AWX](ansible-awx.mdx): How to use Machine & Workload Identity with Ansible AWX or
+  Ansible Automation Platform.
+- [Argo CD](argocd.mdx): How to use Machine & Workload Identity to enable Argo CD to connect to external Kubernetes clusters.
+- [SPIFFE](../workload-identity/getting-started.mdx): How to use Machine & Workload Identity to issue SPIFFE certificates.
diff --git a/docs/pages/machine-workload-identity/access-guides/ansible-awx.mdx b/docs/pages/machine-workload-identity/access-guides/ansible-awx.mdx
new file mode 100644
index 0000000000000..f63cfed18d336
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/ansible-awx.mdx
@@ -0,0 +1,510 @@
+---
+title: Machine & Workload Identity with Ansible AWX
+description: How to use Machine & Workload Identity with Ansible AWX
+sidebar_label: Ansible AWX
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+Ansible AWX, formerly known as Ansible Tower, is an interface on top of Ansible
+that can be used to run and coordinate Ansible workflows. These workflows
+connect to remote hosts via SSH which requires a form of authentication. Machine
+& Workload Identity can provide short-lived certificates to Ansible jobs run via
+AWX that allow the job to connect to SSH nodes enrolled in Teleport in a secure
+and auditable manner.
+
+This guide applies both to open-source Ansible AWX as well as Red Hat's
+commercial Ansible Automation Platform automation controller, which is
+built on top of the open-source Ansible AWX engine.
+
+## How it works
+
+In this guide, you will configure a container group in Ansible AWX to run the
+Machine & Workload Identity agent, `tbot`, as a sidecar, which will provide
+credentials and a high-performance multiplexing proxy to your Ansible AWX jobs.
+You'll then configure Ansible to use these credentials to connect to SSH nodes
+through the Teleport Proxy Service.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- A working Ansible AWX installation (or Ansible Tower, or Ansible Automation
+  Platform)
+- You must have permissions to create a new container group.
+- This guide does not apply to instance groups running outside of Kubernetes:
+  these can be treated as traditional Ansible nodes and should follow our
+  [traditional Ansible guide](./ansible.mdx) instead.
+- While not required, you may wish to read our guides on [Deploying tbot
+  in Kubernetes](../deployment/kubernetes.mdx) or [Deploying tbot in
+  Kubernetes with OIDC](../deployment/kubernetes-oidc.mdx) to learn more about
+  how to deploy `tbot` on Kubernetes, which is the foundation of the steps
+  we'll be taking in this guide.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/5. Configure Teleport resources
+
+{/* TODO: Consider recommending use of `tctl tokens configure-kube` once it is
+widely available. */}
+
+To begin, we'll need to create three new Teleport resources:
+1. A Teleport role to that will grant the `tbot` sidecar access to your desired
+   SSH nodes
+1. A bot resource to name the bot and specify its list of allowed roles
+2. A join token to allow the bot to authenticate to Teleport
+
+For this example we'll assume your AWX jobs will run on a Kubernetes cluster
+where bots can join using the [Kubernetes `static_jwks` joining
+mode](../../reference/deployment/join-methods.mdx#kubernetes-jwks).
+
+<Admonition type="tip" title="OIDC Joining">
+Kubernetes clusters running on cloud providers like Amazon EKS, Azure AKS, and
+Google Kubernetes Engine frequently rotate their JWKS keys and should instead
+use Kubernetes OIDC joining. Refer to our [Kubernetes OIDC joining
+guide](../deployment/kubernetes-oidc.mdx#step-15-verify-support-for-service-account-issuer-discovery)
+to learn how to configure the join token on these providers.
+</Admonition>
+
+Run the following command to determine your cluster's JWKS keys:
+```code
+$ kubectl get --raw /openid/v1/jwks
+{"keys":[--snip--]}
+```
+
+These keys will allow Teleport to verify that a bot trying to authenticate is
+using a JWT signed by your trusted Kubernetes cluster. Keep this value available
+for the next step.
+
+Next, create `awx-bot-resources.yaml` with the following content containing the
+three resources described above:
+```yaml
+kind: role
+version: v7
+metadata:
+  name: example-role
+spec:
+  allow:
+    # Allow login to the Linux user 'root'.
+    logins: ['root']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # your Ansible jobs need to access.
+    node_labels:
+      '*': '*'
+---
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: awx-bot
+spec:
+  # roles is a list of roles to grant to the Bot. This includes the role above,
+  # but you can add any additional roles needed to grants the bot SSH access to
+  # all the nodes you want to access via your Ansible jobs.
+  roles: [example-role]
+---
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: awx-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot resource above
+  bot_name: awx-bot
+  join_method: kubernetes
+  kubernetes:
+    # static_jwks configures the Auth Service to validate the JWT presented by
+    # `tbot` using the public key from a statically configured JWKS.
+    type: static_jwks
+    static_jwks:
+      jwks: |
+        # Replace this section (including this comment) with the JWKS keys you
+        # retrieved above.
+        {"keys":[--snip--]}
+    # allow specifies the rules by which the Auth Service determines if `tbot`
+    # should be allowed to join.
+    allow:
+    - service_account: "<Var name="awx" />:default" # namespace:service_account
+```
+
+Be sure to adjust this configuration as needed:
+- Adjust the example role's `logins` and `node_labels` fields to limit access to
+  just the nodes and logins needed to run your Ansible jobs.
+- Grant any additional desired roles to the bot by appending them to the
+  `spec.roles` list in the bot definition.
+- Replace the token's `spec.kubernetes.static_jwks.jwks` field value with the
+  JWKS keys you retrieved above.
+- Adjust the token's `spec.kubernetes.allow` entry or entries as needed to match
+  the namespace(s) and service account under which your AWX jobs will run.
+
+Once ready, run the following command to create the resources on your Teleport
+cluster:
+```code
+$ tctl create -f awx-bot-resources.yaml
+```
+
+## Step 2/5. Configure Kubernetes resources
+
+Next, we'll prepare a `ConfigMap` resource in the Kubernetes cluster in which
+your AWX jobs will run. This `ConfigMap` will contain the configuration for
+Machine & Workload Identity's agent, `tbot`, in particular:
+- The address of your Teleport cluster
+- How to join your Teleport cluster, using the join token you created in the
+  previous step
+- Where the bot should store its internal data (in memory, since AWX jobs are
+  ephemeral)
+- Which additional services the bot should run, in this case an
+  `ssh-multiplexer` to provide efficient access to SSH nodes
+
+The only Kubernetes resource we'll need to configure
+manually is a `ConfigMap` for `tbot`.
+
+Write the following to `configmap-tbot-awx-config.yaml`:
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tbot-awx-config
+  namespace: <Var name="awx" />
+data:
+  tbot.yaml: |
+    version: v2
+    onboarding:
+      join_method: kubernetes
+      # ensure token is set to the name of the join token you created earlier
+      token: awx-bot
+    storage:
+      # a memory destination is used for the bots own state since the kubernetes
+      # join method does not require persistence.
+      type: memory
+    # ensure this is configured to the address of your Teleport Proxy Service.
+    proxy_server: <Var name="example.teleport.sh" />:443
+    services:
+    # The `ssh-multiplexer` service provides a high-performance multiplexer
+    # socket for use in Ansible jobs.
+    - type: ssh-multiplexer
+      # This path (/tbot/) must match the volume mount for the `tbot-binaries`
+      # shared volume.
+      proxy_command: ["/tbot/fdpass-teleport"]
+      destination:
+        type: directory
+        # The path in the pod where credentials and the multiplexer socket will
+        # be created. This must match the volume mounts for both the worker and
+        # tbot containers.
+        path: "/tbot-output"
+```
+
+For more information on the possible values in this config file, see Machine
+ID's [configuration reference](../../reference/machine-workload-identity/configuration.mdx).
+
+<Admonition type="info" title="About the ssh-multiplexer">
+Machine ID's `ssh-multiplexer` service is used to improve performance when
+opening many SSH connections. It provides a Unix socket which the
+`fdpass-teleport` executable can use to open new SSH sessions over a single,
+shared connection to Teleport. The SSH config written to
+`/tbot-output/ssh_config` will be automatically configured to do this.
+
+See the [reference page](../../reference/machine-workload-identity/configuration.mdx#ssh-multiplexer)
+to learn more about the `ssh-multiplexer` service.
+</Admonition>
+
+Note that this `ConfigMap` resource may need to be adjusted to match your
+environment. Here we assume that AWX jobs will run in the namespace
+<Var name="awx" /> and that credentials should be fetched from the Teleport
+cluster at <Var name="example.teleport.sh" />. Once ready, create the resource:
+
+```code
+$ kubectl create -f configmap-tbot-awx-config.yaml
+```
+
+Note that we use the default service namespace service account, matching the
+default AWX container group template that you'll configure below. If you prefer
+to create a custom service account, refer to our generic [Kubernetes
+guide](../deployment/kubernetes.mdx) for an example of the Kubernetes RBAC
+resources you'll need to create, and the adjustments you'll need to make to the
+Teleport token to allow that account to join.
+
+## Step 3/5. Create a new container group
+
+### Summary of pod spec changes
+
+This section describes only one possible way to access resources in Teleport
+from a workflow run from Ansible AWX and you will likely need to adapt the steps
+described here to suit your environment.
+
+Here's a quick summary of the changes we'll make to the default pod spec in this
+guide, and what alternatives you might consider when implementing this yourself:
+
+1. `tbot` and `fdpass-teleport` binaries must be made available to your
+   execution environment. We'll use a Teleport `initContainer` to copy these
+   binaries into an arbitrary execution environment (like `awx-ee`), but if you
+   build your own EE, you can instead install these Teleport binaries into your
+   EE directly and will not need to use an `initContainer`.
+2. A `tbot` sidecar is added to connect to Teleport, fetch and update SSH
+   credentials, and provide an `ssh-multiplexer` socket to enable efficient SSH
+   connections to your SSH hosts managed by Teleport.
+3. Four additional volumes are be added to the pod spec:
+   1. A projected service account token (`join-sa-token`), used for [Kubernetes
+      joining](../deployment/kubernetes.mdx)
+   2. An `emptyDir` volume (`tbot-binaries`) to contain Teleport binaries
+   3. An `emptyDir` volume (`tbot-output`) to contain generated Teleport SSH
+      credentials
+   4. A `configMap` volume (`tbot-config`) to contain a YAML configuration used
+      for the `tbot` sidecar
+4. Several volume mounts are added:
+   1. The `tbot-binaries` volume is mounted to both the "tbot-installer"
+      `initContainer` and the `awx-ee` worker container so your Ansible job can
+      execute the binaries at runtime
+   2. The `tbot-output` volume is mounted to both the `awx-ee` worker container
+      and the `tbot` sidecar `tbot` can share its generated credentials with
+      your Ansible job at runtime
+   3. The `tbot-config` and `join-sa-token` volumes are mounted to only the
+      `tbot` sidecar
+
+### Configuring AWX
+
+Next, we'll need to create a new container instance group that spawns jobs in
+Kubernetes (or OpenShift). We'll additionally customize the pod specification to
+run `tbot` as a sidecar alongside the `awx-ee` worker container to provide SSH
+credentials to your jobs.
+
+In the AWX web UI, navigate to Administration, Instance Groups, select the "Add"
+button, and select "Add container group". Enter any name you like, and set the
+fields as desired for your environment.
+
+<Admonition type="note" title="AWX version">
+Note that this custom pod specification was written for Ansible AWX version
+24.6.1. If using a different version, or if your environment requires additional
+pod spec changes, you should carefully review the example pod spec shown below
+and make any necessary adjustments.
+</Admonition>
+
+Next, select the "Customize pod specification" checkbox. A text field will
+appear, containing a default pod spec. Replace it with the following:
+
+{/* TODO: update init container when `tbot copy-binaries` is available */}
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: <Var name="awx" />
+spec:
+  serviceAccountName: default
+  automountServiceAccountToken: false
+  initContainers:
+    - name: tbot-installer
+      image: public.ecr.aws/gravitational/teleport-distroless-debug:(=teleport.version=)
+      command: ["/busybox/busybox"]
+      args: ["cp", "/usr/local/bin/tbot", "/usr/local/bin/fdpass-teleport", "/tbot"]
+      volumeMounts:
+        - name: tbot-binaries
+          mountPath: /tbot
+  containers:
+    - image: quay.io/ansible/awx-ee:latest
+      name: worker
+      args:
+        - ansible-runner
+        - worker
+        - '--private-data-dir=/runner'
+      resources:
+        requests:
+          cpu: 250m
+          memory: 100Mi
+      volumeMounts:
+        - name: tbot-binaries
+          mountPath: /tbot
+        - name: tbot-output
+          mountPath: /tbot-output
+    - name: tbot
+      image: public.ecr.aws/gravitational/teleport-distroless-debug:(=teleport.version=)
+      command: ["/usr/local/bin/tbot"]
+      args:
+        - start
+        - -c
+        - /config/tbot.yaml
+      env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: KUBERNETES_TOKEN_PATH
+          value: /var/run/secrets/tokens/join-sa-token
+      volumeMounts:
+        - mountPath: /config
+          name: tbot-config
+        - mountPath: /var/run/secrets/tokens
+          name: join-sa-token
+        - mountPath: /tbot-output
+          name: tbot-output
+      # Configure security context to match awx-ee
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 0
+  volumes:
+    - name: tbot-binaries
+      emptyDir: {}
+    - name: tbot-output
+      emptyDir: {}
+    - name: tbot-config
+      configMap:
+        name: tbot-awx-config
+    - name: join-sa-token
+      projected:
+        sources:
+          - serviceAccountToken:
+              path: join-sa-token
+              expirationSeconds: 600
+              audience: <Var name="example.teleport.sh" />
+```
+
+Additional changes may be needed for your environment, but make certain
+to adjust at least these fields:
+- The top-level `metadata.namespace` field should match the namespace in which
+  AWX spawns pods for this instance group.
+- The `audience` field of the `join-sa-token` volume should be set to your
+  Teleport cluster name.
+- The configured `serviceAccountName` should be adjusted if you opt to use a
+  service account other than `default`.
+
+Once all necessary modifications have been made, select "Save" to finish
+configuring the new container group.
+
+## Step 4/5. Define an inventory
+
+In this step we'll create a trivial inventory containing a Teleport SSH host to
+demonstrate how to connect to them in AWX.
+
+In the Ansible AWX web interface, create an inventory containing nodes
+accessible via Teleport. To do so, navigate to Resources, Inventories, select
+the "Add" button, then select "Add inventory".
+
+Configure the name and other fields as desired, then save the new inventory.
+From the new inventory's details page, navigate to the Hosts tab, and select
+"Add" to add a new host to the inventory.
+
+Node names follow the same rules as traditional [server
+access](./ssh.mdx#connecting-using-openssh). For example, if your Teleport
+cluster name is `example.teleport.sh` and you have a node named `foo`, you
+would add `foo.example.teleport.sh`. Add one or more nodes and continue on to
+the next step.
+
+Note that for future expansion, you can compose inventories using any of the
+usual Ansible AWX tools, including smart and constructed inventories.
+
+## Step 5/5. Use the credentials in your Ansible playbook
+
+Once `tbot` is successfully able to provide credentials to your AWX jobs, you
+can adjust your playbook to make use of the credentials.
+
+{/* TODO: consider remove this once fix for gravitational/teleport#59066 is
+released; troubleshooting entry can stay to help users on older versions. */}
+
+First, create an `ansible.cfg` to disable OpenSSH's built-in multiplexer:
+
+```ini
+[ssh_connection]
+ssh_args = -o ControlMaster=no -o ControlPersist=no
+```
+
+As we've configured `tbot` to use its built-in `ssh-multiplexer` service,
+connections will still be multiplexed - by Teleport instead of OpenSSH - and
+performance should be equivalent.
+
+Next, start with this simple `hello_world.yml` playbook example:
+
+```yaml
+- name: Hello World Sample
+  hosts: all
+  gather_facts: false
+  pre_tasks:
+    - name: Wait for Teleport ssh_config to become available # noqa: run-once[task] (best effort)
+      delegate_to: localhost
+      run_once: true
+      ansible.builtin.wait_for:
+        path: /tbot-output/ssh_config
+        state: present
+        timeout: 120
+
+    - name: Configure SSH via Teleport
+      ansible.builtin.set_fact:
+        ansible_ssh_common_args: "-F /tbot-output/ssh_config"
+
+  tasks:
+    # We have to disable gather_facts at the start because we can't expect to
+    # have SSH access until Teleport's ssh_config is ready. Now that it is, we
+    # can run the module explicitly.
+    - name: Gather facts
+      ansible.builtin.setup:
+
+    - name: "Print node hostname"
+      ansible.builtin.command: "hostname"
+      changed_when: false
+```
+
+This example takes a few steps to ensure it can reliably access hosts via the
+Teleport Proxy:
+- The initial `gather_facts` is disabled as we can't depend on the SSH proxy
+  being ready immediately at startup
+- A `wait_for` task waits for `tbot`'s generated `ssh_config` to be written to
+  disk, signalling it is ready to accept SSH connection requests
+- Once ready, `ansible_ssh_common_args` is set to point to the generated
+  `ssh_config` and the playbook is allowed to continue
+- `ansible.builtin.setup` is run manually to gather facts, which was initially
+  skipped
+
+You may want to tweak the exact steps taken here to better suit your environment
+and your playbooks. For example, you may want to specify
+`ansible_ssh_common_args` at the inventory level to reuse playbooks with
+non-Teleport SSH hosts. In this case, make sure your playbooks still check to
+make certain the Teleport `ssh_config` is ready for use before trying to connect
+to hosts.
+
+Once ready, do the following to run the playbook using the new `tbot`-enabled
+container group in an AWX job:
+1. Commit these two files to a Git repository
+2. Create a new project pointing to it in your AWX dashboard and ensure it is
+   synced to your Git repository.
+3. Create a new job template and configure the following values:
+   - Select the inventory you created in step 4 using the selection dialog
+   - Select the project you just created in the selection dialog
+   - Select the `hello_world.yml` playbook from the drop-down
+   - Select the instance group you created in step 3 in the selection dialog
+   - To see node hostname output, select verbosity level "1 (Verbose)" from the
+     drop-down
+4. Perform any additional customizations you might need, depending on your
+   environment
+
+Once finished, save the new job template. On the resulting details page, select
+"Launch" to run the job. If successful, you should see a successful job run. If
+verbose logging was enabled, you should see `"stdout": "$hostname"` in the log
+output for each inventory node.
+
+## Troubleshooting
+
+### Ansible fails to connect to Teleport hosts with an error like: "Shared connection to foo.example.teleport.sh closed."
+
+This is caused by [a Teleport
+bug](https://github.com/gravitational/teleport/issues/59066) with a pending fix.
+The simplest workaround is to disable OpenSSH's built-in multiplexing via
+an `ansible.cfg` in your project containing the following:
+
+```ini
+[ssh_connection]
+ssh_args = -o ControlMaster=no -o ControlPersist=no
+```
+
+We've configured the `tbot` client to provide its own multiplexer (via the
+`ssh-multiplexer` service), so performance should be equivalent.
+
+## Next Steps
+
+- Learn more about [deploying `tbot` on Kubernetes](../deployment/kubernetes.mdx)
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+
+{/* see also: https://github.com/ansible/awx-logos/blob/master/TRADEMARKS.md */}
+
+The AWX Project is a trademark of Red Hat, Inc., used with permission.
diff --git a/docs/pages/machine-workload-identity/access-guides/ansible.mdx b/docs/pages/machine-workload-identity/access-guides/ansible.mdx
new file mode 100644
index 0000000000000..15c3e45e38ce0
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/ansible.mdx
@@ -0,0 +1,281 @@
+---
+title: Machine & Workload Identity with Ansible
+sidebar_label: Ansible
+description: How to use Machine & Workload Identity with Ansible
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+Ansible is a common tool for managing fleets of Linux hosts via SSH. In order to
+connect to the hosts, it requires a form of authentication. Machine & Workload
+Identity can be used to provide short-lived certificates to Ansible that allow
+it to connect to SSH nodes enrolled in Teleport in a secure and auditable manner.
+
+In this guide, you will configure the Machine & Workload Identity agent, `tbot`,
+to produce credentials and an OpenSSH configuration, and then configure Ansible
+to use these to connect to your SSH nodes through the Teleport Proxy Service.
+
+## Prerequisites
+
+<Admonition type="tip" title="Using Ansible AWX?">
+If you're running your Ansible jobs under Ansible AWX or Ansible Automation
+Platform, consider reading our [dedicated guide](./ansible-awx.mdx).
+</Admonition>
+
+You will need the following tools to use Teleport with Ansible.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- `ssh` OpenSSH tool
+
+- `ansible` >= (=ansible.min_version=)
+
+- Optional: [`jq`](https://stedolan.github.io/jq/) to process `JSON` output
+
+- `tbot` must already be installed and configured on the machine that will
+  run Ansible. For more information, see the
+  [deployment guides](../deployment/deployment.mdx).
+
+- If you followed the above guide, note the `--destination-dir=/opt/machine-id`
+  flag, which defines the directory where SSH certificates and OpenSSH configuration
+  used by Ansible will be written.
+
+  In particular, you will be using the `/opt/machine-id/ssh_config` file in your
+  Ansible configuration to define how Ansible should connect to Teleport Nodes.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/4. Configure RBAC
+
+As Ansible will use the credentials produced by `tbot` to connect to the SSH
+nodes, you first need to configure Teleport to grant the bot access. This is
+done by creating a role that grants the necessary permissions and then assigning
+this role to a Bot.
+
+In this example, access will be granted to all SSH nodes for the username
+<Var name="root" />. Ensure that you set this to a username that is available
+across your SSH nodes and that will have the appropriate privileges to manage
+your nodes.
+
+Create a file called `role.yaml` with the following content:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: example-role
+spec:
+  allow:
+    # Allow login to the user 'root'.
+    logins: ['<Var name="root" />']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that Ansible needs to access.
+    node_labels:
+      '*': '*'
+```
+
+Replace `example-role` with a descriptive name related to your use case.
+
+For production use, you should use labels to restrict this access to only the
+hosts that Ansible will need to access. This is known as the principal of
+least privilege and reduces damage that exfiltrated credentials can do.
+
+Use `tctl create -f ./role.yaml` to create the role.
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+Now, use `tctl bots update` to add the role to the Bot. Replace `example`
+with the name of the Bot you created in the deployment guide and `example-role`
+with the name of the role you just created:
+
+```code
+$ tctl bots update example --add-roles example-role
+```
+
+## Step 2/4. Configure the `tbot` output service
+
+Now, `tbot` needs to be configured with an output service that will produce the
+credentials and SSH configuration that is needed by Ansible. For SSH,
+we use the `identity` service type.
+
+Output services must be configured with a destination. In this example, the
+`directory` destination will be used. This will write these credentials to a
+specified directory on disk. Ensure that this directory can be written to by the
+Linux user that `tbot` runs as, and that it can be read by the Linux user that
+Ansible will run as.
+
+Modify your `tbot` configuration to add an `identity` service:
+
+```yaml
+services:
+- type: identity
+  destination:
+    type: directory
+    # For this guide, /opt/machine-id is used as the destination directory.
+    # You may wish to customize this. Multiple outputs cannot share the same
+    # destination.
+    path: /opt/machine-id
+```
+
+If operating `tbot` as a background service, restart it. If running `tbot` in
+one-shot mode, it must be executed before you attempt to execute the Ansible
+playbook.
+
+You should now see several files under `/opt/machine-id`:
+
+- `ssh_config`: this can be used with Ansible or OpenSSH to configure them to
+use the Teleport Proxy Service with the correct credentials when making connections.
+- `known_hosts`: this contains the Teleport SSH host CAs and allows the SSH
+client to validate a host's certificate.
+- `key-cert.pub`: this is an SSH certificate signed by the Teleport SSH user
+CA.
+- `key`: this is the private key needed to use the SSH certificate.
+
+Next, Ansible will be configured to use these files when making connections.
+
+## Step 3/4. Configure Ansible
+
+Create a folder named `ansible` where all Ansible files will be collected.
+
+```code
+$ mkdir -p ansible
+$ cd ansible
+```
+
+Create a file called `ansible.cfg`. We will configure Ansible
+to run the OpenSSH client with the configuration file generated
+by `tbot`, `/opt/machine-id/ssh_config`. Note, `example.com` here is the
+name of your Teleport cluster.
+
+```code
+[defaults]
+host_key_checking = True
+inventory=./hosts
+remote_tmp=/tmp
+
+[ssh_connection]
+scp_if_ssh = True
+ssh_args = -F /opt/machine-id/ssh_config
+```
+
+You can then create an inventory file called `hosts`. This should refer to the
+hosts using their hostname as registered in Teleport and the name of your
+Teleport cluster should be appended to this. For example, if your cluster is
+called `teleport.example.com` and your host is called `node1`, the entry in
+`hosts` would be `node1.teleport.example.com`.
+
+You can generate an inventory file for all your nodes that meets this
+requirement with a script like the following:
+
+```code
+# Source tsh env to get the name of the current Teleport cluster.
+$ eval "$( tsh env )"
+# You can modify the `tsh ls` command to filter nodes based ont he label.
+$ tsh ls --format=json | jq --arg cluster $TELEPORT_CLUSTER -r '.[].spec.hostname + "." + $cluster' > hosts
+```
+
+<details>
+<summary>Not seeing Nodes?</summary>
+
+(!docs/pages/includes/node-logins.mdx!)
+
+</details>
+
+## Step 4/4. Run a playbook
+
+Finally, let's create a simple Ansible playbook, `playbook.yaml`. The example
+playbook below runs `hostname` on all hosts.
+
+```yaml
+- hosts: all
+  remote_user: <Var name="root" />
+  tasks:
+    - name: "hostname"
+      command: "hostname"
+```
+
+From the folder `ansible`, run the Ansible playbook:
+
+```code
+$ ansible-playbook playbook.yaml
+
+# PLAY [all] *****************************************************************************************************************************************
+# TASK [Gathering Facts] *****************************************************************************************************************************
+#
+# ok: [terminal]
+#
+# TASK [hostname] ************************************************************************************************************************************
+# changed: [terminal]
+#
+# PLAY RECAP *****************************************************************************************************************************************
+# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+You are all set. You have provided your machine with short-lived certificates
+tied to a machine identity that can be rotated, audited, and controlled with
+all the familiar access controls.
+
+## Troubleshooting
+
+In case if Ansible cannot connect, you may see error like this one:
+
+```txt
+example.host | UNREACHABLE! => {
+    "changed": false,
+    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname node-name: Name or service not known",
+    "unreachable": true
+}
+```
+
+You can examine and tweak patterns matching the inventory hosts in `ssh_config`.
+
+Try the SSH connection using `ssh_config` with verbose mode to inspect the error:
+
+```code
+$ ssh -vvv -F /opt/machine-id/ssh_config <Var name="root" />@node-name.example.com
+```
+
+If `ssh` works, try running the playbook with verbose mode on:
+
+```code
+$ ansible-playbook -vvv playbook.yaml
+```
+
+If your hostnames contain uppercase characters (like `MYHOSTNAME`), please note that Teleport's internal hostname matching
+is case sensitive by default, which can also lead to seeing this error.
+
+If this is the case, you can work around this by enabling case-insensitive routing at the cluster level.
+
+<Tabs>
+<TabItem label="Self-hosted Teleport">
+
+Edit your `/etc/teleport.yaml` config file on all servers running the Teleport `auth_service`, then restart Teleport on each.
+
+```yaml
+auth_service:
+  case_insensitive_routing: true
+```
+
+</TabItem>
+<TabItem label="Managed Teleport Enterprise/Cloud">
+
+Run `tctl edit cluster_networking_config` to add the following specification, then save and exit.
+
+```yaml
+spec:
+  case_insensitive_routing: true
+```
+
+</TabItem>
+</Tabs>
+
+## Next steps
+
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- If you use Ansible AWX or Ansible Automation Platform, read our
+  [dedicated Ansible AWX Guide](./ansible-awx.mdx).
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/applications.mdx b/docs/pages/machine-workload-identity/access-guides/applications.mdx
similarity index 78%
rename from docs/pages/enroll-resources/machine-id/access-guides/applications.mdx
rename to docs/pages/machine-workload-identity/access-guides/applications.mdx
index f9b7f6479174e..d9e1fe15f6c2d 100644
--- a/docs/pages/enroll-resources/machine-id/access-guides/applications.mdx
+++ b/docs/pages/machine-workload-identity/access-guides/applications.mdx
@@ -1,20 +1,29 @@
 ---
-title: Machine ID with Application Access
-description: How to use Machine ID to access applications
+title: Machine & Workload Identity with Application Access
+description: How to use Machine & Workload Identity to access applications
+sidebar_label: Applications
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
-Teleport protects and controls access to HTTP and TCP applications. Machine ID
-can be used to grant machines secure, short-lived access to these applications.
+{/* lint disable page-structure remark-lint */}
 
-In this guide, you will configure `tbot` to produce credentials that can be
-used to access an application enrolled in your Teleport cluster.
+Teleport protects and controls access to HTTP and TCP applications. Machine &
+Workload Identity can be used to grant machines secure, short-lived access to
+these applications.
+
+In this guide, you will configure Machine & Workload Identity's agent, `tbot`,
+to produce credentials that can be used to access an application enrolled in
+your Teleport cluster.
 
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - If you have not already connected your application to Teleport, follow
-  the [Protect a Web Application with Teleport](../../application-access/getting-started.mdx).
+  the [Protect a Web Application with Teleport](../../enroll-resources/application-access/getting-started.mdx).
 - (!docs/pages/includes/tctl.mdx!)
 - `tbot` must already be installed and configured on the machine that will
   access applications. For more information, see the
@@ -70,7 +79,7 @@ the credentials to the connection, meaning that the client does not need to
 support client certificates. However, this does mean that the `tbot` process
 must be running for the client to access the application.
 
-The second option is the `application` output. This will write TLS credentials
+The second option is the `application` output service. This will write TLS credentials
 to a destination where your client will read them from. The client must support
 client certificates and reloading them from disk when they are renewed. In
 addition, this option is not compatible with a TLS-terminating load-balancer
@@ -102,19 +111,22 @@ Replace:
 - `dumper` with the name of the application you registered in Teleport.
 - `listen` with the address and port you wish the service to bind to.
 
+Ensure that `tbot` is not configured to run in one-shot mode, as the application
+tunnel will not start in this mode.
+
 Restart `tbot` to apply the new configuration.
 </TabItem>
-<TabItem label="application output">
-Outputs must be configured with a destination. In this example, the `directory`
-destination will be used. This will write artifacts to a specified directory on
-disk. Ensure that this directory can be written to by the Linux user that
-`tbot` runs as, and that it can be read by the Linux user that will be accessing
-applications.
+<TabItem label="application service">
+Output services must be configured with a destination. In this example, the
+`directory` destination will be used. This will write artifacts to a specified
+directory on disk. Ensure that this directory can be written to by the Linux
+user that `tbot` runs as, and that it can be read by the Linux user that will be
+accessing applications.
 
-Modify your `tbot` configuration to add an `application` output:
+Modify your `tbot` configuration to add an `application` service:
 
 ```yaml
-outputs:
+services:
 - type: application
   # specify the name of the application you wish the credentials to grant
   # access to.
@@ -122,8 +134,8 @@ outputs:
   destination:
     type: directory
     # For this guide, /opt/machine-id is used as the destination directory.
-    # You may wish to customize this. Multiple outputs cannot share the same
-    # destination.
+    # You may wish to customize this. Multiple output services cannot share the
+    # same destination.
     path: /opt/machine-id
 ```
 
@@ -135,7 +147,7 @@ one-shot mode, it must be executed before you attempt to use the credentials.
 </TabItem>
 </Tabs>
 
-## Step 3/3. Connect to your web application with the Machine ID identity
+## Step 3/3. Connect to your web application
 
 <Tabs>
 <TabItem label="application-tunnel service">
@@ -148,7 +160,7 @@ For example, to access the application using `curl`:
 $ curl http://127.0.0.1:1234/
 ```
 </TabItem>
-<TabItem label="application output">
+<TabItem label="application service">
 Once `tbot` has been run, credentials will be output to the directory specified
 in the destination. Using the example of `/opt/machine-id`:
 
@@ -185,10 +197,11 @@ will be redirected to the Teleport login page when attempting to access the app.
 ### Client application requires certificates with standard extensions
 
 If your automated service requires TLS certificates with a specific file
-extension, you may also enable the `specific_tls_naming` option for the output:
+extension, you may also enable the `specific_tls_naming` option for the output
+service:
 
 ```yaml
-outputs:
+services:
 - type: application
   destination:
     type: directory
@@ -211,10 +224,10 @@ has been configured to use both the client certificate and key.
 
 ## Next steps
 
-- Review the [Access Controls Reference](../../../reference/access-controls/roles.mdx)
+- Review the [Access Controls Reference](../../reference/access-controls/roles.mdx)
   to learn about restricting which Applications and other Teleport resources
   your bot may access.
-- Configure [JWTs](../../application-access/jwt/introduction.mdx) for your
+- Configure [JWTs](../../enroll-resources/application-access/jwt/introduction.mdx) for your
   Application to remove the need for additional login credentials.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available configuration options.
diff --git a/docs/pages/machine-workload-identity/access-guides/argocd.mdx b/docs/pages/machine-workload-identity/access-guides/argocd.mdx
new file mode 100644
index 0000000000000..6c8771e2d5011
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/argocd.mdx
@@ -0,0 +1,342 @@
+---
+title: Machine & Workload Identity with Argo CD
+description: How to use Machine & Workload Identity to enable Argo CD to connect to external Kubernetes clusters
+sidebar_label: Argo CD
+tags:
+ - ci-cd
+ - infrastructure-as-code
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It
+runs in Kubernetes and can deploy applications to the same cluster or to other
+"external" clusters.
+
+In this guide, you will configure the Machine & Workload Identity agent, `tbot`,
+to manage Argo CD's cluster credentials, enabling it to securely deploy
+applications using Teleport.
+
+## How it works
+
+Argo CD supports declaratively managing clusters using Kubernetes secrets (see
+the [Argo CD
+documentation](https://argo-cd.readthedocs.io/en/latest/operator-manual/declarative-setup/#clusters).
+The Argo CD application controller reads these secrets in order to retrieve
+cluster credentials. When configured to use the Argo CD output service, `tbot`
+writes Teleport-signed Kubernetes cluster credentials into secrets that Argo CD
+can then use to access Teleport-protected Kubernetes clusters.
+
+## Prerequisite
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- Argo CD [installed](https://argo-cd.readthedocs.io/en/latest/#quick-start)
+  in a Kubernetes cluster. This cluster will be referred to as the **source
+  cluster** throughout this guide, it does not need to be enrolled into Teleport.
+- The Kubernetes cluster to which you'd like Argo CD to deploy applications.
+  This cluster will be referred to as the **target cluster** throughout this
+  guide, it must be enrolled into Teleport, if you have not already done this,
+  follow the [Enroll a Kubernetes Cluster](../../enroll-resources/kubernetes-access/getting-started.mdx)
+  guide.
+- (!docs/pages/includes/tctl.mdx!)
+- To configure Kubernetes and deploy `tbot` you will need
+  [`kubectl`](https://kubernetes.io/docs/tasks/tools/) and
+  [`helm`](https://helm.sh/docs/intro/install/) installed.
+- To check clusters have been registered with Argo CD, you will need the
+  [`argocd` CLI](https://argo-cd.readthedocs.io/en/stable/cli_installation/)
+  installed.
+
+## Step 1/4. Configure Teleport and Kubernetes RBAC
+
+First, we need to configure the RBAC for both Teleport and Kubernetes in order
+to grant the Machine & Workload Identity agent, `tbot`, the correct level of
+access.
+
+When forwarding requests to the Kubernetes API on behalf of a bot, the Teleport
+Proxy attaches the groups configured (using `kubernetes_groups`) in the bot's
+Teleport roles to the request. These groups are then used to configure a
+RoleBinding or ClusterRoleBinding in Kubernetes to grant specific permissions
+within the Kubernetes cluster to the bot.
+
+For the purpose of this guide, we will bind the `editor` group to the default
+`edit` ClusterRole that is preconfigured in most Kubernetes clusters to give the
+bot read and write access to resources in all the cluster namespaces.
+
+When configuring this in a production environment, you should consider:
+
+- If RoleBinding should be used instead of ClusterRoleBinding to limit the bot's
+  access to a specific namespace.
+- If a Role should be created that grants the bot the least privileges necessary
+  rather than using a pre-existing general Role such as `edit`.
+
+To bind the `editor` group to the `edit` Cluster Role, run the following command
+against both the **source and target clusters**:
+
+```code
+$ kubectl create clusterrolebinding teleport-editor-edit \
+  --clusterrole=edit \
+  --group=editor
+```
+
+With the appropriate RoleBinding configured in Kubernetes to grant access to a
+specific group, you now need to add this group to the role that the bot will
+impersonate when producing credentials. You also need to grant the bot access
+through Teleport to the cluster itself. This is done by creating a role that
+grants the necessary permissions and then assigning this role to the bot.
+
+Create a file called `role.yaml` with the following content:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: example-role
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_groups:
+    - editor
+    kubernetes_resources:
+    - kind: "*"
+      namespace: "*"
+      name: "*"
+      verbs: ["*"]
+```
+
+Replace `example-role` with a descriptive name related to your use case.
+
+Adjust the `allow` field for your environment:
+
+- `kubernetes_labels` should be adjusted to grant access to only the clusters
+  that the bot will need to access. The value shown, `'*': '*'` will grant
+  access to all Kubernetes clusters.
+- `editor` must match the name of the group you specified in the RoleBinding or
+  ClusterRoleBinding.
+- `kubernetes_resources` can be used to apply additional restrictions to what
+  the bot can access within the Kubernetes cluster. These restrictions are
+  layered upon the RBAC configured within the Kubernetes role itself.
+
+Use `tctl create -f ./role.yaml` to create the role.
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+## Step 2/4. Create a bot
+
+Next, we need to create the bot. A bot is a Teleport identity for a machine or
+group of machines.
+
+Create a file called `bot.yaml` with the following content:
+
+```yaml
+kind: bot
+version: v1
+metadata:
+  # name uniquely identifies the bot within Teleport
+  name: example-bot
+spec:
+  # roles that will be granted to the bot.
+  roles: [example-role]
+```
+
+Make sure you replace `example-bot` with a unique, descriptive name for your Bot,
+and replace `example-role` with the name of the role you created in the previous
+step.
+
+Use `tctl create -f ./bot.yaml` to create the bot.
+
+## Step 3/4. Create a join token
+
+In order for `tbot` to be able to authenticate and join the Teleport cluster,
+we need to configure a join token. There are a number of different available
+[methods](../../reference/deployment/join-methods.mdx), but for this guide we will use
+the `kubernetes` method with a static JWKS. Please refer to the
+[Deploying tbot on Kubernetes](../deployment/kubernetes.mdx) guide for more
+in-depth information.
+
+<Admonition type="warning" title="OIDC Joining">
+Certain cloud providers like Amazon EKS regularly rotate their OIDC signing
+keys, which will cause the `static_jwks` configuration you create in this guide
+to become invalid after a short period of time.
+
+On Kubernetes providers with OIDC support, like Amazon's Elastic Kubernetes
+Service (EKS), Google Kubernetes Engine (GKE), and Azure Kubernetes Service
+(AKS), consider using [Kubernetes OIDC joining](../deployment/kubernetes-oidc.mdx)
+instead.
+</Admonition>
+
+First, run the following command against the **source cluster**, to determine
+the JWKS-formatted public key:
+
+```code
+$ kubectl get --raw /openid/v1/jwks
+{"keys":[--snip--]}%
+```
+
+Next, create a file called `join-token.yaml` with the following content, ensuring
+you insert the output from the `curl` command in `spec.kubernetes.static_jwks.jwks`
+and specify the namespace in which Argo CD is running in
+`spec.kubernetes.allow[0].service_account`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the tbot Helm chart values later
+  name: example-join-token
+spec:
+  roles: [Bot]
+  # bot_name must match the name of the bot created earlier in this guide.
+  bot_name: example-bot
+  join_method: kubernetes
+  kubernetes:
+    # static_jwks configures the Auth Service to validate the JWT presented by
+    # `tbot` using the public key from a statically configured JWKS.
+    type: static_jwks
+    static_jwks:
+      jwks: |
+        # Place the data returned by the curl command here
+        {"keys":[--snip--]}
+    # allow specifies the rules by which the Auth Service determines if `tbot`
+    # should be allowed to join.
+    allow:
+    - service_account: "argocd:tbot" # namespace:service_account
+```
+
+Use `tctl create -f ./join-token.yaml` to create the join.
+
+## Step 4/4. Deploy `tbot`
+
+Finally, we'll use the official [Helm chart](../../reference/helm-reference/tbot.mdx)
+to deploy `tbot`.
+
+Find your cluster name by running `tctl status`.
+
+Create a file called `tbot-values.yaml` with the following content, ensuring you
+replace the placeholder values with your cluster name, proxy address, and using
+`clusterSelectors` to identify which Kubernetes clusters you'd like to expose to
+Argo CD:
+
+```yaml
+clusterName: "test.teleport.sh"
+teleportProxyAddress: "test.teleport.sh:443"
+token: "example-join-token"
+defaultOutput:
+  enabled: false
+argocd:
+  enabled: true
+  clusterSelectors:
+    - labels:
+        environment: production
+```
+
+Please refer to the [Helm chart reference](../../reference/helm-reference/tbot.mdx#argocd)
+for all of the supported configuration options.
+
+Install the Helm chart by running the following commands against the source
+cluster, ensuring you specify the namespace in which Argo CD is running:
+
+```code
+$ helm repo add teleport (=teleport.helm_repo_url=)
+$ helm repo update
+$ helm install tbot teleport/tbot \
+  --namespace argocd \
+  --values tbot-values.yaml
+```
+
+Once the Helm chart installation is complete (usually after a few minutes), you
+should see your Kubernetes clusters in Argo CD. You can check this by running
+the following command:
+
+```code
+$ argocd cluster list
+SERVER                                                                    NAME
+https://test.teleport.sh:443/v1/teleport/dHAxLmZsb3BweS5jbw/Ym94b2ZyYWQ1  test.teleport.sh-prod-eu-1
+https://kubernetes.default.svc                                            in-cluster
+```
+
+You should also be able to see the `tbot`-managed cluster secrets in Kubernetes
+when running the following command:
+
+```code
+$ kubectl get secrets -n argocd | grep ^teleport.argocd-cluster.
+teleport.argocd-cluster.e815df7b7588be17   Opaque               3      7d3h
+```
+
+You can now configure Argo CD to deploy applications to your Teleport-enrolled
+clusters!
+
+If new matching clusters are added in Teleport, `tbot` will register them with
+Argo CD on the bot's next certificate renewal. If needed, the `tbot` process can
+be restarted by deleting the pod or signalled (`pkill -USR1 tbot`) to trigger an
+immediate reload.
+
+Please note that, for safety, if a cluster is deleted in Teleport or no longer
+matches your `clusterSelectors`, it will **not** be automatically removed from
+Argo CD - but `tbot` will stop refreshing its credentials.
+
+### Argo CD Impersonation
+
+Argo CD [supports using](https://argo-cd.readthedocs.io/en/latest/operator-manual/app-sync-using-impersonation/)
+Kubernetes' user impersonation feature to give the application sync process more
+restrictive privileges than the Argo control plane has generally. This can be
+used to create a permission boundary where applications deployed to the same
+cluster, but in different projects, cannot read or modify each other's resources.
+
+In order to use Argo CD impersonation with Teleport Kubernetes Access, your bot
+must have a role where `kubernetes_users` contains a wildcard. For example:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: kube-wildcard-access
+spec:
+  allow:
+    kubernetes_users:
+    - '*'
+```
+
+If you simply enumerate the users that Argo CD is allowed to impersonate in
+`kubernetes_users`, you will encounter the following error:
+
+```
+please select a user to impersonate, refusing to select a user due to several kubernetes_users set up for this user
+```
+
+This happens because Argo CD *only* sets impersonation headers on requests that
+operate on application-scoped resources. Because your role has permission to
+impersonate many users, it's ambiguous which one Teleport should use by default.
+
+When `kubernetes_users` contains a wildcard, and no specific user is being
+impersonated, Kubernetes Access will fall back to sending your bot's Teleport
+username by default. You should therefore create a RoleBinding or
+ClusterRoleBinding, in the **target cluster**, granting your bot user the
+broader permissions needed by the Argo CD control plane.
+
+```code
+$ kubectl create clusterrolebinding example-bot-edit \
+  --clusterrole=edit \
+  --user=bot-example-bot
+```
+
+<Admonition type="warning">
+When using impersonation to create a permission boundary between Argo CD
+projects, remember that Kubernetes Access will automatically impersonate any
+groups listed in `kubernetes_groups` by default.
+
+You should ensure that your bot user does not have any roles which contain
+`kubernetes_groups`, otherwise the privilege isolation provided by impersonating
+different users is compromised, because the application sync process will have
+the combination of the impersonated user's privileges and those granted to the
+groups.
+</Admonition>
+
+## Next steps
+
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx)
+  to explore all the available configuration options.
+- Read the [Teleport Kubernetes RBAC guide](../../enroll-resources/kubernetes-access/controls.mdx)
+  for more details on controlling Kubernetes access.
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/databases.mdx b/docs/pages/machine-workload-identity/access-guides/databases.mdx
similarity index 81%
rename from docs/pages/enroll-resources/machine-id/access-guides/databases.mdx
rename to docs/pages/machine-workload-identity/access-guides/databases.mdx
index b271136245ae0..6cb09a4e139f2 100644
--- a/docs/pages/enroll-resources/machine-id/access-guides/databases.mdx
+++ b/docs/pages/machine-workload-identity/access-guides/databases.mdx
@@ -1,29 +1,37 @@
 ---
-title: Machine ID with Database Access
-description: How to use Machine ID to access database servers
+# lint disable page-structure remark-lint
+title: Machine & Workload Identity with Database Access
+sidebar_label: Databases
+description: How to use Machine & Workload Identity to access database servers
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
-Teleport protects and controls access to databases. Machine ID
+{/* lint disable page-structure remark-lint */}
+
+Teleport protects and controls access to databases. Machine & Workload Identity
 can be used to grant machines secure, short-lived access to these databases.
 
 In this guide, you will configure `tbot` to produce credentials that can be
 used to access a database configured in Teleport.
 
-![Accessing Teleport-protected databases with Machine ID](../../../../img/machine-id/machine-id-database-access.svg)
+![Accessing Teleport-protected databases with Machine & Workload Identity](../../../img/machine-id/machine-id-database-access.svg)
 
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - If you have not already put your database behind the Teleport Database Service,
-  follow the [database access getting started guide](../../database-access/getting-started.mdx).
+  follow the [database access getting started guide](../../enroll-resources/database-access/getting-started.mdx).
   The Teleport Database Service supports databases like PostgreSQL, MongoDB,
   Redis, and much more. See our [database access
-  guides](../../database-access/guides/guides.mdx) for a complete list.
+  guides](../../enroll-resources/database-access/guides/guides.mdx) for a complete list.
 - (!docs/pages/includes/tctl.mdx!)
 - The `tsh` binary must be installed on the machine that will access the
   database. Depending on how `tbot` was installed, this may already be
-  installed. If it is not, see [Installation](../../../installation.mdx) for
+  installed. If it is not, see [Installation](../../installation/installation.mdx) for
   details.
 - `tbot` must already be installed and configured on the machine that will
   access the database. For more information, see the
@@ -84,18 +92,18 @@ This rule will allow the bot to do two things:
 The `'*': '*'` label selector grants access to any database server configured in Teleport.
 In production, consider restricting the bot's access using a more specific
 label selector; see the
-[Database Access RBAC guide](../../database-access/rbac.mdx)
+[Database Access RBAC guide](../../enroll-resources/database-access/rbac.mdx)
 for a full reference of database-related role options.
 {/* vale messaging.protocol-products = YES */}
 
-## Step 2/4. Configure a database `tbot` output
+## Step 2/4. Configure a database `tbot` output service
 
-Now, `tbot` needs to be configured with an output that will produce the
+Now, `tbot` needs to be configured with an output service that will produce the
 credentials needed for database access. To do this, the `database` output
-type is used.
+service type is used.
 
 The database you wish to generate credentials for is configured as part of the
-`database` output. This is controlled using three fields:
+`database` service. This is controlled using three fields:
 
 - `service` specifies the Database Service as named in the Teleport
   configuration that the credentials will grant access to.
@@ -105,11 +113,11 @@ The database you wish to generate credentials for is configured as part of the
   access to. This field does not need to be specified for all types of
   database.
 
-In addition, the `format` field in the database output controls the format of
-the generated credentials. This allows for compatibility with clients that
-expect a specific format. When this field is not specified, a sensible default
-option is used that is compatible with most clients. The full list of supported
-`format` options is below:
+In addition, the `format` field in the database output service controls the
+format of the generated credentials. This allows for compatibility with clients
+that expect a specific format. When this field is not specified, a sensible
+default option is used that is compatible with most clients. The full list of
+supported `format` options is below:
 
 | Client        | `format`      | Description                          |
 |---------------|---------------|--------------------------------------|
@@ -118,16 +126,16 @@ option is used that is compatible with most clients. The full list of supported
 | CockroachDB   | `cockroach`   | Provides `cockroach/node.key`, `cockroach/node.crt`, and `cockroach/ca.crt`. |
 | Generic TLS   | `tls`         | Provides `tls.key`, `tls.crt`, and `tls.cas` for generic clients that require specific file extensions. |
 
-Outputs must be configured with a destination. In this example, the `directory`
-destination will be used. This will write artifacts to a specified directory on
-disk. Ensure that this directory can be written to by the Linux user that
-`tbot` runs as, and that it can be read by the Linux user that will be accessing
-applications.
+Output services must be configured with a destination. In this example, the
+`directory` destination will be used. This will write artifacts to a specified
+directory on disk. Ensure that this directory can be written to by the Linux
+user that `tbot` runs as, and that it can be read by the Linux user that will be
+accessing applications.
 
-Modify your `tbot` configuration to add a `database` output:
+Modify your `tbot` configuration to add a `database` service:
 
 ```yaml
-outputs:
+services:
 - type: database
   destination:
     type: directory
@@ -175,7 +183,7 @@ To create a systemd service for this purpose, create a unit file at
 
 ```systemd
 [Unit]
-Description=Teleport Machine ID Proxy Service
+Description=Teleport Machine & Workload Identity Proxy Service
 After=network.target
 # If you have followed a previous guide and configured tbot itself as a systemd
 # service, uncomment the following line to create a dependency between the two
@@ -261,5 +269,5 @@ access controls.
 
 ## Next steps
 
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available configuration options.
diff --git a/docs/pages/machine-workload-identity/access-guides/kubernetes.mdx b/docs/pages/machine-workload-identity/access-guides/kubernetes.mdx
new file mode 100644
index 0000000000000..369d747e65a03
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/kubernetes.mdx
@@ -0,0 +1,216 @@
+---
+title: Machine & Workload Identity with Kubernetes Access
+sidebar_label: Kubernetes Clusters
+description: How to use Machine & Workload Identity to access Kubernetes clusters
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+Teleport protects and controls access to Kubernetes
+clusters. Machine & Workload Identity can be used to grant machines secure,
+short-lived access to these clusters.
+
+In this guide, you will configure `tbot` to produce credentials that can be
+used to access a Kubernetes cluster enrolled with your Teleport cluster.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- If you have not already connected your Kubernetes cluster to Teleport, follow
+  [Enroll a Kubernetes Cluster](../../enroll-resources/kubernetes-access/getting-started.mdx).
+- (!docs/pages/includes/tctl.mdx!)
+- To configure the Kubernetes cluster, your client system will need to have
+  `kubectl` installed. See the
+  [Kubernetes documentation](https://kubernetes.io/docs/tasks/tools/) for
+  installation instructions.
+- `tbot` must already be installed and configured on the machine that will
+  access Kubernetes clusters. For more information, see the
+  [deployment guides](../deployment/deployment.mdx).
+- To demonstrate connecting to the Kubernetes cluster, the machine that will
+  access Kubernetes clusters will need to have `kubectl` installed. See the
+  [Kubernetes documentation](https://kubernetes.io/docs/tasks/tools/) for
+  installation instructions.
+
+## Step 1/3. Configure Teleport and Kubernetes RBAC
+
+First, we need to configure the RBAC for both Teleport and Kubernetes in order
+to grant the bot the correct level of access.
+
+When forwarding requests to the Kubernetes API on behalf of a bot, the
+Teleport Proxy attaches the groups configured (using `kubernetes_groups`) in the
+bot's Teleport roles to the request. These groups are then used to configure a
+RoleBinding or ClusterRoleBinding in Kubernetes to grant specific permissions
+within the Kubernetes cluster to the bot.
+
+For the purpose of this guide, we will bind the `editor` group to the default
+`edit` ClusterRole that is preconfigured in most Kubernetes clusters to give
+the bot read and write access to resources in all the cluster namespaces.
+
+When configuring this for a production environment, you should consider:
+
+- If RoleBinding should be used instead of ClusterRoleBinding to limit the
+  bot's access to a specific namespace.
+- If a Role should be created that grants the bot the least privileges
+  necessary rather than using a pre-existing general Role such as `edit`.
+
+To bind the `editor` group to the `edit` Cluster Role, execute:
+
+```code
+$ kubectl create clusterrolebinding teleport-editor-edit \
+  --clusterrole=edit \
+  --group=editor
+```
+
+With the appropriate RoleBinding configured in Kubernetes to grant access to
+a specific group, you now need to add this group to the role that the bot
+will impersonate when producing credentials. You also need to grant the bot
+access through Teleport to the cluster itself. This is done by creating a
+role that grants the necessary permissions and then assigning this role to a
+Bot.
+
+Create a file called `role.yaml` with the following content:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: example-role
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_groups:
+    - editor
+    kubernetes_resources:
+    - kind: "*"
+      namespace: "*"
+      name: "*"
+      verbs: ["*"]
+```
+
+Replace `example-role` with a descriptive name related to your use case.
+
+Adjust the `allow` field for your environment:
+
+- `kubernetes_labels` should be adjusted to grant access to only the clusters
+  that the bot will need to access. The value shown, `'*': '*'` will grant
+  access to all Kubernetes clusters.
+- `editor` must match the name of the group you specified in the
+  RoleBinding or ClusterRoleBinding.
+- `kubernetes_resources` can be used to apply additional restrictions to what
+  the bot can access within the Kubernetes cluster. These restrictions are
+  layered upon the RBAC configured within the Kubernetes role itself.
+
+Use `tctl create -f ./role.yaml` to create the role.
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+Now, use `tctl bots update` to add the role to the Bot. Replace `example`
+with the name of the Bot you created in the deployment guide and `example-role`
+with the name of the role you just created:
+
+```code
+$ tctl bots update example --add-roles example-role
+```
+
+## Step 2/3. Configure a Kubernetes `tbot` output service
+
+Now, `tbot` needs to be configured with an output service to produce the
+Kubernetes credentials and client configuration file. This is done using the
+`kubernetes/v2` service type.
+
+The Kubernetes clusters you wish to make available must be specified using
+entries in the `selectors` list. In this example, `example-k8s-cluster` will be
+selected using a name selector, and all clusters with the label
+`environment=dev` will be selected as well.
+
+Output services must also be configured with a destination. In this example, the
+`directory` type will be used. This will write artifacts to a specified
+directory on disk. Ensure that this directory can be written to by the Linux
+user that `tbot` runs as, and that it can be read by the Linux user that will
+be accessing the Kubernetes cluster.
+
+Modify your `tbot` configuration to add a `kubernetes/v2` service:
+
+```yaml
+services:
+  - type: kubernetes/v2
+    selectors:
+      # Specify the name of the Kubernetes cluster you wish the credentials to
+      # grant access to. Note that wildcards are not supported.
+      - name: example-k8s-cluster
+
+      # Specify a label selector to dynamically select many clusters at once.
+      # All labels in a selector must match for a cluster to be selected, and
+      # multiple separate selectors can be specified if desired. Note that
+      # wildcards are not supported.
+      - labels:
+          environment: dev
+    destination:
+      type: directory
+          # For this guide, /opt/machine-id is used as the destination directory.
+          # You may wish to customize this. Multiple output services cannot
+          # share the same destination.
+      path: /opt/machine-id
+```
+
+Ensure you replace `example-k8s-cluster` with the name of the Kubernetes cluster
+as registered in Teleport and adjust `/opt/machine-id` if you wish.
+
+If operating `tbot` as a background service, restart it. If running `tbot` in
+one-shot mode, it must be executed before you attempt to use the credentials.
+
+## Step 3/3. Connect to your Kubernetes cluster
+
+Once `tbot` has been run with the new service configured, a file called
+`kubeconfig.yaml` should have been generated in the destination directory
+you specified. This contains all the information necessary for `kubectl` to
+connect to the Kubernetes cluster through the Teleport Proxy.
+
+To use `kubeconfig.yaml` with `kubectl`, the `--kubeconfig` flag or `KUBECONFIG`
+environment variable can be provided to `kubectl`:
+
+```code
+$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml get pods -A
+# Or, set the KUBECONFIG environment variable:
+$ export KUBECONFIG=/opt/machine-id/kubeconfig.yaml
+$ kubectl get pods -A
+```
+
+If you selected multiple clusters, they will be exposed as separate contexts
+within the generated `kubeconfig.yaml`, and will be named following the format
+`$teleportClusterName-$kubeClusterName`. To target a specific cluster, use the
+`--context` flag:
+
+```code
+$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml --context=example.teleport.sh-my-kube-cluster get pods -A
+```
+
+Note that the first selected cluster in `tbot.yaml` will be used as the default
+context. If using label selectors, the default context may vary over time if
+clusters are added or removed in Teleport.
+
+If new matching clusters are added or removed in Teleport, `kubeconfig.yaml`
+will be regenerated to reflect the change on the bot's next certificate renewal.
+If needed, the `tbot` process can be restarted or signaled (`pkill -USR1 tbot`)
+to trigger an immediate reload. Note that modifications to `kubeconfig.yaml`,
+such as changes to the `current-context` field, will be overwritten.
+
+Whilst this guide has demonstrated `kubeconfig.yaml` being used with `kubectl`,
+this format is compatible with most Kubernetes tools including:
+
+- Helm
+- Lens
+- ArgoCD
+
+## Next steps
+
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- Read the [Teleport Kubernetes RBAC guide](../../enroll-resources/kubernetes-access/controls.mdx)
+  for more details on controlling Kubernetes access.
diff --git a/docs/pages/machine-workload-identity/access-guides/mcp.mdx b/docs/pages/machine-workload-identity/access-guides/mcp.mdx
new file mode 100644
index 0000000000000..bd10d2f18a3e0
--- /dev/null
+++ b/docs/pages/machine-workload-identity/access-guides/mcp.mdx
@@ -0,0 +1,212 @@
+---
+title: Machine & Workload Identity with MCP Access
+description: How to use Machine & Workload Identity to access MCP servers
+sidebar_label: MCP
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - mcp
+---
+
+Teleport protects and control access to Model Context Protocol (MCP) servers.
+Machine & Workload Identity (MWI) can then be used to grant machines and
+workloads secure and short-lived access to these MCP servers without the need
+for long-lived static secrets.
+
+In this guide, you will configure `tbot` to produce short-lived credentials that
+can be used by an MCP client to access MCP servers enrolled within your Teleport
+cluster.
+
+This guide focuses on granting machines access to MCP servers. If you wish to
+grant human users access to MCP servers, you should instead refer to the
+[MCP Access with Stdio MCP Server guide](../../enroll-resources/mcp-access/enrolling-mcp-servers/stdio.mdx).
+
+## How it works
+
+The Teleport Application Access agent is deployed in front of the MCP server
+that you wish to protect access to. This agent is responsible for enforcing
+access control based on roles configured in Teleport.
+
+The Machine & Workload Identity agent, `tbot`, is installed on the machine
+that will require access to the MCP server. It is responsible for authenticating
+to the Teleport cluster and producing an identity file that can be used by the
+MCP client to access the MCP server through the Teleport Proxy.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- If you have not already connected your MCP server to Teleport, follow
+the [MCP Getting Started guide](../../enroll-resources/mcp-access/getting-started.mdx).
+- (!docs/pages/includes/tctl.mdx!)
+- `tbot` and `tsh` must already be installed and configured on the machine that
+will access MCP servers. For more information, see the
+[deployment guides](../deployment/deployment.mdx).
+
+## Step 1/3. Configure RBAC
+
+First, Teleport must be configured to allow the credentials produced by the bot
+to access MCP servers in your infrastructure. This is done by creating a role
+that specifies label matchers for the MCP server that you want to grant access
+to, and, specifying with tools within the MCP server that should be accessible.
+
+In our example, we will grant access to an MCP server that has been labelled
+with `env: dev` and allow access to all tools within that MCP server.
+
+Create a file named `role.yaml` with the following content:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: example-role
+spec:
+  allow:
+    app_labels:
+      'env': 'dev'
+    mcp:
+      tools: ['*']
+```
+
+Replace `example-role` with a descriptive name related to your use case, adjust
+the `app_labels` to match the labels of your MCP server, and modify the
+`mcp.tools` field to specify which tools you want to allow access to.
+
+Use `tctl create -f ./role.yaml` to create the role.
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+Now, use `tctl bots update` to add the role to the Bot. Replace `example`
+with the name of the Bot you created in the deployment guide and `example-role`
+with the name of the role you just created:
+
+```code
+$ tctl bots update example --add-roles example-role
+```
+
+## Step 2/3. Configure `tbot`
+
+Next, you'll configure `tbot` to output an identity file. This identity file
+will then be used by the MCP client to authenticate to Teleport. This is done
+using the `identity` service type.
+
+The service will need to be configured with a destination. In this example,
+the `directory` type will be used. This will write artifacts to the specified
+directory on disk. Ensure that this directory is writable by the user that
+`tbot` runs as, and that it can be read by the Linux user that the MCP client
+will be running as.
+
+Modify your `tbot` configuration to add an `identity` service:
+
+```yaml
+services:
+  - type: identity
+    allow_reissue: true
+    destination:
+      type: directory
+      path: /opt/machine-id
+```
+
+Ensure that you replace `/opt/machine-id` with the directory you have chosen.
+
+If operating `tbot` as a background service, restart it. If running `tbot` in
+one-shot mode, it must be executed before you attempt to use the credentials.
+
+## Step 3/3. Connect your MCP client
+
+You can now configure your MCP client to use the credentials produced by `tbot`
+to access MCP servers. The exact steps you need to take will depend on the
+MCP client you are using.
+
+<Tabs>
+    <TabItem label="LangGraph">
+        For compatibility with LangGraph, use the `langchain-mcp-adapters`
+        package. This package implements an MCP client and exposes the tools
+        from an MCP server in the same way as tools defined natively in Python.
+
+        Instantiate a `MultiServerMCPClient` and configure it to call
+        `tsh mcp connect` with the identity file produced by `tbot`:
+
+        ```python
+            from langchain_mcp_adapters.client import MultiServerMCPClient
+            client = MultiServerMCPClient({
+                "my-mcp-server": {
+                    "command": "tsh"
+                    "args": [
+                        "mcp",
+                        "connect",
+                        "-i", "/opt/machine-id/identity",
+                        "--proxy", "example.teleport.sh:443",
+                        "my-mcp-server",
+                    ],
+                    "transport": "stdio",
+                },
+            })
+            tools = await client.get_tools()
+        ```
+
+       Modify the example values to match your environment:
+       - `/opt/machine-id/identity` with the path to the identity file
+          produced by `tbot`.
+       - `example.teleport.sh:443` with the address of your Teleport proxy.
+       - `my-mcp-server` with the name of your MCP server as enrolled in Teleport.
+
+        See the [LangGraph documentation](https://langchain-ai.github.io/langgraph/agents/mcp/)
+        for further details.
+    </TabItem>
+    <TabItem label="Claude Desktop">
+       To configure Claude Desktop to call an MCP server through Teleport,
+       add an entry to `claude_desktop_config.json` that invokes
+       `tsh mcp connect` with the identity file produced by `tbot`:
+
+        ```json
+            {
+                "mcpServers": {
+                    "teleport-mcp-teleport-mcp-demo": {
+                        "command": "tsh",
+                        "args": [
+                           "mcp",
+                            "connect",
+                            "-i",
+                            "/opt/machine-id/identity",
+                            "--proxy",
+                            "example.teleport.sh:443",
+                            "my-mcp-server"
+                        ]
+                    }
+                }
+            }
+        ```
+
+        Modify the example values to match your environment:
+        - `/opt/machine-id/identity` with the path to the identity file
+        produced by `tbot`.
+        - `example.teleport.sh:443` with the address of your Teleport proxy.
+        - `my-mcp-server` with the name of your MCP server as enrolled in Teleport.
+
+        See the [Claude Desktop documentation](https://modelcontextprotocol.io/quickstart/user)
+        for further details.
+    </TabItem>
+    <TabItem label="Other">
+        Generally, any MCP client that supports STDIO transport can be used with
+        Teleport MCP access.
+
+        You'll need to configure the MCP client to invoke the `tsh` binary with
+        the following arguments:
+        `tsh mcp connect -i /opt/machine-id/identity --proxy example.teleport.sh:443 my-mcp-server`.
+
+        Modify the example values to match your environment:
+        - `/opt/machine-id/identity` with the path to the identity file
+        produced by `tbot`.
+        - `example.teleport.sh:443` with the address of your Teleport proxy.
+        - `my-mcp-server` with the name of your MCP server as enrolled in Teleport.
+    </TabItem>
+</Tabs>
+
+## Next steps
+
+- Read the [MCP access documentation](../../enroll-resources/mcp-access/mcp-access.mdx)
+to learn more about Teleport's MCP integration and RBAC controls.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+all the available configuration options for `tbot`.
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/ssh.mdx b/docs/pages/machine-workload-identity/access-guides/ssh.mdx
similarity index 76%
rename from docs/pages/enroll-resources/machine-id/access-guides/ssh.mdx
rename to docs/pages/machine-workload-identity/access-guides/ssh.mdx
index 7a05e458a4154..d2f41d40e2e5d 100644
--- a/docs/pages/enroll-resources/machine-id/access-guides/ssh.mdx
+++ b/docs/pages/machine-workload-identity/access-guides/ssh.mdx
@@ -1,10 +1,18 @@
 ---
-title: Machine ID with Server Access
-description: How to use Machine ID to access servers via SSH
+title: Machine & Workload Identity with Server Access
+sidebar_label: Linux Servers
+description: How to use Machine & Workload Identity to access servers via SSH
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
-Teleport protects and controls SSH access to servers. Machine ID
-can be used to grant machines secure, short-lived access to these servers.
+{/* lint disable page-structure remark-lint */}
+
+Teleport protects and controls SSH access to servers. Machine & Workload
+Identity can be used to grant machines secure, short-lived access to these
+servers.
 
 In this guide, you will configure `tbot` to produce credentials that can be
 used to access a Linux server enrolled in Teleport. The guide
@@ -15,7 +23,7 @@ will cover access using the Teleport CLI `tsh` as well as the OpenSSH client.
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - If you have not already connected your server to Teleport, follow
-  the [getting started guide](../../server-access/getting-started.mdx).
+  the [getting started guide](../../enroll-resources/server-access/getting-started.mdx).
 - (!docs/pages/includes/tctl.mdx!)
 - `tbot` must already be installed and configured on the machine that will
   connect to Linux hosts with SSH. For more information, see the
@@ -67,22 +75,22 @@ with the name of the role you just created:
 $ tctl bots update example --add-roles example-role
 ```
 
-## Step 2/3. Configure the `tbot` output
+## Step 2/3. Configure the `tbot` output service
 
-Now, `tbot` needs to be configured with an output that will produce an
-SSH certificate and OpenSSH configuration. For this we use the `identity` output
-type.
+Now, `tbot` needs to be configured with a service that will produce an SSH
+certificate and OpenSSH configuration. For this we use the `identity` output
+service type.
 
-Outputs must be configured with a destination. In this example, the `directory`
-destination will be used. This will write these credentials to a specified
-directory on disk. Ensure that this directory can be written to by the Linux
-user that `tbot` runs as, and that it can be read by the Linux user that needs
-to use SSH.
+Output services must be configured with a destination. In this example, the
+`directory` destination will be used. This will write these credentials to a
+specified directory on disk. Ensure that this directory can be written to by the
+Linux user that `tbot` runs as, and that it can be read by the Linux user that
+needs to use SSH.
 
-Modify your `tbot` configuration to add an `identity` output:
+Modify your `tbot` configuration to add an `identity` service:
 
 ```yaml
-outputs:
+services:
 - type: identity
   destination:
     type: directory
@@ -117,7 +125,7 @@ tools like `ssh` and `sftp`.
 
 ### Connecting using `tsh`
 
-To use `tsh` with a `tbot` identity output, the path to the `identity` file
+To use `tsh` with a `tbot` identity service the path to the `identity` file
 must be specified using the `-i` flag. In addition, `--proxy` must be used to
 specify the address of the Teleport Proxy Service that should be used when making
 connections.
@@ -132,7 +140,7 @@ my-host
 
 ### Connecting using OpenSSH
 
-To use OpenSSH with the identity output, the path to the `ssh_config` should be
+To use OpenSSH with the identity service, the path to the `ssh_config` should be
 provided to `ssh` with the `-F` flag.
 
 With the generated `ssh_config` you must append the name of the Teleport cluster
@@ -161,10 +169,11 @@ If you wish to integrate with Ansible, check out the
 [Ansible-specific guide](./ansible.mdx).
 
 If your tool is not compatible with `ssh_config`, it may still be possible to
-configure it to use the credentials produced by Machine ID. It must support
-SSH client certificates and either ProxyCommand or ProxyJump functionality.
+configure it to use the credentials produced by Machine & Workload Identity. It
+must support SSH client certificates and either ProxyCommand or ProxyJump
+functionality.
 
 ## Next steps
 
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available configuration options.
diff --git a/docs/pages/enroll-resources/machine-id/access-guides/tctl.mdx b/docs/pages/machine-workload-identity/access-guides/tctl.mdx
similarity index 80%
rename from docs/pages/enroll-resources/machine-id/access-guides/tctl.mdx
rename to docs/pages/machine-workload-identity/access-guides/tctl.mdx
index 63eb7e79e38b6..cd570aed36fa0 100644
--- a/docs/pages/enroll-resources/machine-id/access-guides/tctl.mdx
+++ b/docs/pages/machine-workload-identity/access-guides/tctl.mdx
@@ -1,12 +1,20 @@
 ---
-title: Machine ID with tctl
-description: How to use Machine ID with tctl to manage your Teleport configuration
+title: Machine & Workload Identity with tctl
+sidebar_label: tctl
+description: How to use Machine & Workload Identity with tctl to manage your Teleport configuration
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 `tctl` is the Teleport cluster management CLI tool. Whilst it usually uses the
 credentials from the locally logged in user, it is also possible to use
-Machine ID credentials. This allows `tctl` to be leveraged as part of a custom
-automation workflow deployed in a non-interactive environment (e.g CI/CD).
+credentials issued by Machine & Workload Identity. This allows `tctl` to be
+leveraged as part of a custom automation workflow deployed in a non-interactive
+environment (e.g CI/CD).
 
 In this guide, you will configure `tbot` to produce credentials for `tctl`, and
 then use `tctl` to deploy Teleport roles defined in files.
@@ -66,11 +74,11 @@ with the name of the role you just created:
 $ tctl bots update example --add-roles example-role
 ```
 
-## Step 2/3. Configure `tbot` output
+## Step 2/3. Configure `tbot` output service
 
-Now, `tbot` needs to be configured with an output that will produce the
+Now, `tbot` needs to be configured with a service that will produce the
 credentials needed by `tctl`. As `tctl` will be accessing the Teleport API, the
-correct output type to use is `identity`.
+correct service type to use is `identity`.
 
 For this guide, the `directory` destination will be used. This will write these
 credentials to a specified directory on disk. Ensure that this directory can
@@ -80,13 +88,13 @@ the Linux user that `tctl` will run as.
 Modify your `tbot` configuration to add an `identity` output:
 
 ```yaml
-outputs:
+services:
 - type: identity
   destination:
     type: directory
     # For this guide, /opt/machine-id is used as the destination directory.
-    # You may wish to customize this. Multiple outputs cannot share the same
-    # destination.
+    # You may wish to customize this. Multiple output services cannot share the
+    # same destination.
     path: /opt/machine-id
 ```
 
@@ -98,7 +106,7 @@ You should now see an `identity` file under `/opt/machine-id`. This contains
 the private key and signed certificates needed by `tctl` to
 authenticate with the Teleport Auth Service.
 
-## Step 3/3. Use `tctl` with the identity output
+## Step 3/3. Use `tctl` with the identity output service
 
 As an example, `tctl` will be used to apply a directory of YAML files that
 define Teleport roles. If these were stored in version control (e.g., `git`) and
@@ -141,7 +149,7 @@ $ tctl get role/tctl-test
 
 ## Next steps
 
-- Explore the [`tctl` reference](../../../reference/cli/tctl.mdx) to discover all
+- Explore the [`tctl` reference](../../reference/cli/tctl.mdx) to discover all
   `tctl` can do.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
-  all the available `tbot` configuration options.
\ No newline at end of file
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available `tbot` configuration options.
diff --git a/docs/pages/machine-workload-identity/deployment/aws.mdx b/docs/pages/machine-workload-identity/deployment/aws.mdx
new file mode 100644
index 0000000000000..eea67080a6d98
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/aws.mdx
@@ -0,0 +1,138 @@
+---
+title: Deploying tbot on AWS
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on an AWS EC2 instance
+sidebar_label: AWS EC2
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - aws
+---
+
+This guide shows you how to deploy Machine & Workload Identity's agent, `tbot`,
+on an AWS EC2 instance and connect it to your Teleport cluster.
+
+## How it works
+
+On AWS, virtual machines can be assigned an IAM role, which they can assume in
+order to request a signed document that includes information about the machine.
+
+The Teleport `iam` join method instructs the Machine & Workload Identity bot to
+request this signed document from AWS using the assigned identity and send it to
+the Teleport Auth Service for verification. This allows the bot to join the
+cluster without the exchange of a long-lived secret.
+
+While this guide focuses on deploying `tbot` on an EC2 instance, it is also
+possible to use the `iam` join method with workloads running on an EKS
+Kubernetes cluster. To do so, you must configure [IAM Roles for Service Accounts
+(IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
+for the cluster and the Kubernetes service account that will be used by the
+`tbot` pod. See the [Kubernetes platform guide](kubernetes.mdx) for further
+guidance on deploying `tbot` as a workload on Kubernetes.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- An AWS IAM role that you wish to grant access to your Teleport cluster. This
+  role must be granted `sts:GetCallerIdentity`. In this guide, this role will
+  be named `teleport-bot-role`.
+- An AWS EC2 virtual machine that you wish to install `tbot` onto configured
+  with the IAM role attached.
+
+## Step 1/5. Install `tbot`
+
+**This step is completed on the AWS EC2 instance.**
+
+First, `tbot` needs to be installed on the VM that you wish to use Machine &
+Workload Identity on.
+
+Download and install the appropriate Teleport package for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/5. Create a Bot
+
+**This step is completed on your local machine.**
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+**This step is completed on your local machine.**
+
+Create `bot-token.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: example-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: iam
+  # Restrict the AWS account and (optionally) ARN that can use this token.
+  # This information can be obtained from running the
+  # "aws sts get-caller-identity" command from the CLI.
+  allow:
+    - aws_account: "111111111111"
+      aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-bot-role/i-*"
+```
+
+Replace:
+
+- `111111111111` with the ID of your AWS account.
+- `teleport-bot-role` with the name of the AWS IAM role you created and assigned
+  to the EC2 instance.
+- `example` with the name of the bot you created in the second step.
+- `i-*` indicates that any instance with the specified role can use the join
+  method. If you wish to restrict this to an individual instance, replace `i-*`
+  with the full instance ID.
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 4/5. Configure `tbot`
+
+**This step is completed on the AWS EC2 instance.**
+
+Create `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: iam
+  token: example-bot
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy Service or
+  Auth Service. Prefer using the address of a Teleport Proxy Service instance.
+- `example-bot` with the name of the token you created in the second step.
+
+(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
+
+## Step 5/5. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Next steps
+
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+  your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/azure-devops.mdx b/docs/pages/machine-workload-identity/deployment/azure-devops.mdx
new file mode 100644
index 0000000000000..9b451564b9500
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/azure-devops.mdx
@@ -0,0 +1,205 @@
+---
+title: Deploying tbot on Azure DevOps
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on Azure DevOps.
+sidebar_label: Azure DevOps
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - azure
+---
+
+In this guide, you will configure Machine & Workload Identity's agent, `tbot`,
+to run within a Azure DevOps pipeline run. The bot will be configured to use
+the `azure_devops` delegated joining method to eliminate the need for long-lived
+secrets.
+
+## How it works
+
+The `azure_devops` join method is a secure way for Machine & Workload Identity
+bots to authenticate with the Teleport Auth Service without using any shared
+secrets. Instead, it makes use of an OpenID Connect token that Azure DevOps
+provides via an API to the pipeline job.
+
+This token is sent to the Teleport Auth Service, and assuming it has been
+configured to trust Azure DevOps's identity provider and all identity assertions
+match, the authentication attempt will succeed.
+
+This mitigates the risk of long-lived secrets such as passwords or SSH private
+keys being exfiltrated from your Azure DevOps organization and provides many of
+the other benefits of Teleport such as auditing and finely-grained access
+control.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport (v17.5.1 or higher)"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/5. Determine your Azure DevOps organization ID
+
+Before we can grant access to a `tbot` running within an Azure DevOps pipeline,
+we must determine the ID of the Azure DevOps organization that the pipeline
+runs within. This will be used later to configure the join token.
+
+To determine the organization ID, add a step to a new or existing pipeline that
+exists within the organization that echoes the `System.CollectionId` variable.
+
+For example:
+
+```yaml
+trigger:
+- main
+
+pool:
+  vmImage: ubuntu-latest
+
+steps:
+- script: |
+    echo "Organization ID: $(System.CollectionId)"
+```
+
+Run this pipeline, and inspect the output of the step. You should see your
+organization ID printed in the logs, similar to the following:
+
+```code
+========================== Starting Command Output ===========================
+/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/c4fdfbf7-6cd4-4737-a2a2-16702d201449.sh
+Organization ID: 0ca3ddd9-0000-1111-2222-example58665
+```
+
+Record this organization ID as you will need it later: <Var name="organization-id" />
+
+## Step 2/5. Create a Bot
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+To allow the Azure DevOps pipeline to authenticate to your Teleport cluster,
+you'll first need to create a join token. An Azure DevOps join token contains
+allow rules that describe which pipelines can use that token in order to join
+the Teleport cluster. A rule can contain multiple fields, and any pipeline that
+matches all the fields within a single rule is granted access.
+
+In this example, you will create a token with a rule that grants access to any
+Azure DevOps pipeline within a specific project.
+
+Create a file named `bot-token.yaml`, assigning <Var name="my-project" /> to the
+name of your Azure DevOps project:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example-bot
+spec:
+  roles: [Bot]
+  join_method: azure_devops
+  bot_name: example
+  azure_devops:
+    organization_id: <Var name="organization-id" />
+    allow:
+      - project_name: <Var name="my-project" />
+```
+Replace:
+
+- `example-bot` with a meaningful name that describes the token.
+- `example` with the name of the bot you created in Step 2.
+- `my-project` with the name of the Azure DevOps project that you want to allow
+  access to the bot.
+
+You can find a full list of the token configuration options for Azure DevOps
+joining on the
+[join methods reference page.](../../reference/deployment/join-methods.mdx#azure-devops-azure_devops)
+
+Apply this to your Teleport cluster using `tctl`:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 4/5. Configure an Azure DevOps pipeline
+
+With the bot and join token created, you can now configure an Azure DevOps
+pipeline that sets up `tbot` to use these.
+
+To configure `tbot`, a YAML file will be used. In this example, we'll store the
+configuration within the repository itself but this could be generated by the
+CI pipeline itself.
+
+Create `tbot.yaml` within your repository:
+
+```yaml
+version: v2
+proxy_server: <Var name="example.teleport.sh" />:443
+onboarding:
+  join_method: azure_devops
+  token: example-bot
+oneshot: true
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- <Var name="example.teleport.sh" /> with the address of your Teleport Proxy Service or
+Auth Service. Prefer using the address of the Teleport Proxy Service.
+- `example-bot` with the name of the token you created in the second step
+
+Now you'll modify your Azure DevOps pipeline to install `tbot` and run it with
+the configuration you just created.
+
+In production, rather than installing `tbot` in each pipeline run, you may wish
+to build a container image that contains `tbot` and other dependencies, and run
+your pipeline within a container based on that image.
+
+Create or modify an existing pipeline with the following YAML:
+
+```yaml
+trigger:
+- main
+
+pool:
+  vmImage: ubuntu-latest
+
+steps:
+- script: |
+    curl "https://<Var name="example.teleport.sh"/>:443/scripts/install.sh" | sudo bash
+    tbot start -c tbot.yaml
+  displayName: 'Install Teleport and start tbot'
+  env:
+    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+    TELEPORT_ANONYMOUS_TELEMETRY: 1
+```
+
+Replace <Var name="example.teleport.sh"/> with the address of your Teleport Proxy Service.
+
+Note the inclusion of the `SYSTEM_ACCESSTOKEN` environment variable. This
+variable must be populated in any step where `tbot` is run.
+
+`TELEPORT_ANONYMOUS_TELEMETRY` enables the submission of anonymous usage
+telemetry. This helps us shape the future development of `tbot`. You can disable
+this by omitting this.
+
+Commit and push these two files to the repository.
+
+Check the status of your Azure DevOps pipeline run. If everything is configured
+correctly, you should see `tbot` successfully start, join the cluster, and then
+exit.
+
+## Step 5/5. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Further steps
+
+- For more information about the Azure DevOps join method, read the
+  [join method reference page.](../../reference/deployment/join-methods.mdx#azure-devops-azure_devops)
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/azure.mdx b/docs/pages/machine-workload-identity/deployment/azure.mdx
new file mode 100644
index 0000000000000..3db8b05872f57
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/azure.mdx
@@ -0,0 +1,138 @@
+---
+title: Deploying tbot on Azure
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on an Azure VM
+sidebar_label: Azure VM
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - azure
+---
+
+In this guide, you will install Machine & Workload Identity's agent, `tbot`, on
+an Azure VM. The bot will be configured to use the `azure` delegated joining
+method to authenticate to your Teleport cluster. This eliminates the need for
+long-lived secrets.
+
+## How it works
+
+On the Azure platform, virtual machines can be assigned a managed identity. The
+Azure platform will then make available to the virtual machine an attested
+data document and JWT that allows the virtual machine to act as this identity.
+This identity can be validated by a third party by attempting to use this token
+to fetch its own identity from the Azure identity service.
+
+The `azure` join method instructs the bot to use this attested data document and
+JWT to prove its identity to the Teleport Auth Service. This allows joining to
+occur without the use of a long-lived secret.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- An Azure managed identity with a role granting the
+  `Microsoft.Compute/virtualMachines/read` permission. You will need to know
+  the UID of this identity.
+- An Azure VM you wish to install Machine & Workload Identity onto with the
+  managed identity configured as a user-assigned managed identity.
+
+## Step 1/5. Install `tbot`
+
+**This step is completed on the Azure VM.**
+
+First, `tbot` needs to be installed on the VM that you wish to use Machine &
+Workload Identity on.
+
+Download and install the appropriate Teleport package for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/5. Create a Bot
+
+**This step is completed on your local machine.**
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+**This step is completed on your local machine.**
+
+Create `bot-token.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: example-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: azure
+  azure:
+    allow:
+      # subscription should be the UID of an Azure subscription. Only VMs within
+      # this subscription will be able to join.
+    - subscription: 11111111-1111-1111-1111-111111111111
+      # resource_groups allows joining to be restricted to VMs in a specific
+      # resource group. It can be omitted to allow joining from any VM within
+      # a subscription.
+      resource_groups: ["group1"]
+```
+
+Replace:
+
+- `11111111-1111-1111-1111-111111111111` with the UID of your Azure subscription
+- `example` with the name of the bot you created in the second step
+- `group1` with the name of the resource group that the VM resides within or
+  omit this entirely to allow joining from any VM within the subscription
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 4/5. Configure `tbot`
+
+**This step is completed on the Azure VM.**
+
+Create `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: azure
+  token: example-bot
+  azure :
+    client_id: 22222222-2222-2222-2222-222222222222
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy or
+  Auth Service. Prefer using the address of a Teleport Proxy.
+- `22222222-2222-2222-2222-222222222222` with the ID of the Azure managed
+  identity that has been assigned to the VM.
+- `example-bot` with the name of the token you created in the second step.
+
+(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
+
+## Step 5/5. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Next steps
+
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+  your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/bitbucket.mdx b/docs/pages/machine-workload-identity/deployment/bitbucket.mdx
similarity index 75%
rename from docs/pages/enroll-resources/machine-id/deployment/bitbucket.mdx
rename to docs/pages/machine-workload-identity/deployment/bitbucket.mdx
index 102233c0de666..af80a83eccefe 100644
--- a/docs/pages/enroll-resources/machine-id/deployment/bitbucket.mdx
+++ b/docs/pages/machine-workload-identity/deployment/bitbucket.mdx
@@ -1,18 +1,24 @@
 ---
-title: Deploying Machine ID on Bitbucket Pipelines
-description: How to install and configure Machine ID on Bitbucket Pipelines
+title: Deploying tbot on Bitbucket Pipelines
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on Bitbucket Pipelines
+sidebar_label: Bitbucket Pipelines
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
-In this guide, you will configure Machine ID's agent, `tbot`, to run within a
-Bitbucket Pipelines workflow. The bot will be configured to use the `bitbucket`
-delegated joining method to eliminate the need for long-lived secrets.
+In this guide, you will configure Machine & Workload Identity's agent, `tbot`,
+to run within a Bitbucket Pipelines workflow. The bot will be configured to use
+the `bitbucket` delegated joining method to eliminate the need for long-lived
+secrets.
 
 ## How it works
 
-The `bitbucket` join method is a secure way for Machine ID bots to authenticate
-with the Teleport Auth Service without using any shared secrets. Instead, it
-makes use of an OpenID Connect token that Bitbucket Pipelines injects into the
-job environment.
+The `bitbucket` join method is a secure way for Machine & Workload Identity bots
+to authenticate with the Teleport Auth Service without using any shared secrets.
+Instead, it makes use of an OpenID Connect token that Bitbucket Pipelines
+injects into the job environment.
 
 This token is sent to the Teleport Auth Service, and assuming it has been
 configured to trust Bitbucket's identity provider and all identity assertions
@@ -38,7 +44,7 @@ From this page, note the following values:
 - Workspace UUID, including the braces (<Var name="workspace-uuid" />)
 - Repository UUID, including the braces (<Var name="repository-uuid" />)
 
-## Step 2/4. Create the Machine ID bot
+## Step 2/4. Create a Bot
 
 (!docs/pages/includes/machine-id/create-a-bot.mdx!)
 
@@ -67,8 +73,8 @@ spec:
     # allow specifies the rules by which the Auth Service determines if `tbot`
     # should be allowed to join.
     allow:
-    - workspace_uuid: <Var name="workspace-uuid" />
-      repository_uuid: <Var name="repository-uuid" />
+    - workspace_uuid: '<Var name="workspace-uuid" />'
+      repository_uuid: '<Var name="repository-uuid" />'
 ```
 
 Let's go over the token resource's fields in more detail:
@@ -79,7 +85,8 @@ Let's go over the token resource's fields in more detail:
   access to. Note that this value will need to be used in other parts of the
   configuration later.
 - `spec.roles` defines which roles that this token will grant access to. The
-  value of `[Bot]` states that this token grants access to a Machine ID bot.
+  value of `[Bot]` states that this token grants access to a Machine & Workload
+  Identity bot.
 - `spec.join_method` defines the join method the token is applicable for. Since
   this guide only focuses on Bitbucket Pipelines, you will set this to to
   `bitbucket`.
@@ -90,7 +97,7 @@ Let's go over the token resource's fields in more detail:
 - `spec.bitbucket.allow` is used to set rules for what Bitbucket Pipelines runs
    will be able to authenticate by using the token.
 
-Refer to the [token reference](../../../reference/join-methods.mdx#bitbucket-pipelines-bitbucket)
+Refer to the [token reference](../../reference/deployment/join-methods.mdx#bitbucket-pipelines-bitbucket)
 for a full list of valid fields.
 
 Apply this to your Teleport cluster using `tctl`:
@@ -116,25 +123,26 @@ pipelines:
       - step:
           oidc: true
           script:
-            # Download and extract Teleport
-            - wget https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-            - tar -xvf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
+            # Install Teleport
+            - curl "https://<Var name="example.teleport.sh"/>:443/scripts/install.sh" | bash
 
             # Run `tbot` in identity mode for SSH access
-            - ./teleport/tbot start identity --destination=./tbot-user --join-method=bitbucket --proxy-server=example.teleport.sh:443 --token=bot-bitbucket --oneshot
+            - tbot start identity --destination=./tbot-user --join-method=bitbucket --proxy-server=<Var name="example.teleport.sh"/>:443 --token=bot-bitbucket --oneshot
 
             # Make use of the generated SSH credentials
             - ssh -F ./tbot-user/ssh_config user@node.example.teleport.sh echo "hello world"
 ```
 
+Replace <Var name="example.teleport.sh"/> with the address of your Teleport Proxy Service.
+
 This example will start `tbot` in identity mode to generate SSH credentials.
-Refer to the [`tbot start` documentation](../../../reference/cli/tbot.mdx#tbot-start)
+Refer to the [`tbot start` documentation](../../reference/cli/tbot.mdx#tbot-start)
 for details on using other modes such as database, application, and Kubernetes
 access.
 
 If you're adapting an existing workflow, note these steps:
 1. Set `oidc: true` on the step properties so that step will be issued a token
-1. Download and extract a `.tar.gz` Teleport build
+1. Installs Teleport from your cluster's install script
 1. Run `tbot` with `--join-method=bitbucket`, `--token=example-bot` (or
    whichever name was configured in Step 3), and `--oneshot`
 
@@ -153,7 +161,7 @@ credentials are needed in multiple steps.
 
 - Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
   your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available configuration options.
 - For more information about Bitbucket Pipelines itself, read
   [their documentation](https://support.atlassian.com/bitbucket-cloud/docs/get-started-with-bitbucket-pipelines/).
diff --git a/docs/pages/enroll-resources/machine-id/deployment/circleci.mdx b/docs/pages/machine-workload-identity/deployment/circleci.mdx
similarity index 84%
rename from docs/pages/enroll-resources/machine-id/deployment/circleci.mdx
rename to docs/pages/machine-workload-identity/deployment/circleci.mdx
index 3775cebf03a6a..bcf1019b0d87e 100644
--- a/docs/pages/enroll-resources/machine-id/deployment/circleci.mdx
+++ b/docs/pages/machine-workload-identity/deployment/circleci.mdx
@@ -1,11 +1,19 @@
 ---
-title: Deploying Machine ID on CircleCI
-description: How to install and configure Machine ID on CircleCI
+title: Deploying tbot on CircleCI
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on CircleCI
+sidebar_label: CircleCI
+tags:
+ - ci-cd
+ - how-to
+ - mwi
+ - infrastructure-identity
 ---
 
-In this guide, you will configure Machine ID's agent, `tbot`, to run within a
-CircleCI workflow. The bot will be configured to use the `circleci` delegated
-joining method to eliminate the need for long-lived secrets.
+{/* lint disable page-structure remark-lint */}
+
+In this guide, you will configure Machine & Workload Identity's agent, `tbot`,
+to run within a CircleCI workflow. The bot will be configured to use the
+`circleci` delegated joining method to eliminate the need for long-lived secrets.
 
 ## Prerequisites
 
@@ -63,7 +71,7 @@ Note this value down and substitute <Var name="context-id" /> in configuration e
 with it.
 
 
-## Step 2/5. Create the Machine ID bot
+## Step 2/5. Create a Bot
 
 (!docs/pages/includes/machine-id/create-a-bot.mdx!)
 
@@ -103,7 +111,8 @@ example is set to the year `2100`.
 access to. Note that this value will need to be used in other parts of the
 configuration later.
 - `spec.roles` defines which roles that this token will grant access to. The
-value of `[Bot]` states that this token grants access to a Machine ID bot.
+value of `[Bot]` states that this token grants access to a Machine & Workload
+Identity bot.
 - `spec.join_method` defines the join method the token is applicable for. Since
 this guide only focuses on CircleCI, you will set this to to `circleci`.
 - `spec.circleci.allow` is used to set rules for what CircleCI runs will be able
@@ -128,20 +137,20 @@ Create `tbot.yaml` within your repository:
 
 ```yaml
 version: v2
-proxy_server: example.teleport.sh:443
+proxy_server: <Var name="example.teleport.sh"/>:443
 onboarding:
   join_method: circleci
   token: example-bot
 oneshot: true
 storage:
   type: memory
-# outputs will be filled in during the completion of an access guide.
-outputs: []
+# services will be filled in during the completion of an access guide.
+services: []
 ```
 
 Replace:
 
-- `example.teleport.sh:443` with the address of your Teleport Proxy or
+- <Var name="example.teleport.sh"/> with the address of your Teleport Proxy or
   Auth Service. Prefer using the address of a Teleport Proxy.
 - `example-bot` with the name of the token you created in the second step
 
@@ -155,7 +164,7 @@ Open your Git repository and create a directory called `.circleci`. Then open
 a file called `config.yml` and insert the following configuration:
 
 ```yaml
-# See: https://circleci.com/docs/2.0/configuration-reference
+# See: https://circleci.com/docs/configuration-reference
 version: 2.1
 jobs:
   write-run-log:
@@ -166,12 +175,9 @@ jobs:
       - run:
           name: "Install Teleport"
           command: |
-            cd /tmp
-            curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-            tar -xvf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-            sudo ./teleport/install
+            curl "https://<Var name="example.teleport.sh"/>:443/scripts/install.sh" | sudo bash
       - run:
-          name: "Run Machine ID"
+          name: "Run Machine & Workload Identity"
           command: |
             export TELEPORT_ANONYMOUS_TELEMETRY=1
             tbot start -c tbot.yaml
@@ -183,6 +189,8 @@ workflows:
             - teleport-access
 ```
 
+Replace <Var name="example.teleport.sh"/> with the address of your Teleport Proxy Service.
+
 `TELEPORT_ANONYMOUS_TELEMETRY` enables the submission of anonymous usage
 telemetry. This helps us shape the future development of `tbot`. You can disable
 this by omitting this.
@@ -202,16 +210,16 @@ to these credentials.
 Ensure that the role you assign to your CircleCI bot has access to only the
 resources in your Teleport cluster that your CI/CD needs to interact with.
 
-## Step 5/5. Configure outputs
+## Step 5/5. Configure services
 
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
+(!docs/pages/includes/machine-id/configure-services.mdx!)
 
 ## Further steps
 
 - Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
   your environment.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available configuration options.
 - For more information about CircleCI itself, read
   [their documentation](https://circleci.com/docs/).
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/deployment.mdx b/docs/pages/machine-workload-identity/deployment/deployment.mdx
new file mode 100644
index 0000000000000..f980e2519ad24
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/deployment.mdx
@@ -0,0 +1,181 @@
+---
+title: Deploy tbot
+description: Explains how to deploy tbot on your platform and join it to your Teleport cluster.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+The first step to set up Machine & Workload Identity is to deploy the `tbot`
+agent and join it as a Bot to your Teleport cluster. You can run the `tbot`
+binary on a number of platforms, from AWS and GitHub Actions to a generic Linux
+server or Kubernetes cluster.
+
+## Choosing a deployment method
+
+There are two considerations to make when determining how to deploy the `tbot`
+agent on your infrastructure.
+
+### Your infrastructure
+
+The `tbot` agent runs as a container or on a Linux virtual machine. If you run
+`tbot` on GitHub Actions, you can use one of the ready-made [Teleport GitHub
+Actions workflows](https://github.com/teleport-actions).
+
+### Join method
+
+The `tbot` agent joins your Teleport cluster by using one of the following
+authentication methods:
+
+- **Platform-signed document:** The platform that hosts `tbot`, such as a
+  Kubernetes cluster or Amazon EC2 instance, provides a signed identity document
+  that Teleport can verify using the platform's certificate authority. This is
+  the recommended approach because it avoids the use of shared secrets.
+- **Static join token:** Your Teleport client tool generates a string and stores
+  it on the Teleport Auth Service. `tbot` provides this string when it first
+  connects to your Teleport cluster, demonstrating to the Auth Service that it
+  belongs in the cluster. From then on, `tbot` authenticates to your Teleport
+  cluster with a renewable certificate.
+
+## Deployment guides
+
+The guides in this section show you how to deploy the Machine & Workload
+Identity agent, `tbot`, and join it to your cluster.
+
+If a specific guide does not exist for your platform, the [Linux
+guide](linux.mdx) is compatible with most platforms. For
+custom approaches, you can also read the [Machine & Workload Identity Reference](../../reference/machine-workload-identity/machine-workload-identity.mdx)
+and [Architecture](../../reference/architecture/machine-id-architecture.mdx) to plan your deployment.
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="aws" size="xl" />,
+      to: "./aws",
+      name: "AWS",
+    },
+    {
+      icon: <Icon name="azure" size="xl" />,
+      to: "./azure",
+      name: "Azure",
+    },
+    {
+      icon: <Icon name="azureDevops" size="xl" />,
+      to: "./azure-devops",
+      name: "Azure DevOps",
+    },
+    {
+      icon: <Icon name="bitbucket" size="xl" />,
+      to: "./bitbucket",
+      name: "BitBucket Pipelines",
+    },
+    {
+      icon: <Icon name="circleci" size="xl" />,
+      to: "./circleci",
+      name: "CircleCI",
+    },
+    {
+      icon: <Icon name="gitlab" size="xl" />,
+      to: "./gitlab",
+      name: "GitLab CI",
+    },
+    {
+      icon: <Icon name="githubActions" size="xl" />,
+      to: "./github-actions",
+      name: "GitHub Actions",
+    },
+    {
+      icon: <Icon name="googleCloud" size="xl" />,
+      to: "./gcp",
+      name: "Google Cloud",
+    },
+    {
+      icon: <Icon name="kubernetes2" size="xl" />,
+      to: "./kubernetes",
+      name: "Kubernetes",
+    },
+    {
+      icon: <Icon name="kubernetes" size="xl" />,
+      to: "./kubernetes-oidc",
+      name: "Kubernetes OIDC",
+    },
+    {
+      icon: <Icon name="linux" size="xl" />,
+      to: "./linux",
+      name: "Linux",
+    },
+    {
+      icon: <Icon name="linux-servers" size="xl" />,
+      to: "./linux-tpm",
+      name: "Linux TPM",
+    },
+    {
+      icon: <Icon name="lock" size="xl" />,
+      to: "../../reference/machine-workload-identity/bound-keypair/getting-started",
+      name: "Bound Keypair Joining",
+    }
+  ]}
+/>
+
+### CI/CD
+
+Read the following guides for how to deploy `tbot` on a continuous integration
+and continuous deployment platform.
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="azureDevops" size="xl" />,
+      to: "./azure-devops",
+      name: "Azure DevOps",
+    },
+    {
+      icon: <Icon name="bitbucket" size="xl" />,
+      to: "./bitbucket",
+      name: "BitBucket Pipelines",
+    },
+    {
+      icon: <Icon name="circleci" size="xl" />,
+      to: "./circleci",
+      name: "CircleCI",
+    },
+    {
+      icon: <Icon name="gitlab" size="xl" />,
+      to: "./gitlab",
+      name: "GitLab CI",
+    },
+    {
+      icon: <Icon name="githubActions" size="xl" />,
+      to: "./github-actions",
+      name: "GitHub Actions",
+    },
+    {
+      icon: <Icon name="jenkins" size="xl" />,
+      to: "./jenkins",
+      name: "Jenkins",
+    },
+    {
+      icon: <Icon name="spacelift" size="xl" />,
+      to: "../../zero-trust-access/infrastructure-as-code/terraform-provider/spacelift",
+      name: "Spacelift",
+    },
+    {
+      icon: <Icon name="terraform" size="xl" />,
+      to: "../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud",
+      name: "Terraform Cloud",
+    },
+    {
+      icon: <Icon name="lock" size="xl" />,
+      to: "../../reference/machine-workload-identity/bound-keypair/static-keys",
+      name: "Bound Keypair static keys (Generic)",
+    }
+  ]}
+/>
+
+<Admonition type="tip" title="Unsupported Provider?">
+If your CI/CD provider does not have a dedicated join method listed above,
+consider using [Bound Keypair static keys][bound-keypair-static] as a fallback.
+</Admonition>
+
+[bound-keypair-static]: ../../reference/machine-workload-identity/bound-keypair/static-keys.mdx
diff --git a/docs/pages/machine-workload-identity/deployment/gcp.mdx b/docs/pages/machine-workload-identity/deployment/gcp.mdx
new file mode 100644
index 0000000000000..08be157e3879b
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/gcp.mdx
@@ -0,0 +1,139 @@
+---
+title: Deploying tbot on GCP
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on a GCP VM
+sidebar_label: GCP VM
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - google-cloud
+---
+
+This guide explains how to deploy the Machine & Workload Identity agent, `tbot`,
+on a Google Cloud Platform GCE instance and connect it to your Teleport cluster.
+
+## How it works
+
+On GCP, virtual machines can be assigned a service account. These machines can
+then request a signed JSON web token from GCP, which allows third parties to
+verify information about them, including their service accounts, using the GCP
+public key. The Teleport `gcp` join method instructs `tbot` to use this service
+account JWT to prove its identity to the Teleport Auth Service and join your
+Teleport cluster without using long-lived secrets.
+
+Whilst the guide on this page focuses explicitly on deploying `tbot` on a GCP
+Virtual Machine, it is also possible to use the `gcp` join method with workloads
+running on Google Kubernetes Engine. To do so, you must configure
+[GCP Workload
+Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
+for the cluster and the Kubernetes service account that will be used by the
+`tbot` pod. See the [Kubernetes platform guide](kubernetes.mdx) for further
+guidance on deploying `tbot` as a workload on Kubernetes.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A GCP service account you wish to grant access to your Teleport cluster that
+  is not the GCP compute default service account.
+- A GCP Compute Engine VM that you wish to install `tbot` onto that has been
+  configured with the GCP service account.
+
+## Step 1/5. Install `tbot`
+
+**This step is completed on the GCP VM.**
+
+First, `tbot` needs to be installed on the VM that you wish to use Machine &
+Workload Identity on.
+
+Download and install the appropriate Teleport package for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/5. Create a Bot
+
+**This step is completed on your local machine.**
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+**This step is completed on your local machine.**
+
+Create `bot-token.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: example-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: gcp
+  gcp:
+    # allow specifies the rules by which the Auth Service determines if `tbot`
+    # should be allowed to join.
+    allow:
+    - project_ids:
+        - my-project-123456
+      service_accounts:
+        # This should be the full "name" of a GCP service account. The default
+        # compute service account is not supported.
+        - my-service-account@my-project-123456.iam.gserviceaccount.com
+```
+
+Replace:
+
+- `my-project-123456` with the ID of your GCP project
+- `example` with the name of the bot you created in the second step.
+- `my-service-account@my-project-123456.iam.gserviceaccount.com` with the email
+  of the service account configured in the previous step. The default compute
+  service account is not supported.
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 4/5. Configure `tbot`
+
+**This step is completed on the GCP VM.**
+
+Create `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: gcp
+  token: example-bot
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy or
+  Auth Service. Prefer using the address of a Teleport Proxy.
+- `example-bot` with the name of the token you created in the second step.
+
+(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
+
+## Step 5/5. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Next steps
+
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+  your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/github-actions.mdx b/docs/pages/machine-workload-identity/deployment/github-actions.mdx
new file mode 100644
index 0000000000000..5e2503d44ce2a
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/github-actions.mdx
@@ -0,0 +1,462 @@
+---
+title: Deploying tbot on GitHub Actions
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on GitHub Actions
+sidebar_label: GitHub Actions
+tags:
+ - ci-cd
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+GitHub Actions is a popular CI/CD platform that works as a part of the larger
+GitHub ecosystem. Teleport Machine & Workload Identity allows GitHub Actions to
+securely interact with Teleport protected resources without the need for
+long-lived credentials.
+
+Teleport supports secure joining on both GitHub-hosted and self-hosted GitHub
+Actions runners as well as GitHub Enterprise Server.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- Your user should have the privileges to create token resources.
+- A GitHub repository with GitHub Actions enabled. This guide uses the example
+  `gravitational/example` repo, however this value should be replaced with
+  your own unique repo.
+
+## Step 1/3. Create a Bot
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 2/3. Create a join token for GitHub Actions
+
+In order to allow your GitHub Actions workflow to authenticate with your
+Teleport cluster, you'll first need to create a join token. These tokens set out
+criteria by which the Auth Service decides whether to allow a bot or node
+to join.
+
+In this example, you will create a join token that grants access to any
+GitHub Actions run within a specific GitHub repository. In production, you may
+wish to further restrict these rules to ensure that access can only occur
+when CI is running against a specific branch. You can find a full list of the
+available rules on the
+[join token reference page.](../../reference/deployment/join-methods.mdx#github-actions-github)
+
+Create a file named `bot-token.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example-bot
+spec:
+  # The Bot role indicates that this token grants access to a bot user, rather
+  # than allowing a node to join. This role is built in to Teleport.
+  roles: [Bot]
+  join_method: github
+  # The bot_name indicates which bot user this token grants access to. This
+  # should match the name of the bot that you created in the previous step.
+  bot_name: example
+  github:
+    # allow specifies rules that control which GitHub Actions runs will be
+    # granted access. Those not matching any allow rule will be denied.
+    allow:
+    # repository should include the name of the owner of the repository.
+    - repository: gravitational/example
+```
+
+Replace `gravitational/example` with the name of the repository that `tbot`
+will run within. You may also choose to change the name of the bot and token
+to more accurately describe your use-case.
+
+<Admonition type="note" title="Using GitHub Enterprise?">
+**Enterprise Server**
+
+If you are using self-hosted Teleport Enterprise you are able to permit
+workflows within GitHub Enterprise Server instances to authenticate using the
+GitHub join method.
+
+The Teleport Auth Service must be able to connect to the GitHub Enterprise
+Server.
+
+To configure this, set `spec.github.enterprise_server_host` to the hostname of
+the GHES instance.
+
+For example:
+```yaml
+spec:
+  github:
+    enterprise_server_host: ghes.example.com
+```
+
+**Enterprise Cloud**
+
+If you have enabled `include_enterprise_slug` in your GitHub Enterprise
+Cloud configuration, you will need to set `spec.github.enterprise_slug` to
+the slug of your GitHub Enterprise organization.
+
+For example:
+```yaml
+spec:
+  github:
+    enterprise_slug: my-enterprise
+```
+
+Read more about `include_enterprise_slug` on the GitHub guide to
+[customizing the issuer value for an enterprise](https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise).
+</Admonition>
+
+Once the resource file has been written, create the token with `tctl`:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+Check that token `example-bot` has been created with the following
+command:
+
+```code
+$ tctl tokens ls
+Token       Type Labels Expiry Time (UTC)
+----------- ---- ------ ----------------------------------------------
+example-bot Bot         01 Jan 00 00:00 UTC (2562047h47m16.854775807s)
+```
+
+## Step 3/3. Configure a GitHub Actions Workflow
+
+Now that the bot has been successfully created, you now need to configure your
+GitHub Action's workflow to authenticate as this bot and then use the
+credentials produced by `tbot`. To help with this, Teleport publishes
+several easy-to-use GitHub Actions that can be used within your workflow.
+
+It is also possible to manually configure `tbot` rather than using one of the
+Teleport GitHub Actions. This involves more configuration but allows for
+precise control of `tbot` and allows for implementations that are not possible
+with the actions.
+
+What follows is examples demonstrating two of the GitHub Actions available as
+well as showing how to manually configure `tbot` for use with GitHub Actions.
+
+### Example: `teleport-actions/auth`
+
+The `teleport-actions/auth` action generates a versatile identity output that
+can be used for SSH and for administrative actions against a Teleport cluster.
+Environment variables are configured by this action and these automatically
+configure `tsh` and `tctl` to use this identity.
+
+This example shows using the credentials to:
+
+- List the SSH nodes available using `tsh`
+- List the SSH nodes available using `tctl`
+- Connect to an SSH node using `tsh`
+- Connect to an SSH node using OpenSSH's `ssh`
+
+First, you'll need to adjust the role you assigned to the bot to grant it access
+to SSH. This example grants access to root on all nodes. In a production setup,
+it would be a good idea to restrict this to only the nodes that the bot would
+need.
+
+Use `tctl edit role/example-bot` to add the following to the role:
+
+```yaml
+spec:
+  allow:
+    # Allow login to the Linux user 'root'.
+    logins: ['root']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that ansible needs to access.
+    node_labels:
+      '*': '*'
+```
+
+With that privileges granted, you can now create the GitHub Actions workflow.
+Create `.github/workflows/example.yaml`:
+
+```yaml
+# This is a basic workflow to help you get started.
+# It will take the following action whenever a push is made to the "main" branch.
+on:
+  push:
+    branches:
+    - main
+jobs:
+  demo:
+    permissions:
+      # The "id-token: write" permission is required or tbot will not be able to
+      # authenticate with the cluster.
+      id-token: write
+      contents: read
+    # The name of the workflow, and the Linux distro to be used to perform the
+    # required steps.
+    name: example
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        version: auto
+        # Replace with the address of your Teleport Proxy Service.
+        proxy: example.teleport.sh:443
+    - name: Fetch credentials using Machine & Workload Identity
+      id: auth
+      uses: teleport-actions/auth@v2
+      with:
+        # Replace with the address of your Teleport Proxy Service.
+        proxy: example.teleport.sh:443
+        # Use the name of the join token resource you created in step 1.
+        token: example-bot
+        # Specify the length of time that the generated credentials should be
+        # valid for. This is optional and defaults to "1h"
+        certificate-ttl: 1h
+        # Enable the submission of anonymous usage telemetry. This
+        # helps us shape the future development of `tbot`. You can disable this
+        # by omitting this.
+        anonymous-telemetry: 1
+    - name: List nodes (tsh)
+      # Enters a command from the cluster, in this case "tsh ls" using Machine
+      # ID credentials to list remote SSH nodes.
+      run: tsh ls
+    - name: List nodes (tctl)
+      run: tctl nodes ls
+    - name: Run hostname via SSH (tsh)
+      # Ensure that `root` matches the username of a remote SSH username, and
+      # that hostname matches an SSH host name that is a part of the Teleport
+      # cluster configured for access.
+      run: tsh ssh root@example-node hostname
+    - name: Run hostname via SSH (OpenSSH)
+      run: ssh -F ${{ steps.auth.outputs.ssh-config }} root@example-node.example.teleport.sh hostname
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy or cloud
+  tenant.
+- `example-bot` with the name of the token you created in a previous step.
+- `example-node` with the name of a Teleport SSH node that you wish to connect
+  to.
+- `root` with the name of a user on the node that you are connecting to and that
+  you have granted the bot access to.
+
+Add, commit, and push your changes to the `main` branch of the repository.
+
+Navigate to the **Actions** tab of your GitHub repository in your web browser.
+Select the **Workflow** that has now been created and triggered by the change,
+and select the `example` job. The GitHub Actions workflow may take some time
+to complete, and will resemble the following once successful.
+
+![GitHub Actions](../../../img/machine-id/github-actions.png)
+
+Expand the **List nodes** step of the action, and the output will
+list all nodes in the cluster, from the perspective of the
+Machine & Workload Identity bot using the command `tsh ls`.
+
+### Example: `teleport-actions/auth-k8s`
+
+The `teleport-actions/auth-k8s` action generates a Kubernetes output service that
+contains the necessary credentials and config for a Kubernetes client to connect
+to a Kubernetes cluster enrolled in Teleport. The action emits the necessary
+environment variable to automatically configure these clients.
+
+In this example, the `teleport-actions/auth-k8s` action will be used to list
+all the pods contained within the cluster, but this could just as easily be
+modified to deploy to a Kubernetes cluster with `kubectl` or `helm`.
+
+First, you'll need to adjust the role you assigned to the bot to grant it access
+to the Kubernetes cluster. This example will grant the bot access to all
+clusters with the group `editor`. For more detailed instructions on setting
+up Kubernetes RBAC, see the Kubernetes access guide.
+
+Use `tctl edit role/example-bot` to add the following rule to the Teleport role:
+
+```yaml
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: pod
+      namespace: "*"
+      name: "*"
+    kubernetes_groups:
+    - editor
+```
+
+<Admonition type="note">
+This example assumes the role is version `v6`. If you are using a `v7`+ role
+you will need to include `verbs: ["get", "list"]` for the `kind: pod` section
+in `kubernetes_resources`. Otherwise the example `kubectl get pods -A` execution
+will be denied.
+</Admonition>
+
+With that privileges granted, you can now create the GitHub Actions workflow.
+Create `.github/workflows/example.yaml`:
+
+```yaml
+# This is a basic workflow to help you get started, modify it for your needs.
+on:
+  push:
+    branches:
+    - main
+jobs:
+  demo:
+    permissions:
+      # The "id-token: write" permission is required or tbot will not be able to
+      # authenticate with the cluster.
+      id-token: write
+      contents: read
+    name: example
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Fetch kubectl
+      uses: azure/setup-kubectl@v3
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        version: auto
+        # Replace with the address of your Teleport Proxy Service.
+        proxy: example.teleport.sh:443
+    - name: Fetch credentials using Machine ID
+      uses: teleport-actions/auth-k8s@v2
+      with:
+        # Replace with the address of your Teleport Proxy Service.
+        proxy: example.teleport.sh:443
+        # Use the name of the join token resource you created in step 1.
+        token: example-bot
+        # Use the name of your Kubernetes cluster
+        kubernetes-cluster: my-kubernetes-cluster
+        # Enable the submission of anonymous usage telemetry. This helps us
+        # shape the future development of `tbot`. You can disable this by
+        # omitting this.
+        anonymous-telemetry: 1
+    - name: List pods
+      run: kubectl get pods -A
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy Service.
+- `example-bot` with the name of the token you created in a previous step.
+- `my-kubernetes-cluster` with the name of your Kubernetes cluster.
+
+The `auth-k8s` action sets the `KUBECONFIG` for future steps to the credentials
+it has fetched from Teleport. This means that most existing tooling for
+Kubernetes (e.g `kubectl` and `helm`) can use your cluster with no additional
+configuration.
+
+Add, commit, and push this new workflow file to the default branch of your
+repository.
+
+Navigate to the **Actions** tab of your GitHub repository in your web browser.
+Select the **Workflow** that has now been created and triggered by the change,
+and select the `example` job.
+
+Expand the **List pods** step of the action, where you can then confirm that the
+output shows a list of all the pods within your Kubernetes cluster.
+
+### Example: Manual configuration
+
+To configure `tbot` manually, a YAML file will be used. In this example we'll
+commit this to the repository, but this could be generated or created by the
+CI pipeline itself.
+
+Create `tbot.yaml` within your repository:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: github
+  token: example-bot
+oneshot: true
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy Service.
+- `example-bot` with the name of the token you created in the first step.
+
+Now you can define a GitHub Actions workflow that will start `tbot` with this
+configuration.
+
+Create `.github/workflows/example-action.yaml`:
+
+```yaml
+# This is a basic workflow to help you get started.
+# It will take the following action whenever a push is made to the "main" branch.
+on:
+  push:
+    branches:
+    - main
+jobs:
+  demo:
+    permissions:
+      # The "id-token: write" permission is required or tbot will not be able to
+      # authenticate with the cluster.
+      id-token: write
+      contents: read
+    # The name of the workflow, and the Linux distro to be used to perform the
+    # required steps.
+    name: guide-demo
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        version: auto
+        # Replace with the address of your Teleport Proxy Service.
+        proxy: example.teleport.sh:443
+    - name: Execute Machine ID
+      env:
+        # TELEPORT_ANONYMOUS_TELEMETRY enables the submission of anonymous
+        # usage telemetry. This helps us shape the future development of
+        # tbot. You can disable this by omitting this.
+        TELEPORT_ANONYMOUS_TELEMETRY: 1
+      run: tbot start -c ./tbot.yaml --oneshot
+```
+
+Add, commit, and push these two files to the repository. Check the GitHub
+Actions UI to ensure that the workflow has succeeded.
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## A note on security implications and risk
+
+Once `teleport-actions/auth` has been used in a workflow job, all successive
+steps in that job will have access to the credentials which grant access to your
+Teleport cluster as the bot. Where possible, run as few steps as necessary after
+this action has been used. It may be a good idea to break your workflow up into
+multiple jobs in order to segregate these credentials from other code running in
+your CI/CD pipeline.
+
+Most importantly, ensure that the role you assign to your GitHub Actions bot has
+access to only the resources in your Teleport cluster that your CI/CD needs to
+interact with.
+
+## Next steps
+
+- Check out the GitHub Actions for more usage information:
+  - [teleport-actions/setup](https://github.com/teleport-actions/setup)
+  - [teleport-actions/auth](https://github.com/teleport-actions/auth)
+  - [teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
+  - [teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
+- For more information about the `github` join method, read the
+  [join token reference page](../../reference/deployment/join-methods.mdx#github-actions-github)
+- Find out more about GitHub Actions itself, read
+  [their documentation](https://docs.github.com/en/actions).
+- [More information about `anonymous-telemetry`.](../../reference/machine-workload-identity/telemetry.mdx)
+
diff --git a/docs/pages/machine-workload-identity/deployment/gitlab.mdx b/docs/pages/machine-workload-identity/deployment/gitlab.mdx
new file mode 100644
index 0000000000000..fa7d32546fb96
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/gitlab.mdx
@@ -0,0 +1,187 @@
+---
+title: Deploying tbot on GitLab CI
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on GitLab CI
+sidebar_label: GitLab CI
+tags:
+ - ci-cd
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+In this guide, you will use Teleport Machine & Workload Identity to allow a
+GitLab pipeline to securely connect to a Teleport SSH node without the need for
+long-lived secrets.
+
+Machine & Workload Identity for GitLab works with GitLab's cloud-hosted option
+and with self-hosted GitLab installations. **The minimum supported GitLab
+version is 15.7**.
+
+This mitigates the risk of long-lived secrets such as passwords or SSH private
+keys being exfiltrated from your GitLab organization and provides many of
+the other benefits of Teleport such as auditing and finely-grained access
+control.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A GitLab project to connect to Teleport. This can either be on GitLab's
+cloud-hosted offering (gitlab.com) or on a self-hosted GitLab instance. **When
+using a self-hosted GitLab instance, your Teleport Auth Service must be able to
+connect to your GitLab instance and your GitLab instance must be configured with
+a valid TLS certificate.**
+
+## Step 1/4. Create a Bot
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 2/4. Create a join token
+
+To allow GitLab CI to authenticate to your Teleport cluster, you'll first need
+to create a join token. A GitLab join token contains allow rules that describe
+which pipelines can use that token in order to join the Teleport cluster. A rule
+can contain multiple fields, and any pipeline that matches all the fields
+within a single rule is granted access.
+
+In this example, you will create a token with a rule that grants access to any
+GitLab CI job within a specific GitLab project. Determine the fully qualified
+path of your GitLab project. This will include your username (or group) and the
+name of your project, e.g `my-user/my-project`.
+
+Create a file named `bot-token.yaml`. Ensure you substitute any values as
+suggested by the comments in this example:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example-bot
+spec:
+  # The Bot role indicates that this token grants access to a bot user, rather
+  # than allowing a node to join. This role is built in to Teleport.
+  roles: [Bot]
+  join_method: gitlab
+  # The bot_name indicates which bot user this token grants access to. This
+  # should match the name of the bot that you created in step 1.
+  bot_name: example
+  gitlab:
+    # domain should be the domain of your GitLab instance. If you are using
+    # GitLab's cloud hosted offering, omit this field entirely.
+    domain: gitlab.example.com
+    # allow specifies rules that control which GitLab tokens will be accepted
+    # by Teleport. Tokens not matching any allow rule will be denied.
+    allow:
+        # project_path should be the fully qualified path of your GitLab
+        # project that you determined earlier. This will grant access to any
+        # GitLab CI run in that project.
+      - project_path: my-user/my-project
+```
+
+You can find a full list of the token configuration options for GitLab joining
+on the
+[join tokens reference page.](../../reference/deployment/join-methods.mdx#gitlab-gitlab)
+
+Apply this to your Teleport cluster using `tctl`:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 3/4. Configure a GitLab Pipeline
+
+With the bot and join token created, you can now configure a GitLab pipeline
+that sets up `tbot` to use these.
+
+To configure `tbot`, a YAML file will be used. In this example we'll store this
+within the repository itself, but this could be generated or created by the
+CI pipeline itself.
+
+Create `tbot.yaml` within your repository:
+
+```yaml
+version: v2
+proxy_server: <Var name="example.teleport.sh"/>:443
+onboarding:
+  join_method: gitlab
+  token: example-bot
+oneshot: true
+storage:
+  type: memory
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+
+- <Var name="example.teleport.sh"/> with the address of your Teleport Proxy or
+  Auth Service. Prefer using the address of a Teleport Proxy.
+- `example-bot` with the name of the token you created in the second step
+
+Now, the GitLab CI pipeline can be defined. Before the pipeline can use `tbot`,
+it must be available within the environment. For this example, we'll show
+downloading `tbot` as part of the CI step, but in a production implementation
+you may wish to build a docker image that contains this binary to avoid
+depending on the Teleport CDN.
+
+Create `.gitlab-ci.yml`  within your repository:
+
+```yaml
+stages:
+  - deploy
+
+deploy-job:
+  stage: deploy
+  # id_tokens configures ID Tokens that GitLab will automatically inject into
+  # the environment of your GitLab run.
+  #
+  # See https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html
+  # for further explanation of the id_tokens configuration in GitLab.
+  id_tokens:
+    TBOT_GITLAB_JWT:
+      # aud for TBOT_GITLAB_JWT must be configured with the name of your
+      # Teleport cluster. This is not necessarily the address of your Teleport
+      # cluster and will not include a port or scheme (http/https)
+      #
+      # This helps the Teleport Auth Service know that the token is intended for
+      # it, and not a different service or Teleport cluster.
+      aud: <Var name="example.teleport.sh"/>
+  script:
+    - curl "https://<Var name="example.teleport.sh"/>:443/scripts/install.sh" | bash
+    - 'TELEPORT_ANONYMOUS_TELEMETRY=1 tbot start -c tbot.yaml'
+```
+
+Replace:
+
+- <Var name="example.teleport.sh"/> for `aud` with the name of your Teleport cluster. This
+  is not necessarily the address of your Teleport cluster and will not include
+  a port or scheme (e.g. http/https).
+- <Var name="example.teleport.sh"/> with the address of your Teleport Proxy Service.
+
+`TELEPORT_ANONYMOUS_TELEMETRY` enables the submission of anonymous usage
+telemetry. This helps us shape the future development of `tbot`. You can disable
+this by omitting this.
+
+Commit and push these two files to the repository.
+
+Check your GitLab CI status, and examine the log results from the commit for
+failure.
+
+## Step 4/4. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Further steps
+
+- For more information about GitLab joining, read the
+  [join method reference page.](../../reference/deployment/join-methods.mdx#gitlab-gitlab)
+- For more information about GitLab itself, read
+  [their documentation](https://docs.gitlab.com/ee/ci/).
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+  your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/jenkins.mdx b/docs/pages/machine-workload-identity/deployment/jenkins.mdx
new file mode 100644
index 0000000000000..618bf06d740f3
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/jenkins.mdx
@@ -0,0 +1,187 @@
+---
+title: Deploying tbot on Jenkins
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on Jenkins
+sidebar_label: Jenkins
+tags:
+ - ci-cd
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+Jenkins is an open source automation server that is frequently used to build
+Continuous Integration and Continuous Delivery (CI/CD) pipelines.
+
+In this guide, we will demonstrate how to migrate existing Jenkins pipelines to
+utilize Machine & Workload Identity to connect to infrastructure protected by
+Teleport.
+
+## Prerequisites
+
+You will need the following tools to use Teleport with Jenkins.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- `ssh` OpenSSH tool
+- Jenkins
+- (!docs/pages/includes/tctl.mdx!)
+
+## Architecture
+
+Before we begin, it should be noted that Jenkins is a tool that is notoriously
+difficult to secure. Machine & Workload Identity is one part of securing your
+infrastructure, but it alone is not sufficient. Below we will provide some basic
+guidance which can help improve the security posture of your Jenkins
+installation.
+
+### Single-host deployments
+
+The simplest Jenkins deployments have the
+controller (process that stores configuration, plugins, UI) and agents (process
+that executes tasks) run on the same host. This deployment model is simple to
+get started with, however any compromise of the `jenkins` user within a single
+pipeline can lead to the compromise of your entire CI/CD infrastructure.
+
+### Multihost deployments
+
+A slightly more complex, but more secure deployment
+is running your Jenkins controllers and agents on different hosts and pinning
+workloads to specific agents. This is an improvement over the simple deployment
+because you can limit the blast radius of the compromise of a single pipeline
+to a subset of your CI/CD infrastructure instead of all of your infrastructure.
+
+### Best practices
+
+We strongly encourage the use of the second deployment model whenever possible,
+with ephemeral hosts and IAM joining when possible. When using Machine &
+Workload Identity with this model, create and run separate bots per-host and pin
+particular pipelines to a worker. This will allow you to give each pipeline the
+minimal scope for server access, reduce the blast radius if one pipeline is
+compromised, and allow you to remotely audit and lock pipelines if you detect
+malicious behavior.
+
+  ![Jenkins Deployments](../../../img/machine-id/jenkins.png)
+
+## Step 1/2 Configure and start `tbot`
+
+First, determine if you would like to create a new role or use an existing role
+for your Jenkins workflow. You can run `tctl get roles` to examine your existing
+roles.
+
+In the example below, create a file called `api-workers.yaml` with the content below
+to create a new role called `api-workers` that will allow you to log in to Nodes
+with the label `group: api` and Linux user `jenkins`.
+
+```
+kind: "role"
+version: "v3"
+metadata:
+  name: "api-workers"
+spec:
+  allow:
+    logins: ["jenkins"]
+    node_labels:
+      "group": "api"
+```
+
+<Tabs>
+<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
+On your client machine, log in to Teleport using `tsh` before using `tctl`.
+
+```code
+$ tctl create -f api-workers.yaml
+$ tctl bots add jenkins --roles=api-workers
+```
+</TabItem>
+<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
+Connect to the Teleport Auth Service and use `tctl` to examine what roles exist on
+your system.
+
+```code
+$ tctl create -f api-workers.yaml
+$ tctl bots add jenkins --roles=api-workers
+```
+</TabItem>
+
+</Tabs>
+
+The Machine & Workload Identity agent, `tbot`, allows you to use Linux Access
+Control Lists (ACLs) to control access to certificates on disk. You will use
+this to limit the access Jenkins has to the short-lived certificates `tbot`
+issues.
+
+In the example that follows, you will create a Linux user called `teleport` to
+run `tbot` but short-lived certificates will be written to disk as the
+Linux user `jenkins`.
+
+```code
+$ sudo adduser \
+    --disabled-password \
+    --no-create-home \
+    --shell=/bin/false \
+    --gecos "" \
+    teleport
+```
+
+Create and initialize the directories you will need using the `tbot init`
+command.
+
+```code
+$ sudo tbot init \
+    --destination-dir=/opt/machine-id \
+    --bot-user=teleport \
+    --owner=teleport:teleport \
+    --reader-user=jenkins
+```
+
+(!docs/pages/includes/machine-id/machine-id-init-bot-data.mdx!)
+
+Next, you need to start `tbot` in the background of each Jenkins worker.
+
+First create a configuration file for `tbot` at `/etc/tbot.yaml`.
+
+```yaml
+version: v2
+# Replace "example.teleport.sh:443" with the address of your Teleport Proxy or
+# Teleport Cloud tenant.
+proxy_server: "example.teleport.sh:443"
+onboarding:
+  join_method: "token"
+  # Replace the token field with the name of the token that was output when you
+  # ran `tctl bots add`.
+  token: "00000000000000000000000000000000"
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+services:
+  - type: identity
+    destination:
+      type: directory
+      path: /opt/machine-id
+```
+
+### Create a `tbot` systemd unit file
+
+(!docs/pages/includes/machine-id/daemon.mdx!)
+
+## Step 2/2. Update and run Jenkins pipelines
+
+Using the credentials produced by `tbot` within a Jenkins pipeline is now a
+one-line change. For example, if you want to run the `hostname` command on a
+remote host, add the following to your Jenkins pipeline.
+
+```
+steps {
+  sh "ssh -F /opt/machine-id/ssh_config root@node-name.example.com hostname"
+}
+```
+
+You are all set. You have provided Jenkins with short-lived certificates tied
+to a machine identity that can be rotated, audited, and controlled with access controls.
+
+## Next steps
+
+[More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
+
diff --git a/docs/pages/machine-workload-identity/deployment/kubernetes-oidc.mdx b/docs/pages/machine-workload-identity/deployment/kubernetes-oidc.mdx
new file mode 100644
index 0000000000000..2448d91ac3644
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/kubernetes-oidc.mdx
@@ -0,0 +1,309 @@
+---
+title: Deploying tbot on Kubernetes with OIDC
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on Kubernetes with OIDC
+sidebar_label: Kubernetes (OIDC)
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+This guide shows you how to deploy the Machine & Workload Identity agent,
+`tbot`, on a Kubernetes cluster that supports OIDC. The Kubernetes OIDC join
+method is a good fit for use inside Kubernetes clusters on a cloud platform that
+can be configured to provide a public OpenID Connect (OIDC) endpoint, including
+EKS, AKS, and GKE.
+
+## How it works
+
+In the setup we demonstrate in this guide, `tbot` runs as a Kubernetes
+deployment. It writes output credentials to a Kubernetes secret, which can then
+be mounted in the pods that need to use the credentials. While `tbot` can also
+run as a sidecar within the same pod as the service that needs to use the
+credentials it generates, we recommend running `tbot` as a standalone deployment
+due the limited support Kubernetes has for sidecars.
+
+In this guide, we demonstrate the `kubernetes` join method using its OIDC
+support, in which `tbot` proves its identity to the Teleport Auth Service by
+presenting a JSON web token (JWT) signed by the platform OIDC issuer. This JWT
+is projected into pods by Kubernetes, and identifies the service account, the
+pod, and the namespace in which `tbot` is running. The Teleport Auth Service
+checks the signature of the JWT against the Kubernetes OIDC provider's published
+signing keys to verify the pod identity.
+
+<Admonition type="warning" title="OIDC Support">
+Not all Kubernetes providers support [Service Account Issuer Discovery][said],
+which is required for this guide. If your provider does not support this
+feature, refer to our [Kubernetes with Static JWKS guide](./kubernetes.mdx)
+instead.
+</Admonition>
+
+<details>
+<summary>Using another join method</summary>
+
+When deploying `tbot` to a Teleport cluster, it is generally recommended to use
+the `kubernetes` join method. This will work with most Kubernetes clusters.
+The guide that follows will demonstrate configuring this join method.
+
+However, when using certain cloud Kubernetes services, it is possible to use the
+join method associated with that platform rather than the `kubernetes` join
+method. This may be beneficial if you wish to manage the joining of `tbot`
+within the Kubernetes clusters and on standard VMs on the same platform with
+a single join token. These services are:
+
+- Google Kubernetes Engine: Where
+  [GCP Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
+  is configured for the cluster, it is possible to use the `gcp` join method.
+  See the [GCP Platform Guide](./gcp.mdx) for further information.
+- Amazon Elastic Kubernetes Service: Where
+  [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
+  is configured for the cluster, it is possible to use the `iam` join method.
+  See the [AWS Platform Guide](./aws.mdx) for further information.
+
+It is recommended to use Kubernetes OIDC joining on Azure (AKS) whenever
+possible.
+
+</details>
+
+## Prerequisites
+
+- A running Teleport cluster, version 18.1.5 or above.
+- The `tsh` and `tctl` clients, version 18.1.5 or above.
+- (!docs/pages/includes/tctl.mdx!)
+- A Kubernetes cluster with support for Token Request Projection (which
+  graduated to a generally available feature in Kubernetes 1.20).
+- `kubectl` authenticated with the ability to create resources in the cluster
+  you wish to deploy `tbot` into.
+- A Kubernetes platform that supports [Service Account Issuer Discovery][said],
+  which became generally available in Kubernetes 1.21
+- The `helm` CLI tool installed.
+
+The examples in this guide will install a `tbot` deployment in the `default`
+Namespace of the Kubernetes cluster. Adjust references to `default` to the
+Namespace you wish to use.
+
+## Step 1/5. Verify support for Service Account Issuer Discovery
+
+Before continuing, verify that your Kubernetes cluster can issue tokens that
+Teleport will be able to verify. To do so, we'll want to perform the following
+steps:
+1. Fetch the cluster's OpenID configuration endpoint and extract the `issuer`
+   field
+2. Attempt to fetch the same OpenID configuration endpoint from its public
+   address, derived from the `issuer` field value, and extract the public
+   `jwks_uri`
+3. Attempt to fetch the `jwks_uri` to ensure Teleport will be able to do so when
+   your agents attempt to join
+
+To do so, ensure you have `kubectl`, `curl`, and `jq` available. Start by
+running this command to determine the public OIDC configuration URL:
+```code
+$ kubectl get --raw /.well-known/openid-configuration | jq -r '.issuer + "/.well-known/openid-configuration"'
+https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id/.well-known/openid-configuration
+```
+
+If this command fails, the Service Account Issuer Discovery feature is not
+enabled on your Kubernetes cluster.
+
+Next, we'll attempt to fetch the configuration document returned by the previous
+command. Note that this should be run over the public internet, such as your
+home internet connection, to help ensure the endpoint will be accessible to
+Teleport:
+```code
+$ curl https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id/.well-known/openid-configuration | jq
+{
+  "issuer": "https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id",
+  "jwks_uri": "https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id/keys",
+  "authorization_endpoint": "urn:kubernetes:programmatic_authorization",
+  "response_types_supported": [
+    "id_token"
+  ],
+  "subject_types_supported": [
+    "public"
+  ],
+  "claims_supported": [
+    "sub",
+    "iss"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "RS256"
+  ]
+}
+```
+
+If this command succeeds, make a note of the `issuer` value for future steps.
+Note that the particular `issuer` value will vary depending on your cloud
+provider, region, individual cluster; the example here roughly matches an Amazon
+EKS cluster.
+
+As one final check, you can also attempt to fetch the `jwks_uri`:
+```code
+$ curl https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id/keys
+{"keys":[{...snip...}]}
+```
+
+There's no need to record anything from this response - we just want to be
+certain that Teleport will be able to access this URL.
+
+<Admonition type="warning" title="OIDC Support">
+If any of these commands fail, additional steps may be needed to enable public
+[Service Account Issuer Discovery][said] is enabled for your Kubernetes
+provider.
+
+Refer to your cloud provider documentation to enable this feature, including:
+- [AWS](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html): Enabling OIDC for EKS clusters
+- [Azure](https://learn.microsoft.com/en-us/azure/aks/use-oidc-issuer): Enabling OIDC for AKS clusters
+- GKE clusters should work out of the box
+
+If your provider does not support this feature, consider using either [Static
+JWKS joining](./kubernetes.mdx) or an [alternative Teleport join
+method](../../reference/deployment/join-methods.mdx) better suited to your cloud provider.
+</Admonition>
+
+## Step 2/5. Create a Bot
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+Next, a join token needs to be configured. This will be used by `tbot` to join
+the cluster, and will require the issuer URL determined in Step 1.
+
+Create `bot-token.yaml`, ensuring you insert the `issuer` value in
+`spec.kubernetes.oidc.issuer`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: example-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: kubernetes
+  kubernetes:
+    # oidc configures the Auth Service to validate the JWT presented by `tbot`
+    # using the public keys published by the configured OIDC issuer.
+    type: oidc
+    oidc:
+      # Insert the OIDC issuer value here, it will vary depending on your
+      # cluster and cloud provider.
+      issuer: https://oidc.eks.us-west-2.amazonaws.com/id/cluster-id
+    # allow specifies the rules by which the Auth Service determines if `tbot`
+    # should be allowed to join.
+    allow:
+    - service_account: "default:tbot" # service_account
+```
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 4/5. Create a `tbot` deployment
+
+Now, you'll deploy `tbot` to your Kubernetes cluster using the Teleport `tbot`
+Helm chart. This will be configured using values provided to the Helm CLI tool.
+
+First, create a file called `tbot-values.yaml` to hold the configuration values
+for the Helm chart:
+
+```yaml
+# Replace the cluster name with the name of your Teleport cluster.
+# This is not necessarily the public address of your Teleport Proxy Service.
+clusterName: "example.teleport.sh"
+# Replace this with the address of your Teleport Proxy Service.
+teleportProxyAddress: "example.teleport.sh:443"
+# Ensure this matches the name of the join token you created earlier.
+token: "example-bot"
+```
+
+<Admonition type="warning" title="FIPS Compliance">
+    The default `tbot-distroless` image does not contain the FIPS-compliant
+    binaries. If you operate in an environment where FIPS compliance is required,
+    additionally set the `image: public.ecr.aws/gravitational/tbot-fips-distroless`.
+</Admonition>
+
+Before you can deploy the Helm chart, if you have not previously deployed a
+Teleport Helm chart, you'll need to add the Teleport chart repository to your
+CLI:
+
+```code
+$ helm repo add teleport (=teleport.helm_repo_url=)
+$ helm repo update
+```
+
+You can now deploy the `tbot` Helm chart using the configuration you created
+earlier, ensuring you specify the namespace you wish to deploy `tbot` into:
+
+```code
+$ helm install tbot teleport/tbot \
+  --namespace default \
+  --values tbot-values.yaml
+```
+
+Use `kubectl` to verify that the deployment is healthy:
+
+```code
+$ kubectl describe deployment/tbot
+$ kubectl logs deployment/tbot
+```
+
+With this complete, `tbot` is now successfully deployed to your cluster.
+
+## Step 5/5. Configure services
+
+By default, the `tbot` Helm chart is configured to write an identity file to a
+Kubernetes Secret called `tbot-out` in the namespace where `tbot` has been
+deployed.
+
+This identity file can be mounted into other pods and used with `tsh` or `tctl`
+to access and configure your Teleport cluster. For example:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: tsh
+  namespace: default
+spec:
+  containers:
+    - name: tsh
+      image: public.ecr.aws/gravitational/teleport-distroless:(=teleport.version=)
+      command:
+        - tsh
+      args:
+       - -i
+       - /identity-output/identity
+       - --proxy
+       - example.teleport.sh:443
+       - ls
+      volumeMounts:
+        - name: identity-output
+          mountPath: /identity-output
+  volumes:
+    - name: identity-output
+      secret:
+        secretName: tbot-out
+```
+
+If you wish to use `tbot` for a different kind of access, you can override the
+type of service using the `services` value of the Helm chart and setting
+`defaultOutput.enabled` to `false`.
+
+Follow one of the [access guides](../access-guides/access-guides.mdx) to find
+out more about how to configure `tbot` for your use case.
+
+## Next steps
+
+- Explore the [Helm chart configuration reference](../../reference/helm-reference/tbot.mdx).
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish
+  configuring `tbot` for your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
+
+[said]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery
diff --git a/docs/pages/machine-workload-identity/deployment/kubernetes.mdx b/docs/pages/machine-workload-identity/deployment/kubernetes.mdx
new file mode 100644
index 0000000000000..1b6c4f94165d9
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/kubernetes.mdx
@@ -0,0 +1,236 @@
+---
+title: Deploying tbot on Kubernetes
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on Kubernetes with Static JWKS Keys
+sidebar_label: Kubernetes (Static JWKS)
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+This guide shows you how to deploy the Machine & Workload Identity agent,
+`tbot`, on a Kubernetes cluster and use a static reference to the cluster's
+Service Account issuer keys for authentication.
+
+## How it works
+
+In the setup we demonstrate in this guide, `tbot` runs as a Kubernetes
+deployment. It writes output credentials to a Kubernetes secret, which can then
+be mounted in the pods that need to use the credentials. While `tbot` can also
+run as a sidecar within the same pod as the service that needs to use the
+credentials it generates, we recommend running `tbot` as a standalone deployment
+due the limited support Kubernetes has for sidecars.
+
+In this guide, we demonstrate the `kubernetes` join method, in which `tbot`
+proves its identity to the Teleport Auth Service by presenting a JSON web token
+(JWT) signed by the Kubernetes API server. This JWT contains identifies the
+service account, the pod and the namespace in which `tbot` is running. The
+Teleport Auth Service checks the signature of the JWT against the Kubernetes
+cluster's public signing key.
+
+<Admonition type="warning" title="OIDC Joining">
+Certain cloud providers like Amazon EKS regularly rotate their OIDC signing
+keys, which will cause the `static_jwks` configuration you create in this guide
+to become invalid after a short period of time.
+
+On Kubernetes providers with OIDC support, like Amazon's Elastic Kubernetes
+Service (EKS), Google Kubernetes Engine (GKE), and Azure Kubernetes Service
+(AKS), consider using [Kubernetes OIDC joining](./kubernetes-oidc.mdx) instead.
+</Admonition>
+
+<details>
+<summary>Using another join method</summary>
+
+When deploying `tbot` to a Teleport cluster, it is generally recommended to use
+the `kubernetes` join method. This will work with most Kubernetes clusters.
+The guide that follows will demonstrate configuring this join method.
+
+However, when using certain cloud Kubernetes services, it is possible to use the
+join method associated with that platform rather than the `kubernetes` join
+method. This may be beneficial if you wish to manage the joining of `tbot`
+within the Kubernetes clusters and on standard VMs on the same platform with
+a single join token. These services are:
+
+- Google Kubernetes Engine: Where
+  [GCP Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
+  is configured for the cluster, it is possible to use the `gcp` join method.
+  See the [GCP Platform Guide](./gcp.mdx) for further information.
+- Amazon Elastic Kubernetes Service: Where
+  [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
+  is configured for the cluster, it is possible to use the `iam` join method.
+  See the [AWS Platform Guide](./aws.mdx) for further information.
+
+</details>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A Kubernetes cluster with support for Token Request Projection (which
+  graduated to a generally available feature in Kubernetes 1.20).
+- `kubectl` authenticated with the ability to create resources in the cluster
+  you wish to deploy `tbot` into.
+- The `helm` CLI tool installed.
+
+The examples in this guide will install a `tbot` deployment in the `default`
+Namespace of the Kubernetes cluster. Adjust references to `default` to the
+Namespace you wish to use.
+
+## Step 1/4. Create a Bot
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 2/4. Create a join token
+
+Next, a join token needs to be configured. This will be used by `tbot` to join
+the cluster. As the `kubernetes` join method will be used, the public key of the
+Kubernetes cluster must first be determined. The public key used to sign JWTs
+is exposed on the "JWKS" endpoint of the Kubernetes API server. This public key
+can then be used by the Teleport Auth  to verify that the Service Account JWT
+presented by `tbot` is signed legitimately by the Kubernetes cluster.
+
+Run the following commands to determine the JWKS formatted public key:
+
+```code
+$ kubectl proxy -p 8080
+$ curl http://localhost:8080/openid/v1/jwks
+{"keys":[--snip--]}%
+```
+
+Create `bot-token.yaml`, ensuring you insert the value from the JWKS endpoint
+in `spec.kubernetes.static_jwks.jwks`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # name will be specified in the `tbot` to use this token
+  name: example-bot
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: kubernetes
+  kubernetes:
+    # static_jwks configures the Auth Service to validate the JWT presented by
+    # `tbot` using the public key from a statically configured JWKS.
+    type: static_jwks
+    static_jwks:
+      jwks: |
+        # Place the data returned by the curl command here
+        {"keys":[--snip--]}
+    # allow specifies the rules by which the Auth Service determines if `tbot`
+    # should be allowed to join.
+    allow:
+    - service_account: "default:tbot" # service_account
+```
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f bot-token.yaml
+```
+
+## Step 3/4. Create a `tbot` deployment
+
+Now, you'll deploy `tbot` to your Kubernetes cluster using the Teleport `tbot`
+Helm chart. This will be configured using values provided to the Helm CLI tool.
+
+First, create a file called `tbot-values.yaml` to hold the configuration values
+for the Helm chart:
+
+```yaml
+# Replace the cluster name with the name of your Teleport cluster.
+# This is not necessarily the public address of your Teleport Proxy Service.
+clusterName: "example.teleport.sh"
+# Replace this with the address of your Teleport Proxy Service.
+teleportProxyAddress: "example.teleport.sh:443"
+# Ensure this matches the name of the join token you created earlier.
+token: "example-bot"
+```
+
+<Admonition type="warning" title="FIPS Compliance">
+The default `tbot-distroless` image does not contain the FIPS-compliant
+binaries. If you operate in an environment where FIPS compliance is required,
+additionally set the `image: public.ecr.aws/gravitational/tbot-fips-distroless`.
+</Admonition>
+
+Before you can deploy the Helm chart, if you have not previously deployed a
+Teleport Helm chart, you'll need to add the Teleport chart repository to your
+CLI:
+
+```code
+$ helm repo add teleport (=teleport.helm_repo_url=)
+$ helm repo update
+```
+
+You can now deploy the `tbot` Helm chart using the configuration you created
+earlier, ensuring you specify the namespace you wish to deploy `tbot` into:
+
+```code
+$ helm install tbot teleport/tbot \
+  --namespace default \
+  --values tbot-values.yaml
+```
+
+Use `kubectl` to verify that the deployment is healthy:
+
+```code
+$ kubectl describe deployment/tbot
+$ kubectl logs deployment/tbot
+```
+
+With this complete, `tbot` is now successfully deployed to your cluster.
+
+## Step 4/4. Using the output
+
+By default, the `tbot` Helm chart is configured to write an identity file to a
+Kubernetes Secret called `tbot-out` in the namespace where `tbot` has been
+deployed.
+
+This identity file can be mounted into other pods and used with `tsh` or `tctl`
+to access and configure your Teleport cluster. For example:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: tsh
+  namespace: default
+spec:
+  containers:
+    - name: tsh
+      image: public.ecr.aws/gravitational/teleport-distroless:(=teleport.version=)
+      command:
+        - tsh
+      args:
+       - -i
+       - /identity-output/identity
+       - --proxy
+       - example.teleport.sh:443
+       - ls
+      volumeMounts:
+        - name: identity-output
+          mountPath: /identity-output
+  volumes:
+    - name: identity-output
+      secret:
+        secretName: tbot-out
+```
+
+If you wish to use `tbot` for a different kind of access, you can override the
+type of output using the `services` value of the Helm chart and setting
+`defaultOutput.enabled` to `false`.
+
+Follow one of the [access guides](../access-guides/access-guides.mdx) to find
+out more about how to configure `tbot` for your use case.
+
+## Next steps
+
+- Explore the [Helm chart configuration reference](../../reference/helm-reference/tbot.mdx).
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish
+  configuring `tbot` for your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/enroll-resources/machine-id/deployment/linux-tpm.mdx b/docs/pages/machine-workload-identity/deployment/linux-tpm.mdx
similarity index 82%
rename from docs/pages/enroll-resources/machine-id/deployment/linux-tpm.mdx
rename to docs/pages/machine-workload-identity/deployment/linux-tpm.mdx
index 65c3a558dec45..fd47d97d53b88 100644
--- a/docs/pages/enroll-resources/machine-id/deployment/linux-tpm.mdx
+++ b/docs/pages/machine-workload-identity/deployment/linux-tpm.mdx
@@ -1,11 +1,17 @@
 ---
-title: Deploying Machine ID on Linux (TPM)
-description: How to install and configure Machine ID on a Linux host and use a TPM 2.0 for authentication
+title: Deploying tbot on Linux (TPM)
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on a Linux host and use a TPM 2.0 for authentication
+sidebar_label: Linux (TPM)
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+enterprise: The TPM join method
 ---
 
-This page explains how to deploy Machine ID on a Linux host, and use the
-secure identify of the onboard TPM 2.0 chip for authenticating with the
-Teleport cluster.
+This page explains how to deploy Machine & Workload Identity's agent, `tbot`, on
+a Linux host, and use the secure identity of the onboard TPM 2.0 chip for
+authenticating with the Teleport cluster.
 
 The `tpm` join method requires a valid Teleport Enterprise license to be
 installed on the cluster's Auth Service.
@@ -19,17 +25,17 @@ installed on the cluster's Auth Service.
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
-- A Linux host that you wish to install Machine ID onto, with a TPM2.0
+- A Linux host that you wish to install `tbot` onto with a TPM2.0
   installed.
-- A Linux user on that host that you wish Machine ID to run as. In the guide,
+- A Linux user on that host that you wish `tbot` to run as. In the guide,
 we will use `teleport` for this.
 
 ## Step 1/5. Install `tbot`
 
 **This step is completed on the Linux host.**
 
-First, `tbot` needs to be installed on the VM that you wish to use Machine ID
-on.
+First, `tbot` needs to be installed on the VM that you wish to use Machine
+& Workload Identity on.
 
 Download the appropriate Teleport package for your platform:
 
@@ -58,7 +64,7 @@ With the Bot created, we now need to create a token. The token will be used by
 ### Determining the EKPub Hash or EKCert Serial for your TPM
 
 First, you need to determine the characteristics of the TPM on the host that
-you wish to use Machine ID on. These characteristics will then be used within
+you wish to install `tbot` on. These characteristics will then be used within
 the allow rules of the join token to grant access to this specific host.
 
 On the machine, run `tbot tpm identify`:
@@ -98,8 +104,8 @@ metadata:
   # name identifies the token. Try to ensure that this is descriptive.
   name: my-bot-token
 spec:
-  # For Machine ID and TPM joining, roles will always be "Bot" and
-  # join_method will always be "tpm".
+  # For MWI joining via TPM, roles will always be "Bot" and join_method will
+  # always be "tpm".
   roles: [Bot]
   join_method: tpm
 
@@ -161,8 +167,8 @@ onboarding:
 storage:
   type: directory
   path: /var/lib/teleport/bot
-# outputs will be filled in during the completion of an access guide.
-outputs: []
+# services will be filled in during the completion of an access guide.
+services: []
 ```
 
 Replace:
@@ -193,16 +199,16 @@ $ sudo chown teleport:teleport /var/lib/teleport/bot
 
 (!docs/pages/includes/machine-id/daemon.mdx!)
 
-## Step 5/5. Configure outputs
+## Step 5/5. Configure services
 
-(!docs/pages/includes/machine-id/configure-outputs.mdx!)
+(!docs/pages/includes/machine-id/configure-services.mdx!)
 
 ## Next steps
 
 - Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
 your environment.
-- Read the [TPM joining reference](../../../reference/join-methods.mdx#trusted-platform-module-tpm)
+- Read the [TPM joining reference](../../reference/deployment/join-methods.mdx#trusted-platform-module-tpm)
 to learn more about `tpm`joining.
-- Read the [configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
-- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-id/telemetry.mdx)
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/deployment/linux.mdx b/docs/pages/machine-workload-identity/deployment/linux.mdx
new file mode 100644
index 0000000000000..b2b3cb1d1db08
--- /dev/null
+++ b/docs/pages/machine-workload-identity/deployment/linux.mdx
@@ -0,0 +1,109 @@
+---
+title: Deploying tbot on Linux
+description: How to install and configure the Machine & Workload Identity agent, `tbot`, on a Linux host
+sidebar_label: Linux
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+This page explains how to deploy the Machine & Workload Identity agent, `tbot`,
+on a Linux host.
+
+## How it works
+
+The process in which `tbot` initially authenticates with the Teleport cluster is
+known as joining. A join method is a specific technique for the bot to prove its
+identity.
+
+On platforms where there is no form of identity available to the machine, the
+only available join method is `token`. The `token` join method is special as
+it is the only join method that relies on a shared secret. In order to mitigate
+the risks associated with this, the `token` join method is single use and it
+is not possible to use the same token multiple times.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A Linux host that you wish to install `tbot` onto.
+- A Linux user on that host that you wish `tbot` to run as. In the guide, we
+  will use `teleport` for this.
+
+## Step 1/4. Install `tbot`
+
+**This step is completed on the Linux host.**
+
+First, `tbot` needs to be installed on the VM that you wish to use Machine &
+Workload Identity on.
+
+Install Teleport as appropriate for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/4. Create a bot user
+
+**This step is completed on your local machine.**
+
+Create the bot:
+
+```code
+$ tctl bots add example
+```
+
+A join token will be included in the results of `tctl bots add`, record this
+value as it will be needed when configuring `tbot`.
+
+## Step 3/4. Configure `tbot`
+
+**This step is completed on the Linux host.**
+
+Create `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: token
+  token: (=presets.tokens.first=)
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace:
+- `example.teleport.sh:443` with the address of your Teleport Proxy or
+  Auth Service. Prefer using the address of a Teleport Proxy.
+- `(=presets.tokens.first=)` with the token that was returned by `tctl bots add`
+  in the previous step.
+
+<Admonition type="note">
+The first time that `tbot` runs, this token will be exchanged for a certificate
+that the bot uses for authentication. At this point, the token is invalidated.
+This means you may remove the token from the configuration file after the first
+run has completed, but there is no tangible security benefit to doing so.
+</Admonition>
+
+### Prepare the storage directory
+
+(!docs/pages/includes/machine-id/machine-id-init-bot-data.mdx!)
+
+### Create a systemd service
+
+(!docs/pages/includes/machine-id/daemon.mdx!)
+
+## Step 4/4. Configure services
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Next steps
+
+- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
+  your environment.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../reference/machine-workload-identity/telemetry.mdx)
diff --git a/docs/pages/machine-workload-identity/faq.mdx b/docs/pages/machine-workload-identity/faq.mdx
new file mode 100644
index 0000000000000..77891ef209cff
--- /dev/null
+++ b/docs/pages/machine-workload-identity/faq.mdx
@@ -0,0 +1,135 @@
+---
+title: Machine & Workload Identity FAQ
+description: Frequently asked questions about Teleport Machine & Workload Identity
+sidebar_label: FAQ
+tags:
+ - faq
+ - mwi
+ - infrastructure-identity
+---
+
+This page provides answers to frequently asked questions about Machine &
+Workload Identity (MWI). For a list of frequently asked questions about
+Teleport in general, see [Frequently Asked Questions](../faq.mdx).
+
+## Can MWI be used within CI/CD jobs?
+
+On CI/CD platforms where your workflow runs in an ephemeral environment (e.g
+no persistent state exists between individual workflow runs), MWI works best
+where a supported join method exists. These are:
+
+- GitHub Actions
+- CircleCI
+- GitLab
+- AWS
+- GCP
+- Azure
+- Kubernetes
+- Spacelift
+- Terraform Cloud
+
+On CI/CD platforms where you control the runner environment (e.g self-hosted
+Jenkins runner), MWI can run as a daemon on the runner and the generated
+credentials can be mounted into the environment of your individual workflow
+runs.
+
+## Can MWI be used with Trusted Clusters ?
+
+You can use MWI for SSH access in trusted leaf clusters.
+
+We currently do not support access to applications, databases, or Kubernetes
+clusters in leaf clusters.
+
+## Should I define allowed logins as user traits or within roles?
+
+When defining the logins that your bot will be allowed to use, there are two
+options:
+
+- Directly adding the login to the `logins` section of the role that your bot
+  will impersonate.
+- Adding the login to the logins trait of the bot user, and impersonating a role
+  that includes the `{{ internal.logins }}` role variable. This is usually done
+  by providing the `--logins` parameter when creating the bot.
+
+For simpler scenarios — where you only expect the bot to use a single service
+or role — you can add the login to the logins trait of the bot user. This
+approach allows you to leverage default roles like `access`.
+
+For situations where your bot is producing certificates for different roles in
+different services, it is important to consider whether using a login trait
+grants access to resources that you didn't intend. To prevent a login trait from
+granting access you didn't intend, we recommend that you create bespoke roles
+that explicitly specify the logins that should be included in the certificates.
+
+## Can MWI be used with per-session MFA?
+
+We do not currently support MWI and per-session MFA. Enabling per-session
+MFA globally, or for roles impersonated by MWI, will prevent credentials
+produced by MWI from being used to connect to resources.
+
+As a work-around, ensure that per-session MFA is enforced on individual roles
+rather than enforced globally, and that it is not enforced for roles that you
+will impersonate using MWI.
+
+## Can MWI be used with Device Trust?
+
+We do not currently support MWI and Device Trust. Requiring Device
+Trust cluster-wide or for roles impersonated by MWI will prevent
+credentials produced by MWI from being used to connect to resources.
+
+As a work-around, configure Device Trust enforcement on a role-by-role basis
+and ensure that it is not required for roles that you will impersonate using
+MWI.
+
+## Can MWI be used to generate long-lived certificates?
+
+MWI cannot currently be used to generate certificates valid for longer
+than 24 hours, and requests for longer certificates using the `credential_ttl`
+parameter will be reduced to this 24 hour limit.
+
+This limit serves multiple purposes. For one, it encourages security best
+practices by only ever issuing very short lived certificates. Additionally, as
+MWI allows for certificate renewal, this limit helps to prevent further
+exploitation should a MWI identity be compromised: an attacker could use
+a stolen renewable certificate to request very long lived certificates and
+maintain access for a much longer period.
+
+If your use case absolutely requires long-lived certificates,
+[`tctl auth sign`](../reference/cli/tctl.mdx#tctl-auth-sign) can
+alternatively be used, however this loses the security benefits of MWI's
+short-lived renewable certificates.
+
+## Can MWI be used to connect to multiple Kubernetes clusters?
+
+This is possible in Teleport v17.2.7 or higher, using the new `kubernetes/v2`
+output service type in `tbot`. This service can expose many clusters at once via
+contexts in the generated `kubeconfig.yaml`, and if label selectors are used,
+will dynamically add contexts as clusters are added and removed in Teleport.
+
+Note that both `tbot` and the Teleport Proxy need to be running v17.2.7 to take
+advantage of this functionality.
+
+Refer to the
+[CLI reference](../reference/cli/tbot.mdx#tbot-start-kubernetesv2) and
+[config reference](../reference/machine-workload-identity/configuration.mdx#kubernetesv2)
+for more information.
+
+## Does `tbot` support Windows?
+
+Yes, the `tbot` binary is available for Windows. It can be found in the client
+tools archive that also includes `tsh` and `tctl`. See the
+[Installing Teleport guide](../installation/installation.mdx) for further information.
+
+However, there are a few limitations to be aware of:
+
+- Functionality that relies on Unix Domain Sockets (e.g. SSH multiplexer,
+  SPIFFE Workload API etc.) is not available.
+- Functionality relating to the configuration of Symlink protection on directory
+  destinations is not available.
+- Functionality relating to the management of ACLs on directory destinations is
+  not available.
+- Most delegated join methods are unlikely to function correctly.
+
+In some circumstances, it can be more practical to run `tbot` within Windows
+Subsystem for Linux rather than running it natively on Windows. This will depend
+on where the tools that will consume the output of `tbot` are running.
diff --git a/docs/pages/machine-workload-identity/getting-started.mdx b/docs/pages/machine-workload-identity/getting-started.mdx
new file mode 100644
index 0000000000000..1787461b24f91
--- /dev/null
+++ b/docs/pages/machine-workload-identity/getting-started.mdx
@@ -0,0 +1,479 @@
+---
+title: Machine and Workload Identity Getting Started Guide
+description: Getting started with Teleport Machine and Workload Identity
+sidebar_label: Getting Started
+sidebar_position: 2
+videoBanner: YzVK2tr6u-U
+tags:
+ - get-started
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+Teleport Machine and Workload Identity (MWI) provides secure access for Non-Human Identities across multiple platforms
+and resource types, supporting everything from [Infrastructure-as-Code](./use-cases/iac-mwi.mdx)
+workflows to [AI agent](./use-cases/ai-agents-mwi.mdx) operations. This guide focuses on a popular
+implementation: executing commands on deployment targets through CI/CD pipelines. Even if your specific use case differs,
+this guide covers the fundamental MWI setup process, after which you can reference the dedicated use case pages for tool-specific guidance.
+
+Here's an overview of what you will do:
+
+- Choose a Linux server or Kubernetes cluster as your target resource.
+- Create a Role for your Bot, or choose an existing one.
+- Create a Bot in Teleport with a role allowing it to access your target resource.
+- Create a GitHub join token for the Bot.
+- Set up a GitHub Actions workflow that authenticates and issues a command using the `tbot` binary.
+
+This guide covers configuring MWI for development and learning purposes.
+For a production-ready configuration of MWI, visit the [Deploying Machine
+ID](../machine-workload-identity/deployment/deployment.mdx) guides.
+
+## Prerequisites
+
+In this getting started guide, you will configure MWI to issue commands to a Linux
+server or Kubernetes cluster from a GitHub Actions workflow. This guide assumes you've already enrolled a Linux server
+or Kubernetes cluster to Teleport. If you haven't done so, refer to the
+[guides on enrolling resources](../enroll-resources/enroll-resources.mdx).
+
+- A GitHub repository where you have permissions to create GitHub Actions workflows.
+  <details>
+  <summary>Using GitHub Enterprise?</summary>
+
+  There is extra configuration needed when using GitHub Enterprise repositories, either
+  cloud or self-hosted. We recommend using a personal repository for this guide if possible.
+
+  If you need to use GitHub Enterprise, check the following:
+  - Cloud
+    - In the join token, under `github` set the `enterprise_slug` field to the name of your enterprise's slug, likely the name of the organization.
+  - Self-hosted
+    - Your Teleport Auth Service must be able to reach your GitHub Enterprise instance.
+    - In the join token, under `github`, set the `enterprise_server_host` field to the hostname of your GitHub Enterprise instance.
+
+  <br/>
+  The join token fields are available and commented out in the example join token file.
+  </details>
+- A target resource enrolled in Teleport, either:
+  - A Linux server
+  - A Kubernetes cluster
+  - If you don't have a target resource that you can use, follow one of the [guides](../enroll-resources/enroll-resources.mdx)
+    for enrolling a new resource.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+(!/docs/pages/includes/tctl.mdx!)
+
+## Step 1/5. Choose a target resource
+
+First, choose a target resource that you want your GitHub Actions workflow to
+access using Machine and Workload Identity.
+
+To grant the GitHub Actions workflow access to the resource, you'll create a
+role and specify within this role the labels of the resources it should grant
+access to. Labels are key-value pairs that help identify and categorize
+resources in Teleport.
+
+<Tabs>
+<TabItem label="Server">
+
+You can find your nodes and labels in the GUI or with the following command:
+
+```code
+$ tctl nodes ls --format=text
+
+Host    UUID                                 Public Address Labels                              Version
+------- ------------------------------------ -------------- ----------------------------------- -------
+target1 8a50c8aa-c45f-403c-95ff-83f50561d64c                env=mwi-demo,hostname=ip-10-0-0-200 18.1.5
+```
+
+</TabItem>
+
+<TabItem label="Kubernetes">
+
+  You can find your clusters and labels in the GUI or with the following command:
+
+```code
+$ tctl kube ls --format=text
+
+Cluster  Labels                        Version
+-------- ----------------------------- -------
+staging  env=mwi-demo,region=us-west-2  18.1.5
+```
+
+</TabItem>
+</Tabs>
+
+In our examples, we'll use the `env` label with the value `mwi-demo` to control
+what our GitHub Actions workflow can access.
+
+## Step 2/5. Choose or create a role
+
+Now, we'll create a role which will grant access to our target resource. If you
+have a pre-existing role which grants access to your target resources, you can
+skip this step and use that instead.
+
+<Tabs>
+<TabItem label="Server">
+
+On your local machine, create a file called `role.yaml` and add the following
+contents:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: github-bot
+spec:
+  allow:
+    node_labels:
+      env: mwi-demo
+    logins:
+      - ubuntu
+```
+
+Replace:
+
+- `env: mwi-demo` with the label selector that matches your target resource.
+- `ubuntu` with the name of the Linux user that the workflow should have access to.
+
+Use `tctl create` to create the role from the file:
+
+```code
+$ tctl create -f ./role.yaml
+```
+
+</TabItem>
+
+<TabItem label="Kubernetes">
+
+On your local machine, create a file called `role.yaml` and add the following
+contents:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: github-bot
+spec:
+  allow:
+    kubernetes_labels:
+      env: mwi-demo
+    kubernetes_groups:
+      - system:masters
+    kubernetes_resources:
+      - kind: '*'
+        name: '*'
+        namespace: default
+        verbs:
+          - '*'
+```
+
+Replace:
+
+- `env: mwi-demo` with the label selector that matches your target resource.
+- `system:masters` with the Kubernetes group that the workflow should have access to.
+
+Use `tctl create` to create the role from the file:
+
+```code
+$ tctl create -f role.yaml
+```
+
+</TabItem>
+</Tabs>
+
+## Step 3/5. Create a bot
+
+In Teleport, a **Bot** represents an identity for a machine. This is similar to
+how a user represents the identity of a human. Like users, bots are assigned
+roles to manage their access to resources.
+
+You'll now create a bot to represent the GitHub Actions workflow.
+
+On your local machine, create a file called `bot.yaml` with the following
+contents:
+
+```yaml
+kind: bot
+version: v1
+metadata:
+  name: github-bot
+spec:
+  roles:
+    - github-bot
+```
+
+Ensure that the value within the `spec.roles` field matches the name of the role
+you have just created.
+
+Use `tctl create` to create the bot from the file:
+
+```code
+$ tctl create -f ./bot.yaml
+```
+
+## Step 4/5 Create a join token
+
+Unlike users, bots do not authenticate using a username and password or SSO.
+Instead, they authenticate in a process called joining. Teleport
+uses metadata about the platform the bot is running on, such as OIDC endpoints for CI pipelines,
+or the Assumed Role of an AWS EC2 Instance, to attest to the identity of the process,
+ensuring only authorized bots can join the cluster. This means the bot has a verified <i>identity</i>,
+rather than just a shared secret.
+
+Teleport supports a number of secure [join
+methods](../reference/deployment/join-methods.mdx#delegated-join-methods)
+specific to the platform the bot is running on. Since we are using GitHub
+Actions, we will use the `github` join method.
+
+For the join token definition, edit the `repository`
+field to match the GitHub repository where you will run the GitHub Actions workflow.
+When a bot attempts to join from that GitHub organization and repository, Teleport
+will identify it as your `github-bot` and assign it the correct role. If a bot attempts
+to join from any other repository, it will be rejected.
+
+On your local machine, create a file called `join_token.yaml` with the following
+contents:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: github-bot
+spec:
+  join_method: github
+  roles:
+  - Bot
+  bot_name: github-bot
+  github:
+    allow:
+    - repository: "your-github-username/my-repo"
+    # enterprise_server_host: github.my-company.com # use for self-hosted GitHub Enterprise
+    # enterprise_slug: my-company # use for GitHub Enterprise Cloud organization
+```
+
+Ensure that:
+
+- You replace `your-github-username/my-repo` with the name of the GitHub
+  repository where your GitHub Actions workflow will run.
+- The `spec.bot_name` field matches the name of the bot you created in the
+  previous step.
+- That you have set `enterprise_server_host` or `enterprise_slug` if appropriate.
+
+Use `tctl create` to create the join token from the file:
+
+```code
+$ tctl create -f join_token.yaml
+```
+
+## Step 5/5 Access a resource from GitHub Actions
+
+We have several published [Actions](../reference/deployment/join-methods.mdx#github-actions-helpers)
+for convenience, but for this guide we will look at things explicitly to aid understanding.
+
+Within your GitHub repository, you'll create two different files:
+
+- `.github/workflows/teleport.yaml`: the configuration for the GitHub Actions
+  workflow, specifying which actions should be taken on what triggers.
+- `tbot.yaml`: the configuration file for the Machine & Workload Identity agent,
+  `tbot`, which specifies how the bot should authenticate and what kind of
+  identity it should request.
+
+<Tabs>
+<TabItem label="Server">
+
+At the root of your GitHub repository, create a file called `tbot.yaml` with the
+following contents:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: github
+  token: github-bot
+certificate_ttl: 5m
+storage:
+  type: memory
+services:
+  - type: identity
+    destination:
+      type: directory
+      path: ./ssh_out
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy.
+- `github-bot` with the name of the token you created in Step 4/5.
+
+This configuration will write credentials for SSH access to the `./ssh_out`
+directory, which will last up to 5 minutes. You can adjust this TTL to match the
+expected runtime of your job, so the identity expires when its purpose is
+complete.
+
+Commit and push this file to your repository.
+
+You'll now add the GitHub Actions workflow file. Within the GitHub repository,
+create a file at `.github/workflows/teleport.yaml` with the following contents:
+
+```yaml
+on:
+  workflow_dispatch:
+
+jobs:
+  check_resource_usage:
+    permissions:
+      # The "id-token: write" permission is required, or MWI will not be
+      # able to authenticate with the cluster.
+      id-token: write
+      contents: read
+    name: Check resource usage on server
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        proxy: example.teleport.sh:443
+        version: auto
+    - name: Export ssh config
+      run: tbot start --oneshot -c ./tbot.yaml
+    - name: Run mpstat
+      run: |
+        ssh -F ./ssh_out/ssh_config ubuntu@myinstance.example.teleport.sh mpstat
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport proxy
+- `myinstance.example.teleport.sh` with the address of your target server.
+- `ubuntu` with the Linux user you want to log in as.
+
+In the second step of this workflow, we use one one of the published actions
+which installs the `tbot` binary into the workflow run environment.
+
+In the third step, we use this binary with the configuration you created earlier
+to authenticate as the bot and produce the SSH configuration and credentials in
+the `./ssh_out` directory.
+
+Finally, we run an SSH command using the short-lived identity. Instead, this
+configuration file could be used with Ansible or other kinds of SSH-based
+automations.
+
+Commit and push this file to your repository.
+
+</TabItem>
+
+<TabItem label="Kubernetes">
+
+At the root of your GitHub repository, create a file called `tbot.yaml` with the
+following contents:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: github
+  token: github-bot
+certificate_ttl: 5m
+storage:
+  type: memory
+services:
+  - type: kubernetes/v2
+    selectors:
+      - name: my-kubernetes-cluster
+    destination:
+      type: directory
+      path: ./k8s_out
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport Proxy.
+- `github-bot` with the name of the token you created in Step 4/5.
+- `my-kubernetes-cluster` with the name of your Kubernetes cluster as enrolled in Teleport.
+
+This configuration will write credentials for Kubernetes access to the
+`./k8s_out` directory, which will last up to 5 minutes. You can adjust this TTL
+to match the expected runtime of your job, so the identity expires when its
+purpose is complete.
+
+Commit and push this file to your repository.
+
+You'll now add the GitHub Actions workflow file. Within the GitHub repository,
+create a file at `.github/workflows/teleport.yaml` with the following contents:
+
+```yaml
+on:
+  workflow_dispatch:
+
+jobs:
+  list_pods:
+    permissions:
+      # The "id-token: write" permission is required, or MWI will not be
+      # able to authenticate with the cluster.
+      id-token: write
+      contents: read
+    name: List pods in default namespace
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        proxy: example.teleport.sh:443
+        version: auto
+    - name: Export kubectl config
+      run: tbot start --oneshot -c ./tbot.yaml
+    - name: Run kubectl get pods
+      run: |
+        kubectl --kubeconfig=./k8s_out/kubeconfig.yaml get pods -n default
+```
+
+Replace:
+
+- `example.teleport.sh:443` with the address of your Teleport proxy
+
+In the second step of this workflow, we use one one of the published actions
+which installs the `tbot` binary into the workflow run environment.
+
+In the third step, we use this binary with the configuration you created earlier
+to authenticate as the bot and produce the Kubernetes configuration and
+credentials in the `./k8s_out` directory.
+
+Finally, we run a `kubectl` command using the short-lived identity. This could
+instead be Helm or another Kubernetes configuration management tool.
+
+Commit and push this file to your repository.
+
+</TabItem>
+</Tabs>
+
+### Run the workflow
+
+In your GitHub repository
+- Go to the `Actions` tab
+- Select the Teleport workflow on the left
+- Click `Run workflow` on the right
+- Make sure the branch is `main` and click the `Run workflow` confirmation button
+
+After the workflow completes, you should see the job complete successfully, and the output of the command in the logs.
+
+## Summary
+
+You've successfully set up a workflow in GitHub Actions that can access your resources securely through the Teleport proxy,
+without distributing long-lived credentials, making the process more secure and efficient for development teams.
+
+## Next Steps
+
+- Check out the [deployment guides](./deployment/deployment.mdx) to learn about
+  configuring `tbot` in a production-ready way for your platform.
+- Check out the [access guides](./access-guides/access-guides.mdx) to learn about configuring
+  `tbot` for other use cases than SSH and Kubernetes.
+- Read the [configuration reference](../reference/machine-workload-identity/configuration.mdx) to explore
+  all the available configuration options.
+- Learn how [Workload Identities](../machine-workload-identity/workload-identity/introduction.mdx) enable the same capabilities
+  for resources like cloud APIs that can't be protected with the Teleport proxy.
diff --git a/docs/pages/machine-workload-identity/introduction.mdx b/docs/pages/machine-workload-identity/introduction.mdx
new file mode 100644
index 0000000000000..ebd14ab8c19c7
--- /dev/null
+++ b/docs/pages/machine-workload-identity/introduction.mdx
@@ -0,0 +1,177 @@
+---
+title: "Introduction to Machine & Workload Identity"
+description: "Explains concepts and use cases for Machine & Workload Identity, which replaces static secrets with secure, short-lived identities for machines and workloads."
+sidebar_label: "Introduction"
+sidebar_position: 1
+videoBanner: "ZDWRt105tBg"
+tags:
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport Machine & Workload Identity offers two complementary sets of capabilities for non-human entities in your infrastructure:
+
+- **Zero Trust Access for machines**: 
+Enables machines (like CI/CD pipelines) to securely authenticate with your Teleport cluster to access protected resources and configure the cluster itself.
+- **Flexible Workload Identities**: 
+Issues short-lived cryptographic identities to workloads, compatible with the SPIFFE standard, enabling secure workload-to-workload communication and third-party API authentication.
+
+## Secure service-to-service authentication
+
+Establish a root certificate authority within your Teleport cluster that issues short-lived JWTs and X509 certificates to workloads. These identities ([SPIFFE](../machine-workload-identity/workload-identity/spiffe.mdx) Verifiable Identity Documents or SVIDs) contain the workload's identity encoded as a URI (SPIFFE ID).
+
+Key benefits:
+
+- Eliminates long-lived shared secrets
+- Establishes a universal form of identity for workloads
+- Simplifies infrastructure by reducing authentication methods
+
+The tbot agent manages identity requests and renewals, authenticating to the Teleport cluster using supported join methods. Workloads receive identities either through filesystem/Kubernetes secrets or via the SPIFFE Workload API.
+
+## Zero Trust Access for machines
+
+Teleport provides machines with an identity ("bot") that can authenticate to the Teleport cluster. Bots are similar to human users with access controlled by roles and activities recorded in audit logs.
+
+Bots authenticate using join tokens that specify which bot user they grant access to and what proof (join method) is needed. Each tbot client connection creates a server-side Bot Instance to track installations over time.
+
+## Integrated use cases
+
+Zero Trust Access & Flexible Workload Identity can work together to create a comprehensive security model. Machines can securely access resources while workloads communicate securely with each other and external services, all managed through Teleport's unified access plane.
+
+### CI/CD pipeline with end-to-end authentication
+
+A [CI/CD system](./use-cases/mwi-ci-cd.mdx) securely deploys services to Kubernetes and establishes secure communication channels between them:
+
+- The pipeline authenticates through the proxy to deploy to Kubernetes and receives credentials to interact with cloud APIs (e.g., to push container images)
+- Services deployed by the pipeline receive SPIFFE identities for mutual TLS. The pipeline manages the identity lifecycle for the services it deploys
+
+### Cloud-native application with third-party API access
+
+A Kubernetes-based application needs access to both internal services and external APIs:
+
+- Automation tools authenticate to configure the cluster securely
+- Application components are issued SPIFFE identities
+- Identities authenticate to internal services via mTLS
+- JWT-based authentication is used for external API access
+
+### Zero Trust security implementation
+
+A [Zero Trust strategy](../machine-workload-identity/workload-identity/getting-started.mdx) is applied across workloads and automation:
+
+- Automation scripts authenticate through the proxy to perform infrastructure tasks
+- Workloads authenticate using short-lived, cryptographically verifiable identities
+- Security teams use Teleport’s unified audit logs to trace all identity activity
+
+### Identity-based communication without shared secrets
+
+Zero-trust, identity-based communication without shared secrets are rotated automatically without human involvement.
+
+Instead of managing static credentials (e.g., API keys, database passwords), workloads authenticate using short-lived X.509 certificates or JWTs compatible with the SPIFFE/SPIRE standard.
+
+- The service issues new identities to workloads on a regular schedule, dynamically issued by Teleport’s Auth Service and rotate automatically
+- All identity issuance and usage is recorded in audit logs
+
+## Key differences
+
+**Flexible Workload Identities**: Issues SPIFFE-compatible identities for various authentication purposes; doesn't use Teleport Proxy for workload-to-workload communication
+
+**Zero Trust Access for machines**: Issues Teleport-specific credentials for accessing resources secured by Teleport; requires using the Teleport Proxy
+
+| Feature | Flexible Workload Identities | Zero Trust Access for machines |
+|---------|------------------------------|--------------------------------|
+| Purpose | Authenticate workloads to other workloads or third-party APIs | Authenticate bots to Teleport to access infrastructure |
+| Standards | SPIFFE (SVIDs, Workload API, mTLS, JWT) | Teleport-native X.509 credentials |
+| Proxy Usage | No Teleport Proxy involved | Access goes through the Teleport Proxy |
+| Use Case Focus | Service-to-service authentication | Infrastructure and configuration access |
+| Credential Delivery | Filesystem or SPIFFE API via tbot | Artifacts written to disk via tbot |
+
+## Concepts
+
+Read this section to understand the high-level architecture of a Machine &
+Workload Identity setup. For a more in-depth overview, check out the [architecture
+page](../reference/architecture/machine-id-architecture.mdx).
+
+![Machine & Workload Identity architecture](../../img/machine-id/architecture-diagram.png)
+
+### Bots
+
+Machine & Workload Identity provides machines with an identity that can
+authenticate to the Teleport cluster. This identity is known as a **bot**. Bots
+share a number of similarities with human users:
+
+- Access controlled by roles assigned to them in Teleport
+- Access to resources recorded in audit logs
+- Identity encoded in an x.509 client certificate which is signed by the
+Teleport Auth Service and which can then be used for access.
+
+### Join tokens
+
+Unlike a human Teleport user, a bot does not "log in" using a static username
+and password. Instead, a bot authenticates to Teleport with a **join token**,
+which is configured within Teleport and specifies which bot user it grants
+access to and what sort of proof (known as the **join method**) is needed to use
+this join token. This proof is typically an identity issued to the machine by
+the platform it runs on (e.g. AWS IAM).
+
+Multiple join tokens may be created for a single bot to allow joining with
+different join methods.
+
+### Bot Instances
+
+Each time a new `tbot` client joins from scratch, it creates a new server-side
+Bot Instance. Bot Instances keep track of individual `tbot` installations over
+time, even as they renew their certificates or rejoin. These server-side
+resources also record the most recent authentication attempts, as well as
+bot heartbeats.
+
+Many Bot Instances can exist concurrently for a given Bot, regardless of their
+join method.
+
+Bot Instances can be inspected with:
+- `tctl get bot_instance` to list all instances
+- `tctl get bot_instance/$botName` to list all instances associated with a
+particular Bot
+- `tctl get bot_instance/$botName/$id` to show a single bot instance by its bot
+name and ID
+
+### tbot
+
+Machine & Workload Identity is used through an agent called `tbot`. `tbot`
+authenticates with the Teleport Cluster and then generates credentials and
+configuration files for other tools to use to connect to Teleport resources
+using the bot's identity.
+
+### Artifacts
+
+The files generated by `tbot` are referred to as its **artifacts**. Artifacts
+can be a number of things from credentials, such as signed certificates, to
+configuration files that will automatically configure a tool (such as `kubectl`)
+to use Teleport. This behaviour is controlled by configuring `tbot`'s
+**services**. A service specifies what should be generated and where it should
+be saved.
+
+## Further reading
+
+For a quickstart non-production introduction to Machine & Workload Identity, read the
+[Getting Started Guide](./getting-started.mdx).
+
+Production-ready guidance on deploying Machine & Workload Identity is broken out into two parts:
+
+- [Deploying `tbot`](./deployment/deployment.mdx): How to install and configure
+`tbot` on specific platforms.
+- [Access your Infrastructure using `tbot`](./access-guides/access-guides.mdx):
+How to use `tbot` to access Infrastructure through Teleport.
+
+Reference information:
+
+- [Workload Identity](./workload-identity/introduction.mdx): Information on Teleport Workload
+Identity for SPIFFE, a feature for issuing short-lived identities intended
+for workload to workload communication.
+- [Frequently Asked Questions](./faq.mdx): Commonly asked questions.
+- [Troubleshooting Guide](./troubleshooting.mdx): Common issues and how to solve
+them.
+- [Architecture](../reference/architecture/machine-id-architecture.mdx): A technical deep-dive into how Machine &
+Workload Identity works.
+- [Reference](../reference/machine-workload-identity/machine-workload-identity.mdx): Complete documentation of available
+configuration options.
+- [Manifesto](./manifesto.mdx): Our vision for Machine & Workload Identity.
diff --git a/docs/pages/machine-workload-identity/machine-workload-identity.mdx b/docs/pages/machine-workload-identity/machine-workload-identity.mdx
new file mode 100644
index 0000000000000..940c76f675ed8
--- /dev/null
+++ b/docs/pages/machine-workload-identity/machine-workload-identity.mdx
@@ -0,0 +1,331 @@
+---
+title: "Teleport Machine & Workload Identity"
+description: "Includes guides for for Machine & Workload Identity, which replaces static secrets with secure, short-lived identities for machines and workloads."
+template: "landing-page"
+tags:
+ - mwi
+ - infrastructure-identity
+---
+
+import LandingHero, { LandingHeroProps } from '@site/src/components/Pages/Landing/LandingHero';
+import Integrations, { IntegrationsProps } from "@site/src/components/Pages/Homepage/Integrations";
+import UseCasesList, { UseCasesListProps } from "@site/src/components/Pages/Landing/UseCasesList";
+
+import bookOpenSvg from "@site/src/components/Icon/teleport-svg/book-open.svg";
+import identificationBadgeSvg from "@site/src/components/Icon/teleport-svg/identification-badge.svg";
+import listBulletsSvg from "@site/src/components/Icon/teleport-svg/list-bullets.svg";
+import verifySvg from "@site/src/components/Icon/teleport-svg/verify.svg";
+import awsSvg from "@site/src/components/Icon/teleport-svg/aws.svg";
+import azureSvg from "@site/src/components/Icon/svg/azure2.svg";
+import azureDevOpsSvg from "@site/src/components/Icon/teleport-svg/azure.svg";
+import bitbucketSvg from "@site/src/components/Icon/svg/bitbucket.svg";
+import circleCISvg from "@site/src/components/Icon/svg/circleci2.svg";
+import gcpSvg from "@site/src/components/Icon/teleport-svg/gcp.svg";
+import gitlabSvg from "@site/src/components/Icon/svg/gitlab.svg";
+import jenkinsSvg from "@site/src/components/Icon/teleport-svg/jenkins.svg";
+import kubernetesSvg from "@site/src/components/Icon/svg/kubernetes2.svg";
+import linuxSvg from "@site/src/components/Icon/svg/linux.svg";
+import arrowRightSvg from "@site/src/components/Icon/teleport-svg/arrow-right.svg";
+import terraformSvg from "@site/src/components/Icon/svg/terraform.svg";
+import ansibleSvg from "@site/src/components/Icon/svg/ansible.svg";
+import terminalSvg from "@site/src/components/Icon/teleport-svg/terminal.svg";
+import databaseSvg from "@site/src/components/Icon/teleport-svg/database.svg";
+import appWindowSvg from "@site/src/components/Icon/teleport-svg/app-window.svg";
+import certificateSvg from "@site/src/components/Icon/teleport-svg/certificate.svg";
+import cloudSvg from "@site/src/components/Icon/teleport-svg/cloud.svg";
+import teleportSvg from "@site/src/components/Icon/teleport-svg/teleport.svg";
+
+<LandingHero
+  title="Machine & Workload Identity"
+  youtubeVideoId="ZDWRt105tBg"
+>
+
+Use Teleport to replace long-lived secrets with identity-based authentication for your machines and workloads.
+
+## Introduction to Machine & Workload Identity
+
+Teleport Machine & Workload Identity replaces static secrets across your infrastructure with short-lived certificates that are automatically issued and renewed for your Non-Human Identities (NHI).
+
+[What Teleport can do for non-human infrastructure access](./introduction.mdx)
+
+</LandingHero>
+
+<UseCasesList
+  title="Popular use cases around Machine & Workload Identity"
+  useCases={[
+    {
+      title: "Secure CI/CD pipelines with identity-based auth",
+      description: "Replace long-lived secrets in CI/CD pipelines",
+      href: "./use-cases/mwi-ci-cd/",
+    },  
+    {
+      title: "Guard infrastructure as code with short-lived certs",
+      description: "Manage IaC workflows in Terraform and Pulumi",
+      href: "./use-cases/iac-mwi/",
+    },
+    {
+      title: "Configure workload-to-workload authentication",
+      description: "Set up service-to-service authentication with mTLS",
+      href: "./use-cases/workload-mwi/",
+    },  
+    {
+      title: "Manage AI agent identities with role-based access",
+      description: "Use RBAC to manage autonomous agents and processes",
+      href: "./use-cases/ai-agents-mwi/",
+    },
+    {
+      title: "Configure hybrid & multi-cloud authentication",
+      description: "Set up universal identities across cloud platforms",
+      href: "./use-cases/hybrid-multi-mwi/",
+    },
+  ]}
+/>
+
+{/* lint ignore page-structure remark-lint */}
+
+## Getting started with Machine & Workload Identity
+
+The following steps will help you get started with Machine and Workload Identity. At the core of this flow is tbot, a lightweight agent that runs on your machines and workloads to automatically issue and renew short-lived certificates. This gives your systems secure, identity-based access to infrastructure and cloud providers without relying on static secrets.
+
+<Integrations
+  title={null}
+  secondaryTitle="Step 1: Deploy tbot across your infrastructure"
+  integrations={[
+    {
+      title: 'AWS',
+      href: './deployment/aws/',
+      iconColor: '#FF99001A',
+      iconComponent: awsSvg,
+    },
+    {
+      title: 'Azure',
+      href: './deployment/azure/',
+      iconColor: '#0078D41A',
+      iconComponent: azureSvg,
+    },
+    {
+      title: 'Azure DevOps',
+      href: './deployment/azure-devops/',
+      iconColor: '#0078D41A',
+      iconComponent: azureDevOpsSvg,
+    },
+    {
+      title: 'Bitbucket Pipelines',
+      href: './deployment/bitbucket/',
+      iconColor: '#0078D41A',
+      iconComponent: bitbucketSvg,
+    },
+    {
+      title: 'CircleCI',
+      href: './deployment/circleci/',
+      iconColor: '#0000001A',
+      iconComponent: circleCISvg,
+    },
+    {
+      title: 'Google Cloud',
+      href: './deployment/gcp/',
+      iconColor: '#06AC381A',
+      iconComponent: gcpSvg,
+    },
+    {
+      title: 'Gitlab CI',
+      href: './deployment/gitlab/',
+      iconColor: '#FF99001A',
+      iconComponent: gitlabSvg,
+    },
+    {
+      title: 'Jenkins',
+      href: './deployment/jenkins/',
+      iconColor: '#EA43351A',
+      iconComponent: jenkinsSvg,
+    },
+    {
+      title: 'Kubernetes',
+      href: './deployment/kubernetes/',
+      iconColor: '#0078D41A',
+      iconComponent: kubernetesSvg,
+    },
+    {
+      title: 'Linux',
+      href: './deployment/linux/',
+      iconColor: '#FF99001A',
+      iconComponent: linuxSvg,
+    },
+    {
+      title: 'Linux (TPM)',
+      href: './deployment/linux-tpm/',
+      iconColor: '#FF99001A',
+      iconComponent: linuxSvg,
+    }, 
+    {
+      title: 'View all Integrations',
+      href: './deployment#deployment-guides',
+      iconComponent: arrowRightSvg,
+    },
+  ]}
+    additionalLinks={{
+    title: "References:",
+    links: [
+    {
+      title: "The architecture behind the bots",
+      href: "./introduction/"
+    },
+    {
+      title: "View all tbot guides",
+      href: "./deployment/"
+    }
+  ]
+  }}
+  desktopColumnsCount={6}
+  noBackgroundColor={true}
+  narrowPadding={true}
+/>
+
+<Integrations
+  title={null}
+  secondaryTitle="Step 2: Configure tbot to generate short-lived credentials for resource access"
+  layout="row"
+  integrations={[
+    {
+      title: 'SSH servers',
+      description: 'Access enrolled Linux servers with OpenSSH.',
+      href: './access-guides/ssh/',
+      iconColor: '#F1F2F4',
+      iconComponent: terminalSvg,
+    },
+    {
+      title: 'Kubernetes',
+      description: 'Access enrolled Kubernetes clusters.',
+      href: './access-guides/kubernetes/',
+      iconColor: '#0078D41A',
+      iconComponent: kubernetesSvg,
+    },
+    {
+      title: 'Databases',
+      description: 'Access databases enrolled in Teleport.',
+      href: './access-guides/databases/',
+      iconColor: '#F1F2F4',
+      iconComponent: databaseSvg,
+    },
+    {
+      title: 'HTTP & TCP applications',
+      description: 'Access enrolled applications.',
+      href: './access-guides/applications/',
+      iconColor: '#F1F2F4',
+      iconComponent: appWindowSvg,
+    },
+    {
+      title: 'Ansible',
+      description: 'Access enrolled Linux hosts via SSH.',
+      href: './access-guides/ansible/',
+      iconColor: '#0000001A',
+      iconComponent: ansibleSvg,
+    },
+    {
+      title: 'tctl',
+      description: 'Use Teleport CLI tool for custom flows.',
+      href: './access-guides/tctl/',
+      iconColor: '#F1F2F4',
+      iconComponent: teleportSvg,
+    },
+    {
+      title: 'Spacelift',
+      description: 'Configure Teleport using Spacelift.',
+      href: '../zero-trust-access/infrastructure-as-code/terraform-provider/spacelift/',
+      iconColor: '#F1F2F4',
+      iconComponent: certificateSvg,
+    },
+    {
+      title: 'Terraform',
+      description: 'Configure Teleport using Terraform on a dedicated server.',
+      href: '../zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server/',
+      iconColor: '#512FC91A',
+      iconComponent: terraformSvg,
+    },
+    {
+      title: 'Terraform Cloud',
+      description: 'Configure Teleport using HCP Terraform or Terraform Enterprise.',
+      href: '../zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud/',
+      iconColor: '#F1F2F4',
+      iconComponent: cloudSvg,
+    },
+  ]}
+  additionalLinks={{
+    title: "Getting started",
+    links: [
+    {
+      title: "Issuing certs for NHI remote server access",
+      href: "./getting-started/"
+    },
+    {
+      title: "Frequently Asked Questions",
+      href: "./faq/"
+    },
+    {
+      title: "Troubleshooting",
+      href: "./troubleshooting/"
+    },
+  ]
+  }}
+  desktopColumnsCount={3}
+  noBackgroundColor={true}
+  narrowPadding={true}
+/>
+
+<Integrations
+  title={null}
+  secondaryTitle="Step 3: Secure workload and cloud authentication with SPIFFE compatible identities"
+  layout="row"
+  integrations={[
+    {
+      title: 'AWS OIDC Federation',
+      description: 'Authenticate to AWS with short-lived JWTs.',
+      href: './workload-identity/aws-oidc-federation/',
+      iconColor: '#FF99001A',
+      iconComponent: awsSvg,
+    },
+    {
+      title: 'AWS Roles Anywhere',
+      description: 'Authenticate to AWS with short-lived X.509 certificates.',
+      href: './workload-identity/aws-roles-anywhere/',
+      iconColor: '#FF99001A',
+      iconComponent: awsSvg,
+    },
+    {
+      title: 'Azure Federated Credentials',
+      description: 'Authenticate to Azure with short-lived JWTs.',
+      href: './workload-identity/azure-federated-credentials/',
+      iconColor: '#0078D41A',
+      iconComponent: azureSvg,
+    },
+    {
+      title: 'GCP Workload Identity Federation',
+      description: 'Authenticate to GCP with short-lived JWTs.',
+      href: './workload-identity/gcp-workload-identity-federation-jwt/',
+      iconColor: '#06AC381A',
+      iconComponent: gcpSvg,
+    },
+    {
+      title: 'tsh',
+      description: 'Manually issue SPIFFE SVIDs with Teleport CLI tool tsh.',
+      href: './workload-identity/tsh/',
+      iconColor: '#512FC91A',
+      iconComponent: teleportSvg,
+    },
+  ]}
+  additionalLinks={{
+    title: "References",
+    links: [
+    {
+      title: "SPIFFE, Trust Domains, and SVIDs",
+      href: "./workload-identity/spiffe/"
+    },
+    {
+      title: "About JWT SVIDs",
+      href: "./workload-identity/jwt-svids/"
+    },
+  ]
+  }}
+  desktopColumnsCount={2}
+  noBackgroundColor={true}
+/>
diff --git a/docs/pages/enroll-resources/machine-id/manifesto.mdx b/docs/pages/machine-workload-identity/manifesto.mdx
similarity index 89%
rename from docs/pages/enroll-resources/machine-id/manifesto.mdx
rename to docs/pages/machine-workload-identity/manifesto.mdx
index 8ef76db90c83e..f997c3063b28f 100644
--- a/docs/pages/enroll-resources/machine-id/manifesto.mdx
+++ b/docs/pages/machine-workload-identity/manifesto.mdx
@@ -1,6 +1,11 @@
 ---
-title: Machine ID Manifesto
-description: A manifesto for Machine Identity
+title: Machine & Workload Identity Manifesto
+description: A manifesto for Machine & Workload Identity
+sidebar_label: Manifesto
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 The world of machine identity is changing. Machines are trusted to complete
@@ -48,5 +53,5 @@ Together, these three pillars create a strong foundation for AI, automations and
 other workloads running together in a predictable way that is secure and
 possible to reason about and maintain.
 
-Teleport Workload & Machine Identity is on a mission to make this vision a
+Teleport Machine & Workload Identity is on a mission to make this vision a
 reality.
diff --git a/docs/pages/machine-workload-identity/troubleshooting.mdx b/docs/pages/machine-workload-identity/troubleshooting.mdx
new file mode 100644
index 0000000000000..cc9b78456c198
--- /dev/null
+++ b/docs/pages/machine-workload-identity/troubleshooting.mdx
@@ -0,0 +1,360 @@
+---
+title: Machine & Workload Identity Troubleshooting Guide
+description: Troubleshooting common issues with Machine & Workload Identity
+sidebar_label: Troubleshooting
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+This page provides resolution steps for issues that you may come across when
+setting up Machine & Workload Identity (MWI).
+
+## A bot failed to renew a certificate due to a "generation mismatch"
+
+### Symptoms
+
+The bot will log an error like this:
+
+```text
+ERROR: renewable cert generation mismatch: stored=3, presented=2
+```
+
+Subsequent connection attempts by the bot may see errors like the following:
+```text
+ERROR: failed direct dial to auth server: auth API: access denied [00]
+"\tauth API: access denied [00], failed dial to auth server through reverse tunnel: Get \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://example.com:3025/webapi/find\": x509: cannot validate certificate for example.com because it doesn't contain any IP SANs"
+"\tGet \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://example.com:3025/webapi/find\": x509: cannot validate certificate for example.com because it doesn't contain any IP SANs"
+```
+
+In particular, note the message `auth API: access denied`.
+
+In self-hosted Teleport deployments, the Teleport Auth Service will also provide
+some additional context:
+
+```text
+[AUTH]      WARN lock targeting User:"bot-example" is in force: The bot user "bot-example" has been locked due to a certificate generation mismatch, possibly indicating a stolen certificate. auth/apiserver.go:224
+```
+
+### Explanation
+
+<Admonition type="note">
+This applies only to bots using the `token` join method, which makes use of
+one-time use shared secrets. Provider-specific join methods, such as GitHub,
+AWS IAM, etc will not be locked in this fashion unless another instance of the
+bot uses `token` joining.
+</Admonition>
+
+Machine & Workload Identity (with token-based joining) uses a certificate
+generation counter to detect potentially stolen renewable certificates. Each
+time a bot fetches a new renewable certificate, the Auth Service increments the
+counter, stores it on the backend, and embeds a copy of the counter in the
+certificate.
+
+If the counter embedded in your bot certificate doesn't match the counter
+stored in Teleport's Auth Service, the renewal will fail and the bot user will
+be automatically [locked](../identity-governance/locking.mdx).
+
+Renewable certificates are exclusively stored in the bot's internal data
+directory, by default `/var/lib/teleport/bot`. It's possible to trigger this by
+accident if multiple bots are started using the same internal data directory, or
+if this internal data is otherwise being shared between multiple `tbot`
+processes.
+
+Additionally, if a bot fails to save its freshly renewed certificates (for
+example, due to a filesystem error) and crashes, it will attempt a renewal
+with old certificates and trigger a lock.
+
+### Resolution
+
+Before unlocking the bot, try to determine if either of the two scenarios
+described above apply. If the certificates were stolen, there may be
+underlying security concerns that need to be addressed.
+
+Otherwise, first ensure only one `tbot` process is using the internal data
+directory. Multiple bots can be run on a single system, but separate data
+directories must be configured for each.
+
+Additionally, ensure the internal data is not being shared with or copied to any
+other nodes, for example via a shared NFS volume. If you'd like to share
+certificates between nodes, only copy or share content from destination
+directories (usually `/opt/machine-id`) rather than the internal data directory
+(by default, `/var/lib/teleport/bot`).
+
+Once you have addressed the underlying cause, follow these steps to reset a
+locked bot:
+ 1. Remove the lock on the bot's user
+ 1. Reset the bot's generation counter by creating a new bot instance
+
+To remove the lock, first find and remove the lock targeting the bot user. For
+this example, we'll assume the bot is named `example`, which will have an
+associated Teleport user named `bot-example`:
+
+```code
+$ tctl get locks
+kind: lock
+metadata:
+  id: 1658359514703080513
+  name: 5cee949f-5203-4f3b-9805-dac35d798a16
+spec:
+  message: The bot user "bot-example" has been locked due to a certificate generation
+    mismatch, possibly indicating a stolen certificate.
+  target:
+    user: bot-example
+version: v2
+
+$ tctl rm lock/5cee949f-5203-4f3b-9805-dac35d798a16
+```
+
+Next, use `tctl bots instances add` to generate a new join token for the
+preexisting bot `example`:
+```code
+$ tctl bots instances add example
+```
+
+Finally, reconfigure the local `tbot` instance with the new token and restart
+it. It will detect the new token and automatically reset its internal data
+directory. The bot will be issued a new bot instance UUID once connected, and
+the generation counter will be reset.
+
+## `tbot` shows a "bad certificate error" at startup
+
+### Symptoms
+
+Restarting a `tbot` process outputs a log like the following:
+
+```text
+INFO [TBOT]      Successfully loaded bot identity, valid: after=2022-07-21T21:49:26Z, before=2022-07-21T22:50:26Z, duration=1h1m0s | kind=tls, renewable=true, disallow-reissue=false, roles=[bot-test], principals=[-teleport-internal-join], generation=2 tbot/tbot.go:281
+ERRO [TBOT]      Identity has expired. The renewal is likely to fail. (expires: 2022-07-21T22:50:26Z, current time: 2022-07-25T20:18:33Z) tbot/tbot.go:415
+WARN [TBOT]      Note: onboarding config ignored as identity was loaded from persistent storage tbot/tbot.go:288
+ERRO [TBOT]      Failed to resolve tunnel address Get "https://auth.example.com:3025/webapi/find": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs reversetunnel/transport.go:90
+ERRO [TBOT]      Failed to resolve tunnel address Get "https://auth.example.com:3025/webapi/find": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs reversetunnel/transport.go:90
+ERROR: failed direct dial to auth server: Get "https://teleport.cluster.local/v2/configuration/name": remote error: tls: bad certificate
+"\tGet \"https://teleport.cluster.local/v2/configuration/name\": remote error: tls: bad certificate, failed dial to auth server through reverse tunnel: Get \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://auth.example.com:3025/webapi/find\": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs"
+"\tGet \"https://teleport.cluster.local/v2/configuration/name\": Get \"https://auth.example.com:3025/webapi/find\": x509: cannot validate certificate for auth.example.com because it doesn't contain any IP SANs"
+```
+
+In particular, note the log line: "Identity has expired. The renewal is likely to
+fail."
+
+### Explanation
+
+Token-joined bots are unable to reauthenticate to the Teleport Auth Service once
+their certificates have expired. Tokens in token-based joining (as opposed to
+AWS IAM and other join methods) can only be used once, so when the bot's
+internal certificates expire, it will not be able to connect.
+
+When a bot's identity expires, certain parameters associated with the bot on the
+Auth Service must be reset and a new joining token must be issued. The simplest
+way to accomplish this is by removing and recreating the bot, which purges all
+server-side data and issues a new joining token.
+
+### Resolution
+
+Use `tctl bots instances add` to create a new one-time use token for the bot:
+
+```code
+$ tctl bots instances add example
+```
+
+Copy the resulting join token into the existing bot config—either the
+`--token` CLI flag or the `onboarding.token` parameter in `tbot.yaml`—and
+restart the bot. It will detect the new token and rejoin the cluster as normal.
+
+## SSH connections fail with `ssh: handshake failed: ssh: unable to authenticate`
+
+### Symptoms
+
+When attempting to connect to a node via SSH, connections fail with an error
+like the following:
+
+```code
+$ ssh -F /opt/machine-id/ssh_config bob@node.example.com
+ERROR: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
+
+ERROR: unable to execute tsh
+executing `tsh proxy`
+exit status 1
+
+kex_exchange_identification: Connection closed by remote host
+Connection closed by UNKNOWN port 65535
+```
+
+In particular, note the `ssh: unable to authenticate` message.
+
+### Explanation
+
+This can occur when attempting to log into the node as a user not listed as a
+principal on the SSH certificate.
+
+You can verify this by viewing the `tbot` logs and looking for the log message
+when impersonated certificates for the matching services were renewed.
+
+In the following example, the only principal listed for the identity in
+`/opt/machine-id` is `alice` (via the `access` role):
+```text
+INFO [TBOT]      Successfully renewed impersonated certificates for directory /opt/machine-id, valid: after=2022-07-21T21:49:26Z, before=2022-07-21T22:50:26Z, duration=1h1m0s | kind=tls, renewable=false, disallow-reissue=true, roles=[access], principals=[alice -teleport-internal-join], generation=0 tbot/renew.go:630
+```
+
+However, the SSH command attempted to log in as `bob`.
+
+### Resolution
+
+Ensure the bot identity is allowed to log in as the requested user by taking any
+of the following actions:
+
+ - Changing the SSH command to log in as an allowed user
+ - Modifying the `access` role to allow the `alice` principal
+ - Adding a role granting login via the `bob` principal
+
+Note that if roles are added or modified, the certificates will need to be
+renewed for the changes to take effect. The bot will renew certificates on its
+own after the renewal interval (by default, 20 minutes), but you can trigger a
+renewal immediately by either restarting the `tbot` process or sending it a
+reload signal:
+
+```code
+## If using systemd, you can restart the process:
+$ systemctl restart machine-id
+## Alternatively, you can send `tbot` a reload signal directly:
+$ pkill -sigusr1 tbot
+```
+
+## Database requests fail with `database "example" not found`, but the database exists
+
+### Symptoms
+
+When requesting certificates for Teleport-protected
+[databases](../enroll-resources/database-access/database-access.mdx), the certificate request
+fails with an error like the following:
+
+```text
+ERROR: Failed to generate impersonated certs for directory /opt/machine-id: database "example" not found
+database "example" not found
+```
+
+However, the database exists and can be seen by regular users via `tsh`:
+
+```code
+$ tsh db ls
+Name       Description Allowed Users Labels  Connect
+---------- ----------- ------------- ------- -------
+example                [alice]       env=dev
+```
+
+### Explanation
+
+Unlike regular Teleport users, Machine & Workload Identity bot users are granted
+only minimal Teleport [RBAC permissions](../reference/access-controls/roles.mdx) and are not
+allowed to view or list databases by default unless granted permission via one
+or more roles.
+
+### Resolution
+
+{/* vale messaging.protocol-products = NO */}
+Per the [Machine & Workload Identity Database Access Guide](./access-guides/databases.mdx), ensure at
+least one role providing database permissions has been granted to the
+output service listed in the error.
+{/* vale messaging.protocol-products = YES */}
+
+For example, note the `rules` section in the following example role:
+```yaml
+kind: role
+version: v5
+metadata:
+  name: machine-id-db
+spec:
+  allow:
+    db_labels:
+      '*': '*'
+    db_names: [example]
+    db_users: [alice]
+    rules:
+      - resources: [db_server, db]
+        verbs: [read, list]
+```
+
+Ensure the bot has a role that grants it at least these RBAC rules. If desired
+you can examine bot roles with `tctl` to ensure the necessary `rules` have been
+granted:
+
+```code
+$ tctl get role/machine-id-db
+```
+
+If the role is missing database permissions, it can be modified in your text
+editor:
+
+```code
+$ tctl edit role/machine-id-db
+```
+
+Edit the role, then save and close the file to apply your changes.
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+<Admonition type="note">
+By default, output services (like `/opt/machine-id`) are granted all roles provided
+to the bot via `tctl bots add --roles=...`, but it's possible to grant only a
+subset of these roles using the `roles: ...` parameter in `tbot.yaml`.
+
+If permissions are unexpectedly missing, ensure `tbot.yaml` requests your
+database role, either by relying on default behavior or adding the role to the
+`roles: ...` list.
+</Admonition>
+
+Once fixed, restart or reload the `tbot` clients for the updated role to take
+effect.
+
+If the bot was not granted the role initially, the simplest solution is to
+delete and recreate the bot, being sure to include the role in the `--roles=...`
+flag:
+
+```code
+$ tctl bots rm example
+$ tctl bots add example --roles=foo,bar,machine-id-db
+```
+
+## Destination kubernetes_secret: `identity-output` must be a directory in exec plugin mode
+
+By default, when outputting a Kubernetes identity, `tbot` outputs make use of a Kubernetes exec
+plugin to always provide the latest version of the credentials.
+
+When outputting a Kubernetes identity to a Kubernetes secret, however, it is important to disable
+the use of the `exec` plugin by adding `disable_exec_plugin: true` to the output. This means that
+a static `kubeconfig` file with embedded short-lived credentials is written instead:
+
+```yaml
+services:
+  - type: kubernetes
+    # Specify the name of the Kubernetes cluster you wish the credentials to
+    # grant access to.
+    kubernetes_cluster: example-k8s-cluster
+    # Required when outputting a Kubernetes identity to a Kubernetes secret.
+    disable_exec_plugin: true
+    destination:
+      type: kubernetes_secret
+      # For this guide, identity-output is used as the secret name.
+      # You may wish to customize this. Multiple outputs cannot share the same
+      # destination.
+      name: identity-output
+```
+
+Failure to add the `disable_exec_plugin` flag will result in a warning being displayed:
+`Destination kubernetes_secret: identity-output must be a directory in exec plugin mode`.
+
+## Configuring `tbot` for split DNS proxies
+
+When you have deployed your Proxy Service in such a way that it is
+accessible via two different DNS names, e.g an internal and external address,
+you may find that a `tbot` that is configured to use one of these addresses may
+attempt to use the other address and that this may cause connections to fail.
+
+This is because `tbot` queries an auto-configuration endpoint exposed by the
+Proxy Service to determine the canonical address to use when connecting.
+
+To fix this, set a variable of `TBOT_USE_PROXY_ADDR=yes` in the environment of the
+`tbot` process. This configures `tbot` to prefer using the address that you have
+explicitly provided. This only functions correctly in cases where TLS
+routing/multiplexing is enabled for the Teleport cluster.
diff --git a/docs/pages/machine-workload-identity/use-cases/ai-agents-mwi.mdx b/docs/pages/machine-workload-identity/use-cases/ai-agents-mwi.mdx
new file mode 100644
index 0000000000000..349deb077aa8b
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/ai-agents-mwi.mdx
@@ -0,0 +1,26 @@
+---
+title: AI Agents with Machine & Workload Identity
+description: Use Machine & Workload Identity to securely grant agentic AI access to infrastructure.
+sidebar_label: Agentic AI
+tags:
+ - conceptual
+ - mwi
+ - ai
+---
+
+With Teleport, you can enforce access and privileges for agents.
+
+Security must be enforced deterministically; AI agents cannot be trusted to follow high-level instructions like "don't delete production". 
+Teleport solves this by issuing each agent its own identity and requiring the agent's actions (for example, database queries) to flow through the Teleport proxy. 
+This allows Teleport to apply Role-Based Access Control (RBAC) at both the network and protocol level.
+
+Teleport can secure infrastructure components such as SSH servers, Kubernetes clusters, databases, or MCP servers, when accessed by agents.
+All queries, commands, and requests executed by the agent are logged, providing full visibility and [auditability](../../reference/deployment/monitoring/audit.mdx).
+
+## Interested in a design partnership?
+
+<Admonition type="tip" title="Exploring AI Agents with MWI?">
+If you're exploring how to secure AI Agents with Teleport Machine & Workload Identity, we'd love to hear from you. 
+[Contact us](mailto:product-management@goteleport.com?subject=AI%20Agents%20Design%20Partnership) to share your use case and learn more about opportunities for a design partnership.
+</Admonition>
+
diff --git a/docs/pages/machine-workload-identity/use-cases/hybrid-multi-mwi.mdx b/docs/pages/machine-workload-identity/use-cases/hybrid-multi-mwi.mdx
new file mode 100644
index 0000000000000..eda0f198354c6
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/hybrid-multi-mwi.mdx
@@ -0,0 +1,55 @@
+---
+title: Hybrid & Multi-Cloud with Machine & Workload Identity
+description: Use Machine & Workload Identity to streamline the management of identity and access for machines and workloads across cloud providers and on-prem environments.
+sidebar_label: Hybrid & Multi-Cloud
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport Machine & Workload Identity streamlines hybrid and multi-cloud operations while reducing management costs. 
+It integrates with Terraform, Pulumi, AWS, GCP, Azure, and also provides solutions for on-premises environments.
+
+## Choose your cloud provider
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="awsIdentity" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/aws-roles-anywhere",
+      name: "AWS Roles Anywhere and Workload Identity",
+    },
+    {
+      icon: <Icon name="googleCloud" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt",
+      name: "Google Cloud Workload Identity Federation",
+    },
+    {
+      icon: <Icon name="azure" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/azure-federated-credentials",
+      name: "Azure Federated Credentials",
+    },
+    {
+      icon: <Icon name="oracle" size="xl" />,
+      name: "Oracle Cloud Infrastructure and Workload Identity (Guide coming soon!)",
+    }
+  ]}
+/>
+
+## Manage access for all clouds with one credential
+
+Managing IAM for machines and applications in one cloud is doable. But when organizations move outside one cloud provider, either to a hybrid on-prem architecture or multiple cloud providers (or both), complexity grows quickly. Distributing, managing, and rotating cloud credentials for on-premises servers or for services that span multiple clouds introduces operational complexity and increases the risk of mismanagement.
+
+Teleport issues credentials compatible with all major cloud providers that can also be used for mTLS between applications, making securing communication between clouds easier.
+
+## Secure and auditable access with ephemeral credentials
+
+Teleport generates a credential in X.509 or JWT form, compatible with:
+
+- AWS IAM Roles Anywhere
+- Google Cloud Workload Identity Federation
+- Microsoft Entra Workload ID
+- OCI Workload Identity Federation
+
+You can use these credentials with Infrastructure-as-Code like Terraform and Pulumi, applications that need to access a cloud provider API from outside that cloud (i.e. sending logs to an AWS S3 bucket from GCP), and with human users authenticating with cloud providers via CLI. The credentials are ephemeral, with a custom time-to-live set, and Teleport automatically rotates them. Teleport provides a comprehensive audit log of every credential issued to make compliance reporting easy.
diff --git a/docs/pages/machine-workload-identity/use-cases/iac-mwi.mdx b/docs/pages/machine-workload-identity/use-cases/iac-mwi.mdx
new file mode 100644
index 0000000000000..737ded671a35b
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/iac-mwi.mdx
@@ -0,0 +1,62 @@
+---
+title: Infrastructure-as-Code with Machine & Workload Identity
+description: Use Machine & Workload Identity to replace the use of static secrets in Infrastructure-as-Code workflows.
+sidebar_label: Infrastructure-as-Code
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport Machine & Workload Identity replaces long-lived static secrets in Infrastructure-as-Code (IaC) tools with short-lived, 
+automatically generated certificates. Machine & Workload Identity supports Terraform and Pulumi, and has native integrations with 
+AWS, GCP and Azure, as well as solutions for on-prem configuration.
+
+## Choose your cloud provider
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="awsIdentity" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/aws-roles-anywhere",
+      name: "AWS Roles Anywhere and Workload Identity",
+    },
+    {
+      icon: <Icon name="googleCloud" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt",
+      name: "Google Cloud Workload Identity Federation",
+    },
+    {
+      icon: <Icon name="azure" size="xl" />,
+      to: "/docs/machine-workload-identity/workload-identity/azure-federated-credentials",
+      name: "Azure Federated Credentials and Workload Identity",
+    },
+    {
+      icon: <Icon name="oracle" size="xl" />,
+      name: "Oracle Cloud Infrastructure and Workload Identity (Guide coming soon!)",
+    }
+  ]}
+/>
+
+## Eliminate secrets from your Infrastructure-as-Code
+
+IaC repositories require credentials with wide-ranging privileges in order to create, delete and manage all manner of infrastructure, 
+from networks to Kubernetes clusters to cloud IAM resources. Exfiltration of these credentials, in the form of AWS key pairs, GCP service key 
+files, Azure service principals, etc, can be catastrophic.
+
+Best practices for managing these secrets include very controlled chains of access, and regular rotation, which causes drag on platform, security and developer teams.
+Teleport eliminates the need for these static, long-lived secrets by issuing short-lived, identity-based credentials when your IaC runs.
+
+## Secure and auditable access with ephemeral credentials
+
+When your IaC runs, Teleport generates a short-lived credential compatible with:
+
+- AWS IAM Roles Anywhere
+- Google Cloud Workload Identity Federation
+- Microsoft Entra Workload ID
+- OCI Workload Identity Federation
+
+The cloud provider issues a temporary credential linked to an IAM role, which allows the IaC workflow to perform its tasks. This credential exists only for the duration of the run and automatically expires once it completes. 
+By design, this minimizes the risk of credential exposure and eliminates the need for manual rotation or long-term management. Because all major cloud providers support this method of authentication, IaC pipelines that manage resources across multiple clouds can rely on a single mechanism instead of juggling separate credential processes. 
+
+Teleport further enhances this model by recording every credential issuance in a comprehensive [audit log](../../reference/deployment/monitoring/audit.mdx), simplifying compliance and reporting.
diff --git a/docs/pages/machine-workload-identity/use-cases/mwi-ci-cd.mdx b/docs/pages/machine-workload-identity/use-cases/mwi-ci-cd.mdx
new file mode 100644
index 0000000000000..acb61c6b3e338
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/mwi-ci-cd.mdx
@@ -0,0 +1,92 @@
+---
+title: CI/CD with Machine & Workload Identity
+description: Use Machine & Workload Identity to replace static secrets in CI/CD pipelines for accessing servers, databases, Kubernetes clusters and applications.
+sidebar_label: CI/CD
+tags:
+ - ci-cd
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport Machine & Workload Identity eliminates the need for long-lived static secrets in CI/CD pipelines by issuing short-lived 
+certificates at runtime. Teleport natively integrates with many CI/CD providers and deployment targets.
+
+## Choose your CI/CD platform
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="azureDevops" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/azure-devops",
+      name: "Azure DevOps",
+    },
+    {
+      icon: <Icon name="bitbucket" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/bitbucket",
+      name: "BitBucket Pipelines",
+    },
+    {
+      icon: <Icon name="circleci" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/circleci",
+      name: "CircleCI",
+    },
+    {
+      icon: <Icon name="gitlab" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/gitlab",
+      name: "GitLab CI",
+    },
+    {
+      icon: <Icon name="githubActions" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/github-actions",
+      name: "GitHub Actions",
+    },
+    {
+      icon: <Icon name="jenkins" size="xl" />,
+      to: "/docs/machine-workload-identity/deployment/jenkins",
+      name: "Jenkins",
+    },
+    {
+      icon: <Icon name="spacelift" size="xl" />,
+      to: "/docs/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift",
+      name: "Spacelift",
+    }
+  ]}
+/>
+
+## Eliminate secrets from your CI/CD pipeline
+
+In a typical CI/CD setup, a pipeline such as one running in GitHub Actions on GitHub's infrastructure outside the corporate network builds a 
+container image, pushes it to a container registry, and updates an application running in a container orchestration platform (such as Kubernetes).
+
+This workflow commonly relies on sensitive credentials stored in the CI/CD system, such as:
+
+- Cloud provider access credentials (e.g., AWS, GCP, Azure)
+- Configuration files or tokens for deploying to orchestration platforms
+
+Traditionally, platform teams would generate static credentials and share them with development teams, who were then responsible for manually updating 
+repositories. Although the credential generation process emits a security log, teams often lack a reliable way to correlate it with GitHub's audit logs 
+to verify timely rotation. Sharing credentials via Slack, email, file drops, or password managers adds further risk. Moreover, exposing the Kubernetes API 
+to the internet introduces unnecessary surface area for attack.
+
+Teleport eliminates the need for these shared secrets by issuing short-lived, identity-based credentials at runtime. Rather than storing static access tokens in the CI/CD 
+system, pipelines can request ephemeral credentials that expire automatically, reducing the risk of credential leaks and simplifying access management.
+
+## Secure and auditable access with ephemeral credentials
+
+In CI/CD pipelines, Teleport eliminates the need for static credentials by generating ephemeral, short-lived identities at the start of each job:
+
+- A SPIFFE Verifiable Identity Document (SVID) used with AWS IAM Roles Anywhere for secure AWS access (e.g., to ECR or S3).
+- A time-bound Kubernetes config file to interact with the cluster.
+
+These credentials are issued as short-lived JWT-SVIDs or X.509 certificates that expire automatically when the job completes. 
+This improves the security posture and simplifies credential management for platform teams. All usage is logged by Teleport, 
+and Kubernetes commands from the CI/CD runner are routed through the Teleport Proxy, enabling secure access to private 
+API endpoints and full audit visibility.
+
+### Further reading
+
+- [Architecture](../../reference/architecture/machine-id-architecture.mdx): A technical deep-dive into how Machine &
+  Workload Identity works.
+- [Reference](../../reference/machine-workload-identity/machine-workload-identity.mdx): Complete documentation of available
+  configuration options.
diff --git a/docs/pages/machine-workload-identity/use-cases/use-cases.mdx b/docs/pages/machine-workload-identity/use-cases/use-cases.mdx
new file mode 100644
index 0000000000000..fde8d961e4cd0
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/use-cases.mdx
@@ -0,0 +1,12 @@
+---
+title: Machine & Workload Identity Use Cases
+description: Popular use cases for Teleport Machine & Workload Identity
+sidebar_label: Use Cases
+sidebar_position: 3
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+<DocCardList />
diff --git a/docs/pages/machine-workload-identity/use-cases/workload-mwi.mdx b/docs/pages/machine-workload-identity/use-cases/workload-mwi.mdx
new file mode 100644
index 0000000000000..0f246b969f7f2
--- /dev/null
+++ b/docs/pages/machine-workload-identity/use-cases/workload-mwi.mdx
@@ -0,0 +1,36 @@
+---
+title: Service to Service mTLS with Machine & Workload Identity
+description: Use Machine & Workload Identity to issue flexible, short-lived cryptographic identity documents for service to service authentication.
+sidebar_label: Service to Service mTLS
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+Using Workload Identity certificates reduces the risk of credential exfiltration and provides 
+engineers with a built-in authentication method for new services. Each certificate is tied to 
+the identity of the application itself, rather than relying on a shared certificate infrastructure 
+or API key that can be copied or reused. This ensures that authentication and authorization are both 
+more secure and reliable.
+
+## Eliminate secrets from your applications
+
+Teleport issues special credentials to applications in the form of x.509 certificates or JWTs, after 
+verifying their identity (to get started, see [Introduction to Workload Identity](../workload-identity/introduction.mdx).
+These credentials are automatically rotated every 20 minutes by default. They contain a URI that
+uniquely identifies the application. Applications using the credentials automatically gain mTLS, 
+and can verify that a request or response not only comes from a trusted certificate, but from a specific trusted application. 
+This makes it possible to guarantee separation of tenants, geographic areas, etc.
+
+## Improve developer efficiency and experience
+
+With Teleport Machine & Workload Identity powering application to application authentication, developers can use 
+standardized open-source libraries in their services to request a credential, and not worry about setting up API keys or 
+integrating with custom PKI. Teleport Workload Identity credentials follow the SPIFFE standard, making them interoperable 
+with a wide ecosystem of libraries and SDKs.
+
+### Further reading
+
+- [Best Practices for Teleport Workload Identity](../workload-identity/best-practices.mdx): Learn how Teleport verifies applications and issues credentials
+- [Introduction to SPIFFE:](../workload-identity/spiffe.mdx) Learn about the open-source standard for workload identities and federation
diff --git a/docs/pages/enroll-resources/workload-identity/aws-oidc-federation.mdx b/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx
similarity index 98%
rename from docs/pages/enroll-resources/workload-identity/aws-oidc-federation.mdx
rename to docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx
index bf98e03e298b0..130ec1f025619 100644
--- a/docs/pages/enroll-resources/workload-identity/aws-oidc-federation.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx
@@ -1,6 +1,12 @@
 ---
 title: Configuring Workload Identity and AWS OIDC Federation
+sidebar_label: AWS OIDC Federation
 description: Configuring AWS to accept Workload Identity JWTs as authentication using OIDC Federation
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - aws
 ---
 
 Teleport Workload Identity issues flexible short-lived identities in JWT format.
@@ -55,7 +61,7 @@ This guide covers configuring OIDC federation. For Roles Anywhere, see
 - `tbot` must already be installed and configured on the host where the
   workloads which need to access Teleport Workload Identity will run. For more
   information, see the [deployment
-  guides](../machine-id/deployment/deployment.mdx).
+  guides](../deployment/deployment.mdx).
 
 <Admonition type="warning">
 Issuing JWT SVIDs with Teleport Workload Identity requires at least Teleport
@@ -390,7 +396,7 @@ Take your already deployed `tbot` service and configure it to issue SPIFFE SVIDs
 by adding the following to the `tbot` configuration file:
 
 ```yaml
-outputs:
+services:
   - type: workload-identity-jwt
     destination:
       type: directory
@@ -485,5 +491,5 @@ Workload Identity.
 Teleport Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/aws-roles-anywhere.mdx b/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx
similarity index 96%
rename from docs/pages/enroll-resources/workload-identity/aws-roles-anywhere.mdx
rename to docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx
index a874634baffb2..a1bedef597252 100644
--- a/docs/pages/enroll-resources/workload-identity/aws-roles-anywhere.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx
@@ -1,6 +1,12 @@
 ---
 title: Configuring Workload Identity and AWS Roles Anywhere
+sidebar_label: AWS Roles Anywhere
 description: Configuring AWS to accept Workload Identity certificates as authentication using AWS Roles Anywhere
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - aws
 ---
 
 Teleport Workload Identity issues flexible short-lived identities in X.509
@@ -23,11 +29,12 @@ AWS APIs in a few ways:
 - Workload Identity works with any AWS client, including the command-line tool
   but also
   their SDKs.
-- Using the Teleport Application Service to access AWS does not work with Machine ID
-  and therefore cannot be used when a machine needs to authenticate with AWS.
+- Using the Teleport Application Service to access AWS does not work with
+  Machine & Workload Identity and therefore cannot be used when a machine needs
+  to authenticate with AWS.
 
 Whilst this guide is primarily aimed at allowing a machine to access AWS,
-the `tsh svid issue` command can be used in place of Machine ID to allow a human
+the `tsh svid issue` command can be used in place of `tbot` to allow a human
 user to authenticate with using AWS Roles Anywhere.
 
 ## OIDC Federation vs Roles Anywhere
@@ -56,7 +63,7 @@ This guide covers configuring Roles Anywhere, for OIDC federation, see
 - (!docs/pages/includes/tctl.mdx!)
 - `tbot` must already be installed and configured on the host where the
 workloads which need to access Teleport Workload Identity will run. For more
-information, see the [deployment guides](../machine-id/deployment/deployment.mdx).
+information, see the [deployment guides](../deployment/deployment.mdx).
 
 ### Deciding on a SPIFFE ID structure
 
@@ -266,7 +273,7 @@ Take your already deployed `tbot` service and configure it to issue SPIFFE SVIDs
 by adding the following to the `tbot` configuration file:
 
 ```yaml
-outputs:
+services:
   - type: workload-identity-x509
     destination:
       type: directory
@@ -344,5 +351,5 @@ The official AWS documentation for Roles Anywhere.
 Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/azure-federated-credentials.mdx b/docs/pages/machine-workload-identity/workload-identity/azure-federated-credentials.mdx
similarity index 97%
rename from docs/pages/enroll-resources/workload-identity/azure-federated-credentials.mdx
rename to docs/pages/machine-workload-identity/workload-identity/azure-federated-credentials.mdx
index 9c457be5fd993..4e83b55afe2e8 100644
--- a/docs/pages/enroll-resources/workload-identity/azure-federated-credentials.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/azure-federated-credentials.mdx
@@ -1,6 +1,12 @@
 ---
 title: Configuring Workload Identity and Azure Federated Credentials
+sidebar_label: Azure Federated Credentials
 description: Configuring Azure to accept Workload Identity JWTs as authentication using Azure Federated Credentials
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - azure
 ---
 
 Teleport Workload Identity issues flexible short-lived identities in JWT format.
@@ -27,8 +33,8 @@ protect Azure APIs in a few ways:
 - Workload Identity works with any Azure client, including the command-line tool
   but also their SDKs.
 - Using the Teleport Application Service to access Azure does not work with
-  Machine ID and therefore cannot be used when a machine needs to authenticate
-  with Azure.
+  Machine & Workload Identity and therefore cannot be used when a machine needs
+  to authenticate with Azure.
 
 ## Prerequisites
 
@@ -38,7 +44,7 @@ protect Azure APIs in a few ways:
 - `tbot` must already be installed and configured on the host where the
   workloads which need to access Teleport Workload Identity will run. For more
   information, see the [deployment
-  guides](../machine-id/deployment/deployment.mdx).
+  guides](../deployment/deployment.mdx).
 - An Azure resource group and subscription you wish to grant the workload access
   to.
 
@@ -247,7 +253,7 @@ Take your already deployed `tbot` service and configure it to issue SPIFFE SVIDs
 by adding the following to the `tbot` configuration file:
 
 ```yaml
-outputs:
+services:
   - type: workload-identity-jwt
     destination:
       type: directory
@@ -338,5 +344,5 @@ Workload Identity.
 Teleport Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/best-practices.mdx b/docs/pages/machine-workload-identity/workload-identity/best-practices.mdx
similarity index 96%
rename from docs/pages/enroll-resources/workload-identity/best-practices.mdx
rename to docs/pages/machine-workload-identity/workload-identity/best-practices.mdx
index d4f7d32d55487..18a2258567952 100644
--- a/docs/pages/enroll-resources/workload-identity/best-practices.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/best-practices.mdx
@@ -1,6 +1,11 @@
 ---
 title: Best Practices for Teleport Workload Identity
+sidebar_label: Best Practices
 description: Answers common questions and describes best practices for using Teleport Workload Identity in production.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 This page covers common questions and best practices for using Teleport's
@@ -88,7 +93,7 @@ The SPIFFE SDKs are available in a number of languages:
 To configure the SPIFFE Workload API, follow the instructions in
 [Getting Started with Workload Identity](./getting-started.mdx).
 
-### Using the `spiffe-svid` Output
+### Using the `spiffe-svid` output service
 
 In cases where your workload is not written in a language that has a SPIFFE SDK,
 `tbot` can be configured to write the SVID, SVID key and trust bundle to files
@@ -99,7 +104,7 @@ trust bundle for mTLS. If the workload is long-running, it must watch these
 files and reload them when changes occur. This accounts for renewals of the
 short-lived SVID and CA rotations.
 
-To configure the `spiffe-svid` output type follow the instructions in
+To configure the `spiffe-svid` output service type follow the instructions in
 [Getting Started with Workload Identity](./getting-started.mdx).
 
 ### Proxy
@@ -141,7 +146,8 @@ can then configure Postgres to map this common name to `myuser`.
 There are certain circumstances where you may wish to use Teleport Workload ID
 to authenticate a workload's access to a database.
 
-This differs from using Machine ID with the Database Service in a few ways:
+This differs from using Machine & Workload Identity with the Database Service in
+a few ways:
 
 - The connection is made directly from the workload to the database, rather
   than through Teleport's Proxy Service and Database Service.
diff --git a/docs/pages/enroll-resources/workload-identity/federation.mdx b/docs/pages/machine-workload-identity/workload-identity/federation.mdx
similarity index 96%
rename from docs/pages/enroll-resources/workload-identity/federation.mdx
rename to docs/pages/machine-workload-identity/workload-identity/federation.mdx
index 346dba351e494..5dc21e9e8aaeb 100644
--- a/docs/pages/enroll-resources/workload-identity/federation.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/federation.mdx
@@ -1,6 +1,10 @@
 ---
 title: SPIFFE Federation
 description: An overview of the Teleport Workload Identity SPIFFE Federation feature.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 Federation allows a relationship to be established between your Teleport
@@ -99,7 +103,7 @@ Workload API.
 Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
 - Read the [SPIFFE Federation Specification](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md)
 to understand the technical details of SPIFFE Federation.
diff --git a/docs/pages/enroll-resources/workload-identity/gcp-workload-identity-federation-jwt.mdx b/docs/pages/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt.mdx
similarity index 97%
rename from docs/pages/enroll-resources/workload-identity/gcp-workload-identity-federation-jwt.mdx
rename to docs/pages/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt.mdx
index 52bd95401815b..ad800081eec16 100644
--- a/docs/pages/enroll-resources/workload-identity/gcp-workload-identity-federation-jwt.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt.mdx
@@ -1,6 +1,12 @@
 ---
 title: Configuring Workload Identity and GCP Workload Identity Federation with JWTs
+sidebar_label: GCP Workload Identity Federation with JWTs
 description: Configuring GCP to accept Workload Identity JWTs as authentication using Workload Identity Federation
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+ - google-cloud
 ---
 
 Teleport Workload Identity issues flexible short-lived identities in JWT format.
@@ -26,8 +32,9 @@ GCP APIs in a few ways:
   recorded in Teleport's audit log.
 - Workload Identity works with any GCP client, including the command-line tool
   but also their SDKs.
-- Using the Teleport Application Service to access GCP does not work with Machine ID
-  and therefore cannot be used when a machine needs to authenticate with AWS.
+- Using the Teleport Application Service to access GCP does not work with
+  Machine & Workload Identity and therefore cannot be used when a machine needs
+  to authenticate with AWS.
 
 ## Prerequisites
 
@@ -36,7 +43,7 @@ GCP APIs in a few ways:
 - (!docs/pages/includes/tctl.mdx!)
 - `tbot` must already be installed and configured on the host where the
 workloads which need to access Teleport Workload Identity will run. For more
-information, see the [deployment guides](../machine-id/deployment/deployment.mdx).
+information, see the [deployment guides](../deployment/deployment.mdx).
 
 <Admonition type="warning">
 Issuing JWT SVIDs with Teleport Workload Identity requires at minimum version
@@ -315,7 +322,7 @@ Take your already deployed `tbot` service and configure it to issue SPIFFE SVIDs
 by adding the following to the `tbot` configuration file:
 
 ```yaml
-outputs:
+services:
   - type: workload-identity-jwt
     destination:
       type: directory
@@ -412,5 +419,5 @@ Workload Identity.
 Teleport Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
diff --git a/docs/pages/machine-workload-identity/workload-identity/getting-started.mdx b/docs/pages/machine-workload-identity/workload-identity/getting-started.mdx
new file mode 100644
index 0000000000000..87a91643d001e
--- /dev/null
+++ b/docs/pages/machine-workload-identity/workload-identity/getting-started.mdx
@@ -0,0 +1,258 @@
+---
+title: Getting Started with Workload Identity
+sidebar_label: Getting Started
+description: Getting started with Teleport Workload Identity for SPIFFE
+tags:
+ - get-started
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport's Workload Identity issues flexible short-lived identities intended
+for workloads. It is compatible with the industry-standard SPIFFE specification
+meaning that it can be used in place of other SPIFFE compatible identity
+providers.
+
+## How it works
+
+In this guide, you'll configure the RBAC necessary to allow a Bot to issue
+workload identity credentials and then configure `tbot` to expose a SPIFFE
+Workload API endpoint. You can then connect your workloads to this endpoint to
+receive SPIFFE SVID-compatible workload identity credentials.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- `tbot` must already be installed and configured on the host where the
+  workloads which need to access Teleport Workload Identity will run. For more
+  information, see the [deployment guides](../deployment/deployment.mdx).
+
+## Step 1/4. Configure Workload Identity
+
+First, you will need to create a Workload Identity resource.
+
+This resource is the primary way that Teleport Workload Identity is configured.
+Each Workload Identity resource represents the configuration of an identity for a
+specific workload or a template to be used when representing the identity of a
+group of workloads. The Workload Identity resource specifies a number of key
+things, including:
+
+- The name of the Workload Identity, which will be needed when issuing it.
+- The SPIFFE ID that will be included in credentials issued for this
+  WorkloadIdentity.
+- Any rules around when this Workload Identity can be used to issue credentials.
+
+Before proceeding, you'll want to determine the SPIFFE ID path that your
+workload will use. In our example, we'll use `/svc/foo`. We provide more
+guidance on choosing a SPIFFE ID structure in the
+[Best Practices](./best-practices.mdx) guide.
+
+Create a new file called `workload-identity.yaml`:
+
+```yaml
+kind: workload_identity
+version: v1
+metadata:
+  name: example-workload-identity
+  labels:
+    example: getting-started
+spec:
+  spiffe:
+    id: /svc/foo
+```
+
+Replace:
+
+- `example-workload-identity` with a name that describes your use-case.
+- `/svc/foo` with the SPIFFE ID path you have decided on issuing.
+
+Use `tctl create -f ./workload-identity.yaml` to create the Workload Identity.
+
+Now, you'll need to create a role that will grant access to the Workload Identity
+that you have just created. As with other Teleport resources, access is granted
+by specifying label matchers on the role that will match the labels on the
+resource itself.
+
+In addition to granting access to the resource, we will also need to grant the
+ability to read and list the Workload Identity resource type.
+
+Create `workload-identity-issuer-role.yaml`:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: example-workload-identity-issuer
+spec:
+  allow:
+    workload_identity_labels:
+      example: ["getting-started"]
+    rules:
+    - resources:
+      - workload_identity
+      verbs:
+      - list
+      - read
+```
+
+Use `tctl create -f ./workload-identity-issuer-role.yaml` to create the role.
+
+Now, use `tctl bots update` to add the role to the Bot. Replace `example-bot`
+with the name of the Bot you created in the deployment guide and
+`example-workload-identity-issuer` with the name of the role you just created:
+
+```code
+$ tctl bots update example-bot --add-roles example-workload-identity-issuer
+```
+
+### Configuring DNS SANs
+
+In some cases, you may wish to configure DNS SANs which should be included in
+the X509 certificates issued by the Workload API. This is useful in cases
+where the client may not be SPIFFE aware and will check the DNS SAN rather than
+the SPIFFE URI during the TLS handshake.
+
+Modify your `workload-identity.yaml` resource definition to include the
+`spec.spiffe.x509.dns_sans` field, replacing `example.com` with the DNS name you
+require:
+
+```yaml
+kind: workload_identity
+version: v1
+metadata:
+  name: example-workload-identity
+  labels:
+    example: getting-started
+spec:
+  spiffe:
+    id: /svc/foo
+    x509:
+      dns_sans:
+      - example.com
+```
+
+Use `tctl create -f ./workload-identity.yaml` to update the WorkloadIdentity
+resource with your changes.
+
+## Step 2/4. Configure `workload-identity-api` service in `tbot`
+
+To set up a SPIFFE Workload API endpoint with `tbot`, we configure an instance
+of the `workload-identity-api` service.
+
+First, determine where you wish this socket to be created. In our example,
+we'll use `/opt/machine-id/workload.sock`. You may wish to choose a directory
+that is only accessible by the processes that will need to connect to the
+Workload API.
+
+Modify your `tbot` configuration file to include the `workload-identity-api`
+service:
+
+```yaml
+services:
+- type: workload-identity-api
+  listen: unix:///opt/machine-id/workload.sock
+  selector:
+    name: example-workload-identity
+```
+
+Replace:
+
+- `/opt/machine-id/workload.sock` with the path to the socket you wish to create.
+- `example-workload-identity` with the name of the Workload Identity resource you
+  created earlier.
+
+Start or restart your `tbot` instance to apply the new configuration
+
+### Configuring Unix Workload Attestation
+
+By default, an SVID listed under the Workload API service will be issued to any
+workload that connects to the Workload API. You may wish to restrict which SVIDs
+are issued based on certain characteristics of the workload. This is known as
+Workload Attestation.
+
+When using the Unix listener, `tbot` supports workload attestation based on
+three characteristics of the workload process:
+
+- `uid`: The UID of the user that the workload process is running as.
+- `gid`: The primary GID of the user that the workload process is running as.
+- `pid`: The PID of the workload process.
+
+Within a Workload Identity, you can configure rules based on the attributes
+determined via workload attestation. Each rule contains a number of tests and
+all tests must pass for the rule to pass. At least one rule must pass for the
+Workload Identity to be allowed to issue a credential.
+
+For example, to configure a Workload Identity to be issued only to workloads that
+are running as the user with ID 1000 or running as a user with a primary group
+ID of 50:
+
+```yaml
+kind: workload_identity
+version: v1
+metadata:
+  name: example-workload-identity
+  labels:
+    example: getting-started
+spec:
+  rules:
+    allow:
+    - conditions:
+      - attribute: workload.unix.uid
+        eq:
+          value: 1000
+    - conditions:
+      - attribute: workload.unix.gid
+        eq:
+          value: 50
+  spiffe:
+    id: /svc/foo
+```
+
+## Step 3/4. Testing the Workload API with `tbot spiffe-inspect`
+
+The `tbot` binary includes a `spiffe-inspect` command that can be used to
+test the configuration of the Workload API. This command will connect to the
+Workload API and request SVIDs, whilst providing debug information.
+
+Before configuring your workload to use the Workload API, we recommend using
+this command to ensure that the Workload API is behaving as expected.
+
+Use the `spiffe-inspect` command with `--path` to specify the path to the
+Workload API socket, replacing `/opt/machine-id/workload.sock` with the path you
+configured in the previous step:
+
+```code
+$ tbot spiffe-inspect --path unix:///opt/machine-id/workload.sock
+INFO [TBOT]      Inspecting SPIFFE Workload API Endpoint unix:///opt/machine-id/workload.sock tbot/spiffe.go:31
+INFO [TBOT]      Received X.509 SVID context from Workload API bundles_count:1 svids_count:1 tbot/spiffe.go:46
+SVIDS
+- spiffe://example.teleport.sh/svc/foo
+  - Expiry: 2024-03-20 10:55:52 +0000 UTC
+Trust Bundles
+- example.teleport.sh
+```
+
+## Step 4/4. Configuring your workload to use the Workload API
+
+Now that you know that the Workload API is behaving as expected, you can
+configure your workload to use it. The exact steps will depend on the workload.
+
+In cases where you have used the SPIFFE SDKs, you can configure the
+`SPIFFE_ENDPOINT_SOCKET` environment variable to point to the socket created by
+`tbot`.
+
+See the [Best Practices](./best-practices.mdx) guide for more information on
+integrating SPIFFE with your workloads.
+
+## Next steps
+
+- [Workload Identity Overview](./introduction.mdx): Overview of Teleport
+Workload Identity.
+- [Best Practices](./best-practices.mdx): Best practices for using Workload
+Identity in Production.
+- Read the [Workload Identity reference](../../reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx)
+to explore the configuration of the Workload Identity resource.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+all the available configuration options for `tbot`.
diff --git a/docs/pages/machine-workload-identity/workload-identity/introduction.mdx b/docs/pages/machine-workload-identity/workload-identity/introduction.mdx
new file mode 100644
index 0000000000000..a46e806a45d31
--- /dev/null
+++ b/docs/pages/machine-workload-identity/workload-identity/introduction.mdx
@@ -0,0 +1,121 @@
+---
+title: Introduction to Workload Identity
+sidebar_label: Introduction
+description: Describes Teleport Workload Identity, which securely issues flexible, short-lived cryptographic identities to workloads and non-human identities.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+---
+
+Teleport Workload Identity securely issues short-lived cryptographic identities
+to workloads. It is a flexible foundation for workload identity across your 
+infrastructure, creating a uniform way for your workloads to authenticate 
+regardless of where they are running.
+
+The flexible nature of Teleport Workload Identity enables it to be used for a
+range of purposes, including:
+
+- Workload authentication to third-party APIs on cloud platforms such as AWS, 
+  GCP and Azure.
+- Providing X.509 certificates for mutual TLS authentication between workloads
+  within your infrastructure as part of a Zero Trust strategy.
+- Workload authentication between services within your infrastructure. 
+
+Teleport Workload Identity is compatible with the open-source
+[Secure Production Identity Framework For Everyone (SPIFFE)](./spiffe.mdx)
+standard. This enables interoperability between workload identity
+implementations and also provides a wealth of off-the-shelf tools and SDKs to
+simplify integration with your workloads. 
+
+There's a whole host of benefits to adopting Teleport Workload Identity, but
+here's some of the key ones:
+
+- Eliminate the use of long-lived shared secrets within your infrastructure, and
+  reduce the risk of exfiltration and time spent by engineers creating and 
+  rotating these secrets.
+- Establish an out of the box universal form of identity for your workloads,
+  enabling your engineers to get on with building new services without needing 
+  to think about how they'll authenticate.
+- Converge on a first-class form of identity for your workloads, simplifying
+  infrastructure by reducing the number of different ways workloads authenticate.
+
+## How it works
+
+Teleport Workload Identity establishes a root certificate authority within your
+Teleport cluster that will be responsible for issuing the short-lived JWTs and
+X509 certificates to workloads.
+
+These identities are also known as SPIFFE Verifiable Identity Documents (SVIDs)
+and contain the identity of the workload encoded as a URI, also known as a 
+SPIFFE ID. The structure of this SPIFFE ID is up to you and can encode any
+information you need to uniquely identify your workload.
+
+The ability to request these identities is controlled by Teleport's Role-Based
+Access Control system. Users and Bots are granted roles which will allow them to
+request identities with specific SPIFFE IDs.
+
+The `tbot` agent is installed in close proximity to workloads which require an
+identity. It manages the process of requesting and renewing the identities for
+the workloads. The `tbot` agent authenticates to the Teleport cluster using one
+of our support join methods, which in many cases enable it to authenticate 
+on the basis of federated trust rather than the use of long-lived secrets.
+
+Workloads can receive their identities in one of two ways:
+
+- The `tbot` agent can write these identities to a directory on the local
+  filesystem, or, to a Kubernetes secret.
+- The `tbot` agent can expose a SPIFFE Workload API. A standardized gRPC API
+  that allows workloads to request their identities directly from the `tbot`
+  agent.
+
+When using the Workload API, the `tbot` agent can perform an additional process
+called Workload Attestation. This allows the issuance of identities to be 
+restricted to specific workloads. For example, you can restrict an identity to
+only be issued to a Linux process with a specific UID or GID, or restrict an
+identity to only be issued to a specific Kubernetes pod. The Workload
+Attestation process eliminates the need for a "bootstrapping" secret to be 
+provided to the workloads.
+
+![Workload ID overview](../../../img/workload-identity/intro-diagram.png)
+
+Once the workload has its identity, it can be used for a range of purposes. The
+X.509 certificates can be used to establish Mutual TLS, and the JWTs can be used
+to authenticate with a range of third-party APIs.
+
+## Teleport Zero Trust Access vs Workload Identity
+
+Teleport Machine & Workload Identity for Zero Trust Access primarily issues
+short-lived credentials to workloads to enable them to access resources secured
+by the Teleport cluster. The credentials issued are only compatible with
+Teleport itself, and access to resources must be through the Teleport Proxy.
+
+Teleport Workload Identity issues cryptographic identities that are compatible
+with the popular SPIFFE standard for interoperable workload identity. These 
+identities are flexible enough to be used for a range of purposes. The 
+Teleport Proxy is not used for securing workload-to-workload communication.
+
+## Next steps
+
+Learn more about Teleport Workload Identity:
+
+- [SPIFFE](./spiffe.mdx): Learn about the SPIFFE specification and how it is implemented by Teleport Workload Identity.
+- [Federation](./federation.mdx): Learn about using Federation to allow workloads to trust workloads from other trust domains.
+- [JWT SVIDs](./jwt-svids.mdx): Learn about the short-lived JWTs issued by Workload Identity.
+- [Best Practices](./best-practices.mdx): Best practices for using Workload Identity in Production.
+- [Workload Identity Resource](../../reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx): The full reference for the Workload Identity resource.
+- [Workload Identity API and Workload Attestation](../../reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx): To learn more about the Workload Identity API and Workload Attestation.
+
+Learn how to configure Teleport Workload Identity for specific use-cases:
+
+- [Getting Started](./getting-started.mdx): How to configure Teleport for Workload Identity.
+- [TSH Support](./tsh.mdx): How to use `tsh` with Workload Identity to issue SVIDs to users.
+- [AWS Roles Anywhere](./aws-roles-anywhere.mdx): Configuring AWS to accept Workload Identity certificates as authentication using AWS Roles Anywhere.
+- [AWS OIDC Federation](./aws-oidc-federation.mdx): Configuring AWS to accept Workload Identity JWTs as authentication using AWS OIDC Federation.
+- [GCP Workload Identity Federation](./gcp-workload-identity-federation-jwt.mdx): Configuring GCP to accept Workload Identity JWTs as authentication using GCP Workload Identity Federation.
+- [Azure Federated Credentials](./azure-federated-credentials.mdx): Configuring Azure to accept Workload Identity JWTs as authentication using Azure Federated Credentials.
+
+### Other resources
+
+- [SPIFFE Specification](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE.md): The official SPIFFE specification. Useful for understanding the SPIFFE ID and SVID formats.
+- [Solving The Bottom Turtle](https://spiffe.io/pdf/Solving-the-bottom-turtle-SPIFFE-SPIRE-Book.pdf): A book covering the fundamentals and details of SPIFFE.
diff --git a/docs/pages/enroll-resources/workload-identity/jwt-svids.mdx b/docs/pages/machine-workload-identity/workload-identity/jwt-svids.mdx
similarity index 94%
rename from docs/pages/enroll-resources/workload-identity/jwt-svids.mdx
rename to docs/pages/machine-workload-identity/workload-identity/jwt-svids.mdx
index 51e9b055a4946..befeec7e965a0 100644
--- a/docs/pages/enroll-resources/workload-identity/jwt-svids.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/jwt-svids.mdx
@@ -1,6 +1,10 @@
 ---
 title: JWT SVIDs
 description: An overview of the JWT SVIDs issued by Teleport Workload Identity
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 One type of credential that can be issued by Teleport Workload Identity is a
@@ -64,5 +68,5 @@ platforms:
 Workload Identity.
 - [Best Practices](./best-practices.mdx): Best practices for using Workload
 Identity in Production.
-- Read the [configuration reference](../../reference/machine-id/configuration.mdx) to explore
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
 all the available configuration options.
diff --git a/docs/pages/enroll-resources/workload-identity/spiffe.mdx b/docs/pages/machine-workload-identity/workload-identity/spiffe.mdx
similarity index 98%
rename from docs/pages/enroll-resources/workload-identity/spiffe.mdx
rename to docs/pages/machine-workload-identity/workload-identity/spiffe.mdx
index 8a311104dccd4..5a024bff176b9 100644
--- a/docs/pages/enroll-resources/workload-identity/spiffe.mdx
+++ b/docs/pages/machine-workload-identity/workload-identity/spiffe.mdx
@@ -1,6 +1,10 @@
 ---
 title: Introduction to SPIFFE
 description: Learn about Secure Production Identity Framework For Everyone (SPIFFE) and how it is implemented by Teleport Workload Identity
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 SPIFFE (Secure Production Identity Framework For Everyone) is a set of standards
@@ -90,4 +94,4 @@ before issuing SVIDs. This is known as Workload Attestation.
 - [Workload Identity Overview](./introduction.mdx): Overview of Teleport
   Workload Identity.
 - [SPIFFE Website](https://spiffe.io/): Learn more about the SPIFFE
-  specification.
\ No newline at end of file
+  specification.
diff --git a/docs/pages/machine-workload-identity/workload-identity/tsh.mdx b/docs/pages/machine-workload-identity/workload-identity/tsh.mdx
new file mode 100644
index 0000000000000..6f746c4eac9eb
--- /dev/null
+++ b/docs/pages/machine-workload-identity/workload-identity/tsh.mdx
@@ -0,0 +1,94 @@
+---
+title: Workload Identity and tsh
+description: Issuing SPIFFE SVIDs using Workload Identity and tsh
+tags:
+ - how-to
+ - mwi
+ - infrastructure-identity
+---
+
+{/* lint disable page-structure remark-lint */}
+
+In some scenarios, you may wish to issue a SPIFFE SVID manually, without using
+`tbot`. This can be useful in scenarios where you need to impersonate a service
+for the purposes of debugging or could provide a mechanism for providing
+human access to services which use SPIFFE SVIDs for authentication.
+
+In this guide, you will use the `tsh` tool to issue a SPIFFE SVID.
+
+## Prerequisites
+
+- A role configured to allow issuing SPIFFE SVIDs and this role assigned to
+  your user. See [Getting Started](./getting-started.mdx) for more information.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+## Step 1/2. Using `tsh` to issue a SPIFFE X509 SVID
+
+First, determine where you wish to write the SPIFFE SVID. If you wish to write
+these into a directory, you must first create it. In our example, we will write
+the SVID to a directory called `svid`.
+
+Next, determine which workload identity resource you'll use to issue the X509
+SVID. In our example, we'll use a workload identity called
+`my-workload-identity`.
+
+Issue the SVID specifying the output directory using `--output` and the name of
+the workload identity resource using `--name-selector`:
+
+```sh
+$ tsh workload-identity issue-x509 --output ./svid --name-selector my-workload-identity
+```
+
+Additionally, flags can be used to further customize the SVID:
+
+| `flag`             | Description                                                                                                         |
+|--------------------|---------------------------------------------------------------------------------------------------------------------|
+| `--credential-ttl` | Sets the Time To Live for the resulting X509 SVID. Specify duration using `s`, `m` and `h`, e.g `12h` for 12 hours. |
+
+### Using headless authentication to issue a SVID on a remote host
+
+In some scenarios, you may wish to use `tsh` to issue a SVID on a host you have
+SSHed into, without logging into Teleport on that host. This can be particularly
+useful in scenarios where authentication may not be possible, for example, when
+you authenticate using a hardware token.
+
+In this case, you can use the headless authentication feature of `tsh`. This
+provides a prompt for you to authenticate the command on the remote machine,
+using your local `tsh` client.
+
+To use headless authentication, we provide the `--headless` flag, and must
+also specify the `--proxy` and `--user` flags:
+
+```sh
+$ tsh --proxy=example.teleport.sh \
+  --user example \
+  --headless \
+  workload-identity issue-x509 \
+  --output . \
+  --name-selector my-workload-identity
+```
+
+## Step 2/2. Using the output SVID
+
+Once the SVID has been issued, you can configure your workload to use it. This
+will differ depending on the workload.
+
+When written to disk, the SVID will be written as three files:
+
+| `file`            | Description                                                                                                                                                                    |
+|-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `svid_key.pem`    | The private key for the X509 SVID. This is PEM wrapped and marshalled in PKCS8 format.                                                                                         |
+| `svid.pem`        | The X509 SVID itself. This is PEM wrapped and DER encoded.                                                                                                                     |
+| `svid_bundle.pem` | The SPIFFE trust bundle. A concatenated list of X509 certificates for the certificate authorities within the trust domain. These are individually PEM wrapped and DER encoded. |
+
+## Next steps
+
+- [Workload Identity Overview](./introduction.mdx): Overview of Teleport
+Workload Identity.
+- [Getting Started](./getting-started.mdx): How to configure Teleport for
+Workload Identity.
+- [Best Practices](./best-practices.mdx): Best practices for using Workload
+Identity in Production.
+- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
+all the available configuration options.
diff --git a/docs/pages/machine-workload-identity/workload-identity/workload-identity.mdx b/docs/pages/machine-workload-identity/workload-identity/workload-identity.mdx
new file mode 100644
index 0000000000000..d526856abb615
--- /dev/null
+++ b/docs/pages/machine-workload-identity/workload-identity/workload-identity.mdx
@@ -0,0 +1,55 @@
+---
+title: Workload Identity
+description: Securely issue flexible short-lived identities to your workloads
+tags:
+ - mwi
+ - infrastructure-identity
+---
+
+The guides in this section explain how to use Workload Identity, which securely
+issues flexible short-lived identities to workloads in your infrastructure.
+
+## Getting started
+- [Introduction to Workload Identity](./introduction.mdx): Describes Teleport Workload Identity, which securely issues flexible, short-lived cryptographic identities to workloads and non-human identities.
+- [Introduction to SPIFFE](./spiffe.mdx): Learn about Secure Production Identity Framework For Everyone (SPIFFE) and how it is implemented by Teleport Workload Identity
+- [Getting Started with Workload Identity](./getting-started.mdx): Getting started with Teleport Workload Identity for SPIFFE
+
+## Configuration Guides
+
+<TileGrid
+  tiles={[
+    {
+      icon: <Icon name="aws" size="xl" />,
+      to: "./aws-oidc-federation",
+      name: "AWS OIDC Federation",
+    },
+    {
+      icon: <Icon name="awsIdentity" size="xl" />,
+      to: "./aws-roles-anywhere",
+      name: "AWS Roles Anywhere",
+    },
+    {
+      icon: <Icon name="azure" size="xl" />,
+      to: "./azure-federated-credentials",
+      name: "Azure Federated Credentials",
+    },
+    {
+      icon: <Icon name="googleCloud" size="xl" />,
+      to: "./gcp-workload-identity-federation-jwt",
+      name: "GCP Workload Identity Federation",
+    },
+    {
+      icon: <Icon name="code" size="xl" />,
+      to: "./tsh",
+      name: "Manually issue SPIFFE SVIDs with Teleport CLI tool tsh",
+    }
+  ]}
+/>
+
+
+## Configuration management
+- [Best Practices for Teleport Workload Identity](./best-practices.mdx): Answers common questions and describes best practices for using Teleport Workload Identity in production.
+- [JWT SVIDs](./jwt-svids.mdx): An overview of the JWT SVIDs issued by Teleport Workload Identity
+- [SPIFFE Federation](./federation.mdx): An overview of the Teleport Workload Identity SPIFFE Federation feature.
+- [Workload Attestation](../../reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx): An overview of the Teleport Workload Identity Workload Attestation feature.
+- [Workload Identity Resource](../../reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx): The full reference for the Workload Identity resource.
diff --git a/docs/pages/admin-guides/migrate-plans.mdx b/docs/pages/migrate-plans.mdx
similarity index 84%
rename from docs/pages/admin-guides/migrate-plans.mdx
rename to docs/pages/migrate-plans.mdx
index e667bde1b71d4..b0bb33c2376a5 100644
--- a/docs/pages/admin-guides/migrate-plans.mdx
+++ b/docs/pages/migrate-plans.mdx
@@ -1,6 +1,9 @@
 ---
 title: Migrate Between Teleport Plans
 description: Explains how to migrate between Teleport Enterprise (Self-Hosted), Teleport Enterprise (Cloud), and Teleport Community Edition.
+tags:
+ - how-to
+ - platform-wide
 ---
 
 This guide explains how to migrate from Teleport Community Edition, Teleport
@@ -8,10 +11,10 @@ Enterprise (Self-Hosted) and Teleport Enterprise (Cloud) to another Teleport
 plan. 
 
 We recommend that you try out a Teleport [demo
-cluster](deploy-a-cluster/linux-demo.mdx) with Teleport Community Edition,
-migrate to [Teleport Enterprise (Cloud)](../get-started.mdx) to roll out
+cluster](./get-started/deploy-community.mdx) with Teleport Community Edition,
+migrate to [Teleport Enterprise (Cloud)](./get-started/deploy-cloud.mdx) to roll out
 Teleport across your organization, and deploy a
-[self-hosted](deploy-a-cluster/deploy-a-cluster.mdx) Teleport Enterprise cluster
+[self-hosted](zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx) Teleport Enterprise cluster
 if you have security and compliance requirements that Teleport Enterprise
 (Cloud) cannot address.  
 
@@ -43,10 +46,10 @@ migrating from Teleport Enterprise to Teleport Community Edition.
 - An existing Teleport cluster.
 - The `tsh` and `tctl` client tools. This guide assumes that you are using
   `tctl` to manage dynamic resources, but it is also possible to use [Teleport
-  Terraform provider](infrastructure-as-code/terraform-provider/terraform-provider.mdx) and
+  Terraform provider](zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx) and
   [Kubernetes
-  operator](infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx), in
-  addition to custom scripts that use the [Teleport API](api/api.mdx)
+  operator](zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx), in
+  addition to custom scripts that use the [Teleport API](zero-trust-access/api/api.mdx)
   to manage the Teleport Auth Service backend.
 - If you are migrating to Teleport Enterprise (Cloud), you must not have an
   account with trusted clusters enrolled. Trusted clusters are not supported in
@@ -69,7 +72,7 @@ migrating from Teleport Enterprise to Teleport Community Edition.
 1. If you are migrating to a self-hosted Teleport Enterprise account, plan and
    execute the deployment with the help of your Account Management team. To
    assist with this, read the the documentation on [Self-Hosting
-   Teleport](deploy-a-cluster/deploy-a-cluster.mdx).
+   Teleport](zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx).
 
 1. Ensure you are running Teleport Enterprise agents with versions that are
    the same major or just one major version lower than the new Teleport
@@ -84,8 +87,8 @@ migrating from Teleport Enterprise to Teleport Community Edition.
    $ tctl inventory ls --newer-than=<version>
    ```
 
-1. We recommend that Teleport Enterprise (Self-Hosted) customers set up automatic updates to maintain a healthy set of Agents, and require this in Teleport Enterprise (Cloud). See how to 
-   [Set up Automatic Agent Updates](../upgrading/agent-managed-updates.mdx) to
+1. We recommend that Teleport Enterprise (Self-Hosted) customers set up automatic updates to maintain a healthy set of Agents, and require this in Teleport Enterprise (Cloud). See how to
+   [Set up Automatic Agent Updates](upgrading/agent-managed-updates/agent-managed-updates.mdx) to
    incorporate this into your migration.
 
 
@@ -138,7 +141,7 @@ Teleport Auth Service backend. Since your original Teleport cluster uses a
 separate Auth Service backend from your new cluster, you must retrieve the
 resources on the first backend, then re-apply them against the second backend.
 
-Review the [dynamic resources](../reference/resources.mdx) list to see if any
+Review the [dynamic resources](reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx) list to see if any
 other resources need to be migrated. Some common dynamic resources includes:
 
 - `windows_desktop`
@@ -185,12 +188,12 @@ and configure a new Auth Connector in the new Teleport Enterprise tenant.
 
 ## Step 3/4. Migrate Teleport services and plugins
 
-To migrate services such as Teleport Agents, Machine ID Bots, and plugins, start
-by cataloging the various services you're managing with Teleport. The following
-resources should be considered for migration:
+To migrate services such as Teleport Agents, Machine & Workload Identity Bots,
+and plugins, start by cataloging the various services you're managing with
+Teleport. The following resources should be considered for migration:
 
  - Teleport Agents 
- - Machine ID Bots
+ - Machine & Workload Identity Bots
  - Access Request plugins
  - The Teleport Event Handler
 
@@ -206,9 +209,9 @@ carrying out the actions involved in migrating agent configurations.
 
 To migrate Teleport Agents:
 
-1. For each Agent and Machine ID Bot, obtain a valid join token. We recommend
-   using a [delegated join
-   method](../reference/join-methods.mdx).
+1. For each Agent and Machine & Workload Identity Bot, obtain a valid join
+   token. We recommend using a [delegated join
+   method](reference/deployment/join-methods.mdx).
 
 1. If using ephemeral tokens, ensure you specify the appropriate token type to
    match the Teleport services. Token types can include `node`, `app`, `kube`,
@@ -237,7 +240,7 @@ To migrate Teleport Agents:
    upgrades the `stable/rolling` channel has all released versions.
 
 
-1. If you are using Teleport Community Edition, [uninstall Teleport](./management/admin/uninstall-teleport.mdx)
+1. If you are using Teleport Community Edition, [uninstall Teleport](installation/uninstall-teleport.mdx)
    and install the enterprise edition of the `teleport` binary. You can confirm if the binary
    is correct by running `teleport version`. The output will contain the words
    `Teleport Enterprise`. The enterprise edition of the `teleport`
@@ -299,25 +302,25 @@ To migrate Teleport Agents:
    The settings for the new Teleport Kubernetes Agent should have the 
    `enterprise` value set to true.
 
-### Migrate Machine ID Bots
+### Migrate Machine & Workload Identity Bots
 
-In general, you can migrate a Machine ID Bot using the following steps:
+In general, you can migrate a Machine & Workload Identity Bot using the
+following steps:
 
 1. Obtain a new join token.
 1. In the `tbot` configuration file, edit the `proxy_server` configuration field
    to point to the new Teleport cluster address and port `443`.
 1. Restart `tbot`.
 
-To learn how to restart and configure a Machine ID Bot in your infrastructure,
-read the [full documentation](../enroll-resources/machine-id/deployment/deployment.mdx) on deploying a
-Machine ID Bot.
+To learn how to restart and configure a Bot for your infrastructure, read the
+[Machine & Workload Identity deployment guide.](machine-workload-identity/deployment/deployment.mdx)
 
 ### Access Request plugins and the Event Handler
 
 In general, you can migrate Teleport plugins using the following steps:
 
-1. If you are using Machine ID to produce credentials for the plugin,
-   reconfigure the Machine ID Bot to connect to the new Teleport cluster and
+1. If you are using Machine & Workload Identity to produce credentials for the
+   plugin, reconfigure the Bot to connect to the new Teleport cluster and
    restart the Bot.
 
    Otherwise, connect to the new Teleport cluster with `tctl` and produce an
@@ -331,8 +334,8 @@ In general, you can migrate Teleport plugins using the following steps:
 
 For specific plugins running in your infrastructure, read the full documentation
 on:
-- [Access Request plugins](access-controls/access-request-plugins/access-request-plugins.mdx)
-- The [Teleport Event Handler](management/export-audit-events/export-audit-events.mdx)
+- [Access Request plugins](identity-governance/access-requests/plugins/plugins.mdx)
+- The [Teleport Event Handler](zero-trust-access/export-audit-events/export-audit-events.mdx)
 
 ## Step 4/4. Verify end user access and performance
 
@@ -396,7 +399,7 @@ your new Teleport cluster, ensure that the setup is complete.
 
 For more information on using cloud-hosted Teleport Enterprise, refer to our
 documentation on [signing up for a cloud-hosted Teleport Enterprise
-account](../get-started.mdx).
+account](./get-started/deploy-cloud.mdx).
 
 Read the documentation on [Self-Hosting Teleport
-Enterprise](deploy-a-cluster/deploy-a-cluster.mdx).
+Enterprise](zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx).
diff --git a/docs/pages/model-context-preview.mdx b/docs/pages/model-context-preview.mdx
deleted file mode 100644
index d0ed1f43d53f0..0000000000000
--- a/docs/pages/model-context-preview.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: "Secure Agentic AI with Teleport Zero Trust Access"
-description: "Access control and audit between LLMs and data sources or MCP servers."
-h1: Secure Agentic AI with Teleport Zero Trust Access
----
-
-Secure Large Language Model (LLM) interactions with infrastructure using Teleport's secure 
-[Model Context Protocol](https://goteleport.com/use-cases/secure-model-context-protocol/) (MCP), 
-delivering fine-grained access control and audit between LLMs and data sources or MCP servers.
-
-<Admonition type="tip">
-
-MCP support is coming soon.
-
-Want to be notified when it's available? Sign up for [Early Access](https://goteleport.com/mcp-early-access/)!
-
-</Admonition>
diff --git a/docs/pages/reference/access-controls/access-controls.mdx b/docs/pages/reference/access-controls/access-controls.mdx
index bff9cc26c47bc..13fbe38e2d6c7 100644
--- a/docs/pages/reference/access-controls/access-controls.mdx
+++ b/docs/pages/reference/access-controls/access-controls.mdx
@@ -1,6 +1,18 @@
 ---
 title: Access Controls References
+sidebar_label: Access Controls
 description: Contains guides to configuring authentication and authorization in Teleport.
+tags:
+ - zero-trust
+ - privileged-access
 ---
 
+The Teleport access controls reference guides provide comprehensive information
+on configuring permissions for users to connect to infrastructure resources or
+manage your Teleport cluster. For example, you can find lists of configuration
+fields for Teleport roles, Access Lists, and Access Monitoring Rules. 
+
+If you are new to Teleport RBAC, read [Get Started with Role-Based Access
+Control](../../zero-trust-access/rbac-get-started/rbac-get-started.mdx).
+
 <DocCardList />
diff --git a/docs/pages/reference/access-controls/access-lists.mdx b/docs/pages/reference/access-controls/access-lists.mdx
index 2b1ee353d64ce..4e00abf068e22 100644
--- a/docs/pages/reference/access-controls/access-lists.mdx
+++ b/docs/pages/reference/access-controls/access-lists.mdx
@@ -1,6 +1,11 @@
 ---
 title: Access List Reference
+sidebar_label: Access Lists
 description: An explanation and overview of Access Lists in Teleport.
+tags:
+ - conceptual
+ - identity-governance
+ - privileged-access
 ---
 
 Access Lists allow Teleport users to be granted long term access to resources
@@ -44,6 +49,11 @@ Provided owners meet requirements, owners are able to do the following:
 Owners are not able to add or remove owners from an Access List or control what roles
 and traits are granted by the Access List.
 
+Access List owners are also automatically added as suggested reviewers to any
+resource-based Access Requests that include resource(-s) granted by this Access
+List. Learn more in the [Reviewing Access Requests](../../identity-governance/access-lists/reviewing-access-requests.mdx)
+guide.
+
 ## Access List Membership
 
 Access List members are Teleport users or nested Access Lists who are granted the roles
diff --git a/docs/pages/reference/access-controls/access-monitoring-events.mdx b/docs/pages/reference/access-controls/access-monitoring-events.mdx
new file mode 100644
index 0000000000000..45dfce8feeed8
--- /dev/null
+++ b/docs/pages/reference/access-controls/access-monitoring-events.mdx
@@ -0,0 +1,17 @@
+---
+title: Access Monitoring Event Reference
+sidebar_label: Access Monitoring Events
+description: Provides a comprehensive list of Access Monitoring events, their fields, and their types.
+---
+
+The Access Monitoring event reference includes a list of Access Monitoring
+events that you can query and view in reports, along with examples of `tctl`
+commands you can run to query each event.
+
+Access Monitoring tracks a subset of Teleport audit events that are relevant to
+identifying unusual access patterns. To view a comprehensive set of events,
+visit the [Investigate](../../identity-security/usage/investigate.mdx) view of
+Teleport Identity Security. For a reference of all audit events you can track
+with Teleport, see the [Audit Event Reference](../audit-events.mdx).
+
+(!docs/pages/includes/access-monitoring-events.mdx!)
diff --git a/docs/pages/reference/access-controls/access-monitoring-rules.mdx b/docs/pages/reference/access-controls/access-monitoring-rules.mdx
index 1cae7f2c6d981..3379acde229dd 100644
--- a/docs/pages/reference/access-controls/access-monitoring-rules.mdx
+++ b/docs/pages/reference/access-controls/access-monitoring-rules.mdx
@@ -1,6 +1,11 @@
 ---
 title: Access Monitoring Rule Reference
+sidebar_label: Access Monitoring Rules
 description: An explanation and overview of Access Monitoring Rules.
+tags:
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 Access Monitoring Rules allow administrators to monitor Access Requests and apply
@@ -29,12 +34,14 @@ spec:
   # monitoring rule. The condition accepts a predicate expression which must
   # evaluate to a boolean value.
   #
-  # This condition would be satisfied by an Access Request if all requested roles
-  # are either `access` or `editor`, and if the requester user has the `team: dev`
-  # or `team: stage" user trait.
+  # This condition would be satisfied if:
+  # - `access` role is requested
+  # - all requested resources have the label `env: dev`
+  # - requesting user has the `team: dev` user trait.
   condition: |-
-    contains_all(set("access", "editor"), access_request.spec.roles) &&
-    contains_any(user.traits["team"], set("dev", "stage"))
+    contains_all(set("access"), access_request.spec.roles) &&
+    access_request.spec.resource_labels_intersection["env"].contains("dev") &&
+    contains_any(user.traits["team"], set("dev"))
 
   # Optional: desired_state specifies the desired reconciled state of the Access
   # Request after the rule is applied. This field must be set to "reviewed" to
@@ -67,6 +74,29 @@ spec:
     # access monitoring rule is applied.
     recipients:
     - example@goteleport.com
+
+  # Optional: schedules defines a map of named schedules to apply to this rule.
+  schedules:
+    demo-schedule:
+      time:
+        # timezone specifies the schedule's time zone. This field is optional and
+        # defaults to "UTC". Accepted values follow the time zone identifiers defined in the
+        # IANA Time Zone Database, such as "America/Los_Angeles", "Europe/Lisbon", or
+        # "Asia/Singapore".
+        #
+        # For a list of supported values, see: https://data.iana.org/time-zones/tzdb/zone1970.tab
+        timezone: America/Los_Angeles
+
+        # shifts is a list of time blocks that make up the schedule.
+        # Each shift specifies a weekday, a start time, and an end time.
+        # Start and end times are inclusive.
+        shifts:
+        - weekday: Friday
+          start: 17:00
+          end: 23:59
+        - weekday: Saturday
+          start: 00:00
+          end: 23:59
 ```
 
 ## Notification routing rules
@@ -89,7 +119,7 @@ slack-default RUNNING
 
 If no integrations are listed, enroll a plugin first.
 For a step by step guide on how to enroll a plugin see
-[Access Request Plugins](../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+[Access Request Plugins](../../identity-governance/access-requests/plugins/plugins.mdx).
 
 ### Recipients
 
@@ -171,22 +201,97 @@ spec:
     decision: APPROVED
 ```
 
+### Example automatic review rule for resources
+
+If the following rule is configured, any Access Request for the `access` role and
+resources labeled `env: dev` will be automatically approved.
+
+```yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: env-dev-approval
+spec:
+  subjects:
+  - access_request
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    access_request.spec.resource_labels_intersection["env"].contains("dev")
+  desired_state: reviewed
+  automatic_review:
+    integration: builtin
+    decision: APPROVED
+```
+
+### Example scheduled automatic review rule
+
+If the following rule is configured, any Access Request for the `access` role and
+resources labeled `env: dev` will be automatically approved on Sundays (UTC time).
+
+```yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: env-dev-approval
+spec:
+  subjects:
+  - access_request
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    access_request.spec.resource_labels_intersection["env"].contains("dev")
+  desired_state: reviewed
+  automatic_review:
+    integration: builtin
+    decision: APPROVED
+  schedules:
+    dev-on-call:
+      time:
+        timezone: UTC
+        shifts:
+        - weekday: Sunday
+          start: 00:00
+          end: 23:59
+```
+
+### Example automatic review rule with wildcard or regular expression
+
+If the following rule is configured, any Access Request for the `access` role
+with a request reason containing phrase "on-call" will be automatically approved.
+
+```yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: on-call-automatic-approval
+spec:
+  subjects:
+  - access_request
+  condition: |-
+    regexp.match(set(access_request.spec.request_reason), "*on-call*")
+  desired_state: reviewed
+  automatic_review:
+    integration: builtin
+    decision: APPROVED
+```
+
 ## Condition
 
 The `condition` field is a predicate expression that evaluates to a boolean value
 and determines which Access Requests the rule applies to.
 
 Accepted fields within the condition predicate expression:
-| Field                                   | Description                                    |
-| --------------------------------------- | ---------------------------------------------- |
-| access_request.spec.roles               | The set of roles requested.                    |
-| access_request.spec.suggested_reviewers | The set of reviewers specified in the request. |
-| access_request.spec.system_annotations  | A map of system annotations on the request.    |
-| access_request.spec.user                | The requesting user.                           |
-| access_request.spec.request_reason      | The request reason.                            |
-| access_request.spec.creation_time       | The creation time of the request.              |
-| access_request.spec.expiry              | The expiry time of the request.                |
-| user.traits                             | A map of traits of the requesting user.        |
+| Field                                            | Description                                                         |
+| ------------------------------------------------ | ------------------------------------------------------------------- |
+| access_request.spec.roles                        | The set of roles requested.                                         |
+| access_request.spec.suggested_reviewers          | The set of reviewers specified in the request.                      |
+| access_request.spec.system_annotations           | A map of system annotations on the request.                         |
+| access_request.spec.user                         | The requesting user.                                                |
+| access_request.spec.request_reason               | The request reason.                                                 |
+| access_request.spec.creation_time                | The creation time of the request.                                   |
+| access_request.spec.expiry                       | The expiry time of the request.                                     |
+| access_request.spec.resource_labels_intersection | A map containing the intersection of all requested resource labels. |
+| access_request.spec.resource_labels_union        | A map containing the union of all requested resource labels.        |
+| user.traits                                      | A map of traits of the requesting user.                             |
 
 Examples:
 
@@ -194,7 +299,7 @@ Examples:
 # Applies if the request contains at least one role.
 condition: !is_empty(access_request.spec.roles)
 
-# Applies if created by "example_user"
+# Applies if created by "example_user".
 condition: access_request.spec.user == "example_user"
 
 # Applies if the "example_role" role is requested.
@@ -204,10 +309,19 @@ condition: access_request.spec.roles.contains("example_role")
 condition: set("role_1", "role_2").contains_all(access_request.spec.roles)
 
 # Applies if the user has trait "team: dev" or "team: stage".
-condition: contains_any(user.traits["team"], set("dev". "stage"))
+condition: contains_any(user.traits["team"], set("dev", "stage"))
+
+# Applies if all requested resources have the `env: dev` label.
+condition: access_request.spec.resource_labels_intersection["env"].contains("dev")
+
+# Applies if any requested resources has the `env: prod` label.
+condition: access_request.spec.resource_labels_union["env"].contains("prod")
+
+# Applies if the request reason contains a phrase "on-call".
+condition: regexp.match(set(access_request.spec.request_reason), "*on-call*")
 ```
 
-See [Predicate Language](../predicate-language.mdx) for more details.
+See [Predicate Language](predicate-language.mdx) for more details.
 
 ## SSO users and IdP attributes
 
@@ -253,7 +367,7 @@ spec:
 ```
 
 Trait mapping depends on the SSO provider. For configuration instructions, see:
-[Configure Single Sign-On](../../admin-guides/access-controls/sso/sso.mdx)
+[Configure Single Sign-On](../../zero-trust-access/sso/sso.mdx)
 
 ## Access Monitoring Rule with infrastructure as code
 
@@ -282,5 +396,5 @@ resource "teleport_access_monitoring_rule" "example_rule" {
 }
 ```
 
-See [Terraform Provider](../terraform-provider/resources/access_monitoring_rule.mdx)
+See [Terraform Provider](../infrastructure-as-code/terraform-provider/resources/access_monitoring_rule.mdx)
 for more details.
diff --git a/docs/pages/reference/access-controls/authentication.mdx b/docs/pages/reference/access-controls/authentication.mdx
index 52bbb18d69a64..7880f0e8190bc 100644
--- a/docs/pages/reference/access-controls/authentication.mdx
+++ b/docs/pages/reference/access-controls/authentication.mdx
@@ -1,6 +1,10 @@
 ---
 title: Authentication options
 description: A reference for Teleport's authentication connectors
+tags:
+ - reference
+ - zero-trust
+ - privileged-access
 ---
 
 Teleport authenticates users either via the Proxy Service or with an identity
@@ -20,7 +24,7 @@ possible values (types) of MFA:
   multi-factor authenticators and hardware devices.
   You can use [YubiKeys](https://www.yubico.com/), [SoloKeys](https://solokeys.com/) or any other authenticator that
   implements FIDO2 or FIDO U2F standards.
-  See our [Harden your Cluster Against IdP Compromises](../../admin-guides/access-controls/guides/webauthn.mdx) guide for detailed
+  See our [Harden your Cluster Against IdP Compromises](../../zero-trust-access/management/security/idp-compromise.mdx) guide for detailed
   instructions on setting up WebAuthn for Teleport.
 - `on` enables both TOTP and WebAuthn, and all local users are required to have at least one MFA device registered.
 - `optional` enables both TOTP and WebAuthn but makes it optional for users. Local users that register a MFA device will
@@ -174,7 +178,7 @@ spec:
 version: v2
 ```
 
-See [GitHub OAuth 2.0](../../admin-guides/access-controls/sso/github-sso.mdx) for details on how to configure it.
+See [GitHub OAuth 2.0](../../zero-trust-access/sso/integrate-idp/github-sso.mdx) for details on how to configure it.
 
 ### SAML
 
@@ -222,7 +226,7 @@ auth_service:
     type: github
 ```
 
-See [GitHub OAuth 2.0](../../admin-guides/access-controls/sso/github-sso.mdx) for details on how to configure it.
+See [GitHub OAuth 2.0](../../zero-trust-access/sso/integrate-idp/github-sso.mdx) for details on how to configure it.
 
 ### SAML
 
@@ -264,7 +268,7 @@ auth_service:
     type: github
 ```
 
-See [GitHub OAuth 2.0](../../admin-guides/access-controls/sso/github-sso.mdx) for details on how to configure it.
+See [GitHub OAuth 2.0](../../zero-trust-access/sso/integrate-idp/github-sso.mdx) for details on how to configure it.
 
 </TabItem>
 </Tabs>
diff --git a/docs/pages/reference/access-controls/login-rules.mdx b/docs/pages/reference/access-controls/login-rules.mdx
index fdf24fe1efe45..99f9e0c5a1d8a 100644
--- a/docs/pages/reference/access-controls/login-rules.mdx
+++ b/docs/pages/reference/access-controls/login-rules.mdx
@@ -1,12 +1,17 @@
 ---
 title: Login Rules Reference 
+sidebar_label: Login Rules
 description: Reference documentation for Login Rules
-tocDepth: 3
+tags:
+ - sso
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 This page provides details on the expression language that powers Login Rules.
 To learn how to add the first login rule to your cluster, checkout out the
-[Login Rules Guide](../../admin-guides/access-controls/login-rules/guide.mdx).
+[Login Rules Guide](../../zero-trust-access/sso/login-rules/guide.mdx).
 
 ## YAML specification
 
@@ -789,3 +794,53 @@ Expression | Result
 ---------- | ------
 `union(set("a"), set("b"))` | `("a", "b")`
 `union(set("a", "b"), set("b", "c"))` | `("a", "b", "c")`
+
+
+### `jsonpath`
+
+#### Signature
+
+```go
+func jsonpath(path string) set
+```
+
+#### Description
+
+`jsonpath` returns a new [`set`](#set-type) interpolated from the user's original IdP
+claims using the given [jsonpath query](https://support.smartbear.com/alertsite/docs/monitors/api/endpoint/jsonpath.html).
+This is intended for use with traditionally unmapped arbitrary JSON claims which are
+used in some custom OIDC solutions.
+
+See [this guide](../../zero-trust-access/sso/login-rules/guide.mdx#using-an-oidc-provider-with-arbitrary-non-standard-json-claims) for more context.
+
+#### Arguments
+
+Argument | Type | Description
+-------- | ---- | -----------
+`path` | `string` | A jsonpath query.
+
+#### Returns
+
+Type | Description
+---- | ----------
+`set` | A new `set` containing the interpolated values.
+
+#### Examples
+
+The examples below operates on the given IdP claims object.
+```json
+{
+  // normal claim - string list
+  "a": ["1", "2", "3"],
+  // unmapped claim - arbitrary object
+  "b": {
+    "c": "d"
+  }
+}
+```
+
+Expression | Result
+---------- | ------
+`jsonpath("$.a")`   | `("1", "2", "3")`
+`jsonpath("$.b.*")` | `("d")`
+`jsonpath("$.*.*")` | `("1", "2", "3", "d")`
diff --git a/docs/pages/reference/access-controls/predicate-language.mdx b/docs/pages/reference/access-controls/predicate-language.mdx
new file mode 100644
index 0000000000000..0110260aef4ec
--- /dev/null
+++ b/docs/pages/reference/access-controls/predicate-language.mdx
@@ -0,0 +1,164 @@
+---
+title: Predicate Language
+description: How to use Teleport's predicate language to define filter conditions.
+tags:
+ - conceptual
+ - zero-trust
+---
+
+Teleport's predicate language is used to define conditions for filtering in dynamic configuration resources.
+It is also used as a query language to filter and search through a [list of select resources](#resource-filtering).
+
+The predicate language uses a slightly different syntax depending on whether it is used in:
+
+- [Role resources](#scoping-allowdeny-rules-in-role-resources)
+- [Resource filtering](#resource-filtering)
+- [Label expressions](#label-expressions)
+- [Access Monitoring Rules](#access-monitoring-rules)
+
+## Scoping allow/deny rules in role resources
+
+Some fields in Teleport's role resources use the predicate language to define
+the scope of a role's permissions:
+
+- [Dynamic Impersonation](../../zero-trust-access/authentication/impersonation.mdx)
+- [RBAC for sessions](roles.mdx)
+
+When used in role resources, the predicate language supports the following operators:
+
+| Operator | Meaning                                          | Example                                                  |
+|----------|--------------------------------------------------|----------------------------------------------------------|
+| &&       | and (all conditions must match)                  | `contains(field1, field2) && equals(field2, "val")`      |
+| \|\|     | or  (any one condition should match)             | `contains(field1, field2) \|\| contains(field1, "val2")` |
+| !        | not (used with functions, more about this below) | `!equals(field1, field2)`                                |
+
+The language also supports the following functions:
+
+| Functions                      | Description                                                                           |
+|--------------------------------|---------------------------------------------------------------------------------------|
+| `contains(<field>, <field2>)`  | checks if the value from `<field2>` is included in the list of strings from `<field>` |
+| `contains(<field>, "<value>")` | checks if `<value>` is included in the list of strings from `<field>`                 |
+| `equals(<field>, <field2>)`    | checks if the value from `<field2>` is equal to the value from `<field>`              |
+| `equals(<field>, "<value>")`   | checks if `<value>` is equal to the value from `<field>`                              |
+
+## Resource filtering
+
+Both the [`tsh`](../cli/tsh.mdx) and [`tctl`](../cli/tctl.mdx) CLI tools allow you to filter nodes,
+applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to
+perform more sophisticated searches using the predicate language.
+
+For common resource fields, we defined shortened field names that can easily be accessed by:
+
+| Short Field       | Actual Field Equivalent                                                                | Example                      |
+|-------------------|----------------------------------------------------------------------------------------|------------------------------|
+| `labels["<key>"]` | `resource.metadata.labels` + `resource.spec.dynamic_labels`                            | `labels["env"] == "staging"` |
+| `name`            | `resource.spec.hostname` (only applies to server resource) or `resource.metadata.name` | `name == "jenkins"`          |
+
+The language supports the following operators:
+
+| Operator | Meaning                              | Example                                                |
+|----------|--------------------------------------|--------------------------------------------------------|
+| ==       | equal to                             | `labels["env"] == "prod"` or ``labels[`env`] == "prod"`` |
+| !=       | not equal to                         | `labels["env"] != "prod"`                              |
+| &&       | and (all conditions must match)      | `labels["env"] == "prod" && labels["os"] == "mac"`     |
+| \|\|     | or  (any one condition should match) | `labels["env"] == "dev" \|\| labels["env"] == "qa"`    |
+| !        | not (used with functions)            | `!equals(labels["env"], "prod")`                       |
+
+The language also supports the following functions:
+
+| Functions (with examples)                    | Description                                                |
+|----------------------------------------------|------------------------------------------------------------|
+| `equals(labels["env"], "prod")`              | resources with label key `env` equal to label value `prod` |
+| `exists(labels["env"])`                      | resources with a label key `env`; label value unchecked    |
+| `!exists(labels["env"])`                     | resources without a label key `env`; label value unchecked |
+| `search("foo", "bar", "some phrase")`        | fuzzy match against common resource fields                 |
+| `hasPrefix(name, "foo")`                     | resources with a name that starts with the prefix `foo`    |
+| `split(labels["foo"], ",")`                  | converts a delimited string into a list                    |
+| `contains(split(labels["foo"], ","), "bar")` | determines if a value exists in a list                     |
+
+See some [examples](../cli/cli.mdx) of the different ways you can filter resources.
+
+## Label expressions
+
+Label expressions can be used in Teleport roles to define access to resources
+with custom logic.
+Check out the Access Controls
+[reference page](roles.mdx)
+for an overview of label expressions and where they can be used.
+
+Label expressions support a predicate language with the following fields
+available:
+
+| Field              | Type                    | Description |
+|--------------------|-------------------------|-------------|
+| `labels`           | `map[string]string`     | Combined static and dynamic labels of the resource (server, application, etc.) being accessed. |
+| `user.spec.traits` | `map[string][]string`   | All traits of the user accessing the resource (referred to as `external` or `internal` in role template expressions). |
+
+The language supports the following operators:
+
+| Operator | Meaning                             | Example |
+|----------|-------------------------------------|---------|
+| ==       | equal to                            | `labels["env"] == "staging"` |
+| !=       | not equal to                        | `labels["env"] != "production"` |
+| \|\|     | or (any one condition should match) | `labels["env"] == "staging" \|\| labels["env"] == "test"` |
+| &&       | and (all conditions must match)     | `labels["env"] == "staging" && labels["team"] == "dev"` |
+| !        | not (logical negation)              | `!regexp.match(user.spec.traits["teams"], "contractor")` |
+
+The language also supports the following functions:
+
+| Syntax | Return type | Description | Example |
+|--------|-------------|-------------|---------|
+| `contains(list, item)` | Boolean | Returns true if `list` contains an exact match for `item` | `contains(user.spec.traits[teams], labels["team"])` |
+| `regexp.match(list, re)` | Boolean | Returns true if `list` contains a match for `re` | `regexp.match(labels["team"], "dev-team-\d+$")` |
+| `regexp.replace(list,` `re, replacement)` | `[]string` | Replaces all matches of `re` with replacement for all items in `list` | `contains(regexp.replace(user.spec.traits["allowed-env"],` `"^env-(.*)$", "$1"), labels["env"])` |
+| `email.local(list)` | `[]string` | Returns the local part of each email in `list`, or an error if any email fails to parse | `contains(email.local(user.spec.traits["email"]),` `labels["owner"])` |
+| `strings.upper(list)` | `[]string` | Converts all items of the list to uppercase | `contains(strings.upper(user.spec.traits["username"]),` `labels["owner"])` |
+| `strings.lower(list)` | `[]string` | Converts all items of the list to lowercase | `contains(strings.lower(user.spec.traits["username"]),` `labels["owner"])` |
+| `labels_matching(re)` | `[]string` | Returns the aggregate of all label values with keys matching `re`, which can be a glob or a regular expression | `contains(labels_matching("^project-(team\|label)$"),` `"security")` |
+| `contains_any(list, items)` | Boolean | Returns true if `list` contains an exact match for any element of `items` | `contains_any(user.spec.traits["projects"],` `labels_matching("project-*"))` |
+| `contains_all(list, items)` | Boolean | Returns true if `list` contains an exact match for all elements of `items` | `contains_all(user.spec.traits["projects"],` `labels_matching("project-*"))` |
+
+Above, any argument named `list` can accept a list of values (like the list of
+values for a specific user trait) or a single value (like the value of a
+resource label or a string literal).
+
+## Access Monitoring Rules
+
+Access Monitoring Rules use the predicate language to define conditions for
+applying notification routing rules or automatic review rules to Access Requests.
+
+Access Monitoring Rules support a predicate language with the following fields
+available:
+
+| Field                                            | Description                                                         |
+| ------------------------------------------------ | ------------------------------------------------------------------- |
+| access_request.spec.roles                        | The set of roles requested.                                         |
+| access_request.spec.suggested_reviewers          | The set of reviewers specified in the request.                      |
+| access_request.spec.system_annotations           | A map of system annotations on the request.                         |
+| access_request.spec.user                         | The requesting user.                                                |
+| access_request.spec.request_reason               | The request reason.                                                 |
+| access_request.spec.creation_time                | The creation time of the request.                                   |
+| access_request.spec.expiry                       | The expiry time of the request.                                     |
+| access_request.spec.resource_labels_intersection | A map containing the intersection of all requested resource labels. |
+| access_request.spec.resource_labels_union        | A map containing the union of all requested resource labels.        |
+| user.traits                                      | A map of traits of the requesting user.                             |
+
+The language supports the following operators:
+
+| Operator | Meaning                              | Example                                                |
+|----------|--------------------------------------|--------------------------------------------------------|
+| ==       | equal to                             | `access_request.spec.user == "example_user"`           |
+| !=       | not equal to                         | `access_request.spec.user != "example_user"`           |
+| &&       | and (all conditions must match)      | `regexp.match(user.traits["level"], "^L1$") && regexp.match(user.traits["team"], "^Cloud$")` |
+| \|\|     | or  (any one condition should match) | `regexp.match(user.traits["level"], "^L1$") \|\| regexp.match(user.traits["team"], "^Cloud$")` |
+| !        | not (used with functions)            | `!regexp.match(set(access_request.spec.request_reason), "*important*")` |
+
+The language also supports the following functions:
+
+| Functions | Description | Example |
+|-----------|-------------|---------|
+| `contains_any(set, items)` | Returns true if `set` contains an exact match for any element of `items` | `contains_any(user.traits["team"], set("dev", "stage"))` |
+| `contains_all(set, items)` | Returns true if `set` contains an exact match for all elements of `items` | `contains_all(set("dev"), access_request.spec.roles)` |
+| `set.contains(item)` | Returns true if `set` contains an exact match for `item` | `access_request.spec.roles.contains("example_role")` |
+| `regexp.match(set, re)` | Returns true if `set` contains a match for `re` | `regexp.match(set(access_request.spec.request_reason), "*on-call*")` |
+| `is_empty(set)`| Returns true if `set` contains no elements | `is_empty(access_request.spec.roles)` |
diff --git a/docs/pages/reference/access-controls/roles.mdx b/docs/pages/reference/access-controls/roles.mdx
index f228d26f15ea1..b421a205f7fbb 100644
--- a/docs/pages/reference/access-controls/roles.mdx
+++ b/docs/pages/reference/access-controls/roles.mdx
@@ -1,7 +1,11 @@
 ---
-title: Access Controls Reference
+title: Teleport Role Reference
+sidebar_label: Roles
 description: Explains the configuration settings that you can include in a Teleport role, which enables you to apply access controls for your infrastructure.
-tocDepth: 3
+tags:
+ - reference
+ - zero-trust
+ - privileged-access
 ---
 
 This guide shows you how to use Teleport roles to manage role-based access
@@ -20,10 +24,10 @@ resources:
 - The `tctl` client tool
 - Teleport Terraform provider
 - Teleport Kubernetes operator
-- [Custom API clients](../../admin-guides/api/rbac.mdx)
+- [Custom API clients](../../zero-trust-access/api/rbac.mdx)
 
 To read more about managing dynamic resources, see the [Dynamic
-Resources](../../admin-guides/infrastructure-as-code/infrastructure-as-code.mdx) guide.
+Resources](../../zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx) guide.
 
 You can view all roles in your cluster on your local workstation by running the
 following commands:
@@ -59,7 +63,7 @@ user:
 | `max_sessions` | Total number of session channels which can be established across a single SSH connection via Teleport | The lowest value takes precedence. |
 | `enhanced_recording` | Indicates which events should be recorded by the BFP-based session recorder | |
 | `permit_x11_forwarding` | Allow users to enable X11 forwarding with OpenSSH clients and servers | |
-| `device_trust_mode` | Enforce authenticated device access for users assigned this role (`required`, `optional`, `off`). Applies only to the resources in the roles' allow field. | |
+| `device_trust_mode` | Enforce authenticated device access for users assigned this role (`required`, `required-for-humans`, `optional`, `off`). Applies only to the resources in the roles' allow field. | |
 | `require_session_mfa` | Enforce per-session MFA or PIV-hardware key restrictions on user login sessions (`no`, `yes`, `hardware_key`, `hardware_key_touch`). Applies only to the resources in the roles' allow field. | For per-session MFA, Logical "OR" i.e. evaluates to "yes" if at least one role requires session MFA |
 | `mfa_verification_interval` | Define the maximum duration that can elapse between successive MFA verifications  | The shortest interval wins |
 | `lock` | Locking mode (`strict` or `best_effort`) | `strict` wins in case of conflict |
@@ -67,9 +71,10 @@ user:
 | `request_prompt` | Prompt for the Access Request "reason" field | |
 | `max_connections` | Enterprise-only limit on how many concurrent sessions can be started via Teleport | The lowest value takes precedence. |
 | `max_kubernetes_connections` | Defines the maximum number of concurrent Kubernetes sessions per user | |
-| `record_session` |Defines the [Session recording mode](../monitoring/audit.mdx).|The strictest value takes precedence.|
+| `record_session` |Defines the [Session recording mode](../deployment/monitoring/audit.mdx).|The strictest value takes precedence.|
 | `desktop_clipboard` | Allow clipboard sharing for desktop sessions | Logical "AND" i.e. evaluates to "yes" if all roles enable clipboard sharing |
 | `desktop_directory_sharing` | Allows sharing local workstation directory to remote desktop | Logical "AND" i.e. evaluates to "yes" if all roles enable directory sharing |
+| `create_desktop_user` | Allows [desktop auto user creation](../../enroll-resources/desktop-access/reference/user-creation.mdx) on a local Windows desktop. |  Logical "AND" i.e. for all roles matching a desktop resource. If all roles that allow access to the resource are set to `true` that will allow user creation. If any are set to `false` user auto creation will be denied. |
 | `pin_source_ip` | Enable source IP pinning for SSH certificates. | Logical "OR" i.e. evaluates to "yes" if at least one role requires session termination |
 | `cert_extensions` | Specifies extensions to be included in SSH certificates | |
 | `create_host_user_mode` | Allow users to be automatically created on a host |  Logical "AND" i.e. if all roles matching a server specify host user creation (`off`, `keep`, `insecure-drop`), it will evaluate to the option specified by all of the roles. If some roles specify both `insecure-drop` or `keep` it will evaluate to `keep`|
@@ -88,7 +93,7 @@ There are currently six supported role versions: `v3`, `v4`, `v5`, `v6`, `v7`, a
 `v4` and higher roles are completely backwards compatible with `v3`. The only difference
 lies in the default values which will be applied to the role if they are not explicitly set.
 Additionally, roles with version `v5` or higher do not allow joining sessions by default. The
-[Joining Sessions](../../admin-guides/access-controls/guides/joining-sessions.mdx) configuration in roles 'v5` or higher
+[Joining Sessions](../../zero-trust-access/authentication/joining-sessions.mdx) configuration in roles 'v5` or higher
 must be set to allow for joining sessions.
 
 Label              | `v3` Default   | `v4` and higher Default
@@ -101,21 +106,33 @@ Label              | `v3` Default   | `v4` and higher Default
 Role `v6` introduced a new field `kubernetes_resources` that allows
 fine-grained control over Kubernetes resources. See [Kubernetes RBAC](../../enroll-resources/kubernetes-access/controls.mdx) for more details.
 
+Role `v7` added support for more `kind` values in the `kubernetes_resources` field.
+
+Role `v8` added support for Kubernetes CRDs and introduced changes for how `kubernetes_resources` behave and are defined.
+
+See [Kubernetes Resources](../../enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources) for more details about the difference between versions.
+
+#### Default values for `kubernetes_resources`
+
+The default value for `kubernetes_resources` is applied when there is a label set to
+allow access to a Kubernetes cluster.
+
 Version              |  `kubernetes_resources`
 ------------------ | --------------
-`v3`, `v4` and `v5` Default | `[{"kind":"pod", "name":"*", "namespace":"*", "verbs": ["*"]}]`
-`v6` Default |  `[]`
-`v7` Default |  `[{"kind":"*", "name":"*", "namespace":"*", "verbs": ["*"]}]`
+`v3`, `v4` and `v5` | `[{"kind":"pod","name":"*","namespace":"*","verbs":["*"]}]`
+`v6` |  `[]`
+`v7` |  `[{"kind":"*","name":"*","namespace":"*","verbs":["*"]}]`
+`v8` |  `[{"kind":"*","api_group":"*","name":"*","namespace":"*","verbs":["*"]},{"kind":"*","api_group":"*","name":"*","namespace":"","verbs":["*"]}]`
 
 SAML IdP role option `spec.idp.saml.enabled: true/false` is only supported in role version 7 and below.
-There are further changes to the `saml_idp_service_provider` resource RBAC starting role `v8`. 
+There are further changes to the `saml_idp_service_provider` resource RBAC starting role `v8`.
 See [SAML IdP RBAC](./saml-idp.mdx#RBAC) for more details.
 
 ## RBAC for infrastructure resources
 
 A Teleport role defines which resources (e.g., applications, servers, and
 databases) a user can access.
-This works by [labeling resources](../../admin-guides/management/admin/labels.mdx) and
+This works by [labeling resources](../../zero-trust-access/rbac-get-started/labels.mdx) and
 configuring allow/deny labels in a role definition.
 
 Consider the following use case:
@@ -235,7 +252,7 @@ conditions:
 - `workload_identity_labels_expression`
 
 Check out our
-[predicate language](../predicate-language.mdx)
+[predicate language](predicate-language.mdx)
 guide for a more in depth explanation of the language.
 
 Typically you will only want to use one of `<kind>_labels` or
@@ -264,7 +281,10 @@ allow:
 ```
 
 If this rule was declared in the `deny` section of a role definition, it would
-prohibit users from getting a list of active sessions. You can see all of the
+prohibit users from getting a list of active sessions. If a role does not allow
+access to list a resource, the user will not be able to view it in the Web UI
+or remotely with `tctl`.  The only exception is that a user can always view their 
+assigned roles and their own user information with `tctl`.  You can see all of the
 available resources and verbs under the `allow` section in the example role
 configuration below.
 
@@ -356,13 +376,15 @@ an administrative role. In particular, you should avoid configuring `allow` rule
 that grant `create` and `update` permissions on `token` resources to prevent
 unexpected changes to the configuration or state of your cluster.
 
-## RBAC for sessions
+## RBAC for session recordings
 
 It is possible to further limit access to
-[shared sessions](../../connect-your-client/tsh.mdx) and
 [session recordings](../architecture/session-recording.mdx).
-The examples below illustrate how to restrict session access only for the user
-who created the session.
+
+The `where` field in RBAC rules provides powerful filtering capabilities,
+allowing you to restrict access to session recordings based on user traits
+and resource metadata. This enables fine-grained control over who can view
+recordings based on contextual information.
 
 <Admonition
   type="warning"
@@ -373,24 +395,272 @@ have a more permissive role, like the preset `auditor` role, which allows access
 to all events, sessions, and session recordings.
 </Admonition>
 
-Role for restricted access to session recordings:
+### Understanding the `where` clause
+
+The `where` clause acts as a condition that must evaluate to true for access to be
+granted. It uses predicate expressions that can reference:
+
+- Attributes of the authenticated user (name, roles, traits)
+- Metadata about the session recording (participants, proto, creator, etc.)
+- Resource-specific attributes (server details, database info, etc.)
+
+Basic syntax example:
+
+```
+where: contains(session.participants, user.metadata.name)
+```
+
+This expression evaluates to true only when the current user is found in the session's
+participants list.
+
+
+### Common Access Control Recipes
+
+Here are practical examples of how to use `where` expressions to implement common access control patterns:
+
+#### Restrict to Session Participants
+
+Allow users to view only recordings of sessions they participated in:
 
 ```yaml
-version: v5
+version: v8
 kind: role
 metadata:
   name: only-own-sessions
 spec:
   allow:
     rules:
-    # Users can only view session recordings for sessions in which they
-    # participated.
     - resources: [session]
       verbs: [list, read]
       where: contains(session.participants, user.metadata.name)
 ```
 
-Role for restricted access to active sessions:
+#### Restrict by User Role
+
+Allow access only to users that share a role with the session creator:
+
+```yaml
+version: v8
+kind: role
+metadata:
+  name: sessions-viewer
+spec:
+  allow:
+    rules:
+    - resources: [session]
+      verbs: [list, read]
+      where: contains_any(user.spec.roles, session.user_roles)
+```
+
+#### Restrict by Team Trait
+
+Allow members of the same team to view each other's sessions:
+
+```yaml
+version: v8
+kind: role
+metadata:
+  name: team-sessions-viewer
+spec:
+  allow:
+    rules:
+    - resources: [session]
+      verbs: [list, read]
+      where: contains_any(session.user_traits["team"], user.spec.traits["team"])
+```
+
+#### Restrict by Session participants
+
+Allow viewing only sessions where the user participated:
+
+```yaml
+version: v5
+kind: role
+metadata:
+  name: own-sessions
+spec:
+  allow:
+    rules:
+    - resources: [session]
+      verbs: [list, read]
+      where: contains(session.participants, user.metadata.name)
+```
+
+#### Restrict by Resource Type
+
+Allow viewing only SSH session recordings:
+
+```yaml
+version: v5
+kind: role
+metadata:
+  name: ssh-sessions-only
+spec:
+  allow:
+    rules:
+    - resources: [session]
+      verbs: [list, read]
+      where: session.proto == "ssh"
+```
+
+#### Combine Multiple Conditions
+
+This rule allows users to view SSH session recordings only if they were a participant OR the node is owned by his team.
+
+```yaml
+version: v5
+kind: role
+metadata:
+  name: complex-sessions-access
+spec:
+  allow:
+    rules:
+    - resources: [session]
+      verbs: [list, read]
+      where: >
+        (contains(session.participants, user.metadata.name) || 
+         contains(user.spec.traits["team"], session.server_labels["team"])) && 
+        session.proto == "ssh"
+```
+
+By leveraging these where expressions, you can implement access control policies that
+match your organization's security requirements while still allowing appropriate visibility for auditing and
+monitoring purposes.
+
+### Filter fields
+
+The `where` field in a rule allows you to filter access to resources based on
+user traits and resource metadata.
+
+#### User fields
+
+The following user fields can be used in `where` expressions to filter access.
+The `user` object represents the authenticated user making the request to
+access the session recording.
+
+| User Field | Description | Type |
+|---|---|---|
+| `user.metadata.name` | The name of the user. | `string` |
+| `user.spec.traits` | The traits assigned to the user. | `dict<string, array<string>>` |
+| `user.spec.roles` | The roles assigned to the user. | `array<string> `|
+
+
+#### Session fields
+
+<Admonition
+  type="warning"
+  title="Session fields are immutable">
+
+Session fields are immutable and capture the state of the session at the moment it
+was created.
+
+If the underlying resource changes (e.g., server labels), these fields will not be
+updated, and the session’s RBAC will not reflect the changes.
+
+</Admonition>
+
+The following session fields can be used in `where` expressions to filter access.
+The `session` object represents the session resource being accessed.
+It contains metadata about the session, including the participants, proto,
+resource type and the session creator (user who initiated the session) roles and traits.
+
+| Session Field | Description | Type |
+|---|---|---|
+| `session.id` | The unique identifier of the session. | `string` |
+| `session.kind` | The kind of session (e.g., "ssh", "kube", "db", "rdp"). | `string` |
+| `session.participants` | The list of users who participated in the session. | `array<string>` |
+| `session.proto` | The proto used for the session (e.g., "ssh", "kube", "db", "rdp"). | `string` |
+| `session.user` | The user who initiated the session. | `string` |
+| `session.user_roles` | The roles assigned to the user who initiated the session. | `array<string>` |
+| `session.user_traits` | The traits assigned to the user who initiated the session. | `dict<string, array<string>>` |
+
+Depending on the session kind, additional session fields are available for filtering.
+
+<Tabs>
+<TabItem value="SSH Sessions" label="SSH Sessions">
+
+The following server session fields can also be used in `where` expressions to filter access
+for SSH sessions together with the user and session fields above.
+
+| Server Session Field | Description | Type |
+|---|---|---|
+| `session.server_id` | The unique identifier of the server where the session took place. | `string` |
+| `session.server_hostname` | The hostname of the server where the session took place. | `string` |
+| `session.server_labels` | The labels assigned to the server where the session took place. | `dict<string, string>` |
+| `session.server_addr` | The address of the server where the session took place. | `string` |
+| `session.login` | The username used to log in to the server during the session. |`string` |
+
+</TabItem>
+<TabItem value="Kubernetes Sessions" label="Kubernetes Sessions">
+
+The following Kubernetes session fields can be used in `where` expressions to filter access
+for Kubernetes sessions together with the user and session fields above.
+
+| Kubernetes Session Field | Description | Type |
+|---|---|---|
+| `session.kubernetes_cluster` | The name of the Kubernetes cluster where the session took place. | `string` |
+| `session.kubernetes_labels` | The labels assigned to the Kubernetes cluster where the session took place. | `dict<string, string>` |
+| `session.kubernetes_user` | The Kubernetes user used in the session. | `string` |
+| `session.kubernetes_groups` | The Kubernetes groups used in the session. | `array<string>` |
+| `session.kubernetes_pod_namespace` | The namespace in the Kubernetes cluster where the session took place. | `string` |
+| `session.kubernetes_pod_name` | The name of the pod in the Kubernetes cluster where the session took place. | `string` |
+| `session.kubernetes_container_name` | The name of the container in the Kubernetes cluster where the session took place. | `string` |
+
+</TabItem>
+<TabItem value="Database Sessions" label="Database Sessions">
+
+The following database session fields can be used in `where` expressions to filter access
+for database sessions together with the user and session fields above.
+
+| Database Session Field | Description | Type |
+|---|---|---|
+| `session.db_service` | The name of the database service where the session took place. | `string` |
+| `session.db_protocol` | The protocol used to connect to the database (e.g., "postgres", "mysql"). | `string` |
+| `session.db_uri` | The URI of the database where the session took place. | `string` |
+| `session.db_name` | The name of the database accessed during the session. | `string` |
+| `session.db_user` | The database user used during the session. | `string` |
+| `session.db_labels` | The labels assigned to the database where the session took place. | `dict<string, string>` |
+| `session.db_type` | The type of the database (e.g., "postgres", "mysql"). | `string` |
+
+</TabItem>
+<TabItem value="Windows Desktop Sessions" label="Windows Desktop Sessions">
+
+The following Windows Desktop session fields can be used in `where` expressions to filter access
+for Windows Desktop sessions together with the user and session fields above.
+
+| Windows Desktop Session Field | Description | Type |
+|---|---|---|
+| `session.windows_desktop_service` | The name of the Windows Desktop service where the session took place. | `string` |
+| `session.desktop_addr` | The address of the Windows desktop where the session took place. | `string` |
+| `session.desktop_name` | The name of the Windows desktop where the session took place. | `string` |
+| `session.domain` | The domain of the Windows desktop where the session took place. | `string` |
+| `session.windows_user` | The username used to log in to the Windows desktop during the session. | `string` |
+| `session.desktop_labels` | The labels assigned to the Windows desktop where the session took place. | `dict<string, string>` |
+
+</TabItem>
+</Tabs>
+
+### Functions
+
+You can use the following functions in `where` expressions to filter access to
+session recordings:
+
+| Function | Signature |Description |
+|---|---|---|
+| `contains` | `contains(array<string>, string) -> bool` | Returns true if the array contains the specified value. |
+| `contains_any` | `contains_any(array<string>, array<string>) -> bool` | Returns true if the two arrays have any elements in common. |
+| `contains_all` | `contains_all(array<string>, array<string>) -> bool` | Returns true if the first array contains all elements of the second array. |
+| `can_view` | `can_view() -> bool` | Returns true if the user can view the SSH Node, Kubernetes Cluster, Database or Windows machine in Teleport. |
+| `equals` | `equals(array<string>, array<string>) -> bool` | Returns true if the two strings or two arrays are equal. |
+| `set` | `set(string,string...) -> array<string>` | Converts one or multiple strings into an array. |
+
+
+## RBAC for active sessions
+
+It is possible to further limit access to
+[shared sessions](../../connect-your-client/teleport-clients/tsh.mdx).
+The example below illustrates how to restrict access to active SSH sessions
+only for the user who created the session.
 
 ```yaml
 version: v5
@@ -419,7 +689,7 @@ spec:
 The following role fields configure Access Requests. For a full description of
 Access Request configuration fields and their relationship to one another, see
 the [Access Request configuration
-guide](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx).
+guide](../../identity-governance/access-requests/access-request-configuration.mdx).
 
 ### Creating Access Requests
 
@@ -428,14 +698,14 @@ Requests. The `request` field can fall under both `spec.allow` and `spec.deny`:
 
 |Role Field|Description|Further Information|
 |---|---|---|
-| `request.roles` |Teleport roles that a user can or cannot request|[Restrict role requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-role-requests)|
-| `request.claims_to_roles`|Teleport roles that a user can or cannot access based on their traits.|[Restrict role requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-role-requests)|
-| `request.search_as_roles`|Teleport roles that a user can or cannot assume while searching for resources to request access to.|[Restrict resource requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-resource-requests)|
-| `request.max_duration`|The maximum duration of elevated privileges if an Access Request were granted. | [How long access lasts](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-long-access-lasts) |
-| `request.reason`|Configures the behavior of Access Request reasons. | [Requiring request reasons](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#requiring-request-reasons) | 
-| `request.thresholds`|Configures the criteria that an Access Request must meet.| [Review thresholds](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#review-thresholds) |
-| `request.suggested_reviewers`|Reviewers to add to an Access Request by default.| [Suggested reviewers](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#suggested-reviewers)|
-| `request.annotations`|Arbitrary data to write (or prevent writing) to an Access Request|[Request annotations](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#request-annotations)|
+| `request.roles` |Teleport roles that a user can or cannot request|[Restrict role requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.claims_to_roles`|Teleport roles that a user can or cannot access based on their traits.|[Restrict role requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.search_as_roles`|Teleport roles that a user can or cannot assume while searching for resources to request access to.|[Restrict resource requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.max_duration`|The maximum duration of elevated privileges if an Access Request were granted. | [How long access lasts](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.reason`|Configures the behavior of Access Request reasons. | [Requiring request reasons](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.thresholds`|Configures the criteria that an Access Request must meet.| [Review thresholds](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.suggested_reviewers`|Reviewers to add to an Access Request by default.| [Suggested reviewers](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.annotations`|Arbitrary data to write (or prevent writing) to an Access Request|[Request annotations](../../identity-governance/access-requests/access-request-configuration.mdx)|
 
 ### Reviewing Access Requests
 
@@ -444,10 +714,10 @@ Requests, and like `request`, can fall under `allow` or `deny`:
 
 |Role Field|Description|Further Information|
 |---|---|---|
-|`review_requests.roles`|Allows or denies the ability to review requests for particular roles.|[Reviews for specific roles](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#allowing-and-denying-reviews-for-specific-roles)|
-|`review_requests.where`|Configures conditions in which a user with the role may review an Access Request|[`where` expressions](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#where-expressions)|
-|`review_requests.preview_as_roles`|Allows or denies the ability to list resources that a user with the requested role can access|[Inspecting requested resources](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#inspecting-requested-resources)|
-|`review_requests.claims_to_roles`|Teleport roles that a user can or cannot review requests for based on their traits.|[Reviews for specific roles](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#allowing-and-denying-reviews-for-specific-roles)|
+|`review_requests.roles`|Allows or denies the ability to review requests for particular roles.|[Reviews for specific roles](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.where`|Configures conditions in which a user with the role may review an Access Request|[`where` expressions](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.preview_as_roles`|Allows or denies the ability to list resources that a user with the requested role can access|[Inspecting requested resources](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.claims_to_roles`|Teleport roles that a user can or cannot review requests for based on their traits.|[Reviews for specific roles](../../identity-governance/access-requests/access-request-configuration.mdx)|
 
 ### Client options
 
@@ -455,8 +725,8 @@ The `options` field, a property of `spec`, applies additional settings:
 
 |Role Field|Description|Further Information|
 |---|---|---|
-|`options.request_access`|Configures Teleport client behavior for creating Access Requests|[How clients request access](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-clients-request-access)|
-|`options.request_prompt`|Configures the prompt that Teleport clients display when a user requests access|[How clients request access](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-clients-request-access)|
+|`options.request_access`|Configures Teleport client behavior for creating Access Requests|[How clients request access](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`options.request_prompt`|Configures the prompt that Teleport clients display when a user requests access|[How clients request access](../../identity-governance/access-requests/access-request-configuration.mdx)|
 
 ## Role templates
 
@@ -483,14 +753,14 @@ Labels for resources enrolled with Teleport:
 
 |Role Field|Teleport Resource|
 |---|---|
-|`app_labels`|[Applications](../../enroll-resources/application-access/controls.mdx)|
-|`cluster_labels`|[Trusted Clusters](../../admin-guides/management/admin/trustedclusters.mdx)|
+|`app_labels`|[Applications](../../enroll-resources/application-access/configuration/controls.mdx)|
+|`cluster_labels`|[Trusted Clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx)|
 |`db_labels`|[Databases](../../enroll-resources/database-access/rbac.mdx)|
 |`db_service_labels`|[Database Service](../../enroll-resources/database-access/database-access.mdx) instances|
 |`kubernetes_labels`|[Kubernetes clusters](../../enroll-resources/kubernetes-access/controls.mdx)|
 |`node_labels`|[SSH Servers](../../enroll-resources/server-access/server-access.mdx)|
 |`windows_desktop_labels`|[Windows desktops](../../enroll-resources/server-access/server-access.mdx)|
-|`workload_identity_labels`|[Workload Identities](../workload-identity/workload-identity-resource.mdx)|
+|`workload_identity_labels`|[Workload Identities](../machine-workload-identity/workload-identity/workload-identity-resource.mdx)|
 
 Principals a user can assume on infrastructure resources:
 - `aws_role_arns`
@@ -539,7 +809,7 @@ sign-on provider.
 |`{{internal.jwt}}`|JWT header used for app access.|
 |`{{internal.kubernetes_groups}}`|List of allowed Kubernetes groups for the user.|
 |`{{internal.kubernetes_users}}`|List of allowed Kubernetes users for the user.|
-|`{{internal.logins}}` | Substituted with a value stored in Teleport's local user database and logins from a root cluster. <br/><br/>For local users, Teleport will substitute this with the "allowed logins" parameter used in the `tctl users add [user] <allowed logins>` command. <br/><br/>If the role is within a leaf cluster in a [trusted cluster](../../admin-guides/management/admin/trustedclusters.mdx), Teleport will substitute the logins from the root cluster whether the user is a local user or from an SSO provider. <br/><br/>As an example, if the user has the `ubuntu` login in the root cluster, then `ubuntu` will be substituted in the leaf cluster with this variable. |
+|`{{internal.logins}}` | Substituted with a value stored in Teleport's local user database and logins from a root cluster. <br/><br/>For local users, Teleport will substitute this with the "allowed logins" parameter used in the `tctl users add [user] <allowed logins>` command. <br/><br/>If the role is within a leaf cluster in a [trusted cluster](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx), Teleport will substitute the logins from the root cluster whether the user is a local user or from an SSO provider. <br/><br/>As an example, if the user has the `ubuntu` login in the root cluster, then `ubuntu` will be substituted in the leaf cluster with this variable. |
 |`{{internal.windows_logins}}`|List of allowed Windows logins for the user.|
 |`{{external.xyz}}` | Substituted with a value from an external [SSO provider](https://en.wikipedia.org/wiki/Single_sign-on). If using SAML, this will be expanded with "xyz" assertion value. For OIDC, the variable is expanded to the value of the "xyz" claim. See the next section for more information on referring to the `external` variable in Teleport roles. |
 
@@ -548,7 +818,7 @@ sign-on provider.
 The `internal` trait namespace includes only the exact internal trait names
 included in the above table.
 For local Teleport users, these traits can be set in the `spec.traits` field of the
-[user resource](../resources.mdx#user).
+[user resource](../infrastructure-as-code/teleport-resources/user.mdx).
 These trait names can also be set for SSO users if they are included in an
 attribute or claim from your IdP.
 
@@ -580,7 +850,7 @@ included in the `spec.allow.logins` field of roles the user holds in the root cl
 #### Referring to external traits in Teleport roles
 
 For local Teleport users, the `external` trait namespace includes all values
-from the `spec.traits` field of the [user resource](../resources.mdx#user).
+from the `spec.traits` field of the [user resource](../infrastructure-as-code/teleport-resources/user.mdx).
 This includes any custom trait names, as well as names matching the `internal`
 traits listed above.
 For example, `{{internal.logins}}` and `{{external.logins}}` are both valid ways
@@ -689,5 +959,5 @@ within this guide:
 | `user.metadata.name`       | The user's name                                   |
 
 Read the [predicate
-language](../predicate-language.mdx)
+language](predicate-language.mdx)
 guide for a more in depth explanation of the language.
diff --git a/docs/pages/reference/access-controls/saml-idp.mdx b/docs/pages/reference/access-controls/saml-idp.mdx
index 040505a8c9354..43f0ae10ba344 100644
--- a/docs/pages/reference/access-controls/saml-idp.mdx
+++ b/docs/pages/reference/access-controls/saml-idp.mdx
@@ -1,6 +1,11 @@
 ---
 title: SAML Identity Provider Reference
+sidebar_label: SAML Identity Provider
 description: Reference documentation for the SAML identity provider
+tags:
+ - conceptual
+ - identity-governance
+ - infrastructure-identity
 ---
 
 This page provides details on the SAML identity provider available
@@ -99,69 +104,12 @@ The assertions currently provided by Teleport's SAML identity provider are liste
 
 ## RBAC
 
-In role version 7 and below, the following access controls are applied to the `saml_idp_service_provider` resource access: 
+Access to the SAML IdP service provider can be configured by using a Teleport role 
+with an allow/deny rule targeting the `saml_idp_service_provider` resource and label matchers
+matching role `app_labels` with the `saml_idp_service_provider` resource labels. 
 
-- Role option that enables idp: `spec.options.idp.saml.enabled: true/false`.
-- Cluster auth preference that enables idp: `spec.idp.saml.enabled: true/false`.
-- Resource rule `spec.allow/deny.rules.resources.saml_idp_service_provider`. Applicable only to admin actions. 
-  - Allow rule with `read,list` verbs are applied implicitly. 
-  - Deny rule with `read,list` verbs gets precedence over implicit allow. 
-- Per session MFA: `spec.options.require_session_mfa: true/false`.
-
-Teleport role version 8 introduces the following changes:
-- Label matchers based on `app_labels`.
-- Resource rule with verbs targeting `saml_idp_service_provider` is now applicable to both resource access and admin actions. 
-- Device Trust for SAML IdP session.
-
-The role option `spec.options.idp.saml.enabled: true/false` is no longer supported starting role version 8.
-
-Per session MFA is supported in all role versions.
-
-### RBAC precedence
-
-Users can be assigned with both the newer role (version 8) and the older versioned roles (version 7 and below) at the same time.
-If a user is assigned with both role version 7 and 8, deny rules of the version 8 takes precedence.
-
-For example,
-- If role version 7 denies access, access is denied.
-- If role version 7 allows access but role version 8 denies access, access is denied. 
-- If role version 7 allows access and role version 8 also allows access, access is allowed.
-
-The table below shows a few more examples of applicable RBAC, when two roles with version 7 and 8 each are assigned to the user.
-
-| Role v7                                                                    | Role v8                                                    |  Result           |
-|----------------------------------------------------------------------------|------------------------------------------------------------|-------------------|
-| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: false</pre>      | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ❌ no access.      |
-| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>deny:<br/>  app_labels:<br/>     * : *</pre>          | ❌ no access       |  
-| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>allow:<br/>  app_labels:<br/>    * : *<br/>deny:<br/>  rules:<br/>    resources:<br/>    - saml_idp_service_provider<br/>    verbs:<br/>    - read<br/>    - list</pre>          | ❌ no access     | 
-| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ✅ full access     | 
-| No version 7 role assigned to the user                                     | <pre>allow:<br/>  app_labels:<br/>    * : *</pre>          | ✅ full access     | 
-| <pre>options:<br/>  idp:<br/>    saml:<br/>      enabled: true</pre>       | No version 8 role assigned to the user           | ✅ full access     | 
-
-<Admonition type="important" title="Admin Actions">
- `saml_idp_service_provider` resource does not yet support MFA and Device Trust for admin actions. 
-</Admonition>
-
-## Disabling SAML identity provider at cluster level
-
-To disable access to the identity provider at the cluster level, create
-or update the `cluster_auth_preference` object with the following setting:
-
-```yaml
-kind: cluster_auth_preference
-metadata:
-  name: cluster-auth-preference
-spec:
-  ...
-  idp:
-    saml:
-      enabled: false
-  ...
-version: v2
-```
-
-This will disable access to the SAML identity provider for all users regardless
-of their role level permissions.
+See this [RBAC guide](../../identity-governance/idps/saml-idp-rbac.mdx) to learn more on how to 
+manage access to the SAML IdP Service provider resource in Teleport.
 
 ## Troubleshooting
 
diff --git a/docs/pages/reference/user-types.mdx b/docs/pages/reference/access-controls/user-types.mdx
similarity index 83%
rename from docs/pages/reference/user-types.mdx
rename to docs/pages/reference/access-controls/user-types.mdx
index 0b0f03e31b985..43ab872b118d7 100644
--- a/docs/pages/reference/user-types.mdx
+++ b/docs/pages/reference/access-controls/user-types.mdx
@@ -2,7 +2,9 @@
 title: User Types
 description: Describes the different types of Teleport users and their properties.
 keywords: [user,idp,sso]
-tocDepth: 3
+tags:
+ - conceptual
+ - zero-trust
 ---
 
 This guide explains the different kinds of users in Teleport, how they are
@@ -23,20 +25,20 @@ one-time passwords.
 
 Local user login can be disabled via `cluster_auth_preference` or `teleport.yaml`.
 Disabling local authentication is required for [FIPS/FedRAMP compliance
-](../admin-guides/access-controls/compliance-frameworks/fedramp.mdx).
+](../../zero-trust-access/compliance-frameworks/fedramp.mdx).
 
 ### Special case: Bots
 
-Machine ID provides machines with an identity that can authenticate to the
-Teleport cluster. This identity is known as a bot. Bots are represented in
-Teleport by a user and a role resource and can be created via the
+Machine & Workload Identity provides machines with an identity that can
+authenticate to the Teleport cluster. This identity is known as a bot. Bots are
+represented in Teleport by a user and a role resource and can be created via the
 `tctl bots add` command.
 
 Unlike human users, who use a password, MFA, or SSO, bot users join
-the cluster as Teleport services using [a join method](./join-methods.mdx). They
+the cluster as Teleport services using [a join method](../deployment/join-methods.mdx). They
 can still join even if local auth is disabled. 
 
-See the [Machine ID introduction](../enroll-resources/machine-id/introduction.mdx) for more information.
+See the [Machine & Workload Identity introduction](../../machine-workload-identity/introduction.mdx) for more information.
 
 ## SSO users
 
@@ -68,7 +70,7 @@ and automatically expire. The expiry is dynamically computed based on the IdP
 answer validity, the max session duration allowed by the user roles, and cannot
 exceed 30 hours. Those users cannot be edited via `tctl`, only deleted.
 
-See the [SSO setup guides](../admin-guides/access-controls/sso/sso.mdx) to learn how to setup an
+See the [SSO setup guides](../../zero-trust-access/sso/sso.mdx) to learn how to setup an
 authentication connector and allow user to log in via an IdP.
 
 ### Synced users
diff --git a/docs/pages/reference/agent-services/agent-services.mdx b/docs/pages/reference/agent-services/agent-services.mdx
deleted file mode 100644
index b777635df07c3..0000000000000
--- a/docs/pages/reference/agent-services/agent-services.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Agent Services
-h1: Agent Service References
-description: Includes guides to use while using the SSH Service, Database Service, and other Teleport Agent services.
----
-
-Use these reference guides to configure and run Teleport Agent services. For a
-comprehensive list of options you can configure when running the `teleport`
-binary, including all options for Agent services, consult the [Teleport
-Configuration Reference](../config.mdx).
-
-<DocCardList />
diff --git a/docs/pages/reference/agent-services/application-access.mdx b/docs/pages/reference/agent-services/application-access.mdx
deleted file mode 100644
index be61f71a592fe..0000000000000
--- a/docs/pages/reference/agent-services/application-access.mdx
+++ /dev/null
@@ -1,232 +0,0 @@
----
-title: Application Access Reference Documentation
-description: Configuration and CLI reference documentation for Teleport application access.
----
-
-This guide describes interfaces and options for interacting with the Teleport
-Application Service, including the static configuration file for the `teleport`
-binary, the dynamic `app` resource, and `tsh apps` commands.
-
-## Configuration
-
-(!docs/pages/includes/backup-warning.mdx!)
-
-The following snippet shows the full YAML configuration of an Application Service
-appearing in the `teleport.yaml` configuration file:
-
-```yaml
-app_service:
-  # Enables application proxy service.
-  enabled: true
-  # Teleport provides a small debug app called "dumper" that can be used
-  # to make sure application access is working correctly. It outputs JWTs,
-  #  so it can be useful when extending your application.
-  debug_app: true
-  # Matchers for application resources created with "tctl create" command.
-  resources:
-  - labels:
-      "*": "*"
-  # This section contains definitions of all applications proxied by this
-  # service. It can contain multiple items.
-  apps:
-    # Name of the application. Used for identification purposes.
-  - name: "grafana"
-    # Free-form application description.
-    description: "This is an internal Grafana instance"
-    # URI and port the application is available at.
-    uri: "http://localhost:3000"
-    # Optional application public address to override.
-    public_addr: "grafana.teleport.example.com"
-    # Rewrites section.
-    rewrite:
-      # Specify whether to include roles or traits in the JWT.
-      # Options:
-      # - roles-and-traits: include both roles and traits
-      # - roles: include only roles
-      # - traits: include only traits
-      # - none: exclude both roles and traits from the JWT token
-      # Default: roles-and-traits
-      jwt_claims: roles-and-traits
-      # Rewrite the "Location" header on redirect responses replacing the
-      # host with the public address of this application.
-      redirect:
-      - "grafana.internal.dev"
-      # Headers passthrough configuration.
-      headers:
-      - "X-Custom-Header: example"
-      - "X-External-Trait: {{external.env}}"
-    # Disable application certificate validation.
-    insecure_skip_verify: true
-    # Optional static labels to assign to the app. Used in RBAC.
-    labels:
-      env: "prod"
-    # Optional dynamic labels to assign to the app. Used in RBAC.
-    commands:
-    - name: "hostname"
-      command: ["hostname"]
-      period: 1m0s
-    # Optional AWS-specific configurations.
-    aws:
-      # External ID used when assuming AWS roles for this application.
-      external_id: "example-external-id"
-  - name: "azure-cli"
-    # Optional: For access to cloud provider APIs, specify the cloud provider.
-    # Allowed values are "AWS", "Azure", and "GCP".
-    cloud: "Azure"
-```
-
-For full details on configuring Teleport roles, including how Teleport
-populates the `external` traits, see the [Access Controls
-Reference](../access-controls/roles.mdx).
-
-## Application resource
-
-Full YAML spec of application resources managed by `tctl` resource commands:
-
-```yaml
-kind: app
-version: v3
-metadata:
-  # Application name.
-  name: example
-  # Application description.
-  description: "Example application"
-  # Application static labels.
-  labels:
-    env: local
-spec:
-  # URI and port application is available at.
-  uri: http://localhost:4321
-  # Optional application public address.
-  public_addr: test.example.com
-  # Disable application certificate validation.
-  insecure_skip_verify: true
-  # Rewrites configuration.
-  rewrite:
-    # Rewrite the "Location" header on redirect responses replacing the
-    # host with the public address of this application.
-    redirect:
-    - "grafana.internal.dev"
-    # Headers passthrough configuration.
-    headers:
-    - name: "X-Custom-Header"
-      value: "example"
-    - name: "X-External-Trait"
-      value: "{{external.env}}"
-  # Optional dynamic labels.
-  dynamic_labels:
-  - name: "hostname"
-    command: ["hostname"]
-    period: 1m0s
-```
-
-You can create a new `app` resource by running the following commands, which
-assume that you have created a YAML file called `app.yaml` with your configuration:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-# You can also run tctl on your Auth Service host without running "tsh login"
-# first.
-$ tsh login --proxy=teleport.example.com --user=myuser
-# Create the resource
-$ tctl create -f app.yaml
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-$ tsh login --proxy=mytenant.teleport.sh --user=myuser
-# Create the resource.
-$ tctl create -f app.yaml
-```
-
-</TabItem>
-
-</Tabs>
-
-## CLI
-
-This section shows CLI commands relevant for application access.
-
-### tsh apps ls
-
-Lists available applications.
-
-```code
-$ tsh apps ls
-```
-
-### tsh apps login
-
-Retrieves short-lived X.509 certificate for CLI application access.
-
-```code
-$ tsh apps login grafana
-```
-
-| Flag | Description |
-| - | - |
-| `--aws-role` | For AWS CLI access, the role ARN or role name of an AWS IAM role. |
-| `--azure-identity` | For Azure CLI access, the name or URI of an Azure managed identity to use for accessing the Azure CLI. |
-
-### tsh apps logout
-
-Removes CLI application access certificate.
-
-```code
-# Log out of a particular app.
-$ tsh apps logout grafana
-
-# Log out of all apps.
-$ tsh apps logout
-```
-
-### tsh apps config
-
-Prints application connection information.
-
-```code
-# Print app information in a table form.
-$ tsh apps config
-
-# Print information for a particular app.
-$ tsh apps config grafana
-
-# Print an example curl command.
-$ tsh apps config --format=curl
-
-# Construct a curl command.
-$ curl $(tsh apps config --format=uri) \
-  --cacert $(tsh apps config --format=ca) \
-  --cert $(tsh apps config --format=cert) \
-  --key $(tsh apps config --format=key)
-```
-
-| Flag | Description |
-| - | - |
-| `--format` | Optional print format, one of: `uri` to print app address, `ca` to print CA cert path, `cert` to print cert path, `key` print key path, `curl` to print example curl command.|
-
-### tsh az
-
-Run an Azure CLI command via the Teleport Application Service:
-
-```code
-$ tsh az <command>
-```
-
-`<command>`: A valid command within the `az` CLI, including arguments and flags.
-See the [Azure
-documentation](https://learn.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest)
-for the full list of `az` CLI commands.
-
-To run this command, one of the user's roles must include the
-`spec.allow.azure_identities` field with one of the identities used by the
-Application Service. To learn how to set up secure access to Azure via Teleport,
-read [Protect the Azure CLI with Teleport Application
-Access](../../enroll-resources/application-access/cloud-apis/azure.mdx).
-
diff --git a/docs/pages/reference/agent-services/auto-discovery-reference/auto-discovery-reference.mdx b/docs/pages/reference/agent-services/auto-discovery-reference/auto-discovery-reference.mdx
deleted file mode 100644
index 59bbc9646d46a..0000000000000
--- a/docs/pages/reference/agent-services/auto-discovery-reference/auto-discovery-reference.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Auto-Discovery Reference
-description: Configuration reference for the Teleport Discovery Service.
----
-
-- [AWS IAM](aws-iam.mdx)
-- [Kubernetes Applications](kubernetes-application-discovery.mdx)
diff --git a/docs/pages/reference/agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx b/docs/pages/reference/agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx
deleted file mode 100644
index 8ab153e65c0d2..0000000000000
--- a/docs/pages/reference/agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx
+++ /dev/null
@@ -1,162 +0,0 @@
----
-title: Kubernetes Application Discovery Reference
-description: This guide is a comprehensive reference of configuration options for automatically enrolling Kubernetes applications with Teleport.
----
-
-Kubernetes Application Discovery involves the Teleport Discovery Service,
-Teleport Application Service, and annotations on Kubernetes services. This guide
-shows you how to configure each of these to manage Kubernetes Application
-Discovery in your Kubernetes cluster.
-
-## Configuring Teleport Agent Helm chart
-
-You can configure scope of services discovery by setting value `kubernetesDiscovery` of the chart. For more information
-please see [helm chart documentation](../../helm-reference/teleport-kube-agent.mdx).
-
-`values.yaml` example:
-
-```yaml
-kubernetesDiscovery:
-- types: ["app"]
-  namespaces: [ "toronto", "porto" ]
-  labels:
-    env: staging
-- types: ["app"]
-  namespaces: [ "seattle", "oakland" ]
-  labels:
-    env: testing
-```
-
-## Configuring Kubernetes Apps Discovery manually
-
-While the `teleport-kube-agent` Helm chart will set up configuration for you
-automatically, you can also configure the required services manually. To do so,
-adjust the configuration files for the Teleport Application Service and Teleport
-Discovery Service, then restart the agents running these services.
-
-Configuration for the Discovery Service is controlled by the `kubernetes` field,
-example:
-
-(!docs/pages/includes/discovery/discovery-group.mdx!)
-
-```yaml
-# This section configures the Discovery Service
-discovery_service:
-  enabled: true
-  discovery_group: main-cluster
-  kubernetes:
-  - types: ["app"]
-    namespaces: [ "toronto", "porto" ]
-    labels:
-      env: staging
-  - types: ["app"]
-    namespaces: [ "seattle", "oakland" ]
-    labels:
-      env: testing
-```
-
-Configuration for the Application Service is controlled by the `resources` field, example:
-
-```yaml
-app_service:
-  enabled: true
-  resources:
-  - labels:
-    "teleport.dev/kubernetes-cluster": "main-cluster"
-    "teleport.dev/origin": "discovery-kubernetes"
-```
-
-Label `teleport.dev/kubernetes-cluster` should match value of `discovery_group` field in the Discovery Service config.
-
-For more information you can take a look at [`discovery_service`](../../config.mdx) and [`app_service`](../../config.mdx) configuration references.
-
-## Annotations
-
-Kubernetes annotations on services can be used to fine tune transformation of services to apps.
-All annotations are optional - they will override default behaviour, but they are not required for import of services.
-
-### `teleport.dev/discovery-type`
-
-Controls what type this service is considered to be. If annotation is missing,
-by default all services are considered to be of "app" type. If matchers in the Discovery Service
-config match service type it will be imported. Currently the only supported value is
-`app`, which means Teleport application will be imported from this service. In the future there are plans to expand to database importing.
-
-### `teleport.dev/protocol`
-
-Controls protocol for the uri of the Teleport app we create. If annotation is not set,
-heuristics will be used to try to determine protocol of an exposed port.
-If all heuristics didn't work, the port will be skipped. For app to be imported with `tcp` protocol, the
-service should have explicit annotation `teleport.dev/protocol: "tcp"`
-
-### `teleport.dev/port`
-
-Controls preferred port for the Kubernetes service, only this one will be used even if service
-has multiple exposed ports. Its value should be one of the exposed service ports; otherwise, the app will not be imported.
-Value can be matched either by numeric value or by the name of the port defined on the service.
-
-### `teleport.dev/name`
-
-Controls resulting app name. If present it will override default app name pattern
-`$SERVICE_NAME-$NAMESPACE-$KUBE_CLUSTER_NAME`. If multiple ports are exposed, resulting apps will have port names added
-as a suffix to the annotation value, as `$APP_NAME-$PORT1_NAME`, `$APP_NAME-$PORT2_NAME` etc, where `$APP_NAME` is the name
-set by the annotation.
-
-### `teleport.dev/insecure-skip-verify`
-
-Controls whether TLS certificate verification should be skipped for this app.
-If present and set to `true`, TLS certificate verification will be skipped.
-
-```yaml
-annotations:
-  teleport.dev/insecure-skip-verify: "true"
-```
-
-### `teleport.dev/ignore`
-
-Controls whether this service should be ignored by the Discovery Service.
-This annotation is useful when you want to exclude a service from being imported as an app
-when it matches the Discovery Service config. For example, you may want to exclude a service
-that shares the same labels as another services that you want to import as apps.
-
-```yaml
-annotations:
-  teleport.dev/ignore: "true"
-```
-
-### `teleport.dev/app-rewrite`
-
-Controls rewrite configuration for Teleport app, if needed. It should
-contain full rewrite configuration in YAML format, same as one would use when configuring an app with dynamic registration syntax (see [documentation](../../../enroll-resources/application-access/guides/connecting-apps.mdx)).
-
-```yaml
-annotations:
-  teleport.dev/app-rewrite: |
-    redirect:
-    - "localhost"
-    - "jenkins.internal.dev"
-    headers:
-    - name: "X-Custom-Header"
-      value: "example"
-    - name: "Authorization"
-      value: "Bearer {{internal.jwt}}"
-```
-
-### `teleport.dev/public-addr`
-
-Controls the public address for the Teleport app we create if needed.
-
-```yaml
-annotations:
-  teleport.dev/public-addr: "custom.teleport.dev"
-```
-
-### `teleport.dev/path`
-
-The path is appended to the URI generated for the Teleport app for cases where
-an application is served on a sub-path of an HTTP service.
-
-```yaml
-annotations:
-  teleport.dev/path: "foo/bar"
-```
diff --git a/docs/pages/reference/agent-services/database-access-reference/audit.mdx b/docs/pages/reference/agent-services/database-access-reference/audit.mdx
deleted file mode 100644
index b182d030bee48..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/audit.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Database Access Audit Events Reference
-description: Audit events reference for Teleport database access.
----
-
-
-(!docs/pages/includes/database-access/db-audit-events.mdx!)
-
-## db.session.start (TDB00I/W)
-
-Emitted when a client successfully connects to a database, or when a connection
-attempt fails due to access denied.
-
-Successful connection event:
-
-```json
-{
-  "cluster_name": "root", // Teleport cluster name.
-  "code": "TDB00I", // Event code.
-  "db_name": "test", // Database/schema name.
-  "db_protocol": "postgres", // Database protocol.
-  "db_service": "local", // Database service name.
-  "db_uri": "localhost:5432", // Database server endpoint.
-  "db_user": "postgres", // Database account name.
-  "ei": 0, // Event index within the session.
-  "event": "db.session.start", // Event name.
-  "namespace": "default", // Event namespace, always "default".
-  "server_id": "05ff66c9-a948-42f4-af0e-a1b6ba62561e", // Database Service host ID.
-  "sid": "63b6fa11-cd44-477b-911a-602b75ab13b5", // Unique database session ID.
-  "success": true, // Indicates successful connection.
-  "time": "2021-04-27T23:00:26.014Z", // Event timestamp.
-  "uid": "eac5b6c8-384a-4471-9559-e135834b1ab0", // Unique event ID.
-  "user": "alice" // Teleport user name.
-}
-```
-
-Access denied event:
-
-```json
-{
-  "cluster_name": "root", // Teleport cluster name.
-  "code": "TDB00W", // Event code.
-  "db_name": "test", // Database/schema name user attempted to connect to.
-  "db_protocol": "postgres", // Database protocol.
-  "db_service": "local", // Database service name.
-  "db_uri": "localhost:5432", // Database server endpoint.
-  "db_user": "superuser", // Database account name user attempted to log in as.
-  "ei": 0, // Event index within the session.
-  "error": "access to database denied", // Connection error.
-  "event": "db.session.start", // Event name.
-  "message": "access to database denied", // Detailed error message.
-  "namespace": "default", // Event namespace, always "default".
-  "server_id": "05ff66c9-a948-42f4-af0e-a1b6ba62561e", // Database Service host ID.
-  "sid": "d18388e5-cc7c-4624-b22b-d36db60d0c50", // Unique database session ID.
-  "success": false, // Indicates unsuccessful connection.
-  "time": "2021-04-27T23:03:05.226Z", // Event timestamp.
-  "uid": "507fe008-99a4-4247-8603-6ba03408d047", // Unique event ID.
-  "user": "alice" // Teleport user name.
-}
-```
-
-## db.session.end (TDB01I)
-
-Emitted when a client disconnects from the database.
-
-```json
-{
-  "cluster_name": "root", // Teleport cluster name.
-  "code": "TDB01I", // Event code.
-  "db_name": "test", // Database/schema name.
-  "db_protocol": "postgres", // Database protocol.
-  "db_service": "local", // Database service name.
-  "db_uri": "localhost:5432", // Database server endpoint.
-  "db_user": "postgres", // Database account name.
-  "ei": 3, // Event index within the session.
-  "event": "db.session.end", // Event name.
-  "sid": "63b6fa11-cd44-477b-911a-602b75ab13b5", // Unique database session ID.
-  "time": "2021-04-27T23:00:30.046Z", // Event timestamp.
-  "uid": "a626b22d-bbd0-40ef-9896-b7ff365664b0", // Unique event ID.
-  "user": "alice" // Teleport user name.
-}
-```
-
-## db.session.query (TDB02I)
-
-Emitted when a client executes a SQL query.
-
-```json
-{
-  "cluster_name": "root", // Teleport cluster name.
-  "code": "TDB02I", // Event code.
-  "db_name": "test", // Database/schema name.
-  "db_protocol": "postgres", // Database protocol.
-  "db_query": "INSERT INTO public.test (id,\"timestamp\",json)\n\tVALUES ($1,$2,$3)", // Query text.
-  "db_query_parameters": [ // Query parameters (for prepared statements).
-    "test-id",
-    "2022-04-02 17:50:20-07",
-    "{\"k\": \"v\"}"
-  ],
-  "db_service": "local", // Database service name.
-  "db_uri": "localhost:5432", // Database server endpoint.
-  "db_user": "postgres", // Database account name.
-  "ei": 29, // Event index within the session.
-  "event": "db.session.query", // Event name.
-  "sid": "691e6f70-3c31-4412-90aa-fe0558abb212", // Unique database session ID.
-  "time": "2021-04-27T23:04:57.395Z", // Event timestamp.
-  "uid": "9f7b4179-b9cf-4302-bb7c-1408e404823f", // Unique event ID.
-  "user": "alice" // Teleport user name.
-}
-```
-
-## db.session.spanner.rpc (TSPN001I/W)
-
-Emitted when a client executes a remote procedure call (RPC), or when an RPC
-execution attempt fails due to access denied.
-
-```json
-{
-  "args": { // RPC arguments (specific to the "procedure" below).
-    "query_options": {},
-    "request_options": {},
-    "seqno": 1,
-    "session": "projects/project-id/instances/instance-id/databases/dev-db/sessions/ABCDEF1234567890",
-    "sql": "select * from TestTable",
-    "transaction": {
-      "Selector": {
-        "SingleUse": {
-          "Mode": {
-            "ReadOnly": {
-              "TimestampBound": {
-                "Strong": true
-              },
-              "return_read_timestamp": true
-            }
-          }
-        }
-      }
-    }
-  },
-  "cluster_name": "root", // Teleport cluster name.
-  "code": "TSPN001I", // Event code.
-  "db_name": "dev-db", // Database name.
-  "db_origin": "dynamic", // Teleport database service config origin.
-  "db_protocol": "spanner", // Database protocol.
-  "db_service": "teleport-spanner", // Database service name.
-  "db_type": "spanner", // Database type.
-  "db_uri": "spanner.googleapis.com:443", // Database service endpoint.
-  "db_user": "some-user", // Database account name, (a GCP IAM service account name without its @<project>.iam.gserviceaccount.com suffix).
-  "ei": 29, // Event index within the session.
-  "event": "db.session.spanner.rpc", // Event name.
-  "procedure": "ExecuteStreamingSql", // Name of the remote procedure call (RPC).
-  "sid": "406b9883-0e16-42f2-9d0b-b3bd956f9cd4", // Unique database session ID.
-  "success": true, // The RPC was allowed by Teleport RBAC.
-  "time": "2024-03-13T00:02:44.739Z", // Event timestamp.
-  "uid": "e0625e79-9399-4ea3-aa8b-dba1eb98658d", // Unique event ID.
-  "user": "alice@example.com" // Teleport user name.
-}
-```
diff --git a/docs/pages/reference/agent-services/database-access-reference/aws.mdx b/docs/pages/reference/agent-services/database-access-reference/aws.mdx
deleted file mode 100644
index d7f57e4b5e05f..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/aws.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Database Access AWS IAM Reference
-description: AWS IAM policies for Teleport database access.
----
-
-The Teleport Database Service requires IAM permissions for various tasks
-depending on the database type and setup, such as discovering endpoints and
-metadata of the database servers, generating IAM authentication tokens, and
-assuming IAM roles.
-
-You can generate IAM permissions with the [`teleport db configure aws
-print-iam`](cli.mdx)
-command. For example, the following command would generate and print the IAM
-policies:
-
-```code
-$ teleport db configure aws print-iam --types rds,redshift --role teleport-db-service-role
-```
-
-To learn more about IAM permissions for a specific type of database, refer to
-the related section below.
-
-## DocumentDB
-
-(!docs/pages/includes/database-access/reference/aws-iam/documentdb/access-policy.mdx dbUserRole="documentdb-user-role"!)
-
-### IAM role as a DocumentDB database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/documentdb/role-as-user-policy.mdx!)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="documentdb-user-role"!)
-
-## DynamoDB
-
-(!docs/pages/includes/database-access/reference/aws-iam/dynamodb/access-policy.mdx dbUserRole="dynamodb-user-role"!)
-
-### IAM role as a DynamoDB database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/dynamodb/role-as-user-policy.mdx!)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="dynamodb-user-role"!)
-
-## ElastiCache for Redis
-
-(!docs/pages/includes/database-access/reference/aws-iam/elasticache/access-policy.mdx!)
-
-### ElastiCache managed users
-
-(!docs/pages/includes/database-access/reference/aws-iam/redis/auto-password-access-policy.mdx dbType="ElastiCache" permissionType="elasticache" updateUserPermission="ModifyUser" listTagsPermission="ListTagsForResource"!)
-
-## Keyspaces
-
-(!docs/pages/includes/database-access/reference/aws-iam/keyspaces/access-policy.mdx dbUserRole="keyspaces-user-role"!)
-
-### IAM role as a Keyspaces database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/keyspaces/role-as-user-policy.mdx!)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="keyspaces-user-role"!)
-
-## MemoryDB
-
-(!docs/pages/includes/database-access/reference/aws-iam/memorydb/access-policy.mdx!)
-
-### MemoryDB managed users
-
-(!docs/pages/includes/database-access/reference/aws-iam/redis/auto-password-access-policy.mdx dbType="MemoryDB" permissionType="memorydb" updateUserPermission="UpdateUser" listTagsPermission="ListTags"!)
-
-## OpenSearch
-
-(!docs/pages/includes/database-access/reference/aws-iam/opensearch/access-policy.mdx dbUserRole="opensearch-user-role"!)
-
-### IAM role as an OpenSearch database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/opensearch/role-as-user-policy.mdx!)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="opensearch-user-role"!)
-
-## RDS
-
-(!docs/pages/includes/database-access/reference/aws-iam/rds/access-policy.mdx!)
-
-## RDS Proxy
-
-(!docs/pages/includes/database-access/reference/aws-iam/rds-proxy/access-policy.mdx!)
-
-## Redshift
-
-(!docs/pages/includes/database-access/reference/aws-iam/redshift/access-policy.mdx dbUserRole="redshift-user-role"!)
-
-### IAM role as a Redshift database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/redshift/role-as-user-policy.mdx dbUserRole="redshift-user-role"!)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="redshift-user-role"!)
-
-## Redshift Serverless
-
-(!docs/pages/includes/database-access/reference/aws-iam/redshift-serverless/access-policy.mdx dbUserRole="redshift-serverless-user-role"!)
-
-### IAM role as a Redshift Serverless database user
-
-(!docs/pages/includes/database-access/reference/aws-iam/redshift-serverless/role-as-user-policy.mdx dbUserRole="redshift-serverless-user-role" !)
-
-(!docs/pages/includes/database-access/iam_role_trust_relationship.mdx role1="teleport-db-service-role" role2="redshift-serverless-user-role"!)
diff --git a/docs/pages/reference/agent-services/database-access-reference/cli.mdx b/docs/pages/reference/agent-services/database-access-reference/cli.mdx
deleted file mode 100644
index f35f791ad0c70..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/cli.mdx
+++ /dev/null
@@ -1,383 +0,0 @@
----
-title: Database Access CLI Reference
-description: CLI reference for Teleport database access.
----
-
-This reference shows you how to run common commands for managing Teleport
-the Database Service, including:
-
-- The `teleport` daemon command, which is executed on the host where you
-  will run the Teleport Database Service.
-
-- The `tctl` administration tool, which you use to manage `db` resources that
-  represent databases known to your Teleport cluster.
-
-  (!docs/pages/includes/tctl.mdx!)
-
-- The `tsh` client tool, which end-users run in order to access databases in
-  your cluster.
-
-## teleport db start
-
-Starts Teleport Database Service.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ teleport db start \
-    --token=/path/to/token \
-    --auth-server=proxy.example.com:443 \
-    --name=example \
-    --protocol=postgres \
-    --uri=postgres.example.com:5432
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ teleport db start \
-    --token=/path/to/token \
-    --auth-server=mytenant.teleport.sh:443 \
-    --name=example \
-    --protocol=postgres \
-    --uri=postgres.mytenant.teleport.sh:5432
-```
-
-</TabItem>
-
-</Tabs>
-
-| Flag | Description |
-| - | - |
-| `-d/--debug` | Enable verbose logging to stderr. |
-| `--pid-file` | Full path to the PID file. By default no PID file will be created. |
-| `--auth-server` | Address of the Teleport Proxy Service. |
-| `--token` | Invitation token to register with the Auth Service. |
-| `--ca-pin` | CA pin to validate the Auth Service. |
-| `-c/--config` | Path to a configuration file (default `/etc/teleport.yaml`). |
-| `--labels` | Comma-separated list of labels for this node, for example `env=dev,app=web`. |
-| `--fips` | Start Teleport in FedRAMP/FIPS 140-2 mode. |
-| `--name` | Name of the proxied database. |
-| `--description` | Description of the proxied database. |
-| `--protocol` | Proxied database protocol. Supported are: `postgres` and `mysql`. |
-| `--uri` | Address the proxied database is reachable at. |
-| `--ca-cert` | Database CA certificate path. |
-| `--aws-region` | (Only for RDS, Aurora or Redshift) AWS region RDS, Aurora or Redshift database instance is running in. |
-| `--aws-redshift-cluster-id` | (Only for Redshift) Redshift database cluster identifier. |
-| `--gcp-project-id` | (Only for Cloud SQL) GCP Cloud SQL project identifier. |
-| `--gcp-instance-id` | (Only for Cloud SQL) GCP Cloud SQL instance identifier.|
-
-## teleport db configure create
-
-Creates a sample Database Service configuration.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
-$ teleport db configure create \
-  --token=/tmp/token \
-  --proxy=proxy.example.com:443 \
-  --name=example \
-  --protocol=postgres \
-  --uri=postgres://postgres.example.com:5432 \
-  --labels=env=prod
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
-$ teleport db configure create \
-  --token=/tmp/token \
-  --proxy=mytenant.teleport.sh:443 \
-  --name=example \
-  --protocol=postgres \
-  --uri=postgres://postgres.mytenant.teleport.sh:5432 \
-  --labels=env=prod
-```
-
-</TabItem>
-
-</Tabs>
-
-| Flag | Description |
-| - | - |
-| `--proxy` | Teleport Proxy Service address to connect to. Default: `0.0.0.0:3080`. |
-| `--token` | Invitation token to register with the Auth Service. Default: none. |
-| `--rds-discovery` | List of AWS regions in which the agent will discover RDS/Aurora instances. |
-| `--rdsproxy-discovery` | List of AWS regions in which the agent will discover RDS Proxies. |
-| `--redshift-discovery` | List of AWS regions in which the agent will discover Redshift instances. |
-| `--redshift-serverless-discovery` | List of AWS regions in which the agent will discover Redshift Serverless instances. |
-| `--elasticache-discovery` | List of AWS regions in which the agent will discover ElastiCache Redis clusters. |
-| `--aws-tags` | (Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it |
-| `--memorydb-discovery` | List of AWS regions in which the agent will discover MemoryDB clusters. |
-| `--azure-mysql-discovery` | List of Azure regions in which the agent will discover MySQL servers. |
-| `--azure-postgres-discovery` | List of Azure regions in which the agent will discover Postgres servers. |
-| `--azure-redis-discovery` | List of Azure regions in which the agent will discover Azure Cache For Redis servers. |
-| `--azure-subscription` | List of Azure subscription IDs for Azure discoveries. Default is "*". |
-| `--azure-resource-group` | List of Azure resource groups for Azure discoveries. Default is "*". |
-| `--azure-tags` | (Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it |
-| `--ca-pin` | CA pin to validate the Auth Service (can be repeated for multiple pins). |
-| `--name` | Name of the proxied database. |
-| `--protocol` | Proxied database protocol. Refer to the [configuration](./configuration.mdx#database-service-configuration) reference for supported values. |
-| `--uri` | Address the proxied database is reachable at. |
-| `--labels` | Comma-separated list of labels for the database, for example env=dev,dept=it |
-| `-o/--output` | Write to stdout with `--output=stdout`, the default config file with `--output=file`, or a custom path with `--output=file:///path` |
-| `--dynamic-resources-labels` | Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching. |
-
-## teleport db configure bootstrap
-
-Bootstrap the necessary configuration for the Database Service. It reads the
-provided configuration to determine what will be bootstrapped.
-
-```code
-$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
-$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
-$ teleport db configure bootstrap -c /etc/teleport.yaml --manual
-```
-
-| Flag | Description |
-| - | - |
-| `-c/--config` | Path to a configuration file. Default: `/etc/teleport.yaml`. |
-| `--manual` | When executed in "manual" mode, this command will print the instructions to complete the configuration instead of applying them directly. |
-| `--policy-name` | Name of the Teleport Database Service policy. Default: `DatabaseAccess` |
-| `--confirm` | Do not prompt the user and auto-confirm all actions. |
-| `--attach-to-role` | Role name to attach the policy to. Mutually exclusive with `--attach-to-user`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
-| `--attach-to-user` | User name to attach the policy to. Mutually exclusive with `--attach-to-role`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
-
-## teleport db configure aws print-iam
-
-Print the necessary IAM permissions required for the Database Service based on
-provided database types.
-
-```code
-$ teleport db configure aws print-iam --types rds
-$ teleport db configure aws print-iam --types rds,redshift --role my-db-service-role
-$ teleport db configure aws print-iam --types redshift-serverless --assumes-roles my-access-role --policy
-```
-
-| Flag | Description |
-| - | - |
-| `-r/--types` | Comma-separated list of database types to include in the policy. Any of `rds`, `rdsproxy`, `redshift`, `redshift-serverless`, `elasticache`, `memorydb`, `keyspace`, `dynamodb`, `opensearch`. |
-| `--role` | IAM role name to attach policy to. Mutually exclusive with --user. |
-| `--user` | IAM user name to attach policy to. Mutually exclusive with --role. |
-| `--[no-]policy` | Only print an IAM policy document. |
-| `--[no-]boundary` | Only print an IAM boundary policy document. |
-| `--assumes-roles` | Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account. |
-
-## tctl auth sign
-
-When invoked with a `--format=db` (or `--format=mongodb` for MongoDB) flag,
-produces a CA certificate, a client certificate and a private key file used for
-configuring the Database Service with self-hosted database instances.
-
-<Admonition type="note" title="Note">
-  For database formats, `tctl` must be run on an Auth Service host or the remote
-  user must be be able to impersonate the built-in `Db` role and user. See the
-  [impersonation guide](../../../admin-guides/access-controls/guides/impersonation.mdx)
-  for details on how to allow impersonation.
-</Admonition>
-
-```code
-$ tctl auth sign --format=db --host=db.example.com --out=db --ttl=2190h
-$ tctl auth sign --format=db --host=host1,localhost,127.0.0.1 --out=db --ttl=2190h
-```
-
-In this example, `db.example.com` is the hostname where the Teleport Database
-Service can reach the database server. The second example assumes a
-database running on the same host as Teleport.
-
-| Flag | Description |
-| - | - |
-| `--format` | When given value `db`, produces secrets in database compatible format. Use `mongodb` when generating MongoDB secrets. |
-| `--host` | Comma-separated SANs to encode in the certificate. Must contain the hostname Teleport will use to connect to the database. |
-| `--out` | Name prefix for output files. |
-| `--ttl` | Certificate validity period. |
-
-<details>
-<summary>Setting up RBAC for signing database certificates</summary>
-
-The `tctl` user must have permissions to impersonate the Teleport Database
-Service role, `Db`, in order to generate a signed database certificate. To add
-these impersonation privileges to your Teleport user, run the following
-commands.
-
-First, define a role that can impersonate the `Db` user. Add the following
-content to a file called `db-impersonator.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: db-impersonator
-spec:
-  options:
-  allow:
-    impersonate:
-      users: ['Db']
-      roles: ['Db']
-```
-
-Create the role:
-
-```code
-$ tctl create -f db-impersonator.yaml
-```
-
-(!docs/pages/includes/create-role-using-web.mdx!)
-
-Open your Teleport user's dynamic configuration resource in your editor so you
-can add the `db-impersonator` role:
-
-```code
-$ TELEPORT_USER=<your user>
-$ tctl edit user/${TELEPORT_USER?}
-```
-
-Add the `db-impersonator` role:
-
-```diff
-spec:
-   - access
-   - auditor
-   - editor
-+  - db-impersonator
-   status:
-     is_locked: false
-```
-
-Update your user by saving and closing the file in your editor.
-
-Log out of your Teleport cluster and log in again. You will now be able to run
-`tctl auth sign` for database-specific certificate formats.
-
-</details>
-
-(!docs/pages/includes/database-access/ttl-note.mdx!)
-
-## tctl db ls
-
-Administrative command to list all databases registered with the cluster.
-
-```code
-$ tctl db ls
-$ tctl db ls --format=yaml
-```
-
-| Flag | Description |
-| - | - |
-| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `text`. |
-
-## tctl get db
-
-Prints the list of all configured database resources.
-
-| Flag | Description |
-| - | - |
-| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `yaml`. |
-
-## tctl get db/database-resource-name
-
-Prints details about `database-resource-name` database resource.
-
-| Flag | Description |
-| - | - |
-| `--format` | Output format, one of `text`, `yaml` or `json`. Defaults to `yaml`. |
-
-## tctl rm db/database-resource-name
-
-Removes database resource called `database-resource-name`.
-
-## tsh db ls
-
-Lists available databases and their connection information.
-
-```code
-$ tsh db ls
-```
-
-Displays only the databases a user has access to (see [RBAC](../../../enroll-resources/database-access/rbac.mdx)).
-
-## tsh db login
-
-Retrieves database credentials.
-
-```code
-$ tsh db login example
-$ tsh db login --db-user=postgres --db-name=postgres example
-```
-
-| Flag | Description |
-| - | - |
-| `--db-user` | The database user to log in as. |
-| `--db-name` | The database name to log in to. |
-| `--db-roles` | Comma-separated list of database roles to use for auto-provisioned user. If not provided, all database roles will be assigned. |
-
-(!docs/pages/includes/db-user-name-flags.mdx!)
-
-## tsh db logout
-
-Removes database credentials.
-
-```code
-$ tsh db logout example
-$ tsh db logout
-```
-
-## tsh db connect
-
-Connect to a database using its CLI client.
-
-```code
-# Short syntax when only logged into a single database.
-$ tsh db connect
-# Specify database service to connect to explicitly.
-$ tsh db connect example
-# Provide database user and name to connect to.
-$ tsh db connect --db-user=alice --db-name=db example
-# Select a subset of allowed database roles.
-$ tsh db connect --db-user=alice --db-name=db --db-roles reader example
-```
-
-<Admonition type="note" title="Note">
-  Respective database CLI clients (`psql`, `mysql`, `mongo` or `mongosh`) should be
-  available in PATH.
-</Admonition>
-
-| Flag | Description |
-| - | - |
-| `--db-user` | The database user to log in as. |
-| `--db-name` | The database name to log in to. |
-| `--db-roles` | Comma-separated list of database roles to use for auto-provisioned user. If not provided, all database roles will be assigned. |
-
-(!docs/pages/includes/db-user-name-flags.mdx!)
-
-## tsh db env
-
-Outputs environment variables for a particular database.
-
-```code
-$ tsh db env
-$ tsh db env example
-$ eval $(tsh db env)
-```
-
-## tsh db config
-
-Prints database connection information. Useful when configuring GUI clients.
-
-```code
-$ tsh db config
-$ tsh db config example
-$ tsh db config --format=cmd example
-```
-
-| Flag | Description |
-| - | - |
-| `--format` | Output format: `text` is default, `cmd` to print native database client connect command. |
-
diff --git a/docs/pages/reference/agent-services/database-access-reference/configuration.mdx b/docs/pages/reference/agent-services/database-access-reference/configuration.mdx
deleted file mode 100644
index efdee868d79ca..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/configuration.mdx
+++ /dev/null
@@ -1,247 +0,0 @@
----
-title: Database Access Configuration Reference
-description: Configuration reference for Teleport database access.
----
-
-This guide explains configuration options for the Teleport Database Service,
-which proxies user traffic between Teleport users and protected databases. 
-
-## Database service configuration
-
-The following snippet shows full YAML configuration of a Database Service
-appearing in `teleport.yaml` configuration file:
-
-```yaml
-(!docs/pages/includes/config-reference/database-config.yaml!)
-```
-
-## Proxy configuration
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-The following Proxy service configuration is relevant for database access:
-
-<Admonition
-type="warning"
-title="TLS for database connections"
->
-The `--insecure-no-tls` `tsh` flag is only supported for MySQL/MariaDB and PostgreSQL
-connections using a unique port, specified with `mysql_public_addr` or `postgres_public_addr`.
-</Admonition>
-
-```yaml
-proxy_service:
-  enabled: true
-  # Database proxy is listening on the regular web proxy port.
-  web_listen_addr: "0.0.0.0:443"
-  # MySQL proxy is listening on a separate port and needs to be enabled
-  # on the proxy server.
-  mysql_listen_addr: "0.0.0.0:3036"
-  # MySQL Server version allows you to overwrite the default Teleport Proxy Service MySQL version (8.0.0-Teleport)
-  # Note that if the MySQL client connection is using TLS Routing the dynamic MySQL Server Version takes
-  # precedence over the mysql_server_version proxy settings.
-  # mysql_server_version: "8.0.4"
-  # Postgres proxy listening address. If provided, proxy will use a separate listener
-  # instead of multiplexing Postgres protocol on web_listener_addr.
-  # postgres_listen_addr: "0.0.0.0:5432"
-  # Mongo proxy listening address. If provided, proxy will use a separate listener
-  # instead of multiplexing Mongo protocol on web_listener_addr.
-  # mongo_listen_addr: "0.0.0.0:27017"
-  # By default database clients will be connecting to the Proxy over this
-  # hostname. To override public address for specific database protocols
-  # use postgres_public_addr and mysql_public_addr.
-  public_addr: "teleport.example.com:443"
-  # Address advertised to MySQL clients. If not set, public_addr is used.
-  mysql_public_addr: "mysql.teleport.example.com:3306"
-  # Address advertised to PostgreSQL clients. If not set, public_addr is used.
-  postgres_public_addr: "postgres.teleport.example.com:443"
-  # Address advertised to Mongo clients. If not set, public_addr is used.
-  mongo_public_addr: "mongo.teleport.example.com:443"
-```
-
-</TabItem>
-<TabItem label="Cloud-Hosted">
-
-Teleport Enterprise Cloud automatically configures the Teleport Proxy Service
-with the following settings that are relevant to database access. This reference
-configuration uses `example.teleport.sh` in place of your Teleport Enterprise
-Cloud tenant address:
-
-```yaml
-proxy_service:
-  enabled: true
-  # Database proxy is listening on the regular web proxy port.
-  web_listen_addr: "0.0.0.0:3080"
-  # MySQL proxy is listening on a separate port.
-  mysql_listen_addr: "0.0.0.0:3036"
-  # Database clients will connect to the Proxy Service over this hostname.
-  public_addr: "mytenant.teleport.sh:443"
-  # Address advertised to MySQL clients.
-  mysql_public_addr: "mytenant.teleport.sh:3036"
-  # Address advertised to PostgreSQL clients.
-  postgres_public_addr: "mytenant.teleport.sh:443"
-  # Address advertised to Mongo clients. If not set, public_addr is used.
-  mongo_public_addr: "mongo.teleport.example.com:443
-```
-
-</TabItem>
-</Tabs>
-
-## Database resource
-
-Full YAML spec of database resources managed by `tctl` resource commands:
-
-```yaml
-kind: db
-version: v3
-metadata:
-  # Database resource name.
-  name: example
-
-  # Database resource description.
-  description: "Example database"
-
-  # Database resource static labels.
-  labels:
-    env: example
-
-spec:
-  # Database protocol. Valid options are:
-  # "cassandra"
-  # "clickhouse"
-  # "clickhouse-http"
-  # "cockroachdb"
-  # "dynamodb"
-  # "elasticsearch"
-  # "mongodb"
-  # "mysql"
-  # "oracle"
-  # "postgres"
-  # "redis"
-  # "snowflake"
-  # "spanner"
-  # "sqlserver"
-  protocol: "postgres"
-
-  # Database connection endpoint.
-  uri: "localhost:5432"
-
-  # Optional TLS configuration.
-  tls:
-    # TLS verification mode. Valid options are:
-    # 'verify-full' - performs full certificate validation (default).
-    # 'verify-ca' - the same as `verify-full`, but skips the server name validation.
-    # 'insecure' - accepts any certificate provided by database (not recommended).
-    mode: verify-full
-    # Optional database DNS server name. It allows to override the DNS name on
-    # a client certificate when connecting to a database.
-    # Use only with 'verify-full' mode.
-    server_name: db.example.com
-    # Optional CA for validating the database certificate.
-    ca_cert: |
-      -----BEGIN CERTIFICATE-----
-      ...
-      -----END CERTIFICATE-----
-    # Optional configuration that allows Teleport to trust certificate
-    # authorities available on the host system. If not set (by default),
-    # Teleport only trusts self-signed databases with TLS certificates signed
-    # by Teleport's Database Server CA or the ca_cert specified in this TLS
-    # setting. For cloud-hosted databases, Teleport downloads the corresponding
-    # required CAs for validation.
-    trust_system_cert_pool: false
-
-  # Database admin user for automatic user provisioning.
-  admin_user:
-    # Database admin user name.
-    name: "teleport-admin"
-
-  # MySQL only options.
-  mysql:
-    # The MySQL server version reported by the Teleport Proxy Service.
-    # Teleport uses this string when reporting the server version to a 
-    # connecting client.
-    #
-    # When this option is not set, the Database Service will try to connect to
-    # a MySQL instance on startup and fetch the server version. Otherwise, 
-    # it will use the provided value without connecting to a database. 
-    #
-    # In both cases, the MySQL server version reported to a client will be 
-    # updated on the first successful connection made by a user.
-    # Teleport uses that string instead of default '8.0.0-Teleport' version when reporting
-    # the server version to a connecting client. When this option is not set, the Database Service will try
-    # to connect to MySQL instance on startup and fetch the server version.
-    # Otherwise, it will use the provided value without connecting to a database.
-    # In both cases MySQL server version reported to a client will be updated on the first successful
-    # connection made by a user.
-    server_version: 8.0.28
-
-  # Optional AWS configuration for RDS/Aurora/Redshift. Can be auto-detected from the endpoint.
-  aws:
-    # Region the database is deployed in.
-    region: "us-east-1"
-    # Optional AWS role that the Database Service will assume to access
-    # this database.
-    assume_role_arn: "arn:aws:iam::123456789012:role/example-role-name"
-    # Optional AWS external ID that the Database Service will use to assume
-    # a role in an external AWS account.
-    external_id: "example-external-id"
-    # Redshift specific configuration.
-    redshift:
-      # Redshift cluster identifier.
-      cluster_id: "redshift-cluster-1"
-
-  # GCP configuration (required for Cloud SQL and Spanner databases).
-  gcp:
-    # GCP project ID.
-    project_id: "xxx-1234"
-    # Cloud SQL instance ID.
-    instance_id: "example"
-
-  # Settings specific to Active Directory authentication e.g. for SQL Server.
-  ad:
-    # Path to Kerberos keytab file.
-    keytab_file: /path/to/keytab
-    # Active Directory domain name.
-    domain: EXAMPLE.COM
-    # Service Principal Name to obtain Kerberos tickets for.
-    spn: MSSQLSvc/ec2amaz-4kn05du.dbadir.teleportdemo.net:1433
-    # Optional path to Kerberos configuration file. Defaults to /etc/krb5.conf.
-    krb5_file: /etc/krb5.conf
-
-  # Optional dynamic labels.
-  dynamic_labels:
-  - name: "hostname"
-    command: ["hostname"]
-    period: 1m0s
-```
-
-You can create a new `db` resource by running the following commands, which
-assume that you have created a YAML file called `db.yaml` with your configuration:
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-# You can also run tctl on your Auth Service host without running "tsh login"
-# first.
-$ tsh login --proxy=teleport.example.com --user=myuser
-# Create the resource
-$ tctl create -f db.yaml
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
-
-```code
-# Log in to your Teleport cluster so you can use tctl from your local machine.
-$ tsh login --proxy=mytenant.teleport.sh --user=myuser
-# Create the resource
-$ tctl create -f db.yaml
-```
-
-</TabItem>
-
-</Tabs>
-
diff --git a/docs/pages/reference/agent-services/database-access-reference/database-access-reference.mdx b/docs/pages/reference/agent-services/database-access-reference/database-access-reference.mdx
deleted file mode 100644
index 565379ff08f02..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/database-access-reference.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: Database Access Reference
-description: Configuration and CLI reference for the Teleport Database Service.
----
-
-- [Configuration](configuration.mdx)
-- [CLI](cli.mdx)
-- [Audit Events](audit.mdx)
-- [AWS IAM](aws.mdx)
-- [Database Labels](labels.mdx)
diff --git a/docs/pages/reference/agent-services/database-access-reference/labels.mdx b/docs/pages/reference/agent-services/database-access-reference/labels.mdx
deleted file mode 100644
index f33aab6c1449e..0000000000000
--- a/docs/pages/reference/agent-services/database-access-reference/labels.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: Database Labels Reference
-description: Database labels reference for Teleport database access.
----
-
-Teleport assigns system-defined labels to protected databases. This guide
-describes the system-defined labels and how Teleport uses them.
-
-## Origin
-
-All registered databases have a predefined `teleport.dev/origin` label with one
-of the following values:
-
-| Label Value | Description |
-| - | - |
-| `cloud`   | database resources created by auto-discovery. |
-| `config`  | database resources manually defined in the `database_service.databases` section of `teleport.yaml`. |
-| `dynamic` | database resources created through [dynamic registration](../../../enroll-resources/database-access/guides/dynamic-registration.mdx) like `tcl create` command. |
-
-## Auto-discovery
-
-The labels of auto-discovered databases primarily come from the tags that are
-assigned to the original cloud resources, such as the resources tags of an
-Amazon RDS instance. 
-
-The following tags will override Teleport's default behavior if assigned to the
-original cloud resources:
-
-| Tag name | Description |
-| - | - |
-| `TeleportDatabaseName`                   | Overrides the name of the discovered database. |
-| `teleport.dev/database_name`             | (AWS only, legacy) Overrides the name of the discovered database. `TeleportDatabaseName` is preferred. |
-| `teleport.dev/db-admin`                  | (AWS only) Specifies the name of the admin user for Automatic User Provisioning. |
-| `teleport.dev/db-admin-default-database` | (AWS only) Overrides the default database the admin user logs into for Automatic User Provisioning. |
-
-Additionally, Teleport will generate certain labels derived from the cloud
-resource attributes:
-
-| Label name | Description |
-| - | - |
-| `account-id`       | ID of the AWS account the resource resides in. |
-| `endpoint-type`    | Type of the endpoint. See section below for more details. |
-| `engine`           | Amazon RDS: engine type of the RDS instance or Aurora cluster.<br/>Amazon RDS Proxy: engine family of the proxy.<br/>Azure-hosted databases: resource type of the resource ID. |
-| `engine-version`   | Database engine version, if available. |
-| `namespace`        | Amazon Redshift Serverless namespace name. |
-| `region`           | AWS region or Azure location. |
-| `replication-role` | The replication role of an Azure DB Flexible server. |
-| `source-server`    | The source server of an Azure DB Flexible server replica. |
-| `vpc-id`           | ID of the Amazon VPC the resource resides in, if available. |
-| `workgroup`        | Amazon Redshift Serverless workgroup name. |
-| `teleport.dev/discovery-type` | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "rds", "redshift", etc. |
-
-### `endpoint-type`
-
-The following values are used to indicate the type of the database endpoint:
-
-| Database Type | Values |
-| - | - |
-| Amazon RDS instance              | `instance` |
-| Amazon RDS Aurora cluster        | one of `primary`, `reader`, `custom` |
-| Amazon RDS Proxy                 | one of `READ_WRITE`, `READ_ONLY` (custom endpoints only) |
-| Amazon Redshift Serverless       | one of `workgroup`, `vpc-endpoint` |
-| Amazon ElastiCache               | one of `configuration`, `primary`, `reader`, `node` |
-| Amazon MemoryDB                  | one of `cluster`, `node` |
-| Amazon OpenSearch                | one of `default`, `custom`, `vpc` |
-| Azure Redis Enterprise           | one of `EnterpriseCluster`, `OSSCluster` |
-
-## Manual and dynamic registration
-
-Static labels and dynamic labels can be specified in `labels` and
-`dynamic_labels` fields respectively in database definition. See
-[Configuration](./configuration.mdx) for reference.
-
-## Database Service on Amazon EC2
-
-All registered databases can inherit the labels converted from the tags of the
-EC2 instance running the Teleport Database Service. Labels created this way
-will have the `aws/` prefix. See [Sync EC2
-Tags](../../../admin-guides/management/guides/ec2-tags.mdx) for more details.
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/audit.mdx b/docs/pages/reference/agent-services/desktop-access-reference/audit.mdx
deleted file mode 100644
index 8da5f7f531d63..0000000000000
--- a/docs/pages/reference/agent-services/desktop-access-reference/audit.mdx
+++ /dev/null
@@ -1,250 +0,0 @@
----
-title: Desktop Access Audit Events Reference
-description: Audit events reference for Teleport desktop access.
----
-
-This guide lists the structures and field names of audit events related to
-connecting to remote desktops with Teleport. Use this guide to understand
-desktop-related audit events and configure your log management solutions if you
-are [exporting audit
-events](../../../admin-guides/management/export-audit-events/export-audit-events.mdx).
-
-## windows.desktop.session.start (TDP00I/W)
-
-Emitted when a client successfully connects to a desktop or when a connection
-attempt fails because access was denied.
-
-Successful connection event:
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP00I",
-  "desktop_addr": "192.168.1.206:3389",
-  "desktop_labels": {
-    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
-    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
-    "teleport.dev/is_domain_controller": "true",
-    "teleport.dev/origin": "dynamic",
-    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
-    "teleport.dev/os_version": "6.3 (9600)",
-    "teleport.dev/windows_domain": "teleport.example.com"
-  },
-  "ei": 0,
-  "event": "windows.desktop.session.start",
-  "login": "administrator",
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "success": true,
-  "time": "2022-02-16T16:43:30.459Z",
-  "uid": "1605346b-d90b-4df7-8148-67a3e2d85673",
-  "user": "alice",
-  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
-  "windows_domain": "teleport.example.com",
-  "windows_user": "administrator"
-}
-```
-
-Access denied event:
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP00W",
-  "desktop_addr": "192.168.1.206:3389",
-  "desktop_labels": {
-    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
-    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
-    "teleport.dev/is_domain_controller": "true",
-    "teleport.dev/origin": "dynamic",
-    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
-    "teleport.dev/os_version": "6.3 (9600)",
-    "teleport.dev/windows_domain": "teleport.example.com"
-  },
-  "ei": 0,
-  "error": "access to desktop denied", // Connection error
-  "event": "windows.desktop.session.start",
-  "message": "access to desktop denied", // Detailed error message.
-  "login": "administrator",
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "success": false, // Indicates unsuccessful connection
-  "time": "2022-02-16T16:43:30.459Z",
-  "uid": "1605346b-d90b-4df7-8148-67a3e2d85673",
-  "user": "alice",
-  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
-  "windows_domain": "teleport.example.com",
-  "windows_user": "administrator"
-}
-```
-
-## windows.desktop.session.end (TDP01I)
-
-Emitted when a client disconnects from the desktop.
-
-```json
-{
-  "cluster_name": "root",
-  "code": "TDP01I",
-  "desktop_addr": "192.168.1.206:3389",
-  "desktop_labels": {
-    "teleport.dev/computer_name": "WIN-I44F9TN11M3",
-    "teleport.dev/dns_host_name": "WIN-I44F9TN11M3.teleport.example.com",
-    "teleport.dev/is_domain_controller": "true",
-    "teleport.dev/origin": "dynamic",
-    "teleport.dev/os": "Windows Server 2012 R2 Standard Evaluation",
-    "teleport.dev/os_version": "6.3 (9600)",
-    "teleport.dev/windows_domain": "teleport.example.com"
-  },
-  "desktop_name": "WIN-I44F9TN11M3-teleport-example-com",
-  "ei": 0,
-  "event": "windows.desktop.session.end",
-  "login": "administrator",
-  "participants": ["alice"],
-  "recorded": true,
-  "session_start": "2022-02-16T16:43:30.459Z",
-  "session_stop": "2022-02-16T16:46:50.894Z",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "time": "2022-02-16T16:46:50.895Z",
-  "uid": "c7956a81-597f-4452-90d7-800506f7a05b",
-  "user": "alice",
-  "windows_desktop_service": "316a3ffa-23e6-4d85-92a1-5e44754f8189",
-  "windows_domain": "teleport.example.com",
-  "windows_user": "administrator"
-}
-```
-
-## desktop.clipboard.send (TDP02I)
-
-Emitted when clipboard data is sent from a user's workstation to Teleport. In
-order to avoid capturing sensitive data, the event only records the number of
-bytes that were sent.
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP02I",
-  "desktop_addr": "192.168.1.206:3389",
-  "ei": 0,
-  "event": "desktop.clipboard.send",
-  "length": 4, // number of bytes sent
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "time": "2022-02-16T16:43:40.010217Z",
-  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
-  "user": "alice"
-}
-```
-
-## desktop.clipboard.receive (TDP03I)
-
-Emitted when Teleport receives clipboard data from a remote desktop. In order to
-avoid capturing sensitive data, the event only records the number of bytes that
-were received.
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP03I",
-  "desktop_addr": "192.168.1.206:3389",
-  "ei": 0,
-  "event": "desktop.clipboard.receive",
-  "length": 4, // number of bytes received
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "time": "2022-02-16T16:43:40.010217Z",
-  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
-  "user": "alice"
-}
-```
-
-## desktop.directory.share (TDP04I/W)
-
-Emitted when Teleport starts sharing a directory on a local machine to the remote desktop.
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP04I", // TDP04W if the operation failed
-  "desktop_addr": "192.168.1.206:3389",
-  "directory_id": 2,
-  "directory_name": "local-files",
-  "ei": 0,
-  "event": "desktop.directory.share",
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "success": true, // false if the operation failed
-  "time": "2022-10-21T22:36:27.314409Z",
-  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
-  "user": "alice"
-}
-```
-
-## desktop.directory.read (TDP05I/W)
-
-This event is part of the directory sharing feature, and is emitted when
-Teleport reads data from a file on the user's local machine and sends it
-to the remote Windows desktop.
-
-In order to avoid capturing sensitive data, the event only records the offset
-from the start of the file from which the read began and the number of bytes
-that were sent.
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP05I", // TDP05W if the operation failed
-  "desktop_addr": "192.168.1.206:3389",
-  "directory_id": 2,
-  "directory_name": "local-files",
-  "ei": 0,
-  "event": "desktop.directory.read",
-  "file_path": "powershell-scripts/a-script.ps1", // relative path from the root of the shared directory (local-files in this case)
-  "length": 734, // the number of bytes read
-  "offset": 0, // the offset from the start of the file from which the read began
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "success": true, // false if the operation failed
-  "time": "2022-10-21T22:36:27.314409Z",
-  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
-  "user": "alice"
-}
-```
-
-## desktop.directory.write (TDP06I/W)
-
-This event is part of the directory sharing feature, and is emitted when
-Teleport reads writes from the remote desktop to a file on the user's local
-machine.
-
-In order to avoid capturing sensitive data, the event only records the offset
-from the start of the file from which the write began and the number of bytes
-that were written.
-
-```json
-{
-  "addr.remote": "192.168.1.206:3389",
-  "cluster_name": "root",
-  "code": "TDP06I", // TDP06W if the operation failed
-  "desktop_addr": "192.168.1.206:3389",
-  "directory_id": 2,
-  "directory_name": "local-files",
-  "ei": 0,
-  "event": "desktop.directory.read",
-  "file_path": "powershell-scripts/a-script.ps1", // relative path from the root of the shared directory (local-files in this case)
-  "length": 734, // the number of bytes written
-  "offset": 0, // the offset from the start of the file from which the write began
-  "proto": "tdp",
-  "sid": "4a0ed655-1e0b-412b-b14a-348e840e7fa2",
-  "success": true, // false if the operation failed
-  "time": "2022-10-21T22:36:27.314409Z",
-  "uid": "e45d9890-38a9-4580-8572-35fa0192b123",
-  "user": "alice"
-}
-```
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/cli.mdx b/docs/pages/reference/agent-services/desktop-access-reference/cli.mdx
deleted file mode 100644
index f6398dee6462c..0000000000000
--- a/docs/pages/reference/agent-services/desktop-access-reference/cli.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
----
-title: Desktop Access CLI Reference
-description: CLI reference for Teleport desktop access.
----
-
-The following `tctl` commands are used to manage the Teleport Windows Desktop
-Service.
-
-- (!docs/pages/includes/tctl.mdx!)
-
-Generate a join token for a Windows Desktop Service:
-
-```sh
-$ tctl tokens add --type=WindowsDesktop
-```
-
-List registered Windows Desktop Services:
-
-```sh
-$ tctl get windows_desktop_service
-```
-
-List registered Windows desktops:
-
-```sh
-$ tctl get windows_desktop
-```
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/configuration.mdx b/docs/pages/reference/agent-services/desktop-access-reference/configuration.mdx
deleted file mode 100644
index 1f487b4e828ca..0000000000000
--- a/docs/pages/reference/agent-services/desktop-access-reference/configuration.mdx
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: Desktop Access Configuration Reference
-description: Configuration reference for Teleport desktop access.
----
-
-`teleport.yaml` fields related to desktop access:
-
-```yaml
-# Main service responsible for desktop access.
-#
-# You can have multiple Desktop Service instances in your cluster (but not in the
-# same teleport.yaml), connected to the same or different Active Directory
-# domains.
-(!docs/pages/includes/config-reference/desktop-config.yaml!)
-```
-
-## Deployment
-
-The Windows Desktop Service can be deployed in two modes.
-
-### Direct mode
-
-In *direct* mode, Windows Desktop Services registers directly with the Teleport
-Auth Service, and listens for desktop connections from the Teleport Proxy. To
-enable direct mode, set `windows_desktop_service.listen_addr` in
-`teleport.yaml`, and ensure that `teleport.auth_server` points directly at the
-Auth Service.
-
-Direct mode requires network connectivity both:
-
-- from the Teleport Proxy to the Windows Desktop Service.
-- from the Windows Desktop Service to the Auth Service.
-
-For these reasons direct mode is not available in Teleport cloud, only
-self-hosted Teleport clusters.
-
-### IoT mode (reverse tunnel)
-
-In *IoT mode*, Windows Desktop Service only needs to be able to make an outbound
-connection to a Teleport Proxy. The Windows Desktop Service establishes a
-reverse tunnel to the proxy, and both registration with the Auth Service and
-desktop sessions are performed over this tunnel. To enable this mode, ensure
-that `windows_desktop_service.listen_addr` is *unset*, and point
-`teleport.proxy_server` at a Teleport Proxy.
-
-## Screen size
-
-By default, Teleport will set the screen size of the remote desktop session
-based on the size of your browser window. In some cases, you may wish to
-configure specific hosts to use a specific screen size. To do this, set the
-`screen_size` attribute on the `windows_desktop` resource:
-
-```yaml
-kind: windows_desktop
-metadata:
-  name: fixed-screen-size
-spec:
-  host_id: 307e091b-7f6b-42e0-b78d-3362ad10b55d
-  addr: 192.168.1.153:3389
-  non_ad: true
-
-  # Optional - ensures that all sessions use the same screen size,
-  # no matter what the size of the browser window is.
-  # Leave blank to use the size of the browser window.
-  screen_size:
-    width: 1024
-    height: 768
-```
diff --git a/docs/pages/reference/agent-services/desktop-access-reference/desktop-access-reference.mdx b/docs/pages/reference/agent-services/desktop-access-reference/desktop-access-reference.mdx
deleted file mode 100644
index 6301559fd876c..0000000000000
--- a/docs/pages/reference/agent-services/desktop-access-reference/desktop-access-reference.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: Desktop Access Reference
-description: Comprehensive guides to configuring and auditing desktop access.
-layout: tocless-doc
----
-
-- [Configuration](configuration.mdx): Configure Teleport desktop access.
-- [Audit](audit.mdx): Desktop access audit events.
-- [Clipboard](clipboard.mdx): Share your clipboard with a remote desktop.
-- [Session Recording](sessions.mdx): Desktop session recording and playback
-- [CLI](cli.mdx): Relevant `tctl` commands
-- [Scaling](../../../admin-guides/management/operations/scaling.mdx): Tips on scaling to many concurrent users.
-- [User creation](user-creation.mdx): Automatic user creation
\ No newline at end of file
diff --git a/docs/pages/reference/agent-services/okta.mdx b/docs/pages/reference/agent-services/okta.mdx
deleted file mode 100644
index 69ebd3bdf74e0..0000000000000
--- a/docs/pages/reference/agent-services/okta.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: Okta Service Reference Documentation
-description: Configuration and CLI reference documentation for Teleport Okta service.
----
-
-This guide describes interfaces and options for configuring the Teleport Okta
-Service, including Okta import rules, Okta assignments, and `tctl` commands. It
-also includes troubleshooting instructions.
-
-## Okta Import Rule resources
-
-Full YAML spec of Okta import rule resources managed by `tctl` resource commands:
-
-(!docs/pages/includes/okta-import-rule.mdx!)
-
-You can create a new `okta_import_rule` resource by running the following commands, which
-assume that you have created a YAML file called `okta-import-rule.yaml` with your configuration:
-
-```code
-# Log in to your cluster with tsh so you can use tctl from your local machine.
-# You can also run tctl on your Auth Service host without running "tsh login"
-# first.
-$ tsh login --proxy=teleport.example.com --user=myuser
-# Create the resource
-$ tctl create -f okta-import-rule.yaml
-```
-
-## Okta Assignment resources
-
-These objects are internally facing and are not intended to be modified by users. However,
-you can query them for informational or debugging purposes.
-
-Full YAML spec of Okta assignment resources queried by `tctl` resource commands:
-
-```yaml
-kind: okta_assignment
-version: v1
-metadata:
-  name: test-assignment
-spec:
-  # The user that the Okta assignment is granting access for.
-  user: test-user@test.user
-  # The list of targets to grant access to.
-  targets:
-  # An application target.
-  - type: application
-    id: "123456"
-  # A group target.
-  - type: group
-    id: "234567"
-  # The current status of the Okta assignment.
-  status: pending
-```
-
-## CLI
-
-This section shows CLI commands relevant for managing Okta Service behaviors.
-
-### tctl get okta_import_rules
-
-Lists available Okta import rules.
-
-```code
-$ tctl get okta_import_rules
-```
-
-### tctl get okta_import_rules/NAME
-
-Gets an individual Okta import rule.
-
-```code
-$ tctl get okta_import_rules/my-import-rule
-```
-
-### tctl rm okta_import_rules/NAME
-
-Removes an individual Okta import rule.
-
-```code
-$ tctl rm okta_import_rules/my-import-rule
-```
-
-### tctl get okta_assignments
-
-Lists available Okta assignments.
-
-```code
-$ tctl get okta_assignments
-```
-
-### tctl get okta_assignments/NAME
-
-Gets an individual Okta assignment.
-
-```code
-$ tctl get okta_assignments/my-assignment
-```
-
-## Troubleshooting
-
-### No Okta groups or applications seen in the Teleport UI
-
-If the Teleport applications UI isn't displaying any Okta applications, ensure
-that the Okta API token and endpoint are correct in the Okta service.
-
-If they are, double check the user permissions and ensure that the user has
-appropriate resource and label level access to the groups and applications. You
-may need to tweak the `app_labels` and `group_labels` sections of a role in order
-to see these resources.
diff --git a/docs/pages/reference/architecture/agent-update-management.mdx b/docs/pages/reference/architecture/agent-update-management.mdx
index d94ca01ff0db9..052fd1999da9f 100644
--- a/docs/pages/reference/architecture/agent-update-management.mdx
+++ b/docs/pages/reference/architecture/agent-update-management.mdx
@@ -1,6 +1,9 @@
 ---
 title: Managed Updates
 description: This chapter explains how Teleport Agent Managed Updates work.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 While many Teleport resources [support agentless
@@ -112,7 +115,9 @@ updated properly.
 
 ## Next steps
 
-[Configure automatic updates v2](../../upgrading/agent-managed-updates.mdx).
+[Configure Managed Updates v2](../../upgrading/agent-managed-updates/agent-managed-updates.mdx) in your cluster.
+
+Consult the [Managed Updates v2 Resource Reference](../deployment/managed-updates-v2.mdx)
 
 After that, you can set enroll agents in automatic updates as part of the
 [upgrading procedure](../../upgrading/upgrading.mdx).
diff --git a/docs/pages/reference/architecture/agents.mdx b/docs/pages/reference/architecture/agents.mdx
index 2577824089df7..53ce0dc342eb1 100644
--- a/docs/pages/reference/architecture/agents.mdx
+++ b/docs/pages/reference/architecture/agents.mdx
@@ -1,7 +1,11 @@
 ---
 title: Teleport Agent Architecture
+sidebar_label: Agents
 description: Describes the architecture that enables Teleport to securely proxy client traffic to infrastructure resources. 
-tocDepth: 3
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 **Teleport Agents** route traffic to and from resources in your infrastructure.
@@ -173,7 +177,7 @@ To learn more about the mechanism an agent uses to authenticate to an
 infrastructure resource, read the guide to enrolling that resource in your
 Teleport cluster:
 
-- [Applications](../../enroll-resources/application-access/guides/guides.mdx)
+- [Applications](../../enroll-resources/application-access/application-access.mdx)
 - [Cloud provider APIs](../../enroll-resources/application-access/cloud-apis/cloud-apis.mdx)
 - [Databases](../../enroll-resources/database-access/guides/guides.mdx)
 - [Kubernetes clusters](../../enroll-resources/kubernetes-access/register-clusters/register-clusters.mdx)
@@ -216,7 +220,7 @@ In most cases, users will receive certificates from the Auth Service via a
 connection to the Teleport Proxy Service. The Auth Service and Proxy Service
 connect to each other using mutual TLS.
 
-[Teleport Connect](../../connect-your-client/teleport-connect.mdx) runs `tshd`, a
+[Teleport Connect](../../connect-your-client/teleport-clients/teleport-connect.mdx) runs `tshd`, a
 `tsh` daemon that manages user certificates and kubeconfigs for the graphical
 client.
 
@@ -225,9 +229,9 @@ client.
 Teleport makes several client tools available for accessing infrastructure
 resources through agents:
 
-- [The `tsh` CLI](../../connect-your-client/tsh.mdx)
-- [Teleport Connect](../../connect-your-client/teleport-connect.mdx)
-- [Teleport Web UI](../../connect-your-client/web-ui.mdx)
+- [The `tsh` CLI](../../connect-your-client/teleport-clients/tsh.mdx)
+- [Teleport Connect](../../connect-your-client/teleport-clients/teleport-connect.mdx)
+- [Teleport Web UI](../../connect-your-client/teleport-clients/web-ui.mdx)
 
 After retrieving [client credentials](#credentials-for-teleport-clients), these
 tools are authenticated to the Teleport Proxy Service and can send traffic
@@ -250,12 +254,12 @@ CLI:
 
 |`tsh` command|Upstream infrastructure resource|
 |---|---|
-|`tsh proxy app`|HTTP and [TCP](../../enroll-resources/application-access/guides/tcp.mdx) applications|
+|`tsh proxy app`|HTTP and [TCP](../../enroll-resources/application-access/protect-apps/tcp.mdx) applications|
 |`tsh proxy aws`|[AWS SDK applications](../../enroll-resources/application-access/cloud-apis/aws-console.mdx)|
 |`tsh proxy azure`|[Azure SDK applications](../../enroll-resources/application-access/cloud-apis/azure.mdx)|
 |`tsh proxy gcloud`|[Google Cloud SDK applications](../../enroll-resources/application-access/cloud-apis/google-cloud.mdx)|
 |`tsh proxy ssh`|[OpenSSH client traffic](../../enroll-resources/server-access/openssh/openssh-agentless.mdx)|
-|`tsh proxy db`|[Native database clients](../../connect-your-client/gui-clients.mdx)|
+|`tsh proxy db`|[Native database clients](../../connect-your-client/third-party/gui-clients.mdx)|
 |`tsh proxy kube`|[Kubernetes clusters behind L7 load balancers](tls-routing.mdx#kubernetes)|
 
 </details>
@@ -273,7 +277,7 @@ interacts with a resource, and signs out. Agents interpret the wire protocol
 messages they forward to infrastructure resources in order to detect events.
 
 Learn more about the Teleport audit events in the [Audit Event
-Reference](../monitoring/audit.mdx).
+Reference](../deployment/monitoring/audit.mdx).
 
 ## Further reading
 
diff --git a/docs/pages/reference/architecture/api-architecture.mdx b/docs/pages/reference/architecture/api-architecture.mdx
index efb28745ec113..6c2eee4817ba6 100644
--- a/docs/pages/reference/architecture/api-architecture.mdx
+++ b/docs/pages/reference/architecture/api-architecture.mdx
@@ -1,13 +1,17 @@
 ---
 title: API Architecture
+sidebar_label: API
 description: Architectural overview of the Teleport gRPC API.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 This guide describes the architecture of the Teleport gRPC API, which enables
 clients like `tctl`, the Teleport Terraform provider, and the Teleport
 Kubernetes operator to manage dynamic resources in your Teleport cluster. If you
 are new to the Teleport gRPC API, read how to [Get
-Started](../../admin-guides/api/getting-started.mdx).
+Started](../../zero-trust-access/api/getting-started.mdx).
 
 ## Authentication
 
@@ -28,9 +32,11 @@ action on the `role` resource. You should create a user and role with the minimu
 
 (!docs/pages/includes/permission-warning.mdx!)
 
+Copy and paste the below and run on the Teleport Auth Service:
+
 ```code
-# Copy and Paste the below and run on the Teleport Auth server.
-cat > api-role.yaml <<EOF
+# Create role configuration
+$ cat > api-role.yaml <<EOF
 kind: role
 metadata:
   name: api-role
@@ -45,9 +51,9 @@ spec:
 version: v5
 EOF
 # Create role
-tctl create -f api-role.yaml
+$ tctl create -f api-role.yaml
 # Add user and login via web proxy
-tctl users add api-user --roles=api-role
+$ tctl users add api-user --roles=api-role
 ```
 
 See our [roles](../access-controls/roles.mdx) documentation for more details
@@ -70,11 +76,11 @@ benefits, here's a quick breakdown:
  - Identity File credentials are the most well-rounded in terms of usability,
    functionality, and customizability. Identity files can be generated through
    `tsh login`, `tctl auth sign`, or with
-   [Machine ID](../../enroll-resources/machine-id/introduction.mdx).
+   [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx).
  - Dynamic Identity File credentials are Identity File credentials with support for
-   reloading credentials from disk. This makes them appropriate for Machine ID
-   integrations, as you can reload the credentials when Machine ID rotates the
-   underlying identity files.
+   reloading credentials from disk. This makes them appropriate for Machine &
+   Workload Identity integrations, as you can reload the credentials when
+   Machine & Workload Identity rotates the underlying identity files.
  - Key pair credentials have a much simpler implementation than the other
    Credentials listed and may feel more familiar. These are good for
    authenticating clients hosted directly on the Auth Service.
diff --git a/docs/pages/reference/architecture/architecture.mdx b/docs/pages/reference/architecture/architecture.mdx
index b4a7d52427264..990523c0ea020 100644
--- a/docs/pages/reference/architecture/architecture.mdx
+++ b/docs/pages/reference/architecture/architecture.mdx
@@ -1,6 +1,10 @@
 ---
 title: Teleport Architecture
+sidebar_label: Architecture
 description: Provides detailed information about how Teleport works.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 This guide explains the technical architecture of Teleport. Before reading this
@@ -53,7 +57,7 @@ Read more about [Teleport Proxy Service Architecture](proxy.mdx). You can also
 read about the architecture of Teleport Proxy Service features:
 
 - [TLS Routing](tls-routing.mdx)
-- [Proxy Peering](proxy-peering.mdx)
+- [Proxy Peering](../../zero-trust-access/deploy-a-cluster/proxy-peering.mdx)
 
 ## Enrolling resources
 
@@ -61,17 +65,17 @@ Administrators can **enroll** infrastructure resources with a Teleport cluster
 to provide secure access, RBAC, and auditing. There are three ways to enroll
 infrastructure resources with a Teleport cluster:
 
-- **Teleport Agents** proxy traffic from human users to and from
+- **Teleport Agents** proxy traffic from users to and from
   Teleport-protected infrastructure resources.
-- **Machine ID Bots** receive short-lived credentials from the `tbot` binary so
-  service accounts can access infrastructure.
+- **Machine & Workload Identity Bots** receive short-lived credentials from the
+  `tbot` binary so service accounts can access infrastructure.
 - **Trusted clusters** allow a user of one Teleport cluster to access
   infrastructure that is enrolled with another Teleport cluster by federating
   trust across multiple Teleport clusters.
 
 ### Teleport Agents
 
-Teleport Agents proxy traffic from users to resources in your infrastructure.
+Teleport Agents proxy traffic from users, human or machine, to resources in your infrastructure.
 Agents are instances of the `teleport` binary configured to run certain
 services, e.g., the Teleport SSH Service and Teleport Kubernetes Service, and
 administrators deploy Agents on their own infrastructure.
@@ -99,20 +103,21 @@ about the architecture of Teleport Agent features:
 - [Session recordings](session-recording.mdx): Teleport Agents record user
   sessions and send the data to the Auth Service for storage.
 
-### Machine ID
+### Machine & Workload Identity
 
-Machine ID is a Teleport system that enables automated services to access
-Teleport-protected infrastructure with regularly updated credentials.
-Administrators register a Bot user with Teleport that, like a human user, is
-assigned Teleport roles. 
+Machine & Workload Identity is a Teleport product that enables automated
+services to access Teleport-protected infrastructure with regularly updated
+credentials. Administrators register a Bot user with Teleport that, like a human
+user, is assigned Teleport roles.
 
 Instances of the `tbot` binary communicate with the Teleport Auth Service to
 continuously refresh credentials. As with Agents, administrators must deploy
 `tbot` instances on their own infrastructure, including on CI/CD platforms such
 as GitHub Actions, and [join
-them](../../enroll-resources/machine-id/deployment/deployment.mdx) to a cluster.
+them](../../machine-workload-identity/deployment/deployment.mdx) to a cluster.
 
-Read more about [Machine ID Architecture](machine-id-architecture.mdx).
+Read more about
+[Machine & Workload Identity Architecture](machine-id-architecture.mdx).
 
 ### Trusted clusters
 
diff --git a/docs/pages/reference/architecture/authentication.mdx b/docs/pages/reference/architecture/authentication.mdx
index 8129dc877f331..f56f5e4d5f54d 100644
--- a/docs/pages/reference/architecture/authentication.mdx
+++ b/docs/pages/reference/architecture/authentication.mdx
@@ -1,7 +1,10 @@
 ---
 title: Teleport Authentication
+sidebar_label: Authentication
 description: This chapter explains how Teleport uses certificate authorities to authenticate users and services.
-h1: Teleport Authentication with Certificates
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Teleport handles both authentication and authorization.
@@ -85,7 +88,7 @@ Instead of distributing revocation lists, Teleport relies on time to do the job
 <Admonition type="tip">
 In some cases, certificate expiration is not fast enough, and all sessions have to be terminated immediately,
 for example during active security incident.
-For those cases, Teleport Proxy can terminate live connections using [session and identity locking](../../admin-guides/access-controls/guides/locking.mdx).
+For those cases, Teleport Proxy can terminate live connections using [session and identity locking](../../identity-governance/locking.mdx).
 </Admonition>
 
 ### Short-lived Certs For Users
@@ -98,15 +101,15 @@ We recommend using SSO with GitHub, Okta or any other identity provider and get
 
 ### Short-lived Certs for Services
 
-Deployment automation services, such as Jenkins, can use Teleport's Machine ID
-service to receive and renew certificates. Teleport Machine ID's bot runs alongside
-services and rotates SSH and X.509 certificates.
+Deployment automation services, such as Jenkins, can use Teleport's Machine &
+Workload Identity to receive and renew certificates. Teleport Machine & Workload
+Identity's Bot runs alongside services and rotates SSH and X.509 certificates.
 
 ![Certificates for services](../../../img/architecture/certs-machine-id@1.8x.svg)
 
 ### Internal certificates
 
-Teleport internal services - the Auth Service, Proxy Service, Agents, and Machine ID Bots - use certificates to identify themselves
+Teleport internal services - the Auth Service, Proxy Service, Agents, and Machine & Workload Identity Bots - use certificates to identify themselves
 within a cluster. To join services to the cluster and receive certificates, admins should use
 [short-lived tokens or cloud identity services](../../enroll-resources/agents/join-token.mdx).
 
@@ -116,14 +119,14 @@ To renew these certificates, admins should use certificate authority rotation, t
 previously-issued certificates for nodes or users regardless of expiry and issuing a new ones,
 using a new certificate authority.
 
-Take a look at the [Certificate Rotation Guide](../../admin-guides/management/operations/ca-rotation.mdx) to
+Take a look at the [Certificate Rotation Guide](../../zero-trust-access/management/security/ca-rotation.mdx) to
 learn how to do certificate rotation in practice.
 
 <Admonition type="tip">
 To quickly lock out a potentially compromised Auth Service instance, Proxy
 Service instance, or Teleport Agent without rotating the entire cluster
 certificates, use [session and identity
-locking](../../admin-guides/access-controls/guides/locking.mdx).
+locking](../../identity-governance/locking.mdx).
 </Admonition>
 
 ## More concepts
diff --git a/docs/pages/reference/architecture/authorization.mdx b/docs/pages/reference/architecture/authorization.mdx
index b67465d01541c..2b6ae0508d826 100644
--- a/docs/pages/reference/architecture/authorization.mdx
+++ b/docs/pages/reference/architecture/authorization.mdx
@@ -1,7 +1,11 @@
 ---
 title: Teleport Authorization
+sidebar_label: Authorization
 description: This chapter explains how Teleport authorizes users and roles.
-h1: Teleport Authorization
+tags:
+ - conceptual
+ - platform-wide
+ - privileged-access
 ---
 
 Teleport handles both authentication and authorization.
@@ -64,8 +68,8 @@ running in your organization.
 
 Local non-interactive users also have a user entry that maps their name to roles,
 but they do not have credentials stored in the database.
-Non-interactive users have to use Teleport's machine ID product to receive and renew certificates.
-Teleport Machine ID's bot runs alongside services and rotates SSH and X.509 certificates on behalf
+Non-interactive users have to use Teleport Machine & Workload Identity product to receive and renew certificates.
+Teleport Machine & Workload Identity's Bot runs alongside services and rotates SSH and X.509 certificates on behalf
 of non-interactive users:
 
 ![Certificates for services](../../../img/architecture/certs-machine-id@1.8x.svg)
@@ -385,8 +389,8 @@ spec:
 ## Next steps
 
 - [Access Control Reference](../access-controls/roles.mdx).
-- [Teleport Predicate Language](../predicate-language.mdx).
-- [Access Requests Guides](../../admin-guides/access-controls/access-requests/access-requests.mdx)
+- [Teleport Predicate Language](../access-controls/predicate-language.mdx).
+- [Access Requests Guides](../../identity-governance/access-requests/access-requests.mdx)
 - [Architecture Overview](../../core-concepts.mdx)
 - [Teleport Auth](authentication.mdx)
 - [Teleport Agents](agents.mdx)
diff --git a/docs/pages/reference/architecture/device-trust.mdx b/docs/pages/reference/architecture/device-trust.mdx
index 6b615b108d86a..3ac35985069e0 100644
--- a/docs/pages/reference/architecture/device-trust.mdx
+++ b/docs/pages/reference/architecture/device-trust.mdx
@@ -1,6 +1,11 @@
 ---
-title: Device Trust
+title: Device Trust Architecture
+sidebar_label: Device Trust
 description: How Teleport Device Trust works.
+tags:
+ - conceptual
+ - identity-governance
+ - resiliency
 ---
 
 Device Trust leverages the macOS Secure Enclave, or TPM 2.0 on Linux and Windows
@@ -47,8 +52,8 @@ web][blog-post] blog post describes the implementation challenges in detail.
 
 For practical use see the [Device Trust section][section].
 
-[auto-enrollment]: ../../admin-guides/access-controls/device-trust/device-management.mdx#auto-enrollment
-[device enrollment tokens]: ../../admin-guides/access-controls/device-trust/device-management.mdx#create-a-device-enrollment-token
-[device enforcement]: ../../admin-guides/access-controls/device-trust/enforcing-device-trust.mdx
+[auto-enrollment]: ../../identity-governance/device-trust/device-management.mdx#auto-enrollment
+[device enrollment tokens]: ../../identity-governance/device-trust/device-management.mdx#create-a-device-enrollment-token
+[device enforcement]: ../../identity-governance/device-trust/enforcing-device-trust.mdx
 [blog-post]: https://goteleport.com/blog/device-trust-for-web-challenges-and-solutions/
-[section]: ../../admin-guides/access-controls/device-trust/device-trust.mdx
+[section]: ../../identity-governance/device-trust/device-trust.mdx
diff --git a/docs/pages/reference/architecture/kubernetes-applications-architecture.mdx b/docs/pages/reference/architecture/kubernetes-applications-architecture.mdx
index ff22c78b78144..833a717ed390f 100644
--- a/docs/pages/reference/architecture/kubernetes-applications-architecture.mdx
+++ b/docs/pages/reference/architecture/kubernetes-applications-architecture.mdx
@@ -1,6 +1,11 @@
 ---
 title: Kubernetes App Discovery Architecture
+sidebar_label: Kubernetes App Discovery
 description: Learn how Teleport automatically discovers applications running on Kubernetes.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Kubernetes application auto-discovery consists of two parts:
@@ -15,20 +20,20 @@ Kubernetes application auto-discovery consists of two parts:
 ### Polling Kubernetes services
 
 The Discovery Service running in a Kubernetes cluster will periodically list services and filter them out
-according to the matchers specified in `kubernetes` filed of the service config. You can filter services based on
+according to the matchers specified in `kubernetes` field of the service config. You can filter services based on
 types, namespaces and service labels. Services running in the `kube-system` and `kube-public` namespaces are
  automatically ignored. All services by default currently
-are considered of an "app" type, but it can be changed for a service by Kubernetes annotation [`teleport.dev/discovery-type`](../agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx).
+are considered of an "app" type, but it can be changed for a service by Kubernetes annotation [`teleport.dev/discovery-type`](../../enroll-resources/auto-discovery/kubernetes-applications/reference.mdx).
 If type of a service doesn't equal the one specified in the matcher, service is ignored.
 
-By default name of the created Teleport app will consist of Kubernetes service name, namespace and 
-Kubernetes cluster name: `$SERVICE_NAME-$NAMESPACE-$KUBE_CLUSTER_NAME`. That name can be changed by Kubernetes annotation 
-[`teleport.dev/name`](../agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx).
+By default name of the created Teleport app will consist of Kubernetes service name, namespace and
+Kubernetes cluster name: `$SERVICE_NAME-$NAMESPACE-$KUBE_CLUSTER_NAME`. That name can be changed by Kubernetes annotation
+[`teleport.dev/name`](../../enroll-resources/auto-discovery/kubernetes-applications/reference.mdx).
 
-Every port that is exposed by the service is considered separately, so one Kubernetes service can result in creation of multiple Teleport app resources, 
+Every port that is exposed by the service is considered separately, so one Kubernetes service can result in creation of multiple Teleport app resources,
 if more than one port is exposed on the service. In that case port name will be added to the app name.
 
-By default, the Discovery Service will only try to expose ports that serve HTTP/HTTPS. To understand if this port serves HTTP, discovery 
+By default, the Discovery Service will only try to expose ports that serve HTTP/HTTPS. To understand if this port serves HTTP, discovery
 will use several heuristics or will try to probe exposed port with a HEAD HTTP request.
 
 Heuristics for determining if port serves HTTP/HTTPS are:
@@ -38,13 +43,13 @@ values `http`/`https` it will be used in the URI.
 - Teleport will perform HTTP request to the port to see if it serves HTTP/HTTPS requests
 - if exposed port's name is `http` or it has numeric value 80 or 8080, `http` will be used.
 
-Otherwise, this port is ignored. But if annotation [`teleport.dev/protocol`](../agent-services/auto-discovery-reference/kubernetes-application-discovery.mdx) is used on the service and its value is
-"tcp", then this port will be exposed as a TCP app. 
+Otherwise, this port is ignored. But if annotation [`teleport.dev/protocol`](../../enroll-resources/auto-discovery/kubernetes-applications/reference.mdx) is used on the service and its value is
+"tcp", then this port will be exposed as a TCP app.
 
 ### Creating Teleport apps and proxying requests to them
 
 After relevant Kubernetes services were listed and filtered, the Discovery Service will create Teleport apps, reconciling
-existing and new ones: 
+existing and new ones:
 - If a discovered app was not present at the Teleport backend, it will be created
 - If a discovered app was already present at the backend, it will be updated
 - If a discovered app was already present at the backend, but it was not found in the Kubernetes cluster anymore, it will be deleted.
@@ -53,5 +58,3 @@ App service runs on the Kubernetes cluster and proxies apps based on labels spec
 Discovery Service will have labels copied from the service of origin. In addition, label `teleport.dev/kubernetes-cluster` will be set for
 the app and it will be equal to the name of the Kubernetes cluster of origin. Discovery service uses `discovery_group` property to get Kubernetes
 cluster name.
-
-
diff --git a/docs/pages/reference/architecture/machine-id-architecture.mdx b/docs/pages/reference/architecture/machine-id-architecture.mdx
index 36142ff26568d..dcfd763998e02 100644
--- a/docs/pages/reference/architecture/machine-id-architecture.mdx
+++ b/docs/pages/reference/architecture/machine-id-architecture.mdx
@@ -1,11 +1,18 @@
 ---
-title: Machine ID Architecture
-description: How Teleport Machine ID works.
+title: Machine & Workload Identity Architecture
+sidebar_label: Machine & Workload Identity
+description: How Teleport Machine & Workload Identity works.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
-This section provides an overview of Teleport Machine ID's inner workings.
+This section provides an overview of Teleport Machine & Workload Identity's
+inner workings.
 
-The initial specification and design for Machine ID can be found in
+The initial specification and design for Machine & Workload Identity can be
+found in
 [the Request For Discussion.](https://github.com/gravitational/teleport/blob/master/rfd/0064-bot-for-cert-renewals.md)
 
 ## What is a bot?
@@ -17,15 +24,16 @@ static username/password credentials.
 A bot does not exist as a single distinct resource within Teleport. Instead,
 they comprise three linked resources. These are:
 
-- Bot user: this will be the user that the Machine ID agent authenticates as.
+- Bot user: this will be the user that the Machine & Workload Identity agent
+  authenticates as.
 - Bot role: the bot user is assigned the bot role, and the bot role contains
   various permissions that the bot will need to function. For example, the
   ability to watch the certificate authorities and the ability to
   [impersonate roles](#role-impersonation).
 - Token: for [onboarding](#joining-and-authentication), a token must exist that
-  allows the Machine ID agent to initially authenticate as the bot user. If an
-  existing token is not specified, then a single-use token will be created by
-  the Auth Service.
+  allows the Machine & Workload Identity agent to initially authenticate as the
+  bot user. If an existing token is not specified, then a single-use token will
+  be created by the Auth Service.
 - Bot instance: a single instance of a bot. As multiple `tbot` clients can join
   with a single Bot user or a single token, Bot Instances keep a running record
   of unique bot joins.
@@ -39,7 +47,7 @@ many cases there may be multiple `tbot`'s using the same bot identity.
 ## Role Impersonation
 
 Role Impersonation is an RBAC feature of Teleport that is used heavily by
-Machine ID.
+Machine & Workload Identity.
 
 Role Impersonation allows a user to generate credentials with a set of requested
 roles. The user does not have to hold these roles, but must have been granted
@@ -50,18 +58,19 @@ the user.
 These credentials can then be used to complete any action that is allowed by the
 role's configured permissions.
 
-In the case of Machine ID, the bot user is assigned a bot role, which includes
-permissions to impersonate the roles that the user has configured.
+In the case of Machine & Workload Identity, the bot user is assigned a bot role,
+which includes permissions to impersonate the roles that the user has
+configured.
 
 ## `tbot`
 
-`tbot` is the binary that acts as the agent for Machine ID on your machines that
-need access to resources protected by Teleport. It is typically ran in one of
-two modes. By default, it is a daemon-like long-running process. This is
-suitable for situations where your machine is long running and will need
-continuous access to resources. `tbot` can also run in "oneshot" mode where it
-will fetch credentials for your machine once before exiting. This is ideal for
-short-lived environments such as CI/CD workflows.
+`tbot` is the binary that acts as the agent for Machine & Workload Identity on
+your machines that need access to resources protected by Teleport. It is
+typically ran in one of two modes. By default, it is a daemon-like long-running
+process. This is suitable for situations where your machine is long running and
+will need continuous access to resources. `tbot` can also run in "oneshot" mode
+where it will fetch credentials for your machine once before exiting. This is
+ideal for short-lived environments such as CI/CD workflows.
 
 Before `tbot` can be started, at least two parts of configuration will need to
 be provided via the configuration file or as arguments provided to `tbot` when
@@ -75,7 +84,7 @@ it is executed. This consists of:
   impersonated).
 
 For more detail about the configuration options, see
-[the reference.](../machine-id/machine-id.mdx)
+[the reference.](../machine-workload-identity/machine-workload-identity.mdx)
 
 On initial load, `tbot` uses the configured join method to obtain a set of
 credentials for the bot user from the Teleport Auth Service. It can then use
@@ -102,12 +111,12 @@ by the latest certificate authority.
 Joining is the process by which `tbot` initially authenticates as a bot with the
 Teleport Auth Service.
 
-Machine ID leverages the existing token resource within Teleport, with the
-token containing an additional `botName` field that identifies the bot user
-associated with the token.
+Machine & Workload Identity leverages the existing token resource within
+Teleport, with the token containing an additional `botName` field that
+identifies the bot user associated with the token.
 
-Machine ID currently supports two methods of joining that have some key
-differences.
+Machine & Workload Identity currently supports two methods of joining that have
+some key differences.
 
 ### Ephemeral token
 
@@ -166,10 +175,10 @@ host, like its architecture and OS version.
 As tracking Bot Instances requires bots to prove their identity during each
 authentication attempt, this does require bots to maintain state if they wish
 to keep a single Bot Instance ID over time. It isn't expected or feasible to
-keep state for many Machine ID use cases: for example, CI/CD workflows generally
-should rejoin from scratch each time. This is expected behavior, and bots with
-use cases like this will generate more unique Bot Instances than long-lived
-clients.
+keep state for many Machine & Workload Identity use cases: for example, CI/CD
+workflows generally should rejoin from scratch each time. This is expected
+behavior, and bots with use cases like this will generate more unique Bot
+Instances than long-lived clients.
 
 Bot Instances have a relatively short lifespan and are set to expire after the
 most recent identity issued for that instance will expire. If the `tbot` client
diff --git a/docs/pages/reference/architecture/proxy-peering.mdx b/docs/pages/reference/architecture/proxy-peering.mdx
deleted file mode 100644
index 245eca05ad760..0000000000000
--- a/docs/pages/reference/architecture/proxy-peering.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Proxy Peering
-description: How Teleport implements more efficient networking with Proxy Peering.
----
-
-Proxy Peering enables Teleport Agents to be reachable without connecting to
-every Teleport Proxy Service. This allows Teleport Proxy instances to scale
-horizontally without increasing the number of connections created by agents.
-
-<Admonition title="Note" type="tip">
-  A Teleport Agent is a Teleport instance that provides access to resources in your infrastructure, i.e., by running the SSH,
-  Kubernetes, Database, Application, or Desktop Services.
-</Admonition>
-
-By default, Teleport Agents need to create a reverse tunnel to every Teleport Proxy
-to ensure a client is able to reach every agent. With Proxy Peering this is no
-longer a requirement. When Proxy Peering is enabled agents will automatically
-change their behavior to connect to the configured number of Teleport Proxy
-instances.
-
-## How it works
-
-### Proxy Service
-
-A gRPC service on each Teleport Proxy Service instance provides an API for establishing a
-bi-directional connection to the agents connected to that Teleport Proxy. Teleport
-Proxy instances manage a gRPC client to all other Teleport Proxy instances in the
-cluster.
-
-Routing information on which Teleport Proxy instances each agent is connected to
-is stored in Teleport's backend and propagated to each Teleport Proxy instance.
-
-The routing information and gRPC service allow a Teleport Proxy to identify which
-Proxy Service instance an agent is connected to and create an end-to-end connection
-from a client to that agent. This allows for access to the agent without connecting
-to the same Teleport Proxy instance initially.
-
-### Reverse tunnel agents
-
-Agents will check whether you have enabled Proxy Peering before
-attempting to create a reverse tunnel to a Teleport Proxy instance.
-
-By default, in Proxy Peering mode, agents are configured to connect to a single
-Teleport Proxy instance. For high availability a cluster administrator may
-configure agents to connect to 2 or more Teleport Proxy instances.
-
-![Teleport Proxy Peering](../../../img/architecture/proxy-peering@1.2x.png)
-
-## Next Steps
-- See the [migration guide](../../admin-guides/management/operations/proxy-peering.mdx) to learn how to upgrade an existing cluster to use
-Proxy Peering
diff --git a/docs/pages/reference/architecture/proxy.mdx b/docs/pages/reference/architecture/proxy.mdx
index edfb17dc62989..289d0b0e33759 100644
--- a/docs/pages/reference/architecture/proxy.mdx
+++ b/docs/pages/reference/architecture/proxy.mdx
@@ -1,7 +1,10 @@
 ---
 title: Teleport Proxy Service
+sidebar_label: Proxy Service
 description: Architecture of Teleport's identity-aware proxy service
-h1: Teleport Identity-Aware Proxy Service
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 The Teleport Proxy Service is an identity-aware proxy with a web UI. The Teleport Proxy Service 
@@ -17,7 +20,7 @@ provides the following key features:
   to one TLS port using TLS routing feature.
 - Records commands and API calls, and queries and streams them to the audit log.
   The audit log is stored on one of the Teleport Auth Service
-  [backends](../backends.mdx).
+  [backends](../deployment/backends.mdx).
 
 ![Proxy service](../../../img/architecture/proxy.png)
 
diff --git a/docs/pages/reference/architecture/relay.mdx b/docs/pages/reference/architecture/relay.mdx
new file mode 100644
index 0000000000000..fdde701bed2d1
--- /dev/null
+++ b/docs/pages/reference/architecture/relay.mdx
@@ -0,0 +1,119 @@
+---
+title: Teleport Relay Service
+sidebar_label: Relay Service
+description: Architecture of Teleport's Relay service
+tags:
+ - conceptual
+ - platform-wide
+---
+
+<Admonition type="info">
+
+The Teleport Relay service is available starting from version 18.3.0 for the SSH protocol and version 18.5.0 for the Kubernetes protocol. Other protocols are not supported at this time.
+
+</Admonition>
+
+The Relay service is an optional component of a Teleport cluster that provides an alternative connectivity path between clients and resources. Similar to the Proxy service, it forwards connections to resources [through reverse tunnels](proxy.mdx#tunnels). However, unlike the Proxy service, the Relay service does not route connections through the Teleport control plane. Instead, it allows Teleport agents to open tunnels directly to the Relay service, enabling clients to connect to resources with lower latency and higher efficiency in specific network scenarios.
+
+This alternate connectivity is beneficial in situations where the client and the resource are known to be close together in a physical or logical sense (the same data center, office, campus, geographical region) and regular connections through the control plane would incur higher latency, lower throughput, or higher costs.
+
+Unlike the Proxy service, the Relay does not host a web UI, intercept connections, impersonate users or provide access to the Teleport control plane API. As such, it's simpler to deploy and keep secure, and it's thus suitable to be deployed even in environments where it wouldn't be possible to securely deploy a Proxy instance.
+
+<Admonition type="warning">
+
+The Teleport Relay service is intended for specific scenarios where clients and agents are in the same network segment and there is a need for connectivity that does not go through the Teleport control plane. It is not a required or recommended cluster component in most Teleport deployments.
+
+</Admonition>
+
+## How it works
+
+A Relay service deployment consists of one or more Relay instances configured with the same Relay group name, reachable by Teleport agents and clients through a L4 network load balancer. Relay instances of the same group receive connections from agents and clients through the load balancer, and can connect to each other directly. Relay instances listen on two separate ports to serve connections from agents and clients, and a third listening port is used for direct connections from other Relay instances in the same group.
+
+The typical setup uses a load balancer serving the two ports, reachable at a single hostname, with port 3042 used by agents and port 443 used by clients. However, it's possible to use different load balancers and hostnames for the client and agent ports if necessary. The listening port for connectivity between Relay instances does not make use of the load balancer, since each Relay instance might require connecting to specific other instances to serve connections; as such, the Relay service requires outbound connectivity from each Relay instance to its peers on that port.
+
+The connections from the client to the Relay, the connections between Relay instances, and the tunnel connections from the Teleport agents and the Relay instances use TCP and are encrypted and authenticated through mutual TLS, with X.509 certificates issued by the Teleport control plane.
+
+The `relay_service` section of the Teleport configuration file ([see reference](../deployment/config.mdx#relay-service)) defines both the network connectivity of the single Relay instance and the settings of the Relay group, which should be the same between all instances and will be fetched by agents as needed.
+
+An agent can be configured to use a given Relay by adding the address of the load balancer to its `teleport.yaml` configuration file:
+
+```yaml
+teleport:
+  proxy_server: proxy.example.com:443
+  relay_server: relay.example.com:3042
+```
+
+Agents running the SSH service that are also connected to a Proxy (i.e. they're running in "tunnel mode") will also open tunnels to the Relay service. The address specified in the configuration should resolve to the load balancer for the port used by agents.
+
+When an agent is configured to open tunnels to a given Relay group, it will periodically check the Relay configuration advertised by the Relay instances, then open enough tunnel connections to distinct Relay instances as determined by the Relay group configuration. The target connection count in the configuration should be not bigger than the amount of active and reachable Relay instances in the group at any given time, or all agents configured to use the group will keep connecting to the load balancer to reach for distinct instances that are not actually available.
+
+Before a Relay instance shuts down, it will inform all connected agents that it's about to terminate, and agents will then open new tunnel connections to replace their existing connection, ideally maintaining availability throughout this process. Because of this, we recommend deploying new Relay instances before shutting down old ones, if possible. This is what will happen when deploying the Relay service through [the `teleport-relay` Helm chart](../helm-reference/teleport-relay.mdx). Running a fixed set of Relay instances can result in minor downtime when restarting instances.
+
+{/* TODO: link appropriate deployment guides */}
+
+When connected to a Relay group, Teleport agents will include the group name and the list of Relay instances that they have connected to in the heartbeat for their served resources. It's possible to see this by reading the appropriate resource heartbeat through `tctl` (e.g. `tctl get node/<host ID>`) or, for SSH servers, `tsh ls --format=json`. The list of Relay instance IDs is also used internally by the Relay service to route connections if an agent serving the requested resource is not connected to all Relay instances: in such a case, the Relay instance forwarding a connection from a client will pass the connection along to a Relay instance that has a tunnel from the agent serving the resource - this is the same mechanism used for connection routing in the control plane when using [Proxy Peering](../../zero-trust-access/deploy-a-cluster/proxy-peering.mdx).
+
+When a Relay instance receives a request to open a connection to a resource, it'll run the same connection routing logic used by the Proxy service, resulting in one or more registered resources as a target for the connection. It will then check if the resource is available through an agent that has a tunnel opened directly with the instance; if so, the connection is then forwarded directly to the agent, otherwise, if the resource is available through a Relay instance of the same Relay group, the connection is forwarded to one of the other Relay instances, which will then pass the connection along to the appropriate agent through a tunnel. If the connection request is for a resource that is not available through the Relay group, an error is returned to the client.
+
+## Client configuration
+
+Use of the Relay service requires a desktop client (i.e. `tsh`) or the `ssh-multiplexer` service of the Machine & Workload Identity agent (`tbot`). It's not possible to use a Relay through the Teleport web UI.
+
+When using `tsh`, it's possible to specify the `--relay` option (or the `TELEPORT_RELAY` environment variable) with the hostname and port of the load balancer for the port used by clients; if a port is not specified, the default is taken to be port 443. The load balancer for the client port of the Relay service can employ any routing strategy, since all Relay instances are going to serve client connections equally.
+
+When you specify `--relay` at `tsh login` time, the configured Relay address is saved in your `tsh` profile configuration. This address will be used for all later invocations unless you override it.
+
+You can configure a default Relay address on a per-user basis using the `default_relay_addr` user trait. This trait can be set in several ways:
+
+- Directly for each [local user](../../zero-trust-access/rbac-get-started/users.mdx)
+- Passed by the SSO provider for [SSO users](../../zero-trust-access/sso/sso.mdx)
+- Granted through an [Access List](../../identity-governance/access-lists/access-lists.mdx)
+- Added by a [Login Rule](../../zero-trust-access/sso/login-rules/login-rules.mdx)
+
+When using `tsh ssh`:
+
+- If a Relay address was specified at login time or if you pass `--relay`, the SSH connection will go through the specified Relay instead of the control plane.
+- If an address was specified at login time, you can use `--relay=none` to temporarily disable the Relay service.
+- Use `--relay=default` to use the default Relay address for the user, even if a different address was specified at login time.
+- When a Relay address is configured, only servers available through the Relay will be accessible. No connection will go through the control plane.
+
+```
+# specifying a relay address when logging in
+$ tsh login --proxy proxy.example.com --relay relay.example.com
+...
+> Profile URL:        https://proxy.example.com:443
+  Relay address:      relay.example.com
+  Logged in as:       username
+  Cluster:            proxy.example.com
+  Roles:              access, auditor, editor
+  Logins:             root, ubuntu
+  Kubernetes:         enabled
+  Kubernetes groups:  system:masters
+  Valid until:        2025-10-22 00:48:07 +0200 CEST [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+# connections will use the relay by default
+$ tsh ssh root@nodename
+...
+# using a specific relay for a single connection
+$ tsh ssh --relay another-relay.example.com root@nodename
+...
+# using no relay
+$ tsh ssh --relay none root@nodename
+...
+```
+
+When using `tsh kube login`, `tsh proxy kube`, `tsh kube exec` and `tsh kubectl`:
+- If a Relay address was specified at login time or if you pass `--relay`, the generated Kubeconfig file for direct connections will point to the Relay endpoint and the local forwarding proxy will connect to the Relay rather than the control plane.
+- If an address was specified at login time, you can use `--relay=none` to temporarily disable the Relay service.
+- Use `--relay=default` to use the default Relay address for the user, even if a different address was specified at login time.
+- When a Relay address is configured, only Kubernetes clusters available through the Relay will be accessible. No connection will go through the control plane. If access to the same Kubernetes cluster is being provided by multiple Teleport agents, we recommend making all the agents available through the Relay for the best resiliency and load balancing.
+
+It's not currently possible to use the Relay with `tsh kube join` or with credential files generated by `tsh login` or `tctl auth sign`.
+
+The [`ssh-multiplexer`](../machine-workload-identity/configuration.mdx#ssh-multiplexer) and [`kubernetes/v2`](../machine-workload-identity/configuration.mdx#kubernetesv2) Machine & Workload Identity services can be configured to use a Relay. Similarly to the behavior of `tsh`, if a Relay address is set in the service configuration, only servers or Kubernetes clusters available through the Relay will be accessible. It's possible to provide access to resources through the Relay and through the control plane from the same `tbot` instance by configuring independent services with and without the `relay_server` option.
+
+## More concepts
+
+- [Architecture Overview](../../core-concepts.mdx)
+- [Teleport Proxy](proxy.mdx)
+- [Proxy Peering](../../zero-trust-access/deploy-a-cluster/proxy-peering.mdx)
diff --git a/docs/pages/reference/architecture/session-recording.mdx b/docs/pages/reference/architecture/session-recording.mdx
index 1f40d9d6eb35d..e891dae773b3f 100644
--- a/docs/pages/reference/architecture/session-recording.mdx
+++ b/docs/pages/reference/architecture/session-recording.mdx
@@ -1,6 +1,12 @@
 ---
 title: Teleport Session Recording
+sidebar_label: Session Recording
 description: An overview of Teleport's session recording and its configuration
+tags:
+ - session-recording
+ - conceptual
+ - zero-trust
+ - audit
 ---
 
 This page provides an overview of how Teleport records sessions and the various
@@ -64,7 +70,7 @@ Teleport cluster. It can be configured by setting `session_recording`
 in the `auth_service` section of your `teleport.yaml`, or dynamically using
 the `session_recording_config` resource. If you need to apply different
 recording configurations to different sets of resources, you can set up
-[trusted clusters](../../admin-guides/management/admin/trustedclusters.mdx) with their own
+[trusted clusters](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) with their own
 recording configurations.
 
 <Admonition type="note">
@@ -78,6 +84,41 @@ and `proxy-sync` identically (perform synchronous recording).
 
 </Admonition>
 
+### Encryption
+
+Teleport supports at-rest encryption of session recordings for all 4 recording
+modes. It can be enabled through the `teleport.yaml` configuration file or
+dynamically through the `session_recording_config` resource.
+
+An example of enabling encryption using the `teleport.yaml`:
+
+```yaml
+teleport:
+  auth_service:
+    session_recording_config:
+      encryption:
+        enabled: yes
+```
+
+And using the dynamic `session_recording_config` resource:
+
+```yaml
+kind: session_recording_config
+spec:
+  encryption:
+    enabled: yes
+```
+
+Any encryption keys are provisioned using the same key storage backend
+configured for CAs.
+
+<Admonition type="note">
+In distributed HA environments where there are multiple Teleport Auth Services,
+it is important that all services have access to the same key storage backend
+and keys. Otherwise availability of session replay may be degraded. This holds
+true even when using [Manual Encryption Key Management](#manual-encryption-key-management).
+</Admonition>
+
 ### Record at the SSH node
 
 By default, Teleport performs recording at the SSH node. This is because Teleport's
@@ -88,43 +129,50 @@ Proxy Server cannot see the SSH traffic to the node. It is encrypted end-to-end
 
 ### Record at the Proxy Service
 
-In **Recording Proxy Mode**, the Proxy Service terminates (decrypts) the SSH
-connection using the certificate supplied by the client via SSH agent forwarding
-and then establishes its own SSH connection to the final destination server.
-This allows the Proxy Service to forward SSH session data to the Auth Service to
-be recorded, as shown below:
+In **Recording Proxy Mode**, the Proxy Service terminates (decrypts) SSH connections
+by presenting the client with a trusted host certificate dynamically generated by
+the Auth Service and signed by the Teleport Host CA.
 
-![recording-proxy](../../../img/recording-proxy.svg)
+The Proxy Service then establishes its own connection to the destination server authenticating in one of two ways:
 
-Recording Proxy Mode allows Teleport users to enable session recording for
-OpenSSH's servers running `sshd`, which is helpful when gradually transitioning
-large server fleets to Teleport.
+- For the Teleport SSH Service and legacy OpenSSH servers, the Proxy Service requires the client to provide its credentials through SSH Agent Forwarding so that these credentials can be reused to connect to the OpenSSH server.
+  - Note that SSH Agent Forwarding must be allowed for any user trying to connect in this mode.
+- For [OpenSSH servers](../../enroll-resources/server-access/openssh/openssh-agentless.mdx), the Proxy Service requests a certificate signed by the Teleport OpenSSH CA, which will be trusted by the OpenSSH server.
 
-We consider Recording Proxy Mode to be less secure, as it grants additional
-privileges to the Proxy Service. Since the Proxy Service needs credentials to
-decrypt the SSH connection, it must be properly secured and is a higher value
-target for an attacker than a Proxy Service instance that cannot decrypt the
-data flowing through it.
+With both sides of the connections decrypted, the Proxy Service acts as a pipe between the client
+and the destination server, performing RBAC checks, recording the session, and emitting audit events 
+in the process as shown below:
 
-Additionally, the credentials that the Proxy Service uses to decrypt the SSH
-connection are provided via SSH Agent Forwarding, so Agent Forwarding must be
-enabled to record at the Proxy Service.
+![recording-proxy](../../../img/recording-proxy.svg)
+
+We consider Recording Proxy Mode to be less secure than recording at the server
+level for two reasons:
 
-However, there are advantages of proxy-based session recording too. When
-sessions are recorded at the SSH nodes, a root user can add iptables rules to
-prevent sessions logs from reaching the Auth Service. With sessions recorded at
-the Proxy Service, users with root privileges on nodes have no way of disabling
-the audit.
+- It grants additional privileges to the Teleport Proxy Service. When recording takes place at the Teleport SSH Service, the Proxy Service stores no secrets and cannot "see" the decrypted data. This makes a Proxy Service instance less critical to the security of the overall cluster. But if an attacker gains physical access to a Proxy Server running in Recording Proxy Mode, they will be able to see the decrypted traffic and client keys stored in the Proxy Server's process memory.
+- It requires the use of SSH Agent Forwarding (for Teleport Nodes and legacy OpenSSH server support).
 
-See the [reference](../monitoring/audit.mdx) to learn how to
+See the [reference](../deployment/monitoring/audit.mdx) to learn how to
 turn on Recording Proxy Mode. Note that the recording mode is configured on the
 Auth Service.
 
+<Admonition type="warning" >
+
+The use of Recording Proxy Mode across your cluster is no longer necessary to support
+[OpenSSH servers](../../enroll-resources/server-access/openssh/openssh-agentless.mdx).
+Recording Proxy Mode is automatically used for OpenSSH servers without the need for SSH
+Agent Forwarding, which is the primary security concern for this mode.
+
+Recording Proxy Mode will continue to be supported for legacy OpenSSH support and other
+use cases, but many existing and new features will not be supported in this mode due
+to several technical limitations it introduces.
+
+</Admonition>
+
 ### Synchronous recording
 
 When synchronous recording is enabled, the Teleport component doing the recording
 (which may be the Teleport SSH Service or the Proxy Service instance depending on your configuration)
-submits each recording event to Teleport's Auth Service as it occurs. In this mode,
+submits each recording event to the Teleport Auth Service as it occurs. In this mode,
 failure to emit a recording event is considered fatal - the session will be terminated
 if an event cannot be recorded. This makes synchronous recording best suited for highly
 regulated environments where you need to be confident that all data is recorded.
@@ -132,24 +180,28 @@ This also means that you need a reliable and low-latency connection to the Auth
 Server for the duration of the session to ensure that the session isn't interrupted
 or terminated due to temporary connection loss.
 
-In synchronous recording modes, the Auth Service receives a stream of recording
+In synchronous recording modes, the Teleport Auth Service receives a stream of recording
 events and is responsible for assembling them into the final artifact and uploading
-it to the storage backend. Since data is streamed directly to the Auth Service,
-Teleport administrators don't need to be concerned with disk space on their
-Teleport SSH Service and Proxy Service instances, as no recording data is
-written to those disks.
+it to the storage backend. If recording encryption is enabled, the Teleport Auth Service
+is also responsible for encrypting the event stream prior to upload. Since data is
+streamed directly, Teleport administrators don't need to be concerned with disk space on
+their Teleport SSH Service and Proxy Service instances, as no recording data is written
+to those disks.
 
 ### Asynchronous recording
 
-When asynchronous, recording events are written to the local filesystem
-during the session. When the session completes, Teleport assembles the parts into a
-complete recording and submits the entire recording to the Auth Service for storage.
+When asynchronous recording is enabled, recording events are written to the
+local filesystem during the session. When the session completes, Teleport
+assembles the parts into a complete recording and submits the entire recording
+to the Auth Service for storage.
 
 Since recording data is flushed to disk, administrators should be careful to ensure
 that the system has enough disk space to accommodate the expected number of Teleport
 sessions. Additionally, since recording data is temporarily stored on disk, there
 is a greater chance that it can be tampered with, deleted, or otherwise corrupted
-before the upload completes.
+before the upload completes. Enabling recording encryption for asynchronous
+modes ensures that events are encrypted before being written to the local
+filesystem, which can help prevent tampering.
 
 The advantage of asynchronous recording is that it doesn't require a persistent
 connection to the Auth Service. For example, an SSH session can continue to operate
@@ -164,7 +216,7 @@ high-latency.
 ## Storage
 
 Session recordings are stored in Teleport's audit sessions backend, which is
-specified by the `audit_sessions_uri` field in the `teleport.yaml` [configuration file](../config.mdx).
+specified by the `audit_sessions_uri` field in the `teleport.yaml` [configuration file](../deployment/config.mdx).
 Teleport current supports the following session storage backends:
 
 - File: stores recordings on the local filesystem. Suitable for dev environments, demos,
@@ -182,7 +234,8 @@ audit log storage, which supports a different set of services (SQLite, DynamoDB,
 
 A Teleport session recording is an ordered sequence of structured events associated
 with a session. Each event is an encoded [Protocol Buffer](https://developers.google.com/protocol-buffers)
-and the complete session is compressed with gzip before being written to the storage backend.
+and the complete session is compressed with gzip, and optionally encrypted,
+before being written to the storage backend.
 
 These recordings have a `.tar` extension for backwards compatibility reasons, but it
 should be noted that they are not TAR archives and cannot be read using the `tar` utility.
@@ -193,6 +246,10 @@ SSH and Kubernetes sessions can be played in Teleport's Web UI or by using
 the [`tsh play`](../cli/tsh.mdx) command. Desktop session
 recordings can only be played back in the Web UI.
 
+PostgreSQL database sessions can also be played using [`tsh play`](../cli/tsh.mdx)
+and the Web UI. Sessions from all database protocols are accessible with
+[`tsh play`](../cli/tsh.mdx) in JSON format (`--format json`).
+
 In the Web UI, the session recordings page is populated by querying Teleport's
 audit log for session end events, which contain metadata about the recording.
 This is sometimes surprising to Teleport users, because even though the recordings
@@ -219,8 +276,65 @@ as a series of parts (in cloud storage or on an Auth Service instance's disk) an
 responsibility of the Auth Service's upload completer to detect the abandoned upload and
 complete it.
 
+## Recording summaries
+
+With Teleport Identity Security, you can run language models against session
+recordings to generate session summaries. This feature supports SSH,
+Kubernetes, and database sessions and is only available if the Teleport cluster
+is licensed for Identity Security.
+
+After each recording is uploaded, Teleport Auth Service matches session metadata
+against all `inference_policy` resources. If a match is found, it will then use
+configuration from a corresponding `inference_model` resource to generate
+session recording. The inference model specifies, among other options, which
+inference provider and provider-specific model is used to generate a summary.
+
+No more than 150 concurrent summary jobs will be executed per Auth Service. If
+more sessions arrive, the auth server will wait until the previous ones are
+summarized.
+
+Session recording summaries are stored along with session recordings and can be
+viewed using the Teleport web app.
+
+## Manual Encryption Key Management
+
+Manual encryption key management places all responsibility and complexity of managing
+keys on the administrator. This comes with much more risk of a misconfiguration impacting
+Teleport's ability to record or replay sessions. It's for this reason that Teleport Cloud
+does not allow configuring manual encryption key management. Consider using the default
+automatic key management unless your usage explicitly requires manual key management.
+
+By default, Teleport will automatically provision and manage session recording encryption
+keys. However there may be cases where automatic management is not possible or desired,
+such as environments where Teleport lacks sufficient privileges to manage keys directly.
+For this reason, Teleport can be configured to use externally managed keys. This is
+controlled using the `encryption.manual_key_management` configuration in either the
+`teleport.yaml` file or the dynamic `session_recording_config` resource.
+
+```yaml
+encryption:
+  enabled: yes
+  manual_key_management:
+    enabled: yes
+    active_keys:
+      - type: pkcs11
+        label: 'session_recordings_002'
+    rotated_keys:
+      - type: pkcs11
+        label: 'session_recordings_001'
+```
+
+<Admonition type="warning">
+Session recording encryption relies on a form of envelope encryption using OAEP with
+4096-bit RSA key pairs. This means RSA 4096 is the only key type eligible for use with
+`manual_key_management`. It is also important that these keys are permitted to be used
+for decryption. What this means varies per key storage backend, but generally must be
+defined when the key is first provisioned.
+</Admonition>
+
 ## Related reading
 
-- [Recording Proxy Mode](../../enroll-resources/server-access/guides/recording-proxy-mode.mdx)
-- [SSH recording modes](../monitoring/audit.mdx)
-- [Session recording for desktops](../agent-services/desktop-access-reference/sessions.mdx)
+- [RBAC for session recordings](../access-controls/roles.mdx#rbac-for-session-recordings)
+- [SSH recording modes](../deployment/monitoring/audit.mdx)
+- [Session recording for desktops](../../enroll-resources/desktop-access/reference/sessions.mdx)
+- [Encrypted Session Recordings](../../enroll-resources/server-access/guides/encrypted-session-recordings/encrypted-session-recordings.mdx)
diff --git a/docs/pages/reference/architecture/teleport-cloud-architecture.mdx b/docs/pages/reference/architecture/teleport-cloud-architecture.mdx
index d1c6e59e1ca2b..016dbb125d072 100644
--- a/docs/pages/reference/architecture/teleport-cloud-architecture.mdx
+++ b/docs/pages/reference/architecture/teleport-cloud-architecture.mdx
@@ -1,6 +1,10 @@
 ---
 title: Teleport Enterprise Cloud Architecture
+sidebar_label: Enterprise Cloud
 description: Cloud security, availability, and networking details.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 This guide describes architectural features of Teleport Enterprise (Cloud). In
@@ -9,7 +13,7 @@ Teleport Auth Service and Teleport Proxy Service. Read on for information about
 topics like High Availability, deployment regions, and data retention.
 
 If you are new to Teleport Enterprise (Cloud), read the [Getting Started
-Guide](../../get-started.mdx).
+Guide](../../get-started/get-started.mdx).
 
 ## Security
 
@@ -38,7 +42,7 @@ configuration retained in DynamoDB indefinitely, and session recordings retained
 Customers whose subscriptions lapse will have all session recordings, audit logs, and
 cluster state deleted between 7 and 30 days after the lapse.
 
-Customers can configure [External Audit Storage](../../admin-guides/management/external-audit-storage.mdx) to store audit logs and session recordings in their
+Customers can configure [External Audit Storage](../../zero-trust-access/management/external-audit-storage.mdx) to store audit logs and session recordings in their
 own AWS account where retention period can be managed independently.
 
 ## High Availability
@@ -47,28 +51,26 @@ own AWS account where retention period can be managed independently.
 The Teleport [Auth Service](authentication.mdx) is deployed in 2 AWS availability zones, and can tolerate a single zone failure. AWS guarantees [99.99%](https://aws.amazon.com/compute/sla/) of monthly uptime.
 Teleport Enterprise Cloud can run in one of the following AWS regions:
 
-- us-west-2
-- us-east-1
-- eu-central-1
-- ap-south-1
-- ap-southeast-1
-- sa-east-1
-- ap-southeast-2
+|AWS Region Code|AWS Region Name|
+|---|---|
+|us-west-2|US West (Oregon)|
+|us-east-1|US East (N. Virginia)|
+|eu-central-1|Europe (Frankfurt)|
+|ap-south-1|Asia Pacific (Mumbai)|
+|ap-southeast-1|Asia Pacific (Singapore)|
+|sa-east-1|South America (São Paulo)|
 
 ### Proxies
 The Teleport [Proxy Service](proxy.mdx) is deployed to multiple AWS regions around the world for low-latency access to distributed infrastructure.
 
-- us-west-2
-- us-east-1
-- eu-central-1
-- ap-south-1
-- ap-southeast-1
-- sa-east-1
-- ap-southeast-2
-
-<Admonition type="note">
-  Proxy Service in the ap-southeast-2 region is available upon request or when the Auth Service is deployed to the region.
-</Admonition>
+|AWS Region Code|AWS Region Name|
+|---|---|
+|us-west-2|US West (Oregon)|
+|us-east-1|US East (N. Virginia)|
+|eu-central-1|Europe (Frankfurt)|
+|ap-south-1|Asia Pacific (Mumbai)|
+|ap-southeast-1|Asia Pacific (Singapore)|
+|sa-east-1|South America (São Paulo)|
 
 ## Releases
 
@@ -95,6 +97,13 @@ notifications.
 
 ## Service Level Agreement
 
-Teleport Enterprise Cloud commits to an SLA of (=cloud.sla.monthly_percentage=) of monthly uptime,
+Teleport Cloud commits to an SLA of (=cloud.sla.monthly_percentage=) of monthly uptime,
 a maximum of (=cloud.sla.monthly_downtime=) of downtime per month. As we continue to invest in the
 cloud product and infrastructure, the SLA will be increased.
+
+In Teleport Cloud accounts that enable multi-region high availability, the SLA
+increases to 99.99%. 
+
+For more information on Teleport Cloud SLAs, see the [Teleport Enterprise
+Edition Pricing
+Guide](https://goteleport.com/api/files/teleport-pricing-guide.pdf) (PDF).
diff --git a/docs/pages/reference/architecture/tls-routing.mdx b/docs/pages/reference/architecture/tls-routing.mdx
index 28a2ca8b0ed97..8452e11d84d9e 100644
--- a/docs/pages/reference/architecture/tls-routing.mdx
+++ b/docs/pages/reference/architecture/tls-routing.mdx
@@ -1,6 +1,9 @@
 ---
 title: TLS Routing
 description: How Teleport implements a single-port setup with TLS routing
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 In TLS routing mode [Teleport proxy](./proxy.mdx) multiplexes all client
@@ -127,7 +130,7 @@ Teleport provides a `tsh proxy db` command to launch a local database proxy:
 $ tsh proxy db example-db
 ```
 
-See [GUI clients](../../connect-your-client/gui-clients.mdx) guide for a usage
+See [GUI clients](../../connect-your-client/third-party/gui-clients.mdx) guide for a usage
 example.
 
 ## Web UI, apps and desktops
@@ -266,6 +269,6 @@ behind layer 7 load balancers.
 
 ## Next steps
 
-- See [migration guide](../../admin-guides/management/operations/tls-routing.mdx) to learn how to
+- See [migration guide](../../zero-trust-access/deploy-a-cluster/tls-routing.mdx) to learn how to
   upgrade an existing cluster to use TLS routing.
 - Read through TLS routing design document [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0039-sni-alpn-teleport-proxy-routing.md).
diff --git a/docs/pages/reference/architecture/trustedclusters.mdx b/docs/pages/reference/architecture/trustedclusters.mdx
index 3aee77e05129b..5b86971b780ca 100644
--- a/docs/pages/reference/architecture/trustedclusters.mdx
+++ b/docs/pages/reference/architecture/trustedclusters.mdx
@@ -1,6 +1,11 @@
 ---
 title: Trusted Clusters Architecture
+sidebar_label: Trusted Clusters
 description: Deep dive into design of Teleport Trusted Clusters.
+tags:
+ - conceptual
+ - zero-trust
+ - infrastructure-identity
 ---
 
 Teleport can partition compute infrastructure into multiple clusters. A cluster
@@ -68,5 +73,5 @@ Read the rest of the Architecture Guides:
 
 - See how Teleport uses [Certificates](authentication.mdx) for authentication.
 - Reduce your surface of attack using [TLS routing](./tls-routing.mdx).
-- Follow our [guide](../../admin-guides/management/admin/trustedclusters.mdx) to set up trusted clusters.
+- Follow our [guide](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) to set up trusted clusters.
 
diff --git a/docs/pages/reference/audit-events.mdx b/docs/pages/reference/audit-events.mdx
new file mode 100644
index 0000000000000..4082aef75e784
--- /dev/null
+++ b/docs/pages/reference/audit-events.mdx
@@ -0,0 +1,7082 @@
+---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+{/*cSpell:disable*/}
+
+{/* Formatted event examples sometimes include different capitalization than
+what we standardize on in the docs*/}
+{/* vale messaging.capitalization = NO */}
+
+Teleport components emit audit events to record activity within the cluster. 
+
+Audit event payloads have an `event` field that describes the event, which is
+often an operation performed against a dynamic resource (e.g.,
+`access_list.create` for the creation of an Access List) or some other user
+behavior, such as a local user login (`user.login`). The `code` field
+includes a string with pattern `[A-Z0-9]{6}` that is unique to an audit event,
+such as `TAP03I` for the creation of an application resource.
+
+In some cases, an audit event describes both a success state and a failure
+state, while the `event` field is the same for both states. In this case, the
+`code` field differs between states. For example, `access_list.create`
+describes both successful and failed Access List creations, while the success
+event has code `TAL001I` and the failure has code `TAL001E`. For other
+events, like `db.session.query.failed` and `db.session.query`, the event
+type describes only the success or failure state.
+
+You can set up Teleport to export audit events to third-party services for
+storage, visualization, and analysis. For more information, read [Exporting
+Teleport Audit Events](
+../zero-trust-access/export-audit-events/export-audit-events.mdx).
+
+## access_graph.crown_jewel.create
+
+Crown Jewel Created
+
+Example:
+
+```json
+{
+  "code": "CJ001I",
+  "event": "access_graph.crown_jewel.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_graph.crown_jewel.delete
+
+Crown Jewel Deleted
+
+Example:
+
+```json
+{
+  "code": "CJ003I",
+  "event": "access_graph.crown_jewel.delete",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_graph.crown_jewel.update
+
+Crown Jewel Updated
+
+Example:
+
+```json
+{
+  "code": "CJ002I",
+  "event": "access_graph.crown_jewel.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_graph.path.changed
+
+Access Path Changed
+
+Example:
+
+```json
+{
+  "code": "TAG001I",
+  "event": "access_graph.path.changed",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_list.create
+
+There are multiple events with the `access_list.create` type.
+
+### TAL001I
+
+Access list created
+
+Example:
+
+```json
+{
+  "code": "TAL001I",
+  "event": "access_list.create",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+### TAL001E
+
+Access list create failed
+
+Example:
+
+```json
+{
+  "code": "TAL001E",
+  "event": "access_list.create",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+## access_list.delete
+
+There are multiple events with the `access_list.delete` type.
+
+### TAL003I
+
+Access list deleted
+
+Example:
+
+```json
+{
+  "code": "TAL003I",
+  "event": "access_list.delete",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+### TAL003E
+
+Access list delete failed
+
+Example:
+
+```json
+{
+  "code": "TAL003E",
+  "event": "access_list.delete",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+## access_list.member.add
+
+There are multiple events with the `access_list.member.add` type.
+
+### TAL005I
+
+Access list member added
+
+Example:
+
+```json
+{
+  "code": "TAL005I",
+  "event": "access_list.member.add",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "user"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+### TAL005E
+
+Access list member addition failure
+
+Example:
+
+```json
+{
+  "code": "TAL005E",
+  "event": "access_list.member.add",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "user"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+## access_list.member.delete
+
+There are multiple events with the `access_list.member.delete` type.
+
+### TAL007I
+
+Access list member removed
+
+Example:
+
+```json
+{
+  "code": "TAL007I",
+  "event": "access_list.member.delete",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "user"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+### TAL007E
+
+Access list member removal failure
+
+Example:
+
+```json
+{
+  "code": "TAL007E",
+  "event": "access_list.member.delete",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "carrot"
+    },
+    {
+      "member_name": "apple"
+    },
+    {
+      "member_name": "banana"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+## access_list.member.delete_all_members
+
+There are multiple events with the `access_list.member.delete_all_members` type.
+
+### TAL008I
+
+All members removed from access list
+
+Example:
+
+```json
+{
+  "code": "TAL008I",
+  "event": "access_list.member.delete_all_members",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "updated_by": "mike"
+}
+```
+
+### TAL008E
+
+Access list member delete all members failure
+
+Example:
+
+```json
+{
+  "code": "TAL008E",
+  "event": "access_list.member.delete_all_members",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "updated_by": "mike"
+}
+```
+
+## access_list.member.update
+
+There are multiple events with the `access_list.member.update` type.
+
+### TAL006I
+
+Access list member updated
+
+Example:
+
+```json
+{
+  "code": "TAL006I",
+  "event": "access_list.member.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "user"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+### TAL006E
+
+Access list member update failure
+
+Example:
+
+```json
+{
+  "code": "TAL006E",
+  "event": "access_list.member.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "access_list_name": "access-list",
+  "access_list_title": "example_title",
+  "members": [
+    {
+      "member_name": "user"
+    }
+  ],
+  "updated_by": "mike"
+}
+```
+
+## access_list.review
+
+There are multiple events with the `access_list.review` type.
+
+### TAL004I
+
+Access list reviewed
+
+Example:
+
+```json
+{
+  "code": "TAL004I",
+  "event": "access_list.review",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+### TAL004E
+
+Access list review failed
+
+Example:
+
+```json
+{
+  "code": "TAL004E",
+  "event": "access_list.review",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+## access_list.update
+
+There are multiple events with the `access_list.update` type.
+
+### TAL002I
+
+Access list updated
+
+Example:
+
+```json
+{
+  "code": "TAL002I",
+  "event": "access_list.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+### TAL002E
+
+Access list update failed
+
+Example:
+
+```json
+{
+  "code": "TAL002E",
+  "event": "access_list.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "access-list",
+  "updated_by": "mike",
+  "access_list_title": "example_title"
+}
+```
+
+## access_request.create
+
+Access Request Created
+
+Example:
+
+```json
+{
+  "id": "66b827b2-1b0b-512b-965d-6c789388d3c9",
+  "code": "T5000I",
+  "event": "access_request.create",
+  "time": "2020-06-05T19:26:53Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0",
+  "user": "Carrie_Sandoval",
+  "state": "PENDING",
+  "roles": [
+    "admin"
+  ]
+}
+```
+
+## access_request.delete
+
+Access Request Deleted
+
+Example:
+
+```json
+{
+  "id": "66b827b2-1b0b-512b-965d-6c789388d3c9",
+  "code": "T5003I",
+  "event": "access_request.delete",
+  "time": "2020-06-05T19:26:53Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_request.expire
+
+Access Request Expired
+
+Example:
+
+```json
+{
+  "id": "66b827b2-1b0b-512b-965d-6c789388d3c9",
+  "code": "T5005I",
+  "event": "access_request.expire",
+  "time": "2020-06-05T19:26:53Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_request.review
+
+Access Request Reviewed
+
+Example:
+
+```json
+{
+  "code": "T5002I",
+  "event": "access_request.review",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## access_request.search
+
+Resource Access Search
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "T5004I",
+  "ei": 0,
+  "event": "access_request.search",
+  "namespace": "default",
+  "resource_type": "db_server",
+  "search_as_roles": [
+    "admin",
+    "really-long-role-name-1",
+    "really-long-role-name-2",
+    "really-long-role-name-3",
+    "really-long-role-name-4",
+    "really-long-role-name-5",
+    "really-long-role-name-6",
+    "really-long-role-name-7",
+    "really-long-role-name-8",
+    "really-long-role-name-9"
+  ],
+  "time": "2022-06-08T15:10:35.368Z",
+  "uid": "b13d61-b97-475f-86ef-1fedf",
+  "user": "foo"
+}
+```
+
+## access_request.update
+
+Access Request Updated
+
+Example:
+
+```json
+{
+  "id": "66b827b2-1b0b-512b-965d-6c789388d3c9",
+  "code": "T5001I",
+  "event": "access_request.update",
+  "time": "2020-06-05T19:26:53Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0",
+  "state": "APPROVED",
+  "updated_by": "Sam_Waters"
+}
+```
+
+## app.create
+
+Application Created
+
+Example:
+
+```json
+{
+  "code": "TAP03I",
+  "ei": 0,
+  "event": "app.create",
+  "time": "2022-09-27T19:07:35.00Z",
+  "uid": "45cabf1e-3f19-4f83-a360-01ac0a176b67",
+  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
+  "name": "dynamic-app",
+  "user": "mike"
+}
+```
+
+## app.delete
+
+Application Deleted
+
+Example:
+
+```json
+{
+  "code": "TAP05I",
+  "ei": 0,
+  "event": "app.delete",
+  "time": "2022-09-27T19:11:35.00Z",
+  "uid": "d2342a20-9697-4a5d-9658-5d473e04624a",
+  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
+  "name": "dynamic-app",
+  "user": "mike"
+}
+```
+
+## app.session.chunk
+
+App Session Data
+
+Example:
+
+```json
+{
+  "code": "T2008I",
+  "ei": 0,
+  "event": "app.session.chunk",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2020-10-30T17:28:14.705Z",
+  "uid": "8ea5be3d-07b1-4308-8e0d-2d2ec57cbb20",
+  "user": "alice",
+  "app_name": "test"
+}
+```
+
+## app.session.dynamodb.request
+
+App Session DynamoDB Request
+
+Example:
+
+```json
+{
+  "code": "T2013I",
+  "ei": 1,
+  "event": "app.session.dynamodb.request",
+  "app_name": "dyno1",
+  "app_public_addr": "dynamodb.root.com",
+  "app_uri": "https://console.aws.amazon.com/dynamodbv2/home",
+  "aws_host": "dynamodb.us-west-2.amazonaws.com",
+  "aws_region": "us-west-2",
+  "aws_role_arn": "arn:aws:iam::123456789012:role/GavinDynamoDBRole",
+  "aws_service": "dynamodb",
+  "body": {
+    "TableName": "test-table"
+  },
+  "cluster_name": "root.com",
+  "method": "POST",
+  "path": "/",
+  "raw_query": "",
+  "session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
+  "status_code": 200,
+  "target": "DynamoDB_20120810.Scan",
+  "time": "2022-10-19T19:04:07.763Z",
+  "uid": "f6f38f69-46e9-4110-a773-2c88278d08ca",
+  "user": "alice"
+}
+```
+
+## app.session.end
+
+App Session Ended
+
+Example:
+
+```json
+{
+  "app_name": "ponger",
+  "app_public_addr": "ponger.root.gravitational.io",
+  "app_uri": "tcp://localhost:9876",
+  "cluster_name": "root",
+  "code": "T2011I",
+  "ei": 0,
+  "event": "app.session.end",
+  "namespace": "default",
+  "server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
+  "sid": "11c328b4-5a1e-4adc-b7cb-206389e5f130",
+  "time": "2022-08-10T19:54:40.444Z",
+  "uid": "ac8c9b6b-46a0-4b0e-8d85-2204101d5615",
+  "user": "alice"
+}
+```
+
+## app.session.start
+
+App Session Started
+
+Example:
+
+```json
+{
+  "addr.remote": "50.34.48.113:56902",
+  "code": "T2007I",
+  "ei": 0,
+  "event": "app.session.start",
+  "namespace": "default",
+  "public_addr": "dumper.test.domain.com",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2020-10-30T17:28:14.381Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "kimlisa",
+  "app_name": "test"
+}
+```
+
+## app.update
+
+Application Updated
+
+Example:
+
+```json
+{
+  "code": "TAP04I",
+  "ei": 0,
+  "event": "app.update",
+  "time": "2022-09-27T19:09:35.00Z",
+  "uid": "9909a8d6-b45f-455c-953d-ba1a62340810",
+  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
+  "name": "dynamic-app",
+  "user": "mike"
+}
+```
+
+## auth
+
+Auth Attempt Failed
+
+Example:
+
+```json
+{
+  "code": "T3007W",
+  "error": "ssh: principal \"fsdfdsf\" not in the set of valid principals for given certificate: [\"root\"]",
+  "event": "auth",
+  "success": false,
+  "time": "2019-04-22T02:09:06Z",
+  "uid": "036659d6-fdf7-40a4-aa80-74d6ac73b9c0",
+  "user": "admin@example.com"
+}
+```
+
+## auth_preference.update
+
+Cluster Authentication Preferences Updated
+
+Example:
+
+```json
+{
+  "code": "TCAUTH001I",
+  "event": "auth_preference.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## auto_update_agent_rollout.force_done
+
+Automatic Update Agent Rollout Forced Done.
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "auto_update_agent_rollout.force_done",
+  "code": "AUAR002I",
+  "time": "0001-01-01T00:00:00Z",
+  "user": "system",
+  "groups": [
+    "prod"
+  ],
+  "success": true
+}
+```
+
+## auto_update_agent_rollout.rollback
+
+Automatic Update Agent Rollout Rollback
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "auto_update_agent_rollout.rollback",
+  "code": "AUAR003I",
+  "time": "0001-01-01T00:00:00Z",
+  "user": "system",
+  "groups": [
+    "prod"
+  ],
+  "success": true
+}
+```
+
+## auto_update_agent_rollout.trigger
+
+Automatic Update Agent Rollout Triggered
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "auto_update_agent_rollout.trigger",
+  "code": "AUAR001I",
+  "time": "0001-01-01T00:00:00Z",
+  "user": "system",
+  "groups": [
+    "dev",
+    "prod"
+  ],
+  "success": true
+}
+```
+
+## auto_update_config.create
+
+Automatic Update Config Created
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:46790",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUC001I",
+  "ei": 0,
+  "event": "auto_update_config.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-config",
+  "success": true,
+  "time": "2025-03-04T15:49:31.946Z",
+  "uid": "6fcbf7ed-b44c-4b83-bb70-02a574564e0b",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## auto_update_config.delete
+
+Automatic Update Config Deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:39518",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUC003I",
+  "ei": 0,
+  "event": "auto_update_config.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-config",
+  "success": true,
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "af17ab4a-d5a2-44a3-93ce-89390b50d52f",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## auto_update_config.update
+
+Automatic Update Config Updated
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:46798",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUC002I",
+  "ei": 0,
+  "event": "auto_update_config.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-config",
+  "success": true,
+  "time": "2025-03-04T15:49:37.633Z",
+  "uid": "94c580a9-6f87-4a23-9fe5-f93de4390cff",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## auto_update_version.create
+
+Automatic Update Version Created
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:41608",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUV001I",
+  "ei": 0,
+  "event": "auto_update_version.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-version",
+  "success": true,
+  "time": "2025-03-04T15:41:24.433Z",
+  "uid": "3d677d2f-91d0-4b5a-966d-183a59cec888",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## auto_update_version.delete
+
+Automatic Update Version Deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:50316",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUV003I",
+  "ei": 0,
+  "event": "auto_update_version.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-version",
+  "success": true,
+  "time": "2025-03-04T15:25:44.805Z",
+  "uid": "c4d0d165-3a17-46ac-baa7-c7f521629997",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## auto_update_version.update
+
+Automatic Update Version Updated
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:42540",
+  "cluster_name": "autest.cloud.gravitational.io",
+  "code": "AUV002I",
+  "ei": 0,
+  "event": "auto_update_version.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "autoupdate-version",
+  "success": true,
+  "time": "2025-03-04T15:27:36.039Z",
+  "uid": "b7f9dde2-2899-46f1-bd4e-699d7b630e33",
+  "updated_by": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user": "b6eae9ed-bfde-40ba-a880-948a2c598b2b.autest.cloud.gravitational.io",
+  "user_kind": 1
+}
+```
+
+## aws_identity_center.resource_sync.failed
+
+AWS IAM Identity Center Resource Sync Failed
+
+Example:
+
+```json
+{
+  "code": "TAIC001E",
+  "event": "aws_identity_center.resource_sync.failed",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## aws_identity_center.resource_sync.success
+
+AWS IAM Identity Center Resource Sync Completed
+
+Example:
+
+```json
+{
+  "code": "TAIC001I",
+  "event": "aws_identity_center.resource_sync.success",
+  "message": "Periodic account, permission set and account assignment sync",
+  "success": true,
+  "time": "2025-02-11T15:29:30.045Z",
+  "total_account_assignments": 12,
+  "total_accounts": 4,
+  "total_permission_sets": 3,
+  "total_user_groups": 5
+}
+```
+
+## billing.create_card
+
+Credit Card Added
+
+Example:
+
+```json
+{
+  "cluster_name": "some-name",
+  "code": "TBL00I",
+  "ei": 0,
+  "event": "billing.create_card",
+  "time": "2021-03-18T16:29:05.044Z",
+  "uid": "5c40b62a-4ddd-466c-87a0-fa2922f743d0",
+  "user": "root"
+}
+```
+
+## billing.delete_card
+
+Credit Card Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "some-name",
+  "code": "TBL01I",
+  "ei": 0,
+  "event": "billing.delete_card",
+  "time": "2021-03-18T16:28:51.219Z",
+  "uid": "056517e0-f7e1-4286-b437-c75f3a865af4",
+  "user": "root"
+}
+```
+
+## billing.update_card
+
+Credit Card Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "some-name",
+  "code": "TBL02I",
+  "ei": 0,
+  "event": "billing.update_card",
+  "time": "2021-03-18T16:28:49.067Z",
+  "uid": "0a06aba1-b87c-4d58-8922-e173f6b9729f",
+  "user": "root"
+}
+```
+
+## billing.update_info
+
+Billing Information Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "some-name",
+  "code": "TBL03I",
+  "ei": 0,
+  "event": "billing.update_info",
+  "time": "2021-03-18T16:29:15.719Z",
+  "uid": "95344b33-d25c-4875-896e-f21abc911547",
+  "user": "root"
+}
+```
+
+## bot.create
+
+Bot Created
+
+Example:
+
+```json
+{
+  "cluster_name": "leaf.tele.ottr.sh:443",
+  "code": "TB001I",
+  "ei": 0,
+  "event": "bot.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "made-by-noah",
+  "time": "2023-12-08T10:53:39.798Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "noah"
+}
+```
+
+## bot.delete
+
+Bot Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "leaf.tele.ottr.sh:443",
+  "code": "TB003I",
+  "ei": 0,
+  "event": "bot.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "review2",
+  "time": "2023-12-08T09:52:30.579Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "noah"
+}
+```
+
+## bot.join
+
+There are multiple events with the `bot.join` type.
+
+### TJ001I
+
+Bot Joined
+
+Example:
+
+```json
+{
+  "attributes": {
+    "actor": "strideynet",
+    "actor_id": "16336790",
+    "base_ref": "",
+    "environment": "",
+    "event_name": "push",
+    "head_ref": "",
+    "job_workflow_ref": "strideynet/sandbox/.github/workflows/build.yaml@refs/heads/main",
+    "ref": "refs/heads/main",
+    "ref_type": "branch",
+    "repository": "strideynet/sandbox",
+    "repository_id": "539963344",
+    "repository_owner": "strideynet",
+    "repository_owner_id": "16336790",
+    "repository_visibility": "private",
+    "run_attempt": "6",
+    "run_id": "3547291254",
+    "run_number": "73",
+    "sha": "758c69462083ad67f0714112aab31fdeb1ba3a59",
+    "sub": "repo:strideynet/sandbox:ref:refs/heads/main",
+    "workflow": "Demo"
+  },
+  "bot_name": "github-demo",
+  "cluster_name": "root.tele.ottr.sh",
+  "code": "TJ001I",
+  "ei": 0,
+  "event": "bot.join",
+  "method": "github",
+  "success": true,
+  "time": "2022-12-05T17:11:03.268Z",
+  "token_name": "github-bot",
+  "uid": "15a82555-b5aa-4eb8-820e-551f991bf902"
+}
+```
+
+### TJ001E
+
+Bot Join Failed
+
+Example:
+
+```json
+{
+  "attributes": {
+    "actor": "strideynet",
+    "actor_id": "16336790",
+    "base_ref": "",
+    "environment": "",
+    "event_name": "push",
+    "head_ref": "",
+    "job_workflow_ref": "strideynet/sandbox/.github/workflows/build.yaml@refs/heads/main",
+    "ref": "refs/heads/main",
+    "ref_type": "branch",
+    "repository": "strideynet/sandbox",
+    "repository_id": "539963344",
+    "repository_owner": "strideynet",
+    "repository_owner_id": "16336790",
+    "repository_visibility": "private",
+    "run_attempt": "3",
+    "run_id": "8604159359",
+    "run_number": "100",
+    "sha": "0c9c5361d15154caf1c151dc1f430ea3552c9b93",
+    "sub": "repo:strideynet/sandbox:ref:refs/heads/main",
+    "workflow": "Demo"
+  },
+  "bot_name": "unknown",
+  "cluster_name": "leaf.tele.ottr.sh",
+  "code": "TJ001E",
+  "ei": 0,
+  "error": "id token claims did not match any allow rules",
+  "event": "bot.join",
+  "method": "unknown",
+  "success": false,
+  "time": "2024-04-08T17:33:48.877Z",
+  "uid": "2bc5e2cb-5ba1-47d7-a7ae-381cf323ae7f"
+}
+```
+
+## bot.update
+
+Bot Updated
+
+Example:
+
+```json
+{
+  "code": "TB002I",
+  "event": "bot.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## cert.create
+
+Certificate Issued
+
+Example:
+
+```json
+{
+  "cert_type": "user",
+  "code": "TC000I",
+  "event": "cert.create",
+  "identity": {
+    "user": "alice"
+  },
+  "time": "2022-02-04T19:43:23.529Z"
+}
+```
+
+## cir.update
+
+Client IP Restrictions update
+
+Example:
+
+```json
+{
+  "client_ip_restrictions": [
+    "3.0.0.0/8"
+  ],
+  "cluster_name": "localhost",
+  "code": "CIR001I",
+  "ei": 0,
+  "event": "cir.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "client_ip_restriction",
+  "success": true,
+  "time": "2025-10-21T20:45:14.775Z",
+  "updated_by": "admin",
+  "user": "admin",
+  "user_cluster_name": "localhost",
+  "user_kind": 1,
+  "user_roles": [
+    "editor"
+  ]
+}
+```
+
+## client.disconnect
+
+Client Disconnected
+
+Example:
+
+```json
+{
+  "code": "T3006I",
+  "event": "client.disconnect",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## cluster_networking_config.update
+
+Cluster Networking Configuration Updated
+
+Example:
+
+```json
+{
+  "code": "TCNET002I",
+  "event": "cluster_networking_config.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## contact.create
+
+Contact Created
+
+Example:
+
+```json
+{
+  "code": "TCTC001I",
+  "event": "contact.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## contact.delete
+
+Contact Deleted
+
+Example:
+
+```json
+{
+  "code": "TCTC002I",
+  "event": "contact.delete",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## db.create
+
+Database Created
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB03I",
+  "db_labels": {
+    "env": "local",
+    "teleport.dev/origin": "dynamic"
+  },
+  "db_protocol": "postgres",
+  "db_uri": "localhost:5432",
+  "ei": 0,
+  "event": "db.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "postgres-local",
+  "time": "2021-10-08T15:42:15.39Z",
+  "uid": "9d37514f-aef5-426f-9fda-31fd35d070f5",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## db.delete
+
+Database Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB05I",
+  "ei": 0,
+  "event": "db.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "postgres-local",
+  "time": "2021-10-08T15:42:36.005Z",
+  "uid": "74f5e6b9-50c4-4195-bb26-d615641255bc",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## db.session.cassandra.batch
+
+Cassandra Batch
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "db.session.cassandra.batch",
+  "code": "TCA01I",
+  "time": "2022-06-02T08:46:33.825Z",
+  "cluster_name": "im-a-cluster-name",
+  "user": "alice",
+  "sid": "a724c7e8-8e00-45a6-afac-82023d0f86b6",
+  "db_service": "cassandra",
+  "db_protocol": "cassandra",
+  "db_uri": "localhost:65054",
+  "db_user": "cassandra",
+  "consistency": "ConsistencyLevel QUORUM [0x0004]",
+  "batch_type": "BatchType LOGGED [0x00]",
+  "children": [
+    {
+      "query": "INSERT INTO batch_table (id) VALUES 1"
+    },
+    {
+      "query": "INSERT INTO batch_table (id) VALUES 2"
+    }
+  ]
+}
+```
+
+## db.session.cassandra.execute
+
+Cassandra Execute
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "db.session.cassandra.execute",
+  "code": "TCA03I",
+  "time": "2022-06-02T08:46:33.825Z",
+  "cluster_name": "im-a-cluster-name",
+  "user": "alice",
+  "sid": "2126ee07-cfe1-4213-8032-70b3e6e1ac79",
+  "db_service": "cassandra",
+  "db_protocol": "cassandra",
+  "db_uri": "localhost:65054",
+  "db_user": "cassandra",
+  "query_id": "d34e638934721c3bcd69933f992a00cb"
+}
+```
+
+## db.session.cassandra.prepare
+
+Cassandra Prepare Event
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "db.session.cassandra.prepare",
+  "code": "TCA02I",
+  "time": "2022-06-02T08:46:33.825Z",
+  "cluster_name": "im-a-cluster-name",
+  "user": "alice",
+  "sid": "2126ee07-cfe1-4213-8032-70b3e6e1ac79",
+  "db_service": "cassandra",
+  "db_protocol": "cassandra",
+  "db_uri": "localhost:65054",
+  "db_user": "cassandra",
+  "query": "SELECT * FROM system_schema.keyspaces"
+}
+```
+
+## db.session.cassandra.register
+
+Cassandra Register
+
+Example:
+
+```json
+{
+  "ei": 0,
+  "event": "db.session.cassandra.register",
+  "code": "TCA04I",
+  "time": "2022-06-02T08:46:33.825Z",
+  "cluster_name": "im-a-cluster-name",
+  "user": "alice",
+  "sid": "2126ee07-cfe1-4213-8032-70b3e6e1ac79",
+  "db_service": "cassandra",
+  "db_protocol": "cassandra",
+  "db_uri": "localhost:65054",
+  "db_user": "cassandra",
+  "event_types": [
+    "TOPOLOGY_CHANGE",
+    "STATUS_CHANGE",
+    "SCHEMA_CHANGE"
+  ]
+}
+```
+
+## db.session.dynamodb.request
+
+There are multiple events with the `db.session.dynamodb.request` type.
+
+### TDY01I
+
+DynamoDB Request
+
+Example:
+
+```json
+{
+  "cluster_name": "root.com",
+  "code": "TDY01I",
+  "event": "db.session.dynamodb.request",
+  "db_name": "",
+  "db_protocol": "dynamodb",
+  "db_service": "ddb1",
+  "db_user": "DynamoDBRole",
+  "ei": 1,
+  "uri": "dynamodb.us-west-2.amazonaws.com",
+  "body": {
+    "TableName": "test-table"
+  },
+  "method": "POST",
+  "path": "",
+  "raw_query": "",
+  "status_code": 200,
+  "target": "DynamoDB_20120810.Scan",
+  "time": "2022-12-23T19:14:07.763Z",
+  "uid": "12345678-46e9-4110-a773-2c88278d08ca",
+  "user": "alice@example.com"
+}
+```
+
+### TDY01E
+
+DynamoDB Request Failed
+
+Example:
+
+```json
+{
+  "cluster_name": "root.com",
+  "code": "TDY01E",
+  "event": "db.session.dynamodb.request",
+  "db_name": "",
+  "db_protocol": "dynamodb",
+  "db_service": "ddb1",
+  "db_user": "DynamoDBRole",
+  "ei": 1,
+  "uri": "dynamodb.us-west-2.amazonaws.com",
+  "body": {
+    "TableName": "test-table"
+  },
+  "method": "POST",
+  "path": "",
+  "raw_query": "",
+  "status_code": 0,
+  "target": "DynamoDB_20120810.Scan",
+  "time": "2022-12-23T19:04:07.763Z",
+  "uid": "12345678-46e9-4110-a773-2c88278d08ca",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.elasticsearch.request
+
+There are multiple events with the `db.session.elasticsearch.request` type.
+
+### TES00I
+
+Elasticsearch Request
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TES00I",
+  "body": null,
+  "category": 0,
+  "db_protocol": "elasticsearch",
+  "db_service": "myelastic",
+  "db_uri": "localhost:9201",
+  "db_user": "elasticuser",
+  "ei": 101,
+  "event": "db.session.elasticsearch.request",
+  "headers": {
+    "Accept": [
+      "*/*"
+    ],
+    "User-Agent": [
+      "curl/7.79.1"
+    ]
+  },
+  "method": "GET",
+  "path": "/",
+  "query": "",
+  "raw_query": "",
+  "sid": "b739c817-bc11-4eaa-b256-c6646d7fcc21",
+  "target": "",
+  "time": "2022-09-27T11:43:58.433Z",
+  "uid": "730a8de0-79a9-486f-b9c6-3820c3a6977c",
+  "user": "alice"
+}
+```
+
+### TES00E
+
+Elasticsearch Request Failed
+
+Example:
+
+```json
+{
+  "code": "TES00E",
+  "event": "db.session.elasticsearch.request",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## db.session.end
+
+Database Session Ended
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB01I",
+  "db_name": "",
+  "db_protocol": "mongodb",
+  "db_service": "mongo-primary",
+  "db_uri": "mongodb://mongo-1:27017,mongo-2:27018/?replicaSet=rs0",
+  "db_user": "alice",
+  "ei": 16,
+  "event": "db.session.end",
+  "sid": "13c04d4b-2e94-4106-a3a1-5ab8aae10465",
+  "time": "2021-07-14T07:06:25.608Z",
+  "uid": "0a2387cd-3fa2-4424-9c14-e33af17e4ab1",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.malformed_packet
+
+Database Malformed Packet
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB06I",
+  "db_name": "master",
+  "db_protocol": "sqlserver",
+  "db_service": "sqlserver02",
+  "db_uri": "localhost:1433",
+  "db_user": "sqlserver",
+  "ei": 50,
+  "event": "db.session.malformed_packet",
+  "payload": "AwEAkAAAAgByAGEAbQBfADEAIABuAHYAYQByAGMAaABhAHIAKAA0ADAAMAAwACkAC0AAXwBtAHMAcABhAHIAYQBtAF8AMAAA50AfCQTQADQWAHMAcAB0AF8AbQBvAG4AaQB0AG8AcgALQABfAG0AcwBwAGEAcgBhAG0AXwAxAADnQB8JBNAANAYAZABiAG8A",
+  "sid": "3ed38c42-eef0-419b-b893-f2f10990f117",
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "503e310d-8d88-4bea-bbbb-a1b35456a03a",
+  "user": "alice"
+}
+```
+
+## db.session.mysql.create_db
+
+MySQL Create Database
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY08I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.create_db",
+  "schema_name": "another_database",
+  "time": "2022-04-13T20:00:09.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.debug
+
+MySQL Debug
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY12I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.debug",
+  "time": "2022-04-13T20:00:05.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.drop_db
+
+MySQL Drop Database
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY09I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.drop_db",
+  "schema_name": "another_database",
+  "time": "2022-04-13T20:00:08.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.init_db
+
+MySQL Change Database
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY07I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.init_db",
+  "schema_name": "another_database",
+  "time": "2022-04-13T20:00:10.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.process_kill
+
+MySQL Kill Process
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY11I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.process_kill",
+  "process_id": 60,
+  "time": "2022-04-13T20:00:06.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.refresh
+
+MySQL Refresh
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY13I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.refresh",
+  "subcommand": "REFRESH_THREADS",
+  "time": "2022-04-13T20:00:04.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.shut_down
+
+MySQL Shut Down
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY10I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "event": "db.session.mysql.shut_down",
+  "time": "2022-04-13T20:00:07.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.bulk_execute
+
+MySQL Statement Bulk Execute
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY06I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.bulk_execute",
+  "parameters": null,
+  "statement_id": 1,
+  "time": "2022-02-10T20:57:53.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.close
+
+MySQL Statement Close
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY03I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.close",
+  "statement_id": 1,
+  "time": "2022-02-10T20:57:56.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.execute
+
+MySQL Statement Execute
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY01I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.execute",
+  "parameters": null,
+  "statement_id": 1,
+  "time": "2022-02-10T20:57:54.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.fetch
+
+MySQL Statement Fetch
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY05I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.fetch",
+  "rows_count": 5,
+  "statement_id": 1,
+  "time": "2022-02-10T20:57:55.000Z",
+  "uid": "0a2bd129-7c2f-4e68-9c84-a17dc4415444",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.prepare
+
+MySQL Statement Prepare
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY00I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.prepare",
+  "query": "UPDATE `test`.`user` SET `age` = '7' WHERE (`name` = 'alice')",
+  "time": "2022-02-10T20:57:50.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.reset
+
+MySQL Statement Reset
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY04I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.reset",
+  "statement_id": 1,
+  "time": "2022-02-10T20:57:52.000Z",
+  "uid": "0a2bd129-7c2f-4e68-9c84-a17dc4415444",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.mysql.statements.send_long_data
+
+MySQL Statement Send Long Data
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMY02I",
+  "db_name": "test",
+  "db_protocol": "mysql",
+  "db_service": "self-hosted-mysql",
+  "db_uri": "localhost:3306",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.mysql.statements.send_long_data",
+  "statement_id": 1,
+  "parameter_id": 2,
+  "data_size": 32,
+  "time": "2022-02-10T20:57:51.000Z",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.opensearch.request
+
+There are multiple events with the `db.session.opensearch.request` type.
+
+### TOS00I
+
+OpenSearch Request
+
+Example:
+
+```json
+{
+  "category": 2,
+  "cluster_name": "im-a-cluster-name",
+  "code": "TOS00I",
+  "db_protocol": "opensearch",
+  "db_service": "opensearch-aws",
+  "db_uri": "opensearch-aws-aaa111.eu-central-1.es.amazonaws.com:443",
+  "db_user": "arn:aws:iam::1234567890:role/teleport-db-role",
+  "ei": 1,
+  "event": "db.session.opensearch.request",
+  "headers": {
+    "Accept-Encoding": [
+      "gzip"
+    ],
+    "Content-Type": [
+      "application/json"
+    ],
+    "User-Agent": [
+      "Go-http-client/1.1"
+    ]
+  },
+  "method": "GET",
+  "path": "/_count",
+  "query": "",
+  "raw_query": "",
+  "sid": "370e5d86-84a6-4995-8476-dbea80f9eacf",
+  "status_code": 200,
+  "target": "",
+  "time": "2023-03-11T11:08:29.954Z",
+  "uid": "d15f795c-1f63-4076-bdd4-ffe88cde716e",
+  "user": "alice@example.com"
+}
+```
+
+### TOS00E
+
+OpenSearch Request Failed
+
+Example:
+
+```json
+{
+  "category": 2,
+  "cluster_name": "im-a-cluster-name",
+  "code": "TOS00E",
+  "db_protocol": "opensearch",
+  "db_service": "opensearch-aws",
+  "db_uri": "opensearch-aws-aaa111.eu-central-1.es.amazonaws.com:443",
+  "db_user": "arn:aws:iam::1234567890:role/does-not-exist",
+  "ei": 1,
+  "event": "db.session.opensearch.request",
+  "headers": {
+    "Accept-Encoding": [
+      "gzip"
+    ],
+    "Content-Type": [
+      "application/json"
+    ],
+    "User-Agent": [
+      "Go-http-client/1.1"
+    ]
+  },
+  "method": "GET",
+  "path": "/_count",
+  "query": "",
+  "raw_query": "",
+  "sid": "2d9a43c1-14ab-40fa-88db-195312f3401c",
+  "status_code": 0,
+  "target": "",
+  "time": "2023-03-11T11:08:29.954Z",
+  "uid": "01ad9a74-c8d6-497f-83db-e1c0be83d8da",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.permissions.update
+
+Database User Permissions Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB07I",
+  "db_name": "master",
+  "db_protocol": "postgres",
+  "db_service": "postgres-local",
+  "db_uri": "localhost:1433",
+  "db_user": "alice",
+  "ei": 50,
+  "event": "db.session.permissions.update",
+  "sid": "3ed38c42-eef0-419b-b893-f2f10990f117",
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "503e310d-8d88-4bea-bbbb-a1b35456a03a",
+  "user": "alice",
+  "permission_summary": [
+    {
+      "counts": {
+        "table": 1,
+        "view": 2
+      },
+      "permission": "INSERT"
+    },
+    {
+      "counts": {
+        "table": 2,
+        "view": 4
+      },
+      "permission": "SELECT"
+    },
+    {
+      "counts": {
+        "table": 3
+      },
+      "permission": "UPDATE"
+    }
+  ]
+}
+```
+
+## db.session.postgres.function
+
+PostgreSQL Function Call
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TPG04I",
+  "db_name": "test",
+  "db_protocol": "postgres",
+  "db_service": "local",
+  "db_uri": "localhost:5432",
+  "db_user": "postgres",
+  "ei": 23,
+  "event": "db.session.postgres.function",
+  "sid": "5e0c50cc-4ee7-4110-8d6e-735bf1f06f1f",
+  "function_oid": "123",
+  "function_args": [
+    "qweqweqwe"
+  ],
+  "time": "2021-12-16T00:40:37.073Z",
+  "uid": "295c88fc-4725-4de0-9049-64040fc69ec7",
+  "user": "alice"
+}
+```
+
+## db.session.postgres.statements.bind
+
+PostgreSQL Statement Bind
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TPG01I",
+  "db_name": "test",
+  "db_protocol": "postgres",
+  "db_service": "local",
+  "db_uri": "localhost:5432",
+  "db_user": "postgres",
+  "ei": 20,
+  "event": "db.session.postgres.statements.bind",
+  "parameters": [
+    "qweqweqwe"
+  ],
+  "portal_name": "",
+  "sid": "5e0c50cc-4ee7-4110-8d6e-735bf1f06f1f",
+  "statement_name": "test-ps",
+  "time": "2021-12-16T00:40:37.071Z",
+  "uid": "d5bed7e5-6a15-441b-b8ee-a2abd73f3136",
+  "user": "alice"
+}
+```
+
+## db.session.postgres.statements.close
+
+PostgreSQL Statement Close
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TPG03I",
+  "db_name": "test",
+  "db_protocol": "postgres",
+  "db_service": "local",
+  "db_uri": "localhost:5432",
+  "db_user": "postgres",
+  "ei": 22,
+  "event": "db.session.postgres.statements.close",
+  "portal_name": "",
+  "sid": "5e0c50cc-4ee7-4110-8d6e-735bf1f06f1f",
+  "statement_name": "test-ps",
+  "time": "2021-12-16T00:40:37.073Z",
+  "uid": "295c88fc-4725-4de0-9049-64040fc69ec7",
+  "user": "alice"
+}
+```
+
+## db.session.postgres.statements.execute
+
+PostgreSQL Statement Execute
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TPG02I",
+  "db_name": "test",
+  "db_protocol": "postgres",
+  "db_service": "local",
+  "db_uri": "localhost:5432",
+  "db_user": "postgres",
+  "ei": 21,
+  "event": "db.session.postgres.statements.execute",
+  "portal_name": "",
+  "sid": "5e0c50cc-4ee7-4110-8d6e-735bf1f06f1f",
+  "time": "2021-12-16T00:40:37.071Z",
+  "uid": "a0f045a2-45a4-4a4d-b14a-5f986c1818ff",
+  "user": "alice"
+}
+```
+
+## db.session.postgres.statements.parse
+
+PostgreSQL Statement Parse
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TPG00I",
+  "db_name": "test",
+  "db_protocol": "postgres",
+  "db_service": "local",
+  "db_uri": "localhost:5432",
+  "db_user": "postgres",
+  "ei": 19,
+  "event": "db.session.postgres.statements.parse",
+  "query": "select id from test where id = $1::varchar",
+  "sid": "5e0c50cc-4ee7-4110-8d6e-735bf1f06f1f",
+  "statement_name": "test-ps",
+  "time": "2021-12-16T00:40:37.069Z",
+  "uid": "06781ebf-6c5b-463b-ad32-e7395afd4a59",
+  "user": "alice"
+}
+```
+
+## db.session.query
+
+Database Query
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB02I",
+  "db_name": "test",
+  "db_protocol": "mongodb",
+  "db_query": "{\"find\": \"test\",\"filter\": {},\"lsid\": {\"id\": {\"$binary\":{\"base64\":\"2KMk23/TTCKUtiAVU0fbgg==\",\"subType\":\"04\"}}},\"$clusterTime\": {\"clusterTime\": {\"$timestamp\":{\"t\":\"1626246087\",\"i\":\"1\"}},\"signature\": {\"hash\": {\"$binary\":{\"base64\":\"8X7BlnDAUxKgUo5lpI3XoKoNF54=\",\"subType\":\"00\"}},\"keyId\": {\"$numberLong\":\"6969719000615878659\"}}},\"$db\": \"test\"}",
+  "db_service": "mongo-primary",
+  "db_uri": "mongodb://mongo-1:27017,mongo-2:27018/?replicaSet=rs0",
+  "db_user": "alice",
+  "ei": 11,
+  "event": "db.session.query",
+  "sid": "13c04d4b-2e94-4106-a3a1-5ab8aae10465",
+  "success": true,
+  "time": "2021-07-14T07:03:49.783Z",
+  "uid": "c4550623-0538-452d-912b-1242715666c4",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.query.failed
+
+Database Query Failed
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB02W",
+  "db_name": "houston",
+  "db_protocol": "mongodb",
+  "db_query": "{\"find\": \"test\",\"filter\": {},\"lsid\": {\"id\": {\"$binary\":{\"base64\":\"2KMk23/TTCKUtiAVU0fbgg==\",\"subType\":\"04\"}}},\"$clusterTime\": {\"clusterTime\": {\"$timestamp\":{\"t\":\"1626246227\",\"i\":\"1\"}},\"signature\": {\"hash\": {\"$binary\":{\"base64\":\"zBJKAl6VcjwQrr05N0O4qrQ92PY=\",\"subType\":\"00\"}},\"keyId\": {\"$numberLong\":\"6969719000615878659\"}}},\"$db\": \"houston\"}",
+  "db_service": "mongo-primary",
+  "db_uri": "mongodb://mongo-1:27017,mongo-2:27018/?replicaSet=rs0",
+  "db_user": "alice",
+  "ei": 13,
+  "error": "access to database denied",
+  "event": "db.session.query.failed",
+  "message": "access to database denied",
+  "sid": "13c04d4b-2e94-4106-a3a1-5ab8aae10465",
+  "success": false,
+  "time": "2021-07-14T07:05:22.32Z",
+  "uid": "21796ef9-a5dc-4595-a833-b893ac620488",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.spanner.rpc
+
+There are multiple events with the `db.session.spanner.rpc` type.
+
+### TSPN001W
+
+Spanner RPC Denied
+
+Example:
+
+```json
+{
+  "args": {
+    "database": "projects/project-id/instances/instance-id/databases/prod-db",
+    "session_count": 100,
+    "session_template": {}
+  },
+  "cluster_name": "root",
+  "code": "TSPN001W",
+  "db_name": "prod-db",
+  "db_origin": "dynamic",
+  "db_protocol": "spanner",
+  "db_service": "teleport-spanner",
+  "db_type": "spanner",
+  "db_uri": "spanner.googleapis.com:443",
+  "db_user": "some-user",
+  "error": "access to db denied. User does not have permissions. Confirm database user and name.",
+  "event": "db.session.spanner.rpc",
+  "message": "access to db denied. User does not have permissions. Confirm database user and name.",
+  "procedure": "BatchCreateSessions",
+  "sid": "04364984-a6d0-4e2c-93c7-5c44e2359502",
+  "success": false,
+  "time": "2024-03-13T01:25:48.568Z",
+  "uid": "1de57538-2eea-438b-a52d-3098f8093b28",
+  "user": "alice@example.com"
+}
+```
+
+### TSPN001I
+
+Spanner RPC
+
+Example:
+
+```json
+{
+  "args": {
+    "query_options": {},
+    "request_options": {},
+    "seqno": 1,
+    "session": "projects/project-id/instances/instance-id/databases/dev-db/sessions/ABCDEF1234567890Aye8_QwuELYD9rxa74YTWc-lu9LNuDDADbi4EOGm2C2j0ixe",
+    "sql": "select * from TestTable",
+    "transaction": {
+      "Selector": {
+        "SingleUse": {
+          "Mode": {
+            "ReadOnly": {
+              "TimestampBound": {
+                "Strong": true
+              },
+              "return_read_timestamp": true
+            }
+          }
+        }
+      }
+    }
+  },
+  "cluster_name": "root",
+  "code": "TSPN001I",
+  "db_name": "dev-db",
+  "db_origin": "dynamic",
+  "db_protocol": "spanner",
+  "db_service": "teleport-spanner",
+  "db_type": "spanner",
+  "db_uri": "spanner.googleapis.com:443",
+  "db_user": "some-user",
+  "event": "db.session.spanner.rpc",
+  "procedure": "ExecuteStreamingSql",
+  "sid": "406b9883-0e16-42f2-9d0b-b3bd956f9cd4",
+  "success": true,
+  "time": "2024-03-13T00:02:44.739Z",
+  "uid": "e0625e79-9399-4ea3-aa8b-dba1eb98658d",
+  "user": "alice@example.com"
+}
+```
+
+## db.session.sqlserver.rpc_request
+
+SQLServer RPC Request
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TMS00I",
+  "db_name": "master",
+  "db_protocol": "sqlserver",
+  "db_service": "sqlserver02",
+  "db_uri": "localhost:1433",
+  "db_user": "sqlserver",
+  "ei": 7,
+  "event": "db.session.sqlserver.rpc_request",
+  "parameters": [
+    "SELECT\ndtb.collation_name AS [Collation],\ndtb.name AS [DatabaseName2]\nFROM\nmaster.sys.databases AS dtb\nWHERE\n(dtb.name=@_msparam_0)"
+  ],
+  "proc_name": "Sp_ExecuteSql",
+  "sid": "6b37d89b-0d9c-4681-976b-ba12588a1bcd",
+  "time": "2022-06-02T08:29:17.693Z",
+  "uid": "a29dfad1-5a71-4c48-b4e0-10d1d857a23c",
+  "user": "alice"
+}
+```
+
+## db.session.start
+
+There are multiple events with the `db.session.start` type.
+
+### TDB00I
+
+Database Session Started
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB00I",
+  "db_name": "",
+  "db_protocol": "mongodb",
+  "db_service": "mongo-primary",
+  "db_uri": "mongodb://mongo-1:27017,mongo-2:27018/?replicaSet=rs0",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.start",
+  "namespace": "default",
+  "server_id": "05ff66c9-a948-42f4-af0e-a1b6ba62561e",
+  "sid": "13c04d4b-2e94-4106-a3a1-5ab8aae10465",
+  "success": true,
+  "time": "2021-07-14T07:01:31.958Z",
+  "uid": "4a613b84-7315-41f4-9219-1afd6b08d4da",
+  "user": "alice@example.com"
+}
+```
+
+### TDB00W
+
+Database Session Denied
+
+Example:
+
+```json
+{
+  "code": "TDB00W",
+  "event": "db.session.start",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## db.session.user.create
+
+There are multiple events with the `db.session.user.create` type.
+
+### TDB08I
+
+Database User Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB08I",
+  "db_name": "master",
+  "db_protocol": "postgres",
+  "db_service": "postgres-local",
+  "db_uri": "localhost:1433",
+  "db_user": "alice",
+  "ei": 0,
+  "event": "db.session.user.create",
+  "private_key_policy": "none",
+  "roles": null,
+  "sid": "47f20b91-f5c3-4eef-85e1-9509252238e7",
+  "success": true,
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "95e74359-e5a1-4c76-970e-c522b550dbb9",
+  "user": "alice",
+  "user_kind": 1,
+  "username": "alice"
+}
+```
+
+### TDB08W
+
+Database User Creation Failed
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB08W",
+  "db_name": "master",
+  "db_protocol": "postgres",
+  "db_service": "postgres-local",
+  "db_uri": "localhost:1433",
+  "db_user": "alice",
+  "ei": 0,
+  "error": "dummy error",
+  "event": "db.session.user.create",
+  "message": "dummy error",
+  "private_key_policy": "none",
+  "roles": null,
+  "sid": "3fd14bfe-be21-40a4-b1da-744fa14f5108",
+  "success": false,
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "4a4a6a70-c81d-4326-8565-3f7bd23b874f",
+  "user": "ben",
+  "user_kind": 1,
+  "username": "ben"
+}
+```
+
+## db.session.user.deactivate
+
+There are multiple events with the `db.session.user.deactivate` type.
+
+### TDB09I
+
+Database User Deactivated
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB09I",
+  "db_name": "master",
+  "db_protocol": "postgres",
+  "db_service": "postgres-local",
+  "db_uri": "localhost:1433",
+  "db_user": "alice",
+  "delete": false,
+  "ei": 5,
+  "event": "db.session.user.deactivate",
+  "private_key_policy": "none",
+  "sid": "c362e10b-dbc4-44e5-b90f-0bee5dd0c623",
+  "success": true,
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "0ab70491-4d33-4bc5-be58-27922a647f50",
+  "user": "ben",
+  "user_kind": 1,
+  "username": "ben"
+}
+```
+
+### TDB09W
+
+Database User Deactivate Failure
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDB09W",
+  "db_name": "master",
+  "db_protocol": "postgres",
+  "db_service": "postgres-local",
+  "db_uri": "localhost:1433",
+  "db_user": "alice",
+  "delete": false,
+  "ei": 4,
+  "error": "dummy error",
+  "event": "db.session.user.deactivate",
+  "message": "dummy error",
+  "private_key_policy": "none",
+  "sid": "3bb429a1-be03-4c03-827c-98ff846dacf7",
+  "success": false,
+  "time": "2022-06-02T08:46:33.825Z",
+  "uid": "c6569248-ac06-417d-b5b6-e0bf94eccb1a",
+  "user": "ben",
+  "user_kind": 1,
+  "username": "ben"
+}
+```
+
+## db.update
+
+Database Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "TDB04I",
+  "db_labels": {
+    "env": "local",
+    "teleport.dev/origin": "dynamic"
+  },
+  "db_protocol": "postgres",
+  "db_uri": "localhost:5432",
+  "ei": 0,
+  "event": "db.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "postgres-local",
+  "time": "2021-10-08T15:42:24.581Z",
+  "uid": "fe631a5a-6418-49d6-99e7-5280654663ec",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## desktop.clipboard.receive
+
+Clipboard Data Received
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP03I",
+  "desktop_addr": "100.104.52.89:3389",
+  "desktop_name": "desktop-name",
+  "ei": 0,
+  "event": "desktop.clipboard.receive",
+  "sid": "b7f734d8-bdc2-4996-8959-0b42a11708e7",
+  "time": "2021-10-18T23:39:13.105Z",
+  "uid": "84d408d1-3314-4a30-b7b7-35970633c9de",
+  "user": "joe",
+  "length": 512
+}
+```
+
+## desktop.clipboard.send
+
+Clipboard Data Sent
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP02I",
+  "desktop_addr": "100.104.52.89:3389",
+  "desktop_name": "desktop-name",
+  "ei": 0,
+  "event": "desktop.clipboard.send",
+  "sid": "b7f734d8-bdc2-4996-8959-0b42a11708e7",
+  "time": "2021-10-18T23:39:13.105Z",
+  "uid": "84d408d1-3314-4a30-b7b7-35970633c9de",
+  "user": "joe",
+  "length": 512
+}
+```
+
+## desktop.directory.read
+
+There are multiple events with the `desktop.directory.read` type.
+
+### TDP05I
+
+Directory Sharing Read
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP05I",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 9766,
+  "event": "desktop.directory.read",
+  "file_path": "powershell-scripts/domain-controller.ps1",
+  "length": 734,
+  "offset": 0,
+  "proto": "tdp",
+  "sid": "b9329a34-ab0c-4aa0-9fc8-1054d491e818",
+  "success": true,
+  "time": "2022-10-21T23:07:36.496189Z",
+  "uid": "a6ea5e5b-daac-47c2-9ce5-3f868e51a146",
+  "user": "joe"
+}
+```
+
+### TDP05W
+
+Directory Sharing Read Failed
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP05W",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 9766,
+  "event": "desktop.directory.read",
+  "file_path": "powershell-scripts/domain-controller.ps1",
+  "length": 734,
+  "offset": 0,
+  "proto": "tdp",
+  "sid": "b9329a34-ab0c-4aa0-9fc8-1054d491e818",
+  "success": false,
+  "time": "2022-10-21T23:07:36.496189Z",
+  "uid": "a6ea5e5b-daac-47c2-9ce5-3f868e51a146",
+  "user": "joe"
+}
+```
+
+## desktop.directory.share
+
+There are multiple events with the `desktop.directory.share` type.
+
+### TDP04I
+
+Directory Sharing Started
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP04I",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 3317,
+  "event": "desktop.directory.share",
+  "proto": "tdp",
+  "sid": "6ecf916d-dedf-4769-afc0-d08e55fbebf7",
+  "success": true,
+  "time": "2022-10-21T22:36:27.314409Z",
+  "uid": "f38b07d4-2f3e-400b-a91a-bad7283db775",
+  "user": "joe"
+}
+```
+
+### TDP04W
+
+Directory Sharing Start Failed
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP04W",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 3317,
+  "event": "desktop.directory.share",
+  "proto": "tdp",
+  "sid": "6ecf916d-dedf-4769-afc0-d08e55fbebf7",
+  "success": false,
+  "time": "2022-10-21T22:36:27.314409Z",
+  "uid": "f38b07d4-2f3e-400b-a91a-bad7283db775",
+  "user": "joe"
+}
+```
+
+## desktop.directory.write
+
+There are multiple events with the `desktop.directory.write` type.
+
+### TDP06I
+
+Directory Sharing Write
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP06I",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 7428,
+  "event": "desktop.directory.write",
+  "file_path": "powershell-scripts/domain-controller.ps1",
+  "length": 734,
+  "offset": 0,
+  "proto": "tdp",
+  "sid": "ea959406-27e4-4b11-85c4-1a485ff48417",
+  "success": true,
+  "time": "2022-10-21T23:19:34.519058Z",
+  "uid": "6bb2ebdf-d7e2-4a03-80ae-514ff9a5c71f",
+  "user": "joe"
+}
+```
+
+### TDP06W
+
+Directory Sharing Write Failed
+
+Example:
+
+```json
+{
+  "addr.remote": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP06W",
+  "desktop_addr": "ec2-54-162-177-255.compute-1.amazonaws.com:3389",
+  "desktop_name": "desktop-name",
+  "directory_id": 2,
+  "directory_name": "windows-server-2012-shared",
+  "ei": 7428,
+  "event": "desktop.directory.write",
+  "file_path": "powershell-scripts/domain-controller.ps1",
+  "length": 734,
+  "offset": 0,
+  "proto": "tdp",
+  "sid": "ea959406-27e4-4b11-85c4-1a485ff48417",
+  "success": false,
+  "time": "2022-10-21T23:19:34.519058Z",
+  "uid": "6bb2ebdf-d7e2-4a03-80ae-514ff9a5c71f",
+  "user": "joe"
+}
+```
+
+## device
+
+Device Enrolled
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV005I",
+  "device": {
+    "asset_tag": "M2CQVQV64R",
+    "device_id": "99d39707-efdd-436c-94f3-6a1aeef1fbf2",
+    "os_type": 2
+  },
+  "ei": 0,
+  "event": "device",
+  "status": {
+    "success": true
+  },
+  "time": "2023-01-12T19:28:36.842Z",
+  "uid": "94d33b77-82cd-4558-8893-0320699bf755",
+  "user": {
+    "user": "this user wont render properly"
+  }
+}
+```
+
+## device.authenticate
+
+Device Authenticated
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV006I",
+  "ei": 0,
+  "event": "device.authenticate",
+  "success": true,
+  "time": "2023-01-12T19:34:48.1Z",
+  "uid": "fa279611-91d8-47b5-9fad-b8ea3e5286e0",
+  "user": "lisa"
+}
+```
+
+## device.authenticate.confirm
+
+Device Web Authentication Confirmed
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV009I",
+  "device": {
+    "device_id": "f84f6b35-6226-4e73-8205-3bcbd7d12970",
+    "web_authentication": true,
+    "web_session_id": "my-session-id-12345"
+  },
+  "ei": 0,
+  "event": "device.authenticate.confirm",
+  "success": false,
+  "time": "2024-04-08T19:35:48.1Z",
+  "uid": "b1361d51-70fa-4f1b-803c-a252c2877707",
+  "user": "llama",
+  "user_kind": 1
+}
+```
+
+## device.create
+
+Device Registered
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV001I",
+  "device": {
+    "asset_tag": "M2CQVQV64R",
+    "device_id": "99d39707-efdd-436c-94f3-6a1aeef1fbf2",
+    "os_type": 2
+  },
+  "ei": 0,
+  "event": "device.create",
+  "success": true,
+  "time": "2023-01-12T19:28:36.842Z",
+  "uid": "94d33b77-82cd-4558-8893-0320699bf755",
+  "user": "3827e8ad-7cbe-4423-a80f-dfc89e83eb86.im-a-cluster-name"
+}
+```
+
+## device.delete
+
+Device Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV002I",
+  "device": {
+    "device_id": "99d39707-efdd-436c-94f3-6a1aeef1fbf2"
+  },
+  "ei": 0,
+  "event": "device.delete",
+  "success": true,
+  "time": "2023-01-12T20:33:20.527Z",
+  "uid": "a12e693e-1c45-43e4-a9d1-5fd8399e303c",
+  "user": "3827e8ad-7cbe-4423-a80f-dfc89e83eb86.im-a-cluster-name"
+}
+```
+
+## device.token.create
+
+Device Enroll Token Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV003I",
+  "device": {
+    "device_id": "99d39707-efdd-436c-94f3-6a1aeef1fbf2"
+  },
+  "ei": 0,
+  "event": "device.token.create",
+  "success": true,
+  "time": "2023-01-12T19:51:54.168Z",
+  "uid": "24cce2a0-57b7-494e-a196-c7fd2482b10c",
+  "user": "3827e8ad-7cbe-4423-a80f-dfc89e83eb86.im-a-cluster-name"
+}
+```
+
+## device.token.spent
+
+Device Enroll Token Spent
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV004I",
+  "device": {
+    "asset_tag": "M2CQVQV64R",
+    "device_id": "0e288b23-f99f-4635-b182-06e9308095a8",
+    "os_type": 2
+  },
+  "ei": 0,
+  "event": "device.token.spent",
+  "success": true,
+  "time": "2023-01-12T21:31:29.191Z",
+  "uid": "bbbc496f-820b-4f49-ae0d-1c1b29faee85",
+  "user": "lisa"
+}
+```
+
+## device.update
+
+Device Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV007I",
+  "device": {
+    "asset_tag": "M2CQVQV64R",
+    "device_id": "0e288b23-f99f-4635-b182-06e9308095a8",
+    "os_type": 2
+  },
+  "ei": 0,
+  "event": "device.update",
+  "success": true,
+  "time": "2023-01-12T21:31:29.191Z",
+  "uid": "bbbc496f-820b-4f49-ae0d-1c1b29faee85",
+  "user": "lisa"
+}
+```
+
+## device.webtoken.create
+
+Device Web Token Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TV008I",
+  "device": {
+    "asset_tag": "M2CQVQV64R",
+    "credential_id": "c7572891-8426-4e62-874f-c793029d53a6",
+    "device_id": "f84f6b35-6226-4e73-8205-3bcbd7d12970",
+    "os_type": 2
+  },
+  "ei": 0,
+  "event": "device.webtoken.create",
+  "success": true,
+  "time": "2024-03-05T17:18:43.296Z",
+  "uid": "b1361d51-70fa-4f1b-803c-a252c2877707",
+  "user": "llama",
+  "user_kind": 1
+}
+```
+
+## discovery_config.create
+
+Discovery Config Created
+
+Example:
+
+```json
+{
+  "code": "DC001I",
+  "event": "discovery_config.create",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "discovery-config",
+  "updated_by": "joe"
+}
+```
+
+## discovery_config.delete
+
+Discovery Config Deleted
+
+Example:
+
+```json
+{
+  "code": "DC003I",
+  "event": "discovery_config.delete",
+  "time": "2023-05-08T19:21:38.144Z",
+  "name": "discovery-config",
+  "updated_by": "joe"
+}
+```
+
+## discovery_config.delete_all
+
+All Discovery Configs Deleted
+
+Example:
+
+```json
+{
+  "code": "DC004I",
+  "event": "discovery_config.delete_all",
+  "time": "2023-05-08T19:21:39.144Z",
+  "name": "discovery-config",
+  "updated_by": "joe"
+}
+```
+
+## discovery_config.update
+
+Discovery Config Updated
+
+Example:
+
+```json
+{
+  "code": "DC002I",
+  "event": "discovery_config.update",
+  "time": "2023-05-08T19:21:37.144Z",
+  "name": "discovery-config",
+  "updated_by": "joe"
+}
+```
+
+## exec
+
+There are multiple events with the `exec` type.
+
+### T3002I
+
+Command Execution
+
+Example:
+
+```json
+{
+  "code": "T3002I",
+  "proto": "kube",
+  "kubernetes_cluster": "clusterOne",
+  "ei": 0,
+  "addr.local": "172.31.28.130:3022",
+  "addr.remote": "151.181.228.114:51752",
+  "event": "exec",
+  "namespace": "default",
+  "sid": "8d57a9d5-3848-5ce2-a326-85eb4a6d2eed",
+  "time": "2020-10-30T17:28:14.705Z",
+  "uid": "8ea5be3d-07b1-4308-8e0d-2d2ec57cbb20",
+  "user": "alex"
+}
+```
+
+### T3002E
+
+Command Execution Failed
+
+Example:
+
+```json
+{
+  "code": "T3002E",
+  "event": "exec",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## external_audit_storage.disable
+
+External Audit Storage Disabled
+
+Example:
+
+```json
+{
+  "code": "TEA002I",
+  "event": "external_audit_storage.disable",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## external_audit_storage.enable
+
+External Audit Storage Enabled
+
+Example:
+
+```json
+{
+  "code": "TEA001I",
+  "event": "external_audit_storage.enable",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## git.command
+
+There are multiple events with the `git.command` type.
+
+### TGIT001E
+
+Git Command Failed
+
+Example:
+
+```json
+{
+  "code": "TGIT001E",
+  "event": "git.command",
+  "time": "2024-12-07T11:11:11.111Z",
+  "uid": "7699b806-e717-4821-85a5-d2f41acbe373",
+  "user": "Linus.Torvalds",
+  "service": "git-upload-pack",
+  "exitError": "some-error",
+  "path": "my-org/my-repo"
+}
+```
+
+### TGIT001I
+
+Git Command
+
+Example:
+
+```json
+{
+  "code": "TGIT001I",
+  "event": "git.command",
+  "time": "2024-12-07T11:11:11.112Z",
+  "uid": "7699b806-e717-4821-85a5-d2f41acbe373",
+  "user": "Linus.Torvalds",
+  "service": "git-upload-pack",
+  "path": "my-org/my-repo"
+}
+```
+
+## github.created
+
+GitHub Auth Connector Created
+
+Example:
+
+```json
+{
+  "code": "T8000I",
+  "event": "github.created",
+  "name": "new_github_connector",
+  "time": "2020-06-05T19:28:00Z",
+  "uid": "2b7bb323-35d1-4b9c-9a6d-00ab34c95fb8",
+  "user": "unimplemented"
+}
+```
+
+## github.deleted
+
+GitHub Auth Connector Deleted
+
+Example:
+
+```json
+{
+  "code": "T8001I",
+  "event": "github.deleted",
+  "name": "new_github_connector",
+  "time": "2020-06-05T19:28:28Z",
+  "uid": "26f12a67-d593-40df-b3d3-965faee60143",
+  "user": "unimplemented"
+}
+```
+
+## github.updated
+
+GitHub Auth Connector Updated
+
+Example:
+
+```json
+{
+  "code": "T80002I",
+  "event": "github.updated",
+  "name": "new_github_connector",
+  "time": "2020-06-05T19:28:28Z",
+  "uid": "26f12a67-d593-40df-b3d3-965faee60143",
+  "user": "unimplemented"
+}
+```
+
+## health_check_config.create
+
+Health Check Config Created
+
+Example:
+
+```json
+{
+  "cluster_name": "gavin-leaf.cloud.gravitational.io",
+  "code": "THCC001I",
+  "ei": 0,
+  "event": "health_check_config.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "example-cfg",
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "gavin"
+}
+```
+
+## health_check_config.delete
+
+Health Check Config Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "gavin-leaf.cloud.gravitational.io",
+  "code": "THCC003I",
+  "ei": 0,
+  "event": "health_check_config.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "example-cfg",
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "gavin"
+}
+```
+
+## health_check_config.update
+
+Health Check Config Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "gavin-leaf.cloud.gravitational.io",
+  "code": "THCC002I",
+  "ei": 0,
+  "event": "health_check_config.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "example-cfg",
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "gavin"
+}
+```
+
+## instance.join
+
+There are multiple events with the `instance.join` type.
+
+### TJ002I
+
+Instance Joined
+
+Example:
+
+```json
+{
+  "cluster_name": "root.tele.ottr.sh",
+  "code": "TJ002I",
+  "ei": 0,
+  "event": "instance.join",
+  "method": "token",
+  "node_name": "noah-laptop-follower",
+  "role": "Instance",
+  "success": true,
+  "time": "2022-12-06T09:17:06.392Z",
+  "token_name": "************************a2418147",
+  "uid": "c1ea0e6c-ee3a-4f7e-9a98-9df283b01a98"
+}
+```
+
+### TJ002E
+
+Instance Join Failed
+
+Example:
+
+```json
+{
+  "code": "TJ002E",
+  "event": "instance.join",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## integration.create
+
+Integration Created
+
+Example:
+
+```json
+{
+  "code": "IG001I",
+  "event": "integration.create",
+  "time": "2023-05-09T19:21:36.144Z",
+  "name": "integration",
+  "updated_by": "joe"
+}
+```
+
+## integration.delete
+
+Integration Deleted
+
+Example:
+
+```json
+{
+  "code": "IG003I",
+  "event": "integration.delete",
+  "time": "2023-05-09T19:21:38.144Z",
+  "name": "integration",
+  "updated_by": "joe"
+}
+```
+
+## integration.update
+
+Integration Updated
+
+Example:
+
+```json
+{
+  "code": "IG002I",
+  "event": "integration.update",
+  "time": "2023-05-09T19:21:37.144Z",
+  "name": "integration",
+  "updated_by": "joe"
+}
+```
+
+## join_token.bound_keypair.join_state_verification_failed
+
+Bound Keypair Join Verification Failed
+
+Example:
+
+```json
+{
+  "code": "TBK003W",
+  "event": "join_token.bound_keypair.join_state_verification_failed",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## join_token.bound_keypair.recovery
+
+Bound Keypair Recovery
+
+Example:
+
+```json
+{
+  "code": "TBK001I",
+  "event": "join_token.bound_keypair.recovery",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## join_token.bound_keypair.rotation
+
+Bound Keypair Rotation
+
+Example:
+
+```json
+{
+  "code": "TBK002I",
+  "event": "join_token.bound_keypair.rotation",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## join_token.create
+
+Join Token Created
+
+Example:
+
+```json
+{
+  "code": "TJT00I",
+  "event": "join_token.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## kube.create
+
+Kubernetes Created
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "T3010I",
+  "kube_labels": {
+    "env": "local",
+    "teleport.dev/origin": "dynamic"
+  },
+  "ei": 0,
+  "event": "kube.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "kube-local",
+  "time": "2022-09-08T15:42:36.005Z",
+  "uid": "9d37514f-aef5-426f-9fda-31fd35d070f5",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## kube.delete
+
+Kubernetes Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "T3012I",
+  "ei": 0,
+  "event": "kube.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "kube-local",
+  "time": "2022-09-08T15:42:36.005Z",
+  "uid": "74f5e6b9-50c4-4195-bb26-d615641255bc",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## kube.request
+
+Kubernetes Request
+
+Example:
+
+```json
+{
+  "addr.local": "127.0.0.1:3027",
+  "addr.remote": "[::1]:43026",
+  "code": "T3009I",
+  "ei": 0,
+  "event": "kube.request",
+  "kubernetes_cluster": "gke_teleport-a",
+  "login": "awly",
+  "namespace": "default",
+  "proto": "kube",
+  "request_path": "/api/v1/namespaces/teletest/pods/test-pod",
+  "resource_api_group": "core/v1",
+  "resource_kind": "pods",
+  "resource_name": "test-pod",
+  "resource_namespace": "teletest",
+  "response_code": 200,
+  "server_id": "9b67377e-d61e-4865-96d6-fa71989fd9e9",
+  "time": "2020-11-12T20:35:44.978Z",
+  "uid": "8c1459a8-9199-4d25-bc5d-38e000ddd9ab",
+  "user": "alex",
+  "verb": "GET"
+}
+```
+
+## kube.update
+
+Kubernetes Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "root",
+  "code": "T3011I",
+  "kube_labels": {
+    "env": "local",
+    "teleport.dev/origin": "dynamic"
+  },
+  "ei": 0,
+  "event": "kube.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "kube-local",
+  "time": "2022-09-08T15:42:36.005Z",
+  "uid": "fe631a5a-6418-49d6-99e7-5280654663ec",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+```
+
+## lock.created
+
+Lock Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TLK00I",
+  "ei": 0,
+  "event": "lock.created",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "lock-name",
+  "time": "2021-08-06T18:47:19.75Z",
+  "uid": "070fcb2a-e1cf-5b84-8190-14448cc63c76",
+  "user": "df83fda8-1111-5567-8bcc-c282dec3290e.im-a-cluster-name"
+}
+```
+
+## lock.deleted
+
+Lock Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TLK01I",
+  "ei": 0,
+  "event": "lock.deleted",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "lock-name",
+  "time": "2021-08-06T18:49:51.626Z",
+  "uid": "e4630384-ac85-5a43-9ba9-3355b8d5cae4",
+  "user": "df83fda8-1111-5567-8bcc-c282dec3290e.im-a-cluster-name"
+}
+```
+
+## login_rule.create
+
+Login Rule Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TLR00I",
+  "ei": 0,
+  "event": "login_rule.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "test_rule",
+  "time": "2023-01-25T19:21:36.144Z",
+  "uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
+  "user": "nic"
+}
+```
+
+## login_rule.delete
+
+Login Rule Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TLR01I",
+  "ei": 0,
+  "event": "login_rule.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "test_rule",
+  "time": "2023-01-25T19:21:36.144Z",
+  "uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
+  "user": "nic"
+}
+```
+
+## mcp.session.end
+
+There are multiple events with the `mcp.session.end` type.
+
+### TMCP002I
+
+MCP Session Ended
+
+Example:
+
+```json
+{
+  "code": "TMCP002I",
+  "ei": 0,
+  "event": "mcp.session.end",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T12:22:22.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": true
+}
+```
+
+### TMCP002E
+
+MCP Session End Failure
+
+Example:
+
+```json
+{
+  "code": "TMCP002E",
+  "ei": 0,
+  "event": "mcp.session.end",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T12:22:22.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": true,
+  "error": "HTTP 405 Method Not Allowed"
+}
+```
+
+## mcp.session.invalid_http_request
+
+MCP Session Invalid Request
+
+Example:
+
+```json
+{
+  "code": "TMCP006E",
+  "ei": 0,
+  "event": "mcp.session.invalid_http_request",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T12:22:22.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "method": "OPTIONS",
+  "path": "/"
+}
+```
+
+## mcp.session.listen_sse_stream
+
+There are multiple events with the `mcp.session.listen_sse_stream` type.
+
+### TMCP005I
+
+MCP Session Listen
+
+Example:
+
+```json
+{
+  "code": "TMCP005I",
+  "ei": 0,
+  "event": "mcp.session.listen_sse_stream",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T12:22:22.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": true
+}
+```
+
+### TMCP005E
+
+MCP Session Listen Failure
+
+Example:
+
+```json
+{
+  "code": "TMCP005E",
+  "ei": 0,
+  "event": "mcp.session.listen_sse_stream",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T12:22:22.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": false,
+  "error": "HTTP 405 Method Not Allowed"
+}
+```
+
+## mcp.session.notification
+
+There are multiple events with the `mcp.session.notification` type.
+
+### TMCP004I
+
+MCP Session Notification
+
+Example:
+
+```json
+{
+  "code": "TMCP004I",
+  "ei": 0,
+  "event": "mcp.session.notification",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T11:11:11.333Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": true,
+  "message": {
+    "method": "notifications/initialized",
+    "jsonrpc": "2.0"
+  }
+}
+```
+
+### TMCP004E
+
+MCP Session Notification Failure
+
+Example:
+
+```json
+{
+  "code": "TMCP004E",
+  "ei": 0,
+  "event": "mcp.session.notification",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T11:11:11.333Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": false,
+  "message": {
+    "method": "notifications/initialized",
+    "jsonrpc": "2.0"
+  },
+  "error": "HTTP 401 Unauthorized"
+}
+```
+
+## mcp.session.request
+
+There are multiple events with the `mcp.session.request` type.
+
+### TMCP003I
+
+MCP Session Request
+
+Example:
+
+```json
+{
+  "code": "TMCP003I",
+  "ei": 0,
+  "event": "mcp.session.request",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T11:11:11.222Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": true,
+  "message": {
+    "id": 0,
+    "method": "initialize",
+    "params": {
+      "clientInfo": {
+        "name": "claude-ai",
+        "version": "0.1.0"
+      },
+      "protocolVersion": "2024-11-05"
+    },
+    "jsonrpc": "2.0"
+  }
+}
+```
+
+### TMCP003E
+
+MCP Session Request Failure
+
+Example:
+
+```json
+{
+  "code": "TMCP003E",
+  "ei": 0,
+  "event": "mcp.session.request",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T11:11:11.555Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything",
+  "success": false,
+  "error": "access denied",
+  "message": {
+    "id": 2,
+    "method": "tools/call",
+    "params": {
+      "name": "write_file",
+      "arguments": {
+        "path": "/etc/passwd"
+      }
+    },
+    "jsonrpc": "2.0"
+  }
+}
+```
+
+## mcp.session.start
+
+MCP Session Started
+
+Example:
+
+```json
+{
+  "code": "TMCP001I",
+  "ei": 0,
+  "event": "mcp.session.start",
+  "namespace": "default",
+  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
+  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
+  "time": "2025-05-23T11:11:11.111Z",
+  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
+  "user": "ai-user",
+  "app_name": "mcp-everything"
+}
+```
+
+## mfa.delete
+
+There are multiple events with the `mfa.delete` type.
+
+### T1006I
+
+MFA Device Added
+
+Example:
+
+```json
+{
+  "cluster_name": "localhost",
+  "code": "T1006I",
+  "mfa_device_name": "usb-c",
+  "mfa_device_type": "U2F",
+  "mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
+  "ei": 0,
+  "event": "mfa.delete",
+  "time": "2021-03-03T22:58:34.737Z",
+  "uid": "9be91d9e-79ec-422b-b6ae-ccf7235476d4",
+  "user": "awly"
+}
+```
+
+### T1007I
+
+MFA Device Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "localhost",
+  "code": "T1007I",
+  "mfa_device_name": "usb-c",
+  "mfa_device_type": "U2F",
+  "mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
+  "ei": 0,
+  "event": "mfa.delete",
+  "time": "2021-03-03T22:58:44.737Z",
+  "uid": "c6afe861-d53c-42ce-837c-7920d2398b44",
+  "user": "awly"
+}
+```
+
+## mfa_auth_challenge.create
+
+MFA Authentication Attempt
+
+Example:
+
+```json
+{
+  "challenge_allow_reuse": false,
+  "challenge_scope": "CHALLENGE_SCOPE_LOGIN",
+  "cluster_name": "zarq",
+  "code": "T1015I",
+  "ei": 0,
+  "event": "mfa_auth_challenge.create",
+  "time": "2024-04-16T21:46:59.317Z",
+  "uid": "815bbcf4-fb05-4e08-917c-7259e9332d69",
+  "user": "llama",
+  "user_kind": 1
+}
+```
+
+## mfa_auth_challenge.validate
+
+There are multiple events with the `mfa_auth_challenge.validate` type.
+
+### T1016I
+
+MFA Authentication Success
+
+Example:
+
+```json
+{
+  "code": "T1016I",
+  "event": "mfa_auth_challenge.validate",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T1016W
+
+MFA Authentication Failure
+
+Example:
+
+```json
+{
+  "code": "T1016W",
+  "event": "mfa_auth_challenge.validate",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## oidc.created
+
+OIDC Auth Connector Created
+
+Example:
+
+```json
+{
+  "code": "T8100I",
+  "event": "oidc.created",
+  "name": "new_oidc_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## oidc.deleted
+
+OIDC Auth Connector Deleted
+
+Example:
+
+```json
+{
+  "code": "T8101I",
+  "event": "oidc.deleted",
+  "name": "new_oidc_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## oidc.updated
+
+OIDC Auth Connector Updated
+
+Example:
+
+```json
+{
+  "code": "T8102I",
+  "event": "oidc.updated",
+  "name": "new_oidc_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## okta.access_list.sync
+
+There are multiple events with the `okta.access_list.sync` type.
+
+### TOK006I
+
+Okta access list synchronization completed
+
+Example:
+
+```json
+{
+  "code": "TOK006I",
+  "event": "okta.access_list.sync",
+  "time": "2023-05-08T19:21:36.144Z"
+}
+```
+
+### TOK006E
+
+Okta access list synchronization failed
+
+Example:
+
+```json
+{
+  "code": "TOK006E",
+  "event": "okta.access_list.sync",
+  "time": "2023-05-08T19:21:36.144Z"
+}
+```
+
+## okta.applications.update
+
+Okta applications have been updated
+
+Example:
+
+```json
+{
+  "code": "TOK002I",
+  "event": "okta.applications.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "added": 5,
+  "updated": 1,
+  "deleted": 7
+}
+```
+
+## okta.assignment.cleanup
+
+There are multiple events with the `okta.assignment.cleanup` type.
+
+### TOK005I
+
+Okta assignment has been cleaned up
+
+Example:
+
+```json
+{
+  "code": "TOK005I",
+  "event": "okta.assignment.cleanup",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "assignment-id",
+  "source": "source",
+  "user": "mike"
+}
+```
+
+### TOK005E
+
+Okta assignment failed to clean up
+
+Example:
+
+```json
+{
+  "code": "TOK005E",
+  "event": "okta.assignment.cleanup",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "assignment-id",
+  "source": "source",
+  "user": "mike"
+}
+```
+
+## okta.assignment.process
+
+There are multiple events with the `okta.assignment.process` type.
+
+### TOK004I
+
+Okta assignment has been processed
+
+Example:
+
+```json
+{
+  "code": "TOK004I",
+  "event": "okta.assignment.process",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "assignment-id",
+  "source": "source",
+  "user": "mike"
+}
+```
+
+### TOK004E
+
+Okta assignment failed to process
+
+Example:
+
+```json
+{
+  "code": "TOK004E",
+  "event": "okta.assignment.process",
+  "time": "2023-05-08T19:21:36.144Z",
+  "name": "assignment-id",
+  "source": "source",
+  "user": "mike"
+}
+```
+
+## okta.groups.update
+
+Okta groups have been updated
+
+Example:
+
+```json
+{
+  "code": "TOK001I",
+  "event": "okta.groups.update",
+  "time": "2023-05-08T19:21:36.144Z",
+  "added": 5,
+  "updated": 1,
+  "deleted": 7
+}
+```
+
+## okta.sync.failure
+
+Okta synchronization failed
+
+Example:
+
+```json
+{
+  "code": "TOK003E",
+  "event": "okta.sync.failure",
+  "time": "2023-05-08T19:21:36.144Z"
+}
+```
+
+## okta.user.sync
+
+There are multiple events with the `okta.user.sync` type.
+
+### TOK007I
+
+Okta user synchronization completed
+
+Example:
+
+```json
+{
+  "code": "TOK007I",
+  "event": "okta.user.sync",
+  "time": "2023-05-08T19:21:36.144Z",
+  "num_users_created": 5,
+  "num_users_deleted": 1,
+  "num_users_modified": 7
+}
+```
+
+### TOK007E
+
+Okta user synchronization failed
+
+Example:
+
+```json
+{
+  "code": "TOK007E",
+  "event": "okta.user.sync",
+  "time": "2023-05-08T19:21:36.144Z"
+}
+```
+
+## plugin.create
+
+Plugin Created
+
+Example:
+
+```json
+{
+  "code": "PG001I",
+  "event": "plugin.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## plugin.delete
+
+Plugin Deleted
+
+Example:
+
+```json
+{
+  "code": "PG003I",
+  "event": "plugin.delete",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## plugin.update
+
+Plugin Updated
+
+Example:
+
+```json
+{
+  "code": "PG002I",
+  "event": "plugin.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## port
+
+There are multiple events with the `port` type.
+
+### T3003I
+
+Port Forwarding Start
+
+Example:
+
+```json
+{
+  "code": "T3003I",
+  "event": "port",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T3003E
+
+Port Forwarding Failure
+
+Example:
+
+```json
+{
+  "code": "T3003E",
+  "event": "port",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T3003S
+
+Port Forwarding Stop
+
+Example:
+
+```json
+{
+  "code": "T3003S",
+  "event": "port",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## privilege_token.create
+
+Privilege Token Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "T6002I",
+  "ei": 0,
+  "event": "privilege_token.create",
+  "expires": "2021-11-01T22:29:47.989984Z",
+  "name": "user@example.com",
+  "time": "2021-11-01T22:24:47.99Z",
+  "ttl": "5m0s",
+  "uid": "6a9d5ac1-08c5-5c1e-9ebd-086d34155b08",
+  "user": "user@example.com"
+}
+```
+
+## recovery_code.generated
+
+Recovery Codes Generated
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "T1008I",
+  "ei": 0,
+  "event": "recovery_code.generated",
+  "time": "2021-08-05T21:16:17.13Z",
+  "uid": "ed0f6962-e34d-5fa4-bd41-7961cf2c51bb",
+  "user": "user@example.com"
+}
+```
+
+## recovery_code.used
+
+There are multiple events with the `recovery_code.used` type.
+
+### T1009I
+
+Recovery Code Used
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "T1009I",
+  "ei": 0,
+  "event": "recovery_code.used",
+  "success": true,
+  "time": "2021-08-05T21:22:46.042Z",
+  "uid": "4bb44dfe-70dc-5820-8c65-0baf40f62d13",
+  "user": "user@example.com"
+}
+```
+
+### T1009W
+
+Recovery Code Use Failed
+
+Example:
+
+```json
+{
+  "cluster_name": "localhost",
+  "code": "T1009W",
+  "ei": 0,
+  "error": "recovery code did not match",
+  "event": "recovery_code.used",
+  "message": "recovery code did not match",
+  "success": false,
+  "time": "2021-08-05T23:32:41.273Z",
+  "uid": "714625ab-48d5-51d0-ab1f-c4b267881594",
+  "user": "user@example.com"
+}
+```
+
+## recovery_token.create
+
+Recovery Token Created
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "T6001I",
+  "ei": 0,
+  "event": "recovery_token.create",
+  "expires": "2021-08-05T21:56:14.935267Z",
+  "name": "user@example.com",
+  "time": "2021-08-05T21:41:14.935Z",
+  "ttl": "15m0s",
+  "uid": "29cd2ad5-f1cd-54d2-85fc-4910fbfc9bfa",
+  "user": "user@example.com"
+}
+```
+
+## reset_password_token.create
+
+Reset Password Token Created
+
+Example:
+
+```json
+{
+  "code": "T6000I",
+  "name": "hello",
+  "event": "reset_password_token.create",
+  "time": "2020-06-05T16:24:22Z",
+  "ttl": "8h0m0s",
+  "uid": "85fef5df-6dca-475e-a049-393f4cf1d6a3",
+  "user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
+}
+```
+
+## resize
+
+Terminal Resize
+
+Example:
+
+```json
+{
+  "code": "T2002I",
+  "ei": 3,
+  "event": "resize",
+  "login": "root",
+  "namespace": "default",
+  "sid": "56408539-6536-11e9-80a1-427cfde50f5a",
+  "size": "80:25",
+  "time": "2019-04-22T19:39:52.432Z",
+  "uid": "917d8108-3617-4273-ab37-7bbf8e7c1ab9",
+  "user": "admin@example.com"
+}
+```
+
+## role.created
+
+User Role Created
+
+Example:
+
+```json
+{
+  "code": "T9000I",
+  "event": "role.created",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## role.deleted
+
+User Role Deleted
+
+Example:
+
+```json
+{
+  "code": "T9001I",
+  "event": "role.deleted",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## role.updated
+
+User Role Updated
+
+Example:
+
+```json
+{
+  "code": "T9002I",
+  "event": "role.updated",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## saml.created
+
+SAML Connector Created
+
+Example:
+
+```json
+{
+  "code": "T8200I",
+  "event": "saml.created",
+  "name": "new_saml_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## saml.deleted
+
+SAML Connector Deleted
+
+Example:
+
+```json
+{
+  "code": "T8201I",
+  "event": "saml.deleted",
+  "name": "new_saml_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## saml.idp.auth
+
+SAML IdP authentication
+
+Example:
+
+```json
+{
+  "code": "TSI000I",
+  "event": "saml.idp.auth",
+  "time": "2023-01-25T19:21:36.144Z",
+  "user": "mike",
+  "session_id": "123456",
+  "success": true,
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+## saml.idp.service.provider.create
+
+There are multiple events with the `saml.idp.service.provider.create` type.
+
+### TSI001I
+
+SAML IdP service provider created
+
+Example:
+
+```json
+{
+  "code": "TSI001I",
+  "event": "saml.idp.service.provider.create",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+### TSI001W
+
+SAML IdP service provider create failed
+
+Example:
+
+```json
+{
+  "code": "TSI001W",
+  "event": "saml.idp.service.provider.create",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+## saml.idp.service.provider.delete
+
+There are multiple events with the `saml.idp.service.provider.delete` type.
+
+### TSI003I
+
+SAML IdP service provider deleted
+
+Example:
+
+```json
+{
+  "code": "TSI003I",
+  "event": "saml.idp.service.provider.delete",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+### TSI003W
+
+SAML IdP service provider delete failed
+
+Example:
+
+```json
+{
+  "code": "TSI003W",
+  "event": "saml.idp.service.provider.delete",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+### TSI004I
+
+All SAML IdP service provider deleted
+
+Example:
+
+```json
+{
+  "code": "TSI004I",
+  "event": "saml.idp.service.provider.delete",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike"
+}
+```
+
+### TSI004W
+
+SAML IdP service provider delete failed
+
+Example:
+
+```json
+{
+  "code": "TSI004W",
+  "event": "saml.idp.service.provider.delete",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike"
+}
+```
+
+## saml.idp.service.provider.update
+
+There are multiple events with the `saml.idp.service.provider.update` type.
+
+### TSI002I
+
+SAML IdP service provider updated
+
+Example:
+
+```json
+{
+  "code": "TSI002I",
+  "event": "saml.idp.service.provider.update",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+### TSI002W
+
+SAML IdP service provider update failed
+
+Example:
+
+```json
+{
+  "code": "TSI002W",
+  "event": "saml.idp.service.provider.update",
+  "time": "2023-01-25T19:21:36.144Z",
+  "name": "saml-idp",
+  "updated_by": "mike",
+  "service_provider_entity_id": "valid-entity-id"
+}
+```
+
+## saml.updated
+
+SAML Connector Updated
+
+Example:
+
+```json
+{
+  "code": "T8202I",
+  "event": "saml.updated",
+  "name": "new_saml_connector",
+  "time": "2020-06-05T19:29:14Z",
+  "uid": "6208b4b9-0077-41aa-967a-f173b6bcc0d3",
+  "user": "unimplemented"
+}
+```
+
+## scim.create
+
+There are multiple events with the `scim.create` type.
+
+### TSCIM001I
+
+SCIM Resource Creation Succeeded
+
+Example:
+
+```json
+{
+  "ei": 163,
+  "time": "2023-05-08T19:21:36.144Z",
+  "cluster": "dev",
+  "code": "TSCIM001I",
+  "event": "scim.create",
+  "success": true,
+  "request": {
+    "id": "ff5cea87-db00-4fa8-a30f-99f220f61075",
+    "source_address": "127.0.0.1",
+    "user_agent": "carrier pigeon",
+    "method": "PUT",
+    "path": "/scim/v2/Users",
+    "body": {
+      "active": true,
+      "id": "external-id-0987654321",
+      "nickName": "bofh",
+      "schemas": [
+        "urn:ietf:params:scim:schemas:core:2.0:User"
+      ],
+      "userName": "root@localhost"
+    }
+  },
+  "integration": "okta",
+  "resource_type": "user",
+  "external_id": "external-id-0987654321",
+  "teleport_id": "root@localhost"
+}
+```
+
+### TSCIM001E
+
+SCIM Resource Creation Failed
+
+Example:
+
+```json
+{
+  "time": "2023-05-08T19:21:36.144Z",
+  "cluster": "dev",
+  "code": "TSCIM001E",
+  "event": "scim.create",
+  "success": false,
+  "error": "Too many candidates",
+  "integration": "okta",
+  "resource_type": "group",
+  "teleport_id": "access-list-guid",
+  "external_id": "0987654321",
+  "display": "Some group"
+}
+```
+
+## scim.delete
+
+There are multiple events with the `scim.delete` type.
+
+### TSCIM003I
+
+SCIM Delete Succeeded
+
+Example:
+
+```json
+{
+  "time": "2023-05-08T19:21:36.144Z",
+  "cluster": "dev",
+  "code": "TSCIM003I",
+  "event": "scim.delete",
+  "success": true,
+  "integration": "okta",
+  "resource_type": "user",
+  "teleport_id": "test@example.com",
+  "external_id": "external-id-00123456789",
+  "display": "test@example.com"
+}
+```
+
+### TSCIM003E
+
+SCIM Delete Failed
+
+Example:
+
+```json
+{
+  "time": "2023-05-08T19:21:37.000Z",
+  "cluster": "dev",
+  "code": "TSCIM003E",
+  "event": "scim.delete",
+  "resource_type": "group",
+  "success": false,
+  "error": "no such group",
+  "integration": "okta",
+  "teleport_id": "access-list-guid",
+  "external_id": "external-id-00123456789",
+  "display": "some group"
+}
+```
+
+## scim.get
+
+There are multiple events with the `scim.get` type.
+
+### TSCIM004I
+
+SCIM Resource Fetch Succeeded
+
+Example:
+
+```json
+{
+  "code": "TSCIM004I",
+  "event": "scim.get",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### TSCIM004E
+
+SCIM Resource Fetch Failed
+
+Example:
+
+```json
+{
+  "code": "TSCIM004E",
+  "event": "scim.get",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## scim.list
+
+There are multiple events with the `scim.list` type.
+
+### TSCIM005I
+
+SCIM Resource Listing Succeeded
+
+Example:
+
+```json
+{
+  "ei": 163,
+  "time": "2023-05-08T19:21:36.144Z",
+  "cluster": "dev",
+  "code": "TSCIM005I",
+  "event": "scim.list",
+  "success": true,
+  "integration": "okta",
+  "resource_type": "user",
+  "teleport_id": "root@localhost",
+  "external_id": "external-id-0987654321",
+  "display": "local admin"
+}
+```
+
+### TSCIM005IE
+
+SCIM Resource Listing Failed
+
+Example:
+
+```json
+{
+  "code": "TSCIM005IE",
+  "event": "scim.list",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## scim.update
+
+There are multiple events with the `scim.update` type.
+
+### TSCIM002I
+
+SCIM Update Succeeded
+
+Example:
+
+```json
+{
+  "time": "2023-05-08T19:21:36.144Z",
+  "cluster": "dev",
+  "code": "TSCIM002I",
+  "event": "scim.update",
+  "success": true,
+  "integration": "okta",
+  "resource_type": "user",
+  "teleport_id": "test@example.com",
+  "external_id": "externa-id-00123456789",
+  "display": "test@example.com"
+}
+```
+
+### TSCIM002E
+
+SCIM Update Failed
+
+Example:
+
+```json
+{
+  "time": "2023-05-08T19:21:37.000Z",
+  "cluster": "dev",
+  "code": "TSCIM002E",
+  "event": "scim.update",
+  "resource_type": "user",
+  "success": false,
+  "error": "no such user",
+  "integration": "okta",
+  "teleport_id": "test@example.com",
+  "external_id": "external-id-000123456789",
+  "display": "test@example.com"
+}
+```
+
+## scp
+
+There are multiple events with the `scp` type.
+
+### T3004I
+
+SCP Download
+
+Example:
+
+```json
+{
+  "code": "T3004I",
+  "action": "download",
+  "addr.local": "172.31.28.130:3022",
+  "addr.remote": "127.0.0.1:55594",
+  "event": "scp",
+  "login": "root",
+  "namespace": "default",
+  "path": "~/fsdfsdfsdfsdfs",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "183ca6de-c24b-4f67-854f-163c01245fa1",
+  "user": "admin@example.com"
+}
+```
+
+### T3004E
+
+SCP Download Failed
+
+Example:
+
+```json
+{
+  "action": "download",
+  "addr.local": "192.168.0.105:3022",
+  "addr.remote": "127.0.0.1:39932",
+  "cluster_name": "im-a-cluster-name",
+  "code": "T3004E",
+  "command": "/home/path scp --remote-addr=\"127.0.0.1:39932\" --local-addr=\"111.222.0.105:3022\" -f ~/sdfsdf",
+  "ei": 0,
+  "event": "scp",
+  "exitCode": "1",
+  "exitError": "exit status 1",
+  "login": "root",
+  "namespace": "default",
+  "path": "~/sdfsdf",
+  "server_id": "8045a8cc-49bb-4e02-bdc99313",
+  "sid": "8ff117ec-70a2-4481-8e359cf6",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "30e13b84-a51f-467676258b9bf",
+  "user": "root"
+}
+```
+
+### T3005I
+
+SCP Upload
+
+Example:
+
+```json
+{
+  "action": "upload",
+  "addr.local": "192.168.0.105:3022",
+  "addr.remote": "127.0.0.1:57058",
+  "cluster_name": "im-a-cluster-name",
+  "code": "T3005I",
+  "command": "/home/path scp --remote-addr=\"127.0.0.1:57058\" --local-addr=\"111.222.0.105:3022\" -t ~/",
+  "ei": 0,
+  "event": "scp",
+  "exitCode": "0",
+  "login": "root",
+  "namespace": "default",
+  "path": "~/",
+  "server_id": "8045a8cc-49bb-4e02-bdc5-a782a313",
+  "sid": "b484b5cc-9065-40fa-9a0c-db3",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root"
+}
+```
+
+### T3005E
+
+SCP Upload Failed
+
+Example:
+
+```json
+{
+  "code": "T3005E",
+  "event": "scp",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T3010E
+
+SCP Disallowed
+
+Example:
+
+```json
+{
+  "code": "T3010E",
+  "event": "scp",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## secreports.audit.query.run
+
+Access Monitoring Query Executed
+
+Example:
+
+```json
+{
+  "cluster_name": "root.com",
+  "code": "SRE001I",
+  "data_scanned_in_bytes": 4045,
+  "days": 90,
+  "event": "secreports.audit.query.run",
+  "query": "select * FROM cert_create",
+  "success": true,
+  "time": "2023-10-09T10:09:10.473Z",
+  "total_execution_time_in_millis": 1440,
+  "uid": "dc29d36c-c5b6-4ffc-9aa7-2d9ba18a3953",
+  "user": "marek"
+}
+```
+
+## secreports.report.run
+
+Access Monitoring Report Executed
+
+Example:
+
+```json
+{
+  "cluster_name": "root.com",
+  "code": "SRE002I",
+  "data_scanned_in_bytes": 13258,
+  "event": "secreports.report.run",
+  "name": "privilege_access_report_90_days",
+  "success": true,
+  "time": "2023-10-09T09:10:03.633Z",
+  "total_execution_time_in_millis": 14082,
+  "uid": "f44871b9-7247-467b-a760-8159d3f47bac",
+  "user": "system"
+}
+```
+
+## session.command
+
+Session Command
+
+Example:
+
+```json
+{
+  "argv": [
+    "google.com"
+  ],
+  "cgroup_id": 4294968064,
+  "code": "T4000I",
+  "ei": 5,
+  "event": "session.command",
+  "login": "root",
+  "namespace": "default",
+  "path": "/bin/ping",
+  "pid": 2653,
+  "ppid": 2660,
+  "program": "ping",
+  "return_code": 0,
+  "server_id": "96f2bed2-ebd1-494a-945c-2fd57de41644",
+  "sid": "44c6cea8-362f-11ea-83aa-125400432324",
+  "time": "2020-01-13T18:05:53.919Z",
+  "uid": "734930bb-00e6-4ee6-8798-37f1e9473fac",
+  "user": "benarent"
+}
+```
+
+## session.connect
+
+Session Connected
+
+Example:
+
+```json
+{
+  "addr.local": "192.168.0.106:43858",
+  "addr.remote": "192.168.0.106:3022",
+  "cluster_name": "im-a-cluster-name",
+  "code": "T2010I",
+  "ei": 0,
+  "event": "session.connect",
+  "server_addr": "192.168.0.106:43858",
+  "server_id": "bd5eff-f59b-4fb3-b8ed-757c52ff",
+  "time": "2022-02-04T18:15:28.572Z",
+  "uid": "f2a0f9-d78c-4c38-b3fa-ca63453b"
+}
+```
+
+## session.data
+
+Session Data
+
+Example:
+
+```json
+{
+  "addr.local": "172.10.1.1:3022",
+  "addr.remote": "172.10.1.254:46992",
+  "code": "T2006I",
+  "ei": 2147483646,
+  "event": "session.data",
+  "login": "root",
+  "rx": 3974,
+  "server_id": "b331fb6c-85f9-4cb0-b308-3452420bf81e",
+  "sid": "5fc8bf85-a73e-11ea-afd1-0242ac0a0101",
+  "time": "2020-06-05T15:14:51Z",
+  "tx": 4730,
+  "uid": "2f2f07d0-8a01-4abe-b1c0-5001fd86829b",
+  "user": "Stanley_Cooper"
+}
+```
+
+## session.disk
+
+Session File Access
+
+Example:
+
+```json
+{
+  "code": "T4001I",
+  "event": "session.disk",
+  "namespace": "default",
+  "sid": "44c6cea8-362f-11ea-83aa-125400432324",
+  "server_id": "96f2bed2",
+  "login": "root",
+  "user": "benarent",
+  "pid": 2653,
+  "cgroup_id": 4294968064,
+  "program": "bash",
+  "path": "/etc/profile.d/",
+  "flags": 2100000,
+  "return_code": 0,
+  "time": "2019-04-22T19:39:26.676Z"
+}
+```
+
+## session.end
+
+Session Ended
+
+Example:
+
+```json
+{
+  "cluster_name": "kimlisa.cloud.gravitational.io",
+  "code": "T2004I",
+  "ei": 1,
+  "enhanced_recording": false,
+  "event": "session.end",
+  "interactive": false,
+  "login": "root",
+  "namespace": "default",
+  "participants": [
+    "foo"
+  ],
+  "server_addr": "172.31.30.254:32962",
+  "server_hostname": "ip-172-31-30-254",
+  "server_id": "d3ddd1f8-b602-488b-00c66e29879f",
+  "session_start": "2021-05-21T22:23:55.313562027Z",
+  "session_stop": "2021-05-21T22:54:27.122508023Z",
+  "sid": "9d92ad96-a45c-4add-463cc7bc48b1",
+  "time": "2021-05-21T22:54:27.123Z",
+  "uid": "984ac949-6605-4f0a-e450aa5665f4",
+  "user": "foo"
+}
+```
+
+## session.join
+
+User Joined
+
+Example:
+
+```json
+{
+  "addr.local": "172.31.28.130:3022",
+  "addr.remote": "151.181.228.114:51752",
+  "code": "T2001I",
+  "ei": 4,
+  "event": "session.join",
+  "login": "root",
+  "namespace": "default",
+  "server_id": "de3800ea-69d9-4d72-a108-97e57f8eb393",
+  "sid": "56408539-6536-11e9-80a1-427cfde50f5a",
+  "time": "2019-04-22T19:39:52.434Z",
+  "uid": "13d26190-289b-41d4-af67-c8c8b0617ebe",
+  "user": "admin@example.com"
+}
+```
+
+## session.leave
+
+User Disconnected
+
+Example:
+
+```json
+{
+  "code": "T2003I",
+  "event": "session.leave",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## session.network
+
+Session Network Connection
+
+Example:
+
+```json
+{
+  "code": "T4002I",
+  "event": "session.network",
+  "namespace": "default",
+  "sid": "44c6cea8-362f-11ea-83aa-125400432324",
+  "server_id": "96f2bed2",
+  "login": "root",
+  "user": "benarent",
+  "pid": 2653,
+  "cgroup_id": 4294968064,
+  "program": "bash",
+  "src_addr": "10.217.136.161",
+  "dst_addr": "190.58.129.4",
+  "dst_port": "3000",
+  "version": 4,
+  "time": "2019-04-22T19:39:26.676Z",
+  "action": 1
+}
+```
+
+## session.process_exit
+
+Session Process Exit
+
+Example:
+
+```json
+{
+  "code": "T4003I",
+  "event": "session.process_exit",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## session.recording.access
+
+Session Recording Accessed
+
+Example:
+
+```json
+{
+  "code": "T2012I",
+  "event": "session.recording.access",
+  "sid": "44c6cea8-362f-11ea-83aa-125400432324",
+  "success": true,
+  "time": "2022-07-14T18:04:37.067Z",
+  "uid": "7d440ee1-15f6-4b56-9391-344e8984fd97",
+  "user": "ops@gravitational.io"
+}
+```
+
+## session.rejected
+
+Session Rejected
+
+Example:
+
+```json
+{
+  "code": "T1006W",
+  "event": "session.rejected",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## session.start
+
+Session Started
+
+Example:
+
+```json
+{
+  "addr.local": "172.31.28.130:3022",
+  "addr.remote": "151.181.228.114:51454",
+  "code": "T2000I",
+  "ei": 0,
+  "event": "session.start",
+  "login": "root",
+  "namespace": "default",
+  "server_id": "de3800ea-69d9-4d72-a108-97e57f8eb393",
+  "sid": "56408539-6536-11e9-80a1-427cfde50f5a",
+  "size": "80:25",
+  "time": "2019-04-22T19:39:26.676Z",
+  "uid": "84c07a99-856c-419f-9de5-15560451a116",
+  "user": "admin@example.com"
+}
+```
+
+## session.upload
+
+Session Uploaded
+
+Example:
+
+```json
+{
+  "code": "T2005I",
+  "event": "session.upload",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## session_recording_config.update
+
+Session Recording Configuration Updated
+
+Example:
+
+```json
+{
+  "code": "TCREC003I",
+  "event": "session_recording_config.update",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## sftp
+
+There are multiple events with the `sftp` type.
+
+### TS001I
+
+SFTP Open
+
+Example:
+
+```json
+{
+  "action": 1,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS001I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS001E
+
+SFTP Open Failed
+
+Example:
+
+```json
+{
+  "action": 1,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS001E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS007I
+
+SFTP Setstat
+
+Example:
+
+```json
+{
+  "action": 7,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS007I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS007E
+
+SFTP Setstat Failed
+
+Example:
+
+```json
+{
+  "action": 7,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS007E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS009I
+
+SFTP Opendir
+
+Example:
+
+```json
+{
+  "action": 9,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS009I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS009E
+
+SFTP Opendir Failed
+
+Example:
+
+```json
+{
+  "action": 9,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS009E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS010I
+
+SFTP Readdir
+
+Example:
+
+```json
+{
+  "action": 10,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS010I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS010E
+
+SFTP Readdir Failed
+
+Example:
+
+```json
+{
+  "action": 10,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS010E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS011I
+
+SFTP Remove
+
+Example:
+
+```json
+{
+  "action": 11,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS011I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS011E
+
+SFTP Remove Failed
+
+Example:
+
+```json
+{
+  "action": 11,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS011E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS012I
+
+SFTP Mkdir
+
+Example:
+
+```json
+{
+  "action": 12,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS012I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS012E
+
+SFTP Mkdir Failed
+
+Example:
+
+```json
+{
+  "action": 12,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS012E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS013I
+
+SFTP Rmdir
+
+Example:
+
+```json
+{
+  "action": 13,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS013I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS013E
+
+SFTP Rmdir Failed
+
+Example:
+
+```json
+{
+  "action": 13,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS013E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS016I
+
+SFTP Rename
+
+Example:
+
+```json
+{
+  "action": 16,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS016I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS016E
+
+SFTP Rename Failed
+
+Example:
+
+```json
+{
+  "action": 16,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS016E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS018I
+
+SFTP Symlink
+
+Example:
+
+```json
+{
+  "action": 18,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS018I",
+  "ei": 0,
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS018E
+
+SFTP Symlink Failed
+
+Example:
+
+```json
+{
+  "action": 18,
+  "addr.local": "[::1]:3022",
+  "addr.remote": "127.0.0.1:41106",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TS018E",
+  "ei": 0,
+  "error": "EOF",
+  "event": "sftp",
+  "login": "root",
+  "namespace": "default",
+  "path": "/tmp/file",
+  "server_hostname": "im-a-server-hostname",
+  "server_id": "e106fdd0-51db-4efa-a9ab-c3afa7a1565a",
+  "sid": "",
+  "time": "2019-04-22T19:41:23Z",
+  "uid": "16bfdc34-2766-a5d3-dfd6f7ff7ad6",
+  "user": "root",
+  "working_directory": "/root"
+}
+```
+
+### TS019I
+
+SFTP Link
+
+Example:
+
+```json
+{
+  "code": "TS019I",
+  "event": "sftp",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### TS019E
+
+SFTP Link Failed
+
+Example:
+
+```json
+{
+  "code": "TS019E",
+  "event": "sftp",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### TS020E
+
+SFTP Disallowed
+
+Example:
+
+```json
+{
+  "code": "TS020E",
+  "event": "sftp",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## sftp_summary
+
+File Transfer Completed
+
+Example:
+
+```json
+{
+  "code": "TS021I",
+  "event": "sftp_summary",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## sigstore_policy.create
+
+Sigstore Policy Created
+
+Example:
+
+```json
+{
+  "addr.remote": "203.0.113.77:64794",
+  "cluster_name": "clustername",
+  "code": "TSSP001I",
+  "ei": 0,
+  "event": "sigstore_policy.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "default",
+  "time": "2025-03-26T01:14:36.881Z",
+  "uid": "e52def2f-4109-4cc9-91a8-150c6792f89f",
+  "user": "bob",
+  "user_kind": 1
+}
+```
+
+## sigstore_policy.delete
+
+Sigstore Policy Deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "203.0.113.77:64794",
+  "cluster_name": "clustername",
+  "code": "TSSP003I",
+  "ei": 0,
+  "event": "sigstore_policy.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "default",
+  "time": "2025-03-26T01:14:36.881Z",
+  "uid": "e52def2f-4109-4cc9-91a8-150c6792f89f",
+  "user": "bob",
+  "user_kind": 1
+}
+```
+
+## sigstore_policy.update
+
+Sigstore Policy Updated
+
+Example:
+
+```json
+{
+  "addr.remote": "203.0.113.77:64794",
+  "cluster_name": "clustername",
+  "code": "TSSP002I",
+  "ei": 0,
+  "event": "sigstore_policy.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "default",
+  "time": "2025-03-26T01:14:36.881Z",
+  "uid": "e52def2f-4109-4cc9-91a8-150c6792f89f",
+  "user": "bob",
+  "user_kind": 1
+}
+```
+
+## spiffe.svid.issued
+
+There are multiple events with the `spiffe.svid.issued` type.
+
+### TSPIFFE000I
+
+SPIFFE SVID Issued
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:54378",
+  "cluster_name": "leaf.tele.ottr.sh",
+  "code": "TSPIFFE000I",
+  "dns_sans": null,
+  "ei": 0,
+  "event": "spiffe.svid.issued",
+  "hint": "",
+  "ip_sans": null,
+  "serial_number": "d1:e5:fc:bf:19:67:e7:8c:7a:21:37:b5:05:ea:77:41",
+  "spiffe_id": "spiffe://example.teleport.com/bar",
+  "svid_type": "x509",
+  "time": "2024-02-02T15:48:25.35Z",
+  "uid": "45e13afc-0890-4ffb-b125-99d93c26d7de",
+  "user": "bot-test12",
+  "user_kind": 2
+}
+```
+
+### TSPIFFE000E
+
+SPIFFE SVID Issued Failure
+
+Example:
+
+```json
+{
+  "code": "TSPIFFE000E",
+  "event": "spiffe.svid.issued",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## ssm.run
+
+There are multiple events with the `ssm.run` type.
+
+### TDS00I
+
+SSM Command Executed
+
+Example:
+
+```json
+{
+  "account_id": "278576220453",
+  "cluster_name": "localhost",
+  "code": "TDS00I",
+  "command_id": "e8a5f3ba-e9e5-4cbd-979b-18fd1e7ad00f",
+  "ei": 0,
+  "event": "ssm.run",
+  "exit_code": 0,
+  "instance_id": "i-057d0ffe877128673",
+  "region": "eu-central-1",
+  "status": "Success",
+  "time": "2022-09-14T14:45:38.122Z",
+  "uid": "d053a9a4-6362-4d46-8868-55d83b7b338f"
+}
+```
+
+### TDS00W
+
+SSM Command Execution Failed
+
+Example:
+
+```json
+{
+  "account_id": "278576220453",
+  "cluster_name": "localhost",
+  "code": "TDS00W",
+  "command_id": "c2936d68-fc0c-4c16-a860-916a97f57644",
+  "ei": 0,
+  "event": "ssm.run",
+  "exit_code": 1,
+  "instance_id": "i-057d0ffe877128673",
+  "region": "eu-central-1",
+  "status": "Failure",
+  "time": "2022-09-14T14:45:38.122Z",
+  "uid": "ad123558-1d20-42dd-bf82-a7c544d76550"
+}
+```
+
+## stable_unix_user.create
+
+Stable UNIX user created
+
+Example:
+
+```json
+{
+  "code": "TSUU001I",
+  "event": "stable_unix_user.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## static_host_user.create
+
+Static Host User Created
+
+Example:
+
+```json
+{
+  "code": "SHU001I",
+  "event": "static_host_user.create",
+  "time": "2023-05-09T19:21:36.144Z",
+  "name": "test-user",
+  "user": "bob"
+}
+```
+
+## static_host_user.delete
+
+Static Host User Deleted
+
+Example:
+
+```json
+{
+  "code": "SHU003I",
+  "updated_by": "joe",
+  "event": "static_host_user.delete",
+  "time": "2023-05-09T19:21:38.144Z",
+  "name": "test-user",
+  "user": "bob"
+}
+```
+
+## static_host_user.update
+
+Static Host User Updated
+
+Example:
+
+```json
+{
+  "code": "SHU002I",
+  "event": "static_host_user.update",
+  "time": "2023-05-09T19:21:37.144Z",
+  "name": "test-user",
+  "user": "bob"
+}
+```
+
+## subsystem
+
+There are multiple events with the `subsystem` type.
+
+### T3001I
+
+Subsystem Requested
+
+Example:
+
+```json
+{
+  "code": "T3001I",
+  "event": "subsystem",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T3001E
+
+Subsystem Request Failed
+
+Example:
+
+```json
+{
+  "code": "T3001E",
+  "event": "subsystem",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## trusted_cluster.create
+
+Trusted Cluster Created
+
+Example:
+
+```json
+{
+  "code": "T7000I",
+  "event": "trusted_cluster.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## trusted_cluster.delete
+
+Trusted Cluster Deleted
+
+Example:
+
+```json
+{
+  "code": "T7001I",
+  "event": "trusted_cluster.delete",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## trusted_cluster_token.create
+
+Trusted Cluster Token Created
+
+Example:
+
+```json
+{
+  "code": "T7002I",
+  "event": "trusted_cluster_token.create",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## unknown
+
+Unknown Event
+
+Example:
+
+```json
+{
+  "code": "TCC00E",
+  "event": "unknown",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## upgradewindowstart.update
+
+Upgrade Window Start Updated
+
+Example:
+
+```json
+{
+  "code": "TUW01I",
+  "time": "2022-04-13T20:00:04.000Z",
+  "user": "alice@example.com",
+  "event": "upgradewindowstart.update",
+  "upgrade_window_start": "23:00"
+}
+```
+
+## user.create
+
+User Created
+
+Example:
+
+```json
+{
+  "code": "T1002I",
+  "connector": "local",
+  "name": "hello",
+  "event": "user.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "roles": [
+    "admin"
+  ],
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "22a273678c-ee78-5ffc-a298-68a841555c98",
+  "user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
+}
+```
+
+## user.delete
+
+User Deleted
+
+Example:
+
+```json
+{
+  "code": "T1004I",
+  "uid": "b121fc4c-e419-56a2-a760-19cd746c0650",
+  "time": "2020-06-05T16:24:05Z",
+  "event": "user.delete",
+  "name": "bob",
+  "user": "benarent"
+}
+```
+
+## user.login
+
+There are multiple events with the `user.login` type.
+
+### T1000I
+
+Local Login
+
+Example:
+
+```json
+{
+  "code": "T1000I",
+  "event": "user.login",
+  "method": "local",
+  "success": true,
+  "time": "2019-04-22T00:49:03Z",
+  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef2",
+  "user": "admin@example.com"
+}
+```
+
+### T1000W
+
+Local Login Failed
+
+Example:
+
+```json
+{
+  "code": "T1000W",
+  "error": "user(name=\"fsdfsdf\") not found",
+  "event": "user.login",
+  "method": "local",
+  "success": false,
+  "time": "2019-04-22T18:06:32Z",
+  "uid": "597bf08b-75b2-4dda-a578-e387c5ce9b76",
+  "user": "fsdfsdf"
+}
+```
+
+### T1010I
+
+SSO Test Flow Login
+
+Example:
+
+```json
+{
+  "attributes": {
+    "amr": [
+      "pwd"
+    ],
+    "at_hash": "7_foQ_0QRVU5dIq_B72_zw",
+    "aud": "0oa17kaknnntGFKiJ0h8",
+    "auth_time": 1653294514,
+    "email": "ops@gravitational.io",
+    "email_verified": true,
+    "exp": 1653298115,
+    "groups": [
+      "Everyone",
+      "okta-admin",
+      "okta-dev"
+    ],
+    "iat": 1653294515,
+    "idp": "00oafg105f5D4gv5Y0h7",
+    "iss": "https://dev-813354.oktapreview.com",
+    "jti": "ID.e_EKsCvMELMLa-Gx0aciOazUvPEFdZSxhTj42zccz3g",
+    "sub": "00uafg106hK16pwqE0h7",
+    "ver": 1
+  },
+  "cluster_name": "boson.tener.io",
+  "code": "T1010I",
+  "ei": 0,
+  "event": "user.login",
+  "method": "oidc",
+  "success": true,
+  "time": "2022-05-23T08:28:37.067Z",
+  "uid": "7d440ee1-15f6-4b56-9391-344e8984fd97",
+  "user": "ops@gravitational.io"
+}
+```
+
+### T1011W
+
+SSO Test Flow Login Failed
+
+Example:
+
+```json
+{
+  "attributes": {
+    "amr": [
+      "pwd"
+    ],
+    "at_hash": "Xz4ibHjouHuIIBOSgWm07w",
+    "aud": "0oa17kaknnntGFKiJ0h8",
+    "auth_time": 1653294514,
+    "email": "ops@gravitational.io",
+    "email_verified": true,
+    "exp": 1653298153,
+    "groups": [
+      "Everyone",
+      "okta-admin",
+      "okta-dev"
+    ],
+    "iat": 1653294553,
+    "idp": "00oafg105f5D4gv5Y0h7",
+    "iss": "https://dev-813354.oktapreview.com",
+    "jti": "ID.h0qtjVPXttmNEHb-yHOvziD20Mru4qiw8L3i74se8YA",
+    "sub": "00uafg106hK16pwqE0h7",
+    "ver": 1
+  },
+  "cluster_name": "boson.tener.io",
+  "code": "T1011W",
+  "ei": 0,
+  "error": "No roles mapped from claims. The mappings may contain typos.",
+  "event": "user.login",
+  "message": "Failed to calculate user attributes.\n\tNo roles mapped from claims. The mappings may contain typos.",
+  "method": "oidc",
+  "success": false,
+  "time": "2022-05-23T08:29:14.126Z",
+  "uid": "6fa08495-170a-4de9-884f-9931fbdb5982"
+}
+```
+
+### T1012I
+
+Headless Login Requested
+
+Example:
+
+```json
+{
+  "addr.remote": "1.1.1.1:42",
+  "code": "T1012I",
+  "cluster_name": "root.cluster",
+  "event": "user.login",
+  "method": "headless",
+  "ei": 0,
+  "success": false,
+  "time": "2019-04-22T00:49:03Z",
+  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef4",
+  "user": "admin@example.com"
+}
+```
+
+### T1013I
+
+Headless Login Approved
+
+Example:
+
+```json
+{
+  "addr.remote": "2.2.2.2:42",
+  "code": "T1013I",
+  "cluster_name": "root.cluster",
+  "event": "user.login",
+  "method": "headless",
+  "ei": 0,
+  "success": true,
+  "time": "2019-04-22T00:49:03Z",
+  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
+  "user": "admin@example.com",
+  "message": "Headless login was requested from the address 1.1.1.1:42"
+}
+```
+
+### T1013W
+
+Headless Login Failed
+
+Example:
+
+```json
+{
+  "addr.remote": "2.2.2.2:42",
+  "code": "T1013W",
+  "error": "user(name=\"fsdfsdf\") not found",
+  "cluster_name": "root.cluster",
+  "event": "user.login",
+  "method": "headless",
+  "ei": 0,
+  "success": true,
+  "time": "2019-04-22T00:49:03Z",
+  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
+  "user": "admin@example.com",
+  "message": "Headless login was requested from the address 1.1.1.1:42"
+}
+```
+
+### T1014W
+
+Headless Login Rejected
+
+Example:
+
+```json
+{
+  "addr.remote": "2.2.2.2:42",
+  "code": "T1014W",
+  "cluster_name": "root.cluster",
+  "event": "user.login",
+  "method": "headdless",
+  "ei": 0,
+  "success": false,
+  "time": "2019-04-22T00:49:03Z",
+  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef6",
+  "user": "admin@example.com",
+  "message": "Headless login was requested from the address 1.1.1.1:42"
+}
+```
+
+### T1001I
+
+SSO Login
+
+Example:
+
+```json
+{
+  "code": "T1001I",
+  "event": "user.login",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+### T1001W
+
+SSO Login Failed
+
+Example:
+
+```json
+{
+  "code": "T1001W",
+  "event": "user.login",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## user.password_change
+
+User Password Updated
+
+Example:
+
+```json
+{
+  "code": "T1005I",
+  "event": "user.password_change",
+  "time": "2020-06-05T19:26:53Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0",
+  "user": "Ivan_Jordan"
+}
+```
+
+## user.update
+
+User Updated
+
+Example:
+
+```json
+{
+  "code": "T1003I",
+  "event": "user.update",
+  "name": "bob",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "3a8cd55b5-bce9-5a4c-882d-8e0a5ae10008",
+  "expires": 111111,
+  "roles": [
+    "root"
+  ]
+}
+```
+
+## user_login.invalid_access_list
+
+Access list skipped.
+
+Example:
+
+```json
+{
+  "code": "TAL009W",
+  "event": "user_login.invalid_access_list",
+  "time": "2020-06-05T16:24:05Z",
+  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
+}
+```
+
+## user_task.create
+
+User Task Created
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:52763",
+  "cluster_name": "lenix",
+  "code": "UT001I",
+  "ei": 0,
+  "event": "user_task.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "d217950f-cb5f-5703-96ef-39ab8cd86601",
+  "success": true,
+  "time": "2024-10-17T14:00:34.186Z",
+  "uid": "709840ec-288e-4056-ba20-c8f4b12a478f",
+  "updated_by": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "user": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "user_kind": 1,
+  "user_task_integration": "teleportdev",
+  "user_task_issue_type": "ec2-ssm-invocation-failure",
+  "user_task_type": "discover-ec2"
+}
+```
+
+## user_task.delete
+
+User Task Deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:52915",
+  "cluster_name": "lenix",
+  "code": "UT003I",
+  "ei": 0,
+  "event": "user_task.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "d217950f-cb5f-5703-96ef-39ab8cd86601",
+  "success": true,
+  "time": "2024-10-17T14:01:11.031Z",
+  "uid": "7699b806-e717-4821-85a5-d2f41acbe373",
+  "updated_by": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "user": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "user_kind": 1
+}
+```
+
+## user_task.update
+
+User Task Updated
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:52833",
+  "cluster_name": "lenix",
+  "code": "UT002I",
+  "current_user_task_state": "OPEN",
+  "ei": 0,
+  "event": "user_task.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "d217950f-cb5f-5703-96ef-39ab8cd86601",
+  "success": true,
+  "time": "2024-10-17T14:01:02.853Z",
+  "uid": "0ba36761-4a6a-429e-bce4-1825d80ce06a",
+  "updated_by": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "updated_user_task_state": "OPEN",
+  "user": "30a6b2e1-3b61-4965-92cf-b4f84e9dc683.lenix",
+  "user_kind": 1,
+  "user_task_integration": "teleportdev",
+  "user_task_issue_type": "ec2-ssm-invocation-failure",
+  "user_task_type": "discover-ec2"
+}
+```
+
+## vnet.config.create
+
+VNet config created
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:62460",
+  "cluster_name": "teleport.dev",
+  "code": "TVNET001I",
+  "ei": 0,
+  "event": "vnet.config.create",
+  "success": true,
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
+  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
+  "user_cluster_name": "teleport.dev",
+  "user_kind": 3,
+  "user_roles": [
+    "Admin"
+  ]
+}
+```
+
+## vnet.config.delete
+
+VNet config deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:62460",
+  "cluster_name": "teleport.dev",
+  "code": "TVNET003I",
+  "ei": 0,
+  "event": "vnet.config.delete",
+  "success": true,
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
+  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
+  "user_cluster_name": "teleport.dev",
+  "user_kind": 3,
+  "user_roles": [
+    "Admin"
+  ]
+}
+```
+
+## vnet.config.update
+
+VNet config updated
+
+Example:
+
+```json
+{
+  "addr.remote": "127.0.0.1:62460",
+  "cluster_name": "teleport.dev",
+  "code": "TVNET002I",
+  "ei": 0,
+  "event": "vnet.config.update",
+  "success": true,
+  "time": "2025-03-04T15:49:21.869Z",
+  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
+  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
+  "user_cluster_name": "teleport.dev",
+  "user_kind": 3,
+  "user_roles": [
+    "Admin"
+  ]
+}
+```
+
+## windows.desktop.session.end
+
+Windows Desktop Session Ended
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP01I",
+  "desktop_addr": "100.104.52.89:3389",
+  "desktop_name": "desktop-name",
+  "desktop_labels": {
+    "env": "prod",
+    "foo": "bar"
+  },
+  "ei": 0,
+  "event": "windows.desktop.session.end",
+  "sid": "b7f734d8-bdc2-4996-8959-0b42a11708e7",
+  "time": "2021-10-18T23:19:13.105Z",
+  "uid": "84d408d1-3314-4a30-b7b7-35970633c9de",
+  "user": "joe",
+  "windows_desktop_service": "ba17ae92-5519-476a-954e-c225cf751de1",
+  "windows_domain": "desktopaccess.com",
+  "windows_user": "Administrator"
+}
+```
+
+## windows.desktop.session.start
+
+There are multiple events with the `windows.desktop.session.start` type.
+
+### TDP00I
+
+Windows Desktop Session Started
+
+Example:
+
+```json
+{
+  "addr.remote": "100.104.52.89:3389",
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP00I",
+  "desktop_addr": "100.104.52.89:3389",
+  "desktop_name": "desktop-name",
+  "desktop_labels": {
+    "env": "prod",
+    "foo": "bar"
+  },
+  "ei": 0,
+  "event": "windows.desktop.session.start",
+  "proto": "tdp",
+  "sid": "b7f734d8-bdc2-4996-8959-0b42a11708e7",
+  "success": true,
+  "time": "2021-10-18T23:18:29.144Z",
+  "uid": "cf15cc08-f818-4f09-91c5-238e1326b22b",
+  "user": "joe",
+  "windows_desktop_service": "ba17ae92-5519-476a-954e-c225cf751de1",
+  "windows_domain": "desktopaccess.com",
+  "windows_user": "Administrator"
+}
+```
+
+### TDP00W
+
+Windows Desktop Session Denied
+
+Example:
+
+```json
+{
+  "cluster_name": "im-a-cluster-name",
+  "code": "TDP00W",
+  "desktop_addr": "100.104.52.89:3389",
+  "desktop_name": "desktop-name",
+  "desktop_labels": {
+    "env": "prod",
+    "foo": "bar"
+  },
+  "ei": 0,
+  "event": "windows.desktop.session.start",
+  "sid": "b7f734d8-bdc2-4996-8959-0b42a11708e7",
+  "time": "2021-10-18T23:39:13.105Z",
+  "uid": "84d408d1-3314-4a30-b7b7-35970633c9de",
+  "user": "joe",
+  "windows_desktop_service": "ba17ae92-5519-476a-954e-c225cf751de1",
+  "windows_domain": "desktopaccess.com",
+  "windows_user": "Administrator"
+}
+```
+
+## workload_identity.create
+
+Workload Identity Created
+
+Example:
+
+```json
+{
+  "cluster_name": "leaf.tele.ottr.sh:443",
+  "code": "WID001I",
+  "ei": 0,
+  "event": "workload_identity.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "made-by-noah",
+  "time": "2023-12-08T10:53:39.798Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "noah"
+}
+```
+
+## workload_identity.delete
+
+Workload Identity Deleted
+
+Example:
+
+```json
+{
+  "cluster_name": "leaf.tele.ottr.sh:443",
+  "code": "WID003I",
+  "ei": 0,
+  "event": "workload_identity.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "made-by-noah",
+  "time": "2023-12-08T10:53:39.798Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "noah"
+}
+```
+
+## workload_identity.update
+
+Workload Identity Updated
+
+Example:
+
+```json
+{
+  "cluster_name": "leaf.tele.ottr.sh:443",
+  "code": "WID002I",
+  "ei": 0,
+  "event": "workload_identity.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "made-by-noah",
+  "time": "2023-12-08T10:53:39.798Z",
+  "uid": "0efbb33d-fa50-44e0-8dec-4ac89c0dd4ab",
+  "user": "noah"
+}
+```
+
+## workload_identity_x509_issuer_override.create
+
+Workload Identity X.509 Issuer Override Created
+
+Example:
+
+```json
+{
+  "addr.remote": "203.0.113.71:59517",
+  "cluster_name": "clustername",
+  "code": "WID007I",
+  "ei": 0,
+  "event": "workload_identity_x509_issuer_override.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "default",
+  "time": "2025-03-28T08:42:14.526Z",
+  "uid": "d99124ab-34f8-490e-b839-ca881e7cc6ba",
+  "user": "alice",
+  "user_kind": 1
+}
+```
+
+## workload_identity_x509_issuer_override.delete
+
+Workload Identity X.509 Issuer Override Deleted
+
+Example:
+
+```json
+{
+  "addr.remote": "203.0.113.77:64794",
+  "cluster_name": "clustername",
+  "code": "WID008I",
+  "ei": 0,
+  "event": "workload_identity_x509_issuer_override.delete",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "default",
+  "time": "2025-03-26T01:14:36.881Z",
+  "uid": "e52def2f-4109-4cc9-91a8-150c6792f89f",
+  "user": "bob",
+  "user_kind": 1
+}
+```
+
+## x11-forward
+
+There are multiple events with the `x11-forward` type.
+
+### T3008I
+
+X11 Forwarding Requested
+
+Example:
+
+```json
+{
+  "addr.local": "192.000.0.000:3022",
+  "addr.remote": "127.0.0.1:50000",
+  "cluster_name": "im-a-cluster-name",
+  "code": "T3008I",
+  "ei": 0,
+  "event": "x11-forward",
+  "login": "root",
+  "success": true,
+  "time": "2022-01-20T18:31:45.012Z",
+  "uid": "6333-37a7-4c3c-9180-f3abc8e2b",
+  "user": "lisa"
+}
+```
+
+### T3008W
+
+X11 Forwarding Request Failed
+
+Example:
+
+```json
+{
+  "addr.local": "192.000.0.000:3022",
+  "addr.remote": "127.0.0.1:60000",
+  "cluster_name": "im-a-cluster-name",
+  "code": "T3008W",
+  "ei": 0,
+  "error": "lisa was here",
+  "event": "x11-forward",
+  "login": "root",
+  "success": false,
+  "time": "2022-01-20T19:49:02.307Z",
+  "uid": "0629c7-3d98-4451-ac90-dc5330",
+  "user": "lisa"
+}
+```
diff --git a/docs/pages/reference/cli/cli.mdx b/docs/pages/reference/cli/cli.mdx
index fdd33353897f0..1ee53a20119ba 100644
--- a/docs/pages/reference/cli/cli.mdx
+++ b/docs/pages/reference/cli/cli.mdx
@@ -1,16 +1,20 @@
 ---
-title: Command-Line Tools
-h1: CLI References
+title: Command-Line Tool References
+sidebar_label: Command-Line Tools
 description: Detailed guide and reference documentation for Teleport's command line interface (CLI) tools.
+tags:
+ - reference
+ - platform-wide
 ---
 
-Teleport is made up of five CLI tools.
+Teleport is made up of six CLI tools.
 
 - [teleport](teleport.mdx): Supports the Teleport Infrastructure Identity Platform by starting and configuring various Teleport services.
+- [teleport-update](teleport-update.mdx): Installs and updates Teleport binaries.
 - [tsh](tsh.mdx): Allows end users to authenticate to Teleport and access resources in a cluster.
 - [tctl](tctl.mdx): Used to configure the Teleport Auth Service.
-- [tbot](tbot.mdx): Supports Machine ID, which provides short lived credentials to service accounts (e.g, a CI/CD server).
-- [fdpass-teleport](fdpass-teleport.mdx): Supports integrating Machine ID with OpenSSH for higher performance SSH connections.
+- [tbot](tbot.mdx): Supports Machine & Workload Identity, which provides short lived credentials to service accounts (e.g, a CI/CD server).
+- [fdpass-teleport](fdpass-teleport.mdx): Supports integrating Machine & Workload Identity with OpenSSH for higher performance SSH connections.
 
 (!docs/pages/includes/permission-warning.mdx!)
 
@@ -54,7 +58,7 @@ desktops, and Kubernetes clusters using the `--search` and `--query` flags.
 
 The `--search` flag performs a simple fuzzy search on resource fields. For example, `--search=mac` searches for resources containing `mac`.
 
-The `--query` flag allows you to perform more sophisticated searches using a [predicate language](../predicate-language.mdx).
+The `--query` flag allows you to perform more sophisticated searches using a [predicate language](../access-controls/predicate-language.mdx).
 
 In both cases, you can further refine the results by appending a list of comma-separated labels to the command. For example:
 
@@ -78,4 +82,3 @@ $ tsh ls --search=staging,mac
 # with key `env` equal to `staging` and key `os` equal to `mac`.
 $ tsh ls --query='labels["env"] == "staging" && equals(labels["os"], "mac")'
 ```
-
diff --git a/docs/pages/reference/cli/fdpass-teleport.mdx b/docs/pages/reference/cli/fdpass-teleport.mdx
index e8a5781cac4cf..b5c85197119e4 100644
--- a/docs/pages/reference/cli/fdpass-teleport.mdx
+++ b/docs/pages/reference/cli/fdpass-teleport.mdx
@@ -1,16 +1,20 @@
 ---
 title: fdpass-teleport CLI reference
+sidebar_label: fdpass-teleport
 description: Comprehensive reference of subcommands, flags, and arguments for the fdpass-teleport CLI tool.
+tags:
+ - reference
+ - mwi
 ---
 
-The `fdpass-teleport` binary is used to integrate Machine ID with OpenSSH to
-enable higher performance and reduced resource consumption when establishing SSH
-connections.
+The `fdpass-teleport` binary is used to integrate Machine & Workload Identity
+with OpenSSH to enable higher performance and reduced resource consumption when
+establishing SSH connections.
 
 You should not need to manually invoke `fdpass-teleport` and it will
-automatically be included in OpenSSH configurations generated by the Machine ID
-SSH multiplexer service. For further information, see the
-[Machine ID reference](../machine-id/configuration.mdx).
+automatically be included in OpenSSH configurations generated by the Machine &
+Workload Identity SSH multiplexer service. For further information, see the
+[Machine & Workload Identity reference](../machine-workload-identity/configuration.mdx).
 
 ## Usage
 
diff --git a/docs/pages/reference/cli/tbot.mdx b/docs/pages/reference/cli/tbot.mdx
index 0c472087c11a3..a49592e88cd6a 100644
--- a/docs/pages/reference/cli/tbot.mdx
+++ b/docs/pages/reference/cli/tbot.mdx
@@ -1,10 +1,15 @@
 ---
-title: tbot CLI reference
+title: tbot CLI Reference
+sidebar_label: tbot
 description: Comprehensive reference of subcommands, flags, and arguments for the tbot CLI tool.
+tags:
+ - reference
+ - mwi
 ---
 
-`tbot` is a CLI tool used with **Machine ID** that programatically issues and renews
-short-lived certificates to any service account (e.g, a CI/CD server).
+`tbot` is a CLI tool used with **Machine & Workload Identity** that
+programatically issues and renews short-lived certificates to any service
+account (e.g, a CI/CD server).
 
 The primary commands for `tbot` are as follows:
 
@@ -12,8 +17,8 @@ The primary commands for `tbot` are as follows:
 | - | - |
 | `tbot help` | Outputs guidance for using commands with `tbot`. |
 | `tbot version` | Outputs the current version of the `tbot` binary. |
-| `tbot configure` | Outputs a basic Machine ID client configuration file to be adjusted as needed. |
-| `tbot start` | Starts the Machine ID client `tbot`, fetching and writing certificates to disk at a set interval. |
+| `tbot configure` | Outputs a basic `tbot` client configuration file to be adjusted as needed. |
+| `tbot start` | Starts `tbot`, fetching and writing certificates to disk at a set interval. |
 | `tbot init` | Initialize a certificate destination directory for writes from a separate bot user, configuring either file or POSIX ACL permissions. |
 | `tbot db` | Connects to databases using native clients and queries database information. Functions as a wrapper for `tsh`, and requires `tsh` installation. |
 | `tbot proxy` | Allows for access to Teleport resources on a cluster using TLS Routing. Functions as a wrapper for `tsh`, and requires `tsh` installation. |
@@ -31,14 +36,14 @@ Note that `tsh` must be installed to make use of this command.
 | Flag                | Description                                                                                              |
 |---------------------|----------------------------------------------------------------------------------------------------------|
 | `-d/--debug`        | Enable verbose logging to stderr.                                                                        |
-| `-c/--config`       | Path to a Machine ID configuration file. Required if not using other required configuration flags.                  |
-| `--destination-dir` | Path to the Machine ID destination dir that should be used for authentication. Required.                 |
+| `-c/--config`       | Path to a `tbot` configuration file. Required if not using other required configuration flags.                  |
+| `--destination-dir` | Path to the destination dir that should be used for authentication. Required.                 |
 | `--proxy-server`    | The `host:port` of the Teleport Proxy Service to use to access resources. Required.                      |
 | `--cluster`         | The name of the cluster on which resources should be accessed. Extracted from the bot identity if unset. |
 
 All other flags and arguments are passed directly to `tsh db ...`, along
-with authentication parameters to use the Machine ID identity to skip `tsh`'s
-login steps.
+with authentication parameters to use the Machine & Workload identity to skip
+`tsh`'s login steps.
 
 Note that certain CLI parameters, for example `--help`, may be captured by
 `tbot` even if intended to be passed to the wrapped `tsh`. A `--` argument can
@@ -54,19 +59,19 @@ Additionally, be aware of the following limitations of `tbot db`:
 ## tbot init
 
 Initializes a certificate destination directory for access from a separate bot
-user. Allows for certificates to be written to disks other than a Machine ID
-client, configuring either file or POSIX ACL permissions.
+user. Allows for certificates to be written to disks other than a Machine &
+Workload Identity client, configuring either file or POSIX ACL permissions.
 
 Note that most use cases should instead use tbot's runtime ACL management by
 specifying allowed reader users and groups in the
-[destination configuration](../machine-id/configuration.mdx#directory).
+[destination configuration](../machine-workload-identity/configuration.mdx#directory).
 
 ### Flags
 
 | Flag                | Description                                                                                                        |
 |---------------------|--------------------------------------------------------------------------------------------------------------------|
 | `-d/--debug`        | Enable verbose logging to stderr.                                                                                  |
-| `-c/--config`       | Path to a Machine ID configuration file.                                                                           |
+| `-c/--config`       | Path to a tbot configuration file.                                                                                 |
 | `--destination-dir` | Directory to write short-lived machine certificates to.                                                            |
 | `--owner`           | Defines the Linux `user:group` owner of `--destination-dir`. Defaults to the Linux user running `tbot` if unspecified. |
 | `--bot-user`        | Enables POSIX ACLs and defines the Linux user that can read/write short-lived certificates to `--destination-dir`. |
@@ -120,13 +125,13 @@ Consider using one of the following dedicated tunnel modes where possible:
 | Flag                | Description                                                                                              |
 |---------------------|----------------------------------------------------------------------------------------------------------|
 | `-d/--debug`        | Enable verbose logging to stderr.                                                                        |
-| `-c/--config`       | Path to a Machine ID configuration file. Required if not using other required configuration flags.       |
-| `--destination-dir` | Path to the Machine ID destination dir that should be used for authentication. Required.                 |
+| `-c/--config`       | Path to the tbot configuration file. Required if not using other required configuration flags.           |
+| `--destination-dir` | Path to the tbot destination dir that should be used for authentication. Required.                       |
 | `--proxy-server`    | The `host:port` of the Teleport Proxy Service through which resources will be accessed. Required.        |
 | `--cluster`         | The name of the cluster on which resources should be accessed. Extracted from the bot identity if unset. |
 
 All other flags and arguments are passed directly to `tsh proxy ...`, along
-with authentication parameters to use the Machine ID identity to skip `tsh`'s
+with authentication parameters to use Machine & Workload Identity to skip `tsh`'s
 login step.
 
 Additionally, the following should be noted:
@@ -180,7 +185,7 @@ Note that this decreases security:
  - Your connection to the database will be unencrypted until it reaches the
    `tbot` proxy running on `localhost`.
 
-Refer to the [database guide](../../enroll-resources/machine-id/access-guides/databases.mdx) for more information on
+Refer to the [database guide](../../machine-workload-identity/access-guides/databases.mdx) for more information on
 using database proxies.
 
 ### Flags
@@ -248,8 +253,8 @@ This subcommand supports one additional flag beyond its `tbot start` equivalent:
 
 ## tbot start
 
-The `tbot start` family of commands starts the Machine ID client in various
-modes, depending on the type of resources to be accessed:
+The `tbot start` family of commands starts the Machine & Workload Identity
+client in various modes, depending on the type of resources to be accessed:
 
 - [`tbot start legacy`](#tbot-start-legacy): Starts with a YAML configuration file or in legacy output mode
 - [`tbot start identity`](#tbot-start-identity): Starts with an identity output for SSH and Teleport API access
@@ -269,27 +274,31 @@ These flags are available to all `tbot start` commands. Note that
 `tbot start legacy` supports slightly different options, so refer to its
 specific section for details when using a YAML config file or legacy output.
 
-| Flag                 | Description |
-|----------------------|-------------|
-| `-d/--debug`         | Enable verbose logging to stderr. |
-| `--[no-]fips`        | Whether to run tbot in FIPS compliance mode. This requires the FIPS `tbot` binary. |
-| `--log-format`       | Controls the format of output logs. Can be `json` or `text`. Defaults to `text`. |
-| `-a/--auth-server`   | Address of the Teleport Auth Service. Prefer using `--proxy-server` where possible. |
-| `--proxy-server`     | Address of the Teleport Proxy Server. |
-| `--token`            | A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect. |
-| `--ca-pin`           | CA pin to validate the Teleport Auth Service; used on first connect. |
-| `--certificate-ttl`  | TTL of short-lived machine certificates. |
-| `--renewal-interval` | Interval at which short-lived certificates are renewed; must be less than the certificate TTL. |
-| `--join-method`      | Method to use to join the cluster. One of: `azure`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud` |
-| `--[no-]oneshot`     | If set, quit after the first renewal. |
-| `--diag-addr`        | If set and the bot is in debug mode, a diagnostics service will listen on specified address. |
-| `--storage`          | A destination URI for tbot's internal storage, e.g. `file:///foo/bar`. See [Destination URIs](#destination-uris) for more info. |
+| Flag                    | Description |
+|-------------------------|-------------|
+| `-d/--debug`            | Enable verbose logging to stderr. |
+| `--[no-]fips`           | Whether to run tbot in FIPS compliance mode. This requires the FIPS `tbot` binary. |
+| `--log-format`          | Controls the format of output logs. Can be `json` or `text`. Defaults to `text`. |
+| `-a/--auth-server`      | Address of the Teleport Auth Service. Prefer using `--proxy-server` where possible. |
+| `--proxy-server`        | Address of the Teleport Proxy Service. |
+| `--token`               | A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect. |
+| `--ca-pin`              | CA pin to validate the Teleport Auth Service; used on first connect. |
+| `--certificate-ttl`     | TTL of short-lived machine certificates. |
+| `--renewal-interval`    | Interval at which short-lived certificates are renewed; must be less than the certificate TTL. |
+| `--join-method`         | Method to use to join the cluster. One of: `azure`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud` |
+| `--[no-]oneshot`        | If set, quit after the first renewal. |
+| `--diag-addr`           | If set and the bot is in debug mode, a diagnostics service will listen on specified address. |
+| `--storage`             | A destination URI for tbot's internal storage, e.g. `file:///foo/bar`. See [Destination URIs](#destination-uris) for more info. |
+| `--registration-secret` | An optional joining secret to use on first join with the `bound_keypair` join method. This can also be provided via the `TBOT_REGISTRATION_SECRET` environment variable. |
+| `--registration-secret-path` | An optional path to a file containing a joining secret to use on first join with the `bound_keypair` join method. |
+| `--static-key-path`     | An optional path to a file containing a static private key for use with the `bound_keypair` join method. A base64-encoded key can also be provided via the `TBOT_BOUND_KEYPAIR_STATIC_KEY` environment variable. |
+| `--pid-file`            | Full path to the PID file. By default no PID file will be created. |
 
 ## tbot start legacy
 
-Starts the Machine ID client `tbot`, fetching and writing certificates to disk
-at a set interval. This command either starts from a configuration file if `-c`
-is specified, or starts with a default, legacy-compatible identity output.
+Starts `tbot`, fetching and writing certificates to disk at a set interval. This
+command either starts from a configuration file if `-c` is specified, or starts
+with a default, legacy-compatible identity output.
 
 This is the default `tbot start` subcommand if no other command is specified.
 Unless using a configuration file, consider using `tbot start identity` or
@@ -314,6 +323,7 @@ another dedicated mode instead.
 | `--join-method`      | Method to use to join the cluster. Can be `token`, `azure`, `circleci`, `gcp`, `github`, `gitlab` or `iam`.                                                                     |
 | `--oneshot`          | If set, quit after the first renewal.                                                                                                                                           |
 | `--log-format`       | Controls the format of output logs. Can be `json` or `text`. Defaults to `text`.                                                                                                |
+| `--pid-file`         | Full path to the PID file. By default no PID file will be created.                                                                                                              |
 
 ### Examples
 <Tabs>
@@ -347,8 +357,8 @@ $ tbot start \
 
 ## tbot start identity
 
-Starts the Machine ID client `tbot` with an identity output, fetching and
-writing certificates at a regular interval to the output specified with
+Starts `tbot` with an identity output, fetching and writing certificates at a
+regular interval to the output specified with
 `--destination`.
 
 ```code
@@ -382,8 +392,8 @@ $ tbot start identity \
 
 ## tbot start database
 
-Starts the Machine ID client `tbot` with a database output, fetching and writing
-database certificates at a regular interval to the output specified with
+Starts `tbot` with a database output, fetching and writing database certificates
+at a regular interval to the output specified with
 `--destination`.
 
 ```code
@@ -407,9 +417,9 @@ command supports these additional flags:
 
 ## tbot start kubernetes
 
-Starts the Machine ID client `tbot` with a Kubernetes output, fetching and
-writing Kubernetes credentials and a `kubeconfig.yaml` at a regular interval to
-the output specified with `--destination`.
+Starts `tbot` with a Kubernetes output, fetching and writing Kubernetes
+credentials and a `kubeconfig.yaml` at a regular interval to the output
+specified with `--destination`.
 
 ```code
 $ tbot start kubernetes --destination=DESTINATION --kubernetes-cluster=KUBERNETES-CLUSTER [<flags>]
@@ -429,9 +439,9 @@ command supports these additional flags:
 
 ## tbot start kubernetes/v2
 
-Starts the Machine ID client `tbot` with a Kubernetes V2 output, fetching and
-writing Kubernetes credentials to a `kubeconfig.yaml` at a regular interval to
-the output specified with `--destination`.
+Starts `tbot` with a Kubernetes V2 output, fetching and writing Kubernetes
+credentials to a `kubeconfig.yaml` at a regular interval to the output specified
+with `--destination`.
 
 Unlike the `kubernetes` output, `kubernetes/v2` allows fetching many Kubernetes
 clusters at once, as multiple contexts within the generated `kubeconfig.yaml`.
@@ -477,9 +487,8 @@ matched by the label selector.
 
 ## tbot start application
 
-Starts the Machine ID client `tbot` with an application output, fetching and
-writing application TLS credentials at a regular interval to the output
-specified with `--destination`.
+Starts `tbot` with an application output, fetching and writing application TLS
+credentials at a regular interval to the output specified with `--destination`.
 
 ```code
 $ tbot start application --destination=DESTINATION --app=APP [<flags>]
@@ -499,8 +508,8 @@ command supports these additional flags:
 
 ## tbot start application-tunnel
 
-Starts the Machine ID client with a local tunnel to a particular application.
-This tunnel will run continuously and automatically refresh its certificates.
+Starts `tbot` with a local tunnel to a particular application. This tunnel will
+run continuously and automatically refresh its certificates.
 
 Note that this tunnel will be unencrypted. Be wary of the selected listen
 address, and prefer to use `localhost` or an equivalent loopback interface
@@ -526,8 +535,8 @@ $ tbot start application-tunnel --listen=LISTEN --app=APP [<flags>]
 
 ## tbot start database-tunnel
 
-Starts the Machine ID client with a local tunnel to a particular database.
-This tunnel will run continuously and automatically refresh its certificates.
+Starts `tbot` with a local tunnel to a particular database. This tunnel will run
+continuously and automatically refresh its certificates.
 
 Note that this tunnel will be unencrypted. Be wary of the selected listen
 address, and prefer to use `localhost` or an equivalent loopback interface
@@ -563,7 +572,7 @@ command supports these additional flags:
 Issues an X509 workload identity credential using Teleport Workload Identity and
 writes this credential to a specified destination.
 
-See the [configuration reference](../machine-id/configuration.mdx) for further
+See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
 information about the workload identity credential output and the YAML
 configuration file format.
 
@@ -586,7 +595,7 @@ command supports these additional flags:
 Issues an X509 workload identity credential, exchanges this for short-lived AWS
 credentials using Roles Anywhere, and writes these to a configured destination.
 
-See the [configuration reference](../machine-id/configuration.mdx) for further
+See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
 information about the workload identity credential output and the YAML
 configuration file format.
 
@@ -617,7 +626,7 @@ writes this credential to a specified destination.
 The JWT workload identity credential is compatible with the [SPIFFE JWT SVID
 specification](https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md).
 
-See the [configuration reference](../machine-id/configuration.mdx) for further
+See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
 information about the workload identity credential output and the YAML
 configuration file format.
 
@@ -643,7 +652,7 @@ API.
 The configuration for this service can be complex, and therefore, it is
 recommended that you leverage the YAML configuration.
 
-See [Workload Identity API & Workload Attestation](../workload-identity/workload-identity-api-and-workload-attestation.mdx)
+See [Workload Identity API & Workload Attestation](../machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx)
 for further information about the local workload identity API and the YAML
 configuration.
 
@@ -666,7 +675,7 @@ new Workload Identity configuration experience. You can replace the use of this
 command with the new `tbot start workload-identity-x509` command.
 
 For further information, see [the new Workload Identity configuration experience
-and how to migrate](../workload-identity/configuration-resource-migration.mdx).
+and how to migrate](../machine-workload-identity/workload-identity/configuration-resource-migration.mdx).
 </Admonition>
 
 ### Flags
@@ -710,6 +719,52 @@ $ tbot install systemd \
    --write
 ```
 
+## tbot keypair create
+
+Generates a keypair for use with `bound_keypair` joining and stores it in the
+specified bot internal storage directory. If a key already exists in the storage
+directory, no new key will be generated and the existing public key will be
+printed to the console; use the `--overwrite` flag to force the generation of a
+new keypair.
+
+### Flags
+
+| Flag | Description |
+|------|-------------|
+| `--storage`         | A destination URI to be used for bot internal storage. Required. |
+| `--proxy-server`    | A Teleport Proxy Service address. Required. |
+| `--overwrite`       | If set, always generate a new key. If unset, the existing public key will be printed if one already exists in the destination specified by `--storage`. |
+| `--static`          | If set, generates a static keypair. For more information, see [the static key guide](../machine-workload-identity/bound-keypair/static-keys.mdx). |
+| `--static-key-path` | If set with `--static`, writes the static keypair to a file. |
+| `--format`          | Override the output format, supported values: `text`, `json`. |
+
+### Examples
+
+First, ensure the desired internal storage directory exists:
+```code
+$ mkdir -p /var/lib/teleport/bot
+```
+
+Next, generate a keypair:
+```code
+$ tbot keypair create --proxy-server example.teleport.sh:443 --storage /var/lib/teleport/bot
+2025-07-09T00:00:00.000-00:00 INFO [TBOT]      keypair has been written to storage storage:directory: /var/lib/teleport/bot tbot/keypair.go:135
+
+To register the keypair with Teleport, include this public key in the token's
+`spec.bound_keypair.onboarding.initial_public_key`:
+
+	ssh-ed25519 <data>
+```
+
+This public key, including the algorithm identifier (`ssh-ed25519`, but may vary
+depending on your cluster configuration) can then be copied into a Bound Keypair
+join token to be used as a
+[preregistered key](../machine-workload-identity/bound-keypair/concepts.mdx#onboarding).
+
+Note that the Teleport Proxy Service address is required to fetch the currently
+enabled [signature suite](../deployment/signature-algorithms.mdx). No authentication takes
+place at this time.
+
 ## Destination URIs
 
 Many `tbot start` subcommands accept destination URIs via the `--storage` and
diff --git a/docs/pages/reference/cli/tctl.mdx b/docs/pages/reference/cli/tctl.mdx
index de7bf4f75108c..60b559f6ce9c3 100644
--- a/docs/pages/reference/cli/tctl.mdx
+++ b/docs/pages/reference/cli/tctl.mdx
@@ -1,6 +1,10 @@
 ---
-title: tctl CLI reference
+title: tctl CLI Reference
+sidebar_label: tctl
 description: Comprehensive reference of subcommands, flags, and arguments for the tctl CLI tool.
+tags:
+ - reference
+ - platform-wide
 ---
 
 `tctl` is a CLI tool that allows a cluster administrator to manage all resources
@@ -9,98 +13,8 @@ in a cluster, including nodes, users, tokens, certificates, and devices.
 `tctl` can also be used to modify the dynamic configuration of the cluster, such as
 creating new user roles or connecting to trusted clusters.
 
-## Authentication
-
-Before running `tctl` commands, administrators must authenticate to a Teleport
-cluster. This section explains how `tctl` authenticates to the cluster.
-
-<Tabs>
-  <TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-
-### On a remote host with an identity file
-
-`tctl` can authenticate with a user-provided identity file. The Teleport Auth
-Service signs an identity file when a user runs `tctl auth sign` or
-`tsh login --out=<output-path>`, and the user can include the path to the
-identity file in the `--identity` flag when running `tctl` commands.
-
-When using the `--identity` flag, the user must provide the `--auth-server` flag
-with the address of an Auth Service or Proxy Service so `tctl` knows which
-cluster to authenticate to.
-
-### On the same host as the Teleport Auth Service
-
-If there is a Teleport configuration file on the host where `tctl` is run,
-`tctl` attempts to authenticate to the Auth Service named in the configuration
-file using an identity stored in its local backend.
-
-`tctl` authenticates using this method if a configuration file exists at
-`/etc/teleport.yaml` or `TELEPORT_CONFIG_FILE` points to a configuration file
-in another location. If the `auth_service` is disabled in the configuration
-file, then the configuration file is ignored.
-
-<Admonition type="note">
-
-  Note that when a `tctl` command is run locally on the Auth Service, the audit
-  logs will show that it was performed by the Auth Service itself.
-
-  To provide an accurate audit trail, it is important to limit direct SSH access
-  to the Auth Service with
-  [Access Controls](../../admin-guides/access-controls/access-controls.mdx) and ensure that
-  admins use `tctl` remotely instead.
-
-</Admonition>
-
-### On a remote host after running `tsh login`
-
-If `tctl` cannot find a local Teleport configuration file or a user-provided
-identity file, it attempts to load the user's `tsh` profile to authenticate to
-the cluster. The `tsh` profile is created when a user runs `tsh login`.
-
-`tctl` reads the `TELEPORT_CONFIG_FILE` environment variable to determine if
-a Teleport configuration file is present. If you are using your `tsh` profile to
-authenticate `tctl`, you must ensure that one of these conditions is true:
-
-- `TELEPORT_CONFIG_FILE` is blank
-- No file exists at `/etc/teleport.yaml`
-
-Otherwise `tctl` will attempt to connect to a Teleport cluster on the machine,
-which could result in the error,
-`ERROR: open /var/lib/teleport/host_uuid: permission denied`.
-
-  </TabItem>
-  <TabItem scope={["cloud", "team"]} label="Cloud-Hosted">
-
-### On a remote host with an identity file
-
-`tctl` can authenticate with a user-provided identity file. The Teleport Auth
-Service signs an identity file when a user runs `tctl auth sign` or
-`tsh login --out=<output-path>`, and the user can include the path to the
-identity file in the `--identity` flag when running `tctl` commands.
-
-When using the `--identity` flag, the user must alo provide the `--auth-server`
-flag with the address of an Auth Service or Proxy Service so `tctl` knows which
-cluster to authenticate to.
-
-### On a remote host after running `tsh login`
-
-If `tctl` cannot find a local Teleport configuration file or a user-provided
-identity file, it attempts to load the user's `tsh` profile to authenticate to
-the cluster. The `tsh` profile is created when a user runs `tsh login`.
-
-`tctl` reads the `TELEPORT_CONFIG_FILE` environment variable to determine if
-a Teleport configuration file is present. If you are using your `tsh` profile to
-authenticate `tctl`, you must ensure that one of these conditions is true:
-
-- `TELEPORT_CONFIG_FILE` is blank
-- No file exists at `/etc/teleport.yaml`
-
-Otherwise `tctl` will attempt to connect to a Teleport cluster on the machine,
-which could result in the error,
-`ERROR: open /var/lib/teleport/host_uuid: permission denied`.
-
-  </TabItem>
-</Tabs>
+For a conceptual overview of `tctl`, see [Getting Started with
+`tctl`](../../zero-trust-access/infrastructure-as-code/using-tctl.mdx).
 
 ## tctl global flags
 
@@ -204,7 +118,7 @@ $ tctl notifications ls [<flags>]
 | Name       | Default Value(s) | Allowed Value(s)        | Description                                                                                                                                        |
 | ---------- | ---------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `--user`   | none             | **string**              | List only a specific user's notifications.                                                                                                         |
-| `--format` | `text`           | `text`,`yaml`,`json`    | The format of the output.                                                                                                                          |
+| `--format` | `text`           | `text`,`yaml`,`json`    | The format of the output, default is `text`.                                                                                                                          |
 | `--all`    | `false`          | `true`,`false`          | If `true`, notifications generated by Teleport will also be returned, as opposed to only notifications created by admins via the `tctl` interface. |
 | `--labels` | none             | Comma-separated strings | Filter notifications by labels.                                                                                                                    |
 
@@ -266,6 +180,7 @@ $ tctl alerts ack [<flags>] <id>
 | `--ttl` | 24h | Any duration | Time duration to acknowledge the alert for |
 | `--clear` | none | | Clear an existing alert acknowledgement |
 | `--reason` | none | | The reason for suppressing this alert |
+| `--format` | `text` | `text`,`yaml`,`json` | Output format, default is `text` |
 
 ### Examples
 
@@ -286,6 +201,18 @@ $ tctl alerts ack --clear upgrade-suggestion
 
 Lists alert acknowledgements.
 
+```code
+$ tctl alerts ack ls [<flags>]
+```
+
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--format` | `text` | `text`,`yaml`,`json` | Output format, default is `text` |
+
+### Examples
+
 ```code
 $ tctl alerts ack ls
 ID                 Reason                 Expires
@@ -428,7 +355,7 @@ $ tctl auth rotate --type=host --grace-period=8h
 <Admonition type="tip" title="Automation">
 `tctl auth sign` is commonly used to generate long-lived certificates for
 automation purposes. On supported platforms,
-[Machine ID](../../enroll-resources/machine-id/introduction.mdx) is a more secure alternative that
+[Machine & Workload Identity](../../machine-workload-identity/introduction.mdx) is a more secure alternative that
 generates short-lived certificates for automation workflows.
 </Admonition>
 
@@ -494,7 +421,7 @@ $ tctl auth sign --user=admin --out=identity.pem
 
 ## tctl bots add
 
-Create a new Machine ID Bot:
+Create a new Machine & Workload Identity Bot:
 
 ```code
 $ tctl bots add <name> [<flags>]
@@ -502,7 +429,7 @@ $ tctl bots add <name> [<flags>]
 
 ### Arguments
 
-- `<name>` - name of Machine ID Bot to create.
+- `<name>` - name of Machine & Workload Identity Bot to create.
 
 ### Flags
 
@@ -567,7 +494,7 @@ These flags are available for all commands: `--debug, --config`. Run
 
 ## tctl bots instances list
 
-List all current instances of a Machine ID bot:
+List all current instances of a Machine & Workload Identity bot:
 
 ```code
 $ tctl bots instances list [<name>]
@@ -578,6 +505,16 @@ $ tctl bots instances list [<name>]
 - `[<name>]` - an optional bot name. If provided, filters the result to show
   only instances for the named bot. Otherwise, shows all instances for all bots.
 
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--search` | none | A search term | Optional. Filters the returned bot instances using a fuzzy search based on the term provided. |
+| `--query` | none | Teleport predicate language query | Optional. Filters the returned bot instances based on the Teleport predicate language query provided. |
+| `--sort-index` | `bot_name` | `bot_name`, `active_at_latest`, `version_latest`, `host_name_latest` | Optional. Sorts the returned bot instances using the given field. |
+| `--sort-order` | `ascending` | `ascending`, `descending` | Optional. Sorts the returned bot instances in the given order. |
+| `--format` | `text` | `text`, `json` | If set to `json`, returns results as a machine-readable JSON string. |
+
 ### Examples
 
 This shows all known instances for the bot named "example":
@@ -586,6 +523,25 @@ This shows all known instances for the bot named "example":
 $ tctl bots instance list example
 ```
 
+This shows all known instances which contain the term "github";
+
+```code
+$ tctl bots instance list --search github
+```
+
+Searchable fields include; bot name, instance id, hostname, join method, version
+
+This shows all known instances with a version older than "18.0.0";
+
+```code
+$ tctl bots instance list --query `older_than(status.latest_heartbeat.version, "18.0.0")`
+```
+Version-specific functions include;
+
+- `newer_than(version, comparison)`
+- `older_than(version, comparison)`
+- `between(version, lower (inclusive), upper (exclusive))`
+
 ### Global flags
 
 These flags are available for all commands: `--debug, --config`. Run
@@ -618,7 +574,7 @@ These flags are available for all commands: `--debug, --config`. Run
 
 ## tctl bots ls
 
-Lists all Machine ID Bots:
+Lists all Machine & Workload Identity Bots:
 
 ```code
 $ tctl bots ls [<flags>]
@@ -631,7 +587,7 @@ These flags are available for all commands: `--debug, --config`. Run
 
 ## tctl bots rm
 
-Delete a Machine ID Bot:
+Delete a Machine & Workload Identity Bot:
 
 ```code
 $ tctl bots rm <name> [<flags>]
@@ -639,7 +595,7 @@ $ tctl bots rm <name> [<flags>]
 
 ### Arguments
 
-- `<name>` - name of Machine ID Bot to delete.
+- `<name>` - name of Machine & Workload Identity Bot to delete.
 
 ### Global flags
 
@@ -648,7 +604,7 @@ These flags are available for all commands: `--debug, --config`. Run
 
 ## tctl bots update
 
-Update a Machine ID bot:
+Update a Machine & Workload Identity Bot:
 
 ```code
 $ tctl bots update <bot> [<flags>]
@@ -694,7 +650,7 @@ These flags are available for all commands: `--debug, --config`. Run
 Create or update a Teleport resource from a YAML file.
 
 The supported resource types are: user, node, cluster, role, connector, and device.
-See the [Resources Reference](../resources.mdx) for complete docs on how to build these yaml files.
+See the [Resources Reference](../infrastructure-as-code/teleport-resources/teleport-resources.mdx) for complete docs on how to build these yaml files.
 
 ```code
 $ tctl create [<flags>] <filename>
@@ -731,7 +687,7 @@ $ tctl create -f cluster.yaml
 Register a device.
 
 ```code
-$ tctl devices add --os=OS --asset-tag=SERIAL_NUMBER
+$ tctl devices add --os=OS --asset-tag=SERIAL_NUMBER [<flags>]
 ```
 
 ### Flags
@@ -741,6 +697,7 @@ $ tctl devices add --os=OS --asset-tag=SERIAL_NUMBER
 | `--os` | none | `linux`, `macos`, `windows` | Device operating system |
 | `--asset-tag` | none | string | Device inventory identifier (e.g., Mac serial number) |
 | `--enroll` | false | boolean | If set, creates a device enrollment token |
+| `--format` | `text` | `text`,`yaml`,`json` | Output format, default is `text` |
 
 ### Examples
 
@@ -788,17 +745,22 @@ tsh device enroll --token=(=devicetrust.enroll_token=)
 List registered devices.
 
 ```code
-$ tctl devices ls
+$ tctl devices ls [<flags>]
 ```
 
+### Flags
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--format` | `text` | `text`,`yaml`,`json` | Output format, default is `text` |
+
+
 ### Examples
 
 ```code
 $ tctl devices ls
-
-Asset Tag    OS    Enroll Status Device ID
------------- ----- ------------- ------------------------------------
-(=devicetrust.asset_tag=) macOS enrolled      d40f2ee4-856d-4aef-b784-c4371e39c036
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+(=devicetrust.asset_tag=) macOS        not enrolled        d40f2ee4-856d-4aef-b784-c4371e39c036
 ```
 
 ## tctl devices rm
@@ -965,7 +927,7 @@ $ tctl inventory list [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--format` | `text` | `yaml, json` or `text` | Output format |
+| `--format` | `text` | `yaml, json` or `text` | Output format, default is `text` |
 | `--older-than` | none | string | Filter for older teleport versions |
 | `--exact-version` | none | string | Filter output by teleport version |
 | `--services` | none | string | Filter output by service (node,kube,proxy,etc) |
@@ -1014,7 +976,7 @@ $ tctl inventory status [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--format` | `text` | `yaml, json` or `text` | Output format |
+| `--format` | `text` | `yaml, json` or `text` | Output format, default is `text` |
 | `--[no-]connected` | `--no-connected` | none | Show locally connected instances summary |
 
 ### Global flags
@@ -1087,6 +1049,46 @@ Total Instances: 19
  Note that newly added Teleport services do not show in the inventory right as the service joins. Those can take around 5 minutes
  under regular circumstances to show in inventory counts and up to 15 minutes for heavy load.
 
+## tctl lock
+
+Create a new lock.
+
+```code
+$ tctl lock [<flags>]
+```
+
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| --- | --- | --- | --- |
+| `--user` | none | string | Target a specific user by username. |
+| `--role` | none | string | Target a specific role by name. |
+| `--login` | none | string | Target a specific server login. |
+| `--server-id` | none | string | Target a specific node by name or UUID. |
+| `--mfa-device` | none | string | Target a specific MFA device by UUID. |
+| `--windows-desktop` | none | string | Target a specific Windows desktop by name. |
+| `--access-request` | none | string | Target a specific Access Request by ID. |
+| `--device` | none | string | Target a specific trusted device by ID. |
+| `--message` | none | string | Optional message explaining the reason for the lock. |
+| `--expires` | never | timestamp | When the lock should automatically expire (RFC3339). |
+| `--ttl` | none | duration | Time-to-live for the lock (alternative to --expires). |
+
+### Examples
+
+```code
+# Lock a specific user
+$ tctl lock --user alice --message "Security incident investigation"
+
+# Lock a role with expiration
+$ tctl lock --role developers --expires "2025-06-26T00:20:47.16109Z" --message "Emergency maintenance"
+
+# Lock a specific node
+$ tctl lock --server-id web-server-01 --message "Suspected compromise"
+
+# Lock multiple targets (user and access-request combination)
+$ tctl lock --user=foo@example.com --message="Suspicious activity." --ttl=10h --access-request=1234
+```
+
 ## tctl login_rule test
 
 Test a Login Rule resource without installing it in the cluster.
@@ -1101,7 +1103,7 @@ Test a Login Rule resource without installing it in the cluster.
 | - | - | - | - |
 | `--resource-file` | none | **string** filepath | Path to Login Rule resource path, can be repeated for multiple files |
 | `--load-from-cluster` | `false` | `true, false` | When true, all Login Rules currently installed in the cluster will be loaded for the test. Can be combined with `--resource-file` to test interactions. |
-| `--format` | `yaml` | `yaml, json` | Output format for traits |
+| `--format` | `yaml` | `yaml, json` | Output format for traits, default is `yaml` |
 
 ### Global flags
 
@@ -1202,7 +1204,7 @@ $ tctl request approve request-id-1, request-id-2
 Create a pending Access Request.
 
 ```code
-$ tctl request create <username>
+$ tctl request create [<flags>] <username>
 ```
 
 ### Arguments
@@ -1213,10 +1215,10 @@ $ tctl request create <username>
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-|`roles`|none|Comma-separated list of strings|Roles to be requested|
-|`resource`|none|Comma-separated list of strings|Resource IDs to be requested|
-|`reason`|none|String|Optional reason message|
-|`dry-run`|none|Boolean|Don't actually generate the Access Request|
+|`--roles`|none|Comma-separated list of strings|Roles to be requested|
+|`--resource`|none|Comma-separated list of strings|Resource IDs to be requested|
+|`--reason`|none|String|Optional reason message|
+|`--dry-run`|none|Boolean|Don't actually generate the Access Request|
 
 Use the `dry-run` flag if you want to validate whether Teleport can create an
 Access Request for the user in the `username` argument, given the user's static
@@ -1312,6 +1314,9 @@ $ tctl rm saml/okta
 
 # Delete a local user called "admin":
 $ tctl rm users/admin
+
+# Delete a lock
+$ tctl rm lock/ed7038cb-a3cc-4f59-8063-09553665b773
 ```
 
 ## tctl sso configure github
@@ -1445,7 +1450,7 @@ The following flags are specific to Google Workspace:
 | `--google-acc-uri` | URI of your service account credentials file. Example: `file:///var/lib/teleport/gworkspace-creds.json`.|
 | `--google-acc`      | String containing Google service account credentials.                                                  |
 | `--google-admin`   | Email of a Google admin to impersonate.                                                                |
-| `--google-legacy`  | Flag to select groups with direct membership filtered by domain (legacy behavior). <br/>Disabled by default. [More info](../../admin-guides/access-controls/sso/google-workspace.mdx) |
+| `--google-legacy`  | Flag to select groups with direct membership filtered by domain (legacy behavior). <br/>Disabled by default. [More info](../../zero-trust-access/sso/integrate-idp/google-workspace.mdx) |
 | `--google-id`      | Shorthand for setting the `--id` flag to `<GOOGLE_WORKSPACE_CLIENT_ID>.apps.googleusercontent.com`     |
 
 ### Global flags
@@ -1665,7 +1670,7 @@ This command accepts no arguments.
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--format` | `text` | `json` or `text` | Output format |
+| `--format` | `text` | `json` or `text` | Output format, default is `text` |
 
 ### Examples
 
@@ -1804,12 +1809,18 @@ $ tctl tokens rm [<token>]
 
 Reports diagnostic information.
 
-The diagnostic metrics endpoint must be enabled with `teleport start --diag-addr=<bind-addr>` for `tctl top` to work.
+`tctl top` can consume metrics from a HTTP diagnostic endpoint.
 
 ```code
 $ tctl top [<diag-addr>] [<refresh>]
 ```
 
+When a specific endpoint is provided, `tctl top` will always attempt to connect to it.
+The endpoint should be a valid HTTP URL, corresponding to a matching
+diagnostic metrics service configuration such as `teleport start --diag-addr=<bind-addr>`.
+
+When no endpoint is specified, `tctl top` will attempt to connect via the debug UNIX socket endpoint, falling back to localhost.
+
 ### Argument
 
 - `[<diag-addr>]` Diagnostic HTTP URL (HTTPS not supported)
@@ -1821,6 +1832,8 @@ $ tctl top [<diag-addr>] [<refresh>]
 $ sudo teleport start --diag-addr=127.0.0.1:3000
 # View stats with a refresh period of 5 seconds
 $ tctl top http://127.0.0.1:3000 5s
+# Use configured defaults
+$ tctl top
 ```
 
 ## tctl users add
@@ -2058,6 +2071,83 @@ prod       Done  2025-01-15 18:00:12 outside_window
 backup     Done  2025-01-14 20:00:31 outside_window
 ```
 
+## tctl autoupdate agents report
+
+Aggregates the agent autoupdate reports and displays agent count per version and per update group.
+
+## tctl autoupdate agents start-update
+
+```code
+$ tctl autoupdate agents start-update [--force] [<groups>...]
+```
+
+Manually initiates an update for the specified groups.
+
+### Arguments
+
+- `<groups>` - Groups to update. If not specified, all groups will be started.
+- `--force` - Skips progressive deployment mechanism such as canaries or backpressure.
+
+### Examples
+
+Manually trigger staging and production updates:
+```code
+$ tctl autoupdate agents start-update stage prod
+Started updating agents groups: [stage prod].
+New agent rollout status:
+
+Group Name State     Start Time          State Reason
+---------- --------- ------------------- --------------
+dev        Unstarted                     cannot_start
+stage      Active    2025-03-10 15:04:16 manual_trigger
+prod       Active    2025-03-10 15:04:16 manual_trigger
+```
+## tctl autoupdate agents mark-done
+
+```code
+$ tctl autoupdate agents mark-done [<groups>...]
+```
+
+Manually marks an agent update group as successfully updated.
+
+### Arguments
+
+- `<groups>` - Groups to mark as updated. If not specified, all groups will be marked.
+
+### Examples
+
+Manually mark the staging group as updated:
+```code
+$ tctl autoupdate agents mark-done stage
+Successfully marked agent groups as completed: [stage].
+New agent rollout status:
+
+Group Name State     Start Time          State Reason
+---------- --------- ------------------- ------------------
+dev        Unstarted                     cannot_start
+stage      Done      2025-03-10 15:04:16 manual_forced_done
+prod       Active    2025-03-10 15:04:16 manual_trigger
+```
+
+## tctl autoupdate agents rollback
+
+```code
+$ tctl autoupdate agents rollback [<groups>...]
+```
+
+Initiates an immediate rollback of Teleport agents from the target version to the start version.
+
+### Arguments
+
+- `<groups>` - Groups to rollback. If not specified, all groups not in the `unstarted` state will be rolled back.
+
+### Examples
+
+Rollback all agents immediately:
+```code
+$ tctl autoupdate agents rollback
+```
+
 ## tctl plugins install awsic
 
 Install the AWS Identity Center integration.
@@ -2113,7 +2203,7 @@ the two user filter flags imply that if a user
 - was provisioned into Teleport by Okta (from `--user-origin okta`), OR
 - has the label values `role=aws-admin` AND `dept=engineering` (from `--user-label "role=aws-admin,dept=engineering"`)
 
-then they will be provisioned into AWS Identity Center by Teleport. 
+then they will be provisioned into AWS Identity Center by Teleport.
 
 ## tctl plugins install okta
 
@@ -2130,7 +2220,7 @@ Install the Okta integration.
 | `--api-token` | none | string | Optional. Okta API token for the plugin to use. |
 | `--[no-]scim` | `--no-scim` | boolean | Optional. Enable SCIM Okta integration. |
 | `--[no-]users-sync` | `--users-sync` | none | Optional. Enable user synchronization. |
-| `-o`, `--owner` | none | string | Optional. Add a default owner for synced Access Lists. | 
+| `-o`, `--owner` | none | string | Optional. Add a default owner for synced Access Lists. |
 | `--[no-]accesslist-sync` | `--accesslist-sync` | none | Optional. Enable or disable group to Access List synchronization. |
 | `--[no-]appgroup-sync` | `--appgroup-sync` | none | Optional. Enable or disable Okta Applications and Groups sync. |
 | `-g`, `--group-filter` | none | string | Optional. Add a group filter. Supports globbing by default. Enclose in `^pattern$` for full regex support. |
@@ -2149,6 +2239,88 @@ $ tctl plugins install okta \
     --no-appgroup-sync
 ```
 
+## tctl plugins install entraid
+
+Install the Entra ID plugin.
+
+```code
+$ tctl plugins install entraid <flags>
+```
+
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--name` | `entra-id` | string | Name of the plugin resource to create. |
+| `--auth-connector-name` | `entra-id-default` | string | Name of the SAML connector resource to create. |
+| `--default-owner` | none | string | Required. A Teleport username to set as the default owner for the imported Access Lists. Multiple flags allowed. |
+| `--[no-]access-graph` | `--access-graph` | boolean | Optional. Enable Access Graph cache build. |
+| `--[no-]use-system-credentials` | `--no-use-system-credentials` | boolean | Optional. Use system credentials instead of OIDC. |
+| `--[no-]manual-setup` | `--no-manual-setup` | boolean | Optional. Manually set up the EntraID integration. |
+| `--[no-]force` | `--no-force` | boolean | Optional. Proceed with the installation even if the plugin already exists. |
+| `--group-id` | none | string | Optional. Include group matching the specified group ID. Multiple flags allowed. |
+| `--group-name` | none | string | Optional. Include groups matching the specified group name regex. Multiple flags allowed.  |
+| `--exclude-group-id` | none | string | Optional. Exclude group matching the specified group ID. Multiple flags allowed. |
+| `--exclude-group-name` | none | string | Optional. Exclude groups matching the specified group name regex. Multiple flags allowed. |
+
+
+### Example
+
+```code
+$ tctl plugins install entraid \
+    --name entra-id-default \
+    --auth-connector-name entra-id \
+    --default-owner=admin \
+    --default-owner=root@example.com \
+    --no-access-graph \
+    --use-system-credentials \
+    --manual-setup \
+    --group-id 25f9c527-2314-414c-a75d-ef7efabcc99b \
+    --group-name "admin*" \
+    --exclude-group-id 080b50c3-1c98-4d8e-a54e-20143dbd4f99 \
+    --exclude-group-name "fin*" 
+```
+
+Multiple flags are collected together. In the given example, based on the 
+two `default-owner` flags, all the Access Lists imported by the integration will 
+be created with owners `admin` and `root@example.com`.
+
+
+## tctl plugins rotate awsic
+
+Rotate the bearer token used by Teleport to authenticate with the AWS IAM Identity
+Center SCIM service when provisioning AWS users and groups.
+
+By default, `tctl` will validate that the token can be used to authenticate with
+the SCIM service configured in the integration. Use the `--no-validate-token`
+flag to disable token validation.
+
+```code
+$ tctl plugins rotate awsic [<flags>] <token>
+```
+
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--plugin-name` | | string | Optionally override the name of the AWS IAM Identity Center integration to target | 
+| `--[no-]validate-token` | `--validate-token` | none | Enables or disables validating the supplied token against the configured SCIM server |
+
+### Examples
+
+Rotate the SCIM bearer token without displaying the token in your command history
+
+```code
+$ tctl plugins rotate awsic $(cat ./aws-iam-ic-bearer-token)
+```
+
+Rotate the the SCIM bearer token for a custom integration enrollment that does not
+have the default name set by the guided enrollment flow.
+
+```code
+$ tctl plugins rotate awsic --plugin-name "my-custom-ic-integration" ${TOKEN_VALUE}
+```
+
 ## tctl version
 
 Print the version of your `tctl` binary:
@@ -2156,3 +2328,50 @@ Print the version of your `tctl` binary:
 ```code
 tctl version
 ```
+
+## tctl recordings encryption rotate
+
+Rotate the active session recording encryption key. Will fail if rotation is already in
+progress.
+
+### Example
+
+```code
+$ tctl recordings encryption rotate
+```
+
+## tctl recordings encryption status
+
+Print the rotation status of all active encryption keys.
+
+### Flags
+
+| Name       | Default Value(s) | Allowed Value(s)     | Description               |
+| ---------- | ---------------- | -------------------- | ------------------------- |
+| `--format` | `text`           | `text`,`yaml`,`json` | The format of the output, default is `text` |
+
+### Example
+
+```code
+$ tctl recordings encryption status
+```
+
+## tctl recordings encryption complete-rotation
+
+Completes a key rotation.
+
+### Example
+
+```code
+$ tctl recordings encryption complete-rotation
+```
+
+## tctl recordings encryption rollback-rotation
+
+Reverts a key rotation.
+
+### Example
+
+```code
+$ tctl recordings encryption rollback-rotation
+```
diff --git a/docs/pages/reference/cli/teleport-update.mdx b/docs/pages/reference/cli/teleport-update.mdx
index 32229f9dcbd88..e6eda3fd3caa1 100644
--- a/docs/pages/reference/cli/teleport-update.mdx
+++ b/docs/pages/reference/cli/teleport-update.mdx
@@ -1,11 +1,15 @@
 ---
 title: teleport-update CLI reference
+sidebar_label: teleport-update
 description: Comprehensive reference of subcommands, flags, and arguments for the teleport-update CLI tool.
+tags:
+ - reference
+ - platform-wide
 ---
 
-`teleport-update` is a CLI tool that is used to update Teleport Agents installed on Linux servers.
+`teleport-update` is a CLI tool that is used to update Teleport Agents and Bots installed on Linux servers.
 
-See [Teleport Agent Managed Updates](../../upgrading/agent-managed-updates.mdx) for more details.
+See [Teleport Agent Managed Updates](../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for more details.
 
 The primary commands for `teleport-update` are as follows:
 
@@ -25,7 +29,7 @@ The primary commands for `teleport-update` are as follows:
 
 ## teleport-update enable
 
-Enables agent Managed Updates and performs an initial installation of the Teleport Agent.
+Enables Managed Updates and performs an initial installation of the Teleport Agent and tbot.
 This command also creates a systemd timer that periodically runs the update subcommand.
 
 If Teleport is already installed, `enable` will update to the cluster-advertised version
@@ -37,8 +41,9 @@ Existing tarball-based, static installations may require `--overwrite`.
 
 Files are installed to the following paths (with the default `install-suffix`):
 
-- `/usr/local/bin/{teleport,tsh,...}` - Symbolic links into `/opt/teleport/default/versions/X.Y.Z/bin/`
+- `/usr/local/bin/{teleport,tbot,tsh,...}` - Symbolic links into `/opt/teleport/default/versions/X.Y.Z/bin/`
 - `/lib/systemd/system/teleport.service` - Teleport SystemD service
+- `/etc/systemd/system/tbot.service` - Tbot SystemD service (not replaced if already present)
 - `/opt/teleport/default` - Storage for Teleport versions and updater configuration
 - `/etc/systemd/system/teleport-update.{service,timer}` - Updater SystemD timer and service
 - `/etc/systemd/system/teleport.service.d/teleport-update.conf` - Environment variables that configure Teleport
@@ -62,7 +67,7 @@ To change these flags, run `enable` again with the new flags.
 
 ### Examples
 
-**Example for a new installation.**
+**Example for a new Teleport Agent installation.**
 
 Install Teleport with Managed Updates enabled on a fresh system.
 
@@ -72,6 +77,17 @@ $ sudo teleport-update enable
 $ sudo systemctl enable teleport --now
 ```
 
+**Example for a new Teleport Agent and tbot installation.**
+
+Install Teleport with Managed Updates enabled on a fresh system.
+
+```code
+# create /etc/teleport.yaml and /etc/tbot.yaml
+$ sudo teleport-update enable
+$ sudo systemctl enable teleport --now
+$ sudo systemctl enable tbot --now
+```
+
 **Example for an existing installation.**
 
 Install Teleport with Managed Updates enabled on a system with a running Teleport version.
@@ -96,7 +112,7 @@ $ export PATH=/opt/teleport/mycluster/bin:$PATH
 
 ## teleport-update disable
 
-Disable Managed Updates for the installed agent.
+Disable Managed Updates for the installed Teleport Agent and/or tbot.
 This command does not remove or change the active installation of Teleport.
 
 Unlike `pin`, this command will not touch the current installation, and version lookup requests will stop entirely.
@@ -122,7 +138,7 @@ $ sudo teleport-update disable
 
 ## teleport-update pin
 
-Pin the installed agent to a specific version of Teleport.
+Pin the installed Teleport Agent and/or tbot to a specific version of Teleport.
 This command updates Teleport to latest version (or a version specified with `--force-version`), and ensures the local
 installation of Teleport remains at that version.
 New versions will continue to be reported in SystemD `teleport-update.service` logs, they but will not be installed.
@@ -234,7 +250,7 @@ Link the system installation of Teleport from the Teleport package, if Managed U
 
 This command is used to link the system package installation by:
 - Creating symbolic links from `/opt/teleport/system/bin/*` into `/usr/local/bin/`.
-- Copying the Teleport systemd service file from `/opt/teleport/system/lib/systemd/system/teleport.service` into `/ib/systemd/system/teleport.service`.
+- Copying the Teleport systemd service file from `/opt/teleport/system/lib/systemd/system/teleport.service` into `/lib/systemd/system/teleport.service`.
 
 This command is executed automatically when the Teleport package is installed, and does not need to be manually executed.
 
diff --git a/docs/pages/reference/cli/teleport.mdx b/docs/pages/reference/cli/teleport.mdx
index 137a4be2b43f6..3a87e4336f7b7 100644
--- a/docs/pages/reference/cli/teleport.mdx
+++ b/docs/pages/reference/cli/teleport.mdx
@@ -1,6 +1,10 @@
 ---
 title: teleport CLI Reference
+sidebar_label: teleport
 description: Comprehensive reference of subcommands, flags, and arguments for the teleport CLI tool.
+tags:
+ - reference
+ - platform-wide
 ---
 
 The CLI tool that supports the Teleport Infrastructure Identity Platform is called `teleport`, and allows Teleport services to be managed
@@ -9,7 +13,7 @@ over the command line:
 - [Auth](../architecture/authentication.mdx)
 - [Node/SSH](../architecture/agents.mdx)
 - [Proxy](../architecture/proxy.mdx)
-- [App](../../enroll-resources/application-access/introduction.mdx)
+- [App](../../enroll-resources/application-access/application-access.mdx)
 - [Database](../../enroll-resources/database-access/database-access.mdx)
 - [Windows Desktop](../../enroll-resources/desktop-access/introduction.mdx)
 - [Kubernetes](../../enroll-resources/kubernetes-access/introduction.mdx)
@@ -19,7 +23,7 @@ The primary commands for the `teleport` CLI are as follows:
 | Command | Description |
 | - | - |
 | `teleport app start` | Starts the Teleport Application Service. |
-| `teleport configure` | Generates and writes a [configuration YAML file](../config.mdx) for the Teleport service. This file should be customized in production to suit the needs of your environment, and the default output should only be used when testing. |
+| `teleport configure` | Generates and writes a [configuration YAML file](../deployment/config.mdx) for the Teleport service. This file should be customized in production to suit the needs of your environment, and the default output should only be used when testing. |
 | `teleport db configure aws create-iam` | Generates, creates, and attaches desired IAM policies to a Teleport-managed database. |
 | `teleport db configure aws print-iam` | Generates and outputs current IAM policies for a Teleport-managed database. |
 | `teleport db configure bootstrap` | Used to bootstrap a configuration to the Teleport Database Service by reading a provided configuration. |
@@ -29,7 +33,7 @@ The primary commands for the `teleport` CLI are as follows:
 | `teleport install systemd` | Creates a systemd unit file, used to configure and install a `teleport` service daemon. |
 | `teleport join openssh` | Registers an OpenSSH server with Teleport. |
 | `teleport node configure` | Generates a configuration YAML file for a Teleport Node accessed via SSH. This file should be customized in production to suit the needs of your environment, and the default output should only be used when testing. |
-| `teleport start` | Starts the `teleport` process in the foreground using the current shell session, including any services configured by the [configuration YAML file](../config.mdx). |
+| `teleport start` | Starts the `teleport` process in the foreground using the current shell session, including any services configured by the [configuration YAML file](../deployment/config.mdx). |
 | `teleport status` | Prints the status of the current active Teleport SSH session. |
 | `teleport version` | Prints the current release version of the Teleport binary installed on your system. |
 | `teleport debug set-log-level` | Changes instance log level. |
@@ -45,7 +49,7 @@ For more information on subcommands when working with the `teleport` cli, use th
 The `teleport start` command includes a large number of optional configuration flags.
 
 While configuration flags for `teleport start` can be used to set parameters for Teleport's configuration,
-we recommend using a [configuration file](../config.mdx) in production.
+we recommend using a [configuration file](../deployment/config.mdx) in production.
 
 ### Flags
 
@@ -64,9 +68,9 @@ we recommend using a [configuration file](../config.mdx) in production.
 | `-c, --config` | `/etc/teleport.yaml` | **string** `.yaml` filepath | starts services with config specified in the YAML file, overrides CLI flags if set |
 | `--apply-on-startup` | none | **string** `.yaml` filepath | On startup, always apply resources described in the file at the given path. Only supports the following kinds: `token`, `role`, `user`, `cluster_auth_preference`, `cluster_networking_config`, `bot`. |
 | `--bootstrap` | none | **string** `.yaml` filepath | bootstrap configured YAML resources {/* TODO link how to configure this file */} |
-| `--labels` | none | **string** comma-separated list | assigns a set of labels to a node, for example env=dev,app=web. See the explanation of labeling mechanism in the [Labeling Nodes](../../admin-guides/management/admin/labels.mdx) section. |
+| `--labels` | none | **string** comma-separated list | assigns a set of labels to a node, for example env=dev,app=web. See the explanation of labeling mechanism in the [Labeling Nodes](../../zero-trust-access/rbac-get-started/labels.mdx) section. |
 | `--insecure` | none | none | disable certificate validation on Proxy Service, validation still occurs on Auth Service. |
-| `--fips` | none | none | start Teleport in FedRAMP/FIPS 140-2 mode. |
+| `--fips` | none | none | start Teleport in FedRAMP/FIPS mode. |
 | `--skip-version-check` | `false` | `true` or `false` | Skips version checks between the Auth Service and this Teleport instance |
 | `--diag-addr` | none | none | Enable diagnostic endpoints |
 | `--permit-user-env` | none | none | flag reads in environment variables from `~/.tsh/environment` when creating a session. |
@@ -83,8 +87,8 @@ The `--roles` flag when used with `teleport --start` instructs Teleport on which
 | [Node](../architecture/agents.mdx) | `node` | Allows SSH connections from authenticated clients. |
 | [Auth](../architecture/authentication.mdx) | `auth` | Authenticates and authorizes hosts and users who want access to Teleport-managed resources or information about a cluster. |
 | [Proxy](../architecture/proxy.mdx) | `proxy` | The gateway that clients use to connect to the Auth Service or resources managed by Teleport. |
-| [App](../../enroll-resources/application-access/introduction.mdx) | `app` | Provides access to applications. |
-| [Database](../agent-services/database-access-reference/database-access-reference.mdx) | `db` | Provides access to databases. |
+| [App](../../enroll-resources/application-access/application-access.mdx) | `app` | Provides access to applications. |
+| [Database](../../enroll-resources/database-access/reference/reference.mdx) | `db` | Provides access to databases. |
 
 <Admonition type="tip" scope={["cloud"]}>
 
diff --git a/docs/pages/reference/cli/tsh.mdx b/docs/pages/reference/cli/tsh.mdx
index 50c207bda3f2f..77a45b212a002 100644
--- a/docs/pages/reference/cli/tsh.mdx
+++ b/docs/pages/reference/cli/tsh.mdx
@@ -1,6 +1,10 @@
 ---
 title: tsh CLI reference
+sidebar_label: tsh
 description: Comprehensive reference of subcommands, flags, and arguments for the tsh CLI tool.
+tags:
+ - reference
+ - platform-wide
 ---
 
 `tsh` is a CLI client used by Teleport users. It allows users to interact with
@@ -14,18 +18,19 @@ Environment variables configure your tsh client and can help you avoid using fla
 | Environment Variable | Description | Example Value |
 | - | - | - |
 | TELEPORT_AUTH | Any defined [authentication connector](../access-controls/authentication.mdx), including `passwordless` and `local` (i.e., no authentication connector) | okta |
-| TELEPORT_MFA_MODE | Preferred mode for MFA and Passwordless assertions | otp |
 | TELEPORT_CLUSTER | Name of a Teleport root or leaf cluster | cluster.example.com |
 | TELEPORT_LOGIN | Login name to be used by default on the remote host | root |
 | TELEPORT_LOGIN_BIND_ADDR | Address in the form of host:port to bind to for login command webhook | host:port |
 | TELEPORT_LOGIN_BROWSER | Set to `none` to stop the system default browser from opening for SSO logins. If the value is not `none`, `tsh` will open the system default browser. | none |
 | TELEPORT_PROXY | Address of the Teleport proxy server | cluster.example.com:3080 |
+| TELEPORT_RELAY | Address of the Teleport relay server to use, "none" to disable the use of a relay, or "default" to use the default address specified by the control plane at login time. Defaults to port 443. | relay.example.com |
+| TELEPORT_HEADLESS | Use headless authentication | true, false, 1, 0 |
 | TELEPORT_HOME | Home location for tsh configuration and data | /directory |
 | TELEPORT_USER | A Teleport user name | alice |
 | TELEPORT_ADD_KEYS_TO_AGENT | Specifies if the user certificate should be stored on the running SSH agent | yes, no, auto, only |
 | TELEPORT_USE_LOCAL_SSH_AGENT | Disable or enable local SSH agent integration | true, false |
 | TELEPORT_GLOBAL_TSH_CONFIG | Override location of global `tsh` config file from default `/etc/tsh.yaml` | /opt/teleport/tsh.yaml |
-| TELEPORT_HEADLESS | Use headless authentication | true, false, 1, 0 |
+| TELEPORT_MFA_MODE | Preferred mode for MFA and Passwordless assertions | auto, cross-platform, platform, otp, sso |
 | TELEPORT_IDENTITY_FILE | File path to identity file | /opt/identity |
 
 ## tsh global flags
@@ -34,17 +39,18 @@ Environment variables configure your tsh client and can help you avoid using fla
 | - | - | - | - |
 | `-l, --login` | none | an identity name | The login identity that the Teleport user will use |
 | `--proxy` | none | `host:https_port[,ssh_proxy_port]` | Teleport Proxy Service address |
+| `--relay` | none | `host[:port]|none|default` | Address of the Teleport relay server to use, "none" to disable the use of a relay, or "default" to use the default address specified by the control plane at login time. Defaults to port 443. |
 | `--user` | `$USER` | none | The Teleport username |
 | `--ttl` | `720` (12 hours) | integer | Number of minutes a certificate issued for the `tsh` user will be valid for |
 | `-i, --identity` | none | **string** filepath | Identity file |
 | `--cert-format` | `standard` | `standard` or `oldssh` | SSH certificate format. `oldssh` supports older versions of OpenSSH servers that do not allow for custom metadata, which is how Teleport encodes a user's roles in their SSH certificate. |
 | `--insecure` | none | none | Do not verify the server's certificate and host name. Use only in test environments. |
 | `--auth` | `local` | Any defined [authentication connector](../access-controls/authentication.mdx), including `passwordless` and `local` (i.e., no authentication connector) | Specify the type of authentication connector to use. |
-| `--mfa-mode` | auto | `auto`, `cross-platform`, `platform` or `otp` | Preferred mode for MFA and Passwordless assertions. |
+| `--mfa-mode` | auto | `auto`, `cross-platform`, `platform`, `otp`, or `sso` | Preferred mode for MFA and Passwordless assertions. |
 | `--skip-version-check` | none | none | Skip version checking between server and client. |
 | `-d, --debug` | none | none | Verbose logging to stdout |
 | `-J, --jumphost` | none | A jump host | SSH jumphost |
-| `--headless` | none | none | Use Headless WebAuthn for authentication |
+| `--headless` | none | none | Use Headless Authentication |
 | `--mlock` | `auto` | `auto`, `off`, `best_effort`, `strict` | Lock process memory to protect client secrets stored in memory from being swapped to disk. |
 
 ## tsh apps ls
@@ -69,7 +75,7 @@ $ tsh clusters [<flags>]
 
 ### Global flags
 
-These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -162,7 +168,7 @@ $ tsh gcloud [--app] [<command>]
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -194,7 +200,7 @@ $ tsh gsutil [--app] [<command>]
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -234,7 +240,7 @@ $ tsh join [<flags>] <session-id>
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -310,7 +316,7 @@ $ tsh login [<flags>] [<cluster>]
 
 ### Arguments
 
-- `<cluster>` - the name of the cluster,  see [Trusted Cluster](../../admin-guides/management/admin/trustedclusters.mdx) for more information.
+- `<cluster>` - the name of the cluster,  see [Trusted Cluster](../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) for more information.
 
 ### Flags
 
@@ -329,9 +335,11 @@ $ tsh login [<flags>] [<cluster>]
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
+A relay address specified (or explicitly disabled with the "none" value) at login time will be stored in the `tsh` configuration directory for the specified proxy; if unspecified, the relay address may fall back to a default value specified by the Teleport control plane. Use of a Relay requires `tsh` v18.3.0 or later.
+
 ### Examples
 
 *The proxy endpoint can take a https and ssh port in this format `host:https_port[,ssh_proxy_port]`*
@@ -410,7 +418,7 @@ $ tsh ls [<flags>] [<label>]
 
 ### Global flags
 
-These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -507,7 +515,7 @@ $ tsh play [<flags>] <id-or-file>
 
 `<id-or-file>`
 
-- `id-or-file` The UUID of a past Teleport session, or the path to a local recording file.
+- `id-or-file` The UUID of a past Teleport session, or the path to a local recording file. If the session is encrypted, it must be streamed from the Teleport Auth Service and local file playback is not possible.
 
 ### Flags
 
@@ -520,7 +528,7 @@ $ tsh play [<flags>] <id-or-file>
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -560,12 +568,12 @@ $ tsh proxy app [<flags>] <app>
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `-p, --port` | none | port number | Specify the source port for the local proxy |
+| `-p, --port` | none | port number, port pair | Specify the listening port for the local proxy. Accepts an optional target port of a multi-port TCP app after a colon, e.g. "1234:5678". |
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
 ```code
@@ -596,8 +604,8 @@ $ tsh proxy aws [<flags>]
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
 
@@ -662,8 +670,8 @@ This command does not accept any arguments.
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ## tsh proxy db
 
@@ -689,8 +697,8 @@ $ tsh proxy db [<flags>] <db>
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
 
@@ -740,8 +748,8 @@ $ tsh proxy gcloud [<flags>]
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
 
@@ -753,6 +761,71 @@ $ gcloud compute instances list
 $ gsutil ls
 ```
 
+## tsh proxy kube
+
+Start a local TLS proxy for Kubernetes requests when using Teleport with TLS
+Routing enabled. Clients can interact with a Teleport-registered Kubernetes cluster through
+the local proxy.
+
+```code
+$ tsh proxy kube [<flags>] <kube-cluster>
+```
+
+### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--cluster` | none | string | The name of the Teleport cluster to connect to. |
+| `--kube-cluster` | none | string | The name of the Kubernetes cluster to proxy. |
+| `--as` | none | string | The Kubernetes user to impersonate. |
+| `--as-groups` | none | string | The Kubernetes group to impersonate. |
+| `--namespace` | none | string | The Kubernetes namespace to use. |
+| `--set-context-name` | none | string | A custom Kubernetes context name or template to use. |
+| `--exec` | none | boolean | Runs the proxy in the background and spawns a new shell with the $KUBECONFIG automatically set. |
+| `--port` | none | string | Source port used by the local proxy.|
+
+### [Global Flags](#tsh-global-flags)
+
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
+
+### Examples
+
+Proxy requests to a Kubernetes cluster
+```code
+$ tsh proxy kube test-cluster
+Preparing the following Teleport Kubernetes clusters:
+Teleport Cluster Name Kube Cluster Name Context Name
+--------------------- ----------------- -----------------
+teleport-test             test-cluster           teleport-test-test-cluster
+
+Started local proxy for Kubernetes on 127.0.0.1:49487
+To avoid port randomization, you can choose the listening port using the --port flag.
+
+Use the following config for your Kubernetes applications. For example:
+export KUBECONFIG="/home/alice/.tsh/keys/proxy.example.com/alice-kube/teleport-test/localproxy-49487-kubeconfig"
+kubectl version
+```
+
+Spawn a new shell with the Kubernetes proxy running in the background and the Kubernetes config
+automatically applied.
+```code
+$ tsh proxy kube test-cluster --exec
+Preparing the following Teleport Kubernetes clusters:
+Teleport Cluster Name Kube Cluster Name Context Name
+--------------------- ----------------- -----------------
+teleport-test             test-cluster           teleport-test-test-cluster
+
+Started local proxy for Kubernetes Access in the background.
+
+Warning! Teleport will initiate a new shell configured with kubectl for local proxy access.
+To conclude the session, simply use the "exit" command. Upon exiting, your original shell will be restored,
+the local proxy will be closed, and future access through this headless session won't be possible.
+
+
+Try issuing a command, for example "kubectl version".
+```
+
 ## tsh proxy ssh
 
 Start a local TLS proxy for `ssh` connections when using Teleport in TLS Routing mode.
@@ -776,8 +849,8 @@ $ tsh proxy ssh [<flags>] <[user@]host>
 
 ### [Global Flags](#tsh-global-flags)
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
 
@@ -844,7 +917,7 @@ $ tsh puttyconfig --port 22 ubuntu@openssh
 $ tsh puttyconfig --leaf example.teleport.sh ec2-user@leaf-node
 ```
 
-See [full docs on `tsh puttyconfig` here](../../connect-your-client/putty-winscp.mdx).
+See [full docs on `tsh puttyconfig` here](../../connect-your-client/third-party/putty-winscp.mdx).
 
 ## tsh recordings ls
 
@@ -865,7 +938,7 @@ $ tsh recordings ls [<flags>]
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -895,7 +968,7 @@ $ tsh recordings ls --last=6h0m0s
 >
 
 Recorded sessions are linked from the audit events to session recordings files
-in their [storage backend](../../reference/backends.mdx).
+in their [storage backend](../deployment/backends.mdx).
 The following error can occur if a session recording file is not available or
 when employing multiple auth servers with directory storage backend for recorded
 sessions. When using a directory storage backend for audit logs and recorded sessions,
@@ -1005,7 +1078,7 @@ $ tsh request review [<flags>] <request-id>
 
 ## tsh request search
 
-Search for resources to request access to
+Search for resources to request access to, or list requestable roles.
 
 ```code
 $ tsh request search [<flags>]
@@ -1015,9 +1088,12 @@ $ tsh request search [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--kind` | none | `node`, `kubernetes_cluster`, `db`, `app`, `windows_desktop` | Resource kind to search for (required) |
+| `--roles` | false | boolean | List requestable roles instead of searching for resources. Mutually exclusive with --kind. |
+| `--kind` | none | `node`, `kube_cluster`, `kube_resource`, `db`, `app`, `windows_desktop` | Resource kind to search for. Mutually exclusive with --roles. |
+| `--kube-kind` | none | string | Plural name of the kube resource (required when --kind is `kube_resource`) |
+| `--kube-api-group` | none | string | API group of the kube resource (required when --kind is `kube_resource` depending on the resource) |
 | `--search` | none | Comma-separated strings | List of comma-separated search keywords or phrases enclosed in single quotes |
-| `--query` | none | String | Query by [predicate language](../predicate-language.mdx#resource-filtering) enclosed in single quotes |
+| `--query` | none | String | Query by [predicate language](../access-controls/predicate-language.mdx#resource-filtering) enclosed in single quotes |
 | `--labels` | none | Comma-separated strings | List of comma-separated labels to filter by labels (e.g. `key=value1,key2=value2`) |
 
 ## tsh request show
@@ -1064,7 +1140,7 @@ $ tsh scp [<flags>] <source>... <dest>
 
 ### Global flags
 
-These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 ### Examples
@@ -1115,9 +1191,11 @@ $ tsh ssh [<flags>] <[user@]host> [<command>...]
 
 ### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--relay`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
+Use of a relay (as specified at `tsh login` time or through the `--relay` flag) requires `tsh` v18.3.0 or later.
+
 ### Examples
 
 ```code
diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/deployment/backends.mdx
similarity index 91%
rename from docs/pages/reference/backends.mdx
rename to docs/pages/reference/deployment/backends.mdx
index 06bfe38363bfa..bea5221ec7064 100644
--- a/docs/pages/reference/backends.mdx
+++ b/docs/pages/reference/deployment/backends.mdx
@@ -1,6 +1,9 @@
 ---
 title: Storage Backends
 description: How to configure Teleport deployment for high-availability using storage backends
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 A Teleport cluster stores different types of data in different locations. By
@@ -49,7 +52,7 @@ Once you have a high-availability storage backend and multiple instances of
 the Auth Service running, you'll need to create a load balancer to evenly
 distribute traffic to all Auth Service instances and have a single point of
 entry for all components that need to communicate with the Auth Service. Use the
-address of the load balancer in the [`auth_server`](./config.mdx) field when
+address of the load balancer in the [`auth_server`](config.mdx) field when
 configuring other components of Teleport.
 
 Configure your load balancer to use Layer 4 (TCP) load balancing, round-robin
@@ -81,7 +84,7 @@ load balancer you'll need to run Teleport with `--insecure-no-tls`
 </Admonition>
 
 If your load balancer supports HTTP health checks, configure it to hit the
-`/readyz` [diagnostics endpoint](../admin-guides/management/diagnostics/monitoring.mdx) on
+`/readyz` [diagnostics endpoint](../../zero-trust-access/management/diagnostics/monitoring.mdx) on
 machines running Teleport. This endpoint must be enabled by using the
 `--diag-addr` flag to teleport start:
 
@@ -120,17 +123,92 @@ and user records will be stored.
 To configure Teleport for using etcd as a storage backend:
 
 - Make sure you are using **etcd versions 3.3** or newer.
-- Follow [etcd's cluster hardware recommendations](https://etcd.io/docs/v3.5/op-guide/hardware/). In particular, leverage
+- Follow [etcd's cluster hardware recommendations](https://etcd.io/docs/v3.6/op-guide/hardware/). In particular, leverage
   SSD or high-performance virtualized block device storage for best performance.
 - Install etcd and configure peer and client TLS authentication using the [etcd
-  security guide](https://etcd.io/docs/v3.5/op-guide/security/).
-  - You can use [this script provided by
-    etcd](https://github.com/etcd-io/etcd/tree/master/hack/tls-setup) if you
-    don't already have a TLS setup.
+  security guide](https://etcd.io/docs/v3.6/op-guide/security/). See
+  [Configuring mTLS](#configuring-mtls-authentication-with-etcd) below for
+  details.
 - Configure all Teleport Auth Service instances to use etcd in the "storage" section of the config file as shown below.
 - Deploy several Auth Service instances connected to etcd backend.
 - Deploy several Proxy Service instances that have `auth_server` pointed to the Auth Service to connect to.
 
+### Configuring mTLS authentication with etcd
+
+We recommend using [cfssl](https://github.com/cloudflare/cfssl) and etcd's
+[`tls-setup` script](https://github.com/etcd-io/etcd/tree/main/hack/tls-setup)
+to configure mTLS between Teleport and etcd. It's helpful for creating
+certificates and keys for the entire etcd cluster. After [installing
+cfssl](https://github.com/cloudflare/cfssl?tab=readme-ov-file#installation),
+clone the `tls-setup` repo and follow the `Readme.md` file to customize the
+script configuration. Make sure to tweak the makefile if you change the number
+of etcd nodes (and thus the number of `infra` variables).
+
+After you run `make`, the following files will be generated:
+
+- `tls-setup/certs/ca.pem` is the certificate authority and it should be
+  referenced in Teleport's `tls_ca_file` option (see [Configuring Auth Service
+  instances to use etcd](#configuring-auth-service-instances-to-use-etcd)
+  below).
+- `tls-setup/certs/peer-*` files are used internally by etcd for communicating
+  between nodes.
+- `tls-setup/certs/<host>.pem` and `tls-setup/certs/<host>-key.pem` are the
+  host certificates and their corresponding private keys. Each corresponding
+  etcd host needs to know them, and they are required for providing transport
+  security on the etcd side.
+
+This should be enough to configure mTLS on etcd side.
+
+On the Teleport side, you need to configure client certificates. Here's one way
+to do it:
+
+1. Generate a default CSR:
+   ```code
+   $ cfssl print-defaults csr > client.json`
+   ```
+
+1. Remove all hostnames from the hosts element of the `client.json` file, as
+   this CSR doesn't represent any host, but a client. Also customize any other
+   options if required.
+
+1. For each Auth Service instance, generate the client certificate:
+   ```code
+   $ cfssl gencert -ca=certs/ca.pem \
+     -ca-key=certs/ca-key.pem \
+     -config=config/ca-config.json -profile=client client.json \
+     | cfssljson -bare certs/client
+   ```
+   This assumes that the `tls-setup` tool has been previously run and generated
+   the `certs/ca.pem` and `certs/ca-key.pem` files.
+
+   The following files will be generated:
+
+   - `certs/client.pem`, which will be referenced by the `tls_cert_file` option
+     in Teleport configuration file.
+   - `certs/client-key.pem` which will be referenced by the `tls_key_file`
+     option in Teleport configuration file.
+   
+   Upload these files to the corresponding Auth Service instance, along with
+   `certs/ca.pem`.
+ 
+After generating all the keys and certificates, run etcd using some variation
+of this command, replacing <Var name="etcd-host"/> with your etcd hostname:
+
+```code
+$ etcd --cert-file=certs/host.pem \
+  --key-file=certs/host-key.pem \
+  --client-cert-auth \
+  --trusted-ca-file=certs/ca.pem \
+  --peer-cert-file=certs/peer-host.pem \
+  --peer-cert-file=certs/peer-host-key.pem \
+  --advertise-client-urls=https://<Var name="etcd-host"/>:2379 --listen-client-urls=https://<Var name="etcd-host"/>:2379
+  # ... other applicable options
+ ```
+
+### Configuring Auth Service instances to use etcd
+
+Put these settings into the configuration file of all Auth Service instances:
+
 ```yaml
 teleport:
   storage:
@@ -139,20 +217,19 @@ teleport:
      # List of etcd peers to connect to:
      peers: ["https://172.17.0.1:4001", "https://172.17.0.2:4001"]
 
-     # Required path to TLS client certificate and key files to connect to etcd.
+     # Required path to TLS client certificate and key files to connect to
+     # etcd.
      #
-     # To create these, follow
-     # https://coreos.com/os/docs/latest/generate-self-signed-certificates.html
-     # or use the etcd-provided script
-     # https://github.com/etcd-io/etcd/tree/master/hack/tls-setup.
+     # If you used cfssl as described above, these should be the
+     # certs/client.pem and certs/client-key.pem files from the previous steps.
      tls_cert_file: /var/lib/teleport/etcd-cert.pem
      tls_key_file: /var/lib/teleport/etcd-key.pem
 
      # Optional file with trusted CA authority
      # file to authenticate etcd nodes
      #
-     # If you used the script above to generate the client TLS certificate,
-     # this CA certificate should be one of the other generated files
+     # If you used the tls-setup script, this CA certificate should be the
+     # certs/ca.pem file.
      tls_ca_file: /var/lib/teleport/etcd-ca.pem
 
      # Alternative password-based authentication, if not using TLS client
@@ -184,6 +261,45 @@ teleport:
      etcd_max_client_msg_size_bytes: 15728640
 ```
 
+### Disk sizing, compaction and defragmentation
+
+For large-scale deployments, plan for high write throughput and allocate sufficient storage to meet the history retention requirements.
+
+A rule of thumb for minimum storage size (excluding metadata) is:
+```
+minimum_storage ≈ backend_resource_count * average_record_size * auto_compaction_retention
+```
+
+- `backend_resource_count`: the total number of resources including replicas.
+- `average_record_size`: the average size (in bytes) of a resource.
+- `auto_compaction_retention`: the maximum number of revisions per item.
+
+Auto-compaction based on revision count is strongly recommended.
+Note that physical disk space is not reclaimed during compaction. To recover space, schedule regular defragmentation
+based on available disk space and write throughput.
+
+Use `etcd_mvcc_db_total_size_in_bytes` and `etcd_mvcc_db_total_size_in_use_in_bytes` metrics to tune as needed.
+
+Refer to [etcd's maintenance guide](https://etcd.io/docs/v3.6/op-guide/maintenance/) for auto-compaction and defragmentation.
+
+#### Example disk sizing
+
+For a cluster with 50k resources, with average size of 2 KiB and retention history of 5 revisions we would expect
+the dataset to be at least:
+
+```
+50000 * 2 KiB * 5 ≈ 488 MiB
+```
+
+An additional 20-40% safety margin is recommended for metadata and fragmentation overhead.
+
+Given an existing resource you can estimate its size with the following command,
+assigning <Var name="resource" /> to the resource name, e.g., `role/editor`:
+
+```code
+tctl get <Var name="resource" /> --format=json | awk '{ total += length($0) } END { print total * 2 }'
+```
+
 ## PostgreSQL
 
 PostgreSQL cluster state and audit log storage is available starting from
@@ -309,7 +425,7 @@ teleport:
     # use a different user or different settings for the connection used
     # to set up and make use of logical decoding. If specified, Teleport
     # will use the connection string in change_feed_conn_string for that,
-    # instead of the one in conn_string. Available in Teleport 13.4 and later.
+    # instead of the one in conn_string.
     change_feed_conn_string: postgresql://replication_user_name@database-address/teleport_backend?sslmode=verify-full
 
     # An audit_events_uri with a scheme of postgresql:// will use the
@@ -1002,7 +1118,6 @@ the following Terraform script:
 
 To configure Teleport to use Athena:
 
-- Make sure you are using **Teleport version 14.0.0** or newer.
 - Prepare infrastructure
 - Specify an Athena URL inside the `audit_events_uri` array in your Teleport
   configuration file:
@@ -1218,7 +1333,7 @@ instance with a disk size at least 2x bigger than the table size in Amazon
 DynamoDB.
 
 Instructions for how to use the migration tool can be found
-[on GitHub](https://github.com/gravitational/teleport/blob/master/examples/dynamoathenamigration/README.md).
+[on GitHub](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/dynamoathenamigration/README.md).
 
 You should set `exportTime` to the time when dual writing began.
 
@@ -1520,7 +1635,7 @@ teleport:
     # conn_string is a required parameter. It is a PostgreSQL connection string used
     # to connect to CockroachDB using the PostgreSQL wire protocol. Client
     # parameters may be specified using the URL. For a detailed list of available
-    # parameters see https://www.cockroachlabs.com/docs/stable/connection-parameter
+    # parameters see https://www.cockroachlabs.com/docs/v25.3/connection-parameters.html
     #
     # If your certificates are not stored at the default ~/.postgresql
     # location, you will need to specify them with the sslcert, sslkey, and
diff --git a/docs/pages/reference/config.mdx b/docs/pages/reference/deployment/config.mdx
similarity index 86%
rename from docs/pages/reference/config.mdx
rename to docs/pages/reference/deployment/config.mdx
index a6fbf0f0f2bf7..914cf92f4ef1f 100644
--- a/docs/pages/reference/config.mdx
+++ b/docs/pages/reference/deployment/config.mdx
@@ -1,9 +1,11 @@
 ---
-title: Teleport Configuration
-h1: Teleport Configuration Reference
+title: Teleport Configuration Reference
+sidebar_label: Teleport Configuration
 description: The detailed guide and reference documentation for configuring Teleport for SSH and Kubernetes access.
 keywords: [config, file, reference, yaml, etc]
-tocDepth: 3
+tags:
+ - reference
+ - platform-wide
 ---
 
 Teleport uses the YAML file format for configuration. A full configuration
@@ -31,7 +33,7 @@ $ teleport configure -o file
 
 There are also `configure` commands available for the SSH Service and Database
 Service. See our documentation on `teleport node configure` and `teleport db
-configure` in the [Teleport CLI Reference](cli/teleport.mdx).
+configure` in the [Teleport CLI Reference](../cli/teleport.mdx).
 
 <Admonition type="warning">
 
@@ -69,6 +71,7 @@ Teleport supports the following services:
 |SSH Service|`ssh_service`|✅|
 |Desktop Service|`windows_desktop_service`|❌|
 |Jamf Service|`jamf_service`|❌|
+|Relay Service|`relay_service`|❌|
 |Debug Service|`debug_service`|✅|
 
 Teleport Cloud manages the Auth Service and Proxy Service for you. Instances of
@@ -100,10 +103,10 @@ These settings apply to any `teleport` instance:
 
 Further reading:
 - [Joining Services to a
-  Cluster](../enroll-resources/agents/agents.mdx):
+  Cluster](../../enroll-resources/agents/agents.mdx):
   Available join methods to help you configure `join_params`.
 - [Using a CA
-  Pin](../enroll-resources/agents/join-token.mdx):
+  Pin](../../enroll-resources/agents/join-token.mdx):
   When to assign a value to `ca_pin`.
 - [Teleport Metrics Reference](monitoring/monitoring.mdx): Data to collect using
   `diag_addr`.
@@ -137,18 +140,18 @@ to specify these configuration settings.
 Further reading:
 - [Storage Backends](backends.mdx) reference: instructions on configuring DynamoDB, S3, etcd, and other highly available
   backends.
-- [Passwordless](../admin-guides/access-controls/guides/passwordless.mdx): More
+- [Passwordless](../../zero-trust-access/authentication/passwordless.mdx): More
   information about the `passwordless` authentication option.
 - [Headless
-  WebAuthn](../admin-guides/access-controls/guides/headless.mdx): The
+  WebAuthn](../../zero-trust-access/authentication/headless.mdx): The
   `headless` authentication option.
-- [Single Sign-On](../admin-guides/access-controls/sso/sso.mdx): Configuring SSO
+- [Single Sign-On](../../zero-trust-access/sso/sso.mdx): Configuring SSO
   so you can configure Teleport to use a specific SSO authentication connector.
-- [Locking](../admin-guides/access-controls/guides/locking.mdx): Configuring the
+- [Locking](../../identity-governance/locking.mdx): Configuring the
   `locking_mode` option.
-- [Device Trust](../admin-guides/access-controls/device-trust/device-trust.mdx): Configuring
+- [Device Trust](../../identity-governance/device-trust/device-trust.mdx): Configuring
   the `device_trust` section.
-- [Recording Proxy Mode](architecture/session-recording.mdx): If you configure
+- [Recording Proxy Mode](../architecture/session-recording.mdx): If you configure
   Recording Proxy Mode, consider enabling `proxy_checks_host_keys`.
 
 ### SSH Service
@@ -161,9 +164,9 @@ These settings apply to the Teleport SSH Service:
 
 Further reading:
 - [Enhanced Session
-  Recording](../enroll-resources/server-access/guides/bpf-session-recording.mdx):
+  Recording](../../enroll-resources/server-access/guides/bpf-session-recording.mdx):
   Configuring `enhanced_recording`.
-- [PAM Integration](../enroll-resources/server-access/guides/ssh-pam.mdx):
+- [PAM Integration](../../enroll-resources/server-access/guides/ssh-pam.mdx):
   Configuring the `pam` section.
 
 ### Kubernetes Service
@@ -214,6 +217,16 @@ These settings apply to the Jamf Service:
 (!docs/pages/includes/config-reference/jamf-service.yaml!)
 ```
 
+### Relay Service
+
+The Relay Service is available in Teleport v18.3.0 and later.
+
+These settings apply to the Relay Service:
+
+```yaml
+(!docs/pages/includes/config-reference/relay-service.yaml!)
+```
+
 ### Debug Service
 
 These settings apply to the Debug Service
diff --git a/docs/pages/reference/deployment/deployment.mdx b/docs/pages/reference/deployment/deployment.mdx
new file mode 100644
index 0000000000000..44890b10bca49
--- /dev/null
+++ b/docs/pages/reference/deployment/deployment.mdx
@@ -0,0 +1,12 @@
+---
+title: Teleport Deployment References
+sidebar_label: Deploying Teleport
+description: Provides reference information for running Teleport on your infrastructure.
+---
+
+The Teleport deployment reference guides include comprehensive lists of options
+for managing a Teleport deployment, including the Auth Service, Proxy Service,
+and Teleport Agents. 
+
+<DocCardList />
+
diff --git a/docs/pages/reference/deployment/identity-security-config.mdx b/docs/pages/reference/deployment/identity-security-config.mdx
new file mode 100644
index 0000000000000..c00d1c1391ad5
--- /dev/null
+++ b/docs/pages/reference/deployment/identity-security-config.mdx
@@ -0,0 +1,41 @@
+---
+title: Teleport Identity Security Configuration
+sidebar_label: Identity Security Configuration
+description: The detailed guide and reference documentation for configuring Teleport Identity Security.
+keywords: [config, file, reference, yaml, etc]
+tags:
+ - identity-security
+---
+
+Teleport Identity Security uses the YAML file format for configuration. A full configuration
+reference file is shown below. This provides comments and all available options
+for `identity-security.yaml`.
+
+## Before using this reference
+
+<Admonition type="danger">
+
+Do not use this example configuration in production.
+
+</Admonition>
+
+You must edit your configuration file to meet the needs of your environment.
+Using a copy of the reference configuration will have unintended effects.
+
+## Reference configurations
+
+These example configurations include all possible configuration options in YAML
+format to demonstrate proper use of indentation.
+
+### Teleport Identity Security settings
+
+These settings apply the Teleport Identity Security process.
+
+```yaml
+(!docs/pages/includes/config-reference/identity-security.yaml!)
+```
+
+## Further reading
+
+- [Install Teleport Identity Security](../../identity-security/access-graph/access-graph.mdx): instructions on how to install Teleport Identity Security.
+- [Teleport Identity Security](../../identity-security/identity-security.mdx): instructions on how to use Teleport Identity Security.
diff --git a/docs/pages/reference/deployment/join-methods.mdx b/docs/pages/reference/deployment/join-methods.mdx
new file mode 100644
index 0000000000000..f7876b43500be
--- /dev/null
+++ b/docs/pages/reference/deployment/join-methods.mdx
@@ -0,0 +1,592 @@
+---
+title: Join Methods and Tokens
+description: Describes the different ways to configure a Teleport to join a cluster.
+keywords: [join, joining, token]
+tags:
+ - conceptual
+ - reference
+ - zero-trust
+---
+
+This guide explains the core concepts behind the Teleport joining process,
+references all supported join methods and classifies them based on their
+security properties. This guide does not explain step-by-step how to
+join an instance with each join method, but links to the relevant How-To
+guides when possible.
+
+<Admonition type="note" title="Prerequisite">
+You must be familiar with the [Teleport Core concepts](../../core-concepts.mdx)
+before reading this page.
+</Admonition>
+
+## Definitions
+
+### Joining
+
+Joining a Teleport cluster is the act of establishing trust between a new
+Teleport instance and all the existing instances already part of the Teleport
+cluster. At the end of the joining process, the Auth Service signs certificates
+for the joining instance. Those certificates represent the trust that was
+established. With them, the newly-joined instance can interact with the
+other Teleport instances.
+
+To request its certificates, an instance must prove its identity to the Auth Service.
+Teleport offers multiple ways for a joining instance to prove its authenticity, they
+are called the join methods.
+
+The joining process only happens when a Teleport service doesn't have valid
+certificates. Once the token is exchanged for certificates, those
+certificates are used on all subsequent attempts to connect. In most cases,
+this happens during the first startup.
+
+### Join methods
+
+A join method is a way for the Auth Service to validate that an instance requesting to
+join the Teleport cluster is legitimate. Some join methods are universal while
+others rely on the joining instance context. For example cloud-provider
+join-methods (such as `iam`, `gcp` or `azure`) or CI-provider (such as `github`,
+`gitlab`, `circleci`) are more flexible and provide
+better security guarantees but require the joining instance to run in a specific
+cloud-provider.
+
+Different join methods may provide different security guarantees. e.g. some
+join methods allow the joining instance to request renewable certificates while other
+will require the instance to join again to renew its certificate.
+
+The join method and its parameters are specified in the token resource.
+
+### Token
+
+A Token is a Teleport resource that specifies which join method can be used in
+which context. For example, a token can allow SSH services to join with the
+`iam` join method if they are in the AWS account `333333333333` and can assume
+the role `teleport-instance-role`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: my-iam-token
+spec:
+  roles: [Node]
+  join_method: iam
+  allow:
+  - aws_account: "333333333333"
+    aws_arn: "arn:aws:sts::333333333333:assumed-role/teleport-instance-role/i-*"
+```
+
+<Admonition type="important">
+The token name may, or may not be sensitive depending on the join method.
+Secret-based join methods rely on the token name to be secret. In such
+cases the token name must be protected as knowing the token name in enough
+for an instance to join the cluster.
+</Admonition>
+
+## Classification of join methods
+
+### Secret vs delegated
+
+#### Secret-based join methods
+
+Secret-based join methods are universal: Teleport service can use a secret-based
+join method regardless of the platform/cloud provider it runs on. The joining instance
+sends the secret and the Auth Service validates that it matches the one it
+knows. Those joining methods are inherently prone to secret exfiltration and
+the delegated join methods should be preferred when available. If you have
+to use a secret-based join method, it is recommended to use short-lived tokens
+(valid only 1 hour for example) to reduce the risk of the token leaking.
+
+Secret-based join methods are:
+- [ephemeral `token`](#ephemeral-tokens)
+- [static `token`](#static-tokens)
+
+<Admonition type="warning">
+Teleport supports static tokens for backward compatibility, their use should be avoided.
+</Admonition>
+
+#### Delegated join methods
+
+Delegated join methods rely on the context of the joining instance and a third party to
+establish trust. The third party can be a cloud provider, a CI platform or the
+container runtime. Those methods cannot be used for every instance (e.g. joining an SSH
+agent from a Raspberry Pi is not possible) but should be preferred when possible.
+
+Delegated join methods might also offer more granularity. For example, cloud-provider
+based join methods can allow instances to join based on their Availability Zone,
+service account, or cloud account ID.
+
+Delegated join methods are:
+- [`azure`](#azure-managed-identity-azure)
+- [`azure_devops`](#azure-devops-azure_devops)
+- [`bitbucket`](#bitbucket-pipelines-bitbucket)
+- [`bound_keypair`](#bound-keypair-bound_keypair)
+- [`circleci`](#circleci-circleci)
+- [`ec2`](#aws-ec2-identity-document-ec2)
+- [`env0`](#env0-env0)
+- [`gcp`](#gcp-service-account-gcp)
+- [`github`](#github-actions-github)
+- [`gitlab`](#gitlab-gitlab)
+- [`iam`](#aws-iam-role-iam)
+- [`kubernetes`](#kubernetes-kubernetes)
+- [`oracle`](#oracle-cloud-oracle)
+- [`spacelift`](#spacelift-spacelift)
+- [`terraform_cloud`](#terraform-cloud-terraform_cloud)
+- [`tpm`](#trusted-platform-module-tpm)
+
+### Renewable vs non-renewable
+
+Depending on the join method used, the Auth Service might issue renewable
+or non-renewable certificates.
+
+When the certificate is about to expire, instances with renewable certificates can
+request a new one without having to use a token again. Typically, secret-based join methods
+provide renewable certificates because the secret token is sensitive and typically
+short-lived. With a single join, the instance can stay part of the cluster indefinitely.
+
+Renewable join-methods are:
+- [ephemeral `token`](#ephemeral-tokens)
+- [static `token`](#static-tokens)
+- [`ec2`](#aws-ec2-identity-document-ec2)
+- [`bound_keypair`](#bound-keypair-bound_keypair)
+
+Nodes with non-renewable certificates must join again in order to get a new
+certificate before expiry. The instance will have to prove again that it is legitimate.
+The non-renewable join methods guarantee that an attacker stealing the instance
+certificates will not be able to maintain access to the Teleport cluster.
+Those join methods can be considered more secure and more appropriate for
+temporary workloads such as CI/CD pipelines or containerized environments.
+
+Non-renewable join methods are:
+- [`iam`](#aws-iam-role-iam)
+- [`azure`](#azure-managed-identity-azure)
+- [`azure_devops`](#azure-devops-azure_devops)
+- [`env0`](#env0-env0)
+- [`gcp`](#gcp-service-account-gcp)
+- [`github`](#github-actions-github)
+- [`circleci`](#circleci-circleci)
+- [`gitlab`](#gitlab-gitlab)
+- [`kubernetes`](#kubernetes-kubernetes)
+- [`tpm`](#trusted-platform-module-tpm)
+
+## Token resource reference
+
+The token resource has the following common fields for all join methods:
+
+```yaml
+# token.yaml
+kind: token
+version: v2
+metadata:
+  name: my-token-name
+spec:
+  # System roles describe what services the joining Teleport instance can run.
+  # Those roles are written on the instance certificate. If you want to change
+  # them (e.g. add Application access to an SSH Node), you need to:
+  # - edit the token to update the roles (e.g. add "App")
+  # - un-register the Teleport instance
+  # - modify its configuration to enable the new service (here "app_service.enabled")
+  # - have the instance join again
+  #
+  # You should use the minimal set of system roles required.
+  # Common roles are:
+  # - "Node" for SSH Service
+  # - "Proxy" for Proxy Service
+  # - "Kube" for Kubernetes Service
+  # - "App" for Application Service
+  # - "Db" for Database Service
+  # - "WindowsDesktop" for Windows Desktop Service
+  # - "Discovery" for Discovery Service
+  # - "Bot" for Machine & Workload Identity (when set, "spec.bot_name" must be set in the token)
+  roles:
+    - Node
+    - App
+  join_method: gcp
+  # Only set bot name when the token is used for Machine & Workload Identity.
+  # When set, the token must have the "Bot" role as well.
+  bot_name: my-bot
+  # SuggestedLabels is a set of labels that resources should set when using this
+  # token to enroll themselves in the cluster.
+  # Currently, only node-join scripts create a configuration according to the suggestion.
+  suggested_labels:
+    teams: ["sales-eng", "eng", "qa"]
+    application: ["demo-product"]
+  # SuggestedAgentMatcherLabels is a set of labels to be used by discovery agents to match on resources.
+  # When an agent uses this token, the agent should monitor resources that match those labels.
+  # For databases, this means adding the labels to `db_service.resources.labels`.
+  # Currently, only node-join scripts create a configuration according to the suggestion.
+  suggested_agent_matcher_labels:
+    teams: ["sales-eng"]
+```
+
+## Join methods
+
+### Static tokens
+
+<Admonition type="danger">
+This join method is inherently less secure because long-lived tokens can be stolen and reused.
+Relying on it significantly reduces the security benefits of using Teleport. Its usage is strongly discouraged.
+You should use [ephemeral tokens](#ephemeral-tokens) instead.
+</Admonition>
+
+Static tokens are tokens defined in the Auth Service configuration (`teleport.yaml`).
+The token name must be kept secret as knowing it allows to join instances to
+the Teleport cluster.
+
+```yaml
+auth_service:
+    enabled: true
+    # Pre-defined tokens for adding new instances to a cluster. Each token specifies
+    # the role a new node will be allowed to assume. The more secure way to
+    # add instances is to use `tctl nodes add --ttl` command to generate auto-expiring
+    # tokens.
+    #
+    # We recommend to use tools like `pwgen` to generate sufficiently random
+    # tokens of 32+ byte length.
+    tokens:
+        - "proxy,node:xxxxx"
+        - "auth:yyyy"
+        - "discovery,app,db:zzzzz"
+```
+
+### Ephemeral tokens
+
+Ephemeral tokens are secret tokens created dynamically via the CLI or Teleport API.
+They are time-bound and are typically created just before joining an instance to
+the Teleport cluster.
+
+They can be created by the CLI (a strong random value is picked when not specified, default TTL is 30 minutes):
+```code
+$ tctl tokens add --type discovery,app --ttl 15m
+```
+
+Or as Teleport resources:
+
+(!docs/pages/includes/provision-token/ephemeral-spec.mdx!)
+
+When a Machine & Workload Identity Bot uses an ephemeral join token, the token is deleted.
+
+<Admonition type="tip" title="Upgrade to Bound Keypair">
+New Bot deployments should consider upgrading to the
+[`bound_keypair` join method](#bound-keypair-bound_keypair).
+</Admonition>
+
+<Admonition type="note" title="See Also">
+- How to [Join Services with a Secure Token](../../enroll-resources/agents/join-token.mdx).
+- [Deploying Machine & Workload Identity on Linux](../../machine-workload-identity/deployment/linux.mdx)
+</Admonition>
+
+### Bound Keypair: `bound_keypair`
+
+Bound Keypair tokens are an alternative to
+[secret-based join methods](#secret-based-join-methods) for Machine and Workload
+ID bots that improve security and flexibility. They are best used on platforms
+with persistent storage, but can be configured for use in nearly any
+environment.
+
+This join method is recommended for on-prem environments
+[without TPMs](#trusted-platform-module-tpm) or cloud platforms
+without a specialized [delegated join method](#delegated-join-methods).
+
+At this time, `bound_keypair` can only be used to join Machine and Workload ID
+bots, and cannot be used to join other Teleport agent types.
+
+(!docs/pages/includes/provision-token/bound-keypair-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity with Bound Keypair joining](../machine-workload-identity/bound-keypair/getting-started.mdx)
+- [Bound Keypair Reference](../machine-workload-identity/bound-keypair/bound-keypair.mdx)
+</Admonition>
+
+### AWS IAM role: `iam`
+
+The IAM join method is available to any Teleport process running anywhere with access to IAM credentials,
+such as an EC2 instance with an attached IAM role. No specific permissions or IAM policy is required: an
+IAM role with no attached policies is sufficient. No IAM credentials are required on the Teleport Auth Service.
+
+This is the recommended method to join workload running on AWS.
+
+(!docs/pages/includes/provision-token/iam-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Joining Services via AWS IAM Role](../../enroll-resources/agents/aws-iam.mdx).
+- [Deploying Machine & Workload Identity on AWS](../../machine-workload-identity/deployment/aws.mdx)
+</Admonition>
+
+### AWS EC2 identity document: `ec2`
+
+The EC2 join method is available to any Teleport process running on an EC2
+instance. Only one Teleport process per EC2 instance may use the EC2 join
+method.
+
+IAM credentials with `ec2:DescribeInstances` permissions are required on your
+Teleport Auth Service. No IAM credentials are required on the Teleport processes
+joining the cluster.
+
+<Admonition type="warning">
+
+The EC2 join method is not available in Teleport Enterprise Cloud and Teleport
+Team. Teleport Enterprise Cloud and Team customers can use the [IAM join
+method](#aws-iam-role-iam) or [ephemeral secret tokens](#ephemeral-tokens).
+
+</Admonition>
+
+(!docs/pages/includes/provision-token/ec2-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+[Joining Services via AWS EC2 Identity Document](../../enroll-resources/agents/aws-ec2.mdx).
+</Admonition>
+
+### Azure managed identity: `azure`
+
+The Azure join method is available to any Teleport process running in an
+Azure Virtual Machine.
+
+(!docs/pages/includes/provision-token/azure-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Joining Services via Azure Managed Identity](../../enroll-resources/agents/azure.mdx).
+- [Deploying Machine & Workload Identity on Azure](../../machine-workload-identity/deployment/azure.mdx)
+</Admonition>
+
+### Azure Devops: `azure_devops`
+
+The Azure DevOps is available to any Teleport process running in an Azure DevOps
+pipeline. This join method is typically used with
+[Machine & Workload Identity](../../machine-workload-identity/introduction.mdx)
+to access Teleport-protected resources in Azure DevOps pipelines without the
+use of long-lived secrets.
+
+(!docs/pages/includes/provision-token/azure-devops-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Azure DevOps](../../machine-workload-identity/deployment/azure-devops.mdx)
+</Admonition>
+
+### Env0: `env0`
+
+The Env0 join method is available to workloads running in the Env0 cloud
+environment. The "Enable OIDC during deployments" option must be enabled for
+tokens to be issued into runner environments.
+
+This join method is typically used by the Teleport Terraform provider to
+authenticate to Teleport from the Env0 cloud environment. It cannot be used to
+join Terraform runs on other platforms and dedicated join methods should be used
+instead.
+
+The `env0` join method requires Teleport v18.4.0 or later.
+
+(!docs/pages/includes/provision-token/env0-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Run the Teleport Terraform Provider on Env0](../../zero-trust-access/infrastructure-as-code/terraform-provider/env0.mdx)
+</Admonition>
+
+### GCP service account: `gcp`
+
+The GCP join method is available to any Teleport process running on a GCP VM.
+The VM must have a
+[service account](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
+assigned to it (the default service account is fine). No IAM roles are required
+on the Teleport process joining the cluster.
+
+(!docs/pages/includes/provision-token/gcp-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- How to [Join Services with GCP](../../enroll-resources/agents/gcp.mdx).
+- [Deploying Machine & Workload Identity on GCP](../../machine-workload-identity/deployment/gcp.mdx)
+</Admonition>
+
+### GitHub Actions: `github`
+
+Teleport supports secure joining on both GitHub-hosted and self-hosted GitHub
+Actions runners as well as GitHub Enterprise Server. This join method is
+typically used with [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx) to access
+Teleport-protected resources in GitHub Actions pipelines.
+
+(!docs/pages/includes/provision-token/github-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on GitHub Actions](../../machine-workload-identity/deployment/github-actions.mdx)
+</Admonition>
+
+#### GitHub Actions helpers
+
+We offer a series of off-the-shelf GitHub Actions to use in your workflows when
+utilizing Teleport Machine & Workload Identity and GitHub Actions.
+
+More information about these individual actions can be found in their GitHub
+repositories:
+
+- [https://github.com/teleport-actions/setup](https://github.com/teleport-actions/setup)
+- [https://github.com/teleport-actions/auth](https://github.com/teleport-actions/auth)
+- [https://github.com/teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
+- [https://github.com/teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
+
+If you experience problems when using these actions, please raise an issue in
+their source repository:
+[https://github.com/teleport-actions/root](https://github.com/teleport-actions/root).
+
+### CircleCI: `circleci`
+
+This join method is typically used with [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx)
+to access Teleport-protected resources in Circle CI pipelines.
+
+(!docs/pages/includes/provision-token/circleci-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Circle CI](../../machine-workload-identity/deployment/circleci.mdx)
+</Admonition>
+
+### GitLab: `gitlab`
+
+Teleport supports secure joining on both cloud-hosted and self-hosted GitLab
+instances. **The minimum supported GitLab version is 15.7**.
+
+This join method is typically used with [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx)
+to access Teleport-protected resources in Gitlab CI pipelines.
+
+(!docs/pages/includes/provision-token/gitlab-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on GitLab CI](../../machine-workload-identity/deployment/gitlab.mdx)
+</Admonition>
+
+### Kubernetes: `kubernetes`
+
+The Kubernetes join methods exists in three variants:
+- [in-cluster](#kubernetes-in-cluster)
+- [JWKS](#kubernetes-jwks)
+- [OIDC](#kubernetes-oidc)
+
+#### Kubernetes In-cluster
+
+Kubernetes in-cluster joining is available for any Teleport process running
+in the same Kubernetes cluster than the Auth Service. It uses the Kubernetes
+ServiceAccount tokens to validate the pod identity. The method relies on the
+[Kubernetes TokenReview API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-review-v1/)
+which is typically only reachable from within the Kubernetes cluster. Because of
+this limitation, this join method is only available for self-hosted Teleport
+clusters in Kubernetes.
+
+This method should be preferred when available as tokens are revoked as soon as
+the pod enters the `Terminated` state.
+
+(!docs/pages/includes/provision-token/kubernetes-in-cluster-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Joining Services via Kubernetes ServiceAccount Token](../../enroll-resources/agents/kubernetes.mdx)
+</Admonition>
+
+#### Kubernetes JWKS
+
+Kubernetes JWKS joining is available for any Teleport process running in
+Kubernetes. The Auth Service does not have to run in Kubernetes so this method
+can be used with any Teleport cluster, including Teleport Cloud.
+This join method works by exporting the public Kubernetes signing keys and using
+them to validate Kubernetes SA token signatures. The signature validation can be
+performed by an Auth Service without access to the Kubernetes.
+
+(!docs/pages/includes/provision-token/kubernetes-jwks-spec.mdx!)
+
+<Admonition type="warning">
+After rotating the Kubernetes CA, you must update the Kubernetes JWKS tokens
+to contain the new Kubernetes signing keys (update the
+`spec.kubernetes.static_jwks.jwks` field).
+</Admonition>
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Kubernetes](../../machine-workload-identity/deployment/kubernetes.mdx)
+</Admonition>
+
+#### Kubernetes OIDC
+
+Kubernetes OIDC joining is available for any Teleport process running in
+Kubernetes where the cluster issues service account tokens from a publicly
+accessible, OIDC-compliant issuer.
+
+This feature makes use of the Kubernetes
+[Service Account Issuer Discovery][discovery] feature, added in Kubernetes 1.21,
+to verify Kubernetes workloads. Note that some providers, like Amazon EKS, may
+require additional configuration to enable OIDC joining.
+
+Unlike the `static_jwks` variant described above, this method fetches JWKS keys
+from the upstream provider dynamically and does not need to be reconfigured if
+keys are rotated, which providers like EKS do frequently. However, not all
+Kubernetes implementations have accessible OIDC endpoints.
+
+<Admonition type="tip" title="Supported Teleport Version">
+To use Kubernetes OIDC joining, your Teleport cluster must be running at least
+version 18.1.5.
+</Admonition>
+
+(!docs/pages/includes/provision-token/kubernetes-oidc-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Kubernetes with OIDC](../../machine-workload-identity/deployment/kubernetes-oidc.mdx)
+</Admonition>
+
+### Trusted Platform Module: `tpm`
+
+(!docs/pages/includes/tpm-joining-background.mdx!)
+
+(!docs/pages/includes/provision-token/tpm-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Linux: TPM](../../machine-workload-identity/deployment/linux-tpm.mdx)
+</Admonition>
+
+### Terraform Cloud: `terraform_cloud`
+
+This join method is used to authenticate using Terraform Cloud Workload
+Identity. It is typically used by the Teleport Terraform provider on either
+HCP Terraform or self-hosted Terraform Enterprise. It can not be used to join
+Terraform runs on other platforms and dedicated join methods should be used
+instead.
+
+<Admonition type="warning" title="Enterprise">
+Support for self-hosted Terraform Enterprise requires Teleport Enterprise.
+</Admonition>
+
+(!docs/pages/includes/provision-token/terraform-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Run the Teleport Terraform Provider on Terraform Cloud](../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud.mdx)
+</Admonition>
+
+### Spacelift: `spacelift`
+
+This join method is used to authenticate using Spacelift. It is typically used
+by the Teleport Terraform provider on Spacelift (including self-hosted
+deployments).
+
+(!docs/pages/includes/provision-token/spacelift-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+    - [Run the Teleport Terraform Provider on Spacelift](../../zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx)
+</Admonition>
+
+### Bitbucket Pipelines: `bitbucket`
+
+This join method is used to authenticate using Bitbucket's support for OpenID
+Connect, and is typically used to allow either Machine & Workload Identity's
+`tbot` or the Teleport Terraform provider to authenticate to Teleport without
+use of shared secrets.
+
+(!docs/pages/includes/provision-token/bitbucket-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- [Deploying Machine & Workload Identity on Bitbucket Pipelines](../../machine-workload-identity/deployment/bitbucket.mdx)
+</Admonition>
+
+### Oracle Cloud: `oracle`
+
+The Oracle join method is available to any Teleport process running on an Oracle
+Cloud Compute instance.
+
+(!docs/pages/includes/provision-token/oracle-spec.mdx!)
+
+<Admonition type="note" title="See Also">
+- How to [Join Services with Oracle Cloud](../../enroll-resources/agents/oracle.mdx).
+</Admonition>
+
+[discovery]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery
diff --git a/docs/pages/reference/deployment/managed-updates-v2.mdx b/docs/pages/reference/deployment/managed-updates-v2.mdx
new file mode 100644
index 0000000000000..2f222deb42edd
--- /dev/null
+++ b/docs/pages/reference/deployment/managed-updates-v2.mdx
@@ -0,0 +1,281 @@
+---
+title: Managed Updates Resource Reference
+sidebar_label: Managed Updates Resources
+description: This page describes the details of the Managed Updates v2 resources.
+tags:
+ - reference
+ - platform-wide
+---
+
+This document provides detailed reference information about the Managed Updates v2 resources.
+See also:
+- the [Managed Updates Architecture](../architecture/agent-update-management.mdx) describing the agent update
+  architecture and security invariants.
+- the [Managed Updates Guide](../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for more details on how to
+  set up Managed updates.
+
+## Managed Updates v2 resources
+
+### User facing
+
+Managed Updates are configured via two user-facing resources:
+
+#### `autoupdate_config`
+
+This describes how and when updates are applied. Configuration changes take effect during the next rollout.
+
+(!docs/pages/includes/reference/resources/autoupdate_config.mdx!)
+
+#### `autoupdate_version`
+
+This specifies which version agents should update to.
+Changing the start or target version creates a new rollout.
+
+<Admonition type="note">
+This resource is not editable for cloud-managed Teleport Enterprise to ensure that all of
+your clients receive security patches and remain compatible with your cluster.
+</Admonition>
+
+(!docs/pages/includes/reference/resources/autoupdate_version.mdx!)
+
+### System resources
+
+Those resources are generated automatically by Teleport. Users should not edit them, reading them can be helpful to
+track the autoupdate state and understand Teleport's update decisions.
+
+These resources only track Teleport Agent installations.
+However, if tbot is deployed alongside a Teleport Agent, a tbot update failure will cause the agent update to revert,
+and the agent update will be marked as failed.
+
+#### `autoupdate_agent_rollout`
+
+`autoupdate_agent_rollout` describes the rollout of the version across agent groups.
+A single rollout is active at a time. Each Auth Service updates the rollout every minute.
+
+(!docs/pages/includes/reference/resources/autoupdate_agent_rollout.mdx!)
+
+#### `autoupdate_agent_report`
+
+Reports how many agents are connected to each auth, and which version they are running.
+This is used to track update progress and automatically progress the rollout.
+Each Teleport Auth Service instance generate one report evert minute.
+
+Agents are counted in the report only if:
+- they are connected for at least a minute
+- they are automatically updating with `teleport-update`
+  (`teleport-kube-agent` updater support will be included in a future version)
+- managed updates are enabled (the updater is not disabled or pinned to a specific version)
+
+Due to the reporting period, an agent can take up to 2 minutes to appear in the
+reports, and 3 minutes to appear in the rollout:
+- 1 minute for the agent to be counted as healthy
+- 1 minute for the next report to be generated
+- 1 minute for the next `autoupdate_agent_rollout` update
+
+(!docs/pages/includes/reference/resources/autoupdate_agent_report.mdx!)
+
+Reports can be individually seen using `tctl get autoupdate_agent_reports`.
+To aggregate every report into a single one, run `tctl autoupdate agents report`.
+
+### Agent Update Overview
+
+Here's a schema describing the interactions between the different Managed Updates v2 components when updating agents:
+
+![Schema describing the relations between every resource](../../../img/architecture/managed-updates-v2.svg)
+
+## Update Strategies
+
+The `autoupdate_config` resource supports two different strategies for managing how updates propagate across your agent groups:
+
+### `halt-on-error` Strategy
+
+The `halt-on-error` strategy provides predictable, sequential updates across environments. It's ideal for traditional development pipelines where you want to ensure that development environments are successfully updated before proceeding to staging and production.
+
+**Key characteristics:**
+
+- Updates proceed sequentially through groups in the order they are defined
+- If an earlier group fails to update, later groups will not be updated
+- Provides a controlled, predictable update path
+- Groups with a `wait_hours` parameter will wait the specified duration after the previous group's successful update
+
+**Example configuration:**
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+    schedules:
+      regular:
+        - name: dev
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 16
+        - name: stage
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 18
+        - name: prod
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 20
+          wait_hours: 24
+```
+
+In this example, the `dev` group updates first, followed by `stage`, and finally `prod`. The `prod` group will only update if both `dev` and `stage` have updated successfully, and will wait 24 hours after `stage` has completed.
+
+### `time-based` Strategy
+
+The `time-based` strategy is designed for environments where update groups are independent of each other, such as geographical regions or different teams. It allows updates to occur whenever the specified maintenance window is active for a group, regardless of the status of other groups.
+
+**Key characteristics:**
+
+- Groups update independently during their configured maintenance windows
+- No dependency between groups - if prod's window occurs before dev's, prod will update first
+- Maintenance windows are strictly enforced - updates only occur during the specified window duration
+- Does not support the `wait_hours` parameter
+
+**Example configuration:**
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: time-based
+    maintenance_window_duration: 2h
+    schedules:
+      regular:
+        - name: us-east
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 4
+        - name: us-west
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 6
+        - name: europe
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 12
+```
+
+In this example, each region will update during its own 2-hour maintenance window,
+regardless of the status of other regions. If a new version becomes available
+when Europe's window is active but before US East's window, Europe will update first.
+
+## Version Behavior During Rollout
+
+Depending on which strategy is selected, the system behaves differently regarding which versions are installed at
+different points in the rollout. Consider a scenario where `start_version` is A and `target_version` is B:
+
+### `halt-on-error` Strategy Version Behavior
+
+This table summarizes which version an agent will install based on its group's maintenance window:
+
+| Timing                    | New Agent Installations | Existing Agent Updates |
+|---------------------------|-------------------------|------------------------|
+| Before maintenance window | Install version A       | No updates occur       |
+| During maintenance window | Install version B       | Update to version B    |
+| After maintenance window  | Install version B       | Update to version B    |
+
+In halt-on-error strategy, if the previous group is not done updating, the next one will not start.
+For example, if you have 2 groups:
+- `dev` updating everyday at 13:00
+- `prod` updating on weekdays at 15:00
+
+A group is considered updated once at least 90% of its agents are running the target version.
+The group initial agent count is measured when the group starts updating.
+
+<Admonition type="warning">
+In case of heavy downscale during the update window, the rollout will get stuck
+as the group agent count will never reach 90% of its initial value.
+
+In such case, Teleport cannot differentiate between agents that got legitimately
+downscaled and agents that might be unable to connect because of the new version.
+Agents will be considered missing and the rollout will require manual
+intervention to resume (`tctl autoupdate agents mark-done $GROUP_NAME`).
+</Admonition>
+
+If `dev` finishes updating Friday at 16:30, `prod` will not start updating immediately as update windows are
+1-hour-long and `prod`'s update window is over. `prod` update will start on Monday at 15:00.
+
+#### Canaries
+
+With the `halt-on-error` strategy, the `canary_count` field can be set on each group to specify
+a number of randomly selected agents (fewer than five) to update and verify before
+proceeding to the rest of the agents in the group. This can be used to reduce the impact
+of a failed update that might not be caught by earlier groups due to environment differences.
+
+**Key characteristics:**
+
+- Up to five Linux agent hosts are selected automatically and updated first.
+- If any canary fails to update, the group is marked as failed and not updated.
+- Subsequent groups will not be updated until the group successfully updates.
+- Kubernetes agents are not currently selected as canaries.
+- tbot-only installations are not selected as canaries, but agents may be deployed
+  alongside tbot to detect tbot update failures.
+
+**Example configuration:**
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+    schedules:
+      regular:
+        - name: stage
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 18
+          canary_count: 5
+        - name: prod
+          days: ["Mon", "Tue", "Wed", "Thu"]
+          start_hour: 20
+          wait_hours: 24
+          canary_count: 5
+```
+
+
+### `time-based` Strategy Version Behavior
+
+This table summarizes which version an agent will install based on its group's maintenance window:
+
+| Timing                    | New Agent Installations | Existing Agent Updates             |
+|---------------------------|-------------------------|------------------------------------|
+| Before maintenance window | Install version A       | No updates occur                   |
+| During maintenance window | Install version B       | Update to version B                |
+| After maintenance window  | Install version B       | No updates occur until next window |
+
+The key difference is what happens after the maintenance window closes:
+
+- With `halt-on-error`, agents update even if they missed the window to run the
+  same version as the other agents in their group.
+- With `time-based`, updates are strictly limited to the maintenance window duration.
+
+In time-based strategy, the group will start updating as soon as it enters its maintenance window,
+even if the previous group is not done updating yet.
+
+## Mode Precedence
+
+The `mode` field can be set in both `autoupdate_config` and `autoupdate_version` resources. The most restrictive mode takes precedence:
+
+1. `disabled` (most restrictive)
+2. `suspended`
+3. `enabled` (least restrictive)
+
+This allows different teams to manage the configuration and version resources independently while maintaining safety controls.
+
+## Cloud-specific Constraints
+
+For cloud-hosted Teleport Enterprise:
+
+- The `autoupdate_version` resource is managed automatically and cannot be edited
+- The `days` field in schedules is often not configurable 
+- The `start_hour` defaults to your selected maintenance window
+- A maximum of 5 update groups is allowed by default
+- A full update schedule cannot be longer than 4 days
+
+These constraints ensure that all agents are updated weekly and remain compatible with the Teleport cluster's version.
diff --git a/docs/pages/reference/deployment/monitoring/audit.mdx b/docs/pages/reference/deployment/monitoring/audit.mdx
new file mode 100644
index 0000000000000..2ec515c47f4ca
--- /dev/null
+++ b/docs/pages/reference/deployment/monitoring/audit.mdx
@@ -0,0 +1,291 @@
+---
+title: Audit Events and Records
+description: Reference of Teleport Audit Events and Session Records
+tags:
+ - conceptual
+ - platform-wide
+ - audit
+---
+
+Teleport logs cluster activity by emitting various events into its audit log.
+There are two components of the audit log:
+
+<Tabs>
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+
+- **Cluster Events:** Teleport logs events like successful user logins along
+   with metadata like remote IP address, time, and the session ID.
+- **Recorded Sessions:** Every SSH, desktop, or Kubernetes shell session is recorded and
+   can be replayed later. By default, the recording is done by Teleport Nodes,
+   but can be configured to be done by the proxy.
+
+</TabItem>
+<TabItem scope={["cloud","team"]} label="Cloud-Hosted">
+
+- **Cluster Events:** Teleport logs events like successful user logins along
+   with metadata like remote IP address, time, and the session ID.
+- **Recorded Sessions:** Every SSH, desktop, or Kubernetes shell session is recorded and
+   can be replayed later. Teleport Cloud manages the storage of session
+   recording data.
+
+</TabItem>
+</Tabs>
+
+<Admonition type="tip">
+
+You can use
+[Enhanced Session Recording with BPF](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx)
+to get even more comprehensive audit logs with advanced security.
+
+</Admonition>
+
+## Events
+
+<Tabs>
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+
+Teleport supports multiple storage backends for storing audit events. The `dir`
+backend uses the local filesystem of an Auth Service host. When this backend is
+used, events are written to the filesystem in JSON format. The `dir` backend rotates
+the event file approximately once every 24 hours, but never deletes captured events.
+
+For High Availability configurations, users can refer to our
+[Athena](../backends.mdx), [DynamoDB](../backends.mdx) or
+[Firestore](../backends.mdx) chapters for information on how to
+configure the SSH events and recorded sessions to be stored on network storage.
+When these backends are in use, audit events will eventually expire and be
+removed from the log. The default retention period is 1 year, but this can be
+overridden using the `retention_period` configuration parameter.
+
+It is even possible to store audit logs in multiple places at the same time. For
+more information on how to configure the audit log, refer to the `storage`
+section of the example configuration file in the
+[Teleport Configuration Reference](../config.mdx).
+
+Let's examine the Teleport audit log using the `dir` backend. Teleport Auth
+Service instances write their logs to a subdirectory of Teleport's configured
+data directory that is named based on the service's UUID.
+
+Each day is represented as a file:
+
+```code
+$ ls -l /var/lib/teleport/log/bbdfe5be-fb97-43af-bf3b-29ef2e302941
+
+# total 104
+# -rw-r----- 1 root root  31638 Jan 22 20:00 2022-01-23.00:00:00.log
+# -rw-r----- 1 root root  91256 Jan 31 21:00 2022-02-01.00:00:00.log
+# -rw-r----- 1 root root  15815 Feb 32 22:54 2022-02-03.00:00:00.log
+```
+
+</TabItem>
+<TabItem label="Cloud-Hosted">
+
+Teleport Enterprise Cloud manages the storage of audit logs for you. You can
+access your audit logs via the Teleport Web UI by clicking:
+
+**Audit** > **Audit Log**
+
+</TabItem>
+</Tabs>
+
+Audit logs use JSON format. They are human readable but can also be
+programmatically parsed. Each line represents an event and has the following
+format:
+
+```javascript
+{
+    // Event type. See below for the list of all possible event types.
+    "event": "session.start",
+    // A unique ID for the event log. Useful for  deduplication.
+    "uid": "59cf8d1b-7b36-4894-8e90-9d9713b6b9ef",
+    // Teleport user name
+    "user": "ekontsevoy",
+    // OS login
+    "login": "root",
+    // Server namespace. This field is reserved for future use.
+    "namespace": "default",
+    // Unique server ID
+    "server_id": "f84f7386-5e22-45ff-8f7d-b8079742e63f",
+    // Server Labels
+    "server_labels": {
+      "datacenter": "us-east-1",
+      "label-b": "x"
+    }
+    // Session ID. Can be used to replay the session.
+    "sid": "8d3895b6-e9dd-11e6-94de-40167e68e931",
+    // Address of the SSH node
+    "addr.local": "10.5.l.15:3022",
+    // Address of the connecting client (user)
+    "addr.remote": "73.223.221.14:42146",
+    // Terminal size
+    "size": "80:25",
+    // Timestamp
+    "time": "2017-02-03T06:54:05Z"
+}
+```
+
+## Event types
+
+Below are some possible types of audit events.
+
+<Admonition type="tip">
+
+This list is not comprehensive. We recommend exporting audit events to a
+platform that automatically parses event payloads so you can group and filter
+them by their `event` key and discover trends. To set up audit event exporting,
+read [Exporting Teleport Audit Events](../../../zero-trust-access/export-audit-events/export-audit-events.mdx).
+
+</Admonition>
+
+| Event Type | Description |
+| - | - |
+| auth | Authentication attempt. Adds the following fields: `{"success": "false", "error": "access denied"}` |
+| session.start | Started an interactive shell session. |
+| session.end | An interactive shell session has ended. |
+| session.join | A new user has joined the existing interactive shell session. |
+| session.leave | A user has left the session. |
+| session.disk | A list of files opened during the session. *Requires Enhanced Session Recording*. |
+| session.network | A list of network connections made during the session.  *Requires Enhanced Session Recording*. |
+| session.command | A list of commands ran during the session.  *Requires Enhanced Session Recording*. |
+| session.recording.access | A session recording has been accessed. |
+| exec | Remote command has been executed via SSH, like `tsh ssh root@node ls /`. The following fields will be logged: `{"command": "ls /", "exitCode": 0, "exitError": ""}` |
+| scp | Remote file copy has been executed. The following fields will be logged: `{"path": "/path/to/file.txt", "len": 32344, "action": "read" }` |
+| resize | Terminal has been resized. |
+| user.login | A user logged into web UI or via tsh. The following fields will be logged: `{"user": "alice@example.com", "method": "local"}` . |
+| app.session.start | A user accessed an application |
+| app.session.chunk | A record of activity during an app session |
+| join_token.create | A new join token has been created. Adds the following fields: `{"roles": ["Node", "Db"], "join_method": "token"}` |
+| mcp.session.start | An MCP server session has started. |
+| mcp.session.end | An MCP server session has ended. |
+| mcp.session.notification | A notification has been sent from the MCP client. |
+| mcp.session.request | A request has been sent from the MCP client. |
+| mcp.session.listen_sse_stream | Streamable HTTP client has started to listening server notifications via an SSE stream. |
+| mcp.session.invalid_http_request | The client has sent an HTTP request that Teleport could not process. |
+
+## Recorded sessions
+
+In addition to logging start and end events, Teleport can also record the entire session.
+For SSH or Kubernetes sessions this captures the entire stream of bytes from the PTY.
+For desktop sessions the recording includes the contents of the screen.
+
+<Tabs>
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+
+Teleport can store the recorded sessions in an [AWS S3 bucket](../backends.mdx)
+or in a local filesystem (including NFS).
+
+The recorded sessions are stored as raw bytes in the `sessions` directory under
+`log`. Each session is a protobuf-encoded stream of binary data.
+
+You can replay recorded sessions using the [`tsh play`](../../cli/tsh.mdx)
+command or the Web UI.
+
+For example, replay a session via CLI:
+
+```code
+$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931
+```
+
+Print the session events in JSON to stdout:
+
+```code
+$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931 --format=json
+```
+
+</TabItem>
+<TabItem label="Cloud-Hosted">
+
+Teleport Enterprise Cloud automatically stores recorded sessions.
+
+You can replay recorded sessions using the [`tsh play`](../../cli/tsh.mdx)
+command or the Web UI.
+
+For example, replay a session via CLI:
+
+```code
+$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931
+```
+
+Print the session events in JSON to stdout:
+
+```code
+$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931 --format=json
+```
+
+</TabItem>
+</Tabs>
+
+### Modes
+
+<Admonition type="note">
+Available only for SSH sessions and when Teleport is configured with
+`auth_service.session_recording: node`.
+</Admonition>
+
+Modes define how Teleport deals with recording failures, such as a full disk
+error. They are configured per-service at the role level, where the strictest
+value takes precedence. The available modes are:
+
+|Mode|After a recording failure|
+|----|-------------------------|
+|Best effort (`best_effort`)|Disables recording without terminating the session.|
+|Strict (`strict`)|Immediately terminates the session.|
+
+If the user role doesn’t specify a recording mode, `best_effort` will be used. Here
+is an example of a role configured to use strict mode for SSH sessions:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: ssh-strict
+spec:
+  options:
+    record_session:
+      ssh: strict
+```
+
+### Enable Recording Proxy Mode
+
+Edit the Auth Service configuration file as follows:
+ 
+```yaml
+# snippet from /etc/teleport.yaml
+auth_service:
+   # Session Recording must be set to Proxy to work with OpenSSH
+   session_recording: "proxy"  # can also be "off" and "node" (default)
+```
+
+<Admonition type="warning" >
+ 
+The use of Proxy Recording Mode across your cluster is no longer necessary to support
+[OpenSSH servers](../../../enroll-resources/server-access/openssh/openssh-agentless.mdx).
+Proxy Recording Mode is automatically used for OpenSSH servers without the need for SSH
+agent forwarding, which is the primary security concern for this mode.
+ 
+Recording Proxy Mode will continue to be supported for legacy OpenSSH support and other
+use cases, but many existing and new features will not be supported in this mode due
+to several technical limitations it introduces.
+ 
+</Admonition>
+
+#### Optional insecure step: Disable strict host checking
+ 
+When in Recording Proxy Mode, Teleport will check that the host certificate of any
+Node a user connects to is signed by a Teleport CA. By default, this is a strict
+check. If the Node presents just a key or a certificate signed by a different
+CA, Teleport will reject this connection with the error message:
+ 
+```text
+ssh: handshake failed: remote host presented a public key, expected a host
+certificate
+```
+ 
+You can disable strict host checks as shown below. However, this opens the
+possibility for Person-in-the-Middle attacks and is not recommended.
+ 
+```yaml
+# snippet from /etc/teleport.yaml
+auth_service:
+  proxy_checks_host_keys: false
+```
diff --git a/docs/pages/reference/deployment/monitoring/metrics.mdx b/docs/pages/reference/deployment/monitoring/metrics.mdx
new file mode 100644
index 0000000000000..06da7b9a00d11
--- /dev/null
+++ b/docs/pages/reference/deployment/monitoring/metrics.mdx
@@ -0,0 +1,25 @@
+---
+title: Teleport Metrics
+description: Comprehensive list of all metrics exposed by Teleport.
+tags:
+ - reference
+ - platform-wide
+---
+
+<Admonition scope={["cloud"]} type="tip">
+
+Teleport Cloud does not expose monitoring endpoints for the Auth Service and Proxy Service.
+
+</Admonition>
+
+Teleport metrics are intended for performance monitoring. If you'd like to
+monitor Teleport usage, consider utilizing our Event Handler plugin to push Audit Events into your
+preferred logging aggregation system (Elastic, Splunk, Sumo Logic, etc). 
+
+- [Audit Events and Records](audit.mdx)  
+- [Forwarding events with Fluentd](../../../zero-trust-access/export-audit-events/fluentd.mdx)  
+- [Monitor Teleport Audit Events with the Elastic Stack](../../../zero-trust-access/export-audit-events/elastic-stack.mdx)  
+
+The following metrics are available:
+
+(!docs/pages/includes/metrics.mdx!)
diff --git a/docs/pages/reference/deployment/monitoring/monitoring.mdx b/docs/pages/reference/deployment/monitoring/monitoring.mdx
new file mode 100644
index 0000000000000..b62401f5246e1
--- /dev/null
+++ b/docs/pages/reference/deployment/monitoring/monitoring.mdx
@@ -0,0 +1,9 @@
+---
+title: Teleport Monitoring References
+sidebar_label: Monitoring
+description: Provides comprehensive guides to monitoring data available from Teleport.
+tags:
+ - platform-wide
+---
+
+<DocCardList />
diff --git a/docs/pages/reference/monitoring/tracing-service-configuration.mdx b/docs/pages/reference/deployment/monitoring/tracing-service-configuration.mdx
similarity index 93%
rename from docs/pages/reference/monitoring/tracing-service-configuration.mdx
rename to docs/pages/reference/deployment/monitoring/tracing-service-configuration.mdx
index 9515b6882edca..742256b06732f 100644
--- a/docs/pages/reference/monitoring/tracing-service-configuration.mdx
+++ b/docs/pages/reference/deployment/monitoring/tracing-service-configuration.mdx
@@ -1,6 +1,9 @@
 ---
 title: Distributed Tracing Configuration Reference
 description: Configuration reference for Distributed Tracing.
+tags:
+ - reference
+ - platform-wide
 ---
 
 This guide lays out the configuration fields that are related to distributed
diff --git a/docs/pages/reference/networking.mdx b/docs/pages/reference/deployment/networking.mdx
similarity index 97%
rename from docs/pages/reference/networking.mdx
rename to docs/pages/reference/deployment/networking.mdx
index 39a84e7c55a89..ba9cfc9257782 100644
--- a/docs/pages/reference/networking.mdx
+++ b/docs/pages/reference/deployment/networking.mdx
@@ -1,6 +1,9 @@
 ---
 title: Networking
 description: This reference explains the networking requirements of a Teleport cluster, including its public address, ports, and support for HTTP CONNECT proxies.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 A Teleport cluster is a distributed system that may comprise a number of
@@ -145,7 +148,7 @@ TLS routing is enabled by default. In this mode, all connections to a Teleport
 service (e.g., the Teleport SSH Service or Kubernetes) are routed through the
 Proxy Service's public web address.
 
-Read more in our [TLS Routing](architecture/tls-routing.mdx) guide.
+Read more in our [TLS Routing](../architecture/tls-routing.mdx) guide.
 
 | Port | Downstream Service | Description |
 | - | - | - |
@@ -220,7 +223,7 @@ than through a port allocated to that service.
 In this case, you can see that TLS routing is enabled, and that the Proxy
 Service's public web address (`ssh.public_addr`) is `mytenant.teleport.sh:443`.
 
-Read more in our [TLS Routing](architecture/tls-routing.mdx) guide.
+Read more in our [TLS Routing](../architecture/tls-routing.mdx) guide.
 
 </TabItem>
 </Tabs>
@@ -239,7 +242,7 @@ agents to the public internet.
 ### Direct connections to agents
 
 If you run a self-hosted Teleport cluster, you can join an agent [directly to
-the Teleport Auth Service](../enroll-resources/agents/join-token.mdx).
+the Teleport Auth Service](../../enroll-resources/agents/join-token.mdx).
 In this setup, certain Teleport services open their own listeners rather than
 accepting connections via reverse tunnel. The Proxy Service connects to these
 agent services by dialing them directly.
@@ -260,4 +263,4 @@ expose ports directly.
 
 <Admonition type="important">
 Direct auth joining is only supported for ssh and kube agents. Application, database, and other discovery-based features are not supported when joining auth directly.
-</Admonition>
\ No newline at end of file
+</Admonition>
diff --git a/docs/pages/admin-guides/management/operations/scaling.mdx b/docs/pages/reference/deployment/scaling.mdx
similarity index 97%
rename from docs/pages/admin-guides/management/operations/scaling.mdx
rename to docs/pages/reference/deployment/scaling.mdx
index 43efbb7b00127..23d48f8a0a45e 100644
--- a/docs/pages/admin-guides/management/operations/scaling.mdx
+++ b/docs/pages/reference/deployment/scaling.mdx
@@ -1,6 +1,9 @@
 ---
 title: Scaling
 description: How to configure Teleport for large-scale deployments
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 This section explains the recommended configuration settings for large-scale
@@ -8,13 +11,9 @@ self-hosted deployments of Teleport.
 
 (!docs/pages/includes/cloud/call-to-action.mdx!)
 
-## Prerequisites
-
-- Teleport v(=teleport.version=) Open Source or Enterprise.
-
 ## Hardware recommendations
 
-Set up Teleport with a [High Availability configuration](../../deploy-a-cluster/high-availability.mdx).
+Set up Teleport with a [High Availability configuration](../../zero-trust-access/deploy-a-cluster/deployments/high-availability.mdx).
 
 | Scenario                                                              | Max Recommended Count | Proxy Service         | Auth Service          | AWS Instance Types |
 |-----------------------------------------------------------------------|-----------------------|-----------------------|-----------------------|--------------------|
diff --git a/docs/pages/reference/signals.mdx b/docs/pages/reference/deployment/signals.mdx
similarity index 94%
rename from docs/pages/reference/signals.mdx
rename to docs/pages/reference/deployment/signals.mdx
index 7db71384330fb..e0392545ca690 100644
--- a/docs/pages/reference/signals.mdx
+++ b/docs/pages/reference/deployment/signals.mdx
@@ -1,7 +1,10 @@
 ---
 title: Teleport Signals
-h1: Teleport Signals Reference
+sidebar_label: Signals
 description: "Signals you can send to a running teleport process."
+tags:
+ - reference
+ - platform-wide
 ---
 
 You can send the following signals to a `teleport` process to trigger different
diff --git a/docs/pages/reference/signature-algorithms.mdx b/docs/pages/reference/deployment/signature-algorithms.mdx
similarity index 98%
rename from docs/pages/reference/signature-algorithms.mdx
rename to docs/pages/reference/deployment/signature-algorithms.mdx
index cb12848a529b5..e9f94bdca21f4 100644
--- a/docs/pages/reference/signature-algorithms.mdx
+++ b/docs/pages/reference/deployment/signature-algorithms.mdx
@@ -1,7 +1,9 @@
 ---
 title: Signature Algorithms
-h1: Signature Algorithms Reference
 description: "Signature algorithms used in Teleport."
+tags:
+ - conceptual
+ - zero-trust
 ---
 
 The Teleport Auth Service issues SSH and TLS certificates to users and hosts
@@ -158,7 +160,7 @@ updated.
 In order to use new signature algorithms for your existing Certificate
 Authorities, you will need to complete a CA rotation for each authority.
 This may require manual steps to update the trust relationships in your Cluster.
-The procedure is documented in the [CA rotation guide](../admin-guides/management/operations/ca-rotation.mdx).
+The procedure is documented in the [CA rotation guide](../../zero-trust-access/management/security/ca-rotation.mdx).
 This process is optional, your cluster will continue to function with the
 existing Certificate Authority keys if you don't complete a CA rotation.
 
@@ -241,7 +243,7 @@ For these reasons we recommend continuing to use the `legacy` algorithm suite.
 
 ### My YubiHSM2 authentication key does not have capabilities for ECDSA keys, what do I do?
 
-Our [YubiHSM2 guide](../admin-guides/deploy-a-cluster/hsm.mdx) recommends
+Our [YubiHSM2 guide](../../zero-trust-access/deploy-a-cluster/hsm.mdx) recommends
 creating an
 [authentication key](https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/hsm2-core-concepts.html#authentication-key)
 to be used by the Teleport Auth Service to authenticate with the YubiHSM2.
diff --git a/docs/pages/reference/helm-reference/helm-reference.mdx b/docs/pages/reference/helm-reference/helm-reference.mdx
index 3636a6e0f14c3..86bccb0875158 100644
--- a/docs/pages/reference/helm-reference/helm-reference.mdx
+++ b/docs/pages/reference/helm-reference/helm-reference.mdx
@@ -1,8 +1,10 @@
 ---
-title: Helm Charts
-h1: Helm Chart References
+title: Helm Chart References
+sidebar_label: Helm Charts
 description: Comprehensive lists of configuration values in Teleport's Helm charts
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - platform-wide
 ---
 
 - [teleport-cluster](teleport-cluster.mdx): Deploy the
@@ -13,9 +15,10 @@ layout: tocless-doc
   Kubernetes.
 - [teleport-operator](teleport-operator.mdx): Deploy the
   Teleport Kubernetes Operator.
+- [teleport-relay](teleport-relay.mdx): Deploy the Teleport Relay Service.
 - [teleport-access-graph](teleport-access-graph.mdx): Deploy the
   Teleport Identity Security Access Graph service.
-- [tbot](tbot.mdx): Deploy an instance of TBot, the [MachineID](../../enroll-resources/machine-id/introduction.mdx) agent.
+- [tbot](tbot.mdx): Deploy an instance of TBot, the [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx) agent.
 - [teleport-plugin-event-handler](teleport-plugin-event-handler.mdx):
   Deploy the Teleport Event Handler plugin which sends events and session logs
   to Fluentd.
@@ -42,4 +45,4 @@ layout: tocless-doc
   when Access Requests are made.
 - [teleport-plugin-datadog](teleport-plugin-datadog.mdx): Deploy
   the Teleport Datadog Incident Management Plugin, which allows Access Requests
-  to be managed as Datadog incidents.
\ No newline at end of file
+  to be managed as Datadog incidents.
diff --git a/docs/pages/reference/helm-reference/tbot.mdx b/docs/pages/reference/helm-reference/tbot.mdx
index e68ebfc5ae72a..7ef4ce0c0340f 100644
--- a/docs/pages/reference/helm-reference/tbot.mdx
+++ b/docs/pages/reference/helm-reference/tbot.mdx
@@ -1,17 +1,22 @@
 ---
 title: tbot Chart Reference
+sidebar_label: tbot
 description: Values that can be set using the tbot Helm chart
+tags:
+ - reference
+ - mwi
+ - infrastructure-identity
 ---
 
-This chart deploys an instance of the [MachineID](../../enroll-resources/machine-id/introduction.mdx) agent,
+This chart deploys an instance of the [Machine & Workload Identity](../../machine-workload-identity/introduction.mdx) agent,
 TBot, into your Kubernetes cluster.
 
 To use it, you will need to know:
 
 - The address of your Teleport Proxy Service or Auth Service
 - The name of your Teleport cluster
-- The name of a join token configured for Machine ID and your Kubernetes cluster
-  as described in the [Machine ID on Kubernetes guide](../../enroll-resources/machine-id/deployment/kubernetes.mdx)
+- The name of a join token configured for Machine & Workload Identity and your Kubernetes cluster
+  as described in the [Machine & Workload Identity on Kubernetes guide](../../machine-workload-identity/deployment/kubernetes.mdx)
 
 By default, this chart is designed to use the `kubernetes` join method but it
 can be customized to use any delegated join method. We do not recommend that
@@ -20,13 +25,11 @@ you use the `token` join method with this chart.
 ## Minimal configuration
 
 This basic configuration will write a Teleport identity file to a secret in
-the deployment namespace called `test-output`.
+the deployment namespace called `<helm-release-name>-out`. For example `tbot-out`.
 
 ```yaml
 clusterName: "test.teleport.sh"
 teleportProxyAddress: "test.teleport.sh:443"
-defaultOutput:
-  secretName: "test-output"
 token: "my-token"
 ```
 
diff --git a/docs/pages/reference/helm-reference/teleport-access-graph.mdx b/docs/pages/reference/helm-reference/teleport-access-graph.mdx
index 0806c5fb9dc88..58ce5cc406027 100644
--- a/docs/pages/reference/helm-reference/teleport-access-graph.mdx
+++ b/docs/pages/reference/helm-reference/teleport-access-graph.mdx
@@ -1,11 +1,16 @@
 ---
 title: teleport-access-graph Chart Reference
+sidebar_label: teleport-access-graph
 description: Values that can be set using the teleport-access-graph Helm chart
+tags:
+ - reference
+ - identity-security
+ - access-risks
 ---
 
 The `teleport-access-graph` Helm chart deploys the Access Graph service.
 
-See [Teleport Identity Security with Access Graph on Self-Hosted Clusters with Helm](../../admin-guides/deploy-a-cluster/access-graph/self-hosted-helm.mdx)
+See [Teleport Identity Security with Access Graph on Self-Hosted Clusters with Helm](../../identity-security/access-graph/self-hosted-helm.mdx)
 for more details.
 
 <Admonition type="warning" title="Version Compatibility">
diff --git a/docs/pages/reference/helm-reference/teleport-cluster.mdx b/docs/pages/reference/helm-reference/teleport-cluster.mdx
index fca78605d5305..735a21ac13fa4 100644
--- a/docs/pages/reference/helm-reference/teleport-cluster.mdx
+++ b/docs/pages/reference/helm-reference/teleport-cluster.mdx
@@ -1,11 +1,15 @@
 ---
 title: teleport-cluster Chart Reference
+sidebar_label: teleport-cluster
 description: Values that can be set using the teleport-cluster Helm chart
+tags:
+ - reference
+ - platform-wide
 ---
 
 The `teleport-cluster` Helm chart deploys a Teleport cluster on Kubernetes.
 This includes deploying proxies, auth servers, and [kubernetes-access](../../enroll-resources/kubernetes-access/introduction.mdx).
-See the [Teleport HA Architecture page](../../admin-guides/deploy-a-cluster/high-availability.mdx)
+See the [Teleport HA Architecture page](../../zero-trust-access/deploy-a-cluster/deployments/high-availability.mdx)
 for more details.
 
 You can
@@ -35,11 +39,11 @@ Get started with a guide for each mode:
 
 | `chartMode` | Purpose | Guide |
 | - | - | - |
-| `standalone` | Runs by relying only on Kubernetes resources. | [Getting Started - Kubernetes](../../admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx) |
-| `aws` | Leverages AWS managed services to store data. | [Running an HA Teleport cluster using an AWS EKS Cluster](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx) |
-| `gcp` | Leverages GCP managed services to store data. | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx) |
-| `azure` | Leverages Azure managed services to store data. | [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../admin-guides/deploy-a-cluster/helm-deployments/azure.mdx) |
-| `scratch` (v12 and above) | Generates empty Teleport configuration. User must pass their own config. This is discouraged, use `standalone` mode with [`auth.teleportConfig`](#authteleportconfig) and [`proxy.teleportConfig`](#proxyteleportconfig) instead. | [Running a Teleport cluster with a custom config](../../admin-guides/deploy-a-cluster/helm-deployments/custom.mdx) |
+| `standalone` | Runs by relying only on Kubernetes resources. | [Getting Started - Kubernetes](../../zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx) |
+| `aws` | Leverages AWS managed services to store data. | [Running an HA Teleport cluster using an AWS EKS Cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx) |
+| `gcp` | Leverages GCP managed services to store data. | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx) |
+| `azure` | Leverages Azure managed services to store data. | [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx) |
+| `scratch` (v12 and above) | Generates empty Teleport configuration. User must pass their own config. This is discouraged, use `standalone` mode with [`auth.teleportConfig`](#authteleportconfig) and [`proxy.teleportConfig`](#proxyteleportconfig) instead. | [Running a Teleport cluster with a custom config](../../zero-trust-access/deploy-a-cluster/helm-deployments/custom.mdx) |
 
 <Admonition type="warning" title="Version Compatibility">
 The chart is versioned with Teleport. No compatibility guarantees are ensured
@@ -143,7 +147,7 @@ If `proxyProtocol` is unspecified, Teleport does not require PROXY header for th
 connection, but will accept it if present. This mode is considered insecure
 and should only be used for testing purposes.
 
-See the [PROXY Protocol security section](../../admin-guides/management/security/proxy-protocol.mdx) for more details.
+See the [PROXY Protocol security section](../../zero-trust-access/management/security/proxy-protocol.mdx) for more details.
 
 
 ### `auth.teleportConfig`
@@ -164,7 +168,7 @@ The merge logic is as follows:
 - values (string, integer, boolean, ...) are replaced
 - fields can be unset by setting them to `null` or `~`
 
-See the [Teleport Configuration Reference](../config.mdx) for the list of supported fields.
+See the [Teleport Configuration Reference](../deployment/config.mdx) for the list of supported fields.
 
 ```yaml
 auth:
@@ -225,7 +229,7 @@ The merge logic is as follows:
 - values (string, integer, boolean, ...) are replaced
 - fields can be unset by setting them to `null` or `~`
 
-See the [Teleport Configuration Reference](../config.mdx) for the list of supported fields.
+See the [Teleport Configuration Reference](../deployment/config.mdx) for the list of supported fields.
 
 ```yaml
 proxy:
@@ -257,12 +261,12 @@ Possible values are `local` and `github` for Teleport Community Edition, plus `o
 | `string` | `""`          | No        | `auth_service.authentication.connector_name` |
 
 `authentication.connectorName` sets the default authentication connector.
-[The SSO documentation](../../admin-guides/access-controls/sso/sso.mdx) explains how to create
+[The SSO documentation](../../zero-trust-access/sso/sso.mdx) explains how to create
 authentication connectors for common identity providers. In addition to SSO
 connector names, the following built-in connectors are supported:
 
-- [`local`](../../admin-guides/management/admin/users.mdx) for local users
-- [`passwordless`](../../admin-guides/access-controls/guides/passwordless.mdx) to enable by
+- [`local`](../../zero-trust-access/rbac-get-started/users.mdx) for local users
+- [`passwordless`](../../zero-trust-access/authentication/passwordless.mdx) to enable by
 default passwordless authentication.
 
 Defaults to `local`.
@@ -276,7 +280,7 @@ Defaults to `local`.
 `authentication.localAuth` controls whether local authentication is enabled.
 When disabled, users can only log in through authentication connectors like `saml`, `oidc` or `github`.
 
-[Disabling local auth is required for FedRAMP / FIPS](../../admin-guides/access-controls/compliance-frameworks/fedramp.mdx).
+[Disabling local auth is required for FedRAMP / FIPS](../../zero-trust-access/compliance-frameworks/fedramp.mdx).
 
 ### `authentication.lockingMode`
 
@@ -285,7 +289,7 @@ When disabled, users can only log in through authentication connectors like `sam
 | `string` | `""`          | No        | `auth_service.authentication.locking_mode` |
 
 `authentication.lockingMode` controls the locking mode cluster-wide. Possible values are `best_effort` and `strict`.
-See [the locking modes documentation](../../admin-guides/access-controls/guides/locking.mdx) for more
+See [the locking modes documentation](../../identity-governance/locking.mdx) for more
 details.
 
 Defaults to Teleport's binary default when empty: `best_effort`.
@@ -298,7 +302,7 @@ Defaults to Teleport's binary default when empty: `best_effort`.
 
 `authentication.passwordless` controls whether passwordless authentication is enabled.
 
-[Can be used to forbid passwordless access to your cluster](../../admin-guides/access-controls/guides/passwordless.mdx)
+[Can be used to forbid passwordless access to your cluster](../../zero-trust-access/authentication/passwordless.mdx)
 
 ### `authentication.secondFactor`
 
@@ -367,7 +371,7 @@ Changing the RP ID will invalidate all already registered webauthn second factor
 
 ### `authentication.webauthn`
 
-See [Harden your Cluster Against IdP Compromises](../../admin-guides/access-controls/guides/webauthn.mdx) for more details.
+See [Harden your Cluster Against IdP Compromises](../../zero-trust-access/management/security/idp-compromise.mdx) for more details.
 
 #### `authentication.webauthn.attestationAllowedCas`
 
@@ -415,7 +419,7 @@ By default no devices are forbidden.
 
 `sessionRecording` controls the `session_recording` field in the `teleport.yaml` configuration.
 It is passed as-is in the configuration.
-For possible values, [see the Teleport Configuration Reference](../../reference/config.mdx).
+For possible values, [see the Teleport Configuration Reference](../deployment/config.mdx).
 
 `values.yaml` example:
 
@@ -668,27 +672,6 @@ By using this value you will update the Kubernetes volume specification to mount
   licenseSecretName: enterprise-license
   ```
 
-## `installCRDs`
-
-| Type   | Default value |
-|--------|---------------|
-| `bool` | `false`       |
-
-CRDs are not namespace-scoped resources - they can be installed only once in a cluster.
-
-CRDs are required by the Teleport Kubernetes Operator and are installed by default when `operator.enabled` is true.
-`installCRDs` overrides this behavior and allows users to indicate whether to deploy Teleport CRDs.
-
-If several releases of the `teleport-cluster` chart are deployed in the same Kubernetes cluster, only one
-release should have `installCRDs` enabled. Unless you are deploying multiple `teleport-cluster` Helm releases in
-the same Kubernetes cluster or installing the CRDs on your own you should not have to set this value.
-
-`values.yaml` example:
-
-  ```yaml
-  installCRDs: true
-  ```
-
 ## `operator`
 
 ### `operator.annotations.deployment`
@@ -758,7 +741,7 @@ Kubernetes annotations which should be applied to the `ServiceAccount` created b
 
 Enabling the operator will also deploy the Teleport CRDs in the Kubernetes cluster.
 If you are deploying multiple releases of the Helm chart in the same cluster you can override this behavior with
-[`installCRDs`](#installCRDs).
+[`installCRDs`](#operatorinstallcrds).
 
 `values.yaml` example:
 
@@ -766,6 +749,22 @@ If you are deploying multiple releases of the Helm chart in the same cluster you
   operator:
     enabled: true
   ```
+### `operator.installCRDs`
+
+| Type | Default |
+|------|---------|
+| `string` | `"dynamic"` |
+
+`operator.installCRDs` controls if the chart should install the CRDs.
+There are 3 possible values: dynamic, always, never.
+
+- "dynamic" means the CRDs are installed if the operator is enabled or if
+the CRDs are already present in the cluster. The presence check is here to
+avoid all CRDs to be removed if you temporarily disable the operator.
+Removing CRDs triggers a cascading deletion, which removes CRs, and all the
+related resources in Teleport.
+- "always" means the CRDs are always installed
+- "never" means the CRDs are never installed
 
 ### `operator.image`
 
@@ -885,7 +884,7 @@ If you want to run Teleport version `X.Y.Z`, you should use
 `helm --version X.Y.Z` instead.
 </Admonition>
 
-See our [installation guide](../../installation.mdx#docker) for information on
+See our [installation guide](../../installation/docker.mdx) for information on
 Docker image versions.
 
 `values.yaml` example:
@@ -958,7 +957,7 @@ PodSecurityPolicy resource has been removed in Kubernetes 1.25
 and replaced since 1.23 by PodSecurityAdmission. If you are running on
 Kubernetes 1.23 or later it is recommended to disable PSPs and use PSAs.
 The steps are documented in the
-[PSP removal guide](../../admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
+[PSP removal guide](../../zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
 
 To disable PSP creation, you can set `enabled` to `false`.
 
@@ -1005,11 +1004,11 @@ policies to define access rules for the cluster.
 
 | `chartMode`  | Guide                                                                                                              |
 |--------------|--------------------------------------------------------------------------------------------------------------------|
-| `standalone` | [Getting Started - Kubernetes](../../admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx)            |
-| `aws`        | [Running an HA Teleport cluster using an AWS EKS Cluster](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx)         |
-| `gcp`        | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx) |
-| `azure`      | [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../admin-guides/deploy-a-cluster/helm-deployments/azure.mdx) |
-| `scratch`    | [Running a Teleport cluster with a custom config](../../admin-guides/deploy-a-cluster/helm-deployments/custom.mdx)              |
+| `standalone` | [Getting Started - Kubernetes](../../zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx)            |
+| `aws`        | [Running an HA Teleport cluster using an AWS EKS Cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx)         |
+| `gcp`        | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx) |
+| `azure`      | [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx) |
+| `scratch`    | [Running a Teleport cluster with a custom config](../../zero-trust-access/deploy-a-cluster/helm-deployments/custom.mdx)              |
 
 <Admonition type="warning">
 Using the `scratch` chart mode is discouraged. Precise chart and Teleport
@@ -1031,7 +1030,7 @@ This custom resource configures Prometheus and makes it scrape Teleport metrics.
 The CRD is deployed by the prometheus-operator and allows workload to
 get monitored. You need to deploy the `prometheus-operator`
 in the cluster prior to configuring the `podMonitor` section of the chart. See
-[the prometheus-operator documentation](https://prometheus-operator.dev/docs/prologue/introduction/)
+[the prometheus-operator documentation](https://prometheus-operator.dev/docs/getting-started/introduction/)
 for setup instructions.
 
 ### `podMonitor.enabled`
@@ -1141,7 +1140,7 @@ You can set `volumeSize` to request a different size of persistent volume when i
 
 ## `aws`
 
-`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx)
+`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx)
 
 ### `aws.region`
 
@@ -1195,7 +1194,7 @@ When this value is set, Teleport will export events to the Athena audit backend.
 To use the Athena audit backend, you must set up the required infrastructure
 (S3 buckets, SQS queue, AthenaDB, IAM roles and permissions, ...).
 
-The requirements are described in [the Athena backend documentation](../backends.mdx#athena)
+The requirements are described in [the Athena backend documentation](../deployment/backends.mdx#athena)
 
 If both `aws.athenaURL` and `aws.auditLogTable` (DynamoDB) are set, the
 `aws.auditLogPrimaryBackend` value configures which backend is used for querying.
@@ -1225,11 +1224,11 @@ Whether Teleport should configure DynamoDB's autoscaling. Defaults to `false`.
 
 ### `aws.accessMonitoring`
 
-`aws.accessMonitoring` configures the [Access Monitoring](../../admin-guides/access-controls/access-monitoring.mdx)
+`aws.accessMonitoring` configures the [Access Monitoring](../../identity-governance/access-monitoring.mdx)
 feature of the Auth Service.
 
 Using this features requires setting up specific AWS infrastructure as described
-in [the AccessMonitoring configuration section](../../admin-guides/access-controls/access-monitoring.mdx).
+in [the AccessMonitoring configuration section](../../identity-governance/access-monitoring.mdx).
 The [Terraform example](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/examples/athena)
 code will output the chart values for this section.
 
@@ -1256,11 +1255,11 @@ queries.
 
 ## `gcp`
 
-`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx)
+`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx)
 
 ## `azure`
 
-`azure` settings are described in the Azure guide: [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../admin-guides/deploy-a-cluster/helm-deployments/azure.mdx)
+`azure` settings are described in the Azure guide: [Running an HA Teleport cluster using a Microsoft Azure AKS cluster](../../zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx)
 
 ## `highAvailability`
 
@@ -1384,7 +1383,7 @@ cluster deployed in HA mode.
   You must install and configure `cert-manager` in your Kubernetes cluster yourself.
 
   See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
+  and the relevant sections of the [AWS](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
 </Admonition>
 
 ### `highAvailability.certManager.addCommonName`
@@ -1399,7 +1398,7 @@ Setting `highAvailability.certManager.addCommonName` to `true` will instruct `ce
   You must install and configure `cert-manager` in your Kubernetes cluster yourself.
 
   See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
+  and the relevant sections of the [AWS](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
 </Admonition>
 
 `values.yaml` example:
@@ -1444,7 +1443,7 @@ Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issui
   You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
 
   Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
-  of the [AWS](../../admin-guides/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
+  of the [AWS](../../zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx) and [GCP](../../zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx) guides for more information.
 </Admonition>
 
 `values.yaml` example:
@@ -1549,13 +1548,9 @@ in the pod logs.
 You should create the secret in the same namespace as Teleport using a command like this:
 
 ```code
-kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
+$ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
 
-<Admonition type="warning" title="Root CA filename">
-  The filename used for the root CA in the secret must be `ca.pem`.
-</Admonition>
-
 `values.yaml` example:
 
   ```yaml
@@ -1563,6 +1558,21 @@ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
     existingCASecretName: my-root-ca
   ```
 
+## `tls.existingCASecretKeyName`
+
+| Type     | Default value |
+|----------|---------------|
+| `string` | `"ca.pem"`    |
+
+`tls.existingCASecretKeyName` determines which key in the CA secret will be used as a trusted CA bundle file.
+
+`values.yaml` example:
+
+  ```yaml
+  tls:
+    existingCASecretKeyName: "ca.pem"
+  ```
+
 ## `image`
 
 | Type     | Default value                           |
@@ -1666,7 +1676,7 @@ Possible values are `text` (default) or `json`.
 
 `log.extraFields` sets the fields used in logging for the Teleport process.
 
-See the [Teleport config file reference](../../reference/config.mdx) for more details on possible values for `extra_fields`.
+See the [Teleport config file reference](../deployment/config.mdx) for more details on possible values for `extra_fields`.
 
 `values.yaml` example:
 
@@ -2312,6 +2322,22 @@ See [the GitHub PR](https://github.com/gravitational/teleport/pull/36251) for te
       cpu: 1
       memory: 2Gi
   ```
+## `goMemLimitRatio`
+
+| Type    | Default |
+|---------|---------|
+| `float` | `0.9`   |
+
+`goMemLimitRatio` configures the GOMEMLIMIT env var set by the chart.
+GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+below a given threshold. This is a best-effort attempt, but this helps
+to prevent OOMs in case of bursts.
+
+When the memory limits are set and goMemLimitRatio is non-zero,
+the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+The value must be between 0 and 1.
+Set to 0 to unset GOMEMLIMIT.
+This has no effect if GOMEMLIMIT is already set through `extraEnv`.
 
 ## `podSecurityContext`
 
diff --git a/docs/pages/reference/helm-reference/teleport-kube-agent.mdx b/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
index 6c02a056dc463..405e13314b484 100644
--- a/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
+++ b/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
@@ -1,6 +1,11 @@
 ---
 title: teleport-kube-agent Chart Reference
+sidebar_label: teleport-kube-agent
 description: Values that can be set using the teleport-kube-agent Helm chart
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
 ---
 
 The `teleport-kube-agent` Helm chart is used to configure a Teleport Agent that
@@ -23,10 +28,10 @@ The `teleport-kube-agent` chart can run any or all of three Teleport services:
 | Teleport service                                                          | Name for `roles` and `tctl tokens add` | Purpose                                                                                      |
 |---------------------------------------------------------------------------|----------------------------------------|----------------------------------------------------------------------------------------------|
 | [`kubernetes_service`](../../enroll-resources/kubernetes-access/introduction.mdx)          | `kube`                                 | Uses Teleport to handle authentication<br/> with and proxy access to a Kubernetes cluster    |
-| [`application_service`](../../enroll-resources/application-access/guides/guides.mdx)              | `app`                                  | Uses Teleport to handle authentication<br/> with and proxy access to web-based applications  |
+| [`application_service`](../../enroll-resources/application-access/application-access.mdx)              | `app`                                  | Uses Teleport to handle authentication<br/> with and proxy access to web-based applications  |
 | [`database_service`](../../enroll-resources/database-access/guides/guides.mdx)                    | `db`                                   | Uses Teleport to handle authentication<br/> with and proxy access to databases               |
 | [`discovery_service`](../../enroll-resources/auto-discovery/auto-discovery.mdx)              | `discovery`                            | Uses Teleport to discover new resources<br/> and dynamically add them to the cluster         |
-| [`jamf_service`](../../admin-guides/access-controls/device-trust/jamf-integration.mdx) | `jamf`                                 | Uses Teleport to integrate with Jamf Pro<br/> and sync devices with Device Trust inventory   |
+| [`jamf_service`](../../identity-governance/device-trust/jamf-integration.mdx) | `jamf`                                 | Uses Teleport to integrate with Jamf Pro<br/> and sync devices with Device Trust inventory   |
 
 ### Legacy releases
 
diff --git a/docs/pages/reference/helm-reference/teleport-operator.mdx b/docs/pages/reference/helm-reference/teleport-operator.mdx
index 7fa9f42b19a65..5c1954fd37453 100644
--- a/docs/pages/reference/helm-reference/teleport-operator.mdx
+++ b/docs/pages/reference/helm-reference/teleport-operator.mdx
@@ -1,12 +1,17 @@
 ---
 title: teleport-operator Chart Reference
+sidebar_label: teleport-operator
 description: Values that can be set using the teleport-operator Helm chart
+tags:
+ - infrastructure-as-code
+ - reference
+ - zero-trust
 ---
 
 The `teleport-operator` Helm chart deploys the Teleport Kubernetes Operator.
 When deployed via the chart, the operator can join Teleport clusters living in
 Kubernetes or remote ones (such as Teleport Cloud).
-See the [Kubernetes Operator for remote Teleport clusters guide](../../admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx)
+See the [Kubernetes Operator for remote Teleport clusters guide](../../zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx)
 for more details.
 
 You can
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-datadog.mdx b/docs/pages/reference/helm-reference/teleport-plugin-datadog.mdx
index 6afc4634da03a..61258588eff84 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-datadog.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-datadog.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-datadog Chart Reference
+sidebar_label: teleport-plugin-datadog
 description: Values that can be set using the teleport-plugin-datadog Helm chart
+tags:
+ - access-requests
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-datadog` Helm chart runs the Datadog Teleport plugin, which
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-discord.mdx b/docs/pages/reference/helm-reference/teleport-plugin-discord.mdx
index 2bb6d3a7b3e62..a524ad40654e7 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-discord.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-discord.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-discord Chart Reference
+sidebar_label: teleport-plugin-discord
 description: Values that can be set using the teleport-plugin-discord Helm chart
+tags:
+ - access-requests
+ - reference
+ - zero-trust
+ - privileged-access
 ---
 
 The `teleport-plugin-discord` Helm chart is used to configure the Discord Teleport plugin, which allows users to receive Access Requests via channels or direct messages in Discord.
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-email.mdx b/docs/pages/reference/helm-reference/teleport-plugin-email.mdx
index 4adfdd3f2aeb4..16b0e822a7149 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-email.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-email.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-email Chart Reference
+sidebar_label: teleport-plugin-email
 description: Values that can be set using the teleport-plugin-email Helm chart
+tags:
+ - access-requests
+ - reference
+ - zero-trust
+ - privileged-access
 ---
 
 The `teleport-plugin-email` Helm chart is used to configure the email Teleport plugin, which allows users to receive Access Requests via emails.
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-event-handler.mdx b/docs/pages/reference/helm-reference/teleport-plugin-event-handler.mdx
index e5753d0209390..41907ec037f92 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-event-handler.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-event-handler.mdx
@@ -1,6 +1,11 @@
 ---
 title: teleport-plugin-event-handler Chart Reference
+sidebar_label: teleport-plugin-event-handler
 description: Values that can be set using the teleport-plugin-event-handler Helm chart
+tags:
+ - reference
+ - zero-trust
+ - audit
 ---
 
 The `teleport-plugin-event-handler` Helm chart is used to configure the Event Handler Teleport plugin which allows users to send events and session logs to a Fluentd instance for further processing or storage.
@@ -11,179 +16,4 @@ This reference details available values for the `teleport-plugin-event-handler`
 
 (!docs/pages/includes/backup-warning.mdx!)
 
-## `teleport.address`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `""` | Yes |
-
-This parameter contains the host/port combination of the Teleport Auth Service.
-
-`values.yaml` example:
-
-  ```yaml
-  teleport:
-    address: "teleport.example.com:3025"
-  ```
-
-## `teleport.identitySecretName`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `""` | Yes |
-
-Name of the Kubernetes secret that contains the credentials for the connection.
-
-The secret should be in the following format:
-
-```yaml
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-  name: teleport-plugin-event-handler-identity
-data:
-  auth_id: ...
-```
-
-`values.yaml` example:
-
-  ```yaml
-  teleport:
-    identitySecretName: "teleport-plugin-event-handler-identity"
-  ```
-
-## `teleport.identitySecretPath`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `"auth_id"` | No |
-
-Name of the key in the Kubernetes secret that holds the credentials for the connection. If the secret follows the format above, it can be omitted.
-
-`values.yaml` example:
-
-  ```yaml
-  teleport:
-    identitySecretPath: "auth_id"
-  ```
-
-## `fluentd.url`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `""` | Yes |
-
-Fluentd URL where the events will be sent.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    url: "https://fluentd:24224/events.log"
-  ```
-
-## `fluentd.sessionUrl`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `""` | Yes |
-
-Fluentd URL where the session logs will be sent.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    sessionUrl: "https://fluentd:24224/session.log"
-  ```
-
-## `fluentd.certificate.secretName`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `""` | Yes |
-
-Secret containing the credentials to connect to Fluentd. It must to contain the CA certificate, the client key and the client certificate.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    secretName: "teleport-plugin-event-handler-fluentd"
-  ```
-
-## `fluentd.certificate.caPath`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `"ca.crt"` | No |
-
-Name of the key which contains the CA certificate inside the secret.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    caPath: "ca.crt"
-  ```
-
-## `fluentd.certificate.keyPath`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `"client.key"` | No |
-
-Name of the key which contains the client's private key inside the secret.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    keyPath: "client.key"
-  ```
-
-## `fluentd.certificate.certPath`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `"client.crt"` | No |
-
-Name of the key which contains the client's certificate inside the secret.
-
-`values.yaml` example:
-
-  ```yaml
-  fluentd:
-    certPath: "client.crt"
-  ```
-
-## `log.output`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `stdout` | No |
-
-Logger output. Can be `stdout`, `stderr` or a file name, eg. `/var/log/teleport/fluentd.log`.
-
-`values.yaml` example:
-
-  ```yaml
-  log:
-    output: /var/log/teleport/fluentd.log
-  ```
-
-## `log.severity`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `stdout` | No |
-
-Logger severity. Possible values are `INFO`, `ERROR`, `DEBUG` or `WARN`.
-
-`values.yaml` example:
-
-  ```yaml
-  log:
-    severity: DEBUG
-  ```
+(!docs/pages/includes/helm-reference/zz_generated.event-handler.mdx!)
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-jira.mdx b/docs/pages/reference/helm-reference/teleport-plugin-jira.mdx
index 246fb6a09044e..02f3d7385af0f 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-jira.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-jira.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-jira Chart Reference
+sidebar_label: teleport-plugin-jira
 description: Values that can be set using the teleport-plugin-jira Helm chart
+tags:
+ - access-requests
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-jira` Helm chart runs the Jira Teleport plugin, which
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-mattermost.mdx b/docs/pages/reference/helm-reference/teleport-plugin-mattermost.mdx
index 74dc0e0888ae0..727fc2ceaf5e7 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-mattermost.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-mattermost.mdx
@@ -1,6 +1,11 @@
 ---
 title: teleport-plugin-mattermost Chart Reference
+sidebar_label: teleport-plugin-mattermost
 description: Values that can be set using the teleport-plugin-mattermost Helm chart
+tags:
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-mattermost` Helm chart is used to configure the
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-msteams.mdx b/docs/pages/reference/helm-reference/teleport-plugin-msteams.mdx
index eb0548e6a3500..141ea57408ad3 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-msteams.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-msteams.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-msteams Chart Reference
+sidebar_label: teleport-plugin-msteams
 description: Values that can be set using the teleport-plugin-msteams Helm chart
+tags:
+ - access-requests
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-msteams` Helm chart is used to configure the MsTeams Teleport plugin, which allows users to receive Access Requests via channels or direct messages in MsTeams.
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-pagerduty.mdx b/docs/pages/reference/helm-reference/teleport-plugin-pagerduty.mdx
index 27a706bdbc196..541c4adb0bf19 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-pagerduty.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-pagerduty.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-pagerduty Chart Reference
+sidebar_label: teleport-plugin-pagerduty
 description: Values that can be set using the teleport-plugin-pagerduty Helm chart
+tags:
+ - access-requests
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-pagerduty` Helm chart is used to configure the PagerDuty Teleport plugin, which allows users to receive Access Requests as pages via PagerDuty.
diff --git a/docs/pages/reference/helm-reference/teleport-plugin-slack.mdx b/docs/pages/reference/helm-reference/teleport-plugin-slack.mdx
index 047bd43adcdbe..fa9f13ba7bf18 100644
--- a/docs/pages/reference/helm-reference/teleport-plugin-slack.mdx
+++ b/docs/pages/reference/helm-reference/teleport-plugin-slack.mdx
@@ -1,6 +1,12 @@
 ---
 title: teleport-plugin-slack Chart Reference
+sidebar_label: teleport-plugin-slack
 description: Values that can be set using the teleport-plugin-slack Helm chart
+tags:
+ - access-requests
+ - reference
+ - identity-governance
+ - privileged-access
 ---
 
 The `teleport-plugin-slack` Helm chart is used to configure the Slack Teleport plugin, which allows users to receive Access Requests via channels or direct messages in Slack.
diff --git a/docs/pages/reference/helm-reference/teleport-relay.mdx b/docs/pages/reference/helm-reference/teleport-relay.mdx
new file mode 100644
index 0000000000000..c26cee9e51bbc
--- /dev/null
+++ b/docs/pages/reference/helm-reference/teleport-relay.mdx
@@ -0,0 +1,45 @@
+---
+title: teleport-relay Chart Reference
+sidebar_label: teleport-relay
+description: Values that can be set using the teleport-relay Helm chart
+tags:
+ - reference
+ - zero-trust
+ - infrastructure-identity
+---
+
+The `teleport-relay` Helm chart is used to deploy a Teleport Relay Service group in a Kubernetes cluster, to provide connectivity between clients and resources without involving the Teleport control plane in the network path.
+
+The `teleport-relay` chart is available for Teleport v18.3.0 and later.
+
+You can [browse the source on
+GitHub](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/chart/teleport-relay).
+
+This reference details available values for the `teleport-relay` chart.
+
+<Admonition type="warning">
+
+The Teleport Relay service provides alternate network paths for accessing resources through Teleport in specific scenarios where clients and agents are in the same network segment and there is a need for connectivity that does not go through the Teleport control plane. It is not a required or recommended cluster component in most Teleport deployments.
+
+If you want to provide access to resources like Databases, Applications or Kubernetes clusters, you should use the [`teleport-kube-agent` Helm chart](teleport-kube-agent.mdx) instead.
+
+</Admonition>
+
+(!docs/pages/includes/backup-warning.mdx!)
+
+## What the chart deploys
+
+The `teleport-relay` chart deploys the following Kubernetes resources:
+
+| Kind | Default name | Description |
+|-|-|-|
+| `Deployment` | The release name | One or more replicas of the Teleport instance running the Relay Service |
+| `Service` | The release name | The transport and tunnel servers, pointed at the respective listeners of the Relay Service replicas. |
+| `ConfigMap` | The release name | The Teleport configuration. |
+| `Secret` | `joinTokenSecret.name`, if given, or the release name | The join token name, used to join the cluster. It's possible to use an existing `Secret` that's managed outside of the chart. |
+| `ServiceAccount` | `serviceAccount.name`, if given, or the release name | Used for the `kubernetes` join method. It's possible to use an existing `ServiceAccount` that's managed outside of the chart. |
+| `PodDisruptionBudget` | The release name | Ensures high availability for the Teleport pods. |
+
+## Reference
+
+(!docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx!)
diff --git a/docs/pages/reference/infrastructure-as-code/infrastructure-as-code.mdx b/docs/pages/reference/infrastructure-as-code/infrastructure-as-code.mdx
new file mode 100644
index 0000000000000..85f165ae9692a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/infrastructure-as-code.mdx
@@ -0,0 +1,7 @@
+---
+title: Infrastructure as Code References
+sidebar_label: Infrastructure as Code
+description: Provides comprehensive directories of resources available to tctl, the Teleport Kubernetes operator, and Teleport Terraform provider.
+---
+
+<DocCardList />
diff --git a/docs/pages/reference/infrastructure-as-code/operator-resources/operator-resources.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/operator-resources.mdx
new file mode 100644
index 0000000000000..1cc4d8925e38a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/operator-resources.mdx
@@ -0,0 +1,33 @@
+---
+title: "Teleport Kubernetes Operator Resource Reference Guides"
+sidebar_label: Teleport Kubernetes Operator
+description: "Comprehensive guides to fields available in Kubernetes resources you can apply to manage Teleport resources with the Teleport Kubernetes operator"
+tags:
+ - infrastructure-as-code
+ - reference
+ - platform-wide
+---
+
+The Teleport Kubernetes operator allows cluster administrators to manage dynamic
+resources as Kubernetes resources using `kubectl` or a continuous deployment
+tool like Argo CD. The guides in this section of the documentation include
+comprehensive lists of fields for each supported resource.
+
+## Getting started with the Kubernetes operator
+
+If you are getting started with the Teleport Kubernetes operator, we recommend
+reading the [introductory
+guide](../../../zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx)
+to setting up and using the operator. 
+
+For guidance on using the Teleport Kubernetes operator to manage the dynamic
+resources that you would typically see in a Teleport cluster, such as roles and
+users, see [Managing
+Resources](../../../zero-trust-access/infrastructure-as-code/managing-resources/managing-resources.mdx).
+
+## Selecting a reference guide
+
+The Kubernetes operator resource reference guides are organized by resource
+version. Select a resource version from the sidebar to view supported fields.
+
+
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-accesslists.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-accesslists.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-accesslists.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-accesslists.mdx
index 5b9d66fc1ea3e..a1c36958b3dca 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-accesslists.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-accesslists.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportAccessList
 description: Provides a comprehensive list of fields in the TeleportAccessList resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -34,6 +33,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |owners|[][object](#specowners-items)|owners is a list of owners of the Access List.|
 |ownership_requires|[object](#specownership_requires)|ownership_requires describes the requirements for a user to be an owner of the Access List. For ownership of an Access List to be effective, the user must meet the requirements of ownership_requires and must be in the owners list.|
 |title|string|title is a plaintext short description of the Access List.|
+|type|string|type can be an empty string which denotes a regular Access List, "scim" which represents an Access List created from SCIM group or "static" for Access Lists managed by IaC tools.|
 
 ### spec.audit
 
diff --git a/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-appsv3.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-appsv3.mdx
new file mode 100644
index 0000000000000..d1640f0e7ab7f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-appsv3.mdx
@@ -0,0 +1,128 @@
+---
+title: TeleportAppV3
+description: Provides a comprehensive list of fields in the TeleportAppV3 resource available through the Teleport Kubernetes operator
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/}
+
+This guide is a comprehensive reference to the fields in the `TeleportAppV3`
+resource, which you can apply after installing the Teleport Kubernetes operator.
+
+
+## resources.teleport.dev/v1
+
+**apiVersion:** resources.teleport.dev/v1
+
+|Field|Type|Description|
+|---|---|---|
+|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources|
+|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds|
+|metadata|object||
+|spec|[object](#spec)|App resource definition v3 from Teleport|
+
+### spec
+
+|Field|Type|Description|
+|---|---|---|
+|UserGroups|[]string|UserGroups are a list of user group IDs that this app is associated with.|
+|aws|[object](#specaws)|AWS contains additional options for AWS applications.|
+|cloud|string|Cloud identifies the cloud instance the app represents.|
+|cors|[object](#speccors)|CORSPolicy defines the Cross-Origin Resource Sharing settings for the app.|
+|dynamic_labels|[object](#specdynamic_labels)|DynamicLabels are the app's command labels.|
+|identity_center|[object](#specidentity_center)|IdentityCenter encasulates AWS identity-center specific information. Only valid for Identity Center account apps.|
+|insecure_skip_verify|boolean|InsecureSkipVerify disables app's TLS certificate verification.|
+|integration|string|Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.|
+|mcp|[object](#specmcp)|MCP contains MCP server related configurations.|
+|public_addr|string|PublicAddr is the public address the application is accessible at.|
+|required_app_names|[]string|RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate along side this app.|
+|rewrite|[object](#specrewrite)|Rewrite is a list of rewriting rules to apply to requests and responses.|
+|tcp_ports|[][object](#spectcp_ports-items)|TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol.|
+|uri|string|URI is the web app endpoint.|
+|use_any_proxy_public_addr|boolean|UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.|
+
+### spec.aws
+
+|Field|Type|Description|
+|---|---|---|
+|external_id|string|ExternalID is the AWS External ID used when assuming roles in this app.|
+|roles_anywhere_profile|[object](#specawsroles_anywhere_profile)|RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps.|
+
+### spec.aws.roles_anywhere_profile
+
+|Field|Type|Description|
+|---|---|---|
+|accept_role_session_name|boolean|Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName|
+|profile_arn|string|ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.|
+
+### spec.cors
+
+|Field|Type|Description|
+|---|---|---|
+|allow_credentials|boolean|allow_credentials indicates whether credentials are allowed.|
+|allowed_headers|[]string|allowed_headers specifies which headers can be used when accessing the app.|
+|allowed_methods|[]string|allowed_methods specifies which methods are allowed when accessing the app.|
+|allowed_origins|[]string|allowed_origins specifies which origins are allowed to access the app.|
+|exposed_headers|[]string|exposed_headers indicates which headers are made available to scripts via the browser.|
+|max_age|integer|max_age indicates how long (in seconds) the results of a preflight request can be cached.|
+
+### spec.dynamic_labels
+
+|Field|Type|Description|
+|---|---|---|
+|key|string||
+|value|[object](#specdynamic_labelsvalue)||
+
+### spec.dynamic_labels.value
+
+|Field|Type|Description|
+|---|---|---|
+|command|[]string|Command is a command to run|
+|period|string|Period is a time between command runs|
+|result|string|Result captures standard output|
+
+### spec.identity_center
+
+|Field|Type|Description|
+|---|---|---|
+|account_id|string|Account ID is the AWS-assigned ID of the account|
+|permission_sets|[][object](#specidentity_centerpermission_sets-items)|PermissionSets lists the available permission sets on the given account|
+
+### spec.identity_center.permission_sets items
+
+|Field|Type|Description|
+|---|---|---|
+|arn|string|ARN is the fully-formed ARN of the Permission Set.|
+|assignment_name|string|AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.|
+|name|string|Name is the human-readable name of the Permission Set.|
+
+### spec.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|args|[]string|Args to execute with the command.|
+|command|string|Command to launch stdio-based MCP servers.|
+|run_as_host_user|string|RunAsHostUser is the host user account under which the command will be executed. Required for stdio-based MCP servers.|
+
+### spec.rewrite
+
+|Field|Type|Description|
+|---|---|---|
+|headers|[][object](#specrewriteheaders-items)|Headers is a list of headers to inject when passing the request over to the application.|
+|jwt_claims|string|JWTClaims configures whether roles/traits are included in the JWT token.|
+|redirect|[]string|Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.|
+
+### spec.rewrite.headers items
+
+|Field|Type|Description|
+|---|---|---|
+|name|string|Name is the http header name.|
+|value|string|Value is the http header value.|
+
+### spec.tcp_ports items
+
+|Field|Type|Description|
+|---|---|---|
+|end_port|integer|EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.|
+|port|integer|Port describes the start of the range. It must be between 1 and 65535.|
+
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx
similarity index 89%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx
index f5cd8d33db3b0..08201aea60e55 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateconfigsv1.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportAutoupdateConfigV1
 description: Provides a comprehensive list of fields in the TeleportAutoupdateConfigV1 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -48,6 +47,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 
 |Field|Type|Description|
 |---|---|---|
+|canary_count|integer|canary_count is the number of canary agents that will be updated before the whole group is updated. when set to 0, the group does not enter the canary phase. This number is capped to 5. This number must always be lower than the total number of agents in the group, else the rollout will be stuck.|
 |days|[]string|days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"|
 |name|string|name of the group|
 |start_hour|integer|start_hour to initiate update|
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx
similarity index 89%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx
index 2c2e33e8195cb..a044e78edac11 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-autoupdateversionsv1.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportAutoupdateVersionV1
 description: Provides a comprehensive list of fields in the TeleportAutoupdateVersionV1 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -35,8 +34,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |---|---|---|
 |mode|string|autoupdate_mode to use for the rollout|
 |schedule|string|schedule to use for the rollout|
-|start_version|string|start_version is the version to update from.|
-|target_version|string|target_version is the version to update to.|
+|start_version|string|start_version is the version used for newly installed agents before their update window.|
+|target_version|string|target_version is the version that all agents will update to during their update window.|
 
 ### spec.tools
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-botsv1.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-botsv1.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-botsv1.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-botsv1.mdx
index 9ad6792854b8b..27c63b0ddab74 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-botsv1.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-botsv1.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportBotV1
 description: Provides a comprehensive list of fields in the TeleportBotV1 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-databasesv3.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-databasesv3.mdx
new file mode 100644
index 0000000000000..2f2eaa7897627
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-databasesv3.mdx
@@ -0,0 +1,244 @@
+---
+title: TeleportDatabaseV3
+description: Provides a comprehensive list of fields in the TeleportDatabaseV3 resource available through the Teleport Kubernetes operator
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/}
+
+This guide is a comprehensive reference to the fields in the `TeleportDatabaseV3`
+resource, which you can apply after installing the Teleport Kubernetes operator.
+
+
+## resources.teleport.dev/v1
+
+**apiVersion:** resources.teleport.dev/v1
+
+|Field|Type|Description|
+|---|---|---|
+|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources|
+|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds|
+|metadata|object||
+|spec|[object](#spec)|Database resource definition v3 from Teleport|
+
+### spec
+
+|Field|Type|Description|
+|---|---|---|
+|ad|[object](#specad)|AD is the Active Directory configuration for the database.|
+|admin_user|[object](#specadmin_user)|AdminUser is the database admin user for automatic user provisioning.|
+|aws|[object](#specaws)|AWS contains AWS specific settings for RDS/Aurora/Redshift databases.|
+|azure|[object](#specazure)|Azure contains Azure specific database metadata.|
+|ca_cert|string|CACert is the PEM-encoded database CA certificate.  DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.|
+|dynamic_labels|[object](#specdynamic_labels)|DynamicLabels is the database dynamic labels.|
+|gcp|[object](#specgcp)|GCP contains parameters specific to GCP Cloud SQL databases.|
+|mongo_atlas|[object](#specmongo_atlas)|MongoAtlas contains Atlas metadata about the database.|
+|mysql|[object](#specmysql)|MySQL is an additional section with MySQL database options.|
+|oracle|[object](#specoracle)|Oracle is an additional Oracle configuration options.|
+|protocol|string|Protocol is the database protocol: postgres, mysql, mongodb, etc.|
+|tls|[object](#spectls)|TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name.|
+|uri|string|URI is the database connection endpoint.|
+
+### spec.ad
+
+|Field|Type|Description|
+|---|---|---|
+|domain|string|Domain is the Active Directory domain the database resides in.|
+|kdc_host_name|string|KDCHostName is the host name for a KDC for x509 Authentication.|
+|keytab_file|string|KeytabFile is the path to the Kerberos keytab file.|
+|krb5_file|string|Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.|
+|ldap_cert|string|LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.|
+|ldap_service_account_name|string|LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.|
+|ldap_service_account_sid|string|LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.|
+|spn|string|SPN is the service principal name for the database.|
+
+### spec.admin_user
+
+|Field|Type|Description|
+|---|---|---|
+|default_database|string|DefaultDatabase is the database that the privileged database user logs into by default.  Depending on the database type, this database may be used to store procedures or data for managing database users.|
+|name|string|Name is the username of the privileged database user.|
+
+### spec.aws
+
+|Field|Type|Description|
+|---|---|---|
+|account_id|string|AccountID is the AWS account ID this database belongs to.|
+|assume_role_arn|string|AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.|
+|docdb|[object](#specawsdocdb)|DocumentDB contains Amazon DocumentDB-specific metadata.|
+|elasticache|[object](#specawselasticache)|ElastiCache contains Amazon ElastiCache Redis-specific metadata.|
+|elasticache_serverless|[object](#specawselasticache_serverless)|ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.|
+|external_id|string|ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.|
+|iam_policy_status|string or integer|IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database. Can be either the string or the integer representation of each option.|
+|memorydb|[object](#specawsmemorydb)|MemoryDB contains AWS MemoryDB specific metadata.|
+|opensearch|[object](#specawsopensearch)|OpenSearch contains AWS OpenSearch specific metadata.|
+|rds|[object](#specawsrds)|RDS contains RDS specific metadata.|
+|rdsproxy|[object](#specawsrdsproxy)|RDSProxy contains AWS Proxy specific metadata.|
+|redshift|[object](#specawsredshift)|Redshift contains Redshift specific metadata.|
+|redshift_serverless|[object](#specawsredshift_serverless)|RedshiftServerless contains Amazon Redshift Serverless-specific metadata.|
+|region|string|Region is a AWS cloud region.|
+|secret_store|[object](#specawssecret_store)|SecretStore contains secret store configurations.|
+|session_tags|[object](#specawssession_tags)|SessionTags is a list of AWS STS session tags.|
+
+### spec.aws.docdb
+
+|Field|Type|Description|
+|---|---|---|
+|cluster_id|string|ClusterID is the cluster identifier.|
+|endpoint_type|string|EndpointType is the type of the endpoint.|
+|instance_id|string|InstanceID is the instance identifier.|
+
+### spec.aws.elasticache
+
+|Field|Type|Description|
+|---|---|---|
+|endpoint_type|string|EndpointType is the type of the endpoint.|
+|replication_group_id|string|ReplicationGroupID is the Redis replication group ID.|
+|transit_encryption_enabled|boolean|TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.|
+|user_group_ids|[]string|UserGroupIDs is a list of user group IDs.|
+
+### spec.aws.elasticache_serverless
+
+|Field|Type|Description|
+|---|---|---|
+|cache_name|string|CacheName is an ElastiCache Serverless cache name.|
+
+### spec.aws.memorydb
+
+|Field|Type|Description|
+|---|---|---|
+|acl_name|string|ACLName is the name of the ACL associated with the cluster.|
+|cluster_name|string|ClusterName is the name of the MemoryDB cluster.|
+|endpoint_type|string|EndpointType is the type of the endpoint.|
+|tls_enabled|boolean|TLSEnabled indicates whether in-transit encryption (TLS) is enabled.|
+
+### spec.aws.opensearch
+
+|Field|Type|Description|
+|---|---|---|
+|domain_id|string|DomainID is the ID of the domain.|
+|domain_name|string|DomainName is the name of the domain.|
+|endpoint_type|string|EndpointType is the type of the endpoint.|
+
+### spec.aws.rds
+
+|Field|Type|Description|
+|---|---|---|
+|cluster_id|string|ClusterID is the RDS cluster (Aurora) identifier.|
+|iam_auth|boolean|IAMAuth indicates whether database IAM authentication is enabled.|
+|instance_id|string|InstanceID is the RDS instance identifier.|
+|resource_id|string|ResourceID is the RDS instance resource identifier (db-xxx).|
+|security_groups|[]string|SecurityGroups is a list of attached security groups for the RDS instance.|
+|subnets|[]string|Subnets is a list of subnets for the RDS instance.|
+|vpc_id|string|VPCID is the VPC where the RDS is running.|
+
+### spec.aws.rdsproxy
+
+|Field|Type|Description|
+|---|---|---|
+|custom_endpoint_name|string|CustomEndpointName is the identifier of an RDS Proxy custom endpoint.|
+|name|string|Name is the identifier of an RDS Proxy.|
+|resource_id|string|ResourceID is the RDS instance resource identifier (prx-xxx).|
+
+### spec.aws.redshift
+
+|Field|Type|Description|
+|---|---|---|
+|cluster_id|string|ClusterID is the Redshift cluster identifier.|
+
+### spec.aws.redshift_serverless
+
+|Field|Type|Description|
+|---|---|---|
+|endpoint_name|string|EndpointName is the VPC endpoint name.|
+|workgroup_id|string|WorkgroupID is the workgroup ID.|
+|workgroup_name|string|WorkgroupName is the workgroup name.|
+
+### spec.aws.secret_store
+
+|Field|Type|Description|
+|---|---|---|
+|key_prefix|string|KeyPrefix specifies the secret key prefix.|
+|kms_key_id|string|KMSKeyID specifies the AWS KMS key for encryption.|
+
+### spec.aws.session_tags
+
+|Field|Type|Description|
+|---|---|---|
+|key|string||
+|value|string||
+
+### spec.azure
+
+|Field|Type|Description|
+|---|---|---|
+|is_flexi_server|boolean|IsFlexiServer is true if the database is an Azure Flexible server.|
+|name|string|Name is the Azure database server name.|
+|redis|[object](#specazureredis)|Redis contains Azure Cache for Redis specific database metadata.|
+|resource_id|string|ResourceID is the Azure fully qualified ID for the resource.|
+
+### spec.azure.redis
+
+|Field|Type|Description|
+|---|---|---|
+|clustering_policy|string|ClusteringPolicy is the clustering policy for Redis Enterprise.|
+
+### spec.dynamic_labels
+
+|Field|Type|Description|
+|---|---|---|
+|key|string||
+|value|[object](#specdynamic_labelsvalue)||
+
+### spec.dynamic_labels.value
+
+|Field|Type|Description|
+|---|---|---|
+|command|[]string|Command is a command to run|
+|period|string|Period is a time between command runs|
+|result|string|Result captures standard output|
+
+### spec.gcp
+
+|Field|Type|Description|
+|---|---|---|
+|alloydb|[object](#specgcpalloydb)|AlloyDB contains AlloyDB specific configuration elements.|
+|instance_id|string|InstanceID is the Cloud SQL instance ID.|
+|project_id|string|ProjectID is the GCP project ID the Cloud SQL instance resides in.|
+
+### spec.gcp.alloydb
+
+|Field|Type|Description|
+|---|---|---|
+|endpoint_override|string|EndpointOverride is an override of endpoint address to use.|
+|endpoint_type|string|EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".|
+
+### spec.mongo_atlas
+
+|Field|Type|Description|
+|---|---|---|
+|name|string|Name is the Atlas database instance name.|
+
+### spec.mysql
+
+|Field|Type|Description|
+|---|---|---|
+|server_version|string|ServerVersion is the server version reported by DB proxy if the runtime information is not available.|
+
+### spec.oracle
+
+|Field|Type|Description|
+|---|---|---|
+|audit_user|string|AuditUser is the name of the Oracle database user that should be used to access the internal audit trail.|
+|retry_count|integer|RetryCount is the maximum number of times to retry connecting to a host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.|
+|shuffle_hostnames|boolean|ShuffleHostnames, when true, randomizes the order of hosts to connect to from the provided list.|
+
+### spec.tls
+
+|Field|Type|Description|
+|---|---|---|
+|ca_cert|string|CACert is an optional user provided CA certificate used for verifying database TLS connection.|
+|mode|string or integer|Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure". Can be either the string or the integer representation of each option.|
+|server_name|string|ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.|
+|trust_system_cert_pool|boolean|TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.|
+
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-githubconnectors.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-githubconnectors.mdx
similarity index 94%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-githubconnectors.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-githubconnectors.mdx
index 0b95b075c0a7c..ee81a15560231 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-githubconnectors.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-githubconnectors.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportGithubConnector
 description: Provides a comprehensive list of fields in the TeleportGithubConnector resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -34,6 +33,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |endpoint_url|string|EndpointURL is the URL of the GitHub instance this connector is for.|
 |redirect_url|string|RedirectURL is the authorization callback URL.|
 |teams_to_roles|[][object](#specteams_to_roles-items)|TeamsToRoles maps Github team memberships onto allowed roles.|
+|user_matchers|[]string|UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.|
 
 ### spec.client_redirect_settings
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-loginrules.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-loginrules.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-loginrules.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-loginrules.mdx
index 4befea3b164f3..cbc20e04bcf09 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-loginrules.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-loginrules.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportLoginRule
 description: Provides a comprehensive list of fields in the TeleportLoginRule resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oidcconnectors.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oidcconnectors.mdx
new file mode 100644
index 0000000000000..da59d5d8b2e29
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oidcconnectors.mdx
@@ -0,0 +1,85 @@
+---
+title: TeleportOIDCConnector
+description: Provides a comprehensive list of fields in the TeleportOIDCConnector resource available through the Teleport Kubernetes operator
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/}
+
+This guide is a comprehensive reference to the fields in the `TeleportOIDCConnector`
+resource, which you can apply after installing the Teleport Kubernetes operator.
+
+
+## resources.teleport.dev/v3
+
+**apiVersion:** resources.teleport.dev/v3
+
+|Field|Type|Description|
+|---|---|---|
+|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources|
+|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds|
+|metadata|object||
+|spec|[object](#spec)|OIDCConnector resource definition v3 from Teleport|
+
+### spec
+
+|Field|Type|Description|
+|---|---|---|
+|acr_values|string|ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.|
+|allow_unverified_email|boolean|AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.|
+|claims_to_roles|[][object](#specclaims_to_roles-items)|ClaimsToRoles specifies a dynamic mapping from claims to roles.|
+|client_id|string|ClientID is the id of the authentication client (Teleport Auth Service).|
+|client_redirect_settings|[object](#specclient_redirect_settings)|ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones.|
+|client_secret|string|ClientSecret is used to authenticate the client. This field supports secret lookup. See the operator documentation for more details.|
+|display|string|Display is the friendly name for this provider.|
+|entra_id_groups_provider|[object](#specentra_id_groups_provider)|EntraIDGroupsProvider configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for the "groups" claim when the user's group membership exceeds 200 max item limit.|
+|google_admin_email|string|GoogleAdminEmail is the email of a google admin to impersonate.|
+|google_service_account|string|GoogleServiceAccount is a string containing google service account credentials.|
+|google_service_account_uri|string|GoogleServiceAccountURI is a path to a google service account uri.|
+|issuer_url|string|IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.|
+|max_age|string|MaxAge is the amount of time that user logins are valid for. If a user logs in, but then does not login again within this time period, they will be forced to re-authenticate.|
+|mfa|[object](#specmfa)|MFASettings contains settings to enable SSO MFA checks through this auth connector.|
+|pkce_mode|string|PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"|
+|prompt|string|Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|
+|provider|string|Provider is the external identity provider.|
+|redirect_url|[]string|RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.|
+|request_object_mode|string|RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters.|
+|scope|[]string|Scope specifies additional scopes set by provider.|
+|user_matchers|[]string|UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.|
+|username_claim|string|UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.|
+
+### spec.claims_to_roles items
+
+|Field|Type|Description|
+|---|---|---|
+|claim|string|Claim is a claim name.|
+|roles|[]string|Roles is a list of static teleport roles to match.|
+|value|string|Value is a claim value to match.|
+
+### spec.client_redirect_settings
+
+|Field|Type|Description|
+|---|---|---|
+|allowed_https_hostnames|[]string|a list of hostnames allowed for https client redirect URLs|
+|insecure_allowed_cidr_ranges|[]string|a list of CIDRs allowed for HTTP or HTTPS client redirect URLs|
+
+### spec.entra_id_groups_provider
+
+|Field|Type|Description|
+|---|---|---|
+|disabled|boolean|Disabled specifies that the groups provider should be disabled even when Entra ID responds with a groups claim source. User may choose to disable it if they are using integrations such as SCIM or similar groups importer as connector based role mapping may be not needed in such a scenario.|
+|graph_endpoint|string|GraphEndpoint is a Microsoft Graph API endpoint. The groups claim source endpoint provided by Entra ID points to the now-retired Azure AD Graph endpoint ("https://graph.windows.net"). To convert it to the newer Microsoft Graph API endpoint, Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com"). Update GraphEndpoint to point to a different Microsoft Graph national cloud deployment endpoint.|
+|group_type|string|GroupType is a user group type filter. Defaults to "security-groups". Value can be "security-groups", "directory-roles", "all-groups".|
+
+### spec.mfa
+
+|Field|Type|Description|
+|---|---|---|
+|acr_values|string|AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.|
+|client_id|string|ClientID is the OIDC OAuth app client ID.|
+|client_secret|string|ClientSecret is the OIDC OAuth app client secret.|
+|enabled|boolean|Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.|
+|max_age|string|MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.|
+|prompt|string|Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|
+|request_object_mode|string|RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for the MFA client.|
+
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-oktaimportrules.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oktaimportrules.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-oktaimportrules.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oktaimportrules.mdx
index c28c50efeefc2..1b4c910f77204 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-oktaimportrules.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-oktaimportrules.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportOktaImportRule
 description: Provides a comprehensive list of fields in the TeleportOktaImportRule resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx
index 4f87f08676fda..d1241b6c184a1 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-openssheiceserversv2.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportOpenSSHEICEServerV2
 description: Provides a comprehensive list of fields in the TeleportOpenSSHEICEServerV2 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -33,6 +32,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |peer_addr|string|PeerAddr is the address a proxy server is reachable at by its peer proxies.|
 |proxy_ids|[]string|ProxyIDs is a list of proxy IDs this server is expected to be connected to.|
 |public_addrs|[]string|PublicAddrs is a list of public addresses where this server can be reached.|
+|relay_group|string|the name of the Relay group that the server is connected to|
+|relay_ids|[]string|the list of Relay host IDs that the server is connected to|
 |rotation|[object](#specrotation)|Rotation specifies server rotation|
 |use_tunnel|boolean|UseTunnel indicates that connections to this server should occur over a reverse tunnel.|
 |version|string|TeleportVersion is the teleport version that the server is running on|
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-opensshserversv2.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-opensshserversv2.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-opensshserversv2.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-opensshserversv2.mdx
index 3961366039613..26cc9c60bda10 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-opensshserversv2.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-opensshserversv2.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportOpenSSHServerV2
 description: Provides a comprehensive list of fields in the TeleportOpenSSHServerV2 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -33,6 +32,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |peer_addr|string|PeerAddr is the address a proxy server is reachable at by its peer proxies.|
 |proxy_ids|[]string|ProxyIDs is a list of proxy IDs this server is expected to be connected to.|
 |public_addrs|[]string|PublicAddrs is a list of public addresses where this server can be reached.|
+|relay_group|string|the name of the Relay group that the server is connected to|
+|relay_ids|[]string|the list of Relay host IDs that the server is connected to|
 |rotation|[object](#specrotation)|Rotation specifies server rotation|
 |use_tunnel|boolean|UseTunnel indicates that connections to this server should occur over a reverse tunnel.|
 |version|string|TeleportVersion is the teleport version that the server is running on|
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-provisiontokens.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens.mdx
similarity index 93%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-provisiontokens.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens.mdx
index 82d12d72fa590..d2a82ce98f06b 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-provisiontokens.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-provisiontokens.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportProvisionToken
 description: Provides a comprehensive list of fields in the TeleportProvisionToken resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -34,6 +33,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |bot_name|string|BotName is the name of the bot this token grants access to, if any|
 |bound_keypair|[object](#specbound_keypair)|BoundKeypair allows the configuration of options specific to the "bound_keypair" join method.|
 |circleci|[object](#speccircleci)|CircleCI allows the configuration of options specific to the "circleci" join method.|
+|env0|[object](#specenv0)|Env0 allows the configuration of options specific to the "env0" join method.|
 |gcp|[object](#specgcp)|GCP allows the configuration of options specific to the "gcp" join method.|
 |github|[object](#specgithub)|GitHub allows the configuration of options specific to the "github" join method.|
 |gitlab|[object](#specgitlab)|GitLab allows the configuration of options specific to the "gitlab" join method.|
@@ -143,6 +143,28 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |context_id|string||
 |project_id|string||
 
+### spec.env0
+
+|Field|Type|Description|
+|---|---|---|
+|allow|[][object](#specenv0allow-items)|Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token.|
+
+### spec.env0.allow items
+
+|Field|Type|Description|
+|---|---|---|
+|deployer_email|string||
+|deployment_type|string||
+|env0_tag|string||
+|environment_id|string||
+|environment_name|string||
+|organization_id|string||
+|project_id|string||
+|project_name|string||
+|template_id|string||
+|template_name|string||
+|workspace_name|string||
+
 ### spec.gcp
 
 |Field|Type|Description|
@@ -213,8 +235,9 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |allow|[][object](#speckubernetesallow-items)|Allow is a list of Rules, nodes using this token must match one allow rule to use this token.|
+|oidc|[object](#speckubernetesoidc)|OIDCConfig configures the `oidc` type.|
 |static_jwks|[object](#speckubernetesstatic_jwks)|StaticJWKS is the configuration specific to the `static_jwks` type.|
-|type|string|Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.|
+|type|string|Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults to `in_cluster`.|
 
 ### spec.kubernetes.allow items
 
@@ -222,6 +245,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |---|---|---|
 |service_account|string||
 
+### spec.kubernetes.oidc
+
+|Field|Type|Description|
+|---|---|---|
+|insecure_allow_http_issuer|boolean||
+|issuer|string||
+
 ### spec.kubernetes.static_jwks
 
 |Field|Type|Description|
@@ -238,6 +268,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 
 |Field|Type|Description|
 |---|---|---|
+|instances|[]string||
 |parent_compartments|[]string||
 |regions|[]string||
 |tenancy|string||
@@ -247,6 +278,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |allow|[][object](#specspaceliftallow-items)|Allow is a list of Rules, nodes using this token must match one allow rule to use this token.|
+|enable_glob_matching|boolean|EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.|
 |hostname|string|Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`|
 
 ### spec.spacelift.allow items
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-roles.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-roles.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles.mdx
index 128657fc8d12e..4320678c237d0 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-roles.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportRole
 description: Provides a comprehensive list of fields in the TeleportRole resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -64,6 +63,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specallowrequest)||
@@ -124,6 +124,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.allow.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.allow.request
 
 |Field|Type|Description|
@@ -158,6 +164,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.allow.request.thresholds items
 
@@ -247,6 +254,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specdenyrequest)||
@@ -307,6 +315,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.deny.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.deny.request
 
 |Field|Type|Description|
@@ -341,6 +355,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.deny.request.thresholds items
 
@@ -533,6 +548,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specallowrequest)||
@@ -593,6 +609,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.allow.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.allow.request
 
 |Field|Type|Description|
@@ -627,6 +649,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.allow.request.thresholds items
 
@@ -716,6 +739,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specdenyrequest)||
@@ -776,6 +800,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.deny.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.deny.request
 
 |Field|Type|Description|
@@ -810,6 +840,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.deny.request.thresholds items
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv6.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-rolesv6.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6.mdx
index 06cff4ba93001..90cb1e128fb28 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv6.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportRoleV6
 description: Provides a comprehensive list of fields in the TeleportRoleV6 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -64,6 +63,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specallowrequest)||
@@ -124,6 +124,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.allow.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.allow.request
 
 |Field|Type|Description|
@@ -158,6 +164,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.allow.request.thresholds items
 
@@ -247,6 +254,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specdenyrequest)||
@@ -307,6 +315,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.deny.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.deny.request
 
 |Field|Type|Description|
@@ -341,6 +355,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.deny.request.thresholds items
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv7.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-rolesv7.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7.mdx
index 140930e3b82b2..d1d8f54e0cad7 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv7.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportRoleV7
 description: Provides a comprehensive list of fields in the TeleportRoleV7 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -64,6 +63,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specallowrequest)||
@@ -124,6 +124,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.allow.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.allow.request
 
 |Field|Type|Description|
@@ -158,6 +164,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.allow.request.thresholds items
 
@@ -247,6 +254,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specdenyrequest)||
@@ -307,6 +315,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.deny.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.deny.request
 
 |Field|Type|Description|
@@ -341,6 +355,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.deny.request.thresholds items
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv8.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv8.mdx
similarity index 96%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-rolesv8.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv8.mdx
index fc64854b6e677..ca68d99b68531 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-rolesv8.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv8.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportRoleV8
 description: Provides a comprehensive list of fields in the TeleportRoleV8 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -64,6 +63,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specallowrequest)||
@@ -124,6 +124,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.allow.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.allow.request
 
 |Field|Type|Description|
@@ -158,6 +164,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.allow.request.thresholds items
 
@@ -247,6 +254,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.|
 |kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate|
 |logins|[]string|Logins is a list of *nix system logins.|
+|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.|
 |node_labels|object|NodeLabels is a map of node labels (used to dynamically grant access to nodes).|
 |node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.|
 |request|[object](#specdenyrequest)||
@@ -307,6 +315,12 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |namespace|string|Namespace is the resource namespace. It supports wildcards.|
 |verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.|
 
+### spec.deny.mcp
+
+|Field|Type|Description|
+|---|---|---|
+|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.|
+
 ### spec.deny.request
 
 |Field|Type|Description|
@@ -341,6 +355,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |Field|Type|Description|
 |---|---|---|
 |mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.|
+|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.|
 
 ### spec.deny.request.thresholds items
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-samlconnectors.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-samlconnectors.mdx
similarity index 94%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-samlconnectors.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-samlconnectors.mdx
index 699416850551b..b02c05cbd230e 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-samlconnectors.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-samlconnectors.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportSAMLConnector
 description: Provides a comprehensive list of fields in the TeleportSAMLConnector resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
@@ -37,6 +36,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |entity_descriptor|string|EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.|
 |entity_descriptor_url|string|EntityDescriptorURL is a URL that supplies a configuration XML.|
 |force_authn|string or integer|ForceAuthn specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO. Can be either the string or the integer representation of each option.|
+|include_subject|boolean|IncludeSubject is a flag that indicates whether the Subject element is included in the SAML authentication request. Defaults to false. Note: Some IdPs will reject requests that contain a Subject.|
 |issuer|string|Issuer is the identity provider issuer.|
 |mfa|[object](#specmfa)|MFASettings contains settings to enable SSO MFA checks through this auth connector.|
 |preferred_request_binding|string|PreferredRequestBinding is a preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.|
@@ -45,6 +45,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
 |signing_key_pair|[object](#specsigning_key_pair)|SigningKeyPair is an x509 key pair used to sign AuthnRequest.|
 |single_logout_url|string|SingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.|
 |sso|string|SSO is the URL of the identity provider's SSO service.|
+|user_matchers|[]string|UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.|
 
 ### spec.assertion_key_pair
 
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-trustedclustersv2.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-trustedclustersv2.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-trustedclustersv2.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-trustedclustersv2.mdx
index 8728b51b2ab5c..2d26501c8abad 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-trustedclustersv2.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-trustedclustersv2.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportTrustedClusterV2
 description: Provides a comprehensive list of fields in the TeleportTrustedClusterV2 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-users.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-users.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-users.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-users.mdx
index f4559d680a7ee..b3f3137837f80 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-users.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-users.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportUser
 description: Provides a comprehensive list of fields in the TeleportUser resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx
similarity index 99%
rename from docs/pages/reference/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx
rename to docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx
index e5854fb054844..f7db4d17e26fe 100644
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx
+++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-workloadidentitiesv1.mdx
@@ -1,7 +1,6 @@
 ---
 title: TeleportWorkloadIdentityV1
 description: Provides a comprehensive list of fields in the TeleportWorkloadIdentityV1 resource available through the Teleport Kubernetes operator
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/access-monitoring-rule.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/access-monitoring-rule.mdx
new file mode 100644
index 0000000000000..10279cbd63b7a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/access-monitoring-rule.mdx
@@ -0,0 +1,82 @@
+---
+title: Access Monitoring Rule Resource Reference
+sidebar_label: Access Monitoring rule
+description: Provides a comprehensive list of fields for the Teleport access monitoring rule resource.
+---
+
+Access monitoring rules allows cluster administrators to monitor Access Requests
+and apply notification routing and automatic review rules.
+
+```yaml
+kind: access_monitoring_rule
+version: v1
+metadata:
+  name: example_rule
+spec:
+  # subjects specifies the kinds of subjects to monitor.
+  # Possible values: "access_request"
+  subjects:
+  - access_request
+
+  # condition specifies the conditions that should be met to apply the access
+  # monitoring rule. The condition accepts a predicate expression which must
+  # evaluate to a boolean value.
+  #
+  # This condition would be satisfied if:
+  # - `access` role is requested
+  # - all requested resources have the label `env: dev`
+  # - requesting user has the `team: dev` user trait.
+  condition: |-
+    contains_all(set("access"), access_request.spec.roles) &&
+    access_request.spec.resource_labels_intersection["env"].contains("dev") &&
+    contains_any(user.traits["team"], set("dev"))
+
+  # Optional: desired_state specifies the desired reconciled state of the access
+  # request after the rule is applied. This field must be set to "reviewed" to
+  # enable automatic reviews.
+  # Possible values: "reviewed".
+  desired_state: reviewed
+
+  # Optional: automatic_review configures the automatic review rules.
+  automatic_review:
+    # integration specifies the name of an external integration source used to
+    # help determine if a requesting user satisfies the rule conditions.
+    # Use "builtin" to specify no external integration.
+    # Possible values: "builtin"
+    integration: builtin
+
+    # decision determines whether to automatically approve or deny the
+    # access request.
+    # Possible values: "APPROVED" or "DENIED"
+    decision: APPROVED
+
+  # Optional: notification configures notification routing rules.
+  notification:
+    # name specifies the external integration to which the notifications should
+    # be routed.
+    # Possible values: "email", "discord", "slack", "pagerduty", "jira",
+    # "mattermost", "msteams", "opsgenie", "servicenow", "datadog"
+    name: email
+
+    # recipients specifies the list of recipients to be notified when the
+    # access monitoring rule is applied.
+    recipients:
+    - example@goteleport.com
+```
+
+Accepted fields within the condition predicate expression:
+| Field                                            | Description                                                         |
+| ------------------------------------------------ | ------------------------------------------------------------------- |
+| access_request.spec.roles                        | The set of roles requested.                                         |
+| access_request.spec.suggested_reviewers          | The set of reviewers specified in the request.                      |
+| access_request.spec.system_annotations           | A map of system annotations on the request.                         |
+| access_request.spec.user                         | The requesting user.                                                |
+| access_request.spec.request_reason               | The request reason.                                                 |
+| access_request.spec.creation_time                | The creation time of the request.                                   |
+| access_request.spec.expiry                       | The expiry time of the request.                                     |
+| access_request.spec.resource_labels_intersection | A map containing the intersection of all requested resource labels. |
+| access_request.spec.resource_labels_union        | A map containing the union of all requested resource labels.        |
+| user.traits                                      | A map of traits of the requesting user.                             |
+
+See [Predicate Language](../../access-controls/predicate-language.mdx) for more details.
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-report.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-report.mdx
new file mode 100644
index 0000000000000..0824eea124d98
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-report.mdx
@@ -0,0 +1,14 @@
+---
+title: Auto-Update Agent Report Resource Reference
+sidebar_label: Auto-update Agent Report
+description: Provides a comprehensive list of fields for the Teleport auto-update agent report resource.
+---
+
+The auto-update agent report is an internal resource used by the Auth Service to
+track which agent is running which version and decide if the update can
+progress.
+
+This resource should not be edited by humans.
+
+(!docs/pages/includes/reference/resources/autoupdate_agent_report.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-rollout.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-rollout.mdx
new file mode 100644
index 0000000000000..1d00d54b7c979
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-agent-rollout.mdx
@@ -0,0 +1,15 @@
+---
+title: Auto-Update Agent Rollout Resource Reference
+sidebar_label: Auto-Update Agent Rollout
+description: Provides a comprehensive list of fields for the Teleport auto-update agent rollout resource.
+---
+
+The auto-update agent rollout resource allows cluster administrators to view the
+current agent rollout for Teleport Agent Managed Updates (v2).
+
+This resource should not be edited by humans.
+
+(!docs/pages/includes/reference/resources/autoupdate_agent_rollout.mdx!)
+
+See [Teleport Agent Managed Updates](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for more details.
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-config.mdx
new file mode 100644
index 0000000000000..58c0199692e0e
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-config.mdx
@@ -0,0 +1,22 @@
+---
+title: Auto-Update Config Resource Reference
+sidebar_label: Auto-Update Config
+description: Provides a comprehensive list of fields for the Teleport auto-update config resource.
+---
+
+The auto-update config resource contains configuration options for Teleport
+Agent and client tool Managed Updates (v2).
+
+<Admonition type="warning">
+The `autoupdate_config` and `autoupdate_version` resources configure Managed
+Updates v2 and Managed Updates v1.
+
+`cluster_maintenance_config` above configures only Managed Updates v1
+which are currently supported but will be deprecated in a future version.
+</Admonition>
+
+(!docs/pages/includes/reference/resources/autoupdate_config.mdx!)
+
+See [Teleport Client Tool Managed Updates](../../../upgrading/client-tools-managed-updates.mdx) and
+[Teleport Agent Managed Updates](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for more details.
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-version.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-version.mdx
new file mode 100644
index 0000000000000..9af2375b5e877
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/auto-update-version.mdx
@@ -0,0 +1,25 @@
+---
+title: Auto-Update Version Resource Reference
+sidebar_label: Auto-Update Version
+description: Provides a comprehensive list of fields for the Teleport auto-update version resource.
+---
+
+The auto-update version resource allows cluster administrators to manage
+versions used for agent and client tools Managed Updates.
+
+<Admonition type="warning">
+The `autoupdate_config` and `autoupdate_version` resources configure Managed
+Updates v2 and Managed Updates v1.
+
+`cluster_maintenance_config` above configures only Managed Updates v1
+which are currently supported but will be deprecated in a future version.
+</Admonition>
+
+This resource is not editable for cloud-managed Teleport Enterprise to ensure that all of
+your clients receive security patches and remain compatible with your cluster.
+
+(!docs/pages/includes/reference/resources/autoupdate_version.mdx!)
+
+See [Teleport Client Tool Managed Updates](../../../upgrading/client-tools-managed-updates.mdx) and
+[Teleport Agent Managed Updates](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for more details.
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/bot.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/bot.mdx
new file mode 100644
index 0000000000000..d4eacdc8482d5
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/bot.mdx
@@ -0,0 +1,13 @@
+---
+title: Bot Resource Reference
+sidebar_label: Bot
+description: Provides a comprehensive list of fields for the Teleport bot resource.
+---
+
+The bot resources define a Machine ID Bot identity and its access.
+
+Find out more on the
+[Machine ID configuration reference](../../machine-workload-identity/configuration.mdx).
+
+(!docs/pages/includes/machine-id/bot-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-auth-preferences.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-auth-preferences.mdx
new file mode 100644
index 0000000000000..bd63b744cdc50
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-auth-preferences.mdx
@@ -0,0 +1,109 @@
+---
+title: Cluster Auth Preferences Resource Reference
+sidebar_label: Cluster Auth Preferences
+description: Provides a comprehensive list of fields for the Teleport cluster auth preferences resource.
+---
+
+The cluster auth preferences resource contains global cluster configuration
+options for authentication.
+
+```yaml
+metadata:
+  name: cluster-auth-preference
+spec:
+  # Sets the list of allowed second factors for the cluster.
+  # Possible values: "otp", "webauthn", and "sso".
+  # Defaults to ["otp"].
+  second_factors: ["webauthn", "otp"]
+
+  # second_factors is the list of allowed second factors for the cluster.
+  # Possible values: "on", "otp" and "webauthn"
+  # If "on" is set, all MFA protocols are supported.
+  #
+  # Prefer setting second_factors instead.
+  #second_factor: "webauthn"
+
+  # The name of the OIDC or SAML connector. if this is not set, the first connector in the backend is used.
+  connector_name: ""
+
+  # webauthn is the settings for server-side Web authentication support.
+  webauthn:
+    # rp_id is the ID of the Relying Party.
+    # It should be set to the domain name of the Teleport installation.
+    #
+    # IMPORTANT: rp_id must never change in the lifetime of the cluster, because
+    # it's recorded in the registration data on the WebAuthn device. If the
+    # ri_id changes, all existing WebAuthn key registrations will become invalid
+    # and all users who use WebAuthn as the second factor will need to
+    # re-register.
+    rp_id: teleport.example.com
+    # Allow list of device attestation CAs in PEM format.
+    # If present, only devices whose attestation certificates match the
+    # certificates specified here may be registered (existing registrations are
+    # unchanged).
+    # If supplied in conjunction with `attestation_denied_cas`, then both
+    # conditions need to be true for registration to be allowed (the device
+    # MUST match an allowed CA and MUST NOT match a denied CA).
+    # By default all devices are allowed.
+    attestation_allowed_cas: []
+    # Deny list of device attestation CAs in PEM format.
+    # If present, only devices whose attestation certificates don't match the
+    # certificates specified here may be registered (existing registrations are
+    # unchanged).
+    attestation_denied_cas: []
+
+  # Enforce per-session MFA or PIV-hardware key restrictions on user login sessions.
+  # Possible values: true, false, "hardware_key", "hardware_key_touch".
+  # Defaults to false.
+  require_session_mfa: false
+
+  # Sets whether connections with expired client certificates will be disconnected.
+  disconnect_expired_cert: false
+
+  # Sets whether headless authentication is allowed.
+  # Headless authentication requires WebAuthn.
+  # Defaults to true if webauthn is configured.
+  allow_headless: false
+
+  # Sets whether local auth is enabled alongside any other authentication
+  # type.
+  allow_local_auth: true
+
+  # Sets whether passwordless authentication is allowed.
+  # Requires Webauthn to work.
+  allow_passwordless: false
+
+  # Sets the message of the day for the cluster.
+  message_of_the_day: ""
+
+  # idp is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise
+  idp:
+    # options related to the Teleport SAML IdP.
+    saml:
+      # enables access to the Teleport SAML IdP.
+      enabled: true
+
+  # locking_mode is the cluster-wide locking mode default.
+  # Possible values: "strict" or "best_effort"
+  locking_mode: best_effort
+
+  # default_session_ttl defines the default TTL (time to live) of certificates
+  # issued to the users on this cluster.
+  default_session_ttl: "12h"
+
+  # The type of authentication to use for this cluster.
+  # Possible values: "local", "oidc", "saml" and "github"
+  type: local
+
+  stable_unix_user_config:
+    # If set to true, SSH instances will use the same UID for each given
+    # username when automatically creating users.
+    enabled: false
+
+    # The range of UIDs (including both ends) used for automatic UID assignment.
+    first_uid: 90000
+    last_uid: 95000
+
+version: v2
+```
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-maintenance-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-maintenance-config.mdx
new file mode 100644
index 0000000000000..a9269ad7a65b9
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/cluster-maintenance-config.mdx
@@ -0,0 +1,18 @@
+---
+title: Cluster Maintenance Config Resource Reference
+sidebar_label: Cluster Maintenance Config
+description: Provides a comprehensive list of fields for the Teleport cluster maintenance config resource.
+---
+
+The cluster maintenance config resource represents global configuration options
+for the agents enrolled into automatic updates (v1).
+
+<Admonition type="warning">
+`cluster_maintenance_config` configures Managed Updates v1,
+which are currently supported but will be superseded by Managed Updates v2.
+The `autoupdate_config` and `autoupdate_version` resources further down
+configure Managed Updates v2.
+</Admonition>
+
+(!docs/pages/includes/cluster-maintenance-config-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/database-object-import-rule.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/database-object-import-rule.mdx
new file mode 100644
index 0000000000000..dfd4ab8cbe08a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/database-object-import-rule.mdx
@@ -0,0 +1,13 @@
+---
+title: Database Object Import Rule Resource Reference
+sidebar_label: Database Object Import Rule
+description: Provides a comprehensive list of fields for the Teleport database object import rule resource.
+---
+
+Database object import rules define the labels to be applied to database objects
+imported into Teleport.
+
+See [Database Access Controls](../../../enroll-resources/database-access/rbac.mdx) for more details.
+
+(!docs/pages/includes/database-access/auto-user-provisioning/database-object-import-rule-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/db.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/db.mdx
new file mode 100644
index 0000000000000..70312e3a85629
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/db.mdx
@@ -0,0 +1,10 @@
+---
+title: DB Resource Reference
+sidebar_label: DB
+description: Provides a comprehensive list of fields for the Teleport DB resource.
+---
+
+The DB resource contains a configuration of a database that can be accessed
+through Teleport.
+
+(!docs/pages/includes/reference/resources/db.mdx!)
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/device.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/device.mdx
new file mode 100644
index 0000000000000..3e5f4818deb86
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/device.mdx
@@ -0,0 +1,10 @@
+---
+title: Device Resource Reference
+sidebar_label: Device
+description: Provides a comprehensive list of fields for the Teleport device resource.
+---
+
+Device contains information identifying a trusted device.
+
+(!docs/pages/includes/device-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/discovery-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/discovery-config.mdx
new file mode 100644
index 0000000000000..ad0b2fbc74791
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/discovery-config.mdx
@@ -0,0 +1,521 @@
+---
+title: Discovery Config Reference
+description: Provides a reference of fields within the Discovery Config resource, which you can manage with tctl.
+sidebar_label: Discovery Config
+---
+{/* vale 3rd-party-products.former-names = NO */}
+{/* vale messaging.capitalization = NO */}
+{/* Automatically generated from: types/discoveryconfig/discoveryconfig.go */}
+{/* DO NOT EDIT */}
+
+**Kind**: `discovery_config`<br/>
+**Version**: `v1`
+
+Describes extra discovery matchers that are added to DiscoveryServices that share the same Discovery Group.
+
+Example:
+
+```yaml
+kind: "string"
+sub_kind: "string"
+version: "string"
+metadata: # [...]
+spec: # [...]
+status: # [...]
+```
+|Field Name|Description|Type|
+|---|---|---|
+|kind|A resource kind.|string|
+|metadata|Metadata for the resource.|[Metadata](#metadata)|
+|spec|The specification for the discovery config.|[Spec](#spec)|
+|status|The status for the discovery config.|[Status](#status)|
+|sub_kind|An optional resource sub kind, used in some resources.|string|
+|version|The resource version.|string|
+
+## AWS Matcher
+
+Matches AWS EC2 instances and AWS Databases
+
+
+Example:
+
+```yaml
+types: 
+  - "string"
+  - "string"
+  - "string"
+regions: 
+  - "string"
+  - "string"
+  - "string"
+assume_role: # [...]
+tags: # [...]
+install: # [...]
+ssm: # [...]
+integration: "string"
+kube_app_discovery: true
+setup_access_for_arn: "string"
+organization: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|assume_role|ARN is the AWS role to assume for database discovery.|[Assume Role](#assume-role)|
+|install|Sets the join method when installing on discovered EC2 nodes|[Installer Params](#installer-params)|
+|integration|The integration name used to generate credentials to interact with AWS APIs. Environment credentials will not be used when this value is set.|string|
+|kube_app_discovery|Controls whether Kubernetes App Discovery will be enabled for agents running on discovered clusters, currently only affects AWS EKS discovery in integration mode.|Boolean|
+|organization|An AWS Organization matcher for discovering resources accross multiple accounts under an Organization.|[AWS Organization Matcher](#aws-organization-matcher)|
+|regions|AWS regions to query for databases.|[]string|
+|setup_access_for_arn|The role that the Discovery Service should create EKS Access Entries for. This value should match the IAM identity that Teleport Kubernetes Service uses. If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).|string|
+|ssm|Provides options to use when sending a document command to an EC2 node|[AWSSSM](#awsssm)|
+|tags|AWS resource Tags to match.|[Labels](#labels)|
+|types|AWS database types to match, "ec2", "rds", "redshift", "elasticache", or "memorydb".|[]string|
+
+## AWS Organization Matcher
+
+Specifies an Organization and rules for discovering accounts under that organization.
+
+
+Example:
+
+```yaml
+organization_id: "string"
+organizational_units: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|organization_id|The AWS Organization ID to match against. Required.|string|
+|organizational_units|Contains rules for matchings AWS accounts based on their Organizational Units.|[AWS Organization Units Matcher](#aws-organization-units-matcher)|
+
+## AWS Organization Units Matcher
+
+Contains rules for matching accounts under an Organization. Accounts that belong to an excluded Organizational Unit, and its children, will be excluded even if they were included.
+
+
+Example:
+
+```yaml
+include: 
+  - "string"
+  - "string"
+  - "string"
+exclude: 
+  - "string"
+  - "string"
+  - "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|exclude|A list of AWS Organizational Unit IDs to exclude. Only exact matches or wildcard (*) are supported. If empty, no Organizational Units are excluded by default.|[]string|
+|include|A list of AWS Organizational Unit IDs to match. Only exact matches or wildcard (*) are supported. If empty, all Organizational Units are included by default.|[]string|
+
+## AWSSSM
+
+Provides options to use when executing SSM documents
+
+
+Example:
+
+```yaml
+document_name: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|document_name|The name of the document to use when executing an SSM command|string|
+
+## Access Graph AWS Sync
+
+A configuration for AWS Access Graph service poll service.
+
+
+Example:
+
+```yaml
+regions: 
+  - "string"
+  - "string"
+  - "string"
+assume_role: # [...]
+integration: "string"
+cloud_trail_logs: # [...]
+eks_audit_logs: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|assume_role|ARN is the AWS role to assume for database discovery.|[Assume Role](#assume-role)|
+|cloud_trail_logs|Configuration settings for collecting AWS CloudTrail logs via an SQS queue.|[Access Graph AWS Sync Cloud Trail Logs](#access-graph-aws-sync-cloud-trail-logs)|
+|eks_audit_logs||[Access Graph AWS Sync EKS Audit Logs](#access-graph-aws-sync-eks-audit-logs)|
+|integration|The integration name used to generate credentials to interact with AWS APIs.|string|
+|regions|AWS regions to import resources from.|[]string|
+
+## Access Graph AWS Sync Cloud Trail Logs
+
+Defines settings for ingesting AWS CloudTrail logs by polling an SQS queue that receives notifications about new log files.
+
+
+Example:
+
+```yaml
+region: "string"
+sqs_queue: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|region|The AWS region of the SQS queue for CloudTrail notifications, ex.: "us-east-2".|string|
+|sqs_queue|The name or URL for CloudTrail log events, ex.: "demo-cloudtrail-queue".|string|
+
+## Access Graph AWS Sync EKS Audit Logs
+
+Defines the settings for ingesting Kubernetes apiserver audit logs from EKS clusters.
+
+
+Example:
+
+```yaml
+tags: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|tags|The tags of EKS clusters for which apiserver audit logs should be fetched.|[Labels](#labels)|
+
+## Access Graph Azure Sync
+
+A configuration for Azure Access Graph service poll service.
+
+
+Example:
+
+```yaml
+subscription_id: "string"
+integration: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|integration|The integration name used to generate credentials to interact with AWS APIs.|string|
+|subscription_id|Is the ID of the Azure subscription to sync resources from|string|
+
+## Access Graph Sync
+
+A configuration for Access Graph service.
+
+
+Example:
+
+```yaml
+aws: 
+  - # [...]
+  - # [...]
+  - # [...]
+poll_interval: # See description
+azure: 
+  - # [...]
+  - # [...]
+  - # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|aws|A configuration for AWS Access Graph service poll service.|[][Access Graph AWS Sync](#access-graph-aws-sync)|
+|azure|A configuration for Azure Access Graph service poll service.|[][Access Graph Azure Sync](#access-graph-azure-sync)|
+|poll_interval|The frequency at which to poll for resources||
+
+## Assume Role
+
+Provides a role ARN and ExternalID to assume an AWS role when interacting with AWS resources.
+
+
+Example:
+
+```yaml
+role_arn: "string"
+external_id: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|external_id|The external ID used to assume a role in another account.|string|
+|role_arn|The fully specified AWS IAM role ARN.|string|
+
+## Azure Installer Params
+
+The set of Azure-specific installation parameters.
+
+
+Example:
+
+```yaml
+client_id: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|client_id|The client ID of the managed identity discovered nodes should use to join the cluster.|string|
+
+## Azure Matcher
+
+Matches Azure resources. It defines which resource types, filters and some configuration params.
+
+
+Example:
+
+```yaml
+subscriptions: 
+  - "string"
+  - "string"
+  - "string"
+resource_groups: 
+  - "string"
+  - "string"
+  - "string"
+types: 
+  - "string"
+  - "string"
+  - "string"
+regions: 
+  - "string"
+  - "string"
+  - "string"
+tags: # [...]
+install_params: # [...]
+integration: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|install_params|Sets the join method when installing on discovered Azure nodes.|[Installer Params](#installer-params)|
+|integration|The integration name used to generate credentials to interact with Azure APIs. Environment credentials will not be used when this value is set.|string|
+|regions|Azure locations to match for databases.|[]string|
+|resource_groups|Azure resource groups to query for resources.|[]string|
+|subscriptions|Azure subscriptions to query for resources.|[]string|
+|tags|Azure tags on resources to match.|[Labels](#labels)|
+|types|Azure types to match: "mysql", "postgres", "aks", "vm"|[]string|
+
+## GCP Matcher
+
+Matches GCP resources.
+
+
+Example:
+
+```yaml
+types: 
+  - "string"
+  - "string"
+  - "string"
+locations: 
+  - "string"
+  - "string"
+  - "string"
+tags: # [...]
+project_ids: 
+  - "string"
+  - "string"
+  - "string"
+service_accounts: 
+  - "string"
+  - "string"
+  - "string"
+install_params: # [...]
+labels: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|install_params|Sets the join method when installing on discovered GCP nodes.|[Installer Params](#installer-params)|
+|labels|GCP labels to match.|[Labels](#labels)|
+|locations|GKE locations to search resources for.|[]string|
+|project_ids|The GCP project ID where the resources are deployed.|[]string|
+|service_accounts|The emails of service accounts attached to VMs.|[]string|
+|tags|Obsolete and only exists for backwards compatibility. Use Labels instead.|[Labels](#labels)|
+|types|GKE resource types to match: "gke", "vm".|[]string|
+
+## HTTP Proxy Settings
+
+Defines HTTP proxy settings for making HTTP and HTTPS requests.
+
+
+Example:
+
+```yaml
+http_proxy: "string"
+https_proxy: "string"
+no_proxy: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|http_proxy|The URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.|string|
+|https_proxy|The URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.|string|
+|no_proxy|A comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.|string|
+
+## Install Param Enroll Mode
+
+The mode used to enroll the node into the cluster.
+
+
+## Installer Params
+
+InstallParams sets join method to use on discovered nodes
+
+
+Example:
+
+```yaml
+join_method: # [...]
+join_token: "string"
+script_name: "string"
+install_teleport: true
+sshd_config: "string"
+proxy_addr: "string"
+azure: # [...]
+enroll_mode: # [...]
+suffix: "string"
+update_group: "string"
+http_proxy_settings: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|azure|The set of Azure-specific installation parameters.|[Azure Installer Params](#azure-installer-params)|
+|enroll_mode|Indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode|[Install Param Enroll Mode](#install-param-enroll-mode)|
+|http_proxy_settings|Defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.|[HTTP Proxy Settings](#http-proxy-settings)|
+|install_teleport|Disables agentless discovery|Boolean|
+|join_method|The method to use when joining the cluster|[Join Method](#join-method)|
+|join_token|The token to use when joining the cluster|string|
+|proxy_addr|The address of the proxy the discovered node should use to connect to the cluster.|string|
+|script_name|The name of the teleport installer script resource for the cloud instance to execute|string|
+|sshd_config|Provides the path to write sshd configuration changes|string|
+|suffix|Indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.|string|
+|update_group|Indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.|string|
+
+## Join Method
+
+The method used for new nodes to join the cluster.
+
+
+## Kubernetes Matcher
+
+Matches Kubernetes services.
+
+
+Example:
+
+```yaml
+types: 
+  - "string"
+  - "string"
+  - "string"
+namespaces: 
+  - "string"
+  - "string"
+  - "string"
+labels: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|labels|Kubernetes services labels to match.|[Labels](#labels)|
+|namespaces|Kubernetes namespaces in which to discover services|[]string|
+|types|Kubernetes services types to match. Currently only 'app' is supported.|[]string|
+
+## Labels
+
+A wrapper around map that can marshal and unmarshal itself from scalar and list values
+
+
+## Metadata
+
+Resource metadata
+
+
+Example:
+
+```yaml
+name: "string"
+description: "string"
+labels: 
+  "string": "string"
+  "string": "string"
+  "string": "string"
+expires: # See description
+revision: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|description|Object description|string|
+|expires|A global expiry time header can be set on any resource in the system.||
+|labels|A set of labels|map[string]string|
+|name|An object name|string|
+|revision|An opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.|string|
+
+## Spec
+
+The specification for a discovery config.
+
+
+Example:
+
+```yaml
+discovery_group: "string"
+aws: 
+  - # [...]
+  - # [...]
+  - # [...]
+azure: 
+  - # [...]
+  - # [...]
+  - # [...]
+gcp: 
+  - # [...]
+  - # [...]
+  - # [...]
+kube: 
+  - # [...]
+  - # [...]
+  - # [...]
+access_graph: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|access_graph|The configuration for the Access Graph Cloud sync.|[Access Graph Sync](#access-graph-sync)|
+|aws|A list of matchers for the supported resources in AWS.|[][AWS Matcher](#aws-matcher)|
+|azure|A list of matchers for the supported resources in Azure.|[][Azure Matcher](#azure-matcher)|
+|discovery_group|The Discovery Group for the current DiscoveryConfig. DiscoveryServices should include all the matchers if the DiscoveryGroup matches with their own group.|string|
+|gcp|A list of matchers for the supported resources in GCP.|[][GCP Matcher](#gcp-matcher)|
+|kube|A list of matchers for the supported resources in Kubernetes.|[][Kubernetes Matcher](#kubernetes-matcher)|
+
+## Status
+
+Holds dynamic information about the discovery configuration running status such as errors, state and count of the resources.
+
+
+Example:
+
+```yaml
+state: "string"
+error_message: "string"
+discovered_resources: 1
+last_sync_time: # See description
+integration_discovered_resources: 
+  "string": # See description
+  "string": # See description
+  "string": # See description
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|discovered_resources|Holds the count of the discovered resources in the previous iteration.|number|
+|error_message|Holds the error message when state is DISCOVERY_CONFIG_STATE_ERROR.|string|
+|integration_discovered_resources|Maps an integration to a summary of resources that were found using that integration.|map[string]|
+|last_sync_time|The timestamp when the Discovery Config was last sync.||
+|state|The current state of the discovery config.|string|
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/health-check-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/health-check-config.mdx
new file mode 100644
index 0000000000000..d96eba4240a50
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/health-check-config.mdx
@@ -0,0 +1,51 @@
+---
+title: Health Check Config Resource Reference
+sidebar_label: Health Check Config
+description: Provides a comprehensive list of fields for the Teleport health check config resource.
+---
+
+The health check config resource specifies configuration options for resource
+endpoint health checks.
+
+Currently, health checks can only be configured for database endpoints.
+
+```yaml
+kind: health_check_config
+version: v1
+metadata:
+  name: example
+  description: Example healthcheck configuration
+spec:
+  # interval is the time between each health check. Default 30s.
+  interval: 30s
+  # timeout is the health check connection establishment timeout. Default 5s.
+  timeout: 5s
+  # healthy_threshold is the number of consecutive passing health checks
+  # after which a target's health status becomes "healthy". Default 2.
+  healthy_threshold: 2
+  # unhealthy_threshold is the number of consecutive failing health checks
+  # after which a target's health status becomes "unhealthy". Default 1.
+  unhealthy_threshold: 1
+  # match is used to select resources that these settings apply to.
+  # Resources are matched by label selectors and at least one label selector
+  # must be set.
+  # If multiple `health_check_config` resources match the same resource, then
+  # the matching health check configs are sorted by name and only the first
+  # config applies.
+  match:
+    # db_labels matches database labels. An empty value is ignored.
+    # If db_labels_expression is also set, then the match result is the logical
+    # AND of both.
+    db_labels:
+      - name: env
+        values:
+          - dev
+          - staging
+    # db_labels_expression is a label predicate expression to match databases.
+    # An empty value is ignored.
+    # If db_labels is also set, then the match result is the logical AND of both.
+    db_labels_expression: 'labels["owner"] == "database-team"'
+```
+
+See [predicate language label expressions](../../access-controls/predicate-language.mdx#label-expressions) for more info about using predicate language to match resource labels.
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-model.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-model.mdx
new file mode 100644
index 0000000000000..a45480a117878
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-model.mdx
@@ -0,0 +1,62 @@
+---
+title: Inference Model Resource Reference
+sidebar_label: Inference Model
+description: Provides a comprehensive list of fields for the Teleport inference model resource.
+---
+
+The inference model resource configures which third-party inference provider
+should be accessed and contains both general and provider-specific options that
+control session recording summarization. Multiple models can be configured.
+
+```yaml
+kind: inference_model
+version: v1
+metadata:
+  name: example-model
+spec:
+
+  # openai tells Teleport to use OpenAI for summarizing session recordings
+  # using this model.
+  openai:
+
+    # openai_model_id is the provider-specific model name. If this model
+    # connects to a real OpenAI API, this needs to be a valid OpenAI model
+    # name. If it connects to an OpenAI-compatible proxy, this ID is whatever
+    # the public model name is used by that particular proxy. Required.
+    openai_model_id: gpt-4o
+    
+    # temperature is an optional temperature of the model. Defaults to whatever
+    # is the model's default.
+    temperature: 0.4
+    
+    # api_key_secret_ref is a name of an inference_secret resource containing
+    # the OpenAI API key (in case of direct connection to OpenAI) or other
+    # secret required to authenticate against an LLM proxy. Required.
+    api_key_secret_ref: example-openai-key
+    
+    # base_url allows changing the base URL to point Teleport to an alternate
+    # OpenAI-compatible API, e.g. a proxy. Optional, defaults to the public
+    # OpenAI API endpoint.
+    base_url: "http://my-llm-proxy:4000/"
+  
+  # max_session_length_bytes is the maximum length of a session recording to be
+  # processed using this model configuration. Setting it protects from
+  # incurring additional cost from summarization attempts that fail because of
+  # the model's context window limit. Optional, defaults to 200kB.
+  max_session_length_bytes: 235000
+  
+  # bedrock tells Teleport to use Amazon Bedrock for summarizing session
+  # recordings using this model.
+  bedrock:
+
+    # region is the AWS region which will be used for inference. Required.
+    region: eu-central-1
+
+    # bedrock_model_id specifies a model ID or an inference profile as
+    # understood by the Bedrock API. Required.
+    bedrock_model_id: "anthropic.claude-3-5-sonnet-20240620-v1:0"
+
+    # temperature is an optional temperature of the model. Defaults to whatever
+    # is the model's default.
+    temperature: 0.6
+```
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-policy.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-policy.mdx
new file mode 100644
index 0000000000000..8b0192d49547c
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-policy.mdx
@@ -0,0 +1,34 @@
+---
+title: Inference Policy Resource Reference
+sidebar_label: Inference Policy
+description: Provides a comprehensive list of fields for the Teleport inference policy resource.
+---
+
+The inference policy resource controls, in session recording summaries, which
+sessions are summarized and which model will be used to summarize them. There
+can be multiple policies defined; multiple policies can also share the same
+model.
+
+```yaml
+kind: inference_policy
+version: v1
+metadata:
+  name: example-policy
+spec:
+
+  # kinds indicate which kinds of sessions will match this policy. Required.
+  # Supported values: 'ssh', 'k8s', 'db'.
+  kinds: ['ssh', 'db']
+
+  # model is the name of the inference_model resource containing provider and
+  # model configuration. Required.
+  model: example-model
+  
+  # filter is an additional filter that the sessions need to match to be
+  # matched by this policy. Optional, defaults to matching all sessions of
+  # given kind.
+  filter: 'equals(resource.metadata.labels["env"], "prod")'
+```
+
+See [Predicate Language](../../access-controls/predicate-language.mdx) for more details on the
+filter expressions.
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-secret.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-secret.mdx
new file mode 100644
index 0000000000000..62be9b419f24f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/inference-secret.mdx
@@ -0,0 +1,22 @@
+---
+title: Inference Secret Resource Reference
+sidebar_label: Inference Secret
+description: Provides a comprehensive list of fields for the Teleport inference secret resource.
+---
+
+The inference secret resource configures a secret, such as OpenAI API key or
+LiteLLM master key, that is used along with an `inference_model`. Multiple
+inference models can use the same secret. Inference secret resources can be
+listed and retrieved, but their values will be stripped from the payload to
+protect them from leaking outside.
+
+```yaml
+kind: inference_secret
+version: v1
+metadata:
+  name: example-openai-key
+spec:
+  # value is the secret value, e.g. an OpenAI key.
+  value: "************************************"
+```
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/installer-v1.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/installer-v1.mdx
new file mode 100644
index 0000000000000..94f2280dad77c
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/installer-v1.mdx
@@ -0,0 +1,73 @@
+---
+title: Installer V1 Reference
+description: Provides a reference of fields within the Installer V1 resource, which you can manage with tctl.
+sidebar_label: Installer V1
+---
+{/* vale 3rd-party-products.former-names = NO */}
+{/* vale messaging.capitalization = NO */}
+{/* Automatically generated from: types/types.pb.go */}
+{/* DO NOT EDIT */}
+
+**Kind**: `installer`<br/>
+**Version**: `v1`
+
+Represents an installer script resource. Used to provide a script to install teleport on discovered nodes.
+
+Example:
+
+```yaml
+kind: "string"
+sub_kind: "string"
+version: "string"
+metadata: # [...]
+spec: # [...]
+```
+|Field Name|Description|Type|
+|---|---|---|
+|kind|The resource kind.|string|
+|metadata|The resource metadata.|[Metadata](#metadata)|
+|spec|The resource spec.|[Installer Spec V1](#installer-spec-v1)|
+|sub_kind|An optional resource subkind. Currently unused for this resource.|string|
+|version|The resource version.|string|
+
+## Installer Spec V1
+
+The specification for an Installer
+
+
+Example:
+
+```yaml
+script: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|script|Represents the contents of a installer shell script|string|
+
+## Metadata
+
+Resource metadata
+
+
+Example:
+
+```yaml
+name: "string"
+description: "string"
+labels: 
+  "string": "string"
+  "string": "string"
+  "string": "string"
+expires: # See description
+revision: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|description|Object description|string|
+|expires|A global expiry time header can be set on any resource in the system.||
+|labels|A set of labels|map[string]string|
+|name|An object name|string|
+|revision|An opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.|string|
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/login-rules.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/login-rules.mdx
new file mode 100644
index 0000000000000..6818b2afe0abe
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/login-rules.mdx
@@ -0,0 +1,10 @@
+---
+title: Login Rules Resource Reference
+sidebar_label: Login Rules
+description: Provides a comprehensive list of fields for the Teleport login rules resource.
+---
+
+Login rules contain logic to transform SSO user traits during login.
+
+(!docs/pages/includes/login-rule-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/oidc-connector-v3.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/oidc-connector-v3.mdx
new file mode 100644
index 0000000000000..8b184646e9909
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/oidc-connector-v3.mdx
@@ -0,0 +1,225 @@
+---
+title: OIDC Connector V3 Reference
+description: Provides a reference of fields within the OIDC Connector V3 resource, which you can manage with tctl.
+sidebar_label: OIDC Connector V3
+---
+{/* vale 3rd-party-products.former-names = NO */}
+{/* vale messaging.capitalization = NO */}
+{/* Automatically generated from: types/types.pb.go */}
+{/* DO NOT EDIT */}
+
+**Kind**: `oidc`<br/>
+**Version**: `v3`
+
+Represents an OIDC connector.
+
+Example:
+
+```yaml
+kind: "string"
+sub_kind: "string"
+version: "string"
+metadata: # [...]
+spec: # [...]
+```
+|Field Name|Description|Type|
+|---|---|---|
+|kind|A resource kind.|string|
+|metadata|Holds resource metadata.|[Metadata](#metadata)|
+|spec|An OIDC connector specification.|[OIDC Connector Spec V3](#oidc-connector-spec-v3)|
+|sub_kind|An optional resource sub kind, used in some resources.|string|
+|version|The resource version. It must be specified. Supported values are: `v3`.|string|
+
+## Claim Mapping
+
+Maps a claim to teleport roles.
+
+
+Example:
+
+```yaml
+claim: "string"
+value: "string"
+roles: 
+  - "string"
+  - "string"
+  - "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|claim|A claim name.|string|
+|roles|A list of static teleport roles to match.|[]string|
+|value|A claim value to match.|string|
+
+## Duration
+
+A wrapper around duration to set up custom marshal/unmarshal
+
+
+## Entra ID Groups Provider
+
+Configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for "groups" claim when the user's group membership exceeds 200 max item limit.
+
+
+Example:
+
+```yaml
+disabled: true
+group_type: "string"
+graph_endpoint: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|disabled|Specifies that the groups provider should be disabled even when Entra ID responds with a groups claim source. User may choose to disable it if they are using integrations such as SCIM or similar groups importer as connector based role mapping may be not needed in such a scenario.|Boolean|
+|graph_endpoint|A Microsoft Graph API endpoint. The groups claim source endpoint provided by Entra ID points to the now-retired Azure AD Graph endpoint ("https://graph.windows.net"). To convert it to the newer Microsoft Graph API endpoint, Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com"). Update GraphEndpoint to point to a different Microsoft Graph national cloud deployment endpoint.|string|
+|group_type|A user group type filter. Defaults to "security-groups". Value can be "security-groups", "directory-roles", "all-groups".|string|
+
+## Metadata
+
+Resource metadata
+
+
+Example:
+
+```yaml
+name: "string"
+description: "string"
+labels: 
+  "string": "string"
+  "string": "string"
+  "string": "string"
+expires: # See description
+revision: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|description|Object description|string|
+|expires|A global expiry time header can be set on any resource in the system.||
+|labels|A set of labels|map[string]string|
+|name|An object name|string|
+|revision|An opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.|string|
+
+## OIDC Connector MFA Settings
+
+Contains OIDC MFA settings.
+
+
+Example:
+
+```yaml
+enabled: true
+client_id: "string"
+client_secret: "string"
+acr_values: "string"
+prompt: "string"
+max_age: # [...]
+request_object_mode: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|acr_values|Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.|string|
+|client_id|ClientID is the OIDC OAuth app client ID.|string|
+|client_secret|The OIDC OAuth app client secret.|string|
+|enabled|Specified whether this OIDC connector supports MFA checks. Defaults to false.|Boolean|
+|max_age|The amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.|[Duration](#duration)|
+|prompt|An optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|string|
+|request_object_mode|Determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for the MFA client.|string|
+
+## OIDC Connector Spec V3
+
+An OIDC connector specification.  It specifies configuration for Open ID Connect compatible external identity provider: https://openid.net/specs/openid-connect-core-1_0.html
+
+
+Example:
+
+```yaml
+issuer_url: "string"
+client_id: "string"
+client_secret: "string"
+acr_values: "string"
+provider: "string"
+display: "string"
+scope: 
+  - "string"
+  - "string"
+  - "string"
+prompt: "string"
+claims_to_roles: 
+  - # [...]
+  - # [...]
+  - # [...]
+google_service_account_uri: "string"
+google_service_account: "string"
+google_admin_email: "string"
+redirect_url: # [...]
+allow_unverified_email: true
+username_claim: "string"
+max_age: # [...]
+client_redirect_settings: # [...]
+mfa: # [...]
+pkce_mode: "string"
+user_matchers: 
+  - "string"
+  - "string"
+  - "string"
+request_object_mode: "string"
+entra_id_groups_provider: # [...]
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|acr_values|An Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.|string|
+|allow_unverified_email|Tells the connector to accept OIDC users with unverified emails.|Boolean|
+|claims_to_roles|Specifies a dynamic mapping from claims to roles.|[][Claim Mapping](#claim-mapping)|
+|client_id|The id of the authentication client (Teleport Auth Service).|string|
+|client_redirect_settings|Defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones.|[SSO Client Redirect Settings](#sso-client-redirect-settings)|
+|client_secret|Used to authenticate the client.|string|
+|display|The friendly name for this provider.|string|
+|entra_id_groups_provider|EntraIDGroupsProvider configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for the "groups" claim when the user's group membership exceeds 200 max item limit.|[Entra ID Groups Provider](#entra-id-groups-provider)|
+|google_admin_email|The email of a google admin to impersonate.|string|
+|google_service_account|A string containing google service account credentials.|string|
+|google_service_account_uri|A path to a google service account uri.|string|
+|issuer_url|The endpoint of the provider, e.g. https://accounts.google.com.|string|
+|max_age||[Duration](#duration)|
+|mfa|Contains settings to enable SSO MFA checks through this auth connector.|[OIDC Connector MFA Settings](#oidc-connector-mfa-settings)|
+|pkce_mode|Represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"|string|
+|prompt|An optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|string|
+|provider|The external identity provider.|string|
+|redirect_url|A list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.|[Strings](#strings)|
+|request_object_mode|Determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters.|string|
+|scope|Specifies additional scopes set by provider.|[]string|
+|user_matchers|A set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.|[]string|
+|username_claim|Specifies the name of the claim from the OIDC connector to be used as the user's username.|string|
+
+## SSO Client Redirect Settings
+
+Contains settings to define which additional client redirect URLs should be allowed for non-browser SSO logins.
+
+
+Example:
+
+```yaml
+allowed_https_hostnames: 
+  - "string"
+  - "string"
+  - "string"
+insecure_allowed_cidr_ranges: 
+  - "string"
+  - "string"
+  - "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|allowed_https_hostnames|A list of hostnames allowed for https client redirect URLs|[]string|
+|insecure_allowed_cidr_ranges|A list of CIDRs allowed for HTTP or HTTPS client redirect URLs|[]string|
+
+## Strings
+
+A list of string that can unmarshal from list of strings or a scalar string from scalar yaml or json property
+
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/role.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/role.mdx
new file mode 100644
index 0000000000000..6271b90c47b9f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/role.mdx
@@ -0,0 +1,59 @@
+---
+title: Role Resource Reference
+sidebar_label: Role
+description: Provides a comprehensive list of fields for the Teleport role resource.
+---
+
+Interactive and non-interactive users (bots) assume one or many roles.
+
+Roles govern access to databases, SSH servers, Kubernetes clusters, web services and applications and Windows Desktops.
+
+(!docs/pages/includes/role-spec.mdx!)
+
+## Role versions
+
+There are currently six supported role versions: `v3`, `v4`, `v5`, `v6`, `v7`, and `v8`.
+
+Different role versions may have varying RBAC applied to resources.
+
+### `kubernetes_resource`
+
+Versions 5, 6, 7 and 8 of the Teleport role resource have different behaviors when
+accessing Kubernetes resources.
+{/*lint ignore messaging*/}
+Roles not [granting Kubernetes access](../../../enroll-resources/kubernetes-access/introduction.mdx) are
+equivalent in the four versions.
+
+Roles v5 and v6 can only restrict actions on pods (e.g. executing in them).
+Role v7 supports restricting some common resource kinds (
+see [the `kubernetes_resource` documentation](../../../enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources)
+for a complete list).
+Role v8 supports restricting all resource kinds, including CRDs. It also changes the format of the `kind` field.
+
+When no `kubernetes_resource` is set:
+- Roles v5, v7 and v8 grant all access by default
+- Roles v6 blocks pod execution by default, this was reverted by roles v7 to improve the user experience.
+
+{/* This table is cursed. Our current docs engine doesn't support HTML tables
+(due to SSR and the rehydration process). We have dto do everything inlined in
+markdown. Some HTML character codes are used to render specific chars like {}
+or to avoid line breaks in the middle fo the YAML. Spaces before br tags
+are required.*/}
+
+| Allow rule                                                                                                                                                                                                                                                                                              | Role v5                                                                                                              | Role v6                                                                                                              | Role v7                                                                                                                                                                                                    | Role v8                            |
+|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------|
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: &#123;&#125; <br/>kubernetes_resources:&nbsp;[]<br/></pre>                                                                                                                                                                    | ❌ no access                                                                                                         | ❌ no access                                                                                                         | ❌ no access                                                                                                                                                                                                | ❌ no access                        |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources:&nbsp;[]<br/></pre>                                                                                                                                                             | ✅ full access to `dev` clusters                                                                                     | ❌ cannot exec in pods <br/> ✅ can access other <br/>resources like `secrets`                                       | ✅ full access to `dev` clusters                                                                                                                                                                            | ✅ full access to `dev` clusters    |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - name: "&ast;" <br/>    kind: pod <br/>    namespace: "foo"</pre>                                                                                                      | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in all namespaces. <br/>❌ cannot exec in other namespaces | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in all namespaces. <br/>❌ cannot exec in other namespaces | ✅ can exec in pods in `foo` <br/>❌ cannot access `secrets` in all namespaces <br/>❌ cannot exec in other namespaces                                                                                        | ⚠️ invalid, v8 uses plural          |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - name: "&ast;" <br/>    kind: pod <br/>    namespace: "foo" <br/>  - name: "&ast;" <br/>    kind: secret <br/>    namespace: "foo"</pre>                               | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                     | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in `foo` <br/>❌ cannot exec in other namespaces <br/>❌ cannot access `secrets` in other namespaces <br/>❌ cannot access `configmaps` in `foo`   | ⚠️ invalid, v8 uses plural          |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - kind: "namespace" <br/>    name: "foo"</pre>                                                                                                                          | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                     | ✅ full access in namespace `foo` including all its resources <br/>❌ cannot access other namespaces<br/>❌ cannot access cluster-wide resources                                                            | ⚠️ invalid, v8 uses plural          |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - kind: "&ast;"<br/>    namespace: "foo"<br/>    name: "&ast;"</pre>                                                                                                    | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                     | ✅ full access in namespace `foo` including all its resources <br/>❌ cannot access other namespaces<br/> ✅ full access to cluster-wide resources                                                          | ⚠️ invalid, v8 requires api_group for '*' kind |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - kind: "&ast;"<br/>    namespace: "&ast;"<br/>    name: "&ast;"</pre>                                                                                                  | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                     | ✅ full access to `dev` clusters                                                                                                                                                                           | ⚠️ invalid, v8 requires api_group for '*' kind |
+| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - name: "&ast;" <br/>    kind: pods <br/>    namespace: "foo" <br/>  - name: "&ast;" <br/>    kind: deployments <br/>    api_group: apps<br/>    namespace: "foo"</pre> | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                     | ⚠️ not supported                                                                                                                                                                                           | ✅ can exec in pods in `foo` <br/>✅ can access `deployments` in `foo` <br/>❌ cannot exec in other namespaces <br/>❌ cannot access `deployments` in other namespaces <br/>❌ cannot access `configmaps` in `foo`  |
+
+### `saml_idp_service_provider`
+SAML IdP role option `spec.idp.saml.enabled: true/false` is only supported in role version 7 and below.
+See [SAML IdP reference](../../access-controls/saml-idp.mdx#RBAC) to learn how the RBAC is applied to
+the `saml_idp_service_provider` resource starting role version 8.
+
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/saml-connector-v2.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/saml-connector-v2.mdx
new file mode 100644
index 0000000000000..cd7180c957b90
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/saml-connector-v2.mdx
@@ -0,0 +1,213 @@
+---
+title: SAML Connector V2 Reference
+description: Provides a reference of fields within the SAML Connector V2 resource, which you can manage with tctl.
+sidebar_label: SAML Connector V2
+---
+{/* vale 3rd-party-products.former-names = NO */}
+{/* vale messaging.capitalization = NO */}
+{/* Automatically generated from: types/types.pb.go */}
+{/* DO NOT EDIT */}
+
+**Kind**: `saml`<br/>
+**Version**: `v2`
+
+Represents a SAML connector.
+
+Example:
+
+```yaml
+kind: "string"
+sub_kind: "string"
+version: "string"
+metadata: # [...]
+spec: # [...]
+```
+|Field Name|Description|Type|
+|---|---|---|
+|kind|A resource kind.|string|
+|metadata|Holds resource metadata.|[Metadata](#metadata)|
+|spec|An SAML connector specification.|[SAML Connector Spec V2](#saml-connector-spec-v2)|
+|sub_kind|An optional resource sub kind, used in some resources.|string|
+|version|The resource version. It must be specified. Supported values are: `v2`.|string|
+
+## Asymmetric Key Pair
+
+A combination of a public certificate and private key that can be used for encryption and signing.
+
+
+Example:
+
+```yaml
+private_key: "string"
+cert: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|cert|A PEM-encoded x509 certificate.|string|
+|private_key|A PEM encoded x509 private key.|string|
+
+## Attribute Mapping
+
+Maps a SAML attribute statement to teleport roles.
+
+
+Example:
+
+```yaml
+name: "string"
+value: "string"
+roles: 
+  - "string"
+  - "string"
+  - "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|name|An attribute statement name.|string|
+|roles|A list of static teleport roles to map to.|[]string|
+|value|An attribute statement value to match.|string|
+
+## Metadata
+
+Resource metadata
+
+
+Example:
+
+```yaml
+name: "string"
+description: "string"
+labels: 
+  "string": "string"
+  "string": "string"
+  "string": "string"
+expires: # See description
+revision: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|description|Object description|string|
+|expires|A global expiry time header can be set on any resource in the system.||
+|labels|A set of labels|map[string]string|
+|name|An object name|string|
+|revision|An opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.|string|
+
+## SAML Connector MFA Settings
+
+Contains SAML MFA settings.
+
+
+Example:
+
+```yaml
+enabled: true
+entity_descriptor: "string"
+entity_descriptor_url: "string"
+force_authn: # [...]
+issuer: "string"
+sso: "string"
+cert: "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|cert|The identity provider certificate PEM. IDP signs `\<Response\>` responses using this certificate.|string|
+|enabled|Specified whether this SAML connector supports MFA checks. Defaults to false.|Boolean|
+|entity_descriptor|XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements. Usually set from EntityDescriptorUrl.|string|
+|entity_descriptor_url|A URL that supplies a configuration XML.|string|
+|force_authn|Specified whether re-authentication should be forced for MFA checks. UNSPECIFIED is treated as YES to always re-authentication for MFA checks. This should only be set to NO if the IdP is setup to perform MFA checks on top of active user sessions.|[SAML Force Authn](#saml-force-authn)|
+|issuer|The identity provider issuer. Usually set from EntityDescriptor.|string|
+|sso|SSO is the URL of the identity provider's SSO service. Usually set from EntityDescriptor.|string|
+
+## SAML Connector Spec V2
+
+A SAML connector specification.
+
+
+Example:
+
+```yaml
+issuer: "string"
+sso: "string"
+cert: "string"
+display: "string"
+acs: "string"
+audience: "string"
+service_provider_issuer: "string"
+entity_descriptor: "string"
+entity_descriptor_url: "string"
+attributes_to_roles: 
+  - # [...]
+  - # [...]
+  - # [...]
+signing_key_pair: # [...]
+provider: "string"
+assertion_key_pair: # [...]
+allow_idp_initiated: true
+client_redirect_settings: # [...]
+single_logout_url: "string"
+mfa: # [...]
+force_authn: # [...]
+preferred_request_binding: "string"
+user_matchers: 
+  - "string"
+  - "string"
+  - "string"
+include_subject: true
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|acs|A URL for assertion consumer service on the service provider (Teleport's side).|string|
+|allow_idp_initiated|A flag that indicates if the connector can be used for IdP-initiated logins.|Boolean|
+|assertion_key_pair|A key pair used for decrypting SAML assertions.|[Asymmetric Key Pair](#asymmetric-key-pair)|
+|attributes_to_roles|A list of mappings of attribute statements to roles.|[][Attribute Mapping](#attribute-mapping)|
+|audience|Uniquely identifies our service provider.|string|
+|cert|The identity provider certificate PEM. IDP signs `\<Response\>` responses using this certificate.|string|
+|client_redirect_settings|Defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones.|[SSO Client Redirect Settings](#sso-client-redirect-settings)|
+|display|Controls how this connector is displayed.|string|
+|entity_descriptor|XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.|string|
+|entity_descriptor_url|A URL that supplies a configuration XML.|string|
+|force_authn|Specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO.|[SAML Force Authn](#saml-force-authn)|
+|include_subject|A flag that indicates whether the Subject element is included in the SAML authentication request. Defaults to false. Note: Some IdPs will reject requests that contain a Subject.|Boolean|
+|issuer|The identity provider issuer.|string|
+|mfa|Contains settings to enable SSO MFA checks through this auth connector.|[SAML Connector MFA Settings](#saml-connector-mfa-settings)|
+|preferred_request_binding|A preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.|string|
+|provider|The external identity provider.|string|
+|service_provider_issuer|The issuer of the service provider (Teleport).|string|
+|signing_key_pair|An x509 key pair used to sign AuthnRequest.|[Asymmetric Key Pair](#asymmetric-key-pair)|
+|single_logout_url|The SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.|string|
+|sso|The URL of the identity provider's SSO service.|string|
+|user_matchers|A set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.|[]string|
+
+## SAML Force Authn
+
+Specified whether existing SAML sessions should be accepted or re-authentication should be forced.
+
+
+## SSO Client Redirect Settings
+
+Contains settings to define which additional client redirect URLs should be allowed for non-browser SSO logins.
+
+
+Example:
+
+```yaml
+allowed_https_hostnames: 
+  - "string"
+  - "string"
+  - "string"
+insecure_allowed_cidr_ranges: 
+  - "string"
+  - "string"
+  - "string"
+```
+
+|Field Name|Description|Type|
+|---|---|---|
+|allowed_https_hostnames|A list of hostnames allowed for https client redirect URLs|[]string|
+|insecure_allowed_cidr_ranges|A list of CIDRs allowed for HTTP or HTTPS client redirect URLs|[]string|
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx
new file mode 100644
index 0000000000000..5a62a3ccdc7cb
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx
@@ -0,0 +1,72 @@
+---
+title: Teleport Resource Reference
+description: Reference documentation for Teleport resources
+tags:
+ - reference
+ - platform-wide
+---
+
+The guides in this section list fields within dynamic resources you can manage
+with Teleport. For more information on dynamic resources, see our guide to
+[Using Dynamic
+Resources](../../../zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx).
+
+Examples of applying dynamic resources with `tctl`:
+
+```code
+# List all connectors:
+$ tctl get connectors
+
+# Dump a SAML connector called "okta":
+$ tctl get saml/okta
+
+# Delete a SAML connector called "okta":
+$ tctl rm saml/okta
+
+# Delete an OIDC connector called "gworkspace":
+$ tctl rm oidc/gworkspace
+
+# Delete a github connector called "myteam":
+$ tctl rm github/myteam
+
+# Delete a local user called "admin":
+$ tctl rm users/admin
+
+# Show all devices:
+$ tctl get devices
+
+# Fetch a specific device:
+$ tctl get devices/<asset-tag>
+
+# Fetch the cluster auth preferences
+$ tctl get cluster_auth_preference
+```
+
+<Admonition type="note">
+  Although `tctl get connectors` will show you every connector, when working with an individual connector you must use the correct `kind`, such as `saml` or `oidc`. You can see each connector's `kind` at the top of its YAML output from `tctl get connectors`.
+</Admonition>
+
+Here's the list of resources currently exposed via [`tctl`](../../cli/tctl.mdx):
+
+| Resource Kind | Description |
+| - | - |
+| [user](user.mdx) | A user record in the internal Teleport user DB. |
+| [role](role.mdx) | A role assumed by interactive and non-interactive users. |
+| connector | Authentication connectors for [Single Sign-On](../../../zero-trust-access/sso/sso.mdx) (SSO) for SAML, OIDC and GitHub. |
+| node | A registered SSH node. The same record is displayed via `tctl nodes ls`. |
+| windows_desktop | A registered Windows desktop. |
+| cluster | A trusted cluster. See [here](../../../zero-trust-access/deploy-a-cluster/trustedclusters.mdx) for more details on connecting clusters together. |
+| [login_rule](login-rules.mdx) | A Login Rule, see the [Login Rules guide](../../../zero-trust-access/sso/login-rules/login-rules.mdx) for more info. |
+| [device](device.mdx) | A Teleport Trusted Device, see the [Device Trust guide](../../../identity-governance/device-trust/guide.mdx) for more info. |
+| [ui_config](ui-config.mdx) | Configuration for the Web UI served by the Proxy Service. |
+| [vnet_config](vnet-config.mdx) | Configuration for the cluster's VNet options. |
+| [cluster_auth_preference](cluster-auth-preferences.mdx) | Configuration for the cluster's auth preferences. |
+| [database_object_import_rule](database-object-import-rule.mdx) | Database object import rules. |
+| [autoupdate_config](auto-update-config.mdx) | Client tools auto-update configuration |
+| [autoupdate_version](auto-update-version.mdx) | Client tools auto-update target version configuration |
+| [access_monitoring_rule](access-monitoring-rule.mdx) | Access monitoring rules. |
+| [health_check_config](health-check-config.mdx) | Configuration for resource endpoint health checks |
+| [inference_model](inference-model.mdx) | Session summarization AI model configuration |
+| [inference_secret](inference-secret.mdx) | Session summarization AI provider secret (API key) |
+| [inference_policy](inference-policy.mdx)| Matches sessions to inference models using session kind and other metadata |
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/ui-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/ui-config.mdx
new file mode 100644
index 0000000000000..f6ccbc3384a66
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/ui-config.mdx
@@ -0,0 +1,12 @@
+---
+title: UI Config Resource Reference
+sidebar_label: UI Config
+description: Provides a comprehensive list of fields for the Teleport UI config resource.
+---
+
+The UI config resource contains global configuration options for the Web UI
+served by the Proxy Service. This resource is not set by default, which means a
+`tctl get ui` will result in an error if used before this resource has been set.
+
+(!docs/pages/includes/ui-config-spec.mdx!)
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/user.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/user.mdx
new file mode 100644
index 0000000000000..eaa5e9d409694
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/user.mdx
@@ -0,0 +1,41 @@
+---
+title: User Resource Reference
+sidebar_label: User
+description: Provides a comprehensive list of fields for the Teleport user resource.
+---
+
+Teleport supports interactive local users, non-interactive local users (bots)
+and single-sign on users, and represents these with a dynamic resource: 
+
+```yaml
+kind: user
+version: v2
+metadata:
+  name: joe
+spec:
+  # roles is a list of roles assigned to this user
+  roles:
+  - admin
+  # status sets user temporarily locked in a Teleport system, for example
+  # when users exceed predefined amount of failed login attempts
+  status:
+    is_locked: false
+    lock_expires: 0001-01-01T00:00:00Z
+    locked_time: 0001-01-01T00:00:00Z
+  # traits are key, list of values pairs assigned to a user resource.
+  # Traits can be used in role templates as variables.
+  traits:
+    logins:
+    - joe
+    - root
+  # expires, if not empty, sets automatic expiry of the resource
+  expires: 0001-01-01T00:00:00Z
+  # created_by is a system property that tracks
+  # identity of the author of this user resource.
+  created_by:
+    time: 0001-01-01T00:00:00Z
+    user:
+      name: builtin-Admin
+```
+
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/vnet-config.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/vnet-config.mdx
new file mode 100644
index 0000000000000..5d56f0576d0ce
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/vnet-config.mdx
@@ -0,0 +1,29 @@
+---
+title: VNet Config Resource Reference
+sidebar_label: VNet Config
+description: Provides a comprehensive list of fields for the Teleport VNet config resource.
+---
+
+The VNet config resource contains cluster-specific options VNet should use when
+setting up connections to resources from this cluster.
+
+See [VNet](../../../enroll-resources/application-access/vnet.mdx) for more details.
+
+```yaml
+kind: vnet_config
+version: v1
+metadata:
+  name: vnet-config
+spec:
+  # The range to use when assigning IP addresses to resources.
+  # It can be changed in case of conflicts with other software
+  # deployed on end user devices. Defaults to "100.64.0.0/10".
+  ipv4_cidr_range: "100.64.0.0/10"
+  # Extra DNS zones that VNet should capture DNS queries for.
+  # Set them if your TCP apps use custom public_addr.
+  # Requires DNS TXT record to be set on the domains,
+  # see the guide linked above. Empty by default.
+  custom_dns_zones:
+  - suffix: company.test
+```
+
diff --git a/docs/pages/reference/infrastructure-as-code/teleport-resources/windows-desktops.mdx b/docs/pages/reference/infrastructure-as-code/teleport-resources/windows-desktops.mdx
new file mode 100644
index 0000000000000..e10005fceb803
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/teleport-resources/windows-desktops.mdx
@@ -0,0 +1,24 @@
+---
+title: Windows Desktops Resource Reference
+sidebar_label: Windows Desktops
+description: Provides a guide to the Teleport windows desktop resource.
+---
+
+In most cases, Teleport will register `windows_desktop` resources automatically
+based on static hosts in your configuration file or via LDAP-based discovery.
+
+You can also use [dynamic
+registration](../../../enroll-resources/desktop-access/dynamic-registration.mdx) using
+`dynamic_windows_desktop` resources. This can be useful for managing inventories
+of hosts that are not joined to an Active Directory domain.
+
+There are a few important considerations to keep in mind when registering
+desktops this way:
+
+1. The desktop's `addr` can be a hostname or IP address, and should include
+   the RDP port (typically 3389).
+1. If you intend to log in to the desktop with local Windows users you must set
+   `non_ad: true`. If you intend to log in with Active Directory users, leave
+   `non_ad` unset (or false), and specify the Active Directory domain in the
+   `domain` field.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list.mdx
new file mode 100644
index 0000000000000..f9e324ade47f8
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list.mdx
@@ -0,0 +1,164 @@
+---
+title: Reference for the teleport_access_list Terraform data-source
+sidebar_label: access_list
+description: This page describes the supported values of the teleport_access_list data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_access_list` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) spec is the specification for the Access List. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `owners` (Attributes List) owners is a list of owners of the Access List. (see [below for nested schema](#nested-schema-for-specowners))
+
+Optional:
+
+- `audit` (Attributes) audit describes the frequency that this Access List must be audited. (see [below for nested schema](#nested-schema-for-specaudit))
+- `description` (String) description is an optional plaintext description of the Access List.
+- `grants` (Attributes) grants describes the access granted by membership to this Access List. (see [below for nested schema](#nested-schema-for-specgrants))
+- `membership_requires` (Attributes) membership_requires describes the requirements for a user to be a member of the Access List. For a membership to an Access List to be effective, the user must meet the requirements of Membership_requires and must be in the members list. (see [below for nested schema](#nested-schema-for-specmembership_requires))
+- `owner_grants` (Attributes) owner_grants describes the access granted by owners to this Access List. (see [below for nested schema](#nested-schema-for-specowner_grants))
+- `ownership_requires` (Attributes) ownership_requires describes the requirements for a user to be an owner of the Access List. For ownership of an Access List to be effective, the user must meet the requirements of ownership_requires and must be in the owners list. (see [below for nested schema](#nested-schema-for-specownership_requires))
+- `title` (String) title is a plaintext short description of the Access List.
+- `type` (String) type can be an empty string which denotes a regular Access List, "scim" which represents an Access List created from SCIM group or "static" for Access Lists managed by IaC tools.
+
+### Nested Schema for `spec.owners`
+
+Optional:
+
+- `description` (String) description is the plaintext description of the owner and why they are an owner.
+- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
+- `name` (String) name is the username of the owner.
+
+
+### Nested Schema for `spec.audit`
+
+Optional:
+
+- `next_audit_date` (String) next_audit_date is when the next audit date should be done by.
+- `notifications` (Attributes) notifications is the configuration for notifying users. (see [below for nested schema](#nested-schema-for-specauditnotifications))
+- `recurrence` (Attributes) recurrence is the recurrence definition (see [below for nested schema](#nested-schema-for-specauditrecurrence))
+
+### Nested Schema for `spec.audit.notifications`
+
+Optional:
+
+- `start` (String) start specifies when to start notifying users that the next audit date is coming up.
+
+
+### Nested Schema for `spec.audit.recurrence`
+
+Optional:
+
+- `day_of_month` (Number) day_of_month is the day of month that reviews will be scheduled on. Supported values are 0, 1, 15, and 31.
+- `frequency` (Number) frequency is the frequency of reviews. This represents the period in months between two reviews. Supported values are 0, 1, 3, 6, and 12.
+
+
+
+### Nested Schema for `spec.grants`
+
+Optional:
+
+- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
+- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specgrantstraits))
+
+### Nested Schema for `spec.grants.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.membership_requires`
+
+Optional:
+
+- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
+- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specmembership_requirestraits))
+
+### Nested Schema for `spec.membership_requires.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.owner_grants`
+
+Optional:
+
+- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
+- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specowner_grantstraits))
+
+### Nested Schema for `spec.owner_grants.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.ownership_requires`
+
+Optional:
+
+- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
+- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specownership_requirestraits))
+
+### Nested Schema for `spec.ownership_requires.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list_member.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list_member.mdx
new file mode 100644
index 0000000000000..746ce0cade95f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_list_member.mdx
@@ -0,0 +1,67 @@
+---
+title: Reference for the teleport_access_list_member Terraform data-source
+sidebar_label: access_list_member
+description: This page describes the supported values of the teleport_access_list_member data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_access_list_member` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) spec is the specification for the Access List member. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `access_list` (String) associated Access List
+- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
+
+Optional:
+
+- `added_by` (String) added_by is the user that added this user to the Access List.
+- `expires` (String) expires is when the user's membership to the Access List expires.
+- `joined` (String) joined is when the user joined the Access List.
+- `name` (String) name is the name of the member of the Access List.
+- `reason` (String) reason is the reason this user was added to the Access List.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_monitoring_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_monitoring_rule.mdx
new file mode 100644
index 0000000000000..5250b0e536d63
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/access_monitoring_rule.mdx
@@ -0,0 +1,97 @@
+---
+title: Reference for the teleport_access_monitoring_rule Terraform data-source
+sidebar_label: access_monitoring_rule
+description: This page describes the supported values of the teleport_access_monitoring_rule data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_access_monitoring_rule` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an AccessMonitoringRule specification (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) version is version
+
+### Optional
+
+- `metadata` (Attributes) metadata is the rules's metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Required:
+
+- `subjects` (List of String) subjects the rule operates on, can be a resource kind or a particular resource property.
+
+Optional:
+
+- `automatic_review` (Attributes) automatic_review defines automatic review configurations for Access Requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specautomatic_review))
+- `condition` (String) condition is a predicate expression that operates on the specified subject resources, and determines whether the subject will be moved into desired state.
+- `desired_state` (String) desired_state defines the desired state of the subject. For Access Request subjects, the desired_state may be set to `reviewed` to indicate that the Access Request should be automatically reviewed.
+- `notification` (Attributes) notification defines the plugin configuration for notifications if rule is triggered. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specnotification))
+- `schedules` (Attributes Map) schedules specifies a map of schedules that can be used to configure the access monitoring rule conditions.  Available in Teleport v18.2.8 or higher. (see [below for nested schema](#nested-schema-for-specschedules))
+- `states` (List of String) states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.
+
+### Nested Schema for `spec.automatic_review`
+
+Optional:
+
+- `decision` (String) decision specifies the proposed state of the access review. This can be either 'APPROVED' or 'DENIED'.
+- `integration` (String) integration is the name of the integration that is responsible for monitoring the rule. Set this value to `builtin` to monitor the rule with Teleport.
+
+
+### Nested Schema for `spec.notification`
+
+Optional:
+
+- `name` (String) name is the name of the plugin to which this configuration should apply.
+- `recipients` (List of String) recipients is the list of recipients the plugin should notify.
+
+
+### Nested Schema for `spec.schedules`
+
+Optional:
+
+- `time` (Attributes) TimeSchedule specifies an in-line schedule. (see [below for nested schema](#nested-schema-for-specschedulestime))
+
+### Nested Schema for `spec.schedules.time`
+
+Optional:
+
+- `shifts` (Attributes List) Shifts contains a set of shifts that make up the schedule. (see [below for nested schema](#nested-schema-for-specschedulestimeshifts))
+- `timezone` (String) Timezone specifies the schedule timezone. This field is optional and defaults to "UTC". Accepted values use timezone locations as defined in the IANA Time Zone Database, such as "America/Los_Angeles", "Europe/Lisbon", or "Asia/Singapore".  See https://data.iana.org/time-zones/tzdb/zone1970.tab for a list of supported values.
+
+### Nested Schema for `spec.schedules.time.shifts`
+
+Optional:
+
+- `end` (String) End specifies the end time in the format HH:MM, e.g., "12:30".
+- `start` (String) Start specifies the start time in the format HH:MM, e.g., "12:30".
+- `weekday` (String) Weekday specifies the day of the week, e.g., "Sunday", "Monday", "Tuesday".
+
+
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/app.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/app.mdx
new file mode 100644
index 0000000000000..ae410ab849153
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/app.mdx
@@ -0,0 +1,149 @@
+---
+title: Reference for the teleport_app Terraform data-source
+sidebar_label: app
+description: This page describes the supported values of the teleport_app data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_app` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is the app resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the app resource spec. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource subkind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `aws` (Attributes) AWS contains additional options for AWS applications. (see [below for nested schema](#nested-schema-for-specaws))
+- `cloud` (String) Cloud identifies the cloud instance the app represents.
+- `cors` (Attributes) CORSPolicy defines the Cross-Origin Resource Sharing settings for the app. (see [below for nested schema](#nested-schema-for-speccors))
+- `dynamic_labels` (Attributes Map) DynamicLabels are the app's command labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
+- `identity_center` (Attributes) IdentityCenter encasulates AWS identity-center specific information. Only valid for Identity Center account apps. (see [below for nested schema](#nested-schema-for-specidentity_center))
+- `insecure_skip_verify` (Boolean) InsecureSkipVerify disables app's TLS certificate verification.
+- `integration` (String) Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.
+- `mcp` (Attributes) MCP contains MCP server related configurations. (see [below for nested schema](#nested-schema-for-specmcp))
+- `public_addr` (String) PublicAddr is the public address the application is accessible at.
+- `required_app_names` (List of String) RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate along side this app.
+- `rewrite` (Attributes) Rewrite is a list of rewriting rules to apply to requests and responses. (see [below for nested schema](#nested-schema-for-specrewrite))
+- `tcp_ports` (Attributes List) TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol. (see [below for nested schema](#nested-schema-for-spectcp_ports))
+- `uri` (String) URI is the web app endpoint.
+- `use_any_proxy_public_addr` (Boolean) UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.
+- `user_groups` (List of String) UserGroups are a list of user group IDs that this app is associated with.
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `external_id` (String) ExternalID is the AWS External ID used when assuming roles in this app.
+- `roles_anywhere_profile` (Attributes) RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps. (see [below for nested schema](#nested-schema-for-specawsroles_anywhere_profile))
+
+### Nested Schema for `spec.aws.roles_anywhere_profile`
+
+Optional:
+
+- `accept_role_session_name` (Boolean) Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName
+- `profile_arn` (String) ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.
+
+
+
+### Nested Schema for `spec.cors`
+
+Optional:
+
+- `allow_credentials` (Boolean) allow_credentials indicates whether credentials are allowed.
+- `allowed_headers` (List of String) allowed_headers specifies which headers can be used when accessing the app.
+- `allowed_methods` (List of String) allowed_methods specifies which methods are allowed when accessing the app.
+- `allowed_origins` (List of String) allowed_origins specifies which origins are allowed to access the app.
+- `exposed_headers` (List of String) exposed_headers indicates which headers are made available to scripts via the browser.
+- `max_age` (Number) max_age indicates how long (in seconds) the results of a preflight request can be cached.
+
+
+### Nested Schema for `spec.dynamic_labels`
+
+Optional:
+
+- `command` (List of String) Command is a command to run
+- `period` (String) Period is a time between command runs
+- `result` (String) Result captures standard output
+
+
+### Nested Schema for `spec.identity_center`
+
+Optional:
+
+- `account_id` (String) Account ID is the AWS-assigned ID of the account
+- `permission_sets` (Attributes List) PermissionSets lists the available permission sets on the given account (see [below for nested schema](#nested-schema-for-specidentity_centerpermission_sets))
+
+### Nested Schema for `spec.identity_center.permission_sets`
+
+Optional:
+
+- `arn` (String) ARN is the fully-formed ARN of the Permission Set.
+- `assignment_name` (String) AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.
+- `name` (String) Name is the human-readable name of the Permission Set.
+
+
+
+### Nested Schema for `spec.mcp`
+
+Optional:
+
+- `args` (List of String) Args to execute with the command.
+- `command` (String) Command to launch stdio-based MCP servers.
+- `run_as_host_user` (String) RunAsHostUser is the host user account under which the command will be executed. Required for stdio-based MCP servers.
+
+
+### Nested Schema for `spec.rewrite`
+
+Optional:
+
+- `headers` (Attributes List) Headers is a list of headers to inject when passing the request over to the application. (see [below for nested schema](#nested-schema-for-specrewriteheaders))
+- `jwt_claims` (String) JWTClaims configures whether roles/traits are included in the JWT token.
+- `redirect` (List of String) Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.
+
+### Nested Schema for `spec.rewrite.headers`
+
+Optional:
+
+- `name` (String) Name is the http header name.
+- `value` (String) Value is the http header value.
+
+
+
+### Nested Schema for `spec.tcp_ports`
+
+Optional:
+
+- `end_port` (Number) EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.
+- `port` (Number) Port describes the start of the range. It must be between 1 and 65535.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/auth_preference.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/auth_preference.mdx
new file mode 100644
index 0000000000000..149dc2fcb54e3
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/auth_preference.mdx
@@ -0,0 +1,137 @@
+---
+title: Reference for the teleport_auth_preference Terraform data-source
+sidebar_label: auth_preference
+description: This page describes the supported values of the teleport_auth_preference data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_auth_preference` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an AuthPreference specification (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `allow_headless` (Boolean) AllowHeadless enables/disables headless support. Headless authentication requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
+- `allow_local_auth` (Boolean) AllowLocalAuth is true if local authentication is enabled.
+- `allow_passwordless` (Boolean) AllowPasswordless enables/disables passwordless support. Passwordless requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
+- `connector_name` (String) ConnectorName is the name of the OIDC or SAML connector. If this value is not set the first connector in the backend will be used.
+- `default_session_ttl` (String) DefaultSessionTTL is the TTL to use for user certs when an explicit TTL is not requested.
+- `device_trust` (Attributes) DeviceTrust holds settings related to trusted device verification. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specdevice_trust))
+- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert provides disconnect expired certificate setting - if true, connections with expired client certificates will get disconnected
+- `hardware_key` (Attributes) HardwareKey are the settings for hardware key support. (see [below for nested schema](#nested-schema-for-spechardware_key))
+- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specidp))
+- `locking_mode` (String) LockingMode is the cluster-wide locking mode default.
+- `message_of_the_day` (String)
+- `okta` (Attributes) Okta is a set of options related to the Okta service in Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specokta))
+- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this cluster. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
+- `second_factor` (String) SecondFactor is the type of mult-factor. Deprecated: Prefer using SecondFactors instead.
+- `second_factors` (List of Number) SecondFactors is a list of supported multi-factor types. 1 is "otp", 2 is "webauthn", 3 is "sso", If unspecified, the current default value is [1], or ["otp"].
+- `signature_algorithm_suite` (Number) SignatureAlgorithmSuite is the configured signature algorithm suite for the cluster. If unspecified, the current default value is "legacy". 1 is "legacy", 2 is "balanced-v1", 3 is "fips-v1", 4 is "hsm-v1".
+- `stable_unix_user_config` (Attributes) StableUnixUserConfig contains the cluster-wide configuration for stable UNIX users. (see [below for nested schema](#nested-schema-for-specstable_unix_user_config))
+- `type` (String) Type is the type of authentication.
+- `u2f` (Attributes) U2F are the settings for the U2F device. (see [below for nested schema](#nested-schema-for-specu2f))
+- `webauthn` (Attributes) Webauthn are the settings for server-side Web Authentication support. (see [below for nested schema](#nested-schema-for-specwebauthn))
+
+### Nested Schema for `spec.device_trust`
+
+Optional:
+
+- `auto_enroll` (Boolean) Enable device auto-enroll. Auto-enroll lets any user issue a device enrollment token for a known device that is not already enrolled. `tsh` takes advantage of auto-enroll to automatically enroll devices on user login, when appropriate. The effective cluster Mode still applies: AutoEnroll=true is meaningless if Mode="off".
+- `ekcert_allowed_cas` (List of String) Allow list of EKCert CAs in PEM format. If present, only TPM devices that present an EKCert that is signed by a CA specified here may be enrolled (existing enrollments are unchanged).  If not present, then the CA of TPM EKCerts will not be checked during enrollment, this allows any device to enroll.
+- `mode` (String) Mode of verification for trusted devices.  The following modes are supported:  - "off": disables both device authentication and authorization. - "optional": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - "required": enforces the presence of device extensions for sensitive endpoints. - "required-for-humans": enforces the presence of device extensions for sensitive endpoints, for human users only (bots are exempt).  Mode is always "off" for OSS. Defaults to "optional" for Enterprise.
+
+
+### Nested Schema for `spec.hardware_key`
+
+Optional:
+
+- `pin_cache_ttl` (String) PinCacheTTL is the amount of time in nanoseconds that Teleport clients will cache the user's PIV PIN when hardware key PIN policy is enabled.
+- `piv_slot` (String) PIVSlot is a PIV slot that Teleport clients should use instead of the default based on private key policy. For example, "9a" or "9e".
+- `serial_number_validation` (Attributes) SerialNumberValidation holds settings for hardware key serial number validation. By default, serial number validation is disabled. (see [below for nested schema](#nested-schema-for-spechardware_keyserial_number_validation))
+
+### Nested Schema for `spec.hardware_key.serial_number_validation`
+
+Optional:
+
+- `enabled` (Boolean) Enabled indicates whether hardware key serial number validation is enabled.
+- `serial_number_trait_name` (String) SerialNumberTraitName is an optional custom user trait name for hardware key serial numbers to replace the default: "hardware_key_serial_numbers".  Note: Values for this user trait should be a comma-separated list of serial numbers, or a list of comm-separated lists. e.g ["123", "345,678"]
+
+
+
+### Nested Schema for `spec.idp`
+
+Optional:
+
+- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specidpsaml))
+
+### Nested Schema for `spec.idp.saml`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
+
+
+
+### Nested Schema for `spec.okta`
+
+Optional:
+
+- `sync_period` (String) SyncPeriod is the duration between synchronization calls in nanoseconds.
+
+
+### Nested Schema for `spec.stable_unix_user_config`
+
+Optional:
+
+- `enabled` (Boolean) Enabled signifies that (UNIX) Teleport SSH hosts should obtain a UID from the control plane if they're about to provision a host user with no other configured UID.
+- `first_uid` (Number) FirstUid is the start of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
+- `last_uid` (Number) LastUid is the end of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
+
+
+### Nested Schema for `spec.u2f`
+
+Optional:
+
+- `app_id` (String) AppID returns the application ID for universal mult-factor.
+- `device_attestation_cas` (List of String) DeviceAttestationCAs contains the trusted attestation CAs for U2F devices.
+- `facets` (List of String) Facets returns the facets for universal mult-factor. Deprecated: Kept for backwards compatibility reasons, but Facets have no effect since Teleport v10, when Webauthn replaced the U2F implementation.
+
+
+### Nested Schema for `spec.webauthn`
+
+Optional:
+
+- `attestation_allowed_cas` (List of String) Allow list of device attestation CAs in PEM format. If present, only devices whose attestation certificates match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationDeniedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default all devices are allowed.
+- `attestation_denied_cas` (List of String) Deny list of device attestation CAs in PEM format. If present, only devices whose attestation certificates don't match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationAllowedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default no devices are denied.
+- `rp_id` (String) RPID is the ID of the Relying Party. It should be set to the domain name of the Teleport installation.  IMPORTANT: RPID must never change in the lifetime of the cluster, because it's recorded in the registration data on the WebAuthn device. If the RPID changes, all existing WebAuthn key registrations will become invalid and all users who use WebAuthn as the multi-factor will need to re-register.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_config.mdx
new file mode 100644
index 0000000000000..cd5e0e238d65a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_config.mdx
@@ -0,0 +1,81 @@
+---
+title: Reference for the teleport_autoupdate_config Terraform data-source
+sidebar_label: autoupdate_config
+description: This page describes the supported values of the teleport_autoupdate_config data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_autoupdate_config` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String)
+
+### Optional
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String)
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
+- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
+
+### Nested Schema for `spec.agents`
+
+Optional:
+
+- `maintenance_window_duration` (String) maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based". Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next maintenance window.
+- `mode` (String) mode specifies whether agent autoupdates are enabled, disabled, or paused.
+- `schedules` (Attributes) schedules specifies schedules for updates of grouped agents. (see [below for nested schema](#nested-schema-for-specagentsschedules))
+- `strategy` (String) strategy to use for updating the agents.
+
+### Nested Schema for `spec.agents.schedules`
+
+Optional:
+
+- `regular` (Attributes List) regular schedules for non-critical versions. (see [below for nested schema](#nested-schema-for-specagentsschedulesregular))
+
+### Nested Schema for `spec.agents.schedules.regular`
+
+Optional:
+
+- `canary_count` (Number) canary_count is the number of canary agents that will be updated before the whole group is updated. when set to 0, the group does not enter the canary phase. This number is capped to 5. This number must always be lower than the total number of agents in the group, else the rollout will be stuck.
+- `days` (List of String) days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
+- `name` (String) name of the group
+- `start_hour` (Number) start_hour to initiate update
+- `wait_hours` (Number) wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure". This field must be positive.
+
+
+
+
+### Nested Schema for `spec.tools`
+
+Optional:
+
+- `mode` (String) Mode defines state of the client tools auto update.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `name` (String) name is an object name.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_version.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_version.mdx
new file mode 100644
index 0000000000000..e3aa18e578f71
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/autoupdate_version.mdx
@@ -0,0 +1,63 @@
+---
+title: Reference for the teleport_autoupdate_version Terraform data-source
+sidebar_label: autoupdate_version
+description: This page describes the supported values of the teleport_autoupdate_version data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_autoupdate_version` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String)
+
+### Optional
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String)
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
+- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
+
+### Nested Schema for `spec.agents`
+
+Optional:
+
+- `mode` (String) autoupdate_mode to use for the rollout
+- `schedule` (String) schedule to use for the rollout
+- `start_version` (String) start_version is the version used for newly installed agents before their update window.
+- `target_version` (String) target_version is the version that all agents will update to during their update window.
+
+
+### Nested Schema for `spec.tools`
+
+Optional:
+
+- `target_version` (String) TargetVersion specifies the semantic version required for tools to establish a connection with the cluster. Client tools after connection to the cluster going to be updated to this version automatically.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `name` (String) name is an object name.
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/cluster_maintenance_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_maintenance_config.mdx
similarity index 93%
rename from docs/pages/reference/terraform-provider/data-sources/cluster_maintenance_config.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_maintenance_config.mdx
index 338a4dd882953..543286936b977 100644
--- a/docs/pages/reference/terraform-provider/data-sources/cluster_maintenance_config.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_maintenance_config.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_cluster_ma
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_cluster_maintenance_config` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_networking_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_networking_config.mdx
new file mode 100644
index 0000000000000..2130fe042aeda
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/cluster_networking_config.mdx
@@ -0,0 +1,73 @@
+---
+title: Reference for the teleport_cluster_networking_config Terraform data-source
+sidebar_label: cluster_networking_config
+description: This page describes the supported values of the teleport_cluster_networking_config data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_cluster_networking_config` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a ClusterNetworkingConfig specification (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `assist_command_execution_workers` (Number) AssistCommandExecutionWorkers determines the number of workers that will execute arbitrary Assist commands on servers in parallel
+- `case_insensitive_routing` (Boolean) CaseInsensitiveRouting causes proxies to use case-insensitive hostname matching.
+- `client_idle_timeout` (String) ClientIdleTimeout sets global cluster default setting for client idle timeouts.
+- `idle_timeout_message` (String) ClientIdleTimeoutMessage is the message sent to the user when a connection times out.
+- `keep_alive_count_max` (Number) KeepAliveCountMax is the number of keep-alive messages that can be missed before the server disconnects the connection to the client.
+- `keep_alive_interval` (String) KeepAliveInterval is the interval at which the server sends keep-alive messages to the client.
+- `proxy_listener_mode` (Number) ProxyListenerMode is proxy listener mode used by Teleport Proxies. 0 is "separate"; 1 is "multiplex".
+- `proxy_ping_interval` (String) ProxyPingInterval defines in which interval the TLS routing ping message should be sent. This is applicable only when using ping-wrapped connections, regular TLS routing connections are not affected.
+- `routing_strategy` (Number) RoutingStrategy determines the strategy used to route to nodes. 0 is "unambiguous_match"; 1 is "most_recent".
+- `session_control_timeout` (String) SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the Auth Service before it begins terminating controlled sessions.
+- `ssh_dial_timeout` (String) SSHDialTimeout is a custom dial timeout used when establishing SSH connections. If not set, the default timeout of 30s will be used.
+- `tunnel_strategy` (Attributes) TunnelStrategyV1 determines the tunnel strategy used in the cluster. (see [below for nested schema](#nested-schema-for-spectunnel_strategy))
+- `web_idle_timeout` (String) WebIdleTimeout sets global cluster default setting for the web UI idle timeouts.
+
+### Nested Schema for `spec.tunnel_strategy`
+
+Optional:
+
+- `agent_mesh` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyagent_mesh))
+- `proxy_peering` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyproxy_peering))
+
+### Nested Schema for `spec.tunnel_strategy.agent_mesh`
+
+Optional:
+
+- `active` (Boolean) Automatically generated field preventing empty message errors
+
+
+### Nested Schema for `spec.tunnel_strategy.proxy_peering`
+
+Optional:
+
+- `agent_connection_count` (Number)
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/data-sources.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/data-sources.mdx
new file mode 100644
index 0000000000000..068b458f182fb
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/data-sources.mdx
@@ -0,0 +1,43 @@
+---
+title: "Terraform data-sources index"
+description: "Index of all the data-sources supported by the Teleport Terraform Provider"
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+{/*
+    This file will be renamed data-sources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+The Teleport Terraform provider supports the following data-sources:
+
+  - [`teleport_access_list`](./access_list.mdx)
+  - [`teleport_access_list_member`](./access_list_member.mdx)
+  - [`teleport_access_monitoring_rule`](./access_monitoring_rule.mdx)
+  - [`teleport_app`](./app.mdx)
+  - [`teleport_auth_preference`](./auth_preference.mdx)
+  - [`teleport_autoupdate_config`](./autoupdate_config.mdx)
+  - [`teleport_autoupdate_version`](./autoupdate_version.mdx)
+  - [`teleport_cluster_maintenance_config`](./cluster_maintenance_config.mdx)
+  - [`teleport_cluster_networking_config`](./cluster_networking_config.mdx)
+  - [`teleport_database`](./database.mdx)
+  - [`teleport_discovery_config`](./discovery_config.mdx)
+  - [`teleport_dynamic_windows_desktop`](./dynamic_windows_desktop.mdx)
+  - [`teleport_github_connector`](./github_connector.mdx)
+  - [`teleport_health_check_config`](./health_check_config.mdx)
+  - [`teleport_installer`](./installer.mdx)
+  - [`teleport_integration`](./integration.mdx)
+  - [`teleport_login_rule`](./login_rule.mdx)
+  - [`teleport_oidc_connector`](./oidc_connector.mdx)
+  - [`teleport_okta_import_rule`](./okta_import_rule.mdx)
+  - [`teleport_provision_token`](./provision_token.mdx)
+  - [`teleport_role`](./role.mdx)
+  - [`teleport_saml_connector`](./saml_connector.mdx)
+  - [`teleport_session_recording_config`](./session_recording_config.mdx)
+  - [`teleport_static_host_user`](./static_host_user.mdx)
+  - [`teleport_trusted_cluster`](./trusted_cluster.mdx)
+  - [`teleport_trusted_device`](./trusted_device.mdx)
+  - [`teleport_user`](./user.mdx)
+  - [`teleport_workload_identity`](./workload_identity.mdx)
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/database.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/database.mdx
new file mode 100644
index 0000000000000..f5824cd9c9a45
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/database.mdx
@@ -0,0 +1,273 @@
+---
+title: Reference for the teleport_database Terraform data-source
+sidebar_label: database
+description: This page describes the supported values of the teleport_database data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_database` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is the database metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the database spec. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource subkind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `protocol` (String) Protocol is the database protocol: postgres, mysql, mongodb, etc.
+- `uri` (String) URI is the database connection endpoint.
+
+Optional:
+
+- `ad` (Attributes) AD is the Active Directory configuration for the database. (see [below for nested schema](#nested-schema-for-specad))
+- `admin_user` (Attributes) AdminUser is the database admin user for automatic user provisioning. (see [below for nested schema](#nested-schema-for-specadmin_user))
+- `aws` (Attributes) AWS contains AWS specific settings for RDS/Aurora/Redshift databases. (see [below for nested schema](#nested-schema-for-specaws))
+- `azure` (Attributes) Azure contains Azure specific database metadata. (see [below for nested schema](#nested-schema-for-specazure))
+- `ca_cert` (String) CACert is the PEM-encoded database CA certificate.  DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.
+- `dynamic_labels` (Attributes Map) DynamicLabels is the database dynamic labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
+- `gcp` (Attributes) GCP contains parameters specific to GCP Cloud SQL databases. (see [below for nested schema](#nested-schema-for-specgcp))
+- `mongo_atlas` (Attributes) MongoAtlas contains Atlas metadata about the database. (see [below for nested schema](#nested-schema-for-specmongo_atlas))
+- `mysql` (Attributes) MySQL is an additional section with MySQL database options. (see [below for nested schema](#nested-schema-for-specmysql))
+- `oracle` (Attributes) Oracle is an additional Oracle configuration options. (see [below for nested schema](#nested-schema-for-specoracle))
+- `tls` (Attributes) TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name. (see [below for nested schema](#nested-schema-for-spectls))
+
+### Nested Schema for `spec.ad`
+
+Optional:
+
+- `domain` (String) Domain is the Active Directory domain the database resides in.
+- `kdc_host_name` (String) KDCHostName is the host name for a KDC for x509 Authentication.
+- `keytab_file` (String) KeytabFile is the path to the Kerberos keytab file.
+- `krb5_file` (String) Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.
+- `ldap_cert` (String) LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.
+- `ldap_service_account_name` (String) LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
+- `ldap_service_account_sid` (String) LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
+- `spn` (String) SPN is the service principal name for the database.
+
+
+### Nested Schema for `spec.admin_user`
+
+Optional:
+
+- `default_database` (String) DefaultDatabase is the database that the privileged database user logs into by default.  Depending on the database type, this database may be used to store procedures or data for managing database users.
+- `name` (String) Name is the username of the privileged database user.
+
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `account_id` (String) AccountID is the AWS account ID this database belongs to.
+- `assume_role_arn` (String) AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.
+- `docdb` (Attributes) DocumentDB contains Amazon DocumentDB-specific metadata. (see [below for nested schema](#nested-schema-for-specawsdocdb))
+- `elasticache` (Attributes) ElastiCache contains Amazon ElastiCache Redis-specific metadata. (see [below for nested schema](#nested-schema-for-specawselasticache))
+- `elasticache_serverless` (Attributes) ElastiCacheServerless contains Amazon ElastiCache Serverless metadata. (see [below for nested schema](#nested-schema-for-specawselasticache_serverless))
+- `external_id` (String) ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
+- `iam_policy_status` (Number) IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database.
+- `memorydb` (Attributes) MemoryDB contains AWS MemoryDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsmemorydb))
+- `opensearch` (Attributes) OpenSearch contains AWS OpenSearch specific metadata. (see [below for nested schema](#nested-schema-for-specawsopensearch))
+- `rds` (Attributes) RDS contains RDS specific metadata. (see [below for nested schema](#nested-schema-for-specawsrds))
+- `rdsproxy` (Attributes) RDSProxy contains AWS Proxy specific metadata. (see [below for nested schema](#nested-schema-for-specawsrdsproxy))
+- `redshift` (Attributes) Redshift contains Redshift specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift))
+- `redshift_serverless` (Attributes) RedshiftServerless contains Amazon Redshift Serverless-specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift_serverless))
+- `region` (String) Region is a AWS cloud region.
+- `secret_store` (Attributes) SecretStore contains secret store configurations. (see [below for nested schema](#nested-schema-for-specawssecret_store))
+- `session_tags` (Map of String) SessionTags is a list of AWS STS session tags.
+
+### Nested Schema for `spec.aws.docdb`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the cluster identifier.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `instance_id` (String) InstanceID is the instance identifier.
+
+
+### Nested Schema for `spec.aws.elasticache`
+
+Optional:
+
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `replication_group_id` (String) ReplicationGroupID is the Redis replication group ID.
+- `transit_encryption_enabled` (Boolean) TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.
+- `user_group_ids` (List of String) UserGroupIDs is a list of user group IDs.
+
+
+### Nested Schema for `spec.aws.elasticache_serverless`
+
+Optional:
+
+- `cache_name` (String) CacheName is an ElastiCache Serverless cache name.
+
+
+### Nested Schema for `spec.aws.memorydb`
+
+Optional:
+
+- `acl_name` (String) ACLName is the name of the ACL associated with the cluster.
+- `cluster_name` (String) ClusterName is the name of the MemoryDB cluster.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `tls_enabled` (Boolean) TLSEnabled indicates whether in-transit encryption (TLS) is enabled.
+
+
+### Nested Schema for `spec.aws.opensearch`
+
+Optional:
+
+- `domain_id` (String) DomainID is the ID of the domain.
+- `domain_name` (String) DomainName is the name of the domain.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+
+
+### Nested Schema for `spec.aws.rds`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the RDS cluster (Aurora) identifier.
+- `iam_auth` (Boolean) IAMAuth indicates whether database IAM authentication is enabled.
+- `instance_id` (String) InstanceID is the RDS instance identifier.
+- `resource_id` (String) ResourceID is the RDS instance resource identifier (db-xxx).
+- `security_groups` (List of String) SecurityGroups is a list of attached security groups for the RDS instance.
+- `subnets` (List of String) Subnets is a list of subnets for the RDS instance.
+- `vpc_id` (String) VPCID is the VPC where the RDS is running.
+
+
+### Nested Schema for `spec.aws.rdsproxy`
+
+Optional:
+
+- `custom_endpoint_name` (String) CustomEndpointName is the identifier of an RDS Proxy custom endpoint.
+- `name` (String) Name is the identifier of an RDS Proxy.
+- `resource_id` (String) ResourceID is the RDS instance resource identifier (prx-xxx).
+
+
+### Nested Schema for `spec.aws.redshift`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the Redshift cluster identifier.
+
+
+### Nested Schema for `spec.aws.redshift_serverless`
+
+Optional:
+
+- `endpoint_name` (String) EndpointName is the VPC endpoint name.
+- `workgroup_id` (String) WorkgroupID is the workgroup ID.
+- `workgroup_name` (String) WorkgroupName is the workgroup name.
+
+
+### Nested Schema for `spec.aws.secret_store`
+
+Optional:
+
+- `key_prefix` (String) KeyPrefix specifies the secret key prefix.
+- `kms_key_id` (String) KMSKeyID specifies the AWS KMS key for encryption.
+
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `is_flexi_server` (Boolean) IsFlexiServer is true if the database is an Azure Flexible server.
+- `name` (String) Name is the Azure database server name.
+- `redis` (Attributes) Redis contains Azure Cache for Redis specific database metadata. (see [below for nested schema](#nested-schema-for-specazureredis))
+- `resource_id` (String) ResourceID is the Azure fully qualified ID for the resource.
+
+### Nested Schema for `spec.azure.redis`
+
+Optional:
+
+- `clustering_policy` (String) ClusteringPolicy is the clustering policy for Redis Enterprise.
+
+
+
+### Nested Schema for `spec.dynamic_labels`
+
+Optional:
+
+- `command` (List of String) Command is a command to run
+- `period` (String) Period is a time between command runs
+- `result` (String) Result captures standard output
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `alloydb` (Attributes) AlloyDB contains AlloyDB specific configuration elements. (see [below for nested schema](#nested-schema-for-specgcpalloydb))
+- `instance_id` (String) InstanceID is the Cloud SQL instance ID.
+- `project_id` (String) ProjectID is the GCP project ID the Cloud SQL instance resides in.
+
+### Nested Schema for `spec.gcp.alloydb`
+
+Optional:
+
+- `endpoint_override` (String) EndpointOverride is an override of endpoint address to use.
+- `endpoint_type` (String) EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".
+
+
+
+### Nested Schema for `spec.mongo_atlas`
+
+Optional:
+
+- `name` (String) Name is the Atlas database instance name.
+
+
+### Nested Schema for `spec.mysql`
+
+Optional:
+
+- `server_version` (String) ServerVersion is the server version reported by DB proxy if the runtime information is not available.
+
+
+### Nested Schema for `spec.oracle`
+
+Optional:
+
+- `audit_user` (String) AuditUser is the name of the Oracle database user that should be used to access the internal audit trail.
+- `retry_count` (Number) RetryCount is the maximum number of times to retry connecting to a host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.
+- `shuffle_hostnames` (Boolean) ShuffleHostnames, when true, randomizes the order of hosts to connect to from the provided list.
+
+
+### Nested Schema for `spec.tls`
+
+Optional:
+
+- `ca_cert` (String) CACert is an optional user provided CA certificate used for verifying database TLS connection.
+- `mode` (Number) Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure".
+- `server_name` (String) ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.
+- `trust_system_cert_pool` (Boolean) TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/discovery_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/discovery_config.mdx
new file mode 100644
index 0000000000000..c93ea23d5ef69
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/discovery_config.mdx
@@ -0,0 +1,297 @@
+---
+title: Reference for the teleport_discovery_config Terraform data-source
+sidebar_label: discovery_config
+description: This page describes the supported values of the teleport_discovery_config data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_discovery_config` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `header` (Attributes) Header is the resource header. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) Spec is an DiscoveryConfig specification. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `access_graph` (Attributes) AccessGraph is the configurations for syncing Cloud accounts into Access Graph. (see [below for nested schema](#nested-schema-for-specaccess_graph))
+- `aws` (Attributes List) AWS is a list of AWS Matchers. (see [below for nested schema](#nested-schema-for-specaws))
+- `azure` (Attributes List) Azure is a list of Azure Matchers. (see [below for nested schema](#nested-schema-for-specazure))
+- `discovery_group` (String) DiscoveryGroup is used by discovery_service to add extra matchers. All the discovery_services that have the same discovery_group, will load the matchers of this resource.
+- `gcp` (Attributes List) GCP is a list of GCP Matchers. (see [below for nested schema](#nested-schema-for-specgcp))
+- `kube` (Attributes List) Kube is a list of Kubernetes Matchers. (see [below for nested schema](#nested-schema-for-speckube))
+
+### Nested Schema for `spec.access_graph`
+
+Optional:
+
+- `aws` (Attributes List) AWS is a configuration for AWS Access Graph service poll service. (see [below for nested schema](#nested-schema-for-specaccess_graphaws))
+- `azure` (Attributes List) Azure is a configuration for Azure Access Graph service poll service. (see [below for nested schema](#nested-schema-for-specaccess_graphazure))
+- `poll_interval` (String) PollInterval is the frequency at which to poll for resources
+
+### Nested Schema for `spec.access_graph.aws`
+
+Optional:
+
+- `assume_role` (Attributes) AssumeRoleARN is the AWS role to assume for database discovery. (see [below for nested schema](#nested-schema-for-specaccess_graphawsassume_role))
+- `cloud_trail_logs` (Attributes) Configuration settings for collecting AWS CloudTrail logs via an SQS queue. (see [below for nested schema](#nested-schema-for-specaccess_graphawscloud_trail_logs))
+- `eks_audit_logs` (Attributes) (see [below for nested schema](#nested-schema-for-specaccess_graphawseks_audit_logs))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs.
+- `regions` (List of String) Regions are AWS regions to import resources from.
+
+### Nested Schema for `spec.access_graph.aws.assume_role`
+
+Optional:
+
+- `external_id` (String) ExternalID is the external ID used to assume a role in another account.
+- `role_arn` (String) RoleARN is the fully specified AWS IAM role ARN.
+
+
+### Nested Schema for `spec.access_graph.aws.cloud_trail_logs`
+
+Optional:
+
+- `region` (String) The AWS region of the SQS queue for CloudTrail notifications, ex.: "us-east-2".
+- `sqs_queue` (String) The name or URL for CloudTrail log events, ex.: "demo-cloudtrail-queue".
+
+
+### Nested Schema for `spec.access_graph.aws.eks_audit_logs`
+
+Optional:
+
+- `tags` (Map of List of String) The tags of EKS clusters for which apiserver audit logs should be fetched.
+
+
+
+### Nested Schema for `spec.access_graph.azure`
+
+Optional:
+
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs.
+- `subscription_id` (String) SubscriptionID Is the ID of the Azure subscription to sync resources from
+
+
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `assume_role` (Attributes) AssumeRoleARN is the AWS role to assume for database discovery. (see [below for nested schema](#nested-schema-for-specawsassume_role))
+- `install` (Attributes) Params sets the join method when installing on discovered EC2 nodes (see [below for nested schema](#nested-schema-for-specawsinstall))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs. Environment credentials will not be used when this value is set.
+- `kube_app_discovery` (Boolean) KubeAppDiscovery controls whether Kubernetes App Discovery will be enabled for agents running on discovered clusters, currently only affects AWS EKS discovery in integration mode.
+- `organization` (Attributes) Organization is an AWS Organization matcher for discovering resources accross multiple accounts under an Organization. (see [below for nested schema](#nested-schema-for-specawsorganization))
+- `regions` (List of String) Regions are AWS regions to query for databases.
+- `setup_access_for_arn` (String) SetupAccessForARN is the role that the Discovery Service should create EKS Access Entries for. This value should match the IAM identity that Teleport Kubernetes Service uses. If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).
+- `ssm` (Attributes) SSM provides options to use when sending a document command to an EC2 node (see [below for nested schema](#nested-schema-for-specawsssm))
+- `tags` (Map of List of String) Tags are AWS resource Tags to match.
+- `types` (List of String) Types are AWS database types to match, "ec2", "rds", "redshift", "elasticache", or "memorydb".
+
+### Nested Schema for `spec.aws.assume_role`
+
+Optional:
+
+- `external_id` (String) ExternalID is the external ID used to assume a role in another account.
+- `role_arn` (String) RoleARN is the fully specified AWS IAM role ARN.
+
+
+### Nested Schema for `spec.aws.install`
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specawsinstallazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specawsinstallhttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.aws.install.azure`
+
+Optional:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.aws.install.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+### Nested Schema for `spec.aws.organization`
+
+Optional:
+
+- `organization_id` (String) OrganizationID is the AWS Organization ID to match against. Required.
+- `organizational_units` (Attributes) OrganizationalUnits contains rules for matchings AWS accounts based on their Organizational Units. (see [below for nested schema](#nested-schema-for-specawsorganizationorganizational_units))
+
+### Nested Schema for `spec.aws.organization.organizational_units`
+
+Optional:
+
+- `exclude` (List of String) Exclude is a list of AWS Organizational Unit IDs to exclude. Only exact matches or wildcard (*) are supported. If empty, no Organizational Units are excluded by default.
+- `include` (List of String) Include is a list of AWS Organizational Unit IDs to match. Only exact matches or wildcard (*) are supported. If empty, all Organizational Units are included by default.
+
+
+
+### Nested Schema for `spec.aws.ssm`
+
+Optional:
+
+- `document_name` (String) DocumentName is the name of the document to use when executing an SSM command
+
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `install_params` (Attributes) Params sets the join method when installing on discovered Azure nodes. (see [below for nested schema](#nested-schema-for-specazureinstall_params))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with Azure APIs. Environment credentials will not be used when this value is set.
+- `regions` (List of String) Regions are Azure locations to match for databases.
+- `resource_groups` (List of String) ResourceGroups are Azure resource groups to query for resources.
+- `subscriptions` (List of String) Subscriptions are Azure subscriptions to query for resources.
+- `tags` (Map of List of String) ResourceTags are Azure tags on resources to match.
+- `types` (List of String) Types are Azure types to match: "mysql", "postgres", "aks", "vm"
+
+### Nested Schema for `spec.azure.install_params`
+
+Required:
+
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specazureinstall_paramsazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specazureinstall_paramshttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.azure.install_params.azure`
+
+Required:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.azure.install_params.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `install_params` (Attributes) Params sets the join method when installing on discovered GCP nodes. (see [below for nested schema](#nested-schema-for-specgcpinstall_params))
+- `labels` (Map of List of String) Labels are GCP labels to match.
+- `locations` (List of String) Locations are GKE locations to search resources for.
+- `project_ids` (List of String) ProjectIDs are the GCP project ID where the resources are deployed.
+- `service_accounts` (List of String) ServiceAccounts are the emails of service accounts attached to VMs.
+- `tags` (Map of List of String) Tags is obsolete and only exists for backwards compatibility. Use Labels instead.
+- `types` (List of String) Types are GKE resource types to match: "gke", "vm".
+
+### Nested Schema for `spec.gcp.install_params`
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specgcpinstall_paramsazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specgcpinstall_paramshttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.gcp.install_params.azure`
+
+Optional:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.gcp.install_params.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+
+### Nested Schema for `spec.kube`
+
+Optional:
+
+- `labels` (Map of List of String) Labels are Kubernetes services labels to match.
+- `namespaces` (List of String) Namespaces are Kubernetes namespaces in which to discover services
+- `types` (List of String) Types are Kubernetes services types to match. Currently only 'app' is supported.
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/dynamic_windows_desktop.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/dynamic_windows_desktop.mdx
similarity index 93%
rename from docs/pages/reference/terraform-provider/data-sources/dynamic_windows_desktop.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/dynamic_windows_desktop.mdx
index efc0123c7c373..4d2ffbf114c6e 100644
--- a/docs/pages/reference/terraform-provider/data-sources/dynamic_windows_desktop.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/dynamic_windows_desktop.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_dynamic_wi
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_dynamic_windows_desktop` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/github_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/github_connector.mdx
new file mode 100644
index 0000000000000..a2945e46eff00
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/github_connector.mdx
@@ -0,0 +1,88 @@
+---
+title: Reference for the teleport_github_connector Terraform data-source
+sidebar_label: github_connector
+description: This page describes the supported values of the teleport_github_connector data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_github_connector` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an Github connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Required:
+
+- `client_id` (String) ClientID is the Github OAuth app client ID.
+- `client_secret` (String, Sensitive) ClientSecret is the Github OAuth app client secret.
+
+Optional:
+
+- `api_endpoint_url` (String) APIEndpointURL is the URL of the API endpoint of the Github instance this connector is for.
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `display` (String) Display is the connector display name.
+- `endpoint_url` (String) EndpointURL is the URL of the GitHub instance this connector is for.
+- `redirect_url` (String) RedirectURL is the authorization callback URL.
+- `teams_to_logins` (Attributes List) TeamsToLogins maps Github team memberships onto allowed logins/roles.  DELETE IN 11.0.0 Deprecated: use GithubTeamsToRoles instead. (see [below for nested schema](#nested-schema-for-specteams_to_logins))
+- `teams_to_roles` (Attributes List) TeamsToRoles maps Github team memberships onto allowed roles. (see [below for nested schema](#nested-schema-for-specteams_to_roles))
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.teams_to_logins`
+
+Optional:
+
+- `kubernetes_groups` (List of String) KubeGroups is a list of allowed kubernetes groups for this org/team.
+- `kubernetes_users` (List of String) KubeUsers is a list of allowed kubernetes users to impersonate for this org/team.
+- `logins` (List of String) Logins is a list of allowed logins for this org/team.
+- `organization` (String) Organization is a Github organization a user belongs to.
+- `team` (String) Team is a team within the organization a user belongs to.
+
+
+### Nested Schema for `spec.teams_to_roles`
+
+Optional:
+
+- `organization` (String) Organization is a Github organization a user belongs to.
+- `roles` (List of String) Roles is a list of allowed logins for this org/team.
+- `team` (String) Team is a team within the organization a user belongs to.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/health_check_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/health_check_config.mdx
new file mode 100644
index 0000000000000..cf8d072c5d178
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/health_check_config.mdx
@@ -0,0 +1,80 @@
+---
+title: Reference for the teleport_health_check_config Terraform data-source
+sidebar_label: health_check_config
+description: This page describes the supported values of the teleport_health_check_config data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_health_check_config` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) Metadata is the health check config resource's metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the health check config specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the health check config version.
+
+### Optional
+
+- `sub_kind` (String) SubKind is an optional resource sub kind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `match` (Attributes) Match is used to select resources that these settings apply to. (see [below for nested schema](#nested-schema-for-specmatch))
+
+Optional:
+
+- `healthy_threshold` (Number) HealthyThreshold is the number of consecutive passing health checks after which a target's health status becomes "healthy".
+- `interval` (String) Interval is the time between each health check.
+- `timeout` (String) Timeout is the health check connection establishment timeout. An attempt that times out is a failed attempt.
+- `unhealthy_threshold` (Number) UnhealthyThreshold is the number of consecutive failing health checks after which a target's health status becomes "unhealthy".
+
+### Nested Schema for `spec.match`
+
+Optional:
+
+- `db_labels` (Attributes List) DBLabels matches database labels. An empty value is ignored. The match result is logically ANDed with DBLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchdb_labels))
+- `db_labels_expression` (String) DBLabelsExpression is a label predicate expression to match databases. An empty value is ignored. The match result is logically ANDed with DBLabels, if both are non-empty.
+- `disabled` (Boolean) Disabled disables matches for all labels and expressions.
+- `kubernetes_labels` (Attributes List) KubernetesLabels matches Kubernetes labels. An empty value is ignored. The match result is logically ANDed with KubernetesLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchkubernetes_labels))
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a label predicate expression to match Kubernetes. An empty value is ignored. The match result is logically ANDed with KubernetesLabels, if both are non-empty.
+
+### Nested Schema for `spec.match.db_labels`
+
+Optional:
+
+- `name` (String) The name of the label.
+- `values` (List of String) The values associated with the label.
+
+
+### Nested Schema for `spec.match.kubernetes_labels`
+
+Optional:
+
+- `name` (String) The name of the label.
+- `values` (List of String) The values associated with the label.
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/installer.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/installer.mdx
similarity index 91%
rename from docs/pages/reference/terraform-provider/data-sources/installer.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/installer.mdx
index 6ced168143064..dd84fb3d4ff05 100644
--- a/docs/pages/reference/terraform-provider/data-sources/installer.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/installer.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_installer
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_installer` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/integration.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/integration.mdx
new file mode 100644
index 0000000000000..55ea761d2e841
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/integration.mdx
@@ -0,0 +1,82 @@
+---
+title: Reference for the teleport_integration Terraform data-source
+sidebar_label: integration
+description: This page describes the supported values of the teleport_integration data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_integration` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is an Integration specification. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `aws_oidc` (Attributes) AWSOIDC contains the specific fields to handle the AWS OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specaws_oidc))
+- `aws_ra` (Attributes) AWSRA contains the specific fields to handle the AWS Roles Anywhere Integration subkind. (see [below for nested schema](#nested-schema-for-specaws_ra))
+- `azure_oidc` (Attributes) AzureOIDC contains the specific fields to handle the Azure OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specazure_oidc))
+
+### Nested Schema for `spec.aws_oidc`
+
+Optional:
+
+- `audience` (String) Audience is used to record a name of a plugin or a discover service in Teleport that depends on this integration. Audience value can either be empty or "aws-identity-center". Preset audience may impose specific behavior on the integration CRUD API, such as preventing integration from update or deletion. Empty audience value should be treated as a default and backward-compatible behavior of the integration.
+- `issuer_s3_uri` (String) IssuerS3URI is the Identity Provider that was configured in AWS. This bucket/prefix/* files must be publicly accessible and contain the following: > .well-known/openid-configuration > .well-known/jwks Format: `s3://<bucket>/<prefix>` Optional. The proxy's endpoint is used if it is not specified.  DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate. Amazon had some whitelisted providers where the thumbprint was ignored. S3 hosted providers was in that list. Amazon is now trusting all the root certificate authorities, and this workaround is no longer needed. DELETE IN 18.0.
+- `role_arn` (String) RoleARN contains the Role ARN used to set up the Integration. This is the AWS Role that Teleport will use to issue tokens for API Calls.
+
+
+### Nested Schema for `spec.aws_ra`
+
+Optional:
+
+- `profile_sync_config` (Attributes) ProfileSyncConfig contains the configuration for the AWS Roles Anywhere Profile sync. This is used to create AWS Roles Anywhere profiles as application servers. (see [below for nested schema](#nested-schema-for-specaws_raprofile_sync_config))
+- `trust_anchor_arn` (String) TrustAnchorARN contains the AWS IAM Roles Anywhere Trust Anchor ARN used to set up the Integration.
+
+### Nested Schema for `spec.aws_ra.profile_sync_config`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this integration should sync profiles as application servers.
+- `profile_accepts_role_session_name` (Boolean) ProfileAcceptsRoleSessionName indicates whether the profile accepts a custom Role Session name.
+- `profile_arn` (String) ProfileARN is the ARN of the Roles Anywhere Profile used to generate credentials to access the AWS APIs.
+- `profile_name_filters` (List of String) ProfileNameFilters is a list of filters applied to the profile name. Only matching profiles will be synchronized as application servers. If empty, no filtering is applied.  Filters can be globs, for example:  profile* *name*  Or regexes if they're prefixed and suffixed with ^ and $, for example:  ^profile.*$ ^.*name.*$
+- `role_arn` (String) RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.
+
+
+
+### Nested Schema for `spec.azure_oidc`
+
+Optional:
+
+- `client_id` (String) ClientID specifies the ID of Azure enterprise application (client) that corresponds to this plugin.
+- `tenant_id` (String) TenantID specifies the ID of Entra Tenant (Directory) that this plugin integrates with.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/login_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/login_rule.mdx
new file mode 100644
index 0000000000000..cf60bfd1c6f11
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/login_rule.mdx
@@ -0,0 +1,49 @@
+---
+title: Reference for the teleport_login_rule Terraform data-source
+sidebar_label: login_rule
+description: This page describes the supported values of the teleport_login_rule data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_login_rule` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `priority` (Number) Priority is the priority of the login rule relative to other login rules in the same cluster. Login rules with a lower numbered priority will be evaluated first.
+- `version` (String) Version is the resource version.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `traits_expression` (String) TraitsExpression is a predicate expression which should return the desired traits for the user upon login.
+- `traits_map` (Attributes Map) TraitsMap is a map of trait keys to lists of predicate expressions which should evaluate to the desired values for that trait. (see [below for nested schema](#nested-schema-for-traits_map))
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `traits_map`
+
+Optional:
+
+- `values` (List of String)
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/oidc_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/oidc_connector.mdx
new file mode 100644
index 0000000000000..d3964c8844c3b
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/oidc_connector.mdx
@@ -0,0 +1,108 @@
+---
+title: Reference for the teleport_oidc_connector Terraform data-source
+sidebar_label: oidc_connector
+description: This page describes the supported values of the teleport_oidc_connector data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_oidc_connector` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an OIDC connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `acr_values` (String) ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.
+- `allow_unverified_email` (Boolean) AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a dynamic mapping from claims to roles. (see [below for nested schema](#nested-schema-for-specclaims_to_roles))
+- `client_id` (String) ClientID is the id of the authentication client (Teleport Auth Service).
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `client_secret` (String, Sensitive) ClientSecret is used to authenticate the client.
+- `display` (String) Display is the friendly name for this provider.
+- `entra_id_groups_provider` (Attributes) EntraIDGroupsProvider configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for the "groups" claim when the user's group membership exceeds 200 max item limit. (see [below for nested schema](#nested-schema-for-specentra_id_groups_provider))
+- `google_admin_email` (String) GoogleAdminEmail is the email of a google admin to impersonate.
+- `google_service_account` (String, Sensitive) GoogleServiceAccount is a string containing google service account credentials.
+- `google_service_account_uri` (String) GoogleServiceAccountURI is a path to a google service account uri.
+- `issuer_url` (String) IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
+- `max_age` (String)
+- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
+- `pkce_mode` (String) PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
+- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
+- `provider` (String) Provider is the external identity provider.
+- `redirect_url` (List of String) RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.
+- `request_object_mode` (String) RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters.
+- `scope` (List of String) Scope specifies additional scopes set by provider.
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+- `username_claim` (String) UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.
+
+### Nested Schema for `spec.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.entra_id_groups_provider`
+
+Optional:
+
+- `disabled` (Boolean) Disabled specifies that the groups provider should be disabled even when Entra ID responds with a groups claim source. User may choose to disable it if they are using integrations such as SCIM or similar groups importer as connector based role mapping may be not needed in such a scenario.
+- `graph_endpoint` (String) GraphEndpoint is a Microsoft Graph API endpoint. The groups claim source endpoint provided by Entra ID points to the now-retired Azure AD Graph endpoint ("https://graph.windows.net"). To convert it to the newer Microsoft Graph API endpoint, Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com"). Update GraphEndpoint to point to a different Microsoft Graph national cloud deployment endpoint.
+- `group_type` (String) GroupType is a user group type filter. Defaults to "security-groups". Value can be "security-groups", "directory-roles", "all-groups".
+
+
+### Nested Schema for `spec.mfa`
+
+Optional:
+
+- `acr_values` (String) AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.
+- `client_id` (String) ClientID is the OIDC OAuth app client ID.
+- `client_secret` (String) ClientSecret is the OIDC OAuth app client secret.
+- `enabled` (Boolean) Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.
+- `max_age` (String) MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.
+- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
+- `request_object_mode` (String) RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for the MFA client.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/okta_import_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/okta_import_rule.mdx
similarity index 95%
rename from docs/pages/reference/terraform-provider/data-sources/okta_import_rule.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/okta_import_rule.mdx
index 6816340d9c9f9..1e2d4a45dd79e 100644
--- a/docs/pages/reference/terraform-provider/data-sources/okta_import_rule.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/okta_import_rule.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_okta_impor
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_okta_import_rule` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/provision_token.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/provision_token.mdx
new file mode 100644
index 0000000000000..8430e0631c5bb
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/provision_token.mdx
@@ -0,0 +1,397 @@
+---
+title: Reference for the teleport_provision_token Terraform data-source
+sidebar_label: provision_token
+description: This page describes the supported values of the teleport_provision_token data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_provision_token` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is a provisioning token V2 spec (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `status` (Attributes) Status is extended status information, depending on token type. It is not user writable. (see [below for nested schema](#nested-schema-for-status))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Required:
+
+- `roles` (List of String) Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specallow))
+- `aws_iid_ttl` (String) AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.
+- `azure` (Attributes) Azure allows the configuration of options specific to the "azure" join method. (see [below for nested schema](#nested-schema-for-specazure))
+- `azure_devops` (Attributes) AzureDevops allows the configuration of options specific to the "azure_devops" join method. (see [below for nested schema](#nested-schema-for-specazure_devops))
+- `bitbucket` (Attributes) Bitbucket allows the configuration of options specific to the "bitbucket" join method. (see [below for nested schema](#nested-schema-for-specbitbucket))
+- `bot_name` (String) BotName is the name of the bot this token grants access to, if any
+- `bound_keypair` (Attributes) BoundKeypair allows the configuration of options specific to the "bound_keypair" join method. (see [below for nested schema](#nested-schema-for-specbound_keypair))
+- `circleci` (Attributes) CircleCI allows the configuration of options specific to the "circleci" join method. (see [below for nested schema](#nested-schema-for-speccircleci))
+- `env0` (Attributes) Env0 allows the configuration of options specific to the "env0" join method. (see [below for nested schema](#nested-schema-for-specenv0))
+- `gcp` (Attributes) GCP allows the configuration of options specific to the "gcp" join method. (see [below for nested schema](#nested-schema-for-specgcp))
+- `github` (Attributes) GitHub allows the configuration of options specific to the "github" join method. (see [below for nested schema](#nested-schema-for-specgithub))
+- `gitlab` (Attributes) GitLab allows the configuration of options specific to the "gitlab" join method. (see [below for nested schema](#nested-schema-for-specgitlab))
+- `join_method` (String) JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm
+- `kubernetes` (Attributes) Kubernetes allows the configuration of options specific to the "kubernetes" join method. (see [below for nested schema](#nested-schema-for-speckubernetes))
+- `oracle` (Attributes) Oracle allows the configuration of options specific to the "oracle" join method. (see [below for nested schema](#nested-schema-for-specoracle))
+- `spacelift` (Attributes) Spacelift allows the configuration of options specific to the "spacelift" join method. (see [below for nested schema](#nested-schema-for-specspacelift))
+- `suggested_agent_matcher_labels` (Map of List of String) SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to `db_service.resources.labels`. Currently, only node-join scripts create a configuration according to the suggestion.
+- `suggested_labels` (Map of List of String) SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.
+- `terraform_cloud` (Attributes) TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method. (see [below for nested schema](#nested-schema-for-specterraform_cloud))
+- `tpm` (Attributes) TPM allows the configuration of options specific to the "tpm" join method. (see [below for nested schema](#nested-schema-for-spectpm))
+
+### Nested Schema for `spec.allow`
+
+Optional:
+
+- `aws_account` (String) AWSAccount is the AWS account ID.
+- `aws_arn` (String) AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".
+- `aws_regions` (List of String) AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.
+- `aws_role` (String) AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specazureallow))
+
+### Nested Schema for `spec.azure.allow`
+
+Optional:
+
+- `resource_groups` (List of String) ResourceGroups is a list of Azure resource groups the node is allowed to join from.
+- `subscription` (String) Subscription is the Azure subscription.
+
+
+
+### Nested Schema for `spec.azure_devops`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified. (see [below for nested schema](#nested-schema-for-specazure_devopsallow))
+- `organization_id` (String) OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.
+
+### Nested Schema for `spec.azure_devops.allow`
+
+Optional:
+
+- `definition_id` (String) The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.
+- `pipeline_name` (String) The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.
+- `project_id` (String) The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.
+- `project_name` (String) The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.
+- `repository_ref` (String) The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.
+- `repository_uri` (String) The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.
+- `repository_version` (String) The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.
+- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.
+
+
+
+### Nested Schema for `spec.bitbucket`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specbitbucketallow))
+- `audience` (String) Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
+- `identity_provider_url` (String) IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
+
+### Nested Schema for `spec.bitbucket.allow`
+
+Optional:
+
+- `branch_name` (String) BranchName is the name of the branch on which this pipeline executed.
+- `deployment_environment_uuid` (String) DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.
+- `repository_uuid` (String) RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
+- `workspace_uuid` (String) WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
+
+
+
+### Nested Schema for `spec.bound_keypair`
+
+Optional:
+
+- `onboarding` (Attributes) Onboarding contains parameters related to initial onboarding and keypair registration. (see [below for nested schema](#nested-schema-for-specbound_keypaironboarding))
+- `recovery` (Attributes) Recovery contains parameters related to recovery after identity expiration. (see [below for nested schema](#nested-schema-for-specbound_keypairrecovery))
+- `rotate_after` (String) RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.
+
+### Nested Schema for `spec.bound_keypair.onboarding`
+
+Optional:
+
+- `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.
+- `must_register_before` (String) MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.
+- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.
+
+
+### Nested Schema for `spec.bound_keypair.recovery`
+
+Optional:
+
+- `limit` (Number) Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.
+- `mode` (String) Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.
+
+
+
+### Nested Schema for `spec.circleci`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speccircleciallow))
+- `organization_id` (String)
+
+### Nested Schema for `spec.circleci.allow`
+
+Optional:
+
+- `context_id` (String)
+- `project_id` (String)
+
+
+
+### Nested Schema for `spec.env0`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specenv0allow))
+
+### Nested Schema for `spec.env0.allow`
+
+Optional:
+
+- `deployer_email` (String) DeployerEmail is the email of the person that triggered the deployment, corresponding to `deployerEmail` in an Env0 OIDC token.
+- `deployment_type` (String) DeploymentType is the env0 deployment type, such as "deploy", "destroy", etc. Corresponds to `deploymentType` in an Env0 OIDC token.
+- `env0_tag` (String) Env0Tag is a custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.
+- `environment_id` (String) EnvironmentID is the unique identifier of the Env0 environment, corresponding to `environmentId` in an Env0 OIDC token.
+- `environment_name` (String) EnvironmentName is the name of the Env0 environment, corresponding to `environmentName` in an Env0 OIDC token.
+- `organization_id` (String) OrganizationID is the unique organization identifier, corresponding to `organizationId` in an Env0 OIDC token.
+- `project_id` (String) ProjectID is a unique project identifier, corresponding to `projectId` in an Env0 OIDC token.
+- `project_name` (String) ProjectName is the name of the project under which the job was run corresponding to `projectName` in an Env0 OIDC token.
+- `template_id` (String) TemplateID is the unique identifier of the Env0 template, corresponding to `templateId` in an Env0 OIDC token.
+- `template_name` (String) TemplateName is the name of the Env0 template, corresponding to `templateName` in an Env0 OIDC token.
+- `workspace_name` (String) WorkspaceName is the name of the Env0 workspace, corresponding to `workspaceName` in an Env0 OIDC token.
+
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgcpallow))
+
+### Nested Schema for `spec.gcp.allow`
+
+Optional:
+
+- `locations` (List of String) Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").
+- `project_ids` (List of String) ProjectIDs is a list of project IDs (e.g. `<example-id-123456>`).
+- `service_accounts` (List of String) ServiceAccounts is a list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).
+
+
+
+### Nested Schema for `spec.github`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgithuballow))
+- `enterprise_server_host` (String) EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host.  This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.
+- `enterprise_slug` (String) EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE.  This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified.  See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.
+- `static_jwks` (String) StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.
+
+### Nested Schema for `spec.github.allow`
+
+Optional:
+
+- `actor` (String) The personal account that initiated the workflow run.
+- `environment` (String) The name of the environment used by the job.
+- `ref` (String) The git ref that triggered the workflow run.
+- `ref_type` (String) The type of ref, for example: "branch".
+- `repository` (String) The repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport`
+- `repository_owner` (String) The name of the organization in which the repository is stored.
+- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run.
+- `workflow` (String) The name of the workflow.
+
+
+
+### Nested Schema for `spec.gitlab`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgitlaballow))
+- `domain` (String) Domain is the domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.
+- `static_jwks` (String) StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.
+
+### Nested Schema for `spec.gitlab.allow`
+
+Optional:
+
+- `ci_config_ref_uri` (String) CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
+- `ci_config_sha` (String) CIConfigSHA is the git commit SHA for the ci_config_ref_uri.
+- `deployment_tier` (String) DeploymentTier is the deployment tier of the environment the job specifies
+- `environment` (String) Environment limits access by the environment the job deploys to (if one is associated)
+- `environment_protected` (Boolean) EnvironmentProtected is true if the Git ref is protected, false otherwise.
+- `namespace_path` (String) NamespacePath is used to limit access to jobs in a group or user's projects. Example: `mygroup`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `pipeline_source` (String) PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`
+- `project_path` (String) ProjectPath is used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `project_visibility` (String) ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.
+- `ref` (String) Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type.  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `ref_protected` (Boolean) RefProtected is true if the Git ref is protected, false otherwise.
+- `ref_type` (String) RefType allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`
+- `sub` (String) Sub roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `user_email` (String) UserEmail is the email of the user executing the job
+- `user_id` (String) UserID is the ID of the user executing the job
+- `user_login` (String) UserLogin is the username of the user executing the job
+
+
+
+### Nested Schema for `spec.kubernetes`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speckubernetesallow))
+- `oidc` (Attributes) OIDCConfig configures the `oidc` type. (see [below for nested schema](#nested-schema-for-speckubernetesoidc))
+- `static_jwks` (Attributes) StaticJWKS is the configuration specific to the `static_jwks` type. (see [below for nested schema](#nested-schema-for-speckubernetesstatic_jwks))
+- `type` (String) Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults to `in_cluster`.
+
+### Nested Schema for `spec.kubernetes.allow`
+
+Optional:
+
+- `service_account` (String) ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".
+
+
+### Nested Schema for `spec.kubernetes.oidc`
+
+Optional:
+
+- `insecure_allow_http_issuer` (Boolean) InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.
+- `issuer` (String) Issuer is the URI of the OIDC issuer. It must have an accessible and OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should be a valid URL and must exactly match the `issuer` field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...
+
+
+### Nested Schema for `spec.kubernetes.static_jwks`
+
+Optional:
+
+- `jwks` (String) JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.
+
+
+
+### Nested Schema for `spec.oracle`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specoracleallow))
+
+### Nested Schema for `spec.oracle.allow`
+
+Optional:
+
+- `instances` (List of String) Instances is a list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.
+- `parent_compartments` (List of String) ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.
+- `regions` (List of String) Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.
+- `tenancy` (String) Tenancy is the OCID of the instance's tenancy. Required.
+
+
+
+### Nested Schema for `spec.spacelift`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specspaceliftallow))
+- `enable_glob_matching` (Boolean) EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.
+- `hostname` (String) Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`
+
+### Nested Schema for `spec.spacelift.allow`
+
+Optional:
+
+- `caller_id` (String) CallerID is the ID of the caller, ie. the stack or module that generated the run.  This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `caller_type` (String) CallerType is the type of the caller, ie. the entity that owns the run - either `stack` or `module`.
+- `scope` (String) Scope is the scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
+- `space_id` (String) SpaceID is the ID of the space in which the run that owns the token was executed.  This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+
+
+
+### Nested Schema for `spec.terraform_cloud`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specterraform_cloudallow))
+- `audience` (String) Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the variable is set to match the cluster name, it does not need to be set here.
+- `hostname` (String) Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be `app.terraform.io`. Otherwise, it must both match the `iss` (issuer) field included in JWTs, and provide standard JWKS endpoints.
+
+### Nested Schema for `spec.terraform_cloud.allow`
+
+Optional:
+
+- `organization_id` (String) OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.
+- `organization_name` (String) OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.
+- `project_id` (String) ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.
+- `project_name` (String) ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.
+- `run_phase` (String) RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
+- `workspace_id` (String) WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
+- `workspace_name` (String) WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
+
+
+
+### Nested Schema for `spec.tpm`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining. (see [below for nested schema](#nested-schema-for-spectpmallow))
+- `ekcert_allowed_cas` (List of String) EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.
+
+### Nested Schema for `spec.tpm.allow`
+
+Optional:
+
+- `description` (String) Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"
+- `ek_certificate_serial` (String) EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4
+- `ek_public_hash` (String) EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6
+
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+- `name` (String, Sensitive) Name is an object name
+
+
+### Nested Schema for `status`
+
+Optional:
+
+- `bound_keypair` (Attributes) BoundKeypair contains status information related to bound_keypair type tokens. (see [below for nested schema](#nested-schema-for-statusbound_keypair))
+
+### Nested Schema for `status.bound_keypair`
+
+Optional:
+
+- `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any.
+- `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format.
+- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated.
+- `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join.
+- `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`.
+- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/role.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/role.mdx
new file mode 100644
index 0000000000000..0a5836deb9311
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/role.mdx
@@ -0,0 +1,557 @@
+---
+title: Reference for the teleport_role Terraform data-source
+sidebar_label: role
+description: This page describes the supported values of the teleport_role data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_role` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a role specification (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `allow` (Attributes) Allow is the set of conditions evaluated to grant access. (see [below for nested schema](#nested-schema-for-specallow))
+- `deny` (Attributes) Deny is the set of conditions evaluated to deny access. Deny takes priority over allow. (see [below for nested schema](#nested-schema-for-specdeny))
+- `options` (Attributes) Options is for OpenSSH options like agent forwarding. (see [below for nested schema](#nested-schema-for-specoptions))
+
+### Nested Schema for `spec.allow`
+
+Optional:
+
+- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specallowaccount_assignments))
+- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
+- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
+- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
+- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
+- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
+- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
+- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
+- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
+- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
+- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specallowdb_permissions))
+- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
+- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
+- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
+- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
+- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
+- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
+- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specallowgithub_permissions))
+- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
+- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
+- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
+- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
+- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specallowimpersonate))
+- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specallowjoin_sessions))
+- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
+- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
+- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specallowkubernetes_resources))
+- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
+- `logins` (List of String) Logins is a list of *nix system logins.
+- `mcp` (Attributes) MCPPermissions defines MCP servers related permissions. (see [below for nested schema](#nested-schema-for-specallowmcp))
+- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
+- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
+- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specallowrequest))
+- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specallowrequire_session_join))
+- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specallowreview_requests))
+- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specallowrules))
+- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specallowspiffe))
+- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
+- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
+- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
+- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
+- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
+
+### Nested Schema for `spec.allow.account_assignments`
+
+Optional:
+
+- `account` (String)
+- `permission_set` (String)
+
+
+### Nested Schema for `spec.allow.db_permissions`
+
+Optional:
+
+- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
+- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
+
+
+### Nested Schema for `spec.allow.github_permissions`
+
+Optional:
+
+- `orgs` (List of String)
+
+
+### Nested Schema for `spec.allow.impersonate`
+
+Optional:
+
+- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
+- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.allow.join_sessions`
+
+Optional:
+
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
+- `name` (String) Name is the name of the policy.
+- `roles` (List of String) Roles is a list of roles that you can join the session of.
+
+
+### Nested Schema for `spec.allow.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
+- `kind` (String) Kind specifies the Kubernetes Resource type.
+- `name` (String) Name is the resource name. It supports wildcards.
+- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
+- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
+
+
+### Nested Schema for `spec.allow.mcp`
+
+Optional:
+
+- `tools` (List of String) Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.
+
+
+### Nested Schema for `spec.allow.request`
+
+Optional:
+
+- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowrequestclaims_to_roles))
+- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specallowrequestkubernetes_resources))
+- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
+- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specallowrequestreason))
+- `roles` (List of String) Roles is the name of roles which will match the request rule.
+- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
+- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
+- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specallowrequestthresholds))
+
+### Nested Schema for `spec.allow.request.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.allow.request.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
+- `kind` (String) kind specifies the Kubernetes Resource type.
+
+
+### Nested Schema for `spec.allow.request.reason`
+
+Optional:
+
+- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
+- `prompt` (String) Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.
+
+
+### Nested Schema for `spec.allow.request.thresholds`
+
+Optional:
+
+- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
+- `deny` (Number) Deny is the number of denials needed for state-transition.
+- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
+- `name` (String) Name is the optional human-readable name of the threshold.
+
+
+
+### Nested Schema for `spec.allow.require_session_join`
+
+Optional:
+
+- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
+- `filter` (String) Filter is a predicate that determines what users count towards this policy.
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
+- `name` (String) Name is the name of the policy.
+- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
+
+
+### Nested Schema for `spec.allow.review_requests`
+
+Optional:
+
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowreview_requestsclaims_to_roles))
+- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
+- `roles` (List of String) Roles is the name of roles which may be reviewed.
+- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
+
+### Nested Schema for `spec.allow.review_requests.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+
+### Nested Schema for `spec.allow.rules`
+
+Optional:
+
+- `actions` (List of String) Actions specifies optional actions taken when this rule matches
+- `resources` (List of String) Resources is a list of resources
+- `verbs` (List of String) Verbs is a list of verbs
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.allow.spiffe`
+
+Optional:
+
+- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
+- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
+- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
+
+
+
+### Nested Schema for `spec.deny`
+
+Optional:
+
+- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specdenyaccount_assignments))
+- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
+- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
+- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
+- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
+- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
+- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
+- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
+- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
+- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
+- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specdenydb_permissions))
+- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
+- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
+- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
+- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
+- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
+- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
+- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specdenygithub_permissions))
+- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
+- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
+- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
+- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
+- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specdenyimpersonate))
+- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specdenyjoin_sessions))
+- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
+- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
+- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specdenykubernetes_resources))
+- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
+- `logins` (List of String) Logins is a list of *nix system logins.
+- `mcp` (Attributes) MCPPermissions defines MCP servers related permissions. (see [below for nested schema](#nested-schema-for-specdenymcp))
+- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
+- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
+- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specdenyrequest))
+- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specdenyrequire_session_join))
+- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specdenyreview_requests))
+- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specdenyrules))
+- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specdenyspiffe))
+- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
+- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
+- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
+- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
+- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
+
+### Nested Schema for `spec.deny.account_assignments`
+
+Optional:
+
+- `account` (String)
+- `permission_set` (String)
+
+
+### Nested Schema for `spec.deny.db_permissions`
+
+Optional:
+
+- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
+- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
+
+
+### Nested Schema for `spec.deny.github_permissions`
+
+Optional:
+
+- `orgs` (List of String)
+
+
+### Nested Schema for `spec.deny.impersonate`
+
+Optional:
+
+- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
+- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.deny.join_sessions`
+
+Optional:
+
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
+- `name` (String) Name is the name of the policy.
+- `roles` (List of String) Roles is a list of roles that you can join the session of.
+
+
+### Nested Schema for `spec.deny.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
+- `kind` (String) Kind specifies the Kubernetes Resource type.
+- `name` (String) Name is the resource name. It supports wildcards.
+- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
+- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
+
+
+### Nested Schema for `spec.deny.mcp`
+
+Optional:
+
+- `tools` (List of String) Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.
+
+
+### Nested Schema for `spec.deny.request`
+
+Optional:
+
+- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyrequestclaims_to_roles))
+- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specdenyrequestkubernetes_resources))
+- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
+- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specdenyrequestreason))
+- `roles` (List of String) Roles is the name of roles which will match the request rule.
+- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
+- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
+- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specdenyrequestthresholds))
+
+### Nested Schema for `spec.deny.request.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.deny.request.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
+- `kind` (String) kind specifies the Kubernetes Resource type.
+
+
+### Nested Schema for `spec.deny.request.reason`
+
+Optional:
+
+- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
+- `prompt` (String) Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.
+
+
+### Nested Schema for `spec.deny.request.thresholds`
+
+Optional:
+
+- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
+- `deny` (Number) Deny is the number of denials needed for state-transition.
+- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
+- `name` (String) Name is the optional human-readable name of the threshold.
+
+
+
+### Nested Schema for `spec.deny.require_session_join`
+
+Optional:
+
+- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
+- `filter` (String) Filter is a predicate that determines what users count towards this policy.
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
+- `name` (String) Name is the name of the policy.
+- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
+
+
+### Nested Schema for `spec.deny.review_requests`
+
+Optional:
+
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyreview_requestsclaims_to_roles))
+- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
+- `roles` (List of String) Roles is the name of roles which may be reviewed.
+- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
+
+### Nested Schema for `spec.deny.review_requests.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+
+### Nested Schema for `spec.deny.rules`
+
+Optional:
+
+- `actions` (List of String) Actions specifies optional actions taken when this rule matches
+- `resources` (List of String) Resources is a list of resources
+- `verbs` (List of String) Verbs is a list of verbs
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.deny.spiffe`
+
+Optional:
+
+- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
+- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
+- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
+
+
+
+### Nested Schema for `spec.options`
+
+Optional:
+
+- `cert_extensions` (Attributes List) CertExtensions specifies the key/values (see [below for nested schema](#nested-schema-for-specoptionscert_extensions))
+- `cert_format` (String) CertificateFormat defines the format of the user certificate to allow compatibility with older versions of OpenSSH.
+- `client_idle_timeout` (String) ClientIdleTimeout sets disconnect clients on idle timeout behavior, if set to 0 means do not disconnect, otherwise is set to the idle duration.
+- `create_db_user` (Boolean) CreateDatabaseUser enabled automatic database user creation.
+- `create_db_user_mode` (Number) CreateDatabaseUserMode allows users to be automatically created on a database when not set to off. 0 is "unspecified", 1 is "off", 2 is "keep", 3 is "best_effort_drop".
+- `create_desktop_user` (Boolean) CreateDesktopUser allows users to be automatically created on a Windows desktop
+- `create_host_user` (Boolean) Deprecated: use CreateHostUserMode instead.
+- `create_host_user_default_shell` (String) CreateHostUserDefaultShell is used to configure the default shell for newly provisioned host users.
+- `create_host_user_mode` (Number) CreateHostUserMode allows users to be automatically created on a host when not set to off. 0 is "unspecified"; 1 is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; 4 is "insecure-drop".
+- `desktop_clipboard` (Boolean) DesktopClipboard indicates whether clipboard sharing is allowed between the user's workstation and the remote desktop. It defaults to true unless explicitly set to false.
+- `desktop_directory_sharing` (Boolean) DesktopDirectorySharing indicates whether directory sharing is allowed between the user's workstation and the remote desktop. It defaults to false unless explicitly set to true.
+- `device_trust_mode` (String) DeviceTrustMode is the device authorization mode used for the resources associated with the role. See DeviceTrust.Mode.
+- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert sets disconnect clients on expired certificates.
+- `enhanced_recording` (List of String) BPF defines what events to record for the BPF-based session recorder.
+- `forward_agent` (Boolean) ForwardAgent is SSH agent forwarding.
+- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specoptionsidp))
+- `lock` (String) Lock specifies the locking mode (strict|best_effort) to be applied with the role.
+- `max_connections` (Number) MaxConnections defines the maximum number of concurrent connections a user may hold.
+- `max_kubernetes_connections` (Number) MaxKubernetesConnections defines the maximum number of concurrent Kubernetes sessions a user may hold.
+- `max_session_ttl` (String) MaxSessionTTL defines how long a SSH session can last for.
+- `max_sessions` (Number) MaxSessions defines the maximum number of concurrent sessions per connection.
+- `mfa_verification_interval` (String) MFAVerificationInterval optionally defines the maximum duration that can elapse between successive MFA verifications. This variable is used to ensure that users are periodically prompted to verify their identity, enhancing security by preventing prolonged sessions without re-authentication when using tsh proxy * derivatives. It's only effective if the session requires MFA. If not set, defaults to `max_session_ttl`.
+- `permit_x11_forwarding` (Boolean) PermitX11Forwarding authorizes use of X11 forwarding.
+- `pin_source_ip` (Boolean) PinSourceIP forces the same client IP for certificate generation and usage
+- `port_forwarding` (Boolean) Deprecated: Use SSHPortForwarding instead
+- `record_session` (Attributes) RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false. (see [below for nested schema](#nested-schema-for-specoptionsrecord_session))
+- `request_access` (String) RequestAccess defines the request strategy (optional|reason|always) where optional is the default.
+- `request_prompt` (String) RequestPrompt is an optional message which tells users what they aught to request.
+- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
+- `ssh_file_copy` (Boolean) SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to true unless explicitly set to false.
+- `ssh_port_forwarding` (Attributes) SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwarding))
+
+### Nested Schema for `spec.options.cert_extensions`
+
+Optional:
+
+- `mode` (Number) Mode is the type of extension to be used -- currently critical-option is not supported. 0 is "extension".
+- `name` (String) Name specifies the key to be used in the cert extension.
+- `type` (Number) Type represents the certificate type being extended, only ssh is supported at this time. 0 is "ssh".
+- `value` (String) Value specifies the value to be used in the cert extension.
+
+
+### Nested Schema for `spec.options.idp`
+
+Optional:
+
+- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specoptionsidpsaml))
+
+### Nested Schema for `spec.options.idp.saml`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
+
+
+
+### Nested Schema for `spec.options.record_session`
+
+Optional:
+
+- `default` (String) Default indicates the default value for the services.
+- `desktop` (Boolean) Desktop indicates whether desktop sessions should be recorded. It defaults to true unless explicitly set to false.
+- `ssh` (String) SSH indicates the session mode used on SSH sessions.
+
+
+### Nested Schema for `spec.options.ssh_port_forwarding`
+
+Optional:
+
+- `local` (Attributes) Allow local port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardinglocal))
+- `remote` (Attributes) Allow remote port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardingremote))
+
+### Nested Schema for `spec.options.ssh_port_forwarding.local`
+
+Optional:
+
+- `enabled` (Boolean)
+
+
+### Nested Schema for `spec.options.ssh_port_forwarding.remote`
+
+Optional:
+
+- `enabled` (Boolean)
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/saml_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/saml_connector.mdx
new file mode 100644
index 0000000000000..4d33e3a353e81
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/saml_connector.mdx
@@ -0,0 +1,117 @@
+---
+title: Reference for the teleport_saml_connector Terraform data-source
+sidebar_label: saml_connector
+description: This page describes the supported values of the teleport_saml_connector data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_saml_connector` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an SAML connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Required:
+
+- `acs` (String) AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).
+- `attributes_to_roles` (Attributes List) AttributesToRoles is a list of mappings of attribute statements to roles. (see [below for nested schema](#nested-schema-for-specattributes_to_roles))
+
+Optional:
+
+- `allow_idp_initiated` (Boolean) AllowIDPInitiated is a flag that indicates if the connector can be used for IdP-initiated logins.
+- `assertion_key_pair` (Attributes) EncryptionKeyPair is a key pair used for decrypting SAML assertions. (see [below for nested schema](#nested-schema-for-specassertion_key_pair))
+- `audience` (String) Audience uniquely identifies our service provider.
+- `cert` (String, Sensitive) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `display` (String) Display controls how this connector is displayed.
+- `entity_descriptor` (String, Sensitive) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.
+- `entity_descriptor_url` (String) EntityDescriptorURL is a URL that supplies a configuration XML.
+- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO.
+- `include_subject` (Boolean) IncludeSubject is a flag that indicates whether the Subject element is included in the SAML authentication request. Defaults to false. Note: Some IdPs will reject requests that contain a Subject.
+- `issuer` (String) Issuer is the identity provider issuer.
+- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
+- `preferred_request_binding` (String) PreferredRequestBinding is a preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.
+- `provider` (String) Provider is the external identity provider.
+- `service_provider_issuer` (String) ServiceProviderIssuer is the issuer of the service provider (Teleport).
+- `signing_key_pair` (Attributes) SigningKeyPair is an x509 key pair used to sign AuthnRequest. (see [below for nested schema](#nested-schema-for-specsigning_key_pair))
+- `single_logout_url` (String) SingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.
+- `sso` (String) SSO is the URL of the identity provider's SSO service.
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+
+### Nested Schema for `spec.attributes_to_roles`
+
+Optional:
+
+- `name` (String) Name is an attribute statement name.
+- `roles` (List of String) Roles is a list of static teleport roles to map to.
+- `value` (String) Value is an attribute statement value to match.
+
+
+### Nested Schema for `spec.assertion_key_pair`
+
+Optional:
+
+- `cert` (String) Cert is a PEM-encoded x509 certificate.
+- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
+
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.mfa`
+
+Optional:
+
+- `cert` (String) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
+- `enabled` (Boolean) Enabled specified whether this SAML connector supports MFA checks. Defaults to false.
+- `entity_descriptor` (String) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements. Usually set from EntityDescriptorUrl.
+- `entity_descriptor_url` (String) EntityDescriptorUrl is a URL that supplies a configuration XML.
+- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced for MFA checks. UNSPECIFIED is treated as YES to always re-authentication for MFA checks. This should only be set to NO if the IdP is setup to perform MFA checks on top of active user sessions.
+- `issuer` (String) Issuer is the identity provider issuer. Usually set from EntityDescriptor.
+- `sso` (String) SSO is the URL of the identity provider's SSO service. Usually set from EntityDescriptor.
+
+
+### Nested Schema for `spec.signing_key_pair`
+
+Optional:
+
+- `cert` (String) Cert is a PEM-encoded x509 certificate.
+- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/session_recording_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/session_recording_config.mdx
new file mode 100644
index 0000000000000..fcdc3189105e5
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/session_recording_config.mdx
@@ -0,0 +1,93 @@
+---
+title: Reference for the teleport_session_recording_config Terraform data-source
+sidebar_label: session_recording_config
+description: This page describes the supported values of the teleport_session_recording_config data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_session_recording_config` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a SessionRecordingConfig specification (see [below for nested schema](#nested-schema-for-spec))
+- `status` (Attributes) Status is the SessionRecordingConfig status containing active encryption keys (see [below for nested schema](#nested-schema-for-status))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `encryption` (Attributes) Encryption configures if and how session recordings should be encrypted. (see [below for nested schema](#nested-schema-for-specencryption))
+- `mode` (String) Mode controls where (or if) the session is recorded.
+- `proxy_checks_host_keys` (Boolean) ProxyChecksHostKeys is used to control if the proxy will check host keys when in recording mode.
+
+### Nested Schema for `spec.encryption`
+
+Optional:
+
+- `enabled` (Boolean) Enabled controls whether or not session recordings should be encrypted.
+- `manual_key_management` (Attributes) ManualKeyManagement defines whether or not recording encryption keys should be managed externally and how to query those keys. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_management))
+
+### Nested Schema for `spec.encryption.manual_key_management`
+
+Optional:
+
+- `active_keys` (Attributes List) ActiveKeys describe which keys should be queried for active recording encryption and replay. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_managementactive_keys))
+- `enabled` (Boolean) Enabled controls whether or recording encryption keys should be managed externally.
+- `rotated_keys` (Attributes List) RotatedKeys describe which keys should be queried for historical replay. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_managementrotated_keys))
+
+### Nested Schema for `spec.encryption.manual_key_management.active_keys`
+
+Optional:
+
+- `label` (String) Label is a value that can be used with the related keystore in order to find relevant keys.
+- `type` (String) Type represents which keystore should be searched when looking up keys by label.
+
+
+### Nested Schema for `spec.encryption.manual_key_management.rotated_keys`
+
+Optional:
+
+- `label` (String) Label is a value that can be used with the related keystore in order to find relevant keys.
+- `type` (String) Type represents which keystore should be searched when looking up keys by label.
+
+
+
+
+
+### Nested Schema for `status`
+
+Optional:
+
+- `encryption_keys` (Attributes List) EncryptionKeys contain the currently active age encryption keys used for encrypted session recording. (see [below for nested schema](#nested-schema-for-statusencryption_keys))
+
+### Nested Schema for `status.encryption_keys`
+
+Optional:
+
+- `public_key` (String) A PKIX ASN.1 DER encoded public key used for key wrapping during age encryption. Expected to be RSA 4096.
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/static_host_user.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/static_host_user.mdx
similarity index 94%
rename from docs/pages/reference/terraform-provider/data-sources/static_host_user.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/static_host_user.mdx
index d444a8158e33e..9adc1d0c5f7c4 100644
--- a/docs/pages/reference/terraform-provider/data-sources/static_host_user.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/static_host_user.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_static_hos
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_static_host_user` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/terraform-provider/data-sources/trusted_cluster.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_cluster.mdx
similarity index 95%
rename from docs/pages/reference/terraform-provider/data-sources/trusted_cluster.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_cluster.mdx
index 29db4b81913d6..242a7e0f2a2e3 100644
--- a/docs/pages/reference/terraform-provider/data-sources/trusted_cluster.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_cluster.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_trusted_cl
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_trusted_cluster` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_device.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_device.mdx
new file mode 100644
index 0000000000000..534b3af3b9693
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/trusted_device.mdx
@@ -0,0 +1,56 @@
+---
+title: Reference for the teleport_trusted_device Terraform data-source
+sidebar_label: trusted_device
+description: This page describes the supported values of the teleport_trusted_device data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_trusted_device` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Specification of the device. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `labels` (Map of String) Labels is a set of labels
+- `name` (String) Name is an object name
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `asset_tag` (String)
+- `os_type` (String)
+
+Optional:
+
+- `enroll_status` (String)
+- `owner` (String)
+- `source` (Attributes) (see [below for nested schema](#nested-schema-for-specsource))
+
+### Nested Schema for `spec.source`
+
+Optional:
+
+- `name` (String)
+- `origin` (String)
+
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/user.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/user.mdx
new file mode 100644
index 0000000000000..2ecec268c99b9
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/user.mdx
@@ -0,0 +1,92 @@
+---
+title: Reference for the teleport_user Terraform data-source
+sidebar_label: user
+description: This page describes the supported values of the teleport_user data-source of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the `teleport_user` data source of the
+Teleport Terraform provider.
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a user specification (see [below for nested schema](#nested-schema-for-spec))
+- `status` (Attributes) (see [below for nested schema](#nested-schema-for-status))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `github_identities` (Attributes List) GithubIdentities list associated Github OAuth2 identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specgithub_identities))
+- `oidc_identities` (Attributes List) OIDCIdentities lists associated OpenID Connect identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specoidc_identities))
+- `roles` (List of String) Roles is a list of roles assigned to user
+- `saml_identities` (Attributes List) SAMLIdentities lists associated SAML identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specsaml_identities))
+- `traits` (Map of List of String) Traits are key/value pairs received from an identity provider (through OIDC claims or SAML assertions) or from a system administrator for local accounts. Traits are used to populate role variables.
+- `trusted_device_ids` (List of String) TrustedDeviceIDs contains the IDs of trusted devices enrolled by the user.  Note that SSO users are transient and thus may contain an empty TrustedDeviceIDs field, even though the user->device association exists under the Device Trust subsystem. Do not rely on this field to determine device associations or ownership, it exists for legacy/informative purposes only.  Managed by the Device Trust subsystem, avoid manual edits.
+
+### Nested Schema for `spec.github_identities`
+
+Optional:
+
+- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
+- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
+- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
+- `username` (String) Username is username supplied by external identity provider
+
+
+### Nested Schema for `spec.oidc_identities`
+
+Optional:
+
+- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
+- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
+- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
+- `username` (String) Username is username supplied by external identity provider
+
+
+### Nested Schema for `spec.saml_identities`
+
+Optional:
+
+- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
+- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
+- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
+- `username` (String) Username is username supplied by external identity provider
+
+
+
+### Nested Schema for `status`
+
+Optional:
+
+- `mfa_weakest_device` (Number) mfa_weakest_device reflects what the system knows about the user's weakest MFA device. Note that this is a "best effort" property, in that it can be UNSPECIFIED.
+- `password_state` (Number) password_state reflects what the system knows about the user's password. Note that this is a "best effort" property, in that it can be UNSPECIFIED for users who were created before this property was introduced and didn't perform any password-related activity since then. See RFD 0159 for details. Do NOT use this value for authentication purposes!
+
diff --git a/docs/pages/reference/terraform-provider/data-sources/workload_identity.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/workload_identity.mdx
similarity index 98%
rename from docs/pages/reference/terraform-provider/data-sources/workload_identity.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/workload_identity.mdx
index c02037ba98801..22dde51499ff5 100644
--- a/docs/pages/reference/terraform-provider/data-sources/workload_identity.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/workload_identity.mdx
@@ -7,6 +7,9 @@ description: This page describes the supported values of the teleport_workload_i
 {/*Auto-generated file. Do not edit.*/}
 {/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
 
+This page describes the supported values of the `teleport_workload_identity` data source of the
+Teleport Terraform provider.
+
 
 
 
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list.mdx
new file mode 100644
index 0000000000000..4849076c568a2
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list.mdx
@@ -0,0 +1,206 @@
+---
+title: Reference for the teleport_access_list Terraform resource
+sidebar_label: access_list
+description: This page describes the supported values of the teleport_access_list resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_access_list resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_access_list" "crane-operation" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "crane-operation"
+      labels = {
+        example = "yes"
+      }
+    }
+  }
+  spec = {
+    description = "Used to grant access to the crane."
+    owners = [
+      {
+        name        = "gru"
+        description = "The supervillain."
+      }
+    ]
+    membership_requires = {
+      roles = ["minion"]
+    }
+    ownership_requires = {
+      roles = ["supervillain"]
+    }
+    grants = {
+      roles = ["crane-operator"]
+      traits = [{
+        key    = "allowed-machines"
+        values = ["crane", "forklift"]
+      }]
+    }
+    title = "Crane operation"
+    audit = {
+      recurrence = {
+        frequency    = 3  # audit every 3 months
+        day_of_month = 15 # audit happen 15's day of the month. Possible values are 1, 15, and 31.
+      }
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) spec is the specification for the Access List. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `owners` (Attributes List) owners is a list of owners of the Access List. (see [below for nested schema](#nested-schema-for-specowners))
+
+Optional:
+
+- `audit` (Attributes) audit describes the frequency that this Access List must be audited. (see [below for nested schema](#nested-schema-for-specaudit))
+- `description` (String) description is an optional plaintext description of the Access List.
+- `grants` (Attributes) grants describes the access granted by membership to this Access List. (see [below for nested schema](#nested-schema-for-specgrants))
+- `membership_requires` (Attributes) membership_requires describes the requirements for a user to be a member of the Access List. For a membership to an Access List to be effective, the user must meet the requirements of Membership_requires and must be in the members list. (see [below for nested schema](#nested-schema-for-specmembership_requires))
+- `owner_grants` (Attributes) owner_grants describes the access granted by owners to this Access List. (see [below for nested schema](#nested-schema-for-specowner_grants))
+- `ownership_requires` (Attributes) ownership_requires describes the requirements for a user to be an owner of the Access List. For ownership of an Access List to be effective, the user must meet the requirements of ownership_requires and must be in the owners list. (see [below for nested schema](#nested-schema-for-specownership_requires))
+- `title` (String) title is a plaintext short description of the Access List.
+- `type` (String) type can be an empty string which denotes a regular Access List, "scim" which represents an Access List created from SCIM group or "static" for Access Lists managed by IaC tools.
+
+### Nested Schema for `spec.owners`
+
+Optional:
+
+- `description` (String) description is the plaintext description of the owner and why they are an owner.
+- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
+- `name` (String) name is the username of the owner.
+
+
+### Nested Schema for `spec.audit`
+
+Optional:
+
+- `next_audit_date` (String) next_audit_date is when the next audit date should be done by.
+- `notifications` (Attributes) notifications is the configuration for notifying users. (see [below for nested schema](#nested-schema-for-specauditnotifications))
+- `recurrence` (Attributes) recurrence is the recurrence definition (see [below for nested schema](#nested-schema-for-specauditrecurrence))
+
+### Nested Schema for `spec.audit.notifications`
+
+Optional:
+
+- `start` (String) start specifies when to start notifying users that the next audit date is coming up.
+
+
+### Nested Schema for `spec.audit.recurrence`
+
+Optional:
+
+- `day_of_month` (Number) day_of_month is the day of month that reviews will be scheduled on. Supported values are 0, 1, 15, and 31.
+- `frequency` (Number) frequency is the frequency of reviews. This represents the period in months between two reviews. Supported values are 0, 1, 3, 6, and 12.
+
+
+
+### Nested Schema for `spec.grants`
+
+Optional:
+
+- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
+- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specgrantstraits))
+
+### Nested Schema for `spec.grants.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.membership_requires`
+
+Optional:
+
+- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
+- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specmembership_requirestraits))
+
+### Nested Schema for `spec.membership_requires.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.owner_grants`
+
+Optional:
+
+- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
+- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specowner_grantstraits))
+
+### Nested Schema for `spec.owner_grants.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
+
+
+
+### Nested Schema for `spec.ownership_requires`
+
+Optional:
+
+- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
+- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specownership_requirestraits))
+
+### Nested Schema for `spec.ownership_requires.traits`
+
+Optional:
+
+- `key` (String) key is the name of the trait.
+- `values` (List of String) values is the list of trait values.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list_member.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list_member.mdx
new file mode 100644
index 0000000000000..5091a6bdfaf96
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_list_member.mdx
@@ -0,0 +1,141 @@
+---
+title: Reference for the teleport_access_list_member Terraform resource
+sidebar_label: access_list_member
+description: This page describes the supported values of the teleport_access_list_member resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_access_list_member resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_access_list" "characters" {
+  header = {
+    metadata = {
+      name = "crane-operation"
+    }
+  }
+  spec = {
+    type        = "static" # the access list must be of type "static" to manage its members with Terraform
+    title       = "Characters"
+    description = "The list of game characters."
+    owners = [
+      { name = "dungeon_master" },
+    ]
+    grants = {
+      roles = ["dungeon_access"]
+    }
+  }
+}
+
+# User member:
+
+resource "teleport_access_list_member" "fighter" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "fighter" # Teleport user name
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.characters.id
+    membership_kind = 1 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+
+# Nested Access List member:
+
+resource "teleport_access_list" "npcs" {
+  header = {
+    metadata = {
+      name = "npcs"
+    }
+  }
+  spec = {
+    title       = "NPCs"
+    description = "Non-player characters."
+    owners = [
+      { name = "dungeon_master" }
+    ]
+    grants = {
+      roles = ["dungeon_access"]
+    }
+    audit = {
+      recurrence = {
+        frequency    = 3
+        day_of_month = 15
+      }
+    }
+  }
+}
+
+resource "teleport_access_list_member" "npcs" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = teleport_access_list.npcs.id
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.characters.id
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) spec is the specification for the Access List member. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `access_list` (String) associated Access List
+- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
+
+Optional:
+
+- `added_by` (String) added_by is the user that added this user to the Access List.
+- `expires` (String) expires is when the user's membership to the Access List expires.
+- `joined` (String) joined is when the user joined the Access List.
+- `name` (String) name is the name of the member of the Access List.
+- `reason` (String) reason is the reason this user was added to the Access List.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_monitoring_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_monitoring_rule.mdx
new file mode 100644
index 0000000000000..2510cbc7cc919
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/access_monitoring_rule.mdx
@@ -0,0 +1,144 @@
+---
+title: Reference for the teleport_access_monitoring_rule Terraform resource
+sidebar_label: access_monitoring_rule
+description: This page describes the supported values of the teleport_access_monitoring_rule resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_access_monitoring_rule resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Access Monitoring Rule enables notification routing or automatic
+# review rules based on specific conditions.
+#
+# This example automatically approves access requests for the role `your_role_name`
+# on Mondays and Tuesdays, and sends notifications to `#your-slack-channel`.
+
+resource "teleport_access_monitoring_rule" "test" {
+  version = "v1"
+  metadata = {
+    name = "test"
+  }
+  spec = {
+    subjects      = ["access_request"]
+    condition     = "access_request.spec.roles.contains(\"your_role_name\")"
+    desired_state = "reviewed"
+    notification = {
+      name       = "slack"
+      recipients = ["#your-slack-channel"]
+    }
+
+    automatic_review = {
+      integration = "builtin"
+      decision    = "APPROVED"
+    }
+    schedules = {
+      default = {
+        time = {
+          timezone = "America/Los_Angeles"
+          shifts = [
+            {
+              weekday : "Monday"
+              start : "00:00"
+              end : "23:59"
+            },
+            {
+              weekday : "Tuesday"
+              start : "00:00"
+              end : "23:59"
+            },
+          ]
+        }
+      }
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an AccessMonitoringRule specification (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) version is version
+
+### Optional
+
+- `metadata` (Attributes) metadata is the rules's metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Required:
+
+- `subjects` (List of String) subjects the rule operates on, can be a resource kind or a particular resource property.
+
+Optional:
+
+- `automatic_review` (Attributes) automatic_review defines automatic review configurations for Access Requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specautomatic_review))
+- `condition` (String) condition is a predicate expression that operates on the specified subject resources, and determines whether the subject will be moved into desired state.
+- `desired_state` (String) desired_state defines the desired state of the subject. For Access Request subjects, the desired_state may be set to `reviewed` to indicate that the Access Request should be automatically reviewed.
+- `notification` (Attributes) notification defines the plugin configuration for notifications if rule is triggered. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specnotification))
+- `schedules` (Attributes Map) schedules specifies a map of schedules that can be used to configure the access monitoring rule conditions.  Available in Teleport v18.2.8 or higher. (see [below for nested schema](#nested-schema-for-specschedules))
+- `states` (List of String) states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.
+
+### Nested Schema for `spec.automatic_review`
+
+Optional:
+
+- `decision` (String) decision specifies the proposed state of the access review. This can be either 'APPROVED' or 'DENIED'.
+- `integration` (String) integration is the name of the integration that is responsible for monitoring the rule. Set this value to `builtin` to monitor the rule with Teleport.
+
+
+### Nested Schema for `spec.notification`
+
+Optional:
+
+- `name` (String) name is the name of the plugin to which this configuration should apply.
+- `recipients` (List of String) recipients is the list of recipients the plugin should notify.
+
+
+### Nested Schema for `spec.schedules`
+
+Optional:
+
+- `time` (Attributes) TimeSchedule specifies an in-line schedule. (see [below for nested schema](#nested-schema-for-specschedulestime))
+
+### Nested Schema for `spec.schedules.time`
+
+Optional:
+
+- `shifts` (Attributes List) Shifts contains a set of shifts that make up the schedule. (see [below for nested schema](#nested-schema-for-specschedulestimeshifts))
+- `timezone` (String) Timezone specifies the schedule timezone. This field is optional and defaults to "UTC". Accepted values use timezone locations as defined in the IANA Time Zone Database, such as "America/Los_Angeles", "Europe/Lisbon", or "Asia/Singapore".  See https://data.iana.org/time-zones/tzdb/zone1970.tab for a list of supported values.
+
+### Nested Schema for `spec.schedules.time.shifts`
+
+Optional:
+
+- `end` (String) End specifies the end time in the format HH:MM, e.g., "12:30".
+- `start` (String) Start specifies the start time in the format HH:MM, e.g., "12:30".
+- `weekday` (String) Weekday specifies the day of the week, e.g., "Sunday", "Monday", "Tuesday".
+
+
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/app.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/app.mdx
new file mode 100644
index 0000000000000..cec7314b479ba
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/app.mdx
@@ -0,0 +1,167 @@
+---
+title: Reference for the teleport_app Terraform resource
+sidebar_label: app
+description: This page describes the supported values of the teleport_app resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_app resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport App
+
+resource "teleport_app" "example" {
+  version = "v3"
+  metadata = {
+    name        = "example"
+    description = "Test app"
+    labels = {
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    uri = "localhost:3000"
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is the app resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the app resource spec. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource subkind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `aws` (Attributes) AWS contains additional options for AWS applications. (see [below for nested schema](#nested-schema-for-specaws))
+- `cloud` (String) Cloud identifies the cloud instance the app represents.
+- `cors` (Attributes) CORSPolicy defines the Cross-Origin Resource Sharing settings for the app. (see [below for nested schema](#nested-schema-for-speccors))
+- `dynamic_labels` (Attributes Map) DynamicLabels are the app's command labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
+- `identity_center` (Attributes) IdentityCenter encasulates AWS identity-center specific information. Only valid for Identity Center account apps. (see [below for nested schema](#nested-schema-for-specidentity_center))
+- `insecure_skip_verify` (Boolean) InsecureSkipVerify disables app's TLS certificate verification.
+- `integration` (String) Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.
+- `mcp` (Attributes) MCP contains MCP server related configurations. (see [below for nested schema](#nested-schema-for-specmcp))
+- `public_addr` (String) PublicAddr is the public address the application is accessible at.
+- `required_app_names` (List of String) RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate along side this app.
+- `rewrite` (Attributes) Rewrite is a list of rewriting rules to apply to requests and responses. (see [below for nested schema](#nested-schema-for-specrewrite))
+- `tcp_ports` (Attributes List) TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol. (see [below for nested schema](#nested-schema-for-spectcp_ports))
+- `uri` (String) URI is the web app endpoint.
+- `use_any_proxy_public_addr` (Boolean) UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.
+- `user_groups` (List of String) UserGroups are a list of user group IDs that this app is associated with.
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `external_id` (String) ExternalID is the AWS External ID used when assuming roles in this app.
+- `roles_anywhere_profile` (Attributes) RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps. (see [below for nested schema](#nested-schema-for-specawsroles_anywhere_profile))
+
+### Nested Schema for `spec.aws.roles_anywhere_profile`
+
+Optional:
+
+- `accept_role_session_name` (Boolean) Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName
+- `profile_arn` (String) ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.
+
+
+
+### Nested Schema for `spec.cors`
+
+Optional:
+
+- `allow_credentials` (Boolean) allow_credentials indicates whether credentials are allowed.
+- `allowed_headers` (List of String) allowed_headers specifies which headers can be used when accessing the app.
+- `allowed_methods` (List of String) allowed_methods specifies which methods are allowed when accessing the app.
+- `allowed_origins` (List of String) allowed_origins specifies which origins are allowed to access the app.
+- `exposed_headers` (List of String) exposed_headers indicates which headers are made available to scripts via the browser.
+- `max_age` (Number) max_age indicates how long (in seconds) the results of a preflight request can be cached.
+
+
+### Nested Schema for `spec.dynamic_labels`
+
+Optional:
+
+- `command` (List of String) Command is a command to run
+- `period` (String) Period is a time between command runs
+- `result` (String) Result captures standard output
+
+
+### Nested Schema for `spec.identity_center`
+
+Optional:
+
+- `account_id` (String) Account ID is the AWS-assigned ID of the account
+- `permission_sets` (Attributes List) PermissionSets lists the available permission sets on the given account (see [below for nested schema](#nested-schema-for-specidentity_centerpermission_sets))
+
+### Nested Schema for `spec.identity_center.permission_sets`
+
+Optional:
+
+- `arn` (String) ARN is the fully-formed ARN of the Permission Set.
+- `assignment_name` (String) AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.
+- `name` (String) Name is the human-readable name of the Permission Set.
+
+
+
+### Nested Schema for `spec.mcp`
+
+Optional:
+
+- `args` (List of String) Args to execute with the command.
+- `command` (String) Command to launch stdio-based MCP servers.
+- `run_as_host_user` (String) RunAsHostUser is the host user account under which the command will be executed. Required for stdio-based MCP servers.
+
+
+### Nested Schema for `spec.rewrite`
+
+Optional:
+
+- `headers` (Attributes List) Headers is a list of headers to inject when passing the request over to the application. (see [below for nested schema](#nested-schema-for-specrewriteheaders))
+- `jwt_claims` (String) JWTClaims configures whether roles/traits are included in the JWT token.
+- `redirect` (List of String) Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.
+
+### Nested Schema for `spec.rewrite.headers`
+
+Optional:
+
+- `name` (String) Name is the http header name.
+- `value` (String) Value is the http header value.
+
+
+
+### Nested Schema for `spec.tcp_ports`
+
+Optional:
+
+- `end_port` (Number) EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.
+- `port` (Number) Port describes the start of the range. It must be between 1 and 65535.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/auth_preference.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/auth_preference.mdx
new file mode 100644
index 0000000000000..abbdc638183f9
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/auth_preference.mdx
@@ -0,0 +1,155 @@
+---
+title: Reference for the teleport_auth_preference Terraform resource
+sidebar_label: auth_preference
+description: This page describes the supported values of the teleport_auth_preference resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_auth_preference resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# AuthPreference resource
+
+resource "teleport_auth_preference" "example" {
+  version = "v2"
+  metadata = {
+    description = "Auth preference"
+    labels = {
+      "example"             = "yes"
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    disconnect_expired_cert = true
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an AuthPreference specification (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `allow_headless` (Boolean) AllowHeadless enables/disables headless support. Headless authentication requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
+- `allow_local_auth` (Boolean) AllowLocalAuth is true if local authentication is enabled.
+- `allow_passwordless` (Boolean) AllowPasswordless enables/disables passwordless support. Passwordless requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
+- `connector_name` (String) ConnectorName is the name of the OIDC or SAML connector. If this value is not set the first connector in the backend will be used.
+- `default_session_ttl` (String) DefaultSessionTTL is the TTL to use for user certs when an explicit TTL is not requested.
+- `device_trust` (Attributes) DeviceTrust holds settings related to trusted device verification. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specdevice_trust))
+- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert provides disconnect expired certificate setting - if true, connections with expired client certificates will get disconnected
+- `hardware_key` (Attributes) HardwareKey are the settings for hardware key support. (see [below for nested schema](#nested-schema-for-spechardware_key))
+- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specidp))
+- `locking_mode` (String) LockingMode is the cluster-wide locking mode default.
+- `message_of_the_day` (String)
+- `okta` (Attributes) Okta is a set of options related to the Okta service in Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specokta))
+- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this cluster. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
+- `second_factor` (String) SecondFactor is the type of mult-factor. Deprecated: Prefer using SecondFactors instead.
+- `second_factors` (List of Number) SecondFactors is a list of supported multi-factor types. 1 is "otp", 2 is "webauthn", 3 is "sso", If unspecified, the current default value is [1], or ["otp"].
+- `signature_algorithm_suite` (Number) SignatureAlgorithmSuite is the configured signature algorithm suite for the cluster. If unspecified, the current default value is "legacy". 1 is "legacy", 2 is "balanced-v1", 3 is "fips-v1", 4 is "hsm-v1".
+- `stable_unix_user_config` (Attributes) StableUnixUserConfig contains the cluster-wide configuration for stable UNIX users. (see [below for nested schema](#nested-schema-for-specstable_unix_user_config))
+- `type` (String) Type is the type of authentication.
+- `u2f` (Attributes) U2F are the settings for the U2F device. (see [below for nested schema](#nested-schema-for-specu2f))
+- `webauthn` (Attributes) Webauthn are the settings for server-side Web Authentication support. (see [below for nested schema](#nested-schema-for-specwebauthn))
+
+### Nested Schema for `spec.device_trust`
+
+Optional:
+
+- `auto_enroll` (Boolean) Enable device auto-enroll. Auto-enroll lets any user issue a device enrollment token for a known device that is not already enrolled. `tsh` takes advantage of auto-enroll to automatically enroll devices on user login, when appropriate. The effective cluster Mode still applies: AutoEnroll=true is meaningless if Mode="off".
+- `ekcert_allowed_cas` (List of String) Allow list of EKCert CAs in PEM format. If present, only TPM devices that present an EKCert that is signed by a CA specified here may be enrolled (existing enrollments are unchanged).  If not present, then the CA of TPM EKCerts will not be checked during enrollment, this allows any device to enroll.
+- `mode` (String) Mode of verification for trusted devices.  The following modes are supported:  - "off": disables both device authentication and authorization. - "optional": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - "required": enforces the presence of device extensions for sensitive endpoints. - "required-for-humans": enforces the presence of device extensions for sensitive endpoints, for human users only (bots are exempt).  Mode is always "off" for OSS. Defaults to "optional" for Enterprise.
+
+
+### Nested Schema for `spec.hardware_key`
+
+Optional:
+
+- `pin_cache_ttl` (String) PinCacheTTL is the amount of time in nanoseconds that Teleport clients will cache the user's PIV PIN when hardware key PIN policy is enabled.
+- `piv_slot` (String) PIVSlot is a PIV slot that Teleport clients should use instead of the default based on private key policy. For example, "9a" or "9e".
+- `serial_number_validation` (Attributes) SerialNumberValidation holds settings for hardware key serial number validation. By default, serial number validation is disabled. (see [below for nested schema](#nested-schema-for-spechardware_keyserial_number_validation))
+
+### Nested Schema for `spec.hardware_key.serial_number_validation`
+
+Optional:
+
+- `enabled` (Boolean) Enabled indicates whether hardware key serial number validation is enabled.
+- `serial_number_trait_name` (String) SerialNumberTraitName is an optional custom user trait name for hardware key serial numbers to replace the default: "hardware_key_serial_numbers".  Note: Values for this user trait should be a comma-separated list of serial numbers, or a list of comm-separated lists. e.g ["123", "345,678"]
+
+
+
+### Nested Schema for `spec.idp`
+
+Optional:
+
+- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specidpsaml))
+
+### Nested Schema for `spec.idp.saml`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
+
+
+
+### Nested Schema for `spec.okta`
+
+Optional:
+
+- `sync_period` (String) SyncPeriod is the duration between synchronization calls in nanoseconds.
+
+
+### Nested Schema for `spec.stable_unix_user_config`
+
+Optional:
+
+- `enabled` (Boolean) Enabled signifies that (UNIX) Teleport SSH hosts should obtain a UID from the control plane if they're about to provision a host user with no other configured UID.
+- `first_uid` (Number) FirstUid is the start of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
+- `last_uid` (Number) LastUid is the end of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
+
+
+### Nested Schema for `spec.u2f`
+
+Optional:
+
+- `app_id` (String) AppID returns the application ID for universal mult-factor.
+- `device_attestation_cas` (List of String) DeviceAttestationCAs contains the trusted attestation CAs for U2F devices.
+- `facets` (List of String) Facets returns the facets for universal mult-factor. Deprecated: Kept for backwards compatibility reasons, but Facets have no effect since Teleport v10, when Webauthn replaced the U2F implementation.
+
+
+### Nested Schema for `spec.webauthn`
+
+Optional:
+
+- `attestation_allowed_cas` (List of String) Allow list of device attestation CAs in PEM format. If present, only devices whose attestation certificates match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationDeniedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default all devices are allowed.
+- `attestation_denied_cas` (List of String) Deny list of device attestation CAs in PEM format. If present, only devices whose attestation certificates don't match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationAllowedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default no devices are denied.
+- `rp_id` (String) RPID is the ID of the Relying Party. It should be set to the domain name of the Teleport installation.  IMPORTANT: RPID must never change in the lifetime of the cluster, because it's recorded in the registration data on the WebAuthn device. If the RPID changes, all existing WebAuthn key registrations will become invalid and all users who use WebAuthn as the multi-factor will need to re-register.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_config.mdx
new file mode 100644
index 0000000000000..0733447e4ea0f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_config.mdx
@@ -0,0 +1,115 @@
+---
+title: Reference for the teleport_autoupdate_config Terraform resource
+sidebar_label: autoupdate_config
+description: This page describes the supported values of the teleport_autoupdate_config resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_autoupdate_config resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_autoupdate_config" "test" {
+  version = "v1"
+  spec = {
+    tools = {
+      mode = "enabled"
+    }
+    agents = {
+      mode     = "enabled"
+      strategy = "halt-on-error"
+      schedules = {
+        regular = [
+          {
+            name = "dev"
+            days = ["Mon", "Tue", "Wed", "Thu"]
+            start_hour : 4
+          },
+          {
+            name = "staging"
+            days = ["Mon", "Tue", "Wed", "Thu"]
+            start_hour : 14
+          },
+          {
+            name = "prod"
+            days = ["Mon", "Tue", "Wed", "Thu"]
+            start_hour : 14
+            wait_hours : 24
+          },
+        ]
+      }
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String)
+
+### Optional
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String)
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
+- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
+
+### Nested Schema for `spec.agents`
+
+Optional:
+
+- `maintenance_window_duration` (String) maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based". Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next maintenance window.
+- `mode` (String) mode specifies whether agent autoupdates are enabled, disabled, or paused.
+- `schedules` (Attributes) schedules specifies schedules for updates of grouped agents. (see [below for nested schema](#nested-schema-for-specagentsschedules))
+- `strategy` (String) strategy to use for updating the agents.
+
+### Nested Schema for `spec.agents.schedules`
+
+Optional:
+
+- `regular` (Attributes List) regular schedules for non-critical versions. (see [below for nested schema](#nested-schema-for-specagentsschedulesregular))
+
+### Nested Schema for `spec.agents.schedules.regular`
+
+Optional:
+
+- `canary_count` (Number) canary_count is the number of canary agents that will be updated before the whole group is updated. when set to 0, the group does not enter the canary phase. This number is capped to 5. This number must always be lower than the total number of agents in the group, else the rollout will be stuck.
+- `days` (List of String) days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
+- `name` (String) name of the group
+- `start_hour` (Number) start_hour to initiate update
+- `wait_hours` (Number) wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure". This field must be positive.
+
+
+
+
+### Nested Schema for `spec.tools`
+
+Optional:
+
+- `mode` (String) Mode defines state of the client tools auto update.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `name` (String) name is an object name.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_version.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_version.mdx
new file mode 100644
index 0000000000000..e121152aab7ce
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/autoupdate_version.mdx
@@ -0,0 +1,79 @@
+---
+title: Reference for the teleport_autoupdate_version Terraform resource
+sidebar_label: autoupdate_version
+description: This page describes the supported values of the teleport_autoupdate_version resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_autoupdate_version resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_autoupdate_version" "test" {
+  version = "v1"
+  spec = {
+    tools = {
+      target_version = "1.2.3"
+    }
+    agents = {
+      start_version  = "1.2.3"
+      target_version = "1.2.4"
+      schedule       = "regular"
+      mode           = "enabled"
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String)
+
+### Optional
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String)
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
+- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
+
+### Nested Schema for `spec.agents`
+
+Optional:
+
+- `mode` (String) autoupdate_mode to use for the rollout
+- `schedule` (String) schedule to use for the rollout
+- `start_version` (String) start_version is the version used for newly installed agents before their update window.
+- `target_version` (String) target_version is the version that all agents will update to during their update window.
+
+
+### Nested Schema for `spec.tools`
+
+Optional:
+
+- `target_version` (String) TargetVersion specifies the semantic version required for tools to establish a connection with the cluster. Client tools after connection to the cluster going to be updated to this version automatically.
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `name` (String) name is an object name.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/bot.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/bot.mdx
new file mode 100644
index 0000000000000..f2388e93cf4e7
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/bot.mdx
@@ -0,0 +1,81 @@
+---
+title: Reference for the teleport_bot Terraform resource
+sidebar_label: bot
+description: This page describes the supported values of the teleport_bot resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_bot resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Machine ID Bot creation example
+
+resource "teleport_bot" "example" {
+  metadata = {
+    name = "example"
+  }
+
+  spec = {
+    roles = ["access"]
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `metadata` (Attributes) Requires provider v18.4.0 or newer. Common metadata that all resources share (see [below for nested schema](#nested-schema-for-metadata))
+- `name` (String, Deprecated) The name of the bot, i.e. the unprefixed User name
+- `roles` (List of String, Deprecated) A list of roles the created bot should be allowed to assume via role impersonation.
+- `spec` (Attributes) Requires provider v18.4.0 or newer. The configured properties of a bot. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) Differentiates variations of the same kind. All resources should contain one, even if it is never populated.
+- `token_id` (String, Sensitive, Deprecated)
+- `token_ttl` (String, Deprecated)
+- `traits` (Map of List of String, Deprecated)
+- `version` (String) The version of the resource being represented.
+
+### Read-Only
+
+- `role_name` (String, Deprecated) The name of the generated bot role
+- `status` (Attributes) Requires provider v18.4.0 or newer. Fields that are set by the server as results of operations. These should not be modified by users. (see [below for nested schema](#nested-schema-for-status))
+- `user_name` (String, Deprecated) The name of the generated bot user
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `max_session_ttl` (String) The max session TTL value for the bot's internal role. Unless specified, bots may not request a value beyond the default maximum TTL of 12 hours. This value may not be larger than 7 days (168 hours).
+- `roles` (List of String) A list of roles the created bot should be allowed to assume via role impersonation.
+- `traits` (Map of List of String) The traits that will be associated with the bot for the purposes of role templating.
+
+Where multiple specified with the same name, these will be merged by the server.
+
+
+### Nested Schema for `status`
+
+Read-Only:
+
+- `role_name` (String) The name of the role associated with the bot.
+- `user_name` (String) The name of the user associated with the bot.
diff --git a/docs/pages/reference/terraform-provider/resources/cluster_maintenance_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/cluster_maintenance_config.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/cluster_maintenance_config.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/cluster_maintenance_config.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/cluster_networking_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/cluster_networking_config.mdx
new file mode 100644
index 0000000000000..00c91aa643e35
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/cluster_networking_config.mdx
@@ -0,0 +1,91 @@
+---
+title: Reference for the teleport_cluster_networking_config Terraform resource
+sidebar_label: cluster_networking_config
+description: This page describes the supported values of the teleport_cluster_networking_config resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_cluster_networking_config resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Cluster Networking config
+
+resource "teleport_cluster_networking_config" "example" {
+  version = "v2"
+  metadata = {
+    description = "Networking config"
+    labels = {
+      "example"             = "yes"
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    client_idle_timeout = "1h"
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a ClusterNetworkingConfig specification (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `assist_command_execution_workers` (Number) AssistCommandExecutionWorkers determines the number of workers that will execute arbitrary Assist commands on servers in parallel
+- `case_insensitive_routing` (Boolean) CaseInsensitiveRouting causes proxies to use case-insensitive hostname matching.
+- `client_idle_timeout` (String) ClientIdleTimeout sets global cluster default setting for client idle timeouts.
+- `idle_timeout_message` (String) ClientIdleTimeoutMessage is the message sent to the user when a connection times out.
+- `keep_alive_count_max` (Number) KeepAliveCountMax is the number of keep-alive messages that can be missed before the server disconnects the connection to the client.
+- `keep_alive_interval` (String) KeepAliveInterval is the interval at which the server sends keep-alive messages to the client.
+- `proxy_listener_mode` (Number) ProxyListenerMode is proxy listener mode used by Teleport Proxies. 0 is "separate"; 1 is "multiplex".
+- `proxy_ping_interval` (String) ProxyPingInterval defines in which interval the TLS routing ping message should be sent. This is applicable only when using ping-wrapped connections, regular TLS routing connections are not affected.
+- `routing_strategy` (Number) RoutingStrategy determines the strategy used to route to nodes. 0 is "unambiguous_match"; 1 is "most_recent".
+- `session_control_timeout` (String) SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the Auth Service before it begins terminating controlled sessions.
+- `ssh_dial_timeout` (String) SSHDialTimeout is a custom dial timeout used when establishing SSH connections. If not set, the default timeout of 30s will be used.
+- `tunnel_strategy` (Attributes) TunnelStrategyV1 determines the tunnel strategy used in the cluster. (see [below for nested schema](#nested-schema-for-spectunnel_strategy))
+- `web_idle_timeout` (String) WebIdleTimeout sets global cluster default setting for the web UI idle timeouts.
+
+### Nested Schema for `spec.tunnel_strategy`
+
+Optional:
+
+- `agent_mesh` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyagent_mesh))
+- `proxy_peering` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyproxy_peering))
+
+### Nested Schema for `spec.tunnel_strategy.agent_mesh`
+
+Optional:
+
+- `active` (Boolean) Automatically generated field preventing empty message errors
+
+
+### Nested Schema for `spec.tunnel_strategy.proxy_peering`
+
+Optional:
+
+- `agent_connection_count` (Number)
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/database.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/database.mdx
new file mode 100644
index 0000000000000..e35b901db96fd
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/database.mdx
@@ -0,0 +1,293 @@
+---
+title: Reference for the teleport_database Terraform resource
+sidebar_label: database
+description: This page describes the supported values of the teleport_database resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_database resource of the Teleport Terraform provider.
+Follow [the database dynamic registration guide](../../../../enroll-resources/database-access/guides/dynamic-registration.mdx)
+to complete deploying a database_service and access the database resource
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Database
+
+resource "teleport_database" "example" {
+  version = "v3"
+  metadata = {
+    name        = "example"
+    description = "Test database"
+    labels = {
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    protocol = "postgres"
+    uri      = "localhost"
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is the database metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the database spec. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource subkind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `protocol` (String) Protocol is the database protocol: postgres, mysql, mongodb, etc.
+- `uri` (String) URI is the database connection endpoint.
+
+Optional:
+
+- `ad` (Attributes) AD is the Active Directory configuration for the database. (see [below for nested schema](#nested-schema-for-specad))
+- `admin_user` (Attributes) AdminUser is the database admin user for automatic user provisioning. (see [below for nested schema](#nested-schema-for-specadmin_user))
+- `aws` (Attributes) AWS contains AWS specific settings for RDS/Aurora/Redshift databases. (see [below for nested schema](#nested-schema-for-specaws))
+- `azure` (Attributes) Azure contains Azure specific database metadata. (see [below for nested schema](#nested-schema-for-specazure))
+- `ca_cert` (String) CACert is the PEM-encoded database CA certificate.  DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.
+- `dynamic_labels` (Attributes Map) DynamicLabels is the database dynamic labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
+- `gcp` (Attributes) GCP contains parameters specific to GCP Cloud SQL databases. (see [below for nested schema](#nested-schema-for-specgcp))
+- `mongo_atlas` (Attributes) MongoAtlas contains Atlas metadata about the database. (see [below for nested schema](#nested-schema-for-specmongo_atlas))
+- `mysql` (Attributes) MySQL is an additional section with MySQL database options. (see [below for nested schema](#nested-schema-for-specmysql))
+- `oracle` (Attributes) Oracle is an additional Oracle configuration options. (see [below for nested schema](#nested-schema-for-specoracle))
+- `tls` (Attributes) TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name. (see [below for nested schema](#nested-schema-for-spectls))
+
+### Nested Schema for `spec.ad`
+
+Optional:
+
+- `domain` (String) Domain is the Active Directory domain the database resides in.
+- `kdc_host_name` (String) KDCHostName is the host name for a KDC for x509 Authentication.
+- `keytab_file` (String) KeytabFile is the path to the Kerberos keytab file.
+- `krb5_file` (String) Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.
+- `ldap_cert` (String) LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.
+- `ldap_service_account_name` (String) LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
+- `ldap_service_account_sid` (String) LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
+- `spn` (String) SPN is the service principal name for the database.
+
+
+### Nested Schema for `spec.admin_user`
+
+Optional:
+
+- `default_database` (String) DefaultDatabase is the database that the privileged database user logs into by default.  Depending on the database type, this database may be used to store procedures or data for managing database users.
+- `name` (String) Name is the username of the privileged database user.
+
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `account_id` (String) AccountID is the AWS account ID this database belongs to.
+- `assume_role_arn` (String) AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.
+- `docdb` (Attributes) DocumentDB contains Amazon DocumentDB-specific metadata. (see [below for nested schema](#nested-schema-for-specawsdocdb))
+- `elasticache` (Attributes) ElastiCache contains Amazon ElastiCache Redis-specific metadata. (see [below for nested schema](#nested-schema-for-specawselasticache))
+- `elasticache_serverless` (Attributes) ElastiCacheServerless contains Amazon ElastiCache Serverless metadata. (see [below for nested schema](#nested-schema-for-specawselasticache_serverless))
+- `external_id` (String) ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
+- `iam_policy_status` (Number) IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database.
+- `memorydb` (Attributes) MemoryDB contains AWS MemoryDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsmemorydb))
+- `opensearch` (Attributes) OpenSearch contains AWS OpenSearch specific metadata. (see [below for nested schema](#nested-schema-for-specawsopensearch))
+- `rds` (Attributes) RDS contains RDS specific metadata. (see [below for nested schema](#nested-schema-for-specawsrds))
+- `rdsproxy` (Attributes) RDSProxy contains AWS Proxy specific metadata. (see [below for nested schema](#nested-schema-for-specawsrdsproxy))
+- `redshift` (Attributes) Redshift contains Redshift specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift))
+- `redshift_serverless` (Attributes) RedshiftServerless contains Amazon Redshift Serverless-specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift_serverless))
+- `region` (String) Region is a AWS cloud region.
+- `secret_store` (Attributes) SecretStore contains secret store configurations. (see [below for nested schema](#nested-schema-for-specawssecret_store))
+- `session_tags` (Map of String) SessionTags is a list of AWS STS session tags.
+
+### Nested Schema for `spec.aws.docdb`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the cluster identifier.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `instance_id` (String) InstanceID is the instance identifier.
+
+
+### Nested Schema for `spec.aws.elasticache`
+
+Optional:
+
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `replication_group_id` (String) ReplicationGroupID is the Redis replication group ID.
+- `transit_encryption_enabled` (Boolean) TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.
+- `user_group_ids` (List of String) UserGroupIDs is a list of user group IDs.
+
+
+### Nested Schema for `spec.aws.elasticache_serverless`
+
+Optional:
+
+- `cache_name` (String) CacheName is an ElastiCache Serverless cache name.
+
+
+### Nested Schema for `spec.aws.memorydb`
+
+Optional:
+
+- `acl_name` (String) ACLName is the name of the ACL associated with the cluster.
+- `cluster_name` (String) ClusterName is the name of the MemoryDB cluster.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+- `tls_enabled` (Boolean) TLSEnabled indicates whether in-transit encryption (TLS) is enabled.
+
+
+### Nested Schema for `spec.aws.opensearch`
+
+Optional:
+
+- `domain_id` (String) DomainID is the ID of the domain.
+- `domain_name` (String) DomainName is the name of the domain.
+- `endpoint_type` (String) EndpointType is the type of the endpoint.
+
+
+### Nested Schema for `spec.aws.rds`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the RDS cluster (Aurora) identifier.
+- `iam_auth` (Boolean) IAMAuth indicates whether database IAM authentication is enabled.
+- `instance_id` (String) InstanceID is the RDS instance identifier.
+- `resource_id` (String) ResourceID is the RDS instance resource identifier (db-xxx).
+- `security_groups` (List of String) SecurityGroups is a list of attached security groups for the RDS instance.
+- `subnets` (List of String) Subnets is a list of subnets for the RDS instance.
+- `vpc_id` (String) VPCID is the VPC where the RDS is running.
+
+
+### Nested Schema for `spec.aws.rdsproxy`
+
+Optional:
+
+- `custom_endpoint_name` (String) CustomEndpointName is the identifier of an RDS Proxy custom endpoint.
+- `name` (String) Name is the identifier of an RDS Proxy.
+- `resource_id` (String) ResourceID is the RDS instance resource identifier (prx-xxx).
+
+
+### Nested Schema for `spec.aws.redshift`
+
+Optional:
+
+- `cluster_id` (String) ClusterID is the Redshift cluster identifier.
+
+
+### Nested Schema for `spec.aws.redshift_serverless`
+
+Optional:
+
+- `endpoint_name` (String) EndpointName is the VPC endpoint name.
+- `workgroup_id` (String) WorkgroupID is the workgroup ID.
+- `workgroup_name` (String) WorkgroupName is the workgroup name.
+
+
+### Nested Schema for `spec.aws.secret_store`
+
+Optional:
+
+- `key_prefix` (String) KeyPrefix specifies the secret key prefix.
+- `kms_key_id` (String) KMSKeyID specifies the AWS KMS key for encryption.
+
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `is_flexi_server` (Boolean) IsFlexiServer is true if the database is an Azure Flexible server.
+- `name` (String) Name is the Azure database server name.
+- `redis` (Attributes) Redis contains Azure Cache for Redis specific database metadata. (see [below for nested schema](#nested-schema-for-specazureredis))
+- `resource_id` (String) ResourceID is the Azure fully qualified ID for the resource.
+
+### Nested Schema for `spec.azure.redis`
+
+Optional:
+
+- `clustering_policy` (String) ClusteringPolicy is the clustering policy for Redis Enterprise.
+
+
+
+### Nested Schema for `spec.dynamic_labels`
+
+Optional:
+
+- `command` (List of String) Command is a command to run
+- `period` (String) Period is a time between command runs
+- `result` (String) Result captures standard output
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `alloydb` (Attributes) AlloyDB contains AlloyDB specific configuration elements. (see [below for nested schema](#nested-schema-for-specgcpalloydb))
+- `instance_id` (String) InstanceID is the Cloud SQL instance ID.
+- `project_id` (String) ProjectID is the GCP project ID the Cloud SQL instance resides in.
+
+### Nested Schema for `spec.gcp.alloydb`
+
+Optional:
+
+- `endpoint_override` (String) EndpointOverride is an override of endpoint address to use.
+- `endpoint_type` (String) EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".
+
+
+
+### Nested Schema for `spec.mongo_atlas`
+
+Optional:
+
+- `name` (String) Name is the Atlas database instance name.
+
+
+### Nested Schema for `spec.mysql`
+
+Optional:
+
+- `server_version` (String) ServerVersion is the server version reported by DB proxy if the runtime information is not available.
+
+
+### Nested Schema for `spec.oracle`
+
+Optional:
+
+- `audit_user` (String) AuditUser is the name of the Oracle database user that should be used to access the internal audit trail.
+- `retry_count` (Number) RetryCount is the maximum number of times to retry connecting to a host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.
+- `shuffle_hostnames` (Boolean) ShuffleHostnames, when true, randomizes the order of hosts to connect to from the provided list.
+
+
+### Nested Schema for `spec.tls`
+
+Optional:
+
+- `ca_cert` (String) CACert is an optional user provided CA certificate used for verifying database TLS connection.
+- `mode` (Number) Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure".
+- `server_name` (String) ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.
+- `trust_system_cert_pool` (Boolean) TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/discovery_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/discovery_config.mdx
new file mode 100644
index 0000000000000..adfac53903bb0
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/discovery_config.mdx
@@ -0,0 +1,372 @@
+---
+title: Reference for the teleport_discovery_config Terraform resource
+sidebar_label: discovery_config
+description: This page describes the supported values of the teleport_discovery_config resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_discovery_config resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Discovery Config
+#
+# Discovery Config resources define matchers for the Teleport Discovery Service.
+# The Discovery Service automatically discovers and enrolls cloud resources
+# (EC2 instances, RDS databases, EKS clusters, Azure VMs, etc.) into your
+# Teleport cluster.
+#
+# Each Discovery Config is associated with a discovery_group. Discovery Services
+# load matchers from Discovery Configs that share the same discovery_group.
+
+# Example: AWS Discovery Config for EC2 instances and RDS databases
+resource "teleport_discovery_config" "aws_example" {
+  header = {
+    metadata = {
+      name        = "aws-discovery"
+      description = "Discover AWS EC2 instances and RDS databases"
+      labels = {
+        env = "production"
+      }
+    }
+    version = "v1"
+  }
+
+  spec = {
+    discovery_group = "aws-prod"
+
+    aws = [{
+      types   = ["ec2", "rds"]
+      regions = ["us-west-2", "us-east-1"]
+      tags = {
+        "env" = ["prod", "production"]
+      }
+      install_params = {
+        join_method = "iam"
+        join_token  = "aws-discovery-token"
+        script_name = "default-installer"
+      }
+    }]
+  }
+}
+
+# Example: Azure Discovery Config for VMs and AKS clusters
+resource "teleport_discovery_config" "azure_example" {
+  header = {
+    metadata = {
+      name        = "azure-discovery"
+      description = "Discover Azure VMs and AKS clusters"
+    }
+    version = "v1"
+  }
+
+  spec = {
+    discovery_group = "azure-prod"
+
+    azure = [{
+      types           = ["vm", "aks"]
+      regions         = ["eastus", "westus2"]
+      subscriptions   = ["00000000-0000-0000-0000-000000000000"]
+      resource_groups = ["my-resource-group"]
+      tags = {
+        "*" = ["*"]
+      }
+      install_params = {
+        join_method = "azure"
+        join_token  = "azure-discovery-token"
+        script_name = "default-installer"
+        azure = {
+          client_id = "00000000-0000-0000-0000-000000000000"
+        }
+      }
+    }]
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `header` (Attributes) Header is the resource header. (see [below for nested schema](#nested-schema-for-header))
+- `spec` (Attributes) Spec is an DiscoveryConfig specification. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `header`
+
+Required:
+
+- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+Optional:
+
+- `kind` (String) kind is a resource kind.
+- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `header.metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
+- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
+
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `access_graph` (Attributes) AccessGraph is the configurations for syncing Cloud accounts into Access Graph. (see [below for nested schema](#nested-schema-for-specaccess_graph))
+- `aws` (Attributes List) AWS is a list of AWS Matchers. (see [below for nested schema](#nested-schema-for-specaws))
+- `azure` (Attributes List) Azure is a list of Azure Matchers. (see [below for nested schema](#nested-schema-for-specazure))
+- `discovery_group` (String) DiscoveryGroup is used by discovery_service to add extra matchers. All the discovery_services that have the same discovery_group, will load the matchers of this resource.
+- `gcp` (Attributes List) GCP is a list of GCP Matchers. (see [below for nested schema](#nested-schema-for-specgcp))
+- `kube` (Attributes List) Kube is a list of Kubernetes Matchers. (see [below for nested schema](#nested-schema-for-speckube))
+
+### Nested Schema for `spec.access_graph`
+
+Optional:
+
+- `aws` (Attributes List) AWS is a configuration for AWS Access Graph service poll service. (see [below for nested schema](#nested-schema-for-specaccess_graphaws))
+- `azure` (Attributes List) Azure is a configuration for Azure Access Graph service poll service. (see [below for nested schema](#nested-schema-for-specaccess_graphazure))
+- `poll_interval` (String) PollInterval is the frequency at which to poll for resources
+
+### Nested Schema for `spec.access_graph.aws`
+
+Optional:
+
+- `assume_role` (Attributes) AssumeRoleARN is the AWS role to assume for database discovery. (see [below for nested schema](#nested-schema-for-specaccess_graphawsassume_role))
+- `cloud_trail_logs` (Attributes) Configuration settings for collecting AWS CloudTrail logs via an SQS queue. (see [below for nested schema](#nested-schema-for-specaccess_graphawscloud_trail_logs))
+- `eks_audit_logs` (Attributes) (see [below for nested schema](#nested-schema-for-specaccess_graphawseks_audit_logs))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs.
+- `regions` (List of String) Regions are AWS regions to import resources from.
+
+### Nested Schema for `spec.access_graph.aws.assume_role`
+
+Optional:
+
+- `external_id` (String) ExternalID is the external ID used to assume a role in another account.
+- `role_arn` (String) RoleARN is the fully specified AWS IAM role ARN.
+
+
+### Nested Schema for `spec.access_graph.aws.cloud_trail_logs`
+
+Optional:
+
+- `region` (String) The AWS region of the SQS queue for CloudTrail notifications, ex.: "us-east-2".
+- `sqs_queue` (String) The name or URL for CloudTrail log events, ex.: "demo-cloudtrail-queue".
+
+
+### Nested Schema for `spec.access_graph.aws.eks_audit_logs`
+
+Optional:
+
+- `tags` (Map of List of String) The tags of EKS clusters for which apiserver audit logs should be fetched.
+
+
+
+### Nested Schema for `spec.access_graph.azure`
+
+Optional:
+
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs.
+- `subscription_id` (String) SubscriptionID Is the ID of the Azure subscription to sync resources from
+
+
+
+### Nested Schema for `spec.aws`
+
+Optional:
+
+- `assume_role` (Attributes) AssumeRoleARN is the AWS role to assume for database discovery. (see [below for nested schema](#nested-schema-for-specawsassume_role))
+- `install` (Attributes) Params sets the join method when installing on discovered EC2 nodes (see [below for nested schema](#nested-schema-for-specawsinstall))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with AWS APIs. Environment credentials will not be used when this value is set.
+- `kube_app_discovery` (Boolean) KubeAppDiscovery controls whether Kubernetes App Discovery will be enabled for agents running on discovered clusters, currently only affects AWS EKS discovery in integration mode.
+- `organization` (Attributes) Organization is an AWS Organization matcher for discovering resources accross multiple accounts under an Organization. (see [below for nested schema](#nested-schema-for-specawsorganization))
+- `regions` (List of String) Regions are AWS regions to query for databases.
+- `setup_access_for_arn` (String) SetupAccessForARN is the role that the Discovery Service should create EKS Access Entries for. This value should match the IAM identity that Teleport Kubernetes Service uses. If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).
+- `ssm` (Attributes) SSM provides options to use when sending a document command to an EC2 node (see [below for nested schema](#nested-schema-for-specawsssm))
+- `tags` (Map of List of String) Tags are AWS resource Tags to match.
+- `types` (List of String) Types are AWS database types to match, "ec2", "rds", "redshift", "elasticache", or "memorydb".
+
+### Nested Schema for `spec.aws.assume_role`
+
+Optional:
+
+- `external_id` (String) ExternalID is the external ID used to assume a role in another account.
+- `role_arn` (String) RoleARN is the fully specified AWS IAM role ARN.
+
+
+### Nested Schema for `spec.aws.install`
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specawsinstallazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specawsinstallhttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.aws.install.azure`
+
+Optional:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.aws.install.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+### Nested Schema for `spec.aws.organization`
+
+Optional:
+
+- `organization_id` (String) OrganizationID is the AWS Organization ID to match against. Required.
+- `organizational_units` (Attributes) OrganizationalUnits contains rules for matchings AWS accounts based on their Organizational Units. (see [below for nested schema](#nested-schema-for-specawsorganizationorganizational_units))
+
+### Nested Schema for `spec.aws.organization.organizational_units`
+
+Optional:
+
+- `exclude` (List of String) Exclude is a list of AWS Organizational Unit IDs to exclude. Only exact matches or wildcard (*) are supported. If empty, no Organizational Units are excluded by default.
+- `include` (List of String) Include is a list of AWS Organizational Unit IDs to match. Only exact matches or wildcard (*) are supported. If empty, all Organizational Units are included by default.
+
+
+
+### Nested Schema for `spec.aws.ssm`
+
+Optional:
+
+- `document_name` (String) DocumentName is the name of the document to use when executing an SSM command
+
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `install_params` (Attributes) Params sets the join method when installing on discovered Azure nodes. (see [below for nested schema](#nested-schema-for-specazureinstall_params))
+- `integration` (String) Integration is the integration name used to generate credentials to interact with Azure APIs. Environment credentials will not be used when this value is set.
+- `regions` (List of String) Regions are Azure locations to match for databases.
+- `resource_groups` (List of String) ResourceGroups are Azure resource groups to query for resources.
+- `subscriptions` (List of String) Subscriptions are Azure subscriptions to query for resources.
+- `tags` (Map of List of String) ResourceTags are Azure tags on resources to match.
+- `types` (List of String) Types are Azure types to match: "mysql", "postgres", "aks", "vm"
+
+### Nested Schema for `spec.azure.install_params`
+
+Required:
+
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specazureinstall_paramsazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specazureinstall_paramshttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.azure.install_params.azure`
+
+Required:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.azure.install_params.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `install_params` (Attributes) Params sets the join method when installing on discovered GCP nodes. (see [below for nested schema](#nested-schema-for-specgcpinstall_params))
+- `labels` (Map of List of String) Labels are GCP labels to match.
+- `locations` (List of String) Locations are GKE locations to search resources for.
+- `project_ids` (List of String) ProjectIDs are the GCP project ID where the resources are deployed.
+- `service_accounts` (List of String) ServiceAccounts are the emails of service accounts attached to VMs.
+- `tags` (Map of List of String) Tags is obsolete and only exists for backwards compatibility. Use Labels instead.
+- `types` (List of String) Types are GKE resource types to match: "gke", "vm".
+
+### Nested Schema for `spec.gcp.install_params`
+
+Optional:
+
+- `azure` (Attributes) Azure is the set of Azure-specific installation parameters. (see [below for nested schema](#nested-schema-for-specgcpinstall_paramsazure))
+- `enroll_mode` (Number) EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode
+- `http_proxy_settings` (Attributes) HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation. (see [below for nested schema](#nested-schema-for-specgcpinstall_paramshttp_proxy_settings))
+- `install_teleport` (Boolean) InstallTeleport disables agentless discovery
+- `join_method` (String) JoinMethod is the method to use when joining the cluster
+- `join_token` (String) JoinToken is the token to use when joining the cluster
+- `proxy_addr` (String) PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.
+- `script_name` (String) ScriptName is the name of the teleport installer script resource for the cloud instance to execute
+- `sshd_config` (String) SSHDConfig provides the path to write sshd configuration changes
+- `suffix` (String) Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.
+- `update_group` (String) UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.
+
+### Nested Schema for `spec.gcp.install_params.azure`
+
+Optional:
+
+- `client_id` (String) ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.
+
+
+### Nested Schema for `spec.gcp.install_params.http_proxy_settings`
+
+Optional:
+
+- `http_proxy` (String) HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.
+- `https_proxy` (String) HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.
+- `no_proxy` (String) NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.
+
+
+
+
+### Nested Schema for `spec.kube`
+
+Optional:
+
+- `labels` (Map of List of String) Labels are Kubernetes services labels to match.
+- `namespaces` (List of String) Namespaces are Kubernetes namespaces in which to discover services
+- `types` (List of String) Types are Kubernetes services types to match. Currently only 'app' is supported.
diff --git a/docs/pages/reference/terraform-provider/resources/dynamic_windows_desktop.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/dynamic_windows_desktop.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/dynamic_windows_desktop.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/dynamic_windows_desktop.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/github_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/github_connector.mdx
new file mode 100644
index 0000000000000..9262a42d902df
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/github_connector.mdx
@@ -0,0 +1,119 @@
+---
+title: Reference for the teleport_github_connector Terraform resource
+sidebar_label: github_connector
+description: This page describes the supported values of the teleport_github_connector resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_github_connector resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Terraform Github connector
+
+variable "github_secret" {}
+
+resource "teleport_github_connector" "github" {
+  version = "v3"
+  # This section tells Terraform that role example must be created before the GitHub connector
+  depends_on = [
+    teleport_role.example
+  ]
+
+  metadata = {
+    name = "example"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    client_id     = "client"
+    client_secret = var.github_secret
+
+    teams_to_roles = [{
+      organization = "gravitational"
+      team         = "devs"
+      roles        = ["example"]
+    }]
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an Github connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Required:
+
+- `client_id` (String) ClientID is the Github OAuth app client ID.
+- `client_secret` (String, Sensitive) ClientSecret is the Github OAuth app client secret.
+
+Optional:
+
+- `api_endpoint_url` (String) APIEndpointURL is the URL of the API endpoint of the Github instance this connector is for.
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `display` (String) Display is the connector display name.
+- `endpoint_url` (String) EndpointURL is the URL of the GitHub instance this connector is for.
+- `redirect_url` (String) RedirectURL is the authorization callback URL.
+- `teams_to_logins` (Attributes List) TeamsToLogins maps Github team memberships onto allowed logins/roles.  DELETE IN 11.0.0 Deprecated: use GithubTeamsToRoles instead. (see [below for nested schema](#nested-schema-for-specteams_to_logins))
+- `teams_to_roles` (Attributes List) TeamsToRoles maps Github team memberships onto allowed roles. (see [below for nested schema](#nested-schema-for-specteams_to_roles))
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.teams_to_logins`
+
+Optional:
+
+- `kubernetes_groups` (List of String) KubeGroups is a list of allowed kubernetes groups for this org/team.
+- `kubernetes_users` (List of String) KubeUsers is a list of allowed kubernetes users to impersonate for this org/team.
+- `logins` (List of String) Logins is a list of allowed logins for this org/team.
+- `organization` (String) Organization is a Github organization a user belongs to.
+- `team` (String) Team is a team within the organization a user belongs to.
+
+
+### Nested Schema for `spec.teams_to_roles`
+
+Optional:
+
+- `organization` (String) Organization is a Github organization a user belongs to.
+- `roles` (List of String) Roles is a list of allowed logins for this org/team.
+- `team` (String) Team is a team within the organization a user belongs to.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/health_check_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/health_check_config.mdx
new file mode 100644
index 0000000000000..9a067fb5df06a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/health_check_config.mdx
@@ -0,0 +1,108 @@
+---
+title: Reference for the teleport_health_check_config Terraform resource
+sidebar_label: health_check_config
+description: This page describes the supported values of the teleport_health_check_config resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_health_check_config resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_health_check_config" "example" {
+  metadata = {
+    name        = "example"
+    description = "Example health check config"
+    labels = {
+      foo = "bar"
+    }
+  }
+  version = "v1"
+  spec = {
+    interval            = "60s"
+    timeout             = "5s"
+    healthy_threshold   = 3
+    unhealthy_threshold = 2
+    match = {
+      db_labels = [{
+        name = "env"
+        values = [
+          "foo",
+          "bar",
+        ]
+      }]
+      db_labels_expression = "labels.foo == `bar`"
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) Metadata is the health check config resource's metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is the health check config specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the health check config version.
+
+### Optional
+
+- `sub_kind` (String) SubKind is an optional resource sub kind.
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `match` (Attributes) Match is used to select resources that these settings apply to. (see [below for nested schema](#nested-schema-for-specmatch))
+
+Optional:
+
+- `healthy_threshold` (Number) HealthyThreshold is the number of consecutive passing health checks after which a target's health status becomes "healthy".
+- `interval` (String) Interval is the time between each health check.
+- `timeout` (String) Timeout is the health check connection establishment timeout. An attempt that times out is a failed attempt.
+- `unhealthy_threshold` (Number) UnhealthyThreshold is the number of consecutive failing health checks after which a target's health status becomes "unhealthy".
+
+### Nested Schema for `spec.match`
+
+Optional:
+
+- `db_labels` (Attributes List) DBLabels matches database labels. An empty value is ignored. The match result is logically ANDed with DBLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchdb_labels))
+- `db_labels_expression` (String) DBLabelsExpression is a label predicate expression to match databases. An empty value is ignored. The match result is logically ANDed with DBLabels, if both are non-empty.
+- `disabled` (Boolean) Disabled disables matches for all labels and expressions.
+- `kubernetes_labels` (Attributes List) KubernetesLabels matches Kubernetes labels. An empty value is ignored. The match result is logically ANDed with KubernetesLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchkubernetes_labels))
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a label predicate expression to match Kubernetes. An empty value is ignored. The match result is logically ANDed with KubernetesLabels, if both are non-empty.
+
+### Nested Schema for `spec.match.db_labels`
+
+Optional:
+
+- `name` (String) The name of the label.
+- `values` (List of String) The values associated with the label.
+
+
+### Nested Schema for `spec.match.kubernetes_labels`
+
+Optional:
+
+- `name` (String) The name of the label.
+- `values` (List of String) The values associated with the label.
diff --git a/docs/pages/reference/terraform-provider/resources/installer.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/installer.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/installer.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/installer.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/integration.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/integration.mdx
new file mode 100644
index 0000000000000..afe9a8b8461d8
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/integration.mdx
@@ -0,0 +1,152 @@
+---
+title: Reference for the teleport_integration Terraform resource
+sidebar_label: integration
+description: This page describes the supported values of the teleport_integration resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_integration resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+resource "teleport_integration" "aws_oidc" {
+  version  = "v1"
+  sub_kind = "aws-oidc"
+  metadata = {
+    name        = "example"
+    description = "AWS OIDC integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    aws_oidc = {
+      role_arn = "arn:aws:iam::123456789012:role/example-role-name"
+    }
+  }
+}
+
+resource "teleport_integration" "azure_oidc" {
+  version  = "v1"
+  sub_kind = "azure-oidc"
+  metadata = {
+    name        = "azure-oidc"
+    description = "Example Azure OIDC integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    azure_oidc = {
+      // Azure Entra ID tenant ID
+      tenant_id = "a1b2c3d4-f2e4-97a8-9abc-1234567890ab"
+      // Azure enterprise application client ID
+      client_id = "7f12e3b5-6789-4abc-def0-112233445566"
+    }
+  }
+}
+
+resource "teleport_integration" "aws_roles_anywhere" {
+  version  = "v1"
+  sub_kind = "aws-ra"
+  metadata = {
+    name        = "aws-ra"
+    description = "Example AWS Roles Anywhere integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    aws_ra = {
+      profile_sync_config = {
+        // sync AWS profiles as Teleport applications
+        enabled                           = true
+        profile_accepts_role_session_name = false
+        profile_arn                       = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/<random-uuid>"
+        role_arn                          = "arn:aws:iam::123456789012:role/example-role-name"
+        // only sync AWS profiles as Teleport applications if the profile name matches
+        profile_name_filters = [
+          "teleport-*",    // supports globs
+          "^teleport-.*$", // and regex if the string is enclosed in regex anchors
+        ]
+      }
+      trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/<random-uuid>"
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is an Integration specification. (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `aws_oidc` (Attributes) AWSOIDC contains the specific fields to handle the AWS OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specaws_oidc))
+- `aws_ra` (Attributes) AWSRA contains the specific fields to handle the AWS Roles Anywhere Integration subkind. (see [below for nested schema](#nested-schema-for-specaws_ra))
+- `azure_oidc` (Attributes) AzureOIDC contains the specific fields to handle the Azure OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specazure_oidc))
+
+### Nested Schema for `spec.aws_oidc`
+
+Optional:
+
+- `audience` (String) Audience is used to record a name of a plugin or a discover service in Teleport that depends on this integration. Audience value can either be empty or "aws-identity-center". Preset audience may impose specific behavior on the integration CRUD API, such as preventing integration from update or deletion. Empty audience value should be treated as a default and backward-compatible behavior of the integration.
+- `issuer_s3_uri` (String) IssuerS3URI is the Identity Provider that was configured in AWS. This bucket/prefix/* files must be publicly accessible and contain the following: > .well-known/openid-configuration > .well-known/jwks Format: `s3://<bucket>/<prefix>` Optional. The proxy's endpoint is used if it is not specified.  DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate. Amazon had some whitelisted providers where the thumbprint was ignored. S3 hosted providers was in that list. Amazon is now trusting all the root certificate authorities, and this workaround is no longer needed. DELETE IN 18.0.
+- `role_arn` (String) RoleARN contains the Role ARN used to set up the Integration. This is the AWS Role that Teleport will use to issue tokens for API Calls.
+
+
+### Nested Schema for `spec.aws_ra`
+
+Optional:
+
+- `profile_sync_config` (Attributes) ProfileSyncConfig contains the configuration for the AWS Roles Anywhere Profile sync. This is used to create AWS Roles Anywhere profiles as application servers. (see [below for nested schema](#nested-schema-for-specaws_raprofile_sync_config))
+- `trust_anchor_arn` (String) TrustAnchorARN contains the AWS IAM Roles Anywhere Trust Anchor ARN used to set up the Integration.
+
+### Nested Schema for `spec.aws_ra.profile_sync_config`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this integration should sync profiles as application servers.
+- `profile_accepts_role_session_name` (Boolean) ProfileAcceptsRoleSessionName indicates whether the profile accepts a custom Role Session name.
+- `profile_arn` (String) ProfileARN is the ARN of the Roles Anywhere Profile used to generate credentials to access the AWS APIs.
+- `profile_name_filters` (List of String) ProfileNameFilters is a list of filters applied to the profile name. Only matching profiles will be synchronized as application servers. If empty, no filtering is applied.  Filters can be globs, for example:  profile* *name*  Or regexes if they're prefixed and suffixed with ^ and $, for example:  ^profile.*$ ^.*name.*$
+- `role_arn` (String) RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.
+
+
+
+### Nested Schema for `spec.azure_oidc`
+
+Optional:
+
+- `client_id` (String) ClientID specifies the ID of Azure enterprise application (client) that corresponds to this plugin.
+- `tenant_id` (String) TenantID specifies the ID of Entra Tenant (Directory) that this plugin integrates with.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/login_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/login_rule.mdx
new file mode 100644
index 0000000000000..60748d2a55d3b
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/login_rule.mdx
@@ -0,0 +1,85 @@
+---
+title: Reference for the teleport_login_rule Terraform resource
+sidebar_label: login_rule
+description: This page describes the supported values of the teleport_login_rule resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_login_rule resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Login Rule resource
+
+resource "teleport_login_rule" "example" {
+  metadata = {
+    description = "Example Login Rule"
+    labels = {
+      "example" = "yes"
+    }
+  }
+
+  version  = "v1"
+  priority = 0
+
+  # Either traits_map or traits_expression must be provided, but not both.
+  traits_map = {
+    "logins" = {
+      values = [
+        "external.logins",
+        "external.username",
+      ]
+    }
+    "groups" = {
+      values = [
+        "external.groups",
+      ]
+    }
+  }
+  #   # This traits_expression is functionally equivalent to the traits_map above.
+  #   traits_expression = <<EOF
+  # dict(
+  #   pair("logins", union(external.logins, external.username))
+  #   pair("groups", external.groups))
+  # EOF
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `priority` (Number) Priority is the priority of the login rule relative to other login rules in the same cluster. Login rules with a lower numbered priority will be evaluated first.
+- `version` (String) Version is the resource version.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `traits_expression` (String) TraitsExpression is a predicate expression which should return the desired traits for the user upon login.
+- `traits_map` (Attributes Map) TraitsMap is a map of trait keys to lists of predicate expressions which should evaluate to the desired values for that trait. (see [below for nested schema](#nested-schema-for-traits_map))
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `traits_map`
+
+Optional:
+
+- `values` (List of String)
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/oidc_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/oidc_connector.mdx
new file mode 100644
index 0000000000000..3eb40629c2ebb
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/oidc_connector.mdx
@@ -0,0 +1,137 @@
+---
+title: Reference for the teleport_oidc_connector Terraform resource
+sidebar_label: oidc_connector
+description: This page describes the supported values of the teleport_oidc_connector resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_oidc_connector resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport OIDC connector
+# 
+# Please note that the OIDC connector will work in Teleport Enterprise only.
+
+variable "oidc_secret" {}
+
+resource "teleport_oidc_connector" "example" {
+  version = "v3"
+  metadata = {
+    name = "example"
+    labels = {
+      test = "yes"
+    }
+  }
+
+  spec = {
+    client_id     = "client"
+    client_secret = var.oidc_secret
+
+    claims_to_roles = [{
+      claim = "test"
+      roles = ["terraform"]
+    }]
+
+    redirect_url = ["https://example.com/redirect"]
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an OIDC connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `acr_values` (String) ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.
+- `allow_unverified_email` (Boolean) AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a dynamic mapping from claims to roles. (see [below for nested schema](#nested-schema-for-specclaims_to_roles))
+- `client_id` (String) ClientID is the id of the authentication client (Teleport Auth Service).
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `client_secret` (String, Sensitive) ClientSecret is used to authenticate the client.
+- `display` (String) Display is the friendly name for this provider.
+- `entra_id_groups_provider` (Attributes) EntraIDGroupsProvider configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for the "groups" claim when the user's group membership exceeds 200 max item limit. (see [below for nested schema](#nested-schema-for-specentra_id_groups_provider))
+- `google_admin_email` (String) GoogleAdminEmail is the email of a google admin to impersonate.
+- `google_service_account` (String, Sensitive) GoogleServiceAccount is a string containing google service account credentials.
+- `google_service_account_uri` (String) GoogleServiceAccountURI is a path to a google service account uri.
+- `issuer_url` (String) IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
+- `max_age` (String)
+- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
+- `pkce_mode` (String) PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
+- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
+- `provider` (String) Provider is the external identity provider.
+- `redirect_url` (List of String) RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.
+- `request_object_mode` (String) RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters.
+- `scope` (List of String) Scope specifies additional scopes set by provider.
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+- `username_claim` (String) UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.
+
+### Nested Schema for `spec.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.entra_id_groups_provider`
+
+Optional:
+
+- `disabled` (Boolean) Disabled specifies that the groups provider should be disabled even when Entra ID responds with a groups claim source. User may choose to disable it if they are using integrations such as SCIM or similar groups importer as connector based role mapping may be not needed in such a scenario.
+- `graph_endpoint` (String) GraphEndpoint is a Microsoft Graph API endpoint. The groups claim source endpoint provided by Entra ID points to the now-retired Azure AD Graph endpoint ("https://graph.windows.net"). To convert it to the newer Microsoft Graph API endpoint, Teleport defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com"). Update GraphEndpoint to point to a different Microsoft Graph national cloud deployment endpoint.
+- `group_type` (String) GroupType is a user group type filter. Defaults to "security-groups". Value can be "security-groups", "directory-roles", "all-groups".
+
+
+### Nested Schema for `spec.mfa`
+
+Optional:
+
+- `acr_values` (String) AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.
+- `client_id` (String) ClientID is the OIDC OAuth app client ID.
+- `client_secret` (String) ClientSecret is the OIDC OAuth app client secret.
+- `enabled` (Boolean) Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.
+- `max_age` (String) MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.
+- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
+- `request_object_mode` (String) RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for the MFA client.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/okta_import_rule.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/okta_import_rule.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/okta_import_rule.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/okta_import_rule.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/provision_token.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/provision_token.mdx
new file mode 100644
index 0000000000000..5f49cb636d8e2
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/provision_token.mdx
@@ -0,0 +1,432 @@
+---
+title: Reference for the teleport_provision_token Terraform resource
+sidebar_label: provision_token
+description: This page describes the supported values of the teleport_provision_token resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_provision_token resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Provision Token resource
+
+resource "teleport_provision_token" "example" {
+  version = "v2"
+  metadata = {
+    expires     = "2022-10-12T07:20:51Z"
+    description = "Example token"
+
+    labels = {
+      example               = "yes"
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    roles = ["Node", "Auth"]
+  }
+}
+
+resource "teleport_provision_token" "iam-token" {
+  version = "v2"
+  metadata = {
+    name = "iam-token"
+  }
+  spec = {
+    roles       = ["Bot"]
+    bot_name    = "mybot"
+    join_method = "iam"
+    allow = [{
+      aws_account = "123456789012"
+    }]
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is a provisioning token V2 spec (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `status` (Attributes) Status is extended status information, depending on token type. It is not user writable. (see [below for nested schema](#nested-schema-for-status))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `spec`
+
+Required:
+
+- `roles` (List of String) Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specallow))
+- `aws_iid_ttl` (String) AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.
+- `azure` (Attributes) Azure allows the configuration of options specific to the "azure" join method. (see [below for nested schema](#nested-schema-for-specazure))
+- `azure_devops` (Attributes) AzureDevops allows the configuration of options specific to the "azure_devops" join method. (see [below for nested schema](#nested-schema-for-specazure_devops))
+- `bitbucket` (Attributes) Bitbucket allows the configuration of options specific to the "bitbucket" join method. (see [below for nested schema](#nested-schema-for-specbitbucket))
+- `bot_name` (String) BotName is the name of the bot this token grants access to, if any
+- `bound_keypair` (Attributes) BoundKeypair allows the configuration of options specific to the "bound_keypair" join method. (see [below for nested schema](#nested-schema-for-specbound_keypair))
+- `circleci` (Attributes) CircleCI allows the configuration of options specific to the "circleci" join method. (see [below for nested schema](#nested-schema-for-speccircleci))
+- `env0` (Attributes) Env0 allows the configuration of options specific to the "env0" join method. (see [below for nested schema](#nested-schema-for-specenv0))
+- `gcp` (Attributes) GCP allows the configuration of options specific to the "gcp" join method. (see [below for nested schema](#nested-schema-for-specgcp))
+- `github` (Attributes) GitHub allows the configuration of options specific to the "github" join method. (see [below for nested schema](#nested-schema-for-specgithub))
+- `gitlab` (Attributes) GitLab allows the configuration of options specific to the "gitlab" join method. (see [below for nested schema](#nested-schema-for-specgitlab))
+- `join_method` (String) JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm
+- `kubernetes` (Attributes) Kubernetes allows the configuration of options specific to the "kubernetes" join method. (see [below for nested schema](#nested-schema-for-speckubernetes))
+- `oracle` (Attributes) Oracle allows the configuration of options specific to the "oracle" join method. (see [below for nested schema](#nested-schema-for-specoracle))
+- `spacelift` (Attributes) Spacelift allows the configuration of options specific to the "spacelift" join method. (see [below for nested schema](#nested-schema-for-specspacelift))
+- `suggested_agent_matcher_labels` (Map of List of String) SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to `db_service.resources.labels`. Currently, only node-join scripts create a configuration according to the suggestion.
+- `suggested_labels` (Map of List of String) SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.
+- `terraform_cloud` (Attributes) TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method. (see [below for nested schema](#nested-schema-for-specterraform_cloud))
+- `tpm` (Attributes) TPM allows the configuration of options specific to the "tpm" join method. (see [below for nested schema](#nested-schema-for-spectpm))
+
+### Nested Schema for `spec.allow`
+
+Optional:
+
+- `aws_account` (String) AWSAccount is the AWS account ID.
+- `aws_arn` (String) AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".
+- `aws_regions` (List of String) AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.
+- `aws_role` (String) AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.
+
+
+### Nested Schema for `spec.azure`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specazureallow))
+
+### Nested Schema for `spec.azure.allow`
+
+Optional:
+
+- `resource_groups` (List of String) ResourceGroups is a list of Azure resource groups the node is allowed to join from.
+- `subscription` (String) Subscription is the Azure subscription.
+
+
+
+### Nested Schema for `spec.azure_devops`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified. (see [below for nested schema](#nested-schema-for-specazure_devopsallow))
+- `organization_id` (String) OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.
+
+### Nested Schema for `spec.azure_devops.allow`
+
+Optional:
+
+- `definition_id` (String) The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.
+- `pipeline_name` (String) The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.
+- `project_id` (String) The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.
+- `project_name` (String) The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.
+- `repository_ref` (String) The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.
+- `repository_uri` (String) The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.
+- `repository_version` (String) The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.
+- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.
+
+
+
+### Nested Schema for `spec.bitbucket`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specbitbucketallow))
+- `audience` (String) Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
+- `identity_provider_url` (String) IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
+
+### Nested Schema for `spec.bitbucket.allow`
+
+Optional:
+
+- `branch_name` (String) BranchName is the name of the branch on which this pipeline executed.
+- `deployment_environment_uuid` (String) DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.
+- `repository_uuid` (String) RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
+- `workspace_uuid` (String) WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
+
+
+
+### Nested Schema for `spec.bound_keypair`
+
+Optional:
+
+- `onboarding` (Attributes) Onboarding contains parameters related to initial onboarding and keypair registration. (see [below for nested schema](#nested-schema-for-specbound_keypaironboarding))
+- `recovery` (Attributes) Recovery contains parameters related to recovery after identity expiration. (see [below for nested schema](#nested-schema-for-specbound_keypairrecovery))
+- `rotate_after` (String) RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.
+
+### Nested Schema for `spec.bound_keypair.onboarding`
+
+Optional:
+
+- `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.
+- `must_register_before` (String) MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.
+- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.
+
+
+### Nested Schema for `spec.bound_keypair.recovery`
+
+Optional:
+
+- `limit` (Number) Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.
+- `mode` (String) Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.
+
+
+
+### Nested Schema for `spec.circleci`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speccircleciallow))
+- `organization_id` (String)
+
+### Nested Schema for `spec.circleci.allow`
+
+Optional:
+
+- `context_id` (String)
+- `project_id` (String)
+
+
+
+### Nested Schema for `spec.env0`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specenv0allow))
+
+### Nested Schema for `spec.env0.allow`
+
+Optional:
+
+- `deployer_email` (String) DeployerEmail is the email of the person that triggered the deployment, corresponding to `deployerEmail` in an Env0 OIDC token.
+- `deployment_type` (String) DeploymentType is the env0 deployment type, such as "deploy", "destroy", etc. Corresponds to `deploymentType` in an Env0 OIDC token.
+- `env0_tag` (String) Env0Tag is a custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.
+- `environment_id` (String) EnvironmentID is the unique identifier of the Env0 environment, corresponding to `environmentId` in an Env0 OIDC token.
+- `environment_name` (String) EnvironmentName is the name of the Env0 environment, corresponding to `environmentName` in an Env0 OIDC token.
+- `organization_id` (String) OrganizationID is the unique organization identifier, corresponding to `organizationId` in an Env0 OIDC token.
+- `project_id` (String) ProjectID is a unique project identifier, corresponding to `projectId` in an Env0 OIDC token.
+- `project_name` (String) ProjectName is the name of the project under which the job was run corresponding to `projectName` in an Env0 OIDC token.
+- `template_id` (String) TemplateID is the unique identifier of the Env0 template, corresponding to `templateId` in an Env0 OIDC token.
+- `template_name` (String) TemplateName is the name of the Env0 template, corresponding to `templateName` in an Env0 OIDC token.
+- `workspace_name` (String) WorkspaceName is the name of the Env0 workspace, corresponding to `workspaceName` in an Env0 OIDC token.
+
+
+
+### Nested Schema for `spec.gcp`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgcpallow))
+
+### Nested Schema for `spec.gcp.allow`
+
+Optional:
+
+- `locations` (List of String) Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").
+- `project_ids` (List of String) ProjectIDs is a list of project IDs (e.g. `<example-id-123456>`).
+- `service_accounts` (List of String) ServiceAccounts is a list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).
+
+
+
+### Nested Schema for `spec.github`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgithuballow))
+- `enterprise_server_host` (String) EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host.  This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.
+- `enterprise_slug` (String) EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE.  This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified.  See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.
+- `static_jwks` (String) StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.
+
+### Nested Schema for `spec.github.allow`
+
+Optional:
+
+- `actor` (String) The personal account that initiated the workflow run.
+- `environment` (String) The name of the environment used by the job.
+- `ref` (String) The git ref that triggered the workflow run.
+- `ref_type` (String) The type of ref, for example: "branch".
+- `repository` (String) The repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport`
+- `repository_owner` (String) The name of the organization in which the repository is stored.
+- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run.
+- `workflow` (String) The name of the workflow.
+
+
+
+### Nested Schema for `spec.gitlab`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgitlaballow))
+- `domain` (String) Domain is the domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.
+- `static_jwks` (String) StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.
+
+### Nested Schema for `spec.gitlab.allow`
+
+Optional:
+
+- `ci_config_ref_uri` (String) CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
+- `ci_config_sha` (String) CIConfigSHA is the git commit SHA for the ci_config_ref_uri.
+- `deployment_tier` (String) DeploymentTier is the deployment tier of the environment the job specifies
+- `environment` (String) Environment limits access by the environment the job deploys to (if one is associated)
+- `environment_protected` (Boolean) EnvironmentProtected is true if the Git ref is protected, false otherwise.
+- `namespace_path` (String) NamespacePath is used to limit access to jobs in a group or user's projects. Example: `mygroup`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `pipeline_source` (String) PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`
+- `project_path` (String) ProjectPath is used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `project_visibility` (String) ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.
+- `ref` (String) Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type.  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `ref_protected` (Boolean) RefProtected is true if the Git ref is protected, false otherwise.
+- `ref_type` (String) RefType allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`
+- `sub` (String) Sub roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `user_email` (String) UserEmail is the email of the user executing the job
+- `user_id` (String) UserID is the ID of the user executing the job
+- `user_login` (String) UserLogin is the username of the user executing the job
+
+
+
+### Nested Schema for `spec.kubernetes`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speckubernetesallow))
+- `oidc` (Attributes) OIDCConfig configures the `oidc` type. (see [below for nested schema](#nested-schema-for-speckubernetesoidc))
+- `static_jwks` (Attributes) StaticJWKS is the configuration specific to the `static_jwks` type. (see [below for nested schema](#nested-schema-for-speckubernetesstatic_jwks))
+- `type` (String) Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults to `in_cluster`.
+
+### Nested Schema for `spec.kubernetes.allow`
+
+Optional:
+
+- `service_account` (String) ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".
+
+
+### Nested Schema for `spec.kubernetes.oidc`
+
+Optional:
+
+- `insecure_allow_http_issuer` (Boolean) InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.
+- `issuer` (String) Issuer is the URI of the OIDC issuer. It must have an accessible and OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should be a valid URL and must exactly match the `issuer` field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...
+
+
+### Nested Schema for `spec.kubernetes.static_jwks`
+
+Optional:
+
+- `jwks` (String) JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.
+
+
+
+### Nested Schema for `spec.oracle`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specoracleallow))
+
+### Nested Schema for `spec.oracle.allow`
+
+Optional:
+
+- `instances` (List of String) Instances is a list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.
+- `parent_compartments` (List of String) ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.
+- `regions` (List of String) Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.
+- `tenancy` (String) Tenancy is the OCID of the instance's tenancy. Required.
+
+
+
+### Nested Schema for `spec.spacelift`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specspaceliftallow))
+- `enable_glob_matching` (Boolean) EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.
+- `hostname` (String) Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`
+
+### Nested Schema for `spec.spacelift.allow`
+
+Optional:
+
+- `caller_id` (String) CallerID is the ID of the caller, ie. the stack or module that generated the run.  This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+- `caller_type` (String) CallerType is the type of the caller, ie. the entity that owns the run - either `stack` or `module`.
+- `scope` (String) Scope is the scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
+- `space_id` (String) SpaceID is the ID of the space in which the run that owns the token was executed.  This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.
+
+
+
+### Nested Schema for `spec.terraform_cloud`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specterraform_cloudallow))
+- `audience` (String) Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the variable is set to match the cluster name, it does not need to be set here.
+- `hostname` (String) Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be `app.terraform.io`. Otherwise, it must both match the `iss` (issuer) field included in JWTs, and provide standard JWKS endpoints.
+
+### Nested Schema for `spec.terraform_cloud.allow`
+
+Optional:
+
+- `organization_id` (String) OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.
+- `organization_name` (String) OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.
+- `project_id` (String) ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.
+- `project_name` (String) ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.
+- `run_phase` (String) RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
+- `workspace_id` (String) WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
+- `workspace_name` (String) WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
+
+
+
+### Nested Schema for `spec.tpm`
+
+Optional:
+
+- `allow` (Attributes List) Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining. (see [below for nested schema](#nested-schema-for-spectpmallow))
+- `ekcert_allowed_cas` (List of String) EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.
+
+### Nested Schema for `spec.tpm.allow`
+
+Optional:
+
+- `description` (String) Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"
+- `ek_certificate_serial` (String) EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4
+- `ek_public_hash` (String) EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6
+
+
+
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+- `name` (String, Sensitive) Name is an object name
+
+
+### Nested Schema for `status`
+
+Optional:
+
+- `bound_keypair` (Attributes) BoundKeypair contains status information related to bound_keypair type tokens. (see [below for nested schema](#nested-schema-for-statusbound_keypair))
+
+### Nested Schema for `status.bound_keypair`
+
+Optional:
+
+- `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any.
+- `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format.
+- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated.
+- `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join.
+- `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`.
+- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/resources.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/resources.mdx
new file mode 100644
index 0000000000000..c11704e2c0046
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/resources.mdx
@@ -0,0 +1,45 @@
+---
+title: "Terraform resources index"
+description: "Index of all the datasources supported by the Teleport Terraform Provider"
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+{/*
+    This file will be renamed data-sources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+The Teleport Terraform provider supports the following resources:
+
+  - [`teleport_access_list`](./access_list.mdx)
+  - [`teleport_access_list_member`](./access_list_member.mdx)
+  - [`teleport_access_monitoring_rule`](./access_monitoring_rule.mdx)
+  - [`teleport_app`](./app.mdx)
+  - [`teleport_auth_preference`](./auth_preference.mdx)
+  - [`teleport_autoupdate_config`](./autoupdate_config.mdx)
+  - [`teleport_autoupdate_version`](./autoupdate_version.mdx)
+  - [`teleport_bot`](./bot.mdx)
+  - [`teleport_cluster_maintenance_config`](./cluster_maintenance_config.mdx)
+  - [`teleport_cluster_networking_config`](./cluster_networking_config.mdx)
+  - [`teleport_database`](./database.mdx)
+  - [`teleport_discovery_config`](./discovery_config.mdx)
+  - [`teleport_dynamic_windows_desktop`](./dynamic_windows_desktop.mdx)
+  - [`teleport_github_connector`](./github_connector.mdx)
+  - [`teleport_health_check_config`](./health_check_config.mdx)
+  - [`teleport_installer`](./installer.mdx)
+  - [`teleport_integration`](./integration.mdx)
+  - [`teleport_login_rule`](./login_rule.mdx)
+  - [`teleport_oidc_connector`](./oidc_connector.mdx)
+  - [`teleport_okta_import_rule`](./okta_import_rule.mdx)
+  - [`teleport_provision_token`](./provision_token.mdx)
+  - [`teleport_role`](./role.mdx)
+  - [`teleport_saml_connector`](./saml_connector.mdx)
+  - [`teleport_server`](./server.mdx)
+  - [`teleport_session_recording_config`](./session_recording_config.mdx)
+  - [`teleport_static_host_user`](./static_host_user.mdx)
+  - [`teleport_trusted_cluster`](./trusted_cluster.mdx)
+  - [`teleport_trusted_device`](./trusted_device.mdx)
+  - [`teleport_user`](./user.mdx)
+  - [`teleport_workload_identity`](./workload_identity.mdx)
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/role.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/role.mdx
new file mode 100644
index 0000000000000..2aea4f386198f
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/role.mdx
@@ -0,0 +1,618 @@
+---
+title: Reference for the teleport_role Terraform resource
+sidebar_label: role
+description: This page describes the supported values of the teleport_role resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_role resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport Role resource
+
+resource "teleport_role" "example" {
+  version = "v8"
+  metadata = {
+    name        = "example"
+    description = "Example Teleport Role"
+    expires     = "2022-10-12T07:20:51Z"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    options = {
+      forward_agent   = false
+      max_session_ttl = "7m"
+      ssh_port_forwarding = {
+        remote = {
+          enabled = false
+        }
+
+        local = {
+          enabled = false
+        }
+      }
+      client_idle_timeout     = "1h"
+      disconnect_expired_cert = true
+      permit_x11_forwarding   = false
+      request_access          = "optional"
+    }
+
+    allow = {
+      logins = ["example"]
+
+      rules = [{
+        resources = ["user", "role"]
+        verbs     = ["list"]
+      }]
+
+      request = {
+        roles = ["example"]
+        claims_to_roles = [{
+          claim = "example"
+          value = "example"
+          roles = ["example"]
+        }]
+      }
+
+      node_labels = {
+        example = ["yes"]
+      }
+    }
+
+    deny = {
+      logins = ["anonymous"]
+    }
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a role specification (see [below for nested schema](#nested-schema-for-spec))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `allow` (Attributes) Allow is the set of conditions evaluated to grant access. (see [below for nested schema](#nested-schema-for-specallow))
+- `deny` (Attributes) Deny is the set of conditions evaluated to deny access. Deny takes priority over allow. (see [below for nested schema](#nested-schema-for-specdeny))
+- `options` (Attributes) Options is for OpenSSH options like agent forwarding. (see [below for nested schema](#nested-schema-for-specoptions))
+
+### Nested Schema for `spec.allow`
+
+Optional:
+
+- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specallowaccount_assignments))
+- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
+- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
+- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
+- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
+- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
+- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
+- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
+- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
+- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
+- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specallowdb_permissions))
+- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
+- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
+- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
+- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
+- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
+- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
+- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specallowgithub_permissions))
+- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
+- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
+- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
+- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
+- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specallowimpersonate))
+- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specallowjoin_sessions))
+- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
+- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
+- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specallowkubernetes_resources))
+- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
+- `logins` (List of String) Logins is a list of *nix system logins.
+- `mcp` (Attributes) MCPPermissions defines MCP servers related permissions. (see [below for nested schema](#nested-schema-for-specallowmcp))
+- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
+- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
+- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specallowrequest))
+- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specallowrequire_session_join))
+- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specallowreview_requests))
+- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specallowrules))
+- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specallowspiffe))
+- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
+- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
+- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
+- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
+- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
+
+### Nested Schema for `spec.allow.account_assignments`
+
+Optional:
+
+- `account` (String)
+- `permission_set` (String)
+
+
+### Nested Schema for `spec.allow.db_permissions`
+
+Optional:
+
+- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
+- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
+
+
+### Nested Schema for `spec.allow.github_permissions`
+
+Optional:
+
+- `orgs` (List of String)
+
+
+### Nested Schema for `spec.allow.impersonate`
+
+Optional:
+
+- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
+- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.allow.join_sessions`
+
+Optional:
+
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
+- `name` (String) Name is the name of the policy.
+- `roles` (List of String) Roles is a list of roles that you can join the session of.
+
+
+### Nested Schema for `spec.allow.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
+- `kind` (String) Kind specifies the Kubernetes Resource type.
+- `name` (String) Name is the resource name. It supports wildcards.
+- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
+- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
+
+
+### Nested Schema for `spec.allow.mcp`
+
+Optional:
+
+- `tools` (List of String) Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.
+
+
+### Nested Schema for `spec.allow.request`
+
+Optional:
+
+- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowrequestclaims_to_roles))
+- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specallowrequestkubernetes_resources))
+- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
+- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specallowrequestreason))
+- `roles` (List of String) Roles is the name of roles which will match the request rule.
+- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
+- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
+- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specallowrequestthresholds))
+
+### Nested Schema for `spec.allow.request.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.allow.request.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
+- `kind` (String) kind specifies the Kubernetes Resource type.
+
+
+### Nested Schema for `spec.allow.request.reason`
+
+Optional:
+
+- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
+- `prompt` (String) Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.
+
+
+### Nested Schema for `spec.allow.request.thresholds`
+
+Optional:
+
+- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
+- `deny` (Number) Deny is the number of denials needed for state-transition.
+- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
+- `name` (String) Name is the optional human-readable name of the threshold.
+
+
+
+### Nested Schema for `spec.allow.require_session_join`
+
+Optional:
+
+- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
+- `filter` (String) Filter is a predicate that determines what users count towards this policy.
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
+- `name` (String) Name is the name of the policy.
+- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
+
+
+### Nested Schema for `spec.allow.review_requests`
+
+Optional:
+
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowreview_requestsclaims_to_roles))
+- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
+- `roles` (List of String) Roles is the name of roles which may be reviewed.
+- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
+
+### Nested Schema for `spec.allow.review_requests.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+
+### Nested Schema for `spec.allow.rules`
+
+Optional:
+
+- `actions` (List of String) Actions specifies optional actions taken when this rule matches
+- `resources` (List of String) Resources is a list of resources
+- `verbs` (List of String) Verbs is a list of verbs
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.allow.spiffe`
+
+Optional:
+
+- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
+- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
+- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
+
+
+
+### Nested Schema for `spec.deny`
+
+Optional:
+
+- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specdenyaccount_assignments))
+- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
+- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
+- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
+- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
+- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
+- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
+- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
+- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
+- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
+- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specdenydb_permissions))
+- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
+- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
+- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
+- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
+- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
+- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
+- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specdenygithub_permissions))
+- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
+- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
+- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
+- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
+- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specdenyimpersonate))
+- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specdenyjoin_sessions))
+- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
+- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
+- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
+- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specdenykubernetes_resources))
+- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
+- `logins` (List of String) Logins is a list of *nix system logins.
+- `mcp` (Attributes) MCPPermissions defines MCP servers related permissions. (see [below for nested schema](#nested-schema-for-specdenymcp))
+- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
+- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
+- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specdenyrequest))
+- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specdenyrequire_session_join))
+- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specdenyreview_requests))
+- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specdenyrules))
+- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specdenyspiffe))
+- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
+- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
+- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
+- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
+- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
+
+### Nested Schema for `spec.deny.account_assignments`
+
+Optional:
+
+- `account` (String)
+- `permission_set` (String)
+
+
+### Nested Schema for `spec.deny.db_permissions`
+
+Optional:
+
+- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
+- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
+
+
+### Nested Schema for `spec.deny.github_permissions`
+
+Optional:
+
+- `orgs` (List of String)
+
+
+### Nested Schema for `spec.deny.impersonate`
+
+Optional:
+
+- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
+- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.deny.join_sessions`
+
+Optional:
+
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
+- `name` (String) Name is the name of the policy.
+- `roles` (List of String) Roles is a list of roles that you can join the session of.
+
+
+### Nested Schema for `spec.deny.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
+- `kind` (String) Kind specifies the Kubernetes Resource type.
+- `name` (String) Name is the resource name. It supports wildcards.
+- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
+- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
+
+
+### Nested Schema for `spec.deny.mcp`
+
+Optional:
+
+- `tools` (List of String) Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.
+
+
+### Nested Schema for `spec.deny.request`
+
+Optional:
+
+- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyrequestclaims_to_roles))
+- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specdenyrequestkubernetes_resources))
+- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
+- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specdenyrequestreason))
+- `roles` (List of String) Roles is the name of roles which will match the request rule.
+- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
+- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
+- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specdenyrequestthresholds))
+
+### Nested Schema for `spec.deny.request.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+### Nested Schema for `spec.deny.request.kubernetes_resources`
+
+Optional:
+
+- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
+- `kind` (String) kind specifies the Kubernetes Resource type.
+
+
+### Nested Schema for `spec.deny.request.reason`
+
+Optional:
+
+- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
+- `prompt` (String) Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.
+
+
+### Nested Schema for `spec.deny.request.thresholds`
+
+Optional:
+
+- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
+- `deny` (Number) Deny is the number of denials needed for state-transition.
+- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
+- `name` (String) Name is the optional human-readable name of the threshold.
+
+
+
+### Nested Schema for `spec.deny.require_session_join`
+
+Optional:
+
+- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
+- `filter` (String) Filter is a predicate that determines what users count towards this policy.
+- `kinds` (List of String) Kinds are the session kinds this policy applies to.
+- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
+- `name` (String) Name is the name of the policy.
+- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
+
+
+### Nested Schema for `spec.deny.review_requests`
+
+Optional:
+
+- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyreview_requestsclaims_to_roles))
+- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
+- `roles` (List of String) Roles is the name of roles which may be reviewed.
+- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
+
+### Nested Schema for `spec.deny.review_requests.claims_to_roles`
+
+Optional:
+
+- `claim` (String) Claim is a claim name.
+- `roles` (List of String) Roles is a list of static teleport roles to match.
+- `value` (String) Value is a claim value to match.
+
+
+
+### Nested Schema for `spec.deny.rules`
+
+Optional:
+
+- `actions` (List of String) Actions specifies optional actions taken when this rule matches
+- `resources` (List of String) Resources is a list of resources
+- `verbs` (List of String) Verbs is a list of verbs
+- `where` (String) Where specifies optional advanced matcher
+
+
+### Nested Schema for `spec.deny.spiffe`
+
+Optional:
+
+- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
+- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
+- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
+
+
+
+### Nested Schema for `spec.options`
+
+Optional:
+
+- `cert_extensions` (Attributes List) CertExtensions specifies the key/values (see [below for nested schema](#nested-schema-for-specoptionscert_extensions))
+- `cert_format` (String) CertificateFormat defines the format of the user certificate to allow compatibility with older versions of OpenSSH.
+- `client_idle_timeout` (String) ClientIdleTimeout sets disconnect clients on idle timeout behavior, if set to 0 means do not disconnect, otherwise is set to the idle duration.
+- `create_db_user` (Boolean) CreateDatabaseUser enabled automatic database user creation.
+- `create_db_user_mode` (Number) CreateDatabaseUserMode allows users to be automatically created on a database when not set to off. 0 is "unspecified", 1 is "off", 2 is "keep", 3 is "best_effort_drop".
+- `create_desktop_user` (Boolean) CreateDesktopUser allows users to be automatically created on a Windows desktop
+- `create_host_user` (Boolean) Deprecated: use CreateHostUserMode instead.
+- `create_host_user_default_shell` (String) CreateHostUserDefaultShell is used to configure the default shell for newly provisioned host users.
+- `create_host_user_mode` (Number) CreateHostUserMode allows users to be automatically created on a host when not set to off. 0 is "unspecified"; 1 is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; 4 is "insecure-drop".
+- `desktop_clipboard` (Boolean) DesktopClipboard indicates whether clipboard sharing is allowed between the user's workstation and the remote desktop. It defaults to true unless explicitly set to false.
+- `desktop_directory_sharing` (Boolean) DesktopDirectorySharing indicates whether directory sharing is allowed between the user's workstation and the remote desktop. It defaults to false unless explicitly set to true.
+- `device_trust_mode` (String) DeviceTrustMode is the device authorization mode used for the resources associated with the role. See DeviceTrust.Mode.
+- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert sets disconnect clients on expired certificates.
+- `enhanced_recording` (List of String) BPF defines what events to record for the BPF-based session recorder.
+- `forward_agent` (Boolean) ForwardAgent is SSH agent forwarding.
+- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specoptionsidp))
+- `lock` (String) Lock specifies the locking mode (strict|best_effort) to be applied with the role.
+- `max_connections` (Number) MaxConnections defines the maximum number of concurrent connections a user may hold.
+- `max_kubernetes_connections` (Number) MaxKubernetesConnections defines the maximum number of concurrent Kubernetes sessions a user may hold.
+- `max_session_ttl` (String) MaxSessionTTL defines how long a SSH session can last for.
+- `max_sessions` (Number) MaxSessions defines the maximum number of concurrent sessions per connection.
+- `mfa_verification_interval` (String) MFAVerificationInterval optionally defines the maximum duration that can elapse between successive MFA verifications. This variable is used to ensure that users are periodically prompted to verify their identity, enhancing security by preventing prolonged sessions without re-authentication when using tsh proxy * derivatives. It's only effective if the session requires MFA. If not set, defaults to `max_session_ttl`.
+- `permit_x11_forwarding` (Boolean) PermitX11Forwarding authorizes use of X11 forwarding.
+- `pin_source_ip` (Boolean) PinSourceIP forces the same client IP for certificate generation and usage
+- `port_forwarding` (Boolean) Deprecated: Use SSHPortForwarding instead
+- `record_session` (Attributes) RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false. (see [below for nested schema](#nested-schema-for-specoptionsrecord_session))
+- `request_access` (String) RequestAccess defines the request strategy (optional|reason|always) where optional is the default.
+- `request_prompt` (String) RequestPrompt is an optional message which tells users what they aught to request.
+- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
+- `ssh_file_copy` (Boolean) SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to true unless explicitly set to false.
+- `ssh_port_forwarding` (Attributes) SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwarding))
+
+### Nested Schema for `spec.options.cert_extensions`
+
+Optional:
+
+- `mode` (Number) Mode is the type of extension to be used -- currently critical-option is not supported. 0 is "extension".
+- `name` (String) Name specifies the key to be used in the cert extension.
+- `type` (Number) Type represents the certificate type being extended, only ssh is supported at this time. 0 is "ssh".
+- `value` (String) Value specifies the value to be used in the cert extension.
+
+
+### Nested Schema for `spec.options.idp`
+
+Optional:
+
+- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specoptionsidpsaml))
+
+### Nested Schema for `spec.options.idp.saml`
+
+Optional:
+
+- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
+
+
+
+### Nested Schema for `spec.options.record_session`
+
+Optional:
+
+- `default` (String) Default indicates the default value for the services.
+- `desktop` (Boolean) Desktop indicates whether desktop sessions should be recorded. It defaults to true unless explicitly set to false.
+- `ssh` (String) SSH indicates the session mode used on SSH sessions.
+
+
+### Nested Schema for `spec.options.ssh_port_forwarding`
+
+Optional:
+
+- `local` (Attributes) Allow local port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardinglocal))
+- `remote` (Attributes) Allow remote port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardingremote))
+
+### Nested Schema for `spec.options.ssh_port_forwarding.local`
+
+Optional:
+
+- `enabled` (Boolean)
+
+
+### Nested Schema for `spec.options.ssh_port_forwarding.remote`
+
+Optional:
+
+- `enabled` (Boolean)
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/saml_connector.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/saml_connector.mdx
new file mode 100644
index 0000000000000..1cf42043bde1a
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/saml_connector.mdx
@@ -0,0 +1,162 @@
+---
+title: Reference for the teleport_saml_connector Terraform resource
+sidebar_label: saml_connector
+description: This page describes the supported values of the teleport_saml_connector resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_saml_connector resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport SAML connector
+# 
+# Please note that the SAML connector will work in Teleport Enterprise only.
+
+resource "teleport_saml_connector" "example" {
+  version = "v2"
+  # This block will tell Terraform to never update private key from our side if a keys are managed 
+  # from an outside of Terraform.
+
+  # lifecycle {
+  #   ignore_changes = [
+  #     spec[0].signing_key_pair[0].cert,
+  #     spec[0].signing_key_pair[0].private_key,
+  #     spec[0].assertion_key_pair[0].cert,
+  #     spec[0].assertion_key_pair[0].private_key,
+  #   ]
+  # }
+
+  # This section tells Terraform that role example must be created before the SAML connector
+  depends_on = [
+    teleport_role.example
+  ]
+
+  metadata = {
+    name = "example"
+  }
+
+  spec = {
+    attributes_to_roles = [{
+      name  = "groups"
+      roles = ["example"]
+      value = "okta-admin"
+      },
+      {
+        name  = "groups"
+        roles = ["example"]
+        value = "okta-dev"
+    }]
+
+    acs               = "https://localhost:3025/v1/webapi/saml/acs"
+    entity_descriptor = ""
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `spec` (Attributes) Spec is an SAML connector specification. (see [below for nested schema](#nested-schema-for-spec))
+- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
+
+### Nested Schema for `spec`
+
+Required:
+
+- `acs` (String) AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).
+- `attributes_to_roles` (Attributes List) AttributesToRoles is a list of mappings of attribute statements to roles. (see [below for nested schema](#nested-schema-for-specattributes_to_roles))
+
+Optional:
+
+- `allow_idp_initiated` (Boolean) AllowIDPInitiated is a flag that indicates if the connector can be used for IdP-initiated logins.
+- `assertion_key_pair` (Attributes) EncryptionKeyPair is a key pair used for decrypting SAML assertions. (see [below for nested schema](#nested-schema-for-specassertion_key_pair))
+- `audience` (String) Audience uniquely identifies our service provider.
+- `cert` (String, Sensitive) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
+- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
+- `display` (String) Display controls how this connector is displayed.
+- `entity_descriptor` (String, Sensitive) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.
+- `entity_descriptor_url` (String) EntityDescriptorURL is a URL that supplies a configuration XML.
+- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO.
+- `include_subject` (Boolean) IncludeSubject is a flag that indicates whether the Subject element is included in the SAML authentication request. Defaults to false. Note: Some IdPs will reject requests that contain a Subject.
+- `issuer` (String) Issuer is the identity provider issuer.
+- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
+- `preferred_request_binding` (String) PreferredRequestBinding is a preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.
+- `provider` (String) Provider is the external identity provider.
+- `service_provider_issuer` (String) ServiceProviderIssuer is the issuer of the service provider (Teleport).
+- `signing_key_pair` (Attributes) SigningKeyPair is an x509 key pair used to sign AuthnRequest. (see [below for nested schema](#nested-schema-for-specsigning_key_pair))
+- `single_logout_url` (String) SingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.
+- `sso` (String) SSO is the URL of the identity provider's SSO service.
+- `user_matchers` (List of String) UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.
+
+### Nested Schema for `spec.attributes_to_roles`
+
+Optional:
+
+- `name` (String) Name is an attribute statement name.
+- `roles` (List of String) Roles is a list of static teleport roles to map to.
+- `value` (String) Value is an attribute statement value to match.
+
+
+### Nested Schema for `spec.assertion_key_pair`
+
+Optional:
+
+- `cert` (String) Cert is a PEM-encoded x509 certificate.
+- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
+
+
+### Nested Schema for `spec.client_redirect_settings`
+
+Optional:
+
+- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
+- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
+
+
+### Nested Schema for `spec.mfa`
+
+Optional:
+
+- `cert` (String) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
+- `enabled` (Boolean) Enabled specified whether this SAML connector supports MFA checks. Defaults to false.
+- `entity_descriptor` (String) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements. Usually set from EntityDescriptorUrl.
+- `entity_descriptor_url` (String) EntityDescriptorUrl is a URL that supplies a configuration XML.
+- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced for MFA checks. UNSPECIFIED is treated as YES to always re-authentication for MFA checks. This should only be set to NO if the IdP is setup to perform MFA checks on top of active user sessions.
+- `issuer` (String) Issuer is the identity provider issuer. Usually set from EntityDescriptor.
+- `sso` (String) SSO is the URL of the identity provider's SSO service. Usually set from EntityDescriptor.
+
+
+### Nested Schema for `spec.signing_key_pair`
+
+Optional:
+
+- `cert` (String) Cert is a PEM-encoded x509 certificate.
+- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
+
+
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) Name is an object name
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/server.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/server.mdx
similarity index 95%
rename from docs/pages/reference/terraform-provider/resources/server.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/server.mdx
index 73da11cd75fa5..3732281462d6e 100644
--- a/docs/pages/reference/terraform-provider/resources/server.mdx
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/server.mdx
@@ -71,6 +71,7 @@ resource "teleport_server" "ssh_agentless_eice" {
 ### Optional
 
 - `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `scope` (String) The advertized scope of the server which can not change once assigned.
 - `spec` (Attributes) Spec is a server spec (see [below for nested schema](#nested-schema-for-spec))
 
 ### Nested Schema for `metadata`
@@ -94,6 +95,8 @@ Optional:
 - `peer_addr` (String) PeerAddr is the address a proxy server is reachable at by its peer proxies.
 - `proxy_ids` (List of String) ProxyIDs is a list of proxy IDs this server is expected to be connected to.
 - `public_addrs` (List of String) PublicAddrs is a list of public addresses where this server can be reached.
+- `relay_group` (String) the name of the Relay group that the server is connected to
+- `relay_ids` (List of String) the list of Relay host IDs that the server is connected to
 - `rotation` (Attributes) Rotation specifies server rotation (see [below for nested schema](#nested-schema-for-specrotation))
 - `use_tunnel` (Boolean) UseTunnel indicates that connections to this server should occur over a reverse tunnel.
 - `version` (String) TeleportVersion is the teleport version that the server is running on
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/session_recording_config.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/session_recording_config.mdx
new file mode 100644
index 0000000000000..d525ec2724c18
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/session_recording_config.mdx
@@ -0,0 +1,111 @@
+---
+title: Reference for the teleport_session_recording_config Terraform resource
+sidebar_label: session_recording_config
+description: This page describes the supported values of the teleport_session_recording_config resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_session_recording_config resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Teleport session recording config
+
+resource "teleport_session_recording_config" "example" {
+  version = "v2"
+  metadata = {
+    description = "Session recording config"
+    labels = {
+      "example"             = "yes"
+      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
+    }
+  }
+
+  spec = {
+    proxy_checks_host_keys = true
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Spec is a SessionRecordingConfig specification (see [below for nested schema](#nested-schema-for-spec))
+- `status` (Attributes) Status is the SessionRecordingConfig status containing active encryption keys (see [below for nested schema](#nested-schema-for-status))
+- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `description` (String) Description is object description
+- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) Labels is a set of labels
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `encryption` (Attributes) Encryption configures if and how session recordings should be encrypted. (see [below for nested schema](#nested-schema-for-specencryption))
+- `mode` (String) Mode controls where (or if) the session is recorded.
+- `proxy_checks_host_keys` (Boolean) ProxyChecksHostKeys is used to control if the proxy will check host keys when in recording mode.
+
+### Nested Schema for `spec.encryption`
+
+Optional:
+
+- `enabled` (Boolean) Enabled controls whether or not session recordings should be encrypted.
+- `manual_key_management` (Attributes) ManualKeyManagement defines whether or not recording encryption keys should be managed externally and how to query those keys. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_management))
+
+### Nested Schema for `spec.encryption.manual_key_management`
+
+Optional:
+
+- `active_keys` (Attributes List) ActiveKeys describe which keys should be queried for active recording encryption and replay. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_managementactive_keys))
+- `enabled` (Boolean) Enabled controls whether or recording encryption keys should be managed externally.
+- `rotated_keys` (Attributes List) RotatedKeys describe which keys should be queried for historical replay. (see [below for nested schema](#nested-schema-for-specencryptionmanual_key_managementrotated_keys))
+
+### Nested Schema for `spec.encryption.manual_key_management.active_keys`
+
+Optional:
+
+- `label` (String) Label is a value that can be used with the related keystore in order to find relevant keys.
+- `type` (String) Type represents which keystore should be searched when looking up keys by label.
+
+
+### Nested Schema for `spec.encryption.manual_key_management.rotated_keys`
+
+Optional:
+
+- `label` (String) Label is a value that can be used with the related keystore in order to find relevant keys.
+- `type` (String) Type represents which keystore should be searched when looking up keys by label.
+
+
+
+
+
+### Nested Schema for `status`
+
+Optional:
+
+- `encryption_keys` (Attributes List) EncryptionKeys contain the currently active age encryption keys used for encrypted session recording. (see [below for nested schema](#nested-schema-for-statusencryption_keys))
+
+### Nested Schema for `status.encryption_keys`
+
+Optional:
+
+- `public_key` (String) A PKIX ASN.1 DER encoded public key used for key wrapping during age encryption. Expected to be RSA 4096.
diff --git a/docs/pages/reference/terraform-provider/resources/static_host_user.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/static_host_user.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/static_host_user.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/static_host_user.mdx
diff --git a/docs/pages/reference/terraform-provider/resources/trusted_cluster.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/trusted_cluster.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/trusted_cluster.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/trusted_cluster.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/trusted_device.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/trusted_device.mdx
new file mode 100644
index 0000000000000..30b369350f4d8
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/trusted_device.mdx
@@ -0,0 +1,67 @@
+---
+title: Reference for the teleport_trusted_device Terraform resource
+sidebar_label: trusted_device
+description: This page describes the supported values of the teleport_trusted_device resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_trusted_device resource of the Teleport Terraform provider.
+
+
+
+
+## Example Usage
+
+```hcl
+# Trusted device resource
+
+resource "teleport_trusted_device" "TESTDEVICE1" {
+  version = "v1"
+  spec = {
+    asset_tag = "TESTDEVICE1"
+    os_type   = "macos"
+  }
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
+
+### Optional
+
+- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) Specification of the device. (see [below for nested schema](#nested-schema-for-spec))
+
+### Nested Schema for `metadata`
+
+Optional:
+
+- `labels` (Map of String) Labels is a set of labels
+- `name` (String) Name is an object name
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `asset_tag` (String)
+- `os_type` (String)
+
+Optional:
+
+- `enroll_status` (String)
+- `owner` (String)
+- `source` (Attributes) (see [below for nested schema](#nested-schema-for-specsource))
+
+### Nested Schema for `spec.source`
+
+Optional:
+
+- `name` (String)
+- `origin` (String)
diff --git a/docs/pages/reference/terraform-provider/resources/user.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/user.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/user.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/user.mdx
diff --git a/docs/pages/reference/terraform-provider/resources/workload_identity.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/workload_identity.mdx
similarity index 100%
rename from docs/pages/reference/terraform-provider/resources/workload_identity.mdx
rename to docs/pages/reference/infrastructure-as-code/terraform-provider/resources/workload_identity.mdx
diff --git a/docs/pages/reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx b/docs/pages/reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx
new file mode 100644
index 0000000000000..133ab0f63ae3d
--- /dev/null
+++ b/docs/pages/reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx
@@ -0,0 +1,197 @@
+---
+title: "Teleport Terraform Provider Reference"
+sidebar_label: Terraform Provider
+description: Reference documentation of the Teleport Terraform provider.
+tags:
+ - infrastructure-as-code
+ - reference
+ - platform-wide
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+The Teleport Terraform provider allows Terraform users to configure Teleport
+from Terraform.
+
+This section is the Teleport Terraform Provider reference.
+It lists all the supported resources and their fields.
+
+<Admonition type="tip">
+To get started with the Terraform provider, you must start with [the installation
+guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
+Once you got a working provider, we recommend you to follow the
+["Managing users and roles with IaC"](../../../zero-trust-access/infrastructure-as-code/managing-resources/user-and-role.mdx) guide.
+</Admonition>
+
+The provider exposes Teleport resources both as Terraform data-sources and Terraform resources.
+Data-sources are used by Terraform to fetch information from Teleport, while resources are used
+to create resources in Teleport.
+
+{/* Note: the awkward `resource-index` file names are here because `data-sources`
+is reserved by the generator for the catch-all resource template */}
+
+- [list of supported resources](./resources/resources.mdx)
+- [list of supported data-sources](./data-sources/data-sources.mdx)
+
+## Example Usage
+
+<Tabs>
+<TabItem label="self-hosted">
+
+```hcl
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> (=teleport.major_version=).0"
+    }
+  }
+}
+
+provider "teleport" {
+  # Update addr to point to Teleport Auth/Proxy
+  # addr              = "auth.example.com:3025"
+  addr               = "proxy.example.com:443"
+  identity_file_path = "terraform-identity/identity"
+}
+```
+
+</TabItem>
+<TabItem label="cloud">
+
+```hcl
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> (=cloud.major_version=).0"
+    }
+  }
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Enterprise (managed) tenant URL's host:port
+  addr               = "mytenant.teleport.sh:443"
+  identity_file_path = "terraform-identity/identity"
+}
+```
+
+</TabItem>
+</Tabs>
+
+## Connection methods
+
+This section lists the different ways of passing credentials to the Terraform provider.
+You can find which method fits your use case in
+the [Teleport Terraform provider setup
+page](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+
+### With an identity file
+
+With this connection method, you must provide an identity file.This file allows Terraform to connect both via the Proxy
+Service (ports 443 or 3080) and via the Auth Service (port 3025). This is the recommended way of passing credentials to
+the Terraform provider.
+
+The identity file can be obtained via several ways:
+
+### Obtaining an identity file locally with `tctl`
+
+Since 16.2, you can use `tctl` and your local credentials to create a temporary bot and load its identity
+in your shell's environment variables:
+
+```code
+$ eval "$(tctl terraform env)"
+🔑 Detecting if MFA is required
+This is an admin-level action and requires MFA to complete
+Tap any security key
+Detected security key tap
+⚙️ Creating temporary bot "tctl-terraform-env-82ab1a2e" and its token
+🤖 Using the temporary bot to obtain certificates
+🚀 Certificates obtained, you can now use Terraform in this terminal for 1h0m0s
+```
+
+You can find more information in
+the ["Run the Terraform provider locally" guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/local.mdx)
+
+#### Obtaining an identity file via `tbot`
+
+`tbot` relies on [Machine & Workload Identity](../../../machine-workload-identity/machine-workload-identity.mdx) to obtain and automatically renew
+short-lived credentials. Such credentials are harder to exfiltrate, and you can control more precisely who has access to
+which roles (e.g. you can allow only GitHub Actions pipelines targeting the `prod` environment to get certificates).
+
+You can follow [the Terraform Provider
+guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx) to setup `tbot`
+and have Terraform use its identity.
+
+#### Obtaining an identity file via `tctl auth sign`
+
+You can obtain an identity file with the command
+
+```code
+$ tctl auth sign --user terraform --format file -o identity.pem
+```
+
+This auth method has the following limitations:
+- Such credentials are high-privileged and long-lived. They must be protected and rotated.
+- This auth method does not work against Teleport clusters with MFA set to `webauthn`.
+  On such clusters, Teleport will reject any long-lived certificate and require
+  [an additional MFA challenge for administrative
+  actions](../../../zero-trust-access/authentication/mfa-for-admin-actions.mdx).
+
+### With a token (native Machine & Workload Identity)
+
+Starting with 16.2, the Teleport Terraform provider can natively use Machine & Workload Identity (without `tbot`) to join a Teleport
+cluster. The Terraform Provider will rely on its runtime (AWS, GCP, Kubernetes, CI/CD system) to prove its identity to
+Teleport.
+
+You can use any [delegated join method](../../deployment/join-methods.mdx#delegated-join-methods) by setting
+both `join_method` and `join_token` in the provider configuration.
+
+This setup is described in more details in
+the ["Run the Teleport Terraform provider in CI or Cloud" guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx).
+
+### With key, certificate, and CA certificate
+
+With this connection method, you must provide a TLS key, a TLS certificate, and the Teleport Auth Service TLS CA certificates.
+Those can be obtained with the command:
+
+```code
+$ tctl auth sign --user terraform --format=tls -o terraform.pem
+```
+
+This auth method has the following limitations:
+- The provider can only connect to the Auth directly (port 3025). On most clusters, only the proxy is publicly exposed.
+- Such credentials are high-privileged and long-lived. They must be protected and rotated.
+- This auth method does not work against Teleport clusters with MFA set to `webauthn`.
+  On such clusters, Teleport will reject any long-lived certificate and require
+  [an additional MFA challenge for administrative
+  actions](../../../zero-trust-access/authentication/mfa-for-admin-actions.mdx).
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Optional
+
+- `addr` (String) host:port of the Teleport address. This can be the Teleport Proxy Service address (port 443 or 4080) or the Teleport Auth Service address (port 3025). This can also be set with the environment variable `TF_TELEPORT_ADDR`.
+- `audience_tag` (String) Name of the optional audience tag used for native Machine ID joining with the `terraform` method. This can also be set with the environment variable `TF_TELEPORT_JOIN_AUDIENCE_TAG`.
+- `cert_base64` (String) Base64 encoded TLS auth certificate. This can also be set with the environment variable `TF_TELEPORT_CERT_BASE64`.
+- `cert_path` (String) Path to Teleport auth certificate file. This can also be set with the environment variable `TF_TELEPORT_CERT`.
+- `dial_timeout_duration` (String) DialTimeout sets timeout when trying to connect to the server. This can also be set with the environment variable `TF_TELEPORT_DIAL_TIMEOUT_DURATION`.
+- `gitlab_id_token_env_var` (String) Environment variable used to fetch the ID token issued by GitLab for the `gitlab` join method. If unset, this defaults to `TBOT_GITLAB_JWT`. This can also be set with the environment variable `TF_TELEPORT_GITLAB_ID_TOKEN_ENV_VAR`.
+- `identity_file` (String, Sensitive) Teleport identity file content. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE`.
+- `identity_file_base64` (String, Sensitive) Teleport identity file content base64 encoded. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE_BASE64`.
+- `identity_file_path` (String) Teleport identity file path. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE_PATH`.
+- `insecure` (Boolean) Skip proxy certificate verification when joining the Teleport cluster. This is not recommended for production use. This can also be set with the environment variable `TF_TELEPORT_INSECURE`.
+- `join_method` (String) Enables the native Terraform MachineID support. When set, Terraform uses MachineID to securely join the Teleport cluster and obtain credentials. See [the join method reference](../../deployment/join-methods.mdx) for possible values. You must use [a delegated join method](../../deployment/join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `TF_TELEPORT_JOIN_METHOD`.
+- `join_token` (String) Name of the token used for the native MachineID joining. This value is not sensitive for [delegated join methods](../../deployment/join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `TF_TELEPORT_JOIN_TOKEN`.
+- `key_base64` (String, Sensitive) Base64 encoded TLS auth key. This can also be set with the environment variable `TF_TELEPORT_KEY_BASE64`.
+- `key_path` (String) Path to Teleport auth key file. This can also be set with the environment variable `TF_TELEPORT_KEY`.
+- `profile_dir` (String) Teleport profile path. This can also be set with the environment variable `TF_TELEPORT_PROFILE_PATH`.
+- `profile_name` (String) Teleport profile name. This can also be set with the environment variable `TF_TELEPORT_PROFILE_NAME`.
+- `retry_base_duration` (String) Retry algorithm when the API returns 'not found': base duration between retries (https://pkg.go.dev/time#ParseDuration). This can also be set with the environment variable `TF_TELEPORT_RETRY_BASE_DURATION`.
+- `retry_cap_duration` (String) Retry algorithm when the API returns 'not found': max duration between retries (https://pkg.go.dev/time#ParseDuration). This can also be set with the environment variable `TF_TELEPORT_RETRY_CAP_DURATION`.
+- `retry_max_tries` (String) Retry algorithm when the API returns 'not found': max tries. This can also be set with the environment variable `TF_TELEPORT_RETRY_MAX_TRIES`.
+- `root_ca_base64` (String) Base64 encoded Root CA. This can also be set with the environment variable `TF_TELEPORT_CA_BASE64`.
+- `root_ca_path` (String) Path to Teleport Root CA. This can also be set with the environment variable `TF_TELEPORT_ROOT_CA`.
+
diff --git a/docs/pages/reference/join-methods.mdx b/docs/pages/reference/join-methods.mdx
deleted file mode 100644
index ce36690d36447..0000000000000
--- a/docs/pages/reference/join-methods.mdx
+++ /dev/null
@@ -1,492 +0,0 @@
----
-title: Join Methods and Tokens
-h1: Join Methods and Token Reference
-description: Describes the different ways to configure a Teleport to join a cluster.
-keywords: [join, joining, token]
-tocDepth: 3
----
-
-This guide explains the core concepts behind the Teleport joining process,
-references all support join methods and classifies them based on their
-security properties. This guide does not explain step-by-step how to
-join an instance with each join method, but links to the relevant How-To
-guides when possible.
-
-<Admonition type="note" title="Prerequisite">
-You must be familiar with the [Teleport Core concepts](../core-concepts.mdx)
-before reading this page.
-</Admonition>
-
-## Definitions
-
-### Joining
-
-Joining a Teleport cluster is the act of establishing trust between a new
-Teleport instance and all the existing instances already part of the Teleport
-cluster. At the end of the joining process, the Auth Service signs certificates
-for the joining instance. Those certificates represent the trust that was
-established. With them, the newly-joined instance can interact with the
-other Teleport instances.
-
-To request its certificates, an instance must prove its identity to the Auth Service.
-Teleport offers multiple ways for a joining instance to prove its authenticity, they
-are called the join methods.
-
-The joining process only happens when a Teleport service doesn't have valid
-certificates. Once the token is exchanged for certificates, those
-certificates are used on all subsequent attempts to connect. In most cases,
-this happens during the first startup.
-
-### Join methods
-
-A join method is a way for the Auth Service to validate that an instance requesting to
-join the Teleport cluster is legitimate. Some join methods are universal while
-others rely on the joining instance context. For example cloud-provider
-join-methods (such as `iam`, `gcp` or `azure`) or CI-provider (such as `github`,
-`gitlab`, `circleci`) are more flexible and provide
-better security guarantees but require the joining instance to run in a specific
-cloud-provider.
-
-Different join methods may provide different security guarantees. e.g. some
-join methods allow the joining instance to request renewable certificates while other
-will require the instance to join again to renew its certificate.
-
-The join method and its parameters are specified in the token resource.
-
-### Token
-
-A Token is a Teleport resource that specifies which join method can be used in
-which context. For example, a token can allow SSH services to join with the
-`iam` join method if they are in the AWS account `333333333333` and can assume
-the role `teleport-instance-role`:
-
-```yaml
-kind: token
-version: v2
-metadata:
-  name: my-iam-token
-spec:
-  roles: [Node]
-  join_method: iam
-  allow:
-  - aws_account: "333333333333"
-    aws_arn: "arn:aws:sts::333333333333:assumed-role/teleport-instance-role/i-*"
-```
-
-<Admonition type="important">
-The token name may, or may not be sensitive depending on the join method.
-Secret-based join methods rely on the token name to be secret. In such
-cases the token name must be protected as knowing the token name in enough
-for an instance to join the cluster.
-</Admonition>
-
-## Classification of join methods
-
-### Secret vs delegated
-
-#### Secret-based join methods
-
-Secret-based join methods are universal: Teleport service can use a secret-based
-join method regardless of the platform/cloud provider it runs on. The joining instance
-sends the secret and the Auth Service validates that it matches the one it
-knows. Those joining methods are inherently prone to secret exfiltration and
-the delegated join methods should be preferred when available. If you have
-to use a secret-based join method, it is recommended to use short-lived tokens
-(valid only 1 hour for example) to reduce the risk of the token leaking.
-
-Secret-based join methods are:
-- [ephemeral `token`](#ephemeral-tokens)
-- [static `token`](#static-tokens)
-
-<Admonition type="warning">
-Teleport supports static tokens for backward compatibility, their use should be avoided.
-</Admonition>
-
-#### Delegated join methods
-
-Delegated join methods rely on the context of the joining instance and a third party to
-establish trust. The third party can be a cloud provider, a CI platform or the
-container runtime. Those methods cannot be used for every instance (e.g. joining an SSH
-agent from a Raspberry Pi is not possible) but should be preferred when possible.
-
-Delegated join methods might also offer more granularity. For example, cloud-provider
-based join methods can allow instances to join based on their Availability Zone,
-service account, or cloud account ID.
-
-Delegated join methods are:
-- [`azure`](#azure-managed-identity-azure)
-- [`azure_devops`](#azure-devops-azure_devops)
-- [`bitbucket`](#bitbucket-pipelines-bitbucket)
-- [`circleci`](#circleci-circleci)
-- [`ec2`](#aws-ec2-identity-document-ec2)
-- [`gcp`](#gcp-service-account-gcp)
-- [`github`](#github-actions-github)
-- [`gitlab`](#gitlab-gitlab)
-- [`iam`](#aws-iam-role-iam)
-- [`kubernetes`](#kubernetes-kubernetes)
-- [`oracle`](#oracle-cloud-oracle)
-- [`spacelift`](#spacelift-spacelift)
-- [`terraform_cloud`](#terraform-cloud-terraform_cloud)
-- [`tpm`](#trusted-platform-module-tpm)
-
-### Renewable vs non-renewable
-
-Depending on the join method used, the Auth Service might issue renewable
-or non-renewable certificates.
-
-When the certificate is about to expire, instances with renewable certificates can
-request a new one without having to use a token again. Typically, secret-based join methods
-provide renewable certificates because the secret token is sensitive and typically
-short-lived. With a single join, the instance can stay part of the cluster indefinitely.
-
-Renewable join-methods are:
-- [ephemeral `token`](#ephemeral-tokens)
-- [static `token`](#static-tokens)
-- [`ec2`](#aws-ec2-identity-document-ec2)
-
-Nodes with non-renewable certificates must join again in order to get a new
-certificate before expiry. The instance will have to prove again that it is legitimate.
-The non-renewable join methods guarantee that an attacker stealing the instance
-certificates will not be able to maintain access to the Teleport cluster.
-Those join methods can be considered more secure and more appropriate for
-temporary workloads such as CI/CD pipelines or containerized environments.
-
-Non-renewable join methods are:
-- [`iam`](#aws-iam-role-iam)
-- [`azure`](#azure-managed-identity-azure)
-- [`azure_devops`](#azure-devops-azure_devops)
-- [`gcp`](#gcp-service-account-gcp)
-- [`github`](#github-actions-github)
-- [`circleci`](#circleci-circleci)
-- [`gitlab`](#gitlab-gitlab)
-- [`kubernetes`](#kubernetes-kubernetes)
-- [`tpm`](#trusted-platform-module-tpm)
-
-## Token resource reference
-
-The token resource has the following common fields for all join methods:
-
-```yaml
-# token.yaml
-kind: token
-version: v2
-metadata:
-  name: my-token-name
-spec:
-  # System roles describe what services the joining Teleport instance can run.
-  # Those roles are written on the instance certificate. If you want to change
-  # them (e.g. add Application access to an SSH Node), you need to:
-  # - edit the token to update the roles (e.g. add "App")
-  # - un-register the Teleport instance
-  # - modify its configuration to enable the new service (here "app_service.enabled")
-  # - have the instance join again
-  #
-  # You should use the minimal set of system roles required.
-  # Common roles are:
-  # - "Node" for SSH Service
-  # - "Proxy" for Proxy Service
-  # - "Kube" for Kubernetes Service
-  # - "App" for Application Service
-  # - "Db" for Database Service
-  # - "WindowsDesktop" for Windows Desktop Service
-  # - "Discovery" for Discovery Service
-  # - "Bot" for MachineID (when set, "spec.bot_name" must be set in the token)
-  roles:
-    - Node
-    - App
-  join_method: gcp
-  # Only set bot name when the token is used for MachineID.
-  # When set, the token must have the "Bot" role as well.
-  bot_name: my-bot
-  # SuggestedLabels is a set of labels that resources should set when using this
-  # token to enroll themselves in the cluster.
-  # Currently, only node-join scripts create a configuration according to the suggestion.
-  suggested_labels:
-    teams: ["sales-eng", "eng", "qa"]
-    application: ["demo-product"]
-  # SuggestedAgentMatcherLabels is a set of labels to be used by discovery agents to match on resources.
-  # When an agent uses this token, the agent should monitor resources that match those labels.
-  # For databases, this means adding the labels to `db_service.resources.labels`.
-  # Currently, only node-join scripts create a configuration according to the suggestion.
-  suggested_agent_matcher_labels:
-    teams: ["sales-eng"]
-```
-
-## Join methods
-
-### Static tokens
-
-<Admonition type="danger">
-This join method is inherently less secure because long-lived tokens can be stolen and reused.
-Relying on it significantly reduces the security benefits of using Teleport. Its usage is strongly discouraged.
-You should use [ephemeral tokens](#ephemeral-tokens) instead.
-</Admonition>
-
-Static tokens are tokens defined in the Auth Service configuration (`teleport.yaml`).
-The token name must be kept secret as knowing it allows to join instances to
-the Teleport cluster.
-
-```yaml
-auth_service:
-    enabled: true
-    # Pre-defined tokens for adding new instances to a cluster. Each token specifies
-    # the role a new node will be allowed to assume. The more secure way to
-    # add instances is to use `tctl nodes add --ttl` command to generate auto-expiring
-    # tokens.
-    #
-    # We recommend to use tools like `pwgen` to generate sufficiently random
-    # tokens of 32+ byte length.
-    tokens:
-        - "proxy,node:xxxxx"
-        - "auth:yyyy"
-        - "discovery,app,db:zzzzz"
-```
-
-### Ephemeral tokens
-
-Ephemeral tokens are secret tokens created dynamically via the CLI or Teleport API.
-They are time-bound and are typically created just before joining an instance to
-the Teleport cluster.
-
-They can be created by the CLI (a strong random value is picked when not specified, default TTL is 30 minutes):
-```code
-$ tctl tokens add --type discovery,app --ttl 15m
-```
-
-Or as Teleport resources:
-
-(!docs/pages/includes/provision-token/ephemeral-spec.mdx!)
-
-When a MachineID bot uses an ephemeral join token, the token is deleted.
-
-<Admonition type="note" title="See Also">
-- How to [Join Services with a Secure Token](../enroll-resources/agents/join-token.mdx).
-- [Deploying Machine ID on Linux](../enroll-resources/machine-id/deployment/linux.mdx)
-</Admonition>
-
-### AWS IAM role: `iam`
-
-The IAM join method is available to any Teleport process running anywhere with access to IAM credentials,
-such as an EC2 instance with an attached IAM role. No specific permissions or IAM policy is required: an
-IAM role with no attached policies is sufficient. No IAM credentials are required on the Teleport Auth Service.
-
-This is the recommended method to join workload running on AWS.
-
-(!docs/pages/includes/provision-token/iam-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Joining Services via AWS IAM Role](../enroll-resources/agents/aws-iam.mdx).
-- [Deploying Machine ID on AWS](../enroll-resources/machine-id/deployment/aws.mdx)
-</Admonition>
-
-### AWS EC2 identity document: `ec2`
-
-The EC2 join method is available to any Teleport process running on an EC2
-instance. Only one Teleport process per EC2 instance may use the EC2 join
-method.
-
-IAM credentials with `ec2:DescribeInstances` permissions are required on your
-Teleport Auth Service. No IAM credentials are required on the Teleport processes
-joining the cluster.
-
-<Admonition type="warning">
-
-The EC2 join method is not available in Teleport Enterprise Cloud and Teleport
-Team. Teleport Enterprise Cloud and Team customers can use the [IAM join
-method](#aws-iam-role-iam) or [ephemeral secret tokens](#ephemeral-tokens).
-
-</Admonition>
-
-(!docs/pages/includes/provision-token/ec2-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-[Joining Services via AWS EC2 Identity Document](../enroll-resources/agents/aws-ec2.mdx).
-</Admonition>
-
-### Azure managed identity: `azure`
-
-The Azure join method is available to any Teleport process running in an
-Azure Virtual Machine. Support for joining a cluster with the Proxy Service
-behind a layer 7 load balancer or reverse proxy is available in Teleport 13.0+.
-
-(!docs/pages/includes/provision-token/azure-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Joining Services via Azure Managed Identity](../enroll-resources/agents/azure.mdx).
-- [Deploying Machine ID on Azure](../enroll-resources/machine-id/deployment/azure.mdx)
-</Admonition>
-
-### Azure Devops: `azure_devops`
-
-The Azure DevOps is available to any Teleport process running in an Azure DevOps
-pipeline. This join method is typically used with
-[Machine & Workload Identity](../enroll-resources/machine-id/introduction.mdx)
-to access Teleport-protected resources in Azure DevOps pipelines without the
-use of long-lived secrets.
-
-(!docs/pages/includes/provision-token/azure-devops-spec.mdx!)
-
-### GCP service account: `gcp`
-
-The GCP join method is available to any Teleport process running on a GCP VM.
-The VM must have a
-[service account](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
-assigned to it (the default service account is fine). No IAM roles are required
-on the Teleport process joining the cluster.
-
-(!docs/pages/includes/provision-token/gcp-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- How to [Join Services with GCP](../enroll-resources/agents/gcp.mdx).
-- [Deploying Machine ID on GCP](../enroll-resources/machine-id/deployment/gcp.mdx)
-</Admonition>
-
-### GitHub Actions: `github`
-
-Teleport supports secure joining on both GitHub-hosted and self-hosted GitHub
-Actions runners as well as GitHub Enterprise Server. This join method is
-typically used with [Machine ID](../enroll-resources/machine-id/introduction.mdx) to access
-Teleport-protected resources in GitHub Actions pipelines.
-
-(!docs/pages/includes/provision-token/github-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on GitHub Actions](../enroll-resources/machine-id/deployment/github-actions.mdx)
-</Admonition>
-
-### CircleCI: `circleci`
-
-This join method is typically used with [Machine ID](../enroll-resources/machine-id/introduction.mdx)
-to access Teleport-protected resources in Circle CI pipelines.
-
-(!docs/pages/includes/provision-token/circleci-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on Circle CI](../enroll-resources/machine-id/deployment/circleci.mdx)
-</Admonition>
-
-### GitLab: `gitlab`
-
-Teleport supports secure joining on both cloud-hosted and self-hosted GitLab
-instances. **The minimum supported GitLab version is 15.7**.
-
-This join method is typically used with [MachineID](../enroll-resources/machine-id/introduction.mdx)
-to access Teleport-protected resources in Gitlab CI pipelines.
-
-(!docs/pages/includes/provision-token/gitlab-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on GitLab CI](../enroll-resources/machine-id/deployment/gitlab.mdx)
-</Admonition>
-
-### Kubernetes: `kubernetes`
-
-The Kubernetes join methods exists in two variants:
-- [in-cluster](#kubernetes-in-cluster)
-- [JWKS](#kubernetes-jwks)
-
-#### Kubernetes In-cluster
-
-Kubernetes in-cluster joining is available for any Teleport process running
-in the same Kubernetes cluster than the Auth Service. It uses the Kubernetes
-ServiceAccount tokens to validate the pod identity. The method relies on the
-[Kubernetes TokenReview API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-review-v1/)
-which is typically only reachable from within the Kubernetes cluster. Because of
-this limitation, this join method is only available for self-hosted Teleport
-clusters in Kubernetes.
-
-This method should be preferred when available as tokens are revoked as soon as
-the pod enters the `Terminated` state.
-
-(!docs/pages/includes/provision-token/kubernetes-in-cluster-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Joining Services via Kubernetes ServiceAccount Token](../enroll-resources/agents/kubernetes.mdx)
-</Admonition>
-
-#### Kubernetes JWKS
-
-Kubernetes JWKS joining is available for any Teleport process running in
-Kubernetes. The Auth Service does not have to run in Kubernetes so this method
-can be used with any Teleport cluster, including Teleport Cloud.
-This join method works by exporting the public Kubernetes signing keys and using
-them to validate Kubernetes SA token signatures. The signature validation can be
-performed by an Auth Service without access to the Kubernetes.
-
-The Kubernetes JWKS join method is available in Teleport 14+.
-
-(!docs/pages/includes/provision-token/kubernetes-jwks-spec.mdx!)
-
-<Admonition type="warning">
-After rotating the Kubernetes CA, you must update the Kubernetes JWKS tokens
-to contain the new Kubernetes signing keys (update the
-`spec.kubernetes.static_jwks.jwks` field).
-</Admonition>
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on Kubernetes](../enroll-resources/machine-id/deployment/kubernetes.mdx)
-</Admonition>
-
-### Trusted Platform Module: `tpm`
-
-(!docs/pages/includes/tpm-joining-background.mdx!)
-
-(!docs/pages/includes/provision-token/tpm-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on Linux: TPM](../enroll-resources/machine-id/deployment/linux-tpm.mdx)
-</Admonition>
-
-### Terraform Cloud: `terraform_cloud`
-
-This join method is used to authenticate using Terraform Cloud Workload
-Identity. It is typically used by the Teleport Terraform provider on either
-HCP Terraform or self-hosted Terraform Enterprise. It can not be used to join
-Terraform runs on other platforms and dedicated join methods should be used
-instead.
-
-<Admonition type="warning" title="Enterprise">
-Support for self-hosted Terraform Enterprise requires Teleport Enterprise.
-</Admonition>
-
-(!docs/pages/includes/provision-token/terraform-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Run the Teleport Terraform Provider on Terraform Cloud](../admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx)
-</Admonition>
-
-### Spacelift: `spacelift`
-
-This join method is used to authenticate using Spacelift. It is typically used
-by the Teleport Terraform provider on Spacelift (including self-hosted
-deployments).
-
-(!docs/pages/includes/provision-token/spacelift-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-    - [Run the Teleport Terraform Provider on Spacelift](../admin-guides/infrastructure-as-code/terraform-provider/spacelift.mdx)
-</Admonition>
-
-### Bitbucket Pipelines: `bitbucket`
-
-This join method is used to authenticate using Bitbucket's support for OpenID
-Connect, and is typically used to allow either Machine ID's `tbot` or the
-Teleport Terraform provider to authenticate to Teleport without use of shared
-secrets.
-
-(!docs/pages/includes/provision-token/bitbucket-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- [Deploying Machine ID on Bitbucket Pipelines](../enroll-resources/machine-id/deployment/bitbucket.mdx)
-</Admonition>
-
-### Oracle Cloud: `oracle`
-
-The Oracle join method is available to any Teleport process running on an Oracle
-Cloud Compute instance.
-
-(!docs/pages/includes/provision-token/oracle-spec.mdx!)
-
-<Admonition type="note" title="See Also">
-- How to [Join Services with Oracle Cloud](../enroll-resources/agents/oracle.mdx).
-</Admonition>
diff --git a/docs/pages/reference/machine-id/configuration.mdx b/docs/pages/reference/machine-id/configuration.mdx
deleted file mode 100644
index a641ec8c76876..0000000000000
--- a/docs/pages/reference/machine-id/configuration.mdx
+++ /dev/null
@@ -1,1309 +0,0 @@
----
-title: Machine ID Configuration Reference
-description: Configuration reference for Teleport Machine ID.
-tocDepth: 4
----
-
-This reference documents the various options that can be configured in the `tbot`
-configuration file. This configuration file offers more control than
-configuring `tbot` using CLI parameters alone.
-
-To run `tbot` with a configuration file, specify the path with the `-c` flag:
-
-```code
-$ tbot start -c ./tbot.yaml
-```
-
-In this reference, the term **artifact** refers an item that `tbot` writes to a
-destination as part of the process of generating an output. Examples of
-artifacts include configuration files, certificates, and cryptographic key
-material. Usually, artifacts are files, but this term is explicitly avoided
-because a destination isn't required to be a filesystem.
-
-From Teleport 14, `tbot` supports the v2 configuration version.
-
-```yaml
-# version specifies the version of the configuration file in use. `v2` is the
-# most recent and should be used for all new bots. The rest of this example
-# is in the `v2` schema.
-version: v2
-
-# debug enables verbose logging to stderr. If unspecified, this defaults to
-# false.
-debug: true
-
-# auth_server specifies the address of the Auth Service instance that `tbot` should connect
-# to. You should prefer specifying `proxy_server` to specify the Proxy Service
-# address.
-auth_server: "teleport.example.com:3025"
-
-# proxy_server specifies the address of the Teleport Proxy Service that `tbot` should
-# connect to.
-# It is recommended to use the address of your Teleport Proxy Service, or, if using
-# Teleport Cloud, the address of your Teleport Cloud instance.
-proxy_server: "teleport.example.com:443" # or "example.teleport.sh:443" for Teleport Cloud
-
-# credential_ttl specifies how long certificates generated by `tbot` should
-# live for. It should be a positive, numeric value with an `m` (for minutes) or
-# `h` (for hours) suffix. By default, this value is `1h`.
-# This has a maximum value of `24h`.
-#
-# It can be overridden for most outputs and services to give them a shorter TTL
-# than `tbot`'s internal certificates.
-credential_ttl: "1h"
-
-# renewal_interval specifies how often `tbot` should aim to renew the
-# outputs it has generated. It should be a positive, numeric value with an
-# `m` (for minutes) or `h` (for hours) suffix. The default value is `20m`.
-# This value must be lower than `credential_ttl`.
-# This value is ignored when using `tbot` is running in one-shot mode.
-#
-# It can be overridden for most outputs and services to give them a shorter
-# renewal interval than `tbot`'s internal certificates.
-renewal_interval: "20m"
-
-# oneshot configures `tbot` to exit immediately after generating the outputs.
-# The default value is `false`. A value of `true` is useful in ephemeral environments, like
-# CI/CD.
-oneshot: false
-
-# onboarding is a group of configuration options that control how `tbot` will
-# authenticate with the Teleport cluster.
-onboarding:
-  # token specifies which join token, configured in the Teleport cluster,
-  # should be used to join the Teleport cluster.
-  #
-  # This can also be an absolute path to a file containing the value you wish
-  # to be used.
-  # File path example:
-  # token: /var/lib/teleport/tokenjoin
-  token: "00000000000000000000000000000000"
-
-  # join_method must be the join method associated with the specified token
-  # above. This setting should match the value output when creating the bot using
-  # `tctl`.
-  #
-  # Support values include:
-  # - `token`
-  # - `azure`
-  # - `gcp`
-  # - `circleci`
-  # - `github`
-  # - `gitlab`
-  # - `iam`
-  # - `ec2`
-  # - `kubernetes`
-  # - `spacelift`
-  # - `tpm`
-  # - `terraform_cloud`
-  join_method: "token"
-
-  # ca_pins are used to validate the identity of the Teleport Auth Service on
-  # first connect. This should not be specified when using Teleport Cloud or
-  # connecting through a Teleport Proxy.
-  ca_pins:
-    - "(=presets.ca_pin=)"
-    - "(=presets.ca_pin=)"
-
-  # ca_path is used to specify where a CA file can be found that can be used to
-  # validate the identity of the Teleport Auth Service on first connect.
-  # This should not be specified when using Teleport Cloud or connecting through a
-  # Teleport Proxy. The ca_pins option should be preferred over ca_path.
-  ca_path: "/path/to/ca.pem"
-
-  # gitlab holds configuration specific to the "gitlab" join method.
-  gitlab:
-    # token_env_var_name allows the environment variable that contains the
-    # GitLab ID token to be specified. If unspecified, this defaults to
-    # "TBOT_GITLAB_JWT".
-    #
-    # Overriding this is useful when you need to use `tbot` to authenticate to
-    # multiple Teleport clusters from a single GitLab CI job.
-    token_env_var_name: "MY_GITLAB_ID_TOKEN"
-
-
-# storage specifies the destination that `tbot` should use to store its
-# internal state. This state is sensitive, and you should ensure that the
-# destination you specify here can only be accessed by `tbot`.
-#
-# If unspecified, storage is set to a directory destination with a path
-# of `/var/lib/teleport/bot`.
-#
-# See the full list of supported destinations and their configuration options
-# under the Destinations section of this reference page.
-storage:
-  type: directory
-  path: /var/lib/teleport/bot
-
-# outputs specifies what artifacts `tbot` should generate and renew when it
-# runs.
-#
-# See the full list of supported outputs and their configuration options
-# under the Outputs section of this reference page.
-outputs:
-  - type: identity
-    destination:
-      type: directory
-      path: /opt/machine-id
-
-# services specify which `tbot` sub-services should be enabled and how they
-# should be configured.
-#
-# See the full list of supported services and their configuration options
-# under the Services section of this reference page.
-services:
-  - type: example
-```
-
-If no configuration file is provided, a simple configuration is used based
-on the provided CLI flags. Given the following sample CLI from
-`tctl bots add ...`:
-
-```code
-$ tbot start \
-   --destination-dir=./tbot-user \
-   --token=00000000000000000000000000000000 \
-   --ca-pin=(=presets.ca_pin=) \
-   --proxy-server=example.teleport.sh:443
-```
-
-it uses a configuration equivalent to the following:
-
-```yaml
-proxy_server: example.teleport.sh:443
-
-onboarding:
-  join_method: "token"
-  token: "(=presets.tokens.first=)"
-  ca_pins:
-    - "(=presets.ca_pin=)"
-
-storage:
-  type: directory
-  path: /var/lib/teleport/bot
-
-outputs:
-  - type: identity
-    destination:
-      type: directory
-      path: ./tbot-user
-```
-
-## Outputs
-
-Outputs define what actions `tbot` should take when it runs. They describe
-the format of the certificates to be generated, the roles used to generate the certificates, and the
-destination where they should be written.
-
-There are multiple types of output. Select the one that is most appropriate for
-your intended use-case.
-
-### `identity`
-
-The `identity` output can be used to authenticate:
-
-- SSH access to your Teleport servers, using `tsh`, openssh and tools like
-  ansible.
-- Administrative actions against your cluster using tools like `tsh` or `tctl`.
-- Management of Teleport resources using the Teleport Terraform provider.
-- Access to the Teleport API using the Teleport Go SDK.
-
-See the [Getting Started guide](../../enroll-resources/machine-id/getting-started.mdx) to see the `identity`
-output used in context.
-
-```yaml
-# type specifies the type of the output. For the identity output, this will
-# always be `identity`.
-type: identity
-# ssh_config controls whether the identity output will attempt to generate an
-# OpenSSH configuration file. This requires that `tbot` can connect to the 
-# Teleport Proxy Service. Must be "on" or "off". If unspecified, this defaults to
-# "on".
-ssh_config: on
-# allow_reissue controls whether the certificates generated by the identity
-# output can be reissued (e.g. used with `tsh apps login`/`tsh db login`). This
-# defaults to `false` if unspecified. If you receive an error message indicating
-# that the certificate cannot be reissued, set this to `true`.
-allow_reissue: false
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `application`
-
-The `application` output is used to generate credentials that can be used to
-access applications that have been configured with Teleport.
-
-See the [Machine ID with Applications guide](../../enroll-resources/machine-id/access-guides/applications.mdx)
-to see the `application` output used in context.
-
-```yaml
-# type specifies the type of the output. For the application output, this will
-# always be `application`.
-type: application
-# app_name specifies the application name, as configured in your Teleport
-# cluster, that `tbot` should generate credentials for.
-# This field must be specified.
-app_name: grafana
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `database`
-
-The `database` output is used to generate credentials that can be used to
-access databases that have been configured with Teleport.
-
-See the [Machine ID with Databases guide](../../enroll-resources/machine-id/access-guides/databases.mdx)
-to see the `database` output used in context.
-
-```yaml
-# type specifies the type of the output. For the database output, this will
-# always be `database`.
-type: database
-# service is the name of the database server, as configured in Teleport, that
-# the output should generate credentials for. This field must be specified.
-service: my-postgres-server
-# database is the name of the specific database on the specified database
-# server to generate credentials for. This field doesn't need to be specified
-# for database types that don't support multiple individual databases.
-database: my-database
-# username is the name of the user on the specified database server to
-# generate credentials for. This field doesn't need to be specified
-# for database types that don't have users.
-username: my-user
-# format specifies the format to use for output artifacts. If
-# unspecified, a default format is used. See the table titled "Supported
-# formats" below for the full list of supported values.
-format: tls
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-#### Supported formats
-
-You can provide the following values to the `format` configuration field in
-the `database` output type:
-
-| `format`      | Description                          |
-|---------------|--------------------------------------|
-| Unspecified   | Provides a certificate in `tlscert`, a private key in `key` and the CA in `teleport-database-ca.crt`. This is compatible with most clients and databases. |
-| `mongo`       | Provides `mongo.crt` and `mongo.cas`. This is designed to be used with MongoDB clients. |
-| `cockroach`   | Provides `cockroach/node.key`, `cockroach/node.crt`, and `cockroach/ca.crt`. This is designed to be used with CockroachDB clients. |
-| `tls`         | Provides `tls.key`, `tls.crt`, and `tls.cas`. This is for generic clients that require the specific file extensions. |
-
-### `kubernetes`
-
-The `kubernetes` output is used to generate credentials that can be used to
-access Kubernetes clusters that have been configured with Teleport.
-
-It outputs a `kubeconfig.yaml` in the output destination, which can be used
-with `kubectl`.
-
-See the [Machine ID with Kubernetes Clusters guide](../../enroll-resources/machine-id/access-guides/kubernetes.mdx)
-to see the `kubernetes` output used in context.
-
-```yaml
-# type specifies the type of the output. For the kubernetes output, this will
-# always be `kubernetes`.
-type: kubernetes
-# kubernetes_cluster is the name of the Kubernetes cluster, as configured in
-# Teleport, that the output should generate credentials and a kubeconfig for.
-# This field must be specified.
-kubernetes_cluster: my-cluster
-# disable_exec_plugin disables the default behaviour of using the `tbot` binary
-# as a `kubectl` credentials exec plugin. This is useful in environments where
-# `tbot` does not exist on the system that will consume the generated kubeconfig
-# (e.g. when using the `kubernetes_secret` output type). This credentials exec
-# plugin is used to automatically refresh the credentials within a single
-# invocation of `kubectl`. Defaults to `false`.
-disable_exec_plugin: false
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `kubernetes/v2`
-
-The `kubernetes/v2` output type can be used to access many Kubernetes clusters
-as individual contexts within the same `kubeconfig.yaml`.
-
-```yaml
-type: kubernetes/v2
-
-# selectors include one or more matching Kubernetes clusters. Each match will be
-# included in the resulting `kubeconfig.yaml`, assuming the bot has permission
-# to access the cluster.
-selectors:
-  # name includes an exact match by name. Note that wildcards are not currently
-  # supported. Multiple name selectors can be specified if desired.
-  - name: foo
-  # labels include all clusters matching all of these labels. Multiple label
-  # selectors can be provided if needed.
-  - labels:
-      env: dev
-
-# The following configuration fields are available across most output types.
-# Note that `roles` are not supported for this output type.
-
-destination:
-  type: directory
-  path: /opt/machine-id
-
-# credential_ttl and renewal_interval override the credential TTL and renewal
-# interval for this specific output, so that you can make its certificates valid
-# for shorter than `tbot`'s internal certificates.
-#
-# This is particularly useful when using `tbot` in one-shot as part of a cron job
-# where you need `tbot`'s internal certificate to live long enough to be renewed
-# on the next invocation, but don't want long-lived workload certificates on-disk.
-credential_ttl: 30m
-renewal_interval: 15m
-
-# disable_exec_plugin disables the default behaviour of using the `tbot` binary
-# as a `kubectl` credentials exec plugin. This is useful in environments where
-# `tbot` does not exist on the system that will consume the generated kubeconfig
-# (e.g. when using the `kubernetes_secret` output type). This credentials exec
-# plugin is used to automatically refresh the credentials within a single
-# invocation of `kubectl`. Defaults to `false`.
-disable_exec_plugin: false
-```
-
-Each Kubernetes cluster matching a selector will result in a new context in the
-generated `kubeconfig.yaml`. This can be consumed like so:
-
-```code
-$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml --context=example.teleport.sh-foo get pods
-```
-
-The context name is `[Teleport cluster name]-[Kubernetes cluster name]`, so the
-command above runs `kubectl get pods` on the `foo` cluster.
-
-If clusters are added or removed over time, the `kubeconfig.yaml` will be
-updated at the bot's normal renewal interval. You can trigger an early renewal
-by restarting `tbot`, or signaling it with `pkill -usr1 tbot`.
-
-### `ssh_host`
-
-The `ssh_host` output is used to generate the artifacts required to configure
-an OpenSSH server with Teleport in order to allow Teleport users to connect to
-it.
-
-The output generates the following artifacts:
-- `ssh_host-cert.pub`: an SSH certificate signed by the Teleport host certificate authority.
-- `ssh_host`: the private key associated with the SSH host certificate.
-- `ssh_host-user-ca.pub`: an export of the Teleport user certificate authority in an OpenSSH compatible format.
-
-```yaml
-# type specifies the type of the output. For the ssh host output, this will
-# always be `ssh_host`.
-type: ssh_host
-# principals is the list of host names to include in the host certificates.
-# These names should match the names that clients use to connect to the host.
-principals:
-  - host.example.com
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `workload-identity-x509`
-
-The `workload-identity-x509` output is used to issue an X509 workload identity
-credential and write this to a configured destination.
-
-The output generates the following artifacts:
-
-- `svid.pem`: the X509 SVID.
-- `svid.key`: the private key associated with the X509 SVID.
-- `bundle.pem`: the X509 bundle that contains the trust domain CAs.
-
-See [Workload Identity introduction](../../enroll-resources/workload-identity/introduction.mdx)
-for more information on Workload Identity functionality.
-
-```yaml
-# type specifies the type of the output. For the X509 Workload Identity output,
-# this will always be `workload-identity-x509`.
-type: workload-identity-x509
-(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `workload-identity-jwt`
-
-The `workload-identity-jwt` output is used to issue a JWT workload identity
-credential and write this to a configured destination.
-
-The JWT workload identity credential is compatible with the [SPIFFE JWT SVID
-specification](https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md).
-
-The output generates the following artifacts:
-
-- `jwt_svid`: the JWT SVID.
-
-See [Workload Identity introduction](../../enroll-resources/workload-identity/introduction.mdx)
-for more information on Workload Identity functionality.
-
-```yaml
-# type specifies the type of the output. For the JWT Workload Identity output,
-# this will always be `workload-identity-jwt`.
-type: workload-identity-jwt
-# audiences specifies the values that should be included in the `aud` claim of
-# the JWT. Typically, this identifies the intended recipient of the JWT and
-# contains a single value.
-#
-# At least one audience value must be specified.
-audiences:
- - example.com
- - foo.example.com
-(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-### `workload-identity-aws-roles-anywhere`
-
-The `workload-identity-aws-roles-anywhere` output is used to issue an X509
-workload identity credential, exchange this for short-lived AWS credentials
-using Roles Anywhere, and write these to a configured destination.
-
-The credentials are written in the [AWS shared credentials file format](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html#file-format-creds),
-which is compatible with the AWS CLI and SDKs.
-
-The output generates the following artifacts:
-
-- `aws_credentials`: the CLI and SDK compatible AWS shared credentials file.
-
-See [Workload Identity introduction](../../enroll-resources/workload-identity/introduction.mdx)
-for more information on Workload Identity functionality.
-
-```yaml
-# type specifies the type of the output. For the Workload Identity AWS Roles
-# Anywhere output, this will always be `workload-identity-aws-roles-anywhere`.
-type: workload-identity-aws-roles-anywhere
-# The following configuration fields are available across most output types.
-
-# destination specifies where the output should write any generated artifacts
-# such as certificates and configuration files.
-#
-# See the full list of supported destinations and their configuration options
-# under the Destinations section of this reference page.
-destination:
-  type: directory
-  path: /opt/machine-id
-# role_arn is the ARN of the AWS role that the generated credentials should
-# assume.
-# Required.
-role_arn: arn:aws:iam::123456789012:role/example-role
-# profile_arn is the ARN of the AWS profile to be used during the Roles Anywhere
-# exchange.
-# Required.
-profile_arn: arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000
-# trust_anchor_arn is the ARN of the trust anchor that should be used during the
-# Roles Anywhere exchange.
-# Required.
-trust_anchor_arn: arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000
-# region is the AWS region to use for the Roles Anywhere exchange. If omitted,
-# this defaults to the region set by `AWS_REGION` environment variable or the
-# AWS configuration file.
-region: us-east-1
-# session_duration is the duration that the generated AWS credentials should be
-# valid for. This may be up to 12 hours. If omitted, this defaults to 6 hours.
-session_duration: 6h
-# session_renewal_interval is the interval at which the AWS credentials should
-# be renewed. This should be less than the session duration. If omitted, this
-# defaults to 1 hour.
-session_renewal_interval: 1h
-# credential_profile_name is the name of the profile to write to in the AWS
-# credentials file. If unspecified, this profile will be named `default`.
-credential_profile_name: my-profile
-# artifact_name is the name of the file that the AWS credentials should be
-# written to. If unspecified, this defaults to `aws_credentials`.
-artifact_name: my-credentials-file
-# overwrite_credential_file controls whether the AWS credentials file should be
-# overwritten if it already exists, or whether the profile added by tbot should
-# be merged with any existing profiles in the file. If unspecified, this
-# defaults to `false`.
-overwrite_credential_file: false
-(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
-```
-
-### `spiffe-svid`
-
-<Admonition type="warning" >
-The use of this service has been deprecated as part of the introduction of the
-new Workload Identity configuration experience. You can replace the use of this
-output with the new `workload-identity-x509` or `workload-identity-jwt` service.
-
-For further information, see [the new Workload Identity configuration experience
-and how to migrate](../workload-identity/configuration-resource-migration.mdx).
-</Admonition>
-
-The `spiffe-svid` output is used to generate a SPIFFE X509 SVID and write this
-to a configured destination.
-
-The output generates the following artifacts:
-- `svid.pem`: the X509 SVID.
-- `svid.key`: the private key associated with the X509 SVID.
-- `bundle.pem`: the X509 bundle that contains the trust domain CAs.
-
-
-An artifact will also be generated for each entry within the `jwts` list. This
-will be named according to `file_name`. This artifact will contain only the
-JWT-SVID with the audience specified in `audience`.
-
-See [Workload Identity](../../enroll-resources/workload-identity/introduction.mdx) for more information on how
-to use SPIFFE SVIDs.
-
-```yaml
-# type specifies the type of the output. For the SPIFFE SVID output, this will
-# always be `spiffe-svid`.
-type: spiffe-svid
-# svid specifies the properties of the SPIFFE SVID that should be requested.
-svid:
-  # path specifies what the path element should be requested for the SPIFFE ID.
-  path: /svc/foo
-  # sans specifies optional Subject Alternative Names (SANs) to include in the
-  # generated X509 SVID. If omitted, no SANs are included.
-  sans:
-    # dns specifies the DNS SANs. If omitted, no DNS SANs are included.
-    dns:
-      - foo.svc.example.com
-    # ip specifies the IP SANs. If omitted, no IP SANs are included.
-    ip:
-      - 10.0.0.1
-  # jwts controls the output of JWT-SVIDs. Each entry will be generated as a
-  # separate artifact. If omitted, no JWT-SVIDs are generated.
-  jwts:
-      # audience specifies the audience that the JWT-SVID should be issued for.
-      # this typically identifies the service that the JWT-SVID will be used to
-      # authenticate to.
-    - audience: https://example.com
-      # file_name specifies the name of the file that the JWT-SVID should be
-      # written to.
-      file_name: example-jwt
-
-(!docs/pages/includes/machine-id/common-output-config.yaml!)
-```
-
-## Services
-
-Services are configurable long-lived components that run within `tbot`. Unlike
-Outputs, they may not necessarily generate artifacts. Typically, services
-provide supporting functionality for machine to machine access, for example,
-opening tunnels or providing APIs.
-
-### `workload-identity-api`
-
-The `workload-identity-api` services opens a listener that provides a local
-workload identity API, intended to serve workload identity credentials
-(e.g X509/JWT SPIFFE SVIDs) to workloads running on the same host.
-
-For more information about this, see the
-[Workload Identity API and Workload Attestation reference](../workload-identity/workload-identity-api-and-workload-attestation.mdx)
-
-### `spiffe-workload-api`
-
-<Admonition type="warning" >
-The use of this service has been deprecated as part of the introduction of the
-new Workload Identity configuration experience. You can replace the use of this
-service with the new `workload-identity-api` service.
-
-For further information, see [the new Workload Identity configuration experience
-and how to migrate](../workload-identity/configuration-resource-migration.mdx).
-</Admonition>
-
-The `spiffe-workload-api` service opens a listener for a service that implements
-the SPIFFE Workload API. This service is used to provide SPIFFE SVIDs to
-workloads.
-
-See [Workload Identity](../../enroll-resources/workload-identity/introduction.mdx) for more information on the
-SPIFFE Workload API.
-
-```yaml
-# type specifies the type of the service. For the SPIFFE Workload API service,
-# this will always be `spiffe-workload-api`.
-type: spiffe-workload-api
-# listen specifies the address that the service should listen on.
-#
-# Two types of listener are supported:
-# - TCP: `tcp://<address>:<port>`
-# - Unix socket: `unix:///<path>`
-listen: unix:///opt/machine-id/workload.sock
-# attestors allows Workload Attestation to be configured for this Workload
-# API.
-attestors:
-  # docker is configuration for the Docker Workload Attestor. See the Workload
-  # Identity API & Workload Attestation reference for more information.
-  docker:
-    # enabled specifies whether the workload's identity should be attested with
-    # information about its Docker container. If unspecified, this defaults to
-    # false.
-    enabled: true
-    # addr is the address at which the Docker Engine daemon can be reached. It
-    # must be in the form `unix://path/to/socket`, as connecting via TCP is not
-    # currently supported. If unspecified, this defaults to the standard socket
-    # location for "rootful" Docker installations: `unix:///var/run/docker.sock`.
-    addr: unix:///var/run/docker.sock
-  # kubernetes is configuration for the Kubernetes Workload Attestor. See
-  # the Kubernetes Workload Attestor section for more information.
-  kubernetes:
-    # enabled specifies whether the Kubernetes Workload Attestor should be
-    # enabled. If unspecified, this defaults to false.
-    enabled: true
-    # kubelet holds configuration relevant to the Kubernetes Workload Attestors
-    # interaction with the Kubelet API.
-    kubelet:
-      # read_only_port is the port on which the Kubelet API is exposed for
-      # read-only operations. Since Kubernetes 1.16, the read-only port is
-      # typically disabled by default and secure_port should be used instead.
-      read_only_port: 10255
-      # secure_port is the port on which the attestor should connect to the
-      # Kubelet secure API. If unspecified, this defaults to `10250`. This is
-      # mutually exclusive with ReadOnlyPort.
-      secure_port: 10250
-      # token_path is the path to the token file that the Kubelet API client
-      # should use to authenticate with the Kubelet API. If unspecified, this
-      # defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-      token_path: "/var/run/secrets/kubernetes.io/serviceaccount/token"
-      # ca_path is the path to the CA file that the Kubelet API client should
-      # use to validate the Kubelet API server's certificate. If unspecified,
-      # this defaults to `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
-      ca_path: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-      # skip_verify is used to disable verification of the Kubelet API server's
-      # certificate. If unspecified, this defaults to false.
-      #
-      # If specified, the value specified in ca_path is ignored.
-      #
-      # This is useful in cases where the Kubelet API server has not been issued
-      # with a certificate signed by the Kubernetes cluster's CA. This is fairly
-      # common with a number of Kubernetes distributions.
-      skip_verify: true
-      # anonymous is used to disable authentication with the Kubelet API. If
-      # unspecified, this defaults to false. If set, the token_path field is
-      # ignored.
-      anonymous: false
-  # podman is configuration for the Podman Workload Attestor. See the Workload
-  # Identity API & Workload Attestation reference for more information.
-  podman:
-    # enabled specifies whether the workload's identity should be attested with
-    # information about its Podman container and pod. If unspecified, this
-    # defaults to false.
-    enabled: true
-    # addr is the address at which the Podman API Service can be reached. It
-    # must be in the form `unix://path/to/socket`, as connecting via TCP is not
-    # supported. This field is required and there is no default value. See the
-    # Workload Identity API & Workload Attestation reference for more information.
-    addr: unix:///run/podman/podman.sock
-  # sigstore is configuration for the Sigstore Workload attestor. See the
-  # Sigstore Workload Attestation page for more information.
-  sigstore:
-    # enabled specifies whether tbot will discover Sigstore signatures for the
-    # workload's container image. If unspecified, this defaults to false.
-    enabled: true
-    # additional_registries optionally configures the OCI registries that will
-    # be searched for signatures in addition to the workload container image's
-    # source registry.
-    additional_registries:
-      -
-        # host of the OCI registry.
-        host: ghcr.io
-    # credentials_path is the path to a Docker or Podman configuration file
-    # containing per-registry credentials.
-    credentials_path: /path/to/docker/config.json
-    # allowed_private_network_prefixes are the private IP address prefixes (CIDR
-    # blocks) that the Sigstore attestor is allowed to connect to. By default,
-    # tbot will only connect to registries at publicly-routable IP addresses to
-    # reduce the surface area for SSRF attacks.
-    allowed_private_network_prefixes:
-      - "192.168.1.42/32"
-      - "fd12:3456:789a:1::1/128"
-  # systemd is configuration for the Systemd Workload Attestor. See the Workload
-  # Identity API & Workload Attestation reference for more information.
-  systemd:
-    # enabled specifies whether the workload's identity should be attested with
-    # information about its Systemd service. If unspecified, this defaults to
-    # false.
-    enabled: true
-  # unix is configuration for the Unix Workload Attestor.
-  unix:
-    # binary_hash_max_size_bytes is the maximum number of bytes that will be
-    # read from a process' binary to calculate its SHA-256 checksum. If the
-    # binary is larger than this, the `workload.unix.binary_hash` attribute
-    # will be empty. If unspecified, this defaults to 1GiB. Set it to -1 to
-    # make it unlimited.
-    binary_hash_max_size_bytes: 1024
-# svids specifies the SPIFFE SVIDs that the Workload API should provide.
-svids:
-    # path specifies what the path element should be requested for the SPIFFE
-    # ID.
-  - path: /svc/foo
-    # hint is a free-form string which can be used to help workloads determine
-    # which SVID to select when multiple are available. If omitted, no hint is
-    # included.
-    hint: my-hint
-    # sans specifies optional Subject Alternative Names (SANs) to include in the
-    # generated X509 SVID. If omitted, no SANs are included.
-    sans:
-      # dns specifies the DNS SANs. If omitted, no DNS SANs are included.
-      dns:
-        - foo.svc.example.com
-      # ip specifies the IP SANs. If omitted, no IP SANs are included.
-      ip:
-        - 10.0.0.1
-    # rules specifies a list of workload attestation rules. At least one of
-    # these rules must be satisfied by the workload in order for it to receive
-    # this SVID.
-    #
-    # If no rules are specified, the SVID will be issued to all workloads that
-    # connect to this service.
-    rules:
-        # unix is a group of workload attestation criteria that are available
-        # when the workload is running on the same host, and is connected to
-        # the Workload API using a Unix socket.
-        #
-        # If any of the criteria in this group are specified, then workloads
-        # that do not connect using a Unix socket will not receive this SVID.
-      - unix:
-          # uid is the ID of the user that the workload process must be running
-          # as to receive this SVID.
-          #
-          # If unspecified, the UID is not checked.
-          uid: 1000
-          # pid is the ID that the workload process must have to receive this
-          # SVID.
-          #
-          # If unspecified, the PID is not checked.
-          pid: 1234
-          # gid is the ID of the primary group that the workload process must be
-          # running as to receive this SVID.
-          #
-          # If unspecified, the GID is not checked.
-          gid: 50
-```
-
-#### Envoy SDS
-
-The `spiffe-workload-api` service endpoint also implements the Envoy SDS API.
-This allows it to act as a source of certificates and certificate authorities
-for the Envoy proxy.
-
-As a forward proxy, Envoy can be used to attach an X.509 SVID to an outgoing
-connection from a workload that is not SPIFFE-enabled.
-
-As a reverse proxy, Envoy can be used to terminate mTLS connections from
-SPIFFE-enabled clients. Envoy can validate that the client has presented a valid
-X.509 SVID and perform enforcement of authorization policies based on the SPIFFE
-ID contained within the SVID.
-
-When acting as a reverse proxy for certain protocols, Envoy can be configured
-to attach a header indicating the identity of the client to a request before
-forwarding it to the service. This can then be used by the service to make
-authorization decisions based on the client's identity.
-
-When configuring Envoy to use the SDS API exposed by the `spiffe-workload-api`
-service, three additional special names can be used to aid configuration:
-
-- `default`: `tbot` will return the default SVID for the workload.
-- `ROOTCA`: `tbot` will return the trust bundle for the trust domain that the
-workload is a member of.
-- `ALL`: `tbot` will return the trust bundle for the trust domain that the
-workload is a member of, as well as the trust bundles of any trust domain
-that the trust domain is federated with.
-
-The following is an example Envoy configuration that sources a certificate
-and trust bundle from the `spiffe-workload-api` service listening on
-`unix:///opt/machine-id/workload.sock`. It requires that a connecting client
-presents a valid SPIFFE SVID and forwards this information to the backend
-service in the `x-forwarded-client-cert` header.
-
-```yaml
-node:
-  id: "my-envoy-proxy"
-  cluster: "my-cluster"
-static_resources:
-  listeners:
-    - name: test_listener
-      enable_reuse_port: false
-      address:
-        socket_address:
-          address: 0.0.0.0
-          port_value: 8080
-      filter_chains:
-        - filters:
-            - name: envoy.filters.network.http_connection_manager
-              typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
-                common_http_protocol_options:
-                  idle_timeout: 1s
-                forward_client_cert_details: sanitize_set
-                set_current_client_cert_details:
-                  uri: true
-                stat_prefix: ingress_http
-                route_config:
-                  name: local_route
-                  virtual_hosts:
-                    - name: my_service
-                      domains: ["*"]
-                      routes:
-                        - match:
-                            prefix: "/"
-                          route:
-                            cluster: my_service
-                http_filters:
-                  - name: envoy.filters.http.router
-                    typed_config:
-                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
-          transport_socket:
-            name: envoy.transport_sockets.tls
-            typed_config:
-              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
-              common_tls_context:
-                # configure the certificate that the reverse proxy should present.
-                tls_certificate_sds_secret_configs:
-                  # `name` can be replaced with the desired SPIFFE ID if  multiple
-                  # SVIDs are available.
-                  - name: "default"
-                    sds_config:
-                      resource_api_version: V3
-                      api_config_source:
-                        api_type: GRPC
-                        transport_api_version: V3
-                        grpc_services:
-                          envoy_grpc:
-                            cluster_name: tbot_agent
-                # combined validation context "melds" two validation contexts
-                # together. This is handy for extending the validation context
-                # from the SDS source.
-                combined_validation_context:
-                  default_validation_context:
-                    # You can use match_typed_subject_alt_names to configure
-                    # rules that only allow connections from specific SPIFFE IDs.
-                    match_typed_subject_alt_names: []
-                  validation_context_sds_secret_config:
-                    name: "ALL" # This can also be replaced with the trust domain name
-                    sds_config:
-                      resource_api_version: V3
-                      api_config_source:
-                        api_type: GRPC
-                        transport_api_version: V3
-                        grpc_services:
-                          envoy_grpc:
-                            cluster_name: tbot_agent
-  clusters:
-    # my_service is the example service that Envoy will forward traffic to.
-    - name: my_service
-      type: strict_dns
-      load_assignment:
-        cluster_name: my_service
-        endpoints:
-          - lb_endpoints:
-              - endpoint:
-                  address:
-                    socket_address:
-                      address: 127.0.0.1
-                      port_value: 8090
-    - name: tbot_agent
-      http2_protocol_options: {}
-      load_assignment:
-        cluster_name: tbot_agent
-        endpoints:
-          - lb_endpoints:
-              - endpoint:
-                  address:
-                    pipe:
-                      # Configure the path to the socket that `tbot` is
-                      # listening on.
-                      path: /opt/machine-id/workload.sock
-```
-
-### `database-tunnel`
-
-The `database-tunnel` service opens a listener for a service that tunnels
-connections to a database server.
-
-The tunnel authenticates connections for the client, meaning that any
-application which can connect to the listener will be able to connect to the
-database as the specified user. For this reason, we heavily recommend using the
-Unix socket listener type and configuring the permissions of the socket to
-ensure that only the intended applications can connect.
-
-```yaml
-# type specifies the type of the service. For the database tunnel service, this
-# will always be `database-tunnel`.
-type: database-tunnel
-# listen specifies the address that the service should listen on.
-#
-# Two types of listener are supported:
-# - TCP: `tcp://<address>:<port>`
-# - Unix socket: `unix:///<path>`
-listen: tcp://127.0.0.1:25432
-# service is the name of the database server, as configured in Teleport, that
-# the service should open a tunnel to.
-service: postgres-docker
-# database is the name of the specific database on the specified database
-# service.
-database: postgres
-# username is the name of the user on the specified database server to open a
-# tunnel for.
-username: postgres
-```
-
-### `application-tunnel`
-
-The `application-tunnel` service opens a listener that tunnels connections to
-an application in Teleport. It supports both HTTP and TCP applications. This is
-useful for applications which cannot be configured to use client certificates,
-when using TCP application or where using a L7 load-balancer in front of your
-Teleport proxies.
-
-The tunnel authenticates connections for the client, meaning that any
-client that connects to the listener will be able to access the application.
-For this reason, ensure that the listener is only accessible by the intended
-clients by using the Unix socket listener or binding to `127.0.0.1`.
-
-```yaml
-# type specifies the type of the service. For the application tunnel service,
-# this will always be `application-tunnel`.
-type: application-tunnel
-# listen specifies the address that the service should listen on.
-#
-# Two types of listener are supported:
-# - TCP: `tcp://<address>:<port>`
-# - Unix socket: `unix:///<path>`
-listen: tcp://127.0.0.1:8084
-# app_name is the name of the application, as configured in Teleport, that
-# the service should open a tunnel to.
-app_name: my-application
-```
-
-### `ssh-multiplexer`
-
-The `ssh-multiplexer` service opens a listener for a high-performance local
-SSH multiplexer. This is designed for use-cases which create a large number
-of SSH connections using Teleport, for example, Ansible.
-
-This differs to using `identity` output for SSH in a few ways:
-
-- The `tbot` instance running the `ssh-multiplexer` service must be running on
-  the same host as the SSH client.
-- The `ssh-multiplexer` service is designed to be a long-running background
-  service and cannot be used in one-shot mode. It must be running in order for
-  SSH connections to be established and to continue running.
-- Resource consumption is significantly reduced by multiplexing SSH connections
-  through a fewer number of upstream connections to the Teleport Proxy Service.
-
-Additionally, the `ssh-multiplexer` opens a socket that implements the SSH
-agent protocol. This allows the SSH client to authenticate without writing the
-sensitive private key to disk.
-
-By default, the `ssh-multiplexer` service outputs an `ssh_config` which uses
-`tbot` itself as the ProxyCommand. You can further reduce the resource
-consumption of SSH connections by installing and specifying the
-`fdpass-teleport` binary.
-
-```yaml
-# type specifies the type of the service. For the SSH multiplexer
-type: ssh-multiplexer
-# destination specifies where the tunnel should be opened and any artifacts
-# should be written. It must be of type `directory`.
-destination:
-  type: directory
-  path: /foo
-# enable_resumption specifies whether the multiplexer should negotiate
-# session resumption. This allows SSH connections to survive network
-# interruptions. It does increase the memory resources used per connection.
-#
-# If unspecified, this defaults to true.
-enable_resumption: true
-# proxy_command specifies the command that should be used as the ProxyCommand
-# in the generated SSH configuration.
-#
-# If unspecified, the ProxyCommand will be the currently running binary of tbot
-# itself.
-proxy_command:
-  - /usr/local/bin/fdpass-teleport
-# proxy_templates_path specifies a path to a proxy templates configuration file
-# which should be used when resolving the Teleport node to connect to. This
-# file must be accessible by the long-lived tbot process running the
-# ssh-multiplexer.
-#
-# If unspecified, proxy templates will not be used.
-proxy_templates_path: /etc/my-proxy-templates.yaml
-```
-
-Once configured, `tbot` will create the following artifacts in the specified
-destination:
-
-- `ssh_config`: an SSH configuration file that will configure OpenSSH to use
-   the multiplexer and agent.
-- `known_hosts`: the known hosts file that will be used by OpenSSH to validate
-   a server's identity.
-- `v1.sock`: the Unix socket that the multiplexer listens on.
-- `agent.sock`: the Unix socket that the SSH agent listens on.
-
-#### Using the SSH multiplexer programmatically
-
-To use the SSH multiplexer programmatically, your SSH client library will need
-to support one of two things:
-
-- The ability to use a ProxyCommand with FDPass. If so, you can use the
-  `ssh_config` file generated by `tbot` to configure the SSH client.
-- The ability to accept an open socket to use as the connection to the SSH
-  server. You will then need to manually connect to the socket and send the
-  multiplexer request.
-
-The `v1.sock` Unix Domain Socket implements the V1 Teleport SSH multiplexer
-protocol. The client must first send a short request message to indicate the
-desired target host and port, terminated with a null byte. The multiplexer will
-then begin to forward traffic to the target host and port. The client can then
-make an SSH connection.
-
-<details>
-<summary>Example in Python (Paramiko)</summary>
-```python
-import os
-import paramiko
-import socket
-
-host = "ubuntu.example.teleport.sh"
-username = "root"
-port = 3022
-directory_destination = "/opt/machine-id"
-
-# Connect to Mux Unix Domain Socket
-sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-sock.connect(os.path.join(directory_destination, "v1.sock"))
-# Send the connection request specifying the server you wish to connect to
-sock.sendall(f"{host}:{port}\x00".encode("utf-8"))
-
-# We must set the env var as Paramiko does not make this configurable...
-os.environ["SSH_AUTH_SOCK"] = os.path.join(directory_destination, "agent.sock")
-
-ssh_config = paramiko.SSHConfig()
-with open(os.path.join(directory_destination, "ssh_config")) as f:
-    ssh_config.parse(f)
-
-ssh_client = paramiko.SSHClient()
-
-# Paramiko does not support known_hosts with CAs: https://github.com/paramiko/paramiko/issues/771
-# Therefore, we must disable host key checking
-ssh_client.set_missing_host_key_policy(paramiko.WarningPolicy())
-
-ssh_client.connect(
-    hostname=host,
-    port=port,
-    username=username,
-    sock=sock
-)
-
-stdin, stdout, stderr = ssh_client.exec_command("hostname")
-print(stdout.read().decode())
-```
-</details>
-
-<details>
-<summary>Example in Go</summary>
-```go
-package main
-
-import (
-    "fmt"
-    "net"
-    "path/filepath"
-
-    "golang.org/x/crypto/ssh"
-    "golang.org/x/crypto/ssh/agent"
-    "golang.org/x/crypto/ssh/knownhosts"
-)
-
-func main() {
-    host := "ubuntu.example.teleport.sh"
-    username := "root"
-    directoryDestination := "/opt/machine-id"
-
-    // Setup Agent and Known Hosts
-    agentConn, err := net.Dial(
-        "unix", filepath.Join(directoryDestination, "agent.sock"),
-    )
-    if err != nil {
-        panic(err)
-    }
-    defer agentConn.Close()
-    agentClient := agent.NewClient(agentConn)
-    hostKeyCallback, err := knownhosts.New(
-        filepath.Join(directoryDestination, "known_hosts"),
-    )
-    if err != nil {
-        panic(err)
-    }
-
-    // Create SSH Config
-    sshConfig := &ssh.ClientConfig{
-        Auth: []ssh.AuthMethod{
-            ssh.PublicKeysCallback(agentClient.Signers),
-        },
-        User:            username,
-        HostKeyCallback: hostKeyCallback,
-    }
-
-    // Dial Unix Domain Socket and send multiplexing request
-    conn, err := net.Dial(
-        "unix", filepath.Join(directoryDestination, "v1.sock"),
-    )
-    if err != nil {
-        panic(err)
-    }
-    defer conn.Close()
-    _, err = fmt.Fprint(conn, fmt.Sprintf("%s:0\x00", host))
-    if err != nil {
-        panic(err)
-    }
-
-    sshConn, sshChan, sshReq, err := ssh.NewClientConn(
-        conn,
-        // Port here doesn't matter because Multiplexer has already established
-        // connection.
-        fmt.Sprintf("%s:22", host),
-        sshConfig,
-    )
-    if err != nil {
-        panic(err)
-    }
-    sshClient := ssh.NewClient(sshConn, sshChan, sshReq)
-    defer sshClient.Close()
-
-    sshSess, err := sshClient.NewSession()
-    if err != nil {
-        panic(err)
-    }
-    defer sshSess.Close()
-
-    out, err := sshSess.CombinedOutput("hostname")
-    if err != nil {
-        panic(err)
-    }
-    fmt.Println(string(out))
-}
-```
-</details>
-
-## Destinations
-
-A destination is somewhere that `tbot` can read and write artifacts.
-
-Destinations are used in two places in the `tbot` configuration:
-
-- Specifying where `tbot` should store its internal state.
-- Specifying where an output should write its generated artifacts.
-
-Destinations come in multiple types. Usually, the `directory` type is the most
-appropriate.
-
-### `directory`
-
-The `directory` destination type stores artifacts as files in a specified
-directory.
-
-```yaml
-# type specifies the type of the destination. For the directory destination,
-# this will always be `directory`.
-type: directory
-
-# path specifies the path to the directory that this destination should write
-# to. This directory should already exist, or `tbot init` should be used to
-# create it with the correct permissions.
-path: /opt/machine-id
-
-# symlinks configures the behaviour of symlink attack prevention.
-# Requires Linux 5.6+.
-# Supported values:
-#   * try-secure (default): Attempt to securely read and write certificates
-#     without symlinks, but fall back (with a warning) to insecure read
-#     and write if the host doesn't support this.
-#   * secure: Attempt to securely read and write certificates, with a hard error
-#     if unsupported.
-#   * insecure: Quietly allow symlinks in paths.
-symlinks: try-secure
-
-# acls configures whether Linux Access Control List (ACL) setup should occur for
-# this destination.
-# Requires Linux with a file system that supports ACLs.
-# Supported values:
-#   * try (default on Linux): Attempt to use ACLs, warn at runtime if ACLs
-#     are configured but invalid.
-#   * off (default on non-Linux): Do not attempt to use ACLs.
-#   * required: Always use ACLs, produce a hard error at runtime if ACLs
-#     are invalid.
-acls: try
-
-# readers is a list of users and groups that will be allowed by ACL to access
-# this directory output. The `acls` parameter must be either `try` or
-# `required`. File ACLs will be monitored and corrected at runtime to ensure
-# they match this configuration.
-# Individual entries may either specify `user` or `group`, but not both. `user`
-# accepts an existing named user or a UID, and `group` accepts an existing named
-# group or GID. UIDs and GIDs do not necessarily need to exist on the local
-# system.
-# An empty list of readers disables runtime ACL management.
-readers:
-- user: teleport
-- user: 123
-- group: teleport
-- group: 456
-```
-
-### `memory`
-
-The `memory` destination type stores artifacts in the process memory. When
-the process exits, nothing is persisted. This destination type
-is most suitable for ephemeral environments, but can also be used for testing.
-
-Configuration:
-
-```yaml
-# type specifies the type of the destination. For the memory destination, this
-# will always be `memory`.
-type: memory
-```
-
-### `kubernetes_secret`
-
-The `kubernetes_secret` destination type stores artifacts in a Kubernetes
-secret. This allows them to be mounted into other containers deployed in
-Kubernetes.
-
-Prerequisites:
-
-- `tbot` must be running in Kubernetes with at most one replica. If using a
-  `deployment`, then the `Recreate` strategy must be used to ensure only one
-  instance exists at any time. This is because multiple `tbot` agents configured
-  with the same secret will compete to write to the secret and it may be left
-  in an inconsistent state or the `tbot` agents may fail to write.
-- The `tbot` pod must be configured with a service account that allows it to
-  read and write from the configured secret.
-- The `POD_NAMESPACE` environment variable must be configured with the
-  name of the namespace that `tbot` is running in. This is best achieved with
-  the [Downward API](https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/).
-
-There is no requirement that the secret already exists, one will be created
-if it does not exist. If a secret already exists, `tbot` will overwrite any
-other keys within the secret.
-
-Configuration:
-
-```yaml
-# type specifies the type of the destination. For the kubernetes_secret
-# destination, this will always be `kubernetes_secret`.
-type: kubernetes_secret
-# name specifies the name of the Kubernetes Secret to write the artifacts to.
-# This must be in the same namespace that `tbot` is running in.
-name: my-secret
-```
-
-## Bot resource
-
-The `bot` resource is used to manage Machine ID Bots. It is used to configure
-the access that is granted to a Bot.
-
-(!docs/pages/includes/machine-id/bot-spec.mdx!)
-
-You can apply a file containing YAML that defines a `bot` resource using
-`tctl create -f ./bot.yaml`.
diff --git a/docs/pages/reference/machine-id/diagnostics-service.mdx b/docs/pages/reference/machine-id/diagnostics-service.mdx
deleted file mode 100644
index 23859771f51d8..0000000000000
--- a/docs/pages/reference/machine-id/diagnostics-service.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: Diagnostics Service
-description: Reference information for the `tbot` diagnostics service.
----
-
-The `tbot` process can optionally expose a diagnostics service. This is
-disabled by default, but once enabled, allows useful information about the
-running `tbot` process to be queried via HTTP.
-
-## Configuration
-
-To enable the diagnostics service, you must specify an address and port for
-it to listen on.
-
-For security reasons, you should ensure that access to this listener is
-restricted. In most cases, the most secure thing to do is to bind the listener
-to `127.0.0.1`, which will only allow access from the local machine.
-
-You can configure the diagnostics service using the `--diag-addr` CLI parameter:
-
-```code
-$ tbot start -c my-config.yaml --diag-addr 127.0.0.1:3001
-```
-
-Or directly within the configuration file using `diag_addr`:
-
-```yaml
-diag_addr: 127.0.0.1:3001
-```
-
-## Endpoints
-
-The diagnostics service exposes the following HTTP endpoints.
-
-### `/livez`
-
-The `/livez` endpoint always returns with a 200 status code. This can be used
-to determine if the `tbot` process is running and has not crashed or hung.
-
-If deploying to Kubernetes, we recommend this endpoint is used for your
-Liveness Probe.
-
-### `/readyz`
-
-The `/readyz` endpoint currently returns the same information as `/livez`.
-
-In the future, this endpoint will be expanded to indicate whether the internal
-components of `tbot` have been able to generate certificates and are ready
-to serve requests.
-
-### `/metrics`
-
-The `/metrics` endpoint returns a Prometheus-compatible metrics snapshot.
-
-The metrics provided by the Go runtime are exposed and these can be used for
-monitoring the overall health of the `tbot` process. In addition, certain
-outputs and services configured in `tbot` will produce metrics.
-
-#### `ssh-multiplexer`
-
-The SSH multiplexer service exposes metrics about the number of active SSH
-connections:
-
-- `tbot_ssh_multiplexer_requests_started_total`: the total number of SSH
-   connections that have been started.
-- `tbot_ssh_multiplexer_requests_handled_total`: the total number of SSH
-   connections that have been handled. This has a `status` label with the
-   following values: `OK` or `ERROR`.
-- `tbot_ssh_multiplexer_requests_in_flight`: the number of SSH connections
-   currently in progress.
-
-### `/debug/pprof`
-
-These endpoints allow the collection of pprof profiles for debugging purposes.
-You may be asked by a Teleport engineer to collect these if you are experiencing
-performance issues.
-
-They will only be enabled if the `-d`/`--debug` flag is provided when starting
-`tbot`. This is known as **debug mode**.
\ No newline at end of file
diff --git a/docs/pages/reference/machine-id/github-actions.mdx b/docs/pages/reference/machine-id/github-actions.mdx
deleted file mode 100644
index 86a033d56ef3e..0000000000000
--- a/docs/pages/reference/machine-id/github-actions.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: GitHub Actions
-description: Reference for GitHub Actions joining
----
-
-This document acts a reference for GitHub Actions and Machine ID. You will find
-links to in-depth guides on using GitHub Actions and a full explanation of the
-configuration options available when using the GitHub join method.
-
-## Guides
-
-You can read step-by-step guides on using Machine ID and GitHub Actions:
-
-- [Using Machine ID with GitHub Actions](../../enroll-resources/machine-id/deployment/github-actions.mdx): How to
-  use Machine ID to SSH into Teleport nodes from GitHub Actions.
-
-## GitHub join token
-
-The `token` resource sets out rules for what is allowed to join a Teleport
-cluster. Joining clients must specify which `token` they want to use, and then
-information included in their join request is compared to the rules contained
-within the token by the Auth Service to determine whether or not they should be
-admitted.
-
-The following snippet shows all available options in the `token` resource when
-used for GitHub joining with Machine ID:
-
-(!docs/pages/includes/provision-token/github-spec.mdx!)
-
-## GitHub Actions helpers
-
-We offer a series of off-the-shelf GitHub Actions to use in your workflows when
-utilizing Teleport Machine ID and GitHub Actions.
-
-More information about these individual actions can be found in their GitHub
-repositories:
-
-- [https://github.com/teleport-actions/setup](https://github.com/teleport-actions/setup)
-- [https://github.com/teleport-actions/auth](https://github.com/teleport-actions/auth)
-- [https://github.com/teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
-- [https://github.com/teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
-
-If you experience problems when using these actions, please raise an issue in
-their source repository:
-[https://github.com/teleport-actions/root](https://github.com/teleport-actions/root).
diff --git a/docs/pages/reference/machine-id/gitlab.mdx b/docs/pages/reference/machine-id/gitlab.mdx
deleted file mode 100644
index e137e6dafd9ec..0000000000000
--- a/docs/pages/reference/machine-id/gitlab.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: GitLab CI
-description: Reference for GitLab joining
----
-
-This document acts a reference for GitLab CI and Machine ID. You will find
-links to in-depth guides as well as a full description of the configuration
-options available when using the GitLab join method.
-
-## Guides
-
-You can read step-by-step guides on using Machine ID and GitLab CI:
-
-- [Using Machine ID with GitLab](../../enroll-resources/machine-id/deployment/gitlab.mdx): How to
-  use Machine ID to SSH into Teleport nodes from GitLab CI.
-
-## GitLab join token
-
-A GitLab join token contains allow rules that describe which pipelines can
-use that token in order to join the Teleport cluster. A rule can contain
-multiple fields, and any pipeline that matches all of the fields within a
-single rule is granted access.
-
-(!docs/pages/includes/provision-token/gitlab-spec.mdx!)
diff --git a/docs/pages/reference/machine-id/machine-id.mdx b/docs/pages/reference/machine-id/machine-id.mdx
deleted file mode 100644
index 69ad4cf34eb20..0000000000000
--- a/docs/pages/reference/machine-id/machine-id.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: Machine ID References
-description: Configuration and CLI reference for Teleport Machine ID.
----
-
-- [Configuration](configuration.mdx)
-- [Diagnostics Service](diagnostics-service.mdx)
-- [GitHub Actions](github-actions.mdx)
-- [GitLab CI](gitlab.mdx)
-- [CLI](../../reference/cli/tbot.mdx)
-- [Telemetry](telemetry.mdx)
-- [V16 Upgrade Guide](v16-upgrade-guide.mdx)
-- [Bot Terraform Resource](../../reference/terraform-provider/resources/bot.mdx)
diff --git a/docs/pages/reference/machine-id/v16-upgrade-guide.mdx b/docs/pages/reference/machine-id/v16-upgrade-guide.mdx
deleted file mode 100644
index 5830d5c7cb58d..0000000000000
--- a/docs/pages/reference/machine-id/v16-upgrade-guide.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Machine ID v16 Upgrade Guide
-description: Upgrade instructions for Machine ID in Teleport 16.0
----
-
-Teleport 16.0 introduces a number of changes to Machine ID. These changes may require action on your part if you use Machine ID with OpenSSH or OpenSSH-based clients (e.g. Ansible).
-
-This guide explains how to migrate your Teleport 16.0 cluster for continued Machine ID support.
-
-## Changes OpenSSH support and the `tbot proxy ssh` command
-
-When using Machine ID with an OpenSSH client, an `ssh_config` is generated and
-used to configure the OpenSSH client.
-
-Within the `ssh_config`, the `ProxyCommand` directive specifies a special
-command to be used to connect to the target host.
-
-Historically, this command would be `tbot proxy ssh`.
-
-We have now introduced a new command: `tbot ssh-proxy-command`. This has
-a number of benefits:
-
-- `tsh` is no longer required to be installed on the machine.
-- The amount of CPU and memory used during a connection is significantly reduced.
-- The time taken to establish a connection is significantly reduced.
-
-This command was introduced in a Teleport 15 release, and from Teleport 16.0
-will become used by default in the generated `ssh_config`. From Teleport 17.0,
-the `tbot proxy ssh` command will no longer be supported and will be removed.
-
-### Actions required
-
-If you are using Machine ID with OpenSSH or OpenSSH based clients, you may need
-to take action.
-
-#### Using the default `ssh_config`
-
-If you are using the default generated `ssh_config`, then no explicit action
-on your behalf should be necessary. From 16.0, the new command will be
-automatically used.
-
-We do recommend that you perform a test-run when updating to ensure that
-everything is working as expected. You can revert to the old behaviour by
-setting the `TBOT_SSH_CONFIG_PROXY_COMMAND_MODE` environment variable to
-`legacy` in the environment in which you are running `tbot`:
-
-```code
-$ export TBOT_SSH_CONFIG_PROXY_COMMAND_MODE=legacy
-$ tbot start -c config.yaml
-```
-
-#### Using a modified `ssh_config`
-
-If you have modified the `ssh_config` and therefore do not use the default
-`ssh_config` generated by `tbot`, then you will need to manually update the
-file. You must do this before 17.0, but we recommend doing this in 16.0 to
-benefit from the performance improvements.
-
-To update your modified `ssh_config`, we recommend running an instance of `tbot`
-as you would usually configure it. This will generate a new `ssh_config`.
-Carefully inspect the `ProxyCommand` directive, and copy the new command to
-your modified `ssh_config`.
-
-You can find a full list of the parameters available for the
-`tbot ssh-proxy-command` on the
-[CLI reference page](../cli/tbot.mdx).
\ No newline at end of file
diff --git a/docs/pages/reference/machine-workload-identity/bound-keypair/admin-guide.mdx b/docs/pages/reference/machine-workload-identity/bound-keypair/admin-guide.mdx
new file mode 100644
index 0000000000000..eb67b8aa1eeca
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/bound-keypair/admin-guide.mdx
@@ -0,0 +1,338 @@
+---
+title: Bound Keypair Joining Admin Guide
+description: "How to deploy and maintain bots in production with Bound Keypair Joining"
+tags:
+ - mwi
+ - conceptual
+ - infrastructure-identity
+---
+
+This guide discusses various tasks users administering bots using Bound Keypair
+Joining may need to perform over the lifespan of the bot.
+
+## Allowing additional recovery attempts
+
+When using the `standard` recovery mode, only a configured number of recovery
+attempts can be made. If the limit is reached, no further recovery attempts can
+be made until the limit is increased.
+
+To increase this limit and allow an expired bot to join again, edit the token
+using `tctl edit`:
+```code
+$ tctl edit token/example-token
+```
+
+Find the `spec.bound_keypair.recovery.limit` field and increment the limit by
+the desired amount. You are free to select any desired threshold. For example,
+consider these use cases:
+- If human intervention is desired for each join attempt you can increase this
+  value by 1. This single recovery attempt will be immediately consumed, so
+  future recoveries will again require human intervention, and may result in
+  downtime.
+
+  While this approach makes downtime likely, it does ensure a human verifies the
+  state of the bot host on each recovery.
+
+- If you want human intervention for each recovery, but want to avoid downtime,
+  you can increase this value by 2. The first attempt will be consumed
+  immediately, but the bot will have one recovery attempt for automatic future
+  use.
+
+  A human user can periodically audit the recovery count and bot host to ensure
+  a recovery attempt is always available and the host is behaving as expected.
+
+- Any larger value will increase the amount of time required between human
+  intervention. You can select your tolerance for automatic bot recoveries as
+  desired.
+
+Alternatively, if you wish to allow an unlimited number of automatic recovery
+attempts, [refer to the entry below](#allowing-unlimited-recovery-attempts) on
+the `relaxed` recovery mode.
+
+Note that the recovery limit is always relative to the recovery counter (in the
+`status.bound_keypair.recovery_count` field in the token resource). It is valid
+to decrease the limit or set it to zero, however doing so may prevent future
+bot recovery attempts until the limit is increased again.
+
+Additionally, note that [join state verification](concepts.mdx#join-state-verification)
+is still required, and will prevent multiple concurrent uses of the same keypair
+and token. In other words, increasing the recovery limit will not allow multiple
+clients to join.
+
+## Allowing unlimited recovery attempts
+
+To allow unlimited recovery attempts, the `spec.bound_keypair.recovery.mode`
+field should be set to `relaxed`. To do this, use `tctl edit` to edit the token:
+```code
+$ tctl edit token/example-token
+```
+
+Find or create the `spec.bound_keypair.recovery.mode` field and set the value to
+`relaxed`. Save the file and quit your editor to update the token.
+
+When the recovery mode is set to `relaxed`, the `limit` field is ignored and the
+`status.bound_keypair.recovery_count` field may increase beyond the written
+limit. If the mode is later changed back to `standard`, be aware that future
+recovery attempts will fail unless the `limit` is increased to accommodate the
+current value of `recovery_count`.
+
+Note that when `relaxed` mode is in use,
+[join state verification](concepts.mdx#join-state-verification) is still required and will
+prevent multiple concurrent uses of the same keypair and token. If your use case
+requires this, you can
+[disable join state verification](#disabling-join-state-verification), but doing
+so does impact the security of the token.
+
+## Requesting a keypair rotation
+
+To request a keypair rotation, set the `.spec.bound_keypair.rotate_after` field
+to contain a timestamp. On the next authentication attempt after that timestamp
+has elapsed, the bot will automatically rotate its keypair.
+
+To simplify this process, you can use the `tctl bound-keypair rotate` helper:
+```code
+$ tctl bound-keypair rotate token-name
+```
+
+This sets the timestamp to the current time. Note that by default bots only
+reauthenticate every 20 minutes, so it may take some time for the request to be
+acknowledged. You can monitor the rotation status by watching the token's
+`.status.bound_keypair.last_rotated_at` field.
+
+If you want to force an early rotation and have access to the bot host, you can
+restart the `tbot` process, or send it a signal with `pkill -usr1 tbot` to
+request an early rotation.
+
+Note that the previous 10 keypairs are retained on the client for use in case of
+a cluster rollback; refer to the
+[cluster rollback](#recovery-after-a-cluster-rollback) section for additional
+information.
+
+## Locking a `bound_keypair` bot or bot instance
+
+The simplest way to lock out a bot that joined using the `bound_keypair` join
+method is to use a join token lock target:
+
+```code
+$ tctl lock --join-token=token-name
+```
+
+As a bound keypair token is linked to a single bot, this will effectively lock
+the bot. It will not be able to reauthenticate, recover, interact with the
+Teleport API, or otherwise use its credentials until the lock is removed.
+
+Note that if a bot is locked for long enough - bots have a 1 hour certificate
+TTL by default - its certificates will expire. If you intend to remove this lock
+and reinstate the bot, you may also need to increase the recovery limit
+(`.spec.bound_keypair.recovery.limit`) to accommodate the additional recovery
+attempt.
+
+Other lock targets can also be used, but are not preferred:
+- Bot instance (`tctl lock --bot-instance-id ...`): will lock only a single
+  instance of the bot. Note that if the recovery limit allows for it, the
+  [automatic recovery process](concepts.mdx#recovery) will attempt to rejoin and, if
+  successful, will generate a new bot instance ID.
+- Bot name (`tctl lock --user bot-<name>`): will lock all bots using the same
+  bot / user. This may be overly broad and lock other instances running under
+  this bot user.
+
+## Recovering a locked `bound_keypair` bot instance
+
+Bots joined with the `bound_keypair` join method can become automatically locked
+under various conditions, including:
+- Failing to correctly complete [join state verification](concepts.mdx#join-state-verification)
+- Connecting with certificates that have an invalid [generation counter][ephemeral]
+- Locked manually by a cluster admin
+
+To recover a bot that has become locked, first ensure the bot's internal storage
+(`storage`) has not been compromised. These locking conditions are designed to
+trigger if more than one client tries to join using a copy of the same
+certificates and private key. This can occur due to a misconfiguration or due
+to an attacker copying a bot's credentials, so ideally the latter should be
+ruled out before unlocking a bot.
+
+Next, determine the name (UUID) of the lock or locks targeting the bot:
+```code
+$ tctl get lock
+kind: lock
+metadata:
+  name: 372af058-76d1-4e64-93da-3b04d7d03ac2
+spec:
+  target:
+    user: bot-example
+version: v2
+---
+kind: lock
+metadata:
+  name: 791d0b1d-01b4-4752-8a99-9b2908aebfae
+spec:
+  target:
+    bot_instance_id: e7d494ae-a0ff-4d12-b935-de5e2025f667
+version: v2
+---
+kind: lock
+metadata:
+  name: a69fdbb2-8e53-406a-b453-48b2cda6991d
+spec:
+  target:
+    join_token: example-token-name
+version: v2
+```
+
+Note the different locks and lock targets shown above: bots can be targeted by
+any of their Teleport user name (`bot-example`), the bot instance ID (a UUID),
+or the join token name. Locks created automatically for bots using Bound Keypair
+Joining will typically use a `join_token` target, but a lock targeting any of
+these values could be created manually.
+
+Note that locks may have a message field containing details about why the lock
+was created.
+
+Once the lock name(s) have been determined, remove each using `tctl rm`:
+```code
+$ tctl rm lock/372af058-76d1-4e64-93da-3b04d7d03ac2
+```
+
+Next, join state should be reset. Use `tctl edit` to set the token's recovery
+mode to `insecure`, but make a note of the current value (`standard` or
+`relaxed`):
+```code
+$ tctl edit token/example-token
+```
+
+Change the `.spec.bound_keypair.recovery.mode` field to `insecure`, save, and
+quit the editor.
+
+The bot can now be allowed to rejoin. Given sufficient time it will retry on its
+own, but if you have access to the host, `systemctl restart tbot` or similar can
+be used to restart the bot process.
+
+The bot should now be able to join successfully. You can monitor progress by
+watching for new audit events in Teleport's web UI, or by waiting for the
+recovery counter to increase:
+```code
+$ tctl get token/example-token --format=json | jq '.[].status.bound_keypair.recovery_count'
+```
+
+Once the bot has joined successfully, reset the recovery mode to its previous
+value using `tctl edit`:
+```code
+$ tctl edit token/example-token
+```
+
+If you do suspect the bot's credentials may have been compromised, you may also
+want to [request a keypair rotation](#requesting-a-keypair-rotation) in
+addition to taking other steps to ensure the host is properly secured.
+
+## Disabling join state verification
+
+It is occasionally useful to intentionally disable join state verification. For
+example, this can enable use with:
+- CI/CD providers without an explicit [delegated join method][delegated].
+- Nodes with immutable storage that cannot store an updated join state document
+  after each join.
+
+Before continuing, be aware that disabling join state verification will prevent
+Teleport from detecting if multiple clients are joining using the same bound
+keypair token. In other words, if the private key is copied by an attacker, they
+will be able to join indefinitely. Take care to protect the keypair, and make
+certain to limit access from the bot identity using Teleport's
+[RBAC system][rbac].
+
+When ready, use `tctl edit` to modify the Bound Keypair token:
+```code
+$ tctl edit token/example-token
+```
+
+Find or add the `spec.bound_keypair.recovery.mode` field and set it to
+`insecure`. Save and quit your editor to update the token.
+
+With the mode set to `insecure`, the `recovery.limit` is ignored, allowing
+unlimited reuse of the token, and join state verification is disabled, allowing
+concurrent or stateless reuse.
+
+## Recovery after a cluster rollback
+
+If your Teleport cluster is rolled back for any reason, joining bots may fail
+[join state verification](concepts.mdx#join-state-verification) as their local join state
+document may not match the values currently (or previously) known to Teleport.
+
+The simplest workaround is to temporarily set all bound keypair tokens to
+`insecure` recovery mode for the first join attempt following a cluster restore.
+Once they've joined once, they will once again have a valid join state, so the
+recovery mode can be restored to its previous value.
+
+To change the recovery mode, use `tctl edit` to modify the token resource:
+```code
+$ tctl edit token/example-token
+```
+
+Find the `spec.bound_keypair.recovery.mode` field, and set the value to
+"insecure". Repeat this for each bound keypair token. Wait for all bound keypair
+bots to reauthenticate, and repeat this process to restore the recovery mode to
+its previous value.
+
+If [bot keypairs were rotated](#requesting-a-keypair-rotation) between the
+snapshot and restore of the Teleport cluster, note that bots only keep a record
+of the previous 10 keypairs. This means server-side recovery may be impossible
+if the keypair expected by the restored Teleport cluster has been rotated out of
+the client-side history, or if the client-side history has been lost or deleted.
+
+## Manually rotating static keys
+
+Static keys prevent automatic key rotation as the `tbot` client cannot update
+keys in an arbitrary keystore. However, it may still possible to automate
+rotation if your environment or secret store allows you to update secrets
+through an API.
+
+The specific steps needed to automate these will vary based on your environment,
+but the general steps are:
+
+1. Generate a new keypair on any node using the tbot client:
+
+   ```code
+   $ tbot keypair create --proxy-server example.teleport.sh:443 --static --format json
+   ```
+
+2. Parse the `.public_key` and `.private_key` values using your tool of choice,
+   like `jq` or any other JSON parser.
+
+3. Replace the token in Teleport to trust the new public key, using the value in
+   the `.public_key` field:
+   ```code
+   $ cat my-token.yaml
+   version: v2
+   kind: token
+   metadata:
+     name: my-token
+   spec:
+     bot_name: example-bot
+     bound_keypair:
+       onboarding:
+         initial_public_key: <insert .public_key value here>
+       recovery:
+         mode: insecure
+     join_method: bound_keypair
+     roles:
+     - Bot
+   $ tctl create -f my-token.yaml
+   ```
+
+3. Insert the new private key into your keystore. This will vary depending on
+   which keystore or provider you are using.
+   * If passing the private key via an environment variable, copy the value directly
+   * If passing the private key via file, decode the base64-encoded private key first:
+     ```code
+     $ tbot keypair create --proxy-server example.teleport.sh:443 --static --format json | jq -r .private_key | base64 -d
+     ```
+     ...and store the result as needed.
+
+4. Future jobs should now use the new keypair.
+
+Frequently rotating static keys can help to mitigate the security tradeoffs of
+`insecure` recovery. See the [concepts page](concepts.mdx#static-keys) for more
+information about static keys.
+
+[rbac]: ../../access-controls/roles.mdx
+[ephemeral]: ../../architecture/machine-id-architecture.mdx#ephemeral-token
+[delegated]: ../../deployment/join-methods.mdx#delegated-join-methods
diff --git a/docs/pages/reference/machine-workload-identity/bound-keypair/bound-keypair.mdx b/docs/pages/reference/machine-workload-identity/bound-keypair/bound-keypair.mdx
new file mode 100644
index 0000000000000..5ca86a96ea589
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/bound-keypair/bound-keypair.mdx
@@ -0,0 +1,91 @@
+---
+title: Bound Keypair Joining Reference
+sidebar_label: Bound Keypair Joining
+description: "Bound Keypair Joining: Reference and admin guide"
+tags:
+ - infrastructure-as-code
+ - reference
+ - mwi
+ - infrastructure-identity
+---
+
+Bound Keypair is a join method designed to provide the best features of
+[delegated join methods][s-vs-d] - like the AWS, GCP, or Azure join
+methods - but in on-prem or otherwise unsupported environments where no external
+verification is available.
+
+Specifically, this join method:
+- Does not require dedicated TPM hardware or external identity attestation
+- Does not require long-lived shared secrets
+- Allows for limited automatic recovery if certificates expire
+- Allows recovery restrictions to be relaxed or lifted to accommodate different
+  use cases and deployment scenarios
+- Ensures failed bots can be recovered without client-side intervention in most
+  cases
+
+<Admonition type="tip" title="Preview Note">
+Bound Keypair Joining is available in v18.1.0 and is intended to replace `token`
+joining as the default recommended join method in Teleport v19.0.0.
+
+At this time, Bound Keypair Joining can only be used to join Machine and
+Workload ID bots and cannot be used to join other Teleport agent types.
+</Admonition>
+
+## Use cases
+
+Bound Keypair Joining can be used in any environment and is designed to function
+as a drop-in replacement for the traditional [`token`][ephemeral] join method in
+all situations where it is used today. This includes bare-metal and on-prem
+hardware where TPMs are not available, or cloud providers not currently
+supported by a [delegated join method][delegated].
+
+Similar to `token` joining, Bound Keypair Joining is also a good replacement for
+local experimentation for testing, with minimal configuration needed to onboard
+a bot initially. When ready to deploy to production, it's trivial to adjust
+onboarding and recovery settings to select your desired balance between
+resiliency and security.
+
+Additionally, with [static keys](static-keys.mdx) and in situations that can
+accommodate the security complications, Bound Keypair Joining can be used to
+join bots in otherwise unsupported CI/CD providers by persisting the bot's
+keypair in a platform keystore.
+
+## Limitations
+
+While Bound Keypair Joining does enable or simplify a number use cases, it does
+have limitations that may make it unfit in some instances.
+
+In particular, the [secure recovery modes](concepts.mdx#recovery) introduce some deployment
+restrictions:
+- Each bot deployment must be issued a unique token. For deployment at scale,
+  use of Teleport's
+  [Terraform provider](../../infrastructure-as-code/terraform-provider/terraform-provider.mdx) is
+  recommended to create tokens in bulk for each deployment.
+- Each bot deployment must be able to store client-side state (used for
+  [join state verification](concepts.mdx#join-state-verification)).
+
+This limitation can be worked around using the
+[`insecure` recovery mode](admin-guide.mdx#disabling-join-state-verification), but doing so
+does meaningfully reduce the join method's security protections and should be
+used with care.
+
+## Next steps
+
+You can read step-by-step guides on using Bound Keypair Joining with
+Machine & Workload Identity:
+
+- [Using Bound Keypair Joining](./getting-started.mdx):
+  How to install and configure Machine & Workload Identity with Bound Keypair
+  Joining
+- [Using Bound Keypair static keys](./static-keys.mdx): How to use Bound Keypair
+  static keys with stateless hosts, like otherwise unsupported CI/CD providers
+- [Bound Keypair Joining Concepts](./concepts.mdx): Learn more about the
+  components and architecture of Bound Keypair Joining
+- [Bound Keypair Joining Admin Guide](./admin-guide.mdx): Learn how to deploy
+  and maintain bots in production with Bound Keypair Joining
+- [Bound Keypair Provision Token Reference](../../deployment/join-methods.mdx#bound-keypair-bound_keypair): Learn about the options that can be configured for a `bound_keypair` token
+
+[delegated]: ../../deployment/join-methods.mdx#delegated-join-methods
+[ephemeral]: ../../architecture/machine-id-architecture.mdx#ephemeral-token
+[token]: ../../deployment/join-methods.mdx#ephemeral-tokens
+[s-vs-d]: ../../deployment/join-methods.mdx#secret-vs-delegated
diff --git a/docs/pages/reference/machine-workload-identity/bound-keypair/concepts.mdx b/docs/pages/reference/machine-workload-identity/bound-keypair/concepts.mdx
new file mode 100644
index 0000000000000..eefab60ab3235
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/bound-keypair/concepts.mdx
@@ -0,0 +1,190 @@
+---
+title: Bound Keypair Joining Concepts
+description: "Learn the key components of Bound Keypair Joining"
+tags:
+ - mwi
+ - conceptual
+ - infrastructure-identity
+---
+
+This page discusses the main concepts needed to understand Bound Keypair
+Joining.
+
+## Bound keypair
+
+The term "bound keypair" refers to both the type of credential and way it's used
+in Teleport: first, a bot generates a standard public/private keypair; next,
+Teleport is configured to trust the public key, binding it to a token.
+
+While bots using Bound Keypair Joining will receive regular, short-lived
+Teleport certificates, and will refresh them regularly in a similar manner to
+[renewable certificates][renewable], they also make use of an additional
+public/private keypair that is not tied directly to a certificate. Critically,
+this means the keypair does not have an expiration date, and that any trust
+relationship established between Teleport and a Bound Keypair bot is controlled
+by server-side configuration within Teleport and not due to the passage of time.
+
+Once this trust relationship has been established, bots can - in a sense - serve
+as their own identity authority, similar to how cloud providers can attest to
+the identity of a host or CI workflow run. Teleport issues the joining bot a
+unique cryptographic challenge which the bot signs using its private key, and
+the result is verified using the key registered with Teleport.
+
+As this self attestation is not by itself a sufficient security guarantee, Bound
+Keypair Joining makes use of additional server-side rules to control whether or
+not a join attempt will be allowed, including:
+- Limiting the number of [recovery attempts](#recovery) and optionally requiring
+  (server-side) human intervention for each recovery.
+- Preventing reuse or theft of private keys using
+  [join state verification](#join-state-verification).
+
+## Onboarding
+
+Onboarding takes place at first join and is the stage at which a public key
+becomes bound to a token. There are two methods bots may use to complete this
+step:
+- Preregistered keys: a private key is generated locally on the bot host, and
+  the public key is copied out-of-band to Teleport by a human user or a script.
+  This method ensures no secret values are ever copied between systems.
+- Registration secrets: a one time use random secret is generated by Teleport
+  and provided to the bot host via either a human user or a script, similar to
+  the [ephemeral `token` join method][token].
+
+If a registration secret is used, the bot uses the registration secret to prove
+its identity for this first connection, generates a keypair on the fly, and
+registers the public key with Teleport.
+
+Registration secrets are used by default: if a token is created and no initial
+(preregistered) public key is provided, a registration secret will be randomly
+generated by Teleport and written to the token's
+`status.bound_keypair.registration_secret` field.
+
+In both cases - once registered, or when using preregistered keys - the joining
+bot is then required to complete a joining challenge. A unique cryptographic
+challenge is generated by Teleport which the bot must sign and return. If the
+signature matches the registered public key, onboarding has succeeded: the
+public key is permanently bound to the token, a certificate bundle is issued,
+and a join state document is provided for use on the next join attempt.
+
+## Recovery
+
+Recovery takes place when a bot uses its private key to request new
+certificates. This can occur in two situations:
+- On first join, when the bot has no certificates.
+- When the bot's certificates expire before they can be renewed, such as when a
+  bot is offline for longer than its configured `certificate_ttl`.
+
+So long as the bot has and maintains valid Teleport credentials - by default,
+bot certificates are valid for an hour and renewed every 20 minutes, but these
+values are configurable - no recovery will be needed after the initial join.
+Recovery is only required when a bot is unable to refresh its certificates for
+longer than its configured certificate TTL (e.g. 1 hour).
+
+The behavior of the recovery process depends on two values configured in the
+token resource: the recovery mode (`spec.bound_keypair.recovery.mode`), and the
+recovery limit (`spec.bound_keypair.recovery.limit`). The mode may have these
+values:
+- `standard` (default): only `limit` recovery attempts can be automatically
+  attempted.
+
+  This mode is recommended for most situations. Bots can recover automatically
+  so long as the recovery count (`status.bound_keypair.recovery_count`) doesn't
+  exceed the configured limit, which allows cluster administrators to select
+  their tolerance for automatic bot recovery attempts.
+
+  [Join state verification](#join-state-verification) is enabled, which helps
+  prevent keypair reuse, but does require clients to store additional on each
+  join.
+
+  Note that as the initial join counts as a recovery attempt, `limit` must
+  always be at least `1` for the initial join to succeed.
+
+- `relaxed`: `limit` is ignored, but
+  [join state verification](#join-state-verification) remains enabled.
+
+  This mode allows for unlimited recovery attempts and is useful for lower
+  security impact bots, or deployments where bots are regularly expected to go
+  offline for extended periods.
+
+  Like `standard` mode, join state verification is enabled to help prevent
+  keypair reuse, but does require clients to store additional state on each
+  join.
+
+- `insecure`: `limit` is ignored, and join state verification is **disabled**.
+
+  This mode is the most flexible, as bots can rejoin repeatedly and can operate
+  without mutable client-side state. However, this disables most additional
+  security checks and should be used with care.
+  [See the admin guide](admin-guide.mdx#disabling-join-state-verification) for
+  more information on using `insecure` mode in practice.
+
+  Static key joining (`tbot keypair create --static ...`) requires use of
+  `insecure` mode as it disables client-side credential storage, meaning bots
+  cannot complete [join state verification](#join-state-verification).
+
+## Join state verification
+
+A **join state document** is an additional piece of information provided to
+joining bots alongside their usual Teleport certificate bundle. It contains
+signed information about the state of the joining process, including a sequence
+number that uniquely identifies each join attempt.
+
+**Join state verification** both ensures that the bot can provide a valid and
+signed join state document, and that the document contains the expected sequence
+number.
+* If successful, the join attempt can proceed and a new join state document will
+  be issued with an incremented sequence counter.
+* If the sequence number presented by the client is outdated, the join
+  attempt is rejected, and a lock is created to ensure existing clients will be
+  denied further access to the Teleport cluster.
+
+This system takes advantage of Teleport's short lived certificates and frequent
+bot reauthentication. If an attacker somehow obtains a copy of a bot's keypair
+and attempts to use it to retrieve Teleport certificates, they will initially
+succeed. However, the original bot will eventually make another authentication
+attempt, using its now-outdated join state document. This join attempt with an
+outdated document will trigger a lockout and block both the original bot and any
+credentials in use by the attacker.
+
+Note that join state verification is disabled when the token's
+`spec.bound_keypair.recovery.mode` is set to `insecure`.
+
+## Static Keys
+
+Static keys trade some security guarantees for flexibility, and can help enable
+use of `tbot` in environments where bots otherwise could not authenticate, such
+as:
+- CI/CD providers for which Teleport has no dedicated join method
+- Ephemeral bare-metal nodes without TPMs
+- Any other environment where persistent storage is not available
+- Any environment where an arbitrary number of instances may join, like
+  ephemeral CI runners.
+
+However, static keys have disadvantages:
+- `insecure` mode means any client with the private key can join without
+  restrictions. If the key is stolen, the attacker will have access to Teleport
+  and any resources the bot is allowed to access.
+- `insecure` mode additionally means you cannot limit the number of uses of the
+  bound keypair token (`spec.bound_keypair.recovery.limit`).
+- Keypair rotation is not supported, as client storage is not writable, and
+  attempting to require a rotation will prevent bots from joining.
+
+When using static keys, a keypair is generated ahead of time and [preregistered
+with Teleport](#onboarding). You can then provide the keypair to the `tbot`
+client using a file or the `TBOT_BOUND_KEYPAIR_STATIC_KEY` environment variable.
+
+The `insecure` recovery mode is required when using static keys (with
+`tbot keypair create --static ...`) as this mode disables client-side storage
+for join state documents. With no previous state, bots will not be able to
+complete join state verification, and will be unable to recover after their
+first authentication attempt; as such, join state verification must be disabled.
+
+With this context in mind, when using static keys, be aware that any client with
+knowledge of the private key can authenticate to Teleport with no additional
+restrictions. Before deploying a bot with static keys, take additional care to
+fully understand your environment's threat model and security needs, and reduce
+access using [Teleport's RBAC](../../access-controls/roles.mdx) to ensure the
+minimum possible blast radius in the event the keypair is compromised.
+
+[renewable]: ../../deployment/join-methods.mdx#renewable-vs-non-renewable
+[token]: ../../deployment/join-methods.mdx#ephemeral-tokens
diff --git a/docs/pages/reference/machine-workload-identity/bound-keypair/getting-started.mdx b/docs/pages/reference/machine-workload-identity/bound-keypair/getting-started.mdx
new file mode 100644
index 0000000000000..c35071ffdf9ce
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/bound-keypair/getting-started.mdx
@@ -0,0 +1,303 @@
+---
+title: Deploying tbot with Bound Keypair Joining
+description: "How to install and configure tbot with Bound Keypair Joining"
+tags:
+ - mwi
+ - how-to
+ - infrastructure-identity
+---
+
+In this guide, you will install Machine & Workload Identity's agent, `tbot`, on
+an arbitrary host using Bound Keypair Joining. This host could be a bare-metal
+machine, a VM, a container, or any other host - the only requirement is that the
+host has persistent storage.
+
+Bound Keypair Joining is an improved alternative to
+[secret-based join methods][secret] and can function as a drop-in replacement.
+It is more secure than static token joining, and is more flexible than ephemeral
+token joining with renewable certificates: when its certificates expire, it can
+perform an automated recovery to ensure the bot can rejoin even after an
+extended outage.
+
+Note that platform-specific join methods may be available that are better suited
+to your environment; refer to the
+[deployment guides](../../../machine-workload-identity/deployment/deployment.mdx)
+for a full list of options.
+
+## How it works
+
+With Bound Keypair Joining, Machine & Workload Identity bots generate a unique
+keypair which is persistently stored in their internal data directory. Teleport
+is then configured to trust this public key for future joining attempts.
+
+Later, when the bot attempts to join the cluster, Teleport issues it a challenge
+that can only be completed using its private key. The bot returns the solved
+challenge, attesting to its own identity, and is conditionally allowed to join
+the cluster. This process is repeated for every join attempt, but if the bot has
+been offline long enough for its certificates to expire, it is additionally
+forced to perform an automatic recovery to join again.
+
+As self attestation is inherently less secure than the external verification
+that would be provided by a cloud provider like AWS or a dedicated TPM, Bound
+Keypair Joining enforces a number of additional checks to prevent abuse,
+including:
+- Join state verification to ensure the keypair cannot be usefully shared or
+  duplicated
+- Certificate generation counter checks to ensure regular bot certificates
+  cannot be usefully shared or duplicated
+- Configurable limits on how often - if at all - bots may be allowed to
+  automatically recover using this keypair
+
+An important benefit to Bound Keypair Joining is that all joining restrictions
+can be reconfigured at any time, and bots that expire or go offline can be
+recovered by making a server-side exemption without any client-side
+intervention.
+
+Refer to the [reference page][reference] for further details on how this join
+method works and how to use it in production.
+
+## Prerequisites
+
+{/* note: consider edition-prereqs-tabs.mdx include for v19; it is misleading due to the minor launch release */}
+
+- A running Teleport cluster version 18.1.0 or above.
+- The `tsh` and `tctl` clients.
+- (!docs/pages/includes/tctl.mdx!)
+- This guide assumes the bot host has mutable persistent storage for internal
+  bot data. While it is possible to use Bound Keypair Joining can on immutable
+  hosts (like CI runs), doing so will reduce security guarantees; see the
+  [reference page][reference] for further information.
+
+## Step 1/5. Install `tbot`
+
+**This step is completed on the bot host.**
+
+First, `tbot` needs to be installed on the host that you wish to use Machine &
+Workload Identity on.
+
+Download and install the appropriate Teleport package for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/5. Create a Bot
+
+**This step is completed on your local machine.**
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/5. Create a join token
+
+**This step is completed on your local machine.**
+
+In this guide, we'll demonstrate joining a bot using a registration secret: this
+is a one-time use secret the bot can provide to Teleport to authenticate its
+first join. Once authenticated, the bot automatically generates a keypair and
+registers its public key with Teleport for use in all future join attempts.
+
+Create `token-example.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # This name will be used in tbot's `onboarding.token` field.
+  name: example
+spec:
+  roles: [Bot]
+  # bot_name should match the name of the bot created earlier in this guide.
+  bot_name: example
+  join_method: bound_keypair
+  bound_keypair:
+    recovery:
+      mode: standard
+      limit: 1
+```
+
+Replace `example` in `spec.bot_name` with the name of the bot you created in the
+second step.
+
+For this example, we don't need to set any additional options for the bound
+keypair token. We've allowed a single recovery attempt, which will be used to
+allow the bot's initial join, and Teleport will generate a registration secret
+automatically when the token is created as we have not preregistered a public
+key to use.
+
+<Admonition type="tip" title="Onboarding Options">
+This example makes use of registration secrets to authenticate the initial join.
+If desired, it is also possible to generate a key on the bot host first and
+register it with Teleport out-of-band, avoiding the need to copy secrets between
+hosts.
+
+To learn more about preregistering public keys, see the
+[alternative flow](#alternative-preregistered-keys) below. For more information
+on Bound Keypair Joining's other onboarding and recovery options, refer to the
+[reference page][reference].
+</Admonition>
+
+Use `tctl` to apply this file:
+
+```code
+$ tctl create -f token-example.yaml
+```
+
+Next, retrieve the generated registration secret, which will be needed for the
+next step:
+```code
+$ tctl get token/example --format=json | jq -r '.[0].status.bound_keypair.registration_secret'
+```
+
+This assumes `jq` is installed. If not, run `tctl get token/example` and inspect
+the `.status.bound_keypair.registration_secret` field.
+
+## Step 4/5. Configure `tbot`
+
+**This step is completed on the bot host.**
+
+### Prepare a storage directory
+
+(!docs/pages/includes/machine-id/machine-id-init-bot-data.mdx!)
+
+### Create a configuration file
+
+Create `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: bound_keypair
+  token: example
+  bound_keypair:
+    registration_secret: SECRET
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+# services will be filled in during the completion of an access guide.
+services: []
+```
+
+Replace the following:
+- `example.teleport.sh:443` with the address of your Teleport Proxy.
+- `example` with the name of the token created in the previous step, if you
+  changed it from `example`.
+- `SECRET` with the registration secret retrieved in the previous step.
+
+(!docs/pages/includes/machine-id/daemon-or-oneshot.mdx!)
+
+## Step 5/5. Configure outputs
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Alternative: preregistered keys
+
+This guide makes use of a registration secret - a single use shared secret
+that's consumed on the first bot join and allows a bot to automatically register
+its public key with Teleport. If you don't want to use any shared secrets, you
+can instead opt to generate the bot's keypair ahead of time and inform Teleport
+of the public key yourself.
+
+To generate a public key, run the following command on the bot host:
+```code
+## If needed, create the bot's storage directory
+$ mkdir -p /var/lib/teleport/bot
+$ tbot keypair create --storage /var/lib/teleport/bot --proxy-server=example.teleport.sh:443
+2025-07-08T16:31:48.000-00:00 INFO [TBOT]      keypair has been written to storage storage:directory: /var/lib/teleport/bot tbot/keypair.go:135
+
+To register the keypair with Teleport, include this public key in the token's
+`spec.bound_keypair.onboarding.initial_public_key`:
+
+	ssh-ed25519 <data>
+```
+
+Note the SSH-style public key written to the console - you'll need this value in
+the next step.
+
+<Admonition type="note" title="Automation note">
+Be aware that if a keypair already exists within the specified storage directory
+it will not be overwritten by default. If an existing key is found, a warning
+will be logged and the existing public key will be printed to the console.
+
+If you explicitly want to create a new public key, pass the `--overwrite` flag
+to `tbot keypair create`. A warning will also be logged if any keys are actually
+overwritten.
+
+If you'd like to automate this process, the `--format=json` flag will write the
+public key string in a JSON document for use in scripts.
+</Admonition>
+
+Note that while a proxy server address must be provided, this is only used to
+ping the cluster to determine its configured
+[signature algorithms](../../deployment/signature-algorithms.mdx). Once the keypair has been
+generated, the public key will be printed to the console.
+
+Next, on your local machine, create a file named `token-example.yaml`:
+```yaml
+kind: token
+version: v2
+metadata:
+  name: example
+spec:
+  roles: [Bot]
+  join_method: bound_keypair
+  bot_name: example
+  bound_keypair:
+    onboarding:
+      initial_public_key: "ssh-ed25519 <data>"
+    recovery:
+      mode: standard
+      limit: 1
+```
+
+The SSH-style public key generated by the bot should be copied into the
+`initial_public_key` field. As shown above, the value should be quoted to ensure
+the YAML remains valid.
+
+Create the token with `tctl`:
+```code
+$ tctl create -f token-example.yaml
+```
+
+Back on the bot machine, configure the bot as in the original guide, but this
+time with no `registration_secret` field set. Create a `tbot.yaml` with this
+content:
+```yaml
+version: v2
+proxy_server: example.teleport.sh:443
+onboarding:
+  join_method: bound_keypair
+  token: example
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+# outputs will be filled in during the completion of an access guide.
+outputs: []
+```
+
+As in the original example, replace:
+- `example.teleport.sh:443` with the address of your Teleport Proxy.
+- `example` with the name of the token created in the previous step, if you
+  changed it from `example`.
+
+Note that the `storage.path` must point to the same storage directory you passed
+to `tbot keypair create` above.
+
+Once the config file has been created, you can start the bot as usual:
+```code
+$ tbot start -c tbot.yaml
+```
+
+For additional information on how onboarding a new bot works with Bound Keypair
+Joining, refer to the [onboarding reference](./concepts.mdx#onboarding).
+
+## Next steps
+
+- Read the [Bound Keypair Joining Reference][reference]
+  for more details about the join method and the available configuration options.
+- Follow the [access guides](../../../machine-workload-identity/access-guides/access-guides.mdx)
+  to finish configuring `tbot` for your environment.
+- Read the [configuration reference](../configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../telemetry.mdx)
+
+[secret]: ../../deployment/join-methods.mdx#secret-vs-delegated
+[reference]: ./bound-keypair.mdx
diff --git a/docs/pages/reference/machine-workload-identity/bound-keypair/static-keys.mdx b/docs/pages/reference/machine-workload-identity/bound-keypair/static-keys.mdx
new file mode 100644
index 0000000000000..b50b258105c6e
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/bound-keypair/static-keys.mdx
@@ -0,0 +1,298 @@
+---
+title: Deploying tbot with Bound Keypair Static Keys
+description: "How to install and configure tbot with Bound Keypair static keys"
+tags:
+ - mwi
+ - how-to
+ - infrastructure-identity
+---
+
+In this guide, you will install Machine and Workload Identity's agent, `tbot`,
+on an arbitrary stateless environment using Bound Keypair static keys. This
+might be a CI/CD job on a provider not yet supported by one of Teleport's
+[dedicated join methods](../../deployment/join-methods.mdx), an ephemeral
+bare-metal node, or any other environment without writable persistent storage.
+
+Bound Keypair Joining is a more flexible alternative to [secret-based join
+methods][secret], and static keys allow arbitrary nodes to join by relaxing some
+of its built-in security requirements.
+
+<Admonition type="tip" title="Persistent Storage">
+If your provider has writable persistent storage, like a Kubernetes PVC or
+similar writable persistent storage, you should instead follow the [standard
+Bound Keypair guide](./getting-started.mdx).
+</Admonition>
+
+## How it works
+
+Bound Keypair joining typically assumes you have access to writable client-side
+storage to store additional identity proofs, but this requirement is lifted when
+using Bound Keypair static keys.
+
+Normally, the actual Bound Keypair keys are managed internally by the `tbot`
+client, which allows them to be generated and rotated on demand. With static
+keys, you take direct ownership of the private key and can store it as you see
+fit - like in a platform keystore. The `tbot` client is then configured to use
+your static private key instead of managing it automatically.
+
+<Admonition type="warning" title="Security Considerations">
+Static key joining relaxes certain security checks otherwise performed when
+client-side storage is available. This is designed to be used where no other
+join methods are possible. Before continuing, consider:
+- Using a [dedicated join method](../../deployment/join-methods.mdx) for your
+  platform if available.
+- Using [standard Bound Keypair joining](./getting-started.mdx) if your
+  environment has writable persistent storage.
+
+[Read more about static keys and what tradeoffs they
+require](./concepts.mdx#static-keys) before using them in a production
+environment.
+</Admonition>
+
+## Prerequisites
+
+{/* note: consider edition-prereqs-tabs.mdx include for v19; it is misleading due to the minor launch release */}
+
+{/* TODO: replace version with version containing `tbot keypair create --static` */}
+
+- A running Teleport cluster version 18.2.0 or above.
+- The `tsh`, `tctl`, and `tbot` clients.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/7. Install `tbot`
+
+**This step is completed on the bot host.**
+
+First, `tbot` needs to be installed on the host that you wish to use Machine &
+Workload Identity on.
+
+Download and install the appropriate Teleport package for your platform:
+
+(!docs/pages/includes/install-linux.mdx!)
+
+## Step 2/7. Create a Bot
+
+**This step is completed on your local machine.**
+
+(!docs/pages/includes/machine-id/create-a-bot.mdx!)
+
+## Step 3/7. Create a keypair and a join token
+
+Next, we'll need to generate a keypair, consisting of:
+* A private key that will need to be available on your bot host at runtime
+* A public key that will need to be configured in the Teleport join token
+
+We'll use a helper in the `tbot` client to generate a static keypair. This
+step can be run anywhere and does not require any configuration, but you will
+need to decide how the bot will access the key, which may vary depending on your
+environment or secret store:
+1. Via an environment variable, useful for providers or environments that inject
+   secrets as environment variables
+2. Via a standard file which you transfer to the bot host
+
+With that in mind, if you intend to make the key available to `tbot` via an
+environment variable, run the following:
+
+```code
+$ tbot keypair create --proxy-server <Var name="example.teleport.sh"/>:443 --static
+```
+
+Otherwise, if using a file, run the following:
+```code
+$ tbot keypair create --proxy-server <Var name="example.teleport.sh"/>:443 --static --static-key-path ./path/to/key
+```
+
+Adjust the `--static-key-path` value as desired. If you didn't run this command
+on the bot host directly, be prepared to transfer this to the bot host in the
+next step.
+
+In either case, the command will generate a keypair and print some instructions.
+For example, this is shown when using an environment variable key:
+```code
+To register the keypair with Teleport, include this public key in the token's
+'spec.bound_keypair.onboarding.initial_public_key' field:
+
+	<Var name="public key"/>
+
+Refer to this token example as a reference:
+
+	kind: token
+	metadata:
+	  name: example-token
+	spec:
+	  bot_name: example
+	  bound_keypair:
+	    onboarding:
+	      initial_public_key: <Var name="public key"/>
+	    recovery:
+	      limit: 0
+	      mode: insecure
+	  join_method: bound_keypair
+	  roles:
+	  - Bot
+	version: v2
+
+Configure your bot to use this static key by inserting the following private key
+value into the bot's environment, ideally via a platform-specific keystore if
+available:
+
+	export TBOT_BOUND_KEYPAIR_STATIC_KEY="<...encoded private key...>"
+
+Note that bots joined with static tokens do not support keypair rotation and
+will be unable to join if a rotation is requested server-side via the token's
+'rotate_after' field. Additionally, 'insecure' recovery mode must be used, as
+shown above. Read more at:
+
+	https://goteleport.com/docs/reference/machine-workload-identity/machine-id/bound-keypair/concepts/#recovery
+```
+
+This command will print the public key, a join token example, and the private
+key needed to configure your bot. Keep this output available as you'll need it
+through the next step.
+
+Using the example token printed by the above command as a template,
+create `token.yaml` containing the following content:
+```yaml
+kind: token
+metadata:
+  name: example-token
+spec:
+  bot_name: example
+  bound_keypair:
+  onboarding:
+    initial_public_key: <Var name="public key"/>
+  recovery:
+    limit: 0
+    mode: insecure
+  join_method: bound_keypair
+  roles:
+  - Bot
+version: v2
+```
+
+Be sure to set `bot_name` to match the bot created in the previous step, and
+ensure the public key matches the value printed by `tbot keypair create ...`.
+
+When ready, create the join token in your Teleport cluster using `tctl`:
+```code
+$ tctl create -f token.yaml
+```
+
+## Step 4/7. Store the private key
+
+Now that you've generated the private key, it needs to be stored and made
+available to your job. Exactly how to do this will depend on your provider and
+environment, as well as whether you'll be making it available via an environment
+variable or a file.
+
+### Storing the key in a file on the bot host
+
+Ensure the private key file you generated is made available on the bot host. If
+you generated it on your local machine, this might mean copying it via `scp`,
+provisioning the key via Ansible, or transferring it to the bot host through
+whichever means you prefer.
+
+Take care to ensure the resulting file on the bot host will only be readable by
+the account that will run the `tbot` process.
+
+### Storing the key in an environment variable
+
+If using an environment variable, depending on your platform and environment,
+you'll likely want to store the key in a platform-specific keystore - such that
+the environment variable is set on the bot host when it starts - rather than
+on the bot host directly.
+
+Regardless of backend, set the variable as follows:
+- Name: `TBOT_BOUND_KEYPAIR_STATIC_KEY`
+- Value: the base64-encoded value as printed by `tbot keypair create --static ...`
+
+The value is the same content that would otherwise be written to a file if you'd
+used `tbot keypair create ... --static --static-key-path /path/to/key`, but the
+content has been base64 encoded to simplify use as an environment variable
+value.
+
+## Step 5/7. Configure `tbot`
+
+**This step is completed on the bot host.**
+
+### With an environment variable key
+
+If exposing the secret via an environment variable, ensure it's available in the
+`$TBOT_BOUND_KEYPAIR_STATIC_KEY` variable.
+
+Create `/etc/tbot.yaml` with the following content:
+
+```yaml
+version: v2
+proxy_server: <Var name="example.teleport.sh"/>:443
+onboarding:
+  join_method: bound_keypair
+  token: example-token
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+# outputs will be filled in during the completion of an access guide.
+outputs: []
+```
+
+Aside from specifying the `join_method` and `token`, no additional configuration
+is needed; the key will be read from the environment as needed during the join
+process.
+
+### With a file key
+
+Copy the key to the bot environment or otherwise make sure it's available, and
+write the following to `/etc/tbot.yaml`:
+
+```yaml
+version: v2
+proxy_server: <Var name="example.teleport.sh"/>:443
+onboarding:
+  join_method: bound_keypair
+  token: example-token
+  bound_keypair:
+    static_private_key_path: /path/to/key
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+# outputs will be filled in during the completion of an access guide.
+outputs: []
+```
+
+Set `static_private_key_path` to point to the location the key will be
+available and save the file.
+
+## Step 6/7. Verify `tbot` can authenticate to Teleport
+
+Run `tbot` using the `tbot.yaml` you created, and ensure the private key is
+available as expected, either via file (at the path you configured earlier) or
+via the environment in `$TBOT_BOUND_KEYPAIR_STATIC_KEY`:
+
+```code
+$ tbot start -c /etc/tbot.yaml --oneshot
+```
+
+If everything has been setup correctly, `tbot` should run, authenticate with
+Teleport, and exit cleanly. In production, you can remove the `--oneshot` flag
+if you want `tbot` to continually provide updated certificates for
+longer-running jobs, otherwise the certificates issued will expire eventually
+(1 hour by default).
+
+## Step 7/7. Configure outputs
+
+(!docs/pages/includes/machine-id/configure-services.mdx!)
+
+## Next Steps
+
+- Read more about [Bound Keypair static keys](./concepts.mdx#static-keys).
+- Read about [static key rotation](./admin-guide.mdx#manually-rotating-static-keys)
+- Read the [Bound Keypair Joining Reference][reference]
+  for more details about the join method and the available configuration options.
+- Follow the [access guides](../../../machine-workload-identity/access-guides/access-guides.mdx)
+  to finish configuring `tbot` for your environment.
+- Read the [configuration reference](../configuration.mdx) to explore
+  all the available configuration options.
+- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../telemetry.mdx)
+
+[secret]: ../../deployment/join-methods.mdx#secret-vs-delegated
+[reference]: ./bound-keypair.mdx
diff --git a/docs/pages/reference/machine-workload-identity/configuration.mdx b/docs/pages/reference/machine-workload-identity/configuration.mdx
new file mode 100644
index 0000000000000..7076c3d0d9ecf
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/configuration.mdx
@@ -0,0 +1,1600 @@
+---
+title: Machine & Workload Identity Configuration Reference
+sidebar_label: Configuration
+description: Configuration reference for Teleport Machine & Workload Identity.
+toc_max_heading_level: 4
+tags:
+ - infrastructure-as-code
+ - reference
+ - mwi
+ - infrastructure-identity
+---
+
+This reference documents the various options that can be configured in the `tbot`
+configuration file. This configuration file offers more control than
+configuring `tbot` using CLI parameters alone.
+
+To run `tbot` with a configuration file, specify the path with the `-c` flag:
+
+```code
+$ tbot start -c ./tbot.yaml
+```
+
+In this reference, the term **artifact** refers an item that `tbot` writes to a
+destination as part of the process of generating an output. Examples of
+artifacts include configuration files, certificates, and cryptographic key
+material. Usually, artifacts are files, but this term is explicitly avoided
+because a destination isn't required to be a filesystem.
+
+```yaml
+# version specifies the version of the configuration file in use. `v2` is the
+# most recent and should be used for all new bots. The rest of this example
+# is in the `v2` schema.
+version: v2
+
+# debug enables verbose logging to stderr. If unspecified, this defaults to
+# false.
+debug: true
+
+# auth_server specifies the address of the Auth Service instance that `tbot` should connect
+# to. You should prefer specifying `proxy_server` to specify the Proxy Service
+# address.
+auth_server: "teleport.example.com:3025"
+
+# proxy_server specifies the address of the Teleport Proxy Service that `tbot` should
+# connect to.
+# It is recommended to use the address of your Teleport Proxy Service, or, if using
+# Teleport Cloud, the address of your Teleport Cloud instance.
+proxy_server: "teleport.example.com:443" # or "example.teleport.sh:443" for Teleport Cloud
+
+# credential_ttl specifies how long certificates generated by `tbot` should
+# live for. It should be a positive, numeric value with an `m` (for minutes) or
+# `h` (for hours) suffix. By default, this value is `1h`.
+# This has a maximum value of `24h`.
+#
+# It can be overridden for most outputs and services to give them a shorter TTL
+# than `tbot`'s internal certificates.
+credential_ttl: "1h"
+
+# renewal_interval specifies how often `tbot` should aim to renew the
+# outputs it has generated. It should be a positive, numeric value with an
+# `m` (for minutes) or `h` (for hours) suffix. The default value is `20m`.
+# This value must be lower than `credential_ttl`.
+# This value is ignored when using `tbot` is running in one-shot mode.
+#
+# It can be overridden for most outputs and services to give them a shorter
+# renewal interval than `tbot`'s internal certificates.
+renewal_interval: "20m"
+
+# oneshot configures `tbot` to exit immediately after generating the outputs.
+# The default value is `false`. A value of `true` is useful in ephemeral environments, like
+# CI/CD.
+oneshot: false
+
+# onboarding is a group of configuration options that control how `tbot` will
+# authenticate with the Teleport cluster.
+onboarding:
+  # token specifies which join token, configured in the Teleport cluster,
+  # should be used to join the Teleport cluster.
+  #
+  # This can also be an absolute path to a file containing the value you wish
+  # to be used.
+  # File path example:
+  # token: /var/lib/teleport/tokenjoin
+  token: "00000000000000000000000000000000"
+
+  # join_method must be the join method associated with the specified token
+  # above. This setting should match the value output when creating the bot using
+  # `tctl`.
+  #
+  # Support values include:
+  # - `token`
+  # - `azure`
+  # - `gcp`
+  # - `circleci`
+  # - `github`
+  # - `gitlab`
+  # - `iam`
+  # - `ec2`
+  # - `kubernetes`
+  # - `spacelift`
+  # - `tpm`
+  # - `terraform_cloud`
+  join_method: "token"
+
+  # ca_pins are used to validate the identity of the Teleport Auth Service on
+  # first connect. This should not be specified when using Teleport Cloud or
+  # connecting through a Teleport Proxy.
+  ca_pins:
+    - "(=presets.ca_pin=)"
+    - "(=presets.ca_pin=)"
+
+  # ca_path is used to specify where a CA file can be found that can be used to
+  # validate the identity of the Teleport Auth Service on first connect.
+  # This should not be specified when using Teleport Cloud or connecting through a
+  # Teleport Proxy. The ca_pins option should be preferred over ca_path.
+  ca_path: "/path/to/ca.pem"
+
+  # gitlab holds configuration specific to the "gitlab" join method.
+  gitlab:
+    # token_env_var_name allows the environment variable that contains the
+    # GitLab ID token to be specified. If unspecified, this defaults to
+    # "TBOT_GITLAB_JWT".
+    #
+    # Overriding this is useful when you need to use `tbot` to authenticate to
+    # multiple Teleport clusters from a single GitLab CI job.
+    token_env_var_name: "MY_GITLAB_ID_TOKEN"
+
+  # bound_keypair holds parameters specific to the "bound_keypair" join method
+  bound_keypair:
+    # registration_secret is an optional secret to use on first join in lieu of
+    # a preregistered keypair. You can also set this in the
+    # `TBOT_REGISTRATION_SECRET` environment variable.
+    registration_secret: "secret"
+
+    # registration_secret_path is an optional path to a file containing a
+    # registration secret; conflicts with `registration_secret`
+    registration_secret_path: ./path/to/secret
+
+    # static_key_path is an optional path to a file containing a static private
+    # key.
+    static_key_path: ./path/to/secret
+
+# storage specifies the destination that `tbot` should use to store its
+# internal state. This state is sensitive, and you should ensure that the
+# destination you specify here can only be accessed by `tbot`.
+#
+# If unspecified, storage is set to a directory destination with a path
+# of `/var/lib/teleport/bot`.
+#
+# See the full list of supported destinations and their configuration options
+# under the Destinations section of this reference page.
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+
+# outputs specifies what artifacts `tbot` should generate and renew when it
+# runs.
+#
+# See the full list of supported outputs and their configuration options
+# under the Outputs section of this reference page.
+outputs:
+  - type: identity
+    destination:
+      type: directory
+      path: /opt/machine-id
+
+# services specify which `tbot` sub-services should be enabled and how they
+# should be configured.
+#
+# See the full list of supported services and their configuration options
+# under the Services section of this reference page.
+services:
+  - type: example
+```
+
+If no configuration file is provided, a simple configuration is used based
+on the provided CLI flags. Given the following sample CLI from
+`tctl bots add ...`:
+
+```code
+$ tbot start \
+   --destination-dir=./tbot-user \
+   --token=00000000000000000000000000000000 \
+   --ca-pin=(=presets.ca_pin=) \
+   --proxy-server=example.teleport.sh:443
+```
+
+it uses a configuration equivalent to the following:
+
+```yaml
+proxy_server: example.teleport.sh:443
+
+onboarding:
+  join_method: "token"
+  token: "(=presets.tokens.first=)"
+  ca_pins:
+    - "(=presets.ca_pin=)"
+
+storage:
+  type: directory
+  path: /var/lib/teleport/bot
+
+services:
+  - type: identity
+    destination:
+      type: directory
+      path: ./tbot-user
+```
+
+## Outputs
+
+Outputs define what actions `tbot` should take when it runs. They describe
+the format of the certificates to be generated, the roles used to generate the certificates, and the
+destination where they should be written.
+
+There are multiple types of output. Select the one that is most appropriate for
+your intended use-case.
+
+### `identity`
+
+The `identity` output can be used to authenticate:
+
+- SSH access to your Teleport servers, using `tsh`, openssh and tools like
+  ansible.
+- Administrative actions against your cluster using tools like `tsh` or `tctl`.
+- Management of Teleport resources using the Teleport Terraform provider.
+- Access to the Teleport API using the Teleport Go SDK.
+
+See the [Getting Started guide](../../machine-workload-identity/getting-started.mdx) to see the `identity`
+output used in context.
+
+```yaml
+# type specifies the type of the output. For the identity output, this will
+# always be `identity`.
+type: identity
+# ssh_config controls whether the identity output will attempt to generate an
+# OpenSSH configuration file. This requires that `tbot` can connect to the
+# Teleport Proxy Service. Must be "on" or "off". If unspecified, this defaults to
+# "on".
+ssh_config: on
+# allow_reissue controls whether the certificates generated by the identity
+# output can be reissued (e.g. used with `tsh apps login`/`tsh db login`). This
+# defaults to `false` if unspecified. If you receive an error message indicating
+# that the certificate cannot be reissued, set this to `true`.
+allow_reissue: false
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `application`
+
+The `application` output is used to generate credentials that can be used to
+access applications that have been configured with Teleport.
+
+See the [Machine & Workload Identity with Applications guide](../../machine-workload-identity/access-guides/applications.mdx)
+to see the `application` output used in context.
+
+```yaml
+# type specifies the type of the output. For the application output, this will
+# always be `application`.
+type: application
+# app_name specifies the application name, as configured in your Teleport
+# cluster, that `tbot` should generate credentials for.
+# This field must be specified.
+app_name: grafana
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `database`
+
+The `database` output is used to generate credentials that can be used to
+access databases that have been configured with Teleport.
+
+See the [Machine & Workload Identity with Databases guide](../../machine-workload-identity/access-guides/databases.mdx)
+to see the `database` output used in context.
+
+```yaml
+# type specifies the type of the output. For the database output, this will
+# always be `database`.
+type: database
+# service is the name of the database server, as configured in Teleport, that
+# the output should generate credentials for. This field must be specified.
+service: my-postgres-server
+# database is the name of the specific database on the specified database
+# server to generate credentials for. This field doesn't need to be specified
+# for database types that don't support multiple individual databases.
+database: my-database
+# username is the name of the user on the specified database server to
+# generate credentials for. This field doesn't need to be specified
+# for database types that don't have users.
+username: my-user
+# format specifies the format to use for output artifacts. If
+# unspecified, a default format is used. See the table titled "Supported
+# formats" below for the full list of supported values.
+format: tls
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+#### Supported formats
+
+You can provide the following values to the `format` configuration field in
+the `database` output type:
+
+| `format`      | Description                          |
+|---------------|--------------------------------------|
+| Unspecified   | Provides a certificate in `tlscert`, a private key in `key` and the CA in `teleport-database-ca.crt`. This is compatible with most clients and databases. |
+| `mongo`       | Provides `mongo.crt` and `mongo.cas`. This is designed to be used with MongoDB clients. |
+| `cockroach`   | Provides `cockroach/node.key`, `cockroach/node.crt`, and `cockroach/ca.crt`. This is designed to be used with CockroachDB clients. |
+| `tls`         | Provides `tls.key`, `tls.crt`, and `tls.cas`. This is for generic clients that require the specific file extensions. |
+
+### `kubernetes`
+
+The `kubernetes` output is used to generate credentials that can be used to
+access Kubernetes clusters that have been configured with Teleport.
+
+It outputs a `kubeconfig.yaml` in the output destination, which can be used
+with `kubectl`.
+
+See the [Machine & Workload Identity with Kubernetes Clusters guide](../../machine-workload-identity/access-guides/kubernetes.mdx)
+to see the `kubernetes` output used in context.
+
+```yaml
+# type specifies the type of the output. For the kubernetes output, this will
+# always be `kubernetes`.
+type: kubernetes
+# kubernetes_cluster is the name of the Kubernetes cluster, as configured in
+# Teleport, that the output should generate credentials and a kubeconfig for.
+# This field must be specified.
+kubernetes_cluster: my-cluster
+# disable_exec_plugin disables the default behaviour of using the `tbot` binary
+# as a `kubectl` credentials exec plugin. This is useful in environments where
+# `tbot` does not exist on the system that will consume the generated kubeconfig
+# (e.g. when using the `kubernetes_secret` output type). This credentials exec
+# plugin is used to automatically refresh the credentials within a single
+# invocation of `kubectl`. Defaults to `false`.
+disable_exec_plugin: false
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `kubernetes/v2`
+
+The `kubernetes/v2` output type can be used to access many Kubernetes clusters
+as individual contexts within the same `kubeconfig.yaml`.
+
+```yaml
+type: kubernetes/v2
+
+# selectors include one or more matching Kubernetes clusters. Each match will be
+# included in the resulting `kubeconfig.yaml`, assuming the bot has permission
+# to access the cluster.
+selectors:
+  # name includes an exact match by name. Note that wildcards are not currently
+  # supported. Multiple name selectors can be specified if desired.
+  - name: foo
+    # default_namespace is the namespace that should be configured for the
+    # context within the kubeconfig. This will be the namespace used by
+    # `kubectl`/SDK if the user has not explicitly provided one.
+    #
+    # If unspecified, no default namespace is set within the kubeconfig and
+    # `kubectl`/SDKs will use default based on their own logic - which is often
+    # to select the `default` namespace.
+    default_namespace: my-namespace
+  # labels include all clusters matching all of these labels. Multiple label
+  # selectors can be provided if needed.
+  - labels:
+      env: dev
+
+# The following configuration fields are available across most output types.
+# Note that `roles` are not supported for this output type.
+
+destination:
+  type: directory
+  path: /opt/machine-id
+
+# credential_ttl and renewal_interval override the credential TTL and renewal
+# interval for this specific output, so that you can make its certificates valid
+# for shorter than `tbot`'s internal certificates.
+#
+# This is particularly useful when using `tbot` in one-shot as part of a cron job
+# where you need `tbot`'s internal certificate to live long enough to be renewed
+# on the next invocation, but don't want long-lived workload certificates on-disk.
+credential_ttl: 30m
+renewal_interval: 15m
+
+# disable_exec_plugin disables the default behaviour of using the `tbot` binary
+# as a `kubectl` credentials exec plugin. This is useful in environments where
+# `tbot` does not exist on the system that will consume the generated kubeconfig
+# (e.g. when using the `kubernetes_secret` output type). This credentials exec
+# plugin is used to automatically refresh the credentials within a single
+# invocation of `kubectl`. Defaults to `false`.
+disable_exec_plugin: false
+
+# context_name_template determines the format of context names in the generated
+# kubeconfig. It is a Go template string that supports the following variables:
+#
+#   - {{.ClusterName}} - Name of the Teleport cluster
+#   - {{.KubeName}} - Name of the Kubernetes cluster resource
+#   - {{.Labels}} - Map of labels applied to the Kubernetes cluster
+# 	   resource that can be indexed using `{{index .Labels "key"}}`
+#
+# By default, the following template will be used: "{{.ClusterName}}-{{.KubeName}}"
+context_name_template: "{{.KubeName}}"
+
+# relay_server specifies the Relay service address that tbot should use to route
+# Kubernetes traffic to instead of the Teleport control plane. When set, all
+# Kubernetes API connections are sent via this Relay; only Kubernetes clusters
+# reachable through the specified Relay will be accessible and tbot will not fall
+# back to the control plane. Provide either a hostname or host:port (e.g.
+# relay.example.com or relay.example.com:443).
+#
+# Use of the relay_server option requires `tbot` 18.5.0 or later.
+relay_server: relay.example.com
+
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+Each Kubernetes cluster matching a selector will result in a new context in the
+generated `kubeconfig.yaml`. This can be consumed like so:
+
+```code
+$ kubectl --kubeconfig /opt/machine-id/kubeconfig.yaml --context=example.teleport.sh-foo get pods
+```
+
+The context name is `[Teleport cluster name]-[Kubernetes cluster name]`, so the
+command above runs `kubectl get pods` on the `foo` cluster.
+
+If clusters are added or removed over time, the `kubeconfig.yaml` will be
+updated at the bot's normal renewal interval. You can trigger an early renewal
+by restarting `tbot`, or signaling it with `pkill -usr1 tbot`.
+
+### `kubernetes/argo-cd`
+
+The `kubernetes/argo-cd` output type can be used to enable Argo CD to securely
+connect to external Kubernetes clusters.
+
+It works by "declaratively" managing cluster credentials
+[using Kubernetes secrets](https://argo-cd.readthedocs.io/en/release-1.8/operator-manual/declarative-setup/#clusters).
+For each matching Kubernetes cluster, `tbot` will create and continuously update
+a secret containing connection details and short-lived credentials, labeled with
+`"argocd.argoproj.io/secret-type": "cluster"` for Argo CD to discover.
+
+As such, it is only intended to be used within a Kubernetes cluster. See the
+[Machine & Workload Identity with Argo CD guide](../../machine-workload-identity/access-guides/argocd.mdx)
+for information on how to deploy it using the Helm chart.
+
+<Admonition type="warning" >
+    The `kubernetes/argo-cd` output type does not currently support
+    configurations where the Teleport proxy is behind a TLS-terminating load
+    balancer.
+</Admonition>
+
+```yaml
+type: kubernetes/argo-cd
+
+# selectors include one or more matching Kubernetes clusters. Each matching
+# cluster that the bot has permission to access will be registered with Argo CD
+# by creating a Kubernetes secret.
+selectors:
+  # name includes an exact match by name. Note that wildcards are not currently
+  # supported. Multiple name selectors can be specified if desired.
+  - name: foo
+  # labels include all clusters matching all of these labels. Multiple label
+  # selectors can be provided if needed.
+  - labels:
+      env: dev
+
+# secret_namespace is the Kubernetes namespace in which Argo CD cluster secrets
+# will be created. It must match the namespace where Argo CD is running.
+#
+# By default, `tbot` will use the `POD_NAMESPACE` environment variable, or if
+# that is empty: "default".
+secret_namespace: "argocd"
+
+# secret_name_prefix is the prefix that will be applied to Kubernetes secret
+# names so they can be easily identified. The rest of the name will be derived
+# from a hash of the target cluster name.
+#
+# By default, the prefix will be: "teleport.argocd-cluster".
+secret_name_prefix: "argocd-cluster"
+
+# secret_labels is a set of labels that will be applied to the cluster secrets
+# in addition to the "argocd.argoproj.io/secret-type" label added for Argo CD
+# discovery.
+#
+# Label values can be Go template strings with the following variables:
+#
+#   - {{.ClusterName}} - Name of the Teleport cluster
+#   - {{.KubeName}} - Name of the Kubernetes cluster resource
+#   - {{.Labels}} - Map of labels applied to the Kubernetes cluster
+# 	   resource that can be indexed using `{{index .Labels "key"}}`
+#
+# If the label value is empty, the label will not be added to the secret.
+secret_labels:
+  department: engineering
+  cluster-region: |-
+    {{index .Labels "region"}}
+
+# secret_annotations is a set of annotations that will be applied to the cluster
+# secrets in addition to `tbot`'s own annotations:
+#
+#   - "teleport.dev/bot-name"                - Name of the Bot
+#   - "teleport.dev/kubernetes-cluster-name" - Name of the Kubernetes cluster
+#   - "teleport.dev/updated"                 - RFC3339-formatted timestamp
+#   - "teleport.dev/tbot-version"            - Version of tbot running
+#   - "teleport.dev/teleport-cluster-name"   - Name of the Teleport cluster
+secret_annotations:
+  creator: bob
+
+# project is the Argo CD project with which the Kubernetes clusters will be
+# associated.
+project: edge-services
+
+# namespaces optionally restricts which namespaces within the target Kubernetes
+# clusters applications may be deployed into. By default, all namespaces are
+# allowed.
+namespaces:
+  - dev
+  - qa
+
+# cluster_resources determines whether Argo CD will be allowed to operate on
+# cluster-scoped resources within the target clusters. This option is only
+# applicable when `namespaces` is non-empty.
+cluster_resources: true
+
+# cluster_name_template determines the format of cluster names in Argo CD. It is
+# a Go template string that supports the following variables:
+#
+#   - {{.ClusterName}} - Name of the Teleport cluster
+#   - {{.KubeName}} - Name of the Kubernetes cluster resource
+#
+# By default, the following template will be used: "{{.ClusterName}}-{{.KubeName}}"
+cluster_name_template: "{{.KubeName}}"
+
+# The following configuration fields are available across most output types.
+# Note that `roles` and `destination` are not supported for this output type.
+
+# credential_ttl and renewal_interval override the credential TTL and renewal
+# interval for this specific output, so that you can make its certificates valid
+# for shorter than `tbot`'s internal certificates.
+credential_ttl: 30m
+renewal_interval: 15m
+
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+### `ssh_host`
+
+The `ssh_host` output is used to generate the artifacts required to configure
+an OpenSSH server with Teleport in order to allow Teleport users to connect to
+it.
+
+The output generates the following artifacts:
+- `ssh_host-cert.pub`: an SSH certificate signed by the Teleport host certificate authority.
+- `ssh_host`: the private key associated with the SSH host certificate.
+- `ssh_host-user-ca.pub`: an export of the Teleport user certificate authority in an OpenSSH compatible format.
+
+```yaml
+# type specifies the type of the output. For the ssh host output, this will
+# always be `ssh_host`.
+type: ssh_host
+# principals is the list of host names to include in the host certificates.
+# These names should match the names that clients use to connect to the host.
+principals:
+  - host.example.com
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `workload-identity-x509`
+
+The `workload-identity-x509` output is used to issue an X509 workload identity
+credential and write this to a configured destination.
+
+The output generates the following artifacts:
+
+- `svid.pem`: the X509 SVID.
+- `svid.key`: the private key associated with the X509 SVID.
+- `bundle.pem`: the X509 bundle that contains the trust domain CAs.
+
+See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
+for more information on Workload Identity functionality.
+
+```yaml
+# type specifies the type of the output. For the X509 Workload Identity output,
+# this will always be `workload-identity-x509`.
+type: workload-identity-x509
+(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `workload-identity-jwt`
+
+The `workload-identity-jwt` output is used to issue a JWT workload identity
+credential and write this to a configured destination.
+
+The JWT workload identity credential is compatible with the [SPIFFE JWT SVID
+specification](https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md).
+
+The output generates the following artifacts:
+
+- `jwt_svid`: the JWT SVID.
+
+See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
+for more information on Workload Identity functionality.
+
+```yaml
+# type specifies the type of the output. For the JWT Workload Identity output,
+# this will always be `workload-identity-jwt`.
+type: workload-identity-jwt
+# audiences specifies the values that should be included in the `aud` claim of
+# the JWT. Typically, this identifies the intended recipient of the JWT and
+# contains a single value.
+#
+# At least one audience value must be specified.
+audiences:
+ - example.com
+ - foo.example.com
+(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+### `workload-identity-aws-roles-anywhere`
+
+The `workload-identity-aws-roles-anywhere` output is used to issue an X509
+workload identity credential, exchange this for short-lived AWS credentials
+using Roles Anywhere, and write these to a configured destination.
+
+The credentials are written in the [AWS shared credentials file format](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html#file-format-creds),
+which is compatible with the AWS CLI and SDKs.
+
+The output generates the following artifacts:
+
+- `aws_credentials`: the CLI and SDK compatible AWS shared credentials file.
+
+See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
+for more information on Workload Identity functionality.
+
+```yaml
+# type specifies the type of the output. For the Workload Identity AWS Roles
+# Anywhere output, this will always be `workload-identity-aws-roles-anywhere`.
+type: workload-identity-aws-roles-anywhere
+# The following configuration fields are available across most output types.
+
+# destination specifies where the output should write any generated artifacts
+# such as certificates and configuration files.
+#
+# See the full list of supported destinations and their configuration options
+# under the Destinations section of this reference page.
+destination:
+  type: directory
+  path: /opt/machine-id
+# role_arn is the ARN of the AWS role that the generated credentials should
+# assume.
+# Required.
+role_arn: arn:aws:iam::123456789012:role/example-role
+# profile_arn is the ARN of the AWS profile to be used during the Roles Anywhere
+# exchange.
+# Required.
+profile_arn: arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000
+# trust_anchor_arn is the ARN of the trust anchor that should be used during the
+# Roles Anywhere exchange.
+# Required.
+trust_anchor_arn: arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000
+# region is the AWS region to use for the Roles Anywhere exchange. If omitted,
+# this defaults to the region set by `AWS_REGION` environment variable or the
+# AWS configuration file.
+region: us-east-1
+# session_duration is the duration that the generated AWS credentials should be
+# valid for. This may be up to 12 hours. If omitted, this defaults to 6 hours.
+session_duration: 6h
+# session_renewal_interval is the interval at which the AWS credentials should
+# be renewed. This should be less than the session duration. If omitted, this
+# defaults to 1 hour.
+session_renewal_interval: 1h
+# credential_profile_name is the name of the profile to write to in the AWS
+# credentials file. If unspecified, this profile will be named `default`.
+credential_profile_name: my-profile
+# artifact_name is the name of the file that the AWS credentials should be
+# written to. If unspecified, this defaults to `aws_credentials`.
+artifact_name: my-credentials-file
+# overwrite_credential_file controls whether the AWS credentials file should be
+# overwritten if it already exists, or whether the profile added by tbot should
+# be merged with any existing profiles in the file. If unspecified, this
+# defaults to `false`.
+overwrite_credential_file: false
+(!docs/pages/includes/machine-id/workload-identity-selector-config.yaml!)
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+### `spiffe-svid`
+
+<Admonition type="warning" >
+The use of this service has been deprecated as part of the introduction of the
+new Workload Identity configuration experience. You can replace the use of this
+output with the new `workload-identity-x509` or `workload-identity-jwt` service.
+
+For further information, see [the new Workload Identity configuration experience
+and how to migrate](./workload-identity/configuration-resource-migration.mdx).
+</Admonition>
+
+The `spiffe-svid` output is used to generate a SPIFFE X509 SVID and write this
+to a configured destination.
+
+The output generates the following artifacts:
+- `svid.pem`: the X509 SVID.
+- `svid.key`: the private key associated with the X509 SVID.
+- `bundle.pem`: the X509 bundle that contains the trust domain CAs.
+
+
+An artifact will also be generated for each entry within the `jwts` list. This
+will be named according to `file_name`. This artifact will contain only the
+JWT-SVID with the audience specified in `audience`.
+
+See [Workload Identity](../../machine-workload-identity/workload-identity/introduction.mdx) for more information on how
+to use SPIFFE SVIDs.
+
+```yaml
+# type specifies the type of the output. For the SPIFFE SVID output, this will
+# always be `spiffe-svid`.
+type: spiffe-svid
+# svid specifies the properties of the SPIFFE SVID that should be requested.
+svid:
+  # path specifies what the path element should be requested for the SPIFFE ID.
+  path: /svc/foo
+  # sans specifies optional Subject Alternative Names (SANs) to include in the
+  # generated X509 SVID. If omitted, no SANs are included.
+  sans:
+    # dns specifies the DNS SANs. If omitted, no DNS SANs are included.
+    dns:
+      - foo.svc.example.com
+    # ip specifies the IP SANs. If omitted, no IP SANs are included.
+    ip:
+      - 10.0.0.1
+  # jwts controls the output of JWT-SVIDs. Each entry will be generated as a
+  # separate artifact. If omitted, no JWT-SVIDs are generated.
+  jwts:
+      # audience specifies the audience that the JWT-SVID should be issued for.
+      # this typically identifies the service that the JWT-SVID will be used to
+      # authenticate to.
+    - audience: https://example.com
+      # file_name specifies the name of the file that the JWT-SVID should be
+      # written to.
+      file_name: example-jwt
+
+(!docs/pages/includes/machine-id/common-output-config.yaml!)
+```
+
+## Services
+
+Services are configurable long-lived components that run within `tbot`. Unlike
+Outputs, they may not necessarily generate artifacts. Typically, services
+provide supporting functionality for machine to machine access, for example,
+opening tunnels or providing APIs.
+
+### `workload-identity-api`
+
+The `workload-identity-api` services opens a listener that provides a local
+workload identity API, intended to serve workload identity credentials
+(e.g X509/JWT SPIFFE SVIDs) to workloads running on the same host.
+
+For more information about this, see the
+[Workload Identity API and Workload Attestation reference](./workload-identity/workload-identity-api-and-workload-attestation.mdx)
+
+The `workload-identity-api` service will not start if `tbot` has been configured
+to run in one-shot mode.
+
+### `spiffe-workload-api`
+
+<Admonition type="warning" >
+The use of this service has been deprecated as part of the introduction of the
+new Workload Identity configuration experience. You can replace the use of this
+service with the new `workload-identity-api` service.
+
+For further information, see [the new Workload Identity configuration experience
+and how to migrate](./workload-identity/configuration-resource-migration.mdx).
+</Admonition>
+
+The `spiffe-workload-api` service opens a listener for a service that implements
+the SPIFFE Workload API. This service is used to provide SPIFFE SVIDs to
+workloads.
+
+See [Workload Identity](../../machine-workload-identity/workload-identity/introduction.mdx) for more information on the
+SPIFFE Workload API.
+
+```yaml
+# type specifies the type of the service. For the SPIFFE Workload API service,
+# this will always be `spiffe-workload-api`.
+type: spiffe-workload-api
+# listen specifies the address that the service should listen on.
+#
+# Two types of listener are supported:
+# - TCP: `tcp://<address>:<port>`
+# - Unix socket: `unix:///<path>`
+listen: unix:///opt/machine-id/workload.sock
+# attestors allows Workload Attestation to be configured for this Workload
+# API.
+attestors:
+  # docker is configuration for the Docker Workload Attestor. See the Workload
+  # Identity API & Workload Attestation reference for more information.
+  docker:
+    # enabled specifies whether the workload's identity should be attested with
+    # information about its Docker container. If unspecified, this defaults to
+    # false.
+    enabled: true
+    # addr is the address at which the Docker Engine daemon can be reached. It
+    # must be in the form `unix://path/to/socket`, as connecting via TCP is not
+    # currently supported. If unspecified, this defaults to the standard socket
+    # location for "rootful" Docker installations: `unix:///var/run/docker.sock`.
+    addr: unix:///var/run/docker.sock
+  # kubernetes is configuration for the Kubernetes Workload Attestor. See
+  # the Kubernetes Workload Attestor section for more information.
+  kubernetes:
+    # enabled specifies whether the Kubernetes Workload Attestor should be
+    # enabled. If unspecified, this defaults to false.
+    enabled: true
+    # kubelet holds configuration relevant to the Kubernetes Workload Attestors
+    # interaction with the Kubelet API.
+    kubelet:
+      # read_only_port is the port on which the Kubelet API is exposed for
+      # read-only operations. Since Kubernetes 1.16, the read-only port is
+      # typically disabled by default and secure_port should be used instead.
+      read_only_port: 10255
+      # secure_port is the port on which the attestor should connect to the
+      # Kubelet secure API. If unspecified, this defaults to `10250`. This is
+      # mutually exclusive with ReadOnlyPort.
+      secure_port: 10250
+      # token_path is the path to the token file that the Kubelet API client
+      # should use to authenticate with the Kubelet API. If unspecified, this
+      # defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+      token_path: "/var/run/secrets/kubernetes.io/serviceaccount/token"
+      # ca_path is the path to the CA file that the Kubelet API client should
+      # use to validate the Kubelet API server's certificate. If unspecified,
+      # this defaults to `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+      ca_path: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+      # skip_verify is used to disable verification of the Kubelet API server's
+      # certificate. If unspecified, this defaults to false.
+      #
+      # If specified, the value specified in ca_path is ignored.
+      #
+      # This is useful in cases where the Kubelet API server has not been issued
+      # with a certificate signed by the Kubernetes cluster's CA. This is fairly
+      # common with a number of Kubernetes distributions.
+      skip_verify: true
+      # anonymous is used to disable authentication with the Kubelet API. If
+      # unspecified, this defaults to false. If set, the token_path field is
+      # ignored.
+      anonymous: false
+  # podman is configuration for the Podman Workload Attestor. See the Workload
+  # Identity API & Workload Attestation reference for more information.
+  podman:
+    # enabled specifies whether the workload's identity should be attested with
+    # information about its Podman container and pod. If unspecified, this
+    # defaults to false.
+    enabled: true
+    # addr is the address at which the Podman API Service can be reached. It
+    # must be in the form `unix://path/to/socket`, as connecting via TCP is not
+    # supported. This field is required and there is no default value. See the
+    # Workload Identity API & Workload Attestation reference for more information.
+    addr: unix:///run/podman/podman.sock
+  # sigstore is configuration for the Sigstore Workload attestor. See the
+  # Sigstore Workload Attestation page for more information.
+  sigstore:
+    # enabled specifies whether tbot will discover Sigstore signatures for the
+    # workload's container image. If unspecified, this defaults to false.
+    enabled: true
+    # additional_registries optionally configures the OCI registries that will
+    # be searched for signatures in addition to the workload container image's
+    # source registry.
+    additional_registries:
+      -
+        # host of the OCI registry.
+        host: ghcr.io
+    # credentials_path is the path to a Docker or Podman configuration file
+    # containing per-registry credentials.
+    credentials_path: /path/to/docker/config.json
+    # allowed_private_network_prefixes are the private IP address prefixes (CIDR
+    # blocks) that the Sigstore attestor is allowed to connect to. By default,
+    # tbot will only connect to registries at publicly-routable IP addresses to
+    # reduce the surface area for SSRF attacks.
+    allowed_private_network_prefixes:
+      - "192.168.1.42/32"
+      - "fd12:3456:789a:1::1/128"
+  # systemd is configuration for the Systemd Workload Attestor. See the Workload
+  # Identity API & Workload Attestation reference for more information.
+  systemd:
+    # enabled specifies whether the workload's identity should be attested with
+    # information about its Systemd service. If unspecified, this defaults to
+    # false.
+    enabled: true
+  # unix is configuration for the Unix Workload Attestor.
+  unix:
+    # binary_hash_max_size_bytes is the maximum number of bytes that will be
+    # read from a process' binary to calculate its SHA-256 checksum. If the
+    # binary is larger than this, the `workload.unix.binary_hash` attribute
+    # will be empty. If unspecified, this defaults to 1GiB. Set it to -1 to
+    # make it unlimited.
+    binary_hash_max_size_bytes: 1024
+# svids specifies the SPIFFE SVIDs that the Workload API should provide.
+svids:
+    # path specifies what the path element should be requested for the SPIFFE
+    # ID.
+  - path: /svc/foo
+    # hint is a free-form string which can be used to help workloads determine
+    # which SVID to select when multiple are available. If omitted, no hint is
+    # included.
+    hint: my-hint
+    # sans specifies optional Subject Alternative Names (SANs) to include in the
+    # generated X509 SVID. If omitted, no SANs are included.
+    sans:
+      # dns specifies the DNS SANs. If omitted, no DNS SANs are included.
+      dns:
+        - foo.svc.example.com
+      # ip specifies the IP SANs. If omitted, no IP SANs are included.
+      ip:
+        - 10.0.0.1
+    # rules specifies a list of workload attestation rules. At least one of
+    # these rules must be satisfied by the workload in order for it to receive
+    # this SVID.
+    #
+    # If no rules are specified, the SVID will be issued to all workloads that
+    # connect to this service.
+    rules:
+        # unix is a group of workload attestation criteria that are available
+        # when the workload is running on the same host, and is connected to
+        # the Workload API using a Unix socket.
+        #
+        # If any of the criteria in this group are specified, then workloads
+        # that do not connect using a Unix socket will not receive this SVID.
+      - unix:
+          # uid is the ID of the user that the workload process must be running
+          # as to receive this SVID.
+          #
+          # If unspecified, the UID is not checked.
+          uid: 1000
+          # pid is the ID that the workload process must have to receive this
+          # SVID.
+          #
+          # If unspecified, the PID is not checked.
+          pid: 1234
+          # gid is the ID of the primary group that the workload process must be
+          # running as to receive this SVID.
+          #
+          # If unspecified, the GID is not checked.
+          gid: 50
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+#### Envoy SDS
+
+The `spiffe-workload-api` service endpoint also implements the Envoy SDS API.
+This allows it to act as a source of certificates and certificate authorities
+for the Envoy proxy.
+
+As a forward proxy, Envoy can be used to attach an X.509 SVID to an outgoing
+connection from a workload that is not SPIFFE-enabled.
+
+As a reverse proxy, Envoy can be used to terminate mTLS connections from
+SPIFFE-enabled clients. Envoy can validate that the client has presented a valid
+X.509 SVID and perform enforcement of authorization policies based on the SPIFFE
+ID contained within the SVID.
+
+When acting as a reverse proxy for certain protocols, Envoy can be configured
+to attach a header indicating the identity of the client to a request before
+forwarding it to the service. This can then be used by the service to make
+authorization decisions based on the client's identity.
+
+When configuring Envoy to use the SDS API exposed by the `spiffe-workload-api`
+service, three additional special names can be used to aid configuration:
+
+- `default`: `tbot` will return the default SVID for the workload.
+- `ROOTCA`: `tbot` will return the trust bundle for the trust domain that the
+workload is a member of.
+- `ALL`: `tbot` will return the trust bundle for the trust domain that the
+workload is a member of, as well as the trust bundles of any trust domain
+that the trust domain is federated with.
+
+The following is an example Envoy configuration that sources a certificate
+and trust bundle from the `spiffe-workload-api` service listening on
+`unix:///opt/machine-id/workload.sock`. It requires that a connecting client
+presents a valid SPIFFE SVID and forwards this information to the backend
+service in the `x-forwarded-client-cert` header.
+
+```yaml
+node:
+  id: "my-envoy-proxy"
+  cluster: "my-cluster"
+static_resources:
+  listeners:
+    - name: test_listener
+      enable_reuse_port: false
+      address:
+        socket_address:
+          address: 0.0.0.0
+          port_value: 8080
+      filter_chains:
+        - filters:
+            - name: envoy.filters.network.http_connection_manager
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                common_http_protocol_options:
+                  idle_timeout: 1s
+                forward_client_cert_details: sanitize_set
+                set_current_client_cert_details:
+                  uri: true
+                stat_prefix: ingress_http
+                route_config:
+                  name: local_route
+                  virtual_hosts:
+                    - name: my_service
+                      domains: ["*"]
+                      routes:
+                        - match:
+                            prefix: "/"
+                          route:
+                            cluster: my_service
+                http_filters:
+                  - name: envoy.filters.http.router
+                    typed_config:
+                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          transport_socket:
+            name: envoy.transport_sockets.tls
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+              common_tls_context:
+                # configure the certificate that the reverse proxy should present.
+                tls_certificate_sds_secret_configs:
+                  # `name` can be replaced with the desired SPIFFE ID if  multiple
+                  # SVIDs are available.
+                  - name: "default"
+                    sds_config:
+                      resource_api_version: V3
+                      api_config_source:
+                        api_type: GRPC
+                        transport_api_version: V3
+                        grpc_services:
+                          envoy_grpc:
+                            cluster_name: tbot_agent
+                # combined validation context "melds" two validation contexts
+                # together. This is handy for extending the validation context
+                # from the SDS source.
+                combined_validation_context:
+                  default_validation_context:
+                    # You can use match_typed_subject_alt_names to configure
+                    # rules that only allow connections from specific SPIFFE IDs.
+                    match_typed_subject_alt_names: []
+                  validation_context_sds_secret_config:
+                    name: "ALL" # This can also be replaced with the trust domain name
+                    sds_config:
+                      resource_api_version: V3
+                      api_config_source:
+                        api_type: GRPC
+                        transport_api_version: V3
+                        grpc_services:
+                          envoy_grpc:
+                            cluster_name: tbot_agent
+  clusters:
+    # my_service is the example service that Envoy will forward traffic to.
+    - name: my_service
+      type: strict_dns
+      load_assignment:
+        cluster_name: my_service
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: 127.0.0.1
+                      port_value: 8090
+    - name: tbot_agent
+      http2_protocol_options: {}
+      load_assignment:
+        cluster_name: tbot_agent
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    pipe:
+                      # Configure the path to the socket that `tbot` is
+                      # listening on.
+                      path: /opt/machine-id/workload.sock
+```
+
+### `database-tunnel`
+
+The `database-tunnel` service opens a listener for a service that tunnels
+connections to a database server.
+
+The tunnel authenticates connections for the client, meaning that any
+application which can connect to the listener will be able to connect to the
+database as the specified user. For this reason, we heavily recommend using the
+Unix socket listener type and configuring the permissions of the socket to
+ensure that only the intended applications can connect.
+
+```yaml
+# type specifies the type of the service. For the database tunnel service, this
+# will always be `database-tunnel`.
+type: database-tunnel
+# listen specifies the address that the service should listen on.
+#
+# Two types of listener are supported:
+# - TCP: `tcp://<address>:<port>`
+# - Unix socket: `unix:///<path>`
+listen: tcp://127.0.0.1:25432
+# service is the name of the database server, as configured in Teleport, that
+# the service should open a tunnel to.
+service: postgres-docker
+# database is the name of the specific database on the specified database
+# service.
+database: postgres
+# username is the name of the user on the specified database server to open a
+# tunnel for.
+username: postgres
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+The `database-tunnel` service will not start if `tbot` has been configured
+to run in one-shot mode.
+
+### `application-tunnel`
+
+The `application-tunnel` service opens a listener that tunnels connections to
+an application in Teleport. It supports both HTTP and TCP applications. This is
+useful for applications which cannot be configured to use client certificates,
+when using TCP application or where using a L7 load-balancer in front of your
+Teleport proxies.
+
+The tunnel authenticates connections for the client, meaning that any
+client that connects to the listener will be able to access the application.
+For this reason, ensure that the listener is only accessible by the intended
+clients by using the Unix socket listener or binding to `127.0.0.1`.
+
+```yaml
+# type specifies the type of the service. For the application tunnel service,
+# this will always be `application-tunnel`.
+type: application-tunnel
+# listen specifies the address that the service should listen on.
+#
+# Two types of listener are supported:
+# - TCP: `tcp://<address>:<port>`
+# - Unix socket: `unix:///<path>`
+listen: tcp://127.0.0.1:8084
+# app_name is the name of the application, as configured in Teleport, that
+# the service should open a tunnel to.
+app_name: my-application
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+The `application-tunnel` service will not start if `tbot` has been configured
+to run in one-shot mode.
+
+### `ssh-multiplexer`
+
+The `ssh-multiplexer` service opens a listener for a high-performance local
+SSH multiplexer. This is designed for use-cases which create a large number
+of SSH connections using Teleport, for example, Ansible.
+
+This differs to using `identity` output for SSH in a few ways:
+
+- The `tbot` instance running the `ssh-multiplexer` service must be running on
+  the same host as the SSH client.
+- The `ssh-multiplexer` service is designed to be a long-running background
+  service and cannot be used in one-shot mode. It must be running in order for
+  SSH connections to be established and to continue running.
+- Resource consumption is significantly reduced by multiplexing SSH connections
+  through a fewer number of upstream connections to the Teleport Proxy Service.
+- It's possible to configure the `ssh-multiplexer` service to connect to SSH
+  servers through a [Teleport Relay](../architecture/relay.mdx).
+
+Additionally, the `ssh-multiplexer` opens a socket that implements the SSH
+agent protocol. This allows the SSH client to authenticate without writing the
+sensitive private key to disk.
+
+By default, the `ssh-multiplexer` service outputs an `ssh_config` which uses
+`tbot` itself as the ProxyCommand. You can further reduce the resource
+consumption of SSH connections by installing and specifying the
+`fdpass-teleport` binary.
+
+```yaml
+# type specifies the type of the service. For the SSH multiplexer
+type: ssh-multiplexer
+# destination specifies where the tunnel should be opened and any artifacts
+# should be written. It must be of type `directory`.
+destination:
+  type: directory
+  path: /foo
+# enable_resumption specifies whether the multiplexer should negotiate
+# session resumption. This allows SSH connections to survive network
+# interruptions. It does increase the memory resources used per connection.
+#
+# If unspecified, this defaults to true.
+enable_resumption: true
+# proxy_command specifies the command that should be used as the ProxyCommand
+# in the generated SSH configuration.
+#
+# If unspecified, the ProxyCommand will be the currently running binary of tbot
+# itself.
+proxy_command:
+  - /usr/local/bin/fdpass-teleport
+# proxy_templates_path specifies a path to a proxy templates configuration file
+# which should be used when resolving the Teleport node to connect to. This
+# file must be accessible by the long-lived tbot process running the
+# ssh-multiplexer.
+#
+# If unspecified, proxy templates will not be used.
+proxy_templates_path: /etc/my-proxy-templates.yaml
+# relay_server specifies the Relay service address that tbot should use to route
+# SSH traffic instead of going through the Teleport control plane. When set, all
+# SSH connections are sent via this Relay; only servers reachable through the
+# specified Relay will be accessible and tbot will not fall back to the control
+# plane. Provide either a hostname or host:port (e.g. relay.example.com or
+# relay.example.com:443).
+#
+# Use of the relay_server option requires `tbot` 18.3.0 or later.
+relay_server: relay.example.com
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+Once configured, `tbot` will create the following artifacts in the specified
+destination:
+
+- `ssh_config`: an SSH configuration file that will configure OpenSSH to use
+   the multiplexer and agent.
+- `known_hosts`: the known hosts file that will be used by OpenSSH to validate
+   a server's identity.
+- `v1.sock`: the Unix socket that the multiplexer listens on.
+- `agent.sock`: the Unix socket that the SSH agent listens on.
+
+The `ssh-multiplexer` service will not start if `tbot` has been configured
+to run in one-shot mode.
+
+#### Using the SSH multiplexer programmatically
+
+To use the SSH multiplexer programmatically, your SSH client library will need
+to support one of two things:
+
+- The ability to use a ProxyCommand with FDPass. If so, you can use the
+  `ssh_config` file generated by `tbot` to configure the SSH client.
+- The ability to accept an open socket to use as the connection to the SSH
+  server. You will then need to manually connect to the socket and send the
+  multiplexer request.
+
+The `v1.sock` Unix Domain Socket implements the V1 Teleport SSH multiplexer
+protocol. The client must first send a short request message to indicate the
+desired target host and port, terminated with a null byte. The multiplexer will
+then begin to forward traffic to the target host and port. The client can then
+make an SSH connection.
+
+<details>
+<summary>Example in Python (Paramiko)</summary>
+```python
+import os
+import paramiko
+import socket
+
+host = "ubuntu.example.teleport.sh"
+username = "root"
+port = 3022
+directory_destination = "/opt/machine-id"
+
+# Connect to Mux Unix Domain Socket
+sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+sock.connect(os.path.join(directory_destination, "v1.sock"))
+# Send the connection request specifying the server you wish to connect to
+sock.sendall(f"{host}:{port}\x00".encode("utf-8"))
+
+# We must set the env var as Paramiko does not make this configurable...
+os.environ["SSH_AUTH_SOCK"] = os.path.join(directory_destination, "agent.sock")
+
+ssh_config = paramiko.SSHConfig()
+with open(os.path.join(directory_destination, "ssh_config")) as f:
+    ssh_config.parse(f)
+
+ssh_client = paramiko.SSHClient()
+
+# Paramiko does not support known_hosts with CAs: https://github.com/paramiko/paramiko/issues/771
+# Therefore, we must disable host key checking
+ssh_client.set_missing_host_key_policy(paramiko.WarningPolicy())
+
+ssh_client.connect(
+    hostname=host,
+    port=port,
+    username=username,
+    sock=sock
+)
+
+stdin, stdout, stderr = ssh_client.exec_command("hostname")
+print(stdout.read().decode())
+```
+</details>
+
+<details>
+<summary>Example in Go</summary>
+```go
+package main
+
+import (
+    "fmt"
+    "net"
+    "path/filepath"
+
+    "golang.org/x/crypto/ssh"
+    "golang.org/x/crypto/ssh/agent"
+    "golang.org/x/crypto/ssh/knownhosts"
+)
+
+func main() {
+    host := "ubuntu.example.teleport.sh"
+    username := "root"
+    directoryDestination := "/opt/machine-id"
+
+    // Setup Agent and Known Hosts
+    agentConn, err := net.Dial(
+        "unix", filepath.Join(directoryDestination, "agent.sock"),
+    )
+    if err != nil {
+        panic(err)
+    }
+    defer agentConn.Close()
+    agentClient := agent.NewClient(agentConn)
+    hostKeyCallback, err := knownhosts.New(
+        filepath.Join(directoryDestination, "known_hosts"),
+    )
+    if err != nil {
+        panic(err)
+    }
+
+    // Create SSH Config
+    sshConfig := &ssh.ClientConfig{
+        Auth: []ssh.AuthMethod{
+            ssh.PublicKeysCallback(agentClient.Signers),
+        },
+        User:            username,
+        HostKeyCallback: hostKeyCallback,
+    }
+
+    // Dial Unix Domain Socket and send multiplexing request
+    conn, err := net.Dial(
+        "unix", filepath.Join(directoryDestination, "v1.sock"),
+    )
+    if err != nil {
+        panic(err)
+    }
+    defer conn.Close()
+    _, err = fmt.Fprint(conn, fmt.Sprintf("%s:0\x00", host))
+    if err != nil {
+        panic(err)
+    }
+
+    sshConn, sshChan, sshReq, err := ssh.NewClientConn(
+        conn,
+        // Port here doesn't matter because Multiplexer has already established
+        // connection.
+        fmt.Sprintf("%s:22", host),
+        sshConfig,
+    )
+    if err != nil {
+        panic(err)
+    }
+    sshClient := ssh.NewClient(sshConn, sshChan, sshReq)
+    defer sshClient.Close()
+
+    sshSess, err := sshClient.NewSession()
+    if err != nil {
+        panic(err)
+    }
+    defer sshSess.Close()
+
+    out, err := sshSess.CombinedOutput("hostname")
+    if err != nil {
+        panic(err)
+    }
+    fmt.Println(string(out))
+}
+```
+</details>
+
+### `application-proxy`
+
+The `application-proxy` service opens a listener serving an HTTP proxy that
+forwards requests to HTTP applications enrolled in Teleport. It handles the
+process of attaching the necessary client certificate to the upstream connection
+on the behalf of the client.
+
+Unlike the `application-tunnel` service, which is explicitly bound to a specific
+application, the `application-proxy` service dynamically routes requests to the
+correct application. This makes it more suitable for use-cases where a client
+must connect to a large number of applications enrolled in Teleport,
+for example, for scraping Prometheus metric endpoints through Teleport.
+
+The proxy authenticates connections for the client, meaning that any client that
+connects to the listener will be able to access applications through Teleport.
+For this reason, ensure that the listener is only accessible by the intended
+clients by using the Unix socket listener or binding to `127.0.0.1`.
+
+```yaml
+# type specifies the type of the service. For the application proxy service,
+# this will always be `application-proxy`.
+type: application-proxy
+# listen specifies the address that the service should listen on.
+#
+# Two types of listener are supported:
+# - TCP: `tcp://<address>:<port>`
+# - Unix socket: `unix:///<path>`
+listen: tcp://127.0.0.1:8080
+# name optionally overrides the name of the service used in logs and the `/readyz`
+# endpoint. It must only contain letters, numbers, hyphens, underscores, and plus
+# symbols.
+name: my-service-name
+```
+
+The `application-proxy` service will not start if `tbot` has been configured
+to run in one-shot mode.
+
+#### Limitations
+
+There are a number of limitations in the initial implementation of the
+`application-proxy` to be aware of:
+
+- Only HTTP applications are supported. TCP applications are not supported at
+  this time.
+- Only HTTP/1 and HTTP/1.1 are supported. HTTP/2 is not supported at this time.
+
+If these limitations are problematic, consider using the `application-tunnel`
+service instead, or, reach out to the Teleport team to discuss your use-case.
+
+#### Using the application proxy
+
+The listener exposed by the `application-proxy` service is compatible with a
+wide range of HTTP clients and libraries. How this is configured will depend on
+the client or library being used. For many clients, this is possible using the
+`http_proxy` environment variable.
+
+When using the `application-proxy`, either the `Host` header or authority
+specified within a request's target URI must match the name of the application
+as enrolled within Teleport.
+
+For example, using `curl` to access the HTTP application enrolled in Teleport
+called `my-app`:
+
+```bash
+curl --proxy localhost:8080 http://my-app/example
+````
+
+## Destinations
+
+A destination is somewhere that `tbot` can read and write artifacts.
+
+Destinations are used in two places in the `tbot` configuration:
+
+- Specifying where `tbot` should store its internal state.
+- Specifying where an output should write its generated artifacts.
+
+Destinations come in multiple types. Usually, the `directory` type is the most
+appropriate.
+
+### `directory`
+
+The `directory` destination type stores artifacts as files in a specified
+directory.
+
+```yaml
+# type specifies the type of the destination. For the directory destination,
+# this will always be `directory`.
+type: directory
+
+# path specifies the path to the directory that this destination should write
+# to. This directory should already exist, or `tbot init` should be used to
+# create it with the correct permissions.
+path: /opt/machine-id
+
+# symlinks configures the behaviour of symlink attack prevention.
+# Requires Linux 5.6+.
+# Supported values:
+#   * try-secure (default): Attempt to securely read and write certificates
+#     without symlinks, but fall back (with a warning) to insecure read
+#     and write if the host doesn't support this.
+#   * secure: Attempt to securely read and write certificates, with a hard error
+#     if unsupported.
+#   * insecure: Quietly allow symlinks in paths.
+symlinks: try-secure
+
+# acls configures whether Linux Access Control List (ACL) setup should occur for
+# this destination.
+# Requires Linux with a file system that supports ACLs.
+# Supported values:
+#   * try (default on Linux): Attempt to use ACLs, warn at runtime if ACLs
+#     are configured but invalid.
+#   * off (default on non-Linux): Do not attempt to use ACLs.
+#   * required: Always use ACLs, produce a hard error at runtime if ACLs
+#     are invalid.
+acls: try
+
+# readers is a list of users and groups that will be allowed by ACL to access
+# this directory output. The `acls` parameter must be either `try` or
+# `required`. File ACLs will be monitored and corrected at runtime to ensure
+# they match this configuration.
+# Individual entries may either specify `user` or `group`, but not both. `user`
+# accepts an existing named user or a UID, and `group` accepts an existing named
+# group or GID. UIDs and GIDs do not necessarily need to exist on the local
+# system.
+# An empty list of readers disables runtime ACL management.
+readers:
+- user: teleport
+- user: 123
+- group: teleport
+- group: 456
+```
+
+### `memory`
+
+The `memory` destination type stores artifacts in the process memory. When
+the process exits, nothing is persisted. This destination type
+is most suitable for ephemeral environments, but can also be used for testing.
+
+Configuration:
+
+```yaml
+# type specifies the type of the destination. For the memory destination, this
+# will always be `memory`.
+type: memory
+```
+
+### `kubernetes_secret`
+
+The `kubernetes_secret` destination type stores artifacts in a Kubernetes
+secret. This allows them to be mounted into other containers deployed in
+Kubernetes.
+
+Prerequisites:
+
+- `tbot` must be running in Kubernetes with at most one replica. If using a
+  `deployment`, then the `Recreate` strategy must be used to ensure only one
+  instance exists at any time. This is because multiple `tbot` agents configured
+  with the same secret will compete to write to the secret and it may be left
+  in an inconsistent state or the `tbot` agents may fail to write.
+- The `tbot` pod must be configured with a service account that allows it to
+  read and write from the configured secret.
+- The `POD_NAMESPACE` environment variable must be configured with the
+  name of the namespace that `tbot` is running in. This is best achieved with
+  the [Downward API](https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/).
+
+There is no requirement that the secret already exists, one will be created
+if it does not exist. If a secret already exists, `tbot` will overwrite any
+other keys within the secret.
+
+Configuration:
+
+```yaml
+# type specifies the type of the destination. For the kubernetes_secret
+# destination, this will always be `kubernetes_secret`.
+type: kubernetes_secret
+# name specifies the name of the Kubernetes Secret to write the artifacts to.
+name: my-secret
+# namespace specifies the Kubernetes namespace that the secret should be written
+# to. If unspecified, this defaults to the value of the `POD_NAMESPACE`
+# environment variable.
+#
+# When using the Helm chart, and specifying a namespace other than the one that
+# `tbot` is running in, you must manually grant the `tbot` service account
+# privileges to read and write to secrets in that namespace.
+namespace: default
+# labels specifies the labels to apply to the Kubernetes Secret. This field is
+# optional.
+labels:
+  example: "foo"
+```
+
+## Bot resource
+
+The `bot` resource is used to manage Machine & Workload Identity Bots. It is
+used to configure the access that is granted to a Bot.
+
+(!docs/pages/includes/machine-id/bot-spec.mdx!)
+
+You can apply a file containing YAML that defines a `bot` resource using
+`tctl create -f ./bot.yaml`.
diff --git a/docs/pages/reference/machine-workload-identity/diagnostics-service.mdx b/docs/pages/reference/machine-workload-identity/diagnostics-service.mdx
new file mode 100644
index 0000000000000..588eefb7fe0b1
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/diagnostics-service.mdx
@@ -0,0 +1,184 @@
+---
+title: Diagnostics Service
+description: Reference information for the `tbot` diagnostics service.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+The `tbot` process can optionally expose a diagnostics service. This is
+disabled by default, but once enabled, allows useful information about the
+running `tbot` process to be queried via HTTP.
+
+## Configuration
+
+To enable the diagnostics service, you must specify an address and port for
+it to listen on.
+
+For security reasons, you should ensure that access to this listener is
+restricted. In most cases, the most secure thing to do is to bind the listener
+to `127.0.0.1`, which will only allow access from the local machine.
+
+You can configure the diagnostics service using the `--diag-addr` CLI parameter:
+
+```code
+$ tbot start -c my-config.yaml --diag-addr 127.0.0.1:3001
+```
+
+Or directly within the configuration file using `diag_addr`:
+
+```yaml
+diag_addr: 127.0.0.1:3001
+```
+
+## Endpoints
+
+The diagnostics service exposes the following HTTP endpoints.
+
+### `/livez`
+
+The `/livez` endpoint always returns with a 200 status code. This can be used
+to determine if the `tbot` process is running and has not crashed or hung.
+
+If deploying to Kubernetes, we recommend this endpoint is used for your
+Liveness Probe.
+
+### `/readyz` and `/readyz/{service}`
+
+The `/readyz` endpoint returns the overall health of `tbot`, including all of
+its internal and user-defined services. If all services are healthy, it will
+respond with a 200 status code. If any service is unhealthy, it will respond
+with a 503 status code.
+
+```code
+$ curl -v http://127.0.0.1:3001/readyz
+
+HTTP/1.1 503 Service Unavailable
+Content-Type: application/json
+
+{
+  "status": "unhealthy",
+  "services": {
+    "ca-rotation": {
+      "status": "healthy"
+    },
+    "heartbeat": {
+      "status": "healthy"
+    },
+    "identity": {
+      "status": "healthy"
+    },
+    "aws-roles-anywhere": {
+      "status": "unhealthy",
+      "reason": "access denied to perform action \"read\" on \"workload_identity\""
+    }
+  },
+  "pid": 42344
+}
+```
+
+If deploying to Kubernetes, we recommend this endpoint is used for your
+Readiness Probe.
+
+You can also use the `/readyz/{service}` endpoint to query the health of a
+specific service.
+
+```code
+$ curl -v http://127.0.0.1:3001/readyz/aws-roles-anywhere
+
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+  "status": "healthy"
+}
+```
+
+By default, `tbot` generates service names based on their type (e.g.
+`application-output-1`). You can override this by providing your own name in the
+`tbot` configuration file.
+
+```yaml
+services:
+  - type: identity
+    name: my-service-123
+```
+
+### `/metrics`
+
+The `/metrics` endpoint returns a Prometheus-compatible metrics snapshot.
+
+See [Prometheus Metrics](#prometheus-metrics) below for more information.
+
+### `/debug/pprof`
+
+These endpoints allow the collection of pprof profiles for debugging purposes.
+You may be asked by a Teleport engineer to collect these if you are experiencing
+performance issues.
+
+They will only be enabled if the `-d`/`--debug` flag is provided when starting
+`tbot`. This is known as **debug mode**.
+
+## Prometheus metrics
+
+The `tbot` process exposes a number of Prometheus metrics via the `/metrics`
+endpoint of the diagnostics service.
+
+In addition to exporting the standard Go runtime metrics, `tbot` also exports
+custom metrics that reflect the health and performance of the various
+configurable services.
+
+## Advice
+
+When monitoring the health of `tbot`, there are three categories of metrics you
+should consider:
+
+- The health of the `tbot` process itself. For example, how much CPU time and
+  memory is it using? These can be strong indicators of overall health and
+  provide early warning signs of potential issues (e.g. memory leaks).
+- The health of the internal services that `tbot` relies on. For example, has
+  `tbot` been able to successfully renew its internal identity? If these
+  internal services have become unhealthy, then it is likely that user-defined
+  services within `tbot` will also become unhealthy.
+- The health of the services you configured within `tbot`. This will indicate
+  whether `tbot` has been able to successfully perform its intended functions.
+
+For monitoring the health of the `tbot` process itself, a large number of
+metrics are provided by the Go runtime.
+
+For monitoring the health of internal and user-defined services, there are
+two key metrics:
+
+- `tbot_task_iterations_failed`: the total number of task iterations that have
+  failed. This will have a `service` label indicating which service within the
+  `tbot` process the task belongs to.
+- `tbot_task_iterations_successful`: the total number of task iterations that
+  have succeeded. This will also have a `service` label. This metric is a
+  histogram, and will also indicate the number of retries that were required
+  before the task succeeded. For a perfectly healthy service, you would expect
+  this number of retries to be zero, or close to zero.
+
+## Metrics
+
+### Generic
+
+These metrics are generated by more than one service within `tbot` or may be
+generated by the core supervisor within `tbot` itself.
+
+| Name                                    | Description                                                                                                                                                                                                                                        |
+|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `tbot_task_iterations_total`            | The total number of task iterations that have been performed. This will have a `service` and `name` label to specify which task.                                                                                                                   |
+| `tbot_task_iterations_failed`           | The total number of task iterations that have failed. This will have a `service` and `name` label to specify which task.                                                                                                                           |
+| `tbot_task_iterations_successful`       | The total number of task iterations that have succeeded. This will have a `service` and `name` label to specify which task. This metric is a histogram, and will also indicate the number of retries that were required before the task succeeded. |
+| `tbot_task_iterations_duration_seconds` | The duration of the time taken to perform an iteration of the task. This will have a `service` and `name` label to specify which task. This metric is a histogram.                                                                                 |
+
+### `ssh-multiplexer`
+
+These metrics are generated by the SSH multiplexer service.
+
+| Name                                          | Description                                                                                                                                                                   |
+|-----------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `tbot_ssh_multiplexer_requests_started_total` | The total number of SSH multiplexing requests that have been started.                                                                                                         |
+| `tbot_ssh_multiplexer_requests_handled_total` | The total number of SSH multiplexing requests that have completed. The `status` label indicates whether the request completed successfully (`OK`) or with an error (`ERROR`). |
+| `tbot_ssh_multiplexer_requests_in_flight`     | The number of SSH multiplexing requests that are currently in progress.                                                                                                       |
+
diff --git a/docs/pages/reference/machine-workload-identity/machine-workload-identity.mdx b/docs/pages/reference/machine-workload-identity/machine-workload-identity.mdx
new file mode 100644
index 0000000000000..70c77af0f6aff
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/machine-workload-identity.mdx
@@ -0,0 +1,10 @@
+---
+title: 'Machine & Workload Identity References'
+sidebar_label: Machine & Workload Identity
+description: 'Includes comprehensive guides to tools for managing Teleport Machine & Workload Identity'
+---
+
+This section includes comprehensive reference documentation for the tools you
+can use to manage Teleport Machine & Workload Identity.
+
+<DocCardList />
diff --git a/docs/pages/reference/machine-id/telemetry.mdx b/docs/pages/reference/machine-workload-identity/telemetry.mdx
similarity index 76%
rename from docs/pages/reference/machine-id/telemetry.mdx
rename to docs/pages/reference/machine-workload-identity/telemetry.mdx
index 510f7a38d63ef..a4ea25d59e688 100644
--- a/docs/pages/reference/machine-id/telemetry.mdx
+++ b/docs/pages/reference/machine-workload-identity/telemetry.mdx
@@ -1,19 +1,22 @@
 ---
 title: Telemetry
-description: An explanation of the telemetry collected by Machine ID
+description: An explanation of the telemetry collected by Machine & Workload Identity
+tags:
+ - conceptual
+ - mwi
 ---
 
-This document explains what telemetry is collected by the Machine ID `tbot`
-agent, why we want to collect this telemetry and, how to opt in or out.
+This document explains what telemetry is collected by the `tbot` agent, why we
+want to collect this telemetry and, how to opt in or out.
 
 ## Why?
 
-Machine ID is an emerging part of the Teleport product and it's helpful for us
-to be able to identify the kinds of use-cases people have. This allows us to
-prioritise more common usages. Whilst we try to collect this sort of information
-by talking to users directly, having a more general overview of the product in
-the wild helps us make even more informed decisions and avoid our decisions
-being solely influenced by a select few users.
+Machine & Workload Identity is an emerging part of the Teleport product and it's
+helpful for us to be able to identify the kinds of use-cases people have. This
+allows us to prioritise more common usages. Whilst we try to collect this sort
+of information by talking to users directly, having a more general overview of
+the product in the wild helps us make even more informed decisions and avoid our
+decisions being solely influenced by a select few users.
 
 ## Anonymous telemetry
 
@@ -25,9 +28,9 @@ that the collected data does not include anything which identifies:
 - the hosts, applications, databases and Kubernetes clusters `tbot` connects to
 - the user that has configured `tbot`
 
-If we introduce further events to Machine ID's anonymous telemetry in future,
-we will abide by the above guidelines and ensure that changes are explicitly
-included in changelogs where new information is gathered.
+If we introduce further events to Machine & Workload Identity's anonymous
+telemetry in future, we will abide by the above guidelines and ensure that
+changes are explicitly included in changelogs where new information is gathered.
 
 Whilst we do not collect data which uniquely identifies the specific machine
 `tbot` is running on, we may collect general information about the architecture
diff --git a/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/data-sources.mdx b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/data-sources.mdx
new file mode 100644
index 0000000000000..db7ba0c3f8a7e
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/data-sources.mdx
@@ -0,0 +1,31 @@
+---
+title: "MWI Terraform data-sources index"
+description: "Index of all the data-sources supported by the Teleport MWI Terraform Provider"
+tags:
+  - infrastructure-as-code
+  - reference
+  - mwi
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+{/*
+    This file will be renamed data-sources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+<Admonition type="info">
+This is reference page is for the Teleport MWI Terraform provider, which
+generates short-lived credentials using Teleport Machine & Workload Identity.
+These short-lived credentials can be used to grant other Terraform providers
+access to resources through Teleport.
+
+If you are looking to manage the configuration of Teleport itself, use the
+[Teleport Terraform Provider](../../../infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+instead.
+</Admonition>
+
+The Teleport MWI Terraform provider supports the following data-sources:
+
+  - [`teleportmwi_kubernetes`](./kubernetes.mdx)
diff --git a/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/kubernetes.mdx b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/kubernetes.mdx
new file mode 100644
index 0000000000000..f00542922c377
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/data-sources/kubernetes.mdx
@@ -0,0 +1,71 @@
+---
+title: Reference for the teleportmwi_kubernetes Terraform data-source
+sidebar_label: kubernetes
+description: This page describes the supported values of the teleportmwi_kubernetes data-source of the Teleport MWI Terraform provider.
+tags:
+  - infrastructure-as-code
+  - reference
+  - mwi
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+The Kubernetes data source provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.
+
+## Example Usage
+
+```hcl
+// Warning: The teleportmwi_kubernetes data source will not function correctly
+// when the Teleport cluster is fronted by a L7 load balancer that terminates
+// TLS.
+data "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-k8s-cluster"
+  }
+  credential_ttl = "1h"
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = data.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = data.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = data.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = data.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = data.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `selector` (Attributes) Selects the Kubernetes cluster to connect to. (see [below for nested schema](#nested-schema-for-selector))
+
+### Optional
+
+- `credential_ttl` (String) How long the issued credentials should be valid for. Defaults to 30 minutes.
+
+### Read-Only
+
+- `output` (Attributes) (see [below for nested schema](#nested-schema-for-output))
+
+### Nested Schema for `selector`
+
+Required:
+
+- `name` (String) The name of the Kubernetes cluster to connect to.
+
+
+### Nested Schema for `output`
+
+Read-Only:
+
+- `client_certificate` (String) Compatible with the `client_certificate` argument of the `kubernetes` provider.
+- `client_key` (String, Sensitive) Compatible with the `client_key` argument of the `kubernetes` provider.
+- `cluster_ca_certificate` (String) Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.
+- `host` (String) Compatible with the `host` argument of the `kubernetes` provider.
+- `tls_server_name` (String) Compatible with the `tls_server_name` argument of the `kubernetes` provider.
+
diff --git a/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/ephemeral-resources.mdx b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/ephemeral-resources.mdx
new file mode 100644
index 0000000000000..02f664c9207a3
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/ephemeral-resources.mdx
@@ -0,0 +1,31 @@
+---
+title: "MWI Terraform ephemeral resources index"
+description: "Index of all the resources supported by the Teleport MWI Terraform Provider"
+tags:
+  - infrastructure-as-code
+  - reference
+  - mwi
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+{/*
+    This file will be renamed ephemeral-resources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+<Admonition type="info">
+This is reference page is for the Teleport MWI Terraform provider, which
+generates short-lived credentials using Teleport Machine & Workload Identity.
+These short-lived credentials can be used to grant other Terraform providers
+access to resources through Teleport.
+
+If you are looking to manage the configuration of Teleport itself, use the
+[Teleport Terraform Provider](../../../infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+instead.
+</Admonition>
+
+The Teleport MWI Terraform provider supports the following ephemeral resources:
+
+  - [`teleportmwi_kubernetes`](./kubernetes.mdx)
diff --git a/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/kubernetes.mdx b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/kubernetes.mdx
new file mode 100644
index 0000000000000..f5b383241d785
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/ephemeral-resources/kubernetes.mdx
@@ -0,0 +1,73 @@
+---
+title: Reference for the teleportmwi_kubernetes Terraform ephemeral resource
+sidebar_label: kubernetes
+description: This page describes the supported values of the teleportmwi_kubernetes ephemeral resource of the Teleport MWI Terraform provider.
+tags:
+  - infrastructure-as-code
+  - reference
+  - mwi
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleportmwi_kubernetes ephemeral resource of the Teleport MWI Terraform provider.
+
+
+The Kubernetes Ephemeral Resource provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.
+
+## Example Usage
+
+```hcl
+// Warning: The teleportmwi_kubernetes ephemeral resource will not function
+// correctly when the Teleport cluster is fronted by a L7 load balancer that
+// terminates TLS.
+ephemeral "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-k8s-cluster"
+  }
+  credential_ttl = "1h"
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
+```
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `selector` (Attributes) Selects the Kubernetes cluster to connect to. (see [below for nested schema](#nested-schema-for-selector))
+
+### Optional
+
+- `credential_ttl` (String) How long the issued credentials should be valid for. Defaults to 30 minutes.
+
+### Read-Only
+
+- `output` (Attributes) (see [below for nested schema](#nested-schema-for-output))
+
+### Nested Schema for `selector`
+
+Required:
+
+- `name` (String) The name of the Kubernetes cluster to connect to.
+
+
+### Nested Schema for `output`
+
+Read-Only:
+
+- `client_certificate` (String) Compatible with the `client_certificate` argument of the `kubernetes` provider.
+- `client_key` (String, Sensitive) Compatible with the `client_key` argument of the `kubernetes` provider.
+- `cluster_ca_certificate` (String) Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.
+- `host` (String) Compatible with the `host` argument of the `kubernetes` provider.
+- `tls_server_name` (String) Compatible with the `tls_server_name` argument of the `kubernetes` provider.
diff --git a/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/terraform-provider-mwi.mdx b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/terraform-provider-mwi.mdx
new file mode 100644
index 0000000000000..1e4368ff954e3
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/terraform-provider-mwi/terraform-provider-mwi.mdx
@@ -0,0 +1,115 @@
+---
+title: "Teleport MWI Terraform Provider"
+description: Reference documentation of the Teleport MWI Terraform provider.
+tags:
+ - infrastructure-as-code
+ - reference
+ - mwi
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+The Teleport MWI Terraform provider generates short-lived credentials using
+[Teleport Machine & Workload Identity (MWI)](../../../machine-workload-identity/machine-workload-identity.mdx)
+that can be used to grant other Terraform providers access to resources.
+
+To manage the configuration of Teleport itself, use the [Teleport Terraform
+Provider instead](../../infrastructure-as-code/terraform-provider/terraform-provider.mdx).
+
+{/* Note: the awkward `resource-index` file names are here because `data-sources`
+is reserved by the generator for the catch-all resource template */}
+
+- [list of supported ephemeral resources](./ephemeral-resources/ephemeral-resources.mdx)
+- [list of supported data-sources](./data-sources/data-sources.mdx)
+
+## Example usage
+
+In this example, we will use the Teleport MWI Terraform provider to grant the
+Kubernetes provider access to a Kubernetes cluster through Teleport.
+
+Our Kubernetes cluster is enrolled in Teleport under the name `my-cluster`, and
+we've setup a Bot and Join Token to allow our Terraform provider to authenticate
+to Teleport.
+
+```hcl
+terraform {
+  required_providers {
+    teleportmwi = {
+      source = "terraform.releases.teleport.dev/gravitational/teleportmwi"
+      version = "~> (=teleport.major_version=).0"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+  }
+}
+
+provider "teleportmwi" {
+  join_method = "gitlab"
+  join_token = "my-join-token"
+  proxy_server = "example.teleport.sh:443"
+}
+
+ephemeral "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-cluster"
+  }
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name = "example-namespace"
+  }
+}
+```
+
+## Ephemeral resources vs data sources
+
+The MWI Terraform provider exposes functionality using two different kinds of
+entity in the Terraform ecosystem: **ephemeral resources** and **data sources**.
+
+Ephemeral resources are supported by Terraform 1.10 and later, and should be
+the preferred way to use the MWI Terraform provider. They have the following
+benefits over data sources:
+
+- The short-lived credentials generated by the MWI Terraform provider will not
+  be persisted within the Terraform state.
+- Fresh short-lived credentials will be generated in the apply phase, allowing
+  you to grant read-only privileges to plan runs and read-write privileges to
+  apply runs.
+
+When using a version of Terraform that does not support ephemeral resources,
+you can use the data source variants instead. When using the data sources,
+keep the following in mind:
+
+- The short-lived secrets generated by the MWI Terraform provider will be
+  persisted within the Terraform state. The secrets will be generated in the
+  plan phase and reused in the apply phase. We therefore highly recommend that
+  you encrypt your Terraform state file.
+- You will need to configure a `credential_ttl` that will ensure that credentials
+  generated during the plan phase will still be valid during the apply phase.
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `join_method` (String) The join method to use to authenticate to the Teleport cluster.
+- `join_token` (String) The name of the join token to use to authenticate to the Teleport cluster.
+- `proxy_server` (String) The address of the Teleport Proxy service. This should exclude the scheme but should include the port.
+
+### Optional
+
+- `insecure` (Boolean) When enabled, the certificates of the Proxy will not be verified. This is not recommended for production use.
+
diff --git a/docs/pages/reference/workload-identity/attributes.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/attributes.mdx
similarity index 99%
rename from docs/pages/reference/workload-identity/attributes.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/attributes.mdx
index 04e668679e0be..a6f45e8c6e763 100644
--- a/docs/pages/reference/workload-identity/attributes.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/attributes.mdx
@@ -1,6 +1,11 @@
 ---
 title: Workload Identity Attributes
+sidebar_label: Attributes
 description: Information about the attributes that can be used in templating and rules in the WorkloadIdentity resource.
+tags:
+ - reference
+ - mwi
+ - infrastructure-identity
 ---
 
 Attributes are features of an identity which you can use with the
diff --git a/docs/pages/reference/workload-identity/configuration-resource-migration.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/configuration-resource-migration.mdx
similarity index 93%
rename from docs/pages/reference/workload-identity/configuration-resource-migration.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/configuration-resource-migration.mdx
index 295b629273588..897edb34b1c31 100644
--- a/docs/pages/reference/workload-identity/configuration-resource-migration.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/configuration-resource-migration.mdx
@@ -1,6 +1,10 @@
 ---
 title: WorkloadIdentity Configuration Resource migration
 description: Migrating to the new WorkloadIdentity resource configuration
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 The way that you configure Teleport Workload Identity is changing. If you are
@@ -46,7 +50,7 @@ The following new additional CLI commands have been introduced:
 - `tbot start workload-identity-jwt` to issue a JWT SVID.
 
 You can read more about the new CLI commands in the
-[`tbot` CLI reference](../cli/tbot.mdx).
+[`tbot` CLI reference](../../cli/tbot.mdx).
 
 The following service types have been replaced:
 
@@ -58,4 +62,4 @@ The following new additional service types have been introduced:
 - `workload-identity-jwt` to issue JWT SVIDs.
 
 You can read more about the new service types in the
-[`tbot` configuration reference](../machine-id/configuration.mdx).
\ No newline at end of file
+[`tbot` configuration reference](../configuration.mdx).
diff --git a/docs/pages/reference/workload-identity/issuer-override.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/issuer-override.mdx
similarity index 91%
rename from docs/pages/reference/workload-identity/issuer-override.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/issuer-override.mdx
index 890a520f3489c..aa52f501e2855 100644
--- a/docs/pages/reference/workload-identity/issuer-override.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/issuer-override.mdx
@@ -1,6 +1,12 @@
 ---
 title: Workload Identity X.509 Issuer Override Resource
+sidebar_label: X.509 Issuer Override Resource
 description: Provides information about the `workload_identity_x509_issuer_override` resource.
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+enterprise: Issuer override
 ---
 
 The X.509 issuer override functionality provides a way to replace the self-signed X.509 certificate used by Teleport as the issuer SPIFFE X509-SVID credentials with an issuing certificate of your choosing, together with an optional certificate chain. After configuring a default `workload_identity_x509_issuer_override` resource, all X509-SVID credentials issued to `tbot` or `tsh` will be issued by one of the issuers specified in the resource, and will include the appropriate certificate chain.
@@ -55,6 +61,8 @@ SERIALNUMBER=234567890123456789012345678901234567890,CN=clustername,O=clusternam
 
 Use of this command requires `create` permissions for the `workload_identity_x509_issuer_override_csr` resource kind in one of the roles associated with the identity running the command.
 
+In clusters that make use of Hardware Security Modules (HSMs) it's possible that no single Teleport Auth Service instance is capable of generating signatures for all the keys that make up the SPIFFE certificate authority at once. In such situations, it's possible to use the `--force` option with the `sign-csrs` command on each machine running the Auth Service, to gather CSRs for keys managed by the different HSMs.
+
 ## Using `tctl` to create a `workload_identity_x509_issuer_override` from certificate chain PEM files
 
 The `tctl workload-identity x509-issuer-overrides create` command can be used to build a `workload_identity_x509_issuer_override` resource out of one or more PEM files containing a certificate chain each, and to create or forcibly overwrite an existing resource in the cluster. The command will check that the first certificates in the specified chains have different public keys, and that they match 1:1 with the trusted X.509 certificates in the SPIFFE certificate authority in the Teleport cluster.
diff --git a/docs/pages/reference/workload-identity/revocations.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/revocations.mdx
similarity index 97%
rename from docs/pages/reference/workload-identity/revocations.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/revocations.mdx
index 5b540ff7abc20..f84a1fae0d7ba 100644
--- a/docs/pages/reference/workload-identity/revocations.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/revocations.mdx
@@ -1,6 +1,11 @@
 ---
 title: Workload Identity Revocations
+sidebar_label: Revocations
 description: Information about performing revocations for issued workload identity credentials
+tags:
+ - conceptual
+ - mwi
+ - resiliency
 ---
 
 The revocations mechanism provides a way to mark an issued X509 workload
@@ -88,4 +93,4 @@ tFJEdB/d5SoDzpGXC394eeRmFml77+L0XfZmbmcXE00sRBi0Xr5MAa1PGjw/wS9a
 ```
 
 To directly write this to a file, you can provide the `--out` flag and a path
-to which to write the file.
\ No newline at end of file
+to which to write the file.
diff --git a/docs/pages/reference/workload-identity/sigstore-attestation.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/sigstore-attestation.mdx
similarity index 98%
rename from docs/pages/reference/workload-identity/sigstore-attestation.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/sigstore-attestation.mdx
index 1e326b0109345..3725d286216e8 100644
--- a/docs/pages/reference/workload-identity/sigstore-attestation.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/sigstore-attestation.mdx
@@ -1,6 +1,11 @@
 ---
 title: Sigstore Workload Attestation
 description: Using Teleport's integration with Sigstore to ensure workload supply chain security
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
+enterprise: Sigstore workload attestation
 ---
 
 By using Teleport's integration with [Sigstore](https://sigstore.dev), you can
@@ -15,7 +20,7 @@ signed container images, reducing the scope for
 
 ## How it works
 
-![Sigstore Integration Diagram](../../../img/workload-identity/sigstore-integration.png)
+![Sigstore Integration Diagram](../../../../img/workload-identity/sigstore-integration.png)
 
 ### Signing
 
diff --git a/docs/pages/reference/workload-identity/workload-identity-api-and-workload-attestation.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx
similarity index 99%
rename from docs/pages/reference/workload-identity/workload-identity-api-and-workload-attestation.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx
index aa885807c2790..5e9b65a5aa5be 100644
--- a/docs/pages/reference/workload-identity/workload-identity-api-and-workload-attestation.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-api-and-workload-attestation.mdx
@@ -1,6 +1,11 @@
 ---
 title: Workload Identity API & Workload Attestation
+sidebar_label: API Service
 description: Information about the `tbot` Workload Identity API service and Workload Attestation functionality
+tags:
+ - conceptual
+ - mwi
+ - infrastructure-identity
 ---
 
 The Workload Identity API service (`workload-identity-api`) is a configurable
diff --git a/docs/pages/reference/workload-identity/workload-identity-resource.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx
similarity index 96%
rename from docs/pages/reference/workload-identity/workload-identity-resource.mdx
rename to docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx
index 28d17f994386a..574ba8ed0ca77 100644
--- a/docs/pages/reference/workload-identity/workload-identity-resource.mdx
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx
@@ -1,6 +1,10 @@
 ---
 title: WorkloadIdentity Resource
 description: Information about the WorkloadIdentity resource
+tags:
+ - reference
+ - mwi
+ - infrastructure-identity
 ---
 
 The WorkloadIdentity resource is used to define the structure of an identity
@@ -166,7 +170,7 @@ You can find a full list of the supported attributes on the
 [Attributes reference](./attributes.mdx) page.
 
 The WorkloadIdentity resource's fields use Teleport's
-[Predicate Language](../predicate-language.mdx) for templating, allowing you to
+[Predicate Language](../../access-controls/predicate-language.mdx) for templating, allowing you to
 apply text manipulation functions like `strings.lower` and `regex.replace`.
 
 ## Rules
@@ -178,7 +182,7 @@ the labels on the WorkloadIdentity resource.
 However, you can further restrict the issuance of credentials based on the
 attributes of the workload using the rules mechanism.
 
-Each rule consists of either a [Predicate Language](../predicate-language.mdx)
+Each rule consists of either a [Predicate Language](../../access-controls/predicate-language.mdx)
 expression or a set of conditions. When using the conditions form, all
 conditions within that rule must pass in order for the rule to be considered a
 pass. If you specify multiple rules, then at least one rule must pass in order
@@ -312,7 +316,7 @@ When using the conditions form and comparing attributes which are not strings
 (e.g. a boolean or number), the attribute values will be converted to a string
 representation.
 
-When using the [Predicate Language](../predicate-language.mdx), the attribute
+When using the [Predicate Language](../../access-controls/predicate-language.mdx), the attribute
 values will be compared as-is.
 
 ## Infrastructure as Code
@@ -323,4 +327,4 @@ tools.
 
 For further information see:
 
-- [Terraform provider reference: teleport_workload_identity](../terraform-provider/resources/workload_identity.mdx)
+- [Terraform provider reference: teleport_workload_identity](../../infrastructure-as-code/terraform-provider/resources/workload_identity.mdx)
diff --git a/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity.mdx b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity.mdx
new file mode 100644
index 0000000000000..c116be15276a4
--- /dev/null
+++ b/docs/pages/reference/machine-workload-identity/workload-identity/workload-identity.mdx
@@ -0,0 +1,10 @@
+---
+title: Workload Identity References
+sidebar_label: Workload Identity
+description: Configuration and CLI reference for Teleport Workload Identity
+tags:
+ - mwi
+ - infrastructure-identity
+---
+
+<DocCardList />
diff --git a/docs/pages/reference/monitoring/audit.mdx b/docs/pages/reference/monitoring/audit.mdx
deleted file mode 100644
index 5d1a79eb1cca9..0000000000000
--- a/docs/pages/reference/monitoring/audit.mdx
+++ /dev/null
@@ -1,236 +0,0 @@
----
-title: Audit Events and Records
-description: Reference of Teleport Audit Events and Session Records
----
-
-Teleport logs cluster activity by emitting various events into its audit log.
-There are two components of the audit log:
-
-<Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-
-- **Cluster Events:** Teleport logs events like successful user logins along
-   with metadata like remote IP address, time, and the session ID.
-- **Recorded Sessions:** Every SSH, desktop, or Kubernetes shell session is recorded and
-   can be replayed later. By default, the recording is done by Teleport Nodes,
-   but can be configured to be done by the proxy.
-
-</TabItem>
-<TabItem scope={["cloud","team"]} label="Cloud-Hosted">
-
-- **Cluster Events:** Teleport logs events like successful user logins along
-   with metadata like remote IP address, time, and the session ID.
-- **Recorded Sessions:** Every SSH, desktop, or Kubernetes shell session is recorded and
-   can be replayed later. Teleport Cloud manages the storage of session
-   recording data.
-
-</TabItem>
-</Tabs>
-
-<Admonition type="tip">
-
-You can use
-[Enhanced Session Recording with BPF](../../enroll-resources/server-access/guides/bpf-session-recording.mdx)
-to get even more comprehensive audit logs with advanced security.
-
-</Admonition>
-
-## Events
-
-<Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-
-Teleport supports multiple storage backends for storing audit events. The `dir`
-backend uses the local filesystem of an Auth Service host. When this backend is
-used, events are written to the filesystem in JSON format. The `dir` backend rotates
-the event file approximately once every 24 hours, but never deletes captured events.
-
-For High Availability configurations, users can refer to our
-[Athena](../backends.mdx), [DynamoDB](../backends.mdx) or
-[Firestore](../backends.mdx) chapters for information on how to
-configure the SSH events and recorded sessions to be stored on network storage.
-When these backends are in use, audit events will eventually expire and be
-removed from the log. The default retention period is 1 year, but this can be
-overridden using the `retention_period` configuration parameter.
-
-It is even possible to store audit logs in multiple places at the same time. For
-more information on how to configure the audit log, refer to the `storage`
-section of the example configuration file in the
-[Teleport Configuration Reference](../config.mdx).
-
-Let's examine the Teleport audit log using the `dir` backend. Teleport Auth
-Service instances write their logs to a subdirectory of Teleport's configured
-data directory that is named based on the service's UUID.
-
-Each day is represented as a file:
-
-```code
-$ ls -l /var/lib/teleport/log/bbdfe5be-fb97-43af-bf3b-29ef2e302941
-
-# total 104
-# -rw-r----- 1 root root  31638 Jan 22 20:00 2022-01-23.00:00:00.log
-# -rw-r----- 1 root root  91256 Jan 31 21:00 2022-02-01.00:00:00.log
-# -rw-r----- 1 root root  15815 Feb 32 22:54 2022-02-03.00:00:00.log
-```
-
-</TabItem>
-<TabItem label="Cloud-Hosted">
-
-Teleport Enterprise Cloud manages the storage of audit logs for you. You can
-access your audit logs via the Teleport Web UI by clicking:
-
-**Audit** > **Audit Log**
-
-</TabItem>
-</Tabs>
-
-Audit logs use JSON format. They are human readable but can also be
-programmatically parsed. Each line represents an event and has the following
-format:
-
-```javascript
-{
-    // Event type. See below for the list of all possible event types.
-    "event": "session.start",
-    // A unique ID for the event log. Useful for  deduplication.
-    "uid": "59cf8d1b-7b36-4894-8e90-9d9713b6b9ef",
-    // Teleport user name
-    "user": "ekontsevoy",
-    // OS login
-    "login": "root",
-    // Server namespace. This field is reserved for future use.
-    "namespace": "default",
-    // Unique server ID
-    "server_id": "f84f7386-5e22-45ff-8f7d-b8079742e63f",
-    // Server Labels
-    "server_labels": {
-      "datacenter": "us-east-1",
-      "label-b": "x"
-    }
-    // Session ID. Can be used to replay the session.
-    "sid": "8d3895b6-e9dd-11e6-94de-40167e68e931",
-    // Address of the SSH node
-    "addr.local": "10.5.l.15:3022",
-    // Address of the connecting client (user)
-    "addr.remote": "73.223.221.14:42146",
-    // Terminal size
-    "size": "80:25",
-    // Timestamp
-    "time": "2017-02-03T06:54:05Z"
-}
-```
-
-## Event types
-
-Below are some possible types of audit events.
-
-<Admonition type="tip">
-
-This list is not comprehensive. We recommend exporting audit events to a
-platform that automatically parses event payloads so you can group and filter
-them by their `event` key and discover trends. To set up audit event exporting,
-read [Exporting Teleport Audit Events](../../admin-guides/management/export-audit-events/export-audit-events.mdx).
-
-</Admonition>
-
-| Event Type | Description |
-| - | - |
-| auth | Authentication attempt. Adds the following fields: `{"success": "false", "error": "access denied"}` |
-| session.start | Started an interactive shell session. |
-| session.end | An interactive shell session has ended. |
-| session.join | A new user has joined the existing interactive shell session. |
-| session.leave | A user has left the session. |
-| session.disk | A list of files opened during the session. *Requires Enhanced Session Recording*. |
-| session.network | A list of network connections made during the session.  *Requires Enhanced Session Recording*. |
-| session.command | A list of commands ran during the session.  *Requires Enhanced Session Recording*. |
-| session.recording.access | A session recording has been accessed. |
-| exec | Remote command has been executed via SSH, like `tsh ssh root@node ls /`. The following fields will be logged: `{"command": "ls /", "exitCode": 0, "exitError": ""}` |
-| scp | Remote file copy has been executed. The following fields will be logged: `{"path": "/path/to/file.txt", "len": 32344, "action": "read" }` |
-| resize | Terminal has been resized. |
-| user.login | A user logged into web UI or via tsh. The following fields will be logged: `{"user": "alice@example.com", "method": "local"}` . |
-| app.session.start | A user accessed an application |
-| app.session.chunk | A record of activity during an app session |
-| join_token.create | A new join token has been created. Adds the following fields: `{"roles": ["Node", "Db"], "join_method": "token"}` |
-
-## Recorded sessions
-
-In addition to logging start and end events, Teleport can also record the entire session.
-For SSH or Kubernetes sessions this captures the entire stream of bytes from the PTY.
-For desktop sessions the recording includes the contents of the screen.
-
-<Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
-
-Teleport can store the recorded sessions in an [AWS S3 bucket](../backends.mdx)
-or in a local filesystem (including NFS).
-
-The recorded sessions are stored as raw bytes in the `sessions` directory under
-`log`. Each session is a protobuf-encoded stream of binary data.
-
-You can replay recorded sessions using the [`tsh play`](../cli/tsh.mdx)
-command or the Web UI.
-
-For example, replay a session via CLI:
-
-```code
-$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931
-```
-
-Print the session events in JSON to stdout:
-
-```code
-$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931 --format=json
-```
-
-</TabItem>
-<TabItem label="Cloud-Hosted">
-
-Teleport Enterprise Cloud automatically stores recorded sessions.
-
-You can replay recorded sessions using the [`tsh play`](../cli/tsh.mdx)
-command or the Web UI.
-
-For example, replay a session via CLI:
-
-```code
-$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931
-```
-
-Print the session events in JSON to stdout:
-
-```code
-$ tsh play 4c146ec8-eab6-11e6-b1b3-40167e68e931 --format=json
-```
-
-</TabItem>
-</Tabs>
-
-### Modes
-
-<Admonition type="note">
-Available only for SSH sessions and when Teleport is configured with
-`auth_service.session_recording: node`.
-</Admonition>
-
-Modes define how Teleport deals with recording failures, such as a full disk
-error. They are configured per-service at the role level, where the strictest
-value takes precedence. The available modes are:
-
-|Mode|After a recording failure|
-|----|-------------------------|
-|Best effort (`best_effort`)|Disables recording without terminating the session.|
-|Strict (`strict`)|Immediately terminates the session.|
-
-If the user role doesn’t specify a recording mode, `best_effort` will be used. Here
-is an example of a role configured to use strict mode for SSH sessions:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: ssh-strict
-spec:
-  options:
-    record_session:
-      ssh: strict
-```
diff --git a/docs/pages/reference/monitoring/metrics.mdx b/docs/pages/reference/monitoring/metrics.mdx
deleted file mode 100644
index e0587f820621b..0000000000000
--- a/docs/pages/reference/monitoring/metrics.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: Teleport Metrics
-description: Comprehensive list of all metrics exposed by Teleport.
----
-
-<Admonition scope={["cloud"]} type="tip">
-
-Teleport Cloud does not expose monitoring endpoints for the Auth Service and Proxy Service.
-
-</Admonition>
-
-Teleport metrics are intended for performance monitoring. If you'd like to
-monitor Teleport usage, consider utilizing our Event Handler plugin to push Audit Events into your
-preferred logging aggregation system (Elastic, Splunk, Sumo Logic, etc). 
-
-- [Audit Events and Records](audit.mdx)  
-- [Forwarding events with Fluentd](../../admin-guides/management/export-audit-events/fluentd.mdx)  
-- [Monitor Teleport Audit Events with the Elastic Stack](../../admin-guides/management/export-audit-events/elastic-stack.mdx)  
-
-The following metrics are available:
-
-(!docs/pages/includes/metrics.mdx!)
diff --git a/docs/pages/reference/monitoring/monitoring.mdx b/docs/pages/reference/monitoring/monitoring.mdx
deleted file mode 100644
index 28233d6f37193..0000000000000
--- a/docs/pages/reference/monitoring/monitoring.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Teleport Monitoring
-h1: Teleport Monitoring References
-description: Provides comprehensive guides to monitoring data available from Teleport.
----
-
-<DocCardList />
diff --git a/docs/pages/reference/operator-resources/operator-resources.mdx b/docs/pages/reference/operator-resources/operator-resources.mdx
deleted file mode 100644
index 88a1660ad2ab2..0000000000000
--- a/docs/pages/reference/operator-resources/operator-resources.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "Teleport Kubernetes Operator Resource Reference Guides"
-description: "Comprehensive guides to fields available in Kubernetes resources you can apply to manage Teleport resources with the Teleport Kubernetes operator"
----
-
-<DocCardList />
diff --git a/docs/pages/reference/operator-resources/resources-teleport-dev-oidcconnectors.mdx b/docs/pages/reference/operator-resources/resources-teleport-dev-oidcconnectors.mdx
deleted file mode 100644
index 44905c4dda8f9..0000000000000
--- a/docs/pages/reference/operator-resources/resources-teleport-dev-oidcconnectors.mdx
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: TeleportOIDCConnector
-description: Provides a comprehensive list of fields in the TeleportOIDCConnector resource available through the Teleport Kubernetes operator
-tocDepth: 3
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/}
-
-This guide is a comprehensive reference to the fields in the `TeleportOIDCConnector`
-resource, which you can apply after installing the Teleport Kubernetes operator.
-
-
-## resources.teleport.dev/v3
-
-**apiVersion:** resources.teleport.dev/v3
-
-|Field|Type|Description|
-|---|---|---|
-|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources|
-|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds|
-|metadata|object||
-|spec|[object](#spec)|OIDCConnector resource definition v3 from Teleport|
-
-### spec
-
-|Field|Type|Description|
-|---|---|---|
-|acr_values|string|ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.|
-|allow_unverified_email|boolean|AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.|
-|claims_to_roles|[][object](#specclaims_to_roles-items)|ClaimsToRoles specifies a dynamic mapping from claims to roles.|
-|client_id|string|ClientID is the id of the authentication client (Teleport Auth Service).|
-|client_redirect_settings|[object](#specclient_redirect_settings)|ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones.|
-|client_secret|string|ClientSecret is used to authenticate the client. This field supports secret lookup. See the operator documentation for more details.|
-|display|string|Display is the friendly name for this provider.|
-|google_admin_email|string|GoogleAdminEmail is the email of a google admin to impersonate.|
-|google_service_account|string|GoogleServiceAccount is a string containing google service account credentials.|
-|google_service_account_uri|string|GoogleServiceAccountURI is a path to a google service account uri.|
-|issuer_url|string|IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.|
-|max_age|string|MaxAge is the amount of time that user logins are valid for. If a user logs in, but then does not login again within this time period, they will be forced to re-authenticate.|
-|mfa|[object](#specmfa)|MFASettings contains settings to enable SSO MFA checks through this auth connector.|
-|pkce_mode|string|PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"|
-|prompt|string|Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|
-|provider|string|Provider is the external identity provider.|
-|redirect_url|[]string|RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.|
-|scope|[]string|Scope specifies additional scopes set by provider.|
-|username_claim|string|UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.|
-
-### spec.claims_to_roles items
-
-|Field|Type|Description|
-|---|---|---|
-|claim|string|Claim is a claim name.|
-|roles|[]string|Roles is a list of static teleport roles to match.|
-|value|string|Value is a claim value to match.|
-
-### spec.client_redirect_settings
-
-|Field|Type|Description|
-|---|---|---|
-|allowed_https_hostnames|[]string|a list of hostnames allowed for https client redirect URLs|
-|insecure_allowed_cidr_ranges|[]string|a list of CIDRs allowed for HTTP or HTTPS client redirect URLs|
-
-### spec.mfa
-
-|Field|Type|Description|
-|---|---|---|
-|acr_values|string|AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.|
-|client_id|string|ClientID is the OIDC OAuth app client ID.|
-|client_secret|string|ClientSecret is the OIDC OAuth app client secret.|
-|enabled|boolean|Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.|
-|max_age|string|MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.|
-|prompt|string|Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.|
-
diff --git a/docs/pages/reference/predicate-language.mdx b/docs/pages/reference/predicate-language.mdx
deleted file mode 100644
index adeda2509b85d..0000000000000
--- a/docs/pages/reference/predicate-language.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-title: Predicate Language
-description: How to use Teleport's predicate language to define filter conditions.
----
-
-Teleport's predicate language is used to define conditions for filtering in dynamic configuration resources.
-It is also used as a query language to filter and search through a [list of select resources](#resource-filtering).
-
-The predicate language uses a slightly different syntax depending on whether it is used in:
-
-- [Role resources](#scoping-allowdeny-rules-in-role-resources)
-- [Resource filtering](#resource-filtering)
-- [Label expressions](#label-expressions)
-
-## Scoping allow/deny rules in role resources
-
-Some fields in Teleport's role resources use the predicate language to define
-the scope of a role's permissions:
-
-- [Dynamic Impersonation](../admin-guides/access-controls/guides/impersonation.mdx)
-- [RBAC for sessions](access-controls/roles.mdx)
-
-When used in role resources, the predicate language supports the following operators:
-
-| Operator | Meaning                                          | Example                                                  |
-|----------|--------------------------------------------------|----------------------------------------------------------|
-| &&       | and (all conditions must match)                  | `contains(field1, field2) && equals(field2, "val")`      |
-| \|\|     | or  (any one condition should match)             | `contains(field1, field2) \|\| contains(field1, "val2")` |
-| !        | not (used with functions, more about this below) | `!equals(field1, field2)`                                |
-
-The language also supports the following functions:
-
-| Functions                      | Description                                                                           |
-|--------------------------------|---------------------------------------------------------------------------------------|
-| `contains(<field>, <field2>)`  | checks if the value from `<field2>` is included in the list of strings from `<field>` |
-| `contains(<field>, "<value>")` | checks if `<value>` is included in the list of strings from `<field>`                 |
-| `equals(<field>, <field2>)`    | checks if the value from `<field2>` is equal to the value from `<field>`              |
-| `equals(<field>, "<value>")`   | checks if `<value>` is equal to the value from `<field>`                              |
-
-## Resource filtering
-
-Both the [`tsh`](cli/tsh.mdx) and [`tctl`](cli/tctl.mdx) CLI tools allow you to filter nodes,
-applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to
-perform more sophisticated searches using the predicate language.
-
-For common resource fields, we defined shortened field names that can easily be accessed by:
-
-| Short Field       | Actual Field Equivalent                                                                | Example                      |
-|-------------------|----------------------------------------------------------------------------------------|------------------------------|
-| `labels["<key>"]` | `resource.metadata.labels` + `resource.spec.dynamic_labels`                            | `labels["env"] == "staging"` |
-| `name`            | `resource.spec.hostname` (only applies to server resource) or `resource.metadata.name` | `name == "jenkins"`          |
-
-The language supports the following operators:
-
-| Operator | Meaning                              | Example                                                |
-|----------|--------------------------------------|--------------------------------------------------------|
-| ==       | equal to                             | `labels["env"] == "prod"` or ``labels[`env`] == "prod"`` |
-| !=       | not equal to                         | `labels["env"] != "prod"`                              |
-| &&       | and (all conditions must match)      | `labels["env"] == "prod" && labels["os"] == "mac"`     |
-| \|\|     | or  (any one condition should match) | `labels["env"] == "dev" \|\| labels["env"] == "qa"`    |
-| !        | not (used with functions)            | `!equals(labels["env"], "prod")`                       |
-
-The language also supports the following functions:
-
-| Functions (with examples)                    | Description                                                |
-|----------------------------------------------|------------------------------------------------------------|
-| `equals(labels["env"], "prod")`              | resources with label key `env` equal to label value `prod` |
-| `exists(labels["env"])`                      | resources with a label key `env`; label value unchecked    |
-| `!exists(labels["env"])`                     | resources without a label key `env`; label value unchecked |
-| `search("foo", "bar", "some phrase")`        | fuzzy match against common resource fields                 |
-| `hasPrefix(name, "foo")`                     | resources with a name that starts with the prefix `foo`    |
-| `split(labels["foo"], ",")`                  | converts a delimited string into a list                    |
-| `contains(split(labels["foo"], ","), "bar")` | determines if a value exists in a list                     |
-
-See some [examples](cli/cli.mdx) of the different ways you can filter resources.
-
-## Label expressions
-
-Label expressions can be used in Teleport roles to define access to resources
-with custom logic.
-Check out the Access Controls
-[reference page](access-controls/roles.mdx)
-for an overview of label expressions and where they can be used.
-
-Label expressions support a predicate language with the following fields
-available:
-
-| Field              | Type                    | Description |
-|--------------------|-------------------------|-------------|
-| `labels`           | `map[string]string`     | Combined static and dynamic labels of the resource (server, application, etc.) being accessed. |
-| `user.spec.traits` | `map[string][]string`   | All traits of the user accessing the resource (referred to as `external` or `internal` in role template expressions). |
-
-The language supports the following functions:
-
-| Syntax | Return type | Description | Example |
-|--------|-------------|-------------|---------|
-| `contains(list, item)` | Boolean | Returns true if `list` contains an exact match for `item` | `contains(user.spec.traits[teams], labels["team"])` |
-| `regexp.match(list, re)` | Boolean | Returns true if `list` contains a match for `re` | `regexp.match(labels["team"], "dev-team-\d+$")` |
-| `regexp.replace(list,` `re, replacement)` | `[]string` | Replaces all matches of `re` with replacement for all items in `list` | `contains(regexp.replace(user.spec.traits["allowed-env"],` `"^env-(.*)$", "$1"), labels["env"])`
-| `email.local(list)` | `[]string` | Returns the local part of each email in `list`, or an error if any email fails to parse | `contains(email.local(user.spec.traits["email"]),` `labels["owner"])`
-| `strings.upper(list)` | `[]string` | Converts all items of the list to uppercase | `contains(strings.upper(user.spec.traits["username"]),` `labels["owner"])`
-| `strings.lower(list)` | `[]string` | Converts all items of the list to lowercase | `contains(strings.lower(user.spec.traits["username"]),` `labels["owner"])`
-| `labels_matching(re)` | `[]string` | Returns the aggregate of all label values with keys matching `re`, which can be a glob or a regular expression | `contains(labels_matching("^project-(team\|label)$"),` `"security")`
-| `contains_any(list, items)` | Boolean | Returns true if `list` contains an exact match for any element of `items` | `contains_any(user.spec.traits["projects"],` `labels_matching("project-*"))` |
-| `contains_all(list, items)` | Boolean | Returns true if `list` contains an exact match for all elements of `items` | `contains_all(user.spec.traits["projects"],` `labels_matching("project-*"))` |
-
-Above, any argument named `list` can accept a list of values (like the list of
-values for a specific user trait) or a single value (like the value of a
-resource label or a string literal).
-
-The language also supports the following operators:
-
-| Operator | Meaning                             | Example |
-|----------|-------------------------------------|---------|
-| ==       | equal to                            | `labels["env"] == "staging"` |
-| !=       | not equal to                        | `labels["env"] != "production"` |
-| \|\|      | or (any one condition should match) | `labels["env"] == "staging" \|\| labels["env"] == "test"` |
-| &&       | and (all conditions must match)     | `labels["env"] == "staging" && labels["team"] == "dev"` |
-| !        | not (logical negation)              | `!regexp.match(user.spec.traits["teams"], "contractor")` |
diff --git a/docs/pages/reference/public-certificates.mdx b/docs/pages/reference/public-certificates.mdx
new file mode 100644
index 0000000000000..cfa95428ddfe0
--- /dev/null
+++ b/docs/pages/reference/public-certificates.mdx
@@ -0,0 +1,198 @@
+---
+title: "Public Certificates & Encryption Keys"
+---
+
+We use the following certificates and public keys to sign our software. Many of
+these keys and certificates use our legal business name Gravitational, Inc. and
+our former domain gravitational.com. Don’t worry – [Gravitational is
+Teleport](https://goteleport.com/blog/gravitational-is-teleport/).
+
+## APT, YUM, & Zypper signing keys
+
+We sign our [APT, YUM and Zypper
+repositories](../installation/linux.mdx#package-repositories)
+with the following PGP key:
+
+* ID `C87ED53A6282C411`
+* Fingerprint `0C5E 8BA5 658E 320D 1B03 1179 C87E D53A 6282 C411`
+
+The key is available for download at:
+* [https://apt.releases.teleport.dev/gpg](https://apt.releases.teleport.dev/gpg)
+* [https://yum.releases.teleport.dev/gpg](https://yum.releases.teleport.dev/gpg)
+* [https://zypper.releases.teleport.dev/gpg](https://zypper.releases.teleport.dev/gpg)
+
+## Apple signing certificates
+
+Our Apple packages and binaries are [code
+signed](https://developer.apple.com/support/code-signing/) by "Developer ID
+QH8AA5B8UP Gravitational Inc." with the following certificate:
+* SHA256 Fingerprint: `78 2F E1 18 5F A1 AD 68 AD 25 0B A9 4D 21 DC BB 0D 8E 47
+  C6 E4 1D FE FB AB 05 41 33 4C 33 1D 43`
+* SHA1 Fingerprint: `82 B6 25 AD 32 7C 24 1B 37 8A 54 B4 B2 54 BB 08 CE 71 B5 DF`
+
+Packages published prior to September 14, 2021 are signed with an older certificate for the same Developer ID (QH8AA5B8UP):
+* SHA256 Fingerprint: `78 05 14 69 20 59 21 D1 EE 96 42 01 5A 28 35 FB E1 D4 38 5E 2A 23 5D 62 73 A4 D1 27 8A 33 BA 34`
+* SHA1 Fingerprint: `D2 70 EA 0C F2 0E CB 17 28 B2 21 E1 D5 B6 7C FE 50 FF AB 62`
+
+Verify the Developer ID and fingerprint match on package downloads with the
+pkgutil tool:
+```console
+$ pkgutil --check-signature teleport-(=teleport.version=).pkg
+Package "teleport-(=teleport.version=).pkg":
+   Status: signed by a developer certificate issued by Apple for distribution
+   Notarization: trusted by the Apple notary service
+   Signed with a trusted timestamp on: 2024-02-16 21:42:52 +0000
+   Certificate Chain:
+    1. Developer ID Installer: Gravitational Inc. (QH8AA5B8UP)
+       Expires: 2026-07-27 18:27:29 +0000
+       SHA256 Fingerprint:
+           78 2F E1 18 5F A1 AD 68 AD 25 0B A9 4D 21 DC BB 0D 8E 47 C6 E4 1D
+           FE FB AB 05 41 33 4C 33 1D 43
+       ------------------------------------------------------------------------
+    2. Developer ID Certification Authority
+       Expires: 2027-02-01 22:12:15 +0000
+       SHA256 Fingerprint:
+           7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03
+           F2 9C 88 CF B0 B1 BA 63 58 7F
+       ------------------------------------------------------------------------
+    3. Apple Root CA
+       Expires: 2035-02-09 21:40:36 +0000
+       SHA256 Fingerprint:
+           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
+           68 C5 BE 91 B5 A1 10 01 F0 24
+```
+
+The codesign tool can be used to perform the verification on individual
+binaries:
+```console
+$ codesign --verify -d --verbose=2 /usr/local/bin/tsh
+...
+Authority=Developer ID Application: Gravitational Inc. (QH8AA5B8UP)
+Authority=Developer ID Certification Authority
+Authority=Apple Root CA
+Timestamp=Jun 29, 2024 at 11:02:15 PM
+Info.plist=not bound
+TeamIdentifier=QH8AA5B8UP
+...
+```
+
+The Teleport package in Homebrew is not maintained or signed by Teleport. We
+recommend the use of [our Teleport packages](https://goteleport.com/download/).
+
+## Windows signing certificates
+
+Our Windows binaries are signed with the following certificate:
+* Issued to: Gravitational, Inc.
+* Thumbprint: `C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391`
+
+Verify the binary using the following PowerShell command:
+```console
+Get-AuthenticodeSignature -FilePath .\tsh.exe
+
+    Directory: C:\Users\ExampleUser
+
+SignerCertificate                         Status   Path
+-----------------                         ------   ----
+C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391  Valid    tsh.exe
+```
+
+Ensure that the `SignerCertificate` matches the thumbprint shown above, and that
+the `Status` field is `Valid`.
+
+To further inspect the certificate, run the following PowerShell command:
+```console
+(Get-AuthenticodeSignature -FilePath.\tsh.exe).SignerCertificate | Format-List
+
+Subject      : CN="Gravitational, Inc.", O="Gravitational, Inc.", L=Oakland,
+               S=California, C=US, SERIALNUMBER=5720258,
+               OID.2.5.4.15=Private Organization,
+               OID.1.3.6.1.4.1.311.60.2.1.2=Delaware,
+               OID.1.3.6.1.4.1.311.60.2.1.3=US
+Issuer       : CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,
+               O="DigiCert, Inc.", C=US
+Thumbprint   : C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391
+FriendlyName :
+NotBefore    : 11/2/2023 12:00:00 AM
+NotAfter     : 10/16/2026 11:59:59 PM
+Extensions   : {System.Security.Cryptography.Oid,
+                System.Security.Cryptography.Oid,
+                System.Security.Cryptography.Oid,
+                System.Security.Cryptography.Oid...}
+```
+
+Alternatively, Windows binaries may be inspected graphically via the Windows
+Explorer with the following steps:
+1. Right click on the binary in question, for example `tsh.exe`.
+2. Select “Properties”.
+3. On the resulting “tsh.exe Properties” dialog, select the “Digital Signatures”
+   tab.
+4. Select the “Gravitational Inc.” signer from the list.
+5. Select the “Details” button.
+5. On the resulting “Digital Signature Details” dialog, ensure that the header
+   states “This digital signature is OK.”
+6. Select the “View Certificate” button.
+7. On the resulting “Certificate” dialog, select the “Details” tab.
+8. Select the “Thumbprint” item from the list, and compare its value to the
+   thumbprint listed above.
+
+## OCI container images
+All of our distroless OCI container images are signed with `cosign`. The public
+key is:
+```
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx+9UZboMl9ibwu/IWqbX
++wEJeKJqVpaLEsy1ODRpzIgcgaMh2n3BWtFEIoEszR3ZNlGdfqoPmb0nNnWx/qSf
+eEsoSXievXa63M/gAUBB+jecbGEJH+SNaJPMVuvjabPqKtoMT2Spw3cacqpINzq1
+rkWU8IawY333gXbwzgsuK7izT7ymgOLPO9qPuX7Q3EBaGw3EvY7u6UKtqhvSGdyr
+MirEErOERQ8EP8TrkCcJk0UfPAukzIcj91uHlXaqYBD/IyNYiC70EOlSLoN5/EeA
+I4jQnGRfaKF6H6K+WieX9tP9k8/02S+1EVJW592pdQZhJZEq1B/dMc8UR3IjPMMC
+qCT2xT6TsinaVzDaAbaRf0hvp311GxwrckNofGm/OSLn1+HqM6q4/A7qHubeRXGO
+byabRr93CHSLegZ7OBMswHqqnu6/DuXjc6gOsQkH09dVTFeh34rQy4GKrvnpmOwj
+Er1ccxzKcF/pw+lxi07hkpihR/uHUPxFboA/Wl7H2Jub21MFwIFQrDJv7z8yQgxJ
+EuIXJJox2oAL7NzdSi9VIUYnEnx+2EtkU/spAFRR6i1BnT6aoIy3521B76wnmRr9
+atCSKjt6MdRxgj4htCjBWWJAGM9Z/avF4CYFmK7qiVxgpdrSM8Esbt2Ta+Lu3QMJ
+T8LjqFu3u3dxVOo9RuLk+BkCAwEAAQ==
+-----END PUBLIC KEY-----
+```
+
+Signatures can be validated against the Teleport OCI image signing key:
+```console
+$ cosign verify --key teleport-oci-key.pub \
+    public.ecr.aws/gravitational/teleport-distroless-debug:(=teleport.version=)
+
+Verification for public.ecr.aws/gravitational/teleport-distroless-debug:(=teleport.version=) --
+The following checks were performed on each of these signatures:
+  - The cosign claims were validated
+  - The signatures were verified against the specified public key
+
+[
+    {
+        "critical": {
+            "identity": {
+                "docker-reference": "public.ecr.aws/gravitational/teleport-distroless-debug"
+            },
+            "image": {
+                "docker-manifest-digest": "sha256:02093593bf129dc304b79854b01b0b911674e9bd6b9049cac14b6e1b116c58e5"
+            },
+            "type": "cosign container image signature"
+        },
+        "optional": ...
+    }
+]
+```
+
+## Pre-releases and custom builds
+
+At times, we share pre-releases or one-off custom builds with customers. Those builds are available
+from cdn.cloud.gravitational.io and are signed with a different set of certificates.
+
+For Apple devices:
+
+* Developer ID: K497G57PDJ
+* SHA256 Fingerprint: `B0 34 81 61 82 B6 C6 3B 5B 4C C2 47 4E 9F EE 3F 12 AE 29 9A DE 70 BB 31 6F 2A
+  25 DC 23 46 7D 26`
+
+For Windows devices:
+
+* Issued to: Gravitational, Inc.
+* Thumbprint: `3C14BE378BE889E35B64649ED18A1EE362DA63D5`
diff --git a/docs/pages/reference/reference.mdx b/docs/pages/reference/reference.mdx
index 8c32fc711b1d9..8f10bb5140a01 100644
--- a/docs/pages/reference/reference.mdx
+++ b/docs/pages/reference/reference.mdx
@@ -1,6 +1,9 @@
 ---
 title: Teleport Reference Guides
+sidebar_label: References
 description: Provides comprehensive information on configuration fields, Teleport commands, and other ways of interacting with Teleport.
+tags:
+ - platform-wide
 ---
 
 <DocCardList />
diff --git a/docs/pages/reference/resources.mdx b/docs/pages/reference/resources.mdx
deleted file mode 100644
index 277ea89d5c9a2..0000000000000
--- a/docs/pages/reference/resources.mdx
+++ /dev/null
@@ -1,644 +0,0 @@
----
-title: Teleport Resources
-h1: Teleport Resource Reference
-description: Reference documentation for Teleport resources
----
-
-This reference guide lists dynamic resources you can manage with Teleport. For
-more information on dynamic resources, see our guide to [Using Dynamic
-Resources](../admin-guides/infrastructure-as-code/infrastructure-as-code.mdx).
-
-Examples of applying dynamic resources with `tctl`:
-
-```code
-# List all connectors:
-$ tctl get connectors
-
-# Dump a SAML connector called "okta":
-$ tctl get saml/okta
-
-# Delete a SAML connector called "okta":
-$ tctl rm saml/okta
-
-# Delete an OIDC connector called "gworkspace":
-$ tctl rm oidc/gworkspace
-
-# Delete a github connector called "myteam":
-$ tctl rm github/myteam
-
-# Delete a local user called "admin":
-$ tctl rm users/admin
-
-# Show all devices:
-$ tctl get devices
-
-# Fetch a specific device:
-$ tctl get devices/<asset-tag>
-
-# Fetch the cluster auth preferences
-$ tctl get cluster_auth_preference
-```
-
-<Admonition type="note">
-  Although `tctl get connectors` will show you every connector, when working with an individual connector you must use the correct `kind`, such as `saml` or `oidc`. You can see each connector's `kind` at the top of its YAML output from `tctl get connectors`.
-</Admonition>
-
-## List of dynamic resources
-
-Here's the list of resources currently exposed via [`tctl`](./cli/tctl.mdx):
-
-| Resource Kind | Description |
-| - | - |
-| [user](#user) | A user record in the internal Teleport user DB. |
-| [role](#role) | A role assumed by interactive and non-interactive users. |
-| connector | Authentication connectors for [Single Sign-On](../admin-guides/access-controls/sso/sso.mdx) (SSO) for SAML, OIDC and GitHub. |
-| node | A registered SSH node. The same record is displayed via `tctl nodes ls`. |
-| windows_desktop | A registered Windows desktop. |
-| cluster | A trusted cluster. See [here](../admin-guides/management/admin/trustedclusters.mdx) for more details on connecting clusters together. |
-| [login_rule](#login-rules) | A Login Rule, see the [Login Rules guide](../admin-guides/access-controls/login-rules/login-rules.mdx) for more info. |
-| [device](#device) | A Teleport Trusted Device, see the [Device Trust guide](../admin-guides/access-controls/device-trust/guide.mdx) for more info. |
-| [ui_config](#ui-config) | Configuration for the Web UI served by the Proxy Service. |
-| [vnet_config](#vnet-config) | Configuration for the cluster's VNet options. |
-| [cluster_auth_preference](#cluster-auth-preferences) | Configuration for the cluster's auth preferences. |
-| [database_object_import_rule](#database-object-import-rule) | Database object import rules. |
-| [autoupdate_config](#auto-update-config) | Client tools auto-update configuration |
-| [autoupdate_version](#auto-update-version) | Client tools auto-update target version configuration |
-| [access_monitoring_rule](#access-monitoring-rule) | Access monitoring rules. |
-
-## User
-
-Teleport supports interactive local users, non-interactive local users (bots)
-and single-sign on users that are represented as a resource.
-
-```yaml
-kind: user
-version: v2
-metadata:
-  name: joe
-spec:
-  # roles is a list of roles assigned to this user
-  roles:
-  - admin
-  # status sets user temporarily locked in a Teleport system, for example
-  # when users exceed predefined amount of failed login attempts
-  status:
-    is_locked: false
-    lock_expires: 0001-01-01T00:00:00Z
-    locked_time: 0001-01-01T00:00:00Z
-  # traits are key, list of values pairs assigned to a user resource.
-  # Traits can be used in role templates as variables.
-  traits:
-    logins:
-    - joe
-    - root
-  # expires, if not empty, sets automatic expiry of the resource
-  expires: 0001-01-01T00:00:00Z
-  # created_by is a system property that tracks
-  # identity of the author of this user resource.
-  created_by:
-    time: 0001-01-01T00:00:00Z
-    user:
-      name: builtin-Admin
-```
-
-## Role
-
-Interactive and non-interactive users (bots) assume one or many roles.
-
-Roles govern access to databases, SSH servers, Kubernetes clusters, web services and applications and Windows Desktops.
-
-(!docs/pages/includes/role-spec.mdx!)
-
-### Role versions
-
-Versions 5, 6 and 7 of the Teleport role resource have different behaviors when
-accessing Kubernetes resources.
-{/*lint ignore messaging*/}
-Roles not [granting Kubernetes access](../enroll-resources/kubernetes-access/introduction.mdx) are
-equivalent in the three versions.
-
-Roles v5 and v6 can only restrict actions on pods (e.g. executing in them).
-Role v7 supports restricting all common resource kinds (
-see [the `kubernetes_resource` documentation](../enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources)
-for a complete list).
-
-When no `kubernetes_resource` is set:
-- Roles v5 and v7 grant all access by default
-- Roles v6 blocks pod execution by default, this was reverted by roles v7 to improve the user experience.
-
-{/* This table is cursed. Our current docs engine doesn't support HTML tables
-(due to SSR and the rehydration process). We have dto do everything inlined in
-markdown. Some HTML character codes are used to render specific chars like {}
-or to avoid line breaks in the middle fo the YAML. Spaces before br tags
-are required.*/}
-
-| Allow rule                                                                                                                                                                                                                                                                | Role v5                                                                                                           | Role v6                                                                                                           | Role v7                                                                                                                                                                                               |
-|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: &#123;&#125; <br/>kubernetes_resources:&nbsp;[]<br/></pre>                                                                                                                                      | ❌ no access                                                                                                       | ❌ no access                                                                                                       | ❌ no access                                                                                                                                                                                           |
-| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources:&nbsp;[]<br/></pre>                                                                                                                               | ✅ full access to `dev` clusters                                                                                   | ❌ cannot exec in pods <br/> ✅ can access other <br/>resources like `secrets`                                      | ✅ full access to `dev` clusters                                                                                                                                                                       |
-| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - name: "&ast;" <br/>    kind: pod <br/>    namespace: "foo"</pre>                                                                        | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in all namespaces. <br/>❌ cannot exec in other namespaces | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in all namespaces. <br/>❌ cannot exec in other namespaces | ✅ can exec in pods in `foo` <br/>❌ cannot access `secrets` in all namespaces <br/>❌ cannot exec in other namespaces                                                                                   |
-| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - name: "&ast;" <br/>    kind: pod <br/>    namespace: "foo" <br/>  - name: "&ast;" <br/>    kind: secret <br/>    namespace: "foo"</pre> | ⚠️ not supported                                                                                                  | ⚠️ not supported                                                                                                  | ✅ can exec in pods in `foo` <br/>✅ can access `secrets` in `foo` <br/>❌ cannot exec in other namespaces <br/>❌ cannot access `secrets` in other namespaces <br/>❌ cannot access `configmaps` in `foo` |
-| <pre>kubernetes_groups: <br/>  - "system:masters" <br/>kubernetes_labels: <br/>  env: ["dev"] <br/>kubernetes_resources: <br/>  - kind: "namespace" <br/>    name: "foo"</pre>                                                                                            | ⚠️ not supported                                                                                                  | ⚠️ not supported                                                                                                  | ✅ full access in namespace `foo` <br/>❌ cannot access other namespaces                                                                                                                                |
-
-
-## Windows desktops
-
-In most cases, Teleport will register `windows_desktop` resources automatically
-based on static hosts in your configuration file or via LDAP-based discovery.
-
-You can also use [dynamic
-registration](../enroll-resources/desktop-access/dynamic-registration.mdx) using
-`dynamic_windows_desktop` resources. This can be useful for managing inventories
-of hosts that are not joined to an Active Directory domain.
-
-There are a few important considerations to keep in mind when registering
-desktops this way:
-
-1. The desktop's `addr` can be a hostname or IP address, and should include
-   the RDP port (typically 3389).
-1. If you intend to log in to the desktop with local Windows users you must set
-   `non_ad: true`. If you intend to log in with Active Directory users, leave
-   `non_ad` unset (or false), and specify the Active Directory domain in the
-   `domain` field.
-
-## Login Rules
-
-Login rules contain logic to transform SSO user traits during login.
-
-(!docs/pages/includes/login-rule-spec.mdx!)
-
-## Database object import rule
-
-Database object import rule define the labels to be applied to database objects imported into Teleport.
-
-See [Database Access Controls](../enroll-resources/database-access/rbac.mdx) for more details.
-
-(!docs/pages/includes/database-access/auto-user-provisioning/database-object-import-rule-spec.mdx!)
-
-## Device
-
-Device contains information identifying a trusted device.
-
-(!docs/pages/includes/device-spec.mdx!)
-
-## UI config
-
-Global configuration options for the Web UI served by the Proxy Service. This resource is not set by default, which means a `tctl get ui` will result in an error if used before this resource has been set.
-
-(!docs/pages/includes/ui-config-spec.mdx!)
-
-## VNet config
-
-Cluster-specific options VNet should use when setting up connections to resources from this cluster.
-
-See [VNet](../enroll-resources/application-access/guides/vnet.mdx) for more details.
-
-```yaml
-kind: vnet_config
-version: v1
-metadata:
-  name: vnet-config
-spec:
-  # The range to use when assigning IP addresses to resources.
-  # It can be changed in case of conflicts with other software
-  # deployed on end user devices. Defaults to "100.64.0.0/10".
-  ipv4_cidr_range: "100.64.0.0/10"
-  # Extra DNS zones that VNet should capture DNS queries for.
-  # Set them if your TCP apps use custom public_addr.
-  # Requires DNS TXT record to be set on the domains,
-  # see the guide linked above. Empty by default.
-  custom_dns_zones:
-  - suffix: company.test
-```
-
-## Cluster maintenance config
-
-Global configuration options for the agents enrolled into automatic updates (v1).
-
-<Admonition type="warning">
-`cluster_maintenance_config` configures Managed Updates v1,
-which are currently supported but will be superseded by Managed Updates v2.
-The `autoupdate_config` and `autoupdate_version` resources further down
-configure Managed Updates v2.
-</Admonition>
-
-(!docs/pages/includes/cluster-maintenance-config-spec.mdx!)
-
-## Cluster auth preferences
-
-Global cluster configuration options for authentication.
-
-```yaml
-metadata:
-  name: cluster-auth-preference
-spec:
-  # Sets the list of allowed second factors for the cluster.
-  # Possible values: "otp", "webauthn", and "sso".
-  # Defaults to ["otp"].
-  second_factors: ["webauthn", "otp"]
-
-  # second_factors is the list of allowed second factors for the cluster.
-  # Possible values: "on", "otp" and "webauthn"
-  # If "on" is set, all MFA protocols are supported.
-  #
-  # Prefer setting second_factors instead.
-  #second_factor: "webauthn"
-
-  # The name of the OIDC or SAML connector. if this is not set, the first connector in the backend is used.
-  connector_name: ""
-
-  # webauthn is the settings for server-side Web authentication support.
-  webauthn:
-    # rp_id is the ID of the Relying Party.
-    # It should be set to the domain name of the Teleport installation.
-    #
-    # IMPORTANT: rp_id must never change in the lifetime of the cluster, because
-    # it's recorded in the registration data on the WebAuthn device. If the
-    # ri_id changes, all existing WebAuthn key registrations will become invalid
-    # and all users who use WebAuthn as the second factor will need to
-    # re-register.
-    rp_id: teleport.example.com
-    # Allow list of device attestation CAs in PEM format.
-    # If present, only devices whose attestation certificates match the
-    # certificates specified here may be registered (existing registrations are
-    # unchanged).
-    # If supplied in conjunction with `attestation_denied_cas`, then both
-    # conditions need to be true for registration to be allowed (the device
-    # MUST match an allowed CA and MUST NOT match a denied CA).
-    # By default all devices are allowed.
-    attestation_allowed_cas: []
-    # Deny list of device attestation CAs in PEM format.
-    # If present, only devices whose attestation certificates don't match the
-    # certificates specified here may be registered (existing registrations are
-    # unchanged).
-    attestation_denied_cas: []
-
-  # Enforce per-session MFA or PIV-hardware key restrictions on user login sessions.
-  # Possible values: true, false, "hardware_key", "hardware_key_touch".
-  # Defaults to false.
-  require_session_mfa: false
-
-  # Sets whether connections with expired client certificates will be disconnected.
-  disconnect_expired_cert: false
-
-  # Sets whether headless authentication is allowed.
-  # Headless authentication requires WebAuthn.
-  # Defaults to true if webauthn is configured.
-  allow_headless: false
-
-  # Sets whether local auth is enabled alongside any other authentication
-  # type.
-  allow_local_auth: true
-
-  # Sets whether passwordless authentication is allowed.
-  # Requires Webauthn to work.
-  allow_passwordless: false
-
-  # Sets the message of the day for the cluster.
-  message_of_the_day: ""
-
-  # idp is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise
-  idp:
-    # options related to the Teleport SAML IdP.
-    saml:
-      # enables access to the Teleport SAML IdP.
-      enabled: true
-
-  # locking_mode is the cluster-wide locking mode default.
-  # Possible values: "strict" or "best_effort"
-  locking_mode: best_effort
-
-  # default_session_ttl defines the default TTL (time to live) of certificates
-  # issued to the users on this cluster.
-  default_session_ttl: "12h"
-
-  # The type of authentication to use for this cluster.
-  # Possible values: "local", "oidc", "saml" and "github"
-  type: local
-
-  stable_unix_user_config:
-    # If set to true, SSH instances will use the same UID for each given
-    # username when automatically creating users.
-    enabled: false
-
-    # The range of UIDs (including both ends) used for automatic UID assignment.
-    first_uid: 90000
-    last_uid: 95000
-
-version: v2
-```
-
-## Bot
-
-Bot resources define a Machine ID Bot identity and its access.
-
-Find out more on the
-[Machine ID configuration reference](machine-id/configuration.mdx).
-
-(!docs/pages/includes/machine-id/bot-spec.mdx!)
-
-## Auto-update config
-
-Configuration options for Teleport Agent and client tools Managed Updates (v2).
-
-<Admonition type="warning">
-The `autoupdate_config` and `autoupdate_version` resources configure Managed
-Updates v2 and Managed Updates v1.
-
-`cluster_maintenance_config` above configures only Managed Updates v1
-which are currently supported but will be deprecated in a future version.
-</Admonition>
-
-```yaml
-kind: autoupdate_config
-metadata:
-  name: autoupdate-config
-spec:
-  agents:
-    # mode allows users to enable, disable, or suspend agent updates at the
-    # cluster level. Disable agent automatic updates only if self-managed
-    # updates are in place. This value may also be set in autoupdate_version.
-    # If set in both places, disabled overrides suspended, which overrides enabled.
-    # Possible values: "enabled", "disabled", "suspended"
-    # Default: "disabled" (unless specified in autoupdate_version)
-    mode: enabled
-
-    # strategy used to roll out updates to agents.
-    # The halt-on-error strategy ensures that groups earlier in the schedule are
-    # given the opportunity to update to the target_version before groups that are
-    # later in the schedule. (Currently, the schedule must be stopped manually by
-    # setting the mode to "suspended" or "disabled". In the future, errors will be
-    # detected automatically).
-    # The time-based strategy ensure that each group updates within a defined
-    # time window, with no dependence between groups.
-    # Possible values: "halt-on-error" or "time-based"
-    # Default: "halt-on-error"
-    strategy: halt-on-error
-
-    # maintenance_window_duration configures the duration after the start_hour
-    # when updates may occur. Only valid for the time-based strategy.
-    # maintenance_window_duration: 1h
-
-    # schedules define groups of agents with different update times.
-    # Currently, only the regular schedule is configurable.
-    schedules:
-      regular:
-
-        # name of each group, configured locally via "teleport-update enable --group"
-        - name: staging
-
-          # start_hour of the update, in UTC
-          start_hour: 4
-
-          # days that the update may occur on
-          # Days are not configurable for most Enterprise cloud-hosted users.
-          # Possible values: "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun", and "*"
-          # Default: [ "Mon", "Tue", "Wed", "Thu" ]
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-
-        - name: production
-          start_hour: 5
-
-          # wait_hours ensures that the group executes at least a specific number of hours
-          # after the previous group. Only valid for the halt-on-error schedule.
-          # Default: 0
-          wait_hours: 24
-
-  tools:
-    # mode allows users to enable or disable client tool updates at the
-    # cluster level. Disable client tool automatic updates only if self-managed
-    # updates are in place.
-    # Possible values: "enabled" or "disabled"
-    # Default: "disabled"
-    mode: enabled
-```
-
-See [Teleport Client Tool Managed Updates](../upgrading/client-tools-autoupdate.mdx) and
-[Teleport Agent Managed Updates](../upgrading/agent-managed-updates.mdx) for more details.
-
-## Auto-update version
-
-Allows cluster administrators to manage versions used for agent and client tools Managed Updates.
-
-<Admonition type="warning">
-The `autoupdate_config` and `autoupdate_version` resources configure Managed
-Updates v2 and Managed Updates v1.
-
-`cluster_maintenance_config` above configures only Managed Updates v1
-which are currently supported but will be deprecated in a future version.
-</Admonition>
-
-This resource is not editable for cloud-managed Teleport Enterprise to ensure that all of
-your clients receive security patches and remain compatible with your cluster.
-
-```yaml
-kind: autoupdate_version
-metadata:
-  name: autoupdate-version
-spec:
-  agents:
-    # start_version is the version used to install new agents before their
-    # group's scheduled update time. Agents never update to the start_version
-    # automatically, but may be required to via "teleport-update update --now".
-    start_version: v17.2.0
-
-    # target_version is the version that agents update to during their group's
-    # scheduled update time. New agents also use this version after their group's
-    # scheduled update time.
-    target_version: v17.2.1
-
-    # schedule used to roll out updates.
-    # The regular schedule is defined in the autoupdate_config resource.
-    # The immediate schedule updates all agents to target_version immediately.
-    # Possible values: "regular" or "immediate"
-    # Default: "regular"
-    schedule: regular
-
-    # mode allows users to enable, disable, or suspend agent updates at the
-    # cluster level. Disable agent automatic updates only if self-managed
-    # updates are in place. This value may also be set in autoupdate_config.
-    # If set in both places, disabled overrides suspended, which overrides enabled.
-    # Possible values: "enabled", "disabled", "suspended"
-    # Default: "disabled" (unless specified in autoupdate_config)
-    mode: enabled
-
-  tools:
-    # target_version is the semver version of client tools the cluster will advertise.
-    # Client tools such as tsh and tctl will update to this version at login if the
-    # mode set in autoupdate_config is set to enabled.
-    # Default: cluster version
-    target_version: v17.2.1
-```
-
-See [Teleport Client Tool Managed Updates](../upgrading/client-tools-autoupdate.mdx) and
-[Teleport Agent Managed Updates](../upgrading/agent-managed-updates.mdx) for more details.
-
-## Auto-update agent rollout
-
-Allows cluster administrators to view the current agent rollout for Teleport Agent Managed Updates (v2).
-
-This resource should not be edited by humans.
-
-```yaml
-kind: autoupdate_agent_rollout
-metadata:
-  name: autoupdate-agent-rollout
-spec:
-  # start_version is the version used to install new agents before their
-  # group's scheduled update time. Agents never update to the start_version
-  # automatically, but may be required to via "teleport-update update --now".
-  start_version: v17.2.0
-
-  # target_version is the version that agents update to during their group's
-  # scheduled update time. New agents also use this version after their group's
-  # scheduled update time.
-  target_version: v17.2.1
-
-  # schedule used to roll out updates.
-  # The regular schedule is defined in the autoupdate_config resource.
-  # The immediate schedule updates all agents to target_version immediately.
-  # Possible values: "regular" or "immediate"
-  schedule: regular
-
-  # autoupdate_mode allows users to enable, disable, or suspend agent updates at the
-  # cluster level. Disable agent automatic updates only if self-managed
-  # updates are in place. This value may also be set in autoupdate_config.
-  # If set in both places, disabled overrides suspended, which overrides enabled.
-  # Possible values: "enabled", "disabled", "suspended"
-  autoupdate_mode: enabled
-
-  # strategy used to roll out updates to agents.
-  # The halt-on-error strategy ensures that groups earlier in the schedule are
-  # given the opportunity to update to the target_version before groups that are
-  # later in the schedule. (Currently, the schedule must be stopped manually by
-  # setting the mode to "suspended" or "disabled". In the future, errors will be
-  # detected automatically).
-  # The time-based strategy ensure that each group updates within a defined
-  # time window, with no dependence between groups.
-  # Possible values: "halt-on-error" or "time-based"
-  # Default: "halt-on-error"
-  strategy: halt-on-error
-
-  # maintenance_window_duration configures the duration after the start_hour
-  # when updates may occur. Only valid for the time-based strategy.
-  # maintenance_window_duration: 1h
-
-status:
-
-  # groups contains the status for each group in the currently executing schedule.
-  groups:
-
-    # name of each group, configured locally via "teleport-update enable --group"
-    - name: staging
-
-      # start_time of the group
-      start_time: 0001-01-01T00:00:00Z
-
-      # state of the group
-      # Possible values: unstarted, active, done, rolledback
-      state: active
-
-      # last_update_time of this group's status
-      last_update_time: 0001-01-01T00:00:00Z
-
-      # last_update_reason of this group's status
-      last_update_reason: "new version"
-
-      # days that the update may occur on, from autoupdate_config
-      # Possible values: "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun", and "*"
-      config_days: [ "Mon", "Tue", "Wed", "Thu" ]
-
-      # start_hour of the update, in UTC, from autoupdate_config
-      config_start_hour: 4
-
-    - name: production
-
-      # ...
-
-      # config_wait_hours is specific number of hours after the previous group that this
-      # group may execute after, from autoupdate_config.
-      config_wait_hours: 24
-
-  # start_time of the rollout
-  start_time: 0001-01-01T00:00:00Z
-
-  # state of the entire rollout
-  # Possible values: unstarted, active, done, rolledback
-  state: active
-
-```
-
-See [Teleport Agent Managed Updates](../upgrading/agent-managed-updates.mdx) for more details.
-
-## Access monitoring rule
-
-Access monitoring rules allows cluster administrators to monitor Access Requests
-and apply notification routing and automatic review rules.
-
-```yaml
-kind: access_monitoring_rule
-version: v1
-metadata:
-  name: example_rule
-spec:
-  # subjects specifies the kinds of subjects to monitor.
-  # Possible values: "access_request"
-  subjects:
-  - access_request
-
-  # condition specifies the conditions that should be met to apply the access
-  # monitoring rule. The condition accepts a predicate expression which must
-  # evaluate to a boolean value.
-  #
-  # This condition would be satisfied by an access request if the `access` role
-  # is requested, and if the requesting user has the `team: dev` user trait.
-  condition: |-
-    contains_all(set("access"), access_request.spec.roles) &&
-    contains_any(user.traits["team"], set("dev"))
-
-  # Optional: desired_state specifies the desired reconciled state of the access
-  # request after the rule is applied. This field must be set to "reviewed" to
-  # enable automatic reviews.
-  # Possible values: "reviewed".
-  desired_state: reviewed
-
-  # Optional: automatic_review configures the automatic review rules.
-  automatic_review:
-    # integration specifies the name of an external integration source used to
-    # help determine if a requesting user satisfies the rule conditions.
-    # Use "builtin" to specify no external integration.
-    # Possible values: "builtin"
-    integration: builtin
-
-    # decision determines whether to automatically approve or deny the
-    # access request.
-    # Possible values: "APPROVED" or "DENIED"
-    decision: APPROVED
-
-  # Optional: notification configures notification routing rules.
-  notification:
-    # name specifies the external integration to which the notifications should
-    # be routed.
-    # Possible values: "email", "discord", "slack", "pagerduty", "jira",
-    # "mattermost", "msteams", "opsgenie", "servicenow", "datadog"
-    name: email
-
-    # recipients specifies the list of recipients to be notified when the
-    # access monitoring rule is applied.
-    recipients:
-    - example@goteleport.com
-```
-
-Accepted fields within the condition predicate expression:
-| Field                                   | Description                                    |
-| --------------------------------------- | ---------------------------------------------- |
-| access_request.spec.roles               | The set of roles requested.                    |
-| access_request.spec.suggested_reviewers | The set of reviewers specified in the request. |
-| access_request.spec.system_annotations  | A map of system annotations on the request.    |
-| access_request.spec.user                | The requesting user.                           |
-| access_request.spec.request_reason      | The request reason.                            |
-| access_request.spec.creation_time       | The creation time of the request.              |
-| access_request.spec.expiry              | The expiry time of the request.                |
-| user.traits                             | A map of traits of the requesting user.        |
-
-See [Predicate Language](./predicate-language.mdx) for more details.
diff --git a/docs/pages/reference/terraform-provider/data-sources/access_list.mdx b/docs/pages/reference/terraform-provider/data-sources/access_list.mdx
deleted file mode 100644
index 69bad80b38e0d..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/access_list.mdx
+++ /dev/null
@@ -1,166 +0,0 @@
----
-title: Reference for the teleport_access_list Terraform data-source
-sidebar_label: access_list
-description: This page describes the supported values of the teleport_access_list data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Optional
-
-- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
-- `spec` (Attributes) spec is the specification for the Access List. (see [below for nested schema](#nested-schema-for-spec))
-
-### Nested Schema for `header`
-
-Required:
-
-- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
-
-Optional:
-
-- `kind` (String) kind is a resource kind.
-- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
-- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `header.metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
-- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
-
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `audit` (Attributes) audit describes the frequency that this Access List must be audited. (see [below for nested schema](#nested-schema-for-specaudit))
-- `grants` (Attributes) grants describes the access granted by membership to this Access List. (see [below for nested schema](#nested-schema-for-specgrants))
-- `owners` (Attributes List) owners is a list of owners of the Access List. (see [below for nested schema](#nested-schema-for-specowners))
-
-Optional:
-
-- `description` (String) description is an optional plaintext description of the Access List.
-- `membership_requires` (Attributes) membership_requires describes the requirements for a user to be a member of the Access List. For a membership to an Access List to be effective, the user must meet the requirements of Membership_requires and must be in the members list. (see [below for nested schema](#nested-schema-for-specmembership_requires))
-- `owner_grants` (Attributes) owner_grants describes the access granted by owners to this Access List. (see [below for nested schema](#nested-schema-for-specowner_grants))
-- `ownership_requires` (Attributes) ownership_requires describes the requirements for a user to be an owner of the Access List. For ownership of an Access List to be effective, the user must meet the requirements of ownership_requires and must be in the owners list. (see [below for nested schema](#nested-schema-for-specownership_requires))
-- `title` (String) title is a plaintext short description of the Access List.
-
-### Nested Schema for `spec.audit`
-
-Required:
-
-- `recurrence` (Attributes) recurrence is the recurrence definition (see [below for nested schema](#nested-schema-for-specauditrecurrence))
-
-Optional:
-
-- `next_audit_date` (String) next_audit_date is when the next audit date should be done by.
-- `notifications` (Attributes) notifications is the configuration for notifying users. (see [below for nested schema](#nested-schema-for-specauditnotifications))
-
-### Nested Schema for `spec.audit.recurrence`
-
-Required:
-
-- `frequency` (Number) frequency is the frequency of reviews. This represents the period in months between two reviews. Supported values are 0, 1, 3, 6, and 12.
-
-Optional:
-
-- `day_of_month` (Number) day_of_month is the day of month that reviews will be scheduled on. Supported values are 0, 1, 15, and 31.
-
-
-### Nested Schema for `spec.audit.notifications`
-
-Optional:
-
-- `start` (String) start specifies when to start notifying users that the next audit date is coming up.
-
-
-
-### Nested Schema for `spec.grants`
-
-Optional:
-
-- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
-- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specgrantstraits))
-
-### Nested Schema for `spec.grants.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.owners`
-
-Optional:
-
-- `description` (String) description is the plaintext description of the owner and why they are an owner.
-- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
-- `name` (String) name is the username of the owner.
-
-
-### Nested Schema for `spec.membership_requires`
-
-Optional:
-
-- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
-- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specmembership_requirestraits))
-
-### Nested Schema for `spec.membership_requires.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.owner_grants`
-
-Optional:
-
-- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
-- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specowner_grantstraits))
-
-### Nested Schema for `spec.owner_grants.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.ownership_requires`
-
-Optional:
-
-- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
-- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specownership_requirestraits))
-
-### Nested Schema for `spec.ownership_requires.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/access_monitoring_rule.mdx b/docs/pages/reference/terraform-provider/data-sources/access_monitoring_rule.mdx
deleted file mode 100644
index 977e148109dcf..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/access_monitoring_rule.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Reference for the teleport_access_monitoring_rule Terraform data-source
-sidebar_label: access_monitoring_rule
-description: This page describes the supported values of the teleport_access_monitoring_rule data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an AccessMonitoringRule specification (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) version is version
-
-### Optional
-
-- `metadata` (Attributes) metadata is the rules's metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Required:
-
-- `subjects` (List of String) subjects the rule operates on, can be a resource kind or a particular resource property.
-
-Optional:
-
-- `automatic_review` (Attributes) automatic_review defines automatic review configurations for access requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specautomatic_review))
-- `condition` (String) condition is a predicate expression that operates on the specified subject resources, and determines whether the subject will be moved into desired state.
-- `desired_state` (String) desired_state defines the desired state of the subject. For access request subjects, the desired_state may be set to `reviewed` to indicate that the access request should be automatically reviewed.
-- `notification` (Attributes) notification defines the plugin configuration for notifications if rule is triggered. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specnotification))
-- `states` (List of String) states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.
-
-### Nested Schema for `spec.automatic_review`
-
-Optional:
-
-- `decision` (String) decision specifies the proposed state of the access review. This can be either 'APPROVED' or 'DENIED'.
-- `integration` (String) integration is the name of the integration that is responsible for monitoring the rule. Set this value to `builtin` to monitor the rule with Teleport.
-
-
-### Nested Schema for `spec.notification`
-
-Optional:
-
-- `name` (String) name is the name of the plugin to which this configuration should apply.
-- `recipients` (List of String) recipients is the list of recipients the plugin should notify.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/app.mdx b/docs/pages/reference/terraform-provider/data-sources/app.mdx
deleted file mode 100644
index ae1ecc738108d..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/app.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-title: Reference for the teleport_app Terraform data-source
-sidebar_label: app
-description: This page describes the supported values of the teleport_app data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is the app resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the app resource spec. (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource subkind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `aws` (Attributes) AWS contains additional options for AWS applications. (see [below for nested schema](#nested-schema-for-specaws))
-- `cloud` (String) Cloud identifies the cloud instance the app represents.
-- `cors` (Attributes) CORSPolicy defines the Cross-Origin Resource Sharing settings for the app. (see [below for nested schema](#nested-schema-for-speccors))
-- `dynamic_labels` (Attributes Map) DynamicLabels are the app's command labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
-- `identity_center` (Attributes) IdentityCenter encasulates AWS identity-center specific information. Only valid for Identity Center account apps. (see [below for nested schema](#nested-schema-for-specidentity_center))
-- `insecure_skip_verify` (Boolean) InsecureSkipVerify disables app's TLS certificate verification.
-- `integration` (String) Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.
-- `public_addr` (String) PublicAddr is the public address the application is accessible at.
-- `required_app_names` (List of String) RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate along side this app.
-- `rewrite` (Attributes) Rewrite is a list of rewriting rules to apply to requests and responses. (see [below for nested schema](#nested-schema-for-specrewrite))
-- `tcp_ports` (Attributes List) TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol. (see [below for nested schema](#nested-schema-for-spectcp_ports))
-- `uri` (String) URI is the web app endpoint.
-- `use_any_proxy_public_addr` (Boolean) UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.
-- `user_groups` (List of String) UserGroups are a list of user group IDs that this app is associated with.
-
-### Nested Schema for `spec.aws`
-
-Optional:
-
-- `external_id` (String) ExternalID is the AWS External ID used when assuming roles in this app.
-- `roles_anywhere_profile` (Attributes) RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps. (see [below for nested schema](#nested-schema-for-specawsroles_anywhere_profile))
-
-### Nested Schema for `spec.aws.roles_anywhere_profile`
-
-Optional:
-
-- `accept_role_session_name` (Boolean) Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName
-- `profile_arn` (String) ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.
-
-
-
-### Nested Schema for `spec.cors`
-
-Optional:
-
-- `allow_credentials` (Boolean) allow_credentials indicates whether credentials are allowed.
-- `allowed_headers` (List of String) allowed_headers specifies which headers can be used when accessing the app.
-- `allowed_methods` (List of String) allowed_methods specifies which methods are allowed when accessing the app.
-- `allowed_origins` (List of String) allowed_origins specifies which origins are allowed to access the app.
-- `exposed_headers` (List of String) exposed_headers indicates which headers are made available to scripts via the browser.
-- `max_age` (Number) max_age indicates how long (in seconds) the results of a preflight request can be cached.
-
-
-### Nested Schema for `spec.dynamic_labels`
-
-Optional:
-
-- `command` (List of String) Command is a command to run
-- `period` (String) Period is a time between command runs
-- `result` (String) Result captures standard output
-
-
-### Nested Schema for `spec.identity_center`
-
-Optional:
-
-- `account_id` (String) Account ID is the AWS-assigned ID of the account
-- `permission_sets` (Attributes List) PermissionSets lists the available permission sets on the given account (see [below for nested schema](#nested-schema-for-specidentity_centerpermission_sets))
-
-### Nested Schema for `spec.identity_center.permission_sets`
-
-Optional:
-
-- `arn` (String) ARN is the fully-formed ARN of the Permission Set.
-- `assignment_name` (String) AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.
-- `name` (String) Name is the human-readable name of the Permission Set.
-
-
-
-### Nested Schema for `spec.rewrite`
-
-Optional:
-
-- `headers` (Attributes List) Headers is a list of headers to inject when passing the request over to the application. (see [below for nested schema](#nested-schema-for-specrewriteheaders))
-- `jwt_claims` (String) JWTClaims configures whether roles/traits are included in the JWT token.
-- `redirect` (List of String) Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.
-
-### Nested Schema for `spec.rewrite.headers`
-
-Optional:
-
-- `name` (String) Name is the http header name.
-- `value` (String) Value is the http header value.
-
-
-
-### Nested Schema for `spec.tcp_ports`
-
-Optional:
-
-- `end_port` (Number) EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.
-- `port` (Number) Port describes the start of the range. It must be between 1 and 65535.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/auth_preference.mdx b/docs/pages/reference/terraform-provider/data-sources/auth_preference.mdx
deleted file mode 100644
index 36b821618c116..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/auth_preference.mdx
+++ /dev/null
@@ -1,134 +0,0 @@
----
-title: Reference for the teleport_auth_preference Terraform data-source
-sidebar_label: auth_preference
-description: This page describes the supported values of the teleport_auth_preference data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an AuthPreference specification (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `allow_headless` (Boolean) AllowHeadless enables/disables headless support. Headless authentication requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
-- `allow_local_auth` (Boolean) AllowLocalAuth is true if local authentication is enabled.
-- `allow_passwordless` (Boolean) AllowPasswordless enables/disables passwordless support. Passwordless requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
-- `connector_name` (String) ConnectorName is the name of the OIDC or SAML connector. If this value is not set the first connector in the backend will be used.
-- `default_session_ttl` (String) DefaultSessionTTL is the TTL to use for user certs when an explicit TTL is not requested.
-- `device_trust` (Attributes) DeviceTrust holds settings related to trusted device verification. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specdevice_trust))
-- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert provides disconnect expired certificate setting - if true, connections with expired client certificates will get disconnected
-- `hardware_key` (Attributes) HardwareKey are the settings for hardware key support. (see [below for nested schema](#nested-schema-for-spechardware_key))
-- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specidp))
-- `locking_mode` (String) LockingMode is the cluster-wide locking mode default.
-- `message_of_the_day` (String)
-- `okta` (Attributes) Okta is a set of options related to the Okta service in Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specokta))
-- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this cluster. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
-- `second_factor` (String) SecondFactor is the type of mult-factor. Deprecated: Prefer using SecondFactors instead.
-- `second_factors` (List of Number) SecondFactors is a list of supported multi-factor types. 1 is "otp", 2 is "webauthn", 3 is "sso", If unspecified, the current default value is [1], or ["otp"].
-- `signature_algorithm_suite` (Number) SignatureAlgorithmSuite is the configured signature algorithm suite for the cluster. If unspecified, the current default value is "legacy". 1 is "legacy", 2 is "balanced-v1", 3 is "fips-v1", 4 is "hsm-v1".
-- `stable_unix_user_config` (Attributes) StableUnixUserConfig contains the cluster-wide configuration for stable UNIX users. (see [below for nested schema](#nested-schema-for-specstable_unix_user_config))
-- `type` (String) Type is the type of authentication.
-- `u2f` (Attributes) U2F are the settings for the U2F device. (see [below for nested schema](#nested-schema-for-specu2f))
-- `webauthn` (Attributes) Webauthn are the settings for server-side Web Authentication support. (see [below for nested schema](#nested-schema-for-specwebauthn))
-
-### Nested Schema for `spec.device_trust`
-
-Optional:
-
-- `auto_enroll` (Boolean) Enable device auto-enroll. Auto-enroll lets any user issue a device enrollment token for a known device that is not already enrolled. `tsh` takes advantage of auto-enroll to automatically enroll devices on user login, when appropriate. The effective cluster Mode still applies: AutoEnroll=true is meaningless if Mode="off".
-- `ekcert_allowed_cas` (List of String) Allow list of EKCert CAs in PEM format. If present, only TPM devices that present an EKCert that is signed by a CA specified here may be enrolled (existing enrollments are unchanged).  If not present, then the CA of TPM EKCerts will not be checked during enrollment, this allows any device to enroll.
-- `mode` (String) Mode of verification for trusted devices.  The following modes are supported:  - "off": disables both device authentication and authorization. - "optional": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - "required": enforces the presence of device extensions for sensitive endpoints.  Mode is always "off" for OSS. Defaults to "optional" for Enterprise.
-
-
-### Nested Schema for `spec.hardware_key`
-
-Optional:
-
-- `pin_cache_ttl` (String) PinCacheTTL is the amount of time in nanoseconds that Teleport clients will cache the user's PIV PIN when hardware key PIN policy is enabled.
-- `piv_slot` (String) PIVSlot is a PIV slot that Teleport clients should use instead of the default based on private key policy. For example, "9a" or "9e".
-- `serial_number_validation` (Attributes) SerialNumberValidation holds settings for hardware key serial number validation. By default, serial number validation is disabled. (see [below for nested schema](#nested-schema-for-spechardware_keyserial_number_validation))
-
-### Nested Schema for `spec.hardware_key.serial_number_validation`
-
-Optional:
-
-- `enabled` (Boolean) Enabled indicates whether hardware key serial number validation is enabled.
-- `serial_number_trait_name` (String) SerialNumberTraitName is an optional custom user trait name for hardware key serial numbers to replace the default: "hardware_key_serial_numbers".  Note: Values for this user trait should be a comma-separated list of serial numbers, or a list of comm-separated lists. e.g ["123", "345,678"]
-
-
-
-### Nested Schema for `spec.idp`
-
-Optional:
-
-- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specidpsaml))
-
-### Nested Schema for `spec.idp.saml`
-
-Optional:
-
-- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
-
-
-
-### Nested Schema for `spec.okta`
-
-Optional:
-
-- `sync_period` (String) SyncPeriod is the duration between synchronization calls in nanoseconds.
-
-
-### Nested Schema for `spec.stable_unix_user_config`
-
-Optional:
-
-- `enabled` (Boolean) Enabled signifies that (UNIX) Teleport SSH hosts should obtain a UID from the control plane if they're about to provision a host user with no other configured UID.
-- `first_uid` (Number) FirstUid is the start of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
-- `last_uid` (Number) LastUid is the end of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
-
-
-### Nested Schema for `spec.u2f`
-
-Optional:
-
-- `app_id` (String) AppID returns the application ID for universal mult-factor.
-- `device_attestation_cas` (List of String) DeviceAttestationCAs contains the trusted attestation CAs for U2F devices.
-- `facets` (List of String) Facets returns the facets for universal mult-factor. Deprecated: Kept for backwards compatibility reasons, but Facets have no effect since Teleport v10, when Webauthn replaced the U2F implementation.
-
-
-### Nested Schema for `spec.webauthn`
-
-Optional:
-
-- `attestation_allowed_cas` (List of String) Allow list of device attestation CAs in PEM format. If present, only devices whose attestation certificates match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationDeniedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default all devices are allowed.
-- `attestation_denied_cas` (List of String) Deny list of device attestation CAs in PEM format. If present, only devices whose attestation certificates don't match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationAllowedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default no devices are denied.
-- `rp_id` (String) RPID is the ID of the Relying Party. It should be set to the domain name of the Teleport installation.  IMPORTANT: RPID must never change in the lifetime of the cluster, because it's recorded in the registration data on the WebAuthn device. If the RPID changes, all existing WebAuthn key registrations will become invalid and all users who use WebAuthn as the multi-factor will need to re-register.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/autoupdate_config.mdx b/docs/pages/reference/terraform-provider/data-sources/autoupdate_config.mdx
deleted file mode 100644
index 7d8feb1e83ce9..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/autoupdate_config.mdx
+++ /dev/null
@@ -1,77 +0,0 @@
----
-title: Reference for the teleport_autoupdate_config Terraform data-source
-sidebar_label: autoupdate_config
-description: This page describes the supported values of the teleport_autoupdate_config data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String)
-
-### Optional
-
-- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String)
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
-- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
-
-### Nested Schema for `spec.agents`
-
-Optional:
-
-- `maintenance_window_duration` (String) maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based". Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next maintenance window.
-- `mode` (String) mode specifies whether agent autoupdates are enabled, disabled, or paused.
-- `schedules` (Attributes) schedules specifies schedules for updates of grouped agents. (see [below for nested schema](#nested-schema-for-specagentsschedules))
-- `strategy` (String) strategy to use for updating the agents.
-
-### Nested Schema for `spec.agents.schedules`
-
-Optional:
-
-- `regular` (Attributes List) regular schedules for non-critical versions. (see [below for nested schema](#nested-schema-for-specagentsschedulesregular))
-
-### Nested Schema for `spec.agents.schedules.regular`
-
-Optional:
-
-- `days` (List of String) days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
-- `name` (String) name of the group
-- `start_hour` (Number) start_hour to initiate update
-- `wait_hours` (Number) wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure". This field must be positive.
-
-
-
-
-### Nested Schema for `spec.tools`
-
-Optional:
-
-- `mode` (String) Mode defines state of the client tools auto update.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `name` (String) name is an object name.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/autoupdate_version.mdx b/docs/pages/reference/terraform-provider/data-sources/autoupdate_version.mdx
deleted file mode 100644
index 4737c8dbb4f8f..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/autoupdate_version.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: Reference for the teleport_autoupdate_version Terraform data-source
-sidebar_label: autoupdate_version
-description: This page describes the supported values of the teleport_autoupdate_version data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String)
-
-### Optional
-
-- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String)
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
-- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
-
-### Nested Schema for `spec.agents`
-
-Optional:
-
-- `mode` (String) autoupdate_mode to use for the rollout
-- `schedule` (String) schedule to use for the rollout
-- `start_version` (String) start_version is the version to update from.
-- `target_version` (String) target_version is the version to update to.
-
-
-### Nested Schema for `spec.tools`
-
-Optional:
-
-- `target_version` (String) TargetVersion specifies the semantic version required for tools to establish a connection with the cluster. Client tools after connection to the cluster going to be updated to this version automatically.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `name` (String) name is an object name.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/cluster_networking_config.mdx b/docs/pages/reference/terraform-provider/data-sources/cluster_networking_config.mdx
deleted file mode 100644
index cc5ac33f000fe..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/cluster_networking_config.mdx
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: Reference for the teleport_cluster_networking_config Terraform data-source
-sidebar_label: cluster_networking_config
-description: This page describes the supported values of the teleport_cluster_networking_config data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a ClusterNetworkingConfig specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `assist_command_execution_workers` (Number) AssistCommandExecutionWorkers determines the number of workers that will execute arbitrary Assist commands on servers in parallel
-- `case_insensitive_routing` (Boolean) CaseInsensitiveRouting causes proxies to use case-insensitive hostname matching.
-- `client_idle_timeout` (String) ClientIdleTimeout sets global cluster default setting for client idle timeouts.
-- `idle_timeout_message` (String) ClientIdleTimeoutMessage is the message sent to the user when a connection times out.
-- `keep_alive_count_max` (Number) KeepAliveCountMax is the number of keep-alive messages that can be missed before the server disconnects the connection to the client.
-- `keep_alive_interval` (String) KeepAliveInterval is the interval at which the server sends keep-alive messages to the client.
-- `proxy_listener_mode` (Number) ProxyListenerMode is proxy listener mode used by Teleport Proxies. 0 is "separate"; 1 is "multiplex".
-- `proxy_ping_interval` (String) ProxyPingInterval defines in which interval the TLS routing ping message should be sent. This is applicable only when using ping-wrapped connections, regular TLS routing connections are not affected.
-- `routing_strategy` (Number) RoutingStrategy determines the strategy used to route to nodes. 0 is "unambiguous_match"; 1 is "most_recent".
-- `session_control_timeout` (String) SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the auth server before it begins terminating controlled sessions.
-- `ssh_dial_timeout` (String) SSHDialTimeout is a custom dial timeout used when establishing SSH connections. If not set, the default timeout of 30s will be used.
-- `tunnel_strategy` (Attributes) TunnelStrategyV1 determines the tunnel strategy used in the cluster. (see [below for nested schema](#nested-schema-for-spectunnel_strategy))
-- `web_idle_timeout` (String) WebIdleTimeout sets global cluster default setting for the web UI idle timeouts.
-
-### Nested Schema for `spec.tunnel_strategy`
-
-Optional:
-
-- `agent_mesh` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyagent_mesh))
-- `proxy_peering` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyproxy_peering))
-
-### Nested Schema for `spec.tunnel_strategy.agent_mesh`
-
-Optional:
-
-- `active` (Boolean) Automatically generated field preventing empty message errors
-
-
-### Nested Schema for `spec.tunnel_strategy.proxy_peering`
-
-Optional:
-
-- `agent_connection_count` (Number)
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/data-sources.mdx b/docs/pages/reference/terraform-provider/data-sources/data-sources.mdx
deleted file mode 100644
index 68a856a5746df..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/data-sources.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: "Terraform data-sources index"
-description: "Index of all the data-sources supported by the Teleport Terraform Provider"
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-{/*
-    This file will be renamed data-sources.mdx during build time.
-    The template name is reserved by tfplugindocs so we suffix with -index.
-*/}
-
-The Teleport Terraform provider supports the following data-sources:
-
-  - [`teleport_access_list`](./access_list.mdx)
-  - [`teleport_access_monitoring_rule`](./access_monitoring_rule.mdx)
-  - [`teleport_app`](./app.mdx)
-  - [`teleport_auth_preference`](./auth_preference.mdx)
-  - [`teleport_autoupdate_config`](./autoupdate_config.mdx)
-  - [`teleport_autoupdate_version`](./autoupdate_version.mdx)
-  - [`teleport_cluster_maintenance_config`](./cluster_maintenance_config.mdx)
-  - [`teleport_cluster_networking_config`](./cluster_networking_config.mdx)
-  - [`teleport_database`](./database.mdx)
-  - [`teleport_dynamic_windows_desktop`](./dynamic_windows_desktop.mdx)
-  - [`teleport_github_connector`](./github_connector.mdx)
-  - [`teleport_health_check_config`](./health_check_config.mdx)
-  - [`teleport_installer`](./installer.mdx)
-  - [`teleport_login_rule`](./login_rule.mdx)
-  - [`teleport_oidc_connector`](./oidc_connector.mdx)
-  - [`teleport_okta_import_rule`](./okta_import_rule.mdx)
-  - [`teleport_provision_token`](./provision_token.mdx)
-  - [`teleport_role`](./role.mdx)
-  - [`teleport_saml_connector`](./saml_connector.mdx)
-  - [`teleport_session_recording_config`](./session_recording_config.mdx)
-  - [`teleport_static_host_user`](./static_host_user.mdx)
-  - [`teleport_trusted_cluster`](./trusted_cluster.mdx)
-  - [`teleport_trusted_device`](./trusted_device.mdx)
-  - [`teleport_user`](./user.mdx)
-  - [`teleport_workload_identity`](./workload_identity.mdx)
diff --git a/docs/pages/reference/terraform-provider/data-sources/database.mdx b/docs/pages/reference/terraform-provider/data-sources/database.mdx
deleted file mode 100644
index e00fdf02b8955..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/database.mdx
+++ /dev/null
@@ -1,251 +0,0 @@
----
-title: Reference for the teleport_database Terraform data-source
-sidebar_label: database
-description: This page describes the supported values of the teleport_database data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is the database metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the database spec. (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource subkind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `protocol` (String) Protocol is the database protocol: postgres, mysql, mongodb, etc.
-- `uri` (String) URI is the database connection endpoint.
-
-Optional:
-
-- `ad` (Attributes) AD is the Active Directory configuration for the database. (see [below for nested schema](#nested-schema-for-specad))
-- `admin_user` (Attributes) AdminUser is the database admin user for automatic user provisioning. (see [below for nested schema](#nested-schema-for-specadmin_user))
-- `aws` (Attributes) AWS contains AWS specific settings for RDS/Aurora/Redshift databases. (see [below for nested schema](#nested-schema-for-specaws))
-- `azure` (Attributes) Azure contains Azure specific database metadata. (see [below for nested schema](#nested-schema-for-specazure))
-- `ca_cert` (String) CACert is the PEM-encoded database CA certificate.  DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.
-- `dynamic_labels` (Attributes Map) DynamicLabels is the database dynamic labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
-- `gcp` (Attributes) GCP contains parameters specific to GCP Cloud SQL databases. (see [below for nested schema](#nested-schema-for-specgcp))
-- `mongo_atlas` (Attributes) MongoAtlas contains Atlas metadata about the database. (see [below for nested schema](#nested-schema-for-specmongo_atlas))
-- `mysql` (Attributes) MySQL is an additional section with MySQL database options. (see [below for nested schema](#nested-schema-for-specmysql))
-- `oracle` (Attributes) Oracle is an additional Oracle configuration options. (see [below for nested schema](#nested-schema-for-specoracle))
-- `tls` (Attributes) TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name. (see [below for nested schema](#nested-schema-for-spectls))
-
-### Nested Schema for `spec.ad`
-
-Optional:
-
-- `domain` (String) Domain is the Active Directory domain the database resides in.
-- `kdc_host_name` (String) KDCHostName is the host name for a KDC for x509 Authentication.
-- `keytab_file` (String) KeytabFile is the path to the Kerberos keytab file.
-- `krb5_file` (String) Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.
-- `ldap_cert` (String) LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.
-- `ldap_service_account_name` (String) LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
-- `ldap_service_account_sid` (String) LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
-- `spn` (String) SPN is the service principal name for the database.
-
-
-### Nested Schema for `spec.admin_user`
-
-Optional:
-
-- `default_database` (String) DefaultDatabase is the database that the privileged database user logs into by default.  Depending on the database type, this database may be used to store procedures or data for managing database users.
-- `name` (String) Name is the username of the privileged database user.
-
-
-### Nested Schema for `spec.aws`
-
-Optional:
-
-- `account_id` (String) AccountID is the AWS account ID this database belongs to.
-- `assume_role_arn` (String) AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.
-- `docdb` (Attributes) DocumentDB contains AWS DocumentDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsdocdb))
-- `elasticache` (Attributes) ElastiCache contains AWS ElastiCache Redis specific metadata. (see [below for nested schema](#nested-schema-for-specawselasticache))
-- `external_id` (String) ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
-- `iam_policy_status` (Number) IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database.
-- `memorydb` (Attributes) MemoryDB contains AWS MemoryDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsmemorydb))
-- `opensearch` (Attributes) OpenSearch contains AWS OpenSearch specific metadata. (see [below for nested schema](#nested-schema-for-specawsopensearch))
-- `rds` (Attributes) RDS contains RDS specific metadata. (see [below for nested schema](#nested-schema-for-specawsrds))
-- `rdsproxy` (Attributes) RDSProxy contains AWS Proxy specific metadata. (see [below for nested schema](#nested-schema-for-specawsrdsproxy))
-- `redshift` (Attributes) Redshift contains Redshift specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift))
-- `redshift_serverless` (Attributes) RedshiftServerless contains AWS Redshift Serverless specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift_serverless))
-- `region` (String) Region is a AWS cloud region.
-- `secret_store` (Attributes) SecretStore contains secret store configurations. (see [below for nested schema](#nested-schema-for-specawssecret_store))
-- `session_tags` (Map of String) SessionTags is a list of AWS STS session tags.
-
-### Nested Schema for `spec.aws.docdb`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the cluster identifier.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `instance_id` (String) InstanceID is the instance identifier.
-
-
-### Nested Schema for `spec.aws.elasticache`
-
-Optional:
-
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `replication_group_id` (String) ReplicationGroupID is the Redis replication group ID.
-- `transit_encryption_enabled` (Boolean) TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.
-- `user_group_ids` (List of String) UserGroupIDs is a list of user group IDs.
-
-
-### Nested Schema for `spec.aws.memorydb`
-
-Optional:
-
-- `acl_name` (String) ACLName is the name of the ACL associated with the cluster.
-- `cluster_name` (String) ClusterName is the name of the MemoryDB cluster.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `tls_enabled` (Boolean) TLSEnabled indicates whether in-transit encryption (TLS) is enabled.
-
-
-### Nested Schema for `spec.aws.opensearch`
-
-Optional:
-
-- `domain_id` (String) DomainID is the ID of the domain.
-- `domain_name` (String) DomainName is the name of the domain.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-
-
-### Nested Schema for `spec.aws.rds`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the RDS cluster (Aurora) identifier.
-- `iam_auth` (Boolean) IAMAuth indicates whether database IAM authentication is enabled.
-- `instance_id` (String) InstanceID is the RDS instance identifier.
-- `resource_id` (String) ResourceID is the RDS instance resource identifier (db-xxx).
-- `security_groups` (List of String) SecurityGroups is a list of attached security groups for the RDS instance.
-- `subnets` (List of String) Subnets is a list of subnets for the RDS instance.
-- `vpc_id` (String) VPCID is the VPC where the RDS is running.
-
-
-### Nested Schema for `spec.aws.rdsproxy`
-
-Optional:
-
-- `custom_endpoint_name` (String) CustomEndpointName is the identifier of an RDS Proxy custom endpoint.
-- `name` (String) Name is the identifier of an RDS Proxy.
-- `resource_id` (String) ResourceID is the RDS instance resource identifier (prx-xxx).
-
-
-### Nested Schema for `spec.aws.redshift`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the Redshift cluster identifier.
-
-
-### Nested Schema for `spec.aws.redshift_serverless`
-
-Optional:
-
-- `endpoint_name` (String) EndpointName is the VPC endpoint name.
-- `workgroup_id` (String) WorkgroupID is the workgroup ID.
-- `workgroup_name` (String) WorkgroupName is the workgroup name.
-
-
-### Nested Schema for `spec.aws.secret_store`
-
-Optional:
-
-- `key_prefix` (String) KeyPrefix specifies the secret key prefix.
-- `kms_key_id` (String) KMSKeyID specifies the AWS KMS key for encryption.
-
-
-
-### Nested Schema for `spec.azure`
-
-Optional:
-
-- `is_flexi_server` (Boolean) IsFlexiServer is true if the database is an Azure Flexible server.
-- `name` (String) Name is the Azure database server name.
-- `redis` (Attributes) Redis contains Azure Cache for Redis specific database metadata. (see [below for nested schema](#nested-schema-for-specazureredis))
-- `resource_id` (String) ResourceID is the Azure fully qualified ID for the resource.
-
-### Nested Schema for `spec.azure.redis`
-
-Optional:
-
-- `clustering_policy` (String) ClusteringPolicy is the clustering policy for Redis Enterprise.
-
-
-
-### Nested Schema for `spec.dynamic_labels`
-
-Optional:
-
-- `command` (List of String) Command is a command to run
-- `period` (String) Period is a time between command runs
-- `result` (String) Result captures standard output
-
-
-### Nested Schema for `spec.gcp`
-
-Optional:
-
-- `instance_id` (String) InstanceID is the Cloud SQL instance ID.
-- `project_id` (String) ProjectID is the GCP project ID the Cloud SQL instance resides in.
-
-
-### Nested Schema for `spec.mongo_atlas`
-
-Optional:
-
-- `name` (String) Name is the Atlas database instance name.
-
-
-### Nested Schema for `spec.mysql`
-
-Optional:
-
-- `server_version` (String) ServerVersion is the server version reported by DB proxy if the runtime information is not available.
-
-
-### Nested Schema for `spec.oracle`
-
-Optional:
-
-- `audit_user` (String) AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
-
-
-### Nested Schema for `spec.tls`
-
-Optional:
-
-- `ca_cert` (String) CACert is an optional user provided CA certificate used for verifying database TLS connection.
-- `mode` (Number) Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure".
-- `server_name` (String) ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.
-- `trust_system_cert_pool` (Boolean) TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/github_connector.mdx b/docs/pages/reference/terraform-provider/data-sources/github_connector.mdx
deleted file mode 100644
index 662a0991480b2..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/github_connector.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: Reference for the teleport_github_connector Terraform data-source
-sidebar_label: github_connector
-description: This page describes the supported values of the teleport_github_connector data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an Github connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Required:
-
-- `client_id` (String) ClientID is the Github OAuth app client ID.
-- `client_secret` (String, Sensitive) ClientSecret is the Github OAuth app client secret.
-
-Optional:
-
-- `api_endpoint_url` (String) APIEndpointURL is the URL of the API endpoint of the Github instance this connector is for.
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `display` (String) Display is the connector display name.
-- `endpoint_url` (String) EndpointURL is the URL of the GitHub instance this connector is for.
-- `redirect_url` (String) RedirectURL is the authorization callback URL.
-- `teams_to_logins` (Attributes List) TeamsToLogins maps Github team memberships onto allowed logins/roles.  DELETE IN 11.0.0 Deprecated: use GithubTeamsToRoles instead. (see [below for nested schema](#nested-schema-for-specteams_to_logins))
-- `teams_to_roles` (Attributes List) TeamsToRoles maps Github team memberships onto allowed roles. (see [below for nested schema](#nested-schema-for-specteams_to_roles))
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.teams_to_logins`
-
-Optional:
-
-- `kubernetes_groups` (List of String) KubeGroups is a list of allowed kubernetes groups for this org/team.
-- `kubernetes_users` (List of String) KubeUsers is a list of allowed kubernetes users to impersonate for this org/team.
-- `logins` (List of String) Logins is a list of allowed logins for this org/team.
-- `organization` (String) Organization is a Github organization a user belongs to.
-- `team` (String) Team is a team within the organization a user belongs to.
-
-
-### Nested Schema for `spec.teams_to_roles`
-
-Optional:
-
-- `organization` (String) Organization is a Github organization a user belongs to.
-- `roles` (List of String) Roles is a list of allowed logins for this org/team.
-- `team` (String) Team is a team within the organization a user belongs to.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/health_check_config.mdx b/docs/pages/reference/terraform-provider/data-sources/health_check_config.mdx
deleted file mode 100644
index bdd5769e5d3c5..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/health_check_config.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Reference for the teleport_health_check_config Terraform data-source
-sidebar_label: health_check_config
-description: This page describes the supported values of the teleport_health_check_config data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `metadata` (Attributes) Metadata is the health check config resource's metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the health check config specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the health check config version.
-
-### Optional
-
-- `sub_kind` (String) SubKind is an optional resource sub kind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `match` (Attributes) Match is used to select resources that these settings apply to. (see [below for nested schema](#nested-schema-for-specmatch))
-
-Optional:
-
-- `healthy_threshold` (Number) HealthyThreshold is the number of consecutive passing health checks after which a target's health status becomes "healthy".
-- `interval` (String) Interval is the time between each health check.
-- `timeout` (String) Timeout is the health check connection establishment timeout. An attempt that times out is a failed attempt.
-- `unhealthy_threshold` (Number) UnhealthyThreshold is the number of consecutive failing health checks after which a target's health status becomes "unhealthy".
-
-### Nested Schema for `spec.match`
-
-Optional:
-
-- `db_labels` (Attributes List) DBLabels matches database labels. An empty value is ignored. The match result is logically ANDed with DBLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchdb_labels))
-- `db_labels_expression` (String) DBLabelsExpression is a label predicate expression to match databases. An empty value is ignored. The match result is logically ANDed with DBLabels, if both are non-empty.
-
-### Nested Schema for `spec.match.db_labels`
-
-Optional:
-
-- `name` (String) The name of the label.
-- `values` (List of String) The values associated with the label.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/login_rule.mdx b/docs/pages/reference/terraform-provider/data-sources/login_rule.mdx
deleted file mode 100644
index 0456955695f92..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/login_rule.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Reference for the teleport_login_rule Terraform data-source
-sidebar_label: login_rule
-description: This page describes the supported values of the teleport_login_rule data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `priority` (Number) Priority is the priority of the login rule relative to other login rules in the same cluster. Login rules with a lower numbered priority will be evaluated first.
-- `version` (String) Version is the resource version.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `traits_expression` (String) TraitsExpression is a predicate expression which should return the desired traits for the user upon login.
-- `traits_map` (Attributes Map) TraitsMap is a map of trait keys to lists of predicate expressions which should evaluate to the desired values for that trait. (see [below for nested schema](#nested-schema-for-traits_map))
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `traits_map`
-
-Optional:
-
-- `values` (List of String)
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/oidc_connector.mdx b/docs/pages/reference/terraform-provider/data-sources/oidc_connector.mdx
deleted file mode 100644
index 3c05ed35fc097..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/oidc_connector.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: Reference for the teleport_oidc_connector Terraform data-source
-sidebar_label: oidc_connector
-description: This page describes the supported values of the teleport_oidc_connector data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an OIDC connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `acr_values` (String) ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.
-- `allow_unverified_email` (Boolean) AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a dynamic mapping from claims to roles. (see [below for nested schema](#nested-schema-for-specclaims_to_roles))
-- `client_id` (String) ClientID is the id of the authentication client (Teleport Auth Service).
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `client_secret` (String, Sensitive) ClientSecret is used to authenticate the client.
-- `display` (String) Display is the friendly name for this provider.
-- `google_admin_email` (String) GoogleAdminEmail is the email of a google admin to impersonate.
-- `google_service_account` (String, Sensitive) GoogleServiceAccount is a string containing google service account credentials.
-- `google_service_account_uri` (String) GoogleServiceAccountURI is a path to a google service account uri.
-- `issuer_url` (String) IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
-- `max_age` (String)
-- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
-- `pkce_mode` (String) PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
-- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
-- `provider` (String) Provider is the external identity provider.
-- `redirect_url` (List of String) RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.
-- `scope` (List of String) Scope specifies additional scopes set by provider.
-- `username_claim` (String) UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.
-
-### Nested Schema for `spec.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.mfa`
-
-Optional:
-
-- `acr_values` (String) AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.
-- `client_id` (String) ClientID is the OIDC OAuth app client ID.
-- `client_secret` (String) ClientSecret is the OIDC OAuth app client secret.
-- `enabled` (Boolean) Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.
-- `max_age` (String) MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.
-- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx b/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx
deleted file mode 100644
index 9e442133ac75c..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx
+++ /dev/null
@@ -1,358 +0,0 @@
----
-title: Reference for the teleport_provision_token Terraform data-source
-sidebar_label: provision_token
-description: This page describes the supported values of the teleport_provision_token data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is a provisioning token V2 spec (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `status` (Attributes) Status is extended status information, depending on token type. It is not user writable. (see [below for nested schema](#nested-schema-for-status))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Required:
-
-- `roles` (List of String) Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specallow))
-- `aws_iid_ttl` (String) AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.
-- `azure` (Attributes) Azure allows the configuration of options specific to the "azure" join method. (see [below for nested schema](#nested-schema-for-specazure))
-- `azure_devops` (Attributes) AzureDevops allows the configuration of options specific to the "azure_devops" join method. (see [below for nested schema](#nested-schema-for-specazure_devops))
-- `bitbucket` (Attributes) Bitbucket allows the configuration of options specific to the "bitbucket" join method. (see [below for nested schema](#nested-schema-for-specbitbucket))
-- `bot_name` (String) BotName is the name of the bot this token grants access to, if any
-- `bound_keypair` (Attributes) BoundKeypair allows the configuration of options specific to the "bound_keypair" join method. (see [below for nested schema](#nested-schema-for-specbound_keypair))
-- `circleci` (Attributes) CircleCI allows the configuration of options specific to the "circleci" join method. (see [below for nested schema](#nested-schema-for-speccircleci))
-- `gcp` (Attributes) GCP allows the configuration of options specific to the "gcp" join method. (see [below for nested schema](#nested-schema-for-specgcp))
-- `github` (Attributes) GitHub allows the configuration of options specific to the "github" join method. (see [below for nested schema](#nested-schema-for-specgithub))
-- `gitlab` (Attributes) GitLab allows the configuration of options specific to the "gitlab" join method. (see [below for nested schema](#nested-schema-for-specgitlab))
-- `join_method` (String) JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm
-- `kubernetes` (Attributes) Kubernetes allows the configuration of options specific to the "kubernetes" join method. (see [below for nested schema](#nested-schema-for-speckubernetes))
-- `oracle` (Attributes) Oracle allows the configuration of options specific to the "oracle" join method. (see [below for nested schema](#nested-schema-for-specoracle))
-- `spacelift` (Attributes) Spacelift allows the configuration of options specific to the "spacelift" join method. (see [below for nested schema](#nested-schema-for-specspacelift))
-- `suggested_agent_matcher_labels` (Map of List of String) SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to `db_service.resources.labels`. Currently, only node-join scripts create a configuration according to the suggestion.
-- `suggested_labels` (Map of List of String) SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.
-- `terraform_cloud` (Attributes) TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method. (see [below for nested schema](#nested-schema-for-specterraform_cloud))
-- `tpm` (Attributes) TPM allows the configuration of options specific to the "tpm" join method. (see [below for nested schema](#nested-schema-for-spectpm))
-
-### Nested Schema for `spec.allow`
-
-Optional:
-
-- `aws_account` (String) AWSAccount is the AWS account ID.
-- `aws_arn` (String) AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".
-- `aws_regions` (List of String) AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.
-- `aws_role` (String) AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.
-
-
-### Nested Schema for `spec.azure`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specazureallow))
-
-### Nested Schema for `spec.azure.allow`
-
-Optional:
-
-- `resource_groups` (List of String) ResourceGroups is a list of Azure resource groups the node is allowed to join from.
-- `subscription` (String) Subscription is the Azure subscription.
-
-
-
-### Nested Schema for `spec.azure_devops`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified. (see [below for nested schema](#nested-schema-for-specazure_devopsallow))
-- `organization_id` (String) OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.
-
-### Nested Schema for `spec.azure_devops.allow`
-
-Optional:
-
-- `definition_id` (String) The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.
-- `pipeline_name` (String) The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.
-- `project_id` (String) The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.
-- `project_name` (String) The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.
-- `repository_ref` (String) The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.
-- `repository_uri` (String) The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.
-- `repository_version` (String) The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.
-- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.
-
-
-
-### Nested Schema for `spec.bitbucket`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specbitbucketallow))
-- `audience` (String) Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
-- `identity_provider_url` (String) IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
-
-### Nested Schema for `spec.bitbucket.allow`
-
-Optional:
-
-- `branch_name` (String) BranchName is the name of the branch on which this pipeline executed.
-- `deployment_environment_uuid` (String) DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.
-- `repository_uuid` (String) RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
-- `workspace_uuid` (String) WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
-
-
-
-### Nested Schema for `spec.bound_keypair`
-
-Optional:
-
-- `onboarding` (Attributes) Onboarding contains parameters related to initial onboarding and keypair registration. (see [below for nested schema](#nested-schema-for-specbound_keypaironboarding))
-- `recovery` (Attributes) Recovery contains parameters related to recovery after identity expiration. (see [below for nested schema](#nested-schema-for-specbound_keypairrecovery))
-- `rotate_after` (String) RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.
-
-### Nested Schema for `spec.bound_keypair.onboarding`
-
-Optional:
-
-- `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.
-- `must_register_before` (String) MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.
-- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.
-
-
-### Nested Schema for `spec.bound_keypair.recovery`
-
-Optional:
-
-- `limit` (Number) Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.
-- `mode` (String) Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.
-
-
-
-### Nested Schema for `spec.circleci`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speccircleciallow))
-- `organization_id` (String)
-
-### Nested Schema for `spec.circleci.allow`
-
-Optional:
-
-- `context_id` (String)
-- `project_id` (String)
-
-
-
-### Nested Schema for `spec.gcp`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgcpallow))
-
-### Nested Schema for `spec.gcp.allow`
-
-Optional:
-
-- `locations` (List of String) Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").
-- `project_ids` (List of String) ProjectIDs is a list of project IDs (e.g. `<example-id-123456>`).
-- `service_accounts` (List of String) ServiceAccounts is a list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).
-
-
-
-### Nested Schema for `spec.github`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgithuballow))
-- `enterprise_server_host` (String) EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host.  This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.
-- `enterprise_slug` (String) EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE.  This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified.  See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.
-- `static_jwks` (String) StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.
-
-### Nested Schema for `spec.github.allow`
-
-Optional:
-
-- `actor` (String) The personal account that initiated the workflow run.
-- `environment` (String) The name of the environment used by the job.
-- `ref` (String) The git ref that triggered the workflow run.
-- `ref_type` (String) The type of ref, for example: "branch".
-- `repository` (String) The repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport`
-- `repository_owner` (String) The name of the organization in which the repository is stored.
-- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run.
-- `workflow` (String) The name of the workflow.
-
-
-
-### Nested Schema for `spec.gitlab`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgitlaballow))
-- `domain` (String) Domain is the domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.
-- `static_jwks` (String) StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.
-
-### Nested Schema for `spec.gitlab.allow`
-
-Optional:
-
-- `ci_config_ref_uri` (String) CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
-- `ci_config_sha` (String) CIConfigSHA is the git commit SHA for the ci_config_ref_uri.
-- `deployment_tier` (String) DeploymentTier is the deployment tier of the environment the job specifies
-- `environment` (String) Environment limits access by the environment the job deploys to (if one is associated)
-- `environment_protected` (Boolean) EnvironmentProtected is true if the Git ref is protected, false otherwise.
-- `namespace_path` (String) NamespacePath is used to limit access to jobs in a group or user's projects. Example: `mygroup`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `pipeline_source` (String) PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`
-- `project_path` (String) ProjectPath is used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `project_visibility` (String) ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.
-- `ref` (String) Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type.  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `ref_protected` (Boolean) RefProtected is true if the Git ref is protected, false otherwise.
-- `ref_type` (String) RefType allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`
-- `sub` (String) Sub roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `user_email` (String) UserEmail is the email of the user executing the job
-- `user_id` (String) UserID is the ID of the user executing the job
-- `user_login` (String) UserLogin is the username of the user executing the job
-
-
-
-### Nested Schema for `spec.kubernetes`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speckubernetesallow))
-- `static_jwks` (Attributes) StaticJWKS is the configuration specific to the `static_jwks` type. (see [below for nested schema](#nested-schema-for-speckubernetesstatic_jwks))
-- `type` (String) Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.
-
-### Nested Schema for `spec.kubernetes.allow`
-
-Optional:
-
-- `service_account` (String) ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".
-
-
-### Nested Schema for `spec.kubernetes.static_jwks`
-
-Optional:
-
-- `jwks` (String) JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.
-
-
-
-### Nested Schema for `spec.oracle`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specoracleallow))
-
-### Nested Schema for `spec.oracle.allow`
-
-Optional:
-
-- `parent_compartments` (List of String) ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.
-- `regions` (List of String) Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.
-- `tenancy` (String) Tenancy is the OCID of the instance's tenancy. Required.
-
-
-
-### Nested Schema for `spec.spacelift`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specspaceliftallow))
-- `hostname` (String) Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`
-
-### Nested Schema for `spec.spacelift.allow`
-
-Optional:
-
-- `caller_id` (String) CallerID is the ID of the caller, ie. the stack or module that generated the run.
-- `caller_type` (String) CallerType is the type of the caller, ie. the entity that owns the run - either `stack` or `module`.
-- `scope` (String) Scope is the scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
-- `space_id` (String) SpaceID is the ID of the space in which the run that owns the token was executed.
-
-
-
-### Nested Schema for `spec.terraform_cloud`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specterraform_cloudallow))
-- `audience` (String) Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the variable is set to match the cluster name, it does not need to be set here.
-- `hostname` (String) Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be `app.terraform.io`. Otherwise, it must both match the `iss` (issuer) field included in JWTs, and provide standard JWKS endpoints.
-
-### Nested Schema for `spec.terraform_cloud.allow`
-
-Optional:
-
-- `organization_id` (String) OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.
-- `organization_name` (String) OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.
-- `project_id` (String) ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.
-- `project_name` (String) ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.
-- `run_phase` (String) RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
-- `workspace_id` (String) WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
-- `workspace_name` (String) WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
-
-
-
-### Nested Schema for `spec.tpm`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining. (see [below for nested schema](#nested-schema-for-spectpmallow))
-- `ekcert_allowed_cas` (List of String) EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.
-
-### Nested Schema for `spec.tpm.allow`
-
-Optional:
-
-- `description` (String) Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"
-- `ek_certificate_serial` (String) EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4
-- `ek_public_hash` (String) EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6
-
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-- `name` (String, Sensitive) Name is an object name
-
-
-### Nested Schema for `status`
-
-Optional:
-
-- `bound_keypair` (Attributes) BoundKeypair contains status information related to bound_keypair type tokens. (see [below for nested schema](#nested-schema-for-statusbound_keypair))
-
-### Nested Schema for `status.bound_keypair`
-
-Optional:
-
-- `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any.
-- `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format.
-- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does,  either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated.
-- `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join.
-- `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`.
-- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/role.mdx b/docs/pages/reference/terraform-provider/data-sources/role.mdx
deleted file mode 100644
index 594ce5ccb8d6c..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/role.mdx
+++ /dev/null
@@ -1,536 +0,0 @@
----
-title: Reference for the teleport_role Terraform data-source
-sidebar_label: role
-description: This page describes the supported values of the teleport_role data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a role specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `allow` (Attributes) Allow is the set of conditions evaluated to grant access. (see [below for nested schema](#nested-schema-for-specallow))
-- `deny` (Attributes) Deny is the set of conditions evaluated to deny access. Deny takes priority over allow. (see [below for nested schema](#nested-schema-for-specdeny))
-- `options` (Attributes) Options is for OpenSSH options like agent forwarding. (see [below for nested schema](#nested-schema-for-specoptions))
-
-### Nested Schema for `spec.allow`
-
-Optional:
-
-- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specallowaccount_assignments))
-- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
-- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
-- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
-- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
-- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
-- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
-- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
-- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
-- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
-- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specallowdb_permissions))
-- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
-- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
-- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
-- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
-- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
-- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
-- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specallowgithub_permissions))
-- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
-- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
-- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
-- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
-- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specallowimpersonate))
-- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specallowjoin_sessions))
-- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
-- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
-- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
-- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specallowkubernetes_resources))
-- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
-- `logins` (List of String) Logins is a list of *nix system logins.
-- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
-- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
-- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specallowrequest))
-- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specallowrequire_session_join))
-- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specallowreview_requests))
-- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specallowrules))
-- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specallowspiffe))
-- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
-- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
-- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
-- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
-- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
-
-### Nested Schema for `spec.allow.account_assignments`
-
-Optional:
-
-- `account` (String)
-- `permission_set` (String)
-
-
-### Nested Schema for `spec.allow.db_permissions`
-
-Optional:
-
-- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
-- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
-
-
-### Nested Schema for `spec.allow.github_permissions`
-
-Optional:
-
-- `orgs` (List of String)
-
-
-### Nested Schema for `spec.allow.impersonate`
-
-Optional:
-
-- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
-- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.allow.join_sessions`
-
-Optional:
-
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
-- `name` (String) Name is the name of the policy.
-- `roles` (List of String) Roles is a list of roles that you can join the session of.
-
-
-### Nested Schema for `spec.allow.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
-- `kind` (String) Kind specifies the Kubernetes Resource type.
-- `name` (String) Name is the resource name. It supports wildcards.
-- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
-- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
-
-
-### Nested Schema for `spec.allow.request`
-
-Optional:
-
-- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowrequestclaims_to_roles))
-- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specallowrequestkubernetes_resources))
-- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
-- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specallowrequestreason))
-- `roles` (List of String) Roles is the name of roles which will match the request rule.
-- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
-- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
-- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specallowrequestthresholds))
-
-### Nested Schema for `spec.allow.request.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.allow.request.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
-- `kind` (String) kind specifies the Kubernetes Resource type.
-
-
-### Nested Schema for `spec.allow.request.reason`
-
-Optional:
-
-- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
-
-
-### Nested Schema for `spec.allow.request.thresholds`
-
-Optional:
-
-- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
-- `deny` (Number) Deny is the number of denials needed for state-transition.
-- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
-- `name` (String) Name is the optional human-readable name of the threshold.
-
-
-
-### Nested Schema for `spec.allow.require_session_join`
-
-Optional:
-
-- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
-- `filter` (String) Filter is a predicate that determines what users count towards this policy.
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
-- `name` (String) Name is the name of the policy.
-- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
-
-
-### Nested Schema for `spec.allow.review_requests`
-
-Optional:
-
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowreview_requestsclaims_to_roles))
-- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
-- `roles` (List of String) Roles is the name of roles which may be reviewed.
-- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
-
-### Nested Schema for `spec.allow.review_requests.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-
-### Nested Schema for `spec.allow.rules`
-
-Optional:
-
-- `actions` (List of String) Actions specifies optional actions taken when this rule matches
-- `resources` (List of String) Resources is a list of resources
-- `verbs` (List of String) Verbs is a list of verbs
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.allow.spiffe`
-
-Optional:
-
-- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
-- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
-- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
-
-
-
-### Nested Schema for `spec.deny`
-
-Optional:
-
-- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specdenyaccount_assignments))
-- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
-- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
-- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
-- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
-- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
-- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
-- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
-- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
-- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
-- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specdenydb_permissions))
-- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
-- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
-- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
-- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
-- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
-- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
-- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specdenygithub_permissions))
-- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
-- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
-- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
-- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
-- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specdenyimpersonate))
-- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specdenyjoin_sessions))
-- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
-- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
-- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
-- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specdenykubernetes_resources))
-- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
-- `logins` (List of String) Logins is a list of *nix system logins.
-- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
-- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
-- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specdenyrequest))
-- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specdenyrequire_session_join))
-- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specdenyreview_requests))
-- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specdenyrules))
-- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specdenyspiffe))
-- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
-- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
-- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
-- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
-- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
-
-### Nested Schema for `spec.deny.account_assignments`
-
-Optional:
-
-- `account` (String)
-- `permission_set` (String)
-
-
-### Nested Schema for `spec.deny.db_permissions`
-
-Optional:
-
-- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
-- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
-
-
-### Nested Schema for `spec.deny.github_permissions`
-
-Optional:
-
-- `orgs` (List of String)
-
-
-### Nested Schema for `spec.deny.impersonate`
-
-Optional:
-
-- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
-- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.deny.join_sessions`
-
-Optional:
-
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
-- `name` (String) Name is the name of the policy.
-- `roles` (List of String) Roles is a list of roles that you can join the session of.
-
-
-### Nested Schema for `spec.deny.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
-- `kind` (String) Kind specifies the Kubernetes Resource type.
-- `name` (String) Name is the resource name. It supports wildcards.
-- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
-- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
-
-
-### Nested Schema for `spec.deny.request`
-
-Optional:
-
-- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyrequestclaims_to_roles))
-- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specdenyrequestkubernetes_resources))
-- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
-- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specdenyrequestreason))
-- `roles` (List of String) Roles is the name of roles which will match the request rule.
-- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
-- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
-- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specdenyrequestthresholds))
-
-### Nested Schema for `spec.deny.request.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.deny.request.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
-- `kind` (String) kind specifies the Kubernetes Resource type.
-
-
-### Nested Schema for `spec.deny.request.reason`
-
-Optional:
-
-- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
-
-
-### Nested Schema for `spec.deny.request.thresholds`
-
-Optional:
-
-- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
-- `deny` (Number) Deny is the number of denials needed for state-transition.
-- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
-- `name` (String) Name is the optional human-readable name of the threshold.
-
-
-
-### Nested Schema for `spec.deny.require_session_join`
-
-Optional:
-
-- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
-- `filter` (String) Filter is a predicate that determines what users count towards this policy.
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
-- `name` (String) Name is the name of the policy.
-- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
-
-
-### Nested Schema for `spec.deny.review_requests`
-
-Optional:
-
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyreview_requestsclaims_to_roles))
-- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
-- `roles` (List of String) Roles is the name of roles which may be reviewed.
-- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
-
-### Nested Schema for `spec.deny.review_requests.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-
-### Nested Schema for `spec.deny.rules`
-
-Optional:
-
-- `actions` (List of String) Actions specifies optional actions taken when this rule matches
-- `resources` (List of String) Resources is a list of resources
-- `verbs` (List of String) Verbs is a list of verbs
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.deny.spiffe`
-
-Optional:
-
-- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
-- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
-- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
-
-
-
-### Nested Schema for `spec.options`
-
-Optional:
-
-- `cert_extensions` (Attributes List) CertExtensions specifies the key/values (see [below for nested schema](#nested-schema-for-specoptionscert_extensions))
-- `cert_format` (String) CertificateFormat defines the format of the user certificate to allow compatibility with older versions of OpenSSH.
-- `client_idle_timeout` (String) ClientIdleTimeout sets disconnect clients on idle timeout behavior, if set to 0 means do not disconnect, otherwise is set to the idle duration.
-- `create_db_user` (Boolean) CreateDatabaseUser enabled automatic database user creation.
-- `create_db_user_mode` (Number) CreateDatabaseUserMode allows users to be automatically created on a database when not set to off. 0 is "unspecified", 1 is "off", 2 is "keep", 3 is "best_effort_drop".
-- `create_desktop_user` (Boolean) CreateDesktopUser allows users to be automatically created on a Windows desktop
-- `create_host_user` (Boolean) Deprecated: use CreateHostUserMode instead.
-- `create_host_user_default_shell` (String) CreateHostUserDefaultShell is used to configure the default shell for newly provisioned host users.
-- `create_host_user_mode` (Number) CreateHostUserMode allows users to be automatically created on a host when not set to off. 0 is "unspecified"; 1 is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; 4 is "insecure-drop".
-- `desktop_clipboard` (Boolean) DesktopClipboard indicates whether clipboard sharing is allowed between the user's workstation and the remote desktop. It defaults to true unless explicitly set to false.
-- `desktop_directory_sharing` (Boolean) DesktopDirectorySharing indicates whether directory sharing is allowed between the user's workstation and the remote desktop. It defaults to false unless explicitly set to true.
-- `device_trust_mode` (String) DeviceTrustMode is the device authorization mode used for the resources associated with the role. See DeviceTrust.Mode.
-- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert sets disconnect clients on expired certificates.
-- `enhanced_recording` (List of String) BPF defines what events to record for the BPF-based session recorder.
-- `forward_agent` (Boolean) ForwardAgent is SSH agent forwarding.
-- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specoptionsidp))
-- `lock` (String) Lock specifies the locking mode (strict|best_effort) to be applied with the role.
-- `max_connections` (Number) MaxConnections defines the maximum number of concurrent connections a user may hold.
-- `max_kubernetes_connections` (Number) MaxKubernetesConnections defines the maximum number of concurrent Kubernetes sessions a user may hold.
-- `max_session_ttl` (String) MaxSessionTTL defines how long a SSH session can last for.
-- `max_sessions` (Number) MaxSessions defines the maximum number of concurrent sessions per connection.
-- `mfa_verification_interval` (String) MFAVerificationInterval optionally defines the maximum duration that can elapse between successive MFA verifications. This variable is used to ensure that users are periodically prompted to verify their identity, enhancing security by preventing prolonged sessions without re-authentication when using tsh proxy * derivatives. It's only effective if the session requires MFA. If not set, defaults to `max_session_ttl`.
-- `permit_x11_forwarding` (Boolean) PermitX11Forwarding authorizes use of X11 forwarding.
-- `pin_source_ip` (Boolean) PinSourceIP forces the same client IP for certificate generation and usage
-- `port_forwarding` (Boolean) Deprecated: Use SSHPortForwarding instead
-- `record_session` (Attributes) RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false. (see [below for nested schema](#nested-schema-for-specoptionsrecord_session))
-- `request_access` (String) RequestAccess defines the request strategy (optional|reason|always) where optional is the default.
-- `request_prompt` (String) RequestPrompt is an optional message which tells users what they aught to request.
-- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
-- `ssh_file_copy` (Boolean) SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to true unless explicitly set to false.
-- `ssh_port_forwarding` (Attributes) SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwarding))
-
-### Nested Schema for `spec.options.cert_extensions`
-
-Optional:
-
-- `mode` (Number) Mode is the type of extension to be used -- currently critical-option is not supported. 0 is "extension".
-- `name` (String) Name specifies the key to be used in the cert extension.
-- `type` (Number) Type represents the certificate type being extended, only ssh is supported at this time. 0 is "ssh".
-- `value` (String) Value specifies the value to be used in the cert extension.
-
-
-### Nested Schema for `spec.options.idp`
-
-Optional:
-
-- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specoptionsidpsaml))
-
-### Nested Schema for `spec.options.idp.saml`
-
-Optional:
-
-- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
-
-
-
-### Nested Schema for `spec.options.record_session`
-
-Optional:
-
-- `default` (String) Default indicates the default value for the services.
-- `desktop` (Boolean) Desktop indicates whether desktop sessions should be recorded. It defaults to true unless explicitly set to false.
-- `ssh` (String) SSH indicates the session mode used on SSH sessions.
-
-
-### Nested Schema for `spec.options.ssh_port_forwarding`
-
-Optional:
-
-- `local` (Attributes) Allow local port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardinglocal))
-- `remote` (Attributes) Allow remote port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardingremote))
-
-### Nested Schema for `spec.options.ssh_port_forwarding.local`
-
-Optional:
-
-- `enabled` (Boolean)
-
-
-### Nested Schema for `spec.options.ssh_port_forwarding.remote`
-
-Optional:
-
-- `enabled` (Boolean)
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/saml_connector.mdx b/docs/pages/reference/terraform-provider/data-sources/saml_connector.mdx
deleted file mode 100644
index d1534f6571f45..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/saml_connector.mdx
+++ /dev/null
@@ -1,112 +0,0 @@
----
-title: Reference for the teleport_saml_connector Terraform data-source
-sidebar_label: saml_connector
-description: This page describes the supported values of the teleport_saml_connector data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an SAML connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Required:
-
-- `acs` (String) AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).
-- `attributes_to_roles` (Attributes List) AttributesToRoles is a list of mappings of attribute statements to roles. (see [below for nested schema](#nested-schema-for-specattributes_to_roles))
-
-Optional:
-
-- `allow_idp_initiated` (Boolean) AllowIDPInitiated is a flag that indicates if the connector can be used for IdP-initiated logins.
-- `assertion_key_pair` (Attributes) EncryptionKeyPair is a key pair used for decrypting SAML assertions. (see [below for nested schema](#nested-schema-for-specassertion_key_pair))
-- `audience` (String) Audience uniquely identifies our service provider.
-- `cert` (String, Sensitive) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `display` (String) Display controls how this connector is displayed.
-- `entity_descriptor` (String, Sensitive) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.
-- `entity_descriptor_url` (String) EntityDescriptorURL is a URL that supplies a configuration XML.
-- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO.
-- `issuer` (String) Issuer is the identity provider issuer.
-- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
-- `preferred_request_binding` (String) PreferredRequestBinding is a preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.
-- `provider` (String) Provider is the external identity provider.
-- `service_provider_issuer` (String) ServiceProviderIssuer is the issuer of the service provider (Teleport).
-- `signing_key_pair` (Attributes) SigningKeyPair is an x509 key pair used to sign AuthnRequest. (see [below for nested schema](#nested-schema-for-specsigning_key_pair))
-- `single_logout_url` (String) SingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.
-- `sso` (String) SSO is the URL of the identity provider's SSO service.
-
-### Nested Schema for `spec.attributes_to_roles`
-
-Optional:
-
-- `name` (String) Name is an attribute statement name.
-- `roles` (List of String) Roles is a list of static teleport roles to map to.
-- `value` (String) Value is an attribute statement value to match.
-
-
-### Nested Schema for `spec.assertion_key_pair`
-
-Optional:
-
-- `cert` (String) Cert is a PEM-encoded x509 certificate.
-- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
-
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.mfa`
-
-Optional:
-
-- `cert` (String) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
-- `enabled` (Boolean) Enabled specified whether this SAML connector supports MFA checks. Defaults to false.
-- `entity_descriptor` (String) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements. Usually set from EntityDescriptorUrl.
-- `entity_descriptor_url` (String) EntityDescriptorUrl is a URL that supplies a configuration XML.
-- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced for MFA checks. UNSPECIFIED is treated as YES to always re-authentication for MFA checks. This should only be set to NO if the IdP is setup to perform MFA checks on top of active user sessions.
-- `issuer` (String) Issuer is the identity provider issuer. Usually set from EntityDescriptor.
-- `sso` (String) SSO is the URL of the identity provider's SSO service. Usually set from EntityDescriptor.
-
-
-### Nested Schema for `spec.signing_key_pair`
-
-Optional:
-
-- `cert` (String) Cert is a PEM-encoded x509 certificate.
-- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/session_recording_config.mdx b/docs/pages/reference/terraform-provider/data-sources/session_recording_config.mdx
deleted file mode 100644
index 6227a418d8daf..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/session_recording_config.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Reference for the teleport_session_recording_config Terraform data-source
-sidebar_label: session_recording_config
-description: This page describes the supported values of the teleport_session_recording_config data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a SessionRecordingConfig specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `mode` (String) Mode controls where (or if) the session is recorded.
-- `proxy_checks_host_keys` (Boolean) ProxyChecksHostKeys is used to control if the proxy will check host keys when in recording mode.
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/trusted_device.mdx b/docs/pages/reference/terraform-provider/data-sources/trusted_device.mdx
deleted file mode 100644
index 8b2d90d1101a6..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/trusted_device.mdx
+++ /dev/null
@@ -1,53 +0,0 @@
----
-title: Reference for the teleport_trusted_device Terraform data-source
-sidebar_label: trusted_device
-description: This page describes the supported values of the teleport_trusted_device data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Specification of the device. (see [below for nested schema](#nested-schema-for-spec))
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `labels` (Map of String) Labels is a set of labels
-- `name` (String) Name is an object name
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `asset_tag` (String)
-- `os_type` (String)
-
-Optional:
-
-- `enroll_status` (String)
-- `owner` (String)
-- `source` (Attributes) (see [below for nested schema](#nested-schema-for-specsource))
-
-### Nested Schema for `spec.source`
-
-Optional:
-
-- `name` (String)
-- `origin` (String)
-
diff --git a/docs/pages/reference/terraform-provider/data-sources/user.mdx b/docs/pages/reference/terraform-provider/data-sources/user.mdx
deleted file mode 100644
index ddfdba981231b..0000000000000
--- a/docs/pages/reference/terraform-provider/data-sources/user.mdx
+++ /dev/null
@@ -1,89 +0,0 @@
----
-title: Reference for the teleport_user Terraform data-source
-sidebar_label: user
-description: This page describes the supported values of the teleport_user data-source of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-
-
-
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a user specification (see [below for nested schema](#nested-schema-for-spec))
-- `status` (Attributes) (see [below for nested schema](#nested-schema-for-status))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `github_identities` (Attributes List) GithubIdentities list associated Github OAuth2 identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specgithub_identities))
-- `oidc_identities` (Attributes List) OIDCIdentities lists associated OpenID Connect identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specoidc_identities))
-- `roles` (List of String) Roles is a list of roles assigned to user
-- `saml_identities` (Attributes List) SAMLIdentities lists associated SAML identities that let user log in using externally verified identity (see [below for nested schema](#nested-schema-for-specsaml_identities))
-- `traits` (Map of List of String) Traits are key/value pairs received from an identity provider (through OIDC claims or SAML assertions) or from a system administrator for local accounts. Traits are used to populate role variables.
-- `trusted_device_ids` (List of String) TrustedDeviceIDs contains the IDs of trusted devices enrolled by the user.  Note that SSO users are transient and thus may contain an empty TrustedDeviceIDs field, even though the user->device association exists under the Device Trust subsystem. Do not rely on this field to determine device associations or ownership, it exists for legacy/informative purposes only.  Managed by the Device Trust subsystem, avoid manual edits.
-
-### Nested Schema for `spec.github_identities`
-
-Optional:
-
-- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
-- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
-- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
-- `username` (String) Username is username supplied by external identity provider
-
-
-### Nested Schema for `spec.oidc_identities`
-
-Optional:
-
-- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
-- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
-- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
-- `username` (String) Username is username supplied by external identity provider
-
-
-### Nested Schema for `spec.saml_identities`
-
-Optional:
-
-- `connector_id` (String) ConnectorID is id of registered OIDC connector, e.g. 'google-example.com'
-- `samlSingleLogoutUrl` (String) SAMLSingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out), if applicable.
-- `user_id` (String) UserID is the ID of the identity. Some connectors like GitHub have an unique ID apart from the username.
-- `username` (String) Username is username supplied by external identity provider
-
-
-
-### Nested Schema for `status`
-
-Optional:
-
-- `mfa_weakest_device` (Number) mfa_weakest_device reflects what the system knows about the user's weakest MFA device. Note that this is a "best effort" property, in that it can be UNSPECIFIED.
-- `password_state` (Number) password_state reflects what the system knows about the user's password. Note that this is a "best effort" property, in that it can be UNSPECIFIED for users who were created before this property was introduced and didn't perform any password-related activity since then. See RFD 0159 for details. Do NOT use this value for authentication purposes!
-
diff --git a/docs/pages/reference/terraform-provider/resources/access_list.mdx b/docs/pages/reference/terraform-provider/resources/access_list.mdx
deleted file mode 100644
index bb33d60362040..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/access_list.mdx
+++ /dev/null
@@ -1,210 +0,0 @@
----
-title: Reference for the teleport_access_list Terraform resource
-sidebar_label: access_list
-description: This page describes the supported values of the teleport_access_list resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_access_list resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-resource "teleport_access_list" "crane-operation" {
-  header = {
-    metadata = {
-      name = "crane-operation"
-      labels = {
-        example = "yes"
-      }
-    }
-  }
-  spec = {
-    description = "Used to grant access to the crane."
-    owners = [
-      {
-        name        = "gru"
-        description = "The supervillain."
-      }
-    ]
-    membership_requires = {
-      roles = ["minion"]
-    }
-    ownership_requires = {
-      roles = ["supervillain"]
-    }
-    grants = {
-      roles = ["crane-operator"]
-      traits = [{
-        key    = "allowed-machines"
-        values = ["crane", "forklift"]
-      }]
-    }
-    title = "Crane operation"
-    audit = {
-      recurrence = {
-        frequency    = 3  # audit every 3 months
-        day_of_month = 15 # audit happen 15's day of the month. Possible values are 1, 15, and 31.
-      }
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Optional
-
-- `header` (Attributes) header is the header for the resource. (see [below for nested schema](#nested-schema-for-header))
-- `spec` (Attributes) spec is the specification for the Access List. (see [below for nested schema](#nested-schema-for-spec))
-
-### Nested Schema for `header`
-
-Required:
-
-- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
-
-Optional:
-
-- `kind` (String) kind is a resource kind.
-- `metadata` (Attributes) metadata is resource metadata. (see [below for nested schema](#nested-schema-for-headermetadata))
-- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `header.metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `namespace` (String) namespace is object namespace. The field should be called "namespace" when it returns in Teleport 2.4.
-- `revision` (String) revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.
-
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `audit` (Attributes) audit describes the frequency that this Access List must be audited. (see [below for nested schema](#nested-schema-for-specaudit))
-- `grants` (Attributes) grants describes the access granted by membership to this Access List. (see [below for nested schema](#nested-schema-for-specgrants))
-- `owners` (Attributes List) owners is a list of owners of the Access List. (see [below for nested schema](#nested-schema-for-specowners))
-
-Optional:
-
-- `description` (String) description is an optional plaintext description of the Access List.
-- `membership_requires` (Attributes) membership_requires describes the requirements for a user to be a member of the Access List. For a membership to an Access List to be effective, the user must meet the requirements of Membership_requires and must be in the members list. (see [below for nested schema](#nested-schema-for-specmembership_requires))
-- `owner_grants` (Attributes) owner_grants describes the access granted by owners to this Access List. (see [below for nested schema](#nested-schema-for-specowner_grants))
-- `ownership_requires` (Attributes) ownership_requires describes the requirements for a user to be an owner of the Access List. For ownership of an Access List to be effective, the user must meet the requirements of ownership_requires and must be in the owners list. (see [below for nested schema](#nested-schema-for-specownership_requires))
-- `title` (String) title is a plaintext short description of the Access List.
-
-### Nested Schema for `spec.audit`
-
-Required:
-
-- `recurrence` (Attributes) recurrence is the recurrence definition (see [below for nested schema](#nested-schema-for-specauditrecurrence))
-
-Optional:
-
-- `next_audit_date` (String) next_audit_date is when the next audit date should be done by.
-- `notifications` (Attributes) notifications is the configuration for notifying users. (see [below for nested schema](#nested-schema-for-specauditnotifications))
-
-### Nested Schema for `spec.audit.recurrence`
-
-Required:
-
-- `frequency` (Number) frequency is the frequency of reviews. This represents the period in months between two reviews. Supported values are 0, 1, 3, 6, and 12.
-
-Optional:
-
-- `day_of_month` (Number) day_of_month is the day of month that reviews will be scheduled on. Supported values are 0, 1, 15, and 31.
-
-
-### Nested Schema for `spec.audit.notifications`
-
-Optional:
-
-- `start` (String) start specifies when to start notifying users that the next audit date is coming up.
-
-
-
-### Nested Schema for `spec.grants`
-
-Optional:
-
-- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
-- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specgrantstraits))
-
-### Nested Schema for `spec.grants.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.owners`
-
-Optional:
-
-- `description` (String) description is the plaintext description of the owner and why they are an owner.
-- `membership_kind` (Number) membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
-- `name` (String) name is the username of the owner.
-
-
-### Nested Schema for `spec.membership_requires`
-
-Optional:
-
-- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
-- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specmembership_requirestraits))
-
-### Nested Schema for `spec.membership_requires.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.owner_grants`
-
-Optional:
-
-- `roles` (List of String) roles are the roles that are granted to users who are members of the Access List.
-- `traits` (Attributes List) traits are the traits that are granted to users who are members of the Access List. (see [below for nested schema](#nested-schema-for-specowner_grantstraits))
-
-### Nested Schema for `spec.owner_grants.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
-
-
-
-### Nested Schema for `spec.ownership_requires`
-
-Optional:
-
-- `roles` (List of String) roles are the user roles that must be present for the user to obtain access.
-- `traits` (Attributes List) traits are the traits that must be present for the user to obtain access. (see [below for nested schema](#nested-schema-for-specownership_requirestraits))
-
-### Nested Schema for `spec.ownership_requires.traits`
-
-Optional:
-
-- `key` (String) key is the name of the trait.
-- `values` (List of String) values is the list of trait values.
diff --git a/docs/pages/reference/terraform-provider/resources/access_monitoring_rule.mdx b/docs/pages/reference/terraform-provider/resources/access_monitoring_rule.mdx
deleted file mode 100644
index 77a621fde8df0..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/access_monitoring_rule.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: Reference for the teleport_access_monitoring_rule Terraform resource
-sidebar_label: access_monitoring_rule
-description: This page describes the supported values of the teleport_access_monitoring_rule resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_access_monitoring_rule resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-resource "teleport_access_monitoring_rule" "test" {
-  version = "v1"
-  metadata = {
-    name = "test"
-  }
-  spec = {
-    subjects      = ["access_request"]
-    condition     = "access_request.spec.roles.contains(\"your_role_name\")"
-    desired_state = "reviewed"
-    notification = {
-      name       = "slack"
-      recipients = ["your-slack-channel"]
-    }
-    automatic_review = {
-      integration = "builtin"
-      decision    = "APPROVED"
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an AccessMonitoringRule specification (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) version is version
-
-### Optional
-
-- `metadata` (Attributes) metadata is the rules's metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) sub_kind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Required:
-
-- `subjects` (List of String) subjects the rule operates on, can be a resource kind or a particular resource property.
-
-Optional:
-
-- `automatic_review` (Attributes) automatic_review defines automatic review configurations for access requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specautomatic_review))
-- `condition` (String) condition is a predicate expression that operates on the specified subject resources, and determines whether the subject will be moved into desired state.
-- `desired_state` (String) desired_state defines the desired state of the subject. For access request subjects, the desired_state may be set to `reviewed` to indicate that the access request should be automatically reviewed.
-- `notification` (Attributes) notification defines the plugin configuration for notifications if rule is triggered. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set. (see [below for nested schema](#nested-schema-for-specnotification))
-- `states` (List of String) states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.
-
-### Nested Schema for `spec.automatic_review`
-
-Optional:
-
-- `decision` (String) decision specifies the proposed state of the access review. This can be either 'APPROVED' or 'DENIED'.
-- `integration` (String) integration is the name of the integration that is responsible for monitoring the rule. Set this value to `builtin` to monitor the rule with Teleport.
-
-
-### Nested Schema for `spec.notification`
-
-Optional:
-
-- `name` (String) name is the name of the plugin to which this configuration should apply.
-- `recipients` (List of String) recipients is the list of recipients the plugin should notify.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
diff --git a/docs/pages/reference/terraform-provider/resources/app.mdx b/docs/pages/reference/terraform-provider/resources/app.mdx
deleted file mode 100644
index 7d7e7cadc9bba..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/app.mdx
+++ /dev/null
@@ -1,157 +0,0 @@
----
-title: Reference for the teleport_app Terraform resource
-sidebar_label: app
-description: This page describes the supported values of the teleport_app resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_app resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport App
-
-resource "teleport_app" "example" {
-  version = "v3"
-  metadata = {
-    name        = "example"
-    description = "Test app"
-    labels = {
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    uri = "localhost:3000"
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is the app resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the app resource spec. (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource subkind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `aws` (Attributes) AWS contains additional options for AWS applications. (see [below for nested schema](#nested-schema-for-specaws))
-- `cloud` (String) Cloud identifies the cloud instance the app represents.
-- `cors` (Attributes) CORSPolicy defines the Cross-Origin Resource Sharing settings for the app. (see [below for nested schema](#nested-schema-for-speccors))
-- `dynamic_labels` (Attributes Map) DynamicLabels are the app's command labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
-- `identity_center` (Attributes) IdentityCenter encasulates AWS identity-center specific information. Only valid for Identity Center account apps. (see [below for nested schema](#nested-schema-for-specidentity_center))
-- `insecure_skip_verify` (Boolean) InsecureSkipVerify disables app's TLS certificate verification.
-- `integration` (String) Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.
-- `public_addr` (String) PublicAddr is the public address the application is accessible at.
-- `required_app_names` (List of String) RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate along side this app.
-- `rewrite` (Attributes) Rewrite is a list of rewriting rules to apply to requests and responses. (see [below for nested schema](#nested-schema-for-specrewrite))
-- `tcp_ports` (Attributes List) TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol. (see [below for nested schema](#nested-schema-for-spectcp_ports))
-- `uri` (String) URI is the web app endpoint.
-- `use_any_proxy_public_addr` (Boolean) UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.
-- `user_groups` (List of String) UserGroups are a list of user group IDs that this app is associated with.
-
-### Nested Schema for `spec.aws`
-
-Optional:
-
-- `external_id` (String) ExternalID is the AWS External ID used when assuming roles in this app.
-- `roles_anywhere_profile` (Attributes) RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps. (see [below for nested schema](#nested-schema-for-specawsroles_anywhere_profile))
-
-### Nested Schema for `spec.aws.roles_anywhere_profile`
-
-Optional:
-
-- `accept_role_session_name` (Boolean) Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName
-- `profile_arn` (String) ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.
-
-
-
-### Nested Schema for `spec.cors`
-
-Optional:
-
-- `allow_credentials` (Boolean) allow_credentials indicates whether credentials are allowed.
-- `allowed_headers` (List of String) allowed_headers specifies which headers can be used when accessing the app.
-- `allowed_methods` (List of String) allowed_methods specifies which methods are allowed when accessing the app.
-- `allowed_origins` (List of String) allowed_origins specifies which origins are allowed to access the app.
-- `exposed_headers` (List of String) exposed_headers indicates which headers are made available to scripts via the browser.
-- `max_age` (Number) max_age indicates how long (in seconds) the results of a preflight request can be cached.
-
-
-### Nested Schema for `spec.dynamic_labels`
-
-Optional:
-
-- `command` (List of String) Command is a command to run
-- `period` (String) Period is a time between command runs
-- `result` (String) Result captures standard output
-
-
-### Nested Schema for `spec.identity_center`
-
-Optional:
-
-- `account_id` (String) Account ID is the AWS-assigned ID of the account
-- `permission_sets` (Attributes List) PermissionSets lists the available permission sets on the given account (see [below for nested schema](#nested-schema-for-specidentity_centerpermission_sets))
-
-### Nested Schema for `spec.identity_center.permission_sets`
-
-Optional:
-
-- `arn` (String) ARN is the fully-formed ARN of the Permission Set.
-- `assignment_name` (String) AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.
-- `name` (String) Name is the human-readable name of the Permission Set.
-
-
-
-### Nested Schema for `spec.rewrite`
-
-Optional:
-
-- `headers` (Attributes List) Headers is a list of headers to inject when passing the request over to the application. (see [below for nested schema](#nested-schema-for-specrewriteheaders))
-- `jwt_claims` (String) JWTClaims configures whether roles/traits are included in the JWT token.
-- `redirect` (List of String) Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.
-
-### Nested Schema for `spec.rewrite.headers`
-
-Optional:
-
-- `name` (String) Name is the http header name.
-- `value` (String) Value is the http header value.
-
-
-
-### Nested Schema for `spec.tcp_ports`
-
-Optional:
-
-- `end_port` (Number) EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.
-- `port` (Number) Port describes the start of the range. It must be between 1 and 65535.
diff --git a/docs/pages/reference/terraform-provider/resources/auth_preference.mdx b/docs/pages/reference/terraform-provider/resources/auth_preference.mdx
deleted file mode 100644
index 108b43f4034a2..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/auth_preference.mdx
+++ /dev/null
@@ -1,155 +0,0 @@
----
-title: Reference for the teleport_auth_preference Terraform resource
-sidebar_label: auth_preference
-description: This page describes the supported values of the teleport_auth_preference resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_auth_preference resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# AuthPreference resource
-
-resource "teleport_auth_preference" "example" {
-  version = "v2"
-  metadata = {
-    description = "Auth preference"
-    labels = {
-      "example"             = "yes"
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    disconnect_expired_cert = true
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an AuthPreference specification (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `allow_headless` (Boolean) AllowHeadless enables/disables headless support. Headless authentication requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
-- `allow_local_auth` (Boolean) AllowLocalAuth is true if local authentication is enabled.
-- `allow_passwordless` (Boolean) AllowPasswordless enables/disables passwordless support. Passwordless requires Webauthn to work. Defaults to true if the Webauthn is configured, defaults to false otherwise.
-- `connector_name` (String) ConnectorName is the name of the OIDC or SAML connector. If this value is not set the first connector in the backend will be used.
-- `default_session_ttl` (String) DefaultSessionTTL is the TTL to use for user certs when an explicit TTL is not requested.
-- `device_trust` (Attributes) DeviceTrust holds settings related to trusted device verification. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specdevice_trust))
-- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert provides disconnect expired certificate setting - if true, connections with expired client certificates will get disconnected
-- `hardware_key` (Attributes) HardwareKey are the settings for hardware key support. (see [below for nested schema](#nested-schema-for-spechardware_key))
-- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specidp))
-- `locking_mode` (String) LockingMode is the cluster-wide locking mode default.
-- `message_of_the_day` (String)
-- `okta` (Attributes) Okta is a set of options related to the Okta service in Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specokta))
-- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this cluster. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
-- `second_factor` (String) SecondFactor is the type of mult-factor. Deprecated: Prefer using SecondFactors instead.
-- `second_factors` (List of Number) SecondFactors is a list of supported multi-factor types. 1 is "otp", 2 is "webauthn", 3 is "sso", If unspecified, the current default value is [1], or ["otp"].
-- `signature_algorithm_suite` (Number) SignatureAlgorithmSuite is the configured signature algorithm suite for the cluster. If unspecified, the current default value is "legacy". 1 is "legacy", 2 is "balanced-v1", 3 is "fips-v1", 4 is "hsm-v1".
-- `stable_unix_user_config` (Attributes) StableUnixUserConfig contains the cluster-wide configuration for stable UNIX users. (see [below for nested schema](#nested-schema-for-specstable_unix_user_config))
-- `type` (String) Type is the type of authentication.
-- `u2f` (Attributes) U2F are the settings for the U2F device. (see [below for nested schema](#nested-schema-for-specu2f))
-- `webauthn` (Attributes) Webauthn are the settings for server-side Web Authentication support. (see [below for nested schema](#nested-schema-for-specwebauthn))
-
-### Nested Schema for `spec.device_trust`
-
-Optional:
-
-- `auto_enroll` (Boolean) Enable device auto-enroll. Auto-enroll lets any user issue a device enrollment token for a known device that is not already enrolled. `tsh` takes advantage of auto-enroll to automatically enroll devices on user login, when appropriate. The effective cluster Mode still applies: AutoEnroll=true is meaningless if Mode="off".
-- `ekcert_allowed_cas` (List of String) Allow list of EKCert CAs in PEM format. If present, only TPM devices that present an EKCert that is signed by a CA specified here may be enrolled (existing enrollments are unchanged).  If not present, then the CA of TPM EKCerts will not be checked during enrollment, this allows any device to enroll.
-- `mode` (String) Mode of verification for trusted devices.  The following modes are supported:  - "off": disables both device authentication and authorization. - "optional": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - "required": enforces the presence of device extensions for sensitive endpoints.  Mode is always "off" for OSS. Defaults to "optional" for Enterprise.
-
-
-### Nested Schema for `spec.hardware_key`
-
-Optional:
-
-- `pin_cache_ttl` (String) PinCacheTTL is the amount of time in nanoseconds that Teleport clients will cache the user's PIV PIN when hardware key PIN policy is enabled.
-- `piv_slot` (String) PIVSlot is a PIV slot that Teleport clients should use instead of the default based on private key policy. For example, "9a" or "9e".
-- `serial_number_validation` (Attributes) SerialNumberValidation holds settings for hardware key serial number validation. By default, serial number validation is disabled. (see [below for nested schema](#nested-schema-for-spechardware_keyserial_number_validation))
-
-### Nested Schema for `spec.hardware_key.serial_number_validation`
-
-Optional:
-
-- `enabled` (Boolean) Enabled indicates whether hardware key serial number validation is enabled.
-- `serial_number_trait_name` (String) SerialNumberTraitName is an optional custom user trait name for hardware key serial numbers to replace the default: "hardware_key_serial_numbers".  Note: Values for this user trait should be a comma-separated list of serial numbers, or a list of comm-separated lists. e.g ["123", "345,678"]
-
-
-
-### Nested Schema for `spec.idp`
-
-Optional:
-
-- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specidpsaml))
-
-### Nested Schema for `spec.idp.saml`
-
-Optional:
-
-- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
-
-
-
-### Nested Schema for `spec.okta`
-
-Optional:
-
-- `sync_period` (String) SyncPeriod is the duration between synchronization calls in nanoseconds.
-
-
-### Nested Schema for `spec.stable_unix_user_config`
-
-Optional:
-
-- `enabled` (Boolean) Enabled signifies that (UNIX) Teleport SSH hosts should obtain a UID from the control plane if they're about to provision a host user with no other configured UID.
-- `first_uid` (Number) FirstUid is the start of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
-- `last_uid` (Number) LastUid is the end of the range of UIDs for autoprovisioned host users. The range is inclusive on both ends, so the specified UID can be assigned.
-
-
-### Nested Schema for `spec.u2f`
-
-Optional:
-
-- `app_id` (String) AppID returns the application ID for universal mult-factor.
-- `device_attestation_cas` (List of String) DeviceAttestationCAs contains the trusted attestation CAs for U2F devices.
-- `facets` (List of String) Facets returns the facets for universal mult-factor. Deprecated: Kept for backwards compatibility reasons, but Facets have no effect since Teleport v10, when Webauthn replaced the U2F implementation.
-
-
-### Nested Schema for `spec.webauthn`
-
-Optional:
-
-- `attestation_allowed_cas` (List of String) Allow list of device attestation CAs in PEM format. If present, only devices whose attestation certificates match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationDeniedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default all devices are allowed.
-- `attestation_denied_cas` (List of String) Deny list of device attestation CAs in PEM format. If present, only devices whose attestation certificates don't match the certificates specified here may be registered (existing registrations are unchanged). If supplied in conjunction with AttestationAllowedCAs, then both conditions need to be true for registration to be allowed (the device MUST match an allowed CA and MUST NOT match a denied CA). By default no devices are denied.
-- `rp_id` (String) RPID is the ID of the Relying Party. It should be set to the domain name of the Teleport installation.  IMPORTANT: RPID must never change in the lifetime of the cluster, because it's recorded in the registration data on the WebAuthn device. If the RPID changes, all existing WebAuthn key registrations will become invalid and all users who use WebAuthn as the multi-factor will need to re-register.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/autoupdate_config.mdx b/docs/pages/reference/terraform-provider/resources/autoupdate_config.mdx
deleted file mode 100644
index 4c357def001cf..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/autoupdate_config.mdx
+++ /dev/null
@@ -1,114 +0,0 @@
----
-title: Reference for the teleport_autoupdate_config Terraform resource
-sidebar_label: autoupdate_config
-description: This page describes the supported values of the teleport_autoupdate_config resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_autoupdate_config resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-resource "teleport_autoupdate_config" "test" {
-  version = "v1"
-  spec = {
-    tools = {
-      mode = "enabled"
-    }
-    agents = {
-      mode     = "enabled"
-      strategy = "halt-on-error"
-      schedules = {
-        regular = [
-          {
-            name = "dev"
-            days = ["Mon", "Tue", "Wed", "Thu"]
-            start_hour : 4
-          },
-          {
-            name = "staging"
-            days = ["Mon", "Tue", "Wed", "Thu"]
-            start_hour : 14
-          },
-          {
-            name = "prod"
-            days = ["Mon", "Tue", "Wed", "Thu"]
-            start_hour : 14
-            wait_hours : 24
-          },
-        ]
-      }
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String)
-
-### Optional
-
-- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String)
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
-- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
-
-### Nested Schema for `spec.agents`
-
-Optional:
-
-- `maintenance_window_duration` (String) maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based". Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next maintenance window.
-- `mode` (String) mode specifies whether agent autoupdates are enabled, disabled, or paused.
-- `schedules` (Attributes) schedules specifies schedules for updates of grouped agents. (see [below for nested schema](#nested-schema-for-specagentsschedules))
-- `strategy` (String) strategy to use for updating the agents.
-
-### Nested Schema for `spec.agents.schedules`
-
-Optional:
-
-- `regular` (Attributes List) regular schedules for non-critical versions. (see [below for nested schema](#nested-schema-for-specagentsschedulesregular))
-
-### Nested Schema for `spec.agents.schedules.regular`
-
-Optional:
-
-- `days` (List of String) days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
-- `name` (String) name of the group
-- `start_hour` (Number) start_hour to initiate update
-- `wait_hours` (Number) wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure". This field must be positive.
-
-
-
-
-### Nested Schema for `spec.tools`
-
-Optional:
-
-- `mode` (String) Mode defines state of the client tools auto update.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `name` (String) name is an object name.
diff --git a/docs/pages/reference/terraform-provider/resources/autoupdate_version.mdx b/docs/pages/reference/terraform-provider/resources/autoupdate_version.mdx
deleted file mode 100644
index 8df2a2d2a13b5..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/autoupdate_version.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: Reference for the teleport_autoupdate_version Terraform resource
-sidebar_label: autoupdate_version
-description: This page describes the supported values of the teleport_autoupdate_version resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_autoupdate_version resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-resource "teleport_autoupdate_version" "test" {
-  version = "v1"
-  spec = {
-    tools = {
-      target_version = "1.2.3"
-    }
-    agents = {
-      start_version  = "1.2.3"
-      target_version = "1.2.4"
-      schedule       = "regular"
-      mode           = "enabled"
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String)
-
-### Optional
-
-- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String)
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `agents` (Attributes) (see [below for nested schema](#nested-schema-for-specagents))
-- `tools` (Attributes) (see [below for nested schema](#nested-schema-for-spectools))
-
-### Nested Schema for `spec.agents`
-
-Optional:
-
-- `mode` (String) autoupdate_mode to use for the rollout
-- `schedule` (String) schedule to use for the rollout
-- `start_version` (String) start_version is the version to update from.
-- `target_version` (String) target_version is the version to update to.
-
-
-### Nested Schema for `spec.tools`
-
-Optional:
-
-- `target_version` (String) TargetVersion specifies the semantic version required for tools to establish a connection with the cluster. Client tools after connection to the cluster going to be updated to this version automatically.
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-- `name` (String) name is an object name.
diff --git a/docs/pages/reference/terraform-provider/resources/bot.mdx b/docs/pages/reference/terraform-provider/resources/bot.mdx
deleted file mode 100644
index 7cff2b1a7483b..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/bot.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Reference for the teleport_bot Terraform resource
-sidebar_label: bot
-description: This page describes the supported values of the teleport_bot resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_bot resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Machine ID Bot creation example
-
-locals {
-  bot_name = "example"
-}
-
-resource "random_password" "bot_token" {
-  length  = 32
-  special = false
-}
-
-resource "time_offset" "bot_example_token_expiry" {
-  offset_hours = 1
-}
-
-resource "teleport_provision_token" "bot_example" {
-  metadata = {
-    expires     = time_offset.bot_example_token_expiry.rfc3339
-    description = "Bot join token for ${local.bot_name} generated by Terraform"
-
-    name = random_password.bot_token.result
-  }
-
-  spec = {
-    roles       = ["Bot"]
-    bot_name    = local.bot_name
-    join_method = "token"
-  }
-}
-
-resource "teleport_bot" "example" {
-  name  = local.bot_name
-  roles = ["access"]
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `name` (String) The name of the bot, i.e. the unprefixed User name
-- `roles` (List of String) A list of roles the created bot should be allowed to assume via role impersonation.
-
-### Optional
-
-- `token_id` (String, Sensitive) Deprecated. This field is not required anymore and has no effect.
-- `token_ttl` (String) Deprecated. This field is not required anymore and has no effect.
-- `traits` (Map of List of String)
-
-### Read-Only
-
-- `role_name` (String) The name of the generated bot role
-- `user_name` (String) The name of the generated bot user
diff --git a/docs/pages/reference/terraform-provider/resources/cluster_networking_config.mdx b/docs/pages/reference/terraform-provider/resources/cluster_networking_config.mdx
deleted file mode 100644
index 3977596ef338c..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/cluster_networking_config.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Reference for the teleport_cluster_networking_config Terraform resource
-sidebar_label: cluster_networking_config
-description: This page describes the supported values of the teleport_cluster_networking_config resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_cluster_networking_config resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Cluster Networking config
-
-resource "teleport_cluster_networking_config" "example" {
-  version = "v2"
-  metadata = {
-    description = "Networking config"
-    labels = {
-      "example"             = "yes"
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    client_idle_timeout = "1h"
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a ClusterNetworkingConfig specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `assist_command_execution_workers` (Number) AssistCommandExecutionWorkers determines the number of workers that will execute arbitrary Assist commands on servers in parallel
-- `case_insensitive_routing` (Boolean) CaseInsensitiveRouting causes proxies to use case-insensitive hostname matching.
-- `client_idle_timeout` (String) ClientIdleTimeout sets global cluster default setting for client idle timeouts.
-- `idle_timeout_message` (String) ClientIdleTimeoutMessage is the message sent to the user when a connection times out.
-- `keep_alive_count_max` (Number) KeepAliveCountMax is the number of keep-alive messages that can be missed before the server disconnects the connection to the client.
-- `keep_alive_interval` (String) KeepAliveInterval is the interval at which the server sends keep-alive messages to the client.
-- `proxy_listener_mode` (Number) ProxyListenerMode is proxy listener mode used by Teleport Proxies. 0 is "separate"; 1 is "multiplex".
-- `proxy_ping_interval` (String) ProxyPingInterval defines in which interval the TLS routing ping message should be sent. This is applicable only when using ping-wrapped connections, regular TLS routing connections are not affected.
-- `routing_strategy` (Number) RoutingStrategy determines the strategy used to route to nodes. 0 is "unambiguous_match"; 1 is "most_recent".
-- `session_control_timeout` (String) SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the auth server before it begins terminating controlled sessions.
-- `ssh_dial_timeout` (String) SSHDialTimeout is a custom dial timeout used when establishing SSH connections. If not set, the default timeout of 30s will be used.
-- `tunnel_strategy` (Attributes) TunnelStrategyV1 determines the tunnel strategy used in the cluster. (see [below for nested schema](#nested-schema-for-spectunnel_strategy))
-- `web_idle_timeout` (String) WebIdleTimeout sets global cluster default setting for the web UI idle timeouts.
-
-### Nested Schema for `spec.tunnel_strategy`
-
-Optional:
-
-- `agent_mesh` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyagent_mesh))
-- `proxy_peering` (Attributes) (see [below for nested schema](#nested-schema-for-spectunnel_strategyproxy_peering))
-
-### Nested Schema for `spec.tunnel_strategy.agent_mesh`
-
-Optional:
-
-- `active` (Boolean) Automatically generated field preventing empty message errors
-
-
-### Nested Schema for `spec.tunnel_strategy.proxy_peering`
-
-Optional:
-
-- `agent_connection_count` (Number)
diff --git a/docs/pages/reference/terraform-provider/resources/database.mdx b/docs/pages/reference/terraform-provider/resources/database.mdx
deleted file mode 100644
index 944f0584c6693..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/database.mdx
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: Reference for the teleport_database Terraform resource
-sidebar_label: database
-description: This page describes the supported values of the teleport_database resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_database resource of the Teleport Terraform provider.
-Follow [the database dynamic registration guide](../../../enroll-resources/database-access/guides/dynamic-registration.mdx)
-to complete deploying a database_service and access the database resource
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Database
-
-resource "teleport_database" "example" {
-  version = "v3"
-  metadata = {
-    name        = "example"
-    description = "Test database"
-    labels = {
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    protocol = "postgres"
-    uri      = "localhost"
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is the database metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the database spec. (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource subkind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `protocol` (String) Protocol is the database protocol: postgres, mysql, mongodb, etc.
-- `uri` (String) URI is the database connection endpoint.
-
-Optional:
-
-- `ad` (Attributes) AD is the Active Directory configuration for the database. (see [below for nested schema](#nested-schema-for-specad))
-- `admin_user` (Attributes) AdminUser is the database admin user for automatic user provisioning. (see [below for nested schema](#nested-schema-for-specadmin_user))
-- `aws` (Attributes) AWS contains AWS specific settings for RDS/Aurora/Redshift databases. (see [below for nested schema](#nested-schema-for-specaws))
-- `azure` (Attributes) Azure contains Azure specific database metadata. (see [below for nested schema](#nested-schema-for-specazure))
-- `ca_cert` (String) CACert is the PEM-encoded database CA certificate.  DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.
-- `dynamic_labels` (Attributes Map) DynamicLabels is the database dynamic labels. (see [below for nested schema](#nested-schema-for-specdynamic_labels))
-- `gcp` (Attributes) GCP contains parameters specific to GCP Cloud SQL databases. (see [below for nested schema](#nested-schema-for-specgcp))
-- `mongo_atlas` (Attributes) MongoAtlas contains Atlas metadata about the database. (see [below for nested schema](#nested-schema-for-specmongo_atlas))
-- `mysql` (Attributes) MySQL is an additional section with MySQL database options. (see [below for nested schema](#nested-schema-for-specmysql))
-- `oracle` (Attributes) Oracle is an additional Oracle configuration options. (see [below for nested schema](#nested-schema-for-specoracle))
-- `tls` (Attributes) TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name. (see [below for nested schema](#nested-schema-for-spectls))
-
-### Nested Schema for `spec.ad`
-
-Optional:
-
-- `domain` (String) Domain is the Active Directory domain the database resides in.
-- `kdc_host_name` (String) KDCHostName is the host name for a KDC for x509 Authentication.
-- `keytab_file` (String) KeytabFile is the path to the Kerberos keytab file.
-- `krb5_file` (String) Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.
-- `ldap_cert` (String) LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.
-- `ldap_service_account_name` (String) LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
-- `ldap_service_account_sid` (String) LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
-- `spn` (String) SPN is the service principal name for the database.
-
-
-### Nested Schema for `spec.admin_user`
-
-Optional:
-
-- `default_database` (String) DefaultDatabase is the database that the privileged database user logs into by default.  Depending on the database type, this database may be used to store procedures or data for managing database users.
-- `name` (String) Name is the username of the privileged database user.
-
-
-### Nested Schema for `spec.aws`
-
-Optional:
-
-- `account_id` (String) AccountID is the AWS account ID this database belongs to.
-- `assume_role_arn` (String) AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.
-- `docdb` (Attributes) DocumentDB contains AWS DocumentDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsdocdb))
-- `elasticache` (Attributes) ElastiCache contains AWS ElastiCache Redis specific metadata. (see [below for nested schema](#nested-schema-for-specawselasticache))
-- `external_id` (String) ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
-- `iam_policy_status` (Number) IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database.
-- `memorydb` (Attributes) MemoryDB contains AWS MemoryDB specific metadata. (see [below for nested schema](#nested-schema-for-specawsmemorydb))
-- `opensearch` (Attributes) OpenSearch contains AWS OpenSearch specific metadata. (see [below for nested schema](#nested-schema-for-specawsopensearch))
-- `rds` (Attributes) RDS contains RDS specific metadata. (see [below for nested schema](#nested-schema-for-specawsrds))
-- `rdsproxy` (Attributes) RDSProxy contains AWS Proxy specific metadata. (see [below for nested schema](#nested-schema-for-specawsrdsproxy))
-- `redshift` (Attributes) Redshift contains Redshift specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift))
-- `redshift_serverless` (Attributes) RedshiftServerless contains AWS Redshift Serverless specific metadata. (see [below for nested schema](#nested-schema-for-specawsredshift_serverless))
-- `region` (String) Region is a AWS cloud region.
-- `secret_store` (Attributes) SecretStore contains secret store configurations. (see [below for nested schema](#nested-schema-for-specawssecret_store))
-- `session_tags` (Map of String) SessionTags is a list of AWS STS session tags.
-
-### Nested Schema for `spec.aws.docdb`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the cluster identifier.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `instance_id` (String) InstanceID is the instance identifier.
-
-
-### Nested Schema for `spec.aws.elasticache`
-
-Optional:
-
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `replication_group_id` (String) ReplicationGroupID is the Redis replication group ID.
-- `transit_encryption_enabled` (Boolean) TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.
-- `user_group_ids` (List of String) UserGroupIDs is a list of user group IDs.
-
-
-### Nested Schema for `spec.aws.memorydb`
-
-Optional:
-
-- `acl_name` (String) ACLName is the name of the ACL associated with the cluster.
-- `cluster_name` (String) ClusterName is the name of the MemoryDB cluster.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-- `tls_enabled` (Boolean) TLSEnabled indicates whether in-transit encryption (TLS) is enabled.
-
-
-### Nested Schema for `spec.aws.opensearch`
-
-Optional:
-
-- `domain_id` (String) DomainID is the ID of the domain.
-- `domain_name` (String) DomainName is the name of the domain.
-- `endpoint_type` (String) EndpointType is the type of the endpoint.
-
-
-### Nested Schema for `spec.aws.rds`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the RDS cluster (Aurora) identifier.
-- `iam_auth` (Boolean) IAMAuth indicates whether database IAM authentication is enabled.
-- `instance_id` (String) InstanceID is the RDS instance identifier.
-- `resource_id` (String) ResourceID is the RDS instance resource identifier (db-xxx).
-- `security_groups` (List of String) SecurityGroups is a list of attached security groups for the RDS instance.
-- `subnets` (List of String) Subnets is a list of subnets for the RDS instance.
-- `vpc_id` (String) VPCID is the VPC where the RDS is running.
-
-
-### Nested Schema for `spec.aws.rdsproxy`
-
-Optional:
-
-- `custom_endpoint_name` (String) CustomEndpointName is the identifier of an RDS Proxy custom endpoint.
-- `name` (String) Name is the identifier of an RDS Proxy.
-- `resource_id` (String) ResourceID is the RDS instance resource identifier (prx-xxx).
-
-
-### Nested Schema for `spec.aws.redshift`
-
-Optional:
-
-- `cluster_id` (String) ClusterID is the Redshift cluster identifier.
-
-
-### Nested Schema for `spec.aws.redshift_serverless`
-
-Optional:
-
-- `endpoint_name` (String) EndpointName is the VPC endpoint name.
-- `workgroup_id` (String) WorkgroupID is the workgroup ID.
-- `workgroup_name` (String) WorkgroupName is the workgroup name.
-
-
-### Nested Schema for `spec.aws.secret_store`
-
-Optional:
-
-- `key_prefix` (String) KeyPrefix specifies the secret key prefix.
-- `kms_key_id` (String) KMSKeyID specifies the AWS KMS key for encryption.
-
-
-
-### Nested Schema for `spec.azure`
-
-Optional:
-
-- `is_flexi_server` (Boolean) IsFlexiServer is true if the database is an Azure Flexible server.
-- `name` (String) Name is the Azure database server name.
-- `redis` (Attributes) Redis contains Azure Cache for Redis specific database metadata. (see [below for nested schema](#nested-schema-for-specazureredis))
-- `resource_id` (String) ResourceID is the Azure fully qualified ID for the resource.
-
-### Nested Schema for `spec.azure.redis`
-
-Optional:
-
-- `clustering_policy` (String) ClusteringPolicy is the clustering policy for Redis Enterprise.
-
-
-
-### Nested Schema for `spec.dynamic_labels`
-
-Optional:
-
-- `command` (List of String) Command is a command to run
-- `period` (String) Period is a time between command runs
-- `result` (String) Result captures standard output
-
-
-### Nested Schema for `spec.gcp`
-
-Optional:
-
-- `instance_id` (String) InstanceID is the Cloud SQL instance ID.
-- `project_id` (String) ProjectID is the GCP project ID the Cloud SQL instance resides in.
-
-
-### Nested Schema for `spec.mongo_atlas`
-
-Optional:
-
-- `name` (String) Name is the Atlas database instance name.
-
-
-### Nested Schema for `spec.mysql`
-
-Optional:
-
-- `server_version` (String) ServerVersion is the server version reported by DB proxy if the runtime information is not available.
-
-
-### Nested Schema for `spec.oracle`
-
-Optional:
-
-- `audit_user` (String) AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
-
-
-### Nested Schema for `spec.tls`
-
-Optional:
-
-- `ca_cert` (String) CACert is an optional user provided CA certificate used for verifying database TLS connection.
-- `mode` (Number) Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure".
-- `server_name` (String) ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.
-- `trust_system_cert_pool` (Boolean) TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.
diff --git a/docs/pages/reference/terraform-provider/resources/github_connector.mdx b/docs/pages/reference/terraform-provider/resources/github_connector.mdx
deleted file mode 100644
index 79ccf2b9e8ba2..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/github_connector.mdx
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: Reference for the teleport_github_connector Terraform resource
-sidebar_label: github_connector
-description: This page describes the supported values of the teleport_github_connector resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_github_connector resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Terraform Github connector
-
-variable "github_secret" {}
-
-resource "teleport_github_connector" "github" {
-  version = "v3"
-  # This section tells Terraform that role example must be created before the GitHub connector
-  depends_on = [
-    teleport_role.example
-  ]
-
-  metadata = {
-    name = "example"
-    labels = {
-      example = "yes"
-    }
-  }
-
-  spec = {
-    client_id     = "client"
-    client_secret = var.github_secret
-
-    teams_to_roles = [{
-      organization = "gravitational"
-      team         = "devs"
-      roles        = ["example"]
-    }]
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an Github connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Required:
-
-- `client_id` (String) ClientID is the Github OAuth app client ID.
-- `client_secret` (String, Sensitive) ClientSecret is the Github OAuth app client secret.
-
-Optional:
-
-- `api_endpoint_url` (String) APIEndpointURL is the URL of the API endpoint of the Github instance this connector is for.
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `display` (String) Display is the connector display name.
-- `endpoint_url` (String) EndpointURL is the URL of the GitHub instance this connector is for.
-- `redirect_url` (String) RedirectURL is the authorization callback URL.
-- `teams_to_logins` (Attributes List) TeamsToLogins maps Github team memberships onto allowed logins/roles.  DELETE IN 11.0.0 Deprecated: use GithubTeamsToRoles instead. (see [below for nested schema](#nested-schema-for-specteams_to_logins))
-- `teams_to_roles` (Attributes List) TeamsToRoles maps Github team memberships onto allowed roles. (see [below for nested schema](#nested-schema-for-specteams_to_roles))
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.teams_to_logins`
-
-Optional:
-
-- `kubernetes_groups` (List of String) KubeGroups is a list of allowed kubernetes groups for this org/team.
-- `kubernetes_users` (List of String) KubeUsers is a list of allowed kubernetes users to impersonate for this org/team.
-- `logins` (List of String) Logins is a list of allowed logins for this org/team.
-- `organization` (String) Organization is a Github organization a user belongs to.
-- `team` (String) Team is a team within the organization a user belongs to.
-
-
-### Nested Schema for `spec.teams_to_roles`
-
-Optional:
-
-- `organization` (String) Organization is a Github organization a user belongs to.
-- `roles` (List of String) Roles is a list of allowed logins for this org/team.
-- `team` (String) Team is a team within the organization a user belongs to.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/health_check_config.mdx b/docs/pages/reference/terraform-provider/resources/health_check_config.mdx
deleted file mode 100644
index 1cbaa1d7ecc95..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/health_check_config.mdx
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: Reference for the teleport_health_check_config Terraform resource
-sidebar_label: health_check_config
-description: This page describes the supported values of the teleport_health_check_config resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_health_check_config resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-resource "teleport_health_check_config" "example" {
-  metadata = {
-    name        = "example"
-    description = "Example health check config"
-    labels = {
-      foo = "bar"
-    }
-  }
-  version = "v1"
-  spec = {
-    interval            = "60s"
-    timeout             = "5s"
-    healthy_threshold   = 3
-    unhealthy_threshold = 2
-    match = {
-      db_labels = [{
-        name = "env"
-        values = [
-          "foo",
-          "bar",
-        ]
-      }]
-      db_labels_expression = "labels.foo == `bar`"
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `metadata` (Attributes) Metadata is the health check config resource's metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is the health check config specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the health check config version.
-
-### Optional
-
-- `sub_kind` (String) SubKind is an optional resource sub kind.
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) name is an object name.
-
-Optional:
-
-- `description` (String) description is object description.
-- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) labels is a set of labels.
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `match` (Attributes) Match is used to select resources that these settings apply to. (see [below for nested schema](#nested-schema-for-specmatch))
-
-Optional:
-
-- `healthy_threshold` (Number) HealthyThreshold is the number of consecutive passing health checks after which a target's health status becomes "healthy".
-- `interval` (String) Interval is the time between each health check.
-- `timeout` (String) Timeout is the health check connection establishment timeout. An attempt that times out is a failed attempt.
-- `unhealthy_threshold` (Number) UnhealthyThreshold is the number of consecutive failing health checks after which a target's health status becomes "unhealthy".
-
-### Nested Schema for `spec.match`
-
-Optional:
-
-- `db_labels` (Attributes List) DBLabels matches database labels. An empty value is ignored. The match result is logically ANDed with DBLabelsExpression, if both are non-empty. (see [below for nested schema](#nested-schema-for-specmatchdb_labels))
-- `db_labels_expression` (String) DBLabelsExpression is a label predicate expression to match databases. An empty value is ignored. The match result is logically ANDed with DBLabels, if both are non-empty.
-
-### Nested Schema for `spec.match.db_labels`
-
-Optional:
-
-- `name` (String) The name of the label.
-- `values` (List of String) The values associated with the label.
diff --git a/docs/pages/reference/terraform-provider/resources/login_rule.mdx b/docs/pages/reference/terraform-provider/resources/login_rule.mdx
deleted file mode 100644
index a843324a05822..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/login_rule.mdx
+++ /dev/null
@@ -1,77 +0,0 @@
----
-title: Reference for the teleport_login_rule Terraform resource
-sidebar_label: login_rule
-description: This page describes the supported values of the teleport_login_rule resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_login_rule resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Login Rule resource
-
-resource "teleport_login_rule" "example" {
-  metadata = {
-    description = "Example Login Rule"
-    labels = {
-      "example" = "yes"
-    }
-  }
-
-  version  = "v1"
-  priority = 0
-  traits_map = {
-    "logins" = {
-      values = [
-        "external.logins",
-        "external.username",
-      ]
-    }
-    "groups" = {
-      values = [
-        "external.groups",
-      ]
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `priority` (Number) Priority is the priority of the login rule relative to other login rules in the same cluster. Login rules with a lower numbered priority will be evaluated first.
-- `version` (String) Version is the resource version.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `traits_expression` (String) TraitsExpression is a predicate expression which should return the desired traits for the user upon login.
-- `traits_map` (Attributes Map) TraitsMap is a map of trait keys to lists of predicate expressions which should evaluate to the desired values for that trait. (see [below for nested schema](#nested-schema-for-traits_map))
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `traits_map`
-
-Optional:
-
-- `values` (List of String)
diff --git a/docs/pages/reference/terraform-provider/resources/oidc_connector.mdx b/docs/pages/reference/terraform-provider/resources/oidc_connector.mdx
deleted file mode 100644
index c571bef9912ad..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/oidc_connector.mdx
+++ /dev/null
@@ -1,124 +0,0 @@
----
-title: Reference for the teleport_oidc_connector Terraform resource
-sidebar_label: oidc_connector
-description: This page describes the supported values of the teleport_oidc_connector resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_oidc_connector resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport OIDC connector
-# 
-# Please note that the OIDC connector will work in Teleport Enterprise only.
-
-variable "oidc_secret" {}
-
-resource "teleport_oidc_connector" "example" {
-  version = "v3"
-  metadata = {
-    name = "example"
-    labels = {
-      test = "yes"
-    }
-  }
-
-  spec = {
-    client_id     = "client"
-    client_secret = var.oidc_secret
-
-    claims_to_roles = [{
-      claim = "test"
-      roles = ["terraform"]
-    }]
-
-    redirect_url = ["https://example.com/redirect"]
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an OIDC connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `acr_values` (String) ACR is an Authentication Context Class Reference value. The meaning of the ACR value is context-specific and varies for identity providers.
-- `allow_unverified_email` (Boolean) AllowUnverifiedEmail tells the connector to accept OIDC users with unverified emails.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a dynamic mapping from claims to roles. (see [below for nested schema](#nested-schema-for-specclaims_to_roles))
-- `client_id` (String) ClientID is the id of the authentication client (Teleport Auth Service).
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `client_secret` (String, Sensitive) ClientSecret is used to authenticate the client.
-- `display` (String) Display is the friendly name for this provider.
-- `google_admin_email` (String) GoogleAdminEmail is the email of a google admin to impersonate.
-- `google_service_account` (String, Sensitive) GoogleServiceAccount is a string containing google service account credentials.
-- `google_service_account_uri` (String) GoogleServiceAccountURI is a path to a google service account uri.
-- `issuer_url` (String) IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
-- `max_age` (String)
-- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
-- `pkce_mode` (String) PKCEMode represents the configuration state for PKCE (Proof Key for Code Exchange). It can be "enabled" or "disabled"
-- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
-- `provider` (String) Provider is the external identity provider.
-- `redirect_url` (List of String) RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.
-- `scope` (List of String) Scope specifies additional scopes set by provider.
-- `username_claim` (String) UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.
-
-### Nested Schema for `spec.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.mfa`
-
-Optional:
-
-- `acr_values` (String) AcrValues are Authentication Context Class Reference values. The meaning of the ACR value is context-specific and varies for identity providers. Some identity providers support MFA specific contexts, such Okta with its "phr" (phishing-resistant) ACR.
-- `client_id` (String) ClientID is the OIDC OAuth app client ID.
-- `client_secret` (String) ClientSecret is the OIDC OAuth app client secret.
-- `enabled` (Boolean) Enabled specified whether this OIDC connector supports MFA checks. Defaults to false.
-- `max_age` (String) MaxAge is the amount of time in nanoseconds that an IdP session is valid for. Defaults to 0 to always force re-authentication for MFA checks. This should only be set to a non-zero value if the IdP is setup to perform MFA checks on top of active user sessions.
-- `prompt` (String) Prompt is an optional OIDC prompt. An empty string omits prompt. If not specified, it defaults to select_account for backwards compatibility.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/provision_token.mdx b/docs/pages/reference/terraform-provider/resources/provision_token.mdx
deleted file mode 100644
index 524633f7e1a60..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/provision_token.mdx
+++ /dev/null
@@ -1,394 +0,0 @@
----
-title: Reference for the teleport_provision_token Terraform resource
-sidebar_label: provision_token
-description: This page describes the supported values of the teleport_provision_token resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_provision_token resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Provision Token resource
-
-resource "teleport_provision_token" "example" {
-  metadata = {
-    expires     = "2022-10-12T07:20:51Z"
-    description = "Example token"
-
-    labels = {
-      example               = "yes"
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    roles = ["Node", "Auth"]
-  }
-}
-
-resource "teleport_provision_token" "iam-token" {
-  metadata = {
-    name = "iam-token"
-  }
-  spec = {
-    roles       = ["Bot"]
-    bot_name    = "mybot"
-    join_method = "iam"
-    allow = [{
-      aws_account = "123456789012"
-    }]
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is a provisioning token V2 spec (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `status` (Attributes) Status is extended status information, depending on token type. It is not user writable. (see [below for nested schema](#nested-schema-for-status))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `spec`
-
-Required:
-
-- `roles` (List of String) Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specallow))
-- `aws_iid_ttl` (String) AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.
-- `azure` (Attributes) Azure allows the configuration of options specific to the "azure" join method. (see [below for nested schema](#nested-schema-for-specazure))
-- `azure_devops` (Attributes) AzureDevops allows the configuration of options specific to the "azure_devops" join method. (see [below for nested schema](#nested-schema-for-specazure_devops))
-- `bitbucket` (Attributes) Bitbucket allows the configuration of options specific to the "bitbucket" join method. (see [below for nested schema](#nested-schema-for-specbitbucket))
-- `bot_name` (String) BotName is the name of the bot this token grants access to, if any
-- `bound_keypair` (Attributes) BoundKeypair allows the configuration of options specific to the "bound_keypair" join method. (see [below for nested schema](#nested-schema-for-specbound_keypair))
-- `circleci` (Attributes) CircleCI allows the configuration of options specific to the "circleci" join method. (see [below for nested schema](#nested-schema-for-speccircleci))
-- `gcp` (Attributes) GCP allows the configuration of options specific to the "gcp" join method. (see [below for nested schema](#nested-schema-for-specgcp))
-- `github` (Attributes) GitHub allows the configuration of options specific to the "github" join method. (see [below for nested schema](#nested-schema-for-specgithub))
-- `gitlab` (Attributes) GitLab allows the configuration of options specific to the "gitlab" join method. (see [below for nested schema](#nested-schema-for-specgitlab))
-- `join_method` (String) JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm
-- `kubernetes` (Attributes) Kubernetes allows the configuration of options specific to the "kubernetes" join method. (see [below for nested schema](#nested-schema-for-speckubernetes))
-- `oracle` (Attributes) Oracle allows the configuration of options specific to the "oracle" join method. (see [below for nested schema](#nested-schema-for-specoracle))
-- `spacelift` (Attributes) Spacelift allows the configuration of options specific to the "spacelift" join method. (see [below for nested schema](#nested-schema-for-specspacelift))
-- `suggested_agent_matcher_labels` (Map of List of String) SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to `db_service.resources.labels`. Currently, only node-join scripts create a configuration according to the suggestion.
-- `suggested_labels` (Map of List of String) SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.
-- `terraform_cloud` (Attributes) TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method. (see [below for nested schema](#nested-schema-for-specterraform_cloud))
-- `tpm` (Attributes) TPM allows the configuration of options specific to the "tpm" join method. (see [below for nested schema](#nested-schema-for-spectpm))
-
-### Nested Schema for `spec.allow`
-
-Optional:
-
-- `aws_account` (String) AWSAccount is the AWS account ID.
-- `aws_arn` (String) AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".
-- `aws_regions` (List of String) AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.
-- `aws_role` (String) AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.
-
-
-### Nested Schema for `spec.azure`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specazureallow))
-
-### Nested Schema for `spec.azure.allow`
-
-Optional:
-
-- `resource_groups` (List of String) ResourceGroups is a list of Azure resource groups the node is allowed to join from.
-- `subscription` (String) Subscription is the Azure subscription.
-
-
-
-### Nested Schema for `spec.azure_devops`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified. (see [below for nested schema](#nested-schema-for-specazure_devopsallow))
-- `organization_id` (String) OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.
-
-### Nested Schema for `spec.azure_devops.allow`
-
-Optional:
-
-- `definition_id` (String) The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.
-- `pipeline_name` (String) The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.
-- `project_id` (String) The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.
-- `project_name` (String) The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.
-- `repository_ref` (String) The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.
-- `repository_uri` (String) The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.
-- `repository_version` (String) The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.
-- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.
-
-
-
-### Nested Schema for `spec.bitbucket`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specbitbucketallow))
-- `audience` (String) Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
-- `identity_provider_url` (String) IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
-
-### Nested Schema for `spec.bitbucket.allow`
-
-Optional:
-
-- `branch_name` (String) BranchName is the name of the branch on which this pipeline executed.
-- `deployment_environment_uuid` (String) DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.
-- `repository_uuid` (String) RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
-- `workspace_uuid` (String) WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
-
-
-
-### Nested Schema for `spec.bound_keypair`
-
-Optional:
-
-- `onboarding` (Attributes) Onboarding contains parameters related to initial onboarding and keypair registration. (see [below for nested schema](#nested-schema-for-specbound_keypaironboarding))
-- `recovery` (Attributes) Recovery contains parameters related to recovery after identity expiration. (see [below for nested schema](#nested-schema-for-specbound_keypairrecovery))
-- `rotate_after` (String) RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.
-
-### Nested Schema for `spec.bound_keypair.onboarding`
-
-Optional:
-
-- `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.
-- `must_register_before` (String) MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.
-- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.
-
-
-### Nested Schema for `spec.bound_keypair.recovery`
-
-Optional:
-
-- `limit` (Number) Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.
-- `mode` (String) Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.
-
-
-
-### Nested Schema for `spec.circleci`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speccircleciallow))
-- `organization_id` (String)
-
-### Nested Schema for `spec.circleci.allow`
-
-Optional:
-
-- `context_id` (String)
-- `project_id` (String)
-
-
-
-### Nested Schema for `spec.gcp`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgcpallow))
-
-### Nested Schema for `spec.gcp.allow`
-
-Optional:
-
-- `locations` (List of String) Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").
-- `project_ids` (List of String) ProjectIDs is a list of project IDs (e.g. `<example-id-123456>`).
-- `service_accounts` (List of String) ServiceAccounts is a list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).
-
-
-
-### Nested Schema for `spec.github`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgithuballow))
-- `enterprise_server_host` (String) EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host.  This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.
-- `enterprise_slug` (String) EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE.  This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified.  See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.
-- `static_jwks` (String) StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.
-
-### Nested Schema for `spec.github.allow`
-
-Optional:
-
-- `actor` (String) The personal account that initiated the workflow run.
-- `environment` (String) The name of the environment used by the job.
-- `ref` (String) The git ref that triggered the workflow run.
-- `ref_type` (String) The type of ref, for example: "branch".
-- `repository` (String) The repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport`
-- `repository_owner` (String) The name of the organization in which the repository is stored.
-- `sub` (String) Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run.
-- `workflow` (String) The name of the workflow.
-
-
-
-### Nested Schema for `spec.gitlab`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specgitlaballow))
-- `domain` (String) Domain is the domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.
-- `static_jwks` (String) StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.
-
-### Nested Schema for `spec.gitlab.allow`
-
-Optional:
-
-- `ci_config_ref_uri` (String) CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
-- `ci_config_sha` (String) CIConfigSHA is the git commit SHA for the ci_config_ref_uri.
-- `deployment_tier` (String) DeploymentTier is the deployment tier of the environment the job specifies
-- `environment` (String) Environment limits access by the environment the job deploys to (if one is associated)
-- `environment_protected` (Boolean) EnvironmentProtected is true if the Git ref is protected, false otherwise.
-- `namespace_path` (String) NamespacePath is used to limit access to jobs in a group or user's projects. Example: `mygroup`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `pipeline_source` (String) PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`
-- `project_path` (String) ProjectPath is used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject`  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `project_visibility` (String) ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.
-- `ref` (String) Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type.  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `ref_protected` (Boolean) RefProtected is true if the Git ref is protected, false otherwise.
-- `ref_type` (String) RefType allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`
-- `sub` (String) Sub roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME  This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
-- `user_email` (String) UserEmail is the email of the user executing the job
-- `user_id` (String) UserID is the ID of the user executing the job
-- `user_login` (String) UserLogin is the username of the user executing the job
-
-
-
-### Nested Schema for `spec.kubernetes`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-speckubernetesallow))
-- `static_jwks` (Attributes) StaticJWKS is the configuration specific to the `static_jwks` type. (see [below for nested schema](#nested-schema-for-speckubernetesstatic_jwks))
-- `type` (String) Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.
-
-### Nested Schema for `spec.kubernetes.allow`
-
-Optional:
-
-- `service_account` (String) ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".
-
-
-### Nested Schema for `spec.kubernetes.static_jwks`
-
-Optional:
-
-- `jwks` (String) JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.
-
-
-
-### Nested Schema for `spec.oracle`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specoracleallow))
-
-### Nested Schema for `spec.oracle.allow`
-
-Optional:
-
-- `parent_compartments` (List of String) ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.
-- `regions` (List of String) Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.
-- `tenancy` (String) Tenancy is the OCID of the instance's tenancy. Required.
-
-
-
-### Nested Schema for `spec.spacelift`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specspaceliftallow))
-- `hostname` (String) Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`
-
-### Nested Schema for `spec.spacelift.allow`
-
-Optional:
-
-- `caller_id` (String) CallerID is the ID of the caller, ie. the stack or module that generated the run.
-- `caller_type` (String) CallerType is the type of the caller, ie. the entity that owns the run - either `stack` or `module`.
-- `scope` (String) Scope is the scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
-- `space_id` (String) SpaceID is the ID of the space in which the run that owns the token was executed.
-
-
-
-### Nested Schema for `spec.terraform_cloud`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, nodes using this token must match one allow rule to use this token. (see [below for nested schema](#nested-schema-for-specterraform_cloudallow))
-- `audience` (String) Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the variable is set to match the cluster name, it does not need to be set here.
-- `hostname` (String) Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be `app.terraform.io`. Otherwise, it must both match the `iss` (issuer) field included in JWTs, and provide standard JWKS endpoints.
-
-### Nested Schema for `spec.terraform_cloud.allow`
-
-Optional:
-
-- `organization_id` (String) OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.
-- `organization_name` (String) OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.
-- `project_id` (String) ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.
-- `project_name` (String) ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.
-- `run_phase` (String) RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
-- `workspace_id` (String) WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
-- `workspace_name` (String) WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
-
-
-
-### Nested Schema for `spec.tpm`
-
-Optional:
-
-- `allow` (Attributes List) Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining. (see [below for nested schema](#nested-schema-for-spectpmallow))
-- `ekcert_allowed_cas` (List of String) EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.
-
-### Nested Schema for `spec.tpm.allow`
-
-Optional:
-
-- `description` (String) Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"
-- `ek_certificate_serial` (String) EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4
-- `ek_public_hash` (String) EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6
-
-
-
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-- `name` (String, Sensitive) Name is an object name
-
-
-### Nested Schema for `status`
-
-Optional:
-
-- `bound_keypair` (Attributes) BoundKeypair contains status information related to bound_keypair type tokens. (see [below for nested schema](#nested-schema-for-statusbound_keypair))
-
-### Nested Schema for `status.bound_keypair`
-
-Optional:
-
-- `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any.
-- `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format.
-- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does,  either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated.
-- `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join.
-- `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`.
-- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.
diff --git a/docs/pages/reference/terraform-provider/resources/resources.mdx b/docs/pages/reference/terraform-provider/resources/resources.mdx
deleted file mode 100644
index 184a9ef06811a..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/resources.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: "Terraform resources index"
-description: "Index of all the datasources supported by the Teleport Terraform Provider"
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-{/*
-    This file will be renamed data-sources.mdx during build time.
-    The template name is reserved by tfplugindocs so we suffix with -index.
-*/}
-
-The Teleport Terraform provider supports the following resources:
-
-  - [`teleport_access_list`](./access_list.mdx)
-  - [`teleport_access_monitoring_rule`](./access_monitoring_rule.mdx)
-  - [`teleport_app`](./app.mdx)
-  - [`teleport_auth_preference`](./auth_preference.mdx)
-  - [`teleport_autoupdate_config`](./autoupdate_config.mdx)
-  - [`teleport_autoupdate_version`](./autoupdate_version.mdx)
-  - [`teleport_bot`](./bot.mdx)
-  - [`teleport_cluster_maintenance_config`](./cluster_maintenance_config.mdx)
-  - [`teleport_cluster_networking_config`](./cluster_networking_config.mdx)
-  - [`teleport_database`](./database.mdx)
-  - [`teleport_dynamic_windows_desktop`](./dynamic_windows_desktop.mdx)
-  - [`teleport_github_connector`](./github_connector.mdx)
-  - [`teleport_health_check_config`](./health_check_config.mdx)
-  - [`teleport_installer`](./installer.mdx)
-  - [`teleport_login_rule`](./login_rule.mdx)
-  - [`teleport_oidc_connector`](./oidc_connector.mdx)
-  - [`teleport_okta_import_rule`](./okta_import_rule.mdx)
-  - [`teleport_provision_token`](./provision_token.mdx)
-  - [`teleport_role`](./role.mdx)
-  - [`teleport_saml_connector`](./saml_connector.mdx)
-  - [`teleport_server`](./server.mdx)
-  - [`teleport_session_recording_config`](./session_recording_config.mdx)
-  - [`teleport_static_host_user`](./static_host_user.mdx)
-  - [`teleport_trusted_cluster`](./trusted_cluster.mdx)
-  - [`teleport_trusted_device`](./trusted_device.mdx)
-  - [`teleport_user`](./user.mdx)
-  - [`teleport_workload_identity`](./workload_identity.mdx)
diff --git a/docs/pages/reference/terraform-provider/resources/role.mdx b/docs/pages/reference/terraform-provider/resources/role.mdx
deleted file mode 100644
index 35721e10a9745..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/role.mdx
+++ /dev/null
@@ -1,600 +0,0 @@
----
-title: Reference for the teleport_role Terraform resource
-sidebar_label: role
-description: This page describes the supported values of the teleport_role resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_role resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport Role resource
-
-resource "teleport_role" "example" {
-  version = "v7"
-  metadata = {
-    name        = "example"
-    description = "Example Teleport Role"
-    expires     = "2022-10-12T07:20:51Z"
-    labels = {
-      example = "yes"
-    }
-  }
-
-  spec = {
-    options = {
-      forward_agent   = false
-      max_session_ttl = "7m"
-      ssh_port_forwarding = {
-        remote = {
-          enabled = false
-        }
-
-        local = {
-          enabled = false
-        }
-      }
-      client_idle_timeout     = "1h"
-      disconnect_expired_cert = true
-      permit_x11_forwarding   = false
-      request_access          = "optional"
-    }
-
-    allow = {
-      logins = ["example"]
-
-      rules = [{
-        resources = ["user", "role"]
-        verbs     = ["list"]
-      }]
-
-      request = {
-        roles = ["example"]
-        claims_to_roles = [{
-          claim = "example"
-          value = "example"
-          roles = ["example"]
-        }]
-      }
-
-      node_labels = {
-        example = ["yes"]
-      }
-    }
-
-    deny = {
-      logins = ["anonymous"]
-    }
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a role specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `allow` (Attributes) Allow is the set of conditions evaluated to grant access. (see [below for nested schema](#nested-schema-for-specallow))
-- `deny` (Attributes) Deny is the set of conditions evaluated to deny access. Deny takes priority over allow. (see [below for nested schema](#nested-schema-for-specdeny))
-- `options` (Attributes) Options is for OpenSSH options like agent forwarding. (see [below for nested schema](#nested-schema-for-specoptions))
-
-### Nested Schema for `spec.allow`
-
-Optional:
-
-- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specallowaccount_assignments))
-- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
-- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
-- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
-- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
-- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
-- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
-- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
-- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
-- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
-- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specallowdb_permissions))
-- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
-- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
-- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
-- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
-- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
-- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
-- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specallowgithub_permissions))
-- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
-- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
-- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
-- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
-- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specallowimpersonate))
-- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specallowjoin_sessions))
-- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
-- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
-- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
-- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specallowkubernetes_resources))
-- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
-- `logins` (List of String) Logins is a list of *nix system logins.
-- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
-- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
-- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specallowrequest))
-- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specallowrequire_session_join))
-- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specallowreview_requests))
-- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specallowrules))
-- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specallowspiffe))
-- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
-- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
-- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
-- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
-- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
-
-### Nested Schema for `spec.allow.account_assignments`
-
-Optional:
-
-- `account` (String)
-- `permission_set` (String)
-
-
-### Nested Schema for `spec.allow.db_permissions`
-
-Optional:
-
-- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
-- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
-
-
-### Nested Schema for `spec.allow.github_permissions`
-
-Optional:
-
-- `orgs` (List of String)
-
-
-### Nested Schema for `spec.allow.impersonate`
-
-Optional:
-
-- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
-- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.allow.join_sessions`
-
-Optional:
-
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
-- `name` (String) Name is the name of the policy.
-- `roles` (List of String) Roles is a list of roles that you can join the session of.
-
-
-### Nested Schema for `spec.allow.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
-- `kind` (String) Kind specifies the Kubernetes Resource type.
-- `name` (String) Name is the resource name. It supports wildcards.
-- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
-- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
-
-
-### Nested Schema for `spec.allow.request`
-
-Optional:
-
-- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowrequestclaims_to_roles))
-- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specallowrequestkubernetes_resources))
-- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
-- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specallowrequestreason))
-- `roles` (List of String) Roles is the name of roles which will match the request rule.
-- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
-- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
-- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specallowrequestthresholds))
-
-### Nested Schema for `spec.allow.request.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.allow.request.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
-- `kind` (String) kind specifies the Kubernetes Resource type.
-
-
-### Nested Schema for `spec.allow.request.reason`
-
-Optional:
-
-- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
-
-
-### Nested Schema for `spec.allow.request.thresholds`
-
-Optional:
-
-- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
-- `deny` (Number) Deny is the number of denials needed for state-transition.
-- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
-- `name` (String) Name is the optional human-readable name of the threshold.
-
-
-
-### Nested Schema for `spec.allow.require_session_join`
-
-Optional:
-
-- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
-- `filter` (String) Filter is a predicate that determines what users count towards this policy.
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
-- `name` (String) Name is the name of the policy.
-- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
-
-
-### Nested Schema for `spec.allow.review_requests`
-
-Optional:
-
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specallowreview_requestsclaims_to_roles))
-- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
-- `roles` (List of String) Roles is the name of roles which may be reviewed.
-- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
-
-### Nested Schema for `spec.allow.review_requests.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-
-### Nested Schema for `spec.allow.rules`
-
-Optional:
-
-- `actions` (List of String) Actions specifies optional actions taken when this rule matches
-- `resources` (List of String) Resources is a list of resources
-- `verbs` (List of String) Verbs is a list of verbs
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.allow.spiffe`
-
-Optional:
-
-- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
-- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
-- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
-
-
-
-### Nested Schema for `spec.deny`
-
-Optional:
-
-- `account_assignments` (Attributes List) AccountAssignments holds the list of account assignments affected by this condition. (see [below for nested schema](#nested-schema-for-specdenyaccount_assignments))
-- `app_labels` (Map of List of String) AppLabels is a map of labels used as part of the RBAC system.
-- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
-- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
-- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
-- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
-- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
-- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
-- `db_labels_expression` (String) DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.
-- `db_names` (List of String) DatabaseNames is a list of database names this role is allowed to connect to.
-- `db_permissions` (Attributes List) DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning. (see [below for nested schema](#nested-schema-for-specdenydb_permissions))
-- `db_roles` (List of String) DatabaseRoles is a list of databases roles for automatic user creation.
-- `db_service_labels` (Map of List of String) DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.
-- `db_service_labels_expression` (String) DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.
-- `db_users` (List of String) DatabaseUsers is a list of databases users this role is allowed to connect as.
-- `desktop_groups` (List of String) DesktopGroups is a list of groups for created desktop users to be added to
-- `gcp_service_accounts` (List of String) GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.
-- `github_permissions` (Attributes List) GitHubPermissions defines GitHub integration related permissions. (see [below for nested schema](#nested-schema-for-specdenygithub_permissions))
-- `group_labels` (Map of List of String) GroupLabels is a map of labels used as part of the RBAC system.
-- `group_labels_expression` (String) GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.
-- `host_groups` (List of String) HostGroups is a list of groups for created users to be added to
-- `host_sudoers` (List of String) HostSudoers is a list of entries to include in a users sudoer file
-- `impersonate` (Attributes) Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means. (see [below for nested schema](#nested-schema-for-specdenyimpersonate))
-- `join_sessions` (Attributes List) JoinSessions specifies policies to allow users to join other sessions. (see [below for nested schema](#nested-schema-for-specdenyjoin_sessions))
-- `kubernetes_groups` (List of String) KubeGroups is a list of kubernetes groups
-- `kubernetes_labels` (Map of List of String) KubernetesLabels is a map of kubernetes cluster labels used for RBAC.
-- `kubernetes_labels_expression` (String) KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.
-- `kubernetes_resources` (Attributes List) KubernetesResources is the Kubernetes Resources this Role grants access to. (see [below for nested schema](#nested-schema-for-specdenykubernetes_resources))
-- `kubernetes_users` (List of String) KubeUsers is an optional kubernetes users to impersonate
-- `logins` (List of String) Logins is a list of *nix system logins.
-- `node_labels` (Map of List of String) NodeLabels is a map of node labels (used to dynamically grant access to nodes).
-- `node_labels_expression` (String) NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.
-- `request` (Attributes) (see [below for nested schema](#nested-schema-for-specdenyrequest))
-- `require_session_join` (Attributes List) RequireSessionJoin specifies policies for required users to start a session. (see [below for nested schema](#nested-schema-for-specdenyrequire_session_join))
-- `review_requests` (Attributes) ReviewRequests defines conditions for submitting access reviews. (see [below for nested schema](#nested-schema-for-specdenyreview_requests))
-- `rules` (Attributes List) Rules is a list of rules and their access levels. Rules are a high level construct used for access control. (see [below for nested schema](#nested-schema-for-specdenyrules))
-- `spiffe` (Attributes List) SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID. (see [below for nested schema](#nested-schema-for-specdenyspiffe))
-- `windows_desktop_labels` (Map of List of String) WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.
-- `windows_desktop_labels_expression` (String) WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.
-- `windows_desktop_logins` (List of String) WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.
-- `workload_identity_labels` (Map of List of String) WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.
-- `workload_identity_labels_expression` (String) WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.
-
-### Nested Schema for `spec.deny.account_assignments`
-
-Optional:
-
-- `account` (String)
-- `permission_set` (String)
-
-
-### Nested Schema for `spec.deny.db_permissions`
-
-Optional:
-
-- `match` (Map of List of String) Match is a list of object labels that must be matched for the permission to be granted.
-- `permissions` (List of String) Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...
-
-
-### Nested Schema for `spec.deny.github_permissions`
-
-Optional:
-
-- `orgs` (List of String)
-
-
-### Nested Schema for `spec.deny.impersonate`
-
-Optional:
-
-- `roles` (List of String) Roles is a list of resources this role is allowed to impersonate
-- `users` (List of String) Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.deny.join_sessions`
-
-Optional:
-
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is a list of permitted participant modes for this policy.
-- `name` (String) Name is the name of the policy.
-- `roles` (List of String) Roles is a list of roles that you can join the session of.
-
-
-### Nested Schema for `spec.deny.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.
-- `kind` (String) Kind specifies the Kubernetes Resource type.
-- `name` (String) Name is the resource name. It supports wildcards.
-- `namespace` (String) Namespace is the resource namespace. It supports wildcards.
-- `verbs` (List of String) Verbs are the allowed Kubernetes verbs for the following resource.
-
-
-### Nested Schema for `spec.deny.request`
-
-Optional:
-
-- `annotations` (Map of List of String) Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins.  Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyrequestclaims_to_roles))
-- `kubernetes_resources` (Attributes List) kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources. (see [below for nested schema](#nested-schema-for-specdenyrequestkubernetes_resources))
-- `max_duration` (String) MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.
-- `reason` (Attributes) Reason defines settings for the reason for the access provided by the user. (see [below for nested schema](#nested-schema-for-specdenyrequestreason))
-- `roles` (List of String) Roles is the name of roles which will match the request rule.
-- `search_as_roles` (List of String) SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.
-- `suggested_reviewers` (List of String) SuggestedReviewers is a list of reviewer suggestions.  These can be teleport usernames, but that is not a requirement.
-- `thresholds` (Attributes List) Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition.  If no thresholds are provided, a default threshold of 1 for approval and denial is used. (see [below for nested schema](#nested-schema-for-specdenyrequestthresholds))
-
-### Nested Schema for `spec.deny.request.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-### Nested Schema for `spec.deny.request.kubernetes_resources`
-
-Optional:
-
-- `api_group` (String) APIGroup specifies the Kubernetes Resource API group.
-- `kind` (String) kind specifies the Kubernetes Resource type.
-
-
-### Nested Schema for `spec.deny.request.reason`
-
-Optional:
-
-- `mode` (String) Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.
-
-
-### Nested Schema for `spec.deny.request.thresholds`
-
-Optional:
-
-- `approve` (Number) Approve is the number of matching approvals needed for state-transition.
-- `deny` (Number) Deny is the number of denials needed for state-transition.
-- `filter` (String) Filter is an optional predicate used to determine which reviews count toward this threshold.
-- `name` (String) Name is the optional human-readable name of the threshold.
-
-
-
-### Nested Schema for `spec.deny.require_session_join`
-
-Optional:
-
-- `count` (Number) Count is the amount of people that need to be matched for this policy to be fulfilled.
-- `filter` (String) Filter is a predicate that determines what users count towards this policy.
-- `kinds` (List of String) Kinds are the session kinds this policy applies to.
-- `modes` (List of String) Modes is the list of modes that may be used to fulfill this policy.
-- `name` (String) Name is the name of the policy.
-- `on_leave` (String) OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.
-
-
-### Nested Schema for `spec.deny.review_requests`
-
-Optional:
-
-- `claims_to_roles` (Attributes List) ClaimsToRoles specifies a mapping from claims (traits) to teleport roles. (see [below for nested schema](#nested-schema-for-specdenyreview_requestsclaims_to_roles))
-- `preview_as_roles` (List of String) PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.
-- `roles` (List of String) Roles is the name of roles which may be reviewed.
-- `where` (String) Where is an optional predicate which further limits which requests are reviewable.
-
-### Nested Schema for `spec.deny.review_requests.claims_to_roles`
-
-Optional:
-
-- `claim` (String) Claim is a claim name.
-- `roles` (List of String) Roles is a list of static teleport roles to match.
-- `value` (String) Value is a claim value to match.
-
-
-
-### Nested Schema for `spec.deny.rules`
-
-Optional:
-
-- `actions` (List of String) Actions specifies optional actions taken when this rule matches
-- `resources` (List of String) Resources is a list of resources
-- `verbs` (List of String) Verbs is a list of verbs
-- `where` (String) Where specifies optional advanced matcher
-
-
-### Nested Schema for `spec.deny.spiffe`
-
-Optional:
-
-- `dns_sans` (List of String) DNSSANs specifies matchers for the SPIFFE ID DNS SANs.  Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: *.example.com would match foo.example.com
-- `ip_sans` (List of String) IPSANs specifies matchers for the SPIFFE ID IP SANs.  Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met.  The matchers should be specified using CIDR notation, it supports IPv4 and IPv6.  Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42
-- `path` (String) Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash.  The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax.  Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar
-
-
-
-### Nested Schema for `spec.options`
-
-Optional:
-
-- `cert_extensions` (Attributes List) CertExtensions specifies the key/values (see [below for nested schema](#nested-schema-for-specoptionscert_extensions))
-- `cert_format` (String) CertificateFormat defines the format of the user certificate to allow compatibility with older versions of OpenSSH.
-- `client_idle_timeout` (String) ClientIdleTimeout sets disconnect clients on idle timeout behavior, if set to 0 means do not disconnect, otherwise is set to the idle duration.
-- `create_db_user` (Boolean) CreateDatabaseUser enabled automatic database user creation.
-- `create_db_user_mode` (Number) CreateDatabaseUserMode allows users to be automatically created on a database when not set to off. 0 is "unspecified", 1 is "off", 2 is "keep", 3 is "best_effort_drop".
-- `create_desktop_user` (Boolean) CreateDesktopUser allows users to be automatically created on a Windows desktop
-- `create_host_user` (Boolean) Deprecated: use CreateHostUserMode instead.
-- `create_host_user_default_shell` (String) CreateHostUserDefaultShell is used to configure the default shell for newly provisioned host users.
-- `create_host_user_mode` (Number) CreateHostUserMode allows users to be automatically created on a host when not set to off. 0 is "unspecified"; 1 is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; 4 is "insecure-drop".
-- `desktop_clipboard` (Boolean) DesktopClipboard indicates whether clipboard sharing is allowed between the user's workstation and the remote desktop. It defaults to true unless explicitly set to false.
-- `desktop_directory_sharing` (Boolean) DesktopDirectorySharing indicates whether directory sharing is allowed between the user's workstation and the remote desktop. It defaults to false unless explicitly set to true.
-- `device_trust_mode` (String) DeviceTrustMode is the device authorization mode used for the resources associated with the role. See DeviceTrust.Mode.
-- `disconnect_expired_cert` (Boolean) DisconnectExpiredCert sets disconnect clients on expired certificates.
-- `enhanced_recording` (List of String) BPF defines what events to record for the BPF-based session recorder.
-- `forward_agent` (Boolean) ForwardAgent is SSH agent forwarding.
-- `idp` (Attributes) IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise. (see [below for nested schema](#nested-schema-for-specoptionsidp))
-- `lock` (String) Lock specifies the locking mode (strict|best_effort) to be applied with the role.
-- `max_connections` (Number) MaxConnections defines the maximum number of concurrent connections a user may hold.
-- `max_kubernetes_connections` (Number) MaxKubernetesConnections defines the maximum number of concurrent Kubernetes sessions a user may hold.
-- `max_session_ttl` (String) MaxSessionTTL defines how long a SSH session can last for.
-- `max_sessions` (Number) MaxSessions defines the maximum number of concurrent sessions per connection.
-- `mfa_verification_interval` (String) MFAVerificationInterval optionally defines the maximum duration that can elapse between successive MFA verifications. This variable is used to ensure that users are periodically prompted to verify their identity, enhancing security by preventing prolonged sessions without re-authentication when using tsh proxy * derivatives. It's only effective if the session requires MFA. If not set, defaults to `max_session_ttl`.
-- `permit_x11_forwarding` (Boolean) PermitX11Forwarding authorizes use of X11 forwarding.
-- `pin_source_ip` (Boolean) PinSourceIP forces the same client IP for certificate generation and usage
-- `port_forwarding` (Boolean) Deprecated: Use SSHPortForwarding instead
-- `record_session` (Attributes) RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false. (see [below for nested schema](#nested-schema-for-specoptionsrecord_session))
-- `request_access` (String) RequestAccess defines the request strategy (optional|reason|always) where optional is the default.
-- `request_prompt` (String) RequestPrompt is an optional message which tells users what they aught to request.
-- `require_session_mfa` (Number) RequireMFAType is the type of MFA requirement enforced for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN".
-- `ssh_file_copy` (Boolean) SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to true unless explicitly set to false.
-- `ssh_port_forwarding` (Attributes) SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwarding))
-
-### Nested Schema for `spec.options.cert_extensions`
-
-Optional:
-
-- `mode` (Number) Mode is the type of extension to be used -- currently critical-option is not supported. 0 is "extension".
-- `name` (String) Name specifies the key to be used in the cert extension.
-- `type` (Number) Type represents the certificate type being extended, only ssh is supported at this time. 0 is "ssh".
-- `value` (String) Value specifies the value to be used in the cert extension.
-
-
-### Nested Schema for `spec.options.idp`
-
-Optional:
-
-- `saml` (Attributes) SAML are options related to the Teleport SAML IdP. (see [below for nested schema](#nested-schema-for-specoptionsidpsaml))
-
-### Nested Schema for `spec.options.idp.saml`
-
-Optional:
-
-- `enabled` (Boolean) Enabled is set to true if this option allows access to the Teleport SAML IdP.
-
-
-
-### Nested Schema for `spec.options.record_session`
-
-Optional:
-
-- `default` (String) Default indicates the default value for the services.
-- `desktop` (Boolean) Desktop indicates whether desktop sessions should be recorded. It defaults to true unless explicitly set to false.
-- `ssh` (String) SSH indicates the session mode used on SSH sessions.
-
-
-### Nested Schema for `spec.options.ssh_port_forwarding`
-
-Optional:
-
-- `local` (Attributes) Allow local port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardinglocal))
-- `remote` (Attributes) Allow remote port forwarding. (see [below for nested schema](#nested-schema-for-specoptionsssh_port_forwardingremote))
-
-### Nested Schema for `spec.options.ssh_port_forwarding.local`
-
-Optional:
-
-- `enabled` (Boolean)
-
-
-### Nested Schema for `spec.options.ssh_port_forwarding.remote`
-
-Optional:
-
-- `enabled` (Boolean)
diff --git a/docs/pages/reference/terraform-provider/resources/saml_connector.mdx b/docs/pages/reference/terraform-provider/resources/saml_connector.mdx
deleted file mode 100644
index 4f5ec67454e15..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/saml_connector.mdx
+++ /dev/null
@@ -1,160 +0,0 @@
----
-title: Reference for the teleport_saml_connector Terraform resource
-sidebar_label: saml_connector
-description: This page describes the supported values of the teleport_saml_connector resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_saml_connector resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport SAML connector
-# 
-# Please note that the SAML connector will work in Teleport Enterprise only.
-
-resource "teleport_saml_connector" "example" {
-  version = "v2"
-  # This block will tell Terraform to never update private key from our side if a keys are managed 
-  # from an outside of Terraform.
-
-  # lifecycle {
-  #   ignore_changes = [
-  #     spec[0].signing_key_pair[0].cert,
-  #     spec[0].signing_key_pair[0].private_key,
-  #     spec[0].assertion_key_pair[0].cert,
-  #     spec[0].assertion_key_pair[0].private_key,
-  #   ]
-  # }
-
-  # This section tells Terraform that role example must be created before the SAML connector
-  depends_on = [
-    teleport_role.example
-  ]
-
-  metadata = {
-    name = "example"
-  }
-
-  spec = {
-    attributes_to_roles = [{
-      name  = "groups"
-      roles = ["example"]
-      value = "okta-admin"
-      },
-      {
-        name  = "groups"
-        roles = ["example"]
-        value = "okta-dev"
-    }]
-
-    acs               = "https://localhost:3025/v1/webapi/saml/acs"
-    entity_descriptor = ""
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `spec` (Attributes) Spec is an SAML connector specification. (see [below for nested schema](#nested-schema-for-spec))
-- `version` (String) Version is the resource version. It must be specified. Supported values are: `v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata holds resource metadata. (see [below for nested schema](#nested-schema-for-metadata))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources.
-
-### Nested Schema for `spec`
-
-Required:
-
-- `acs` (String) AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).
-- `attributes_to_roles` (Attributes List) AttributesToRoles is a list of mappings of attribute statements to roles. (see [below for nested schema](#nested-schema-for-specattributes_to_roles))
-
-Optional:
-
-- `allow_idp_initiated` (Boolean) AllowIDPInitiated is a flag that indicates if the connector can be used for IdP-initiated logins.
-- `assertion_key_pair` (Attributes) EncryptionKeyPair is a key pair used for decrypting SAML assertions. (see [below for nested schema](#nested-schema-for-specassertion_key_pair))
-- `audience` (String) Audience uniquely identifies our service provider.
-- `cert` (String, Sensitive) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
-- `client_redirect_settings` (Attributes) ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones. (see [below for nested schema](#nested-schema-for-specclient_redirect_settings))
-- `display` (String) Display controls how this connector is displayed.
-- `entity_descriptor` (String, Sensitive) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements.
-- `entity_descriptor_url` (String) EntityDescriptorURL is a URL that supplies a configuration XML.
-- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced on login. UNSPECIFIED is treated as NO.
-- `issuer` (String) Issuer is the identity provider issuer.
-- `mfa` (Attributes) MFASettings contains settings to enable SSO MFA checks through this auth connector. (see [below for nested schema](#nested-schema-for-specmfa))
-- `preferred_request_binding` (String) PreferredRequestBinding is a preferred SAML request binding method. Value must be either "http-post" or "http-redirect". In general, the SAML identity provider lists request binding methods it supports. And the SAML service provider uses one of the IdP supported request binding method that it prefers. But we never honored request binding value provided by the IdP and always used http-redirect binding as a default. Setting up PreferredRequestBinding value lets us preserve existing auth connector behavior and only use http-post binding if it is explicitly configured.
-- `provider` (String) Provider is the external identity provider.
-- `service_provider_issuer` (String) ServiceProviderIssuer is the issuer of the service provider (Teleport).
-- `signing_key_pair` (Attributes) SigningKeyPair is an x509 key pair used to sign AuthnRequest. (see [below for nested schema](#nested-schema-for-specsigning_key_pair))
-- `single_logout_url` (String) SingleLogoutURL is the SAML Single log-out URL to initiate SAML SLO (single log-out). If this is not provided, SLO is disabled.
-- `sso` (String) SSO is the URL of the identity provider's SSO service.
-
-### Nested Schema for `spec.attributes_to_roles`
-
-Optional:
-
-- `name` (String) Name is an attribute statement name.
-- `roles` (List of String) Roles is a list of static teleport roles to map to.
-- `value` (String) Value is an attribute statement value to match.
-
-
-### Nested Schema for `spec.assertion_key_pair`
-
-Optional:
-
-- `cert` (String) Cert is a PEM-encoded x509 certificate.
-- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
-
-
-### Nested Schema for `spec.client_redirect_settings`
-
-Optional:
-
-- `allowed_https_hostnames` (List of String) a list of hostnames allowed for https client redirect URLs
-- `insecure_allowed_cidr_ranges` (List of String) a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
-
-
-### Nested Schema for `spec.mfa`
-
-Optional:
-
-- `cert` (String) Cert is the identity provider certificate PEM. IDP signs `<Response>` responses using this certificate.
-- `enabled` (Boolean) Enabled specified whether this SAML connector supports MFA checks. Defaults to false.
-- `entity_descriptor` (String) EntityDescriptor is XML with descriptor. It can be used to supply configuration parameters in one XML file rather than supplying them in the individual elements. Usually set from EntityDescriptorUrl.
-- `entity_descriptor_url` (String) EntityDescriptorUrl is a URL that supplies a configuration XML.
-- `force_authn` (Number) ForceAuthn specified whether re-authentication should be forced for MFA checks. UNSPECIFIED is treated as YES to always re-authentication for MFA checks. This should only be set to NO if the IdP is setup to perform MFA checks on top of active user sessions.
-- `issuer` (String) Issuer is the identity provider issuer. Usually set from EntityDescriptor.
-- `sso` (String) SSO is the URL of the identity provider's SSO service. Usually set from EntityDescriptor.
-
-
-### Nested Schema for `spec.signing_key_pair`
-
-Optional:
-
-- `cert` (String) Cert is a PEM-encoded x509 certificate.
-- `private_key` (String, Sensitive) PrivateKey is a PEM encoded x509 private key.
-
-
-
-### Nested Schema for `metadata`
-
-Required:
-
-- `name` (String) Name is an object name
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
diff --git a/docs/pages/reference/terraform-provider/resources/session_recording_config.mdx b/docs/pages/reference/terraform-provider/resources/session_recording_config.mdx
deleted file mode 100644
index 39c83b9a4c2cf..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/session_recording_config.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-title: Reference for the teleport_session_recording_config Terraform resource
-sidebar_label: session_recording_config
-description: This page describes the supported values of the teleport_session_recording_config resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_session_recording_config resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Teleport session recording config
-
-resource "teleport_session_recording_config" "example" {
-  version = "v2"
-  metadata = {
-    description = "Session recording config"
-    labels = {
-      "example"             = "yes"
-      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
-    }
-  }
-
-  spec = {
-    proxy_checks_host_keys = true
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the resource version. It must be specified. Supported values are:`v2`.
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Spec is a SessionRecordingConfig specification (see [below for nested schema](#nested-schema-for-spec))
-- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `description` (String) Description is object description
-- `expires` (String) Expires is a global expiry time header can be set on any resource in the system.
-- `labels` (Map of String) Labels is a set of labels
-
-
-### Nested Schema for `spec`
-
-Optional:
-
-- `mode` (String) Mode controls where (or if) the session is recorded.
-- `proxy_checks_host_keys` (Boolean) ProxyChecksHostKeys is used to control if the proxy will check host keys when in recording mode.
diff --git a/docs/pages/reference/terraform-provider/resources/trusted_device.mdx b/docs/pages/reference/terraform-provider/resources/trusted_device.mdx
deleted file mode 100644
index 760e1687e6331..0000000000000
--- a/docs/pages/reference/terraform-provider/resources/trusted_device.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Reference for the teleport_trusted_device Terraform resource
-sidebar_label: trusted_device
-description: This page describes the supported values of the teleport_trusted_device resource of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-This page describes the supported values of the teleport_trusted_device resource of the Teleport Terraform provider.
-
-
-
-
-## Example Usage
-
-```hcl
-# Trusted device resource
-
-resource "teleport_trusted_device" "TESTDEVICE1" {
-  spec = {
-    asset_tag = "TESTDEVICE1"
-    os_type   = "macos"
-  }
-}
-```
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Required
-
-- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1`
-
-### Optional
-
-- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata))
-- `spec` (Attributes) Specification of the device. (see [below for nested schema](#nested-schema-for-spec))
-
-### Nested Schema for `metadata`
-
-Optional:
-
-- `labels` (Map of String) Labels is a set of labels
-- `name` (String) Name is an object name
-
-
-### Nested Schema for `spec`
-
-Required:
-
-- `asset_tag` (String)
-- `os_type` (String)
-
-Optional:
-
-- `enroll_status` (String)
-- `owner` (String)
-- `source` (Attributes) (see [below for nested schema](#nested-schema-for-specsource))
-
-### Nested Schema for `spec.source`
-
-Optional:
-
-- `name` (String)
-- `origin` (String)
diff --git a/docs/pages/reference/terraform-provider/terraform-provider.mdx b/docs/pages/reference/terraform-provider/terraform-provider.mdx
deleted file mode 100644
index 5c72f911076ce..0000000000000
--- a/docs/pages/reference/terraform-provider/terraform-provider.mdx
+++ /dev/null
@@ -1,190 +0,0 @@
----
-title: "Teleport Terraform Provider"
-description: Reference documentation of the Teleport Terraform provider.
----
-
-{/*Auto-generated file. Do not edit.*/}
-{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
-
-The Teleport Terraform provider allows Terraform users to configure Teleport
-from Terraform.
-
-This section is the Teleport Terraform Provider reference.
-It lists all the supported resources and their fields.
-
-<Admonition type="tip">
-To get started with the Terraform provider, you must start with [the installation
-guide](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
-Once you got a working provider, we recommend you to follow the
-["Managing users and roles with IaC"](
-../../admin-guides/infrastructure-as-code/managing-resources/user-and-role.mdx) guide.
-</Admonition>
-
-The provider exposes Teleport resources both as Terraform data-sources and Terraform resources.
-Data-sources are used by Terraform to fetch information from Teleport, while resources are used
-to create resources in Teleport.
-
-{/* Note: the awkward `resource-index` file names are here because `data-sources`
-is reserved by the generator for the catch-all resource template */}
-
-- [list of supported resources](./resources/resources.mdx)
-- [list of supported data-sources](./data-sources/data-sources.mdx)
-
-## Example Usage
-
-<Tabs>
-<TabItem label="self-hosted">
-
-```hcl
-terraform {
-  required_providers {
-    teleport = {
-      source  = "terraform.releases.teleport.dev/gravitational/teleport"
-      version = "~> (=teleport.major_version=).0"
-    }
-  }
-}
-
-provider "teleport" {
-  # Update addr to point to Teleport Auth/Proxy
-  # addr              = "auth.example.com:3025"
-  addr               = "proxy.example.com:443"
-  identity_file_path = "terraform-identity/identity"
-}
-```
-
-</TabItem>
-<TabItem label="cloud">
-
-```hcl
-terraform {
-  required_providers {
-    teleport = {
-      source  = "terraform.releases.teleport.dev/gravitational/teleport"
-      version = "~> (=cloud.major_version=).0"
-    }
-  }
-}
-
-provider "teleport" {
-  # Update addr to point to your Teleport Enterprise (managed) tenant URL's host:port
-  addr               = "mytenant.teleport.sh:443"
-  identity_file_path = "terraform-identity/identity"
-}
-```
-
-</TabItem>
-</Tabs>
-
-## Connection methods
-
-This section lists the different ways of passing credentials to the Terraform provider.
-You can find which method fits your use case in
-the [Teleport Terraform provider setup
-page](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
-
-### With an identity file
-
-With this connection method, you must provide an identity file.This file allows Terraform to connect both via the Proxy
-Service (ports 443 or 3080) and via the Auth Service (port 3025). This is the recommended way of passing credentials to
-the Terraform provider.
-
-The identity file can be obtained via several ways:
-
-### Obtaining an identity file locally with `tctl`
-
-Since 16.2, you can use `tctl` and your local credentials to create a temporary bot and load its identity
-in your shell's environment variables:
-
-```code
-$ eval "$(tctl terraform env)"
-🔑 Detecting if MFA is required
-This is an admin-level action and requires MFA to complete
-Tap any security key
-Detected security key tap
-⚙️ Creating temporary bot "tctl-terraform-env-82ab1a2e" and its token
-🤖 Using the temporary bot to obtain certificates
-🚀 Certificates obtained, you can now use Terraform in this terminal for 1h0m0s
-```
-
-You can find more information in
-the ["Run the Terraform provider locally" guide](../../admin-guides/infrastructure-as-code/terraform-provider/local.mdx)
-
-#### Obtaining an identity file via `tbot`
-
-`tbot` relies on [MachineID](../../enroll-resources/machine-id/introduction.mdx) to obtain and automatically renew
-short-lived credentials. Such credentials are harder to exfiltrate, and you can control more precisely who has access to
-which roles (e.g. you can allow only GitHub Actions pipelines targeting the `prod` environment to get certificates).
-
-You can follow [the Terraform Provider
-guide](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx) to setup `tbot`
-and have Terraform use its identity.
-
-#### Obtaining an identity file via `tctl auth sign`
-
-You can obtain an identity file with the command
-
-```code
-$ tctl auth sign --user terraform --format file -o identity.pem
-```
-
-This auth method has the following limitations:
-- Such credentials are high-privileged and long-lived. They must be protected and rotated.
-- This auth method does not work against Teleport clusters with MFA set to `webauthn`.
-  On such clusters, Teleport will reject any long-lived certificate and require
-  [an additional MFA challenge for administrative actions](../../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx).
-
-### With a token (native MachineID)
-
-Starting with 16.2, the Teleport Terraform provider can natively use MachineID (without `tbot`) to join a Teleport
-cluster. The Terraform Provider will rely on its runtime (AWS, GCP, Kubernetes, CI/CD system) to prove its identity to
-Teleport.
-
-You can use any [delegated join method](../join-methods.mdx#delegated-join-methods) by setting
-both `join_method` and `join_token` in the provider configuration.
-
-This setup is described in more details in
-the ["Run the Teleport Terraform provider in CI or Cloud" guide](../../admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx).
-
-### With key, certificate, and CA certificate
-
-With this connection method, you must provide a TLS key, a TLS certificate, and the Teleport Auth Service TLS CA certificates.
-Those can be obtained with the command:
-
-```code
-$ tctl auth sign --user terraform --format=tls -o terraform.pem
-```
-
-This auth method has the following limitations:
-- The provider can only connect to the Auth directly (port 3025). On most clusters, only the proxy is publicly exposed.
-- Such credentials are high-privileged and long-lived. They must be protected and rotated.
-- This auth method does not work against Teleport clusters with MFA set to `webauthn`.
-  On such clusters, Teleport will reject any long-lived certificate and require
-  [an additional MFA challenge for administrative actions](../../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx).
-
-{/*  schema generated by tfplugindocs */}
-## Schema
-
-### Optional
-
-- `addr` (String) host:port of the Teleport address. This can be the Teleport Proxy Service address (port 443 or 4080) or the Teleport Auth Service address (port 3025). This can also be set with the environment variable `TF_TELEPORT_ADDR`.
-- `audience_tag` (String) Name of the optional audience tag used for native Machine ID joining with the `terraform` method. This can also be set with the environment variable `TF_TELEPORT_JOIN_AUDIENCE_TAG`.
-- `cert_base64` (String) Base64 encoded TLS auth certificate. This can also be set with the environment variable `TF_TELEPORT_CERT_BASE64`.
-- `cert_path` (String) Path to Teleport auth certificate file. This can also be set with the environment variable `TF_TELEPORT_CERT`.
-- `dial_timeout_duration` (String) DialTimeout sets timeout when trying to connect to the server. This can also be set with the environment variable `TF_TELEPORT_DIAL_TIMEOUT_DURATION`.
-- `gitlab_id_token_env_var` (String) Environment variable used to fetch the ID token issued by GitLab for the `gitlab` join method. If unset, this defaults to `TBOT_GITLAB_JWT`. This can also be set with the environment variable `TF_TELEPORT_GITLAB_ID_TOKEN_ENV_VAR`.
-- `identity_file` (String, Sensitive) Teleport identity file content. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE`.
-- `identity_file_base64` (String, Sensitive) Teleport identity file content base64 encoded. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE_BASE64`.
-- `identity_file_path` (String) Teleport identity file path. This can also be set with the environment variable `TF_TELEPORT_IDENTITY_FILE_PATH`.
-- `join_method` (String) Enables the native Terraform MachineID support. When set, Terraform uses MachineID to securely join the Teleport cluster and obtain credentials. See [the join method reference](../join-methods.mdx) for possible values. You must use [a delegated join method](../join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `TF_TELEPORT_JOIN_METHOD`.
-- `join_token` (String) Name of the token used for the native MachineID joining. This value is not sensitive for [delegated join methods](../join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `TF_TELEPORT_JOIN_TOKEN`.
-- `key_base64` (String, Sensitive) Base64 encoded TLS auth key. This can also be set with the environment variable `TF_TELEPORT_KEY_BASE64`.
-- `key_path` (String) Path to Teleport auth key file. This can also be set with the environment variable `TF_TELEPORT_KEY`.
-- `profile_dir` (String) Teleport profile path. This can also be set with the environment variable `TF_TELEPORT_PROFILE_PATH`.
-- `profile_name` (String) Teleport profile name. This can also be set with the environment variable `TF_TELEPORT_PROFILE_NAME`.
-- `retry_base_duration` (String) Retry algorithm when the API returns 'not found': base duration between retries (https://pkg.go.dev/time#ParseDuration). This can also be set with the environment variable `TF_TELEPORT_RETRY_BASE_DURATION`.
-- `retry_cap_duration` (String) Retry algorithm when the API returns 'not found': max duration between retries (https://pkg.go.dev/time#ParseDuration). This can also be set with the environment variable `TF_TELEPORT_RETRY_CAP_DURATION`.
-- `retry_max_tries` (String) Retry algorithm when the API returns 'not found': max tries. This can also be set with the environment variable `TF_TELEPORT_RETRY_MAX_TRIES`.
-- `root_ca_base64` (String) Base64 encoded Root CA. This can also be set with the environment variable `TF_TELEPORT_CA_BASE64`.
-- `root_ca_path` (String) Path to Teleport Root CA. This can also be set with the environment variable `TF_TELEPORT_ROOT_CA`.
-
diff --git a/docs/pages/reference/workload-identity/workload-identity.mdx b/docs/pages/reference/workload-identity/workload-identity.mdx
deleted file mode 100644
index e82f4221df44b..0000000000000
--- a/docs/pages/reference/workload-identity/workload-identity.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Workload Identity References
-description: Configuration and CLI reference for Teleport Workload Identity
----
-
-<DocCardList />
diff --git a/docs/pages/upcoming-releases.mdx b/docs/pages/upcoming-releases.mdx
index d60122c14c809..624cb7cd30d18 100644
--- a/docs/pages/upcoming-releases.mdx
+++ b/docs/pages/upcoming-releases.mdx
@@ -1,117 +1,91 @@
 ---
 title: Teleport Upcoming Releases
 description: A timeline of upcoming Teleport releases.
-h1: Upcoming Teleport Releases
+tags:
+ - reference
+ - platform-wide
 ---
 
-The Teleport team delivers a new major release roughly every 3 months.
+Teleport releases a new major version once per year, and provides
+security-critical support for the current and previous major version. We
+support each major version for 24 months.
 
-## Teleport
-
-### Teleport 12.3.0
-
-####  Automatic user creation for desktop access
-
-Teleport's passwordless access for local users will provide the ability to
-create Windows users on demand, similar to how host-user creation works for SSH
-servers.
-
-#### SFTP UX enhancements
-
-Will include fixes for wildcard patterns, excessive audit logging and PyCharm
-compatibility. [#22748](https://github.com/gravitational/teleport/issues/22748)
-[#21518](https://github.com/gravitational/teleport/issues/21518)
-[#22982](https://github.com/gravitational/teleport/issues/22982)
-[#22263](https://github.com/gravitational/teleport/issues/22263)
-[#20863](https://github.com/gravitational/teleport/issues/20863)
-[#23593](https://github.com/gravitational/teleport/issues/23593)
-
-| Version | Date          |
-|---------|---------------|
-| 12.3.0  | May 1st, 2023 |
-
-### Teleport 13.0.0
+The most recent major version of Teleport, referred to as the **current version**,
+is the only major version of Teleport that will receive new features. The
+previous major version, referred to as the **stable version**, will only receive
+bug fixes and security patches.
 
-| Version        | Date             |
-|----------------|------------------|
-| 13.0.0-alpha.1 | April 17th, 2023 |
-| 13.0.0         | May 8th, 2023    |
-
-####  Automatic updates
-
-Users will be able to configure Teleport Agents to upgrade automatically.
-
-####  TLS routing through ALB for server access and Kubernetes access
-
-Teleport will support server access and Kubernetes access through load
-balancers in TLS routing mode.
-
-####  Ability to import applications and groups from Okta
+## Teleport
 
-Teleport will be able to imports Okta apps and groups and users will be able to
-use Access Requests with Okta apps and groups.
+### Supported releases
 
-####  AWS OpenSearch support for database access
+We continue to support the following major versions of Teleport:
 
-Database access will add support for connecting to AWS OpenSearch.
+| Version | Release | Release Date      | EOL              | Minimum `tsh` version |
+|---------|---------|-------------------|------------------|-----------------------|
+| Current | v18.x   | July 3, 2025      | August 2027      | v17.0.0               |
+| Stable  | v17.x   | November 16, 2024 | August 2026      | v16.0.0               |
 
-#### Cross-Cluster Search for Teleport Connect
+### Upcoming releases
 
-Teleport Connect will include a new search experience, allowing you to search
-for and connect to resources across all logged-in clusters.
+We plan to release the following versions in the coming months:
 
-#### Kubernetes access performance improvements
+| Version | Date                       |
+|---------|----------------------------|
+| 18.7.0  | Week of January 26, 2026   |
+| 19.0.0  | August 2026                |
 
-Users will experience better performance when interacting with Kubernetes clusters.
+### 18.7.0
 
-#### Universal binaries (including Apple Silicon) for macOS
+#### VNet for Linux
 
-Teleport will run natively on ARM Macs, without the need for Rosetta emulation.
+Teleport VNet support will be extended to Linux workstations.
 
-#### Simplified RDS onboarding flow in Access Management UI
+#### Session timeline view for Identity Security
 
-Teleport Access Management UI will provide ability to connect to AWS account
-and select RDS databases for onboarding.
+Session player for Identity Security users will receive an enhanced timeline view with
+per-command session breakdown.
 
-#### Light theme for Web UI
+#### Improvements to access list creation UX
 
-Teleport's web UI will ship with an optional light theme.
+Teleport will provide guided in-product UX for creating common types of access lists
+centered around granting users permissions to resources and permissions to request
+access to resources.
 
-#### Other
+#### Terraform-native flow for configuration of AWS EC2 auto-discovery
 
-In addition, the following improvements
+Teleport will provide in-product UX for configuring EC2 auto-discovery in a single AWS
+account using terraform module.
 
-- Improved SQL Server PKINIT Auth support
-- Session recording video export support for Teleport-protected desktops
-- Add support for locking to Web UI
-- Device listing in Web UI
+#### Static labels for auto-discovered Windows desktops
 
-### 13.1.0
+Teleport can now be configured to apply a set of static labels to Windows
+desktops that it discovers via LDAP. This is an alternative to setting labels
+based on the value of LDAP attributes.
 
-####  GCP Auto-Discovery for server access
+#### Access requests privilege escalation UX for AWS
 
-Teleport will be able to automatically enroll GCP VM for server access.
+Teleport users will be able to see specific IAM roles available to them when requesting
+elevated access to AWS CLI/console. Future releases will extend support for specific
+principal selection to access requests for other resource types as well.
 
-####  OpsGenie Access Request Plugin
+#### RoleV8 support in terraform provider
 
-Teleport will include OpsGenie access plugin.
+Teleport terraform provider will support RoleV8 out of the box.
 
-*Delayed from Teleport 13.0.0.*
+#### Entra ID integration status page
 
-| Version | Date           |
-|---------|----------------|
-| 12.3.0  | June 1st, 2023 |
+Teleport users will be able to see status of the configured Entra ID integration in the
+web UI.
 
 ## Teleport Cloud
 
 The key deliverables for Teleport Cloud in the next quarter:
 
-| Week of          | Description                                          |
-|------------------|------------------------------------------------------|
-| April 10th, 2023 | Teleport 12.2 begins to roll out for Cloud customers |
-| May 8th, 2023    | Add support for hosted Access Request plugins        |
-| June 5th, 2023   | Teleport 13.1 begins to roll out for Cloud customers |
-| June 5th, 2023   | Advanced Audit Log rollout begins                    |
+| Week of            | Description                                                  |
+|--------------------|--------------------------------------------------------------|
+| December 29, 2025   | Teleport 18.6 will begin rollout on Cloud.                   |
+| December 29, 2025   | Teleport 18.6 agents will begin rollout to eligible tenants. |
 
 ## Production readiness
 
@@ -152,18 +126,6 @@ minor release, such as (=teleport.major_version=).1.0.
 Patch releases contain small bug fixes and can typically be deployed directly
 to production.
 
-## Preview Policy
-
-A product or feature may be marked as "Preview" if any of the following is
-true.
-
-- The product or feature is missing key functionality. For example, Microsoft
-  SQL Server support for database access initially shipped without audit
-  logging support.
-- The product or feature has NOT been adopted by at least 2 existing customers.
-- The product or feature has NOT been through a security audit.
-- The documentation for the product or feature is incomplete.
-- Assets (e.g. binaries) associated with the feature are not published to our
-  official downloads page.
+## Version compatibility
 
-Use preview features in production if the above issues are not a concern.
+(!docs/pages/includes/compatibility.mdx!)
diff --git a/docs/pages/upgrading/agent-managed-updates-v1.mdx b/docs/pages/upgrading/agent-managed-updates-v1.mdx
index 397d473d56660..e193c6219fe58 100644
--- a/docs/pages/upgrading/agent-managed-updates-v1.mdx
+++ b/docs/pages/upgrading/agent-managed-updates-v1.mdx
@@ -1,23 +1,29 @@
 ---
-title: Managed Updates for Teleport Agents (v1)
+title: Managed Updates for Teleport Agents (legacy)
 description: Describes how to set up Managed Updates for Teleport Agents (v1)
+tags:
+ - how-to
+ - platform-wide
 ---
 
 <Admonition type="warning">
-This document describes Managed Updates for Agents (v1), which is
-currently supported but will be deprecated after [Managed Updates for
-Agents (v2)](./agent-managed-updates.mdx) is generally available.
+This document describes Managed Updates for Agents v1, which
+is a legacy system that may be removed in future versions of Teleport.
+
+For Managed Updates v2 instructions, see [Managed Updates for
+Agents (v2)](./agent-managed-updates/agent-managed-updates.mdx).
 </Admonition>
 
 Managed Updates v1 uses a script called `teleport-upgrade` that is provided by
 the `teleport-ent-updater` package and configured by the `cluster_maintenance_config`
 Teleport resource. Managed Updates v2 uses a binary called `teleport-update` that is
 provided by the `teleport` package and configured by the `autoupdate_version` and
-`autoupdate_config`. The original updater and resource are described in this document.
+`autoupdate_config` resources. The original updater and resource are described in
+this document.
 
 Only Enterprise versions of Teleport can use Managed Updates v1.
 
-Please consider using [Managed Updates for Agents (v2)](./agent-managed-updates.mdx),
+Please consider using [Managed Updates for Agents v2](./agent-managed-updates/agent-managed-updates.mdx),
 as it provides a safer, simpler, more flexible, compatible, and reliable update experience
 compared to Managed Updates v1.
 
@@ -67,13 +73,10 @@ regular maintenance window.
 
 ## Prerequisites
 
-- A Teleport Enterprise cluster. If you do not have one, [sign
-  up](https://goteleport.com/signup) for a free trial or consult the [Update
-  Reference](upgrading-reference.mdx) to read about manual updates.
 - Familiarity with the [Upgrading Compatibility Overview](./overview.mdx) guide,
   which describes the sequence in which to upgrade components in your cluster.
 - Teleport Agents that are not yet enrolled in Managed Updates.
-- (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
+- (!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/4. Enable Managed Agent Updates
@@ -119,7 +122,7 @@ Teleport cluster that agents use to determine when to check for upgrades.
 
 1. Add the role to your Teleport user:
 
-  (!docs/pages/includes/add-role-to-user.mdx role="cmc-editor"!)
+   (!docs/pages/includes/add-role-to-user.mdx role="cmc-editor"!)
 
 1. Create a cluster maintenance config in a file called `cmc.yaml`. The
    following example allows maintenance on Monday, Wednesday and Friday between
@@ -198,9 +201,9 @@ Server ID                            Hostname      Services Version Upgrader
 
 1. Determine the Teleport version to install by querying the Teleport Proxy
    Service. This way, the Teleport installation has the same major version as
-   the automatic updater. 
+   the updater. 
 
-   Replace <Var name="stable/cloud" /> with the name of your automatic update
+   Replace <Var name="stable/cloud" /> with the name of your update
    channel. For cloud-hosted Teleport Enterprise accounts, this is always
    `stable/cloud`:
 
@@ -224,7 +227,7 @@ Server ID                            Hostname      Services Version Upgrader
    <TabItem label="Self-Hosted Teleport Enterprise">
 
    1. Follow the instructions in the Teleport [installation
-      guide](../installation.mdx#package-repositories) to install the `teleport`
+      guide](../installation/linux.mdx#package-repositories) to install the `teleport`
       binary on your Linux server for your package manager.
 
    1. Using your package manager, install `teleport-ent-updater` on the
@@ -240,7 +243,7 @@ Server ID                            Hostname      Services Version Upgrader
    The installation script detects the package manager on your Linux server and
    uses it to install Teleport binaries. To customize your installation, learn
    about the Teleport package repositories in the [installation
-   guide](../installation.mdx#linux).
+   guide](../installation/linux.mdx).
 
 1. Confirm that the version of the `teleport` binary is the one you expect:
 
@@ -248,19 +251,19 @@ Server ID                            Hostname      Services Version Upgrader
    $ teleport version
    ```
 
-<details>
-<summary>Running the agent as a non-root user</summary>
+   <details>
+   <summary>Running the agent as a non-root user</summary>
 
-If you changed the agent user to run as non-root, create
-`/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user:
+   If you changed the agent user to run as non-root, create
+   `/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user:
 
-```code
-$ sudo mkdir -p /etc/teleport-upgrade.d/
-$ sudo touch /etc/teleport-upgrade.d/schedule
-$ sudo chown your-teleport-user /etc/teleport-upgrade.d/schedule
-```
+   ```code
+   $ sudo mkdir -p /etc/teleport-upgrade.d/
+   $ sudo touch /etc/teleport-upgrade.d/schedule
+   $ sudo chown your-teleport-user /etc/teleport-upgrade.d/schedule
+   ```
 
-</details>
+   </details>
 
 1. Verify that the upgrader can see your version endpoint by checking for
    upgrades:
@@ -409,3 +412,152 @@ until the next reconciliation, you can trigger an event.
    $ sudo systemctl enable --now teleport-upgrade.timer
    ```
 
+## Working with the teleport-upgrade tool
+
+This section explains advanced usage of the v1 `teleport-upgrade` script for Linux.
+Note that this tool is no longer actively developed, and the Managed Updates v2
+`teleport-update` binary should be used instead.
+For Managed Updates v2 instructions, see [Managed Updates for
+Agents (v2)](./agent-managed-updates/agent-managed-updates.mdx).
+
+### `teleport-upgrade` commands
+
+The `teleport-upgrade` tool provides some basic commands to verify and perform an
+update of the Teleport Agent.
+
+```code
+$ teleport-upgrade help
+USAGE: /usr/sbin/teleport-upgrade <command>
+
+Tool for automatic upgrades of Teleport Agents.
+
+Commands:
+  run           check for and potentially apply a teleport upgrade.
+  dry-run       check for new teleport version but do not upgrade.
+  force         performs an upgrade if an upgrade is available.
+  version       print the current version of /usr/sbin/teleport-upgrade.
+  help          show this help text.
+```
+
+The `dry-run` command can be used to check for an available update without performing
+an update.
+```code
+# Example output when teleport is already on the latest compatible version.
+$ teleport-upgrade dry-run
+[i] no upgrades available (14.3.14 == 14.3.14) [ 582 ]
+
+# Example output when an update is available.
+$ teleport-upgrade dry-run
+[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
+[i] within maintenance window, upgrade will be attempted. [ 596 ]
+```
+
+The `run` command performs an update if available.
+```code
+# Successful teleport update from 13.4.14 to 14.3.14.
+$ teleport-upgrade run
+[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
+[i] within maintenance window, upgrade will be attempted. [ 596 ]
+[i] attempting apt install teleport-ent=14.3.14... [ 480 ]
+[...]
+[i] gracefully restarting Teleport (if already running) [ 449 ]
+
+# Teleport updates are not attempted when outside the maintenance window.
+$ teleport-upgrade run
+[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
+[i] upgrade is non-critical and we are outside of maintenance window, not attempting. [ 618 ]
+```
+
+The `force` command performs an update immediately even when outside the maintenance
+window.
+```code
+$ teleport-upgrade force
+[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
+[i] attempting apt install teleport-ent=14.3.14... [ 480 ]
+[...]
+[i] gracefully restarting Teleport (if already running) [ 449 ]
+```
+
+### Configuring the `teleport-upgrade` tool
+
+1. Create the upgrade configuration directory:
+
+   ```code
+   $ sudo mkdir -p /etc/teleport-upgrade.d/
+   ```
+
+1. If you changed the agent user to run as non-root, create
+   `/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user,
+   assigning <Var name="your-teleport-user" /> to the name of your Teleport
+   user. Otherwise, you can skip this step:
+
+   ```code 
+   $ sudo touch /etc/teleport-upgrade.d/schedule 
+   $ sudo chown <Var name="your-teleport-user" /> /etc/teleport-upgrade.d/schedule 
+   ```
+
+   1. Configure the upgrader to connect to your version server and subscribe to
+      the right release channel:
+
+   ```code 
+   $ echo "<Var name="teleport.example.com:443" />/v1/webapi/automaticupgrades/channel/default" | sudo tee /etc/teleport-upgrade.d/endpoint
+   ```
+
+   Make sure not to include `https://` as a prefix to the server address, nor
+   suffix the endpoint with `/version`.
+
+### Choosing a release channel
+
+When [configuring the updater](#configuring-the-teleport-upgrade-tool), you can
+select a release channel.
+
+The following channels are available for APT, YUM, and Zypper repos:
+
+| Channel name      | Description                                                                                |
+|-------------------|--------------------------------------------------------------------------------------------|
+| `stable/<major>`  | Receives releases for the specified major release line, i.e. `v(=teleport.major_version=)` |
+| `stable/cloud`    | Rolling channel that receives releases compatible with current Cloud version               |
+| `stable/rolling`  | Rolling channel that receives all published Teleport releases                              |
+
+### Updating the updater
+
+The updater is designed to be minimal and relatively stable, but the updater will
+receive updates on occasion. Currently, the updater does not have the capability
+to update itself. Updates to the `teleport-ent-updater` package must be done manually.
+
+The `teleport-ent-updater` will be backwards compatible with older versions of Teleport,
+so you can always update the `teleport-ent-updater` package to the latest available
+version.
+
+### Version locking
+
+As of Teleport `15.1.10`, a version locking mechanism is enabled by the updater.
+This mechanism locks the version of Teleport and prevents manual updates of the Teleport
+package. This prevents unintentional updates during routine system maintenance, or
+an accidental update by a user. The updater still has the capability to update the
+Teleport package, and all updates of Teleport are expected to be performed by the
+updater.
+
+The version locking mechanism is implemented using the features of the package managers.
+In case a user would like to manually update the Teleport version, this can be done
+with the following commands.
+
+With the `apt` package manager CLI, the `--allow-change-held-packages` flag must be provided
+to bypass the version lock.
+```code
+$ apt-get install --allow-change-held-packages "teleport-ent=<target-version>"
+```
+
+With the `yum` package manager CLI, the `--disableexcludes="teleport"` flag must be provided
+to bypass the version lock.
+```code
+$ yum install --disablerepo="*" --enablerepo="teleport" --disableexcludes="teleport" "teleport-ent-<target-version>"
+```
+
+With the `zypper` package manager CLI, the lock must be disabled and then re-enabled
+after the update.
+```code
+$ zypper removelock "teleport-ent"
+$ zypper install --repo="teleport" "teleport-ent-<target-version>"
+$ zypper addlock "teleport-ent"
+```
diff --git a/docs/pages/upgrading/agent-managed-updates.mdx b/docs/pages/upgrading/agent-managed-updates.mdx
deleted file mode 100644
index 7ba2ddba74f75..0000000000000
--- a/docs/pages/upgrading/agent-managed-updates.mdx
+++ /dev/null
@@ -1,561 +0,0 @@
----
-title: Managed Updates (v2) for Teleport Agents
-description: Describes how to set up Managed Updates (v2) for Teleport Agents
----
-
-<Admonition type="warning">
-This document describes Managed Updates for Agents (v2), which is gradually being rolled out to Cloud.
-
-For Managed Updates v1 instructions, see
-[Managed Updates for Agents (v1)](./agent-managed-updates-v1.mdx).
-</Admonition>
-
-In Managed Updates v2, a binary called `teleport-update` is distributed in
-all Teleport packages, alongside the `teleport` binary. Admins configure updates
-by managing the `autoupdate_version` and `autoupdate_config` dynamic resources.
-
-This document covers how to use `teleport-update` and the `autoupdate_*`
-resources to manage your agent updates from Teleport. It describes:
-- [The agent architecture](#how-it-works)
-- [How to enroll existing agents](#quick-setup-for-existing-connected-linux-servers)
-- [How to enroll new agents](#quick-setup-for-new-linux-servers)
-- [How to configure Managed Updates v2](#configuring-managed-agent-updates) (
-  [when updates happen](#configuring-the-schedule) and for self-hosted users,
-  [which version to update to](#setting-the-version-self-hosted-only))
-- [How to migrate to Managed Updates v2](#migrating-agents-on-linux-servers-to-managed-updates)
-
-`teleport-update` supports:
-- Both Teleport Enterprise and Teleport Community Edition
-- Both cloud and self-hosted Teleport Enterprise deployments
-- Regular and FIPS variants of Teleport
-- amd64 and arm64 CPU architectures
-- systemd-based operating systems, regardless of the package manager used
-
-<Admonition type="note" title="Compatibility between Managed Updates v1 and v2">
-The Managed Updates v2 `teleport-update` binary is backwards-compatible with the
-`cluster_maintenance_config` resource. The Managed Updates v1 `teleport-upgrade` script
-is forwards-compatible with the `autoupdate_config` and `autoupdate_version` resources.
-Agents connected to the same cluster will all update to the same version.
-
-If the `autoupdate_config` resource is configured, it takes precedence over
-`cluster_maintenance_config`. This allows for a safe, non-breaking, incremental
-migration between Managed Updates v1 and v2. If `autoupdate_config` is not present
-and `autoupdate_version` is present, the `autoupdate_config` settings are implicitly
-derived from `cluster_maintenance_config`.
-
-Users of cloud-hosted Teleport Enterprise will be migrated to Managed Updates v2
-in the first half of 2025 and should plan to migrate their agents to `teleport-update`.
-</Admonition>
-
-## How it works
-
-When Managed Updates are enabled, a Teleport updater is installed alongside
-each new Teleport Agent. The updater communicates with the Teleport Proxy Service to
-determine when an update is available and if it should perform the update now.
-
-Each agent belongs to an update group. The update schedule specifies when each
-group is updated. The schedule is stored in the `autoupdate_config` resource and
-can be edited via `tctl`.
-
-For Linux server-based installations, `teleport-update` command configures
-Managed Updates locally on the server.
-
-For Kubernetes-based installations, the `teleport-kube-agent` Helm chart
-deploys a controller that automatically updates the main Teleport container.
-
-Existing agents must be manually enrolled into Managed Updates.
-
-## Prerequisites
-
-- A Teleport cluster. If you do not have one, [sign
-  up](https://goteleport.com/signup) for a free trial or consult the
-  [Teleport Installation](../installation.mdx) page.
-- Familiarity with the [Upgrading Compatibility Overview](./overview.mdx) guide,
-  which describes the sequence in which to upgrade components in your cluster.
-- Teleport Agents that are not yet enrolled in Managed Updates.
-- (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
-- (!docs/pages/includes/tctl.mdx!)
-
-## Quick setup for existing connected Linux servers
-
-Users can enable Managed Updates v2 on Linux servers that are already running
-a Teleport Agent by running the following command on every server:
-
-```code
-$ sudo teleport-update enable
-```
-
-<Admonition type="note">
-If this command is not available, update the `teleport` package
-to the latest version that is supported by your cluster.
-</Admonition>
-
-The `teleport-update enable` command will disable (but not remove)
-the v1 updater if present. No other action is necessary.
-
-If everything is working, the v1 updater package can be removed:
-
-```code
-$ sudo apt remove teleport-ent-updater
-```
-
-If the v2 updater does not work, your installation can be reverted
-back to manual updates or the v1 updater (if it has not been removed):
-
-```code
-$ sudo teleport-update uninstall
-```
-
-If Teleport was installed via the apt or yum package,
-`teleport-update uninstall` will revert the running version of Teleport back to
-the version provided by the package.
-
-## Quick setup for new Linux servers
-
-The [Install Script](../installation.mdx#one-line-installation-script) is the
-fastest way to onboard new Linux servers. However, you may also use
-`teleport-update` by itself to set up a Teleport Agent manually.
-
-Users can create a new installation of Teleport using any version of the
-`teleport-update` binary. First, download copy of the Teleport tarball from
-the downloads page. Next, invoke `teleport-update` to install the correct version
-for your cluster.
-
-```code
-$ tar xf teleport-[version].tgz
-$ cd teleport-[version]
-$ sudo ./teleport-update enable --proxy example.teleport.sh
-```
-
-After Teleport is installed, you can create `/etc/teleport.yaml`, either manually
-or using `teleport configure`. After, the Teleport Agent can be enabled and
-started via the `systemctl` command:
-
-```code
-$ sudo systemctl enable teleport --now
-```
-
-## Configuring managed agent updates
-
-Managed agent updates are configured via two Teleport resources:
-- `autoupdate_config` controls the update schedule
-- `autoupdate_version` controls the desired version
-
-Self-hosted Teleport users must configure both `autoupdate_config` and
-`autoupdate_version`.
-
-Cloud-hosted Teleport Enterprise users can configure the `autoupdate_config`, while the
-`autoupdate_version` is managed by Teleport Cloud. Updates will roll out
-automatically during the first chosen maintenance window that is at least 36
-hours after the cluster version is updated.
-
-To configure Managed Updates in your cluster, you must have access to
-the `autoupdate_config` and `autoupdate_version` resources. By default,
-the `editor` role can modify both resources.
-
-### Configuring the schedule
-
-For both cloud-hosted and self-hosted editions of Teleport, an update schedule
-may be set with the `autoupdate_config` resource. The default resource looks
-like this:
-
-```yaml
-kind: autoupdate_config
-metadata:
-  name: autoupdate-config
-spec:
-  agents:
-    mode: enabled
-    strategy: halt-on-error
-    schedules:
-      regular:
-        - name: default
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-          # start_hour is in UTC
-          start_hour: 16
-```
-
-For example, a Teleport user with staging and production
-environments might create a custom schedule that looks like this:
-
-```yaml
-kind: autoupdate_config
-metadata:
-  name: autoupdate-config
-spec:
-  agents:
-    mode: enabled
-    strategy: halt-on-error
-    schedules:
-      regular:
-        - name: staging
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-          start_hour: 4
-        - name: production
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-          start_hour: 5
-          wait_hours: 24
-```
-
-This schedule would update agents in the `staging` group at 4 UTC, and then update
-the `production` group at 5 UTC the next day. The `production` group will not execute
-update until the staging group has updated. The `wait_hours` field sets a minimum
-duration between groups, ensuring that `production` happens the day after `staging`,
-and not one hour after.
-
-<Admonition type="warning">
-While failed installations will revert automatically on the client-side,
-server-side healthchecks are still in development. To prevent the `production`
-group above from updating after `staging` has failed, you must manually suspend
-the schedule by setting the `spec.agents.mode` to `suspended`.
-</Admonition>
-
-You may wish to schedule groups of agents to update without any dependence between
-them. For example, groups may represent geographic areas and not environments.
-To accomplish this, you can change the default `halt-on-error` strategy to the
-`time-based` strategy:
-
-```yaml
-kind: autoupdate_config
-metadata:
-  name: autoupdate-config
-spec:
-  agents:
-    strategy: time-based
-    maintenance_window_duration: 1h
-    schedules:
-      regular:
-        - name: nyc
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-          start_hour: 4
-        - name: sj
-          days: [ "Mon", "Tue", "Wed", "Thu" ]
-          start_hour: 20
-```
-
-With this strategy, updates to `sj` may occur before `nyc`, depending on when
-new versions become available. The `maintenance_window_duration` restricts
-updates to the specified duration after the `start_hour`. This ensures that
-disruptions do not occur outside a known window.
-
-The time-based strategy does not support the `wait_days` option.
-
-To add agents to groups, run `teleport-update enable --group group-name`.
-You may execute `teleport-update enable` repeatedly to change the group
-(or other Managed Update settings).
-
-If no agent update group is configured, or if the group name does not match a
-group defined in `autoupdate_config`, the agent will be part of the last
-`autoupdate_config` group.
-
-Except for `autoupdate_config.agents.mode`, changes to `autoupdate_config` fields
-take effect during the next version rollout. A new rollout happens when
-`autoupdate_version` is changed and targets a new version.
-Version is automatically updated for Cloud-hosted Teleport clusters; for
-self-hosted ones you have to update the version manually, see
-[the dedicated guide section](#setting-the-version-self-hosted-only).
-
-<Admonition type="info" title="Cloud-hosting schedule constraints">
-For cloud-hosted Teleport Enterprise, the `days` are not configurable for most
-customers, and the `start_hour` is defaulted to your selected maintenance window.
-
-Cloud-hosted Teleport clusters also have a maximum of 5 update groups by default,
-and a full update schedule must not be longer than 4 days. Those limitations
-ensure that all your agents are updated weekly and that they stay
-compatible with the Teleport cluster's version.
-</Admonition>
-
-### Setting the version (self-hosted only)
-
-For cloud-hosted Teleport Enterprise, Managed Updates are enabled by default.
-The `autoupdate_version` resource is managed for you and cannot be edited.
-This ensures your agents are always up-to-date and running the best version
-for your Teleport cluster.
-
-Self-hosted Teleport users must specify which version their agents should update
-to via the `autoupdate_version` resource.
-
-Create a file called `autoupdate_version.yaml` containing:
-
-```yaml
-kind: autoupdate_version
-metadata:
-  name: autoupdate-version
-spec:
-  agents:
-    start_version: 17.2.0
-    target_version: 17.2.1
-    schedule: regular
-    mode: enabled
-```
-
-This resource is used to deploy new versions of Teleport to your agents.
-The cluster will update agents from `start_version` to `target_version`
-according to the update schedule specified in the `autoupdate_config`.
-
-The `schedule` may be changed from `regular` to `immediate` to force all
-agents to update to the `target_version` immediately.
-
-The `mode` is used to enable, disable, or suspend Managed Updates.
-The `mode` may be set in both `autoupdate_version` or `autoupdate_config`,
-such that `disabled` overrides `suspended`, which overrides `enabled` on either
-side. The `mode` being specified in two places is useful when
-`autoupdate_version` and `autoupdate_config` are not managed by the same team.
-
-Run the following command to create or update the resource:
-
-```code
-$ tctl create autoupdate_version.yaml
-```
-
-Changes to `autoupdate_version` can take up to a minute to create a new rollout.
-You can observe the current rollout state with the command:
-
-```code
-$ tctl autoupdate agents status
-Agent autoupdate mode: enabled
-Rollout creation date: 2025-03-10 15:01:45
-Start version: 1.2.3
-Target version: 1.2.4
-Rollout state: Active
-Strategy: halt-on-error
-
-Group Name State     Start Time          State Reason
----------- --------- ------------------- ------------------------
-dev        Active    2025-03-11 12:00:10 can_start
-stage      Unstarted                     previous_groups_not_done
-prod       Unstarted                     previous_groups_not_done
-```
-
-## Migrating agents on Linux servers to Managed Updates
-
-### Finding unmanaged agents
-
-Use the `tctl inventory ls` command to list connected agents along with their current
-version. Use the `--upgrader=none` flag to list agents that are not enrolled in managed
-updates.
-
-```code
-$ tctl inventory ls --upgrader=none
-Server ID                            Hostname      Services Version Upgrader
------------------------------------- ------------- -------- ------- --------
-00000000-0000-0000-0000-000000000000 ip-10-1-6-130 Node     v14.4.5 none
-...
-```
-
-Use the `--upgrader=unit` flag to list agents that are using Managed Updates v1
-and should be updated to Managed Updates v2:
-
-```code
-$ tctl inventory ls --upgrader=unit
-Server ID                            Hostname      Services Version Upgrader
------------------------------------- ------------- -------- ------- --------
-00000000-0000-0000-0000-000000000000 ip-10-1-6-131 Node     v14.4.5 unit
-...
-```
-
-Agents enrolled into Managed Updates v2 can be queried with the
-`--upgrader=binary` flag.
-
-### Enrolling unmanaged agents
-
-1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
-   and run the following `tctl` command to access the host via `tsh`:
-
-   ```code
-   $ HOST=00000000-0000-0000-0000-000000000000
-   $ USER=root
-   $ tsh ssh "${USER?}@${HOST?}"
-   ```
-
-1. Run `teleport-update enable` on each agent you would like
-   to enroll into Managed Updates v2:
-
-   ```code
-   $ sudo teleport-update enable
-   ```
-
-1. Confirm that the version of the `teleport` binary is the one you expect:
-
-   ```code
-   $ teleport version
-   ```
-
-1. Remove the Managed Updates v1 updater if present:
-
-   <Tabs>
-   <TabItem label="DEB">
-
-   ```code
-   $ sudo apt remove teleport-ent-updater
-   ```
-
-   </TabItem>
-   <TabItem label="RPM">
-
-   ```code
-   $ sudo yum remove teleport-ent-updater
-   ```
-
-   </TabItem>
-   </Tabs>
-
-<details>
-<summary>Running the agent as a non-root user</summary>
-
-If you changed the agent user to run as non-root, create
-`/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user:
-
-```code
-$ sudo mkdir -p /etc/teleport-upgrade.d/
-$ sudo touch /etc/teleport-upgrade.d/schedule
-$ sudo chown your-teleport-user /etc/teleport-upgrade.d/schedule
-```
-
-While `teleport-update` does not read this file, `teleport` will warn if it
-cannot disable the Managed Update v1 updater using this file.
-
-</details>
-
-## Enroll Kubernetes agents in Managed Updates
-
-This section assumes that the name of your `teleport-kube-agent` release is
-`teleport-agent`, and that you have installed it in the `teleport` namespace.
-
-1. Add the following chart values to the values file for the
-   `teleport-kube-agent` chart:
-
-   ```yaml
-   updater:
-     enabled: true
-   ```
-
-1. Update the Teleport Helm repository to include any new versions of the
-   `teleport-kube-agent` chart:
-
-   ```code
-   $ helm repo update teleport
-   ```
-
-1. Update the Helm chart release with the new values:
-
-   <Tabs>
-   <TabItem label="Cloud-Hosted">
-
-   ```code
-   $ helm -n <Var name="teleport" />  upgrade <Var name="teleport-agent" /> teleport/teleport-kube-agent \
-   --values=values.yaml \
-   --version="(=cloud.version=)"
-   ```
-   </TabItem>
-   <TabItem label="Self-Hosted">
-
-   ```code
-   $ helm -n <Var name="teleport" />  upgrade <Var name="teleport-agent" /> teleport/teleport-kube-agent \
-   --values=values.yaml \
-   --version="(=teleport.version=)"
-   ```
-   </TabItem>
-   </Tabs>
-
-1. You can validate the updater is running properly by checking if its pod is
-   ready:
-
-   ```code
-   $ kubectl -n teleport-agent get pods
-   NAME                               READY   STATUS    RESTARTS   AGE
-   <your-agent-release>-0                         1/1     Running   0          14m
-   <your-agent-release>-1                         1/1     Running   0          14m
-   <your-agent-release>-2                         1/1     Running   0          14m
-   <your-agent-release>-updater-d9f97f5dd-v57g9   1/1     Running   0          16m
-   ```
-
-1. Check for any deployment issues by checking the updater logs:
-
-   ```code
-   $ kubectl -n <Var name="teleport" /> logs deployment/<Var name="teleport-agent" />-updater
-   2023-04-28T13:13:30Z	INFO	StatefulSet is already up-to-date, not updating.	{"controller": "statefulset", "controllerGroup": "apps", "controllerKind": "StatefulSet", "StatefulSet": {"name":"my-agent","namespace":"agent"}, "namespace": "agent", "name": "my-agent", "reconcileID": "10419f20-a4c9-45d4-a16f-406866b7fc05", "namespacedname": "agent/my-agent", "kind": "StatefulSet", "err": "no new version (current: \"v12.2.3\", next: \"v12.2.3\")"}
-   ```
-
-## Troubleshooting
-
-You can inspect the current agent autoupdate status by running:
-```code
-$ tctl autoupdate agents status
-
-Agent autoupdate mode: enabled
-Rollout creation date: 2025-02-24 16:01:44
-Start version: 17.2.0
-Target version: 17.2.1
-Rollout state: Unstarted
-Strategy: time-based
-
-Group Name State     Start Time State Reason
----------- --------- ---------- --------------
-default    Unstarted            outside_window
-```
-
-This rollout state is computed by each Auth Service instance every minute. An `autoupdate_config` or `autoupdate_version`
-change might take up to a minute to be reflected and applied.
-
-Teleport Agents are not updated immediately when a new version of Teleport is
-released, and agent updates can lag behind the cluster by a few days.
-
-If the Teleport Agent has not been automatically updating for several weeks, you
-can consult the updater logs to help troubleshoot the problem:
-
-### Troubleshooting managed agent upgrades on Kubernetes
-
-The updater is a controller that periodically reconciles expected Kubernetes
-resources with those in the cluster. The updater executes a reconciliation loop
-every 30 minutes or in response to a Kubernetes event. If you don't want to wait
-until the next reconciliation, you can trigger an event.
-
-1. Any deployment update will send an event, so you can trigger the upgrader by
-   annotating the resource:
-
-   ```code
-   $ kubectl -n <Var name="teleport" /> annotate statefulset/<Var name="teleport-agent" /> 'debug.teleport.dev/trigger-event=1'
-   ```
-
-1. To suspend Managed Updates for an agent, annotate the agent deployment
-   with `teleport.dev/skipreconcile: "true"`, either by setting the
-   `annotations.deployment` value in Helm, or by patching the deployment
-   directly with `kubectl`.
-
-### Troubleshooting managed agent upgrades on Linux
-
-1. You can query the updater status by running:
-
-   ```code
-   $ teleport-update status
-   proxy: teleport.example.com:443
-   path: /usr/local/bin
-   base_url: https://cdn.teleport.dev
-   enabled: true
-   pinned: false
-   active:
-       version: 17.2.0
-       flags: [Enterprise]
-   target:
-       version: 17.2.1
-       flags: [Enterprise]
-   in_window: false
-   jitter: 1m0s
-   ```
-
-   Here, the local active version is 17.2.0. The cluster's target version is
-   17.2.1, but we are not in an update window, so the agent is not immediately
-   updated.
-
-```code
-$ journalctl -u teleport-update
-```
-
-1. If an agent is not automatically updated, you can invoke the updater
-   manually and look at its logs:
-
-   ```code
-   $ sudo teleport-update update --now
-   ```
-
diff --git a/docs/pages/upgrading/agent-managed-updates/agent-managed-updates.mdx b/docs/pages/upgrading/agent-managed-updates/agent-managed-updates.mdx
new file mode 100644
index 0000000000000..fff047929fe83
--- /dev/null
+++ b/docs/pages/upgrading/agent-managed-updates/agent-managed-updates.mdx
@@ -0,0 +1,764 @@
+---
+title: Managed Updates for Teleport Agents and Bots
+description: Describes how to set up Managed Updates for Teleport Agents and Bots
+tags:
+  - conceptual
+  - platform-wide
+---
+
+<Admonition type="warning">
+This document describes Managed Updates for Agents and Bots (v2),
+which replaces Managed Updates for Agents (v1).
+
+For Managed Updates v1 instructions, see
+[Managed Updates for Agents (v1)](../agent-managed-updates-v1.mdx).
+</Admonition>
+
+For Managed Updates, a binary called `teleport-update` is distributed in
+all Teleport packages, alongside the `teleport`, `tbot`, and other binaries.
+Admins configure updates by managing the `autoupdate_version` and
+`autoupdate_config` dynamic resources.
+
+This document covers how to use `teleport-update` and the `autoupdate_*`
+resources to manage automated agent and bot updates from Teleport. It describes:
+
+- [The agent architecture](#how-it-works)
+- [How to enroll existing agents](#quick-setup-for-existing-linux-agent-and-bot-installations)
+- [How to enroll new agents](#quick-setup-for-new-linux-agents-and-bot-installations)
+- [How to configure Managed Updates v2](#configuring-managed-agent-and-tbot-updates) (
+  [when updates happen](#configuring-the-schedule) and for self-hosted users,
+  [which version to update to](#setting-the-version-self-hosted-only))
+- [How to migrate to Managed Updates v2](#migrating-agents-on-linux-servers-to-managed-updates)
+
+`teleport-update` supports:
+
+- Teleport Enterprise and Teleport Community Edition
+- Both cloud and self-hosted Teleport Enterprise deployments
+- Regular and FIPS variants of Teleport
+- amd64, arm64, and other supported CPU architectures
+- systemd-based operating systems, regardless of the package manager used
+
+<Admonition type="note" title="Compatibility between Managed Updates v1 and v2">
+The Managed Updates v2 `teleport-update` binary is backwards-compatible with the
+`cluster_maintenance_config` resource. The Managed Updates v1 `teleport-upgrade` script
+is forwards-compatible with the `autoupdate_config` and `autoupdate_version` resources.
+Agents connected to the same cluster will all update to the same version.
+
+If the `autoupdate_config` resource is configured, it takes precedence over
+`cluster_maintenance_config`. This allows for a safe, non-breaking, incremental
+migration between Managed Updates v1 and v2. If `autoupdate_config` is not present
+and `autoupdate_version` is present, the `autoupdate_config` settings are implicitly
+derived from `cluster_maintenance_config`.
+
+Regardless of how the cluster is configured, `teleport-update` is capable of managing
+both Teleport Agent and tbot installations, while `teleport-upgrade` is only capable
+of managing Teleport Agents.
+
+Users of cloud-hosted Teleport Enterprise have been migrated to Managed Updates v2
+and should migrate their agents to `teleport-update` as soon as possible.
+</Admonition>
+
+## How it works
+
+Managed Updates for Agents and Bots are designed to manage long-running, unattended Teleport
+clients, such as Teleport Agents and tbot. This is different from Managed Updates for
+Client Tools, which are designed to manage interactive Teleport clients, such as `tsh` and `tctl`.
+
+When Managed Updates are enabled, a Teleport updater is installed alongside
+each new Teleport Agent or tbot. The updater communicates with the Teleport Proxy
+Service to determine when an update is available and if it should perform the update now.
+
+Each installation belongs to an update group. The update schedule specifies when each
+group is updated. The schedule is stored in the `autoupdate_config` resource and
+can be edited via `tctl`. The `tctl autoupdate agents` subcommands are used to interact
+with the rollout for both Teleport Agents and long-running tbot installations.
+
+For Linux server-based installations, `teleport-update` command configures
+Managed Updates for Teleport Agents and tbot locally on the server.
+
+For Kubernetes-based installations, the `teleport-kube-agent` Helm chart
+deploys a controller that automatically updates the main Teleport container.
+
+Agents and bots that were installed before Managed Updates was enabled on the
+cluster usually need to be manually enrolled into Managed Updates.
+
+## Prerequisites
+
+- Familiarity with the [Upgrading Compatibility Overview](../overview.mdx) guide,
+  which describes the sequence in which to upgrade components in your cluster.
+- Teleport Agent or tbot installations that are not yet enrolled in Managed Updates.
+- (!docs/pages/includes/edition-prereqs-tabs.mdx!)
+- (!docs/pages/includes/tctl.mdx!)
+
+## Quick setup for existing Linux Agent and Bot installations
+
+Users can enable Managed Updates v2 on Linux servers that are already running
+a Teleport Agent by running the following command on every server:
+
+```code
+$ sudo teleport-update enable
+```
+
+<Admonition type="note">
+If this command is not available, update the `teleport` package
+to the latest version that is supported by your cluster.
+</Admonition>
+
+The `teleport-update enable` command will disable (but not remove)
+the v1 updater if present. No other action is necessary.
+
+If everything is working, the v1 updater package can be removed:
+
+```code
+$ sudo apt remove teleport-ent-updater
+```
+
+If the v2 updater does not work, your installation can be reverted
+back to manual updates or the v1 updater (if it has not been removed):
+
+```code
+$ sudo teleport-update uninstall
+```
+
+If Teleport was installed via the apt or yum package,
+`teleport-update uninstall` will revert the running version of Teleport back to
+the version provided by the package.
+
+### Migrating Bots
+
+Existing tbot installations require additional steps to be converted to Managed Updates.
+
+When `teleport-update enable` is run, a disabled systemd service is created at `/etc/systemd/system/tbot.service`
+if a service does not already exist at that location.
+
+If a custom tbot systemd service is already installed at `/etc/systemd/system/tbot.service`,
+a warning will be displayed when `teleport-update enable` is run. To overwrite that custom service
+and replace it with an updater-managed service, run the following command:
+
+```code
+$ sudo teleport-update enable --overwrite
+```
+
+If a custom tbot systemd service is installed with a different name (e.g., `/etc/systemd/system/machineid.service`),
+it must be stopped if it shares the same configuration and data directories as the updater-managed service:
+
+```code
+$ sudo systemctl disable machineid --now
+```
+
+After `teleport-update enable` has successfully created the service, its output will recommend that you run
+the following command to enable `tbot.service`:
+
+```code
+$ sudo systemctl enable tbot --now
+```
+
+Note that you must have a valid `/etc/tbot.yaml` file to use tbot.
+See [Deploying tbot on Linux](../../machine-workload-identity/deployment/linux.mdx) for more information.
+
+## Quick setup for new Linux Agents and Bot installations
+
+The [Web UI onboarding and Install Script](../../installation/linux.mdx) are the
+fastest ways to onboard new Linux servers. However, you may also use
+`teleport-update` by itself to set up a Teleport Agent and/or tbot manually.
+Note that web-based agent enrollment does not automatically configure tbot.
+See the end of this section for information on how to configure and enable tbot.
+
+Users can create a new installation of Teleport using any version of the
+`teleport-update` binary. First, download copy of the `teleport-update` tarball from
+the [Agent Installer & Updater section](https://goteleport.com/download/all-downloads/?kind=agentInstaller&os=linux) of
+the downloads page.
+Next, invoke `teleport-update` to install the correct version for your cluster.
+
+```code
+$ tar xf teleport-update-[version].tgz
+$ cd teleport-update-[version]
+$ sudo ./teleport-update enable --proxy example.teleport.sh
+```
+
+After Teleport is installed, you can create `/etc/teleport.yaml`, either manually
+or using `teleport configure`. After, the Teleport Agent can be enabled and
+started via the `systemctl` command:
+
+```code
+$ sudo systemctl enable teleport --now
+```
+
+Similarly, you can create an `/etc/tbot.yaml` file, either manually or using `tbot configure`.
+See [Deploying tbot on Linux](../../machine-workload-identity/deployment/linux.mdx) for more information.
+
+After, tbot can be enabled and started via the `systemctl` command:
+
+```code
+$ sudo systemctl enable tbot --now
+```
+
+## Configuring managed agent and tbot updates
+
+Managed agent and bot updates are configured via two Teleport resources:
+
+- `autoupdate_config` controls the update schedule
+- `autoupdate_version` controls the desired version
+
+Self-hosted Teleport users must configure both `autoupdate_config` and
+`autoupdate_version`.
+
+Cloud-hosted Teleport Enterprise users can configure the `autoupdate_config`, while the
+`autoupdate_version` is managed by Teleport Cloud. Updates will roll out
+automatically during the first chosen maintenance window that is at least 36
+hours after the cluster version is updated.
+
+To configure Managed Updates in your cluster, you must have access to
+the `autoupdate_config` and `autoupdate_version` resources. By default,
+the `editor` role can modify both resources.
+
+### Configuring the schedule
+
+For both cloud-hosted and self-hosted editions of Teleport, an update schedule
+may be set with the `autoupdate_config` resource. The default resource looks
+like this:
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+    schedules:
+      regular:
+        - name: default
+          days: [ "Mon", "Tue", "Wed", "Thu" ]
+          # start_hour is in UTC
+          start_hour: 16
+```
+
+This example configures a single group named "default" for all agents.
+All agents will be placed in this group, as agents with missing
+or unknown groups are always placed in the last listed group.
+Currently, only the "regular" schedule is user-configurable.
+
+For example, a Teleport user with staging and production
+environments might create a custom schedule that looks like this:
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+    schedules:
+      regular:
+        - name: staging
+          days: [ "Mon", "Tue", "Wed", "Thu" ]
+          start_hour: 4
+        - name: production
+          days: [ "Mon", "Tue", "Wed", "Thu" ]
+          start_hour: 5
+          wait_hours: 24
+```
+
+This schedule would update agents and bots in the `staging` group at 4 UTC, and then update
+the `production` group at 5 UTC the next day. The `production` group will not execute
+update until the staging group has updated. The `wait_hours` field sets a minimum
+duration between groups, ensuring that `production` happens the day after `staging`,
+and not one hour after.
+
+Two update rollout strategies are available:
+
+- The `halt-on-error` strategy provides predictable, sequential updates
+  across environments. It's ideal for traditional development pipelines where
+  you want to ensure that development environments are successfully updated
+  before proceeding to staging and production.
+- The `time-based` strategy is designed for environments where update groups
+  are independent of each other, such as geographical regions or different teams.
+  It allows updates to occur whenever the specified maintenance window is active
+  for a group, regardless of the status of other groups. This strategy does not
+  provide ordering guarantees across groups.
+
+With the `halt-on-error` strategy, the `canary_count` field can be set on each group to specify
+a number of randomly selected agents (fewer than five) to update and verify before
+proceeding to the rest of the agents in the group. This can be used to reduce the impact
+of a failed update that might not be caught by earlier groups due to environment differences.
+
+You can find more information
+in [the Managed Updates v2 resource reference](../../reference/deployment/managed-updates-v2.mdx)
+
+Except for `autoupdate_config.agents.mode`, changes to `autoupdate_config` fields
+take effect during the next version rollout. A new rollout happens when
+`autoupdate_version` is changed and targets a new version.
+Version is automatically updated for Cloud-hosted Teleport clusters; for
+self-hosted ones you have to update the version manually, see
+[the dedicated guide section](#setting-the-version-self-hosted-only).
+
+### Setting the version (self-hosted only)
+
+For cloud-hosted Teleport Enterprise, Managed Updates are enabled by default.
+The `autoupdate_version` resource is managed for you and cannot be edited.
+This ensures your agents are always up-to-date and running the best version
+for your Teleport cluster.
+
+<Admonition type="important">
+Self-hosted Teleport users must specify which version their agents and bots should
+update to via the `autoupdate_version` resource.
+If the resource does not exist, agents and bots will not update.
+</Admonition>
+
+Create a file called `autoupdate_version.yaml` containing:
+
+```yaml
+kind: autoupdate_version
+metadata:
+  name: autoupdate-version
+spec:
+  agents:
+    start_version: 17.2.0
+    target_version: 17.2.1
+    schedule: regular
+    mode: enabled
+```
+
+This resource is used to deploy new versions of Teleport to your agents and bots.
+The cluster will update agents and bots to `target_version` according to the update
+schedule specified in the `autoupdate_config`.
+
+The `start_version` is only used to determine the version used for newly
+connected agents and bots when their update window has not occurred yet.
+This is useful to prevent version drift within groups, but some users may
+prefer to set both version fields to the same version.
+
+Run the following command to create or update the resource:
+
+```code
+$ tctl create -f autoupdate_version.yaml
+```
+
+Changes to `autoupdate_version` can take up to a minute to create a new rollout.
+You can observe the current rollout state with the command:
+
+```code
+$ tctl autoupdate agents status
+Agent autoupdate mode: enabled
+Rollout creation date: 2025-03-10 15:01:45
+Start version: 1.2.3
+Target version: 1.2.4
+Rollout state: Active
+Strategy: halt-on-error
+
+Group Name State     Start Time          State Reason
+---------- --------- ------------------- ------------------------
+dev        Active    2025-03-11 12:00:10 can_start
+stage      Unstarted                     previous_groups_not_done
+prod       Unstarted                     previous_groups_not_done
+```
+
+### Monitoring tbot updates
+
+Unlike the Teleport Agent, tbot does not have a persistent connection to the cluster and cannot be monitored directly
+during upgrades.
+
+However, tbot installation failures are still tracked if tbot is installed alongside a running Teleport Agent.
+
+If a tbot upgrade fails and tbot is installed alongside an agent, both tbot and the agent will be rolled back to the
+previous version, and the update group may be marked as failed.
+If tbot is installed without an agent, tbot will still be rolled back to the previous version, but the upgrade may still
+progress to further groups.
+
+Similarly, tbot installations are only considered candidates for canary installations if they are deployed alongside a
+running Teleport Agent.
+
+## Managing Rollouts
+
+Managed Update groups are automatically progressed as configured by the `autoupdate_config` resource.
+However, it is possible to manually trigger or rollback updates for a selection of groups using `tctl autoupdate agents` commands:
+
+```code
+Commands:
+  autoupdate agents status       Prints agents auto update status.
+  autoupdate agents report       Aggregates the agent autoupdate reports and displays agent count per version and per update group.
+  autoupdate agents start-update Starts updating one or many groups.
+  autoupdate agents mark-done    Marks one or many groups as done updating.
+  autoupdate agents rollback     Rolls back one or many groups.
+```
+
+For example, if an earlier group cannot be started, the other groups can be triggered manually:
+```code
+$ tctl autoupdate agents start-update stage prod
+Started updating agents groups: [stage prod].
+New agent rollout status:
+
+Group Name State     Start Time          State Reason
+---------- --------- ------------------- --------------
+dev        Unstarted                     cannot_start
+stage      Active    2025-03-10 15:04:16 manual_trigger
+prod       Active    2025-03-10 15:04:16 manual_trigger
+```
+
+While individual agents will automatically and immediately rollback if they fail health checks during the update,
+regressions or breaking changes in new versions could make it desirable to rollback an agent update to an earlier version.
+The `tctl autoupdate agents rollback` command can be used to rollback one or more groups to the cluster's `start_version`.
+Rollbacks are immediate and do not wait for canaries to complete.
+
+## Migrating agents on Linux servers to Managed Updates
+
+### Finding unmanaged agents
+
+Use the `tctl inventory ls` command to list connected agents along with their current
+version. Use the `--upgrader=none` flag to list agents that are not enrolled in managed
+updates.
+
+```code
+$ tctl inventory ls --upgrader=none
+Server ID                            Hostname      Services Version Upgrader
+------------------------------------ ------------- -------- ------- --------
+00000000-0000-0000-0000-000000000000 ip-10-1-6-130 Node     v14.4.5 none
+...
+```
+
+Use the `--upgrader=unit` flag to list agents that are using Managed Updates v1
+and should be updated to Managed Updates v2:
+
+```code
+$ tctl inventory ls --upgrader=unit
+Server ID                            Hostname      Services Version Upgrader
+------------------------------------ ------------- -------- ------- --------
+00000000-0000-0000-0000-000000000000 ip-10-1-6-131 Node     v14.4.5 unit
+...
+```
+
+Agents enrolled into Managed Updates v2 can be queried with the
+`--upgrader=binary` flag.
+
+Note that it may take several minutes for newly upgraded agents to be reflected
+in the inventory output.
+
+### Enrolling unmanaged agents
+
+1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
+   and run the following `tctl` command to access the host via `tsh`:
+
+   ```code
+   $ HOST=00000000-0000-0000-0000-000000000000
+   $ USER=root
+   $ tsh ssh "${USER?}@${HOST?}"
+   ```
+
+1. Run `teleport-update enable` on each agent you would like
+   to enroll into Managed Updates v2:
+
+   ```code
+   $ sudo teleport-update enable
+   ```
+
+1. Confirm that the version of the `teleport` binary is the one you expect:
+
+   ```code
+   $ teleport version
+   ```
+
+1. Remove the Managed Updates v1 updater if present:
+
+   <Tabs>
+   <TabItem label="DEB">
+
+   ```code
+   $ sudo apt remove teleport-ent-updater
+   ```
+
+   </TabItem>
+   <TabItem label="RPM">
+
+   ```code
+   $ sudo yum remove teleport-ent-updater
+   ```
+
+   </TabItem>
+   </Tabs>
+
+<details>
+<summary>Running the agent as a non-root user</summary>
+
+If you changed the agent user to run as non-root, create
+`/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user:
+
+```code
+$ sudo mkdir -p /etc/teleport-upgrade.d/
+$ sudo touch /etc/teleport-upgrade.d/schedule
+$ sudo chown your-teleport-user /etc/teleport-upgrade.d/schedule
+```
+
+While `teleport-update` does not read this file, `teleport` will warn if it
+cannot disable the Managed Update v1 updater using this file.
+
+</details>
+
+## Enroll Kubernetes agents in Managed Updates
+
+This section assumes that the name of your `teleport-kube-agent` release is
+`teleport-agent`, and that you have installed it in the `teleport` namespace.
+
+1. Add the following chart values to the values file for the
+   `teleport-kube-agent` chart:
+
+   ```yaml
+   updater:
+     enabled: true
+   ```
+
+1. Update the Teleport Helm repository to include any new versions of the
+   `teleport-kube-agent` chart:
+
+   ```code
+   $ helm repo update teleport
+   ```
+
+1. Update the Helm chart release with the new values:
+
+   <Tabs>
+   <TabItem label="Cloud-Hosted">
+
+   ```code
+   $ helm -n <Var name="teleport" />  upgrade <Var name="teleport-agent" /> teleport/teleport-kube-agent \
+   --values=values.yaml \
+   --version="(=cloud.version=)"
+   ```
+   </TabItem>
+   <TabItem label="Self-Hosted">
+
+   ```code
+   $ helm -n <Var name="teleport" />  upgrade <Var name="teleport-agent" /> teleport/teleport-kube-agent \
+   --values=values.yaml \
+   --version="(=teleport.version=)"
+   ```
+   </TabItem>
+   </Tabs>
+
+1. You can validate the updater is running properly by checking if its pod is
+   ready:
+
+   ```code
+   $ kubectl -n teleport-agent get pods
+   NAME                               READY   STATUS    RESTARTS   AGE
+   <your-agent-release>-0                         1/1     Running   0          14m
+   <your-agent-release>-1                         1/1     Running   0          14m
+   <your-agent-release>-2                         1/1     Running   0          14m
+   <your-agent-release>-updater-d9f97f5dd-v57g9   1/1     Running   0          16m
+   ```
+
+1. Check for any deployment issues by checking the updater logs:
+
+   ```code
+   $ kubectl -n <Var name="teleport" /> logs deployment/<Var name="teleport-agent" />-updater
+   2023-04-28T13:13:30Z	INFO	StatefulSet is already up-to-date, not updating.	{"controller": "statefulset", "controllerGroup": "apps", "controllerKind": "StatefulSet", "StatefulSet": {"name":"my-agent","namespace":"agent"}, "namespace": "agent", "name": "my-agent", "reconcileID": "10419f20-a4c9-45d4-a16f-406866b7fc05", "namespacedname": "agent/my-agent", "kind": "StatefulSet", "err": "no new version (current: \"v12.2.3\", next: \"v12.2.3\")"}
+   ```
+
+## GitOps tools
+
+Managed updates for Kubernetes agents requires workarounds when used with GitOps tools for
+continuous deployment. The `teleport-kube-agent` Helm chart owns the version of the
+`teleport-agent` resource, so when the `teleport-agent-updater` modifies the
+image version of the `teleport-agent` resource, the GitOps tool will detect a
+drift or a diff in the `teleport-agent` resource.
+
+The sections below describe workarounds for various GitOps tools.
+
+### ArgoCD deployments
+
+After a managed update, ArgoCD reports the `teleport-agent` resource as `OutOfSync`.
+As a workaround to this problem use
+a [Diff Customization](https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#diffing-customization)
+to ignore the difference in image version. Here is an example deployment using the
+name `teleport-agent` and namespace `teleport`.
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: teleport-agent
+  namespace: teleport
+spec:
+  ignoreDifferences:
+    - group: apps
+      kind: StatefulSet
+      name: teleport-agent
+      namespace: teleport
+      jqPathExpressions:
+        - .spec.template.spec.containers[] | select(.name == "teleport").image
+...
+```
+
+### FluxCD deployments
+
+After a managed update, FluxCD reports a `DriftDetected` event. As a workaround
+to this problem modify the [drift detection](https://fluxcd.io/flux/components/helm/helmreleases/#drift-detection)
+configuration to ignore the difference in image version. Here is an example deployment
+using the name `teleport-agent` and namespace `teleport`.
+
+```yaml
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: teleport-agent
+  namespace: teleport
+spec:
+  driftDetection:
+    mode: enabled
+    ignore:
+      - paths: [ "/spec/template/spec/containers/0/image" ]
+        target:
+          kind: StatefulSet
+          name: teleport-agent
+          namespace: teleport
+...
+```
+
+## Troubleshooting
+
+You can inspect the current autoupdate status by running:
+
+```code
+$ tctl autoupdate agents status
+
+Agent autoupdate mode: enabled
+Rollout creation date: 2025-02-24 16:01:44
+Start version: 17.2.0
+Target version: 17.2.1
+Rollout state: Unstarted
+Strategy: time-based
+
+Group Name State     Start Time State Reason
+---------- --------- ---------- --------------
+default    Unstarted            outside_window
+```
+
+This rollout state is computed by each Auth Service instance every minute. An `autoupdate_config` or
+`autoupdate_version`
+change might take up to a minute to be reflected and applied.
+
+Teleport Agents are not updated immediately when a new version of Teleport is
+released, and agent updates can lag behind the cluster by a few days.
+
+If the Teleport Agent has not been automatically updating for several weeks, you
+can consult the updater logs as described above to help troubleshoot the problem.
+
+The `teleport-update status` command provides the best UX for determining how an
+agent is being instructed to update. However, if `teleport-update is not available,
+this information can also be queried directly from the Teleport cluster using `curl`:
+
+```code
+$ curl -s https://teleport.example.com/webapi/find | jq .auto_update
+{
+  ...
+  "agent_version": "18.2.7",         # version that the agent should update to (also used for new agents)
+  "agent_auto_update": false,        # true if in window and the agent should update now
+  "agent_update_jitter_seconds": 60  # jitter to reduce load on the cluster and CDN
+}
+```
+
+This may be tuned for a specific agent using the `group` and `update_id` params:
+```code
+$ curl -s https://teleport.example.com/webapi/find?group=staging&update_id=$(</tmp/teleport-update.id) | jq .auto_update
+{
+  ...
+  "agent_version": "18.2.8",
+  "agent_auto_update": true,
+  "agent_update_jitter_seconds": 60
+}
+```
+
+
+### Troubleshooting managed agent upgrades on Kubernetes
+
+The updater is a controller that periodically reconciles expected Kubernetes
+resources with those in the cluster. The updater executes a reconciliation loop
+every 30 minutes or in response to a Kubernetes event. If you don't want to wait
+until the next reconciliation, you can trigger an event.
+
+1. Any deployment update will send an event, so you can trigger the upgrader by
+   annotating the resource:
+
+   ```code
+   $ kubectl -n <Var name="teleport" /> annotate statefulset/<Var name="teleport-agent" /> 'debug.teleport.dev/trigger-event=1'
+   ```
+
+1. To suspend Managed Updates for an agent, annotate the agent deployment
+   with `teleport.dev/skipreconcile: "true"`, either by setting the
+   `annotations.deployment` value in Helm, or by patching the deployment
+   directly with `kubectl`.
+
+### Troubleshooting managed agent upgrades on Linux
+
+1. You can query the updater status by running:
+
+   ```code
+   $ teleport-update status
+   proxy: teleport.example.com:443
+   path: /usr/local/bin
+   base_url: https://cdn.teleport.dev
+   enabled: true
+   pinned: false
+   active:
+       version: 17.2.0
+       flags: [Enterprise]
+   target:
+       version: 17.2.1
+       flags: [Enterprise]
+   in_window: false
+   jitter: 1m0s
+   ```
+
+   Here, the local active version is 17.2.0. The cluster's target version is
+   17.2.1, but we are not in an update window, so the agent is not immediately
+   updated.
+
+1. If an agent is not automatically updated, you can invoke the updater
+   manually and look at its logs:
+
+   ```code
+   $ sudo teleport-update update --now
+   ```
+
+### Using a different CDN URL
+
+If your agents cannot reach the default Teleport CDN URL (`cdn.teleport.dev`), they will be unable to download updates.
+
+Here are a couple of potential solutions to this issue:
+
+#### Use an HTTP CONNECT proxy
+
+If you configure the `HTTPS_PROXY` variable in the `teleport-update` process's environment, it will use this proxy to
+pull updates.
+
+The easiest way to configure a proxy with a default install is to add this variable to
+`/etc/systemd/system/teleport-update.service.d/override.conf`:
+
+```bash
+$ sudo mkdir -p /etc/systemd/system/teleport-update.service.d
+$ sudo tee -a /etc/systemd/system/teleport-update.service.d/override.conf > /dev/null <<'EOF'
+[Service]
+Environment=HTTPS_PROXY=http://proxy-url:3128
+EOF
+```
+
+You can view the `teleport-update` process logs with `sudo journalctl -u teleport-update.service`.
+
+#### Mirror the Teleport tarball packages and change the base-url
+
+If you can mirror the Teleport tarball installers somewhere that your agents are able to access, you can change the
+`base-url`
+used by Teleport updaters so they can pull them directly.
+
+To change the `base-url`, you should add the `-b` or `--base-url` flag to the `teleport-update enable` command:
+
+```bash
+$ sudo teleport-update enable --base-url https://teleport.artifactory.company.local
+```
+
+It is safe to re-run `sudo teleport-update enable` to modify the base URL.
+Existing updater settings will be preserved if not explicitly overridden by flags.
+
+More information about flags that can be used with `teleport-update enable` can be
+found [here](../../reference/cli/teleport-update.mdx#teleport-update-enable)
diff --git a/docs/pages/upgrading/agent-managed-updates/bootstrap-ec2-agent.mdx b/docs/pages/upgrading/agent-managed-updates/bootstrap-ec2-agent.mdx
new file mode 100644
index 0000000000000..46ffd6fdd2c02
--- /dev/null
+++ b/docs/pages/upgrading/agent-managed-updates/bootstrap-ec2-agent.mdx
@@ -0,0 +1,385 @@
+---
+title: Managed Updates v2 in EC2 Agents
+description: Describes how to set up EC2 instance by cloud-init script and install Teleport with "teleport-update enable"
+tags:
+ - get-started
+ - how-to
+---
+
+This guide shows two cloud-init patterns for bringing Linux EC2 instances under Managed Updates v2
+and assigning them to an update group using `teleport-update` by defining the group and proxy address.
+
+## How it works
+
+It assumes you'll join the agent to your cluster during first boot wit delegated join method
+and that your cluster has Managed Updates v2 enabled.
+
+Delegated joins avoid shipping any secret token in user data. You create a named token resource that
+encodes context rules (your AWS account, role ARNs, regions, etc.), then the agent proves its identity
+to the Auth Service using cloud-issued credentials. Your agent can fetch IAM credentials
+(e.g., EC2 instance profile, IRSA, or env vars).
+
+In more detail, here is how IAM join works:
+- The Node signs an AWS STS `GetCallerIdentity` request using its own IAM credentials (e.g., EC2 instance role).
+- The Node sends this pre-signed request to the Teleport Auth Service as part of the join handshake.
+- The Auth Service does not call AWS APIs directly with its own credentials. Instead, it simply executes that pre-signed `GetCallerIdentity` request over HTTPS. AWS STS returns the identity information (Account ID, ARN, etc.).
+- Teleport validates that identity against your token's allow rules.
+
+In this guide, we use the `teleport-update` binary for installation.
+The `teleport-update enable` command installs Teleport at the version advertised by the cluster and enables
+Managed Updates v2 on the host. It also creates the necessary systemd units for Teleport, along with a
+`teleport-update` timer that periodically runs `teleport-update update`. In addition, it saves most of the
+flags you pass in (such as -g, -p, or -b), so that running the command again will update the stored settings
+rather than requiring you to re-enter them.
+
+For full Managed Updates v2 instructions, see [Managed Updates forAgents (v2)](./agent-managed-updates.mdx).
+
+Every agent belongs to an update group (e.g., development, staging, prod), if no group is configured `default` is used.
+The cluster-side `autoupdate_config` resource defines when each group may update.
+Cloud or self-hosted clusters use the same schedule model. Self-hosted clusters also set the desired
+version via `autoupdate_version` resource.
+
+## Step 1/5. Creating join tokens
+
+See [the joining documentation](../../reference/deployment/join-methods.mdx) for a detailed explanation
+of the joining process and the supported join methods.
+
+The IAM join method is the recommended way of joining EC2 instances. It offers stronger security guarantees,
+more granular control over who can join, and is easier to use (the token doesn't need to be short-lived nor rotated).
+
+Create a file named `token.yaml`:
+```yaml
+# token.yaml
+kind: token
+version: v2
+metadata:
+  name: iam-join
+spec:
+  roles: [Node]
+  join_method: iam
+  allow:
+    # Allow specific AWS accounts (or restrict by ARN)
+    - aws_account: "123456789012"
+    - aws_account: "999998880000"
+      aws_arn: "arn:aws:sts::999998880000:assumed-role/teleport-node-role/i-*"
+```
+
+Run the following command to create or update the resource:
+
+```code
+$ tctl create -f token.yaml
+provision_token "iam-join" has been created
+```
+
+This defines which AWS accounts and roles can join via IAM. You can use `aws_account` alone
+(to allow all roles in that account) or add an `aws_arn` filter for stricter control.
+
+On AWS, prepare an IAM role that your EC2 instances will assume to prove their identity.
+No permissions required - the join verification only calls `sts:GetCallerIdentity`.
+
+Example trust policy for EC2:
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "ec2.amazonaws.com" },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+```
+
+This policy is required and must be created using the [AWS Management Console or the AWS CLI](#step-45-create-an-ec2-instance).
+
+## Step 2/5. Define groups and schedules
+
+To enable managed updates, you need to create an `autoupdate_config` resource with the `enabled` mode.
+Additionally, in `autoupdate_config`, you can define update groups (each agent belongs to one) and configure update schedules.
+If no group or schedule is defined, the default one is used.
+
+<Tabs>
+<TabItem label="Default">
+
+Create a file called `autoupdate_config.yaml` containing:
+
+```yaml
+# autoupdate_config.yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+```
+
+</TabItem>
+
+<TabItem label="Custom groups with schedule">
+
+Pick simple, meaningful groups like `development`, `staging`, `production`. Then model your rollout windows
+and sequencing in `autoupdate_config`:
+
+```yaml
+# autoupdate_config.yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  agents:
+    mode: enabled
+    strategy: halt-on-error
+    schedules:
+      regular:
+        - name: <Var name="development" />
+          days: ["Mon","Tue","Wed","Thu"]
+          start_hour: 4   # UTC
+        - name: staging
+          days: ["Mon","Tue","Wed","Thu"]
+          start_hour: 5
+          wait_hours: 24  # run a day later than <Var name="development" />
+```
+
+This resource is used to control the update schedule by defining different groups, sequence and upgrade window.
+
+In the example, we define two update groups: `<Var name="development" />` and `staging`. Upgrades are allowed on Monday, Tuesday,
+Wednesday, and Thursday.
+
+The first group, `<Var name="development" />`, must start the upgrade process at 04:00 UTC. Once it is completed and all
+agents in the `<Var name="development" />` group are upgraded, the next group, `staging`, begins the upgrade process with
+a 24-hour delay at 05:00 UTC.
+
+If any agent in the `<Var name="development" />` group fails, the upgrade process must stop. This behavior is controlled by
+the `halt-on-error` strategy value.
+
+</TabItem>
+</Tabs>
+
+Run the following command to create or update the resource:
+
+```code
+$ tctl create -f autoupdate_config.yaml
+autoupdate_config has been created
+```
+
+<Admonition type="note">
+    Changes to the schedule configuration will take effect for the next version change.
+</Admonition>
+
+## Step 3/5. Define the version (self-hosted only)
+
+<Admonition type="important">
+    Self-hosted Teleport users must specify which version their agents should update
+    to via the `autoupdate_version` resource. Cloud-hosted Teleport Enterprise users must
+    skip this step, as it is managed by the Cloud team.
+</Admonition>
+
+By creating `autoupdate_version` resource we define the version of the Teleport that must be initially installed
+during EC2 instance bootstrap.
+
+```yaml
+# autoupdate_version.yaml
+kind: autoupdate_version
+metadata:
+  name: autoupdate-version
+spec:
+  agents:
+    start_version: (=teleport.version=)
+    target_version: (=teleport.version=)
+    schedule: regular
+    mode: enabled
+```
+Create or update `autoupdate_version` resource:
+
+```code
+$ tctl create -f autoupdate_version.yaml
+autoupdate_version has been created
+```
+
+## Step 4/5. Create an EC2 Instance
+
+<Tabs>
+<TabItem label="AWS CLI">
+
+To create required IAM role, instance profile and launch EC2 instance, follow these steps:
+
+1. Create an IAM role with a trust policy that allows EC2 to assume it:
+
+```code
+$ cat > trust-policy.json <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "ec2.amazonaws.com" },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+$ aws iam create-role \
+  --role-name EC2TeleportRole \
+  --assume-role-policy-document file://trust-policy.json
+   ```
+
+1. Create an EC2 instance profile to use the role:
+
+```code
+$ aws iam create-instance-profile --instance-profile-name EC2TeleportInstanceProfile
+$ aws iam add-role-to-instance-profile \
+  --instance-profile-name EC2TeleportInstanceProfile \
+  --role-name EC2TeleportRole
+   ```
+
+1. Create `cloud-init.yaml` configuration file with cloud init data.
+
+```yaml
+#cloud-config
+packages:
+- curl
+
+runcmd:
+  # Install Teleport using your cluster's script and define the group by query parameter.
+  # Script persists your updater flags (group, proxy, etc.)
+  - curl "https://<Var name="example.teleport.sh:443" />/scripts/install.sh?group=<Var name="development" />" | sudo bash
+
+  # Write agent config (join token) before starting the service.
+  - teleport configure --roles node --proxy <Var name="example.teleport.sh:443" /> --join-method iam --token iam-join > /etc/teleport.yaml
+
+  # Enable and start Teleport service.
+  - systemctl enable --now teleport
+   ```
+
+1. Launch the EC2 instance with the instance profile:
+
+```code
+# Specify the AMI image ID for the instance and a security group that allows at least outbound traffic.
+$ aws ec2 run-instances \
+  --image-id ami-xxxx \
+  --instance-type t3.micro \
+  --iam-instance-profile Name=EC2TeleportInstanceProfile \
+  --security-group-ids sg-xxxx \
+  --region us-west-2 \
+  --user-data file://cloud-init.yaml
+   ```
+</TabItem>
+
+<TabItem label="AWS web console">
+
+Follow the procedure for [launching an instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-instance-wizard.html)
+and [providing user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html),
+which allows you to supply cloud-init directives at launch - whether by entering them in the User data field of the
+AWS Management Console's Advanced details section.
+
+In the example below, the directives create and configure a Teleport node on Amazon Linux 2.
+The script installs Teleport and the v2 updater and enables SSH service only.
+The `#cloud-config` line at the top is required in order to identify the commands as cloud-init directives.
+
+User-data example with a previously created join token:
+
+```yaml
+#cloud-config
+packages:
+- curl
+
+runcmd:
+  # Install Teleport using your cluster's script and define the group by query parameter.
+  # Script persists your updater flags (group, proxy, etc.).
+  - curl "https://<Var name="example.teleport.sh:443" />/scripts/install.sh?group=<Var name="development" />" | sudo bash
+
+  # Write agent config (join token) before starting the service.
+  - teleport configure --roles node --proxy <Var name="example.teleport.sh:443" /> --join-method iam --token iam-join > /etc/teleport.yaml
+
+  # Enable and start Teleport service.
+  - systemctl enable --now teleport
+```
+</TabItem>
+</Tabs>
+
+
+## Step 5/5. Verifying on the instance
+Once the EC2 instance is started, SSH on it to check the updater status:
+
+```code
+$ teleport-update status
+
+proxy: <Var name="example.teleport.sh:443" />
+path: /usr/local/bin
+base_url: https://cdn.teleport.dev
+enabled: true
+pinned: false
+active:
+    version: (=teleport.version=)
+    flags: [Enterprise]
+target:
+    version: (=teleport.version=)
+    flags: [Enterprise]
+in_window: false
+```
+
+Shows proxy, group, active/target versions, and whether you're in an update window.
+
+Check services:
+
+```code
+$ systemctl status teleport
+● teleport.service - Teleport Service
+     Loaded: loaded (/usr/lib/systemd/system/teleport.service; enabled; preset: enabled)
+    Drop-In: /etc/systemd/system/teleport.service.d
+             └─teleport-update.conf
+     Active: active (running)
+ Invocation: 1725c68591634876afd805b417cf9801
+   Main PID: 40848 (teleport)
+      Tasks: 17 (limit: 11011)
+     Memory: 79.5M (peak: 81.7M, swap: 27.5M, swap peak: 27.5M)
+        CPU: 19min 2.548s
+     CGroup: /system.slice/teleport.service
+             └─40848 /usr/local/bin/teleport start --config /etc/teleport.yaml --pid-file=/run/teleport.pid
+
+$ journalctl -u teleport -n100 -f
+teleport[2246081]: 2025-10-21T20:51:44.154Z INFO [PROC:1]    Found an instance metadata service. Teleport will import labels from this cloud instance. pid:2246081.1 type:EC2 service/service.go:1186
+teleport[2246081]: 2025-10-21T20:51:44.156Z INFO [PROC:1]    Service is creating new listener. pid:2246081.1 type:debug address:/var/lib/teleport/debug.sock service/signals.go:242
+teleport[2246081]: 2025-10-21T20:51:44.159Z INFO [PROC:1]    Generating new host UUID pid:2246081.1 host_uuid:1fcaf1e0-0fbf-454d-ac13-49965918dc39 storage/storage.go:356
+teleport[2246081]: 2025-10-21T20:51:44.166Z INFO [PROC:1]    Joining the cluster with a secure token. pid:2246081.1 service/connect.go:532
+teleport[2246081]: 2025-10-21T20:51:44.166Z INFO  Attempting registration. method:via proxy server join/join.go:388
+teleport[2246081]: 2025-10-21T20:51:44.168Z WARN [CLOUD] Could not fetch EC2 instance's tags, please ensure 'allow instance tags in metadata' is enabled on the instance. labels/cloud.go:147
+teleport[2246081]: 2025-10-21T20:51:44.541Z INFO  Attempting to register with IAM method using region STS endpoint. role:Instance join/join.go:785
+teleport[2246081]: 2025-10-21T20:51:44.697Z INFO  Successfully registered with IAM method using regional STS endpoint. role:Instance join/join.go:807
+teleport[2246081]: 2025-10-21T20:51:44.697Z INFO  Successfully registered. method:via proxy server join/join.go:395
+teleport[2246081]: 2025-10-21T20:51:44.698Z INFO [PROC:1]    Successfully obtained credentials to connect to the cluster. pid:2246081.1 identity:Instance service/connect.go:383
+
+$ journalctl -u teleport-update -n100 -f
+systemd[1]: Starting teleport-update.service - Teleport auto-update service...
+teleport-update[160893]: INFO [UPDATER]   Teleport is up-to-date. Update window is active, but no action is needed. active_version:(=teleport.version=) agent/updater.go:877
+systemd[1]: teleport-update.service: Deactivated successfully.
+systemd[1]: Finished teleport-update.service - Teleport auto-update service.
+```
+
+From an admin workstation.
+
+Login to the remote cluster:
+
+```code
+$ tsh login --proxy <Var name="example.teleport.sh:443" />
+```
+
+Confirm that the node is joined (it might take up to 15 min to be synced).
+
+```code
+$ tctl inventory ls
+Server ID                            Hostname                                    Services Agent Version Upgrader Upgrader Version Update Group
+------------------------------------ ------------------------------------------- -------- ------------- -------- ---------------- ------------
+1fcaf1e0-0fbf-454d-ac13-49965918dc39 ip-172-31-44-126.us-west-2.compute.internal Node     v(=teleport.version=)       binary   v(=teleport.version=)          default
+```
+
+Check the Managed Update v2 status:
+
+```code
+$ tctl autoupdate agents status
+Group Name          State Start Time          State Reason    Agent Count Up-to-date
+------------------- ----- ------------------- --------------- ----------- ----------
+default (catch-all) Done  XXXX-XX-XX 00:00:00 update_complete 1           1
+```
\ No newline at end of file
diff --git a/docs/pages/upgrading/client-tools-autoupdate.mdx b/docs/pages/upgrading/client-tools-autoupdate.mdx
deleted file mode 100644
index a824acd861a7d..0000000000000
--- a/docs/pages/upgrading/client-tools-autoupdate.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Teleport Client Tool Automatic Updates
-description: Explains how to use Teleport client tools (`tsh` and `tctl`) auto-updates.
----
-
-This documentation explains how to keep Teleport client tools like `tsh` and `tctl` up-to-date.
-Updates can be automatic or self-managed, ensuring tools are secure, free from bugs,
-and compatible with your Teleport cluster. Available in versions: 17.0.1, 16.4.10, and 15.4.24.
-
-Why keep client tools updated?
-
-- **Security**: Updates deliver patches for known vulnerabilities.
-- **Bug Fixes**: Resolved issues are pushed to endpoints.
-- **Compatibility**: Avoid manual understanding of [Teleport component compatibility rules](overview.mdx#component-compatibility).
-
-## How it works
-
-When you run `tsh login`, the tsh tool will check if updates are enabled for your cluster.
-If your client version differs from the cluster's required version, it will:
-
-1. Download the updated version.
-2. Store it in `~/.tsh/bin`.
-3. Validate the binary with a checksum.
-4. Re-execute using the updated version (with the same environment variables).
-
-### Key features
-
-**Binary Management**: Original binaries are preserved, and updates are stored separately.
-Updates are installed in the `$TELEPORT_HOME/.tsh/bin/` folder (if `TELEPORT_HOME` is not defined, the home folder is used).
-When client tools (`tctl` or `tsh`) are executed from any other path, they consistently check for binaries in the update
-folder and re-execute them if found.
-
-**Validation**: Downloaded packages are verified with a hash sum to ensure integrity.
-Package downloads are directed to the `cdn.teleport.dev` endpoint and depend on the operating system,
-platform, and edition. The edition must be identified by the original client tools binary.
-The URL pattern is as follows:
-- `https://cdn.teleport.dev/teleport-{ent-}vX.Y.Z-{linux,darwin,windows}-{amd64,arm64,arm,386}-{fips-}bin.{tar.gz,pkg,zip}`
-- `https://cdn.teleport.dev/teleport-{ent-}vX.Y.Z-{linux,darwin,windows}-{amd64,arm64,arm,386}-{fips-}bin.{tar.gz,pkg,zip}.sha256`
-
-**Concurrency**: Tools use a locking mechanism to enable smooth operation during updates.
-Only one process can acquire the lock to update client tools, while other processes wait for the lock to be released.
-If the first process cancels the update, the next process in line will initiate the update.
-
-## Configuring client tool automatic updates
-
-### Using environment variables
-Values:
-- `X.Y.Z`: Use a specific version.
-- `off`: Disable updates.
-
-An environment variable `TELEPORT_TOOLS_VERSION` can be used as an emergency workaround for a known issue,
-pinning to a specific version in CI/CD, for debugging, or for manual updates.
-
-During re-execution, child process will inherit all environment variables and flags. To prevent infinite loops
-only version environment variable will be overridden to `TELEPORT_TOOLS_VERSION=off`.
-
-Example of self-managed auto-update by setting the version with environment variable:
-```bash
-$ TELEPORT_TOOLS_VERSION=17.0.5 tctl version
-Update progress: [▒▒▒▒▒▒▒▒▒▒] (Ctrl-C to cancel update)
-Teleport v17.0.5 git:v17.0.5-0-g7cc4c2a go1.23.4
-````
-
-### Using `tctl`
-
-To enable or disable client tools automatic updates in the cluster, use the following command:
-
-```code
-$ tctl autoupdate client-tools enable
-client tools auto update mode has been changed
-
-$ tctl autoupdate client-tools disable
-client tools auto update mode has been changed
-```
-
-To set or remove the target version for automatic updates for all client tools:
-
-```code
-$ tctl autoupdate client-tools target X.Y.Z
-client tools auto update target version has been set
-
-$ tctl autoupdate client-tools target --clear
-client tools auto update target version has been cleared
-```
-
-If the target version is cleared, the cluster version will be used automatically, eliminating the need for manual
-updates each time the cluster version is upgraded.
-
-The `status` command retrieves the target version and mode configured for the logged-in cluster.
-To use an unauthenticated endpoint for this configuration, include the `--proxy` flag.
-
-```code
-$ tctl autoupdate client-tools status --format json
-{
-    "mode": "enabled",
-    "target_version": "X.Y.Z"
-}
-
-$ tctl autoupdate client-tools status --proxy proxy.example.com --format json
-{
-    "mode": "enabled",
-    "target_version": "X.Y.Z"
-}
-```
-
-### Using resource definitions
-
-To enable client tools automatic updates in cluster, first create a file named `autoupdate_config.yaml` with the following content:
-
-```yaml
-kind: autoupdate_config
-metadata:
-  name: autoupdate-config
-spec:
-  tools:
-    mode: enabled
-```
-
-And write resource data to the cluster `tctl create -f autoupdate_config.yaml`, after that any new `tsh` login must
-check the target version and initiate downloading desired version to install in Teleport home folder.
-
-The next resource is responsible for setting target version `autoupdate_version.yaml`.
-
-```yaml
-kind: autoupdate_version
-metadata:
-  name: autoupdate-version
-spec:
-  tools:
-    target_version: X.Y.Z
-```
-
-Create the resource using `tctl create -f autoupdate_version.yaml`.
-If the `autoupdate_version` resource hasn't been created yet, the cluster version will be used as the default target version.
-
-<Admonition type="note">
-    - For self-hosted clusters, automatic updates are disabled by default but can be enabled.
-    - Cloud clusters are automatically enrolled in updates, managed by the Teleport Cloud team.
-    - For clusters with multiple root versions, use self-managed updates to avoid frequent version switching.
-</Admonition>
-
-## Determining a client tool version
-
-To determine the version required to operate with the cluster, during the login process, `tsh` queries from the
-unauthenticated proxy discovery `/v1/webapi/find` endpoint. If `.auto_update.tools_auto_update` is enabled, the
-client tools must initiate the installation of the version specified in `.auto_update.tools_version`.
-
-For manual updates, when scheduling updates at specific times or using custom CDN mirrors or with self-build packages,
-you can disable auto-update via configuration. In this case, you can monitor the tool's version separately
-or pair it with the `TELEPORT_TOOLS_VERSION=off` environment variable.
-
-```bash
-$ curl https://proxy.example.com/v1/webapi/find | jq .auto_update
-{
-    "tools_auto_update": true,
-    "tools_version": "X.Y.Z",
-}
-```
diff --git a/docs/pages/upgrading/client-tools-managed-updates.mdx b/docs/pages/upgrading/client-tools-managed-updates.mdx
new file mode 100644
index 0000000000000..c41e6c41117b5
--- /dev/null
+++ b/docs/pages/upgrading/client-tools-managed-updates.mdx
@@ -0,0 +1,277 @@
+---
+title: Teleport Client Tool Managed Updates
+description: Explains how to use Teleport client tools (`tsh` and `tctl`) managed updates.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+This documentation explains how to keep Teleport client tools like `tsh` and `tctl` up-to-date.
+Updates can be managed by cluster or self-managed, ensuring tools are secure, free from bugs,
+and compatible with your Teleport cluster.
+
+For detailed information on managed updates in Teleport Connect, see [Teleport Connect Managed updates](../connect-your-client/teleport-clients/teleport-connect.mdx#managed-updates).
+
+Why keep client tools updated?
+
+- **Security**: Updates deliver patches for known vulnerabilities.
+- **Bug Fixes**: Resolved issues are pushed to endpoints.
+- **Compatibility**: Avoid manual understanding of [Teleport component compatibility rules](overview.mdx#component-compatibility).
+
+## How it works
+
+When you run `tsh login`, the tsh tool will check if updates are enabled for your cluster.
+If your client version differs from the cluster's required version, it will:
+
+1. Download the updated version.
+2. Validate the package with a checksum.
+3. Extract the package and store the binaries in `~/.tsh/bin` (`$TELEPORT_HOME/bin`).
+4. Records the client tools version advertised by the cluster in `~/.tsh/bin/.config.json`(`$TELEPORT_HOME/bin/.config.json`).
+5. Re-execute using the updated version (with the same environment variables).
+
+### Key features
+
+**Binary Management**: Original binaries are preserved, and updates are stored separately.
+Updates are installed in the `$TELEPORT_HOME/bin` folder (if `TELEPORT_HOME` is not defined, the home folder is used `$HOME/.tsh/bin`).
+When client tools (`tctl` or `tsh`) are executed from any other path, they consistently check for binaries in the update
+folder and re-execute them if found.
+
+**Validation**: Downloaded packages are verified with a hash sum to ensure integrity.
+Package downloads are directed to the `cdn.teleport.dev` endpoint and depend on the operating system,
+platform, and edition. The edition must be identified by the original client tools binary.
+The URL pattern is as follows:
+- `https://cdn.teleport.dev/teleport-{ent-}vX.Y.Z-{linux,darwin,windows}-{amd64,arm64,arm,386}-{fips-}bin.{tar.gz,pkg,zip}`
+- `https://cdn.teleport.dev/teleport-{ent-}vX.Y.Z-{linux,darwin,windows}-{amd64,arm64,arm,386}-{fips-}bin.{tar.gz,pkg,zip}.sha256`
+The base URL of the CDN can be overridden using the `TELEPORT_CDN_BASE_URL` environment variable.
+Allows mirroring the CDN in a private network or using custom builds.
+
+**Concurrency**: Tools use a locking mechanism to enable smooth operation during updates.
+Only one process can acquire the lock to update client tools, while other processes wait for the lock to be released.
+If the first process cancels the update, the next process in line will initiate the update.
+
+### Multi-cluster support and multi-version caching
+
+Client tools managed updates support multi-cluster environments. When you log in to different clusters that use
+different versions (including different major versions), the client makes a request to the `/v1/webapi/find` endpoint
+before executing the login command. This request retrieves the client tools version required by the target cluster.
+The specified version is then downloaded, extracted to the tools directory, and used to re-execute the command.
+As a result, the login command runs using the version required by that cluster.
+
+The required version for each cluster is tracked in `$TELEPORT_HOME/bin/.config.json` (defaults to `~/.tsh/bin/.config.json`).
+This file stores the proxy address, the required version for each cluster, and the update mode.
+If managed updates are disabled for a cluster (i.e., the mode is set to "disable"), re-execution
+is skipped and the currently installed version is used instead.
+
+Example of managed updates configuration file:
+```json
+{
+  "version": "v1",
+  "configs": {
+    "proxy1.example.com": {"version": "18.1.0","disabled": false},
+    "proxy2.example.com": {"version": "17.5.5","disabled": false},
+    "proxy3.example.com": {"version": "16.5.5","disabled": false},
+    "proxy4.example.com": {"version": "16.5.5","disabled": true}
+  }
+}
+```
+
+By default, client tools managed updates store up to three different versions in the `$TELEPORT_HOME/bin` directory.
+If multiple clusters require the same version, a single shared copy is used. Once the update process is complete,
+the relative path to the client tools is recorded in the configuration file.
+
+```json
+{
+  "version": "v1",
+  "configs": {
+    "proxy1.example.com": {"version": "18.1.0","disabled": false}
+  },
+  "tools": [
+    {
+      "version": "18.1.0",
+      "path": {
+        "tctl": "1921b970-807f-4d36-a769-fbda149d8970-update-pkg-v2/tctl-18.1.0.pkg/Payload/tctl.app/Contents/MacOS/tctl",
+        "tsh": "1921b970-807f-4d36-a769-fbda149d8970-update-pkg-v2/tsh-18.1.0.pkg/Payload/tsh.app/Contents/MacOS/tsh"
+      }
+    }
+  ],
+  "max_tools": 3
+}
+```
+
+After each `tctl` or `tsh` command is re-executed using a specific version from the tools list,
+the list is reordered to move the most recently used version to the top. If the number of cached
+versions exceeds the allowed limit, the least recently used version (at the bottom of the list)
+will be removed during the next update.
+
+To reduce the need for repeated downloads, you can increase the number of stored versions by
+manually setting the max_tools value to the desired limit.
+
+### Managed updates version checks
+
+Client tools make a request to the Teleport Proxy Service discovery endpoint `/v1/webapi/find` during every login
+in order to retrieve the required version of Teleport client tools and check the update mode for the target cluster.
+
+To enable version checks for `tsh ssh` or `tsh proxy ssh` commands in case a login is not required,
+set the `TELEPORT_TOOLS_CHECK_UPDATE=t` environment variable to initiate this check. For example:
+
+```code
+$ TELEPORT_TOOLS_CHECK_UPDATE=t tsh ssh user@host
+Update progress: [▒▒▒▒▒▒▒▒▒▒] (Ctrl-C to cancel update)
+user@host ~ #
+```
+
+Managed update local checks are triggered during the execution of any command. If there is an active
+session with a cluster and the cluster advertises a required client tools version,
+both `tsh` and `tctl` will be re-executed using that version. If the version is not already present
+in the tools directory, it will be downloaded, extracted, and executed automatically.
+
+If there is no active session, but a versioned binary exists in the tools directory
+(e.g., `~/.tsh/bin/tsh` or `~/.tsh/bin/tctl`), the corresponding tool will be re-executed with that version
+(for backward compatibility with older versions of managed updates).
+
+## Configuring client tool managed updates
+
+### Cluster-wide using `tctl`
+
+To configure client tool managed updates in your cluster, you must have access to the
+`autoupdate_config` and `autoupdate_version` resources. By default, the `editor` role can modify both resources. Note that `autoupdate_version` is managed for you on Cloud clusters, and cannot be edited.
+
+To enable or disable client tools managed updates in the cluster, use the following command:
+
+```code
+$ tctl autoupdate client-tools enable
+client tools auto update mode has been changed
+
+$ tctl autoupdate client-tools disable
+client tools auto update mode has been changed
+```
+
+To set or remove the target version for automatic updates for all client tools:
+
+```code
+$ tctl autoupdate client-tools target X.Y.Z
+client tools auto update target version has been set
+
+$ tctl autoupdate client-tools target --clear
+client tools auto update target version has been cleared
+```
+
+If the target version is cleared, the cluster version will be used automatically, eliminating the need for manual
+updates each time the cluster version is upgraded.
+
+The `status` command retrieves the target version and mode configured for the logged-in cluster.
+To use an unauthenticated endpoint for this configuration, include the `--proxy` flag.
+
+```code
+$ tctl autoupdate client-tools status --format json
+{
+    "mode": "enabled",
+    "target_version": "X.Y.Z"
+}
+
+$ tctl autoupdate client-tools status --proxy proxy.example.com --format json
+{
+    "mode": "enabled",
+    "target_version": "X.Y.Z"
+}
+```
+
+### On a per-client basis using environment variables
+Values:
+- `X.Y.Z`: Use a specific version.
+- `off`: Disable updates.
+
+The `TELEPORT_TOOLS_VERSION` environment variable can be used for pinning a specific version, for debugging, or for manual updates.
+
+During re-execution, child process will inherit all environment variables and flags. To prevent infinite loops
+only version environment variable will be overridden to `TELEPORT_TOOLS_VERSION=off`.
+
+Example of self-managed update by setting the version with environment variable:
+```bash
+$ TELEPORT_TOOLS_VERSION=18.1.0 tctl version
+Update progress: [▒▒▒▒▒▒▒▒▒▒] (Ctrl-C to cancel update)
+Teleport v18.1.0 git:v18.1.0-0-g8cdb161 go1.24.5
+
+# If the environment variable is not set, the currently installed version is used.
+$ tctl version
+Teleport v17.6.0 git:v17.6.0-0-g4c3b13b go1.23.11
+````
+
+To use the version specified by the environment variable, it must always be set.
+If the variable is set during the login command, we prioritize this version over the one
+provided by the cluster configuration. Even if the cluster indicates that client tools
+managed updates are disabled, setting the environment variable will force them to be enabled.
+Any tsh or tctl command executed with an active profile for this cluster will be re-executed
+using the recorded version.
+
+```bash
+$ TELEPORT_TOOLS_VERSION=18.1.0 tsh login --proxy proxy.example.com
+Update progress: [▒▒▒▒▒▒▒▒▒▒] (Ctrl-C to cancel update)
+...
+
+# The session is still active, and the profile at ~/.tsh/current-profile is set to proxy.example.com.
+$ tctl version
+Teleport v18.1.0 git:v18.1.0-0-g8cdb161 go1.24.5
+
+$ cat ~/.tsh/bin/.config.json
+{
+  "version": "v1",
+  "configs": {
+    "proxy.example.com": {"version": "18.1.0","disabled": false}
+  }
+}
+````
+
+### Using resource definitions
+
+To enable client tools managed updates in cluster, first create a file named `autoupdate_config.yaml` with the following content:
+
+```yaml
+kind: autoupdate_config
+metadata:
+  name: autoupdate-config
+spec:
+  tools:
+    mode: enabled
+```
+
+And write resource data to the cluster `tctl create -f autoupdate_config.yaml`, after that any new `tsh` login must
+check the target version and initiate downloading desired version to install in Teleport home folder.
+
+The next resource is responsible for setting target version `autoupdate_version.yaml`.
+
+```yaml
+kind: autoupdate_version
+metadata:
+  name: autoupdate-version
+spec:
+  tools:
+    target_version: X.Y.Z
+```
+
+Create the resource using `tctl create -f autoupdate_version.yaml`.
+If the `autoupdate_version` resource hasn't been created yet, the cluster version will be used as the default target version.
+
+<Admonition type="note">
+    - For self-hosted clusters, managed updates are disabled by default but can be enabled.
+    - Cloud clusters are automatically enrolled in updates, managed by the Teleport Cloud team.
+    - For clusters with multiple root versions, use self-managed updates to avoid frequent version switching.
+</Admonition>
+
+## Determining a client tool version
+
+To determine the version required to operate with the cluster, during the login process, `tsh` queries from the
+unauthenticated proxy discovery `/v1/webapi/find` endpoint. If `.auto_update.tools_auto_update` is enabled, the
+client tools must initiate the installation of the version specified in `.auto_update.tools_version`.
+
+For manual updates, when scheduling updates at specific times or using custom CDN mirrors or with self-build packages,
+you can disable managed updates via configuration. In this case, you can monitor the tool's version separately
+or pair it with the `TELEPORT_TOOLS_VERSION=off` environment variable.
+
+```bash
+$ curl https://proxy.example.com/v1/webapi/find | jq .auto_update
+{
+    "tools_auto_update": true,
+    "tools_version": "X.Y.Z",
+}
+```
diff --git a/docs/pages/upgrading/cloud-cluster-updates.mdx b/docs/pages/upgrading/cloud-cluster-updates.mdx
index 3771aeeb4fe50..85dced6396269 100644
--- a/docs/pages/upgrading/cloud-cluster-updates.mdx
+++ b/docs/pages/upgrading/cloud-cluster-updates.mdx
@@ -1,6 +1,9 @@
 ---
 title: Cloud Cluster Updates
 description: Provides a high-level overview of Teleport cluster updates on Cloud.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 On Teleport Enterprise (Cloud) clusters, the Auth Service and Proxy Service are automatically
@@ -11,7 +14,7 @@ described in [Teleport Upcoming Releases](../upcoming-releases.mdx).
 release of a new major version. Minor version updates and patches occur more regularly.
 - Major version updates will not occur if any connected Teleport Agents are more than one major version behind.
 - Updates only occur during your scheduled maintenance window.
-- Teleport Agents are only updated automatically if you enroll them in [managed updates](agent-managed-updates.mdx).
+- Teleport Agents are only updated automatically if you enroll them in [managed updates](agent-managed-updates/agent-managed-updates.mdx).
 
 ## Notifications
 
diff --git a/docs/pages/upgrading/overview.mdx b/docs/pages/upgrading/overview.mdx
index 5556fbfbbb3b1..a6c227d9fee3a 100644
--- a/docs/pages/upgrading/overview.mdx
+++ b/docs/pages/upgrading/overview.mdx
@@ -1,6 +1,10 @@
 ---
 title: Upgrading Compatibility Overview
 description: Provides a high-level description of how to upgrade the components in your Teleport cluster. Read this guide before following upgrade instructions for your environment.
+sidebar_position: 1
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Since Teleport is a distributed system with a number of services that run on
@@ -14,13 +18,22 @@ Teleport cluster while preserving compatibility.
 
 (!docs/pages/includes/compatibility.mdx!)
 
+You can think of Teleport cluster components in three tiers:
+1. The Auth Service is expected to be the newest component in the cluster.
+   For this reason it should always be the first component that is upgraded.
+2. The Proxy Service is expected to run a version less than or equal to the
+   Auth Service. The Proxy Service should never run a version newer than the
+   Auth Service.
+3. Other Teleport agents (SSH Service, Database Service, etc.) should always
+   run a version less than or equal to the Proxy Service.
+
 In Teleport Enterprise Cloud, we manage the Auth Service and Proxy Service for
 you. You can determine the current version of these services by running the
 following command, where `mytenant` is the name of your Teleport Enterprise
 Cloud tenant:
 
 ```code
-$ curl -s https://mytenant.teleport.sh/webapi/ping | jq '.server_version'
+$ curl -s https://mytenant.teleport.sh/webapi/find | jq '.server_version'
 ```
 
 ## Upgrading a self-hosted Teleport cluster
@@ -32,27 +45,32 @@ Teleport cluster.
 <Admonition type="warning">
   If you are upgrading more then one major version, you must repeat the
   following steps for each major version until you reach your target version.
-  For example, if your cluster is on v10 and you wish to upgrade to v13, you
-  must first follow the sequence below for v11, then v12, before finally upgrading
-  to v13. You must not upgrade directly from v10 to v13.
+  For example, if your cluster is on v15 and you wish to upgrade to v18, you
+  must first follow the sequence below for v16, then v17, before finally upgrading
+  to v18. You must not upgrade directly from v15 to v18.
 </Admonition>
 
 1. Back up your Teleport cluster state as a precaution against any unforeseen
    incidents while upgrading the Auth Service, which may perform data
    migrations on its backend. Follow the instructions in [Backup and
-   Restore](../admin-guides/management/operations/backup-restore.mdx).
+   Restore](../zero-trust-access/deploy-a-cluster/backup-restore.mdx).
 1. Upgrade all **Auth Service** instances to the **target version first**.
    Auth Service instances may be upgraded in any sequence or at the same time. After
    the upgrade **confirm** that the cluster is in a healthy state before continuing.
-1. Upgrade Proxy Service instances to the same version as the Auth
-   Service. Proxy Service instances are stateless and can be upgraded in any
-   sequence or at the same time. After the upgrade **confirm** that the cluster
-   is in a healthy state before continuing.
-1. Upgrade your Teleport Agents to the same version as the Auth Service.
-   You can upgrade resource agents in any sequence or at the same time. After the
+1. After all Auth Service instances are running the target version, upgrade Proxy Service instances
+   to the same version as the Auth Service. Proxy Service instances are
+   stateless and can be upgraded in any sequence or at the same time. After the
    upgrade **confirm** that the cluster is in a healthy state before continuing.
+1. After all Proxy Service instances are running the target version, upgrade
+   your Teleport Agents to the same version as the Auth Service. You can upgrade
+   agents in any sequence or at the same time. After the upgrade **confirm**
+   that the cluster is in a healthy state before continuing.
 1. Upgrade your Teleport clients and plugins (tctl, tsh, tbot, terraform-provider, event-handler, etc.).
 
+By following this process, your agents will never get ahead of your control
+plane components (even within the same major/patch version), ensuring that all
+expected APIs and migrations will be available by the time the agents upgrade.
+
 ## Upgrading multiple Teleport clusters
 
 When upgrading multiple Teleport clusters with a trust relationship, you must
@@ -68,6 +86,18 @@ upgrade from v10 to v11.
 1. Verify the upgrade was successful.
 1. Upgrade the trusted leaf clusters.
 
+## Downgrading major versions
+
+In order to safely downgrade from one major version to another, i.e. from v17 to v16,
+you must restore the Teleport backend to the back up taken prior to upgrading. First,
+roll back all components to the exact version they were running prior to the upgrade in
+reverse order of the upgrade sequence above until only the Auth Service instances are running
+the new major version. Then stop the Auth Service and follow the
+[Backup and Restore](../zero-trust-access/deploy-a-cluster/backup-restore.mdx) guidance
+to restore the backend to a point in time prior to the upgrade. Once the backup has been
+restored, downgrade the Auth Service instances to the exact version of Teleport
+they were running prior to the upgrade attempt, then start them again.
+
 ## Next steps
 
 Return to the [Upgrading Introduction](upgrading.mdx) for how to upgrade
diff --git a/docs/pages/upgrading/upgrading-manual.mdx b/docs/pages/upgrading/upgrading-manual.mdx
new file mode 100644
index 0000000000000..32808f9a6806c
--- /dev/null
+++ b/docs/pages/upgrading/upgrading-manual.mdx
@@ -0,0 +1,172 @@
+---
+title: Manual Upgrades
+description: Provides detailed information on upgrading Teleport without Managed Updates.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+To ensure that your Teleport cluster remains up to date with the lowest amount
+of manual overhead, we recommend [signing up](https://goteleport.com/signup) for
+a cloud-hosted Teleport Enterprise account and following [Enroll Agents in
+Managed Updates](./agent-managed-updates/agent-managed-updates.mdx).
+
+Before reading this guide, become familiar with the [Upgrading Compatibility
+Overview](./overview.mdx) guide, which describes the sequence in which to
+upgrade components in your cluster.
+
+This guide shows you how to upgrade Teleport manually. You can perform manual
+upgrades on Teleport Auth Service and Proxy Service instances running in
+self-hosted clusters, as well as all Teleport Agents.
+
+## Teleport Agents
+
+Note that all Linux servers with SystemD should use Managed Updates for Agents
+instead of this workflow, including on self-hosted clusters. Otherwise, agents
+may be disconnected when the cluster is upgraded.
+
+1. Identify the latest compatible Teleport Agent version by querying the
+   `webapi` endpoint of the Teleport Proxy Service, replacing 
+   <Var name="teleport.example.com:443" /> with the host and port of your
+   Teleport account or Teleport Proxy Service:
+
+   ```code
+   $ curl https://<Var name="teleport.example.com:443" />/webapi/find
+     ...
+     "auto_update": {
+       "tools_version": "(=teleport.version=)",
+       "tools_auto_update": true,
+       "agent_version": "(=teleport.version=)",
+       "agent_auto_update": true,
+       "agent_update_jitter_seconds": 60
+     },
+     ...
+   ```
+
+1. Use the `tctl inventory ls` command to list connected agents along with their
+   current version. Use the `--older-than` flag to list agents that are
+   upgradable:
+
+   ```code
+   $ tctl inventory ls --older-than=v(=teleport.version=)
+   Server ID                            Hostname       Services       Version Upgrader
+   ------------------------------------ -------------- -------------- ------- --------
+   00000000-0000-0000-0000-000000000000 ip-10-1-6-130  Node           v14.4.5 none
+   00000000-0000-0000-0000-000000000001 teleport-proxy Proxy          v15.2.0 none
+   00000000-0000-0000-0000-000000000002 teleport-auth  Auth,Discovery v15.2.0 none
+   ...
+   ```
+
+1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
+   and run the following `tctl` command to access the host via `tsh`:
+
+   ```code
+   $ HOST=00000000-0000-0000-0000-000000000000
+   $ USER=root
+   $ tsh ssh "${USER?}@${HOST?}"
+   ```
+
+1. On each Linux server, follow the instructions in the [next
+   section](#single-teleport-binaries-on-linux-servers) to install the new
+   version of the `teleport` binary.
+
+1. If you have deployed any agents on Kubernetes using the `teleport-kube-agent`
+   Helm chart, [follow the instructions](#teleport-agents-running-on-kubernetes)
+   to upgrade the Helm release.
+
+## Single Teleport binaries on Linux servers
+
+You can upgrade a single Teleport binary running on a Linux host by running the
+one-line installation script with a higher version than the current one.
+
+Before upgrading Teleport across a self-hosted cluster, read the [Compatibility
+Overview](./overview.mdx) to ensure you are upgrading components in
+the correct order.
+
+Complete the following steps on all servers that run the Auth Service and Proxy
+Service, then on each of your agents:
+
+1. Get the current version:
+
+   ```code
+   $ teleport version
+   ```
+
+1. Assign <Var name="edition" /> to one of the following, depending on your
+   Teleport edition:
+
+   | Edition                           | Value        |
+   |-----------------------------------|--------------|
+   | Teleport Enterprise (Cloud)       | `cloud`      |
+   | Teleport Enterprise (Self-Hosted) | `enterprise` |
+   | Teleport Community Edition        | `oss`        |
+
+1. Assign <Var name="version" /> to the version you want to install.
+
+1. Install the new Teleport version on your Linux server:
+
+   ```code
+   $ curl (=teleport.teleport_install_script_url=) | bash -s <Var name="version" /> <Var name="edition" />
+   ```
+
+   The installation script detects the package manager on your Linux server and
+   uses it to install Teleport binaries. To customize your installation, learn
+   about the Teleport package repositories in the [installation
+   guide](../installation/linux.mdx).
+
+1. Confirm that the version of the `teleport` binary is the one you expect:
+
+   ```code
+   $ teleport version
+   ```
+
+1. Now that you have installed a more recent `teleport` binary on your Auth
+   Service and Proxy Service instances, restart Teleport on these servers to run
+   the new version.
+
+   (!docs/pages/includes/start-teleport.mdx!)
+
+## Self-hosted Teleport clusters on Kubernetes
+
+The instructions in this section assume that you have configured the
+`teleport-cluster` Helm chart with a values file called `values.yaml`, and that
+your `teleport-cluster` release is called `teleport-cluster`. The Auth Service instances
+are restarted simultaneously during the upgrade so there is no need to shrink 
+the number of replicas.
+
+1. Update the Teleport Helm chart repository so you can install the latest
+   version of the `teleport-cluster` chart:
+
+   (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+1. Upgrade the `teleport-cluster` Helm release:
+
+   ```code
+   $ helm upgrade teleport-cluster teleport/teleport-cluster \
+     --version=<Var name="(=teleport.version=)" /> \
+     --values=values.yaml
+   ```
+
+   The `teleport-cluster` Helm chart automatically waits for the previous
+   version of the Proxy Service to stop responding to requests before running a
+   new version of the Auth Service.
+
+## Teleport Agents running on Kubernetes
+
+The instructions in this section assume that you have configured the
+`teleport-kube-agent` Helm chart with a values file called `values.yaml`, and
+that your `teleport-kube-agent` release is called `teleport-agent`.
+
+1. Update the Teleport Helm chart repository so you can install the latest
+   version of the `teleport-kube-agent` chart:
+
+   (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+1. Upgrade the Helm release:
+
+   ```code
+   $ helm -n "teleport" upgrade teleport-agent teleport/teleport-kube-agent \
+     --values=values.yaml \
+     --version=<Var name="(=teleport.version=)" />
+   ```
+
diff --git a/docs/pages/upgrading/upgrading-reference.mdx b/docs/pages/upgrading/upgrading-reference.mdx
deleted file mode 100644
index 1c368abd302e0..0000000000000
--- a/docs/pages/upgrading/upgrading-reference.mdx
+++ /dev/null
@@ -1,402 +0,0 @@
----
-title: Upgrading Reference
-description: Provides detailed information on upgrading Teleport in various situations.
-tocDepth: 3
----
-
-<Admonition type="warning">
-This document describes the Managed Updates v1 Teleport Agent updater, which is
-currently supported but will be deprecated after the [Managed update v2 updater
-](./agent-managed-updates.mdx) is generally available.
-</Admonition>
-
-This guide explains how to upgrade components of a Teleport cluster in
-non-standard situations. 
-
-To ensure that your Teleport cluster remains up to date with the lowest amount
-of manual overhead, we recommend [signing up](https://goteleport.com/signup) for
-a cloud-hosted Teleport Enterprise account and following [Enroll Agents in
-Automatic Upgrades](./agent-managed-updates.mdx). 
-
-If your infrastructure does not support automatic agent updates, follow this
-guide to determine the best approach for keeping your Teleport cluster up to
-date. 
-
-Before reading this guide, become familiar with the  [Upgrading Compatibility
-Overview](./overview.mdx) guide, which describes the sequence in which to
-upgrade components in your cluster.
-
-## Working with the automatic updater
-
-This section explains how to manage the automatic updater.
-
-On Kubernetes deployments, the updater is a controller that periodically
-reconciles expected Kubernetes resources with those in the cluster. On a Linux
-server, the updater is an executable script called `teleport-upgrade`. 
-
-### `teleport-upgrade` commands
-
-The `teleport-upgrade` tool provides some basic commands to verify and perform an
-update of the Teleport Agent.
-
-```code
-$ teleport-upgrade help
-USAGE: /usr/sbin/teleport-upgrade <command>
-
-Tool for automatic upgrades of Teleport Agents.
-
-Commands:
-  run           check for and potentially apply a teleport upgrade.
-  dry-run       check for new teleport version but do not upgrade.
-  force         performs an upgrade if an upgrade is available.
-  version       print the current version of /usr/sbin/teleport-upgrade.
-  help          show this help text.
-```
-
-The `dry-run` command can be used to check for an available update without performing
-an update.
-```code
-# Example output when teleport is already on the latest compatible version.
-$ teleport-upgrade dry-run
-[i] no upgrades available (14.3.14 == 14.3.14) [ 582 ]
-
-# Example output when an update is available.
-$ teleport-upgrade dry-run
-[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
-[i] within maintenance window, upgrade will be attempted. [ 596 ]
-```
-
-The `run` command performs an update if available.
-```code
-# Successful teleport update from 13.4.14 to 14.3.14.
-$ teleport-upgrade run
-[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
-[i] within maintenance window, upgrade will be attempted. [ 596 ]
-[i] attempting apt install teleport-ent=14.3.14... [ 480 ]
-[...]
-[i] gracefully restarting Teleport (if already running) [ 449 ]
-
-# Teleport updates are not attempted when outside the maintenance window.
-$ teleport-upgrade run
-[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
-[i] upgrade is non-critical and we are outside of maintenance window, not attempting. [ 618 ]
-```
-
-The `force` command performs an update immediately even when outside the maintenance
-window.
-```code
-$ teleport-upgrade force
-[i] an upgrade is available (13.4.14 -> 14.3.14) [ 585 ]
-[i] attempting apt install teleport-ent=14.3.14... [ 480 ]
-[...]
-[i] gracefully restarting Teleport (if already running) [ 449 ]
-```
-
-### Configuring the `teleport-upgrade` tool
-
-1. Create the upgrade configuration directory:
-   
-   ```code
-   $ sudo mkdir -p /etc/teleport-upgrade.d/
-   ```
-   
-1. If you changed the agent user to run as non-root, create
-   `/etc/teleport-upgrade.d/schedule` and grant ownership to your Teleport user,
-   assigning <Var name="your-teleport-user" /> to the name of your Teleport
-   user. Otherwise, you can skip this step:
-   
-   ```code 
-   $ sudo touch /etc/teleport-upgrade.d/schedule 
-   $ sudo chown <Var name="your-teleport-user" /> /etc/teleport-upgrade.d/schedule 
-   ```
-   
-   1. Configure the upgrader to connect to your version server and subscribe to
-   the right release channel:
-   
-   ```code 
-   $ echo "<Var name="teleport.example.com:443" />/v1/webapi/automaticupgrades/channel/default" | sudo tee /etc/teleport-upgrade.d/endpoint
-   ```
-
-   Make sure not to include `https://` as a prefix to the server address, nor
-   suffix the endpoint with `/version`.
-
-### Choosing a release channel
-
-When [configuring the updater](#configuring-the-teleport-upgrade-tool), you can
-select a release channel. 
-
-The following channels are available for APT, YUM, and Zypper repos:
-
-| Channel name      | Description                                                                                |
-|-------------------|--------------------------------------------------------------------------------------------|
-| `stable/<major>`  | Receives releases for the specified major release line, i.e. `v(=teleport.major_version=)` |
-| `stable/cloud`    | Rolling channel that receives releases compatible with current Cloud version               |
-| `stable/rolling`  | Rolling channel that receives all published Teleport releases                              |
-### Updating the updater
-
-The updater is designed to be minimal and relatively stable, but the updater will
-receive updates on occasion. Currently, the updater does not have the capability
-to update itself. Updates to the `teleport-ent-updater` package must be done manually.
-
-The `teleport-ent-updater` will be backwards compatible with older versions of Teleport,
-so you can always update the `teleport-ent-updater` package to the latest available
-version.
-
-### Version locking
-
-As of Teleport `15.1.10`, a version locking mechanism is enabled by the updater.
-This mechanism locks the version of Teleport and prevents manual updates of the Teleport
-package. This prevents unintentional updates during routine system maintenance, or
-an accidental update by a user. The updater still has the capability to update the
-Teleport package, and all updates of Teleport are expected to be performed by the
-updater.
-
-The version locking mechanism is implemented using the features of the package managers.
-In case a user would like to manually update the Teleport version, this can be done
-with the following commands.
-
-With the `apt` package manager CLI, the `--allow-change-held-packages` flag must be provided
-to bypass the version lock.
-```code
-$ apt-get install --allow-change-held-packages "teleport-ent=<target-version>"
-```
-
-With the `yum` package manager CLI, the `--disableexcludes="teleport"` flag must be provided
-to bypass the version lock.
-```code
-$ yum install --disablerepo="*" --enablerepo="teleport" --disableexcludes="teleport" "teleport-ent-<target-version>"
-```
-
-With the `zypper` package manager CLI, the lock must be disabled and then re-enabled
-after the update.
-```code
-$ zypper removelock "teleport-ent"
-$ zypper install --repo="teleport" "teleport-ent-<target-version>"
-$ zypper addlock "teleport-ent"
-```
-
-## Automatic update limitations
-
-Automatic updates are not available in all Teleport editions and installation
-methods. If you cannot use automatic updates, read [Manual
-updates](#manual-updates) for possible steps.
-
-### Automatic updates with Teleport Community Edition
-
-Automatic updates is not currently supported with the community editions of Teleport.
-Ensure that you are using the Teleport Enterprise edition of the `teleport-kube-agent`
-chart. You should see the following when you query your `teleport-kube-agent` release:
-
-```code
-$ helm -n "teleport" get values "teleport-agent" -o json | jq '.enterprise'
-true
-```
-
-### Automatic updates with direct binary installation
-
-Automatic updates is not currently supported with the direct binary installation method.
-Automatic updates is only supported with installations via the `apt`, `yum`, and
-`zypper` package managers.
-
-## Automatic updates with GitOps tools
-
-Automatic updates are incompatible with some GitOps tools used for continuous
-deployment.  The `teleport-kube-agent` Helm chart owns the version of the
-`teleport-agent` resource, so when the `teleport-agent-updater` modifies the
-image version of the `teleport-agent` resource, the GitOps tool will detect a
-drift or a diff in the `teleport-agent` resource.
-
-### ArgoCD deployments
-
-After an automatic update, ArgoCD reports the `teleport-agent` resource as `OutOfSync`.
-As a workaround to this problem use a [Diff Customization](https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#diffing-customization)
-to ignore the difference in image version. Here is an example deployment using the
-name `teleport-agent` and namespace `teleport`.
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: teleport-agent
-  namespace: teleport
-spec
-  ignoreDifferences:
-  - group: apps
-    kind: StatefulSet
-    name: teleport-agent
-    namespace: teleport
-    jqPathExpressions:
-    - .spec.template.spec.containers[] | select(.name == "teleport").image
-...
-```
-
-### FluxCD deployments
-
-After an automatic update, FluxCD reports a `DriftDetected` event. As a workaround
-to this problem modify the [drift detection](https://fluxcd.io/flux/components/helm/helmreleases/#drift-detection)
-configuration to ignore the difference in image version. Here is an example deployment
-using the name `teleport-agent` and namespace `teleport`.
-
-```yaml
-apiVersion: helm.toolkit.fluxcd.io/v2beta2
-kind: HelmRelease
-metadata:
-  name: teleport-agent
-  namespace: teleport
-spec
-  driftDetection:
-    mode: enabled
-    ignore:
-    - paths: ["/spec/template/spec/containers/0/image"]
-      target:
-        kind: StatefulSet
-        name: teleport-agent
-        namespace: teleport
-...
-```
-
-## Manual updates
-
-This section shows you how to upgrade Teleport manually. You can perform manual
-upgrades on Teleport Auth Service and Proxy Service instances running in
-self-hosted clusters, as well as all Teleport Agents.
-
-### Teleport Agents
-
-1. Identify the latest compatible Teleport Agent version by querying the
-   `webapi` endpoint of the Teleport Proxy Service, replacing 
-   <Var name="teleport.example.com:443" /> with the host and port of your
-   Teleport account or Teleport Proxy Service:
-
-   ```code
-   $ curl https://<Var name="teleport.example.com:443" />/webapi/automaticupgrades/channel/stable/cloud/version
-   v15.2.1
-   ```
-
-1. Use the `tctl inventory ls` command to list connected agents along with their
-   current version. Use the `--older-than` flag to list agents that are
-   upgradable:
-
-   ```code
-   $ tctl inventory ls --older-than=v15.2.1
-   Server ID                            Hostname       Services       Version Upgrader
-   ------------------------------------ -------------- -------------- ------- --------
-   00000000-0000-0000-0000-000000000000 ip-10-1-6-130  Node           v14.4.5 none
-   00000000-0000-0000-0000-000000000001 teleport-proxy Proxy          v15.2.0 none
-   00000000-0000-0000-0000-000000000002 teleport-auth  Auth,Discovery v15.2.0 none
-   ...
-   ```
-
-1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
-   and run the following `tctl` command to access the host via `tsh`:
-
-   ```code
-   $ HOST=00000000-0000-0000-0000-000000000000
-   $ USER=root
-   $ tsh ssh "${USER?}@${HOST?}"
-   ```
-
-1. On each Linux server, follow the instructions in the [next
-   section](#single-teleport-binaries-on-linux-servers) to install the new
-   version of the `teleport` binary.
-
-1. If you have deployed any agents on Kubernetes using the `teleport-kube-agent`
-   Helm chart, [follow the instructions](#teleport-agents-running-on-kubernetes)
-   to upgrade the Helm release.
-
-### Single Teleport binaries on Linux servers
-
-You can upgrade a single Teleport binary running on a Linux host by running the
-one-line installation script with a higher version than the current one.
-
-Before upgrading Teleport across a self-hosted cluster, read the [Compatibility
-Overview](./overview.mdx) to ensure you are upgrading components in
-the correct order.
-
-Complete the following steps on all servers that run the Auth Service and Proxy
-Service, then on each of your agents:
-
-1. Get the current version:
-
-   ```code
-   $ teleport version
-   ```
-
-1. Assign <Var name="edition" /> to one of the following, depending on your
-   Teleport edition:
-
-   | Edition                           | Value        |
-   |-----------------------------------|--------------|
-   | Teleport Enterprise (Cloud)       | `cloud`      |
-   | Teleport Enterprise (Self-Hosted) | `enterprise` |
-   | Teleport Community Edition        | `oss`        |
-
-1. Assign <Var name="version" /> to the version you want to install.
-
-1. Install the new Teleport version on your Linux server:
-
-   ```code
-   $ curl (=teleport.teleport_install_script_url=) | bash -s <Var name="version" /> <Var name="edition" />
-   ```
-
-   The installation script detects the package manager on your Linux server and
-   uses it to install Teleport binaries. To customize your installation, learn
-   about the Teleport package repositories in the [installation
-   guide](../installation.mdx#linux).
-
-1. Confirm that the version of the `teleport` binary is the one you expect:
-
-   ```code
-   $ teleport version
-   ```
-
-1. Now that you have installed a more recent `teleport` binary on your Auth
-   Service and Proxy Service instances, restart Teleport on these servers to run
-   the new version.
-
-   (!docs/pages/includes/start-teleport.mdx!)
-
-### Self-hosted Teleport clusters on Kubernetes
-
-The instructions in this section assume that you have configured the
-`teleport-cluster` Helm chart with a values file called `values.yaml`, and that
-your `teleport-cluster` release is called `teleport-cluster`. The Auth Service instances
-are restarted simultaneously during the upgrade so there is no need to shrink 
-the number of replicas.
-
-1. Update the Teleport Helm chart repository so you can install the latest
-   version of the `teleport-cluster` chart:
-
-   (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-1. Upgrade the `teleport-cluster` Helm release:
-
-   ```code
-   $ helm upgrade teleport-cluster teleport/teleport-cluster \
-     --version=<Var name="(=teleport.version=)" /> \
-     --values=values.yaml
-   ```
-
-   The `teleport-cluster` Helm chart automatically waits for the previous
-   version of the Proxy Service to stop responding to requests before running a
-   new version of the Auth Service.
-
-### Teleport Agents running on Kubernetes
-
-The instructions in this section assume that you have configured the
-`teleport-kube-agent` Helm chart with a values file called `values.yaml`, and
-that your `teleport-kube-agent` release is called `teleport-agent`.
-
-1. Update the Teleport Helm chart repository so you can install the latest
-   version of the `teleport-kube-agent` chart:
-
-   (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
-
-1. Upgrade the Helm release:
-
-   ```code
-   $ helm -n "teleport" upgrade teleport-agent teleport/teleport-kube-agent \
-     --values=values.yaml \
-     --version=<Var name="(=teleport.version=)" />
-   ```
-
diff --git a/docs/pages/upgrading/upgrading.mdx b/docs/pages/upgrading/upgrading.mdx
index 4efa80e4f08cf..5d8136d1ffd21 100644
--- a/docs/pages/upgrading/upgrading.mdx
+++ b/docs/pages/upgrading/upgrading.mdx
@@ -1,6 +1,9 @@
 ---
 title: Upgrading Teleport
 description: Explains how to upgrade Teleport depending on your environment and edition.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 The guides in this section show you how to upgrade Teleport to a more recent
@@ -13,16 +16,16 @@ compatibility between all components.  For Teleport Enterprise (Cloud) users, se
 managed for you.
 
 If you have a Teleport Enterprise (Cloud) account, you **must** [set up Managed
-Teleport Agent Updates](agent-managed-updates.mdx) to ensure that
+Teleport Agent Updates](agent-managed-updates/agent-managed-updates.mdx) to ensure that
 the version of Teleport running on agents is always compatible with that of the
 Teleport cluster. You can also set up automatic agent upgrades in a self-hosted
 Enterprise cluster.
 
-For more information about upgrading, for example, to upgrade manually, read the
-[Upgrading Reference](upgrading-reference.mdx).
+For more information about upgrading Teleport manually, read
+[Upgrading Manually](upgrading-manual.mdx).
 
-For more information about client tools auto-update, read the
-[Teleport Client Tools Automatic Updates](client-tools-autoupdate.mdx).
+For more information about client tools managed updates, read the
+[Teleport Client Tools Managed Updates](client-tools-managed-updates.mdx).
 
 You can find more information regarding the automatic updates architecture in the
 [Agent Update Management](../reference/architecture/agent-update-management.mdx) page.
diff --git a/docs/pages/usage-billing.mdx b/docs/pages/usage-billing.mdx
index c5e7e304ae8ca..3fb863ab1164a 100644
--- a/docs/pages/usage-billing.mdx
+++ b/docs/pages/usage-billing.mdx
@@ -1,7 +1,9 @@
 ---
 title: Usage Reporting and Billing
 description: Provides a detailed breakdown of Teleport usage reporting and billing.
-tocDepth: 3
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Commercial editions of Teleport send anonymized usage data to Teleport so we can
@@ -59,7 +61,7 @@ The code that aggregates and anonymizes this data can be found in our [GitHub
 repository](https://github.com/gravitational/teleport/tree/master/lib/usagereporter/teleport/aggregating).
 
 For a restricted network environment you can configure Teleport Auth Service instances
-to send usage data through a proxy for version 16.0.4/15.4.7/14.3.21 or later.
+to send usage data through a proxy for version 16.0.4/15.4.7 or later.
 Set the `TELEPORT_REPORTING_HTTPS_PROXY` and `TELEPORT_REPORTING_HTTP_PROXY`
 environment variables to your proxy address. That will apply as the HTTP connect
 proxy setting overriding `HTTPS_PROXY` and `HTTP_PROXY` just for outbound usage reporting.
@@ -72,6 +74,7 @@ calculate three types of billing metrics:
 - Monthly Active Users
 - Teleport Protected Resources
 - Machine & Workload Identities
+- Identity Governance Monthly Active Users
 
 ### Usage metrics in the Web UI
 
@@ -135,7 +138,7 @@ for the entire hour, Teleport would report 30 protected servers.
 The Machine and Workload Identity (MWI) metric is an aggregate of
 * [Bots](reference/architecture/machine-id-architecture.mdx#what-is-a-bot)
 * [Bot Instances](reference/architecture/machine-id-architecture.mdx#what-is-a-bot)
-* [SPIFFE IDs](enroll-resources/workload-identity/spiffe.mdx#spiffe-ids-and-trust-domains)
+* [SPIFFE IDs](machine-workload-identity/workload-identity/spiffe.mdx#spiffe-ids-and-trust-domains)
 
 We aggregate Bots, Bot Instances and unique SPIFFE IDs during each day on an hourly basis, and take
 an hourly average to compute a daily Bot, Bot Instance and SPIFFE ID count. Then we average the daily
@@ -155,6 +158,21 @@ as one SPIFFE ID for billing.
 The sum of your calculated Bots, Bot Instances, and unique SPIFFE IDs is your
 total MWI for the billing period.
 
+### Identity Governance Monthly Active Users
+
+Identity Governance Monthly Active Users (IG MAU) is the aggregate number of unique users performing Identity Governance-related activities in Teleport.
+
+We aggregate IG MAU over each monthly period starting on the subscription start date and ending on each monthly anniversary thereafter.
+
+Identity Governance "active user" means a user having performed any of the following activities:
+- Submitting an Access Request
+- Reviewing an Access Request
+- Getting roles assigned during login through Access List membership
+- Reviewing an Access List
+- Logging in to a service provider application via Teleport SAML IdP
+
+IG MAU is calculated separately from standard MAU and represents users specifically engaging with Teleport's Identity Governance features. A user can contribute to both standard MAU and IG MAU billing metrics within the same period if they perform activities that qualify for both metrics.
+
 ## Usage measurement for billing
 
 We aggregate all counts of the billing metrics on a monthly basis starting on
@@ -205,10 +223,10 @@ usage numbers.
 ### SSO users
 
 In Teleport, single sign-on (SSO) users are
-[ephemeral](reference/user-types.mdx#temporary-users). Teleport deletes an SSO user
+[ephemeral](reference/access-controls/user-types.mdx#temporary-users). Teleport deletes an SSO user
 when its session expires. To count the number of SSO users in your cluster, you
 can examine Teleport audit events for unique SSO users that have authenticated
 to Teleport during a given time period. The Teleport documentation includes
-[how-to guides](./admin-guides/management/export-audit-events/export-audit-events.mdx) for
+[how-to guides](zero-trust-access/export-audit-events/export-audit-events.mdx) for
 exporting audit events to common log management solutions so you can identify
 users that have authenticated using an SSO provider.
diff --git a/docs/pages/admin-guides/api/api.mdx b/docs/pages/zero-trust-access/api/api.mdx
similarity index 88%
rename from docs/pages/admin-guides/api/api.mdx
rename to docs/pages/zero-trust-access/api/api.mdx
index c376b1271bfb0..2122ce145e06e 100644
--- a/docs/pages/admin-guides/api/api.mdx
+++ b/docs/pages/zero-trust-access/api/api.mdx
@@ -1,7 +1,9 @@
 ---
 title: Using the Teleport API
 description: Guides to writing a client application for the Teleport gRPC API, which makes it possible to programmatically manage dynamic resources.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - zero-trust
 ---
 
 The Teleport Auth Service provides a gRPC API for remotely interacting with your
@@ -17,7 +19,7 @@ the same API.
 Here is what you can do with the Go Client:
 
  - Integrate with external tools, e.g., to write an [Access Request
-   plugin](../access-controls/access-request-plugins/access-request-plugins.mdx). Teleport
+   plugin](../../identity-governance/access-requests/plugins/plugins.mdx). Teleport
    maintains Access Request plugins for tools like Slack, Jira, and Mattermost.
  - Perform CRUD actions on resources, such as roles, authentication connectors,
    and provisioning tokens.
@@ -41,6 +43,6 @@ Teleport's API client libraries:
 - [Automatically generate Teleport roles](./rbac.mdx) from an external RBAC
   system, making it easier to get started with Teleport-based RBAC and keep your
   Teleport roles up to date.
-- [Write an Access Request Plugin](./access-plugin.mdx): Follow this guide for a
+- [Write an Access Request Plugin](../../identity-governance/access-requests/plugins/how-to-build.mdx): Follow this guide for a
   minimal working example of a plugin that you can use to manage Access Requests
   through your organization's unique communication workflows.
diff --git a/docs/pages/admin-guides/api/automatically-register-agents.mdx b/docs/pages/zero-trust-access/api/automatically-register-agents.mdx
similarity index 98%
rename from docs/pages/admin-guides/api/automatically-register-agents.mdx
rename to docs/pages/zero-trust-access/api/automatically-register-agents.mdx
index 56d3e50ffad35..87d797aac2d94 100644
--- a/docs/pages/admin-guides/api/automatically-register-agents.mdx
+++ b/docs/pages/zero-trust-access/api/automatically-register-agents.mdx
@@ -1,6 +1,11 @@
 ---
 title: Automatically Register Resources with Teleport
+sidebar_label: Custom Auto-Discovery
 description: Learn how to use the Teleport API to start agents automatically when you add resources to your infrastructure.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 You can use Teleport's API to automatically register resources in your
@@ -9,7 +14,7 @@ infrastructure with your Teleport cluster.
 Teleport already supports the automatic discovery of [Kubernetes
 clusters](../../enroll-resources/auto-discovery/kubernetes/kubernetes.mdx) in AWS, Azure, and
 Google Cloud, as well as
-[servers](../../enroll-resources/auto-discovery/servers/ec2-discovery.mdx) on
+[servers](../../enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery.mdx) on
 Amazon EC2.  To support other resources and cloud providers, you can use the API
 to write your own workflow.
 
@@ -973,7 +978,6 @@ and other tasks.
 
 In this example, we used the `tctl auth sign` command to fetch credentials for
 the program you wrote. For production usage, we recommend provisioning
-short-lived credentials via Machine ID, which reduces the risk of these
-credentials becoming stolen. View our [Machine ID
-documentation](../../enroll-resources/machine-id/introduction.mdx) to learn more.
-
+short-lived credentials via Machine & Workload Identity, which reduces the risk
+of these credentials becoming stolen. View our [Machine & Workload Identity
+documentation](../../machine-workload-identity/introduction.mdx) to learn more.
diff --git a/docs/pages/zero-trust-access/api/getting-started.mdx b/docs/pages/zero-trust-access/api/getting-started.mdx
new file mode 100644
index 0000000000000..7cb30ba79860a
--- /dev/null
+++ b/docs/pages/zero-trust-access/api/getting-started.mdx
@@ -0,0 +1,145 @@
+---
+title: API Getting Started Guide
+sidebar_label: Get Started
+description: Get started working with the Teleport API programmatically using Go.
+tags:
+ - get-started
+ - mwi
+---
+
+In this getting started guide we will use the Teleport API Go client to connect
+to a Teleport Auth Service.
+
+Here are the steps we'll walkthrough:
+
+- Create an API user using a simple role-based authentication method.
+- Generate credentials for that user.
+- Create and connect a Go client to interact with Teleport's API.
+
+## How it works
+
+The Teleport Auth Service exposes a gRPC API that allows client tools to manage
+backend resources. `tctl`, the Teleport Kubernetes Operator, and the Teleport
+Terraform provider use this API, and you can write custom tools to manage API
+resources or subscribe to Teleport audit events. 
+
+Teleport API clients authenticate to Teleport using TLS credentials. In this
+guide, we show you how to load the TLS credentials that the Auth Service
+provides to you after you log in using `tsh`.
+
+## Prerequisites
+
+- Install [Go](https://golang.org/doc/install) (=teleport.golang=)+ and Go development environment.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Create a user
+
+(!docs/pages/includes/permission-warning.mdx!)
+
+<Admonition type="tip" title="Tip">
+  Read [API authorization](../../reference/architecture/api-architecture.mdx) to learn more about defining custom roles for your API client.
+</Admonition>
+
+Create a user `api-admin` with the built-in role `editor`:
+
+```code
+$ tctl users add api-admin --roles=editor
+```
+
+## Step 2/3. Generate client credentials
+
+Log in as the newly created user with `tsh`.
+
+```code
+# generate tsh profile
+$ tsh login --user=api-admin --proxy=tele.example.com
+```
+
+The [Profile Credentials loader](https://pkg.go.dev/github.com/gravitational/teleport/api/client#LoadProfile)
+will automatically retrieve Credentials from the current profile in the next step.
+
+## Step 3/3. Create a Go project
+
+Set up a new [Go module](https://golang.org/doc/tutorial/create-module) and import the `client` package:
+
+```code
+$ mkdir client-demo && cd client-demo
+$ go mod init client-demo
+$ go get github.com/gravitational/teleport/api/client
+```
+
+<Admonition type="tip" title="API Version">
+To ensure compatibility, you should use a version of Teleport's API library that matches
+the major version of Teleport running in your cluster.
+
+To find the pseudoversion appropriate for a go.mod file for a specific git tag,
+run the following command from the `teleport` repository:
+
+```code
+$ go list -f '{{.Version}}' -m "github.com/gravitational/teleport/api@$(git rev-parse v12.1.0)"
+v0.0.0-20230307032901-49a6de744a3a
+```
+</Admonition>
+
+Create a file called `main.go`, modifying the `Addrs` strings as needed:
+
+```go
+package main
+
+import (
+	"context"
+	"log"
+
+	"github.com/gravitational/teleport/api/client"
+)
+
+func main() {
+	ctx := context.Background()
+
+	clt, err := client.New(ctx, client.Config{
+		Addrs: []string{
+			// Teleport Cloud customers should use <tenantname>.teleport.sh
+			"tele.example.com:443",
+			"tele.example.com:3025",
+			"tele.example.com:3024",
+			"tele.example.com:3080",
+ 		},
+		Credentials: []client.Credentials{
+			client.LoadProfile("", ""),
+		},
+	})
+
+	if err != nil {
+		log.Fatalf("failed to create client: %v", err)
+	}
+
+	defer clt.Close()
+	resp, err := clt.Ping(ctx)
+	if err != nil {
+		log.Fatalf("failed to ping server: %v", err)
+	}
+
+	log.Printf("Example success!")
+	log.Printf("Example server response: %v", resp)
+	log.Printf("Server version: %s", resp.ServerVersion)
+}
+```
+
+Now you can run the program and connect the client to the Teleport Auth Service to fetch the server version.
+
+```code
+$ go run main.go
+```
+
+## Next steps
+
+- Learn about [pkg.go.dev](https://pkg.go.dev/github.com/gravitational/teleport/api/client)
+- Learn how to use [the client](https://pkg.go.dev/github.com/gravitational/teleport/api/client#Client)
+- Learn how to [work with credentials](https://pkg.go.dev/github.com/gravitational/teleport/api/client#Credentials)
+- Read about Teleport [API architecture](../../reference/architecture/api-architecture.mdx) for an in-depth overview of the API and API clients.
+- Read [API authorization](../../reference/architecture/api-architecture.mdx) to learn more about defining custom roles for your API client.
+- Review the `client` [pkg.go reference documentation](https://pkg.go.dev/github.com/gravitational/teleport/api/client) for more information about working with the Teleport API programmatically.
+- Familiarize yourself with the [admin manual](../../index.mdx) to make the best use of the API.
diff --git a/docs/pages/zero-trust-access/api/rbac.mdx b/docs/pages/zero-trust-access/api/rbac.mdx
new file mode 100644
index 0000000000000..537343423d10c
--- /dev/null
+++ b/docs/pages/zero-trust-access/api/rbac.mdx
@@ -0,0 +1,1000 @@
+---
+title: Generate Teleport Roles from an External RBAC System
+sidebar_label: External RBAC Sync
+description: Use Teleport's API to automatically generate Teleport roles based on third-party RBAC policies
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
+---
+
+You can use the Teleport gRPC API to generate roles automatically based on an
+external role-based access control (RBAC) system, such as GitHub or AWS Identity
+and Access Management.
+
+This is especially useful for:
+
+- Setting up a new Teleport cluster, since you can preserve your existing
+  authorization levels or categories while letting Teleport handle access
+  control.
+- Ensuring that your Teleport cluster stays up to date with the RBAC systems of
+  the infrastructure it manages access to. This way, Teleport roles do not
+  unexpectedly gain or lose permissions if your teams reconfigure your external
+  RBAC systems.
+
+## How it works
+
+In this guide, we will build a small demo application to show you how to
+generate Teleport roles using Teleport's API client library. 
+
+The application authenticates to the Teleport Auth Service gRPC API as well as
+your Kubernetes API server, and loads the role bindings and cluster role
+bindings from the Kubernetes API server. For each role binding and cluster role
+binding, the application generates a Teleport role using logic that maps the
+fields in the former to the fields in the latter.
+
+<Admonition type="danger">
+
+The program we will build in this guide is intended as a learning tool. **Do not
+connect it to your production Teleport cluster.**  Use a demo cluster instead.
+
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- Go version (=teleport.golang=) or above installed on your workstation. See the
+  [Go download page](https://go.dev/dl/). You will not need to be familiar with
+  Go to complete this guide, though Go knowledge is required if you want to
+  build a production-ready Teleport client application.
+
+In a production scenario, you will already have a third-party RBAC solution to
+use as a basis for generating Teleport roles. In this guide, we will simulate
+this by deploying a local Kubernetes cluster using `minikube` and setting up
+some RBAC resources. We will then use this Kubernetes cluster to generate
+Teleport roles.
+
+To run the local demo environment, ensure that you have the following tools
+installed on your workstation:
+
+| Tool     | Purpose                          | Installation link                                             |
+|----------|----------------------------------|---------------------------------------------------------------|
+| minikube | Local Kubernetes deployment tool | [Install minikube](https://minikube.sigs.k8s.io/docs/start/)  |
+| Helm     | Kubernetes package manager       | [Install Helm](https://helm.sh/docs/intro/install/)           |
+| kubectl  | Kubernetes admin CLI             | [Install kubectl](https://kubernetes.io/docs/tasks/tools/)    |
+| Docker   | Required minikube driver         | [Get Started With Docker](https://www.docker.com/get-started) |
+<Admonition type="tip">
+
+Even if you do not plan to set up the demo project, you can follow this guide to
+see which libraries, types, and functions you can use to automatically generate
+Teleport roles based on an external RBAC system.
+
+</Admonition>
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/4. Set up your Kubernetes cluster
+
+In this step, we will launch a local Kubernetes cluster and set up role-based
+access controls within it. We will then use this Kubernetes cluster as a basis
+for generating Teleport roles.
+
+### Start minikube
+
+Start minikube with the Docker driver, which boots a local Kubernetes cluster on
+a single Docker container:
+
+```code
+$ minikube start --driver=docker
+```
+
+This command should start a local Kubernetes cluster and set your context (i.e.,
+the Kubernetes cluster you are currently interacting with) to `minikube`. To
+verify this, run the following command:
+
+```code
+$ kubectl config current-context
+minikube
+```
+
+### Define demo Kubernetes RBAC resources
+
+Next, we will set up RBAC resources in your local `minikube` cluster to use as a
+basis for generating Teleport roles.
+
+In Kubernetes, you can divide a cluster into logically isolated **namespaces**.
+A **role** defines a set of permissions for manipulating resources in a specific
+namespace. A **cluster role** is a role that applies to all namespaces in a
+cluster. You can use a **role binding** or **cluster role binding** to attach a
+role or cluster role to Kubernetes users and groups.
+
+Define a Kubernetes role and role binding that allows users in the
+`app-developer` group to read and list pods in the `app` namespace. Add the
+following to a file called `pod-reader.yaml`:
+
+```yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: app
+  name: pod-reader
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-pods
+  namespace: app
+  annotations:
+    'create-teleport-role': 'true'
+subjects:
+- kind: Group
+  name: app-developer
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: pod-reader
+  apiGroup: rbac.authorization.k8s.io
+```
+
+Create the resources:
+
+```code
+$ kubectl apply -f pod-reader.yaml
+namespace/app created
+role.rbac.authorization.k8s.io/pod-reader created
+rolebinding.rbac.authorization.k8s.io/read-pods created
+```
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+Next, define a cluster role and cluster role binding that allow users in the
+`ops` group to read, create, and execute commands on pods in all namespaces. Add
+the following to a file called `pod-ops.yaml`:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pod-ops
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "create", "exec", "logs"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pod-ops
+  annotations:
+    'create-teleport-role': 'true'
+subjects:
+- kind: Group
+  name: ops
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: pod-ops
+  apiGroup: rbac.authorization.k8s.io
+```
+
+Create the resources:
+
+```code
+$ kubectl apply -f pod-ops.yaml
+clusterrole.rbac.authorization.k8s.io/pod-ops created
+clusterrolebinding.rbac.authorization.k8s.io/pod-ops created
+```
+
+Later in this guide, we will show you how to automatically generate Teleport
+roles based on the Kubernetes RBAC resources you created.
+
+### Define RBAC resources for the client application
+
+Next, ensure that your API client can read the RBAC resources you created.
+Create a file called `rbac-sync.yaml` with the following content:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rbac-sync
+rules:
+- apiGroups: ["rbac.authorization.k8s.io"]
+  resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: rbac-sync
+subjects:
+- kind: User
+  name: sync-kubernetes-rbac
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: rbac-sync
+  apiGroup: rbac.authorization.k8s.io
+```
+
+Apply the changes:
+
+```code
+$ kubectl apply -f rbac-sync.yaml
+clusterrole.rbac.authorization.k8s.io/rbac-sync created
+clusterrolebinding.rbac.authorization.k8s.io/rbac-sync created
+```
+
+## Step 2/4. Set up Teleport
+
+In this step, you will configure Teleport to enable your API client application
+to interact with your Kubernetes cluster.
+
+### Create a user and role for the client application
+
+Give the client application a Teleport user and role that can retrieve
+information about a Kubernetes cluster that is registered with Teleport,
+authenticate to the cluster, and create or update Teleport roles.
+
+Create a file called `sync-kubernetes-rbac.yaml` with the following content:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: sync-kubernetes-rbac
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_users:
+      - sync-kubernetes-rbac
+    kubernetes_resources:
+      - kind: pod
+        name: '*'
+        namespace: '*'
+    rules:
+      - resources: ['kubernetes_cluster']
+        verbs: ['read']
+      - resources: ['role']
+        verbs: ['create', 'update']
+---
+kind: user
+metadata:
+  name: sync-kubernetes-rbac
+spec:
+  roles: ['sync-kubernetes-rbac']
+version: v2
+```
+
+Create the user and role:
+
+```code
+$ tctl create -f sync-kubernetes-rbac.yaml
+role 'sync-kubernetes-rbac' has been created
+user "sync-kubernetes-rbac" has been created
+```
+
+### Enable impersonation of the client application
+
+As with all Teleport users, the Teleport Auth Service authenticates the
+`sync-kubernetes-rbac` user by issuing short-lived TLS credentials. In this
+case, we will request the credentials manually by *impersonating* the
+`sync-kubernetes-rbac` role and user.
+
+If you are running a self-hosted Teleport Enterprise deployment and are using
+`tctl` from the Auth Service host, you will already have impersonation
+privileges.
+
+To grant your user impersonation privileges for `sync-kubernetes-rbac`, define a role
+called `sync-kubernetes-rbac-impersonator` by pasting the following YAML document into
+a file called `sync-kubernetes-rbac-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: sync-kubernetes-rbac-impersonator
+spec:
+  allow:
+    impersonate:
+      roles:
+      - sync-kubernetes-rbac
+      users:
+      - sync-kubernetes-rbac
+```
+
+Create the `sync-kubernetes-rbac-impersonator` role:
+
+```code
+$ tctl create -f sync-kubernetes-rbac-impersonator.yaml
+```
+
+(!docs/pages/includes/add-role-to-user.mdx role="sync-kubernetes-rbac-impersonator"!)
+
+You will now be able to generate signed certificates for the `sync-kubernetes-rbac`
+role and user.
+
+### Install the Teleport Kubernetes Service
+
+We will enable your client application to communicate with your Kubernetes
+cluster via the Teleport Kubernetes Service, which forwards requests after
+authorizing them. While this step is not strictly necessary with a local
+`minikube` cluster, it demonstrates one way to use Teleport to securely access
+your external RBAC system's API.
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+Request a token that the Kubernetes Service will use to join your Teleport
+cluster:
+
+```code
+$ tctl tokens add --type=kube,app,discovery --format=text
+```
+
+Copy this token so you can use it when running the Teleport Kubernetes Service.
+
+Ensure that you are connected to the right Kubernetes cluster (logging into
+Teleport earlier will have changed your Kubernetes context):
+
+```code
+$ kubectl config use-context minikube
+Switched to context "minikube".
+```
+
+Install the Teleport Kubernetes Service in your cluster, assigning <Var
+name="proxy-address" /> to the host **and port** of your Teleport Proxy Service
+(e.g., `mytenant.teleport.sh:443`) and <Var name="token" /> to the token you
+requested earlier:
+
+```code
+$ helm install teleport-agent teleport/teleport-kube-agent \
+  --set kubeClusterName=minikube \
+  --set roles="kube\,app\,discovery" \
+  --set proxyAddr=<Var name="proxy-address" /> \
+  --set authToken=<Var name="token" /> \
+  --create-namespace \
+  --namespace=teleport-agent \
+  --set labels.environment=demo \
+  --version (=teleport.version=)
+```
+
+After a few seconds, verify that you have deployed the Teleport Kubernetes
+Service by running the following command:
+
+```code
+$ kubectl -n teleport-agent get pods
+```
+
+This should show that the Kubernetes Service is running:
+
+```text
+NAME               READY   STATUS    RESTARTS   AGE
+teleport-agent-0   1/1     Running   0          22s
+```
+
+`tsh` should indicate that the cluster has registered with Teleport:
+
+```code
+$ tsh kube ls
+Kube Cluster Name Labels           Selected
+----------------- ---------------- --------
+minikube          environment=demo
+```
+
+## Step 3/4. Write the client application
+
+At this point, we have set up an external RBAC system to use for generating
+Teleport roles and configured Teleport to allow our API client to interact with
+our Kubernetes cluster and Teleport cluster. In this step, we will write our
+client application.
+
+### Set up your Go project
+
+Download the source code for the API client application:
+
+```code
+$ git clone --depth=1 https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
+$ cd teleport/examples/api-sync-roles
+```
+
+For the rest of this guide, we will show you how to set up the client
+application and explore the ways it uses Teleport's API to automatically
+generate Teleport roles.
+
+### Export identity files for the client application
+
+The `sync-kubernetes-rbac` user needs signed credentials in order to connect to
+your Teleport cluster as well as your Kubernetes cluster. You will use the `tctl
+auth sign` command to request these credentials for your API client.
+
+#### Connecting to your Teleport cluster
+
+The following `tctl auth sign` command impersonates the `sync-kubernetes-rbac`
+user, generates signed credentials, and writes an identity file to the local
+directory:
+
+```code
+$ tctl auth sign --user=sync-kubernetes-rbac --out=auth.pem
+```
+
+The identity file, `auth.pem`, includes both TLS and SSH credentials. Your
+client application uses the SSH credentials to connect to the Proxy Service,
+which establishes a reverse tunnel connection to the Auth Service. The client
+application uses this reverse tunnel, along with your TLS credentials, to
+connect to the Auth Service's gRPC endpoint.
+
+#### Connecting to the Kubernetes cluster
+
+You will also need to give the client application a way to authenticate to your
+Kubernetes cluster. To do this, use Teleport's certificate authority to sign
+credentials for the `sync-kubernetes-rbac` user. Your API client will present
+these credentials to authenticate to the Teleport Kubernetes Service, which will
+proxy requests to the Kubernetes cluster.
+
+Run the following command, ensuring that <Var name="proxy-address" /> includes
+the host and port of your Proxy Service:
+
+```code
+$ tctl auth sign --user=sync-kubernetes-rbac \
+  --kube-cluster-name=minikube \
+  --format=kubernetes \
+  --proxy=https://<Var name="proxy-address" /> \
+  --out=kubeconfig
+```
+
+### Imports
+
+In the `api-sync-roles` directory, open `main.go`, which contains the API client
+program we demonstrate in this guide.
+
+Here are the packages our client application imports from Go's standard library:
+
+|Package|Description|
+|---|---|
+| `context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata.|
+|`fmt`|Formatting data for printing, strings, or errors.|
+|`io`|Dealing with I/O operations, e.g., reading files or network sockets.|
+|`os`|Interacting with the operating system, e.g., to open files.|
+|`time`|Dealing with time. We will use this to define a timeout for connecting to the Auth Service along with a ticker for executing our discovery logic in a loop.|
+
+The client imports the following third-party code:
+
+|Package|Description|
+|---|---|
+|`github.com/gravitational/teleport/api/client`|A library for authenticating to the Auth Service's gRPC API and making requests, aliased as `teleport`.|
+|`github.com/gravitational/teleport/api/types`|Types used in the Auth Service API, e.g., Application Service records.|
+|`github.com/gravitational/trace`|Presenting errors with more useful detail than the standard library provides.|
+|`google.golang.org/grpc`|The gRPC client and server library.|
+|`k8s.io/api/rbac/v1`|The Kubernetes RBAC API client library.|
+|`k8s.io/apimachinery/pkg/apis/meta/v1`|Code common to Kubernetes' API client libraries.|
+|`k8s.io/client-go/kubernetes`|Setting up an general-purpose Kubernetes client.|
+|`k8s.io/client-go/kubernetes/typed/rbac/v1`|Types for the Kubernetes RBAC API.|
+|`k8s.io/client-go/tools/clientcmd`|Another general-purpose Kubernetes client library.|
+
+### Constants
+
+The program defines constants in a visible location so, later on, it's easier to
+make them configurable outside the program:
+
+```go
+const (
+	proxyAddr         string = ""
+	initTimeout              = time.Duration(30) * time.Second
+	identityFilePath  string = "auth.pem"
+	kubeconfigPath    string = "kubeconfig"
+	clusterName       string = "minikube"
+	roleAnnotationKey string = "create-teleport-role"
+)
+```
+
+We will use these constants later in the program. They define some values we may
+want to change later, including:
+
+|Constant|Description|
+|---|---|
+|`proxyAddr`|The host and port of the Teleport Proxy Service, e.g., `mytenant.teleport.sh:443`, which we will use to connect the client to your cluster. **Assign this to your own Proxy Service's host and port:** <Var name="proxy-address" /> |
+|`initTimeout`|The timeout for connecting to the Teleport cluster. We have defined this as 30 seconds.|
+|`identityFilePath`|The path to the Teleport identity file you created earlier.|
+|`clusterName`|The name of the Kubernetes cluster you will fetch RBAC resources from. In this guide, the cluster's name is `minikube`.|
+|`roleAnnotationKey`|In Kubernetes, annotations are arbitrary key/value pairs that you can add to resources. The role and cluster role bindings we created earlier have the annotation key we specify here so our client application can fetch them.|
+
+### Initializing a Kubernetes RBAC client
+
+To contact the Kubernetes API, we will need to set up an HTTP client. The client
+authenticates to the API using mutual TLS, loading a client certificate,
+certificate authority, and private key from the file at `kubeconfigPath`.
+Earlier in the guide, we requested this from the Teleport Auth Service.
+
+The program sets up a Kubernetes API client with the `getRBACClient` function:
+
+```go
+func getRBACClient() (v1.RbacV1Interface, error) {
+	f, err := os.Open(kubeconfigPath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	kc, err := io.ReadAll(f)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	n, err := clientcmd.RESTConfigFromKubeConfig(kc)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	c, err := kubernetes.NewForConfig(n)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return c.RbacV1(), nil
+}
+```
+
+`getRBACClient` opens and reads the Kubernetes credentials file at
+`kubeconfigPath`, then uses the file to set up a Kubernetes API client
+configuration (`clientcmd.RESTConfigFromKubeConfig(kc)`) and, with that, an HTTP
+client (`kubernetes.NewForConfig(n)`).
+
+Finally, it returns an interface to the Kubernetes API dedicated to role-based
+access controls, which the rest of the program uses to interact with your
+Kubernetes cluster.
+
+### Creating a Teleport role from a Kubernetes cluster role binding
+
+The `createTeleportRoleFromClusterRoleBinding` function creates a Teleport role
+from a Kubernetes cluster role binding by populating fields in the former based
+on fields in latter:
+
+```go
+func createTeleportRoleFromClusterRoleBinding(teleport *client.Client, k types.KubeCluster, r rbacv1.ClusterRoleBinding) error {
+	if e, ok := r.Annotations[roleAnnotationKey]; !ok || e != "true" {
+		return nil
+	}
+
+	role := types.RoleV6{}
+	role.SetMetadata(types.Metadata{
+		Name: k.GetName() + "-" + r.RoleRef.Name + "-" + "cluster",
+	})
+
+	b := k.GetStaticLabels()
+	labels := make(types.Labels)
+	for k, v := range b {
+		labels[k] = []string{v}
+	}
+	role.SetKubernetesLabels(types.Allow, labels)
+	role.SetKubeResources(types.Allow, []types.KubernetesResource{
+		types.KubernetesResource{
+			Kind:      "pod",
+			Namespace: "*",
+			Name:      "*",
+		},
+	})
+
+	var g []string
+	var u []string
+	for _, s := range r.Subjects {
+		if s.Kind == "User" || s.Kind == "ServiceAccount" {
+			u = append(u, s.Name)
+			continue
+		}
+		if s.Kind == "Group" {
+			g = append(g, s.Name)
+			continue
+		}
+	}
+	role.SetKubeGroups(types.Allow, g)
+	role.SetKubeUsers(types.Allow, u)
+	if err := teleport.UpsertRole(
+		context.Background(),
+		&role,
+	); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Println("Upserted Teleport role:", role.GetName())
+	return nil
+}
+```
+
+To avoid unexpected behavior, this function ignores Kubernetes-managed roles and
+roles for internal systems like the Teleport Kubernetes Service. This function
+checks the cluster role binding's metadata for an annotation with a specific
+key, `roleAnnotationKey`, and ignores any resource where this key is not set to
+`"true"`.
+
+We also want a quick way to identify roles we created with this program. To do
+so, this function names all roles it generates based on cluster role bindings
+according to the following attributes:
+
+- Kubernetes cluster name
+- Kubernetes role name
+- The suffix `-cluster`.
+
+In our demo application, this function will create a Teleport role called
+`minikube-pod-ops-cluster`.
+
+The rest of the function assigns fields to a `types.RoleV6`, the Teleport API
+client's role type, based on the cluster role binding:
+
+|Role field|Purpose|How we assign it|
+|---|---|---|
+|`allow.kubernetes_labels`|Labels for Teleport-registered Kubernetes clusters that a user with this role is allowed to access.|Based on the Teleport-registered Kubernetes cluster that the cluster role binding belongs to.|
+|`allow.kubernetes_resources`|Kubernetes pods in specific namespaces that that a user with this role is allowed to access.|Allow access to all namespaces, since cluster role bindings are not restricted by namespace.|
+|`allow.kubernetes_users` and `allow.kubernetes_groups`|The Kubernetes groups and users that a Teleport user with this role will assume when interacting with the Kubernetes cluster.|Supply the names of any users or groups connected to the cluster role binding.|
+
+### Creating a Teleport role from a Kubernetes role binding
+
+As with cluster role bindings, this program will also create Teleport roles
+based on Kubernetes role bindings:
+
+```go
+func createTeleportRoleFromRoleBinding(teleport *client.Client, k types.KubeCluster, r rbacv1.RoleBinding) error {
+	if e, ok := r.Annotations[roleAnnotationKey]; !ok || e != "true" {
+		return nil
+	}
+
+	role := types.RoleV6{}
+	role.SetMetadata(types.Metadata{
+		Name: k.GetName() + "-" + r.RoleRef.Name + "-" + r.Namespace,
+	})
+
+	b := k.GetStaticLabels()
+	labels := make(types.Labels)
+	for k, v := range b {
+		labels[k] = []string{v}
+	}
+	role.SetKubernetesLabels(types.Allow, labels)
+	role.SetKubeResources(types.Allow, []types.KubernetesResource{
+		types.KubernetesResource{
+			Kind:      "pod",
+			Namespace: r.Namespace,
+			Name:      "*",
+		},
+	})
+	var g []string
+	var u []string
+	for _, s := range r.Subjects {
+		if s.Kind == "User" || s.Kind == "ServiceAccount" {
+			u = append(u, s.Name)
+			continue
+		}
+		if s.Kind == "Group" {
+			g = append(g, s.Name)
+			continue
+		}
+	}
+	role.SetKubeGroups(types.Allow, g)
+	role.SetKubeUsers(types.Allow, u)
+
+	if err := teleport.UpsertRole(
+		context.Background(),
+		&role,
+	); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Println("Upserted Teleport role:", role.GetName())
+	return nil
+}
+```
+
+While the overall behavior of this function is the same as
+`createTeleportRoleFromClusterRoleBinding`, Kubernetes role bindings require
+some differences in how we assign fields to Teleport roles:
+
+- When setting the name of the role, we use the role binding's namespace as the
+  suffix, rather than `-cluster`, to indicate the namespace that this role
+  applies to.
+- In the role's `kubernetes_resources` field, the value has the same namespace
+  as the role binding, rather than applying to all namespaces.
+
+### Creating Teleport roles based on Kubernetes resources
+
+Now that we have functions to create Teleport roles based on individual
+Kubernetes RBAC resources, we can fetch all RBAC resources from our Kubernetes
+cluster and call these functions:
+
+```go
+func createTeleportRolesForKubeCluster(teleport *client.Client, k types.KubeCluster) error {
+	rbac, err := getRBACClient()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	crb, err := rbac.ClusterRoleBindings().List(
+		context.Background(),
+		metav1.ListOptions{},
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, i := range crb.Items {
+		if err := createTeleportRoleFromClusterRoleBinding(teleport, k, i); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	rb, err := rbac.RoleBindings("").List(
+		context.Background(),
+		metav1.ListOptions{},
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, i := range rb.Items {
+		if err := createTeleportRoleFromRoleBinding(teleport, k, i); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+```
+
+`createTeleportRolesForKubeCluster` takes a Teleport client and a
+Teleport-registered Kubernetes cluster. It calls the `getRBACClient` function we
+defined earlier to set up a client for the Kubernetes cluster. It then:
+
+- Lists Kubernetes cluster role bindings and creates a Teleport role for each one.
+- Lists Kubernetes role bindings and creates a Teleport role for each one.
+
+### Initializing clients and start the application
+
+The functions we declared earlier require a Teleport API client and a
+Teleport-registered Kubernetes cluster, and we initialize these in the
+entrypoint of the program, the `main` function:
+
+```go
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), initTimeout)
+	defer cancel()
+	creds := client.LoadIdentityFile(identityFilePath)
+
+	teleport, err := client.New(ctx, client.Config{
+		Addrs:       []string{proxyAddr},
+		Credentials: []client.Credentials{creds},
+	})
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println("Connected to Teleport")
+
+	ks, err := teleport.GetKubernetesServers(context.Background())
+	if err != nil {
+		panic(err)
+	}
+	for _, k := range ks {
+		if k.GetCluster().GetName() != clusterName {
+			continue
+		}
+		fmt.Println("Retrieved Kubernetes cluster", clusterName)
+
+		if err := createTeleportRolesForKubeCluster(teleport, k.GetCluster()); err != nil {
+			panic(err)
+		}
+		fmt.Println("Created roles for Kubernetes cluster", clusterName)
+		return
+	}
+	panic("Unable to locate a Kubernetes Service instance for " + clusterName)
+}
+```
+
+`client` is Teleport's library for setting up an API client. Our program
+initializes a Teleport client by calling `client.LoadIdentityFile` to obtain a
+`client.Credentials`. It then uses the `client.Credentials` to call
+`client.New`, which connects to the Teleport Proxy Service specified in the
+`Addrs` field using the provided identity file.
+
+<Admonition type="warning">
+
+This program does not validate your credentials or Teleport cluster address.
+Make sure that:
+
+- The identity file you exported earlier does not have an expired TTL
+- The value you supplied to the `Addrs` field in `teleport.Config` includes both
+  the host **and** the web port of your Teleport Proxy Service, e.g.,
+  `mytenant.teleport.sh:443`
+
+</Admonition>
+
+After initializing a Teleport client, the `main` function fetches all Kubernetes
+servers registered with Teleport (`teleport.GetKubernetesServers`) and checks if
+there is a registered Kubernetes cluster that matches the one you specified.
+
+If a matching Kubernetes cluster exists, the code calls the
+`createTeleportRolesForKubeClusters` function we defined earlier. If not, the
+program prints an error message and a stack trace by calling Go's built-in
+`panic` function.
+
+## Step 4/4. Test your client application
+
+To test the client application, start it up from within its project directory:
+
+```code
+$ go run main.go
+```
+
+You should see the following output:
+
+```text
+Connected to Teleport
+Retrieved Kubernetes cluster minikube
+Upserted Teleport role: minikube-pod-ops-cluster
+Upserted Teleport role: minikube-pod-reader-app
+Created roles for Kubernetes cluster minikube
+```
+
+Examine the new `minikube-pod-ops-cluster` role by running the command below:
+
+```code
+$ tctl get roles/minikube-pod-ops-cluster
+```
+
+You should see output similar to the following:
+
+```yaml
+kind: role
+metadata:
+  id: 1678732494974032643
+  name: minikube-pod-ops-cluster
+spec:
+  allow:
+    kubernetes_groups:
+    - ops
+    kubernetes_labels:
+      environment: demo
+    kubernetes_resources:
+    - kind: pod
+      name: '*'
+      namespace: '*'
+  deny: {}
+  options:
+    cert_format: standard
+    create_host_user: false
+    desktop_clipboard: true
+    desktop_directory_sharing: true
+    enhanced_recording:
+    - command
+    - network
+    forward_agent: false
+    idp:
+      saml:
+        enabled: true
+    max_session_ttl: 30h0m0s
+    pin_source_ip: false
+    ssh_port_forwarding:
+      remote:
+        enabled: true
+      local:
+        enabled: true
+    record_session:
+      default: best_effort
+      desktop: true
+    ssh_file_copy: true
+version: v7
+```
+
+Compare this with the `minikube-pod-reader-app` role, which you can retrieve
+with the following command:
+
+```code
+$ tctl get roles/minikube-pod-reader-app
+```
+
+Here is the role we created:
+
+```yaml
+kind: role
+metadata:
+  id: 1678732495284493075
+  name: minikube-pod-reader-app
+spec:
+  allow:
+    kubernetes_groups:
+    - app-developer
+    kubernetes_labels:
+      environment: demo
+    kubernetes_resources:
+    - kind: pod
+      name: '*'
+      namespace: app
+  deny: {}
+  options:
+    cert_format: standard
+    create_host_user: false
+    desktop_clipboard: true
+    desktop_directory_sharing: true
+    enhanced_recording:
+    - command
+    - network
+    forward_agent: false
+    idp:
+      saml:
+        enabled: true
+    max_session_ttl: 30h0m0s
+    pin_source_ip: false
+    ssh_port_forwarding:
+      remote:
+        enabled: true
+      local:
+        enabled: true
+    record_session:
+      default: best_effort
+      desktop: true
+    ssh_file_copy: true
+version: v7
+```
+
+Since role bindings are namespaced, this role only allows access to pods in the
+`app` namespace, where this role binding was applied. The Kubernetes Service
+forwards traffic from users with this role using the `app-developer` Kubernetes
+group.
+
+## Next steps
+
+We have implemented a Teleport API client that generates Teleport roles based on
+the Kubernetes RBAC system. You can use Teleport's API to build similar
+applications that interact with other RBAC systems, such as GitHub teams or
+groups within your database management system.
+
+Here are some starting points for building out your client application.
+
+### Learn more about Teleport roles
+
+To write an effective client application that generates Teleport roles from an
+external RBAC solution, you should understand the role fields that apply to
+infrastructure resources you want to manage access to.
+
+See the links below for guides to fields related to different infrastructure
+resources:
+
+- [Servers](../../enroll-resources/server-access/rbac.mdx)
+- [Databases](../../enroll-resources/database-access/rbac.mdx)
+- [Kubernetes clusters](../../enroll-resources/kubernetes-access/controls.mdx)
+- [Windows Desktops](../../enroll-resources/desktop-access/rbac.mdx)
+- [Applications](../../enroll-resources/application-access/configuration/controls.mdx)
+
+For general guidance, read our [Access Controls
+Reference](../../reference/access-controls/roles.mdx).
+
+### Register your cloud provider with Teleport
+
+You can protect cloud provider APIs with Teleport and instruct your API client
+applications to connect to these APIs via the Teleport Application Service.
+Using Teleport-protected cloud provider APIs, you can generate Teleport roles
+based on your cloud provider's RBAC solution.
+
+Read our guides for how to set up the Teleport Application Service for cloud
+provider APIs:
+
+- [AWS](../../enroll-resources/application-access/cloud-apis/aws-console.mdx)
+- [Google Cloud](../../enroll-resources/application-access/cloud-apis/google-cloud.mdx)
+- [Azure](../../enroll-resources/application-access/cloud-apis/azure.mdx)
+
+### Consult examples
+
+The Teleport code repository contains [examples of production-ready Teleport API
+clients](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/examples/).
+While we currently do not maintain plugins that generate Teleport
+roles, you can use these examples to see how to implement configuration
+parsing, retries, and other tasks.
+
+### Provision the client application with short-lived credentials
+
+In this example, we used the `tctl auth sign` command to fetch credentials for
+the program you wrote. For production usage, we recommend provisioning
+short-lived credentials via Machine & Workload Identity, which reduces the risk
+of these credentials becoming stolen. View our [Machine & Workload Identity
+documentation](../../machine-workload-identity/introduction.mdx) to learn more.
diff --git a/docs/pages/zero-trust-access/authentication/authentication.mdx b/docs/pages/zero-trust-access/authentication/authentication.mdx
new file mode 100644
index 0000000000000..9dbe6df9dee6a
--- /dev/null
+++ b/docs/pages/zero-trust-access/authentication/authentication.mdx
@@ -0,0 +1,19 @@
+---
+title: Authentication and Session Joining
+description: Provides information on configuring the way users authenticate to your Teleport cluster or join an existing session.
+sidebar_position: 3
+template: "no-toc"
+tags:
+ - zero-trust
+---
+
+Teleport gives you control over how and when users authenticate to your cluster.
+For example, you can configure Teleport to allow passwordless authentication
+with a hardware key or trust an external identity provider. You can also
+configure whether a user can join an existing session with a Kubernetes cluster
+or SSH server, and whether the user must authenticate again in order to do so.
+
+The guides in this section show you how to configure Teleport authentication for
+your organization's needs:
+
+<DocCardList />
diff --git a/docs/pages/admin-guides/access-controls/guides/hardware-key-support.mdx b/docs/pages/zero-trust-access/authentication/hardware-key-support.mdx
similarity index 96%
rename from docs/pages/admin-guides/access-controls/guides/hardware-key-support.mdx
rename to docs/pages/zero-trust-access/authentication/hardware-key-support.mdx
index 7e2d1f524119e..1b4f6e00cf4d6 100644
--- a/docs/pages/admin-guides/access-controls/guides/hardware-key-support.mdx
+++ b/docs/pages/zero-trust-access/authentication/hardware-key-support.mdx
@@ -1,8 +1,18 @@
 ---
 title: Hardware Key Support
 description: Hardware Key Support
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Hardware key support
 ---
 
+This guide explains how to configure Teleport authentication using
+hardware-based private keys.
+
+## How it works
+
 <Admonition type="warning" title="Enterprise">
   Hardware Key Support requires Teleport Enterprise.
 </Admonition>
@@ -64,7 +74,7 @@ like `tctl edit`. With touch required, hardware key support provides better secu
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - A series 5+ YubiKey
 
@@ -233,7 +243,7 @@ While Connect is running, touch and PIN prompts for `tsh` and `tctl` commands wi
 displayed in Teleport Connect instead. These prompts will be brought to the foreground
 to raise attention to the user.
 
-![Agent](../../../../img/access-controls/hardware-key-support/agent.png)
+![Agent](../../../img/access-controls/hardware-key-support/agent.png)
 
 ## PIN Caching
 
@@ -244,7 +254,7 @@ common use cases:
 
 * Proxying kubectl commands, database queries, or app requests through a Teleport local proxy (`tsh proxy kube|db|app`).
 * Running automated scripts which run `tsh` commands in bulk.
-* Connecting to TCP applications with [VNet](../../../connect-your-client/vnet.mdx).
+* Connecting to TCP applications with [VNet](../../connect-your-client/teleport-clients/vnet.mdx).
 * General Teleport Connect usage.
 
 Instead, you can set the cluster-wide `hardware_key.pin_cache_ttl` configuration option to enable
diff --git a/docs/pages/zero-trust-access/authentication/headless.mdx b/docs/pages/zero-trust-access/authentication/headless.mdx
new file mode 100644
index 0000000000000..c7b0f16941e16
--- /dev/null
+++ b/docs/pages/zero-trust-access/authentication/headless.mdx
@@ -0,0 +1,257 @@
+---
+title: Headless Authentication
+description: Headless Authentication
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
+---
+
+Headless Authentication provides a secure way to authenticate with Teleport on
+a machine that does not have the ability to authenticate directly with the
+required mechanisms.
+
+For example:
+
+- Authenticating with [WebAuthn](../management/security/idp-compromise.mdx#set-up-cluster-wide-webauthn) or [SSO MFA](../sso/sso-for-mfa.mdx) from a remote dev box
+- Authenticating with WebAuthn on a machine without a WebAuthn-compatible browser
+- Authenticating with SSO MFA from a browser that is not supported by your SSO provider
+
+<Admonition type="note" title="Headless Authentication Support">
+  Headless Authentication only supports the following `tsh` commands:
+
+  - `tsh ls`
+  - `tsh ssh`
+  - `tsh scp`
+  - `tsh proxy kube`
+
+  In the future, Headless Authentication will be extended to other `tsh` commands.
+</Admonition>
+
+## How it works
+
+In the Headless Authentication flow, a user on a remote machine requests headless
+authentication when running `tsh` commands. `tsh` sends a request to an API path
+on the Teleport Proxy Service, `/webapi/login/headless`, and the Teleport Proxy
+Service sends a request to the Teleport Auth Service to store a headless
+authentication request on its backend. `tsh` then obtains the ID of the request
+and prints a URL containing the ID in the user's terminal. The user accesses the
+URL on their browser and completes an MFA flow with the Teleport Auth Service.
+
+Once the Teleport Auth Service authenticates the user, `tsh` generates a new
+private key in memory, and shares its public key only to obtain user
+certificates. `tsh` then holds user certificates in memory with a one-minute TTL
+to reduce the impact of exfiltration.
+
+## Prerequisites
+
+- A Teleport cluster with [WebAuthn](../management/security/idp-compromise.mdx#set-up-cluster-wide-webauthn) or [SSO MFA](../sso/sso-for-mfa.mdx) configured.
+- Machines for Headless Authentication activities have [Linux](../../installation/installation.mdx), [macOS](../../installation/installation.mdx) or [Windows](../../installation/installation.mdx) `tsh` binary installed.
+- Machines used to approve Headless Authentication requests have a Web browser with [WebAuthn support](
+  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) or `tsh` binary installed.
+- Optional: Teleport Connect for [seamless Headless Authentication approval](#optional-teleport-connect).
+
+## Step 1/3. Configuration
+
+A Teleport cluster capable of WebAuthn or SSO MFA is automatically capable of
+Headless Authentication without any additional configuration.
+
+<details>
+<summary>Optional: make Headless Authentication the default auth connector</summary>
+
+To make Headless Authentication the default authentication method for your Teleport
+Cluster, add `connector_name: headless` to your cluster configuration.
+
+Create a `cap.yaml` file or get the existing configuration using
+`tctl get cluster_auth_preference`:
+
+```yaml
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  type: local
+  second_factors: ["webauthn"]
+  webauthn:
+    rp_id: example.com
+  connector_name: headless # headless by default
+```
+
+Update the configuration:
+
+```code
+$ tctl create -f cap.yaml
+# cluster auth preference has been updated
+```
+</details>
+
+<details>
+<summary>Alternative: disable Headless Authentication</summary>
+
+Headless Authentication is enabled automatically when WebAuthn or SSO MFA is configured.
+If you want to forbid Headless Authentication in your cluster, add `headless: false` to your
+configuration.
+
+Create a `cap.yaml` file or get the existing configuration using
+`tctl get cluster_auth_preference`:
+
+```yaml
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  type: local
+  second_factors: ["webauthn"]
+  webauthn:
+    rp_id: example.com
+  headless: false # disable Headless Authentication
+```
+
+Update the configuration:
+
+```code
+$ tctl create -f cap.yaml
+# cluster auth preference has been updated
+```
+
+</details>
+
+## Step 2/3. Initiate Headless Authentication
+
+Run a headless `tsh` command with the `--headless` flag. This will initiate
+headless authentication, printing a URL and `tsh` command.
+
+```code
+$ tsh ls --headless --proxy=proxy.example.com --user=alice
+# Complete headless authentication in your local web browser:
+#
+# https://proxy.example.com:3080/web/headless/86172f78-af7c-5935-a7c1-ed06b94f17dc
+#
+# or execute this command in your local terminal:
+#
+# tsh headless approve --user=alice --proxy=proxy.example.com 86172f78-af7c-5935-a7c1-ed06b94f17dc
+```
+
+## Step 3/3. Approve Headless Authentication
+
+To approve the headless authentication, click or copy+paste the URL printed by
+`tsh` in your local web browser. You will be prompted to approve the log in with
+MFA verification. Once approved, your initial `tsh --headless <command>`
+should continue as if you had logged in locally.
+
+Unlike a standard login session, headless sessions are only available for the
+lifetime of a single `tsh` request. This means that for each `tsh --headless`
+command, you will need to go through the Headless Authentication flow:
+
+### Example: Listing SSH servers
+```code
+$ tsh ls --headless --proxy=proxy.example.com --user=alice
+# Complete headless authentication in your local web browser:
+#
+# https://proxy.example.com:3080/web/headless/86172f78-af7c-5935-a7c1-ed06b94f17dc
+#
+# or execute this command in your local terminal:
+#
+# tsh headless approve --user=alice --proxy=proxy.example.com 86172f78-af7c-5935-a7c1-ed06b94f17dc
+# # User approves through link
+# Node Name Address        Labels
+# --------- -------------- -----------
+# server01  127.0.0.1:3022 arch=x86_64
+```
+
+### Example: Initiating an SSH session
+```code
+$ tsh ssh --headless --proxy=proxy.example.com --user=alice alice@server01
+# Complete headless authentication in your local web browser:
+#
+# https://proxy.example.com:3080/web/headless/864cccd9-2425-46d9-a9f2-636387e66ebf
+#
+# or execute this command in your local terminal:
+#
+# tsh headless approve --user=alice --proxy=proxy.example.com 864cccd9-2425-46d9-a9f2-636387e66ebf
+# # User approves through link and a ssh terminal starts
+alice@server01 $
+```
+
+<Admonition type="note">
+  The Teleport user, `--user` parameter, is the Teleport user requesting Headless Authentication activity.
+  If no `--user` parameter or environment variables set the OS user in the machine terminal is used.
+
+  The login username, `--login` parameter or login@hostname, for `tsh ssh` commands is the user
+  to open a SSH session as. If no login username for the SSH session is set the OS terminal username is used.
+  A Teleport user must have access to that login user for that server or they will receive
+  an access denied message. The user could receive an access denied message after being approved
+  for their Headless Authentication activity since the same access rights are granted or denied as if running from
+  your local terminal.
+</Admonition>
+
+### Example: Kubernetes
+```code
+$ tsh proxy kube --headless --proxy=proxy.example.com --user=alice example-cluster
+Complete headless authentication in your local web browser:
+# https://proxy.example.com:3080/web/headless/7f7e1369-e45b-5b7b-bb17-84360873acaf
+#
+# or execute this command in your local terminal:
+#
+# tsh headless approve --user=alice --proxy=proxy.example.com 7f7e1369-e45b-5b7b-bb17-84360873acaf
+# # User approves through link and the local proxy is created:
+
+Preparing the following Teleport Kubernetes clusters:
+Teleport Cluster Name Kube Cluster Name
+--------------------- -----------------
+teleport-cluster             example-cluster
+
+Started local proxy for Kubernetes on 127.0.0.1:1234 in the background
+and kubectl is set up to work with it. Try issuing a command, for example "kubectl get namespaces"
+
+$ kubectl get pods
+NAMESPACE        NAME                                READY   STATUS    RESTARTS      AGE
+teleport-agent   teleport-agent-0                    1/1     Running   0             2d12h
+```
+
+## Optional: Teleport Connect
+
+Teleport Connect can also be used to approve Headless Authentication logins.  Teleport
+Connect will automatically detect the Headless Authentication login attempt and allow
+you to approve or cancel the request.
+
+![Headless Confirmation](../../../img/headless/confirmation.png)
+
+You will be prompted to tap your MFA key to complete the approval process.
+
+![Headless Authentication Approval](../../../img/headless/approval.png)
+
+## Troubleshooting
+
+### "WARN: Failed to lock system memory for headless login: ..."
+
+When using Headless Authentication, `tsh` does not write private key and certificate data
+to disk(`~/.tsh`). Instead, `tsh` holds these secrets in memory for the duration of
+the request. Additionally, it will try to lock the process memory to further protect
+the secrets from being stolen by other users on a shared machine.
+
+Below are some of the specific warning messages you may run into and how to fix them:
+
+#### "operation not permitted" OR "cannot allocate memory"
+
+In order to lock the process memory, your OS user must have permission to lock
+the amount of memory needed. Use `ulimit -l` to check your OS user's current limit.
+The exact amount of memory needed may vary from system to system, so we recommend
+updating your ulimit to unlimited, with either `ulimit -l unlimited` or by adding
+the line `<os_username> hard memlock unlimited` to your `/etc/security/limits.conf`.
+
+#### "memory locking is not supported on non-linux operating systems"
+
+The `mlockall` syscall is only supported on Linux operating systems. This means
+that on other operating systems, the memory lock attempt will always fail and
+output the warning. We recommend only using Headless Authentication on Linux machines
+for the best level of security on shared machines.
+
+#### Disable mlock
+
+If the above solutions are not feasible in your environment, you can also disable
+the memory locking requirement by setting the `--mlock` flag or `TELEPORT_MLOCK_MODE`
+environment variable to `off` or `best_effort`. This is not recommended in production
+environments on shared systems where a memory swap attack is possible.
diff --git a/docs/pages/admin-guides/access-controls/guides/impersonation.mdx b/docs/pages/zero-trust-access/authentication/impersonation.mdx
similarity index 93%
rename from docs/pages/admin-guides/access-controls/guides/impersonation.mdx
rename to docs/pages/zero-trust-access/authentication/impersonation.mdx
index 84c9bd157c3c5..aa1b925cc0b82 100644
--- a/docs/pages/admin-guides/access-controls/guides/impersonation.mdx
+++ b/docs/pages/zero-trust-access/authentication/impersonation.mdx
@@ -1,6 +1,10 @@
 ---
 title: Impersonating Teleport Users
+sidebar_label: Impersonation
 description: How to issue short-lived certs on behalf of Teleport users using impersonation.
+tags:
+ - how-to
+ - zero-trust
 ---
 
 Sometimes users need to create short-lived certificates for non-interactive
@@ -11,6 +15,16 @@ users and robots to create short-lived certs for other users and roles.
 Let's explore how interactive user Alice can create credentials for a
 non-interactive CI/CD user Jenkins and a security scanner.
 
+## How it works
+
+A Teleport role allows a Teleport user to impersonate other roles or users. When
+a Teleport user authenticates with a role that allows impersonation, they can
+execute the `tctl auth sign` command to instruct the Teleport Auth Service to
+sign a certificate for another Teleport user. As with all Teleport user
+certificates, the certificate written by `tctl auth sign` includes the names of
+a Teleport user and that user's roles. TLS or SSH clients can then load the
+certificate in order to authenticate to Teleport as the impersonated user.
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
@@ -334,6 +348,6 @@ Here is an explanation of the fields used in the `where` conditions within this
 | `impersonate_role.metadata.labels["<label key>"]` | The label value given the label `key` from a role to impersonate                                                       |
 | `impersonate_user.metadata.labels["<label key>"]` | The label value given the label `key` from a user to impersonate                                                       |
 
-Check out our [predicate language](../../../reference/predicate-language.mdx) 
+Check out our [predicate language](../../reference/access-controls/predicate-language.mdx) 
 guide for a more in depth explanation of the language.
 
diff --git a/docs/pages/admin-guides/access-controls/guides/ip-pinning.mdx b/docs/pages/zero-trust-access/authentication/ip-pinning.mdx
similarity index 97%
rename from docs/pages/admin-guides/access-controls/guides/ip-pinning.mdx
rename to docs/pages/zero-trust-access/authentication/ip-pinning.mdx
index bc39809ef91c2..a6878b2d66435 100644
--- a/docs/pages/admin-guides/access-controls/guides/ip-pinning.mdx
+++ b/docs/pages/zero-trust-access/authentication/ip-pinning.mdx
@@ -1,6 +1,11 @@
 ---
-title: "IP Pinning "
+title: "IP Pinning"
 description: How to enable IP pinning for Teleport users
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
+enterprise: IP pinning
 ---
 
 <Admonition type="warning">
diff --git a/docs/pages/admin-guides/access-controls/guides/joining-sessions.mdx b/docs/pages/zero-trust-access/authentication/joining-sessions.mdx
similarity index 96%
rename from docs/pages/admin-guides/access-controls/guides/joining-sessions.mdx
rename to docs/pages/zero-trust-access/authentication/joining-sessions.mdx
index 4a792fc6c9e67..a2ab38b008da6 100644
--- a/docs/pages/admin-guides/access-controls/guides/joining-sessions.mdx
+++ b/docs/pages/zero-trust-access/authentication/joining-sessions.mdx
@@ -6,6 +6,11 @@ keywords:
   - Kubernetes
   - session moderation
   - audit
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
+enterprise: Session joining
 ---
 
 Teleport allows multiple users to join the same SSH or `kubectl exec` session.
@@ -20,8 +25,7 @@ When joining a session, users can be in one of three participant modes:
 - **Peer**: Can view the session and interact with it as if they were the session owner.
 - **Moderator**: (Enterprise only) Can view the session and terminate it.
 
-Users can join SSH sessions from the command line or from the Teleport web UI,
-but Kubernetes sessions can only be joined from the command line.
+Users can join sessions from the command line or from the Teleport web UI.
 
 The web UI forces users to select a join mode prior to joining. If you join a
 session with `tsh join` or `tsh kube join`, you can specify a participant mode
@@ -137,7 +141,7 @@ ubuntu@prod.teleport.example.com %
 Because this session is an SSH session, Alice could also join from the
 Teleport Web UI. For example:
 
-![Join Server Session from UI](../../../../img/webui-active-session.png)
+![Join Server Session from UI](../../../img/webui-active-session.png)
 
 ### Access controls
 
@@ -246,7 +250,7 @@ unless the mapped leaf role also requires moderation. To require moderated sessi
 you must include the `require_session_join` policy in the mapped role defined on the leaf cluster.
 
 For more information about configuring trust relationships and role mapping between root and leaf
-clusters, see [Configure Trusted Clusters](../../management/admin/trustedclusters.mdx).
+clusters, see [Configure Trusted Clusters](../deploy-a-cluster/trustedclusters.mdx).
 
 ### Multifactor authentication
 
@@ -287,7 +291,7 @@ during the file transfer initiation to receive the file transfer request notific
 After the file transfer has been requested, all session participants and notified
 and prompted to approve or deny the file transfer request.
 
-![Approve/Deny Prompt](../../../../img/moderated-file-transfer-dialog.png)
+![Approve/Deny Prompt](../../../img/moderated-file-transfer-dialog.png)
 
 If a moderator denies the file transfer request, the request is immediately removed and
 all session participants are notified.
diff --git a/docs/pages/admin-guides/access-controls/guides/mfa-for-admin-actions.mdx b/docs/pages/zero-trust-access/authentication/mfa-for-admin-actions.mdx
similarity index 89%
rename from docs/pages/admin-guides/access-controls/guides/mfa-for-admin-actions.mdx
rename to docs/pages/zero-trust-access/authentication/mfa-for-admin-actions.mdx
index c4ff9b5818318..ac815a12afd6b 100644
--- a/docs/pages/admin-guides/access-controls/guides/mfa-for-admin-actions.mdx
+++ b/docs/pages/zero-trust-access/authentication/mfa-for-admin-actions.mdx
@@ -1,6 +1,10 @@
 ---
 title: MFA for Administrative Actions
 description: Require MFA checks to perform administrative actions.
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
 ---
 
 Teleport can be configured to require additional multi-factor authentication
@@ -16,7 +20,7 @@ Examples of administrative actions include, but are not limited to:
 - Approving Access Requests
 - Generating new join tokens
 - Impersonation
-- Creating new bots for Machine ID
+- Creating new bots for Machine & Workload Identity
 
 This is an advanced security feature that protects users against compromises of
 their on-disk Teleport certificates.
@@ -26,7 +30,7 @@ their on-disk Teleport certificates.
   with `tctl auth sign` will no longer be suitable for automation due to the
   additional MFA checks.
 
-  We recommend using [Machine ID](../../../enroll-resources/machine-id/getting-started.mdx) to
+  We recommend using [Machine & Workload Identity](../../machine-workload-identity/getting-started.mdx) to
   issue certificates for automated workflows, which uses role impersonation
   that is not subject to MFA checks.
 
@@ -40,7 +44,7 @@ their on-disk Teleport certificates.
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
-- [WebAuthn configured](webauthn.mdx) on this cluster
+- [WebAuthn configured](../management/security/idp-compromise.mdx) on this cluster
 - Multi-factor authentication hardware device, such as YubiKey or SoloKey
 - A Web browser with [WebAuthn support](
   https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
diff --git a/docs/pages/admin-guides/access-controls/guides/passwordless.mdx b/docs/pages/zero-trust-access/authentication/passwordless.mdx
similarity index 86%
rename from docs/pages/admin-guides/access-controls/guides/passwordless.mdx
rename to docs/pages/zero-trust-access/authentication/passwordless.mdx
index bae26d513f4a8..3a41ab48dc0e0 100644
--- a/docs/pages/admin-guides/access-controls/guides/passwordless.mdx
+++ b/docs/pages/zero-trust-access/authentication/passwordless.mdx
@@ -2,17 +2,39 @@
 title: "Passwordless"
 description: Learn how to use passwordless authentication with Teleport.
 videoBanner: GA37qqB6Lmk
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
 ---
 
-Passwordless takes advantage of WebAuthn to provide passwordless and
-usernameless authentication for Teleport.
+This guide shows you how to provide passwordless and usernameless authentication
+for Teleport (called "passwordless" below for simplicity). With passwordless,
+users can authenticate to Teleport with only WebAuthn or Touch ID, and do not
+need to provide a username and password.
+
+## How it works
+
+In passwordless, a user registers a WebAuthn or Touch ID device with Teleport
+using the Web UI or `tsh` client. When the user authenticates to Teleport,
+Teleport issues an authentication challenge for the client to sign with an
+authenticator, i.e., their local device. The authenticator signs the challenge,
+and the Teleport Auth Service verifies the signature against a trusted
+certificate authority.
+
+If you are using a hardware device, a passwordless registration will occupy a
+resident key slot. Resident keys, also called discoverable credentials, are
+stored in persistent memory in the authenticator (i.e., the device that is used
+to authenticate). In contrast, multi-factor authentication keys are encrypted by
+the authenticator and stored in the Teleport Auth Service backend. Regardless of
+your device type, passwordless registrations may also be used for regular MFA.
 
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - Teleport must be configured for WebAuthn. See the [Harden your Cluster Against
-  IdP Compromises](./webauthn.mdx) guide.
+  IdP Compromises](../management/security/idp-compromise.mdx) guide.
 - A hardware device with support for WebAuthn and resident keys.  As an
   alternative, you can use a Mac with biometrics / Touch ID or device that
   supports Windows Hello (Windows 10 19H1 or later).
@@ -22,7 +44,7 @@ usernameless authentication for Teleport.
   page.
 - A signed and notarized version of `tsh` is required for Touch ID. This means
   versions installed from Homebrew or compiled from source will not work.
-  [Download the macOS tsh installer](../../../installation.mdx#macos).
+  [Download the macOS tsh installer](../../installation/macos.mdx).
 - (!docs/pages/includes/tctl.mdx!)
 
 A Teleport cluster capable of WebAuthn is automatically capable of passwordless.
@@ -44,13 +66,6 @@ $ tsh mfa add
 You may pick either `WEBAUTHN` or `TOUCHID` as the device type. Make sure to
 answer `YES` to "Allow passwordless logins".
 
-If you are using a hardware device, a passwordless registration will occupy a
-resident key slot. Resident keys, also called discoverable credentials, are
-stored in persistent memory in the authenticator (i.e., the device that is used
-to authenticate). In contrast, MFA keys are encrypted by the authenticator and
-stored in the Teleport Auth Service backend. Regardless of your device type,
-passwordless registrations may also be used for regular MFA.
-
 <Admonition type="tip" title="Important">
 If you plan on relying exclusively on passwordless, it's recommended to register
 more than one device. A portable hardware device is ideal, as it can be shared
@@ -150,7 +165,7 @@ spec:
 
 If you don't see the "Allow passwordless logins" prompt during `tsh mfa add`,
 you may be using an older version of `tsh`. Download the latest `tsh` from our
-[installation page](../../../installation.mdx).
+[installation page](../../installation/installation.mdx).
 
 ### Hardware device not usable
 
@@ -175,7 +190,7 @@ necessary udev rules.
 ### Touch ID not usable
 
 If you are having trouble with Touch ID, make sure that you are using the latest
-standalone version of `tsh`. [Download the macOS tsh installer](../../../installation.mdx).
+standalone version of `tsh`. [Download the macOS tsh installer](../../installation/installation.mdx).
 
 Touch ID support requires Macs with a Touch ID sensor and Secure Enclave.
 
diff --git a/docs/pages/zero-trust-access/authentication/per-session-mfa.mdx b/docs/pages/zero-trust-access/authentication/per-session-mfa.mdx
new file mode 100644
index 0000000000000..82916f4243361
--- /dev/null
+++ b/docs/pages/zero-trust-access/authentication/per-session-mfa.mdx
@@ -0,0 +1,241 @@
+---
+title: Per-session MFA
+description: Require MFA checks to initiate sessions.
+videoBanner: j8Ze7HhjFGw
+tags:
+ - conceptual
+ - zero-trust
+ - resiliency
+---
+
+Teleport supports requiring additional multi-factor authentication checks
+when starting new:
+
+- SSH connections (a single `tsh ssh` call, Web UI SSH session or Teleport Connect SSH session)
+- Kubernetes sessions (a single `kubectl` call)
+- Database sessions (a single `tsh db connect` call)
+- Application sessions
+- Desktop sessions
+
+This is an advanced security feature that protects users against compromises of
+their on-disk Teleport certificates.
+
+Per-session MFA checks can be satisfied by a webauthn device or by [delegating MFA checks to your IdP](../sso/sso-for-mfa.mdx).
+
+<Admonition type="note">
+  In addition to per-session MFA, enable login MFA in your SSO provider and/or
+  for all [local Teleport
+  users](../../reference/access-controls/authentication.mdx)
+  to improve security.
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- [WebAuthn configured](../management/security/idp-compromise.mdx) on this cluster
+- Hardware device for multi-factor authentication, such as YubiKey or SoloKey
+- A Web browser with [WebAuthn support](
+  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
+  SSH or desktop sessions from the Teleport Web UI).
+
+<Admonition type="note" title="Per-session MFA with FIPS" scope="enterprise" scopeOnly>
+
+Teleport FIPS builds disable local users. To configure WebAuthn in order to use
+per-session MFA with FIPS builds, provide the following in your `teleport.yaml`:
+
+```yaml
+teleport:
+  auth_service:
+    local_auth: false
+    second_factors: ["webauthn"]
+    webauthn:
+      rp_id: teleport.example.com
+```
+
+</Admonition>
+
+## Configure per-session MFA
+
+Per-session MFA can be enforced cluster-wide or only for some specific roles.
+
+### Cluster-wide
+
+To enforce MFA checks for all roles, edit your cluster authentication
+configuration.
+
+Edit your `cluster_auth_preference` resource:
+
+```code
+$ tctl edit cap
+```
+
+Ensure that the resource contains the following content:
+
+```yaml
+kind: cluster_auth_preference
+metadata:
+  name: cluster-auth-preference
+spec:
+  require_session_mfa: true
+version: v2
+```
+
+Apply your changes by saving and closing the file in your editor.
+
+### Per role
+
+To enforce MFA checks for a specific role, update the role to contain:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: example-role-with-mfa
+spec:
+  options:
+    # require per-session MFA for this role
+    require_session_mfa: true
+  allow:
+    ...
+  deny:
+    ...
+```
+
+Role-specific enforcement only applies when accessing resources matching a
+role's `allow` section.
+
+### Roles example
+
+Let's walk through an example of setting up per-session MFA checks for roles.
+
+Jerry is an engineer with access to the company infrastructure. The
+infrastructure is split into development and production environments. Security
+engineer Olga wants to enforce MFA checks for accessing production servers.
+Development servers don't require this to reduce engineers' friction.
+
+Olga defines two Teleport roles: `access-dev` and `access-prod`:
+
+```yaml
+# access-dev.yaml
+kind: role
+version: v7
+metadata:
+  name: access-dev
+spec:
+  allow:
+    node_labels:
+      env: dev
+    logins:
+      - jerry
+---
+# access-prod.yaml
+kind: role
+version: v7
+metadata:
+  name: access-prod
+spec:
+  options:
+    # require per-session MFA for production access
+    require_session_mfa: true
+  allow:
+    node_labels:
+      env: prod
+    logins:
+      - jerry
+  deny: {}
+```
+
+Olga then assigns both roles to all engineers, including Jerry.
+
+When Jerry logs into node `dev1.example.com` (with label `env: dev` as login `jerry`), nothing
+special happens:
+
+```code
+$ tsh ssh jerry@dev1.example.com
+
+# jerry@dev1.example.com >
+```
+
+But when Jerry logs into node `rod3.example.com` (with label `env: prod` as login `jerry`), he
+gets prompted for an MFA check:
+
+```code
+$ tsh ssh jerry@prod3.example.com
+# Tap any security key <tap>
+
+# jerry@prod3.example.com >
+```
+
+If per-session MFA was enabled cluster-wide, Jerry would be prompted for MFA
+even when logging into `dev1.example.com`.
+
+<Admonition title="Per-session MFA for Database Access" type="tip">
+
+The Teleport Database Service supports per-connection MFA. When Jerry connects
+to the database `prod-mysql-instance` (with label `env: prod`), he gets prompted
+for an MFA check for each `tsh db connect` or `tsh proxy db` call:
+
+```code
+$ tsh db connect prod-mysql-instance
+# Tap any security key
+
+# Welcome to the MySQL monitor.  Commands end with ; or \g.
+# Your MySQL connection id is 10002
+# Server version: 8.0.0-Teleport (Ubuntu)
+#
+# Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+#
+# Oracle is a registered trademark of Oracle Corporation and/or its
+# affiliates. Other names may be trademarks of their respective
+# owners.
+#
+# Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
+#
+# mysql>
+```
+
+Jerry can also execute a query against multiple databases with a single MFA check
+using the `tsh db exec` command:
+```code
+$ tsh db exec "select 1" --labels env=prod --db-user teleport-user --output-dir=logs
+Searching databases ...
+Found 2 database(s):
+
+Name                  Description Protocol Labels
+--------------------- ----------- -------- --------
+prod-mysql-instance-1             mysql    env=prod
+prod-mysql-instance-2             mysql    env=prod
+
+Do you want to proceed with 2 database(s)? [y/N]: y
+Executing command for "prod-mysql-instance-1". Output will be saved at "logs/prod-mysql-instance-1.output".
+MFA is required to access Database "prod-mysql-instance-1"
+Tap any security key
+Detected security key tap
+Executing command for "prod-mysql-instance-2". Output will be saved at "logs/prod-mysql-instance-2.output".
+
+Summary: 2 of 2 succeeded.
+Summary is saved at "logs/summary.json".
+```
+
+Note that each MFA check remains valid for up to 5 minutes. After the 5-minutes
+window, a new MFA check will be requested for new connections.
+
+</Admonition>
+
+## Limitations
+
+Current limitations for this feature are:
+
+- VNet SSH must be used for per-session MFA when using an OpenSSH client (`ssh`, `scp`).
+- Only `kubectl` supports per-session WebAuthn authentication for Kubernetes.
+- When accessing a
+  [multi-port](../../enroll-resources/application-access/protect-apps/tcp.mdx#configuring-access-to-multiple-ports)
+  TCP application through [VNet](../../connect-your-client/teleport-clients/vnet.mdx), the first connection over
+  each port triggers an MFA check.
+- For the `tsh db exec` command, only WebAuthn devices are supported.
+
+## Next steps
+
+- [Require MFA for administrative actions](./mfa-for-admin-actions.mdx)
diff --git a/docs/pages/admin-guides/access-controls/compliance-frameworks/compliance-frameworks.mdx b/docs/pages/zero-trust-access/compliance-frameworks/compliance-frameworks.mdx
similarity index 94%
rename from docs/pages/admin-guides/access-controls/compliance-frameworks/compliance-frameworks.mdx
rename to docs/pages/zero-trust-access/compliance-frameworks/compliance-frameworks.mdx
index 6ee2dcd7f4484..f02fa8e229610 100644
--- a/docs/pages/admin-guides/access-controls/compliance-frameworks/compliance-frameworks.mdx
+++ b/docs/pages/zero-trust-access/compliance-frameworks/compliance-frameworks.mdx
@@ -1,6 +1,9 @@
 ---
 title: "Compliance Frameworks"
 description: "How to use Teleport's access controls to streamline compliance without sacrificing productivity."
+tags:
+ - zero-trust
+ - audit
 ---
 
 Teleport makes it easier for your organization to achieve compliance with
diff --git a/docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx b/docs/pages/zero-trust-access/compliance-frameworks/fedramp.mdx
similarity index 76%
rename from docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx
rename to docs/pages/zero-trust-access/compliance-frameworks/fedramp.mdx
index 923da5ca7e032..8b85ca21bf91e 100644
--- a/docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx
+++ b/docs/pages/zero-trust-access/compliance-frameworks/fedramp.mdx
@@ -1,36 +1,48 @@
 ---
 title: FedRAMP Compliance for Infrastructure Access
-description: How to configure SSH, Kubernetes, database, and web app access to be FedRAMP compliant, including support for FIPS 140-2.
+sidebar_label: FedRAMP
+description: How to configure SSH, Kubernetes, database, and web app access to be FedRAMP compliant, including support for FIPS 140.
+tags:
+ - conceptual
+ - zero-trust
+ - audit
+enterprise: FedRAMP compliance
 ---
 
 Teleport provides the foundation to meet FedRAMP requirements for the purposes of accessing infrastructure.
-This includes support for the Federal Information Processing Standard [FIPS 140-2](https://en.wikipedia.org/wiki/FIPS\_140-2).
+This includes support for the [Federal Information Processing Standard [FIPS 140](https://en.wikipedia.org/wiki/FIPS_140).
 This standard is the US government approved standard for cryptographic modules. This document explains how
 Teleport FIPS mode works and how it can help your company to become FedRAMP authorized.
 
+## FIPS Module
+
+Teleport Enterprise FIPS builds are compiled against a FIPS 140 validated module.
+
+- Teleport releases from 17.7.3+ and 18.0.0+ use BoringCrypto tag `fips-20220613` (CMVP certificate #4735, FIPS 140-3)
+- Teleport releases prior to 17.7.3 use BoringCrypto tag `fips-20210429` (CMVP certificate #4407, FIPS 140-2)
+
 ## Obtain FedRAMP authorization with Teleport
 
-Teleport includes FedRAMP and FIPS 140-2 features to support companies that sell into
-government agencies.
+Teleport includes FedRAMP and FIPS features to support companies that sell into government agencies.
 
 ### Access controls
 
 |  Control | Teleport Features |
 | - | - |
 | [AC-02 Account Management]((=fedramp.control_url=)AC-02) | Audit events are emitted in the Auth Service when a user is created, updated, deleted, locked, or unlocked. |
-| [AC-03 Access Enforcement]((=fedramp.control_url=)AC-03) | Teleport Enterprise supports robust [Role-based Access Controls (RBAC)](../access-controls.mdx) to: <br/>• Control which infrastructure resources a user can or cannot access. <br/>• Control cluster level configuration (session recording, configuration, etc.) <br/>• Control which Unix logins a user is allowed to use when logging into a server. |
+| [AC-03 Access Enforcement]((=fedramp.control_url=)AC-03) | Teleport Enterprise supports robust [Role-based Access Controls (RBAC)](../authentication/authentication.mdx) to: <br/>• Control which infrastructure resources a user can or cannot access. <br/>• Control cluster level configuration (session recording, configuration, etc.) <br/>• Control which Unix logins a user is allowed to use when logging into a server. |
 | [AC-07 Unsuccessful Logon Attempts]((=fedramp.control_url=)AC-07) |  Teleport supports two types of users: local and SSO-based accounts (GitHub, Google Apps, Okta, etc). For local accounts, by default, Teleport locks accounts for 30 minutes after 5 failed login attempts. For SSO-based accounts, the number of invalid login attempts and lockout time period is controlled by the SSO provider. |
 | [AC-08 System Use Notification]((=fedramp.control_url=)AC-08) | Teleport integrates with Linux Pluggable Authentication Modules (PAM). PAM modules can be used to display a custom message on login using a message of the day (MOTD) module within the Session management primitive. |
 | [AC-10 Concurrent Session Control]((=fedramp.control_url=)AC-10) | Teleport administrators can define concurrent session limits using Teleport’s RBAC. |
-| [AC-12 Session Termination]((=fedramp.control_url=)AC-12) | Admins can terminate active sessions with [session locking](../../access-controls/guides/locking.mdx). Teleport terminates sessions on expiry or inactivity. |
+| [AC-12 Session Termination]((=fedramp.control_url=)AC-12) | Admins can terminate active sessions with [session locking](../../identity-governance/locking.mdx). Teleport terminates sessions on expiry or inactivity. |
 | [AC-17 Remote Access]((=fedramp.control_url=)AC-17) | Teleport administrators create users with configurable roles that can be used to allow or deny access to system resources. |
-| [AC-20 Use of External Information Systems]((=fedramp.control_url=)AC-20) | Teleport supports connecting multiple independent clusters using a feature called [Trusted Clusters](../../management/admin/trustedclusters.mdx). When allowing access from one cluster to another, roles are mapped according to a pre-defined relationship of the scope of access. |
+| [AC-20 Use of External Information Systems]((=fedramp.control_url=)AC-20) | Teleport supports connecting multiple independent clusters using a feature called [Trusted Clusters](../deploy-a-cluster/trustedclusters.mdx). When allowing access from one cluster to another, roles are mapped according to a pre-defined relationship of the scope of access. |
 
 ### Audit and accountability
 
 | Control | Teleport Features |
 | - | - |
-| [AU-03, AU-04, AU-12 Audit and Accountability]((=fedramp.control_url=)AU) – Content of Audit Records and [AU-12 Audit Generation]((=fedramp.control_url=)AU-12) | Teleport contains an [Audit Log](../../../reference/monitoring/audit.mdx) that records cluster-wide events such as: <br/>• Failed login attempts.<br/>• Commands that were executed (SSH “exec” commands).<br/> • Ports that were forwarded. <br/>• File transfers that were initiated. |
+| [AU-03, AU-04, AU-12 Audit and Accountability]((=fedramp.control_url=)AU) – Content of Audit Records and [AU-12 Audit Generation]((=fedramp.control_url=)AU-12) | Teleport contains an [Audit Log](../../reference/deployment/monitoring/audit.mdx) that records cluster-wide events such as: <br/>• Failed login attempts.<br/>• Commands that were executed (SSH “exec” commands).<br/> • Ports that were forwarded. <br/>• File transfers that were initiated. |
 | [AU-10 Non-Repudiation]((=fedramp.control_url=)AU-10) | Teleport audit logging supports both events as well as audit of an entire SSH session. For non-repudiation purposes, a full session can be replayed back and viewed. |
 
 ### Configuration management
@@ -43,7 +55,7 @@ government agencies.
 
 | Control | Teleport Features |
 | - | - |
-| [IA-02 Concurrent Session Control]((=fedramp.control_url=)IA-02) | Integrates with SSO providers such as GitHub, Okta, Google, etc. Acts as its own SSO provider. Enforces the use of multi-factor authentication (MFA), including requiring per-session MFA. Supports PIV-compatible hardware keys, as well as connection and user limits. |
+| [IA-02 Concurrent Session Control]((=fedramp.control_url=)IA-02) | Integrates with SSO providers such as GitHub, Okta, Google, etc. Acts as its own SSO provider. Supports the use of multi-factor authentication (MFA) including per-session MFA. Supports PIV-compatible hardware keys, as well as connection and user limits. |
 | [IA-04 Identifier Management]((=fedramp.control_url=)IA-04) | Maintains several unique identifiers: local users are required to be unique (unique username), roles have unique names and tied to organization roles via SSO, identifiers for devices are unique randomly generated IDs (UUID). |
 | [IA-08 Identification and Authentication (Non-Organizational Users)]((=fedramp.control_url=)IA-08) | Teleport supports PIV-compatible hardware keys. |
 | [IA-03 Device Identification and Authentication]((=fedramp.control_url=)IA-03) | Teleport requires valid x509 or SSH certificates issued by a Teleport Certificate Authority (CA) to establish a network connection for device-to-device network connection between Teleport components. |
@@ -53,8 +65,8 @@ government agencies.
 | Control | Teleport Features |
 | - | - |
 | [SC-10 Network Disconnection]((=fedramp.control_url=)SC-10) | Teleport requires valid X.509 or SSH certificates issued by a Teleport Certificate Authority (CA) to establish a network connection for device-to-device network connection between Teleport components. |
-| [SC-12 Cryptographic Key Establish and Management]((=fedramp.control_url=)SC-12) | Teleport initializes cryptographic keys that act as a Certificate Authority (CA) to further issue x509 and SSH certificates. SSH and x509 user certificates that are issued are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA. Teleport supports Hardware Security Modules (HSM).<br/>Teleport Enterprise builds against a FIPS 140-2 compliant library (BoringCrypto) is available. <br/>In addition, when Teleport Enterprise is in FedRAMP/FIPS 140-2 mode, Teleport will only start and use FIPS 140-2 compliant cryptography. |
-| [SC-13 Use of Cryptography]((=fedramp.control_url=)SC-13) | Teleport Enterprise builds against a FIPS 140-2 compliant library (BoringCrypto). In addition, when Teleport Enterprise is in FedRAMP/FIPS 140-2 mode, Teleport will only start and use FIPS 140-2 compliant cryptography. |
+| [SC-12 Cryptographic Key Establish and Management]((=fedramp.control_url=)SC-12) | Teleport initializes cryptographic keys that act as a Certificate Authority (CA) to further issue x509 and SSH certificates. SSH and x509 user certificates that are issued are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA. Teleport supports Hardware Security Modules (HSM).<br/>Teleport Enterprise builds against a FIPS 140 compliant library are available. <br/>In addition, when Teleport Enterprise is in FedRAMP/FIPS mode, Teleport will only start and use FIPS 140 compliant cryptography. |
+| [SC-13 Use of Cryptography]((=fedramp.control_url=)SC-13) | Teleport Enterprise builds against a FIPS 140 compliant library. In addition, when Teleport Enterprise is in FedRAMP/FIPS mode, Teleport will only start and use FIPS 140 compliant cryptography. |
 | [SC-17 Public Key Infrastructure]((=fedramp.control_url=)SC-17) | Certificates Teleport initializes cryptographic keys that act as a Certificate Authority (CA) to further issue X.509 and SSH certificates. SSH and X.509 user certificates that are issued are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA. |
 | [SC-23 Session Authenticity]((=fedramp.control_url=)SC-23) | Teleport SSH and TLS sessions are protected with SSH user and X.509 client certificates. For access to the Web UI, Teleport uses bearer token auth stored in a browser token to authenticate a session. Upon user logout, SSH and TLS certificates are deleted from disk and cookies are removed from the browser. |
 
@@ -75,12 +87,12 @@ Inside the ATO boundary, mTLS is used for communication between the Teleport pro
 
 #### FIPS mTLS details
 
-In FIPS builds, Teleport uses Go’s BoringCrypto-based networking stack for all protocols.
+In FIPS builds, Teleport uses a FIPS 140 validated networking stack for all protocols.
 
 For a detailed list of cryptographic algorithms used in FIPS mode please consult [Teleport FIPS documentation](#default-cryptographic-algorithms).
 
-You also can follow the [Installation instructions](../../../installation.mdx) for
-Teleport Enterprise edition to download and install the appropriate FIPS-compliant binaries for
+You also can follow the [Installation instructions](../../installation/installation.mdx) for
+Teleport Enterprise edition to download and install the appropriate FIPS  binaries for
 your operating environment and package manager or from compressed archive (tarball).
 
 For example, you can download and install from the compressed archive by running the following commands:
@@ -103,15 +115,16 @@ $ sudo ./install
 ```
 
 After you download and install, all of the Teleport Enterprise binaries are
-installed in the `/usr/local/bin` directory. You can verify you have FIPS-compliant
+installed in the `/usr/local/bin` directory. You can verify you have FIPS
 binaries installed by running the `teleport version` command and verifying that
-the `X:boringcrypto` library is listed. For example:
+the `X:boringcrypto` library is listed:
 
 ```code
 $ teleport version
-Teleport Enterprise (= teleport.version =) (= teleport.git =) (= teleport.golang =) X:boringcrypto
 ```
 
+The output should end with `X:boringcrypto`.
+
 If your Teleport cluster runs on AWS, the cluster can run in US-East or US-West regions for services
 with low or moderate impact levels. For services with a high impact level, the cluster must run
 in a GovCloud region to support FIPS.
@@ -201,11 +214,10 @@ $ sudo systemctl enable teleport
 When using `teleport start --fips`, Teleport will start in FIPS mode.
 
 - If the `--fips` flag is selected, Teleport will fail to start unless the
-  binaries are compiled with the appropriate cryptographic module
-  (BoringCrypto).
+  binaries are compiled with the appropriate cryptographic module.
 - If no TLS or SSH cryptographic primitives are specified, Teleport will
   default to FIPS-compliant cryptographic algorithms.
-- If TLS or SSH cryptographic primitives are not FIPS 140-2 compliant, Teleport
+- If TLS or SSH cryptographic primitives are not FIPS 140 compliant, Teleport
   will fail to start.
 - Teleport will always enable at-rest encryption for both DynamoDB and S3.
 - If recording proxy mode is selected, validation of host certificates should
@@ -280,8 +292,8 @@ is emitted to the Audit Log.
 
 - TLS protocol version is restricted to TLS 1.2 and TLS 1.3.
 - All uses of non-compliant algorithms such as NaCl are removed and replaced with compliant algorithms such as AES-GCM.
-- Teleport is compiled with [BoringCrypto](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4407).
-- User, host, and CA certificates (and host keys for recording proxy mode) only use 2048-bit RSA private keys.
+- Teleport is compiled with a FIPS 140 validated cryptographic module.
+- User, host, and CA certificates (and host keys for recording proxy mode) only use ECDSA keys on the NIST-P256 curve or 2048-bit RSA private keys.
 
 ## Remote desktop access
 
@@ -293,12 +305,46 @@ Note that `arm64` FIPS builds do not support access to Windows desktops.
 
 ## Migrating from non-FIPS to FIPS
 
-As of v17, new installations of Teleport default to using Ed25519 keys.  This is currently not supported 
-by FIPS binaries.  If the Teleport Auth Service was already deployed with a standard binary or without 
-the `--fips` flag, you must update the certificate authorities.  Otherwise, the error `User Message: only RSA and 
-ECDSA keys supported` is produced.  
+As of v17, new installations of Teleport default to using Ed25519 keys.  This is currently not supported
+by FIPS binaries.  If the Teleport Auth Service was already deployed with a standard binary or without
+the `--fips` flag, you must update the certificate authorities.  Otherwise, the error `User Message: only RSA and
+ECDSA keys supported` is produced.
 
-To migrate to a FIPS installation, [set the signature algorithm suite](../../../reference/signature-algorithms.mdx)
-to `fips-v1`.  Then, any CA with an Ed25519 key must undergo a [CA rotation](../../management/operations/ca-rotation.mdx).  The 
-command `tctl status` can be used on v17+ to confirm the signature algorithms in use.  After all CA rotations are 
+To migrate to a FIPS installation, [set the signature algorithm suite](../../reference/deployment/signature-algorithms.mdx)
+to `fips-v1`.  Then, any CA with an Ed25519 key must undergo a [CA rotation](../management/security/ca-rotation.mdx).  The
+command `tctl status` can be used on v17+ to confirm the signature algorithms in use.  After all CA rotations are
 complete, proceed with installing the FIPS binary.
+
+## Tradeoffs of using the Teleport FIPS binary
+
+Using Teleport's FIPS binary should not be considered a wholesale security improvement.
+It is designed to meet specific regulatory and compliance requirements (such as
+FedRAMP), not to increase security in general-purpose deployments.
+
+There are several tradeoffs when considering using Teleport FIPS builds in
+cases where it is not strictly required.
+
+### Restricted cipher suite selection
+
+The FIPS build only permits ciphers, key exchange mechanisms, and signature
+algorithms that are approved under the FIPS certification program. Due to the
+rigorous and lengthy certification process, FIPS-approved algorithms often lag
+behind the state of the art. As a result, the FIPS build lacks support for
+newer algorithms with improved performance or forward-looking security
+properties (e.g. ChaCha20-Poly1305, Ed25519).
+
+### Reduced performance
+
+Cryptographic operations may be up to 2× slower compared to the standard build.
+This can impact throughput for high-volume clusters.
+
+### Operational complexity
+
+Running the FIPS build can introduce additional maintenance burden, such as
+troubleshooting connection issues where peers expect different cipher support.
+
+### No security benefit without compliance need
+
+Outside of regulated environments, using the FIPS binary does not increase
+Teleport’s security posture. In fact, it may result in a net negative effect by
+limiting use of modern cryptographic algorithms.
diff --git a/docs/pages/zero-trust-access/compliance-frameworks/soc2.mdx b/docs/pages/zero-trust-access/compliance-frameworks/soc2.mdx
new file mode 100644
index 0000000000000..9e0dd6a9180f9
--- /dev/null
+++ b/docs/pages/zero-trust-access/compliance-frameworks/soc2.mdx
@@ -0,0 +1,101 @@
+---
+title: SOC 2 compliance for SSH, Kubernetes, and Databases
+sidebar_label: SOC 2
+description: How to configure SOC 2-compliant access to SSH, Kubernetes, databases, desktops, and web apps
+tags:
+ - conceptual
+ - zero-trust
+ - audit
+enterprise: SOC 2 compliance
+---
+
+Teleport is designed to meet SOC 2 requirements for the purposes of accessing infrastructure, change management, and system operations. This document outlines a high
+level overview of how Teleport can be used to help your company to become SOC 2 compliant.
+
+<Admonition type="warning">
+
+  SOC 2 compliance features are only available for Teleport Enterprise and
+  Teleport Enterprise Cloud.
+
+</Admonition>
+
+## Achieving SOC 2 Compliance with Teleport
+SOC 2 or Service Organization Controls were developed by the American Institute of CPAs (AICPA). They are based on five trust services criteria: security, availability, processing integrity, confidentiality, and privacy.
+
+## What Key SOC 2 Controls does Teleport help achieve?
+Teleport helps with 4 of the 9 control areas.
+
+### CC6 Control Activities
+Teleport helps with separation of duties using RBAC and restricts access to authorized users
+- Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service.
+
+### CC6 Physical and Logical Access controls
+Teleport issues temporary security credentials according to the user's role.
+
+### CC7 System Operations
+Teleport helps audit and monitor access.
+
+- Audit events and session recordings are securely stored in a vault to prevent tampering.
+- Convert logins, executed commands, deployments and other events into structured audit logs.
+- Monitor, share and join interactive sessions in real-time from the CLI or browser.
+
+### CC8 Change Management
+Teleport helps users elevate their permissions during incidents, RBAC helps limit the need for approvals. The Teleport Slack integration allows for managers to quickly approve temporary SSH Access Requests.
+
+- Let engineers request elevated permissions on the fly without ever leaving the terminal
+- Approve or deny permission requests with ChatOps workflow via Slack or other supported platforms.
+- Extend and customize permission elevation workflow with a simple API and extendable plugin system.
+
+## What Specific Criteria does Teleport Help Satisfy? 
+
+Below is a table of principles and common points of focus listed by [AICPA's official "Trust Services Criteria" reference document](https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf) and how Teleport helps satisfy them.
+
+Each principle has many "Points of Focus" which will apply differently to different products and organizations, talk to an auditor to understand exactly which points of focus apply to your organization.
+
+| Principle Criteria | Point of Focus | Teleport Features |
+| --- | --- | --- |
+| CC6.1 - Restricts Logical Access | Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. | Teleport Enterprise supports robust [Role-based Access Controls (RBAC)](../authentication/authentication.mdx) to: <ul> <li> Control which SSH nodes a user can or cannot access. </li> <li> Control cluster level configuration (session recording, configuration, etc.) </li> <li> Control which UNIX logins a user is allowed to use when logging into a server. </li></ul> |
+| CC6.1 - Identifies and Authenticates Users | Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. | Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service. Connecting locally or remotely is just as easy. |
+| CC6.1 - Considers Network Segmentation | Network segmentation permits unrelated portions of the entity&#39;s information system to be isolated from each other. | [Teleport enables beyond corp network segmentation](../deploy-a-cluster/trustedclusters.mdx) <br/><br/> [Connect to nodes behind Firewalls or create reverse tunnels to a proxy server](../../faq.mdx) |
+| CC6.1 - Manages Points of Access | Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. | [Label Nodes to inventory and create rules](../rbac-get-started/labels.mdx) <br/><br/> [Create Labels from AWS Tags](../../enroll-resources/automatic-labels/ec2-tags.mdx) <br/><br/>Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. |
+| CC6.1 - Restricts Access to Information Assets | Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. | [Teleport uses Certificates to grant access and create access control rules](../../core-concepts.mdx) | 
+| CC6.1 - Manages Identification and Authentication | Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. | Teleport makes setting policies for SSH requirements easy since it works in the cloud and on premise with the same authentication security standards. | 
+| CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../../enroll-resources/agents/join-token.mdx) | 
+| CC6.1 - Uses Encryption to Protect Data | The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. | Teleport Audit logs can use DynamoDB encryption at rest. | 
+| CC6.1 - Protects Encryption Keys | Processes are in place to protect encryption keys during generation, storage, use, and destruction. | Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically  | 
+| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system&#39;s asset owner or authorized custodian. | [Request Approval from the command line](../../reference/cli/tctl.mdx) <br/><br/> [Build Approval Workflows with Access Requests](../../identity-governance/access-requests/access-requests.mdx) <br/><br/> [Use Plugins to send approvals to tools like Slack or Jira](../../identity-governance/access-requests/access-requests.mdx) |
+| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](../../identity-governance/access-requests/access-requests.mdx) | 
+| CC6.2 - Reviews Appropriateness of Access Credentials | The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
+| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](../../identity-governance/access-requests/access-requests.mdx) to get authorization from asset owners. | 
+| CC6.3 - Removes Access to Protected Information Assets | Processes are in place to remove access to protected information assets when an individual no longer requires access. | Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to [revoke access with the Access requests API](../api/api.mdx) | 
+| CC6.3 - Uses Role-Based Access Controls | Role-based access control is utilized to support segregation of incompatible functions. | [Role based access control (&quot;RBAC&quot;) allows Teleport administrators to grant granular access permissions to users.](../authentication/authentication.mdx) | 
+| CC6.3 - Reviews Access Roles and Rules | The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
+| CC6.6 - Restricts Access | The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted. | Teleport makes it easy to restrict access to common ports like 21, 22 and instead have users [tunnel to the server](../../faq.mdx) using Teleport. [Teleport uses the following default ports.](../../reference/deployment/networking.mdx) | 
+| CC6.6 - Protects Identification and Authentication Credentials | Identification and authentication credentials are protected during transmission outside system boundaries. | [Yes, Teleport protects credentials outside your network allowing for Zero Trust network architecture](https://goteleport.com/blog/applying-principles-of-zero-trust-to-ssh/) | 
+| CC6.6 - Requires Additional Authentication or Credentials | Additional authentication information or credentials are required when accessing the system from outside its boundaries. | [Yes, Teleport can manage MFA with TOTP, WebAuthn or U2F Standards or connect to your Identity Provider using SAML, OAUTH or OIDC](../sso/sso.mdx) |
+| CC6.6 - Implements Boundary Protection Systems | Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and are monitored to detect such attempts. | [Trusted clusters](../deploy-a-cluster/trustedclusters.mdx) | 
+| CC6.7 - Uses Encryption Technologies or Secure Communication Channels to Protect Data | Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points. | [Teleport has strong encryption including a FedRAMP compliant FIPS mode](./fedramp.mdx#start-teleport-in-fips-mode) |
+| CC7.2 - Implements Detection Policies, Procedures, and Tools | Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software. | [Teleport creates detailed SSH Audit Logs with Metadata](../../reference/deployment/monitoring/audit.mdx) <br/><br/> [Use BPF Session Recording to catch malicious program execution](../../enroll-resources/server-access/guides/bpf-session-recording.mdx) |
+| CC7.2 - Designs Detection Measures | Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software. | [Use Enhanced Session Recording to catch malicious program execution, capture TCP connections and log programs accessing files on the system the should not be accessing.](../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
+| CC7.3 - Communicates and Reviews Detected Security Events | Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary. | [Use Session recording to replay and review suspicious sessions](../../reference/architecture/session-recording.mdx). | 
+| CC7.3 - Develops and Implements Procedures to Analyze Security Incidents | Procedures are in place to analyze security incidents and determine system impact. | [Analyze detailed logs and replay recorded sessions to determine impact. See exactly what files were accessed during an incident.](../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
+| CC7.4 - Contains Security Incidents | Procedures are in place to contain security incidents that actively threaten entity objectives. | [Use Teleport to quickly revoke access and contain an active incident](../../identity-governance/locking.mdx) <br/><br/> [Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.](../../connect-your-client/teleport-clients/tsh.mdx) |
+| CC7.4 - Ends Threats Posed by Security Incidents | Procedures are in place to mitigate the effects of ongoing security incidents. | [Use Teleport to quickly revoke access and contain an active incident](../../identity-governance/locking.mdx)   | 
+| CC7.4 - Obtains Understanding of Nature of Incident and Determines Containment Strategy | An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach. | [Use Teleport’s Session Recording and Replay along with logs to understand what actions led to an incident.](../../reference/deployment/monitoring/audit.mdx) | 
+| CC7.4 - Evaluates the Effectiveness of Incident Response | The design of incident-response activities is evaluated for effectiveness on a periodic basis. | [Use audit logs and session recordings to find pain points in your incident response plan and improve effectiveness](../../enroll-resources/server-access/guides/bpf-session-recording.mdx). | 
+| CC7.4 - Periodically Evaluates Incidents | Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes. | [Use Session recording and audit logs to find patterns that lead to incidents.](../../enroll-resources/server-access/guides/bpf-session-recording.mdx)  | 
+| CC7.5 - Determines Root Cause of the Event | The root cause of the event is determined. | [Use Session recording and audit logs to find root cause.](../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
+| CC7.5 - Improves Response and Recovery Procedures | Lessons learned are analyzed and the incident-response plan and recovery procedures are improved. | [Replay Session recordings at your &#39;after action review&#39; or postmortem meetings](../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages changes throughout the system life cycle. | Enables a documented software development lifecycle through its integrations with [infrastructure as code tools](../infrastructure-as-code/infrastructure-as-code.mdx). |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Authorizes Changes, Identifies and Evaluates System Changes. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) integrations enable you to authorize changes using GitOps platforms. [Access Requests](../../identity-governance/access-requests/access-requests.mdx) enable authorization for elevated privileges. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Designs and Develops Changes. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow you to specify infrastructure access controls as code. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Documents Changes. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow for documenting configuration changes in version control system logs, and a [notification system](../../connect-your-client/teleport-clients/notifications.mdx) allows you to inform end users of system changes. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tracks System Changes. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) integrations and audit logging allow you to track the history of configuration changes and [Access Request](../../identity-governance/access-requests/access-requests.mdx) approvals in a Teleport cluster. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Configures Software. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to track dynamic resource configurations. [Helm support](../../reference/helm-reference/helm-reference.mdx) allows you to track configurations for Teleport services on Kubernetes. You can also use version control to manage Teleport [YAML configuration files](../../reference/deployment/config.mdx).|
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tests System Changes. | Teleport's infrastructure as code support and [gRPC API](../api/api.mdx) make it possible to set up staging environments and automated tests for changes in a Teleport configuration. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Approves System Changes. | [Access Requests](../../identity-governance/access-requests/access-requests.mdx) allow approvals to proposed permissions changes, and infrastructure as code support enables you to set up an approval system for configurations. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Deploys System Changes. | [RBAC protections](../../reference/access-controls/roles.mdx#rbac-for-dynamic-teleport-resources) for API resources allow you to restrict configuration changes to an authorized continuous deployment runner. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Identifies Changes in the Infrastructure, Data, Software, and Procedures Required to Remediate Incidents. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to revert changes. It is also possible for you to [back up the Auth Service backend](../deploy-a-cluster/backup-restore.mdx) on self-hosted clusters.|
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Creates Baseline Configuration of IT Technology. |[Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to set up a baseline configuration in a code repository. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Provides Changes Necessary in Emergency Situations. | Admins can use [Access Requests](../../identity-governance/access-requests/access-requests.mdx) to obtain temporarily elevated permissions in order to provide changes in emergency situations. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages Patch Changes. | [Infrastructure as code](../infrastructure-as-code/infrastructure-as-code.mdx) support enables regular patch changes to configurations. |
diff --git a/docs/pages/admin-guides/management/operations/backup-restore.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/backup-restore.mdx
similarity index 76%
rename from docs/pages/admin-guides/management/operations/backup-restore.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/backup-restore.mdx
index 64ecfa5def83e..d1c537bb6a96b 100644
--- a/docs/pages/admin-guides/management/operations/backup-restore.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/backup-restore.mdx
@@ -1,6 +1,9 @@
 ---
 title: Backup and Restore
 description: How to back up and restore your Teleport cluster state.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Operators must have a plan in place to back up self-hosted Teleport clusters.
@@ -21,7 +24,7 @@ You must back up data that the Auth Service manages across its three backends:
 - Audit event backend
 - Session recording backend
 
-See [Storage Backends](../../../reference/backends.mdx) for more information on
+See [Storage Backends](../../reference/deployment/backends.mdx) for more information on
 Teleport backends.
 
 The following table summarizes the kinds of backend data the Auth Service
@@ -51,12 +54,12 @@ listed here, consult the documentation for your backend:
 For the most part, you can use the same solution for both cluster state and
 audit events, setting aside a separate table for each kind of backend. The
 exception is etcd, which can only function as a cluster state backend. (See a
-full explanation in [Storage Backends](../../../reference/backends.mdx#etcd).)
+full explanation in [Storage Backends](../../reference/deployment/backends.mdx#etcd).)
 
 | Backend | Recommended backup strategy |
 | - | - |
 | Local Filesystem | Back up the data directory (`/var/lib/teleport/` by default) |
-| DynamoDB | [Amazon DynamoDB documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/BackupRestore.html) |
+| DynamoDB | [Amazon DynamoDB documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Backup-and-Restore.html) |
 | etcd | [etcd documentation](https://etcd.io/docs/v2.3/admin_guide/#disaster-recovery) |
 | Firestore | [Firestore documentation](https://firebase.google.com/docs/database/backups) |
 | Azure Database for PostgreSQL | [Azure Database for PostgreSQL documentation](https://learn.microsoft.com/en-us/azure/backup/backup-azure-database-postgresql) |
@@ -68,14 +71,13 @@ full explanation in [Storage Backends](../../../reference/backends.mdx#etcd).)
 | - | - |
 | Local Filesystem | Back up the data directory (`/var/lib/teleport/` by default) |
 | S3 | [Amazon S3 documentation](https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html) |
-| GCS | GCS has [built-in
-redundancy](https://cloud.google.com/storage/docs/availability-durability), but you may also use [cross-bucket replication](https://cloud.google.com/storage/docs/using-cross-bucket-replication) |
+| GCS | GCS has [built-in redundancy](https://cloud.google.com/storage/docs/availability-durability), but you may also use [cross-bucket replication](https://cloud.google.com/storage/docs/using-cross-bucket-replication) |
 | Azure Blob Storage | [Azure Blob backup documentation](https://learn.microsoft.com/en-us/azure/backup/blob-backup-overview)|
 
 ## Versioning dynamic resources with infrastructure as code
 
 Teleport uses [dynamic
-resources](../../infrastructure-as-code/infrastructure-as-code.mdx) for roles,
+resources](../infrastructure-as-code/infrastructure-as-code.mdx) for roles,
 local users, authentication connectors, and other configurations, and stores
 dynamic resource data on the cluster state backend. Backing up the cluster
 state backend protects your cluster against the loss of dynamic resource data.
@@ -94,9 +96,9 @@ Teleport provides the following infrastructure as code tools for managing
 dynamic resources:
 
 - [Terraform
-  provider](../../infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+  provider](../infrastructure-as-code/terraform-provider/terraform-provider.mdx)
 - [Kubernetes
-  operator](../../infrastructure-as-code/teleport-operator/teleport-operator.mdx)
+  operator](../infrastructure-as-code/teleport-operator/teleport-operator.mdx)
 
 ## Cloning a backend
 
@@ -128,10 +130,6 @@ Kubernetes pod that usually runs the Teleport Auth Service, you can expect the
      # parallel is the amount of backend data cloned in parallel.
      # If a clone operation is taking too long consider increasing this value.
      parallel: 100
-     # force, if set to true, will continue cloning data to a destination
-     # regardless of whether data is already present. By default this is false
-     # to protect against overwriting the data of an existing Teleport cluster.
-     force: false
    ```
 
    This example clones backend data in Amazon DynamoDB to a SQLite database.
@@ -140,7 +138,7 @@ Kubernetes pod that usually runs the Teleport Auth Service, you can expect the
    include information about the source and destination backends. Possible
    values of `src` and `dst` are the same as the `teleport.storage` section in
    the Teleport configuration file. See the [Storage
-   Backends](../../../reference/backends.mdx) reference for the configuration
+   Backends](../../reference/deployment/backends.mdx) reference for the configuration
    fields to assign for each backend.
 
 1. Run the following command on an Auth Service instance to execute the clone
@@ -155,3 +153,39 @@ You can run the `teleport backend clone` command on an Auth Service instance
 without stopping your cluster. The command retrieves each item from the source
 backend and writes it to the destination backend. Any items created on the
 source backend after the initial retrieval will not be included in the clone.
+
+
+## Rollbacks
+
+Rollbacks can be performed without any backend corruption or data loss by leveraging
+`teleport backend clone` to create a copy of an existing backend. For example, prior
+to upgrading a cluster from Teleport v18 to v19 the following clone configuration can
+be used to make a full clone of the Teleport backend state to a different key range of
+the same etcd cluster using the `prefix` field. See the etcd storage backend
+[configuration reference](../../reference/deployment/backends.mdx#etcd) for an explanation:
+
+```yaml
+src:
+  type: etcd
+  prefix: teleport
+  peers: [https://peer.example.com:2379]
+dst:
+  type: etcd
+  prefix: teleport-v18-backup
+  peers: [https://peer.example.com:2379]
+parallel: 100
+```
+
+Teleport major releases may alter the backend state in a way that
+previous versions cannot reconcile. If the upgrade to v19 fails
+and requires a rollback, this can be achieved by editing the
+Auth Service configuration to point it at the prefix containing
+the v18 backup.
+
+```yaml
+teleport:
+  storage:
+    type: etcd
+    prefix: teleport-v18-backup
+    peers: [https://peer.example.com:2379]
+```
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/breakglass-access.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/breakglass-access.mdx
new file mode 100644
index 0000000000000..e956bb7f734c5
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/breakglass-access.mdx
@@ -0,0 +1,395 @@
+---
+title: Configuring break-glass SSH Access for Disaster Recovery
+description: Guide to set up break-glass emergency SSH access for critical systems if Teleport becomes unavailable.
+---
+
+This guide will walk you through the steps required to configure emergency "break-glass" access for critical agents and servers via OpenSSH
+using Teleport-issued certificates, in the following scenarios:
+
+1. The Teleport Agent on a server has crashed, gone offline, or become unusable.
+2. The Teleport control plane is down and cannot be used to access systems, and out-of-band access is necessary to fix it.
+
+## How it works
+
+Teleport's `user` CA can issue short-lived, signed certificates that can be used to grant access to OpenSSH servers in emergency disaster recovery scenarios.
+
+By configuring the OpenSSH server alongside a Teleport Agent to trust Teleport's `user` CA, users with valid Teleport-issued certificates
+can authenticate to the server without requiring static SSH keys or passwords - even if Teleport itself is down.
+
+Below, we'll detail the steps to accomplish the following objectives:
+
+1. Configure an out-of-band OpenSSH server running on the Teleport Agent machine to trust Teleport's `user` CA
+1. Create a `breakglass` system user on the remote host
+1. Create a `breakglass` Role in Teleport
+1. Create a Teleport Machine ID bot (`tbot`) to issue a `breakglass` SSH Key and Certificate using Teleport's CA on an ongoing basis
+1. Access the remote server using a Teleport issued cert, even if Teleport is down or unresponsive
+
+<Admonition type="warning">
+You must protect any machine that holds break-glass credentials as configured in steps 4 and 5. Anyone able to access these certificates will
+be able to use them to get access to any machine configured with an out-of-band OpenSSH server (as per instructions in step 1).
+
+Additionally, any access as the `breakglass` user configured via this guide will be able to bypass Teleport session recordings and
+audit logging. You should only allow use of the `breakglass` user via this process, and this user should never be used for any purpose other
+than emergency break-glass access when the regular Teleport access path is unavailable.
+
+**Any** use of the `breakglass` user, for any reason, should be a cause for immediate investigation.
+</Admonition>
+
+## Prerequisites
+
+- OpenSSH client version 7.4 or above on your local machine.
+- A Linux host with OpenSSH server (`sshd`) version 7.4 or above.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+## Step 1/5. Configure an out-of-band OpenSSH server running on the Teleport Agent machine to trust the Teleport user CA
+
+**This step is completed on the Teleport Agent machine.**
+
+For break-glass access, an OpenSSH server must be running, and configured to trust client certificates issued by the Teleport `user`
+Certificate Authority (CA).
+
+1. Export the public key of the Teleport `user` CA:
+
+On the Teleport Agent machine, run the following command. Replace `teleport.example.com` with the address of your Teleport Proxy Service:
+
+```bash
+export KEY=$(curl 'https://<Var name="teleport.example.com" />/webapi/auth/export?type=user' | sed "s/cert-authority\ /g/")
+echo "$KEY" | sudo tee /etc/ssh/teleport_user_ca.pub
+```
+
+2. Ensure the following line is added and/or uncommented in your `/etc/ssh/sshd_config` file:
+
+```
+Include /etc/ssh/sshd_config.d/*.conf
+```
+
+3. Create a `teleport-breakglass.conf` file under `/etc/ssh/sshd_config.d`:
+
+```bash
+sudo tee /etc/ssh/sshd_config.d/teleport-breakglass.conf > /dev/null <<'EOF'
+# Teleport breakglass config
+Match User breakglass
+    # Trust the Teleport user CA for connections as this user
+    TrustedUserCAKeys /etc/ssh/teleport_user_ca.pub
+    # Explicitly use sshd's default behaviour: the username being used to connect must match a principal on the certificate
+    AuthorizedPrincipalsFile none
+    # Don't allow SSH key authentication as this user
+    AuthorizedKeysFile /dev/null
+EOF
+```
+
+4. Check the syntax of the sshd config file (you should see no errors printed):
+
+```bash
+sudo sshd -t
+```
+
+5. Restart the sshd service:
+
+```bash
+# This unit may also be called ssh.service depending on your distribution
+# Check with 'systemctl list-unit-files | grep ssh | grep service'
+sudo systemctl restart sshd
+```
+
+Now, `sshd` will trust users who present a Teleport-issued SSH certificate.
+
+
+## Step 2/5. Create a `breakglass` user on the Teleport Agent server
+
+**This step is completed on the Teleport Agent machine.**
+
+Log into the Teleport Agent server and run the following commands.
+
+1. Create the `breakglass` user:
+
+```bash
+sudo adduser --disabled-password breakglass
+```
+
+<Admonition type="note">
+As a general security principle, it is highly recommended to limit `root` permissions through `sudo`. Because `breakglass` will need
+ability to gain elevated access to the system to troubleshoot and recover access, however, any use of break-glass access should always be audited
+via `sshd` access logs.
+</Admonition>
+
+
+## Step 3/5. Create `breakglass` Role in Teleport
+
+**This step is completed on your local machine.**
+
+1. Log into your Teleport cluster with a user that has permission to create roles:
+
+```bash
+tsh login --proxy=<Var name="teleport.example.com" />
+```
+
+2. Create a `breakglass` Teleport role:
+
+Define the role in a file named `breakglass-role.yaml`:
+
+```yaml
+kind: role
+metadata:
+  name: breakglass-role
+spec:
+  allow:
+    logins:
+    - breakglass
+    node_labels:
+      '*': '*'
+  deny: {}
+  options:
+    cert_format: standard
+    forward_agent: false
+    max_session_ttl: 24h0m0s
+    port_forwarding: true
+    ssh_file_copy: true
+version: v7
+```
+
+Create the role by applying with:
+
+```bash
+tctl create -f breakglass-role.yaml
+```
+
+
+## Step 4/5. Create a Teleport Machine ID bot to issue an SSH Key and Certificate for the `breakglass` user using Teleport's CA
+
+**This step is completed on the machine where you will make use of the certificates for break-glass access.**
+
+This step will configure and start a [Teleport Machine ID bot](../../machine-workload-identity/deployment/deployment.mdx) as a background
+daemon (managed by `systemd`), which will continually generate and refresh a short-lived key and certificate for break-glass access on the machine
+where it runs.
+
+This guide will join the Teleport Machine ID bot to the cluster using a [bound keypair](../../reference/machine-workload-identity/bound-keypair/concepts.mdx)
+which is a secure, optionally single-use join method based on public key cryptography, providing a strong guarantee of security and protection against
+credential theft.
+
+The configuration below generates a certificate which is valid for 24 hours from the time of issuance, refreshed every 2 hours. This means that
+depending on the exact time of usage, the certificate will be usable for break-glass access for between 22 and 24 hours. This validity period was
+chosen as a sane default to strike a good balance between usability (shorter-lived certificates may be invalid by the time they are needed) and
+security (longer-lived certificates are less secure, as the period where they could be used if compromised is longer).
+
+1. Create a `breakglass` bot which will run in the background to continually refresh a certificate which is valid for break-glass usage:
+
+Define the bot in a file named `breakglass-bot.yaml`:
+
+```yaml
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: breakglass-bot
+spec:
+  # roles is a list of roles to grant to the Bot
+  roles: ['breakglass-role']
+```
+
+2. Create the bot using `tctl`:
+
+```bash
+tctl create -f breakglass-bot.yaml
+```
+
+3. Create a [bound keypair](../../reference/machine-workload-identity/bound-keypair/bound-keypair.mdx) to use as a join method for running instances of the bot:
+
+Define the join method in a file named `breakglass-token.yaml`:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  # This name will be used in tbot's `onboarding.token` field.
+  name: breakglass-bot-join-token
+spec:
+  roles: [Bot]
+  # bot_name must match the name of the bot created earlier.
+  bot_name: breakglass-bot
+  join_method: bound_keypair
+  bound_keypair:
+    recovery:
+      mode: standard
+      limit: 1
+```
+
+4. Create the token using `tctl`:
+
+```bash
+tctl create -f breakglass-token.yaml
+```
+
+5. Get the `registration_secret` for the bot using `tctl` - this is needed to create the bot's config file in the next step.
+
+```bash
+tctl get token/breakglass-bot-join-token --format=json | jq -r '.[0].status.bound_keypair.registration_secret'
+```
+
+This assumes `jq` is installed. If not, run `tctl get token/breakglass-bot-join-token` and inspect the `.status.bound_keypair.registration_secret` field.
+
+6. Write a config file for the bot.
+
+Define the config in a file named `/etc/tbot-teleport-breakglass.yaml`:
+
+```yaml
+version: v2
+# replace teleport.example.com with the FQDN of your Teleport proxy server
+proxy_server: <Var name="teleport.example.com" />:443
+certificate_ttl: "24h"
+renewal_interval: "2h"
+onboarding:
+  join_method: bound_keypair
+  token: breakglass-bot-join-token
+  bound_keypair:
+    # replace this with the value of `registration_secret` from the previous step
+    registration_secret: REGISTRATION-SECRET-VALUE-FROM-PREVIOUS-STEP
+storage:
+  type: directory
+  # change to a directory to use to store the bot's own identity for communicating with the Teleport cluster
+  path: /var/lib/teleport/breakglass-bot
+outputs:
+- type: identity
+  destination:
+    type: directory
+    # change to the output directory you'd like to use to store the bot's outputted OpenSSH private key and certificate
+    path: /opt/teleport-breakglass-output
+```
+
+7. To configure the bot to run in the background, write out a systemd unit file for the bot:
+
+```bash
+sudo tbot install systemd \
+  --write \
+  --name tbot-teleport-breakglass \
+  --config /etc/tbot-teleport-breakglass.yaml \
+  --user teleport-breakglass \
+  --group teleport-breakglass
+```
+
+The user and group you specify here must already exist on the server running the `tbot` service. If you do not already have a `teleport-breakglass` user
+and group, create one:
+
+```bash
+sudo useradd -s /sbin/nologin teleport-breakglass
+```
+
+You must also create the bot's storage and output directories, and give the `teleport-breakglass` user permissions.
+
+```bash
+sudo mkdir -p /var/lib/teleport-breakglass /opt/teleport-breakglass/output
+sudo chown teleport-breakglass:teleport-breakglass /var/lib/teleport-breakglass /opt/teleport-breakglass /opt/teleport-breakglass/output
+sudo chmod 700 /var/lib/teleport-breakglass /opt/teleport-breakglass /opt/teleport-breakglass/output
+```
+
+8. Reload the systemd configuration:
+
+```bash
+sudo systemctl daemon-reload
+```
+
+9. Configure the bot to start when the machine boots, and start it immediately:
+
+```bash
+sudo systemctl enable --now tbot-teleport-breakglass
+```
+
+10. Check that the bot has started successfully:
+
+```bash
+$ sudo systemctl status tbot-teleport-breakglass
+● tbot-teleport-breakglass.service - tbot-teleport-breakglass - Teleport Machine & Workload Identity Service
+     Loaded: loaded (/etc/systemd/system/tbot-teleport-breakglass.service; enabled; preset: enabled)
+     Active: active (running) since Thu 2025-11-27 10:32:24 AST; 7s ago
+   Main PID: 2437534 (tbot)
+      Tasks: 9 (limit: 9065)
+     Memory: 22.8M (peak: 23.4M)
+        CPU: 239ms
+     CGroup: /system.slice/tbot-teleport-breakglass.service
+             └─2437534 /usr/local/bin/tbot start -c /etc/tbot-teleport-breakglass.yaml
+```
+
+11. Check that the bot has correctly outputted a certificate:
+
+```bash
+$ ls -l /opt/teleport-breakglass/output/
+total 60
+-rw------- 1 teleport-breakglass teleport-breakglass 5513 Nov 27 10:32 identity
+-rw------- 1 teleport-breakglass teleport-breakglass  241 Nov 27 10:32 key
+-rw------- 1 teleport-breakglass teleport-breakglass 1274 Nov 27 10:32 key-cert.pub
+-rw------- 1 teleport-breakglass teleport-breakglass  161 Nov 27 10:32 key.pub
+-rw------- 1 teleport-breakglass teleport-breakglass  612 Nov 27 10:32 known_hosts
+-rw------- 1 teleport-breakglass teleport-breakglass 1379 Nov 27 10:32 ssh_config
+-rw------- 1 teleport-breakglass teleport-breakglass 1330 Nov 27 10:32 teleport-database-ca.crt
+-rw------- 1 teleport-breakglass teleport-breakglass 2051 Nov 27 10:32 teleport-host-ca.crt
+-rw------- 1 teleport-breakglass teleport-breakglass  794 Nov 27 10:32 teleport-user-ca.crt
+-rw------- 1 teleport-breakglass teleport-breakglass 1375 Nov 27 10:32 tlscert
+```
+
+12. Check the validity of the certificate to see that it is valid for ~24 hours from now:
+
+```bash
+$ date
+Thu Nov 27 10:39:41 AST 2025
+$ sudo -u teleport-breakglass ssh-keygen -Lf /opt/teleport-breakglass/output/key-cert.pub | grep Valid
+        Valid: from 2025-11-27T10:31:24 to 2025-11-28T10:32:24
+```
+
+
+## Step 5/5. Access the Teleport Agent machine using OpenSSH
+
+**This step is completed on the machine where you will make use of the certificates for break-glass access.**
+
+1. Create a local SSH config which uses the Teleport-issued break-glass certificate to connect:
+
+Define the config in a file called `/opt/teleport-breakglass/breakglass_ssh_config`:
+
+```bash
+Host *
+    User breakglass
+    UserKnownHostsFile /opt/teleport-breakglass/output/known_hosts
+    IdentityFile /opt/teleport-breakglass/output/key
+    CertificateFile /opt/teleport-breakglass/output/key-cert.pub
+    StrictHostKeyChecking no
+```
+
+Make sure the permissions are set correctly:
+
+```bash
+sudo chown teleport-breakglass:teleport-breakglass /opt/teleport-breakglass/breakglass_ssh_config
+```
+
+2. Now, use the break-glass SSH config to securely access the Teleport Agent using the `breakglass` user and Teleport-issued certificate:
+
+```bash
+sudo -u teleport-breakglass ssh -F /opt/teleport-breakglass/breakglass_ssh_config sshd-server
+```
+
+<Admonition type="note">
+We use `sudo -u teleport-breakglass ssh` here because the outputted certificates and files in the `/opt/teleport-breakglass-output` directory
+are only readable by the `teleport-breakglass` user and `root`, to improve security.
+</Admonition>
+
+If you do not have DNS resolution available for the hostname you need to connect to, you can use the IP address:
+
+```bash
+sudo -u teleport-breakglass ssh -F /opt/teleport-breakglass/breakglass_ssh_config 10.11.12.134
+```
+
+Alternatively, you can provide the IP to use with the `HostName` option to `ssh`:
+
+```bash
+sudo -u teleport-breakglass ssh -F /opt/teleport-breakglass/breakglass_ssh_config -o "HostName=10.11.12.134" sshd-server
+```
+
+<Admonition type="important">
+If the connection from `tbot` to the Teleport control plane remains offline, the outputted certificate will only be valid for the following
+22 hours, then it will expire and break-glass access will no longer be available. If you cannot restore access to your Teleport control plane
+within this timeframe, you should use your break-glass access to set up alternative strategies for access while the certificate is still valid.
+</Admonition>
+
+---
+
+The method described above ensures you can securely access your servers and Teleport Agents in emergency scenarios using Teleport CA signed certificates,
+even if Teleport's agents or control plane are down. This process can be used for any Teleport Agent running on a server which supports OpenSSH.
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx
new file mode 100644
index 0000000000000..5cf97787fa59e
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deploy-a-cluster.mdx
@@ -0,0 +1,32 @@
+---
+title: Self-Hosting Teleport
+sidebar_label: Self-Hosting
+sidebar_position: 5
+description: "Guides to running a self-hosted Teleport cluster in production."
+tags:
+ - platform-wide
+---
+
+These guides show you how to run a self-hosted Teleport cluster in production.
+
+## Getting started
+
+Self-hosted Teleport Enterprise subscriptions require a valid license. We
+recommend [reaching out to us directly](https://goteleport.com/contact-us/) to
+learn more about getting started with this deployment option and start planning
+your approach. Self-hosted Teleport Enterprise deployments typically take place
+in conversation with the team at Teleport.
+
+While designing a deployment, you can consult the [High
+Availability](deployments/high-availability.mdx) guide for the components of a production
+Teleport cluster. 
+
+## Dedicated account dashboard
+
+Teleport Enterprise subscriptions include a dedicated account dashboard with their preferred
+subdomain of [teleport.sh](https://teleport.sh). The dedicated account dashboard provides
+subscription administrators access to the license file, support links and Teleport Enterprise binary downloads.
+
+## Guides to self-hosting Teleport 
+
+<DocCardList />
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx
similarity index 89%
rename from docs/pages/admin-guides/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx
index 346a8c049a25c..c48086e6cebd5 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment.mdx
@@ -1,12 +1,17 @@
 ---
-title: "AWS Multi-Region Proxy Deployment"
+title: "AWS Multi-Region Proxy Service Deployment"
+sidebar_label: Multi-Region Proxy Service
 description: "Deploying a high-availability multi-region Teleport cluster using Proxy Peering and Route 53."
+tags:
+ - conceptual
+ - platform-wide
+ - aws
 ---
 
 This deployment architecture features two important design decisions:
 
 - Amazon Route 53 latency-based routing is used to ensure that users and agents connect to the closest available proxy.
-- Teleport's [Proxy Peering](../../../reference/architecture/proxy-peering.mdx) is used to reduce the total number of tunnel connections in the Teleport cluster.
+- Teleport's [Proxy Peering](../proxy-peering.mdx) is used to reduce the total number of tunnel connections in the Teleport cluster.
 
 This deployment architecture isn't recommended for use cases where your users or resources are
 clustered in a single region, or for Managed Service Providers needing to provide separate clusters
@@ -15,6 +20,11 @@ to customers.
 This architecture is best suited for globally distributed resources and end-users that prefer a single point of
 entry while also ensuring minimal latency when accessing connected resources.
 
+This guide assumes that your infrastructure is **not** hosted in AWS GovCloud or
+in an air-gapped AWS environment (EKS Anywhere). If it is, [contact the Teleport
+team](https://goteleport.com/contact-us) for assistance planning your
+deployment.
+
 ## Key deployment components
 
 - Deployed exclusively in the AWS ecosystem
@@ -22,7 +32,7 @@ entry while also ensuring minimal latency when accessing connected resources.
 - High-availability Auto Scaling group of Proxy Service instances deployed across multiple regions
 - [Amazon Route 53 latency-based routing](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-latency.html)
 - [Teleport TLS Routing](../../../reference/architecture/tls-routing.mdx) to reduce the number of ports needed to use Teleport
-- [Teleport Proxy Peering](../../../reference/architecture/proxy-peering.mdx) for reducing the number of resource connections
+- [Teleport Proxy Peering](../proxy-peering.mdx) for reducing the number of resource connections
 - [AWS Network Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)
 - [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html) for cluster state storage
 - [AWS S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) for session recording storage
@@ -146,7 +156,7 @@ Example Hosted Zone using AWS Route53 Latency Routing:
 |```teleport.example.com```|CNAME|Latency|eu-central-1| ```elb.eu_central-1.amazonaws.com```|
 |```*.teleport.example.com```|CNAME|Latency|eu-central-1| ```elb.eu_central-1.amazonaws.com```|
 
-<Admonition title="Required permissions">
+<Admonition type="important" title="Required permissions">
 
 If you are using Let's Encrypt to provide TLS credentials to your Teleport
 instances, the TLS credential system we mentioned earlier needs permissions to
@@ -172,12 +182,12 @@ teleport:
         enabled: true
     ...
 ```
-Review the [configuration reference](../../../reference/config.mdx) page for
+Review the [configuration reference](../../../reference/deployment/config.mdx) page for
 additional settings.
 
 ## Configure Proxy Peering
 
-In this deployment architecture, [Proxy Peering](../../../reference/architecture/proxy-peering.mdx) is used to restrict the number of connections made from
+In this deployment architecture, [Proxy Peering](../proxy-peering.mdx) is used to restrict the number of connections made from
 resources to proxies in the Teleport Cluster.
 
 ### Auth Service Proxy Peering configuration
@@ -191,7 +201,7 @@ auth_service:
   type: proxy_peering
   agent_connection_count: 2
 ```
-Reference the [Auth Service configuration](../../../reference/config.mdx) reference page
+Reference the [Auth Service configuration](../../../reference/deployment/config.mdx) reference page
 for additional settings.
 
 ### Proxy Service Proxy Peering configuration
@@ -238,5 +248,5 @@ proxy_service:
 the likelihood of agents being unavailable.
 </Admonition>
 
-Reference the [Proxy Service configuration](../../../reference/config.mdx) reference page
+Reference the [Proxy Service configuration](../../../reference/deployment/config.mdx) reference page
 for additional settings.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
similarity index 97%
rename from docs/pages/admin-guides/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
index 5de625376b234..a8f69a2afccd3 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
@@ -1,8 +1,12 @@
 ---
-title: Teleport High Availability mode on AWS
+title: Deploy Teleport in Production with Terraform on AWS
+sidebar_label: Terraform (Production HA)
 description: How to configure Teleport in High Availability mode for AWS deployments.
-h1: Running Teleport Enterprise in High Availability mode on AWS
-tocDepth: 3
+tags:
+ - infrastructure-as-code
+ - how-to
+ - platform-wide
+ - aws
 ---
 
 This guide is designed to accompany our [reference Terraform code](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster#terraform-based-provisioning-example-amazon-single-ami)
@@ -12,6 +16,13 @@ and describe how to manage the resulting Teleport deployment.
 
 ## Prerequisites
 
+This guide assumes that your infrastructure is **not** hosted in AWS GovCloud or
+in an air-gapped AWS environment (EKS Anywhere). If it is, [contact the Teleport
+team](https://goteleport.com/contact-us) for assistance planning your
+deployment.
+
+This guide also requires the following:
+
 - Terraform installed on your system. Visit [Install
   Terraform](https://developer.hashicorp.com/terraform/install) for
   instructions. We will assume that you have `terraform` available on your path.
@@ -27,11 +38,11 @@ and describe how to manage the resulting Teleport deployment.
   and macOS Homebrew as the `awscli` package.
 
   Fedora/CentOS: `yum -y install awscli`
-  
+
   Ubuntu/Debian: `apt-get -y install awscli`
-  
+
   macOS (with [Homebrew](https://brew.sh/)): `brew install awscli`
-  
+
   When possible, installing via a package is always preferable. If you can't
   find a package available for your distribution, you can also download the tool
   from [https://aws.amazon.com/cli/](https://aws.amazon.com/cli/)
@@ -171,12 +182,12 @@ cluster from scratch, so choose carefully. A good example might be something lik
 $ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)-x86_64"
 ```
 
-Teleport (Gravitational) automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2
+Teleport (Gravitational) automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS
 AMIs when we release a new version of Teleport. The AMI names follow the format: `teleport-<type>-<version>-<arch>`
 where `<type>` is either `oss` or `ent` (Enterprise), `<version>` is the version of Teleport, e.g. `(=teleport.version=)`,
 and `<arch>` is either `x86_64` or `arm64`.
 
-FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix after `<arch>`,
+FIPS 140 compatible AMIs (which deploy Teleport in FIPS mode by default) have the `-fips` suffix after `<arch>`,
 e.g. `teleport-ent-(=teleport.version=)-x86_64-fips`.
 
 The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with
@@ -196,7 +207,7 @@ the example `awscli` commands below. The output is in JSON format by default.
   $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*'
   ```
 
-  Enterprise FIPS 140-2 AMIs<br/>
+  Enterprise FIPS AMIs<br/>
   ```code
   $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*'
   ```
@@ -432,7 +443,7 @@ table for cluster state will be the same as the cluster name configured in the [
 
 In our example, the DynamoDB table would be called `teleport-example`.
 
-More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/backends.mdx).
+More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/deployment/backends.mdx).
 
 ### Audit event storage
 
@@ -442,7 +453,7 @@ with `-events` appended to the end.
 
 In our example, the DynamoDB table would be called `teleport-example-events`.
 
-More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/backends.mdx).
+More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/deployment/backends.mdx).
 
 ### Recorded session storage
 
@@ -842,13 +853,13 @@ $ journalctl -u teleport-node.service
 ## Adding agents to your Teleport cluster
 
 Customers run many workloads within AWS and depending on how you work, there are many
-ways to integrate Teleport onto your servers. We recommend looking at our [Installation guide](../../../installation.mdx).
+ways to integrate Teleport onto your servers. We recommend looking at our [Installation guide](../../../installation/installation.mdx).
 
 To add new nodes/EC2 servers that you can "SSH into" you'll need to:
 
-- [Install the Teleport binary on the Server](../../../installation.mdx)
-- [Run Teleport - we recommend using systemd](../../management/admin/daemon.mdx)
-- [Set the correct settings in /etc/teleport.yaml](../../../reference/config.mdx)
+- [Install the Teleport binary on the Server](../../../installation/installation.mdx)
+- [Run Teleport - we recommend using systemd](../../management/daemon.mdx)
+- [Set the correct settings in /etc/teleport.yaml](../../../reference/deployment/config.mdx)
 - [Add Nodes to the Teleport
   cluster](../../../enroll-resources/agents/agents.mdx)
 
@@ -890,7 +901,7 @@ spec:
 ```
 
 You can generate a token for adding the trusted cluster using `tctl tokens add --type=trusted_cluster` after connecting
-to a Teleport Auth Service instance. Follow the instructions in our [Trusted Clusters guide](../../management/admin/trustedclusters.mdx).
+to a Teleport Auth Service instance. Follow the instructions in our [Trusted Clusters guide](../trustedclusters.mdx).
 
 ## Script to quickly connect to instances
 
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
similarity index 97%
rename from docs/pages/admin-guides/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
index 4403f3716b582..1d77a46c5a4d9 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
@@ -1,7 +1,12 @@
 ---
 title: Teleport Single-Instance Deployment on AWS
+sidebar_label: Terraform (Single-Instance)
 description: How to quickly configure Teleport on a single instance for testing in AWS.
-tocDepth: 3
+tags:
+ - infrastructure-as-code
+ - how-to
+ - platform-wide
+ - aws
 ---
 
 This guide is designed to accompany our [reference starter-cluster Terraform code](https://github.com/gravitational/teleport/tree/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster#teleport-terraform-aws-ami-simple-example)
@@ -25,6 +30,13 @@ More details are [provided below](#reference-deployment-defaults).
 
 ## Prerequisites
 
+This guide assumes that your infrastructure is **not** hosted in AWS GovCloud or
+in an air-gapped AWS environment (EKS Anywhere). If it is, [contact the Teleport
+team](https://goteleport.com/contact-us) for assistance planning your
+deployment.
+
+This guide also requires the following:
+
 - Terraform installed on your system. Visit [Install
   Terraform](https://developer.hashicorp.com/terraform/install) for
   instructions. We will assume that you have `terraform` available on your path.
@@ -183,12 +195,12 @@ cluster from scratch, so choose carefully. A good example might be something lik
 $ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)-x86_64"
 ```
 
-Teleport (Gravitational) automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we
+Teleport (Gravitational) automatically builds and publishes OSS, Enterprise and Enterprise FIPS AMIs when we
 release a new version of Teleport. The AMI names follow the format: `teleport-<type>-<version>-<arch>`
 where `<type>` is either `oss` or `ent` (Enterprise), `<version>` is the version of Teleport, e.g. `(=teleport.version=)`,
 and `<arch>` is either `x86_64` or `arm64`.
 
-FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix after `<arch>`,
+FIPS compatible AMIs (which deploy Teleport in FIPS mode by default) have the `-fips` suffix after `<arch>`,
 e.g. `teleport-ent-(=teleport.version=)-x86_64-fips`.
 
 The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with
@@ -208,7 +220,7 @@ the example `awscli` commands below. The output is in JSON format by default.
   $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*'
   ```
 
-  Enterprise FIPS 140-2 AMIs<br/>
+  Enterprise FIPS AMIs<br/>
   ```code
   $ aws --region <Var name="us-west-2" /> ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*'
   ```
@@ -410,7 +422,7 @@ table for cluster state will be the same as the cluster name configured in the [
 
 In our example, the DynamoDB table would be called `teleport-example`.
 
-More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/backends.mdx).
+More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/deployment/backends.mdx).
 
 ### Audit event storage
 
@@ -420,7 +432,7 @@ with `-events` appended to the end.
 
 In our example, the DynamoDB table would be called `teleport-example-events`.
 
-More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/backends.mdx).
+More information about how Teleport works with DynamoDB can be found in our [Storage Backends guide](../../../reference/deployment/backends.mdx).
 
 ### Recorded session storage
 
@@ -732,13 +744,13 @@ The `systemd` service name is different between Let's Encrypt (`teleport.service
 The easiest way to quickly join new resources to your cluster is to use the "Enroll New Resource" wizards in the Teleport web UI.
 
 Customers run many workloads within AWS and depending on how you work, there are many manual
-ways to integrate Teleport onto your servers. We recommend looking at our [Installation guide](../../../installation.mdx).
+ways to integrate Teleport onto your servers. We recommend looking at our [Installation guide](../../../installation/installation.mdx).
 
 To add new nodes/EC2 servers that you can "SSH into" you'll need to:
 
-- [Install the Teleport binary on the Server](../../../installation.mdx)
-- [Run Teleport - we recommend using systemd](../../management/admin/daemon.mdx)
-- [Set the correct settings in /etc/teleport.yaml](../../../reference/config.mdx)
+- [Install the Teleport binary on the Server](../../../installation/installation.mdx)
+- [Run Teleport - we recommend using systemd](../../management/daemon.mdx)
+- [Set the correct settings in /etc/teleport.yaml](../../../reference/deployment/config.mdx)
 - [Add Nodes to the Teleport
   cluster](../../../enroll-resources/agents/agents.mdx)
 
diff --git a/docs/pages/admin-guides/deploy-a-cluster/deployments/deployments.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/deployments.mdx
similarity index 91%
rename from docs/pages/admin-guides/deploy-a-cluster/deployments/deployments.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/deployments.mdx
index 0b23d038b6fab..714850af87ce4 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/deployments/deployments.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/deployments.mdx
@@ -1,7 +1,9 @@
 ---
-title: Reference Deployment Guides
+title: Deployment Guides
 description: Teleport Installation and Configuration Reference Deployment Guides.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - platform-wide
 ---
 
 These guides show you how to set up a full self-hosted Teleport deployment on
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/deployments/gcp.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/gcp.mdx
new file mode 100644
index 0000000000000..a07d3cdd554a0
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/gcp.mdx
@@ -0,0 +1,357 @@
+---
+title: Running Teleport on GCP
+sidebar_label: Google Cloud VMs
+description: How to install and configure Teleport on GCP
+tags:
+ - conceptual
+ - platform-wide
+ - google-cloud
+---
+
+We've created this guide to give customers an overview of how to deploy a
+self-hosted Teleport cluster on [Google Cloud](https://cloud.google.com/gcp/)
+(GCP). This guide provides a high-level introduction to setting up and running
+Teleport in production.
+
+We have split this guide into:
+
+- [GCP Teleport Introduction](#gcp-teleport-introduction)
+- [GCP Quickstart](#gcp-quickstart)
+
+(!docs/pages/includes/cloud/call-to-action.mdx!)
+
+## GCP Teleport Introduction
+
+This guide will cover how to set up, configure and run Teleport on GCP.
+
+The following GCP Services are required to run Teleport in high availability mode:
+
+- [Compute Engine: VM Instances with Instance Groups](#compute-engine-vm-instances-with-instance-groups)
+- [Compute Engine: Health Checks](#compute-engine-health-checks)
+- [Storage: Cloud Firestore](#storage-cloud-firestore)
+- [Storage: Google Cloud Storage](#storage-google-cloud-storage)
+- [Network Services: Load Balancing](#network-services-load-balancing)
+- [Network Services: Cloud DNS](#network-services-cloud-dns)
+
+Other things needed:
+
+- [SSL Certificate](https://cloud.google.com/load-balancing/docs/ssl-certificates)
+
+Optional:
+
+- Management Tools: Cloud Deployment Manager
+- Logging: Stackdriver
+
+We recommend setting up Teleport in high availability mode.
+In high availability mode Firestore is used for cluster state and audit logs,
+and Google Cloud Storage is used for session recordings.
+
+![GCP Intro Image](../../../../img/gcp/gcp-teleport.svg)
+
+Throughout this guide, we'll make use of the following placeholder variables.
+Please replace them with values appropriate for your environment.
+
+| Name     | Example     | Description |
+| -------- | ----------- | ----------- |
+| `Example_GCP_PROJECT` | teleport-project | Your GCP project ID |
+| `Example_GCP_CREDENTIALS` | /var/lib/teleport/google.json | Path to service account credentials |
+| `Example_FIRESTORE_CLUSTER_STATE` | teleport-cluster-state | Name of the Firestore collection for Teleport cluster state |
+| `Example_FIRESTORE_AUDIT_LOGS` | teleport-audit-logs | Name of the Firestore collection for Teleport audit logs |
+| `Example_BUCKET_NAME` | teleport-session-recordings | Name of the GCS bucket for session recording storage |
+
+### Compute Engine: VM Instances with Instance Groups
+
+We recommend using `n1-standard-2` instances in production. It's best to separate
+Teleport Proxy Service and Auth Service instances using instance groups for each.
+
+### Compute Engine: Health Checks
+
+GCP relies heavily on [Health Checks](https://cloud.google.com/load-balancing/docs/health-checks),
+this is helpful when adding new instances to an instance group.
+
+To enable health checks in Teleport start with `teleport start --diag-addr=0.0.0.0:3000`
+see  [Admin Guide: Troubleshooting](../../management/diagnostics/troubleshooting.mdx) for more information.
+
+### Storage: Cloud Firestore
+
+The [Firestore](https://cloud.google.com/firestore/) backend uses real-time
+updates to keep individual Auth Service instances in sync, and requires Firestore configured
+in native mode.
+
+To configure Teleport to store audit events in Firestore, add the following to
+the teleport section of your Auth Service's config file (by default it's `/etc/teleport.yaml`):
+
+```yaml
+teleport:
+  storage:
+    type: firestore
+    collection_name: Example_FIRESTORE_CLUSTER_STATE
+    project_id: Example_GCP_PROJECT
+    credentials_path: Example_GCP_CREDENTIALS
+    audit_events_uri: [ 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS' ]
+```
+
+<Admonition type="warning" title="Table Names">
+Be careful to ensure that `Example_FIRESTORE_CLUSTER_STATE` and `Example_FIRESTORE_AUDIT_LOGS`
+refer to *different* Firestore collections. The schema is different for each, and using the same
+collection for both types of data will result in errors.
+</Admonition>
+
+### Storage: Google Cloud Storage
+
+The Google Cloud Storage backend is used for Teleport session recordings.
+Teleport will try to create the bucket on startup if it doesn't already exist.
+If you prefer, you can create the bucket ahead of time. In this case, Teleport
+does not need permissions to create buckets.
+
+When creating the Bucket, we recommend setting it up as `Dual-region` with
+the `Standard` storage class. Provide access using a `Uniform` access control
+with a Google-managed key.
+
+When setting up `audit_sessions_uri` use the `gs://` prefix.
+
+```yaml
+storage:
+    ...
+    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
+    ...
+```
+
+### Network Services: Load Balancing
+
+Load Balancing is required for Proxy and SSH traffic. Use `TCP Load Balancing` as
+Teleport requires custom ports for SSH and Web Traffic.
+
+### Network Services: Cloud DNS
+
+Cloud DNS is used to set up the public URL of the Teleport Proxy.
+
+### Access: Service accounts
+
+The Teleport Auth Service will need to read and write to Firestore and
+Google Cloud Storage. For this you will need a Service Account with the
+correct permissions.
+
+If you want Teleport to be able to create its own GCS bucket, you'll need to
+create a role allowing the `storage.buckets.create` permission. You can skip
+this step if you choose to create the bucket before installing Teleport.
+
+To create this role, start by defining the role in a YAML file:
+
+```yaml
+# teleport_auth_role.yaml
+title: teleport_auth_role
+description: 'Teleport permissions for GCP'
+stage: ALPHA
+includedPermissions:
+# Allow Teleport to create the GCS bucket for session
+# recordings if it doesn't already exist.
+- storage.buckets.create
+```
+
+Create the role using this file:
+
+```code
+$ gcloud iam roles create teleport_auth_role \
+    --project Example_GCP_PROJECT \
+    --file teleport_auth_role.yaml \
+    --format yaml
+```
+
+Note the `name` field in the output which is the fully qualified name for the
+custom role and must be used in later steps.
+
+```code
+$ export IAM_ROLE=<role name output from above>
+```
+
+If you don't already have a GCP service account for your Teleport Auth Service
+you can create one with the following command, otherwise use your existing
+service account.
+
+```code
+$ gcloud iam service-accounts create teleport-auth-server \
+    --description="Service account for Teleport Auth Service" \
+    --display-name="Teleport Auth Service" \
+    --format=yaml
+```
+
+Note the `email` field in the output, this must be used as the identifier for
+the service account.
+
+```code
+$ export SERVICE_ACCOUNT=<email output from above command>
+```
+
+Lastly, bind the required IAM roles to your newly created service account.
+
+```code
+# our custom IAM role allows Teleport to create the GCS
+# bucket for session recordings if it doesn't already exist
+$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
+    --member=serviceAccount:$SERVICE_ACCOUNT \
+    --role=$IAM_ROLE
+
+# datastore.owner grants the required Firestore access
+$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
+    --member=serviceAccount:$SERVICE_ACCOUNT \
+    --role=roles/datastore.owner
+
+# storage.objectAdmin is needed to read/write/delete storage objects
+$ gcloud projects add-iam-policy-binding Example_GCP_PROJECT \
+    --member=serviceAccount:$SERVICE_ACCOUNT \
+    --role=roles/storage.objectAdmin
+```
+
+**Download JSON Service Key**
+
+The credentials for this service account should be exported in JSON format
+and provided to Teleport throughout the remainder of this guide.
+
+![GCP Service Key](../../../../img/gcp/gcp-service-key.png)
+
+## GCP Quickstart
+
+### 1. Create Resources
+
+We recommend starting by creating the resources. We highly recommend creating these
+an infrastructure automation tool such as [Cloud Deployment Manager](https://cloud.google.com/deployment-manager/) or Terraform.
+
+### 2. Install & Configure Teleport
+
+Follow install instructions from our [installation page](../../../installation/installation.mdx).
+
+We recommend configuring Teleport as per the below steps:
+
+<Tabs>
+	<TabItem label="Teleport Community Edition" scope="oss">
+**1. Configure Teleport Auth Service** using the below example `teleport.yaml`, and start it
+using [systemd](../../management/daemon.mdx). The DEB/RPM installations will
+automatically include the `systemd` configuration.
+
+```yaml
+#
+# Sample Teleport configuration teleport.yaml file for Auth Service
+#
+teleport:
+  nodename: teleport-auth-server
+  data_dir: /var/lib/teleport
+  pid_file: /run/teleport.pid
+  log:
+    output: stderr
+    severity: DEBUG
+  storage:
+    type: firestore
+    collection_name: Example_FIRESTORE_CLUSTER_STATE
+    # Credentials: Path to google service account file, used for Firestore and Google Storage.
+    credentials_path: Example_GCP_CREDENTIALS
+    project_id: Example_GCP_PROJECT
+    audit_events_uri: 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
+    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
+auth_service:
+  enabled: true
+  tokens:
+    - "proxy:(= presets.tokens.first =)"
+    - "node:(= presets.tokens.second =)"
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+```
+	</TabItem>
+	<TabItem label="Enterprise" label="Enterprise" scope={["enterprise"]}>
+**1. Configure Teleport Auth Service** using the below example `teleport.yaml`, and start it
+using [systemd](../../management/daemon.mdx). The DEB/RPM installations will
+automatically include the `systemd` configuration.
+
+```yaml
+#
+# Sample Teleport configuration teleport.yaml file for Auth Service
+#
+teleport:
+  nodename: teleport-auth-server
+  data_dir: /var/lib/teleport
+  pid_file: /run/teleport.pid
+  log:
+    output: stderr
+    severity: DEBUG
+  storage:
+    type: firestore
+    collection_name: Example_FIRESTORE_CLUSTER_STATE
+    # Credentials: Path to google service account file, used for Firestore and Google Storage.
+    credentials_path: Example_GCP_CREDENTIALS
+    project_id: Example_GCP_PROJECT
+    audit_events_uri: 'firestore://Example_FIRESTORE_AUDIT_LOGS?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
+    audit_sessions_uri: 'gs://Example_BUCKET_NAME?projectID=Example_GCP_PROJECT&credentialsPath=Example_GCP_CREDENTIALS'
+auth_service:
+  enabled: true
+  license_file: /var/lib/teleport/license.pem
+  tokens:
+    - "proxy:(= presets.tokens.first =)"
+    - "node:(= presets.tokens.second =)"
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+```
+
+(!docs/pages/includes/enterprise/obtainlicense.mdx!)
+
+Save your license file on the Auth Service instances at the path,
+`/var/lib/teleport/license.pem`.
+	</TabItem>
+</Tabs>
+
+**2. Set up Proxy**
+
+Save the following configuration file as `/etc/teleport.yaml` on the Proxy Server:
+
+```yaml
+# enable multiplexing all traffic on TCP port 443
+version: v3
+teleport:
+  auth_token: (= presets.tokens.first =)
+  # We recommend using a TCP load balancer pointed to the auth servers when
+  # setting up in High Availability mode.
+  auth_server: auth.example.com:3025
+# enable proxy service, disable auth and ssh
+ssh_service:
+  enabled: false
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: true
+  web_listen_addr: 0.0.0.0:443
+  public_addr: teleport.example.com:443
+  # automatically get an ACME certificate for teleport.example.com (works for a single proxy)
+  acme:
+    enabled: true
+    email: example@email.com
+```
+
+**3. Set up Teleport Nodes**
+
+Save the following configuration file as `/etc/teleport.yaml` on the Node:
+
+```yaml
+version: v3
+teleport:
+  auth_token: (= presets.tokens.second =)
+  # Teleport Agents can be joined to the cluster via the Proxy Service's
+  # public address. This will establish a reverse tunnel between the Proxy
+  # Service and the agent that is used for all traffic.
+  proxy_server: teleport.example.com:443
+# enable the SSH Service and disable the Auth and Proxy Services
+ssh_service:
+  enabled: true
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: false
+```
+
+**4. Add Users**
+
+Follow our [Local Users](../../rbac-get-started/users.mdx) guide or integrate
+with [Google Workspace](../../sso/integrate-idp/google-workspace.mdx) to
+provide SSO access.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/high-availability.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/high-availability.mdx
similarity index 93%
rename from docs/pages/admin-guides/deploy-a-cluster/high-availability.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/high-availability.mdx
index 2b93e0280ad51..11bf360ab6af4 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/high-availability.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/high-availability.mdx
@@ -1,7 +1,11 @@
 ---
 title: "Deploying a High Availability Teleport Cluster"
+sidebar_label: High Availability
+sidebar_position: 1
 description: "Deploying a High Availability Teleport Cluster"
-tocDepth: 3
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 When deploying Teleport in production, you should design your deployment to
@@ -45,7 +49,7 @@ Infrastructure components include:
   credential provisioner will need to manage DNS records to demonstrate control
   over your domain name.
 
-![Architecture of a high availability Teleport deployment](../../../img/ha-diagram.png)
+![Architecture of a high availability Teleport deployment](../../../../img/ha-diagram.png)
 
 ## Layer 4 load balancers
 
@@ -71,7 +75,7 @@ solution) to ensure availability.
 #### TLS Routing
 
 The way you configure the Proxy Service load balancer depends on whether you
-will enable [TLS Routing](../management/operations/tls-routing.mdx) in your
+will enable [TLS Routing](../tls-routing.mdx) in your
 Teleport cluster.
 
 With TLS Routing, the Teleport Proxy Service uses application-layer protocol
@@ -296,7 +300,7 @@ pod or virtual machine in your group.
 
 If you plan to run Teleport on Kubernetes, the `teleport-cluster` Helm chart
 deploys the Auth Service and Proxy Service pools for you. To see how to use this
-Helm chart, read our [Helm Deployments](helm-deployments/helm-deployments.mdx) documentation.
+Helm chart, read our [Helm Deployments](../helm-deployments/helm-deployments.mdx) documentation.
 
 </Admonition>
 
@@ -353,7 +357,7 @@ Create a configuration file and provide it to each of your Proxy Service
 instances at `/etc/teleport.yaml`. We will explain the required configuration
 fields for a high-availability Teleport deployment below. These are the minimum
 requirements, and when planning your high-availability deployment, you will want
-to follow a more specific [deployment guide](deployments/deployments.mdx) for your
+to follow a more specific [deployment guide](deployments.mdx) for your
 environment. 
 
 #### `proxy_service` and `auth_service`
@@ -467,7 +471,7 @@ Create a configuration file and provide it to each of your Auth Service
 instances at `/etc/teleport.yaml`. We will explain the required configuration
 fields for a high-availability Teleport deployment below. These are the minimum
 requirements, and when planning your high-availability deployment, you will want
-to follow a more specific [deployment guide](deployments/deployments.mdx) for your
+to follow a more specific [deployment guide](deployments.mdx) for your
 environment.
 
 #### `storage`
@@ -483,7 +487,7 @@ teleport:
     # ...
 ```
 
-Consult our [Backends Reference](../../reference/backends.mdx) for the configuration
+Consult our [Backends Reference](../../../reference/deployment/backends.mdx) for the configuration
 fields you should set in the `storage` section.
 
 #### `auth_service` and `proxy_service`
@@ -540,8 +544,8 @@ deployment, read about how to design your own deployment on Kubernetes or a
 cluster of virtual machines in your cloud of choice:
 
 - [High-availability Teleport Deployments on Kubernetes with
-  Helm](helm-deployments/helm-deployments.mdx)
-- [Reference Deployments](deployments/deployments.mdx) for running Teleport on a cluster of
+  Helm](../helm-deployments/helm-deployments.mdx)
+- [Reference Deployments](deployments.mdx) for running Teleport on a cluster of
   virtual machines
 
 ### Ensure high performance
@@ -549,8 +553,8 @@ cluster of virtual machines in your cloud of choice:
 You should also get familiar with how to ensure that your Teleport deployment is
 performing as expected:
 
-- [Scaling a Teleport cluster](../management/operations/scaling.mdx)
-- [Monitoring a Teleport cluster](../management/diagnostics/diagnostics.mdx)
+- [Scaling a Teleport cluster](../../../reference/deployment/scaling.mdx)
+- [Monitoring a Teleport cluster](../../management/diagnostics/diagnostics.mdx)
 
 ### Deploy Teleport services
 
@@ -560,9 +564,9 @@ separate network from your Teleport cluster.
 
 To get started, read about registering:
 
-- [Applications](../../enroll-resources/application-access/getting-started.mdx)
-- [Servers](../../enroll-resources/server-access/getting-started.mdx)
-- [Kubernetes clusters](../../enroll-resources/kubernetes-access/getting-started.mdx)
-- [Databases](../../enroll-resources/database-access/getting-started.mdx)
-- [Windows desktops](../../enroll-resources/desktop-access/introduction.mdx)
-- [Bot users](../../enroll-resources/machine-id/getting-started.mdx)
+- [Applications](../../../enroll-resources/application-access/getting-started.mdx)
+- [Servers](../../../enroll-resources/server-access/getting-started.mdx)
+- [Kubernetes clusters](../../../enroll-resources/kubernetes-access/getting-started.mdx)
+- [Databases](../../../enroll-resources/database-access/getting-started.mdx)
+- [Windows desktops](../../../enroll-resources/desktop-access/introduction.mdx)
+- [Bot users](../../../machine-workload-identity/getting-started.mdx)
diff --git a/docs/pages/admin-guides/deploy-a-cluster/multi-region-blueprint.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint.mdx
similarity index 81%
rename from docs/pages/admin-guides/deploy-a-cluster/multi-region-blueprint.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint.mdx
index 53187b5aa3133..9ed4bcfdf3e27 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/multi-region-blueprint.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/multi-region-blueprint.mdx
@@ -1,13 +1,25 @@
 ---
 title: "Multi-region Blueprint"
 description: "Blueprint describing how to deploy a multi-region Teleport Enterprise cluster using CockroachDB."
+sidebar_position: 2
+tags:
+ - conceptual
+ - platform-wide
+enterprise: Support for multi-region deployments
 ---
 
 This page describes how to deploy a Teleport cluster in multiple regions to
-improve resiliency and sustain regional failure. This is not a step-by-step
-guide but a blueprint on how to build a multi-region Teleport cluster. This
-blueprint must be adapted to work with your specific infrastructure and network
-constraints.
+improve resiliency and sustain regional failure.
+
+<Admonition type="danger">
+This deployment drastically increases complexity and costs to provide
+multi-region resilience. Do not use this blueprint unless multi-region
+resilience is a requirement. We recommend the [High Availability
+Cluster](high-availability.mdx) for most deployments.
+
+Please follow this blueprint precisely with no modifications. If you modify any
+parts of this blueprint, we would not be able to support your deployment.
+</Admonition>
 
 ## Important technical consideration
 
@@ -16,19 +28,25 @@ Before continuing, you must acknowledge the following warnings:
 - This setup is not required for most Teleport users and customers.
   Single-region multi-zone deployments provide the best availability/cost ratio.
   For example, Amazon SLAs are 99.99% for both DynamoDB and EC2.
+- Multi-region setups do not offer better scalability than single-region setups.
+  Due to their distributed and redundant nature, they are less performant and
+  more expensive than single-region setups for the same number of agents.
 - This blueprint relies on many complex components. If you don't have the team
   capacity and expertise to deploy and operate such components, you will end
   up with a lower availability than a single-region multi-zone setup.
 - You are responsible for deploying and maintaining the Teleport dependencies
   including the database, object storage, container runtime, network plugins
   and anything else which is required.
+- Regions must be provisioned with enough capacity to handle all traffic in
+  the event of a complete region failure. This includes the ability to
+  immediately absorb new traffic as nodes and users reconnect to the healthy regions.
 
 <Admonition type="tip">
 
 For teams with limited bandwidth who need multi-region clusters, Teleport
 offers to host cross-region clusters. You can benefit from the
 setup described in this document without the operational costs and complexity,
-see [the Teleport Enterprise (Cloud) getting started guide](../../get-started.mdx)
+see [the Teleport Enterprise (Cloud) getting started guide](../../../get-started/deploy-cloud.mdx)
 for more details.
 
 </Admonition>
@@ -37,14 +55,14 @@ for more details.
 
 A multi-region Teleport deployment is composed of several regional Teleport
 deployments. Teleport stores its state in a multi-region backend and uses
-[Proxy Peering](../../reference/architecture/proxy-peering.mdx) to connect users to resources
+[Proxy Peering](../proxy-peering.mdx) to connect users to resources
 hosted in a different region.
 
 The recommended multi-region backend
-is [the CockroachDB backend](../../reference/backends.mdx)
+is [the CockroachDB backend](../../../reference/deployment/backends.mdx)
 available in self-hosted Teleport Enterprise.
 
-![Architecture diagram](../../../img/deploy-a-cluster/multi-region-blueprint.svg)
+![Architecture diagram](../../../../img/deploy-a-cluster/multi-region-blueprint.svg)
 
 To run a multi-region Teleport deployment, you must have:
 
@@ -63,12 +81,20 @@ To run a multi-region Teleport deployment, you must have:
 Teams with Kubernetes infrastructure will want to host Teleport in Kubernetes.
 This section describes this setup in more detail.
 
+<Admonition type="warning" title="Kubernetes CPU Limits">
+
+We strongly discourage setting CPU limits on any Teleport component, as throttling can introduce unpredictable
+latency, disrupt real-time authentication and networking operations, and trigger cascading failures across
+otherwise healthy regions, potentially leading to a full cluster outage.
+
+</Admonition>
+
 ### Teleport Dependencies
 
 - Create 3 peered regional VPCs (e.g., on AWS) or 1 global VPC (e.g., on GKE).
 - Create 1 Kubernetes cluster in each region, **Pod CIDRs must not overlap**.
 - Ensure pod mesh connectivity. Proxy pods must be able to dial each other
-  [on port 3021](../../reference/networking.mdx). The setup will vary
+  [on port 3021](../../../reference/deployment/networking.mdx). The setup will vary
   based on your network and CNI plugin configuration:
   - If pods are using the native network layer (for example GKE, or AWS' vpc-cni addon)
     you can rely on pure VPC peering, routing, and firewall capabilities to
@@ -80,9 +106,8 @@ This section describes this setup in more detail.
   - on GCP, GCS has a multi-region location
   - on-prem, MinIO supports [multi-site bucket replication](https://min.io/docs/minio/linux/administration/bucket-replication/enable-server-side-multi-site-bucket-replication.html)
   - on AWS, you can [set up two-way-replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mrap-create-two-way-replication-rules.html)
-    between S3 buckets.
-- Set up IAM to allow access to the object storage. See [S3 docs](../../reference/backends.mdx#s3-iam-policy) for the reference.
-- Set up [a CockroachDB multi-region cluster](https://www.cockroachlabs.com/docs/v24.1/multiregion-overview)
+    between S3 buckets. See [the dedicated S3 replication section](#setting-up-multi-region-aws-s3-replication) for more details.
+- Setup [a CockroachDB multi-region cluster](https://www.cockroachlabs.com/docs/v24.1/multiregion-overview)
 
 ### Teleport backend configuration
 
@@ -175,9 +200,8 @@ auth:
         conn_string: postgres://teleport@cockroachdb-public.<region>.svc.cluster.local:26257/teleport_backend?sslmode=verify-full&pool_max_conns=20
         audit_events_uri:
           - "postgres://teleport@cockroachdb-public.<region>.svc.cluster.local:26257/teleport_audit?sslmode=verify-full"
-        # replace this with the URI of your regional object storage (S3, GCS, MinIO) and IAM role configured for the object storage access
-        # set complete_initiators param to ensure Teleport will only complete uploads initiated by itself
-        audit_sessions_uri: "uri://to-your-regional-bucket?complete_initiators=<teleport-iam-role>"
+        # replace this with the URI of your regional object storage (S3, GCS, MinIO)
+        audit_sessions_uri: "uri://to-your-regional-bucket"
         ttl_job_cron: '*/20 * * * *'
     
     # Configure proxy peering
@@ -254,7 +278,7 @@ The CockroachDB performance depends on the storage type. Make sure to store
 CockroachDB's state on SSDs. When running on Kubernetes, the default storage
 class might not be the one offering the best latency and throughput.
 
-See the [Teleport scaling](../management/operations/scaling.mdx) page for more
+See the [Teleport scaling](../../../reference/deployment/scaling.mdx) page for more
 details on how to size Teleport.
 
 Teleport load varies depending on the usage type (number of connected
@@ -313,3 +337,21 @@ Terraform. With 3 buckets `bucketA`, `bucketB`, `bucketC` you need 6 rules:
     If you want Teleport to automatically clean up session recordings, you must
     enable "Delete marker replication" in the replication rules.
 </Admonition>
+
+Finally, you must configure Teleport to only complete file uploads
+initiated by itself (so Teleport does not attempt to complete uploads caused
+by the bucket replication rules).
+
+You can do so by setting `complete_initiators=<Var name= "teleport-iam-role"/>` in the `audit_sessions_uri` value.
+<Var name= "teleport-iam-role"/> is the name of the IAM role used by the Teleport Auth service to upload recording to
+the S3 bucket:
+
+```yaml
+auth:
+  teleportConfig:
+    teleport:
+      storage:
+        # [other storage options here...]
+        audit_sessions_uri: "uri://to-your-regional-bucket?complete_initiators=<Var name= "teleport-iam-role"/>"
+        # ...
+```
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/deployments/separate-proxy-service-endpoints.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/separate-proxy-service-endpoints.mdx
new file mode 100644
index 0000000000000..e1d1cbeb49566
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/deployments/separate-proxy-service-endpoints.mdx
@@ -0,0 +1,213 @@
+---
+title: Separate Internal and External Proxy Service Traffic
+sidebar_label: Dedicated Internal Address
+description: Explains how to set up the Teleport Proxy Service to isolate traffic from the public internet from internal client traffic.
+tags:
+- how-to
+- platform-wide
+---
+
+In a typical Teleport cluster, including clusters deployed on Teleport Cloud,
+the Teleport Proxy Service exposes a single HTTPS port to users on the public
+internet as well as infrastructure resources running in private networks. For
+self-hosted Teleport clusters with security needs that require it, you can
+configure your cluster to handle traffic to the Proxy Service differently
+depending on whether it originates from the public internet or from your
+internal networks.
+
+This guide explains how to set up a self-hosted Teleport cluster to separate
+Proxy Service HTTPS traffic for internal and external clients.
+
+## Architecture
+
+To handle Teleport Proxy Service traffic differently depending on the origin,
+you can deploy separate Proxy Service load balancers:
+
+- A load balancer for end-user traffic from the public internet
+- A load balancer for traffic from Teleport Agents in private networks
+
+Each load balancer has a separate IP address. Both load balancers route traffic
+to the same pool of Teleport Proxy Service instances, such as the same AWS
+target group.
+
+Clients then connect to the Proxy Service load balancer at the appropriate
+address. Teleport Agents establish SSH reverse tunnels to the Proxy Service by
+dialing the internal load balancer, while external clients connect to the Proxy
+Service using the external load balancer. 
+
+When an end user connects to an infrastructure resource, e.g., using `tsh proxy
+db` or sending an HTTP request to a Teleport-protected application, they dial
+the external load balancer, which forwards the traffic to the Teleport Proxy
+Service. The Proxy Service then routes the traffic to the appropriate
+infrastructure resource by selecting a reverse tunnel.
+
+## Routing traffic to the appropriate load balancer
+
+Assuming you have deployed two load balancers, one for external Proxy Service
+clients and one for internal clients, there are three strategies for routing
+traffic to the appropriate load balancer from Teleport Agents and end users:
+
+- [Split DNS](#split-dns)
+- [Multiple public addresses](#multiple-public-addresses)
+- [Tunnel public address](#tunnel-public-address)
+
+<Admonition type="warning">
+
+We strongly recommend using the split DNS approach. Of the three methods we
+discuss, this requires the least disruptive change to your Teleport cluster, and
+is the only one that supports other recommended configurations.
+
+</Admonition>
+
+### Split DNS
+
+You can set up your infrastructure to use split DNS so that a single public
+address for your Teleport cluster resolves to the external endpoint for end
+users and the internal endpoint for infrastructure resources in your internal
+network. 
+
+We strongly recommend this approach for maintaining separate internal and
+external Proxy Service load balancers. This is the only approach we discuss that
+you can implement while maintaining other configurations we recommend for your
+cluster: TLS multiplexing with a single value for the Proxy Service public
+address.
+
+1. Determine the public address to use for the Teleport Proxy Service, e.g.,
+   `proxy.example.com`.
+
+1. Configure your DNS infrastructure to return the IP address of the internal
+   load balancer for your internal network and the external load balancer for
+   the public internet.
+
+   For example, in Amazon Route 53, you can create public and private hosted
+   zones for the same domain and add a separate record to each hosted zone ([AWS
+   documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-considerations.html#hosted-zone-private-considerations-split-view-dns)).
+
+1. Edit your Proxy Service configuration to include a single value for its
+   public address:
+
+   ```yaml
+   proxy_service:
+     enabled: true
+     public_addr: proxy.example.com:3080
+   ```
+
+### Multiple public addresses
+
+You can configure the Teleport Proxy Service to advertise multiple addresses on
+its SSH host certificate. This enables you to instruct internal clients (e.g.,
+Teleport Agents) to connect to the Proxy Service on the internal address while
+external clients connect on the external address. You can use this approach if
+your infrastructure does not support split DNS and your cluster has TLS
+multiplexing enabled.
+
+1. Create two DNS records for, respectively, your internal and external Teleport
+   Proxy Service load balancers. This section assumes you have created the
+   following records:
+
+   | Domain Name                | IP Address             |
+   |----------------------------|------------------------|
+   | external_proxy.example.com | External load balancer |
+   | internal_proxy.example.com | Internal load balancer |
+
+1. Configure the Teleport Proxy Service to use multiple public address values:
+
+   ```yaml
+   proxy_service:
+     enabled: true
+     public_addr: 
+       - external_proxy.example.com:443
+       - internal_proxy.example.com:443
+   ```
+
+1. On Teleport Agent hosts, start the `teleport` process with the
+   `TELEPORT_TUNNEL_PUBLIC_ADDR` environment variable assigned to the internal
+   Proxy Service load balancer address. 
+
+   Setting `TELEPORT_TUNNEL_PUBLIC_ADDR` overrides the default behavior, in
+   which an agent verifies the Proxy Service certificate using the first public
+   address listed, to use the value of the environment variable instead.
+
+   The step differs according to whether you installed Teleport on Linux servers
+   using [Manage Updates v2](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx) or
+   using the `teleport-kube-agent` Helm chart:
+
+   <Tabs>
+   <TabItem label="Linux Server">
+
+   By default, Teleport installations based on Managed Updates v2 configure the
+   `teleport` systemd unit to read environment variables from the file
+   `/etc/default/teleport`.
+   
+   Edit the environment file to specify a tunnel public address with the
+   following line, updating the value to include the address of your internal
+   Proxy Service load balancer:
+
+   ```text
+   TELEPORT_TUNNEL_PUBLIC_ADDR=internal_proxy.example.com:443
+   ```
+   </TabItem>
+   <TabItem label="Kubernetes">
+
+   In the values file for your `teleport-kube-agent` installation , assign the
+   following field:
+
+   ```yaml
+   extraEnv:
+     - name: TELEPORT_TUNNEL_PUBLIC_ADDR
+       value: "internal_proxy.example.com:443"
+   ```
+
+   Upgrade your `teleport-kube-agent` Helm release, assigning 
+   <Var name="release-name" /> to the release name. This command assumes that the
+   path to your values file is `values.yaml`:
+
+   ```code
+   $ helm upgrade <Var name="release-name" /> teleport/teleport-kube-agent --values values.yaml
+   ```
+
+   </TabItem>
+   </Tabs>
+
+In this setup, end users would connect to the external address,
+`external_proxy.example.com:443`, when using client tools such as `tsh`.
+
+### Tunnel public address
+
+If your cluster has disabled [TLS
+multiplexing](../../../reference/architecture/tls-routing.mdx), you can configure
+internal clients, such as Teleport Agents, to connect to the Teleport Proxy
+Service over a port that is separate from the HTTPS port that end users connect
+to. We recommend using the split DNS or multiple public Proxy Service addresses
+unless your cluster already has TLS multiplexing disabled.
+
+1. Edit the Teleport Proxy Service configuration to set a public address for
+   establishing reverse tunnels:
+
+   ```yaml
+   proxy_service:
+     enabled: true
+     public_addr: external_proxy.example.com:3080
+     tunnel_public_addr: internal_proxy.example.com:3024
+   ```
+
+1. Create two DNS records for the Teleport Proxy Service:
+
+   - One for the internal Proxy Service load balancer at
+     `internal_proxy.example.com`
+   - One for the external Proxy Service load balancer at
+     `external_proxy.example.com`
+
+At this point, Teleport Agents can connect to the Proxy Service using the
+internal address, e.g., if you set the following field in your agents'
+configuration file:
+
+```yaml
+teleport:
+  proxy_server: internal_proxy.example.com:3024
+```
+
+End users can connect to the Teleport Proxy Service on
+`external_proxy.example.com:3080`.
+
+
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx
new file mode 100644
index 0000000000000..6988bc0bcd3c6
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/aws.mdx
@@ -0,0 +1,610 @@
+---
+title: Running an HA Teleport Cluster Using AWS, EKS, and Helm
+sidebar_label: EKS
+description: Install and configure an HA Teleport cluster using an AWS EKS cluster
+tags:
+ - how-to
+ - platform-wide
+ - aws
+---
+
+In this guide, we'll use Teleport Helm charts to set up a high-availability
+Teleport cluster that runs on AWS EKS.
+
+(!docs/pages/includes/cloud/call-to-action.mdx!)
+
+## How it works
+
+The `teleport-cluster` Helm chart deploys the Teleport Auth Service and Teleport
+Proxy Service on your Amazon Elastic Kubernetes Service cluster, implementing
+the architecture described in [Deploying a High Availability Teleport
+Cluster](../deployments/high-availability.mdx). The chart requires the following
+resources, which we show you how to create in this guide:
+
+- **IAM permissions for the Teleport Auth Service**. The Auth Service requires
+  permissions to manage resources on its backend. 
+- **A system to provision TLS credentials** that the Proxy Service uses to run
+  its HTTPS server. In this guide, we show you how to do this with
+  `cert-manager`, the recommended approach.  Depending on the method you choose,
+  you may also need to create IAM permissions to allow the provisioning system
+  to interact with AWS APIs.
+- **Amazon S3 bucket and DynamoDB database** for the Teleport Auth Service
+  backend.
+
+## Prerequisites
+
+We recommend provisioning the Teleport Proxy Service with TLS credentials using
+`cert-manager`, so you should become familiar with `cert-manager` before
+beginning this guide by reading the
+[documentation](https://cert-manager.io/docs/).
+
+This guide assumes that your infrastructure is **not** hosted in AWS GovCloud or
+in an air-gapped AWS environment (EKS Anywhere). If it is, [contact the Teleport
+team](https://goteleport.com/contact-us) for assistance planning your
+deployment.
+
+This guide also requires the following:
+
+(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
+
+### Choose a Kubernetes namespace and Helm release name
+
+Before starting, setting your Kubernetes namespace and Helm release name here
+will enable easier copy/pasting of commands for installation.
+
+If you don't know what to put here, use `teleport` for both values.
+
+Namespace: <Var name="namespace" description="Kubernetes namespace" />
+
+Release name: <Var name="release-name" description="Helm release name" />
+
+## Step 1/7. Install Helm
+
+(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-install.mdx!)
+
+## Step 2/7. Add the Teleport Helm chart repository
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+## Step 3/7. Set up AWS IAM configuration
+
+For Teleport to be able to manage the DynamoDB tables, indexes, and the S3
+storage bucket it needs, you'll need to configure AWS IAM policies to allow
+access.
+
+<Admonition type="note">
+  Add these IAM policies to your AWS account and then grant it to the role associated with your EKS node group(s).
+</Admonition>
+
+### DynamoDB IAM policy
+
+(!docs/pages/includes/dynamodb-iam-policy.mdx!)
+
+### S3 IAM policy
+
+(!docs/pages/includes/s3-iam-policy.mdx!)
+
+### Route53 IAM policy
+
+This policy allows `cert-manager` to use DNS01 Let's Encrypt challenges to
+provision TLS certificates for your Teleport cluster.
+
+You'll need to replace these values in the policy example below:
+
+| Placeholder value | Replace with |
+| - | - |
+| <Var name="Z0159221358P96JYAUAA4" /> | Route 53 hosted zone ID for the domain hosting your Teleport cluster |
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "route53:GetChange",
+            "Resource": "arn:aws:route53:::change/*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "route53:ChangeResourceRecordSets",
+                "route53:ListResourceRecordSets"
+            ],
+            "Resource": "arn:aws:route53:::hostedzone/<Var name="Z0159221358P96JYAUAA4" />"
+        }
+    ]
+}
+```
+
+## Step 4/7. Configure TLS certificates for Teleport
+
+We now need to configure TLS certificates for Teleport to secure its
+communications and allow external clients to connect.
+
+We recommend using `cert-manager` to provision and automatically renew TLS
+credentials by completing ACME challenges via Let's Encrypt. In this guide, we
+are using multiple pods to create a High Availability Teleport cluster. This
+setup mounts TLS credentials into each Teleport pod, and `cert-manager`
+automatically renews certificates and keeps them up to date.
+
+This method uses a Kubernetes `LoadBalancer`, which will provision an underlying
+AWS Network Load Balancer (NLB) to handle incoming traffic.
+
+You can also use `cert-manager` with AWS Private Certificate Authority (PCA) in
+EKS using the `aws-privateca-issuer` plugin.
+
+### Install cert-manager
+
+If you do not have `cert-manager` already configured in the Kubernetes cluster where you are installing Teleport,
+you should add the Jetstack Helm chart repository which hosts the `cert-manager` chart, and install the chart:
+
+```code
+$ helm repo add jetstack https://charts.jetstack.io
+$ helm repo update
+$ helm install cert-manager jetstack/cert-manager \
+--create-namespace \
+--namespace cert-manager \
+--set installCRDs=true \
+--set global.leaderElection.namespace=cert-manager \
+--set extraArgs="{--issuer-ambient-credentials}" # required to automount ambient AWS credentials when using an Issuer
+```
+
+### Create an Issuer
+
+Next, create a `cert-manager` Issuer resource. You'll need to replace these
+values in the Issuer example below:
+
+| Placeholder value | Replace with |
+| - | - |
+| <Var name="email@address.com" description="Email for Let's Encrypt" /> | An email address to receive communications from Let's Encrypt |
+| <Var name="example.com" description="Route 53 Hosted Zone" /> | The name of the Route 53 domain hosting your Teleport cluster |
+| <Var name="us-west-2" description="AWS Region"/> | AWS region where the cluster is running |
+| <Var name="Z0159221358P96JYAUAA4" description="Route 53 hosted zone id"/> | Route 53 hosted zone ID for the domain hosting your Teleport cluster |
+
+Run the following command to create a manifest:
+
+```yaml
+cat << EOF > aws-issuer.yaml
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt-production
+  namespace: teleport
+spec:
+  acme:
+    email: <Var name="email@address.com" />
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+    - selector:
+        dnsZones:
+          - "<Var name="example.com" />"
+      dns01:
+        route53:
+          region: <Var name="us-west-2" />
+          hostedZoneID: <Var name="Z0159221358P96JYAUAA4" />
+EOF
+```
+
+After you have created the `Issuer` and updated the values, add it to your cluster using `kubectl`:
+
+```code
+$ kubectl create namespace <Var name="namespace" />
+$ kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
+$ kubectl --namespace <Var name="namespace" /> create -f aws-issuer.yaml
+```
+
+## Step 5/7. Set values to configure the cluster
+
+If you run Teleport Enterprise, you will need to create a secret that contains
+your Teleport license information before you can install Teleport in your
+Kubernetes cluster. 
+
+(!docs/pages/includes//enterprise/obtainlicense.mdx!)
+
+Create a secret from your license file. Teleport will automatically discover
+this secret as long as your file is named `license.pem`.
+
+```code
+$ kubectl -n <Var name="namespace" /> create secret generic license --from-file=license.pem
+```
+
+Next, configure the `teleport-cluster` Helm chart to use the `aws` mode. Create
+a file called `aws-values.yaml` and write the values you've chosen above to it:
+
+```yaml
+chartMode: aws
+clusterName: <Var name="teleport.example.com" />                 # Name of your cluster. Use the FQDN you intend to configure in DNS below.
+proxyListenerMode: multiplex
+aws:
+  region: <Var name="us-west-2" />                # AWS region
+  backendTable: <Var name="teleport-helm-backend" /> # DynamoDB table to use for the Teleport backend
+  auditLogTable: <Var name="teleport-helm-events" />             # DynamoDB table to use for the Teleport audit log (must be different to the backend table)
+  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  sessionRecordingBucket: <Var name="your-sessions-bucket" />  # S3 bucket to use for Teleport session recordings
+  backups: true                                   # Whether or not to turn on DynamoDB backups
+  dynamoAutoScaling: false                        # Whether Teleport should configure DynamoDB's autoscaling.
+highAvailability:
+  replicaCount: 2                                 # Number of replicas to configure
+  certManager:
+    enabled: true                                 # Enable cert-manager support to get TLS certificates
+    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
+# Indicate that this is a Teleport Enterprise deployment. Set to false for
+# Teleport Community Edition.
+enterprise: true                                  
+# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
+podSecurityPolicy:
+  enabled: false
+```
+<Admonition type="note">
+If using an AWS PCA with cert-manager, you will need to
+[ensure you set](../../../reference/helm-reference/teleport-cluster.mdx)
+`highAvailability.certManager.addCommonName: true` in your values file.  You will also need to get the certificate authority
+certificate for the CA (`aws acm-pca get-certificate-authority-certificate --certificate-authority-arn <arn>`),
+upload the full certificate chain to a secret, and
+[reference the secret](../../../reference/helm-reference/teleport-cluster.mdx)
+with `tls.existingCASecretName` in the values file.
+</Admonition>
+
+Install the chart with the values from your `aws-values.yaml` file using this command:
+
+```code
+$ helm install <Var name="release-name" /> teleport/teleport-cluster \
+  --create-namespace \
+  --namespace <Var name="namespace" /> \
+  -f aws-values.yaml
+```
+
+<Admonition type="note">
+  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. You should use the fully-qualified domain name that you'll use for external access to your Teleport cluster.
+</Admonition>
+
+Once the chart is installed, you can use `kubectl` commands to view the deployment (example using `cert-manager`):
+
+```code
+$ kubectl --namespace <Var name="namespace" /> get all
+
+NAME                                 READY   STATUS    RESTARTS   AGE
+pod/teleport-auth-57989d4cbd-4q2ds   1/1     Running   0          22h
+pod/teleport-auth-57989d4cbd-rtrzn   1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
+
+NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP                         PORT(S)                                                                     AGE
+service/teleport            LoadBalancer   10.40.11.180   xxxxx.elb.us-east-1.amazonaws.com   443:30258/TCP                                                               22h
+service/teleport-auth       ClusterIP      10.40.8.251    <none>                              3025/TCP,3026/TCP                                                           22h
+service/teleport-auth-v11   ClusterIP      None           <none>                              <none>                                                                      22h
+service/teleport-auth-v12   ClusterIP      None           <none>                              <none>                                                                      22h
+
+NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
+deployment.apps/teleport-auth    2/2     2            2           22h
+deployment.apps/teleport-proxy   2/2     2            2           22h
+
+NAME                                       DESIRED   CURRENT   READY   AGE
+replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
+replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
+```
+
+## Step 6/7. Set up DNS
+
+You'll need to set up a DNS `A` record for `teleport.example.com`. In our example, this record is an alias to an ELB.
+
+<details>
+<summary>Enrolling applications with Teleport?</summary>
+
+(!docs/pages/includes/dns-app-access.mdx!)
+
+</details>
+
+Here's how to do this in a hosted zone with Amazon Route 53:
+
+```code
+# Change these parameters if you altered them above
+$ NAMESPACE='<Var name="namespace" />'
+$ RELEASE_NAME='<Var name="release-name" />'
+
+# DNS settings (change as necessary)
+$ MYZONE_DNS='<Var name="example.com"/>'
+$ MYDNS='<Var name="teleport.example.com"/>'
+$ MY_CLUSTER_REGION='<Var name="us-west-2"/>'
+
+# Find AWS Zone ID and ELB Zone ID
+$ MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
+$ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "service/${RELEASE_NAME?}-proxy" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
+$ MYELB_NAME="${MYELB%%-*}"
+$ MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
+
+# Create a JSON file changeset for AWS.
+$ jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" \
+    '{
+        "Comment": "Create records",
+        "Changes": [
+          {
+            "Action": "CREATE",
+            "ResourceRecordSet": {
+              "Name": $dns,
+              "Type": "A",
+              "AliasTarget": {
+                "HostedZoneId": $elbz,
+                "DNSName": ("dualstack." + $elb),
+                "EvaluateTargetHealth": false
+              }
+            }
+          },
+          {
+            "Action": "CREATE",
+            "ResourceRecordSet": {
+              "Name": ("*." + $dns),
+              "Type": "A",
+              "AliasTarget": {
+                "HostedZoneId": $elbz,
+                "DNSName": ("dualstack." + $elb),
+                "EvaluateTargetHealth": false
+              }
+            }
+          }
+      ]
+    }' > myrecords.json
+
+# Review records before applying.
+$ cat myrecords.json | jq
+# Apply the records and capture change id
+$ CHANGEID="$(aws route53 change-resource-record-sets --hosted-zone-id "${MYZONE?}" --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')"
+
+# Verify that change has been applied
+$ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
+# "INSYNC"
+```
+
+## Step 7/7. Create a Teleport user
+
+Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
+so we can run the command using `kubectl`:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Teleport Community Edition">
+```code
+$ kubectl --namespace <Var name="namespace" /> exec deploy/<Var name="release-name" />-auth -- tctl users add test --roles=access,editor
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</TabItem>
+<TabItem scope={["enterprise", "cloud"]} label="Commercial">
+```code
+$ kubectl --namespace <Var name="namespace" /> exec deploy/<Var name="release-name" />-auth -- tctl users add test --roles=access,editor,reviewer
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</TabItem>
+</Tabs>
+
+Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
+
+### High Availability
+
+In this guide, we have configured two replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
+value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
+
+### Upgrading the cluster after deployment
+
+To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
+
+Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
+version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
+
+Here's an example where we set the chart to use 2 replicas:
+
+Edit your `aws-values.yaml` file from above and make the appropriate changes:
+
+```yaml
+highAvailability:
+  replicaCount: 2
+```
+
+Upgrade the deployment with the values from your `aws-values.yaml` file using this command:
+
+```code
+$ helm upgrade <Var name="release-name" /> teleport/teleport-cluster \
+  --namespace <Var name="namespace" /> \
+  -f aws-values.yaml
+```
+
+<Admonition type="note">
+  To change `chartMode`, `clusterName`, or any `aws` settings, you must first uninstall the existing chart and then install a new version with the appropriate values.
+</Admonition>
+
+Then perform a cluster upgrade with the new values:
+
+```code
+$ helm upgrade <Var name="release-name" /> teleport/teleport-cluster \
+  --namespace <Var name="namespace" /> \
+  -f aws-values.yaml
+```
+
+## Uninstalling Teleport
+
+To uninstall the `teleport-cluster` chart, use `helm uninstall <release-name>`. For example:
+
+```code
+$ helm --namespace <Var name="namespace" /> uninstall <Var name="release-name" />
+```
+
+### Uninstalling cert-manager
+
+If you want to remove the `cert-manager` installation later, you can use this command:
+
+```code
+$ helm --namespace cert-manager uninstall cert-manager
+```
+
+## Troubleshooting AWS quotas
+
+(!docs/pages/includes/aws-quotas.mdx!)
+
+## Additional ways to provision TLS certificates
+
+We recommend using `cert-manager` to provision TLS credentials and an AWS
+Network Load Balancer to provide connectivity to the Teleport Proxy Service, as
+shown in this guide. This approach allows Teleport to operate at the expected
+performance and support native clients (like `kubectl` and database clients) via
+server name indication (SNI).
+
+If your infrastructure does not support the approach we outline in this guide,
+we recommend that you [contact the Teleport
+team](https://goteleport.com/contact-us/). This section includes examples of
+taking two alternative approaches: static TLS certificates and Amazon
+Certificate Manager.
+
+### Static TLS certificates
+
+When you provision Teleport with static TLS certificates, you are responsible
+for determining how to obtain a TLS certificate and private key for your
+Teleport cluster, and for renewing your credentials periodically. Use this
+approach if you would like to use a trusted internal certificate authority
+instead of Let's Encrypt. As with `cert-manager`, this method uses a Kubernetes
+`LoadBalancer` and will provision an underlying AWS NLB.
+
+Configure the `teleport-cluster` Helm chart to secure the Teleport Web UI using
+existing TLS credentials within a Kubernetes secret.
+
+Use the following command to create your secret:
+
+```code
+$ kubectl -n <Var name="namespace" /> create secret tls my-tls-secret --cert=/path/to/cert/file --key=/path/to/key/file
+```
+
+Edit the `teleport-cluster` chart values file  to refer to the name of your
+secret:
+
+```yaml
+  tls:
+    existingSecretName: my-tls-secret
+```
+
+### AWS Certificate Manager
+
+If your organization cannot accommodate using `cert-manager` or a trusted
+internal certificate authority with a Network Load Balancer, you can use AWS
+Certificate Manager to handle TLS termination with AWS-managed certificates.
+This method uses a Kubernetes `Ingress`, which can provision an underlying AWS
+Application Load Balancer (ALB) to handle incoming traffic if one does not
+already exist. It also requires the installation and setup of the AWS Load
+Balancer controller.
+
+You should be aware of these potential limitations and differences when using
+Layer 7 load balancers with Teleport:
+
+- Connecting to Kubernetes clusters at the command line requires the use of the
+  `tsh proxy kube` or `tsh kubectl` commands and `tsh proxy db`/`tsh db connect`
+  commands respectively. It is not possible to connect `kubectl` directly to
+  Teleport listeners without the use of `tsh` as a proxy client in this mode.
+- Connecting to databases at the command line requires the use of the `tsh proxy
+  db` or `tsh db connect` commands. It is not possible to connect database
+  clients directly to Teleport listeners without the use of `tsh` as a proxy
+  client in this mode.
+- The reason for both of these requirements is that Teleport uses X509
+  certificates for authentication, which requires that it terminate all inbound
+  TLS traffic itself on the Teleport proxy. This is not directly possible when
+  using a Layer 7 load balancer, so the `tsh` client implements this flow itself
+  [using ALPN connection
+  upgrades](../../../reference/architecture/tls-routing.mdx).
+
+To use ACM in your cluster, make the following adjustments to the steps you
+followed above:
+
+1. Either follow the [AWS-maintained documentation on installing the AWS Load
+   Balancer
+   Controller](https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html)
+   or ensure that you already have a working installation of the AWS LB
+   controller before continuing with these instructions. Failure to do this will
+   result in an unusable Teleport cluster.
+
+   Assuming you follow the AWS guide linked above, you can check whether the AWS
+   LB controller is running in your cluster by looking for pods with the
+   `app.kubernetes.io/name=aws-load-balancer-controller` label:
+
+   ```code
+   $ kubectl get pods -A -l app.kubernetes.io/name=aws-load-balancer-controller
+   NAMESPACE     NAME                                            READY   STATUS    RESTARTS   AGE
+   kube-system   aws-load-balancer-controller-655f647b95-5vz56   1/1     Running   0          109d
+   kube-system   aws-load-balancer-controller-655f647b95-b4brx   1/1     Running   0          109d
+   ```
+
+   You can also check whether `alb` is registered as an `IngressClass` in your
+   cluster:
+
+   ```code
+   $ kubectl get ingressclass
+   NAME    CONTROLLER             PARAMETERS   AGE
+   alb     ingress.k8s.aws/alb    <none>       109d
+   ```
+
+1. Add annotations to the chart using the `teleport-cluster` values file to
+   allow ACM to handle TLS. These specify the ACM certificate ARN to use, the
+   port it should be served on and other ALB configuration parameters.
+
+   Replace <Var
+   name="arn:aws:acm:us-west-2:1234567890:certificate/12345678-43c7-4dd1-a2f6-c495b91ebece"/>
+   with your actual ACM certificate ARN:
+   
+   ```yaml
+   service:
+     type: ClusterIP
+   ingress:
+     enabled: true
+     spec:
+       ingressClassName: alb
+   annotations:
+     ingress:
+       alb.ingress.kubernetes.io/target-type: ip
+       alb.ingress.kubernetes.io/backend-protocol: HTTPS
+       alb.ingress.kubernetes.io/scheme: internet-facing
+       alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=350
+       alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
+       alb.ingress.kubernetes.io/success-codes: 200,301,302
+       # Replace with your AWS certificate ARN
+       alb.ingress.kubernetes.io/certificate-arn: "<Var name="arn:aws:acm:us-west-2:1234567890:certificate/12345678-43c7-4dd1-a2f6-c495b91ebece"/>"
+   ```
+   
+   To use an internal AWS Application Load Balancer (as opposed to an
+   internet-facing ALB), you should edit the `alb.ingress.kubernetes.io/scheme`
+   annotation:
+   
+   ```yaml
+     alb.ingress.kubernetes.io/scheme: internal
+   ```
+
+   To automatically redirect HTTP requests on port 80 to HTTPS requests on port
+   443, you can also optionally provide these two values under
+   `annotations.ingress`:
+
+   ```yaml
+     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
+     alb.ingress.kubernetes.io/ssl-redirect: '443'
+   ```
+
+1. Determine the address of your load balancer so you can create a DNS record as
+   explained in [Step 6](#step-67-set-up-dns). In this case, the address is the
+   host name of the Kubernetes ingress created by the `teleport-cluster` chart:
+
+   ```code
+   $ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "ingress/${RELEASE_NAME?}-proxy" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
+   $ MYELB_ROOT="${MYELB%%.*}"
+   $ MYELB_NAME="${MYELB_ROOT%-*}"
+   ```
+
+## Next steps
+
+Now that you have deployed a Teleport cluster, read the [Manage
+Access](../../authentication/authentication.mdx) section to get started enrolling
+users and setting up RBAC.
+
+See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
+
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx
new file mode 100644
index 0000000000000..450bccbd43a8c
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/azure.mdx
@@ -0,0 +1,378 @@
+---
+title: Running an HA Teleport cluster using Microsoft Azure, AKS, and Helm
+sidebar_label: AKS
+description: Install and configure an HA Teleport cluster using a Microsoft Azure AKS cluster.
+tags:
+ - how-to
+ - platform-wide
+ - aws
+---
+
+In this guide, we'll go through how to set up a High Availability Teleport
+cluster with multiple replicas in Kubernetes using Teleport Helm charts and
+Microsoft Azure managed services (Kubernetes Services, Database for PostgreSQL,
+Blob Storage).
+
+<Admonition type="tip" title="Have an existing Teleport cluster?">
+If you are already running Teleport on another platform, you can use your
+existing Teleport deployment to access your Kubernetes cluster. [Follow our
+guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
+cluster to Teleport.
+</Admonition>
+
+(!docs/pages/includes/cloud/call-to-action.mdx!)
+
+## How it works
+
+The `teleport-cluster` Helm chart deploys the Teleport Auth Service and Teleport
+Proxy Service on your Azure Kubernetes Service cluster. The chart requires the
+following resources, which we show you how to create in this guide:
+
+- **IAM permissions for the Teleport Auth Service**. The Auth Service requires
+  permissions to manage resources on its backend.
+- **cert-manager** for obtaining and renewing TLS credentials that the Proxy
+  Service uses to run its HTTPS server.
+- **IAM permissions for cert-manager**. In the setup we show in this guide,
+  `cert-manager` modifies DNS records to demonstrate domain ownership and
+  receive TLS credentials from Let's Encrypt. To do so, the Proxy Service
+  completes the [ACME DNS-01
+  challenge](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge).
+- **Teleport Auth Service backend components:** PostgreSQL database and an
+  Amazon S3-compatible object storage solution.
+
+## Prerequisites
+
+(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
+
+In addition, you will need `azure-cli` 2.51 or later to follow along these
+instructions. Reference the Azure docs on [how to install the Azure
+CLI](https://learn.microsoft.com/cli/azure/install-azure-cli).
+
+After installing it, make sure you are logged in by typing `az login`. This
+guide assumes that your user has permissions to create Azure Database for
+PostgreSQL instances, Azure Blob Storage accounts, and Managed Identities, and
+has the ability to add role assignments for those. You will also need an Azure
+DNS zone, and access to an AKS cluster with cert-manager
+[installed](https://cert-manager.io/docs/installation/) and configured to [issue
+certificates for said Azure DNS
+zone](https://cert-manager.io/docs/configuration/acme/dns01/azuredns/).
+
+In this guide we'll use [workload
+identity](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
+to authenticate Teleport to PostgreSQL and Blob Storage, so you'll need to
+[enable workload identity and the OIDC issuer in your AKS
+cluster](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#update-an-existing-aks-cluster)
+if they're not enabled already:
+
+```code
+$ az aks update --resource-group <Var name="aks-rg" /> --name <Var name="aks-name" /> --enable-oidc-issuer --enable-workload-identity
+```
+
+## Step 1/5. Add the Teleport Helm chart repository
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+## Step 2/5. Set up PostgreSQL and Blob Storage
+
+For convenience, we'll create all the resources necessary in a brand new
+resource group; if you want to use an existing one, you can skip this step.
+Assign <Var name="region" /> to your Azure region:
+
+```code
+$ az group create --name <Var name="teleport-rg" /> --location <Var name="region" />
+```
+
+We're going to need a Managed Identity for Teleport to use these services.
+
+```code
+$ az identity create --resource-group <Var name="teleport-rg" /> --name teleport-id
+```
+
+The recommended HA deployment of Teleport on Azure stores the cluster state and
+the audit log entries in a PostgreSQL instance. In this guide we'll create a
+publicly accessible one, but you can restrict it to your AKS cluster's IP
+address, or you can create it attached to the same virtual network that the
+cluster is using, instead.
+
+Depending on your region, you might be able to use `ZoneRedundant` high
+availability, or you might have to use `SameZone` high availability.
+
+```code
+$ az postgres flexible-server create --resource-group <Var name="teleport-rg" /> --name <Var name="teleport-pg" /> \
+    --microsoft-entra-auth Enabled --password-auth Disabled \
+    --version 15 --high-availability SameZone --public-access All
+$ az postgres flexible-server parameter set --resource-group <Var name="teleport-rg" /> --server-name <Var name="teleport-pg" /> \
+    --name wal_level --value logical
+$ az postgres flexible-server restart --resource-group <Var name="teleport-rg" /> --name <Var name="teleport-pg" />
+$ az postgres flexible-server microsoft-entra-admin create --resource-group <Var name="teleport-rg" /> --server-name <Var name="teleport-pg" /> \
+    --display-name <Var name="pguser" /> --type ServicePrincipal \
+    --object-id "$(az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query principalId -o tsv)"
+```
+
+Teleport will store session recordings in a Blob Storage account. Optionally,
+access can be restricted to just the AKS outbound address, or the account can be
+made part of the virtual network that the AKS cluster is using.
+
+```code
+$ az storage account create --resource-group <Var name="teleport-rg" /> --name <Var name="teleportblob" /> \
+    --allow-blob-public-access false
+$ az role assignment create --role "Storage Blob Data Owner" --assignee-principal-type ServicePrincipal \
+    --assignee-object-id "$(az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query principalId -o tsv)" \
+    --scope "$(az storage account show --resource-group <Var name="teleport-rg" /> --name <Var name="teleportblob" /> --query id -o tsv)"
+```
+
+We'll use Workload Identity to authenticate to those services, so we'll add
+federated credentials for the Teleport service account used by the Auth Service.
+
+```code
+$ az identity federated-credential create --resource-group <Var name="teleport-rg" /> --identity-name teleport-id \
+    --name aks --audience api://AzureADTokenExchange \
+    --subject system:serviceaccount:<Var name="teleport-ns" />:<Var name="teleport-release" /> \
+    --issuer "$(az aks show --resource-group <Var name="aks-rg" /> --name <Var name="aks-name" /> --query oidcIssuerProfile.issuerUrl -o tsv)"
+```
+
+## Step 3/5. Set values to configure the cluster
+
+<details>
+<summary>License Secret</summary>
+
+Before you can install Teleport Enterprise in your Kubernetes cluster, you will need to
+create a secret that contains your Teleport license information.
+
+(!docs/pages/includes/enterprise/obtainlicense.mdx!)
+
+Create a secret from your license file. Teleport will automatically discover
+this secret as long as your file is named `license.pem`.
+
+```code
+$ kubectl create namespace <Var name="teleport-ns" />
+$ kubectl -n <Var name="teleport-ns" /> create secret generic license --from-file=license.pem
+```
+
+</details>
+
+Now we'll configure the `teleport-cluster` Helm chart to use the `azure` mode.
+
+First get the client ID for the `teleport-id` identity:
+```code
+$ az identity show --resource-group <Var name="teleport-rg" /> --name teleport-id --query clientId -o tsv
+<Var name="teleport-client-id-uuid-123456789012" />
+```
+
+Then create a file called `azure-values.yaml` containing the values you've selected above:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+```yaml
+chartMode: azure
+# Name of your cluster. Use the FQDN you intend to configure in DNS later
+clusterName: teleport.example.com
+azure:
+  databaseHost: "<Var name="teleport-pg" />.postgres.database.azure.com"
+  databaseUser: "<Var name="pguser" />"
+  sessionRecordingStorageAccount: "<Var name="teleportblob" />.blob.core.windows.net"
+  # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  auditLogMirrorOnStdout: false
+  clientID: "<Var name="teleport-client-id-uuid-123456789012" />"
+highAvailability:
+  # Number of replicas to configure
+  replicaCount: 2
+  certManager:
+    # Enable cert-manager support to get TLS certificates
+    enabled: true
+    # Name of the cert-manager GlobalIssuer or Issuer to use
+    issuerName: letsencrypt-production
+    issuerKind: ClusterIssuer
+# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
+podSecurityPolicy:
+  enabled: false
+```
+
+</TabItem>
+<TabItem scope={["enterprise"]} label="Enterprise">
+
+```yaml
+chartMode: azure
+# Name of your cluster. Use the FQDN you intend to configure in DNS later
+clusterName: teleport.example.com
+azure:
+  databaseHost: "<Var name="teleport-pg" />.postgres.database.azure.com"
+  databaseUser: "<Var name="pguser" />"
+  sessionRecordingStorageAccount: "<Var name="teleportblob" />.blob.core.windows.net"
+  # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  auditLogMirrorOnStdout: false
+  clientID: "<Var name="teleport-client-id-uuid-123456789012" />"
+highAvailability:
+  # Number of replicas to configure
+  replicaCount: 2
+  certManager:
+    # Enable cert-manager support to get TLS certificates
+    enabled: true
+    # Name of the cert-manager GlobalIssuer or Issuer to use
+    issuerName: letsencrypt-production
+    issuerKind: ClusterIssuer
+# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
+podSecurityPolicy:
+  enabled: false
+# Indicate that this is a Teleport Enterprise deployment
+enterprise: true
+```
+
+</TabItem>
+</Tabs>
+
+Install the chart with the values from your `azure-values.yaml` file using this command:
+
+```code
+$ helm install <Var name="teleport-release" /> teleport/teleport-cluster \
+    --create-namespace --namespace <Var name="teleport-ns" /> \
+    --values azure-values.yaml
+```
+
+<Admonition type="note">
+  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. We recommend using the fully-qualified domain name that you'll use for external access to your Teleport cluster.
+</Admonition>
+
+Once the chart is installed, you can use `kubectl` commands to view the deployment:
+
+```code
+$ kubectl --namespace <Var name="teleport-ns" /> get all
+
+NAME                                 READY   STATUS    RESTARTS   AGE
+pod/teleport-auth-57989d4cb-4q2ds    1/1     Running   0          22h
+pod/teleport-auth-57989d4cb-rtrzn    1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
+
+NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                                                                     AGE
+service/teleport            LoadBalancer   10.40.11.180   34.138.177.11   443:30258/TCP,3023:31802/TCP,3026:32182/TCP,3024:30101/TCP,3036:30302/TCP   22h
+service/teleport-auth       ClusterIP      10.40.8.251    <none>          3025/TCP,3026/TCP                                                           22h
+service/teleport-auth-v13   ClusterIP      None           <none>          <none>                                                                      22h
+service/teleport-auth-v14   ClusterIP      None           <none>          <none>                                                                      22h
+
+NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
+deployment.apps/teleport-auth    2/2     2            2           22h
+deployment.apps/teleport-proxy   2/2     2            2           22h
+
+NAME                                       DESIRED   CURRENT   READY   AGE
+replicaset.apps/teleport-auth-57989d4cb    2         2         2       22h
+replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
+```
+
+## Step 4/5. Set up DNS
+
+We'll now set up DNS `A` records for `teleport.example.com` and
+`*.teleport.example.com`, using your Azure DNS zone rooted at `example.com`. If
+you're using a different DNS hosting service, follow their instructions instead.
+
+```code
+$ PREFIX=teleport
+$ ZONE=example.com
+$ ZONE_RG=dns-rg
+$ external_ip="$(kubectl --namespace <Var name="teleport-ns" /> get service/<Var name="teleport-release" /> -o jsonpath='{.status.loadBalancer.ingress[*].ip}')"
+$ az network dns record-set a add-record --resource-group ${ZONE_RG} --zone-name ${ZONE} --record-set-name ${PREFIX} --ipv4-address "${external_ip}"
+$ az network dns record-set a add-record --resource-group ${ZONE_RG} --zone-name ${ZONE} --record-set-name "*.${PREFIX}" --ipv4-address "${external_ip}"
+```
+
+## Step 5/5. Create a Teleport user
+
+Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
+so we can run the command using `kubectl`:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+```code
+$ kubectl --namespace <Var name="teleport-ns" /> exec deploy/<Var name="teleport-release" />-auth -- tctl users add test --roles=access,editor
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+
+</TabItem>
+<TabItem scope={["enterprise"]} label="Enterprise">
+
+```code
+$ kubectl --namespace <Var name="teleport-ns" /> exec deploy/<Var name="teleport-release" />-auth -- tctl users add test --roles=access,editor,reviewer
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+
+</TabItem>
+</Tabs>
+
+Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
+
+### High Availability
+
+In this guide, we have configured 2 replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
+value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
+
+## Upgrading the cluster after deployment
+
+To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
+
+Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
+version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
+
+If you want to use a different version of Teleport, pass the `--version` argument to Helm:
+
+```code
+$ helm upgrade --version 14.0.0 \
+  <Var name="teleport-release" /> teleport/teleport-cluster \
+  --namespace <Var name="teleport-ns" /> \
+  -f azure-values.yaml
+```
+
+Here's an example where we set the chart to use 3 replicas:
+
+<Tabs>
+  <TabItem label="Using values.yaml">
+  Edit your `azure-values.yaml` file from above and make the appropriate changes.
+
+  Upgrade the deployment with the values from your `azure-values.yaml` file using this command:
+
+  ```code
+  $ helm upgrade <Var name="teleport-release" /> teleport/teleport-cluster \
+    --namespace <Var name="teleport-ns" /> \
+    -f azure-values.yaml
+  ```
+
+  </TabItem>
+  <TabItem label="Using --set via CLI">
+  Run this command, editing your command line parameters as appropriate:
+
+  ```code
+  $ helm upgrade <Var name="teleport-release" /> teleport/teleport-cluster \
+    --namespace <Var name="teleport-ns" /> \
+    --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+<Admonition type="note">
+  To change `chartMode`, `clusterName` or any `azure` settings, you must first uninstall the existing chart and then install
+  a new version with the appropriate values.
+</Admonition>
+
+## Uninstalling Teleport
+
+To uninstall the `teleport-cluster` chart, use `helm uninstall`. For example:
+
+```code
+$ helm --namespace <Var name="teleport-ns" /> uninstall <Var name="teleport-release" />
+```
+
+## Next steps
+
+Now that you have deployed a Teleport cluster, read the [Manage
+Access](../../authentication/authentication.mdx) section to get started enrolling
+users and setting up RBAC.
+
+See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/custom.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/custom.mdx
similarity index 92%
rename from docs/pages/admin-guides/deploy-a-cluster/helm-deployments/custom.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/custom.mdx
index 68f50615d6452..bd8456c95acca 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/custom.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/custom.mdx
@@ -1,10 +1,15 @@
 ---
 title: Running Teleport with a Custom Configuration using Helm
+sidebar_label: Custom Configuration
+sidebar_position: 8
 description: Install and configure a Teleport cluster with a custom configuration using Helm
+tags:
+ - how-to
+ - platform-wide
 ---
 
 In this guide, we'll explain how to set up a Teleport cluster in Kubernetes
-with custom [`teleport.yaml`](../../../reference/config.mdx) config file elements
+with custom [`teleport.yaml`](../../../reference/deployment/config.mdx) config file elements
 using Teleport Helm charts.
 
 (!docs/pages/includes/cloud/call-to-action.mdx!)
@@ -18,13 +23,16 @@ existing Teleport deployment to access your Kubernetes cluster. [Follow our
 guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
 cluster to Teleport.
 
-## Prerequisites
+## How it works
 
-<Admonition type="warning">
-Those instructions are both for v12+ Teleport and the v12+ `teleport-cluster` chart.
-If you are running an older Teleport version, use the version selector at the top
-of this page to choose the correct version.
-</Admonition>
+The `teleport-cluster` Helm chart deploys the Teleport Auth Service and Proxy
+Service. You can modify the chart's values file to include a custom
+configuration for each service. The Helm chart applies Auth Service and Proxy
+Service configurations to their respective pods, which load each configuration
+as a ConfigMap. The chart applies Teleport-recommended defaults for any field
+not included in your custom configurations.
+
+## Prerequisites
 
 (!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
 
@@ -54,14 +62,14 @@ Setting `publicAddr` is the same as setting `proxy.teleportConfig.proxy_service.
 When using `scratch` or `standalone` mode, you **must** use highly-available
 storage (e.g. etcd, DynamoDB, or Firestore) for multiple replicas to be supported.
 
-[Information on supported Teleport storage backends](../../../reference/backends.mdx)
+[Information on supported Teleport storage backends](../../../reference/deployment/backends.mdx)
 
 Manually configuring NFS-based storage or `ReadWriteMany` volume claims is **NOT**
 supported for an HA deployment and will result in errors.
 </Admonition>
 
 Write the following `my-values.yaml` file, and adapt the teleport configuration as needed.
-You can find all possible configuration fields in the [Teleport Config Reference](../../../reference/config.mdx).
+You can find all possible configuration fields in the [Teleport Config Reference](../../../reference/deployment/config.mdx).
 
 ```yaml
 chartMode: standalone
@@ -270,7 +278,7 @@ install a new version with the appropriate values.
 ## Next steps
 
 Now that you have deployed a Teleport cluster, read the [Manage
-Access](../../access-controls/access-controls.mdx) section to get started enrolling
+Access](../../authentication/authentication.mdx) section to get started enrolling
 users and setting up RBAC.
 
 To see all of the options you can set in the values file for the
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/digitalocean.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/digitalocean.mdx
similarity index 94%
rename from docs/pages/admin-guides/deploy-a-cluster/helm-deployments/digitalocean.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/digitalocean.mdx
index 3cbe508a8958b..f329341a6cd01 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/digitalocean.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/digitalocean.mdx
@@ -1,6 +1,10 @@
 ---
 title: Get started with Teleport on DigitalOcean Kubernetes
+sidebar_label: DigitalOcean
 description: How to get started with Teleport on DigitalOcean Kubernetes
+tags:
+ - how-to
+ - platform-wide
 ---
 
 This guide will show you how to get started with Teleport on DigitalOcean
@@ -13,10 +17,18 @@ cluster to Teleport.
 
 (!docs/pages/includes/cloud/call-to-action.mdx!)
 
+## How it works
+
+In the setup we describe in this guide, you deploy a DigitalOcean Kubernetes
+cluster, then install the `teleport-cluster` Helm chart, which deploys the
+Teleport Auth Service and Teleport Proxy Service. You can then create a local
+administrative user on your Teleport cluster and enroll infrastructure
+resources by deploying Teleport Agents.
+
 ## Prerequisites
 
 - DigitalOcean account.
-- Your workstation configured with [kubectl](https://kubernetes.io/docs/tasks/tools/), [Helm](https://helm.sh/docs/intro/install/), [doctl](https://docs.digitalocean.com/reference/doctl/how-to/install/), and the Teleport [tsh](../../../installation.mdx) client.
+- Your workstation configured with [kubectl](https://kubernetes.io/docs/tasks/tools/), [Helm](https://helm.sh/docs/intro/install/), [doctl](https://docs.digitalocean.com/reference/doctl/how-to/install/), and the Teleport [tsh](../../../installation/installation.mdx) client.
 
 ## Step 1/4. Create a DigitalOcean Kubernetes cluster
 
@@ -270,6 +282,6 @@ Read our guides to additional ways you can protect a Kubernetes cluster with
 Teleport:
 
 - Connect another Kubernetes cluster to Teleport by [deploying the Teleport Kubernetes Service](../../../enroll-resources/kubernetes-access/getting-started.mdx)
-- [Set up Machine ID with Kubernetes](../../../enroll-resources/machine-id/access-guides/kubernetes.mdx)
+- [Set up Machine & Workload Identity with Kubernetes](../../../machine-workload-identity/access-guides/kubernetes.mdx)
 - [Single-Sign On and RBAC for Kubernetes Clusters](../../../enroll-resources/kubernetes-access/controls.mdx)
 
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/disaster-recovery.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/disaster-recovery.mdx
new file mode 100644
index 0000000000000..b7655abfe22d5
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/disaster-recovery.mdx
@@ -0,0 +1,353 @@
+---
+title: Managing Disaster Recovery in an Amazon EKS Teleport Cluster
+sidebar_label: Disaster Recovery
+description: Provides guidance for planning a strategy for restoring a self-hosted Teleport cluster on EKS after a regional outage.
+tags:
+ - how-to
+ - platform-wide
+ - aws
+---
+
+In case of an outage in your cloud provider region, you need to ensure that you
+can restore your Teleport cluster to working order. This guide provides an
+overview of a disaster recovery approach for self-hosted Teleport clusters.
+
+The guide assumes that your self-hosted Teleport cluster runs on Amazon Elastic
+Kubernetes Service and uses the `teleport-cluster` Helm chart. The
+`teleport-cluster` Helm chart is the recommended approach for quickly getting
+started with self-hosting a Teleport cluster on Kubernetes, and you can read
+about how to get started with the chart in [Deploy Teleport on
+Kubernetes](./kubernetes-cluster.mdx).
+
+## How it works
+
+In the approach we explain in this guide, AWS backs up the Teleport Auth Service
+backends to a secondary region. If the primary region becomes unavailable due to
+an outage, an admin redeploys the cluster to the secondary region, configuring
+the Teleport Auth Service to connect to new backends in the region. 
+
+Since Teleport certificate authorities are already backed up in the new region,
+running Teleport Agents and bots outside the unavailable region do not need to
+reconnect to the cluster. In this disaster recovery scenario, the recovery time
+objective depends on the time it takes to redeploy the Auth Service and Proxy
+Service in the new region, as well as the time to live (TTL) of the DNS records
+for the Teleport Proxy Service.
+
+## Prerequisites
+
+- Your self-hosted Teleport cluster was launched using the `teleport-cluster`
+  Helm chart. We recommend reading [Deploying a High Availability Teleport
+  Cluster](../deployments/high-availability.mdx) for a high-level architectural outline of a
+  self-hosted Teleport cluster.
+- You are using Amazon DynamoDB for the cluster state backend and audit event
+  backend, and using Amazon S3 for your session recording backend. For
+  information on selecting Teleport backends, see [Storage
+  Backends](../../../reference/deployment/backends.mdx).
+
+<Admonition type="danger">
+
+This guide is not intended to be a runbook for a regional outage.
+
+Read this guide to help prepare your disaster recovery plan, including any
+runbooks and automation. We strongly recommend that you regularly test your plan
+to prevent issues.
+
+</Admonition>
+
+## Step 1/4. Back up Auth Service backends
+
+The first step in setting up a disaster recovery procedure for your Teleport
+cluster on Amazon EKS is to back up your Teleport Auth Service backends to a
+secondary region. If the primary region becomes unavailable, the backend
+replicas in the secondary region will be ready for your new cluster to connect
+to once you redeploy it in the secondary region.
+
+The recovery point objective for a Teleport cluster during a regional outage
+depends on how frequently you back up the Auth Service backend. The more
+frequent the backups, the fewer backend changes you will lose when you restore
+the cluster during a disaster.
+
+### Cluster state backend
+
+With a backup of the cluster state backend, the Teleport Auth Service can use
+its existing certificate authorities to sign certificates for cluster
+components. If you restore a Teleport cluster with a new backend, and do not
+have a backup, you will need to configure cluster components, such as
+self-hosted databases protected by Teleport, to trust the new CAs.
+
+Read the [Amazon DynamoDB
+documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Backup-and-Restore.html)
+to plan your backup procedure.
+
+<details>
+<summary>AWS Key Management Service users</summary>
+
+If the Teleport Auth Service in your cluster uses AWS Key Management Service for
+certificate authority private keys, you must replicate your keys to the new AWS
+region before reinstalling the `teleport-cluster` Helm chart. See the [AWS
+documentation](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html")
+for information about using KMS keys in multiple regions. 
+
+Note that KMS support is only possible in the `teleport-cluster` Helm chart
+using the `auth.teleportConfig` values field ([chart
+reference](../../../reference/helm-reference/teleport-cluster.mdx#authteleportconfig),
+and is not recommended for most `teleport-cluster` users.
+
+</details>
+
+### Audit event backend
+
+In addition to the cluster state backend, you must also back up the audit event
+backend to a secondary region in order to retain access to audit events. As with
+the cluster state backend read the [Amazon DynamoDB
+documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Backup-and-Restore.html)
+to plan your backup procedure.
+
+### Session recording backend
+
+To retain access to your session recordings in the case of region-wide
+unavailability, you need to back up your session recordings to the secondary
+region. When you redeploy the Teleport Auth Service to the new region, you can
+configure it to connect to an S3 bucket in the new region.
+
+You can use S3 replication rules to create continuous backups from your primary
+region to the backup region. Follow the [Multi-Region
+Blueprint](../deployments/multi-region-blueprint.mdx#setting-up-multi-region-aws-s3-replication)
+guide to plan multi-region S3 bucket replication for your session recording
+backend.
+
+## Step 2/4. Stop the existing cluster
+
+When you detect a zonal or regional outage, it is important that you cleanly
+stop the existing Teleport cluster. While outages at the cloud provider level
+disrupt the expected functioning of a Teleport cluster, some operations in your
+cluster may continue successfully. After the outage has concluded, services that
+remained functional or come back online can cause the cluster to behave in
+unexpected ways.
+
+For example, Teleport Agents can remain connected to a Teleport cluster even
+after an outage has caused it to become unavailable. This is because agents
+establish long-lived gRPC connections through the Proxy Service, and maintain
+these even when the target Proxy Service instances have become unresponsive. You
+can force-close the connections between agents and the Proxy Service by stopping
+and restarting the Proxy Service.
+
+If it is possible to do so, stop any Teleport Auth Service and Proxy Service
+pods in your cluster. This command assumes that the name of your release is
+`teleport-cluster` and that it runs in the `teleport` namespace:
+
+```code
+$ helm --namespace teleport uninstall teleport-cluster
+```
+
+Note that, in the case of a full regional outage, your existing cluster may
+already be unavailable.
+
+## Step 3/4. Relaunch the Auth Service and Proxy Service
+
+Now that there is a backup of the Auth Service backend, you are safe to deploy
+the Teleport cluster in a new region.  
+
+### Update your values file
+
+When deploying the Teleport Auth Service and Proxy Service to the new region,
+you need to update the following fields in the values file for the
+`teleport-cluster` Helm chart:
+
+- `aws.region`
+- `aws.backendTable`
+- `aws.auditLogTable`
+- `aws.sessionRecordingBucket`
+
+You may need to update other values to match third-party dependencies of the
+Teleport cluster. For example, if you plan to deploy `cert-manager` to handle
+Teleport Proxy Service certificates instead of Let's Encrypt, you need to set
+the `certManager.issuerName` field to match the name of the `cert-manager`
+Issuer in your Kubernetes cluster. 
+
+We recommend reading [Running an HA Teleport Cluster Using AWS, EKS, and
+Helm](./aws.mdx) so you can make sure that you have accounted for any
+third-party dependencies you need to manage in the new AWS region.
+
+### Update IAM configurations
+
+You also need to ensure that the roles used by the Auth Service and Proxy
+Service grant the services permissions to access backends in the new region.
+Make sure that the trust policies associated with these roles grant access to
+principals in the new region.
+
+### Provision credentials to the load balancer  
+
+The `teleport-cluster` Helm chart deploys a Kubernetes service that, by default,
+has the `LoadBalancer` type. Reinstalling the Helm chart in your new AWS region
+recreates the load balancer. 
+
+If you are using AWS Certificate Manager or `cert-manager` to provision TLS
+credentials for your load balancer, you must create a new certificate and
+private key before installing the chart in the new region.
+
+For guidance on configuring your EKS cluster to use ACM and `cert-manager` with
+the Teleport Proxy Service load balancer, see [Configure TLS certificates for
+Teleport](./aws.mdx#step-47-configure-tls-certificates-for-teleport).
+
+### Reinstall the Helm chart
+
+1. Install the `teleport-cluster` Helm chart using the new values:
+
+   ```code
+   $ helm install teleport-cluster teleport/teleport-cluster \
+     --version (=teleport.version=) \
+     --values teleport-cluster-values.yaml
+   ```
+
+1. After installing the `teleport-cluster` chart, wait a minute or so and ensure
+   that both the Auth Service and Proxy Service pods are running:
+
+   ```code
+   $ kubectl get pods
+   NAME                                      READY   STATUS    RESTARTS   AGE
+   teleport-cluster-auth-000000000-00000     1/1     Running   0          114s
+   teleport-cluster-proxy-0000000000-00000   1/1     Running   0          114s
+   ```
+
+1. Once the Teleport Auth Service is running on the new cluster, make sure that
+   you have applied Teleport dynamic resources against the new cluster so the
+   Teleport Kubernetes operator can manage them. 
+
+   You should manage your Teleport resources as a set of Kubernetes manifests
+   applied using a GitOps tool like Flux CD so that, when you launch the new
+   cluster, you can readily apply them.
+
+<Admonition type="warning">
+
+Note that, by the time you have redeployed the Auth Service and Proxy Service,
+any Machine & Workload Identity bots that have joined the cluster with a static
+token will likely miss their renewal periods and become locked out of the
+cluster until the Teleport Auth Service can issue new tokens. We recommend using
+delegated join methods to prevent this scenario. 
+
+</Admonition>
+
+## Step 4/4. Update DNS records
+
+Once you have launched your Teleport cluster in the new AWS region, you must
+ensure that Route 53 DNS records point to the new cluster.
+
+Ensure that existing DNS records for the Teleport Proxy Service in your cluster
+have a low TTL, e.g., one minute. We expect that DNS resolvers in your users'
+networks honor the TTLs of DNS records to prevent issues with propagating
+records.
+
+(!docs/pages/includes/self-hosted-helm-dns.mdx!)
+
+## Guidance  
+
+Assuming that you have planned your disaster recovery strategy around the steps
+we lay out in this guide, we recommend the following practices.
+  
+### Testing your disaster recovery procedure
+
+We strongly recommended testing your disaster recovery plan. Schedule time to
+stop your Teleport cluster in one region and redeploy in another one using your
+backup of the Auth Service cluster state backend. After redeploying your
+cluster, ensure that users can continue to connect to Teleport-protected
+resources.
+
+Common causes of disaster recovery failures include:
+- **Misconfigured IAM settings:** The Teleport Auth Service in your first region
+  can access its backend, for example, but in the second region, the Auth
+  Service has a role with insufficient permissions.
+- **Misconfigured backend connections:** The Teleport Auth Service is configured
+  with an incorrect cluster state backend URL in the new region, meaning that
+  when it starts up, it fails to retrieve its existing CAs and bootstraps
+  instead with a self-signed certificate.
+
+### Shortening the recovery time objective
+
+When planning a Teleport disaster recovery plan, the main consideration for
+estimating a recovery time objective is how long it will take for the Teleport
+Auth Service to come online in your secondary region.
+
+You can expect the disaster recovery procedure outlined in this guide to take at
+least an hour, though the precise details depend on your infrastructure and
+organization. To arrive at an exact benchmark, we strongly recommend [testing
+your disaster recovery procedure](#testing-your-disaster-recovery-procedure).
+
+You can take measures to shorten the recovery time objective of your disaster
+recovery procedure. Possibilities include:
+
+- Reduce the TTL of the DNS records for the Teleport Proxy Service. If this is
+  longer than the time it takes to redeploy your cluster to a new region,
+  clients may continue to connect to the cluster in the previous region.
+- Restore your cluster state and audit event backend tables from backup prior to
+  reinstalling the `teleport-cluster` Helm chart, so the Teleport Auth Service
+  does not need to initialize any tables itself.
+- Run the Auth Service, Proxy Service, and backend services in the secondary
+  region before any regional outage takes place. When there are redundant
+  Teleport cluster deployments across multiple regions, there is no need to lose
+  availability while waiting for your cluster to deploy to a new region. Read
+  about the architecture of a multi-region Teleport deployment in the
+  [Multi-Region Blueprint](../deployments/multi-region-blueprint.mdx) guide.
+
+### Imposing a change freeze
+
+During a regional cloud provider outage, the procedure we outline in this guide
+includes stopping the Teleport cluster in the affected region. Until the cluster
+comes back online, it is impossible for users to update dynamic resources or
+rotate the cluster CAs. In some cases, though, you may need to impose a change
+freeze to prevent users from updating cluster resources while you restore a
+cluster from a backup.
+
+You can impose a change freeze by locking Teleport roles that include
+permissions to edit dynamic resources. Teleport roles allow access to modifying
+dynamic resources with the `spec.allow.rules` field. 
+
+You can use the following `jq` command to list all roles with one or more rule
+that grants permissions to modify backend resources. This example assumes that
+there is a role called `locksmith` that allows the user to create, list, read,
+and delete locks. It skips the `locksmith` user so you can remove the lock after
+restoring the cluster:
+
+```code
+$ tctl get roles --format json | jq -r '.[] | select(.metadata.name != "locksmith" and .spec.allow.rules) | .metadata.name'
+dashboard-admin
+dashboard-user
+device-admin
+device-enroll
+group-access
+```
+
+Teleport grants access to certificate authority rotations using the
+`spec.allow.rules` field - on the `cert_authority` resource - so using role
+locking to impose a change freeze will also unintended certificate authority
+rotations during the disaster recovery procedure.
+
+Create a lock using a `tctl lock` command. The following example locks the
+`contractor` role for 24 hours:
+
+```code
+$ tctl lock --role=contractor --message="change freeze during disaster recovery" --ttl=24h
+```
+
+Note that users with permissions to execute commands directly on the Auth
+Service pod can still make changes to the backend using `tctl`.
+
+Once it is safe for users to modify cluster resources, use the `tctl rm
+lock/<lock_id>` command to remove each lock. If you provided each lock with a
+similar `--message` flag value when creating the locks, you can remove all locks
+you created with a single command. This command removes all locks with a message
+that includes the substring `change freeze`:
+
+```code
+$ tctl get lock --format=json \
+  | jq -r '.[] | select(.spec.message and (.spec.message | contains("change freeze"))) | .metadata.name' \
+  | xargs -I{} tctl rm lock/{}
+```
+
+## Further reading
+
+- Read the [Backup and Restore](../backup-restore.mdx)
+  guide for general information on backing up your Teleport cluster backends.
+- For more information on preventing Teleport roles from making changes to your
+  cluster state backend, read [Session and Identity
+  Locking](../../../identity-governance/locking.mdx).
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx
new file mode 100644
index 0000000000000..7adc1398cb54c
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/gcp.mdx
@@ -0,0 +1,512 @@
+---
+title: Running an HA Teleport cluster using GCP, GKE, and Helm
+sidebar_label: GKE
+description: Install and configure an HA Teleport cluster using a Google Cloud GKE cluster.
+tags:
+ - how-to
+ - platform-wide
+ - google-cloud
+---
+
+In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
+using Teleport Helm charts and Google Cloud Platform products (Firestore and Google Cloud Storage).
+
+If you are already running Teleport on another platform, you can use your
+existing Teleport deployment to access your Kubernetes cluster. [Follow our
+guide](../../../enroll-resources/kubernetes-access/getting-started.mdx) to connect your Kubernetes
+cluster to Teleport.
+
+(!docs/pages/includes/cloud/call-to-action.mdx!)
+
+## How it works
+
+The `teleport-cluster` Helm chart deploys the Teleport Auth Service and Teleport
+Proxy Service on your Google Kubernetes Engine cluster. The chart requires the
+following resources, which we show you how to create in this guide:
+
+- **IAM permissions for the Teleport Auth Service**. The Auth Service requires
+  permissions to manage resources on its backend. 
+- **cert-manager** for obtaining and renewing TLS credentials that the Proxy
+  Service uses to run its HTTPS server.
+- **IAM permissions for cert-manager**. In the setup we show in this guide,
+  `cert-manager` modifies DNS records to demonstrate domain ownership and
+  receive TLS credentials from Let's Encrypt. To do so, the Proxy Service
+  completes the [ACME DNS-01
+  challenge](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge).
+- **Teleport Auth Service backend components:** A Google Cloud Storage bucket and
+  Firestore database.
+
+## Prerequisites
+
+(!docs/pages/includes/kubernetes-access/helm/teleport-cluster-prereqs.mdx!)
+
+## Step 1/6. Add the Teleport Helm chart repository
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+<Admonition
+  type="note"
+  title="Note">
+>
+  The steps below apply to Google Cloud Google Kubernetes Engine (GKE) Standard deployments.
+</Admonition>
+
+## Step 2/6. Google Cloud IAM configuration
+
+For Teleport to be able to create the Firestore collections, indexes, and the Google Cloud Storage bucket it needs,
+you'll need to configure a Google Cloud service account with permissions to use these services.
+
+### Create an IAM role granting the `storage.buckets.create` permission
+
+Go to the "Roles" section of Google Cloud IAM & Admin.
+
+1. Click the "Create Role" button at the top.
+
+   ![Roles section](../../../../img/helm/gcp/1-roles@1.5x.png)
+
+2. Fill in the details of a "Storage Bucket Creator" role (we suggest using the name `storage-bucket-creator-role`)
+
+   ![Create role](../../../../img/helm/gcp/2-createrole@1.5x.png)
+
+3. Click the "Add Permissions" button.
+
+   ![Storage bucket creator role](../../../../img/helm/gcp/3-addpermissions@1.5x.png)
+
+4. Use the "Filter" box to enter `storage.buckets.create` and select it in the list.
+
+   ![Filter the list](../../../../img/helm/gcp/4-storagebucketscreate@1.5x.png)
+
+5. Check the `storage.buckets.create` permission in the list and click the "Add" button to add it to the role.
+
+   ![Select storage.buckets.create](../../../../img/helm/gcp/5-select@1.5x.png)
+
+6. Once all these settings are entered successfully, click the "Create" button.
+
+   ![Create role](../../../../img/helm/gcp/6-createrole@1.5x.png)
+
+### Create an IAM role granting Cloud DNS permissions
+
+Go to the "Roles" section of Google Cloud IAM & Admin.
+
+1. Click the "Create Role" button at the top.
+
+   ![Roles section](../../../../img/helm/gcp/1-roles@1.5x.png)
+
+2. Fill in the details of a "DNS Updater" role (we suggest using the name `dns-updater-role`)
+
+   ![Create role](../../../../img/helm/gcp/13-dns-createrole@1.5x.png)
+
+3. Click the "Add Permissions" button.
+
+   ![DNS updater role](../../../../img/helm/gcp/3-addpermissions@1.5x.png)
+
+4. Use the "Filter" box to find each of the following permissions in the list
+   and add it.  You can type things like `dns.resourceRecordSets.*` to quickly
+   filter the list.
+
+   ```console
+   dns.resourceRecordSets.create
+   dns.resourceRecordSets.delete
+   dns.resourceRecordSets.list
+   dns.resourceRecordSets.update
+   dns.changes.create
+   dns.changes.get
+   dns.changes.list
+   dns.managedZones.list
+   ```
+
+5. Once all these settings are entered successfully, click the "Create" button.
+
+   ![Add DNS permissions](../../../../img/helm/gcp/14-dns-permissions-create@1.5x.png)
+
+### Create a service account for the Teleport Helm chart
+
+<Admonition type="note">
+ If you already have a JSON private key for an appropriately-provisioned service account that you wish to use, you can skip this
+ creation process and go to the ["Create the Kubernetes secret containing the JSON private key for the service account"](#create-the-kubernetes-secret-containing-the-json-private-key-for-the-service-account)
+ section below.
+</Admonition>
+
+Go to the "Service Accounts" section of Google Cloud IAM & Admin.
+
+1. Click the "Create Service Account" button at the top.
+
+   ![Create service account](../../../../img/helm/gcp/7-serviceaccounts@1.5x.png)
+
+2. Enter details for the service account (we recommend using the name `teleport-helm`) and click the "Create" button.
+
+   ![Enter service account details](../../../../img/helm/gcp/8-createserviceaccount@1.5x.png)
+
+3. In the "Grant this service account access to project" section, add these four roles:
+
+| Role | Purpose |
+| - | - |
+| storage-bucket-creator-role | Role you just created allowing creation of storage buckets |
+| dns-updater-role | Role you just created allowing updates to Cloud DNS records |
+| Cloud Datastore Owner | Grants permissions to create Cloud Datastore collections |
+| Storage Object Admin | Allows read/write/delete of Google Cloud storage objects |
+
+![Add roles](../../../../img/helm/gcp/9-addroles@1.5x.png)
+
+4. Click the "continue" button to save these settings, then click the "create" button to create the service account.
+
+### Generate an access key for the service account
+
+Go back to the "Service Accounts" view in Google Cloud IAM & Admin.
+
+1. Click on the `teleport-helm` service account that you just created.
+
+   ![Click on the service account](../../../../img/helm/gcp/10-serviceaccountdetails@1.5x.png)
+
+2. Click the "Keys" tab at the top and click "Add Key". Choose "JSON" and click "Create".
+
+   ![Create JSON key](../../../../img/helm/gcp/11-createkey.png)
+
+3. The JSON private key will be downloaded to your computer. Take note of the filename (`bens-demos-24150b1a0a7f.json` in this example)
+   as you will need it shortly.
+
+   ![Private key saved](../../../../img/helm/gcp/12-privatekey@1.5x.png)
+
+#### Create the Kubernetes secret containing the JSON private key for the service account
+
+Find the path where the JSON private key was just saved (likely your browser's default "Downloads" directory).
+
+Use `kubectl` to create the `teleport` namespace, set its security policy, and
+create the secret using the path to the JSON private key:
+
+```code
+$ kubectl create namespace teleport
+namespace/teleport created
+$ kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
+namespace/teleport labeled
+$ kubectl --namespace teleport create secret generic teleport-gcp-credentials --from-file=gcp-credentials.json=/path/to/downloads/bens-demos-24150b1a0a7f.json
+secret/teleport-gcp-credentials created
+```
+
+<Admonition type="tip">
+  If you installed the Teleport chart into a specific namespace, the `teleport-gcp-credentials` secret you create must also be added to the same namespace.
+</Admonition>
+
+<Admonition type="note">
+ The default name configured for the secret is `teleport-gcp-credentials`.
+
+ If you already have a secret created, you can skip this creation process and specify the name of the secret using `gcp.credentialSecretName`.
+
+ The credentials file stored in any secret used must have the key name `gcp-credentials.json`.
+</Admonition>
+
+## Step 3/6. Install and configure cert-manager
+
+Reference the [cert-manager docs](https://cert-manager.io/docs/).
+
+In this example, we are using multiple pods to create a High Availability Teleport cluster. As such, we will be using
+`cert-manager` to centrally provision TLS certificates using Let's Encrypt. These certificates will be mounted into each
+Teleport pod, and automatically renewed and kept up to date by `cert-manager`.
+
+If you do not have `cert-manager` already configured in the Kubernetes cluster where you are installing Teleport,
+you should add the Jetstack Helm chart repository which hosts the `cert-manager` chart, and install the chart:
+
+```code
+$ helm repo add jetstack https://charts.jetstack.io
+$ helm repo update
+$ helm install cert-manager jetstack/cert-manager \
+--create-namespace \
+--namespace cert-manager \
+--set global.leaderElection.namespace=cert-manager \
+--set installCRDs=true
+```
+
+Once `cert-manager` is installed, you should create and add an `Issuer`.
+
+You'll need to replace these values in the `Issuer` example below:
+
+| Placeholder value | Replace with |
+| - | - |
+| `email@address.com` | An email address to receive communications from Let's Encrypt |
+| `example.com` | The name of the Cloud DNS domain hosting your Teleport cluster |
+| `gcp-project-id` | GCP project ID where the Cloud DNS domain is registered |
+
+```yaml
+cat << EOF > gcp-issuer.yaml
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt-production
+  namespace: teleport
+spec:
+  acme:
+    email: email@address.com                                # Change this
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+    - selector:
+        dnsZones:
+          - "example.com"                                  # Change this
+      dns01:
+        cloudDNS:
+          project: gcp-project-id                          # Change this
+          serviceAccountSecretRef:
+            name: teleport-gcp-credentials
+            key: gcp-credentials.json
+EOF
+```
+
+<Admonition type="note">
+  The secret name under `serviceAccountSecretRef` here defaults to `teleport-gcp-credentials`.
+
+  If you have changed `gcp.credentialSecretName` in your chart values, you must also make sure it matches here.
+</Admonition>
+
+After you have created the `Issuer` and updated the values, add it to your cluster using `kubectl`:
+
+```code
+$ kubectl --namespace teleport create -f gcp-issuer.yaml
+```
+
+## Step 4/6. Set values to configure the cluster
+
+<details>
+<summary>License Secret</summary>
+
+Before you can install Teleport Enterprise in your Kubernetes cluster, you will need to
+create a secret that contains your Teleport license information.
+
+(!docs/pages/includes/enterprise/obtainlicense.mdx!)
+
+Create a secret from your license file. Teleport will automatically discover
+this secret as long as your file is named `license.pem`.
+
+```code
+$ kubectl -n teleport create secret generic license --from-file=license.pem
+```
+
+</details>
+
+<Admonition type="note">
+  If you are installing Teleport in a brand new GCP project, make sure you have enabled the
+  [Cloud Firestore API](https://console.cloud.google.com/apis/api/firestore.googleapis.com/overview)
+  and created a
+  [Firestore Database](https://console.cloud.google.com/firestore/welcome)
+  in your project before continuing.
+</Admonition>
+
+Next, configure the `teleport-cluster` Helm chart to use the `gcp` mode. Create a
+file called `gcp-values.yaml` file and write the values you've chosen above to
+it:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Teleport Community Edition">
+
+```yaml
+chartMode: gcp
+clusterName: teleport.example.com                 # Name of your cluster. Use the FQDN you intend to configure in DNS below
+gcp:
+  projectId: gcpproj-123456                       # Google Cloud project ID
+  backendTable: teleport-helm-backend             # Firestore collection to use for the Teleport backend
+  auditLogTable: teleport-helm-events             # Firestore collection to use for the Teleport audit log (must be different to the backend collection)
+  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  sessionRecordingBucket: teleport-helm-sessions  # Google Cloud Storage bucket to use for Teleport session recordings
+highAvailability:
+  replicaCount: 2                                 # Number of replicas to configure
+  certManager:
+    enabled: true                                 # Enable cert-manager support to get TLS certificates
+    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
+
+# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
+podSecurityPolicy:
+  enabled: false
+```
+
+</TabItem>
+<TabItem scope={["enterprise"]} label="Teleport Enterprise">
+
+```yaml
+chartMode: gcp
+clusterName: teleport.example.com                 # Name of your cluster. Use the FQDN you intend to configure in DNS below
+gcp:
+  projectId: gcpproj-123456                       # Google Cloud project ID
+  backendTable: teleport-helm-backend             # Firestore collection to use for the Teleport backend
+  auditLogTable: teleport-helm-events             # Firestore collection to use for the Teleport audit log (must be different to the backend collection)
+  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  sessionRecordingBucket: teleport-helm-sessions  # Google Cloud Storage bucket to use for Teleport session recordings
+highAvailability:
+  replicaCount: 2                                 # Number of replicas to configure
+  certManager:
+    enabled: true                                 # Enable cert-manager support to get TLS certificates
+    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
+enterprise: true                                  # Indicate that this is a Teleport Enterprise deployment
+```
+
+</TabItem>
+
+</Tabs>
+
+Install the chart with the values from your `gcp-values.yaml` file using this command:
+
+```code
+$ helm install teleport teleport/teleport-cluster \
+  --create-namespace \
+  --namespace teleport \
+  -f gcp-values.yaml
+```
+
+<Admonition type="note">
+  You cannot change the `clusterName` after the cluster is configured, so make sure you choose wisely. We recommend using the fully-qualified domain name that you'll use for external access to your Teleport cluster.
+</Admonition>
+
+Once the chart is installed, you can use `kubectl` commands to view the deployment:
+
+```code
+$ kubectl --namespace teleport get all
+
+NAME                                 READY   STATUS    RESTARTS   AGE
+pod/teleport-auth-57989d4cbd-4q2ds   1/1     Running   0          22h
+pod/teleport-auth-57989d4cbd-rtrzn   1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-w96d2   1/1     Running   0          22h
+pod/teleport-proxy-c6bf55cfc-z256w   1/1     Running   0          22h
+
+NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                                                                     AGE
+service/teleport            LoadBalancer   10.40.11.180   34.138.177.11   443:30258/TCP,3023:31802/TCP,3026:32182/TCP,3024:30101/TCP,3036:30302/TCP   22h
+service/teleport-auth       ClusterIP      10.40.8.251    <none>          3025/TCP,3026/TCP                                                           22h
+service/teleport-auth-v11   ClusterIP      None           <none>          <none>                                                                      22h
+service/teleport-auth-v12   ClusterIP      None           <none>          <none>                                                                      22h
+
+NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
+deployment.apps/teleport-auth    2/2     2            2           22h
+deployment.apps/teleport-proxy   2/2     2            2           22h
+
+NAME                                       DESIRED   CURRENT   READY   AGE
+replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
+replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
+```
+
+## Step 5/6. Set up DNS
+
+You'll need to set up a DNS `A` record for `teleport.example.com`.
+
+<details>
+<summary>Enrolling applications with Teleport?</summary>
+
+(!docs/pages/includes/dns-app-access.mdx!)
+
+</details>
+
+Here's how to do this using Google Cloud DNS:
+
+```code
+# Change these parameters if you altered them above
+$ NAMESPACE=teleport
+$ RELEASE_NAME=teleport
+
+$ MYIP=$(kubectl --namespace ${NAMESPACE?} get service/${RELEASE_NAME?} -o jsonpath='{.status.loadBalancer.ingress[*].ip}')
+$ MYZONE="myzone"
+$ MYDNS="teleport.example.com"
+
+$ gcloud dns record-sets transaction start --zone="${MYZONE?}"
+$ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="300" --type="A" --zone="${MYZONE?}"
+$ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="300" --type="A" --zone="${MYZONE?}"
+$ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
+$ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
+```
+
+## Step 6/6. Create a Teleport user
+
+Create a user to be able to log into Teleport. This needs to be done on the Teleport Auth Service,
+so we can run the command using `kubectl`:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Teleport Community Edition">
+```code
+$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</TabItem>
+<TabItem scope={["enterprise", "cloud"]} label="Commercial">
+```code
+$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor,reviewer
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</TabItem>
+
+</Tabs>
+
+Load the user creation link to create a password and set up multi-factor authentication for the Teleport user via the web UI.
+
+### High Availability
+
+In this guide, we have configured 2 replicas. This can be changed after cluster creation by altering the `highAvailability.replicaCount`
+value [using `helm upgrade` as detailed below](#upgrading-the-cluster-after-deployment).
+
+## Upgrading the cluster after deployment
+
+To make changes to your Teleport cluster after deployment, you can use `helm upgrade`.
+
+Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
+version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
+
+If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../../../reference/helm-reference/teleport-cluster.mdx) value.
+
+Here's an example where we set the chart to use 3 replicas:
+
+<Tabs>
+  <TabItem label="Using values.yaml">
+  Edit your `gcp-values.yaml` file from above and make the appropriate changes.
+
+  Upgrade the deployment with the values from your `gcp-values.yaml` file using this command:
+
+  ```code
+  $ helm upgrade teleport teleport/teleport-cluster \
+    --namespace teleport \
+    -f gcp-values.yaml
+  ```
+
+  </TabItem>
+  <TabItem label="Using --set via CLI">
+  Run this command, editing your command line parameters as appropriate:
+
+  ```code
+  $ helm upgrade teleport teleport/teleport-cluster \
+    --namespace teleport \
+    --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+<Admonition type="note">
+  To change `chartMode`, `clusterName` or any `gcp` settings, you must first uninstall the existing chart and then install
+  a new version with the appropriate values.
+</Admonition>
+
+## Uninstalling Teleport
+
+To uninstall the `teleport-cluster` chart, use `helm uninstall <release-name>`. For example:
+
+```code
+$ helm --namespace teleport uninstall teleport
+```
+
+### Uninstalling cert-manager
+
+If you want to remove the `cert-manager` installation later, you can use this command:
+
+```code
+$ helm --namespace cert-manager uninstall cert-manager
+```
+
+## Next steps
+
+Now that you have deployed a Teleport cluster, read the [Manage
+Access](../../authentication/authentication.mdx) section to get started enrolling
+users and setting up RBAC.
+
+See the [high availability section of our Helm chart reference](../../../reference/helm-reference/teleport-cluster.mdx) for more details on high availability.
+
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx
new file mode 100644
index 0000000000000..74acfda8d3a08
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/helm-deployments.mdx
@@ -0,0 +1,27 @@
+---
+title: Guides for Running Teleport Using Helm
+sidebar_label: Helm Deployments
+sidebar_position: 3
+description: How to install and configure Teleport in Kubernetes using Helm
+template: "no-toc"
+tags:
+ - platform-wide
+---
+
+The `teleport-cluster` Helm chart enables you deploy and manage a self-hosted,
+high-availability Teleport cluster. This chart launches the Teleport Auth
+Service, Teleport Proxy Service, and the Kubernetes infrastructure required to
+support these services. The guides in this section show you how to use the
+`teleport-cluster` Helm chart in your environment.
+
+You do not need to deploy the Auth Service and Proxy Service on Kubernetes in
+order to protect a Kubernetes cluster with Teleport, and it is possible to
+enroll a Kubernetes cluster on Teleport Cloud or by running the Teleport
+Kubernetes Service on a Linux server. For instructions on enrolling a Kubernetes
+cluster with Teleport, read the [Kubernetes
+Access](../../../enroll-resources/kubernetes-access/introduction.mdx) documentation.
+
+These guides show you how to manage a self-hosted Teleport deployment using our
+`teleport-cluster` Helm chart:
+
+<DocCardList />
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/ibm.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/ibm.mdx
similarity index 97%
rename from docs/pages/admin-guides/deploy-a-cluster/helm-deployments/ibm.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/ibm.mdx
index b9989f35dfa58..90f000e10fbc6 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/ibm.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/ibm.mdx
@@ -1,21 +1,26 @@
 ---
 title: Running Teleport on IBM Cloud
+sidebar_label: IBM Cloud
 description: How to install and configure Teleport on IBM cloud
+tags:
+ - how-to
+ - platform-wide
 ---
 
 This guide describes how to set up Teleport on IBM Cloud.
 
+## How it works
+
 We will use the following services to deploy Teleport on IBM cloud:
 - [Compute: IBM Cloud Kubernetes Service](https://www.ibm.com/products/kubernetes-service)
   to deploy Teleport using the [`teleport-cluster` Helm chart](../../../reference/helm-reference/teleport-cluster.mdx)
 - [Storage: IBM Cloud Databases for PostgreSQL](https://www.ibm.com/products/databases-for-postgresql)
-  to store the Teleport cluster state, and the Teleport audit events (see []backends reference](../../../reference/backends.mdx)
+  to store the Teleport cluster state, and the Teleport audit events (see [backends reference](../../../reference/deployment/backends.mdx)
   for more details).
 - [Storage: IBM Cloud Object Storage](https://www.ibm.com/products/cloud-object-storage) to store the Teleport
   session recordings.
 - [Network: IBM Cloud DNS Services](https://www.ibm.com/products/dns) to route Teleport
 
-
 ## Prerequisites
 
 To follow this guide you will need:
@@ -308,10 +313,10 @@ In this step you will create a new user and access the web UI:
 ## Next Steps
 
 As next steps you can:
-- enroll [servers](../../../enroll-resources/server-access/introduction.mdx),
+- enroll [servers](../../../enroll-resources/server-access/server-access.mdx),
   [Kubernetes clusters](../../../enroll-resources/kubernetes-access/introduction.mdx),
   [databases](../../../enroll-resources/database-access/getting-started.mdx),
   [applications](../../../enroll-resources/application-access/getting-started.mdx),
   or [Windows desktops](../../../enroll-resources/desktop-access/desktop-access.mdx) into your Teleport cluster
 - check the [`teleport-cluster` Helm reference](../../../reference/helm-reference/teleport-cluster.mdx) for a list of supported values
-- use [the Teleport Kubernetes operator(../../admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx) to control Teleport resources
\ No newline at end of file
+- use [the Teleport Kubernetes operator(../../admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx) to control Teleport resources
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
similarity index 79%
rename from docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
index 9c8a7a5d6f2cb..5409769a607b7 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
@@ -1,11 +1,17 @@
 ---
 title: Deploy Teleport on Kubernetes
+sidebar_label: Get Started
 description: This guide shows you how to deploy Teleport on a Kubernetes cluster using Helm.
+tags:
+ - how-to
+ - platform-wide
 ---
 
 Teleport can provide secure, unified access to your Kubernetes clusters. This
 guide will show you how to deploy Teleport on a Kubernetes cluster using Helm.
 
+## How it works
+
 While completing this guide, you will deploy one Teleport pod each for the Auth
 Service and Proxy Service in your Kubernetes cluster, and a load balancer that
 forwards outside traffic to your Teleport cluster. Users can then access your
@@ -92,8 +98,8 @@ cluster to Teleport.
 
   </details>
 
-- The `tsh` client tool v(=teleport.version=)+ installed on your workstation.
-  You can download this from our [installation page](../../../installation.mdx).
+- The `tsh` client tool installed on your workstation.  You can download this
+  from our [installation page](../../../installation/installation.mdx).
 
 (!docs/pages/includes/kubernetes-access/helm-k8s.mdx!)
 
@@ -220,63 +226,7 @@ chart.
 In this section, you will enable users and services to connect to your cluster
 by creating DNS records that point to the address of your Proxy Service.
 
-The `teleport-cluster` Helm chart exposes the Proxy Service to traffic from the
-internet using a Kubernetes service that sets up an external load balancer with
-your cloud provider.
-
-Obtain the address of your load balancer by following the instructions below.
-
-1. Get information about the Proxy Service load balancer:
-
-   ```code
-   $ kubectl get services/teleport-cluster
-   NAME              TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)                        AGE
-   teleport-cluster  LoadBalancer   10.4.4.73    192.0.2.0        443:31204/TCP                  89s
-   ```
-   
-   The `teleport-cluster` service directs traffic to the Teleport Proxy Service.
-   Notice the `EXTERNAL-IP` field, which shows you the IP address or domain name of
-   the cloud-hosted load balancer. For example, on AWS, you may see a domain name
-   resembling the following:
-   
-   ```text
-   00000000000000000000000000000000-0000000000.us-east-2.elb.amazonaws.com
-   ```
-
-1. Set up two DNS records: `teleport.example.com` for all traffic and
-   `*.teleport.example.com` for any web applications you will register with
-   Teleport. We are assuming that your domain name is `example.com` and
-   `teleport` is the subdomain you have assigned to your Teleport cluster.
-
-   Depending on whether the `EXTERNAL-IP` column above points to an IP address or a
-   domain name, the records will have the following details:
-   
-   <Tabs>
-   <TabItem label="IP Address">
-   
-   |Record Type|Domain Name|Value|
-   |---|---|---|
-   |A|`teleport.example.com`|The IP address of your load balancer|
-   |A|`*.teleport.example.com`|The IP address of your load balancer|
-   
-   </TabItem>
-   <TabItem label="Domain Name">
-   
-   |Record Type|Domain Name|Value|
-   |---|---|---|
-   |CNAME|`teleport.example.com`|The domain name of your load balancer|
-   |CNAME|`*.teleport.example.com`|The domain name of your load balancer|
-   
-   </TabItem>
-   </Tabs>
-
-1. Once you create the records, use the following command to confirm that your
-   Teleport cluster is running:
-
-   ```code
-   $ curl https://<Var name="clusterName" />/webapi/ping
-   {"auth":{"type":"local","second_factor":"on","preferred_local_mfa":"webauthn","allow_passwordless":true,"allow_headless":true,"local":{"name":""},"webauthn":{"rp_id":"teleport.example.com"},"private_key_policy":"none","device_trust":{},"has_motd":false},"proxy":{"kube":{"enabled":true,"listen_addr":"0.0.0.0:3026"},"ssh":{"listen_addr":"[::]:3023","tunnel_listen_addr":"0.0.0.0:3024","web_listen_addr":"0.0.0.0:3080","public_addr":"teleport.example.com:443"},"db":{"mysql_listen_addr":"0.0.0.0:3036"},"tls_routing_enabled":false},"server_version":"(=teleport.version=)","min_client_version":"12.0.0","cluster_name":"teleport.example.com","automatic_upgrades":false}
-   ```
+(!docs/pages/includes/self-hosted-helm-dns.mdx!)
 
 ## Step 2/2. Create a local user
 
@@ -371,7 +321,7 @@ cluster.
 - **Set up Single Sign-On:** In this guide, we showed you how to create a local
   user, which is appropriate for demo environments. For a production deployment,
   you should set up Single Sign-On with your provider of choice. See our [Single
-  Sign-On guides](../../access-controls/sso/sso.mdx) for how to do this.
+  Sign-On guides](../../../zero-trust-access/sso/sso.mdx) for how to do this.
 - **Configure your Teleport deployment:** To see all of the options you can set
   in the values file for the `teleport-cluster` Helm chart, consult our
   [reference guide](../../../reference/helm-reference/teleport-cluster.mdx).
diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx
similarity index 95%
rename from docs/pages/admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx
index 0d9a29f102d72..450694d6d0ca5 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx
@@ -1,6 +1,9 @@
 ---
-title: Kubernetes 1.25 and PSP removal
+title: Kubernetes 1.25 Migration
 description: How to prepare for the PodSecurityPolicy removal happening in Kubernetes 1.25
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 PodSecurityPolicies (PSPs) were deprecated in Kubernetes 1.22 and are removed
diff --git a/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/hsm.mdx
similarity index 94%
rename from docs/pages/admin-guides/deploy-a-cluster/hsm.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/hsm.mdx
index bb42e9fa35ebd..0d9c4d807a10e 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/hsm.mdx
@@ -1,15 +1,28 @@
 ---
 title: HSM Support
 description: How to configure Hardware Security Modules to manage your Teleport CA private keys
-h1: Teleport HSM Support
+tags:
+ - how-to
+ - platform-wide
+enterprise: Hardware security module support
 ---
 
 This guide will show you how to set up the Teleport Auth Service to use a
 hardware security module (HSM) to store and handle private keys.
 
+## How it works
+
+The Teleport Auth Service maintains several [certificate
+authorities](../management/security/ca-rotation.mdx) that it
+uses for critical cluster operations, such as issuing certificates to users to
+authenticate to Teleport-protected resources. Each certificate authority uses a
+private key to sign certificates. On self-hosted clusters, you can instruct the
+Teleport Auth Service to sign certificates with private keys that it obtains
+from your HSM. 
+
 ## Prerequisites
 
-- Teleport v(=teleport.version=) Enterprise (self-hosted).
+- Teleport Enterprise (self-hosted).
 - (!docs/pages/includes/tctl.mdx!)
 - An HSM reachable from your Teleport Auth Service.
 - The PKCS#11 module for your HSM.
@@ -214,7 +227,7 @@ to use.
    Created session 0
 
    # Create an Authentication Key for Teleport
-   yubihsm> put authkey 0 0 "Teleport Auth Key" 1 generate-asymmetric-key:sign-pkcs:sign-pss:sign-ecdsa:delete-asymmetric-key sign-pkcs:sign-pss:decrypt-pkcs:decrypt-oaep:sign-ecdsa
+   yubihsm> put authkey 0 0 "Teleport Auth Key" 1 generate-asymmetric-key:sign-pkcs:sign-pss:sign-ecdsa:delete-asymmetric-key:decrypt-oaep sign-pkcs:sign-pss:decrypt-pkcs:decrypt-oaep:sign-ecdsa
    Enter password:
    Stored Authentication key 0x85cf
 
@@ -349,7 +362,7 @@ their Teleport roles will also see a cluster alert reminding them to rotate the
 CAs.
 
 CA rotation can be performed manually or semi-automatically, see our admin guide
-on [Certificate rotation](../management/operations/ca-rotation.mdx).
+on [Certificate rotation](../management/security/ca-rotation.mdx).
 All CAs listed in the output of `tctl status` must be rotated.
 
 ## Step 5/5. Confirm that Teleport is using your HSM
diff --git a/docs/pages/admin-guides/deploy-a-cluster/license.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/license.mdx
similarity index 88%
rename from docs/pages/admin-guides/deploy-a-cluster/license.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/license.mdx
index 2099c729babf1..1bed0f5427bf5 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/license.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/license.mdx
@@ -1,6 +1,10 @@
 ---
 title: Enterprise License File
+sidebar_position: 1
 description: How to manage your Teleport Enterprise license file.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Self-hosted Teleport Enterprise subscriptions require a valid license. In this
@@ -136,7 +140,7 @@ license:
    risk of an Auth Service instance looking up a nonexistent license file:
 
    ```code
-   $ kubectl create secret generic license --from-file license.pem --dry-run=client -o yaml | kubectl replace -n <Var name="teleport-namespace" /> -f -   
+   $ kubectl create secret generic license --from-file license.pem --dry-run=client -o yaml | kubectl replace -n <Var name="teleport-namespace" /> -f -
    ```
 
 ## When your license expires
@@ -187,3 +191,21 @@ following error:
 ```text
 SAML: this feature requires Teleport Enterprise
 ```
+
+## Automatic license updates
+
+By default, self-hosted Teleport Enterprise clusters will periodically check
+whether there have been any changes to their subscription. If a change is
+detected, then the cluster will automatically fetch an updated license without
+user interaction.
+
+In order for this functionality to work:
+
+- the cluster must be running Teleport 16.4.11 or later
+- the cluster must have outbound connectivity to https://api.teleport.sh
+- the customer must have license updates enabled on their account
+
+It can take up to 15 minutes for a change on the backend to be detected by the
+cluster. There is no way to disable this functionality, but the cluster will
+continue to function even if network access to api.teleport.sh is not available
+(so long as the license remains valid).
diff --git a/docs/pages/admin-guides/deploy-a-cluster/aws-kms.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/aws-kms.mdx
similarity index 84%
rename from docs/pages/admin-guides/deploy-a-cluster/aws-kms.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/private-keys/aws-kms.mdx
index 1bafd4b668a95..5036c1e8dd34f 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/aws-kms.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/aws-kms.mdx
@@ -1,7 +1,11 @@
 ---
-title: AWS KMS
+title: Store Teleport Private Keys in AWS KMS
+sidebar_label: AWS
 description: Configure Teleport to store CA private keys in the AWS Key Management Service
-h1: Store Teleport Private Keys in AWS KMS
+tags:
+ - how-to
+ - platform-wide
+ - aws
 ---
 
 This guide will show you how to set up your Teleport cluster to use the AWS Key
@@ -32,7 +36,7 @@ learn more.
 The features documented on this page are available in Teleport `15.0.0` and
 higher.
 
-- Teleport v(=teleport.version=) Enterprise (self-hosted).
+- Teleport Enterprise (self-hosted).
 - (!docs/pages/includes/tctl.mdx!)
 - An AWS account.
 
@@ -58,7 +62,7 @@ Start by creating the following AWS IAM policy in your account.
             "Resource": "*"
         },
         {
-            "Sid": "CreateKeys",
+            "Sid": "CreateSigningKeys",
             "Effect": "Allow",
             "Action": [
                 "kms:CreateKey",
@@ -73,7 +77,22 @@ Start by creating the following AWS IAM policy in your account.
             }
         },
         {
-            "Sid": "UseKeys",
+            "Sid": "CreateEncryptionKeys",
+            "Effect": "Allow",
+            "Action": [
+                "kms:CreateKey",
+                "kms:TagResource"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:RequestTag/TeleportClusterEncryption": "<Var name="teleport.example.com" description="Your Teleport cluster name"/>",
+                    "aws:ResourceTag/TeleportClusterEncryption": "<Var name="teleport.example.com" description="Your Teleport cluster name"/>"
+                }
+            }
+        },
+        {
+            "Sid": "UseSigningKeys",
             "Effect": "Allow",
             "Action": [
                 "kms:GetPublicKey",
@@ -88,6 +107,23 @@ Start by creating the following AWS IAM policy in your account.
                     "aws:ResourceTag/TeleportCluster": "<Var name="teleport.example.com" description="Your Teleport cluster name"/>"
                 }
             }
+        },
+        {
+            "Sid": "UseEncryptionKeys",
+            "Effect": "Allow",
+            "Action": [
+                "kms:GetPublicKey",
+                "kms:ScheduleKeyDeletion",
+                "kms:DescribeKey",
+                "kms:ListResourceTags",
+                "kms:Decrypt"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:ResourceTag/TeleportClusterEncryption": "<Var name="teleport.example.com" description="Your Teleport cluster name"/>"
+                }
+            }
         }
     ]
 }
@@ -214,5 +250,5 @@ their Teleport roles will also see a cluster alert reminding them to rotate the
 CAs.
 
 CA rotation can be performed manually or semi-automatically. See our admin guide
-on [Certificate rotation](../management/operations/ca-rotation.mdx).
+on [Certificate rotation](../../management/security/ca-rotation.mdx).
 All CAs listed in the output of `tctl status` must be rotated.
diff --git a/docs/pages/admin-guides/deploy-a-cluster/gcp-kms.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/gcp-kms.mdx
similarity index 97%
rename from docs/pages/admin-guides/deploy-a-cluster/gcp-kms.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/private-keys/gcp-kms.mdx
index c6f72108f21bd..7d248a39978ef 100644
--- a/docs/pages/admin-guides/deploy-a-cluster/gcp-kms.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/gcp-kms.mdx
@@ -1,7 +1,11 @@
 ---
-title: Google Cloud KMS
+title: Store Teleport Private Keys in Google Cloud KMS
+sidebar_label: Google Cloud
 description: Configure Teleport to store CA private keys in the Google Cloud Key Management Service
-h1: Store Teleport Private Keys in Google Cloud KMS
+tags:
+ - how-to
+ - platform-wide
+ - google-cloud
 ---
 
 This guide will show you how to set up your Teleport Cluster to use the Google
@@ -29,7 +33,7 @@ learn more.
 
 ## Prerequisites
 
-- Teleport v(=teleport.version=) Enterprise (self-hosted).
+- Teleport Enterprise (self-hosted).
 - (!docs/pages/includes/tctl.mdx!)
 - A Google Cloud account.
 
@@ -75,6 +79,7 @@ includedPermissions:
 - cloudkms.cryptoKeyVersions.create
 - cloudkms.cryptoKeyVersions.destroy
 - cloudkms.cryptoKeyVersions.useToSign
+- cloudkms.cryptoKeyVersions.useToDecrypt
 - cloudkms.cryptoKeyVersions.viewPublicKey
 ```
 
@@ -257,5 +262,5 @@ their Teleport roles will also see a cluster alert reminding them to rotate the
 CAs.
 
 CA rotation can be performed manually or semi-automatically, see our admin guide
-on [Certificate rotation](../management/operations/ca-rotation.mdx).
+on [Certificate rotation](../../management/security/ca-rotation.mdx).
 All CAs listed in the output of `tctl status` must be rotated.
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/private-keys.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/private-keys.mdx
new file mode 100644
index 0000000000000..6a1f8882ee3c4
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/private-keys/private-keys.mdx
@@ -0,0 +1,15 @@
+---
+title: Using Teleport with a Key Management Service"
+sidebar_label: External KMS
+description: Provides information on managing Teleport private keys with a third-party service.
+---
+
+You can configure a third-party service to manage the private keys that the
+Teleport Auth Service uses for its internal Certificate Authorities. The Auth
+Service uses CAs are used to sign all certificates issued to clients and hosts
+in the Teleport cluster.
+
+Teleport supports key management services from the following cloud providers:
+
+- [AWS](./aws-kms.mdx)
+- [Google Cloud](./gcp-kms.mdx)
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/proxy-peering.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/proxy-peering.mdx
new file mode 100644
index 0000000000000..e90f09ea91368
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/proxy-peering.mdx
@@ -0,0 +1,90 @@
+---
+title: Proxy Peering Migration
+description: How to upgrade an existing Teleport cluster to Proxy Peering mode.
+tags:
+ - how-to
+ - platform-wide
+---
+
+Proxy Peering enables Teleport Agents to be reachable without connecting to
+every Teleport Proxy Service instance. This allows Proxy Service instances to
+scale horizontally without increasing the number of connections created by
+agents.
+
+By default, Teleport Agents need to create a reverse tunnel to every Proxy
+Service instance to ensure a client is able to reach every agent. With Proxy
+Peering this is no longer a requirement. When Proxy Peering is enabled agents
+will automatically change their behavior to connect to the configured number of
+Proxy Service instances.
+
+This guide shows you how to migrate your Teleport cluster to use Proxy Peering.
+
+## How it works
+
+A gRPC service on each Teleport Proxy Service instance provides an API for
+establishing a bi-directional connection to the agents connected to that
+instance. Proxy Service instances also manage a gRPC client to all other Proxy
+Service instances in the cluster.
+
+Routing information on which Proxy Service instances each agent is connected to
+is stored in Teleport's backend and propagated to each Proxy Service instance.
+
+The routing information and gRPC service allow a Proxy Service instance to
+identify which peer instances an agent is connected to and create an
+end-to-end connection from a client to that agent. This allows for access to the
+agent without connecting to the same Proxy Service instance initially.
+
+Agents check whether you have enabled Proxy Peering before attempting to create
+a reverse tunnel to a Proxy Service instance. By default, in Proxy Peering mode,
+agents are configured to connect to a single Proxy Service instance. For high
+availability a cluster administrator may configure agents to connect to 2 or
+more Proxy Service instances.
+
+![Teleport Proxy Peering](../../../img/architecture/proxy-peering@1.2x.png)
+
+## Prerequisites
+
+1. An existing self-hosted Teleport Enterprise cluster that is **not** using
+   [Trusted
+   Clusters](trustedclusters.mdx). See
+   the documentation on [self-hosting
+   Teleport](deploy-a-cluster.mdx) to get started.
+
+1. A network architecture that meets the following DNS requirements: 
+
+   * Teleport Proxy Service instances must be able to reach each other over the
+     network on port `3021` by default. Ensure there are no firewall policies
+     that would block communication between instances.
+   * All Proxy Service instances must be available at a single domain. If
+     clients in different networks must access the Teleport Proxy Service, the
+     typical pattern is to use split DNS to resolve the same domain differently
+     depending on the network.
+
+## Step 1/3. Enable Proxy Peering
+
+Update your cluster's Auth Service configuration to set the tunnel strategy type
+to `proxy_peering`.
+
+```yaml
+auth_service:
+    tunnel_strategy:
+        type: proxy_peering
+        agent_connection_count: 1
+```
+
+This setting will indicate to agents that they are only required to connect to 1
+Teleport Proxy instance as specified by the `agent_connection_count` field.
+
+For high availability, an `agent_connection_count` greater than 1 can be configured.
+This ensures an agent is still reachable if one of the Proxy Service instances it is connected to is not available.
+
+## Step 2/3. Restart the Auth Service
+
+Restart all Teleport Auth Service instances running in the cluster to apply the
+new Auth Service configuration.
+
+## Step 3/3. Restart the Proxy Services
+
+Restart all Teleport Proxy Service instances running in the cluster in order to
+start the services required for Proxy Peering.
+
diff --git a/docs/pages/zero-trust-access/deploy-a-cluster/self-signed-certs.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/self-signed-certs.mdx
new file mode 100644
index 0000000000000..5857bea60be13
--- /dev/null
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/self-signed-certs.mdx
@@ -0,0 +1,264 @@
+---
+title: Running Teleport with Self-Signed Certificates
+sidebar_label: Self-Signed Certificates
+description: This guide shows you how to run Teleport using self-signed certificates, which is helpful for testing or demo environments.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+This guide explains how to evaluate Teleport in a
+non-production environment without having to configure TLS certificates.
+We will show you how to run Teleport with self-signed certificates and address
+problems caused by this configuration.
+
+The Teleport Proxy Service authenticates itself to clients via TLS x509 certificates.
+If certificates are not configured for the Proxy Service then it uses self-signed certificates,
+which clients will not trust by default.
+When visiting the cluster's Web UI, the certificate presented will not be trusted by your browser. In this case, 
+you will likely see a page warning you that the website is not trusted.
+
+Additionally, self-signed certificates can prevent `teleport`, `tsh`, and `tctl` from connecting
+to the Proxy Service.
+
+<Admonition type="warning" title="DO NOT USE THIS IN PRODUCTION">
+  **DO NOT USE SELF-SIGNED CERTIFICATES IN PRODUCTION**
+
+  Configuring your cluster to trust self-signed certificates
+  makes it easier for attackers to intercept communications
+  between the Proxy Service and clients, since there is no
+  way to verify the authenticity of the certificates.
+  It is therefore important to properly configure certificates
+  when using Teleport in a production environment.
+</Admonition>
+
+## Prerequisites
+
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+- A running Teleport cluster. For details on how to set this up, see our
+  [Getting Started](../../get-started/deploy-community.mdx) guide (skip TLS certificate setup).
+
+- A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
+For example, this Teleport Proxy Service configuration would use self-signed certs:
+
+  ```yaml
+  proxy_service:
+    enabled: true
+    # TLS certificate for the HTTPS connection.
+    https_keypairs: []
+    # Get an automatic certificate from letsencrypt.org using ACME.
+    acme: {}
+  ```
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on how to set this up, see our Enterprise
+  [Getting Started](deploy-a-cluster.mdx) guide.
+
+- A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
+For example, this Teleport Proxy Service configuration would use self-signed certs:
+
+  ```yaml
+  proxy_service:
+    enabled: true
+    # TLS certificate for the HTTPS connection.
+    https_keypairs: []
+    # Get an automatic certificate from letsencrypt.org using ACME.
+    acme: {}
+  ```
+
+</TabItem>
+</Tabs>
+
+- The `tctl` and `tsh` client tools:
+
+  <Tabs>
+    <TabItem label="Mac">
+  
+      Download the signed macOS .pkg installer for Teleport, which includes `tctl`
+      and `tsh`. In Finder double-click the `pkg` file to begin installation:
+  
+      ```code
+      $ curl -O https://cdn.teleport.dev/teleport-(=teleport.version=).pkg
+      ```
+  
+      <Admonition type="danger">
+        Using Homebrew to install Teleport is not supported. The Teleport package in
+        Homebrew is not maintained by Teleport and we can't guarantee its reliability or
+        security.
+      </Admonition>
+  
+    </TabItem>
+  
+    <TabItem label="Windows - Powershell">
+  
+      ```code
+      $ curl.exe -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
+      # Unzip the archive and move tsh.exe and tctl.exe to your %PATH%
+      # NOTE: Do not place tsh.exe and tctl.exe in the System32 directory, as this can cause issues when using WinSCP.
+      # Use %SystemRoot% (C:\Windows) or %USERPROFILE% (C:\Users\<username>) instead.
+      ```
+  
+    </TabItem>
+  
+    <TabItem label="Linux">
+  
+      All of the Teleport binaries in Linux installations include tctl and tsh.  For more
+      options (including RPM/DEB packages and downloads for i386/ARM/ARM64) see
+      the [installation page](../../installation/installation.mdx).
+  
+      ```code
+      $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
+      $ tar -xzf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
+      $ cd teleport
+      $ sudo ./install
+      # Teleport binaries have been copied to /usr/local/bin
+      ```
+    </TabItem>
+  </Tabs>
+  
+  Make sure `tctl` and `tsh` are at most one major version behind your Teleport
+  cluster version. Send a GET request to the Proxy Service at `/v1/webapi/ping`
+  and use a JSON query tool to obtain your cluster version:
+  
+  ```code
+  $ curl https://example.teleport.sh/v1/webapi/ping | jq -r '.server_version'
+  (=teleport.version=)
+  ```
+
+## How to use self-signed certs with Teleport binaries and clients
+
+### `teleport`
+
+When running a Teleport service with `teleport`, if the service you are starting is configured to point to
+the Teleport Proxy Service endpoint and the Proxy Service is using self-signed certificates, then `teleport` will need
+to be run with the `--insecure` flag to disable verification of the
+Proxy Service TLS certificate. This is the case when:
+- The Teleport config file `proxy_server` setting is set to the Proxy Service endpoint:
+  - `proxy_server: "tele.example.com:443"` or
+  - `proxy_server: "tele.example.com:3080"`
+- Teleport is started with the `--auth-server` flag pointing to the Proxy Service endpoint:
+  - `teleport [app | db] start --auth-server=tele.example.com:443` or
+  - `teleport [app | db] start --auth-server=tele.example.com:3080`
+
+Instructions for disabling TLS certificate verification depend on how you are
+running Teleport: via the `teleport` CLI, using a Helm chart, or via systemd:
+<Tabs>
+
+    <TabItem label="Using the CLI">
+    When running `teleport` from the command line, pass the `--insecure` flag to disable
+    TLS certificate validation. For example:
+    ```sh
+    $ sudo teleport start -c /etc/teleport.yaml --insecure
+    $ sudo teleport app start -c /etc/teleport.yaml --insecure
+    $ sudo teleport db start -c /etc/teleport.yaml --insecure
+    ```
+    Without the `--insecure` flag, you will see an error message that looks like
+    `x509: “tele.example.com” certificate is not trusted`.
+    </TabItem>
+
+    <TabItem label="Helm chart">
+    If you are using the `teleport-cluster` Helm chart, set
+    [extraArgs](../../reference/helm-reference/teleport-cluster.mdx)
+    to include the extra argument: `--insecure`.
+
+    Here is an example of the field within a values file:
+
+    ```yaml
+    extraArgs:
+    - "--insecure"
+    ```
+
+    When using the `--set` flag, use the following syntax:
+
+
+      ```text
+      --set "extraArgs={--insecure}"
+      ```
+    
+    If you are using the `teleport-kube-agent` chart, set the 
+    [insecureSkipProxyTLSVerify](../../reference/helm-reference/teleport-kube-agent.mdx)
+    flag to `true`.
+
+    In a values file, this would appear as follows:
+
+    ```yaml
+    insecureSkipProxyTLSVerify: true
+    ```
+
+    When using the `--set` flag, use the following syntax:
+
+    ```text
+    --set insecureSkipProxyTLSVerify=true
+    ```
+    </TabItem>
+
+    <TabItem label="systemd">
+    Locate the `systemd` unit file for Teleport (called teleport.service) by running the following command:
+    ```sh
+    $ systemctl status teleport
+    ```
+    You will see output similar to the following, including the file path (`/lib/systemd/system/teleport.service`) that contains the unit file for the systemd configuration being applied:
+
+    ```code
+    ● teleport.service - Teleport Service
+        Loaded: loaded (/lib/systemd/system/teleport.service; disabled; vendor preset: enabled)
+        Active: inactive (dead)
+    ```
+
+    Edit the Teleport unit file to include `--insecure` in the `ExecStart` line, for example:
+    ```text
+    ExecStart=/usr/local/bin/teleport start --pid-file=/run/teleport.pid --insecure
+    ```
+    
+    After saving the unit file, you will need to reload the daemon for your changes to take effect:
+    ```sh
+    $ sudo systemctl daemon-reload
+    $ sudo systemctl restart teleport.service
+    ```
+    </TabItem>
+
+</Tabs>
+
+### `tctl`
+When running `tctl` remotely via the Teleport Proxy Service, if the Proxy Service is using self-signed 
+certificates, then `tctl` will not trust the certificate from the Proxy Service.
+To disable certificate verification use the `--insecure` flag when running `tctl` commands.
+
+`tctl` will determine how to connect to the Auth Service in a few ways:
+- loading configuration from a local profile after logging in with `tsh`
+- loading from a config file passed as an argument: `tctl -c /etc/teleport.yaml`
+- passing the `--auth-server` flag directly, as in:
+  - `tctl --auth-server=tele.example.com:443` or
+  - `tctl --auth-server=tele.example.com:3080`
+
+If any of these methods tries to connect via the Teleport Proxy Service, and the Proxy Service is using 
+self-signed certificates, then `tctl` will not trust the certificate from the Proxy Service and you will get an
+error message about
+untrusted or invalid certificates, unless `--insecure` is also passed to `tctl`.
+
+For example: `tctl status --insecure`
+
+### `tsh`
+When running `tsh`, you must specify the Teleport Proxy Service address for `tsh` to connect to.
+If the Teleport Proxy Service is using self-signed certificates, then `tsh` will not trust the Proxy Service 
+certificate.
+In order to use `tsh` in this case, you need to use the `--insecure` flag.
+
+For example: `tsh login --proxy=tele.example.com:443 --user=alice --insecure`
+
+### Teleport Connect
+
+Teleport Connect lets you [skip TLS certificate verification with the `--insecure`
+flag](../../connect-your-client/teleport-clients/teleport-connect.mdx).
+
+## Further reading
+
+- [Configuring Teleport TLS Certs](../../get-started/deploy-community.mdx)
+- [Run Teleport as a systemd Daemon](../management/daemon.mdx)
+- [Teleport Proxy Service](../../reference/architecture/proxy.mdx)
+- [Teleport Authentication](../../reference/architecture/authentication.mdx)
diff --git a/docs/pages/admin-guides/management/operations/tls-routing.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/tls-routing.mdx
similarity index 91%
rename from docs/pages/admin-guides/management/operations/tls-routing.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/tls-routing.mdx
index f9e0ca94debd3..5e2b97f04f9b7 100644
--- a/docs/pages/admin-guides/management/operations/tls-routing.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/tls-routing.mdx
@@ -1,8 +1,13 @@
 ---
 title: TLS Routing Migration
 description: How to upgrade an existing Teleport cluster to single-port TLS routing mode
+tags:
+ - how-to
+ - platform-wide
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 In TLS routing mode, all Teleport client connections are wrapped in TLS and
 multiplexed on one Teleport Proxy Service port.
 
@@ -27,9 +32,6 @@ Cloud.
 
 ## Prerequisites
 
-Support for TLS routing behind layer 7 (HTTP/HTTPS) load balancers and reverse
-proxies is available starting from Teleport `13.0`.
-
 If you use Teleport Cloud, see which ports and networking settings the Proxy
 Service is configured to use in your Teleport Cloud tenant. Run the following
 command, replacing `mytenant.teleport.sh` with your tenant address:
@@ -42,7 +44,7 @@ $ curl https://mytenant.teleport.sh/webapi/ping | jq '.proxy'
 
 Download Teleport from the [downloads page](https://goteleport.com/download) or
 your enterprise portal and follow the standard [upgrade
-procedure](../../../upgrading/upgrading.mdx). Make sure to upgrade both root and leaf clusters
+procedure](../../upgrading/upgrading.mdx). Make sure to upgrade both root and leaf clusters
 as well as `tsh` client.
 
 ## Step 2/7. Enable proxy multiplexing
@@ -106,7 +108,7 @@ to connect to nodes within your Teleport cluster, you need to regenerate the
 config.
 
 Run `tsh config` command again so it generates SSH config compatible with SSH
-routing setup. See our [OpenSSH guide](../../../enroll-resources/server-access/openssh/openssh-agentless.mdx)
+routing setup. See our [OpenSSH guide](../../enroll-resources/server-access/openssh/openssh-agentless.mdx)
 docs for reference.
 
 ## Step 7/7. Disable legacy listeners
@@ -144,4 +146,4 @@ To go back to the legacy separate listeners mode, perform the following steps:
 
 ## Next steps
 
-- Learn how TLS routing [works](../../../reference/architecture/tls-routing.mdx).
+- Learn how TLS routing [works](../../reference/architecture/tls-routing.mdx).
diff --git a/docs/pages/admin-guides/management/admin/trustedclusters.mdx b/docs/pages/zero-trust-access/deploy-a-cluster/trustedclusters.mdx
similarity index 87%
rename from docs/pages/admin-guides/management/admin/trustedclusters.mdx
rename to docs/pages/zero-trust-access/deploy-a-cluster/trustedclusters.mdx
index c6b6ad41fdb27..69075f8e12690 100644
--- a/docs/pages/admin-guides/management/admin/trustedclusters.mdx
+++ b/docs/pages/zero-trust-access/deploy-a-cluster/trustedclusters.mdx
@@ -1,25 +1,30 @@
 ---
 title: Configure Trusted Clusters
+sidebar_label: Trusted Clusters
 description: Explains how you can configure a trust relationship and manage access between two Teleport clusters.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 <Admonition type="note">
 Trusted clusters are only available for self-hosted Teleport clusters.
 </Admonition>
 
-As you learned in [Core Concepts](../../../core-concepts.mdx), a Teleport cluster
-consists of the Teleport Auth Service, the Teleport Proxy Service, and the 
+As you learned in [Core Concepts](../../core-concepts.mdx), a Teleport cluster
+consists of the Teleport Auth Service, the Teleport Proxy Service, and the
 Teleport services that manage access to resources in your infrastructure.
-With Teleport, you can also partition your infrastructure into multiple connected 
-clusters to allow the users of one cluster—the **root cluster**—to connect to resources 
-in another cluster—the **leaf cluster**—while authenticated using a single 
-Teleport Auth Service. 
+With Teleport, you can also partition your infrastructure into multiple connected
+clusters to allow the users of one cluster—the **root cluster**—to connect to resources
+in another cluster—the **leaf cluster**—while authenticated using a single
+Teleport Auth Service.
 
 After you establish a trust relationship between the root and leaf clusters, the leaf cluster can
-run behind a firewall without any inbound ports open. The leaf cluster creates an outbound reverse 
+run behind a firewall without any inbound ports open. The leaf cluster creates an outbound reverse
 SSH tunnel to the root cluster and keeps the tunnel open.
-When a user tries to connect to any resource in the leaf cluster, the Teleport Auth Service on the 
-leaf cluster connects to the root cluster through the reverse tunnel using the Teleport Proxy Service 
+When a user tries to connect to any resource in the leaf cluster, the Teleport Auth Service on the
+leaf cluster connects to the root cluster through the reverse tunnel using the Teleport Proxy Service
 instance running on the root cluster.
 
 <Admonition type="warning">
@@ -27,25 +32,25 @@ instance running on the root cluster.
    can ask the leaf Proxy Service to establish network connections to arbitrary addresses. This is
    how root clusters access resources on leaf clusters. A compromised root Proxy Service can ask
    leaf Proxy Services to connect to sensitive or unauthorized resources, so be sure to use a
-   firewall to ensure leaf Proxy services are only allowed to connect to the appropriate resources.  
+   firewall to ensure leaf Proxy services are only allowed to connect to the appropriate resources.
 </Admonition>
 
 ## How it works
 
-In the following example, a managed service provider uses three independent clusters to 
+In the following example, a managed service provider uses three independent clusters to
 provide access to clients in different regions:
 
-- Cluster `msp-root.example.com` is the root cluster. This cluster might have its own resources or be 
+- Cluster `msp-root.example.com` is the root cluster. This cluster might have its own resources or be
 strictly used for collecting audit logs and authenticating users.
-- Clusters `leaf-east.example.com` and `leaf-west.example.com` are two independent leaf clusters to service 
+- Clusters `leaf-east.example.com` and `leaf-west.example.com` are two independent leaf clusters to service
 clients in different regions.
 - Each cluster is an independent x.509 and SSH certificate authority and can operate autonomously.
-- Each leaf cluster dials back to the root cluster to establish a reverse tunnel. If you have multiple 
+- Each leaf cluster dials back to the root cluster to establish a reverse tunnel. If you have multiple
 Proxy Service instances, you have multiple tunnels for high availability.
 
 The following diagram provides a simplified view of the architecture:
 
-![Trusted cluster](../../../../img/trusted-clusters/simplified-trusted-cluster.png)
+![Trusted cluster](../../../img/trusted-clusters/simplified-trusted-cluster.png)
 
 As this diagram suggests, users can sign in to the root cluster to receive certificates signed by the root
 cluster certificate authority. They can then connect to leaf clusters either directly
@@ -58,16 +63,16 @@ checking the certificate for the following information:
 
 - The list of **principals** that the user is authorized to use. Principals are equivalent to
   the local logins that have been added to a Teleport user profile.
-- The signature of the **certificate authority** that issued the certificate. In a trusted cluster environment, 
+- The signature of the **certificate authority** that issued the certificate. In a trusted cluster environment,
   the Teleport Auth Service on the root cluster signs the certificate.
-- The **metadata certificate extensions** that are provided by the Teleport Auth Service. Teleport uses 
+- The **metadata certificate extensions** that are provided by the Teleport Auth Service. Teleport uses
   the metadata to store the list of user roles and SSH options like `permit-agent-forwarding`.
 - The expiration date, or **time-to-live** (TTL) to ensure the certificate is still valid.
 
 Based on the information in the certificate, the Teleport Auth Service performs the following actions:
 
 - Verifies that the certificate signature matches one of its trusted root clusters.
-- Applies role mapping to associate a role on the leaf cluster with one of the roles assigned 
+- Applies role mapping to associate a role on the leaf cluster with one of the roles assigned
   to the user in the root cluster.
 - Checks if the local role allows the requested identity—the Unix login—to have access.
 - Verifies that the certificate has not expired. The TTL is set by the root cluster.
@@ -75,20 +80,20 @@ Based on the information in the certificate, the Teleport Auth Service performs
 The following diagram provides a simplified view of the interaction between the services running
 on the leaf cluster and service running on the root cluster:
 
-![Service interaction in a trusted cluster](../../../../img/trusted-clusters/trusted-cluster-service-interaction.png)
+![Service interaction in a trusted cluster](../../../img/trusted-clusters/trusted-cluster-service-interaction.png)
 
-Note that trusted clusters only work in one direction. 
+Note that trusted clusters only work in one direction.
 Users from the leaf cluster can't see or connect to resources in the root cluster.
 
 ## Who uses trusted clusters?
 
-Most organizations don't need to configure trusted clusters. In most cases, you can add 
-multiple Teleport Proxy Service instances to enroll and manage thousands of resources 
+Most organizations don't need to configure trusted clusters. In most cases, you can add
+multiple Teleport Proxy Service instances to enroll and manage thousands of resources
 without creating a new cluster.
 
 However, there are a few specific scenarios where trusted clusters can be particularly useful.
 For example, if you have a large and widely-distributed infrastructure or must provide access
-to resources for external agencies, contractors, or clients, you might benefit from setting up 
+to resources for external agencies, contractors, or clients, you might benefit from setting up
 a trusted cluster. The most common use cases for trusted clusters include:
 
 - Managed service providers (MSP) remotely managing the infrastructure of their clients.
@@ -97,23 +102,23 @@ a trusted cluster. The most common use cases for trusted clusters include:
 
 ## Role relationships in a trusted cluster
 
-Leaf clusters are autonomous in that they have their own state, roles, and local users. This autonomy 
-enables leaf cluster administrators to decide how to map the identity of the external users to their 
-local cluster roles. 
+Leaf clusters are autonomous in that they have their own state, roles, and local users. This autonomy
+enables leaf cluster administrators to decide how to map the identity of the external users to their
+local cluster roles.
 The following diagram provides a simplified view of how role mapping works using the same trusted
 cluster with `msp-root.example.com` as the root cluster and `leaf-east.example.com` as the leaf cluster:
 
-![Role mapping in a trusted cluster](../../../../img/trusted-clusters/simplified-trusted-cluster-role-mapping.png)
+![Role mapping in a trusted cluster](../../../img/trusted-clusters/simplified-trusted-cluster-role-mapping.png)
 
 In this example, the user Alice signs in to the `msp-root.example.com` root cluster. The root cluster is
 configured with a single sign-on identity provider that authenticates her identity and her group membership.
 Based on the information from the identity provider, the root cluster assigns Alice the `full-access` role
 and issues her a certificate. The mapping of single sign-on properties to Teleport roles is configured when
 you add an authentication connector to the Teleport cluster. To learn more about configuring single sign-on
-through an external identity provider, see [Configure Single Sign-on](../../access-controls/sso/sso.mdx).
+through an external identity provider, see [Configure Single Sign-on](../sso/sso.mdx).
 
 Alice receives the certificate that specifies the roles assigned to her in the root cluster. This metadata
-about her roles is contained in the certificate extensions and is protected by the signature of the root 
+about her roles is contained in the certificate extensions and is protected by the signature of the root
 cluster certificate authority so it can't be tampered with.
 
 When Alice connects to a resource in the leaf cluster `leaf-east.example.com`, she's identified as an external user
@@ -131,7 +136,7 @@ With role mapping, leaf cluster administrators can control the privileges extern
 Although role mapping can be as simple as assigning users to the same roles in the root and leaf clusters,
 you can also use mapping to downgrade a user's privileges or restrict access to specific resources.
 
-Now that you know what a trusted cluster is and how it works, you can use this guide 
+Now that you know what a trusted cluster is and how it works, you can use this guide
 to learn how to:
 
 - Identify root and leaf clusters.
@@ -144,28 +149,30 @@ to learn how to:
 
 To complete the steps in this guide, verify your environment meets the following requirements:
 
+- [Proxy peering](proxy-peering.mdx) must be disabled. Proxy Peering and Trusted Clusters are not compatible.
+
 - Access to **two** Teleport cluster instances.
 
-  The two clusters should be at the same version or, at most, the leaf cluster can be one major version 
+  The two clusters should be at the same version or, at most, the leaf cluster can be one major version
   behind the root cluster version.
 
-- The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=).
-  
+- The `tctl` admin tool and `tsh` client tool.
+
   You can verify the tools you have installed by running the following commands:
 
   ```code
   $ tctl version
   # Teleport v(=teleport.version=) go(=teleport.golang=)
-  
+
   $ tsh version
   # Teleport v(=teleport.version=) go(=teleport.golang=)
   ```
 
-  For more information about installing Teleport, see [Installation](../../../installation.mdx).
+  For more information about installing Teleport, see [Installation](../../installation/installation.mdx).
 
 - A Teleport SSH server that is joined to the cluster you plan to use as the **leaf cluster**.
-  For information about how to enroll a resource in your cluster, see 
-  [Join Services to your Cluster](../../../enroll-resources/agents/agents.mdx).
+  For information about how to enroll a resource in your cluster, see
+  [Join Services to your Cluster](../../enroll-resources/agents/agents.mdx).
 
 (!docs/pages/includes/permission-warning.mdx!)
 
@@ -174,37 +181,37 @@ To complete the steps in this guide, verify your environment meets the following
 This guide demonstrates how to enable users of your root cluster to access
 a server in your leaf cluster with a specific user identity and role.
 For this example, the user identity you can use to access the server in the leaf
-cluster is `visitor`. Therefore, to prepare your environment, you first need to 
-create the `visitor` user and a Teleport role that can assume this username when 
+cluster is `visitor`. Therefore, to prepare your environment, you first need to
+create the `visitor` user and a Teleport role that can assume this username when
 logging in to the server in the leaf cluster.
 
 To add a user and role for accessing the trusted cluster:
 
 1. Open a terminal shell on the server running the Teleport Agent in the leaf cluster.
 
-1. Add the local `visitor` user and create a home directory for the user by running the 
+1. Add the local `visitor` user and create a home directory for the user by running the
 following command:
-   
+
    ```code
    $ sudo useradd --create-home visitor
    ```
-   
+
    The home directory is required for the `visitor` user to access a shell on the server.
 
 1. Sign out of all user logins and clusters by running the following command:
-   
+
    ```code
    $ tsh logout
    ```
 
-1. Sign in to your **leaf cluster** from your administrative workstation using 
+1. Sign in to your **leaf cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="leafcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and 
+   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and
    `myuser` with your Teleport username.
 
 1. Create a role definition file called `visitor.yaml` with the following content:
@@ -222,20 +229,20 @@ your Teleport username:
          '*': '*'
    ```
 
-   You must explicitly allow access to nodes with labels to SSH into the server running 
+   You must explicitly allow access to nodes with labels to SSH into the server running
    the Teleport Agent. In this example, the `visitor` login is allowed access to any server.
 
 1. Create the `visitor` role by running the following command:
-   
+
    ```code
    $ tctl create visitor.yaml
    ```
-   
+
    (!docs/pages/includes/create-role-using-web.mdx!)
 
-   You now have a `visitor` role on your leaf cluster. The `visitor` role allows 
-   users with the `visitor` login to access nodes in the leaf cluster. In the next step, 
-   you must add the `visitor` login to your user so you can satisfy the conditions of 
+   You now have a `visitor` role on your leaf cluster. The `visitor` role allows
+   users with the `visitor` login to access nodes in the leaf cluster. In the next step,
+   you must add the `visitor` login to your user so you can satisfy the conditions of
    the role and access the server in the leaf cluster.
 
 ## Step 2/6. Prepare the root cluster environment
@@ -248,19 +255,19 @@ root cluster.
 To add the login to your Teleport user:
 
 1. Sign out of all user logins and clusters by running the following command:
-   
+
    ```code
    $ tsh logout
    ```
 
-1. Sign in to your **root cluster** from your administrative workstation using 
+1. Sign in to your **root cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="rootcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `rootcluster.example.com` with the Teleport root cluster domain and 
+   Replace `rootcluster.example.com` with the Teleport root cluster domain and
    `myuser` with your Teleport username.
 
 1. Open your user resource in your editor by running a command similar to the
@@ -273,7 +280,7 @@ your Teleport username:
    Replace `myuser` with your Teleport username.
 
 1. Add the `visitor` login:
-   
+
    ```diff
       traits:
         logins:
@@ -287,44 +294,44 @@ your Teleport username:
 ## Step 3/6. Establish trust between clusters
 
 Before users from the root cluster can access the server in the
-leaf cluster using the `visitor` role, you must define a trust relationship 
-between the clusters. Teleport establishes trust between the root cluster and a 
+leaf cluster using the `visitor` role, you must define a trust relationship
+between the clusters. Teleport establishes trust between the root cluster and a
 leaf cluster using an **invitation token**.
 
 To set up trust between clusters, you must first create the invitation token using the
-Teleport Auth Service in the root cluster. You can then use the Teleport Auth Service 
-on the leaf cluster to create a `trusted_cluster` resource that includes the invitation token, 
+Teleport Auth Service in the root cluster. You can then use the Teleport Auth Service
+on the leaf cluster to create a `trusted_cluster` resource that includes the invitation token,
 proving to the root cluster that the leaf cluster is the one you expect to register.
 
 To establish the trust relationship:
 
 1. Sign out of all user logins and clusters by running the following command:
-   
+
    ```code
    $ tsh logout
    ```
 
-1. Sign in to your **root cluster** from your administrative workstation using 
+1. Sign in to your **root cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="rootcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `rootcluster.example.com` with the Teleport root cluster domain and 
+   Replace `rootcluster.example.com` with the Teleport root cluster domain and
    `myuser` with your Teleport username.
 
 1. Generate the invitation token by running the following command:
-   
+
    ```code
    $ tctl tokens add --type=trusted_cluster --ttl=5m
    The cluster invite token: (=presets.tokens.first=)
    ```
 
-   This command generates a trusted cluster invitation token to allow an inbound 
+   This command generates a trusted cluster invitation token to allow an inbound
    connection from a leaf cluster. The token can be used multiple times. In this
    command example, the token has an expiration time of five minutes.
-   
+
    Note that the invitation token is only used to establish a
    connection for the first time. Clusters exchange certificates and
    don't use tokens to re-establish their connection afterward.
@@ -362,47 +369,47 @@ following content:
    - Set `metadata.name` to the name of your root cluster.
    - Set `spec.token` to the invitation token you generated previously.
    - Set `spec.tunnel_addr` to the reverse tunnel address of the Teleport Proxy Service in the root cluster.
-   - Set `spec.web_proxy_addr` to the address of the Teleport Proxy Service on the root cluster. 
+   - Set `spec.web_proxy_addr` to the address of the Teleport Proxy Service on the root cluster.
    - Set `spec.role_map` to map Teleport roles from the root cluster to roles in the leaf cluster.
-   
+
    **Look up cluster addresses**
 
-   If you aren't sure of what values to use for cluster settings such as the `tunnel_addr` or `web_proxy_addr`, 
-   you can often look up the information using command-line tools that parse and extract machine-readable data 
-   from JSON files. One of the most common of these tools is `jq`. You can download `jq` for most operating 
+   If you aren't sure of what values to use for cluster settings such as the `tunnel_addr` or `web_proxy_addr`,
+   you can often look up the information using command-line tools that parse and extract machine-readable data
+   from JSON files. One of the most common of these tools is `jq`. You can download `jq` for most operating
    systems from the [jqlang](https://jqlang.github.io/jq/download/) website.
-   
+
    To get cluster addresses using `jq`:
-   
-   1. Set the `PROXY` environment variable to retrieve information about your Teleport cluster 
+
+   1. Set the `PROXY` environment variable to retrieve information about your Teleport cluster
       by replacing `teleport.example.com` with your Teleport cluster domain:
-      
+
       ```code
       $ PROXY=teleport.example.com
       ```
-   
+
    1. Extract the `tunnel_addr` for your cluster by running the following command:
-   
+
       ```code
-      $ curl https://$PROXY/webapi/ping | jq 'if .proxy.tls_routing_enabled == true then .proxy.ssh.public_addr else .proxy.ssh.ssh_tunnel_public_addr end'      
+      $ curl https://$PROXY/webapi/ping | jq 'if .proxy.tls_routing_enabled == true then .proxy.ssh.public_addr else .proxy.ssh.ssh_tunnel_public_addr end'
       ```
 
    1. Extract the `web_proxy_addr` for your cluster by running the following command:
-      
+
       ```code
       $ curl https://$PROXY/webapi/ping | jq .proxy.ssh.public_addr
       ```
-   
+
    **Map root cluster roles to leaf cluster roles**
 
-   You use the `role_map` setting in the `trusted_cluster` resource configuration to define how 
-   roles from the root cluster map to roles on the leaf cluster. In this example, users assigned 
-   the `access` role for the root cluster are granted the `visitor` role when they attempt to log 
+   You use the `role_map` setting in the `trusted_cluster` resource configuration to define how
+   roles from the root cluster map to roles on the leaf cluster. In this example, users assigned
+   the `access` role for the root cluster are granted the `visitor` role when they attempt to log
    in to a server in the leaf cluster. This role mapping enables you to restrict access to resources
    in the leaf cluster.
-   
-   If your Teleport user is assigned the `access` role on the root cluster, you can use this role 
-   mapping to test access to the server in the leaf cluster. If your Teleport user isn't assigned 
+
+   If your Teleport user is assigned the `access` role on the root cluster, you can use this role
+   mapping to test access to the server in the leaf cluster. If your Teleport user isn't assigned
    the `access` role, change `access` in the `role_map` to one of your user's roles.
 
    Role mapping can be quite powerful for managing access in trusted clusters. For more information
@@ -410,7 +417,7 @@ following content:
    syntax, see [Role mapping syntax and expressions](#role-mapping-syntax-and-expressions).
 
 1. Sign out of the root cluster by running the following command:
-   
+
    ```code
    $ tsh logout
    ```
@@ -421,17 +428,17 @@ You're now ready to create the trusted cluster resource in the leaf cluster.
 
 To create the trusted cluster resource:
 
-1. Sign in to your **leaf cluster** from your administrative workstation using 
+1. Sign in to your **leaf cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="leafcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and 
+   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and
    `myuser` with your Teleport username.
 
-1. Create the trusted cluster resource from the resource configuration file by running 
+1. Create the trusted cluster resource from the resource configuration file by running
 the following command:
 
    ```code
@@ -442,42 +449,42 @@ the following command:
    For example, you can select **Zero Trust Access** in the left pane, then click **Manage Clusters** to create a
    new `trusted_cluster` resource or manage an existing trusted cluster.
 
-1. Sign out of the leaf cluster and sign back in to the root cluster. 
+1. Sign out of the leaf cluster and sign back in to the root cluster.
 
 1. Verify the trusted cluster configuration by running the following command:
-   
+
    ```code
    $ tsh clusters
    ```
-   
-   This command should list the root cluster and the leaf cluster with output 
+
+   This command should list the root cluster and the leaf cluster with output
    similar to the following:
-   
+
    ```
-   Cluster Name                Status Cluster Type Labels Selected 
-   --------------------------- ------ ------------ ------ -------- 
-   rootcluster.example.com     online root                *        
-   leafcluster.example.com     online leaf                         
+   Cluster Name                Status Cluster Type Labels Selected
+   --------------------------- ------ ------------ ------ --------
+   rootcluster.example.com     online root                *
+   leafcluster.example.com     online leaf
    ```
 
 ## Step 5/6. Manage access to the trusted cluster
 
-When you created a `trusted_cluster` resource on the leaf cluster, the 
-Teleport Auth Service on the leaf cluster sends a request to the Teleport 
-Proxy Service on the root cluster to validate the trusted cluster. 
-After validating the request, the root cluster creates a `remote_cluster` 
+When you created a `trusted_cluster` resource on the leaf cluster, the
+Teleport Auth Service on the leaf cluster sends a request to the Teleport
+Proxy Service on the root cluster to validate the trusted cluster.
+After validating the request, the root cluster creates a `remote_cluster`
 resource to represent the trusted leaf cluster.
 
 You can add labels to the `remote_cluster` resource on the root cluster to
 manage access to the leaf cluster. You can't manage labels on the leaf clusters
-themselves. Leaf clusters propagating their own labels could create problems with 
+themselves. Leaf clusters propagating their own labels could create problems with
 rogue clusters updating their labels to unexpected values.
 
 To manage access to the leaf cluster:
 
 1. Verify that you are signed in as a Teleport user on the root cluster by
 running the following command:
-   
+
    ```code
    tsh status
    ```
@@ -506,13 +513,13 @@ running the following command:
    ```code
    $ tctl update rc/leafcluster.example.com --set-labels=env=demo
    ```
-   
-   After you run this command, you must be given explicit permission to access 
-   clusters with the label you just set. If a trusted cluster has a label, the 
+
+   After you run this command, you must be given explicit permission to access
+   clusters with the label you just set. If a trusted cluster has a label, the
    Teleport Auth Service won't return any information about the cluster unless you
    are assigned a role that allows access to clusters with the label that's been set.
 
-1. Create a role configuration file called `demo-cluster-access.yaml` that 
+1. Create a role configuration file called `demo-cluster-access.yaml` that
 allows access to clusters with the `env: demo` label:
 
    ```yaml
@@ -534,7 +541,7 @@ allows access to clusters with the `env: demo` label:
 
 1. (!docs/pages/includes/add-role-to-user.mdx role="demo-cluster-access"!)
 
-1. Confirm that the leaf cluster has been updated with the label you set by 
+1. Confirm that the leaf cluster has been updated with the label you set by
 running the following command:
 
    ```code
@@ -566,15 +573,15 @@ To test access to the server:
 
 1. Verify that you are signed in as a Teleport user on the root cluster by
 running the following command:
-   
+
    ```code
    tsh status
    ```
-   
 
-1. Confirm that the server running the Teleport Agent is joined to the leaf cluster by 
+
+1. Confirm that the server running the Teleport Agent is joined to the leaf cluster by
 running a command similar to the following:
-   
+
    ```code
    $ tsh ls --cluster=<Var name="leafcluster.example.com" />
    ```
@@ -584,7 +591,7 @@ running a command similar to the following:
    ```
    Node Name       Address        Labels
    --------------- -------------- ------------------------------------
-   ip-172-3-1-242  127.0.0.1:3022 hostname=ip-172-3-1-242                                                                    
+   ip-172-3-1-242  127.0.0.1:3022 hostname=ip-172-3-1-242
    ip-172-3-2-205  ⟵ Tunnel      hostname=ip-172-3-2-205
    ```
 
@@ -596,7 +603,7 @@ running a command similar to the following:
 
 1. Confirm you are logged in with as the user `visitor` on the server
 in the leaf cluster by running the following commands:
-   
+
    ```code
    $ pwd
    /home/visitor
@@ -607,9 +614,9 @@ in the leaf cluster by running the following commands:
 ## Role mapping syntax and expressions
 
 In this guide, you saw a simple example of role mapping.
-However, you can define more sophisticated role mapping for trusted clusters using wildcards, regular expressions, 
+However, you can define more sophisticated role mapping for trusted clusters using wildcards, regular expressions,
 role template variables, shared user traits, and labels.
-The next sections provide additional details about role mapping in trusted clusters and provide examples 
+The next sections provide additional details about role mapping in trusted clusters and provide examples
 for using more complex role mapping syntax.
 
 ### Wildcard characters
@@ -636,7 +643,7 @@ role_map:
 ### Regular expressions
 
 You can also use regular expressions to map user roles from one cluster to
-another. The regular expression syntax enables you to use part of a remote 
+another. The regular expression syntax enables you to use part of a remote
 role name that matches a regular expression in the corresponding local role.
 In the following example, remote users with a remote role called `remote-one` are
 mapped to a local role called `local-one`, `remote-two` becomes `local-two`, and so on:
@@ -664,7 +671,7 @@ db_users: ["postgres"]
 db_names: ["dev", "metrics"]
 ```
 
-When setting up the trusted cluster relationship, the leaf cluster can choose 
+When setting up the trusted cluster relationship, the leaf cluster can choose
 to map this `root` cluster role to its own `admin` role:
 
 ```yaml
@@ -696,13 +703,13 @@ node_labels:
 
 For full details on how variable expansion works in Teleport roles, see the
 [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
+Reference](../../reference/access-controls/roles.mdx).
 
 ### Update role mappings
 
-You can update role mappings for a trusted cluster resource by modifying the `role_map` 
-field in the `trusted_cluster.yaml` resource configuration file. After you update the 
-resource configuration file, you can update the trusted cluster by signing in to the 
+You can update role mappings for a trusted cluster resource by modifying the `role_map`
+field in the `trusted_cluster.yaml` resource configuration file. After you update the
+resource configuration file, you can update the trusted cluster by signing in to the
 leaf cluster and running the following command:
 
 ```code
@@ -712,13 +719,13 @@ $ tctl create --force trusted_cluster.yaml
 ### Role mapping and cluster-level labels
 
 In this guide, you learned how you can combine role mapping and labels to manage access to leaf cluster resources.
-You should note that you can use a certificate issued for a root cluster to connect directly 
-to a leaf cluster because the leaf cluster inherently trusts the root cluster. In most cases, 
-the trust relationship between the root and leaf clusters provides the desired behavior. 
+You should note that you can use a certificate issued for a root cluster to connect directly
+to a leaf cluster because the leaf cluster inherently trusts the root cluster. In most cases,
+the trust relationship between the root and leaf clusters provides the desired behavior.
 
-However, this trust relationship can also be exploited if you use cluster labels to enforce authorization 
-restrictions. Because the leaf cluster trusts the certificate authority of the root cluster, that certificate 
-can be used to bypass any leaf-specific `cluster_labels` settings that might be intended to restrict access to 
+However, this trust relationship can also be exploited if you use cluster labels to enforce authorization
+restrictions. Because the leaf cluster trusts the certificate authority of the root cluster, that certificate
+can be used to bypass any leaf-specific `cluster_labels` settings that might be intended to restrict access to
 the leaf cluster. For example, assume you assign the leaf cluster a label using the following command:
 
 ```text
@@ -736,14 +743,14 @@ cluster and editing the `trusted_cluster` resource configuration files that you
 
 To temporarily disable trust:
 
-1. Sign in to your **leaf cluster** from your administrative workstation using 
+1. Sign in to your **leaf cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="leafcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and 
+   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and
    `myuser` with your Teleport username.
 
 1. Edit the resource configuration by running the following command:
@@ -769,7 +776,7 @@ your Teleport username:
    This command closes the reverse tunnel between your leaf cluster and your root cluster.
    It also deactivates the root cluster's certificate authority on the leaf cluster.
 
-You can repeat these steps to change `spec.enabled` to `true` if you want to reestablish 
+You can repeat these steps to change `spec.enabled` to `true` if you want to reestablish
 the trust relationship between the leaf cluster and the root cluster.
 
 ## Federating access to Kubernetes clusters
@@ -790,26 +797,26 @@ For example, consider the following scenario:
 - There are two Teleport clusters named `east` and `west`, and two Kubernetes
   clusters with the same names. Each Teleport cluster has its own configuration
   file with its name specified in the `cluster_name` field.
-- The clusters `east` and `west` are leaf clusters that trust a Teleport Team or
-  Enterprise Cloud account, for example, `example.teleport.sh`.
-- Users always authenticate against `example.teleport.sh` but use their
+- The clusters `east` and `west` are leaf clusters that trust a self-hosted Teleport
+  Cluster, for example, `teleport.example.com`.
+- Users always authenticate against `teleport.example.com` but use their
   certificates to access SSH nodes and the Kubernetes API in all three clusters.
 
 In this scenario, users usually log in using the following commands:
 
 ```code
 # Log in to the root cluster
-$ tsh --proxy=mytenant.teleport.sh login
+$ tsh --proxy=teleport.example.com login
 
 # Receive a certificate for "east"
-$ tsh --proxy=mytenant.teleport.sh login east
+$ tsh --proxy=teleport.example.com login east
 
 # Log in to the Kubernetes cluster called "east" in the Teleport cluster with
 # the same name
-$ tsh kube login --proxy=mytenant.teleport.sh --cluster=east east
+$ tsh kube login --proxy=teleport.example.com --cluster=east east
 
 # The user's kubeconfig now contains the entry for the "east" Kubernetes
-# endpoint, i.e. east.mytenant.teleport.sh
+# endpoint, i.e. east.teleport.example.com
 ```
 
 ## Remove a trusted leaf cluster
@@ -819,14 +826,14 @@ it later, you must run commands on both the leaf cluster and the root cluster.
 
 To remove a leaf cluster completely:
 
-1. Sign in to your **leaf cluster** from your administrative workstation using 
+1. Sign in to your **leaf cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="leafcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and 
+   Replace `leafcluster.example.com` with the Teleport leaf cluster domain and
    `myuser` with your Teleport username.
 
 1. Disable and remove the leaf cluster by running the following command:
@@ -838,14 +845,14 @@ your Teleport username:
    This command sets `spec.enabled` to `false` for the `trusted_cluster` resource
    and removes the trusted cluster resource from the Teleport Auth Service backend.
 
-1. Sign in to your **root cluster** from your administrative workstation using 
+1. Sign in to your **root cluster** from your administrative workstation using
 your Teleport username:
-   
+
    ```code
    $ tsh login --proxy=<Var name="rootcluster.example.com" /> --user=<Var name="myuser" />
    ```
 
-   Replace `rootcluster.example.com` with the Teleport root cluster domain and 
+   Replace `rootcluster.example.com` with the Teleport root cluster domain and
    `myuser` with your Teleport username.
 
 1. Delete the certificate authorities associated with the remote cluster and remove the
@@ -856,8 +863,8 @@ your Teleport username:
    ```
 
    If you run this command without removing the trust relationship from the leaf cluster,
-   the leaf cluster will continue to try to ping the root cluster, but won't be able to connect. 
-   To reestablish the trusted cluster relationship, you must recreate the trusted cluster 
+   the leaf cluster will continue to try to ping the root cluster, but won't be able to connect.
+   To reestablish the trusted cluster relationship, you must recreate the trusted cluster
    from the leaf cluster.
 
 ## Troubleshooting
@@ -867,27 +874,27 @@ the following categories:
 
 - **HTTPS configuration issues**.
 - **Connectivity problems**.
-- **Access problems**. 
+- **Access problems**.
 
 ### HTTPS configuration issues
 
-The most common HTTPS configuration issues stem from a root cluster that uses a self-signed 
-or invalid HTTPS certificate. If the `web_proxy_addr` endpoint of the root cluster uses a self-signed 
-or invalid HTTPS certificate, you are likely to see an error similar to the following: 
-`The trusted cluster uses misconfigured HTTP/TLS certificate`. 
+The most common HTTPS configuration issues stem from a root cluster that uses a self-signed
+or invalid HTTPS certificate. If the `web_proxy_addr` endpoint of the root cluster uses a self-signed
+or invalid HTTPS certificate, you are likely to see an error similar to the following:
+`The trusted cluster uses misconfigured HTTP/TLS certificate`.
 
-For ease of testing, you can start the `teleport` daemon on the leaf cluster with 
-the `--insecure` command-line options to accept self-signed certificates. However, you should 
-ensure that you configure HTTPS properly to resolve the issue, then remove the `--insecure` before 
+For ease of testing, you can start the `teleport` daemon on the leaf cluster with
+the `--insecure` command-line options to accept self-signed certificates. However, you should
+ensure that you configure HTTPS properly to resolve the issue, then remove the `--insecure` before
 running Teleport in a production environment.
 
 ### Connectivity problems
 
-If a leaf cluster doesn't show up in the output when you run the `tsh clusters` command 
-on the root cluster, it might indicate network connectivity issues or problems communicating 
+If a leaf cluster doesn't show up in the output when you run the `tsh clusters` command
+on the root cluster, it might indicate network connectivity issues or problems communicating
 with the Teleport Auth Service.
 
-To troubleshoot connectivity problems, enable verbose output for the Teleport Auth Service on 
+To troubleshoot connectivity problems, enable verbose output for the Teleport Auth Service on
 both the root and leaf clusters. Usually, this can be done by adding the `--debug` flag to the
 command to start the teleport service:
 
@@ -920,18 +927,25 @@ how your network security groups are configured on AWS.
 
 ### Access problems
 
-If users from the root cluster get **Access denied** error messages when trying to connect to nodes 
+If users from the root cluster get **Access denied** error messages when trying to connect to nodes
 on the leaf cluster, it might indicate problems with their role assignment, role mapping, or allowed logins.
-However, troubleshooting **Access denied** messages can be quite challenging. 
+However, troubleshooting **Access denied** messages can be quite challenging.
 To troubleshoot, you should start by checking the following information for the user being denied access:
 
-- The roles assigned to the user on the root cluster when signing in with the `tsh login` command. 
+- The roles assigned to the user on the root cluster when signing in with the `tsh login` command.
   You can inspect the certificate and assigned roles by running the `tsh status` command on the client.
 
 - The roles assigned to the user on the leaf cluster when the role mapping takes place. You can check
-  the role mapping in the Teleport audit log. 
-  
-  If you manage Teleport on your own network, the default location for audit log is 
+  the role mapping in the Teleport audit log.
+
+  If you manage Teleport on your own network, the default location for audit log is
   `/var/lib/teleport/log` on the server where the Teleport Auth Service for the cluster runs.
 
   If you use Teleport as a managed cloud-based service, the audit log is viewable under **Audit** in the left-hand pane via the Web UI for users with permission to the `event` resources.
+
+
+### Application access within trusted clusters
+
+It is recommended to have unique application names across your entire cluster, root and leafs included. Applications served by leaf clusters are accessed via `app_name.root_proxy_public_addr`
+in the root cluster. When accessing the app via FQDN only, it can lead to ambiguous resolution. If your apps must contain the same name across multiple
+clusters, the most deterministic way to access the correct app is via the web UI's resources page.
diff --git a/docs/pages/zero-trust-access/export-audit-events/datadog.mdx b/docs/pages/zero-trust-access/export-audit-events/datadog.mdx
new file mode 100644
index 0000000000000..f1b0d5d927139
--- /dev/null
+++ b/docs/pages/zero-trust-access/export-audit-events/datadog.mdx
@@ -0,0 +1,215 @@
+---
+title: Export Teleport Audit Events with Datadog
+sidebar_label: Datadog
+description: How to configure the Teleport Event Handler plugin and Fluentd to send audit logs to Datadog
+tags:
+ - how-to
+ - zero-trust
+ - audit
+---
+
+Datadog is a SAAS monitoring and security platform. In this guide, we'll explain
+how to forward Teleport audit events to Datadog using Fluentd.
+
+## How it works
+
+The Teleport Event Handler authenticates to the Teleport Auth Service to receive
+audit events over a gRPC stream, then sends those events to Fluentd as JSON
+payloads over a secure channel established via mutual TLS:
+
+![Architecture of the setup shown in this guide](../../../img/management/datadog-diagram.png)
+
+Since the Datadog Agent can only receive logs from remote sources as
+JSON-encoded bytes over a [TCP or UDP
+connection](https://docs.datadoghq.com/agent/logs/?tab=tailfiles#custom-log-collection),
+the Teleport Event Handler needs to send its HTTPS payloads without using the
+Datadog Agent. Fluentd handles authentication to the Datadog API.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+(!docs/pages/includes/machine-id/plugin-prerequisites.mdx!)
+
+- A [Datadog](https://www.datadoghq.com/) account.
+- A server, virtual machine, Kubernetes cluster, or Docker environment to run the
+  Event Handler. The instructions below assume a local Docker container for testing.
+- Fluentd version v(=fluentd.version=) or greater. The Teleport Event Handler
+  will create a new `fluent.conf` file you can integrate into an existing Fluentd
+  system, or use with a fresh setup.
+
+The instructions below demonstrate a local test of the Event Handler plugin on
+your workstation. You will need to adjust paths, ports, and domains for other
+environments.
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/6. Install the Event Handler plugin
+
+The Teleport Event Handler runs alongside the Fluentd forwarder, receives events
+from Teleport's events API, and forwards them to Fluentd.
+
+(!docs/pages/includes/install-event-handler.mdx!)
+
+## Step 2/6. Generate a plugin configuration
+
+(!docs/pages/includes/configure-event-handler.mdx!)
+
+## Step 3/6. Create a user and role for reading audit events
+
+(!docs/pages/includes/plugins/event-handler-role-user.mdx!)
+
+## Step 4/6. Create teleport-event-handler credentials
+
+The Teleport Event Handler needs credentials to authenticate to the Teleport
+Auth Service. In this section, you will give the Event Handler access to these
+credentials.
+
+### Enable issuing of credentials for the Event Handler role
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/rbac-impersonate-event-handler.mdx!)
+</TabItem>
+</Tabs>
+
+### Export an identity file for the Event Handler plugin user
+
+Give the plugin access to a Teleport identity file. We recommend using Machine
+ID for this in order to produce short-lived identity files that are less
+dangerous if exfiltrated, though in demo deployments, you can generate
+longer-lived identity files with `tctl`:
+
+<Tabs>
+<TabItem label="Machine & Workload Identity">
+(!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
+</TabItem>
+<TabItem label="Long-lived identity files">
+(!docs/pages/includes/plugins/identity-export.mdx user="teleport-event-handler" secret="teleport-event-handler-identity"!)
+</TabItem>
+</Tabs>
+
+## Step 5/6. Install the Fluentd output plugin for Datadog
+
+In order for Fluentd to communicate with Datadog, it requires the [Fluentd output
+plugin for Datadog](https://github.com/DataDog/fluent-plugin-datadog). Install
+the plugin on your Fluentd host using either `gem` or the `td-agent`, if installed:
+
+```code
+# Using Gem
+$ gem install fluent-plugin-datadog
+
+# Using td-agent
+$ /usr/sbin/td-agent-gem install fluent-plugin-datadog
+```
+
+<Admonition type="tip" title="Testing Locally?">
+
+If you're running Fluentd in a local Docker container for testing, you can adjust
+the entrypoint to an interactive shell as the root user, so you can install the
+plugin before starting Fluentd:
+
+```code
+$ docker run -u $(id -u root):$(id -g root) -p 8888:8888 -v $(pwd):/keys -v \
+$(pwd)/fluent.conf:/fluentd/etc/fluent.conf --entrypoint=/bin/sh -i --tty  fluent/fluentd:edge
+# From the container shell:
+$ gem install fluent-plugin-datadog
+$ fluentd -c /fluentd/etc/fluent.conf
+```
+
+</Admonition>
+
+### Configure Fluentd
+
+1. Visit Datadog and generate an API key for Fluentd by following the [Datadog
+   documentation](https://docs.datadoghq.com/account_management/api-app-keys).
+
+1. Copy the API key and use it to add a new `<match>` block to `fluent.conf`:
+
+   ```ini
+   <match test.log>
+   
+     @type datadog
+     @id awesome_agent
+     api_key (=presets.tokens.first=)
+   
+     host http-intake.logs.us5.datadoghq.com
+   
+     # Optional parameters
+     dd_source teleport
+   
+   </match>
+   ```
+
+1. Edit your configuration as follows:
+
+   - Add your API key to the `api_key` field.
+   - Adjust the `host` value to match your Datadog site. See the Datadog [Log
+     Collection and
+     Integrations](https://docs.datadoghq.com/logs/log_collection/?tab=host)
+     guide to determine the correct value.
+   - `dd_source` is an optional field you can use to filter these logs in the
+     Datadog UI.
+   - Adjust `ca_path`, `cert_path` and `private_key_path` to point to the
+     credential files generated earlier. If you're testing locally, the Docker
+     command above already mounted the current working directory to `keys/` in
+     the container.
+
+1. Restart Fluentd after saving the changes to `fluent.conf`.
+
+## Step 6/6. Run the Teleport Event Handler plugin
+
+In this section, you will modify the Event Handler configuration you generated
+and run the Event Handler to test your configuration.
+
+### Configure the Event Handler
+
+In this section, you will configure the Teleport Event Handler for your
+environment.
+
+(!docs/pages/includes/plugins/finish-event-handler-config.mdx!)
+
+Next, modify the configuration file as follows:
+
+(!docs/pages/includes/plugins/config-toml-teleport.mdx!)
+
+(!docs/pages/includes/plugins/machine-id-exporter-config.mdx!)
+
+### Start the Teleport Event Handler
+
+(!docs/pages/includes/start-event-handler.mdx!)
+
+The Logs view in Datadog should now report your Teleport cluster events:
+
+![Datadog Logs](../../../img/management/datadog-logs.png)
+
+## Troubleshooting connection issues
+
+If the Teleport Event Handler is displaying error logs while connecting to your
+Teleport Cluster, ensure that:
+
+- The certificate the Teleport Event Handler is using to connect to your
+  Teleport cluster is not past its expiration date. This is the value of the
+  `--ttl` flag in the `tctl auth sign` command, which is 12 hours by default.
+- Ensure that in your Teleport Event Handler configuration file
+  (`teleport-event-handler.toml`), you have provided the correct host *and* port
+  for the Teleport Proxy Service.
+
+## Next steps
+
+- Read more about
+[impersonation](../authentication/impersonation.mdx)
+here.
+- While this guide uses the `tctl auth sign` command to issue credentials for the
+Teleport Event Handler, production clusters should use Machine & Workload
+Identity for safer, more reliable renewals. Read [our guide](../../machine-workload-identity/getting-started.mdx)
+to getting started with Machine & Workload Identity.
+- To see all of the options you can set in the values file for the
+`teleport-plugin-event-handler` Helm chart, consult our [reference
+guide](../../reference/helm-reference/teleport-plugin-event-handler.mdx).
+- Review the Fluentd output plugin for Datadog [README
+file](https://github.com/DataDog/fluent-plugin-datadog/blob/master/README.md)
+to learn how to customize the log format entering Datadog.
diff --git a/docs/pages/admin-guides/management/export-audit-events/elastic-stack.mdx b/docs/pages/zero-trust-access/export-audit-events/elastic-stack.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/export-audit-events/elastic-stack.mdx
rename to docs/pages/zero-trust-access/export-audit-events/elastic-stack.mdx
index 608e9cd69d364..c143d0507f354 100644
--- a/docs/pages/admin-guides/management/export-audit-events/elastic-stack.mdx
+++ b/docs/pages/zero-trust-access/export-audit-events/elastic-stack.mdx
@@ -1,6 +1,11 @@
 ---
 title: "Export Teleport Audit Events to the Elastic Stack"
+sidebar_label: "Elastic Stack"
 description: "How to configure Teleport's Event Handler plugin to send audit events to the Elastic Stack"
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
 Teleport's Event Handler plugin receives audit events from the Teleport Auth
@@ -81,7 +86,7 @@ locally.
 ### Enable issuing of credentials for the Event Handler role
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -97,7 +102,7 @@ dangerous if exfiltrated, though in demo deployments, you can generate
 longer-lived identity files with `tctl`:
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -127,7 +132,7 @@ under "Cluster privileges", enter `manage_index_templates`, `manage_ilm`, and
 Under "Index privileges", define an entry with `audit-events-*` in the "Indices"
 field and `write` and `manage` in the "Privileges" field. Click "Create role".
 
-![Creating an Elasticsearch role](../../../../img/enterprise/plugins/elasticsearch/create-role.png)
+![Creating an Elasticsearch role](../../../img/enterprise/plugins/elasticsearch/create-role.png)
 
 ### Create an Elasticsearch user for the Event Handler
 
@@ -433,7 +438,7 @@ For the "Name" field, use "Teleport Audit Events". In "Index pattern", use
 `audit-events-*` to select all indices created by our Logstash pipeline. In
 "Timestamp field", choose `time`, which Teleport adds to its audit events.
 
-![Creating a data view](../../../../img/enterprise/plugins/elasticsearch/data-view-create.png)
+![Creating a data view](../../../img/enterprise/plugins/elasticsearch/data-view-create.png)
 
 To use your data view, find the search box at the top of the Elastic Stack UI
 and enter "Discover". On the upper left of the screen, click the dropdown menu
@@ -441,12 +446,12 @@ and select "Teleport Audit Events". You can now search and filter your Teleport
 audit events in order to get a better understanding how users are interacting
 with your Teleport cluster.
 
-![Creating a data view](../../../../img/enterprise/plugins/elasticsearch/data-view-explore.png)
+![Creating a data view](../../../img/enterprise/plugins/elasticsearch/data-view-explore.png)
 
 For example, we can click the `event` field on the left sidebar and visualize
 the event types for your Teleport audit events over time:
 
-![Creating a visualization](../../../../img/enterprise/plugins/elasticsearch/lens.png)
+![Creating a visualization](../../../img/enterprise/plugins/elasticsearch/lens.png)
 
 ## Troubleshooting connection issues
 
@@ -463,10 +468,10 @@ Teleport Cluster, ensure that:
 ## Next steps
 
 Now that you are exporting your audit events to the Elastic Stack, consult our
-[audit event reference](../../../reference/monitoring/audit.mdx) so you can plan
+[audit event reference](../../reference/deployment/monitoring/audit.mdx) so you can plan
 visualizations and alerts.
 
 While this guide uses the `tctl auth sign` command to issue credentials for the
-Teleport Event Handler, production clusters should use Machine ID for safer,
-more reliable renewals. Read [our guide](../../../enroll-resources/machine-id/getting-started.mdx)
-to getting started with Machine ID.
+Teleport Event Handler, production clusters should use Machine & Workload
+Identity for safer, more reliable renewals. Read [our guide](../../machine-workload-identity/getting-started.mdx)
+to getting started with Machine & Workload Identity.
diff --git a/docs/pages/admin-guides/management/export-audit-events/export-audit-events.mdx b/docs/pages/zero-trust-access/export-audit-events/export-audit-events.mdx
similarity index 96%
rename from docs/pages/admin-guides/management/export-audit-events/export-audit-events.mdx
rename to docs/pages/zero-trust-access/export-audit-events/export-audit-events.mdx
index 49387f7964b1b..7e75e3d0cce8c 100644
--- a/docs/pages/admin-guides/management/export-audit-events/export-audit-events.mdx
+++ b/docs/pages/zero-trust-access/export-audit-events/export-audit-events.mdx
@@ -1,6 +1,10 @@
 ---
 title: Exporting Teleport Audit Events
+sidebar_label: Audit Event Export
 description: Learn how to export Teleport audit events to your log management solution.
+tags:
+ - zero-trust
+ - audit
 ---
 
 The Teleport Auth Service emits audit logs when users and services interact with
diff --git a/docs/pages/admin-guides/management/export-audit-events/fluentd.mdx b/docs/pages/zero-trust-access/export-audit-events/fluentd.mdx
similarity index 88%
rename from docs/pages/admin-guides/management/export-audit-events/fluentd.mdx
rename to docs/pages/zero-trust-access/export-audit-events/fluentd.mdx
index feff73c5b13f6..88d8837e2108e 100644
--- a/docs/pages/admin-guides/management/export-audit-events/fluentd.mdx
+++ b/docs/pages/zero-trust-access/export-audit-events/fluentd.mdx
@@ -1,7 +1,12 @@
 ---
 title: Export Events with Fluentd
+sidebar_label: Fluentd
 description: Forwarding events with Fluentd and Teleport event handler
 videoBanner: HAqxs4rBv2c
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
 Fluentd is an open source data collector for a unified logging layer. In this
@@ -11,10 +16,16 @@ guide, we will:
 - Forward events with Fluentd.
 
 This guide also serves as an explanation for the Teleport Event Handler plugin,
-using Fluentd as the target service. We'll create a local Docker container as a
-destination for the Event Handler:
+using Fluentd as the target service. 
 
-![The Teleport Fluentd plugin](../../../../img/enterprise/plugins/fluentd-diagram.png)
+## How it works
+
+The Teleport event handler runs alongside the Fluentd forwarder, receives events
+from Teleport's events API, and forwards them to Fluentd.
+
+We'll create a local Docker container as a destination for the Event Handler:
+
+![The Teleport Fluentd plugin](../../../img/enterprise/plugins/fluentd-diagram.png)
 
 You can follow the instructions below for a local proof-of-concept demo, or use any
 of the additional installation instructions to configure the Teleport Event Handler
@@ -41,9 +52,6 @@ to integrate with your infrastructure.
 
 ## Step 1/6. Install the event handler plugin
 
-The Teleport event handler runs alongside the Fluentd forwarder, receives events
-from Teleport's events API, and forwards them to Fluentd.
-
 (!docs/pages/includes/install-event-handler.mdx!)
 
 ## Step 2/6. Generate a plugin configuration
@@ -62,7 +70,7 @@ key from the same certificate authority for the Teleport Event Handler to use.
 ### Enable issuing of credentials for the event handler role
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -78,7 +86,7 @@ dangerous if exfiltrated, though in demo deployments, you can generate
 longer-lived identity files with `tctl`:
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -183,15 +191,15 @@ Teleport Cluster, ensure that:
 ## Next Steps
 
 Read more about
-[impersonation](../../access-controls/guides/impersonation.mdx)
+[impersonation](../authentication/impersonation.mdx)
 here.
 
 While this guide uses the `tctl auth sign` command to issue credentials for the
-Teleport Event Handler, production clusters should use Machine ID for safer,
-more reliable renewals. Read [our guide](../../../enroll-resources/machine-id/getting-started.mdx)
-to getting started with Machine ID.
+Teleport Event Handler, production clusters should use Machine & Workload
+Identity for safer, more reliable renewals. Read [our guide](../../machine-workload-identity/getting-started.mdx)
+to getting started with Machine & Workload Identity.
 
 To see all of the options you can set in the values file for the
 `teleport-plugin-event-handler` Helm chart, consult our [reference
-guide](../../../reference/helm-reference/teleport-plugin-event-handler.mdx).
+guide](../../reference/helm-reference/teleport-plugin-event-handler.mdx).
 
diff --git a/docs/pages/admin-guides/management/export-audit-events/panther.mdx b/docs/pages/zero-trust-access/export-audit-events/panther.mdx
similarity index 94%
rename from docs/pages/admin-guides/management/export-audit-events/panther.mdx
rename to docs/pages/zero-trust-access/export-audit-events/panther.mdx
index 45a79e899e151..d1870b11d316a 100644
--- a/docs/pages/admin-guides/management/export-audit-events/panther.mdx
+++ b/docs/pages/zero-trust-access/export-audit-events/panther.mdx
@@ -1,6 +1,11 @@
 ---
 title: Export Teleport Audit Events to Panther 
+sidebar_label: Panther
 description: How to configure the Teleport Event Handler plugin and Fluentd to send audit logs to Panther
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
 Panther is a cloud-native security analytics platform. In this guide, we'll explain
@@ -11,7 +16,7 @@ how to forward Teleport audit events to Panther using Fluentd.
 The Teleport Event Handler is designed to communicate with Fluentd using mTLS
 to establish a secure channel. In this setup, the Event Handler sends events to Fluentd, which forwards them to S3 to be ingested by Panther.
 
-![Architecture of the setup shown in this guide](../../../../img/management/fluentd-diagram.png)
+![Architecture of the setup shown in this guide](../../../img/management/fluentd-diagram.png)
 
 ## Prerequisites
 
@@ -52,7 +57,7 @@ from Teleport's events API, and forwards them to Fluentd.
 ### Enable issuing of credentials for the Event Handler role
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -68,7 +73,7 @@ dangerous if exfiltrated, though in demo deployments, you can generate
 longer-lived identity files with `tctl`:
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -224,7 +229,7 @@ Once logs are being sent to S3, you can configure Panther to ingest them. Follow
 the [Panther documentation](https://docs.panther.com/data-onboarding/supported-logs/teleport) to set
 up the S3 bucket as a data source.
 
-![Panther Dashboard Example](../../../../img/management/panther-ingest.png)
+![Panther Dashboard Example](../../../img/management/panther-ingest.png)
 
 ## Troubleshooting connection issues
 
@@ -243,9 +248,9 @@ Teleport Cluster, ensure that:
 ## Next steps
 
 - Read more about
-[impersonation](../../access-controls/guides/impersonation.mdx)
+[impersonation](../authentication/impersonation.mdx)
 here.
 - Learn more about the [Panther Detections, Alerts and Notifications](https://panther.com/integrations/logs/teleport/).
 - To see all of the options you can set in the values file for the
 `teleport-plugin-event-handler` Helm chart, consult our [reference
-guide](../../../reference/helm-reference/teleport-plugin-event-handler.mdx).
+guide](../../reference/helm-reference/teleport-plugin-event-handler.mdx).
diff --git a/docs/pages/admin-guides/management/export-audit-events/splunk.mdx b/docs/pages/zero-trust-access/export-audit-events/splunk.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/export-audit-events/splunk.mdx
rename to docs/pages/zero-trust-access/export-audit-events/splunk.mdx
index 1172a8818b227..654988d180bfe 100644
--- a/docs/pages/admin-guides/management/export-audit-events/splunk.mdx
+++ b/docs/pages/zero-trust-access/export-audit-events/splunk.mdx
@@ -1,6 +1,11 @@
 ---
 title: Export Teleport Audit Events to Splunk
+sidebar_label: Splunk
 description: How to configure the Teleport Event Handler plugin to send audit logs to Splunk
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
 Teleport's Event Handler plugin receives audit logs from the Teleport Auth
@@ -75,7 +80,7 @@ We'll re-purpose the files generated for Fluentd in our Universal Forwarder conf
 ### Enable issuing of credentials for the Event Handler role
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/rbac-impersonate-event-handler-machine-id.mdx!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -91,7 +96,7 @@ dangerous if exfiltrated, though in demo deployments, you can generate
 longer-lived identity files with `tctl`:
 
 <Tabs>
-<TabItem label="Machine ID">
+<TabItem label="Machine & Workload Identity">
 (!docs/pages/includes/plugins/tbot-identity.mdx secret="teleport-event-handler-identity"!)
 </TabItem>
 <TabItem label="Long-lived identity files">
@@ -146,7 +151,7 @@ Splunk UI and navigating to **Settings** > **Indexes**. Click **New Index**.
 Name your index `teleport-audit-logs` and assign the **Index Data Type** field
 to "Events".
 
-![Creating an Index](../../../../img/enterprise/plugins/splunk/new-index.png)
+![Creating an Index](../../../img/enterprise/plugins/splunk/new-index.png)
 
 The values of the remaining fields, **Max raw data size** and **Searchable
 retention (days)** depend on your organization's resources and practices for log
@@ -164,7 +169,7 @@ click **Add new**
 Enter a name you can use to recognize the token later so you can
 manage it, e.g., `Teleport Audit Events`. Click **Next**.
 
-![Create a Token](../../../../img/enterprise/plugins/splunk/new-token.png)
+![Create a Token](../../../img/enterprise/plugins/splunk/new-token.png)
 
 In the **Input Settings** view (above), next to the **Source type** field, click
 **Select**. In the **Select Source Type** dropdown menu, click **Structured**,
@@ -384,7 +389,7 @@ Once you click **Add to Dashboard** you will see a count of Teleport event types
 over time, which gives you a general sense of how users are interacting with
 Teleport:
 
-![Event Types over Time](../../../../img/enterprise/plugins/splunk/splunk-dashboard.png)
+![Event Types over Time](../../../img/enterprise/plugins/splunk/splunk-dashboard.png)
 
 ## Troubleshooting connection issues
 
@@ -401,15 +406,15 @@ Teleport Cluster, ensure that:
 ## Next steps
 
 Now that you are exporting your audit logs to Splunk, consult our [audit log
-reference](../../../reference/monitoring/audit.mdx) so you can plan visualizations
+reference](../../reference/deployment/monitoring/audit.mdx) so you can plan visualizations
 and alerts.
 
 In this guide, we made use of impersonation to supply credentials to the
 Teleport Event Handler to communicate with your Teleport cluster. To learn more
 about impersonation, read [our
-guide](../../access-controls/guides/impersonation.mdx).
+guide](../authentication/impersonation.mdx).
 
 While this guide uses the `tctl auth sign` command to issue credentials for the
-Teleport Event Handler, production clusters should use Machine ID for safer,
-more reliable renewals. Read [our guide](../../../enroll-resources/machine-id/getting-started.mdx)
-to getting started with Machine ID.
+Teleport Event Handler, production clusters should use Machine & Workload
+Identity for safer, more reliable renewals. Read [our guide](../../machine-workload-identity/getting-started.mdx)
+to getting started with Machine & Workload Identity.
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx
new file mode 100644
index 0000000000000..4e9023bf447d6
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/infrastructure-as-code.mdx
@@ -0,0 +1,187 @@
+---
+title: Infrastructure as Code
+description: An introduction to managing Teleport with Infrastructure as Code tools, including Terraform and Kubernetes resources.
+sidebar_position: 4
+tags:
+ - infrastructure-as-code
+ - conceptual
+ - zero-trust
+---
+
+This section explains how to manage Teleport using infrastructure as code (IaC)
+tools.
+
+Teleport provides three methods for managing Teleport with infrastructure as
+code tools: 
+- [Teleport Terraform provider](terraform-provider/terraform-provider.mdx)
+- [Teleport Kubernetes operator](teleport-operator/teleport-operator.mdx)
+- [`tctl` client tool](using-tctl.mdx)
+
+For instructions on managing users, roles, trusted clusters, and other resources
+with IaC tools, see [Managing Resources with Infrastructure as
+Code](managing-resources/managing-resources.mdx).
+
+## How IaC works with Teleport
+
+There are two ways to configure a Teleport cluster:
+
+- **Static configuration file:** At startup, a Teleport process reads a
+  configuration file from the local filesystem (the default path is
+  `/etc/teleport.yaml`). Static configuration settings control aspects of a
+  cluster that are not expected to change frequently, like the ports that
+  services listen on. (See the [Configuration
+  Reference](../../reference/deployment/config.mdx) for all static configuration
+  options.)
+- **Dynamic resources:** Dynamic resources control aspects of your cluster that
+  are likely to change over time, such as roles, local users, and
+  Teleport-protected infrastructure resources.
+
+![Architecture of dynamic resources](../../../img/dynamic-resources.png)
+
+The Teleport Auth Service stores dynamic resources on its cluster state backend,
+and clients can authenticate to the Auth Service to read or write dynamic
+resources, depending on their permissions. Infrastructure as code tools can
+authenticate to a Teleport cluster to manage dynamic resources.
+
+## Reconciling static and dynamic configurations
+
+Some dynamic resources assign the same settings as fields within
+Teleport's static configuration file. For these fields, the Teleport Auth
+Service reconciles static and dynamic configurations on startup and when you
+create or remove a Teleport resource.
+
+While Teleport Enterprise Cloud does not expose the static configuration file to
+operators, they do use a static configuration file for certain settings.
+
+### Configuration resources that apply to static configuration fields
+
+There are four dynamic resources that share fields with the
+static configuration file:
+
+- `session_recording_config`
+- `cluster_auth_preference`
+- `cluster_networking_config`
+- `ui_config`
+
+#### `session_recording_config`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.mode`|`auth_service.session_recording`|
+|`spec.proxy_checks_host_keys`|`auth_service.proxy_checks_host_keys`|
+
+#### `cluster_auth_preference`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.type`|`auth_service.authentication.type`|
+|`spec.second_factor`|`auth_service.authentication.second_factor`|
+|`spec.second_factors`|`auth_service.authentication.second_factors`|
+|`spec.connector_name`|`auth_service.authentication.connector_name`
+|`spec.u2f`|`auth_service.authentication.u2f`|
+|`spec.disconnect_expired_cert`|`auth_service.disconnect_expired_cert`|
+|`spec.allow_local_auth`|`auth_service.authentication.local_auth`|
+|`spec.message_of_the_day`|`auth_service.message_of_the_day`|
+|`spec.locking_mode`|`auth_service.authentication.locking_mode`|
+|`spec.webauthn`|`auth_service.authentication.webauthn`|
+|`spec.require_session_mfa`|`auth_service.authentication.require_session_mfa`|
+|`spec.allow_passwordless`|`auth_service.authentication.passwordless`|
+|`spec.device_trust`|`auth_service.authentication.device_trust`|
+|`spec.idp`|`proxy_service.idp`|
+|`spec.allow_headless`|`auth_service.authentication.headless`|
+
+#### `cluster_networking_config`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.client_idle_timeout`|`auth_service.client_idle_timeout`|
+|`spec.keep_alive_interval`|`auth_service.keep_alive_interval`|
+|`spec.keep_alive_count_max`|`auth_service.keep_alive_count_max`|
+|`spec.session_control_timeout`|`auth_service.session_control_timeout`|
+|`spec.idle_timeout_message`|`auth_service.client_idle_timeout_message`|
+|`spec.web_idle_timeout`|`auth_service.web_idle_timeout`|
+|`spec.proxy_listener_mode`|`auth_service.proxy_listener_mode`|
+|`spec.routing_strategy`|`auth_service.routing_strategy`|
+|`spec.tunnel_strategy`|`auth_service.tunnel_strategy`|
+|`spec.proxy_ping_interval`|`auth_service.proxy_ping_interval`|
+|`spec.case_insensitive_routing`|`auth_service.case_insensitive_routing`|
+
+#### `ui_config`
+
+| Dynamic resource field  | Static configuration field          |
+| ----------------------- | ----------------------------------- |
+| `spec.scrollback_lines` | `proxy_service.ui.scrollback_lines` |
+| `spec.show_resources`   | `proxy_service.ui.show_resources`   |
+
+## Origin labels
+
+The Teleport Auth Service applies the `teleport.dev/origin` label to
+configuration resources to indicate whether they originated from the static
+configuration file, a dynamic configuration resource, or the default value.
+
+Here are possible values of the `teleport.dev/origin` label:
+
+- `defaults`
+- `config-file`
+- `dynamic`
+- `terraform`
+- `kubernetes`
+
+When the Auth Service starts up, it looks up the values of static configuration
+fields that correspond to fields in dynamic configuration resources. If any of
+these have values, it creates the corresponding dynamic configuration resources
+and stores them in its backend.
+
+For any static configuration fields without a value, the Auth Service checks
+whether the backend contains the corresponding dynamic configuration resource.
+If not, it creates one with default values and the
+`teleport.dev/origin=defaults` label.
+
+If you attempt to create a dynamic configuration resource after the Auth Service
+has already loaded the configuration from a static configuration file, the Auth
+Service will return an error.
+
+If you remove a dynamic configuration resource, the Auth Service will restore
+its configuration fields to the default values and add the
+`teleport.dev/origin=defaults` label.
+
+<Admonition type="tip">
+
+Cloud-hosted Teleport deployments use configuration files, but these are not
+available for operators to modify. Users of Teleport Enterprise Cloud may see
+configuration resources with the `teleport.dev/origin=config-file` label.
+
+</Admonition>
+
+## Dynamic resource references
+
+Read the following reference guides for comprehensive lists of supported fields
+in Teleport dynamic resources:
+
+### tctl resources
+
+For reference guides to dynamic configuration resources available to apply using
+`tctl`, read the [Configuration Resource
+Reference](../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx). There are also
+dedicated configuration resource references for
+[applications](../../enroll-resources/application-access/reference.mdx) and
+[databases](../../enroll-resources/database-access/reference/configuration.mdx).
+
+### Terraform resources and data sources
+
+For comprehensive reference guides for resources and data sources you can manage
+with the Teleport Terraform provider, see [Teleport Terraform Provider
+References](../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
+
+### Kubernetes operator resources 
+
+For comprehensive reference guides for resources you can manage with the
+Kubernetes operator, see [Teleport Kubernetes Operator Resource
+References](../../reference/infrastructure-as-code/operator-resources/operator-resources.mdx).
+
+## Other ways to use the dynamic resource API
+
+The Teleport Kubernetes Operator, Terraform provider, and `tctl` are all clients
+of the Teleport Auth Service's gRPC API. To build your own API client to extend
+Teleport for your organization's needs, read our [API
+guides](../api/api.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/access-list.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/access-list.mdx
similarity index 81%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/access-list.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/access-list.mdx
index a04950be4c6b0..763795355a451 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/access-list.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/access-list.mdx
@@ -1,6 +1,11 @@
 ---
 title: Creating Access Lists with IaC
+sidebar_label: Access Lists
 description: Use Infrastructure-as-Code tooling to create Access Lists.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 Access Lists allow Teleport users to be granted long-term access to resources
@@ -12,14 +17,23 @@ on [the IaC users and roles guide](./user-and-role.mdx) by allowing users with
 the `manager` role to grant the `support-engineer` role to users meeting
 specific criteria.
 
-Please note that Access Lists can be managed via IaC but Access List memberships
-cannot. The goal of Access Lists is to decentralize granting and reviewing
-access. By allowing managers to grant access within specific guidelines and
-automatically enforcing review, users can request common access rights without
-having to go through the centralized team managing the Teleport IaC.
-This reduces the load on the centralized IaC/security team, ensures the access
-reviewer is aware of the context, reduces the request resolution time, and
-ensures access grants are periodically reviewed.
+## How it works
+
+Access Lists are registered with the Teleport Auth Service as resources stored
+on the Auth Service backend. The Teleport Auth Service exposes a gRPC API that
+enables clients to create, delete, or modify backend resources, including Access
+Lists. The Teleport Kubernetes Operator and Terraform provider, along with the
+`tctl` command-line tool, can manage agentless SSH services by authenticating to
+the Teleport Auth Service and interacting with its gRPC API.
+
+Access Lists can be managed via IaC but Access List memberships cannot. The goal
+of Access Lists is to decentralize granting and reviewing access. By allowing
+managers to grant access within specific guidelines and automatically enforcing
+review, users can request common access rights without having to go through the
+centralized team managing the Teleport IaC. This reduces the load on the
+centralized IaC/security team, ensures the access reviewer is aware of the
+context, reduces the request resolution time, and ensures access grants are
+periodically reviewed.
 
 ## Prerequisites
 
@@ -265,19 +279,18 @@ You can log in as alice and add `bob` to the `support-engineers` Access List.
 <Tabs>
 <TabItem label="Web UI">
 
-Login as `alice` in the web UI, open the management panel and select the
-"Access Lists" tab. Your Access List should be displayed, open it, choose "Enroll
-members" and add `bob`.
+Log in as `alice` in the Web UI, Zero Trust Access, select Access Lists, and click on your Access List. 
+Click "Add new Members or Access Lists or Access Lists" and add `bob`.
 
-![Screenshot of the web UI showing the Access List and the "Enroll Member" button](../../../../img/management/access-list-web-ui.png)
+![Screenshot of the Web UI showing the Access List and the "Enroll Member" button](../../../../img/management/access-list-web-ui.png)
 
 </TabItem>
 <TabItem label="CLI">
 
-Login as `alice` with `tsh`, then add bob to the Access List:
+Log in as `alice` with `tsh`, then add bob to the Access List:
 
 ```code
-# login as alice
+# log in as alice
 $ tsh login --proxy <your-cluster-domain>:<port> --user alice
 
 # tctl acl users add <access-list-name> <user> [<expires>] [<reason>]
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx
similarity index 89%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx
index 4a5dd53e3a484..a8467577ea952 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx
@@ -1,6 +1,12 @@
 ---
 title: Registering Agentless OpenSSH Servers with IaC
+sidebar_label: Agentless OpenSSH Servers
 description: Use infrastructure-as-code tooling to register Agentless OpenSSH servers in Teleport.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
+ - infrastructure-identity
 ---
 
 In this guide, you will see how to register in Teleport your OpenSSH nodes
@@ -13,7 +19,24 @@ dynamically create resources from code:
 - The `tctl` CLI, which allows you to manage Teleport resources from your local
   computer or your CI environment
 
-## Prerequisites
+## How it works
+
+Teleport can route SSH connections through the Teleport Proxy Service to SSH
+nodes. Once you have configured your SSH nodes to trust the Teleport certificate
+authority for OpenSSH (see the [Agentless OpenSSH
+guide](../../../enroll-resources/server-access/openssh/openssh-agentless.mdx),
+the Proxy Service can present a Teleport-signed certificate to the node and
+establish a connection. For this to work, the Teleport Proxy Service must be
+able to dial the node.
+
+Agentless SSH servers are registered with the Teleport Auth Service as resources
+stored on the Auth Service backend. The Teleport Auth Service exposes a gRPC API
+that enables clients to create, delete, or modify backend resources, including
+agentless SSH servers. The Teleport Kubernetes Operator and Terraform provider,
+along with the `tctl` command-line tool, can manage agentless SSH services by
+authenticating to the Teleport Auth Service and interacting with its gRPC API.
+
+# Prerequisites
 
 To follow this guide, you must have:
 
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/kubernetes-oidc-join-token.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/kubernetes-oidc-join-token.mdx
new file mode 100644
index 0000000000000..0b8385f5c3c8b
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/kubernetes-oidc-join-token.mdx
@@ -0,0 +1,334 @@
+---
+title: Configuring Kubernetes OIDC Joining With IaC
+sidebar_label: Kubernetes OIDC Joining
+description: Use infrastructure-as-code tooling to join Teleport Kubernetes agents.
+tags:
+ - how-to
+ - zero-trust
+---
+
+In this guide you will see how to configure Teleport to allow Kubernetes Agents
+to join without secret tokens. Teleport supports three ways to dynamically
+create resources from code:
+
+- The Teleport Kubernetes Operator, which allows you to manage Teleport resources
+from Kubernetes
+- The Teleport Terraform Provider, which allows you to manage Teleport resources
+via Terraform
+- The `tctl` CLI, which allows you to manage Teleport resources from your local
+computer or your CI environment
+
+## How it works
+
+This guide relies on the OIDC variant of [the Kubernetes join
+method](../../../reference/deployment/join-methods.mdx#kubernetes-oidc). Most
+Kubernetes clusters use an OpenID Connect (OIDC) provider to sign their Service
+Account tokens.
+
+In this guide you will configure Teleport to trust the Kubernetes OIDC provider
+so the agent running in the Kubernetes cluster can use its Kubernetes-issued
+token to join the Teleport cluster.
+
+## Prerequisites
+
+To follow this guide, you must have:
+- A Teleport cluster running v18.1.5 or above
+- A Kubernetes cluster you want to enroll, whose service account tokens are
+  signed by a publicly reachable OIDC provider.
+
+<Admonition type="note">
+Cloud-managed Kubernetes clusters either have public OIDC provider by default,
+or this can be configured when creating the cluster:
+- EKS and GKE clusters should all have a publicly reachable OIDC provider.
+- this is [optional on AKS clusters](https://learn.microsoft.com/en-us/azure/aks/use-oidc-issuer)
+- [OIDC Discovery is optional on OKE cluster](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengOpenIDConnect-Discovery.htm)
+
+The cluster does not have to be public, only its OIDC provider has to.
+</Admonition>
+
+<Tabs>
+<TabItem label="tctl">
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+</TabItem>
+<TabItem label="Kubernetes Operator">
+
+A running operator by following either:
+- [the guide to enable the operator in the `teleport-cluster` Helm chart](../teleport-operator/teleport-operator-helm.mdx).
+- [the guide to setup a standalone operator](../teleport-operator/teleport-operator-standalone.mdx).
+
+You must also set the namespace in which you deployed the operator as this is
+the namespace where you will deploy the CustomResources:
+
+```code
+# for operators deployed with the `teleport-cluster` Helm chart
+$ export OPERATOR_NAMESPACE="teleport-cluster"
+
+# for standalone operators
+$ export OPERATOR_NAMESPACE="teleport-iac"
+```
+
+</TabItem>
+<TabItem label="Terraform">
+
+A functional Teleport Terraform provider by following [the Terraform provider guide](../terraform-provider/terraform-provider.mdx).
+
+</TabItem>
+</Tabs>
+
+## Step 1/4. Detect the OIDC provider URL
+
+In this step we will connect to the cluster and recover the OIDC provider URL.
+If you already have the cluster's OIDC provider URL (e.g. as an output from the
+cluster provisioning), you can skip to step 2.
+
+Validate that you have access:
+```code
+$ kubectl cluster-info
+
+Kubernetes control plane is running at https://kube.example.com:443
+CoreDNS is running at https://kube.example.com:443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
+Metrics-server is running at https://kube.example.com:443/api/v1/namespaces/kube-system/services/https:metrics-server:/proxy
+
+To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
+```
+
+Retrieve the OIDC issuer URL in the `issuer` field of the OIDC configuration endpoint:
+```code
+$ kubectl get --raw=/.well-known/openid-configuration
+
+{"issuer":"<Var name="https://oidc.example.com/path/to/issuer/"/>",
+"jwks_uri":"https://kube.example.com:443/openid/v1/jwks","response_types_supported":["id_token"],
+"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"]}
+```
+
+In the example above, it is <Var name="https://oidc.example.com/path/to/issuer/"/>.
+
+<Admonition type="important">
+The issuer URL must be copied exactly, including the presence or absence of trailing `/` in the URL.
+</Admonition>
+
+Validate that the OIDC provider is publicly reachable by running the following command
+and making sure it returns JSON:
+
+```code
+$ curl <Var name="https://oidc.example.com/path/to/issuer/"/>.well-known/openid-configuration
+
+{
+  "issuer": "<Var name="https://oidc.example.com/path/to/issuer/"/>",
+  "jwks_uri": "<Var name="https://oidc.example.com/path/to/issuer/"/>openid/v1/jwks",
+  "response_types_supported": [
+    "id_token"
+  ],
+  "subject_types_supported": [
+    "public"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "RS256"
+  ]
+}
+```
+
+## Step 2/4. Create the Join Token
+
+In this step we will configure Teleport to trust tokens signed by the Kubernetes OIDC provider.
+This will allow agents running in this Kubernetes cluster to join the Teleport cluster.
+
+<Admonition type="note">
+We recommend naming the token after the Kubernetes cluster it's trusting,
+this will allow you to enroll other clusters without facing token name conflicts.
+</Admonition>
+
+### Write the manifest
+
+When creating the token, you will need to specify the future agent namespace
+(<Var name="teleport"/>) and agent release name (<Var name="teleport-agent"/>).
+This will be used by Teleport to check if the agent can join.
+
+<Tabs>
+<TabItem label="tctl">
+
+Create the file `token.yaml` with the following content:
+
+```yaml
+kind: token
+version: v2
+metadata:
+  name: <Var name="kube-cluster-name"/>-oidc
+spec:
+  roles: ['Kube']
+  join_method: "kubernetes"
+  kubernetes:
+    type: oidc
+    oidc:
+      issuer: "<Var name="https://oidc.example.com/path/to/issuer/"/>"
+    allow:
+      - service_account: "<Var name="teleport"/>:<Var name="teleport-agent"/>"
+```
+
+</TabItem>
+<TabItem label="Kubernetes Operator">
+
+Create the file `token.yaml` with the following content:
+
+```yaml
+apiVersion: resources.teleport.dev/v1
+kind: TeleportProvisionToken
+metadata:
+  name: <Var name="kube-cluster-name"/>-oidc
+spec:
+  roles: ['Kube']
+  join_method: "kubernetes"
+  kubernetes:
+    type: oidc
+    oidc:
+      issuer: "<Var name="https://oidc.example.com/path/to/issuer/"/>"
+    allow:
+      - service_account: "<Var name="teleport"/>:<Var name="teleport-agent"/>"
+```
+
+<Admonition type="note">
+  Kubernetes validates all custom resource names to follow RFC 1123, which
+  includes specifications for hostnames. This requires the `metadata.name` field
+  of Teleport resources controlled by the operator to consist of lowercase
+  alphanumeric characters, `-` or `.`, and to start and end with an alphanumeric
+  character.
+</Admonition>
+
+</TabItem>
+<TabItem label="Terraform">
+
+Create the file `token.tf` with the following content:
+
+```hcl
+resource "teleport_provision_token" "<Var name="kube-cluster-name"/>" {
+  version = "v2"
+  metadata = {
+    name = "<Var name="kube-cluster-name"/>-oidc"
+  }
+
+  spec = {
+    roles = ["Kube"]
+    join_method = "kubernetes"
+    kubernetes = {
+      type = "oidc"
+      oidc = {
+        issuer = "<Var name="https://oidc.example.com/path/to/issuer/"/>"
+      }
+      allow = [
+        {
+          service_account = "<Var name="teleport"/>:<Var name="teleport-agent"/>"
+        }
+      ]
+    }
+  }
+}
+```
+</TabItem>
+</Tabs>
+
+### Apply the manifest
+
+<Tabs>
+<TabItem label="tctl">
+
+```code
+$ tctl create -f token.yaml
+token '<Var name="kube-cluster-name"/>-oidc' has been created
+```
+
+</TabItem>
+<TabItem label="Kubernetes Operator">
+
+```code
+$ kubectl apply -n "$OPERATOR_NAMESPACE" -f token.yaml
+
+teleportprovisiontokenv2.resources.teleport.dev/<Var name="kube-cluster-name"/>-oidc created
+```
+
+List the created Kubernetes resources:
+
+```code
+$ kubectl get teleportprovisiontokenv2 -n "$OPERATOR_NAMESPACE"
+
+NAME                                  AGE
+<Var name="kube-cluster-name"/>-oidc   10m
+```
+
+</TabItem>
+<TabItem label="Terraform">
+
+```code
+$ terraform plan
+[...]
+Plan: 1 to add, 0 to change, 0 to destroy.
+
+$ terraform apply
+teleport_provision_token.<Var name="kube-cluster-name"/>-oidc: Creating...
+teleport_provision_token.<Var name="kube-cluster-name"/>-oidc: Creation complete after 0s [id=<Var name="kube-cluster-name"/>-oidc]
+
+Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
+```
+</TabItem>
+</Tabs>
+
+## Step 3/4. Configure the agent
+
+In this step we will write the `teleport-kube-agent` Helm chart configuration
+so that the agent uses the previously created token to join.
+
+You must have the following information:
+- The Teleport cluster address: <Var name="teleport.example.com:443"/>
+- The Teleport cluster name: <Var name="teleport.example.com"/>
+- The name of the kubernetes cluster you are connecting: <Var name="kube-cluster-name"/>
+
+Write the following `values.yaml` YAML manifest.
+
+```yaml
+roles: "kube"
+proxyAddr: <Var name="teleport.example.com:443"/>
+# If you use Teleport Community Edition or AGPL, set to false
+enterprise: true
+updater:
+  enabled: true
+joinParams:
+  method: "kubernetes"
+  tokenName: <Var name="kube-cluster-name"/>-oidc
+kubeClusterName: <Var name="kube-cluster-name"/>
+teleportClusterName: <Var name="teleport.example.com"/>
+```
+
+## Step 4/4. Deploy the agent
+
+In this step we will deploy a release of the `teleport-kube-agent` chart using
+the values we wrote previously.
+
+(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
+
+Finally deploy the Teleport Kubernetes Agent using the values we previously set in the provision token:
+- The namespace in which you will deploy the agent: <Var name="teleport"/>
+- The name of the Teleport agent release: <Var name="teleport-agent"/>
+
+```code
+$ helm upgrade --install <Var name="teleport-agent"/> teleport/teleport-kube-agent \
+  --namespace <Var name="teleport"/> --create-namespace \
+  --version (=teleport.version=) \
+  --values values.yaml
+```
+
+Validate that the agent successfully joined the cluster by checking its pod readiness
+(this can take a couple of minutes):
+
+```code
+$ kubectl get pods -n <Var name="teleport"/>
+
+NAME                                     READY   STATUS    RESTARTS   AGE
+<Var name="teleport-agent"/>-0                         1/1     Running   0          9s
+<Var name="teleport-agent"/>-updater-6b8b74996-jz4qg   1/1     Running   0          15s
+```
+
+## Next steps
+
+Look at [the `teleport-kube-agent` Helm chart reference](../../../reference/helm-reference/teleport-kube-agent.mdx)
+for the list of supported values.
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-operator.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-operator.mdx
similarity index 92%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-operator.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-operator.mdx
index 9110501361bcb..b5177c80e05c5 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-operator.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-operator.mdx
@@ -1,6 +1,11 @@
 ---
-title: Deploy Login Rules using Kubernetes Operator 
+title: Deploying Login Rules Using Kubernetes Operator 
+sidebar_label: Login Rules (Kubernetes Operator)
 description: Use Teleport's Kubernetes Operator to deploy Login Rules to your cluster
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide will explain how to:
@@ -11,6 +16,14 @@ This guide will explain how to:
 This guide is applicable if you self-host Teleport in Kubernetes using the
 `teleport-cluster` Helm chart.
 
+## How it works
+
+Login Rules are registered with the Teleport Auth Service as resources stored on
+the Auth Service backend. The Teleport Auth Service exposes a gRPC API that
+enables clients to create, delete, or modify backend resources, including Login
+Rules. The Teleport Kubernetes Operator can manage agentless SSH services by
+authenticating to the Teleport Auth Service and interacting with its gRPC API.
+
 ## Prerequisites
 
 - A Teleport Enterprise license
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-terraform.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-terraform.mdx
similarity index 87%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-terraform.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-terraform.mdx
index f9f0e3fae17ce..09f82cce27dbd 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/login-rules-terraform.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/login-rules-terraform.mdx
@@ -1,6 +1,12 @@
 ---
-title: Deploy Login Rules via Terraform 
+title: Deploying Login Rules via Terraform 
+sidebar_label: Login Rules (Terraform)
 description: Use Teleport's Terraform Provider to deploy Login Rules to your cluster
+tags:
+ - sso
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide will explain how to:
@@ -8,9 +14,17 @@ This guide will explain how to:
 - Use Teleport's Terraform Provider to deploy Login Rules to your Teleport cluster
 - Edit deployed Login Rules via Terraform
 
+## How it works
+
+Login Rules are registered with the Teleport Auth Service as resources stored on
+the Auth Service backend. The Teleport Auth Service exposes a gRPC API that
+enables clients to create, delete, or modify backend resources, including Login
+Rules. The Teleport Terraform Provider can manage agentless SSH services by
+authenticating to the Teleport Auth Service and interacting with its gRPC API.
+
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/managing-resources.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/managing-resources.mdx
similarity index 76%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/managing-resources.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/managing-resources.mdx
index 248c067130040..bd9727d3a02f7 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/managing-resources.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/managing-resources.mdx
@@ -1,7 +1,12 @@
 ---
 title: "Managing Resources with Infrastructure as Code"
+sidebar_label: Managing Resources
+sidebar_position: 1
 description: Provides instructions on managing specific dynamic resources with tctl and the Teleport Terraform provider and Kubernetes operator.
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - infrastructure-as-code
+ - zero-trust
 ---
 
 Read the guides in this section for instructions on managing specific dynamic
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/trusted-cluster.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/trusted-cluster.mdx
similarity index 98%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/trusted-cluster.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/trusted-cluster.mdx
index 7f4533740d4cf..f34cd0f1f95b8 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/trusted-cluster.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/trusted-cluster.mdx
@@ -1,6 +1,11 @@
 ---
 title: Managing Trusted Clusters With IaC
+sidebar_label: Trusted Clusters
 description: Use infrastructure-as-code tooling to create Teleport trusted clusters.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 <Admonition type="note">
@@ -23,7 +28,7 @@ Teleport supports three ways to dynamically create resources from code:
 
 ## Prerequisites
 
-- Access to **two** Teleport cluster instances. Follow the [Run a Self-Hosted Demo Cluster](../../deploy-a-cluster/linux-demo.mdx)
+- Access to **two** Teleport cluster instances. Follow the [Run a Self-Hosted Demo Cluster](../../../get-started/deploy-community.mdx)
   guide to learn how to deploy a self-hosted Teleport cluster on a Linux server.
 
   The two clusters should be at the same version or, at most, the leaf cluster can be one major version
@@ -33,7 +38,7 @@ Teleport supports three ways to dynamically create resources from code:
   For information about how to enroll a resource in your cluster, see
   [Join Services to your Cluster](../../../enroll-resources/agents/agents.mdx).
 
-- Read through the [Configure Trusted Clusters](../../management/admin/trustedclusters.mdx)
+- Read through the [Configure Trusted Clusters](../../deploy-a-cluster/trustedclusters.mdx)
   guide to understand how trusted clusters works.
 
 - The `tctl` admin tool and `tsh` client tool.
@@ -567,4 +572,4 @@ metadata:
     teleport.dev/origin: kubernetes
 ...
 ```
-</Admonition>
\ No newline at end of file
+</Admonition>
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/user-and-role.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/user-and-role.mdx
similarity index 91%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/user-and-role.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/user-and-role.mdx
index 7b75dc050c066..94497c79c141e 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/user-and-role.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/managing-resources/user-and-role.mdx
@@ -1,10 +1,16 @@
 ---
 title: Managing Users And Roles With IaC
+sidebar_label: Users and Roles
 description: Use infrastructure-as-code tooling to create Teleport users and roles.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
+ - privileged-access
 ---
 
 In this guide, you will see how to create users and grant them roles through
-infrastructure as code (IaC). Teleports supports three ways to dynamically
+infrastructure as code (IaC). Teleport supports three ways to dynamically
 create resources from code:
 
 - The Teleport Kubernetes Operator, which allows you to manage Teleport resources
@@ -14,6 +20,15 @@ create resources from code:
 - The `tctl` CLI, which allows you to manage Teleport resources from your local
   computer or your CI environment
 
+## How it works
+
+In Teleport, users and roles are backend resources managed by the Teleport Auth
+Service. The Teleport Auth Service exposes a gRPC API that enables clients to
+create, delete, or modify backend resources, including users and roles. The
+Teleport Kubernetes Operator and Terraform provider, along with the `tctl`
+command-line tool, can manage Teleport users and roles by authenticating to the
+Teleport Auth Service and interacting with its gRPC API.
+
 ## Prerequisites
 
 To follow this guide, you must have:
@@ -192,7 +207,7 @@ We will create 2 users:
   Users created from manifests are local users, as opposed to users coming from
   an external SAML/OIDC/GitHub Identity Provider (IdP).
 
-  See [the user type reference](../../../reference/user-types.mdx) for more details.
+  See [the user type reference](../../../reference/access-controls/user-types.mdx) for more details.
 </Admonition>
 
 <Tabs>
@@ -477,13 +492,13 @@ resource "teleport_user" "bob" {
 - Allow users with the `manager` role to grant access to production servers to
   some `engineers` via Access Lists. Manager will need to justify and review
   granted access periodically.
-  See [the AccessList documentation](../../access-controls/access-lists/access-lists.mdx) for
+  See [the AccessList documentation](../../../identity-governance/access-lists/access-lists.mdx) for
   a high-level explanation of the feature,
   and [the AccessList IaC guide](access-list.mdx) for a step by step IaC
   AccessList setup.
 - Allow users with the `engineer` role to request temporary access to
   production, and have users with the `manager` role validate the requests.
-  See [the Access Requests documentation](../../access-controls/access-requests/access-requests.mdx)
+  See [the Access Requests documentation](../../../identity-governance/access-requests/access-requests.mdx)
 - You can see all supported fields in the references
-  of [the user resource](../../../reference/resources.mdx)
-  and [the role resource](../../../reference/resources.mdx).
+  of [the user resource](../../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx)
+  and [the role resource](../../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/secret-lookup.mdx
similarity index 97%
rename from docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/secret-lookup.mdx
index ca8f2b20e5b60..3473af4b2e794 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/secret-lookup.mdx
@@ -1,6 +1,11 @@
 ---
-title: Looking up values from secrets
+title: Looking up Values from Secrets
+sidebar_label: Secret Lookup
 description: How to store sensitive values in a Kubernetes Secret and have the operator look them up.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide describes how to store sensitive information in Kubernetes Secrets instead
diff --git a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx
similarity index 84%
rename from docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx
index 5a40f1e2bef4a..d4098b6da95d5 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-helm.mdx
@@ -1,6 +1,11 @@
 ---
 title: Kubernetes Operator in teleport-cluster Helm chart
+sidebar_label: Deploy with a Cluster
 description: Deploy the operator alongside your Helm-deployed Teleport Cluster.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide explains how to run the Teleport Kubernetes Operator alongside a Teleport cluster
@@ -12,6 +17,17 @@ If your Teleport cluster is not deployed using the `teleport-cluster` Helm chart
 [the standalone operator guide](./teleport-operator-standalone.mdx) instead.
 </Admonition>
 
+## How it works
+
+The `teleport-cluster` Helm chart includes the `teleport-operator` chart as a
+dependency. If you install the `teleport-cluster` chart with the
+`operator.enabled` values field set to `true`, the chart launches one or more
+pods for the Teleport Kubernetes Operator. It also creates a join token that
+allows the Teleport Kubernetes Operator to establish trust with your Teleport
+cluster, plus a Teleport role and Kubernetes service account for the Operator.
+Finally, the `teleport-operator` chart installs custom resource definitions that
+enable the Operator to manage Teleport resources.
+
 ## Prerequisites
 
 - Kubernetes cluster (with or without `teleport-cluster` Helm chart already deployed);
diff --git a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx
similarity index 89%
rename from docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx
index 4139e661d4921..de8b59dad9a7f 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx
@@ -1,12 +1,33 @@
 ---
 title: Standalone Kubernetes Operator
+sidebar_label: Deploy without a Cluster
 description: Run a standalone operator against a remote Teleport cluster such as Teleport Cloud.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide explains how to run the Teleport Kubernetes Operator against any remote Teleport cluster.
 If your Teleport cluster is deployed using the `teleport-cluster` Helm chart, you might want to follow
 [the guide for Helm-deployed clusters](./teleport-operator-helm.mdx) instead.
 
+## How it works
+
+The Teleport Kubernetes Operator is a Teleport Auth Service client that you
+install using the `teleport-operator` Helm chart. 
+
+For the Operator to manage Teleport resources in your cluster, you need to
+authenticate it with your Teleport cluster and authorize it to manage Teleport
+resources. This requires the following additional resources, which we show you
+how to create in this guide:
+
+- A Teleport role
+- A join token
+- A Machine & Workload Identity Bot
+
+You can then deploy the Operator by installing the `teleport-operator` chart.
+
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
diff --git a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx
similarity index 77%
rename from docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx
index 890421acf2742..ac99d801fabef 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/teleport-operator/teleport-operator.mdx
@@ -1,6 +1,11 @@
 ---
 title: Teleport Kubernetes Operator
+sidebar_label: Kubernetes Operator
 description: Easily manage Teleport resources from Kubernetes
+tags:
+ - infrastructure-as-code
+ - conceptual
+ - zero-trust
 ---
 
 The Teleport Kubernetes Operator provides a way for Kubernetes users to manage some Teleport resources through
@@ -12,10 +17,9 @@ custom resources. The Teleport Kubernetes Operator watches for those resources a
 reach the desired state.  
 
 Since Teleport version 15, the operator can be deployed both:
-- alongside self-hosted Teleport clusters deployed with the `teleport-cluster` Helm chart.
-  This deployment method differs from version 14. In version 15 and above, the operator
-  is no longer deployed as a sidecar. An operator outage cannot affect Teleport's availability.
-- against a remote Teleport instance (such as Teleport Cloud or deployed with Terraform)
+- Alongside self-hosted Teleport clusters deployed with the `teleport-cluster` Helm chart.
+  An operator outage cannot affect Teleport's availability.
+- Against a remote Teleport instance (such as Teleport Cloud or deployed with Terraform)
 
 The operator supports multiple replicas within a single cluster by electing a
 leader with a Kubernetes lease.
@@ -25,22 +29,7 @@ Only one operator deployment should run against a Teleport cluster. Else, differ
 could cause instability and non-deterministic behaviour.
 </Admonition>
 
-Currently supported Teleport resources are:
-- Users (`TeleportUser`)
-- Roles
-  - `TeleportRole` creates role v5
-  - `TeleportRoleV6` creates role v6
-  - `TeleportRoleV7` creates role v7
-- OIDC Connectors (`TeleportOIDCConnector`)
-- SAML Connectors (`TeleportSAMLConnector`)
-- GitHub Connectors (`TeleportGithubConnector`)
-- Provision Tokens (`TeleportProvisionToken`)
-- Login Rules (`TeleportLoginRule`)
-- Access Lists (`TeleportAccessList`)
-- Okta Import Rules (`TeleportOktaImportRule`)
-- OpenSSHEICE Servers (`TeleportOpenSSHEICEServerV2`)
-- OpenSSH Servers (`TeleportOpenSSHServerV2`)
-- Trusted Clusters (`TeleportTrustedClusterV2`)
+Supported Teleport resources are listed in [the Operator Reference Page](../../../reference/infrastructure-as-code/operator-resources/operator-resources.mdx).
 
 ### Setting up the operator
 
@@ -95,4 +84,4 @@ See [the dedicated guide](secret-lookup.mdx) for more details.
 ## Next steps
 
 - Follow the ["Managing users and roles with IaC" guide](../managing-resources/user-and-role.mdx).
-- Check out [access controls documentation](../../access-controls/access-controls.mdx).
+- Check out [access controls documentation](../../authentication/authentication.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx
similarity index 94%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx
index 6c5cd40519cb7..b7e4a374bf4a4 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx
@@ -1,6 +1,12 @@
 ---
 title: Run the Teleport Terraform Provider in CI or Cloud
+sidebar_label: CI or Cloud
 description: How to manage dynamic resources using the Teleport Terraform provider from your CI pipelines or Cloud provider.
+tags:
+ - ci-cd
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guides covers how to run the Teleport Terraform Provider from:
@@ -14,14 +20,14 @@ This guides covers how to run the Teleport Terraform Provider from:
   - GCP (we'll use the `gcp` join method)
 
 <Admonition type="note">
-Running the Terraform provider with native MachineID is supported on Azure, inside a Kubernetes pod,
+Running the Terraform provider with native Machine & Workload Identity is supported on Azure, inside a Kubernetes pod,
 and on servers with Trusted Platform Module (TPM). While those setups are not described in details in this guide,
-you can follow their regular MachineID guides and replace the "Configure `tbot`" step by passing the
+you can follow their regular Machine & Workload Identity guides and replace the "Configure `tbot`" step by passing the
 join method and token to the provider.
 
-- [Azure MachineID guide](../../../enroll-resources/machine-id/deployment/azure.mdx)
-- [Kubernetes MachineID guide](../../../enroll-resources/machine-id/deployment/kubernetes.mdx)
-- [TPM MachineID guide](../../../enroll-resources/machine-id/deployment/linux-tpm.mdx)
+- [Azure Machine & Workload Identity guide](../../../machine-workload-identity/deployment/azure.mdx)
+- [Kubernetes Machine & Workload Identity  guide](../../../machine-workload-identity/deployment/kubernetes.mdx)
+- [TPM Machine & Workload Identity  guide](../../../machine-workload-identity/deployment/linux-tpm.mdx)
 
 HCP Terraform (Terraform Cloud) and self-hosted Terraform Enterprise are
 supported but require special configuration, so refer to our
@@ -42,7 +48,7 @@ In this setup, there is no `tbot` daemon involved as the Terraform provider can
 and join the Teleport cluster.
 
 The setup only works for select runtimes which Teleport
-has [a delegated join method](../../../reference/join-methods.mdx#delegated-join-methods) for (e.g. GitHub Actions,
+has [a delegated join method](../../../reference/deployment/join-methods.mdx#delegated-join-methods) for (e.g. GitHub Actions,
 GitLab CI, ...)
 
 ## Prerequisites
@@ -98,7 +104,7 @@ In this step you will create a token allowing a process to connect to Teleport a
 earlier.
 
 The token type and configuration depends on where the Terraform provider is running.
-See [the joining reference](../../../reference/join-methods.mdx) for more details about the joining process,
+See [the joining reference](../../../reference/deployment/join-methods.mdx) for more details about the joining process,
 the different join methods, types of tokens, and the fields they support.
 
 <Tabs>
@@ -361,8 +367,8 @@ on:
 jobs:
   demo:
     permissions:
-      # The "id-token: write" permission is required or Machine ID will not be
-      # able to authenticate with the cluster.
+      # The "id-token: write" permission is required or Machine & Workload
+      # Identity will not be able to authenticate with the cluster.
       id-token: write
       contents: read
     name: terraform-plan
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/dedicated-server.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server.mdx
similarity index 86%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/dedicated-server.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server.mdx
index 0ff477616ef8f..26d16e86824ae 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/dedicated-server.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server.mdx
@@ -1,6 +1,11 @@
 ---
 title: Run the Teleport Terraform Provider on a Server
-description: How to manage dynamic resources using the Teleport Terraform provider from a dedicated deployment server with MachineID.
+sidebar_label: Dedicated Server
+description: How to manage dynamic resources using the Teleport Terraform provider from a dedicated deployment server with Machine & Workload Identity .
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide demonstrates how to set up the Terraform provider for Teleport on a persistent Linux or macOS server.
@@ -11,12 +16,13 @@ CI/CD and short-lived cloud VMs. If you are in one of those cases, please follow
 - [Run the Terraform Provider in CI or cloud VMs](./ci-or-cloud.mdx)
 - [Run the Terraform Provider locally](./local.mdx)
 
-This guide will setup MachineID on the server. MachineID is Teleport's feature
-for providing identities to machines and services, rather than users.
+This guide will setup Teleport Machine & Workload Identity on the server.
+Machine & Workload Identity provides identities to machines and services, rather
+than human users.
 
 ## How it works
 
-This setup relies on a MachineID daemon (`tbot`) to join the Teleport cluster, obtain and refresh credentials for the
+This setup relies on a Machine & Workload Identity daemon (`tbot`) to join the Teleport cluster, obtain and refresh credentials for the
 Terraform provider. The daemon stores its identity on the disk and refresh the terraform credentials, typically every
 30 minutes.
 
@@ -40,7 +46,7 @@ Terraform provider. The daemon stores its identity on the disk and refresh the t
 ## Step 1/4. Install `tbot` on your server
 
 You must install `tbot` and make it join the Teleport cluster.
-To do so, follow [the `tbot` deployment guide for Linux](../../../enroll-resources/machine-id/deployment/linux.mdx)
+To do so, follow [the `tbot` deployment guide for Linux](../../../machine-workload-identity/deployment/linux.mdx)
 until step 3. 
 
 ## Step 2/4. Configure RBAC
@@ -70,7 +76,7 @@ the Linux user that Terraform will run as.
 Modify your `tbot` configuration to add an `identity` output:
 
 ```yaml
-outputs:
+services:
 - type: identity
   destination:
     type: directory
@@ -99,7 +105,7 @@ $ terraform init
 ```
 
 In order to configure the Teleport Terraform provider to use the credentials
-output by Machine ID, we use the `identity_file_path` option.
+output by Machine & Workload Identity, we use the `identity_file_path` option.
 
 In this directory, create `main.tf`:
 
@@ -158,7 +164,7 @@ $ tctl get role/terraform-test
 ## Next steps
 
 - Explore the
-  [Terraform provider resource reference](../../../reference/terraform-provider/terraform-provider.mdx)
+  [Terraform provider resource reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
   to discover what can be configured with the Teleport Terraform provider.
-- Read the [tbot configuration reference](../../../reference/machine-id/configuration.mdx) to explore
+- Read the [tbot configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
   all the available `tbot` configuration options.
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/env0.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/env0.mdx
new file mode 100644
index 0000000000000..cb1f7cbe0b426
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/env0.mdx
@@ -0,0 +1,229 @@
+---
+title: Run the Teleport Terraform Provider on env zero
+sidebar_label: env zero
+description: How to manage dynamic resources using the Teleport Terraform provider on env zero.
+tags:
+ - ci-cd
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
+---
+
+This guide demonstrates how to use the Terraform provider for Teleport in jobs
+running on [env zero].
+
+This guide does not cover running the Terraform provider locally, in other CI/CD
+environments, or in short-lived cloud VMs. In any of these cases, refer to a
+dedicated guide:
+
+- [Run the Terraform Provider on Terraform Cloud](./terraform-cloud.mdx)
+- [Run the Terraform Provider in CI or cloud VMs](./ci-or-cloud.mdx)
+- [Run the Terraform Provider locally](./local.mdx)
+
+## How it works
+
+When running the Teleport Terraform provider on env zero, you can use its
+built-in Machine & Workload ID support to dynamically authenticate to your
+Teleport cluster without any shared secrets.
+
+To do so, Teleport can make use of env zero's support for
+[General OIDC Integrations][oidc], which provides OIDC tokens to jobs run on
+env zero's platform. The Teleport Terraform provider can then use these tokens
+to prove its identity to your Teleport cluster.
+
+While following this guide, you'll configure your Teleport cluster to accept
+join requests from env zero deployments and configure the provider to
+authenticate using the `env0` join method.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport 18.4.0"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+- [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
+
+  ```code
+  $ terraform version
+  # Terraform v(=terraform.version=)
+  ```
+
+  To import existing Teleport resources as Terraform resources, you must have
+  Terraform version `v1.5.0` or above.
+
+- An account and project on [env zero]
+
+- The Teleport Terraform provider, v18.4.0 or later
+
+## Step 1/5: Enable OIDC in env zero
+
+OIDC integrations must be enabled in your organization's credential settings. To
+do so:
+1. Navigate to your organization settings
+2. Select the "Policies" tab
+3. Under the "Third-Party Authentication" header, ensure "Enable OIDC during deployments" is checked
+4. If necessary, select "Save"
+
+For more information, refer to [env zero's documentation](https://docs.env0.com/docs/oidc-integrations#enabling-oidc-token-availability).
+
+## Step 2/5. Collect information
+
+To allow deployment workflows to authenticate to Teleport, you'll need to
+configure - at a minimum - the IDs of your organization and project. These
+values can be found in the env zero UI.
+
+To determine your organization ID, navigate to your organization's settings,
+select the "General" tab, and make a note of the value shown in the ID field. If
+desired, store your organization ID here: <Var name="example-organization-id" />
+
+Next, you'll also need to retrieve a project ID. Navigate to the settings for
+the desired project and make a note of the ID shown. If desired, you can insert
+it here: <Var name="example-project-id" />
+
+## Step 3/5. Configure env zero joining in Teleport
+
+To start, the Teleport Auth Service needs to be configured to accept join
+requests from env zero runs. We'll do this by creating a bot named `terraform`
+which the Teleport Terraform provider will use in a later step.
+
+Write the following to `terraform_bot.yaml`:
+
+```yaml
+kind: bot
+version: v1
+metadata:
+  name: terraform
+spec:
+  # The terraform-provider role is a built-in role granting access to every
+  # resource supported by the terraform provider.
+  roles: ["terraform-provider"]
+```
+
+Then, create the bot from the new YAML manifest:
+
+```code
+$ tctl create -f terraform_bot.yaml
+bot 'terraform' has been created
+```
+
+Next, the new bot needs to be allowed to authenticate with env zero's [OIDC
+credentials][oidc]. Create a file named `terraform_token.yaml` with this
+content:
+```yaml
+kind: token
+version: v2
+metadata:
+  name: terraform
+spec:
+  roles: [Bot]
+  join_method: env0
+  bot_name: terraform
+  env0:
+    allow:
+      - organization_id: <Var name="example-organization-id" />
+        project_id: <Var name="example-project-id" />
+```
+
+Additional allow rules fields may be used to further restrict which jobs are
+allowed to authenticate , refer to the [`env0` join method reference][reference]
+for a full list of options.
+
+Note that all specified fields must match those presented to Teleport by a
+deployment job for it to be allowed to join. If you want to allow multiple
+different projects to join, you can add additional entries to the `allow` field.
+Additionally, note that each entry must provide at minimum `organization_id` and
+a project identifier (`project_id` or `project_name`).
+
+Once finished, create the token:
+
+```code
+$ tctl create -f terraform_token.yaml
+token 'terraform' has been created
+```
+
+## Step 4/5. Configure the Terraform Provider
+
+In your `provider.tf` or similar, configure the `teleport` provider:
+
+```hcl
+provider "teleport" {
+  addr = "example.teleport.sh:443"
+  join_method = "env0"
+  join_token = "terraform"
+}
+```
+
+These parameters must be set:
+- `addr` should match the public hostname and port of your Teleport cluster
+- `join_method` should be `env0`
+- `join_token` should match the name of the `token` resource created in Step #2
+
+Be sure to remove any preexisting `identity_file_path`; it is replaced by
+`join_method` and `join_token`.
+
+For a complete example, consider this minimal `provider.tf`:
+
+```hcl
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "(=teleport.plugin.version=)"
+    }
+  }
+}
+
+provider "teleport" {
+  addr = "example.teleport.sh:443"
+  join_method = "env0"
+  join_token = "terraform"
+}
+
+resource "teleport_role" "test" {
+  version = "v7"
+  metadata = {
+    name        = "test"
+    description = "Dummy role to validate Terraform Provider setup"
+    labels = {
+      test = "yes"
+    }
+  }
+}
+```
+
+## Step 5/5. Run Terraform
+
+You should now be able to perform a Terraform `plan` or `apply`. All types of
+triggers should work, including CLI, API, and Git, so long as the run is
+coordinated by Terraform Cloud.
+
+If your local `terraform` is authenticated to env zero and
+[Remote Plan][remote-plan] is configured, you can run:
+```code
+$ terraform plan
+```
+
+Otherwise, you can trigger a job execution through whichever means you normally
+use: manually, via a Git hook, etc.
+
+Regardless of trigger, the workflow should successfully execute, depending on
+your Terraform configuration. You can use `tctl` to verify the dummy role was
+created:
+```code
+$ tctl get role/test
+```
+
+## Next steps
+
+- Now that you know how to manage Teleport configuration resources with
+  Terraform and env zero, read the [Terraform resource
+  reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx) so
+  you can flesh out your configuration.
+- To find out more about env zero's OIDC implementation, which Machine &
+  Workload ID uses to authenticate to your Teleport cluster, read
+  [env zero's documentation][oidc].
+
+[env zero]: https://www.env0.com/
+[oidc]: https://docs.envzero.com/guides/integrations/oidc-integrations
+[reference]: ../../../reference/deployment/join-methods.mdx#env0-env0
+[remote-plan]: https://docs.envzero.com/guides/admin-guide/remote-backend/remote-plan
diff --git a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/import-existing-resources.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/import-existing-resources.mdx
similarity index 79%
rename from docs/pages/admin-guides/infrastructure-as-code/managing-resources/import-existing-resources.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/import-existing-resources.mdx
index 4e3a186d6b0c4..ce7ca10bb8e96 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/managing-resources/import-existing-resources.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/import-existing-resources.mdx
@@ -1,6 +1,12 @@
 ---
-title: Import Teleport Resources into Terraform
+title: Importing Teleport Resources into Terraform
+sidebar_label: Importing Resources
+sidebar_position: 2
 description: How to import your existing Teleport resources into Terraform
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide shows you how to import existing dynamic Teleport resources as
@@ -14,6 +20,14 @@ contains `resource` blocks that represent your existing Teleport resources.
 By defining all Teleport resources in one place, you can help ensure that your
 cluster configuration matches your expectations.
 
+## How it works
+
+As with any compliant Terraform provider, the Teleport provider allows you to
+generate a Terraform configuration based on existing resources that the Teleport
+Auth Service has stored on its backend. For all of the Teleport resources that
+the Terraform provider supports, see the [Terraform resource
+reference](../../../reference/infrastructure-as-code/terraform-provider/resources/resources.mdx).
+
 ## Step 1/3. Add an `import` block
 
 1. On your workstation, navigate to your root Teleport Terraform module.
@@ -80,9 +94,9 @@ cluster configuration matches your expectations.
 
 ## Next steps
 
-- Follow [the user and role IaC guide](user-and-role.mdx) to use the Terraform
+- Follow [the user and role IaC guide](../managing-resources/user-and-role.mdx) to use the Terraform
   Provider to create Teleport users and grant them roles.
 - Explore the full list of supported [Terraform provider
-  resources](../../../reference/terraform-provider/terraform-provider.mdx).
+  resources](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
 - See [the list of supported Teleport Terraform
   setups](../terraform-provider/terraform-provider.mdx):
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/local.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/local.mdx
similarity index 93%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/local.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/local.mdx
index e77ae81039e84..36d9753253177 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/local.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/local.mdx
@@ -1,9 +1,14 @@
 ---
 title: Run the Teleport Terraform Provider Locally
+sidebar_label: Local Demos
 description: How to manage dynamic resources using the Teleport Terraform provider from your workstation.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
-This guide covers how to run the Teleport terraform provider from your local computer,
+This guide covers how to run the Teleport Terraform provider from your local computer,
 where you are already logged in Teleport as yourself.
 
 This guide does not cover running Teleport in remote environments such as a cloud VM, an on-prem server,
@@ -20,14 +25,13 @@ connect to Teleport as the temporary bot.
 
 ## Prerequisites
 
-- A running Teleport Cluster whose version is higher than 16.2
+- A running Teleport cluster, version 16.2 or higher
 - Local tsh/tctl clients with versions higher than 16.2
 - Being locally logged in Teleport with a role that allows creating Bot and Token resources.
   You can use the default `editor` role for this.
 
 To check that you can connect to your Teleport cluster, sign in with `tsh login`, then
 verify that you can run `tctl` commands using your current credentials.
-`tctl` is supported on macOS and Linux machines.
 
 For example:
 
@@ -55,7 +59,7 @@ provider. The bot will exist for one hour and will be granted the default `terra
 resource the TF provider supports.
 
 `tctl` will then obtain credentials for the temporary bot and export them in your shell's environment variables.
-If [MFA for Administrative Actions](../../../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx)
+If [MFA for Administrative Actions](../../authentication/mfa-for-admin-actions.mdx)
 is enabled on your cluster, `tctl` will prompt for your MFA.
 
 Run the following command, do not remove the `eval` as it is required to load credentials in your shell:
@@ -160,7 +164,7 @@ Do not forget to obtain new temporary credentials every hour by re-running `eval
   Provider to create Teleport users and grant them roles.
 - Consult the list of Terraform-supported
   resources [in the Terraform
-  reference](../../../reference/terraform-provider/terraform-provider.mdx).
+  reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
 - Once you have working Terraform code that configures your Teleport cluster,
   you might want to run it in the CI or from a bastion instead of running it
   locally. To do this, please follow the dedicated guides:
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx
similarity index 81%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx
index 18c741d33009b..d0b2316693a52 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/long-lived-credentials.mdx
@@ -1,30 +1,46 @@
 ---
 title: Run the Teleport Terraform Provider with Long-Lived Credentials
+sidebar_label: Long-Lived Credentials
 description: How to manage dynamic resources using the Teleport Terraform provider from anywhere with long-lived credentials.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide explains you how to create a Terraform user and have the Teleport Auth Service sign long-lived credentials
 for it. The Teleport Terraform Provider can then user those credentials to interact with Teleport.
 
-<Admonition type="warning">
+## How it works
 
-Long-lived credentials are less secure and their usage is discouraged. You must protect and rotate the credentials as
-they hold full Teleport administrative access. You should prefer
-using [`tbot`](./dedicated-server.mdx), [native MachineID joining](./ci-or-cloud.mdx) in CI or Cloud environments,
-or [create temporary bots for local use](./local.mdx) when possible.
+A Teleport administrator defines a role for the Teleport Terraform provider, as
+well as a role that can
+[impersonate](../../authentication/impersonation.mdx)
+the Terraform provider role. A Teleport user assumes the impersonator role and
+executes a `tctl` command to instruct the Teleport Auth Service to sign a user
+certificate for the Terraform provider. The provider then loads the certificate
+in order to authenticate to your Teleport cluster and manage resources on the
+Teleport Auth Service backend.
 
-See [the list of possible Terraform provider setups](terraform-provider.mdx) to find which one fits your
-use-case.
+<Admonition type="warning">
 
-</Admonition>
+Long-lived credentials are less secure than other Teleport credentials and their
+usage is discouraged. 
 
+</Admonition>
 
-<Admonition type="important">
+You must protect and rotate the credentials as they hold full Teleport
+administrative access. You should prefer using [`tbot`](./dedicated-server.mdx),
+[native Machine & Workload Identity joining](./ci-or-cloud.mdx) in CI or Cloud
+environments, or [create temporary bots for local use](./local.mdx) when
+possible.
 
-Long-lived credentials are not compatible with MFA for administrative actions (MFA4A)
-which is an additional security layer that protects Teleport in case of Identity Provider (IdP) compromise.
+See [the list of possible Terraform provider setups](terraform-provider.mdx) to
+find which one fits your use-case.
 
-</Admonition>
+Long-lived credentials are not compatible with MFA for administrative actions
+(MFA4A) which is an additional security layer that protects Teleport in case of
+Identity Provider (IdP) compromise.
 
 ## Prerequisites
 
@@ -205,8 +221,8 @@ To apply the configuration:
 ## Next steps
 
 - Explore the full list of supported [Terraform provider
-  resources](../../../reference/terraform-provider/terraform-provider.mdx).
+  resources](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
 - Learn [how to manage users and roles with
   IaC](../managing-resources/user-and-role.mdx)
 - Read more about
-  [impersonation](../../access-controls/guides/impersonation.mdx).
+  [impersonation](../../authentication/impersonation.mdx).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/spacelift.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx
similarity index 86%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/spacelift.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx
index 2c63f45986ec6..afd79731d5e6d 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/spacelift.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx
@@ -1,6 +1,12 @@
 ---
 title: Run the Teleport Terraform Provider on Spacelift
+sidebar_label: Spacelift
 description: How to manage dynamic resources using the Teleport Terraform provider on the Spacelift platform.
+tags:
+ - ci-cd
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 You can use Spacelift with the Teleport Terraform provider to manage dynamic
@@ -9,7 +15,8 @@ audit trail of changes to your Teleport configuration and a single source of
 truth for operators to examine.
 
 This guide shows you how to configure the Teleport Terraform Provider to
-authenticate to a Teleport cluster using Machine ID when running on Spacelift.
+authenticate to a Teleport cluster using Machine & Workload Identity when
+running on Spacelift.
 
 ## How it works
 
@@ -24,7 +31,7 @@ resources.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 - A GitHub repository where you will store your Terraform configuration and a
@@ -32,11 +39,11 @@ resources.
 - A paid Spacelift account. This is required to use the `spacelift` join method.
 - Your Teleport user should have the privileges to create token resources.
 
-## Step 1/3. Create a role and Machine ID bot
+## Step 1/3. Create a role and Machine & Workload Identity bot
 
-First, we'll create a Machine ID Bot for our Spacelift job to act as. We'll
-grant it the `terraform-provider` role, which automatically grants access to
-every resource supported by the Teleport terraform provider.
+First, we'll create a Machine & Workload Identity Bot for our Spacelift job to
+act as. We'll grant it the `terraform-provider` role, which automatically grants
+access to every resource supported by the Teleport terraform provider.
 
 Create `bot.yaml`:
 
@@ -191,9 +198,9 @@ earlier:
 
 ![Terraform plan](../../../../img/management/spacelift/pr-run.png)
 
-When running `terraform plan`, the Teleport Terraform Provider uses Machine ID
-to generate the short-lived credentials necessary to authenticate to the
-Teleport cluster.
+When running `terraform plan`, the Teleport Terraform Provider uses Machine &
+Workload Identity to generate the short-lived credentials necessary to
+authenticate to the Teleport cluster.
 
 Merge the PR, then navigate to your stack and click **Runs**. Click the status
 of the first run, which corresponds to merging your PR, to visit the page for
@@ -215,11 +222,8 @@ $ tctl get users/terraform-test
 
 - Now that you know how to manage Teleport configuration resources with
   Terraform and Spacelift, read the [Terraform resource
-  reference](../../../reference/terraform-provider/terraform-provider.mdx) so
+  reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx) so
   you can flesh out your configuration.
-- To find out more about Spacelift's OIDC implementation, which Machine ID uses
-  to authenticate to your Teleport cluster, read [the Spacelift
-  documentation](https://docs.spacelift.io/integrations/cloud-providers/oidc/).
-- Learn how you can help achieve secure access for service accounts by sending
-  [anonymous Machine ID telemetry](../../../reference/machine-id/telemetry.mdx).
-
+- To find out more about Spacelift's OIDC implementation, which Machine &
+  Workload Identity uses to authenticate to your Teleport cluster, read
+  [the Spacelift documentation](https://docs.spacelift.io/integrations/cloud-providers/oidc/).
diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud.mdx
similarity index 95%
rename from docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx
rename to docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud.mdx
index cc2e6b00cf1c1..b88b0b685448b 100644
--- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-cloud.mdx
@@ -1,6 +1,12 @@
 ---
 title: Run the Teleport Terraform Provider on Terraform Cloud
+sidebar_label: Terraform Cloud
 description: How to manage dynamic resources using the Teleport Terraform provider on HCP Terraform, Terraform Cloud, and Terraform Enterprise.
+tags:
+ - ci-cd
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
 ---
 
 This guide demonstrates how to use the Terraform provider for Teleport using
@@ -22,10 +28,10 @@ dedicated guide:
 </Admonition>
 
 When running the Teleport Terraform provider on Terraform Cloud, you can use its
-built-in Machine ID support to dynamically authenticate to your Teleport cluster
-without any shared secrets. When run in this configuration, the Terraform
-provider proves its identity to the Teleport Auth Service using Terraform
-Cloud's [Workload Identity][tf-workload-id] tokens.
+built-in Machine & Workload Identity support to dynamically authenticate to your
+Teleport cluster without any shared secrets. When run in this configuration, the
+Terraform provider proves its identity to the Teleport Auth Service using
+Terraform Cloud's [Workload Identity][tf-workload-id] tokens.
 
 While following this guide, you'll configure your Teleport cluster to accept
 join requests from Terraform Cloud runs and configure the provider to
@@ -39,7 +45,7 @@ provider in these environments.
 
 ## Prerequisites
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx
new file mode 100644
index 0000000000000..ffc154db60233
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-getting-started.mdx
@@ -0,0 +1,1111 @@
+---
+title: Get Started with the Teleport Terraform Provider
+sidebar_label: Getting Started
+description: Provides an example to help you get started managing dynamic resources in a Teleport cluster using Terraform.
+tags:
+ - infrastructure-as-code
+ - how-to
+ - zero-trust
+---
+
+This guide provides an example of a Terraform module that manages Teleport
+resources in production. The guide helps you to understand the Teleport
+resources to manage with Terraform in order to accomplish common Teleport setup
+tasks. You can use the example module as a starting point for managing a
+complete set of Teleport cluster resources.
+
+## How it works
+
+This guide shows you how to use a Terraform module that serves two purposes:
+joining Teleport Agents to your cluster and configure role-based access control
+for infrastructure resources.
+
+### Joining Teleport Agents
+
+An Agent is a Teleport instance configured to run one or more Teleport services
+in order to proxy infrastructure resources (see [Introduction to Teleport
+Agents](../../../enroll-resources/agents/agents.mdx)). There are several methods
+you can use to join a Teleport Agent to your cluster, which we discuss in the
+[Joining Services to your Cluster](../../../enroll-resources/agents/agents.mdx)
+guide. In this guide, we will use the **join token** method, where the operator
+stores a secure token on the Auth Service, and an Agent presents the token in
+order to join a cluster.
+
+The Terraform module enrolls resources such as Linux servers, databases, and
+Kubernetes clusters by deploying a pool of Teleport Agents on virtual machine
+instances. You can then declare dynamic infrastructure resources with Terraform
+or change the configuration file provided to each Agent.
+
+### Configuring role-based access control
+
+The module also configures Teleport role-based access controls to provide
+different levels of access to the resources. It also configures Access Requests,
+available in Teleport Identity Governance, so that users authenticate with less
+privileged roles by default but can request access to more privileged roles. An
+authentication connector lets users authenticate to Teleport using a Single
+Sign-On provider.
+
+## Prerequisites
+
+- A running Teleport (v16.2.0 or higher) cluster. If you do not have one, read
+  [Getting Started](../../../get-started/get-started.mdx).
+
+<Admonition type="tip">
+
+We recommend following this guide on a fresh Teleport demo cluster. After you
+are familiar with the setup, apply the lessons from this guide to protect your
+infrastructure. You can get started with a demo cluster using:
+- A demo deployment on a [Linux server](../../../get-started/deploy-community.mdx)
+- A [Teleport Enterprise (Cloud) trial](https://goteleport.com/signup)
+
+</Admonition>
+
+- An AWS, Google Cloud, or Azure account with permissions to create virtual
+  machine instances.
+  
+- Cloud infrastructure that enables virtual machine instances to connect to the
+  Teleport Proxy Service. For example:
+  - An AWS subnet with a public NAT gateway or NAT instance
+  - Google Cloud NAT
+  - Azure NAT Gateway
+
+  In minimum-security demo clusters, you can also configure the VM instances you
+  deploy to have public IP addresses.
+
+- [Optional] If adding a Single Sign-On authentication connector, an identity
+  provider that supports OIDC or SAML. You should have either:
+  - The ability to modify SAML attributes or OIDC claims in your organization.
+  - Pre-existing groups of users that you want to map to two levels of access:
+    the ability to connect to `dev` resources; and the ability to review Access
+    Requests for `prod` access.
+
+- [Optional] If adding a Single Sign-On authentication connector, an app
+  registered with your IdP for your Teleport cluster. The following guides show
+  you how to set up your IdP to support the SAML or OIDC authentication
+  connector. **Read only the linked section**, since these guides assume you are
+  using `tctl` instead of Terraform to manage authentication connectors:
+  - [AD FS](../../sso/integrate-idp/adfs.mdx#step-13-configure-adfs)
+  - [GitLab](../../sso/integrate-idp/gitlab.mdx#step-13-configure-gitlab)
+  - [Google
+    Workspace](../../sso/integrate-idp/google-workspace.mdx#step-13-configure-google-workspace)
+  - [OneLogin](../../sso/integrate-idp/one-login.mdx#step-13-create-teleport-application-in-onelogin)
+  - [Entra ID](../../sso/integrate-idp/entra-id.mdx#step-13-configure-microsoft-entra-id)
+  - [Okta](../../sso/integrate-idp/okta.mdx#step-13-configure-okta)
+
+- To help with troubleshooting, we recommend completing the setup steps in this
+  guide with a local user that has the preset `editor` and `auditor` roles. In
+  production, you can apply the lessons in this guide using a less privileged
+  user.
+
+- Terraform v(=terraform.version=) or higher.
+
+## Step 1/7. Import the Terraform module
+
+To configure the `terraform-starter` module, you will clone the
+`gravitational/teleport` repository from GitHub and copy child modules into a
+project directory. After finishing this guide and becoming familiar with the
+setup, you can modify your Terraform configuration to accommodate your
+infrastructure in production.
+
+1. Navigate to your Terraform project directory.
+
+1. Fetch the Teleport code repository and copy the example Terraform
+   configuration for this project into your current working directory. 
+
+   ```code
+   $ git clone --depth=1 https://github.com/gravitational/teleport teleport-clone --branch=branch/v(=teleport.major_version=)
+   ```
+
+## Step 2/7. Add provider configurations
+
+In this step, you will configure the `terraform-starter` module for your
+Teleport cluster and cloud provider.
+
+In your Terraform project directory, ensure that the file called `provider.tf`
+includes the following content, depending on which cloud provider you plan to
+use to deploy Teleport Agents:
+
+<Tabs>
+<TabItem label="AWS">
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.0"
+    }
+
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> (=teleport.major_version=).0"
+    }
+  }
+}
+
+provider "aws" {
+  region = AWS_REGION
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Enterprise (Cloud) tenant URL's host:port
+  addr               = PROXY_SERVICE_ADDRESS
+}
+```
+
+Replace the following placeholders:
+
+| Placeholder           | Value                                                                        |
+|-----------------------|------------------------------------------------------------------------------|
+| AWS_REGION            | The AWS region where you will deploy Agents, e.g., `us-east-2`               |
+| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
+
+</TabItem>
+<TabItem label="Google Cloud">
+```hcl
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.5.0"
+    }
+
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> (=teleport.major_version=).0"
+    }
+  }
+}
+
+provider "google" {
+  project = GOOGLE_CLOUD_PROJECT
+  region  = GOOGLE_CLOUD_REGION
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Enterprise (Cloud) tenant URL's host:port
+  addr               = PROXY_SERVICE_ADDRESS
+}
+```
+
+Replace the following placeholders:
+
+| Placeholder           | Value                                                                        |
+|-----------------------|------------------------------------------------------------------------------|
+| GOOGLE_CLOUD_PROJECT| Google Cloud project where you will deploy Agents. |
+| GOOGLE_CLOUD_REGION | Google Cloud region where you will deploy Agents. |
+| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
+
+
+</TabItem>
+<TabItem label="Azure">
+```hcl
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.0.0"
+    }
+
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> (=teleport.major_version=).0"
+    }
+  }
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Cloud tenant URL's host:port
+  addr               = PROXY_SERVICE_ADDRESS
+}
+
+provider "azurerm" {
+  features {}
+}
+```
+
+Replace the following placeholders:
+
+|Placeholder|Value|
+|---|---|
+| PROXY_SERVICE_ADDRESS | The host and port of the Teleport Proxy Service, e.g., `example.teleport.sh:443` |
+
+</TabItem>
+</Tabs>
+
+## Step 3/7. Configure Agent deployments
+
+Configure your Terraform project to deploy Teleport Agents:
+
+1. Copy the appropriate child module for your cloud provider into a subdirectory
+   called `cloud` and HCL configurations for Teleport resources into a
+   subdirectory called `teleport`:
+
+   <Tabs>
+   <TabItem label="AWS">
+
+   ```code
+   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
+   $ cp -R teleport-clone/examples/terraform-starter/aws cloud
+   ```
+
+   </TabItem>
+   <TabItem label="Google Cloud">
+
+   ```code
+   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
+   $ cp -R teleport-clone/examples/terraform-starter/gcp cloud
+   ```
+
+   </TabItem>
+   <TabItem label="Azure">
+
+   ```code
+   $ cp -R teleport-clone/examples/terraform-starter/agent-installation teleport
+   $ cp -R teleport-clone/examples/terraform-starter/azure cloud
+   ```
+
+   </TabItem>
+   </Tabs>
+
+1. Create a file called `agent.tf` with the following content, which configures
+   the child modules you downloaded in the previous step:
+
+   <Tabs>
+   <TabItem label="AWS">
+   
+   ```hcl
+   module "agent_installation_dev" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "dev"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_installation_prod" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "prod"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_deployment" {
+     region           = ""
+     source           = "./cloud"
+     subnet_id        = ""
+     userdata_scripts = concat(
+       module.agent_installation_dev.userdata_scripts,
+       module.agent_installation_prod.userdata_scripts
+     )
+   }
+   ```
+   
+   </TabItem>
+   <TabItem label="Google Cloud">
+   
+   ```hcl
+   module "agent_installation_dev" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "dev"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_installation_prod" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "prod"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_deployment" {
+     gcp_zone         = "us-east1-b"
+     google_project   = ""
+     source           = "./cloud"
+     subnet_id        = ""
+     userdata_scripts = concat(
+       module.agent_installation_dev.userdata_scripts,
+       module.agent_installation_prod.userdata_scripts
+     )
+   }
+   ```
+   
+   </TabItem>
+   <TabItem label="Azure">
+   
+   ```hcl
+   module "agent_installation_dev" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "dev"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_installation_prod" {
+     source      = "./teleport"
+     agent_count = 1
+     agent_labels = {
+       env = "prod"
+     }
+     proxy_service_address = "teleport.example.com:443"
+     teleport_edition      = "cloud"
+     teleport_version      = "(=teleport.version=)"
+   }
+   
+   module "agent_deployment" {
+     azure_resource_group = ""
+     public_key_path      = ""
+     region               = "East US"
+     source               = "./cloud"
+     subnet_id            = ""
+     userdata_scripts     = concat(
+       module.agent_installation_dev.userdata_scripts,
+       module.agent_installation_prod.userdata_scripts
+     )
+   }
+   ```
+   
+   </TabItem>
+   </Tabs>
+
+Each of the `agent_installation_*` module blocks produces a number of
+installation scripts equal to the `agent_count` input. Each installation script
+runs the Teleport SSH Service with a Teleport join token, labeling the Agent
+with the key/value pairs specified in `agent_labels`. This configuration passes
+all installation scripts to the `agent_deployment` module in order to run them
+on virtual machines, launching one VM per script.
+
+As you scale your Teleport usage, you can increase this count to ease the load
+on each Agent. 
+
+Edit the `agent_installation_dev` and `agent_installation_prod` blocks in
+`agent.tf` as follows:
+
+1. Assign `proxy_service_address` to the host and HTTPS port of your Teleport
+   Proxy Service, e.g., `mytenant.teleport.sh:443`.
+
+   <Admonition type="tip">
+   
+   Make sure to include the port.
+   
+   </Admonition>
+
+1. Make sure `teleport_edition` matches your Teleport edition. Assign this to
+   `oss`, `cloud`, or `enterprise`. The default is `oss`.
+
+1. If needed, change the value of `teleport_version` to the version of Teleport
+   you want to run on your Agents. It must be either the same major version as
+   your Teleport cluster or one major version behind.
+
+Edit the `module "agent_deployment"` block in `agent.tf` as follows:
+
+1. If you are deploying your instance in a minimum-security demo environment and
+   do not have a NAT gateway, NAT instance, or other method for connecting your
+   instances to the Teleport Proxy Service, modify the `module` block to
+   associate a public IP address with each Agent instance: 
+
+   ```hcl
+   insecure_direct_access=true
+   ```
+
+1. Assign the remaining input variables depending on your cloud provider:
+
+   <Tabs>
+   <TabItem label="AWS">
+   
+   1. Assign `region` to the AWS region where you plan to deploy Teleport Agents,
+      such as `us-east-1`.
+   1. For `subnet_id`, include the ID of the subnet where you will deploy Teleport
+      Agents.
+   
+   </TabItem>
+   <TabItem label="Google Cloud">
+   
+   1. Assign `google_project` to the name of your Google Cloud project and
+      `gcp_zone` to the zone where you will deploy Agents, such as `us-east1-b`.
+
+   1. For `subnet_id`, include the name or URI of the Google Cloud subnet where you
+      will deploy the Teleport Agents.
+   
+      The subnet URI has the format:
+   
+      ```
+      projects/PROJECT_NAME/regions/REGION/subnetworks/SUBNET_NAME
+      ```
+   
+   </TabItem>
+   <TabItem label="Azure">
+   
+   1. Assign `azure_resource_group` to the name of the Azure resource group where
+      you are deploying Teleport Agents.
+   
+   1. The module uses `public_key_path` to pass validation, as Azure VMs must
+      include an RSA public key with at least 2048 bits. Once the module deploys
+      the VMs, a cloud-init script removes the public key and disables OpenSSH. Set
+      this input to the path to a valid public SSH key.
+   
+   1. Assign `region` to the Azure region where you plan to deploy Teleport Agents,
+      such as `East US`.
+   
+   1. For `subnet_id`, include the ID of the subnet where you will deploy Teleport
+      Agents. Use the following format:
+   
+      ```text
+      /subscriptions/SUBSCRIPTION/resourceGroups/RESOURCE_GROUP/providers/Microsoft.Network/virtualNetworks/NETWORK_NAME/subnets/SUBNET_NAME
+      ```
+   
+   </TabItem>
+   </Tabs>
+
+## Step 4/7. Configure role-based access control
+
+After configuring Teleport Agent deployments, configure role-based access
+control so Teleport users can access only the infrastructure resources they need
+to:
+
+1. Since you will enable users to authenticate to Teleport through your
+   organization's identity provider (IdP), the modules depend on whether your
+   organization uses OIDC or SAML to communicate with services:
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   ```code
+   $ cp -R teleport-clone/examples/terraform-starter/env_role env_role
+   $ cp -R teleport-clone/examples/terraform-starter/oidc oidc
+   ```
+   </TabItem>
+   <TabItem label="SAML">
+
+   ```code
+   $ cp -R teleport-clone/examples/terraform-starter/env_role env_role
+   $ cp -R teleport-clone/examples/terraform-starter/saml saml
+   ```
+
+   </TabItem>
+   </Tabs>
+
+   Your project directory will include two new modules: 
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   |Name|Description|
+   |---|---|
+   |`env_role`|A module for a Teleport role that grants access to resources with a specific `env` label.|
+   |`oidc`|Teleport resources to configure an OIDC authentication connector and require that users authenticate with it.|
+
+   </TabItem>
+   <TabItem label="SAML">
+
+   |Name|Description|
+   |---|---|
+   |`env_role`|A module for a Teleport role that grants access to resources with a specific `env` label.|
+   |`saml`|Teleport resources to configure a SAML authentication connector and require that users authenticate with it.|
+
+   </TabItem>
+   </Tabs>
+
+1. Create a file called `rbac.tf` that includes the following `module` blocks: 
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   ```hcl
+   module "oidc" {
+     source               = "./oidc"
+     oidc_claims_to_roles = []
+     oidc_client_id       = ""
+     oidc_connector_name  = "Log in with OIDC"
+     oidc_redirect_url    = ""
+     oidc_secret          = ""
+     teleport_domain      = ""
+   }
+   
+   module "prod_role" {
+     source        = "./env_role"
+     env_label     = "prod"
+     principals    = {}
+     request_roles = []
+   }
+
+   module "dev_role" {
+     source        = "./env_role"
+     env_label     = "dev"
+     principals    = {}
+     request_roles = [module.prod_role.role_name]
+   }
+   ```
+   </TabItem>
+   <TabItem label="SAML">
+
+   ```hcl
+   module "saml" {
+     source                   = "./saml"
+     saml_connector_name      = "Log in with SAML"
+     saml_attributes_to_roles = []
+     saml_acs                 = ""
+     saml_entity_descriptor   = ""
+     teleport_domain          = ""
+   }
+   
+   module "prod_role" {
+     source        = "./env_role"
+     env_label     = "prod"
+     principals    = {}
+     request_roles = []
+   }
+   
+   module "dev_role" {
+     source        = "./env_role"
+     env_label     = "dev"
+     principals    = {}
+     request_roles = [module.prod_role.role_name]
+   }
+   ```
+   </TabItem>
+   </Tabs>
+
+Next, we will show you how to configure the two child modules, and walk you
+through the Terraform resources that they apply.
+
+
+## Step 5/7. Configure role principals
+
+Together, the `prod_role` and `dev_role` modules you declared in Step 1 create
+three Teleport roles:
+
+|Role|Description|
+|---|---|
+|`prod_access`|Allows access to infrastructure resources with the `env:prod` label.|
+|`dev_access`|Allows access to infrastructure resources with the `env:dev` label, and Access Requests for the `prod_access` role.|
+|`prod_reviewer`|Allows reviews of Access Requests for the `prod_access` role.|
+
+When Teleport users connect to resources in your infrastructure, they assume a
+principal, such as an operating system login or Kubernetes user, in order to
+interact with those resources. In this step, you will configure the `prod_role`
+and `dev_role` modules to grant access to principals in your infrastructure.
+
+In `rbac.tf`, edit the `prod_role` and `dev_role` blocks so that the
+`principals` field contains a mapping, similar to the example below. Use the
+list of keys below the example to configure the principals.
+
+```hcl
+module "prod_role" {
+  principals = {
+    KEY = "value"
+  }
+  // ...
+}
+
+// ...
+```
+
+|Key|Description|
+|---|---|
+|`aws_role_arns`|AWS role ARNs the user can access when authenticating to an AWS API.|
+|`azure_identities`|Azure identities the user can access when authenticating to an Azure API.|
+|`db_names`|Names of databases the user can access within a database server.|
+|`db_roles`|Roles the user can access on a database when they authenticate to a database server.|
+|`db_users`|Users the user can access on a database when they authenticate to a database server.|
+|`gcp_service_accounts`|Google Cloud service accounts the user can access when authenticating to a Google Cloud API.|
+|`kubernetes_groups`|Kubernetes groups the Teleport Database Service can impersonate when proxying requests from the user.|
+|`kubernetes_users`|Kubernetes users the Teleport Database Service can impersonate when proxying requests from the user.|
+|`logins`|Operating system logins the user can access when authenticating to a Linux server.|
+|`windows_desktop_logins`|Operating system logins the user can access when authenticating to a Windows desktop.|
+
+For example, the following configuration allows users with the `dev_access` role
+to assume the `dev` login on Linux hosts and the `developers` group on
+Kubernetes. `prod` users have more privileges and can assume the `root` login
+and `system:masters` Kubernetes group:
+
+```hcl
+module "dev_role" {
+  principals = {
+    logins            = ["dev"]
+    kubernetes_groups = ["developers"]
+  }
+  // ...
+}
+
+module "prod_role" {
+  principals = {
+    logins            = ["root"]
+    kubernetes_groups = ["system:masters"]
+  }
+  // ...
+}
+```
+
+## Step 6/7. [Optional] Configure the single sign-on connector
+
+In this step, you will configure your Terraform module to enable authentication
+through your organization's IdP. Configure the `saml` or `oidc` module you
+declared in Step 1 by following the instructions.
+
+<Admonition type="tip">
+
+You can skip this step for now if you want to assign the `dev_access` and
+`prod_access` roles to local Teleport users instead of single sign-on users. To
+do so, you can:
+
+- Import existing `teleport_user` resources and modify them to include the
+  `dev_access` and `prod_access` roles (see the
+  [documentation](import-existing-resources.mdx)).
+- Create a new `teleport_user` resource that includes the roles
+  ([documentation](../managing-resources/user-and-role.mdx).
+
+If you plan to skip this step, make sure to remove the `module "saml"` or
+`module "oidc"` block from your Terraform configuration.
+
+</Admonition>
+
+1. Configure the redirect URL (for OIDC) or assertion consumer service (for SAML):
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   Set `oidc_redirect_url` to
+   `https://example.teleport.sh:443/v1/webapi/oidc/callback`, replacing
+   `example.teleport.sh` with the domain name of your Teleport cluster. 
+
+   Ensure that `oidc_redirect_url` matches match the URL you configured with
+   your IdP when registering your Teleport cluster as a relying party.
+
+   </TabItem>
+   <TabItem label="SAML">
+
+   Set `saml_acs` to `https://example.teleport.sh:443/v1/webapi/saml/acs`,
+   replacing `example.teleport.sh` with the domain name of your Teleport
+   cluster. 
+
+   Ensure that `saml_acs` matches the URL you configured with your IdP when
+   registering your Teleport cluster as a relying party.
+
+   </TabItem>
+   </Tabs>
+
+1. After you register Teleport as a relying party, your identity provider will
+   print information that you will use to configure the authentication
+   connector. Fill in the information depending on your provider type:
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   Fill in the `oidc_client_id` and `oidc_secret` with the client ID and secret
+   returned by the IdP.
+
+   </TabItem>
+   <TabItem label="SAML">
+
+   Assign `saml_entity_descriptor` to the contents of the XML document that
+   contains the SAML entity descriptor for the IdP.
+
+   </TabItem>
+   </Tabs>
+
+1. Assign `teleport_domain` to the domain name of your Teleport Proxy Service,
+   with no scheme or path, e.g., `example.teleport.sh`. The child module uses
+   this to configure WebAuthn for local users. This way, you can authenticate as
+   a local user as a fallback if you need to troubleshoot your single sign-on
+   authentication connector.
+
+1. Configure role mapping for your authentication connector. When a user
+   authenticates to Teleport through your organization's IdP, Teleport assigns
+   roles to the user based on your connector's role mapping configuration:
+
+   <Tabs>
+   <TabItem label="OIDC">
+
+   In this example, users with a `group` claim with the `developers` value
+   receive the `dev_access` role, while users with a `group` claim with the
+   value `admins` receive the `prod_reviewer` role:
+
+   ```hcl
+        oidc_claims_to_roles = [
+          {
+            claim = "group"
+            value = "developers"
+            roles = [
+              module.dev_role.role_name
+            ]
+          },
+          {
+            claim = "group"
+            value = "admins"
+            roles = module.dev_role.reviewer_role_names
+          }
+        ]
+   ```
+
+   Edit the `claim` value for each item in `oidc_claims_to_roles` to match the
+   name of an OIDC claim you have configured on your IdP. 
+
+   </TabItem>
+   <TabItem label="SAML">
+
+   In this example, users with a `group` attribute with the `developers` value
+   receive the `dev_access` role, while users with a `group` attribute with the
+   value `admins` receive the `prod_reviewer` role:
+
+   ```hcl
+        saml_attributes_to_roles = [
+          {
+            name  = "group"
+            value = "developers"
+            roles = [
+              module.dev_role.role_name
+            ]
+          },
+          {
+            name  = "group"
+            value = "admins"
+            roles = module.dev_role.reviewer_role_names
+          }
+        ]
+   ```
+
+   </TabItem>
+   </Tabs>
+
+## Step 7/7. Apply and verify
+
+In this step, you will ensure that your Terraform configuration works as
+expected by applying it against your demo cluster.
+
+### Apply your Terraform configuration
+
+In this step, you will create a Teleport bot to apply your Terraform
+configuration. The bot will exist for one hour and will be granted the default
+`terraform-provider` role that can edit every resource the TF provider supports.
+
+1. Navigate to your Terraform project directory and run the following command.
+   The `eval`command assigns environment variables in your shell to credentials
+   for the Teleport Terraform provider:
+
+   ```code
+   $ eval "$(tctl terraform env)"
+   🔑 Detecting if MFA is required
+   This is an admin-level action and requires MFA to complete
+   Tap any security key
+   Detected security key tap
+   ⚙️ Creating temporary bot "tctl-terraform-env-82ab1a2e" and its token
+   🤖 Using the temporary bot to obtain certificates
+   🚀 Certificates obtained, you can now use Terraform in this terminal for 1h0m0s
+   ```
+
+1. Make sure your cloud provider credentials are available to Terraform using
+   the standard approach for your organization.
+
+1. Apply the Terraform configuration:
+
+   ```code
+   $ terraform init
+   $ terraform apply
+   ```
+
+### Verify that agents have deployed
+
+Once the `apply` command completes, run the following command to verify that
+your Agents have deployed successfully. This command, which assumes that the
+Agents have the `Node` role, lists all Teleport SSH Service instances with the
+`role=agent-pool` label:
+
+```code
+$ tsh ls role=agent-pool
+Node Name                  Address    Labels
+-------------------------- ---------- ---------------
+ip-10-1-1-187.ec2.internal ⟵ Tunnel   role=agent-pool
+ip-10-1-1-24.ec2.internal  ⟵ Tunnel   role=agent-pool
+```
+
+### Verify access controls
+
+1. Open the Teleport Web UI in a browser and sign in to Teleport as a user on
+   your IdP with the `groups` trait assigned to the value that you mapped to the
+   role in your authentication connector. Your user should have the `dev_access`
+   role.
+
+   <Admonition type="tip">
+
+   If you receive errors logging in using your authentication connector, log in
+   as a local user with permissions to view the Teleport audit log. These is
+   available in the preset `auditor` role. Check for error messages in events
+   related with the "SSO Login" type.
+
+   </Admonition>
+
+1. Request access to the `prod_access` role through the Web UI. Visit the
+   "Access Requests" tab and click "New Request".
+
+1. Sign out of the Web UI and, as a user in a group that you mapped to the
+   `prod_access` role, sign in. In the "Access Requests" tab, you should be able
+   to see and resolve the Access Request you created.
+
+## Further reading: How the module works
+
+In this section, we explain the resources configured in the
+`terraform-starter` module.
+
+We encourage you to copy and customize these configurations in order to refine
+your settings and choose the best reusable interface for your environment.
+
+### Join token
+
+The `terraform-starter` module deploys one virtual machine instance for each
+Teleport Agent. Each Agent joins the cluster using a token. We create each token
+using the `teleport_provision_token` Terraform resource, specifying the token's
+value with a `random_string` resource:
+
+```hcl
+(!examples/terraform-starter/agent-installation/token.tf!)
+```
+
+When we apply the `teleport_provision_token` resources, the Teleport Terraform
+provider creates them on the Teleport Auth Service backend. 
+
+### User data script
+
+Each Teleport Agent deployed by the `terraform-starter` module loads a user
+data script that creates a Teleport configuration file for the Agent: 
+
+```text
+(!examples/terraform-starter/agent-installation/userdata!)
+```
+
+The configuration adds the `role: agent-pool` label to the Teleport SSH Service
+on each instance. This makes it easier to access hosts in the Agent pool later.
+It also adds the labels you configured using the `agent_labels` input of the
+module.
+
+The script makes Teleport the only option for accessing Agent instances by
+disabling OpenSSH on startup and deleting any authorized public keys.
+
+### Virtual machine instances
+
+Each cloud-specific child module of `terraform-starter` declares resources to
+deploy a virtual machine instance on your cloud provider:
+
+<Tabs>
+<TabItem label="AWS">
+
+`ec2-instance.tf` declares a data source for an Amazon Linux 2023 machine image
+and uses it to launch EC2 instances that run Teleport Agents with the
+`teleport_provision_token` resource:
+
+```hcl
+(!examples/terraform-starter/aws/ec2-instance.tf!)
+```
+
+</TabItem>
+<TabItem label="Google Cloud">
+
+`gcp-instance.tf` declares Google Compute Engine instances that use the
+`teleport_provision_token` to run Teleport Agents:
+
+```hcl
+(!examples/terraform-starter/gcp/gcp-instance.tf!)
+```
+
+</TabItem>
+<TabItem label="Azure">
+
+`azure-instance.tf` declares an Azure virtual machine resource to run Teleport
+Agents using the `teleport_provision_token` resource, plus the required network
+interface for each instance. 
+
+Note that while Azure VM instances require a user account, this module declares
+a temporary one to pass validation, but uses Teleport to enable access to the
+instances:
+
+```hcl
+(!examples/terraform-starter/azure/azure-instance.tf!)
+```
+
+</TabItem>
+</Tabs>
+
+### The `env_access` role
+
+The `env_role` child module creates Teleport roles with the ability to access
+Teleport-protected resources with the `env` label:
+
+```hcl
+(!examples/terraform-starter/env_role/env_role.tf!)
+```
+
+The role hardcodes an `allow` rule with the ability to access applications,
+databases, Linux servers, Kubernetes clusters, and Windows desktops with the
+user-configured `env` label. 
+
+Since we cannot predict which principals are available in your infrastructure,
+this role leaves the `aws_role_arns`, `logins`, and other principal-related role
+attributes for the user to configure.
+
+The role also configures an `allow` rule that enables users to request access
+for the roles configured in the `request_roles` input variable.
+
+An `output` prints the name of the role to allow us to create a dependency
+relationship between this role and an authentication connector.
+
+### The `env_access_reviewer` role
+
+If `var.request_roles` in the `env_access` role is nonempty, the `env_role`
+module creates a role that can review those roles. This is a separate role to
+make permissions more composable:
+
+```hcl
+(!examples/terraform-starter/env_role/reviewer.tf!)
+```
+
+As with the `env_access` role, there is an output to print the name of the
+`env_access_reviewer` role to create a dependency relationship with the
+authentication connector.
+
+### Configuring an authentication connector
+
+The authentication connector resources are minimal. Beyond providing the
+attributes necessary to send and receive Teleport OIDC and SAML messages, the
+connectors configure role mappings based on user-provided values:
+
+<Tabs>
+<TabItem label="OIDC">
+
+```hcl
+(!examples/terraform-starter/oidc/oidc_connector.tf!)
+```
+</TabItem>
+<TabItem label="SAML">
+
+```hcl
+(!examples/terraform-starter/saml/saml.tf!)
+```
+
+</TabItem>
+</Tabs>
+
+Since the role mappings inputs are composite data types, we add a complex type
+definition when declaring the input variables for the `oidc` and `saml` child
+modules:
+
+<Tabs>
+<TabItem label="OIDC">
+
+```hcl
+(!examples/terraform-starter/oidc/inputs.tf!)
+```
+</TabItem>
+<TabItem label="SAML">
+
+```hcl
+(!examples/terraform-starter/saml/inputs.tf!)
+```
+</TabItem>
+</Tabs>
+
+For each authentication connector, we declare a cluster authentication
+preference that enables the connector. The cluster authentication preference
+enables local user login with WebAuthn as a secure fallback in case you need to
+troubleshoot the single sign-on provider.
+
+<Tabs>
+<TabItem label="OIDC">
+
+```hcl
+(!examples/terraform-starter/oidc/auth_pref.tf!)
+```
+</TabItem>
+<TabItem label="SAML">
+
+```hcl
+(!examples/terraform-starter/saml/auth_pref.tf!)
+```
+</TabItem>
+</Tabs>
+
+
+## Next steps
+
+In this guide, we showed you how to use Terraform to deploy a pool of Teleport
+Agents in order to enroll infrastructure resources with Teleport. While the
+guide showed you how to enroll resources dynamically, by declaring Terraform
+resources for each infrastructure resource you want to enroll, you can protect
+more of your infrastructure with Teleport by:
+
+- Configuring Auto-Discovery
+- Configuring resource enrollment
+
+### Configure Auto-Discovery
+
+For a more scalable approach to enrolling resources than the one shown in this
+guide, configure the Teleport Discovery Service to automatically detect
+resources in your infrastructure and enroll them with the Teleport Auth Service.
+
+To configure the Teleport Discovery Service:
+
+1. Edit the userdata script run by the Agent instances managed in the Terraform
+   starter module. Follow the [Auto-Discovery
+   guides](../../../enroll-resources/auto-discovery/auto-discovery.mdx) guides
+   to configure the Discovery Service and enable your Agents to proxy the
+   resources that the service enrolls.
+1. Add the `Discovery` role to the join token resource you created earlier. In
+   this guide, the join token only has the `Node` role.
+1. Add roles to the join token resource that corresponds to the Agent services
+   you want to proxy discovered resources. The roles to add depend on the
+   resources you want to automatically enroll based on the [Auto-Discovery
+   guides](../../../enroll-resources/auto-discovery/auto-discovery.mdx) guides.
+
+### Enroll resources manually
+
+You can also enroll resources manually, instructing Agents to proxy specific
+endpoints in your infrastructure. For information about manual enrollment, read
+the documentation section for each kind of resource you would like to enroll:
+  
+- [Databases](../../../enroll-resources/database-access/database-access.mdx)
+- [Windows
+  desktops](../../../enroll-resources/desktop-access/desktop-access.mdx)
+- [Kubernetes
+  clusters](../../../enroll-resources/kubernetes-access/kubernetes-access.mdx)
+- [Linux servers](../../../enroll-resources/server-access/server-access.mdx)
+- [Web applications and cloud provider
+  APIs](../../../enroll-resources/application-access/application-access.mdx)
+
+Once you are familiar with the process of enrolling a resource manually, you can
+edit your Terraform module to:
+
+1. **Add token roles:** The token resource you created has only the `Node` role,
+   and you can add roles to authorize your Agents to proxy additional kinds of
+   resources. Consult a guide to enrolling resources manually to determine the
+   role to add to the token.
+1. **Change the userdata script** to enable additional Agent services additional
+   infrastructure resources for your Agents to proxy.
+1. **Deploy dynamic resources:** Consult the [Terraform provider
+   reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx) for
+   Terraform resources that you can apply in order to enroll dynamic resources
+   in your infrastructure.
+
+### Fine-tune your configuration
+
+Now that you have configured RBAC in your Terraform demo cluster, fine-tune your
+setup by reading the comprehensive [Terraform provider
+reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx
new file mode 100644
index 0000000000000..2582ad338259e
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx
@@ -0,0 +1,51 @@
+---
+title: Using the Teleport Terraform Provider
+sidebar_label: Terraform Provider
+description: How to manage dynamic resources using the Teleport Terraform provider.
+videoBanner: YgNHD4SS8dg
+tags:
+ - infrastructure-as-code
+ - conceptual
+ - zero-trust
+---
+
+The Teleport Terraform provider allows Teleport administrators to use Terraform to configure Teleport via
+dynamic resources.
+
+## Getting started
+
+For an example of using the Teleport Terraform provider to deploy Teleport
+Agents, configure Single Sign-On, and manage role-based access controls, see
+[Getting Started](./terraform-getting-started.mdx).
+
+## Setup
+
+For instructions on managing users and roles via Terraform, read
+the ["Managing users and roles with IaC" guide](../managing-resources/user-and-role.mdx).
+
+The provider must obtain an identity to connect to Teleport. The method to obtain it depends on where the Terraform code
+is executed. You must pick the correct guide for your setup:
+
+| Guide                                                                                                               | Use-case                                                                                                                                                                                                         | How it works                                                                                                                           |
+|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
+| [Local Demos](local.mdx)                                       | You are getting started with the Teleport Terraform provider and managing Teleport resources with IaC.                                                                           | You use local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. |
+| [Terraform Cloud](terraform-cloud.mdx) | You're running on HCP Terraform (Terraform Cloud) or self-hosted Terraform Enterprise. | Terraform Cloud Workload Identity issues a proof of identity and the Teleport Terraform provider uses it to authenticate. |
+| [env zero](env0.mdx)                   | You're running on env zero's cloud. | env zero issues a proof of identity to deployments and the Teleport Terraform provider uses it to authenticate to Teleport. |
+| [CI or a Cloud VM](ci-or-cloud.mdx)                     | You already have a working Terraform module configuring Teleport and want to run it in CI to benefit from review and audit capabilities from your versioning system (e.g. git).                                  | You're using a proof provided by your runtime (CI engine, cloud provider) to prove your identity and join using Machine & Workload Identity .             |
+| [Spacelift](spacelift.mdx)                              | You already have a working Terraform module configuring Teleport and want to run it on the Spacelift platform.                                                                                                   | You're using a proof provided by Spacelift to prove your identity and join using Machine & Workload Identity.                                            |
+| [Dedicated Server](dedicated-server.mdx)                      | You have working Terraform code and want to run it on a dedicated server. The server is long-lived, like a bastion or a task runner.                                                                             | You setup a Machine & Workload Identity daemon (`tbot`) that obtains and refreshes credentials for the Terraform provider.                               |
+| [Long-Lived Credentials](long-lived-credentials.mdx) | This method is discouraged as less secure than the others. This should be used when none of the other methods work in your case (short-lived CI environments that don't have dedicated Teleport join methods). | You sign one long lived certificate allowing the Terraform provider to connect to Teleport.                                            |
+
+## Resource guides
+
+Once you have a functional Teleport Terraform provider, you will want to configure your resources with it.
+
+The list of supported resources and their fields is available [in the Terraform
+reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
+
+Some resources have their dedicated Infrastructure-as-Code (IaC) step-by step guides such as:
+- [Managing Users And Roles With IaC](../managing-resources/user-and-role.mdx)
+- [Creating Access Lists with IaC](../managing-resources/access-list.mdx)
+- [Registering Agentless OpenSSH Servers with IaC](../managing-resources/agentless-ssh-servers.mdx)
+
+Finally, you can [import your existing resources in Terraform](import-existing-resources.mdx).
diff --git a/docs/pages/zero-trust-access/infrastructure-as-code/using-tctl.mdx b/docs/pages/zero-trust-access/infrastructure-as-code/using-tctl.mdx
new file mode 100644
index 0000000000000..f3dcc62437edf
--- /dev/null
+++ b/docs/pages/zero-trust-access/infrastructure-as-code/using-tctl.mdx
@@ -0,0 +1,132 @@
+---
+title: "Getting Started with tctl"
+sidebar_label: tctl Admin Tool
+description: Provides a conceptual overview of tctl, the Teleport administrative client tool.
+sidebar_position: 2
+tags:
+- conceptual
+- platform-wide
+---
+
+This guide provides an overview of `tctl`, a command-line tool for managing
+Teleport dynamic resources.
+
+For an overview of what a dynamic resource is, see [Infrastructure as
+Code](infrastructure-as-code.mdx).
+
+For a comprehensive list of `tctl` commands, arguments, flag, and environment
+variables, see the [`tctl` CLI Reference](../../reference/cli/tctl.mdx).
+
+## When to use tctl
+
+`tctl` is a Teleport Auth Service client that manages dynamic resources. The
+following Teleport Auth Service clients can also manage dynamic resources:
+
+- [Teleport Terraform provider](./terraform-provider/terraform-provider.mdx)
+- [Teleport Kubernetes operator](./teleport-operator/teleport-operator.mdx)
+- [Custom API clients](../api/api.mdx)
+
+`tctl` is best suited for ad hoc operations such as retrieving data about your
+cluster or unanticipated configuration changes. You can also use it to manage
+resources on small-scale Teleport clusters.
+
+As the number of Teleport resources increases, we recommend that you to switch
+to IaC tools such as Terraform or the Kubernetes operator as they offer more
+robust resource lifecycle management.
+
+## tctl permissions
+
+Every Teleport Auth Service client has an identity with a Teleport username and
+a list of roles. The identity must list every Teleport resource it has
+permissions to perform operations on and every operation it has permissions to
+perform. For example, the following Teleport role has permissions to perform all
+operations on `app` resources but read-only operations on Teleport roles:
+
+```yaml
+allow:
+  rules:
+    - resources:
+        - role
+      verbs: [list, read]
+    - resources:
+        - app
+      verbs: [list, create, read, update, delete]
+```
+
+See-the [Role
+Reference](../../reference/access-controls/roles.mdx#rbac-for-dynamic-teleport-resources)
+for more information on configuring access to Teleport resources.
+
+## Audit log 
+
+When you create or modify a resource with `tctl`, Teleport records the operation
+in the audit log. You can use the Teleport username associated with each audit
+event to determine which resource modifications took place using `tctl` and
+which ones occurred with the Terraform provider, Kubernetes operator, or custom
+API clients.
+
+See the [audit event reference](../../reference/audit-events.mdx) for a full
+list of events.
+
+## Authentication
+
+Before running `tctl` commands, administrators must authenticate to a Teleport
+cluster. You can authenticate to your cluster by running the following command:
+
+```code
+$ tsh login --user=TELEPORT_USER --proxy=PROXY_SERVICE_ADDRESS
+```
+
+See the [`tsh login`](../../reference/cli/tsh.mdx#tsh-login) reference entry for
+a full list of `tsh login` flags. 
+
+### Using the local Auth Service backend
+
+Administrators of a self-hosted Teleport cluster can manage the cluster by
+authenticating to a host that runs the Teleport Auth Service. If there is a
+Teleport configuration file on the host where `tctl` is run, `tctl` attempts to
+authenticate to the Auth Service named in the configuration file using an
+identity stored in its local backend. 
+
+`tctl` authenticates using this method if a configuration file exists at
+`/etc/teleport.yaml` or the `TELEPORT_CONFIG_FILE` environment variable points
+to a configuration file in another location. If the `auth_service` is disabled
+in the configuration file, then the configuration file is ignored.
+
+<Admonition type="warning">
+
+If you set up demo Teleport clusters on your workstation, make sure you remove
+any configuration files when you are done so `tctl` works as intended. If `tctl`
+attempts to connect to a Teleport cluster on your local machine, you will see an
+error similar to the following:
+
+```
+ERROR: open /var/lib/teleport/host_uuid: permission denied
+```
+
+</Admonition>
+
+Note that when a `tctl` command is run locally on the Auth Service, the audit
+logs will show that it was performed by the Auth Service itself.
+
+To provide an accurate audit trail, it is important to limit direct SSH access
+to the Auth Service with
+[Access Controls](../../zero-trust-access/authentication/authentication.mdx) and ensure that
+admins use `tctl` remotely instead.
+
+### Using an identity file
+
+`tctl` can authenticate with a user-provided identity file. The Teleport Auth
+Service signs an identity file when a user runs `tctl auth sign` or
+`tsh login --out=<output-path>`, and the user can include the path to the
+identity file in the `--identity` flag when running `tctl` commands.
+
+When using the `--identity` flag, the user must provide the `--auth-server` flag
+with the address of an Auth Service or Proxy Service so `tctl` knows which
+cluster to authenticate to.
+
+## Resources you can view
+
+You can view the following resources with the `tctl get` command:
+
+(!docs/pages/includes/tctl-get-resources.mdx!)
diff --git a/docs/pages/admin-guides/management/admin/daemon.mdx b/docs/pages/zero-trust-access/management/daemon.mdx
similarity index 92%
rename from docs/pages/admin-guides/management/admin/daemon.mdx
rename to docs/pages/zero-trust-access/management/daemon.mdx
index c43e9d0aed85e..fb9fd2c8eba13 100644
--- a/docs/pages/admin-guides/management/admin/daemon.mdx
+++ b/docs/pages/zero-trust-access/management/daemon.mdx
@@ -1,12 +1,23 @@
 ---
 title: Run Teleport as a Daemon
 description: Configure Teleport to run as a daemon using systemd
+tags:
+ - how-to
+ - platform-wide
 ---
 On Linux systems in non-containerized environments, we recommend running the `teleport` binary as a daemon using systemd.
 Using a daemon helps to ensure that the `teleport` process can remain running and available regardless of a controlling terminal session or parent process, and opens up additional
 configuration options that allow for better optimization, uptime, and availability.
 
-This guide will outline best practices for installing, configuring, and starting teleport as a daemon on a Linux host using systemd.
+This guide will outline best practices for installing, configuring, and starting `teleport` as a daemon on a Linux host using systemd.
+
+## How it works
+
+When you install Teleport on a Linux server using a package manager, the
+installation creates a systemd service configuration that starts `teleport` in
+the background when your machine boots up. If you build Teleport from source or
+install it from a TAR archive, you can install the systemd service using the
+`teleport install systemd` command.
 
 ## Prerequisites
 
@@ -147,8 +158,8 @@ until existing clients disconnect (with a timeout of 30 hours).
 To upgrade a host to a newer version of Teleport, you must:
 
 - Replace the Teleport binaries, usually
-  [`teleport`](../../../reference/cli/teleport.mdx) and
-  [`tctl`](../../../reference/cli/tctl.mdx).
+  [`teleport`](../../reference/cli/teleport.mdx) and
+  [`tctl`](../../reference/cli/tctl.mdx).
 - Execute `systemctl reload teleport`.
 
 </Admonition>
@@ -182,11 +193,11 @@ $ sudo teleport install systemd \
 
 In this guide, we showed you how to run `teleport start` as a systemd service.
 To see all commands that you can run via the `teleport` binary, see the
-[Teleport CLI Reference](../../../reference/cli/teleport.mdx).
+[Teleport CLI Reference](../../reference/cli/teleport.mdx).
 
 While we used a minimal configuration in this guide, for a production Teleport
 cluster, you should consult our
-[Configuration Reference](../../../reference/config.mdx).
+[Configuration Reference](../../reference/deployment/config.mdx).
 
 For information on unit file configurations and unit file load paths,
 see [systemd's documentation on systemd.unit configurations](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)
diff --git a/docs/pages/zero-trust-access/management/diagnostics/datadog.mdx b/docs/pages/zero-trust-access/management/diagnostics/datadog.mdx
new file mode 100644
index 0000000000000..8689a91c1963c
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/diagnostics/datadog.mdx
@@ -0,0 +1,27 @@
+---
+title: Datadog Integration
+description: How to export Teleport metrics and logs to Datadog
+tags:
+ - conceptual
+ - platform-wide
+---
+
+Datadog has an [officially maintained integration](https://docs.datadoghq.com/integrations/teleport/) for Teleport.
+
+The integration exports both metrics and logs to Datadog. The metrics are Datadog-native,
+not external metrics, which means they incur no extra usage charges to your Datadog account.
+The integration also includes a dashboard for monitoring your Teleport cluster.
+
+There is no installation required to use the integration, only changes to the Datadog
+Agent configuration. Please see the Datadog documentation linked above for how to activate
+the Teleport integration in Datadog.
+
+The Teleport Datadog integration includes log processing rules for
+text-formatted logs printed by an Auth Service instance. If you self-host
+Teleport, you can configure the Datadog Agent to tail these logs on an Auth
+Service host. 
+
+On Teleport Enterprise (Cloud), you must use the Teleport Event Handler to
+subscribe to audit logs from the Auth Service and forward them to Datadog using
+Fluentd. Read the [Teleport documentation](../../../zero-trust-access/export-audit-events/datadog.mdx)
+for how to configure audit log exporting using Datadog and the Event Handler.
diff --git a/docs/pages/admin-guides/management/diagnostics/diagnostics.mdx b/docs/pages/zero-trust-access/management/diagnostics/diagnostics.mdx
similarity index 97%
rename from docs/pages/admin-guides/management/diagnostics/diagnostics.mdx
rename to docs/pages/zero-trust-access/management/diagnostics/diagnostics.mdx
index d78436fd796f8..01c3549145130 100644
--- a/docs/pages/admin-guides/management/diagnostics/diagnostics.mdx
+++ b/docs/pages/zero-trust-access/management/diagnostics/diagnostics.mdx
@@ -1,6 +1,10 @@
 ---
-title: Monitoring your Cluster
-description: Monitoring your Teleport deployment
+title: Monitoring your Cluster and Diagnosing Issues
+sidebar_label: Diagnostics
+description: Provides guidance on monitoring your Teleport deployment and diagnosing issues.
+tags:
+ - how-to
+ - platform-wide
 ---
 
 Teleport provides health checking mechanisms in order to verify that it is healthy and ready to serve traffic.
@@ -98,7 +102,7 @@ to a format that your telemetry backend accepts.
 ## Configure Teleport
 
 In order to enable tracing for a `teleport` instance, add the following section to that instance's configuration file (`/etc/teleport.yaml`).
-For a detailed description of these configuration fields, see the [configuration reference](../../../reference/config.mdx) page.
+For a detailed description of these configuration fields, see the [configuration reference](../../../reference/deployment/config.mdx) page.
 
 ```yaml
 tracing_service:
diff --git a/docs/pages/admin-guides/management/diagnostics/logging.mdx b/docs/pages/zero-trust-access/management/diagnostics/logging.mdx
similarity index 93%
rename from docs/pages/admin-guides/management/diagnostics/logging.mdx
rename to docs/pages/zero-trust-access/management/diagnostics/logging.mdx
index 1248df63f1ace..085bc5769e1ad 100644
--- a/docs/pages/admin-guides/management/diagnostics/logging.mdx
+++ b/docs/pages/zero-trust-access/management/diagnostics/logging.mdx
@@ -1,6 +1,9 @@
 ---
 title: Logger Configuration
 description: Explains how to configure the logger on a Teleport instance.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 In the configuration file of a Teleport instance, you can configure the logger's behavior by defining the output
@@ -41,9 +44,9 @@ Format `extra_fields` defines additional fields which must be added to the log o
 On systemd-based distributions you can watch the log output by running the following command:
 
 ```code
-$ teleport install systemd -o /etc/systemd/system/teleport.service
-$ systemctl enable teleport
-$ journalctl -fu teleport
+$ sudo teleport install systemd -o /etc/systemd/system/teleport.service
+$ sudo systemctl enable teleport
+$ sudo journalctl -fu teleport
 ```
 
 ## Log rotation support
@@ -69,4 +72,4 @@ to rotate Teleport log file weekly:
     compress
     notifempty
 }
-```
\ No newline at end of file
+```
diff --git a/docs/pages/zero-trust-access/management/diagnostics/metrics.mdx b/docs/pages/zero-trust-access/management/diagnostics/metrics.mdx
new file mode 100644
index 0000000000000..bed819a20d526
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/diagnostics/metrics.mdx
@@ -0,0 +1,215 @@
+---
+title: Key Metrics for Self-Hosted Clusters
+sidebar_label: Key Metrics
+description: Describes important metrics to monitor if you are self-hosting Teleport.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+This guide explains the metrics you should use to get started monitoring your
+self-hosted Teleport cluster, focusing on metrics reported by the Auth Service
+and Proxy Service. If you use Teleport Enterprise (Cloud), the Teleport team
+monitors and responds to these metrics for you.
+
+For a reference of all available metrics, see the [Teleport Metrics
+Reference](../../../reference/deployment/monitoring/metrics.mdx).
+
+This guide assumes that you already monitor compute resources on all instances
+that run the Teleport Auth Service and Proxy Service (e.g., CPU, memory, disk,
+bandwidth, and open file descriptors).
+
+## Enabling metrics
+
+(!docs/pages/includes/diagnostics/diag-addr-prereqs-tabs.mdx!)
+
+This will enable the `http://127.0.0.1:3000/metrics` endpoint, which serves the
+metrics that Teleport tracks. It is compatible with [Prometheus](https://prometheus.io/) collectors.
+
+<Admonition type="tip" title="Grafana dashboard">
+
+A Grafana dashboard template can be found at
+[examples/grafana/teleport-dashboard.json](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/grafana/teleport-dashboard.json).
+
+</Admonition>
+
+## Backend operations
+
+A Teleport cluster cannot function if the Auth Service does not have a healthy
+cluster state backend. You need to track the ability of the Auth Service to read
+from and write to its backend. 
+
+The Auth Service can connect to [several possible
+backends](../../../reference/deployment/backends.mdx). In addition to Teleport backend
+metrics, you should set up monitoring for your backend of choice so that, if
+these metrics show problematic values, you can correlate them with metrics on
+your backend infrastructure.
+
+### Backend operation throughput and availability
+
+On each backend operation, the Auth Service increments a metric. Backend
+operation metrics have the following format:
+
+```text
+teleport_backend_<METRIC_NAME>[_failed]_total
+```
+
+If an operation results in an error, the Auth Service adds the `_failed` segment
+to the metric name. For example, successfully creating a record increments the
+`teleport_backend_write_requests_total` metric. If the create operation fails,
+the Auth Service increments `teleport_backend_write_requests_failed_total`
+instead.
+
+The following backend operation metrics are available:
+
+|Operation|Incremented metric name|
+|---|---|
+|Create an item|`write_requests`|
+|Modify an item, creating it if it does not exist|`write_requests`|
+|Update an item|`write_requests`|
+|Conditionally update an item if versions match|`write_requests`|
+|List a range of items|`batch_read_requests`|
+|Get a single item|`read_requests`|
+|Compare and swap items|`write_requests`|
+|Delete an item|`write_requests`|
+|Conditionally delete an item if versions match|`write_requests`|
+|Write a batch of updates atomically, failing the write if any update fails|Both `write_requests` and `atomic_write_requests`|
+|Delete a range of items|`batch_write_requests`|
+|Update the keepalive status of an item|`write_requests`|
+
+During failed backend writes, a Teleport process also increments the
+`backend_write_requests_failed_precondition_total` metric if the cause of the
+failure is expected. For example, the metric increments during a create
+operation if a record already exists, during an update or delete operation if
+the record is not found, and during an atomic write if the resource was modified
+concurrently. All of these conditions can hold in a well-functioning Teleport
+cluster. 
+
+`backend_write_requests_failed_precondition_total`  increments whenever
+`backend_write_requests_failed_total` increments, and you can use it to
+distinguish potentially expected write failures from unexpected, problematic
+ones.
+
+You can use backend operation metrics to define an availability formula, i.e.,
+the percentage of reads or writes that succeeded. For example, in Prometheus,
+you can define a query similar to the following. This takes the percentage of
+write requests that failed for unexpected reasons and subtracts it from 1 to get
+a percentage of successful writes:
+
+```
+1- (sum(rate(backend_write_requests_failed_total -sum(rate(teleport_backend_write_requests_failed_precondition_total)) / sum(rate(backend_write_requests_total))
+```
+
+If your backend begins to appear unavailable, you can investigate your backend
+infrastructure.
+
+### Backend operation performance
+
+To help you track backend operation performance, the Auth Service also exposes
+Prometheus [histogram metrics](https://prometheus.io/docs/practices/histograms/)
+for read and write operations:
+
+- `teleport_backend_read_seconds_bucket`
+- `teleport_backend_write_seconds_bucket`
+- `teleport_backend_batch_write_seconds_bucket`
+- `teleport_backend_batch_read_seconds_bucket`
+- `teleport_backend_atomic_write_seconds_bucket`
+
+The backend throughput metrics discussed in the previous section map on to
+latency metrics. Whenever the Auth Service increments one of the throughput
+metrics, it reports one of the corresponding latency metrics. See the table
+below for which throughput metrics map to which latency metrics. Each metric
+name excludes the standard prefixes and suffixes.
+
+|Throughput|Latency|
+|---|---|
+|`read_requests`|`read_seconds_bucket`|
+|`read_requests`|`write_seconds_bucket`|
+|`batch_read_requests`|`batch_write_seconds_bucket`|
+|`batch_write_requests`|`batch_read_seconds_bucket`|
+|`atomic_write_requests`|`atomic_write_seconds_bucket`|
+
+## Agents and connected resources
+
+To enable users to access most infrastructure with Teleport, you must join a
+[Teleport Agent](../../../enroll-resources/agents/agents.mdx) to your Teleport
+cluster and configure it to proxy your infrastructure. In a typical setup, an
+Agent establishes an SSH reverse tunnel with the Proxy Service. User traffic to
+Teleport-protected resources flows through the Proxy Service, an Agent, and
+finally the infrastructure resource the Agent proxies. Return traffic from the
+resource takes this path in reverse.
+
+### Number of connected resources by type
+
+Teleport-connected resources periodically send heartbeat (keepalive) messages to
+the Auth Service. The Auth Service uses these heartbeats to track the number of
+Teleport-protected resources by type with the `teleport_connected_resources`
+metric. 
+
+The Auth Service tracks this metric for the following resources:
+
+- SSH servers
+- Kubernetes clusters
+- Applications
+- Databases
+- Teleport Database Service instances
+- Windows desktops
+
+You can use this metric to:
+- Compare the number of resources that are protected by Teleport with those that
+  are not so you can plan your Teleport rollout, e.g., by configuring [Auto
+  Discovery](../../../enroll-resources/auto-discovery/auto-discovery.mdx).
+- Correlate changes in Teleport usage with resource utilization on Auth Service
+  and Proxy Service compute instances to determine scaling needs.
+
+You can include this query in your Grafana configuration to break this metric
+down by resource type:
+
+```text
+sum(teleport_connected_resources) by (type)
+```
+
+### Reverse tunnels by type
+
+Every Teleport service that starts up establishes an SSH reverse tunnel to the
+Proxy Service. (Self-hosted clusters can configure Agent services to connect to
+the Auth Service directly without establishing a reverse tunnel.) The Proxy
+Service tracks the number of reverse tunnels using the metric,
+`teleport_reverse_tunnels_connected`.
+
+With an improperly scaled Proxy Service pool, the Proxy Service can become a
+bottleneck for traffic to Teleport-protected resources. If Proxy Service
+instances display heavy utilization of compute resources while the number of
+connected infrastructure resources is high, you can consider scaling out your
+Proxy Service pool and using [Proxy Peering](../../deploy-a-cluster/proxy-peering.mdx).
+
+Use the following Grafana query to track the maximum number of reverse tunnels
+by type over a given interval:
+
+```text
+max(teleport_reverse_tunnels_connected) by (type))
+```
+
+## Teleport instance versions
+
+At regular intervals (around 7 seconds with jitter), the Auth Service refreshes
+its count of registered Teleport instances, including Agents and Teleport
+processes that run the Auth Service and Proxy Service. You can measure this
+count with the metric, `teleport_registered_servers`. To get the number of
+registered instances by version, you can use this query in Grafana:
+
+```text
+sum by (version)(teleport_registered_servers)
+```
+
+You can use this metric to tell how many of your registered Teleport instances
+are behind the version of the Auth Service and Proxy Service, which can help you
+identify any that are at risk of violating the Teleport [version compatibility
+guarantees](../../../upgrading/overview.mdx). 
+
+We strongly encourage self-hosted Teleport users to enroll their Agents in
+automatic updates. You can track the count of Teleport Agents that are not
+enrolled in automatic updates using the metric, `teleport_enrolled_in_upgrades`.
+[Read the documentation](../../../upgrading/agent-managed-updates/agent-managed-updates.mdx) for how
+to enroll Agents in automatic updates.
+
diff --git a/docs/pages/zero-trust-access/management/diagnostics/monitoring.mdx b/docs/pages/zero-trust-access/management/diagnostics/monitoring.mdx
new file mode 100644
index 0000000000000..832504a968318
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/diagnostics/monitoring.mdx
@@ -0,0 +1,65 @@
+---
+title: Health Monitoring
+description: Monitoring health and readiness.
+tags:
+ - conceptual
+ - platform-wide
+---
+
+Teleport provides health checking mechanisms in order to verify that it
+is healthy and ready to serve traffic. These can be used by things like
+Kubernetes probes to monitor the health of a Teleport process.
+
+## Enable health monitoring
+
+(!docs/pages/includes/diagnostics/diag-addr-prereqs-tabs.mdx!)
+
+Now you can collect monitoring information from several endpoints.
+
+## `/healthz`
+
+The `http://127.0.0.1:3000/healthz` endpoint responds with a body of
+`{"status":"ok"}` and an HTTP 200 OK status code if the process is running.
+
+This is a simple check, suitable for determining if the Teleport process is
+still running.
+
+## `/readyz`
+
+The `http://127.0.0.1:3000/readyz` endpoint is similar to `/healthz`, but its
+response includes information about the state of the process.
+
+The response body is a JSON object of the form:
+
+```
+{ "status": "a status message here"}
+```
+
+### `/readyz` and heartbeats
+
+If a Teleport component fails to execute its heartbeat procedure, it will enter
+a degraded state. Teleport will begin recovering from this state when a
+heartbeat completes successfully.
+
+The first successful heartbeat will transition Teleport into a recovering state.
+
+A second consecutive successful heartbeat will cause Teleport to transition to
+the OK state.
+
+Teleport heartbeats run approximately every 60 seconds when healthy, and failed
+heartbeats are retried approximately every 5 seconds. This means that depending
+on the timing of heartbeats, it can take 60-70 seconds after connectivity is
+restored for `/readyz` to start reporting healthy again.
+
+### Status codes
+
+The status code of the response can be one of:
+
+- HTTP 200 OK: Teleport is operating normally
+- HTTP 503 Service Unavailable: Teleport has encountered a connection error and
+  is running in a degraded state. This happens when a Teleport heartbeat fails.
+- HTTP 400 Bad Request: Teleport is either entering its initial startup phase or
+  has begun recovering from a degraded state.
+
+The same state information is also available via the `process_state` metric
+under the `/metrics` endpoint.
diff --git a/docs/pages/admin-guides/management/diagnostics/profiles.mdx b/docs/pages/zero-trust-access/management/diagnostics/profiles.mdx
similarity index 99%
rename from docs/pages/admin-guides/management/diagnostics/profiles.mdx
rename to docs/pages/zero-trust-access/management/diagnostics/profiles.mdx
index ec104d7df72d6..22febe98b3e3d 100644
--- a/docs/pages/admin-guides/management/diagnostics/profiles.mdx
+++ b/docs/pages/zero-trust-access/management/diagnostics/profiles.mdx
@@ -1,6 +1,9 @@
 ---
 title: Profiling
 description: Collecting pprof profiles.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Teleport leverages Go's diagnostic capabilities to collect and export
diff --git a/docs/pages/admin-guides/management/diagnostics/tracing.mdx b/docs/pages/zero-trust-access/management/diagnostics/tracing.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/diagnostics/tracing.mdx
rename to docs/pages/zero-trust-access/management/diagnostics/tracing.mdx
index da4767d49b9e8..c192cb3b9dd96 100644
--- a/docs/pages/admin-guides/management/diagnostics/tracing.mdx
+++ b/docs/pages/zero-trust-access/management/diagnostics/tracing.mdx
@@ -1,6 +1,9 @@
 ---
 title: Distributed Tracing
 description: How to enable tracing within Teleport.
+tags:
+ - conceptual
+ - platform-wide
 ---
 
 Teleport leverages [OpenTelemetry](https://opentelemetry.io/) to generate traces
@@ -12,7 +15,7 @@ to a format that your telemetry backend accepts.
 ## Configure Teleport
 
 In order to enable tracing for a `teleport` instance, add the following section to that instance's configuration file (`/etc/teleport.yaml`).
-For a detailed description of these configuration fields, see the [configuration reference](../../../reference/monitoring/tracing-service-configuration.mdx) page.
+For a detailed description of these configuration fields, see the [configuration reference](../../../reference/deployment/monitoring/tracing-service-configuration.mdx) page.
 
 ```yaml
 tracing_service:
diff --git a/docs/pages/zero-trust-access/management/diagnostics/troubleshooting.mdx b/docs/pages/zero-trust-access/management/diagnostics/troubleshooting.mdx
new file mode 100644
index 0000000000000..6ffcfe10b4168
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/diagnostics/troubleshooting.mdx
@@ -0,0 +1,250 @@
+---
+title: Troubleshooting
+description: Troubleshooting and Collecting Metrics of Teleport Processes
+tags:
+ - how-to
+ - platform-wide
+---
+
+In this guide, we will explain how to address issues or unexpected behavior in your
+Teleport cluster.
+
+You can use these steps to get more visibility into the `teleport` process so
+you can troubleshoot the Auth Service, Proxy Service, and Teleport Agent
+services such as the Application Service and Database Service.
+
+## How it works
+
+A Teleport process exposes several methods that you can use to collect data
+about its internal operations:
+
+- **Debug Service:** A service that runs within a Teleport process and allows
+  users to change the log level of the Teleport instance without restarting it.
+- **Verbose logging:** It is possible to change the log level of a Teleport
+  process using its configuration file.
+- **Debug dump:** Teleport is a Go program. The Go runtime schedules operations
+  within CPU threads using an abstraction called a goroutine, and you can
+  generate a file containing information about each running goroutine.
+
+For further information, you can [ask for help](#step-33-ask-for-help) from the
+Teleport team or community.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Enable verbose logging
+
+To change log levels in Teleport, you can use either of the following methods:
+
+- Debug Service: Allows on-the-fly log level adjustments without restarting the
+  instance, which is ideal for troubleshooting sessions.
+- Updating configuration: Involves updating the Teleport configuration file and
+  restarting the instance.
+
+<Tabs>
+<TabItem label="Debug Service">
+The Teleport Debug Service allows administrators to dynamically manage log levels
+without restarting the instance. The service, enabled by default, ensures
+local-only access and must be consumed from inside the same instance.
+
+To change the instance log level use the `teleport debug set-log-level` command:
+
+```code
+$ teleport debug set-log-level DEBUG
+Changed log level from "INFO" to "DEBUG".
+
+$ kubectl -n teleport exec my-pod -- teleport debug set-log-level DEBUG
+Changed log level from "INFO" to "DEBUG".
+```
+
+If you're unsure what is the current level you can retrieve it using
+`teleport debug get-log-level`.
+
+After troubleshooting, remember to turn the log level back to avoid generating
+unnecessary logs.
+
+(!docs/pages/includes/diagnostics/teleport-debug-config.mdx!)
+</TabItem>
+
+<TabItem label="Updating configuration">
+To diagnose problems, you can configure the `teleport` process to run with
+verbose logging enabled by passing it the `-d` flag. `teleport` will write logs
+to stderr.
+
+Alternatively, you can set the log level from the Teleport configuration file:
+
+```yaml
+teleport:
+  log:
+    severity: DEBUG
+```
+
+Restart the `teleport` process to apply the modified log level. Logs will resemble
+the following (these logs were printed while joining a server to a cluster, then
+terminating the `teleport` process on the server):
+</TabItem>
+</Tabs>
+
+Debug logs include the file and line number of the code that emitted the log, so
+you can investigate (or report) what a `teleport` process was doing before it ran into
+problems. Here's an example:
+
+```
+DEBU [NODE:PROX] Agent connected to proxy: [aee1241f-0f6f-460e-8149-23c38709e46d.tele.example.com aee1241f-0f6f-460e-8149-23c38709e46d teleport-proxy-us-west-2-6db8db844c-ftmg9.tele.example.com teleport-proxy-us-west-2-6db8db844c-ftmg9 localhost 127.0.0.1 ::1 tele.example.com 100.92.90.42 remote.kube.proxy.teleport.cluster.local]. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:414
+DEBU [NODE:PROX] Changing state connecting -> connected. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:210
+DEBU [NODE:PROX] Discovery request channel opened: teleport-discovery. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:526
+DEBU [NODE:PROX] handleDiscovery requests channel. leaseID:4 target:tele.example.com:11106 reversetunnel/agent.go:544
+DEBU [NODE:PROX] Pool is closing agent. leaseID:2 target:tele.example.com:11106 reversetunnel/agentpool.go:238
+DEBU [NODE:PROX] Pool is closing agent. leaseID:3 target:tele.example.com:11106 reversetunnel/agentpool.go:238
+```
+
+<Admonition
+  type="warning"
+>
+  It is not recommended to run Teleport in production with verbose logging as it
+  generates a substantial amount of data.
+
+</Admonition>
+
+## Step 2/3. Generate a debug dump
+
+The `teleport` binary is a Go program. Go programs assign work to CPU threads
+using an abstraction called a **goroutine**. You can get a goroutine dump of a
+running `teleport` process by sending it a `USR1` signal.
+
+This is especially useful for troubleshooting a `teleport` process that appears
+stuck, since you can see which a goroutine is blocked and and why. For example,
+goroutines often communicate using **channels**, and a goroutine dump indicates
+whether a goroutine is waiting to send or receive on a channel.
+
+To generate a goroutine dump, send a `USR1` signal to a `teleport` process:
+
+```code
+$ kill -USR1 $(pidof teleport)
+```
+
+Teleport will print the debug information to `stderr`. Here what you will see in
+the logs:
+
+```txt
+INFO [PROC:1]    Got signal "user defined signal 1", logging diagnostic info to stderr. service/signals.go:99
+Runtime stats
+goroutines: 64
+OS threads: 10
+GOMAXPROCS: 2
+num CPU: 2
+...
+goroutines: 84
+...
+Goroutines
+goroutine 1 [running]:
+runtime/pprof.writeGoroutineStacks(0x3c2ffc0, 0xc0001a8010, 0xc001011a38, 0x4bcfb3)
+	/usr/local/go/src/runtime/pprof/pprof.go:693 +0x9f
+...
+```
+
+<Admonition type="tip">
+
+You can print a goroutine dump without enabling verbose logging.
+
+</Admonition>
+
+## Step 3/3. Ask for help
+
+Once you have collected verbose logs and a goroutine dump from your `teleport`
+binary, you can use this information to get help from the Teleport community and
+Support team.
+
+### Collect your Teleport version
+
+Determine the version of the `teleport` process you are investigating.
+
+```code
+$ teleport version
+Teleport v8.3.7 git:v8.3.7-0-ga8d066935 go1.17.3
+```
+
+You can also collect the versions of the Teleport Auth Service, Proxy
+Service, and client tools to rule out version compatibility issues.
+
+To see the version of the Auth Service and Proxy Service, run the following
+command:
+
+```code
+$ tctl status
+Cluster  mytenant.teleport.sh
+Version  (=cloud.version=)
+Host CA  never updated
+User CA  never updated
+Jwt CA   never updated
+CA pin   (=presets.ca_pin=)
+```
+
+Get the versions of your client tools:
+
+```code
+$ tctl version
+Teleport v9.0.4 git: go1.18
+$ tsh version
+Teleport v9.0.4 git: go1.18
+```
+
+### Pose your question
+
+<Tabs>
+<TabItem scope={["cloud", "enterprise","team"]} label="Commercial Teleport Editions">
+If you have a question or need assistance please submit a request
+through the [Teleport support portal](https://support.goteleport.com).
+
+</TabItem>
+<TabItem scope={["oss"]} label="Teleport Community Edition">
+If you need help, please ask on our [community forum](https://github.com/gravitational/teleport/discussions). You can also open an [issue on GitHub](https://github.com/gravitational/teleport/issues).
+
+For more information about Enterprise features reach out to [the Teleport sales team](https://goteleport.com/signup/enterprise/).
+You can also sign up for a [free trial](https://goteleport.com/signup) of Teleport Enterprise.
+</TabItem>
+</Tabs>
+
+## Further reading
+
+This guide showed how to investigate issues with the `teleport` process. To see
+how you can monitor more general health and performance data from your Teleport
+cluster, read our [Teleport Diagnostics](../diagnostics/monitoring.mdx) guides.
+
+For additional sources of Teleport support, please see the
+[Teleport Support and Education Center](https://goteleport.com/support/).
+
+## Common Issues
+
+### `teleport.cluster.local`
+
+It is common to see references to `teleport.cluster.local` within logs and
+errors in Teleport. This is a special value that is used within Teleport for two
+purposes and seeing it within your logs is not necessarily an indication that
+anything is incorrect.
+
+Firstly, Teleport uses this value within certificates (as a DNS Subject
+Alternative Name) issued to the Auth Service and Proxy Service. Teleport clients can
+then use this value to validate the service's certificates during the TLS
+handshake regardless of the service address as long as the client already has a
+copy of the cluster's certificate authorities. This is important as there are
+often multiple different ways that a client can connect to the Auth Service and
+these are not always via the same address.
+
+Secondly, this value is used by clients as part of the URL when making gRPC or
+HTTP requests to the Teleport API. This is because the Teleport API client uses
+special logic to open the connection to the Auth Service to make the request,
+rather than connecting to a single address as a typical client may do. This
+special logic is necessary for the client to be able to support connecting to a
+list of Auth Service instances or to be able to connect to the Auth Service through a
+tunnel via the Proxy Service. This means that `teleport.cluster.local` appears
+in log messages that show the URL of a request made to the Auth Service, and
+does not explicitly indicate that something is misconfigured.
+
+### `ssh: overflow reading version string` and/or `502: Bad Gateway` errors
+
+(!docs/pages/includes/tls-multiplexing-warnings.mdx!)
+
diff --git a/docs/pages/admin-guides/management/external-audit-storage.mdx b/docs/pages/zero-trust-access/management/external-audit-storage.mdx
similarity index 94%
rename from docs/pages/admin-guides/management/external-audit-storage.mdx
rename to docs/pages/zero-trust-access/management/external-audit-storage.mdx
index c58381494ae3a..00c880d2d062e 100644
--- a/docs/pages/admin-guides/management/external-audit-storage.mdx
+++ b/docs/pages/zero-trust-access/management/external-audit-storage.mdx
@@ -1,8 +1,14 @@
 ---
 title: External Audit Storage
 description: Store audit logs and session recordings on your own infrastructure with Teleport Enterprise Cloud.
+tags:
+ - how-to
+ - zero-trust
+ - audit
 ---
 
+{/* lint disable page-structure remark-lint */}
+
 External Audit Storage is a feature of Teleport in which the Auth Service stores
 audit events and session recordings directly on infrastructure in any AWS
 account. 
@@ -16,8 +22,8 @@ custom audit event queries, since you can access and efficiently query your
 audit events right where they are stored.
 
 External Audit Storage is based on Teleport's
-[Athena](../../reference/backends.mdx#athena) backend for audit events and the
-[S3](../../reference/backends.mdx#s3-session-recordings) backend for session recordings. It is only
+[Athena](../../reference/deployment/backends.mdx#athena) backend for audit events and the
+[S3](../../reference/deployment/backends.mdx#s3-session-recordings) backend for session recordings. It is only
 available on Teleport Enterprise Cloud clusters running Teleport v14.2.1 or
 above.
 
@@ -161,7 +167,7 @@ recordings will be stored in your S3 bucket, and they will *not* be stored in
 the Teleport Cloud infrastructure.
 
 If you currently use the
-[Event Handler](export-audit-events/export-audit-events.mdx) plugin to export
+[Event Handler](../../zero-trust-access/export-audit-events/export-audit-events.mdx) plugin to export
 events, it will follow the switch from the old to new backends and new events
 will continue to be exported. Only events emitted after the transition to
 External Audit Storage will be visible in the Teleport UI or accessible to
diff --git a/docs/pages/admin-guides/management/management.mdx b/docs/pages/zero-trust-access/management/management.mdx
similarity index 85%
rename from docs/pages/admin-guides/management/management.mdx
rename to docs/pages/zero-trust-access/management/management.mdx
index ec3a0557bfa1f..eb1a434b626c1 100644
--- a/docs/pages/admin-guides/management/management.mdx
+++ b/docs/pages/zero-trust-access/management/management.mdx
@@ -1,7 +1,9 @@
 ---
 title: Cluster Management
 description: "Guides for performing day-two operations on your Teleport cluster."
-layout: tocless-doc
+template: "no-toc"
+tags:
+ - platform-wide
 ---
 
 In this section, you can find guides on managing a Teleport cluster after
diff --git a/docs/pages/admin-guides/management/operations/ca-rotation.mdx b/docs/pages/zero-trust-access/management/security/ca-rotation.mdx
similarity index 93%
rename from docs/pages/admin-guides/management/operations/ca-rotation.mdx
rename to docs/pages/zero-trust-access/management/security/ca-rotation.mdx
index 6828612732479..52165ec03f8a9 100644
--- a/docs/pages/admin-guides/management/operations/ca-rotation.mdx
+++ b/docs/pages/zero-trust-access/management/security/ca-rotation.mdx
@@ -1,7 +1,10 @@
 ---
 title: Certificate Authority Rotation
 description: Describes how to rotate Teleport's certificate authorities.
-tocDepth: 3
+tags:
+ - how-to
+ - platform-wide
+ - resiliency
 ---
 
 Components of a Teleport cluster authenticate to one another using either X.509
@@ -82,6 +85,8 @@ during the migration.
 |[`saml_idp`](#saml_idp)|The Teleport SAML IdP.|
 |[`spiffe`](#spiffe)|Workload Identity (SPIFFE) clients.|
 |[`oidc_idp`](#oidc_idp)|The Teleport OIDC IdP integration.|
+|[`awsra`](#awsra)|The Teleport AWS IAM Roles Anywhere integration.|
+|[`bound_keypair`](#bound_keypair)|Bound Keypair JWT verification.|
 
 ### `host`
 
@@ -301,7 +306,7 @@ rely on the Teleport IdP can verify them.
 If you are rotating this CA, then before entering the `update_clients` phase, you
 must configure any service providers that rely on the Teleport SAML IdP to trust
 the Teleport `saml_idp` CA. Follow the instructions in the
-[SAML IdP documentation](../../access-controls/idps/saml-guide.mdx) to export an
+[SAML IdP documentation](../../../identity-governance/idps/saml-guide.mdx) to export an
 XML metadata file and make it available to your service provider.
 
 ### `spiffe`
@@ -322,7 +327,7 @@ CA:
   with one of the `spiffe-svid` outputs, new SVIDs should be issued
   automatically.
 
-- If using [SPIFFE federation](../../../enroll-resources/workload-identity/federation.mdx#federation-to-teleport-workload-identity),
+- If using [SPIFFE federation](../../../machine-workload-identity/workload-identity/federation.mdx#federation-to-teleport-workload-identity),
   other SPIFFE trust domains should periodically refresh Teleport's certificate
   bundle. This interval is usually 5 minute, but you can examine the bundle
   yourself to verify:
@@ -353,6 +358,43 @@ $ curl https://example.teleport.sh/.well-known/openid-configuration | jq '.jwks_
 "https://example.teleport.sh/.well-known-jwks-oidc"
 ```
 
+### `awsra`
+
+The `awsra` CA signs X.509 certificates which are sent to AWS in exchange for AWS temporary sessions.
+AWS must be configured to trust the `awsra` CA by adding it as trust anchor.
+This integration allows for AWS CLI and Console access.
+
+After starting the rotation, you will need to add the new CA to the same AWS IAM Roles Anywhere trust anchor.
+
+During this period, AWS will trust both the old and the new CA.
+All new sessions will use the new CA.
+
+After the rotation is complete, make sure to remove the old CA from the AWS IAM Roles Anywhere trust anchor.
+
+### `bound_keypair`
+
+The `bound_keypair` CA signs JWTs issued for [Bound Keypair join state
+verification](../../../reference/machine-workload-identity/bound-keypair/concepts.mdx#join-state-verification).
+This is an additional document stored by clients that join your Teleport cluster
+using the `bound_keypair` join method that uniquely identifies each join
+attempt, and is additionally verified by Teleport during subsequent joins.
+
+During rotation, clients can continue to join as expected so long as the CA used
+to sign their join state JWT is either active or trusted, which remains true
+through the `update_servers` phase.
+
+Machine & Workload ID bots, if active, should detect the rotation event and
+renew their certificates, which will automatically fetch a new join state JWT
+signed with the new CA. Bots that are not currently running will need to be
+started once and allowed to fetch new certificates, which will also refresh the
+join state JWT.
+
+If join state verification fails after a CA rotation, you can allow clients to
+join again by [temporarily disabling join state
+verification](../../../reference/machine-workload-identity/bound-keypair/admin-guide.mdx#recovery-after-a-cluster-rollback).
+They will be issued a new join state JWT on their next join, after which
+join state verification can be safely reenabled.
+
 ## Step 2/4. Start a manual rotation
 
 Once you have chosen a CA to rotate and have planned to check or update the
diff --git a/docs/pages/admin-guides/management/security/client-timeout.mdx b/docs/pages/zero-trust-access/management/security/client-timeout.mdx
similarity index 97%
rename from docs/pages/admin-guides/management/security/client-timeout.mdx
rename to docs/pages/zero-trust-access/management/security/client-timeout.mdx
index bb06ae6ff34bd..60584d698d7a4 100644
--- a/docs/pages/admin-guides/management/security/client-timeout.mdx
+++ b/docs/pages/zero-trust-access/management/security/client-timeout.mdx
@@ -1,6 +1,11 @@
 ---
 title: Securing Sessions with Client Timeout Enforcement
+sidebar_label: Client Timeout Enforcement
 description: How to implement idle client timeouts.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 The `client_idle_timeout` in Teleport is a configurable setting that helps improve security by terminating inactive sessions after a specified period. It can be applied globally or per role, 
diff --git a/docs/pages/zero-trust-access/management/security/cloud-client-ip-restrictions.mdx b/docs/pages/zero-trust-access/management/security/cloud-client-ip-restrictions.mdx
new file mode 100644
index 0000000000000..6bf0b068ced7c
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/security/cloud-client-ip-restrictions.mdx
@@ -0,0 +1,60 @@
+---
+title: Cloud Client IP Restrictions
+description: Restrict access to your cloud cluster with a configurable allowlist.
+tags:
+ - faq
+ - platform-wide
+---
+
+**Client IP Restrictions** restrict access to your Teleport Cloud cluster, allowing traffic only from the specified network ranges (CIDR blocks).
+
+## How to enable
+This feature is only available to Teleport Cloud customers and is opt-in only. Please contact your account executive or [customer support](https://goteleport.com/support/) to enable client IP restrictions for your tenant.
+
+## Adding CIDR blocks to the IP Allowlist
+
+Log in to your Teleport Cloud account. Open the user dropdown menu on the top right of the navigation bar, and select "Help & Support," then scroll down until you see the IP Allowlist section.
+If you do not see the IP Allowlist section, then it has yet to be enabled for your account. Please refer to [how to enable](#how-to-enable).
+
+Once you add a CIDR, it will take effect in 5-20 minutes and will terminate existing connections. Changes to the allowlist are recorded in the audit log.
+
+Managing allow rules is governed by Teleport’s existing RBAC system.
+The preset `editor` role has permissions to read and write the allowlist.
+
+You can also create custom roles granting access via the `client_ip_restriction`
+resource.
+
+```yaml
+allow:
+  - resources: [ client_ip_restriction ]
+    verbs:
+      # list is required to view the allowlist
+      - list
+      # create and update are required to modify the allowlist
+      - create
+      - update
+```
+
+## Limitations
+
+### Misconfiguration
+Misconfiguration can block all access to your cluster. Make sure to include your current network before saving changes. 
+
+### Third-party service ranges
+Teleport does not auto-add third-party service ranges. You must add allow rules for any third party service that needs to access your Teleport cluster (CI/CD systems, Identity Providers, etc.)
+
+### Network security
+The allowlist applies to Teleport Cloud access; it does not replace your organization’s network/firewall policies.
+
+### Sync time
+The Client IP Restriction allowlist may take up to 20 minutes before it is fully synced. 
+
+## FAQ
+
+### How many CIDRs can you configure?
+
+By default, up to 256 CIDR blocks can be configured. Please contact your account executive or customer support to increase the limit. 
+
+### Do you support a denylist?
+
+Teleport Cloud client IP restrictions do not currently support a denylist. 
diff --git a/docs/pages/admin-guides/management/operations/db-ca-migrations.mdx b/docs/pages/zero-trust-access/management/security/db-ca-migrations.mdx
similarity index 98%
rename from docs/pages/admin-guides/management/operations/db-ca-migrations.mdx
rename to docs/pages/zero-trust-access/management/security/db-ca-migrations.mdx
index 9dfe489e1a18b..09968c79af8ee 100644
--- a/docs/pages/admin-guides/management/operations/db-ca-migrations.mdx
+++ b/docs/pages/zero-trust-access/management/security/db-ca-migrations.mdx
@@ -1,6 +1,10 @@
 ---
 title: Database CA Migrations
 description: How to complete Teleport Database CA migrations.
+tags:
+ - conceptual
+ - zero-trust
+ - resiliency
 ---
 
 In Teleport, self-hosted databases must be configured with certificates to
@@ -59,7 +63,7 @@ For a dynamic database, put your CA's root certificate in `spec.tls.ca_cert`.
 
 For examples and more information, consult the
 [configuration
-reference](../../../reference/agent-services/database-access-reference/configuration.mdx)
+reference](../../../enroll-resources/database-access/reference/configuration.mdx)
 for protecting databases with Teleport.
 </details>
 
diff --git a/docs/pages/zero-trust-access/management/security/idp-compromise.mdx b/docs/pages/zero-trust-access/management/security/idp-compromise.mdx
new file mode 100644
index 0000000000000..2e03a5038209a
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/security/idp-compromise.mdx
@@ -0,0 +1,502 @@
+---
+title: Harden your Cluster Against IdP Compromises
+sidebar_label: Preventing IdP Compromise
+description: Implement cluster-wide hardening measures.
+videoBanner: vQgKkD4ZRDU
+tags:
+ - how-to
+ - zero-trust
+ - resiliency
+---
+
+This guide aims to help you fortify your identity infrastructure and mitigate the risks associated with IdP weaknesses.
+
+An IdP compromise occurs when an attacker gains unauthorized access to your identity management
+system, potentially allowing them to impersonate legitimate users, escalate privileges, or access
+sensitive information. This can happen through various means, such as exploiting software vulnerabilities,
+stealing credentials, or social engineering attacks.
+
+While many organizations have implemented basic security measures like single sign-on (SSO) and multi-factor authentication (MFA),
+these alone may not be sufficient to protect against sophisticated attacks targeting your IdP.
+Attackers are constantly evolving their techniques, and traditional security measures may have limitations
+or vulnerabilities that can be exploited.
+
+![IdP threat vector tree](../../../../img/access-controls/idp-graph.png)
+
+To enhance your defense against IdP compromises, we recommend implementing the following comprehensive security measures.
+
+## Set up cluster-wide WebAuthn
+Implement strong, phishing-resistant authentication across
+your entire infrastructure using WebAuthn standards. WebAuthn, a W3C standard and part of FIDO2,
+enables public-key cryptography for web authentication. Teleport supports WebAuthn as a multi-factor
+for logging into Teleport (via tsh login or Web UI) and accessing SSH nodes or Kubernetes clusters.
+It's compatible with hardware keys (e.g., YubiKeys, SoloKeys) and biometric authenticators like Touch ID and Windows Hello.
+
+### Prerequisites
+
+- A running Teleport cluster or Teleport Cloud, version 16 or later. If you want to get started with Teleport,
+[sign up](https://goteleport.com/signup) for a free trial.
+
+- The `tctl` admin tool and `tsh` client tool.
+
+  Visit [Installation](../../../installation/installation.mdx) for instructions on downloading `tctl` and `tsh`.
+
+- WebAuthn hardware device, such as YubiKey or SoloKey
+
+- A Web browser with [WebAuthn support](https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+### Step 1/3. Enable WebAuthn support
+
+WebAuthn is disabled by default. To enable WebAuthn support, update your
+Teleport configuration as below:
+
+  Edit the `cluster_auth_preference` resource:
+
+  ```code
+  $ tctl edit cap
+  ```
+
+ Update the `cluster_auth_preference` definition to include the following content:
+
+  ```yaml
+  kind: cluster_auth_preference
+  version: v2
+  metadata:
+    name: cluster-auth-preference
+  spec:
+    type: local
+    # To enable WebAuthn support, include "webauthn" as a second factor method.
+    second_factors: ["webauthn"]
+    webauthn:
+      # Required, replace with proxy web address (example.com, example.teleport.sh).
+      # rp_id is the public domain of the Teleport Proxy Service, *excluding* protocol
+      # (https://) and port number.
+      rp_id: example.com
+      # Optional, attestation_allowed_cas is an optional allow list
+      # of certificate authorities.
+      attestation_allowed_cas:
+      # Entries can be paths to certificate files:
+      - "/path/to/allowed_ca.pem"
+      # Entries can also be inline certificates:
+      - |
+        -----BEGIN CERTIFICATE-----
+        ...
+        -----END CERTIFICATE-----
+      # Optional, attestation_denied_cas is an optional deny list
+      # of certificate authorities.
+      attestation_denied_cas:
+      # Entries can be paths to certificate files:
+      - "/path/to/denied_ca.pem"
+      # Entries can also be inline certificates:
+      - |
+        -----BEGIN CERTIFICATE-----
+        ...
+        -----END CERTIFICATE-----
+  ```
+
+  Save and exit the file. `tctl` will update the remote definition:
+
+  ```text
+  cluster auth preference has been updated
+  ```
+
+### `webauthn` fields definitions
+
+`rp_id` is the public domain of the Teleport Proxy Service, *excluding* protocol
+  (`https://`) and port number.
+
+`attestation_allowed_cas` is an optional allow list of certificate authorities
+(as local file paths or inline PEM certificate strings) for
+[device verification](
+https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
+
+This field allows you to restrict which device models and vendors you trust.
+Devices outside of the list will be rejected during registration. By default all
+devices are allowed. If you must use attestation, consider using
+`attestation_denied_cas` to forbid troublesome devices instead.
+
+`attestation_denied_cas` is an optional deny list of certificate authorities (as
+local file paths or inline PEM certificate strings) for [device verification](
+https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
+
+This field allows you to forbid specific device models and vendors, while
+allowing all others (provided they clear `attestation_allowed_cas` as well).
+Devices within this list will be rejected during registration. By default no
+devices are forbidden.
+
+### Step 2/3. Register WebAuthn devices as a user
+
+A user can register multiple WebAuthn devices using `tsh`:
+
+```code
+$ tsh mfa add
+# Choose device type [TOTP, WEBAUTHN]: webauthn
+# Enter device name: desktop yubikey
+# Tap any *registered* security key or enter a code from a *registered* OTP device:
+# Tap your *new* security key
+# MFA device "desktop yubikey" added.
+```
+
+### Step 3/3. Log in using WebAuthn
+
+Once a WebAuthn device is registered, the user will be prompted for it on login:
+
+```code
+$ tsh login --proxy=example.teleport.sh
+# Enter password for Teleport user codingllama:
+# Tap any security key or enter a code from a OTP device:
+# > Profile URL:        https://example.teleport.sh
+#   Logged in as:       codingllama
+#   Cluster:            example.teleport.sh
+#   Roles:              access, editor, reviewer
+#   Logins:             codingllama
+#   Kubernetes:         enabled
+#   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
+#   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+<Admonition type="note">
+  WebAuthn for logging in to Teleport is only required for [local
+  users](../../../reference/access-controls/authentication.mdx#local-no-authentication-connector).
+  SSO users should configure multi-factor authentication in their SSO provider.
+</Admonition>
+
+## Configure per-session MFA
+Ensure that multi-factor authentication is required for each session, not just at initial login,
+to maintain continuous security. Teleport's per-session MFA enhances security by protecting
+against compromised on-disk certificates. It requires additional MFA checks when initiating new SSH, Kubernetes, database, or desktop sessions.
+
+Teleport supports requiring additional multi-factor authentication checks
+when starting new:
+
+- SSH connections (a single `tsh ssh` call, Web UI SSH session or Teleport Connect SSH session)
+- Kubernetes sessions (a single `kubectl` call)
+- Database sessions (a single `tsh db connect` call)
+- Application sessions
+- Desktop sessions
+
+<Admonition type="note">
+  In addition to per-session MFA, enable login MFA in your SSO provider and/or
+  for all [local Teleport
+  users](../../../reference/access-controls/authentication.mdx)
+  to improve security.
+</Admonition>
+
+To enforce MFA checks for all roles, edit your cluster authentication
+configuration:
+
+Edit your `cluster_auth_preference` resource:
+
+```code
+$ tctl edit cap
+```
+
+Ensure that the resource contains the following content:
+
+```yaml
+kind: cluster_auth_preference
+metadata:
+  name: cluster-auth-preference
+spec:
+  require_session_mfa: true
+version: v2
+```
+
+Save and close the file in your editor to apply your changes.
+
+
+### Per role
+
+To enforce MFA checks for a specific role, update the role to contain:
+
+```yaml
+kind: role
+version: v7
+metadata:
+  name: example-role-with-mfa
+spec:
+  options:
+    # require per-session MFA for this role
+    require_session_mfa: true
+  allow:
+    ...
+  deny:
+    ...
+```
+
+## Implement cluster-wide Device Trust
+Develop a system to verify and manage trusted devices across your organization, reducing the risk
+of unauthorized access from unknown or compromised devices. Device Trust adds an extra layer of security by requiring the use of trusted devices
+for accessing protected resources, complementing user identity and role enforcement. This can be
+configured cluster-wide or via RBAC. Supported resources include apps (role-based only), SSH nodes,
+databases, Kubernetes clusters, and first MFA device enrollment. The latter helps prevent auto-provisioning of new users through compromised IdPs.
+
+<Admonition type="warning" title="Machine & Workload Identity and Device Trust">
+
+  We do not currently support Machine & Workload Identity and Device Trust.
+  Requiring Device Trust cluster-wide or for roles impersonated by Machine &
+  Workload Identity will prevent credentials produced by Machine & Workload
+  Identity from being used to connect to resources.
+
+  As a work-around, configure Device Trust enforcement on a role-by-role basis and
+  ensure that it is not required for roles that you will impersonate using
+  Machine & Workload Identity
+</Admonition>
+
+### Prerequisites
+
+(!docs/pages/includes/device-trust/prereqs.mdx!)
+
+The `tctl` tool is used to manage the device inventory. A device admin is
+responsible for managing devices, adding new devices to the inventory and
+removing devices that are no longer in use.
+
+<Admonition type="tip" title="Self enrollment">
+  Users with the preset `editor` or `device-admin` role
+  can register and enroll their device in a single step with the following command:
+  ```code
+  $ tsh device enroll --current-device
+  ```
+</Admonition>
+
+### Step 1/3. Register a trusted device
+
+Before you can enroll the device, you need to register it. To register
+a device, you first need to determine its serial number.
+
+Retrieve device serial number with `tsh` (must be run on the device you want to register):
+```code
+$ tsh device asset-tag
+(=devicetrust.asset_tag=)
+```
+<details>
+<summary>Manually retrieving device serial</summary>
+  <Tabs>
+  <TabItem label="macOS">
+    The serial number is visible under Apple menu -> "About This Mac" -> "Serial number".
+  </TabItem>
+
+  <TabItem label="Windows and Linux">
+    Windows and Linux devices can have multiple serial numbers depending on the
+    configuration made by the manufacturer.
+
+    Teleport will pick the first available value from the following:
+    - System asset tag
+    - System serial number
+    - Baseboard serial number
+
+    To find the value chosen by Teleport, run the following command:
+
+    ```code
+    $ tsh device asset-tag
+    (=devicetrust.asset_tag=)
+    ```
+  </TabItem>
+</Tabs>
+</details>
+
+Replace <Var name="(=devicetrust.asset_tag=)" description="The serial number to be registered"/>
+with the serial number of the device you wish to enroll, and
+<Var name="macos" /> with your operating system. Run the
+`tctl devices add` command:
+
+```code
+$ tctl devices add --os='<Var name="macos"/>' --asset-tag='<Var name="(=devicetrust.asset_tag=)"/>'
+Device <Var name="(=devicetrust.asset_tag=)"/>/macos added to the inventory
+```
+
+Use `tctl` to check that the device has been registered:
+
+```code
+$ tctl devices ls
+Asset Tag    OS    Source Enroll Status Owner Device ID
+------------ ----- ------ ------------- ----- ------------------------------------
+(=devicetrust.asset_tag=) macOS        not enrolled        (=devicetrust.device_id=)
+```
+
+### Step 2/3. Create a device enrollment token
+
+A registered device becomes a trusted device after it goes through the
+enrollment ceremony. To enroll the device, a device enrollment token is
+necessary. The token is created by a device admin and sent to the person
+performing the enrollment off-band (for example, via a corporate chat).
+
+To create an enrollment token run the command below, where `--asset-tag` is
+the serial number of the device we want to enroll:
+
+```code
+$ tctl devices enroll --asset-tag="(=devicetrust.asset_tag=)"
+Run the command below on device "(=devicetrust.asset_tag=)" to enroll it:
+tsh device enroll --token=(=devicetrust.enroll_token=)
+```
+
+### Step 3/3. Enroll a trusted device
+
+To perform the enrollment ceremony, using the device specified above, type the
+command printed by `tctl devices enroll`:
+
+```code
+$ tsh device enroll --token=(=devicetrust.enroll_token=)
+Device "(=devicetrust.asset_tag=)"/macOS enrolled
+
+$ tsh logout
+$ tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=) # fetch new certificates
+Enter password for Teleport user (=clusterDefaults.username=):
+Tap any security key
+Detected security key tap
+> Profile URL:        (=clusterDefaults.clusterName=):443
+  Logged in as:       (=clusterDefaults.username=)
+  Cluster:            (=clusterDefaults.clusterName=)
+  Roles:              access, editor
+  Logins:             (=clusterDefaults.username=)
+  Kubernetes:         enabled
+  Valid until:        2023-06-23 02:47:05 -0300 -03 [valid for 12h0m0s]
+  Extensions:         teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
+```
+The presence of the `teleport-device-*` extensions shows that the device was
+successfully enrolled and authenticated. The device above is now a trusted device.
+
+### Auto-Enrollment
+
+Distributing enrollment tokens to many users can be challenging. To address that,
+Teleport supports auto-enrollment. When enabled, auto-enrollment automatically
+enrolls the user's device in their next Teleport (`tsh`) login.
+
+For auto-enrollment to work, the following conditions must be met:
+- A device must be registered. Registration may be [manual](#implement-cluster-wide-device-trust) or
+  performed using [an MDM integration](../../../identity-governance/device-trust/device-trust.mdx#mdm-integrations).
+- Auto-enrollment must be enabled in the cluster setting.
+
+### Step 1/2. Enable auto-enrollment in your cluster settings
+
+Modify the dynamic config resource using `tctl edit cluster_auth_preference`:
+
+```diff
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  # ...
+  device_trust:
+    mode: "required"
++   auto_enroll: true
+```
+
+### Step 2/2. Log out and back in
+
+Once enabled, users with their device registered in Teleport will have their
+device enrolled to Teleport in their next login.
+
+```code
+$ tsh logout
+All users logged out.
+$ tsh login --proxy=(=clusterDefaults.clusterName=) --user=(=clusterDefaults.username=)
+Enter password for Teleport user (=clusterDefaults.username=):
+Tap any security key
+Detected security key tap
+> Profile URL:        (=clusterDefaults.clusterName=):443
+  Logged in as:       (=clusterDefaults.username=)
+  Cluster:            (=clusterDefaults.clusterName=)
+  Roles:              access, editor
+  Logins:             (=clusterDefaults.username=)
+  Kubernetes:         enabled
+  Valid until:        2023-06-23 02:47:05 -0300 -03 [valid for 12h0m0s]
+  Extensions:         teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
+```
+
+The presence of the `teleport-device-*` extensions shows that the device was
+successfully enrolled and authenticated.
+
+## Require MFA for administrative actions
+
+Add an extra layer of security for sensitive administrative operations by requiring multi-factor authentication
+for these high-privilege actions. Teleport enforces additional MFA verification for administrative
+actions across all clients (tctl, tsh, Web UI, and Connect). This feature adds an extra security
+layer by re-verifying user identity immediately before any admin action, mitigating risks from compromised admin accounts.
+
+By adopting these advanced security measures, you can create a robust defense against IdP compromises and significantly reduce your organization's attack surface.
+In the following sections, we'll dive deeper into each of these recommendations, providing step-by-step guidance on implementation and best practices.
+
+<Admonition type="warning">
+  When MFA for administrative actions is enabled, user certificates produced
+  with `tctl auth sign` will no longer be suitable for automation due to the
+  additional MFA checks.
+
+  We recommend using Machine ID to issue certificates for automated workflows,
+  which uses role impersonation that is not subject to MFA checks.
+
+  Certificates produced with `tctl auth sign` directly on an Auth Service instance using the super-admin
+  role are not subject to MFA checks to support legacy self-hosted setups.
+</Admonition>
+
+### Prerequisites
+
+- (!docs/pages/includes/tctl.mdx!)
+- [WebAuthn configured](#set-up-cluster-wide-WebAuthn) on this cluster
+- Multi-factor hardware device, such as YubiKey or SoloKey
+- A Web browser with [WebAuthn support](https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
+  SSH or desktop sessions from the Teleport Web UI).
+
+MFA for administrative actions is automatically enforced for clusters where WebAuthn is the only form of multi-factor allowed.
+
+<Admonition type="note">
+  In a future major version, Teleport may enforce MFA for administrative actions
+  for a wider range of cluster configurations.
+</Admonition>
+
+Examples of administrative actions include, but are not limited to:
+
+- Resetting or recovering user accounts
+- Inviting new users
+- Updating cluster configuration resources
+- Modifying access management resources
+- Approving Access Requests
+- Generating new join tokens
+- Impersonation
+- Creating new bots for Machine & Workload Identity
+
+This is an advanced security feature that protects users against compromises of
+their on-disk Teleport certificates.
+
+### Step 1/2. Edit the resource
+
+  Edit the `cluster_auth_preference` resource:
+
+  ```code
+  $ tctl edit cap
+  ```
+
+Update the `cluster_auth_preference` definition to include the following content:
+
+  ```yaml
+  kind: cluster_auth_preference
+  version: v2
+  metadata:
+    name: cluster-auth-preference
+  spec:
+    type: local
+    second_factors: ["webauthn"]
+    webauthn:
+      rp_id: example.com
+  ```
+
+  ### Step 2/2. Save and exit the file
+
+  The command `tctl` will update the remote definition:
+
+  ```text
+  cluster auth preference has been updated
+  ```
+
+## Next steps
+For additional cluster hardening measures, see:
+
+- [Passwordless Authentication](../../authentication/passwordless.mdx): Provides passwordless and usernameless authentication.
+- [Locking](../../../identity-governance/locking.mdx): Lock access to active user sessions or hosts.
+- [Moderated Sessions](../../authentication/joining-sessions.mdx): Require session auditors and allow fine-grained live session access.
+- [Hardware Key Support](../../authentication/hardware-key-support.mdx): Enforce the use of hardware-based private keys.
+- [Configuring SSO for MFA checks](../../sso/sso-for-mfa.mdx): Delegate per-session MFA to your IdP. 
+
diff --git a/docs/pages/admin-guides/management/security/proxy-protocol.mdx b/docs/pages/zero-trust-access/management/security/proxy-protocol.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/security/proxy-protocol.mdx
rename to docs/pages/zero-trust-access/management/security/proxy-protocol.mdx
index 6f2a06a7a4b75..a13563728fe80 100644
--- a/docs/pages/admin-guides/management/security/proxy-protocol.mdx
+++ b/docs/pages/zero-trust-access/management/security/proxy-protocol.mdx
@@ -1,6 +1,10 @@
 ---
 title: Run Teleport with the PROXY Protocol
+sidebar_label: PROXY Protocol
 description: How to securely configure PROXY protocol usage with Teleport.
+tags:
+ - how-to
+ - platform-wide
 ---
 
 This guide shows you how to configure the Teleport Auth Service and Proxy
@@ -43,14 +47,14 @@ PROXY TCP4 127.0.0.1 127.0.0.2 12345 42\r\n
 - A self-hosted Teleport Enterprise account. If you want to get started with
   self-hosted Teleport Enterprise, [contact
   Sales](https://goteleport.com/contact-us/). You can also [set up a demo
-  environment](../../deploy-a-cluster/linux-demo.mdx) with Teleport Community Edition.
+  environment](../../../get-started/deploy-community.mdx) with Teleport Community Edition.
 
   We recommend reading and understanding this guide completely before
   configuring your Teleport cluster to use the PROXY protocol.
 
-- The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=).
+- The `tctl` admin tool and `tsh` client tool.
 
-  Visit [Installation](../../../installation.mdx) for instructions on downloading
+  Visit [Installation](../../../installation/installation.mdx) for instructions on downloading
   `tctl` and `tsh`.
 
 ## Step 1/2. Plan your Teleport deployment
diff --git a/docs/pages/admin-guides/management/security/reduce-blast-radius.mdx b/docs/pages/zero-trust-access/management/security/reduce-blast-radius.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/security/reduce-blast-radius.mdx
rename to docs/pages/zero-trust-access/management/security/reduce-blast-radius.mdx
index c6fb564fc13be..dbf93d6b56d19 100644
--- a/docs/pages/admin-guides/management/security/reduce-blast-radius.mdx
+++ b/docs/pages/zero-trust-access/management/security/reduce-blast-radius.mdx
@@ -1,6 +1,11 @@
 ---
 title: Reducing the Blast Radius of Attacks
+sidebar_label: Limiting Attack Blast Radius
 description: How to configure Teleport to minimize the scope of security breaches
+tags:
+ - conceptual
+ - platform-wide
+ - resiliency
 ---
 
 Teleport encourages users to practice defense in depth so that every component of their infrastructure is safe against attacks, even if an attacker is partially successful. You can configure Teleport to add layers of protection to your cluster when users authenticate or request elevated privileges. In this guide, we will show you how to:
@@ -211,10 +216,10 @@ Two `user`s can grant elevated privileges to another `user` temporarily without
 ## Next steps
 
 ### Guides
-- [Per-session MFA](../../access-controls/guides/per-session-mfa.mdx)
-- [Dual authorization](../../access-controls/guides/dual-authz.mdx)
-- [Role templates, allow/deny rules, and traits](../../access-controls/guides/role-templates.mdx)
-- [Access Requests](../../access-controls/access-requests/access-requests.mdx)
+- [Per-session MFA](../../authentication/per-session-mfa.mdx)
+- [Dual authorization](../../../identity-governance/access-requests/access-requests.mdx)
+- [Role templates, allow/deny rules, and traits](../../rbac-get-started/role-templates.mdx)
+- [Access Requests](../../../identity-governance/access-requests/access-requests.mdx)
 
 ### Background reading
 - [Authentication connectors](../../../reference/access-controls/authentication.mdx)
diff --git a/docs/pages/admin-guides/management/security/restrict-privileges.mdx b/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx
similarity index 93%
rename from docs/pages/admin-guides/management/security/restrict-privileges.mdx
rename to docs/pages/zero-trust-access/management/security/restrict-privileges.mdx
index 54a75149445a6..72b1e904d3581 100644
--- a/docs/pages/admin-guides/management/security/restrict-privileges.mdx
+++ b/docs/pages/zero-trust-access/management/security/restrict-privileges.mdx
@@ -1,6 +1,11 @@
 ---
 title: Restrict Access for Privileged Accounts
+sidebar_label: Privileged Accounts
 description: Explains the risks of root-level access to Teleport-protected resources.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 As an administrator, you need to make informed decisions about when and how to grant
@@ -10,7 +15,7 @@ and determine whether to apply network-level restrictions.
 
 ## Labels and label expressions
 
-As you learned in [Add Labels to Resources](../../management/admin/labels.mdx), labels enable you to group, filter, and control access to 
+As you learned in [Add Labels to Resources](../../rbac-get-started/labels.mdx), labels enable you to group, filter, and control access to 
 nodes and services in your infrastructure that you want to protect with Teleport. 
 When combined with allow and deny rules in Teleport roles, labels become the primary mechanism 
 for granting or denying access to critical resources.
@@ -60,7 +65,7 @@ following guidelines:
 You should make sure that the Teleport storage backend you use can't be accessed directly or modified. 
 For example, you should ensure that the storage you use for audit log events and session recordings is
 secured so the data can't be tampered with. For more information about managing storage, see 
-[Storage backends](../../../reference/backends.mdx)
+[Storage backends](../../../reference/deployment/backends.mdx)
 
 ## Restrict network access
 
diff --git a/docs/pages/zero-trust-access/management/security/revoking-access.mdx b/docs/pages/zero-trust-access/management/security/revoking-access.mdx
new file mode 100644
index 0000000000000..a391ec497976d
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/security/revoking-access.mdx
@@ -0,0 +1,37 @@
+---
+title: Revoking Access
+description: Learn how to revoke access before Teleport certificates expire
+tags:
+ - platform-wide
+ - resiliency
+---
+
+Teleport's approach to using short-lived certificates for all infrastructure
+access means that it can generate large numbers of certificates every day. For
+this reason, Teleport does not support traditional certificate revocation.
+
+There are two options available for revoking access: CA rotations and Teleport locks.
+
+## CA rotations
+
+To generate a new certificate authority and invalidate user certificates issued
+by the current CA, run `tctl auth rotate --type=user`. This process will require
+that the newly generated CA certificate is uploaded to your entire fleet of
+OpenSSH servers. This can be a disruptive change, especially in environments
+that lack automation, so proceed with caution.
+
+See the [CA rotations guide](ca-rotation.mdx) for more details on
+how to execute the procedure.
+
+## Locks
+
+Teleport locks allow you to permanently or temporarily revoke access to a number
+of different "targets". Supported lock targets include: specific users, roles,
+servers, desktops, or MFA devices. For Machine & Workload Identity bots, this
+additionally includes the join token name (for delegated join methods) and the
+bot instance UUID. After you create a lock, all existing sessions where the loc
+applies are terminated and new sessions are rejected while the lock remains in
+force.
+
+For more information, read our
+[Session and Identity Locking Guide](../../../identity-governance/locking.mdx).
diff --git a/docs/pages/admin-guides/management/security/security.mdx b/docs/pages/zero-trust-access/management/security/security.mdx
similarity index 95%
rename from docs/pages/admin-guides/management/security/security.mdx
rename to docs/pages/zero-trust-access/management/security/security.mdx
index ab9c62e9cc316..58a3b0b46b212 100644
--- a/docs/pages/admin-guides/management/security/security.mdx
+++ b/docs/pages/zero-trust-access/management/security/security.mdx
@@ -1,6 +1,10 @@
 ---
 title: Secure Practices for Teleport Clusters
+sidebar_label: Cluster Security
 description: Highlights recommended practices and ways to harden security for your Teleport cluster.
+tags:
+ - zero-trust
+ - resiliency
 ---
 
 To help ensure that Teleport can protect your infrastructure in a production environment, you should 
diff --git a/docs/pages/zero-trust-access/management/security/selinux.mdx b/docs/pages/zero-trust-access/management/security/selinux.mdx
new file mode 100644
index 0000000000000..d08406c8966f9
--- /dev/null
+++ b/docs/pages/zero-trust-access/management/security/selinux.mdx
@@ -0,0 +1,206 @@
+---
+title: "SELinux Module for Teleport SSH Service"
+sidebar_label: SELinux Module
+description: "How to configure SELinux to enforce Teleport SSH Service."
+tags:
+ - conceptual
+ - zero-trust
+ - resiliency
+---
+
+<Admonition type="note">
+
+This feature is currently under active development. Future releases will extend SELinux policy to support
+more Teleport features, and integration with Teleport Managed Updates.
+
+</Admonition>
+
+The Teleport SSH Service SELinux module allows SELinux to confine the Teleport SSH Service Service. It ensures that Teleport SSH Service processes can only perform explicitly allowed operations, reducing the attack surface and preventing unauthorized actions even if the Teleport binary were compromised.
+
+## Supported features
+
+The Teleport SSH Service SELinux module supports the following Teleport SSH Service features:
+
+- handling SSH connections
+- PAM support
+- SSH agent forwarding
+- auditd logging
+- enhanced session recording
+
+## Supported platforms
+
+The SELinux policy module for Teleport SSH Service is officially supported on Red Hat Enterprise Linux (RHEL) **8 and 9 only**.
+
+## Installation
+
+Before installing the SELinux module ensure that the `selinux-policy-devel` package is installed:
+
+```code
+$ sudo dnf install selinux-policy-devel
+```
+
+To install the SELinux module, run the `install-selinux.sh` script included in Linux tarballs as `root`:
+
+```code
+$ sudo ./install-selinux.sh
+# if teleport is not in your PATH
+$ sudo ./install-selinux.sh -t /path/to/teleport
+```
+
+This script performs the following:
+
+1. Extracts the SELinux module from the installed Teleport binary.
+1. Customizes the module based on the Teleport configuration.
+1. Compiles and installs the `teleport_ssh` SELinux module into the system policy.
+1. Labels any existing Teleport SSH Service binaries and directories.
+
+The script needs to read the configuration file of Teleport SSH Service in order to customize the module
+and label files and directories correctly. It will read `/etc/teleport.yaml` by default, but you can specify a different location for the configuration file using the `-c` flag:
+
+```code
+$ sudo ./install-selinux.sh -c /path/to/teleport.yaml
+```
+
+<Admonition type="note">
+
+You must re-run `install-selinux.sh` whenever your Teleport SSH Service agents are updated. This ensures the SELinux module matches the version of the binaries in use.
+
+</Admonition>
+
+Future versions of Teleport will make managed updates with `teleport-update` the primary way to manage the SELinux module.
+
+## SELinux modes
+
+SELinux can operate in three modes:
+
+| Mode           | Description                                                          |
+| -------------- | -------------------------------------------------------------------- |
+| Enforcing  | SELinux policy is enforced. Violations are blocked and logged.       |
+| Permissive | SELinux policy is not enforced, but violations are logged (allowed). |
+| Disabled   | SELinux is turned off entirely; no policy is loaded or logged.       |
+
+Use `getenforce` or `sestatus` to check the current mode. To change the mode, use `setenforce` or `semanage`. Teleport SSH Service will work if SELinux is in permissive mode, but this is not recommended for
+production use. Permissive mode is only recommended for testing and development, as it only logs policy violations and does not enforce them. For production use, SELinux should be set to the **enforcing** mode.
+
+## Enforcing Teleport SSH Service with SELinux
+
+Once the module is installed, Teleport must be explicitly told to enable SELinux support by adding the `--enable-selinux` flag when starting:
+
+```code
+$ teleport start --enable-selinux
+```
+
+<Admonition type="note">
+
+Only the SSH service supports SELinux enforcement, if you try and start Teleport with `--enable-selinux` passed with other services enabled or the SSH service not enabled, Teleport will exit with an error.
+
+</Admonition>
+
+When `--enable-selinux` is passed, Teleport will exit with an error if:
+- SELinux is not installed on the system.
+- SELinux is disabled.
+- The `teleport_ssh` module is not installed or is disabled.
+- Teleport is not running under the correct SELinux domain.
+
+Teleport's binary must have the `teleport_ssh_exec_t` type. The install script will label the Teleport binary with the correct type if it is not already.
+If you copy or move the binary the label will need to be updated. You can simply re-run the install script to update the label, or you can update the label manually:
+
+```code
+$ sudo semanage fcontext -a -t teleport_ssh_exec_t /path/to/teleport
+```
+
+<Admonition type="note">
+
+Teleport will probably not run under the correct `teleport_ssh_t` domain and not be enforced by SELinux unless it is running as a **systemd service**. For more information on SELinux domains refer to the Red Hat article [Getting started with SELinux](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/getting-started-with-selinux_using-selinux).
+
+</Admonition>
+
+The optional `--ensure-selinux-enforcing` flag causes Teleport to exit with an error if:
+
+- SELinux is in permissive mode.
+- The required `teleport_ssh` module is permissive.
+
+This provides a safety check to guarantee that Teleport SSH Service is always running under the protection of SELinux policy enforcement. It may be necessary to run Teleport without this flag when testing SELinux configuration or diagnosing issues.
+
+## Inspecting the SELinux module source
+
+The module source consists of two files, the type enforcement file and the file contexts file.
+
+The type enforcement file is the heart of the module and contains statements that define what Teleport SSH Service processes are allowed to do.
+
+The file contexts file maps files and directories Teleport SSH Service uses to the appropriate SELinux labels. For more information on SELinux labels refer to the Red Hat article [SELinux Contexts - Labeling Files](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files).
+
+The customized module source can be printed using Teleport:
+
+```code
+# print type enforcement file
+$ teleport selinux-ssh module-source 
+# print file contexts file
+$ teleport selinux-ssh file-contexts
+```
+
+## Customizing the SELinux module
+
+If you need to grant additional permissions beyond the defaults, you can create and install your own SELinux policy module targeting the `teleport_ssh_t` domain (used by the official module).
+
+<Admonition type="warning">
+
+The official Teleport SSH Service module is named `teleport_ssh`. The install script will overwrite any module of that name. Be sure to name your custom policy module something else (e.g., `my_teleport_ssh_extras`).
+
+</Admonition>
+
+1. Write a new `.te` file defining the extra rules for `teleport_ssh_t`.
+
+1. Compile and package your module:
+
+   ```code
+   $ make -f /usr/share/selinux/devel/Makefile my_teleport_ssh_extras.pp
+   ```
+
+1. Install it:
+
+   ```code
+   $ semodule -i my_teleport_ssh_extras.pp
+   ```
+
+For detailed guidance on writing SELinux modules, refer to the Red Hat article [How to write SELinux policy modules](https://access.redhat.com/articles/6999267)
+
+## Troubleshooting SELinux and Teleport SSH Service
+
+When Teleport SSH Service is blocked by SELinux, use the following tools to diagnose and resolve policy issues:
+
+1. **sealert** (from the `setroubleshoot-server` package):
+
+   ```code
+   $ sudo sealert -a /var/log/audit/audit.log
+   ```
+
+   This generates a human-readable report of SELinux denials and recommendations for policy adjustments.
+
+1. **audit2why** (from the `policycoreutils-python-utils` package):
+
+   ```code
+   $ ausearch -m AVC -c teleport | audit2why
+   ```
+
+   This explains why a denial occurred and suggests which policy rules are missing.
+
+1. **audit2allow** (to generate a custom policy module):
+
+   ```code
+   $ ausearch -m AVC -c teleport | audit2allow -M my_teleport_fix
+   ```
+
+   Use this approach to create a small, targeted module to grant the necessary permissions.
+
+If Teleport fails to start with `--enable-selinux --ensure-selinux-enforcing`, check:
+
+- That SELinux is in **enforcing** mode (`getenforce`).
+
+- That the `teleport_ssh` module is listed:
+
+  ```code
+  $ semodule -l | grep teleport_ssh
+  ```
+
+- The audit log (`/var/log/audit/audit.log`) for detailed AVC messages.
diff --git a/docs/pages/zero-trust-access/rbac-get-started/labels.mdx b/docs/pages/zero-trust-access/rbac-get-started/labels.mdx
new file mode 100644
index 0000000000000..e5f1b19fa0889
--- /dev/null
+++ b/docs/pages/zero-trust-access/rbac-get-started/labels.mdx
@@ -0,0 +1,387 @@
+---
+title: Add Labels to Resources
+sidebar_label: Labels
+description: How to assign static and command-based dynamic labels to Teleport resources.
+tags:
+ - how-to
+ - zero-trust
+ - infrastructure-identity
+---
+
+Teleport allows you to add arbitrary key-value pairs to applications, servers,
+databases, and other resources in your cluster. You can use labels to do
+the following:
+
+- Filter the resources returned when running `tctl` and `tsh` commands.
+- Define roles that limit the resources Teleport users can access.
+
+This guide demonstrates how to add labels to enrolled server resources.
+However, you can follow similar steps to add labels to other types of resources.
+
+## How it works
+
+The labels you assign to resources can be **static labels**, **dynamic labels**, or **resource-based labels**.
+
+- Static labels are hardcoded in the Teleport configuration file and don't change
+while the `teleport` process is running. For example, you might use a static label to identify
+the resources in a `staging` or `production` environment.
+- Dynamic labels—also known as **commands-based labels**—allow you to generate labels at runtime.
+With a dynamic label, the `teleport` process executes an external command on its host at
+a configurable frequency and the output of the command becomes the label value.
+- Resource-based labels allow you to add labels to an instance without restarting the `teleport`
+process or editing the configuration file.
+
+You can add multiple static, dynamic, and resource-based labels for the same resource.
+However, you can't add static labels that use the same key with different values or use
+a static label to define multiple potential values.
+
+Dynamic labels are especially useful for decoupling a label value from the Teleport configuration.
+For example, if you start Teleport on an Amazon EC2 instance, you can use a dynamic label to set the
+`region` value based on the result from a command sent to the EC2 instance
+[metadata API](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html).
+The dynamic label enables you to use the same configuration for each server in an Amazon Machine Image
+but filter and limit access to the servers based on their AWS region.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- A Linux host where you will run a Teleport Agent. This guide shows you how to
+  apply labels to an instance of the Teleport SSH Service. You can use the
+  technique shown in the guide to label any Teleport-protected resource.
+
+(!docs/pages/includes/tctl.mdx!)
+
+## Step 1/2. Install Teleport
+
+1. Select a Linux server where you will run a Teleport Agent.
+
+1. (!docs/pages/includes/install-linux.mdx!)
+
+1. Generate an invitation token for the host.
+
+   The invitation token is required for the local computer to join the Teleport cluster.
+   The following example generates a new token that is valid for five minutes and can be used
+   to enroll a server:
+
+   ```code
+   $ tctl tokens add --ttl=5m --type=node
+   # The invite token: (=presets.tokens.first=)
+   ```
+
+1. List all generated non-expired tokens by running the following command:
+
+   ```code
+   $ tctl tokens ls
+   # Token                            Type        Labels Expiry Time (UTC)
+   # -------------------------------- ----------- ------ -------------------------------
+   # (=presets.tokens.first=) Node,Db,App        10 Aug 23 19:49 UTC (4m11s)
+   ```
+
+1. Write the join token to a file on the host at `/tmp/token`:
+
+   ```code
+   $ echo (=presets.tokens.first=) | sudo tee /tmp/token
+   ```
+
+1. On the host where you plan to run the Agent, generate a configuration file
+   that enables the Teleport SSH Service. Replace `teleport.example.com` with
+   the host and port of your Teleport Proxy Service or Teleport Enterprise
+   (Cloud) account:
+
+   ```code
+   $ sudo teleport configure \
+     --token="/tmp/token" \
+     --roles=node \
+     --proxy=example.teleport.sh:443 \
+     -o file
+   ```
+
+## Step 2/2. Apply labels
+
+Follow any or all of the sections below to add different types of labels to
+your resource.
+
+### Apply a static label
+
+You can configure static labels by editing the Teleport configuration file, then
+starting Teleport.
+
+To add a static label:
+
+1. Open the Teleport configuration file, `/etc/teleport.yaml`, in an editor on the computer
+where you installed the Teleport Agent.
+
+1. Locate the `labels` configuration under the `ssh_service` section.
+
+1. Add the static label key and value.
+   For example, add `environment` as the label key and `dev` as the value:
+
+   ```yaml
+   ssh_service:
+     enabled: true
+     labels:
+       environment: dev
+   ```
+
+   The preceding example illustrates a simple value setting. However, you can also use static labels
+   to define more complex string values that include white space or punctuation marks.
+   For example:
+
+   ```code
+   ssh_service:
+     enabled: true
+     labels:
+       location: San Francisco Bldg 301 4th floor
+   ```
+
+1. Save your changes and close the file.
+
+1. Start Teleport on the Linux host:
+
+   (!docs/pages/includes/start-teleport.mdx!)
+
+1. Verify that you have added the label by running the following command
+on your local computer.
+
+   ```code
+   $ tsh ls --query 'labels["environment"]=="dev"'
+   ```
+
+   You should see output similar to the following:
+
+   ```code
+   Node Name        Address    Labels
+   ---------------- ---------- ------------------------------------------
+   ip-192-168-13-57 ⟵ Tunnel   environment=dev,hostname=ip-192-168-13-57
+   ```
+
+   **Checking the status of your server**
+
+   If you don't see your server listed when you query for the label you added, you should verify that the
+   SSH Service is running on the server. Check the log for the server to verify that there are
+   messages similar to the following:
+
+   ```text
+   2023-08-07T22:22:21Z INFO [NODE:1]    Service is starting in tunnel mode. pid:149932.1 service/service.go:2630
+   2023-08-07T22:22:21Z INFO [UPLOAD:1]  starting upload completer service pid:149932.1 service/service.go:2723
+   2023-08-07T22:22:21Z INFO [PROC:1]    The new service has started successfully. Starting syncing rotation status...
+   ```
+
+   **Checking your user profile**
+
+   If the SSH Service is running on the server, verify that your current Teleport user has a login on the local host.
+   You can check the status of your user account by running the following command:
+
+   ```code
+   $ tsh status
+   ```
+
+   You should see output similar to the following with at least one login listed for your current user:
+
+   ```code
+   > Profile URL:        https://ajuba-aws.teledocs.click:443
+     Logged in as:       teleport-admin
+     Cluster:            teleport-aws.example.com
+     Roles:              access, editor
+     Logins:             root, ubuntu, ec2-user
+     Kubernetes:         enabled
+     Valid until:        2023-08-08 10:08:46 +0000 UTC [valid for 10h36m0s]
+     Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+   ```
+
+   If no valid logins have been assigned to the user, you should update your current user profile to include
+   at least one valid login.
+
+   You can add logins to a user by running a command similar to the following:
+
+   ```code
+   $ tctl users update myuser --set-logins=root
+   ```
+
+   This example adds the `root` login to the `myuser` Teleport user.
+   For more information about managing logins for Teleport users, see [Local Users](users.mdx).
+
+**Using hidden static labels**
+
+If you want to use labels for role-based access control but don't want to
+display the labels in command output or the Teleport Web UI, you can define them
+in a hidden namespace by prefixing the label key with `teleport.hidden/`.
+For example:
+
+
+```yaml
+ssh_service:
+  enabled: true
+  labels:
+    teleport.hidden/team-id: ai-lab-01
+```
+
+### Apply dynamic labels using commands
+
+As with static labels, you can apply dynamic labels by editing the
+Teleport configuration file, then restarting the Teleport service on your server.
+
+To add a command to generate a dynamic label:
+
+1. Stop the Teleport service running on your server.
+
+1. Open the Teleport configuration file—by default, `/etc/teleport.yaml`—in a text editor.
+
+1. Locate the `commands` configuration under the `ssh_service` section.
+
+1. Add a `command` array that runs the `uname` command with the `-p` argument to return the architecture of the
+host server every one hour.
+
+   For example, add the `name`, `command`, and `period` fields as follows:
+
+   ```yaml
+   ...
+   ssh_service:
+     enabled: true
+     labels:
+       teleport.internal/resource-id: 1f2cdcc5-cde3-41fa-b390-bc872087821a
+       environment: dev
+     commands:
+     - name: hostname
+       command: [hostname]
+       period: 1m0s
+     - name: arch
+       command: [uname, -p]
+       period: 1h0m0s
+   ```
+
+   In the `command` setting, the first element is a valid executable.
+   Each subsequent element is an argument.
+   The following syntax is valid:
+
+   ```yaml
+   command: ["/bin/uname", "-m"]
+   ```
+
+   The following syntax is not valid:
+
+   ```yaml
+   command: ["/bin/uname -m"]
+   ```
+
+   For more complex commands, you can use single (') and double (")
+   quotation marks interchangeably to create nested expressions.
+   For example:
+
+   ```yaml
+   command: ["/bin/sh", "-c", "uname -a | egrep -o '[0-9]+\\.[0-9]+\\.[0-9]+'"]
+   ```
+
+   In configuring commands, keep the following in mind:
+
+   - The executable must be discoverable in the `$PATH` or specified using an absolute path.
+   - You must set the executable permission bit on any file you use as a command.
+   - Shell scripts must have a [shebang line](https://en.wikipedia.org/wiki/Shebang_\(Unix\)).
+
+   The `period` setting specifies how frequently Teleport executes each command.
+   In this example, the `uname -p` command is executed every one hour (1h), zero minutes (0m),
+   and zero seconds (0s). This value can't be less than one minute.
+
+1. Save your changes and close the file.
+
+1. Start Teleport with the invitation token you saved in the `INVITE_TOKEN` environment variable:
+
+   ```code
+   $ sudo teleport start --token=${INVITE_TOKEN?}
+   ```
+
+1. Verify that you have added the label by running the following command on your local
+computer. Your Teleport user must be authorized to access the server.
+
+   ```code
+   $ tsh ls
+   ```
+
+   You should see output similar to the following with both the `arch` and `environment` labels displayed:
+
+   ```code
+   Node Name        Address        Labels
+   ---------------- -------------- ------------------------------------------------------
+   ip-192-168-13-57 ⟵ Tunnel       arch=x86_64,environment=dev,hostname=ip-192-168-13-57
+   ```
+
+### Apply resource-based labels
+
+Applying resource-based labels is only supported for SSH servers.
+
+You can apply resource-based labels to a Teleport SSH server by creating a
+corresponding `server_info` resource.
+
+To add resource-based labels first get the SSH server details.
+
+1. Retrieve the SSH server that you wish to apply labels to. Assign <Var
+   name="node_name" /> to the name of the SSH server:
+
+   ```code
+   $ tctl get node/<Var name="node_name" />
+   kind: node
+   metadata:
+     expires: "2024-01-12T00:41:17.355013266Z"
+     name: 116b08d2-7167-4eab-85a8-cf93f054b217
+   spec:
+     addr: 127.0.0.1:3022
+     hostname: foo
+   ```
+
+1. Create the corresponding `server_info.yaml` for the node above.
+
+   ```yaml
+   # server_info.yaml
+   kind: server_info
+   metadata:
+      name: si-116b08d2-7167-4eab-85a8-cf93f054b217
+   spec:
+      new_labels:
+         "foo": "bar"
+   ```
+
+   The `metadata.name` of the `server_info` resource must be equivalent to the `metadata.name` field
+   of the node resource prefixed with `si-`.
+
+   Run the following to create the `server_info` resource:
+
+   ```code
+   $ tctl create server_info.yaml
+   ```
+
+1. Verify that you have added the label by running the following command on your local
+computer. Your Teleport user must be authorized to access the server. Teleport
+applies labels from `server_info` resources gradually to prevent strain on the Auth Service in
+larger clusters, so it may take several minutes for the new labels to appear.
+
+   ```code
+   $ tsh ls
+   ```
+
+   You should see output similar to the following with the `dynamic/foo` label displayed:
+
+   ```code
+   Node Name        Address        Labels
+   ---------------- -------------- ------------------------------------------------------
+   ip-192-168-13-57 ⟵ Tunnel       dynamic/foo=bar,hostname=ip-192-168-13-57
+   ```
+
+<Admonition type="warning">
+   All resource-based labels created with `tctl` will have the
+   `dynamic/` prefix. This prefix forbids the label from being used in a
+   role's deny rules.
+</Admonition>
+
+To update resource-based labels, recreate the `server_info` resource with updated labels.
+
+## Next steps
+
+After you have labeled your resources, you can use the labels when running
+`tsh` and `tctl` commands to filter the resources that the commands return.
+For more information, see [Resource filtering](../../reference/access-controls/predicate-language.mdx).
+
+You can also use labels to limit the access that users in different roles have to
+
+specific classes of resources. For more information, see
+[Teleport Role Templates](role-templates.mdx).
diff --git a/docs/pages/zero-trust-access/rbac-get-started/rbac-get-started.mdx b/docs/pages/zero-trust-access/rbac-get-started/rbac-get-started.mdx
new file mode 100644
index 0000000000000..82fba66fa95d4
--- /dev/null
+++ b/docs/pages/zero-trust-access/rbac-get-started/rbac-get-started.mdx
@@ -0,0 +1,49 @@
+---
+title: Get Started with Role-Based Access Control
+sidebar_label: Role-Based Access Control
+sidebar_position: 1
+description: Provides an introduction to the Teleport role-based access control system.
+tags:
+ - privileged-access
+ - conceptual
+ - zero-trust
+---
+
+Teleport's role-based access control (RBAC) enables you to set fine-grained
+policies for who can perform certain actions against specific resources. For
+example, you can allow analytics team members to SSH into a MongoDB read
+replica, but not the main database.
+
+Teleport **roles** are [dynamic
+resources](../infrastructure-as-code/infrastructure-as-code.mdx) that allow or
+deny access to infrastructure resources, as well as to Teleport API operations
+like creating users or reviewing Access Requests.
+
+## Role demo
+
+You can follow the [Teleport Role Demo](role-demo.mdx) guide for a quick
+illustration of how Teleport roles work. 
+
+## Labels
+
+All infrastructure resources that are enrolled in your Teleport cluster have
+**labels**, which are key-value pairs such as `env: dev`. When a user attempts to
+connect to a resource, the Teleport Agent that proxies the resource checks the
+user's Teleport roles to ensure that the user has the appropriate permissions
+and, if not, denies the connection.
+
+Read more about labels in [Add Labels to Resources](labels.mdx).
+
+## Role templates
+
+Teleport roles include a templating syntax that allows you to specify a user's
+permissions based on data about the user, e.g., data from your organization's
+identity provider or stored on the Teleport Auth Service backend.
+
+Read more about [Teleport Role Templates](role-templates.mdx).
+
+## Role reference
+
+After getting familiar with the concepts we introduce in this section, you can
+read the [Access Controls Reference](../../reference/access-controls/roles.mdx)
+for descriptions of all fields you can configure in a Teleport role.
diff --git a/docs/pages/zero-trust-access/rbac-get-started/role-demo.mdx b/docs/pages/zero-trust-access/rbac-get-started/role-demo.mdx
new file mode 100644
index 0000000000000..004d59485a95d
--- /dev/null
+++ b/docs/pages/zero-trust-access/rbac-get-started/role-demo.mdx
@@ -0,0 +1,325 @@
+---
+title: Getting Started With Teleport Access Controls
+sidebar_label: Get Started
+description: Teleport Role-Based Access Control.
+tags:
+ - privileged-access
+ - how-to
+ - zero-trust
+---
+
+Teleport Role-Based Access Control (RBAC) is a system for managing who can
+access what within your infrastructure. Instead of assigning permissions
+directly to users, you create roles that define sets of permissions, then assign
+those roles to users.
+
+This guide helps you understand RBAC in Teleport by walking you through the
+process of applying labels to resources, setting up minimal roles, and accessing
+resources available to a particular role.
+
+## How it works
+
+This guide illustrates how to register a server with Teleport using a Docker
+container and the Teleport SSH Service in order to apply RBAC rules for
+accessing the server. While the example uses a Teleport-protected server,
+applying RBAC rules for accessing infrastructure resources works in similar ways
+for any Teleport-protected resource.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+- A Teleport user with permissions to create join tokens and other roles. We
+  recommend using a demo cluster with the preset `editor` role. 
+- Docker installed on your workstation. Docker is only required for the local
+  demo environment used in this guide. You can find installation instructions
+  for Docker on [Docker's website](https://docs.docker.com/get-docker/). If you
+  want to register servers in Teleport without using Docker, see the getting
+  started guide for [server
+  access](../../enroll-resources/server-access/getting-started.mdx).
+
+## Step 1/3. Enroll resources with labels
+
+In this section, you will enroll two servers with your Teleport cluster. One
+server will have the `env:local-dev` label and the other will have the
+`env:local-prod`.  Later in this guide, you will create a role that will allow a
+user to access a server with the `env:local-dev` label and deny access to the
+`env:local-prod` label.
+
+{/*Note that these instructions only apply to Teleport versions 17.3 and
+above*/}
+
+Before following these instructions, assign <Var
+name="teleport.example.com:443"/> to your Teleport cluster hostname and port,
+but not the scheme (https://).
+
+### Enroll a server with the `env:local-dev` label
+
+1. Create a join token for the server to use to join the cluster:
+
+   ```code
+   $ tctl tokens add --type=node --format=text
+   ```
+
+1. Assign the token to <Var name="token" /> and the host and web port of your
+   Teleport Proxy Service to <Var name="example.teleport.sh:443" />.
+
+1. Copy the following Teleport configuration to a file called `local-dev.yaml`:
+
+   ```yaml
+   version: v3
+   teleport:
+     data_dir: /var/lib/teleport
+     join_params:
+       token_name: <Var name="token" />
+       method: token
+     proxy_server: <Var name="example.teleport.sh:443" />
+   auth_service:
+     enabled: "false"
+   ssh_service:
+     enabled: "true"
+     labels:
+       env: local-dev
+   proxy_service:
+     enabled: "false"
+   ```
+
+   This Teleport configuration enables the Teleport SSH Service, which enrolls a
+   server in your Teleport cluster. The `ssh_service.labels` field adds a label
+   to the server called `env:local`.
+
+1. Assign the absolute path to the configuration file you created to 
+   <Var name="dev-config-path"/>.
+
+1. Start a Docker container on your workstation to prepare a server that you
+   want enroll as a resource in your Teleport cluster:
+   
+   ```code
+   $ docker run -v <Var name="dev-config-path"/>:/etc/teleport.yaml --interactive --tty ubuntu:24.04 /bin/bash
+   ```
+
+1. In your container shell, install curl and sudo:
+
+   ```code
+   $ apt-get update && apt-get install -y curl sudo
+   ```
+
+1. In your container shell, install Teleport on your container:
+
+   ```code
+   $ curl "https://<Var name="teleport.example.com:443"/>/scripts/install.sh" | bash
+   ```
+
+1. In your container shell, start the Teleport SSH Service:
+
+   ```code
+   $ teleport start
+   ```
+
+   Keep the terminal attached to the container shell open.
+
+1. Wait for a minute or so. Verify that you have logged in via `tsh login` and
+   check that the server has joined your cluster by listing enrolled servers by
+   label. You should see the server you just enrolled:
+
+   ```code
+   $ tsh ls env=local-dev
+   Node Name    Address    Labels
+   ------------ ---------- -------------
+   80f60427d316 ⟵ Tunnel   env=local-dev   
+   ```
+
+### Enroll a server with the `env:local-prod` label
+
+1. Open a separate terminal.
+
+1. Create a join token for the server to use to join the cluster:
+
+   ```code
+   $ tctl tokens add --type=node --format=text
+   ```
+
+1. Assign the token to <Var name="token" />.
+
+1. Copy the following YAML document to a file called `local-prod.yaml`. This
+   configuration starts the Teleport SSH Service with the label
+   `env:local-prod`:
+
+   ```yaml
+   version: v3
+   teleport:
+     data_dir: /var/lib/teleport
+     join_params:
+       token_name: <Var name="token" />
+       method: token
+     proxy_server: <Var name="example.teleport.sh:443" />
+   auth_service:
+     enabled: "false"
+   ssh_service:
+     enabled: "true"
+     labels:
+       env: local-prod
+   proxy_service:
+     enabled: "false"
+   ```
+
+1. Assign the absolute path to the configuration file you created to 
+   <Var name="prod-config-path" />.
+
+1. Start a Docker container on your workstation to prepare a server that you
+   want enroll as a resource in your Teleport cluster:
+   
+   ```code
+   $ docker run -v <Var name="prod-config-path"/>:/etc/teleport.yaml --interactive --tty ubuntu:24.04 /bin/bash
+   ```
+
+1. In your container shell, install curl and sudo:
+
+   ```code
+   $ apt-get update && apt-get install -y curl sudo
+   ```
+
+1. In your container shell, install Teleport on your container:
+
+   ```code
+   $ curl "https://<Var name="teleport.example.com:443"/>/scripts/install.sh" | bash
+   ```
+
+1. In your container shell, start the Teleport SSH Service:
+
+   ```code
+   $ teleport start
+   ```
+
+   Keep the terminal attached to the container shell open.
+
+1. Ensure that the server has joined the cluster:
+
+   ```code
+   $ tsh ls env=local-prod
+   Node Name    Address    Labels
+   ------------ ---------- --------------
+   ba2290caf694 ⟵ Tunnel   env=local-prod
+   ```
+
+## Step 2/3. Create a Teleport role
+
+Create a role that can access servers with the `env:local-dev` label but not the
+`env:local-prod` label.
+
+1. Create a file called `role.yaml` with the following content:
+
+   ```yaml
+   kind: role
+   version: v7
+   metadata:
+     name: local-dev-only
+   spec:
+     allow:
+       logins: [root]
+       node_labels:
+         env: local-*
+     deny:
+       node_labels:
+         env: local-prod
+   ```
+
+   The `allow` block indicates what the user is allowed to access. By default,
+   nothing is allowed, so each role must include at least one `allow` field to
+   provide permissions.  
+
+   The `spec.allow.logins` field allows the user to assume the `root` login when
+   connecting to a server. You can change this to a less permissive login, but
+   we are using `root` because it is the only available login on the Docker
+   containers we spun up.
+
+   `spec.allow.node_labels` uses wildcard syntax, which matches one or more
+   characters, to allow users to connect to any server with a label that begins
+   `env:local-`, such as the `env:local-dev` and `env:local-prod` labels we
+   assigned to our servers.
+
+   However, since the `deny.node_labels` field specifies `env:local-prod`, a
+   user with this role would only be able to access the server with the
+   `env:local-dev` label.
+
+1. Create the role:
+
+   ```code
+   $ tctl create role.yaml
+   ```
+
+## Step 3/3. Access your server
+
+In this step, you will create a local Teleport user with the `local-dev-access`
+role, then list available servers and connect the one with the label
+`env:local-dev`.
+
+1. Create a local user named `alice` with the `local-dev-access` role:
+
+   ```code
+   $ tctl users add alice --roles=local-dev-access
+   ```
+
+1. Follow the instructions in your terminal to sign in as `alice`.
+
+1. In your terminal, log out of your cluster and log in again, assigning <Var
+   name="example.teleport.sh" /> to the domain name of your Teleport Proxy
+   Service:
+
+   ```code
+   $ tsh logout
+   $ tsh login --user=alice --proxy=<Var name="example.teleport.sh" />
+   ```
+
+1. List all servers available for your user to access. You should only see one:
+
+   ```code
+   $ tsh ls
+   Node Name    Address    Labels
+   ------------ ---------- -------------
+   ba2290caf694 ⟵ Tunnel   env=local-dev
+   ```
+
+   Since `alice` is denied access to servers with the `env:local-prod` label,
+   only the server with the `env:local-dev` label is available to connect to.
+
+1. Access the server using the value of the `Node Name` field as shown in `tsh
+   ls`. Assign <Var name="ba2290caf694" /> to the name of your server:
+
+   ```code
+   $ tsh ssh root@<Var name="ba2290caf694" />
+   ```
+
+## Next steps
+
+In this guide, you created a Teleport role that allowed and denied access to SSH
+servers based on the labels that the servers were enrolled with. Read about more
+things you can do with Teleport roles.
+
+### Learn more Teleport RBAC fundamentals
+
+Read more about using Teleport roles to govern RBAC:
+
+- [Add Labels to Resources](./labels.mdx)
+- [Role Templates](./role-templates.mdx)
+
+### Configure RBAC for specific kinds of resources
+
+You can label all Teleport-protected resources and use those labels to set RBAC
+policies. In addition, each kind of Teleport resource also has more specific
+attributes that you can use to control access. Read the guides below to refine
+your RBAC for each kind of resource:
+
+- [Servers](../../enroll-resources/server-access/rbac.mdx)
+- [Databases](../../enroll-resources/database-access/rbac.mdx)
+- [Kubernetes clusters](../../enroll-resources/kubernetes-access/controls.mdx)
+- [Remote desktops](../../enroll-resources/desktop-access/rbac.mdx)
+- [Web applications](../../enroll-resources/application-access/configuration/controls.mdx)
+
+### Reference guide
+
+For a full description of the fields you can configure in a Teleport role, see
+the [Teleport Access Controls
+Reference](../../reference/access-controls/roles.mdx).
+
diff --git a/docs/pages/admin-guides/access-controls/guides/role-templates.mdx b/docs/pages/zero-trust-access/rbac-get-started/role-templates.mdx
similarity index 91%
rename from docs/pages/admin-guides/access-controls/guides/role-templates.mdx
rename to docs/pages/zero-trust-access/rbac-get-started/role-templates.mdx
index 20c2ee4576436..7dcb788110247 100644
--- a/docs/pages/admin-guides/access-controls/guides/role-templates.mdx
+++ b/docs/pages/zero-trust-access/rbac-get-started/role-templates.mdx
@@ -1,6 +1,12 @@
 ---
 title: Teleport Role Templates
+sidebar_label: Role Templates
 description: This guide explains templating in Teleport roles. Templates allow you to enable access to resources depending on the traits of a local or single sign-on user.
+tags:
+ - sso
+ - conceptual
+ - zero-trust
+ - privileged-access
 ---
 
 As organizations grow, infrastructure teams have to figure out how to define
@@ -403,6 +409,8 @@ spec:
         verbs: ['*']
 ```
 
+### Available interpolation functions
+
 Available interpolation functions include:
 
 Function | Description
@@ -410,6 +418,38 @@ Function | Description
 `email.local(variable)` | Extracts the local part of an email address. `email.local(alice@example.com)` evaluates to `alice`.
 `regexp.replace(variable, expression, replacement)` | Finds all matches of `expression` and replaces them with `replacement`. This supports expansion, e.g. `regexp.replace(external.email, "^(.*)@example.com$", "$1")`. Values which do not match the expression will be filtered out. `$N` is used to refer to the Nth captured group, starting at `$1`.
 
+### Working with an external email identity
+
+Along with sending groups, an SSO provider will also provide a user's email address.
+In many organizations, the username that a person uses to log in to a system is the
+same as the first part of their email address, the "local" part.
+
+For example, `dave.smith@example.com` might log in with the username `dave.smith`.
+Teleport provides an easy way to extract the first part of an email address so
+it can be used as a username. This is the `{{email.local}}` function.
+
+If the email claim from the identity provider (which can be accessed via
+`{{external.email}}`) is sent and contains an email address, you can extract the
+"local" part of the email address before the @ sign like this:
+`{{email.local(external.email)}}`
+
+Here's how this looks in a Teleport role:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: sso_user
+spec:
+  allow:
+    logins:
+    # Extracts the local part of dave.smith@acme.com, so the login will
+    # now support dave.smith.
+    - '{{email.local(external.email)}}'
+    node_labels:
+      '*': '*'
+```
+
 ## Templating in Access Requests
 
 Access and Reviewer Request specifications do not use the same interpolation
diff --git a/docs/pages/zero-trust-access/rbac-get-started/users.mdx b/docs/pages/zero-trust-access/rbac-get-started/users.mdx
new file mode 100644
index 0000000000000..ede4399ab7f7f
--- /dev/null
+++ b/docs/pages/zero-trust-access/rbac-get-started/users.mdx
@@ -0,0 +1,143 @@
+---
+title: Local Users
+description: Learn how to manage local users in Teleport. Local users are stored on the Auth Service instead of a third-party identity provider.
+tags:
+ - conceptual
+ - zero-trust
+ - privileged-access
+---
+
+In Teleport, **local users** are users managed directly via Teleport, rather
+than a third-party identity provider. All local users are stored in Teleport's
+cluster state backend, which contains the user's name, their roles and traits,
+and a bcrypt password hash.
+
+This guide shows you how to:
+
+- [Add local users](./users.mdx#adding-local-users)
+- [Edit existing users](./users.mdx#editing-users)
+- [Delete users](./users.mdx#deleting-users)
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Adding local users
+
+A user identity in Teleport exists in the scope of a cluster.
+A Teleport administrator creates Teleport user accounts and maps them to the roles they can use.
+
+Let's look at this table:
+
+| Teleport User | SSH Logins | Description |
+| - | - | - |
+| `joe` | `joe`, `root` | Teleport user `joe` can log in as user `joe` or `root` on SSH servers. |
+| `bob` | `bob` | Teleport user `bob` can log in as user `bob` on SSH servers. |
+| `kim` | | Teleport user 'kim' has no designated SSH logins.  |
+
+SSH logins are some of the user traits available in Teleport roles. For all supported traits, see the reference for [`tctl users add`](../../reference/cli/tctl.mdx#tctl-users-add).
+
+Let's add a new user to Teleport using the `tctl` tool:
+
+<Tabs>
+<TabItem scope={["oss"]} label="Teleport Community Edition">
+```code
+$ tctl users add joe --logins=joe,root --roles=access,editor
+```
+</TabItem>
+<TabItem scope={["enterprise", "cloud"]} label="Commercial">
+```code
+$ tctl users add joe --logins=joe,root --roles=access,editor,reviewer
+```
+</TabItem>
+
+</Tabs>
+
+Teleport generates an auto-expiring token (with a TTL of one hour) and prints
+the token URL, which must be used before the TTL expires.
+
+```code
+User "joe" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://<proxy_host>:443/web/invite/<token>
+
+NOTE: Make sure <proxy_host>:443 points at a Teleport proxy which users can access.
+```
+
+The user completes registration by visiting this URL in their web browser,
+picking a password, and configuring multi-factor authentication. If the
+credentials are correct, the Teleport Auth Service generates and signs a new
+user certificate.
+
+The certificate will automatically expire after 12 hours by default, after which
+the user will need to log back in with their credentials. This TTL can be
+configured to a different value.
+
+Once authenticated, the account will become visible via `tctl`:
+
+```code
+$ tctl users ls
+
+# User           Roles
+# ----           --------------
+# admin          editor
+# kim            access
+# joe            access,editor
+```
+
+## Editing users
+
+Admins can edit user entries via `tctl`.
+
+For example, to see the full list of user records, an administrator can execute:
+
+```code
+$ tctl get users
+```
+
+To edit the user `joe`, run the following command:
+
+```code
+$ tctl edit user/joe
+```
+
+Make your changes, then save and close the file in your editor to apply them.
+
+## Deleting users
+
+Admins can delete a local user via `tctl`:
+
+```code
+$ tctl users rm joe
+```
+
+## Next steps
+
+<Tabs>
+<TabItem scope={["enterprise", "cloud"]} label="Teleport Enterprise/Enterprise Cloud">
+
+In addition to users, you can use `tctl` to manage roles and other dynamic
+resources. See our [Teleport Resources Reference](../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx).
+
+For all available `tctl` commands and flags, see our [CLI Reference](../../reference/cli/tctl.mdx).
+
+You can also configure Teleport so that users can log in using an SSO provider.
+For more information, see:
+
+- [Single Sign-On](../sso/sso.mdx)
+
+</TabItem>
+<TabItem label="Teleport Community Edition">
+
+In addition to users, you can use `tctl` to manage roles and other dynamic
+resources. See our [Teleport Resources Reference](../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx).
+
+For all available `tctl` commands and flags, see our
+[CLI Reference](../../reference/cli/tctl.mdx).
+
+You can also configure Teleport so that users can log in using GitHub. For more
+information, see [GitHub SSO](../sso/integrate-idp/github-sso.mdx).
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/adfs.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/adfs.mdx
new file mode 100644
index 0000000000000..9b1c88f627a46
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/adfs.mdx
@@ -0,0 +1,187 @@
+---
+title: SSO with Active Directory Federation Services
+sidebar_label: Active Directory Federation Services
+description: How to configure Teleport access with Active Directory Federation Services
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
+---
+
+This guide will explain how to configure Active Directory Federation Services
+([ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services)) to be
+a single sign-on (SSO) provider to issue login credentials to specific groups
+of users. When used in combination with role based access control (RBAC), it
+allows Teleport administrators to define policies like:
+
+- Only members of "DBA" group can SSH into machines running PostgreSQL.
+- Developers must never SSH into production servers.
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="ADFS"!)
+
+## Prerequisites
+
+- ADFS installation with Admin access and users assigned to at least two groups.
+- Teleport role with access to maintaining `saml` resources.  This is available in the default `editor` role.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Configure ADFS
+
+You'll need to configure ADFS to export claims about a user (Claims Provider
+Trust in ADFS terminology) and you'll need to configure ADFS to trust
+Teleport (a Relying Party Trust in ADFS terminology).
+
+For Claims Provider Trust configuration, open the **AD FS** management window.
+Under **Claims Provider Trusts**, right-click on **Active Directory** and
+select **Edit Claim Rules**. You'll need to specify at least the following two
+incoming claims: `Name ID` and `Group`.
+
+- `Name ID` should be a mapping of the LDAP Attribute `E-Mail-Addresses` to
+  `Name ID`.
+
+  ![Name ID Configuration](../../../../img/adfs-1.png)
+
+- A group membership claim should be used to map users to roles (for example to
+  separate normal users and admins).
+
+  ![Group Configuration](../../../../img/adfs-2.png)
+
+- If you are using dynamic roles (see below), it may be useful to map the LDAP
+  Attribute `SAM-Account-Name` to `Windows account name`:
+
+  ![WAN Configuration](../../../../img/adfs-3.png)
+
+- And create another mapping of `E-Mail-Addresses` to `UPN`:
+
+  ![UPN Configuration](../../../../img/adfs-4.png)
+
+You'll also need to create a Relying Party Trust. Use the below information to
+help guide you through the Wizard.
+
+- Create a Relaying Party Trust:
+  ![Add a Claims Provider Trust](../../../../img/adfs-add-provider-trust.png)
+- Enter data about the relying party manually.
+- Set the display name to something along the lines of `Teleport`.
+- Skip the token encryption certificate.
+- Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to
+  `https://<Var name="teleport.example.com" />/v1/webapi/saml/acs`, replacing the domain name
+  with your Teleport Proxy Service URL. If you have a self-hosted cluster with
+  multiple public addresses for the Teleport Proxy Service (the value of
+  `proxy_service.public_addr` in the Teleport configuration file), ensure that this
+  address points to the first one listed.
+- Set the relying party trust identifier to
+  `https://<Var name="teleport.example.com" />/v1/webapi/saml/acs` as well.
+- For access control policy select *"Permit everyone"*.
+
+Once the Relying Party Trust has been created, update the Claim Issuance Policy
+for it. Like before, make sure you send at least `Name ID` and `Group` claims to the
+relying party (Teleport). If you are using dynamic roles, it may be useful to
+map the LDAP Attribute `SAM-Account-Name` to *"Windows account name"* and create
+another mapping of `E-Mail-Addresses` to *"UPN"*.
+
+Lastly, ensure the user you create in Active Directory has an email address
+associated with it. To check this open Server Manager then
+*"Tools -> Active Directory Users and Computers"* and select the user and right
+click and open properties. Make sure the email address field is filled out.
+
+## Step 2/3. Connect ADFS to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange SAML messages with ADFS and
+issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="attribute"!)
+
+Make sure that, in your role mapping, each attribute begins with the following
+namespace prefix:
+
+```
+http://schemas.xmlsoap.org/claims/
+```
+
+### Configure a SAML connector
+
+Create a SAML connector resource using `tctl`:
+
+```code
+$ tctl sso configure saml --acs https://<Var name="teleport.example.com" />/v1/webapi/saml/acs \
+  --preset adfs \
+  --entity-descriptor https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml \
+  --attributes-to-roles <Var name="mapping_1" /> \
+  --attributes-to-roles <Var name="mapping_2" />  \
+  > adfs.yaml
+```
+
+The `--attributes-to-roles` flag contains the role mapping you assigned earlier.
+
+The `acs` field should match the value you set in ADFS earlier and you can
+obtain the `entity_descriptor_url` from ADFS under *"ADFS -> Service -> Endpoints -> Metadata"*.
+
+### Export the signing key
+
+For the last step, you'll need to export the signing key:
+
+```code
+$ tctl saml export adfs > saml.cer
+```
+
+Copy `saml.cer`, to ADFS server, open the "Relying Party Trust" and add this
+file as one of the signature verification certificates:
+
+![adfs-add-teleport-cert.png](../../../../img/adfs-add-teleport-cert.png)
+
+The Web UI will now contain a new button: "Login with MS Active Directory". The CLI is
+the same as before:
+
+```code
+$ tsh --proxy=proxy.example.com login
+```
+
+This command will print the SSO login URL and try to open it
+automatically in a browser.
+
+<Admonition
+  type="tip"
+  title="Tip"
+>
+  Teleport can use multiple SAML connectors. In this case a connector name
+  can be passed via `tsh login --auth=connector_name`
+</Admonition>
+
+### Test the connector
+
+Run the following command to test your connector:
+
+```code
+$ tctl sso test < adfs.yaml
+```
+
+### Create the connector
+
+Apply the connector:
+
+```code
+$ tctl create -f adfs.yaml
+```
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="saml"!)
+
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
+
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/entra-id-oidc.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/entra-id-oidc.mdx
new file mode 100644
index 0000000000000..9a2fb5ad6230a
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/entra-id-oidc.mdx
@@ -0,0 +1,382 @@
+---
+title: Teleport Authentication with Microsoft Entra ID (OIDC)
+sidebar_label: Microsoft Entra ID (OIDC)
+description: How to configure Teleport access with Microsoft Entra ID (formerly Azure AD) as an OIDC identity provider.
+tags:
+ - how-to
+ - zero-trust
+ - privileged-access
+ - azure
+enterprise: Enterprise SSO
+---
+
+This guide shows how to configure Microsoft Entra ID (formerly Azure AD) as an 
+OIDC identity provider for Teleport. With this configuration, users can access 
+Teleport by authenticating with Entra ID, and be granted with permissions to 
+access or manage resource in Teleport based on their group membership in Entra ID.
+
+A SAML-based Entra ID IdP configuration version is available in this [guide](entra-id.mdx).
+
+## How it works
+
+In the Microsoft Entra ID tenant, you will create an enterprise application and
+set it up as an OIDC identity provider for Teleport. You will also configure the
+`groups` claim, which will be included in the user's OIDC ID Token. 
+
+In Teleport, you will create an Auth Connector resource and set up Microsoft 
+Entra ID as an OIDC identity provider. You will also map Entra ID groups to 
+Teleport roles. 
+
+When a user signs in to Teleport by authenticating with their Microsoft Entra ID
+account, Teleport first creates a temporary user account with Teleport roles mapped
+from `groups` claim and traits. Traits are user attributes (key-value format). 
+Any claim that is present in the OIDC ID Token is preserved as user traits. 
+Teleport then starts a new session for the user by issuing a pair of short-lived 
+TLS and SSH certificates. These certificates encodes user's identity, 
+roles and traits, which are evaluated to grant access in Teleport. 
+
+To demonstrate Microsoft Entra ID group to Teleport role mapping, 
+we will have two user groups created in the Microsoft Entra ID tenant: 
+1. `ad-app-support`. We will map this group to Teleport preset `requester` role. 
+    The preset `requester` role grants permission to request access to resources 
+    that are enrolled in Teleport. 
+2. `ad-app-admin`. We will map this group to Teleport preset `reviewer` and `editor` 
+roles. The preset `editor` role grants permission to manage resource in Teleport. 
+The preset `reviewer` grants permission to review access to resources in Teleport.
+
+Instead of creating new groups, you may use an existing Microsoft Entra ID groups 
+to follow this guide. 
+
+## Prerequisites
+
+- Permissions to create an enterprise application, configure and grant Microsoft 
+  Graph API permissions and manage groups in the Microsoft Entra ID tenant.
+- Teleport user with a preset `editor` role or an equivalent role that allows 
+  you to read and write Auth Connectors, users and roles.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Configure Microsoft Entra ID
+
+### Create groups
+
+<Admonition type="info" title="New Group">
+  You may skip this step if you are using existing Microsoft Entra ID 
+  groups to follow this guide.
+</Admonition>
+
+In the Azure portal, select the "Groups" menu which is available under the
+"Azure services" menu. 
+
+From the "Groups" UI, click the "New group" button to create a new user group 
+named `ad-app-admin`.
+
+![Entra ID create group](../../../../img/sso/entraid/oidc/entra-id-create-group.png) 
+
+You may add desired users to this group. 
+Repeat this step to create another group named `ad-app-support`.
+
+### Create an enterprise application
+
+In the Azure Portal, from the “Azure services” menu, select “Enterprise applications”.
+Click on the `+ New Application` button, then click `+ Create your own application` 
+button. Enter a name for your application and create the application.
+
+![Entra ID create application](../../../../img/sso/entraid/oidc/entra-id-create-application.png) 
+
+### Assign groups
+
+In the Azure Portal, in the enterprise application UI, select the "Users and groups" 
+menu, which can be located under the "Manage" menu.
+
+In the "Users and groups" UI, click `+Add user/group` button. 
+
+Now assign the two groups you created in Step 1. If you are following this guide 
+with an existing user groups, select those groups in this step.
+
+![Entra ID assign](../../../../img/sso/entraid/oidc/entra-id-assign-group.png) 
+
+### Configure OIDC
+
+Configuring OIDC involves setting up a redirect URI for the relying party (Teleport 
+in this case), setting up the OIDC claims and a client credential. 
+
+These OIDC configurations are available in the "App registrations" service.
+
+In the Azure Portal, from the “Azure services” menu, select "App registrations".
+In the "App registrations" UI, search and select the enterprise application you 
+created while following this guide.
+
+In the "App registrations" UI for the enterprise application, from the “Manage” 
+menu, select the “Authentication” menu. In this configuration UI, under the 
+"Platform configurations" section, click `+ Add a platform` button. 
+
+OIDC redirect URI for Teleport should point to the OIDC callback endpoint, which 
+has the following URI format: `https://example.teleport.sh/v1/webapi/oidc/callback`.
+
+Enter the Teleport Proxy Service hostname of your Teleport cluster below to 
+generate the OIDC callback URI. Then copy and paste the value in the Azure Portal
+to configure OIDC redirect URI. 
+```code
+https://<Var name="example.teleport.sh" />/v1/webapi/oidc/callback
+```
+
+![Entra ID OIDC redirect URI](../../../../img/sso/entraid/oidc/entra-id-oidc-redirect-uri.png)
+
+Save the configuration once the redirect URI is configured.
+
+### Set up client credentials 
+
+Teleport uses the OIDC authorization code flow to exchange an OIDC authorization 
+code for the user's ID Token. To exchange the ID Token, a client credential must 
+be set up for Teleport. 
+
+In the "App registrations" UI for the enterprise application, from the "Manage" 
+menu, select "Certificates & secrets". Now select the "Client secrets" tab and 
+click on the `+ New client secret` button. Create a new client secret. 
+
+![Entra ID OIDC client credential](../../../../img/sso/entraid/oidc/entra-id-oidc-client-credential.png)
+
+Once the secret is created, copy the value and save it in your working environment: 
+```code 
+$ echo 'secret value copied from entra id' > /tmp/client-secret
+``` 
+
+### Configure groups claims
+
+You need to configure `groups` claim to configure access in Teleport.
+
+In the "App registrations" UI for the enterprise application, from the "Manage" 
+menu, select "Token configuration".
+
+In the "Token configuration" UI, click `+ Add groups claim` button.
+
+Select group type you wish to include in user's OIDC `groups` claim. 
+
+The reference image below shows that a "Security groups" type is selected. 
+
+![Entra ID OIDC groups claim](../../../../img/sso/entraid/oidc/entra-id-oidc-group-claim.png)
+
+You may configure other claims as desired. All the claims issued by Microsoft 
+Entra ID are preserved as user's traits in the user resource.
+
+### (Optional) Groups overage claim
+
+If user's group membership exceeds the 200 group limit, Microsoft Entra ID issues a
+groups overage claim instead of the expected `groups` claim. The groups overage 
+claim contains an Azure AD Graph API link, which indicates that the user's group 
+membership is to be queried from the Microsoft Graph API. 
+
+If your user's group membership do not exceed the group limit, you can skip this
+step. Otherwise, you will need to grant Teleport with a Microsoft Graph API 
+permission so it can retrieve user's group membership using the Microsoft 
+Graph API. 
+
+To query user's group membership, Teleport requires `User.ReadBasic.All` permission.
+To grant this permission, in the "App registrations" UI for the enterprise 
+application, from the "Manage" menu, select "API permissions".
+
+Next, click `+ Add a permission` button and then select "Microsoft APIs > Microsoft Graph >
+Application permissions". In the permission filter search bar, type `User.ReadBasic.All`.
+
+Select the permission and add it to the application by clicking on the `Add permissions` button.
+
+![Entra ID OIDC graph permission](../../../../img/sso/entraid/oidc/entra-id-oidc-graph-permission.png)
+
+Once you add the permission, you will need to grant an admin consent.
+
+In the same "API permissions" UI, click the `Grant admin consent` button.
+
+A consent confirmation prompt will appear, click "Yes" to grant the consent. 
+
+The Graph API permission to fetch user's group membership is now configured.
+Should the user's group membership exceed 200 groups, Teleport will follow through 
+the groups overage claim issued by Entra ID and fetch user's groups detail using the 
+Microsoft Graph API. 
+
+## Step 2/3. Connect your OIDC provider to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange OIDC messages with Microsoft
+Entra ID and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="claim"!)
+
+Note that the Entra ID `groups` claim includes group's object ID. As such, you
+will need to map groups by using groups object ID. Assign 
+<Var name="mapping_1"/> to the object ID of `ad-app-admin` and 
+<Var name="mapping_2" /> to the object ID of `ad-app-support`.
+
+### Create an OIDC connector 
+
+Before creating the Auth Connector resource, its useful to first generate the 
+configuration spec and test the configuration.
+
+The Auth Connector spec can be configured by using the `tctl sso configure`
+command. We will show you how to run the command with the following flags:
+
+- `--name`: Teleport resource name for the Microsoft Entra ID Auth Connector. 
+- `--display`: Display name for the Microsoft Entra ID Auth Connector
+- `--issuer-url`: Microsoft Entra ID OIDC issuer URL. You need your Microsoft Entra 
+  ID tenant ID to configure this URL. Assign it to <Var name="Entra ID tenant ID" />.
+- `--id`: The application (client) ID of the enterprise application you created in 
+  Step 2. This value can be copied from the "Overview" section of the enterprise 
+  application in the Azure Portal. Assign it to <Var name="Enterprise application client ID" />.
+- `--secret`: The client secret we created earlier.
+
+```code
+$ tctl sso configure oidc --name "entra-id" \
+  --display "Entra ID" \
+  --issuer-url https://login.microsoftonline.com/<Var name="Entra ID tenant ID" />/v2.0 \
+  --id <Var name="Enterprise application client ID" /> \
+  --secret $(cat /tmp/client-secret) \
+  --claims-to-roles groups,<Var name="mapping_1" /> \
+  --claims-to-roles groups,<Var name="mapping_2" /> \
+  --scope openid \
+  --scope email \
+  --scope profile > entraid-oidc-connector.yaml
+```
+
+<details>
+<summary>Example YAML Auth Connector resource file created by the `tctl sso configure` command</summary>
+
+```yaml
+kind: oidc
+metadata:
+  name: entra-id
+spec:
+  claims_to_roles:
+  - claim: groups
+    roles:
+    - editor
+    - reviewer
+    value: da770259-8007-42da-a9c2-3b366a88bc1c
+  - claim: groups
+    roles:
+    - requester
+    value: ed5763df-9465-45e8-b10b-06a8979b072e
+  client_id: d40666f7-3352-43e8-a8ad-b75e7a0a7be3
+  client_secret: example-secret-value
+  display: Entra ID
+  issuer_url: https://login.microsoftonline.com/0297d2f3-62c3-4598-aaa1-2104929ba73c/v2.0
+  redirect_url: https://<Var name="example.teleport.sh" />:443/v1/webapi/oidc/callback
+  scope:
+  - openid
+  - email
+  - profile
+version: v3
+```
+
+</details>
+
+(!docs/pages/includes/sso/username-claim.mdx!)
+
+<details>
+<summary>Changing the callback address</summary>
+
+(!docs/pages/includes/sso/change-callback.mdx!)
+
+</details>
+
+### Test the connector
+
+Now test the connector resource by piping the file to `tctl sso test` command:
+
+```code
+$ cat entraid-oidc-connector.yaml | tctl sso test
+```
+If the configuration test fails, the `tctl sso test` command will print helpful 
+information to debug the issue.
+
+### Create the connector
+
+If the configuration is working for you, proceed creating the connector resource 
+by using the `tctl create` command:
+
+```code
+$ tctl create -f entraid-oidc-connector.yaml
+```
+
+The Auth Connector resource for Microsoft Entra ID is now configured.
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="oidc"!)
+
+## FAQ
+
+### I want to customize how Teleport follows the groups overage claim
+
+Groups overage claim setting can be customized by using the `entra_id_groups_provider`
+field in the Auth Connector spec.
+
+```yaml
+kind: oidc
+metadata:
+  name: entra-id
+spec:
+  ... # other fields not displayed for brevity
+  entra_id_groups_provider: 
+    disabled: false # set value to "true" to turn off the groups overage claim 
+    group_type: "security-groups" # can be "directory-roles", "all-groups"
+    graph_endpoint: "https://graph.microsoft.com" # update this value to point to another official Graph API endpoint
+```
+
+## Next steps
+
+Now that you know how to integrate Microsoft Entra ID with Teleport, you can
+refine your configuration to better suit your organization.
+
+### Edit your OIDC setup
+
+Learn more about other [OIDC](oidc.mdx)-related configurations that Teleport
+supports.
+
+### Integrate IdP traits in Teleport roles
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
+
+### Identity provider callback failed, missing parameter "Name"
+
+Teleport uses the `email` claim as user's username. 
+This error indicates that an `email` claim was not found in user's OIDC ID Token
+claims.
+
+This can happen if the user does not have a domain verified email account.
+
+Alternatively, you can update the connector spec to use a different claim value
+(must be a uniquely identifiable value) as an alternative of `email` claim.
+
+Example:
+```yaml
+kind: oidc
+metadata:
+  name: entra-id
+spec:
+  ... # other fields not displayed for brevity
+  username_claim: oid
+```
+
+### oid claim not found
+
+The user may receive this error if a groups overage claim was issued for the user but 
+Teleport could not find the `oid` claim.
+
+To resolve this, ensure that the `profile` scope is configured in the Auth Connector.
+```yaml
+kind: oidc
+metadata:
+  name: entra-id
+spec:
+  ... # other fields not displayed for brevity
+  scope:
+  - openid
+  - email
+  - profile
+```
+
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/entra-id.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/entra-id.mdx
new file mode 100644
index 0000000000000..5aff107f64c9b
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/entra-id.mdx
@@ -0,0 +1,446 @@
+---
+title: Teleport Authentication with Microsoft Entra ID (SAML)
+sidebar_label: Microsoft Entra ID (SAML)
+description: How to configure Teleport access with Microsoft Entra ID (formerly Azure AD) as a SAML identity provider.
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+ - azure
+enterprise: Enterprise SSO
+---
+
+This guide will cover how to configure Microsoft Entra ID (formerly Azure AD) as
+a SAML identity provider to issue credentials to specific groups of users with 
+a SAML Authentication Connector. When used in combination with role-based access 
+control (RBAC), it allows Teleport administrators to define policies like:
+
+- Only members of the "DBA" Microsoft Entra ID group can connect to PostgreSQL
+  databases.
+- Developers must never SSH into production servers.
+
+The following steps configure an example SAML authentication connector matching
+Microsoft Entra ID groups with security roles. You can choose to configure other
+options.
+
+An OIDC-based Entra ID IdP configuration version is available in this [guide](entra-id-oidc.mdx).
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="Microsoft Entra ID"!)
+
+## Prerequisites
+
+Before you get started, you’ll need:
+
+- A Microsoft Entra ID admin account with access to creating non-gallery
+  applications (P2 License).
+- To register one or more users in the directory.
+- To create at least two security groups in Microsoft Entra ID and assign one or
+  more users to each group.
+- A Teleport role with access to maintaining `saml` resources. This is available
+  in the default `editor` role.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Configure Microsoft Entra ID
+
+### Create an enterprise application
+
+1. Select **Entra ID -> Enterprise Applications**
+
+   ![Select Enterprise Applications From Manage](../../../../img/azuread/azuread-1-home.png)
+
+1. Select **New application**
+
+   ![Select New Applications From Manage](../../../../img/azuread/azuread-2-newapp.png)
+
+1. Select **Create your own application**, enter the application name (for example,
+   Teleport), and select **Integrate any other application you don't find in
+   the gallery (Non-gallery)**.
+
+   ![Select Non-gallery application](../../../../img/azuread/azuread-3-createnongalleryapp.png)
+
+1. Select **Properties** under **Manage** and set **Assignment required?** to **No**
+
+   ![Turn off user assignment](../../../../img/azuread/azuread-4-turnoffuserassign.png)
+
+   Click **Save** before proceeding to the next step.
+
+### Configure SAML
+
+1. Select **Single sign-on** under **Manage** and choose **SAML**
+
+   ![Select SAML](../../../../img/azuread/azuread-5-selectsaml.png)
+
+1. Edit the **Basic SAML Configuration**
+
+   ![Edit Basic SAML Configuration](../../../../img/azuread/azuread-6-editbasicsaml.png)
+
+1. Enter the URL for your Teleport Proxy Service host in the **Entity ID** and
+   **Reply URL**  fields, for example:
+
+   ```code
+   https://mytenant.teleport.sh:443/v1/webapi/saml/acs/ad
+   ```
+
+   If you have a self-hosted cluster with multiple public addresses for the
+   Teleport Proxy Service (the value of `proxy_service.public_addr` in the
+   Teleport configuration file), ensure that this address points to the first
+   one listed.
+
+   ![Put in Entity ID and Reply URL](../../../../img/azuread/azuread-7-entityandreplyurl.png)
+
+   Click **Save** before proceeding to the next step.
+
+1. In **SAML Certificates** section, copy the **App Federation
+   Metadata URL** link and save it for use in our Teleport connector configuration:
+
+   ![Download Federation Metadata XML](../../../../img/azuread/azuread-9-fedmeatadataxml.png)
+
+### Edit attributes & claims
+
+1. Click on **Unique User Identifier (Name ID)** under **Required claim**.
+
+1. Change the "name identifier format" to **Default**. Make sure the source
+  attribute is `user.userprincipalname`.
+
+   ![Confirm Name Identifier](../../../../img/azuread/azuread-8a-nameidentifier.png)
+
+1. Add a group claim to make user security groups available to the connector:
+
+   ![Put in Security group claim](../../../../img/azuread/azuread-8b-groupclaim.png)
+
+1. (optional) Add a claim that transforms the format of the Entra ID username to lower case, in order to use it inside
+   Teleport roles as the `{{external.username}}` property.
+
+   Set the Source to "Transformation". In the new panel:
+
+   - Set the Transformation value to "Extract()"
+
+   - Set the Attribute name to `user.userprincipalname`.
+
+   - Set the Value to `@`.
+
+   - Click "Add Transformation" and set the Transformation to `ToLowercase()`.
+
+     ![Add a transformed username](../../../../img/azuread/azuread-8c-usernameclaim.png)
+
+
+## Step 2/3. Connect Microsoft Entra ID to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange OIDC messages with Microsoft
+Entra ID and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="attribute"!)
+
+Make sure that, in your role mapping, each attribute begins with the following
+namespace prefix:
+
+```
+http://schemas.microsoft.com/ws/2008/06/identity/claims/
+```
+
+### Configure a SAML connector
+
+Now, create a SAML connector resource using `tctl`.
+
+```code
+$ tctl sso configure saml --preset ad \
+--entity-descriptor https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml\?appid\=b8d06e01... \
+--attributes-to-roles <Var name="mapping_1" /> \
+--attributes-to-roles <Var name="mapping_2" /> / > azure-connector.yaml
+```
+
+In the example above:
+
+- `--entity-descriptor` specifies the app federation metadata URL saved in the
+  previous step.
+- Each `--attributes-to-roles` specifies the name of the schema definition for groups,
+  groups, the UUID of an AD group, and the Teleport role that members of the group
+  will be assigned.
+
+The file `azure-connector.yaml` should now resemble the following:
+
+```yaml
+kind: saml
+metadata:
+  name: ad
+spec:
+  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
+  attributes_to_roles:
+  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+    roles:
+    - dev
+    value: 41c94563...
+  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+    roles:
+    - access
+    value: 8adac502...
+  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
+  cert: ""
+  display: Microsoft
+  entity_descriptor: ""
+  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
+  issuer: ""
+  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/ad
+  sso: ""
+version: v2
+
+```
+
+### Test the connector
+
+With the connector in place on the cluster, you can test it with `tctl`:
+
+```code
+$ cat azure-connector.yaml | tctl sso test
+```
+
+Your browser should open and log you in to the Teleport cluster using your
+Entra ID credentials. If there are any problems, the CLI output will help you
+debug the connector configuration.
+
+### Create the connector
+
+To create the connector using the `tctl` tool, run the following command:
+
+```code
+$ tctl create -f azure-connector.yaml
+```
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="saml"!)
+
+## Token encryption (Optional)
+
+Entra ID's SAML token encryption encrypts the SAML assertions sent to Teleport
+during SSO redirect.
+
+Token encryption is an Microsoft Entra ID premium feature and requires a
+separate license. Since traffic between Entra ID and the Teleport Proxy Service
+already uses HTTPS, token encryption is optional. To determine whether you
+should enable token encryption, read the Entra ID
+[documentation](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption).
+
+### Set up Teleport token encryption
+
+Start with generating a public/private key and a certificate. You will set up
+the public certificate with Entra ID and the private key with Teleport.
+
+```code
+$ openssl req -nodes -new -x509 -keyout server.key -out server.cer
+```
+
+If you are modifying the existing connector, open it in your editor:
+
+```code
+$ tctl edit saml
+```
+
+You will notice that Teleport has generated a `signing_key_pair`. This key pair
+is used to sign responses.
+
+```yaml
+kind: saml
+metadata:
+  name: ad
+spec:
+  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  attributes_to_roles:
+  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+    roles:
+    - editor
+    - access
+    - auditor
+    value: '*'
+  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  cert: ""
+  display: Microsoft
+  entity_descriptor:
+  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
+  issuer: https://sts.windows.net/your-id-here/
+  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  signing_key_pair:
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      ...
+      -----END CERTIFICATE-----
+    private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      ...
+      -----END RSA PRIVATE KEY-----
+  sso: https://login.microsoftonline.com/your-id-here/saml2
+version: v2
+```
+
+Add `assertion_key_pair` using the data from `server.key` and `server.cer`.
+
+```yaml
+kind: saml
+metadata:
+  name: azure-saml
+spec:
+  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  attributes_to_roles:
+  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+    roles:
+    - editor
+    - access
+    - auditor
+    value: '*'
+  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  cert: ""
+  display: Microsoft
+  entity_descriptor:
+  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
+  issuer: https://sts.windows.net/your-id-here/
+  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  signing_key_pair:
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      ...
+      -----END CERTIFICATE-----
+    private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      ...
+      -----END RSA PRIVATE KEY-----
+  sso: https://login.microsoftonline.com/your-id-here/saml2
+version: v2
+```
+
+<Admonition
+  type="warning"
+  title="Warning"
+>
+  Make sure to have the same indentation for all lines of the certificate and key, otherwise
+  Teleport will not parse the YAML file.
+</Admonition>
+
+After your edits, the file will look like this:
+
+```yaml
+kind: saml
+metadata:
+  name: azure-saml
+spec:
+  acs: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  attributes_to_roles:
+  - name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+    roles:
+    - editor
+    - access
+    - auditor
+    value: '*'
+  audience: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  cert: ""
+  display: Microsoft
+  entity_descriptor:
+  entity_descriptor_url: https://login.microsoftonline.com/ff882432.../federationmetadata/2007-06/federationmetadata.xml?appid=b8d06e01...
+  issuer: https://sts.windows.net/your-id-here/
+  service_provider_issuer: https://mytenant.teleport.sh/v1/webapi/saml/acs/azure-saml
+  assertion_key_pair:
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      New CERT
+      -----END CERTIFICATE-----
+    private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      New private key
+      -----END RSA PRIVATE KEY-----
+  signing_key_pair:
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      ...
+      -----END CERTIFICATE-----
+    private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      ...
+      -----END RSA PRIVATE KEY-----
+  sso: https://login.microsoftonline.com/your-id-here/saml2
+version: v2
+```
+
+Update the connector by saving and closing the file in your editor.
+
+### Activate token encryption
+
+- Navigate to **Token Encryption**:
+
+![Navigate to token encryption](../../../../img/azuread/azuread-token-encryption-0.png)
+
+- Import certificate
+
+![Import certificate](../../../../img/azuread/azuread-token-encryption-1-import.png)
+
+- Activate it
+
+![Activate certificate](../../../../img/azuread/azuread-token-encryption-2-activate.png)
+
+If the SSO login with this connector is successful, the encryption works.
+
+## Next steps
+
+Now that you know how to integrate Microsoft Entra ID with Teleport, you can
+refine your configuration to better suit your organization.
+
+### Integrate IdP traits in Teleport roles
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+### Refer to Microsoft Entra ID traits in Teleport roles
+
+Note that to reference a trait from Microsoft Entra ID with its full namespace
+prefix, you must use an `external` template variable with the following
+notation:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: dev
+spec:
+  options:
+    max_session_ttl: 24h
+  allow:
+    # only allow login as either ubuntu or the 'windowsaccountname' claim
+    logins: [ '{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}', ubuntu ]
+    node_labels:
+      access: relaxed
+```
+
+The login
+<nobr>`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`</nobr>
+configures Teleport to look at the
+`http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
+attribute and use that field as an allowed login for each user. Since the name
+of the attribute contains characters besides letters, numbers, and underscores,
+you must use double quotes (`"`) and square brackets (`[]`) around the name of
+the attribute.
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
+
+### Failed to process SAML callback
+
+If you encounter a "Failed to process SAML callback" error, take a look at the audit log.
+
+```text
+Special characters are not allowed in resource names. Use a name composed only from
+alphanumeric characters, hyphens, and dots: /web/users/ops_example.com#EXT#@opsexample.onmicrosoft.com/params
+```
+
+The error above is caused by a Name ID format that is not compatible with Teleport's naming conventions.
+
+Change the Name ID format to use email instead:
+
+![Change NameID format to use email](../../../../img/azuread/azuread-nameid.png)
+
diff --git a/docs/pages/admin-guides/access-controls/sso/github-sso.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/github-sso.mdx
similarity index 83%
rename from docs/pages/admin-guides/access-controls/sso/github-sso.mdx
rename to docs/pages/zero-trust-access/sso/integrate-idp/github-sso.mdx
index be94e2c7c87f3..2029fed184264 100644
--- a/docs/pages/admin-guides/access-controls/sso/github-sso.mdx
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/github-sso.mdx
@@ -1,7 +1,13 @@
 ---
 title: Set up Single Sign-On with GitHub
+sidebar_label: GitHub
 description: Setting up GitHub SSO
 videoBanner: XjgN2WWFCX8
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
 ---
 
 This guide explains how to set up GitHub Single Sign On (SSO) so you can
@@ -31,7 +37,7 @@ reading data from the OAuth 2.0 access token. In particular, the Auth Service:
 GitHub usernames are not formatted as email addresses. As a result, any Teleport
 plugin that expects to send email to a user based on their Teleport username
 will not work as expected. For example, the [PagerDuty Access Request
-plugin](../access-request-plugins/ssh-approval-pagerduty.mdx) has this
+plugin](../../../identity-governance/access-requests/plugins/pagerduty.mdx) has this
 limitation.
 
 </Admonition>
@@ -53,7 +59,7 @@ limitation.
 
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/4. Create a GitHub OAuth app
+## Step 1/3. Create a GitHub OAuth app
 
 Create and register a GitHub OAuth App. When you do so, ensure that your OAuth
 App's "Authentication callback URL" is the following:
@@ -63,7 +69,10 @@ https://PROXY_ADDRESS/v1/webapi/github/
 ```
 
 Replace `PROXY_ADDRESS` with be the public address of the Teleport Proxy Service
-or your Teleport Cloud workspace URL (e.g., `example.teleport.sh`).
+or your Teleport Cloud workspace URL (e.g., `example.teleport.sh`). If you have
+a self-hosted cluster with multiple public addresses for the Teleport Proxy
+Service (the value of `proxy_service.public_addr` in the Teleport configuration
+file), ensure that this address points to the first one listed.
 
 The app must have the `read:org` scope in order to be able to read org and team
 membership details.
@@ -75,7 +84,54 @@ Create a client secret to use along with the client ID in the next step:
 
 ![A GitHub Oauth App, highlighting Client ID and secret](../../../../img/sso/github-app-vars.png)
 
-## Step 2/4. Create a GitHub authentication connector
+## Step 2/3. Connect GitHub to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to connect to GitHub and issue
+certificates to users.
+
+### Assign a role mapping
+
+When a user authenticates to Teleport, the Teleport Auth Service issues SSH and
+TLS certificates to the user that contain the user's Teleport roles. 
+
+For SSO authentication connectors, the Auth Service determines which roles to
+encode in the certificate by reading the authentication connector's **role
+mapping**. The role mapping indicates which Teleport roles to assign based on
+data that your identity provider stores about the user.
+
+When you configure the GitHub authentication connector using the `tctl` CLI, a
+role mapping takes the following format:
+
+```text
+<github_org_name>,<github_team_name>,<teleport_role_1>,<teleport_role_2>,...,<teleport_role_n>
+```
+
+For example, the following role mapping means that any user with the team
+`admins` in the `gravitational` org receives the Teleport roles `editor` and
+`auditor`:
+
+```text
+gravitational,admins,editor,auditor
+```
+
+For the purpose of this guide, assign two separate role mappings:
+
+- A more permissive role mapping: <Var name="github_mapping_1" initial="org,admins,auditor,editor" />
+- A more restrictive role mapping: <Var name="github_mapping_2" initial="org,users,access" />
+
+GitHub organizations and teams should be referred to by their slug, not display
+name. To create the team slug, GitHub replaces special characters in the name
+string, changes all words to lowercase, and replaces spaces with a `-`
+separator. 
+
+For example, `My TEam Näme` would become `my-team-name`.  The organization slug
+is treated the same except the organization is not changed to lowercase. You can
+confirm the slug in GitHub Web application URLs or via the GitHub API. Example:
+navigate to the team `My Team` in the GitHub web application. The URL
+`https://github.com/orgs/org-name/teams/my-team` shows the slug is `my-team`.
+
+### Configure a GitHub authentication connector
 
 In this section, you will define a GitHub authentication connector using `tctl`.
 
@@ -96,19 +152,10 @@ for a full reference of flags for this command:
 $ tctl sso configure github \
 --id=<Var name="GITHUB-CLIENT-ID"/> \
 --secret=$(cat client-secret.txt) \
---teams-to-roles=<Var name="ORG-NAME,github-team,access,editor"/> \
+--teams-to-roles=<Var name="github_mapping_1" /> \
+--teams-to-roles=<Var name="github_mapping_2" /> \
 > github.yaml
 ```
-<Admonition type="tip">
-  GitHub organizations and teams should be referred to by their slug, not display name.
-  To create the team slug, GitHub replaces special characters in the name string, changes all words to lowercase,
-  and replaces spaces with a `-` separator. For example, `My TEam Näme` would become `my-team-name`.
-  The organization slug is treated the same except the organization is not changed to lowercase.
-  You can confirm the slug in GitHub Web application URLs or via the GitHub API.
-  Example: navigate to the team `My Team` in the GitHub web application.
-  The URL `https://github.com/orgs/org-name/teams/my-team`
-  shows the slug is `my-team`.
-</Admonition>
 
 The contents of `github.yaml` should resemble the following:
 
@@ -164,6 +211,7 @@ version: v3
 
 <details>
 <summary>Mapping multiple roles</summary>
+
 You can add multiple instances of the `--teams-to-roles` flag or edit the connector
 file to define multiple mappings. For example:
 
@@ -226,6 +274,8 @@ spec:
 
 </details>
 
+### Test the connector
+
 You can test the connector configuration before applying it to your cluster.
 This is strongly encouraged to avoid interruption to active clusters:
 
@@ -268,6 +318,8 @@ username: alice
 For more details repeat the command with --debug flag.
 ```
 
+### Create the connector
+
 Finally, create the connector using `tctl`:
 
 ```code
@@ -297,8 +349,6 @@ Here is an example role configuration snippet using the trait variable:
       '*': '*'
 ```
 
-## Step 3/4. Log in to Teleport using GitHub
-
 You can now log in with Teleport using GitHub SSO. Run the following to log out
 of Teleport and log in again using GitHub SSO.
 
@@ -398,7 +448,7 @@ You will receive the details of your user session within the CLI:
 
 </Tabs>
 
-## Step 4/4. Configure authentication preference
+## Step 3/3. Configure authentication preferences
 
 In the previous step we signed in to Teleport using GitHub credentials by
 specifying GitHub as our auth type. By editing the `cluster_auth_preference`
@@ -451,6 +501,10 @@ auth_service:
 After logging out of `tsh`, you can log back in without specifying
 `--auth=github`. You will automatically be redirected to the GitHub auth flow.
 
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
 ## Troubleshooting
 
 (!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
@@ -478,12 +532,3 @@ shows the slug is `my-team`. Update the teams to roles mapping.
       team: my-team
 ```
 
-## Next steps
-
-
-The role we illustrated in this guide uses the `internal.logins` trait,
-which Teleport replaces with values from the Teleport local user
-database. For full details on how traits work in Teleport roles,
-see the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
-
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/gitlab.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/gitlab.mdx
new file mode 100644
index 0000000000000..80895dbd487a9
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/gitlab.mdx
@@ -0,0 +1,212 @@
+---
+title: Authentication With GitLab as an SSO provider
+sidebar_label: GitLab
+description: How to configure Teleport access using GitLab for SSO
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
+---
+
+This guide will cover how to configure [GitLab](https://www.gitlab.com/) to issue
+credentials to specific groups of users. When used in combination with role
+based access control (RBAC), it allows administrators to define policies
+like:
+
+- Only members of the "DBA" group can access PostgreSQL databases.
+- Only members of "ProductionKubernetes" can access production Kubernetes clusters
+- Developers must never SSH into production servers.
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="GitLab"!)
+
+## Prerequisites
+
+- At least two groups in GitLab with users assigned. In our examples below,
+  we'll assume a group named `company` with two subgroups, `admin` and `dev`.
+- Teleport role with access to maintaining `oidc` resources.  This is available
+  in the default `editor` role.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Configure GitLab
+
+You should have at least one group configured in GitLab to map to Teleport roles.
+In this example we use the names `gitlab-dev` and `gitlab-admin`.  Assign users
+to each of these groups.
+
+1. Create an application in one of your groups (**Group overview** ->
+   **Settings** -> **Applications**) that will allow using GitLab as an OAuth
+   provider to Teleport. 
+
+   Assign <Var name="teleport.example.com" /> to your Teleport Proxy Service's
+   public address. If you have a self-hosted cluster with multiple public
+   addresses for the Teleport Proxy Service (the value of
+   `proxy_service.public_addr` in the Teleport configuration file), ensure that
+   this address points to the first one listed.
+
+   Settings:
+
+   - Redirect URL: `https://<Var name="teleport.example.com" />/v1/webapi/oidc/callback`.
+   - Check `Confidential`, `openid`, `profile`, and `email`.
+
+   ![Create App](../../../../img/sso/gitlab/gitlab-oidc-0.png)
+
+1. Collect the `Application ID` and `Secret` in the Application. These will be
+   used in the Teleport OIDC auth connector:
+
+   ![Collection Information](../../../../img/sso/gitlab/gitlab-oidc-1.png)
+
+1. Confirm the GitLab issuer address.
+
+   For GitLab.com, the issuer address is `https://gitlab.com`. This allows
+   Teleport to access the Open-ID configuration at
+   `https://gitlab.com/.well-known/openid-configuration`. If you are self
+   hosting the issuer address is the path to your GitLab instance.
+
+## Step 2/3. Connect GitLab to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange OIDC messages with GitLab and
+issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="claim"!)
+
+### Configure an OIDC connector
+
+Create an OIDC connector resource using `tctl`.
+
+On your workstation, create a file called `client-secret.txt` consisting only of
+your client secret.
+
+<Tabs>
+<TabItem label="GitLab.com">
+Replace the application ID and secret with the values from GitLab:
+
+```code
+$ tctl sso configure oidc --preset gitlab \
+--id <APPLICATION-ID> \
+--secret $( cat client-secret.txt) \
+--claims-to-roles <Var name="mapping_1" /> \
+--claims-to-roles <Var name="mapping_2" /> > oidc.yaml
+```
+
+</TabItem>
+<TabItem label="Self-hosted">
+Replace the application ID and secret with the values from GitLab, and replace
+`https://gitlab.company.com` with the path to your self-hosted GitLab instance:
+
+```code
+$ tctl sso configure oidc --preset gitlab \
+--id <APPLICATION-ID> \
+--issuer-url https://gitlab.company.com \
+--secret $( cat client-secret.txt) \
+--claims-to-roles <Var name="mapping_1" /> \
+--claims-to-roles <Var name="mapping_2" /> > oidc.yaml
+```
+
+</TabItem>
+</Tabs>
+
+This example maps the two subgroups `admin` and `dev` of the parent group
+`company` to the `admin` and `dev` roles in Teleport, and creates the `oidc.yaml` file:
+
+```yaml
+kind: oidc
+metadata:
+  name: gitlab
+spec:
+  claims_to_roles:
+  - claim: groups
+    roles:
+    - admin
+    value: company/admin
+  - claim: groups
+    roles:
+    - dev
+    value: company/gitlab-dev
+  client_id: <APPLICATION-ID>
+  client_secret: <APPLICATION-SECRET>
+  display: GitLab
+  issuer_url: https://gitlab.com
+  prompt: none
+  redirect_url: https://<Var name="teleport.example.com" />:443/v1/webapi/oidc/callback
+version: v3
+
+```
+
+(!docs/pages/includes/sso/username-claim.mdx!)
+
+<details>
+<summary>Changing the callback address</summary>
+
+(!docs/pages/includes/sso/change-callback.mdx!)
+
+</details>
+
+### Test the connector
+
+Test the connector resource by piping the file to `tctl sso test`:
+
+```code
+$ cat oidc.yaml | tctl sso test
+```
+
+After authorizing the application in GitLab you should get a
+**Login Successful** message in your web browser. Otherwise, consult the output
+of the command to diagnose.
+
+### Create the connector
+
+Create the connector using `tctl` tool:
+
+```code
+$ tctl create -f oidc.yaml
+```
+
+The Web UI will now contain a new button: "Login with GitLab". The CLI is
+the same as before:
+
+```code
+$ tsh --proxy=<Var name="teleport.example.com" /> login
+```
+
+This command will print the SSO login URL (and will try to open it
+automatically in a browser).
+
+<Admonition
+  type="tip"
+  title="Tip"
+>
+  Teleport can use multiple OIDC/SAML connectors. In this case a connector name
+  can be passed via `tsh login --auth=connector_name`
+</Admonition>
+
+<Admonition
+  type="note"
+  title="IMPORTANT"
+>
+  Teleport only supports sending party initiated flows for OIDC Connect. This
+  means you can not initiate login from your identity provider, you have to
+  initiate login from either the Teleport Web UI or CLI.
+</Admonition>
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="oidc"!)
+
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
+
diff --git a/docs/pages/admin-guides/access-controls/sso/google-workspace.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/google-workspace.mdx
similarity index 92%
rename from docs/pages/admin-guides/access-controls/sso/google-workspace.mdx
rename to docs/pages/zero-trust-access/sso/integrate-idp/google-workspace.mdx
index 4b849b7d63960..1231f0639c5c4 100644
--- a/docs/pages/admin-guides/access-controls/sso/google-workspace.mdx
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/google-workspace.mdx
@@ -1,7 +1,15 @@
 ---
 title: Teleport Authentication with Google Workspace (G Suite)
+sidebar_label: Google Workspace (G Suite)
 description: How to configure Teleport access with Google Workspace (formerly known as G Suite)
 videoBanner: WTLWc6nnPfk
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+ - google-cloud
+enterprise: Enterprise SSO
 ---
 
 This guide explains how to configure [Google Workspace](https://workspace.google.com/)
@@ -12,6 +20,10 @@ access control (RBAC), you can define policies like the following:
 - Only members of the "DBA" Google group can connect to PostgreSQL databases.
 - Developers must never use SSH to access production servers.
 
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="Google Workspace"!)
+
 ## Prerequisites
 
 Before you get started, verify the following:
@@ -31,11 +43,11 @@ Before you get started, verify the following:
 
 - You have a Teleport cluster, Enterprise edition, and command-line tools.
    
-  (!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+  (!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/4. Configure Google Workspace
+## Step 1/3. Configure Google Workspace
 
 The following steps are required to configure Google Workspace to work with Teleport:
 
@@ -187,8 +199,11 @@ To create an OAuth client identifier:
 
 1. Under Authorized redirect URIs, click **Add URI**.
 
-1. Set the redirect URI to the address of your Teleport cluster, then add 
-`/v1/webapi/oidc/callback` to the URI.
+1. Set the redirect URI to the address of your Teleport cluster, then add
+   `/v1/webapi/oidc/callback` to the URI. If you have a self-hosted cluster with
+   multiple public addresses for the Teleport Proxy Service (the value of
+   `proxy_service.public_addr` in the Teleport configuration file), ensure that
+   this address points to the first one listed:
    
    ![OAuth client ID creation](../../../../img/sso/googleoidc/redirect-uri.png)
 
@@ -280,7 +295,17 @@ To configure delegation:
 
 1. Click **Authorize**.
 
-## Step 2/4. Create an OIDC connector
+## Step 2/3. Connect Google Workspace to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange OIDC messages with Google
+Workspace and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="claim"!)
+
+### Configure an OIDC connector
 
 After you have prepared Google Workspace, you can create the OIDC connector by 
 running the `tctl sso configure oidc` command. Depending on how you have deployed
@@ -310,8 +335,8 @@ With this method, you don't have to provide the JSON file to all of the hosts ru
 ```code
 $ tctl sso configure oidc --preset google --id <CLIENT-ID> \
 --secret $( cat client-secret.txt) \
---claims-to-roles groups,auditor@example.com,auditor \
---claims-to-roles groups,teleport-developers@example.com,access \
+--claims-to-roles <Var name="mapping_1" /> \
+--claims-to-roles <Var name="mapping_2" /> \
 --google-admin=<GOOGLE-WORKSPACE-ADMIN-EMAIL> \
 --google-acc '
 {
@@ -384,8 +409,8 @@ make the JSON file available to all hosts running the Teleport Auth Service.
 $ tctl sso configure oidc --preset google --id <CLIENT-ID> \
 --secret $( cat client-secret.txt) \
 --google-acc-uri <PATH/TO/SERVICE-ACCOUNT-KEY>.json \
---claims-to-roles groups,auditor@example.com,auditor \
---claims-to-roles groups,teleport-developers@example.com,access \
+--claims-to-roles <Var name="mapping_1" /> \
+--claims-to-roles <Var name="mapping_2" /> \
 --google-admin=<GOOGLE-WORKSPACE-ADMIN-EMAIL> > gworkspace-connector.yaml
 ```
 
@@ -439,6 +464,17 @@ credentials for scopes [...]" in audit log messages, change the `client_id` sett
 resource configuration file. For more information about viewing audit logs, see 
 [Troubleshooting](#troubleshooting).
 
+(!docs/pages/includes/sso/username-claim.mdx!)
+
+<details>
+<summary>Changing the callback address</summary>
+
+(!docs/pages/includes/sso/change-callback.mdx!)
+
+</details>
+
+### Test the connector
+
 To test the connector, run the following command:
 
 ```code
@@ -449,14 +485,14 @@ This command opens the browser and attempts to sign you in to your Teleport clus
 using Google. If it fails, review the command output for troubleshooting
 information.
 
+### Create the connector 
+
 To create the connector using the `tctl` tool, run the following command:
 
 ```code
 $ tctl create -f gworkspace-connector.yaml
 ```
 
-## Step 3/4. Test your Google Workspace OIDC connector
-
 After you create the connector, the Teleport Web UI displays a new sign-in option, **Login with Google**. 
 To sign in from the command-line:
 
@@ -467,9 +503,13 @@ $ tsh --proxy=proxy.example.com login --auth=google
 This command displays the single sign-on endpoint URL and tries to open it
 automatically in a browser.
 
-## Step 4/4. Enable default OIDC authentication
+## Step 3/3. Enable default OIDC authentication
+
+(!docs/pages/includes/sso/cap.mdx type="oidc"!)
+
+## Next steps
 
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
+(!docs/pages/includes/sso/next-step-traits.mdx!)
 
 ## Troubleshooting
 
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/integrate-idp.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/integrate-idp.mdx
new file mode 100644
index 0000000000000..89f37d4c2bafb
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/integrate-idp.mdx
@@ -0,0 +1,78 @@
+---
+title: Integrate your Identity Provider with Teleport
+sidebar_label: Integrate your Provider
+description: Provides step-by-step guides for allowing users to authenticate to Teleport using your IdP.
+---
+
+You can configure Teleport so that users authenticate with an external identity
+provider such as Okta or GitHub. To do so, you can create a Teleport resource
+called an **authentication connector** that contains information about your IdP
+and configures the Teleport roles that users assume once they authenticate.
+
+The guides in this section show you how to integrate your IdP with Teleport. 
+
+For an overview of how Teleport integrates with single sign-on providers, see
+[Single Sign-On](../sso.mdx).
+
+<Admonition type="warning">
+
+Teleport Community Edition only supports GitHub as an identity provider. In
+Teleport Enterprise, you can integrate SAML and OIDC solutions as well. All
+editions support [local
+users](../../../zero-trust-access/rbac-get-started/users.mdx).
+
+</Admonition>
+
+## Integrating your provider
+
+Integrating a provider with Teleport includes the following steps:
+
+1. **Configure your IdP** to register Teleport as an application, resulting in a
+   client ID, client secret, and other data about your application.
+1. **Determine a role mapping:** When a user authenticates to Teleport, Teleport
+   issues certificates containing the user's roles. A role mapping configures
+   how Teleport selects roles for the user based on the user's GitHub teams,
+   SAML attributes, or OIDC claims.
+1. **Apply an authentication connector:** The authentication connector includes
+   information about the role mapping and Teleport application, giving Teleport
+   the information it needs to exchange SAML, OIDC, and GitHub SSO messages with
+   your IdP and issue certificates to users. 
+1. **Apply a cluster authentication preference:** The cluster auth preference
+   resource selects an SSO provider as the default authentication method for
+   Teleport users.
+
+Teleport supports the following identity providers:
+
+<DocCardList kind="labelOnly" />
+
+## Provider-specific workarounds
+
+Certain SSO providers may require or benefit from changes to Teleport's SSO
+flow. These provider-specific changes can be enabled by setting the
+`spec.provider` property of the connector definition to one of the following
+values to match your identity provider:
+
+- `adfs` (SAML): Required for compatibility with Active Directory (ADFS); refer
+  to the full [ADFS guide](adfs.mdx) for details.
+- `jumpcloud` (SAML): Required for compatibility with JumpCloud.
+- `netiq` (OIDC): Used to enable NetIQ-specific ACR value processing; refer to
+  the [OIDC guide](oidc.mdx) for details.
+- `ping` (SAML and OIDC): Required for compatibility with Ping Identity (including
+  PingOne and PingFederate).
+- `okta` (OIDC): Required when using Okta as an OIDC provider.
+
+At this time, the `spec.provider` field should not be set for any other identity providers.
+
+## Customizing authentication buttons 
+
+Use the `display` field in an authentication connector to control the appearance
+of SSO buttons in the Teleport Web UI.
+
+| Provider | YAML | Example |
+| - | - | - |
+| GitHub | `display: GitHub` | ![github](../../../../img/teleport-sso/github@2x.png) |
+| Microsoft | `display: Microsoft` | ![microsoft](../../../../img/teleport-sso/microsoft@2x.png) |
+| Google | `display: Google` | ![google](../../../../img/teleport-sso/google@2x.png) |
+| BitBucket | `display: Bitbucket` | ![bitbucket](../../../../img/teleport-sso/bitbucket@2x.png) |
+| OpenID | `display: Okta` | ![Okta](../../../../img/teleport-sso/openId@2x.png) |
+
diff --git a/docs/pages/admin-guides/access-controls/sso/keycloak.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/keycloak.mdx
similarity index 86%
rename from docs/pages/admin-guides/access-controls/sso/keycloak.mdx
rename to docs/pages/zero-trust-access/sso/integrate-idp/keycloak.mdx
index b72c4c4ce7241..3f2d041286058 100644
--- a/docs/pages/admin-guides/access-controls/sso/keycloak.mdx
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/keycloak.mdx
@@ -1,6 +1,13 @@
 ---
 title: Teleport Authentication with Keycloak
+sidebar_label: Keycloak
 description: How to configure Teleport access with Keycloak
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
 ---
 
 This guide explains how to configure Keycloak to issue
@@ -14,6 +21,10 @@ administrators to define policies like:
 The following steps configure an example SAML authentication connector matching
 Keycloak groups. You can choose to configure other options.
 
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="Keycloak"!)
+
 ## Prerequisites
 
 Before you get started, you’ll need:
@@ -28,13 +39,14 @@ Before you get started, you’ll need:
 - A Teleport role with access to maintaining `saml` resources. This is available
   in the default `editor` role.
 
-(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/3. Configure Keycloak
 
-### Create a SAML Client
+### Create a SAML client
+
 1. Select the Realm to be used for your SAML integration. Click **Clients** in the menu.
 
 1. Click **Create client** 
@@ -44,11 +56,15 @@ Before you get started, you’ll need:
 1. Set Client type to **SAML** and Set a Client ID to the URL for your Teleport Proxy Service URL
 
    ```code
-   https://<Var name="mytenant.teleport.sh" />
+   https://<Var name="mytenant.teleport.sh" />/v1/webapi/saml/acs/keycloak
    ```
    ![SAML](../../../../img/sso/keycloak/saml.png)
 
-1. Set the **Valid Redirect URIs** field  to the URL for your Teleport Proxy Service host and Save
+1. Set the **Valid Redirect URIs** field  to the URL for your Teleport Proxy
+   Service host. If you have a self-hosted cluster with multiple public
+   addresses for the Teleport Proxy Service (the value of
+   `proxy_service.public_addr` in the Teleport configuration file), ensure that
+   this address points to the first one listed:
 
    ```code
    https://<Var name="mytenant.teleport.sh" />/v1/webapi/saml/acs/keycloak
@@ -89,14 +105,28 @@ Before you get started, you’ll need:
 
    This enables using the username inside Teleport roles as the <nobr>`{{external.username}}`</nobr> property.
 
-## Step 2/3. Create a SAML connector
+## Step 2/3. Connect Keycloak to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange SAML messages with KeyCloak
+and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="attribute"!)
+
+If you define a role mapping using a Keycloak group, you must include an
+explicit leading `/` in the group name.
+
+### Configure a SAML connector
 
 Now, create a SAML connector resource using `tctl`.
 
 ```code
 $ tctl sso configure saml --name keycloak \
 --entity-descriptor https://<root>/realms/{realm-name}/protocol/saml/descriptor \
---attributes-to-roles groups,/devops,dev \
+--attributes-to-roles <Var name="mapping_1" /> \
+--attributes-to-roles <Var name="mapping_2" /> \
 --audience https://mytenant.teleport.sh/v1/webapi/saml/acs/keycloak \
 --acs https://mytenant.teleport.sh/v1/webapi/saml/acs/keycloak > keycloak-connector.yaml
 ```
@@ -104,11 +134,6 @@ $ tctl sso configure saml --name keycloak \
 In the example above:
 
 - `--entity-descriptor` specifies the app federation metadata URL
-- Each `--attributes-to-roles` specifies the name of the schema definition for groups,
-  groups, the name of a Keycloak group and the Teleport role that members of the group
-  will be assigned.
-- Keycloak includes an explicit leading `/` in the group name, 
-  which is reflected in the group name specified in the above example.
 - `--acs` specifies where the SAML provider makes callbacks after successful authentication.
 - `--audience`  uniquely identifies your service provider (Teleport).
 
@@ -143,6 +168,7 @@ This will be enabled at a later step as you proceed through the guide.
 
 ![Edit client scope](../../../../img/sso/keycloak/disable_signature.png)
 
+### Test the connector
 
 With the connector in place on the cluster, you can test it with `tctl`: 
 
@@ -160,45 +186,9 @@ To create the connector using the `tctl` tool, run the following command:
 $ tctl create -f keycloak-connector.yaml
 ```
 
-## Step 3/3. Create a new Teleport role
-
-Create a Teleport role resource that will use external username data from the
-Keycloak connector to determine which Linux logins to allow on a host.
-
-Create a file called `dev.yaml` with the following content:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: dev
-spec:
-  options:
-    max_session_ttl: 24h
-  allow:
-    # only allow login as either ubuntu or the 'windowsaccountname' claim
-    logins: [ '{{external.username}}', ubuntu ]
-    node_labels:
-      access: relaxed
-```
-
-Users with the `dev` role are only allowed to log in to nodes with the `access:
-relaxed` Teleport label. They can log in as either `ubuntu` or a username that
-is passed in from the keycloak connector using the `username`
-attribute.
-
-The login
-<nobr>`{{external.username}}`</nobr>
-configures Teleport to look at the `username`
-attribute and use that field as an allowed login for each user.
+## Step 3/3. Configure authentication preferences
 
-Create the role:
-
-```code
-$ tctl create dev.yaml
-```
-
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+(!docs/pages/includes/sso/cap.mdx type="saml"!)
 
 ## Client Certificate Signature validation (Recommended)
 
@@ -346,6 +336,10 @@ Update the connector by saving and closing the file in your editor.
 
 If the SSO login with this connector is successful, the client signature validation works.
 
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
 ## Troubleshooting
 
 (!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/oidc.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/oidc.mdx
new file mode 100644
index 0000000000000..7a715d1e177db
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/oidc.mdx
@@ -0,0 +1,370 @@
+---
+title: OAuth2 and OIDC Authentication
+sidebar_label: OAuth2 and OIDC
+description: How to configure Teleport access with OAuth2 or OpenID connect (OIDC)
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
+---
+
+This guide will explain how to configure an SSO provider using [OpenID
+Connect](http://openid.net/connect/) (also known as OIDC) to issue Teleport
+credentials to specific groups of users. When used in combination with role-based 
+access control (RBAC), OIDC allows Teleport administrators to define
+policies like:
+
+- Only members of the "DBA" group can connect to PostgreSQL databases.
+- Developers must never SSH into production servers.
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx!)
+
+## Prerequisites
+
+- Admin access to the SSO/IdP being integrated with users assigned to groups/roles.
+- Teleport role with permission to maintain `oidc` resources. This permission is available
+  in the default `editor` role.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Configure your OIDC provider
+
+Register Teleport with the external identity provider you will be using and
+obtain your `client_id` and `client_secret`. This information should be
+documented on the identity providers website. Here are a few links:
+
+- [Auth0 Client Configuration](https://auth0.com/docs/applications)
+- [Google Identity Platform](https://developers.google.com/identity/protocols/OpenIDConnect)
+- [Keycloak Client Registration](https://www.keycloak.org/docs/latest/securing_apps/index.html#\_client_registration)
+
+<Admonition type="tip" title="Google Workspace">
+For Google Workspace, see [Teleport Authentication with Google Workspace](google-workspace.mdx)
+</Admonition>
+
+Save the relevant information from your identity provider. To make following
+this guide easier, you can add the Client ID here and it will be included in the
+example commands below:
+
+Client ID: <Var name="CLIENT-ID" description="The Client ID for your Teleport
+application, provided by your IdP"/>
+
+### Select an OIDC redirect URL
+
+OIDC relies on HTTP redirects to return control back to Teleport after
+authentication is complete. The redirect URL must be selected by a Teleport
+administrator in advance.
+
+The redirect URL for OIDC authentication in Teleport is <nobr> <Var
+name="mytenant.teleport.sh:443" description="Your Teleport Cloud tenant or Proxy
+Service address"/>`/v1/webapi/oidc/callback`</nobr>.  Replace <Var
+name="mytenant.teleport.sh:443" /> with your Teleport Cloud tenant or Proxy
+Service address. If you have a self-hosted cluster with multiple public
+addresses for the Teleport Proxy Service (the value of
+`proxy_service.public_addr` in the Teleport configuration file), ensure that
+this address points to the first one listed.
+
+## Step 2/3. Connect your OIDC provider to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange OIDC messages with your IdP
+and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="claim"!)
+
+### Configure an OIDC connector
+
+The next step is to add an OIDC connector to Teleport. The connectors are
+created, tested, and added or removed using `tctl` [resource
+commands](../../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx) or the Teleport Web UI.
+
+On your workstation, create a file called `client-secret.txt` consisting only of
+your client secret.
+
+To create a new connector, use `tctl sso configure`. The following example creates a
+connector resource file in YAML format named `oidc-connector.yaml`:
+
+```code
+$ tctl sso configure oidc --name <CONNECTOR-NAME> \
+  --issuer-url <PATH-TO-PROVIDER> \
+  --id <Var name="CLIENT-ID" /> \
+  --secret $(cat client-secret.txt) \
+  --claims-to-roles <Var name="mapping_1" /> \
+  --claims-to-roles <Var name="mapping_2" /> > oidc-connector.yaml
+```
+
+- `--name`: Usually the name of the IdP, this is how the connector will be
+  identified in Teleport.
+- `--issuer-url`: This is the base path to the IdP's OIDC configuration endpoint,
+  excluding `.well-known/openid-configuration`. If, for example, the endpoint
+  is `https://example.com/.well-known/openid-configuration`, you would use
+  `https://example.com`.
+- `--id`: The client ID as defined in the IdP. Depending on your identity
+  provider this may be something you can define (for example, `teleport`), or may be an
+  assigned string.
+- `--secret`: The client token/secret provided by the IdP to authorize this client.
+
+For more information on these and all available flags, see the [tctl sso configure
+oidc](../../../reference/cli/tctl.mdx) section of the Teleport CLI
+Reference page.
+
+The file created should look like the example below:
+
+```yaml
+(!examples/resources/oidc-connector.yaml!)
+```
+
+<details>
+<summary>Practical Example: Keycloak</summary>
+The following example was generated using Keycloak as the identity provider.
+Keycloak is being served at `keycloak.example.com`, and the Teleport Proxy
+Service is listening at `teleport.example.com`. In Keycloak, the client is
+named `teleport`. Under the `teleport-dedicated` client scope, we've added
+the "Group Membership" mapper:
+
+```yaml
+kind: oidc
+metadata:
+  name: keycloak
+spec:
+  claims_to_roles:
+  - claim: groups
+    roles:
+    - access
+    value: /users
+  - claim: groups
+    roles:
+    - editor
+    value: /admins
+  client_id: teleport
+  client_secret: abc123...
+  issuer_url: https://keycloak.example.com/realms/master
+  redirect_url: https://teleport.example.com:443/v1/webapi/oidc/callback
+version: v3
+
+```
+
+</details>
+
+<details>
+<summary>Changing the callback address</summary>
+
+(!docs/pages/includes/sso/change-callback.mdx!)
+
+</details>
+
+### Optional: ACR Values
+
+Teleport supports sending Authentication Context Class Reference (ACR) values
+when obtaining an authorization code from an OIDC provider. By default ACR
+values are not set. However, if the `acr_values` field is set, Teleport expects
+to receive the same value in the `acr` claim, otherwise it will consider the
+callback invalid.
+
+In addition, Teleport supports OIDC provider specific ACR value processing
+which can be enabled by setting the `provider` field in OIDC configuration. At
+the moment, the only build-in support is for NetIQ.
+
+A example of using ACR values and provider specific processing is below:
+
+```yaml
+# example connector which uses ACR values
+kind: oidc
+version: v2
+metadata:
+  name: "oidc-connector"
+spec:
+  issuer_url: "https://oidc.example.com"
+  client_id: "xxxxxxxxxxxxxxxxxxxxxxx.example.com"
+  client_secret: "zzzzzzzzzzzzzzzzzzzzzzzz"
+  redirect_url: "https://mytenant.teleport.sh/v1/webapi/oidc/callback"
+  display: "Login with Example"
+  acr_values: "foo/bar"
+  provider: netiq
+  scope: [ "group" ]
+  claims_to_roles:
+     - claim: "group"
+       value: "editor"
+       roles: [ "editor" ]
+     - claim: "group"
+       value: "user"
+       roles: [ "access" ]
+```
+
+### Optional: Max age
+
+The `max_age` field controls the maximum age of users' sessions before they will
+be forced to reauthenticate. By default `max_age` is unset, meaning once a user
+authenticates using OIDC they will not have to reauthenticate unless the
+configured OIDC provider forces them to. This can be set to a duration of time
+to force users to reauthenticate more often. If `max_age` is set to zero
+seconds, users will be forced to reauthenticate with their OIDC provider every
+time they authenticate with Teleport.
+
+Note that the specified duration must be in whole seconds. `24h` works because that's
+the same as `1440s`, but `60s500ms` would not be allowed as that is 60.5 seconds.
+
+```yaml
+# Extra parts of OIDC yaml have been removed.
+spec:
+  max_age: 24h
+```
+
+Note that not all OIDC providers support setting `max_age`. Google and GitLab are
+both known not to support it and authentication with those providers will not work
+when the `max_age` field is set.
+
+### Optional: Prompt
+
+Set the Authorization Server prompt for the End-User for reauthentication and consent
+per the OIDC protocol. If no `prompt` value is set, Teleport uses `select_account` as
+default.
+
+```yaml
+# Extra parts of OIDC yaml have been removed.
+spec:
+  # Valid values as defined from https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+  # none: The Authorization Server must not display any authentication or consent user interface pages.
+  # select_account: The Authorization Server should prompt the End-User to select a user account.
+  # login: The Authorization Server should prompt the End-User for reauthentication.
+  # consent: The Authorization Server should prompt the End-User for consent before returning information to the Client.
+  prompt: 'login'
+```
+
+### Optional: Redirect URL and Timeout
+
+The redirect URL must be accessible by all user, optional redirect timeout.
+
+```yaml
+# Extra parts of OIDC yaml have been removed.
+spec:
+  redirect_url: https://<cluster-url>.example.com:3080/v1/webapi/oidc/callback
+  # Optional Redirect Timeout.
+  # redirect_timeout: 90s
+```
+
+### Optional: Disable email verification
+
+By default, Teleport validates the `email_verified` claim, and users who
+attempt to sign in without a verified email address are prevented from doing so:
+
+```text
+ERROR: SSO flow failed.
+identity provider callback failed with error: OIDC provider did not verify email.
+        email not verified by OIDC provider
+```
+
+For testing and other purposes, you can opt out of this behavior by enabling
+`allow_unverified_email` in your OIDC connector. This option weakens the overall
+security of the system, so we do not recommend enabling it.
+
+```yaml
+kind: oidc
+version: v2
+metadata:
+  name: connector
+spec:
+  allow_unverified_email: true
+```
+
+### Optional: Specify a claim to use as the username
+
+(!docs/pages/includes/sso/username-claim.mdx!)
+
+### Optional: Request object mode
+
+Teleport supports the ability to send authorization request parameters in a
+JSON Web Token (JWT), referred to as "request objects", following RFC 9101.
+Presently, Teleport only supports signed request objects sent by value. This
+option necessitates that the IdP be provided with, or configured to discover,
+Teleport's JSON Web Key Sets (JWKS) used for OIDC IdP integration in order to
+verify request object signatures. This JWKS can be found at the `/.well-known/jwks-oidc`
+path of the Web API.
+
+Additionally, the public key to be used for verifying request object signatures can
+be found via `tctl`.
+
+```code
+$ tctl get cert_authority/oidc_idp/$CLUSTER_NAME --format=json | jq -r .[].spec.active_keys.jwt[].public_key
+```
+
+By default, `request_object_mode` is unset, meaning authorization request parameters
+will be sent in the query string of the authorization endpoint.
+
+```yaml
+kind: oidc
+version: v2
+metadata:
+  name: connector
+spec:
+  # Use signed request objects when making authorization requests to the IdP.
+  request_object_mode: signed
+```
+
+Request objects are also supported for MFA checks. If `request_object_mode` is not
+explicitly set on the MFA client, the login client's request object mode will be used
+by default. If desired, you can explicitly configure the MFA client to use a separate
+request object mode.
+
+```yaml
+kind: oidc
+version: v2
+metadata:
+  name: connector
+spec:
+  client_id: teleport_login
+  client_secret: abc123...
+  request_object_mode: none
+  mfa:
+    client_id: teleport_mfa
+    client_secret: mfa123...
+    request_object_mode: signed
+```
+
+Note: Support for request objects is available in Teleport Enterprise versions `17.7.2` or later and `18.1.6` or later.
+
+### Test the connector
+
+Before applying the connector to your cluster, you can test that it's configured
+correctly:
+
+```code
+$ cat oidc-connector.yaml | tctl sso test
+```
+
+This should open up your web browser and attempt to log you in to the Teleport
+cluster through your IdP. If it fails, review the output of this command for
+troubleshooting details.
+
+<Admonition type="tip">
+The "[OIDC] Claims" section of the CLI output provides all the details of your
+user provided by the IdP. This is a good starting point while troubleshooting
+errors like `Failed to calculate user attributes.`
+</Admonition>
+
+### Create the connector
+
+After your tests are successful, create the connector:
+
+```code
+$ tctl create -f oidc-connector.yaml
+```
+
+## Step 3/3. Enable default OIDC authentication
+
+(!docs/pages/includes/sso/cap.mdx type="oidc"!)
+
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/okta.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/okta.mdx
new file mode 100644
index 0000000000000..95cd02f32429a
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/okta.mdx
@@ -0,0 +1,316 @@
+---
+title: Authentication With Okta as an SSO Provider
+sidebar_label: Okta
+description: How to configure Teleport access using Okta for SSO
+videoBanner: SM4Am-i8cj4
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
+---
+
+This guide covers how to configure [Okta](https://www.okta.com/) to provide
+single sign on (SSO) identities to Teleport Enterprise and Teleport Enterprise
+Cloud. When used in combination with role-based access control (RBAC), this allows
+Teleport administrators to define policies like:
+
+- Only members of the "DBA" group can access PostgreSQL databases.
+- Developers must never SSH into production servers.
+- Members of the HR group can view audit logs but not production environments.
+
+<details>
+<summary>Automated SSO connection with Okta integration</summary>
+
+In Teleport Enterprise Cloud and Self-Hosted Teleport Enterprise, Teleport can
+automatically configure an SSO connector for you when as part of [enrolling the
+hosted Okta integration](../../../identity-governance/integrations/okta/okta.mdx).
+
+You can enroll the Okta integration from the Teleport Web UI.
+
+Visit the Teleport Web UI, click **Add New** in the left sidebar and click **Integration**:
+
+![Enroll an Access Request plugin](../../../../img/enterprise/plugins/enroll.png)
+
+On the "Select Integration Type" menu, click the Okta tile. Teleport will then
+guide you through configuring the Okta integration.
+
+</details>
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="Okta"!)
+
+## Prerequisites
+
+- An Okta account with admin access. Your account must include users and at
+  least two groups. If you don't already have Okta groups you want to assign to
+  Teleport roles don't worry, we'll create example groups below.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- A Teleport role with access to edit and maintain `saml` resources. This is
+  available in the default `editor` role.
+
+## Step 1/3. Configure Okta
+
+Okta indicates a user's group membership as a SAML assertion in the data it
+provides to Teleport. We will configure Teleport to assign the "dev" role to
+members of the `okta-dev` Okta group, and the preset "editor" role to members of
+the `okta-admin` group.
+
+If you already have Okta groups you want to assign to "dev" and "editor" roles in
+Teleport, you can skip to the [next step](#step-13-configure-okta).
+
+### Create Groups
+
+Create two groups: "okta-dev" and "okta-admin". In the Okta dashboard go to the
+navigation bar and click **Directory** -> **Groups**, then **Add group**:
+
+![Create Group Devs](../../../../img/sso/okta/okta-saml-2.1@2x.png)
+
+Repeat for the admin group:
+
+![Create Group Devs](../../../../img/sso/okta/okta-saml-2.2.png)
+
+In this section we will create an application in the Okta dashboard to allow our
+Teleport cluster to access Okta as an IdP provider. We'll also locate the
+address that Okta uses to provides their IdP metadata to Teleport.
+
+### Create Okta SAML 2.0 App
+
+From the main navigation menu, select **Applications** -> **Applications**, and click
+**Create App Integration**. Select SAML 2.0, then click **Next**.
+
+![Create APP](../../../../img/sso/okta/okta-saml-1.png)
+
+On the next screen (**General Settings**), provide a name and optional logo for
+your new app, then click **Next**. This will bring you to the **Configure SAML** section.
+
+### Configure the App
+
+Provide the following values to their respective fields:
+
+#### General
+
+Replace <Var name="example.teleport.sh:443" /> with your Teleport Proxy Service
+or Enterprise Cloud account domain and port (`443` by default). If you have a
+self-hosted cluster with multiple public addresses for the Teleport Proxy
+Service (the value of `proxy_service.public_addr` in the Teleport configuration
+file), ensure that this address points to the first one listed.
+
+- Single sign on URL:
+
+  ```
+  https://<Var name="example.teleport.sh:443" />/v1/webapi/saml/acs/okta
+  ```
+
+- Audience URI (SP Entity ID):
+
+  ```
+  https://<Var name="example.teleport.sh:443" />/v1/webapi/saml/acs/okta
+  ```
+
+- Name ID format `EmailAddress`
+
+- Application username `Okta username`
+
+#### Attribute Statements
+
+- Name: `username`  | Name format: `Unspecified` | Value: `user.login`
+
+#### Group Attribute Statements
+
+We will map our Okta groups to SAML attribute statements (special signed metadata
+exposed via a SAML XML response), so that Teleport can discover a user's group
+membership and assign matching roles.
+
+- Name: `groups` | Name format: `Unspecified`
+- Filter: `Matches regex` |  `.*`
+
+The configuration page should now look like this:
+
+![Configure APP](../../../../img/sso/okta/setup-redirection.png)
+
+The "Matches regex" filter requires the literal string `.*` in order to match all
+content from the group attribute statement.
+
+Notice that we have set "NameID" to the email format and mapped the groups with
+a wildcard regex in the Group Attribute statements. We have also set the "Audience"
+and SSO URLs to the same value. This is so Teleport can read and use Okta users'
+email addresses to create their usernames in Teleport, instead of relying on additional
+name fields.
+
+Once you've filled the required fields, click **Next**, then finish the app creation wizard.
+
+### Group assignment
+
+From the **Assignments** tab of the new application page, click **Assign**.  Assign the user groups
+which can access to the app. Users being members of those groups will have the SSO access to
+Teleport once the Auth Connector is configured.
+
+![Configure APP](../../../../img/sso/okta/okta-saml-3.1.png)
+
+### Save IdP metadata path
+
+Okta provides an IdP metadata block, used by clients to identify and verify it
+as a trusted source of user identity.
+
+Since Okta serves this content over HTTPS we can configure Teleport to use this
+path instead of a local copy, which can go stale.
+
+From the app's **Sign On** tab, scroll down to **SAML Signing Certificates**.
+Click **Actions** for the SHA-2 entry, then "View IdP metadata":
+
+![View Okta IdP Metadata](../../../../img/sso/okta/okta-copy-metadata.png)
+
+Copy the URL to the metadata file for use in our Teleport configuration.
+
+<Admonition type="tip">
+You can also right click on the "View IdP metadata" link and select
+"Copy Link" or "Copy Link Address".
+</Admonition>
+
+## Step 2/3. Connect Okta to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange SAML messages with Okta and
+issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="attribute"!)
+
+### Configure a SAML connector
+
+Define an Okta SAML connector using `tctl`. Update this example command with
+the path to your metadata file, and edit the `--attributes-to-roles` values for
+custom group assignment to roles. See [tctl sso configure
+saml](../../../reference/cli/tctl.mdx) for a full reference of
+flags for this command:
+
+```code
+$ tctl sso configure saml --preset=okta \
+--entity-descriptor "https://example.okta.com/app/000000/sso/saml/metadata" \
+--attributes-to-roles=<Var name="mapping_1" /> \
+--attributes-to-roles=<Var name="mapping_2" /> > okta-connector.yaml
+```
+
+The contents of `okta-connector.yaml` should resemble the following:
+
+```yaml
+kind: saml
+metadata:
+  name: okta
+spec:
+  acs: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  attributes_to_roles:
+  - name: groups
+    roles:
+    - editor
+    value: okta-admin
+  - name: groups
+    roles:
+    - dev
+    value: okta-dev
+  audience: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  cert: ""
+  display: "Okta"
+  entity_descriptor: ""
+  entity_descriptor_url: https://example.okta.com/app/000000/sso/saml/metadata
+  issuer: ""
+  service_provider_issuer: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  sso: ""
+version: v2
+```
+
+(!docs/pages/includes/sso/idp-initiated.mdx!)
+
+### Test the connector
+
+You can test the connector before applying it to your cluster. This is strongly
+encouraged to avoid interruption to active clusters:
+
+```code
+$ cat okta-connector.yaml | tctl sso test
+If browser window does not open automatically, open it by clicking on the link:
+ http://127.0.0.1:52519/0222b1ca...
+Success! Logged in as: alice@example.com
+--------------------------------------------------------------------------------
+Authentication details:
+   roles:
+   - editor
+   - dev
+   traits:
+     groups:
+     - Everyone
+     - okta-admin
+     - okta-dev
+     username:
+     - alice@example.com
+   username: alice@example.com
+--------------------------------------------------------------------------------
+[SAML] Attributes to roles:
+- name: groups
+  roles:
+  - editor
+  value: okta-admin
+- name: groups
+  roles:
+  - dev
+  value: okta-dev
+
+--------------------------------------------------------------------------------
+[SAML] Attributes statements:
+groups:
+- Everyone
+- okta-admin
+- okta-dev
+username:
+- alice@example.com
+
+--------------------------------------------------------------------------------
+For more details repeat the command with --debug flag.
+```
+
+Create the connector using `tctl`:
+
+```code
+$ tctl create okta-connector.yaml
+```
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="saml"!)
+
+## Testing
+
+The Web UI now contains a new "Okta" button at the login screen. To
+authenticate via the `tsh` CLI, specify the Proxy Service address and `tsh` will
+automatically use the default authentication type:
+
+```code
+$ tsh login --proxy=proxy.example.com
+```
+
+This command prints the SSO login URL (and will try to open it automatically
+in a browser).
+
+<Admonition  type="tip">
+Teleport can use multiple SAML connectors. In this case a connector name
+can be passed via the `--auth` flag. For the connector we created above:
+
+```code
+$ tsh login --proxy=proxy.example.com --auth=okta
+```
+
+</Admonition>
+
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/zero-trust-access/sso/integrate-idp/one-login.mdx b/docs/pages/zero-trust-access/sso/integrate-idp/one-login.mdx
new file mode 100644
index 0000000000000..de17fe0640f56
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/integrate-idp/one-login.mdx
@@ -0,0 +1,166 @@
+---
+title: Teleport Authentication with OneLogin as an SSO Provider
+sidebar_label: OneLogin
+description: How to configure Teleport access using OneLogin as an SSO provider
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+enterprise: Enterprise SSO
+---
+
+import SquareIcon from "@version/docs/img/sso/onelogin/teleport.png"
+import RectangleIcon from "@version/docs/img/sso/onelogin/teleportlogo@2x.png"
+
+This guide will explain how to configure [OneLogin](https://www.onelogin.com/)
+to issue Teleport credentials to specific groups of users. When used in
+combination with role based access control (RBAC) it allows SSH administrators
+to define policies like:
+
+- Only members of "DBA" group can connect to PostgreSQL databases.
+- Developers must never SSH into production servers.
+- ... and many others.
+
+## How it works
+
+(!docs/pages/includes/sso/how-it-works.mdx idp="OneLogin"!)
+
+## Prerequisites
+
+- A OneLogin account with admin access, and users assigned to at least two groups.
+- Teleport role with access to maintaining `saml` resources.  This is available
+  in the default `editor` role.
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Create Teleport application in OneLogin
+
+1. In the OneLogin control panel's main menu navigate to **Applications** ->
+   **Add App**. Using the search box, select "SAML Custom Connector (SP
+   Shibboleth)":
+
+   ![SAML Custom Connector (SP Shibboleth)](../../../../img/sso/onelogin/onelogin-saml-1.png)
+
+1. Define the new application:
+
+   ![SAML Config](../../../../img/sso/onelogin/onelogin-saml-1a.png)
+
+   You can find Teleport icons to upload from the following links:
+
+   - <a href={SquareIcon} download>Square Icon</a>
+   - <a href={RectangleIcon} download>Rectangular Icon</a>
+
+1. From the application's **Configuration** page, set the following values. Set
+   <Var name="teleport.example.com:443" description="Your Teleport Proxy Service
+   address and port, or cloud tenant." /> here with your Teleport Proxy Service
+   address and port, or Teleport Enterprise Cloud tenant (e.g.
+   `company.teleport.sh:443`) to fill out the values below.
+
+   If you have a self-hosted cluster with multiple public addresses for the
+   Teleport Proxy Service (the value of `proxy_service.public_addr` in the
+   Teleport configuration file), ensure that this address points to the first
+   one listed.
+   
+   - **Login URL**:
+     - `https://`<Var name="teleport.example.com:443"/>`/web/login`
+   - **ACS (Consumer) URL**, **SAML Recipient**, **ACS (Consumer) URL Validator**, & **Audience**:
+     - `https://`<Var name="teleport.example.com:443"/>`/v1/webapi/saml/acs/onelogin`
+
+   ![Configure SAML](../../../../img/sso/onelogin/onelogin-saml-2.png)
+
+1. Teleport needs to assign groups to users. From the **Parameters** page,
+   configure the application with some parameters exposed as SAML attribute
+   statements:
+
+   ![New Field](../../../../img/sso/onelogin/onelogin-saml-3.png)
+   
+   ![New Field Group](../../../../img/sso/onelogin/onelogin-saml-4.png)
+   
+   <Admonition
+     type="warning"
+     title="Important"
+   >
+     Make sure to check `Include in SAML assertion` checkbox.
+   </Admonition>
+
+1. Add users to the application:
+
+   ![Add User](../../../../img/sso/onelogin/onelogin-saml-5.png)
+
+1. Obtain SAML metadata for your authentication connector. Once the application
+   is set up, navigate to the the **More Actions** menu and find the **SAML
+   Metadata** option:
+
+   ![Download XML](../../../../img/sso/onelogin/saml-download.png)
+
+   You can either left-click the option and download the XML document as a local
+   file or right-click the option and copy the link address. The Teleport Auth
+   Service either reads the provided document or queries the address to obtain
+   SAML metadata. We recommend copying the address so the Auth Service can use
+   the most up-to-date information.
+
+## Step 2/3. Connect OneLogin to Teleport
+
+In this section, you will create an authentication connector that provides
+Teleport with the information it needs to exchange SAML messages with OneLogin
+and issue certificates to users.
+
+### Assign a role mapping
+
+(!docs/pages/includes/sso/role-mapping.mdx fieldType="attribute"!)
+
+### Configure a SAML connector
+
+Create a SAML connector using `tctl`. Update <Var name="xml-path"/> to the URL
+of the XML document that you copied in the previous step. If you downloaded the
+XML document instead, use the path to the XML metadata file:
+
+```code
+$ tctl sso configure saml --preset onelogin \
+--entity-descriptor <Var name="xml-path"/> \
+--attributes-to-roles <Var name="mapping_1" /> \
+--attributes-to-roles <Var name="mapping_2" /> > onelogin.yaml
+```
+
+This will create `onelogin.yaml`, describing the connector resource:
+
+```yaml
+(!examples/resources/onelogin-connector.yaml!)
+```
+
+### Test the connector
+
+Test the newly created configuration:
+
+```code
+$ cat onelogin.yaml | tctl sso test
+```
+
+`tctl sso test` will open the browser and attempt to authenticate with OneLogin.
+If it succeeds the output will print what SAML attributes are received and mapped
+to Teleport roles. If the test fails, the output will help you troubleshoot your
+configuration.
+
+### Create the connector
+
+Create the connector using the `tctl` tool:
+
+```code
+$ tctl create -f onelogin.yaml
+```
+
+## Step 3/3. Configure authentication preferences
+
+(!docs/pages/includes/sso/cap.mdx type="saml"!)
+
+## Next steps
+
+(!docs/pages/includes/sso/next-step-traits.mdx!)
+
+## Troubleshooting
+
+(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
+
diff --git a/docs/pages/zero-trust-access/sso/login-rules/guide.mdx b/docs/pages/zero-trust-access/sso/login-rules/guide.mdx
new file mode 100644
index 0000000000000..7c69e4b34d6bf
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/login-rules/guide.mdx
@@ -0,0 +1,365 @@
+---
+title: Set Up Login Rules 
+description: Set up Login Rules to transform user traits
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+---
+
+Login Rules define logic that transforms the external traits of a user who signs
+into Teleport, providing consistent access control policies for users in your
+cluster. A Teleport administrator can use Login Rules to define transformations
+in user traits without requiring changes in their IdP configuration. This is
+particularly useful if the team that manages an organization's identity provider
+(IdP) is separate from the team that manages Teleport.
+
+This guide walks you through the process of writing, testing, and adding the
+first Login Rule to your Teleport cluster. 
+
+## How it works
+
+A Login Rule is a dynamic Teleport resource stored on the Auth Service backend.
+When a user authenticates to Teleport through an IdP, Teleport populates the
+user's **external traits** based on data from the IdP.  Login Rules define logic
+for manipulating a user's external traits. When a user signs into Teleport, the
+Teleport Auth Service executes Login Rules in order of priority. After executing
+all Login Rules the Auth Service encodes the final set of external traits in the
+certificates that it issues to the user.
+
+For more information about configuring Login Rules, see the [Login Rules
+Reference](../../../reference/access-controls/login-rules.mdx).
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx edition="Teleport Enterprise"!)
+
+- (!docs/pages/includes/tctl.mdx!)
+
+Before you get started you’ll need a running Teleport Enterprise or Cloud
+cluster on version `11.3.1` or greater.
+
+Login Rules only operate on SSO logins, so make sure you have
+configured an OIDC, SAML, or GitHub connector before you begin.
+Check the [Single Sign-On](../../../zero-trust-access/sso/sso.mdx) docs to learn how to set this up.
+
+## Step 1/5. Configure RBAC
+
+First, ensure you are logged into Teleport as a user that has permissions
+to read and modify `login_rule` resources. The preset `editor` role
+has access to this already, but in case you are using a more customized configuration,
+create a role called `loginrule-manager.yaml` with the following contents:
+
+```yaml
+kind: role
+metadata:
+  name: loginrule-manager
+spec:
+  allow:
+    rules:
+      - resources: [login_rule]
+        verbs: [list, create, read, update, delete]
+version: v7
+```
+
+Create the role with `tctl`:
+
+```code
+$ tctl create loginrule-manager.yaml
+role 'loginrule-manager' has been created
+```
+
+(!docs/pages/includes/create-role-using-web.mdx!)
+
+(!docs/pages/includes/add-role-to-user.mdx role="loginrule-manager" !)
+
+## Step 2/5. Draft your Login Rule resource
+
+The following example will give all users a new `logins` trait set to the value
+of their current `username` trait converted to lowercase.
+Copy this example rule to a file called `my_rule.yaml` to continue with the
+guide.
+
+```yaml
+# my_rule.yaml
+kind: login_rule
+version: v1
+metadata:
+  # Each Login Rule must have a unique name within the cluster.
+  name: my_rule
+
+  # expires is optional and usually should not be set for deployed login
+  # rules, but it can be useful to set an expiry a short time in the future
+  # while testing new Login Rules to prevent potentially locking yourself out of
+  # your Teleport cluster.
+  # expires: "2023-01-31T00:00:00-00:00"
+spec:
+  # priority orders the evaluation of Login Rules if multiple are present in the
+  # cluster, lower priorities are evaluated first.
+  priority: 0
+
+  # traits_expression is a predicate expression which will be evaluated to
+  # determine the final traits for each SSO user during login.
+  #
+  # This example expression sets the "logins" trait to the incoming "username"
+  # trait converted to lowercase.
+  traits_expression: 'external.put("logins", strings.lower(external["username"]))'
+```
+
+Each Login Rule resource must have either a `traits_map` or `traits_expression`
+field.
+In this guide we will use an example `traits_expression`.
+
+The `traits_expression` is a form of script which will be evaluated by your
+Teleport cluster at runtime to determine the traits for each SSO user who logs
+in.
+The expression can access the incoming traits for the user via the `external`
+variable.
+The `external` variable is a dictionary which maps trait keys to sets of values
+for that trait.
+
+## Step 3/5. Test the Login Rule
+
+The `tctl login_rule test` command can be used to experiment with new Login
+Rules to check their syntax and see exactly how they will operate on example
+incoming traits.
+
+Fetch your user's current traits and store them in `input.json`, then test your
+new Login Rule with that input.
+
+```code
+$ tctl get --format json users/<Var name="username"/> | jq 'first.spec.traits' > input.json
+$ tctl login_rule test --resource-file my_rule.yaml input.json
+access:
+- staging
+groups:
+- dbs
+- devs
+logins:
+- alice
+```
+
+This script will catch any syntax errors in your expressions.
+Make sure that all expected traits are present in the output.
+
+## Step 4/5. Create the Login Rule
+
+Use the following command to create the Login Rule in your cluster:
+
+```code
+$ tctl create my_rule.yaml
+```
+
+## Step 5/5. Try it out
+
+As a final step, log out of your cluster, then log in again and make sure your user received the
+expected traits and roles.
+You can check the traits and roles with the following command:
+
+```code
+$ tctl get --format json users/<Var name="username"/> | jq '{traits: first.spec.traits, roles: first.spec.roles}'
+{
+  "traits": {
+    "access": [
+      "staging"
+    ],
+    "groups": [
+      "dbs",
+      "devs"
+    ],
+    "logins": [
+      "alice"
+    ]
+  },
+  "roles": [
+    "access",
+    "editor",
+    "auditor"
+  ]
+}
+```
+
+## Troubleshooting
+
+The [`tctl sso test`](../../../reference/cli/tctl.mdx) command can be used to
+debug SSO logins and see exactly which traits are being sent by your SSO
+provider and how they are being mapped by your Login Rules.
+
+`tctl sso test` expects a connector spec.  Run the following command to debug
+with a connector currently installed in your cluster, replacing 
+<Var name="SSO connector name"/> with the name of the SSO connector you registered with
+Teleport: 
+
+```code
+$ tctl get connector/<Var name="SSO connector name"/> --with-secrets | tctl sso test
+```
+
+## Next steps
+
+To learn more about the Login Rule expression syntax, check out the
+[Login Rule Reference](../../../reference/access-controls/login-rules.mdx) page.
+
+Learn about the `tctl login_rule test` command by running the help command or
+checking the [reference page](../../../reference/cli/tctl.mdx).
+```code
+$ tctl help login_rule test
+```
+
+The following `tctl` resource commands are helpful for viewing and modifying the
+login rules currently installed in your cluster.
+
+Command | Description
+------- | -----------
+`tctl get login_rules` | Show all Login Rules installed in your cluster.
+`tctl get login_rule/<rule_name>` | Get a specific installed Login Rule.
+`tctl create login_rule.yaml` | Install a new Login Rule.
+`tctl create -f login_rule.yaml` | Overwrite an existing Login Rule.
+`tctl rm login_rule/<rule_name>` | Delete a Login Rule.
+
+## Example Login Rules
+
+### Using an OIDC provider with arbitrary non-standard JSON claims
+
+Standard OIDC claims consist of string values and lists. However, it is also
+possible to have provider that returns non-standard JSON claims. By default,
+Teleport will not attempt to read these claims for `claims_to_roles` mappings
+or for the user's Teleport traits.
+
+For example, imagine a custom distributed IdP that aggregates claims for a user
+from multiple different provider sources. The claims set might look like a JSON
+object of the following format:
+
+```json
+{
+  "aggregated_claims": {
+    "okta": {
+      "groups": "okta_dev"
+    },
+    "auth0": {
+      "groups": "auth0_devops"
+    }
+  }
+}
+```
+
+The following JSONPath expression will take these claims and interpolate them
+into a standard groups claim:
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: set_logins
+spec:
+  priority: 1
+  traits_expression: |
+    external.put("groups", jsonpath("$.aggregated_claims.*.groups"))
+```
+
+A user logging in with the claims and login rule above will be treated as if
+they have the following claims:
+
+```json
+{
+  "groups": [
+    "okta_dev", 
+    "auth0_devops"
+  ]
+}
+```
+
+These interpolated claims can be used in claims to roles mappings, and they are
+kept as Teleport traits like any standard claims would be.
+
+### Set a trait to a static list of values defined per group
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: example
+spec:
+  priority: 0
+  traits_expression: |
+    external.put("allow-env",
+      choose(
+        option(external.group.contains("dev"), set("dev", "staging")),
+        option(external.group.contains("qa"), set("qa", "staging")),
+        option(external.group.contains("admin"), set("dev", "qa", "staging", "prod")),
+        option(true, set()),
+      ))
+```
+
+### Use only specific traits provided by the OIDC/SAML provider
+
+To only keep the `groups` and `email` traits, with their original values:
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: example
+spec:
+  priority: 0
+  traits_map:
+    groups:
+      - external.groups
+    email:
+      - external.email
+```
+
+### Remove a specific trait
+
+To remove a specific trait and keep the rest:
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: example
+spec:
+  priority: 0
+  traits_expression: |
+    external.remove("big-trait")
+```
+
+### Extend a specific trait with extra values
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: example
+spec:
+  priority: 0
+  traits_expression: |
+    external.add_values("logins", "ubuntu", "ec2-user")
+```
+
+### Use the output of one Login Rule in another rule
+
+```yaml
+kind: login_rule
+version: v1
+metadata:
+  name: set_groups
+spec:
+  priority: 0
+  traits_expression: |
+    external.put("groups",
+      ifelse(external.groups.contains("admins"),
+        external["groups"].add("superusers"),
+        external["groups"]))
+---
+kind: login_rule
+version: v1
+metadata:
+  name: set_logins
+spec:
+  priority: 1
+  traits_expression: |
+    ifelse(external.groups.contains("superusers"),
+      external.add_values("logins", "root"),
+      external)
+```
diff --git a/docs/pages/zero-trust-access/sso/login-rules/login-rules.mdx b/docs/pages/zero-trust-access/sso/login-rules/login-rules.mdx
new file mode 100644
index 0000000000000..3265917602af6
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/login-rules/login-rules.mdx
@@ -0,0 +1,88 @@
+---
+title: Login Rules 
+description: Transform User Traits with Login Rules
+template: "no-toc"
+tags:
+ - sso
+ - how-to
+ - zero-trust
+ - privileged-access
+---
+
+When users log in to your Teleport cluster with a configured SSO provider,
+**Login Rules** can transform the traits provided by your IdP to meet your needs
+for configuring access within Teleport.
+Login Rules are a feature of Teleport Enterprise.
+
+Some use cases for Login Rules are:
+
+- When you need to modify a user trait based on logical rules, like
+  "users in group `db-admins` should also be added to group `db-users`",
+  Login Rules provide a powerful expression language to make these changes
+  without needing to modify claims in your IdP.
+- When your IdP provides a large number of traits with many values, all of these
+  traits will be included in your user's SSH certificates and JWTs, which can
+  become too large for some third-party applications to handle.  Login Rules can
+  filter out unnecessary traits and keep just the ones you need.
+- When you have multiple [Role Templates](../../rbac-get-started/role-templates.mdx) repeating
+  the same logic to combine and transform external traits, consider using Login
+  Rules to consolidate the logic to one place and simplify your Roles.
+
+Login Rules can solve these problems without requiring changes to your
+organization's IdP.
+
+Login Rules use a predicate language to provide maximum flexibility when
+configuring your cluster.
+This allows you to write simple or complex expressions to define the traits your
+users should be granted.
+
+For example, you can convert the value of a `username` trait to lowercase and
+conditionally extend the value of a groups trait with the following
+snippet:
+```yaml
+traits_map:
+  username:
+    - 'strings.lower(external.username)'
+  groups:
+    - 'ifelse(external.groups.contains("db-admins"), external.groups.add("db-users"), external.groups)'
+```
+
+Check out the [Login Rules guide](guide.mdx) for a quick walkthrough
+that will show you how to write, test, and add the first Login Rule to your
+cluster. See [example Login Rules](guide.mdx) to
+learn how to address common use cases.
+
+When you're ready to take full advantage of Login Rules in your cluster, see the
+[Login Rules Reference](../../../reference/access-controls/login-rules.mdx) for details on the expression
+language that powers them.
+
+## FAQ
+
+### Which users do Login Rules apply to?
+
+Login Rules apply to all users logging in via OIDC, SAML, or GitHub.
+They do not apply to local Teleport users.
+
+### When are Login Rules evaluated?
+
+Login Rules are evaluated once during each user login, after receiving the
+claims or assertions from your IdP, before mapping claims/assertions to Teleport
+roles, and before generating user certificates.
+If Login Rules modify any traits used for role mapping, the role mapping will be
+affected.
+
+### Can I define custom helper functions for the predicate language?
+
+No, but if you have a use case which is not adequately met by the currently
+supported helper functions, please talk to support or submit a GitHub issue and
+we will consider adding helpers which are generally useful.
+
+### Can I have multiple Login Rules in a single cluster?
+
+Yes.
+All Login Rules installed in the cluster will first be sorted by priority and
+then evaluated in order.
+Each subsequent Login Rule will receive the full output of the previous rule as
+its input.
+It is strongly recommended to give each Login Rule a unique priority, but ties
+will be broken by sorting by the rule name.
diff --git a/docs/pages/zero-trust-access/sso/multiple-providers.mdx b/docs/pages/zero-trust-access/sso/multiple-providers.mdx
new file mode 100644
index 0000000000000..dcf54ba8a07a8
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/multiple-providers.mdx
@@ -0,0 +1,114 @@
+---
+title: Working with Multiple Identity Providers
+sidebar_label: Multiple Identity Providers
+sidebar_position: 2
+description: Provides guidance on integrating Teleport with multiple identity providers.
+---
+
+Teleport allows you to create and manage multiple authentication connectors, so
+you can centralize authentication and access controls in your organization's
+infrastructure even if your organization uses several identity providers.
+
+This guide explains how you can work with multiple identity providers in
+Teleport.
+
+## Managing authentication connector resources
+
+An authentication connector, which configures the integration between an
+identity provider and Teleport, is a dynamic resource. This means that you can
+manage it, like other dynamic resources, with `tctl` and other Teleport Auth
+Service clients.
+
+To see all configured connectors, execute this command:
+
+```code
+$ tctl get connectors
+```
+
+To delete/update connectors, use the usual `tctl rm` and `tctl create` commands
+as described in the [Resources
+Reference](../../reference/infrastructure-as-code/teleport-resources/teleport-resources.mdx).
+
+## Specifying a connector
+
+If multiple authentication connectors exist, the clients must supply a
+connector name to `tsh login` via `--auth` argument:
+
+```code
+# use "okta" SAML connector:
+$ tsh --proxy=proxy.example.com login --auth=okta
+
+# use local Teleport user DB:
+$ tsh --proxy=proxy.example.com login --auth=local --user=admin
+```
+
+No persistent backend data in Teleport associates a user's account with the SSO
+provider they used to authenticate.
+
+This also means that if one SSO provider becomes unavailable, the end user only
+needs to choose another SSO provider when signing in to Teleport. While the user
+may be locked out of their account with the first SSO provider, signing in via
+the second provider is sufficient for Teleport to issue a new certificate and
+grant the user access to your infrastructure.
+
+Note that if the username of an SSO user already belongs to a user registered
+locally with the Auth Service (i.e., created via `tctl users add`), the SSO
+login will fail.
+
+## Identifier-first login
+
+Identifier-first login is a feature that simplifies the login experience in clusters with
+multiple authentication connectors. When identifier-first login is enabled, the initial
+login screen prompts the user for their username only.
+Teleport will then present only the auth connectors
+that are relevant to the specified user.
+
+### Configuration
+
+You can enable identifier-first login on a cluster by configuring one or more
+SAML, OIDC, or GitHub auth connectors with a `spec.user_matchers` field, which
+takes a set of one or more user matchers for usernames. A user matcher is a
+string matcher that can either be a specific username to match, or a glob
+pattern using wildcard characters (`*`). An auth connector will be mapped to a
+user if one or more of its `user_matchers` matches their username.
+
+```yaml
+kind: saml
+version: v2
+metadata:
+  name: okta
+spec:
+  user_matchers: ['joe', '*@example.com']
+```
+
+Once enabled, users without an auth connector mapped to them will not be able to see
+any auth connectors on the login page. For this reason, it is recommended to configure
+one or more fallback connectors. A user matcher of `*` is a special case that marks a
+connector as a fallback, which will only be presented to users who don't match any other connector.
+
+### Examples
+
+Match users with a username that ends in "@example.com":
+
+```yaml
+  user_matchers: ['*@example.com']
+```
+
+Match users with a username that ends in "@example.com" and also match "alice":
+
+```yaml
+user_matchers: ['*@example.com', 'alice']
+```
+
+Match only users that weren't matched to any other auth connectors:
+
+```yaml
+user_matchers: ['*']
+```
+
+Match users that end in "@example.com" or weren't matched to any other connectors:
+
+```yaml
+user_matchers: ['*', '*@example.com']
+```
+
diff --git a/docs/pages/zero-trust-access/sso/sso-for-mfa.mdx b/docs/pages/zero-trust-access/sso/sso-for-mfa.mdx
new file mode 100644
index 0000000000000..e6b93bafd3b40
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/sso-for-mfa.mdx
@@ -0,0 +1,129 @@
+---
+title: Configuring SSO for MFA Checks
+sidebar_label: SSO For MFA Checks
+description: Explains how to set up an authentication connector to delegate multi-factor authentication to your identity provider.
+---
+
+Teleport administrators can configure Teleport to delegate multi-factor
+authentication checks to a single sign-on provider as an alternative to
+registering MFA devices directly with the Teleport cluster. This guide explains
+how to configure SSO for MFA checks.  
+
+SSO for MFA checks allows Teleport users to use MFA devices and custom flows
+configured in the SSO provider to carry out privileged actions in Teleport, such
+as:
+
+- [Per-session MFA](../authentication/per-session-mfa.mdx)
+- [Moderated sessions](../authentication/joining-sessions.mdx)
+- [Admin actions](../authentication/mfa-for-admin-actions.mdx)
+
+Administrators may want to consider enabling this feature in order to:
+
+- Make all authentication (login and MFA) go through the IDP, reducing administrative overhead
+- Make custom MFA flows, such as prompting for 2 distinct devices for a single MFA check
+- Integrate with non-webauthn devices supported directly by your IDP
+
+<Admonition type="note">
+  SSO MFA is an enterprise feature. Only OIDC and SAML auth connectors are supported.
+</Admonition>
+
+{/* lint ignore page-structure remark-lint */}
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- This guide assumes that you are familiar with how to integrate your identity
+  provider with Teleport. Make sure that you understand the guide in [Integrate
+  your IdP](integrate-idp/integrate-idp.mdx) for your provider. You must already
+  have an authentication connector configured.
+
+## Step 1/3. Configure the IdP application or client
+
+There is no standardized MFA flow unlike there is with SAML/OIDC
+login, so each IDP may offer zero, one, or more ways to offer MFA checks.
+
+Generally, these offerings will fall under one of the following cases:
+
+1. Use a separate IDP app for MFA:
+
+You can create a separate IDP app with a custom MFA flow. For example, with
+Auth0 (OIDC), you can create a separate app with a custom [Auth0 Action](https://auth0.com/docs/customize/actions)
+which prompts for MFA for an active OIDC session.
+
+2. Use the same IDP app for MFA:
+
+Some IDPs provide a way to fork to different flows using the same IDP app.
+For example, with Okta (OIDC), you can provide `acr_values: ["phr"]` to
+[enforce phishing resistant authentication](https://developer.okta.com/docs/guides/step-up-authentication/main/#predefined-parameter-values).
+
+For a simpler approach, you could use the same IDP app for both login and MFA
+with no adjustments. For Teleport MFA checks, the user will be required to
+relogin through the IDP with username, password, and MFA if required.
+
+<Admonition type="warning">
+  While the customizability of SSO MFA presents multiple secure options previously
+  unavailable to administrators, it also presents the possibility of insecure
+  misconfigurations. Therefore, we strongly advice administrators to incorporate
+  strict, phishing-resistant checks with WebAuthn, Device Trust, or some similar
+  security features into their custom SSO MFA flow.
+</Admonition>
+
+## Step 2/3. Update your authentication connector
+
+Add MFA settings to your authentication connector, as shown in the following
+examples:
+
+<Tabs>
+<TabItem label="OIDC">
+
+```yaml
+(!examples/resources/oidc-connector-mfa.yaml!)
+```
+
+</TabItem>
+<TabItem label="SAML">
+
+```yaml
+(!examples/resources/saml-connector-mfa.yaml!)
+```
+
+You may use `entity_descriptor_url` in lieu of `entity_descriptor` to fetch
+the entity descriptor from your IDP.
+
+We recommend "pinning" the entity descriptor by including the XML rather than
+fetching from a URL.
+
+</TabItem>
+</Tabs>
+
+Update the connector:
+
+```code
+$ tctl create -f connector.yaml
+```
+
+## Step 3/3. Allow SSO as an MFA method in your cluster
+
+Before you can use the SSO MFA flow we created above, you need to enable SSO for
+multi-factor authentication in your cluster settings. Modify the dynamic config
+resource using the following command:
+
+```code
+$ tctl edit cluster_auth_preference
+```
+
+Make the following change:
+
+```diff
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  # ...
+  second_factors:
+   - webauthn
++  - sso
+```
+
diff --git a/docs/pages/zero-trust-access/sso/sso.mdx b/docs/pages/zero-trust-access/sso/sso.mdx
new file mode 100644
index 0000000000000..4ae84946e6f0c
--- /dev/null
+++ b/docs/pages/zero-trust-access/sso/sso.mdx
@@ -0,0 +1,169 @@
+---
+title: Configure Single Sign-On
+sidebar_label: Single Sign-On
+sidebar_position: 2
+description: How to set up single sign-on (SSO) using Teleport
+tags:
+ - sso
+ - conceptual
+ - zero-trust
+ - privileged-access
+---
+
+Users can log in to Teleport through your organization's single sign-on (SSO)
+provider. You can centralize the way your infrastructure authenticates,
+authorizes, and audits users who want to access it, while also keeping your
+organization's existing processes for managing users.
+
+To get started integrating your identity provider with Teleport, read [Integrate
+your Identity Provider](integrate-idp/integrate-idp.mdx). The rest of this guide
+explains key concepts related to Teleport single sign-on integrations.
+
+## How Teleport uses SSO
+
+You can register your Teleport cluster as an application with your SSO provider.
+When a user signs in to Teleport, your SSO provider will execute its own
+authentication flow, then send an HTTP request to your Teleport cluster to
+indicate that authentication has completed.
+
+Teleport authenticates users to your infrastructure by issuing short-lived
+certificates. After a user completes an SSO authentication flow, Teleport issues
+a short-lived certificate to the user. Teleport also creates a temporary user on
+the Auth Service backend.
+
+### Temporary user resources
+
+After a user completes an SSO authentication flow, Teleport creates a temporary
+`user` resource for the user.
+
+When a user signs in to Teleport with `tsh login`, they can configure the TTL of
+the `user` Teleport creates. Teleport enforces a limit of 30 hours (the default
+is 12 hours).
+
+In the Teleport audit log, you will see an event of type `user.create` with
+information about the temporary user.
+
+<details>
+<summary>How can I inspect a temporary user resource?</summary>
+
+You can inspect a temporary `user` resource created via your SSO integration
+by using the `tctl` command:
+
+```code
+# Log in to your cluster with tsh so you can use tctl remotely
+$ tsh login --proxy=example.teleport.sh
+$ tctl get users/<username>
+```
+
+Here is an example of a temporary `user` resource created when the GitHub user
+`myuser` signed in to GitHub to authenticate to Teleport. This resource
+expires 12 hours after creation. The `created_by` field indicates that the
+resource was created by Teleport's GitHub SSO integration:
+
+```yaml
+kind: user
+metadata:
+  expires: "2022-06-15T04:02:34.586688054Z"
+  id: 0000000000000000000
+  name: myuser
+spec:
+  created_by:
+    connector:
+      id: github
+      identity: myuser
+      type: github
+    time: "2022-06-14T16:02:34.586688441Z"
+    user:
+      name: system
+  expires: "0001-01-01T00:00:00Z"
+  github_identities:
+  - connector_id: github
+    username: myuser
+  roles:
+  - editor
+  - access
+  - auditor
+  status:
+    is_locked: false
+    lock_expires: "0001-01-01T00:00:00Z"
+    locked_time: "0001-01-01T00:00:00Z"
+  traits:
+    github_teams:
+    - my-team
+    kubernetes_groups: null
+    kubernetes_users: null
+    logins:
+    - root
+version: v2
+```
+
+</details>
+
+### Certificates for SSO users
+
+Along with creating a temporary user, Teleport issues SSH and X.509 certificates
+to a successfully authenticated SSO user's machine. This enables SSO users to
+authenticate to your cluster without Teleport needing to create a permanent
+record of them.
+
+In the X.509 certificate, for example, the `Subject` field contains the same
+information defined in the temporary `user` resource. This enables Teleport to
+enforce RBAC rules for the authenticated user when they access resources in your
+cluster.
+
+This is a `Subject` field for a certificate that Teleport issued for the GitHub
+user `myuser`, who signed in to a Teleport cluster via the GitHub SSO
+integration:
+
+```
+Subject: L=myuser/street=teleport.example.com/postalCode={"github_teams":["my-team"],"kubernetes_groups":null,"kubernetes_users":null,"logins":["root"]}, O=access, O=editor, O=auditor, CN=myuser/1.3.9999.1.7=teleport.example.com
+```
+
+The user belongs to the GitHub team `my-team`, which this Teleport cluster maps
+to the `access`, `editor`, and `auditor` roles in Teleport. 
+
+<details>
+<summary>Inspecting your certificate subject</summary>
+
+To inspect the contents of an X.509 certificate issued for your user after you
+sign in to Teleport via SSO, run the following commands:
+
+```code
+$ TELEPORT_CLUSTER=<your cluster>
+$ SSO_USER=<your username within your SSO provider>
+$ openssl x509 -text -in ~/.tsh/keys/${TELEPORT_CLUSTER}/${SSO_USER}-x509.pem | grep "Subject:"
+```
+
+You can inspect an SSH certificate issued for your Teleport user with the
+following command:
+
+```code
+$ ssh-keygen -L -f ~/.tsh/keys/${TELEPORT_CLUSTER}/${SSO_USER}-ssh/${TELEPORT_CLUSTER}-cert.pub
+```
+
+</details>
+
+## Logging in via SSO
+
+Users can log in to Teleport via your SSO provider by executing a command
+similar to the following, using the `--auth` flag to specify the provider:
+
+```code
+# This command will automatically open the default web browser and take a user
+# through the login process with an SSO provider
+$ tsh login --proxy=proxy.example.com --auth=github
+```
+
+The command opens a browser window and shows a URL the user can visit in the
+terminal to complete their SSO flow:
+
+```text
+If browser window does not open automatically, open it by clicking on the link:
+http://127.0.0.1:45235/055a310a-1099-43ea-8cf6-ffc41d88ad1f
+```
+
+Teleport will wait for up to 3 minutes for a user to authenticate. If
+authentication succeeds, Teleport will retrieve SSH and X.509 certificates and
+store them in the `~/.tsh/keys/<clustername>` directory. The tool will also will
+add SSH cert to an SSH agent if there's one running.
+
diff --git a/docs/pages/zero-trust-access/zero-trust-access.mdx b/docs/pages/zero-trust-access/zero-trust-access.mdx
new file mode 100644
index 0000000000000..be1a3f32e4d60
--- /dev/null
+++ b/docs/pages/zero-trust-access/zero-trust-access.mdx
@@ -0,0 +1,284 @@
+---
+title: Teleport Zero Trust Access
+description: Provides guides for the Teleport Zero Trust Access product.
+template: "landing-page"
+---
+
+import LandingHero, { LandingHeroProps } from '@site/src/components/Pages/Landing/LandingHero';
+import Resources, { ResourcesProps } from "@site/src/components/Pages/Homepage/Resources";
+import UseCasesList, { UseCasesListProps } from "@site/src/components/Pages/Landing/UseCasesList";
+
+import applicationSvg from "@site/src/components/Icon/teleport-svg/application.svg";
+import linuxServersSvg from "@site/src/components/Icon/teleport-svg/linux-servers.svg";
+import databaseSvg from "@site/src/components/Icon/teleport-svg/database-access.svg";
+import kubernetesClustersSvg from "@site/src/components/Icon/teleport-svg/kubernetes-clusters.svg";
+import windowsDesktopsSvg from "@site/src/components/Icon/teleport-svg/windows-desktops.svg";
+import autoDiscoverySvg from "@site/src/components/Icon/teleport-svg/auto-discovery.svg";
+import cloudProvidersSvg from "@site/src/components/Icon/teleport-svg/cloud-providers.svg";
+import mcpAndAiSvg from "@site/src/components/Icon/teleport-svg/mcp-and-ai.svg";
+
+<LandingHero
+  title="Teleport Zero Trust Access"
+  youtubeVideoId="Vf9W6EjENcg"
+>
+  Easy access to all your infrastructure, on a foundation of cryptographic identity and zero trust.
+
+  [Authentication and session joining](./authentication/authentication.mdx)
+
+  [Get started with role-based access control (RBAC)](./rbac-get-started/rbac-get-started.mdx)
+
+  [Export audit events to a SIEM tool](./export-audit-events/export-audit-events.mdx)
+
+</LandingHero>
+
+<UseCasesList
+  title="Popular topics"
+  desktopColumnsCount={2}
+  useCases={[
+    {
+      title: "Sign in with your identity provider",
+      description: "Log into infrastructure via your Single Sign-On (SSO) provider",
+      href: "./sso/",
+      tags: [
+        {
+          name: "Okta",
+          href: "./sso/integrate-idp/okta/",
+          icon: "okta",
+        },
+        {
+          name: "GitHub",
+          href: "./sso/integrate-idp/github-sso/",
+          icon: "github",
+        },
+        {
+          name: "Entra ID",
+          href: "./sso/integrate-idp/entra-id-oidc/",
+          icon: "entraId",
+        },
+       {
+          name: "More IdPs",
+          href: "./sso/integrate-idp/",
+          arrow: true,
+        },
+      ]
+    },
+     {
+      title: "VNet: Build without VPNs",
+      description: "Connect to internal, non-browser TCP and SSH resources without VPNs. Use familiar tools and workflows while eliminating exposure to public internet.",
+      href: "../enroll-resources/application-access/vnet/",
+      tags: [
+        {
+          name: "Teleport VNet demo",
+          href: "https://youtu.be/OQ98VErAorM",
+          icon: "youtube",
+        },
+        {
+          name: "VNet guide",
+          href: "../connect-your-client/teleport-clients/vnet/",
+        },
+      ]
+    },
+    {
+      title: "Manage and track Teleport audit events",
+      description: "Log granular audit events when users and services interact with your cluster. View audit events in Teleport or export them to a third-party tool.",
+      href: "./export-audit-events/",
+      tags: [
+        {
+          name: "Elastic Stack",
+          href: "./export-audit-events/elastic-stack/",
+          icon: "elasticStack",
+        },
+        {
+          name: "Panther",
+          href: "./export-audit-events/panther/",
+          icon: "panther",
+        },
+        {
+          name: "Datadog",
+          href: "./export-audit-events/datadog/",
+          icon: "datadog",
+        },
+        {
+          name: "Splunk",
+          href: "./export-audit-events/splunk/",
+        },
+      ]
+    },
+    {
+      title: "Self-host Teleport",
+      description: "Run Teleport Enterprise in your own infrastructure, with guides covering high availability and multi-region clusters, securing key material with KMS or HSMs, and more.",
+      href: "./deploy-a-cluster/",
+      tags: [
+        {
+          name: "AWS KMS",
+          href: "./deploy-a-cluster/private-keys/aws-kms/",
+          icon: "aws",
+        },
+        {
+          name: "Google Cloud KMS",
+          href: "./deploy-a-cluster/private-keys/gcp-kms/",
+          icon: "googleCloud",
+        },
+        {
+          name: "Helm chart",
+          href: "./deploy-a-cluster/helm-deployments/",
+        },
+      ]
+    },  
+    {
+      title: "Infrastructure as Code",
+      description: "Manage Teleport's Dynamic Resources using infrastructure as code tools, including Terraform, Helm and the Teleport tctl client tool.",
+      href: "./infrastructure-as-code/",
+      tags: [
+        {
+          name: "Terraform",
+          href: "./infrastructure-as-code/terraform-provider/",
+        },
+        {
+          name: "Kubernetes operator",
+          href: "./infrastructure-as-code/teleport-operator/",
+        },
+      ]
+    },
+    {
+      title: "Security best practices",
+      description: "Run Teleport Enterprise in your own infrastructure, with guides covering high availability and multi-region clusters, secure CA keys with KMS or HSM, and more.",
+      href: "./management/security/",
+      tags: [
+        {
+          name: "Reducing the blast radius of attacks",
+          href: "./management/security/reduce-blast-radius/",
+        },
+        {
+          name: "Restricting access",
+          href: "./management/security/restrict-privileges/",
+        },
+        {
+          name: "Revoking access",
+          href: "./management/security/revoking-access/",
+        },
+      ]
+    }
+  ]}
+/>
+
+<UseCasesList
+  title="Use cases"
+  useCases={[
+    {
+      title: "Enroll and protect your infrastructure",
+      description: "Apps, servers, databases, Kubernetes, desktops, and more",
+      href: "../enroll-resources/",
+    },  
+    {
+      title: "VNet: Build without VPNs",
+      description: "Secure app and SSH access with no VPNs or proxies",
+      href: "../enroll-resources/application-access/vnet/",
+    },
+    {
+      title: "Secure MCP",
+      description: "Secure MCP integration with a granular audit trail",
+      href: "../connect-your-client/model-context-protocol/",
+    },  
+    {
+      title: "Role-Based Access Control (RBAC)",
+      description: "Govern infrastructure access with granular permissions",
+      href: "./rbac-get-started/",
+    },
+    {
+      title: "Passwordless authentication",
+      description: "Log in securely using biometrics",
+      href: "./authentication/passwordless/",
+    },
+    {
+      title: "Integrate with SSO providers",
+      description: "Connect Okta, Entra ID, Google, and more",
+      href: "./sso/",
+    },  
+    {
+      title: "Structured audit export",
+      description: "Forward audit logs to SIEMs like Splunk and Datadog",
+      href: "./export-audit-events/",
+    },
+    {
+      title: "Identity-based audit events",
+      description: "Detailed audit logs for every user action",
+      href: "../reference/deployment/monitoring/audit/",
+    },  
+    {
+      title: "Session recording and playback",
+      description: "Record a detailed review of what took place",
+      href: "../enroll-resources/desktop-access/reference/sessions/",
+    },
+    {
+      title: "Session sharing and moderation",
+      description: "Require a moderator for privileged sessions",
+      href: "./authentication/joining-sessions/",
+    },
+    {
+      title: "Dual authorization capabilities",
+      description: "Require approvals to perform critical actions",
+      href: "../identity-governance/access-requests/",
+    },
+    {
+      title: "Manage clusters with IaC",
+      description: "Create, update, and manage Teleport in declarative code.",
+      href: "./infrastructure-as-code/",
+    },
+  ]}
+/>
+
+{/* vale messaging.protocol-products = NO */}
+<Resources
+  resources={[
+    {
+      title: 'Applications',
+      description: 'Protect web apps, TCP apps, and Cloud APIs',
+      iconComponent: applicationSvg,
+      href: '../enroll-resources/application-access/'
+    },
+    {
+      title: 'Linux servers',
+      description: 'Secure Linux servers and OpenSSH servers',
+      iconComponent: linuxServersSvg,
+      href: '../enroll-resources/server-access/'
+    },
+    {
+      title: 'Database access',
+      description: 'PostgreSQL, MongoDB, SQL Server, and more',
+      iconComponent: databaseSvg,
+      href: '../enroll-resources/database-access/'
+    },
+    {
+      title: 'Kubernetes clusters',
+      description: 'Kubernetes clusters and the apps running in them',
+      iconComponent: kubernetesClustersSvg,
+      href: '../enroll-resources/kubernetes-access/'
+    },
+    {
+      title: 'Windows desktops',
+      description: 'With or without Active Directory',
+      iconComponent: windowsDesktopsSvg,
+      href: '../enroll-resources/desktop-access/'
+    },
+    {
+      title: 'Auto-discovery of resources',
+      description: 'SSH servers, databases, Kubernetes clusters and apps',
+      iconComponent: autoDiscoverySvg,
+      href: '../enroll-resources/auto-discovery/'
+    },
+    {
+      title: 'Cloud providers',
+      description: 'AWS, Azure, and Google Cloud consoles and CLI',
+      iconComponent: cloudProvidersSvg,
+      href: '../enroll-resources/application-access/cloud-apis/'
+    },
+    {
+      title: 'MCP and AI agents',
+      description: 'Secure agentic AI connections to databases and MCP servers',
+      iconComponent: mcpAndAiSvg,
+      href: '../enroll-resources/mcp-access/'
+    }
+  ]}
+/>
+{/* vale messaging.protocol-products = YES */}
diff --git a/docs/security/signing-info.md b/docs/security/signing-info.md
deleted file mode 100644
index 54339a260eb8a..0000000000000
--- a/docs/security/signing-info.md
+++ /dev/null
@@ -1,180 +0,0 @@
-## Public Certificates & Encryption Keys
-
-We use the following certificates and public keys to sign our software. Many of
-these keys and certificates use our legal business name “Gravitational Inc.” and
-our former domain “gravitational.com”. Don’t worry – [Gravitational is
-Teleport](https://goteleport.com/blog/gravitational-is-teleport/).
-
-### APT, YUM, & Zypper Signing Keys
-
-We sign our [APT, YUM and Zypper
-repositories](https://goteleport.com/docs/installation/#package-repositories)
-with the following PGP key:
-
-* ID `C87ED53A6282C411`
-* Fingerprint `0C5E 8BA5 658E 320D 1B03 1179 C87E D53A 6282 C411`
-
-The key is available for download at:
-* [https://apt.releases.teleport.dev/gpg](https://apt.releases.teleport.dev/gpg)
-* [https://yum.releases.teleport.dev/gpg](https://yum.releases.teleport.dev/gpg)
-* [https://zypper.releases.teleport.dev/gpg](https://zypper.releases.teleport.dev/gpg)
-
-### Apple Signing Certificates
-
-Our Apple packages and binaries are [code
-signed](https://developer.apple.com/support/code-signing/) by "Developer ID
-QH8AA5B8UP Gravitational Inc." with the following certificate:
-* SHA256 Fingerprint: `78 2F E1 18 5F A1 AD 68 AD 25 0B A9 4D 21 DC BB 0D 8E 47
-  C6 E4 1D FE FB AB 05 41 33 4C 33 1D 43`
-* SHA1 Fingerprint: `82 B6 25 AD 32 7C 24 1B 37 8A 54 B4 B2 54 BB 08 CE 71 B5 DF`
-
-Packages published prior to September 14, 2021 are signed with an older certificate for the same Developer ID (QH8AA5B8UP):
-* SHA256 Fingerprint: `78 05 14 69 20 59 21 D1 EE 96 42 01 5A 28 35 FB E1 D4 38 5E 2A 23 5D 62 73 A4 D1 27 8A 33 BA 34`
-* SHA1 Fingerprint: `D2 70 EA 0C F2 0E CB 17 28 B2 21 E1 D5 B6 7C FE 50 FF AB 62`
-
-Verify the Developer ID and fingerprint match on package downloads with the
-pkgutil tool:
-```console
-$ pkgutil --check-signature teleport-15.0.2.pkg
-Package "teleport-15.0.2.pkg":
-   Status: signed by a developer certificate issued by Apple for distribution
-   Notarization: trusted by the Apple notary service
-   Signed with a trusted timestamp on: 2024-02-16 21:42:52 +0000
-   Certificate Chain:
-    1. Developer ID Installer: Gravitational Inc. (QH8AA5B8UP)
-       Expires: 2026-07-27 18:27:29 +0000
-       SHA256 Fingerprint:
-           78 2F E1 18 5F A1 AD 68 AD 25 0B A9 4D 21 DC BB 0D 8E 47 C6 E4 1D
-           FE FB AB 05 41 33 4C 33 1D 43
-       ------------------------------------------------------------------------
-    2. Developer ID Certification Authority
-       Expires: 2027-02-01 22:12:15 +0000
-       SHA256 Fingerprint:
-           7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03
-           F2 9C 88 CF B0 B1 BA 63 58 7F
-       ------------------------------------------------------------------------
-    3. Apple Root CA
-       Expires: 2035-02-09 21:40:36 +0000
-       SHA256 Fingerprint:
-           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
-           68 C5 BE 91 B5 A1 10 01 F0 24
-```
-
-The codesign tool can be used to perform the verification on individual
-binaries:
-```console
-$ codesign --verify -d --verbose=2 /usr/local/bin/tsh
-...
-Authority=Developer ID Application: Gravitational Inc. (QH8AA5B8UP)
-Authority=Developer ID Certification Authority
-Authority=Apple Root CA
-Timestamp=Jun 29, 2024 at 11:02:15 PM
-Info.plist=not bound
-TeamIdentifier=QH8AA5B8UP
-...
-```
-
-The Teleport package in Homebrew is not maintained or signed by Teleport. We
-recommend the use of [our Teleport packages](https://goteleport.com/download/).
-
-### Windows Signing Certificates
-
-Our Windows binaries are signed with the following certificate:
-* Issued to: Gravitational Inc.
-* Thumbprint: C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391
-
-Verify the binary using the following PowerShell command:
-```console
-Get-AuthenticodeSignature -FilePath .\tsh.exe
-
-    Directory: C:\Users\ExampleUser
-
-SignerCertificate                         Status   Path
------------------                         ------   ----
-C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391  Valid    tsh.exe
-```
-
-Ensure that the `SignerCertificate` matches the thumbprint shown above, and that
-the `Status` field is `Valid`. 
-
-To further inspect the certificate, run the following PowerShell command:
-```console
-(Get-AuthenticodeSignature -FilePath.\tsh.exe).SignerCertificate | Format-List
-
-Subject      : CN="Gravitational, Inc.", O="Gravitational, Inc.", L=Oakland,
-               S=California, C=US, SERIALNUMBER=5720258,
-               OID.2.5.4.15=Private Organization,
-               OID.1.3.6.1.4.1.311.60.2.1.2=Delaware,
-               OID.1.3.6.1.4.1.311.60.2.1.3=US
-Issuer       : CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,
-               O="DigiCert, Inc.", C=US
-Thumbprint   : C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391
-FriendlyName :
-NotBefore    : 11/2/2023 12:00:00 AM
-NotAfter     : 10/16/2026 11:59:59 PM
-Extensions   : {System.Security.Cryptography.Oid, 
-                System.Security.Cryptography.Oid,
-                System.Security.Cryptography.Oid,
-                System.Security.Cryptography.Oid...}
-```
-
-Alternatively, Windows binaries may be inspected graphically via the Windows
-Explorer with the following steps:
-1. Right click on the binary in question, for example `tsh.exe`.
-2. Select “Properties”.
-3. On the resulting “tsh.exe Properties” dialog, select the “Digital Signatures”
-   tab.
-4. Select the “Gravitational Inc.” signer from the list.
-5. Select the “Details” button.
-5. On the resulting “Digital Signature Details” dialog, ensure that the header
-   states “This digital signature is OK.”
-6. Select the “View Certificate” button.
-7. On the resulting “Certificate” dialog, select the “Details” tab.
-8. Select the “Thumbprint” item from the list, and compare its value to the
-   thumbprint listed above.
-
-### OCI Container Images
-All of our distroless OCI container images are signed with `cosign`. The public
-key is:
-```
------BEGIN PUBLIC KEY-----
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx+9UZboMl9ibwu/IWqbX
-+wEJeKJqVpaLEsy1ODRpzIgcgaMh2n3BWtFEIoEszR3ZNlGdfqoPmb0nNnWx/qSf
-eEsoSXievXa63M/gAUBB+jecbGEJH+SNaJPMVuvjabPqKtoMT2Spw3cacqpINzq1
-rkWU8IawY333gXbwzgsuK7izT7ymgOLPO9qPuX7Q3EBaGw3EvY7u6UKtqhvSGdyr
-MirEErOERQ8EP8TrkCcJk0UfPAukzIcj91uHlXaqYBD/IyNYiC70EOlSLoN5/EeA
-I4jQnGRfaKF6H6K+WieX9tP9k8/02S+1EVJW592pdQZhJZEq1B/dMc8UR3IjPMMC
-qCT2xT6TsinaVzDaAbaRf0hvp311GxwrckNofGm/OSLn1+HqM6q4/A7qHubeRXGO
-byabRr93CHSLegZ7OBMswHqqnu6/DuXjc6gOsQkH09dVTFeh34rQy4GKrvnpmOwj
-Er1ccxzKcF/pw+lxi07hkpihR/uHUPxFboA/Wl7H2Jub21MFwIFQrDJv7z8yQgxJ
-EuIXJJox2oAL7NzdSi9VIUYnEnx+2EtkU/spAFRR6i1BnT6aoIy3521B76wnmRr9
-atCSKjt6MdRxgj4htCjBWWJAGM9Z/avF4CYFmK7qiVxgpdrSM8Esbt2Ta+Lu3QMJ
-T8LjqFu3u3dxVOo9RuLk+BkCAwEAAQ==
------END PUBLIC KEY-----
-```
-
-Signatures can be validated against the Teleport OCI image signing key:
-```console
-$ cosign verify --key teleport-oci-key.pub \
-    public.ecr.aws/gravitational/teleport-distroless-debug:15.4.6
-
-Verification for public.ecr.aws/gravitational/teleport-distroless-debug:15.4.6 --
-The following checks were performed on each of these signatures:
-  - The cosign claims were validated
-  - The signatures were verified against the specified public key
-
-[
-    {
-        "critical": {
-            "identity": {
-                "docker-reference": "public.ecr.aws/gravitational/teleport-distroless-debug"
-            },
-            "image": {
-                "docker-manifest-digest": "sha256:02093593bf129dc304b79854b01b0b911674e9bd6b9049cac14b6e1b116c58e5"
-            },
-            "type": "cosign container image signature"
-        },
-        "optional": ...
-    }
-]
-```
diff --git a/docs/sidebar.json b/docs/sidebar.json
index ccf593e8eca54..3277db4285461 100644
--- a/docs/sidebar.json
+++ b/docs/sidebar.json
@@ -10,54 +10,112 @@
       },
       "items": [
         {
-          "type": "doc",
+          "type": "category",
           "label": "Get Started",
-          "id": "get-started"
+          "collapsible": true,
+          "link": {
+            "type": "doc",
+            "id": "get-started/get-started"
+          },
+          "items": [
+            {
+              "type": "category",
+              "label": "Step 1: Deploy a Cluster",
+              "collapsible": true,
+              "items": [
+                {
+                  "type": "doc",
+                  "id": "get-started/deploy-cloud",
+                  "label": "Enterprise Cloud"
+                },
+                {
+                  "type": "doc",
+                  "id": "get-started/deploy-community",
+                  "label": "Community Edition (Linux Demo)"
+                }
+              ]
+            },
+            {
+              "type": "doc",
+              "id": "get-started/connect",
+              "label": "Step 2: Connect Infrastructure"
+            },
+            {
+              "type": "doc",
+              "id": "get-started/access",
+              "label": "Step 3: Set Up Access Controls"
+            },
+            {
+              "type": "doc",
+              "id": "get-started/audit",
+              "label": "Step 4: Monitor Audit Logs"
+            }
+          ]
         },
         {
           "type": "doc",
           "label": "Core Concepts",
           "id": "core-concepts"
         },
-        {
-          "type": "doc",
-          "label": "Installation",
-          "id": "installation"
-        },
-        {
-          "type": "doc",
-          "label": "Teleport Feature Matrix",
-          "id": "feature-matrix"
-        },
         {
           "type": "category",
-          "label": "Upgrading",
+          "label": "Installation",
           "collapsible": true,
           "items": [
             {
               "type": "doc",
-              "label": "Compatibility Overview",
-              "id": "upgrading/overview"
+              "label": "Linux",
+              "id": "installation/linux"
+            },
+            {
+              "type": "doc",
+              "label": "Docker",
+              "id": "installation/docker"
             },
             {
               "type": "doc",
-              "label": "Cluster Upgrading Reference",
-              "id": "upgrading/upgrading-reference"
+              "label": "Amazon EC2",
+              "id": "installation/amazon-ec2"
             },
             {
               "type": "doc",
-              "label": "Managed Updates for Agents (v1)",
-              "id": "upgrading/agent-managed-updates-v1"
+              "label": "Amazon ECS",
+              "id": "installation/amazon-ecs"
             },
             {
               "type": "doc",
-              "label": "Managed Updates for Agents (v2)",
-              "id": "upgrading/agent-managed-updates"
+              "label": "Helm",
+              "id": "installation/helm"
             },
             {
               "type": "doc",
-              "label": "Managed Updates for Client Tools",
-              "id": "upgrading/client-tools-autoupdate"
+              "label": "macOS",
+              "id": "installation/macos"
+            },
+            {
+              "type": "doc",
+              "label": "Windows",
+              "id": "installation/windows"
+            },
+            {
+              "type": "doc",
+              "label": "Source",
+              "id": "installation/source"
+            }
+          ],
+          "link": {
+            "type": "doc",
+            "id": "installation/installation"
+          }
+        },
+        {
+          "type": "category",
+          "label": "Upgrading",
+          "collapsible": true,
+          "items": [
+            {
+              "type": "autogenerated",
+              "dirName": "upgrading"
             }
           ],
           "link": {
@@ -65,11 +123,33 @@
             "id": "upgrading/upgrading"
           }
         },
+        {
+          "type": "doc",
+          "label": "Migrate Teleport Plans",
+          "id": "migrate-plans"
+        }
+      ]
+    },
+    {
+      "type": "category",
+      "label": "Quick Links",
+      "collapsible": true,
+      "items": [
+        {
+          "type": "doc",
+          "label": "Teleport Feature Matrix",
+          "id": "feature-matrix"
+        },
         {
           "type": "doc",
           "label": "FAQ",
           "id": "faq"
         },
+        {
+          "type": "doc",
+          "label": "Teleport Cloud FAQ",
+          "id": "cloud-faq"
+        },
         {
           "type": "doc",
           "label": "Usage Reporting and Billing",
@@ -94,66 +174,72 @@
     },
     {
       "type": "category",
-      "label": "Admin Guides",
+      "label": "User Guides",
+      "collapsible": true,
       "link": {
         "type": "doc",
-        "id": "admin-guides/admin-guides"
+        "id": "connect-your-client/connect-your-client"
       },
       "items": [
         {
           "type": "autogenerated",
-          "dirName": "admin-guides"
+          "dirName": "connect-your-client"
         }
       ]
     },
     {
       "type": "category",
-      "label": "User Guides",
-      "collapsible": true,
+      "label": "Zero Trust Access",
       "link": {
         "type": "doc",
-        "id": "connect-your-client/connect-your-client"
+        "id": "zero-trust-access/zero-trust-access"
       },
       "items": [
         {
-          "type": "doc",
-          "label": "Introduction",
-          "id": "connect-your-client/introduction"
-        },
-        {
-          "type": "doc",
-          "label": "Using tsh",
-          "id": "connect-your-client/tsh"
-        },
-        {
-          "type": "doc",
-          "label": "Using the Web UI",
-          "id": "connect-your-client/web-ui"
-        },
-        {
-          "type": "doc",
-          "label": "Using Teleport Connect",
-          "id": "connect-your-client/teleport-connect"
-        },
-        {
-          "type": "doc",
-          "label": "Using VNet",
-          "id": "connect-your-client/vnet"
-        },
+          "type": "autogenerated",
+          "dirName": "zero-trust-access"
+        }
+      ]
+    },
+    {
+      "type": "category",
+      "label": "Machine & Workload Identity",
+      "link": {
+        "type": "doc",
+        "id": "machine-workload-identity/machine-workload-identity"
+      },
+      "items": [
         {
-          "type": "doc",
-          "label": "Using PuTTY and WinSCP",
-          "id": "connect-your-client/putty-winscp"
-        },
+          "type": "autogenerated",
+          "dirName": "machine-workload-identity"
+        }
+      ]
+    },
+    {
+      "type": "category",
+      "label": "Identity Governance",
+      "link": {
+        "type": "doc",
+        "id": "identity-governance/identity-governance"
+      },
+      "items": [
         {
-          "type": "doc",
-          "label": "Database GUI Clients",
-          "id": "connect-your-client/gui-clients"
-        },
+          "type": "autogenerated",
+          "dirName": "identity-governance"
+        }
+      ]
+    },
+    {
+      "type": "category",
+      "label": "Identity Security",
+      "link": {
+        "type": "doc",
+        "id": "identity-security/identity-security"
+      },
+      "items": [
         {
-          "type": "doc",
-          "label": "Notifications",
-          "id": "connect-your-client/notifications"
+          "type": "autogenerated",
+          "dirName": "identity-security"
         }
       ]
     },
diff --git a/docs/vale-styles/structure/architecture-h2.yml b/docs/vale-styles/structure/architecture-h2.yml
deleted file mode 100644
index 297571def5150..0000000000000
--- a/docs/vale-styles/structure/architecture-h2.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# This style enforces the presence of architectural information in how-to
-# guides. The motivation is that the architecture of the setups shown in how-to
-# guides is often a point of confusion for users.
-#
-# In this rule, the first H2 of a how-to guide must be called "How it works".
-# This style defines a how-to guide as any guide that includes at least one H2
-# beginning "Step [0-9]". 
-extends: script
-level: warning
-message: "In a how-to guide, the first H2-level section must be called `## How it works`. Use this section to include 1-3 paragraphs that describe the high-level architecture of the setup shown in the guide, i.e., which infrastructure components are involved and how they communicate. If there is already architectural information in the guide, include it in a `## How it works` section."
-scope: raw
-script: |
-  text := import("text")
-  getMatches := func() {
-    // If there is no "Step" H2, this is not a how-to guide.
-    if !text.re_match(`\n## [sS]tep [0-9]`, scope) {
-      return []
-    }
- 
-    // Find the first H2 section. If it is not called "How it works", return
-    // an error at the position of the first H2.
-    firstH2 := text.re_find(`\n## [^#\n]+\n`, scope, 1)
-    if firstH2 && firstH2[0][0].text != "\n## How it works\n" {
-      return [{
-        begin: firstH2[0][0].begin,
-        end: firstH2[0][0].end
-      }]
-    }
-  }
-
-  matches := getMatches()
-
diff --git a/docs/vale-styles/structure/intro-paragraph.yml b/docs/vale-styles/structure/intro-paragraph.yml
deleted file mode 100644
index 1c34b054b2c2a..0000000000000
--- a/docs/vale-styles/structure/intro-paragraph.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-# This style enforces the presence of an introductory paragraph before the first
-# H2 of a docs page.
-extends: script
-level: warning
-message: There must be a brief intro paragraph before the first H2-level section of a docs page. Use this to describe the purpose of the guide so a reader can determine whether they should continue reading. If the guide introduces a feature, describe the purpose and benefits of the feature. If there is already an "Introduction" H2 or similar, remove the heading.
-scope: raw
-script: |
-  text := import("text")
-  getMatches := func() {
-    docSeparators := text.re_find(`\n?---\n`, scope, 2)
-    // This is probably not a valid MDX file, but let other linters handler the
-    // error.
-    if docSeparators == undefined || len(docSeparators) != 2 {
-      return []
-    }
-
-    // Get the first H2 section
-    firstH2 := text.re_find(`\n## \w`, scope, 1)
-    if firstH2 == undefined {
-      return []
-    }
-
-    initialText := text.substr(scope, docSeparators[1][0].end,firstH2[0][0].begin)
-    // Check for at least one non-empty line before the first H2.
-    if !text.re_match(`\n[^\n]+\n`, initialText) {
-      return [{ 
-          begin: docSeparators[1][0].end,
-          end: firstH2[0][0].begin
-      }]
-    }
-
-  }
-
-  matches := getMatches()
diff --git a/docs/vale-styles/structure/step-numbering.yml b/docs/vale-styles/structure/step-numbering.yml
deleted file mode 100644
index ce5c584a84021..0000000000000
--- a/docs/vale-styles/structure/step-numbering.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-# This style enforces numbering in "## Step [0-9]+/[0-9]+" H2-level headings in
-# the docs (e.g., "Step 1/3"). It expects steps to have sequential numbering and
-# for total step counts to be equal to the actual total number of steps.
-# 
-# It is up to other vale styles to enforce other rules related to step headings,
-# such as the presence of step headings in how-to guides and the formatting of
-# step headings.
-extends: script
-level: error
-message: Guides that include H2 sections named after numbered steps (e.g., "Step 1/5") must have the expected sequence of numbers and accurate total numbers of steps. This heading either has an unexpected step number or an unexpected total number of steps.
-scope: raw
-script: |
-  text := import("text")
-  getMatches := func() {
-    // Get all sections named "Step n/d"
-    stepH2s := text.re_find(`\n## Step ([0-9]+)/([0-9]+)`, scope, -1)
-    if stepH2s == undefined {
-      return []
-    }
-
-    for i, h2 in stepH2s {
-      // Get the step number and total step count. Since this already matches the regular expression
-      // for step numbers, we know there must be one integer on either side of "/".
-      if text.atoi(h2[1].text) != i+1 || 
-        text.atoi(h2[2].text) != len(stepH2s) {
-        return [{
-          // The step number pattern begins with a newline character since the 
-          // input text is concatenated, so exclude the newline from the error
-          // for more accurate messaging.
-          begin: h2[0].begin+1,
-          end: h2[0].end
-        }]
-      }
-    }
-  }
-
-  matches := getMatches()
diff --git a/docs/vale-styles/structure/var-misuse.yml b/docs/vale-styles/structure/var-misuse.yml
deleted file mode 100644
index e83e90c5dae29..0000000000000
--- a/docs/vale-styles/structure/var-misuse.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-extends: script
-level: warning
-message: This Var is the only one with its name on this page. Var components only make sense when there are more than one with the same name.
-scope: raw
-script: |
-  text := import("text")
-
-  getMatches := func() {
-    // Find all uses of the Var component
-    varMatches := text.re_find(`<\s*Var[^>]+name=["']([^"']+)["']`, scope, -1)
-    if varMatches == undefined {
-      return []
-    }
-
-    // Assemble a map of Var names to their counts and first instances
-    varsToData := {}
-    for i, match in varMatches {
-      matchText := match[1].text
-
-      if varsToData[matchText] != undefined {
-        val := varsToData[matchText]
-        val.count++
-        varsToData[matchText] = val
-        continue
-      }
-
-      varsToData[match[1].text] = {
-        begin: match[1].begin,
-        end: match[1].end,
-        count: 1
-      }
-    }
-
-    // Find Var names that correspond to a single instance
-    matches := []
-    for k, v in varsToData {
-      if v.count == 1 {
-        matches = append(matches, {
-          begin: v.begin,
-          end: v.end
-        })
-      }
-    }
-    return matches
-  }
-
-  matches := getMatches()
diff --git a/e b/e
index e927ebe726c9b..6c75c1c53b5d4 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit e927ebe726c9b67cc8edc980cf2b6f335fae03ec
+Subproject commit 6c75c1c53b5d4d39c39c6fb314127bf1cba42250
diff --git a/e2e/aws/databases_test.go b/e2e/aws/databases_test.go
index a53636b9c4a89..36d989353d6d0 100644
--- a/e2e/aws/databases_test.go
+++ b/e2e/aws/databases_test.go
@@ -56,7 +56,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestDatabases(t *testing.T) {
@@ -338,7 +338,7 @@ func connectPostgres(t *testing.T, ctx context.Context, info dbUserLogin, dbName
 		_ = conn.Close(ctx)
 	})
 	return &pgConn{
-		logger: utils.NewSlogLoggerForTests().With("test_name", t.Name()),
+		logger: logtest.With("test_name", t.Name()),
 		Conn:   conn,
 	}
 }
diff --git a/e2e/aws/fixtures_test.go b/e2e/aws/fixtures_test.go
index 568659df8b28c..e20b981eddc3d 100644
--- a/e2e/aws/fixtures_test.go
+++ b/e2e/aws/fixtures_test.go
@@ -36,7 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // hostUser is the name of the host user used for tests.
@@ -190,7 +190,7 @@ func newInstanceConfig(t *testing.T) helpers.InstanceConfig {
 		NodeName:    host,
 		Priv:        priv,
 		Pub:         pub,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 }
 
diff --git a/e2e/aws/main_test.go b/e2e/aws/main_test.go
index ee9df7dfa21f1..a7adda214753c 100644
--- a/e2e/aws/main_test.go
+++ b/e2e/aws/main_test.go
@@ -23,7 +23,7 @@ import (
 
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const (
@@ -141,7 +141,7 @@ const (
 // TestMain will re-execute Teleport to run a command if "exec" is passed to
 // it as an argument. Otherwise, it will run tests as normal.
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	// agents connect over a reverse tunnel to proxy, so we use insecure mode.
 	lib.SetInsecureDevMode(true)
 	helpers.TestMainImplementation(m)
diff --git a/e2e/aws/rds_test.go b/e2e/aws/rds_test.go
index 04cddb0a12961..4e505a89c9421 100644
--- a/e2e/aws/rds_test.go
+++ b/e2e/aws/rds_test.go
@@ -79,10 +79,11 @@ func testRDS(t *testing.T) {
 
 	// use random names so we can test auto provisioning these users with these
 	// roles via Teleport, without tests colliding with eachother across
-	// parallel test runs.
-	autoUserFineGrain := "auto_fine_grain_" + randASCII(t)
-	autoUserKeep := "auto_keep_" + randASCII(t)
-	autoUserDrop := "auto_drop_" + randASCII(t)
+	// parallel test runs. use email addresses in some tests to test out
+	// special characters.
+	autoUserFineGrain := "auto_fine_grain_" + randASCII(t) + "@teleport.com"
+	autoUserKeep := "auto_keep_" + randASCII(t) + "@teleport.com"
+	autoUserDrop := "auto_drop_" + randASCII(t) + "@teleport.com"
 	autoUserFineGrain2 := "auto_fine_grain2_" + randASCII(t)
 	autoUserKeep2 := "auto_keep2_" + randASCII(t)
 	autoUserDrop2 := "auto_drop2_" + randASCII(t)
diff --git a/e2e/package.json b/e2e/package.json
index cae36e579faf8..cb066ed877a6b 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -8,6 +8,6 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@playwright/test": "^1.51.1"
+    "@playwright/test": "^1.55.1"
   }
 }
diff --git a/e2e/pnpm-lock.yaml b/e2e/pnpm-lock.yaml
index 36ecb1c9da03b..b178f6864d611 100644
--- a/e2e/pnpm-lock.yaml
+++ b/e2e/pnpm-lock.yaml
@@ -9,13 +9,13 @@ importers:
   .:
     devDependencies:
       '@playwright/test':
-        specifier: ^1.51.1
-        version: 1.52.0
+        specifier: ^1.55.1
+        version: 1.56.1
 
 packages:
 
-  '@playwright/test@1.52.0':
-    resolution: {integrity: sha512-uh6W7sb55hl7D6vsAeA+V2p5JnlAqzhqFyF0VcJkKZXkgnFcVG9PziERRHQfPLfNGx1C292a4JqbWzhR8L4R1g==}
+  '@playwright/test@1.56.1':
+    resolution: {integrity: sha512-vSMYtL/zOcFpvJCW71Q/OEGQb7KYBPAdKh35WNSkaZA75JlAO8ED8UN6GUNTm3drWomcbcqRPFqQbLae8yBTdg==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -24,29 +24,29 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  playwright-core@1.52.0:
-    resolution: {integrity: sha512-l2osTgLXSMeuLZOML9qYODUQoPPnUsKsb5/P6LJ2e6uPKXUdPK5WYhN4z03G+YNbWmGDY4YENauNu4ZKczreHg==}
+  playwright-core@1.56.1:
+    resolution: {integrity: sha512-hutraynyn31F+Bifme+Ps9Vq59hKuUCz7H1kDOcBs+2oGguKkWTU50bBWrtz34OUWmIwpBTWDxaRPXrIXkgvmQ==}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.52.0:
-    resolution: {integrity: sha512-JAwMNMBlxJ2oD1kce4KPtMkDeKGHQstdpFPcPH3maElAXon/QZeTvtsfXmTMRyO9TslfoYOXkSsvao2nE1ilTw==}
+  playwright@1.56.1:
+    resolution: {integrity: sha512-aFi5B0WovBHTEvpM3DzXTUaeN6eN0qWnTkKx4NQaH4Wvcmc153PdaY2UBdSYKaGYw+UyWXSVyxDUg5DoPEttjw==}
     engines: {node: '>=18'}
     hasBin: true
 
 snapshots:
 
-  '@playwright/test@1.52.0':
+  '@playwright/test@1.56.1':
     dependencies:
-      playwright: 1.52.0
+      playwright: 1.56.1
 
   fsevents@2.3.2:
     optional: true
 
-  playwright-core@1.52.0: {}
+  playwright-core@1.56.1: {}
 
-  playwright@1.52.0:
+  playwright@1.56.1:
     dependencies:
-      playwright-core: 1.52.0
+      playwright-core: 1.56.1
     optionalDependencies:
       fsevents: 2.3.2
diff --git a/e2e/web_e2e_test.go b/e2e/web_e2e_test.go
index 26df51c31a8c6..f2bd7bafc455d 100644
--- a/e2e/web_e2e_test.go
+++ b/e2e/web_e2e_test.go
@@ -28,15 +28,16 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestSignup sets up a test instance of Teleport and runs a playwright test against it to test the signup flow.
@@ -97,7 +98,7 @@ func createTeleportTestInstanceForWebTests(t *testing.T) (instance *helpers.Tele
 		ClusterName: "test-cluster",
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Host,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 		Priv:        privateKey,
 		Pub:         publicKey,
 	}
diff --git a/e_imports.go b/e_imports.go
index a3f3ca74754fd..2ae9f4fc3f64b 100644
--- a/e_imports.go
+++ b/e_imports.go
@@ -56,12 +56,19 @@ import (
 	_ "github.com/aws/aws-sdk-go-v2/credentials/stscreds"
 	_ "github.com/aws/aws-sdk-go-v2/service/athena"
 	_ "github.com/aws/aws-sdk-go-v2/service/athena/types"
+	_ "github.com/aws/aws-sdk-go-v2/service/bedrockruntime"
+	_ "github.com/aws/aws-sdk-go-v2/service/bedrockruntime/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/glue"
+	_ "github.com/aws/aws-sdk-go-v2/service/glue/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/identitystore"
 	_ "github.com/aws/aws-sdk-go-v2/service/identitystore/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/organizations"
 	_ "github.com/aws/aws-sdk-go-v2/service/organizations/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/s3"
+	_ "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	_ "github.com/aws/aws-sdk-go-v2/service/sns"
+	_ "github.com/aws/aws-sdk-go-v2/service/sqs"
+	_ "github.com/aws/aws-sdk-go-v2/service/sqs/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/ssoadmin"
 	_ "github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
 	_ "github.com/aws/aws-sdk-go-v2/service/sts/types"
@@ -73,7 +80,7 @@ import (
 	_ "github.com/ghodss/yaml"
 	_ "github.com/go-jose/go-jose/v3"
 	_ "github.com/go-jose/go-jose/v3/json"
-	_ "github.com/go-piv/piv-go/piv"
+	_ "github.com/go-piv/piv-go/v2/piv"
 	_ "github.com/gogo/protobuf/proto"
 	_ "github.com/golang-jwt/jwt/v5"
 	_ "github.com/google/go-attestation/attest"
@@ -99,9 +106,13 @@ import (
 	_ "github.com/jonboulle/clockwork"
 	_ "github.com/julienschmidt/httprouter"
 	_ "github.com/mitchellh/mapstructure"
+	_ "github.com/ohler55/ojg/jp"
 	_ "github.com/okta/okta-sdk-golang/v2/okta"
 	_ "github.com/okta/okta-sdk-golang/v2/okta/query"
+	_ "github.com/openai/openai-go"
+	_ "github.com/openai/openai-go/option"
 	_ "github.com/patrickmn/go-cache"
+	_ "github.com/pkoukk/tiktoken-go"
 	_ "github.com/pquerna/otp/totp"
 	_ "github.com/prometheus/client_golang/prometheus"
 	_ "github.com/russellhaering/gosaml2"
@@ -182,6 +193,7 @@ import (
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessgraph/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/crownjewel/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1"
@@ -199,9 +211,11 @@ import (
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/scim/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
+	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
+	_ "github.com/gravitational/teleport/api/internalutils/stream"
 	_ "github.com/gravitational/teleport/api/metadata"
 	_ "github.com/gravitational/teleport/api/mfa"
 	_ "github.com/gravitational/teleport/api/trail"
diff --git a/entitlements/entitlements.go b/entitlements/entitlements.go
index 4f06af8959aa5..d9cc9ebe71fe8 100644
--- a/entitlements/entitlements.go
+++ b/entitlements/entitlements.go
@@ -53,6 +53,7 @@ const (
 	UsageReporting             EntitlementKind = "UsageReporting"
 	LicenseAutoUpdate          EntitlementKind = "LicenseAutoUpdate"
 	AccessGraphDemoMode        EntitlementKind = "AccessGraphDemoMode"
+	ClientIPRestrictions       EntitlementKind = "ClientIPRestrictions"
 )
 
 // AllEntitlements returns all Entitlements; should be 1:1 with the const declared above.
@@ -60,6 +61,7 @@ var AllEntitlements = []EntitlementKind{
 	AccessLists, AccessMonitoring, AccessRequests, App, CloudAuditLogRetention, DB, Desktop, DeviceTrust,
 	ExternalAuditStorage, FeatureHiding, HSM, Identity, JoinActiveSessions, K8s, MobileDeviceManagement, OIDC, OktaSCIM,
 	OktaUserSync, Policy, SAML, SessionLocks, UnrestrictedManagedUpdates, UpsellAlert, UsageReporting, LicenseAutoUpdate, AccessGraphDemoMode,
+	ClientIPRestrictions,
 }
 
 // BackfillFeatures ensures entitlements are backwards compatible.
diff --git a/entitlements/entitlements_test.go b/entitlements/entitlements_test.go
index ac90e4a8b1e29..dca2788c18207 100644
--- a/entitlements/entitlements_test.go
+++ b/entitlements/entitlements_test.go
@@ -93,6 +93,7 @@ func TestBackfillFeatures(t *testing.T) {
 					string(LicenseAutoUpdate):          {Enabled: true},
 					string(AccessGraphDemoMode):        {Enabled: true},
 					string(UnrestrictedManagedUpdates): {Enabled: true},
+					string(ClientIPRestrictions):       {Enabled: true},
 				},
 			},
 			expected: map[string]*proto.EntitlementInfo{
@@ -122,6 +123,7 @@ func TestBackfillFeatures(t *testing.T) {
 				string(LicenseAutoUpdate):          {Enabled: true},
 				string(AccessGraphDemoMode):        {Enabled: true},
 				string(UnrestrictedManagedUpdates): {Enabled: true},
+				string(ClientIPRestrictions):       {Enabled: true},
 			},
 		},
 		{
@@ -200,6 +202,7 @@ func TestBackfillFeatures(t *testing.T) {
 				string(LicenseAutoUpdate):          {Enabled: false},
 				string(AccessGraphDemoMode):        {Enabled: false},
 				string(UnrestrictedManagedUpdates): {Enabled: false},
+				string(ClientIPRestrictions):       {Enabled: false},
 			},
 		},
 		{
@@ -275,6 +278,7 @@ func TestBackfillFeatures(t *testing.T) {
 				string(LicenseAutoUpdate):          {Enabled: false},
 				string(AccessGraphDemoMode):        {Enabled: false},
 				string(UnrestrictedManagedUpdates): {Enabled: false},
+				string(ClientIPRestrictions):       {Enabled: false},
 				// Identity off, fields false
 				string(Identity):     {Enabled: false},
 				string(SessionLocks): {Enabled: false},
diff --git a/examples/access-plugin-minimal/go.mod b/examples/access-plugin-minimal/go.mod
index 084abffe3b8fa..52dbbae9885c2 100644
--- a/examples/access-plugin-minimal/go.mod
+++ b/examples/access-plugin-minimal/go.mod
@@ -1,59 +1,58 @@
 module teleport-sheets
 
-go 1.23.0
+go 1.24.11
 
 require (
-	github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40
-	github.com/gravitational/trace v1.3.1
+	github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707
+	github.com/gravitational/trace v1.5.1
 	google.golang.org/api v0.149.0
-	google.golang.org/grpc v1.61.1
+	google.golang.org/grpc v1.73.0
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.3.0 // indirect
-	github.com/beevik/etree v1.2.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	github.com/beevik/etree v1.5.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.3.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.3.2 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/russellhaering/gosaml2 v0.9.1 // indirect
-	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
-	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
diff --git a/examples/access-plugin-minimal/go.sum b/examples/access-plugin-minimal/go.sum
index 7cd010cc50d5f..4a2f076a40be8 100644
--- a/examples/access-plugin-minimal/go.sum
+++ b/examples/access-plugin-minimal/go.sum
@@ -1,55 +1,40 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
-github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/beevik/etree v1.5.0 h1:iaQZFSDS+3kYZiGoc9uKeOkUY3nYMXOKLl6KIJxiJWs=
+github.com/beevik/etree v1.5.0/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.3.0 h1:kKkrYlgLQTMPA6BiSL25A7/x4CEh2YCG7rtb/aTkx+g=
+github.com/go-piv/piv-go/v2 v2.3.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
-github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -59,27 +44,23 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4er
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -89,161 +70,113 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfF
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40 h1:fehEGHkaAJrxMtBla0boubs9ZamPO+wcSWEUjr7eEmI=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40/go.mod h1:aBBajLLEwtcb/iKA9JNSq+WyKMiNp93837yQgNnUuJ8=
-github.com/gravitational/trace v1.3.1 h1:jwZEuRtCYpLhUtqHo+JH+lu2qM0LB98UagqHtvdKuLI=
-github.com/gravitational/trace v1.3.1/go.mod h1:E61mn73aro7Zg9gZheZaeUsK6gjUMbCLazY76xuYAVA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707 h1:IKMvcBI53M7H3j9G3ZJCqVzCZ0sQrK83h/lRgHFNESk=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707/go.mod h1:tGFGcp5agfdWDorAqy9sdEVZ5FZbngYMW5s/NWFTc6I=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
-github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
-github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
-github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 h1:9M3+rhx7kZCIQQhQRYaZCdNu1V73tm4TvXs2ntl98C4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0/go.mod h1:noq80iT8rrHP1SfybmPiRGc9dc5M8RPmGvtwo7Oo7tc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 h1:H2JFgRcGiyHg7H7bwcwaQJYrNFqCqrbTQ8K4p1OvDu8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0/go.mod h1:WfCWp1bGoYK8MeULtI15MmQVczfR+bFkk0DF3h06QmQ=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
-go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -252,8 +185,6 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -264,24 +195,18 @@ google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9Ywl
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
+google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -291,21 +216,14 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/examples/api-sync-roles/go.mod b/examples/api-sync-roles/go.mod
index 132d54a2419c5..8055c167d043d 100644
--- a/examples/api-sync-roles/go.mod
+++ b/examples/api-sync-roles/go.mod
@@ -1,80 +1,84 @@
 module sync-roles
 
-go 1.23.0
+go 1.24.11
 
 require (
-	github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40
-	github.com/gravitational/trace v1.3.1
-	google.golang.org/grpc v1.61.1
-	k8s.io/api v0.27.2
-	k8s.io/apimachinery v0.27.2
-	k8s.io/client-go v0.27.2
+	github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707
+	github.com/gravitational/trace v1.5.1
+	google.golang.org/grpc v1.74.2
+	k8s.io/api v0.32.3
+	k8s.io/apimachinery v0.32.3
+	k8s.io/client-go v0.32.3
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.3.0 // indirect
-	github.com/beevik/etree v1.2.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/beevik/etree v1.5.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.1 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.3.2 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic v0.5.7-v3refs // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
-	github.com/imdario/mergo v0.3.6 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/russellhaering/gosaml2 v0.9.1 // indirect
-	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
-	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/klog/v2 v2.90.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
-	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250701173324-9bd5c66d9911 // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/examples/api-sync-roles/go.sum b/examples/api-sync-roles/go.sum
index 6f1d86ada9dee..142e385aa8dc0 100644
--- a/examples/api-sync-roles/go.sum
+++ b/examples/api-sync-roles/go.sum
@@ -1,135 +1,78 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
-github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
+github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
-github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8=
-github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
-github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40 h1:fehEGHkaAJrxMtBla0boubs9ZamPO+wcSWEUjr7eEmI=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40/go.mod h1:aBBajLLEwtcb/iKA9JNSq+WyKMiNp93837yQgNnUuJ8=
-github.com/gravitational/trace v1.3.1 h1:jwZEuRtCYpLhUtqHo+JH+lu2qM0LB98UagqHtvdKuLI=
-github.com/gravitational/trace v1.3.1/go.mod h1:E61mn73aro7Zg9gZheZaeUsK6gjUMbCLazY76xuYAVA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
-github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707 h1:IKMvcBI53M7H3j9G3ZJCqVzCZ0sQrK83h/lRgHFNESk=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707/go.mod h1:tGFGcp5agfdWDorAqy9sdEVZ5FZbngYMW5s/NWFTc6I=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -139,229 +82,139 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.9.1 h1:zie5Ly042PD3bsCvsSOPvRnFwyo3rKe64TJlD6nu0mk=
-github.com/onsi/ginkgo/v2 v2.9.1/go.mod h1:FEcmzVcCHl+4o9bQZVab+4dC9+j+91t2FHSzmGAPfuo=
-github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E=
-github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
-github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
-github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
-github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 h1:9M3+rhx7kZCIQQhQRYaZCdNu1V73tm4TvXs2ntl98C4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0/go.mod h1:noq80iT8rrHP1SfybmPiRGc9dc5M8RPmGvtwo7Oo7tc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 h1:H2JFgRcGiyHg7H7bwcwaQJYrNFqCqrbTQ8K4p1OvDu8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0/go.mod h1:WfCWp1bGoYK8MeULtI15MmQVczfR+bFkk0DF3h06QmQ=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
-go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.27.2 h1:+H17AJpUMvl+clT+BPnKf0E3ksMAzoBBg7CntpSuADo=
-k8s.io/api v0.27.2/go.mod h1:ENmbocXfBT2ADujUXcBhHV55RIT31IIEvkntP6vZKS4=
-k8s.io/apimachinery v0.27.2 h1:vBjGaKKieaIreI+oQwELalVG4d8f3YAMNpWLzDXkxeg=
-k8s.io/apimachinery v0.27.2/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
-k8s.io/client-go v0.27.2 h1:vDLSeuYvCHKeoQRhCXjxXO45nHVv2Ip4Fe0MfioMrhE=
-k8s.io/client-go v0.27.2/go.mod h1:tY0gVmUsHrAmjzHX9zs7eCjxcBsf8IiNe7KQ52biTcQ=
-k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
-k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
-k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+k8s.io/api v0.32.3 h1:Hw7KqxRusq+6QSplE3NYG4MBxZw1BZnq4aP4cJVINls=
+k8s.io/api v0.32.3/go.mod h1:2wEDTXADtm/HA7CCMD8D8bK4yuBUptzaRhYcYEEYA3k=
+k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
+k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
+k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250701173324-9bd5c66d9911 h1:gAXU86Fmbr/ktY17lkHwSjw5aoThQvhnstGGIYKlKYc=
+k8s.io/kube-openapi v0.0.0-20250701173324-9bd5c66d9911/go.mod h1:GLOk5B+hDbRROvt0X2+hqX64v/zO3vXN7J78OUmBSKw=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/examples/aws/terraform/ecs-agent/main.tf b/examples/aws/terraform/ecs-agent/main.tf
new file mode 100644
index 0000000000000..2795bbd489e7d
--- /dev/null
+++ b/examples/aws/terraform/ecs-agent/main.tf
@@ -0,0 +1,122 @@
+data "aws_caller_identity" "current" {}
+
+resource "aws_ecs_cluster" "teleport_ecs_cluster" {
+  name = var.ecs_cluster
+}
+
+resource "aws_iam_role" "ecs_teleport_agent_executionrole" {
+  name = var.ecs_executionrole
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ecs-tasks.amazonaws.com"
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "ecs_teleport_agent_executionrole_logs" {
+  name = "WriteLogsToCloudWatch"
+  role = aws_iam_role.ecs_teleport_agent_executionrole.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+          "logs:CreateLogGroup",
+        ]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role" "ecs_teleport_agent_taskrole" {
+  name = var.ecs_taskrole
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ecs-tasks.amazonaws.com"
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "ecs_teleport_agent_taskrole" {
+  name   = "ECSGuideAgentAPIAccess"
+  role   = aws_iam_role.ecs_teleport_agent_taskrole.id
+  policy = jsonencode(var.ecs_taskrole_policy)
+}
+
+// get teleport version from teleport cluster endpoint
+data "http" "teleport_version" {
+  url = "https://${var.teleport_proxy_server}/v1/webapi/automaticupgrades/channel/default/version"
+}
+locals {
+  teleport_image = format("public.ecr.aws/gravitational/teleport-ent-distroless:%s",
+    trimprefix(data.http.teleport_version.response_body, "v")
+  )
+}
+
+resource "aws_ecs_task_definition" "teleport_agent_task" {
+  family                   = var.teleport_task_family
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "2048"
+  memory                   = "4096"
+  network_mode             = "awsvpc"
+  task_role_arn            = aws_iam_role.ecs_teleport_agent_taskrole.arn
+  execution_role_arn       = aws_iam_role.ecs_teleport_agent_executionrole.arn
+  container_definitions = jsonencode([
+    {
+      name       = "agent"
+      image      = local.teleport_image
+      entryPoint = ["/usr/bin/dumb-init"]
+      command = [
+        "--rewrite",
+        "15:3",
+        "--",
+        "teleport",
+        "start",
+        "--config-string",
+        base64encode(yamlencode(var.teleport_agent_config))
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = format("ecs-%s", aws_ecs_cluster.teleport_ecs_cluster.name)
+          "awslogs-region"        = var.aws_region
+          "awslogs-stream-prefix" = "teleport-agent-services"
+          "awslogs-create-group"  = "true"
+        }
+      }
+    }
+  ])
+}
+
+resource "aws_ecs_service" "teleport_agent" {
+  name            = "teleport-agent"
+  desired_count   = 2
+  launch_type     = "FARGATE"
+  task_definition = aws_ecs_task_definition.teleport_agent_task.arn
+  cluster         = aws_ecs_cluster.teleport_ecs_cluster.id
+
+  network_configuration {
+    subnets          = var.teleport_agent_subnets
+    security_groups  = var.teleport_agent_security_groups
+    assign_public_ip = true
+  }
+}
\ No newline at end of file
diff --git a/examples/aws/terraform/ecs-agent/providers.tf b/examples/aws/terraform/ecs-agent/providers.tf
new file mode 100644
index 0000000000000..68feb340c230a
--- /dev/null
+++ b/examples/aws/terraform/ecs-agent/providers.tf
@@ -0,0 +1,15 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+  default_tags {
+    tags = var.default_tags
+  }
+}
\ No newline at end of file
diff --git a/examples/aws/terraform/ecs-agent/variables.tf b/examples/aws/terraform/ecs-agent/variables.tf
new file mode 100644
index 0000000000000..1b9f3c7f4ce29
--- /dev/null
+++ b/examples/aws/terraform/ecs-agent/variables.tf
@@ -0,0 +1,61 @@
+variable "teleport_proxy_server" {
+  type = string
+  validation {
+    condition     = can(regex("^[a-zA-Z0-9.-]+:[0-9]+$", var.teleport_proxy_server))
+    error_message = "The teleport_proxy_server must be in the format 'hostname:port'."
+  }
+  description = "The Teleport Proxy server address. Example: tenant.teleport.sh:443"
+}
+
+variable "aws_region" {
+  type        = string
+  description = "The AWS region where the Teleport agent will be deployed."
+}
+
+variable "ecs_cluster" {
+  type        = string
+  description = "The AWS ECS cluster name where Teleport agent will run."
+}
+
+variable "ecs_taskrole" {
+  type        = string
+  default     = "teleport_ecs_agent_taskrole"
+  description = "The IAM role for the ECS task that allows it to interact with AWS APIs."
+}
+
+variable "ecs_taskrole_policy" {
+  type        = any
+  description = "The policy assigned to the IAM Role passed to the Teleport Agent."
+}
+
+variable "ecs_executionrole" {
+  type        = string
+  default     = "teleport_ecs_agent_executionrole"
+  description = "The IAM role for the ECS agent to assume, only needed to write process logs into CloudWatch."
+}
+
+variable "teleport_agent_subnets" {
+  type        = list(string)
+  description = "The subnets where the Teleport Agent runs. Must allow access to: teleport cluster, teleport container registry and any private resource (e.g., EKS, RDS) to proxy."
+}
+
+variable "teleport_agent_security_groups" {
+  type        = list(string)
+  description = "The security groups for the Teleport Agent. Must have access to: teleport cluster, teleport container registry and any private resource (e.g., EKS, RDS) to proxy."
+}
+
+variable "default_tags" {
+  type        = map(string)
+  description = "Default tags to apply to all resources created by this Terraform configuration."
+}
+
+variable "teleport_task_family" {
+  type        = string
+  default     = "teleport-ecs-agent"
+  description = "The ECS task definition family name."
+}
+
+variable "teleport_agent_config" {
+  type        = any
+  description = "The Teleport Agent configuration. Write the configuration using native Terraform syntax."
+}
diff --git a/examples/aws/terraform/ha-autoscale-cluster/Makefile b/examples/aws/terraform/ha-autoscale-cluster/Makefile
index 725fdc318c90c..76022ef2c28f4 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/Makefile
+++ b/examples/aws/terraform/ha-autoscale-cluster/Makefile
@@ -9,7 +9,7 @@ TF_VAR_cluster_name ?=
 # AWS SSH key name to provision in installed instances, should be available in the region
 TF_VAR_key_name ?=
 
-# Full absolute path to the license file for Teleport Enterprise 
+# Full absolute path to the license file for Teleport Enterprise
 # This license will be copied into SSM and then pulled down on the auth nodes to enable Enterprise functionality
 TF_VAR_license_path ?=
 
@@ -18,7 +18,7 @@ TF_VAR_license_path ?=
 # To list available AMIs:
 # OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
 # Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
-# FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
+# FIPS images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
 TF_VAR_ami_name ?=
 
 
diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md
index 968cae771ad62..60e41043ca117 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/README.md
+++ b/examples/aws/terraform/ha-autoscale-cluster/README.md
@@ -45,7 +45,7 @@ export TF_VAR_cluster_name="teleport.example.com"
 # To list available AMIs:
 # OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
 # Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
-# FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
+# FIPS images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
 export TF_VAR_ami_name="teleport-ent-17.4.8-arm64"
 
 # Instance types used for authentication server auto scaling group
diff --git a/examples/aws/terraform/starter-cluster/README.md b/examples/aws/terraform/starter-cluster/README.md
index d472fe2c9cf0e..b5dad8396d586 100644
--- a/examples/aws/terraform/starter-cluster/README.md
+++ b/examples/aws/terraform/starter-cluster/README.md
@@ -97,7 +97,7 @@ TF_VAR_license_path ?= "/path/to/license"
 # To list available AMIs:
 # OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*'
 # Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*'
-# FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
+# FIPS images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
 TF_VAR_ami_name ?= "teleport-ent-17.4.8-arm64"
 
 # Route 53 hosted zone to use, must be a root zone registered in AWS, e.g. example.com
diff --git a/examples/chart/.lint-config.yaml b/examples/chart/.lint-config.yaml
index df72f34581845..d8049b35bb9ad 100644
--- a/examples/chart/.lint-config.yaml
+++ b/examples/chart/.lint-config.yaml
@@ -5,3 +5,8 @@ rules:
     min-spaces-after: 0
   line-length:
     max: 120
+  indentation:
+    # helm's toYaml template function adds zero indentation to arrays but we
+    # generally add it in our manual templates; "whatever" means that any
+    # indentation level is fine (as long as it's the same within the same array)
+    indent-sequences: whatever
diff --git a/examples/chart/Makefile b/examples/chart/Makefile
index 017864ae573b5..3f9192988edf5 100644
--- a/examples/chart/Makefile
+++ b/examples/chart/Makefile
@@ -7,7 +7,7 @@ check_access = $(addprefix check-chart-ref-access-,$(access))
 render_access = $(addprefix render-chart-ref-access-,$(access))
 
 .PHONY: render-chart-ref
-render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-tbot $(render_access)  # render-chart-ref-teleport-cluster
+render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-teleport-relay render-chart-ref-tbot $(render_access) render-chart-ref-event-handler # render-chart-ref-teleport-cluster
 
 .PHONY: render-chart-ref-example
 render-chart-ref-example:
@@ -25,6 +25,11 @@ render-chart-ref-teleport-kube-agent:
 	cd ../../build.assets/tooling && \
 	go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
 
+.PHONY: render-chart-ref-teleport-relay
+render-chart-ref-teleport-relay:
+	cd ../../build.assets/tooling && \
+	go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx
+
 .PHONY: render-chart-ref-teleport-operator
 render-chart-ref-teleport-operator:
 	cd ../../build.assets/tooling && \
@@ -40,8 +45,13 @@ render-chart-ref-access-%:
 	cd ../../build.assets/tooling && \
 	go run ./cmd/render-helm-ref -chart ../../examples/chart/access/$* -output ../../docs/pages/includes/helm-reference/zz_generated.access-$*.mdx
 
+.PHONY: render-chart-ref-event-handler
+render-chart-ref-event-handler:
+	cd ../../build.assets/tooling && \
+	go run ./cmd/render-helm-ref -chart ../../examples/chart/event-handler -output ../../docs/pages/includes/helm-reference/zz_generated.event-handler.mdx
+
 .PHONY: check-chart-ref
-check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-tbot $(check_access) #check-chart-ref-teleport-cluster
+check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-teleport-relay check-chart-ref-tbot $(check_access) check-chart-ref-event-handler #check-chart-ref-teleport-cluster
 
 .PHONY: check-chart-ref-example
 check-chart-ref-example:
@@ -64,6 +74,13 @@ check-chart-ref-teleport-kube-agent:
 	go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx - || \
 	( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
 
+.PHONY: check-chart-ref-teleport-relay
+check-chart-ref-teleport-relay:
+	@ echo "Checking teleport-relay reference"
+	@ cd ../../build.assets/tooling && \
+	GOWORK=off go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx - || \
+	( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
+
 .PHONY: check-chart-ref-teleport-operator
 check-chart-ref-teleport-operator:
 	@echo "Checking teleport-operator reference"
@@ -84,3 +101,10 @@ check-chart-ref-access-%:
 	@ cd ../../build.assets/tooling && \
 	go run ./cmd/render-helm-ref -chart ../../examples/chart/access/$* -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.access-$*.mdx - || \
 	( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
+
+.PHONY: check-chart-ref-event-handler
+check-chart-ref-event-handler:
+	@echo "Checking event-handler reference"
+	@ cd ../../build.assets/tooling && \
+	go run ./cmd/render-helm-ref -chart ../../examples/chart/event-handler -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.event-handler.mdx - || \
+	( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
diff --git a/examples/chart/access/datadog/Chart.yaml b/examples/chart/access/datadog/Chart.yaml
index 780b08f38eb06..c20832835b5e4 100644
--- a/examples/chart/access/datadog/Chart.yaml
+++ b/examples/chart/access/datadog/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-datadog
diff --git a/examples/chart/access/datadog/templates/_helpers.tpl b/examples/chart/access/datadog/templates/_helpers.tpl
index 86e3fb5b1f677..096d7f586e950 100644
--- a/examples/chart/access/datadog/templates/_helpers.tpl
+++ b/examples/chart/access/datadog/templates/_helpers.tpl
@@ -61,6 +61,9 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
 {{- define "datadog.identitySecretName" -}}
 {{- if .Values.teleport.identitySecretName -}}
 {{- .Values.teleport.identitySecretName -}}
@@ -76,7 +79,3 @@ identity
 {{- .Values.teleport.identitySecretPath -}}
 {{- end -}}
 {{- end -}}
-
-{{- define "datadog.teleportAddress" -}}
-
-{{- end -}}
diff --git a/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap
index 4c0e2f9ccf058..df9b32b3b801f 100644
--- a/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap
@@ -26,6 +26,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-datadog
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-datadog-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-datadog-18.6.1
       name: RELEASE-NAME-teleport-plugin-datadog
diff --git a/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap
index 90fca5a21d942..0468053714ded 100644
--- a/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-datadog
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-datadog-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-datadog-18.6.1
       name: RELEASE-NAME-teleport-plugin-datadog
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-datadog
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-datadog-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-datadog-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/datadog/values.yaml b/examples/chart/access/datadog/values.yaml
index 9c92af3397917..88e7446f881d3 100644
--- a/examples/chart/access/datadog/values.yaml
+++ b/examples/chart/access/datadog/values.yaml
@@ -33,7 +33,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Datadog Incident Management](../../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) guide
+  # Datadog Incident Management](../../identity-governance/access-requests/plugins/datadog-hosted.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -134,7 +134,7 @@ tbot:
   teleportAuthAddress: ""
 
   # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
-  # See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
   joinMethod: "kubernetes"
   token: ""
 
diff --git a/examples/chart/access/discord/Chart.yaml b/examples/chart/access/discord/Chart.yaml
index 1dd61c72910d9..a9b3f3d674ec8 100644
--- a/examples/chart/access/discord/Chart.yaml
+++ b/examples/chart/access/discord/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-discord
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport Discord Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/discord/README.md b/examples/chart/access/discord/README.md
index b83c7ba74f5dd..f8feea4b3eb3c 100644
--- a/examples/chart/access/discord/README.md
+++ b/examples/chart/access/discord/README.md
@@ -7,95 +7,6 @@ This chart sets up and configures a Deployment for the Access Request Discord pl
 See the [Access Requests with Discord guide](https://goteleport.com/docs/admin-guides/access-controls/access-request-plugins/ssh-approval-discord/)
 which covers how to create the Discord bot and how to deploy the access plugin.
 
-## Settings
+## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>discord.token</code></td>
-    <td>Discord API token</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>discord.tokenFromSecret</code></td>
-    <td>Kubernetes secret to read the token from instead of <code>discord.token</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>discord.tokenSecretPath</code></td>
-    <td>The path of the token in the secret described by <code>discord.tokenFromSecret</code></td>
-    <td>string</td>
-    <td><code>"discordToken"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>roleToRecipients</code></td>
-    <td>
-      Mapping of roles to a list of Discord channel IDs. <br />
-      Example:
-      <pre>
-"dev" = ["0987654321", "1234567890"]
-"*" = ["1234567890"]</pre>
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/discord.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-discord Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-discord/) for available Helm Chart configuration.
diff --git a/examples/chart/access/discord/charts/tbot b/examples/chart/access/discord/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/discord/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/discord/templates/_helpers.tpl b/examples/chart/access/discord/templates/_helpers.tpl
index 7410b7167af27..bbeeb815dc938 100644
--- a/examples/chart/access/discord/templates/_helpers.tpl
+++ b/examples/chart/access/discord/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "discord.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "discord.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/discord/templates/configmap.yaml b/examples/chart/access/discord/templates/configmap.yaml
index 4d953c25b6029..9ce7d1d11b4cb 100644
--- a/examples/chart/access/discord/templates/configmap.yaml
+++ b/examples/chart/access/discord/templates/configmap.yaml
@@ -11,8 +11,8 @@ metadata:
 data:
   teleport-discord.toml: |
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/discord/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/discord/teleport-identity/{{ include "discord.identitySecretPath" . }}"
     refresh_identity = true
 
     [discord]
diff --git a/examples/chart/access/discord/templates/deployment.yaml b/examples/chart/access/discord/templates/deployment.yaml
index 674decf24ed43..8f553632c04e0 100644
--- a/examples/chart/access/discord/templates/deployment.yaml
+++ b/examples/chart/access/discord/templates/deployment.yaml
@@ -72,7 +72,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "discord.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: {{ .Values.secretVolumeName }}
           secret:
diff --git a/examples/chart/access/discord/templates/secret.yaml b/examples/chart/access/discord/templates/secret.yaml
index 50bcde7851049..eebfa60ecc2bb 100644
--- a/examples/chart/access/discord/templates/secret.yaml
+++ b/examples/chart/access/discord/templates/secret.yaml
@@ -9,5 +9,5 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
-   discordToken: {{ .Values.discord.token | b64enc }}
+  discordToken: {{ .Values.discord.token | b64enc }}
 {{- end }}
diff --git a/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap
index 743646baa06b0..fb99215ed2650 100644
--- a/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap
@@ -24,6 +24,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-discord
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-discord-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-discord-18.6.1
       name: RELEASE-NAME-teleport-plugin-discord
diff --git a/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap
index cf255389b1d94..313adeb4cb530 100644
--- a/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-discord
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-discord-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-discord-18.6.1
       name: RELEASE-NAME-teleport-plugin-discord
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-discord
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-discord-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-discord-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/discord/values.yaml b/examples/chart/access/discord/values.yaml
index 86dae5d87d5f6..f8ba037d4ab54 100644
--- a/examples/chart/access/discord/values.yaml
+++ b/examples/chart/access/discord/values.yaml
@@ -13,6 +13,8 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +32,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Discord](../../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) guide
+  # Discord](../../identity-governance/access-requests/plugins/discord.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -90,6 +92,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the Discord plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the Discord plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 
 # annotations -- contains annotations to apply to the different Kubernetes
diff --git a/examples/chart/access/email/Chart.yaml b/examples/chart/access/email/Chart.yaml
index 0f661981e882a..1d8e6c0573d92 100644
--- a/examples/chart/access/email/Chart.yaml
+++ b/examples/chart/access/email/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-email
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport Email Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/email/README.md b/examples/chart/access/email/README.md
index 9970f1845e92a..e571a1a0714fa 100644
--- a/examples/chart/access/email/README.md
+++ b/examples/chart/access/email/README.md
@@ -8,185 +8,4 @@ See the [Access Requests with Email guide](https://goteleport.com/docs/admin-gui
 
 ## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>mailgun.enabled</code></td>
-    <td>
-      Specifies if the Mailgun integration should be enabled. Mutually exclusive with <code>smtp.enabled</code>.
-      In the case of both values are set to true, <code>mailgun.enabled</code> will take precedence.
-    </td>
-    <td>boolean</td>
-    <td><code>false</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mailgun.domain</code></td>
-    <td>Domain name of the Mailgun instance</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mailgun.privateKey</code></td>
-    <td>Private key for accessing the Mailgun instance</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mailgun.privateKeyFromSecret</code></td>
-    <td>Kubernetes secret to read the private key from instead of using <code>mailgun.privateKey</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mailgun.privateKeySecretPath</code></td>
-    <td>The path of the private key in the secret described by <code>mailgun.privateKeyFromSecret</code></td>
-    <td>string</td>
-    <td><code>"mailgunPrivateKey"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>smtp.enabled</code></td>
-    <td>
-      Specifies if the MailSMTPgun integration should be enabled. Mutually exclusive with <code>mailgun.enabled</code>.
-      In the case of both values are set to true, <code>mailgun.enabled</code> will take precedence.
-    </td>
-    <td>boolean</td>
-    <td><code>false</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.host</code></td>
-    <td>SMTP host.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.port</code></td>
-    <td>Port of the SMTP server.</td>
-    <td>integer</td>
-    <td><code>587</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.username</code></td>
-    <td>Username to be used with the SMTP server.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.password</code></td>
-    <td>Password to be used with the SMTP server. Mutually exclusive with <code>smtp.passwordFile</code>.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.passwordFromSecret</code></td>
-    <td>Kubernetes secret to read the SMTP password from instead of using <code>smtp.password</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.passwordSecretPath</code></td>
-    <td>The path of the SMTP password in the secret described by <code>smtp.passwordFromSecret</code></td>
-    <td>string</td>
-    <td><code>"smtpPassword"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>smtp.starttlsPolicy</code></td>
-    <td>Which policy to use for secure communications: mandatory, opportunistic or disabled.</td>
-    <td>string</td>
-    <td><code>"mandatory"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>delivery.sender</code></td>
-    <td>Email address to be used in the <code>From</code> field of the emails.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>delivery.recipients</code></td>
-    <td>Array of the recipients the plugin should send emails.</td>
-    <td>array</td>
-    <td><code>[]</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>roleToRecipients</code></td>
-    <td>
-      Mapping of roles to a list of emails. <br />
-      Example:
-      <pre>
-"dev" = ["developers@example.com", "user@example.com"]
-"*" = ["access-requests"]</pre>
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/email.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-email Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-email/) for available Helm Chart configuration.
diff --git a/examples/chart/access/email/charts/tbot b/examples/chart/access/email/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/email/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/email/templates/_helpers.tpl b/examples/chart/access/email/templates/_helpers.tpl
index 9742d31eb80c8..f3bc4f88bb515 100644
--- a/examples/chart/access/email/templates/_helpers.tpl
+++ b/examples/chart/access/email/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "email.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "email.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/email/templates/configmap.yaml b/examples/chart/access/email/templates/configmap.yaml
index e62fad3c76731..ce263faa24d12 100644
--- a/examples/chart/access/email/templates/configmap.yaml
+++ b/examples/chart/access/email/templates/configmap.yaml
@@ -11,8 +11,8 @@ metadata:
 data:
   teleport-email.toml: |
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/email/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/email/teleport-identity/{{ include "email.identitySecretPath" . }}"
     refresh_identity = true
 
     {{ if .Values.mailgun.enabled -}}
diff --git a/examples/chart/access/email/templates/deployment.yaml b/examples/chart/access/email/templates/deployment.yaml
index 76feb4eab2124..2d224460502a6 100644
--- a/examples/chart/access/email/templates/deployment.yaml
+++ b/examples/chart/access/email/templates/deployment.yaml
@@ -87,7 +87,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "email.identitySecretName" . | quote }}
             defaultMode: 0600
         {{- if or .Values.smtp.enabled .Values.mailgun.enabled }}
         {{- if .Values.smtp.enabled }}
diff --git a/examples/chart/access/email/templates/secret.yaml b/examples/chart/access/email/templates/secret.yaml
index c8c8005e864ab..3bfe9b15a3016 100644
--- a/examples/chart/access/email/templates/secret.yaml
+++ b/examples/chart/access/email/templates/secret.yaml
@@ -1,5 +1,5 @@
 {{- if or (and .Values.mailgun.enabled (not .Values.mailgun.privateKeyFromSecret))
-         (and .Values.smtp.enabled (not .Values.smtp.passwordFromSecret)) -}}
+          (and .Values.smtp.enabled (not .Values.smtp.passwordFromSecret)) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
diff --git a/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap
index 7e8b22428edd0..e12eb224233aa 100644
--- a/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap
@@ -26,8 +26,8 @@ should match the snapshot (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on):
   1: |
@@ -59,8 +59,8 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, no starttls):
   1: |
@@ -92,8 +92,8 @@ should match the snapshot (smtp on, no starttls):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, password file):
   1: |
@@ -125,8 +125,8 @@ should match the snapshot (smtp on, password file):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, roleToRecipients set):
   1: |
@@ -161,8 +161,8 @@ should match the snapshot (smtp on, roleToRecipients set):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, starttls disabled):
   1: |
@@ -194,6 +194,6 @@ should match the snapshot (smtp on, starttls disabled):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
diff --git a/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap
index a00d0d6644629..24218a1300000 100644
--- a/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should be possible to override volume name (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should be possible to override volume name (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -34,7 +34,7 @@ should be possible to override volume name (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-email:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -75,8 +75,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -90,8 +90,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -136,8 +136,8 @@ should match the snapshot (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -151,8 +151,8 @@ should match the snapshot (mailgun on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -163,7 +163,7 @@ should match the snapshot (mailgun on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-email:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -204,8 +204,8 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -219,8 +219,8 @@ should match the snapshot (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -231,7 +231,7 @@ should match the snapshot (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-email:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -272,8 +272,8 @@ should mount external secret (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -287,8 +287,8 @@ should mount external secret (mailgun on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -299,7 +299,7 @@ should mount external secret (mailgun on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-email:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -340,8 +340,8 @@ should mount external secret (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-email-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-email-18.6.1
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -355,8 +355,8 @@ should mount external secret (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-email-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-email-18.6.1
         spec:
           containers:
           - command:
@@ -367,7 +367,7 @@ should mount external secret (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-email:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
diff --git a/examples/chart/access/email/values.yaml b/examples/chart/access/email/values.yaml
index afad04dba3d98..b1882f45ff6cc 100644
--- a/examples/chart/access/email/values.yaml
+++ b/examples/chart/access/email/values.yaml
@@ -13,6 +13,8 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +32,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Email](../../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) guide
+  # Email](../../identity-governance/access-requests/plugins/email.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -136,6 +138,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the mail plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the mail plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 
 # annotations -- contains annotations to apply to the different Kubernetes
diff --git a/examples/chart/access/jira/Chart.yaml b/examples/chart/access/jira/Chart.yaml
index 7efa93cb9eb86..c9d8fdffacccf 100644
--- a/examples/chart/access/jira/Chart.yaml
+++ b/examples/chart/access/jira/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-jira
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport Jira Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/jira/README.md b/examples/chart/access/jira/README.md
index 9d3227deae322..ff51aba8f7a66 100644
--- a/examples/chart/access/jira/README.md
+++ b/examples/chart/access/jira/README.md
@@ -8,147 +8,4 @@ See the [Access Requests with JIRA guide](https://goteleport.com/docs/access-con
 
 ## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>chartMode</code></td>
-    <td>
-      When set to <code>"aws"</code>, it'll add the proper annotations to the created service
-      to ensure the AWS LoadBalancer is set up properly. Additional annotations can be added
-      using <code>serviceAnnotations</code>.
-    </td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>jira.url</code></td>
-    <td>URL of the Jira server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>jira.username</code></td>
-    <td>Username of the bot user in Jira to use for creating issues.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>jira.apiToken</code></td>
-    <td>API token of the bot user.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>jira.project</code></td>
-    <td>Short code of the project in Jira in which issues will be created</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>jira.issueType</code></td>
-    <td>Type of the issues to be created on access requests (eg. Bug, Task)</td>
-    <td>string</td>
-    <td><code>"Task"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>http.publicAddress</code></td>
-    <td>The domain name which will be assigned to the service</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>http.tlsFromSecret</code></td>
-    <td>Name of the Kubernetes secret where the TLS key and certificate will be mounted</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>http.tlsKeySecretPath</code></td>
-    <td>Path of the TLS key in the secret specified by <code>http.tlsFromSecret</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>http.tlsCertSecretPath</code></td>
-    <td>Path of the TLS certificate in the secret specified by <code>http.tlsFromSecret</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>http.basicAuth.username</code></td>
-    <td>Username for the basic authentication. The plugin will require a matching `Authorization` header in case both the username and the password are specified.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>http.basicAuth.password</code></td>
-    <td>Password for the basic authentication. The plugin will require a matching `Authorization` header in case both the username and the password are specified.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/jira.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-  </tr>
-</table>
+See [teleport-plugin-jira Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-jira/) for available Helm Chart configuration.
diff --git a/examples/chart/access/jira/charts/tbot b/examples/chart/access/jira/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/jira/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/jira/templates/_helpers.tpl b/examples/chart/access/jira/templates/_helpers.tpl
index 689e783e2c03e..c99317db31d6a 100644
--- a/examples/chart/access/jira/templates/_helpers.tpl
+++ b/examples/chart/access/jira/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "jira.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "jira.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/jira/templates/configmap.yaml b/examples/chart/access/jira/templates/configmap.yaml
index e0b3e91e49d3f..95d1c3d842d36 100644
--- a/examples/chart/access/jira/templates/configmap.yaml
+++ b/examples/chart/access/jira/templates/configmap.yaml
@@ -11,8 +11,8 @@ metadata:
 data:
   teleport-jira.toml: |
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/jira/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/jira/teleport-identity/{{ include "jira.identitySecretPath" . }}"
     refresh_identity = true
 
     [jira]
diff --git a/examples/chart/access/jira/templates/deployment.yaml b/examples/chart/access/jira/templates/deployment.yaml
index 1e93b7bb7415a..c728f0f1edf95 100644
--- a/examples/chart/access/jira/templates/deployment.yaml
+++ b/examples/chart/access/jira/templates/deployment.yaml
@@ -85,7 +85,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identityFromSecret }}"
+            secretName: {{ include "jira.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: {{ .Values.secretVolumeName }}
           secret:
diff --git a/examples/chart/access/jira/templates/secret.yaml b/examples/chart/access/jira/templates/secret.yaml
index 6535d8f9b5f72..76365c2e58a78 100644
--- a/examples/chart/access/jira/templates/secret.yaml
+++ b/examples/chart/access/jira/templates/secret.yaml
@@ -8,6 +8,6 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
-   jiraApiToken: {{ .Values.jira.apiToken | b64enc }}
+  jiraApiToken: {{ .Values.jira.apiToken | b64enc }}
 type: Opaque
 {{- end }}
diff --git a/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap
index c3eb26a29fb70..a8c0efebab1f1 100644
--- a/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap
@@ -32,6 +32,6 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-jira
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-jira-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-jira-18.6.1
       name: RELEASE-NAME-teleport-plugin-jira
diff --git a/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap
index 6beb3d5e41d09..2ca599960eba7 100644
--- a/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-jira
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-jira-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-jira-18.6.1
       name: RELEASE-NAME-teleport-plugin-jira
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-jira
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-jira-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-jira-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/jira/values.yaml b/examples/chart/access/jira/values.yaml
index cc73cf399f744..16b28ef5f1313 100644
--- a/examples/chart/access/jira/values.yaml
+++ b/examples/chart/access/jira/values.yaml
@@ -13,6 +13,8 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identityFromSecret(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +32,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Jira](../../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) guide
+  # Jira](../../identity-governance/access-requests/plugins/jira.mdx) guide
   # for more information about how to acquire these credentials.
   identityFromSecret: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -113,6 +115,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the Jira plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the Jira plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 tlsSecretVolumeName: "tls"
 
diff --git a/examples/chart/access/mattermost/Chart.yaml b/examples/chart/access/mattermost/Chart.yaml
index 074f9ca626108..b25f93e0c5e1e 100644
--- a/examples/chart/access/mattermost/Chart.yaml
+++ b/examples/chart/access/mattermost/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-mattermost
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport Mattermost Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/mattermost/README.md b/examples/chart/access/mattermost/README.md
index f18c02893fe19..ea22342b9d4e8 100644
--- a/examples/chart/access/mattermost/README.md
+++ b/examples/chart/access/mattermost/README.md
@@ -6,95 +6,6 @@ This chart sets up and configures a Deployment for the Access Request Mattermost
 
 See the [Access Requests with Mattermost guide](https://goteleport.com/docs/access-controls/access-request-plugins/ssh-approval-mattermost/).
 
-## Settings
+## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>mattermost.url</code></td>
-    <td>URL of the Mattermost server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>mattermost.token</code></td>
-    <td>Token to be used to authenticate with Mattermost</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>mattermost.tokenFromSecret</code></td>
-    <td>Kubernetes secret to read the token from instead of <code>mattermost.token</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mattermost.tokenSecretPath</code></td>
-    <td>The path of the token in the secret described by <code>mattermost.tokenFromSecret</code></td>
-    <td>string</td>
-    <td><code>"mattermostToken"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>mattermost.recipients</code></td>
-    <td>Array of the recipients the plugin should send access requests to.</td>
-    <td>array</td>
-    <td><code>[]</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/mattermost.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-mattermost Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-mattermost/) for available Helm Chart configuration.
diff --git a/examples/chart/access/mattermost/charts/tbot b/examples/chart/access/mattermost/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/mattermost/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/mattermost/templates/_helpers.tpl b/examples/chart/access/mattermost/templates/_helpers.tpl
index dca7e6f2b2a9a..abfdce0aff71d 100644
--- a/examples/chart/access/mattermost/templates/_helpers.tpl
+++ b/examples/chart/access/mattermost/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "mattermost.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "mattermost.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/mattermost/templates/configmap.yaml b/examples/chart/access/mattermost/templates/configmap.yaml
index b370d2eb0bab9..95ea14e9ad839 100644
--- a/examples/chart/access/mattermost/templates/configmap.yaml
+++ b/examples/chart/access/mattermost/templates/configmap.yaml
@@ -11,8 +11,8 @@ metadata:
 data:
   teleport-mattermost.toml: |
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/mattermost/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/mattermost/teleport-identity/{{ include "mattermost.identitySecretPath" . }}"
     refresh_identity = true
 
     [mattermost]
diff --git a/examples/chart/access/mattermost/templates/deployment.yaml b/examples/chart/access/mattermost/templates/deployment.yaml
index edc91c06c333a..6dce2ee92b8ef 100644
--- a/examples/chart/access/mattermost/templates/deployment.yaml
+++ b/examples/chart/access/mattermost/templates/deployment.yaml
@@ -76,7 +76,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "mattermost.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: {{ .Values.secretVolumeName }}
           secret:
diff --git a/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap
index 770c441b8ac59..0b9ffc840cc23 100644
--- a/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap
@@ -22,6 +22,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-mattermost
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-mattermost-18.6.1
       name: RELEASE-NAME-teleport-plugin-mattermost
diff --git a/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap
index b087c6fe56263..df126f6b6de52 100644
--- a/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-mattermost
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-mattermost-18.6.1
       name: RELEASE-NAME-teleport-plugin-mattermost
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-mattermost
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-mattermost-18.6.1
         spec:
           containers:
           - command:
@@ -75,8 +75,8 @@ should mount external secret:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-mattermost
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-mattermost-18.6.1
       name: RELEASE-NAME-teleport-plugin-mattermost
     spec:
       replicas: 1
@@ -90,8 +90,8 @@ should mount external secret:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-mattermost
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-mattermost-18.6.1
         spec:
           containers:
           - command:
@@ -102,7 +102,7 @@ should mount external secret:
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-mattermost:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-mattermost:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-mattermost
             ports:
@@ -143,8 +143,8 @@ should override volume name:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-mattermost
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-mattermost-18.6.1
       name: RELEASE-NAME-teleport-plugin-mattermost
     spec:
       replicas: 1
@@ -158,8 +158,8 @@ should override volume name:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-mattermost
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-mattermost-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-mattermost-18.6.1
         spec:
           containers:
           - command:
@@ -170,7 +170,7 @@ should override volume name:
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-mattermost:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-plugin-mattermost:18.6.1
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-mattermost
             ports:
diff --git a/examples/chart/access/mattermost/values.schema.json b/examples/chart/access/mattermost/values.schema.json
index 15a8cc8974fdd..3c738e240eac3 100644
--- a/examples/chart/access/mattermost/values.schema.json
+++ b/examples/chart/access/mattermost/values.schema.json
@@ -328,9 +328,9 @@
                 "tokenSecretPath": {
                     "$id": "#/properties/mattermost/properties/tokenSecretPath",
                     "type": "string",
-                    "default": "pagerdutyApiKey",
+                    "default": "mattermostToken",
                     "examples": [
-                        "pagerdutyApiKey"
+                        "mattermostToken"
                     ]
                 },
                 "recipients": {
diff --git a/examples/chart/access/mattermost/values.yaml b/examples/chart/access/mattermost/values.yaml
index dd2106decaf61..552e9eaefafa6 100644
--- a/examples/chart/access/mattermost/values.yaml
+++ b/examples/chart/access/mattermost/values.yaml
@@ -13,6 +13,8 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +32,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Mattermost](../../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) guide
+  # Mattermost](../../identity-governance/access-requests/plugins/mattermost.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -80,6 +82,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the Mattermost plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the Mattermost plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 
 # annotations -- contains annotations to apply to the different Kubernetes
diff --git a/examples/chart/access/msteams/Chart.yaml b/examples/chart/access/msteams/Chart.yaml
index efa37f9118153..4d0a9b4765a1c 100644
--- a/examples/chart/access/msteams/Chart.yaml
+++ b/examples/chart/access/msteams/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-msteams
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport MsTeams Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/msteams/README.md b/examples/chart/access/msteams/README.md
index a427a6fdf5f3d..92ed523298f83 100644
--- a/examples/chart/access/msteams/README.md
+++ b/examples/chart/access/msteams/README.md
@@ -4,4 +4,8 @@ This chart sets up and configures a Deployment for the Access Request MsTeams pl
 
 ## Installation
 
-See the [Access Requests with Microsoft Teams guide](https://goteleport.com/docs/access-controls/access-request-plugins/ssh-approval-msteams/).
\ No newline at end of file
+See the [Access Requests with Microsoft Teams guide](https://goteleport.com/docs/access-controls/access-request-plugins/ssh-approval-msteams/).
+
+## Values
+
+See [teleport-plugin-msteams Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-msteams/) for available Helm Chart configuration.
diff --git a/examples/chart/access/msteams/charts/tbot b/examples/chart/access/msteams/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/msteams/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/msteams/templates/_helpers.tpl b/examples/chart/access/msteams/templates/_helpers.tpl
index 788a5556d6580..3d4468cb4e49c 100644
--- a/examples/chart/access/msteams/templates/_helpers.tpl
+++ b/examples/chart/access/msteams/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "msteams.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "msteams.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/msteams/templates/configmap.yaml b/examples/chart/access/msteams/templates/configmap.yaml
index 26066caad4ca6..e54bc5e686189 100644
--- a/examples/chart/access/msteams/templates/configmap.yaml
+++ b/examples/chart/access/msteams/templates/configmap.yaml
@@ -13,8 +13,8 @@ data:
     preload = true
     
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/msteams/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/msteams/teleport-identity/{{ include "msteams.identitySecretPath" . }}"
     refresh_identity = true
 
     [msapi]
diff --git a/examples/chart/access/msteams/templates/deployment.yaml b/examples/chart/access/msteams/templates/deployment.yaml
index bdb302a8a3dae..c1f6bd3d75092 100644
--- a/examples/chart/access/msteams/templates/deployment.yaml
+++ b/examples/chart/access/msteams/templates/deployment.yaml
@@ -72,7 +72,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "msteams.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: {{ .Values.secretVolumeName }}
           secret:
diff --git a/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap
index 9823f589ccdf6..bddf7dfc5ca31 100644
--- a/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap
@@ -29,6 +29,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-msteams
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-msteams-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-msteams-18.6.1
       name: RELEASE-NAME-teleport-plugin-msteams
diff --git a/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap
index b1b3c735e173c..5943d4ffab67d 100644
--- a/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-msteams
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-msteams-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-msteams-18.6.1
       name: RELEASE-NAME-teleport-plugin-msteams
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-msteams
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-msteams-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-msteams-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/msteams/values.yaml b/examples/chart/access/msteams/values.yaml
index 84490daafae48..4eb5a6917898c 100644
--- a/examples/chart/access/msteams/values.yaml
+++ b/examples/chart/access/msteams/values.yaml
@@ -13,6 +13,8 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +32,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Microsoft Teams](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) guide
+  # Microsoft Teams](../../identity-governance/access-requests/plugins/msteams.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -46,17 +48,17 @@ teleport:
 # - via an existing Kubernetes Secret by setting `msTeams.appSecretFromSecret`
 msTeams:
   # msTeams.appID(string) -- is the Azure app ID used by the plugin.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
   #
   # This value is mandatory.
   appID: ""
   # msTeams.tenantID(string) -- is the Azure tenant ID used by the plugin and Microsoft Teams.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
   #
   # This value is mandatory.
   tenantID: ""
   # msTeams.teamsAppID(string) -- is the MsTeams app ID used by the plugin.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-requests/plugins/msteams.mdx) to know how to get this value.
   #
   # This value is mandatory.
   teamsAppID: ""
@@ -104,6 +106,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the MS Teams plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the MS Teams plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 
 # annotations -- contains annotations to apply to the different Kubernetes
diff --git a/examples/chart/access/pagerduty/Chart.yaml b/examples/chart/access/pagerduty/Chart.yaml
index 721e204baa89b..987019c70166a 100644
--- a/examples/chart/access/pagerduty/Chart.yaml
+++ b/examples/chart/access/pagerduty/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-pagerduty
@@ -6,3 +6,8 @@ description: A Helm chart for the Teleport Pagerduty Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/access/pagerduty/README.md b/examples/chart/access/pagerduty/README.md
index a02ad36e429b2..043a26b29156e 100644
--- a/examples/chart/access/pagerduty/README.md
+++ b/examples/chart/access/pagerduty/README.md
@@ -8,86 +8,4 @@ See the [Access Requests with PagerDuty guide](https://goteleport.com/docs/acces
 
 ## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>pagerduty.apiKey</code></td>
-    <td>PagerDuty API Key</td>
-    <td>string</td>
-    <td><code></code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>pagerduty.apiKeyFromSecret</code></td>
-    <td>Kubernetes secret to read the api key from instead of <code>pagerduty.apiKey</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>pagerduty.apiKeySecretPath</code></td>
-    <td>The path of the api key in the secret described by <code>pagerduty.apiKeyFromSecret</code></td>
-    <td>string</td>
-    <td><code>"pagerdutyApiKey"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>pagerduty.userEmail</code></td>
-    <td>PagerDuty bot user email</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/pagerduty.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-pagerduty Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-pagerduty/) for available Helm Chart configuration.
diff --git a/examples/chart/access/pagerduty/charts/tbot b/examples/chart/access/pagerduty/charts/tbot
new file mode 120000
index 0000000000000..bc5284c76fa10
--- /dev/null
+++ b/examples/chart/access/pagerduty/charts/tbot
@@ -0,0 +1 @@
+../../../tbot
\ No newline at end of file
diff --git a/examples/chart/access/pagerduty/templates/_helpers.tpl b/examples/chart/access/pagerduty/templates/_helpers.tpl
index ee4d235b04488..51a653e5c9efb 100644
--- a/examples/chart/access/pagerduty/templates/_helpers.tpl
+++ b/examples/chart/access/pagerduty/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "pagerduty.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "pagerduty.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/access/pagerduty/templates/configmap.yaml b/examples/chart/access/pagerduty/templates/configmap.yaml
index 03139e6e1058d..44d2808ac1334 100644
--- a/examples/chart/access/pagerduty/templates/configmap.yaml
+++ b/examples/chart/access/pagerduty/templates/configmap.yaml
@@ -11,8 +11,8 @@ metadata:
 data:
   teleport-pagerduty.toml: |
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/pagerduty/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/pagerduty/teleport-identity/{{ include "pagerduty.identitySecretPath" . }}"
     refresh_identity = true
 
     [pagerduty]
diff --git a/examples/chart/access/pagerduty/templates/deployment.yaml b/examples/chart/access/pagerduty/templates/deployment.yaml
index 6990b9262a7ec..dbe5e2a6820a5 100644
--- a/examples/chart/access/pagerduty/templates/deployment.yaml
+++ b/examples/chart/access/pagerduty/templates/deployment.yaml
@@ -76,7 +76,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "pagerduty.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: {{ .Values.secretVolumeName }}
           secret:
diff --git a/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap
index 7b5b7d971c412..7fb60f13caa40 100644
--- a/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap
@@ -21,6 +21,6 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-pagerduty
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-pagerduty-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-pagerduty-18.6.1
       name: RELEASE-NAME-teleport-plugin-pagerduty
diff --git a/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap
index fc4b46644d074..b1ca40a034ef0 100644
--- a/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-pagerduty
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-pagerduty-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-pagerduty-18.6.1
       name: RELEASE-NAME-teleport-plugin-pagerduty
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-pagerduty
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-pagerduty-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-pagerduty-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/pagerduty/values.yaml b/examples/chart/access/pagerduty/values.yaml
index 74e32245cf19c..ddc7b0dcc1af9 100644
--- a/examples/chart/access/pagerduty/values.yaml
+++ b/examples/chart/access/pagerduty/values.yaml
@@ -13,6 +13,9 @@ teleport:
   # For example:
   #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
   #   - joining an Auth: `teleport-auth.example.com:3025`
+  #
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
   # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
   # that contains the credentials for the connection to your Teleport cluster.
@@ -30,7 +33,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # PagerDuty](../../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) guide
+  # PagerDuty](../../identity-governance/access-requests/plugins/pagerduty.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -76,6 +79,54 @@ log:
   # will still go to `stderr` for resilience.
   output: stdout
 
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the PagerDuty plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the PagerDuty plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
+
 secretVolumeName: "password-file"
 
 # annotations -- contains annotations to apply to the different Kubernetes
diff --git a/examples/chart/access/slack/Chart.yaml b/examples/chart/access/slack/Chart.yaml
index 7d4b14b6be3c4..1bb2cae3461ab 100644
--- a/examples/chart/access/slack/Chart.yaml
+++ b/examples/chart/access/slack/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-slack
diff --git a/examples/chart/access/slack/README.md b/examples/chart/access/slack/README.md
index 634f3c23d60d4..ffad800e06e6d 100644
--- a/examples/chart/access/slack/README.md
+++ b/examples/chart/access/slack/README.md
@@ -8,130 +8,4 @@ See the [Access Requests with Slack guide](https://goteleport.com/docs/access-co
 
 ## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>Host/port combination of the teleport auth server</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>slack.token</code></td>
-    <td>Slack API token</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>slack.tokenFromSecret</code></td>
-    <td>Kubernetes secret to read the token from instead of <code>slack.token</code></td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>slack.tokenSecretPath</code></td>
-    <td>The path of the token in the secret described by <code>slack.tokenFromSecret</code></td>
-    <td>string</td>
-    <td><code>"slackToken"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>roleToRecipients</code></td>
-    <td>
-      Mapping of roles to a list of channels and Slack emails. <br />
-      Example:
-      <pre>
-"dev" = ["dev-access-requests", "user@example.com"]
-"*" = ["access-requests"]</pre>
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>yes</td>
-  </tr>
-
-  <tr>
-    <td><code>log.output</code></td>
-    <td>
-      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
-      eg. <code>"/var/lib/teleport/slack.log"</code>
-    </td>
-    <td>string</td>
-    <td><code>"stdout"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>log.severity</code></td>
-    <td>
-      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
-      <code>"DEBUG"</code> or <code>"WARN"</code>.
-    </td>
-    <td>string</td>
-    <td><code>"INFO"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>annotations.config</code></td>
-    <td>
-      Annotations to add to the configmap.
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>annotations.deployment</code></td>
-    <td>
-      Annotations to add to the deployment.
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>annotations.pod</code></td>
-    <td>
-      Annotations to add to every pod created by the deployment.
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>annotations.secret</code></td>
-    <td>
-      Annotations to add to the secret.
-    </td>
-    <td>map</td>
-    <td><code>{}</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-slack Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-slack/) for available Helm Chart configuration.
diff --git a/examples/chart/access/slack/templates/_helpers.tpl b/examples/chart/access/slack/templates/_helpers.tpl
index b592fb8a4c466..0b152b53b92a5 100644
--- a/examples/chart/access/slack/templates/_helpers.tpl
+++ b/examples/chart/access/slack/templates/_helpers.tpl
@@ -61,6 +61,9 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
 {{- define "slack.identitySecretName" -}}
 {{- if .Values.teleport.identitySecretName -}}
 {{- .Values.teleport.identitySecretName -}}
@@ -76,7 +79,3 @@ identity
 {{- .Values.teleport.identitySecretPath -}}
 {{- end -}}
 {{- end -}}
-
-{{- define "slack.teleportAddress" -}}
-
-{{- end -}}
diff --git a/examples/chart/access/slack/templates/secret.yaml b/examples/chart/access/slack/templates/secret.yaml
index c21021a0e40ce..72402da0c3fda 100644
--- a/examples/chart/access/slack/templates/secret.yaml
+++ b/examples/chart/access/slack/templates/secret.yaml
@@ -9,5 +9,5 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:
-   slackToken: {{ .Values.slack.token | b64enc }}
+  slackToken: {{ .Values.slack.token | b64enc }}
 {{- end }}
diff --git a/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap
index 734127f067b8c..9342060944774 100644
--- a/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap
@@ -24,6 +24,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-slack
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-slack-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-slack-18.6.1
       name: RELEASE-NAME-teleport-plugin-slack
diff --git a/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap
index 0dc816f98e1ad..36a8063dcbd67 100644
--- a/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-slack
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-slack-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-slack-18.6.1
       name: RELEASE-NAME-teleport-plugin-slack
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-slack
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-plugin-slack-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-slack-18.6.1
         spec:
           containers:
           - command:
diff --git a/examples/chart/access/slack/values.yaml b/examples/chart/access/slack/values.yaml
index 566354c544fe9..82d5be16f6af3 100644
--- a/examples/chart/access/slack/values.yaml
+++ b/examples/chart/access/slack/values.yaml
@@ -33,7 +33,7 @@ teleport:
   # ```
   #
   # Check out the [Access Requests with
-  # Slack](../../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) guide
+  # Slack](../../identity-governance/access-requests/plugins/slack.mdx) guide
   # for more information about how to acquire these credentials.
   identitySecretName: ""
   # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -130,7 +130,7 @@ tbot:
   teleportAuthAddress: ""
 
   # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
-  # See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
   joinMethod: "kubernetes"
   token: ""
 
diff --git a/examples/chart/event-handler/.lint/existing-tls-secret-with-ca.yaml b/examples/chart/event-handler/.lint/existing-tls-secret-with-ca.yaml
index a767c9076f74a..39f5b33d2917e 100644
--- a/examples/chart/event-handler/.lint/existing-tls-secret-with-ca.yaml
+++ b/examples/chart/event-handler/.lint/existing-tls-secret-with-ca.yaml
@@ -1,2 +1,3 @@
 tls:
   existingCASecretName: "helm-lint-existing-tls-secret-ca"
+  existingCASecretKeyName: "helm-lint-existing-tls-secret-key-name"
diff --git a/examples/chart/event-handler/Chart.yaml b/examples/chart/event-handler/Chart.yaml
index 45d3d52a5bfcd..b74ab34d2a860 100644
--- a/examples/chart/event-handler/Chart.yaml
+++ b/examples/chart/event-handler/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 apiVersion: v2
 name: teleport-plugin-event-handler
@@ -6,3 +6,8 @@ description: A Helm chart for Teleport Event Handler Plugin
 type: application
 version: *version
 appVersion: *version
+
+dependencies:
+  - name: tbot
+    version: *version
+    condition: tbot.enabled
diff --git a/examples/chart/event-handler/README.md b/examples/chart/event-handler/README.md
index 07a6d885197f8..53c97163d9767 100644
--- a/examples/chart/event-handler/README.md
+++ b/examples/chart/event-handler/README.md
@@ -6,147 +6,6 @@ This chart sets up and configures a Deployment for the Event Handler plugin.
 
 See the [Export Events with FluentD Guide](https://goteleport.com/docs/management/export-audit-events/fluentd/).
 
-## Settings
+## Values
 
-The following values can be set for the Helm chart:
-
-<table>
-  <tr>
-    <th>Name</th>
-    <th>Description</th>
-    <th>Type</th>
-    <th>Default</th>
-    <th>Required</th>
-  </tr>
-
-  <tr>
-    <td><code>teleport.address</code></td>
-    <td>hostname and HTTPS port of your Teleport Proxy Service
-or Teleport Enterprise Cloud account (e.g., `teleport.example.com:443` or
-`mytenant.teleport.sh:443`)</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretName</code></td>
-    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>teleport.identitySecretPath</code></td>
-    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
-    <td>string</td>
-    <td><code>"auth_id"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>eventHandler.storagePath</code></td>
-    <td>Path to the directory where <code>event-handler</code>'s state is stored</td>
-    <td>string</td>
-    <td><code>"/var/lib/teleport/plugins/event-handler/storage"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>eventHandler.timeout</code></td>
-    <td>Maximum time to wait for incoming events before sending them to fluentd.</td>
-    <td>string</td>
-    <td><code>"10s"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>eventHandler.batch</code></td>
-    <td>Maximum number of events fetched from Teleport in one request</td>
-    <td>string</td>
-    <td><code>20</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>fluentd.url</code></td>
-    <td>URL of fluentd where the event logs will be sent to.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>fluentd.sessionUrl</code></td>
-    <td>URL of fluentd where the session logs will be sent to.</td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>fluentd.secretName</code></td>
-    <td>
-      Name of the secret where credentials for the connection is stored.
-      It must contain the client's private key, certificate and fluentd's
-      CA certificate. See the default paths below.
-    </td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>yes</td>
-  </tr>
-  <tr>
-    <td><code>fluentd.caPath</code></td>
-    <td>Path of the CA certificate in the secret described by <code>fluentd.secretName</code>.</td>
-    <td>string</td>
-    <td><code>"ca.crt"</code></td>
-  </tr>
-  <tr>
-    <td><code>fluentd.certPath</code></td>
-    <td>Path of the client's certificate in the secret described by <code>fluentd.secretName</code>.</td>
-    <td>string</td>
-    <td><code>"client.crt"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>fluentd.keyPath</code></td>
-    <td>Path of the client private key in the secret described by <code>fluentd.secretName</code>.</td>
-    <td>string</td>
-    <td><code>"client.key"</code></td>
-    <td>no</td>
-  </tr>
-
-  <tr>
-    <td><code>persistentVolumeClaim.enabled</code></td>
-    <td>
-      Instructs the Helm chart to include a PersistentVolumeClaim for the storage. This storage
-      will be mounted to the path specified by <code>eventHandler.storagePath</code>.
-    </td>
-    <td>boolean</td>
-    <td><code>false</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>persistentVolumeClaim.size</code></td>
-    <td>Sets the size of the created PersistentVolumeClaim. Don't forget to append the proper suffix!</td>
-    <td>string</td>
-    <td><code>"1Gi"</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>persistentVolumeClaim.storageClassName</code></td>
-    <td>
-      Sets the storage class name of the created PersistentVolumeClaim. Kubernetes will use the default
-      one when omitted.
-    </td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-  <tr>
-    <td><code>persistentVolumeClaim.existingClaim</code></td>
-    <td>
-      Specifies an already existing PersistentVolumeClaim which should be mounted to the path specified
-      by <code>eventHandler.storagePath</code>. <code>persistentVolumeClaim.enabled</code> must be set to false for this
-      option to take precedence. Ignored when <code>persistentVolumeClaim.enabled</code> is true.
-    </td>
-    <td>string</td>
-    <td><code>""</code></td>
-    <td>no</td>
-  </tr>
-</table>
+See [teleport-plugin-event-handler Chart Reference](https://goteleport.com/docs/reference/helm-reference/teleport-plugin-event-handler/) for available Helm Chart configuration.
diff --git a/examples/chart/event-handler/charts/tbot b/examples/chart/event-handler/charts/tbot
new file mode 120000
index 0000000000000..fe8e1716bedfb
--- /dev/null
+++ b/examples/chart/event-handler/charts/tbot
@@ -0,0 +1 @@
+../../tbot
\ No newline at end of file
diff --git a/examples/chart/event-handler/templates/_helpers.tpl b/examples/chart/event-handler/templates/_helpers.tpl
index 450f1572d9973..7574e35903823 100644
--- a/examples/chart/event-handler/templates/_helpers.tpl
+++ b/examples/chart/event-handler/templates/_helpers.tpl
@@ -60,3 +60,22 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Use tbot-managed identity secret if tbot is enabled
+*/}}
+{{- define "event-handler.identitySecretName" -}}
+{{- if .Values.teleport.identitySecretName -}}
+{{- .Values.teleport.identitySecretName -}}
+{{- else if .Values.tbot.enabled -}}
+  {{- .Release.Name }}-{{ default .Values.tbot.nameOverride "tbot" }}-out
+{{- end }}
+{{- end -}}
+
+{{- define "event-handler.identitySecretPath" -}}
+{{- if .Values.tbot.enabled -}}
+identity
+{{- else -}}
+{{- .Values.teleport.identitySecretPath -}}
+{{- end -}}
+{{- end -}}
diff --git a/examples/chart/event-handler/templates/configmap.yaml b/examples/chart/event-handler/templates/configmap.yaml
index 4729c749b7e29..c2feef5752578 100644
--- a/examples/chart/event-handler/templates/configmap.yaml
+++ b/examples/chart/event-handler/templates/configmap.yaml
@@ -2,8 +2,15 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "event-handler.fullname" . }}
+  {{- with .Values.annotations.config }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- include "event-handler.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.config }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 data:
   teleport-event-handler.toml: |
     storage = {{ .Values.eventHandler.storagePath | toJson }}
@@ -15,15 +22,38 @@ data:
     types = "{{ join "," .Values.eventHandler.types }}"
     {{- end }}
     {{- if .Values.eventHandler.skipEventTypes }}
-    skip-event-types = "{{ join "," .Values.eventHandler.skipEventTypes  }}"
+    skip-event-types = "{{ join "," .Values.eventHandler.skipEventTypes }}"
     {{- end }}
-    {{- if .Values.eventHandler.skipSessionTypes  }}
+    {{- if .Values.eventHandler.skipSessionTypes }}
     skip-session-types = "{{ join "," .Values.eventHandler.skipSessionTypes }}"
     {{- end }}
+    {{- if .Values.eventHandler.startTime }}
+    start-time = {{ .Values.eventHandler.startTime | quote }}
+    {{- end }}
+    {{- if .Values.eventHandler.dryRun }}
+    dry-run = {{ .Values.eventHandler.dryRun }}
+    {{- end }}
+    {{- if .Values.eventHandler.concurrency }}
+    concurrency = {{ .Values.eventHandler.concurrency }}
+    {{- end }}
+    {{- if .Values.eventHandler.lock }}
+    {{- if .Values.eventHandler.lock.enabled }}
+    lock-enabled = {{ .Values.eventHandler.lock.enabled }}
+    {{- end }}
+    {{- if .Values.eventHandler.lock.failedAttemptsCount }}
+    lock-failed-attempts-count = {{ .Values.eventHandler.lock.failedAttemptsCount }}
+    {{- end }}
+    {{- if .Values.eventHandler.lock.period }}
+    lock-period = {{ .Values.eventHandler.lock.period | quote }}
+    {{- end }}
+    {{- if .Values.eventHandler.lock.for }}
+    lock-for = {{ .Values.eventHandler.lock.for | quote }}
+    {{- end }}
+    {{- end }}
 
     [teleport]
-    addr = "{{ .Values.teleport.address }}"
-    identity = "/var/lib/teleport/plugins/event-handler/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    addr = {{ coalesce .Values.teleport.address .Values.tbot.teleportProxyAddress .Values.tbot.teleportAuthAddress | quote }}
+    identity = "/var/lib/teleport/plugins/event-handler/teleport-identity/{{ include "event-handler.identitySecretPath" . }}"
     refresh.enabled = true
 
     [forward.fluentd]
@@ -32,3 +62,4 @@ data:
     ca = "/var/lib/teleport/plugins/event-handler/ca.crt"
     cert = "/var/lib/teleport/plugins/event-handler/client.crt"
     key = "/var/lib/teleport/plugins/event-handler/client.key"
+    max-connections = {{ default (mul .Values.eventHandler.concurrency 2) .Values.fluentd.maxConnections }}
diff --git a/examples/chart/event-handler/templates/deployment.yaml b/examples/chart/event-handler/templates/deployment.yaml
index 368b0015ab7a1..1e316e4078c15 100644
--- a/examples/chart/event-handler/templates/deployment.yaml
+++ b/examples/chart/event-handler/templates/deployment.yaml
@@ -2,8 +2,15 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "event-handler.fullname" . }}
+  {{- with .Values.annotations.deployment }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- include "event-handler.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.deployment }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   replicas: 1
   {{- if or .Values.persistentVolumeClaim.enabled .Values.persistentVolumeClaim.existingClaim }}
@@ -15,12 +22,15 @@ spec:
       {{- include "event-handler.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
+      {{- with coalesce .Values.annotations.pod .Values.podAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
-        {{- include "event-handler.selectorLabels" . | nindent 8 }}
+        {{- include "event-handler.labels" . | nindent 8 }}
+        {{- with .Values.extraLabels.pod }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -36,16 +46,23 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
             - /usr/local/bin/teleport-plugin
+          args:
             - start
             - "--config"
             - "/etc/teleport-event-handler.toml"
+            {{- with .Values.extraArgs }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           env:
             - name: "TELEPORT_PLUGIN_FAIL_FAST"
               value: "true"
-          {{- if .Values.tls.existingCASecretName }}
+            {{- if .Values.tls.existingCASecretName }}
             - name: SSL_CERT_FILE
-              value: /etc/teleport-tls-ca/ca.pem
-          {{- end }}
+              value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
+            {{- end }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 80
@@ -67,11 +84,11 @@ spec:
             - name: certificate
               mountPath: /var/lib/teleport/plugins/event-handler/client.key
               subPath: {{ .Values.fluentd.certificate.keyPath }}
-           {{- if .Values.tls.existingCASecretName }}
+            {{- if .Values.tls.existingCASecretName }}
             - mountPath: /etc/teleport-tls-ca
               name: "teleport-tls-ca"
               readOnly: true
-           {{- end }}
+            {{- end }}
             {{- if or .Values.persistentVolumeClaim.enabled .Values.persistentVolumeClaim.existingClaim }}
             - name: "{{ .Values.persistentVolumeClaim.volumeName }}"
               mountPath: "{{ .Values.eventHandler.storagePath }}"
@@ -98,7 +115,7 @@ spec:
             defaultMode: 0600
         - name: teleport-identity
           secret:
-            secretName: "{{ .Values.teleport.identitySecretName }}"
+            secretName: {{ include "event-handler.identitySecretName" . | quote }}
             defaultMode: 0600
         - name: certificate
           secret:
diff --git a/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap
index 96c2b224a922f..f36abf366d67e 100644
--- a/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap
+++ b/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap
@@ -7,7 +7,13 @@ should match the snapshot:
         timeout = "10s"
         batch = 20
         window-size = "24h"
-        debug = false
+        debug = true
+        start-time = "2025-01-01T00:00:00.000Z"
+        dry-run = true
+        concurrency = 2
+        lock-enabled = true
+        lock-failed-attempts-count = 3
+        lock-period = "1m"
 
         [teleport]
         addr = "teleport.example.com:1234"
@@ -20,12 +26,13 @@ should match the snapshot:
         ca = "/var/lib/teleport/plugins/event-handler/ca.crt"
         cert = "/var/lib/teleport/plugins/event-handler/client.crt"
         key = "/var/lib/teleport/plugins/event-handler/client.key"
+        max-connections = 4
     kind: ConfigMap
     metadata:
       labels:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-event-handler
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-event-handler-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-event-handler-18.6.1
       name: RELEASE-NAME-teleport-plugin-event-handler
diff --git a/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap
index 8e4c4a3071659..6d3e2698f60ea 100644
--- a/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-event-handler
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-plugin-event-handler-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-plugin-event-handler-18.6.1
       name: RELEASE-NAME-teleport-plugin-event-handler
     spec:
       replicas: 1
@@ -20,14 +20,18 @@ should match the snapshot:
         metadata:
           labels:
             app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-event-handler
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-plugin-event-handler-18.6.1
         spec:
           containers:
-          - command:
-            - /usr/local/bin/teleport-plugin
+          - args:
             - start
             - --config
             - /etc/teleport-event-handler.toml
+            command:
+            - /usr/local/bin/teleport-plugin
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
@@ -72,17 +76,18 @@ should match the snapshot:
 should mount tls.existingCASecretName and set environment when set in values:
   1: |
     containers:
-    - command:
-      - /usr/local/bin/teleport-plugin
+    - args:
       - start
       - --config
       - /etc/teleport-event-handler.toml
+      command:
+      - /usr/local/bin/teleport-plugin
       env:
       - name: TELEPORT_PLUGIN_FAIL_FAST
         value: "true"
       - name: SSL_CERT_FILE
-        value: /etc/teleport-tls-ca/ca.pem
-      image: public.ecr.aws/gravitational/teleport-plugin-event-handler:18.0.0-dev
+        value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
+      image: public.ecr.aws/gravitational/teleport-plugin-event-handler:18.6.1
       imagePullPolicy: IfNotPresent
       name: teleport-plugin-event-handler
       ports:
diff --git a/examples/chart/event-handler/tests/configmap_test.yaml b/examples/chart/event-handler/tests/configmap_test.yaml
index 2142f7f2cc6f1..cf352679c04b2 100644
--- a/examples/chart/event-handler/tests/configmap_test.yaml
+++ b/examples/chart/event-handler/tests/configmap_test.yaml
@@ -4,6 +4,13 @@ templates:
 tests:
   - it: should match the snapshot
     set:
+      eventHandler:
+        debug: true
+        startTime: "2025-01-01T00:00:00.000Z"
+        dryRun: true
+        concurrency: 2
+        lock:
+          enabled: true
       teleport:
         address: teleport.example.com:1234
       fluentd:
@@ -16,3 +23,29 @@ tests:
           keyPath: myclient.key
     asserts:
       - matchSnapshot: {}
+  - it: should not contain annotations when not defined
+    asserts:
+      - isNull:
+          path: metadata.annotations
+  - it: should contain annotations when defined
+    set:
+      annotations:
+        config:
+          keyA: valA
+          keyB: valB
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            keyA: valA
+            keyB: valB
+  - it: sets extraLabels when set in values
+    set:
+      extraLabels:
+        config:
+          test-key: test-label-config
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            test-key: test-label-config
diff --git a/examples/chart/event-handler/tests/deployment_test.yaml b/examples/chart/event-handler/tests/deployment_test.yaml
index aa5103c328e58..d8eb188ed334a 100644
--- a/examples/chart/event-handler/tests/deployment_test.yaml
+++ b/examples/chart/event-handler/tests/deployment_test.yaml
@@ -9,7 +9,6 @@ tests:
         tag: v98.76.54
     asserts:
       - matchSnapshot: {}
-
   - it: uses the recreate strategy if a PV is mounted
     set:
       persistentVolumeClaim:
@@ -39,6 +38,95 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - matchSnapshot:
           path: spec.template.spec
+  - it: should not contain deployment or pod annotations when not defined
+    asserts:
+      - isNull:
+          path: metadata.annotations
+      - isNull:
+          path: spec.template.metadata.annotations
+  - it: should contain deployment annotations when defined
+    set:
+      annotations:
+        deployment:
+          keyA: valA
+          keyB: valB
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            keyA: valA
+            keyB: valB
+      - isNull:
+          path: spec.template.metadata.annotations
+  - it: should contain pod annotations when defined
+    set:
+      annotations:
+        pod:
+          keyA: valA
+          keyB: valB
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            keyA: valA
+            keyB: valB
+      - isNull:
+          path: metadata.annotations
+  - it: should contain both annotations when defined
+    set:
+      annotations:
+        deployment:
+          keyA: valA
+          keyB: valB
+        pod:
+          keyA: valA'
+          keyC: valC
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            keyA: valA
+            keyB: valB
+      - equal:
+          path: spec.template.metadata.annotations
+          value:
+            keyA: valA'
+            keyC: valC
+  - it: sets extraLabels when set in values
+    set:
+      extraLabels:
+        deployment:
+          test-key: test-label-deployment
+        pod:
+          test-key: test-label-pod
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            test-key: test-label-deployment
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            test-key: test-label-pod
+  - it: sets extraArgs when set in values
+    set:
+      extraArgs:
+        - --extra-arg
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --extra-arg
+  - it: sets extraEnv when set in values
+    set:
+      extraEnv:
+        - name: TEST_ENV
+          value: test-value
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: TEST_ENV
+            value: test-value
diff --git a/examples/chart/event-handler/values.schema.json b/examples/chart/event-handler/values.schema.json
index 68f234f9dade8..5aa97de174da0 100644
--- a/examples/chart/event-handler/values.schema.json
+++ b/examples/chart/event-handler/values.schema.json
@@ -11,8 +11,11 @@
         "podSecurityContext",
         "securityContext",
         "nodeSelector",
+        "annotations",
         "tolerations",
         "affinity",
+        "extraArgs",
+        "extraEnv",
         "teleport",
         "fluentd"
     ],
@@ -131,6 +134,16 @@
             },
             "additionalProperties": true
         },
+        "extraArgs": {
+            "$id": "#/properties/extraArgs",
+            "type": "array",
+            "default": []
+        },
+        "extraEnv": {
+            "$id": "#/properties/extraEnv",
+            "type": "array",
+            "default": []
+        },
         "resources": {
             "$id": "#/properties/resources",
             "type": "object",
@@ -225,20 +238,73 @@
             "default": {},
             "additionalProperties": true
         },
+        "annotations": {
+            "$id": "#/properties/annotations",
+            "type": "object",
+            "required": [
+                "config",
+                "deployment",
+                "pod"
+            ],
+            "properties": {
+                "config": {
+                    "$id": "#/properties/annotations/properties/config",
+                    "type": "object",
+                    "default": {}
+                },
+                "deployment": {
+                    "$id": "#/properties/annotations/properties/deployment",
+                    "type": "object",
+                    "default": {}
+                },
+                "pod": {
+                    "$id": "#/properties/annotations/properties/pod",
+                    "type": "object",
+                    "default": {}
+                }
+            }
+        },
+        "extraLabels": {
+            "$id": "#/properties/extraLabels",
+            "type": "object",
+            "properties": {
+                "config": {
+                    "$id": "#/properties/extraLabels/properties/config",
+                    "type": "object",
+                    "default": {}
+                },
+                "deployment": {
+                    "$id": "#/properties/extraLabels/properties/deployment",
+                    "type": "object",
+                    "default": {}
+                },
+                "pod": {
+                    "$id": "#/properties/extraLabels/properties/pod",
+                    "type": "object",
+                    "default": {}
+                }
+            }
+        },
         "tls": {
             "$id": "#/properties/tls",
             "type": "object",
             "required": [
-                "existingCASecretName"
+                "existingCASecretName",
+                "existingCASecretKeyName"
             ],
             "properties": {
                 "existingCASecretName": {
                     "$id": "#/properties/tls/properties/existingCASecretName",
                     "type": "string",
                     "default": ""
+                },
+                "existingCASecretKeyName": {
+                    "$id": "#/properties/tls/properties/existingCASecretKeyName",
+                    "type": "string",
+                    "default": "ca.pem"
                 }
             }
-        },        
+        },
         "tolerations": {
             "$id": "#/properties/tolerations",
             "type": "array",
@@ -351,17 +417,26 @@
                 "timeout": {
                     "$id": "#/properties/eventHandler/properties/timeout",
                     "type": "string",
-                    "default": "10s"
+                    "default": "10s",
+                    "examples": [
+                        "10s"
+                    ]
                 },
                 "batch": {
                     "$id": "#/properties/eventHandler/properties/batch",
-                    "type": "number",
-                    "default": 20
+                    "type": "integer",
+                    "default": 20,
+                    "examples": [
+                        20
+                    ]
                 },
                 "window-size": {
                     "$id": "#/properties/eventHandler/properties/window-size",
                     "type": "string",
-                    "default": "24h"
+                    "default": "24h",
+                    "examples": [
+                        "24h"
+                    ]
                 },
                 "debug": {
                     "$id": "#/properties/eventHandler/properties/debug",
@@ -392,8 +467,84 @@
                     "type": "array",
                     "default": "",
                     "examples": [
-                        ["print"]
+                        ["print", "desktop.recording"]
+                    ]
+                },
+                "startTime": {
+                    "$id": "#/properties/eventHandler/properties/startTime",
+                    "type": "string",
+                    "default": "",
+                    "examples": [
+                        "2025-01-01T00:00:00.000Z"
                     ]
+                },
+                "dryRun": {
+                    "$id": "#/properties/eventHandler/properties/dryRun",
+                    "type": "boolean",
+                    "default": false,
+                    "examples": [
+                        false
+                    ]
+                },
+                "concurrency": {
+                    "$id": "#/properties/eventHandler/properties/concurrency",
+                    "type": "integer",
+                    "default": 5,
+                    "examples": [
+                        5
+                    ]
+                },
+                "lock": {
+                    "$id": "#/properties/eventHandler/properties/lock",
+                    "type": "object",
+                    "default": {
+                        "enabled": false
+                    },
+                    "examples": [
+                        {
+                            "enabled": true,
+                            "failedAttemptsCount": 3,
+                            "period": "1m",
+                            "for": "5s"
+                        }
+                    ],
+                    "required": [
+                        "enabled"
+                    ],
+                    "properties": {
+                        "enabled": {
+                            "$id": "#/properties/eventHandler/properties/lock/enabled",
+                            "type": "boolean",
+                            "default": false,
+                            "examples": [
+                                true
+                            ]
+                        },
+                        "failedAttemptsCount": {
+                            "$id": "#/properties/eventHandler/properties/lock/failedAttemptsCount",
+                            "type": "integer",
+                            "default": 3,
+                            "examples": [
+                                3
+                            ]
+                        },
+                        "period": {
+                            "$id": "#/properties/eventHandler/properties/lock/period",
+                            "type": "string",
+                            "default": "1m",
+                            "examples": [
+                                "1m"
+                            ]
+                        },
+                        "for": {
+                            "$id": "#/properties/eventHandler/properties/lock/for",
+                            "type": "string",
+                            "default": "5s",
+                            "examples": [
+                                "5s"
+                            ]
+                        }
+                    }
                 }
             },
             "additionalProperties": true
@@ -481,6 +632,14 @@
                             "default": "client.key"
                         }
                     }
+                },
+                "maxConnections": {
+                    "$id": "#/properties/fluentd/properties/maxConnections",
+                    "type": "integer",
+                    "default": 0,
+                    "examples": [
+                        10
+                    ]
                 }
             },
             "additionalProperties": true
diff --git a/examples/chart/event-handler/values.yaml b/examples/chart/event-handler/values.yaml
index ac5a7dc0586c0..ef5adac45243e 100644
--- a/examples/chart/event-handler/values.yaml
+++ b/examples/chart/event-handler/values.yaml
@@ -5,40 +5,159 @@
 #
 # Plugin specific options
 #
+
+# teleport -- contains the configuration describing how the plugin connects to
+# your Teleport cluster.
 teleport:
+  # teleport.address(string) -- is the address of the Teleport cluster the plugin
+  # connects to. The address must contain both the domain name and the port of
+  # the Teleport cluster. It can be either the address of the auth servers or the
+  # proxy servers.
+  #
+  # For example:
+  #   - joining a Proxy: `teleport.example.com:443` or `teleport.example.com:3080`
+  #   - joining an Auth: `teleport-auth.example.com:3025`
+  #
+  # When the address is empty, `tbot.teleportProxyAddress`
+  # or `tbot.teleportAuthAddress` will be used if they are set.
   address: ""
+  # teleport.identitySecretName(string) -- is the name of the Kubernetes secret
+  # that contains the credentials for the connection to your Teleport cluster.
+  #
+  # The secret should be in the following format:
+  #
+  # ```yaml
+  # apiVersion: v1
+  # kind: Secret
+  # type: Opaque
+  # metadata:
+  #   name: teleport-plugin-event-handler-identity
+  # data:
+  #   auth_id: #...
+  # ```
+  #
+  # Check out the [Export Events with Fluentd]
+  # (../../zero-trust-access/export-audit-events/fluentd.mdx) guide
+  # for more information about how to acquire these credentials.
   identitySecretName: ""
+  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
+  # specified by `teleport.identitySecretName` that holds the credentials for
+  # the connection to your Teleport cluster. If the secret has the path,
+  # `"auth_id"`, you can omit this field.
   identitySecretPath: "auth_id"
 
+# eventHandler -- contains the configuration used by the plugin to forward Teleport events.
 eventHandler:
+  # eventHandler.storagePath(string) -- is the storage directory for the event handler.
   storagePath: "/var/lib/teleport/plugins/event-handler/storage"
+  # eventHandler.timeout(string) -- is the polling timeout.
   timeout: "10s"
+  # eventHandler.batch(int) -- is the fetch batch size.
   batch: 20
-  # The window size configures the duration of the time window for the event handler
+  # eventHandler.windowSize(string) -- configures the duration of the time window for the event handler
   # to request events from Teleport. By default, this is set to 24 hours.
-  # Reduce the window size if the events backend cannot manage the event volume 
+  # Reduce the window size if the events backend cannot manage the event volume
   # for the default window size.
   # The window size should be specified as a duration string, parsed by Go's time.ParseDuration.
   windowSize: "24h"
-  # Optional setting to enable debug logging
-  # debug: true
-  # Optional setting for event types to forward
-  # types: ["TYPE1", "TYPE2"]
-  # Optional setting for event types to skip
-  # skipEventTypes: ["TYPE1"]
-  # Optional setting for session types to skip
-  # skipSessionTypes: ["TYPE1"]
-
-  
+  # eventHandler.debug(bool) -- enables debug logging.
+  debug: false
+  # eventHandler.types(list) -- is the list of event types to forward.
+  # When unset, the event handler forwards all events.
+  types: []
+  # eventHandler.skipEventTypes(list) -- is the list of audit event types to skip.
+  skipEventTypes: []
+  # eventHandler.skipSessionTypes(list) -- is the list of session recording event types to skip.
+  # When unset, the event handler skips noisy and binary events.
+  #
+  # See the [Teleport-event-handler README](https://github.com/gravitational/teleport/blob/1d2bd5eb8fc3500deb7d7108f6835efde98b7b24/integrations/event-handler/README.md)
+  # for a list of default skipped events.
+  skipSessionTypes: []
+  # eventHandler.startTime(string) -- is the start time to start ingestion from (RFC3339 format).
+  startTime: ""
+  # eventHandler.dryRun(bool) -- enables dry run without sending events to fluentd.
+  dryRun: false
+  # eventHandler.concurrency(int) -- is the number of concurrent sessions to process. By default, this is set to 5.
+  concurrency: 5
+  lock:
+    # eventHandler.lock.enabled(bool) -- controls whether user auto-locking is enabled.
+    enabled: false
+    # eventHandler.lock.failedAttemptsCount(int) -- is the number of failed attempts in the `lockPeriod` which
+    # triggers locking. By default, this is set to 3.
+    failedAttemptsCount: 3
+    # eventHandler.lock.period(string) -- is the time period where `lock-failed-attempts-count` failed attempts
+    # will trigger locking. By default, this is set to 1 minute.
+    period: "1m"
+    # eventHandler.lock.for(string) -- is the time period for which user gets lock.
+    for: ""
 
+# fluentd -- contains the configuration for the fluentd forwarder.
 fluentd:
+  # fluentd.url(string) -- is the Fluentd URL where the events will be sent.
   url: ""
+  # fluentd.sessionUrl(string) -- is the Fluentd URL where the session logs will be sent.
   sessionUrl: ""
   certificate:
+    # fluentd.certificate.secretName(string) -- is the secret containing the credentials to connect to Fluentd.
+    # It must contain the CA certificate, the client key and the client certificate.
     secretName: ""
+    # fluentd.certificate.caPath(string) -- is the name of the key which contains the CA certificate inside the secret.
     caPath: "ca.crt"
+    # fluentd.certificate.certPath(string) -- is the name of the key which contains the client's certificate inside the secret.
     certPath: "client.crt"
+    # fluentd.certificate.keyPath(string) -- is the name of the key which contains the client's private key inside the secret.
     keyPath: "client.key"
+  # fluentd.maxConnections(int) -- is the maximum number of connections to Fluentd. By default, or when set to 0,
+  # this becomes `eventHandler.concurrency` * 2.
+  maxConnections: 0
+
+# tbot -- controls the optional tbot deployment that obtains and renews
+# credentials for the plugin to connect to Teleport.
+# Only default and mandatory values are described here, see the tbot chart reference
+# for the full list of supported values.
+tbot:
+  # tbot.enabled(bool) -- controls if tbot should be deployed with the event handler plugin.
+  enabled: false
+  # tbot.clusterName(string) -- is the name of the Teleport cluster tbot and the event handler plugin will join.
+  # Setting this value is mandatory when tbot is enabled.
+  clusterName: ""
+  # tbot.teleportProxyAddress(string) -- is the teleport Proxy Service address the bot will connect to.
+  # This must contain the port number, usually 443 or 3080 for Proxy Service.
+  # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
+  # This is mandatory to connect to Teleport Enterprise (Cloud).
+  #
+  # This setting is mutually exclusive with `teleportAuthAddress`.
+  #
+  # For example:
+  # ```yaml
+  # tbot:
+  #   teleportProxyAddress: "test.teleport.sh:443"
+  # ```
+  teleportProxyAddress: ""
+  # tbot.teleportAuthAddress(string) -- is the teleport Auth Service address the bot will connect to.
+  # This must contain the port number, usually 3025 for Auth Service. Direct Auth Service connection
+  # should be used when you are deploying the bot in the same Kubernetes cluster than your `teleport-cluster`
+  # Helm release and have direct access to the Auth Service.
+  # Else, you should prefer connecting via the Proxy Service.
+  #
+  # This setting is mutually exclusive with `teleportProxyAddress`.
+  #
+  # For example:
+  # ```yaml
+  # teleportAuthAddress: "teleport-auth.teleport-namespace.svc.cluster.local:3025"
+  # ```
+  teleportAuthAddress: ""
+
+  # tbot.joinMethod(string) -- describes how tbot joins the Teleport cluster.
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+  joinMethod: "kubernetes"
+  token: ""
+
+  # Don't touch the tbot values below, this will break the chart.
+  # This ensures that tbot.fullname is not shortened if the release name contains "tbot"
+  nameOverride: tbot
+  defaultOutput:
+    enabled: true
 
 persistentVolumeClaim:
   enabled: false
@@ -47,27 +166,95 @@ persistentVolumeClaim:
   existingClaim: ""
   volumeName: "storage"
 
+# annotations -- contains annotations to apply to the different Kubernetes
+# objects created by the chart. See [the Kubernetes annotation
+# documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+# for more details.
+annotations:
+  # annotations.config(object) -- are annotations to set on the ConfigMap.
+  config: {}
+  # annotations.deployment(object) -- are annotations to set on the Deployment.
+  deployment: {}
+  # annotations.pod(object) -- are annotations to set on the Pods.
+  pod: {}
+  
+# extraLabels -- contains additional Kubernetes labels to apply on the resources
+# created by the chart. See [the Kubernetes label documentation
+# ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+# for more information.
+extraLabels:
+  # extraLabels.config(object) -- are labels to set on the ConfigMap.
+  config: {}
+  # extraLabels.deployment(object) -- are labels to set on the Deployment.
+  deployment: {}
+  # extraLabels.pod(object) -- are labels to set on the Pods.
+  pod: {}
+
 #
 # Deployment
 #
+# image -- sets the container image used for plugin pods created by the chart.
+#
+# You can override this to use your own plugin image rather than a Teleport-published image.
 image:
+  # image.repository(string) -- is the image repository.
   repository: public.ecr.aws/gravitational/teleport-plugin-event-handler
+  # image.pullPolicy(string) -- is the [Kubernetes image pull policy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy).
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # image.tag(string) -- Overrides the image tag whose default is the chart appVersion.
+  #
+  # Normally, the version of the Teleport plugin matches the
+  # version of the chart. If you install chart version 15.0.0, you'll use
+  # the plugin version 15.0.0. Upgrading the plugin is done by upgrading the chart.
+  #
+  # <Admonition type="warning">
+  # `image.tag` is intended for development and custom tags. This MUST NOT be
+  # used to control the plugin version in a typical deployment. This
+  # chart is designed to run a specific plugin version. You will face
+  # compatibility issues trying to run a different version with it.
+  #
+  # If you want to run the Teleport plugin version `X.Y.Z`, you should use
+  # `helm install --version X.Y.Z` instead.
+  # </Admonition>
   tag: ""
 
+# imagePullSecrets(list) -- is a list of secrets containing authorization tokens
+# which can be optionally used to access a private Docker registry.
+#
+# See the [Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) for more details.
 imagePullSecrets: []
+
+# nameOverride(string) -- optionally overrides the name of the chart, used
+# together with the release name when giving a name to resources.
 nameOverride: ""
+# fullnameOverride(string) -- optionally overrides the full name of resources.
 fullnameOverride: ""
 
+# Deprecated way to set pod annotations. `annotations.pod` should be preferred.
 podAnnotations: {}
 
+# podSecurityContext(object) -- sets the pod security context for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+# for more details.
+#
+# To unset the security context, set it to `null` or `~`.
 podSecurityContext: {}
 
+# securityContext(object) -- sets the container security context for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
+# for more details.
+#
+# To unset the security context, set it to `null` or `~`.
 securityContext: {}
 
+# resources(object) -- sets the resource requests/limits for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+# for more details.
 resources: {}
 
+# nodeSelector(object) -- sets the node selector for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
+# for more details.
 nodeSelector: {}
 
 # tls -- contains settings for mounting your own TLS material in the event-handler pod.
@@ -80,20 +267,60 @@ tls:
   #
   # You must create a secret containing the CA certs in the same namespace as Teleport using a command like:
   #
+  # ```code
   # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
-  #
-  #   The key containing the root CA in the secret must be `ca.pem`.
+  # ```
   existingCASecretName: ""
+  # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
+  # will be used as a trusted CA bundle file.
+  existingCASecretKeyName: "ca.pem"
 
+# tolerations(list) -- sets the tolerations for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+# for more details.
 tolerations: []
 
+# affinity(object) -- sets the affinities for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+# for more details.
 affinity: {}
 
+# volumes(list) -- sets the volumes mounted into the main event-handler pod.
+# See [the Kubernetes volume
+# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+# details.
+#
+# For example:
+# ```yaml
+# - name: storage
+#   persistentVolumeClaim:
+#     claimName: teleport-plugin-event-handler
+# ```
 volumes: []
-  # - name: storage
-  #   persistentVolumeClaim:
-  #     claimName: teleport-plugin-event-handler
 
+# volumeMounts(list) -- sets the volume mounts for the main event-handler container.
+# See [the Kubernetes volume
+# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+# details.
+#
+# For example:
+# ```yaml
+# - name: storage
+#   mountPath: "/var/lib/teleport/plugins/event-handler/storage"
+# ```
 volumeMounts: []
-  # - name: storage
-  #   mountPath: "/var/lib/teleport/plugins/event-handler/storage"
+
+# extraArgs(list) -- contains extra arguments to pass to `teleport-plugin start` for
+# the main event-handler container.
+extraArgs: []
+
+# extraEnv(list) -- contains extra environment variables to set in the main
+# event-handler container.
+#
+# For example:
+# ```yaml
+# extraEnv:
+#   - name: HTTPS_PROXY
+#     value: "http://username:password@my.proxy.host:3128"
+# ```
+extraEnv: []
diff --git a/examples/chart/tbot/.lint/argocd.yaml b/examples/chart/tbot/.lint/argocd.yaml
new file mode 100644
index 0000000000000..3a48349244b54
--- /dev/null
+++ b/examples/chart/tbot/.lint/argocd.yaml
@@ -0,0 +1,25 @@
+clusterName: "test.teleport.sh"
+teleportProxyAddress: "test.teleport.sh:443"
+token: "my-token"
+defaultOutput:
+  enabled: false
+argocd:
+  enabled: true
+  clusterSelectors:
+    - name: foo
+    - labels:
+        foo: bar
+  secretNamespace: my-namespace
+  secretLabels:
+    baz: qux
+    cluster-region: |-
+      {{index .Labels "region"}}
+  secretAnnotations:
+    chunky: bacon
+  project: my-argo-project
+  namespaces:
+    - dev
+    - prod
+  clusterResources: true
+  clusterNameTemplate: |-
+    {{.KubeName}}-{{index .Labels "region"}}
diff --git a/examples/chart/tbot/.lint/full.yaml b/examples/chart/tbot/.lint/full.yaml
index 6e555c8a9a726..6e7a0a1711588 100644
--- a/examples/chart/tbot/.lint/full.yaml
+++ b/examples/chart/tbot/.lint/full.yaml
@@ -109,3 +109,7 @@ securityContext:
   runAsUser: 9807
   seccompProfile:
     type: RuntimeDefault
+
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 3000
diff --git a/examples/chart/tbot/.lint/simple.yaml b/examples/chart/tbot/.lint/simple.yaml
index 4dd982e168097..9960f8f9f0c0f 100644
--- a/examples/chart/tbot/.lint/simple.yaml
+++ b/examples/chart/tbot/.lint/simple.yaml
@@ -1,5 +1,3 @@
 clusterName: "test.teleport.sh"
 teleportProxyAddress: "test.teleport.sh:443"
-defaultOutput:
-  secretName: "test-output"
 token: "my-token"
diff --git a/examples/chart/tbot/Chart.yaml b/examples/chart/tbot/Chart.yaml
index 572025c41c937..c5d0cb3a77eaa 100644
--- a/examples/chart/tbot/Chart.yaml
+++ b/examples/chart/tbot/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 name: tbot
 apiVersion: v2
diff --git a/examples/chart/tbot/README.md b/examples/chart/tbot/README.md
index c775de6784830..cd5cd523d9235 100644
--- a/examples/chart/tbot/README.md
+++ b/examples/chart/tbot/README.md
@@ -19,13 +19,11 @@ you use the `token` join method with this chart.
 ### Basic configuration
 
 This basic configuration will write a Teleport identity file to a secret in
-the deployment namespace called `test-output`.
+the deployment namespace called `<helm-release-name>-out`. For example `tbot-out`.
 
 ```yaml
 clusterName: "test.teleport.sh"
 teleportProxyAddress: "test.teleport.sh:443"
-defaultOutput:
-  secretName: "test-output"
 token: "my-token"
 ```
 
diff --git a/examples/chart/tbot/templates/_config.tpl b/examples/chart/tbot/templates/_config.tpl
index d8c9aff491862..3cdecd2ca9bd5 100644
--- a/examples/chart/tbot/templates/_config.tpl
+++ b/examples/chart/tbot/templates/_config.tpl
@@ -31,7 +31,7 @@ storage:
 {{- else }}
   {{- required "'persistence' must be 'secret' or 'disabled'" "" }}
 {{- end }}
-{{- if or (.Values.defaultOutput.enabled) (.Values.outputs) }}
+{{- if or (.Values.defaultOutput.enabled) (.Values.argocd.enabled) (.Values.outputs) }}
 outputs:
 {{- if .Values.defaultOutput.enabled }}
   - type: identity
@@ -39,6 +39,39 @@ outputs:
       type: kubernetes_secret
       name: {{ include "tbot.defaultOutputName" . }}
 {{- end }}
+{{- if .Values.argocd.enabled }}
+  - type: kubernetes/argo-cd
+    {{- if .Values.argocd.clusterSelectors }}
+    selectors:
+        {{- toYaml .Values.argocd.clusterSelectors | nindent 8 }}
+    {{- else }}
+        {{- required "'argocd.clusterSelectors' must be provided if `argocd.enabled' is true" "" }}
+    {{- end }}
+    {{- if .Values.argocd.secretNamespace }}
+    secret_namespace: {{ .Values.argocd.secretNamespace }}
+    {{- end }}
+    {{- if .Values.argocd.secretLabels }}
+    secret_labels:
+        {{- toYaml .Values.argocd.secretLabels | nindent 8 }}
+    {{- end }}
+    {{- if .Values.argocd.secretAnnotations }}
+    secret_annotations:
+        {{- toYaml .Values.argocd.secretAnnotations | nindent 8 }}
+    {{- end }}
+    {{- if .Values.argocd.project }}
+    project: {{ .Values.argocd.project }}
+    {{- end }}
+    {{- if .Values.argocd.namespaces }}
+    namespaces:
+        {{- toYaml .Values.argocd.namespaces | nindent 8 }}
+    {{- end }}
+    {{- if .Values.argocd.clusterResources }}
+    cluster_resources: {{ .Values.argocd.clusterResources }}
+    {{- end }}
+    {{- if .Values.argocd.clusterNameTemplate }}
+    cluster_name_template: {{ .Values.argocd.clusterNameTemplate | quote }}
+    {{- end }}
+{{- end }}
 {{- if .Values.outputs }}
 {{- toYaml .Values.outputs | nindent 2}}
 {{- end }}
diff --git a/examples/chart/tbot/templates/deployment.yaml b/examples/chart/tbot/templates/deployment.yaml
index 64270a303e113..e98cf3bd2da26 100644
--- a/examples/chart/tbot/templates/deployment.yaml
+++ b/examples/chart/tbot/templates/deployment.yaml
@@ -46,6 +46,9 @@ spec:
     {{- end }}
     {{- if .Values.tolerations }}
       tolerations: {{- toYaml .Values.tolerations | nindent 8 }}
+    {{- end }}
+    {{- if .Values.podSecurityContext }}
+      securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
     {{- end }}
       containers:
         - name: tbot
diff --git a/examples/chart/tbot/tests/__snapshot__/config_test.yaml.snap b/examples/chart/tbot/tests/__snapshot__/config_test.yaml.snap
index 2dbfb81532f58..f0932195f00c1 100644
--- a/examples/chart/tbot/tests/__snapshot__/config_test.yaml.snap
+++ b/examples/chart/tbot/tests/__snapshot__/config_test.yaml.snap
@@ -25,6 +25,41 @@ it should match the snapshot (custom):
     metadata:
       name: RELEASE-NAME-tbot
       namespace: NAMESPACE
+should match the snapshot (argocd):
+  1: |
+    apiVersion: v1
+    data:
+      tbot.yaml: |-
+        onboarding:
+          join_method: kubernetes
+          token: my-token
+        outputs:
+        - cluster_name_template: '{{.KubeName}}-{{index .Labels "region"}}'
+          cluster_resources: true
+          namespaces:
+          - dev
+          - prod
+          project: my-argo-project
+          secret_annotations:
+            chunky: bacon
+          secret_labels:
+            baz: qux
+            cluster-region: '{{index .Labels "region"}}'
+          secret_namespace: my-namespace
+          selectors:
+          - name: foo
+          - labels:
+              foo: bar
+          type: kubernetes/argo-cd
+        proxy_server: test.teleport.sh:443
+        storage:
+          name: RELEASE-NAME-tbot
+          type: kubernetes_secret
+        version: v2
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME-tbot
+      namespace: NAMESPACE
 should match the snapshot (full):
   1: |
     apiVersion: v1
diff --git a/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap
index 6f135fcee50ab..aba19ed2c7fb5 100644
--- a/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap
@@ -29,7 +29,7 @@ should match the snapshot (full):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: tbot
-            helm.sh/chart: tbot-18.0.0-dev
+            helm.sh/chart: tbot-18.6.1
             test-key: test-label-pod
         spec:
           affinity:
@@ -68,7 +68,7 @@ should match the snapshot (full):
               value: "1"
             - name: TEST_ENV
               value: test-value
-            image: public.ecr.aws/gravitational/tbot-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/tbot-distroless:18.6.1
             imagePullPolicy: Always
             livenessProbe:
               failureThreshold: 6
@@ -119,6 +119,9 @@ should match the snapshot (full):
           - name: test-pull-secret
           nodeSelector:
             test-key: test-node-selector
+          securityContext:
+            runAsGroup: 3000
+            runAsUser: 1000
           serviceAccountName: modified-sa-name
           tolerations:
           - effect: NoSchedule
@@ -164,7 +167,7 @@ should match the snapshot (simple):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: tbot
-            helm.sh/chart: tbot-18.0.0-dev
+            helm.sh/chart: tbot-18.6.1
         spec:
           containers:
           - args:
@@ -186,7 +189,7 @@ should match the snapshot (simple):
                   fieldPath: spec.nodeName
             - name: KUBERNETES_TOKEN_PATH
               value: /var/run/secrets/tokens/join-sa-token
-            image: public.ecr.aws/gravitational/tbot-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/tbot-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             livenessProbe:
               failureThreshold: 6
diff --git a/examples/chart/tbot/tests/config_test.yaml b/examples/chart/tbot/tests/config_test.yaml
index 6db9a736bf1bc..313baa79abb1d 100644
--- a/examples/chart/tbot/tests/config_test.yaml
+++ b/examples/chart/tbot/tests/config_test.yaml
@@ -29,3 +29,8 @@ tests:
               path: /buzz
     asserts:
       - matchSnapshot: {}
+  - it: should match the snapshot (argocd)
+    values:
+      - ../.lint/argocd.yaml
+    asserts:
+      - matchSnapshot: {}
diff --git a/examples/chart/tbot/values.yaml b/examples/chart/tbot/values.yaml
index c0e4b69139b72..765a8efba838a 100644
--- a/examples/chart/tbot/values.yaml
+++ b/examples/chart/tbot/values.yaml
@@ -18,7 +18,7 @@ fullnameOverride: ""
 # Connecting to the Proxy Service is the most common and recommended way to connect to Teleport.
 # This is mandatory to connect to Teleport Enterprise (Cloud)
 #
-# This setting is mutually exclusive with teleportProxyAddress and is ignored if `customConfig` is set.
+# This setting is mutually exclusive with teleportProxyAddress and is ignored if `tbotConfig` is set.
 #
 # For example:
 # ```yaml
@@ -31,7 +31,7 @@ teleportProxyAddress: ""
 # Helm release and have direct access to the Auth Service.
 # Else, you should prefer connecting via the Proxy Service.
 #
-# This setting is mutually exclusive with teleportProxyAddress and is ignored if `customConfig` is set.
+# This setting is mutually exclusive with teleportProxyAddress and is ignored if `tbotConfig` is set.
 #
 # For example:
 # ```yaml
@@ -40,11 +40,71 @@ teleportProxyAddress: ""
 teleportAuthAddress: ""
 
 # defaultOutput -- controls the default output configured for the tbot agent.
-# Ignored if `customConfig` is set.
+# Ignored if `tbotConfig` is set.
 defaultOutput:
   # defaultOutput.enabled(bool) -- controls whether the default output is enabled.
   enabled: true
 
+# argocd -- configures tbot to synchronize Teleport-managed Kubernetes clusters
+# to Argo CD.
+# Ignored if `tbotConfig` is set.
+argocd:
+  # argocd.enabled(bool) -- controls whether the Argo CD output is enabled.
+  enabled: false
+  # argocd.clusterSelectors(list) -- determines which Kubernetes clusters will
+  # be synchronized to Argo CD.
+  #
+  # For example:
+  # ```yaml
+  # clusterSelectors:
+  #   - name: my-cluster-1
+  #   - labels:
+  #       environment: production
+  # ```
+  clusterSelectors: []
+  # argocd.secretNamespace(string) -- determines to which Kubernetes namespace
+  # cluster secrets will be written (it must be the namespace in which Argo CD
+  # is running). Defaults to the current namespace.
+  secretNamespace: ""
+  # argocd.secretNamePrefix(string) -- overrides the string that cluster secret
+  # names will be prefixed with. Defaults to "teleport.argocd-cluster".
+  secretNamePrefix: ""
+  # argocd.secretLabels(object) -- provides a set of labels that will be applied
+  # to cluster secrets. Label values can be Go template strings (rendered by tbot,
+  # not Helm) with the following variables:
+  #
+  #   - \{\{.ClusterName\}\} - Name of the Teleport cluster
+  #   - \{\{.KubeName\}\} - Name of the Kubernetes cluster resource
+  #   - \{\{.Labels\}\} - Map of labels applied to the Kubernetes cluster
+  #     resource that can be indexed using `\{\{index .Labels "key"\}\}`
+  #
+  # If the label value is empty, the label will not be added to the secret.
+  secretLabels: {}
+  # argocd.secretAnnotations(object) -- provides a set of annotations that will
+  # be applied to cluster secrets.
+  secretAnnotations: {}
+  # argocd.project(string) -- sets the Argo CD project with which the Kubernetes
+  # clusters will be associated.
+  project: ""
+  # argocd.namespaces(list) -- controls which Kubernetes namespaces the Argo CD
+  # clusters will be allowed to operate on.
+  namespaces: []
+  # argocd.clusterResources(bool) -- determines whether the Argo CD cluster is
+  # allowed to operate on cluster-scoped resources (only when `argocd.namespaces`
+  # is non-empty).
+  clusterResources: false
+  # argocd.clusterNameTemplate(string) -- determines the format of cluster names
+  # in Argo CD. It is a Go template string (rendered by tbot, not Helm) that
+  # supports the following variables:
+  #
+  #   - \{\{.ClusterName\}\} - Name of the Teleport cluster
+  #   - \{\{.KubeName\}\} - Name of the Kubernetes cluster resource
+  #   - \{\{.Labels\}\} - Map of labels applied to the Kubernetes cluster
+  #     resource that can be indexed using `\{\{index .Labels "key"\}\}`
+  #
+  # By default, the following template will be used: "\{\{.ClusterName\}\}-\{\{.KubeName\}\}".
+  clusterNameTemplate: ""
+
 # persistence -- controls how the tbot agent stores its data.
 #
 # Options:
@@ -61,22 +121,22 @@ tbotConfig: {}
 
 # outputs(list) -- contains additional outputs to configure for the tbot agent.
 # These should be in the same format as the `outputs` field in the tbot.yaml.
-# Ignored if `customConfig` is set.
+# Ignored if `tbotConfig` is set.
 outputs: []
 
 # services(list) -- contains additional services to configure for the tbot agent.
 # These should be in the same format as the `services` field in the tbot.yaml.
-# Ignored if `customConfig` is set.
+# Ignored if `tbotConfig` is set.
 services: []
 
 # joinMethod(string) -- describes how tbot joins the Teleport cluster.
-# See [the join method reference](../../reference/join-methods.mdx) for a list fo supported values and detailed explanations.
-# Ignored if `customConfig` is set.
+# See [the join method reference](../../reference/deployment/join-methods.mdx) for a list of supported values and detailed explanations.
+# Ignored if `tbotConfig` is set.
 joinMethod: "kubernetes"
 
 # token(string) -- is the name of the token used by tbot to join the Teleport cluster.
 # This value is not sensitive unless the `joinMethod` is set to `"token"`.
-# Ignored if `customConfig` is set.
+# Ignored if `tbotConfig` is set.
 token: ""
 
 # teleportVersionOverride(string) -- controls the tbot image version deployed by
@@ -242,3 +302,10 @@ extraEnv: []
 #
 # By default, this is unset.
 securityContext: null
+
+# podSecurityContext(object) -- sets the pod security context for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+# for more details.
+#
+# By default, this is unset.
+podSecurityContext: null
diff --git a/examples/chart/teleport-cluster/.lint/existing-tls-secret-with-ca.yaml b/examples/chart/teleport-cluster/.lint/existing-tls-secret-with-ca.yaml
index 086c628b0e8f0..9a99cb5f0097c 100644
--- a/examples/chart/teleport-cluster/.lint/existing-tls-secret-with-ca.yaml
+++ b/examples/chart/teleport-cluster/.lint/existing-tls-secret-with-ca.yaml
@@ -2,3 +2,4 @@ clusterName: test-cluster-name
 tls:
   existingSecretName: helm-lint-existing-tls-secret
   existingCASecretName: helm-lint-existing-tls-secret-ca
+  existingCASecretKeyName: helm-lint-existing-tls-secret-key-name
diff --git a/examples/chart/teleport-cluster/Chart.yaml b/examples/chart/teleport-cluster/Chart.yaml
index f9f5e800d3714..6b91b21d3c09e 100644
--- a/examples/chart/teleport-cluster/Chart.yaml
+++ b/examples/chart/teleport-cluster/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 name: teleport-cluster
 apiVersion: v2
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/.lint/existing-tls-ca.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/existing-tls-ca.yaml
index 354a5e26475b8..aa33234e9d584 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/.lint/existing-tls-ca.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/existing-tls-ca.yaml
@@ -1,5 +1,6 @@
 tls:
   existingCASecretName: helm-lint-existing-tls-secret-ca
+  existingCASecretKeyName: helm-lint-existing-tls-secret-key-name
 
 teleportAddress: "teleport.example.com:3080"
 token: "my-operator-bot"
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-args.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-args.yaml
new file mode 100644
index 0000000000000..37c3b7f61e8ef
--- /dev/null
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-args.yaml
@@ -0,0 +1,6 @@
+extraArgs:
+  - "--namespace"
+  - "teleport"
+teleportAddress: "example.teleport.sh:443"
+token: "my-operator-bot"
+teleportClusterName: "example.teleport.sh"
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-env.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-env.yaml
new file mode 100644
index 0000000000000..fd1d6ea8dac0b
--- /dev/null
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/.lint/extra-env.yaml
@@ -0,0 +1,6 @@
+extraEnv:
+  - name: SOME_ENVIRONMENT_VARIABLE
+    value: "some-value"
+teleportAddress: "example.teleport.sh:443"
+token: "my-operator-bot"
+teleportClusterName: "example.teleport.sh"
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
index 0cdeac0816dcc..20f8c2709f47e 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 name: teleport-operator
 apiVersion: v2
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_accesslists.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_accesslists.yaml
index 2c595617b69d3..5307894f3066a 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_accesslists.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_accesslists.yaml
@@ -190,6 +190,11 @@ spec:
                 description: title is a plaintext short description of the Access
                   List.
                 type: string
+              type:
+                description: type can be an empty string which denotes a regular Access
+                  List, "scim" which represents an Access List created from SCIM group
+                  or "static" for Access Lists managed by IaC tools.
+                type: string
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_appsv3.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_appsv3.yaml
new file mode 100644
index 0000000000000..e1feb5d38f100
--- /dev/null
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_appsv3.yaml
@@ -0,0 +1,353 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportappsv3.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportAppV3
+    listKind: TeleportAppV3List
+    plural: teleportappsv3
+    shortNames:
+    - appv3
+    - appsv3
+    singular: teleportappv3
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: AppV3 is the Schema for the appsv3 API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: App resource definition v3 from Teleport
+            properties:
+              UserGroups:
+                description: UserGroups are a list of user group IDs that this app
+                  is associated with.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              aws:
+                description: AWS contains additional options for AWS applications.
+                nullable: true
+                properties:
+                  external_id:
+                    description: ExternalID is the AWS External ID used when assuming
+                      roles in this app.
+                    type: string
+                  roles_anywhere_profile:
+                    description: RolesAnywhereProfile contains the IAM Roles Anywhere
+                      fields associated with this Application. These fields are set
+                      when performing the synchronization of AWS IAM Roles Anywhere
+                      Profiles into Teleport Apps.
+                    nullable: true
+                    properties:
+                      accept_role_session_name:
+                        description: 'Whether this Roles Anywhere Profile accepts
+                          a custom role session name. When not supported, the AWS
+                          Session Name will be the X.509 certificate''s serial number.
+                          When supported, the AWS Session Name will be the identity''s
+                          username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html
+                          / acceptRoleSessionName'
+                        type: boolean
+                      profile_arn:
+                        description: ProfileARN is the AWS IAM Roles Anywhere Profile
+                          ARN that originated this Teleport App.
+                        type: string
+                    type: object
+                type: object
+              cloud:
+                description: Cloud identifies the cloud instance the app represents.
+                type: string
+              cors:
+                description: CORSPolicy defines the Cross-Origin Resource Sharing
+                  settings for the app.
+                nullable: true
+                properties:
+                  allow_credentials:
+                    description: allow_credentials indicates whether credentials are
+                      allowed.
+                    type: boolean
+                  allowed_headers:
+                    description: allowed_headers specifies which headers can be used
+                      when accessing the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  allowed_methods:
+                    description: allowed_methods specifies which methods are allowed
+                      when accessing the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  allowed_origins:
+                    description: allowed_origins specifies which origins are allowed
+                      to access the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  exposed_headers:
+                    description: exposed_headers indicates which headers are made
+                      available to scripts via the browser.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  max_age:
+                    description: max_age indicates how long (in seconds) the results
+                      of a preflight request can be cached.
+                    format: int32
+                    type: integer
+                type: object
+              dynamic_labels:
+                description: DynamicLabels are the app's command labels.
+                properties:
+                  key:
+                    type: string
+                  value:
+                    nullable: true
+                    properties:
+                      command:
+                        description: Command is a command to run
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      period:
+                        description: Period is a time between command runs
+                        format: duration
+                        type: string
+                      result:
+                        description: Result captures standard output
+                        type: string
+                    type: object
+                type: object
+              identity_center:
+                description: IdentityCenter encasulates AWS identity-center specific
+                  information. Only valid for Identity Center account apps.
+                nullable: true
+                properties:
+                  account_id:
+                    description: Account ID is the AWS-assigned ID of the account
+                    type: string
+                  permission_sets:
+                    description: PermissionSets lists the available permission sets
+                      on the given account
+                    items:
+                      properties:
+                        arn:
+                          description: ARN is the fully-formed ARN of the Permission
+                            Set.
+                          type: string
+                        assignment_name:
+                          description: AssignmentID is the ID of the Teleport Account
+                            Assignment resource that represents this permission being
+                            assigned on the enclosing Account.
+                          type: string
+                        name:
+                          description: Name is the human-readable name of the Permission
+                            Set.
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                type: object
+              insecure_skip_verify:
+                description: InsecureSkipVerify disables app's TLS certificate verification.
+                type: boolean
+              integration:
+                description: Integration is the integration name that must be used
+                  to access this Application. Only applicable to AWS App Access. If
+                  present, the Application must use the Integration's credentials
+                  instead of ambient credentials to access Cloud APIs.
+                type: string
+              mcp:
+                description: MCP contains MCP server related configurations.
+                nullable: true
+                properties:
+                  args:
+                    description: Args to execute with the command.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  command:
+                    description: Command to launch stdio-based MCP servers.
+                    type: string
+                  run_as_host_user:
+                    description: RunAsHostUser is the host user account under which
+                      the command will be executed. Required for stdio-based MCP servers.
+                    type: string
+                type: object
+              public_addr:
+                description: PublicAddr is the public address the application is accessible
+                  at.
+                type: string
+              required_app_names:
+                description: RequiredAppNames is a list of app names that are required
+                  for this app to function. Any app listed here will be part of the
+                  authentication redirect flow and authenticate along side this app.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              rewrite:
+                description: Rewrite is a list of rewriting rules to apply to requests
+                  and responses.
+                nullable: true
+                properties:
+                  headers:
+                    description: Headers is a list of headers to inject when passing
+                      the request over to the application.
+                    items:
+                      properties:
+                        name:
+                          description: Name is the http header name.
+                          type: string
+                        value:
+                          description: Value is the http header value.
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                  jwt_claims:
+                    description: JWTClaims configures whether roles/traits are included
+                      in the JWT token.
+                    type: string
+                  redirect:
+                    description: Redirect defines a list of hosts which will be rewritten
+                      to the public address of the application if they occur in the
+                      "Location" header.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                type: object
+              tcp_ports:
+                description: TCPPorts is a list of ports and port ranges that an app
+                  agent can forward connections to. Only applicable to TCP App Access.
+                  If this field is not empty, URI is expected to contain no port number
+                  and start with the tcp protocol.
+                items:
+                  properties:
+                    end_port:
+                      description: EndPort describes the end of the range, inclusive.
+                        If set, it must be between 2 and 65535 and be greater than
+                        Port when describing a port range. When omitted or set to
+                        zero, it signifies that the port range defines a single port.
+                      format: int32
+                      type: integer
+                    port:
+                      description: Port describes the start of the range. It must
+                        be between 1 and 65535.
+                      format: int32
+                      type: integer
+                  type: object
+                nullable: true
+                type: array
+              uri:
+                description: URI is the web app endpoint.
+                type: string
+              use_any_proxy_public_addr:
+                description: UseAnyProxyPublicAddr will rebuild this app's fqdn based
+                  on the proxy public addr that the request originated from. This
+                  should be true if your proxy has multiple proxy public addrs and
+                  you want the app to be accessible from any of them. If `public_addr`
+                  is explicitly set in the app spec, setting this value to true will
+                  overwrite that public address in the web UI.
+                type: boolean
+            type: object
+          status:
+            description: Status defines the observed state of the Teleport resource
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateconfigsv1.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateconfigsv1.yaml
index f56da0ee7c415..8aaeff1d116ca 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateconfigsv1.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateconfigsv1.yaml
@@ -60,6 +60,15 @@ spec:
                         description: regular schedules for non-critical versions.
                         items:
                           properties:
+                            canary_count:
+                              description: canary_count is the number of canary agents
+                                that will be updated before the whole group is updated.
+                                when set to 0, the group does not enter the canary
+                                phase. This number is capped to 5. This number must
+                                always be lower than the total number of agents in
+                                the group, else the rollout will be stuck.
+                              format: int32
+                              type: integer
                             days:
                               description: days when the update can run. Supported
                                 values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat",
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateversionsv1.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateversionsv1.yaml
index dc35ecbd7a1b7..63a35618df0b9 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateversionsv1.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_autoupdateversionsv1.yaml
@@ -46,10 +46,12 @@ spec:
                     description: schedule to use for the rollout
                     type: string
                   start_version:
-                    description: start_version is the version to update from.
+                    description: start_version is the version used for newly installed
+                      agents before their update window.
                     type: string
                   target_version:
-                    description: target_version is the version to update to.
+                    description: target_version is the version that all agents will
+                      update to during their update window.
                     type: string
                 type: object
               tools:
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_databasesv3.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_databasesv3.yaml
new file mode 100644
index 0000000000000..e80b0a9e6ba4b
--- /dev/null
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_databasesv3.yaml
@@ -0,0 +1,495 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportdatabasesv3.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportDatabaseV3
+    listKind: TeleportDatabaseV3List
+    plural: teleportdatabasesv3
+    shortNames:
+    - databasev3
+    - databasesv3
+    singular: teleportdatabasev3
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: DatabaseV3 is the Schema for the databasesv3 API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Database resource definition v3 from Teleport
+            properties:
+              ad:
+                description: AD is the Active Directory configuration for the database.
+                properties:
+                  domain:
+                    description: Domain is the Active Directory domain the database
+                      resides in.
+                    type: string
+                  kdc_host_name:
+                    description: KDCHostName is the host name for a KDC for x509 Authentication.
+                    type: string
+                  keytab_file:
+                    description: KeytabFile is the path to the Kerberos keytab file.
+                    type: string
+                  krb5_file:
+                    description: Krb5File is the path to the Kerberos configuration
+                      file. Defaults to /etc/krb5.conf.
+                    type: string
+                  ldap_cert:
+                    description: LDAPCert is a certificate from Windows LDAP/AD, optional;
+                      only for x509 Authentication.
+                    type: string
+                  ldap_service_account_name:
+                    description: LDAPServiceAccountName is the name of service account
+                      for performing LDAP queries. Required for x509 Auth / PKINIT.
+                    type: string
+                  ldap_service_account_sid:
+                    description: LDAPServiceAccountSID is the SID of service account
+                      for performing LDAP queries. Required for x509 Auth / PKINIT.
+                    type: string
+                  spn:
+                    description: SPN is the service principal name for the database.
+                    type: string
+                type: object
+              admin_user:
+                description: AdminUser is the database admin user for automatic user
+                  provisioning.
+                nullable: true
+                properties:
+                  default_database:
+                    description: DefaultDatabase is the database that the privileged
+                      database user logs into by default.  Depending on the database
+                      type, this database may be used to store procedures or data
+                      for managing database users.
+                    type: string
+                  name:
+                    description: Name is the username of the privileged database user.
+                    type: string
+                type: object
+              aws:
+                description: AWS contains AWS specific settings for RDS/Aurora/Redshift
+                  databases.
+                properties:
+                  account_id:
+                    description: AccountID is the AWS account ID this database belongs
+                      to.
+                    type: string
+                  assume_role_arn:
+                    description: AssumeRoleARN is an optional AWS role ARN to assume
+                      when accessing a database. Set this field and ExternalID to
+                      enable access across AWS accounts.
+                    type: string
+                  docdb:
+                    description: DocumentDB contains Amazon DocumentDB-specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the cluster identifier.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      instance_id:
+                        description: InstanceID is the instance identifier.
+                        type: string
+                    type: object
+                  elasticache:
+                    description: ElastiCache contains Amazon ElastiCache Redis-specific
+                      metadata.
+                    properties:
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      replication_group_id:
+                        description: ReplicationGroupID is the Redis replication group
+                          ID.
+                        type: string
+                      transit_encryption_enabled:
+                        description: TransitEncryptionEnabled indicates whether in-transit
+                          encryption (TLS) is enabled.
+                        type: boolean
+                      user_group_ids:
+                        description: UserGroupIDs is a list of user group IDs.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
+                  elasticache_serverless:
+                    description: ElastiCacheServerless contains Amazon ElastiCache
+                      Serverless metadata.
+                    properties:
+                      cache_name:
+                        description: CacheName is an ElastiCache Serverless cache
+                          name.
+                        type: string
+                    type: object
+                  external_id:
+                    description: ExternalID is an optional AWS external ID used to
+                      enable assuming an AWS role across accounts.
+                    type: string
+                  iam_policy_status:
+                    description: 'IAMPolicyStatus indicates whether the IAM Policy
+                      is configured properly for database access. If not, the user
+                      must update the AWS profile identity to allow access to the
+                      Database. Eg for an RDS Database: the underlying AWS profile
+                      allows for `rds-db:connect` for the Database.'
+                    x-kubernetes-int-or-string: true
+                  memorydb:
+                    description: MemoryDB contains AWS MemoryDB specific metadata.
+                    properties:
+                      acl_name:
+                        description: ACLName is the name of the ACL associated with
+                          the cluster.
+                        type: string
+                      cluster_name:
+                        description: ClusterName is the name of the MemoryDB cluster.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      tls_enabled:
+                        description: TLSEnabled indicates whether in-transit encryption
+                          (TLS) is enabled.
+                        type: boolean
+                    type: object
+                  opensearch:
+                    description: OpenSearch contains AWS OpenSearch specific metadata.
+                    properties:
+                      domain_id:
+                        description: DomainID is the ID of the domain.
+                        type: string
+                      domain_name:
+                        description: DomainName is the name of the domain.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                    type: object
+                  rds:
+                    description: RDS contains RDS specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the RDS cluster (Aurora) identifier.
+                        type: string
+                      iam_auth:
+                        description: IAMAuth indicates whether database IAM authentication
+                          is enabled.
+                        type: boolean
+                      instance_id:
+                        description: InstanceID is the RDS instance identifier.
+                        type: string
+                      resource_id:
+                        description: ResourceID is the RDS instance resource identifier
+                          (db-xxx).
+                        type: string
+                      security_groups:
+                        description: SecurityGroups is a list of attached security
+                          groups for the RDS instance.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      subnets:
+                        description: Subnets is a list of subnets for the RDS instance.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      vpc_id:
+                        description: VPCID is the VPC where the RDS is running.
+                        type: string
+                    type: object
+                  rdsproxy:
+                    description: RDSProxy contains AWS Proxy specific metadata.
+                    properties:
+                      custom_endpoint_name:
+                        description: CustomEndpointName is the identifier of an RDS
+                          Proxy custom endpoint.
+                        type: string
+                      name:
+                        description: Name is the identifier of an RDS Proxy.
+                        type: string
+                      resource_id:
+                        description: ResourceID is the RDS instance resource identifier
+                          (prx-xxx).
+                        type: string
+                    type: object
+                  redshift:
+                    description: Redshift contains Redshift specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the Redshift cluster identifier.
+                        type: string
+                    type: object
+                  redshift_serverless:
+                    description: RedshiftServerless contains Amazon Redshift Serverless-specific
+                      metadata.
+                    properties:
+                      endpoint_name:
+                        description: EndpointName is the VPC endpoint name.
+                        type: string
+                      workgroup_id:
+                        description: WorkgroupID is the workgroup ID.
+                        type: string
+                      workgroup_name:
+                        description: WorkgroupName is the workgroup name.
+                        type: string
+                    type: object
+                  region:
+                    description: Region is a AWS cloud region.
+                    type: string
+                  secret_store:
+                    description: SecretStore contains secret store configurations.
+                    properties:
+                      key_prefix:
+                        description: KeyPrefix specifies the secret key prefix.
+                        type: string
+                      kms_key_id:
+                        description: KMSKeyID specifies the AWS KMS key for encryption.
+                        type: string
+                    type: object
+                  session_tags:
+                    description: SessionTags is a list of AWS STS session tags.
+                    nullable: true
+                    properties:
+                      key:
+                        type: string
+                      value:
+                        type: string
+                    type: object
+                type: object
+              azure:
+                description: Azure contains Azure specific database metadata.
+                properties:
+                  is_flexi_server:
+                    description: IsFlexiServer is true if the database is an Azure
+                      Flexible server.
+                    type: boolean
+                  name:
+                    description: Name is the Azure database server name.
+                    type: string
+                  redis:
+                    description: Redis contains Azure Cache for Redis specific database
+                      metadata.
+                    properties:
+                      clustering_policy:
+                        description: ClusteringPolicy is the clustering policy for
+                          Redis Enterprise.
+                        type: string
+                    type: object
+                  resource_id:
+                    description: ResourceID is the Azure fully qualified ID for the
+                      resource.
+                    type: string
+                type: object
+              ca_cert:
+                description: 'CACert is the PEM-encoded database CA certificate.  DEPRECATED:
+                  Moved to TLS.CACert. DELETE IN 10.0.'
+                type: string
+              dynamic_labels:
+                description: DynamicLabels is the database dynamic labels.
+                properties:
+                  key:
+                    type: string
+                  value:
+                    nullable: true
+                    properties:
+                      command:
+                        description: Command is a command to run
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      period:
+                        description: Period is a time between command runs
+                        format: duration
+                        type: string
+                      result:
+                        description: Result captures standard output
+                        type: string
+                    type: object
+                type: object
+              gcp:
+                description: GCP contains parameters specific to GCP Cloud SQL databases.
+                properties:
+                  alloydb:
+                    description: AlloyDB contains AlloyDB specific configuration elements.
+                    properties:
+                      endpoint_override:
+                        description: EndpointOverride is an override of endpoint address
+                          to use.
+                        type: string
+                      endpoint_type:
+                        description: 'EndpointType is the database endpoint type to
+                          use. Should be one of: "private", "public", "psc".'
+                        type: string
+                    type: object
+                  instance_id:
+                    description: InstanceID is the Cloud SQL instance ID.
+                    type: string
+                  project_id:
+                    description: ProjectID is the GCP project ID the Cloud SQL instance
+                      resides in.
+                    type: string
+                type: object
+              mongo_atlas:
+                description: MongoAtlas contains Atlas metadata about the database.
+                properties:
+                  name:
+                    description: Name is the Atlas database instance name.
+                    type: string
+                type: object
+              mysql:
+                description: MySQL is an additional section with MySQL database options.
+                properties:
+                  server_version:
+                    description: ServerVersion is the server version reported by DB
+                      proxy if the runtime information is not available.
+                    type: string
+                type: object
+              oracle:
+                description: Oracle is an additional Oracle configuration options.
+                properties:
+                  audit_user:
+                    description: AuditUser is the name of the Oracle database user
+                      that should be used to access the internal audit trail.
+                    type: string
+                  retry_count:
+                    description: RetryCount is the maximum number of times to retry
+                      connecting to a host upon failure. If not specified it defaults
+                      to 2, for a total of 3 connection attempts.
+                    format: int32
+                    type: integer
+                  shuffle_hostnames:
+                    description: ShuffleHostnames, when true, randomizes the order
+                      of hosts to connect to from the provided list.
+                    type: boolean
+                type: object
+              protocol:
+                description: 'Protocol is the database protocol: postgres, mysql,
+                  mongodb, etc.'
+                type: string
+              tls:
+                description: TLS is the TLS configuration used when establishing connection
+                  to target database. Allows to provide custom CA cert or override
+                  server name.
+                properties:
+                  ca_cert:
+                    description: CACert is an optional user provided CA certificate
+                      used for verifying database TLS connection.
+                    type: string
+                  mode:
+                    description: Mode is a TLS connection mode. 0 is "verify-full";
+                      1 is "verify-ca", 2 is "insecure".
+                    x-kubernetes-int-or-string: true
+                  server_name:
+                    description: ServerName allows to provide custom hostname. This
+                      value will override the servername/hostname on a certificate
+                      during validation.
+                    type: string
+                  trust_system_cert_pool:
+                    description: TrustSystemCertPool allows Teleport to trust certificate
+                      authorities available on the host system. If not set (by default),
+                      Teleport only trusts self-signed databases with TLS certificates
+                      signed by Teleport's Database Server CA or the ca_cert specified
+                      in this TLS setting. For cloud-hosted databases, Teleport downloads
+                      the corresponding required CAs for validation.
+                    type: boolean
+                type: object
+              uri:
+                description: URI is the database connection endpoint.
+                type: string
+            type: object
+          status:
+            description: Status defines the observed state of the Teleport resource
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_githubconnectors.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_githubconnectors.yaml
index 1832b3db75e21..0e59c787bdc41 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_githubconnectors.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_githubconnectors.yaml
@@ -99,6 +99,14 @@ spec:
                       type: string
                   type: object
                 type: array
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_oidcconnectors.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_oidcconnectors.yaml
index c3881a649fff2..f4026b004d413 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_oidcconnectors.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_oidcconnectors.yaml
@@ -96,6 +96,35 @@ spec:
               display:
                 description: Display is the friendly name for this provider.
                 type: string
+              entra_id_groups_provider:
+                description: EntraIDGroupsProvider configures out-of-band user groups
+                  provider. It works by following through the groups claim source,
+                  which is sent for the "groups" claim when the user's group membership
+                  exceeds 200 max item limit.
+                nullable: true
+                properties:
+                  disabled:
+                    description: Disabled specifies that the groups provider should
+                      be disabled even when Entra ID responds with a groups claim
+                      source. User may choose to disable it if they are using integrations
+                      such as SCIM or similar groups importer as connector based role
+                      mapping may be not needed in such a scenario.
+                    type: boolean
+                  graph_endpoint:
+                    description: GraphEndpoint is a Microsoft Graph API endpoint.
+                      The groups claim source endpoint provided by Entra ID points
+                      to the now-retired Azure AD Graph endpoint ("https://graph.windows.net").
+                      To convert it to the newer Microsoft Graph API endpoint, Teleport
+                      defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com").
+                      Update GraphEndpoint to point to a different Microsoft Graph
+                      national cloud deployment endpoint.
+                    type: string
+                  group_type:
+                    description: GroupType is a user group type filter. Defaults to
+                      "security-groups". Value can be "security-groups", "directory-roles",
+                      "all-groups".
+                    type: string
+                type: object
               google_admin_email:
                 description: GoogleAdminEmail is the email of a google admin to impersonate.
                 type: string
@@ -151,6 +180,15 @@ spec:
                       omits prompt. If not specified, it defaults to select_account
                       for backwards compatibility.
                     type: string
+                  request_object_mode:
+                    description: RequestObjectMode determines how JWT-Secured Authorization
+                      Requests will be used for authorization requests. JARs, or request
+                      objects, can provide integrity protection, source authentication,
+                      and confidentiality for authorization request parameters. If
+                      omitted, MFA flows will default to the `RequestObjectMode` behavior
+                      specified in the base OIDC connector. Set this property to 'none'
+                      to explicitly disable request objects for the MFA client.
+                    type: string
                 type: object
               pkce_mode:
                 description: PKCEMode represents the configuration state for PKCE
@@ -174,12 +212,26 @@ spec:
                 items:
                   type: string
                 type: array
+              request_object_mode:
+                description: RequestObjectMode determines how JWT-Secured Authorization
+                  Requests will be used for authorization requests. JARs, or request
+                  objects, can provide integrity protection, source authentication,
+                  and confidentiality for authorization request parameters.
+                type: string
               scope:
                 description: Scope specifies additional scopes set by provider.
                 items:
                   type: string
                 nullable: true
                 type: array
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
               username_claim:
                 description: UsernameClaim specifies the name of the claim from the
                   OIDC connector to be used as the user's username.
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_openssheiceserversv2.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_openssheiceserversv2.yaml
index bad8469a76fb6..5d4cdf65d5d56 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_openssheiceserversv2.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_openssheiceserversv2.yaml
@@ -123,6 +123,17 @@ spec:
                   type: string
                 nullable: true
                 type: array
+              relay_group:
+                description: the name of the Relay group that the server is connected
+                  to
+                type: string
+              relay_ids:
+                description: the list of Relay host IDs that the server is connected
+                  to
+                items:
+                  type: string
+                nullable: true
+                type: array
               rotation:
                 description: Rotation specifies server rotation
                 properties:
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_opensshserversv2.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_opensshserversv2.yaml
index fe3d76a8db7a4..8ffb3d954abba 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_opensshserversv2.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_opensshserversv2.yaml
@@ -122,6 +122,17 @@ spec:
                   type: string
                 nullable: true
                 type: array
+              relay_group:
+                description: the name of the Relay group that the server is connected
+                  to
+                type: string
+              relay_ids:
+                description: the list of Relay host IDs that the server is connected
+                  to
+                items:
+                  type: string
+                nullable: true
+                type: array
               rotation:
                 description: Rotation specifies server rotation
                 properties:
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_provisiontokens.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_provisiontokens.yaml
index 2d8522dc4007a..4a4a0757890fb 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_provisiontokens.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_provisiontokens.yaml
@@ -236,6 +236,42 @@ spec:
                   organization_id:
                     type: string
                 type: object
+              env0:
+                description: Env0 allows the configuration of options specific to
+                  the "env0" join method.
+                nullable: true
+                properties:
+                  allow:
+                    description: Allow is a list of Rules, jobs using this token must
+                      match at least one allow rule to use this token.
+                    items:
+                      properties:
+                        deployer_email:
+                          type: string
+                        deployment_type:
+                          type: string
+                        env0_tag:
+                          type: string
+                        environment_id:
+                          type: string
+                        environment_name:
+                          type: string
+                        organization_id:
+                          type: string
+                        project_id:
+                          type: string
+                        project_name:
+                          type: string
+                        template_id:
+                          type: string
+                        template_name:
+                          type: string
+                        workspace_name:
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                type: object
               gcp:
                 description: GCP allows the configuration of options specific to the
                   "gcp" join method.
@@ -398,6 +434,15 @@ spec:
                       type: object
                     nullable: true
                     type: array
+                  oidc:
+                    description: OIDCConfig configures the `oidc` type.
+                    nullable: true
+                    properties:
+                      insecure_allow_http_issuer:
+                        type: boolean
+                      issuer:
+                        type: string
+                    type: object
                   static_jwks:
                     description: StaticJWKS is the configuration specific to the `static_jwks`
                       type.
@@ -409,7 +454,8 @@ spec:
                   type:
                     description: 'Type controls which behavior should be used for
                       validating the Kubernetes Service Account token. Support values:
-                      - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.'
+                      - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults
+                      to `in_cluster`.'
                     type: string
                 type: object
               oracle:
@@ -422,6 +468,11 @@ spec:
                       must match one allow rule to use this token.
                     items:
                       properties:
+                        instances:
+                          items:
+                            type: string
+                          nullable: true
+                          type: array
                         parent_compartments:
                           items:
                             type: string
@@ -467,6 +518,10 @@ spec:
                       type: object
                     nullable: true
                     type: array
+                  enable_glob_matching:
+                    description: EnableGlobMatching enables glob-style matching for
+                      the space_id and caller_id fields in the rules.
+                    type: boolean
                   hostname:
                     description: Hostname is the hostname of the Spacelift tenant
                       that tokens will originate from. E.g `example.app.spacelift.io`
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_roles.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_roles.yaml
index 09ce2f3da3ba5..43e41b8a7e869 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_roles.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_roles.yaml
@@ -305,6 +305,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -390,6 +405,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -901,6 +922,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -986,6 +1022,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -1794,6 +1836,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -1879,6 +1936,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -2390,6 +2453,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -2475,6 +2553,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv6.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv6.yaml
index 512eee6828114..43f1050b40222 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv6.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv6.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv7.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv7.yaml
index e72c51466862f..b5e2aa56a82ef 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv7.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv7.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv8.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv8.yaml
index c4847df93f7f0..a7a0bbc1b7785 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv8.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv8.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_samlconnectors.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_samlconnectors.yaml
index caf7efa06472f..8b23b39d7cfb0 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_samlconnectors.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_samlconnectors.yaml
@@ -119,6 +119,12 @@ spec:
                 description: ForceAuthn specified whether re-authentication should
                   be forced on login. UNSPECIFIED is treated as NO.
                 x-kubernetes-int-or-string: true
+              include_subject:
+                description: 'IncludeSubject is a flag that indicates whether the
+                  Subject element is included in the SAML authentication request.
+                  Defaults to false. Note: Some IdPs will reject requests that contain
+                  a Subject.'
+                type: boolean
               issuer:
                 description: Issuer is the identity provider issuer.
                 type: string
@@ -197,6 +203,14 @@ spec:
               sso:
                 description: SSO is the URL of the identity provider's SSO service.
                 type: string
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/templates/_helpers.tpl b/examples/chart/teleport-cluster/charts/teleport-operator/templates/_helpers.tpl
index 3da8bedd4f967..317b85a5c7abb 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/templates/_helpers.tpl
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/templates/_helpers.tpl
@@ -66,7 +66,7 @@ teleport.dev/release: '{{ include "teleport-cluster.operator.namespacedRelease"
 {{- if empty $clusterAddr -}}
     {{- required "The `teleportAddress` value is mandatory when deploying a standalone operator." .Values.teleportAddress -}}
     {{- if and (eq .Values.joinMethod "kubernetes") (empty .Values.teleportClusterName) (not (hasSuffix ":3025" .Values.teleportAddress)) -}}
-        {{- fail "When joining using the Kubernetes JWKS join method, you must set the value `teleportClusterName`" -}}
+        {{- fail "When joining using the Kubernetes JWKS or OIDC join method, you must set the value `teleportClusterName`" -}}
     {{- end -}}
 {{- else -}}
     {{- $clusterAddr | printf "%s:3025" -}}
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/templates/deployment.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/templates/deployment.yaml
index ae0395a1c6bd8..d22e8beddf5c2 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/templates/deployment.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/templates/deployment.yaml
@@ -60,11 +60,17 @@ spec:
             - -ca-pin
             - '{{ join "," .Values.caPins }}'
   {{- end }}
-  {{- if or (.Values.tls.existingCASecretName) (.Values.teleportClusterName) }}
+  {{- if .Values.extraArgs }}
+            {{- toYaml .Values.extraArgs | nindent 12 }}
+  {{- end }}
+  {{- if or (.Values.tls.existingCASecretName) (.Values.teleportClusterName) (.Values.extraEnv)  }}
           env:
+    {{- if .Values.extraEnv }}
+          {{- toYaml .Values.extraEnv | nindent 12 }}
+    {{- end }}
     {{- if .Values.tls.existingCASecretName }}
             - name: SSL_CERT_FILE
-              value: /etc/teleport-tls-ca/ca.pem
+              value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
     {{- end }}
     {{- if .Values.teleportClusterName }}
             - name: KUBERNETES_TOKEN_PATH
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/templates/role.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/templates/role.yaml
index e6f073c7c0afa..7eb76a1200975 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/templates/role.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/templates/role.yaml
@@ -16,6 +16,8 @@ rules:
       - teleportrolesv6/status
       - teleportrolesv7
       - teleportrolesv7/status
+      - teleportrolesv8
+      - teleportrolesv8/status
       - teleportusers
       - teleportusers/status
       - teleportgithubconnectors
@@ -42,6 +44,14 @@ rules:
       - teleportbotsv1/status
       - teleportworkloadidentitiesv1
       - teleportworkloadidentitiesv1/status
+      - teleportautoupdateconfigsv1
+      - teleportautoupdateconfigsv1/status
+      - teleportautoupdateversionsv1
+      - teleportautoupdateversionsv1/status
+      - teleportappsv3
+      - teleportappsv3/status
+      - teleportdatabasesv3
+      - teleportdatabasesv3/status
     verbs:
       - get
       - list
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/tests/deployment_test.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/tests/deployment_test.yaml
index ca261d8056be4..5e4e004814d6e 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/tests/deployment_test.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/tests/deployment_test.yaml
@@ -98,7 +98,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
 
   - it: mounts tokens through projected volumes
     values:
@@ -216,3 +216,22 @@ tests:
           content:
             name: KUBERNETES_TOKEN_PATH
             value: /var/run/secrets/teleport/serviceaccount/token
+
+  - it: should set environment when extraEnv set in values
+    values:
+      - ../.lint/extra-env.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SOME_ENVIRONMENT_VARIABLE
+            value: "some-value"
+
+  - it: should set additional arguments when extraArgs set in values
+    values:
+      - ../.lint/extra-args.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "--namespace"
+
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/values.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/values.yaml
index f96b8ec1ab483..cf2081e32fafb 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/values.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/values.yaml
@@ -41,7 +41,7 @@ joinMethod: "kubernetes"
 
 # teleportClusterName(string) -- is the name of the joined Teleport cluster.
 # Setting this value is required when joining via the
-# [Kubernetes JWKS](../../reference/join-methods.mdx#kubernetes-jwks) join method.
+# [Kubernetes JWKS](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
 teleportClusterName: ""
 
 # token(string) -- is the name of the token used by the operator to join the Teleport cluster.
@@ -89,7 +89,7 @@ annotations:
   # put on the `Deployment` resource created by the chart.
   serviceAccount: {}
 
-# annotations --
+# labels --
 labels:
   # labels.deployment(object) -- contains the Kubernetes labels
   # put on the `Deployment` resource created by the chart.
@@ -129,6 +129,12 @@ rbac:
   # where the user deploying the operator is not allowed to edit RBAC resources.
   create: true
 
+# extraEnv(list) -- contains extra environment to be configured on the pod.
+extraEnv: []
+
+# extraArgs(list) -- contains extra arguments to pass to the operator
+extraArgs: []
+
 # imagePullPolicy(string) -- sets the pull policy for any pods created by the chart.
 # See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
 # for more details.
@@ -193,6 +199,9 @@ tls:
   # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
   # ```
   existingCASecretName: ""
+  # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
+  # will be used as a trusted CA bundle file.
+  existingCASecretKeyName: "ca.pem"
 
 # podSecurityContext(object) -- sets the pod security context for any pods created by the chart.
 # See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
diff --git a/examples/chart/teleport-cluster/templates/_quantity.tpl b/examples/chart/teleport-cluster/templates/_quantity.tpl
new file mode 100644
index 0000000000000..527f719a8d2b8
--- /dev/null
+++ b/examples/chart/teleport-cluster/templates/_quantity.tpl
@@ -0,0 +1,39 @@
+{{/* This template tries to parse a resource quantity like Kubernetes does.
+Helm sadly doesn't offer this critical primitive: https://github.com/helm/helm/issues/11376
+The quantity serialization format is described here: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go#L33
+
+This template support IEC, SI and decimal notation syntaxes, but has poor error handling.*/}}
+{{- define "teleport-cluster.resource-quantity" -}}
+    {{- $value := . -}}
+    {{- $unit := 1.0 -}}
+    {{- if typeIs "string" . -}}
+        {{- $base2 := dict "Ki" 0x1p10 "Mi" 0x1p20 "Gi" 0x1p30 "Ti" 0x1p40 "Pi" 0x1p50 "Ei" 0x1p60 -}}
+        {{- $base10 := dict "m" 1e-3 "k" 1e3 "M" 1e6 "G" 1e9 "T" 1e12 "P" 1e15 "E" 1e18 -}}
+        {{- range $k, $v := merge $base2 $base10 -}}
+            {{- if hasSuffix $k $ -}}
+                {{- $value = trimSuffix $k $ -}}
+                {{- $unit = $v -}}
+            {{- end -}}
+        {{- end -}}
+    {{- end -}}
+    {{- mulf (float64 $value) $unit -}}
+{{- end -}}
+
+{{/* This renders the GOMEMLIMIT env var unless the user already specified it
+in extraEnv, goMemLimitRatio is set to 0, or requests.memory.limit is unset.
+
+Important: unlike other templates, this should be called on $proxy or $auth instead of .*/}}
+{{- define "teleport-cluster.gomemlimit" -}}
+    {{- $alreadySet := false -}}
+    {{- range $_, $var := .extraEnv -}}
+        {{- if eq $var.name "GOMEMLIMIT" -}}
+            {{- $alreadySet = true -}}
+        {{- end -}}
+    {{- end -}}
+    {{- if and (not $alreadySet) .goMemLimitRatio -}}
+        {{- $ratio := .goMemLimitRatio -}}
+        {{- with .resources }}{{ with .limits }}{{ with .memory -}}
+            {{- include "teleport-cluster.resource-quantity" . | float64 | mulf $ratio | ceil | int -}}
+        {{- end }}{{ end }}{{ end -}}
+    {{- end -}}
+{{- end -}}
diff --git a/examples/chart/teleport-cluster/templates/auth/config.yaml b/examples/chart/teleport-cluster/templates/auth/config.yaml
index 355bf05b8db7d..1dfa1f995bead 100644
--- a/examples/chart/teleport-cluster/templates/auth/config.yaml
+++ b/examples/chart/teleport-cluster/templates/auth/config.yaml
@@ -66,6 +66,15 @@ data:
       name: operator
     spec:
       allow:
+        # The operator role can see all nodes.
+        # This is required to reconcile OpenSSH and OpenSSHEICE nodes.
+        # However, it has no login set, so it cannot SSH on them
+        node_labels:
+          "*": ["*"]
+        app_labels:
+          "*": ["*"]
+        db_labels:
+          "*": ["*"]
         rules:
           - resources:
               - role
@@ -155,6 +164,14 @@ data:
               - read
               - update
               - delete
+          - resources:
+              - app
+            verbs:
+              - list
+              - create
+              - read
+              - update
+              - delete
           - resources:
               - autoupdate_version
             verbs:
@@ -171,6 +188,14 @@ data:
               - read
               - update
               - delete
+          - resources:
+              - db
+            verbs:
+              - list
+              - create
+              - read
+              - update
+              - delete
       deny: {}
     version: v7
     ---
diff --git a/examples/chart/teleport-cluster/templates/auth/deployment.yaml b/examples/chart/teleport-cluster/templates/auth/deployment.yaml
index 5f03f38e7448b..43b12bf69bbce 100644
--- a/examples/chart/teleport-cluster/templates/auth/deployment.yaml
+++ b/examples/chart/teleport-cluster/templates/auth/deployment.yaml
@@ -157,14 +157,19 @@ spec:
       - name: "teleport"
         image: '{{ if $auth.enterprise }}{{ $auth.enterpriseImage }}{{ else }}{{ $auth.image }}{{ end }}:{{ include "teleport-cluster.version" . }}'
         imagePullPolicy: {{ $auth.imagePullPolicy }}
-        {{- if or $auth.extraEnv $auth.tls.existingCASecretName }}
+        {{- $gomemlimit := include "teleport-cluster.gomemlimit" $auth }}
+        {{- if or $auth.extraEnv $auth.tls.existingCASecretName $gomemlimit }}
         env:
+        {{- if $gomemlimit }}
+        - name: GOMEMLIMIT
+          value: {{ $gomemlimit | quote }}
+        {{- end }}
         {{- if (gt (len $auth.extraEnv) 0) }}
           {{- toYaml $auth.extraEnv | nindent 8 }}
         {{- end }}
         {{- if $auth.tls.existingCASecretName }}
         - name: SSL_CERT_FILE
-          value: /etc/teleport-tls-ca/ca.pem
+          value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
         {{- end }}
         {{- end }}
         args:
diff --git a/examples/chart/teleport-cluster/templates/auth/predeploy_job.yaml b/examples/chart/teleport-cluster/templates/auth/predeploy_job.yaml
index c557c718042c3..5dad87f0add70 100644
--- a/examples/chart/teleport-cluster/templates/auth/predeploy_job.yaml
+++ b/examples/chart/teleport-cluster/templates/auth/predeploy_job.yaml
@@ -39,10 +39,6 @@ spec:
       - name: "teleport-config-check"
         image: '{{ if $auth.enterprise }}{{ $auth.enterpriseImage }}{{ else }}{{ $auth.image }}{{ end }}:{{ include "teleport-cluster.version" . }}'
         imagePullPolicy: {{ $auth.imagePullPolicy }}
-{{- if $auth.resources }}
-        resources:
-  {{- toYaml $auth.resources | nindent 10 }}
-{{- end }}
 {{- if or $auth.extraEnv $auth.tls.existingCASecretName }}
         env:
   {{- if (gt (len $auth.extraEnv) 0) }}
@@ -50,7 +46,7 @@ spec:
   {{- end }}
   {{- if $auth.tls.existingCASecretName }}
         - name: SSL_CERT_FILE
-          value: /etc/teleport-tls-ca/ca.pem
+          value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
   {{- end }}
 {{- end }}
         command:
diff --git a/examples/chart/teleport-cluster/templates/proxy/deployment.yaml b/examples/chart/teleport-cluster/templates/proxy/deployment.yaml
index 0fd3e031750b7..052e566ac9a1f 100644
--- a/examples/chart/teleport-cluster/templates/proxy/deployment.yaml
+++ b/examples/chart/teleport-cluster/templates/proxy/deployment.yaml
@@ -176,14 +176,19 @@ spec:
       - name: "teleport"
         image: '{{ if $proxy.enterprise }}{{ $proxy.enterpriseImage }}{{ else }}{{ $proxy.image }}{{ end }}:{{ include "teleport-cluster.version" . }}'
         imagePullPolicy: {{ $proxy.imagePullPolicy }}
-        {{- if or $proxy.extraEnv $proxy.tls.existingCASecretName }}
+        {{- $gomemlimit := include "teleport-cluster.gomemlimit" $proxy }}
+        {{- if or $proxy.extraEnv $proxy.tls.existingCASecretName $gomemlimit }}
         env:
+        {{- if $gomemlimit }}
+        - name: GOMEMLIMIT
+          value: {{ $gomemlimit | quote }}
+        {{- end }}
         {{- if (gt (len $proxy.extraEnv) 0) }}
           {{- toYaml $proxy.extraEnv | nindent 8 }}
         {{- end }}
         {{- if $proxy.tls.existingCASecretName }}
         - name: SSL_CERT_FILE
-          value: /etc/teleport-tls-ca/ca.pem
+          value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
         {{- end }}
         {{- end }}
         args:
diff --git a/examples/chart/teleport-cluster/templates/proxy/predeploy_job.yaml b/examples/chart/teleport-cluster/templates/proxy/predeploy_job.yaml
index 4484d9cadc095..e059f84ea9741 100644
--- a/examples/chart/teleport-cluster/templates/proxy/predeploy_job.yaml
+++ b/examples/chart/teleport-cluster/templates/proxy/predeploy_job.yaml
@@ -39,10 +39,6 @@ spec:
       - name: "teleport"
         image: '{{ if $proxy.enterprise }}{{ $proxy.enterpriseImage }}{{ else }}{{ $proxy.image }}{{ end }}:{{ include "teleport-cluster.version" . }}'
         imagePullPolicy: {{ $proxy.imagePullPolicy }}
-{{- if $proxy.resources }}
-        resources:
-  {{- toYaml $proxy.resources | nindent 10 }}
-{{- end }}
 {{- if or $proxy.extraEnv $proxy.tls.existingCASecretName }}
         env:
   {{- if (gt (len $proxy.extraEnv) 0) }}
@@ -50,7 +46,7 @@ spec:
   {{- end }}
   {{- if $proxy.tls.existingCASecretName }}
         - name: SSL_CERT_FILE
-          value: /etc/teleport-tls-ca/ca.pem
+          value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
   {{- end }}
 {{- end }}
         command:
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
index 6ccb7b5467fce..0537ee7a81b42 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
@@ -8,8 +8,8 @@ adds operator permissions to ClusterRole:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-cluster
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-cluster-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-cluster-18.6.1
         teleport.dev/majorVersion: "18"
       name: RELEASE-NAME
     rules:
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
index 759e2ea31d60a..10a7c4d2b6431 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
@@ -2040,8 +2040,8 @@ sets clusterDomain on Configmap:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-cluster
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-cluster-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-cluster-18.6.1
         teleport.dev/majorVersion: "18"
       name: RELEASE-NAME-auth
       namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
index 141bad103be51..6eccdafd31f92 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
@@ -8,7 +8,7 @@
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -159,7 +159,7 @@ should set nodeSelector when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -274,7 +274,10 @@ should set resources when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      env:
+      - name: GOMEMLIMIT
+        value: "3865470567"
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -378,7 +381,7 @@ should set securityContext when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap
index bd048d4cad03b..ccf9f4bb27ed8 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap
@@ -567,8 +567,8 @@ sets clusterDomain on Configmap:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-cluster
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-cluster-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-cluster-18.6.1
         teleport.dev/majorVersion: "18"
       name: RELEASE-NAME-proxy
       namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
index 3072e091ad401..877b2bec732e4 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
@@ -11,8 +11,8 @@ sets clusterDomain on Deployment Pods:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-cluster
-        app.kubernetes.io/version: 18.0.0-dev
-        helm.sh/chart: teleport-cluster-18.0.0-dev
+        app.kubernetes.io/version: 18.6.1
+        helm.sh/chart: teleport-cluster-18.6.1
         teleport.dev/majorVersion: "18"
       name: RELEASE-NAME-proxy
       namespace: NAMESPACE
@@ -26,7 +26,7 @@ sets clusterDomain on Deployment Pods:
       template:
         metadata:
           annotations:
-            checksum/config: 5cee21778063eafa4687da4372a09f8c752ea114a3cee79883d96f9f15c14eb1
+            checksum/config: c40044b37f5825c5b6cd422e18118d17ecd277e482256cf17fbf64ef5bf4320f
             kubernetes.io/pod: test-annotation
             kubernetes.io/pod-different: 4
           labels:
@@ -34,8 +34,8 @@ sets clusterDomain on Deployment Pods:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-cluster
-            app.kubernetes.io/version: 18.0.0-dev
-            helm.sh/chart: teleport-cluster-18.0.0-dev
+            app.kubernetes.io/version: 18.6.1
+            helm.sh/chart: teleport-cluster-18.6.1
             teleport.dev/majorVersion: "18"
         spec:
           affinity:
@@ -44,7 +44,7 @@ sets clusterDomain on Deployment Pods:
           containers:
           - args:
             - --diag-addr=0.0.0.0:3000
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             lifecycle:
               preStop:
@@ -106,7 +106,7 @@ sets clusterDomain on Deployment Pods:
             - wait
             - no-resolve
             - RELEASE-NAME-auth-v17.NAMESPACE.svc.test.com
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             name: wait-auth-update
           serviceAccountName: RELEASE-NAME-proxy
           terminationGracePeriodSeconds: 60
@@ -155,7 +155,7 @@ should provision initContainer correctly when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
       resources:
         limits:
@@ -219,7 +219,7 @@ should set nodeSelector when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -281,7 +281,7 @@ should set nodeSelector when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
     nodeSelector:
       environment: security
@@ -349,7 +349,10 @@ should set resources for wait-auth-update initContainer when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      env:
+      - name: GOMEMLIMIT
+        value: "3865470567"
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -418,7 +421,7 @@ should set resources for wait-auth-update initContainer when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
       resources:
         limits:
@@ -475,7 +478,10 @@ should set resources when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      env:
+      - name: GOMEMLIMIT
+        value: "3865470567"
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -544,7 +550,7 @@ should set resources when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
       resources:
         limits:
@@ -601,7 +607,7 @@ should set securityContext for initContainers when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -670,7 +676,7 @@ should set securityContext for initContainers when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false
@@ -727,7 +733,7 @@ should set securityContext when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -796,7 +802,7 @@ should set securityContext when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v17.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false
diff --git a/examples/chart/teleport-cluster/tests/auth_deployment_test.yaml b/examples/chart/teleport-cluster/tests/auth_deployment_test.yaml
index 0b36bd5987b35..012a7248b2862 100644
--- a/examples/chart/teleport-cluster/tests/auth_deployment_test.yaml
+++ b/examples/chart/teleport-cluster/tests/auth_deployment_test.yaml
@@ -709,7 +709,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
 
   - it: should mount tls.existingCASecretName and set extra environment when set in values
     template: auth/deployment.yaml
@@ -733,7 +733,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - contains:
           path: spec.template.spec.containers[0].env
           content:
@@ -1021,3 +1021,102 @@ tests:
               labelSelector:
                 matchLabels:
                   app: baz
+
+  - it: sets GOMEMLIMIT by default (SI unit)
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5G"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: sets GOMEMLIMIT by default (IEC unit)
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5Gi"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "10146860237"
+
+  - it: sets GOMEMLIMIT by default (scientific notation)
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5e9"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: honours existing GOMEMLIMIT
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5G"
+      extraEnv:
+        - name: FOO
+          value: bar
+        - name: GOMEMLIMIT
+          value: "5GB"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "5GB"
+
+  - it: does not set GOMEMLIMIT if ratio is 0
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      # we set an extra env so contrainers[0].env always exists
+      # this makes testing easier
+      extraEnv:
+        - name: FOO
+          value: bar
+      resources:
+        limits:
+          memory: "10.5G"
+      # we nest under auth to check if merge works properly
+      auth:
+        goMemLimitRatio: 0
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: does not set GOMEMLIMIT if resources are not set
+    template: auth/deployment.yaml
+    set:
+      clusterName: helm-lint
+      # we set an extra env so contrainers[0].env always exists
+      # this makes testing easier
+      extraEnv:
+        - name: FOO
+          value: bar
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+          any: true
diff --git a/examples/chart/teleport-cluster/tests/predeploy_test.yaml b/examples/chart/teleport-cluster/tests/predeploy_test.yaml
index 7481cae5217df..fd309244ca8f8 100644
--- a/examples/chart/teleport-cluster/tests/predeploy_test.yaml
+++ b/examples/chart/teleport-cluster/tests/predeploy_test.yaml
@@ -56,40 +56,20 @@ tests:
       - hasDocuments:
           count: 0
 
-  - it: should set resources on auth predeploy job when set in values
+  - it: should not set resources on auth predeploy job when set in values
     template: auth/predeploy_job.yaml
     values:
       - ../.lint/resources.yaml
     asserts:
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 2Gi
-  - it: should set resources on proxy predeploy job when set in values
+      - isEmpty:
+          path: spec.template.spec.containers[0].resources
+  - it: should not set resources on proxy predeploy job when set in values
     template: proxy/predeploy_job.yaml
     values:
       - ../.lint/resources.yaml
     asserts:
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 2Gi
+      - isEmpty:
+          path: spec.template.spec.containers[0].resources
 
   - it: should set imagePullSecrets on proxy predeploy job when set in values
     template: proxy/predeploy_job.yaml
diff --git a/examples/chart/teleport-cluster/tests/proxy_deployment_test.yaml b/examples/chart/teleport-cluster/tests/proxy_deployment_test.yaml
index 3be38c79de584..39e1299e2d58f 100644
--- a/examples/chart/teleport-cluster/tests/proxy_deployment_test.yaml
+++ b/examples/chart/teleport-cluster/tests/proxy_deployment_test.yaml
@@ -845,7 +845,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
 
   - it: should mount tls.existingCASecretName and set extra environment when set in values
     template: proxy/deployment.yaml
@@ -869,7 +869,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - contains:
           path: spec.template.spec.containers[0].env
           content:
@@ -1140,3 +1140,102 @@ tests:
               labelSelector:
                 matchLabels:
                   app: baz
+
+  - it: sets GOMEMLIMIT by default (SI unit)
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5G"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: sets GOMEMLIMIT by default (IEC unit)
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5Gi"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "10146860237"
+
+  - it: sets GOMEMLIMIT by default (scientific notation)
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5e9"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: honours existing GOMEMLIMIT
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      resources:
+        limits:
+          memory: "10.5G"
+      extraEnv:
+        - name: FOO
+          value: bar
+        - name: GOMEMLIMIT
+          value: "5GB"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "5GB"
+
+  - it: does not set GOMEMLIMIT if ratio is 0
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      # we set an extra env so contrainers[0].env always exists
+      # this makes testing easier
+      extraEnv:
+        - name: FOO
+          value: bar
+      resources:
+        limits:
+          memory: "10.5G"
+      # we nest under proxy to check if merge works properly
+      proxy:
+        goMemLimitRatio: 0
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: does not set GOMEMLIMIT if resources are not set
+    template: proxy/deployment.yaml
+    set:
+      clusterName: helm-lint
+      # we set an extra env so contrainers[0].env always exists
+      # this makes testing easier
+      extraEnv:
+        - name: FOO
+          value: bar
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+          any: true
diff --git a/examples/chart/teleport-cluster/values.schema.json b/examples/chart/teleport-cluster/values.schema.json
index cadc25b5999dc..5bac6bc580ea3 100644
--- a/examples/chart/teleport-cluster/values.schema.json
+++ b/examples/chart/teleport-cluster/values.schema.json
@@ -712,7 +712,8 @@
             "type": "object",
             "required": [
                 "existingSecretName",
-                "existingCASecretName"
+                "existingCASecretName",
+                "existingCASecretKeyName"
             ],
             "properties": {
                 "existingSecretName": {
@@ -724,6 +725,11 @@
                     "$id": "#/properties/tls/properties/existingCASecretName",
                     "type": "string",
                     "default": ""
+                },
+                "existingCASecretKeyName": {
+                    "$id": "#/properties/tls/properties/existingCASecretKeyName",
+                    "type": "string",
+                    "default": "ca.pem"
                 }
             }
         },
diff --git a/examples/chart/teleport-cluster/values.yaml b/examples/chart/teleport-cluster/values.yaml
index 25c0acf3d8c9e..650a9ea237d80 100644
--- a/examples/chart/teleport-cluster/values.yaml
+++ b/examples/chart/teleport-cluster/values.yaml
@@ -121,7 +121,7 @@ authentication:
   connectorName: ""
 
   # Enable/disable local authentication by setting `authentication.local_auth` in `teleport.yaml`.
-  # Disabling local auth is required for FedRAMP / FIPS; see https://gravitational.com/teleport/docs/enterprise/ssh-kubernetes-fedramp/.
+  # Disabling local auth is required for FedRAMP / FIPS; see https://goteleport.com/docs/zero-trust-access/compliance-frameworks/fedramp/#configure-the-teleport-auth-service
   localAuth: true
 
   # Controls the locking mode: in case of network split should Teleport guarantee availability or integrity ?
@@ -347,7 +347,7 @@ createProxyToken: true
 # This CRD is managed by the prometheus-operator and allows workload to
 # get monitored. To use this value, you need to run a `prometheus-operator`
 # in the cluster for this value to take effect.
-# See https://prometheus-operator.dev/docs/prologue/introduction/
+# See https://prometheus-operator.dev/docs/getting-started/introduction/
 podMonitor:
   # Whether the chart should deploy a PodMonitor.
   # Disabled by default as it requires the PodMonitor CRD to be installed.
@@ -585,8 +585,9 @@ tls:
   # Useful for building trust when using intermediate certificate authorities.
   # This will automatically set the SSL_CERT_FILE environment variable to trust the CA.
   # Create the secret with `kubectl create secret generic --from-file=ca.pem=/path/to/root-ca.pem
-  # The filename inside the secret is important - it _must_ be ca.pem
   existingCASecretName: ""
+  # (optional) Name of an existing key in the CA secret which will be used as a trusted CA bundle file.
+  existingCASecretKeyName: "ca.pem"
 
 ##################################################
 # Values that you shouldn't need to change.
@@ -825,6 +826,18 @@ resources: {}
 #  limits:
 #    memory: "2Gi"
 
+# goMemLimitRatio configures the GOMEMLIMIT env var set by the chart.
+# GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+# below a given threshold. This is a best-effort attempt, but this helps
+# to prevent OOMs in case of bursts.
+#
+# When the memory limits are set and goMemLimitRatio is non-zero,
+# the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+# The value must be between 0 and 1.
+# Set to 0 to unset GOMEMLIMIT.
+# This has no effect if GOMEMLIMIT is already set through `extraEnv`.
+goMemLimitRatio: 0.9
+
 # Pod security context for any pods created by the chart
 podSecurityContext: {}
   # fsGroup: 65532
diff --git a/examples/chart/teleport-kube-agent/.lint/all-v6.yaml b/examples/chart/teleport-kube-agent/.lint/all-v6.yaml
index 09ce83df0f026..4f95c2aa7a1ed 100644
--- a/examples/chart/teleport-kube-agent/.lint/all-v6.yaml
+++ b/examples/chart/teleport-kube-agent/.lint/all-v6.yaml
@@ -1,5 +1,6 @@
 authToken: auth-token
 proxyAddr: proxy.example.com:3080
+relayAddr: relay.example.com:3024
 roles: kube,app,db,jamf
 kubeClusterName: test-kube-cluster-name
 labels:
diff --git a/examples/chart/teleport-kube-agent/.lint/existing-tls-secret-with-ca.yaml b/examples/chart/teleport-kube-agent/.lint/existing-tls-secret-with-ca.yaml
index a8e2a468fd7a3..d3fe2c117f10a 100644
--- a/examples/chart/teleport-kube-agent/.lint/existing-tls-secret-with-ca.yaml
+++ b/examples/chart/teleport-kube-agent/.lint/existing-tls-secret-with-ca.yaml
@@ -4,3 +4,4 @@ roles: kube
 kubeClusterName: test-kube-cluster
 tls:
   existingCASecretName: "helm-lint-existing-tls-secret-ca"
+  existingCASecretKeyName: "helm-lint-existing-tls-secret-key-name"
diff --git a/examples/chart/teleport-kube-agent/.lint/topology-spread-constraints.yaml b/examples/chart/teleport-kube-agent/.lint/topology-spread-constraints.yaml
new file mode 100644
index 0000000000000..d6da0270bf2be
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/topology-spread-constraints.yaml
@@ -0,0 +1,13 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app: foo
+    matchLabelKeys:
+      - pod-template-hash
diff --git a/examples/chart/teleport-kube-agent/Chart.yaml b/examples/chart/teleport-kube-agent/Chart.yaml
index cc359d3019b83..a765a83ff0971 100644
--- a/examples/chart/teleport-kube-agent/Chart.yaml
+++ b/examples/chart/teleport-kube-agent/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "18.0.0-dev"
+.version: &version "18.6.1"
 
 name: teleport-kube-agent
 apiVersion: v2
diff --git a/examples/chart/teleport-kube-agent/templates/_config.tpl b/examples/chart/teleport-kube-agent/templates/_config.tpl
index adb708ddfa4b5..93ee57e10dc93 100644
--- a/examples/chart/teleport-kube-agent/templates/_config.tpl
+++ b/examples/chart/teleport-kube-agent/templates/_config.tpl
@@ -15,6 +15,9 @@ teleport:
   {{- else }}
   auth_servers: ["{{ required "proxyAddr is required in chart values" .Values.proxyAddr }}"]
   {{- end }}
+  {{- with .Values.relayAddr }}
+  relay_server: {{ . | quote }}
+  {{- end }}
   {{- if .Values.caPin }}
   ca_pin: {{- toYaml .Values.caPin | nindent 4 }}
   {{- end }}
diff --git a/examples/chart/teleport-kube-agent/templates/_quantity.tpl b/examples/chart/teleport-kube-agent/templates/_quantity.tpl
new file mode 100644
index 0000000000000..451426d5cc614
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/templates/_quantity.tpl
@@ -0,0 +1,37 @@
+{{/* This template tries to parse a resource quantity like Kubernetes does.
+Helm sadly doesn't offer this critical primitive: https://github.com/helm/helm/issues/11376
+The quantity serialization format is described here: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go#L33
+
+This template support IEC, SI and decimal notation syntaxes, but has poor error handling.*/}}
+{{- define "teleport-kube-agent.resource-quantity" -}}
+    {{- $value := . -}}
+    {{- $unit := 1.0 -}}
+    {{- if typeIs "string" . -}}
+        {{- $base2 := dict "Ki" 0x1p10 "Mi" 0x1p20 "Gi" 0x1p30 "Ti" 0x1p40 "Pi" 0x1p50 "Ei" 0x1p60 -}}
+        {{- $base10 := dict "m" 1e-3 "k" 1e3 "M" 1e6 "G" 1e9 "T" 1e12 "P" 1e15 "E" 1e18 -}}
+        {{- range $k, $v := merge $base2 $base10 -}}
+            {{- if hasSuffix $k $ -}}
+                {{- $value = trimSuffix $k $ -}}
+                {{- $unit = $v -}}
+            {{- end -}}
+        {{- end -}}
+    {{- end -}}
+    {{- mulf (float64 $value) $unit -}}
+{{- end -}}
+
+{{/* This renders the GOMEMLIMIT env var unless the user already specified it
+in extraEnv, goMemLimitRatio is set to 0, or requests.memory.limit is unset. */}}
+{{- define "teleport-kube-agent.gomemlimit" -}}
+    {{- $alreadySet := false -}}
+    {{- range $_, $var := .Values.extraEnv -}}
+        {{- if eq $var.name "GOMEMLIMIT" -}}
+            {{- $alreadySet = true -}}
+        {{- end -}}
+    {{- end -}}
+    {{- if and (not $alreadySet) .Values.goMemLimitRatio -}}
+        {{- $ratio := .Values.goMemLimitRatio -}}
+        {{- with .Values.resources }}{{ with .limits }}{{ with .memory -}}
+            {{- include "teleport-kube-agent.resource-quantity" . | float64 | mulf $ratio | ceil | int -}}
+        {{- end }}{{ end }}{{ end -}}
+    {{- end -}}
+{{- end -}}
diff --git a/examples/chart/teleport-kube-agent/templates/deployment.yaml b/examples/chart/teleport-kube-agent/templates/deployment.yaml
index 4eb3f5d48525c..7bd2ef037e2a6 100644
--- a/examples/chart/teleport-kube-agent/templates/deployment.yaml
+++ b/examples/chart/teleport-kube-agent/templates/deployment.yaml
@@ -81,6 +81,9 @@ spec:
         {{- end }}
         {{- end }}
       {{- end }}
+      {{- if .Values.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
       {{- if .Values.tolerations }}
       tolerations:
         {{- toYaml .Values.tolerations | nindent 6 }}
diff --git a/examples/chart/teleport-kube-agent/templates/statefulset.yaml b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
index 3105debacb4e2..0a9daebb6a67c 100644
--- a/examples/chart/teleport-kube-agent/templates/statefulset.yaml
+++ b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
@@ -2,6 +2,7 @@
 # Warning to maintainers, any changes to this file that are not specific to the StatefulSet need to also be duplicated
 # in the deployment.yaml file.
 #
+{{- $topologySpreadConstraints := and (semverCompare ">=1.18.0-0" .Capabilities.KubeVersion.Version) (not .Values.disableTopologySpreadConstraints) }}
 {{- $replicaCount := (coalesce .Values.replicaCount .Values.highAvailability.replicaCount "1") }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -84,6 +85,25 @@ spec:
         {{- end }}
         {{- end }}
       {{- end }}
+{{- if $topologySpreadConstraints }}
+  {{- if .Values.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
+  {{- else }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: {{ .Release.Name }}
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: {{ .Release.Name }}
+  {{- end }}
+{{- end }}
       {{- if .Values.tolerations }}
       tolerations:
         {{- toYaml .Values.tolerations | nindent 6 }}
@@ -138,6 +158,11 @@ spec:
         imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
         {{- end }}
         env:
+        {{- $gomemlimit := include "teleport-kube-agent.gomemlimit" . }}
+        {{- if $gomemlimit }}
+          - name: GOMEMLIMIT
+            value: {{ $gomemlimit | quote }}
+        {{- end }}
           # This variable is set for telemetry purposes.
           # Telemetry is opt-in and controlled at the auth level.
           - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
@@ -164,11 +189,19 @@ spec:
           {{- end }}
           {{- if .Values.tls.existingCASecretName }}
           - name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
           {{- end }}
           {{- if .Values.extraEnv }}
             {{- toYaml .Values.extraEnv | nindent 10 }}
           {{- end }}
+          {{- if .Values.teleportClusterName }}
+          - name: KUBERNETES_TOKEN_PATH
+            value: /var/run/secrets/tokens/join-sa-token
+          {{- end }}
+          {{- if .Values.updater.enabled }}
+          - name: "TELEPORT_UPDATE_CONFIG_FILE"
+            value: "/etc/updater-config/update.yaml"
+          {{- end }}
         args:
         - "--diag-addr=0.0.0.0:3000"
         {{- if .Values.insecureSkipProxyTLSVerify }}
@@ -211,6 +244,11 @@ spec:
         - mountPath: /etc/teleport-secrets
           name: "auth-token"
           readOnly: true
+{{- if .Values.teleportClusterName }}
+        - mountPath: /var/run/secrets/tokens
+          name: join-sa-token
+          readOnly: true
+{{- end }}
 {{- if .Values.storage.enabled }}
         - mountPath: /var/lib/teleport
           name: "{{ .Release.Name }}-teleport-data"
@@ -228,6 +266,11 @@ spec:
           name: "jamf-api-credentials"
           readOnly: true
 {{- end }}
+{{- if .Values.updater.enabled }}
+        - mountPath: /etc/updater-config
+          name: "updater-config"
+          readOnly: true
+{{- end }}
 {{- if .Values.extraVolumeMounts }}
   {{- toYaml .Values.extraVolumeMounts | nindent 8 }}
 {{- end }}
@@ -241,6 +284,19 @@ spec:
       - name: "auth-token"
         secret:
           secretName: {{ coalesce .Values.secretName .Values.joinTokenSecret.name }}
+      {{- if .Values.teleportClusterName }}
+      {{- /* This volume is used to obtain a service account token that can be used
+       to join the Teleport cluster using the kubernetes join method.
+       To ensure backward compatibility, we use .Values.teleportClusterName as a feature flag.
+       The token must have the cluster name as audience, and its TTL must not exceed 30 minutes. */}}
+      - name: join-sa-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                path: join-sa-token
+                expirationSeconds: 600
+                audience: {{ .Values.teleportClusterName }}
+      {{- end }}
 {{- if not .Values.storage.enabled }}
       - name: "data"
         emptyDir: {}
@@ -255,6 +311,11 @@ spec:
         secret:
           secretName: {{ .Values.jamfCredentialsSecret.name }}
 {{- end }}
+{{- if .Values.updater.enabled }}
+      - name: "updater-config"
+        configMap:
+          name: {{ .Release.Name }}-updater
+{{- end }}
 {{- if .Values.extraVolumes }}
   {{- toYaml .Values.extraVolumes | nindent 6 }}
 {{- end }}
diff --git a/examples/chart/teleport-kube-agent/templates/updater/deployment.yaml b/examples/chart/teleport-kube-agent/templates/updater/deployment.yaml
index 5790f16cd8dfc..fa850c8b88426 100644
--- a/examples/chart/teleport-kube-agent/templates/updater/deployment.yaml
+++ b/examples/chart/teleport-kube-agent/templates/updater/deployment.yaml
@@ -56,7 +56,7 @@ spec:
   {{- end }}
   {{- if $updater.tls.existingCASecretName }}
         - name: SSL_CERT_FILE
-          value: /etc/teleport-tls-ca/ca.pem
+          value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
   {{- end }}
 {{- end }}
         args:
@@ -71,7 +71,7 @@ spec:
     would be a breaking change when the teleport proxy starts override the explicitly set RFD-109 version server */ -}}
   {{- if and $updater.proxyAddr (not $versionServerOverride)}}
           - "--proxy-address={{ $updater.proxyAddr }}"
-          - "--update-group={{ default $updater.releaseChannel $updater.group }}"
+          - "--update-group={{ default "default" $updater.group }}"
   {{- end }}
 {{- if $updater.pullCredentials }}
           - "--pull-credentials={{ $updater.pullCredentials }}"
diff --git a/examples/chart/teleport-kube-agent/templates/updater/role.yaml b/examples/chart/teleport-kube-agent/templates/updater/role.yaml
index 12608478fdb9b..86085c041ffd8 100644
--- a/examples/chart/teleport-kube-agent/templates/updater/role.yaml
+++ b/examples/chart/teleport-kube-agent/templates/updater/role.yaml
@@ -53,6 +53,24 @@ rules:
   verbs:
     - create
     - patch
+# the updater needs to create, get, and update the configmap containing updater state
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - create
+    - watch
+    - list
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - get
+    - update
+  resourceNames:
+    - {{ .Release.Name }}-updater
 # the controller in the updater must be able to watch deployments and
 # statefulsets and get the one it should reconcile
 - apiGroups:
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
index ad817a9498ce3..bb1a7fd9c13b1 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
@@ -268,6 +268,7 @@ matches snapshot for all-v6.yaml:
             output: stderr
             severity: INFO
           proxy_server: proxy.example.com:3080
+          relay_server: relay.example.com:3024
         version: v3
     kind: ConfigMap
     metadata:
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
index e933dd7d18e57..73a50ad2a1950 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
@@ -32,7 +32,7 @@ sets Deployment annotations when specified if action is Upgrade:
               value: "true"
             - name: TELEPORT_KUBE_CLUSTER_DOMAIN
               value: cluster.local
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             livenessProbe:
               failureThreshold: 6
@@ -109,7 +109,7 @@ sets Deployment labels when specified if action is Upgrade:
             value: "true"
           - name: TELEPORT_KUBE_CLUSTER_DOMAIN
             value: cluster.local
-          image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+          image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 6
@@ -173,7 +173,7 @@ sets Pod annotations when specified if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -237,7 +237,7 @@ sets Pod labels when specified if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -322,7 +322,7 @@ should add emptyDir for data when existingDataVolume is not set if action is Upg
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -387,7 +387,7 @@ should add insecureSkipProxyTLSVerify to args when set in values if action is Up
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -451,7 +451,7 @@ should correctly configure existingDataVolume when set if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -513,7 +513,7 @@ should expose diag port if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -589,7 +589,7 @@ should have multiple replicas when replicaCount is set (using .replicaCount, dep
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -665,7 +665,7 @@ should have multiple replicas when replicaCount is set (using highAvailability.r
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -729,7 +729,7 @@ should have one replica when replicaCount is not set if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -793,7 +793,7 @@ should mount extraVolumes and extraVolumeMounts if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -862,7 +862,7 @@ should mount jamfCredentialsSecret if it already exists and when role is jamf an
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -932,7 +932,7 @@ should mount jamfCredentialsSecret.name when role is jamf and action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1004,7 +1004,7 @@ should mount tls.existingCASecretName and set environment when set in values if
         value: cluster.local
       - name: SSL_CERT_FILE
         value: /etc/teleport-tls-ca/ca.pem
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1078,7 +1078,7 @@ should mount tls.existingCASecretName and set extra environment when set in valu
         value: http://username:password@my.proxy.host:3128
       - name: SSL_CERT_FILE
         value: /etc/teleport-tls-ca/ca.pem
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1148,7 +1148,7 @@ should provision initContainer correctly when set in values if action is Upgrade
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1270,7 +1270,7 @@ should set affinity when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1334,7 +1334,7 @@ should set default serviceAccountName when not set in values if action is Upgrad
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1411,7 +1411,7 @@ should set environment when extraEnv set in values if action is Upgrade:
         value: cluster.local
       - name: HTTPS_PROXY
         value: http://username:password@my.proxy.host:3128
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1539,7 +1539,7 @@ should set imagePullPolicy when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: Always
       livenessProbe:
         failureThreshold: 6
@@ -1603,7 +1603,7 @@ should set nodeSelector if set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1669,7 +1669,7 @@ should set not set priorityClassName when not set in values if action is Upgrade
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1745,7 +1745,7 @@ should set preferred affinity when more than one replica is used if action is Up
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1809,7 +1809,7 @@ should set priorityClassName when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1874,7 +1874,7 @@ should set probeTimeoutSeconds when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1948,7 +1948,7 @@ should set required affinity when highAvailability.requireAntiAffinity is set if
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2012,7 +2012,7 @@ should set resources when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2083,7 +2083,7 @@ should set serviceAccountName when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2147,7 +2147,7 @@ should set tolerations when set in values if action is Upgrade:
         value: "true"
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
index 1e86a682420e3..d06e4f325e46e 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
@@ -25,7 +25,7 @@ should create ServiceAccount for post-delete hook by default:
             fieldPath: metadata.namespace
       - name: RELEASE_NAME
         value: RELEASE-NAME
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       name: post-delete-job
       securityContext:
@@ -108,7 +108,7 @@ should not create ServiceAccount for post-delete hook if serviceAccount.create i
                   fieldPath: metadata.namespace
             - name: RELEASE_NAME
               value: RELEASE-NAME
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             name: post-delete-job
             securityContext:
@@ -138,7 +138,7 @@ should not create ServiceAccount, Role or RoleBinding for post-delete hook if se
             fieldPath: metadata.namespace
       - name: RELEASE_NAME
         value: RELEASE-NAME
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       name: post-delete-job
       securityContext:
@@ -168,7 +168,7 @@ should set nodeSelector in post-delete hook:
             fieldPath: metadata.namespace
       - name: RELEASE_NAME
         value: RELEASE-NAME
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       name: post-delete-job
       securityContext:
@@ -200,7 +200,7 @@ should set resources in the Job's pod spec if resources is set in values:
             fieldPath: metadata.namespace
       - name: RELEASE_NAME
         value: RELEASE-NAME
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       name: post-delete-job
       resources:
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
index d11ff50cfe5b2..b5a83c42ae0c9 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
@@ -18,7 +18,7 @@ sets Pod annotations when specified:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -64,6 +64,19 @@ sets Pod annotations when specified:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -91,7 +104,7 @@ sets Pod labels when specified:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -137,6 +150,19 @@ sets Pod labels when specified:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -188,7 +214,7 @@ sets StatefulSet labels when specified:
               value: RELEASE-NAME
             - name: TELEPORT_KUBE_CLUSTER_DOMAIN
               value: cluster.local
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             livenessProbe:
               failureThreshold: 6
@@ -234,6 +260,19 @@ sets StatefulSet labels when specified:
             fsGroup: 9807
           serviceAccountName: RELEASE-NAME
           terminationGracePeriodSeconds: 30
+          topologySpreadConstraints:
+          - labelSelector:
+              matchLabels:
+                app: RELEASE-NAME
+            maxSkew: 1
+            topologyKey: kubernetes.io/hostname
+            whenUnsatisfiable: ScheduleAnyway
+          - labelSelector:
+              matchLabels:
+                app: RELEASE-NAME
+            maxSkew: 1
+            topologyKey: topology.kubernetes.io/zone
+            whenUnsatisfiable: ScheduleAnyway
           volumes:
           - configMap:
               name: RELEASE-NAME
@@ -293,7 +332,7 @@ should add insecureSkipProxyTLSVerify to args when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -339,6 +378,19 @@ should add insecureSkipProxyTLSVerify to args when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -366,7 +418,7 @@ should add volumeClaimTemplate for data volume when using StatefulSet and action
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -412,6 +464,19 @@ should add volumeClaimTemplate for data volume when using StatefulSet and action
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -459,7 +524,7 @@ should add volumeClaimTemplate for data volume when using StatefulSet and is Fre
               value: RELEASE-NAME
             - name: TELEPORT_KUBE_CLUSTER_DOMAIN
               value: cluster.local
-            image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+            image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
             imagePullPolicy: IfNotPresent
             livenessProbe:
               failureThreshold: 6
@@ -505,6 +570,19 @@ should add volumeClaimTemplate for data volume when using StatefulSet and is Fre
             fsGroup: 9807
           serviceAccountName: RELEASE-NAME
           terminationGracePeriodSeconds: 30
+          topologySpreadConstraints:
+          - labelSelector:
+              matchLabels:
+                app: RELEASE-NAME
+            maxSkew: 1
+            topologyKey: kubernetes.io/hostname
+            whenUnsatisfiable: ScheduleAnyway
+          - labelSelector:
+              matchLabels:
+                app: RELEASE-NAME
+            maxSkew: 1
+            topologyKey: topology.kubernetes.io/zone
+            whenUnsatisfiable: ScheduleAnyway
           volumes:
           - configMap:
               name: RELEASE-NAME
@@ -542,7 +620,7 @@ should add volumeMount for data volume when using StatefulSet:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -588,6 +666,19 @@ should add volumeMount for data volume when using StatefulSet:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -615,7 +706,7 @@ should expose diag port:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -661,6 +752,19 @@ should expose diag port:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -688,7 +792,7 @@ should generate Statefulset when storage is disabled and mode is a Upgrade:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -734,6 +838,19 @@ should generate Statefulset when storage is disabled and mode is a Upgrade:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -775,7 +892,7 @@ should have multiple replicas when replicaCount is set (using .replicaCount, dep
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -821,6 +938,19 @@ should have multiple replicas when replicaCount is set (using .replicaCount, dep
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -860,7 +990,7 @@ should have multiple replicas when replicaCount is set (using highAvailability.r
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -906,6 +1036,19 @@ should have multiple replicas when replicaCount is set (using highAvailability.r
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -933,7 +1076,7 @@ should have one replica when replicaCount is not set:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -979,6 +1122,19 @@ should have one replica when replicaCount is not set:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1006,7 +1162,7 @@ should install Statefulset when storage is disabled and mode is a Fresh Install:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1052,6 +1208,19 @@ should install Statefulset when storage is disabled and mode is a Fresh Install:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1081,7 +1250,7 @@ should mount extraVolumes and extraVolumeMounts:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1129,6 +1298,19 @@ should mount extraVolumes and extraVolumeMounts:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1159,7 +1341,7 @@ should mount jamfCredentialsSecret if it already exists and when role is jamf:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1208,6 +1390,19 @@ should mount jamfCredentialsSecret if it already exists and when role is jamf:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1240,7 +1435,7 @@ should mount jamfCredentialsSecret.name when role is jamf:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1289,6 +1484,19 @@ should mount jamfCredentialsSecret.name when role is jamf:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1322,8 +1530,8 @@ should mount tls.existingCASecretName and set environment when set in values:
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
       - name: SSL_CERT_FILE
-        value: /etc/teleport-tls-ca/ca.pem
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+        value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1372,6 +1580,19 @@ should mount tls.existingCASecretName and set environment when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1405,10 +1626,10 @@ should mount tls.existingCASecretName and set extra environment when set in valu
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
       - name: SSL_CERT_FILE
-        value: /etc/teleport-tls-ca/ca.pem
+        value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - name: HTTPS_PROXY
         value: http://username:password@my.proxy.host:3128
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1457,6 +1678,19 @@ should mount tls.existingCASecretName and set extra environment when set in valu
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1489,7 +1723,7 @@ should not add emptyDir for data when using StatefulSet:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1535,6 +1769,19 @@ should not add emptyDir for data when using StatefulSet:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1548,6 +1795,8 @@ should provision initContainer correctly when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       env:
+      - name: GOMEMLIMIT
+        value: "3865470567"
       - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
         value: "true"
       - name: TELEPORT_REPLICA_NAME
@@ -1562,7 +1811,7 @@ should provision initContainer correctly when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1646,6 +1895,19 @@ should provision initContainer correctly when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1693,7 +1955,7 @@ should set affinity when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1739,6 +2001,19 @@ should set affinity when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1766,7 +2041,7 @@ should set default serviceAccountName when not set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1812,6 +2087,19 @@ should set default serviceAccountName when not set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1852,7 +2140,7 @@ should set environment when extraEnv set in values:
         value: cluster.local
       - name: HTTPS_PROXY
         value: http://username:password@my.proxy.host:3128
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -1898,6 +2186,19 @@ should set environment when extraEnv set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1971,6 +2272,19 @@ should set image and tag correctly:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -1998,7 +2312,7 @@ should set imagePullPolicy when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: Always
       livenessProbe:
         failureThreshold: 6
@@ -2044,6 +2358,19 @@ should set imagePullPolicy when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2071,7 +2398,7 @@ should set nodeSelector if set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2119,6 +2446,19 @@ should set nodeSelector if set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2158,7 +2498,7 @@ should set preferred affinity when more than one replica is used:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2204,6 +2544,19 @@ should set preferred affinity when more than one replica is used:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2231,7 +2584,7 @@ should set probeTimeoutSeconds when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2277,6 +2630,19 @@ should set probeTimeoutSeconds when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2314,7 +2680,7 @@ should set required affinity when highAvailability.requireAntiAffinity is set:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2360,6 +2726,19 @@ should set required affinity when highAvailability.requireAntiAffinity is set:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2373,6 +2752,8 @@ should set resources when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       env:
+      - name: GOMEMLIMIT
+        value: "3865470567"
       - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
         value: "true"
       - name: TELEPORT_REPLICA_NAME
@@ -2387,7 +2768,7 @@ should set resources when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2440,6 +2821,19 @@ should set resources when set in values:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2467,7 +2861,7 @@ should set serviceAccountName when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2513,6 +2907,19 @@ should set serviceAccountName when set in values:
       fsGroup: 9807
     serviceAccountName: teleport-kube-agent-sa
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2540,7 +2947,7 @@ should set storage.requests when set in values and action is an Upgrade:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2586,6 +2993,19 @@ should set storage.requests when set in values and action is an Upgrade:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2613,7 +3033,7 @@ should set storage.storageClassName when set in values and action is an Upgrade:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2659,6 +3079,19 @@ should set storage.storageClassName when set in values and action is an Upgrade:
       fsGroup: 9807
     serviceAccountName: RELEASE-NAME
     terminationGracePeriodSeconds: 30
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
@@ -2686,7 +3119,7 @@ should set tolerations when set in values:
         value: RELEASE-NAME
       - name: TELEPORT_KUBE_CLUSTER_DOMAIN
         value: cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-distroless:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -2741,6 +3174,19 @@ should set tolerations when set in values:
       key: dedicated
       operator: Equal
       value: teleport
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+    - labelSelector:
+        matchLabels:
+          app: RELEASE-NAME
+      maxSkew: 1
+      topologyKey: topology.kubernetes.io/zone
+      whenUnsatisfiable: ScheduleAnyway
     volumes:
     - configMap:
         name: RELEASE-NAME
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap
index 625ef1b7276ec..a02d2589dc90f 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap
@@ -27,7 +27,7 @@ sets the affinity:
       - --base-image=public.ecr.aws/gravitational/teleport-distroless
       - --version-server=https://my-custom-version-server/v1
       - --version-channel=custom/preview
-      image: public.ecr.aws/gravitational/teleport-kube-agent-updater:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-kube-agent-updater:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
@@ -73,7 +73,7 @@ sets the tolerations:
       - --base-image=public.ecr.aws/gravitational/teleport-distroless
       - --version-server=https://my-custom-version-server/v1
       - --version-channel=custom/preview
-      image: public.ecr.aws/gravitational/teleport-kube-agent-updater:18.0.0-dev
+      image: public.ecr.aws/gravitational/teleport-kube-agent-updater:18.6.1
       imagePullPolicy: IfNotPresent
       livenessProbe:
         failureThreshold: 6
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_role_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_role_test.yaml.snap
index 0c1e6a6268c30..90d5f40e1259d 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_role_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_role_test.yaml.snap
@@ -39,6 +39,23 @@ sets the correct role rules:
       verbs:
       - create
       - patch
+    - apiGroups:
+      - ""
+      resources:
+      - configmaps
+      verbs:
+      - create
+      - watch
+      - list
+    - apiGroups:
+      - ""
+      resourceNames:
+      - RELEASE-NAME-updater
+      resources:
+      - configmaps
+      verbs:
+      - get
+      - update
     - apiGroups:
       - apps
       resources:
diff --git a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
index 5e0b2bd0d98a5..0261665642596 100644
--- a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
+++ b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
@@ -160,6 +160,75 @@ tests:
       - matchSnapshot:
           path: spec.template.spec
 
+  - it: sets topology spread constraints by default
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.topologySpreadConstraints
+          value:
+            - maxSkew: 1
+              topologyKey: kubernetes.io/hostname
+              whenUnsatisfiable: ScheduleAnyway
+              labelSelector:
+                matchLabels:
+                  app: RELEASE-NAME
+            - maxSkew: 1
+              topologyKey: topology.kubernetes.io/zone
+              whenUnsatisfiable: ScheduleAnyway
+              labelSelector:
+                matchLabels:
+                  app: RELEASE-NAME
+
+  - it: removes topology spread constraints when disabled
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      disableTopologySpreadConstraints: true
+    asserts:
+      - isEmpty:
+          path: spec.template.spec.topologySpreadConstraints
+
+  - it: removes topology spread constraints when running on antique kubernetes
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    capabilities:
+      majorVersion: 1
+      minorVersion: 17
+    asserts:
+      - isEmpty:
+          path: spec.template.spec.topologySpreadConstraints
+
+  - it: uses custom topology spread constraints when set
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      topologySpreadConstraints:
+        - maxSkew: 2
+          topologyKey: foobar
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: baz
+    # helm unit-test has a bug where capabilities are not reset between tests, we must set back to 1.18 after the 1.17 test.
+    capabilities:
+      majorVersion: 1
+      minorVersion: 18
+    asserts:
+      - equal:
+          path: spec.template.spec.topologySpreadConstraints
+          value:
+            - maxSkew: 2
+              topologyKey: foobar
+              whenUnsatisfiable: ScheduleAnyway
+              labelSelector:
+                matchLabels:
+                  app: baz
+
   - it: should set tolerations when set in values
     template: statefulset.yaml
     values:
@@ -580,7 +649,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - matchSnapshot:
           path: spec.template.spec
 
@@ -606,7 +675,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
       - contains:
           path: spec.template.spec.containers[0].env
           content:
@@ -786,6 +855,52 @@ tests:
             name: TELEPORT_EXT_UPGRADER_VERSION
             value: 13.4.5
 
+  - it: should mount the update.yaml configmap when updater is enabled
+    template: statefulset.yaml
+    values:
+      - ../.lint/updater.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: TELEPORT_UPDATE_CONFIG_FILE
+            value: /etc/updater-config/update.yaml
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/updater-config
+            name: updater-config
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: updater-config
+            configMap:
+              name: RELEASE-NAME-updater
+
+  - it: should not mount the update.yaml configmap when updater is disabled
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: TELEPORT_UPDATE_CONFIG_FILE
+            value: /etc/updater-config/update.yaml
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/updater-config
+            name: updater-config
+            readOnly: true
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: updater-config
+            configMap:
+              name: RELEASE-NAME-updater
+
   - it: should set the installation method environment variable
     template: statefulset.yaml
     values:
@@ -823,4 +938,161 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.terminationGracePeriodSeconds
-          value: 3600
\ No newline at end of file
+          value: 3600
+
+  - it: should mount a projected SA token when teleportClusterName is set
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: join-sa-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    path: join-sa-token
+                    expirationSeconds: 600
+                    audience: teleport.example.com
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+              mountPath: /var/run/secrets/tokens
+              name: join-sa-token
+              readOnly: true
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_TOKEN_PATH
+            value: /var/run/secrets/tokens/join-sa-token
+
+  - it: should not mount a projected SA token when teleportClusterName is not set
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: ""
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: join-sa-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    path: join-sa-token
+                    expirationSeconds: 600
+                    audience: ""
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/run/secrets/tokens
+            name: join-sa-token
+            readOnly: true
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_TOKEN_PATH
+            value: /var/run/secrets/tokens/join-sa-token
+
+  - it: sets GOMEMLIMIT by default (SI unit)
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+      resources:
+        limits:
+          memory: "10.5G"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: sets GOMEMLIMIT by default (IEC unit)
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+      resources:
+        limits:
+          memory: "10.5Gi"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "10146860237"
+
+  - it: sets GOMEMLIMIT by default (scientific notation)
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+      resources:
+        limits:
+          memory: "10.5e9"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: honours existing GOMEMLIMIT
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+      resources:
+        limits:
+          memory: "10.5G"
+      extraEnv:
+        - name: FOO
+          value: bar
+        - name: GOMEMLIMIT
+          value: "5GB"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "5GB"
+
+  - it: does not set GOMEMLIMIT if ratio is 0
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+      resources:
+        limits:
+          memory: "10.5G"
+      goMemLimitRatio: 0
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: does not set GOMEMLIMIT if resources are not set
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportClusterName: teleport.example.com
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+          any: true
diff --git a/examples/chart/teleport-kube-agent/tests/updater_deployment_test.yaml b/examples/chart/teleport-kube-agent/tests/updater_deployment_test.yaml
index 3e27f481b5a33..47ad551fb7100 100644
--- a/examples/chart/teleport-kube-agent/tests/updater_deployment_test.yaml
+++ b/examples/chart/teleport-kube-agent/tests/updater_deployment_test.yaml
@@ -103,7 +103,7 @@ tests:
     asserts:
       - contains:
           path: spec.template.spec.containers[0].args
-          content: "--update-group=stable/cloud"
+          content: "--update-group=default"
   - it: uses the update group when set
     set:
       proxyAddr: proxy.teleport.example.com:443
@@ -242,7 +242,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SSL_CERT_FILE
-            value: /etc/teleport-tls-ca/ca.pem
+            value: /etc/teleport-tls-ca/helm-lint-existing-tls-secret-key-name
   - it: sets the updater container extraEnv
     values:
       - ../.lint/updater.yaml
diff --git a/examples/chart/teleport-kube-agent/values.schema.json b/examples/chart/teleport-kube-agent/values.schema.json
index 46b600c888319..193a5b829eca8 100644
--- a/examples/chart/teleport-kube-agent/values.schema.json
+++ b/examples/chart/teleport-kube-agent/values.schema.json
@@ -3,6 +3,7 @@
     "type": "object",
     "required": [
         "proxyAddr",
+        "relayAddr",
         "roles",
         "joinParams",
         "kubeClusterName",
@@ -50,6 +51,11 @@
             "type": "string",
             "default": ""
         },
+        "relayAddr": {
+            "$id": "#/properties/relayAddr",
+            "type": "string",
+            "default": ""
+        },
         "roles": {
             "$id": "#/properties/roles",
             "type": "string",
@@ -78,6 +84,11 @@
             "type": "string",
             "default": ""
         },
+        "teleportClusterName": {
+            "$id": "#/properties/teleportClusterName",
+            "type": "string",
+            "default": ""
+        },
         "apps": {
             "$id": "#/properties/apps",
             "type": "array",
@@ -261,13 +272,19 @@
             "$id": "#/properties/tls",
             "type": "object",
             "required": [
-                "existingCASecretName"
+                "existingCASecretName",
+                "existingCASecretKeyName"
             ],
             "properties": {
                 "existingCASecretName": {
                     "$id": "#/properties/tls/properties/existingCASecretName",
                     "type": "string",
                     "default": ""
+                },
+                "existingCASecretKeyName": {
+                    "$id": "#/properties/tls/properties/existingCASecretKeyName",
+                    "type": "string",
+                    "default": "ca.pem"
                 }
             }
         },
@@ -519,6 +536,11 @@
             "type": "object",
             "default": {}
         },
+        "topologySpreadConstraints": {
+            "$id": "#/properties/topologySpreadConstraints",
+            "type": "array",
+            "default": []
+        },
         "dnsConfig": {
             "$id": "#/properties/dnsConfig",
             "type": "object",
diff --git a/examples/chart/teleport-kube-agent/values.yaml b/examples/chart/teleport-kube-agent/values.yaml
index 1890f584a5201..a35e2dfec547a 100644
--- a/examples/chart/teleport-kube-agent/values.yaml
+++ b/examples/chart/teleport-kube-agent/values.yaml
@@ -32,6 +32,16 @@ roles: "kube"
 # | `teleport-cluster` Helm chart | `teleport.example.com:443`          |
 proxyAddr: ""
 
+# relayAddr(string) -- defines the optional address of the Teleport Relay
+# Service tunnel endpoint that this agent should use.
+#
+# If set, the agent will open reverse tunnels to the specified Relay in addition
+# to the tunnels to the control plane, for the protocols supported by the Relay.
+#
+# relayAddr is available starting from Teleport v18.5.0, taking effect for the
+# Kubernetes service.
+relayAddr: ""
+
 # enterprise(bool) -- controls if the `teleport-kube-agent` chart should deploy
 # the OSS version or the enterprise version of the container image.
 # This must be set to `true` when connecting to Teleport Cloud or self-hosted
@@ -66,21 +76,21 @@ joinParams:
   # joinParams.method(string) -- controls which join method will be used by the
   # instance to join the Teleport cluster.
   #
-  # See [the join method reference](../../reference/join-methods.mdx) for the list of possible
+  # See [the join method reference](../../reference/deployment/join-methods.mdx) for the list of possible
   # values, the implications of each join method, and guides to set up each method.
   #
   # Common join-methods for the `teleport-kube-agent` are:
   # - `token`: the most basic one, with regular ephemeral secret tokens
   # - `kubernetes`: either the `in-cluster` variant (if the agent runs in the
-  #   same Kubernetes cluster as the `teleport-cluster` chart) or the `JWKS`
-  #   variant (works in every Kubernetes cluster, regardless of the Teleport Auth
+  #   same Kubernetes cluster as the `teleport-cluster` chart) or the `JWKS/OIDC`
+  #   variants (work in every Kubernetes cluster, regardless of the Teleport Auth
   #   Service location).
   method: "token"
 
   # joinParams.tokenName(string) -- controls which token is used by the agent to
   # join the Teleport cluster.
   #
-  # When `joinParams.method` is [a delegated join method](../../reference/join-methods.mdx#delegated-join-methods),
+  # When `joinParams.method` is [a delegated join method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
   # the value is not sensitive.
   #
   # When `joinParams.method` is `token` (by default), `joinParams.tokenName`
@@ -91,8 +101,18 @@ joinParams:
   # If method is `token`, `joinParams.tokenName` can be empty if the token
   # is provided through an existing Kubernetes Secret, see
   # [`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
+  #
+  # If method is `kubernetes`, you must set [`teleportClusterName`](#teleportClusterName).
   tokenName: ""
 
+# teleportClusterName(string) -- is the name of the joined Teleport cluster.
+# Setting this value is required when joining via the
+# [Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
+#
+# When this value is set, the chart mounts a kubernetes service account token
+# via a projected volume and configures Teleport to use it for joining.
+teleportClusterName: ""
+
 ################################################################
 # Values that must be provided if Kubernetes access is enabled.
 ################################################################
@@ -109,7 +129,7 @@ kubeClusterName: ""
 ################################################################
 
 # apps(list) -- is a static list of applications that should be proxied by
-# the agent. See [the Teleport Application access documentation](../../reference/agent-services/application-access.mdx#configuration)
+# the agent. See [the Teleport Application access documentation](../../enroll-resources/application-access/reference.mdx#configuration)
 # for more details.
 #
 # Proxied applications can be defined statically (through this value) or dynamically
@@ -134,13 +154,13 @@ kubeClusterName: ""
 # <Admonition type="tip" title="Supported values">
 #   You can see a list of all the supported values that can be used in a Teleport
 #   Application Service configuration in the [Application Service Configuration
-#   Reference](../../reference/agent-services/application-access.mdx#configuration).
+#   Reference](../../enroll-resources/application-access/reference.mdx#configuration).
 # </Admonition>
 apps: []
 
 # appResources(list) -- is a set of labels the agent will monitor. Any application
 # matching those labels will be proxied by the agent. See [the Teleport
-# Application access documentation](../../enroll-resources/application-access/introduction.mdx)
+# Application access documentation](../../enroll-resources/application-access/application-access.mdx)
 # for more details.
 #
 # Proxied applications can be defined statically (through [`apps`](#apps)) or
@@ -159,7 +179,7 @@ apps: []
 #
 # <Admonition type="tip" title="Example">
 # Once `appResources` is set, you can dynamically register application with
-# `tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/guides/dynamic-registration.mdx).
+# `tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/configuration/dynamic-registration.mdx).
 # </Admonition>
 appResources: []
 
@@ -179,7 +199,7 @@ clusterDomain: "cluster.local"
 # awsDatabases(list) -- configures AWS database auto-discovery.
 #
 # <Admonition type="note" title="IAM roles">
-#   For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport).
+#   For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enrollment/aws/rds/mysql-postgres-mariadb.mdx#step-36-create-iam-policies-for-teleport).
 #   After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
 #
 #   ```yaml
@@ -219,7 +239,7 @@ awsDatabases: []
 
 # azureDatabases(list) -- configures Azure database auto-discovery.
 # <Admonition type="note" title="Azure IAM">
-#   For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-25-configure-iam-permissions-for-teleport).
+#   For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enrollment/azure/azure-postgres-mysql.mdx#step-25-configure-iam-permissions-for-teleport).
 #
 #   After configuring a service principal with appropriate IAM permissions, you must pass credentials to the pods.
 #   The easiest way is to use an Azure client secret.
@@ -320,7 +340,7 @@ azureDatabases: []
 # ```
 #
 # <Admonition type="tip" title="Supported values">
-#   You can see a list of all the supported [values which can be used in a Teleport Database Service configuration here](../../reference/agent-services/database-access-reference/configuration.mdx).
+#   You can see a list of all the supported [values which can be used in a Teleport Database Service configuration here](../../enroll-resources/database-access/reference/configuration.mdx).
 # </Admonition>
 #
 # <Admonition type="tip" title="Trusting Database CA">
@@ -523,7 +543,7 @@ insecureSkipProxyTLSVerify: false
 # Teleport pods. The configuration will be merged with the chart-generated
 # configuration and will take precedence in case of conflict.
 #
-# See the [Teleport Configuration Reference](../../reference/config.mdx) for the list of supported fields.
+# See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
 #
 # ```yaml
 # teleportConfig:
@@ -568,11 +588,10 @@ tls:
   # ```code
   # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
   # ```
-  #
-  # <Admonition type="warning" title="Root CA filename">
-  #   The key containing the root CA in the secret must be `ca.pem`.
-  # </Admonition>
   existingCASecretName: ""
+  # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
+  # will be used as a trusted CA bundle file.
+  existingCASecretKeyName: "ca.pem"
 
 # updater -- controls whether the Kube Agent Updater should be deployed alongside
 # the `teleport-kube-agent`. The updater fetches the target version, validates the
@@ -651,7 +670,7 @@ updater:
   releaseChannel: "stable/cloud"
 
   # updater.group(string) -- is the update group used when fetching the version using the webapi protocol.
-  # When unset, the group defaults to `update.releaseChannel`.
+  # When unset, the group defaults to `default`.
   group: ""
 
   # updater.image(string) -- sets the container image used for Teleport updater
@@ -725,7 +744,7 @@ podSecurityPolicy:
   # and replaced since 1.23 by PodSecurityAdmission (PSA). If you are running on
   # Kubernetes 1.23 or later, it is recommended to disable PSPs and use PSAs.
   # The steps are documented in the
-  # [PSP removal guide](../../admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
+  # [PSP removal guide](../../zero-trust-access/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
   #
   # This value will be removed in a future chart version.
   enabled: true
@@ -746,7 +765,7 @@ podSecurityPolicy:
 #   To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
 #   To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
 #
-#   For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../admin-guides/management/admin/labels.mdx).
+#   For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../zero-trust-access/rbac-get-started/labels.mdx).
 # </Admonition>
 #
 # For example:
@@ -822,7 +841,7 @@ highAvailability:
 # This CRD is managed by the prometheus-operator and allows workload to
 # get monitored. To use this value, you need to run a `prometheus-operator`
 # in the cluster for this value to take effect.
-# See https://prometheus-operator.dev/docs/prologue/introduction/
+# See https://prometheus-operator.dev/docs/getting-started/introduction/
 podMonitor:
   # podMonitor.enabled(bool) -- controls if the chart deploys a PodMonitor.
   # This is disabled by default as it requires the PodMonitor CRD to be installed.
@@ -893,7 +912,7 @@ adminClusterRoleBinding:
 # You can override this to use your own Teleport image rather than a
 # Teleport-published image.
 #
-# <Admonition type="warning" title="Interaction with Teleport Kube Agent Updater"> 
+# <Admonition type="warning" title="Interaction with Teleport Kube Agent Updater">
 # When using the Teleport Kube Agent Updater, you must ensure the
 # image is available before the updater version target gets updated and
 # Kubernetes tries to pull the image.
@@ -927,7 +946,7 @@ image: public.ecr.aws/gravitational/teleport-distroless
 # By default, the image contains only the Teleport application and its runtime
 # dependencies, and does not contain a shell.
 # This setting only takes effect when [`enterprise`](#enterprise) is `true`.
-# When running an enterprise version, you must use [`image`](#image) instead.
+# When running an OSS version, you must use [`image`](#image) instead.
 enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
 
 # imagePullSecrets(list) -- is a list of secrets containing authorization tokens
@@ -1069,7 +1088,7 @@ log:
   format: text
   # log.extraFields(list) -- sets the fields used in logging for the Teleport process.
   #
-  # See the [Teleport config file reference](../../reference/config.mdx) for
+  # See the [Teleport config file reference](../../reference/deployment/config.mdx) for
   # more details on possible values for `extra_fields`.
   extraFields: ["timestamp", "level", "component", "caller"]
 
@@ -1082,6 +1101,32 @@ log:
 # for more details.
 affinity: {}
 
+# disableTopologySpreadConstraints(bool) -- turns off the topology spread constraints.
+# The feature is automatically turned off on Kubernetes versions below 1.18.
+disableTopologySpreadConstraints: false
+
+# topologySpreadConstraints(list) -- sets the topology spread constraints for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+# for more details.
+#
+# When unset, the chart defaults to a soft topology spread constraint
+# that tries to spread pods across hosts and zones.
+#
+# ```
+# topologySpreadConstraints:
+#   - maxSkew: 1
+#     topologyKey: kubernetes.io/hostname
+#     whenUnsatisfiable: ScheduleAnyway
+#     labelSelector:
+#       matchLabels: # dynamically computed
+#   - maxSkew: 1
+#     topologyKey: topology.kubernetes.io/zone
+#     whenUnsatisfiable: ScheduleAnyway
+#     labelSelector:
+#       matchLabels: # dynamically computed
+# ```
+topologySpreadConstraints: []
+
 # dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods.
 # This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
 # only use FQDNs to refer to applications and databases.
@@ -1270,6 +1315,18 @@ initContainers: []
 # for more details.
 resources: {}
 
+# goMemLimitRatio(float) -- configures the GOMEMLIMIT env var set by the chart.
+# GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+# below a given threshold. This is a best-effort attempt, but this helps
+# to prevent OOMs in case of bursts.
+#
+# When the memory limits are set and goMemLimitRatio is non-zero,
+# the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+# The value must be between 0 and 1.
+# Set to 0 to unset GOMEMLIMIT.
+# This has no effect if GOMEMLIMIT is already set through `extraEnv`.
+goMemLimitRatio: 0.9
+
 # initSecurityContext(object) -- sets the init container security context for any
 # pods created by the chart.
 # See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
diff --git a/examples/chart/teleport-relay/.helmignore b/examples/chart/teleport-relay/.helmignore
new file mode 100644
index 0000000000000..0e8a0eb36f4ca
--- /dev/null
+++ b/examples/chart/teleport-relay/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/examples/chart/teleport-relay/.lint/exercise-configmap.yaml b/examples/chart/teleport-relay/.lint/exercise-configmap.yaml
new file mode 100644
index 0000000000000..23a1d09d24208
--- /dev/null
+++ b/examples/chart/teleport-relay/.lint/exercise-configmap.yaml
@@ -0,0 +1,24 @@
+joinParams:
+  tokenName: token-name-2
+  method: join-method-2
+
+proxyAddr: proxy-2.example.com:443
+
+log:
+  level: randomLogLevel
+  format: randomLogFormat
+
+shutdownDelay: "90s"
+
+relayGroup: relay-group-2
+
+publicHostnames:
+  - public-hostname-3.example.com
+  - public-hostname-4.example.com
+
+targetConnectionCount: 42
+
+highAvailability:
+  replicaCount: 0
+
+proxyProtocol: true
diff --git a/examples/chart/teleport-relay/.lint/simple.yaml b/examples/chart/teleport-relay/.lint/simple.yaml
new file mode 100644
index 0000000000000..09bc0e0e8c4c9
--- /dev/null
+++ b/examples/chart/teleport-relay/.lint/simple.yaml
@@ -0,0 +1,11 @@
+joinParams:
+  tokenName: token-name
+  method: join-method
+
+proxyAddr: proxy.example.com:443
+
+relayGroup: relay-group
+
+publicHostnames:
+  - public-hostname-1.example.com
+  - public-hostname-2.example.com
diff --git a/examples/chart/teleport-relay/Chart.yaml b/examples/chart/teleport-relay/Chart.yaml
new file mode 100644
index 0000000000000..000f8a2d08bf5
--- /dev/null
+++ b/examples/chart/teleport-relay/Chart.yaml
@@ -0,0 +1,10 @@
+.version: &version "18.6.1"
+
+name: teleport-relay
+apiVersion: v2
+version: *version
+appVersion: *version
+description: This chart deploys the Teleport Relay service.
+icon: https://goteleport.com/static/teleport-symbol-bimi.svg
+keywords:
+  - Teleport
diff --git a/examples/chart/teleport-relay/templates/NOTES.txt b/examples/chart/teleport-relay/templates/NOTES.txt
new file mode 100644
index 0000000000000..8883ab66dde72
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/NOTES.txt
@@ -0,0 +1,9 @@
+{{- if .Values.teleportVersionOverride }}
+
+DANGER: `teleportVersionOverride` MUST NOT be used to control the Teleport version.
+This chart is designed to run Teleport version {{ .Chart.AppVersion }}.
+You will face compatibility issues trying to run a different Teleport version with it.
+
+If you want to run Teleport version {{.Values.teleportVersionOverride}},
+you should use `helm --version {{.Values.teleportVersionOverride}}` instead.
+{{- end }}
diff --git a/examples/chart/teleport-relay/templates/_config.tpl b/examples/chart/teleport-relay/templates/_config.tpl
new file mode 100644
index 0000000000000..a6f9874685774
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/_config.tpl
@@ -0,0 +1,41 @@
+{{- define "teleport-relay.config" -}}
+version: v3
+teleport:
+  join_params:
+    method: {{ required "joinParams.method is required in chart values" .Values.joinParams.method | quote }}
+    token_name: "/etc/teleport-secrets/auth-token"
+  proxy_server: {{ required "proxyAddr is required in chart values" .Values.proxyAddr | quote }}
+  log:
+    severity: {{ required "log.level is required in chart values" .Values.log.level | quote }}
+    format:
+      output: {{ required "log.format is required in chart values" .Values.log.format | quote }}
+  diag_addr: "0.0.0.0:3000"
+  {{- with .Values.shutdownDelay }}
+  shutdown_delay: {{ quote . }}
+  {{- end }}
+auth_service:
+  enabled: false
+proxy_service:
+  enabled: false
+ssh_service:
+  enabled: false
+relay_service:
+  enabled: true
+  relay_group: {{ required "relayGroup is required in chart values" .Values.relayGroup | quote }}
+  {{- if le (int .Values.targetConnectionCount) 0 }}
+    {{ fail "targetConnectionCount must be greater than 0" }}
+  {{- end }}
+  target_connection_count: {{ int .Values.targetConnectionCount }}
+  {{- if empty .Values.publicHostnames }}
+    {{- fail "publicHostnames cannot be empty in chart values" }}
+  {{- end }}
+  public_hostnames:
+    {{- toYaml .Values.publicHostnames | nindent 4 }}
+  transport_listen_addr: "0.0.0.0:3040"
+  peer_listen_addr: "0.0.0.0:3041"
+  tunnel_listen_addr: "0.0.0.0:3042"
+  {{- if .Values.proxyProtocol }}
+  transport_proxy_protocol: true
+  tunnel_proxy_protocol: true
+  {{- end }}
+{{- end -}}
diff --git a/examples/chart/teleport-relay/templates/_helpers.tpl b/examples/chart/teleport-relay/templates/_helpers.tpl
new file mode 100644
index 0000000000000..66aee87f3e6f4
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/_helpers.tpl
@@ -0,0 +1,87 @@
+{{- define "teleport-relay.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+This is a modified version of the default fully qualified app name helper.
+We diverge by always honouring "nameOverride" when it's set, as opposed to the
+default behaviour of shortening if `nameOverride` is included in chart name.
+This is done to avoid naming conflicts when including the chart in other charts.
+*/}}
+{{- define "teleport-relay.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- if .Values.nameOverride }}
+{{- printf "%s-%s" .Release.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- if contains .Chart.Name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "teleport-relay.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "teleport-relay.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "teleport-relay.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "teleport-relay.labels" -}}
+helm.sh/chart: {{ include "teleport-relay.chart" . }}
+{{ include "teleport-relay.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "teleport-relay.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "teleport-relay.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- required "serviceAccount.name is required in chart values if serviceAccount.create is false" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "teleport-relay.version" -}}
+{{ default .Chart.AppVersion .Values.teleportVersionOverride }}
+{{- end }}
+
+{{- define "teleport-relay.baseImage" -}}
+{{- if .Values.enterprise }}
+  {{- .Values.enterpriseImage }}
+{{- else }}
+  {{- .Values.image }}
+{{- end }}
+{{- end }}
+
+{{- define "teleport-relay.image" -}}
+{{ include "teleport-relay.baseImage" . }}:{{ include "teleport-relay.version" . }}
+{{- end }}
+
+{{- define "teleport-relay.joinTokenSecretName" -}}
+{{- if .Values.joinTokenSecret.create }}
+{{- default (include "teleport-relay.fullname" .) .Values.joinTokenSecret.name }}
+{{- else }}
+{{- required "joinTokenSecret.name is required in chart values if joinTokenSecret.create is false" .Values.joinTokenSecret.name }}
+{{- end }}
+{{- end }}
diff --git a/examples/chart/teleport-relay/templates/_quantity.tpl b/examples/chart/teleport-relay/templates/_quantity.tpl
new file mode 100644
index 0000000000000..f1ea7f5371df1
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/_quantity.tpl
@@ -0,0 +1,37 @@
+{{/* This template tries to parse a resource quantity like Kubernetes does.
+Helm sadly doesn't offer this critical primitive: https://github.com/helm/helm/issues/11376
+The quantity serialization format is described here: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go#L33
+
+This template support IEC, SI and decimal notation syntaxes, but has poor error handling.*/}}
+{{- define "teleport-relay.resource-quantity" -}}
+    {{- $value := . -}}
+    {{- $unit := 1.0 -}}
+    {{- if typeIs "string" . -}}
+        {{- $base2 := dict "Ki" 0x1p10 "Mi" 0x1p20 "Gi" 0x1p30 "Ti" 0x1p40 "Pi" 0x1p50 "Ei" 0x1p60 -}}
+        {{- $base10 := dict "m" 1e-3 "k" 1e3 "M" 1e6 "G" 1e9 "T" 1e12 "P" 1e15 "E" 1e18 -}}
+        {{- range $k, $v := merge $base2 $base10 -}}
+            {{- if hasSuffix $k $ -}}
+                {{- $value = trimSuffix $k $ -}}
+                {{- $unit = $v -}}
+            {{- end -}}
+        {{- end -}}
+    {{- end -}}
+    {{- mulf (float64 $value) $unit -}}
+{{- end -}}
+
+{{/* This renders the GOMEMLIMIT env var unless the user already specified it
+in extraEnv, goMemLimitRatio is set to 0, or requests.memory.limit is unset. */}}
+{{- define "teleport-relay.gomemlimit" -}}
+    {{- $alreadySet := false -}}
+    {{- range $_, $var := .Values.extraEnv -}}
+        {{- if eq $var.name "GOMEMLIMIT" -}}
+            {{- $alreadySet = true -}}
+        {{- end -}}
+    {{- end -}}
+    {{- if and (not $alreadySet) .Values.goMemLimitRatio -}}
+        {{- $ratio := .Values.goMemLimitRatio -}}
+        {{- with .Values.resources }}{{ with .limits }}{{ with .memory -}}
+            {{- include "teleport-relay.resource-quantity" . | float64 | mulf $ratio | ceil | int -}}
+        {{- end }}{{ end }}{{ end -}}
+    {{- end -}}
+{{- end -}}
diff --git a/examples/chart/teleport-relay/templates/configmap.yaml b/examples/chart/teleport-relay/templates/configmap.yaml
new file mode 100644
index 0000000000000..fda395d5ebf60
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/configmap.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "teleport-relay.fullname" . }}
+  labels:
+    {{- include "teleport-relay.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.config }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations.config }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  teleport.yaml: |
+    {{- mustMergeOverwrite (include "teleport-relay.config" . | fromYaml) .Values.teleportConfig | toYaml | nindent 4 -}}
diff --git a/examples/chart/teleport-relay/templates/deployment.yaml b/examples/chart/teleport-relay/templates/deployment.yaml
new file mode 100644
index 0000000000000..17d8459d74a88
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/deployment.yaml
@@ -0,0 +1,229 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "teleport-relay.fullname" . }}
+  labels:
+    {{- include "teleport-relay.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.deployment }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations.deployment }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "teleport-relay.selectorLabels" . | nindent 6 }}
+  {{- $replicaCount := int .Values.highAvailability.replicaCount }}
+  {{- if and (gt $replicaCount 0) (lt $replicaCount (int .Values.targetConnectionCount)) }}
+    {{- fail "highAvailability.replicaCount must not be smaller than targetConnectionCount" }}
+  {{- end }}
+  replicas: {{ $replicaCount }}
+  template:
+    metadata:
+      labels:
+        {{- include "teleport-relay.labels" . | nindent 8 }}
+        {{- with .Values.extraLabels.pod }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- with .Values.annotations.pod }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "teleport-relay.serviceAccountName" . | quote }}
+      automountServiceAccountToken: false
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ quote . }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.dnsPolicy }}
+      dnsPolicy: {{ quote . }}
+      {{- end }}
+      {{- with .Values.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and .Values.topologySpreadConstraints .Values.disableTopologySpreadConstraints }}
+        {{- fail "disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values"}}
+      {{- end }}
+      {{- if .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
+      {{- else if not .Values.disableTopologySpreadConstraints }}
+      topologySpreadConstraints:
+        - topologyKey: kubernetes.io/hostname
+          maxSkew: 1
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              {{- include "teleport-relay.selectorLabels" . | nindent 14 }}
+        - topologyKey: topology.kubernetes.io/zone
+          maxSkew: 1
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              {{- include "teleport-relay.selectorLabels" . | nindent 14 }}
+      {{- end }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "teleport-relay.fullname" . }}
+        - name: auth-token
+          secret:
+            secretName: {{ include "teleport-relay.joinTokenSecretName" . }}
+        - name: data
+          emptyDir: {}
+        {{- with .Values.tls.existingCASecretName }}
+        - name: teleport-tls-ca
+          secret:
+            secretName: {{ quote . }}
+        {{- end }}
+        {{- with .Values.teleportClusterName }}
+        {{- /* This volume is used to obtain a service account token that can be
+          used to join the Teleport cluster using the kubernetes join method. To
+          ensure Kubernetes compatibility, we use .Values.teleportClusterName as
+          a feature flag. The token must have the cluster name as audience, and
+          its TTL must not exceed 30 minutes. We pick 10 minutes because that's
+          the shortest lifetime for the token. */}}
+        - name: join-sa-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  path: join-sa-token
+                  expirationSeconds: 600
+                  audience: {{ quote . }}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: teleport
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: {{ include "teleport-relay.image" . | quote }}
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ quote . }}
+          {{- end }}
+          command:
+            - /usr/bin/dumb-init
+            - "--"
+            - /usr/local/bin/teleport
+          args:
+            - start
+            {{- if .Values.insecureSkipProxyTLSVerify }}
+            - "--insecure"
+            {{- end }}
+            {{- with .Values.extraArgs }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          env:
+            {{- $gomemlimit := include "teleport-relay.gomemlimit" . }}
+            {{- if $gomemlimit }}
+            - name: GOMEMLIMIT
+              value: {{ $gomemlimit | quote }}
+            {{- end }}
+            {{- /* This variable is set for telemetry purposes.
+              Telemetry is opt-in and controlled at the auth level. */}}
+            - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
+              value: "true"
+            {{- if .Values.teleportClusterName }}
+            - name: KUBERNETES_TOKEN_PATH
+              value: /var/run/secrets/teleport-join-sa-token/join-sa-token
+            {{- end }}
+            {{- if .Values.tls.existingCASecretName }}
+            - name: SSL_CERT_FILE
+              value: "/etc/teleport-tls-ca/{{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName }}" 
+            {{- end }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          ports:
+            - containerPort: 3000
+              name: diagnostics
+              protocol: TCP
+            - containerPort: 3040
+              name: transport
+              protocol: TCP
+            - containerPort: 3041
+              name: peer
+              protocol: TCP
+            - containerPort: 3042
+              name: tunnel
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: diagnostics
+            failureThreshold: 6
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 1
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: diagnostics
+            failureThreshold: 12
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 1
+          {{- with .Values.preStopDelay }}
+          lifecycle:
+            {{- /* waiting during preStop ensures that load balancers have time
+              to stop sending new connections to the Terminating pod */}}
+            preStop:
+              exec:
+                command:
+                  - /usr/local/bin/teleport
+                  - wait
+                  - duration
+                  - {{ quote . }}
+          {{- end }}
+          volumeMounts:
+            - mountPath: /var/lib/teleport
+              name: data
+            - mountPath: /etc/teleport.yaml
+              name: config
+              subPath: teleport.yaml
+            - mountPath: /etc/teleport-secrets
+              name: auth-token
+            {{- if .Values.teleportClusterName }}
+            - mountPath: /var/run/secrets/teleport-join-sa-token
+              name: join-sa-token
+            {{- end }}
+            {{- if .Values.tls.existingCASecretName }}
+            - mountPath: /etc/teleport-tls-ca
+              name: teleport-tls-ca
+              readOnly: true
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/examples/chart/teleport-relay/templates/pdb.yaml b/examples/chart/teleport-relay/templates/pdb.yaml
new file mode 100644
index 0000000000000..2146124b64965
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/pdb.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.highAvailability.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "teleport-relay.fullname" . }}
+  labels:
+    {{- include "teleport-relay.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.podDisruptionBudget }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations.podDisruptionBudget }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  minAvailable: {{ .Values.highAvailability.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "teleport-relay.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/examples/chart/teleport-relay/templates/secret.yaml b/examples/chart/teleport-relay/templates/secret.yaml
new file mode 100644
index 0000000000000..07859f15b7198
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/secret.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.joinTokenSecret.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "teleport-relay.joinTokenSecretName" . | quote }}
+  {{- with .Values.extraLabels.secret }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.annotations.secret }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+stringData:
+  auth-token: {{ required "joinParams.tokenName must be specified if joinTokenSecret.create is enabled" .Values.joinParams.tokenName | quote }}
+{{- end }}
diff --git a/examples/chart/teleport-relay/templates/service.yaml b/examples/chart/teleport-relay/templates/service.yaml
new file mode 100644
index 0000000000000..bbabf70691943
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/service.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "teleport-relay.fullname" . }}
+  labels:
+    {{- include "teleport-relay.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.service }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations.service }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ required "service.type must be set in chart values" .Values.service.type | quote }}
+  ports:
+    - name: transport
+      port: 443
+      targetPort: transport
+      protocol: TCP
+    - name: tunnel
+      port: 3042
+      targetPort: tunnel
+      protocol: TCP
+  selector:
+    {{- include "teleport-relay.selectorLabels" . | nindent 4 }}
+  {{- with .Values.service.spec }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
diff --git a/examples/chart/teleport-relay/templates/serviceaccount.yaml b/examples/chart/teleport-relay/templates/serviceaccount.yaml
new file mode 100644
index 0000000000000..c2217dde773e0
--- /dev/null
+++ b/examples/chart/teleport-relay/templates/serviceaccount.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "teleport-relay.serviceAccountName" . }}
+  labels:
+    {{- include "teleport-relay.labels" . | nindent 4 }}
+    {{- with .Values.extraLabels.serviceAccount }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations.serviceAccount }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}
diff --git a/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap
new file mode 100644
index 0000000000000..3834076c7da43
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap
@@ -0,0 +1,64 @@
+teleport.yaml matches the snapshot (exercise-configmap):
+  1: |
+    |-
+      auth_service:
+        enabled: false
+      proxy_service:
+        enabled: false
+      relay_service:
+        enabled: true
+        peer_listen_addr: 0.0.0.0:3041
+        public_hostnames:
+        - public-hostname-3.example.com
+        - public-hostname-4.example.com
+        relay_group: relay-group-2
+        target_connection_count: 42
+        transport_listen_addr: 0.0.0.0:3040
+        transport_proxy_protocol: true
+        tunnel_listen_addr: 0.0.0.0:3042
+        tunnel_proxy_protocol: true
+      ssh_service:
+        enabled: false
+      teleport:
+        diag_addr: 0.0.0.0:3000
+        join_params:
+          method: join-method-2
+          token_name: /etc/teleport-secrets/auth-token
+        log:
+          format:
+            output: randomLogFormat
+          severity: randomLogLevel
+        proxy_server: proxy-2.example.com:443
+        shutdown_delay: 90s
+      version: v3
+teleport.yaml matches the snapshot (simple):
+  1: |
+    |-
+      auth_service:
+        enabled: false
+      proxy_service:
+        enabled: false
+      relay_service:
+        enabled: true
+        peer_listen_addr: 0.0.0.0:3041
+        public_hostnames:
+        - public-hostname-1.example.com
+        - public-hostname-2.example.com
+        relay_group: relay-group
+        target_connection_count: 2
+        transport_listen_addr: 0.0.0.0:3040
+        tunnel_listen_addr: 0.0.0.0:3042
+      ssh_service:
+        enabled: false
+      teleport:
+        diag_addr: 0.0.0.0:3000
+        join_params:
+          method: join-method
+          token_name: /etc/teleport-secrets/auth-token
+        log:
+          format:
+            output: json
+          severity: INFO
+        proxy_server: proxy.example.com:443
+        shutdown_delay: 30s
+      version: v3
diff --git a/examples/chart/teleport-relay/tests/configmap_test.yaml b/examples/chart/teleport-relay/tests/configmap_test.yaml
new file mode 100644
index 0000000000000..50675dc26b66e
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/configmap_test.yaml
@@ -0,0 +1,95 @@
+suite: Test ConfigMap
+templates:
+  - configmap.yaml
+
+tests:
+  - it: creates a config map
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: ConfigMap
+          apiVersion: v1
+          name: RELEASE-NAME-teleport-relay
+      - isNotNull:
+          path: data.teleport\.yaml
+  - it: includes extraLabels and annotations
+    values:
+      - ../.lint/simple.yaml
+    set:
+      extraLabels:
+        config:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        config:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
+
+  - it: fails if joinParams.method is missing
+    values:
+      - ../.lint/simple.yaml
+    set:
+      joinParams:
+        method: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: joinParams.method is required in chart values
+  - it: fails if proxyAddr is missing
+    values:
+      - ../.lint/simple.yaml
+    set:
+      proxyAddr: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: proxyAddr is required in chart values
+  - it: fails if relayGroup is missing
+    values:
+      - ../.lint/simple.yaml
+    set:
+      relayGroup: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: relayGroup is required in chart values
+  - it: fails if targetConnectionCount is not positive
+    values:
+      - ../.lint/simple.yaml
+    set:
+      targetConnectionCount: -3
+    asserts:
+      - failedTemplate:
+          errorMessage: targetConnectionCount must be greater than 0
+  - it: fails if publicHostnames is empty
+    values:
+      - ../.lint/simple.yaml
+    set:
+      publicHostnames: []
+    asserts:
+      - failedTemplate:
+          errorMessage: publicHostnames cannot be empty in chart values
+
+  - it: teleport.yaml matches the snapshot (simple)
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - matchSnapshot:
+          path: data.teleport\.yaml
+  - it: teleport.yaml matches the snapshot (exercise-configmap)
+    values:
+      - ../.lint/exercise-configmap.yaml
+    asserts:
+      - matchSnapshot:
+          path: data.teleport\.yaml
diff --git a/examples/chart/teleport-relay/tests/deployment_test.yaml b/examples/chart/teleport-relay/tests/deployment_test.yaml
new file mode 100644
index 0000000000000..bb36ab3a05576
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/deployment_test.yaml
@@ -0,0 +1,410 @@
+suite: Test Deployment
+templates:
+  - configmap.yaml
+  - deployment.yaml
+
+tests:
+  - it: creates a deployment
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: Deployment
+          apiVersion: apps/v1
+          name: RELEASE-NAME-teleport-relay
+
+  - it: includes extraLabels and annotations
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      extraLabels:
+        deployment:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        deployment:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
+  - it: includes extraLabels and annotations in the pod template
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      extraLabels:
+        pod:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        pod:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - isSubset:
+          path: spec.template.metadata.annotations
+          content:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
+
+  - it: pods are selected by deployment, service and pdb
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    # these selector labels are also checked to be matched in service_test.yaml
+    # and pdb_test.yaml
+    asserts:
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: teleport-relay
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: teleport-relay
+
+  - it: pods are selected by the default topologySpreadConstraints
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.topologySpreadConstraints
+          value:
+            - topologyKey: kubernetes.io/hostname
+              maxSkew: 1
+              whenUnsatisfiable: ScheduleAnyway
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: RELEASE-NAME
+                  app.kubernetes.io/name: teleport-relay
+            - topologyKey: topology.kubernetes.io/zone
+              maxSkew: 1
+              whenUnsatisfiable: ScheduleAnyway
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: RELEASE-NAME
+                  app.kubernetes.io/name: teleport-relay
+
+  - it: refuses to set and disable topologySpreadConstraints at the same time
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      disableTopologySpreadConstraints: true
+      topologySpreadConstraints: nonempty
+    asserts:
+      - failedTemplate:
+          errorMessage: disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values
+
+  - it: requires the target connection count to be not greater than the replica count
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      highAvailability:
+        replicaCount: 2
+      targetConnectionCount: 3
+    asserts:
+      - failedTemplate:
+          errorMessage: highAvailability.replicaCount must not be smaller than targetConnectionCount
+
+  - it: allows the replica count to be zero no matter the target connection count
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      highAvailability:
+        replicaCount: 0
+      targetConnectionCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 0
+
+  - it: chooses the default service account and join token
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-teleport-relay
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: auth-token
+            secret:
+              secretName: RELEASE-NAME-teleport-relay
+
+  - it: chooses the customized service account and join token
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      serviceAccount:
+        name: randomServiceAccountName
+      joinTokenSecret:
+        name: randomSecretName
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: randomServiceAccountName
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: auth-token
+            secret:
+              secretName: randomSecretName
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-secrets
+            name: auth-token
+
+  - it: chooses the correct configmap
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+            configMap:
+              name: RELEASE-NAME-teleport-relay
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport.yaml
+            name: config
+            subPath: teleport.yaml
+
+  - it: defines the projected service account token with the appropriate audience
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      teleportClusterName: randomTeleportClusterName
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: join-sa-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    path: join-sa-token
+                    expirationSeconds: 600
+                    audience: randomTeleportClusterName
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/run/secrets/teleport-join-sa-token
+            name: join-sa-token
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_TOKEN_PATH
+            value: /var/run/secrets/teleport-join-sa-token/join-sa-token
+  - it: does not include a projected service account if teleportClusterName is not set
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: join-sa-token
+          any: true
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: join-sa-token
+          any: true
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KUBERNETES_TOKEN_PATH
+          any: true
+
+  - it: defines the ports referenced by the service
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    # these are values checked for in service_test.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: transport
+            protocol: TCP
+          any: true
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: tunnel
+            protocol: TCP
+          any: true
+
+  - it: uses the non-enterprise image by default
+    chart:
+      appVersion: 12.34.56-sigma
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: public.ecr.aws/gravitational/teleport-distroless:12.34.56-sigma
+  - it: uses the enterprise image if the option is set
+    chart:
+      appVersion: 12.34.56-sigma
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      enterprise: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: public.ecr.aws/gravitational/teleport-ent-distroless:12.34.56-sigma
+
+  - it: mounts a secret for SSL_CERT_FILE if the option is set
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      tls:
+        existingCASecretName: randomCASecretName
+        existingCASecretKeyName: randomCASecretKeyName
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: teleport-tls-ca
+            secret:
+              secretName: randomCASecretName
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-tls-ca
+            name: teleport-tls-ca
+            readOnly: true
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SSL_CERT_FILE
+            value: /etc/teleport-tls-ca/randomCASecretKeyName
+
+  - it: sets GOMEMLIMIT by default (SI unit)
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      resources:
+        limits:
+          memory: "10.5G"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: sets GOMEMLIMIT by default (IEC unit)
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      resources:
+        limits:
+          memory: "10.5Gi"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "10146860237"
+
+  - it: sets GOMEMLIMIT by default (scientific notation)
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      resources:
+        limits:
+          memory: "10.5e9"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: honours existing GOMEMLIMIT
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      resources:
+        limits:
+          memory: "10.5G"
+      extraEnv:
+        - name: FOO
+          value: bar
+        - name: GOMEMLIMIT
+          value: "5GB"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "5GB"
+
+  - it: does not set GOMEMLIMIT if ratio is 0
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    set:
+      resources:
+        limits:
+          memory: "10.5G"
+      goMemLimitRatio: 0
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+            value: "9450000000"
+
+  - it: does not set GOMEMLIMIT if resources are not set
+    template: deployment.yaml
+    values:
+      - ../.lint/simple.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "GOMEMLIMIT"
+          any: true
diff --git a/examples/chart/teleport-relay/tests/pdb_test.yaml b/examples/chart/teleport-relay/tests/pdb_test.yaml
new file mode 100644
index 0000000000000..01ee55ec6eb6b
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/pdb_test.yaml
@@ -0,0 +1,73 @@
+suite: Test PodDisruptionBudget
+templates:
+  - pdb.yaml
+
+tests:
+  - it: does not create a PDB by default
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: creates a PDB if highAvailability.podDisruptionBudget.enabled is set
+    set:
+      highAvailability:
+        podDisruptionBudget:
+          enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: PodDisruptionBudget
+          apiVersion: policy/v1
+          name: RELEASE-NAME-teleport-relay
+      - equal:
+          path: spec.minAvailable
+          value: 1
+  - it: sets the custom minAvailable from the values
+    set:
+      highAvailability:
+        podDisruptionBudget:
+          enabled: true
+          minAvailable: 42
+    asserts:
+      - equal:
+          path: spec.minAvailable
+          value: 42
+
+  - it: selects the deployment pods
+    set:
+      highAvailability:
+        podDisruptionBudget:
+          enabled: true
+    # the selector labels are checked to be in the deployment template in
+    # deployment_test.yaml
+    asserts:
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: teleport-relay
+
+  - it: includes extraLabels and annotations
+    set:
+      highAvailability:
+        podDisruptionBudget:
+          enabled: true
+      extraLabels:
+        podDisruptionBudget:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        podDisruptionBudget:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
diff --git a/examples/chart/teleport-relay/tests/secret_test.yaml b/examples/chart/teleport-relay/tests/secret_test.yaml
new file mode 100644
index 0000000000000..d63c952ce64be
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/secret_test.yaml
@@ -0,0 +1,70 @@
+suite: Test Secret
+templates:
+  - secret.yaml
+
+tests:
+  - it: creates a secret by default
+    set:
+      joinParams:
+        tokenName: randomTokenName
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: RELEASE-NAME-teleport-relay
+  - it: fails if joinParams.tokenName is missing
+    asserts:
+      - failedTemplate:
+          errorMessage: joinParams.tokenName must be specified if joinTokenSecret.create is enabled
+  - it: the secret contains the token in auth-token
+    set:
+      joinParams:
+        tokenName: randomTokenName
+    asserts:
+      - equal:
+          path: stringData.auth-token
+          value: randomTokenName
+
+  - it: does not create a secret account if joinTokenSecret.create is false
+    set:
+      joinTokenSecret:
+        create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: creates a secret with the configured name
+    set:
+      joinParams:
+        tokenName: randomTokenName
+      joinTokenSecret:
+        name: randomSecretName
+    asserts:
+      - equal:
+          path: metadata.name
+          value: randomSecretName
+
+  - it: includes extraLabels and annotations
+    set:
+      joinParams:
+        tokenName: randomTokenName
+      extraLabels:
+        secret:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        secret:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
diff --git a/examples/chart/teleport-relay/tests/service_test.yaml b/examples/chart/teleport-relay/tests/service_test.yaml
new file mode 100644
index 0000000000000..518213c66ba15
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/service_test.yaml
@@ -0,0 +1,100 @@
+suite: Test Service
+templates:
+  - service.yaml
+
+tests:
+  - it: creates a service
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: RELEASE-NAME-teleport-relay
+
+  - it: defines the expected ports
+    # the port names are checked in deployment_test.yaml
+    asserts:
+      - lengthEqual:
+          path: spec.ports
+          count: 2
+      - contains:
+          path: spec.ports
+          content:
+            name: transport
+            port: 443
+            targetPort: transport
+            protocol: TCP
+      - contains:
+          path: spec.ports
+          content:
+            name: tunnel
+            port: 3042
+            targetPort: tunnel
+            protocol: TCP
+
+  - it: selects the deployment pods
+    # the selector labels are checked to be in the deployment template in
+    # deployment_test.yaml
+    asserts:
+      - equal:
+          path: spec.selector
+          value:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: teleport-relay
+
+  - it: requires service.type
+    set:
+      service:
+        type: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: service.type must be set in chart values
+  - it: the default service type is LoadBalancer
+    asserts:
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+  - it: service.type sets the service type
+    set:
+      service:
+        type: serviceType
+    asserts:
+      - equal:
+          path: spec.type
+          value: serviceType
+
+  - it: includes service.spec, extraLabels and annotations
+    set:
+      service:
+        spec:
+          specKey1:
+            - specValue1
+            - 42
+          specKey2: specValue2
+      extraLabels:
+        service:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        service:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
+      - isSubset:
+          path: spec
+          content:
+            specKey2: specValue2
+            specKey1:
+              - specValue1
+              - 42
diff --git a/examples/chart/teleport-relay/tests/serviceaccount_test.yaml b/examples/chart/teleport-relay/tests/serviceaccount_test.yaml
new file mode 100644
index 0000000000000..66983b80adeca
--- /dev/null
+++ b/examples/chart/teleport-relay/tests/serviceaccount_test.yaml
@@ -0,0 +1,49 @@
+suite: Test ServiceAccount
+templates:
+  - serviceaccount.yaml
+
+tests:
+  - it: creates a service account by default
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+          name: RELEASE-NAME-teleport-relay
+  - it: does not create a service account if serviceAccount.create is false
+    set:
+      serviceAccount:
+        create: false
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: creates a service account with the configured name
+    set:
+      serviceAccount:
+        name: randomServiceAccountName
+    asserts:
+      - equal:
+          path: metadata.name
+          value: randomServiceAccountName
+  - it: includes extraLabels and annotations
+    set:
+      extraLabels:
+        serviceAccount:
+          labelName1: labelValue1
+          labelName2: labelValue2
+      annotations:
+        serviceAccount:
+          annotationName1: annotationValue1
+          annotationName2: annotationValue2
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            labelName1: labelValue1
+            labelName2: labelValue2
+      - equal:
+          path: metadata.annotations
+          value:
+            annotationName1: annotationValue1
+            annotationName2: annotationValue2
diff --git a/examples/chart/teleport-relay/values.yaml b/examples/chart/teleport-relay/values.yaml
new file mode 100644
index 0000000000000..c1f453f708ad3
--- /dev/null
+++ b/examples/chart/teleport-relay/values.yaml
@@ -0,0 +1,571 @@
+# relayGroup(string) -- sets the internal identifier for the group of Relay
+# instances reachable through the same load balancer. Should be unique in the
+# whole Teleport cluster.
+relayGroup: ""
+
+# publicHostnames(list) -- a list of hostnames that this Relay group is publicly
+# reachable at by clients.
+#
+# ```
+# publicHostnames:
+#   - relay.example.com
+# ```
+publicHostnames: []
+
+# targetConnectionCount(int) -- the amount of tunnel connections that agents
+# will open to distinct Relay instances. It should not be bigger than the
+# replica count.
+targetConnectionCount: 2
+
+# proxyAddr(string) -- provides the public-facing Teleport Proxy Service
+# endpoint which should be used to join the cluster. This is the same URL used
+# to access the web UI of your Teleport cluster. The port used is usually either
+# 3080 or 443.
+#
+# Here are a few examples:
+#
+# | Deployment method             | Example `proxy_service.public_addr` |
+# |-------------------------------|-------------------------------------|
+# | On-prem Teleport cluster      | `teleport.example.com:3080`         |
+# | Teleport Cloud cluster        | `example.teleport.sh:443`           |
+# | `teleport-cluster` Helm chart | `teleport.example.com:443`          |
+proxyAddr: ""
+
+# enterprise(bool) -- controls if the `teleport-relay` chart should deploy the
+# OSS version or the enterprise version of the container image. This must be set
+# to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise
+# clusters to allow the agent to leverage enterprise features.
+enterprise: false
+
+# joinParams -- controls how the Teleport Agent joins the Teleport cluster.
+# These sub-values must be configured for the agent to connect to a cluster.
+#
+# The token used must grant the `Relay` role, and should be valid for the
+# lifetime of the Helm release.
+joinParams:
+  # joinParams.method(string) -- controls which join method will be used by the
+  # instance to join the Teleport cluster.
+  #
+  # See [the join method reference](../../reference/deployment/join-methods.mdx)
+  # for the list of possible values, the implications of each join method, and
+  # guides to set up each method.
+  #
+  # Common join-methods for the `teleport-relay` are:
+  # - `token`: the most basic one, with regular ephemeral secret tokens
+  # - `kubernetes`: either the `in-cluster` variant (if the agent runs in the
+  #   same Kubernetes cluster as the `teleport-cluster` chart) or the
+  #   `JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the
+  #   Teleport Auth Service location).
+  method: ""
+
+  # joinParams.tokenName(string) -- controls which token is used by the agent to
+  # join the Teleport cluster.
+  #
+  # When `joinParams.method` is [a delegated join
+  # method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
+  # the value is not sensitive.
+  #
+  # When `joinParams.method` is `token` (by default), `joinParams.tokenName`
+  # contains the secret token itself. In this case, the value is sensitive and
+  # is automatically stored in a Kubernetes Secret instead of being directly
+  # included in the agent's configuration.
+  #
+  # If method is `token`, `joinParams.tokenName` can be empty if the token is
+  # provided through an existing Kubernetes Secret, see
+  # [`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
+  #
+  # If method is `kubernetes`, you must set
+  # [`teleportClusterName`](#teleportClusterName).
+  tokenName: ""
+
+# teleportClusterName(string) -- is the name of the joined Teleport cluster.
+# Setting this value is required when joining via the
+# [Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
+#
+# When this value is set, the chart mounts a kubernetes service account token
+# via a projected volume and configures Teleport to use it for joining.
+teleportClusterName: ""
+
+# joinTokenSecret -- manages the join token secret creation and its name. See
+# the [`joinParams`](#joinParams) section for more details.
+joinTokenSecret:
+  # joinTokenSecret.create(bool) -- controls whether the chart creates the
+  # Kubernetes `Secret` containing the Teleport join token. If false, you must
+  # create a Kubernetes Secret with the configured name in the Helm release
+  # namespace.
+  create: true
+  # joinTokenSecret.name(string) -- is the name of the Kubernetes Secret
+  # containing the Teleport join token used by the chart.
+  #
+  # If `joinTokenSecret.create` is `false`, the chart will not attempt to create
+  # the secret itself. Instead, it will read the value from an existing secret.
+  # `joinTokenSecret.name` configures the name of this secret. This allows you
+  # to configure this secret externally and avoid having a plaintext join token
+  # stored in your Teleport chart values.
+  #
+  # To create your own join token secret, you can use a command like this:
+  #
+  # ```code
+  # $ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token=<replace-with-actual-token>
+  # ```
+  #
+  # <Admonition type="note">
+  #
+  #   The key used for the auth token inside the secret must be `auth-token`, as
+  #   in the command above.
+  #
+  # </Admonition>
+  #
+  # ```yaml
+  # joinTokenSecret:
+  #   create: false
+  #   name: my-token-secret
+  #
+  # joinParams:
+  #   method: "token"
+  #   tokenName: ""
+  # ```
+  name: ""
+
+# proxyProtocol(bool) -- controls whether or not the connections coming from the
+# load balancer will include a PROXY protocol v2 header.
+proxyProtocol: false
+
+# log -- controls the agent logging.
+log:
+  # log.level(string) -- is the log level for the Teleport process.
+  # Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+  #
+  # The default is `INFO`, which is recommended in production.
+  # `DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+  level: INFO
+  # log.format(string) -- sets the log output format for the Teleport process.
+  # Possible values are `text` or `json`.
+  format: json
+
+# preStopDelay(string) -- the optional time that will pass between the pod
+# entering the Terminating state and the Teleport instance getting signaled to
+# begin its shutdown advertisement. Useful to allow load balancers to stop
+# routing connections to the terminating pod.
+preStopDelay: "30s"
+
+# shutdownDelay(string) -- the optional time that the Teleport instance will
+# wait after advertising its shutdown and before it will stop serving new
+# inbound connections.
+shutdownDelay: "30s"
+
+# terminationGracePeriodSeconds(int) -- the time allotted to a Teleport instance
+# pod for termination. It should be longer than the sum of
+# [`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay).
+terminationGracePeriodSeconds: 90
+
+# highAvailability -- contains settings controlling the availability of the
+# Teleport Agent deployed by the chart.
+#
+# The availability can be increased by:
+# - running more replicas with `replicaCount`
+# - requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity`
+# - by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`.
+#
+# Even with highAvailability settings Restarting/rolling-out pods can still cause
+# disruption for established long-lived sessions.
+highAvailability:
+  # highAvailability.replicaCount(int) -- is the number of agent replicas
+  # deployed by the Chart.
+  #
+  # Set to a number higher than `1` for a high availability mode where multiple
+  # Teleport pods will be deployed.
+  #
+  # <Admonition type="tip" title="Sizing guidelines">
+  #
+  #   As a rough guide, we recommend configuring one replica per distinct
+  #   availability zone where your cluster has worker nodes.
+  #
+  #   2 replicas/availability zones will be fine for smaller workloads. 3-5
+  #   replicas/availability zones will be more appropriate for bigger clusters
+  #   with more traffic.
+  #
+  # </Admonition>
+  replicaCount: 2
+
+  # highAvailability.podDisruptionBudget -- controls how the chart creates and
+  # configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not
+  # delete all agent replicas at the same time.
+  podDisruptionBudget:
+    # highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create
+    # a Kubernetes PodDisruptionBudget for the agent pods.
+    enabled: false
+
+    # highAvailability.podDisruptionBudget.minAvailable(intOrString) -- is the
+    # minimum available pod count specified on the PodDisruptionBudget.
+    minAvailable: 1
+
+# resources(object) -- sets the resource requests/limits for any pods created by
+# the chart. See [the Kubernetes
+# documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+# for more details.
+resources: {}
+
+# goMemLimitRatio(float) -- configures the GOMEMLIMIT env var set by the chart.
+# GOMEMLIMIT instructs the go garbage collector to try to keep allocated memory
+# below a given threshold. This is a best-effort attempt, but this helps
+# to prevent OOMs in case of bursts.
+#
+# When the memory limits are set and goMemLimitRatio is non-zero,
+# the chart sets the GOMEMLIMIT to `resources.memory.limits * goMemLimitRatio`.
+# The value must be between 0 and 1.
+# Set to 0 to unset GOMEMLIMIT.
+# This has no effect if GOMEMLIMIT is already set through `extraEnv`.
+goMemLimitRatio: 0.9
+
+# service -- options for the Service that points to the Teleport Relay
+# instances.
+service:
+  # service.type(string) -- the type of the Service. Unless you have specific
+  # needs, it should probably be set to LoadBalancer.
+  type: LoadBalancer
+  # service.spec(object) -- any additional entries here will be added to the
+  # Service spec.
+  #
+  # ```
+  # spec:
+  #   loadBalancerIP: "1.2.3.4"
+  #   loadBalancerClass: service.k8s.aws/nlb
+  # ```
+  spec: {}
+  # To set annotations on the Service, use the annotations.service value.
+
+# serviceAccount -- contains settings related to the Kubernetes service account
+# used by pods.
+serviceAccount:
+  # serviceAccount.create(bool) -- specifies whether a `ServiceAccount` should
+  # be created or if an existing one should be used.
+  create: true
+  # serviceAccount.name(string) -- the name of the `ServiceAccount` to use. If
+  # not set and serviceAccount.create is true, the name is generated using the
+  # release name. If create is false, the name will be used to reference an
+  # existing service account.
+  name: ""
+  # To set annotations on the `ServiceAccount`, use the
+  # `annotations.serviceAccount` value.
+
+# extraLabels -- contains additional Kubernetes labels to apply on the resources
+# created by the chart. See [the Kubernetes label documentation
+# ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+# for more information.
+extraLabels:
+  # extraLabels.config(object) -- are labels to set on the ConfigMap.
+  config: {}
+  # extraLabels.deployment(object) -- are labels to set on the Deployment.
+  deployment: {}
+  # extraLabels.pod(object) -- are labels to set on the Pods.
+  pod: {}
+  # extraLabels.podDisruptionBudget(object) -- are labels to set on the
+  # PodDisruptionBudget.
+  podDisruptionBudget: {}
+  # extraLabels.secret(object) -- are labels to set on the Secret.
+  secret: {}
+  # extraLabels.service(object) -- are labels to set on the Service.
+  service: {}
+  # extraLabels.serviceAccount(object) -- are labels to set on the
+  # ServiceAccount.
+  serviceAccount: {}
+
+# annotations -- contains annotations to apply to the different Kubernetes
+# objects created by the chart. See [the Kubernetes annotation
+# documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+# for more details.
+annotations:
+  # annotations.config(object) -- are annotations to set on the ConfigMap.
+  config: {}
+  # annotations.deployment(object) -- are annotations to set on the Deployment.
+  deployment: {}
+  # annotations.pod(object) -- are annotations to set on the Pods.
+  pod: {}
+  # annotations.podDisruptionBudget(object) -- are annotations to set on the
+  # podDisruptionBudget.
+  podDisruptionBudget: {}
+  # annotations.secret(object) -- are annotations to set on the Secret.
+  secret: {}
+  # annotations.service(object) -- are annotations to set on the Service.
+  service: {}
+  # annotations.serviceAccount(object) -- are annotations to set on the
+  # ServiceAccount.
+  serviceAccount: {}
+
+# image(string) -- sets the container image used for Teleport Community Edition
+# Agent pods created by the chart.
+#
+# You can override this to use your own Teleport image rather than a
+# Teleport-published image.
+#
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
+#
+# This setting only takes effect when [`enterprise`](#enterprise) is `false`.
+# When running an enterprise version, you must use
+# [`enterpriseImage`](#enterpriseImage) instead.
+image: public.ecr.aws/gravitational/teleport-distroless
+
+# enterpriseImage(string) -- sets the container image used for Teleport Enterprise
+# agent pods created by the chart.
+#
+# You can override this to use your own Teleport image rather than a
+# Teleport-published image.
+#
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
+#
+# This setting only takes effect when [`enterprise`](#enterprise) is `true`.
+# When running an OSS version, you must use [`image`](#image) instead.
+enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
+
+# imagePullSecrets(list) -- is a list of secrets containing authorization tokens
+# which can be optionally used to access a private Docker registry.
+#
+# See the [Kubernetes
+# reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
+# for more details.
+imagePullSecrets: []
+
+# imagePullPolicy(string) -- sets the pull policy for any pods created by the
+# chart. See [the Kubernetes
+# documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+# for more details.
+imagePullPolicy: IfNotPresent
+
+# topologySpreadConstraints(list) -- sets the topology spread constraints for
+# any pods created by the chart. See [the Kubernetes
+# documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+# for more details.
+#
+# When unset, the chart defaults to a soft topology spread constraint that tries
+# to spread pods across hosts and zones.
+#
+# ```
+# topologySpreadConstraints:
+#   - maxSkew: 1
+#     topologyKey: kubernetes.io/hostname
+#     whenUnsatisfiable: ScheduleAnyway
+#     labelSelector:
+#       matchLabels: # dynamically computed
+#   - maxSkew: 1
+#     topologyKey: topology.kubernetes.io/zone
+#     whenUnsatisfiable: ScheduleAnyway
+#     labelSelector:
+#       matchLabels: # dynamically computed
+# ```
+topologySpreadConstraints: []
+
+# disableTopologySpreadConstraints(bool) -- turns off the default topology
+# spread constraints.
+disableTopologySpreadConstraints: false
+
+# affinity(object) -- sets the affinities for any pods created by the chart. See
+# [the Kubernetes
+# documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+# for more details.
+affinity: {}
+
+# tolerations(list) -- sets the tolerations for any pods created by the chart.
+# See [the Kubernetes
+# documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+# for more details.
+tolerations: []
+
+# teleportConfig(object) -- contains YAML teleport configuration to pass to the
+# Teleport pods. The configuration will be merged with the chart-generated
+# configuration and will take precedence in case of conflict.
+#
+# See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
+teleportConfig: {}
+
+# extraArgs(list) -- contains extra arguments to pass to `teleport start` for
+# the main Teleport container.
+extraArgs: []
+
+# extraEnv(list) -- contains extra environment variables to set in the main
+# Teleport container.
+#
+# For example:
+# ```yaml
+# extraEnv:
+#   - name: HTTPS_PROXY
+#     value: "http://username:password@my.proxy.host:3128"
+# ```
+extraEnv: []
+
+# extraVolumes(list) -- contains extra volumes to mount into the Teleport pods.
+# See [the Kubernetes volume
+# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+# details.
+#
+# For example:
+# ```yaml
+# extraVolumes:
+# - name: myvolume
+#   secret:
+#     secretName: testSecret
+# ```
+extraVolumes: []
+
+# extraVolumeMounts(list) -- contains extra volumes mounts for the main Teleport
+# container. See [the Kubernetes volume
+# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
+# details.
+#
+# For example:
+# ```yaml
+# extraVolumesMounts:
+# - name: myvolume
+#   mountPath: /path/on/host
+# ```
+extraVolumeMounts: []
+
+# dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods.
+# This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
+# only use FQDNs to refer to remote hosts.
+#
+# See [the Kubernetes pod DNS documentation
+# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config)
+# for more information.
+#
+# For example:
+# ```yaml
+#  nameservers:
+#    - 1.2.3.4
+#  searches:
+#    - ns1.svc.cluster-domain.example
+#    - my.dns.search.suffix
+#  options:
+#    - name: ndots
+#      value: "2"
+# ```
+dnsConfig: {}
+
+# dnsPolicy(string) -- sets the Pod's DNS Policy
+#
+# See [the Kubernetes pod DNS documentation
+# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
+# for more information.
+dnsPolicy: ""
+
+# hostAliases -- sets Host aliases in the Teleport Pod. See [the Kubernetes
+# hosts file
+# documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
+# for more details.
+#
+# For example:
+# ```yaml
+# hostAliases:
+#   - ip: "127.0.0.1"
+#     hostnames:
+#       - "foo.local"
+#       - "bar.local"
+#   - ip: "10.1.2.3"
+#     hostnames:
+#       - "foo.remote"
+#       - "bar.remote"
+# ```
+hostAliases: []
+
+# tls -- contains settings for mounting your own TLS material in the agent pod.
+tls:
+  # tls.existingCASecretName(string) -- sets the `SSL_CERT_FILE` environment
+  # variable to load a trusted CA or bundle in PEM format into Teleport pods.
+  # The injected CA will be used to validate TLS communications with the Proxy
+  # Service.
+  #
+  # You must create a secret containing the CA certs in the same namespace as
+  # Teleport using a command like:
+  #
+  # ```code
+  # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
+  # ```
+  existingCASecretName: ""
+  # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
+  # will be used as a trusted CA bundle file.
+  existingCASecretKeyName: ca.pem
+
+# insecureSkipProxyTLSVerify(bool) -- disables TLS verification of the TLS
+# certificate presented by the Proxy Service.
+#
+# This can be used for joining a Teleport instance to a Teleport cluster which
+# does not have valid TLS certificates for testing.
+#
+# <Admonition type="warning">
+#
+#   Using a self-signed TLS certificate and disabling TLS verification is OK for
+#   testing, but is not viable when running a production Teleport cluster as it
+#   will drastically reduce security. You must configure valid TLS certificates
+#   on your Teleport cluster for production workloads.
+#
+#   One option might be to use Teleport's built-in [ACME
+#   support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable
+#   [cert-manager
+#   support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager).
+#
+# </Admonition>
+insecureSkipProxyTLSVerify: false
+
+# securityContext(object) -- sets the container security context for any pods
+# created by the chart. See [the Kubernetes
+# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
+# for more details.
+#
+# The default value is compatible with [the restricted
+# PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
+#
+# To unset the security context, set it to `null` or `~`.
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 65532
+  runAsGroup: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+# podSecurityContext(object) -- sets the pod security context for any pods
+# created by the chart. See [the Kubernetes
+# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
+# for more details.
+#
+# To unset the security context, set it to `null` or `~`.
+podSecurityContext:
+  fsGroup: 65532
+
+# priorityClassName(string) -- sets the priority class used by any pods created by the chart.
+# The user is responsible for creating the `PriorityClass` resource before deploying the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
+# for more details.
+priorityClassName: ""
+
+# nameOverride(string) -- optionally overrides the name of the chart, used
+# together with the release name when giving a name to resources.
+nameOverride: ""
+# fullnameOverride(string) -- optionally overrides the full name of resources.
+fullnameOverride: ""
+
+# teleportVersionOverride(string) -- controls the Teleport Kubernetes Operator
+# image version deployed by the chart.
+#
+# Normally, the version of the Teleport Kubernetes Operator matches the version
+# of the chart. If you install chart version 15.0.0, you'll use Teleport version
+# 15.0.0. Upgrading the agent is done by upgrading the chart.
+#
+# <Admonition type="warning">
+#
+#   `teleportVersionOverride` is intended for development and MUST NOT be used
+#   to control the Teleport version in a typical deployment. This chart is
+#   designed to run a specific Teleport version. You will face compatibility
+#   issues trying to run a different Teleport version with it.
+#
+#   If you want to run Teleport version `X.Y.Z`, you should use `helm install
+#   --version X.Y.Z` instead.
+#
+# </Admonition>
+teleportVersionOverride: ""
diff --git a/examples/desktop-registration/go.mod b/examples/desktop-registration/go.mod
index b22d2fe752119..8091cadb9ecd2 100644
--- a/examples/desktop-registration/go.mod
+++ b/examples/desktop-registration/go.mod
@@ -1,50 +1,47 @@
 module teleport-desktop-registration
 
-go 1.23.0
+go 1.24.11
 
-require github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40
+require github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/beevik/etree v1.2.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/beevik/etree v1.5.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.3.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.3.2 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gravitational/trace v1.3.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/gravitational/trace v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/russellhaering/gosaml2 v0.9.1 // indirect
-	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
-	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/grpc v1.61.1 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/grpc v1.73.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
diff --git a/examples/desktop-registration/go.sum b/examples/desktop-registration/go.sum
index b78e034de702d..282789daac97a 100644
--- a/examples/desktop-registration/go.sum
+++ b/examples/desktop-registration/go.sum
@@ -1,294 +1,140 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
-cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
-github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/beevik/etree v1.5.0 h1:iaQZFSDS+3kYZiGoc9uKeOkUY3nYMXOKLl6KIJxiJWs=
+github.com/beevik/etree v1.5.0/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.3.0 h1:kKkrYlgLQTMPA6BiSL25A7/x4CEh2YCG7rtb/aTkx+g=
+github.com/go-piv/piv-go/v2 v2.3.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
-github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40 h1:fehEGHkaAJrxMtBla0boubs9ZamPO+wcSWEUjr7eEmI=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40/go.mod h1:aBBajLLEwtcb/iKA9JNSq+WyKMiNp93837yQgNnUuJ8=
-github.com/gravitational/trace v1.3.1 h1:jwZEuRtCYpLhUtqHo+JH+lu2qM0LB98UagqHtvdKuLI=
-github.com/gravitational/trace v1.3.1/go.mod h1:E61mn73aro7Zg9gZheZaeUsK6gjUMbCLazY76xuYAVA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707 h1:IKMvcBI53M7H3j9G3ZJCqVzCZ0sQrK83h/lRgHFNESk=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707/go.mod h1:tGFGcp5agfdWDorAqy9sdEVZ5FZbngYMW5s/NWFTc6I=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
-github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
-github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
-github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 h1:9M3+rhx7kZCIQQhQRYaZCdNu1V73tm4TvXs2ntl98C4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0/go.mod h1:noq80iT8rrHP1SfybmPiRGc9dc5M8RPmGvtwo7Oo7tc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 h1:H2JFgRcGiyHg7H7bwcwaQJYrNFqCqrbTQ8K4p1OvDu8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0/go.mod h1:WfCWp1bGoYK8MeULtI15MmQVczfR+bFkk0DF3h06QmQ=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
-go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
-golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
+google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/examples/dynamoathenamigration/migration_test.go b/examples/dynamoathenamigration/migration_test.go
index b086a8c4fda1a..11c774b07f462 100644
--- a/examples/dynamoathenamigration/migration_test.go
+++ b/examples/dynamoathenamigration/migration_test.go
@@ -41,8 +41,8 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMigrateProcessDataObjects(t *testing.T) {
@@ -62,7 +62,7 @@ func TestMigrateProcessDataObjects(t *testing.T) {
 		},
 		eventsEmitter: emitter,
 		Config: Config{
-			Logger:          utils.NewSlogLoggerForTests(),
+			Logger:          logtest.NewLogger(),
 			NoOfEmitWorkers: 5,
 			bufferSize:      10,
 			CheckpointPath:  filepath.Join(t.TempDir(), "migration-tests.json"),
@@ -133,7 +133,7 @@ func TestLargeEventsParse(t *testing.T) {
 		},
 		eventsEmitter: emitter,
 		Config: Config{
-			Logger:          utils.NewSlogLoggerForTests(),
+			Logger:          logtest.NewLogger(),
 			NoOfEmitWorkers: 5,
 			bufferSize:      10,
 			CheckpointPath:  filepath.Join(t.TempDir(), "migration-tests.json"),
@@ -223,7 +223,7 @@ func TestMigrationCheckpoint(t *testing.T) {
 
 	noOfWorkers := 3
 	defaultConfig := Config{
-		Logger:          utils.NewSlogLoggerForTests(),
+		Logger:          logtest.NewLogger(),
 		NoOfEmitWorkers: noOfWorkers,
 		bufferSize:      noOfWorkers * 5,
 		CheckpointPath:  filepath.Join(t.TempDir(), "migration-tests.json"),
diff --git a/examples/go-client/go.mod b/examples/go-client/go.mod
index e68bf2e37445a..c7dd776e1bc48 100644
--- a/examples/go-client/go.mod
+++ b/examples/go-client/go.mod
@@ -1,50 +1,47 @@
 module go-client
 
-go 1.23.0
+go 1.24.11
 
-require github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40
+require github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/beevik/etree v1.2.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/beevik/etree v1.5.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.3.2 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gravitational/trace v1.3.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/gravitational/trace v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/russellhaering/gosaml2 v0.9.1 // indirect
-	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
-	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
-	google.golang.org/grpc v1.61.1 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/grpc v1.74.2 // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
diff --git a/examples/go-client/go.sum b/examples/go-client/go.sum
index b78e034de702d..d3308c5c55339 100644
--- a/examples/go-client/go.sum
+++ b/examples/go-client/go.sum
@@ -1,294 +1,140 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
-cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
-github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
+github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
-github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40 h1:fehEGHkaAJrxMtBla0boubs9ZamPO+wcSWEUjr7eEmI=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40/go.mod h1:aBBajLLEwtcb/iKA9JNSq+WyKMiNp93837yQgNnUuJ8=
-github.com/gravitational/trace v1.3.1 h1:jwZEuRtCYpLhUtqHo+JH+lu2qM0LB98UagqHtvdKuLI=
-github.com/gravitational/trace v1.3.1/go.mod h1:E61mn73aro7Zg9gZheZaeUsK6gjUMbCLazY76xuYAVA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707 h1:IKMvcBI53M7H3j9G3ZJCqVzCZ0sQrK83h/lRgHFNESk=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707/go.mod h1:tGFGcp5agfdWDorAqy9sdEVZ5FZbngYMW5s/NWFTc6I=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
-github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
-github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
-github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 h1:9M3+rhx7kZCIQQhQRYaZCdNu1V73tm4TvXs2ntl98C4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0/go.mod h1:noq80iT8rrHP1SfybmPiRGc9dc5M8RPmGvtwo7Oo7tc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 h1:H2JFgRcGiyHg7H7bwcwaQJYrNFqCqrbTQ8K4p1OvDu8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0/go.mod h1:WfCWp1bGoYK8MeULtI15MmQVczfR+bFkk0DF3h06QmQ=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
-go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
-golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
-google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/examples/grafana/teleport-dashboard.json b/examples/grafana/teleport-dashboard.json
new file mode 100644
index 0000000000000..abdfe7f613102
--- /dev/null
+++ b/examples/grafana/teleport-dashboard.json
@@ -0,0 +1,3115 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": 6,
+  "links": [
+    {
+      "asDropdown": false,
+      "icon": "external link",
+      "includeVars": false,
+      "keepTime": false,
+      "tags": [],
+      "targetBlank": true,
+      "title": "Key Metrics for Self-Hosted Clusters",
+      "tooltip": "",
+      "type": "link",
+      "url": "https://goteleport.com/docs/admin-guides/management/diagnostics/metrics/"
+    },
+    {
+      "asDropdown": false,
+      "icon": "external link",
+      "includeVars": false,
+      "keepTime": false,
+      "tags": [],
+      "targetBlank": true,
+      "title": "Teleport Metrics Reference",
+      "tooltip": "",
+      "type": "link",
+      "url": "https://goteleport.com/docs/reference/monitoring/metrics/"
+    },
+    {
+      "asDropdown": false,
+      "icon": "external link",
+      "includeVars": false,
+      "keepTime": false,
+      "tags": [],
+      "targetBlank": false,
+      "title": "Teleport Managed Updates V2",
+      "tooltip": "",
+      "type": "link",
+      "url": "https://goteleport.com/docs/upgrading/agent-managed-updates/"
+    }
+  ],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 3,
+      "panels": [],
+      "title": "Teleport Info",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "custom": {
+            "align": "auto",
+            "cellOptions": {
+              "type": "auto",
+              "wrapText": false
+            },
+            "filterable": true,
+            "inspect": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Value"
+            },
+            "properties": [
+              {
+                "id": "displayName",
+                "value": "count"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "goversion"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 121
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "service"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 204
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "version"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 96
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "count"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 85
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "job"
+            },
+            "properties": [
+              {
+                "id": "custom.width",
+                "value": 202
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 0,
+        "y": 1
+      },
+      "id": 4,
+      "links": [
+        {
+          "targetBlank": true,
+          "title": "Teleport Docs - Changelog",
+          "url": "https://goteleport.com/docs/changelog/"
+        }
+      ],
+      "options": {
+        "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": true
+        },
+        "showHeader": true,
+        "sortBy": []
+      },
+      "pluginVersion": "10.4.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "count by(job, goversion, version) (teleport_build_info{namespace=\"$namespace\", job=~\"$teleport_job\"})",
+          "format": "table",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": true,
+          "legendFormat": "__auto",
+          "range": false,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Teleport Build Info",
+      "transformations": [
+        {
+          "id": "filterFieldsByName",
+          "options": {
+            "include": {
+              "names": [
+                "goversion",
+                "version",
+                "Value",
+                "job"
+              ]
+            }
+          }
+        }
+      ],
+      "type": "table"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "The number of Teleport services connected to an Auth Service instance, grouped by version.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            }
+          },
+          "mappings": [],
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 5,
+        "x": 6,
+        "y": 1
+      },
+      "id": 5,
+      "options": {
+        "displayLabels": [],
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true,
+          "values": [
+            "value",
+            "percent"
+          ]
+        },
+        "pieType": "pie",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "12.0.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "sum by (version) (teleport_registered_servers{namespace=\"$namespace\", job=~\"$teleport_job\"})",
+          "format": "time_series",
+          "instant": true,
+          "legendFormat": "__auto",
+          "range": false,
+          "refId": "A"
+        }
+      ],
+      "title": "Connected Teleport Versions",
+      "type": "piechart"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Count and version of connected Teleport agents.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.hideFrom",
+                "value": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 13,
+        "x": 11,
+        "y": 1
+      },
+      "id": 20,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true,
+          "sortBy": "Last *",
+          "sortDesc": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "12.0.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": true,
+          "expr": "sum by (version) (teleport_registered_servers{namespace=\"$namespace\", job=~\"$teleport_job\"})",
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{version}}",
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(teleport_registered_servers{namespace=\"$namespace\", job=~\"$teleport_job\"})",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Total",
+          "range": true,
+          "refId": "Total"
+        }
+      ],
+      "title": "Connected Teleport Versions",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "continuous-GrYlRd"
+          },
+          "custom": {
+            "fillOpacity": 70,
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineWidth": 0,
+            "spanNulls": false
+          },
+          "mappings": [
+            {
+              "options": {
+                "0": {
+                  "color": "green",
+                  "index": 0,
+                  "text": "ok"
+                },
+                "1": {
+                  "color": "yellow",
+                  "index": 1,
+                  "text": "recovering"
+                },
+                "2": {
+                  "color": "red",
+                  "index": 2,
+                  "text": "degraded"
+                },
+                "3": {
+                  "color": "#a2a1a1",
+                  "index": 3,
+                  "text": "starting"
+                }
+              },
+              "type": "value"
+            }
+          ],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 12,
+        "w": 11,
+        "x": 0,
+        "y": 8
+      },
+      "id": 35,
+      "options": {
+        "alignValue": "left",
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false
+        },
+        "mergeValues": true,
+        "perPage": 30,
+        "rowHeight": 0.73,
+        "showValue": "auto",
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "asc"
+        }
+      },
+      "pluginVersion": "12.0.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "process_state{namespace=\"$namespace\", job=~\"$teleport_job\"}",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "legendFormat": "{{$metrics_per}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Teleport Process State",
+      "type": "state-timeline"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "- Number of user logins\n- Number of failed `tsh login` or `tsh ssh` logins",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "fixed"
+          },
+          "custom": {
+            "fillOpacity": 65,
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineWidth": 0,
+            "spanNulls": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "transparent",
+                "value": null
+              }
+            ]
+          },
+          "unit": "cps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "A"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "continuous-greens"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "B"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "continuous-reds"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 13,
+        "x": 11,
+        "y": 8
+      },
+      "id": 33,
+      "options": {
+        "alignValue": "left",
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": false
+        },
+        "mergeValues": true,
+        "rowHeight": 1,
+        "showValue": "never",
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "12.0.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(user_login_total{namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval]))",
+          "legendFormat": "User login count",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(failed_login_attempts_total{namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval]))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Failed login attempts",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Login Count",
+      "type": "state-timeline"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Number of resources connected to the Teleport Cluster.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "links": [],
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "yellow",
+                "value": null
+              },
+              {
+                "color": "light-green",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 13,
+        "x": 11,
+        "y": 12
+      },
+      "id": 18,
+      "links": [
+        {
+          "targetBlank": true,
+          "title": "Teleport Docs - Enroll Resources",
+          "url": "https://goteleport.com/docs/enroll-resources/"
+        }
+      ],
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "center",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value_and_name",
+        "wideLayout": true
+      },
+      "pluginVersion": "10.4.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "sort(sum(teleport_connected_resources{namespace=\"$namespace\", job=~\"$teleport_job\"}) by (type))",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connected Resources",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Number of reverse SSH tunnels connected to the Teleport Proxy Service by Teleport instances.",
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "yellow",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 13,
+        "x": 11,
+        "y": 16
+      },
+      "id": 19,
+      "links": [
+        {
+          "title": "Teleport Docs - Proxy Tunnels",
+          "url": "https://goteleport.com/docs/reference/architecture/proxy/#tunnels"
+        }
+      ],
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "10.4.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": true,
+          "expr": "sum by (type) (teleport_reverse_tunnels_connected{namespace=\"$namespace\", job=~\"$teleport_job\"})",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Tunnels",
+      "type": "stat"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 20
+      },
+      "id": 39,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "custom": {
+                "align": "auto",
+                "cellOptions": {
+                  "type": "auto"
+                },
+                "inspect": false
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              }
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byName",
+                  "options": "Start version"
+                },
+                "properties": [
+                  {
+                    "id": "custom.width",
+                    "value": 130
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 4,
+            "w": 4,
+            "x": 0,
+            "y": 21
+          },
+          "id": 42,
+          "options": {
+            "cellHeight": "sm",
+            "footer": {
+              "countRows": false,
+              "fields": "",
+              "reducer": [
+                "sum"
+              ],
+              "show": false
+            },
+            "showHeader": true,
+            "sortBy": []
+          },
+          "pluginVersion": "10.4.1",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": false,
+              "expr": "count(teleport_agent_autoupdates_rollout_start{namespace=\"$namespace\", job=~\"$teleport_job\"} == 1) by (version)",
+              "format": "table",
+              "instant": true,
+              "legendFormat": "start version",
+              "range": false,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": false,
+              "expr": "count(teleport_agent_autoupdates_rollout_target{namespace=\"$namespace\", job=~\"$teleport_job\"} == 1) by (version)",
+              "format": "table",
+              "hide": false,
+              "instant": true,
+              "legendFormat": "target version",
+              "range": false,
+              "refId": "B"
+            }
+          ],
+          "title": "Rollout Spec",
+          "transformations": [
+            {
+              "id": "concatenate",
+              "options": {
+                "frameNameLabel": "frame",
+                "frameNameMode": "drop"
+              }
+            },
+            {
+              "id": "filterFieldsByName",
+              "options": {
+                "include": {
+                  "names": [
+                    "version 1",
+                    "version 2"
+                  ]
+                }
+              }
+            },
+            {
+              "id": "organize",
+              "options": {
+                "excludeByName": {},
+                "includeByName": {},
+                "indexByName": {},
+                "renameByName": {
+                  "version 1": "Start version",
+                  "version 2": "Target version"
+                }
+              }
+            }
+          ],
+          "type": "table"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "continuous-GrYlRd"
+              },
+              "custom": {
+                "fillOpacity": 70,
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineWidth": 0,
+                "spanNulls": false
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "0": {
+                      "color": "red",
+                      "index": 0,
+                      "text": "absent"
+                    },
+                    "1": {
+                      "color": "green",
+                      "index": 1,
+                      "text": "present"
+                    }
+                  },
+                  "type": "value"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 4,
+            "w": 10,
+            "x": 4,
+            "y": 21
+          },
+          "id": 40,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Documentation",
+              "url": "https://goteleport.com/docs/reference/managed-updates-v2/#managed-updates-v2-resources"
+            }
+          ],
+          "options": {
+            "alignValue": "left",
+            "legend": {
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "mergeValues": true,
+            "rowHeight": 0.9,
+            "showValue": "auto",
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "max by(__name__) ({__name__=~\"teleport_agent_autoupdates_.*_present\", namespace=\"$namespace\", job=~\"$teleport_job\"})",
+              "legendFormat": "__auto",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "Teleport Agent Updates Settings",
+          "type": "state-timeline"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "fixed"
+              },
+              "custom": {
+                "fillOpacity": 70,
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineWidth": 0,
+                "spanNulls": false
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "0": {
+                      "color": "text",
+                      "index": 0,
+                      "text": "Unknown"
+                    },
+                    "1": {
+                      "color": "red",
+                      "index": 1,
+                      "text": "Disabled"
+                    },
+                    "2": {
+                      "color": "yellow",
+                      "index": 2,
+                      "text": "Suspended"
+                    },
+                    "3": {
+                      "color": "green",
+                      "index": 3,
+                      "text": "Enabled"
+                    }
+                  },
+                  "type": "value"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 4,
+            "w": 10,
+            "x": 14,
+            "y": 21
+          },
+          "id": 41,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Managed Updates V2",
+              "url": "https://goteleport.com/docs/reference/managed-updates-v2/#mode-precedence"
+            }
+          ],
+          "options": {
+            "alignValue": "left",
+            "legend": {
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": false
+            },
+            "mergeValues": true,
+            "rowHeight": 0.9,
+            "showValue": "always",
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "max by(__name__) ({__name__=~\"teleport_agent_autoupdates_.*_mode\", namespace=\"$namespace\", job=~\"$teleport_job\"})",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "__auto",
+              "range": true,
+              "refId": "D"
+            }
+          ],
+          "title": "Auto Update Mode",
+          "type": "state-timeline"
+        },
+        {
+          "description": "The rollout state aggregates the state of every group. It becomes active as soon as the first group is updated, and done when the last group is updated.\n\nThe operator makes update decisions based on this state. For example, if there is an unstarted v1 -> v2 rollout and you want to update to v3, the operator will choose to do v1 -> v3 instead of v2 -> v3.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "fixed"
+              },
+              "custom": {
+                "fillOpacity": 70,
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineWidth": 0,
+                "spanNulls": false
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "0": {
+                      "color": "text",
+                      "index": 0,
+                      "text": "Unknown"
+                    },
+                    "1": {
+                      "color": "orange",
+                      "index": 1,
+                      "text": "Unstarted"
+                    },
+                    "2": {
+                      "color": "blue",
+                      "index": 2,
+                      "text": "Active"
+                    },
+                    "3": {
+                      "color": "green",
+                      "index": 3,
+                      "text": "Done"
+                    },
+                    "4": {
+                      "color": "red",
+                      "index": 4,
+                      "text": "RolledBack"
+                    }
+                  },
+                  "type": "value"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 25
+          },
+          "id": 43,
+          "options": {
+            "alignValue": "left",
+            "legend": {
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": false
+            },
+            "mergeValues": true,
+            "rowHeight": 0.9,
+            "showValue": "always",
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "multi",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "max(teleport_agent_autoupdates_rollout_state{namespace=\"$namespace\", job=~\"$teleport_job\"}) ",
+              "legendFormat": "State ",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "max(teleport_agent_autoupdates_rollout_group_state{namespace=\"$namespace\", job=~\"$teleport_job\"}) by (group_number)",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Group {{group_number}}",
+              "range": true,
+              "refId": "B"
+            }
+          ],
+          "title": "Rollout State",
+          "type": "state-timeline"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "r/m"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 25
+          },
+          "id": 44,
+          "options": {
+            "legend": {
+              "calcs": [],
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "avg by(result)(rate(teleport_agent_autoupdates_reconciliations_total{namespace=\"$namespace\", job=~\"$teleport_job\"}[5m])*60)",
+              "hide": false,
+              "legendFormat": "[{{result}}] reconciliation ",
+              "range": true,
+              "refId": "A"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "avg by(result)(rate(teleport_agent_autoupdates_reconciliation_tries_total{namespace=\"$namespace\", job=~\"$teleport_job\"}[5m])*60)",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "[{{result}}] attempt",
+              "range": true,
+              "refId": "B"
+            }
+          ],
+          "title": "Reconciliations Triggered Rate (per minute)",
+          "type": "timeseries"
+        }
+      ],
+      "title": "Managed Updates V2",
+      "type": "row"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 21
+      },
+      "id": 16,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Percentage of write requests to the backend that succeed.\n\n---\n\nA Teleport cluster cannot function if the Auth Service does not have a healthy cluster state backend.\nYou need to track the ability of the Auth Service to read from and write to its backend.\n\nIf your backend becomes unavailable, you can investigate your backend infrastructure.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "custom": {
+                "fillOpacity": 70,
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineWidth": 0,
+                "spanNulls": 600000
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "red"
+                  },
+                  {
+                    "color": "#EAB839",
+                    "value": 0.8
+                  },
+                  {
+                    "color": "green",
+                    "value": 0.99
+                  }
+                ]
+              },
+              "unit": "percentunit"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 22
+          },
+          "id": 23,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/admin-guides/management/diagnostics/metrics/#backend-operations"
+            }
+          ],
+          "options": {
+            "alignValue": "left",
+            "legend": {
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "mergeValues": true,
+            "rowHeight": 0.9,
+            "showValue": "auto",
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "\n1 - ((\n        sum by ($metrics_per) (rate(backend_write_requests_failed_total{component=\"backend\",namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval]))\n        - \n        sum by ($metrics_per) (rate(teleport_backend_write_requests_failed_precondition_total{component=\"backend\",namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval])) OR on() vector(0)\n    ) / (\n        sum by ($metrics_per) (rate(backend_write_requests_total{component=\"backend\",namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval]))\n    ))\n",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "{{$metrics_per}}",
+              "range": true,
+              "refId": "Failures"
+            }
+          ],
+          "title": "Backend Write Availability",
+          "type": "state-timeline"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Percentage of read requests to the backend that succeed.\n\n---\n\nA Teleport cluster cannot function if the Auth Service does not have a healthy cluster state backend.\nYou need to track the ability of the Auth Service to read from and write to its backend.\n\nIf your backend becomes unavailable, you can investigate your backend infrastructure.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "custom": {
+                "fillOpacity": 70,
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineWidth": 0,
+                "spanNulls": 600000
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "red"
+                  },
+                  {
+                    "color": "#EAB839",
+                    "value": 0.8
+                  },
+                  {
+                    "color": "green",
+                    "value": 0.99
+                  }
+                ]
+              },
+              "unit": "percentunit"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 22
+          },
+          "id": 24,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/admin-guides/management/diagnostics/metrics/#backend-operations"
+            }
+          ],
+          "options": {
+            "alignValue": "left",
+            "legend": {
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "mergeValues": true,
+            "rowHeight": 0.9,
+            "showValue": "auto",
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "1- ((\n    (\n        (sum by ($metrics_per) (rate(backend_read_requests_failed_total{component=\"backend\",namespace=\"$namespace\"}[$__rate_interval])) OR vector(0))\n            /\n        (sum by ($metrics_per) (rate(backend_read_requests_total{component=\"backend\",namespace=\"$namespace\"}[$__rate_interval])))\n    )\n  )) or group by ($metrics_per) (rate(backend_read_requests_total{component=\"backend\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "__auto",
+              "range": true,
+              "refId": "Failures"
+            }
+          ],
+          "title": "Backend Read Availability",
+          "type": "state-timeline"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Count of successful and failed backend requests.\n\nDuring failed backend writes, a Teleport process also increments the `Precondition failed` metric if the cause of the failure is expected. For example, the metric increments during a create operation if a record already exists, during an update or delete operation if the record is not found, and during an atomic write if the resource was modified concurrently. All of these conditions can occur in a well-functioning Teleport cluster.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 12,
+                "gradientMode": "hue",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "line"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  }
+                ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "failed_total"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "failed_precondition_total"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "light-yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 8,
+            "x": 0,
+            "y": 30
+          },
+          "id": 31,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "lastNotNull"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "multi",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "repeat": "backend_metrics",
+          "repeatDirection": "h",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"[[backend_metrics]]_total\",component=\"backend\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "legendFormat": "Success",
+              "range": true,
+              "refId": "total"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"[[backend_metrics]]_failed_total\",component=\"backend\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Failed",
+              "range": true,
+              "refId": "failed_total"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"teleport_[[backend_metrics]]_failed_precondition_total\",component=\"backend\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Precondition failed",
+              "range": true,
+              "refId": "failed_precondition_total"
+            }
+          ],
+          "title": "[[backend_metrics]]",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 25,
+                "gradientMode": "hue",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "line"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  }
+                ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "failed_total"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              },
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "failed_precondition_total"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "light-yellow",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 6,
+            "x": 0,
+            "y": 38
+          },
+          "id": 32,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean",
+                "lastNotNull"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "multi",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "repeat": "cache_metrics",
+          "repeatDirection": "h",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"[[cache_metrics]]_total\",component=\"cache\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "legendFormat": "Total Count",
+              "range": true,
+              "refId": "total"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"[[cache_metrics]]_failed_total\",component=\"cache\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Total Failed Count",
+              "range": true,
+              "refId": "failed_total"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate({__name__=\"teleport_[[cache_metrics]]_failed_precondition_total\",component=\"cache\",namespace=\"$namespace\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Total Precondition Failed Count",
+              "range": true,
+              "refId": "failed_precondition_total"
+            }
+          ],
+          "title": "[cache] [[cache_metrics]]",
+          "type": "timeseries"
+        }
+      ],
+      "title": "Backend",
+      "type": "row"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 22
+      },
+      "id": 36,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "- Number of audit events emitted.\n- Number of times emitting audit events failed.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 25,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "eps"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "failed"
+                },
+                "properties": [
+                  {
+                    "id": "color",
+                    "value": {
+                      "fixedColor": "red",
+                      "mode": "fixed"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 23
+          },
+          "id": 37,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Audit Events",
+              "url": "https://goteleport.com/docs/reference/monitoring/audit/"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true,
+              "sortBy": "Mean",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "multi",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(teleport_audit_emit_events{namespace=\"$namespace\", job=~\"$teleport_job\"}[$__rate_interval]))",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "Emitted",
+              "range": true,
+              "refId": "emitted"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(audit_failed_emit_events{namespace=\"$namespace\", job=~\"$teleport_job\"}[$__rate_interval]))",
+              "legendFormat": "Failed to emit",
+              "range": true,
+              "refId": "failed"
+            }
+          ],
+          "title": "Audit Events",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Per-resource count of events emitted.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic-by-name"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 25,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "normal"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green"
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "eps"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 23
+          },
+          "id": 38,
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Mean",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "multi",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(watcher_events_count{namespace=\"$namespace\", job=~\"$teleport_job\"}[$__rate_interval])) by (resource)",
+              "legendFormat": "__auto",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "Watcher Events by Resource",
+          "type": "timeseries"
+        }
+      ],
+      "title": "Events",
+      "type": "row"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 23
+      },
+      "id": 11,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Resident memory size in bytes.\n\nIf available, [GOMEMLIMIT](https://pkg.go.dev/runtime) is shown as a dotted line.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "bytes"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "GOMEMLIMIT"
+                },
+                "properties": [
+                  {
+                    "id": "custom.lineStyle",
+                    "value": {
+                      "dash": [
+                        0,
+                        10
+                      ],
+                      "fill": "dot"
+                    }
+                  },
+                  {
+                    "id": "custom.showPoints",
+                    "value": "never"
+                  },
+                  {
+                    "id": "custom.hideFrom",
+                    "value": {
+                      "legend": true,
+                      "tooltip": false,
+                      "viz": false
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 7,
+            "w": 13,
+            "x": 0,
+            "y": 24
+          },
+          "id": 13,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/reference/monitoring/metrics/#go-runtime-metrics"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Last *",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": true,
+              "expr": "process_resident_memory_bytes{namespace=\"$namespace\",job=~\"$teleport_job\"}",
+              "interval": "",
+              "legendFormat": "{{$metrics_per}}",
+              "range": true,
+              "refId": "Resident Memory"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "(go_gc_gomemlimit_bytes{namespace=\"$namespace\",job=~\"$teleport_job\"} < 9000000000000000000)",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "GOMEMLIMIT {{$metrics_per}}",
+              "range": true,
+              "refId": "GOMEMLIMIT"
+            }
+          ],
+          "title": "Memory",
+          "transformations": [
+            {
+              "id": "configFromData",
+              "options": {
+                "configRefId": "B",
+                "mappings": []
+              }
+            }
+          ],
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Number of goroutines that currently exist.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "short"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 7,
+            "w": 11,
+            "x": 13,
+            "y": 24
+          },
+          "id": 14,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/reference/monitoring/metrics/#go-runtime-metrics"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Last *",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": true,
+              "expr": "go_goroutines{namespace=\"$namespace\",job=~\"$teleport_job\"}",
+              "hide": false,
+              "interval": "",
+              "legendFormat": "{{$metrics_per}}",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "Goroutines",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Total user and system CPU time spent in seconds.\n\nIf available, the [GOMAXPROCS](https://pkg.go.dev/runtime) value is shown as a dotted line.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "CPU/s"
+            },
+            "overrides": [
+              {
+                "matcher": {
+                  "id": "byFrameRefID",
+                  "options": "GOMAXPROCS"
+                },
+                "properties": [
+                  {
+                    "id": "custom.lineStyle",
+                    "value": {
+                      "dash": [
+                        0,
+                        10
+                      ],
+                      "fill": "dot"
+                    }
+                  },
+                  {
+                    "id": "custom.showPoints",
+                    "value": "never"
+                  },
+                  {
+                    "id": "custom.hideFrom",
+                    "value": {
+                      "legend": true,
+                      "tooltip": false,
+                      "viz": false
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 13,
+            "x": 0,
+            "y": 31
+          },
+          "id": 12,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/reference/monitoring/metrics/#go-runtime-metrics"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Last *",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": true,
+              "expr": "rate(process_cpu_seconds_total{namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval])",
+              "hide": false,
+              "interval": "",
+              "legendFormat": "{{$metrics_per}}",
+              "range": true,
+              "refId": "CPU_SECONDS"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "go_sched_gomaxprocs_threads{namespace=\"$namespace\",job=~\"$teleport_job\"}",
+              "hide": false,
+              "instant": false,
+              "legendFormat": "GOMAXPROCS {{$metrics_per}}",
+              "range": true,
+              "refId": "GOMAXPROCS"
+            }
+          ],
+          "title": "CPU Usage",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Number of open file descriptors.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 11,
+            "x": 13,
+            "y": 31
+          },
+          "id": 15,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/reference/monitoring/metrics/#go-runtime-metrics"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Last *",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "exemplar": true,
+              "expr": "process_open_fds{namespace=\"$namespace\",job=~\"$teleport_job\"}",
+              "interval": "",
+              "legendFormat": "{{$metrics_per}}",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "Open FDs",
+          "type": "timeseries"
+        }
+      ],
+      "title": "Go Runtime",
+      "type": "row"
+    },
+    {
+      "collapsed": true,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 24
+      },
+      "id": 7,
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Total number of RPCs completed on the server, regardless of success or failure.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 24,
+            "x": 0,
+            "y": 25
+          },
+          "id": 25,
+          "links": [
+            {
+              "targetBlank": true,
+              "title": "Teleport Docs - Metrics Reference",
+              "url": "https://goteleport.com/docs/reference/architecture/api-architecture/"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Mean",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(grpc_server_handled_total{namespace=\"$namespace\",job=~\"$teleport_job\"}[$__rate_interval])) by (grpc_service, grpc_method)",
+              "legendFormat": "{{grpc_service}}/{{grpc_method}}",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "RPC Invocations Handled",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "description": "Total number of RPCs completed on the server, with a non-OK status code.",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 24,
+            "x": 0,
+            "y": 33
+          },
+          "id": 26,
+          "links": [
+            {
+              "title": "gRPC Status Codes",
+              "url": "https://grpc.io/docs/guides/status-codes/"
+            }
+          ],
+          "options": {
+            "legend": {
+              "calcs": [
+                "mean"
+              ],
+              "displayMode": "table",
+              "placement": "right",
+              "showLegend": true,
+              "sortBy": "Mean",
+              "sortDesc": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.0.0",
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${datasource}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(grpc_server_handled_total{namespace=\"$namespace\",grpc_code!=\"OK\",job=~\"$teleport_job\"}[$__rate_interval])) by (grpc_service, grpc_method, grpc_code)",
+              "legendFormat": "{{grpc_service}}/{{grpc_method}} - {{grpc_code}}",
+              "range": true,
+              "refId": "A"
+            }
+          ],
+          "title": "RPC Invocation Failures",
+          "type": "timeseries"
+        }
+      ],
+      "title": "gRPCs",
+      "type": "row"
+    }
+  ],
+  "schemaVersion": 39,
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "allowCustomValue": false,
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "allowCustomValue": false,
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(teleport_build_info,job)",
+        "description": "Filter metrics based on prometheus' `job` label.",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "teleport_job",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(teleport_build_info,job)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "allowCustomValue": false,
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "{__name__=~\"backend_.*_requests_total\",namespace=\"$namespace\", component=\"backend\", job=~\"$teleport_job\"}",
+        "hide": 2,
+        "includeAll": true,
+        "multi": false,
+        "name": "backend_metrics",
+        "options": [],
+        "query": {
+          "qryType": 4,
+          "query": "{__name__=~\"backend_.*_requests_total\",namespace=\"$namespace\", component=\"backend\", job=~\"$teleport_job\"}",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "/^(.*)_total/",
+        "skipUrlSync": false,
+        "sort": 2,
+        "type": "query"
+      },
+      {
+        "allowCustomValue": false,
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "{__name__=~\"backend_.*_requests_total\",namespace=\"$namespace\", component=\"cache\", job=~\"$teleport_job\"}",
+        "hide": 2,
+        "includeAll": true,
+        "multi": false,
+        "name": "cache_metrics",
+        "options": [],
+        "query": {
+          "qryType": 4,
+          "query": "{__name__=~\"backend_.*_requests_total\",namespace=\"$namespace\", component=\"cache\", job=~\"$teleport_job\"}",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "/^(.*)_total/",
+        "skipUrlSync": false,
+        "sort": 2,
+        "type": "query"
+      },
+      {
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_names(teleport_build_info)",
+        "description": "For per-instance metrics show metrics based on `pod` label if available, otherwise use `instance` label.",
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "metrics_per",
+        "options": [],
+        "query": {
+          "qryType": 0,
+          "query": "label_names(teleport_build_info)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "/(instance|pod)/",
+        "skipUrlSync": false,
+        "sort": 2,
+        "type": "query"
+      },
+      {
+        "allValue": "",
+        "allowCustomValue": false,
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(teleport_build_info,namespace)",
+        "description": "Kubernetes namespace selector. Available only for Kubernetes deployments.",
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "namespace",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(teleport_build_info,namespace)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "UTC",
+  "title": "Self-hosted Teleport Dashboard",
+  "uid": "gravitational-teleport-self-hosted",
+  "version": 1,
+  "weekStart": ""
+}
\ No newline at end of file
diff --git a/examples/identity-activity-center/README.md b/examples/identity-activity-center/README.md
new file mode 100644
index 0000000000000..56e459408931a
--- /dev/null
+++ b/examples/identity-activity-center/README.md
@@ -0,0 +1,20 @@
+## Identity Activity Center IaC Setup
+
+This directory contains the IaC setup for the Identity Activity Center infrastructure.
+
+#### Configuration
+
+```bash
+cat > variables.auto.tfvars << EOF
+aws_region            = "eu-central-1"
+iac_sqs_queue_name        = "example-sns_queue"
+iac_sqs_dlq_name          = "example-sns_dlq"
+iac_kms_key_alias         = "example-kms_key"
+iac_long_term_bucket_name = "example-long-term-bucket"
+iac_transient_bucket_name = "example-transient-bucket"
+iac_database_name         = "example_db"
+iac_table_name            = "example_table"
+iac_workgroup             = "example_iac_workgroup"
+EOF
+```
+
diff --git a/examples/identity-activity-center/identity_activity_center.tf b/examples/identity-activity-center/identity_activity_center.tf
new file mode 100644
index 0000000000000..3ae80515dcb61
--- /dev/null
+++ b/examples/identity-activity-center/identity_activity_center.tf
@@ -0,0 +1,612 @@
+# ========================================
+# Identity Activity Center Infrastructure
+# ========================================
+#
+# This Terraform configuration provisions a comprehensive Identity Activity Center 
+# infrastructure on AWS designed to collect, store, and analyze identity-related 
+# events from various sources including AWS services, GitHub, Okta, and Teleport.
+#
+# Architecture Overview:
+# 1. Event Collection: Events received via SQS queue
+# 2. Processing: Events processed and stored in S3 buckets  
+# 3. Storage: Long-term storage in partitioned Parquet format
+# 4. Analysis: Querying via Amazon Athena with Glue Data Catalog
+#
+# Security Features:
+# - All data encrypted at rest using customer-managed KMS keys
+# - S3 buckets with public access blocked
+# - Versioning enabled for data protection
+# - Dead letter queue for reliable message processing
+#
+# Data Partitioning Strategy:
+# - tenant_id: Enables multi-tenant data separation
+# - event_date: Daily partitions for efficient querying (4-year range)
+
+# ========================================
+# Provider Configuration
+# ========================================
+provider "aws" {
+  region = var.aws_region
+}
+
+# Get current AWS account information.
+data "aws_caller_identity" "current" {}
+
+# ========================================
+# Encryption Infrastructure
+# ========================================
+
+# Customer-managed KMS key for encrypting all Identity Activity Center data
+# This key is used across S3 buckets, SQS queues, and Athena query results
+resource "aws_kms_key" "identity_activity_center_encryption_key" {
+  description         = "KMS key for Athena audit log"
+  enable_key_rotation = true
+}
+
+# KMS key policy granting full access to the current AWS account
+# In production, consider restricting to specific roles/users
+resource "aws_kms_key_policy" "identity_activity_center_encryption_key_policy" {
+  key_id = aws_kms_key.identity_activity_center_encryption_key.id
+  policy = jsonencode({
+    Statement = [
+      {
+        Action = [
+          "kms:*"
+        ]
+        Effect = "Allow"
+        Principal = {
+          AWS = data.aws_caller_identity.current.account_id
+        }
+        Resource = "*"
+        Sid      = "Default Policy"
+      },
+    ]
+    Version = "2012-10-17"
+  })
+}
+
+# Human-readable alias for the KMS key
+resource "aws_kms_alias" "identity_activity_center_encryption_key_alias" {
+  name          = "alias/${var.iac_kms_key_alias}"
+  target_key_id = aws_kms_key.identity_activity_center_encryption_key.key_id
+}
+
+
+# ========================================
+# Message Queue Infrastructure
+# ========================================
+
+# Dead Letter Queue for messages that fail processing
+# Retains messages for 7 days
+# This provides time for troubleshooting failed message processing
+
+resource "aws_sqs_queue" "identity_activity_center_queue_dlq" {
+  name = var.iac_sqs_dlq_name
+
+  # Encrypt messages using the Identity Activity Center KMS key
+  kms_master_key_id                 = aws_kms_key.identity_activity_center_encryption_key.arn
+  kms_data_key_reuse_period_seconds = 300 # 5 minutes - balances security and performance
+
+  # Extended retention for troubleshooting failed messages
+  message_retention_seconds = 604800 # 7 days
+
+  tags = {
+    Name      = "Identity Activity Center DLQ"
+    Purpose   = "Dead letter queue for failed identity event processing"
+    Component = "MessageQueue"
+  }
+}
+
+
+# Main SQS queue for receiving identity events from various sources
+# Events include authentication attempts, access requests, and administrative actions
+resource "aws_sqs_queue" "identity_activity_center_queue" {
+  name = var.iac_sqs_queue_name
+
+  # Encrypt all messages using customer-managed KMS key
+  kms_master_key_id                 = aws_kms_key.identity_activity_center_encryption_key.arn
+  kms_data_key_reuse_period_seconds = 300
+
+  # Configure dead letter queue for failed message processing
+  # Messages are moved to DLQ after max_receive_count failed processing attempts
+  redrive_policy = jsonencode({
+    deadLetterTargetArn = aws_sqs_queue.identity_activity_center_queue_dlq.arn
+    maxReceiveCount     = var.max_receive_count
+  })
+
+  tags = {
+    Name      = "Identity Activity Center Main Queue"
+    Purpose   = "Primary queue for identity event ingestion"
+    Component = "MessageQueue"
+  }
+}
+
+
+
+# ========================================
+# Long-term Storage Infrastructure
+# ========================================
+
+# S3 bucket for permanent storage of processed identity events
+# Data is stored in Parquet format with daily partitions by tenant_id and event_date
+resource "aws_s3_bucket" "identity_activity_center_long_term_storage" {
+  bucket = var.iac_long_term_bucket_name
+
+  # Allow destruction for development - disable in production
+  force_destroy = true
+
+  # Object lock provides immutable storage for compliance requirements
+  # Recommended for production environments to prevent accidental deletion
+  object_lock_enabled = false
+
+  tags = {
+    Name      = "Identity Activity Center Long-term Storage"
+    Purpose   = "Permanent storage for processed identity events"
+    Component = "Storage"
+    DataType  = "LongTerm"
+  }
+}
+
+
+# Enable KMS encryption for all objects in the long-term storage bucket
+resource "aws_s3_bucket_server_side_encryption_configuration" "identity_activity_center_long_term_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_long_term_storage.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.identity_activity_center_encryption_key.arn
+      sse_algorithm     = "aws:kms"
+    }
+    # S3 Bucket Keys reduce KMS API calls and costs
+    bucket_key_enabled = true
+  }
+}
+
+# Enforce bucket owner control over all objects
+resource "aws_s3_bucket_ownership_controls" "identity_activity_center_long_term_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_long_term_storage.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+# Enable versioning for data protection and compliance
+resource "aws_s3_bucket_versioning" "identity_activity_center_long_term_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_long_term_storage.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+
+# Block all public access to protect sensitive identity data
+resource "aws_s3_bucket_public_access_block" "identity_activity_center_long_term_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_long_term_storage.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+
+
+# ========================================
+# Transient Storage Infrastructure  
+# ========================================
+
+# S3 bucket for temporary data storage including:
+# - Athena query results
+# - Processing intermediate files
+# - Large files during processing
+resource "aws_s3_bucket" "identity_activity_center_transient_storage" {
+  bucket = var.iac_transient_bucket_name
+
+  force_destroy = true
+
+  tags = {
+    Name      = "Identity Activity Center Transient Storage"
+    Purpose   = "Temporary storage for processing and query results"
+    Component = "Storage"
+    DataType  = "Transient"
+  }
+}
+
+
+# S3 bucket deletes the files after 60 days.
+resource "aws_s3_bucket_lifecycle_configuration" "identity_activity_center_transient_bucket_lifecycle_config" {
+  bucket = aws_s3_bucket.identity_activity_center_transient_storage.id
+
+  rule {
+    status = "Enabled"
+    id     = "delete_after_60_days"
+    filter {}
+
+    expiration {
+      days = 60
+    }
+  }
+}
+
+# Apply same encryption configuration as long-term storage
+resource "aws_s3_bucket_server_side_encryption_configuration" "identity_activity_center_transient_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_transient_storage.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.identity_activity_center_encryption_key.arn
+      sse_algorithm     = "aws:kms"
+    }
+    bucket_key_enabled = true
+  }
+}
+
+resource "aws_s3_bucket_ownership_controls" "identity_activity_center_transient_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_transient_storage.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_versioning" "identity_activity_center_transient_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_transient_storage.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "identity_activity_center_transient_storage" {
+  bucket = aws_s3_bucket.identity_activity_center_transient_storage.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+
+# ========================================
+# Data Catalog Infrastructure
+# ========================================
+
+# Glue database serves as a logical container for table metadata
+# Used by Athena for querying identity event data
+resource "aws_glue_catalog_database" "identity_activity_center_db" {
+  name = var.iac_database_name
+
+  description = "Database containing identity activity event tables for multi-tenant analytics"
+}
+
+# Glue table definition for identity events with comprehensive schema
+# Supports data from multiple identity providers: AWS, GitHub, Okta, Teleport
+resource "aws_glue_catalog_table" "identity_activity_center_table" {
+  name          = var.iac_table_name
+  database_name = aws_glue_catalog_database.identity_activity_center_db.name
+  table_type    = "EXTERNAL_TABLE"
+
+  description = "Identity activity events table with partition projection for efficient querying"
+
+  # Table parameters configure partition projection and storage format
+  parameters = {
+    "EXTERNAL"            = "TRUE"
+    "classification"      = "parquet"
+    "parquet.compression" = "SNAPPY"
+
+    # Partition projection automatically generates partition metadata
+    # Eliminates need for manual partition management
+    "projection.enabled" = "true"
+
+    # tenant_id projection - injected values for multi-tenant support
+    "projection.tenant_id.type" = "injected"
+
+    # event_date projection - daily partitions with 4-year range
+    "projection.event_date.type"          = "date"
+    "projection.event_date.format"        = "yyyy-MM-dd"
+    "projection.event_date.interval"      = "1"
+    "projection.event_date.interval.unit" = "DAYS"
+    "projection.event_date.range"         = "NOW-4YEARS,NOW"
+
+    # S3 location template for partitioned data
+    "storage.location.template" = format("s3://%s/data/$${tenant_id}/$${event_date}/", aws_s3_bucket.identity_activity_center_long_term_storage.bucket)
+  }
+
+  # Storage descriptor defines data format and location
+  storage_descriptor {
+    location      = format("s3://%s/data/", aws_s3_bucket.identity_activity_center_long_term_storage.bucket)
+    input_format  = "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat"
+    output_format = "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat"
+
+    ser_de_info {
+      name                  = "identity-events-parquet-serde"
+      serialization_library = "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
+      parameters = {
+        "serialization.format" = "1"
+      }
+    }
+
+    # Comprehensive schema for identity events from multiple sources
+    # Core identity and authentication fields
+    columns {
+      name = "event_source"
+      type = "string"
+    }
+
+    columns {
+      name = "identity"
+      type = "string"
+    }
+
+    columns {
+      name = "identity_kind"
+      type = "string"
+    }
+
+    columns {
+      name = "identity_id"
+      type = "string"
+    }
+
+    columns {
+      name = "token"
+      type = "string"
+    }
+
+    columns {
+      name = "action"
+      type = "string"
+    }
+
+    columns {
+      name = "origin"
+      type = "string"
+    }
+
+    columns {
+      name = "status"
+      type = "string"
+    }
+
+    columns {
+      name = "ip"
+      type = "string"
+    }
+
+    columns {
+      name = "city"
+      type = "string"
+    }
+
+    columns {
+      name = "country"
+      type = "string"
+    }
+
+    columns {
+      name = "region"
+      type = "string"
+    }
+
+    columns {
+      name = "latitude"
+      type = "double"
+    }
+
+    columns {
+      name = "longitude"
+      type = "double"
+    }
+
+    columns {
+      name = "target_resource"
+      type = "string"
+    }
+
+    columns {
+      name = "target_kind"
+      type = "string"
+    }
+
+    columns {
+      name = "target_location"
+      type = "string"
+    }
+
+    columns {
+      name = "target_id"
+      type = "string"
+    }
+
+    columns {
+      name = "user_agent"
+      type = "string"
+    }
+
+    columns {
+      name = "event_type"
+      type = "string"
+    }
+
+    columns {
+      name = "event_time"
+      type = "timestamp"
+    }
+
+    columns {
+      name = "uid"
+      type = "string"
+    }
+
+    columns {
+      name = "event_data"
+      type = "string"
+    }
+
+    columns {
+      name = "aws_account_id"
+      type = "string"
+    }
+
+    columns {
+      name = "aws_service"
+      type = "string"
+    }
+
+    columns {
+      name = "github_organization"
+      type = "string"
+    }
+
+    columns {
+      name = "github_repo"
+      type = "string"
+    }
+
+    columns {
+      name = "okta_org"
+      type = "string"
+    }
+
+    columns {
+      name = "teleport_cluster"
+      type = "string"
+    }
+  }
+
+  partition_keys {
+    name = "tenant_id"
+    type = "string"
+  }
+
+  partition_keys {
+    name = "event_date"
+    type = "date"
+  }
+}
+
+# ========================================
+# Analytics Infrastructure
+# ========================================
+
+# Athena workgroup for managing query execution and cost controls
+# Provides isolated environment for identity analytics queries
+resource "aws_athena_workgroup" "identity_activity_center_workgroup" {
+  name = var.iac_workgroup
+
+  # Allow destruction for development environments
+  force_destroy = true
+
+  description = "Workgroup for Identity Activity Center analytics with cost controls and encryption"
+
+  configuration {
+    # Cost control - limit maximum data scanned per query
+    # Adjust based on expected query patterns and cost requirements
+    bytes_scanned_cutoff_per_query = var.iac_workgroup_max_scanned_bytes_per_query
+
+    # Use latest Athena engine for best performance and features
+    engine_version {
+      selected_engine_version = "Athena engine version 3"
+    }
+
+    # Configure encrypted storage for query results
+    result_configuration {
+      output_location = format("s3://%s/results/", aws_s3_bucket.identity_activity_center_transient_storage.bucket)
+
+      encryption_configuration {
+        encryption_option = "SSE_KMS"
+        kms_key_arn       = aws_kms_key.identity_activity_center_encryption_key.arn
+      }
+    }
+
+  }
+
+  tags = {
+    Name      = "Identity Activity Center Workgroup"
+    Purpose   = "Analytics workgroup for identity event queries"
+    Component = "Analytics"
+  }
+}
+
+# ========================================
+# Configuration Output
+# ========================================
+
+# Generate YAML configuration for applications consuming this infrastructure
+# Provides all necessary connection details and endpoints
+output "identity_activity_center_yaml" {
+  description = "YAML configuration for Identity Activity Center applications"
+
+  value = <<EOT
+# Identity Activity Center Configuration
+# Generated by Terraform - contains all necessary connection details
+identity_activity_center:
+  # AWS Region where resources are deployed
+  region: ${var.aws_region}
+  
+  # Athena database and table for querying identity events
+  database: ${var.iac_database_name}
+  table: '${var.iac_table_name}'
+  
+  # S3 storage locations
+  s3: '${format("s3://%s/data", aws_s3_bucket.identity_activity_center_long_term_storage.bucket)}'
+  s3_results: '${format("s3://%s/results", aws_s3_bucket.identity_activity_center_transient_storage.bucket)}'
+  s3_large_files: '${format("s3://%s/large_files", aws_s3_bucket.identity_activity_center_transient_storage.bucket)}'
+  
+  # SQS queue for event ingestion
+  sqs_queue_url: '${aws_sqs_queue.identity_activity_center_queue.url}'
+  
+  # Athena workgroup for query execution
+  workgroup: '${aws_athena_workgroup.identity_activity_center_workgroup.name}'
+  
+  # MaxMind GeoIP database path (configure based on your setup)
+  maxmind_geoip_city_db_path: './geo...'
+  
+EOT
+}
+
+# ========================================
+# Additional Outputs for Integration
+# ========================================
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key used for encryption"
+  value       = aws_kms_key.identity_activity_center_encryption_key.arn
+  sensitive   = false
+}
+
+output "sqs_queue_url" {
+  description = "URL of the main SQS queue for event ingestion"
+  value       = aws_sqs_queue.identity_activity_center_queue.url
+}
+
+output "sqs_dlq_url" {
+  description = "URL of the dead letter queue"
+  value       = aws_sqs_queue.identity_activity_center_queue_dlq.url
+}
+
+output "long_term_bucket_name" {
+  description = "Name of the S3 bucket for long-term storage"
+  value       = aws_s3_bucket.identity_activity_center_long_term_storage.bucket
+}
+
+output "transient_bucket_name" {
+  description = "Name of the S3 bucket for transient storage"
+  value       = aws_s3_bucket.identity_activity_center_transient_storage.bucket
+}
+
+output "database_name" {
+  description = "Name of the Glue database"
+  value       = aws_glue_catalog_database.identity_activity_center_db.name
+}
+
+output "table_name" {
+  description = "Name of the Glue table"
+  value       = aws_glue_catalog_table.identity_activity_center_table.name
+}
+
+output "athena_workgroup_name" {
+  description = "Name of the Athena workgroup"
+  value       = aws_athena_workgroup.identity_activity_center_workgroup.name
+}
\ No newline at end of file
diff --git a/examples/identity-activity-center/policy.tf b/examples/identity-activity-center/policy.tf
new file mode 100644
index 0000000000000..bd0b7f47f3c56
--- /dev/null
+++ b/examples/identity-activity-center/policy.tf
@@ -0,0 +1,205 @@
+# ========================================
+# Identity Activity Center IAM Policy
+# ========================================
+#
+# This Terraform configuration creates comprehensive IAM policies for the Identity 
+# Activity Center infrastructure. The policy grants least-privilege access to AWS 
+# services required for identity event processing, storage, and analytics.
+#
+# Policy Coverage:
+# - S3 bucket and object operations for data storage and retrieval
+# - SQS queue operations for event message processing
+# - Athena and Glue operations for data analytics and querying
+# - KMS operations for encryption/decryption of data
+#
+# Usage:
+# This policy should be attached to IAM roles used by:
+# - Lambda functions processing identity events
+# - EC2 instances running data processing workloads
+# - ECS/Fargate tasks handling identity analytics
+# - Applications querying identity data via Athena
+#
+# Security Principles:
+# - Least privilege access with specific resource ARNs
+# - Separate permissions for different operation types
+# - Resource-specific access patterns (e.g., data/* for objects)
+# - KMS permissions limited to necessary operations
+
+# ========================================
+# Data Sources for Dynamic ARN Construction
+# ========================================
+
+# Get current AWS partition (aws, aws-gov, or aws-cn)
+# Used for constructing ARNs that work across different AWS partitions
+data "aws_partition" "current" {}
+
+# Get current AWS region
+# Used for constructing region-specific ARNs like Glue catalog
+data "aws_region" "current" {}
+
+# ========================================
+# Identity Activity Center IAM Policy Document
+# ========================================
+
+# Comprehensive IAM policy document providing least-privilege access
+# to all AWS services required by the Identity Activity Center
+data "aws_iam_policy_document" "identity_activity_center_policy" {
+
+  # ========================================
+  # S3 Bucket-Level Permissions
+  # ========================================
+
+  # Allow listing and metadata operations on S3 buckets
+  # Required for multipart uploads, bucket discovery, and versioning operations
+  statement {
+    sid = "AllowListingMultipartUploads"
+
+    effect = "Allow"
+
+    actions = [
+      "s3:ListBucketMultipartUploads", # List incomplete multipart uploads
+      "s3:GetBucketLocation",          # Get bucket region for cross-region operations
+      "s3:ListBucketVersions",         # List object versions (versioning enabled)
+      "s3:ListBucket"                  # List objects in bucket
+    ]
+
+    # Apply to both storage buckets used by Identity Activity Center
+    resources = [
+      aws_s3_bucket.identity_activity_center_transient_storage.arn, # Temporary storage
+      aws_s3_bucket.identity_activity_center_long_term_storage.arn, # Permanent storage
+    ]
+  }
+
+  # ========================================
+  # S3 Object-Level Permissions
+  # ========================================
+
+  # Allow object operations within specific prefixes
+  # Supports large file uploads via multipart upload mechanism
+  statement {
+    sid = "AllowMultipartAndObjectAccess"
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",                # Upload new objects
+      "s3:ListMultipartUploadParts", # List parts of multipart upload
+      "s3:GetObjectVersion",         # Get specific version of object
+      "s3:GetObject",                # Download objects
+      "s3:DeleteObjectVersion",      # Delete specific object version
+      "s3:DeleteObject",             # Delete objects
+      "s3:AbortMultipartUpload"      # Cancel incomplete multipart uploads
+    ]
+
+    # Resource-specific access patterns for different data types
+    resources = [
+      # Long-term storage: processed identity events in Parquet format
+      # Organized by tenant_id and date partitions
+      format("%s/data/*", aws_s3_bucket.identity_activity_center_long_term_storage.arn),
+
+      # Transient storage: Athena query results
+      # Temporary files cleaned up by lifecycle policies
+      format("%s/results/*", aws_s3_bucket.identity_activity_center_transient_storage.arn),
+
+      # Transient storage: Large files during processing
+      # Intermediate files that exceed memory limits
+      format("%s/large_files/*", aws_s3_bucket.identity_activity_center_transient_storage.arn),
+    ]
+  }
+
+  # ========================================
+  # SQS Queue Permissions
+  # ========================================
+
+  # Allow message operations on the Identity Activity Center queue
+  # Supports event ingestion workflow from various identity providers
+  statement {
+    sid = "AllowPublishReceiveSQS"
+
+    effect = "Allow"
+
+    actions = [
+      "sqs:ReceiveMessage", # Receive identity events from queue
+      "sqs:DeleteMessage",  # Remove processed messages
+      "sqs:SendMessage"     # Send new identity events to queue
+    ]
+
+    # Apply only to the main Identity Activity Center queue
+    # Dead letter queue access not included (separate permissions if needed)
+    resources = [
+      aws_sqs_queue.identity_activity_center_queue.arn
+    ]
+  }
+
+  # ========================================
+  # Athena and Glue Analytics Permissions
+  # ========================================
+
+  # Allow querying identity data via Athena and accessing Glue metadata
+  # Supports analytics workloads and reporting capabilities
+  statement {
+    sid = "AllowAthenaQuery"
+
+    effect = "Allow"
+
+    actions = [
+      # Glue Data Catalog operations
+      "glue:GetTable", # Get table schema and metadata
+
+      # Athena query operations
+      "athena:StartQueryExecution", # Execute SQL queries
+      "athena:GetQueryResults",     # Retrieve query results
+      "athena:GetQueryExecution"    # Get query status and metadata
+    ]
+
+    resources = [
+      # Glue resources for table and database metadata
+      aws_glue_catalog_table.identity_activity_center_table.arn,
+      aws_glue_catalog_database.identity_activity_center_db.arn,
+
+      # Athena workgroup for query execution and cost control
+      aws_athena_workgroup.identity_activity_center_workgroup.arn,
+
+      # Glue Data Catalog (regional resource)
+      # Required for Athena to access table metadata
+      "arn:${data.aws_partition.current.partition}:glue:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:catalog",
+    ]
+  }
+
+  # ========================================
+  # KMS Encryption Permissions
+  # ========================================
+
+  # Allow encryption and decryption operations for Identity Activity Center data
+  # Required for accessing encrypted S3 objects, SQS messages, and Athena results
+  statement {
+    sid = "AllowAthenaKMSUsage"
+
+    effect = "Allow"
+
+    actions = [
+      "kms:GenerateDataKey", # Generate data keys for encryption
+      "kms:Decrypt"          # Decrypt data keys and objects
+    ]
+
+    # Apply only to the Identity Activity Center KMS key
+    # Prevents access to other KMS keys in the account
+    resources = [
+      aws_kms_key.identity_activity_center_encryption_key.arn,
+    ]
+
+  }
+}
+
+# ========================================
+# Policy Output for External Use
+# ========================================
+
+# Output the complete IAM policy as JSON for use in IAM roles
+# This policy can be attached to roles used by applications accessing
+# the Identity Activity Center infrastructure
+output "identity_activity_center_iam_policy" {
+  description = "Complete IAM policy JSON for Identity Activity Center access"
+  value       = data.aws_iam_policy_document.identity_activity_center_policy.json
+
+}
diff --git a/examples/identity-activity-center/variables.tf b/examples/identity-activity-center/variables.tf
new file mode 100644
index 0000000000000..50b393d99e2dd
--- /dev/null
+++ b/examples/identity-activity-center/variables.tf
@@ -0,0 +1,47 @@
+variable "aws_region" {
+  description = "AWS region"
+  default     = "us-west-2"
+}
+
+variable "iac_sqs_queue_name" {
+  description = "Name of the SQS queue used for Identity Activity Center."
+}
+
+variable "iac_sqs_dlq_name" {
+  description = "Name of the SQS Dead-Letter Queue used for handling unprocessable events"
+}
+
+variable "max_receive_count" {
+  description = "Number of times a message can be received before it is sent to the DLQ"
+  default     = 20
+}
+
+variable "iac_kms_key_alias" {
+  description = "The alias of a custom KMS key"
+}
+
+variable "iac_long_term_bucket_name" {
+  description = "Name of the long term storage bucket used for storing audit logs"
+}
+
+variable "iac_transient_bucket_name" {
+  description = "Name of the transient storage bucket used for storing query results and large events payloads"
+}
+
+variable "iac_database_name" {
+  description = "Name of Glue database"
+}
+
+variable "iac_table_name" {
+  description = "Name of Glue table"
+}
+
+variable "iac_workgroup" {
+  description = "Name of Athena iac_workgroup"
+}
+
+variable "iac_workgroup_max_scanned_bytes_per_query" {
+  description = "Limit per query of max scanned bytes"
+  default     = 21474836480 # 20GB
+}
+
diff --git a/examples/mcp-servers/README.md b/examples/mcp-servers/README.md
new file mode 100644
index 0000000000000..7011145d42422
--- /dev/null
+++ b/examples/mcp-servers/README.md
@@ -0,0 +1,8 @@
+# MCP Server Examples
+
+## Verify Teleport JWT
+
+Examples of MCP servers that can verify the JWT issued by Teleport and extract
+the Teleport's identity information:
+- [Using `fastmcp`](verify-teleport-jwt-fastmcp)
+- [Using `mcp-go`](verify-teleport-jwt-mcp-go)
diff --git a/examples/mcp-servers/verify-teleport-jwt-fastmcp/.python-version b/examples/mcp-servers/verify-teleport-jwt-fastmcp/.python-version
new file mode 100644
index 0000000000000..24ee5b1be9961
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-fastmcp/.python-version
@@ -0,0 +1 @@
+3.13
diff --git a/examples/mcp-servers/verify-teleport-jwt-fastmcp/README.md b/examples/mcp-servers/verify-teleport-jwt-fastmcp/README.md
new file mode 100644
index 0000000000000..e37c01b72f1ac
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-fastmcp/README.md
@@ -0,0 +1,45 @@
+# verify-teleport-jwt-fastmcp
+
+Teleport sends a JWT token signed with Teleport's authority with each request
+to a target MCP server over the streamable HTTP or SSE transport.
+
+This example demonstrates an MCP server built with `fastmcp` that verifies the
+JWT issued by Teleport and extracts the Teleport's identity information.
+
+To start the server:
+```bash
+# export TELEPORT_PROXY_URL=https://teleport.example.com
+$ uv run main.py
+☕ Teleport cluster: teleport.example.com
+☕ JWT algo: ES256
+🚀 example Teleport MCP app definition:
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "verify-teleport-jwt"
+    uri: "mcp+http://127.0.0.1:8000/mcp"
+    labels:
+      env: dev
+    rewrite:
+      headers:
+      - "Authorization: Bearer {{internal.jwt}}"
+
+...
+Starting MCP server 'Verify Teleport JWT' with transport 'http' on http://127.0.0.1:8000/mcp  
+...
+```
+
+Sample response from calling the `teleport_user_info_from_jwt` tool via
+Teleport:
+```json
+{
+  "authenticated": true,
+  "teleport_user_name": "admin",
+  "teleport_roles": ["access", "editor"]
+}
+```
+
+References:
+- [Enroll MCP servers](https://goteleport.com/docs/enroll-resources/mcp-access/)
+- [Use JWT Tokens With MCP Access](https://goteleport.com/docs/enroll-resources/application-access/jwt/introduction/)
+- [Configure MCP clients](https://goteleport.com/docs/connect-your-client/model-context-protocol/mcp-access/)
diff --git a/examples/mcp-servers/verify-teleport-jwt-fastmcp/main.py b/examples/mcp-servers/verify-teleport-jwt-fastmcp/main.py
new file mode 100644
index 0000000000000..77aa0b4fda2b1
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-fastmcp/main.py
@@ -0,0 +1,93 @@
+# Copyright 2025 Gravitational, Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import httpx
+
+from fastmcp import FastMCP
+from fastmcp.server.dependencies import get_access_token, AccessToken
+from fastmcp.server.auth.providers.jwt import JWTVerifier
+
+# Teleport Proxy URL. If Proxy uses self-signed certificate for web address:
+# export SSL_CERT_FILE=/path/to/teleport-proxy-web-cert.pem
+TELEPORT_PROXY_URL = os.getenv("TELEPORT_PROXY_URL", "https://teleport.example.com")
+
+# Optional configs.
+HOST = os.getenv("MCP_HOST", "127.0.0.1")
+PORT = int(os.getenv("MCP_PORT", "8000"))
+TELEPORT_MCP_APP_URI = os.getenv("TELEPORT_MCP_APP_URI", f"mcp+http://{HOST}:{PORT}/mcp")
+
+def get_json(url: str):
+    with httpx.Client(timeout=5) as client:
+        resp = client.get(url)
+        resp.raise_for_status()
+        return resp.json()
+
+def get_teleport_cluster_name() -> str:
+    try:
+        return get_json(f"{TELEPORT_PROXY_URL}/webapi/find").get("cluster_name")
+    except Exception as e:
+        raise RuntimeError(f"Failed to get Teleport cluster name from {TELEPORT_PROXY_URL}/webapi/find") from e
+
+def get_jwt_algo(jwks_uri: str) -> str:
+    try:
+        keys = get_json(jwks_uri).get("keys") or []
+        if len(keys) == 0:
+            raise ValueError("JWKS keys not found")
+        return keys[0].get("alg") or "ES256"
+    except Exception as e:
+        raise RuntimeError(f"Failed to find keys from {jwks_uri}") from e
+
+async def teleport_user_info_from_jwt() -> dict:
+    "Read Teleport user info from verified JWT"
+    token: AccessToken | None = get_access_token()
+    if token is None:
+        return {"authenticated": False}
+
+    return {
+        "authenticated": True,
+        "teleport_user_name": token.claims.get("username"),
+        "teleport_roles": token.claims.get("roles"),
+    }
+
+if __name__ == "__main__":
+    teleport_cluster_name = get_teleport_cluster_name()
+    print(f"☕ Teleport cluster: {teleport_cluster_name}")
+
+    jwks_uri = f"{TELEPORT_PROXY_URL}/.well-known/jwks.json"
+    algo = get_jwt_algo(jwks_uri)
+    print(f"☕ JWT algo: {algo}")
+
+    print(f"""🚀 Teleport app service example:
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "verify-teleport-jwt"
+    uri: "mcp+http://127.0.0.1:8000/mcp"
+    labels:
+      env: dev
+    rewrite:
+      headers:
+      - "Authorization: Bearer {{{{internal.jwt}}}}"
+""")
+
+    verifier = JWTVerifier(
+        jwks_uri=jwks_uri,
+        issuer=teleport_cluster_name,  # Teleport cluster name
+        audience=TELEPORT_MCP_APP_URI, # MCP app URI
+        algorithm=algo,
+    )
+    mcp = FastMCP("Verify Teleport JWT", auth=verifier)
+    mcp.tool(teleport_user_info_from_jwt)
+    mcp.run(transport="http", host=HOST, port=PORT, log_level="debug")
diff --git a/examples/mcp-servers/verify-teleport-jwt-fastmcp/pyproject.toml b/examples/mcp-servers/verify-teleport-jwt-fastmcp/pyproject.toml
new file mode 100644
index 0000000000000..80f862808ae88
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-fastmcp/pyproject.toml
@@ -0,0 +1,9 @@
+[project]
+name = "verify-teleport-jwt-fastmcp"
+version = "0.1.0"
+description = "MCP server that verifies Teleport's JWT"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = [
+    "fastmcp>=2.12.4",
+]
diff --git a/examples/mcp-servers/verify-teleport-jwt-fastmcp/uv.lock b/examples/mcp-servers/verify-teleport-jwt-fastmcp/uv.lock
new file mode 100644
index 0000000000000..94082b74a4e3d
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-fastmcp/uv.lock
@@ -0,0 +1,1022 @@
+version = 1
+revision = 2
+requires-python = ">=3.13"
+
+[[package]]
+name = "annotated-types"
+version = "0.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/67/531ea369ba64dcff5ec9c3402f9f51bf748cec26dde048a2f973a4eea7f5/annotated_types-0.7.0.tar.gz", hash = "sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89", size = 16081, upload-time = "2024-05-20T21:33:25.928Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/78/b6/6307fbef88d9b5ee7421e68d78a9f162e0da4900bc5f5793f6d3d0e34fb8/annotated_types-0.7.0-py3-none-any.whl", hash = "sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53", size = 13643, upload-time = "2024-05-20T21:33:24.1Z" },
+]
+
+[[package]]
+name = "anyio"
+version = "4.11.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "sniffio" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c6/78/7d432127c41b50bccba979505f272c16cbcadcc33645d5fa3a738110ae75/anyio-4.11.0.tar.gz", hash = "sha256:82a8d0b81e318cc5ce71a5f1f8b5c4e63619620b63141ef8c995fa0db95a57c4", size = 219094, upload-time = "2025-09-23T09:19:12.58Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/15/b3/9b1a8074496371342ec1e796a96f99c82c945a339cd81a8e73de28b4cf9e/anyio-4.11.0-py3-none-any.whl", hash = "sha256:0287e96f4d26d4149305414d4e3bc32f0dcd0862365a4bddea19d7a1ec38c4fc", size = 109097, upload-time = "2025-09-23T09:19:10.601Z" },
+]
+
+[[package]]
+name = "attrs"
+version = "25.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/6b/5c/685e6633917e101e5dcb62b9dd76946cbb57c26e133bae9e0cd36033c0a9/attrs-25.4.0.tar.gz", hash = "sha256:16d5969b87f0859ef33a48b35d55ac1be6e42ae49d5e853b597db70c35c57e11", size = 934251, upload-time = "2025-10-06T13:54:44.725Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3a/2a/7cc015f5b9f5db42b7d48157e23356022889fc354a2813c15934b7cb5c0e/attrs-25.4.0-py3-none-any.whl", hash = "sha256:adcf7e2a1fb3b36ac48d97835bb6d8ade15b8dcce26aba8bf1d14847b57a3373", size = 67615, upload-time = "2025-10-06T13:54:43.17Z" },
+]
+
+[[package]]
+name = "authlib"
+version = "1.6.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cd/3f/1d3bbd0bf23bdd99276d4def22f29c27a914067b4cf66f753ff9b8bbd0f3/authlib-1.6.5.tar.gz", hash = "sha256:6aaf9c79b7cc96c900f0b284061691c5d4e61221640a948fe690b556a6d6d10b", size = 164553, upload-time = "2025-10-02T13:36:09.489Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f8/aa/5082412d1ee302e9e7d80b6949bc4d2a8fa1149aaab610c5fc24709605d6/authlib-1.6.5-py2.py3-none-any.whl", hash = "sha256:3e0e0507807f842b02175507bdee8957a1d5707fd4afb17c32fb43fee90b6e3a", size = 243608, upload-time = "2025-10-02T13:36:07.637Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2025.10.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/4c/5b/b6ce21586237c77ce67d01dc5507039d444b630dd76611bbca2d8e5dcd91/certifi-2025.10.5.tar.gz", hash = "sha256:47c09d31ccf2acf0be3f701ea53595ee7e0b8fa08801c6624be771df09ae7b43", size = 164519, upload-time = "2025-10-05T04:12:15.808Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e4/37/af0d2ef3967ac0d6113837b44a4f0bfe1328c2b9763bd5b1744520e5cfed/certifi-2025.10.5-py3-none-any.whl", hash = "sha256:0f212c2744a9bb6de0c56639a6f68afe01ecd92d91f14ae897c4fe7bbeeef0de", size = 163286, upload-time = "2025-10-05T04:12:14.03Z" },
+]
+
+[[package]]
+name = "cffi"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
+    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
+    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
+    { url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
+    { url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
+    { url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
+    { url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
+    { url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/83/2d/5fd176ceb9b2fc619e63405525573493ca23441330fcdaee6bef9460e924/charset_normalizer-3.4.3.tar.gz", hash = "sha256:6fce4b8500244f6fcb71465d4a4930d132ba9ab8e71a7859e6a5d59851068d14", size = 122371, upload-time = "2025-08-09T07:57:28.46Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/65/ca/2135ac97709b400c7654b4b764daf5c5567c2da45a30cdd20f9eefe2d658/charset_normalizer-3.4.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:14c2a87c65b351109f6abfc424cab3927b3bdece6f706e4d12faaf3d52ee5efe", size = 205326, upload-time = "2025-08-09T07:56:24.721Z" },
+    { url = "https://files.pythonhosted.org/packages/71/11/98a04c3c97dd34e49c7d247083af03645ca3730809a5509443f3c37f7c99/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:41d1fc408ff5fdfb910200ec0e74abc40387bccb3252f3f27c0676731df2b2c8", size = 146008, upload-time = "2025-08-09T07:56:26.004Z" },
+    { url = "https://files.pythonhosted.org/packages/60/f5/4659a4cb3c4ec146bec80c32d8bb16033752574c20b1252ee842a95d1a1e/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1bb60174149316da1c35fa5233681f7c0f9f514509b8e399ab70fea5f17e45c9", size = 159196, upload-time = "2025-08-09T07:56:27.25Z" },
+    { url = "https://files.pythonhosted.org/packages/86/9e/f552f7a00611f168b9a5865a1414179b2c6de8235a4fa40189f6f79a1753/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:30d006f98569de3459c2fc1f2acde170b7b2bd265dc1943e87e1a4efe1b67c31", size = 156819, upload-time = "2025-08-09T07:56:28.515Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/95/42aa2156235cbc8fa61208aded06ef46111c4d3f0de233107b3f38631803/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:416175faf02e4b0810f1f38bcb54682878a4af94059a1cd63b8747244420801f", size = 151350, upload-time = "2025-08-09T07:56:29.716Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/a9/3865b02c56f300a6f94fc631ef54f0a8a29da74fb45a773dfd3dcd380af7/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:6aab0f181c486f973bc7262a97f5aca3ee7e1437011ef0c2ec04b5a11d16c927", size = 148644, upload-time = "2025-08-09T07:56:30.984Z" },
+    { url = "https://files.pythonhosted.org/packages/77/d9/cbcf1a2a5c7d7856f11e7ac2d782aec12bdfea60d104e60e0aa1c97849dc/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:fdabf8315679312cfa71302f9bd509ded4f2f263fb5b765cf1433b39106c3cc9", size = 160468, upload-time = "2025-08-09T07:56:32.252Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/42/6f45efee8697b89fda4d50580f292b8f7f9306cb2971d4b53f8914e4d890/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:bd28b817ea8c70215401f657edef3a8aa83c29d447fb0b622c35403780ba11d5", size = 158187, upload-time = "2025-08-09T07:56:33.481Z" },
+    { url = "https://files.pythonhosted.org/packages/70/99/f1c3bdcfaa9c45b3ce96f70b14f070411366fa19549c1d4832c935d8e2c3/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:18343b2d246dc6761a249ba1fb13f9ee9a2bcd95decc767319506056ea4ad4dc", size = 152699, upload-time = "2025-08-09T07:56:34.739Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/ad/b0081f2f99a4b194bcbb1934ef3b12aa4d9702ced80a37026b7607c72e58/charset_normalizer-3.4.3-cp313-cp313-win32.whl", hash = "sha256:6fb70de56f1859a3f71261cbe41005f56a7842cc348d3aeb26237560bfa5e0ce", size = 99580, upload-time = "2025-08-09T07:56:35.981Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/8f/ae790790c7b64f925e5c953b924aaa42a243fb778fed9e41f147b2a5715a/charset_normalizer-3.4.3-cp313-cp313-win_amd64.whl", hash = "sha256:cf1ebb7d78e1ad8ec2a8c4732c7be2e736f6e5123a4146c5b89c9d1f585f8cef", size = 107366, upload-time = "2025-08-09T07:56:37.339Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/91/b5a06ad970ddc7a0e513112d40113e834638f4ca1120eb727a249fb2715e/charset_normalizer-3.4.3-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:3cd35b7e8aedeb9e34c41385fda4f73ba609e561faedfae0a9e75e44ac558a15", size = 204342, upload-time = "2025-08-09T07:56:38.687Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/ec/1edc30a377f0a02689342f214455c3f6c2fbedd896a1d2f856c002fc3062/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b89bc04de1d83006373429975f8ef9e7932534b8cc9ca582e4db7d20d91816db", size = 145995, upload-time = "2025-08-09T07:56:40.048Z" },
+    { url = "https://files.pythonhosted.org/packages/17/e5/5e67ab85e6d22b04641acb5399c8684f4d37caf7558a53859f0283a650e9/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2001a39612b241dae17b4687898843f254f8748b796a2e16f1051a17078d991d", size = 158640, upload-time = "2025-08-09T07:56:41.311Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e5/38421987f6c697ee3722981289d554957c4be652f963d71c5e46a262e135/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8dcfc373f888e4fb39a7bc57e93e3b845e7f462dacc008d9749568b1c4ece096", size = 156636, upload-time = "2025-08-09T07:56:43.195Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e4/5a075de8daa3ec0745a9a3b54467e0c2967daaaf2cec04c845f73493e9a1/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:18b97b8404387b96cdbd30ad660f6407799126d26a39ca65729162fd810a99aa", size = 150939, upload-time = "2025-08-09T07:56:44.819Z" },
+    { url = "https://files.pythonhosted.org/packages/02/f7/3611b32318b30974131db62b4043f335861d4d9b49adc6d57c1149cc49d4/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ccf600859c183d70eb47e05a44cd80a4ce77394d1ac0f79dbd2dd90a69a3a049", size = 148580, upload-time = "2025-08-09T07:56:46.684Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/61/19b36f4bd67f2793ab6a99b979b4e4f3d8fc754cbdffb805335df4337126/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:53cd68b185d98dde4ad8990e56a58dea83a4162161b1ea9272e5c9182ce415e0", size = 159870, upload-time = "2025-08-09T07:56:47.941Z" },
+    { url = "https://files.pythonhosted.org/packages/06/57/84722eefdd338c04cf3030ada66889298eaedf3e7a30a624201e0cbe424a/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:30a96e1e1f865f78b030d65241c1ee850cdf422d869e9028e2fc1d5e4db73b92", size = 157797, upload-time = "2025-08-09T07:56:49.756Z" },
+    { url = "https://files.pythonhosted.org/packages/72/2a/aff5dd112b2f14bcc3462c312dce5445806bfc8ab3a7328555da95330e4b/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:d716a916938e03231e86e43782ca7878fb602a125a91e7acb8b5112e2e96ac16", size = 152224, upload-time = "2025-08-09T07:56:51.369Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/8c/9839225320046ed279c6e839d51f028342eb77c91c89b8ef2549f951f3ec/charset_normalizer-3.4.3-cp314-cp314-win32.whl", hash = "sha256:c6dbd0ccdda3a2ba7c2ecd9d77b37f3b5831687d8dc1b6ca5f56a4880cc7b7ce", size = 100086, upload-time = "2025-08-09T07:56:52.722Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/7a/36fbcf646e41f710ce0a563c1c9a343c6edf9be80786edeb15b6f62e17db/charset_normalizer-3.4.3-cp314-cp314-win_amd64.whl", hash = "sha256:73dc19b562516fc9bcf6e5d6e596df0b4eb98d87e4f79f3ae71840e6ed21361c", size = 107400, upload-time = "2025-08-09T07:56:55.172Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/1f/f041989e93b001bc4e44bb1669ccdcf54d3f00e628229a85b08d330615c5/charset_normalizer-3.4.3-py3-none-any.whl", hash = "sha256:ce571ab16d890d23b5c278547ba694193a45011ff86a9162a71307ed9f86759a", size = 53175, upload-time = "2025-08-09T07:57:26.864Z" },
+]
+
+[[package]]
+name = "click"
+version = "8.3.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/46/61/de6cd827efad202d7057d93e0fed9294b96952e188f7384832791c7b2254/click-8.3.0.tar.gz", hash = "sha256:e7b8232224eba16f4ebe410c25ced9f7875cb5f3263ffc93cc3e8da705e229c4", size = 276943, upload-time = "2025-09-18T17:32:23.696Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/db/d3/9dcc0f5797f070ec8edf30fbadfb200e71d9db6b84d211e3b2085a7589a0/click-8.3.0-py3-none-any.whl", hash = "sha256:9b9f285302c6e3064f4330c05f05b81945b2a39544279343e6e7c5f27a9baddc", size = 107295, upload-time = "2025-09-18T17:32:22.42Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "cryptography"
+version = "46.0.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4a/9b/e301418629f7bfdf72db9e80ad6ed9d1b83c487c471803eaa6464c511a01/cryptography-46.0.2.tar.gz", hash = "sha256:21b6fc8c71a3f9a604f028a329e5560009cc4a3a828bfea5fcba8eb7647d88fe", size = 749293, upload-time = "2025-10-01T00:29:11.856Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e0/98/7a8df8c19a335c8028414738490fc3955c0cecbfdd37fcc1b9c3d04bd561/cryptography-46.0.2-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:f3e32ab7dd1b1ef67b9232c4cf5e2ee4cd517d4316ea910acaaa9c5712a1c663", size = 7261255, upload-time = "2025-10-01T00:27:22.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/38/b2adb2aa1baa6706adc3eb746691edd6f90a656a9a65c3509e274d15a2b8/cryptography-46.0.2-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1fd1a69086926b623ef8126b4c33d5399ce9e2f3fac07c9c734c2a4ec38b6d02", size = 4297596, upload-time = "2025-10-01T00:27:25.258Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/27/0f190ada240003119488ae66c897b5e97149292988f556aef4a6a2a57595/cryptography-46.0.2-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bb7fb9cd44c2582aa5990cf61a4183e6f54eea3172e54963787ba47287edd135", size = 4450899, upload-time = "2025-10-01T00:27:27.458Z" },
+    { url = "https://files.pythonhosted.org/packages/85/d5/e4744105ab02fdf6bb58ba9a816e23b7a633255987310b4187d6745533db/cryptography-46.0.2-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:9066cfd7f146f291869a9898b01df1c9b0e314bfa182cef432043f13fc462c92", size = 4300382, upload-time = "2025-10-01T00:27:29.091Z" },
+    { url = "https://files.pythonhosted.org/packages/33/fb/bf9571065c18c04818cb07de90c43fc042c7977c68e5de6876049559c72f/cryptography-46.0.2-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:97e83bf4f2f2c084d8dd792d13841d0a9b241643151686010866bbd076b19659", size = 4017347, upload-time = "2025-10-01T00:27:30.767Z" },
+    { url = "https://files.pythonhosted.org/packages/35/72/fc51856b9b16155ca071080e1a3ad0c3a8e86616daf7eb018d9565b99baa/cryptography-46.0.2-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:4a766d2a5d8127364fd936572c6e6757682fc5dfcbdba1632d4554943199f2fa", size = 4983500, upload-time = "2025-10-01T00:27:32.741Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/53/0f51e926799025e31746d454ab2e36f8c3f0d41592bc65cb9840368d3275/cryptography-46.0.2-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:fab8f805e9675e61ed8538f192aad70500fa6afb33a8803932999b1049363a08", size = 4482591, upload-time = "2025-10-01T00:27:34.869Z" },
+    { url = "https://files.pythonhosted.org/packages/86/96/4302af40b23ab8aa360862251fb8fc450b2a06ff24bc5e261c2007f27014/cryptography-46.0.2-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:1e3b6428a3d56043bff0bb85b41c535734204e599c1c0977e1d0f261b02f3ad5", size = 4300019, upload-time = "2025-10-01T00:27:37.029Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/59/0be12c7fcc4c5e34fe2b665a75bc20958473047a30d095a7657c218fa9e8/cryptography-46.0.2-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:1a88634851d9b8de8bb53726f4300ab191d3b2f42595e2581a54b26aba71b7cc", size = 4950006, upload-time = "2025-10-01T00:27:40.272Z" },
+    { url = "https://files.pythonhosted.org/packages/55/1d/42fda47b0111834b49e31590ae14fd020594d5e4dadd639bce89ad790fba/cryptography-46.0.2-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:be939b99d4e091eec9a2bcf41aaf8f351f312cd19ff74b5c83480f08a8a43e0b", size = 4482088, upload-time = "2025-10-01T00:27:42.668Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/60f583f69aa1602c2bdc7022dae86a0d2b837276182f8c1ec825feb9b874/cryptography-46.0.2-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9f13b040649bc18e7eb37936009b24fd31ca095a5c647be8bb6aaf1761142bd1", size = 4425599, upload-time = "2025-10-01T00:27:44.616Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/57/d8d4134cd27e6e94cf44adb3f3489f935bde85f3a5508e1b5b43095b917d/cryptography-46.0.2-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bdc25e4e01b261a8fda4e98618f1c9515febcecebc9566ddf4a70c63967043b", size = 4697458, upload-time = "2025-10-01T00:27:46.209Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/2b/531e37408573e1da33adfb4c58875013ee8ac7d548d1548967d94a0ae5c4/cryptography-46.0.2-cp311-abi3-win32.whl", hash = "sha256:8b9bf67b11ef9e28f4d78ff88b04ed0929fcd0e4f70bb0f704cfc32a5c6311ee", size = 3056077, upload-time = "2025-10-01T00:27:48.424Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/cd/2f83cafd47ed2dc5a3a9c783ff5d764e9e70d3a160e0df9a9dcd639414ce/cryptography-46.0.2-cp311-abi3-win_amd64.whl", hash = "sha256:758cfc7f4c38c5c5274b55a57ef1910107436f4ae842478c4989abbd24bd5acb", size = 3512585, upload-time = "2025-10-01T00:27:50.521Z" },
+    { url = "https://files.pythonhosted.org/packages/00/36/676f94e10bfaa5c5b86c469ff46d3e0663c5dc89542f7afbadac241a3ee4/cryptography-46.0.2-cp311-abi3-win_arm64.whl", hash = "sha256:218abd64a2e72f8472c2102febb596793347a3e65fafbb4ad50519969da44470", size = 2927474, upload-time = "2025-10-01T00:27:52.91Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/cc/47fc6223a341f26d103cb6da2216805e08a37d3b52bee7f3b2aee8066f95/cryptography-46.0.2-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:bda55e8dbe8533937956c996beaa20266a8eca3570402e52ae52ed60de1faca8", size = 7198626, upload-time = "2025-10-01T00:27:54.8Z" },
+    { url = "https://files.pythonhosted.org/packages/93/22/d66a8591207c28bbe4ac7afa25c4656dc19dc0db29a219f9809205639ede/cryptography-46.0.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e7155c0b004e936d381b15425273aee1cebc94f879c0ce82b0d7fecbf755d53a", size = 4287584, upload-time = "2025-10-01T00:27:57.018Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/3e/fac3ab6302b928e0398c269eddab5978e6c1c50b2b77bb5365ffa8633b37/cryptography-46.0.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a61c154cc5488272a6c4b86e8d5beff4639cdb173d75325ce464d723cda0052b", size = 4433796, upload-time = "2025-10-01T00:27:58.631Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/d8/24392e5d3c58e2d83f98fe5a2322ae343360ec5b5b93fe18bc52e47298f5/cryptography-46.0.2-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:9ec3f2e2173f36a9679d3b06d3d01121ab9b57c979de1e6a244b98d51fea1b20", size = 4292126, upload-time = "2025-10-01T00:28:00.643Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/38/3d9f9359b84c16c49a5a336ee8be8d322072a09fac17e737f3bb11f1ce64/cryptography-46.0.2-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2fafb6aa24e702bbf74de4cb23bfa2c3beb7ab7683a299062b69724c92e0fa73", size = 3993056, upload-time = "2025-10-01T00:28:02.8Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a3/4c44fce0d49a4703cc94bfbe705adebf7ab36efe978053742957bc7ec324/cryptography-46.0.2-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:0c7ffe8c9b1fcbb07a26d7c9fa5e857c2fe80d72d7b9e0353dcf1d2180ae60ee", size = 4967604, upload-time = "2025-10-01T00:28:04.783Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/c2/49d73218747c8cac16bb8318a5513fde3129e06a018af3bc4dc722aa4a98/cryptography-46.0.2-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:5840f05518caa86b09d23f8b9405a7b6d5400085aa14a72a98fdf5cf1568c0d2", size = 4465367, upload-time = "2025-10-01T00:28:06.864Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/64/9afa7d2ee742f55ca6285a54386ed2778556a4ed8871571cb1c1bfd8db9e/cryptography-46.0.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:27c53b4f6a682a1b645fbf1cd5058c72cf2f5aeba7d74314c36838c7cbc06e0f", size = 4291678, upload-time = "2025-10-01T00:28:08.982Z" },
+    { url = "https://files.pythonhosted.org/packages/50/48/1696d5ea9623a7b72ace87608f6899ca3c331709ac7ebf80740abb8ac673/cryptography-46.0.2-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:512c0250065e0a6b286b2db4bbcc2e67d810acd53eb81733e71314340366279e", size = 4931366, upload-time = "2025-10-01T00:28:10.74Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/3c/9dfc778401a334db3b24435ee0733dd005aefb74afe036e2d154547cb917/cryptography-46.0.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:07c0eb6657c0e9cca5891f4e35081dbf985c8131825e21d99b4f440a8f496f36", size = 4464738, upload-time = "2025-10-01T00:28:12.491Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/b1/abcde62072b8f3fd414e191a6238ce55a0050e9738090dc6cded24c12036/cryptography-46.0.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:48b983089378f50cba258f7f7aa28198c3f6e13e607eaf10472c26320332ca9a", size = 4419305, upload-time = "2025-10-01T00:28:14.145Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/1f/3d2228492f9391395ca34c677e8f2571fb5370fe13dc48c1014f8c509864/cryptography-46.0.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:e6f6775eaaa08c0eec73e301f7592f4367ccde5e4e4df8e58320f2ebf161ea2c", size = 4681201, upload-time = "2025-10-01T00:28:15.951Z" },
+    { url = "https://files.pythonhosted.org/packages/de/77/b687745804a93a55054f391528fcfc76c3d6bfd082ce9fb62c12f0d29fc1/cryptography-46.0.2-cp314-cp314t-win32.whl", hash = "sha256:e8633996579961f9b5a3008683344c2558d38420029d3c0bc7ff77c17949a4e1", size = 3022492, upload-time = "2025-10-01T00:28:17.643Z" },
+    { url = "https://files.pythonhosted.org/packages/60/a5/8d498ef2996e583de0bef1dcc5e70186376f00883ae27bf2133f490adf21/cryptography-46.0.2-cp314-cp314t-win_amd64.whl", hash = "sha256:48c01988ecbb32979bb98731f5c2b2f79042a6c58cc9a319c8c2f9987c7f68f9", size = 3496215, upload-time = "2025-10-01T00:28:19.272Z" },
+    { url = "https://files.pythonhosted.org/packages/56/db/ee67aaef459a2706bc302b15889a1a8126ebe66877bab1487ae6ad00f33d/cryptography-46.0.2-cp314-cp314t-win_arm64.whl", hash = "sha256:8e2ad4d1a5899b7caa3a450e33ee2734be7cc0689010964703a7c4bcc8dd4fd0", size = 2919255, upload-time = "2025-10-01T00:28:21.115Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/bb/fa95abcf147a1b0bb94d95f53fbb09da77b24c776c5d87d36f3d94521d2c/cryptography-46.0.2-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:a08e7401a94c002e79dc3bc5231b6558cd4b2280ee525c4673f650a37e2c7685", size = 7248090, upload-time = "2025-10-01T00:28:22.846Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/66/f42071ce0e3ffbfa80a88feadb209c779fda92a23fbc1e14f74ebf72ef6b/cryptography-46.0.2-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d30bc11d35743bf4ddf76674a0a369ec8a21f87aaa09b0661b04c5f6c46e8d7b", size = 4293123, upload-time = "2025-10-01T00:28:25.072Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/5d/1fdbd2e5c1ba822828d250e5a966622ef00185e476d1cd2726b6dd135e53/cryptography-46.0.2-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bca3f0ce67e5a2a2cf524e86f44697c4323a86e0fd7ba857de1c30d52c11ede1", size = 4439524, upload-time = "2025-10-01T00:28:26.808Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/c1/5e4989a7d102d4306053770d60f978c7b6b1ea2ff8c06e0265e305b23516/cryptography-46.0.2-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ff798ad7a957a5021dcbab78dfff681f0cf15744d0e6af62bd6746984d9c9e9c", size = 4297264, upload-time = "2025-10-01T00:28:29.327Z" },
+    { url = "https://files.pythonhosted.org/packages/28/78/b56f847d220cb1d6d6aef5a390e116ad603ce13a0945a3386a33abc80385/cryptography-46.0.2-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:cb5e8daac840e8879407acbe689a174f5ebaf344a062f8918e526824eb5d97af", size = 4011872, upload-time = "2025-10-01T00:28:31.479Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/80/2971f214b066b888944f7b57761bf709ee3f2cf805619a18b18cab9b263c/cryptography-46.0.2-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:3f37aa12b2d91e157827d90ce78f6180f0c02319468a0aea86ab5a9566da644b", size = 4978458, upload-time = "2025-10-01T00:28:33.267Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/84/0cb0a2beaa4f1cbe63ebec4e97cd7e0e9f835d0ba5ee143ed2523a1e0016/cryptography-46.0.2-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:5e38f203160a48b93010b07493c15f2babb4e0f2319bbd001885adb3f3696d21", size = 4472195, upload-time = "2025-10-01T00:28:36.039Z" },
+    { url = "https://files.pythonhosted.org/packages/30/8b/2b542ddbf78835c7cd67b6fa79e95560023481213a060b92352a61a10efe/cryptography-46.0.2-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:d19f5f48883752b5ab34cff9e2f7e4a7f216296f33714e77d1beb03d108632b6", size = 4296791, upload-time = "2025-10-01T00:28:37.732Z" },
+    { url = "https://files.pythonhosted.org/packages/78/12/9065b40201b4f4876e93b9b94d91feb18de9150d60bd842a16a21565007f/cryptography-46.0.2-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:04911b149eae142ccd8c9a68892a70c21613864afb47aba92d8c7ed9cc001023", size = 4939629, upload-time = "2025-10-01T00:28:39.654Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/9e/6507dc048c1b1530d372c483dfd34e7709fc542765015425f0442b08547f/cryptography-46.0.2-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:8b16c1ede6a937c291d41176934268e4ccac2c6521c69d3f5961c5a1e11e039e", size = 4471988, upload-time = "2025-10-01T00:28:41.822Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/86/d025584a5f7d5c5ec8d3633dbcdce83a0cd579f1141ceada7817a4c26934/cryptography-46.0.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:747b6f4a4a23d5a215aadd1d0b12233b4119c4313df83ab4137631d43672cc90", size = 4422989, upload-time = "2025-10-01T00:28:43.608Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/39/536370418b38a15a61bbe413006b79dfc3d2b4b0eafceb5581983f973c15/cryptography-46.0.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6b275e398ab3a7905e168c036aad54b5969d63d3d9099a0a66cc147a3cc983be", size = 4685578, upload-time = "2025-10-01T00:28:45.361Z" },
+    { url = "https://files.pythonhosted.org/packages/15/52/ea7e2b1910f547baed566c866fbb86de2402e501a89ecb4871ea7f169a81/cryptography-46.0.2-cp38-abi3-win32.whl", hash = "sha256:0b507c8e033307e37af61cb9f7159b416173bdf5b41d11c4df2e499a1d8e007c", size = 3036711, upload-time = "2025-10-01T00:28:47.096Z" },
+    { url = "https://files.pythonhosted.org/packages/71/9e/171f40f9c70a873e73c2efcdbe91e1d4b1777a03398fa1c4af3c56a2477a/cryptography-46.0.2-cp38-abi3-win_amd64.whl", hash = "sha256:f9b2dc7668418fb6f221e4bf701f716e05e8eadb4f1988a2487b11aedf8abe62", size = 3500007, upload-time = "2025-10-01T00:28:48.967Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/7c/15ad426257615f9be8caf7f97990cf3dcbb5b8dd7ed7e0db581a1c4759dd/cryptography-46.0.2-cp38-abi3-win_arm64.whl", hash = "sha256:91447f2b17e83c9e0c89f133119d83f94ce6e0fb55dd47da0a959316e6e9cfa1", size = 2918153, upload-time = "2025-10-01T00:28:51.003Z" },
+]
+
+[[package]]
+name = "cyclopts"
+version = "3.24.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "docstring-parser", marker = "python_full_version < '4.0'" },
+    { name = "rich" },
+    { name = "rich-rst" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/30/ca/7782da3b03242d5f0a16c20371dff99d4bd1fedafe26bc48ff82e42be8c9/cyclopts-3.24.0.tar.gz", hash = "sha256:de6964a041dfb3c57bf043b41e68c43548227a17de1bad246e3a0bfc5c4b7417", size = 76131, upload-time = "2025-09-08T15:40:57.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f0/8b/2c95f0645c6f40211896375e6fa51f504b8ccb29c21f6ae661fe87ab044e/cyclopts-3.24.0-py3-none-any.whl", hash = "sha256:809d04cde9108617106091140c3964ee6fceb33cecdd537f7ffa360bde13ed71", size = 86154, upload-time = "2025-09-08T15:40:56.41Z" },
+]
+
+[[package]]
+name = "dnspython"
+version = "2.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8c/8b/57666417c0f90f08bcafa776861060426765fdb422eb10212086fb811d26/dnspython-2.8.0.tar.gz", hash = "sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f", size = 368251, upload-time = "2025-09-07T18:58:00.022Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" },
+]
+
+[[package]]
+name = "docstring-parser"
+version = "0.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b2/9d/c3b43da9515bd270df0f80548d9944e389870713cc1fe2b8fb35fe2bcefd/docstring_parser-0.17.0.tar.gz", hash = "sha256:583de4a309722b3315439bb31d64ba3eebada841f2e2cee23b99df001434c912", size = 27442, upload-time = "2025-07-21T07:35:01.868Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/55/e2/2537ebcff11c1ee1ff17d8d0b6f4db75873e3b0fb32c2d4a2ee31ecb310a/docstring_parser-0.17.0-py3-none-any.whl", hash = "sha256:cf2569abd23dce8099b300f9b4fa8191e9582dda731fd533daf54c4551658708", size = 36896, upload-time = "2025-07-21T07:35:00.684Z" },
+]
+
+[[package]]
+name = "docutils"
+version = "0.22.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/4a/c0/89fe6215b443b919cb98a5002e107cb5026854ed1ccb6b5833e0768419d1/docutils-0.22.2.tar.gz", hash = "sha256:9fdb771707c8784c8f2728b67cb2c691305933d68137ef95a75db5f4dfbc213d", size = 2289092, upload-time = "2025-09-20T17:55:47.994Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/66/dd/f95350e853a4468ec37478414fc04ae2d61dad7a947b3015c3dcc51a09b9/docutils-0.22.2-py3-none-any.whl", hash = "sha256:b0e98d679283fc3bb0ead8a5da7f501baa632654e7056e9c5846842213d674d8", size = 632667, upload-time = "2025-09-20T17:55:43.052Z" },
+]
+
+[[package]]
+name = "email-validator"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "dnspython" },
+    { name = "idna" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f5/22/900cb125c76b7aaa450ce02fd727f452243f2e91a61af068b40adba60ea9/email_validator-2.3.0.tar.gz", hash = "sha256:9fc05c37f2f6cf439ff414f8fc46d917929974a82244c20eb10231ba60c54426", size = 51238, upload-time = "2025-08-26T13:09:06.831Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/de/15/545e2b6cf2e3be84bc1ed85613edd75b8aea69807a71c26f4ca6a9258e82/email_validator-2.3.0-py3-none-any.whl", hash = "sha256:80f13f623413e6b197ae73bb10bf4eb0908faf509ad8362c5edeb0be7fd450b4", size = 35604, upload-time = "2025-08-26T13:09:05.858Z" },
+]
+
+[[package]]
+name = "exceptiongroup"
+version = "1.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/0b/9f/a65090624ecf468cdca03533906e7c69ed7588582240cfe7cc9e770b50eb/exceptiongroup-1.3.0.tar.gz", hash = "sha256:b241f5885f560bc56a59ee63ca4c6a8bfa46ae4ad651af316d4e81817bb9fd88", size = 29749, upload-time = "2025-05-10T17:42:51.123Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/36/f4/c6e662dade71f56cd2f3735141b265c3c79293c109549c1e6933b0651ffc/exceptiongroup-1.3.0-py3-none-any.whl", hash = "sha256:4d111e6e0c13d0644cad6ddaa7ed0261a0b36971f6d23e7ec9b4b9097da78a10", size = 16674, upload-time = "2025-05-10T17:42:49.33Z" },
+]
+
+[[package]]
+name = "fastmcp"
+version = "2.12.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "authlib" },
+    { name = "cyclopts" },
+    { name = "exceptiongroup" },
+    { name = "httpx" },
+    { name = "mcp" },
+    { name = "openapi-core" },
+    { name = "openapi-pydantic" },
+    { name = "pydantic", extra = ["email"] },
+    { name = "pyperclip" },
+    { name = "python-dotenv" },
+    { name = "rich" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a8/b2/57845353a9bc63002995a982e66f3d0be4ec761e7bcb89e7d0638518d42a/fastmcp-2.12.4.tar.gz", hash = "sha256:b55fe89537038f19d0f4476544f9ca5ac171033f61811cc8f12bdeadcbea5016", size = 7167745, upload-time = "2025-09-26T16:43:27.71Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e2/c7/562ff39f25de27caec01e4c1e88cbb5fcae5160802ba3d90be33165df24f/fastmcp-2.12.4-py3-none-any.whl", hash = "sha256:56188fbbc1a9df58c537063f25958c57b5c4d715f73e395c41b51550b247d140", size = 329090, upload-time = "2025-09-26T16:43:25.314Z" },
+]
+
+[[package]]
+name = "h11"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/ee/02a2c011bdab74c6fb3c75474d40b3052059d95df7e73351460c8588d963/h11-0.16.0.tar.gz", hash = "sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1", size = 101250, upload-time = "2025-04-24T03:35:25.427Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" },
+]
+
+[[package]]
+name = "httpcore"
+version = "1.0.9"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "h11" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
+]
+
+[[package]]
+name = "httpx"
+version = "0.28.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "certifi" },
+    { name = "httpcore" },
+    { name = "idna" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/df/48c586a5fe32a0f01324ee087459e112ebb7224f646c0b5023f5e79e9956/httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc", size = 141406, upload-time = "2024-12-06T15:37:23.222Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" },
+]
+
+[[package]]
+name = "httpx-sse"
+version = "0.4.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/63/7a/280d644f906f077e4f4a6d327e9b6e5a936624395ad1bf6ee9165a9d9959/httpx_sse-0.4.2.tar.gz", hash = "sha256:5bb6a2771a51e6c7a5f5c645e40b8a5f57d8de708f46cb5f3868043c3c18124e", size = 16000, upload-time = "2025-10-07T08:10:05.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/e5/ec31165492ecc52426370b9005e0637d6da02f9579283298affcb1ab614d/httpx_sse-0.4.2-py3-none-any.whl", hash = "sha256:a9fa4afacb293fa50ef9bacb6cae8287ba5fd1f4b1c2d10a35bb981c41da31ab", size = 9018, upload-time = "2025-10-07T08:10:04.257Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+
+[[package]]
+name = "isodate"
+version = "0.7.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/54/4d/e940025e2ce31a8ce1202635910747e5a87cc3a6a6bb2d00973375014749/isodate-0.7.2.tar.gz", hash = "sha256:4cd1aa0f43ca76f4a6c6c0292a85f40b35ec2e43e315b59f06e6d32171a953e6", size = 29705, upload-time = "2024-10-08T23:04:11.5Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/15/aa/0aca39a37d3c7eb941ba736ede56d689e7be91cab5d9ca846bde3999eba6/isodate-0.7.2-py3-none-any.whl", hash = "sha256:28009937d8031054830160fce6d409ed342816b543597cece116d966c6d99e15", size = 22320, upload-time = "2024-10-08T23:04:09.501Z" },
+]
+
+[[package]]
+name = "jsonschema"
+version = "4.25.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "jsonschema-specifications" },
+    { name = "referencing" },
+    { name = "rpds-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/74/69/f7185de793a29082a9f3c7728268ffb31cb5095131a9c139a74078e27336/jsonschema-4.25.1.tar.gz", hash = "sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85", size = 357342, upload-time = "2025-08-18T17:03:50.038Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bf/9c/8c95d856233c1f82500c2450b8c68576b4cf1c871db3afac5c34ff84e6fd/jsonschema-4.25.1-py3-none-any.whl", hash = "sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63", size = 90040, upload-time = "2025-08-18T17:03:48.373Z" },
+]
+
+[[package]]
+name = "jsonschema-path"
+version = "0.3.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pathable" },
+    { name = "pyyaml" },
+    { name = "referencing" },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/6e/45/41ebc679c2a4fced6a722f624c18d658dee42612b83ea24c1caf7c0eb3a8/jsonschema_path-0.3.4.tar.gz", hash = "sha256:8365356039f16cc65fddffafda5f58766e34bebab7d6d105616ab52bc4297001", size = 11159, upload-time = "2025-01-24T14:33:16.547Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/58/3485da8cb93d2f393bce453adeef16896751f14ba3e2024bc21dc9597646/jsonschema_path-0.3.4-py3-none-any.whl", hash = "sha256:f502191fdc2b22050f9a81c9237be9d27145b9001c55842bece5e94e382e52f8", size = 14810, upload-time = "2025-01-24T14:33:14.652Z" },
+]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2025.9.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "referencing" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/74/a633ee74eb36c44aa6d1095e7cc5569bebf04342ee146178e2d36600708b/jsonschema_specifications-2025.9.1.tar.gz", hash = "sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d", size = 32855, upload-time = "2025-09-08T01:34:59.186Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/41/45/1a4ed80516f02155c51f51e8cedb3c1902296743db0bbc66608a0db2814f/jsonschema_specifications-2025.9.1-py3-none-any.whl", hash = "sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe", size = 18437, upload-time = "2025-09-08T01:34:57.871Z" },
+]
+
+[[package]]
+name = "lazy-object-proxy"
+version = "1.12.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/08/a2/69df9c6ba6d316cfd81fe2381e464db3e6de5db45f8c43c6a23504abf8cb/lazy_object_proxy-1.12.0.tar.gz", hash = "sha256:1f5a462d92fd0cfb82f1fab28b51bfb209fabbe6aabf7f0d51472c0c124c0c61", size = 43681, upload-time = "2025-08-22T13:50:06.783Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/26/b74c791008841f8ad896c7f293415136c66cc27e7c7577de4ee68040c110/lazy_object_proxy-1.12.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:86fd61cb2ba249b9f436d789d1356deae69ad3231dc3c0f17293ac535162672e", size = 26745, upload-time = "2025-08-22T13:42:44.982Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/52/641870d309e5d1fb1ea7d462a818ca727e43bfa431d8c34b173eb090348c/lazy_object_proxy-1.12.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:81d1852fb30fab81696f93db1b1e55a5d1ff7940838191062f5f56987d5fcc3e", size = 71537, upload-time = "2025-08-22T13:42:46.141Z" },
+    { url = "https://files.pythonhosted.org/packages/47/b6/919118e99d51c5e76e8bf5a27df406884921c0acf2c7b8a3b38d847ab3e9/lazy_object_proxy-1.12.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be9045646d83f6c2664c1330904b245ae2371b5c57a3195e4028aedc9f999655", size = 71141, upload-time = "2025-08-22T13:42:47.375Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/47/1d20e626567b41de085cf4d4fb3661a56c159feaa73c825917b3b4d4f806/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:67f07ab742f1adfb3966c40f630baaa7902be4222a17941f3d85fd1dae5565ff", size = 69449, upload-time = "2025-08-22T13:42:48.49Z" },
+    { url = "https://files.pythonhosted.org/packages/58/8d/25c20ff1a1a8426d9af2d0b6f29f6388005fc8cd10d6ee71f48bff86fdd0/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:75ba769017b944fcacbf6a80c18b2761a1795b03f8899acdad1f1c39db4409be", size = 70744, upload-time = "2025-08-22T13:42:49.608Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/67/8ec9abe15c4f8a4bcc6e65160a2c667240d025cbb6591b879bea55625263/lazy_object_proxy-1.12.0-cp313-cp313-win_amd64.whl", hash = "sha256:7b22c2bbfb155706b928ac4d74c1a63ac8552a55ba7fff4445155523ea4067e1", size = 26568, upload-time = "2025-08-22T13:42:57.719Z" },
+    { url = "https://files.pythonhosted.org/packages/23/12/cd2235463f3469fd6c62d41d92b7f120e8134f76e52421413a0ad16d493e/lazy_object_proxy-1.12.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4a79b909aa16bde8ae606f06e6bbc9d3219d2e57fb3e0076e17879072b742c65", size = 27391, upload-time = "2025-08-22T13:42:50.62Z" },
+    { url = "https://files.pythonhosted.org/packages/60/9e/f1c53e39bbebad2e8609c67d0830cc275f694d0ea23d78e8f6db526c12d3/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:338ab2f132276203e404951205fe80c3fd59429b3a724e7b662b2eb539bb1be9", size = 80552, upload-time = "2025-08-22T13:42:51.731Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/b6/6c513693448dcb317d9d8c91d91f47addc09553613379e504435b4cc8b3e/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8c40b3c9faee2e32bfce0df4ae63f4e73529766893258eca78548bac801c8f66", size = 82857, upload-time = "2025-08-22T13:42:53.225Z" },
+    { url = "https://files.pythonhosted.org/packages/12/1c/d9c4aaa4c75da11eb7c22c43d7c90a53b4fca0e27784a5ab207768debea7/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:717484c309df78cedf48396e420fa57fc8a2b1f06ea889df7248fdd156e58847", size = 80833, upload-time = "2025-08-22T13:42:54.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/ae/29117275aac7d7d78ae4f5a4787f36ff33262499d486ac0bf3e0b97889f6/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a6b7ea5ea1ffe15059eb44bcbcb258f97bcb40e139b88152c40d07b1a1dfc9ac", size = 79516, upload-time = "2025-08-22T13:42:55.812Z" },
+    { url = "https://files.pythonhosted.org/packages/19/40/b4e48b2c38c69392ae702ae7afa7b6551e0ca5d38263198b7c79de8b3bdf/lazy_object_proxy-1.12.0-cp313-cp313t-win_amd64.whl", hash = "sha256:08c465fb5cd23527512f9bd7b4c7ba6cec33e28aad36fbbe46bf7b858f9f3f7f", size = 27656, upload-time = "2025-08-22T13:42:56.793Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/3a/277857b51ae419a1574557c0b12e0d06bf327b758ba94cafc664cb1e2f66/lazy_object_proxy-1.12.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c9defba70ab943f1df98a656247966d7729da2fe9c2d5d85346464bf320820a3", size = 26582, upload-time = "2025-08-22T13:49:49.366Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/b6/c5e0fa43535bb9c87880e0ba037cdb1c50e01850b0831e80eb4f4762f270/lazy_object_proxy-1.12.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:6763941dbf97eea6b90f5b06eb4da9418cc088fce0e3883f5816090f9afcde4a", size = 71059, upload-time = "2025-08-22T13:49:50.488Z" },
+    { url = "https://files.pythonhosted.org/packages/06/8a/7dcad19c685963c652624702f1a968ff10220b16bfcc442257038216bf55/lazy_object_proxy-1.12.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fdc70d81235fc586b9e3d1aeef7d1553259b62ecaae9db2167a5d2550dcc391a", size = 71034, upload-time = "2025-08-22T13:49:54.224Z" },
+    { url = "https://files.pythonhosted.org/packages/12/ac/34cbfb433a10e28c7fd830f91c5a348462ba748413cbb950c7f259e67aa7/lazy_object_proxy-1.12.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:0a83c6f7a6b2bfc11ef3ed67f8cbe99f8ff500b05655d8e7df9aab993a6abc95", size = 69529, upload-time = "2025-08-22T13:49:55.29Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/6a/11ad7e349307c3ca4c0175db7a77d60ce42a41c60bcb11800aabd6a8acb8/lazy_object_proxy-1.12.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:256262384ebd2a77b023ad02fbcc9326282bcfd16484d5531154b02bc304f4c5", size = 70391, upload-time = "2025-08-22T13:49:56.35Z" },
+    { url = "https://files.pythonhosted.org/packages/59/97/9b410ed8fbc6e79c1ee8b13f8777a80137d4bc189caf2c6202358e66192c/lazy_object_proxy-1.12.0-cp314-cp314-win_amd64.whl", hash = "sha256:7601ec171c7e8584f8ff3f4e440aa2eebf93e854f04639263875b8c2971f819f", size = 26988, upload-time = "2025-08-22T13:49:57.302Z" },
+]
+
+[[package]]
+name = "markdown-it-py"
+version = "4.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "mdurl" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/5b/f5/4ec618ed16cc4f8fb3b701563655a69816155e79e24a17b651541804721d/markdown_it_py-4.0.0.tar.gz", hash = "sha256:cb0a2b4aa34f932c007117b194e945bd74e0ec24133ceb5bac59009cda1cb9f3", size = 73070, upload-time = "2025-08-11T12:57:52.854Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/94/54/e7d793b573f298e1c9013b8c4dade17d481164aa517d1d7148619c2cedbf/markdown_it_py-4.0.0-py3-none-any.whl", hash = "sha256:87327c59b172c5011896038353a81343b6754500a08cd7a4973bb48c6d578147", size = 87321, upload-time = "2025-08-11T12:57:51.923Z" },
+]
+
+[[package]]
+name = "markupsafe"
+version = "3.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7e/99/7690b6d4034fffd95959cbe0c02de8deb3098cc577c67bb6a24fe5d7caa7/markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698", size = 80313, upload-time = "2025-09-27T18:37:40.426Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
+    { url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
+    { url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
+    { url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
+    { url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
+    { url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
+    { url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
+    { url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
+    { url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
+    { url = "https://files.pythonhosted.org/packages/33/8a/8e42d4838cd89b7dde187011e97fe6c3af66d8c044997d2183fbd6d31352/markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe", size = 11619, upload-time = "2025-09-27T18:37:06.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/64/7660f8a4a8e53c924d0fa05dc3a55c9cee10bbd82b11c5afb27d44b096ce/markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026", size = 12029, upload-time = "2025-09-27T18:37:07.213Z" },
+    { url = "https://files.pythonhosted.org/packages/da/ef/e648bfd021127bef5fa12e1720ffed0c6cbb8310c8d9bea7266337ff06de/markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737", size = 24408, upload-time = "2025-09-27T18:37:09.572Z" },
+    { url = "https://files.pythonhosted.org/packages/41/3c/a36c2450754618e62008bf7435ccb0f88053e07592e6028a34776213d877/markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97", size = 23005, upload-time = "2025-09-27T18:37:10.58Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/20/b7fdf89a8456b099837cd1dc21974632a02a999ec9bf7ca3e490aacd98e7/markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d", size = 22048, upload-time = "2025-09-27T18:37:11.547Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/a7/591f592afdc734f47db08a75793a55d7fbcc6902a723ae4cfbab61010cc5/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda", size = 23821, upload-time = "2025-09-27T18:37:12.48Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/33/45b24e4f44195b26521bc6f1a82197118f74df348556594bd2262bda1038/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf", size = 21606, upload-time = "2025-09-27T18:37:13.485Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/0e/53dfaca23a69fbfbbf17a4b64072090e70717344c52eaaaa9c5ddff1e5f0/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe", size = 23043, upload-time = "2025-09-27T18:37:14.408Z" },
+    { url = "https://files.pythonhosted.org/packages/46/11/f333a06fc16236d5238bfe74daccbca41459dcd8d1fa952e8fbd5dccfb70/markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9", size = 14747, upload-time = "2025-09-27T18:37:15.36Z" },
+    { url = "https://files.pythonhosted.org/packages/28/52/182836104b33b444e400b14f797212f720cbc9ed6ba34c800639d154e821/markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581", size = 15341, upload-time = "2025-09-27T18:37:16.496Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/18/acf23e91bd94fd7b3031558b1f013adfa21a8e407a3fdb32745538730382/markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4", size = 14073, upload-time = "2025-09-27T18:37:17.476Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/f0/57689aa4076e1b43b15fdfa646b04653969d50cf30c32a102762be2485da/markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab", size = 11661, upload-time = "2025-09-27T18:37:18.453Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c3/2e67a7ca217c6912985ec766c6393b636fb0c2344443ff9d91404dc4c79f/markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175", size = 12069, upload-time = "2025-09-27T18:37:19.332Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/00/be561dce4e6ca66b15276e184ce4b8aec61fe83662cce2f7d72bd3249d28/markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634", size = 25670, upload-time = "2025-09-27T18:37:20.245Z" },
+    { url = "https://files.pythonhosted.org/packages/50/09/c419f6f5a92e5fadde27efd190eca90f05e1261b10dbd8cbcb39cd8ea1dc/markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50", size = 23598, upload-time = "2025-09-27T18:37:21.177Z" },
+    { url = "https://files.pythonhosted.org/packages/22/44/a0681611106e0b2921b3033fc19bc53323e0b50bc70cffdd19f7d679bb66/markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e", size = 23261, upload-time = "2025-09-27T18:37:22.167Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/57/1b0b3f100259dc9fffe780cfb60d4be71375510e435efec3d116b6436d43/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5", size = 24835, upload-time = "2025-09-27T18:37:23.296Z" },
+    { url = "https://files.pythonhosted.org/packages/26/6a/4bf6d0c97c4920f1597cc14dd720705eca0bf7c787aebc6bb4d1bead5388/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523", size = 22733, upload-time = "2025-09-27T18:37:24.237Z" },
+    { url = "https://files.pythonhosted.org/packages/14/c7/ca723101509b518797fedc2fdf79ba57f886b4aca8a7d31857ba3ee8281f/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc", size = 23672, upload-time = "2025-09-27T18:37:25.271Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/df/5bd7a48c256faecd1d36edc13133e51397e41b73bb77e1a69deab746ebac/markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d", size = 14819, upload-time = "2025-09-27T18:37:26.285Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/8a/0402ba61a2f16038b48b39bccca271134be00c5c9f0f623208399333c448/markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9", size = 15426, upload-time = "2025-09-27T18:37:27.316Z" },
+    { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
+]
+
+[[package]]
+name = "mcp"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "httpx" },
+    { name = "httpx-sse" },
+    { name = "jsonschema" },
+    { name = "pydantic" },
+    { name = "pydantic-settings" },
+    { name = "python-multipart" },
+    { name = "pywin32", marker = "sys_platform == 'win32'" },
+    { name = "sse-starlette" },
+    { name = "starlette" },
+    { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/5a/79/5724a540df19e192e8606c543cdcf162de8eb435077520cca150f7365ec0/mcp-1.17.0.tar.gz", hash = "sha256:1b57fabf3203240ccc48e39859faf3ae1ccb0b571ff798bbedae800c73c6df90", size = 477951, upload-time = "2025-10-10T12:16:44.519Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1c/72/3751feae343a5ad07959df713907b5c3fbaed269d697a14b0c449080cf2e/mcp-1.17.0-py3-none-any.whl", hash = "sha256:0660ef275cada7a545af154db3082f176cf1d2681d5e35ae63e014faf0a35d40", size = 167737, upload-time = "2025-10-10T12:16:42.863Z" },
+]
+
+[[package]]
+name = "mdurl"
+version = "0.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba", size = 8729, upload-time = "2022-08-14T12:40:10.846Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/38/89ba8ad64ae25be8de66a6d463314cf1eb366222074cfda9ee839c56a4b4/mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8", size = 9979, upload-time = "2022-08-14T12:40:09.779Z" },
+]
+
+[[package]]
+name = "more-itertools"
+version = "10.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ea/5d/38b681d3fce7a266dd9ab73c66959406d565b3e85f21d5e66e1181d93721/more_itertools-10.8.0.tar.gz", hash = "sha256:f638ddf8a1a0d134181275fb5d58b086ead7c6a72429ad725c67503f13ba30bd", size = 137431, upload-time = "2025-09-02T15:23:11.018Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a4/8e/469e5a4a2f5855992e425f3cb33804cc07bf18d48f2db061aec61ce50270/more_itertools-10.8.0-py3-none-any.whl", hash = "sha256:52d4362373dcf7c52546bc4af9a86ee7c4579df9a8dc268be0a2f949d376cc9b", size = 69667, upload-time = "2025-09-02T15:23:09.635Z" },
+]
+
+[[package]]
+name = "openapi-core"
+version = "0.19.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "isodate" },
+    { name = "jsonschema" },
+    { name = "jsonschema-path" },
+    { name = "more-itertools" },
+    { name = "openapi-schema-validator" },
+    { name = "openapi-spec-validator" },
+    { name = "parse" },
+    { name = "typing-extensions" },
+    { name = "werkzeug" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/35/1acaa5f2fcc6e54eded34a2ec74b479439c4e469fc4e8d0e803fda0234db/openapi_core-0.19.5.tar.gz", hash = "sha256:421e753da56c391704454e66afe4803a290108590ac8fa6f4a4487f4ec11f2d3", size = 103264, upload-time = "2025-03-20T20:17:28.193Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/6f/83ead0e2e30a90445ee4fc0135f43741aebc30cca5b43f20968b603e30b6/openapi_core-0.19.5-py3-none-any.whl", hash = "sha256:ef7210e83a59394f46ce282639d8d26ad6fc8094aa904c9c16eb1bac8908911f", size = 106595, upload-time = "2025-03-20T20:17:26.77Z" },
+]
+
+[[package]]
+name = "openapi-pydantic"
+version = "0.5.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/02/2e/58d83848dd1a79cb92ed8e63f6ba901ca282c5f09d04af9423ec26c56fd7/openapi_pydantic-0.5.1.tar.gz", hash = "sha256:ff6835af6bde7a459fb93eb93bb92b8749b754fc6e51b2f1590a19dc3005ee0d", size = 60892, upload-time = "2025-01-08T19:29:27.083Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/12/cf/03675d8bd8ecbf4445504d8071adab19f5f993676795708e36402ab38263/openapi_pydantic-0.5.1-py3-none-any.whl", hash = "sha256:a3a09ef4586f5bd760a8df7f43028b60cafb6d9f61de2acba9574766255ab146", size = 96381, upload-time = "2025-01-08T19:29:25.275Z" },
+]
+
+[[package]]
+name = "openapi-schema-validator"
+version = "0.6.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "jsonschema" },
+    { name = "jsonschema-specifications" },
+    { name = "rfc3339-validator" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8b/f3/5507ad3325169347cd8ced61c232ff3df70e2b250c49f0fe140edb4973c6/openapi_schema_validator-0.6.3.tar.gz", hash = "sha256:f37bace4fc2a5d96692f4f8b31dc0f8d7400fd04f3a937798eaf880d425de6ee", size = 11550, upload-time = "2025-01-10T18:08:22.268Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/21/c6/ad0fba32775ae749016829dace42ed80f4407b171da41313d1a3a5f102e4/openapi_schema_validator-0.6.3-py3-none-any.whl", hash = "sha256:f3b9870f4e556b5a62a1c39da72a6b4b16f3ad9c73dc80084b1b11e74ba148a3", size = 8755, upload-time = "2025-01-10T18:08:19.758Z" },
+]
+
+[[package]]
+name = "openapi-spec-validator"
+version = "0.7.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "jsonschema" },
+    { name = "jsonschema-path" },
+    { name = "lazy-object-proxy" },
+    { name = "openapi-schema-validator" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/82/af/fe2d7618d6eae6fb3a82766a44ed87cd8d6d82b4564ed1c7cfb0f6378e91/openapi_spec_validator-0.7.2.tar.gz", hash = "sha256:cc029309b5c5dbc7859df0372d55e9d1ff43e96d678b9ba087f7c56fc586f734", size = 36855, upload-time = "2025-06-07T14:48:56.299Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/dd/b3fd642260cb17532f66cc1e8250f3507d1e580483e209dc1e9d13bd980d/openapi_spec_validator-0.7.2-py3-none-any.whl", hash = "sha256:4bbdc0894ec85f1d1bea1d6d9c8b2c3c8d7ccaa13577ef40da9c006c9fd0eb60", size = 39713, upload-time = "2025-06-07T14:48:54.077Z" },
+]
+
+[[package]]
+name = "parse"
+version = "1.20.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/4f/78/d9b09ba24bb36ef8b83b71be547e118d46214735b6dfb39e4bfde0e9b9dd/parse-1.20.2.tar.gz", hash = "sha256:b41d604d16503c79d81af5165155c0b20f6c8d6c559efa66b4b695c3e5a0a0ce", size = 29391, upload-time = "2024-06-11T04:41:57.34Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d0/31/ba45bf0b2aa7898d81cbbfac0e88c267befb59ad91a19e36e1bc5578ddb1/parse-1.20.2-py2.py3-none-any.whl", hash = "sha256:967095588cb802add9177d0c0b6133b5ba33b1ea9007ca800e526f42a85af558", size = 20126, upload-time = "2024-06-11T04:41:55.057Z" },
+]
+
+[[package]]
+name = "pathable"
+version = "0.4.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/67/93/8f2c2075b180c12c1e9f6a09d1a985bc2036906b13dff1d8917e395f2048/pathable-0.4.4.tar.gz", hash = "sha256:6905a3cd17804edfac7875b5f6c9142a218c7caef78693c2dbbbfbac186d88b2", size = 8124, upload-time = "2025-01-10T18:43:13.247Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7d/eb/b6260b31b1a96386c0a880edebe26f89669098acea8e0318bff6adb378fd/pathable-0.4.4-py3-none-any.whl", hash = "sha256:5ae9e94793b6ef5a4cbe0a7ce9dbbefc1eec38df253763fd0aeeacf2762dbbc2", size = 9592, upload-time = "2025-01-10T18:43:11.88Z" },
+]
+
+[[package]]
+name = "pycparser"
+version = "2.23"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/fe/cf/d2d3b9f5699fb1e4615c8e32ff220203e43b248e1dfcc6736ad9057731ca/pycparser-2.23.tar.gz", hash = "sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2", size = 173734, upload-time = "2025-09-09T13:23:47.91Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/e3/59cd50310fc9b59512193629e1984c1f95e5c8ae6e5d8c69532ccc65a7fe/pycparser-2.23-py3-none-any.whl", hash = "sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934", size = 118140, upload-time = "2025-09-09T13:23:46.651Z" },
+]
+
+[[package]]
+name = "pydantic"
+version = "2.12.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-types" },
+    { name = "pydantic-core" },
+    { name = "typing-extensions" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c3/da/b8a7ee04378a53f6fefefc0c5e05570a3ebfdfa0523a878bcd3b475683ee/pydantic-2.12.0.tar.gz", hash = "sha256:c1a077e6270dbfb37bfd8b498b3981e2bb18f68103720e51fa6c306a5a9af563", size = 814760, upload-time = "2025-10-07T15:58:03.467Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/9d/d5c855424e2e5b6b626fbc6ec514d8e655a600377ce283008b115abb7445/pydantic-2.12.0-py3-none-any.whl", hash = "sha256:f6a1da352d42790537e95e83a8bdfb91c7efbae63ffd0b86fa823899e807116f", size = 459730, upload-time = "2025-10-07T15:58:01.576Z" },
+]
+
+[package.optional-dependencies]
+email = [
+    { name = "email-validator" },
+]
+
+[[package]]
+name = "pydantic-core"
+version = "2.41.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/14/12b4a0d2b0b10d8e1d9a24ad94e7bbb43335eaf29c0c4e57860e8a30734a/pydantic_core-2.41.1.tar.gz", hash = "sha256:1ad375859a6d8c356b7704ec0f547a58e82ee80bb41baa811ad710e124bc8f2f", size = 454870, upload-time = "2025-10-07T10:50:45.974Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/8a/6d54198536a90a37807d31a156642aae7a8e1263ed9fe6fc6245defe9332/pydantic_core-2.41.1-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:70e790fce5f05204ef4403159857bfcd587779da78627b0babb3654f75361ebf", size = 2105825, upload-time = "2025-10-06T21:10:51.719Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/2e/4784fd7b22ac9c8439db25bf98ffed6853d01e7e560a346e8af821776ccc/pydantic_core-2.41.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:9cebf1ca35f10930612d60bd0f78adfacee824c30a880e3534ba02c207cceceb", size = 1910126, upload-time = "2025-10-06T21:10:53.145Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/92/31eb0748059ba5bd0aa708fb4bab9fcb211461ddcf9e90702a6542f22d0d/pydantic_core-2.41.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:170406a37a5bc82c22c3274616bf6f17cc7df9c4a0a0a50449e559cb755db669", size = 1961472, upload-time = "2025-10-06T21:10:55.754Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/91/946527792275b5c4c7dde4cfa3e81241bf6900e9fee74fb1ba43e0c0f1ab/pydantic_core-2.41.1-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:12d4257fc9187a0ccd41b8b327d6a4e57281ab75e11dda66a9148ef2e1fb712f", size = 2063230, upload-time = "2025-10-06T21:10:57.179Z" },
+    { url = "https://files.pythonhosted.org/packages/31/5d/a35c5d7b414e5c0749f1d9f0d159ee2ef4bab313f499692896b918014ee3/pydantic_core-2.41.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a75a33b4db105dd1c8d57839e17ee12db8d5ad18209e792fa325dbb4baeb00f4", size = 2229469, upload-time = "2025-10-06T21:10:59.409Z" },
+    { url = "https://files.pythonhosted.org/packages/21/4d/8713737c689afa57ecfefe38db78259d4484c97aa494979e6a9d19662584/pydantic_core-2.41.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:08a589f850803a74e0fcb16a72081cafb0d72a3cdda500106942b07e76b7bf62", size = 2347986, upload-time = "2025-10-06T21:11:00.847Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/ec/929f9a3a5ed5cda767081494bacd32f783e707a690ce6eeb5e0730ec4986/pydantic_core-2.41.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7a97939d6ea44763c456bd8a617ceada2c9b96bb5b8ab3dfa0d0827df7619014", size = 2072216, upload-time = "2025-10-06T21:11:02.43Z" },
+    { url = "https://files.pythonhosted.org/packages/26/55/a33f459d4f9cc8786d9db42795dbecc84fa724b290d7d71ddc3d7155d46a/pydantic_core-2.41.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d2ae423c65c556f09569524b80ffd11babff61f33055ef9773d7c9fabc11ed8d", size = 2193047, upload-time = "2025-10-06T21:11:03.787Z" },
+    { url = "https://files.pythonhosted.org/packages/77/af/d5c6959f8b089f2185760a2779079e3c2c411bfc70ea6111f58367851629/pydantic_core-2.41.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:4dc703015fbf8764d6a8001c327a87f1823b7328d40b47ce6000c65918ad2b4f", size = 2140613, upload-time = "2025-10-06T21:11:05.607Z" },
+    { url = "https://files.pythonhosted.org/packages/58/e5/2c19bd2a14bffe7fabcf00efbfbd3ac430aaec5271b504a938ff019ac7be/pydantic_core-2.41.1-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:968e4ffdfd35698a5fe659e5e44c508b53664870a8e61c8f9d24d3d145d30257", size = 2327641, upload-time = "2025-10-06T21:11:07.143Z" },
+    { url = "https://files.pythonhosted.org/packages/93/ef/e0870ccda798c54e6b100aff3c4d49df5458fd64217e860cb9c3b0a403f4/pydantic_core-2.41.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:fff2b76c8e172d34771cd4d4f0ade08072385310f214f823b5a6ad4006890d32", size = 2318229, upload-time = "2025-10-06T21:11:08.73Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/4b/c3b991d95f5deb24d0bd52e47bcf716098fa1afe0ce2d4bd3125b38566ba/pydantic_core-2.41.1-cp313-cp313-win32.whl", hash = "sha256:a38a5263185407ceb599f2f035faf4589d57e73c7146d64f10577f6449e8171d", size = 1997911, upload-time = "2025-10-06T21:11:10.329Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/ce/5c316fd62e01f8d6be1b7ee6b54273214e871772997dc2c95e204997a055/pydantic_core-2.41.1-cp313-cp313-win_amd64.whl", hash = "sha256:b42ae7fd6760782c975897e1fdc810f483b021b32245b0105d40f6e7a3803e4b", size = 2034301, upload-time = "2025-10-06T21:11:12.113Z" },
+    { url = "https://files.pythonhosted.org/packages/29/41/902640cfd6a6523194123e2c3373c60f19006447f2fb06f76de4e8466c5b/pydantic_core-2.41.1-cp313-cp313-win_arm64.whl", hash = "sha256:ad4111acc63b7384e205c27a2f15e23ac0ee21a9d77ad6f2e9cb516ec90965fb", size = 1977238, upload-time = "2025-10-06T21:11:14.1Z" },
+    { url = "https://files.pythonhosted.org/packages/04/04/28b040e88c1b89d851278478842f0bdf39c7a05da9e850333c6c8cbe7dfa/pydantic_core-2.41.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:440d0df7415b50084a4ba9d870480c16c5f67c0d1d4d5119e3f70925533a0edc", size = 1875626, upload-time = "2025-10-06T21:11:15.69Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/58/b41dd3087505220bb58bc81be8c3e8cbc037f5710cd3c838f44f90bdd704/pydantic_core-2.41.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:71eaa38d342099405dae6484216dcf1e8e4b0bebd9b44a4e08c9b43db6a2ab67", size = 2045708, upload-time = "2025-10-06T21:11:17.258Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/b8/760f23754e40bf6c65b94a69b22c394c24058a0ef7e2aa471d2e39219c1a/pydantic_core-2.41.1-cp313-cp313t-win_amd64.whl", hash = "sha256:555ecf7e50f1161d3f693bc49f23c82cf6cdeafc71fa37a06120772a09a38795", size = 1997171, upload-time = "2025-10-06T21:11:18.822Z" },
+    { url = "https://files.pythonhosted.org/packages/41/12/cec246429ddfa2778d2d6301eca5362194dc8749ecb19e621f2f65b5090f/pydantic_core-2.41.1-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:05226894a26f6f27e1deb735d7308f74ef5fa3a6de3e0135bb66cdcaee88f64b", size = 2107836, upload-time = "2025-10-06T21:11:20.432Z" },
+    { url = "https://files.pythonhosted.org/packages/20/39/baba47f8d8b87081302498e610aefc37142ce6a1cc98b2ab6b931a162562/pydantic_core-2.41.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:85ff7911c6c3e2fd8d3779c50925f6406d770ea58ea6dde9c230d35b52b16b4a", size = 1904449, upload-time = "2025-10-06T21:11:22.185Z" },
+    { url = "https://files.pythonhosted.org/packages/50/32/9a3d87cae2c75a5178334b10358d631bd094b916a00a5993382222dbfd92/pydantic_core-2.41.1-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:47f1f642a205687d59b52dc1a9a607f45e588f5a2e9eeae05edd80c7a8c47674", size = 1961750, upload-time = "2025-10-06T21:11:24.348Z" },
+    { url = "https://files.pythonhosted.org/packages/27/42/a96c9d793a04cf2a9773bff98003bb154087b94f5530a2ce6063ecfec583/pydantic_core-2.41.1-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:df11c24e138876ace5ec6043e5cae925e34cf38af1a1b3d63589e8f7b5f5cdc4", size = 2063305, upload-time = "2025-10-06T21:11:26.556Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/8d/028c4b7d157a005b1f52c086e2d4b0067886b213c86220c1153398dbdf8f/pydantic_core-2.41.1-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7f0bf7f5c8f7bf345c527e8a0d72d6b26eda99c1227b0c34e7e59e181260de31", size = 2228959, upload-time = "2025-10-06T21:11:28.426Z" },
+    { url = "https://files.pythonhosted.org/packages/08/f7/ee64cda8fcc9ca3f4716e6357144f9ee71166775df582a1b6b738bf6da57/pydantic_core-2.41.1-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:82b887a711d341c2c47352375d73b029418f55b20bd7815446d175a70effa706", size = 2345421, upload-time = "2025-10-06T21:11:30.226Z" },
+    { url = "https://files.pythonhosted.org/packages/13/c0/e8ec05f0f5ee7a3656973ad9cd3bc73204af99f6512c1a4562f6fb4b3f7d/pydantic_core-2.41.1-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b5f1d5d6bbba484bdf220c72d8ecd0be460f4bd4c5e534a541bb2cd57589fb8b", size = 2065288, upload-time = "2025-10-06T21:11:32.019Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/25/d77a73ff24e2e4fcea64472f5e39b0402d836da9b08b5361a734d0153023/pydantic_core-2.41.1-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2bf1917385ebe0f968dc5c6ab1375886d56992b93ddfe6bf52bff575d03662be", size = 2189759, upload-time = "2025-10-06T21:11:33.753Z" },
+    { url = "https://files.pythonhosted.org/packages/66/45/4a4ebaaae12a740552278d06fe71418c0f2869537a369a89c0e6723b341d/pydantic_core-2.41.1-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:4f94f3ab188f44b9a73f7295663f3ecb8f2e2dd03a69c8f2ead50d37785ecb04", size = 2140747, upload-time = "2025-10-06T21:11:35.781Z" },
+    { url = "https://files.pythonhosted.org/packages/da/6d/b727ce1022f143194a36593243ff244ed5a1eb3c9122296bf7e716aa37ba/pydantic_core-2.41.1-cp314-cp314-musllinux_1_1_armv7l.whl", hash = "sha256:3925446673641d37c30bd84a9d597e49f72eacee8b43322c8999fa17d5ae5bc4", size = 2327416, upload-time = "2025-10-06T21:11:37.75Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/8c/02df9d8506c427787059f87c6c7253435c6895e12472a652d9616ee0fc95/pydantic_core-2.41.1-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:49bd51cc27adb980c7b97357ae036ce9b3c4d0bb406e84fbe16fb2d368b602a8", size = 2318138, upload-time = "2025-10-06T21:11:39.463Z" },
+    { url = "https://files.pythonhosted.org/packages/98/67/0cf429a7d6802536941f430e6e3243f6d4b68f41eeea4b242372f1901794/pydantic_core-2.41.1-cp314-cp314-win32.whl", hash = "sha256:a31ca0cd0e4d12ea0df0077df2d487fc3eb9d7f96bbb13c3c5b88dcc21d05159", size = 1998429, upload-time = "2025-10-06T21:11:41.989Z" },
+    { url = "https://files.pythonhosted.org/packages/38/60/742fef93de5d085022d2302a6317a2b34dbfe15258e9396a535c8a100ae7/pydantic_core-2.41.1-cp314-cp314-win_amd64.whl", hash = "sha256:1b5c4374a152e10a22175d7790e644fbd8ff58418890e07e2073ff9d4414efae", size = 2028870, upload-time = "2025-10-06T21:11:43.66Z" },
+    { url = "https://files.pythonhosted.org/packages/31/38/cdd8ccb8555ef7720bd7715899bd6cfbe3c29198332710e1b61b8f5dd8b8/pydantic_core-2.41.1-cp314-cp314-win_arm64.whl", hash = "sha256:4fee76d757639b493eb600fba668f1e17475af34c17dd61db7a47e824d464ca9", size = 1974275, upload-time = "2025-10-06T21:11:45.476Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/7e/8ac10ccb047dc0221aa2530ec3c7c05ab4656d4d4bd984ee85da7f3d5525/pydantic_core-2.41.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f9b9c968cfe5cd576fdd7361f47f27adeb120517e637d1b189eea1c3ece573f4", size = 1875124, upload-time = "2025-10-06T21:11:47.591Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/e4/7d9791efeb9c7d97e7268f8d20e0da24d03438a7fa7163ab58f1073ba968/pydantic_core-2.41.1-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f1ebc7ab67b856384aba09ed74e3e977dded40e693de18a4f197c67d0d4e6d8e", size = 2043075, upload-time = "2025-10-06T21:11:49.542Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/c3/3f6e6b2342ac11ac8cd5cb56e24c7b14afa27c010e82a765ffa5f771884a/pydantic_core-2.41.1-cp314-cp314t-win_amd64.whl", hash = "sha256:8ae0dc57b62a762985bc7fbf636be3412394acc0ddb4ade07fe104230f1b9762", size = 1995341, upload-time = "2025-10-06T21:11:51.497Z" },
+]
+
+[[package]]
+name = "pydantic-settings"
+version = "2.11.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dotenv" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/20/c5/dbbc27b814c71676593d1c3f718e6cd7d4f00652cefa24b75f7aa3efb25e/pydantic_settings-2.11.0.tar.gz", hash = "sha256:d0e87a1c7d33593beb7194adb8470fc426e95ba02af83a0f23474a04c9a08180", size = 188394, upload-time = "2025-09-24T14:19:11.764Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/83/d6/887a1ff844e64aa823fb4905978d882a633cfe295c32eacad582b78a7d8b/pydantic_settings-2.11.0-py3-none-any.whl", hash = "sha256:fe2cea3413b9530d10f3a5875adffb17ada5c1e1bab0b2885546d7310415207c", size = 48608, upload-time = "2025-09-24T14:19:10.015Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.19.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+]
+
+[[package]]
+name = "pyperclip"
+version = "1.11.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e8/52/d87eba7cb129b81563019d1679026e7a112ef76855d6159d24754dbd2a51/pyperclip-1.11.0.tar.gz", hash = "sha256:244035963e4428530d9e3a6101a1ef97209c6825edab1567beac148ccc1db1b6", size = 12185, upload-time = "2025-09-26T14:40:37.245Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/80/fc9d01d5ed37ba4c42ca2b55b4339ae6e200b456be3a1aaddf4a9fa99b8c/pyperclip-1.11.0-py3-none-any.whl", hash = "sha256:299403e9ff44581cb9ba2ffeed69c7aa96a008622ad0c46cb575ca75b5b84273", size = 11063, upload-time = "2025-09-26T14:40:36.069Z" },
+]
+
+[[package]]
+name = "python-dotenv"
+version = "1.1.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/b0/4bc07ccd3572a2f9df7e6782f52b0c6c90dcbb803ac4a167702d7d0dfe1e/python_dotenv-1.1.1.tar.gz", hash = "sha256:a8a6399716257f45be6a007360200409fce5cda2661e3dec71d23dc15f6189ab", size = 41978, upload-time = "2025-06-24T04:21:07.341Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5f/ed/539768cf28c661b5b068d66d96a2f155c4971a5d55684a514c1a0e0dec2f/python_dotenv-1.1.1-py3-none-any.whl", hash = "sha256:31f23644fe2602f88ff55e1f5c79ba497e01224ee7737937930c448e4d0e24dc", size = 20556, upload-time = "2025-06-24T04:21:06.073Z" },
+]
+
+[[package]]
+name = "python-multipart"
+version = "0.0.20"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f3/87/f44d7c9f274c7ee665a29b885ec97089ec5dc034c7f3fafa03da9e39a09e/python_multipart-0.0.20.tar.gz", hash = "sha256:8dd0cab45b8e23064ae09147625994d090fa46f5b0d1e13af944c331a7fa9d13", size = 37158, upload-time = "2024-12-16T19:45:46.972Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/45/58/38b5afbc1a800eeea951b9285d3912613f2603bdf897a4ab0f4bd7f405fc/python_multipart-0.0.20-py3-none-any.whl", hash = "sha256:8a62d3a8335e06589fe01f2a3e178cdcc632f3fbe0d492ad9ee0ec35aab1f104", size = 24546, upload-time = "2024-12-16T19:45:44.423Z" },
+]
+
+[[package]]
+name = "pywin32"
+version = "311"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a5/be/3fd5de0979fcb3994bfee0d65ed8ca9506a8a1260651b86174f6a86f52b3/pywin32-311-cp313-cp313-win32.whl", hash = "sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d", size = 8705700, upload-time = "2025-07-14T20:13:26.471Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/28/e0a1909523c6890208295a29e05c2adb2126364e289826c0a8bc7297bd5c/pywin32-311-cp313-cp313-win_amd64.whl", hash = "sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d", size = 9494700, upload-time = "2025-07-14T20:13:28.243Z" },
+    { url = "https://files.pythonhosted.org/packages/04/bf/90339ac0f55726dce7d794e6d79a18a91265bdf3aa70b6b9ca52f35e022a/pywin32-311-cp313-cp313-win_arm64.whl", hash = "sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a", size = 8709318, upload-time = "2025-07-14T20:13:30.348Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/31/097f2e132c4f16d99a22bfb777e0fd88bd8e1c634304e102f313af69ace5/pywin32-311-cp314-cp314-win32.whl", hash = "sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee", size = 8840714, upload-time = "2025-07-14T20:13:32.449Z" },
+    { url = "https://files.pythonhosted.org/packages/90/4b/07c77d8ba0e01349358082713400435347df8426208171ce297da32c313d/pywin32-311-cp314-cp314-win_amd64.whl", hash = "sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87", size = 9656800, upload-time = "2025-07-14T20:13:34.312Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/d2/21af5c535501a7233e734b8af901574572da66fcc254cb35d0609c9080dd/pywin32-311-cp314-cp314-win_arm64.whl", hash = "sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42", size = 8932540, upload-time = "2025-07-14T20:13:36.379Z" },
+]
+
+[[package]]
+name = "pyyaml"
+version = "6.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/8c/f4bd7f6465179953d3ac9bc44ac1a8a3e6122cf8ada906b4f96c60172d43/pyyaml-6.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac", size = 181814, upload-time = "2025-09-25T21:32:35.712Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/9c/4d95bb87eb2063d20db7b60faa3840c1b18025517ae857371c4dd55a6b3a/pyyaml-6.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310", size = 173809, upload-time = "2025-09-25T21:32:36.789Z" },
+    { url = "https://files.pythonhosted.org/packages/92/b5/47e807c2623074914e29dabd16cbbdd4bf5e9b2db9f8090fa64411fc5382/pyyaml-6.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7", size = 766454, upload-time = "2025-09-25T21:32:37.966Z" },
+    { url = "https://files.pythonhosted.org/packages/02/9e/e5e9b168be58564121efb3de6859c452fccde0ab093d8438905899a3a483/pyyaml-6.0.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788", size = 836355, upload-time = "2025-09-25T21:32:39.178Z" },
+    { url = "https://files.pythonhosted.org/packages/88/f9/16491d7ed2a919954993e48aa941b200f38040928474c9e85ea9e64222c3/pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5", size = 794175, upload-time = "2025-09-25T21:32:40.865Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/3f/5989debef34dc6397317802b527dbbafb2b4760878a53d4166579111411e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764", size = 755228, upload-time = "2025-09-25T21:32:42.084Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ce/af88a49043cd2e265be63d083fc75b27b6ed062f5f9fd6cdc223ad62f03e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35", size = 789194, upload-time = "2025-09-25T21:32:43.362Z" },
+    { url = "https://files.pythonhosted.org/packages/23/20/bb6982b26a40bb43951265ba29d4c246ef0ff59c9fdcdf0ed04e0687de4d/pyyaml-6.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac", size = 156429, upload-time = "2025-09-25T21:32:57.844Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/f4/a4541072bb9422c8a883ab55255f918fa378ecf083f5b85e87fc2b4eda1b/pyyaml-6.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3", size = 143912, upload-time = "2025-09-25T21:32:59.247Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/f9/07dd09ae774e4616edf6cda684ee78f97777bdd15847253637a6f052a62f/pyyaml-6.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3", size = 189108, upload-time = "2025-09-25T21:32:44.377Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/78/8d08c9fb7ce09ad8c38ad533c1191cf27f7ae1effe5bb9400a46d9437fcf/pyyaml-6.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba", size = 183641, upload-time = "2025-09-25T21:32:45.407Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/5b/3babb19104a46945cf816d047db2788bcaf8c94527a805610b0289a01c6b/pyyaml-6.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c", size = 831901, upload-time = "2025-09-25T21:32:48.83Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/cc/dff0684d8dc44da4d22a13f35f073d558c268780ce3c6ba1b87055bb0b87/pyyaml-6.0.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702", size = 861132, upload-time = "2025-09-25T21:32:50.149Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5e/f77dc6b9036943e285ba76b49e118d9ea929885becb0a29ba8a7c75e29fe/pyyaml-6.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c", size = 839261, upload-time = "2025-09-25T21:32:51.808Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/88/a9db1376aa2a228197c58b37302f284b5617f56a5d959fd1763fb1675ce6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065", size = 805272, upload-time = "2025-09-25T21:32:52.941Z" },
+    { url = "https://files.pythonhosted.org/packages/da/92/1446574745d74df0c92e6aa4a7b0b3130706a4142b2d1a5869f2eaa423c6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65", size = 829923, upload-time = "2025-09-25T21:32:54.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/7a/1c7270340330e575b92f397352af856a8c06f230aa3e76f86b39d01b416a/pyyaml-6.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9", size = 174062, upload-time = "2025-09-25T21:32:55.767Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
+]
+
+[[package]]
+name = "referencing"
+version = "0.36.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "rpds-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/2f/db/98b5c277be99dd18bfd91dd04e1b759cad18d1a338188c936e92f921c7e2/referencing-0.36.2.tar.gz", hash = "sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa", size = 74744, upload-time = "2025-01-25T08:48:16.138Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c1/b1/3baf80dc6d2b7bc27a95a67752d0208e410351e3feb4eb78de5f77454d8d/referencing-0.36.2-py3-none-any.whl", hash = "sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0", size = 26775, upload-time = "2025-01-25T08:48:14.241Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.32.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
+]
+
+[[package]]
+name = "rfc3339-validator"
+version = "0.1.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/28/ea/a9387748e2d111c3c2b275ba970b735e04e15cdb1eb30693b6b5708c4dbd/rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b", size = 5513, upload-time = "2021-05-12T16:37:54.178Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7b/44/4e421b96b67b2daff264473f7465db72fbdf36a07e05494f50300cc7b0c6/rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa", size = 3490, upload-time = "2021-05-12T16:37:52.536Z" },
+]
+
+[[package]]
+name = "rich"
+version = "14.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markdown-it-py" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/fb/d2/8920e102050a0de7bfabeb4c4614a49248cf8d5d7a8d01885fbb24dc767a/rich-14.2.0.tar.gz", hash = "sha256:73ff50c7c0c1c77c8243079283f4edb376f0f6442433aecb8ce7e6d0b92d1fe4", size = 219990, upload-time = "2025-10-09T14:16:53.064Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/25/7a/b0178788f8dc6cafce37a212c99565fa1fe7872c70c6c9c1e1a372d9d88f/rich-14.2.0-py3-none-any.whl", hash = "sha256:76bc51fe2e57d2b1be1f96c524b890b816e334ab4c1e45888799bfaab0021edd", size = 243393, upload-time = "2025-10-09T14:16:51.245Z" },
+]
+
+[[package]]
+name = "rich-rst"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "docutils" },
+    { name = "rich" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b0/69/5514c3a87b5f10f09a34bb011bc0927bc12c596c8dae5915604e71abc386/rich_rst-1.3.1.tar.gz", hash = "sha256:fad46e3ba42785ea8c1785e2ceaa56e0ffa32dbe5410dec432f37e4107c4f383", size = 13839, upload-time = "2024-04-30T04:40:38.125Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fd/bc/cc4e3dbc5e7992398dcb7a8eda0cbcf4fb792a0cdb93f857b478bf3cf884/rich_rst-1.3.1-py3-none-any.whl", hash = "sha256:498a74e3896507ab04492d326e794c3ef76e7cda078703aa592d1853d91098c1", size = 11621, upload-time = "2024-04-30T04:40:32.619Z" },
+]
+
+[[package]]
+name = "rpds-py"
+version = "0.27.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e9/dd/2c0cbe774744272b0ae725f44032c77bdcab6e8bcf544bffa3b6e70c8dba/rpds_py-0.27.1.tar.gz", hash = "sha256:26a1c73171d10b7acccbded82bf6a586ab8203601e565badc74bbbf8bc5a10f8", size = 27479, upload-time = "2025-08-27T12:16:36.024Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cc/77/610aeee8d41e39080c7e14afa5387138e3c9fa9756ab893d09d99e7d8e98/rpds_py-0.27.1-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:e4b9fcfbc021633863a37e92571d6f91851fa656f0180246e84cbd8b3f6b329b", size = 361741, upload-time = "2025-08-27T12:13:31.039Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/fc/c43765f201c6a1c60be2043cbdb664013def52460a4c7adace89d6682bf4/rpds_py-0.27.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:1441811a96eadca93c517d08df75de45e5ffe68aa3089924f963c782c4b898cf", size = 345574, upload-time = "2025-08-27T12:13:32.902Z" },
+    { url = "https://files.pythonhosted.org/packages/20/42/ee2b2ca114294cd9847d0ef9c26d2b0851b2e7e00bf14cc4c0b581df0fc3/rpds_py-0.27.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:55266dafa22e672f5a4f65019015f90336ed31c6383bd53f5e7826d21a0e0b83", size = 385051, upload-time = "2025-08-27T12:13:34.228Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/e8/1e430fe311e4799e02e2d1af7c765f024e95e17d651612425b226705f910/rpds_py-0.27.1-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d78827d7ac08627ea2c8e02c9e5b41180ea5ea1f747e9db0915e3adf36b62dcf", size = 398395, upload-time = "2025-08-27T12:13:36.132Z" },
+    { url = "https://files.pythonhosted.org/packages/82/95/9dc227d441ff2670651c27a739acb2535ccaf8b351a88d78c088965e5996/rpds_py-0.27.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ae92443798a40a92dc5f0b01d8a7c93adde0c4dc965310a29ae7c64d72b9fad2", size = 524334, upload-time = "2025-08-27T12:13:37.562Z" },
+    { url = "https://files.pythonhosted.org/packages/87/01/a670c232f401d9ad461d9a332aa4080cd3cb1d1df18213dbd0d2a6a7ab51/rpds_py-0.27.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c46c9dd2403b66a2a3b9720ec4b74d4ab49d4fabf9f03dfdce2d42af913fe8d0", size = 407691, upload-time = "2025-08-27T12:13:38.94Z" },
+    { url = "https://files.pythonhosted.org/packages/03/36/0a14aebbaa26fe7fab4780c76f2239e76cc95a0090bdb25e31d95c492fcd/rpds_py-0.27.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2efe4eb1d01b7f5f1939f4ef30ecea6c6b3521eec451fb93191bf84b2a522418", size = 386868, upload-time = "2025-08-27T12:13:40.192Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/03/8c897fb8b5347ff6c1cc31239b9611c5bf79d78c984430887a353e1409a1/rpds_py-0.27.1-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:15d3b4d83582d10c601f481eca29c3f138d44c92187d197aff663a269197c02d", size = 405469, upload-time = "2025-08-27T12:13:41.496Z" },
+    { url = "https://files.pythonhosted.org/packages/da/07/88c60edc2df74850d496d78a1fdcdc7b54360a7f610a4d50008309d41b94/rpds_py-0.27.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4ed2e16abbc982a169d30d1a420274a709949e2cbdef119fe2ec9d870b42f274", size = 422125, upload-time = "2025-08-27T12:13:42.802Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/86/5f4c707603e41b05f191a749984f390dabcbc467cf833769b47bf14ba04f/rpds_py-0.27.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a75f305c9b013289121ec0f1181931975df78738cdf650093e6b86d74aa7d8dd", size = 562341, upload-time = "2025-08-27T12:13:44.472Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/92/3c0cb2492094e3cd9baf9e49bbb7befeceb584ea0c1a8b5939dca4da12e5/rpds_py-0.27.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:67ce7620704745881a3d4b0ada80ab4d99df390838839921f99e63c474f82cf2", size = 592511, upload-time = "2025-08-27T12:13:45.898Z" },
+    { url = "https://files.pythonhosted.org/packages/10/bb/82e64fbb0047c46a168faa28d0d45a7851cd0582f850b966811d30f67ad8/rpds_py-0.27.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9d992ac10eb86d9b6f369647b6a3f412fc0075cfd5d799530e84d335e440a002", size = 557736, upload-time = "2025-08-27T12:13:47.408Z" },
+    { url = "https://files.pythonhosted.org/packages/00/95/3c863973d409210da7fb41958172c6b7dbe7fc34e04d3cc1f10bb85e979f/rpds_py-0.27.1-cp313-cp313-win32.whl", hash = "sha256:4f75e4bd8ab8db624e02c8e2fc4063021b58becdbe6df793a8111d9343aec1e3", size = 221462, upload-time = "2025-08-27T12:13:48.742Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/2c/5867b14a81dc217b56d95a9f2a40fdbc56a1ab0181b80132beeecbd4b2d6/rpds_py-0.27.1-cp313-cp313-win_amd64.whl", hash = "sha256:f9025faafc62ed0b75a53e541895ca272815bec18abe2249ff6501c8f2e12b83", size = 232034, upload-time = "2025-08-27T12:13:50.11Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/78/3958f3f018c01923823f1e47f1cc338e398814b92d83cd278364446fac66/rpds_py-0.27.1-cp313-cp313-win_arm64.whl", hash = "sha256:ed10dc32829e7d222b7d3b93136d25a406ba9788f6a7ebf6809092da1f4d279d", size = 222392, upload-time = "2025-08-27T12:13:52.587Z" },
+    { url = "https://files.pythonhosted.org/packages/01/76/1cdf1f91aed5c3a7bf2eba1f1c4e4d6f57832d73003919a20118870ea659/rpds_py-0.27.1-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:92022bbbad0d4426e616815b16bc4127f83c9a74940e1ccf3cfe0b387aba0228", size = 358355, upload-time = "2025-08-27T12:13:54.012Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/6f/bf142541229374287604caf3bb2a4ae17f0a580798fd72d3b009b532db4e/rpds_py-0.27.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:47162fdab9407ec3f160805ac3e154df042e577dd53341745fc7fb3f625e6d92", size = 342138, upload-time = "2025-08-27T12:13:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/77/355b1c041d6be40886c44ff5e798b4e2769e497b790f0f7fd1e78d17e9a8/rpds_py-0.27.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fb89bec23fddc489e5d78b550a7b773557c9ab58b7946154a10a6f7a214a48b2", size = 380247, upload-time = "2025-08-27T12:13:57.683Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a4/d9cef5c3946ea271ce2243c51481971cd6e34f21925af2783dd17b26e815/rpds_py-0.27.1-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e48af21883ded2b3e9eb48cb7880ad8598b31ab752ff3be6457001d78f416723", size = 390699, upload-time = "2025-08-27T12:13:59.137Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/06/005106a7b8c6c1a7e91b73169e49870f4af5256119d34a361ae5240a0c1d/rpds_py-0.27.1-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6f5b7bd8e219ed50299e58551a410b64daafb5017d54bbe822e003856f06a802", size = 521852, upload-time = "2025-08-27T12:14:00.583Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/3e/50fb1dac0948e17a02eb05c24510a8fe12d5ce8561c6b7b7d1339ab7ab9c/rpds_py-0.27.1-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:08f1e20bccf73b08d12d804d6e1c22ca5530e71659e6673bce31a6bb71c1e73f", size = 402582, upload-time = "2025-08-27T12:14:02.034Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/b0/f4e224090dc5b0ec15f31a02d746ab24101dd430847c4d99123798661bfc/rpds_py-0.27.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0dc5dceeaefcc96dc192e3a80bbe1d6c410c469e97bdd47494a7d930987f18b2", size = 384126, upload-time = "2025-08-27T12:14:03.437Z" },
+    { url = "https://files.pythonhosted.org/packages/54/77/ac339d5f82b6afff1df8f0fe0d2145cc827992cb5f8eeb90fc9f31ef7a63/rpds_py-0.27.1-cp313-cp313t-manylinux_2_31_riscv64.whl", hash = "sha256:d76f9cc8665acdc0c9177043746775aa7babbf479b5520b78ae4002d889f5c21", size = 399486, upload-time = "2025-08-27T12:14:05.443Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/29/3e1c255eee6ac358c056a57d6d6869baa00a62fa32eea5ee0632039c50a3/rpds_py-0.27.1-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:134fae0e36022edad8290a6661edf40c023562964efea0cc0ec7f5d392d2aaef", size = 414832, upload-time = "2025-08-27T12:14:06.902Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/db/6d498b844342deb3fa1d030598db93937a9964fcf5cb4da4feb5f17be34b/rpds_py-0.27.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:eb11a4f1b2b63337cfd3b4d110af778a59aae51c81d195768e353d8b52f88081", size = 557249, upload-time = "2025-08-27T12:14:08.37Z" },
+    { url = "https://files.pythonhosted.org/packages/60/f3/690dd38e2310b6f68858a331399b4d6dbb9132c3e8ef8b4333b96caf403d/rpds_py-0.27.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:13e608ac9f50a0ed4faec0e90ece76ae33b34c0e8656e3dceb9a7db994c692cd", size = 587356, upload-time = "2025-08-27T12:14:10.034Z" },
+    { url = "https://files.pythonhosted.org/packages/86/e3/84507781cccd0145f35b1dc32c72675200c5ce8d5b30f813e49424ef68fc/rpds_py-0.27.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dd2135527aa40f061350c3f8f89da2644de26cd73e4de458e79606384f4f68e7", size = 555300, upload-time = "2025-08-27T12:14:11.783Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/ee/375469849e6b429b3516206b4580a79e9ef3eb12920ddbd4492b56eaacbe/rpds_py-0.27.1-cp313-cp313t-win32.whl", hash = "sha256:3020724ade63fe320a972e2ffd93b5623227e684315adce194941167fee02688", size = 216714, upload-time = "2025-08-27T12:14:13.629Z" },
+    { url = "https://files.pythonhosted.org/packages/21/87/3fc94e47c9bd0742660e84706c311a860dcae4374cf4a03c477e23ce605a/rpds_py-0.27.1-cp313-cp313t-win_amd64.whl", hash = "sha256:8ee50c3e41739886606388ba3ab3ee2aae9f35fb23f833091833255a31740797", size = 228943, upload-time = "2025-08-27T12:14:14.937Z" },
+    { url = "https://files.pythonhosted.org/packages/70/36/b6e6066520a07cf029d385de869729a895917b411e777ab1cde878100a1d/rpds_py-0.27.1-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:acb9aafccaae278f449d9c713b64a9e68662e7799dbd5859e2c6b3c67b56d334", size = 362472, upload-time = "2025-08-27T12:14:16.333Z" },
+    { url = "https://files.pythonhosted.org/packages/af/07/b4646032e0dcec0df9c73a3bd52f63bc6c5f9cda992f06bd0e73fe3fbebd/rpds_py-0.27.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:b7fb801aa7f845ddf601c49630deeeccde7ce10065561d92729bfe81bd21fb33", size = 345676, upload-time = "2025-08-27T12:14:17.764Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/16/2f1003ee5d0af4bcb13c0cf894957984c32a6751ed7206db2aee7379a55e/rpds_py-0.27.1-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fe0dd05afb46597b9a2e11c351e5e4283c741237e7f617ffb3252780cca9336a", size = 385313, upload-time = "2025-08-27T12:14:19.829Z" },
+    { url = "https://files.pythonhosted.org/packages/05/cd/7eb6dd7b232e7f2654d03fa07f1414d7dfc980e82ba71e40a7c46fd95484/rpds_py-0.27.1-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b6dfb0e058adb12d8b1d1b25f686e94ffa65d9995a5157afe99743bf7369d62b", size = 399080, upload-time = "2025-08-27T12:14:21.531Z" },
+    { url = "https://files.pythonhosted.org/packages/20/51/5829afd5000ec1cb60f304711f02572d619040aa3ec033d8226817d1e571/rpds_py-0.27.1-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ed090ccd235f6fa8bb5861684567f0a83e04f52dfc2e5c05f2e4b1309fcf85e7", size = 523868, upload-time = "2025-08-27T12:14:23.485Z" },
+    { url = "https://files.pythonhosted.org/packages/05/2c/30eebca20d5db95720ab4d2faec1b5e4c1025c473f703738c371241476a2/rpds_py-0.27.1-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:bf876e79763eecf3e7356f157540d6a093cef395b65514f17a356f62af6cc136", size = 408750, upload-time = "2025-08-27T12:14:24.924Z" },
+    { url = "https://files.pythonhosted.org/packages/90/1a/cdb5083f043597c4d4276eae4e4c70c55ab5accec078da8611f24575a367/rpds_py-0.27.1-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:12ed005216a51b1d6e2b02a7bd31885fe317e45897de81d86dcce7d74618ffff", size = 387688, upload-time = "2025-08-27T12:14:27.537Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/92/cf786a15320e173f945d205ab31585cc43969743bb1a48b6888f7a2b0a2d/rpds_py-0.27.1-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:ee4308f409a40e50593c7e3bb8cbe0b4d4c66d1674a316324f0c2f5383b486f9", size = 407225, upload-time = "2025-08-27T12:14:28.981Z" },
+    { url = "https://files.pythonhosted.org/packages/33/5c/85ee16df5b65063ef26017bef33096557a4c83fbe56218ac7cd8c235f16d/rpds_py-0.27.1-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0b08d152555acf1f455154d498ca855618c1378ec810646fcd7c76416ac6dc60", size = 423361, upload-time = "2025-08-27T12:14:30.469Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/8e/1c2741307fcabd1a334ecf008e92c4f47bb6f848712cf15c923becfe82bb/rpds_py-0.27.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:dce51c828941973a5684d458214d3a36fcd28da3e1875d659388f4f9f12cc33e", size = 562493, upload-time = "2025-08-27T12:14:31.987Z" },
+    { url = "https://files.pythonhosted.org/packages/04/03/5159321baae9b2222442a70c1f988cbbd66b9be0675dd3936461269be360/rpds_py-0.27.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:c1476d6f29eb81aa4151c9a31219b03f1f798dc43d8af1250a870735516a1212", size = 592623, upload-time = "2025-08-27T12:14:33.543Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/39/c09fd1ad28b85bc1d4554a8710233c9f4cefd03d7717a1b8fbfd171d1167/rpds_py-0.27.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3ce0cac322b0d69b63c9cdb895ee1b65805ec9ffad37639f291dd79467bee675", size = 558800, upload-time = "2025-08-27T12:14:35.436Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/d6/99228e6bbcf4baa764b18258f519a9035131d91b538d4e0e294313462a98/rpds_py-0.27.1-cp314-cp314-win32.whl", hash = "sha256:dfbfac137d2a3d0725758cd141f878bf4329ba25e34979797c89474a89a8a3a3", size = 221943, upload-time = "2025-08-27T12:14:36.898Z" },
+    { url = "https://files.pythonhosted.org/packages/be/07/c802bc6b8e95be83b79bdf23d1aa61d68324cb1006e245d6c58e959e314d/rpds_py-0.27.1-cp314-cp314-win_amd64.whl", hash = "sha256:a6e57b0abfe7cc513450fcf529eb486b6e4d3f8aee83e92eb5f1ef848218d456", size = 233739, upload-time = "2025-08-27T12:14:38.386Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/89/3e1b1c16d4c2d547c5717377a8df99aee8099ff050f87c45cb4d5fa70891/rpds_py-0.27.1-cp314-cp314-win_arm64.whl", hash = "sha256:faf8d146f3d476abfee026c4ae3bdd9ca14236ae4e4c310cbd1cf75ba33d24a3", size = 223120, upload-time = "2025-08-27T12:14:39.82Z" },
+    { url = "https://files.pythonhosted.org/packages/62/7e/dc7931dc2fa4a6e46b2a4fa744a9fe5c548efd70e0ba74f40b39fa4a8c10/rpds_py-0.27.1-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:ba81d2b56b6d4911ce735aad0a1d4495e808b8ee4dc58715998741a26874e7c2", size = 358944, upload-time = "2025-08-27T12:14:41.199Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/22/4af76ac4e9f336bfb1a5f240d18a33c6b2fcaadb7472ac7680576512b49a/rpds_py-0.27.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:84f7d509870098de0e864cad0102711c1e24e9b1a50ee713b65928adb22269e4", size = 342283, upload-time = "2025-08-27T12:14:42.699Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/15/2a7c619b3c2272ea9feb9ade67a45c40b3eeb500d503ad4c28c395dc51b4/rpds_py-0.27.1-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a9e960fc78fecd1100539f14132425e1d5fe44ecb9239f8f27f079962021523e", size = 380320, upload-time = "2025-08-27T12:14:44.157Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/7d/4c6d243ba4a3057e994bb5bedd01b5c963c12fe38dde707a52acdb3849e7/rpds_py-0.27.1-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:62f85b665cedab1a503747617393573995dac4600ff51869d69ad2f39eb5e817", size = 391760, upload-time = "2025-08-27T12:14:45.845Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/71/b19401a909b83bcd67f90221330bc1ef11bc486fe4e04c24388d28a618ae/rpds_py-0.27.1-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fed467af29776f6556250c9ed85ea5a4dd121ab56a5f8b206e3e7a4c551e48ec", size = 522476, upload-time = "2025-08-27T12:14:47.364Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/44/1a3b9715c0455d2e2f0f6df5ee6d6f5afdc423d0773a8a682ed2b43c566c/rpds_py-0.27.1-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f2729615f9d430af0ae6b36cf042cb55c0936408d543fb691e1a9e36648fd35a", size = 403418, upload-time = "2025-08-27T12:14:49.991Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/4b/fb6c4f14984eb56673bc868a66536f53417ddb13ed44b391998100a06a96/rpds_py-0.27.1-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1b207d881a9aef7ba753d69c123a35d96ca7cb808056998f6b9e8747321f03b8", size = 384771, upload-time = "2025-08-27T12:14:52.159Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/56/d5265d2d28b7420d7b4d4d85cad8ef891760f5135102e60d5c970b976e41/rpds_py-0.27.1-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:639fd5efec029f99b79ae47e5d7e00ad8a773da899b6309f6786ecaf22948c48", size = 400022, upload-time = "2025-08-27T12:14:53.859Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/e9/9f5fc70164a569bdd6ed9046486c3568d6926e3a49bdefeeccfb18655875/rpds_py-0.27.1-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:fecc80cb2a90e28af8a9b366edacf33d7a91cbfe4c2c4544ea1246e949cfebeb", size = 416787, upload-time = "2025-08-27T12:14:55.673Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/64/56dd03430ba491db943a81dcdef115a985aac5f44f565cd39a00c766d45c/rpds_py-0.27.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:42a89282d711711d0a62d6f57d81aa43a1368686c45bc1c46b7f079d55692734", size = 557538, upload-time = "2025-08-27T12:14:57.245Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/36/92cc885a3129993b1d963a2a42ecf64e6a8e129d2c7cc980dbeba84e55fb/rpds_py-0.27.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:cf9931f14223de59551ab9d38ed18d92f14f055a5f78c1d8ad6493f735021bbb", size = 588512, upload-time = "2025-08-27T12:14:58.728Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/10/6b283707780a81919f71625351182b4f98932ac89a09023cb61865136244/rpds_py-0.27.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f39f58a27cc6e59f432b568ed8429c7e1641324fbe38131de852cd77b2d534b0", size = 555813, upload-time = "2025-08-27T12:15:00.334Z" },
+    { url = "https://files.pythonhosted.org/packages/04/2e/30b5ea18c01379da6272a92825dd7e53dc9d15c88a19e97932d35d430ef7/rpds_py-0.27.1-cp314-cp314t-win32.whl", hash = "sha256:d5fa0ee122dc09e23607a28e6d7b150da16c662e66409bbe85230e4c85bb528a", size = 217385, upload-time = "2025-08-27T12:15:01.937Z" },
+    { url = "https://files.pythonhosted.org/packages/32/7d/97119da51cb1dd3f2f3c0805f155a3aa4a95fa44fe7d78ae15e69edf4f34/rpds_py-0.27.1-cp314-cp314t-win_amd64.whl", hash = "sha256:6567d2bb951e21232c2f660c24cf3470bb96de56cdcb3f071a83feeaff8a2772", size = 230097, upload-time = "2025-08-27T12:15:03.961Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
+[[package]]
+name = "sniffio"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
+]
+
+[[package]]
+name = "sse-starlette"
+version = "3.0.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/42/6f/22ed6e33f8a9e76ca0a412405f31abb844b779d52c5f96660766edcd737c/sse_starlette-3.0.2.tar.gz", hash = "sha256:ccd60b5765ebb3584d0de2d7a6e4f745672581de4f5005ab31c3a25d10b52b3a", size = 20985, upload-time = "2025-07-27T09:07:44.565Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ef/10/c78f463b4ef22eef8491f218f692be838282cd65480f6e423d7730dfd1fb/sse_starlette-3.0.2-py3-none-any.whl", hash = "sha256:16b7cbfddbcd4eaca11f7b586f3b8a080f1afe952c15813455b162edea619e5a", size = 11297, upload-time = "2025-07-27T09:07:43.268Z" },
+]
+
+[[package]]
+name = "starlette"
+version = "0.48.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a7/a5/d6f429d43394057b67a6b5bbe6eae2f77a6bf7459d961fdb224bf206eee6/starlette-0.48.0.tar.gz", hash = "sha256:7e8cee469a8ab2352911528110ce9088fdc6a37d9876926e73da7ce4aa4c7a46", size = 2652949, upload-time = "2025-09-13T08:41:05.699Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/be/72/2db2f49247d0a18b4f1bb9a5a39a0162869acf235f3a96418363947b3d46/starlette-0.48.0-py3-none-any.whl", hash = "sha256:0764ca97b097582558ecb498132ed0c7d942f233f365b86ba37770e026510659", size = 73736, upload-time = "2025-09-13T08:41:03.869Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+]
+
+[[package]]
+name = "typing-inspection"
+version = "0.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/55/e3/70399cb7dd41c10ac53367ae42139cf4b1ca5f36bb3dc6c9d33acdb43655/typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464", size = 75949, upload-time = "2025-10-01T02:14:41.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/9b/47798a6c91d8bdb567fe2698fe81e0c6b7cb7ef4d13da4114b41d239f65d/typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7", size = 14611, upload-time = "2025-10-01T02:14:40.154Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.5.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185, upload-time = "2025-06-18T14:07:41.644Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795, upload-time = "2025-06-18T14:07:40.39Z" },
+]
+
+[[package]]
+name = "uvicorn"
+version = "0.37.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "h11" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/71/57/1616c8274c3442d802621abf5deb230771c7a0fec9414cb6763900eb3868/uvicorn-0.37.0.tar.gz", hash = "sha256:4115c8add6d3fd536c8ee77f0e14a7fd2ebba939fed9b02583a97f80648f9e13", size = 80367, upload-time = "2025-09-23T13:33:47.486Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/85/cd/584a2ceb5532af99dd09e50919e3615ba99aa127e9850eafe5f31ddfdb9a/uvicorn-0.37.0-py3-none-any.whl", hash = "sha256:913b2b88672343739927ce381ff9e2ad62541f9f8289664fa1d1d3803fa2ce6c", size = 67976, upload-time = "2025-09-23T13:33:45.842Z" },
+]
+
+[[package]]
+name = "verify-teleport-jwt-fastmcp"
+version = "0.1.0"
+source = { virtual = "." }
+dependencies = [
+    { name = "fastmcp" },
+]
+
+[package.metadata]
+requires-dist = [{ name = "fastmcp", specifier = ">=2.12.4" }]
+
+[[package]]
+name = "werkzeug"
+version = "3.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markupsafe" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/32/af/d4502dc713b4ccea7175d764718d5183caf8d0867a4f0190d5d4a45cea49/werkzeug-3.1.1.tar.gz", hash = "sha256:8cd39dfbdfc1e051965f156163e2974e52c210f130810e9ad36858f0fd3edad4", size = 806453, upload-time = "2024-11-01T16:40:45.462Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ee/ea/c67e1dee1ba208ed22c06d1d547ae5e293374bfc43e0eb0ef5e262b68561/werkzeug-3.1.1-py3-none-any.whl", hash = "sha256:a71124d1ef06008baafa3d266c02f56e1836a5984afd6dd6c9230669d60d9fb5", size = 224371, upload-time = "2024-11-01T16:40:43.994Z" },
+]
diff --git a/examples/mcp-servers/verify-teleport-jwt-mcp-go/README.md b/examples/mcp-servers/verify-teleport-jwt-mcp-go/README.md
new file mode 100644
index 0000000000000..790df5d096b2a
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-mcp-go/README.md
@@ -0,0 +1,43 @@
+# verify-teleport-jwt-mcp-go
+
+Teleport sends a JWT token signed with Teleport's authority with each request
+to a target MCP server over the streamable HTTP or SSE transport.
+
+This example demonstrates an MCP server built with `mcp-go` that verifies the
+JWT issued by Teleport and extracts the Teleport's identity information.
+
+To start the server:
+```bash
+# export TELEPORT_PROXY_URL=https://teleport.example.com
+$ go run .
+☕ Teleport cluster: teleport.example.com
+☕ JWT algo: ES256
+🚀 Teleport MCP app example:
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "verify-teleport-jwt"
+    uri: "mcp+http://127.0.0.1:8000/mcp"
+    labels:
+      env: dev
+    rewrite:
+      headers:
+	  - "Authorization: Bearer {{internal.jwt}}"
+
+🏁 Starting MCP server 'Verify Teleport JWT' with transport 'http' on http://127.0.0.1:8000/mcp
+```
+
+Sample response from calling the `teleport_user_info_from_jwt` tool via
+Teleport:
+```json
+{
+  "authenticated": true,
+  "teleport_user_name": "admin",
+  "teleport_roles": ["access", "editor"]
+}
+```
+
+References:
+- [Enroll MCP servers](https://goteleport.com/docs/enroll-resources/mcp-access/)
+- [Use JWT Tokens With MCP Access](https://goteleport.com/docs/enroll-resources/application-access/jwt/introduction/)
+- [Configure MCP clients](https://goteleport.com/docs/connect-your-client/model-context-protocol/mcp-access/)
diff --git a/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.mod b/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.mod
new file mode 100644
index 0000000000000..aadd3d66c8a67
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.mod
@@ -0,0 +1,23 @@
+module verify-teleport-jwt-mcp-go
+
+go 1.25.5
+
+require (
+	github.com/auth0/go-jwt-middleware/v2 v2.3.0
+	github.com/mark3labs/mcp-go v0.41.1
+	gopkg.in/go-jose/go-jose.v2 v2.6.3
+)
+
+require (
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.sum b/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.sum
new file mode 100644
index 0000000000000..1b37390799c7b
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-mcp-go/go.sum
@@ -0,0 +1,45 @@
+github.com/auth0/go-jwt-middleware/v2 v2.3.0 h1:4QREj6cS3d8dS05bEm443jhnqQF97FX9sMBeWqnNRzE=
+github.com/auth0/go-jwt-middleware/v2 v2.3.0/go.mod h1:dL4ObBs1/dj4/W4cYxd8rqAdDGXYyd5rqbpMIxcbVrU=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mark3labs/mcp-go v0.41.1 h1:w78eWfiQam2i8ICL7AL0WFiq7KHNJQ6UB53ZVtH4KGA=
+github.com/mark3labs/mcp-go v0.41.1/go.mod h1:T7tUa2jO6MavG+3P25Oy/jR7iCeJPHImCZHRymCn39g=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
+gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/examples/mcp-servers/verify-teleport-jwt-mcp-go/main.go b/examples/mcp-servers/verify-teleport-jwt-mcp-go/main.go
new file mode 100644
index 0000000000000..9b11a246db8e7
--- /dev/null
+++ b/examples/mcp-servers/verify-teleport-jwt-mcp-go/main.go
@@ -0,0 +1,193 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+
+	jwtmiddleware "github.com/auth0/go-jwt-middleware/v2"
+	"github.com/auth0/go-jwt-middleware/v2/validator"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"gopkg.in/go-jose/go-jose.v2"
+)
+
+type teleportCustomClaims struct {
+	UserName string   `json:"username"`
+	Roles    []string `json:"roles"`
+}
+
+func (c *teleportCustomClaims) Validate(context.Context) error {
+	if c.UserName == "" {
+		return fmt.Errorf("missing username")
+	}
+	return nil
+}
+
+func main() {
+	teleportProxyURL := cmp.Or(os.Getenv("TELEPORT_PROXY_URL"), "https://teleport.example.com")
+
+	// Optional configs.
+	host := cmp.Or(os.Getenv("MCP_HOST"), "127.0.0.1")
+	port := cmp.Or(os.Getenv("MCP_PORT"), "8000")
+	mcpAppURI := cmp.Or(os.Getenv("TELEPORT_MCP_APP_URI"), fmt.Sprintf("mcp+http://%s:%s/mcp", host, port))
+
+	jwtValidator, err := makeJWTValidator(teleportProxyURL, mcpAppURI)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf(`🚀 Teleport app service example:
+app_service:
+  enabled: "yes"
+  apps:
+  - name: "verify-teleport-jwt"
+    uri: "%s"
+    labels:
+      env: dev
+    rewrite:
+      headers:
+	  - "Authorization: Bearer {{internal.jwt}}"
+
+`, mcpAppURI)
+	fmt.Printf("🏁 Starting MCP server 'Verify Teleport JWT' with transport 'http' on http://%s:%s/mcp\n", host, port)
+
+	mcpServerHandler := mcpserver.NewStreamableHTTPServer(makeMCPServer())
+	httpServer := &http.Server{
+		Addr:    fmt.Sprintf("%s:%s", host, port),
+		Handler: jwtmiddleware.New(jwtValidator.ValidateToken).CheckJWT(mcpServerHandler),
+	}
+	if err := httpServer.ListenAndServe(); err != nil {
+		log.Fatalf("failed to start the HTTP server: %v", err)
+	}
+}
+
+func makeMCPServer() *mcpserver.MCPServer {
+	server := mcpserver.NewMCPServer("Verify Teleport JWT", "1.0.0")
+	server.AddTool(
+		mcp.NewTool(
+			"teleport_user_info_from_jwt",
+			mcp.WithDescription("Read Teleport user info from verified JWT"),
+		),
+		func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+			// Find jwt claim.
+			claims, ok := ctx.Value(jwtmiddleware.ContextKey{}).(*validator.ValidatedClaims)
+			if !ok {
+				return &mcp.CallToolResult{
+					Content: []mcp.Content{mcp.NewTextContent(`{"authenticated":false}`)},
+				}, nil
+			}
+			teleportClaims, ok := claims.CustomClaims.(*teleportCustomClaims)
+			if !ok {
+				return &mcp.CallToolResult{
+					Content: []mcp.Content{mcp.NewTextContent(`{"authenticated":false}`)},
+				}, nil
+			}
+
+			// Prepare result.
+			result := struct {
+				Authenticated    bool     `json:"authenticated"`
+				TeleportUsername string   `json:"teleport_username"`
+				TeleportRoles    []string `json:"teleport_roles"`
+			}{
+				TeleportUsername: teleportClaims.UserName,
+				TeleportRoles:    teleportClaims.Roles,
+				Authenticated:    true,
+			}
+			teleportClaimsInJSON, err := json.Marshal(result)
+			if err != nil {
+				return nil, err
+			}
+			return &mcp.CallToolResult{
+				Content: []mcp.Content{mcp.NewTextContent(string(teleportClaimsInJSON))},
+			}, nil
+		},
+	)
+	return server
+}
+
+func makeJWTValidator(teleportProxyURL, mcpAppURI string) (*validator.Validator, error) {
+	teleportClusterName, err := getTeleportClusterName(teleportProxyURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Teleport cluster name: %v", err)
+	}
+	fmt.Println("☕ Teleport cluster:", teleportClusterName)
+
+	keySet, err := getJWKS(teleportProxyURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get JWKS: %v", err)
+	}
+	fmt.Println("☕ JWT algo:", getJWTAlgorithm(keySet))
+
+	jwtValidator, err := validator.New(
+		func(context.Context) (interface{}, error) {
+			return keySet, nil
+		},
+		getJWTAlgorithm(keySet),
+		teleportClusterName, // Issuer is Teleport cluster name.
+		[]string{mcpAppURI}, // Audience is MCP app URI.
+		validator.WithCustomClaims(func() validator.CustomClaims {
+			return &teleportCustomClaims{}
+		}),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to set up the validator: %v", err)
+	}
+	return jwtValidator, nil
+}
+
+func getJSONFromURL(url string, target any) error {
+	resp, err := http.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("expected 200 OK, got %s", resp.Status)
+	}
+	return json.NewDecoder(resp.Body).Decode(target)
+}
+
+func getTeleportClusterName(teleportProxyURL string) (string, error) {
+	var find struct {
+		ClusterName string `json:"cluster_name"`
+	}
+	err := getJSONFromURL(teleportProxyURL+"/webapi/find", &find)
+	return find.ClusterName, err
+}
+
+func getJWTAlgorithm(keySet *jose.JSONWebKeySet) validator.SignatureAlgorithm {
+	for _, key := range keySet.Keys {
+		return validator.SignatureAlgorithm(key.Algorithm)
+	}
+	return validator.ES256
+}
+
+func getJWKS(teleportProxyURL string) (*jose.JSONWebKeySet, error) {
+	var jwks jose.JSONWebKeySet
+	if err := getJSONFromURL(teleportProxyURL+"/.well-known/jwks.json", &jwks); err != nil {
+		return nil, fmt.Errorf("failed to get JWKS: %v", err)
+	}
+	if len(jwks.Keys) == 0 {
+		return nil, fmt.Errorf("no keys found")
+	}
+	return &jwks, nil
+}
diff --git a/examples/resources/plugins/teleport-discord-helm.yaml b/examples/resources/plugins/teleport-discord-helm.yaml
index 147abf65d8559..bbb7c7b195b79 100644
--- a/examples/resources/plugins/teleport-discord-helm.yaml
+++ b/examples/resources/plugins/teleport-discord-helm.yaml
@@ -1,16 +1,16 @@
 teleport:
   # Teleport HTTPS Proxy web address, for Teleport Enterprise Cloud should be in the form "your-account.teleport.sh:443"
-  address: "teleport.example.com:443"
-  # Secret containing identity
-  identitySecretName: teleport-plugin-discord-identity
-  # Path within the secret containing the identity file.
-  identitySecretPath: identity
+  address: ""
+  # Secret containing identity, e.g., teleport-plugin-discord-identity
+  identitySecretName: "" 
+  # Path within the secret containing the identity file, e.g., identity
+  identitySecretPath: ""
 
 discord:
   token: "XXXXXXXX"  # Discord Bot OAuth token
 
 # Mapping from role to recipients
-roleToRecipients: []
+roleToRecipients: {}
 #  "*":
 #    - "1234567890"  # security-team
 #  "dev":
diff --git a/examples/resources/plugins/teleport-email-helm.yaml b/examples/resources/plugins/teleport-email-helm.yaml
index 413bf3bf64f86..c7fdb66790310 100644
--- a/examples/resources/plugins/teleport-email-helm.yaml
+++ b/examples/resources/plugins/teleport-email-helm.yaml
@@ -1,14 +1,14 @@
 teleport:
-  address: teleport.example.com:443
-  identitySecretName: teleport-plugin-email-identity
-  identitySecretPath: identity
+  address: ""              # e.g., example.teleport.sh:443 
+  identitySecretName: ""   # e.g., teleport-plugin-email-identity
+  identitySecretPath: ""   # e.g., identity
 
 mailgun:
   enabled: false
   domain: ""
   privateKey: ""
   privateKeyFromSecret: ""
-  privateKeySecretPath: "mailgunPrivateKey"
+  privateKeySecretPath: "" # e.g., mailgunPrivateKey
 
 smtp:
   enabled: false
@@ -17,8 +17,8 @@ smtp:
   username: ""
   password: ""
   passwordFromSecret: ""
-  passwordSecretPath: "smtpPassword"
-  starttlsPolicy: "mandatory"
+  passwordSecretPath: ""   # e.g., smtpPassword
+  starttlsPolicy: ""       # e.g., mandatory
 
 delivery:
   sender: ""
@@ -26,4 +26,4 @@ delivery:
 
 roleToRecipients: {}
 
-secretVolumeName: "password-file"
+secretVolumeName: ""       # e.g., password-file
diff --git a/examples/resources/plugins/teleport-jira-cloud.toml b/examples/resources/plugins/teleport-jira-cloud.toml
index ad99bacbdd7d6..212e10d528cb3 100644
--- a/examples/resources/plugins/teleport-jira-cloud.toml
+++ b/examples/resources/plugins/teleport-jira-cloud.toml
@@ -1,25 +1,34 @@
 # Example Jira plugin configuration TOML file
 [teleport]
 # Proxy Service domain and HTTPS port
-auth_server = "myinstance.teleport.sh:443"
+# e.g., example.teleport.sh:443
+auth_server = "" 
 # Teleport identity file location
-identity = "/var/lib/teleport/plugins/jira/identity"
+identity = ""
 # Refresh identity file on a periodic basis.
 refresh_identity = true
 
 [jira]
-url = "https://[my-jira].atlassian.net"    # JIRA URL
-username = "bot@example.com"               # JIRA username
-api_token = "token"                        # JIRA API token
-project = "TAR"                            # JIRA Project key
+# JIRA URL
+url = ""        
+# JIRA username
+username = ""   
+# JIRA API token
+api_token = ""  
+# JIRA Project key
+project = ""    
 
 [http]
 # URL on which webhook server is accessible externally, for example,
 # [https://]teleport-jira.example.com
-public_addr = "example.com" 
-https_key_file = "/var/lib/teleport/plugins/jira/server.key"  # TLS private key
-https_cert_file = "/var/lib/teleport/plugins/jira/server.crt" # TLS certificate
+public_addr = "" 
+# TLS private key
+https_key_file = ""  
+# TLS certificate
+https_cert_file = "" 
 
 [log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/jira.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+# Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/jira.log"
+output = "stderr" 
+# Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+severity = "INFO" 
diff --git a/examples/resources/plugins/teleport-jira-helm-cloud.yaml b/examples/resources/plugins/teleport-jira-helm-cloud.yaml
index 2de263080bea0..65ef0b8a9b042 100644
--- a/examples/resources/plugins/teleport-jira-helm-cloud.yaml
+++ b/examples/resources/plugins/teleport-jira-helm-cloud.yaml
@@ -1,22 +1,22 @@
 teleport:
   # Teleport Proxy Service domain name and HTTPS port. If you are using Teleport
   # Enterprise Cloud, this should be in the form "your-account.teleport.sh:443"
-  address: "teleport.example.com:443"
-  # Secret containing a Teleport identity document
-  identityFromSecret: teleport-plugin-jira-identity
+  address: ""
+  # Secret containing a Teleport identity document, e.g., teleport-plugin-jira-identity
+  identityFromSecret: ""
   # Path within the secret containing the identity file.
-  identitySecretPath: identity
+  identitySecretPath: ""
 
 jira:
-  url: "https://[my-jira].atlassian.net"      # URL of the Jira instance
-  username: bot@example.com                   # Email of the bot user
-  apiToken: token                             # Token of the bot user
-  project: TAR                                # Project where issues will be created
+  url: ""       # URL of the Jira instance
+  username: ""  # Email of the bot user
+  apiToken: ""  # Token of the bot user
+  project: ""   # Project where issues will be created
 
 http:
-  publicAddress: https://jira-teleport.example.com/ 
-  # Secret containing the TLS certificate
-  tlsFromSecret: teleport-plugin-jira-tls            
+  publicAddress: "" 
+  # Secret containing the TLS certificate, e.g., teleport-plugin-jira-tls
+  tlsFromSecret: ""
   # tlsKeySecretPath:  tls.key                # Name of the key inside the secret
   # tlsCertSecretPath: tls.crt                # Name of the certificate inside the secret
 
diff --git a/examples/resources/plugins/teleport-mattermost-helm-cloud.yaml b/examples/resources/plugins/teleport-mattermost-helm-cloud.yaml
index 594dcc774f0d3..a53a32d5787a6 100644
--- a/examples/resources/plugins/teleport-mattermost-helm-cloud.yaml
+++ b/examples/resources/plugins/teleport-mattermost-helm-cloud.yaml
@@ -1,17 +1,17 @@
 teleport:
   # Teleport HTTPS Proxy web address, for Teleport Enterprise Cloud should be in the form "your-account.teleport.sh:443"
-  address: "teleport.example.com:443"
+  address: ""            # e.g., teleport.example.com:443
   # Secret containing identity
-  identitySecretName: teleport-plugin-mattermost-identity
+  identitySecretName: "" # e.g., teleport-plugin-mattermost-identity 
   # Path within the secret containing the identity file.
-  identitySecretPath: identity
+  identitySecretPath: "" # e.g., identity
 
 mattermost:
-  url: https://mattermost.example.com/  # URL of the Mattermost instance
-  token: mattermosttoken                # Mattermost token of the bot
+  url: ""          # URL of the Mattermost instance, e.g., https://mattermost.example.com/
+  token: ""        # Mattermost token of the bot
   recipients:
-    - "access-requests@example.com"     # User
-    - "team/example-channel"            # Channel
+    - ""           # User, e.g., access-requests@example.com
+    - ""           # Channel, e.g., team/example-channel
 
 log:
   output: "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/mattermost.log"
diff --git a/examples/resources/plugins/teleport-msteams-helm.yaml b/examples/resources/plugins/teleport-msteams-helm.yaml
index 580d6598c53c1..4f69fe22176ea 100644
--- a/examples/resources/plugins/teleport-msteams-helm.yaml
+++ b/examples/resources/plugins/teleport-msteams-helm.yaml
@@ -6,18 +6,20 @@
 # Plugin specific options
 #
 teleport:
-  address: "teleport.example.com:443"
-  identitySecretName: teleport-plugin-msteams-identity
-  identitySecretPath: identity
+  address: ""            # e.g., teleport.example.com:443
+  identitySecretName: "" # e.g., teleport-plugin-msteams-identity
+  identitySecretPath: "" # e.g., identity
 
 msTeams:
-  appID: "APP_ID"
-  tenantID: "TENANT_ID"
-  teamsAppID: "TEAMS_APP_ID"
+  appID: ""
+  tenantID: ""
+  teamsAppID: ""
 
-roleToRecipients:
-  "*": "TELEPORT_USERNAME"
-  "editor": "TELEPORT_USERNAME"
+roleToRecipients: {}
+  # "*": "admin@example.com"
+  # dev:
+  #  - "https://teams.microsoft.com/l/channel/19%3ae06a7383ed98468f90217a35fa1980d7%40thread.tacv2/Approval%2520Channel%25202?groupId=f2b3c8ed-5502-4449-b76f-dc3acea81f1c&tenantId=ff882432-09b0-437b-bd22-ca13c0037ded"
+  #  - "devops@example.com"
 
 log:
   output: stdout
diff --git a/examples/resources/plugins/teleport-msteams.toml b/examples/resources/plugins/teleport-msteams.toml
index d1de7eb34885a..f84bfa205f0ae 100644
--- a/examples/resources/plugins/teleport-msteams.toml
+++ b/examples/resources/plugins/teleport-msteams.toml
@@ -8,25 +8,29 @@
 preload = true
 
 [teleport]
-# Teleport Auth/Proxy Server address.
-# addr = "example.com:3025"
+# Teleport Auth Service or Proxy Service address.
+# Example: examples/resources/plugins/teleport-msteams.toml
+# addr = ""
 #
-# Should be port 3025 for Auth Server and 3080 or 443 for Proxy.
+# Should be port 3025 for the Auth Service and 3080 or 443 for the Proxy
+# Service.
 # For Teleport Cloud, should be in the form "your-account.teleport.sh:443".
 
 # Credentials generated with `tctl auth sign`.
 #
 # When using --format=file:
-# identity = "/var/lib/teleport/plugins/msteams/identity"   # Identity file
-# refresh_identity = true                                   # Refresh identity file periodically
+# Identity file, e.g., /var/lib/teleport/plugins/msteams/identity
+identity = ""   
+# Refresh identity file periodically
+refresh_identity = true                                   
 #
 # When using --format=tls:
-# client_key = "/var/lib/teleport/plugins/msteams/auth.key" # Teleport TLS secret key
-# client_crt = "/var/lib/teleport/plugins/msteams/auth.crt" # Teleport TLS certificate
-# root_cas = "/var/lib/teleport/plugins/msteams/auth.cas"   # Teleport CA certs
-addr = "localhost:3025"
-identity = "identity"
-refresh_identity = true
+# Teleport TLS secret key, e.g., /var/lib/teleport/plugins/msteams/auth.key
+# client_key = "" 
+# Teleport TLS certificate, e.g., /var/lib/teleport/plugins/msteams/auth.crt
+# client_crt = "" 
+# Teleport CA certs, e.g., /var/lib/teleport/plugins/msteams/auth.cas
+# root_cas = ""   
 
 [msapi]
 # MS API IDs. Please, check the documentation.
@@ -45,8 +49,10 @@ teams_app_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
 #
 # "dev" = "devs-msteams-channel"
 # "*" = ["admin@email.com", "admin-msteams-channel"]
-"*" = ["foo@example.com"]
+"*" = []
 
 [log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/msteams.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+# Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/msteams.log"
+output = "stderr" 
+# Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
+severity = "INFO" 
diff --git a/examples/resources/plugins/teleport-slack-helm.yaml b/examples/resources/plugins/teleport-slack-helm.yaml
index a062fd463a316..a6c1135b6f4c0 100644
--- a/examples/resources/plugins/teleport-slack-helm.yaml
+++ b/examples/resources/plugins/teleport-slack-helm.yaml
@@ -1,15 +1,15 @@
 teleport:
   # Teleport HTTPS Proxy Web Address, for Teleport Enterprise Cloud should be in the form "your-account.teleport.sh:443"
-  address: "teleport.example.com:443"
-  # Secret containing identity
-  identitySecretName: teleport-plugin-slack-identity
+  address: ""
+  # Secret containing identity, e.g., teleport-plugin-slack-identity
+  identitySecretName: ""
   # Path within the secret containing the identity file.
-  identitySecretPath: identity
+  identitySecretPath: ""
 
 slack:
-  token: "xoxb-11xx"  # Slack Bot OAuth token
+  token: ""  # Slack Bot OAuth token
 
 # Mapping from role to recipients
-roleToRecipients: []
+roleToRecipients: {}
   # "dev": "devs-slack-channel"
   # "*": ["admin@email.com", "admin-slack-channel"]
diff --git a/examples/resources/plugins/teleport-slack.toml b/examples/resources/plugins/teleport-slack.toml
index 06b4cb914221f..0fd986e349422 100644
--- a/examples/resources/plugins/teleport-slack.toml
+++ b/examples/resources/plugins/teleport-slack.toml
@@ -23,7 +23,7 @@
 # Slack Bot OAuth token
 # You can also use an absolute path to a token file, e.g., 
 # "/var/lib/teleport/token"
-token = "xoxb-11xx"
+token = ""
 
 [role_to_recipients]
 # Map roles to recipients.
diff --git a/examples/service-discovery-api-client/go.mod b/examples/service-discovery-api-client/go.mod
index 446f4cb3289b9..d9b5406707ab5 100644
--- a/examples/service-discovery-api-client/go.mod
+++ b/examples/service-discovery-api-client/go.mod
@@ -1,69 +1,67 @@
 module register-app-service
 
-go 1.23.0
+go 1.24.11
 
 require (
-	github.com/docker/docker v27.1.1+incompatible
-	github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40
-	github.com/gravitational/trace v1.3.1
-	google.golang.org/grpc v1.63.0
+	github.com/docker/docker v28.3.3+incompatible
+	github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707
+	github.com/gravitational/trace v1.5.1
+	google.golang.org/grpc v1.74.2
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/Microsoft/go-winio v0.6.0 // indirect
-	github.com/beevik/etree v1.2.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/beevik/etree v1.5.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.3.2 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/russellhaering/gosaml2 v0.9.1 // indirect
-	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.25.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.25.0 // indirect
-	go.opentelemetry.io/otel/metric v1.25.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.25.0 // indirect
-	go.opentelemetry.io/otel/trace v1.25.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gotest.tools/v3 v3.4.0 // indirect
 )
diff --git a/examples/service-discovery-api-client/go.sum b/examples/service-discovery-api-client/go.sum
index 2d9b10dcb5915..6b2dc3f6e7e6b 100644
--- a/examples/service-discovery-api-client/go.sum
+++ b/examples/service-discovery-api-client/go.sum
@@ -1,331 +1,187 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute v1.24.0 h1:phWcR2eWzRJaL/kOiJwfFsPs4BaKq1j6vnpZrc1YlVg=
-cloud.google.com/go/compute v1.24.0/go.mod h1:kw1/T+h/+tK2LJK0wiPPx1intgdAM3j/g3hFDlscY40=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
-github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
+github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
-github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
-github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
-github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
-github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40 h1:fehEGHkaAJrxMtBla0boubs9ZamPO+wcSWEUjr7eEmI=
-github.com/gravitational/teleport/api v0.0.0-20240220221413-126de63e7e40/go.mod h1:aBBajLLEwtcb/iKA9JNSq+WyKMiNp93837yQgNnUuJ8=
-github.com/gravitational/trace v1.3.1 h1:jwZEuRtCYpLhUtqHo+JH+lu2qM0LB98UagqHtvdKuLI=
-github.com/gravitational/trace v1.3.1/go.mod h1:E61mn73aro7Zg9gZheZaeUsK6gjUMbCLazY76xuYAVA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707 h1:IKMvcBI53M7H3j9G3ZJCqVzCZ0sQrK83h/lRgHFNESk=
+github.com/gravitational/teleport/api v0.0.0-20250818183108-571669ac0707/go.mod h1:tGFGcp5agfdWDorAqy9sdEVZ5FZbngYMW5s/NWFTc6I=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
-github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
-github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
-github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
-github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v1.25.0 h1:gldB5FfhRl7OJQbUHt/8s0a7cE8fbsPAtdpRaApKy4k=
-go.opentelemetry.io/otel v1.25.0/go.mod h1:Wa2ds5NOXEMkCmUou1WA7ZBfLTHWIsp034OVD7AO+Vg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0 h1:dT33yIHtmsqpixFsSQPwNeY5drM9wTcoL8h0FWF4oGM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0/go.mod h1:h95q0LBGh7hlAC08X2DhSeyIG02YQ0UyioTCVAqRPmc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0 h1:H2JFgRcGiyHg7H7bwcwaQJYrNFqCqrbTQ8K4p1OvDu8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.22.0/go.mod h1:WfCWp1bGoYK8MeULtI15MmQVczfR+bFkk0DF3h06QmQ=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.25.0 h1:Mbi5PKN7u322woPa85d7ebZ+SOvEoPvoiBu+ryHWgfA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.25.0/go.mod h1:e7ciERRhZaOZXVjx5MiL8TK5+Xv7G5Gv5PA2ZDEJdL8=
-go.opentelemetry.io/otel/metric v1.25.0 h1:LUKbS7ArpFL/I2jJHdJcqMGxkRdxpPHE0VU/D4NuEwA=
-go.opentelemetry.io/otel/metric v1.25.0/go.mod h1:rkDLUSd2lC5lq2dFNrX9LGAbINP5B7WBkC78RXCpH5s=
-go.opentelemetry.io/otel/sdk v1.25.0 h1:PDryEJPC8YJZQSyLY5eqLeafHtG+X7FWnf3aXMtxbqo=
-go.opentelemetry.io/otel/sdk v1.25.0/go.mod h1:oFgzCM2zdsxKzz6zwpTZYLLQsFwc+K0daArPdIhuxkw=
-go.opentelemetry.io/otel/trace v1.25.0 h1:tqukZGLwQYRIFtSQM2u2+yfMVTgGVeqRLPUYx1Dq6RM=
-go.opentelemetry.io/otel/trace v1.25.0/go.mod h1:hCCs70XM/ljO+BeQkyFnbK28SBIJ/Emuha+ccrCRT7I=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
-go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.17.0 h1:6m3ZPmLEFdVxKKWnKq4VqZ60gutO35zm+zrAHVmHyDQ=
-golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de h1:F6qOa9AZTYJXOUEr4jDysRDLrm4PHePlge4v4TGAlxY=
-google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:VUhTRKeHn9wwcdrk73nvdC9gF178Tzhmt/qyaFcPLSo=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de h1:jFNzHPIeuzhdRwVhbZdiym9q0ory/xY3sA+v2wPg8I0=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:5iCWqnniDlqZHrd3neWVTOwvh/v6s3232omMecelax8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.63.0 h1:WjKe+dnvABXyPJMD7KDNLxtoGk5tgk+YFWN6cBWjZE8=
-google.golang.org/grpc v1.63.0/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/examples/systemd/before-remove b/examples/systemd/before-remove
index 9bc9c6542999c..b9bf1f10eddbc 100755
--- a/examples/systemd/before-remove
+++ b/examples/systemd/before-remove
@@ -4,9 +4,59 @@
 
 set -eu
 
-if [ $# -ge 1 ] && [ "$1" = "1" ]; then
-  echo "Skipping symlink removal as this is a package upgrade."
-else
+version_le() {
+  if command -v dpkg >/dev/null 2>&1; then
+    dpkg --compare-versions "$1" le "$2"
+  else
+    [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
+  fi
+}
+
+unlink() {
   echo "Removing symlinks from Teleport system paths..."
-  /opt/teleport/system/bin/teleport-update unlink-package || true
-fi
+  /opt/teleport/system/bin/teleport-update unlink-package
+}
+
+case "$1" in
+  1)
+    echo "Skipping symlink removal as this is a package upgrade."
+    ;;
+  remove|0)
+    unlink || true
+    ;;
+  purge)
+    ;;
+  upgrade)
+    target_version="$2"
+    # We need to compare versions by their major version to determine whether
+    # a package unlink is required. Starting with versions 17.3.0, 16.5.0, and 15.5.0,
+    # the package structure changed — all Teleport binaries were moved to the `/opt/teleport`
+    # directory. After installation, symlinks are created in `/usr/local/bin`, and all
+    # symlinks are managed by `teleport-update`.
+    # When downgrading to an older version that does not use `teleport-update`,
+    # these symlinks must be removed by `teleport-update unlink-package` before installation.
+    if [[ -n "$target_version" ]]; then
+      major="${target_version%%.*}"
+      case "$major" in
+        17)
+          version_le "$target_version" "17.2.9" && unlink || true
+          ;;
+        16)
+          version_le "$target_version" "16.4.29" && unlink || true
+          ;;
+        15)
+          version_le "$target_version" "15.4.33" && unlink || true
+          ;;
+        *)
+          echo "Skipping symlink removal for version $target_version."
+          ;;
+      esac
+    fi
+    ;;
+  failed-upgrade)
+    echo "Upgrade failed — skipping symlink removal."
+    ;;
+  *)
+    unlink || true
+    ;;
+esac
\ No newline at end of file
diff --git a/examples/teleport-usage/Dockerfile b/examples/teleport-usage/Dockerfile
index aa9f485221143..b950bfd7a578f 100644
--- a/examples/teleport-usage/Dockerfile
+++ b/examples/teleport-usage/Dockerfile
@@ -1,6 +1,6 @@
 ARG BASE_IMAGE=gcr.io/distroless/static-debian12
 
-FROM golang:1.22-bookworm as builder
+FROM golang:1.24-bookworm AS builder
 
 WORKDIR /go/src/github.com/gravitational/teleport/examples/teleport-usage
 
diff --git a/examples/teleport-usage/go.mod b/examples/teleport-usage/go.mod
index cdf1098b60673..5cbaf83ad9073 100644
--- a/examples/teleport-usage/go.mod
+++ b/examples/teleport-usage/go.mod
@@ -1,31 +1,30 @@
 module usage-script
 
-go 1.22
+go 1.24.11
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.35.0
-	github.com/aws/aws-sdk-go-v2/config v1.29.3
-	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.17.0
-	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.39.7
+	github.com/aws/aws-sdk-go-v2 v1.38.0
+	github.com/aws/aws-sdk-go-v2/config v1.31.0
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.47.0
 	github.com/stretchr/testify v1.8.3
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.56 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.26 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.24.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.11 // indirect
-	github.com/aws/smithy-go v1.22.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.29.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 // indirect
+	github.com/aws/smithy-go v1.22.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/examples/teleport-usage/go.sum b/examples/teleport-usage/go.sum
index 3a30d379e0bf3..a238c0180c870 100644
--- a/examples/teleport-usage/go.sum
+++ b/examples/teleport-usage/go.sum
@@ -1,52 +1,44 @@
-github.com/aws/aws-sdk-go-v2 v1.35.0 h1:jTPxEJyzjSuuz0wB+302hr8Eu9KUI+Zv8zlujMGJpVI=
-github.com/aws/aws-sdk-go-v2 v1.35.0/go.mod h1:JgstGg0JjWU1KpVJjD5H0y0yyAIpSdKEq556EI6yOOM=
-github.com/aws/aws-sdk-go-v2/config v1.29.3 h1:a5Ucjxe6iV+LHEBmYA9w40rT5aGxWybx/4l/O/fvJlE=
-github.com/aws/aws-sdk-go-v2/config v1.29.3/go.mod h1:pt9z1x12zDiDb4iFLrxoeAKLVCU/Gp9DL/5BnwlY77o=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.56 h1:JKMBreKudV+ozx6rZJLvEtiexv48aEdhdC7mXUw9MLs=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.56/go.mod h1:S3xRjIHD8HHFgMTz4L56q/7IldfNtGL9JjH/vP3U6DA=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.17.0 h1:OljitD0YIY2qkKpHChC+CMjKywEsqDLhUlHOI2AseXQ=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.17.0/go.mod h1:bcffXfieyW3VfH02hxx6MBuCU9UOBRguc4iS7mV7V9E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.26 h1:XMBqBEuZLf8yxtH+mU/uUDyQbN4iD/xv9h6he2+lzhw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.26/go.mod h1:d0+wQ/3CYGPuHEfBTPpQdfUX7gjk0/Lxs5Q6KzdEGY8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.30 h1:+7AzSGNhHoY53di13lvztf9Dyd/9ofzoYGBllkWp3a0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.30/go.mod h1:Jxd/FrCny99yURiQiMywgXvBhd7tmgdv6KdlUTNzMSo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.30 h1:Ex06eY6I5rO7IX0HalGfa5nGjpBoOsS1Qm3xfjkuszs=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.30/go.mod h1:AvyEMA9QcX59kFhVizBpIBpEMThUTXssuJe+emBdcGM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 h1:Pg9URiobXy85kgFev3og2CuOZ8JZUBENF+dcgWBaYNk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.39.7 h1:JFLdDS6ZGKoZii7O+9IBsuvCnvW2vSbseNBji8OKEo8=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.39.7/go.mod h1:8blEsG2cwaS8BK1YiWSEWFwmVav7i7EJk5swid5Vhcw=
-github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.24.17 h1:jPqYzzklr/WkOk5imqvgpm4MkGLoXs6daKsoQSQiSrg=
-github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.24.17/go.mod h1:DRtG2Ux6Ba26Q+bt/ef7gHa10ilrfqobnAAnmBIPnuk=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 h1:D4oz8/CzT9bAEYtVhSBmFj2dNOtaHOtMKc2vHBwYizA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2/go.mod h1:Za3IHqTQ+yNcRHxu1OFucBh0ACZT4j4VQFF0BqpZcLY=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.11 h1:f36sb0FYLZui8mzV6o8DxkUyvOdZfkemyCPTGDJdWhE=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.11/go.mod h1:MaBbVwqDmlH9ytOOcERyVQ+Z6nvWkEdRy0k44m3MYkE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.11 h1:5JKQ2J3BBW4ovy6A/5Lwx9SpA6IzgH8jB3bquGZ1NUw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.11/go.mod h1:VShCk7rfCzK/b9U1aSkzLwcOoaDlYna16482QqEavis=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.13 h1:q4pOAKxypbFoUJzOpgo939bF50qb4DgYshiDfcsdN0M=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.13/go.mod h1:G/0PTg7+vQT42ictQGjJhixzTcVZtHFvrN/OeTXrRfQ=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.12 h1:4sGSGshSSfO1vrcXruPick3ioSf8nhhD6nuB2ni37P4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.12/go.mod h1:NHpu/pLOelViA4qxkAFH10VLqh+XeLhZfXDaFyMVgSs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.11 h1:RIXOjp7Dp4siCYJRwBHUcBdVgOWflSJGlq4ZhMI5Ta0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.11/go.mod h1:ZR17k9bPKPR8u0IkyA6xVsjr56doNQ4ZB1fs7abYBfE=
-github.com/aws/smithy-go v1.22.2 h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
-github.com/aws/smithy-go v1.22.2/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/aws/aws-sdk-go-v2 v1.38.0 h1:UCRQ5mlqcFk9HJDIqENSLR3wiG1VTWlyUfLDEvY7RxU=
+github.com/aws/aws-sdk-go-v2 v1.38.0/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3 h1:RrxJ6g7+jG1lY2nhn7GlRiW4vITuYlfwh/PrW5d84S0=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3/go.mod h1:e4y84j44vA9IFksSDDuAtNj9t3W20iJlsbXhbo/JU10=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.3 h1:o9RnO+YZ4X+kt5Z7Nvcishlz0nksIt2PIzDglLMP0vA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.3/go.mod h1:+6aLJzOG1fvMOyzIySYjOFjcguGvVRL68R+uoRencN4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.3 h1:joyyUFhiTQQmVK6ImzNU9TQSNRNeD9kOklqTzyk5v6s=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.3/go.mod h1:+vNIyZQP3b3B1tSLI0lxvrU9cfM7gpdRXMFfm67ZcPc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.47.0 h1:A5zeikrrAgz3YtNzhMat4K8hK/CFzOjFKLVk8pI7Cz8=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.47.0/go.mod h1:tMQ/Edfn5xLcBFSVd3JDreJPias8GqBq0dVbCbMz9vs=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.29.0 h1:SNys2IbAlovw/c/7Q+f0GXlSMnY/vML5Ex9LStTF0Zc=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.29.0/go.mod h1:GoaIvEhueZB2eDyU7wV8m9K6Wez1e3Pt4f0JrAyIr08=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3 h1:xMmJPUT0G1q9+I0mzH4B6oN9fB5PkDoD+jvpVIcom1I=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3/go.mod h1:U0JFMTY/gPxV07XTXXz152nX0Hg1eBenzyslKF2j4j4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
+github.com/aws/smithy-go v1.22.5 h1:P9ATCXPMb2mPjYBgueqJNCA5S9UfktsW0tTxi+a7eqw=
+github.com/aws/smithy-go v1.22.5/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/examples/terraform/entra-id-integration/README.md b/examples/terraform/entra-id-integration/README.md
new file mode 100644
index 0000000000000..c6cc890f01d51
--- /dev/null
+++ b/examples/terraform/entra-id-integration/README.md
@@ -0,0 +1,95 @@
+## Teleport Entra ID integration
+
+This directory contains the Terraform module to configure Entra ID with attributes necessary for the Teleport Entra ID integration. 
+
+Entra ID configuration involves:
+- Creating an enterprise application.
+- Configuring enterprise application as an SAML SSO provider for Teleport.
+- Configuring an authentication method for Teleport, so it can import users and groups from Entra ID.
+  Teleport supports two kinds of authentication methods:
+  - Teleport as an OIDC IdP - Set up Teleport as an OIDC Identity Provider for the enterprise application. 
+    Teleport Proxy Service must be available under public IP for this method to work. 
+    Use this option if you are using Teleport cloud.
+  - System credentials - Grant API permissions to the managed identity that is assigned to the Teleport Auth Service. 
+    Use this option if you have a self-hosted Teleport cluster.
+
+  In both the cases, you will need to configure three API permissions: `Application.ReadWrite.OwnedBy, Group.Read.All, User.Read.All`.
+
+This example is best followed with the official [Teleport Entra ID integration](https://goteleport.com/docs/identity-governance/entra-id/terraform) guide. 
+
+### Set up Azure CLI
+
+This example expects an authenticated Azure CLI session available in your environment.
+You will also need tenant-level access and an appropriate subscription to run this example.
+E.g., To authenticate with Azure using a user login credential:
+```
+$ az login --allow-no-subscriptions
+```
+
+#### Example configuration to setup SAML SSO and Teleport as an OIDC IdP.
+> [!WARNING]
+> 
+> The `certificate_expiry_date` field is used to configure expiry date for the certificate 
+> which will be used to sign SAML assertion. To avoid access disruption, ensure to update the 
+> value before it expires. When you update the value, you also must update the Entra ID Auth 
+> Connector in Teleport with a new entity descriptor.
+```
+cat > variables.auto.tfvars << EOF
+tenant_id               = "<tenant ID>"
+app_name                = "teleport-entraid-integration"
+proxy_service_address   = "example.teleport.sh" # Teleport Proxy Service host
+certificate_expiry_date = "" # example format - "2028-05-01T01:02:03Z" 
+EOF
+```
+
+#### Example configuration to setup SAML SSO and managed identity.
+
+You will need the principal ID of the managed identity that is assigned to the Teleport Auth Service.
+You will also need the permission ID of these Graph API permissions - `Application.ReadWrite.OwnedBy, Group.Read.All, User.Read.All`.
+These permission objects aren't directly exposed in the Azure portal. 
+You will need to run PowerShell script to obtain permission ID available in your Entra ID tenant.
+```
+Connect-AzureAD
+
+# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
+$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
+
+# These are Microsoft Graph API permissions required by the managed identity.
+$permissions = @(
+  "Application.ReadWrite.OwnedBy"   # Permission to read application
+  "Group.Read.All"     # Permission to read groups in the directory
+  "User.Read.All"        # Permission to read users in the directory
+)
+
+# Filter and find the app roles in the Microsoft Graph service principal that matches with permissions.
+# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
+$appRoles = $GraphServicePrincipal.AppRoles |
+    Where-Object Value -in $permissions |
+    Where-Object AllowedMemberTypes -contains "Application"
+
+# Print ID of each of the three permissions.
+foreach ($appRole in $appRoles) {
+  "{0} : {1}" -f $appRole.Value, $appRole.Id 
+}
+```
+
+Generate tfvars with `use_system_credentials=true`, `graph_permission_ids` with permission IDs you retrieved using 
+PowerShell and `managed_id` with the principal ID of the managed identity.
+> [!WARNING]
+> 
+> The `certificate_expiry_date` field is used to configure expiry date for the certificate 
+> which will be used to sign SAML assertion. To avoid access disruption, ensure to update the 
+> value before it expires. When you update the value, you also must update the Entra ID Auth 
+> Connector in Teleport with a new entity descriptor.
+```
+cat > variables.auto.tfvars << EOF
+tenant_id               = "<tenant ID>"
+app_name                = "teleport-entraid-integration"
+proxy_service_address   = "example.teleport.sh" # Teleport Proxy Service host
+certificate_expiry_date = "" # example format - "2028-05-01T01:02:03Z" 
+
+use_system_credentials  = true
+graph_permission_ids    = [<permission IDs>]
+managed_id              = "<principal ID of the managed identity>"
+EOF
+```
diff --git a/examples/terraform/entra-id-integration/data.tf b/examples/terraform/entra-id-integration/data.tf
new file mode 100644
index 0000000000000..16ab7bf92e37f
--- /dev/null
+++ b/examples/terraform/entra-id-integration/data.tf
@@ -0,0 +1,8 @@
+data "azuread_application_published_app_ids" "well_known" {}
+
+data "azuread_service_principal" "graph_api" {
+  client_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
+}
+
+data "azuread_client_config" "current" {}
+
diff --git a/examples/terraform/entra-id-integration/main.tf b/examples/terraform/entra-id-integration/main.tf
new file mode 100644
index 0000000000000..0cdc01cba5ae2
--- /dev/null
+++ b/examples/terraform/entra-id-integration/main.tf
@@ -0,0 +1,107 @@
+# Configure Terraform
+terraform {
+  required_providers {
+    azuread = {
+      source  = "hashicorp/azuread"
+      version = "~> 3.1.0"
+    }
+  }
+}
+
+provider "azuread" {
+  tenant_id = var.tenant_id
+}
+
+locals {
+  teleport_saml_entity_id = "https://${var.proxy_service_address}/v1/webapi/saml/acs/entra-id"
+  owners                  = [data.azuread_client_config.current.object_id]
+}
+
+# Configure an enterprise application.
+resource "azuread_application" "app" {
+  display_name = var.app_name
+
+  group_membership_claims = var.group_membership_claims
+
+  web {
+    # SAML Assertion Consumer Service URL.
+    redirect_uris = [local.teleport_saml_entity_id]
+  }
+
+  owners = var.use_system_credentials ? concat(local.owners, [var.managed_id]) : local.owners
+
+  # These resources will be updated later and should not 
+  # be overridden.
+  lifecycle {
+    ignore_changes = [
+      identifier_uris,
+      required_resource_access,
+    ]
+  }
+
+  feature_tags {
+    enterprise            = true
+    custom_single_sign_on = true
+  }
+}
+
+# Configure a service principal.
+resource "azuread_service_principal" "app_sp" {
+  client_id = azuread_application.app.client_id
+
+  # Sign-on URL.
+  login_url                     = local.teleport_saml_entity_id
+  preferred_single_sign_on_mode = "saml"
+
+  feature_tags {
+    enterprise            = true
+    custom_single_sign_on = true
+  }
+}
+
+# Configure a certificate to be used for SAML assertion signing.
+resource "azuread_service_principal_token_signing_certificate" "app_saml_cert" {
+  service_principal_id = azuread_service_principal.app_sp.id
+  display_name         = "CN=${var.app_name}-sso-cert"
+  # Choose the expiry date carefully, expired certificate will break user authentication.
+  end_date = var.certificate_expiry_date
+}
+
+resource "azuread_application_identifier_uri" "app_identifier_uri" {
+  depends_on = [azuread_service_principal.app_sp]
+
+  application_id = azuread_application.app.id
+
+  # Configures SAML Entity ID.
+  identifier_uri = local.teleport_saml_entity_id
+}
+
+# By default, the azuread provider configures NameID format of 
+# emailAddress type. Teleport expects the format to be of unspecified 
+# type. To change this value, create a new userprincipalname claim.
+resource "azuread_claims_mapping_policy" "app_nameid" {
+  definition = [
+    jsonencode(
+      {
+        ClaimsMappingPolicy = {
+          ClaimsSchema = [
+            {
+              ID            = "userprincipalname"
+              SamlClaimType = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
+              Source        = "user"
+            },
+          ]
+          IncludeBasicClaimSet = "true"
+          Version              = 1
+        }
+      }
+    ),
+  ]
+  display_name = "app_nameid"
+}
+
+# Attach the claim to the service principal.
+resource "azuread_service_principal_claims_mapping_policy_assignment" "app_nameid_policy_assignment" {
+  claims_mapping_policy_id = azuread_claims_mapping_policy.app_nameid.id
+  service_principal_id     = azuread_service_principal.app_sp.id
+}
diff --git a/examples/terraform/entra-id-integration/output.tf b/examples/terraform/entra-id-integration/output.tf
new file mode 100644
index 0000000000000..63023be0b48b8
--- /dev/null
+++ b/examples/terraform/entra-id-integration/output.tf
@@ -0,0 +1,7 @@
+output "client_id" {
+  value = azuread_application.app.client_id
+}
+
+output "tenant_id" {
+  value = var.tenant_id
+}
\ No newline at end of file
diff --git a/examples/terraform/entra-id-integration/system-credential.tf b/examples/terraform/entra-id-integration/system-credential.tf
new file mode 100644
index 0000000000000..8737b1dfe31a8
--- /dev/null
+++ b/examples/terraform/entra-id-integration/system-credential.tf
@@ -0,0 +1,12 @@
+# Grant Microsoft Graph API permissions to the managed identity.
+resource "azuread_app_role_assignment" "managed_id_permissions" {
+  # Set permission only if use_system_credentials = true
+  for_each = var.use_system_credentials ? toset(var.graph_permission_ids) : toset([])
+  # ID of the API permission
+  app_role_id = each.value
+  # Object ID of the system assigned Managed identity
+  principal_object_id = var.managed_id
+  # Object ID of the MS graph API application. 
+  resource_object_id = data.azuread_service_principal.graph_api.object_id
+}
+
diff --git a/examples/terraform/entra-id-integration/teleport-as-oidc-idp.tf b/examples/terraform/entra-id-integration/teleport-as-oidc-idp.tf
new file mode 100644
index 0000000000000..cb6ad554732d0
--- /dev/null
+++ b/examples/terraform/entra-id-integration/teleport-as-oidc-idp.tf
@@ -0,0 +1,41 @@
+locals {
+  # Graph API permissions.
+  # permissions = ["Application.ReadWrite.OwnedBy", "Group.Read.All", "User.Read.All"]
+  permissions = [
+    data.azuread_service_principal.graph_api.app_role_ids["Application.ReadWrite.OwnedBy"],
+    data.azuread_service_principal.graph_api.app_role_ids["Group.Read.All"],
+    data.azuread_service_principal.graph_api.app_role_ids["User.Read.All"],
+  ]
+}
+
+# Configure Teleport as an OIDC IdP.
+resource "azuread_application_federated_identity_credential" "app_oidc_idp" {
+  count          = !var.use_system_credentials ? 1 : 0
+  application_id = azuread_application.app.id
+  display_name   = "${var.app_name}_oidc_idp"
+  description    = "Teleport as an OIDC IdP"
+  audiences      = ["api://AzureADTokenExchange"]
+  issuer         = "https://${var.proxy_service_address}"
+  subject        = "teleport-azure"
+}
+
+# Assign API permissions. 
+resource "azuread_application_api_access" "app_graph_permission" {
+  count          = !var.use_system_credentials ? 1 : 0
+  application_id = azuread_application.app.id
+  api_client_id  = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
+
+  role_ids = local.permissions
+}
+
+# Grant admin consent.
+resource "azuread_app_role_assignment" "app_grant_permission" {
+  # Set permission only if use_system_credentials = true
+  for_each = !var.use_system_credentials ? toset(local.permissions) : toset([])
+  # ID of the API permission
+  app_role_id = each.value
+  # Object ID of the system assigned Managed identity
+  principal_object_id = azuread_service_principal.app_sp.object_id
+  # Object ID of the MS graph API application. 
+  resource_object_id = data.azuread_service_principal.graph_api.object_id
+}
diff --git a/examples/terraform/entra-id-integration/variables.tf b/examples/terraform/entra-id-integration/variables.tf
new file mode 100644
index 0000000000000..c1e6d1529e2aa
--- /dev/null
+++ b/examples/terraform/entra-id-integration/variables.tf
@@ -0,0 +1,51 @@
+variable "tenant_id" {
+  type        = string
+  description = "Entra ID Tenant ID"
+}
+
+variable "app_name" {
+  type        = string
+  description = "Enterprise application name"
+  default     = "teleport_entra_id_integration"
+}
+
+variable "proxy_service_address" {
+  type        = string
+  description = "Host and HTTPS port of the Teleport Proxy Service"
+}
+
+variable "group_membership_claims" {
+  type        = list(string)
+  description = "Group claim to be used in the SAML assertion"
+  default     = ["SecurityGroup"]
+}
+
+# Warning! An expired certificate will break user authentication.
+# If you update this value, you should also update the Entra ID 
+# Auth Connector in Teleport with a new entity descriptor. 
+variable "certificate_expiry_date" {
+  type        = string
+  description = "Expiry date for the certificate that will be created for SAML assertion signing"
+}
+
+variable "use_system_credentials" {
+  type        = bool
+  default     = false
+  description = "Defines how Teleport will authenticate with the Microsoft Graph API"
+}
+
+# Only required if use_system_credentials=true
+variable "graph_permission_ids" {
+  type        = list(string)
+  default     = []
+  description = "Permission IDs to be assigned to the managed identity"
+}
+
+# Only required if use_system_credentials=true
+# You can also reference a system assigned managed identity configured in the VM resource:
+# azurerm_virtual_machine.my_vm.identity[0].principal_id
+variable "managed_id" {
+  type        = string
+  default     = ""
+  description = "Principal ID of the managed identity"
+}
diff --git a/fixtures/alpine/Makefile b/fixtures/alpine/Makefile
new file mode 100644
index 0000000000000..fdcc73b03cb9c
--- /dev/null
+++ b/fixtures/alpine/Makefile
@@ -0,0 +1,33 @@
+
+# build-image downloads and validates alpine artifacts, and then builds a
+# docker image to be consumed by pods in Kubernetes integration tests.
+.PHONY: build-image
+build-image: ALPINE_VERSION ?= 3.20.3
+build-image: SHORT_VERSION ?= 3.20
+build-image:
+	# download the alpine artifacts
+	curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$(SHORT_VERSION)/releases/x86_64/alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz
+	curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$(SHORT_VERSION)/releases/x86_64/alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.asc
+	curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$(SHORT_VERSION)/releases/x86_64/alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.sha256
+
+	# verify the checksum
+	sha256sum -c alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.sha256
+
+	# verify the signature
+	gpg --import  ./alpine-ncopa.at.alpinelinux.org.asc
+	gpg --verify ./alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.asc ./alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz
+
+	# build the web server
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./webserver ./webserver.go
+	docker build -t alpine-webserver:v1 --build-arg=ALPINE_VERSION=$(ALPINE_VERSION) -f ./Dockerfile .
+
+	rm webserver
+	rm alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz
+	rm alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.asc
+	rm alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz.sha256
+
+
+# load-image installs the custom build docker image from build-image into a KinD cluster.
+.PHONY: load-image
+load-image:
+	kind load docker-image alpine-webserver:v1
\ No newline at end of file
diff --git a/fixtures/alpine/README.md b/fixtures/alpine/README.md
index a6506854275fd..ac8bdebdf7e42 100644
--- a/fixtures/alpine/README.md
+++ b/fixtures/alpine/README.md
@@ -1,50 +1,24 @@
-# `alpine-webserver:v1` Build Process
+# `alpine-webserver:v1`
 
-## Source
+## Why
 
-The `alpine-webserver:v1` image is based on `alpine` `minirootfs`, but instead of relying on Docker Hub's official Alpine image, we source the original files directly from Alpine's CDN. This approach mitigates issues with Docker Hub and GitHub Action network failures, which have been a common cause of integration test failures.
+We build a custom image for Kubernetes integration tests so that we don't have to 
+rely on external dependencies in CI. This approach mitigates issues with Docker Hub 
+and GitHub Actions network failures which have been a common cause of integration test failures
+in the past.
 
-The build process is specified in the `.github/workflows/kube-integration-tests-non-root.yaml` file.
+## How
 
-## Download
+The `make build-image` performs the following steps to produce the image.
 
-To download the new `alpine-minirootfs` image, follow the instructions:
+We download `alpine` `minirootfs` assets directly from the alpine CDN, compile the webserver,
+and build a minimal docker image.
 
-```bash
-$ export ALPINE_VERSION=3.20.3
-$ export SHORT_VERSION=${ALPINE_VERSION%.*}
+The build process validates both the SHA-256 checksum and the GPG signature. The signature verification 
+uses `alpine-ncopa.at.alpinelinux.org.asc`, which is the official public key used by Alpine Linux to 
+sign its assets. This public key is available on the [Alpine Linux Downloads page](https://www.alpinelinux.org/downloads/).
 
-# download alpine minirootfs and signature
-$ curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz
-$ curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.asc
-$ curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.sha256
-          
-```
+The docker image produced is tagged with `:v1` instead of `:latest` to prevent Kubernetes from 
+pulling the image from Docker Hub in an attempt to ensure the most recent image is used.
 
-## Source Validation
-
-The build process in `.github/workflows/kube-integration-tests-non-root.yaml` validates both the SHA-256 checksum and the GPG signature. The signature verification uses `alpine-ncopa.at.alpinelinux.org.asc`, which is the official public key used by Alpine Linux to sign its assets. This public key is available on the [Alpine Linux Downloads page](https://www.alpinelinux.org/downloads/).
-
-## Image Build Process
-
-The image is constructed from a scratch filesystem and incorporates only the necessary components to run the web server. Here’s the basic Dockerfile configuration:
-
-```Dockerfile
-FROM scratch
-
-ARG ALPINE_VERSION
-
-ADD alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz /
-
-COPY webserver /webserver
-
-CMD [ "/webserver" ]
-```
-
-This minimalist configuration ensures the image remains lightweight, secure, and tailored to only the required functionalities.
-
-## Image distribution
-
-After sucessfull build, the image is loaded into our `kind` cluster with the tag `alpine-webserver:v1`.
-
-Note: `:latest` can't be used otherwise Kubernetes will try loading the image from dockerhub and fail.
\ No newline at end of file
+After a successful build, the image can be loaded into a `kind` cluster via `make load-image`.
\ No newline at end of file
diff --git a/fuzz/oss-fuzz-build.sh b/fuzz/oss-fuzz-build.sh
index 34001912c9cdc..615795012edf5 100755
--- a/fuzz/oss-fuzz-build.sh
+++ b/fuzz/oss-fuzz-build.sh
@@ -146,6 +146,9 @@ build_teleport_api_fuzzers() {
   compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/aws \
     FuzzParseElastiCacheEndpoint fuzz_parse_elasti_cache_endpoint
 
+  compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/aws \
+    FuzzParseElastiCacheServerlessEndpoint fuzz_parse_elasti_cache_serverless_endpoint
+
   compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/aws \
     FuzzParseDynamoDBEndpoint fuzz_parse_dynamodb_endpoint
 
diff --git a/gen/preset-roles.json b/gen/preset-roles.json
index 3290103e32492..d570d547e8e20 100755
--- a/gen/preset-roles.json
+++ b/gen/preset-roles.json
@@ -145,7 +145,12 @@
               "{{internal.github_orgs}}"
             ]
           }
-        ]
+        ],
+        "mcp": {
+          "tools": [
+            "{{internal.mcp_tools}}"
+          ]
+        }
       },
       "deny": {}
     }
@@ -1046,6 +1051,15 @@
               "read"
             ]
           },
+          {
+            "resources": [
+              "autoupdate_bot_instance_report"
+            ],
+            "verbs": [
+              "list",
+              "read"
+            ]
+          },
           {
             "resources": [
               "git_server"
@@ -1117,6 +1131,90 @@
               "update",
               "delete"
             ]
+          },
+          {
+            "resources": [
+              "inference_model"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "inference_secret"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "inference_policy"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "client_ip_restriction"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "scoped_role"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "scoped_role_assignment"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
+          },
+          {
+            "resources": [
+              "scoped_token"
+            ],
+            "verbs": [
+              "list",
+              "create",
+              "read",
+              "update",
+              "delete"
+            ]
           }
         ]
       },
diff --git a/gen/proto/go/accessgraph/v1alpha/access_graph_service.pb.go b/gen/proto/go/accessgraph/v1alpha/access_graph_service.pb.go
index 686fa1011e266..4a84628d2f0c0 100644
--- a/gen/proto/go/accessgraph/v1alpha/access_graph_service.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/access_graph_service.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/access_graph_service.proto
 
@@ -28,6 +28,7 @@ import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	structpb "google.golang.org/protobuf/types/known/structpb"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
@@ -41,6 +42,60 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// KubeAuditLogSource specifies a source of logs in order to interpret a
+// KubeAuditLogCursor id and cursor. Different sources of logs will have
+// different ways of representing a position in a log stream.
+type KubeAuditLogCursor_KubeAuditLogSource int32
+
+const (
+	// KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED represents a zero value where no log
+	// source has been specified.
+	KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED KubeAuditLogCursor_KubeAuditLogSource = 0
+	// KUBE_AUDIT_LOG_SOURCE_EKS specifies AWS CloudWatch as the source of
+	// Kubernetes apiserver audit logs. This is where EKS sends the apiserver
+	// audit logs.
+	KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS KubeAuditLogCursor_KubeAuditLogSource = 1
+)
+
+// Enum value maps for KubeAuditLogCursor_KubeAuditLogSource.
+var (
+	KubeAuditLogCursor_KubeAuditLogSource_name = map[int32]string{
+		0: "KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED",
+		1: "KUBE_AUDIT_LOG_SOURCE_EKS",
+	}
+	KubeAuditLogCursor_KubeAuditLogSource_value = map[string]int32{
+		"KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED": 0,
+		"KUBE_AUDIT_LOG_SOURCE_EKS":         1,
+	}
+)
+
+func (x KubeAuditLogCursor_KubeAuditLogSource) Enum() *KubeAuditLogCursor_KubeAuditLogSource {
+	p := new(KubeAuditLogCursor_KubeAuditLogSource)
+	*p = x
+	return p
+}
+
+func (x KubeAuditLogCursor_KubeAuditLogSource) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (KubeAuditLogCursor_KubeAuditLogSource) Descriptor() protoreflect.EnumDescriptor {
+	return file_accessgraph_v1alpha_access_graph_service_proto_enumTypes[0].Descriptor()
+}
+
+func (KubeAuditLogCursor_KubeAuditLogSource) Type() protoreflect.EnumType {
+	return &file_accessgraph_v1alpha_access_graph_service_proto_enumTypes[0]
+}
+
+func (x KubeAuditLogCursor_KubeAuditLogSource) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use KubeAuditLogCursor_KubeAuditLogSource.Descriptor instead.
+func (KubeAuditLogCursor_KubeAuditLogSource) EnumDescriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{46, 0}
+}
+
 // QueryRequest is a request to query the access graph.
 type QueryRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -875,10 +930,12 @@ func (*AuditLogStreamRequest_BulkSync) isAuditLogStreamRequest_Action() {}
 
 // AuditLogConfig is the configuration for exporting audit logs.
 type AuditLogConfig struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	StartDate     *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=start_date,json=startDate,proto3" json:"start_date,omitempty"` // Start date for exporting audit logs.
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state     protoimpl.MessageState `protogen:"open.v1"`
+	StartDate *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=start_date,json=startDate,proto3" json:"start_date,omitempty"` // Start date for exporting audit logs.
+	// teleport_cluster is the teleport cluster name this audit log config refers to.
+	TeleportCluster string `protobuf:"bytes,2,opt,name=teleport_cluster,json=teleportCluster,proto3" json:"teleport_cluster,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *AuditLogConfig) Reset() {
@@ -918,6 +975,13 @@ func (x *AuditLogConfig) GetStartDate() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *AuditLogConfig) GetTeleportCluster() string {
+	if x != nil {
+		return x.TeleportCluster
+	}
+	return ""
+}
+
 // AuditLogEvents bundles a batch of unstructured audit log events with the
 // appropriate resume state information for the type of events being sent
 // ('search' or 'bulk'). This allows the server to persist the client's
@@ -2812,6 +2876,489 @@ func (x *AWSCloudTrailEventResource) GetType() string {
 	return ""
 }
 
+// KubeAuditLogStreamRequest is sent from the client (Teleport) to the server
+// (access graph) over the bi-directional KubeAuditLogStream. It encapsulates
+// distinct client actions for sending batches of Kubernetes audit log events
+// and managing the persistent resume state maintained by the access graph
+// server.
+type KubeAuditLogStreamRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Action:
+	//
+	//	*KubeAuditLogStreamRequest_Config
+	//	*KubeAuditLogStreamRequest_NewStream
+	//	*KubeAuditLogStreamRequest_Events
+	Action        isKubeAuditLogStreamRequest_Action `protobuf_oneof:"action"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogStreamRequest) Reset() {
+	*x = KubeAuditLogStreamRequest{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogStreamRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogStreamRequest) ProtoMessage() {}
+
+func (x *KubeAuditLogStreamRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[42]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogStreamRequest.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogStreamRequest) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *KubeAuditLogStreamRequest) GetAction() isKubeAuditLogStreamRequest_Action {
+	if x != nil {
+		return x.Action
+	}
+	return nil
+}
+
+func (x *KubeAuditLogStreamRequest) GetConfig() *KubeAuditLogConfig {
+	if x != nil {
+		if x, ok := x.Action.(*KubeAuditLogStreamRequest_Config); ok {
+			return x.Config
+		}
+	}
+	return nil
+}
+
+func (x *KubeAuditLogStreamRequest) GetNewStream() *KubeAuditLogNewStream {
+	if x != nil {
+		if x, ok := x.Action.(*KubeAuditLogStreamRequest_NewStream); ok {
+			return x.NewStream
+		}
+	}
+	return nil
+}
+
+func (x *KubeAuditLogStreamRequest) GetEvents() *KubeAuditLogEvents {
+	if x != nil {
+		if x, ok := x.Action.(*KubeAuditLogStreamRequest_Events); ok {
+			return x.Events
+		}
+	}
+	return nil
+}
+
+type isKubeAuditLogStreamRequest_Action interface {
+	isKubeAuditLogStreamRequest_Action()
+}
+
+type KubeAuditLogStreamRequest_Config struct {
+	Config *KubeAuditLogConfig `protobuf:"bytes,1,opt,name=config,proto3,oneof"`
+}
+
+type KubeAuditLogStreamRequest_NewStream struct {
+	NewStream *KubeAuditLogNewStream `protobuf:"bytes,2,opt,name=new_stream,json=newStream,proto3,oneof"`
+}
+
+type KubeAuditLogStreamRequest_Events struct {
+	Events *KubeAuditLogEvents `protobuf:"bytes,3,opt,name=events,proto3,oneof"`
+}
+
+func (*KubeAuditLogStreamRequest_Config) isKubeAuditLogStreamRequest_Action() {}
+
+func (*KubeAuditLogStreamRequest_NewStream) isKubeAuditLogStreamRequest_Action() {}
+
+func (*KubeAuditLogStreamRequest_Events) isKubeAuditLogStreamRequest_Action() {}
+
+// KubeAuditLogConfig is the KubeAuditLogStream configuration. It is sent from
+// the client (Teleport) to the server (access graph) on start up, containing
+// any configuration parameters from the Teleport config. The server will
+// respond with an adjusted config that is that it will use, possibly
+// overriding the supplied config.
+// Currently there is no configuration exchanged. This message is present for
+// future expansion.
+type KubeAuditLogConfig struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogConfig) Reset() {
+	*x = KubeAuditLogConfig{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogConfig) ProtoMessage() {}
+
+func (x *KubeAuditLogConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[43]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogConfig.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogConfig) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{43}
+}
+
+// KubeAuditLogNewStream identifies a log source and cluster that the client
+// wants to start sending to the server. The server responds with a
+// KubeAuditLogResumeState message indicating where to resume streaming
+// logs from.
+type KubeAuditLogNewStream struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Initial       *KubeAuditLogCursor    `protobuf:"bytes,1,opt,name=initial,proto3" json:"initial,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogNewStream) Reset() {
+	*x = KubeAuditLogNewStream{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[44]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogNewStream) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogNewStream) ProtoMessage() {}
+
+func (x *KubeAuditLogNewStream) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[44]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogNewStream.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogNewStream) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{44}
+}
+
+func (x *KubeAuditLogNewStream) GetInitial() *KubeAuditLogCursor {
+	if x != nil {
+		return x.Initial
+	}
+	return nil
+}
+
+// KubeAuditLogEvents is a chunk of Kubernetes apiserver audit logs.
+type KubeAuditLogEvents struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// event is a Kubernetes audit log event represented as a struct so as to
+	// not depend on the Kubernetes proto files. Additionally, the audit log
+	// events are typically received as JSON, not protobufs.
+	// package k8s.io.apiserver.pkg.apis.audit.v1 at
+	// https://github.com/kubernetes/apiserver/blob/master/pkg/apis/audit/v1/generated.proto
+	Events []*structpb.Struct `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+	// cursor is the position in the event stream of the last event in the
+	// event field. It can be sent back to Teleport when a stream is
+	// reconnected to resume the event stream from the end of this chunk.
+	Cursor        *KubeAuditLogCursor `protobuf:"bytes,2,opt,name=cursor,proto3" json:"cursor,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogEvents) Reset() {
+	*x = KubeAuditLogEvents{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[45]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogEvents) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogEvents) ProtoMessage() {}
+
+func (x *KubeAuditLogEvents) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[45]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogEvents.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogEvents) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{45}
+}
+
+func (x *KubeAuditLogEvents) GetEvents() []*structpb.Struct {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+func (x *KubeAuditLogEvents) GetCursor() *KubeAuditLogCursor {
+	if x != nil {
+		return x.Cursor
+	}
+	return nil
+}
+
+// KubeAuditLogCursor is a position in a stream of KubeAuditLogEvents for
+// resuming a stream of events after an interrupted connection. Each batch
+// of events has a cursor referring to the last event of the batch. The
+// cursor can be sent to Teleport when resuming a connection.
+type KubeAuditLogCursor struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// log_source is where the logs are coming from that this cursor is for.
+	LogSource KubeAuditLogCursor_KubeAuditLogSource `protobuf:"varint,1,opt,name=log_source,json=logSource,proto3,enum=accessgraph.v1alpha.KubeAuditLogCursor_KubeAuditLogSource" json:"log_source,omitempty"`
+	// cluster_id is an opaque identifier for the Kubernetes cluster that this
+	// cursor refers to. The ID should be interpreted based on the cluster type.
+	ClusterId string `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
+	// event_id is the ID of the last event of a batch of events that a cursor
+	// refers to. It is an opaque value interpreted according to the log_source
+	// of the cursor. When sent as part of a KubeAuditLogNewStream message, it
+	// will be empty. When sent as part of a KubeAuditLogResumeState, it may be
+	// empty to indicate that there is no resume state cursor.
+	EventId string `protobuf:"bytes,3,opt,name=event_id,json=eventId,proto3" json:"event_id,omitempty"`
+	// last_event_time is the timestamp of the last event of a batch of events
+	// that a cursor refers to. If the event_id is sufficient to resume streaming
+	// events for a log source then this field may be omitted. When sent as part
+	// of a KubeAuditLogNewStream message, it may contain the timestamp from which
+	// the client intends to stream logs. The KubeAuditLogResumeState may contain
+	// a different time, indicating the timestamp from which it should start,
+	// either because it is a resumption of an existing stream or because the
+	// server is overriding the start timestamp for a new stream.
+	LastEventTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_event_time,json=lastEventTime,proto3" json:"last_event_time,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogCursor) Reset() {
+	*x = KubeAuditLogCursor{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[46]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogCursor) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogCursor) ProtoMessage() {}
+
+func (x *KubeAuditLogCursor) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[46]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogCursor.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogCursor) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{46}
+}
+
+func (x *KubeAuditLogCursor) GetLogSource() KubeAuditLogCursor_KubeAuditLogSource {
+	if x != nil {
+		return x.LogSource
+	}
+	return KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED
+}
+
+func (x *KubeAuditLogCursor) GetClusterId() string {
+	if x != nil {
+		return x.ClusterId
+	}
+	return ""
+}
+
+func (x *KubeAuditLogCursor) GetEventId() string {
+	if x != nil {
+		return x.EventId
+	}
+	return ""
+}
+
+func (x *KubeAuditLogCursor) GetLastEventTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastEventTime
+	}
+	return nil
+}
+
+// KubeAuditLogStreamResponse is sent from the server (access graph) to the
+// client (Teleport) over th bi-directional KubeAuditLogStream. It is used to
+// convey the resume state of the log streams that access graph is processing
+// the logs for.
+type KubeAuditLogStreamResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to State:
+	//
+	//	*KubeAuditLogStreamResponse_Config
+	//	*KubeAuditLogStreamResponse_ResumeState
+	State         isKubeAuditLogStreamResponse_State `protobuf_oneof:"state"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogStreamResponse) Reset() {
+	*x = KubeAuditLogStreamResponse{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogStreamResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogStreamResponse) ProtoMessage() {}
+
+func (x *KubeAuditLogStreamResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogStreamResponse.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogStreamResponse) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *KubeAuditLogStreamResponse) GetState() isKubeAuditLogStreamResponse_State {
+	if x != nil {
+		return x.State
+	}
+	return nil
+}
+
+func (x *KubeAuditLogStreamResponse) GetConfig() *KubeAuditLogConfig {
+	if x != nil {
+		if x, ok := x.State.(*KubeAuditLogStreamResponse_Config); ok {
+			return x.Config
+		}
+	}
+	return nil
+}
+
+func (x *KubeAuditLogStreamResponse) GetResumeState() *KubeAuditLogResumeState {
+	if x != nil {
+		if x, ok := x.State.(*KubeAuditLogStreamResponse_ResumeState); ok {
+			return x.ResumeState
+		}
+	}
+	return nil
+}
+
+type isKubeAuditLogStreamResponse_State interface {
+	isKubeAuditLogStreamResponse_State()
+}
+
+type KubeAuditLogStreamResponse_Config struct {
+	Config *KubeAuditLogConfig `protobuf:"bytes,1,opt,name=config,proto3,oneof"`
+}
+
+type KubeAuditLogStreamResponse_ResumeState struct {
+	ResumeState *KubeAuditLogResumeState `protobuf:"bytes,2,opt,name=resume_state,json=resumeState,proto3,oneof"`
+}
+
+func (*KubeAuditLogStreamResponse_Config) isKubeAuditLogStreamResponse_State() {}
+
+func (*KubeAuditLogStreamResponse_ResumeState) isKubeAuditLogStreamResponse_State() {}
+
+// KubeAuditLogResumeState is the response to the KubeAuditLogNewStream request
+// and contains the cursor for the resume state of that Kubernetes cluster.
+type KubeAuditLogResumeState struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// cursor is a resumption cursor for a new stream, sent in response to
+	// a KubeAuditLogNewStream request. If the log_source and cluster_id sent
+	// in the new stream request are unknown to the server, this cursor
+	// may not contain a position to resume from. However the timestamp in
+	// the cursor should be set to what was received in the KubeAuditLogNewStream
+	// message if it is not to be overridden, or it should be replaced with
+	// a different initial start timestamp if Access Graph (server) wants to
+	// override that.
+	Cursor        *KubeAuditLogCursor `protobuf:"bytes,1,opt,name=cursor,proto3" json:"cursor,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeAuditLogResumeState) Reset() {
+	*x = KubeAuditLogResumeState{}
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[48]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeAuditLogResumeState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeAuditLogResumeState) ProtoMessage() {}
+
+func (x *KubeAuditLogResumeState) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[48]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeAuditLogResumeState.ProtoReflect.Descriptor instead.
+func (*KubeAuditLogResumeState) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *KubeAuditLogResumeState) GetCursor() *KubeAuditLogCursor {
+	if x != nil {
+		return x.Cursor
+	}
+	return nil
+}
+
 // GitHubAuditLogStreamRequest represents a client message in the GitHubAuditLogStream,
 // containing either initial configuration or a batch of GitHub audit log events.
 type GitHubAuditLogStreamRequest struct {
@@ -2827,7 +3374,7 @@ type GitHubAuditLogStreamRequest struct {
 
 func (x *GitHubAuditLogStreamRequest) Reset() {
 	*x = GitHubAuditLogStreamRequest{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[42]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2839,7 +3386,7 @@ func (x *GitHubAuditLogStreamRequest) String() string {
 func (*GitHubAuditLogStreamRequest) ProtoMessage() {}
 
 func (x *GitHubAuditLogStreamRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[42]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2852,7 +3399,7 @@ func (x *GitHubAuditLogStreamRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GitHubAuditLogStreamRequest.ProtoReflect.Descriptor instead.
 func (*GitHubAuditLogStreamRequest) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{42}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *GitHubAuditLogStreamRequest) GetOperation() isGitHubAuditLogStreamRequest_Operation {
@@ -2914,7 +3461,7 @@ type GitHubAuditLogStreamResponse struct {
 
 func (x *GitHubAuditLogStreamResponse) Reset() {
 	*x = GitHubAuditLogStreamResponse{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[43]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2926,7 +3473,7 @@ func (x *GitHubAuditLogStreamResponse) String() string {
 func (*GitHubAuditLogStreamResponse) ProtoMessage() {}
 
 func (x *GitHubAuditLogStreamResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[43]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2939,7 +3486,7 @@ func (x *GitHubAuditLogStreamResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GitHubAuditLogStreamResponse.ProtoReflect.Descriptor instead.
 func (*GitHubAuditLogStreamResponse) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{43}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *GitHubAuditLogStreamResponse) GetState() isGitHubAuditLogStreamResponse_State {
@@ -3002,7 +3549,7 @@ type GitHubEventsStreamRequest struct {
 
 func (x *GitHubEventsStreamRequest) Reset() {
 	*x = GitHubEventsStreamRequest{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[44]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3014,7 +3561,7 @@ func (x *GitHubEventsStreamRequest) String() string {
 func (*GitHubEventsStreamRequest) ProtoMessage() {}
 
 func (x *GitHubEventsStreamRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[44]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3027,7 +3574,7 @@ func (x *GitHubEventsStreamRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GitHubEventsStreamRequest.ProtoReflect.Descriptor instead.
 func (*GitHubEventsStreamRequest) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{44}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *GitHubEventsStreamRequest) GetOperation() isGitHubEventsStreamRequest_Operation {
@@ -3096,7 +3643,7 @@ type GitHubEventsStreamResponse struct {
 
 func (x *GitHubEventsStreamResponse) Reset() {
 	*x = GitHubEventsStreamResponse{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[45]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3108,7 +3655,7 @@ func (x *GitHubEventsStreamResponse) String() string {
 func (*GitHubEventsStreamResponse) ProtoMessage() {}
 
 func (x *GitHubEventsStreamResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[45]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3121,7 +3668,7 @@ func (x *GitHubEventsStreamResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GitHubEventsStreamResponse.ProtoReflect.Descriptor instead.
 func (*GitHubEventsStreamResponse) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{45}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{52}
 }
 
 // OktaAuditLogStreamRequest represents a client message in the OktaAuditLogStream,
@@ -3139,7 +3686,7 @@ type OktaAuditLogStreamRequest struct {
 
 func (x *OktaAuditLogStreamRequest) Reset() {
 	*x = OktaAuditLogStreamRequest{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[46]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3151,7 +3698,7 @@ func (x *OktaAuditLogStreamRequest) String() string {
 func (*OktaAuditLogStreamRequest) ProtoMessage() {}
 
 func (x *OktaAuditLogStreamRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[46]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3164,7 +3711,7 @@ func (x *OktaAuditLogStreamRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OktaAuditLogStreamRequest.ProtoReflect.Descriptor instead.
 func (*OktaAuditLogStreamRequest) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{46}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *OktaAuditLogStreamRequest) GetOperation() isOktaAuditLogStreamRequest_Operation {
@@ -3223,7 +3770,7 @@ type OktaAuditLogStreamResponse struct {
 
 func (x *OktaAuditLogStreamResponse) Reset() {
 	*x = OktaAuditLogStreamResponse{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3235,7 +3782,7 @@ func (x *OktaAuditLogStreamResponse) String() string {
 func (*OktaAuditLogStreamResponse) ProtoMessage() {}
 
 func (x *OktaAuditLogStreamResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3248,7 +3795,7 @@ func (x *OktaAuditLogStreamResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OktaAuditLogStreamResponse.ProtoReflect.Descriptor instead.
 func (*OktaAuditLogStreamResponse) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{47}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *OktaAuditLogStreamResponse) GetState() isOktaAuditLogStreamResponse_State {
@@ -3308,7 +3855,7 @@ type OktaEventsStreamRequest struct {
 
 func (x *OktaEventsStreamRequest) Reset() {
 	*x = OktaEventsStreamRequest{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[48]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3320,7 +3867,7 @@ func (x *OktaEventsStreamRequest) String() string {
 func (*OktaEventsStreamRequest) ProtoMessage() {}
 
 func (x *OktaEventsStreamRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[48]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3333,7 +3880,7 @@ func (x *OktaEventsStreamRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OktaEventsStreamRequest.ProtoReflect.Descriptor instead.
 func (*OktaEventsStreamRequest) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{48}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *OktaEventsStreamRequest) GetOperation() isOktaEventsStreamRequest_Operation {
@@ -3402,7 +3949,7 @@ type OktaEventsStreamResponse struct {
 
 func (x *OktaEventsStreamResponse) Reset() {
 	*x = OktaEventsStreamResponse{}
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[49]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3414,7 +3961,7 @@ func (x *OktaEventsStreamResponse) String() string {
 func (*OktaEventsStreamResponse) ProtoMessage() {}
 
 func (x *OktaEventsStreamResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[49]
+	mi := &file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3427,14 +3974,14 @@ func (x *OktaEventsStreamResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OktaEventsStreamResponse.ProtoReflect.Descriptor instead.
 func (*OktaEventsStreamResponse) Descriptor() ([]byte, []int) {
-	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{49}
+	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP(), []int{56}
 }
 
 var File_accessgraph_v1alpha_access_graph_service_proto protoreflect.FileDescriptor
 
 const file_accessgraph_v1alpha_access_graph_service_proto_rawDesc = "" +
 	"\n" +
-	".accessgraph/v1alpha/access_graph_service.proto\x12\x13accessgraph.v1alpha\x1a\x1daccessgraph/v1alpha/aws.proto\x1a\x1faccessgraph/v1alpha/azure.proto\x1a\x1faccessgraph/v1alpha/entra.proto\x1a accessgraph/v1alpha/events.proto\x1a accessgraph/v1alpha/github.proto\x1a accessgraph/v1alpha/gitlab.proto\x1a\x1faccessgraph/v1alpha/graph.proto\x1a\x1faccessgraph/v1alpha/netiq.proto\x1a\x1eaccessgraph/v1alpha/okta.proto\x1a#accessgraph/v1alpha/resources.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a#teleport/auditlog/v1/auditlog.proto\"$\n" +
+	".accessgraph/v1alpha/access_graph_service.proto\x12\x13accessgraph.v1alpha\x1a\x1daccessgraph/v1alpha/aws.proto\x1a\x1faccessgraph/v1alpha/azure.proto\x1a\x1faccessgraph/v1alpha/entra.proto\x1a accessgraph/v1alpha/events.proto\x1a accessgraph/v1alpha/github.proto\x1a accessgraph/v1alpha/gitlab.proto\x1a\x1faccessgraph/v1alpha/graph.proto\x1a\x1faccessgraph/v1alpha/netiq.proto\x1a\x1eaccessgraph/v1alpha/okta.proto\x1a#accessgraph/v1alpha/resources.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a#teleport/auditlog/v1/auditlog.proto\"$\n" +
 	"\fQueryRequest\x12\x14\n" +
 	"\x05query\x18\x01 \x01(\tR\x05query\"q\n" +
 	"\rQueryResponse\x12/\n" +
@@ -3471,10 +4018,11 @@ const file_accessgraph_v1alpha_access_graph_service_proto_rawDesc = "" +
 	"\x06config\x18\x01 \x01(\v2#.accessgraph.v1alpha.AuditLogConfigH\x00R\x06config\x12=\n" +
 	"\x06events\x18\x02 \x01(\v2#.accessgraph.v1alpha.AuditLogEventsH\x00R\x06events\x12G\n" +
 	"\tbulk_sync\x18\x03 \x01(\v2(.accessgraph.v1alpha.BulkResumeStateSyncH\x00R\bbulkSyncB\b\n" +
-	"\x06action\"K\n" +
+	"\x06action\"v\n" +
 	"\x0eAuditLogConfig\x129\n" +
 	"\n" +
-	"start_date\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\tstartDate\"\xa2\x02\n" +
+	"start_date\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\tstartDate\x12)\n" +
+	"\x10teleport_cluster\x18\x02 \x01(\tR\x0fteleportCluster\"\xa2\x02\n" +
 	"\x0eAuditLogEvents\x12?\n" +
 	"\x06events\x18\x01 \x03(\v2'.teleport.auditlog.v1.EventUnstructuredR\x06events\x12X\n" +
 	"\x13search_resume_state\x18\x02 \x01(\v2&.accessgraph.v1alpha.SearchResumeStateH\x00R\x11searchResumeState\x12e\n" +
@@ -3562,7 +4110,35 @@ const file_accessgraph_v1alpha_access_graph_service_proto_rawDesc = "" +
 	"\x18AWSCloudTrailResumeState\"D\n" +
 	"\x1aAWSCloudTrailEventResource\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
-	"\x04type\x18\x02 \x01(\tR\x04type\"\xaf\x01\n" +
+	"\x04type\x18\x02 \x01(\tR\x04type\"\xf8\x01\n" +
+	"\x19KubeAuditLogStreamRequest\x12A\n" +
+	"\x06config\x18\x01 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogConfigH\x00R\x06config\x12K\n" +
+	"\n" +
+	"new_stream\x18\x02 \x01(\v2*.accessgraph.v1alpha.KubeAuditLogNewStreamH\x00R\tnewStream\x12A\n" +
+	"\x06events\x18\x03 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogEventsH\x00R\x06eventsB\b\n" +
+	"\x06action\"\x14\n" +
+	"\x12KubeAuditLogConfig\"Z\n" +
+	"\x15KubeAuditLogNewStream\x12A\n" +
+	"\ainitial\x18\x01 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogCursorR\ainitial\"\x86\x01\n" +
+	"\x12KubeAuditLogEvents\x12/\n" +
+	"\x06events\x18\x01 \x03(\v2\x17.google.protobuf.StructR\x06events\x12?\n" +
+	"\x06cursor\x18\x02 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogCursorR\x06cursor\"\xc9\x02\n" +
+	"\x12KubeAuditLogCursor\x12Y\n" +
+	"\n" +
+	"log_source\x18\x01 \x01(\x0e2:.accessgraph.v1alpha.KubeAuditLogCursor.KubeAuditLogSourceR\tlogSource\x12\x1d\n" +
+	"\n" +
+	"cluster_id\x18\x02 \x01(\tR\tclusterId\x12\x19\n" +
+	"\bevent_id\x18\x03 \x01(\tR\aeventId\x12B\n" +
+	"\x0flast_event_time\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\rlastEventTime\"Z\n" +
+	"\x12KubeAuditLogSource\x12%\n" +
+	"!KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED\x10\x00\x12\x1d\n" +
+	"\x19KUBE_AUDIT_LOG_SOURCE_EKS\x10\x01\"\xbb\x01\n" +
+	"\x1aKubeAuditLogStreamResponse\x12A\n" +
+	"\x06config\x18\x01 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogConfigH\x00R\x06config\x12Q\n" +
+	"\fresume_state\x18\x02 \x01(\v2,.accessgraph.v1alpha.KubeAuditLogResumeStateH\x00R\vresumeStateB\a\n" +
+	"\x05state\"Z\n" +
+	"\x17KubeAuditLogResumeState\x12?\n" +
+	"\x06cursor\x18\x01 \x01(\v2'.accessgraph.v1alpha.KubeAuditLogCursorR\x06cursor\"\xaf\x01\n" +
 	"\x1bGitHubAuditLogStreamRequest\x12=\n" +
 	"\x06config\x18\x01 \x01(\v2#.accessgraph.v1alpha.GitHubConfigV1H\x00R\x06config\x12D\n" +
 	"\taudit_log\x18\x02 \x01(\v2%.accessgraph.v1alpha.GitHubAuditLogV1H\x00R\bauditLogB\v\n" +
@@ -3590,14 +4166,15 @@ const file_accessgraph_v1alpha_access_graph_service_proto_rawDesc = "" +
 	"\x06delete\x18\x02 \x01(\v2%.accessgraph.v1alpha.OktaResourceListH\x00R\x06delete\x123\n" +
 	"\x04sync\x18\x03 \x01(\v2\x1d.accessgraph.v1alpha.OktaSyncH\x00R\x04syncB\v\n" +
 	"\toperation\"\x1a\n" +
-	"\x18OktaEventsStreamResponse2\xf4\x0e\n" +
+	"\x18OktaEventsStreamResponse2\xef\x0f\n" +
 	"\x12AccessGraphService\x12N\n" +
 	"\x05Query\x12!.accessgraph.v1alpha.QueryRequest\x1a\".accessgraph.v1alpha.QueryResponse\x12T\n" +
 	"\aGetFile\x12#.accessgraph.v1alpha.GetFileRequest\x1a$.accessgraph.v1alpha.GetFileResponse\x12e\n" +
 	"\fEventsStream\x12(.accessgraph.v1alpha.EventsStreamRequest\x1a).accessgraph.v1alpha.EventsStreamResponse(\x01\x12m\n" +
 	"\x0eEventsStreamV2\x12*.accessgraph.v1alpha.EventsStreamV2Request\x1a+.accessgraph.v1alpha.EventsStreamV2Response(\x010\x01\x12m\n" +
 	"\x0eAuditLogStream\x12*.accessgraph.v1alpha.AuditLogStreamRequest\x1a+.accessgraph.v1alpha.AuditLogStreamResponse(\x010\x01\x12|\n" +
-	"\x13AWSCloudTrailStream\x12/.accessgraph.v1alpha.AWSCloudTrailStreamRequest\x1a0.accessgraph.v1alpha.AWSCloudTrailStreamResponse(\x010\x01\x12W\n" +
+	"\x13AWSCloudTrailStream\x12/.accessgraph.v1alpha.AWSCloudTrailStreamRequest\x1a0.accessgraph.v1alpha.AWSCloudTrailStreamResponse(\x010\x01\x12y\n" +
+	"\x12KubeAuditLogStream\x12..accessgraph.v1alpha.KubeAuditLogStreamRequest\x1a/.accessgraph.v1alpha.KubeAuditLogStreamResponse(\x010\x01\x12W\n" +
 	"\bRegister\x12$.accessgraph.v1alpha.RegisterRequest\x1a%.accessgraph.v1alpha.RegisterResponse\x12]\n" +
 	"\n" +
 	"ReplaceCAs\x12&.accessgraph.v1alpha.ReplaceCAsRequest\x1a'.accessgraph.v1alpha.ReplaceCAsResponse\x12n\n" +
@@ -3623,191 +4200,214 @@ func file_accessgraph_v1alpha_access_graph_service_proto_rawDescGZIP() []byte {
 	return file_accessgraph_v1alpha_access_graph_service_proto_rawDescData
 }
 
-var file_accessgraph_v1alpha_access_graph_service_proto_msgTypes = make([]protoimpl.MessageInfo, 51)
+var file_accessgraph_v1alpha_access_graph_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_accessgraph_v1alpha_access_graph_service_proto_msgTypes = make([]protoimpl.MessageInfo, 58)
 var file_accessgraph_v1alpha_access_graph_service_proto_goTypes = []any{
-	(*QueryRequest)(nil),                 // 0: accessgraph.v1alpha.QueryRequest
-	(*QueryResponse)(nil),                // 1: accessgraph.v1alpha.QueryResponse
-	(*GetFileRequest)(nil),               // 2: accessgraph.v1alpha.GetFileRequest
-	(*GetFileResponse)(nil),              // 3: accessgraph.v1alpha.GetFileResponse
-	(*EventsStreamRequest)(nil),          // 4: accessgraph.v1alpha.EventsStreamRequest
-	(*EventsStreamV2Request)(nil),        // 5: accessgraph.v1alpha.EventsStreamV2Request
-	(*SyncOperation)(nil),                // 6: accessgraph.v1alpha.SyncOperation
-	(*EventsStreamResponse)(nil),         // 7: accessgraph.v1alpha.EventsStreamResponse
-	(*EventsStreamV2Response)(nil),       // 8: accessgraph.v1alpha.EventsStreamV2Response
-	(*AuditEvent)(nil),                   // 9: accessgraph.v1alpha.AuditEvent
-	(*AuditLogStreamRequest)(nil),        // 10: accessgraph.v1alpha.AuditLogStreamRequest
-	(*AuditLogConfig)(nil),               // 11: accessgraph.v1alpha.AuditLogConfig
-	(*AuditLogEvents)(nil),               // 12: accessgraph.v1alpha.AuditLogEvents
-	(*SearchResumeState)(nil),            // 13: accessgraph.v1alpha.SearchResumeState
-	(*BulkResumeStateUpdate)(nil),        // 14: accessgraph.v1alpha.BulkResumeStateUpdate
-	(*BulkResumeStateSync)(nil),          // 15: accessgraph.v1alpha.BulkResumeStateSync
-	(*AuditLogStreamResponse)(nil),       // 16: accessgraph.v1alpha.AuditLogStreamResponse
-	(*BulkResumeState)(nil),              // 17: accessgraph.v1alpha.BulkResumeState
-	(*BulkResumeDate)(nil),               // 18: accessgraph.v1alpha.BulkResumeDate
-	(*RegisterRequest)(nil),              // 19: accessgraph.v1alpha.RegisterRequest
-	(*RegisterResponse)(nil),             // 20: accessgraph.v1alpha.RegisterResponse
-	(*ReplaceCAsRequest)(nil),            // 21: accessgraph.v1alpha.ReplaceCAsRequest
-	(*ReplaceCAsResponse)(nil),           // 22: accessgraph.v1alpha.ReplaceCAsResponse
-	(*AWSEventsStreamRequest)(nil),       // 23: accessgraph.v1alpha.AWSEventsStreamRequest
-	(*AWSSyncOperation)(nil),             // 24: accessgraph.v1alpha.AWSSyncOperation
-	(*AWSEventsStreamResponse)(nil),      // 25: accessgraph.v1alpha.AWSEventsStreamResponse
-	(*GitlabEventsStreamRequest)(nil),    // 26: accessgraph.v1alpha.GitlabEventsStreamRequest
-	(*GitlabEventsStreamResponse)(nil),   // 27: accessgraph.v1alpha.GitlabEventsStreamResponse
-	(*EntraEventsStreamRequest)(nil),     // 28: accessgraph.v1alpha.EntraEventsStreamRequest
-	(*EntraEventsStreamResponse)(nil),    // 29: accessgraph.v1alpha.EntraEventsStreamResponse
-	(*AzureEventsStreamRequest)(nil),     // 30: accessgraph.v1alpha.AzureEventsStreamRequest
-	(*AzureSyncOperation)(nil),           // 31: accessgraph.v1alpha.AzureSyncOperation
-	(*AzureEventsStreamResponse)(nil),    // 32: accessgraph.v1alpha.AzureEventsStreamResponse
-	(*NetIQEventsStreamRequest)(nil),     // 33: accessgraph.v1alpha.NetIQEventsStreamRequest
-	(*NetIQSyncOperation)(nil),           // 34: accessgraph.v1alpha.NetIQSyncOperation
-	(*NetIQEventsStreamResponse)(nil),    // 35: accessgraph.v1alpha.NetIQEventsStreamResponse
-	(*AWSCloudTrailStreamRequest)(nil),   // 36: accessgraph.v1alpha.AWSCloudTrailStreamRequest
-	(*AWSCloudTrailEventsFile)(nil),      // 37: accessgraph.v1alpha.AWSCloudTrailEventsFile
-	(*AWSCloudTrailConfig)(nil),          // 38: accessgraph.v1alpha.AWSCloudTrailConfig
-	(*AWSCloudTrailStreamResponse)(nil),  // 39: accessgraph.v1alpha.AWSCloudTrailStreamResponse
-	(*AWSCloudTrailResumeState)(nil),     // 40: accessgraph.v1alpha.AWSCloudTrailResumeState
-	(*AWSCloudTrailEventResource)(nil),   // 41: accessgraph.v1alpha.AWSCloudTrailEventResource
-	(*GitHubAuditLogStreamRequest)(nil),  // 42: accessgraph.v1alpha.GitHubAuditLogStreamRequest
-	(*GitHubAuditLogStreamResponse)(nil), // 43: accessgraph.v1alpha.GitHubAuditLogStreamResponse
-	(*GitHubEventsStreamRequest)(nil),    // 44: accessgraph.v1alpha.GitHubEventsStreamRequest
-	(*GitHubEventsStreamResponse)(nil),   // 45: accessgraph.v1alpha.GitHubEventsStreamResponse
-	(*OktaAuditLogStreamRequest)(nil),    // 46: accessgraph.v1alpha.OktaAuditLogStreamRequest
-	(*OktaAuditLogStreamResponse)(nil),   // 47: accessgraph.v1alpha.OktaAuditLogStreamResponse
-	(*OktaEventsStreamRequest)(nil),      // 48: accessgraph.v1alpha.OktaEventsStreamRequest
-	(*OktaEventsStreamResponse)(nil),     // 49: accessgraph.v1alpha.OktaEventsStreamResponse
-	nil,                                  // 50: accessgraph.v1alpha.BulkResumeDate.ChunkCursorsEntry
-	(*Node)(nil),                         // 51: accessgraph.v1alpha.Node
-	(*Edge)(nil),                         // 52: accessgraph.v1alpha.Edge
-	(*ResourceList)(nil),                 // 53: accessgraph.v1alpha.ResourceList
-	(*ResourceHeaderList)(nil),           // 54: accessgraph.v1alpha.ResourceHeaderList
-	(*AccessListsMembers)(nil),           // 55: accessgraph.v1alpha.AccessListsMembers
-	(*ExcludeAccessListsMembers)(nil),    // 56: accessgraph.v1alpha.ExcludeAccessListsMembers
-	(*AccessPathChanged)(nil),            // 57: accessgraph.v1alpha.AccessPathChanged
-	(*timestamppb.Timestamp)(nil),        // 58: google.protobuf.Timestamp
-	(*v1.EventUnstructured)(nil),         // 59: teleport.auditlog.v1.EventUnstructured
-	(*emptypb.Empty)(nil),                // 60: google.protobuf.Empty
-	(*AWSResourceList)(nil),              // 61: accessgraph.v1alpha.AWSResourceList
-	(*GitlabSyncOperation)(nil),          // 62: accessgraph.v1alpha.GitlabSyncOperation
-	(*GitlabResourceList)(nil),           // 63: accessgraph.v1alpha.GitlabResourceList
-	(*EntraSyncOperation)(nil),           // 64: accessgraph.v1alpha.EntraSyncOperation
-	(*EntraResourceList)(nil),            // 65: accessgraph.v1alpha.EntraResourceList
-	(*AzureResourceList)(nil),            // 66: accessgraph.v1alpha.AzureResourceList
-	(*NetIQResourceList)(nil),            // 67: accessgraph.v1alpha.NetIQResourceList
-	(*GitHubConfigV1)(nil),               // 68: accessgraph.v1alpha.GitHubConfigV1
-	(*GitHubAuditLogV1)(nil),             // 69: accessgraph.v1alpha.GitHubAuditLogV1
-	(*GitHubAuditLogV1Cursor)(nil),       // 70: accessgraph.v1alpha.GitHubAuditLogV1Cursor
-	(*GithubResourceList)(nil),           // 71: accessgraph.v1alpha.GithubResourceList
-	(*GithubSync)(nil),                   // 72: accessgraph.v1alpha.GithubSync
-	(*OktaConfigV1)(nil),                 // 73: accessgraph.v1alpha.OktaConfigV1
-	(*OktaAuditLogV1)(nil),               // 74: accessgraph.v1alpha.OktaAuditLogV1
-	(*OktaAuditLogV1Cursor)(nil),         // 75: accessgraph.v1alpha.OktaAuditLogV1Cursor
-	(*OktaResourceList)(nil),             // 76: accessgraph.v1alpha.OktaResourceList
-	(*OktaSync)(nil),                     // 77: accessgraph.v1alpha.OktaSync
+	(KubeAuditLogCursor_KubeAuditLogSource)(0), // 0: accessgraph.v1alpha.KubeAuditLogCursor.KubeAuditLogSource
+	(*QueryRequest)(nil),                       // 1: accessgraph.v1alpha.QueryRequest
+	(*QueryResponse)(nil),                      // 2: accessgraph.v1alpha.QueryResponse
+	(*GetFileRequest)(nil),                     // 3: accessgraph.v1alpha.GetFileRequest
+	(*GetFileResponse)(nil),                    // 4: accessgraph.v1alpha.GetFileResponse
+	(*EventsStreamRequest)(nil),                // 5: accessgraph.v1alpha.EventsStreamRequest
+	(*EventsStreamV2Request)(nil),              // 6: accessgraph.v1alpha.EventsStreamV2Request
+	(*SyncOperation)(nil),                      // 7: accessgraph.v1alpha.SyncOperation
+	(*EventsStreamResponse)(nil),               // 8: accessgraph.v1alpha.EventsStreamResponse
+	(*EventsStreamV2Response)(nil),             // 9: accessgraph.v1alpha.EventsStreamV2Response
+	(*AuditEvent)(nil),                         // 10: accessgraph.v1alpha.AuditEvent
+	(*AuditLogStreamRequest)(nil),              // 11: accessgraph.v1alpha.AuditLogStreamRequest
+	(*AuditLogConfig)(nil),                     // 12: accessgraph.v1alpha.AuditLogConfig
+	(*AuditLogEvents)(nil),                     // 13: accessgraph.v1alpha.AuditLogEvents
+	(*SearchResumeState)(nil),                  // 14: accessgraph.v1alpha.SearchResumeState
+	(*BulkResumeStateUpdate)(nil),              // 15: accessgraph.v1alpha.BulkResumeStateUpdate
+	(*BulkResumeStateSync)(nil),                // 16: accessgraph.v1alpha.BulkResumeStateSync
+	(*AuditLogStreamResponse)(nil),             // 17: accessgraph.v1alpha.AuditLogStreamResponse
+	(*BulkResumeState)(nil),                    // 18: accessgraph.v1alpha.BulkResumeState
+	(*BulkResumeDate)(nil),                     // 19: accessgraph.v1alpha.BulkResumeDate
+	(*RegisterRequest)(nil),                    // 20: accessgraph.v1alpha.RegisterRequest
+	(*RegisterResponse)(nil),                   // 21: accessgraph.v1alpha.RegisterResponse
+	(*ReplaceCAsRequest)(nil),                  // 22: accessgraph.v1alpha.ReplaceCAsRequest
+	(*ReplaceCAsResponse)(nil),                 // 23: accessgraph.v1alpha.ReplaceCAsResponse
+	(*AWSEventsStreamRequest)(nil),             // 24: accessgraph.v1alpha.AWSEventsStreamRequest
+	(*AWSSyncOperation)(nil),                   // 25: accessgraph.v1alpha.AWSSyncOperation
+	(*AWSEventsStreamResponse)(nil),            // 26: accessgraph.v1alpha.AWSEventsStreamResponse
+	(*GitlabEventsStreamRequest)(nil),          // 27: accessgraph.v1alpha.GitlabEventsStreamRequest
+	(*GitlabEventsStreamResponse)(nil),         // 28: accessgraph.v1alpha.GitlabEventsStreamResponse
+	(*EntraEventsStreamRequest)(nil),           // 29: accessgraph.v1alpha.EntraEventsStreamRequest
+	(*EntraEventsStreamResponse)(nil),          // 30: accessgraph.v1alpha.EntraEventsStreamResponse
+	(*AzureEventsStreamRequest)(nil),           // 31: accessgraph.v1alpha.AzureEventsStreamRequest
+	(*AzureSyncOperation)(nil),                 // 32: accessgraph.v1alpha.AzureSyncOperation
+	(*AzureEventsStreamResponse)(nil),          // 33: accessgraph.v1alpha.AzureEventsStreamResponse
+	(*NetIQEventsStreamRequest)(nil),           // 34: accessgraph.v1alpha.NetIQEventsStreamRequest
+	(*NetIQSyncOperation)(nil),                 // 35: accessgraph.v1alpha.NetIQSyncOperation
+	(*NetIQEventsStreamResponse)(nil),          // 36: accessgraph.v1alpha.NetIQEventsStreamResponse
+	(*AWSCloudTrailStreamRequest)(nil),         // 37: accessgraph.v1alpha.AWSCloudTrailStreamRequest
+	(*AWSCloudTrailEventsFile)(nil),            // 38: accessgraph.v1alpha.AWSCloudTrailEventsFile
+	(*AWSCloudTrailConfig)(nil),                // 39: accessgraph.v1alpha.AWSCloudTrailConfig
+	(*AWSCloudTrailStreamResponse)(nil),        // 40: accessgraph.v1alpha.AWSCloudTrailStreamResponse
+	(*AWSCloudTrailResumeState)(nil),           // 41: accessgraph.v1alpha.AWSCloudTrailResumeState
+	(*AWSCloudTrailEventResource)(nil),         // 42: accessgraph.v1alpha.AWSCloudTrailEventResource
+	(*KubeAuditLogStreamRequest)(nil),          // 43: accessgraph.v1alpha.KubeAuditLogStreamRequest
+	(*KubeAuditLogConfig)(nil),                 // 44: accessgraph.v1alpha.KubeAuditLogConfig
+	(*KubeAuditLogNewStream)(nil),              // 45: accessgraph.v1alpha.KubeAuditLogNewStream
+	(*KubeAuditLogEvents)(nil),                 // 46: accessgraph.v1alpha.KubeAuditLogEvents
+	(*KubeAuditLogCursor)(nil),                 // 47: accessgraph.v1alpha.KubeAuditLogCursor
+	(*KubeAuditLogStreamResponse)(nil),         // 48: accessgraph.v1alpha.KubeAuditLogStreamResponse
+	(*KubeAuditLogResumeState)(nil),            // 49: accessgraph.v1alpha.KubeAuditLogResumeState
+	(*GitHubAuditLogStreamRequest)(nil),        // 50: accessgraph.v1alpha.GitHubAuditLogStreamRequest
+	(*GitHubAuditLogStreamResponse)(nil),       // 51: accessgraph.v1alpha.GitHubAuditLogStreamResponse
+	(*GitHubEventsStreamRequest)(nil),          // 52: accessgraph.v1alpha.GitHubEventsStreamRequest
+	(*GitHubEventsStreamResponse)(nil),         // 53: accessgraph.v1alpha.GitHubEventsStreamResponse
+	(*OktaAuditLogStreamRequest)(nil),          // 54: accessgraph.v1alpha.OktaAuditLogStreamRequest
+	(*OktaAuditLogStreamResponse)(nil),         // 55: accessgraph.v1alpha.OktaAuditLogStreamResponse
+	(*OktaEventsStreamRequest)(nil),            // 56: accessgraph.v1alpha.OktaEventsStreamRequest
+	(*OktaEventsStreamResponse)(nil),           // 57: accessgraph.v1alpha.OktaEventsStreamResponse
+	nil,                                        // 58: accessgraph.v1alpha.BulkResumeDate.ChunkCursorsEntry
+	(*Node)(nil),                               // 59: accessgraph.v1alpha.Node
+	(*Edge)(nil),                               // 60: accessgraph.v1alpha.Edge
+	(*ResourceList)(nil),                       // 61: accessgraph.v1alpha.ResourceList
+	(*ResourceHeaderList)(nil),                 // 62: accessgraph.v1alpha.ResourceHeaderList
+	(*AccessListsMembers)(nil),                 // 63: accessgraph.v1alpha.AccessListsMembers
+	(*ExcludeAccessListsMembers)(nil),          // 64: accessgraph.v1alpha.ExcludeAccessListsMembers
+	(*AccessPathChanged)(nil),                  // 65: accessgraph.v1alpha.AccessPathChanged
+	(*timestamppb.Timestamp)(nil),              // 66: google.protobuf.Timestamp
+	(*v1.EventUnstructured)(nil),               // 67: teleport.auditlog.v1.EventUnstructured
+	(*emptypb.Empty)(nil),                      // 68: google.protobuf.Empty
+	(*AWSResourceList)(nil),                    // 69: accessgraph.v1alpha.AWSResourceList
+	(*GitlabSyncOperation)(nil),                // 70: accessgraph.v1alpha.GitlabSyncOperation
+	(*GitlabResourceList)(nil),                 // 71: accessgraph.v1alpha.GitlabResourceList
+	(*EntraSyncOperation)(nil),                 // 72: accessgraph.v1alpha.EntraSyncOperation
+	(*EntraResourceList)(nil),                  // 73: accessgraph.v1alpha.EntraResourceList
+	(*AzureResourceList)(nil),                  // 74: accessgraph.v1alpha.AzureResourceList
+	(*NetIQResourceList)(nil),                  // 75: accessgraph.v1alpha.NetIQResourceList
+	(*structpb.Struct)(nil),                    // 76: google.protobuf.Struct
+	(*GitHubConfigV1)(nil),                     // 77: accessgraph.v1alpha.GitHubConfigV1
+	(*GitHubAuditLogV1)(nil),                   // 78: accessgraph.v1alpha.GitHubAuditLogV1
+	(*GitHubAuditLogV1Cursor)(nil),             // 79: accessgraph.v1alpha.GitHubAuditLogV1Cursor
+	(*GithubResourceList)(nil),                 // 80: accessgraph.v1alpha.GithubResourceList
+	(*GithubSync)(nil),                         // 81: accessgraph.v1alpha.GithubSync
+	(*OktaConfigV1)(nil),                       // 82: accessgraph.v1alpha.OktaConfigV1
+	(*OktaAuditLogV1)(nil),                     // 83: accessgraph.v1alpha.OktaAuditLogV1
+	(*OktaAuditLogV1Cursor)(nil),               // 84: accessgraph.v1alpha.OktaAuditLogV1Cursor
+	(*OktaResourceList)(nil),                   // 85: accessgraph.v1alpha.OktaResourceList
+	(*OktaSync)(nil),                           // 86: accessgraph.v1alpha.OktaSync
 }
 var file_accessgraph_v1alpha_access_graph_service_proto_depIdxs = []int32{
-	51, // 0: accessgraph.v1alpha.QueryResponse.nodes:type_name -> accessgraph.v1alpha.Node
-	52, // 1: accessgraph.v1alpha.QueryResponse.edges:type_name -> accessgraph.v1alpha.Edge
-	6,  // 2: accessgraph.v1alpha.EventsStreamRequest.sync:type_name -> accessgraph.v1alpha.SyncOperation
-	53, // 3: accessgraph.v1alpha.EventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.ResourceList
-	54, // 4: accessgraph.v1alpha.EventsStreamRequest.delete:type_name -> accessgraph.v1alpha.ResourceHeaderList
-	55, // 5: accessgraph.v1alpha.EventsStreamRequest.access_lists_members:type_name -> accessgraph.v1alpha.AccessListsMembers
-	56, // 6: accessgraph.v1alpha.EventsStreamRequest.exclude_access_list_members:type_name -> accessgraph.v1alpha.ExcludeAccessListsMembers
-	6,  // 7: accessgraph.v1alpha.EventsStreamV2Request.sync:type_name -> accessgraph.v1alpha.SyncOperation
-	53, // 8: accessgraph.v1alpha.EventsStreamV2Request.upsert:type_name -> accessgraph.v1alpha.ResourceList
-	54, // 9: accessgraph.v1alpha.EventsStreamV2Request.delete:type_name -> accessgraph.v1alpha.ResourceHeaderList
-	55, // 10: accessgraph.v1alpha.EventsStreamV2Request.access_lists_members:type_name -> accessgraph.v1alpha.AccessListsMembers
-	56, // 11: accessgraph.v1alpha.EventsStreamV2Request.exclude_access_list_members:type_name -> accessgraph.v1alpha.ExcludeAccessListsMembers
-	9,  // 12: accessgraph.v1alpha.EventsStreamV2Response.event:type_name -> accessgraph.v1alpha.AuditEvent
-	57, // 13: accessgraph.v1alpha.AuditEvent.access_path_changed:type_name -> accessgraph.v1alpha.AccessPathChanged
-	11, // 14: accessgraph.v1alpha.AuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.AuditLogConfig
-	12, // 15: accessgraph.v1alpha.AuditLogStreamRequest.events:type_name -> accessgraph.v1alpha.AuditLogEvents
-	15, // 16: accessgraph.v1alpha.AuditLogStreamRequest.bulk_sync:type_name -> accessgraph.v1alpha.BulkResumeStateSync
-	58, // 17: accessgraph.v1alpha.AuditLogConfig.start_date:type_name -> google.protobuf.Timestamp
-	59, // 18: accessgraph.v1alpha.AuditLogEvents.events:type_name -> teleport.auditlog.v1.EventUnstructured
-	13, // 19: accessgraph.v1alpha.AuditLogEvents.search_resume_state:type_name -> accessgraph.v1alpha.SearchResumeState
-	14, // 20: accessgraph.v1alpha.AuditLogEvents.bulk_resume_state_update:type_name -> accessgraph.v1alpha.BulkResumeStateUpdate
-	58, // 21: accessgraph.v1alpha.SearchResumeState.last_event_time:type_name -> google.protobuf.Timestamp
-	58, // 22: accessgraph.v1alpha.BulkResumeStateUpdate.date:type_name -> google.protobuf.Timestamp
-	58, // 23: accessgraph.v1alpha.BulkResumeStateSync.active_dates:type_name -> google.protobuf.Timestamp
-	11, // 24: accessgraph.v1alpha.AuditLogStreamResponse.audit_log_config:type_name -> accessgraph.v1alpha.AuditLogConfig
-	60, // 25: accessgraph.v1alpha.AuditLogStreamResponse.no_resume_state:type_name -> google.protobuf.Empty
-	13, // 26: accessgraph.v1alpha.AuditLogStreamResponse.search_resume_state:type_name -> accessgraph.v1alpha.SearchResumeState
-	17, // 27: accessgraph.v1alpha.AuditLogStreamResponse.bulk_resume_state:type_name -> accessgraph.v1alpha.BulkResumeState
-	18, // 28: accessgraph.v1alpha.BulkResumeState.dates:type_name -> accessgraph.v1alpha.BulkResumeDate
-	58, // 29: accessgraph.v1alpha.BulkResumeDate.date:type_name -> google.protobuf.Timestamp
-	50, // 30: accessgraph.v1alpha.BulkResumeDate.chunk_cursors:type_name -> accessgraph.v1alpha.BulkResumeDate.ChunkCursorsEntry
-	24, // 31: accessgraph.v1alpha.AWSEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.AWSSyncOperation
-	61, // 32: accessgraph.v1alpha.AWSEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.AWSResourceList
-	61, // 33: accessgraph.v1alpha.AWSEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.AWSResourceList
-	62, // 34: accessgraph.v1alpha.GitlabEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.GitlabSyncOperation
-	63, // 35: accessgraph.v1alpha.GitlabEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.GitlabResourceList
-	63, // 36: accessgraph.v1alpha.GitlabEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.GitlabResourceList
-	64, // 37: accessgraph.v1alpha.EntraEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.EntraSyncOperation
-	65, // 38: accessgraph.v1alpha.EntraEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.EntraResourceList
-	65, // 39: accessgraph.v1alpha.EntraEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.EntraResourceList
-	31, // 40: accessgraph.v1alpha.AzureEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.AzureSyncOperation
-	66, // 41: accessgraph.v1alpha.AzureEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.AzureResourceList
-	66, // 42: accessgraph.v1alpha.AzureEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.AzureResourceList
-	34, // 43: accessgraph.v1alpha.NetIQEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.NetIQSyncOperation
-	67, // 44: accessgraph.v1alpha.NetIQEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.NetIQResourceList
-	67, // 45: accessgraph.v1alpha.NetIQEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.NetIQResourceList
-	38, // 46: accessgraph.v1alpha.AWSCloudTrailStreamRequest.config:type_name -> accessgraph.v1alpha.AWSCloudTrailConfig
-	37, // 47: accessgraph.v1alpha.AWSCloudTrailStreamRequest.events_file:type_name -> accessgraph.v1alpha.AWSCloudTrailEventsFile
-	38, // 48: accessgraph.v1alpha.AWSCloudTrailStreamResponse.cloud_trail_config:type_name -> accessgraph.v1alpha.AWSCloudTrailConfig
-	40, // 49: accessgraph.v1alpha.AWSCloudTrailStreamResponse.resume_state:type_name -> accessgraph.v1alpha.AWSCloudTrailResumeState
-	68, // 50: accessgraph.v1alpha.GitHubAuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.GitHubConfigV1
-	69, // 51: accessgraph.v1alpha.GitHubAuditLogStreamRequest.audit_log:type_name -> accessgraph.v1alpha.GitHubAuditLogV1
-	68, // 52: accessgraph.v1alpha.GitHubAuditLogStreamResponse.github_config:type_name -> accessgraph.v1alpha.GitHubConfigV1
-	70, // 53: accessgraph.v1alpha.GitHubAuditLogStreamResponse.audit_log_resume_state:type_name -> accessgraph.v1alpha.GitHubAuditLogV1Cursor
-	71, // 54: accessgraph.v1alpha.GitHubEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.GithubResourceList
-	71, // 55: accessgraph.v1alpha.GitHubEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.GithubResourceList
-	72, // 56: accessgraph.v1alpha.GitHubEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.GithubSync
-	73, // 57: accessgraph.v1alpha.OktaAuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.OktaConfigV1
-	74, // 58: accessgraph.v1alpha.OktaAuditLogStreamRequest.audit_log:type_name -> accessgraph.v1alpha.OktaAuditLogV1
-	73, // 59: accessgraph.v1alpha.OktaAuditLogStreamResponse.config:type_name -> accessgraph.v1alpha.OktaConfigV1
-	75, // 60: accessgraph.v1alpha.OktaAuditLogStreamResponse.audit_log_resume_state:type_name -> accessgraph.v1alpha.OktaAuditLogV1Cursor
-	76, // 61: accessgraph.v1alpha.OktaEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.OktaResourceList
-	76, // 62: accessgraph.v1alpha.OktaEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.OktaResourceList
-	77, // 63: accessgraph.v1alpha.OktaEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.OktaSync
-	0,  // 64: accessgraph.v1alpha.AccessGraphService.Query:input_type -> accessgraph.v1alpha.QueryRequest
-	2,  // 65: accessgraph.v1alpha.AccessGraphService.GetFile:input_type -> accessgraph.v1alpha.GetFileRequest
-	4,  // 66: accessgraph.v1alpha.AccessGraphService.EventsStream:input_type -> accessgraph.v1alpha.EventsStreamRequest
-	5,  // 67: accessgraph.v1alpha.AccessGraphService.EventsStreamV2:input_type -> accessgraph.v1alpha.EventsStreamV2Request
-	10, // 68: accessgraph.v1alpha.AccessGraphService.AuditLogStream:input_type -> accessgraph.v1alpha.AuditLogStreamRequest
-	36, // 69: accessgraph.v1alpha.AccessGraphService.AWSCloudTrailStream:input_type -> accessgraph.v1alpha.AWSCloudTrailStreamRequest
-	19, // 70: accessgraph.v1alpha.AccessGraphService.Register:input_type -> accessgraph.v1alpha.RegisterRequest
-	21, // 71: accessgraph.v1alpha.AccessGraphService.ReplaceCAs:input_type -> accessgraph.v1alpha.ReplaceCAsRequest
-	23, // 72: accessgraph.v1alpha.AccessGraphService.AWSEventsStream:input_type -> accessgraph.v1alpha.AWSEventsStreamRequest
-	26, // 73: accessgraph.v1alpha.AccessGraphService.GitlabEventsStream:input_type -> accessgraph.v1alpha.GitlabEventsStreamRequest
-	28, // 74: accessgraph.v1alpha.AccessGraphService.EntraEventsStream:input_type -> accessgraph.v1alpha.EntraEventsStreamRequest
-	30, // 75: accessgraph.v1alpha.AccessGraphService.AzureEventsStream:input_type -> accessgraph.v1alpha.AzureEventsStreamRequest
-	33, // 76: accessgraph.v1alpha.AccessGraphService.NetIQEventsStream:input_type -> accessgraph.v1alpha.NetIQEventsStreamRequest
-	42, // 77: accessgraph.v1alpha.AccessGraphService.GitHubAuditLogStream:input_type -> accessgraph.v1alpha.GitHubAuditLogStreamRequest
-	44, // 78: accessgraph.v1alpha.AccessGraphService.GitHubEventsStream:input_type -> accessgraph.v1alpha.GitHubEventsStreamRequest
-	46, // 79: accessgraph.v1alpha.AccessGraphService.OktaAuditLogStream:input_type -> accessgraph.v1alpha.OktaAuditLogStreamRequest
-	48, // 80: accessgraph.v1alpha.AccessGraphService.OktaEventsStream:input_type -> accessgraph.v1alpha.OktaEventsStreamRequest
-	1,  // 81: accessgraph.v1alpha.AccessGraphService.Query:output_type -> accessgraph.v1alpha.QueryResponse
-	3,  // 82: accessgraph.v1alpha.AccessGraphService.GetFile:output_type -> accessgraph.v1alpha.GetFileResponse
-	7,  // 83: accessgraph.v1alpha.AccessGraphService.EventsStream:output_type -> accessgraph.v1alpha.EventsStreamResponse
-	8,  // 84: accessgraph.v1alpha.AccessGraphService.EventsStreamV2:output_type -> accessgraph.v1alpha.EventsStreamV2Response
-	16, // 85: accessgraph.v1alpha.AccessGraphService.AuditLogStream:output_type -> accessgraph.v1alpha.AuditLogStreamResponse
-	39, // 86: accessgraph.v1alpha.AccessGraphService.AWSCloudTrailStream:output_type -> accessgraph.v1alpha.AWSCloudTrailStreamResponse
-	20, // 87: accessgraph.v1alpha.AccessGraphService.Register:output_type -> accessgraph.v1alpha.RegisterResponse
-	22, // 88: accessgraph.v1alpha.AccessGraphService.ReplaceCAs:output_type -> accessgraph.v1alpha.ReplaceCAsResponse
-	25, // 89: accessgraph.v1alpha.AccessGraphService.AWSEventsStream:output_type -> accessgraph.v1alpha.AWSEventsStreamResponse
-	27, // 90: accessgraph.v1alpha.AccessGraphService.GitlabEventsStream:output_type -> accessgraph.v1alpha.GitlabEventsStreamResponse
-	29, // 91: accessgraph.v1alpha.AccessGraphService.EntraEventsStream:output_type -> accessgraph.v1alpha.EntraEventsStreamResponse
-	32, // 92: accessgraph.v1alpha.AccessGraphService.AzureEventsStream:output_type -> accessgraph.v1alpha.AzureEventsStreamResponse
-	35, // 93: accessgraph.v1alpha.AccessGraphService.NetIQEventsStream:output_type -> accessgraph.v1alpha.NetIQEventsStreamResponse
-	43, // 94: accessgraph.v1alpha.AccessGraphService.GitHubAuditLogStream:output_type -> accessgraph.v1alpha.GitHubAuditLogStreamResponse
-	45, // 95: accessgraph.v1alpha.AccessGraphService.GitHubEventsStream:output_type -> accessgraph.v1alpha.GitHubEventsStreamResponse
-	47, // 96: accessgraph.v1alpha.AccessGraphService.OktaAuditLogStream:output_type -> accessgraph.v1alpha.OktaAuditLogStreamResponse
-	49, // 97: accessgraph.v1alpha.AccessGraphService.OktaEventsStream:output_type -> accessgraph.v1alpha.OktaEventsStreamResponse
-	81, // [81:98] is the sub-list for method output_type
-	64, // [64:81] is the sub-list for method input_type
-	64, // [64:64] is the sub-list for extension type_name
-	64, // [64:64] is the sub-list for extension extendee
-	0,  // [0:64] is the sub-list for field type_name
+	59, // 0: accessgraph.v1alpha.QueryResponse.nodes:type_name -> accessgraph.v1alpha.Node
+	60, // 1: accessgraph.v1alpha.QueryResponse.edges:type_name -> accessgraph.v1alpha.Edge
+	7,  // 2: accessgraph.v1alpha.EventsStreamRequest.sync:type_name -> accessgraph.v1alpha.SyncOperation
+	61, // 3: accessgraph.v1alpha.EventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.ResourceList
+	62, // 4: accessgraph.v1alpha.EventsStreamRequest.delete:type_name -> accessgraph.v1alpha.ResourceHeaderList
+	63, // 5: accessgraph.v1alpha.EventsStreamRequest.access_lists_members:type_name -> accessgraph.v1alpha.AccessListsMembers
+	64, // 6: accessgraph.v1alpha.EventsStreamRequest.exclude_access_list_members:type_name -> accessgraph.v1alpha.ExcludeAccessListsMembers
+	7,  // 7: accessgraph.v1alpha.EventsStreamV2Request.sync:type_name -> accessgraph.v1alpha.SyncOperation
+	61, // 8: accessgraph.v1alpha.EventsStreamV2Request.upsert:type_name -> accessgraph.v1alpha.ResourceList
+	62, // 9: accessgraph.v1alpha.EventsStreamV2Request.delete:type_name -> accessgraph.v1alpha.ResourceHeaderList
+	63, // 10: accessgraph.v1alpha.EventsStreamV2Request.access_lists_members:type_name -> accessgraph.v1alpha.AccessListsMembers
+	64, // 11: accessgraph.v1alpha.EventsStreamV2Request.exclude_access_list_members:type_name -> accessgraph.v1alpha.ExcludeAccessListsMembers
+	10, // 12: accessgraph.v1alpha.EventsStreamV2Response.event:type_name -> accessgraph.v1alpha.AuditEvent
+	65, // 13: accessgraph.v1alpha.AuditEvent.access_path_changed:type_name -> accessgraph.v1alpha.AccessPathChanged
+	12, // 14: accessgraph.v1alpha.AuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.AuditLogConfig
+	13, // 15: accessgraph.v1alpha.AuditLogStreamRequest.events:type_name -> accessgraph.v1alpha.AuditLogEvents
+	16, // 16: accessgraph.v1alpha.AuditLogStreamRequest.bulk_sync:type_name -> accessgraph.v1alpha.BulkResumeStateSync
+	66, // 17: accessgraph.v1alpha.AuditLogConfig.start_date:type_name -> google.protobuf.Timestamp
+	67, // 18: accessgraph.v1alpha.AuditLogEvents.events:type_name -> teleport.auditlog.v1.EventUnstructured
+	14, // 19: accessgraph.v1alpha.AuditLogEvents.search_resume_state:type_name -> accessgraph.v1alpha.SearchResumeState
+	15, // 20: accessgraph.v1alpha.AuditLogEvents.bulk_resume_state_update:type_name -> accessgraph.v1alpha.BulkResumeStateUpdate
+	66, // 21: accessgraph.v1alpha.SearchResumeState.last_event_time:type_name -> google.protobuf.Timestamp
+	66, // 22: accessgraph.v1alpha.BulkResumeStateUpdate.date:type_name -> google.protobuf.Timestamp
+	66, // 23: accessgraph.v1alpha.BulkResumeStateSync.active_dates:type_name -> google.protobuf.Timestamp
+	12, // 24: accessgraph.v1alpha.AuditLogStreamResponse.audit_log_config:type_name -> accessgraph.v1alpha.AuditLogConfig
+	68, // 25: accessgraph.v1alpha.AuditLogStreamResponse.no_resume_state:type_name -> google.protobuf.Empty
+	14, // 26: accessgraph.v1alpha.AuditLogStreamResponse.search_resume_state:type_name -> accessgraph.v1alpha.SearchResumeState
+	18, // 27: accessgraph.v1alpha.AuditLogStreamResponse.bulk_resume_state:type_name -> accessgraph.v1alpha.BulkResumeState
+	19, // 28: accessgraph.v1alpha.BulkResumeState.dates:type_name -> accessgraph.v1alpha.BulkResumeDate
+	66, // 29: accessgraph.v1alpha.BulkResumeDate.date:type_name -> google.protobuf.Timestamp
+	58, // 30: accessgraph.v1alpha.BulkResumeDate.chunk_cursors:type_name -> accessgraph.v1alpha.BulkResumeDate.ChunkCursorsEntry
+	25, // 31: accessgraph.v1alpha.AWSEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.AWSSyncOperation
+	69, // 32: accessgraph.v1alpha.AWSEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.AWSResourceList
+	69, // 33: accessgraph.v1alpha.AWSEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.AWSResourceList
+	70, // 34: accessgraph.v1alpha.GitlabEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.GitlabSyncOperation
+	71, // 35: accessgraph.v1alpha.GitlabEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.GitlabResourceList
+	71, // 36: accessgraph.v1alpha.GitlabEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.GitlabResourceList
+	72, // 37: accessgraph.v1alpha.EntraEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.EntraSyncOperation
+	73, // 38: accessgraph.v1alpha.EntraEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.EntraResourceList
+	73, // 39: accessgraph.v1alpha.EntraEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.EntraResourceList
+	32, // 40: accessgraph.v1alpha.AzureEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.AzureSyncOperation
+	74, // 41: accessgraph.v1alpha.AzureEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.AzureResourceList
+	74, // 42: accessgraph.v1alpha.AzureEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.AzureResourceList
+	35, // 43: accessgraph.v1alpha.NetIQEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.NetIQSyncOperation
+	75, // 44: accessgraph.v1alpha.NetIQEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.NetIQResourceList
+	75, // 45: accessgraph.v1alpha.NetIQEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.NetIQResourceList
+	39, // 46: accessgraph.v1alpha.AWSCloudTrailStreamRequest.config:type_name -> accessgraph.v1alpha.AWSCloudTrailConfig
+	38, // 47: accessgraph.v1alpha.AWSCloudTrailStreamRequest.events_file:type_name -> accessgraph.v1alpha.AWSCloudTrailEventsFile
+	39, // 48: accessgraph.v1alpha.AWSCloudTrailStreamResponse.cloud_trail_config:type_name -> accessgraph.v1alpha.AWSCloudTrailConfig
+	41, // 49: accessgraph.v1alpha.AWSCloudTrailStreamResponse.resume_state:type_name -> accessgraph.v1alpha.AWSCloudTrailResumeState
+	44, // 50: accessgraph.v1alpha.KubeAuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.KubeAuditLogConfig
+	45, // 51: accessgraph.v1alpha.KubeAuditLogStreamRequest.new_stream:type_name -> accessgraph.v1alpha.KubeAuditLogNewStream
+	46, // 52: accessgraph.v1alpha.KubeAuditLogStreamRequest.events:type_name -> accessgraph.v1alpha.KubeAuditLogEvents
+	47, // 53: accessgraph.v1alpha.KubeAuditLogNewStream.initial:type_name -> accessgraph.v1alpha.KubeAuditLogCursor
+	76, // 54: accessgraph.v1alpha.KubeAuditLogEvents.events:type_name -> google.protobuf.Struct
+	47, // 55: accessgraph.v1alpha.KubeAuditLogEvents.cursor:type_name -> accessgraph.v1alpha.KubeAuditLogCursor
+	0,  // 56: accessgraph.v1alpha.KubeAuditLogCursor.log_source:type_name -> accessgraph.v1alpha.KubeAuditLogCursor.KubeAuditLogSource
+	66, // 57: accessgraph.v1alpha.KubeAuditLogCursor.last_event_time:type_name -> google.protobuf.Timestamp
+	44, // 58: accessgraph.v1alpha.KubeAuditLogStreamResponse.config:type_name -> accessgraph.v1alpha.KubeAuditLogConfig
+	49, // 59: accessgraph.v1alpha.KubeAuditLogStreamResponse.resume_state:type_name -> accessgraph.v1alpha.KubeAuditLogResumeState
+	47, // 60: accessgraph.v1alpha.KubeAuditLogResumeState.cursor:type_name -> accessgraph.v1alpha.KubeAuditLogCursor
+	77, // 61: accessgraph.v1alpha.GitHubAuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.GitHubConfigV1
+	78, // 62: accessgraph.v1alpha.GitHubAuditLogStreamRequest.audit_log:type_name -> accessgraph.v1alpha.GitHubAuditLogV1
+	77, // 63: accessgraph.v1alpha.GitHubAuditLogStreamResponse.github_config:type_name -> accessgraph.v1alpha.GitHubConfigV1
+	79, // 64: accessgraph.v1alpha.GitHubAuditLogStreamResponse.audit_log_resume_state:type_name -> accessgraph.v1alpha.GitHubAuditLogV1Cursor
+	80, // 65: accessgraph.v1alpha.GitHubEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.GithubResourceList
+	80, // 66: accessgraph.v1alpha.GitHubEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.GithubResourceList
+	81, // 67: accessgraph.v1alpha.GitHubEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.GithubSync
+	82, // 68: accessgraph.v1alpha.OktaAuditLogStreamRequest.config:type_name -> accessgraph.v1alpha.OktaConfigV1
+	83, // 69: accessgraph.v1alpha.OktaAuditLogStreamRequest.audit_log:type_name -> accessgraph.v1alpha.OktaAuditLogV1
+	82, // 70: accessgraph.v1alpha.OktaAuditLogStreamResponse.config:type_name -> accessgraph.v1alpha.OktaConfigV1
+	84, // 71: accessgraph.v1alpha.OktaAuditLogStreamResponse.audit_log_resume_state:type_name -> accessgraph.v1alpha.OktaAuditLogV1Cursor
+	85, // 72: accessgraph.v1alpha.OktaEventsStreamRequest.upsert:type_name -> accessgraph.v1alpha.OktaResourceList
+	85, // 73: accessgraph.v1alpha.OktaEventsStreamRequest.delete:type_name -> accessgraph.v1alpha.OktaResourceList
+	86, // 74: accessgraph.v1alpha.OktaEventsStreamRequest.sync:type_name -> accessgraph.v1alpha.OktaSync
+	1,  // 75: accessgraph.v1alpha.AccessGraphService.Query:input_type -> accessgraph.v1alpha.QueryRequest
+	3,  // 76: accessgraph.v1alpha.AccessGraphService.GetFile:input_type -> accessgraph.v1alpha.GetFileRequest
+	5,  // 77: accessgraph.v1alpha.AccessGraphService.EventsStream:input_type -> accessgraph.v1alpha.EventsStreamRequest
+	6,  // 78: accessgraph.v1alpha.AccessGraphService.EventsStreamV2:input_type -> accessgraph.v1alpha.EventsStreamV2Request
+	11, // 79: accessgraph.v1alpha.AccessGraphService.AuditLogStream:input_type -> accessgraph.v1alpha.AuditLogStreamRequest
+	37, // 80: accessgraph.v1alpha.AccessGraphService.AWSCloudTrailStream:input_type -> accessgraph.v1alpha.AWSCloudTrailStreamRequest
+	43, // 81: accessgraph.v1alpha.AccessGraphService.KubeAuditLogStream:input_type -> accessgraph.v1alpha.KubeAuditLogStreamRequest
+	20, // 82: accessgraph.v1alpha.AccessGraphService.Register:input_type -> accessgraph.v1alpha.RegisterRequest
+	22, // 83: accessgraph.v1alpha.AccessGraphService.ReplaceCAs:input_type -> accessgraph.v1alpha.ReplaceCAsRequest
+	24, // 84: accessgraph.v1alpha.AccessGraphService.AWSEventsStream:input_type -> accessgraph.v1alpha.AWSEventsStreamRequest
+	27, // 85: accessgraph.v1alpha.AccessGraphService.GitlabEventsStream:input_type -> accessgraph.v1alpha.GitlabEventsStreamRequest
+	29, // 86: accessgraph.v1alpha.AccessGraphService.EntraEventsStream:input_type -> accessgraph.v1alpha.EntraEventsStreamRequest
+	31, // 87: accessgraph.v1alpha.AccessGraphService.AzureEventsStream:input_type -> accessgraph.v1alpha.AzureEventsStreamRequest
+	34, // 88: accessgraph.v1alpha.AccessGraphService.NetIQEventsStream:input_type -> accessgraph.v1alpha.NetIQEventsStreamRequest
+	50, // 89: accessgraph.v1alpha.AccessGraphService.GitHubAuditLogStream:input_type -> accessgraph.v1alpha.GitHubAuditLogStreamRequest
+	52, // 90: accessgraph.v1alpha.AccessGraphService.GitHubEventsStream:input_type -> accessgraph.v1alpha.GitHubEventsStreamRequest
+	54, // 91: accessgraph.v1alpha.AccessGraphService.OktaAuditLogStream:input_type -> accessgraph.v1alpha.OktaAuditLogStreamRequest
+	56, // 92: accessgraph.v1alpha.AccessGraphService.OktaEventsStream:input_type -> accessgraph.v1alpha.OktaEventsStreamRequest
+	2,  // 93: accessgraph.v1alpha.AccessGraphService.Query:output_type -> accessgraph.v1alpha.QueryResponse
+	4,  // 94: accessgraph.v1alpha.AccessGraphService.GetFile:output_type -> accessgraph.v1alpha.GetFileResponse
+	8,  // 95: accessgraph.v1alpha.AccessGraphService.EventsStream:output_type -> accessgraph.v1alpha.EventsStreamResponse
+	9,  // 96: accessgraph.v1alpha.AccessGraphService.EventsStreamV2:output_type -> accessgraph.v1alpha.EventsStreamV2Response
+	17, // 97: accessgraph.v1alpha.AccessGraphService.AuditLogStream:output_type -> accessgraph.v1alpha.AuditLogStreamResponse
+	40, // 98: accessgraph.v1alpha.AccessGraphService.AWSCloudTrailStream:output_type -> accessgraph.v1alpha.AWSCloudTrailStreamResponse
+	48, // 99: accessgraph.v1alpha.AccessGraphService.KubeAuditLogStream:output_type -> accessgraph.v1alpha.KubeAuditLogStreamResponse
+	21, // 100: accessgraph.v1alpha.AccessGraphService.Register:output_type -> accessgraph.v1alpha.RegisterResponse
+	23, // 101: accessgraph.v1alpha.AccessGraphService.ReplaceCAs:output_type -> accessgraph.v1alpha.ReplaceCAsResponse
+	26, // 102: accessgraph.v1alpha.AccessGraphService.AWSEventsStream:output_type -> accessgraph.v1alpha.AWSEventsStreamResponse
+	28, // 103: accessgraph.v1alpha.AccessGraphService.GitlabEventsStream:output_type -> accessgraph.v1alpha.GitlabEventsStreamResponse
+	30, // 104: accessgraph.v1alpha.AccessGraphService.EntraEventsStream:output_type -> accessgraph.v1alpha.EntraEventsStreamResponse
+	33, // 105: accessgraph.v1alpha.AccessGraphService.AzureEventsStream:output_type -> accessgraph.v1alpha.AzureEventsStreamResponse
+	36, // 106: accessgraph.v1alpha.AccessGraphService.NetIQEventsStream:output_type -> accessgraph.v1alpha.NetIQEventsStreamResponse
+	51, // 107: accessgraph.v1alpha.AccessGraphService.GitHubAuditLogStream:output_type -> accessgraph.v1alpha.GitHubAuditLogStreamResponse
+	53, // 108: accessgraph.v1alpha.AccessGraphService.GitHubEventsStream:output_type -> accessgraph.v1alpha.GitHubEventsStreamResponse
+	55, // 109: accessgraph.v1alpha.AccessGraphService.OktaAuditLogStream:output_type -> accessgraph.v1alpha.OktaAuditLogStreamResponse
+	57, // 110: accessgraph.v1alpha.AccessGraphService.OktaEventsStream:output_type -> accessgraph.v1alpha.OktaEventsStreamResponse
+	93, // [93:111] is the sub-list for method output_type
+	75, // [75:93] is the sub-list for method input_type
+	75, // [75:75] is the sub-list for extension type_name
+	75, // [75:75] is the sub-list for extension extendee
+	0,  // [0:75] is the sub-list for field type_name
 }
 
 func init() { file_accessgraph_v1alpha_access_graph_service_proto_init() }
@@ -3894,27 +4494,36 @@ func file_accessgraph_v1alpha_access_graph_service_proto_init() {
 		(*AWSCloudTrailStreamResponse_ResumeState)(nil),
 	}
 	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[42].OneofWrappers = []any{
+		(*KubeAuditLogStreamRequest_Config)(nil),
+		(*KubeAuditLogStreamRequest_NewStream)(nil),
+		(*KubeAuditLogStreamRequest_Events)(nil),
+	}
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47].OneofWrappers = []any{
+		(*KubeAuditLogStreamResponse_Config)(nil),
+		(*KubeAuditLogStreamResponse_ResumeState)(nil),
+	}
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[49].OneofWrappers = []any{
 		(*GitHubAuditLogStreamRequest_Config)(nil),
 		(*GitHubAuditLogStreamRequest_AuditLog)(nil),
 	}
-	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[43].OneofWrappers = []any{
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[50].OneofWrappers = []any{
 		(*GitHubAuditLogStreamResponse_GithubConfig)(nil),
 		(*GitHubAuditLogStreamResponse_AuditLogResumeState)(nil),
 	}
-	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[44].OneofWrappers = []any{
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[51].OneofWrappers = []any{
 		(*GitHubEventsStreamRequest_Upsert)(nil),
 		(*GitHubEventsStreamRequest_Delete)(nil),
 		(*GitHubEventsStreamRequest_Sync)(nil),
 	}
-	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[46].OneofWrappers = []any{
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[53].OneofWrappers = []any{
 		(*OktaAuditLogStreamRequest_Config)(nil),
 		(*OktaAuditLogStreamRequest_AuditLog)(nil),
 	}
-	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[47].OneofWrappers = []any{
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[54].OneofWrappers = []any{
 		(*OktaAuditLogStreamResponse_Config)(nil),
 		(*OktaAuditLogStreamResponse_AuditLogResumeState)(nil),
 	}
-	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[48].OneofWrappers = []any{
+	file_accessgraph_v1alpha_access_graph_service_proto_msgTypes[55].OneofWrappers = []any{
 		(*OktaEventsStreamRequest_Upsert)(nil),
 		(*OktaEventsStreamRequest_Delete)(nil),
 		(*OktaEventsStreamRequest_Sync)(nil),
@@ -3924,13 +4533,14 @@ func file_accessgraph_v1alpha_access_graph_service_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_accessgraph_v1alpha_access_graph_service_proto_rawDesc), len(file_accessgraph_v1alpha_access_graph_service_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   51,
+			NumEnums:      1,
+			NumMessages:   58,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
 		GoTypes:           file_accessgraph_v1alpha_access_graph_service_proto_goTypes,
 		DependencyIndexes: file_accessgraph_v1alpha_access_graph_service_proto_depIdxs,
+		EnumInfos:         file_accessgraph_v1alpha_access_graph_service_proto_enumTypes,
 		MessageInfos:      file_accessgraph_v1alpha_access_graph_service_proto_msgTypes,
 	}.Build()
 	File_accessgraph_v1alpha_access_graph_service_proto = out.File
diff --git a/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go b/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
index 265fd60072b58..6736c22648ee6 100644
--- a/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
@@ -42,6 +42,7 @@ const (
 	AccessGraphService_EventsStreamV2_FullMethodName       = "/accessgraph.v1alpha.AccessGraphService/EventsStreamV2"
 	AccessGraphService_AuditLogStream_FullMethodName       = "/accessgraph.v1alpha.AccessGraphService/AuditLogStream"
 	AccessGraphService_AWSCloudTrailStream_FullMethodName  = "/accessgraph.v1alpha.AccessGraphService/AWSCloudTrailStream"
+	AccessGraphService_KubeAuditLogStream_FullMethodName   = "/accessgraph.v1alpha.AccessGraphService/KubeAuditLogStream"
 	AccessGraphService_Register_FullMethodName             = "/accessgraph.v1alpha.AccessGraphService/Register"
 	AccessGraphService_ReplaceCAs_FullMethodName           = "/accessgraph.v1alpha.AccessGraphService/ReplaceCAs"
 	AccessGraphService_AWSEventsStream_FullMethodName      = "/accessgraph.v1alpha.AccessGraphService/AWSEventsStream"
@@ -111,6 +112,31 @@ type AccessGraphServiceClient interface {
 	//  3. Server sends second response providing the starting `resume_state` (possilby empty).
 	//  4. Client sends subsequent `AWSCloudTrailStreamRequest` messages.
 	AWSCloudTrailStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[AWSCloudTrailStreamRequest, AWSCloudTrailStreamResponse], error)
+	// KubeAuditLogStream establishes a persistent bidirectional stream for exporting
+	// Kubernetes audit logs from a client (teleport) to a server (access-graph). This stream
+	// is separate from other audit log streams as fetching Kubernetes audit logs can
+	// require a variety of mechanisms for retrieving them depending on how/where the
+	// k8s cluster is deployed. It often will not make sense to integrate this audit log
+	// stream with any of the others.
+	//
+	// This stream facilitates:
+	// - Initial configuration exchange and validation.
+	// - Streaming batches of audit log events from client to server.
+	// - Reliable export resumption via client-provided resume state updates.
+	// - Logs for multiple clusters can be streamed across the one grpc stream.
+	//
+	// Basic Interaction Flow:
+	//  1. Client connects and sends an initial `KubeAuditLogStreamRequest` with `config`.
+	//  2. Server responds with an initial `KubeAuditLogStreamResponse`, confirming the
+	//     effective configuration.
+	//  3. Client sends a `KubeAuditLogNewStream` message initiating a log stream for
+	//     a cluster, with a timestamp of the oldest logs it wants.
+	//  4. Server responds with a `KubeAuditLogResumeState` message containing either
+	//     a resumption cursor indicating when logs should be streamed from, or if
+	//     a new cluster or an old outdated resumption point has been stored, sends
+	//     the timestamp from which logs should be sent.
+	//  5. Client sends subsequent `KubeAuditLogStreamRequest` messages with new logs.
+	KubeAuditLogStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse], error)
 	// Register submits a new tenant representing this Teleport cluster to the TAG service,
 	// identified by its HostCA certificate.
 	// The method is idempotent: it succeeds if the tenant has already registered and has the specific CA associated.
@@ -269,6 +295,19 @@ func (c *accessGraphServiceClient) AWSCloudTrailStream(ctx context.Context, opts
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type AccessGraphService_AWSCloudTrailStreamClient = grpc.BidiStreamingClient[AWSCloudTrailStreamRequest, AWSCloudTrailStreamResponse]
 
+func (c *accessGraphServiceClient) KubeAuditLogStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[4], AccessGraphService_KubeAuditLogStream_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]{ClientStream: stream}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type AccessGraphService_KubeAuditLogStreamClient = grpc.BidiStreamingClient[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]
+
 func (c *accessGraphServiceClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RegisterResponse)
@@ -291,7 +330,7 @@ func (c *accessGraphServiceClient) ReplaceCAs(ctx context.Context, in *ReplaceCA
 
 func (c *accessGraphServiceClient) AWSEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[AWSEventsStreamRequest, AWSEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[4], AccessGraphService_AWSEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[5], AccessGraphService_AWSEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -304,7 +343,7 @@ type AccessGraphService_AWSEventsStreamClient = grpc.ClientStreamingClient[AWSEv
 
 func (c *accessGraphServiceClient) GitlabEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[GitlabEventsStreamRequest, GitlabEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[5], AccessGraphService_GitlabEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[6], AccessGraphService_GitlabEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -317,7 +356,7 @@ type AccessGraphService_GitlabEventsStreamClient = grpc.BidiStreamingClient[Gitl
 
 func (c *accessGraphServiceClient) EntraEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[EntraEventsStreamRequest, EntraEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[6], AccessGraphService_EntraEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[7], AccessGraphService_EntraEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -330,7 +369,7 @@ type AccessGraphService_EntraEventsStreamClient = grpc.BidiStreamingClient[Entra
 
 func (c *accessGraphServiceClient) AzureEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[AzureEventsStreamRequest, AzureEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[7], AccessGraphService_AzureEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[8], AccessGraphService_AzureEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -343,7 +382,7 @@ type AccessGraphService_AzureEventsStreamClient = grpc.BidiStreamingClient[Azure
 
 func (c *accessGraphServiceClient) NetIQEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[NetIQEventsStreamRequest, NetIQEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[8], AccessGraphService_NetIQEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[9], AccessGraphService_NetIQEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -356,7 +395,7 @@ type AccessGraphService_NetIQEventsStreamClient = grpc.BidiStreamingClient[NetIQ
 
 func (c *accessGraphServiceClient) GitHubAuditLogStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[GitHubAuditLogStreamRequest, GitHubAuditLogStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[9], AccessGraphService_GitHubAuditLogStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[10], AccessGraphService_GitHubAuditLogStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -369,7 +408,7 @@ type AccessGraphService_GitHubAuditLogStreamClient = grpc.BidiStreamingClient[Gi
 
 func (c *accessGraphServiceClient) GitHubEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[GitHubEventsStreamRequest, GitHubEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[10], AccessGraphService_GitHubEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[11], AccessGraphService_GitHubEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -382,7 +421,7 @@ type AccessGraphService_GitHubEventsStreamClient = grpc.BidiStreamingClient[GitH
 
 func (c *accessGraphServiceClient) OktaAuditLogStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[OktaAuditLogStreamRequest, OktaAuditLogStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[11], AccessGraphService_OktaAuditLogStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[12], AccessGraphService_OktaAuditLogStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -395,7 +434,7 @@ type AccessGraphService_OktaAuditLogStreamClient = grpc.BidiStreamingClient[Okta
 
 func (c *accessGraphServiceClient) OktaEventsStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[OktaEventsStreamRequest, OktaEventsStreamResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[12], AccessGraphService_OktaEventsStream_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[13], AccessGraphService_OktaEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -462,6 +501,31 @@ type AccessGraphServiceServer interface {
 	//  3. Server sends second response providing the starting `resume_state` (possilby empty).
 	//  4. Client sends subsequent `AWSCloudTrailStreamRequest` messages.
 	AWSCloudTrailStream(grpc.BidiStreamingServer[AWSCloudTrailStreamRequest, AWSCloudTrailStreamResponse]) error
+	// KubeAuditLogStream establishes a persistent bidirectional stream for exporting
+	// Kubernetes audit logs from a client (teleport) to a server (access-graph). This stream
+	// is separate from other audit log streams as fetching Kubernetes audit logs can
+	// require a variety of mechanisms for retrieving them depending on how/where the
+	// k8s cluster is deployed. It often will not make sense to integrate this audit log
+	// stream with any of the others.
+	//
+	// This stream facilitates:
+	// - Initial configuration exchange and validation.
+	// - Streaming batches of audit log events from client to server.
+	// - Reliable export resumption via client-provided resume state updates.
+	// - Logs for multiple clusters can be streamed across the one grpc stream.
+	//
+	// Basic Interaction Flow:
+	//  1. Client connects and sends an initial `KubeAuditLogStreamRequest` with `config`.
+	//  2. Server responds with an initial `KubeAuditLogStreamResponse`, confirming the
+	//     effective configuration.
+	//  3. Client sends a `KubeAuditLogNewStream` message initiating a log stream for
+	//     a cluster, with a timestamp of the oldest logs it wants.
+	//  4. Server responds with a `KubeAuditLogResumeState` message containing either
+	//     a resumption cursor indicating when logs should be streamed from, or if
+	//     a new cluster or an old outdated resumption point has been stored, sends
+	//     the timestamp from which logs should be sent.
+	//  5. Client sends subsequent `KubeAuditLogStreamRequest` messages with new logs.
+	KubeAuditLogStream(grpc.BidiStreamingServer[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]) error
 	// Register submits a new tenant representing this Teleport cluster to the TAG service,
 	// identified by its HostCA certificate.
 	// The method is idempotent: it succeeds if the tenant has already registered and has the specific CA associated.
@@ -566,6 +630,9 @@ func (UnimplementedAccessGraphServiceServer) AuditLogStream(grpc.BidiStreamingSe
 func (UnimplementedAccessGraphServiceServer) AWSCloudTrailStream(grpc.BidiStreamingServer[AWSCloudTrailStreamRequest, AWSCloudTrailStreamResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method AWSCloudTrailStream not implemented")
 }
+func (UnimplementedAccessGraphServiceServer) KubeAuditLogStream(grpc.BidiStreamingServer[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method KubeAuditLogStream not implemented")
+}
 func (UnimplementedAccessGraphServiceServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
 }
@@ -684,6 +751,13 @@ func _AccessGraphService_AWSCloudTrailStream_Handler(srv interface{}, stream grp
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type AccessGraphService_AWSCloudTrailStreamServer = grpc.BidiStreamingServer[AWSCloudTrailStreamRequest, AWSCloudTrailStreamResponse]
 
+func _AccessGraphService_KubeAuditLogStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(AccessGraphServiceServer).KubeAuditLogStream(&grpc.GenericServerStream[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type AccessGraphService_KubeAuditLogStreamServer = grpc.BidiStreamingServer[KubeAuditLogStreamRequest, KubeAuditLogStreamResponse]
+
 func _AccessGraphService_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(RegisterRequest)
 	if err := dec(in); err != nil {
@@ -831,6 +905,12 @@ var AccessGraphService_ServiceDesc = grpc.ServiceDesc{
 			ServerStreams: true,
 			ClientStreams: true,
 		},
+		{
+			StreamName:    "KubeAuditLogStream",
+			Handler:       _AccessGraphService_KubeAuditLogStream_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
 		{
 			StreamName:    "AWSEventsStream",
 			Handler:       _AccessGraphService_AWSEventsStream_Handler,
diff --git a/gen/proto/go/accessgraph/v1alpha/aws.pb.go b/gen/proto/go/accessgraph/v1alpha/aws.pb.go
index 63aedc601dbce..ce09c7f673f50 100644
--- a/gen/proto/go/accessgraph/v1alpha/aws.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/aws.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/aws.proto
 
@@ -213,6 +213,7 @@ type AWSResource struct {
 	//	*AWSResource_Rds
 	//	*AWSResource_SamlProvider
 	//	*AWSResource_OidcProvider
+	//	*AWSResource_KmsKey
 	Resource      isAWSResource_Resource `protobuf_oneof:"resource"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -435,6 +436,15 @@ func (x *AWSResource) GetOidcProvider() *AWSOIDCProviderV1 {
 	return nil
 }
 
+func (x *AWSResource) GetKmsKey() *AWSKMSKeyV1 {
+	if x != nil {
+		if x, ok := x.Resource.(*AWSResource_KmsKey); ok {
+			return x.KmsKey
+		}
+	}
+	return nil
+}
+
 type isAWSResource_Resource interface {
 	isAWSResource_Resource()
 }
@@ -542,6 +552,11 @@ type AWSResource_OidcProvider struct {
 	OidcProvider *AWSOIDCProviderV1 `protobuf:"bytes,20,opt,name=oidc_provider,json=oidcProvider,proto3,oneof"`
 }
 
+type AWSResource_KmsKey struct {
+	// kms_key is an AWS KMS key.
+	KmsKey *AWSKMSKeyV1 `protobuf:"bytes,21,opt,name=kms_key,json=kmsKey,proto3,oneof"`
+}
+
 func (*AWSResource_User) isAWSResource_Resource() {}
 
 func (*AWSResource_Group) isAWSResource_Resource() {}
@@ -582,6 +597,8 @@ func (*AWSResource_SamlProvider) isAWSResource_Resource() {}
 
 func (*AWSResource_OidcProvider) isAWSResource_Resource() {}
 
+func (*AWSResource_KmsKey) isAWSResource_Resource() {}
+
 // AWSUserInlinePolicyV1 is a policy that is inlined to an AWS user.
 type AWSUserInlinePolicyV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -592,9 +609,7 @@ type AWSUserInlinePolicyV1 struct {
 	// account_id is the ID of the AWS account that the user belongs to.
 	AccountId string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	// user is the user who the policy is attached to.
-	User *AWSUserV1 `protobuf:"bytes,5,opt,name=user,proto3" json:"user,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	User          *AWSUserV1 `protobuf:"bytes,5,opt,name=user,proto3" json:"user,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -657,13 +672,6 @@ func (x *AWSUserInlinePolicyV1) GetUser() *AWSUserV1 {
 	return nil
 }
 
-func (x *AWSUserInlinePolicyV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSPolicyV1 is an AWS policy.
 type AWSPolicyV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -692,10 +700,8 @@ type AWSPolicyV1 struct {
 	PolicyName string `protobuf:"bytes,11,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
 	// policy_document is the JSON document that defines the policy.
 	PolicyDocument []byte `protobuf:"bytes,12,opt,name=policy_document,json=policyDocument,proto3" json:"policy_document,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *AWSPolicyV1) Reset() {
@@ -812,13 +818,6 @@ func (x *AWSPolicyV1) GetPolicyDocument() []byte {
 	return nil
 }
 
-func (x *AWSPolicyV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSGroupV1 is a group of AWS users.
 type AWSGroupV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -833,9 +832,7 @@ type AWSGroupV1 struct {
 	// path is the path of the AWS group.
 	Path string `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
 	// account_id is the ID of the AWS account that the group belongs to.
-	AccountId string `protobuf:"bytes,6,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,6,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -912,22 +909,13 @@ func (x *AWSGroupV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSGroupV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSUserGroupsV1 is a list of AWS groups that an AWS user belongs to.
 type AWSUserGroupsV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// user is the AWS user.
 	User *AWSUserV1 `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
 	// groups is the list of AWS groups that the user belongs to.
-	Groups []*AWSGroupV1 `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	Groups        []*AWSGroupV1 `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -976,13 +964,6 @@ func (x *AWSUserGroupsV1) GetGroups() []*AWSGroupV1 {
 	return nil
 }
 
-func (x *AWSUserGroupsV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSUserV1 is an AWS user.
 type AWSUserV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1003,9 +984,7 @@ type AWSUserV1 struct {
 	// tags is the list of tags that are attached to the user.
 	Tags []*AWSTag `protobuf:"bytes,8,rep,name=tags,proto3" json:"tags,omitempty"`
 	// account_id is the ID of the AWS account that the user belongs to.
-	AccountId string `protobuf:"bytes,9,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the user was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,9,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1103,13 +1082,6 @@ func (x *AWSUserV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSUserV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSTag is a tag that is attached to an AWS resource.
 type AWSTag struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1241,8 +1213,6 @@ type AWSInstanceV1 struct {
 	// launch_key_name is the name of the key pair that is used to launch the
 	// instance.
 	LaunchKeyName *wrapperspb.StringValue `protobuf:"bytes,8,opt,name=launch_key_name,json=launchKeyName,proto3" json:"launch_key_name,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1333,13 +1303,6 @@ func (x *AWSInstanceV1) GetLaunchKeyName() *wrapperspb.StringValue {
 	return nil
 }
 
-func (x *AWSInstanceV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSUserAttachedPolicies is a list of AWS policies that are attached to an
 // AWS user.
 type AWSUserAttachedPolicies struct {
@@ -1349,9 +1312,7 @@ type AWSUserAttachedPolicies struct {
 	// policies is the list of AWS policies that are attached to the user.
 	Policies []*AttachedPolicyV1 `protobuf:"bytes,2,rep,name=policies,proto3" json:"policies,omitempty"`
 	// account_id is the ID of the AWS account that the user belongs to.
-	AccountId string `protobuf:"bytes,3,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,3,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1407,13 +1368,6 @@ func (x *AWSUserAttachedPolicies) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSUserAttachedPolicies) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AttachedPolicyV1 is a AWS policy identifier.
 type AttachedPolicyV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1478,9 +1432,7 @@ type AWSGroupAttachedPolicies struct {
 	// policies is the list of AWS policies that are attached to the group.
 	Policies []*AttachedPolicyV1 `protobuf:"bytes,2,rep,name=policies,proto3" json:"policies,omitempty"`
 	// account_id is the ID of the AWS account that the group belongs to.
-	AccountId string `protobuf:"bytes,3,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,3,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1536,13 +1488,6 @@ func (x *AWSGroupAttachedPolicies) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSGroupAttachedPolicies) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSGroupInlinePolicyV1 is a policy that is inlined to an AWS Group.
 type AWSGroupInlinePolicyV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1553,9 +1498,7 @@ type AWSGroupInlinePolicyV1 struct {
 	// policy_document is the JSON document that defines the policy.
 	PolicyDocument []byte `protobuf:"bytes,3,opt,name=policy_document,json=policyDocument,proto3" json:"policy_document,omitempty"`
 	// account_id is the ID of the AWS account that the group belongs to.
-	AccountId string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1618,13 +1561,6 @@ func (x *AWSGroupInlinePolicyV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSGroupInlinePolicyV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSS3BucketV1 is an AWS S3 bucket.
 type AWSS3BucketV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1639,9 +1575,7 @@ type AWSS3BucketV1 struct {
 	// acl is the ACL of the S3 bucket.
 	Acls []*AWSS3BucketACL `protobuf:"bytes,5,rep,name=acls,proto3" json:"acls,omitempty"`
 	// tags is the list of tags that are attached to the S3 bucket.
-	Tags []*AWSTag `protobuf:"bytes,6,rep,name=tags,proto3" json:"tags,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	Tags          []*AWSTag `protobuf:"bytes,6,rep,name=tags,proto3" json:"tags,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1718,13 +1652,6 @@ func (x *AWSS3BucketV1) GetTags() []*AWSTag {
 	return nil
 }
 
-func (x *AWSS3BucketV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSS3BucketACL is the ACL of an AWS S3 bucket.
 type AWSS3BucketACL struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -1889,9 +1816,7 @@ type AWSRoleV1 struct {
 	// role_last_used is the last used information of the role.
 	RoleLastUsed *RoleLastUsedV1 `protobuf:"bytes,11,opt,name=role_last_used,json=roleLastUsed,proto3" json:"role_last_used,omitempty"`
 	// account_id is the ID of the AWS account that the role belongs to.
-	AccountId string `protobuf:"bytes,12,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,12,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2010,13 +1935,6 @@ func (x *AWSRoleV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSRoleV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // RolePermissionsBoundaryV1 is the permissions boundary of a role.
 type RolePermissionsBoundaryV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2137,9 +2055,7 @@ type AWSRoleInlinePolicyV1 struct {
 	// account_id is the ID of the AWS account that the role belongs to.
 	AccountId string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	// aws_role is the role name of the AWS role that the policy is attached to.
-	AwsRole *AWSRoleV1 `protobuf:"bytes,5,opt,name=aws_role,json=awsRole,proto3" json:"aws_role,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AwsRole       *AWSRoleV1 `protobuf:"bytes,5,opt,name=aws_role,json=awsRole,proto3" json:"aws_role,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2202,13 +2118,6 @@ func (x *AWSRoleInlinePolicyV1) GetAwsRole() *AWSRoleV1 {
 	return nil
 }
 
-func (x *AWSRoleInlinePolicyV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSRoleAttachedPolicies is a list of AWS policies that are attached to an
 // AWS role.
 type AWSRoleAttachedPolicies struct {
@@ -2218,9 +2127,7 @@ type AWSRoleAttachedPolicies struct {
 	// account_id is the ID of the AWS account that the role belongs to.
 	AccountId string `protobuf:"bytes,3,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	// aws_role is the AWS role.
-	AwsRole *AWSRoleV1 `protobuf:"bytes,4,opt,name=aws_role,json=awsRole,proto3" json:"aws_role,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AwsRole       *AWSRoleV1 `protobuf:"bytes,4,opt,name=aws_role,json=awsRole,proto3" json:"aws_role,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2276,13 +2183,6 @@ func (x *AWSRoleAttachedPolicies) GetAwsRole() *AWSRoleV1 {
 	return nil
 }
 
-func (x *AWSRoleAttachedPolicies) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSInstanceProfileV1 is an AWS instance profile.
 type AWSInstanceProfileV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2302,9 +2202,7 @@ type AWSInstanceProfileV1 struct {
 	Tags []*AWSTag `protobuf:"bytes,7,rep,name=tags,proto3" json:"tags,omitempty"`
 	// account_id is the ID of the AWS account that the instance profile belongs
 	// to.
-	AccountId string `protobuf:"bytes,8,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,8,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2395,13 +2293,6 @@ func (x *AWSInstanceProfileV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSInstanceProfileV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSEKSClusterV1 represents an AWS EKS cluster.
 type AWSEKSClusterV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2421,9 +2312,7 @@ type AWSEKSClusterV1 struct {
 	Region string `protobuf:"bytes,7,opt,name=region,proto3" json:"region,omitempty"`
 	// account_id is the ID of the AWS account that the instance profile belongs
 	// to.
-	AccountId string `protobuf:"bytes,8,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,8,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2514,13 +2403,6 @@ func (x *AWSEKSClusterV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSEKSClusterV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSEKSClusterAccessEntriesV1 represents an EKS cluster Access Entry.
 type AWSEKSClusterAccessEntryV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2544,9 +2426,7 @@ type AWSEKSClusterAccessEntryV1 struct {
 	Username string `protobuf:"bytes,9,opt,name=username,proto3" json:"username,omitempty"`
 	// account_id is the ID of the AWS account that the instance profile belongs
 	// to.
-	AccountId string `protobuf:"bytes,10,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,10,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2651,13 +2531,6 @@ func (x *AWSEKSClusterAccessEntryV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSEKSClusterAccessEntryV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSEKSAssociatedAccessPolicyV1 identifies an access policy association.
 type AWSEKSAssociatedAccessPolicyV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2676,9 +2549,7 @@ type AWSEKSAssociatedAccessPolicyV1 struct {
 	PolicyArn string `protobuf:"bytes,6,opt,name=policy_arn,json=policyArn,proto3" json:"policy_arn,omitempty"`
 	// account_id is the ID of the AWS account that the instance profile belongs
 	// to.
-	AccountId string `protobuf:"bytes,7,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	AccountId     string `protobuf:"bytes,7,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2762,13 +2633,6 @@ func (x *AWSEKSAssociatedAccessPolicyV1) GetAccountId() string {
 	return ""
 }
 
-func (x *AWSEKSAssociatedAccessPolicyV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSEKSAccessScope identifies the scope to which the AssociatedAccessPolicy applies.
 type AWSEKSAccessScopeV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2847,9 +2711,7 @@ type AWSRDSDatabaseV1 struct {
 	// to.
 	AccountId string `protobuf:"bytes,9,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
 	// resource_id is the RDS unique resource id.
-	ResourceId string `protobuf:"bytes,10,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	ResourceId    string `protobuf:"bytes,10,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2954,13 +2816,6 @@ func (x *AWSRDSDatabaseV1) GetResourceId() string {
 	return ""
 }
 
-func (x *AWSRDSDatabaseV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSRDSEngineV1 defines the database engine details
 type AWSRDSEngineV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -3035,10 +2890,8 @@ type AWSSAMLProviderV1 struct {
 	SsoUrls []string `protobuf:"bytes,7,rep,name=sso_urls,json=ssoUrls,proto3" json:"sso_urls,omitempty"`
 	// signing_certificates is a list of signing certificates for this identity provider.
 	SigningCertificates []string `protobuf:"bytes,8,rep,name=signing_certificates,json=signingCertificates,proto3" json:"signing_certificates,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *AWSSAMLProviderV1) Reset() {
@@ -3127,13 +2980,6 @@ func (x *AWSSAMLProviderV1) GetSigningCertificates() []string {
 	return nil
 }
 
-func (x *AWSSAMLProviderV1) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 // AWSOIDCProviderV1 defines the OIDC identity provider details.
 type AWSOIDCProviderV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -3150,9 +2996,7 @@ type AWSOIDCProviderV1 struct {
 	// thumbprints is a list of certificate thumbprints for this OIDC provider.
 	Thumbprints []string `protobuf:"bytes,6,rep,name=thumbprints,proto3" json:"thumbprints,omitempty"`
 	// url is the URL for this OIDC provider.
-	Url string `protobuf:"bytes,7,opt,name=url,proto3" json:"url,omitempty"`
-	// last_sync_time is the time when the resource was last synced.
-	LastSyncTime  *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
+	Url           string `protobuf:"bytes,7,opt,name=url,proto3" json:"url,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -3236,20 +3080,135 @@ func (x *AWSOIDCProviderV1) GetUrl() string {
 	return ""
 }
 
-func (x *AWSOIDCProviderV1) GetLastSyncTime() *timestamppb.Timestamp {
+// AWSKMSKeyV1 defines the KMS key details.
+type AWSKMSKeyV1 struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// arn is the key ARN.
+	Arn string `protobuf:"bytes,1,opt,name=arn,proto3" json:"arn,omitempty"`
+	// created_at is the time when the key was created.
+	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// tags is the list of tags that are attached to the key.
+	Tags []*AWSTag `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"`
+	// account_id is the ID of the AWS account that the key belongs to.
+	AccountId string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	// aliases is the list of aliases that are attached to the key.
+	// they are prefixed with "alias/", for example "alias/my-key-alias".
+	Aliases []string `protobuf:"bytes,6,rep,name=aliases,proto3" json:"aliases,omitempty"`
+	// policy_document is the JSON document that defines the Key Policy. Every KMS
+	// key must have exactly one key policy.
+	PolicyDocument []byte `protobuf:"bytes,7,opt,name=policy_document,json=policyDocument,proto3" json:"policy_document,omitempty"`
+	// region is the AWS region that the key belongs to. For multi-region keys,
+	// this is the region where the current key, primary or replica, is located.
+	Region string `protobuf:"bytes,8,opt,name=region,proto3" json:"region,omitempty"`
+	// multi_region_key_type is the type of the multi-region key.
+	// It is set to "PRIMARY", "REPLICA" or left empty for single region keys.
+	MultiRegionKeyType string `protobuf:"bytes,9,opt,name=multi_region_key_type,json=multiRegionKeyType,proto3" json:"multi_region_key_type,omitempty"`
+	// hsm_cluster_id is the ID of the HSM cluster that the key belongs to, if any.
+	HsmClusterId  string `protobuf:"bytes,10,opt,name=hsm_cluster_id,json=hsmClusterId,proto3" json:"hsm_cluster_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AWSKMSKeyV1) Reset() {
+	*x = AWSKMSKeyV1{}
+	mi := &file_accessgraph_v1alpha_aws_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AWSKMSKeyV1) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AWSKMSKeyV1) ProtoMessage() {}
+
+func (x *AWSKMSKeyV1) ProtoReflect() protoreflect.Message {
+	mi := &file_accessgraph_v1alpha_aws_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AWSKMSKeyV1.ProtoReflect.Descriptor instead.
+func (*AWSKMSKeyV1) Descriptor() ([]byte, []int) {
+	return file_accessgraph_v1alpha_aws_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *AWSKMSKeyV1) GetArn() string {
 	if x != nil {
-		return x.LastSyncTime
+		return x.Arn
+	}
+	return ""
+}
+
+func (x *AWSKMSKeyV1) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *AWSKMSKeyV1) GetTags() []*AWSTag {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *AWSKMSKeyV1) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *AWSKMSKeyV1) GetAliases() []string {
+	if x != nil {
+		return x.Aliases
+	}
+	return nil
+}
+
+func (x *AWSKMSKeyV1) GetPolicyDocument() []byte {
+	if x != nil {
+		return x.PolicyDocument
 	}
 	return nil
 }
 
+func (x *AWSKMSKeyV1) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *AWSKMSKeyV1) GetMultiRegionKeyType() string {
+	if x != nil {
+		return x.MultiRegionKeyType
+	}
+	return ""
+}
+
+func (x *AWSKMSKeyV1) GetHsmClusterId() string {
+	if x != nil {
+		return x.HsmClusterId
+	}
+	return ""
+}
+
 var File_accessgraph_v1alpha_aws_proto protoreflect.FileDescriptor
 
 const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\n" +
 	"\x1daccessgraph/v1alpha/aws.proto\x12\x13accessgraph.v1alpha\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1egoogle/protobuf/wrappers.proto\"Q\n" +
 	"\x0fAWSResourceList\x12>\n" +
-	"\tresources\x18\x01 \x03(\v2 .accessgraph.v1alpha.AWSResourceR\tresources\"\xf4\f\n" +
+	"\tresources\x18\x01 \x03(\v2 .accessgraph.v1alpha.AWSResourceR\tresources\"\xb1\r\n" +
 	"\vAWSResource\x124\n" +
 	"\x04user\x18\x01 \x01(\v2\x1e.accessgraph.v1alpha.AWSUserV1H\x00R\x04user\x127\n" +
 	"\x05group\x18\x02 \x01(\v2\x1f.accessgraph.v1alpha.AWSGroupV1H\x00R\x05group\x12Z\n" +
@@ -3273,17 +3232,17 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x1deks_cluster_associated_policy\x18\x11 \x01(\v23.accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1H\x00R\x1aeksClusterAssociatedPolicy\x129\n" +
 	"\x03rds\x18\x12 \x01(\v2%.accessgraph.v1alpha.AWSRDSDatabaseV1H\x00R\x03rds\x12M\n" +
 	"\rsaml_provider\x18\x13 \x01(\v2&.accessgraph.v1alpha.AWSSAMLProviderV1H\x00R\fsamlProvider\x12M\n" +
-	"\roidc_provider\x18\x14 \x01(\v2&.accessgraph.v1alpha.AWSOIDCProviderV1H\x00R\foidcProviderB\n" +
+	"\roidc_provider\x18\x14 \x01(\v2&.accessgraph.v1alpha.AWSOIDCProviderV1H\x00R\foidcProvider\x12;\n" +
+	"\akms_key\x18\x15 \x01(\v2 .accessgraph.v1alpha.AWSKMSKeyV1H\x00R\x06kmsKeyB\n" +
 	"\n" +
-	"\bresource\"\x86\x02\n" +
+	"\bresource\"\xda\x01\n" +
 	"\x15AWSUserInlinePolicyV1\x12\x1f\n" +
 	"\vpolicy_name\x18\x01 \x01(\tR\n" +
 	"policyName\x12'\n" +
 	"\x0fpolicy_document\x18\x03 \x01(\fR\x0epolicyDocument\x12\x1d\n" +
 	"\n" +
 	"account_id\x18\x04 \x01(\tR\taccountId\x122\n" +
-	"\x04user\x18\x05 \x01(\v2\x1e.accessgraph.v1alpha.AWSUserV1R\x04user\x12@\n" +
-	"\x0elast_sync_time\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTimeJ\x04\b\x02\x10\x03R\busername\"\x97\x04\n" +
+	"\x04user\x18\x05 \x01(\v2\x1e.accessgraph.v1alpha.AWSUserV1R\x04userJ\x04\b\x02\x10\x03J\x04\b\x06\x10\aR\busernameR\x0elast_sync_time\"\xeb\x03\n" +
 	"\vAWSPolicyV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
 	"\n" +
@@ -3301,8 +3260,7 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	" \x01(\tR\taccountId\x12\x1f\n" +
 	"\vpolicy_name\x18\v \x01(\tR\n" +
 	"policyName\x12'\n" +
-	"\x0fpolicy_document\x18\f \x01(\fR\x0epolicyDocument\x12@\n" +
-	"\x0elast_sync_time\x18\r \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xfd\x01\n" +
+	"\x0fpolicy_document\x18\f \x01(\fR\x0epolicyDocumentJ\x04\b\r\x10\x0eR\x0elast_sync_time\"\xd1\x01\n" +
 	"\n" +
 	"AWSGroupV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
@@ -3312,12 +3270,10 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x04name\x18\x04 \x01(\tR\x04name\x12\x12\n" +
 	"\x04path\x18\x05 \x01(\tR\x04path\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\x06 \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xc0\x01\n" +
+	"account_id\x18\x06 \x01(\tR\taccountIdJ\x04\b\a\x10\bR\x0elast_sync_time\"\x94\x01\n" +
 	"\x0fAWSUserGroupsV1\x122\n" +
 	"\x04user\x18\x01 \x01(\v2\x1e.accessgraph.v1alpha.AWSUserV1R\x04user\x127\n" +
-	"\x06groups\x18\x02 \x03(\v2\x1f.accessgraph.v1alpha.AWSGroupV1R\x06groups\x12@\n" +
-	"\x0elast_sync_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xe2\x03\n" +
+	"\x06groups\x18\x02 \x03(\v2\x1f.accessgraph.v1alpha.AWSGroupV1R\x06groupsJ\x04\b\x03\x10\x04R\x0elast_sync_time\"\xb6\x03\n" +
 	"\tAWSUserV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
 	"\n" +
@@ -3329,15 +3285,14 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x14permissions_boundary\x18\a \x01(\v2/.accessgraph.v1alpha.UsersPermissionsBoundaryV1R\x13permissionsBoundary\x12/\n" +
 	"\x04tags\x18\b \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\t \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\n" +
-	" \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"N\n" +
+	"account_id\x18\t \x01(\tR\taccountIdJ\x04\b\n" +
+	"\x10\vR\x0elast_sync_time\"N\n" +
 	"\x06AWSTag\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x122\n" +
 	"\x05value\x18\x02 \x01(\v2\x1c.google.protobuf.StringValueR\x05value\"\xc5\x01\n" +
 	"\x1aUsersPermissionsBoundaryV1\x128\n" +
 	"\x18permissions_boundary_arn\x18\x01 \x01(\tR\x16permissionsBoundaryArn\x12m\n" +
-	"\x19permissions_boundary_type\x18\x02 \x01(\x0e21.accessgraph.v1alpha.UsersPermissionsBoundaryTypeR\x17permissionsBoundaryType\"\xdc\x03\n" +
+	"\x19permissions_boundary_type\x18\x02 \x01(\x0e21.accessgraph.v1alpha.UsersPermissionsBoundaryTypeR\x17permissionsBoundaryType\"\xb0\x03\n" +
 	"\rAWSInstanceV1\x12\x1f\n" +
 	"\vinstance_id\x18\x01 \x01(\tR\n" +
 	"instanceId\x12;\n" +
@@ -3349,32 +3304,30 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x04tags\x18\x05 \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12&\n" +
 	"\x0fpublic_dns_name\x18\x06 \x01(\tR\rpublicDnsName\x12U\n" +
 	"\x18iam_instance_profile_arn\x18\a \x01(\v2\x1c.google.protobuf.StringValueR\x15iamInstanceProfileArn\x12D\n" +
-	"\x0flaunch_key_name\x18\b \x01(\v2\x1c.google.protobuf.StringValueR\rlaunchKeyName\x12@\n" +
-	"\x0elast_sync_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xf1\x01\n" +
+	"\x0flaunch_key_name\x18\b \x01(\v2\x1c.google.protobuf.StringValueR\rlaunchKeyNameJ\x04\b\t\x10\n" +
+	"R\x0elast_sync_time\"\xc5\x01\n" +
 	"\x17AWSUserAttachedPolicies\x122\n" +
 	"\x04user\x18\x01 \x01(\v2\x1e.accessgraph.v1alpha.AWSUserV1R\x04user\x12A\n" +
 	"\bpolicies\x18\x02 \x03(\v2%.accessgraph.v1alpha.AttachedPolicyV1R\bpolicies\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\x03 \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"E\n" +
+	"account_id\x18\x03 \x01(\tR\taccountIdJ\x04\b\t\x10\n" +
+	"R\x0elast_sync_time\"E\n" +
 	"\x10AttachedPolicyV1\x12\x1f\n" +
 	"\vpolicy_name\x18\x01 \x01(\tR\n" +
 	"policyName\x12\x10\n" +
-	"\x03arn\x18\x02 \x01(\tR\x03arn\"\xf5\x01\n" +
+	"\x03arn\x18\x02 \x01(\tR\x03arn\"\xc9\x01\n" +
 	"\x18AWSGroupAttachedPolicies\x125\n" +
 	"\x05group\x18\x01 \x01(\v2\x1f.accessgraph.v1alpha.AWSGroupV1R\x05group\x12A\n" +
 	"\bpolicies\x18\x02 \x03(\v2%.accessgraph.v1alpha.AttachedPolicyV1R\bpolicies\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\x03 \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xfa\x01\n" +
+	"account_id\x18\x03 \x01(\tR\taccountIdJ\x04\b\x04\x10\x05R\x0elast_sync_time\"\xce\x01\n" +
 	"\x16AWSGroupInlinePolicyV1\x12\x1f\n" +
 	"\vpolicy_name\x18\x01 \x01(\tR\n" +
 	"policyName\x125\n" +
 	"\x05group\x18\x02 \x01(\v2\x1f.accessgraph.v1alpha.AWSGroupV1R\x05group\x12'\n" +
 	"\x0fpolicy_document\x18\x03 \x01(\fR\x0epolicyDocument\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\x04 \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xb4\x02\n" +
+	"account_id\x18\x04 \x01(\tR\taccountIdJ\x04\b\x05\x10\x06R\x0elast_sync_time\"\x88\x02\n" +
 	"\rAWSS3BucketV1\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
 	"\n" +
@@ -3382,8 +3335,7 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x0fpolicy_document\x18\x03 \x01(\fR\x0epolicyDocument\x12\x1b\n" +
 	"\tis_public\x18\x04 \x01(\bR\bisPublic\x127\n" +
 	"\x04acls\x18\x05 \x03(\v2#.accessgraph.v1alpha.AWSS3BucketACLR\x04acls\x12/\n" +
-	"\x04tags\x18\x06 \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12@\n" +
-	"\x0elast_sync_time\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"v\n" +
+	"\x04tags\x18\x06 \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tagsJ\x04\b\a\x10\bR\x0elast_sync_time\"v\n" +
 	"\x0eAWSS3BucketACL\x12D\n" +
 	"\agrantee\x18\x01 \x01(\v2*.accessgraph.v1alpha.AWSS3BucketACLGranteeR\agrantee\x12\x1e\n" +
 	"\n" +
@@ -3394,7 +3346,7 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x02id\x18\x02 \x01(\tR\x02id\x12#\n" +
 	"\remail_address\x18\x03 \x01(\tR\femailAddress\x12\x12\n" +
 	"\x04type\x18\x04 \x01(\tR\x04type\x12\x10\n" +
-	"\x03uri\x18\x05 \x01(\tR\x03uri\"\x87\x05\n" +
+	"\x03uri\x18\x05 \x01(\tR\x03uri\"\xdb\x04\n" +
 	"\tAWSRoleV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x12=\n" +
 	"\x1bassume_role_policy_document\x18\x02 \x01(\fR\x18assumeRolePolicyDocument\x129\n" +
@@ -3410,28 +3362,25 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	" \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12I\n" +
 	"\x0erole_last_used\x18\v \x01(\v2#.accessgraph.v1alpha.RoleLastUsedV1R\froleLastUsed\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\f \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\r \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xc3\x01\n" +
+	"account_id\x18\f \x01(\tR\taccountIdJ\x04\b\r\x10\x0eR\x0elast_sync_time\"\xc3\x01\n" +
 	"\x19RolePermissionsBoundaryV1\x128\n" +
 	"\x18permissions_boundary_arn\x18\x01 \x01(\tR\x16permissionsBoundaryArn\x12l\n" +
 	"\x19permissions_boundary_type\x18\x02 \x01(\x0e20.accessgraph.v1alpha.RolePermissionsBoundaryTypeR\x17permissionsBoundaryType\"j\n" +
 	"\x0eRoleLastUsedV1\x12@\n" +
 	"\x0elast_used_date\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\flastUsedDate\x12\x16\n" +
-	"\x06region\x18\x02 \x01(\tR\x06region\"\x89\x02\n" +
+	"\x06region\x18\x02 \x01(\tR\x06region\"\xdd\x01\n" +
 	"\x15AWSRoleInlinePolicyV1\x12\x1f\n" +
 	"\vpolicy_name\x18\x01 \x01(\tR\n" +
 	"policyName\x12'\n" +
 	"\x0fpolicy_document\x18\x03 \x01(\fR\x0epolicyDocument\x12\x1d\n" +
 	"\n" +
 	"account_id\x18\x04 \x01(\tR\taccountId\x129\n" +
-	"\baws_role\x18\x05 \x01(\v2\x1e.accessgraph.v1alpha.AWSRoleV1R\aawsRole\x12@\n" +
-	"\x0elast_sync_time\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTimeJ\x04\b\x02\x10\x03R\x04role\"\x84\x02\n" +
+	"\baws_role\x18\x05 \x01(\v2\x1e.accessgraph.v1alpha.AWSRoleV1R\aawsRoleJ\x04\b\x02\x10\x03J\x04\b\x06\x10\aR\x04roleR\x0elast_sync_time\"\xd8\x01\n" +
 	"\x17AWSRoleAttachedPolicies\x12A\n" +
 	"\bpolicies\x18\x02 \x03(\v2%.accessgraph.v1alpha.AttachedPolicyV1R\bpolicies\x12\x1d\n" +
 	"\n" +
 	"account_id\x18\x03 \x01(\tR\taccountId\x129\n" +
-	"\baws_role\x18\x04 \x01(\v2\x1e.accessgraph.v1alpha.AWSRoleV1R\aawsRole\x12@\n" +
-	"\x0elast_sync_time\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTimeJ\x04\b\x01\x10\x02R\x04role\"\xa3\x03\n" +
+	"\baws_role\x18\x04 \x01(\v2\x1e.accessgraph.v1alpha.AWSRoleV1R\aawsRoleJ\x04\b\x01\x10\x02J\x04\b\x05\x10\x06R\x04roleR\x0elast_sync_time\"\xf7\x02\n" +
 	"\x14AWSInstanceProfileV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
 	"\n" +
@@ -3442,8 +3391,8 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x05roles\x18\x06 \x03(\v2\x1e.accessgraph.v1alpha.AWSRoleV1R\x05roles\x12/\n" +
 	"\x04tags\x18\a \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\b \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xce\x02\n" +
+	"account_id\x18\b \x01(\tR\taccountIdJ\x04\b\t\x10\n" +
+	"R\x0elast_sync_time\"\xa2\x02\n" +
 	"\x0fAWSEKSClusterV1\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
 	"\x03arn\x18\x02 \x01(\tR\x03arn\x129\n" +
@@ -3454,8 +3403,8 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\x04tags\x18\x06 \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12\x16\n" +
 	"\x06region\x18\a \x01(\tR\x06region\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\b \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\x92\x04\n" +
+	"account_id\x18\b \x01(\tR\taccountIdJ\x04\b\t\x10\n" +
+	"R\x0elast_sync_time\"\xe6\x03\n" +
 	"\x1aAWSEKSClusterAccessEntryV1\x12>\n" +
 	"\acluster\x18\x01 \x01(\v2$.accessgraph.v1alpha.AWSEKSClusterV1R\acluster\x12(\n" +
 	"\x10access_entry_arn\x18\x02 \x01(\tR\x0eaccessEntryArn\x129\n" +
@@ -3470,8 +3419,7 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\busername\x18\t \x01(\tR\busername\x12\x1d\n" +
 	"\n" +
 	"account_id\x18\n" +
-	" \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\v \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xc3\x03\n" +
+	" \x01(\tR\taccountIdJ\x04\b\v\x10\fR\x0elast_sync_time\"\x97\x03\n" +
 	"\x1eAWSEKSAssociatedAccessPolicyV1\x12>\n" +
 	"\acluster\x18\x01 \x01(\v2$.accessgraph.v1alpha.AWSEKSClusterV1R\acluster\x12#\n" +
 	"\rprincipal_arn\x18\x02 \x01(\tR\fprincipalArn\x12>\n" +
@@ -3482,13 +3430,12 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\n" +
 	"policy_arn\x18\x06 \x01(\tR\tpolicyArn\x12\x1d\n" +
 	"\n" +
-	"account_id\x18\a \x01(\tR\taccountId\x12@\n" +
-	"\x0elast_sync_time\x18\b \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"I\n" +
+	"account_id\x18\a \x01(\tR\taccountIdJ\x04\b\b\x10\tR\x0elast_sync_time\"I\n" +
 	"\x13AWSEKSAccessScopeV1\x12\x1e\n" +
 	"\n" +
 	"namespaces\x18\x01 \x03(\tR\n" +
 	"namespaces\x12\x12\n" +
-	"\x04type\x18\x02 \x01(\tR\x04type\"\xc1\x03\n" +
+	"\x04type\x18\x02 \x01(\tR\x04type\"\x95\x03\n" +
 	"\x10AWSRDSDatabaseV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x12\x16\n" +
 	"\x06status\x18\x02 \x01(\tR\x06status\x12\x12\n" +
@@ -3504,11 +3451,10 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"account_id\x18\t \x01(\tR\taccountId\x12\x1f\n" +
 	"\vresource_id\x18\n" +
 	" \x01(\tR\n" +
-	"resourceId\x12@\n" +
-	"\x0elast_sync_time\x18\v \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"B\n" +
+	"resourceIdJ\x04\b\v\x10\fR\x0elast_sync_time\"B\n" +
 	"\x0eAWSRDSEngineV1\x12\x16\n" +
 	"\x06engine\x18\x01 \x01(\tR\x06engine\x12\x18\n" +
-	"\aversion\x18\x02 \x01(\tR\aversion\"\x9a\x03\n" +
+	"\aversion\x18\x02 \x01(\tR\aversion\"\xee\x02\n" +
 	"\x11AWSSAMLProviderV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
 	"\n" +
@@ -3520,8 +3466,8 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"account_id\x18\x05 \x01(\tR\taccountId\x12\x1b\n" +
 	"\tentity_id\x18\x06 \x01(\tR\bentityId\x12\x19\n" +
 	"\bsso_urls\x18\a \x03(\tR\assoUrls\x121\n" +
-	"\x14signing_certificates\x18\b \x03(\tR\x13signingCertificates\x12@\n" +
-	"\x0elast_sync_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\"\xc5\x02\n" +
+	"\x14signing_certificates\x18\b \x03(\tR\x13signingCertificatesJ\x04\b\t\x10\n" +
+	"R\x0elast_sync_time\"\x99\x02\n" +
 	"\x11AWSOIDCProviderV1\x12\x10\n" +
 	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
 	"\n" +
@@ -3532,8 +3478,20 @@ const file_accessgraph_v1alpha_aws_proto_rawDesc = "" +
 	"\n" +
 	"client_ids\x18\x05 \x03(\tR\tclientIds\x12 \n" +
 	"\vthumbprints\x18\x06 \x03(\tR\vthumbprints\x12\x10\n" +
-	"\x03url\x18\a \x01(\tR\x03url\x12@\n" +
-	"\x0elast_sync_time\x18\b \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime*\x90\x01\n" +
+	"\x03url\x18\a \x01(\tR\x03urlJ\x04\b\b\x10\tR\x0elast_sync_time\"\xf4\x02\n" +
+	"\vAWSKMSKeyV1\x12\x10\n" +
+	"\x03arn\x18\x01 \x01(\tR\x03arn\x129\n" +
+	"\n" +
+	"created_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x12/\n" +
+	"\x04tags\x18\x03 \x03(\v2\x1b.accessgraph.v1alpha.AWSTagR\x04tags\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x04 \x01(\tR\taccountId\x12\x18\n" +
+	"\aaliases\x18\x06 \x03(\tR\aaliases\x12'\n" +
+	"\x0fpolicy_document\x18\a \x01(\fR\x0epolicyDocument\x12\x16\n" +
+	"\x06region\x18\b \x01(\tR\x06region\x121\n" +
+	"\x15multi_region_key_type\x18\t \x01(\tR\x12multiRegionKeyType\x12$\n" +
+	"\x0ehsm_cluster_id\x18\n" +
+	" \x01(\tR\fhsmClusterIdJ\x04\b\x05\x10\x06R\x0elast_sync_time*\x90\x01\n" +
 	"\x1cUsersPermissionsBoundaryType\x12/\n" +
 	"+USERS_PERMISSIONS_BOUNDARY_TYPE_UNSPECIFIED\x10\x00\x12?\n" +
 	";USERS_PERMISSIONS_BOUNDARY_TYPE_PERMISSIONS_BOUNDARY_POLICY\x10\x01*\x8d\x01\n" +
@@ -3554,7 +3512,7 @@ func file_accessgraph_v1alpha_aws_proto_rawDescGZIP() []byte {
 }
 
 var file_accessgraph_v1alpha_aws_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_accessgraph_v1alpha_aws_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
+var file_accessgraph_v1alpha_aws_proto_msgTypes = make([]protoimpl.MessageInfo, 32)
 var file_accessgraph_v1alpha_aws_proto_goTypes = []any{
 	(UsersPermissionsBoundaryType)(0),      // 0: accessgraph.v1alpha.UsersPermissionsBoundaryType
 	(RolePermissionsBoundaryType)(0),       // 1: accessgraph.v1alpha.RolePermissionsBoundaryType
@@ -3589,9 +3547,10 @@ var file_accessgraph_v1alpha_aws_proto_goTypes = []any{
 	(*AWSRDSEngineV1)(nil),                 // 30: accessgraph.v1alpha.AWSRDSEngineV1
 	(*AWSSAMLProviderV1)(nil),              // 31: accessgraph.v1alpha.AWSSAMLProviderV1
 	(*AWSOIDCProviderV1)(nil),              // 32: accessgraph.v1alpha.AWSOIDCProviderV1
-	(*timestamppb.Timestamp)(nil),          // 33: google.protobuf.Timestamp
-	(*wrapperspb.StringValue)(nil),         // 34: google.protobuf.StringValue
-	(*durationpb.Duration)(nil),            // 35: google.protobuf.Duration
+	(*AWSKMSKeyV1)(nil),                    // 33: accessgraph.v1alpha.AWSKMSKeyV1
+	(*timestamppb.Timestamp)(nil),          // 34: google.protobuf.Timestamp
+	(*wrapperspb.StringValue)(nil),         // 35: google.protobuf.StringValue
+	(*durationpb.Duration)(nil),            // 36: google.protobuf.Duration
 }
 var file_accessgraph_v1alpha_aws_proto_depIdxs = []int32{
 	3,  // 0: accessgraph.v1alpha.AWSResourceList.resources:type_name -> accessgraph.v1alpha.AWSResource
@@ -3615,87 +3574,70 @@ var file_accessgraph_v1alpha_aws_proto_depIdxs = []int32{
 	29, // 18: accessgraph.v1alpha.AWSResource.rds:type_name -> accessgraph.v1alpha.AWSRDSDatabaseV1
 	31, // 19: accessgraph.v1alpha.AWSResource.saml_provider:type_name -> accessgraph.v1alpha.AWSSAMLProviderV1
 	32, // 20: accessgraph.v1alpha.AWSResource.oidc_provider:type_name -> accessgraph.v1alpha.AWSOIDCProviderV1
-	8,  // 21: accessgraph.v1alpha.AWSUserInlinePolicyV1.user:type_name -> accessgraph.v1alpha.AWSUserV1
-	33, // 22: accessgraph.v1alpha.AWSUserInlinePolicyV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 23: accessgraph.v1alpha.AWSPolicyV1.created_at:type_name -> google.protobuf.Timestamp
+	33, // 21: accessgraph.v1alpha.AWSResource.kms_key:type_name -> accessgraph.v1alpha.AWSKMSKeyV1
+	8,  // 22: accessgraph.v1alpha.AWSUserInlinePolicyV1.user:type_name -> accessgraph.v1alpha.AWSUserV1
+	34, // 23: accessgraph.v1alpha.AWSPolicyV1.created_at:type_name -> google.protobuf.Timestamp
 	9,  // 24: accessgraph.v1alpha.AWSPolicyV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 25: accessgraph.v1alpha.AWSPolicyV1.updated_at:type_name -> google.protobuf.Timestamp
-	33, // 26: accessgraph.v1alpha.AWSPolicyV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 27: accessgraph.v1alpha.AWSGroupV1.created_at:type_name -> google.protobuf.Timestamp
-	33, // 28: accessgraph.v1alpha.AWSGroupV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	8,  // 29: accessgraph.v1alpha.AWSUserGroupsV1.user:type_name -> accessgraph.v1alpha.AWSUserV1
-	6,  // 30: accessgraph.v1alpha.AWSUserGroupsV1.groups:type_name -> accessgraph.v1alpha.AWSGroupV1
-	33, // 31: accessgraph.v1alpha.AWSUserGroupsV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 32: accessgraph.v1alpha.AWSUserV1.created_at:type_name -> google.protobuf.Timestamp
-	33, // 33: accessgraph.v1alpha.AWSUserV1.password_last_used:type_name -> google.protobuf.Timestamp
-	10, // 34: accessgraph.v1alpha.AWSUserV1.permissions_boundary:type_name -> accessgraph.v1alpha.UsersPermissionsBoundaryV1
-	9,  // 35: accessgraph.v1alpha.AWSUserV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 36: accessgraph.v1alpha.AWSUserV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	34, // 37: accessgraph.v1alpha.AWSTag.value:type_name -> google.protobuf.StringValue
-	0,  // 38: accessgraph.v1alpha.UsersPermissionsBoundaryV1.permissions_boundary_type:type_name -> accessgraph.v1alpha.UsersPermissionsBoundaryType
-	33, // 39: accessgraph.v1alpha.AWSInstanceV1.launch_time:type_name -> google.protobuf.Timestamp
-	9,  // 40: accessgraph.v1alpha.AWSInstanceV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	34, // 41: accessgraph.v1alpha.AWSInstanceV1.iam_instance_profile_arn:type_name -> google.protobuf.StringValue
-	34, // 42: accessgraph.v1alpha.AWSInstanceV1.launch_key_name:type_name -> google.protobuf.StringValue
-	33, // 43: accessgraph.v1alpha.AWSInstanceV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	8,  // 44: accessgraph.v1alpha.AWSUserAttachedPolicies.user:type_name -> accessgraph.v1alpha.AWSUserV1
-	13, // 45: accessgraph.v1alpha.AWSUserAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
-	33, // 46: accessgraph.v1alpha.AWSUserAttachedPolicies.last_sync_time:type_name -> google.protobuf.Timestamp
-	6,  // 47: accessgraph.v1alpha.AWSGroupAttachedPolicies.group:type_name -> accessgraph.v1alpha.AWSGroupV1
-	13, // 48: accessgraph.v1alpha.AWSGroupAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
-	33, // 49: accessgraph.v1alpha.AWSGroupAttachedPolicies.last_sync_time:type_name -> google.protobuf.Timestamp
-	6,  // 50: accessgraph.v1alpha.AWSGroupInlinePolicyV1.group:type_name -> accessgraph.v1alpha.AWSGroupV1
-	33, // 51: accessgraph.v1alpha.AWSGroupInlinePolicyV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	17, // 52: accessgraph.v1alpha.AWSS3BucketV1.acls:type_name -> accessgraph.v1alpha.AWSS3BucketACL
-	9,  // 53: accessgraph.v1alpha.AWSS3BucketV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 54: accessgraph.v1alpha.AWSS3BucketV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	18, // 55: accessgraph.v1alpha.AWSS3BucketACL.grantee:type_name -> accessgraph.v1alpha.AWSS3BucketACLGrantee
-	33, // 56: accessgraph.v1alpha.AWSRoleV1.created_at:type_name -> google.protobuf.Timestamp
-	35, // 57: accessgraph.v1alpha.AWSRoleV1.max_session_duration:type_name -> google.protobuf.Duration
-	20, // 58: accessgraph.v1alpha.AWSRoleV1.permissions_boundary:type_name -> accessgraph.v1alpha.RolePermissionsBoundaryV1
-	9,  // 59: accessgraph.v1alpha.AWSRoleV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	21, // 60: accessgraph.v1alpha.AWSRoleV1.role_last_used:type_name -> accessgraph.v1alpha.RoleLastUsedV1
-	33, // 61: accessgraph.v1alpha.AWSRoleV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	1,  // 62: accessgraph.v1alpha.RolePermissionsBoundaryV1.permissions_boundary_type:type_name -> accessgraph.v1alpha.RolePermissionsBoundaryType
-	33, // 63: accessgraph.v1alpha.RoleLastUsedV1.last_used_date:type_name -> google.protobuf.Timestamp
-	19, // 64: accessgraph.v1alpha.AWSRoleInlinePolicyV1.aws_role:type_name -> accessgraph.v1alpha.AWSRoleV1
-	33, // 65: accessgraph.v1alpha.AWSRoleInlinePolicyV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	13, // 66: accessgraph.v1alpha.AWSRoleAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
-	19, // 67: accessgraph.v1alpha.AWSRoleAttachedPolicies.aws_role:type_name -> accessgraph.v1alpha.AWSRoleV1
-	33, // 68: accessgraph.v1alpha.AWSRoleAttachedPolicies.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 69: accessgraph.v1alpha.AWSInstanceProfileV1.created_at:type_name -> google.protobuf.Timestamp
-	19, // 70: accessgraph.v1alpha.AWSInstanceProfileV1.roles:type_name -> accessgraph.v1alpha.AWSRoleV1
-	9,  // 71: accessgraph.v1alpha.AWSInstanceProfileV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 72: accessgraph.v1alpha.AWSInstanceProfileV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 73: accessgraph.v1alpha.AWSEKSClusterV1.created_at:type_name -> google.protobuf.Timestamp
-	9,  // 74: accessgraph.v1alpha.AWSEKSClusterV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 75: accessgraph.v1alpha.AWSEKSClusterV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	25, // 76: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.cluster:type_name -> accessgraph.v1alpha.AWSEKSClusterV1
-	33, // 77: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.created_at:type_name -> google.protobuf.Timestamp
-	33, // 78: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.modified_at:type_name -> google.protobuf.Timestamp
-	9,  // 79: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 80: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	25, // 81: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.cluster:type_name -> accessgraph.v1alpha.AWSEKSClusterV1
-	28, // 82: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.scope:type_name -> accessgraph.v1alpha.AWSEKSAccessScopeV1
-	33, // 83: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.associated_at:type_name -> google.protobuf.Timestamp
-	33, // 84: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.modified_at:type_name -> google.protobuf.Timestamp
-	33, // 85: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	30, // 86: accessgraph.v1alpha.AWSRDSDatabaseV1.engine_details:type_name -> accessgraph.v1alpha.AWSRDSEngineV1
-	33, // 87: accessgraph.v1alpha.AWSRDSDatabaseV1.created_at:type_name -> google.protobuf.Timestamp
-	9,  // 88: accessgraph.v1alpha.AWSRDSDatabaseV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 89: accessgraph.v1alpha.AWSRDSDatabaseV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 90: accessgraph.v1alpha.AWSSAMLProviderV1.created_at:type_name -> google.protobuf.Timestamp
-	33, // 91: accessgraph.v1alpha.AWSSAMLProviderV1.valid_until:type_name -> google.protobuf.Timestamp
-	9,  // 92: accessgraph.v1alpha.AWSSAMLProviderV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 93: accessgraph.v1alpha.AWSSAMLProviderV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	33, // 94: accessgraph.v1alpha.AWSOIDCProviderV1.created_at:type_name -> google.protobuf.Timestamp
-	9,  // 95: accessgraph.v1alpha.AWSOIDCProviderV1.tags:type_name -> accessgraph.v1alpha.AWSTag
-	33, // 96: accessgraph.v1alpha.AWSOIDCProviderV1.last_sync_time:type_name -> google.protobuf.Timestamp
-	97, // [97:97] is the sub-list for method output_type
-	97, // [97:97] is the sub-list for method input_type
-	97, // [97:97] is the sub-list for extension type_name
-	97, // [97:97] is the sub-list for extension extendee
-	0,  // [0:97] is the sub-list for field type_name
+	34, // 25: accessgraph.v1alpha.AWSPolicyV1.updated_at:type_name -> google.protobuf.Timestamp
+	34, // 26: accessgraph.v1alpha.AWSGroupV1.created_at:type_name -> google.protobuf.Timestamp
+	8,  // 27: accessgraph.v1alpha.AWSUserGroupsV1.user:type_name -> accessgraph.v1alpha.AWSUserV1
+	6,  // 28: accessgraph.v1alpha.AWSUserGroupsV1.groups:type_name -> accessgraph.v1alpha.AWSGroupV1
+	34, // 29: accessgraph.v1alpha.AWSUserV1.created_at:type_name -> google.protobuf.Timestamp
+	34, // 30: accessgraph.v1alpha.AWSUserV1.password_last_used:type_name -> google.protobuf.Timestamp
+	10, // 31: accessgraph.v1alpha.AWSUserV1.permissions_boundary:type_name -> accessgraph.v1alpha.UsersPermissionsBoundaryV1
+	9,  // 32: accessgraph.v1alpha.AWSUserV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	35, // 33: accessgraph.v1alpha.AWSTag.value:type_name -> google.protobuf.StringValue
+	0,  // 34: accessgraph.v1alpha.UsersPermissionsBoundaryV1.permissions_boundary_type:type_name -> accessgraph.v1alpha.UsersPermissionsBoundaryType
+	34, // 35: accessgraph.v1alpha.AWSInstanceV1.launch_time:type_name -> google.protobuf.Timestamp
+	9,  // 36: accessgraph.v1alpha.AWSInstanceV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	35, // 37: accessgraph.v1alpha.AWSInstanceV1.iam_instance_profile_arn:type_name -> google.protobuf.StringValue
+	35, // 38: accessgraph.v1alpha.AWSInstanceV1.launch_key_name:type_name -> google.protobuf.StringValue
+	8,  // 39: accessgraph.v1alpha.AWSUserAttachedPolicies.user:type_name -> accessgraph.v1alpha.AWSUserV1
+	13, // 40: accessgraph.v1alpha.AWSUserAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
+	6,  // 41: accessgraph.v1alpha.AWSGroupAttachedPolicies.group:type_name -> accessgraph.v1alpha.AWSGroupV1
+	13, // 42: accessgraph.v1alpha.AWSGroupAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
+	6,  // 43: accessgraph.v1alpha.AWSGroupInlinePolicyV1.group:type_name -> accessgraph.v1alpha.AWSGroupV1
+	17, // 44: accessgraph.v1alpha.AWSS3BucketV1.acls:type_name -> accessgraph.v1alpha.AWSS3BucketACL
+	9,  // 45: accessgraph.v1alpha.AWSS3BucketV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	18, // 46: accessgraph.v1alpha.AWSS3BucketACL.grantee:type_name -> accessgraph.v1alpha.AWSS3BucketACLGrantee
+	34, // 47: accessgraph.v1alpha.AWSRoleV1.created_at:type_name -> google.protobuf.Timestamp
+	36, // 48: accessgraph.v1alpha.AWSRoleV1.max_session_duration:type_name -> google.protobuf.Duration
+	20, // 49: accessgraph.v1alpha.AWSRoleV1.permissions_boundary:type_name -> accessgraph.v1alpha.RolePermissionsBoundaryV1
+	9,  // 50: accessgraph.v1alpha.AWSRoleV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	21, // 51: accessgraph.v1alpha.AWSRoleV1.role_last_used:type_name -> accessgraph.v1alpha.RoleLastUsedV1
+	1,  // 52: accessgraph.v1alpha.RolePermissionsBoundaryV1.permissions_boundary_type:type_name -> accessgraph.v1alpha.RolePermissionsBoundaryType
+	34, // 53: accessgraph.v1alpha.RoleLastUsedV1.last_used_date:type_name -> google.protobuf.Timestamp
+	19, // 54: accessgraph.v1alpha.AWSRoleInlinePolicyV1.aws_role:type_name -> accessgraph.v1alpha.AWSRoleV1
+	13, // 55: accessgraph.v1alpha.AWSRoleAttachedPolicies.policies:type_name -> accessgraph.v1alpha.AttachedPolicyV1
+	19, // 56: accessgraph.v1alpha.AWSRoleAttachedPolicies.aws_role:type_name -> accessgraph.v1alpha.AWSRoleV1
+	34, // 57: accessgraph.v1alpha.AWSInstanceProfileV1.created_at:type_name -> google.protobuf.Timestamp
+	19, // 58: accessgraph.v1alpha.AWSInstanceProfileV1.roles:type_name -> accessgraph.v1alpha.AWSRoleV1
+	9,  // 59: accessgraph.v1alpha.AWSInstanceProfileV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	34, // 60: accessgraph.v1alpha.AWSEKSClusterV1.created_at:type_name -> google.protobuf.Timestamp
+	9,  // 61: accessgraph.v1alpha.AWSEKSClusterV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	25, // 62: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.cluster:type_name -> accessgraph.v1alpha.AWSEKSClusterV1
+	34, // 63: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.created_at:type_name -> google.protobuf.Timestamp
+	34, // 64: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.modified_at:type_name -> google.protobuf.Timestamp
+	9,  // 65: accessgraph.v1alpha.AWSEKSClusterAccessEntryV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	25, // 66: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.cluster:type_name -> accessgraph.v1alpha.AWSEKSClusterV1
+	28, // 67: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.scope:type_name -> accessgraph.v1alpha.AWSEKSAccessScopeV1
+	34, // 68: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.associated_at:type_name -> google.protobuf.Timestamp
+	34, // 69: accessgraph.v1alpha.AWSEKSAssociatedAccessPolicyV1.modified_at:type_name -> google.protobuf.Timestamp
+	30, // 70: accessgraph.v1alpha.AWSRDSDatabaseV1.engine_details:type_name -> accessgraph.v1alpha.AWSRDSEngineV1
+	34, // 71: accessgraph.v1alpha.AWSRDSDatabaseV1.created_at:type_name -> google.protobuf.Timestamp
+	9,  // 72: accessgraph.v1alpha.AWSRDSDatabaseV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	34, // 73: accessgraph.v1alpha.AWSSAMLProviderV1.created_at:type_name -> google.protobuf.Timestamp
+	34, // 74: accessgraph.v1alpha.AWSSAMLProviderV1.valid_until:type_name -> google.protobuf.Timestamp
+	9,  // 75: accessgraph.v1alpha.AWSSAMLProviderV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	34, // 76: accessgraph.v1alpha.AWSOIDCProviderV1.created_at:type_name -> google.protobuf.Timestamp
+	9,  // 77: accessgraph.v1alpha.AWSOIDCProviderV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	34, // 78: accessgraph.v1alpha.AWSKMSKeyV1.created_at:type_name -> google.protobuf.Timestamp
+	9,  // 79: accessgraph.v1alpha.AWSKMSKeyV1.tags:type_name -> accessgraph.v1alpha.AWSTag
+	80, // [80:80] is the sub-list for method output_type
+	80, // [80:80] is the sub-list for method input_type
+	80, // [80:80] is the sub-list for extension type_name
+	80, // [80:80] is the sub-list for extension extendee
+	0,  // [0:80] is the sub-list for field type_name
 }
 
 func init() { file_accessgraph_v1alpha_aws_proto_init() }
@@ -3724,6 +3666,7 @@ func file_accessgraph_v1alpha_aws_proto_init() {
 		(*AWSResource_Rds)(nil),
 		(*AWSResource_SamlProvider)(nil),
 		(*AWSResource_OidcProvider)(nil),
+		(*AWSResource_KmsKey)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -3731,7 +3674,7 @@ func file_accessgraph_v1alpha_aws_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_accessgraph_v1alpha_aws_proto_rawDesc), len(file_accessgraph_v1alpha_aws_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   31,
+			NumMessages:   32,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/gen/proto/go/accessgraph/v1alpha/azure.pb.go b/gen/proto/go/accessgraph/v1alpha/azure.pb.go
index fec4fe44c6047..bbe0c1742909f 100644
--- a/gen/proto/go/accessgraph/v1alpha/azure.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/azure.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/azure.proto
 
@@ -26,7 +26,6 @@ package accessgraphv1alpha
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
@@ -210,8 +209,6 @@ type AzureVirtualMachine struct {
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// subscription_id is the ID of the subscription to which the virtual machine belongs
 	SubscriptionId string `protobuf:"bytes,2,opt,name=subscription_id,json=subscriptionId,proto3" json:"subscription_id,omitempty"`
-	// last_sync_time is when the virtual machine was last fetched from Azure
-	LastSyncTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
 	// name is the given name of the virtual machine
 	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
 	// resource_group is the name of the resource group to which the virtual machine belongs
@@ -268,13 +265,6 @@ func (x *AzureVirtualMachine) GetSubscriptionId() string {
 	return ""
 }
 
-func (x *AzureVirtualMachine) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 func (x *AzureVirtualMachine) GetName() string {
 	if x != nil {
 		return x.Name
@@ -374,8 +364,6 @@ type AzurePrincipal struct {
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// subscription_id is the ID of the subscription to which the principal belongs
 	SubscriptionId string `protobuf:"bytes,2,opt,name=subscription_id,json=subscriptionId,proto3" json:"subscription_id,omitempty"`
-	// last_sync_time is when the principal was last fetched from Azure
-	LastSyncTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
 	// display_name is the given name for the principal, e.g. a user's first+last name
 	DisplayName string `protobuf:"bytes,4,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
 	// member_of lists the groups and directories the principal is assigned to
@@ -432,13 +420,6 @@ func (x *AzurePrincipal) GetSubscriptionId() string {
 	return ""
 }
 
-func (x *AzurePrincipal) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 func (x *AzurePrincipal) GetDisplayName() string {
 	if x != nil {
 		return x.DisplayName
@@ -474,8 +455,6 @@ type AzureRoleAssignment struct {
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// subscription_id is the ID of the subscription to which the role assignment belongs
 	SubscriptionId string `protobuf:"bytes,2,opt,name=subscription_id,json=subscriptionId,proto3" json:"subscription_id,omitempty"`
-	// last_sync_time is when the role assignment was last fetched from Azure
-	LastSyncTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
 	// principal_id is the ID of the principal being assigned a role
 	PrincipalId string `protobuf:"bytes,4,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"`
 	// role_definition_id is the ID of the role definition assigned to the principal
@@ -532,13 +511,6 @@ func (x *AzureRoleAssignment) GetSubscriptionId() string {
 	return ""
 }
 
-func (x *AzureRoleAssignment) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 func (x *AzureRoleAssignment) GetPrincipalId() string {
 	if x != nil {
 		return x.PrincipalId
@@ -574,8 +546,6 @@ type AzureRoleDefinition struct {
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// subscription_id is the ID of the subscription to which the role definition belongs
 	SubscriptionId string `protobuf:"bytes,2,opt,name=subscription_id,json=subscriptionId,proto3" json:"subscription_id,omitempty"`
-	// last_sync_time is when the role definition was last fetched from Azure
-	LastSyncTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_sync_time,json=lastSyncTime,proto3" json:"last_sync_time,omitempty"`
 	// name is the given name for the role definition
 	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
 	// description provides additional detail about the role definition
@@ -636,13 +606,6 @@ func (x *AzureRoleDefinition) GetSubscriptionId() string {
 	return ""
 }
 
-func (x *AzureRoleDefinition) GetLastSyncTime() *timestamppb.Timestamp {
-	if x != nil {
-		return x.LastSyncTime
-	}
-	return nil
-}
-
 func (x *AzureRoleDefinition) GetName() string {
 	if x != nil {
 		return x.Name
@@ -762,7 +725,7 @@ var File_accessgraph_v1alpha_azure_proto protoreflect.FileDescriptor
 
 const file_accessgraph_v1alpha_azure_proto_rawDesc = "" +
 	"\n" +
-	"\x1faccessgraph/v1alpha/azure.proto\x12\x13accessgraph.v1alpha\x1a\x1fgoogle/protobuf/timestamp.proto\"U\n" +
+	"\x1faccessgraph/v1alpha/azure.proto\x12\x13accessgraph.v1alpha\"U\n" +
 	"\x11AzureResourceList\x12@\n" +
 	"\tresources\x18\x01 \x03(\v2\".accessgraph.v1alpha.AzureResourceR\tresources\"\xdf\x02\n" +
 	"\rAzureResource\x12C\n" +
@@ -771,52 +734,48 @@ const file_accessgraph_v1alpha_azure_proto_rawDesc = "" +
 	"\x0frole_assignment\x18\x03 \x01(\v2(.accessgraph.v1alpha.AzureRoleAssignmentH\x00R\x0eroleAssignment\x12S\n" +
 	"\x0fvirtual_machine\x18\x04 \x01(\v2(.accessgraph.v1alpha.AzureVirtualMachineH\x00R\x0evirtualMachineB\n" +
 	"\n" +
-	"\bresource\"\xe8\x02\n" +
+	"\bresource\"\xbc\x02\n" +
 	"\x13AzureVirtualMachine\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
-	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12@\n" +
-	"\x0elast_sync_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\x12\x12\n" +
+	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12\x12\n" +
 	"\x04name\x18\x04 \x01(\tR\x04name\x12%\n" +
 	"\x0eresource_group\x18\x05 \x01(\tR\rresourceGroup\x12F\n" +
 	"\x04tags\x18\x06 \x03(\v22.accessgraph.v1alpha.AzureVirtualMachine.TagsEntryR\x04tags\x12\x1a\n" +
 	"\blocation\x18\a \x01(\tR\blocation\x1a7\n" +
 	"\tTagsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"w\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x03\x10\x04R\x0elast_sync_time\"w\n" +
 	"\rAzureIdentity\x12 \n" +
 	"\fsign_in_type\x18\x01 \x01(\tR\n" +
 	"signInType\x12\x16\n" +
 	"\x06issuer\x18\x02 \x01(\tR\x06issuer\x12,\n" +
-	"\x12issuer_assigned_id\x18\x03 \x01(\tR\x10issuerAssignedId\"\xb0\x02\n" +
+	"\x12issuer_assigned_id\x18\x03 \x01(\tR\x10issuerAssignedId\"\x84\x02\n" +
 	"\x0eAzurePrincipal\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
-	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12@\n" +
-	"\x0elast_sync_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\x12!\n" +
+	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12!\n" +
 	"\fdisplay_name\x18\x04 \x01(\tR\vdisplayName\x12\x1b\n" +
 	"\tmember_of\x18\x05 \x03(\tR\bmemberOf\x12B\n" +
 	"\n" +
 	"identities\x18\x06 \x03(\v2\".accessgraph.v1alpha.AzureIdentityR\n" +
 	"identities\x12\x1f\n" +
 	"\vobject_type\x18\a \x01(\tR\n" +
-	"objectType\"\x95\x02\n" +
+	"objectTypeJ\x04\b\x03\x10\x04R\x0elast_sync_time\"\xe9\x01\n" +
 	"\x13AzureRoleAssignment\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
-	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12@\n" +
-	"\x0elast_sync_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\x12!\n" +
+	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12!\n" +
 	"\fprincipal_id\x18\x04 \x01(\tR\vprincipalId\x12,\n" +
 	"\x12role_definition_id\x18\x05 \x01(\tR\x10roleDefinitionId\x12\x14\n" +
 	"\x05scope\x18\x06 \x01(\tR\x05scope\x12\x1c\n" +
-	"\tcondition\x18\a \x01(\tR\tcondition\"\xf0\x02\n" +
+	"\tcondition\x18\a \x01(\tR\tconditionJ\x04\b\x03\x10\x04R\x0elast_sync_time\"\xc4\x02\n" +
 	"\x13AzureRoleDefinition\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
-	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12@\n" +
-	"\x0elast_sync_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\flastSyncTime\x12\x12\n" +
+	"\x0fsubscription_id\x18\x02 \x01(\tR\x0esubscriptionId\x12\x12\n" +
 	"\x04name\x18\x04 \x01(\tR\x04name\x12 \n" +
 	"\vdescription\x18\x05 \x01(\tR\vdescription\x12+\n" +
 	"\x11assignable_scopes\x18\x06 \x03(\tR\x10assignableScopes\x12J\n" +
 	"\vpermissions\x18\a \x03(\v2(.accessgraph.v1alpha.AzureRBACPermissionR\vpermissions\x12\x1b\n" +
 	"\trole_name\x18\b \x01(\tR\broleName\x12\x12\n" +
-	"\x04type\x18\t \x01(\tR\x04type\"\x9d\x01\n" +
+	"\x04type\x18\t \x01(\tR\x04typeJ\x04\b\x03\x10\x04R\x0elast_sync_time\"\x9d\x01\n" +
 	"\x13AzureRBACPermission\x12\x18\n" +
 	"\aactions\x18\x01 \x03(\tR\aactions\x12\x1f\n" +
 	"\vnot_actions\x18\x02 \x03(\tR\n" +
@@ -838,35 +797,30 @@ func file_accessgraph_v1alpha_azure_proto_rawDescGZIP() []byte {
 
 var file_accessgraph_v1alpha_azure_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_accessgraph_v1alpha_azure_proto_goTypes = []any{
-	(*AzureResourceList)(nil),     // 0: accessgraph.v1alpha.AzureResourceList
-	(*AzureResource)(nil),         // 1: accessgraph.v1alpha.AzureResource
-	(*AzureVirtualMachine)(nil),   // 2: accessgraph.v1alpha.AzureVirtualMachine
-	(*AzureIdentity)(nil),         // 3: accessgraph.v1alpha.AzureIdentity
-	(*AzurePrincipal)(nil),        // 4: accessgraph.v1alpha.AzurePrincipal
-	(*AzureRoleAssignment)(nil),   // 5: accessgraph.v1alpha.AzureRoleAssignment
-	(*AzureRoleDefinition)(nil),   // 6: accessgraph.v1alpha.AzureRoleDefinition
-	(*AzureRBACPermission)(nil),   // 7: accessgraph.v1alpha.AzureRBACPermission
-	nil,                           // 8: accessgraph.v1alpha.AzureVirtualMachine.TagsEntry
-	(*timestamppb.Timestamp)(nil), // 9: google.protobuf.Timestamp
+	(*AzureResourceList)(nil),   // 0: accessgraph.v1alpha.AzureResourceList
+	(*AzureResource)(nil),       // 1: accessgraph.v1alpha.AzureResource
+	(*AzureVirtualMachine)(nil), // 2: accessgraph.v1alpha.AzureVirtualMachine
+	(*AzureIdentity)(nil),       // 3: accessgraph.v1alpha.AzureIdentity
+	(*AzurePrincipal)(nil),      // 4: accessgraph.v1alpha.AzurePrincipal
+	(*AzureRoleAssignment)(nil), // 5: accessgraph.v1alpha.AzureRoleAssignment
+	(*AzureRoleDefinition)(nil), // 6: accessgraph.v1alpha.AzureRoleDefinition
+	(*AzureRBACPermission)(nil), // 7: accessgraph.v1alpha.AzureRBACPermission
+	nil,                         // 8: accessgraph.v1alpha.AzureVirtualMachine.TagsEntry
 }
 var file_accessgraph_v1alpha_azure_proto_depIdxs = []int32{
-	1,  // 0: accessgraph.v1alpha.AzureResourceList.resources:type_name -> accessgraph.v1alpha.AzureResource
-	4,  // 1: accessgraph.v1alpha.AzureResource.principal:type_name -> accessgraph.v1alpha.AzurePrincipal
-	6,  // 2: accessgraph.v1alpha.AzureResource.role_definition:type_name -> accessgraph.v1alpha.AzureRoleDefinition
-	5,  // 3: accessgraph.v1alpha.AzureResource.role_assignment:type_name -> accessgraph.v1alpha.AzureRoleAssignment
-	2,  // 4: accessgraph.v1alpha.AzureResource.virtual_machine:type_name -> accessgraph.v1alpha.AzureVirtualMachine
-	9,  // 5: accessgraph.v1alpha.AzureVirtualMachine.last_sync_time:type_name -> google.protobuf.Timestamp
-	8,  // 6: accessgraph.v1alpha.AzureVirtualMachine.tags:type_name -> accessgraph.v1alpha.AzureVirtualMachine.TagsEntry
-	9,  // 7: accessgraph.v1alpha.AzurePrincipal.last_sync_time:type_name -> google.protobuf.Timestamp
-	3,  // 8: accessgraph.v1alpha.AzurePrincipal.identities:type_name -> accessgraph.v1alpha.AzureIdentity
-	9,  // 9: accessgraph.v1alpha.AzureRoleAssignment.last_sync_time:type_name -> google.protobuf.Timestamp
-	9,  // 10: accessgraph.v1alpha.AzureRoleDefinition.last_sync_time:type_name -> google.protobuf.Timestamp
-	7,  // 11: accessgraph.v1alpha.AzureRoleDefinition.permissions:type_name -> accessgraph.v1alpha.AzureRBACPermission
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	1, // 0: accessgraph.v1alpha.AzureResourceList.resources:type_name -> accessgraph.v1alpha.AzureResource
+	4, // 1: accessgraph.v1alpha.AzureResource.principal:type_name -> accessgraph.v1alpha.AzurePrincipal
+	6, // 2: accessgraph.v1alpha.AzureResource.role_definition:type_name -> accessgraph.v1alpha.AzureRoleDefinition
+	5, // 3: accessgraph.v1alpha.AzureResource.role_assignment:type_name -> accessgraph.v1alpha.AzureRoleAssignment
+	2, // 4: accessgraph.v1alpha.AzureResource.virtual_machine:type_name -> accessgraph.v1alpha.AzureVirtualMachine
+	8, // 5: accessgraph.v1alpha.AzureVirtualMachine.tags:type_name -> accessgraph.v1alpha.AzureVirtualMachine.TagsEntry
+	3, // 6: accessgraph.v1alpha.AzurePrincipal.identities:type_name -> accessgraph.v1alpha.AzureIdentity
+	7, // 7: accessgraph.v1alpha.AzureRoleDefinition.permissions:type_name -> accessgraph.v1alpha.AzureRBACPermission
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_accessgraph_v1alpha_azure_proto_init() }
diff --git a/gen/proto/go/accessgraph/v1alpha/entra.pb.go b/gen/proto/go/accessgraph/v1alpha/entra.pb.go
index 53a19c1b20ebc..6a24967792e85 100644
--- a/gen/proto/go/accessgraph/v1alpha/entra.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/entra.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/entra.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/events.pb.go b/gen/proto/go/accessgraph/v1alpha/events.pb.go
index e163b3a26ccc0..c2a87d0347eb8 100644
--- a/gen/proto/go/accessgraph/v1alpha/events.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/events.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/events.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/github.pb.go b/gen/proto/go/accessgraph/v1alpha/github.pb.go
index 6b76f15e83aa2..7f06aa1e31a6e 100644
--- a/gen/proto/go/accessgraph/v1alpha/github.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/github.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/github.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/gitlab.pb.go b/gen/proto/go/accessgraph/v1alpha/gitlab.pb.go
index 1d34025899978..b812ebfee1ac7 100644
--- a/gen/proto/go/accessgraph/v1alpha/gitlab.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/gitlab.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/gitlab.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/graph.pb.go b/gen/proto/go/accessgraph/v1alpha/graph.pb.go
index b34c0f96c2aa3..8d8955f0f817b 100644
--- a/gen/proto/go/accessgraph/v1alpha/graph.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/graph.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/graph.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/netiq.pb.go b/gen/proto/go/accessgraph/v1alpha/netiq.pb.go
index 86e431001a3ca..238820086eae7 100644
--- a/gen/proto/go/accessgraph/v1alpha/netiq.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/netiq.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/netiq.proto
 
diff --git a/gen/proto/go/accessgraph/v1alpha/okta.pb.go b/gen/proto/go/accessgraph/v1alpha/okta.pb.go
index 0d76576c09050..f1ebe347c8b0c 100644
--- a/gen/proto/go/accessgraph/v1alpha/okta.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/okta.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/okta.proto
 
@@ -467,7 +467,9 @@ func (x *OktaAuditLogV1) GetCursor() *OktaAuditLogV1Cursor {
 type OktaConfigV1 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The desired start date from which to begin exporting Okta audit logs.
-	StartDate     *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=start_date,json=startDate,proto3" json:"start_date,omitempty"`
+	StartDate *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=start_date,json=startDate,proto3" json:"start_date,omitempty"`
+	// organization is the Okta organization name.
+	Organization  string `protobuf:"bytes,2,opt,name=organization,proto3" json:"organization,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -509,6 +511,13 @@ func (x *OktaConfigV1) GetStartDate() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *OktaConfigV1) GetOrganization() string {
+	if x != nil {
+		return x.Organization
+	}
+	return ""
+}
+
 // OktaTokenV1 holds information about an Okta token (ex.: an API token),
 // such as its ID, owner, and lifecycle dates (created, updated, expires).
 type OktaTokenV1 struct {
@@ -961,10 +970,11 @@ const file_accessgraph_v1alpha_okta_proto_rawDesc = "" +
 	"\x0flast_event_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\rlastEventTime\"\x8d\x01\n" +
 	"\x0eOktaAuditLogV1\x128\n" +
 	"\x06events\x18\x01 \x03(\v2 .accessgraph.v1alpha.OktaEventV1R\x06events\x12A\n" +
-	"\x06cursor\x18\x02 \x01(\v2).accessgraph.v1alpha.OktaAuditLogV1CursorR\x06cursor\"I\n" +
+	"\x06cursor\x18\x02 \x01(\v2).accessgraph.v1alpha.OktaAuditLogV1CursorR\x06cursor\"m\n" +
 	"\fOktaConfigV1\x129\n" +
 	"\n" +
-	"start_date\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\tstartDate\"\x8d\x02\n" +
+	"start_date\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\tstartDate\x12\"\n" +
+	"\forganization\x18\x02 \x01(\tR\forganization\"\x8d\x02\n" +
 	"\vOktaTokenV1\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12\x14\n" +
diff --git a/gen/proto/go/accessgraph/v1alpha/resources.pb.go b/gen/proto/go/accessgraph/v1alpha/resources.pb.go
index f72ef79e4d7cc..8ad76bbb45eb6 100644
--- a/gen/proto/go/accessgraph/v1alpha/resources.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/resources.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: accessgraph/v1alpha/resources.proto
 
diff --git a/gen/proto/go/prehog/v1/teleport.pb.go b/gen/proto/go/prehog/v1/teleport.pb.go
index 9e671ca3b9034..ae35a3d7b6cad 100644
--- a/gen/proto/go/prehog/v1/teleport.pb.go
+++ b/gen/proto/go/prehog/v1/teleport.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: prehog/v1/teleport.proto
 
@@ -60,6 +60,10 @@ const (
 	//
 	// PostHog property value: "bot"
 	UserKind_USER_KIND_BOT UserKind = 2
+	// Indicates that the user associated with this event is a system component e.g. Okta service.
+	//
+	// PostHog property value: "system"
+	UserKind_USER_KIND_SYSTEM UserKind = 3
 )
 
 // Enum value maps for UserKind.
@@ -68,11 +72,13 @@ var (
 		0: "USER_KIND_UNSPECIFIED",
 		1: "USER_KIND_HUMAN",
 		2: "USER_KIND_BOT",
+		3: "USER_KIND_SYSTEM",
 	}
 	UserKind_value = map[string]int32{
 		"USER_KIND_UNSPECIFIED": 0,
 		"USER_KIND_HUMAN":       1,
 		"USER_KIND_BOT":         2,
+		"USER_KIND_SYSTEM":      3,
 	}
 )
 
@@ -1171,11 +1177,12 @@ const file_prehog_v1_teleport_proto_rawDesc = "" +
 	"\x15bot_instance_activity\x18\x03 \x03(\v2$.prehog.v1.BotInstanceActivityReportR\x13botInstanceActivity\";\n" +
 	"\x1aSubmitUsageReportsResponse\x12\x1d\n" +
 	"\n" +
-	"batch_uuid\x18\x01 \x01(\fR\tbatchUuid*M\n" +
+	"batch_uuid\x18\x01 \x01(\fR\tbatchUuid*c\n" +
 	"\bUserKind\x12\x19\n" +
 	"\x15USER_KIND_UNSPECIFIED\x10\x00\x12\x13\n" +
 	"\x0fUSER_KIND_HUMAN\x10\x01\x12\x11\n" +
-	"\rUSER_KIND_BOT\x10\x02*\x9a\x01\n" +
+	"\rUSER_KIND_BOT\x10\x02\x12\x14\n" +
+	"\x10USER_KIND_SYSTEM\x10\x03*\x9a\x01\n" +
 	"\n" +
 	"UserOrigin\x12\x1b\n" +
 	"\x17USER_ORIGIN_UNSPECIFIED\x10\x00\x12\x15\n" +
diff --git a/gen/proto/go/prehog/v1alpha/connect.pb.go b/gen/proto/go/prehog/v1alpha/connect.pb.go
index 9039cb3fcd33d..883b5ec8c08ef 100644
--- a/gen/proto/go/prehog/v1alpha/connect.pb.go
+++ b/gen/proto/go/prehog/v1alpha/connect.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: prehog/v1alpha/connect.proto
 
diff --git a/gen/proto/go/prehog/v1alpha/tbot.pb.go b/gen/proto/go/prehog/v1alpha/tbot.pb.go
index 3d0e544072fc5..3e01f6fe1a1c8 100644
--- a/gen/proto/go/prehog/v1alpha/tbot.pb.go
+++ b/gen/proto/go/prehog/v1alpha/tbot.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: prehog/v1alpha/tbot.proto
 
diff --git a/gen/proto/go/prehog/v1alpha/teleport.pb.go b/gen/proto/go/prehog/v1alpha/teleport.pb.go
index abbc9da045838..8d2340c656898 100644
--- a/gen/proto/go/prehog/v1alpha/teleport.pb.go
+++ b/gen/proto/go/prehog/v1alpha/teleport.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: prehog/v1alpha/teleport.proto
 
@@ -209,6 +209,10 @@ const (
 	//
 	// PostHog property value: "bot"
 	UserKind_USER_KIND_BOT UserKind = 2
+	// Indicates that the user associated with this event is a system component e.g. Okta service.
+	//
+	// PostHog property value: "system"
+	UserKind_USER_KIND_SYSTEM UserKind = 3
 )
 
 // Enum value maps for UserKind.
@@ -217,11 +221,13 @@ var (
 		0: "USER_KIND_UNSPECIFIED",
 		1: "USER_KIND_HUMAN",
 		2: "USER_KIND_BOT",
+		3: "USER_KIND_SYSTEM",
 	}
 	UserKind_value = map[string]int32{
 		"USER_KIND_UNSPECIFIED": 0,
 		"USER_KIND_HUMAN":       1,
 		"USER_KIND_BOT":         2,
+		"USER_KIND_SYSTEM":      3,
 	}
 )
 
@@ -298,6 +304,9 @@ const (
 	DiscoverResource_DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD            DiscoverResource = 39
 	DiscoverResource_DISCOVER_RESOURCE_KUBERNETES_EKS                        DiscoverResource = 40
 	DiscoverResource_DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE               DiscoverResource = 41
+	DiscoverResource_DISCOVER_RESOURCE_MCP_STDIO                             DiscoverResource = 42
+	DiscoverResource_DISCOVER_RESOURCE_MCP_SSE                               DiscoverResource = 43
+	DiscoverResource_DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP                   DiscoverResource = 44
 )
 
 // Enum value maps for DiscoverResource.
@@ -345,6 +354,9 @@ var (
 		39: "DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD",
 		40: "DISCOVER_RESOURCE_KUBERNETES_EKS",
 		41: "DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE",
+		42: "DISCOVER_RESOURCE_MCP_STDIO",
+		43: "DISCOVER_RESOURCE_MCP_SSE",
+		44: "DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP",
 	}
 	DiscoverResource_value = map[string]int32{
 		"DISCOVER_RESOURCE_UNSPECIFIED":                           0,
@@ -389,6 +401,9 @@ var (
 		"DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD":            39,
 		"DISCOVER_RESOURCE_KUBERNETES_EKS":                        40,
 		"DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE":               41,
+		"DISCOVER_RESOURCE_MCP_STDIO":                             42,
+		"DISCOVER_RESOURCE_MCP_SSE":                               43,
+		"DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP":                   44,
 	}
 )
 
@@ -570,34 +585,36 @@ func (CTA) EnumDescriptor() ([]byte, []int) {
 type IntegrationEnrollKind int32
 
 const (
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_UNSPECIFIED                 IntegrationEnrollKind = 0
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SLACK                       IntegrationEnrollKind = 1
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_OIDC                    IntegrationEnrollKind = 2
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_PAGERDUTY                   IntegrationEnrollKind = 3
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_EMAIL                       IntegrationEnrollKind = 4
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JIRA                        IntegrationEnrollKind = 5
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DISCORD                     IntegrationEnrollKind = 6
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MATTERMOST                  IntegrationEnrollKind = 7
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MS_TEAMS                    IntegrationEnrollKind = 8
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OPSGENIE                    IntegrationEnrollKind = 9
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OKTA                        IntegrationEnrollKind = 10
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JAMF                        IntegrationEnrollKind = 11
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID                  IntegrationEnrollKind = 12
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS   IntegrationEnrollKind = 13
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI         IntegrationEnrollKind = 14
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB           IntegrationEnrollKind = 15
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS          IntegrationEnrollKind = 16
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE          IntegrationEnrollKind = 17
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS              IntegrationEnrollKind = 18
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP              IntegrationEnrollKind = 19
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE            IntegrationEnrollKind = 20
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT        IntegrationEnrollKind = 21
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES       IntegrationEnrollKind = 22
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_ENTRA_ID                    IntegrationEnrollKind = 23
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT IntegrationEnrollKind = 24
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SERVICENOW                  IntegrationEnrollKind = 25
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER         IntegrationEnrollKind = 26
-	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS          IntegrationEnrollKind = 27
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_UNSPECIFIED                          IntegrationEnrollKind = 0
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SLACK                                IntegrationEnrollKind = 1
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_OIDC                             IntegrationEnrollKind = 2
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_PAGERDUTY                            IntegrationEnrollKind = 3
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_EMAIL                                IntegrationEnrollKind = 4
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JIRA                                 IntegrationEnrollKind = 5
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DISCORD                              IntegrationEnrollKind = 6
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MATTERMOST                           IntegrationEnrollKind = 7
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MS_TEAMS                             IntegrationEnrollKind = 8
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OPSGENIE                             IntegrationEnrollKind = 9
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_OKTA                                 IntegrationEnrollKind = 10
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_JAMF                                 IntegrationEnrollKind = 11
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID                           IntegrationEnrollKind = 12
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS            IntegrationEnrollKind = 13
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI                  IntegrationEnrollKind = 14
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB                    IntegrationEnrollKind = 15
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS                   IntegrationEnrollKind = 16
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE                   IntegrationEnrollKind = 17
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS                       IntegrationEnrollKind = 18
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP                       IntegrationEnrollKind = 19
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE                     IntegrationEnrollKind = 20
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT                 IntegrationEnrollKind = 21
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES                IntegrationEnrollKind = 22
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_ENTRA_ID                             IntegrationEnrollKind = 23
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT          IntegrationEnrollKind = 24
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_SERVICENOW                           IntegrationEnrollKind = 25
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER                  IntegrationEnrollKind = 26
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS                   IntegrationEnrollKind = 27
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD                    IntegrationEnrollKind = 28
+	IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES IntegrationEnrollKind = 29
 )
 
 // Enum value maps for IntegrationEnrollKind.
@@ -631,36 +648,40 @@ var (
 		25: "INTEGRATION_ENROLL_KIND_SERVICENOW",
 		26: "INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER",
 		27: "INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS",
+		28: "INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD",
+		29: "INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES",
 	}
 	IntegrationEnrollKind_value = map[string]int32{
-		"INTEGRATION_ENROLL_KIND_UNSPECIFIED":                 0,
-		"INTEGRATION_ENROLL_KIND_SLACK":                       1,
-		"INTEGRATION_ENROLL_KIND_AWS_OIDC":                    2,
-		"INTEGRATION_ENROLL_KIND_PAGERDUTY":                   3,
-		"INTEGRATION_ENROLL_KIND_EMAIL":                       4,
-		"INTEGRATION_ENROLL_KIND_JIRA":                        5,
-		"INTEGRATION_ENROLL_KIND_DISCORD":                     6,
-		"INTEGRATION_ENROLL_KIND_MATTERMOST":                  7,
-		"INTEGRATION_ENROLL_KIND_MS_TEAMS":                    8,
-		"INTEGRATION_ENROLL_KIND_OPSGENIE":                    9,
-		"INTEGRATION_ENROLL_KIND_OKTA":                        10,
-		"INTEGRATION_ENROLL_KIND_JAMF":                        11,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID":                  12,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS":   13,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI":         14,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB":           15,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS":          16,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE":          17,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS":              18,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP":              19,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE":            20,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT":        21,
-		"INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES":       22,
-		"INTEGRATION_ENROLL_KIND_ENTRA_ID":                    23,
-		"INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT": 24,
-		"INTEGRATION_ENROLL_KIND_SERVICENOW":                  25,
-		"INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER":         26,
-		"INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS":          27,
+		"INTEGRATION_ENROLL_KIND_UNSPECIFIED":                          0,
+		"INTEGRATION_ENROLL_KIND_SLACK":                                1,
+		"INTEGRATION_ENROLL_KIND_AWS_OIDC":                             2,
+		"INTEGRATION_ENROLL_KIND_PAGERDUTY":                            3,
+		"INTEGRATION_ENROLL_KIND_EMAIL":                                4,
+		"INTEGRATION_ENROLL_KIND_JIRA":                                 5,
+		"INTEGRATION_ENROLL_KIND_DISCORD":                              6,
+		"INTEGRATION_ENROLL_KIND_MATTERMOST":                           7,
+		"INTEGRATION_ENROLL_KIND_MS_TEAMS":                             8,
+		"INTEGRATION_ENROLL_KIND_OPSGENIE":                             9,
+		"INTEGRATION_ENROLL_KIND_OKTA":                                 10,
+		"INTEGRATION_ENROLL_KIND_JAMF":                                 11,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID":                           12,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS":            13,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI":                  14,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB":                    15,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS":                   16,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_ANSIBLE":                   17,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_AWS":                       18,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GCP":                       19,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE":                     20,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT":                 21,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES":                22,
+		"INTEGRATION_ENROLL_KIND_ENTRA_ID":                             23,
+		"INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT":          24,
+		"INTEGRATION_ENROLL_KIND_SERVICENOW":                           25,
+		"INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER":                  26,
+		"INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS":                   27,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD":                    28,
+		"INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES": 29,
 	}
 )
 
@@ -707,20 +728,29 @@ const (
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER  IntegrationEnrollStep = 6
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT IntegrationEnrollStep = 7
 	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE        IntegrationEnrollStep = 8
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB   IntegrationEnrollStep = 9
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS IntegrationEnrollStep = 10
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW   IntegrationEnrollStep = 11
+	IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME          IntegrationEnrollStep = 12
 )
 
 // Enum value maps for IntegrationEnrollStep.
 var (
 	IntegrationEnrollStep_name = map[int32]string{
-		0: "INTEGRATION_ENROLL_STEP_UNSPECIFIED",
-		1: "INTEGRATION_ENROLL_STEP_AWSIC_CONNECT_OIDC",
-		2: "INTEGRATION_ENROLL_STEP_AWSIC_SET_ACCESSLIST_DEFAULT_OWNER",
-		3: "INTEGRATION_ENROLL_STEP_AWSIC_UPLOAD_AWS_SAML_SP_METADATA",
-		4: "INTEGRATION_ENROLL_STEP_AWSIC_TEST_SCIM_CONNECTION",
-		5: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_INTEGRATION",
-		6: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER",
-		7: "INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT",
-		8: "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE",
+		0:  "INTEGRATION_ENROLL_STEP_UNSPECIFIED",
+		1:  "INTEGRATION_ENROLL_STEP_AWSIC_CONNECT_OIDC",
+		2:  "INTEGRATION_ENROLL_STEP_AWSIC_SET_ACCESSLIST_DEFAULT_OWNER",
+		3:  "INTEGRATION_ENROLL_STEP_AWSIC_UPLOAD_AWS_SAML_SP_METADATA",
+		4:  "INTEGRATION_ENROLL_STEP_AWSIC_TEST_SCIM_CONNECTION",
+		5:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_INTEGRATION",
+		6:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER",
+		7:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT",
+		8:  "INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE",
+		9:  "INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB",
+		10: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS",
+		11: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW",
+		12: "INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME",
 	}
 	IntegrationEnrollStep_value = map[string]int32{
 		"INTEGRATION_ENROLL_STEP_UNSPECIFIED":                        0,
@@ -732,6 +762,10 @@ var (
 		"INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER":         6,
 		"INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT":        7,
 		"INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE":               8,
+		"INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB":           9,
+		"INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS":         10,
+		"INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW":           11,
+		"INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME":                  12,
 	}
 )
 
@@ -825,6 +859,194 @@ func (IntegrationEnrollStatusCode) EnumDescriptor() ([]byte, []int) {
 	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{8}
 }
 
+// IntegrationEnrollSection identifies a section the user opened or expanded in
+// an integration setup wizard.
+type IntegrationEnrollSection int32
+
+const (
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_UNSPECIFIED IntegrationEnrollSection = 0
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS         IntegrationEnrollSection = 1
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER         IntegrationEnrollSection = 2
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS     IntegrationEnrollSection = 3
+	IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER IntegrationEnrollSection = 4
+)
+
+// Enum value maps for IntegrationEnrollSection.
+var (
+	IntegrationEnrollSection_name = map[int32]string{
+		0: "INTEGRATION_ENROLL_SECTION_UNSPECIFIED",
+		1: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS",
+		2: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER",
+		3: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS",
+		4: "INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER",
+	}
+	IntegrationEnrollSection_value = map[string]int32{
+		"INTEGRATION_ENROLL_SECTION_UNSPECIFIED":                               0,
+		"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS":         1,
+		"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER":         2,
+		"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS":     3,
+		"INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER": 4,
+	}
+)
+
+func (x IntegrationEnrollSection) Enum() *IntegrationEnrollSection {
+	p := new(IntegrationEnrollSection)
+	*p = x
+	return p
+}
+
+func (x IntegrationEnrollSection) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IntegrationEnrollSection) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[9].Descriptor()
+}
+
+func (IntegrationEnrollSection) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[9]
+}
+
+func (x IntegrationEnrollSection) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IntegrationEnrollSection.Descriptor instead.
+func (IntegrationEnrollSection) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{9}
+}
+
+// IntegrationEnrollField identifies a field the user completed in an integration
+// setup wizard.
+type IntegrationEnrollField int32
+
+const (
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_UNSPECIFIED IntegrationEnrollField = 0
+	// MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL         IntegrationEnrollField = 1
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH                 IntegrationEnrollField = 2
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW               IntegrationEnrollField = 3
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT            IntegrationEnrollField = 4
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF                    IntegrationEnrollField = 5
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG        IntegrationEnrollField = 6
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS IntegrationEnrollField = 7
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS             IntegrationEnrollField = 8
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS             IntegrationEnrollField = 9
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS              IntegrationEnrollField = 10
+	IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES     IntegrationEnrollField = 11
+)
+
+// Enum value maps for IntegrationEnrollField.
+var (
+	IntegrationEnrollField_name = map[int32]string{
+		0:  "INTEGRATION_ENROLL_FIELD_UNSPECIFIED",
+		1:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL",
+		2:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH",
+		3:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW",
+		4:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT",
+		5:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF",
+		6:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG",
+		7:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS",
+		8:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS",
+		9:  "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS",
+		10: "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS",
+		11: "INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES",
+	}
+	IntegrationEnrollField_value = map[string]int32{
+		"INTEGRATION_ENROLL_FIELD_UNSPECIFIED":                             0,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL":         1,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH":                 2,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW":               3,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT":            4,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF":                    5,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG":        6,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS": 7,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS":             8,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS":             9,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS":              10,
+		"INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES":     11,
+	}
+)
+
+func (x IntegrationEnrollField) Enum() *IntegrationEnrollField {
+	p := new(IntegrationEnrollField)
+	*p = x
+	return p
+}
+
+func (x IntegrationEnrollField) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IntegrationEnrollField) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[10].Descriptor()
+}
+
+func (IntegrationEnrollField) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[10]
+}
+
+func (x IntegrationEnrollField) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IntegrationEnrollField.Descriptor instead.
+func (IntegrationEnrollField) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{10}
+}
+
+// IntegrationEnrollCodeType identifies the type of code that was copied in an
+// integration setup wizard.
+type IntegrationEnrollCodeType int32
+
+const (
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED         IntegrationEnrollCodeType = 0
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM           IntegrationEnrollCodeType = 1
+	IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML IntegrationEnrollCodeType = 2
+)
+
+// Enum value maps for IntegrationEnrollCodeType.
+var (
+	IntegrationEnrollCodeType_name = map[int32]string{
+		0: "INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED",
+		1: "INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM",
+		2: "INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML",
+	}
+	IntegrationEnrollCodeType_value = map[string]int32{
+		"INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED":         0,
+		"INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM":           1,
+		"INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML": 2,
+	}
+)
+
+func (x IntegrationEnrollCodeType) Enum() *IntegrationEnrollCodeType {
+	p := new(IntegrationEnrollCodeType)
+	*p = x
+	return p
+}
+
+func (x IntegrationEnrollCodeType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IntegrationEnrollCodeType) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[11].Descriptor()
+}
+
+func (IntegrationEnrollCodeType) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[11]
+}
+
+func (x IntegrationEnrollCodeType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IntegrationEnrollCodeType.Descriptor instead.
+func (IntegrationEnrollCodeType) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{11}
+}
+
 // EditorChangeStatus is the possible value of an EditorChangeEvent event status
 type EditorChangeStatus int32
 
@@ -861,11 +1083,11 @@ func (x EditorChangeStatus) String() string {
 }
 
 func (EditorChangeStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[9].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[12].Descriptor()
 }
 
 func (EditorChangeStatus) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[9]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[12]
 }
 
 func (x EditorChangeStatus) Number() protoreflect.EnumNumber {
@@ -874,7 +1096,7 @@ func (x EditorChangeStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use EditorChangeStatus.Descriptor instead.
 func (EditorChangeStatus) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{9}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
 }
 
 // Feature is name of Teleport feature
@@ -908,11 +1130,11 @@ func (x Feature) String() string {
 }
 
 func (Feature) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[10].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[13].Descriptor()
 }
 
 func (Feature) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[10]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[13]
 }
 
 func (x Feature) Number() protoreflect.EnumNumber {
@@ -921,7 +1143,7 @@ func (x Feature) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Feature.Descriptor instead.
 func (Feature) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{10}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{13}
 }
 
 // FeatureRecommendationStatus is feature recommendation status.
@@ -960,11 +1182,11 @@ func (x FeatureRecommendationStatus) String() string {
 }
 
 func (FeatureRecommendationStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[11].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[14].Descriptor()
 }
 
 func (FeatureRecommendationStatus) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[11]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[14]
 }
 
 func (x FeatureRecommendationStatus) Number() protoreflect.EnumNumber {
@@ -973,7 +1195,7 @@ func (x FeatureRecommendationStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use FeatureRecommendationStatus.Descriptor instead.
 func (FeatureRecommendationStatus) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{11}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{14}
 }
 
 // LicenseLimit indicates event type that triggered LicenseLimitEvent.
@@ -1014,11 +1236,11 @@ func (x LicenseLimit) String() string {
 }
 
 func (LicenseLimit) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[12].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[15].Descriptor()
 }
 
 func (LicenseLimit) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[12]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[15]
 }
 
 func (x LicenseLimit) Number() protoreflect.EnumNumber {
@@ -1027,7 +1249,7 @@ func (x LicenseLimit) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use LicenseLimit.Descriptor instead.
 func (LicenseLimit) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{15}
 }
 
 // DeployMethod describes the method used to deploy a service.
@@ -1068,11 +1290,11 @@ func (x UIDiscoverDeployServiceEvent_DeployMethod) String() string {
 }
 
 func (UIDiscoverDeployServiceEvent_DeployMethod) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[13].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[16].Descriptor()
 }
 
 func (UIDiscoverDeployServiceEvent_DeployMethod) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[13]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[16]
 }
 
 func (x UIDiscoverDeployServiceEvent_DeployMethod) Number() protoreflect.EnumNumber {
@@ -1081,7 +1303,7 @@ func (x UIDiscoverDeployServiceEvent_DeployMethod) Number() protoreflect.EnumNum
 
 // Deprecated: Use UIDiscoverDeployServiceEvent_DeployMethod.Descriptor instead.
 func (UIDiscoverDeployServiceEvent_DeployMethod) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31, 0}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32, 0}
 }
 
 // DeployType describes the type of deployment.
@@ -1124,11 +1346,11 @@ func (x UIDiscoverDeployServiceEvent_DeployType) String() string {
 }
 
 func (UIDiscoverDeployServiceEvent_DeployType) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[14].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[17].Descriptor()
 }
 
 func (UIDiscoverDeployServiceEvent_DeployType) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[14]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[17]
 }
 
 func (x UIDiscoverDeployServiceEvent_DeployType) Number() protoreflect.EnumNumber {
@@ -1137,7 +1359,7 @@ func (x UIDiscoverDeployServiceEvent_DeployType) Number() protoreflect.EnumNumbe
 
 // Deprecated: Use UIDiscoverDeployServiceEvent_DeployType.Descriptor instead.
 func (UIDiscoverDeployServiceEvent_DeployType) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31, 1}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32, 1}
 }
 
 // ConfigMethod describes how the discovery config is configured.
@@ -1185,11 +1407,11 @@ func (x UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) String() string {
 }
 
 func (UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[15].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[18].Descriptor()
 }
 
 func (UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[15]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[18]
 }
 
 func (x UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) Number() protoreflect.EnumNumber {
@@ -1198,7 +1420,7 @@ func (x UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) Number() protoreflect
 
 // Deprecated: Use UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod.Descriptor instead.
 func (UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32, 0}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{33, 0}
 }
 
 // ProposedState specifies the proposed state of an access request review.
@@ -1238,11 +1460,11 @@ func (x AccessRequestReviewEvent_ProposedState) String() string {
 }
 
 func (AccessRequestReviewEvent_ProposedState) Descriptor() protoreflect.EnumDescriptor {
-	return file_prehog_v1alpha_teleport_proto_enumTypes[16].Descriptor()
+	return file_prehog_v1alpha_teleport_proto_enumTypes[19].Descriptor()
 }
 
 func (AccessRequestReviewEvent_ProposedState) Type() protoreflect.EnumType {
-	return &file_prehog_v1alpha_teleport_proto_enumTypes[16]
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[19]
 }
 
 func (x AccessRequestReviewEvent_ProposedState) Number() protoreflect.EnumNumber {
@@ -1251,7 +1473,7 @@ func (x AccessRequestReviewEvent_ProposedState) Number() protoreflect.EnumNumber
 
 // Deprecated: Use AccessRequestReviewEvent_ProposedState.Descriptor instead.
 func (AccessRequestReviewEvent_ProposedState) EnumDescriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{103, 0}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{108, 0}
 }
 
 // a successful user login
@@ -1720,7 +1942,10 @@ type SessionStartEvent struct {
 	App *SessionStartAppMetadata `protobuf:"bytes,6,opt,name=app,proto3" json:"app,omitempty"`
 	// if session_type == "git" the git struct contains additional information
 	// about git session.
-	Git           *SessionStartGitMetadata `protobuf:"bytes,7,opt,name=git,proto3" json:"git,omitempty"`
+	Git *SessionStartGitMetadata `protobuf:"bytes,7,opt,name=git,proto3" json:"git,omitempty"`
+	// if session_type == "app_mcp" the mcp struct contains additional information
+	// about the MCP session.
+	Mcp           *SessionStartMCPMetadata `protobuf:"bytes,8,opt,name=mcp,proto3" json:"mcp,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1804,6 +2029,13 @@ func (x *SessionStartEvent) GetGit() *SessionStartGitMetadata {
 	return nil
 }
 
+func (x *SessionStartEvent) GetMcp() *SessionStartMCPMetadata {
+	if x != nil {
+		return x.Mcp
+	}
+	return nil
+}
+
 // SessionStartDatabaseMetadata contains additional information about database session.
 type SessionStartDatabaseMetadata struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2068,6 +2300,97 @@ func (x *SessionStartGitMetadata) GetGitService() string {
 	return ""
 }
 
+// SessionStartMCPMetadata contains additional information about an MCP session.
+type SessionStartMCPMetadata struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Transport type of the MCP server. Value from types.GetMCPServerTransportType.
+	Transport string `protobuf:"bytes,1,opt,name=transport,proto3" json:"transport,omitempty"`
+	// MCP protocol version like "2025-06-18".
+	ProtocolVersion string `protobuf:"bytes,2,opt,name=protocol_version,json=protocolVersion,proto3" json:"protocol_version,omitempty"`
+	// Indicates the client used on the session, e.g "claude-ai".
+	ClientName string `protobuf:"bytes,3,opt,name=client_name,json=clientName,proto3" json:"client_name,omitempty"`
+	// Indicates the server used on the session, e.g "example-servers/everything".
+	ServerName string `protobuf:"bytes,4,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
+	// Indicates how the MCP session is authorized between MCP client and Teleport.
+	IngressAuthType string `protobuf:"bytes,5,opt,name=ingress_auth_type,json=ingressAuthType,proto3" json:"ingress_auth_type,omitempty"`
+	// Indicates how the MCP session is authorized between Teleport and remote MCP server.
+	EgressAuthType string `protobuf:"bytes,6,opt,name=egress_auth_type,json=egressAuthType,proto3" json:"egress_auth_type,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *SessionStartMCPMetadata) Reset() {
+	*x = SessionStartMCPMetadata{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionStartMCPMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionStartMCPMetadata) ProtoMessage() {}
+
+func (x *SessionStartMCPMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionStartMCPMetadata.ProtoReflect.Descriptor instead.
+func (*SessionStartMCPMetadata) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *SessionStartMCPMetadata) GetTransport() string {
+	if x != nil {
+		return x.Transport
+	}
+	return ""
+}
+
+func (x *SessionStartMCPMetadata) GetProtocolVersion() string {
+	if x != nil {
+		return x.ProtocolVersion
+	}
+	return ""
+}
+
+func (x *SessionStartMCPMetadata) GetClientName() string {
+	if x != nil {
+		return x.ClientName
+	}
+	return ""
+}
+
+func (x *SessionStartMCPMetadata) GetServerName() string {
+	if x != nil {
+		return x.ServerName
+	}
+	return ""
+}
+
+func (x *SessionStartMCPMetadata) GetIngressAuthType() string {
+	if x != nil {
+		return x.IngressAuthType
+	}
+	return ""
+}
+
+func (x *SessionStartMCPMetadata) GetEgressAuthType() string {
+	if x != nil {
+		return x.EgressAuthType
+	}
+	return ""
+}
+
 // the issuance of a user certificate from the user CA
 //
 // PostHog event: tp.certificate.issued
@@ -2108,7 +2431,7 @@ type UserCertificateIssuedEvent struct {
 
 func (x *UserCertificateIssuedEvent) Reset() {
 	*x = UserCertificateIssuedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[11]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2120,7 +2443,7 @@ func (x *UserCertificateIssuedEvent) String() string {
 func (*UserCertificateIssuedEvent) ProtoMessage() {}
 
 func (x *UserCertificateIssuedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[11]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2133,7 +2456,7 @@ func (x *UserCertificateIssuedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UserCertificateIssuedEvent.ProtoReflect.Descriptor instead.
 func (*UserCertificateIssuedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{11}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *UserCertificateIssuedEvent) GetUserName() string {
@@ -2234,7 +2557,7 @@ type SPIFFESVIDIssuedEvent struct {
 
 func (x *SPIFFESVIDIssuedEvent) Reset() {
 	*x = SPIFFESVIDIssuedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2246,7 +2569,7 @@ func (x *SPIFFESVIDIssuedEvent) String() string {
 func (*SPIFFESVIDIssuedEvent) ProtoMessage() {}
 
 func (x *SPIFFESVIDIssuedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2259,7 +2582,7 @@ func (x *SPIFFESVIDIssuedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SPIFFESVIDIssuedEvent.ProtoReflect.Descriptor instead.
 func (*SPIFFESVIDIssuedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *SPIFFESVIDIssuedEvent) GetUserName() string {
@@ -2325,7 +2648,7 @@ type UIBannerClickEvent struct {
 
 func (x *UIBannerClickEvent) Reset() {
 	*x = UIBannerClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2337,7 +2660,7 @@ func (x *UIBannerClickEvent) String() string {
 func (*UIBannerClickEvent) ProtoMessage() {}
 
 func (x *UIBannerClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2350,7 +2673,7 @@ func (x *UIBannerClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIBannerClickEvent.ProtoReflect.Descriptor instead.
 func (*UIBannerClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{13}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *UIBannerClickEvent) GetUserName() string {
@@ -2379,7 +2702,7 @@ type UIOnboardCompleteGoToDashboardClickEvent struct {
 
 func (x *UIOnboardCompleteGoToDashboardClickEvent) Reset() {
 	*x = UIOnboardCompleteGoToDashboardClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2391,7 +2714,7 @@ func (x *UIOnboardCompleteGoToDashboardClickEvent) String() string {
 func (*UIOnboardCompleteGoToDashboardClickEvent) ProtoMessage() {}
 
 func (x *UIOnboardCompleteGoToDashboardClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2404,7 +2727,7 @@ func (x *UIOnboardCompleteGoToDashboardClickEvent) ProtoReflect() protoreflect.M
 
 // Deprecated: Use UIOnboardCompleteGoToDashboardClickEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardCompleteGoToDashboardClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{14}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *UIOnboardCompleteGoToDashboardClickEvent) GetUserName() string {
@@ -2426,7 +2749,7 @@ type UIOnboardAddFirstResourceClickEvent struct {
 
 func (x *UIOnboardAddFirstResourceClickEvent) Reset() {
 	*x = UIOnboardAddFirstResourceClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2438,7 +2761,7 @@ func (x *UIOnboardAddFirstResourceClickEvent) String() string {
 func (*UIOnboardAddFirstResourceClickEvent) ProtoMessage() {}
 
 func (x *UIOnboardAddFirstResourceClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2451,7 +2774,7 @@ func (x *UIOnboardAddFirstResourceClickEvent) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use UIOnboardAddFirstResourceClickEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardAddFirstResourceClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{15}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *UIOnboardAddFirstResourceClickEvent) GetUserName() string {
@@ -2473,7 +2796,7 @@ type UIOnboardAddFirstResourceLaterClickEvent struct {
 
 func (x *UIOnboardAddFirstResourceLaterClickEvent) Reset() {
 	*x = UIOnboardAddFirstResourceLaterClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2485,7 +2808,7 @@ func (x *UIOnboardAddFirstResourceLaterClickEvent) String() string {
 func (*UIOnboardAddFirstResourceLaterClickEvent) ProtoMessage() {}
 
 func (x *UIOnboardAddFirstResourceLaterClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2498,7 +2821,7 @@ func (x *UIOnboardAddFirstResourceLaterClickEvent) ProtoReflect() protoreflect.M
 
 // Deprecated: Use UIOnboardAddFirstResourceLaterClickEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardAddFirstResourceLaterClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{16}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *UIOnboardAddFirstResourceLaterClickEvent) GetUserName() string {
@@ -2520,7 +2843,7 @@ type UIOnboardSetCredentialSubmitEvent struct {
 
 func (x *UIOnboardSetCredentialSubmitEvent) Reset() {
 	*x = UIOnboardSetCredentialSubmitEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2532,7 +2855,7 @@ func (x *UIOnboardSetCredentialSubmitEvent) String() string {
 func (*UIOnboardSetCredentialSubmitEvent) ProtoMessage() {}
 
 func (x *UIOnboardSetCredentialSubmitEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2545,7 +2868,7 @@ func (x *UIOnboardSetCredentialSubmitEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIOnboardSetCredentialSubmitEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardSetCredentialSubmitEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{17}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *UIOnboardSetCredentialSubmitEvent) GetUserName() string {
@@ -2569,7 +2892,7 @@ type UIOnboardRegisterChallengeSubmitEvent struct {
 
 func (x *UIOnboardRegisterChallengeSubmitEvent) Reset() {
 	*x = UIOnboardRegisterChallengeSubmitEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2581,7 +2904,7 @@ func (x *UIOnboardRegisterChallengeSubmitEvent) String() string {
 func (*UIOnboardRegisterChallengeSubmitEvent) ProtoMessage() {}
 
 func (x *UIOnboardRegisterChallengeSubmitEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2594,7 +2917,7 @@ func (x *UIOnboardRegisterChallengeSubmitEvent) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use UIOnboardRegisterChallengeSubmitEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardRegisterChallengeSubmitEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{18}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *UIOnboardRegisterChallengeSubmitEvent) GetUserName() string {
@@ -2630,7 +2953,7 @@ type UIOnboardQuestionnaireSubmitEvent struct {
 
 func (x *UIOnboardQuestionnaireSubmitEvent) Reset() {
 	*x = UIOnboardQuestionnaireSubmitEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2642,7 +2965,7 @@ func (x *UIOnboardQuestionnaireSubmitEvent) String() string {
 func (*UIOnboardQuestionnaireSubmitEvent) ProtoMessage() {}
 
 func (x *UIOnboardQuestionnaireSubmitEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2655,7 +2978,7 @@ func (x *UIOnboardQuestionnaireSubmitEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIOnboardQuestionnaireSubmitEvent.ProtoReflect.Descriptor instead.
 func (*UIOnboardQuestionnaireSubmitEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{19}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *UIOnboardQuestionnaireSubmitEvent) GetUserName() string {
@@ -2677,7 +3000,7 @@ type UIRecoveryCodesContinueClickEvent struct {
 
 func (x *UIRecoveryCodesContinueClickEvent) Reset() {
 	*x = UIRecoveryCodesContinueClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2689,7 +3012,7 @@ func (x *UIRecoveryCodesContinueClickEvent) String() string {
 func (*UIRecoveryCodesContinueClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesContinueClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2702,7 +3025,7 @@ func (x *UIRecoveryCodesContinueClickEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIRecoveryCodesContinueClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesContinueClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{20}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *UIRecoveryCodesContinueClickEvent) GetUserName() string {
@@ -2724,7 +3047,7 @@ type UIRecoveryCodesCopyClickEvent struct {
 
 func (x *UIRecoveryCodesCopyClickEvent) Reset() {
 	*x = UIRecoveryCodesCopyClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2736,7 +3059,7 @@ func (x *UIRecoveryCodesCopyClickEvent) String() string {
 func (*UIRecoveryCodesCopyClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesCopyClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2749,7 +3072,7 @@ func (x *UIRecoveryCodesCopyClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIRecoveryCodesCopyClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesCopyClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{21}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *UIRecoveryCodesCopyClickEvent) GetUserName() string {
@@ -2771,7 +3094,7 @@ type UIRecoveryCodesPrintClickEvent struct {
 
 func (x *UIRecoveryCodesPrintClickEvent) Reset() {
 	*x = UIRecoveryCodesPrintClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2783,7 +3106,7 @@ func (x *UIRecoveryCodesPrintClickEvent) String() string {
 func (*UIRecoveryCodesPrintClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesPrintClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2796,7 +3119,7 @@ func (x *UIRecoveryCodesPrintClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIRecoveryCodesPrintClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesPrintClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{22}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *UIRecoveryCodesPrintClickEvent) GetUserName() string {
@@ -2822,7 +3145,7 @@ type DiscoverMetadata struct {
 
 func (x *DiscoverMetadata) Reset() {
 	*x = DiscoverMetadata{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2834,7 +3157,7 @@ func (x *DiscoverMetadata) String() string {
 func (*DiscoverMetadata) ProtoMessage() {}
 
 func (x *DiscoverMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2847,7 +3170,7 @@ func (x *DiscoverMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverMetadata.ProtoReflect.Descriptor instead.
 func (*DiscoverMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *DiscoverMetadata) GetId() string {
@@ -2882,7 +3205,7 @@ type DiscoverResourceMetadata struct {
 
 func (x *DiscoverResourceMetadata) Reset() {
 	*x = DiscoverResourceMetadata{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2894,7 +3217,7 @@ func (x *DiscoverResourceMetadata) String() string {
 func (*DiscoverResourceMetadata) ProtoMessage() {}
 
 func (x *DiscoverResourceMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2907,7 +3230,7 @@ func (x *DiscoverResourceMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverResourceMetadata.ProtoReflect.Descriptor instead.
 func (*DiscoverResourceMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{24}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *DiscoverResourceMetadata) GetResource() DiscoverResource {
@@ -2932,7 +3255,7 @@ type DiscoverStepStatus struct {
 
 func (x *DiscoverStepStatus) Reset() {
 	*x = DiscoverStepStatus{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2944,7 +3267,7 @@ func (x *DiscoverStepStatus) String() string {
 func (*DiscoverStepStatus) ProtoMessage() {}
 
 func (x *DiscoverStepStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2957,7 +3280,7 @@ func (x *DiscoverStepStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverStepStatus.ProtoReflect.Descriptor instead.
 func (*DiscoverStepStatus) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{25}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *DiscoverStepStatus) GetStatus() DiscoverStatus {
@@ -2985,7 +3308,7 @@ type UIDiscoverStartedEvent struct {
 
 func (x *UIDiscoverStartedEvent) Reset() {
 	*x = UIDiscoverStartedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2997,7 +3320,7 @@ func (x *UIDiscoverStartedEvent) String() string {
 func (*UIDiscoverStartedEvent) ProtoMessage() {}
 
 func (x *UIDiscoverStartedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3010,7 +3333,7 @@ func (x *UIDiscoverStartedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverStartedEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverStartedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{26}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *UIDiscoverStartedEvent) GetMetadata() *DiscoverMetadata {
@@ -3040,7 +3363,7 @@ type UIDiscoverResourceSelectionEvent struct {
 
 func (x *UIDiscoverResourceSelectionEvent) Reset() {
 	*x = UIDiscoverResourceSelectionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3052,7 +3375,7 @@ func (x *UIDiscoverResourceSelectionEvent) String() string {
 func (*UIDiscoverResourceSelectionEvent) ProtoMessage() {}
 
 func (x *UIDiscoverResourceSelectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3065,7 +3388,7 @@ func (x *UIDiscoverResourceSelectionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverResourceSelectionEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverResourceSelectionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{27}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *UIDiscoverResourceSelectionEvent) GetMetadata() *DiscoverMetadata {
@@ -3103,7 +3426,7 @@ type UIDiscoverIntegrationAWSOIDCConnectEvent struct {
 
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) Reset() {
 	*x = UIDiscoverIntegrationAWSOIDCConnectEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3115,7 +3438,7 @@ func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) String() string {
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoMessage() {}
 
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3128,7 +3451,7 @@ func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoReflect() protoreflect.M
 
 // Deprecated: Use UIDiscoverIntegrationAWSOIDCConnectEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{28}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) GetMetadata() *DiscoverMetadata {
@@ -3166,7 +3489,7 @@ type UIDiscoverDatabaseRDSEnrollEvent struct {
 
 func (x *UIDiscoverDatabaseRDSEnrollEvent) Reset() {
 	*x = UIDiscoverDatabaseRDSEnrollEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3178,7 +3501,7 @@ func (x *UIDiscoverDatabaseRDSEnrollEvent) String() string {
 func (*UIDiscoverDatabaseRDSEnrollEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseRDSEnrollEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3191,7 +3514,7 @@ func (x *UIDiscoverDatabaseRDSEnrollEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDatabaseRDSEnrollEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseRDSEnrollEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{29}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *UIDiscoverDatabaseRDSEnrollEvent) GetMetadata() *DiscoverMetadata {
@@ -3235,7 +3558,7 @@ type UIDiscoverKubeEKSEnrollEvent struct {
 
 func (x *UIDiscoverKubeEKSEnrollEvent) Reset() {
 	*x = UIDiscoverKubeEKSEnrollEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3247,7 +3570,7 @@ func (x *UIDiscoverKubeEKSEnrollEvent) String() string {
 func (*UIDiscoverKubeEKSEnrollEvent) ProtoMessage() {}
 
 func (x *UIDiscoverKubeEKSEnrollEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3260,7 +3583,7 @@ func (x *UIDiscoverKubeEKSEnrollEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverKubeEKSEnrollEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverKubeEKSEnrollEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{30}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *UIDiscoverKubeEKSEnrollEvent) GetMetadata() *DiscoverMetadata {
@@ -3304,7 +3627,7 @@ type UIDiscoverDeployServiceEvent struct {
 
 func (x *UIDiscoverDeployServiceEvent) Reset() {
 	*x = UIDiscoverDeployServiceEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3316,7 +3639,7 @@ func (x *UIDiscoverDeployServiceEvent) String() string {
 func (*UIDiscoverDeployServiceEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDeployServiceEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3329,7 +3652,7 @@ func (x *UIDiscoverDeployServiceEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDeployServiceEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDeployServiceEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *UIDiscoverDeployServiceEvent) GetMetadata() *DiscoverMetadata {
@@ -3380,7 +3703,7 @@ type UIDiscoverCreateDiscoveryConfigEvent struct {
 
 func (x *UIDiscoverCreateDiscoveryConfigEvent) Reset() {
 	*x = UIDiscoverCreateDiscoveryConfigEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3392,7 +3715,7 @@ func (x *UIDiscoverCreateDiscoveryConfigEvent) String() string {
 func (*UIDiscoverCreateDiscoveryConfigEvent) ProtoMessage() {}
 
 func (x *UIDiscoverCreateDiscoveryConfigEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3405,7 +3728,7 @@ func (x *UIDiscoverCreateDiscoveryConfigEvent) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use UIDiscoverCreateDiscoveryConfigEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverCreateDiscoveryConfigEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *UIDiscoverCreateDiscoveryConfigEvent) GetMetadata() *DiscoverMetadata {
@@ -3448,7 +3771,7 @@ type UIDiscoverDatabaseRegisterEvent struct {
 
 func (x *UIDiscoverDatabaseRegisterEvent) Reset() {
 	*x = UIDiscoverDatabaseRegisterEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3460,7 +3783,7 @@ func (x *UIDiscoverDatabaseRegisterEvent) String() string {
 func (*UIDiscoverDatabaseRegisterEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseRegisterEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3473,7 +3796,7 @@ func (x *UIDiscoverDatabaseRegisterEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDatabaseRegisterEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseRegisterEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{33}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *UIDiscoverDatabaseRegisterEvent) GetMetadata() *DiscoverMetadata {
@@ -3509,7 +3832,7 @@ type UIDiscoverDatabaseConfigureMTLSEvent struct {
 
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) Reset() {
 	*x = UIDiscoverDatabaseConfigureMTLSEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3521,7 +3844,7 @@ func (x *UIDiscoverDatabaseConfigureMTLSEvent) String() string {
 func (*UIDiscoverDatabaseConfigureMTLSEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3534,7 +3857,7 @@ func (x *UIDiscoverDatabaseConfigureMTLSEvent) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use UIDiscoverDatabaseConfigureMTLSEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseConfigureMTLSEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{34}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) GetMetadata() *DiscoverMetadata {
@@ -3570,7 +3893,7 @@ type UIDiscoverDesktopActiveDirectoryToolsInstallEvent struct {
 
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) Reset() {
 	*x = UIDiscoverDesktopActiveDirectoryToolsInstallEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3582,7 +3905,7 @@ func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) String() string {
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3595,7 +3918,7 @@ func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoReflect() proto
 
 // Deprecated: Use UIDiscoverDesktopActiveDirectoryToolsInstallEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{35}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) GetMetadata() *DiscoverMetadata {
@@ -3631,7 +3954,7 @@ type UIDiscoverDesktopActiveDirectoryConfigureEvent struct {
 
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) Reset() {
 	*x = UIDiscoverDesktopActiveDirectoryConfigureEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3643,7 +3966,7 @@ func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) String() string {
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3656,7 +3979,7 @@ func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoReflect() protoref
 
 // Deprecated: Use UIDiscoverDesktopActiveDirectoryConfigureEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{36}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) GetMetadata() *DiscoverMetadata {
@@ -3694,7 +4017,7 @@ type UIDiscoverAutoDiscoveredResourcesEvent struct {
 
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) Reset() {
 	*x = UIDiscoverAutoDiscoveredResourcesEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3706,7 +4029,7 @@ func (x *UIDiscoverAutoDiscoveredResourcesEvent) String() string {
 func (*UIDiscoverAutoDiscoveredResourcesEvent) ProtoMessage() {}
 
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3719,7 +4042,7 @@ func (x *UIDiscoverAutoDiscoveredResourcesEvent) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use UIDiscoverAutoDiscoveredResourcesEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverAutoDiscoveredResourcesEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{37}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) GetMetadata() *DiscoverMetadata {
@@ -3762,7 +4085,7 @@ type UIDiscoverEC2InstanceSelectionEvent struct {
 
 func (x *UIDiscoverEC2InstanceSelectionEvent) Reset() {
 	*x = UIDiscoverEC2InstanceSelectionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3774,7 +4097,7 @@ func (x *UIDiscoverEC2InstanceSelectionEvent) String() string {
 func (*UIDiscoverEC2InstanceSelectionEvent) ProtoMessage() {}
 
 func (x *UIDiscoverEC2InstanceSelectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3787,7 +4110,7 @@ func (x *UIDiscoverEC2InstanceSelectionEvent) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use UIDiscoverEC2InstanceSelectionEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverEC2InstanceSelectionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{38}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *UIDiscoverEC2InstanceSelectionEvent) GetMetadata() *DiscoverMetadata {
@@ -3823,7 +4146,7 @@ type UIDiscoverDeployEICEEvent struct {
 
 func (x *UIDiscoverDeployEICEEvent) Reset() {
 	*x = UIDiscoverDeployEICEEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3835,7 +4158,7 @@ func (x *UIDiscoverDeployEICEEvent) String() string {
 func (*UIDiscoverDeployEICEEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDeployEICEEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3848,7 +4171,7 @@ func (x *UIDiscoverDeployEICEEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDeployEICEEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDeployEICEEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{39}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *UIDiscoverDeployEICEEvent) GetMetadata() *DiscoverMetadata {
@@ -3884,7 +4207,7 @@ type UIDiscoverCreateNodeEvent struct {
 
 func (x *UIDiscoverCreateNodeEvent) Reset() {
 	*x = UIDiscoverCreateNodeEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3896,7 +4219,7 @@ func (x *UIDiscoverCreateNodeEvent) String() string {
 func (*UIDiscoverCreateNodeEvent) ProtoMessage() {}
 
 func (x *UIDiscoverCreateNodeEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3909,7 +4232,7 @@ func (x *UIDiscoverCreateNodeEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverCreateNodeEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverCreateNodeEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{40}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *UIDiscoverCreateNodeEvent) GetMetadata() *DiscoverMetadata {
@@ -3945,7 +4268,7 @@ type UIDiscoverCreateAppServerEvent struct {
 
 func (x *UIDiscoverCreateAppServerEvent) Reset() {
 	*x = UIDiscoverCreateAppServerEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3957,7 +4280,7 @@ func (x *UIDiscoverCreateAppServerEvent) String() string {
 func (*UIDiscoverCreateAppServerEvent) ProtoMessage() {}
 
 func (x *UIDiscoverCreateAppServerEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3970,7 +4293,7 @@ func (x *UIDiscoverCreateAppServerEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverCreateAppServerEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverCreateAppServerEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{41}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *UIDiscoverCreateAppServerEvent) GetMetadata() *DiscoverMetadata {
@@ -4006,7 +4329,7 @@ type UIDiscoverDatabaseConfigureIAMPolicyEvent struct {
 
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) Reset() {
 	*x = UIDiscoverDatabaseConfigureIAMPolicyEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4018,7 +4341,7 @@ func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) String() string {
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4031,7 +4354,7 @@ func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoReflect() protoreflect.
 
 // Deprecated: Use UIDiscoverDatabaseConfigureIAMPolicyEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{42}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) GetMetadata() *DiscoverMetadata {
@@ -4067,7 +4390,7 @@ type UIDiscoverPrincipalsConfigureEvent struct {
 
 func (x *UIDiscoverPrincipalsConfigureEvent) Reset() {
 	*x = UIDiscoverPrincipalsConfigureEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4079,7 +4402,7 @@ func (x *UIDiscoverPrincipalsConfigureEvent) String() string {
 func (*UIDiscoverPrincipalsConfigureEvent) ProtoMessage() {}
 
 func (x *UIDiscoverPrincipalsConfigureEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4092,7 +4415,7 @@ func (x *UIDiscoverPrincipalsConfigureEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIDiscoverPrincipalsConfigureEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverPrincipalsConfigureEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{43}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *UIDiscoverPrincipalsConfigureEvent) GetMetadata() *DiscoverMetadata {
@@ -4129,7 +4452,7 @@ type UIDiscoverTestConnectionEvent struct {
 
 func (x *UIDiscoverTestConnectionEvent) Reset() {
 	*x = UIDiscoverTestConnectionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4141,7 +4464,7 @@ func (x *UIDiscoverTestConnectionEvent) String() string {
 func (*UIDiscoverTestConnectionEvent) ProtoMessage() {}
 
 func (x *UIDiscoverTestConnectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4154,7 +4477,7 @@ func (x *UIDiscoverTestConnectionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverTestConnectionEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverTestConnectionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{44}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *UIDiscoverTestConnectionEvent) GetMetadata() *DiscoverMetadata {
@@ -4190,7 +4513,7 @@ type UIDiscoverCompletedEvent struct {
 
 func (x *UIDiscoverCompletedEvent) Reset() {
 	*x = UIDiscoverCompletedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4202,7 +4525,7 @@ func (x *UIDiscoverCompletedEvent) String() string {
 func (*UIDiscoverCompletedEvent) ProtoMessage() {}
 
 func (x *UIDiscoverCompletedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4215,7 +4538,7 @@ func (x *UIDiscoverCompletedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverCompletedEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverCompletedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{45}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *UIDiscoverCompletedEvent) GetMetadata() *DiscoverMetadata {
@@ -4252,7 +4575,7 @@ type RoleCreateEvent struct {
 
 func (x *RoleCreateEvent) Reset() {
 	*x = RoleCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4264,7 +4587,7 @@ func (x *RoleCreateEvent) String() string {
 func (*RoleCreateEvent) ProtoMessage() {}
 
 func (x *RoleCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4277,7 +4600,7 @@ func (x *RoleCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoleCreateEvent.ProtoReflect.Descriptor instead.
 func (*RoleCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{46}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *RoleCreateEvent) GetUserName() string {
@@ -4317,7 +4640,7 @@ type BotCreateEvent struct {
 
 func (x *BotCreateEvent) Reset() {
 	*x = BotCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4329,7 +4652,7 @@ func (x *BotCreateEvent) String() string {
 func (*BotCreateEvent) ProtoMessage() {}
 
 func (x *BotCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4342,7 +4665,7 @@ func (x *BotCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BotCreateEvent.ProtoReflect.Descriptor instead.
 func (*BotCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{47}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *BotCreateEvent) GetUserName() string {
@@ -4408,7 +4731,7 @@ type BotJoinEvent struct {
 
 func (x *BotJoinEvent) Reset() {
 	*x = BotJoinEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4420,7 +4743,7 @@ func (x *BotJoinEvent) String() string {
 func (*BotJoinEvent) ProtoMessage() {}
 
 func (x *BotJoinEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4433,7 +4756,7 @@ func (x *BotJoinEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BotJoinEvent.ProtoReflect.Descriptor instead.
 func (*BotJoinEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{48}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *BotJoinEvent) GetBotName() string {
@@ -4482,7 +4805,7 @@ type UICreateNewRoleClickEvent struct {
 
 func (x *UICreateNewRoleClickEvent) Reset() {
 	*x = UICreateNewRoleClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4494,7 +4817,7 @@ func (x *UICreateNewRoleClickEvent) String() string {
 func (*UICreateNewRoleClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4507,7 +4830,7 @@ func (x *UICreateNewRoleClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{49}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *UICreateNewRoleClickEvent) GetUserName() string {
@@ -4543,7 +4866,7 @@ type UICreateNewRoleSaveClickEvent struct {
 
 func (x *UICreateNewRoleSaveClickEvent) Reset() {
 	*x = UICreateNewRoleSaveClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4555,7 +4878,7 @@ func (x *UICreateNewRoleSaveClickEvent) String() string {
 func (*UICreateNewRoleSaveClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleSaveClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4568,7 +4891,7 @@ func (x *UICreateNewRoleSaveClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleSaveClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleSaveClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{50}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *UICreateNewRoleSaveClickEvent) GetUserName() string {
@@ -4617,7 +4940,7 @@ type UICreateNewRoleCancelClickEvent struct {
 
 func (x *UICreateNewRoleCancelClickEvent) Reset() {
 	*x = UICreateNewRoleCancelClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4629,7 +4952,7 @@ func (x *UICreateNewRoleCancelClickEvent) String() string {
 func (*UICreateNewRoleCancelClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleCancelClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4642,7 +4965,7 @@ func (x *UICreateNewRoleCancelClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleCancelClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleCancelClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{51}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *UICreateNewRoleCancelClickEvent) GetUserName() string {
@@ -4663,7 +4986,7 @@ type UICreateNewRoleViewDocumentationClickEvent struct {
 
 func (x *UICreateNewRoleViewDocumentationClickEvent) Reset() {
 	*x = UICreateNewRoleViewDocumentationClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4675,7 +4998,7 @@ func (x *UICreateNewRoleViewDocumentationClickEvent) String() string {
 func (*UICreateNewRoleViewDocumentationClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleViewDocumentationClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4688,7 +5011,7 @@ func (x *UICreateNewRoleViewDocumentationClickEvent) ProtoReflect() protoreflect
 
 // Deprecated: Use UICreateNewRoleViewDocumentationClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleViewDocumentationClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{52}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *UICreateNewRoleViewDocumentationClickEvent) GetUserName() string {
@@ -4710,7 +5033,7 @@ type UICallToActionClickEvent struct {
 
 func (x *UICallToActionClickEvent) Reset() {
 	*x = UICallToActionClickEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4722,7 +5045,7 @@ func (x *UICallToActionClickEvent) String() string {
 func (*UICallToActionClickEvent) ProtoMessage() {}
 
 func (x *UICallToActionClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4735,7 +5058,7 @@ func (x *UICallToActionClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICallToActionClickEvent.ProtoReflect.Descriptor instead.
 func (*UICallToActionClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{53}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *UICallToActionClickEvent) GetUserName() string {
@@ -4770,7 +5093,7 @@ type KubeRequestEvent struct {
 
 func (x *KubeRequestEvent) Reset() {
 	*x = KubeRequestEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4782,7 +5105,7 @@ func (x *KubeRequestEvent) String() string {
 func (*KubeRequestEvent) ProtoMessage() {}
 
 func (x *KubeRequestEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4795,7 +5118,7 @@ func (x *KubeRequestEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KubeRequestEvent.ProtoReflect.Descriptor instead.
 func (*KubeRequestEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{54}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *KubeRequestEvent) GetUserName() string {
@@ -4831,7 +5154,7 @@ type SFTPEvent struct {
 
 func (x *SFTPEvent) Reset() {
 	*x = SFTPEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[55]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4843,7 +5166,7 @@ func (x *SFTPEvent) String() string {
 func (*SFTPEvent) ProtoMessage() {}
 
 func (x *SFTPEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[55]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4856,7 +5179,7 @@ func (x *SFTPEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SFTPEvent.ProtoReflect.Descriptor instead.
 func (*SFTPEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{55}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *SFTPEvent) GetUserName() string {
@@ -4902,7 +5225,7 @@ type AgentMetadataEvent struct {
 
 func (x *AgentMetadataEvent) Reset() {
 	*x = AgentMetadataEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[56]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4914,7 +5237,7 @@ func (x *AgentMetadataEvent) String() string {
 func (*AgentMetadataEvent) ProtoMessage() {}
 
 func (x *AgentMetadataEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[56]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4927,7 +5250,7 @@ func (x *AgentMetadataEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AgentMetadataEvent.ProtoReflect.Descriptor instead.
 func (*AgentMetadataEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{56}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *AgentMetadataEvent) GetVersion() string {
@@ -5035,7 +5358,7 @@ type AssistCompletionEvent struct {
 
 func (x *AssistCompletionEvent) Reset() {
 	*x = AssistCompletionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[57]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5047,7 +5370,7 @@ func (x *AssistCompletionEvent) String() string {
 func (*AssistCompletionEvent) ProtoMessage() {}
 
 func (x *AssistCompletionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[57]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5060,7 +5383,7 @@ func (x *AssistCompletionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistCompletionEvent.ProtoReflect.Descriptor instead.
 func (*AssistCompletionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{57}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *AssistCompletionEvent) GetUserName() string {
@@ -5120,7 +5443,7 @@ type AssistExecutionEvent struct {
 
 func (x *AssistExecutionEvent) Reset() {
 	*x = AssistExecutionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[58]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5132,7 +5455,7 @@ func (x *AssistExecutionEvent) String() string {
 func (*AssistExecutionEvent) ProtoMessage() {}
 
 func (x *AssistExecutionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[58]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5145,7 +5468,7 @@ func (x *AssistExecutionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistExecutionEvent.ProtoReflect.Descriptor instead.
 func (*AssistExecutionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{58}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *AssistExecutionEvent) GetUserName() string {
@@ -5205,7 +5528,7 @@ type AssistNewConversationEvent struct {
 
 func (x *AssistNewConversationEvent) Reset() {
 	*x = AssistNewConversationEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[59]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5217,7 +5540,7 @@ func (x *AssistNewConversationEvent) String() string {
 func (*AssistNewConversationEvent) ProtoMessage() {}
 
 func (x *AssistNewConversationEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[59]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5230,7 +5553,7 @@ func (x *AssistNewConversationEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistNewConversationEvent.ProtoReflect.Descriptor instead.
 func (*AssistNewConversationEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{59}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *AssistNewConversationEvent) GetUserName() string {
@@ -5267,7 +5590,7 @@ type AssistAccessRequestEvent struct {
 
 func (x *AssistAccessRequestEvent) Reset() {
 	*x = AssistAccessRequestEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[60]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5279,7 +5602,7 @@ func (x *AssistAccessRequestEvent) String() string {
 func (*AssistAccessRequestEvent) ProtoMessage() {}
 
 func (x *AssistAccessRequestEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[60]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5292,7 +5615,7 @@ func (x *AssistAccessRequestEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistAccessRequestEvent.ProtoReflect.Descriptor instead.
 func (*AssistAccessRequestEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{60}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *AssistAccessRequestEvent) GetUserName() string {
@@ -5350,7 +5673,7 @@ type AssistActionEvent struct {
 
 func (x *AssistActionEvent) Reset() {
 	*x = AssistActionEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[61]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5362,7 +5685,7 @@ func (x *AssistActionEvent) String() string {
 func (*AssistActionEvent) ProtoMessage() {}
 
 func (x *AssistActionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[61]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5375,7 +5698,7 @@ func (x *AssistActionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistActionEvent.ProtoReflect.Descriptor instead.
 func (*AssistActionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{61}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *AssistActionEvent) GetUserName() string {
@@ -5424,7 +5747,7 @@ type AccessListMetadata struct {
 
 func (x *AccessListMetadata) Reset() {
 	*x = AccessListMetadata{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[62]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5436,7 +5759,7 @@ func (x *AccessListMetadata) String() string {
 func (*AccessListMetadata) ProtoMessage() {}
 
 func (x *AccessListMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[62]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5449,7 +5772,7 @@ func (x *AccessListMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListMetadata.ProtoReflect.Descriptor instead.
 func (*AccessListMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{62}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *AccessListMetadata) GetId() string {
@@ -5471,7 +5794,7 @@ type AccessListCreateEvent struct {
 
 func (x *AccessListCreateEvent) Reset() {
 	*x = AccessListCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[63]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5483,7 +5806,7 @@ func (x *AccessListCreateEvent) String() string {
 func (*AccessListCreateEvent) ProtoMessage() {}
 
 func (x *AccessListCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[63]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5496,7 +5819,7 @@ func (x *AccessListCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListCreateEvent.ProtoReflect.Descriptor instead.
 func (*AccessListCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{63}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *AccessListCreateEvent) GetUserName() string {
@@ -5525,7 +5848,7 @@ type AccessListUpdateEvent struct {
 
 func (x *AccessListUpdateEvent) Reset() {
 	*x = AccessListUpdateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[64]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5537,7 +5860,7 @@ func (x *AccessListUpdateEvent) String() string {
 func (*AccessListUpdateEvent) ProtoMessage() {}
 
 func (x *AccessListUpdateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[64]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5550,7 +5873,7 @@ func (x *AccessListUpdateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListUpdateEvent.ProtoReflect.Descriptor instead.
 func (*AccessListUpdateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{64}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *AccessListUpdateEvent) GetUserName() string {
@@ -5579,7 +5902,7 @@ type AccessListDeleteEvent struct {
 
 func (x *AccessListDeleteEvent) Reset() {
 	*x = AccessListDeleteEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[65]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5591,7 +5914,7 @@ func (x *AccessListDeleteEvent) String() string {
 func (*AccessListDeleteEvent) ProtoMessage() {}
 
 func (x *AccessListDeleteEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[65]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5604,7 +5927,7 @@ func (x *AccessListDeleteEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListDeleteEvent.ProtoReflect.Descriptor instead.
 func (*AccessListDeleteEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{65}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *AccessListDeleteEvent) GetUserName() string {
@@ -5635,7 +5958,7 @@ type AccessListMemberCreateEvent struct {
 
 func (x *AccessListMemberCreateEvent) Reset() {
 	*x = AccessListMemberCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[66]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5647,7 +5970,7 @@ func (x *AccessListMemberCreateEvent) String() string {
 func (*AccessListMemberCreateEvent) ProtoMessage() {}
 
 func (x *AccessListMemberCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[66]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5660,7 +5983,7 @@ func (x *AccessListMemberCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListMemberCreateEvent.ProtoReflect.Descriptor instead.
 func (*AccessListMemberCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{66}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *AccessListMemberCreateEvent) GetUserName() string {
@@ -5698,7 +6021,7 @@ type AccessListMemberUpdateEvent struct {
 
 func (x *AccessListMemberUpdateEvent) Reset() {
 	*x = AccessListMemberUpdateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[67]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5710,7 +6033,7 @@ func (x *AccessListMemberUpdateEvent) String() string {
 func (*AccessListMemberUpdateEvent) ProtoMessage() {}
 
 func (x *AccessListMemberUpdateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[67]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5723,7 +6046,7 @@ func (x *AccessListMemberUpdateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListMemberUpdateEvent.ProtoReflect.Descriptor instead.
 func (*AccessListMemberUpdateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{67}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *AccessListMemberUpdateEvent) GetUserName() string {
@@ -5761,7 +6084,7 @@ type AccessListMemberDeleteEvent struct {
 
 func (x *AccessListMemberDeleteEvent) Reset() {
 	*x = AccessListMemberDeleteEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[68]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5773,7 +6096,7 @@ func (x *AccessListMemberDeleteEvent) String() string {
 func (*AccessListMemberDeleteEvent) ProtoMessage() {}
 
 func (x *AccessListMemberDeleteEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[68]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5786,7 +6109,7 @@ func (x *AccessListMemberDeleteEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListMemberDeleteEvent.ProtoReflect.Descriptor instead.
 func (*AccessListMemberDeleteEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{68}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *AccessListMemberDeleteEvent) GetUserName() string {
@@ -5830,7 +6153,7 @@ type AccessListGrantsToUserEvent struct {
 
 func (x *AccessListGrantsToUserEvent) Reset() {
 	*x = AccessListGrantsToUserEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[69]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5842,7 +6165,7 @@ func (x *AccessListGrantsToUserEvent) String() string {
 func (*AccessListGrantsToUserEvent) ProtoMessage() {}
 
 func (x *AccessListGrantsToUserEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[69]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5855,7 +6178,7 @@ func (x *AccessListGrantsToUserEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListGrantsToUserEvent.ProtoReflect.Descriptor instead.
 func (*AccessListGrantsToUserEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{69}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *AccessListGrantsToUserEvent) GetUserName() string {
@@ -5915,7 +6238,7 @@ type AccessListReviewCreateEvent struct {
 
 func (x *AccessListReviewCreateEvent) Reset() {
 	*x = AccessListReviewCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[70]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5927,7 +6250,7 @@ func (x *AccessListReviewCreateEvent) String() string {
 func (*AccessListReviewCreateEvent) ProtoMessage() {}
 
 func (x *AccessListReviewCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[70]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5940,7 +6263,7 @@ func (x *AccessListReviewCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListReviewCreateEvent.ProtoReflect.Descriptor instead.
 func (*AccessListReviewCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{70}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *AccessListReviewCreateEvent) GetUserName() string {
@@ -6006,7 +6329,7 @@ type AccessListReviewDeleteEvent struct {
 
 func (x *AccessListReviewDeleteEvent) Reset() {
 	*x = AccessListReviewDeleteEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[71]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6018,7 +6341,7 @@ func (x *AccessListReviewDeleteEvent) String() string {
 func (*AccessListReviewDeleteEvent) ProtoMessage() {}
 
 func (x *AccessListReviewDeleteEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[71]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6031,7 +6354,7 @@ func (x *AccessListReviewDeleteEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListReviewDeleteEvent.ProtoReflect.Descriptor instead.
 func (*AccessListReviewDeleteEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{71}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *AccessListReviewDeleteEvent) GetUserName() string {
@@ -6069,7 +6392,7 @@ type AccessListReviewComplianceEvent struct {
 
 func (x *AccessListReviewComplianceEvent) Reset() {
 	*x = AccessListReviewComplianceEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[72]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[73]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6081,7 +6404,7 @@ func (x *AccessListReviewComplianceEvent) String() string {
 func (*AccessListReviewComplianceEvent) ProtoMessage() {}
 
 func (x *AccessListReviewComplianceEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[72]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[73]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6094,7 +6417,7 @@ func (x *AccessListReviewComplianceEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessListReviewComplianceEvent.ProtoReflect.Descriptor instead.
 func (*AccessListReviewComplianceEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{72}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *AccessListReviewComplianceEvent) GetTotalAccessLists() int32 {
@@ -6128,7 +6451,7 @@ type IntegrationEnrollMetadata struct {
 
 func (x *IntegrationEnrollMetadata) Reset() {
 	*x = IntegrationEnrollMetadata{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[73]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6140,7 +6463,7 @@ func (x *IntegrationEnrollMetadata) String() string {
 func (*IntegrationEnrollMetadata) ProtoMessage() {}
 
 func (x *IntegrationEnrollMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[73]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6153,7 +6476,7 @@ func (x *IntegrationEnrollMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IntegrationEnrollMetadata.ProtoReflect.Descriptor instead.
 func (*IntegrationEnrollMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{73}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *IntegrationEnrollMetadata) GetId() string {
@@ -6188,7 +6511,7 @@ type UIIntegrationEnrollStartEvent struct {
 
 func (x *UIIntegrationEnrollStartEvent) Reset() {
 	*x = UIIntegrationEnrollStartEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[74]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6200,7 +6523,7 @@ func (x *UIIntegrationEnrollStartEvent) String() string {
 func (*UIIntegrationEnrollStartEvent) ProtoMessage() {}
 
 func (x *UIIntegrationEnrollStartEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[74]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6213,7 +6536,7 @@ func (x *UIIntegrationEnrollStartEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIIntegrationEnrollStartEvent.ProtoReflect.Descriptor instead.
 func (*UIIntegrationEnrollStartEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{74}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{75}
 }
 
 func (x *UIIntegrationEnrollStartEvent) GetMetadata() *IntegrationEnrollMetadata {
@@ -6234,7 +6557,7 @@ type UIIntegrationEnrollCompleteEvent struct {
 
 func (x *UIIntegrationEnrollCompleteEvent) Reset() {
 	*x = UIIntegrationEnrollCompleteEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[75]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6246,7 +6569,7 @@ func (x *UIIntegrationEnrollCompleteEvent) String() string {
 func (*UIIntegrationEnrollCompleteEvent) ProtoMessage() {}
 
 func (x *UIIntegrationEnrollCompleteEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[75]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6259,7 +6582,7 @@ func (x *UIIntegrationEnrollCompleteEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIIntegrationEnrollCompleteEvent.ProtoReflect.Descriptor instead.
 func (*UIIntegrationEnrollCompleteEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{75}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *UIIntegrationEnrollCompleteEvent) GetMetadata() *IntegrationEnrollMetadata {
@@ -6285,7 +6608,7 @@ type IntegrationEnrollStepStatus struct {
 
 func (x *IntegrationEnrollStepStatus) Reset() {
 	*x = IntegrationEnrollStepStatus{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[76]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6297,7 +6620,7 @@ func (x *IntegrationEnrollStepStatus) String() string {
 func (*IntegrationEnrollStepStatus) ProtoMessage() {}
 
 func (x *IntegrationEnrollStepStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[76]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6310,52 +6633,312 @@ func (x *IntegrationEnrollStepStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IntegrationEnrollStepStatus.ProtoReflect.Descriptor instead.
 func (*IntegrationEnrollStepStatus) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{76}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{77}
+}
+
+func (x *IntegrationEnrollStepStatus) GetCode() IntegrationEnrollStatusCode {
+	if x != nil {
+		return x.Code
+	}
+	return IntegrationEnrollStatusCode_INTEGRATION_ENROLL_STATUS_CODE_UNSPECIFIED
+}
+
+func (x *IntegrationEnrollStepStatus) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+// UIIntegrationEnrollStepEvent defines configuration step event
+// with a status for a specific integration enroll kind.
+type UIIntegrationEnrollStepEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata is the metadata of an event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step is the name of the step for a given integration kind.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=prehog.v1alpha.IntegrationEnrollStep" json:"step,omitempty"`
+	// Status is the status of the step outcome.
+	Status        *IntegrationEnrollStepStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UIIntegrationEnrollStepEvent) Reset() {
+	*x = UIIntegrationEnrollStepEvent{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[78]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UIIntegrationEnrollStepEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UIIntegrationEnrollStepEvent) ProtoMessage() {}
+
+func (x *UIIntegrationEnrollStepEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[78]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UIIntegrationEnrollStepEvent.ProtoReflect.Descriptor instead.
+func (*UIIntegrationEnrollStepEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{78}
+}
+
+func (x *UIIntegrationEnrollStepEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *UIIntegrationEnrollStepEvent) GetStep() IntegrationEnrollStep {
+	if x != nil {
+		return x.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (x *UIIntegrationEnrollStepEvent) GetStatus() *IntegrationEnrollStepStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+// a section (e.g. "Advanced Options") in an integration setup wizard.
+type UIIntegrationEnrollSectionOpenEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the section was opened.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=prehog.v1alpha.IntegrationEnrollStep" json:"step,omitempty"`
+	// Section that was opened.
+	Section       IntegrationEnrollSection `protobuf:"varint,3,opt,name=section,proto3,enum=prehog.v1alpha.IntegrationEnrollSection" json:"section,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) Reset() {
+	*x = UIIntegrationEnrollSectionOpenEvent{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[79]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UIIntegrationEnrollSectionOpenEvent) ProtoMessage() {}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[79]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UIIntegrationEnrollSectionOpenEvent.ProtoReflect.Descriptor instead.
+func (*UIIntegrationEnrollSectionOpenEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{79}
+}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) GetStep() IntegrationEnrollStep {
+	if x != nil {
+		return x.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (x *UIIntegrationEnrollSectionOpenEvent) GetSection() IntegrationEnrollSection {
+	if x != nil {
+		return x.Section
+	}
+	return IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_UNSPECIFIED
+}
+
+// UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+// field in an integration setup wizard.
+type UIIntegrationEnrollFieldCompleteEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the field was completed.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=prehog.v1alpha.IntegrationEnrollStep" json:"step,omitempty"`
+	// Field that was completed.
+	Field         IntegrationEnrollField `protobuf:"varint,3,opt,name=field,proto3,enum=prehog.v1alpha.IntegrationEnrollField" json:"field,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) Reset() {
+	*x = UIIntegrationEnrollFieldCompleteEvent{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[80]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UIIntegrationEnrollFieldCompleteEvent) ProtoMessage() {}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[80]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UIIntegrationEnrollFieldCompleteEvent.ProtoReflect.Descriptor instead.
+func (*UIIntegrationEnrollFieldCompleteEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{80}
+}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) GetStep() IntegrationEnrollStep {
+	if x != nil {
+		return x.Step
+	}
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
+}
+
+func (x *UIIntegrationEnrollFieldCompleteEvent) GetField() IntegrationEnrollField {
+	if x != nil {
+		return x.Field
+	}
+	return IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_UNSPECIFIED
+}
+
+// UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+// IaC (e.g. Terraform) code in an integration setup wizard.
+type UIIntegrationEnrollCodeCopyEvent struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata of the event.
+	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Step where the code was copied.
+	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=prehog.v1alpha.IntegrationEnrollStep" json:"step,omitempty"`
+	// Type of code that was copied.
+	Type          IntegrationEnrollCodeType `protobuf:"varint,3,opt,name=type,proto3,enum=prehog.v1alpha.IntegrationEnrollCodeType" json:"type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UIIntegrationEnrollCodeCopyEvent) Reset() {
+	*x = UIIntegrationEnrollCodeCopyEvent{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[81]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UIIntegrationEnrollCodeCopyEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UIIntegrationEnrollCodeCopyEvent) ProtoMessage() {}
+
+func (x *UIIntegrationEnrollCodeCopyEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[81]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UIIntegrationEnrollCodeCopyEvent.ProtoReflect.Descriptor instead.
+func (*UIIntegrationEnrollCodeCopyEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{81}
+}
+
+func (x *UIIntegrationEnrollCodeCopyEvent) GetMetadata() *IntegrationEnrollMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
 }
 
-func (x *IntegrationEnrollStepStatus) GetCode() IntegrationEnrollStatusCode {
+func (x *UIIntegrationEnrollCodeCopyEvent) GetStep() IntegrationEnrollStep {
 	if x != nil {
-		return x.Code
+		return x.Step
 	}
-	return IntegrationEnrollStatusCode_INTEGRATION_ENROLL_STATUS_CODE_UNSPECIFIED
+	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
 }
 
-func (x *IntegrationEnrollStepStatus) GetError() string {
+func (x *UIIntegrationEnrollCodeCopyEvent) GetType() IntegrationEnrollCodeType {
 	if x != nil {
-		return x.Error
+		return x.Type
 	}
-	return ""
+	return IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED
 }
 
-// UIIntegrationEnrollStepEvent defines configuration step event
-// with a status for a specific integration enroll kind.
-type UIIntegrationEnrollStepEvent struct {
+// UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+// documentation, etc. in an integration setup wizard.
+type UIIntegrationEnrollLinkClickEvent struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// Metadata is the metadata of an event.
+	// Metadata of the event.
 	Metadata *IntegrationEnrollMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	// Step is the name of the step for a given integration kind.
+	// Step where the link was clicked.
 	Step IntegrationEnrollStep `protobuf:"varint,2,opt,name=step,proto3,enum=prehog.v1alpha.IntegrationEnrollStep" json:"step,omitempty"`
-	// Status is the status of the step outcome.
-	Status        *IntegrationEnrollStepStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+	// Link that was clicked.
+	Link          string `protobuf:"bytes,3,opt,name=link,proto3" json:"link,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *UIIntegrationEnrollStepEvent) Reset() {
-	*x = UIIntegrationEnrollStepEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[77]
+func (x *UIIntegrationEnrollLinkClickEvent) Reset() {
+	*x = UIIntegrationEnrollLinkClickEvent{}
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *UIIntegrationEnrollStepEvent) String() string {
+func (x *UIIntegrationEnrollLinkClickEvent) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*UIIntegrationEnrollStepEvent) ProtoMessage() {}
+func (*UIIntegrationEnrollLinkClickEvent) ProtoMessage() {}
 
-func (x *UIIntegrationEnrollStepEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[77]
+func (x *UIIntegrationEnrollLinkClickEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6366,30 +6949,30 @@ func (x *UIIntegrationEnrollStepEvent) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use UIIntegrationEnrollStepEvent.ProtoReflect.Descriptor instead.
-func (*UIIntegrationEnrollStepEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{77}
+// Deprecated: Use UIIntegrationEnrollLinkClickEvent.ProtoReflect.Descriptor instead.
+func (*UIIntegrationEnrollLinkClickEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{82}
 }
 
-func (x *UIIntegrationEnrollStepEvent) GetMetadata() *IntegrationEnrollMetadata {
+func (x *UIIntegrationEnrollLinkClickEvent) GetMetadata() *IntegrationEnrollMetadata {
 	if x != nil {
 		return x.Metadata
 	}
 	return nil
 }
 
-func (x *UIIntegrationEnrollStepEvent) GetStep() IntegrationEnrollStep {
+func (x *UIIntegrationEnrollLinkClickEvent) GetStep() IntegrationEnrollStep {
 	if x != nil {
 		return x.Step
 	}
 	return IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_UNSPECIFIED
 }
 
-func (x *UIIntegrationEnrollStepEvent) GetStatus() *IntegrationEnrollStepStatus {
+func (x *UIIntegrationEnrollLinkClickEvent) GetLink() string {
 	if x != nil {
-		return x.Status
+		return x.Link
 	}
-	return nil
+	return ""
 }
 
 // EditorChangeEvent is an event that is emitted when a user role set changes resulting in
@@ -6405,7 +6988,7 @@ type EditorChangeEvent struct {
 
 func (x *EditorChangeEvent) Reset() {
 	*x = EditorChangeEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[78]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6417,7 +7000,7 @@ func (x *EditorChangeEvent) String() string {
 func (*EditorChangeEvent) ProtoMessage() {}
 
 func (x *EditorChangeEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[78]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6430,7 +7013,7 @@ func (x *EditorChangeEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EditorChangeEvent.ProtoReflect.Descriptor instead.
 func (*EditorChangeEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{78}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{83}
 }
 
 func (x *EditorChangeEvent) GetUserName() string {
@@ -6468,7 +7051,7 @@ type DeviceAuthenticateEvent struct {
 
 func (x *DeviceAuthenticateEvent) Reset() {
 	*x = DeviceAuthenticateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[79]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[84]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6480,7 +7063,7 @@ func (x *DeviceAuthenticateEvent) String() string {
 func (*DeviceAuthenticateEvent) ProtoMessage() {}
 
 func (x *DeviceAuthenticateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[79]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[84]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6493,7 +7076,7 @@ func (x *DeviceAuthenticateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeviceAuthenticateEvent.ProtoReflect.Descriptor instead.
 func (*DeviceAuthenticateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{79}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{84}
 }
 
 func (x *DeviceAuthenticateEvent) GetDeviceId() string {
@@ -6544,7 +7127,7 @@ type DeviceEnrollEvent struct {
 
 func (x *DeviceEnrollEvent) Reset() {
 	*x = DeviceEnrollEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[80]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[85]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6556,7 +7139,7 @@ func (x *DeviceEnrollEvent) String() string {
 func (*DeviceEnrollEvent) ProtoMessage() {}
 
 func (x *DeviceEnrollEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[80]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[85]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6569,7 +7152,7 @@ func (x *DeviceEnrollEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeviceEnrollEvent.ProtoReflect.Descriptor instead.
 func (*DeviceEnrollEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{80}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{85}
 }
 
 func (x *DeviceEnrollEvent) GetDeviceId() string {
@@ -6625,7 +7208,7 @@ type FeatureRecommendationEvent struct {
 
 func (x *FeatureRecommendationEvent) Reset() {
 	*x = FeatureRecommendationEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[81]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[86]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6637,7 +7220,7 @@ func (x *FeatureRecommendationEvent) String() string {
 func (*FeatureRecommendationEvent) ProtoMessage() {}
 
 func (x *FeatureRecommendationEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[81]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[86]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6650,7 +7233,7 @@ func (x *FeatureRecommendationEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FeatureRecommendationEvent.ProtoReflect.Descriptor instead.
 func (*FeatureRecommendationEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{81}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{86}
 }
 
 func (x *FeatureRecommendationEvent) GetUserName() string {
@@ -6688,7 +7271,7 @@ type LicenseLimitEvent struct {
 
 func (x *LicenseLimitEvent) Reset() {
 	*x = LicenseLimitEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[82]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[87]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6700,7 +7283,7 @@ func (x *LicenseLimitEvent) String() string {
 func (*LicenseLimitEvent) ProtoMessage() {}
 
 func (x *LicenseLimitEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[82]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[87]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6713,7 +7296,7 @@ func (x *LicenseLimitEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LicenseLimitEvent.ProtoReflect.Descriptor instead.
 func (*LicenseLimitEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{82}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{87}
 }
 
 func (x *LicenseLimitEvent) GetLicenseLimit() LicenseLimit {
@@ -6745,7 +7328,7 @@ type DesktopDirectoryShareEvent struct {
 
 func (x *DesktopDirectoryShareEvent) Reset() {
 	*x = DesktopDirectoryShareEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[83]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[88]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6757,7 +7340,7 @@ func (x *DesktopDirectoryShareEvent) String() string {
 func (*DesktopDirectoryShareEvent) ProtoMessage() {}
 
 func (x *DesktopDirectoryShareEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[83]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[88]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6770,7 +7353,7 @@ func (x *DesktopDirectoryShareEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DesktopDirectoryShareEvent.ProtoReflect.Descriptor instead.
 func (*DesktopDirectoryShareEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{83}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{88}
 }
 
 func (x *DesktopDirectoryShareEvent) GetDesktop() string {
@@ -6812,7 +7395,7 @@ type DesktopClipboardEvent struct {
 
 func (x *DesktopClipboardEvent) Reset() {
 	*x = DesktopClipboardEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[84]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[89]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6824,7 +7407,7 @@ func (x *DesktopClipboardEvent) String() string {
 func (*DesktopClipboardEvent) ProtoMessage() {}
 
 func (x *DesktopClipboardEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[84]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[89]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6837,7 +7420,7 @@ func (x *DesktopClipboardEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DesktopClipboardEvent.ProtoReflect.Descriptor instead.
 func (*DesktopClipboardEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{84}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{89}
 }
 
 func (x *DesktopClipboardEvent) GetDesktop() string {
@@ -6874,7 +7457,7 @@ type TAGExecuteQueryEvent struct {
 
 func (x *TAGExecuteQueryEvent) Reset() {
 	*x = TAGExecuteQueryEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[85]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[90]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6886,7 +7469,7 @@ func (x *TAGExecuteQueryEvent) String() string {
 func (*TAGExecuteQueryEvent) ProtoMessage() {}
 
 func (x *TAGExecuteQueryEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[85]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[90]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6899,7 +7482,7 @@ func (x *TAGExecuteQueryEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TAGExecuteQueryEvent.ProtoReflect.Descriptor instead.
 func (*TAGExecuteQueryEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{85}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{90}
 }
 
 func (x *TAGExecuteQueryEvent) GetUserName() string {
@@ -6944,7 +7527,7 @@ type AccessGraphSecretsScanAuthorizedKeysEvent struct {
 
 func (x *AccessGraphSecretsScanAuthorizedKeysEvent) Reset() {
 	*x = AccessGraphSecretsScanAuthorizedKeysEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[86]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[91]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6956,7 +7539,7 @@ func (x *AccessGraphSecretsScanAuthorizedKeysEvent) String() string {
 func (*AccessGraphSecretsScanAuthorizedKeysEvent) ProtoMessage() {}
 
 func (x *AccessGraphSecretsScanAuthorizedKeysEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[86]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[91]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6969,7 +7552,7 @@ func (x *AccessGraphSecretsScanAuthorizedKeysEvent) ProtoReflect() protoreflect.
 
 // Deprecated: Use AccessGraphSecretsScanAuthorizedKeysEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphSecretsScanAuthorizedKeysEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{86}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{91}
 }
 
 func (x *AccessGraphSecretsScanAuthorizedKeysEvent) GetHostId() string {
@@ -7002,7 +7585,7 @@ type AccessGraphSecretsScanSSHPrivateKeysEvent struct {
 
 func (x *AccessGraphSecretsScanSSHPrivateKeysEvent) Reset() {
 	*x = AccessGraphSecretsScanSSHPrivateKeysEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[87]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[92]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7014,7 +7597,7 @@ func (x *AccessGraphSecretsScanSSHPrivateKeysEvent) String() string {
 func (*AccessGraphSecretsScanSSHPrivateKeysEvent) ProtoMessage() {}
 
 func (x *AccessGraphSecretsScanSSHPrivateKeysEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[87]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[92]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7027,7 +7610,7 @@ func (x *AccessGraphSecretsScanSSHPrivateKeysEvent) ProtoReflect() protoreflect.
 
 // Deprecated: Use AccessGraphSecretsScanSSHPrivateKeysEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphSecretsScanSSHPrivateKeysEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{87}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{92}
 }
 
 func (x *AccessGraphSecretsScanSSHPrivateKeysEvent) GetDeviceId() string {
@@ -7067,7 +7650,7 @@ type AccessGraphGitlabScanEvent struct {
 
 func (x *AccessGraphGitlabScanEvent) Reset() {
 	*x = AccessGraphGitlabScanEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[88]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[93]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7079,7 +7662,7 @@ func (x *AccessGraphGitlabScanEvent) String() string {
 func (*AccessGraphGitlabScanEvent) ProtoMessage() {}
 
 func (x *AccessGraphGitlabScanEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[88]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[93]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7092,7 +7675,7 @@ func (x *AccessGraphGitlabScanEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessGraphGitlabScanEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphGitlabScanEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{88}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{93}
 }
 
 func (x *AccessGraphGitlabScanEvent) GetTotalProjects() uint64 {
@@ -7148,7 +7731,7 @@ type AccessGraphAWSScanEvent struct {
 
 func (x *AccessGraphAWSScanEvent) Reset() {
 	*x = AccessGraphAWSScanEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[89]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[94]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7160,7 +7743,7 @@ func (x *AccessGraphAWSScanEvent) String() string {
 func (*AccessGraphAWSScanEvent) ProtoMessage() {}
 
 func (x *AccessGraphAWSScanEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[89]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[94]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7173,7 +7756,7 @@ func (x *AccessGraphAWSScanEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessGraphAWSScanEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphAWSScanEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{89}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{94}
 }
 
 func (x *AccessGraphAWSScanEvent) GetTotalEc2Instances() uint64 {
@@ -7267,7 +7850,7 @@ type AccessGraphAccessPathChangedEvent struct {
 
 func (x *AccessGraphAccessPathChangedEvent) Reset() {
 	*x = AccessGraphAccessPathChangedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[90]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[95]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7279,7 +7862,7 @@ func (x *AccessGraphAccessPathChangedEvent) String() string {
 func (*AccessGraphAccessPathChangedEvent) ProtoMessage() {}
 
 func (x *AccessGraphAccessPathChangedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[90]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[95]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7292,7 +7875,7 @@ func (x *AccessGraphAccessPathChangedEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use AccessGraphAccessPathChangedEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphAccessPathChangedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{90}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{95}
 }
 
 func (x *AccessGraphAccessPathChangedEvent) GetAffectedResourceSource() string {
@@ -7322,7 +7905,7 @@ type UIAccessGraphCrownJewelDiffViewEvent struct {
 
 func (x *UIAccessGraphCrownJewelDiffViewEvent) Reset() {
 	*x = UIAccessGraphCrownJewelDiffViewEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[91]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[96]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7334,7 +7917,7 @@ func (x *UIAccessGraphCrownJewelDiffViewEvent) String() string {
 func (*UIAccessGraphCrownJewelDiffViewEvent) ProtoMessage() {}
 
 func (x *UIAccessGraphCrownJewelDiffViewEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[91]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[96]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7347,7 +7930,7 @@ func (x *UIAccessGraphCrownJewelDiffViewEvent) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use UIAccessGraphCrownJewelDiffViewEvent.ProtoReflect.Descriptor instead.
 func (*UIAccessGraphCrownJewelDiffViewEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{91}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{96}
 }
 
 func (x *UIAccessGraphCrownJewelDiffViewEvent) GetAffectedResourceSource() string {
@@ -7374,7 +7957,7 @@ type AccessGraphCrownJewelCreateEvent struct {
 
 func (x *AccessGraphCrownJewelCreateEvent) Reset() {
 	*x = AccessGraphCrownJewelCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[92]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[97]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7386,7 +7969,7 @@ func (x *AccessGraphCrownJewelCreateEvent) String() string {
 func (*AccessGraphCrownJewelCreateEvent) ProtoMessage() {}
 
 func (x *AccessGraphCrownJewelCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[92]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[97]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7399,7 +7982,7 @@ func (x *AccessGraphCrownJewelCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessGraphCrownJewelCreateEvent.ProtoReflect.Descriptor instead.
 func (*AccessGraphCrownJewelCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{92}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{97}
 }
 
 // ExternalAuditStorageAuthenticateEvent is emitted when the External Audit
@@ -7414,7 +7997,7 @@ type ExternalAuditStorageAuthenticateEvent struct {
 
 func (x *ExternalAuditStorageAuthenticateEvent) Reset() {
 	*x = ExternalAuditStorageAuthenticateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[93]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[98]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7426,7 +8009,7 @@ func (x *ExternalAuditStorageAuthenticateEvent) String() string {
 func (*ExternalAuditStorageAuthenticateEvent) ProtoMessage() {}
 
 func (x *ExternalAuditStorageAuthenticateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[93]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[98]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7439,7 +8022,7 @@ func (x *ExternalAuditStorageAuthenticateEvent) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use ExternalAuditStorageAuthenticateEvent.ProtoReflect.Descriptor instead.
 func (*ExternalAuditStorageAuthenticateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{93}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{98}
 }
 
 // SecurityReportGetResultEvent is emitted when the user requests a security report.
@@ -7457,7 +8040,7 @@ type SecurityReportGetResultEvent struct {
 
 func (x *SecurityReportGetResultEvent) Reset() {
 	*x = SecurityReportGetResultEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[94]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[99]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7469,7 +8052,7 @@ func (x *SecurityReportGetResultEvent) String() string {
 func (*SecurityReportGetResultEvent) ProtoMessage() {}
 
 func (x *SecurityReportGetResultEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[94]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[99]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7482,7 +8065,7 @@ func (x *SecurityReportGetResultEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecurityReportGetResultEvent.ProtoReflect.Descriptor instead.
 func (*SecurityReportGetResultEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{94}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{99}
 }
 
 func (x *SecurityReportGetResultEvent) GetUserName() string {
@@ -7521,7 +8104,7 @@ type AuditQueryRunEvent struct {
 
 func (x *AuditQueryRunEvent) Reset() {
 	*x = AuditQueryRunEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[95]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[100]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7533,7 +8116,7 @@ func (x *AuditQueryRunEvent) String() string {
 func (*AuditQueryRunEvent) ProtoMessage() {}
 
 func (x *AuditQueryRunEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[95]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[100]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7546,7 +8129,7 @@ func (x *AuditQueryRunEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuditQueryRunEvent.ProtoReflect.Descriptor instead.
 func (*AuditQueryRunEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{95}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{100}
 }
 
 func (x *AuditQueryRunEvent) GetUserName() string {
@@ -7590,7 +8173,7 @@ type DiscoveryFetchEvent struct {
 
 func (x *DiscoveryFetchEvent) Reset() {
 	*x = DiscoveryFetchEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[96]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[101]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7602,7 +8185,7 @@ func (x *DiscoveryFetchEvent) String() string {
 func (*DiscoveryFetchEvent) ProtoMessage() {}
 
 func (x *DiscoveryFetchEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[96]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[101]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7615,7 +8198,7 @@ func (x *DiscoveryFetchEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoveryFetchEvent.ProtoReflect.Descriptor instead.
 func (*DiscoveryFetchEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{96}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{101}
 }
 
 func (x *DiscoveryFetchEvent) GetCloudProvider() string {
@@ -7656,7 +8239,7 @@ type OktaAccessListSyncEvent struct {
 
 func (x *OktaAccessListSyncEvent) Reset() {
 	*x = OktaAccessListSyncEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[97]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[102]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7668,7 +8251,7 @@ func (x *OktaAccessListSyncEvent) String() string {
 func (*OktaAccessListSyncEvent) ProtoMessage() {}
 
 func (x *OktaAccessListSyncEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[97]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[102]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7681,7 +8264,7 @@ func (x *OktaAccessListSyncEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OktaAccessListSyncEvent.ProtoReflect.Descriptor instead.
 func (*OktaAccessListSyncEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{97}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{102}
 }
 
 func (x *OktaAccessListSyncEvent) GetNumAppFilters() int32 {
@@ -7748,7 +8331,7 @@ type DatabaseUserCreatedEvent struct {
 
 func (x *DatabaseUserCreatedEvent) Reset() {
 	*x = DatabaseUserCreatedEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[98]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[103]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7760,7 +8343,7 @@ func (x *DatabaseUserCreatedEvent) String() string {
 func (*DatabaseUserCreatedEvent) ProtoMessage() {}
 
 func (x *DatabaseUserCreatedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[98]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[103]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7773,7 +8356,7 @@ func (x *DatabaseUserCreatedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DatabaseUserCreatedEvent.ProtoReflect.Descriptor instead.
 func (*DatabaseUserCreatedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{98}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{103}
 }
 
 func (x *DatabaseUserCreatedEvent) GetDatabase() *SessionStartDatabaseMetadata {
@@ -7815,7 +8398,7 @@ type DatabaseUserPermissionsUpdateEvent struct {
 
 func (x *DatabaseUserPermissionsUpdateEvent) Reset() {
 	*x = DatabaseUserPermissionsUpdateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[99]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[104]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7827,7 +8410,7 @@ func (x *DatabaseUserPermissionsUpdateEvent) String() string {
 func (*DatabaseUserPermissionsUpdateEvent) ProtoMessage() {}
 
 func (x *DatabaseUserPermissionsUpdateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[99]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[104]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7840,7 +8423,7 @@ func (x *DatabaseUserPermissionsUpdateEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use DatabaseUserPermissionsUpdateEvent.ProtoReflect.Descriptor instead.
 func (*DatabaseUserPermissionsUpdateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{99}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{104}
 }
 
 func (x *DatabaseUserPermissionsUpdateEvent) GetDatabase() *SessionStartDatabaseMetadata {
@@ -7899,7 +8482,7 @@ type SessionRecordingAccessEvent struct {
 
 func (x *SessionRecordingAccessEvent) Reset() {
 	*x = SessionRecordingAccessEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[100]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[105]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7911,7 +8494,7 @@ func (x *SessionRecordingAccessEvent) String() string {
 func (*SessionRecordingAccessEvent) ProtoMessage() {}
 
 func (x *SessionRecordingAccessEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[100]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[105]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7924,7 +8507,7 @@ func (x *SessionRecordingAccessEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionRecordingAccessEvent.ProtoReflect.Descriptor instead.
 func (*SessionRecordingAccessEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{100}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{105}
 }
 
 func (x *SessionRecordingAccessEvent) GetSessionType() string {
@@ -7982,7 +8565,7 @@ type UserTaskStateEvent struct {
 
 func (x *UserTaskStateEvent) Reset() {
 	*x = UserTaskStateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[101]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[106]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7994,7 +8577,7 @@ func (x *UserTaskStateEvent) String() string {
 func (*UserTaskStateEvent) ProtoMessage() {}
 
 func (x *UserTaskStateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[101]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[106]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -8007,7 +8590,7 @@ func (x *UserTaskStateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UserTaskStateEvent.ProtoReflect.Descriptor instead.
 func (*UserTaskStateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{101}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{106}
 }
 
 func (x *UserTaskStateEvent) GetTaskType() string {
@@ -8055,7 +8638,7 @@ type AccessRequestCreateEvent struct {
 
 func (x *AccessRequestCreateEvent) Reset() {
 	*x = AccessRequestCreateEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[102]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[107]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -8067,7 +8650,7 @@ func (x *AccessRequestCreateEvent) String() string {
 func (*AccessRequestCreateEvent) ProtoMessage() {}
 
 func (x *AccessRequestCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[102]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[107]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -8080,7 +8663,7 @@ func (x *AccessRequestCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessRequestCreateEvent.ProtoReflect.Descriptor instead.
 func (*AccessRequestCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{102}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{107}
 }
 
 func (x *AccessRequestCreateEvent) GetUserName() string {
@@ -8123,7 +8706,7 @@ type AccessRequestReviewEvent struct {
 
 func (x *AccessRequestReviewEvent) Reset() {
 	*x = AccessRequestReviewEvent{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[103]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[108]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -8135,7 +8718,7 @@ func (x *AccessRequestReviewEvent) String() string {
 func (*AccessRequestReviewEvent) ProtoMessage() {}
 
 func (x *AccessRequestReviewEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[103]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[108]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -8148,7 +8731,7 @@ func (x *AccessRequestReviewEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessRequestReviewEvent.ProtoReflect.Descriptor instead.
 func (*AccessRequestReviewEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{103}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{108}
 }
 
 func (x *AccessRequestReviewEvent) GetUserName() string {
@@ -8293,6 +8876,10 @@ type SubmitEventRequest struct {
 	//	*SubmitEventRequest_UiIntegrationEnrollStepEvent
 	//	*SubmitEventRequest_AccessRequestCreate
 	//	*SubmitEventRequest_AccessRequestReview
+	//	*SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent
+	//	*SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent
+	//	*SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent
+	//	*SubmitEventRequest_UiIntegrationEnrollLinkClickEvent
 	Event         isSubmitEventRequest_Event `protobuf_oneof:"event"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -8300,7 +8887,7 @@ type SubmitEventRequest struct {
 
 func (x *SubmitEventRequest) Reset() {
 	*x = SubmitEventRequest{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[104]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[109]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -8312,7 +8899,7 @@ func (x *SubmitEventRequest) String() string {
 func (*SubmitEventRequest) ProtoMessage() {}
 
 func (x *SubmitEventRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[104]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[109]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -8325,7 +8912,7 @@ func (x *SubmitEventRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventRequest.ProtoReflect.Descriptor instead.
 func (*SubmitEventRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{104}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{109}
 }
 
 func (x *SubmitEventRequest) GetClusterName() string {
@@ -9202,6 +9789,42 @@ func (x *SubmitEventRequest) GetAccessRequestReview() *AccessRequestReviewEvent
 	return nil
 }
 
+func (x *SubmitEventRequest) GetUiIntegrationEnrollSectionOpenEvent() *UIIntegrationEnrollSectionOpenEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent); ok {
+			return x.UiIntegrationEnrollSectionOpenEvent
+		}
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetUiIntegrationEnrollFieldCompleteEvent() *UIIntegrationEnrollFieldCompleteEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent); ok {
+			return x.UiIntegrationEnrollFieldCompleteEvent
+		}
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetUiIntegrationEnrollCodeCopyEvent() *UIIntegrationEnrollCodeCopyEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent); ok {
+			return x.UiIntegrationEnrollCodeCopyEvent
+		}
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetUiIntegrationEnrollLinkClickEvent() *UIIntegrationEnrollLinkClickEvent {
+	if x != nil {
+		if x, ok := x.Event.(*SubmitEventRequest_UiIntegrationEnrollLinkClickEvent); ok {
+			return x.UiIntegrationEnrollLinkClickEvent
+		}
+	}
+	return nil
+}
+
 type isSubmitEventRequest_Event interface {
 	isSubmitEventRequest_Event()
 }
@@ -9587,6 +10210,22 @@ type SubmitEventRequest_AccessRequestReview struct {
 	AccessRequestReview *AccessRequestReviewEvent `protobuf:"bytes,100,opt,name=access_request_review,json=accessRequestReview,proto3,oneof"`
 }
 
+type SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent struct {
+	UiIntegrationEnrollSectionOpenEvent *UIIntegrationEnrollSectionOpenEvent `protobuf:"bytes,101,opt,name=ui_integration_enroll_section_open_event,json=uiIntegrationEnrollSectionOpenEvent,proto3,oneof"`
+}
+
+type SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent struct {
+	UiIntegrationEnrollFieldCompleteEvent *UIIntegrationEnrollFieldCompleteEvent `protobuf:"bytes,102,opt,name=ui_integration_enroll_field_complete_event,json=uiIntegrationEnrollFieldCompleteEvent,proto3,oneof"`
+}
+
+type SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent struct {
+	UiIntegrationEnrollCodeCopyEvent *UIIntegrationEnrollCodeCopyEvent `protobuf:"bytes,103,opt,name=ui_integration_enroll_code_copy_event,json=uiIntegrationEnrollCodeCopyEvent,proto3,oneof"`
+}
+
+type SubmitEventRequest_UiIntegrationEnrollLinkClickEvent struct {
+	UiIntegrationEnrollLinkClickEvent *UIIntegrationEnrollLinkClickEvent `protobuf:"bytes,104,opt,name=ui_integration_enroll_link_click_event,json=uiIntegrationEnrollLinkClickEvent,proto3,oneof"`
+}
+
 func (*SubmitEventRequest_UserLogin) isSubmitEventRequest_Event() {}
 
 func (*SubmitEventRequest_SsoCreate) isSubmitEventRequest_Event() {}
@@ -9777,6 +10416,14 @@ func (*SubmitEventRequest_AccessRequestCreate) isSubmitEventRequest_Event() {}
 
 func (*SubmitEventRequest_AccessRequestReview) isSubmitEventRequest_Event() {}
 
+func (*SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_UiIntegrationEnrollLinkClickEvent) isSubmitEventRequest_Event() {}
+
 type SubmitEventResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -9785,7 +10432,7 @@ type SubmitEventResponse struct {
 
 func (x *SubmitEventResponse) Reset() {
 	*x = SubmitEventResponse{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[105]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[110]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -9797,7 +10444,7 @@ func (x *SubmitEventResponse) String() string {
 func (*SubmitEventResponse) ProtoMessage() {}
 
 func (x *SubmitEventResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[105]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[110]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -9810,7 +10457,7 @@ func (x *SubmitEventResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventResponse.ProtoReflect.Descriptor instead.
 func (*SubmitEventResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{105}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{110}
 }
 
 type SubmitEventsRequest struct {
@@ -9823,7 +10470,7 @@ type SubmitEventsRequest struct {
 
 func (x *SubmitEventsRequest) Reset() {
 	*x = SubmitEventsRequest{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[106]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[111]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -9835,7 +10482,7 @@ func (x *SubmitEventsRequest) String() string {
 func (*SubmitEventsRequest) ProtoMessage() {}
 
 func (x *SubmitEventsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[106]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[111]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -9848,7 +10495,7 @@ func (x *SubmitEventsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventsRequest.ProtoReflect.Descriptor instead.
 func (*SubmitEventsRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{106}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{111}
 }
 
 func (x *SubmitEventsRequest) GetEvents() []*SubmitEventRequest {
@@ -9866,7 +10513,7 @@ type SubmitEventsResponse struct {
 
 func (x *SubmitEventsResponse) Reset() {
 	*x = SubmitEventsResponse{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[107]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[112]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -9878,7 +10525,7 @@ func (x *SubmitEventsResponse) String() string {
 func (*SubmitEventsResponse) ProtoMessage() {}
 
 func (x *SubmitEventsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[107]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[112]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -9891,7 +10538,7 @@ func (x *SubmitEventsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventsResponse.ProtoReflect.Descriptor instead.
 func (*SubmitEventsResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{107}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{112}
 }
 
 type HelloTeleportRequest struct {
@@ -9902,7 +10549,7 @@ type HelloTeleportRequest struct {
 
 func (x *HelloTeleportRequest) Reset() {
 	*x = HelloTeleportRequest{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[108]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[113]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -9914,7 +10561,7 @@ func (x *HelloTeleportRequest) String() string {
 func (*HelloTeleportRequest) ProtoMessage() {}
 
 func (x *HelloTeleportRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[108]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[113]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -9927,7 +10574,7 @@ func (x *HelloTeleportRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HelloTeleportRequest.ProtoReflect.Descriptor instead.
 func (*HelloTeleportRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{108}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{113}
 }
 
 type HelloTeleportResponse struct {
@@ -9938,7 +10585,7 @@ type HelloTeleportResponse struct {
 
 func (x *HelloTeleportResponse) Reset() {
 	*x = HelloTeleportResponse{}
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[109]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[114]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -9950,7 +10597,7 @@ func (x *HelloTeleportResponse) String() string {
 func (*HelloTeleportResponse) ProtoMessage() {}
 
 func (x *HelloTeleportResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[109]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[114]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -9963,7 +10610,7 @@ func (x *HelloTeleportResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HelloTeleportResponse.ProtoReflect.Descriptor instead.
 func (*HelloTeleportResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{109}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{114}
 }
 
 var File_prehog_v1alpha_teleport_proto protoreflect.FileDescriptor
@@ -9998,7 +10645,7 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x16ResourceHeartbeatEvent\x12#\n" +
 	"\rresource_name\x18\x01 \x01(\fR\fresourceName\x12A\n" +
 	"\rresource_kind\x18\x02 \x01(\x0e2\x1c.prehog.v1alpha.ResourceKindR\fresourceKind\x12\x16\n" +
-	"\x06static\x18\x03 \x01(\bR\x06static\"\x91\x03\n" +
+	"\x06static\x18\x03 \x01(\bR\x06static\"\xcc\x03\n" +
 	"\x11SessionStartEvent\x12\x1b\n" +
 	"\tuser_name\x18\x01 \x01(\tR\buserName\x12!\n" +
 	"\fsession_type\x18\x02 \x01(\tR\vsessionType\x12H\n" +
@@ -10006,7 +10653,8 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\adesktop\x18\x04 \x01(\v2+.prehog.v1alpha.SessionStartDesktopMetadataR\adesktop\x125\n" +
 	"\tuser_kind\x18\x05 \x01(\x0e2\x18.prehog.v1alpha.UserKindR\buserKind\x129\n" +
 	"\x03app\x18\x06 \x01(\v2'.prehog.v1alpha.SessionStartAppMetadataR\x03app\x129\n" +
-	"\x03git\x18\a \x01(\v2'.prehog.v1alpha.SessionStartGitMetadataR\x03git\"\x94\x01\n" +
+	"\x03git\x18\a \x01(\v2'.prehog.v1alpha.SessionStartGitMetadataR\x03git\x129\n" +
+	"\x03mcp\x18\b \x01(\v2'.prehog.v1alpha.SessionStartMCPMetadataR\x03mcp\"\x94\x01\n" +
 	"\x1cSessionStartDatabaseMetadata\x12\x17\n" +
 	"\adb_type\x18\x01 \x01(\tR\x06dbType\x12\x1f\n" +
 	"\vdb_protocol\x18\x02 \x01(\tR\n" +
@@ -10025,7 +10673,16 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x17SessionStartGitMetadata\x12\x19\n" +
 	"\bgit_type\x18\x01 \x01(\tR\agitType\x12\x1f\n" +
 	"\vgit_service\x18\x02 \x01(\tR\n" +
-	"gitService\"\xe7\x02\n" +
+	"gitService\"\xfa\x01\n" +
+	"\x17SessionStartMCPMetadata\x12\x1c\n" +
+	"\ttransport\x18\x01 \x01(\tR\ttransport\x12)\n" +
+	"\x10protocol_version\x18\x02 \x01(\tR\x0fprotocolVersion\x12\x1f\n" +
+	"\vclient_name\x18\x03 \x01(\tR\n" +
+	"clientName\x12\x1f\n" +
+	"\vserver_name\x18\x04 \x01(\tR\n" +
+	"serverName\x12*\n" +
+	"\x11ingress_auth_type\x18\x05 \x01(\tR\x0fingressAuthType\x12(\n" +
+	"\x10egress_auth_type\x18\x06 \x01(\tR\x0eegressAuthType\"\xe7\x02\n" +
 	"\x1aUserCertificateIssuedEvent\x12\x1b\n" +
 	"\tuser_name\x18\x01 \x01(\tR\buserName\x12+\n" +
 	"\x03ttl\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\x03ttl\x12\x15\n" +
@@ -10323,7 +10980,23 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x1cUIIntegrationEnrollStepEvent\x12E\n" +
 	"\bmetadata\x18\x01 \x01(\v2).prehog.v1alpha.IntegrationEnrollMetadataR\bmetadata\x129\n" +
 	"\x04step\x18\x02 \x01(\x0e2%.prehog.v1alpha.IntegrationEnrollStepR\x04step\x12C\n" +
-	"\x06status\x18\x03 \x01(\v2+.prehog.v1alpha.IntegrationEnrollStepStatusR\x06status\"l\n" +
+	"\x06status\x18\x03 \x01(\v2+.prehog.v1alpha.IntegrationEnrollStepStatusR\x06status\"\xeb\x01\n" +
+	"#UIIntegrationEnrollSectionOpenEvent\x12E\n" +
+	"\bmetadata\x18\x01 \x01(\v2).prehog.v1alpha.IntegrationEnrollMetadataR\bmetadata\x129\n" +
+	"\x04step\x18\x02 \x01(\x0e2%.prehog.v1alpha.IntegrationEnrollStepR\x04step\x12B\n" +
+	"\asection\x18\x03 \x01(\x0e2(.prehog.v1alpha.IntegrationEnrollSectionR\asection\"\xe7\x01\n" +
+	"%UIIntegrationEnrollFieldCompleteEvent\x12E\n" +
+	"\bmetadata\x18\x01 \x01(\v2).prehog.v1alpha.IntegrationEnrollMetadataR\bmetadata\x129\n" +
+	"\x04step\x18\x02 \x01(\x0e2%.prehog.v1alpha.IntegrationEnrollStepR\x04step\x12<\n" +
+	"\x05field\x18\x03 \x01(\x0e2&.prehog.v1alpha.IntegrationEnrollFieldR\x05field\"\xe3\x01\n" +
+	" UIIntegrationEnrollCodeCopyEvent\x12E\n" +
+	"\bmetadata\x18\x01 \x01(\v2).prehog.v1alpha.IntegrationEnrollMetadataR\bmetadata\x129\n" +
+	"\x04step\x18\x02 \x01(\x0e2%.prehog.v1alpha.IntegrationEnrollStepR\x04step\x12=\n" +
+	"\x04type\x18\x03 \x01(\x0e2).prehog.v1alpha.IntegrationEnrollCodeTypeR\x04type\"\xb9\x01\n" +
+	"!UIIntegrationEnrollLinkClickEvent\x12E\n" +
+	"\bmetadata\x18\x01 \x01(\v2).prehog.v1alpha.IntegrationEnrollMetadataR\bmetadata\x129\n" +
+	"\x04step\x18\x02 \x01(\x0e2%.prehog.v1alpha.IntegrationEnrollStepR\x04step\x12\x12\n" +
+	"\x04link\x18\x03 \x01(\tR\x04link\"l\n" +
 	"\x11EditorChangeEvent\x12\x1b\n" +
 	"\tuser_name\x18\x01 \x01(\tR\buserName\x12:\n" +
 	"\x06status\x18\x02 \x01(\x0e2\".prehog.v1alpha.EditorChangeStatusR\x06status\"y\n" +
@@ -10446,7 +11119,7 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\rProposedState\x12\x1e\n" +
 	"\x1aPROPOSED_STATE_UNSPECIFIED\x10\x00\x12\x1b\n" +
 	"\x17PROPOSED_STATE_APPROVED\x10\x01\x12\x19\n" +
-	"\x15PROPOSED_STATE_DENIED\x10\x02\"\xadR\n" +
+	"\x15PROPOSED_STATE_DENIED\x10\x02\"\xe0V\n" +
 	"\x12SubmitEventRequest\x12!\n" +
 	"\fcluster_name\x18\x01 \x01(\tR\vclusterName\x128\n" +
 	"\ttimestamp\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12)\n" +
@@ -10549,7 +11222,11 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x0fuser_task_state\x18^ \x01(\v2\".prehog.v1alpha.UserTaskStateEventH\x00R\ruserTaskState\x12v\n" +
 	" ui_integration_enroll_step_event\x18` \x01(\v2,.prehog.v1alpha.UIIntegrationEnrollStepEventH\x00R\x1cuiIntegrationEnrollStepEvent\x12^\n" +
 	"\x15access_request_create\x18c \x01(\v2(.prehog.v1alpha.AccessRequestCreateEventH\x00R\x13accessRequestCreate\x12^\n" +
-	"\x15access_request_review\x18d \x01(\v2(.prehog.v1alpha.AccessRequestReviewEventH\x00R\x13accessRequestReviewB\a\n" +
+	"\x15access_request_review\x18d \x01(\v2(.prehog.v1alpha.AccessRequestReviewEventH\x00R\x13accessRequestReview\x12\x8c\x01\n" +
+	"(ui_integration_enroll_section_open_event\x18e \x01(\v23.prehog.v1alpha.UIIntegrationEnrollSectionOpenEventH\x00R#uiIntegrationEnrollSectionOpenEvent\x12\x92\x01\n" +
+	"*ui_integration_enroll_field_complete_event\x18f \x01(\v25.prehog.v1alpha.UIIntegrationEnrollFieldCompleteEventH\x00R%uiIntegrationEnrollFieldCompleteEvent\x12\x83\x01\n" +
+	"%ui_integration_enroll_code_copy_event\x18g \x01(\v20.prehog.v1alpha.UIIntegrationEnrollCodeCopyEventH\x00R uiIntegrationEnrollCodeCopyEvent\x12\x86\x01\n" +
+	"&ui_integration_enroll_link_click_event\x18h \x01(\v21.prehog.v1alpha.UIIntegrationEnrollLinkClickEventH\x00R!uiIntegrationEnrollLinkClickEventB\a\n" +
 	"\x05eventJ\x04\b\b\x10\tJ\x04\ba\x10bJ\x04\bb\x10cR\x1cui_onboard_get_started_clickR\x1baccess_request_create_eventR\x1baccess_request_review_event\"\x15\n" +
 	"\x13SubmitEventResponse\"Q\n" +
 	"\x13SubmitEventsRequest\x12:\n" +
@@ -10573,11 +11250,12 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x17RESOURCE_KIND_DB_SERVER\x10\x04\x12!\n" +
 	"\x1dRESOURCE_KIND_WINDOWS_DESKTOP\x10\x05\x12\x1e\n" +
 	"\x1aRESOURCE_KIND_NODE_OPENSSH\x10\x06\x12#\n" +
-	"\x1fRESOURCE_KIND_NODE_OPENSSH_EICE\x10\a*M\n" +
+	"\x1fRESOURCE_KIND_NODE_OPENSSH_EICE\x10\a*c\n" +
 	"\bUserKind\x12\x19\n" +
 	"\x15USER_KIND_UNSPECIFIED\x10\x00\x12\x13\n" +
 	"\x0fUSER_KIND_HUMAN\x10\x01\x12\x11\n" +
-	"\rUSER_KIND_BOT\x10\x02*\xc0\x0f\n" +
+	"\rUSER_KIND_BOT\x10\x02\x12\x14\n" +
+	"\x10USER_KIND_SYSTEM\x10\x03*\xab\x10\n" +
 	"\x10DiscoverResource\x12!\n" +
 	"\x1dDISCOVER_RESOURCE_UNSPECIFIED\x10\x00\x12\x1c\n" +
 	"\x18DISCOVER_RESOURCE_SERVER\x10\x01\x12 \n" +
@@ -10621,7 +11299,10 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x1eDISCOVER_RESOURCE_EC2_INSTANCE\x10&\x120\n" +
 	",DISCOVER_RESOURCE_DOC_WINDOWS_DESKTOP_NON_AD\x10'\x12$\n" +
 	" DISCOVER_RESOURCE_KUBERNETES_EKS\x10(\x12-\n" +
-	")DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE\x10)*\xa3\x01\n" +
+	")DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE\x10)\x12\x1f\n" +
+	"\x1bDISCOVER_RESOURCE_MCP_STDIO\x10*\x12\x1d\n" +
+	"\x19DISCOVER_RESOURCE_MCP_SSE\x10+\x12)\n" +
+	"%DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP\x10,*\xa3\x01\n" +
 	"\x0eDiscoverStatus\x12\x1f\n" +
 	"\x1bDISCOVER_STATUS_UNSPECIFIED\x10\x00\x12\x1b\n" +
 	"\x17DISCOVER_STATUS_SUCCESS\x10\x01\x12\x1b\n" +
@@ -10643,7 +11324,8 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"\x12\x16\n" +
 	"\x12CTA_OKTA_USER_SYNC\x10\v\x12\x10\n" +
 	"\fCTA_ENTRA_ID\x10\f\x12\x11\n" +
-	"\rCTA_OKTA_SCIM\x10\r*\xc4\t\n" +
+	"\rCTA_OKTA_SCIM\x10\r*\xb5\n" +
+	"\n" +
 	"\x15IntegrationEnrollKind\x12'\n" +
 	"#INTEGRATION_ENROLL_KIND_UNSPECIFIED\x10\x00\x12!\n" +
 	"\x1dINTEGRATION_ENROLL_KIND_SLACK\x10\x01\x12$\n" +
@@ -10673,7 +11355,9 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"3INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT\x10\x18\x12&\n" +
 	"\"INTEGRATION_ENROLL_KIND_SERVICENOW\x10\x19\x12/\n" +
 	"+INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER\x10\x1a\x12.\n" +
-	"*INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS\x10\x1b*\x83\x04\n" +
+	"*INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS\x10\x1b\x12-\n" +
+	")INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD\x10\x1c\x12@\n" +
+	"<INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES\x10\x1d*\xd6\x05\n" +
 	"\x15IntegrationEnrollStep\x12'\n" +
 	"#INTEGRATION_ENROLL_STEP_UNSPECIFIED\x10\x00\x12.\n" +
 	"*INTEGRATION_ENROLL_STEP_AWSIC_CONNECT_OIDC\x10\x01\x12>\n" +
@@ -10683,13 +11367,42 @@ const file_prehog_v1alpha_teleport_proto_rawDesc = "" +
 	"3INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_INTEGRATION\x10\x05\x126\n" +
 	"2INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER\x10\x06\x127\n" +
 	"3INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT\x10\a\x120\n" +
-	",INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE\x10\b*\xfb\x01\n" +
+	",INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE\x10\b\x124\n" +
+	"0INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB\x10\t\x126\n" +
+	"2INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS\x10\n" +
+	"\x124\n" +
+	"0INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW\x10\v\x12-\n" +
+	")INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME\x10\f*\xfb\x01\n" +
 	"\x1bIntegrationEnrollStatusCode\x12.\n" +
 	"*INTEGRATION_ENROLL_STATUS_CODE_UNSPECIFIED\x10\x00\x12*\n" +
 	"&INTEGRATION_ENROLL_STATUS_CODE_SUCCESS\x10\x01\x12*\n" +
 	"&INTEGRATION_ENROLL_STATUS_CODE_SKIPPED\x10\x02\x12(\n" +
 	"$INTEGRATION_ENROLL_STATUS_CODE_ERROR\x10\x03\x12*\n" +
-	"&INTEGRATION_ENROLL_STATUS_CODE_ABORTED\x10\x04*\x88\x01\n" +
+	"&INTEGRATION_ENROLL_STATUS_CODE_ABORTED\x10\x04*\xda\x02\n" +
+	"\x18IntegrationEnrollSection\x12*\n" +
+	"&INTEGRATION_ENROLL_SECTION_UNSPECIFIED\x10\x00\x12@\n" +
+	"<INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS\x10\x01\x12@\n" +
+	"<INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER\x10\x02\x12D\n" +
+	"@INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS\x10\x03\x12H\n" +
+	"DINTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER\x10\x04*\xd0\x05\n" +
+	"\x16IntegrationEnrollField\x12(\n" +
+	"$INTEGRATION_ENROLL_FIELD_UNSPECIFIED\x10\x00\x12<\n" +
+	"8INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL\x10\x01\x124\n" +
+	"0INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH\x10\x02\x126\n" +
+	"2INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW\x10\x03\x129\n" +
+	"5INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT\x10\x04\x121\n" +
+	"-INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF\x10\x05\x12=\n" +
+	"9INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG\x10\x06\x12D\n" +
+	"@INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS\x10\a\x128\n" +
+	"4INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS\x10\b\x128\n" +
+	"4INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS\x10\t\x127\n" +
+	"3INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS\x10\n" +
+	"\x12@\n" +
+	"<INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES\x10\v*\xab\x01\n" +
+	"\x19IntegrationEnrollCodeType\x12,\n" +
+	"(INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED\x10\x00\x12*\n" +
+	"&INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM\x10\x01\x124\n" +
+	"0INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML\x10\x02*\x88\x01\n" +
 	"\x12EditorChangeStatus\x12$\n" +
 	" EDITOR_CHANGE_STATUS_UNSPECIFIED\x10\x00\x12%\n" +
 	"!EDITOR_CHANGE_STATUS_ROLE_GRANTED\x10\x01\x12%\n" +
@@ -10723,346 +11436,370 @@ func file_prehog_v1alpha_teleport_proto_rawDescGZIP() []byte {
 	return file_prehog_v1alpha_teleport_proto_rawDescData
 }
 
-var file_prehog_v1alpha_teleport_proto_enumTypes = make([]protoimpl.EnumInfo, 17)
-var file_prehog_v1alpha_teleport_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
+var file_prehog_v1alpha_teleport_proto_enumTypes = make([]protoimpl.EnumInfo, 20)
+var file_prehog_v1alpha_teleport_proto_msgTypes = make([]protoimpl.MessageInfo, 115)
 var file_prehog_v1alpha_teleport_proto_goTypes = []any{
-	(UserOrigin)(0),                                // 0: prehog.v1alpha.UserOrigin
-	(ResourceKind)(0),                              // 1: prehog.v1alpha.ResourceKind
-	(UserKind)(0),                                  // 2: prehog.v1alpha.UserKind
-	(DiscoverResource)(0),                          // 3: prehog.v1alpha.DiscoverResource
-	(DiscoverStatus)(0),                            // 4: prehog.v1alpha.DiscoverStatus
-	(CTA)(0),                                       // 5: prehog.v1alpha.CTA
-	(IntegrationEnrollKind)(0),                     // 6: prehog.v1alpha.IntegrationEnrollKind
-	(IntegrationEnrollStep)(0),                     // 7: prehog.v1alpha.IntegrationEnrollStep
-	(IntegrationEnrollStatusCode)(0),               // 8: prehog.v1alpha.IntegrationEnrollStatusCode
-	(EditorChangeStatus)(0),                        // 9: prehog.v1alpha.EditorChangeStatus
-	(Feature)(0),                                   // 10: prehog.v1alpha.Feature
-	(FeatureRecommendationStatus)(0),               // 11: prehog.v1alpha.FeatureRecommendationStatus
-	(LicenseLimit)(0),                              // 12: prehog.v1alpha.LicenseLimit
-	(UIDiscoverDeployServiceEvent_DeployMethod)(0), // 13: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
-	(UIDiscoverDeployServiceEvent_DeployType)(0),   // 14: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
-	(UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod)(0),    // 15: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.ConfigMethod
-	(AccessRequestReviewEvent_ProposedState)(0),               // 16: prehog.v1alpha.AccessRequestReviewEvent.ProposedState
-	(*UserLoginEvent)(nil),                                    // 17: prehog.v1alpha.UserLoginEvent
-	(*MFAAuthenticationEvent)(nil),                            // 18: prehog.v1alpha.MFAAuthenticationEvent
-	(*SSOCreateEvent)(nil),                                    // 19: prehog.v1alpha.SSOCreateEvent
-	(*ResourceCreateEvent)(nil),                               // 20: prehog.v1alpha.ResourceCreateEvent
-	(*DiscoveredDatabaseMetadata)(nil),                        // 21: prehog.v1alpha.DiscoveredDatabaseMetadata
-	(*ResourceHeartbeatEvent)(nil),                            // 22: prehog.v1alpha.ResourceHeartbeatEvent
-	(*SessionStartEvent)(nil),                                 // 23: prehog.v1alpha.SessionStartEvent
-	(*SessionStartDatabaseMetadata)(nil),                      // 24: prehog.v1alpha.SessionStartDatabaseMetadata
-	(*SessionStartDesktopMetadata)(nil),                       // 25: prehog.v1alpha.SessionStartDesktopMetadata
-	(*SessionStartAppMetadata)(nil),                           // 26: prehog.v1alpha.SessionStartAppMetadata
-	(*SessionStartGitMetadata)(nil),                           // 27: prehog.v1alpha.SessionStartGitMetadata
-	(*UserCertificateIssuedEvent)(nil),                        // 28: prehog.v1alpha.UserCertificateIssuedEvent
-	(*SPIFFESVIDIssuedEvent)(nil),                             // 29: prehog.v1alpha.SPIFFESVIDIssuedEvent
-	(*UIBannerClickEvent)(nil),                                // 30: prehog.v1alpha.UIBannerClickEvent
-	(*UIOnboardCompleteGoToDashboardClickEvent)(nil),          // 31: prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
-	(*UIOnboardAddFirstResourceClickEvent)(nil),               // 32: prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
-	(*UIOnboardAddFirstResourceLaterClickEvent)(nil),          // 33: prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
-	(*UIOnboardSetCredentialSubmitEvent)(nil),                 // 34: prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
-	(*UIOnboardRegisterChallengeSubmitEvent)(nil),             // 35: prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
-	(*UIOnboardQuestionnaireSubmitEvent)(nil),                 // 36: prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
-	(*UIRecoveryCodesContinueClickEvent)(nil),                 // 37: prehog.v1alpha.UIRecoveryCodesContinueClickEvent
-	(*UIRecoveryCodesCopyClickEvent)(nil),                     // 38: prehog.v1alpha.UIRecoveryCodesCopyClickEvent
-	(*UIRecoveryCodesPrintClickEvent)(nil),                    // 39: prehog.v1alpha.UIRecoveryCodesPrintClickEvent
-	(*DiscoverMetadata)(nil),                                  // 40: prehog.v1alpha.DiscoverMetadata
-	(*DiscoverResourceMetadata)(nil),                          // 41: prehog.v1alpha.DiscoverResourceMetadata
-	(*DiscoverStepStatus)(nil),                                // 42: prehog.v1alpha.DiscoverStepStatus
-	(*UIDiscoverStartedEvent)(nil),                            // 43: prehog.v1alpha.UIDiscoverStartedEvent
-	(*UIDiscoverResourceSelectionEvent)(nil),                  // 44: prehog.v1alpha.UIDiscoverResourceSelectionEvent
-	(*UIDiscoverIntegrationAWSOIDCConnectEvent)(nil),          // 45: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
-	(*UIDiscoverDatabaseRDSEnrollEvent)(nil),                  // 46: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
-	(*UIDiscoverKubeEKSEnrollEvent)(nil),                      // 47: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent
-	(*UIDiscoverDeployServiceEvent)(nil),                      // 48: prehog.v1alpha.UIDiscoverDeployServiceEvent
-	(*UIDiscoverCreateDiscoveryConfigEvent)(nil),              // 49: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent
-	(*UIDiscoverDatabaseRegisterEvent)(nil),                   // 50: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
-	(*UIDiscoverDatabaseConfigureMTLSEvent)(nil),              // 51: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
-	(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent)(nil), // 52: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
-	(*UIDiscoverDesktopActiveDirectoryConfigureEvent)(nil),    // 53: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
-	(*UIDiscoverAutoDiscoveredResourcesEvent)(nil),            // 54: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
-	(*UIDiscoverEC2InstanceSelectionEvent)(nil),               // 55: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent
-	(*UIDiscoverDeployEICEEvent)(nil),                         // 56: prehog.v1alpha.UIDiscoverDeployEICEEvent
-	(*UIDiscoverCreateNodeEvent)(nil),                         // 57: prehog.v1alpha.UIDiscoverCreateNodeEvent
-	(*UIDiscoverCreateAppServerEvent)(nil),                    // 58: prehog.v1alpha.UIDiscoverCreateAppServerEvent
-	(*UIDiscoverDatabaseConfigureIAMPolicyEvent)(nil),         // 59: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
-	(*UIDiscoverPrincipalsConfigureEvent)(nil),                // 60: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
-	(*UIDiscoverTestConnectionEvent)(nil),                     // 61: prehog.v1alpha.UIDiscoverTestConnectionEvent
-	(*UIDiscoverCompletedEvent)(nil),                          // 62: prehog.v1alpha.UIDiscoverCompletedEvent
-	(*RoleCreateEvent)(nil),                                   // 63: prehog.v1alpha.RoleCreateEvent
-	(*BotCreateEvent)(nil),                                    // 64: prehog.v1alpha.BotCreateEvent
-	(*BotJoinEvent)(nil),                                      // 65: prehog.v1alpha.BotJoinEvent
-	(*UICreateNewRoleClickEvent)(nil),                         // 66: prehog.v1alpha.UICreateNewRoleClickEvent
-	(*UICreateNewRoleSaveClickEvent)(nil),                     // 67: prehog.v1alpha.UICreateNewRoleSaveClickEvent
-	(*UICreateNewRoleCancelClickEvent)(nil),                   // 68: prehog.v1alpha.UICreateNewRoleCancelClickEvent
-	(*UICreateNewRoleViewDocumentationClickEvent)(nil),        // 69: prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
-	(*UICallToActionClickEvent)(nil),                          // 70: prehog.v1alpha.UICallToActionClickEvent
-	(*KubeRequestEvent)(nil),                                  // 71: prehog.v1alpha.KubeRequestEvent
-	(*SFTPEvent)(nil),                                         // 72: prehog.v1alpha.SFTPEvent
-	(*AgentMetadataEvent)(nil),                                // 73: prehog.v1alpha.AgentMetadataEvent
-	(*AssistCompletionEvent)(nil),                             // 74: prehog.v1alpha.AssistCompletionEvent
-	(*AssistExecutionEvent)(nil),                              // 75: prehog.v1alpha.AssistExecutionEvent
-	(*AssistNewConversationEvent)(nil),                        // 76: prehog.v1alpha.AssistNewConversationEvent
-	(*AssistAccessRequestEvent)(nil),                          // 77: prehog.v1alpha.AssistAccessRequestEvent
-	(*AssistActionEvent)(nil),                                 // 78: prehog.v1alpha.AssistActionEvent
-	(*AccessListMetadata)(nil),                                // 79: prehog.v1alpha.AccessListMetadata
-	(*AccessListCreateEvent)(nil),                             // 80: prehog.v1alpha.AccessListCreateEvent
-	(*AccessListUpdateEvent)(nil),                             // 81: prehog.v1alpha.AccessListUpdateEvent
-	(*AccessListDeleteEvent)(nil),                             // 82: prehog.v1alpha.AccessListDeleteEvent
-	(*AccessListMemberCreateEvent)(nil),                       // 83: prehog.v1alpha.AccessListMemberCreateEvent
-	(*AccessListMemberUpdateEvent)(nil),                       // 84: prehog.v1alpha.AccessListMemberUpdateEvent
-	(*AccessListMemberDeleteEvent)(nil),                       // 85: prehog.v1alpha.AccessListMemberDeleteEvent
-	(*AccessListGrantsToUserEvent)(nil),                       // 86: prehog.v1alpha.AccessListGrantsToUserEvent
-	(*AccessListReviewCreateEvent)(nil),                       // 87: prehog.v1alpha.AccessListReviewCreateEvent
-	(*AccessListReviewDeleteEvent)(nil),                       // 88: prehog.v1alpha.AccessListReviewDeleteEvent
-	(*AccessListReviewComplianceEvent)(nil),                   // 89: prehog.v1alpha.AccessListReviewComplianceEvent
-	(*IntegrationEnrollMetadata)(nil),                         // 90: prehog.v1alpha.IntegrationEnrollMetadata
-	(*UIIntegrationEnrollStartEvent)(nil),                     // 91: prehog.v1alpha.UIIntegrationEnrollStartEvent
-	(*UIIntegrationEnrollCompleteEvent)(nil),                  // 92: prehog.v1alpha.UIIntegrationEnrollCompleteEvent
-	(*IntegrationEnrollStepStatus)(nil),                       // 93: prehog.v1alpha.IntegrationEnrollStepStatus
-	(*UIIntegrationEnrollStepEvent)(nil),                      // 94: prehog.v1alpha.UIIntegrationEnrollStepEvent
-	(*EditorChangeEvent)(nil),                                 // 95: prehog.v1alpha.EditorChangeEvent
-	(*DeviceAuthenticateEvent)(nil),                           // 96: prehog.v1alpha.DeviceAuthenticateEvent
-	(*DeviceEnrollEvent)(nil),                                 // 97: prehog.v1alpha.DeviceEnrollEvent
-	(*FeatureRecommendationEvent)(nil),                        // 98: prehog.v1alpha.FeatureRecommendationEvent
-	(*LicenseLimitEvent)(nil),                                 // 99: prehog.v1alpha.LicenseLimitEvent
-	(*DesktopDirectoryShareEvent)(nil),                        // 100: prehog.v1alpha.DesktopDirectoryShareEvent
-	(*DesktopClipboardEvent)(nil),                             // 101: prehog.v1alpha.DesktopClipboardEvent
-	(*TAGExecuteQueryEvent)(nil),                              // 102: prehog.v1alpha.TAGExecuteQueryEvent
-	(*AccessGraphSecretsScanAuthorizedKeysEvent)(nil),         // 103: prehog.v1alpha.AccessGraphSecretsScanAuthorizedKeysEvent
-	(*AccessGraphSecretsScanSSHPrivateKeysEvent)(nil),         // 104: prehog.v1alpha.AccessGraphSecretsScanSSHPrivateKeysEvent
-	(*AccessGraphGitlabScanEvent)(nil),                        // 105: prehog.v1alpha.AccessGraphGitlabScanEvent
-	(*AccessGraphAWSScanEvent)(nil),                           // 106: prehog.v1alpha.AccessGraphAWSScanEvent
-	(*AccessGraphAccessPathChangedEvent)(nil),                 // 107: prehog.v1alpha.AccessGraphAccessPathChangedEvent
-	(*UIAccessGraphCrownJewelDiffViewEvent)(nil),              // 108: prehog.v1alpha.UIAccessGraphCrownJewelDiffViewEvent
-	(*AccessGraphCrownJewelCreateEvent)(nil),                  // 109: prehog.v1alpha.AccessGraphCrownJewelCreateEvent
-	(*ExternalAuditStorageAuthenticateEvent)(nil),             // 110: prehog.v1alpha.ExternalAuditStorageAuthenticateEvent
-	(*SecurityReportGetResultEvent)(nil),                      // 111: prehog.v1alpha.SecurityReportGetResultEvent
-	(*AuditQueryRunEvent)(nil),                                // 112: prehog.v1alpha.AuditQueryRunEvent
-	(*DiscoveryFetchEvent)(nil),                               // 113: prehog.v1alpha.DiscoveryFetchEvent
-	(*OktaAccessListSyncEvent)(nil),                           // 114: prehog.v1alpha.OktaAccessListSyncEvent
-	(*DatabaseUserCreatedEvent)(nil),                          // 115: prehog.v1alpha.DatabaseUserCreatedEvent
-	(*DatabaseUserPermissionsUpdateEvent)(nil),                // 116: prehog.v1alpha.DatabaseUserPermissionsUpdateEvent
-	(*SessionRecordingAccessEvent)(nil),                       // 117: prehog.v1alpha.SessionRecordingAccessEvent
-	(*UserTaskStateEvent)(nil),                                // 118: prehog.v1alpha.UserTaskStateEvent
-	(*AccessRequestCreateEvent)(nil),                          // 119: prehog.v1alpha.AccessRequestCreateEvent
-	(*AccessRequestReviewEvent)(nil),                          // 120: prehog.v1alpha.AccessRequestReviewEvent
-	(*SubmitEventRequest)(nil),                                // 121: prehog.v1alpha.SubmitEventRequest
-	(*SubmitEventResponse)(nil),                               // 122: prehog.v1alpha.SubmitEventResponse
-	(*SubmitEventsRequest)(nil),                               // 123: prehog.v1alpha.SubmitEventsRequest
-	(*SubmitEventsResponse)(nil),                              // 124: prehog.v1alpha.SubmitEventsResponse
-	(*HelloTeleportRequest)(nil),                              // 125: prehog.v1alpha.HelloTeleportRequest
-	(*HelloTeleportResponse)(nil),                             // 126: prehog.v1alpha.HelloTeleportResponse
-	(*durationpb.Duration)(nil),                               // 127: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),                             // 128: google.protobuf.Timestamp
+	(UserOrigin)(0),                                           // 0: prehog.v1alpha.UserOrigin
+	(ResourceKind)(0),                                         // 1: prehog.v1alpha.ResourceKind
+	(UserKind)(0),                                             // 2: prehog.v1alpha.UserKind
+	(DiscoverResource)(0),                                     // 3: prehog.v1alpha.DiscoverResource
+	(DiscoverStatus)(0),                                       // 4: prehog.v1alpha.DiscoverStatus
+	(CTA)(0),                                                  // 5: prehog.v1alpha.CTA
+	(IntegrationEnrollKind)(0),                                // 6: prehog.v1alpha.IntegrationEnrollKind
+	(IntegrationEnrollStep)(0),                                // 7: prehog.v1alpha.IntegrationEnrollStep
+	(IntegrationEnrollStatusCode)(0),                          // 8: prehog.v1alpha.IntegrationEnrollStatusCode
+	(IntegrationEnrollSection)(0),                             // 9: prehog.v1alpha.IntegrationEnrollSection
+	(IntegrationEnrollField)(0),                               // 10: prehog.v1alpha.IntegrationEnrollField
+	(IntegrationEnrollCodeType)(0),                            // 11: prehog.v1alpha.IntegrationEnrollCodeType
+	(EditorChangeStatus)(0),                                   // 12: prehog.v1alpha.EditorChangeStatus
+	(Feature)(0),                                              // 13: prehog.v1alpha.Feature
+	(FeatureRecommendationStatus)(0),                          // 14: prehog.v1alpha.FeatureRecommendationStatus
+	(LicenseLimit)(0),                                         // 15: prehog.v1alpha.LicenseLimit
+	(UIDiscoverDeployServiceEvent_DeployMethod)(0),            // 16: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
+	(UIDiscoverDeployServiceEvent_DeployType)(0),              // 17: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
+	(UIDiscoverCreateDiscoveryConfigEvent_ConfigMethod)(0),    // 18: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.ConfigMethod
+	(AccessRequestReviewEvent_ProposedState)(0),               // 19: prehog.v1alpha.AccessRequestReviewEvent.ProposedState
+	(*UserLoginEvent)(nil),                                    // 20: prehog.v1alpha.UserLoginEvent
+	(*MFAAuthenticationEvent)(nil),                            // 21: prehog.v1alpha.MFAAuthenticationEvent
+	(*SSOCreateEvent)(nil),                                    // 22: prehog.v1alpha.SSOCreateEvent
+	(*ResourceCreateEvent)(nil),                               // 23: prehog.v1alpha.ResourceCreateEvent
+	(*DiscoveredDatabaseMetadata)(nil),                        // 24: prehog.v1alpha.DiscoveredDatabaseMetadata
+	(*ResourceHeartbeatEvent)(nil),                            // 25: prehog.v1alpha.ResourceHeartbeatEvent
+	(*SessionStartEvent)(nil),                                 // 26: prehog.v1alpha.SessionStartEvent
+	(*SessionStartDatabaseMetadata)(nil),                      // 27: prehog.v1alpha.SessionStartDatabaseMetadata
+	(*SessionStartDesktopMetadata)(nil),                       // 28: prehog.v1alpha.SessionStartDesktopMetadata
+	(*SessionStartAppMetadata)(nil),                           // 29: prehog.v1alpha.SessionStartAppMetadata
+	(*SessionStartGitMetadata)(nil),                           // 30: prehog.v1alpha.SessionStartGitMetadata
+	(*SessionStartMCPMetadata)(nil),                           // 31: prehog.v1alpha.SessionStartMCPMetadata
+	(*UserCertificateIssuedEvent)(nil),                        // 32: prehog.v1alpha.UserCertificateIssuedEvent
+	(*SPIFFESVIDIssuedEvent)(nil),                             // 33: prehog.v1alpha.SPIFFESVIDIssuedEvent
+	(*UIBannerClickEvent)(nil),                                // 34: prehog.v1alpha.UIBannerClickEvent
+	(*UIOnboardCompleteGoToDashboardClickEvent)(nil),          // 35: prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
+	(*UIOnboardAddFirstResourceClickEvent)(nil),               // 36: prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
+	(*UIOnboardAddFirstResourceLaterClickEvent)(nil),          // 37: prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
+	(*UIOnboardSetCredentialSubmitEvent)(nil),                 // 38: prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
+	(*UIOnboardRegisterChallengeSubmitEvent)(nil),             // 39: prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
+	(*UIOnboardQuestionnaireSubmitEvent)(nil),                 // 40: prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
+	(*UIRecoveryCodesContinueClickEvent)(nil),                 // 41: prehog.v1alpha.UIRecoveryCodesContinueClickEvent
+	(*UIRecoveryCodesCopyClickEvent)(nil),                     // 42: prehog.v1alpha.UIRecoveryCodesCopyClickEvent
+	(*UIRecoveryCodesPrintClickEvent)(nil),                    // 43: prehog.v1alpha.UIRecoveryCodesPrintClickEvent
+	(*DiscoverMetadata)(nil),                                  // 44: prehog.v1alpha.DiscoverMetadata
+	(*DiscoverResourceMetadata)(nil),                          // 45: prehog.v1alpha.DiscoverResourceMetadata
+	(*DiscoverStepStatus)(nil),                                // 46: prehog.v1alpha.DiscoverStepStatus
+	(*UIDiscoverStartedEvent)(nil),                            // 47: prehog.v1alpha.UIDiscoverStartedEvent
+	(*UIDiscoverResourceSelectionEvent)(nil),                  // 48: prehog.v1alpha.UIDiscoverResourceSelectionEvent
+	(*UIDiscoverIntegrationAWSOIDCConnectEvent)(nil),          // 49: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
+	(*UIDiscoverDatabaseRDSEnrollEvent)(nil),                  // 50: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
+	(*UIDiscoverKubeEKSEnrollEvent)(nil),                      // 51: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent
+	(*UIDiscoverDeployServiceEvent)(nil),                      // 52: prehog.v1alpha.UIDiscoverDeployServiceEvent
+	(*UIDiscoverCreateDiscoveryConfigEvent)(nil),              // 53: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent
+	(*UIDiscoverDatabaseRegisterEvent)(nil),                   // 54: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
+	(*UIDiscoverDatabaseConfigureMTLSEvent)(nil),              // 55: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
+	(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent)(nil), // 56: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
+	(*UIDiscoverDesktopActiveDirectoryConfigureEvent)(nil),    // 57: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
+	(*UIDiscoverAutoDiscoveredResourcesEvent)(nil),            // 58: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
+	(*UIDiscoverEC2InstanceSelectionEvent)(nil),               // 59: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent
+	(*UIDiscoverDeployEICEEvent)(nil),                         // 60: prehog.v1alpha.UIDiscoverDeployEICEEvent
+	(*UIDiscoverCreateNodeEvent)(nil),                         // 61: prehog.v1alpha.UIDiscoverCreateNodeEvent
+	(*UIDiscoverCreateAppServerEvent)(nil),                    // 62: prehog.v1alpha.UIDiscoverCreateAppServerEvent
+	(*UIDiscoverDatabaseConfigureIAMPolicyEvent)(nil),         // 63: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
+	(*UIDiscoverPrincipalsConfigureEvent)(nil),                // 64: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
+	(*UIDiscoverTestConnectionEvent)(nil),                     // 65: prehog.v1alpha.UIDiscoverTestConnectionEvent
+	(*UIDiscoverCompletedEvent)(nil),                          // 66: prehog.v1alpha.UIDiscoverCompletedEvent
+	(*RoleCreateEvent)(nil),                                   // 67: prehog.v1alpha.RoleCreateEvent
+	(*BotCreateEvent)(nil),                                    // 68: prehog.v1alpha.BotCreateEvent
+	(*BotJoinEvent)(nil),                                      // 69: prehog.v1alpha.BotJoinEvent
+	(*UICreateNewRoleClickEvent)(nil),                         // 70: prehog.v1alpha.UICreateNewRoleClickEvent
+	(*UICreateNewRoleSaveClickEvent)(nil),                     // 71: prehog.v1alpha.UICreateNewRoleSaveClickEvent
+	(*UICreateNewRoleCancelClickEvent)(nil),                   // 72: prehog.v1alpha.UICreateNewRoleCancelClickEvent
+	(*UICreateNewRoleViewDocumentationClickEvent)(nil),        // 73: prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
+	(*UICallToActionClickEvent)(nil),                          // 74: prehog.v1alpha.UICallToActionClickEvent
+	(*KubeRequestEvent)(nil),                                  // 75: prehog.v1alpha.KubeRequestEvent
+	(*SFTPEvent)(nil),                                         // 76: prehog.v1alpha.SFTPEvent
+	(*AgentMetadataEvent)(nil),                                // 77: prehog.v1alpha.AgentMetadataEvent
+	(*AssistCompletionEvent)(nil),                             // 78: prehog.v1alpha.AssistCompletionEvent
+	(*AssistExecutionEvent)(nil),                              // 79: prehog.v1alpha.AssistExecutionEvent
+	(*AssistNewConversationEvent)(nil),                        // 80: prehog.v1alpha.AssistNewConversationEvent
+	(*AssistAccessRequestEvent)(nil),                          // 81: prehog.v1alpha.AssistAccessRequestEvent
+	(*AssistActionEvent)(nil),                                 // 82: prehog.v1alpha.AssistActionEvent
+	(*AccessListMetadata)(nil),                                // 83: prehog.v1alpha.AccessListMetadata
+	(*AccessListCreateEvent)(nil),                             // 84: prehog.v1alpha.AccessListCreateEvent
+	(*AccessListUpdateEvent)(nil),                             // 85: prehog.v1alpha.AccessListUpdateEvent
+	(*AccessListDeleteEvent)(nil),                             // 86: prehog.v1alpha.AccessListDeleteEvent
+	(*AccessListMemberCreateEvent)(nil),                       // 87: prehog.v1alpha.AccessListMemberCreateEvent
+	(*AccessListMemberUpdateEvent)(nil),                       // 88: prehog.v1alpha.AccessListMemberUpdateEvent
+	(*AccessListMemberDeleteEvent)(nil),                       // 89: prehog.v1alpha.AccessListMemberDeleteEvent
+	(*AccessListGrantsToUserEvent)(nil),                       // 90: prehog.v1alpha.AccessListGrantsToUserEvent
+	(*AccessListReviewCreateEvent)(nil),                       // 91: prehog.v1alpha.AccessListReviewCreateEvent
+	(*AccessListReviewDeleteEvent)(nil),                       // 92: prehog.v1alpha.AccessListReviewDeleteEvent
+	(*AccessListReviewComplianceEvent)(nil),                   // 93: prehog.v1alpha.AccessListReviewComplianceEvent
+	(*IntegrationEnrollMetadata)(nil),                         // 94: prehog.v1alpha.IntegrationEnrollMetadata
+	(*UIIntegrationEnrollStartEvent)(nil),                     // 95: prehog.v1alpha.UIIntegrationEnrollStartEvent
+	(*UIIntegrationEnrollCompleteEvent)(nil),                  // 96: prehog.v1alpha.UIIntegrationEnrollCompleteEvent
+	(*IntegrationEnrollStepStatus)(nil),                       // 97: prehog.v1alpha.IntegrationEnrollStepStatus
+	(*UIIntegrationEnrollStepEvent)(nil),                      // 98: prehog.v1alpha.UIIntegrationEnrollStepEvent
+	(*UIIntegrationEnrollSectionOpenEvent)(nil),               // 99: prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent
+	(*UIIntegrationEnrollFieldCompleteEvent)(nil),             // 100: prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent
+	(*UIIntegrationEnrollCodeCopyEvent)(nil),                  // 101: prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent
+	(*UIIntegrationEnrollLinkClickEvent)(nil),                 // 102: prehog.v1alpha.UIIntegrationEnrollLinkClickEvent
+	(*EditorChangeEvent)(nil),                                 // 103: prehog.v1alpha.EditorChangeEvent
+	(*DeviceAuthenticateEvent)(nil),                           // 104: prehog.v1alpha.DeviceAuthenticateEvent
+	(*DeviceEnrollEvent)(nil),                                 // 105: prehog.v1alpha.DeviceEnrollEvent
+	(*FeatureRecommendationEvent)(nil),                        // 106: prehog.v1alpha.FeatureRecommendationEvent
+	(*LicenseLimitEvent)(nil),                                 // 107: prehog.v1alpha.LicenseLimitEvent
+	(*DesktopDirectoryShareEvent)(nil),                        // 108: prehog.v1alpha.DesktopDirectoryShareEvent
+	(*DesktopClipboardEvent)(nil),                             // 109: prehog.v1alpha.DesktopClipboardEvent
+	(*TAGExecuteQueryEvent)(nil),                              // 110: prehog.v1alpha.TAGExecuteQueryEvent
+	(*AccessGraphSecretsScanAuthorizedKeysEvent)(nil),         // 111: prehog.v1alpha.AccessGraphSecretsScanAuthorizedKeysEvent
+	(*AccessGraphSecretsScanSSHPrivateKeysEvent)(nil),         // 112: prehog.v1alpha.AccessGraphSecretsScanSSHPrivateKeysEvent
+	(*AccessGraphGitlabScanEvent)(nil),                        // 113: prehog.v1alpha.AccessGraphGitlabScanEvent
+	(*AccessGraphAWSScanEvent)(nil),                           // 114: prehog.v1alpha.AccessGraphAWSScanEvent
+	(*AccessGraphAccessPathChangedEvent)(nil),                 // 115: prehog.v1alpha.AccessGraphAccessPathChangedEvent
+	(*UIAccessGraphCrownJewelDiffViewEvent)(nil),              // 116: prehog.v1alpha.UIAccessGraphCrownJewelDiffViewEvent
+	(*AccessGraphCrownJewelCreateEvent)(nil),                  // 117: prehog.v1alpha.AccessGraphCrownJewelCreateEvent
+	(*ExternalAuditStorageAuthenticateEvent)(nil),             // 118: prehog.v1alpha.ExternalAuditStorageAuthenticateEvent
+	(*SecurityReportGetResultEvent)(nil),                      // 119: prehog.v1alpha.SecurityReportGetResultEvent
+	(*AuditQueryRunEvent)(nil),                                // 120: prehog.v1alpha.AuditQueryRunEvent
+	(*DiscoveryFetchEvent)(nil),                               // 121: prehog.v1alpha.DiscoveryFetchEvent
+	(*OktaAccessListSyncEvent)(nil),                           // 122: prehog.v1alpha.OktaAccessListSyncEvent
+	(*DatabaseUserCreatedEvent)(nil),                          // 123: prehog.v1alpha.DatabaseUserCreatedEvent
+	(*DatabaseUserPermissionsUpdateEvent)(nil),                // 124: prehog.v1alpha.DatabaseUserPermissionsUpdateEvent
+	(*SessionRecordingAccessEvent)(nil),                       // 125: prehog.v1alpha.SessionRecordingAccessEvent
+	(*UserTaskStateEvent)(nil),                                // 126: prehog.v1alpha.UserTaskStateEvent
+	(*AccessRequestCreateEvent)(nil),                          // 127: prehog.v1alpha.AccessRequestCreateEvent
+	(*AccessRequestReviewEvent)(nil),                          // 128: prehog.v1alpha.AccessRequestReviewEvent
+	(*SubmitEventRequest)(nil),                                // 129: prehog.v1alpha.SubmitEventRequest
+	(*SubmitEventResponse)(nil),                               // 130: prehog.v1alpha.SubmitEventResponse
+	(*SubmitEventsRequest)(nil),                               // 131: prehog.v1alpha.SubmitEventsRequest
+	(*SubmitEventsResponse)(nil),                              // 132: prehog.v1alpha.SubmitEventsResponse
+	(*HelloTeleportRequest)(nil),                              // 133: prehog.v1alpha.HelloTeleportRequest
+	(*HelloTeleportResponse)(nil),                             // 134: prehog.v1alpha.HelloTeleportResponse
+	(*durationpb.Duration)(nil),                               // 135: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),                             // 136: google.protobuf.Timestamp
 }
 var file_prehog_v1alpha_teleport_proto_depIdxs = []int32{
 	0,   // 0: prehog.v1alpha.UserLoginEvent.user_origin:type_name -> prehog.v1alpha.UserOrigin
-	21,  // 1: prehog.v1alpha.ResourceCreateEvent.database:type_name -> prehog.v1alpha.DiscoveredDatabaseMetadata
+	24,  // 1: prehog.v1alpha.ResourceCreateEvent.database:type_name -> prehog.v1alpha.DiscoveredDatabaseMetadata
 	1,   // 2: prehog.v1alpha.ResourceHeartbeatEvent.resource_kind:type_name -> prehog.v1alpha.ResourceKind
-	24,  // 3: prehog.v1alpha.SessionStartEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
-	25,  // 4: prehog.v1alpha.SessionStartEvent.desktop:type_name -> prehog.v1alpha.SessionStartDesktopMetadata
+	27,  // 3: prehog.v1alpha.SessionStartEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
+	28,  // 4: prehog.v1alpha.SessionStartEvent.desktop:type_name -> prehog.v1alpha.SessionStartDesktopMetadata
 	2,   // 5: prehog.v1alpha.SessionStartEvent.user_kind:type_name -> prehog.v1alpha.UserKind
-	26,  // 6: prehog.v1alpha.SessionStartEvent.app:type_name -> prehog.v1alpha.SessionStartAppMetadata
-	27,  // 7: prehog.v1alpha.SessionStartEvent.git:type_name -> prehog.v1alpha.SessionStartGitMetadata
-	127, // 8: prehog.v1alpha.UserCertificateIssuedEvent.ttl:type_name -> google.protobuf.Duration
-	2,   // 9: prehog.v1alpha.SPIFFESVIDIssuedEvent.user_kind:type_name -> prehog.v1alpha.UserKind
-	3,   // 10: prehog.v1alpha.DiscoverResourceMetadata.resource:type_name -> prehog.v1alpha.DiscoverResource
-	4,   // 11: prehog.v1alpha.DiscoverStepStatus.status:type_name -> prehog.v1alpha.DiscoverStatus
-	40,  // 12: prehog.v1alpha.UIDiscoverStartedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	42,  // 13: prehog.v1alpha.UIDiscoverStartedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 14: prehog.v1alpha.UIDiscoverResourceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 15: prehog.v1alpha.UIDiscoverResourceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 16: prehog.v1alpha.UIDiscoverResourceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 17: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 18: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 19: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 20: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 21: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 22: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 23: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 24: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 25: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 26: prehog.v1alpha.UIDiscoverDeployServiceEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 27: prehog.v1alpha.UIDiscoverDeployServiceEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 28: prehog.v1alpha.UIDiscoverDeployServiceEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	13,  // 29: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_method:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
-	14,  // 30: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_type:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
-	40,  // 31: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 32: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 33: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	15,  // 34: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.config_method:type_name -> prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.ConfigMethod
-	40,  // 35: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 36: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 37: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 38: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 39: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 40: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 41: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 42: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 43: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 44: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 45: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 46: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 47: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 48: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 49: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 50: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 51: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 52: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 53: prehog.v1alpha.UIDiscoverDeployEICEEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 54: prehog.v1alpha.UIDiscoverDeployEICEEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 55: prehog.v1alpha.UIDiscoverDeployEICEEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 56: prehog.v1alpha.UIDiscoverCreateNodeEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 57: prehog.v1alpha.UIDiscoverCreateNodeEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 58: prehog.v1alpha.UIDiscoverCreateNodeEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 59: prehog.v1alpha.UIDiscoverCreateAppServerEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 60: prehog.v1alpha.UIDiscoverCreateAppServerEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 61: prehog.v1alpha.UIDiscoverCreateAppServerEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 62: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 63: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 64: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 65: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 66: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 67: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 68: prehog.v1alpha.UIDiscoverTestConnectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 69: prehog.v1alpha.UIDiscoverTestConnectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 70: prehog.v1alpha.UIDiscoverTestConnectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	40,  // 71: prehog.v1alpha.UIDiscoverCompletedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	41,  // 72: prehog.v1alpha.UIDiscoverCompletedEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	42,  // 73: prehog.v1alpha.UIDiscoverCompletedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	5,   // 74: prehog.v1alpha.UICallToActionClickEvent.cta:type_name -> prehog.v1alpha.CTA
-	2,   // 75: prehog.v1alpha.KubeRequestEvent.user_kind:type_name -> prehog.v1alpha.UserKind
-	2,   // 76: prehog.v1alpha.SFTPEvent.user_kind:type_name -> prehog.v1alpha.UserKind
-	79,  // 77: prehog.v1alpha.AccessListCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 78: prehog.v1alpha.AccessListUpdateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 79: prehog.v1alpha.AccessListDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 80: prehog.v1alpha.AccessListMemberCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 81: prehog.v1alpha.AccessListMemberUpdateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 82: prehog.v1alpha.AccessListMemberDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 83: prehog.v1alpha.AccessListReviewCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	79,  // 84: prehog.v1alpha.AccessListReviewDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
-	6,   // 85: prehog.v1alpha.IntegrationEnrollMetadata.kind:type_name -> prehog.v1alpha.IntegrationEnrollKind
-	90,  // 86: prehog.v1alpha.UIIntegrationEnrollStartEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
-	90,  // 87: prehog.v1alpha.UIIntegrationEnrollCompleteEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
-	8,   // 88: prehog.v1alpha.IntegrationEnrollStepStatus.code:type_name -> prehog.v1alpha.IntegrationEnrollStatusCode
-	90,  // 89: prehog.v1alpha.UIIntegrationEnrollStepEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
-	7,   // 90: prehog.v1alpha.UIIntegrationEnrollStepEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
-	93,  // 91: prehog.v1alpha.UIIntegrationEnrollStepEvent.status:type_name -> prehog.v1alpha.IntegrationEnrollStepStatus
-	9,   // 92: prehog.v1alpha.EditorChangeEvent.status:type_name -> prehog.v1alpha.EditorChangeStatus
-	10,  // 93: prehog.v1alpha.FeatureRecommendationEvent.feature:type_name -> prehog.v1alpha.Feature
-	11,  // 94: prehog.v1alpha.FeatureRecommendationEvent.feature_recommendation_status:type_name -> prehog.v1alpha.FeatureRecommendationStatus
-	12,  // 95: prehog.v1alpha.LicenseLimitEvent.license_limit:type_name -> prehog.v1alpha.LicenseLimit
-	24,  // 96: prehog.v1alpha.DatabaseUserCreatedEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
-	24,  // 97: prehog.v1alpha.DatabaseUserPermissionsUpdateEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
-	16,  // 98: prehog.v1alpha.AccessRequestReviewEvent.proposed_state:type_name -> prehog.v1alpha.AccessRequestReviewEvent.ProposedState
-	128, // 99: prehog.v1alpha.SubmitEventRequest.timestamp:type_name -> google.protobuf.Timestamp
-	17,  // 100: prehog.v1alpha.SubmitEventRequest.user_login:type_name -> prehog.v1alpha.UserLoginEvent
-	19,  // 101: prehog.v1alpha.SubmitEventRequest.sso_create:type_name -> prehog.v1alpha.SSOCreateEvent
-	20,  // 102: prehog.v1alpha.SubmitEventRequest.resource_create:type_name -> prehog.v1alpha.ResourceCreateEvent
-	23,  // 103: prehog.v1alpha.SubmitEventRequest.session_start:type_name -> prehog.v1alpha.SessionStartEvent
-	30,  // 104: prehog.v1alpha.SubmitEventRequest.ui_banner_click:type_name -> prehog.v1alpha.UIBannerClickEvent
-	31,  // 105: prehog.v1alpha.SubmitEventRequest.ui_onboard_complete_go_to_dashboard_click:type_name -> prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
-	32,  // 106: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
-	33,  // 107: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_later_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
-	34,  // 108: prehog.v1alpha.SubmitEventRequest.ui_onboard_set_credential_submit:type_name -> prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
-	35,  // 109: prehog.v1alpha.SubmitEventRequest.ui_onboard_register_challenge_submit:type_name -> prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
-	37,  // 110: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_continue_click:type_name -> prehog.v1alpha.UIRecoveryCodesContinueClickEvent
-	38,  // 111: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_copy_click:type_name -> prehog.v1alpha.UIRecoveryCodesCopyClickEvent
-	39,  // 112: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_print_click:type_name -> prehog.v1alpha.UIRecoveryCodesPrintClickEvent
-	43,  // 113: prehog.v1alpha.SubmitEventRequest.ui_discover_started_event:type_name -> prehog.v1alpha.UIDiscoverStartedEvent
-	44,  // 114: prehog.v1alpha.SubmitEventRequest.ui_discover_resource_selection_event:type_name -> prehog.v1alpha.UIDiscoverResourceSelectionEvent
-	28,  // 115: prehog.v1alpha.SubmitEventRequest.user_certificate_issued_event:type_name -> prehog.v1alpha.UserCertificateIssuedEvent
-	23,  // 116: prehog.v1alpha.SubmitEventRequest.session_start_v2:type_name -> prehog.v1alpha.SessionStartEvent
-	48,  // 117: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_service_event:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent
-	50,  // 118: prehog.v1alpha.SubmitEventRequest.ui_discover_database_register_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
-	51,  // 119: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_mtls_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
-	52,  // 120: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_tools_install_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
-	53,  // 121: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_configure_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
-	54,  // 122: prehog.v1alpha.SubmitEventRequest.ui_discover_auto_discovered_resources_event:type_name -> prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
-	59,  // 123: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_iam_policy_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
-	60,  // 124: prehog.v1alpha.SubmitEventRequest.ui_discover_principals_configure_event:type_name -> prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
-	61,  // 125: prehog.v1alpha.SubmitEventRequest.ui_discover_test_connection_event:type_name -> prehog.v1alpha.UIDiscoverTestConnectionEvent
-	62,  // 126: prehog.v1alpha.SubmitEventRequest.ui_discover_completed_event:type_name -> prehog.v1alpha.UIDiscoverCompletedEvent
-	63,  // 127: prehog.v1alpha.SubmitEventRequest.role_create:type_name -> prehog.v1alpha.RoleCreateEvent
-	66,  // 128: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_click:type_name -> prehog.v1alpha.UICreateNewRoleClickEvent
-	67,  // 129: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_save_click:type_name -> prehog.v1alpha.UICreateNewRoleSaveClickEvent
-	68,  // 130: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_cancel_click:type_name -> prehog.v1alpha.UICreateNewRoleCancelClickEvent
-	69,  // 131: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_view_documentation_click:type_name -> prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
-	71,  // 132: prehog.v1alpha.SubmitEventRequest.kube_request:type_name -> prehog.v1alpha.KubeRequestEvent
-	72,  // 133: prehog.v1alpha.SubmitEventRequest.sftp:type_name -> prehog.v1alpha.SFTPEvent
-	73,  // 134: prehog.v1alpha.SubmitEventRequest.agent_metadata_event:type_name -> prehog.v1alpha.AgentMetadataEvent
-	22,  // 135: prehog.v1alpha.SubmitEventRequest.resource_heartbeat:type_name -> prehog.v1alpha.ResourceHeartbeatEvent
-	45,  // 136: prehog.v1alpha.SubmitEventRequest.ui_discover_integration_aws_oidc_connect_event:type_name -> prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
-	46,  // 137: prehog.v1alpha.SubmitEventRequest.ui_discover_database_rds_enroll_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
-	70,  // 138: prehog.v1alpha.SubmitEventRequest.ui_call_to_action_click_event:type_name -> prehog.v1alpha.UICallToActionClickEvent
-	74,  // 139: prehog.v1alpha.SubmitEventRequest.assist_completion:type_name -> prehog.v1alpha.AssistCompletionEvent
-	91,  // 140: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_start_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStartEvent
-	92,  // 141: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_complete_event:type_name -> prehog.v1alpha.UIIntegrationEnrollCompleteEvent
-	95,  // 142: prehog.v1alpha.SubmitEventRequest.editor_change_event:type_name -> prehog.v1alpha.EditorChangeEvent
-	64,  // 143: prehog.v1alpha.SubmitEventRequest.bot_create:type_name -> prehog.v1alpha.BotCreateEvent
-	36,  // 144: prehog.v1alpha.SubmitEventRequest.ui_onboard_questionnaire_submit:type_name -> prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
-	65,  // 145: prehog.v1alpha.SubmitEventRequest.bot_join:type_name -> prehog.v1alpha.BotJoinEvent
-	75,  // 146: prehog.v1alpha.SubmitEventRequest.assist_execution:type_name -> prehog.v1alpha.AssistExecutionEvent
-	76,  // 147: prehog.v1alpha.SubmitEventRequest.assist_new_conversation:type_name -> prehog.v1alpha.AssistNewConversationEvent
-	96,  // 148: prehog.v1alpha.SubmitEventRequest.device_authenticate_event:type_name -> prehog.v1alpha.DeviceAuthenticateEvent
-	98,  // 149: prehog.v1alpha.SubmitEventRequest.feature_recommendation_event:type_name -> prehog.v1alpha.FeatureRecommendationEvent
-	77,  // 150: prehog.v1alpha.SubmitEventRequest.assist_access_request:type_name -> prehog.v1alpha.AssistAccessRequestEvent
-	78,  // 151: prehog.v1alpha.SubmitEventRequest.assist_action:type_name -> prehog.v1alpha.AssistActionEvent
-	97,  // 152: prehog.v1alpha.SubmitEventRequest.device_enroll_event:type_name -> prehog.v1alpha.DeviceEnrollEvent
-	99,  // 153: prehog.v1alpha.SubmitEventRequest.license_limit_event:type_name -> prehog.v1alpha.LicenseLimitEvent
-	80,  // 154: prehog.v1alpha.SubmitEventRequest.access_list_create:type_name -> prehog.v1alpha.AccessListCreateEvent
-	81,  // 155: prehog.v1alpha.SubmitEventRequest.access_list_update:type_name -> prehog.v1alpha.AccessListUpdateEvent
-	82,  // 156: prehog.v1alpha.SubmitEventRequest.access_list_delete:type_name -> prehog.v1alpha.AccessListDeleteEvent
-	83,  // 157: prehog.v1alpha.SubmitEventRequest.access_list_member_create:type_name -> prehog.v1alpha.AccessListMemberCreateEvent
-	84,  // 158: prehog.v1alpha.SubmitEventRequest.access_list_member_update:type_name -> prehog.v1alpha.AccessListMemberUpdateEvent
-	85,  // 159: prehog.v1alpha.SubmitEventRequest.access_list_member_delete:type_name -> prehog.v1alpha.AccessListMemberDeleteEvent
-	86,  // 160: prehog.v1alpha.SubmitEventRequest.access_list_grants_to_user:type_name -> prehog.v1alpha.AccessListGrantsToUserEvent
-	55,  // 161: prehog.v1alpha.SubmitEventRequest.ui_discover_ec2_instance_selection:type_name -> prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent
-	56,  // 162: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_eice:type_name -> prehog.v1alpha.UIDiscoverDeployEICEEvent
-	57,  // 163: prehog.v1alpha.SubmitEventRequest.ui_discover_create_node:type_name -> prehog.v1alpha.UIDiscoverCreateNodeEvent
-	100, // 164: prehog.v1alpha.SubmitEventRequest.desktop_directory_share:type_name -> prehog.v1alpha.DesktopDirectoryShareEvent
-	101, // 165: prehog.v1alpha.SubmitEventRequest.desktop_clipboard_transfer:type_name -> prehog.v1alpha.DesktopClipboardEvent
-	102, // 166: prehog.v1alpha.SubmitEventRequest.tag_execute_query:type_name -> prehog.v1alpha.TAGExecuteQueryEvent
-	110, // 167: prehog.v1alpha.SubmitEventRequest.external_audit_storage_authenticate:type_name -> prehog.v1alpha.ExternalAuditStorageAuthenticateEvent
-	111, // 168: prehog.v1alpha.SubmitEventRequest.security_report_get_result:type_name -> prehog.v1alpha.SecurityReportGetResultEvent
-	112, // 169: prehog.v1alpha.SubmitEventRequest.audit_query_run:type_name -> prehog.v1alpha.AuditQueryRunEvent
-	113, // 170: prehog.v1alpha.SubmitEventRequest.discovery_fetch_event:type_name -> prehog.v1alpha.DiscoveryFetchEvent
-	87,  // 171: prehog.v1alpha.SubmitEventRequest.access_list_review_create:type_name -> prehog.v1alpha.AccessListReviewCreateEvent
-	88,  // 172: prehog.v1alpha.SubmitEventRequest.access_list_review_delete:type_name -> prehog.v1alpha.AccessListReviewDeleteEvent
-	89,  // 173: prehog.v1alpha.SubmitEventRequest.access_list_review_compliance:type_name -> prehog.v1alpha.AccessListReviewComplianceEvent
-	18,  // 174: prehog.v1alpha.SubmitEventRequest.mfa_authentication_event:type_name -> prehog.v1alpha.MFAAuthenticationEvent
-	29,  // 175: prehog.v1alpha.SubmitEventRequest.spiffe_svid_issued:type_name -> prehog.v1alpha.SPIFFESVIDIssuedEvent
-	114, // 176: prehog.v1alpha.SubmitEventRequest.okta_access_list_sync:type_name -> prehog.v1alpha.OktaAccessListSyncEvent
-	115, // 177: prehog.v1alpha.SubmitEventRequest.database_user_created:type_name -> prehog.v1alpha.DatabaseUserCreatedEvent
-	116, // 178: prehog.v1alpha.SubmitEventRequest.database_user_permissions_updated:type_name -> prehog.v1alpha.DatabaseUserPermissionsUpdateEvent
-	49,  // 179: prehog.v1alpha.SubmitEventRequest.ui_discover_create_discovery_config:type_name -> prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent
-	47,  // 180: prehog.v1alpha.SubmitEventRequest.ui_discover_kube_eks_enroll_event:type_name -> prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent
-	58,  // 181: prehog.v1alpha.SubmitEventRequest.ui_discover_create_app_server_event:type_name -> prehog.v1alpha.UIDiscoverCreateAppServerEvent
-	105, // 182: prehog.v1alpha.SubmitEventRequest.access_graph_gitlab_scan:type_name -> prehog.v1alpha.AccessGraphGitlabScanEvent
-	103, // 183: prehog.v1alpha.SubmitEventRequest.access_graph_secrets_scan_authorized_keys:type_name -> prehog.v1alpha.AccessGraphSecretsScanAuthorizedKeysEvent
-	104, // 184: prehog.v1alpha.SubmitEventRequest.access_graph_secrets_scan_ssh_private_keys:type_name -> prehog.v1alpha.AccessGraphSecretsScanSSHPrivateKeysEvent
-	106, // 185: prehog.v1alpha.SubmitEventRequest.access_graph_aws_scan:type_name -> prehog.v1alpha.AccessGraphAWSScanEvent
-	107, // 186: prehog.v1alpha.SubmitEventRequest.access_graph_access_path_changed:type_name -> prehog.v1alpha.AccessGraphAccessPathChangedEvent
-	109, // 187: prehog.v1alpha.SubmitEventRequest.access_graph_crown_jewel_create:type_name -> prehog.v1alpha.AccessGraphCrownJewelCreateEvent
-	108, // 188: prehog.v1alpha.SubmitEventRequest.ui_access_graph_crown_jewel_diff_view:type_name -> prehog.v1alpha.UIAccessGraphCrownJewelDiffViewEvent
-	117, // 189: prehog.v1alpha.SubmitEventRequest.session_recording_access:type_name -> prehog.v1alpha.SessionRecordingAccessEvent
-	118, // 190: prehog.v1alpha.SubmitEventRequest.user_task_state:type_name -> prehog.v1alpha.UserTaskStateEvent
-	94,  // 191: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_step_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStepEvent
-	119, // 192: prehog.v1alpha.SubmitEventRequest.access_request_create:type_name -> prehog.v1alpha.AccessRequestCreateEvent
-	120, // 193: prehog.v1alpha.SubmitEventRequest.access_request_review:type_name -> prehog.v1alpha.AccessRequestReviewEvent
-	121, // 194: prehog.v1alpha.SubmitEventsRequest.events:type_name -> prehog.v1alpha.SubmitEventRequest
-	121, // 195: prehog.v1alpha.TeleportReportingService.SubmitEvent:input_type -> prehog.v1alpha.SubmitEventRequest
-	123, // 196: prehog.v1alpha.TeleportReportingService.SubmitEvents:input_type -> prehog.v1alpha.SubmitEventsRequest
-	125, // 197: prehog.v1alpha.TeleportReportingService.HelloTeleport:input_type -> prehog.v1alpha.HelloTeleportRequest
-	122, // 198: prehog.v1alpha.TeleportReportingService.SubmitEvent:output_type -> prehog.v1alpha.SubmitEventResponse
-	124, // 199: prehog.v1alpha.TeleportReportingService.SubmitEvents:output_type -> prehog.v1alpha.SubmitEventsResponse
-	126, // 200: prehog.v1alpha.TeleportReportingService.HelloTeleport:output_type -> prehog.v1alpha.HelloTeleportResponse
-	198, // [198:201] is the sub-list for method output_type
-	195, // [195:198] is the sub-list for method input_type
-	195, // [195:195] is the sub-list for extension type_name
-	195, // [195:195] is the sub-list for extension extendee
-	0,   // [0:195] is the sub-list for field type_name
+	29,  // 6: prehog.v1alpha.SessionStartEvent.app:type_name -> prehog.v1alpha.SessionStartAppMetadata
+	30,  // 7: prehog.v1alpha.SessionStartEvent.git:type_name -> prehog.v1alpha.SessionStartGitMetadata
+	31,  // 8: prehog.v1alpha.SessionStartEvent.mcp:type_name -> prehog.v1alpha.SessionStartMCPMetadata
+	135, // 9: prehog.v1alpha.UserCertificateIssuedEvent.ttl:type_name -> google.protobuf.Duration
+	2,   // 10: prehog.v1alpha.SPIFFESVIDIssuedEvent.user_kind:type_name -> prehog.v1alpha.UserKind
+	3,   // 11: prehog.v1alpha.DiscoverResourceMetadata.resource:type_name -> prehog.v1alpha.DiscoverResource
+	4,   // 12: prehog.v1alpha.DiscoverStepStatus.status:type_name -> prehog.v1alpha.DiscoverStatus
+	44,  // 13: prehog.v1alpha.UIDiscoverStartedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	46,  // 14: prehog.v1alpha.UIDiscoverStartedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 15: prehog.v1alpha.UIDiscoverResourceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 16: prehog.v1alpha.UIDiscoverResourceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 17: prehog.v1alpha.UIDiscoverResourceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 18: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 19: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 20: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 21: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 22: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 23: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 24: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 25: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 26: prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 27: prehog.v1alpha.UIDiscoverDeployServiceEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 28: prehog.v1alpha.UIDiscoverDeployServiceEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 29: prehog.v1alpha.UIDiscoverDeployServiceEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	16,  // 30: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_method:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
+	17,  // 31: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_type:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
+	44,  // 32: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 33: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 34: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	18,  // 35: prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.config_method:type_name -> prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent.ConfigMethod
+	44,  // 36: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 37: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 38: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 39: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 40: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 41: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 42: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 43: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 44: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 45: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 46: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 47: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 48: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 49: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 50: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 51: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 52: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 53: prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 54: prehog.v1alpha.UIDiscoverDeployEICEEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 55: prehog.v1alpha.UIDiscoverDeployEICEEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 56: prehog.v1alpha.UIDiscoverDeployEICEEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 57: prehog.v1alpha.UIDiscoverCreateNodeEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 58: prehog.v1alpha.UIDiscoverCreateNodeEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 59: prehog.v1alpha.UIDiscoverCreateNodeEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 60: prehog.v1alpha.UIDiscoverCreateAppServerEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 61: prehog.v1alpha.UIDiscoverCreateAppServerEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 62: prehog.v1alpha.UIDiscoverCreateAppServerEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 63: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 64: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 65: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 66: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 67: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 68: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 69: prehog.v1alpha.UIDiscoverTestConnectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 70: prehog.v1alpha.UIDiscoverTestConnectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 71: prehog.v1alpha.UIDiscoverTestConnectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	44,  // 72: prehog.v1alpha.UIDiscoverCompletedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	45,  // 73: prehog.v1alpha.UIDiscoverCompletedEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	46,  // 74: prehog.v1alpha.UIDiscoverCompletedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	5,   // 75: prehog.v1alpha.UICallToActionClickEvent.cta:type_name -> prehog.v1alpha.CTA
+	2,   // 76: prehog.v1alpha.KubeRequestEvent.user_kind:type_name -> prehog.v1alpha.UserKind
+	2,   // 77: prehog.v1alpha.SFTPEvent.user_kind:type_name -> prehog.v1alpha.UserKind
+	83,  // 78: prehog.v1alpha.AccessListCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 79: prehog.v1alpha.AccessListUpdateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 80: prehog.v1alpha.AccessListDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 81: prehog.v1alpha.AccessListMemberCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 82: prehog.v1alpha.AccessListMemberUpdateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 83: prehog.v1alpha.AccessListMemberDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 84: prehog.v1alpha.AccessListReviewCreateEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	83,  // 85: prehog.v1alpha.AccessListReviewDeleteEvent.metadata:type_name -> prehog.v1alpha.AccessListMetadata
+	6,   // 86: prehog.v1alpha.IntegrationEnrollMetadata.kind:type_name -> prehog.v1alpha.IntegrationEnrollKind
+	94,  // 87: prehog.v1alpha.UIIntegrationEnrollStartEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	94,  // 88: prehog.v1alpha.UIIntegrationEnrollCompleteEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	8,   // 89: prehog.v1alpha.IntegrationEnrollStepStatus.code:type_name -> prehog.v1alpha.IntegrationEnrollStatusCode
+	94,  // 90: prehog.v1alpha.UIIntegrationEnrollStepEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	7,   // 91: prehog.v1alpha.UIIntegrationEnrollStepEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
+	97,  // 92: prehog.v1alpha.UIIntegrationEnrollStepEvent.status:type_name -> prehog.v1alpha.IntegrationEnrollStepStatus
+	94,  // 93: prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	7,   // 94: prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
+	9,   // 95: prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent.section:type_name -> prehog.v1alpha.IntegrationEnrollSection
+	94,  // 96: prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	7,   // 97: prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
+	10,  // 98: prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent.field:type_name -> prehog.v1alpha.IntegrationEnrollField
+	94,  // 99: prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	7,   // 100: prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
+	11,  // 101: prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent.type:type_name -> prehog.v1alpha.IntegrationEnrollCodeType
+	94,  // 102: prehog.v1alpha.UIIntegrationEnrollLinkClickEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	7,   // 103: prehog.v1alpha.UIIntegrationEnrollLinkClickEvent.step:type_name -> prehog.v1alpha.IntegrationEnrollStep
+	12,  // 104: prehog.v1alpha.EditorChangeEvent.status:type_name -> prehog.v1alpha.EditorChangeStatus
+	13,  // 105: prehog.v1alpha.FeatureRecommendationEvent.feature:type_name -> prehog.v1alpha.Feature
+	14,  // 106: prehog.v1alpha.FeatureRecommendationEvent.feature_recommendation_status:type_name -> prehog.v1alpha.FeatureRecommendationStatus
+	15,  // 107: prehog.v1alpha.LicenseLimitEvent.license_limit:type_name -> prehog.v1alpha.LicenseLimit
+	27,  // 108: prehog.v1alpha.DatabaseUserCreatedEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
+	27,  // 109: prehog.v1alpha.DatabaseUserPermissionsUpdateEvent.database:type_name -> prehog.v1alpha.SessionStartDatabaseMetadata
+	19,  // 110: prehog.v1alpha.AccessRequestReviewEvent.proposed_state:type_name -> prehog.v1alpha.AccessRequestReviewEvent.ProposedState
+	136, // 111: prehog.v1alpha.SubmitEventRequest.timestamp:type_name -> google.protobuf.Timestamp
+	20,  // 112: prehog.v1alpha.SubmitEventRequest.user_login:type_name -> prehog.v1alpha.UserLoginEvent
+	22,  // 113: prehog.v1alpha.SubmitEventRequest.sso_create:type_name -> prehog.v1alpha.SSOCreateEvent
+	23,  // 114: prehog.v1alpha.SubmitEventRequest.resource_create:type_name -> prehog.v1alpha.ResourceCreateEvent
+	26,  // 115: prehog.v1alpha.SubmitEventRequest.session_start:type_name -> prehog.v1alpha.SessionStartEvent
+	34,  // 116: prehog.v1alpha.SubmitEventRequest.ui_banner_click:type_name -> prehog.v1alpha.UIBannerClickEvent
+	35,  // 117: prehog.v1alpha.SubmitEventRequest.ui_onboard_complete_go_to_dashboard_click:type_name -> prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
+	36,  // 118: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
+	37,  // 119: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_later_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
+	38,  // 120: prehog.v1alpha.SubmitEventRequest.ui_onboard_set_credential_submit:type_name -> prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
+	39,  // 121: prehog.v1alpha.SubmitEventRequest.ui_onboard_register_challenge_submit:type_name -> prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
+	41,  // 122: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_continue_click:type_name -> prehog.v1alpha.UIRecoveryCodesContinueClickEvent
+	42,  // 123: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_copy_click:type_name -> prehog.v1alpha.UIRecoveryCodesCopyClickEvent
+	43,  // 124: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_print_click:type_name -> prehog.v1alpha.UIRecoveryCodesPrintClickEvent
+	47,  // 125: prehog.v1alpha.SubmitEventRequest.ui_discover_started_event:type_name -> prehog.v1alpha.UIDiscoverStartedEvent
+	48,  // 126: prehog.v1alpha.SubmitEventRequest.ui_discover_resource_selection_event:type_name -> prehog.v1alpha.UIDiscoverResourceSelectionEvent
+	32,  // 127: prehog.v1alpha.SubmitEventRequest.user_certificate_issued_event:type_name -> prehog.v1alpha.UserCertificateIssuedEvent
+	26,  // 128: prehog.v1alpha.SubmitEventRequest.session_start_v2:type_name -> prehog.v1alpha.SessionStartEvent
+	52,  // 129: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_service_event:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent
+	54,  // 130: prehog.v1alpha.SubmitEventRequest.ui_discover_database_register_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
+	55,  // 131: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_mtls_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
+	56,  // 132: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_tools_install_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
+	57,  // 133: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_configure_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
+	58,  // 134: prehog.v1alpha.SubmitEventRequest.ui_discover_auto_discovered_resources_event:type_name -> prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
+	63,  // 135: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_iam_policy_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
+	64,  // 136: prehog.v1alpha.SubmitEventRequest.ui_discover_principals_configure_event:type_name -> prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
+	65,  // 137: prehog.v1alpha.SubmitEventRequest.ui_discover_test_connection_event:type_name -> prehog.v1alpha.UIDiscoverTestConnectionEvent
+	66,  // 138: prehog.v1alpha.SubmitEventRequest.ui_discover_completed_event:type_name -> prehog.v1alpha.UIDiscoverCompletedEvent
+	67,  // 139: prehog.v1alpha.SubmitEventRequest.role_create:type_name -> prehog.v1alpha.RoleCreateEvent
+	70,  // 140: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_click:type_name -> prehog.v1alpha.UICreateNewRoleClickEvent
+	71,  // 141: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_save_click:type_name -> prehog.v1alpha.UICreateNewRoleSaveClickEvent
+	72,  // 142: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_cancel_click:type_name -> prehog.v1alpha.UICreateNewRoleCancelClickEvent
+	73,  // 143: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_view_documentation_click:type_name -> prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
+	75,  // 144: prehog.v1alpha.SubmitEventRequest.kube_request:type_name -> prehog.v1alpha.KubeRequestEvent
+	76,  // 145: prehog.v1alpha.SubmitEventRequest.sftp:type_name -> prehog.v1alpha.SFTPEvent
+	77,  // 146: prehog.v1alpha.SubmitEventRequest.agent_metadata_event:type_name -> prehog.v1alpha.AgentMetadataEvent
+	25,  // 147: prehog.v1alpha.SubmitEventRequest.resource_heartbeat:type_name -> prehog.v1alpha.ResourceHeartbeatEvent
+	49,  // 148: prehog.v1alpha.SubmitEventRequest.ui_discover_integration_aws_oidc_connect_event:type_name -> prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
+	50,  // 149: prehog.v1alpha.SubmitEventRequest.ui_discover_database_rds_enroll_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
+	74,  // 150: prehog.v1alpha.SubmitEventRequest.ui_call_to_action_click_event:type_name -> prehog.v1alpha.UICallToActionClickEvent
+	78,  // 151: prehog.v1alpha.SubmitEventRequest.assist_completion:type_name -> prehog.v1alpha.AssistCompletionEvent
+	95,  // 152: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_start_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStartEvent
+	96,  // 153: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_complete_event:type_name -> prehog.v1alpha.UIIntegrationEnrollCompleteEvent
+	103, // 154: prehog.v1alpha.SubmitEventRequest.editor_change_event:type_name -> prehog.v1alpha.EditorChangeEvent
+	68,  // 155: prehog.v1alpha.SubmitEventRequest.bot_create:type_name -> prehog.v1alpha.BotCreateEvent
+	40,  // 156: prehog.v1alpha.SubmitEventRequest.ui_onboard_questionnaire_submit:type_name -> prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
+	69,  // 157: prehog.v1alpha.SubmitEventRequest.bot_join:type_name -> prehog.v1alpha.BotJoinEvent
+	79,  // 158: prehog.v1alpha.SubmitEventRequest.assist_execution:type_name -> prehog.v1alpha.AssistExecutionEvent
+	80,  // 159: prehog.v1alpha.SubmitEventRequest.assist_new_conversation:type_name -> prehog.v1alpha.AssistNewConversationEvent
+	104, // 160: prehog.v1alpha.SubmitEventRequest.device_authenticate_event:type_name -> prehog.v1alpha.DeviceAuthenticateEvent
+	106, // 161: prehog.v1alpha.SubmitEventRequest.feature_recommendation_event:type_name -> prehog.v1alpha.FeatureRecommendationEvent
+	81,  // 162: prehog.v1alpha.SubmitEventRequest.assist_access_request:type_name -> prehog.v1alpha.AssistAccessRequestEvent
+	82,  // 163: prehog.v1alpha.SubmitEventRequest.assist_action:type_name -> prehog.v1alpha.AssistActionEvent
+	105, // 164: prehog.v1alpha.SubmitEventRequest.device_enroll_event:type_name -> prehog.v1alpha.DeviceEnrollEvent
+	107, // 165: prehog.v1alpha.SubmitEventRequest.license_limit_event:type_name -> prehog.v1alpha.LicenseLimitEvent
+	84,  // 166: prehog.v1alpha.SubmitEventRequest.access_list_create:type_name -> prehog.v1alpha.AccessListCreateEvent
+	85,  // 167: prehog.v1alpha.SubmitEventRequest.access_list_update:type_name -> prehog.v1alpha.AccessListUpdateEvent
+	86,  // 168: prehog.v1alpha.SubmitEventRequest.access_list_delete:type_name -> prehog.v1alpha.AccessListDeleteEvent
+	87,  // 169: prehog.v1alpha.SubmitEventRequest.access_list_member_create:type_name -> prehog.v1alpha.AccessListMemberCreateEvent
+	88,  // 170: prehog.v1alpha.SubmitEventRequest.access_list_member_update:type_name -> prehog.v1alpha.AccessListMemberUpdateEvent
+	89,  // 171: prehog.v1alpha.SubmitEventRequest.access_list_member_delete:type_name -> prehog.v1alpha.AccessListMemberDeleteEvent
+	90,  // 172: prehog.v1alpha.SubmitEventRequest.access_list_grants_to_user:type_name -> prehog.v1alpha.AccessListGrantsToUserEvent
+	59,  // 173: prehog.v1alpha.SubmitEventRequest.ui_discover_ec2_instance_selection:type_name -> prehog.v1alpha.UIDiscoverEC2InstanceSelectionEvent
+	60,  // 174: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_eice:type_name -> prehog.v1alpha.UIDiscoverDeployEICEEvent
+	61,  // 175: prehog.v1alpha.SubmitEventRequest.ui_discover_create_node:type_name -> prehog.v1alpha.UIDiscoverCreateNodeEvent
+	108, // 176: prehog.v1alpha.SubmitEventRequest.desktop_directory_share:type_name -> prehog.v1alpha.DesktopDirectoryShareEvent
+	109, // 177: prehog.v1alpha.SubmitEventRequest.desktop_clipboard_transfer:type_name -> prehog.v1alpha.DesktopClipboardEvent
+	110, // 178: prehog.v1alpha.SubmitEventRequest.tag_execute_query:type_name -> prehog.v1alpha.TAGExecuteQueryEvent
+	118, // 179: prehog.v1alpha.SubmitEventRequest.external_audit_storage_authenticate:type_name -> prehog.v1alpha.ExternalAuditStorageAuthenticateEvent
+	119, // 180: prehog.v1alpha.SubmitEventRequest.security_report_get_result:type_name -> prehog.v1alpha.SecurityReportGetResultEvent
+	120, // 181: prehog.v1alpha.SubmitEventRequest.audit_query_run:type_name -> prehog.v1alpha.AuditQueryRunEvent
+	121, // 182: prehog.v1alpha.SubmitEventRequest.discovery_fetch_event:type_name -> prehog.v1alpha.DiscoveryFetchEvent
+	91,  // 183: prehog.v1alpha.SubmitEventRequest.access_list_review_create:type_name -> prehog.v1alpha.AccessListReviewCreateEvent
+	92,  // 184: prehog.v1alpha.SubmitEventRequest.access_list_review_delete:type_name -> prehog.v1alpha.AccessListReviewDeleteEvent
+	93,  // 185: prehog.v1alpha.SubmitEventRequest.access_list_review_compliance:type_name -> prehog.v1alpha.AccessListReviewComplianceEvent
+	21,  // 186: prehog.v1alpha.SubmitEventRequest.mfa_authentication_event:type_name -> prehog.v1alpha.MFAAuthenticationEvent
+	33,  // 187: prehog.v1alpha.SubmitEventRequest.spiffe_svid_issued:type_name -> prehog.v1alpha.SPIFFESVIDIssuedEvent
+	122, // 188: prehog.v1alpha.SubmitEventRequest.okta_access_list_sync:type_name -> prehog.v1alpha.OktaAccessListSyncEvent
+	123, // 189: prehog.v1alpha.SubmitEventRequest.database_user_created:type_name -> prehog.v1alpha.DatabaseUserCreatedEvent
+	124, // 190: prehog.v1alpha.SubmitEventRequest.database_user_permissions_updated:type_name -> prehog.v1alpha.DatabaseUserPermissionsUpdateEvent
+	53,  // 191: prehog.v1alpha.SubmitEventRequest.ui_discover_create_discovery_config:type_name -> prehog.v1alpha.UIDiscoverCreateDiscoveryConfigEvent
+	51,  // 192: prehog.v1alpha.SubmitEventRequest.ui_discover_kube_eks_enroll_event:type_name -> prehog.v1alpha.UIDiscoverKubeEKSEnrollEvent
+	62,  // 193: prehog.v1alpha.SubmitEventRequest.ui_discover_create_app_server_event:type_name -> prehog.v1alpha.UIDiscoverCreateAppServerEvent
+	113, // 194: prehog.v1alpha.SubmitEventRequest.access_graph_gitlab_scan:type_name -> prehog.v1alpha.AccessGraphGitlabScanEvent
+	111, // 195: prehog.v1alpha.SubmitEventRequest.access_graph_secrets_scan_authorized_keys:type_name -> prehog.v1alpha.AccessGraphSecretsScanAuthorizedKeysEvent
+	112, // 196: prehog.v1alpha.SubmitEventRequest.access_graph_secrets_scan_ssh_private_keys:type_name -> prehog.v1alpha.AccessGraphSecretsScanSSHPrivateKeysEvent
+	114, // 197: prehog.v1alpha.SubmitEventRequest.access_graph_aws_scan:type_name -> prehog.v1alpha.AccessGraphAWSScanEvent
+	115, // 198: prehog.v1alpha.SubmitEventRequest.access_graph_access_path_changed:type_name -> prehog.v1alpha.AccessGraphAccessPathChangedEvent
+	117, // 199: prehog.v1alpha.SubmitEventRequest.access_graph_crown_jewel_create:type_name -> prehog.v1alpha.AccessGraphCrownJewelCreateEvent
+	116, // 200: prehog.v1alpha.SubmitEventRequest.ui_access_graph_crown_jewel_diff_view:type_name -> prehog.v1alpha.UIAccessGraphCrownJewelDiffViewEvent
+	125, // 201: prehog.v1alpha.SubmitEventRequest.session_recording_access:type_name -> prehog.v1alpha.SessionRecordingAccessEvent
+	126, // 202: prehog.v1alpha.SubmitEventRequest.user_task_state:type_name -> prehog.v1alpha.UserTaskStateEvent
+	98,  // 203: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_step_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStepEvent
+	127, // 204: prehog.v1alpha.SubmitEventRequest.access_request_create:type_name -> prehog.v1alpha.AccessRequestCreateEvent
+	128, // 205: prehog.v1alpha.SubmitEventRequest.access_request_review:type_name -> prehog.v1alpha.AccessRequestReviewEvent
+	99,  // 206: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_section_open_event:type_name -> prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent
+	100, // 207: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_field_complete_event:type_name -> prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent
+	101, // 208: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_code_copy_event:type_name -> prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent
+	102, // 209: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_link_click_event:type_name -> prehog.v1alpha.UIIntegrationEnrollLinkClickEvent
+	129, // 210: prehog.v1alpha.SubmitEventsRequest.events:type_name -> prehog.v1alpha.SubmitEventRequest
+	129, // 211: prehog.v1alpha.TeleportReportingService.SubmitEvent:input_type -> prehog.v1alpha.SubmitEventRequest
+	131, // 212: prehog.v1alpha.TeleportReportingService.SubmitEvents:input_type -> prehog.v1alpha.SubmitEventsRequest
+	133, // 213: prehog.v1alpha.TeleportReportingService.HelloTeleport:input_type -> prehog.v1alpha.HelloTeleportRequest
+	130, // 214: prehog.v1alpha.TeleportReportingService.SubmitEvent:output_type -> prehog.v1alpha.SubmitEventResponse
+	132, // 215: prehog.v1alpha.TeleportReportingService.SubmitEvents:output_type -> prehog.v1alpha.SubmitEventsResponse
+	134, // 216: prehog.v1alpha.TeleportReportingService.HelloTeleport:output_type -> prehog.v1alpha.HelloTeleportResponse
+	214, // [214:217] is the sub-list for method output_type
+	211, // [211:214] is the sub-list for method input_type
+	211, // [211:211] is the sub-list for extension type_name
+	211, // [211:211] is the sub-list for extension extendee
+	0,   // [0:211] is the sub-list for field type_name
 }
 
 func init() { file_prehog_v1alpha_teleport_proto_init() }
@@ -11070,7 +11807,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 	if File_prehog_v1alpha_teleport_proto != nil {
 		return
 	}
-	file_prehog_v1alpha_teleport_proto_msgTypes[104].OneofWrappers = []any{
+	file_prehog_v1alpha_teleport_proto_msgTypes[109].OneofWrappers = []any{
 		(*SubmitEventRequest_UserLogin)(nil),
 		(*SubmitEventRequest_SsoCreate)(nil),
 		(*SubmitEventRequest_ResourceCreate)(nil),
@@ -11165,14 +11902,18 @@ func file_prehog_v1alpha_teleport_proto_init() {
 		(*SubmitEventRequest_UiIntegrationEnrollStepEvent)(nil),
 		(*SubmitEventRequest_AccessRequestCreate)(nil),
 		(*SubmitEventRequest_AccessRequestReview)(nil),
+		(*SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent)(nil),
+		(*SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent)(nil),
+		(*SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent)(nil),
+		(*SubmitEventRequest_UiIntegrationEnrollLinkClickEvent)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_prehog_v1alpha_teleport_proto_rawDesc), len(file_prehog_v1alpha_teleport_proto_rawDesc)),
-			NumEnums:      17,
-			NumMessages:   110,
+			NumEnums:      20,
+			NumMessages:   115,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service.pb.go b/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service.pb.go
new file mode 100644
index 0000000000000..c7cd15987f907
--- /dev/null
+++ b/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service.pb.go
@@ -0,0 +1,423 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/lib/teleterm/auto_update/v1/auto_update_service.proto
+
+package auto_updatev1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for GetClusterVersions.
+type GetClusterVersionsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetClusterVersionsRequest) Reset() {
+	*x = GetClusterVersionsRequest{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetClusterVersionsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetClusterVersionsRequest) ProtoMessage() {}
+
+func (x *GetClusterVersionsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetClusterVersionsRequest.ProtoReflect.Descriptor instead.
+func (*GetClusterVersionsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{0}
+}
+
+// Response for GetClusterVersions.
+type GetClusterVersionsResponse struct {
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	ReachableClusters   []*ClusterVersionInfo  `protobuf:"bytes,1,rep,name=reachable_clusters,json=reachableClusters,proto3" json:"reachable_clusters,omitempty"`
+	UnreachableClusters []*UnreachableCluster  `protobuf:"bytes,2,rep,name=unreachable_clusters,json=unreachableClusters,proto3" json:"unreachable_clusters,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *GetClusterVersionsResponse) Reset() {
+	*x = GetClusterVersionsResponse{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetClusterVersionsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetClusterVersionsResponse) ProtoMessage() {}
+
+func (x *GetClusterVersionsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetClusterVersionsResponse.ProtoReflect.Descriptor instead.
+func (*GetClusterVersionsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetClusterVersionsResponse) GetReachableClusters() []*ClusterVersionInfo {
+	if x != nil {
+		return x.ReachableClusters
+	}
+	return nil
+}
+
+func (x *GetClusterVersionsResponse) GetUnreachableClusters() []*UnreachableCluster {
+	if x != nil {
+		return x.UnreachableClusters
+	}
+	return nil
+}
+
+// ClusterVersionInfo contains tool version information for a reachable cluster.
+type ClusterVersionInfo struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// URI of the cluster.
+	ClusterUri string `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	// Whether the client should automatically update the tools version.
+	ToolsAutoUpdate bool `protobuf:"varint,2,opt,name=tools_auto_update,json=toolsAutoUpdate,proto3" json:"tools_auto_update,omitempty"`
+	// Tools version required by this cluster.
+	ToolsVersion string `protobuf:"bytes,3,opt,name=tools_version,json=toolsVersion,proto3" json:"tools_version,omitempty"`
+	// Minimum tools version allowed by this cluster.
+	MinToolsVersion string `protobuf:"bytes,4,opt,name=min_tools_version,json=minToolsVersion,proto3" json:"min_tools_version,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *ClusterVersionInfo) Reset() {
+	*x = ClusterVersionInfo{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClusterVersionInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterVersionInfo) ProtoMessage() {}
+
+func (x *ClusterVersionInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterVersionInfo.ProtoReflect.Descriptor instead.
+func (*ClusterVersionInfo) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ClusterVersionInfo) GetClusterUri() string {
+	if x != nil {
+		return x.ClusterUri
+	}
+	return ""
+}
+
+func (x *ClusterVersionInfo) GetToolsAutoUpdate() bool {
+	if x != nil {
+		return x.ToolsAutoUpdate
+	}
+	return false
+}
+
+func (x *ClusterVersionInfo) GetToolsVersion() string {
+	if x != nil {
+		return x.ToolsVersion
+	}
+	return ""
+}
+
+func (x *ClusterVersionInfo) GetMinToolsVersion() string {
+	if x != nil {
+		return x.MinToolsVersion
+	}
+	return ""
+}
+
+// UnreachableCluster represents a cluster from which version information could not be retrieved.
+type UnreachableCluster struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// URI of the cluster.
+	ClusterUri string `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	// Error that occurred while retrieving version information.
+	ErrorMessage  string `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UnreachableCluster) Reset() {
+	*x = UnreachableCluster{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UnreachableCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UnreachableCluster) ProtoMessage() {}
+
+func (x *UnreachableCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UnreachableCluster.ProtoReflect.Descriptor instead.
+func (*UnreachableCluster) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UnreachableCluster) GetClusterUri() string {
+	if x != nil {
+		return x.ClusterUri
+	}
+	return ""
+}
+
+func (x *UnreachableCluster) GetErrorMessage() string {
+	if x != nil {
+		return x.ErrorMessage
+	}
+	return ""
+}
+
+// Request for GetDownloadBaseUrl.
+type GetDownloadBaseUrlRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetDownloadBaseUrlRequest) Reset() {
+	*x = GetDownloadBaseUrlRequest{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetDownloadBaseUrlRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDownloadBaseUrlRequest) ProtoMessage() {}
+
+func (x *GetDownloadBaseUrlRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDownloadBaseUrlRequest.ProtoReflect.Descriptor instead.
+func (*GetDownloadBaseUrlRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{4}
+}
+
+// Response for GetDownloadBaseUrl.
+type GetDownloadBaseUrlResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	BaseUrl       string                 `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetDownloadBaseUrlResponse) Reset() {
+	*x = GetDownloadBaseUrlResponse{}
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetDownloadBaseUrlResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDownloadBaseUrlResponse) ProtoMessage() {}
+
+func (x *GetDownloadBaseUrlResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDownloadBaseUrlResponse.ProtoReflect.Descriptor instead.
+func (*GetDownloadBaseUrlResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *GetDownloadBaseUrlResponse) GetBaseUrl() string {
+	if x != nil {
+		return x.BaseUrl
+	}
+	return ""
+}
+
+var File_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto protoreflect.FileDescriptor
+
+const file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDesc = "" +
+	"\n" +
+	">teleport/lib/teleterm/auto_update/v1/auto_update_service.proto\x12$teleport.lib.teleterm.auto_update.v1\"\x1b\n" +
+	"\x19GetClusterVersionsRequest\"\xf2\x01\n" +
+	"\x1aGetClusterVersionsResponse\x12g\n" +
+	"\x12reachable_clusters\x18\x01 \x03(\v28.teleport.lib.teleterm.auto_update.v1.ClusterVersionInfoR\x11reachableClusters\x12k\n" +
+	"\x14unreachable_clusters\x18\x02 \x03(\v28.teleport.lib.teleterm.auto_update.v1.UnreachableClusterR\x13unreachableClusters\"\xb2\x01\n" +
+	"\x12ClusterVersionInfo\x12\x1f\n" +
+	"\vcluster_uri\x18\x01 \x01(\tR\n" +
+	"clusterUri\x12*\n" +
+	"\x11tools_auto_update\x18\x02 \x01(\bR\x0ftoolsAutoUpdate\x12#\n" +
+	"\rtools_version\x18\x03 \x01(\tR\ftoolsVersion\x12*\n" +
+	"\x11min_tools_version\x18\x04 \x01(\tR\x0fminToolsVersion\"Z\n" +
+	"\x12UnreachableCluster\x12\x1f\n" +
+	"\vcluster_uri\x18\x01 \x01(\tR\n" +
+	"clusterUri\x12#\n" +
+	"\rerror_message\x18\x02 \x01(\tR\ferrorMessage\"\x1b\n" +
+	"\x19GetDownloadBaseUrlRequest\"7\n" +
+	"\x1aGetDownloadBaseUrlResponse\x12\x19\n" +
+	"\bbase_url\x18\x01 \x01(\tR\abaseUrl2\xc7\x02\n" +
+	"\x11AutoUpdateService\x12\x97\x01\n" +
+	"\x12GetClusterVersions\x12?.teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest\x1a@.teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse\x12\x97\x01\n" +
+	"\x12GetDownloadBaseUrl\x12?.teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest\x1a@.teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponseBcZagithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/auto_update/v1;auto_updatev1b\x06proto3"
+
+var (
+	file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescOnce sync.Once
+	file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescData []byte
+)
+
+func file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescGZIP() []byte {
+	file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescOnce.Do(func() {
+		file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDesc), len(file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDesc)))
+	})
+	return file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDescData
+}
+
+var file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_goTypes = []any{
+	(*GetClusterVersionsRequest)(nil),  // 0: teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest
+	(*GetClusterVersionsResponse)(nil), // 1: teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse
+	(*ClusterVersionInfo)(nil),         // 2: teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo
+	(*UnreachableCluster)(nil),         // 3: teleport.lib.teleterm.auto_update.v1.UnreachableCluster
+	(*GetDownloadBaseUrlRequest)(nil),  // 4: teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest
+	(*GetDownloadBaseUrlResponse)(nil), // 5: teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse
+}
+var file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_depIdxs = []int32{
+	2, // 0: teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse.reachable_clusters:type_name -> teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo
+	3, // 1: teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse.unreachable_clusters:type_name -> teleport.lib.teleterm.auto_update.v1.UnreachableCluster
+	0, // 2: teleport.lib.teleterm.auto_update.v1.AutoUpdateService.GetClusterVersions:input_type -> teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest
+	4, // 3: teleport.lib.teleterm.auto_update.v1.AutoUpdateService.GetDownloadBaseUrl:input_type -> teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest
+	1, // 4: teleport.lib.teleterm.auto_update.v1.AutoUpdateService.GetClusterVersions:output_type -> teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse
+	5, // 5: teleport.lib.teleterm.auto_update.v1.AutoUpdateService.GetDownloadBaseUrl:output_type -> teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse
+	4, // [4:6] is the sub-list for method output_type
+	2, // [2:4] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_init() }
+func file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_init() {
+	if File_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDesc), len(file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_goTypes,
+		DependencyIndexes: file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_depIdxs,
+		MessageInfos:      file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_msgTypes,
+	}.Build()
+	File_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto = out.File
+	file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_goTypes = nil
+	file_teleport_lib_teleterm_auto_update_v1_auto_update_service_proto_depIdxs = nil
+}
diff --git a/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service_grpc.pb.go
new file mode 100644
index 0000000000000..a178f81d09a3a
--- /dev/null
+++ b/gen/proto/go/teleport/lib/teleterm/auto_update/v1/auto_update_service_grpc.pb.go
@@ -0,0 +1,187 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/lib/teleterm/auto_update/v1/auto_update_service.proto
+
+package auto_updatev1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AutoUpdateService_GetClusterVersions_FullMethodName = "/teleport.lib.teleterm.auto_update.v1.AutoUpdateService/GetClusterVersions"
+	AutoUpdateService_GetDownloadBaseUrl_FullMethodName = "/teleport.lib.teleterm.auto_update.v1.AutoUpdateService/GetDownloadBaseUrl"
+)
+
+// AutoUpdateServiceClient is the client API for AutoUpdateService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AutoUpdateService provides access to information about client tools updates.
+type AutoUpdateServiceClient interface {
+	// GetClusterVersions returns client tools versions for all clusters.
+	GetClusterVersions(ctx context.Context, in *GetClusterVersionsRequest, opts ...grpc.CallOption) (*GetClusterVersionsResponse, error)
+	// GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+	// Can be overridden with TELEPORT_CDN_BASE_URL env var.
+	// OSS builds require this env var to be set, otherwise an error is returned.
+	GetDownloadBaseUrl(ctx context.Context, in *GetDownloadBaseUrlRequest, opts ...grpc.CallOption) (*GetDownloadBaseUrlResponse, error)
+}
+
+type autoUpdateServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAutoUpdateServiceClient(cc grpc.ClientConnInterface) AutoUpdateServiceClient {
+	return &autoUpdateServiceClient{cc}
+}
+
+func (c *autoUpdateServiceClient) GetClusterVersions(ctx context.Context, in *GetClusterVersionsRequest, opts ...grpc.CallOption) (*GetClusterVersionsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetClusterVersionsResponse)
+	err := c.cc.Invoke(ctx, AutoUpdateService_GetClusterVersions_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *autoUpdateServiceClient) GetDownloadBaseUrl(ctx context.Context, in *GetDownloadBaseUrlRequest, opts ...grpc.CallOption) (*GetDownloadBaseUrlResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetDownloadBaseUrlResponse)
+	err := c.cc.Invoke(ctx, AutoUpdateService_GetDownloadBaseUrl_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AutoUpdateServiceServer is the server API for AutoUpdateService service.
+// All implementations must embed UnimplementedAutoUpdateServiceServer
+// for forward compatibility.
+//
+// AutoUpdateService provides access to information about client tools updates.
+type AutoUpdateServiceServer interface {
+	// GetClusterVersions returns client tools versions for all clusters.
+	GetClusterVersions(context.Context, *GetClusterVersionsRequest) (*GetClusterVersionsResponse, error)
+	// GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+	// Can be overridden with TELEPORT_CDN_BASE_URL env var.
+	// OSS builds require this env var to be set, otherwise an error is returned.
+	GetDownloadBaseUrl(context.Context, *GetDownloadBaseUrlRequest) (*GetDownloadBaseUrlResponse, error)
+	mustEmbedUnimplementedAutoUpdateServiceServer()
+}
+
+// UnimplementedAutoUpdateServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAutoUpdateServiceServer struct{}
+
+func (UnimplementedAutoUpdateServiceServer) GetClusterVersions(context.Context, *GetClusterVersionsRequest) (*GetClusterVersionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetClusterVersions not implemented")
+}
+func (UnimplementedAutoUpdateServiceServer) GetDownloadBaseUrl(context.Context, *GetDownloadBaseUrlRequest) (*GetDownloadBaseUrlResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetDownloadBaseUrl not implemented")
+}
+func (UnimplementedAutoUpdateServiceServer) mustEmbedUnimplementedAutoUpdateServiceServer() {}
+func (UnimplementedAutoUpdateServiceServer) testEmbeddedByValue()                           {}
+
+// UnsafeAutoUpdateServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AutoUpdateServiceServer will
+// result in compilation errors.
+type UnsafeAutoUpdateServiceServer interface {
+	mustEmbedUnimplementedAutoUpdateServiceServer()
+}
+
+func RegisterAutoUpdateServiceServer(s grpc.ServiceRegistrar, srv AutoUpdateServiceServer) {
+	// If the following call pancis, it indicates UnimplementedAutoUpdateServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&AutoUpdateService_ServiceDesc, srv)
+}
+
+func _AutoUpdateService_GetClusterVersions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetClusterVersionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AutoUpdateServiceServer).GetClusterVersions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AutoUpdateService_GetClusterVersions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AutoUpdateServiceServer).GetClusterVersions(ctx, req.(*GetClusterVersionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AutoUpdateService_GetDownloadBaseUrl_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetDownloadBaseUrlRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AutoUpdateServiceServer).GetDownloadBaseUrl(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AutoUpdateService_GetDownloadBaseUrl_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AutoUpdateServiceServer).GetDownloadBaseUrl(ctx, req.(*GetDownloadBaseUrlRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AutoUpdateService_ServiceDesc is the grpc.ServiceDesc for AutoUpdateService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AutoUpdateService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.lib.teleterm.auto_update.v1.AutoUpdateService",
+	HandlerType: (*AutoUpdateServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetClusterVersions",
+			Handler:    _AutoUpdateService_GetClusterVersions_Handler,
+		},
+		{
+			MethodName: "GetDownloadBaseUrl",
+			Handler:    _AutoUpdateService_GetDownloadBaseUrl_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/lib/teleterm/auto_update/v1/auto_update_service.proto",
+}
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
index 0310c21698c49..fc3fb77f799b9 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/access_request.proto
 
@@ -56,10 +56,8 @@ type AccessRequest struct {
 	SuggestedReviewers []string               `protobuf:"bytes,10,rep,name=suggested_reviewers,json=suggestedReviewers,proto3" json:"suggested_reviewers,omitempty"`
 	// thresholds specifies minimum amount of approvers or deniers. Defaults to 'default'
 	ThresholdNames []string `protobuf:"bytes,11,rep,name=threshold_names,json=thresholdNames,proto3" json:"threshold_names,omitempty"`
-	// TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-	// a list of resourceIDs requested in the AccessRequest
-	ResourceIds []*ResourceID `protobuf:"bytes,12,rep,name=resource_ids,json=resourceIds,proto3" json:"resource_ids,omitempty"`
-	Resources   []*Resource   `protobuf:"bytes,13,rep,name=resources,proto3" json:"resources,omitempty"`
+	// List of requested resources.
+	Resources []*Resource `protobuf:"bytes,13,rep,name=resources,proto3" json:"resources,omitempty"`
 	// promoted_access_list_title is the title of the access
 	// list that this access request was promoted to.
 	PromotedAccessListTitle string `protobuf:"bytes,14,opt,name=promoted_access_list_title,json=promotedAccessListTitle,proto3" json:"promoted_access_list_title,omitempty"`
@@ -71,7 +69,13 @@ type AccessRequest struct {
 	// approval).
 	RequestTtl *timestamppb.Timestamp `protobuf:"bytes,17,opt,name=request_ttl,json=requestTtl,proto3" json:"request_ttl,omitempty"`
 	// session_ttl indicates how long a certificate for a session should be valid for.
-	SessionTtl    *timestamppb.Timestamp `protobuf:"bytes,18,opt,name=session_ttl,json=sessionTtl,proto3" json:"session_ttl,omitempty"`
+	SessionTtl *timestamppb.Timestamp `protobuf:"bytes,18,opt,name=session_ttl,json=sessionTtl,proto3" json:"session_ttl,omitempty"`
+	// reason_mode specifies the reason mode for this Access Request. It can be either "optional" or
+	// "required". It's only added in response to a dry run request.
+	ReasonMode string `protobuf:"bytes,19,opt,name=reason_mode,json=reasonMode,proto3" json:"reason_mode,omitempty"`
+	// reason_prompts is a sorted and deduplicated list of reason prompts for this Access Request.
+	// It's only added in response to a dry run request.
+	ReasonPrompts []string `protobuf:"bytes,20,rep,name=reason_prompts,json=reasonPrompts,proto3" json:"reason_prompts,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -183,13 +187,6 @@ func (x *AccessRequest) GetThresholdNames() []string {
 	return nil
 }
 
-func (x *AccessRequest) GetResourceIds() []*ResourceID {
-	if x != nil {
-		return x.ResourceIds
-	}
-	return nil
-}
-
 func (x *AccessRequest) GetResources() []*Resource {
 	if x != nil {
 		return x.Resources
@@ -232,6 +229,20 @@ func (x *AccessRequest) GetSessionTtl() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *AccessRequest) GetReasonMode() string {
+	if x != nil {
+		return x.ReasonMode
+	}
+	return ""
+}
+
+func (x *AccessRequest) GetReasonPrompts() []string {
+	if x != nil {
+		return x.ReasonPrompts
+	}
+	return nil
+}
+
 type AccessRequestReview struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// author is the creator of the AccessRequestReview.
@@ -508,7 +519,7 @@ var File_teleport_lib_teleterm_v1_access_request_proto protoreflect.FileDescript
 
 const file_teleport_lib_teleterm_v1_access_request_proto_rawDesc = "" +
 	"\n" +
-	"-teleport/lib/teleterm/v1/access_request.proto\x12\x18teleport.lib.teleterm.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x85\a\n" +
+	"-teleport/lib/teleterm/v1/access_request.proto\x12\x18teleport.lib.teleterm.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x98\a\n" +
 	"\rAccessRequest\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x14\n" +
 	"\x05state\x18\x02 \x01(\tR\x05state\x12%\n" +
@@ -521,8 +532,7 @@ const file_teleport_lib_teleterm_v1_access_request_proto_rawDesc = "" +
 	"\areviews\x18\t \x03(\v2-.teleport.lib.teleterm.v1.AccessRequestReviewR\areviews\x12/\n" +
 	"\x13suggested_reviewers\x18\n" +
 	" \x03(\tR\x12suggestedReviewers\x12'\n" +
-	"\x0fthreshold_names\x18\v \x03(\tR\x0ethresholdNames\x12G\n" +
-	"\fresource_ids\x18\f \x03(\v2$.teleport.lib.teleterm.v1.ResourceIDR\vresourceIds\x12@\n" +
+	"\x0fthreshold_names\x18\v \x03(\tR\x0ethresholdNames\x12@\n" +
 	"\tresources\x18\r \x03(\v2\".teleport.lib.teleterm.v1.ResourceR\tresources\x12;\n" +
 	"\x1apromoted_access_list_title\x18\x0e \x01(\tR\x17promotedAccessListTitle\x12F\n" +
 	"\x11assume_start_time\x18\x0f \x01(\v2\x1a.google.protobuf.TimestampR\x0fassumeStartTime\x12=\n" +
@@ -530,7 +540,10 @@ const file_teleport_lib_teleterm_v1_access_request_proto_rawDesc = "" +
 	"\vrequest_ttl\x18\x11 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
 	"requestTtl\x12;\n" +
 	"\vsession_ttl\x18\x12 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
-	"sessionTtl\"\xac\x02\n" +
+	"sessionTtl\x12\x1f\n" +
+	"\vreason_mode\x18\x13 \x01(\tR\n" +
+	"reasonMode\x12%\n" +
+	"\x0ereason_prompts\x18\x14 \x03(\tR\rreasonPromptsJ\x04\b\f\x10\rR\fresource_ids\"\xac\x02\n" +
 	"\x13AccessRequestReview\x12\x16\n" +
 	"\x06author\x18\x01 \x01(\tR\x06author\x12\x14\n" +
 	"\x05roles\x18\x02 \x03(\tR\x05roles\x12\x14\n" +
@@ -577,21 +590,20 @@ var file_teleport_lib_teleterm_v1_access_request_proto_depIdxs = []int32{
 	5,  // 0: teleport.lib.teleterm.v1.AccessRequest.created:type_name -> google.protobuf.Timestamp
 	5,  // 1: teleport.lib.teleterm.v1.AccessRequest.expires:type_name -> google.protobuf.Timestamp
 	1,  // 2: teleport.lib.teleterm.v1.AccessRequest.reviews:type_name -> teleport.lib.teleterm.v1.AccessRequestReview
-	2,  // 3: teleport.lib.teleterm.v1.AccessRequest.resource_ids:type_name -> teleport.lib.teleterm.v1.ResourceID
-	4,  // 4: teleport.lib.teleterm.v1.AccessRequest.resources:type_name -> teleport.lib.teleterm.v1.Resource
-	5,  // 5: teleport.lib.teleterm.v1.AccessRequest.assume_start_time:type_name -> google.protobuf.Timestamp
-	5,  // 6: teleport.lib.teleterm.v1.AccessRequest.max_duration:type_name -> google.protobuf.Timestamp
-	5,  // 7: teleport.lib.teleterm.v1.AccessRequest.request_ttl:type_name -> google.protobuf.Timestamp
-	5,  // 8: teleport.lib.teleterm.v1.AccessRequest.session_ttl:type_name -> google.protobuf.Timestamp
-	5,  // 9: teleport.lib.teleterm.v1.AccessRequestReview.created:type_name -> google.protobuf.Timestamp
-	5,  // 10: teleport.lib.teleterm.v1.AccessRequestReview.assume_start_time:type_name -> google.protobuf.Timestamp
-	2,  // 11: teleport.lib.teleterm.v1.Resource.id:type_name -> teleport.lib.teleterm.v1.ResourceID
-	3,  // 12: teleport.lib.teleterm.v1.Resource.details:type_name -> teleport.lib.teleterm.v1.ResourceDetails
-	13, // [13:13] is the sub-list for method output_type
-	13, // [13:13] is the sub-list for method input_type
-	13, // [13:13] is the sub-list for extension type_name
-	13, // [13:13] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	4,  // 3: teleport.lib.teleterm.v1.AccessRequest.resources:type_name -> teleport.lib.teleterm.v1.Resource
+	5,  // 4: teleport.lib.teleterm.v1.AccessRequest.assume_start_time:type_name -> google.protobuf.Timestamp
+	5,  // 5: teleport.lib.teleterm.v1.AccessRequest.max_duration:type_name -> google.protobuf.Timestamp
+	5,  // 6: teleport.lib.teleterm.v1.AccessRequest.request_ttl:type_name -> google.protobuf.Timestamp
+	5,  // 7: teleport.lib.teleterm.v1.AccessRequest.session_ttl:type_name -> google.protobuf.Timestamp
+	5,  // 8: teleport.lib.teleterm.v1.AccessRequestReview.created:type_name -> google.protobuf.Timestamp
+	5,  // 9: teleport.lib.teleterm.v1.AccessRequestReview.assume_start_time:type_name -> google.protobuf.Timestamp
+	2,  // 10: teleport.lib.teleterm.v1.Resource.id:type_name -> teleport.lib.teleterm.v1.ResourceID
+	3,  // 11: teleport.lib.teleterm.v1.Resource.details:type_name -> teleport.lib.teleterm.v1.ResourceDetails
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_access_request_proto_init() }
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/app.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/app.pb.go
index d52615bedbe0d..18d5ebe1ae0b2 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/app.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/app.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/app.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/auth_settings.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/auth_settings.pb.go
index d386875a87536..1a74dd1aa2967 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/auth_settings.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/auth_settings.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/auth_settings.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
index dff14826744e9..9183e559219e2 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/cluster.proto
 
@@ -27,6 +27,7 @@ import (
 	types "github.com/gravitational/teleport/api/types"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
@@ -151,7 +152,9 @@ type Cluster struct {
 	// For leaf clusters, it has the form of /clusters/:rootClusterId/leaves/:leafClusterId where
 	// leafClusterId is equal to the name property of the cluster.
 	Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
-	// name is used throughout the Teleport Connect codebase as the cluster name.
+	// name is the site name of Teleport cluster.
+	// Only present in root clusters if the user has logged in (the name comes from the certificate).
+	// Always available for leaf clusters.
 	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// proxy_host is address of the proxy used to connect to this cluster.
 	// Always includes port number. Present only for root clusters.
@@ -310,8 +313,6 @@ type LoggedInUser struct {
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 	// roles is the user roles
 	Roles []string `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
-	// ssh_logins is the user ssh logins
-	SshLogins []string `protobuf:"bytes,3,rep,name=ssh_logins,json=sshLogins,proto3" json:"ssh_logins,omitempty"`
 	// acl is a user access control list.
 	// It is available only after the cluster details are fetched, as it is not stored on disk.
 	Acl *ACL `protobuf:"bytes,4,opt,name=acl,proto3" json:"acl,omitempty"`
@@ -328,8 +329,10 @@ type LoggedInUser struct {
 	IsDeviceTrusted bool `protobuf:"varint,9,opt,name=is_device_trusted,json=isDeviceTrusted,proto3" json:"is_device_trusted,omitempty"`
 	// Indicates whether access may be hindered by the lack of a trusted device.
 	TrustedDeviceRequirement types.TrustedDeviceRequirement `protobuf:"varint,10,opt,name=trusted_device_requirement,json=trustedDeviceRequirement,proto3,enum=types.TrustedDeviceRequirement" json:"trusted_device_requirement,omitempty"`
-	unknownFields            protoimpl.UnknownFields
-	sizeCache                protoimpl.SizeCache
+	// Expiration time of the certificate.
+	ValidUntil    *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=valid_until,json=validUntil,proto3" json:"valid_until,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LoggedInUser) Reset() {
@@ -376,13 +379,6 @@ func (x *LoggedInUser) GetRoles() []string {
 	return nil
 }
 
-func (x *LoggedInUser) GetSshLogins() []string {
-	if x != nil {
-		return x.SshLogins
-	}
-	return nil
-}
-
 func (x *LoggedInUser) GetAcl() *ACL {
 	if x != nil {
 		return x.Acl
@@ -432,6 +428,13 @@ func (x *LoggedInUser) GetTrustedDeviceRequirement() types.TrustedDeviceRequirem
 	return types.TrustedDeviceRequirement(0)
 }
 
+func (x *LoggedInUser) GetValidUntil() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ValidUntil
+	}
+	return nil
+}
+
 // ACL is the access control list of the user
 type ACL struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -763,7 +766,7 @@ var File_teleport_lib_teleterm_v1_cluster_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_v1_cluster_proto_rawDesc = "" +
 	"\n" +
-	"&teleport/lib/teleterm/v1/cluster.proto\x12\x18teleport.lib.teleterm.v1\x1a6teleport/legacy/types/trusted_device_requirement.proto\"\xf8\x03\n" +
+	"&teleport/lib/teleterm/v1/cluster.proto\x12\x18teleport.lib.teleterm.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a6teleport/legacy/types/trusted_device_requirement.proto\"\xf8\x03\n" +
 	"\aCluster\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12\x1d\n" +
@@ -778,12 +781,10 @@ const file_teleport_lib_teleterm_v1_cluster_proto_rawDesc = "" +
 	" \x01(\tR\fproxyVersion\x12N\n" +
 	"\x0eshow_resources\x18\v \x01(\x0e2'.teleport.lib.teleterm.v1.ShowResourcesR\rshowResources\x120\n" +
 	"\x14profile_status_error\x18\f \x01(\tR\x12profileStatusError\x12\x19\n" +
-	"\bsso_host\x18\r \x01(\tR\assoHost\"\xb7\x04\n" +
+	"\bsso_host\x18\r \x01(\tR\assoHost\"\xe7\x04\n" +
 	"\fLoggedInUser\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n" +
-	"\x05roles\x18\x02 \x03(\tR\x05roles\x12\x1d\n" +
-	"\n" +
-	"ssh_logins\x18\x03 \x03(\tR\tsshLogins\x12/\n" +
+	"\x05roles\x18\x02 \x03(\tR\x05roles\x12/\n" +
 	"\x03acl\x18\x04 \x01(\v2\x1d.teleport.lib.teleterm.v1.ACLR\x03acl\x12'\n" +
 	"\x0factive_requests\x18\x05 \x03(\tR\x0eactiveRequests\x12/\n" +
 	"\x13suggested_reviewers\x18\x06 \x03(\tR\x12suggestedReviewers\x12+\n" +
@@ -791,11 +792,14 @@ const file_teleport_lib_teleterm_v1_cluster_proto_rawDesc = "" +
 	"\tuser_type\x18\b \x01(\x0e2/.teleport.lib.teleterm.v1.LoggedInUser.UserTypeR\buserType\x12*\n" +
 	"\x11is_device_trusted\x18\t \x01(\bR\x0fisDeviceTrusted\x12]\n" +
 	"\x1atrusted_device_requirement\x18\n" +
-	" \x01(\x0e2\x1f.types.TrustedDeviceRequirementR\x18trustedDeviceRequirement\"M\n" +
+	" \x01(\x0e2\x1f.types.TrustedDeviceRequirementR\x18trustedDeviceRequirement\x12;\n" +
+	"\vvalid_until\x18\v \x01(\v2\x1a.google.protobuf.TimestampR\n" +
+	"validUntil\"M\n" +
 	"\bUserType\x12\x19\n" +
 	"\x15USER_TYPE_UNSPECIFIED\x10\x00\x12\x13\n" +
 	"\x0fUSER_TYPE_LOCAL\x10\x01\x12\x11\n" +
-	"\rUSER_TYPE_SSO\x10\x02\"\xe9\b\n" +
+	"\rUSER_TYPE_SSO\x10\x02J\x04\b\x03\x10\x04R\n" +
+	"ssh_logins\"\xe9\b\n" +
 	"\x03ACL\x12Q\n" +
 	"\x0fauth_connectors\x18\x02 \x01(\v2(.teleport.lib.teleterm.v1.ResourceAccessR\x0eauthConnectors\x12>\n" +
 	"\x05roles\x18\x03 \x01(\v2(.teleport.lib.teleterm.v1.ResourceAccessR\x05roles\x12>\n" +
@@ -852,6 +856,7 @@ var file_teleport_lib_teleterm_v1_cluster_proto_goTypes = []any{
 	(*ResourceAccess)(nil),              // 5: teleport.lib.teleterm.v1.ResourceAccess
 	(*Features)(nil),                    // 6: teleport.lib.teleterm.v1.Features
 	(types.TrustedDeviceRequirement)(0), // 7: types.TrustedDeviceRequirement
+	(*timestamppb.Timestamp)(nil),       // 8: google.protobuf.Timestamp
 }
 var file_teleport_lib_teleterm_v1_cluster_proto_depIdxs = []int32{
 	3,  // 0: teleport.lib.teleterm.v1.Cluster.logged_in_user:type_name -> teleport.lib.teleterm.v1.LoggedInUser
@@ -860,24 +865,25 @@ var file_teleport_lib_teleterm_v1_cluster_proto_depIdxs = []int32{
 	4,  // 3: teleport.lib.teleterm.v1.LoggedInUser.acl:type_name -> teleport.lib.teleterm.v1.ACL
 	1,  // 4: teleport.lib.teleterm.v1.LoggedInUser.user_type:type_name -> teleport.lib.teleterm.v1.LoggedInUser.UserType
 	7,  // 5: teleport.lib.teleterm.v1.LoggedInUser.trusted_device_requirement:type_name -> types.TrustedDeviceRequirement
-	5,  // 6: teleport.lib.teleterm.v1.ACL.auth_connectors:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 7: teleport.lib.teleterm.v1.ACL.roles:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 8: teleport.lib.teleterm.v1.ACL.users:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 9: teleport.lib.teleterm.v1.ACL.trusted_clusters:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 10: teleport.lib.teleterm.v1.ACL.events:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 11: teleport.lib.teleterm.v1.ACL.tokens:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 12: teleport.lib.teleterm.v1.ACL.servers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 13: teleport.lib.teleterm.v1.ACL.apps:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 14: teleport.lib.teleterm.v1.ACL.dbs:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 15: teleport.lib.teleterm.v1.ACL.kubeservers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 16: teleport.lib.teleterm.v1.ACL.access_requests:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 17: teleport.lib.teleterm.v1.ACL.recorded_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	5,  // 18: teleport.lib.teleterm.v1.ACL.active_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	19, // [19:19] is the sub-list for method output_type
-	19, // [19:19] is the sub-list for method input_type
-	19, // [19:19] is the sub-list for extension type_name
-	19, // [19:19] is the sub-list for extension extendee
-	0,  // [0:19] is the sub-list for field type_name
+	8,  // 6: teleport.lib.teleterm.v1.LoggedInUser.valid_until:type_name -> google.protobuf.Timestamp
+	5,  // 7: teleport.lib.teleterm.v1.ACL.auth_connectors:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 8: teleport.lib.teleterm.v1.ACL.roles:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 9: teleport.lib.teleterm.v1.ACL.users:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 10: teleport.lib.teleterm.v1.ACL.trusted_clusters:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 11: teleport.lib.teleterm.v1.ACL.events:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 12: teleport.lib.teleterm.v1.ACL.tokens:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 13: teleport.lib.teleterm.v1.ACL.servers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 14: teleport.lib.teleterm.v1.ACL.apps:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 15: teleport.lib.teleterm.v1.ACL.dbs:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 16: teleport.lib.teleterm.v1.ACL.kubeservers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 17: teleport.lib.teleterm.v1.ACL.access_requests:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 18: teleport.lib.teleterm.v1.ACL.recorded_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	5,  // 19: teleport.lib.teleterm.v1.ACL.active_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	20, // [20:20] is the sub-list for method output_type
+	20, // [20:20] is the sub-list for method input_type
+	20, // [20:20] is the sub-list for extension type_name
+	20, // [20:20] is the sub-list for extension extendee
+	0,  // [0:20] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_cluster_proto_init() }
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/database.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/database.pb.go
index 694b1e76fad9c..4b8ab7ea050e8 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/database.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/database.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/database.proto
 
@@ -58,7 +58,9 @@ type Database struct {
 	// labels is a list of labels for this database
 	Labels []*Label `protobuf:"bytes,8,rep,name=labels,proto3" json:"labels,omitempty"`
 	// target_health of the "db_server" that is serving this database.
-	TargetHealth  *TargetHealth `protobuf:"bytes,9,opt,name=target_health,json=targetHealth,proto3" json:"target_health,omitempty"`
+	TargetHealth *TargetHealth `protobuf:"bytes,9,opt,name=target_health,json=targetHealth,proto3" json:"target_health,omitempty"`
+	// gcp_project_id is optional project ID set for GCP Project databases.
+	GcpProjectId  string `protobuf:"bytes,10,opt,name=gcp_project_id,json=gcpProjectId,proto3" json:"gcp_project_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -156,6 +158,13 @@ func (x *Database) GetTargetHealth() *TargetHealth {
 	return nil
 }
 
+func (x *Database) GetGcpProjectId() string {
+	if x != nil {
+		return x.GcpProjectId
+	}
+	return ""
+}
+
 // DatabaseServer (db_server) describes a database heartbeat signal
 // reported from an agent (db_service) that is proxying
 // the database.
@@ -231,7 +240,7 @@ var File_teleport_lib_teleterm_v1_database_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_v1_database_proto_rawDesc = "" +
 	"\n" +
-	"'teleport/lib/teleterm/v1/database.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\x1a,teleport/lib/teleterm/v1/target_health.proto\"\xaa\x02\n" +
+	"'teleport/lib/teleterm/v1/database.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\x1a,teleport/lib/teleterm/v1/target_health.proto\"\xd0\x02\n" +
 	"\bDatabase\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12\x12\n" +
@@ -241,7 +250,9 @@ const file_teleport_lib_teleterm_v1_database_proto_rawDesc = "" +
 	"\bhostname\x18\x06 \x01(\tR\bhostname\x12\x12\n" +
 	"\x04addr\x18\a \x01(\tR\x04addr\x127\n" +
 	"\x06labels\x18\b \x03(\v2\x1f.teleport.lib.teleterm.v1.LabelR\x06labels\x12K\n" +
-	"\rtarget_health\x18\t \x01(\v2&.teleport.lib.teleterm.v1.TargetHealthR\ftargetHealth\"\xa4\x01\n" +
+	"\rtarget_health\x18\t \x01(\v2&.teleport.lib.teleterm.v1.TargetHealthR\ftargetHealth\x12$\n" +
+	"\x0egcp_project_id\x18\n" +
+	" \x01(\tR\fgcpProjectId\"\xa4\x01\n" +
 	"\x0eDatabaseServer\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x1a\n" +
 	"\bhostname\x18\x02 \x01(\tR\bhostname\x12\x17\n" +
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/gateway.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/gateway.pb.go
index 647cd1248a435..9ee4f85505015 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/gateway.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/gateway.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/gateway.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/kube.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/kube.pb.go
index b5fc5f41cd323..c620472f3673a 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/kube.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/kube.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/kube.proto
 
@@ -46,7 +46,9 @@ type Kube struct {
 	// name is the kube name
 	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// labels is the kube labels
-	Labels        []*Label `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty"`
+	Labels []*Label `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty"`
+	// target_health is the health of the kube cluster
+	TargetHealth  *TargetHealth `protobuf:"bytes,4,opt,name=target_health,json=targetHealth,proto3" json:"target_health,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -102,6 +104,13 @@ func (x *Kube) GetLabels() []*Label {
 	return nil
 }
 
+func (x *Kube) GetTargetHealth() *TargetHealth {
+	if x != nil {
+		return x.TargetHealth
+	}
+	return nil
+}
+
 // KubeResource describes a kube_cluster's subresource eg: pods, namespaces, etc.
 type KubeResource struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -196,22 +205,100 @@ func (x *KubeResource) GetNamespace() string {
 	return ""
 }
 
+// KubeServer (kube_server) describes a Kube heartbeat signal
+// reported from an agent (kubernetes_service) that is proxying
+// the Kubernetes cluster.
+type KubeServer struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Uri           string                 `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
+	Hostname      string                 `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	HostId        string                 `protobuf:"bytes,3,opt,name=host_id,json=hostId,proto3" json:"host_id,omitempty"`
+	TargetHealth  *TargetHealth          `protobuf:"bytes,4,opt,name=target_health,json=targetHealth,proto3" json:"target_health,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KubeServer) Reset() {
+	*x = KubeServer{}
+	mi := &file_teleport_lib_teleterm_v1_kube_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KubeServer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeServer) ProtoMessage() {}
+
+func (x *KubeServer) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_v1_kube_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeServer.ProtoReflect.Descriptor instead.
+func (*KubeServer) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_v1_kube_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *KubeServer) GetUri() string {
+	if x != nil {
+		return x.Uri
+	}
+	return ""
+}
+
+func (x *KubeServer) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *KubeServer) GetHostId() string {
+	if x != nil {
+		return x.HostId
+	}
+	return ""
+}
+
+func (x *KubeServer) GetTargetHealth() *TargetHealth {
+	if x != nil {
+		return x.TargetHealth
+	}
+	return nil
+}
+
 var File_teleport_lib_teleterm_v1_kube_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_v1_kube_proto_rawDesc = "" +
 	"\n" +
-	"#teleport/lib/teleterm/v1/kube.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\"e\n" +
+	"#teleport/lib/teleterm/v1/kube.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\x1a,teleport/lib/teleterm/v1/target_health.proto\"\xb2\x01\n" +
 	"\x04Kube\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x127\n" +
-	"\x06labels\x18\x03 \x03(\v2\x1f.teleport.lib.teleterm.v1.LabelR\x06labels\"\xb9\x01\n" +
+	"\x06labels\x18\x03 \x03(\v2\x1f.teleport.lib.teleterm.v1.LabelR\x06labels\x12K\n" +
+	"\rtarget_health\x18\x04 \x01(\v2&.teleport.lib.teleterm.v1.TargetHealthR\ftargetHealth\"\xb9\x01\n" +
 	"\fKubeResource\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x12\n" +
 	"\x04kind\x18\x02 \x01(\tR\x04kind\x12\x12\n" +
 	"\x04name\x18\x03 \x01(\tR\x04name\x127\n" +
 	"\x06labels\x18\x04 \x03(\v2\x1f.teleport.lib.teleterm.v1.LabelR\x06labels\x12\x18\n" +
 	"\acluster\x18\x05 \x01(\tR\acluster\x12\x1c\n" +
-	"\tnamespace\x18\x06 \x01(\tR\tnamespaceBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
+	"\tnamespace\x18\x06 \x01(\tR\tnamespace\"\xa0\x01\n" +
+	"\n" +
+	"KubeServer\x12\x10\n" +
+	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x1a\n" +
+	"\bhostname\x18\x02 \x01(\tR\bhostname\x12\x17\n" +
+	"\ahost_id\x18\x03 \x01(\tR\x06hostId\x12K\n" +
+	"\rtarget_health\x18\x04 \x01(\v2&.teleport.lib.teleterm.v1.TargetHealthR\ftargetHealthBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
 
 var (
 	file_teleport_lib_teleterm_v1_kube_proto_rawDescOnce sync.Once
@@ -225,20 +312,24 @@ func file_teleport_lib_teleterm_v1_kube_proto_rawDescGZIP() []byte {
 	return file_teleport_lib_teleterm_v1_kube_proto_rawDescData
 }
 
-var file_teleport_lib_teleterm_v1_kube_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_lib_teleterm_v1_kube_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
 var file_teleport_lib_teleterm_v1_kube_proto_goTypes = []any{
 	(*Kube)(nil),         // 0: teleport.lib.teleterm.v1.Kube
 	(*KubeResource)(nil), // 1: teleport.lib.teleterm.v1.KubeResource
-	(*Label)(nil),        // 2: teleport.lib.teleterm.v1.Label
+	(*KubeServer)(nil),   // 2: teleport.lib.teleterm.v1.KubeServer
+	(*Label)(nil),        // 3: teleport.lib.teleterm.v1.Label
+	(*TargetHealth)(nil), // 4: teleport.lib.teleterm.v1.TargetHealth
 }
 var file_teleport_lib_teleterm_v1_kube_proto_depIdxs = []int32{
-	2, // 0: teleport.lib.teleterm.v1.Kube.labels:type_name -> teleport.lib.teleterm.v1.Label
-	2, // 1: teleport.lib.teleterm.v1.KubeResource.labels:type_name -> teleport.lib.teleterm.v1.Label
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	3, // 0: teleport.lib.teleterm.v1.Kube.labels:type_name -> teleport.lib.teleterm.v1.Label
+	4, // 1: teleport.lib.teleterm.v1.Kube.target_health:type_name -> teleport.lib.teleterm.v1.TargetHealth
+	3, // 2: teleport.lib.teleterm.v1.KubeResource.labels:type_name -> teleport.lib.teleterm.v1.Label
+	4, // 3: teleport.lib.teleterm.v1.KubeServer.target_health:type_name -> teleport.lib.teleterm.v1.TargetHealth
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_kube_proto_init() }
@@ -247,13 +338,14 @@ func file_teleport_lib_teleterm_v1_kube_proto_init() {
 		return
 	}
 	file_teleport_lib_teleterm_v1_label_proto_init()
+	file_teleport_lib_teleterm_v1_target_health_proto_init()
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_teleterm_v1_kube_proto_rawDesc), len(file_teleport_lib_teleterm_v1_kube_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   3,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/label.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/label.pb.go
index 8741a97c8f191..a87ae9cf7d457 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/label.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/label.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/label.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/server.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/server.pb.go
index 6e394e7245ef4..1d180734c72b8 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/server.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/server.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/server.proto
 
@@ -54,7 +54,9 @@ type Server struct {
 	// labels is this server list of labels
 	Labels []*Label `protobuf:"bytes,6,rep,name=labels,proto3" json:"labels,omitempty"`
 	// node sub kind: teleport, openssh, openssh-ec2-ice
-	SubKind       string `protobuf:"bytes,7,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	SubKind string `protobuf:"bytes,7,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Subset of logins allowed by the certificate and RBAC rules.
+	Logins        []string `protobuf:"bytes,8,rep,name=logins,proto3" json:"logins,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -138,11 +140,18 @@ func (x *Server) GetSubKind() string {
 	return ""
 }
 
+func (x *Server) GetLogins() []string {
+	if x != nil {
+		return x.Logins
+	}
+	return nil
+}
+
 var File_teleport_lib_teleterm_v1_server_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_v1_server_proto_rawDesc = "" +
 	"\n" +
-	"%teleport/lib/teleterm/v1/server.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\"\xca\x01\n" +
+	"%teleport/lib/teleterm/v1/server.proto\x12\x18teleport.lib.teleterm.v1\x1a$teleport/lib/teleterm/v1/label.proto\"\xe2\x01\n" +
 	"\x06Server\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12\x16\n" +
 	"\x06tunnel\x18\x02 \x01(\bR\x06tunnel\x12\x12\n" +
@@ -150,7 +159,8 @@ const file_teleport_lib_teleterm_v1_server_proto_rawDesc = "" +
 	"\bhostname\x18\x04 \x01(\tR\bhostname\x12\x12\n" +
 	"\x04addr\x18\x05 \x01(\tR\x04addr\x127\n" +
 	"\x06labels\x18\x06 \x03(\v2\x1f.teleport.lib.teleterm.v1.LabelR\x06labels\x12\x19\n" +
-	"\bsub_kind\x18\a \x01(\tR\asubKindBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
+	"\bsub_kind\x18\a \x01(\tR\asubKind\x12\x16\n" +
+	"\x06logins\x18\b \x03(\tR\x06loginsBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
 
 var (
 	file_teleport_lib_teleterm_v1_server_proto_rawDescOnce sync.Once
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/service.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/service.pb.go
index 5a50ad6e3022c..7703b7d64d913 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/service.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/service.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/service.proto
 
@@ -239,28 +239,28 @@ func (*EmptyResponse) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{0}
 }
 
-// RemoveClusterRequest describes RemoveClusterRequest
-type RemoveClusterRequest struct {
+// GetClusterRequest describes GetClusterRequest
+type GetClusterRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	ClusterUri    string                 `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RemoveClusterRequest) Reset() {
-	*x = RemoveClusterRequest{}
+func (x *GetClusterRequest) Reset() {
+	*x = GetClusterRequest{}
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *RemoveClusterRequest) String() string {
+func (x *GetClusterRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RemoveClusterRequest) ProtoMessage() {}
+func (*GetClusterRequest) ProtoMessage() {}
 
-func (x *RemoveClusterRequest) ProtoReflect() protoreflect.Message {
+func (x *GetClusterRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -272,40 +272,41 @@ func (x *RemoveClusterRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RemoveClusterRequest.ProtoReflect.Descriptor instead.
-func (*RemoveClusterRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetClusterRequest.ProtoReflect.Descriptor instead.
+func (*GetClusterRequest) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{1}
 }
 
-func (x *RemoveClusterRequest) GetClusterUri() string {
+func (x *GetClusterRequest) GetClusterUri() string {
 	if x != nil {
 		return x.ClusterUri
 	}
 	return ""
 }
 
-// GetClusterRequest describes GetClusterRequest
-type GetClusterRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	ClusterUri    string                 `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+type LogoutRequest struct {
+	state      protoimpl.MessageState `protogen:"open.v1"`
+	ClusterUri string                 `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	// Whether to remove the associated YAML profile after logout.
+	RemoveProfile bool `protobuf:"varint,2,opt,name=remove_profile,json=removeProfile,proto3" json:"remove_profile,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *GetClusterRequest) Reset() {
-	*x = GetClusterRequest{}
+func (x *LogoutRequest) Reset() {
+	*x = LogoutRequest{}
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *GetClusterRequest) String() string {
+func (x *LogoutRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetClusterRequest) ProtoMessage() {}
+func (*LogoutRequest) ProtoMessage() {}
 
-func (x *GetClusterRequest) ProtoReflect() protoreflect.Message {
+func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -317,40 +318,46 @@ func (x *GetClusterRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetClusterRequest.ProtoReflect.Descriptor instead.
-func (*GetClusterRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
+func (*LogoutRequest) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *GetClusterRequest) GetClusterUri() string {
+func (x *LogoutRequest) GetClusterUri() string {
 	if x != nil {
 		return x.ClusterUri
 	}
 	return ""
 }
 
-// LogoutRequest describes LogoutRequest
-type LogoutRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	ClusterUri    string                 `protobuf:"bytes,1,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+func (x *LogoutRequest) GetRemoveProfile() bool {
+	if x != nil {
+		return x.RemoveProfile
+	}
+	return false
 }
 
-func (x *LogoutRequest) Reset() {
-	*x = LogoutRequest{}
+type ClearStaleClusterClientsRequest struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	RootClusterUri string                 `protobuf:"bytes,1,opt,name=root_cluster_uri,json=rootClusterUri,proto3" json:"root_cluster_uri,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *ClearStaleClusterClientsRequest) Reset() {
+	*x = ClearStaleClusterClientsRequest{}
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *LogoutRequest) String() string {
+func (x *ClearStaleClusterClientsRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*LogoutRequest) ProtoMessage() {}
+func (*ClearStaleClusterClientsRequest) ProtoMessage() {}
 
-func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
+func (x *ClearStaleClusterClientsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -362,18 +369,54 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
-func (*LogoutRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use ClearStaleClusterClientsRequest.ProtoReflect.Descriptor instead.
+func (*ClearStaleClusterClientsRequest) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *LogoutRequest) GetClusterUri() string {
+func (x *ClearStaleClusterClientsRequest) GetRootClusterUri() string {
 	if x != nil {
-		return x.ClusterUri
+		return x.RootClusterUri
 	}
 	return ""
 }
 
+type ClearStaleClusterClientsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClearStaleClusterClientsResponse) Reset() {
+	*x = ClearStaleClusterClientsResponse{}
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClearStaleClusterClientsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClearStaleClusterClientsResponse) ProtoMessage() {}
+
+func (x *ClearStaleClusterClientsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClearStaleClusterClientsResponse.ProtoReflect.Descriptor instead.
+func (*ClearStaleClusterClientsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{4}
+}
+
 type StartHeadlessWatcherRequest struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
 	RootClusterUri string                 `protobuf:"bytes,1,opt,name=root_cluster_uri,json=rootClusterUri,proto3" json:"root_cluster_uri,omitempty"`
@@ -383,7 +426,7 @@ type StartHeadlessWatcherRequest struct {
 
 func (x *StartHeadlessWatcherRequest) Reset() {
 	*x = StartHeadlessWatcherRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[4]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -395,7 +438,7 @@ func (x *StartHeadlessWatcherRequest) String() string {
 func (*StartHeadlessWatcherRequest) ProtoMessage() {}
 
 func (x *StartHeadlessWatcherRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[4]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -408,7 +451,7 @@ func (x *StartHeadlessWatcherRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartHeadlessWatcherRequest.ProtoReflect.Descriptor instead.
 func (*StartHeadlessWatcherRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{4}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *StartHeadlessWatcherRequest) GetRootClusterUri() string {
@@ -426,7 +469,7 @@ type StartHeadlessWatcherResponse struct {
 
 func (x *StartHeadlessWatcherResponse) Reset() {
 	*x = StartHeadlessWatcherResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[5]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -438,7 +481,7 @@ func (x *StartHeadlessWatcherResponse) String() string {
 func (*StartHeadlessWatcherResponse) ProtoMessage() {}
 
 func (x *StartHeadlessWatcherResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[5]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -451,7 +494,7 @@ func (x *StartHeadlessWatcherResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartHeadlessWatcherResponse.ProtoReflect.Descriptor instead.
 func (*StartHeadlessWatcherResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{5}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{6}
 }
 
 type GetAccessRequestRequest struct {
@@ -465,7 +508,7 @@ type GetAccessRequestRequest struct {
 
 func (x *GetAccessRequestRequest) Reset() {
 	*x = GetAccessRequestRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[6]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -477,7 +520,7 @@ func (x *GetAccessRequestRequest) String() string {
 func (*GetAccessRequestRequest) ProtoMessage() {}
 
 func (x *GetAccessRequestRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[6]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -490,7 +533,7 @@ func (x *GetAccessRequestRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessRequestRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessRequestRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{6}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *GetAccessRequestRequest) GetClusterUri() string {
@@ -517,7 +560,7 @@ type GetAccessRequestsRequest struct {
 
 func (x *GetAccessRequestsRequest) Reset() {
 	*x = GetAccessRequestsRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[7]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -529,7 +572,7 @@ func (x *GetAccessRequestsRequest) String() string {
 func (*GetAccessRequestsRequest) ProtoMessage() {}
 
 func (x *GetAccessRequestsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[7]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -542,7 +585,7 @@ func (x *GetAccessRequestsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessRequestsRequest.ProtoReflect.Descriptor instead.
 func (*GetAccessRequestsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{7}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *GetAccessRequestsRequest) GetClusterUri() string {
@@ -561,7 +604,7 @@ type GetAccessRequestResponse struct {
 
 func (x *GetAccessRequestResponse) Reset() {
 	*x = GetAccessRequestResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[8]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -573,7 +616,7 @@ func (x *GetAccessRequestResponse) String() string {
 func (*GetAccessRequestResponse) ProtoMessage() {}
 
 func (x *GetAccessRequestResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[8]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -586,7 +629,7 @@ func (x *GetAccessRequestResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessRequestResponse.ProtoReflect.Descriptor instead.
 func (*GetAccessRequestResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{8}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *GetAccessRequestResponse) GetRequest() *AccessRequest {
@@ -605,7 +648,7 @@ type GetAccessRequestsResponse struct {
 
 func (x *GetAccessRequestsResponse) Reset() {
 	*x = GetAccessRequestsResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[9]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -617,7 +660,7 @@ func (x *GetAccessRequestsResponse) String() string {
 func (*GetAccessRequestsResponse) ProtoMessage() {}
 
 func (x *GetAccessRequestsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[9]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -630,7 +673,7 @@ func (x *GetAccessRequestsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAccessRequestsResponse.ProtoReflect.Descriptor instead.
 func (*GetAccessRequestsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{9}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *GetAccessRequestsResponse) GetRequests() []*AccessRequest {
@@ -650,7 +693,7 @@ type DeleteAccessRequestRequest struct {
 
 func (x *DeleteAccessRequestRequest) Reset() {
 	*x = DeleteAccessRequestRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[10]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -662,7 +705,7 @@ func (x *DeleteAccessRequestRequest) String() string {
 func (*DeleteAccessRequestRequest) ProtoMessage() {}
 
 func (x *DeleteAccessRequestRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[10]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -675,7 +718,7 @@ func (x *DeleteAccessRequestRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteAccessRequestRequest.ProtoReflect.Descriptor instead.
 func (*DeleteAccessRequestRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{10}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *DeleteAccessRequestRequest) GetRootClusterUri() string {
@@ -700,8 +743,7 @@ type CreateAccessRequestRequest struct {
 	Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
 	// suggested_reviewers is a suggested list of reviewers that can review a request.
 	SuggestedReviewers []string `protobuf:"bytes,4,rep,name=suggested_reviewers,json=suggestedReviewers,proto3" json:"suggested_reviewers,omitempty"`
-	// TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-	// a list of resourceIDs requested in the AccessRequest
+	// List of resources to which access is being requested.
 	ResourceIds []*ResourceID `protobuf:"bytes,5,rep,name=resource_ids,json=resourceIds,proto3" json:"resource_ids,omitempty"`
 	// assume_start_time is the time after which the requested access can be assumed.
 	AssumeStartTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=assume_start_time,json=assumeStartTime,proto3" json:"assume_start_time,omitempty"`
@@ -719,7 +761,7 @@ type CreateAccessRequestRequest struct {
 
 func (x *CreateAccessRequestRequest) Reset() {
 	*x = CreateAccessRequestRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[11]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -731,7 +773,7 @@ func (x *CreateAccessRequestRequest) String() string {
 func (*CreateAccessRequestRequest) ProtoMessage() {}
 
 func (x *CreateAccessRequestRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[11]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -744,7 +786,7 @@ func (x *CreateAccessRequestRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateAccessRequestRequest.ProtoReflect.Descriptor instead.
 func (*CreateAccessRequestRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{11}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *CreateAccessRequestRequest) GetRootClusterUri() string {
@@ -819,7 +861,7 @@ type CreateAccessRequestResponse struct {
 
 func (x *CreateAccessRequestResponse) Reset() {
 	*x = CreateAccessRequestResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[12]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -831,7 +873,7 @@ func (x *CreateAccessRequestResponse) String() string {
 func (*CreateAccessRequestResponse) ProtoMessage() {}
 
 func (x *CreateAccessRequestResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[12]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -844,7 +886,7 @@ func (x *CreateAccessRequestResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateAccessRequestResponse.ProtoReflect.Descriptor instead.
 func (*CreateAccessRequestResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{12}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *CreateAccessRequestResponse) GetRequest() *AccessRequest {
@@ -865,7 +907,7 @@ type AssumeRoleRequest struct {
 
 func (x *AssumeRoleRequest) Reset() {
 	*x = AssumeRoleRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[13]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -877,7 +919,7 @@ func (x *AssumeRoleRequest) String() string {
 func (*AssumeRoleRequest) ProtoMessage() {}
 
 func (x *AssumeRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[13]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -890,7 +932,7 @@ func (x *AssumeRoleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssumeRoleRequest.ProtoReflect.Descriptor instead.
 func (*AssumeRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{13}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *AssumeRoleRequest) GetRootClusterUri() string {
@@ -924,7 +966,7 @@ type GetRequestableRolesRequest struct {
 
 func (x *GetRequestableRolesRequest) Reset() {
 	*x = GetRequestableRolesRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[14]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -936,7 +978,7 @@ func (x *GetRequestableRolesRequest) String() string {
 func (*GetRequestableRolesRequest) ProtoMessage() {}
 
 func (x *GetRequestableRolesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[14]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -949,7 +991,7 @@ func (x *GetRequestableRolesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetRequestableRolesRequest.ProtoReflect.Descriptor instead.
 func (*GetRequestableRolesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{14}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *GetRequestableRolesRequest) GetClusterUri() string {
@@ -976,7 +1018,7 @@ type GetRequestableRolesResponse struct {
 
 func (x *GetRequestableRolesResponse) Reset() {
 	*x = GetRequestableRolesResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[15]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -988,7 +1030,7 @@ func (x *GetRequestableRolesResponse) String() string {
 func (*GetRequestableRolesResponse) ProtoMessage() {}
 
 func (x *GetRequestableRolesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[15]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1001,7 +1043,7 @@ func (x *GetRequestableRolesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetRequestableRolesResponse.ProtoReflect.Descriptor instead.
 func (*GetRequestableRolesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{15}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *GetRequestableRolesResponse) GetRoles() []string {
@@ -1033,7 +1075,7 @@ type ReviewAccessRequestRequest struct {
 
 func (x *ReviewAccessRequestRequest) Reset() {
 	*x = ReviewAccessRequestRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[16]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1045,7 +1087,7 @@ func (x *ReviewAccessRequestRequest) String() string {
 func (*ReviewAccessRequestRequest) ProtoMessage() {}
 
 func (x *ReviewAccessRequestRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[16]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1058,7 +1100,7 @@ func (x *ReviewAccessRequestRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewAccessRequestRequest.ProtoReflect.Descriptor instead.
 func (*ReviewAccessRequestRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{16}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *ReviewAccessRequestRequest) GetRootClusterUri() string {
@@ -1112,7 +1154,7 @@ type ReviewAccessRequestResponse struct {
 
 func (x *ReviewAccessRequestResponse) Reset() {
 	*x = ReviewAccessRequestResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[17]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1124,7 +1166,7 @@ func (x *ReviewAccessRequestResponse) String() string {
 func (*ReviewAccessRequestResponse) ProtoMessage() {}
 
 func (x *ReviewAccessRequestResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[17]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1137,7 +1179,7 @@ func (x *ReviewAccessRequestResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewAccessRequestResponse.ProtoReflect.Descriptor instead.
 func (*ReviewAccessRequestResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{17}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ReviewAccessRequestResponse) GetRequest() *AccessRequest {
@@ -1159,7 +1201,7 @@ type PromoteAccessRequestRequest struct {
 
 func (x *PromoteAccessRequestRequest) Reset() {
 	*x = PromoteAccessRequestRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1171,7 +1213,7 @@ func (x *PromoteAccessRequestRequest) String() string {
 func (*PromoteAccessRequestRequest) ProtoMessage() {}
 
 func (x *PromoteAccessRequestRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1184,7 +1226,7 @@ func (x *PromoteAccessRequestRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromoteAccessRequestRequest.ProtoReflect.Descriptor instead.
 func (*PromoteAccessRequestRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{18}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *PromoteAccessRequestRequest) GetRootClusterUri() string {
@@ -1224,7 +1266,7 @@ type PromoteAccessRequestResponse struct {
 
 func (x *PromoteAccessRequestResponse) Reset() {
 	*x = PromoteAccessRequestResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[19]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1236,7 +1278,7 @@ func (x *PromoteAccessRequestResponse) String() string {
 func (*PromoteAccessRequestResponse) ProtoMessage() {}
 
 func (x *PromoteAccessRequestResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[19]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1249,7 +1291,7 @@ func (x *PromoteAccessRequestResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromoteAccessRequestResponse.ProtoReflect.Descriptor instead.
 func (*PromoteAccessRequestResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{19}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *PromoteAccessRequestResponse) GetRequest() *AccessRequest {
@@ -1269,7 +1311,7 @@ type GetSuggestedAccessListsRequest struct {
 
 func (x *GetSuggestedAccessListsRequest) Reset() {
 	*x = GetSuggestedAccessListsRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[20]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1281,7 +1323,7 @@ func (x *GetSuggestedAccessListsRequest) String() string {
 func (*GetSuggestedAccessListsRequest) ProtoMessage() {}
 
 func (x *GetSuggestedAccessListsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[20]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1294,7 +1336,7 @@ func (x *GetSuggestedAccessListsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSuggestedAccessListsRequest.ProtoReflect.Descriptor instead.
 func (*GetSuggestedAccessListsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{20}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *GetSuggestedAccessListsRequest) GetRootClusterUri() string {
@@ -1320,7 +1362,7 @@ type GetSuggestedAccessListsResponse struct {
 
 func (x *GetSuggestedAccessListsResponse) Reset() {
 	*x = GetSuggestedAccessListsResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1332,7 +1374,7 @@ func (x *GetSuggestedAccessListsResponse) String() string {
 func (*GetSuggestedAccessListsResponse) ProtoMessage() {}
 
 func (x *GetSuggestedAccessListsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1345,7 +1387,7 @@ func (x *GetSuggestedAccessListsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSuggestedAccessListsResponse.ProtoReflect.Descriptor instead.
 func (*GetSuggestedAccessListsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{21}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *GetSuggestedAccessListsResponse) GetAccessLists() []*v1.AccessList {
@@ -1384,7 +1426,7 @@ type ListKubernetesResourcesRequest struct {
 
 func (x *ListKubernetesResourcesRequest) Reset() {
 	*x = ListKubernetesResourcesRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1396,7 +1438,7 @@ func (x *ListKubernetesResourcesRequest) String() string {
 func (*ListKubernetesResourcesRequest) ProtoMessage() {}
 
 func (x *ListKubernetesResourcesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1409,7 +1451,7 @@ func (x *ListKubernetesResourcesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListKubernetesResourcesRequest.ProtoReflect.Descriptor instead.
 func (*ListKubernetesResourcesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{22}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *ListKubernetesResourcesRequest) GetClusterUri() string {
@@ -1484,7 +1526,7 @@ type ListKubernetesResourcesResponse struct {
 
 func (x *ListKubernetesResourcesResponse) Reset() {
 	*x = ListKubernetesResourcesResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1496,7 +1538,7 @@ func (x *ListKubernetesResourcesResponse) String() string {
 func (*ListKubernetesResourcesResponse) ProtoMessage() {}
 
 func (x *ListKubernetesResourcesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1509,7 +1551,7 @@ func (x *ListKubernetesResourcesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListKubernetesResourcesResponse.ProtoReflect.Descriptor instead.
 func (*ListKubernetesResourcesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{23}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *ListKubernetesResourcesResponse) GetResources() []*KubeResource {
@@ -1519,6 +1561,134 @@ func (x *ListKubernetesResourcesResponse) GetResources() []*KubeResource {
 	return nil
 }
 
+// Lists Kubernetes servers request.
+type ListKubernetesServersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Maximum number of servers to return per page.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// Pagination token from a previous response.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// Target Kubernetes cluster URI.
+	ClusterUri string `protobuf:"bytes,3,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	// Additional filters and sorting options.
+	Params        *ListResourcesParams `protobuf:"bytes,4,opt,name=params,proto3" json:"params,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListKubernetesServersRequest) Reset() {
+	*x = ListKubernetesServersRequest{}
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListKubernetesServersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListKubernetesServersRequest) ProtoMessage() {}
+
+func (x *ListKubernetesServersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListKubernetesServersRequest.ProtoReflect.Descriptor instead.
+func (*ListKubernetesServersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *ListKubernetesServersRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListKubernetesServersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListKubernetesServersRequest) GetClusterUri() string {
+	if x != nil {
+		return x.ClusterUri
+	}
+	return ""
+}
+
+func (x *ListKubernetesServersRequest) GetParams() *ListResourcesParams {
+	if x != nil {
+		return x.Params
+	}
+	return nil
+}
+
+// Lists Kubernetes servers response.
+type ListKubernetesServersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Resources in this page of results.
+	Resources []*KubeServer `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
+	// Pagination token for the next page.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListKubernetesServersResponse) Reset() {
+	*x = ListKubernetesServersResponse{}
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListKubernetesServersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListKubernetesServersResponse) ProtoMessage() {}
+
+func (x *ListKubernetesServersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListKubernetesServersResponse.ProtoReflect.Descriptor instead.
+func (*ListKubernetesServersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *ListKubernetesServersResponse) GetResources() []*KubeServer {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *ListKubernetesServersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 // CredentialInfo holds fields related to a user's WebAuthn credential.
 type CredentialInfo struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -1529,7 +1699,7 @@ type CredentialInfo struct {
 
 func (x *CredentialInfo) Reset() {
 	*x = CredentialInfo{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1541,7 +1711,7 @@ func (x *CredentialInfo) String() string {
 func (*CredentialInfo) ProtoMessage() {}
 
 func (x *CredentialInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1554,7 +1724,7 @@ func (x *CredentialInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialInfo.ProtoReflect.Descriptor instead.
 func (*CredentialInfo) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{24}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *CredentialInfo) GetUsername() string {
@@ -1576,7 +1746,7 @@ type LoginPasswordlessResponse struct {
 
 func (x *LoginPasswordlessResponse) Reset() {
 	*x = LoginPasswordlessResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[25]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1588,7 +1758,7 @@ func (x *LoginPasswordlessResponse) String() string {
 func (*LoginPasswordlessResponse) ProtoMessage() {}
 
 func (x *LoginPasswordlessResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[25]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1601,7 +1771,7 @@ func (x *LoginPasswordlessResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginPasswordlessResponse.ProtoReflect.Descriptor instead.
 func (*LoginPasswordlessResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{25}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *LoginPasswordlessResponse) GetPrompt() PasswordlessPrompt {
@@ -1633,7 +1803,7 @@ type LoginPasswordlessRequest struct {
 
 func (x *LoginPasswordlessRequest) Reset() {
 	*x = LoginPasswordlessRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[26]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1645,7 +1815,7 @@ func (x *LoginPasswordlessRequest) String() string {
 func (*LoginPasswordlessRequest) ProtoMessage() {}
 
 func (x *LoginPasswordlessRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[26]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1658,7 +1828,7 @@ func (x *LoginPasswordlessRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginPasswordlessRequest.ProtoReflect.Descriptor instead.
 func (*LoginPasswordlessRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{26}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *LoginPasswordlessRequest) GetRequest() isLoginPasswordlessRequest_Request {
@@ -1734,7 +1904,7 @@ type FileTransferRequest struct {
 
 func (x *FileTransferRequest) Reset() {
 	*x = FileTransferRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[27]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1746,7 +1916,7 @@ func (x *FileTransferRequest) String() string {
 func (*FileTransferRequest) ProtoMessage() {}
 
 func (x *FileTransferRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[27]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1759,7 +1929,7 @@ func (x *FileTransferRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FileTransferRequest.ProtoReflect.Descriptor instead.
 func (*FileTransferRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{27}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *FileTransferRequest) GetLogin() string {
@@ -1806,7 +1976,7 @@ type FileTransferProgress struct {
 
 func (x *FileTransferProgress) Reset() {
 	*x = FileTransferProgress{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[28]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1818,7 +1988,7 @@ func (x *FileTransferProgress) String() string {
 func (*FileTransferProgress) ProtoMessage() {}
 
 func (x *FileTransferProgress) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[28]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1831,7 +2001,7 @@ func (x *FileTransferProgress) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FileTransferProgress.ProtoReflect.Descriptor instead.
 func (*FileTransferProgress) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{28}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *FileTransferProgress) GetPercentage() uint32 {
@@ -1857,7 +2027,7 @@ type LoginRequest struct {
 
 func (x *LoginRequest) Reset() {
 	*x = LoginRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[29]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1869,7 +2039,7 @@ func (x *LoginRequest) String() string {
 func (*LoginRequest) ProtoMessage() {}
 
 func (x *LoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[29]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1882,7 +2052,7 @@ func (x *LoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginRequest.ProtoReflect.Descriptor instead.
 func (*LoginRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *LoginRequest) GetClusterUri() string {
@@ -1944,7 +2114,7 @@ type AddClusterRequest struct {
 
 func (x *AddClusterRequest) Reset() {
 	*x = AddClusterRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[30]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1956,7 +2126,7 @@ func (x *AddClusterRequest) String() string {
 func (*AddClusterRequest) ProtoMessage() {}
 
 func (x *AddClusterRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[30]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1969,7 +2139,7 @@ func (x *AddClusterRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AddClusterRequest.ProtoReflect.Descriptor instead.
 func (*AddClusterRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{30}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *AddClusterRequest) GetName() string {
@@ -1987,7 +2157,7 @@ type ListClustersRequest struct {
 
 func (x *ListClustersRequest) Reset() {
 	*x = ListClustersRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[31]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1999,7 +2169,7 @@ func (x *ListClustersRequest) String() string {
 func (*ListClustersRequest) ProtoMessage() {}
 
 func (x *ListClustersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[31]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2012,7 +2182,7 @@ func (x *ListClustersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListClustersRequest.ProtoReflect.Descriptor instead.
 func (*ListClustersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{31}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{34}
 }
 
 type ListClustersResponse struct {
@@ -2024,7 +2194,7 @@ type ListClustersResponse struct {
 
 func (x *ListClustersResponse) Reset() {
 	*x = ListClustersResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[32]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2036,7 +2206,7 @@ func (x *ListClustersResponse) String() string {
 func (*ListClustersResponse) ProtoMessage() {}
 
 func (x *ListClustersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[32]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2049,7 +2219,7 @@ func (x *ListClustersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListClustersResponse.ProtoReflect.Descriptor instead.
 func (*ListClustersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{32}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *ListClustersResponse) GetClusters() []*Cluster {
@@ -2068,7 +2238,7 @@ type ListLeafClustersRequest struct {
 
 func (x *ListLeafClustersRequest) Reset() {
 	*x = ListLeafClustersRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[33]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2080,7 +2250,7 @@ func (x *ListLeafClustersRequest) String() string {
 func (*ListLeafClustersRequest) ProtoMessage() {}
 
 func (x *ListLeafClustersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[33]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2093,7 +2263,7 @@ func (x *ListLeafClustersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListLeafClustersRequest.ProtoReflect.Descriptor instead.
 func (*ListLeafClustersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{33}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *ListLeafClustersRequest) GetClusterUri() string {
@@ -2112,7 +2282,7 @@ type ListDatabaseUsersRequest struct {
 
 func (x *ListDatabaseUsersRequest) Reset() {
 	*x = ListDatabaseUsersRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[34]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2124,7 +2294,7 @@ func (x *ListDatabaseUsersRequest) String() string {
 func (*ListDatabaseUsersRequest) ProtoMessage() {}
 
 func (x *ListDatabaseUsersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[34]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2137,7 +2307,7 @@ func (x *ListDatabaseUsersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListDatabaseUsersRequest.ProtoReflect.Descriptor instead.
 func (*ListDatabaseUsersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{34}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *ListDatabaseUsersRequest) GetDbUri() string {
@@ -2156,7 +2326,7 @@ type ListDatabaseUsersResponse struct {
 
 func (x *ListDatabaseUsersResponse) Reset() {
 	*x = ListDatabaseUsersResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[35]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2168,7 +2338,7 @@ func (x *ListDatabaseUsersResponse) String() string {
 func (*ListDatabaseUsersResponse) ProtoMessage() {}
 
 func (x *ListDatabaseUsersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[35]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2181,7 +2351,7 @@ func (x *ListDatabaseUsersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListDatabaseUsersResponse.ProtoReflect.Descriptor instead.
 func (*ListDatabaseUsersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{35}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *ListDatabaseUsersResponse) GetUsers() []string {
@@ -2208,7 +2378,7 @@ type ListResourcesParams struct {
 
 func (x *ListResourcesParams) Reset() {
 	*x = ListResourcesParams{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[36]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2220,7 +2390,7 @@ func (x *ListResourcesParams) String() string {
 func (*ListResourcesParams) ProtoMessage() {}
 
 func (x *ListResourcesParams) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[36]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2233,7 +2403,7 @@ func (x *ListResourcesParams) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListResourcesParams.ProtoReflect.Descriptor instead.
 func (*ListResourcesParams) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{36}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ListResourcesParams) GetStartKey() string {
@@ -2274,7 +2444,7 @@ type ListDatabaseServersRequest struct {
 
 func (x *ListDatabaseServersRequest) Reset() {
 	*x = ListDatabaseServersRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[37]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2286,7 +2456,7 @@ func (x *ListDatabaseServersRequest) String() string {
 func (*ListDatabaseServersRequest) ProtoMessage() {}
 
 func (x *ListDatabaseServersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[37]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2299,7 +2469,7 @@ func (x *ListDatabaseServersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListDatabaseServersRequest.ProtoReflect.Descriptor instead.
 func (*ListDatabaseServersRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{37}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *ListDatabaseServersRequest) GetClusterUri() string {
@@ -2326,7 +2496,7 @@ type ListDatabaseServersResponse struct {
 
 func (x *ListDatabaseServersResponse) Reset() {
 	*x = ListDatabaseServersResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[38]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2338,7 +2508,7 @@ func (x *ListDatabaseServersResponse) String() string {
 func (*ListDatabaseServersResponse) ProtoMessage() {}
 
 func (x *ListDatabaseServersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[38]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2351,7 +2521,7 @@ func (x *ListDatabaseServersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListDatabaseServersResponse.ProtoReflect.Descriptor instead.
 func (*ListDatabaseServersResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{38}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ListDatabaseServersResponse) GetResources() []*DatabaseServer {
@@ -2380,7 +2550,7 @@ type CreateGatewayRequest struct {
 
 func (x *CreateGatewayRequest) Reset() {
 	*x = CreateGatewayRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[39]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2392,7 +2562,7 @@ func (x *CreateGatewayRequest) String() string {
 func (*CreateGatewayRequest) ProtoMessage() {}
 
 func (x *CreateGatewayRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[39]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2405,7 +2575,7 @@ func (x *CreateGatewayRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateGatewayRequest.ProtoReflect.Descriptor instead.
 func (*CreateGatewayRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{39}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *CreateGatewayRequest) GetTargetUri() string {
@@ -2444,7 +2614,7 @@ type ListGatewaysRequest struct {
 
 func (x *ListGatewaysRequest) Reset() {
 	*x = ListGatewaysRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[40]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2456,7 +2626,7 @@ func (x *ListGatewaysRequest) String() string {
 func (*ListGatewaysRequest) ProtoMessage() {}
 
 func (x *ListGatewaysRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[40]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2469,7 +2639,7 @@ func (x *ListGatewaysRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListGatewaysRequest.ProtoReflect.Descriptor instead.
 func (*ListGatewaysRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{40}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{43}
 }
 
 type ListGatewaysResponse struct {
@@ -2481,7 +2651,7 @@ type ListGatewaysResponse struct {
 
 func (x *ListGatewaysResponse) Reset() {
 	*x = ListGatewaysResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[41]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2493,7 +2663,7 @@ func (x *ListGatewaysResponse) String() string {
 func (*ListGatewaysResponse) ProtoMessage() {}
 
 func (x *ListGatewaysResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[41]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2506,7 +2676,7 @@ func (x *ListGatewaysResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListGatewaysResponse.ProtoReflect.Descriptor instead.
 func (*ListGatewaysResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{41}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *ListGatewaysResponse) GetGateways() []*Gateway {
@@ -2525,7 +2695,7 @@ type RemoveGatewayRequest struct {
 
 func (x *RemoveGatewayRequest) Reset() {
 	*x = RemoveGatewayRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[42]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2537,7 +2707,7 @@ func (x *RemoveGatewayRequest) String() string {
 func (*RemoveGatewayRequest) ProtoMessage() {}
 
 func (x *RemoveGatewayRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[42]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2550,7 +2720,7 @@ func (x *RemoveGatewayRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveGatewayRequest.ProtoReflect.Descriptor instead.
 func (*RemoveGatewayRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{42}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *RemoveGatewayRequest) GetGatewayUri() string {
@@ -2570,7 +2740,7 @@ type SetGatewayTargetSubresourceNameRequest struct {
 
 func (x *SetGatewayTargetSubresourceNameRequest) Reset() {
 	*x = SetGatewayTargetSubresourceNameRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[43]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2582,7 +2752,7 @@ func (x *SetGatewayTargetSubresourceNameRequest) String() string {
 func (*SetGatewayTargetSubresourceNameRequest) ProtoMessage() {}
 
 func (x *SetGatewayTargetSubresourceNameRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[43]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2595,7 +2765,7 @@ func (x *SetGatewayTargetSubresourceNameRequest) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use SetGatewayTargetSubresourceNameRequest.ProtoReflect.Descriptor instead.
 func (*SetGatewayTargetSubresourceNameRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{43}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *SetGatewayTargetSubresourceNameRequest) GetGatewayUri() string {
@@ -2622,7 +2792,7 @@ type SetGatewayLocalPortRequest struct {
 
 func (x *SetGatewayLocalPortRequest) Reset() {
 	*x = SetGatewayLocalPortRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[44]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2634,7 +2804,7 @@ func (x *SetGatewayLocalPortRequest) String() string {
 func (*SetGatewayLocalPortRequest) ProtoMessage() {}
 
 func (x *SetGatewayLocalPortRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[44]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2647,7 +2817,7 @@ func (x *SetGatewayLocalPortRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SetGatewayLocalPortRequest.ProtoReflect.Descriptor instead.
 func (*SetGatewayLocalPortRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{44}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *SetGatewayLocalPortRequest) GetGatewayUri() string {
@@ -2673,7 +2843,7 @@ type GetAuthSettingsRequest struct {
 
 func (x *GetAuthSettingsRequest) Reset() {
 	*x = GetAuthSettingsRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[45]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2685,7 +2855,7 @@ func (x *GetAuthSettingsRequest) String() string {
 func (*GetAuthSettingsRequest) ProtoMessage() {}
 
 func (x *GetAuthSettingsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[45]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2698,7 +2868,7 @@ func (x *GetAuthSettingsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAuthSettingsRequest.ProtoReflect.Descriptor instead.
 func (*GetAuthSettingsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{45}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *GetAuthSettingsRequest) GetClusterUri() string {
@@ -2717,7 +2887,7 @@ type UpdateTshdEventsServerAddressRequest struct {
 
 func (x *UpdateTshdEventsServerAddressRequest) Reset() {
 	*x = UpdateTshdEventsServerAddressRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[46]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2729,7 +2899,7 @@ func (x *UpdateTshdEventsServerAddressRequest) String() string {
 func (*UpdateTshdEventsServerAddressRequest) ProtoMessage() {}
 
 func (x *UpdateTshdEventsServerAddressRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[46]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2742,7 +2912,7 @@ func (x *UpdateTshdEventsServerAddressRequest) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use UpdateTshdEventsServerAddressRequest.ProtoReflect.Descriptor instead.
 func (*UpdateTshdEventsServerAddressRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{46}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *UpdateTshdEventsServerAddressRequest) GetAddress() string {
@@ -2760,7 +2930,7 @@ type UpdateTshdEventsServerAddressResponse struct {
 
 func (x *UpdateTshdEventsServerAddressResponse) Reset() {
 	*x = UpdateTshdEventsServerAddressResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[47]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2772,7 +2942,7 @@ func (x *UpdateTshdEventsServerAddressResponse) String() string {
 func (*UpdateTshdEventsServerAddressResponse) ProtoMessage() {}
 
 func (x *UpdateTshdEventsServerAddressResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[47]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2785,7 +2955,7 @@ func (x *UpdateTshdEventsServerAddressResponse) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use UpdateTshdEventsServerAddressResponse.ProtoReflect.Descriptor instead.
 func (*UpdateTshdEventsServerAddressResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{47}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{50}
 }
 
 type UpdateHeadlessAuthenticationStateRequest struct {
@@ -2799,7 +2969,7 @@ type UpdateHeadlessAuthenticationStateRequest struct {
 
 func (x *UpdateHeadlessAuthenticationStateRequest) Reset() {
 	*x = UpdateHeadlessAuthenticationStateRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[48]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2811,7 +2981,7 @@ func (x *UpdateHeadlessAuthenticationStateRequest) String() string {
 func (*UpdateHeadlessAuthenticationStateRequest) ProtoMessage() {}
 
 func (x *UpdateHeadlessAuthenticationStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[48]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2824,7 +2994,7 @@ func (x *UpdateHeadlessAuthenticationStateRequest) ProtoReflect() protoreflect.M
 
 // Deprecated: Use UpdateHeadlessAuthenticationStateRequest.ProtoReflect.Descriptor instead.
 func (*UpdateHeadlessAuthenticationStateRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{48}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *UpdateHeadlessAuthenticationStateRequest) GetRootClusterUri() string {
@@ -2856,7 +3026,7 @@ type UpdateHeadlessAuthenticationStateResponse struct {
 
 func (x *UpdateHeadlessAuthenticationStateResponse) Reset() {
 	*x = UpdateHeadlessAuthenticationStateResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[49]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2868,7 +3038,7 @@ func (x *UpdateHeadlessAuthenticationStateResponse) String() string {
 func (*UpdateHeadlessAuthenticationStateResponse) ProtoMessage() {}
 
 func (x *UpdateHeadlessAuthenticationStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[49]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2881,7 +3051,7 @@ func (x *UpdateHeadlessAuthenticationStateResponse) ProtoReflect() protoreflect.
 
 // Deprecated: Use UpdateHeadlessAuthenticationStateResponse.ProtoReflect.Descriptor instead.
 func (*UpdateHeadlessAuthenticationStateResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{49}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{52}
 }
 
 type CreateConnectMyComputerRoleRequest struct {
@@ -2893,7 +3063,7 @@ type CreateConnectMyComputerRoleRequest struct {
 
 func (x *CreateConnectMyComputerRoleRequest) Reset() {
 	*x = CreateConnectMyComputerRoleRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[50]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2905,7 +3075,7 @@ func (x *CreateConnectMyComputerRoleRequest) String() string {
 func (*CreateConnectMyComputerRoleRequest) ProtoMessage() {}
 
 func (x *CreateConnectMyComputerRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[50]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2918,7 +3088,7 @@ func (x *CreateConnectMyComputerRoleRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use CreateConnectMyComputerRoleRequest.ProtoReflect.Descriptor instead.
 func (*CreateConnectMyComputerRoleRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{50}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *CreateConnectMyComputerRoleRequest) GetRootClusterUri() string {
@@ -2939,7 +3109,7 @@ type CreateConnectMyComputerRoleResponse struct {
 
 func (x *CreateConnectMyComputerRoleResponse) Reset() {
 	*x = CreateConnectMyComputerRoleResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[51]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2951,7 +3121,7 @@ func (x *CreateConnectMyComputerRoleResponse) String() string {
 func (*CreateConnectMyComputerRoleResponse) ProtoMessage() {}
 
 func (x *CreateConnectMyComputerRoleResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[51]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2964,7 +3134,7 @@ func (x *CreateConnectMyComputerRoleResponse) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use CreateConnectMyComputerRoleResponse.ProtoReflect.Descriptor instead.
 func (*CreateConnectMyComputerRoleResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{51}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *CreateConnectMyComputerRoleResponse) GetCertsReloaded() bool {
@@ -2983,7 +3153,7 @@ type CreateConnectMyComputerNodeTokenRequest struct {
 
 func (x *CreateConnectMyComputerNodeTokenRequest) Reset() {
 	*x = CreateConnectMyComputerNodeTokenRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[52]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2995,7 +3165,7 @@ func (x *CreateConnectMyComputerNodeTokenRequest) String() string {
 func (*CreateConnectMyComputerNodeTokenRequest) ProtoMessage() {}
 
 func (x *CreateConnectMyComputerNodeTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[52]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3008,7 +3178,7 @@ func (x *CreateConnectMyComputerNodeTokenRequest) ProtoReflect() protoreflect.Me
 
 // Deprecated: Use CreateConnectMyComputerNodeTokenRequest.ProtoReflect.Descriptor instead.
 func (*CreateConnectMyComputerNodeTokenRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{52}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *CreateConnectMyComputerNodeTokenRequest) GetRootClusterUri() string {
@@ -3027,7 +3197,7 @@ type CreateConnectMyComputerNodeTokenResponse struct {
 
 func (x *CreateConnectMyComputerNodeTokenResponse) Reset() {
 	*x = CreateConnectMyComputerNodeTokenResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[53]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3039,7 +3209,7 @@ func (x *CreateConnectMyComputerNodeTokenResponse) String() string {
 func (*CreateConnectMyComputerNodeTokenResponse) ProtoMessage() {}
 
 func (x *CreateConnectMyComputerNodeTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[53]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3052,7 +3222,7 @@ func (x *CreateConnectMyComputerNodeTokenResponse) ProtoReflect() protoreflect.M
 
 // Deprecated: Use CreateConnectMyComputerNodeTokenResponse.ProtoReflect.Descriptor instead.
 func (*CreateConnectMyComputerNodeTokenResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{53}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *CreateConnectMyComputerNodeTokenResponse) GetToken() string {
@@ -3071,7 +3241,7 @@ type WaitForConnectMyComputerNodeJoinRequest struct {
 
 func (x *WaitForConnectMyComputerNodeJoinRequest) Reset() {
 	*x = WaitForConnectMyComputerNodeJoinRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[54]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3083,7 +3253,7 @@ func (x *WaitForConnectMyComputerNodeJoinRequest) String() string {
 func (*WaitForConnectMyComputerNodeJoinRequest) ProtoMessage() {}
 
 func (x *WaitForConnectMyComputerNodeJoinRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[54]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3096,7 +3266,7 @@ func (x *WaitForConnectMyComputerNodeJoinRequest) ProtoReflect() protoreflect.Me
 
 // Deprecated: Use WaitForConnectMyComputerNodeJoinRequest.ProtoReflect.Descriptor instead.
 func (*WaitForConnectMyComputerNodeJoinRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{54}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *WaitForConnectMyComputerNodeJoinRequest) GetRootClusterUri() string {
@@ -3115,7 +3285,7 @@ type WaitForConnectMyComputerNodeJoinResponse struct {
 
 func (x *WaitForConnectMyComputerNodeJoinResponse) Reset() {
 	*x = WaitForConnectMyComputerNodeJoinResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[55]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3127,7 +3297,7 @@ func (x *WaitForConnectMyComputerNodeJoinResponse) String() string {
 func (*WaitForConnectMyComputerNodeJoinResponse) ProtoMessage() {}
 
 func (x *WaitForConnectMyComputerNodeJoinResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[55]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3140,7 +3310,7 @@ func (x *WaitForConnectMyComputerNodeJoinResponse) ProtoReflect() protoreflect.M
 
 // Deprecated: Use WaitForConnectMyComputerNodeJoinResponse.ProtoReflect.Descriptor instead.
 func (*WaitForConnectMyComputerNodeJoinResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{55}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *WaitForConnectMyComputerNodeJoinResponse) GetServer() *Server {
@@ -3159,7 +3329,7 @@ type DeleteConnectMyComputerNodeRequest struct {
 
 func (x *DeleteConnectMyComputerNodeRequest) Reset() {
 	*x = DeleteConnectMyComputerNodeRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[56]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3171,7 +3341,7 @@ func (x *DeleteConnectMyComputerNodeRequest) String() string {
 func (*DeleteConnectMyComputerNodeRequest) ProtoMessage() {}
 
 func (x *DeleteConnectMyComputerNodeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[56]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3184,7 +3354,7 @@ func (x *DeleteConnectMyComputerNodeRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use DeleteConnectMyComputerNodeRequest.ProtoReflect.Descriptor instead.
 func (*DeleteConnectMyComputerNodeRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{56}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *DeleteConnectMyComputerNodeRequest) GetRootClusterUri() string {
@@ -3202,7 +3372,7 @@ type DeleteConnectMyComputerNodeResponse struct {
 
 func (x *DeleteConnectMyComputerNodeResponse) Reset() {
 	*x = DeleteConnectMyComputerNodeResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[57]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3214,7 +3384,7 @@ func (x *DeleteConnectMyComputerNodeResponse) String() string {
 func (*DeleteConnectMyComputerNodeResponse) ProtoMessage() {}
 
 func (x *DeleteConnectMyComputerNodeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[57]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3227,7 +3397,7 @@ func (x *DeleteConnectMyComputerNodeResponse) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use DeleteConnectMyComputerNodeResponse.ProtoReflect.Descriptor instead.
 func (*DeleteConnectMyComputerNodeResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{57}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{60}
 }
 
 type GetConnectMyComputerNodeNameRequest struct {
@@ -3239,7 +3409,7 @@ type GetConnectMyComputerNodeNameRequest struct {
 
 func (x *GetConnectMyComputerNodeNameRequest) Reset() {
 	*x = GetConnectMyComputerNodeNameRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[58]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3251,7 +3421,7 @@ func (x *GetConnectMyComputerNodeNameRequest) String() string {
 func (*GetConnectMyComputerNodeNameRequest) ProtoMessage() {}
 
 func (x *GetConnectMyComputerNodeNameRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[58]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3264,7 +3434,7 @@ func (x *GetConnectMyComputerNodeNameRequest) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use GetConnectMyComputerNodeNameRequest.ProtoReflect.Descriptor instead.
 func (*GetConnectMyComputerNodeNameRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{58}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *GetConnectMyComputerNodeNameRequest) GetRootClusterUri() string {
@@ -3283,7 +3453,7 @@ type GetConnectMyComputerNodeNameResponse struct {
 
 func (x *GetConnectMyComputerNodeNameResponse) Reset() {
 	*x = GetConnectMyComputerNodeNameResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[59]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3295,7 +3465,7 @@ func (x *GetConnectMyComputerNodeNameResponse) String() string {
 func (*GetConnectMyComputerNodeNameResponse) ProtoMessage() {}
 
 func (x *GetConnectMyComputerNodeNameResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[59]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3308,7 +3478,7 @@ func (x *GetConnectMyComputerNodeNameResponse) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use GetConnectMyComputerNodeNameResponse.ProtoReflect.Descriptor instead.
 func (*GetConnectMyComputerNodeNameResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{59}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *GetConnectMyComputerNodeNameResponse) GetName() string {
@@ -3348,7 +3518,7 @@ type ListUnifiedResourcesRequest struct {
 
 func (x *ListUnifiedResourcesRequest) Reset() {
 	*x = ListUnifiedResourcesRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[60]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3360,7 +3530,7 @@ func (x *ListUnifiedResourcesRequest) String() string {
 func (*ListUnifiedResourcesRequest) ProtoMessage() {}
 
 func (x *ListUnifiedResourcesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[60]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3373,7 +3543,7 @@ func (x *ListUnifiedResourcesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListUnifiedResourcesRequest.ProtoReflect.Descriptor instead.
 func (*ListUnifiedResourcesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{60}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *ListUnifiedResourcesRequest) GetClusterUri() string {
@@ -3458,7 +3628,7 @@ type SortBy struct {
 
 func (x *SortBy) Reset() {
 	*x = SortBy{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[61]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3470,7 +3640,7 @@ func (x *SortBy) String() string {
 func (*SortBy) ProtoMessage() {}
 
 func (x *SortBy) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[61]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3483,7 +3653,7 @@ func (x *SortBy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SortBy.ProtoReflect.Descriptor instead.
 func (*SortBy) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{61}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *SortBy) GetIsDesc() bool {
@@ -3512,7 +3682,7 @@ type ListUnifiedResourcesResponse struct {
 
 func (x *ListUnifiedResourcesResponse) Reset() {
 	*x = ListUnifiedResourcesResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[62]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3524,7 +3694,7 @@ func (x *ListUnifiedResourcesResponse) String() string {
 func (*ListUnifiedResourcesResponse) ProtoMessage() {}
 
 func (x *ListUnifiedResourcesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[62]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3537,7 +3707,7 @@ func (x *ListUnifiedResourcesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListUnifiedResourcesResponse.ProtoReflect.Descriptor instead.
 func (*ListUnifiedResourcesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{62}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *ListUnifiedResourcesResponse) GetResources() []*PaginatedResource {
@@ -3571,7 +3741,7 @@ type PaginatedResource struct {
 
 func (x *PaginatedResource) Reset() {
 	*x = PaginatedResource{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[63]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3583,7 +3753,7 @@ func (x *PaginatedResource) String() string {
 func (*PaginatedResource) ProtoMessage() {}
 
 func (x *PaginatedResource) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[63]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3596,7 +3766,7 @@ func (x *PaginatedResource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PaginatedResource.ProtoReflect.Descriptor instead.
 func (*PaginatedResource) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{63}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *PaginatedResource) GetResource() isPaginatedResource_Resource {
@@ -3701,7 +3871,7 @@ type GetUserPreferencesRequest struct {
 
 func (x *GetUserPreferencesRequest) Reset() {
 	*x = GetUserPreferencesRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[64]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3713,7 +3883,7 @@ func (x *GetUserPreferencesRequest) String() string {
 func (*GetUserPreferencesRequest) ProtoMessage() {}
 
 func (x *GetUserPreferencesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[64]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3726,7 +3896,7 @@ func (x *GetUserPreferencesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetUserPreferencesRequest.ProtoReflect.Descriptor instead.
 func (*GetUserPreferencesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{64}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *GetUserPreferencesRequest) GetClusterUri() string {
@@ -3745,7 +3915,7 @@ type GetUserPreferencesResponse struct {
 
 func (x *GetUserPreferencesResponse) Reset() {
 	*x = GetUserPreferencesResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[65]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3757,7 +3927,7 @@ func (x *GetUserPreferencesResponse) String() string {
 func (*GetUserPreferencesResponse) ProtoMessage() {}
 
 func (x *GetUserPreferencesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[65]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3770,7 +3940,7 @@ func (x *GetUserPreferencesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetUserPreferencesResponse.ProtoReflect.Descriptor instead.
 func (*GetUserPreferencesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{65}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *GetUserPreferencesResponse) GetUserPreferences() *UserPreferences {
@@ -3790,7 +3960,7 @@ type UpdateUserPreferencesRequest struct {
 
 func (x *UpdateUserPreferencesRequest) Reset() {
 	*x = UpdateUserPreferencesRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[66]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3802,7 +3972,7 @@ func (x *UpdateUserPreferencesRequest) String() string {
 func (*UpdateUserPreferencesRequest) ProtoMessage() {}
 
 func (x *UpdateUserPreferencesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[66]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3815,7 +3985,7 @@ func (x *UpdateUserPreferencesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateUserPreferencesRequest.ProtoReflect.Descriptor instead.
 func (*UpdateUserPreferencesRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{66}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *UpdateUserPreferencesRequest) GetClusterUri() string {
@@ -3841,7 +4011,7 @@ type UpdateUserPreferencesResponse struct {
 
 func (x *UpdateUserPreferencesResponse) Reset() {
 	*x = UpdateUserPreferencesResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[67]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3853,7 +4023,7 @@ func (x *UpdateUserPreferencesResponse) String() string {
 func (*UpdateUserPreferencesResponse) ProtoMessage() {}
 
 func (x *UpdateUserPreferencesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[67]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3866,7 +4036,7 @@ func (x *UpdateUserPreferencesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateUserPreferencesResponse.ProtoReflect.Descriptor instead.
 func (*UpdateUserPreferencesResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{67}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *UpdateUserPreferencesResponse) GetUserPreferences() *UserPreferences {
@@ -3888,7 +4058,7 @@ type UserPreferences struct {
 
 func (x *UserPreferences) Reset() {
 	*x = UserPreferences{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[68]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3900,7 +4070,7 @@ func (x *UserPreferences) String() string {
 func (*UserPreferences) ProtoMessage() {}
 
 func (x *UserPreferences) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[68]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3913,7 +4083,7 @@ func (x *UserPreferences) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UserPreferences.ProtoReflect.Descriptor instead.
 func (*UserPreferences) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{68}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *UserPreferences) GetClusterPreferences() *v11.ClusterUserPreferences {
@@ -3943,7 +4113,7 @@ type AuthenticateWebDeviceRequest struct {
 
 func (x *AuthenticateWebDeviceRequest) Reset() {
 	*x = AuthenticateWebDeviceRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[69]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3955,7 +4125,7 @@ func (x *AuthenticateWebDeviceRequest) String() string {
 func (*AuthenticateWebDeviceRequest) ProtoMessage() {}
 
 func (x *AuthenticateWebDeviceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[69]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3968,7 +4138,7 @@ func (x *AuthenticateWebDeviceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateWebDeviceRequest.ProtoReflect.Descriptor instead.
 func (*AuthenticateWebDeviceRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{69}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *AuthenticateWebDeviceRequest) GetDeviceWebToken() *v12.DeviceWebToken {
@@ -3997,7 +4167,7 @@ type AuthenticateWebDeviceResponse struct {
 
 func (x *AuthenticateWebDeviceResponse) Reset() {
 	*x = AuthenticateWebDeviceResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[70]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[73]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4009,7 +4179,7 @@ func (x *AuthenticateWebDeviceResponse) String() string {
 func (*AuthenticateWebDeviceResponse) ProtoMessage() {}
 
 func (x *AuthenticateWebDeviceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[70]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[73]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4022,7 +4192,7 @@ func (x *AuthenticateWebDeviceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateWebDeviceResponse.ProtoReflect.Descriptor instead.
 func (*AuthenticateWebDeviceResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{70}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *AuthenticateWebDeviceResponse) GetConfirmationToken() *v12.DeviceConfirmationToken {
@@ -4041,7 +4211,7 @@ type GetAppRequest struct {
 
 func (x *GetAppRequest) Reset() {
 	*x = GetAppRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[71]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4053,7 +4223,7 @@ func (x *GetAppRequest) String() string {
 func (*GetAppRequest) ProtoMessage() {}
 
 func (x *GetAppRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[71]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4066,7 +4236,7 @@ func (x *GetAppRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAppRequest.ProtoReflect.Descriptor instead.
 func (*GetAppRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{71}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *GetAppRequest) GetAppUri() string {
@@ -4085,7 +4255,7 @@ type GetAppResponse struct {
 
 func (x *GetAppResponse) Reset() {
 	*x = GetAppResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[72]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4097,7 +4267,7 @@ func (x *GetAppResponse) String() string {
 func (*GetAppResponse) ProtoMessage() {}
 
 func (x *GetAppResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[72]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4110,7 +4280,7 @@ func (x *GetAppResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAppResponse.ProtoReflect.Descriptor instead.
 func (*GetAppResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{72}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{75}
 }
 
 func (x *GetAppResponse) GetApp() *App {
@@ -4133,7 +4303,7 @@ type TargetDesktop struct {
 
 func (x *TargetDesktop) Reset() {
 	*x = TargetDesktop{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[73]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4145,7 +4315,7 @@ func (x *TargetDesktop) String() string {
 func (*TargetDesktop) ProtoMessage() {}
 
 func (x *TargetDesktop) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[73]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4158,7 +4328,7 @@ func (x *TargetDesktop) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TargetDesktop.ProtoReflect.Descriptor instead.
 func (*TargetDesktop) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{73}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *TargetDesktop) GetDesktopUri() string {
@@ -4189,7 +4359,7 @@ type ConnectToDesktopRequest struct {
 
 func (x *ConnectToDesktopRequest) Reset() {
 	*x = ConnectToDesktopRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[74]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4201,7 +4371,7 @@ func (x *ConnectToDesktopRequest) String() string {
 func (*ConnectToDesktopRequest) ProtoMessage() {}
 
 func (x *ConnectToDesktopRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[74]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4214,7 +4384,7 @@ func (x *ConnectToDesktopRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConnectToDesktopRequest.ProtoReflect.Descriptor instead.
 func (*ConnectToDesktopRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{74}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{77}
 }
 
 func (x *ConnectToDesktopRequest) GetData() []byte {
@@ -4242,7 +4412,7 @@ type ConnectToDesktopResponse struct {
 
 func (x *ConnectToDesktopResponse) Reset() {
 	*x = ConnectToDesktopResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[75]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[78]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4254,7 +4424,7 @@ func (x *ConnectToDesktopResponse) String() string {
 func (*ConnectToDesktopResponse) ProtoMessage() {}
 
 func (x *ConnectToDesktopResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[75]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[78]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4267,7 +4437,7 @@ func (x *ConnectToDesktopResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConnectToDesktopResponse.ProtoReflect.Descriptor instead.
 func (*ConnectToDesktopResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{75}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{78}
 }
 
 func (x *ConnectToDesktopResponse) GetData() []byte {
@@ -4292,7 +4462,7 @@ type SetSharedDirectoryForDesktopSessionRequest struct {
 
 func (x *SetSharedDirectoryForDesktopSessionRequest) Reset() {
 	*x = SetSharedDirectoryForDesktopSessionRequest{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[76]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[79]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4304,7 +4474,7 @@ func (x *SetSharedDirectoryForDesktopSessionRequest) String() string {
 func (*SetSharedDirectoryForDesktopSessionRequest) ProtoMessage() {}
 
 func (x *SetSharedDirectoryForDesktopSessionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[76]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[79]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4317,7 +4487,7 @@ func (x *SetSharedDirectoryForDesktopSessionRequest) ProtoReflect() protoreflect
 
 // Deprecated: Use SetSharedDirectoryForDesktopSessionRequest.ProtoReflect.Descriptor instead.
 func (*SetSharedDirectoryForDesktopSessionRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{76}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{79}
 }
 
 func (x *SetSharedDirectoryForDesktopSessionRequest) GetDesktopUri() string {
@@ -4350,7 +4520,7 @@ type SetSharedDirectoryForDesktopSessionResponse struct {
 
 func (x *SetSharedDirectoryForDesktopSessionResponse) Reset() {
 	*x = SetSharedDirectoryForDesktopSessionResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[77]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[80]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4362,7 +4532,7 @@ func (x *SetSharedDirectoryForDesktopSessionResponse) String() string {
 func (*SetSharedDirectoryForDesktopSessionResponse) ProtoMessage() {}
 
 func (x *SetSharedDirectoryForDesktopSessionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[77]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[80]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4375,7 +4545,7 @@ func (x *SetSharedDirectoryForDesktopSessionResponse) ProtoReflect() protoreflec
 
 // Deprecated: Use SetSharedDirectoryForDesktopSessionResponse.ProtoReflect.Descriptor instead.
 func (*SetSharedDirectoryForDesktopSessionResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{77}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{80}
 }
 
 // LoginPasswordlessRequestInit contains fields needed to init the stream request.
@@ -4389,7 +4559,7 @@ type LoginPasswordlessRequest_LoginPasswordlessRequestInit struct {
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessRequestInit) Reset() {
 	*x = LoginPasswordlessRequest_LoginPasswordlessRequestInit{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[78]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[81]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4401,7 +4571,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessRequestInit) String() string
 func (*LoginPasswordlessRequest_LoginPasswordlessRequestInit) ProtoMessage() {}
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessRequestInit) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[78]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[81]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4414,7 +4584,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessRequestInit) ProtoReflect() p
 
 // Deprecated: Use LoginPasswordlessRequest_LoginPasswordlessRequestInit.ProtoReflect.Descriptor instead.
 func (*LoginPasswordlessRequest_LoginPasswordlessRequestInit) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{26, 0}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29, 0}
 }
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessRequestInit) GetClusterUri() string {
@@ -4435,7 +4605,7 @@ type LoginPasswordlessRequest_LoginPasswordlessPINResponse struct {
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessPINResponse) Reset() {
 	*x = LoginPasswordlessRequest_LoginPasswordlessPINResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[79]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4447,7 +4617,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessPINResponse) String() string
 func (*LoginPasswordlessRequest_LoginPasswordlessPINResponse) ProtoMessage() {}
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessPINResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[79]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4460,7 +4630,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessPINResponse) ProtoReflect() p
 
 // Deprecated: Use LoginPasswordlessRequest_LoginPasswordlessPINResponse.ProtoReflect.Descriptor instead.
 func (*LoginPasswordlessRequest_LoginPasswordlessPINResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{26, 1}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29, 1}
 }
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessPINResponse) GetPin() string {
@@ -4483,7 +4653,7 @@ type LoginPasswordlessRequest_LoginPasswordlessCredentialResponse struct {
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) Reset() {
 	*x = LoginPasswordlessRequest_LoginPasswordlessCredentialResponse{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[80]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4495,7 +4665,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) String()
 func (*LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) ProtoMessage() {}
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[80]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4508,7 +4678,7 @@ func (x *LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) ProtoRefl
 
 // Deprecated: Use LoginPasswordlessRequest_LoginPasswordlessCredentialResponse.ProtoReflect.Descriptor instead.
 func (*LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{26, 2}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29, 2}
 }
 
 func (x *LoginPasswordlessRequest_LoginPasswordlessCredentialResponse) GetIndex() int64 {
@@ -4533,7 +4703,7 @@ type LoginRequest_LocalParams struct {
 
 func (x *LoginRequest_LocalParams) Reset() {
 	*x = LoginRequest_LocalParams{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[81]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[84]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4545,7 +4715,7 @@ func (x *LoginRequest_LocalParams) String() string {
 func (*LoginRequest_LocalParams) ProtoMessage() {}
 
 func (x *LoginRequest_LocalParams) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[81]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[84]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4558,7 +4728,7 @@ func (x *LoginRequest_LocalParams) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginRequest_LocalParams.ProtoReflect.Descriptor instead.
 func (*LoginRequest_LocalParams) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29, 0}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{32, 0}
 }
 
 func (x *LoginRequest_LocalParams) GetUser() string {
@@ -4595,7 +4765,7 @@ type LoginRequest_SsoParams struct {
 
 func (x *LoginRequest_SsoParams) Reset() {
 	*x = LoginRequest_SsoParams{}
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[82]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[85]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4607,7 +4777,7 @@ func (x *LoginRequest_SsoParams) String() string {
 func (*LoginRequest_SsoParams) ProtoMessage() {}
 
 func (x *LoginRequest_SsoParams) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[82]
+	mi := &file_teleport_lib_teleterm_v1_service_proto_msgTypes[85]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4620,7 +4790,7 @@ func (x *LoginRequest_SsoParams) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginRequest_SsoParams.ProtoReflect.Descriptor instead.
 func (*LoginRequest_SsoParams) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{29, 1}
+	return file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP(), []int{32, 1}
 }
 
 func (x *LoginRequest_SsoParams) GetProviderType() string {
@@ -4642,16 +4812,17 @@ var File_teleport_lib_teleterm_v1_service_proto protoreflect.FileDescriptor
 const file_teleport_lib_teleterm_v1_service_proto_rawDesc = "" +
 	"\n" +
 	"&teleport/lib/teleterm/v1/service.proto\x12\x18teleport.lib.teleterm.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a7teleport/devicetrust/v1/device_confirmation_token.proto\x1a.teleport/devicetrust/v1/device_web_token.proto\x1a-teleport/lib/teleterm/v1/access_request.proto\x1a\"teleport/lib/teleterm/v1/app.proto\x1a,teleport/lib/teleterm/v1/auth_settings.proto\x1a&teleport/lib/teleterm/v1/cluster.proto\x1a'teleport/lib/teleterm/v1/database.proto\x1a&teleport/lib/teleterm/v1/gateway.proto\x1a#teleport/lib/teleterm/v1/kube.proto\x1a%teleport/lib/teleterm/v1/server.proto\x1a+teleport/lib/teleterm/v1/usage_events.proto\x1a.teleport/lib/teleterm/v1/windows_desktop.proto\x1a5teleport/userpreferences/v1/cluster_preferences.proto\x1a>teleport/userpreferences/v1/unified_resource_preferences.proto\"\x0f\n" +
-	"\rEmptyResponse\"7\n" +
-	"\x14RemoveClusterRequest\x12\x1f\n" +
-	"\vcluster_uri\x18\x01 \x01(\tR\n" +
-	"clusterUri\"4\n" +
+	"\rEmptyResponse\"4\n" +
 	"\x11GetClusterRequest\x12\x1f\n" +
 	"\vcluster_uri\x18\x01 \x01(\tR\n" +
-	"clusterUri\"0\n" +
+	"clusterUri\"W\n" +
 	"\rLogoutRequest\x12\x1f\n" +
 	"\vcluster_uri\x18\x01 \x01(\tR\n" +
-	"clusterUri\"G\n" +
+	"clusterUri\x12%\n" +
+	"\x0eremove_profile\x18\x02 \x01(\bR\rremoveProfile\"K\n" +
+	"\x1fClearStaleClusterClientsRequest\x12(\n" +
+	"\x10root_cluster_uri\x18\x01 \x01(\tR\x0erootClusterUri\"\"\n" +
+	" ClearStaleClusterClientsResponse\"G\n" +
 	"\x1bStartHeadlessWatcherRequest\x12(\n" +
 	"\x10root_cluster_uri\x18\x01 \x01(\tR\x0erootClusterUri\"\x1e\n" +
 	"\x1cStartHeadlessWatcherResponse\"f\n" +
@@ -4726,7 +4897,17 @@ const file_teleport_lib_teleterm_v1_service_proto_rawDesc = "" +
 	"\x12kubernetes_cluster\x18\b \x01(\tR\x11kubernetesCluster\x121\n" +
 	"\x14kubernetes_namespace\x18\t \x01(\tR\x13kubernetesNamespace\"w\n" +
 	"\x1fListKubernetesResourcesResponse\x12D\n" +
-	"\tresources\x18\x01 \x03(\v2&.teleport.lib.teleterm.v1.KubeResourceR\tresourcesJ\x04\b\x02\x10\x03R\bnext_key\",\n" +
+	"\tresources\x18\x01 \x03(\v2&.teleport.lib.teleterm.v1.KubeResourceR\tresourcesJ\x04\b\x02\x10\x03R\bnext_key\"\xc2\x01\n" +
+	"\x1cListKubernetesServersRequest\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tR\tpageToken\x12\x1f\n" +
+	"\vcluster_uri\x18\x03 \x01(\tR\n" +
+	"clusterUri\x12E\n" +
+	"\x06params\x18\x04 \x01(\v2-.teleport.lib.teleterm.v1.ListResourcesParamsR\x06params\"\x8b\x01\n" +
+	"\x1dListKubernetesServersResponse\x12B\n" +
+	"\tresources\x18\x01 \x03(\v2$.teleport.lib.teleterm.v1.KubeServerR\tresources\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\",\n" +
 	"\x0eCredentialInfo\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\"\xad\x01\n" +
 	"\x19LoginPasswordlessResponse\x12D\n" +
@@ -4927,7 +5108,7 @@ const file_teleport_lib_teleterm_v1_service_proto_rawDesc = "" +
 	")HEADLESS_AUTHENTICATION_STATE_UNSPECIFIED\x10\x00\x12)\n" +
 	"%HEADLESS_AUTHENTICATION_STATE_PENDING\x10\x01\x12(\n" +
 	"$HEADLESS_AUTHENTICATION_STATE_DENIED\x10\x02\x12*\n" +
-	"&HEADLESS_AUTHENTICATION_STATE_APPROVED\x10\x032\xa9+\n" +
+	"&HEADLESS_AUTHENTICATION_STATE_APPROVED\x10\x032\xde,\n" +
 	"\x0fTerminalService\x12\xa0\x01\n" +
 	"\x1dUpdateTshdEventsServerAddress\x12>.teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest\x1a?.teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse\x12q\n" +
 	"\x10ListRootClusters\x12-.teleport.lib.teleterm.v1.ListClustersRequest\x1a..teleport.lib.teleterm.v1.ListClustersResponse\x12u\n" +
@@ -4945,10 +5126,10 @@ const file_teleport_lib_teleterm_v1_service_proto_rawDesc = "" +
 	"AssumeRole\x12+.teleport.lib.teleterm.v1.AssumeRoleRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12\x85\x01\n" +
 	"\x14PromoteAccessRequest\x125.teleport.lib.teleterm.v1.PromoteAccessRequestRequest\x1a6.teleport.lib.teleterm.v1.PromoteAccessRequestResponse\x12\x8e\x01\n" +
 	"\x17GetSuggestedAccessLists\x128.teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest\x1a9.teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse\x12\x8e\x01\n" +
-	"\x17ListKubernetesResources\x128.teleport.lib.teleterm.v1.ListKubernetesResourcesRequest\x1a9.teleport.lib.teleterm.v1.ListKubernetesResourcesResponse\x12\\\n" +
+	"\x17ListKubernetesResources\x128.teleport.lib.teleterm.v1.ListKubernetesResourcesRequest\x1a9.teleport.lib.teleterm.v1.ListKubernetesResourcesResponse\x12\x88\x01\n" +
+	"\x15ListKubernetesServers\x126.teleport.lib.teleterm.v1.ListKubernetesServersRequest\x1a7.teleport.lib.teleterm.v1.ListKubernetesServersResponse\x12\\\n" +
 	"\n" +
-	"AddCluster\x12+.teleport.lib.teleterm.v1.AddClusterRequest\x1a!.teleport.lib.teleterm.v1.Cluster\x12h\n" +
-	"\rRemoveCluster\x12..teleport.lib.teleterm.v1.RemoveClusterRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12m\n" +
+	"AddCluster\x12+.teleport.lib.teleterm.v1.AddClusterRequest\x1a!.teleport.lib.teleterm.v1.Cluster\x12m\n" +
 	"\fListGateways\x12-.teleport.lib.teleterm.v1.ListGatewaysRequest\x1a..teleport.lib.teleterm.v1.ListGatewaysResponse\x12b\n" +
 	"\rCreateGateway\x12..teleport.lib.teleterm.v1.CreateGatewayRequest\x1a!.teleport.lib.teleterm.v1.Gateway\x12h\n" +
 	"\rRemoveGateway\x12..teleport.lib.teleterm.v1.RemoveGatewayRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12\x86\x01\n" +
@@ -4959,7 +5140,8 @@ const file_teleport_lib_teleterm_v1_service_proto_rawDesc = "" +
 	"GetCluster\x12+.teleport.lib.teleterm.v1.GetClusterRequest\x1a!.teleport.lib.teleterm.v1.Cluster\x12X\n" +
 	"\x05Login\x12&.teleport.lib.teleterm.v1.LoginRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12\x80\x01\n" +
 	"\x11LoginPasswordless\x122.teleport.lib.teleterm.v1.LoginPasswordlessRequest\x1a3.teleport.lib.teleterm.v1.LoginPasswordlessResponse(\x010\x01\x12Z\n" +
-	"\x06Logout\x12'.teleport.lib.teleterm.v1.LogoutRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12o\n" +
+	"\x06Logout\x12'.teleport.lib.teleterm.v1.LogoutRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12\x91\x01\n" +
+	"\x18ClearStaleClusterClients\x129.teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest\x1a:.teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse\x12o\n" +
 	"\fTransferFile\x12-.teleport.lib.teleterm.v1.FileTransferRequest\x1a..teleport.lib.teleterm.v1.FileTransferProgress0\x01\x12n\n" +
 	"\x10ReportUsageEvent\x121.teleport.lib.teleterm.v1.ReportUsageEventRequest\x1a'.teleport.lib.teleterm.v1.EmptyResponse\x12\xac\x01\n" +
 	"!UpdateHeadlessAuthenticationState\x12B.teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest\x1aC.teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse\x12\x9a\x01\n" +
@@ -4989,249 +5171,257 @@ func file_teleport_lib_teleterm_v1_service_proto_rawDescGZIP() []byte {
 }
 
 var file_teleport_lib_teleterm_v1_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_teleport_lib_teleterm_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 83)
+var file_teleport_lib_teleterm_v1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 86)
 var file_teleport_lib_teleterm_v1_service_proto_goTypes = []any{
 	(PasswordlessPrompt)(0),                                              // 0: teleport.lib.teleterm.v1.PasswordlessPrompt
 	(FileTransferDirection)(0),                                           // 1: teleport.lib.teleterm.v1.FileTransferDirection
 	(HeadlessAuthenticationState)(0),                                     // 2: teleport.lib.teleterm.v1.HeadlessAuthenticationState
 	(*EmptyResponse)(nil),                                                // 3: teleport.lib.teleterm.v1.EmptyResponse
-	(*RemoveClusterRequest)(nil),                                         // 4: teleport.lib.teleterm.v1.RemoveClusterRequest
-	(*GetClusterRequest)(nil),                                            // 5: teleport.lib.teleterm.v1.GetClusterRequest
-	(*LogoutRequest)(nil),                                                // 6: teleport.lib.teleterm.v1.LogoutRequest
-	(*StartHeadlessWatcherRequest)(nil),                                  // 7: teleport.lib.teleterm.v1.StartHeadlessWatcherRequest
-	(*StartHeadlessWatcherResponse)(nil),                                 // 8: teleport.lib.teleterm.v1.StartHeadlessWatcherResponse
-	(*GetAccessRequestRequest)(nil),                                      // 9: teleport.lib.teleterm.v1.GetAccessRequestRequest
-	(*GetAccessRequestsRequest)(nil),                                     // 10: teleport.lib.teleterm.v1.GetAccessRequestsRequest
-	(*GetAccessRequestResponse)(nil),                                     // 11: teleport.lib.teleterm.v1.GetAccessRequestResponse
-	(*GetAccessRequestsResponse)(nil),                                    // 12: teleport.lib.teleterm.v1.GetAccessRequestsResponse
-	(*DeleteAccessRequestRequest)(nil),                                   // 13: teleport.lib.teleterm.v1.DeleteAccessRequestRequest
-	(*CreateAccessRequestRequest)(nil),                                   // 14: teleport.lib.teleterm.v1.CreateAccessRequestRequest
-	(*CreateAccessRequestResponse)(nil),                                  // 15: teleport.lib.teleterm.v1.CreateAccessRequestResponse
-	(*AssumeRoleRequest)(nil),                                            // 16: teleport.lib.teleterm.v1.AssumeRoleRequest
-	(*GetRequestableRolesRequest)(nil),                                   // 17: teleport.lib.teleterm.v1.GetRequestableRolesRequest
-	(*GetRequestableRolesResponse)(nil),                                  // 18: teleport.lib.teleterm.v1.GetRequestableRolesResponse
-	(*ReviewAccessRequestRequest)(nil),                                   // 19: teleport.lib.teleterm.v1.ReviewAccessRequestRequest
-	(*ReviewAccessRequestResponse)(nil),                                  // 20: teleport.lib.teleterm.v1.ReviewAccessRequestResponse
-	(*PromoteAccessRequestRequest)(nil),                                  // 21: teleport.lib.teleterm.v1.PromoteAccessRequestRequest
-	(*PromoteAccessRequestResponse)(nil),                                 // 22: teleport.lib.teleterm.v1.PromoteAccessRequestResponse
-	(*GetSuggestedAccessListsRequest)(nil),                               // 23: teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest
-	(*GetSuggestedAccessListsResponse)(nil),                              // 24: teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse
-	(*ListKubernetesResourcesRequest)(nil),                               // 25: teleport.lib.teleterm.v1.ListKubernetesResourcesRequest
-	(*ListKubernetesResourcesResponse)(nil),                              // 26: teleport.lib.teleterm.v1.ListKubernetesResourcesResponse
-	(*CredentialInfo)(nil),                                               // 27: teleport.lib.teleterm.v1.CredentialInfo
-	(*LoginPasswordlessResponse)(nil),                                    // 28: teleport.lib.teleterm.v1.LoginPasswordlessResponse
-	(*LoginPasswordlessRequest)(nil),                                     // 29: teleport.lib.teleterm.v1.LoginPasswordlessRequest
-	(*FileTransferRequest)(nil),                                          // 30: teleport.lib.teleterm.v1.FileTransferRequest
-	(*FileTransferProgress)(nil),                                         // 31: teleport.lib.teleterm.v1.FileTransferProgress
-	(*LoginRequest)(nil),                                                 // 32: teleport.lib.teleterm.v1.LoginRequest
-	(*AddClusterRequest)(nil),                                            // 33: teleport.lib.teleterm.v1.AddClusterRequest
-	(*ListClustersRequest)(nil),                                          // 34: teleport.lib.teleterm.v1.ListClustersRequest
-	(*ListClustersResponse)(nil),                                         // 35: teleport.lib.teleterm.v1.ListClustersResponse
-	(*ListLeafClustersRequest)(nil),                                      // 36: teleport.lib.teleterm.v1.ListLeafClustersRequest
-	(*ListDatabaseUsersRequest)(nil),                                     // 37: teleport.lib.teleterm.v1.ListDatabaseUsersRequest
-	(*ListDatabaseUsersResponse)(nil),                                    // 38: teleport.lib.teleterm.v1.ListDatabaseUsersResponse
-	(*ListResourcesParams)(nil),                                          // 39: teleport.lib.teleterm.v1.ListResourcesParams
-	(*ListDatabaseServersRequest)(nil),                                   // 40: teleport.lib.teleterm.v1.ListDatabaseServersRequest
-	(*ListDatabaseServersResponse)(nil),                                  // 41: teleport.lib.teleterm.v1.ListDatabaseServersResponse
-	(*CreateGatewayRequest)(nil),                                         // 42: teleport.lib.teleterm.v1.CreateGatewayRequest
-	(*ListGatewaysRequest)(nil),                                          // 43: teleport.lib.teleterm.v1.ListGatewaysRequest
-	(*ListGatewaysResponse)(nil),                                         // 44: teleport.lib.teleterm.v1.ListGatewaysResponse
-	(*RemoveGatewayRequest)(nil),                                         // 45: teleport.lib.teleterm.v1.RemoveGatewayRequest
-	(*SetGatewayTargetSubresourceNameRequest)(nil),                       // 46: teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest
-	(*SetGatewayLocalPortRequest)(nil),                                   // 47: teleport.lib.teleterm.v1.SetGatewayLocalPortRequest
-	(*GetAuthSettingsRequest)(nil),                                       // 48: teleport.lib.teleterm.v1.GetAuthSettingsRequest
-	(*UpdateTshdEventsServerAddressRequest)(nil),                         // 49: teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest
-	(*UpdateTshdEventsServerAddressResponse)(nil),                        // 50: teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse
-	(*UpdateHeadlessAuthenticationStateRequest)(nil),                     // 51: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest
-	(*UpdateHeadlessAuthenticationStateResponse)(nil),                    // 52: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse
-	(*CreateConnectMyComputerRoleRequest)(nil),                           // 53: teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest
-	(*CreateConnectMyComputerRoleResponse)(nil),                          // 54: teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse
-	(*CreateConnectMyComputerNodeTokenRequest)(nil),                      // 55: teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest
-	(*CreateConnectMyComputerNodeTokenResponse)(nil),                     // 56: teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse
-	(*WaitForConnectMyComputerNodeJoinRequest)(nil),                      // 57: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest
-	(*WaitForConnectMyComputerNodeJoinResponse)(nil),                     // 58: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse
-	(*DeleteConnectMyComputerNodeRequest)(nil),                           // 59: teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest
-	(*DeleteConnectMyComputerNodeResponse)(nil),                          // 60: teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse
-	(*GetConnectMyComputerNodeNameRequest)(nil),                          // 61: teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest
-	(*GetConnectMyComputerNodeNameResponse)(nil),                         // 62: teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse
-	(*ListUnifiedResourcesRequest)(nil),                                  // 63: teleport.lib.teleterm.v1.ListUnifiedResourcesRequest
-	(*SortBy)(nil),                                                       // 64: teleport.lib.teleterm.v1.SortBy
-	(*ListUnifiedResourcesResponse)(nil),                                 // 65: teleport.lib.teleterm.v1.ListUnifiedResourcesResponse
-	(*PaginatedResource)(nil),                                            // 66: teleport.lib.teleterm.v1.PaginatedResource
-	(*GetUserPreferencesRequest)(nil),                                    // 67: teleport.lib.teleterm.v1.GetUserPreferencesRequest
-	(*GetUserPreferencesResponse)(nil),                                   // 68: teleport.lib.teleterm.v1.GetUserPreferencesResponse
-	(*UpdateUserPreferencesRequest)(nil),                                 // 69: teleport.lib.teleterm.v1.UpdateUserPreferencesRequest
-	(*UpdateUserPreferencesResponse)(nil),                                // 70: teleport.lib.teleterm.v1.UpdateUserPreferencesResponse
-	(*UserPreferences)(nil),                                              // 71: teleport.lib.teleterm.v1.UserPreferences
-	(*AuthenticateWebDeviceRequest)(nil),                                 // 72: teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest
-	(*AuthenticateWebDeviceResponse)(nil),                                // 73: teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse
-	(*GetAppRequest)(nil),                                                // 74: teleport.lib.teleterm.v1.GetAppRequest
-	(*GetAppResponse)(nil),                                               // 75: teleport.lib.teleterm.v1.GetAppResponse
-	(*TargetDesktop)(nil),                                                // 76: teleport.lib.teleterm.v1.TargetDesktop
-	(*ConnectToDesktopRequest)(nil),                                      // 77: teleport.lib.teleterm.v1.ConnectToDesktopRequest
-	(*ConnectToDesktopResponse)(nil),                                     // 78: teleport.lib.teleterm.v1.ConnectToDesktopResponse
-	(*SetSharedDirectoryForDesktopSessionRequest)(nil),                   // 79: teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionRequest
-	(*SetSharedDirectoryForDesktopSessionResponse)(nil),                  // 80: teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionResponse
-	(*LoginPasswordlessRequest_LoginPasswordlessRequestInit)(nil),        // 81: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessRequestInit
-	(*LoginPasswordlessRequest_LoginPasswordlessPINResponse)(nil),        // 82: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessPINResponse
-	(*LoginPasswordlessRequest_LoginPasswordlessCredentialResponse)(nil), // 83: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessCredentialResponse
-	(*LoginRequest_LocalParams)(nil),                                     // 84: teleport.lib.teleterm.v1.LoginRequest.LocalParams
-	(*LoginRequest_SsoParams)(nil),                                       // 85: teleport.lib.teleterm.v1.LoginRequest.SsoParams
-	(*AccessRequest)(nil),                                                // 86: teleport.lib.teleterm.v1.AccessRequest
-	(*ResourceID)(nil),                                                   // 87: teleport.lib.teleterm.v1.ResourceID
-	(*timestamppb.Timestamp)(nil),                                        // 88: google.protobuf.Timestamp
-	(*v1.AccessList)(nil),                                                // 89: teleport.accesslist.v1.AccessList
-	(*KubeResource)(nil),                                                 // 90: teleport.lib.teleterm.v1.KubeResource
-	(*Cluster)(nil),                                                      // 91: teleport.lib.teleterm.v1.Cluster
-	(*DatabaseServer)(nil),                                               // 92: teleport.lib.teleterm.v1.DatabaseServer
-	(*Gateway)(nil),                                                      // 93: teleport.lib.teleterm.v1.Gateway
-	(*Server)(nil),                                                       // 94: teleport.lib.teleterm.v1.Server
-	(*Database)(nil),                                                     // 95: teleport.lib.teleterm.v1.Database
-	(*Kube)(nil),                                                         // 96: teleport.lib.teleterm.v1.Kube
-	(*App)(nil),                                                          // 97: teleport.lib.teleterm.v1.App
-	(*WindowsDesktop)(nil),                                               // 98: teleport.lib.teleterm.v1.WindowsDesktop
-	(*v11.ClusterUserPreferences)(nil),                                   // 99: teleport.userpreferences.v1.ClusterUserPreferences
-	(*v11.UnifiedResourcePreferences)(nil),                               // 100: teleport.userpreferences.v1.UnifiedResourcePreferences
-	(*v12.DeviceWebToken)(nil),                                           // 101: teleport.devicetrust.v1.DeviceWebToken
-	(*v12.DeviceConfirmationToken)(nil),                                  // 102: teleport.devicetrust.v1.DeviceConfirmationToken
-	(*ReportUsageEventRequest)(nil),                                      // 103: teleport.lib.teleterm.v1.ReportUsageEventRequest
-	(*AuthSettings)(nil),                                                 // 104: teleport.lib.teleterm.v1.AuthSettings
+	(*GetClusterRequest)(nil),                                            // 4: teleport.lib.teleterm.v1.GetClusterRequest
+	(*LogoutRequest)(nil),                                                // 5: teleport.lib.teleterm.v1.LogoutRequest
+	(*ClearStaleClusterClientsRequest)(nil),                              // 6: teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest
+	(*ClearStaleClusterClientsResponse)(nil),                             // 7: teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse
+	(*StartHeadlessWatcherRequest)(nil),                                  // 8: teleport.lib.teleterm.v1.StartHeadlessWatcherRequest
+	(*StartHeadlessWatcherResponse)(nil),                                 // 9: teleport.lib.teleterm.v1.StartHeadlessWatcherResponse
+	(*GetAccessRequestRequest)(nil),                                      // 10: teleport.lib.teleterm.v1.GetAccessRequestRequest
+	(*GetAccessRequestsRequest)(nil),                                     // 11: teleport.lib.teleterm.v1.GetAccessRequestsRequest
+	(*GetAccessRequestResponse)(nil),                                     // 12: teleport.lib.teleterm.v1.GetAccessRequestResponse
+	(*GetAccessRequestsResponse)(nil),                                    // 13: teleport.lib.teleterm.v1.GetAccessRequestsResponse
+	(*DeleteAccessRequestRequest)(nil),                                   // 14: teleport.lib.teleterm.v1.DeleteAccessRequestRequest
+	(*CreateAccessRequestRequest)(nil),                                   // 15: teleport.lib.teleterm.v1.CreateAccessRequestRequest
+	(*CreateAccessRequestResponse)(nil),                                  // 16: teleport.lib.teleterm.v1.CreateAccessRequestResponse
+	(*AssumeRoleRequest)(nil),                                            // 17: teleport.lib.teleterm.v1.AssumeRoleRequest
+	(*GetRequestableRolesRequest)(nil),                                   // 18: teleport.lib.teleterm.v1.GetRequestableRolesRequest
+	(*GetRequestableRolesResponse)(nil),                                  // 19: teleport.lib.teleterm.v1.GetRequestableRolesResponse
+	(*ReviewAccessRequestRequest)(nil),                                   // 20: teleport.lib.teleterm.v1.ReviewAccessRequestRequest
+	(*ReviewAccessRequestResponse)(nil),                                  // 21: teleport.lib.teleterm.v1.ReviewAccessRequestResponse
+	(*PromoteAccessRequestRequest)(nil),                                  // 22: teleport.lib.teleterm.v1.PromoteAccessRequestRequest
+	(*PromoteAccessRequestResponse)(nil),                                 // 23: teleport.lib.teleterm.v1.PromoteAccessRequestResponse
+	(*GetSuggestedAccessListsRequest)(nil),                               // 24: teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest
+	(*GetSuggestedAccessListsResponse)(nil),                              // 25: teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse
+	(*ListKubernetesResourcesRequest)(nil),                               // 26: teleport.lib.teleterm.v1.ListKubernetesResourcesRequest
+	(*ListKubernetesResourcesResponse)(nil),                              // 27: teleport.lib.teleterm.v1.ListKubernetesResourcesResponse
+	(*ListKubernetesServersRequest)(nil),                                 // 28: teleport.lib.teleterm.v1.ListKubernetesServersRequest
+	(*ListKubernetesServersResponse)(nil),                                // 29: teleport.lib.teleterm.v1.ListKubernetesServersResponse
+	(*CredentialInfo)(nil),                                               // 30: teleport.lib.teleterm.v1.CredentialInfo
+	(*LoginPasswordlessResponse)(nil),                                    // 31: teleport.lib.teleterm.v1.LoginPasswordlessResponse
+	(*LoginPasswordlessRequest)(nil),                                     // 32: teleport.lib.teleterm.v1.LoginPasswordlessRequest
+	(*FileTransferRequest)(nil),                                          // 33: teleport.lib.teleterm.v1.FileTransferRequest
+	(*FileTransferProgress)(nil),                                         // 34: teleport.lib.teleterm.v1.FileTransferProgress
+	(*LoginRequest)(nil),                                                 // 35: teleport.lib.teleterm.v1.LoginRequest
+	(*AddClusterRequest)(nil),                                            // 36: teleport.lib.teleterm.v1.AddClusterRequest
+	(*ListClustersRequest)(nil),                                          // 37: teleport.lib.teleterm.v1.ListClustersRequest
+	(*ListClustersResponse)(nil),                                         // 38: teleport.lib.teleterm.v1.ListClustersResponse
+	(*ListLeafClustersRequest)(nil),                                      // 39: teleport.lib.teleterm.v1.ListLeafClustersRequest
+	(*ListDatabaseUsersRequest)(nil),                                     // 40: teleport.lib.teleterm.v1.ListDatabaseUsersRequest
+	(*ListDatabaseUsersResponse)(nil),                                    // 41: teleport.lib.teleterm.v1.ListDatabaseUsersResponse
+	(*ListResourcesParams)(nil),                                          // 42: teleport.lib.teleterm.v1.ListResourcesParams
+	(*ListDatabaseServersRequest)(nil),                                   // 43: teleport.lib.teleterm.v1.ListDatabaseServersRequest
+	(*ListDatabaseServersResponse)(nil),                                  // 44: teleport.lib.teleterm.v1.ListDatabaseServersResponse
+	(*CreateGatewayRequest)(nil),                                         // 45: teleport.lib.teleterm.v1.CreateGatewayRequest
+	(*ListGatewaysRequest)(nil),                                          // 46: teleport.lib.teleterm.v1.ListGatewaysRequest
+	(*ListGatewaysResponse)(nil),                                         // 47: teleport.lib.teleterm.v1.ListGatewaysResponse
+	(*RemoveGatewayRequest)(nil),                                         // 48: teleport.lib.teleterm.v1.RemoveGatewayRequest
+	(*SetGatewayTargetSubresourceNameRequest)(nil),                       // 49: teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest
+	(*SetGatewayLocalPortRequest)(nil),                                   // 50: teleport.lib.teleterm.v1.SetGatewayLocalPortRequest
+	(*GetAuthSettingsRequest)(nil),                                       // 51: teleport.lib.teleterm.v1.GetAuthSettingsRequest
+	(*UpdateTshdEventsServerAddressRequest)(nil),                         // 52: teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest
+	(*UpdateTshdEventsServerAddressResponse)(nil),                        // 53: teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse
+	(*UpdateHeadlessAuthenticationStateRequest)(nil),                     // 54: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest
+	(*UpdateHeadlessAuthenticationStateResponse)(nil),                    // 55: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse
+	(*CreateConnectMyComputerRoleRequest)(nil),                           // 56: teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest
+	(*CreateConnectMyComputerRoleResponse)(nil),                          // 57: teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse
+	(*CreateConnectMyComputerNodeTokenRequest)(nil),                      // 58: teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest
+	(*CreateConnectMyComputerNodeTokenResponse)(nil),                     // 59: teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse
+	(*WaitForConnectMyComputerNodeJoinRequest)(nil),                      // 60: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest
+	(*WaitForConnectMyComputerNodeJoinResponse)(nil),                     // 61: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse
+	(*DeleteConnectMyComputerNodeRequest)(nil),                           // 62: teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest
+	(*DeleteConnectMyComputerNodeResponse)(nil),                          // 63: teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse
+	(*GetConnectMyComputerNodeNameRequest)(nil),                          // 64: teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest
+	(*GetConnectMyComputerNodeNameResponse)(nil),                         // 65: teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse
+	(*ListUnifiedResourcesRequest)(nil),                                  // 66: teleport.lib.teleterm.v1.ListUnifiedResourcesRequest
+	(*SortBy)(nil),                                                       // 67: teleport.lib.teleterm.v1.SortBy
+	(*ListUnifiedResourcesResponse)(nil),                                 // 68: teleport.lib.teleterm.v1.ListUnifiedResourcesResponse
+	(*PaginatedResource)(nil),                                            // 69: teleport.lib.teleterm.v1.PaginatedResource
+	(*GetUserPreferencesRequest)(nil),                                    // 70: teleport.lib.teleterm.v1.GetUserPreferencesRequest
+	(*GetUserPreferencesResponse)(nil),                                   // 71: teleport.lib.teleterm.v1.GetUserPreferencesResponse
+	(*UpdateUserPreferencesRequest)(nil),                                 // 72: teleport.lib.teleterm.v1.UpdateUserPreferencesRequest
+	(*UpdateUserPreferencesResponse)(nil),                                // 73: teleport.lib.teleterm.v1.UpdateUserPreferencesResponse
+	(*UserPreferences)(nil),                                              // 74: teleport.lib.teleterm.v1.UserPreferences
+	(*AuthenticateWebDeviceRequest)(nil),                                 // 75: teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest
+	(*AuthenticateWebDeviceResponse)(nil),                                // 76: teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse
+	(*GetAppRequest)(nil),                                                // 77: teleport.lib.teleterm.v1.GetAppRequest
+	(*GetAppResponse)(nil),                                               // 78: teleport.lib.teleterm.v1.GetAppResponse
+	(*TargetDesktop)(nil),                                                // 79: teleport.lib.teleterm.v1.TargetDesktop
+	(*ConnectToDesktopRequest)(nil),                                      // 80: teleport.lib.teleterm.v1.ConnectToDesktopRequest
+	(*ConnectToDesktopResponse)(nil),                                     // 81: teleport.lib.teleterm.v1.ConnectToDesktopResponse
+	(*SetSharedDirectoryForDesktopSessionRequest)(nil),                   // 82: teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionRequest
+	(*SetSharedDirectoryForDesktopSessionResponse)(nil),                  // 83: teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionResponse
+	(*LoginPasswordlessRequest_LoginPasswordlessRequestInit)(nil),        // 84: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessRequestInit
+	(*LoginPasswordlessRequest_LoginPasswordlessPINResponse)(nil),        // 85: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessPINResponse
+	(*LoginPasswordlessRequest_LoginPasswordlessCredentialResponse)(nil), // 86: teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessCredentialResponse
+	(*LoginRequest_LocalParams)(nil),                                     // 87: teleport.lib.teleterm.v1.LoginRequest.LocalParams
+	(*LoginRequest_SsoParams)(nil),                                       // 88: teleport.lib.teleterm.v1.LoginRequest.SsoParams
+	(*AccessRequest)(nil),                                                // 89: teleport.lib.teleterm.v1.AccessRequest
+	(*ResourceID)(nil),                                                   // 90: teleport.lib.teleterm.v1.ResourceID
+	(*timestamppb.Timestamp)(nil),                                        // 91: google.protobuf.Timestamp
+	(*v1.AccessList)(nil),                                                // 92: teleport.accesslist.v1.AccessList
+	(*KubeResource)(nil),                                                 // 93: teleport.lib.teleterm.v1.KubeResource
+	(*KubeServer)(nil),                                                   // 94: teleport.lib.teleterm.v1.KubeServer
+	(*Cluster)(nil),                                                      // 95: teleport.lib.teleterm.v1.Cluster
+	(*DatabaseServer)(nil),                                               // 96: teleport.lib.teleterm.v1.DatabaseServer
+	(*Gateway)(nil),                                                      // 97: teleport.lib.teleterm.v1.Gateway
+	(*Server)(nil),                                                       // 98: teleport.lib.teleterm.v1.Server
+	(*Database)(nil),                                                     // 99: teleport.lib.teleterm.v1.Database
+	(*Kube)(nil),                                                         // 100: teleport.lib.teleterm.v1.Kube
+	(*App)(nil),                                                          // 101: teleport.lib.teleterm.v1.App
+	(*WindowsDesktop)(nil),                                               // 102: teleport.lib.teleterm.v1.WindowsDesktop
+	(*v11.ClusterUserPreferences)(nil),                                   // 103: teleport.userpreferences.v1.ClusterUserPreferences
+	(*v11.UnifiedResourcePreferences)(nil),                               // 104: teleport.userpreferences.v1.UnifiedResourcePreferences
+	(*v12.DeviceWebToken)(nil),                                           // 105: teleport.devicetrust.v1.DeviceWebToken
+	(*v12.DeviceConfirmationToken)(nil),                                  // 106: teleport.devicetrust.v1.DeviceConfirmationToken
+	(*ReportUsageEventRequest)(nil),                                      // 107: teleport.lib.teleterm.v1.ReportUsageEventRequest
+	(*AuthSettings)(nil),                                                 // 108: teleport.lib.teleterm.v1.AuthSettings
 }
 var file_teleport_lib_teleterm_v1_service_proto_depIdxs = []int32{
-	86,  // 0: teleport.lib.teleterm.v1.GetAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
-	86,  // 1: teleport.lib.teleterm.v1.GetAccessRequestsResponse.requests:type_name -> teleport.lib.teleterm.v1.AccessRequest
-	87,  // 2: teleport.lib.teleterm.v1.CreateAccessRequestRequest.resource_ids:type_name -> teleport.lib.teleterm.v1.ResourceID
-	88,  // 3: teleport.lib.teleterm.v1.CreateAccessRequestRequest.assume_start_time:type_name -> google.protobuf.Timestamp
-	88,  // 4: teleport.lib.teleterm.v1.CreateAccessRequestRequest.max_duration:type_name -> google.protobuf.Timestamp
-	88,  // 5: teleport.lib.teleterm.v1.CreateAccessRequestRequest.request_ttl:type_name -> google.protobuf.Timestamp
-	86,  // 6: teleport.lib.teleterm.v1.CreateAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
-	87,  // 7: teleport.lib.teleterm.v1.GetRequestableRolesRequest.resource_ids:type_name -> teleport.lib.teleterm.v1.ResourceID
-	88,  // 8: teleport.lib.teleterm.v1.ReviewAccessRequestRequest.assume_start_time:type_name -> google.protobuf.Timestamp
-	86,  // 9: teleport.lib.teleterm.v1.ReviewAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
-	86,  // 10: teleport.lib.teleterm.v1.PromoteAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
-	89,  // 11: teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
-	90,  // 12: teleport.lib.teleterm.v1.ListKubernetesResourcesResponse.resources:type_name -> teleport.lib.teleterm.v1.KubeResource
-	0,   // 13: teleport.lib.teleterm.v1.LoginPasswordlessResponse.prompt:type_name -> teleport.lib.teleterm.v1.PasswordlessPrompt
-	27,  // 14: teleport.lib.teleterm.v1.LoginPasswordlessResponse.credentials:type_name -> teleport.lib.teleterm.v1.CredentialInfo
-	81,  // 15: teleport.lib.teleterm.v1.LoginPasswordlessRequest.init:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessRequestInit
-	82,  // 16: teleport.lib.teleterm.v1.LoginPasswordlessRequest.pin:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessPINResponse
-	83,  // 17: teleport.lib.teleterm.v1.LoginPasswordlessRequest.credential:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessCredentialResponse
-	1,   // 18: teleport.lib.teleterm.v1.FileTransferRequest.direction:type_name -> teleport.lib.teleterm.v1.FileTransferDirection
-	84,  // 19: teleport.lib.teleterm.v1.LoginRequest.local:type_name -> teleport.lib.teleterm.v1.LoginRequest.LocalParams
-	85,  // 20: teleport.lib.teleterm.v1.LoginRequest.sso:type_name -> teleport.lib.teleterm.v1.LoginRequest.SsoParams
-	91,  // 21: teleport.lib.teleterm.v1.ListClustersResponse.clusters:type_name -> teleport.lib.teleterm.v1.Cluster
-	39,  // 22: teleport.lib.teleterm.v1.ListDatabaseServersRequest.params:type_name -> teleport.lib.teleterm.v1.ListResourcesParams
-	92,  // 23: teleport.lib.teleterm.v1.ListDatabaseServersResponse.resources:type_name -> teleport.lib.teleterm.v1.DatabaseServer
-	93,  // 24: teleport.lib.teleterm.v1.ListGatewaysResponse.gateways:type_name -> teleport.lib.teleterm.v1.Gateway
-	2,   // 25: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest.state:type_name -> teleport.lib.teleterm.v1.HeadlessAuthenticationState
-	94,  // 26: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse.server:type_name -> teleport.lib.teleterm.v1.Server
-	64,  // 27: teleport.lib.teleterm.v1.ListUnifiedResourcesRequest.sort_by:type_name -> teleport.lib.teleterm.v1.SortBy
-	66,  // 28: teleport.lib.teleterm.v1.ListUnifiedResourcesResponse.resources:type_name -> teleport.lib.teleterm.v1.PaginatedResource
-	95,  // 29: teleport.lib.teleterm.v1.PaginatedResource.database:type_name -> teleport.lib.teleterm.v1.Database
-	94,  // 30: teleport.lib.teleterm.v1.PaginatedResource.server:type_name -> teleport.lib.teleterm.v1.Server
-	96,  // 31: teleport.lib.teleterm.v1.PaginatedResource.kube:type_name -> teleport.lib.teleterm.v1.Kube
-	97,  // 32: teleport.lib.teleterm.v1.PaginatedResource.app:type_name -> teleport.lib.teleterm.v1.App
-	98,  // 33: teleport.lib.teleterm.v1.PaginatedResource.windows_desktop:type_name -> teleport.lib.teleterm.v1.WindowsDesktop
-	71,  // 34: teleport.lib.teleterm.v1.GetUserPreferencesResponse.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
-	71,  // 35: teleport.lib.teleterm.v1.UpdateUserPreferencesRequest.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
-	71,  // 36: teleport.lib.teleterm.v1.UpdateUserPreferencesResponse.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
-	99,  // 37: teleport.lib.teleterm.v1.UserPreferences.cluster_preferences:type_name -> teleport.userpreferences.v1.ClusterUserPreferences
-	100, // 38: teleport.lib.teleterm.v1.UserPreferences.unified_resource_preferences:type_name -> teleport.userpreferences.v1.UnifiedResourcePreferences
-	101, // 39: teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest.device_web_token:type_name -> teleport.devicetrust.v1.DeviceWebToken
-	102, // 40: teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse.confirmation_token:type_name -> teleport.devicetrust.v1.DeviceConfirmationToken
-	97,  // 41: teleport.lib.teleterm.v1.GetAppResponse.app:type_name -> teleport.lib.teleterm.v1.App
-	76,  // 42: teleport.lib.teleterm.v1.ConnectToDesktopRequest.target_desktop:type_name -> teleport.lib.teleterm.v1.TargetDesktop
-	49,  // 43: teleport.lib.teleterm.v1.TerminalService.UpdateTshdEventsServerAddress:input_type -> teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest
-	34,  // 44: teleport.lib.teleterm.v1.TerminalService.ListRootClusters:input_type -> teleport.lib.teleterm.v1.ListClustersRequest
-	36,  // 45: teleport.lib.teleterm.v1.TerminalService.ListLeafClusters:input_type -> teleport.lib.teleterm.v1.ListLeafClustersRequest
-	7,   // 46: teleport.lib.teleterm.v1.TerminalService.StartHeadlessWatcher:input_type -> teleport.lib.teleterm.v1.StartHeadlessWatcherRequest
-	37,  // 47: teleport.lib.teleterm.v1.TerminalService.ListDatabaseUsers:input_type -> teleport.lib.teleterm.v1.ListDatabaseUsersRequest
-	40,  // 48: teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers:input_type -> teleport.lib.teleterm.v1.ListDatabaseServersRequest
-	10,  // 49: teleport.lib.teleterm.v1.TerminalService.GetAccessRequests:input_type -> teleport.lib.teleterm.v1.GetAccessRequestsRequest
-	9,   // 50: teleport.lib.teleterm.v1.TerminalService.GetAccessRequest:input_type -> teleport.lib.teleterm.v1.GetAccessRequestRequest
-	13,  // 51: teleport.lib.teleterm.v1.TerminalService.DeleteAccessRequest:input_type -> teleport.lib.teleterm.v1.DeleteAccessRequestRequest
-	14,  // 52: teleport.lib.teleterm.v1.TerminalService.CreateAccessRequest:input_type -> teleport.lib.teleterm.v1.CreateAccessRequestRequest
-	19,  // 53: teleport.lib.teleterm.v1.TerminalService.ReviewAccessRequest:input_type -> teleport.lib.teleterm.v1.ReviewAccessRequestRequest
-	17,  // 54: teleport.lib.teleterm.v1.TerminalService.GetRequestableRoles:input_type -> teleport.lib.teleterm.v1.GetRequestableRolesRequest
-	16,  // 55: teleport.lib.teleterm.v1.TerminalService.AssumeRole:input_type -> teleport.lib.teleterm.v1.AssumeRoleRequest
-	21,  // 56: teleport.lib.teleterm.v1.TerminalService.PromoteAccessRequest:input_type -> teleport.lib.teleterm.v1.PromoteAccessRequestRequest
-	23,  // 57: teleport.lib.teleterm.v1.TerminalService.GetSuggestedAccessLists:input_type -> teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest
-	25,  // 58: teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources:input_type -> teleport.lib.teleterm.v1.ListKubernetesResourcesRequest
-	33,  // 59: teleport.lib.teleterm.v1.TerminalService.AddCluster:input_type -> teleport.lib.teleterm.v1.AddClusterRequest
-	4,   // 60: teleport.lib.teleterm.v1.TerminalService.RemoveCluster:input_type -> teleport.lib.teleterm.v1.RemoveClusterRequest
-	43,  // 61: teleport.lib.teleterm.v1.TerminalService.ListGateways:input_type -> teleport.lib.teleterm.v1.ListGatewaysRequest
-	42,  // 62: teleport.lib.teleterm.v1.TerminalService.CreateGateway:input_type -> teleport.lib.teleterm.v1.CreateGatewayRequest
-	45,  // 63: teleport.lib.teleterm.v1.TerminalService.RemoveGateway:input_type -> teleport.lib.teleterm.v1.RemoveGatewayRequest
-	46,  // 64: teleport.lib.teleterm.v1.TerminalService.SetGatewayTargetSubresourceName:input_type -> teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest
-	47,  // 65: teleport.lib.teleterm.v1.TerminalService.SetGatewayLocalPort:input_type -> teleport.lib.teleterm.v1.SetGatewayLocalPortRequest
-	48,  // 66: teleport.lib.teleterm.v1.TerminalService.GetAuthSettings:input_type -> teleport.lib.teleterm.v1.GetAuthSettingsRequest
-	5,   // 67: teleport.lib.teleterm.v1.TerminalService.GetCluster:input_type -> teleport.lib.teleterm.v1.GetClusterRequest
-	32,  // 68: teleport.lib.teleterm.v1.TerminalService.Login:input_type -> teleport.lib.teleterm.v1.LoginRequest
-	29,  // 69: teleport.lib.teleterm.v1.TerminalService.LoginPasswordless:input_type -> teleport.lib.teleterm.v1.LoginPasswordlessRequest
-	6,   // 70: teleport.lib.teleterm.v1.TerminalService.Logout:input_type -> teleport.lib.teleterm.v1.LogoutRequest
-	30,  // 71: teleport.lib.teleterm.v1.TerminalService.TransferFile:input_type -> teleport.lib.teleterm.v1.FileTransferRequest
-	103, // 72: teleport.lib.teleterm.v1.TerminalService.ReportUsageEvent:input_type -> teleport.lib.teleterm.v1.ReportUsageEventRequest
-	51,  // 73: teleport.lib.teleterm.v1.TerminalService.UpdateHeadlessAuthenticationState:input_type -> teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest
-	53,  // 74: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerRole:input_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest
-	55,  // 75: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerNodeToken:input_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest
-	57,  // 76: teleport.lib.teleterm.v1.TerminalService.WaitForConnectMyComputerNodeJoin:input_type -> teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest
-	59,  // 77: teleport.lib.teleterm.v1.TerminalService.DeleteConnectMyComputerNode:input_type -> teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest
-	61,  // 78: teleport.lib.teleterm.v1.TerminalService.GetConnectMyComputerNodeName:input_type -> teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest
-	63,  // 79: teleport.lib.teleterm.v1.TerminalService.ListUnifiedResources:input_type -> teleport.lib.teleterm.v1.ListUnifiedResourcesRequest
-	67,  // 80: teleport.lib.teleterm.v1.TerminalService.GetUserPreferences:input_type -> teleport.lib.teleterm.v1.GetUserPreferencesRequest
-	69,  // 81: teleport.lib.teleterm.v1.TerminalService.UpdateUserPreferences:input_type -> teleport.lib.teleterm.v1.UpdateUserPreferencesRequest
-	72,  // 82: teleport.lib.teleterm.v1.TerminalService.AuthenticateWebDevice:input_type -> teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest
-	74,  // 83: teleport.lib.teleterm.v1.TerminalService.GetApp:input_type -> teleport.lib.teleterm.v1.GetAppRequest
-	77,  // 84: teleport.lib.teleterm.v1.TerminalService.ConnectToDesktop:input_type -> teleport.lib.teleterm.v1.ConnectToDesktopRequest
-	79,  // 85: teleport.lib.teleterm.v1.TerminalService.SetSharedDirectoryForDesktopSession:input_type -> teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionRequest
-	50,  // 86: teleport.lib.teleterm.v1.TerminalService.UpdateTshdEventsServerAddress:output_type -> teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse
-	35,  // 87: teleport.lib.teleterm.v1.TerminalService.ListRootClusters:output_type -> teleport.lib.teleterm.v1.ListClustersResponse
-	35,  // 88: teleport.lib.teleterm.v1.TerminalService.ListLeafClusters:output_type -> teleport.lib.teleterm.v1.ListClustersResponse
-	8,   // 89: teleport.lib.teleterm.v1.TerminalService.StartHeadlessWatcher:output_type -> teleport.lib.teleterm.v1.StartHeadlessWatcherResponse
-	38,  // 90: teleport.lib.teleterm.v1.TerminalService.ListDatabaseUsers:output_type -> teleport.lib.teleterm.v1.ListDatabaseUsersResponse
-	41,  // 91: teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers:output_type -> teleport.lib.teleterm.v1.ListDatabaseServersResponse
-	12,  // 92: teleport.lib.teleterm.v1.TerminalService.GetAccessRequests:output_type -> teleport.lib.teleterm.v1.GetAccessRequestsResponse
-	11,  // 93: teleport.lib.teleterm.v1.TerminalService.GetAccessRequest:output_type -> teleport.lib.teleterm.v1.GetAccessRequestResponse
-	3,   // 94: teleport.lib.teleterm.v1.TerminalService.DeleteAccessRequest:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	15,  // 95: teleport.lib.teleterm.v1.TerminalService.CreateAccessRequest:output_type -> teleport.lib.teleterm.v1.CreateAccessRequestResponse
-	20,  // 96: teleport.lib.teleterm.v1.TerminalService.ReviewAccessRequest:output_type -> teleport.lib.teleterm.v1.ReviewAccessRequestResponse
-	18,  // 97: teleport.lib.teleterm.v1.TerminalService.GetRequestableRoles:output_type -> teleport.lib.teleterm.v1.GetRequestableRolesResponse
-	3,   // 98: teleport.lib.teleterm.v1.TerminalService.AssumeRole:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	22,  // 99: teleport.lib.teleterm.v1.TerminalService.PromoteAccessRequest:output_type -> teleport.lib.teleterm.v1.PromoteAccessRequestResponse
-	24,  // 100: teleport.lib.teleterm.v1.TerminalService.GetSuggestedAccessLists:output_type -> teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse
-	26,  // 101: teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources:output_type -> teleport.lib.teleterm.v1.ListKubernetesResourcesResponse
-	91,  // 102: teleport.lib.teleterm.v1.TerminalService.AddCluster:output_type -> teleport.lib.teleterm.v1.Cluster
-	3,   // 103: teleport.lib.teleterm.v1.TerminalService.RemoveCluster:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	44,  // 104: teleport.lib.teleterm.v1.TerminalService.ListGateways:output_type -> teleport.lib.teleterm.v1.ListGatewaysResponse
-	93,  // 105: teleport.lib.teleterm.v1.TerminalService.CreateGateway:output_type -> teleport.lib.teleterm.v1.Gateway
-	3,   // 106: teleport.lib.teleterm.v1.TerminalService.RemoveGateway:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	93,  // 107: teleport.lib.teleterm.v1.TerminalService.SetGatewayTargetSubresourceName:output_type -> teleport.lib.teleterm.v1.Gateway
-	93,  // 108: teleport.lib.teleterm.v1.TerminalService.SetGatewayLocalPort:output_type -> teleport.lib.teleterm.v1.Gateway
-	104, // 109: teleport.lib.teleterm.v1.TerminalService.GetAuthSettings:output_type -> teleport.lib.teleterm.v1.AuthSettings
-	91,  // 110: teleport.lib.teleterm.v1.TerminalService.GetCluster:output_type -> teleport.lib.teleterm.v1.Cluster
-	3,   // 111: teleport.lib.teleterm.v1.TerminalService.Login:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	28,  // 112: teleport.lib.teleterm.v1.TerminalService.LoginPasswordless:output_type -> teleport.lib.teleterm.v1.LoginPasswordlessResponse
-	3,   // 113: teleport.lib.teleterm.v1.TerminalService.Logout:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	31,  // 114: teleport.lib.teleterm.v1.TerminalService.TransferFile:output_type -> teleport.lib.teleterm.v1.FileTransferProgress
-	3,   // 115: teleport.lib.teleterm.v1.TerminalService.ReportUsageEvent:output_type -> teleport.lib.teleterm.v1.EmptyResponse
-	52,  // 116: teleport.lib.teleterm.v1.TerminalService.UpdateHeadlessAuthenticationState:output_type -> teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse
-	54,  // 117: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerRole:output_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse
-	56,  // 118: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerNodeToken:output_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse
-	58,  // 119: teleport.lib.teleterm.v1.TerminalService.WaitForConnectMyComputerNodeJoin:output_type -> teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse
-	60,  // 120: teleport.lib.teleterm.v1.TerminalService.DeleteConnectMyComputerNode:output_type -> teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse
-	62,  // 121: teleport.lib.teleterm.v1.TerminalService.GetConnectMyComputerNodeName:output_type -> teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse
-	65,  // 122: teleport.lib.teleterm.v1.TerminalService.ListUnifiedResources:output_type -> teleport.lib.teleterm.v1.ListUnifiedResourcesResponse
-	68,  // 123: teleport.lib.teleterm.v1.TerminalService.GetUserPreferences:output_type -> teleport.lib.teleterm.v1.GetUserPreferencesResponse
-	70,  // 124: teleport.lib.teleterm.v1.TerminalService.UpdateUserPreferences:output_type -> teleport.lib.teleterm.v1.UpdateUserPreferencesResponse
-	73,  // 125: teleport.lib.teleterm.v1.TerminalService.AuthenticateWebDevice:output_type -> teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse
-	75,  // 126: teleport.lib.teleterm.v1.TerminalService.GetApp:output_type -> teleport.lib.teleterm.v1.GetAppResponse
-	78,  // 127: teleport.lib.teleterm.v1.TerminalService.ConnectToDesktop:output_type -> teleport.lib.teleterm.v1.ConnectToDesktopResponse
-	80,  // 128: teleport.lib.teleterm.v1.TerminalService.SetSharedDirectoryForDesktopSession:output_type -> teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionResponse
-	86,  // [86:129] is the sub-list for method output_type
-	43,  // [43:86] is the sub-list for method input_type
-	43,  // [43:43] is the sub-list for extension type_name
-	43,  // [43:43] is the sub-list for extension extendee
-	0,   // [0:43] is the sub-list for field type_name
+	89,  // 0: teleport.lib.teleterm.v1.GetAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
+	89,  // 1: teleport.lib.teleterm.v1.GetAccessRequestsResponse.requests:type_name -> teleport.lib.teleterm.v1.AccessRequest
+	90,  // 2: teleport.lib.teleterm.v1.CreateAccessRequestRequest.resource_ids:type_name -> teleport.lib.teleterm.v1.ResourceID
+	91,  // 3: teleport.lib.teleterm.v1.CreateAccessRequestRequest.assume_start_time:type_name -> google.protobuf.Timestamp
+	91,  // 4: teleport.lib.teleterm.v1.CreateAccessRequestRequest.max_duration:type_name -> google.protobuf.Timestamp
+	91,  // 5: teleport.lib.teleterm.v1.CreateAccessRequestRequest.request_ttl:type_name -> google.protobuf.Timestamp
+	89,  // 6: teleport.lib.teleterm.v1.CreateAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
+	90,  // 7: teleport.lib.teleterm.v1.GetRequestableRolesRequest.resource_ids:type_name -> teleport.lib.teleterm.v1.ResourceID
+	91,  // 8: teleport.lib.teleterm.v1.ReviewAccessRequestRequest.assume_start_time:type_name -> google.protobuf.Timestamp
+	89,  // 9: teleport.lib.teleterm.v1.ReviewAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
+	89,  // 10: teleport.lib.teleterm.v1.PromoteAccessRequestResponse.request:type_name -> teleport.lib.teleterm.v1.AccessRequest
+	92,  // 11: teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse.access_lists:type_name -> teleport.accesslist.v1.AccessList
+	93,  // 12: teleport.lib.teleterm.v1.ListKubernetesResourcesResponse.resources:type_name -> teleport.lib.teleterm.v1.KubeResource
+	42,  // 13: teleport.lib.teleterm.v1.ListKubernetesServersRequest.params:type_name -> teleport.lib.teleterm.v1.ListResourcesParams
+	94,  // 14: teleport.lib.teleterm.v1.ListKubernetesServersResponse.resources:type_name -> teleport.lib.teleterm.v1.KubeServer
+	0,   // 15: teleport.lib.teleterm.v1.LoginPasswordlessResponse.prompt:type_name -> teleport.lib.teleterm.v1.PasswordlessPrompt
+	30,  // 16: teleport.lib.teleterm.v1.LoginPasswordlessResponse.credentials:type_name -> teleport.lib.teleterm.v1.CredentialInfo
+	84,  // 17: teleport.lib.teleterm.v1.LoginPasswordlessRequest.init:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessRequestInit
+	85,  // 18: teleport.lib.teleterm.v1.LoginPasswordlessRequest.pin:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessPINResponse
+	86,  // 19: teleport.lib.teleterm.v1.LoginPasswordlessRequest.credential:type_name -> teleport.lib.teleterm.v1.LoginPasswordlessRequest.LoginPasswordlessCredentialResponse
+	1,   // 20: teleport.lib.teleterm.v1.FileTransferRequest.direction:type_name -> teleport.lib.teleterm.v1.FileTransferDirection
+	87,  // 21: teleport.lib.teleterm.v1.LoginRequest.local:type_name -> teleport.lib.teleterm.v1.LoginRequest.LocalParams
+	88,  // 22: teleport.lib.teleterm.v1.LoginRequest.sso:type_name -> teleport.lib.teleterm.v1.LoginRequest.SsoParams
+	95,  // 23: teleport.lib.teleterm.v1.ListClustersResponse.clusters:type_name -> teleport.lib.teleterm.v1.Cluster
+	42,  // 24: teleport.lib.teleterm.v1.ListDatabaseServersRequest.params:type_name -> teleport.lib.teleterm.v1.ListResourcesParams
+	96,  // 25: teleport.lib.teleterm.v1.ListDatabaseServersResponse.resources:type_name -> teleport.lib.teleterm.v1.DatabaseServer
+	97,  // 26: teleport.lib.teleterm.v1.ListGatewaysResponse.gateways:type_name -> teleport.lib.teleterm.v1.Gateway
+	2,   // 27: teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest.state:type_name -> teleport.lib.teleterm.v1.HeadlessAuthenticationState
+	98,  // 28: teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse.server:type_name -> teleport.lib.teleterm.v1.Server
+	67,  // 29: teleport.lib.teleterm.v1.ListUnifiedResourcesRequest.sort_by:type_name -> teleport.lib.teleterm.v1.SortBy
+	69,  // 30: teleport.lib.teleterm.v1.ListUnifiedResourcesResponse.resources:type_name -> teleport.lib.teleterm.v1.PaginatedResource
+	99,  // 31: teleport.lib.teleterm.v1.PaginatedResource.database:type_name -> teleport.lib.teleterm.v1.Database
+	98,  // 32: teleport.lib.teleterm.v1.PaginatedResource.server:type_name -> teleport.lib.teleterm.v1.Server
+	100, // 33: teleport.lib.teleterm.v1.PaginatedResource.kube:type_name -> teleport.lib.teleterm.v1.Kube
+	101, // 34: teleport.lib.teleterm.v1.PaginatedResource.app:type_name -> teleport.lib.teleterm.v1.App
+	102, // 35: teleport.lib.teleterm.v1.PaginatedResource.windows_desktop:type_name -> teleport.lib.teleterm.v1.WindowsDesktop
+	74,  // 36: teleport.lib.teleterm.v1.GetUserPreferencesResponse.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
+	74,  // 37: teleport.lib.teleterm.v1.UpdateUserPreferencesRequest.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
+	74,  // 38: teleport.lib.teleterm.v1.UpdateUserPreferencesResponse.user_preferences:type_name -> teleport.lib.teleterm.v1.UserPreferences
+	103, // 39: teleport.lib.teleterm.v1.UserPreferences.cluster_preferences:type_name -> teleport.userpreferences.v1.ClusterUserPreferences
+	104, // 40: teleport.lib.teleterm.v1.UserPreferences.unified_resource_preferences:type_name -> teleport.userpreferences.v1.UnifiedResourcePreferences
+	105, // 41: teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest.device_web_token:type_name -> teleport.devicetrust.v1.DeviceWebToken
+	106, // 42: teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse.confirmation_token:type_name -> teleport.devicetrust.v1.DeviceConfirmationToken
+	101, // 43: teleport.lib.teleterm.v1.GetAppResponse.app:type_name -> teleport.lib.teleterm.v1.App
+	79,  // 44: teleport.lib.teleterm.v1.ConnectToDesktopRequest.target_desktop:type_name -> teleport.lib.teleterm.v1.TargetDesktop
+	52,  // 45: teleport.lib.teleterm.v1.TerminalService.UpdateTshdEventsServerAddress:input_type -> teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest
+	37,  // 46: teleport.lib.teleterm.v1.TerminalService.ListRootClusters:input_type -> teleport.lib.teleterm.v1.ListClustersRequest
+	39,  // 47: teleport.lib.teleterm.v1.TerminalService.ListLeafClusters:input_type -> teleport.lib.teleterm.v1.ListLeafClustersRequest
+	8,   // 48: teleport.lib.teleterm.v1.TerminalService.StartHeadlessWatcher:input_type -> teleport.lib.teleterm.v1.StartHeadlessWatcherRequest
+	40,  // 49: teleport.lib.teleterm.v1.TerminalService.ListDatabaseUsers:input_type -> teleport.lib.teleterm.v1.ListDatabaseUsersRequest
+	43,  // 50: teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers:input_type -> teleport.lib.teleterm.v1.ListDatabaseServersRequest
+	11,  // 51: teleport.lib.teleterm.v1.TerminalService.GetAccessRequests:input_type -> teleport.lib.teleterm.v1.GetAccessRequestsRequest
+	10,  // 52: teleport.lib.teleterm.v1.TerminalService.GetAccessRequest:input_type -> teleport.lib.teleterm.v1.GetAccessRequestRequest
+	14,  // 53: teleport.lib.teleterm.v1.TerminalService.DeleteAccessRequest:input_type -> teleport.lib.teleterm.v1.DeleteAccessRequestRequest
+	15,  // 54: teleport.lib.teleterm.v1.TerminalService.CreateAccessRequest:input_type -> teleport.lib.teleterm.v1.CreateAccessRequestRequest
+	20,  // 55: teleport.lib.teleterm.v1.TerminalService.ReviewAccessRequest:input_type -> teleport.lib.teleterm.v1.ReviewAccessRequestRequest
+	18,  // 56: teleport.lib.teleterm.v1.TerminalService.GetRequestableRoles:input_type -> teleport.lib.teleterm.v1.GetRequestableRolesRequest
+	17,  // 57: teleport.lib.teleterm.v1.TerminalService.AssumeRole:input_type -> teleport.lib.teleterm.v1.AssumeRoleRequest
+	22,  // 58: teleport.lib.teleterm.v1.TerminalService.PromoteAccessRequest:input_type -> teleport.lib.teleterm.v1.PromoteAccessRequestRequest
+	24,  // 59: teleport.lib.teleterm.v1.TerminalService.GetSuggestedAccessLists:input_type -> teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest
+	26,  // 60: teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources:input_type -> teleport.lib.teleterm.v1.ListKubernetesResourcesRequest
+	28,  // 61: teleport.lib.teleterm.v1.TerminalService.ListKubernetesServers:input_type -> teleport.lib.teleterm.v1.ListKubernetesServersRequest
+	36,  // 62: teleport.lib.teleterm.v1.TerminalService.AddCluster:input_type -> teleport.lib.teleterm.v1.AddClusterRequest
+	46,  // 63: teleport.lib.teleterm.v1.TerminalService.ListGateways:input_type -> teleport.lib.teleterm.v1.ListGatewaysRequest
+	45,  // 64: teleport.lib.teleterm.v1.TerminalService.CreateGateway:input_type -> teleport.lib.teleterm.v1.CreateGatewayRequest
+	48,  // 65: teleport.lib.teleterm.v1.TerminalService.RemoveGateway:input_type -> teleport.lib.teleterm.v1.RemoveGatewayRequest
+	49,  // 66: teleport.lib.teleterm.v1.TerminalService.SetGatewayTargetSubresourceName:input_type -> teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest
+	50,  // 67: teleport.lib.teleterm.v1.TerminalService.SetGatewayLocalPort:input_type -> teleport.lib.teleterm.v1.SetGatewayLocalPortRequest
+	51,  // 68: teleport.lib.teleterm.v1.TerminalService.GetAuthSettings:input_type -> teleport.lib.teleterm.v1.GetAuthSettingsRequest
+	4,   // 69: teleport.lib.teleterm.v1.TerminalService.GetCluster:input_type -> teleport.lib.teleterm.v1.GetClusterRequest
+	35,  // 70: teleport.lib.teleterm.v1.TerminalService.Login:input_type -> teleport.lib.teleterm.v1.LoginRequest
+	32,  // 71: teleport.lib.teleterm.v1.TerminalService.LoginPasswordless:input_type -> teleport.lib.teleterm.v1.LoginPasswordlessRequest
+	5,   // 72: teleport.lib.teleterm.v1.TerminalService.Logout:input_type -> teleport.lib.teleterm.v1.LogoutRequest
+	6,   // 73: teleport.lib.teleterm.v1.TerminalService.ClearStaleClusterClients:input_type -> teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest
+	33,  // 74: teleport.lib.teleterm.v1.TerminalService.TransferFile:input_type -> teleport.lib.teleterm.v1.FileTransferRequest
+	107, // 75: teleport.lib.teleterm.v1.TerminalService.ReportUsageEvent:input_type -> teleport.lib.teleterm.v1.ReportUsageEventRequest
+	54,  // 76: teleport.lib.teleterm.v1.TerminalService.UpdateHeadlessAuthenticationState:input_type -> teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest
+	56,  // 77: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerRole:input_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest
+	58,  // 78: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerNodeToken:input_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest
+	60,  // 79: teleport.lib.teleterm.v1.TerminalService.WaitForConnectMyComputerNodeJoin:input_type -> teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest
+	62,  // 80: teleport.lib.teleterm.v1.TerminalService.DeleteConnectMyComputerNode:input_type -> teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest
+	64,  // 81: teleport.lib.teleterm.v1.TerminalService.GetConnectMyComputerNodeName:input_type -> teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest
+	66,  // 82: teleport.lib.teleterm.v1.TerminalService.ListUnifiedResources:input_type -> teleport.lib.teleterm.v1.ListUnifiedResourcesRequest
+	70,  // 83: teleport.lib.teleterm.v1.TerminalService.GetUserPreferences:input_type -> teleport.lib.teleterm.v1.GetUserPreferencesRequest
+	72,  // 84: teleport.lib.teleterm.v1.TerminalService.UpdateUserPreferences:input_type -> teleport.lib.teleterm.v1.UpdateUserPreferencesRequest
+	75,  // 85: teleport.lib.teleterm.v1.TerminalService.AuthenticateWebDevice:input_type -> teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest
+	77,  // 86: teleport.lib.teleterm.v1.TerminalService.GetApp:input_type -> teleport.lib.teleterm.v1.GetAppRequest
+	80,  // 87: teleport.lib.teleterm.v1.TerminalService.ConnectToDesktop:input_type -> teleport.lib.teleterm.v1.ConnectToDesktopRequest
+	82,  // 88: teleport.lib.teleterm.v1.TerminalService.SetSharedDirectoryForDesktopSession:input_type -> teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionRequest
+	53,  // 89: teleport.lib.teleterm.v1.TerminalService.UpdateTshdEventsServerAddress:output_type -> teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse
+	38,  // 90: teleport.lib.teleterm.v1.TerminalService.ListRootClusters:output_type -> teleport.lib.teleterm.v1.ListClustersResponse
+	38,  // 91: teleport.lib.teleterm.v1.TerminalService.ListLeafClusters:output_type -> teleport.lib.teleterm.v1.ListClustersResponse
+	9,   // 92: teleport.lib.teleterm.v1.TerminalService.StartHeadlessWatcher:output_type -> teleport.lib.teleterm.v1.StartHeadlessWatcherResponse
+	41,  // 93: teleport.lib.teleterm.v1.TerminalService.ListDatabaseUsers:output_type -> teleport.lib.teleterm.v1.ListDatabaseUsersResponse
+	44,  // 94: teleport.lib.teleterm.v1.TerminalService.ListDatabaseServers:output_type -> teleport.lib.teleterm.v1.ListDatabaseServersResponse
+	13,  // 95: teleport.lib.teleterm.v1.TerminalService.GetAccessRequests:output_type -> teleport.lib.teleterm.v1.GetAccessRequestsResponse
+	12,  // 96: teleport.lib.teleterm.v1.TerminalService.GetAccessRequest:output_type -> teleport.lib.teleterm.v1.GetAccessRequestResponse
+	3,   // 97: teleport.lib.teleterm.v1.TerminalService.DeleteAccessRequest:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	16,  // 98: teleport.lib.teleterm.v1.TerminalService.CreateAccessRequest:output_type -> teleport.lib.teleterm.v1.CreateAccessRequestResponse
+	21,  // 99: teleport.lib.teleterm.v1.TerminalService.ReviewAccessRequest:output_type -> teleport.lib.teleterm.v1.ReviewAccessRequestResponse
+	19,  // 100: teleport.lib.teleterm.v1.TerminalService.GetRequestableRoles:output_type -> teleport.lib.teleterm.v1.GetRequestableRolesResponse
+	3,   // 101: teleport.lib.teleterm.v1.TerminalService.AssumeRole:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	23,  // 102: teleport.lib.teleterm.v1.TerminalService.PromoteAccessRequest:output_type -> teleport.lib.teleterm.v1.PromoteAccessRequestResponse
+	25,  // 103: teleport.lib.teleterm.v1.TerminalService.GetSuggestedAccessLists:output_type -> teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse
+	27,  // 104: teleport.lib.teleterm.v1.TerminalService.ListKubernetesResources:output_type -> teleport.lib.teleterm.v1.ListKubernetesResourcesResponse
+	29,  // 105: teleport.lib.teleterm.v1.TerminalService.ListKubernetesServers:output_type -> teleport.lib.teleterm.v1.ListKubernetesServersResponse
+	95,  // 106: teleport.lib.teleterm.v1.TerminalService.AddCluster:output_type -> teleport.lib.teleterm.v1.Cluster
+	47,  // 107: teleport.lib.teleterm.v1.TerminalService.ListGateways:output_type -> teleport.lib.teleterm.v1.ListGatewaysResponse
+	97,  // 108: teleport.lib.teleterm.v1.TerminalService.CreateGateway:output_type -> teleport.lib.teleterm.v1.Gateway
+	3,   // 109: teleport.lib.teleterm.v1.TerminalService.RemoveGateway:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	97,  // 110: teleport.lib.teleterm.v1.TerminalService.SetGatewayTargetSubresourceName:output_type -> teleport.lib.teleterm.v1.Gateway
+	97,  // 111: teleport.lib.teleterm.v1.TerminalService.SetGatewayLocalPort:output_type -> teleport.lib.teleterm.v1.Gateway
+	108, // 112: teleport.lib.teleterm.v1.TerminalService.GetAuthSettings:output_type -> teleport.lib.teleterm.v1.AuthSettings
+	95,  // 113: teleport.lib.teleterm.v1.TerminalService.GetCluster:output_type -> teleport.lib.teleterm.v1.Cluster
+	3,   // 114: teleport.lib.teleterm.v1.TerminalService.Login:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	31,  // 115: teleport.lib.teleterm.v1.TerminalService.LoginPasswordless:output_type -> teleport.lib.teleterm.v1.LoginPasswordlessResponse
+	3,   // 116: teleport.lib.teleterm.v1.TerminalService.Logout:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	7,   // 117: teleport.lib.teleterm.v1.TerminalService.ClearStaleClusterClients:output_type -> teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse
+	34,  // 118: teleport.lib.teleterm.v1.TerminalService.TransferFile:output_type -> teleport.lib.teleterm.v1.FileTransferProgress
+	3,   // 119: teleport.lib.teleterm.v1.TerminalService.ReportUsageEvent:output_type -> teleport.lib.teleterm.v1.EmptyResponse
+	55,  // 120: teleport.lib.teleterm.v1.TerminalService.UpdateHeadlessAuthenticationState:output_type -> teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse
+	57,  // 121: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerRole:output_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse
+	59,  // 122: teleport.lib.teleterm.v1.TerminalService.CreateConnectMyComputerNodeToken:output_type -> teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse
+	61,  // 123: teleport.lib.teleterm.v1.TerminalService.WaitForConnectMyComputerNodeJoin:output_type -> teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse
+	63,  // 124: teleport.lib.teleterm.v1.TerminalService.DeleteConnectMyComputerNode:output_type -> teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse
+	65,  // 125: teleport.lib.teleterm.v1.TerminalService.GetConnectMyComputerNodeName:output_type -> teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse
+	68,  // 126: teleport.lib.teleterm.v1.TerminalService.ListUnifiedResources:output_type -> teleport.lib.teleterm.v1.ListUnifiedResourcesResponse
+	71,  // 127: teleport.lib.teleterm.v1.TerminalService.GetUserPreferences:output_type -> teleport.lib.teleterm.v1.GetUserPreferencesResponse
+	73,  // 128: teleport.lib.teleterm.v1.TerminalService.UpdateUserPreferences:output_type -> teleport.lib.teleterm.v1.UpdateUserPreferencesResponse
+	76,  // 129: teleport.lib.teleterm.v1.TerminalService.AuthenticateWebDevice:output_type -> teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse
+	78,  // 130: teleport.lib.teleterm.v1.TerminalService.GetApp:output_type -> teleport.lib.teleterm.v1.GetAppResponse
+	81,  // 131: teleport.lib.teleterm.v1.TerminalService.ConnectToDesktop:output_type -> teleport.lib.teleterm.v1.ConnectToDesktopResponse
+	83,  // 132: teleport.lib.teleterm.v1.TerminalService.SetSharedDirectoryForDesktopSession:output_type -> teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionResponse
+	89,  // [89:133] is the sub-list for method output_type
+	45,  // [45:89] is the sub-list for method input_type
+	45,  // [45:45] is the sub-list for extension type_name
+	45,  // [45:45] is the sub-list for extension extendee
+	0,   // [0:45] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_service_proto_init() }
@@ -5249,16 +5439,16 @@ func file_teleport_lib_teleterm_v1_service_proto_init() {
 	file_teleport_lib_teleterm_v1_server_proto_init()
 	file_teleport_lib_teleterm_v1_usage_events_proto_init()
 	file_teleport_lib_teleterm_v1_windows_desktop_proto_init()
-	file_teleport_lib_teleterm_v1_service_proto_msgTypes[26].OneofWrappers = []any{
+	file_teleport_lib_teleterm_v1_service_proto_msgTypes[29].OneofWrappers = []any{
 		(*LoginPasswordlessRequest_Init)(nil),
 		(*LoginPasswordlessRequest_Pin)(nil),
 		(*LoginPasswordlessRequest_Credential)(nil),
 	}
-	file_teleport_lib_teleterm_v1_service_proto_msgTypes[29].OneofWrappers = []any{
+	file_teleport_lib_teleterm_v1_service_proto_msgTypes[32].OneofWrappers = []any{
 		(*LoginRequest_Local)(nil),
 		(*LoginRequest_Sso)(nil),
 	}
-	file_teleport_lib_teleterm_v1_service_proto_msgTypes[63].OneofWrappers = []any{
+	file_teleport_lib_teleterm_v1_service_proto_msgTypes[66].OneofWrappers = []any{
 		(*PaginatedResource_Database)(nil),
 		(*PaginatedResource_Server)(nil),
 		(*PaginatedResource_Kube)(nil),
@@ -5271,7 +5461,7 @@ func file_teleport_lib_teleterm_v1_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_teleterm_v1_service_proto_rawDesc), len(file_teleport_lib_teleterm_v1_service_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   83,
+			NumMessages:   86,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
index 141df93ab86e2..977818c1c9a68 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
@@ -52,8 +52,8 @@ const (
 	TerminalService_PromoteAccessRequest_FullMethodName                = "/teleport.lib.teleterm.v1.TerminalService/PromoteAccessRequest"
 	TerminalService_GetSuggestedAccessLists_FullMethodName             = "/teleport.lib.teleterm.v1.TerminalService/GetSuggestedAccessLists"
 	TerminalService_ListKubernetesResources_FullMethodName             = "/teleport.lib.teleterm.v1.TerminalService/ListKubernetesResources"
+	TerminalService_ListKubernetesServers_FullMethodName               = "/teleport.lib.teleterm.v1.TerminalService/ListKubernetesServers"
 	TerminalService_AddCluster_FullMethodName                          = "/teleport.lib.teleterm.v1.TerminalService/AddCluster"
-	TerminalService_RemoveCluster_FullMethodName                       = "/teleport.lib.teleterm.v1.TerminalService/RemoveCluster"
 	TerminalService_ListGateways_FullMethodName                        = "/teleport.lib.teleterm.v1.TerminalService/ListGateways"
 	TerminalService_CreateGateway_FullMethodName                       = "/teleport.lib.teleterm.v1.TerminalService/CreateGateway"
 	TerminalService_RemoveGateway_FullMethodName                       = "/teleport.lib.teleterm.v1.TerminalService/RemoveGateway"
@@ -64,6 +64,7 @@ const (
 	TerminalService_Login_FullMethodName                               = "/teleport.lib.teleterm.v1.TerminalService/Login"
 	TerminalService_LoginPasswordless_FullMethodName                   = "/teleport.lib.teleterm.v1.TerminalService/LoginPasswordless"
 	TerminalService_Logout_FullMethodName                              = "/teleport.lib.teleterm.v1.TerminalService/Logout"
+	TerminalService_ClearStaleClusterClients_FullMethodName            = "/teleport.lib.teleterm.v1.TerminalService/ClearStaleClusterClients"
 	TerminalService_TransferFile_FullMethodName                        = "/teleport.lib.teleterm.v1.TerminalService/TransferFile"
 	TerminalService_ReportUsageEvent_FullMethodName                    = "/teleport.lib.teleterm.v1.TerminalService/ReportUsageEvent"
 	TerminalService_UpdateHeadlessAuthenticationState_FullMethodName   = "/teleport.lib.teleterm.v1.TerminalService/UpdateHeadlessAuthenticationState"
@@ -132,10 +133,10 @@ type TerminalServiceClient interface {
 	// ListKubernetesResourcesRequest defines a request to retrieve kube resources paginated.
 	// Only one type of kube resource can be retrieved per request (eg: namespace, pods, secrets, etc.)
 	ListKubernetesResources(ctx context.Context, in *ListKubernetesResourcesRequest, opts ...grpc.CallOption) (*ListKubernetesResourcesResponse, error)
+	// Lists Kubernetes servers.
+	ListKubernetesServers(ctx context.Context, in *ListKubernetesServersRequest, opts ...grpc.CallOption) (*ListKubernetesServersResponse, error)
 	// AddCluster adds a cluster to profile
 	AddCluster(ctx context.Context, in *AddClusterRequest, opts ...grpc.CallOption) (*Cluster, error)
-	// RemoveCluster removes a cluster from profile
-	RemoveCluster(ctx context.Context, in *RemoveClusterRequest, opts ...grpc.CallOption) (*EmptyResponse, error)
 	// ListGateways lists gateways
 	ListGateways(ctx context.Context, in *ListGatewaysRequest, opts ...grpc.CallOption) (*ListGatewaysResponse, error)
 	// CreateGateway creates a gateway
@@ -174,8 +175,12 @@ type TerminalServiceClient interface {
 	// -> Receive the index number associated with the selected credential in list
 	// <- End
 	LoginPasswordless(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[LoginPasswordlessRequest, LoginPasswordlessResponse], error)
-	// ClusterLogin logs out a user from cluster
+	// Logs the user out of the cluster and cleans up associated resources.
+	// Optionally removes the profile.
+	// This operation is idempotent and can be safely invoked multiple times.
 	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*EmptyResponse, error)
+	// Closes root and leaf cluster clients that use outdated TLS certificates.
+	ClearStaleClusterClients(ctx context.Context, in *ClearStaleClusterClientsRequest, opts ...grpc.CallOption) (*ClearStaleClusterClientsResponse, error)
 	// TransferFile sends a request to download/upload a file
 	TransferFile(ctx context.Context, in *FileTransferRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[FileTransferProgress], error)
 	// ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
@@ -395,20 +400,20 @@ func (c *terminalServiceClient) ListKubernetesResources(ctx context.Context, in
 	return out, nil
 }
 
-func (c *terminalServiceClient) AddCluster(ctx context.Context, in *AddClusterRequest, opts ...grpc.CallOption) (*Cluster, error) {
+func (c *terminalServiceClient) ListKubernetesServers(ctx context.Context, in *ListKubernetesServersRequest, opts ...grpc.CallOption) (*ListKubernetesServersResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(Cluster)
-	err := c.cc.Invoke(ctx, TerminalService_AddCluster_FullMethodName, in, out, cOpts...)
+	out := new(ListKubernetesServersResponse)
+	err := c.cc.Invoke(ctx, TerminalService_ListKubernetesServers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *terminalServiceClient) RemoveCluster(ctx context.Context, in *RemoveClusterRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+func (c *terminalServiceClient) AddCluster(ctx context.Context, in *AddClusterRequest, opts ...grpc.CallOption) (*Cluster, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_RemoveCluster_FullMethodName, in, out, cOpts...)
+	out := new(Cluster)
+	err := c.cc.Invoke(ctx, TerminalService_AddCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -518,6 +523,16 @@ func (c *terminalServiceClient) Logout(ctx context.Context, in *LogoutRequest, o
 	return out, nil
 }
 
+func (c *terminalServiceClient) ClearStaleClusterClients(ctx context.Context, in *ClearStaleClusterClientsRequest, opts ...grpc.CallOption) (*ClearStaleClusterClientsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ClearStaleClusterClientsResponse)
+	err := c.cc.Invoke(ctx, TerminalService_ClearStaleClusterClients_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *terminalServiceClient) TransferFile(ctx context.Context, in *FileTransferRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[FileTransferProgress], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &TerminalService_ServiceDesc.Streams[1], TerminalService_TransferFile_FullMethodName, cOpts...)
@@ -731,10 +746,10 @@ type TerminalServiceServer interface {
 	// ListKubernetesResourcesRequest defines a request to retrieve kube resources paginated.
 	// Only one type of kube resource can be retrieved per request (eg: namespace, pods, secrets, etc.)
 	ListKubernetesResources(context.Context, *ListKubernetesResourcesRequest) (*ListKubernetesResourcesResponse, error)
+	// Lists Kubernetes servers.
+	ListKubernetesServers(context.Context, *ListKubernetesServersRequest) (*ListKubernetesServersResponse, error)
 	// AddCluster adds a cluster to profile
 	AddCluster(context.Context, *AddClusterRequest) (*Cluster, error)
-	// RemoveCluster removes a cluster from profile
-	RemoveCluster(context.Context, *RemoveClusterRequest) (*EmptyResponse, error)
 	// ListGateways lists gateways
 	ListGateways(context.Context, *ListGatewaysRequest) (*ListGatewaysResponse, error)
 	// CreateGateway creates a gateway
@@ -773,8 +788,12 @@ type TerminalServiceServer interface {
 	// -> Receive the index number associated with the selected credential in list
 	// <- End
 	LoginPasswordless(grpc.BidiStreamingServer[LoginPasswordlessRequest, LoginPasswordlessResponse]) error
-	// ClusterLogin logs out a user from cluster
+	// Logs the user out of the cluster and cleans up associated resources.
+	// Optionally removes the profile.
+	// This operation is idempotent and can be safely invoked multiple times.
 	Logout(context.Context, *LogoutRequest) (*EmptyResponse, error)
+	// Closes root and leaf cluster clients that use outdated TLS certificates.
+	ClearStaleClusterClients(context.Context, *ClearStaleClusterClientsRequest) (*ClearStaleClusterClientsResponse, error)
 	// TransferFile sends a request to download/upload a file
 	TransferFile(*FileTransferRequest, grpc.ServerStreamingServer[FileTransferProgress]) error
 	// ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
@@ -882,12 +901,12 @@ func (UnimplementedTerminalServiceServer) GetSuggestedAccessLists(context.Contex
 func (UnimplementedTerminalServiceServer) ListKubernetesResources(context.Context, *ListKubernetesResourcesRequest) (*ListKubernetesResourcesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListKubernetesResources not implemented")
 }
+func (UnimplementedTerminalServiceServer) ListKubernetesServers(context.Context, *ListKubernetesServersRequest) (*ListKubernetesServersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListKubernetesServers not implemented")
+}
 func (UnimplementedTerminalServiceServer) AddCluster(context.Context, *AddClusterRequest) (*Cluster, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AddCluster not implemented")
 }
-func (UnimplementedTerminalServiceServer) RemoveCluster(context.Context, *RemoveClusterRequest) (*EmptyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RemoveCluster not implemented")
-}
 func (UnimplementedTerminalServiceServer) ListGateways(context.Context, *ListGatewaysRequest) (*ListGatewaysResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListGateways not implemented")
 }
@@ -918,6 +937,9 @@ func (UnimplementedTerminalServiceServer) LoginPasswordless(grpc.BidiStreamingSe
 func (UnimplementedTerminalServiceServer) Logout(context.Context, *LogoutRequest) (*EmptyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Logout not implemented")
 }
+func (UnimplementedTerminalServiceServer) ClearStaleClusterClients(context.Context, *ClearStaleClusterClientsRequest) (*ClearStaleClusterClientsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ClearStaleClusterClients not implemented")
+}
 func (UnimplementedTerminalServiceServer) TransferFile(*FileTransferRequest, grpc.ServerStreamingServer[FileTransferProgress]) error {
 	return status.Errorf(codes.Unimplemented, "method TransferFile not implemented")
 }
@@ -1272,38 +1294,38 @@ func _TerminalService_ListKubernetesResources_Handler(srv interface{}, ctx conte
 	return interceptor(ctx, in, info, handler)
 }
 
-func _TerminalService_AddCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(AddClusterRequest)
+func _TerminalService_ListKubernetesServers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListKubernetesServersRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(TerminalServiceServer).AddCluster(ctx, in)
+		return srv.(TerminalServiceServer).ListKubernetesServers(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: TerminalService_AddCluster_FullMethodName,
+		FullMethod: TerminalService_ListKubernetesServers_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TerminalServiceServer).AddCluster(ctx, req.(*AddClusterRequest))
+		return srv.(TerminalServiceServer).ListKubernetesServers(ctx, req.(*ListKubernetesServersRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _TerminalService_RemoveCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RemoveClusterRequest)
+func _TerminalService_AddCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddClusterRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(TerminalServiceServer).RemoveCluster(ctx, in)
+		return srv.(TerminalServiceServer).AddCluster(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: TerminalService_RemoveCluster_FullMethodName,
+		FullMethod: TerminalService_AddCluster_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TerminalServiceServer).RemoveCluster(ctx, req.(*RemoveClusterRequest))
+		return srv.(TerminalServiceServer).AddCluster(ctx, req.(*AddClusterRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -1477,6 +1499,24 @@ func _TerminalService_Logout_Handler(srv interface{}, ctx context.Context, dec f
 	return interceptor(ctx, in, info, handler)
 }
 
+func _TerminalService_ClearStaleClusterClients_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ClearStaleClusterClientsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TerminalServiceServer).ClearStaleClusterClients(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TerminalService_ClearStaleClusterClients_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TerminalServiceServer).ClearStaleClusterClients(ctx, req.(*ClearStaleClusterClientsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _TerminalService_TransferFile_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(FileTransferRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -1801,12 +1841,12 @@ var TerminalService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _TerminalService_ListKubernetesResources_Handler,
 		},
 		{
-			MethodName: "AddCluster",
-			Handler:    _TerminalService_AddCluster_Handler,
+			MethodName: "ListKubernetesServers",
+			Handler:    _TerminalService_ListKubernetesServers_Handler,
 		},
 		{
-			MethodName: "RemoveCluster",
-			Handler:    _TerminalService_RemoveCluster_Handler,
+			MethodName: "AddCluster",
+			Handler:    _TerminalService_AddCluster_Handler,
 		},
 		{
 			MethodName: "ListGateways",
@@ -1844,6 +1884,10 @@ var TerminalService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Logout",
 			Handler:    _TerminalService_Logout_Handler,
 		},
+		{
+			MethodName: "ClearStaleClusterClients",
+			Handler:    _TerminalService_ClearStaleClusterClients_Handler,
+		},
 		{
 			MethodName: "ReportUsageEvent",
 			Handler:    _TerminalService_ReportUsageEvent_Handler,
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/target_health.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/target_health.pb.go
index a7551d139d1d2..87ed93d40cdf5 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/target_health.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/target_health.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/target_health.proto
 
@@ -46,7 +46,9 @@ type TargetHealth struct {
 	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
 	// error is the health check error observed, when
 	// "status" field != "healthy".
-	Error         string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// message is additional information meant for a user.
+	Message       string `protobuf:"bytes,3,opt,name=message,proto3" json:"message,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -95,14 +97,22 @@ func (x *TargetHealth) GetError() string {
 	return ""
 }
 
+func (x *TargetHealth) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
 var File_teleport_lib_teleterm_v1_target_health_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_v1_target_health_proto_rawDesc = "" +
 	"\n" +
-	",teleport/lib/teleterm/v1/target_health.proto\x12\x18teleport.lib.teleterm.v1\"<\n" +
+	",teleport/lib/teleterm/v1/target_health.proto\x12\x18teleport.lib.teleterm.v1\"V\n" +
 	"\fTargetHealth\x12\x16\n" +
 	"\x06status\x18\x01 \x01(\tR\x06status\x12\x14\n" +
-	"\x05error\x18\x02 \x01(\tR\x05errorBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
+	"\x05error\x18\x02 \x01(\tR\x05error\x12\x18\n" +
+	"\amessage\x18\x03 \x01(\tR\amessageBTZRgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1b\x06proto3"
 
 var (
 	file_teleport_lib_teleterm_v1_target_health_proto_rawDescOnce sync.Once
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
index 9fc37293f2e23..65f86d02fdfca 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/tshd_events_service.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/usage_events.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/usage_events.pb.go
index fdbd12d05962d..3a68d8fced290 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/usage_events.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/usage_events.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/usage_events.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/windows_desktop.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/windows_desktop.pb.go
index b0fc5505a4973..5ba32806b0f04 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/windows_desktop.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/windows_desktop.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/v1/windows_desktop.proto
 
diff --git a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service.pb.go b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service.pb.go
index 39c2f91caecc4..652135855f891 100644
--- a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/teleterm/vnet/v1/vnet_service.proto
 
@@ -248,27 +248,27 @@ func (*StopResponse) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP(), []int{3}
 }
 
-// Request for ListDNSZones.
-type ListDNSZonesRequest struct {
+// Request for GetServiceInfo.
+type GetServiceInfoRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListDNSZonesRequest) Reset() {
-	*x = ListDNSZonesRequest{}
+func (x *GetServiceInfoRequest) Reset() {
+	*x = GetServiceInfoRequest{}
 	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListDNSZonesRequest) String() string {
+func (x *GetServiceInfoRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListDNSZonesRequest) ProtoMessage() {}
+func (*GetServiceInfoRequest) ProtoMessage() {}
 
-func (x *ListDNSZonesRequest) ProtoReflect() protoreflect.Message {
+func (x *GetServiceInfoRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -280,34 +280,43 @@ func (x *ListDNSZonesRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListDNSZonesRequest.ProtoReflect.Descriptor instead.
-func (*ListDNSZonesRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetServiceInfoRequest.ProtoReflect.Descriptor instead.
+func (*GetServiceInfoRequest) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP(), []int{4}
 }
 
-// Response for ListDNSZones.
-type ListDNSZonesResponse struct {
+// GetServiceInfoResponse contains the status of the running VNet service.
+type GetServiceInfoResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// dns_zones is a deduplicated list of DNS zones.
-	DnsZones      []string `protobuf:"bytes,1,rep,name=dns_zones,json=dnsZones,proto3" json:"dns_zones,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *ListDNSZonesResponse) Reset() {
-	*x = ListDNSZonesResponse{}
+	// app_dns_zones is a deduplicated list of all DNS zones valid as DNS
+	// suffixes for connections to TCP apps.
+	AppDnsZones []string `protobuf:"bytes,1,rep,name=app_dns_zones,json=appDnsZones,proto3" json:"app_dns_zones,omitempty"`
+	// clusters is a list of cluster names valid as DNS suffixes for SSH hosts.
+	Clusters []string `protobuf:"bytes,2,rep,name=clusters,proto3" json:"clusters,omitempty"`
+	// ssh_configured is true if the user's SSH config file includes VNet's
+	// generated SSH config necessary for SSH access.
+	SshConfigured bool `protobuf:"varint,3,opt,name=ssh_configured,json=sshConfigured,proto3" json:"ssh_configured,omitempty"`
+	// vnet_ssh_config_path is the path of VNet's generated OpenSSH-compatible
+	// config file.
+	VnetSshConfigPath string `protobuf:"bytes,4,opt,name=vnet_ssh_config_path,json=vnetSshConfigPath,proto3" json:"vnet_ssh_config_path,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *GetServiceInfoResponse) Reset() {
+	*x = GetServiceInfoResponse{}
 	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListDNSZonesResponse) String() string {
+func (x *GetServiceInfoResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListDNSZonesResponse) ProtoMessage() {}
+func (*GetServiceInfoResponse) ProtoMessage() {}
 
-func (x *ListDNSZonesResponse) ProtoReflect() protoreflect.Message {
+func (x *GetServiceInfoResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -319,18 +328,39 @@ func (x *ListDNSZonesResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListDNSZonesResponse.ProtoReflect.Descriptor instead.
-func (*ListDNSZonesResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetServiceInfoResponse.ProtoReflect.Descriptor instead.
+func (*GetServiceInfoResponse) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *ListDNSZonesResponse) GetDnsZones() []string {
+func (x *GetServiceInfoResponse) GetAppDnsZones() []string {
+	if x != nil {
+		return x.AppDnsZones
+	}
+	return nil
+}
+
+func (x *GetServiceInfoResponse) GetClusters() []string {
 	if x != nil {
-		return x.DnsZones
+		return x.Clusters
 	}
 	return nil
 }
 
+func (x *GetServiceInfoResponse) GetSshConfigured() bool {
+	if x != nil {
+		return x.SshConfigured
+	}
+	return false
+}
+
+func (x *GetServiceInfoResponse) GetVnetSshConfigPath() string {
+	if x != nil {
+		return x.VnetSshConfigPath
+	}
+	return ""
+}
+
 // Request for GetBackgroundItemStatus.
 type GetBackgroundItemStatusRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -495,6 +525,80 @@ func (x *RunDiagnosticsResponse) GetReport() *v1.Report {
 	return nil
 }
 
+// Request for AutoConfigureSSH.
+type AutoConfigureSSHRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoConfigureSSHRequest) Reset() {
+	*x = AutoConfigureSSHRequest{}
+	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoConfigureSSHRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoConfigureSSHRequest) ProtoMessage() {}
+
+func (x *AutoConfigureSSHRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoConfigureSSHRequest.ProtoReflect.Descriptor instead.
+func (*AutoConfigureSSHRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP(), []int{10}
+}
+
+// Response for AutoConfigureSSH.
+type AutoConfigureSSHResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AutoConfigureSSHResponse) Reset() {
+	*x = AutoConfigureSSHResponse{}
+	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AutoConfigureSSHResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoConfigureSSHResponse) ProtoMessage() {}
+
+func (x *AutoConfigureSSHResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoConfigureSSHResponse.ProtoReflect.Descriptor instead.
+func (*AutoConfigureSSHResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP(), []int{11}
+}
+
 var File_teleport_lib_teleterm_vnet_v1_vnet_service_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDesc = "" +
@@ -503,29 +607,35 @@ const file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDesc = "" +
 	"\fStartRequest\"\x0f\n" +
 	"\rStartResponse\"\r\n" +
 	"\vStopRequest\"\x0e\n" +
-	"\fStopResponse\"\x15\n" +
-	"\x13ListDNSZonesRequest\"3\n" +
-	"\x14ListDNSZonesResponse\x12\x1b\n" +
-	"\tdns_zones\x18\x01 \x03(\tR\bdnsZones\" \n" +
+	"\fStopResponse\"\x17\n" +
+	"\x15GetServiceInfoRequest\"\xb0\x01\n" +
+	"\x16GetServiceInfoResponse\x12\"\n" +
+	"\rapp_dns_zones\x18\x01 \x03(\tR\vappDnsZones\x12\x1a\n" +
+	"\bclusters\x18\x02 \x03(\tR\bclusters\x12%\n" +
+	"\x0essh_configured\x18\x03 \x01(\bR\rsshConfigured\x12/\n" +
+	"\x14vnet_ssh_config_path\x18\x04 \x01(\tR\x11vnetSshConfigPath\" \n" +
 	"\x1eGetBackgroundItemStatusRequest\"n\n" +
 	"\x1fGetBackgroundItemStatusResponse\x12K\n" +
 	"\x06status\x18\x01 \x01(\x0e23.teleport.lib.teleterm.vnet.v1.BackgroundItemStatusR\x06status\"\x17\n" +
 	"\x15RunDiagnosticsRequest\"S\n" +
 	"\x16RunDiagnosticsResponse\x129\n" +
-	"\x06report\x18\x01 \x01(\v2!.teleport.lib.vnet.diag.v1.ReportR\x06report*\x8b\x02\n" +
+	"\x06report\x18\x01 \x01(\v2!.teleport.lib.vnet.diag.v1.ReportR\x06report\"\x19\n" +
+	"\x17AutoConfigureSSHRequest\"\x1a\n" +
+	"\x18AutoConfigureSSHResponse*\x8b\x02\n" +
 	"\x14BackgroundItemStatus\x12&\n" +
 	"\"BACKGROUND_ITEM_STATUS_UNSPECIFIED\x10\x00\x12)\n" +
 	"%BACKGROUND_ITEM_STATUS_NOT_REGISTERED\x10\x01\x12\"\n" +
 	"\x1eBACKGROUND_ITEM_STATUS_ENABLED\x10\x02\x12,\n" +
 	"(BACKGROUND_ITEM_STATUS_REQUIRES_APPROVAL\x10\x03\x12$\n" +
 	" BACKGROUND_ITEM_STATUS_NOT_FOUND\x10\x04\x12(\n" +
-	"$BACKGROUND_ITEM_STATUS_NOT_SUPPORTED\x10\x052\xe5\x04\n" +
+	"$BACKGROUND_ITEM_STATUS_NOT_SUPPORTED\x10\x052\xf1\x05\n" +
 	"\vVnetService\x12b\n" +
 	"\x05Start\x12+.teleport.lib.teleterm.vnet.v1.StartRequest\x1a,.teleport.lib.teleterm.vnet.v1.StartResponse\x12_\n" +
-	"\x04Stop\x12*.teleport.lib.teleterm.vnet.v1.StopRequest\x1a+.teleport.lib.teleterm.vnet.v1.StopResponse\x12w\n" +
-	"\fListDNSZones\x122.teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest\x1a3.teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse\x12\x98\x01\n" +
+	"\x04Stop\x12*.teleport.lib.teleterm.vnet.v1.StopRequest\x1a+.teleport.lib.teleterm.vnet.v1.StopResponse\x12}\n" +
+	"\x0eGetServiceInfo\x124.teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest\x1a5.teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse\x12\x98\x01\n" +
 	"\x17GetBackgroundItemStatus\x12=.teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusRequest\x1a>.teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusResponse\x12}\n" +
-	"\x0eRunDiagnostics\x124.teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest\x1a5.teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponseBUZSgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1;vnetv1b\x06proto3"
+	"\x0eRunDiagnostics\x124.teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest\x1a5.teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse\x12\x83\x01\n" +
+	"\x10AutoConfigureSSH\x126.teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest\x1a7.teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponseBUZSgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1;vnetv1b\x06proto3"
 
 var (
 	file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescOnce sync.Once
@@ -540,36 +650,40 @@ func file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDescGZIP() []byte
 }
 
 var file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_goTypes = []any{
 	(BackgroundItemStatus)(0),               // 0: teleport.lib.teleterm.vnet.v1.BackgroundItemStatus
 	(*StartRequest)(nil),                    // 1: teleport.lib.teleterm.vnet.v1.StartRequest
 	(*StartResponse)(nil),                   // 2: teleport.lib.teleterm.vnet.v1.StartResponse
 	(*StopRequest)(nil),                     // 3: teleport.lib.teleterm.vnet.v1.StopRequest
 	(*StopResponse)(nil),                    // 4: teleport.lib.teleterm.vnet.v1.StopResponse
-	(*ListDNSZonesRequest)(nil),             // 5: teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest
-	(*ListDNSZonesResponse)(nil),            // 6: teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse
+	(*GetServiceInfoRequest)(nil),           // 5: teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest
+	(*GetServiceInfoResponse)(nil),          // 6: teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse
 	(*GetBackgroundItemStatusRequest)(nil),  // 7: teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusRequest
 	(*GetBackgroundItemStatusResponse)(nil), // 8: teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusResponse
 	(*RunDiagnosticsRequest)(nil),           // 9: teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest
 	(*RunDiagnosticsResponse)(nil),          // 10: teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse
-	(*v1.Report)(nil),                       // 11: teleport.lib.vnet.diag.v1.Report
+	(*AutoConfigureSSHRequest)(nil),         // 11: teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest
+	(*AutoConfigureSSHResponse)(nil),        // 12: teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse
+	(*v1.Report)(nil),                       // 13: teleport.lib.vnet.diag.v1.Report
 }
 var file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_depIdxs = []int32{
 	0,  // 0: teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusResponse.status:type_name -> teleport.lib.teleterm.vnet.v1.BackgroundItemStatus
-	11, // 1: teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse.report:type_name -> teleport.lib.vnet.diag.v1.Report
+	13, // 1: teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse.report:type_name -> teleport.lib.vnet.diag.v1.Report
 	1,  // 2: teleport.lib.teleterm.vnet.v1.VnetService.Start:input_type -> teleport.lib.teleterm.vnet.v1.StartRequest
 	3,  // 3: teleport.lib.teleterm.vnet.v1.VnetService.Stop:input_type -> teleport.lib.teleterm.vnet.v1.StopRequest
-	5,  // 4: teleport.lib.teleterm.vnet.v1.VnetService.ListDNSZones:input_type -> teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest
+	5,  // 4: teleport.lib.teleterm.vnet.v1.VnetService.GetServiceInfo:input_type -> teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest
 	7,  // 5: teleport.lib.teleterm.vnet.v1.VnetService.GetBackgroundItemStatus:input_type -> teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusRequest
 	9,  // 6: teleport.lib.teleterm.vnet.v1.VnetService.RunDiagnostics:input_type -> teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest
-	2,  // 7: teleport.lib.teleterm.vnet.v1.VnetService.Start:output_type -> teleport.lib.teleterm.vnet.v1.StartResponse
-	4,  // 8: teleport.lib.teleterm.vnet.v1.VnetService.Stop:output_type -> teleport.lib.teleterm.vnet.v1.StopResponse
-	6,  // 9: teleport.lib.teleterm.vnet.v1.VnetService.ListDNSZones:output_type -> teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse
-	8,  // 10: teleport.lib.teleterm.vnet.v1.VnetService.GetBackgroundItemStatus:output_type -> teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusResponse
-	10, // 11: teleport.lib.teleterm.vnet.v1.VnetService.RunDiagnostics:output_type -> teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse
-	7,  // [7:12] is the sub-list for method output_type
-	2,  // [2:7] is the sub-list for method input_type
+	11, // 7: teleport.lib.teleterm.vnet.v1.VnetService.AutoConfigureSSH:input_type -> teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest
+	2,  // 8: teleport.lib.teleterm.vnet.v1.VnetService.Start:output_type -> teleport.lib.teleterm.vnet.v1.StartResponse
+	4,  // 9: teleport.lib.teleterm.vnet.v1.VnetService.Stop:output_type -> teleport.lib.teleterm.vnet.v1.StopResponse
+	6,  // 10: teleport.lib.teleterm.vnet.v1.VnetService.GetServiceInfo:output_type -> teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse
+	8,  // 11: teleport.lib.teleterm.vnet.v1.VnetService.GetBackgroundItemStatus:output_type -> teleport.lib.teleterm.vnet.v1.GetBackgroundItemStatusResponse
+	10, // 12: teleport.lib.teleterm.vnet.v1.VnetService.RunDiagnostics:output_type -> teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse
+	12, // 13: teleport.lib.teleterm.vnet.v1.VnetService.AutoConfigureSSH:output_type -> teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse
+	8,  // [8:14] is the sub-list for method output_type
+	2,  // [2:8] is the sub-list for method input_type
 	2,  // [2:2] is the sub-list for extension type_name
 	2,  // [2:2] is the sub-list for extension extendee
 	0,  // [0:2] is the sub-list for field type_name
@@ -586,7 +700,7 @@ func file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDesc), len(file_teleport_lib_teleterm_vnet_v1_vnet_service_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   10,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
index d14f95a833ae4..074693d5c6c11 100644
--- a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
@@ -37,9 +37,10 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	VnetService_Start_FullMethodName                   = "/teleport.lib.teleterm.vnet.v1.VnetService/Start"
 	VnetService_Stop_FullMethodName                    = "/teleport.lib.teleterm.vnet.v1.VnetService/Stop"
-	VnetService_ListDNSZones_FullMethodName            = "/teleport.lib.teleterm.vnet.v1.VnetService/ListDNSZones"
+	VnetService_GetServiceInfo_FullMethodName          = "/teleport.lib.teleterm.vnet.v1.VnetService/GetServiceInfo"
 	VnetService_GetBackgroundItemStatus_FullMethodName = "/teleport.lib.teleterm.vnet.v1.VnetService/GetBackgroundItemStatus"
 	VnetService_RunDiagnostics_FullMethodName          = "/teleport.lib.teleterm.vnet.v1.VnetService/RunDiagnostics"
+	VnetService_AutoConfigureSSH_FullMethodName        = "/teleport.lib.teleterm.vnet.v1.VnetService/AutoConfigureSSH"
 )
 
 // VnetServiceClient is the client API for VnetService service.
@@ -52,22 +53,17 @@ type VnetServiceClient interface {
 	Start(ctx context.Context, in *StartRequest, opts ...grpc.CallOption) (*StartResponse, error)
 	// Stop stops VNet.
 	Stop(ctx context.Context, in *StopRequest, opts ...grpc.CallOption) (*StopResponse, error)
-	// ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-	// includes the proxy service hostnames and custom DNS zones configured in vnet_config.
-	//
-	// This is fetched independently of what the Electron app thinks the current state of the cluster
-	// looks like, since the VNet admin process also fetches this data independently of the Electron
-	// app.
-	//
-	// Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-	// be fetched (due to e.g., a network error or an expired cert).
-	ListDNSZones(ctx context.Context, in *ListDNSZonesRequest, opts ...grpc.CallOption) (*ListDNSZonesResponse, error)
+	// GetServiceInfo returns info about the running VNet service.
+	GetServiceInfo(ctx context.Context, in *GetServiceInfoRequest, opts ...grpc.CallOption) (*GetServiceInfoResponse, error)
 	// GetBackgroundItemStatus returns the status of the background item responsible for launching
 	// VNet daemon. macOS only. tsh must be compiled with the vnetdaemon build tag.
 	GetBackgroundItemStatus(ctx context.Context, in *GetBackgroundItemStatusRequest, opts ...grpc.CallOption) (*GetBackgroundItemStatusResponse, error)
 	// RunDiagnostics runs a set of heuristics to determine if VNet actually works on the device, that
 	// is receives network traffic and DNS queries. RunDiagnostics requires VNet to be started.
 	RunDiagnostics(ctx context.Context, in *RunDiagnosticsRequest, opts ...grpc.CallOption) (*RunDiagnosticsResponse, error)
+	// AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+	// connections to Teleport SSH hosts.
+	AutoConfigureSSH(ctx context.Context, in *AutoConfigureSSHRequest, opts ...grpc.CallOption) (*AutoConfigureSSHResponse, error)
 }
 
 type vnetServiceClient struct {
@@ -98,10 +94,10 @@ func (c *vnetServiceClient) Stop(ctx context.Context, in *StopRequest, opts ...g
 	return out, nil
 }
 
-func (c *vnetServiceClient) ListDNSZones(ctx context.Context, in *ListDNSZonesRequest, opts ...grpc.CallOption) (*ListDNSZonesResponse, error) {
+func (c *vnetServiceClient) GetServiceInfo(ctx context.Context, in *GetServiceInfoRequest, opts ...grpc.CallOption) (*GetServiceInfoResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(ListDNSZonesResponse)
-	err := c.cc.Invoke(ctx, VnetService_ListDNSZones_FullMethodName, in, out, cOpts...)
+	out := new(GetServiceInfoResponse)
+	err := c.cc.Invoke(ctx, VnetService_GetServiceInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,6 +124,16 @@ func (c *vnetServiceClient) RunDiagnostics(ctx context.Context, in *RunDiagnosti
 	return out, nil
 }
 
+func (c *vnetServiceClient) AutoConfigureSSH(ctx context.Context, in *AutoConfigureSSHRequest, opts ...grpc.CallOption) (*AutoConfigureSSHResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AutoConfigureSSHResponse)
+	err := c.cc.Invoke(ctx, VnetService_AutoConfigureSSH_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // VnetServiceServer is the server API for VnetService service.
 // All implementations must embed UnimplementedVnetServiceServer
 // for forward compatibility.
@@ -138,22 +144,17 @@ type VnetServiceServer interface {
 	Start(context.Context, *StartRequest) (*StartResponse, error)
 	// Stop stops VNet.
 	Stop(context.Context, *StopRequest) (*StopResponse, error)
-	// ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-	// includes the proxy service hostnames and custom DNS zones configured in vnet_config.
-	//
-	// This is fetched independently of what the Electron app thinks the current state of the cluster
-	// looks like, since the VNet admin process also fetches this data independently of the Electron
-	// app.
-	//
-	// Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-	// be fetched (due to e.g., a network error or an expired cert).
-	ListDNSZones(context.Context, *ListDNSZonesRequest) (*ListDNSZonesResponse, error)
+	// GetServiceInfo returns info about the running VNet service.
+	GetServiceInfo(context.Context, *GetServiceInfoRequest) (*GetServiceInfoResponse, error)
 	// GetBackgroundItemStatus returns the status of the background item responsible for launching
 	// VNet daemon. macOS only. tsh must be compiled with the vnetdaemon build tag.
 	GetBackgroundItemStatus(context.Context, *GetBackgroundItemStatusRequest) (*GetBackgroundItemStatusResponse, error)
 	// RunDiagnostics runs a set of heuristics to determine if VNet actually works on the device, that
 	// is receives network traffic and DNS queries. RunDiagnostics requires VNet to be started.
 	RunDiagnostics(context.Context, *RunDiagnosticsRequest) (*RunDiagnosticsResponse, error)
+	// AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+	// connections to Teleport SSH hosts.
+	AutoConfigureSSH(context.Context, *AutoConfigureSSHRequest) (*AutoConfigureSSHResponse, error)
 	mustEmbedUnimplementedVnetServiceServer()
 }
 
@@ -170,8 +171,8 @@ func (UnimplementedVnetServiceServer) Start(context.Context, *StartRequest) (*St
 func (UnimplementedVnetServiceServer) Stop(context.Context, *StopRequest) (*StopResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Stop not implemented")
 }
-func (UnimplementedVnetServiceServer) ListDNSZones(context.Context, *ListDNSZonesRequest) (*ListDNSZonesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListDNSZones not implemented")
+func (UnimplementedVnetServiceServer) GetServiceInfo(context.Context, *GetServiceInfoRequest) (*GetServiceInfoResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetServiceInfo not implemented")
 }
 func (UnimplementedVnetServiceServer) GetBackgroundItemStatus(context.Context, *GetBackgroundItemStatusRequest) (*GetBackgroundItemStatusResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetBackgroundItemStatus not implemented")
@@ -179,6 +180,9 @@ func (UnimplementedVnetServiceServer) GetBackgroundItemStatus(context.Context, *
 func (UnimplementedVnetServiceServer) RunDiagnostics(context.Context, *RunDiagnosticsRequest) (*RunDiagnosticsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RunDiagnostics not implemented")
 }
+func (UnimplementedVnetServiceServer) AutoConfigureSSH(context.Context, *AutoConfigureSSHRequest) (*AutoConfigureSSHResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AutoConfigureSSH not implemented")
+}
 func (UnimplementedVnetServiceServer) mustEmbedUnimplementedVnetServiceServer() {}
 func (UnimplementedVnetServiceServer) testEmbeddedByValue()                     {}
 
@@ -236,20 +240,20 @@ func _VnetService_Stop_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
-func _VnetService_ListDNSZones_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListDNSZonesRequest)
+func _VnetService_GetServiceInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetServiceInfoRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(VnetServiceServer).ListDNSZones(ctx, in)
+		return srv.(VnetServiceServer).GetServiceInfo(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: VnetService_ListDNSZones_FullMethodName,
+		FullMethod: VnetService_GetServiceInfo_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(VnetServiceServer).ListDNSZones(ctx, req.(*ListDNSZonesRequest))
+		return srv.(VnetServiceServer).GetServiceInfo(ctx, req.(*GetServiceInfoRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -290,6 +294,24 @@ func _VnetService_RunDiagnostics_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
+func _VnetService_AutoConfigureSSH_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AutoConfigureSSHRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VnetServiceServer).AutoConfigureSSH(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: VnetService_AutoConfigureSSH_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VnetServiceServer).AutoConfigureSSH(ctx, req.(*AutoConfigureSSHRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // VnetService_ServiceDesc is the grpc.ServiceDesc for VnetService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -306,8 +328,8 @@ var VnetService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _VnetService_Stop_Handler,
 		},
 		{
-			MethodName: "ListDNSZones",
-			Handler:    _VnetService_ListDNSZones_Handler,
+			MethodName: "GetServiceInfo",
+			Handler:    _VnetService_GetServiceInfo_Handler,
 		},
 		{
 			MethodName: "GetBackgroundItemStatus",
@@ -317,6 +339,10 @@ var VnetService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RunDiagnostics",
 			Handler:    _VnetService_RunDiagnostics_Handler,
 		},
+		{
+			MethodName: "AutoConfigureSSH",
+			Handler:    _VnetService_AutoConfigureSSH_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/lib/teleterm/vnet/v1/vnet_service.proto",
diff --git a/gen/proto/go/teleport/lib/vnet/diag/v1/diag.pb.go b/gen/proto/go/teleport/lib/vnet/diag/v1/diag.pb.go
index 16e907e5481b7..e9449c6f78cbd 100644
--- a/gen/proto/go/teleport/lib/vnet/diag/v1/diag.pb.go
+++ b/gen/proto/go/teleport/lib/vnet/diag/v1/diag.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/vnet/diag/v1/diag.proto
 
@@ -496,6 +496,7 @@ type CheckReport struct {
 	// Types that are valid to be assigned to Report:
 	//
 	//	*CheckReport_RouteConflictReport
+	//	*CheckReport_SshConfigurationReport
 	Report        isCheckReport_Report `protobuf_oneof:"report"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -554,6 +555,15 @@ func (x *CheckReport) GetRouteConflictReport() *RouteConflictReport {
 	return nil
 }
 
+func (x *CheckReport) GetSshConfigurationReport() *SSHConfigurationReport {
+	if x != nil {
+		if x, ok := x.Report.(*CheckReport_SshConfigurationReport); ok {
+			return x.SshConfigurationReport
+		}
+	}
+	return nil
+}
+
 type isCheckReport_Report interface {
 	isCheckReport_Report()
 }
@@ -564,8 +574,15 @@ type CheckReport_RouteConflictReport struct {
 	RouteConflictReport *RouteConflictReport `protobuf:"bytes,2,opt,name=route_conflict_report,json=routeConflictReport,proto3,oneof"`
 }
 
+type CheckReport_SshConfigurationReport struct {
+	// ssh_configuration_report reports the status of the system's SSH configuration.
+	SshConfigurationReport *SSHConfigurationReport `protobuf:"bytes,3,opt,name=ssh_configuration_report,json=sshConfigurationReport,proto3,oneof"`
+}
+
 func (*CheckReport_RouteConflictReport) isCheckReport_Report() {}
 
+func (*CheckReport_SshConfigurationReport) isCheckReport_Report() {}
+
 // CommandAttempt describes the attempt at running a particular command associated with a diagnostic
 // check.
 type CommandAttempt struct {
@@ -761,6 +778,93 @@ func (x *RouteConflict) GetInterfaceApp() string {
 	return ""
 }
 
+// SSHConfigurationReport describes the state of the system's SSH configuration.
+type SSHConfigurationReport struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// user_openssh_config_path is the full path to the user's default OpenSSH
+	// config file (~/.ssh/config).
+	UserOpensshConfigPath string `protobuf:"bytes,1,opt,name=user_openssh_config_path,json=userOpensshConfigPath,proto3" json:"user_openssh_config_path,omitempty"`
+	// vnet_ssh_config_path is the path to VNet's generated OpenSSH-compatible
+	// config file.
+	VnetSshConfigPath string `protobuf:"bytes,2,opt,name=vnet_ssh_config_path,json=vnetSshConfigPath,proto3" json:"vnet_ssh_config_path,omitempty"`
+	// user_openssh_config_includes_vnet_ssh_config is true if the default
+	// OpenSSH user configuration file includes VNet's SSH config file.
+	UserOpensshConfigIncludesVnetSshConfig bool `protobuf:"varint,3,opt,name=user_openssh_config_includes_vnet_ssh_config,json=userOpensshConfigIncludesVnetSshConfig,proto3" json:"user_openssh_config_includes_vnet_ssh_config,omitempty"`
+	// user_openssh_config_exists is true if a file exists at
+	// user_openssh_config_path (~/.ssh/config).
+	UserOpensshConfigExists bool `protobuf:"varint,4,opt,name=user_openssh_config_exists,json=userOpensshConfigExists,proto3" json:"user_openssh_config_exists,omitempty"`
+	// user_openssh_config_contents contains the contents of the file at
+	// user_openssh_config_path if it exists.
+	UserOpensshConfigContents string `protobuf:"bytes,5,opt,name=user_openssh_config_contents,json=userOpensshConfigContents,proto3" json:"user_openssh_config_contents,omitempty"`
+	unknownFields             protoimpl.UnknownFields
+	sizeCache                 protoimpl.SizeCache
+}
+
+func (x *SSHConfigurationReport) Reset() {
+	*x = SSHConfigurationReport{}
+	mi := &file_teleport_lib_vnet_diag_v1_diag_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SSHConfigurationReport) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SSHConfigurationReport) ProtoMessage() {}
+
+func (x *SSHConfigurationReport) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_diag_v1_diag_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SSHConfigurationReport.ProtoReflect.Descriptor instead.
+func (*SSHConfigurationReport) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_diag_v1_diag_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *SSHConfigurationReport) GetUserOpensshConfigPath() string {
+	if x != nil {
+		return x.UserOpensshConfigPath
+	}
+	return ""
+}
+
+func (x *SSHConfigurationReport) GetVnetSshConfigPath() string {
+	if x != nil {
+		return x.VnetSshConfigPath
+	}
+	return ""
+}
+
+func (x *SSHConfigurationReport) GetUserOpensshConfigIncludesVnetSshConfig() bool {
+	if x != nil {
+		return x.UserOpensshConfigIncludesVnetSshConfig
+	}
+	return false
+}
+
+func (x *SSHConfigurationReport) GetUserOpensshConfigExists() bool {
+	if x != nil {
+		return x.UserOpensshConfigExists
+	}
+	return false
+}
+
+func (x *SSHConfigurationReport) GetUserOpensshConfigContents() string {
+	if x != nil {
+		return x.UserOpensshConfigContents
+	}
+	return ""
+}
+
 var File_teleport_lib_vnet_diag_v1_diag_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_vnet_diag_v1_diag_proto_rawDesc = "" +
@@ -785,10 +889,11 @@ const file_teleport_lib_vnet_diag_v1_diag_proto_rawDesc = "" +
 	"\x06status\x18\x01 \x01(\x0e2-.teleport.lib.vnet.diag.v1.CheckAttemptStatusR\x06status\x12\x14\n" +
 	"\x05error\x18\x02 \x01(\tR\x05error\x12I\n" +
 	"\fcheck_report\x18\x03 \x01(\v2&.teleport.lib.vnet.diag.v1.CheckReportR\vcheckReport\x12E\n" +
-	"\bcommands\x18\x04 \x03(\v2).teleport.lib.vnet.diag.v1.CommandAttemptR\bcommands\"\xc3\x01\n" +
+	"\bcommands\x18\x04 \x03(\v2).teleport.lib.vnet.diag.v1.CommandAttemptR\bcommands\"\xb2\x02\n" +
 	"\vCheckReport\x12D\n" +
 	"\x06status\x18\x01 \x01(\x0e2,.teleport.lib.vnet.diag.v1.CheckReportStatusR\x06status\x12d\n" +
-	"\x15route_conflict_report\x18\x02 \x01(\v2..teleport.lib.vnet.diag.v1.RouteConflictReportH\x00R\x13routeConflictReportB\b\n" +
+	"\x15route_conflict_report\x18\x02 \x01(\v2..teleport.lib.vnet.diag.v1.RouteConflictReportH\x00R\x13routeConflictReport\x12m\n" +
+	"\x18ssh_configuration_report\x18\x03 \x01(\v21.teleport.lib.vnet.diag.v1.SSHConfigurationReportH\x00R\x16sshConfigurationReportB\b\n" +
 	"\x06report\"\xa1\x01\n" +
 	"\x0eCommandAttempt\x12G\n" +
 	"\x06status\x18\x01 \x01(\x0e2/.teleport.lib.vnet.diag.v1.CommandAttemptStatusR\x06status\x12\x14\n" +
@@ -801,7 +906,13 @@ const file_teleport_lib_vnet_diag_v1_diag_proto_rawDesc = "" +
 	"\x04dest\x18\x01 \x01(\tR\x04dest\x12\x1b\n" +
 	"\tvnet_dest\x18\x02 \x01(\tR\bvnetDest\x12%\n" +
 	"\x0einterface_name\x18\x03 \x01(\tR\rinterfaceName\x12#\n" +
-	"\rinterface_app\x18\x04 \x01(\tR\finterfaceApp*w\n" +
+	"\rinterface_app\x18\x04 \x01(\tR\finterfaceApp\"\xde\x02\n" +
+	"\x16SSHConfigurationReport\x127\n" +
+	"\x18user_openssh_config_path\x18\x01 \x01(\tR\x15userOpensshConfigPath\x12/\n" +
+	"\x14vnet_ssh_config_path\x18\x02 \x01(\tR\x11vnetSshConfigPath\x12\\\n" +
+	",user_openssh_config_includes_vnet_ssh_config\x18\x03 \x01(\bR&userOpensshConfigIncludesVnetSshConfig\x12;\n" +
+	"\x1auser_openssh_config_exists\x18\x04 \x01(\bR\x17userOpensshConfigExists\x12?\n" +
+	"\x1cuser_openssh_config_contents\x18\x05 \x01(\tR\x19userOpensshConfigContents*w\n" +
 	"\x12CheckAttemptStatus\x12$\n" +
 	" CHECK_ATTEMPT_STATUS_UNSPECIFIED\x10\x00\x12\x1b\n" +
 	"\x17CHECK_ATTEMPT_STATUS_OK\x10\x01\x12\x1e\n" +
@@ -828,23 +939,24 @@ func file_teleport_lib_vnet_diag_v1_diag_proto_rawDescGZIP() []byte {
 }
 
 var file_teleport_lib_vnet_diag_v1_diag_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_teleport_lib_vnet_diag_v1_diag_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_teleport_lib_vnet_diag_v1_diag_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_teleport_lib_vnet_diag_v1_diag_proto_goTypes = []any{
-	(CheckAttemptStatus)(0),       // 0: teleport.lib.vnet.diag.v1.CheckAttemptStatus
-	(CheckReportStatus)(0),        // 1: teleport.lib.vnet.diag.v1.CheckReportStatus
-	(CommandAttemptStatus)(0),     // 2: teleport.lib.vnet.diag.v1.CommandAttemptStatus
-	(*Report)(nil),                // 3: teleport.lib.vnet.diag.v1.Report
-	(*NetworkStackAttempt)(nil),   // 4: teleport.lib.vnet.diag.v1.NetworkStackAttempt
-	(*NetworkStack)(nil),          // 5: teleport.lib.vnet.diag.v1.NetworkStack
-	(*CheckAttempt)(nil),          // 6: teleport.lib.vnet.diag.v1.CheckAttempt
-	(*CheckReport)(nil),           // 7: teleport.lib.vnet.diag.v1.CheckReport
-	(*CommandAttempt)(nil),        // 8: teleport.lib.vnet.diag.v1.CommandAttempt
-	(*RouteConflictReport)(nil),   // 9: teleport.lib.vnet.diag.v1.RouteConflictReport
-	(*RouteConflict)(nil),         // 10: teleport.lib.vnet.diag.v1.RouteConflict
-	(*timestamppb.Timestamp)(nil), // 11: google.protobuf.Timestamp
+	(CheckAttemptStatus)(0),        // 0: teleport.lib.vnet.diag.v1.CheckAttemptStatus
+	(CheckReportStatus)(0),         // 1: teleport.lib.vnet.diag.v1.CheckReportStatus
+	(CommandAttemptStatus)(0),      // 2: teleport.lib.vnet.diag.v1.CommandAttemptStatus
+	(*Report)(nil),                 // 3: teleport.lib.vnet.diag.v1.Report
+	(*NetworkStackAttempt)(nil),    // 4: teleport.lib.vnet.diag.v1.NetworkStackAttempt
+	(*NetworkStack)(nil),           // 5: teleport.lib.vnet.diag.v1.NetworkStack
+	(*CheckAttempt)(nil),           // 6: teleport.lib.vnet.diag.v1.CheckAttempt
+	(*CheckReport)(nil),            // 7: teleport.lib.vnet.diag.v1.CheckReport
+	(*CommandAttempt)(nil),         // 8: teleport.lib.vnet.diag.v1.CommandAttempt
+	(*RouteConflictReport)(nil),    // 9: teleport.lib.vnet.diag.v1.RouteConflictReport
+	(*RouteConflict)(nil),          // 10: teleport.lib.vnet.diag.v1.RouteConflict
+	(*SSHConfigurationReport)(nil), // 11: teleport.lib.vnet.diag.v1.SSHConfigurationReport
+	(*timestamppb.Timestamp)(nil),  // 12: google.protobuf.Timestamp
 }
 var file_teleport_lib_vnet_diag_v1_diag_proto_depIdxs = []int32{
-	11, // 0: teleport.lib.vnet.diag.v1.Report.created_at:type_name -> google.protobuf.Timestamp
+	12, // 0: teleport.lib.vnet.diag.v1.Report.created_at:type_name -> google.protobuf.Timestamp
 	4,  // 1: teleport.lib.vnet.diag.v1.Report.network_stack_attempt:type_name -> teleport.lib.vnet.diag.v1.NetworkStackAttempt
 	6,  // 2: teleport.lib.vnet.diag.v1.Report.checks:type_name -> teleport.lib.vnet.diag.v1.CheckAttempt
 	0,  // 3: teleport.lib.vnet.diag.v1.NetworkStackAttempt.status:type_name -> teleport.lib.vnet.diag.v1.CheckAttemptStatus
@@ -854,13 +966,14 @@ var file_teleport_lib_vnet_diag_v1_diag_proto_depIdxs = []int32{
 	8,  // 7: teleport.lib.vnet.diag.v1.CheckAttempt.commands:type_name -> teleport.lib.vnet.diag.v1.CommandAttempt
 	1,  // 8: teleport.lib.vnet.diag.v1.CheckReport.status:type_name -> teleport.lib.vnet.diag.v1.CheckReportStatus
 	9,  // 9: teleport.lib.vnet.diag.v1.CheckReport.route_conflict_report:type_name -> teleport.lib.vnet.diag.v1.RouteConflictReport
-	2,  // 10: teleport.lib.vnet.diag.v1.CommandAttempt.status:type_name -> teleport.lib.vnet.diag.v1.CommandAttemptStatus
-	10, // 11: teleport.lib.vnet.diag.v1.RouteConflictReport.route_conflicts:type_name -> teleport.lib.vnet.diag.v1.RouteConflict
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	11, // 10: teleport.lib.vnet.diag.v1.CheckReport.ssh_configuration_report:type_name -> teleport.lib.vnet.diag.v1.SSHConfigurationReport
+	2,  // 11: teleport.lib.vnet.diag.v1.CommandAttempt.status:type_name -> teleport.lib.vnet.diag.v1.CommandAttemptStatus
+	10, // 12: teleport.lib.vnet.diag.v1.RouteConflictReport.route_conflicts:type_name -> teleport.lib.vnet.diag.v1.RouteConflict
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_vnet_diag_v1_diag_proto_init() }
@@ -870,6 +983,7 @@ func file_teleport_lib_vnet_diag_v1_diag_proto_init() {
 	}
 	file_teleport_lib_vnet_diag_v1_diag_proto_msgTypes[4].OneofWrappers = []any{
 		(*CheckReport_RouteConflictReport)(nil),
+		(*CheckReport_SshConfigurationReport)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -877,7 +991,7 @@ func file_teleport_lib_vnet_diag_v1_diag_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_vnet_diag_v1_diag_proto_rawDesc), len(file_teleport_lib_vnet_diag_v1_diag_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   8,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/gen/proto/go/teleport/lib/vnet/v1/client_application_service.pb.go b/gen/proto/go/teleport/lib/vnet/v1/client_application_service.pb.go
index 685a31f2b4358..bf46df5a97625 100644
--- a/gen/proto/go/teleport/lib/vnet/v1/client_application_service.pb.go
+++ b/gen/proto/go/teleport/lib/vnet/v1/client_application_service.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/vnet/v1/client_application_service.proto
 
@@ -649,7 +649,15 @@ type MatchedCluster struct {
 	Ipv4CidrRange string `protobuf:"bytes,1,opt,name=ipv4_cidr_range,json=ipv4CidrRange,proto3" json:"ipv4_cidr_range,omitempty"`
 	// WebProxyAddr is the web proxy address of the root cluster that matched the
 	// query.
-	WebProxyAddr  string `protobuf:"bytes,2,opt,name=web_proxy_addr,json=webProxyAddr,proto3" json:"web_proxy_addr,omitempty"`
+	WebProxyAddr string `protobuf:"bytes,2,opt,name=web_proxy_addr,json=webProxyAddr,proto3" json:"web_proxy_addr,omitempty"`
+	// Profile is the profile the matched cluster was found in.
+	Profile string `protobuf:"bytes,3,opt,name=profile,proto3" json:"profile,omitempty"`
+	// RootCluster will always be set to the name of the root cluster that matched
+	// the query.
+	RootCluster string `protobuf:"bytes,4,opt,name=root_cluster,json=rootCluster,proto3" json:"root_cluster,omitempty"`
+	// LeafCluster will be set only when the query matched a leaf cluster of
+	// RootCluster, or else it will be empty.
+	LeafCluster   string `protobuf:"bytes,5,opt,name=leaf_cluster,json=leafCluster,proto3" json:"leaf_cluster,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -698,6 +706,27 @@ func (x *MatchedCluster) GetWebProxyAddr() string {
 	return ""
 }
 
+func (x *MatchedCluster) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+func (x *MatchedCluster) GetRootCluster() string {
+	if x != nil {
+		return x.RootCluster
+	}
+	return ""
+}
+
+func (x *MatchedCluster) GetLeafCluster() string {
+	if x != nil {
+		return x.LeafCluster
+	}
+	return ""
+}
+
 // AppInfo holds all necessary info for making connections to VNet TCP apps.
 type AppInfo struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -860,8 +889,10 @@ type DialOptions struct {
 	Sni string `protobuf:"bytes,3,opt,name=sni,proto3" json:"sni,omitempty"`
 	// InsecureSkipVerify turns off verification for x509 upstream ALPN proxy service certificate.
 	InsecureSkipVerify bool `protobuf:"varint,4,opt,name=insecure_skip_verify,json=insecureSkipVerify,proto3" json:"insecure_skip_verify,omitempty"`
-	// RootClusterCaCertPool overrides the x509 certificate pool used to verify the server.
-	// It is a PEM-encoded X509 certificate pool.
+	// RootClusterCaCertPool is the host CA TLS certificate pool for the root
+	// cluster. It is a PEM-encoded X509 certificate pool. It should be used when
+	// dialing the proxy and AlpnConnUpgradeRequired is true or when dialing the
+	// transport service.
 	RootClusterCaCertPool []byte `protobuf:"bytes,5,opt,name=root_cluster_ca_cert_pool,json=rootClusterCaCertPool,proto3" json:"root_cluster_ca_cert_pool,omitempty"`
 	unknownFields         protoimpl.UnknownFields
 	sizeCache             protoimpl.SizeCache
@@ -1048,13 +1079,8 @@ type SignForAppRequest struct {
 	// TargetPort of a previous successful call to ReissueAppCert for an app
 	// matching AppKey.
 	TargetPort uint32 `protobuf:"varint,2,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
-	// Digest is the bytes to sign.
-	Digest []byte `protobuf:"bytes,3,opt,name=digest,proto3" json:"digest,omitempty"`
-	// Hash is the hash function used to compute digest.
-	Hash Hash `protobuf:"varint,4,opt,name=hash,proto3,enum=teleport.lib.vnet.v1.Hash" json:"hash,omitempty"`
-	// PssSaltLength specifies the length of the salt added to the digest before a
-	// signature. Only used and required for RSA PSS signatures.
-	PssSaltLength *int32 `protobuf:"varint,5,opt,name=pss_salt_length,json=pssSaltLength,proto3,oneof" json:"pss_salt_length,omitempty"`
+	// Sign holds signature request details.
+	Sign          *SignRequest `protobuf:"bytes,6,opt,name=sign,proto3" json:"sign,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1103,21 +1129,72 @@ func (x *SignForAppRequest) GetTargetPort() uint32 {
 	return 0
 }
 
-func (x *SignForAppRequest) GetDigest() []byte {
+func (x *SignForAppRequest) GetSign() *SignRequest {
+	if x != nil {
+		return x.Sign
+	}
+	return nil
+}
+
+// SignRequest holds signature request details.
+type SignRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Digest is the bytes to sign.
+	Digest []byte `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
+	// Hash is the hash function used to compute digest.
+	Hash Hash `protobuf:"varint,2,opt,name=hash,proto3,enum=teleport.lib.vnet.v1.Hash" json:"hash,omitempty"`
+	// PssSaltLength specifies the length of the salt added to the digest before a
+	// signature. Only used and required for RSA PSS signatures.
+	PssSaltLength *int32 `protobuf:"varint,3,opt,name=pss_salt_length,json=pssSaltLength,proto3,oneof" json:"pss_salt_length,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignRequest) Reset() {
+	*x = SignRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignRequest) ProtoMessage() {}
+
+func (x *SignRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignRequest.ProtoReflect.Descriptor instead.
+func (*SignRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *SignRequest) GetDigest() []byte {
 	if x != nil {
 		return x.Digest
 	}
 	return nil
 }
 
-func (x *SignForAppRequest) GetHash() Hash {
+func (x *SignRequest) GetHash() Hash {
 	if x != nil {
 		return x.Hash
 	}
 	return Hash_HASH_UNSPECIFIED
 }
 
-func (x *SignForAppRequest) GetPssSaltLength() int32 {
+func (x *SignRequest) GetPssSaltLength() int32 {
 	if x != nil && x.PssSaltLength != nil {
 		return *x.PssSaltLength
 	}
@@ -1135,7 +1212,7 @@ type SignForAppResponse struct {
 
 func (x *SignForAppResponse) Reset() {
 	*x = SignForAppResponse{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1147,7 +1224,7 @@ func (x *SignForAppResponse) String() string {
 func (*SignForAppResponse) ProtoMessage() {}
 
 func (x *SignForAppResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1160,7 +1237,7 @@ func (x *SignForAppResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SignForAppResponse.ProtoReflect.Descriptor instead.
 func (*SignForAppResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{18}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *SignForAppResponse) GetSignature() []byte {
@@ -1170,8 +1247,8 @@ func (x *SignForAppResponse) GetSignature() []byte {
 	return nil
 }
 
-// OnNewConnectionRequest is a request for OnNewConnection.
-type OnNewConnectionRequest struct {
+// OnNewAppConnectionRequest is a request for OnNewAppConnection.
+type OnNewAppConnectionRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// AppKey identifies the app the connection is being made for.
 	AppKey        *AppKey `protobuf:"bytes,1,opt,name=app_key,json=appKey,proto3" json:"app_key,omitempty"`
@@ -1179,21 +1256,21 @@ type OnNewConnectionRequest struct {
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *OnNewConnectionRequest) Reset() {
-	*x = OnNewConnectionRequest{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[19]
+func (x *OnNewAppConnectionRequest) Reset() {
+	*x = OnNewAppConnectionRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *OnNewConnectionRequest) String() string {
+func (x *OnNewAppConnectionRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*OnNewConnectionRequest) ProtoMessage() {}
+func (*OnNewAppConnectionRequest) ProtoMessage() {}
 
-func (x *OnNewConnectionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[19]
+func (x *OnNewAppConnectionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1204,40 +1281,40 @@ func (x *OnNewConnectionRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use OnNewConnectionRequest.ProtoReflect.Descriptor instead.
-func (*OnNewConnectionRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{19}
+// Deprecated: Use OnNewAppConnectionRequest.ProtoReflect.Descriptor instead.
+func (*OnNewAppConnectionRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{20}
 }
 
-func (x *OnNewConnectionRequest) GetAppKey() *AppKey {
+func (x *OnNewAppConnectionRequest) GetAppKey() *AppKey {
 	if x != nil {
 		return x.AppKey
 	}
 	return nil
 }
 
-// OnNewConnectionRequest is a response for OnNewConnection.
-type OnNewConnectionResponse struct {
+// OnNewAppConnectionResponse is a response for OnNewAppConnection.
+type OnNewAppConnectionResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *OnNewConnectionResponse) Reset() {
-	*x = OnNewConnectionResponse{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[20]
+func (x *OnNewAppConnectionResponse) Reset() {
+	*x = OnNewAppConnectionResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *OnNewConnectionResponse) String() string {
+func (x *OnNewAppConnectionResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*OnNewConnectionResponse) ProtoMessage() {}
+func (*OnNewAppConnectionResponse) ProtoMessage() {}
 
-func (x *OnNewConnectionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[20]
+func (x *OnNewAppConnectionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1248,9 +1325,9 @@ func (x *OnNewConnectionResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use OnNewConnectionResponse.ProtoReflect.Descriptor instead.
-func (*OnNewConnectionResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{20}
+// Deprecated: Use OnNewAppConnectionResponse.ProtoReflect.Descriptor instead.
+func (*OnNewAppConnectionResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{21}
 }
 
 // OnInvalidLocalPortRequest is a request for OnInvalidLocalPort.
@@ -1269,7 +1346,7 @@ type OnInvalidLocalPortRequest struct {
 
 func (x *OnInvalidLocalPortRequest) Reset() {
 	*x = OnInvalidLocalPortRequest{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1281,7 +1358,7 @@ func (x *OnInvalidLocalPortRequest) String() string {
 func (*OnInvalidLocalPortRequest) ProtoMessage() {}
 
 func (x *OnInvalidLocalPortRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1294,7 +1371,7 @@ func (x *OnInvalidLocalPortRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OnInvalidLocalPortRequest.ProtoReflect.Descriptor instead.
 func (*OnInvalidLocalPortRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{21}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *OnInvalidLocalPortRequest) GetAppInfo() *AppInfo {
@@ -1320,7 +1397,7 @@ type OnInvalidLocalPortResponse struct {
 
 func (x *OnInvalidLocalPortResponse) Reset() {
 	*x = OnInvalidLocalPortResponse{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1332,7 +1409,7 @@ func (x *OnInvalidLocalPortResponse) String() string {
 func (*OnInvalidLocalPortResponse) ProtoMessage() {}
 
 func (x *OnInvalidLocalPortResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1345,7 +1422,7 @@ func (x *OnInvalidLocalPortResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OnInvalidLocalPortResponse.ProtoReflect.Descriptor instead.
 func (*OnInvalidLocalPortResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{22}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{23}
 }
 
 // GetTargetOSConfigurationRequest is a request for the target host OS configuration.
@@ -1357,7 +1434,7 @@ type GetTargetOSConfigurationRequest struct {
 
 func (x *GetTargetOSConfigurationRequest) Reset() {
 	*x = GetTargetOSConfigurationRequest{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1369,7 +1446,7 @@ func (x *GetTargetOSConfigurationRequest) String() string {
 func (*GetTargetOSConfigurationRequest) ProtoMessage() {}
 
 func (x *GetTargetOSConfigurationRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1382,7 +1459,7 @@ func (x *GetTargetOSConfigurationRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetTargetOSConfigurationRequest.ProtoReflect.Descriptor instead.
 func (*GetTargetOSConfigurationRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{23}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{24}
 }
 
 // GetTargetOSConfigurationResponse is a response including the target host OS configuration.
@@ -1396,7 +1473,7 @@ type GetTargetOSConfigurationResponse struct {
 
 func (x *GetTargetOSConfigurationResponse) Reset() {
 	*x = GetTargetOSConfigurationResponse{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1408,7 +1485,7 @@ func (x *GetTargetOSConfigurationResponse) String() string {
 func (*GetTargetOSConfigurationResponse) ProtoMessage() {}
 
 func (x *GetTargetOSConfigurationResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1421,7 +1498,7 @@ func (x *GetTargetOSConfigurationResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetTargetOSConfigurationResponse.ProtoReflect.Descriptor instead.
 func (*GetTargetOSConfigurationResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{24}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *GetTargetOSConfigurationResponse) GetTargetOsConfiguration() *TargetOSConfiguration {
@@ -1451,7 +1528,7 @@ type TargetOSConfiguration struct {
 
 func (x *TargetOSConfiguration) Reset() {
 	*x = TargetOSConfiguration{}
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[25]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1463,7 +1540,7 @@ func (x *TargetOSConfiguration) String() string {
 func (*TargetOSConfiguration) ProtoMessage() {}
 
 func (x *TargetOSConfiguration) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[25]
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1476,7 +1553,7 @@ func (x *TargetOSConfiguration) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TargetOSConfiguration.ProtoReflect.Descriptor instead.
 func (*TargetOSConfiguration) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{25}
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *TargetOSConfiguration) GetDnsZones() []string {
@@ -1493,6 +1570,555 @@ func (x *TargetOSConfiguration) GetIpv4CidrRanges() []string {
 	return nil
 }
 
+// UserTLSCertRequest is a request for UserTLSCert.
+type UserTLSCertRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Profile is the profile to retrieve the certificate for.
+	Profile       string `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UserTLSCertRequest) Reset() {
+	*x = UserTLSCertRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UserTLSCertRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserTLSCertRequest) ProtoMessage() {}
+
+func (x *UserTLSCertRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserTLSCertRequest.ProtoReflect.Descriptor instead.
+func (*UserTLSCertRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *UserTLSCertRequest) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+// UserTLSCertResponse is a response for UserTLSCert.
+type UserTLSCertResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Cert is the user TLS certificate in X.509 ASN.1 DER format.
+	Cert []byte `protobuf:"bytes,1,opt,name=cert,proto3" json:"cert,omitempty"`
+	// DialOptions holds options that should be used when dialing the root cluster
+	// proxy.
+	DialOptions   *DialOptions `protobuf:"bytes,2,opt,name=dial_options,json=dialOptions,proto3" json:"dial_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UserTLSCertResponse) Reset() {
+	*x = UserTLSCertResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UserTLSCertResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserTLSCertResponse) ProtoMessage() {}
+
+func (x *UserTLSCertResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserTLSCertResponse.ProtoReflect.Descriptor instead.
+func (*UserTLSCertResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *UserTLSCertResponse) GetCert() []byte {
+	if x != nil {
+		return x.Cert
+	}
+	return nil
+}
+
+func (x *UserTLSCertResponse) GetDialOptions() *DialOptions {
+	if x != nil {
+		return x.DialOptions
+	}
+	return nil
+}
+
+// SignForUserTLSRequest is a request for SignForUserTLS.
+type SignForUserTLSRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Profile is the user profile to sign for.
+	Profile string `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
+	// Sign holds signature request details.
+	Sign          *SignRequest `protobuf:"bytes,2,opt,name=sign,proto3" json:"sign,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignForUserTLSRequest) Reset() {
+	*x = SignForUserTLSRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignForUserTLSRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignForUserTLSRequest) ProtoMessage() {}
+
+func (x *SignForUserTLSRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignForUserTLSRequest.ProtoReflect.Descriptor instead.
+func (*SignForUserTLSRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *SignForUserTLSRequest) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+func (x *SignForUserTLSRequest) GetSign() *SignRequest {
+	if x != nil {
+		return x.Sign
+	}
+	return nil
+}
+
+// SignForUserTLSResponse is a response for SignForUserTLS.
+type SignForUserTLSResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Signature is the signature.
+	Signature     []byte `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignForUserTLSResponse) Reset() {
+	*x = SignForUserTLSResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignForUserTLSResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignForUserTLSResponse) ProtoMessage() {}
+
+func (x *SignForUserTLSResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignForUserTLSResponse.ProtoReflect.Descriptor instead.
+func (*SignForUserTLSResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *SignForUserTLSResponse) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
+// SessionSSHConfigRequest is a request for SessionSSHConfig.
+type SessionSSHConfigRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Profile is the profile in which the SSH server is found.
+	Profile string `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
+	// RootCluster is the cluster in which the SSH server is found.
+	RootCluster string `protobuf:"bytes,2,opt,name=root_cluster,json=rootCluster,proto3" json:"root_cluster,omitempty"`
+	// LeafCluster is the leaf cluster in which the SSH server is found.
+	// If empty, the SSH server is in the root cluster.
+	LeafCluster string `protobuf:"bytes,3,opt,name=leaf_cluster,json=leafCluster,proto3" json:"leaf_cluster,omitempty"`
+	// Address is the address of the SSH server.
+	Address string `protobuf:"bytes,4,opt,name=address,proto3" json:"address,omitempty"`
+	// User is the SSH user the session is for.
+	User          string `protobuf:"bytes,5,opt,name=user,proto3" json:"user,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionSSHConfigRequest) Reset() {
+	*x = SessionSSHConfigRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionSSHConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionSSHConfigRequest) ProtoMessage() {}
+
+func (x *SessionSSHConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionSSHConfigRequest.ProtoReflect.Descriptor instead.
+func (*SessionSSHConfigRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *SessionSSHConfigRequest) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+func (x *SessionSSHConfigRequest) GetRootCluster() string {
+	if x != nil {
+		return x.RootCluster
+	}
+	return ""
+}
+
+func (x *SessionSSHConfigRequest) GetLeafCluster() string {
+	if x != nil {
+		return x.LeafCluster
+	}
+	return ""
+}
+
+func (x *SessionSSHConfigRequest) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *SessionSSHConfigRequest) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+// SessionSSHConfigResponse is a response for SessionSSHConfig.
+type SessionSSHConfigResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SessionId is an opaque identifier for the session, it should be passed to
+	// SignForSSHSession to issue signatures with the private key associated with
+	// the session.
+	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	// Cert is the session SSH certificate in SSH wire format.
+	Cert []byte `protobuf:"bytes,2,opt,name=cert,proto3" json:"cert,omitempty"`
+	// TrustedCas is a list of trusted SSH certificate authorities in SSH wire
+	// format.
+	TrustedCas    [][]byte `protobuf:"bytes,3,rep,name=trusted_cas,json=trustedCas,proto3" json:"trusted_cas,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionSSHConfigResponse) Reset() {
+	*x = SessionSSHConfigResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionSSHConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionSSHConfigResponse) ProtoMessage() {}
+
+func (x *SessionSSHConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionSSHConfigResponse.ProtoReflect.Descriptor instead.
+func (*SessionSSHConfigResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *SessionSSHConfigResponse) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *SessionSSHConfigResponse) GetCert() []byte {
+	if x != nil {
+		return x.Cert
+	}
+	return nil
+}
+
+func (x *SessionSSHConfigResponse) GetTrustedCas() [][]byte {
+	if x != nil {
+		return x.TrustedCas
+	}
+	return nil
+}
+
+// SignForSSHSessionRequest is a request for SignForSSHSession.
+type SignForSSHSessionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// SessionId is an opaque identifier for the session returned from a previous
+	// call to SessionSSHConfig.
+	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	// Sign holds signature request details.
+	Sign          *SignRequest `protobuf:"bytes,2,opt,name=sign,proto3" json:"sign,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignForSSHSessionRequest) Reset() {
+	*x = SignForSSHSessionRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignForSSHSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignForSSHSessionRequest) ProtoMessage() {}
+
+func (x *SignForSSHSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignForSSHSessionRequest.ProtoReflect.Descriptor instead.
+func (*SignForSSHSessionRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *SignForSSHSessionRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *SignForSSHSessionRequest) GetSign() *SignRequest {
+	if x != nil {
+		return x.Sign
+	}
+	return nil
+}
+
+// SignForSSHSessionResponse is a response for SignForSSHSession.
+type SignForSSHSessionResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Signature is the signature.
+	Signature     []byte `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignForSSHSessionResponse) Reset() {
+	*x = SignForSSHSessionResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignForSSHSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignForSSHSessionResponse) ProtoMessage() {}
+
+func (x *SignForSSHSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignForSSHSessionResponse.ProtoReflect.Descriptor instead.
+func (*SignForSSHSessionResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *SignForSSHSessionResponse) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
+// ExchangeSSHKeysRequest is a request to exchange SSH keys for VNet SSH.
+type ExchangeSSHKeysRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// HostPublicKey is the host key that should be trusted by clients connecting
+	// to VNet SSH addresses. It is encoded in OpenSSH wire format.
+	HostPublicKey []byte `protobuf:"bytes,1,opt,name=host_public_key,json=hostPublicKey,proto3" json:"host_public_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeSSHKeysRequest) Reset() {
+	*x = ExchangeSSHKeysRequest{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeSSHKeysRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeSSHKeysRequest) ProtoMessage() {}
+
+func (x *ExchangeSSHKeysRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeSSHKeysRequest.ProtoReflect.Descriptor instead.
+func (*ExchangeSSHKeysRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *ExchangeSSHKeysRequest) GetHostPublicKey() []byte {
+	if x != nil {
+		return x.HostPublicKey
+	}
+	return nil
+}
+
+// ExchangeSSHKeysResponse is a response for ExchangeSSHKeys.
+type ExchangeSSHKeysResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UserPublicKey is the user key that should be trusted by VNet for incoming
+	// connections from SSH clients. It is encoded in OpenSSH wire format.
+	UserPublicKey []byte `protobuf:"bytes,1,opt,name=user_public_key,json=userPublicKey,proto3" json:"user_public_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeSSHKeysResponse) Reset() {
+	*x = ExchangeSSHKeysResponse{}
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeSSHKeysResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeSSHKeysResponse) ProtoMessage() {}
+
+func (x *ExchangeSSHKeysResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[36]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeSSHKeysResponse.ProtoReflect.Descriptor instead.
+func (*ExchangeSSHKeysResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *ExchangeSSHKeysResponse) GetUserPublicKey() []byte {
+	if x != nil {
+		return x.UserPublicKey
+	}
+	return nil
+}
+
 var File_teleport_lib_vnet_v1_client_application_service_proto protoreflect.FileDescriptor
 
 const file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc = "" +
@@ -1521,10 +2147,13 @@ const file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc = "" +
 	"\x05match\"I\n" +
 	"\rMatchedTCPApp\x128\n" +
 	"\bapp_info\x18\x01 \x01(\v2\x1d.teleport.lib.vnet.v1.AppInfoR\aappInfo\"\x0f\n" +
-	"\rMatchedWebApp\"^\n" +
+	"\rMatchedWebApp\"\xbe\x01\n" +
 	"\x0eMatchedCluster\x12&\n" +
 	"\x0fipv4_cidr_range\x18\x01 \x01(\tR\ripv4CidrRange\x12$\n" +
-	"\x0eweb_proxy_addr\x18\x02 \x01(\tR\fwebProxyAddr\"\xe8\x01\n" +
+	"\x0eweb_proxy_addr\x18\x02 \x01(\tR\fwebProxyAddr\x12\x18\n" +
+	"\aprofile\x18\x03 \x01(\tR\aprofile\x12!\n" +
+	"\froot_cluster\x18\x04 \x01(\tR\vrootCluster\x12!\n" +
+	"\fleaf_cluster\x18\x05 \x01(\tR\vleafCluster\"\xe8\x01\n" +
 	"\aAppInfo\x125\n" +
 	"\aapp_key\x18\x01 \x01(\v2\x1c.teleport.lib.vnet.v1.AppKeyR\x06appKey\x12\x18\n" +
 	"\acluster\x18\x02 \x01(\tR\acluster\x12\x1e\n" +
@@ -1546,20 +2175,22 @@ const file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc = "" +
 	"\vtarget_port\x18\x02 \x01(\rR\n" +
 	"targetPort\",\n" +
 	"\x16ReissueAppCertResponse\x12\x12\n" +
-	"\x04cert\x18\x01 \x01(\fR\x04cert\"\xf4\x01\n" +
+	"\x04cert\x18\x01 \x01(\fR\x04cert\"\xd3\x01\n" +
 	"\x11SignForAppRequest\x125\n" +
 	"\aapp_key\x18\x01 \x01(\v2\x1c.teleport.lib.vnet.v1.AppKeyR\x06appKey\x12\x1f\n" +
 	"\vtarget_port\x18\x02 \x01(\rR\n" +
-	"targetPort\x12\x16\n" +
-	"\x06digest\x18\x03 \x01(\fR\x06digest\x12.\n" +
-	"\x04hash\x18\x04 \x01(\x0e2\x1a.teleport.lib.vnet.v1.HashR\x04hash\x12+\n" +
-	"\x0fpss_salt_length\x18\x05 \x01(\x05H\x00R\rpssSaltLength\x88\x01\x01B\x12\n" +
+	"targetPort\x125\n" +
+	"\x04sign\x18\x06 \x01(\v2!.teleport.lib.vnet.v1.SignRequestR\x04signJ\x04\b\x03\x10\x04J\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x06digestR\x04hashR\x0fpss_salt_length\"\x96\x01\n" +
+	"\vSignRequest\x12\x16\n" +
+	"\x06digest\x18\x01 \x01(\fR\x06digest\x12.\n" +
+	"\x04hash\x18\x02 \x01(\x0e2\x1a.teleport.lib.vnet.v1.HashR\x04hash\x12+\n" +
+	"\x0fpss_salt_length\x18\x03 \x01(\x05H\x00R\rpssSaltLength\x88\x01\x01B\x12\n" +
 	"\x10_pss_salt_length\"2\n" +
 	"\x12SignForAppResponse\x12\x1c\n" +
-	"\tsignature\x18\x01 \x01(\fR\tsignature\"O\n" +
-	"\x16OnNewConnectionRequest\x125\n" +
-	"\aapp_key\x18\x01 \x01(\v2\x1c.teleport.lib.vnet.v1.AppKeyR\x06appKey\"\x19\n" +
-	"\x17OnNewConnectionResponse\"v\n" +
+	"\tsignature\x18\x01 \x01(\fR\tsignature\"R\n" +
+	"\x19OnNewAppConnectionRequest\x125\n" +
+	"\aapp_key\x18\x01 \x01(\v2\x1c.teleport.lib.vnet.v1.AppKeyR\x06appKey\"\x1c\n" +
+	"\x1aOnNewAppConnectionResponse\"v\n" +
 	"\x19OnInvalidLocalPortRequest\x128\n" +
 	"\bapp_info\x18\x01 \x01(\v2\x1d.teleport.lib.vnet.v1.AppInfoR\aappInfo\x12\x1f\n" +
 	"\vtarget_port\x18\x02 \x01(\rR\n" +
@@ -1570,11 +2201,43 @@ const file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc = "" +
 	"\x17target_os_configuration\x18\x01 \x01(\v2+.teleport.lib.vnet.v1.TargetOSConfigurationR\x15targetOsConfiguration\"^\n" +
 	"\x15TargetOSConfiguration\x12\x1b\n" +
 	"\tdns_zones\x18\x01 \x03(\tR\bdnsZones\x12(\n" +
-	"\x10ipv4_cidr_ranges\x18\x02 \x03(\tR\x0eipv4CidrRanges*<\n" +
+	"\x10ipv4_cidr_ranges\x18\x02 \x03(\tR\x0eipv4CidrRanges\".\n" +
+	"\x12UserTLSCertRequest\x12\x18\n" +
+	"\aprofile\x18\x01 \x01(\tR\aprofile\"o\n" +
+	"\x13UserTLSCertResponse\x12\x12\n" +
+	"\x04cert\x18\x01 \x01(\fR\x04cert\x12D\n" +
+	"\fdial_options\x18\x02 \x01(\v2!.teleport.lib.vnet.v1.DialOptionsR\vdialOptions\"h\n" +
+	"\x15SignForUserTLSRequest\x12\x18\n" +
+	"\aprofile\x18\x01 \x01(\tR\aprofile\x125\n" +
+	"\x04sign\x18\x02 \x01(\v2!.teleport.lib.vnet.v1.SignRequestR\x04sign\"6\n" +
+	"\x16SignForUserTLSResponse\x12\x1c\n" +
+	"\tsignature\x18\x01 \x01(\fR\tsignature\"\xa7\x01\n" +
+	"\x17SessionSSHConfigRequest\x12\x18\n" +
+	"\aprofile\x18\x01 \x01(\tR\aprofile\x12!\n" +
+	"\froot_cluster\x18\x02 \x01(\tR\vrootCluster\x12!\n" +
+	"\fleaf_cluster\x18\x03 \x01(\tR\vleafCluster\x12\x18\n" +
+	"\aaddress\x18\x04 \x01(\tR\aaddress\x12\x12\n" +
+	"\x04user\x18\x05 \x01(\tR\x04user\"n\n" +
+	"\x18SessionSSHConfigResponse\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x12\x12\n" +
+	"\x04cert\x18\x02 \x01(\fR\x04cert\x12\x1f\n" +
+	"\vtrusted_cas\x18\x03 \x03(\fR\n" +
+	"trustedCas\"p\n" +
+	"\x18SignForSSHSessionRequest\x12\x1d\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tR\tsessionId\x125\n" +
+	"\x04sign\x18\x02 \x01(\v2!.teleport.lib.vnet.v1.SignRequestR\x04sign\"9\n" +
+	"\x19SignForSSHSessionResponse\x12\x1c\n" +
+	"\tsignature\x18\x01 \x01(\fR\tsignature\"@\n" +
+	"\x16ExchangeSSHKeysRequest\x12&\n" +
+	"\x0fhost_public_key\x18\x01 \x01(\fR\rhostPublicKey\"A\n" +
+	"\x17ExchangeSSHKeysResponse\x12&\n" +
+	"\x0fuser_public_key\x18\x01 \x01(\fR\ruserPublicKey*<\n" +
 	"\x04Hash\x12\x14\n" +
 	"\x10HASH_UNSPECIFIED\x10\x00\x12\r\n" +
 	"\tHASH_NONE\x10\x01\x12\x0f\n" +
-	"\vHASH_SHA256\x10\x022\x92\b\n" +
+	"\vHASH_SHA256\x10\x022\xc5\f\n" +
 	"\x18ClientApplicationService\x12z\n" +
 	"\x13AuthenticateProcess\x120.teleport.lib.vnet.v1.AuthenticateProcessRequest\x1a1.teleport.lib.vnet.v1.AuthenticateProcessResponse\x12\x83\x01\n" +
 	"\x16ReportNetworkStackInfo\x123.teleport.lib.vnet.v1.ReportNetworkStackInfoRequest\x1a4.teleport.lib.vnet.v1.ReportNetworkStackInfoResponse\x12M\n" +
@@ -1582,10 +2245,15 @@ const file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc = "" +
 	"\vResolveFQDN\x12(.teleport.lib.vnet.v1.ResolveFQDNRequest\x1a).teleport.lib.vnet.v1.ResolveFQDNResponse\x12k\n" +
 	"\x0eReissueAppCert\x12+.teleport.lib.vnet.v1.ReissueAppCertRequest\x1a,.teleport.lib.vnet.v1.ReissueAppCertResponse\x12_\n" +
 	"\n" +
-	"SignForApp\x12'.teleport.lib.vnet.v1.SignForAppRequest\x1a(.teleport.lib.vnet.v1.SignForAppResponse\x12n\n" +
-	"\x0fOnNewConnection\x12,.teleport.lib.vnet.v1.OnNewConnectionRequest\x1a-.teleport.lib.vnet.v1.OnNewConnectionResponse\x12w\n" +
+	"SignForApp\x12'.teleport.lib.vnet.v1.SignForAppRequest\x1a(.teleport.lib.vnet.v1.SignForAppResponse\x12w\n" +
+	"\x12OnNewAppConnection\x12/.teleport.lib.vnet.v1.OnNewAppConnectionRequest\x1a0.teleport.lib.vnet.v1.OnNewAppConnectionResponse\x12w\n" +
 	"\x12OnInvalidLocalPort\x12/.teleport.lib.vnet.v1.OnInvalidLocalPortRequest\x1a0.teleport.lib.vnet.v1.OnInvalidLocalPortResponse\x12\x89\x01\n" +
-	"\x18GetTargetOSConfiguration\x125.teleport.lib.vnet.v1.GetTargetOSConfigurationRequest\x1a6.teleport.lib.vnet.v1.GetTargetOSConfigurationResponseBLZJgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1;vnetv1b\x06proto3"
+	"\x18GetTargetOSConfiguration\x125.teleport.lib.vnet.v1.GetTargetOSConfigurationRequest\x1a6.teleport.lib.vnet.v1.GetTargetOSConfigurationResponse\x12b\n" +
+	"\vUserTLSCert\x12(.teleport.lib.vnet.v1.UserTLSCertRequest\x1a).teleport.lib.vnet.v1.UserTLSCertResponse\x12k\n" +
+	"\x0eSignForUserTLS\x12+.teleport.lib.vnet.v1.SignForUserTLSRequest\x1a,.teleport.lib.vnet.v1.SignForUserTLSResponse\x12q\n" +
+	"\x10SessionSSHConfig\x12-.teleport.lib.vnet.v1.SessionSSHConfigRequest\x1a..teleport.lib.vnet.v1.SessionSSHConfigResponse\x12t\n" +
+	"\x11SignForSSHSession\x12..teleport.lib.vnet.v1.SignForSSHSessionRequest\x1a/.teleport.lib.vnet.v1.SignForSSHSessionResponse\x12n\n" +
+	"\x0fExchangeSSHKeys\x12,.teleport.lib.vnet.v1.ExchangeSSHKeysRequest\x1a-.teleport.lib.vnet.v1.ExchangeSSHKeysResponseBLZJgithub.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1;vnetv1b\x06proto3"
 
 var (
 	file_teleport_lib_vnet_v1_client_application_service_proto_rawDescOnce sync.Once
@@ -1600,7 +2268,7 @@ func file_teleport_lib_vnet_v1_client_application_service_proto_rawDescGZIP() []
 }
 
 var file_teleport_lib_vnet_v1_client_application_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
+var file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes = make([]protoimpl.MessageInfo, 37)
 var file_teleport_lib_vnet_v1_client_application_service_proto_goTypes = []any{
 	(Hash)(0),                                // 0: teleport.lib.vnet.v1.Hash
 	(*AuthenticateProcessRequest)(nil),       // 1: teleport.lib.vnet.v1.AuthenticateProcessRequest
@@ -1621,15 +2289,26 @@ var file_teleport_lib_vnet_v1_client_application_service_proto_goTypes = []any{
 	(*ReissueAppCertRequest)(nil),            // 16: teleport.lib.vnet.v1.ReissueAppCertRequest
 	(*ReissueAppCertResponse)(nil),           // 17: teleport.lib.vnet.v1.ReissueAppCertResponse
 	(*SignForAppRequest)(nil),                // 18: teleport.lib.vnet.v1.SignForAppRequest
-	(*SignForAppResponse)(nil),               // 19: teleport.lib.vnet.v1.SignForAppResponse
-	(*OnNewConnectionRequest)(nil),           // 20: teleport.lib.vnet.v1.OnNewConnectionRequest
-	(*OnNewConnectionResponse)(nil),          // 21: teleport.lib.vnet.v1.OnNewConnectionResponse
-	(*OnInvalidLocalPortRequest)(nil),        // 22: teleport.lib.vnet.v1.OnInvalidLocalPortRequest
-	(*OnInvalidLocalPortResponse)(nil),       // 23: teleport.lib.vnet.v1.OnInvalidLocalPortResponse
-	(*GetTargetOSConfigurationRequest)(nil),  // 24: teleport.lib.vnet.v1.GetTargetOSConfigurationRequest
-	(*GetTargetOSConfigurationResponse)(nil), // 25: teleport.lib.vnet.v1.GetTargetOSConfigurationResponse
-	(*TargetOSConfiguration)(nil),            // 26: teleport.lib.vnet.v1.TargetOSConfiguration
-	(*types.AppV3)(nil),                      // 27: types.AppV3
+	(*SignRequest)(nil),                      // 19: teleport.lib.vnet.v1.SignRequest
+	(*SignForAppResponse)(nil),               // 20: teleport.lib.vnet.v1.SignForAppResponse
+	(*OnNewAppConnectionRequest)(nil),        // 21: teleport.lib.vnet.v1.OnNewAppConnectionRequest
+	(*OnNewAppConnectionResponse)(nil),       // 22: teleport.lib.vnet.v1.OnNewAppConnectionResponse
+	(*OnInvalidLocalPortRequest)(nil),        // 23: teleport.lib.vnet.v1.OnInvalidLocalPortRequest
+	(*OnInvalidLocalPortResponse)(nil),       // 24: teleport.lib.vnet.v1.OnInvalidLocalPortResponse
+	(*GetTargetOSConfigurationRequest)(nil),  // 25: teleport.lib.vnet.v1.GetTargetOSConfigurationRequest
+	(*GetTargetOSConfigurationResponse)(nil), // 26: teleport.lib.vnet.v1.GetTargetOSConfigurationResponse
+	(*TargetOSConfiguration)(nil),            // 27: teleport.lib.vnet.v1.TargetOSConfiguration
+	(*UserTLSCertRequest)(nil),               // 28: teleport.lib.vnet.v1.UserTLSCertRequest
+	(*UserTLSCertResponse)(nil),              // 29: teleport.lib.vnet.v1.UserTLSCertResponse
+	(*SignForUserTLSRequest)(nil),            // 30: teleport.lib.vnet.v1.SignForUserTLSRequest
+	(*SignForUserTLSResponse)(nil),           // 31: teleport.lib.vnet.v1.SignForUserTLSResponse
+	(*SessionSSHConfigRequest)(nil),          // 32: teleport.lib.vnet.v1.SessionSSHConfigRequest
+	(*SessionSSHConfigResponse)(nil),         // 33: teleport.lib.vnet.v1.SessionSSHConfigResponse
+	(*SignForSSHSessionRequest)(nil),         // 34: teleport.lib.vnet.v1.SignForSSHSessionRequest
+	(*SignForSSHSessionResponse)(nil),        // 35: teleport.lib.vnet.v1.SignForSSHSessionResponse
+	(*ExchangeSSHKeysRequest)(nil),           // 36: teleport.lib.vnet.v1.ExchangeSSHKeysRequest
+	(*ExchangeSSHKeysResponse)(nil),          // 37: teleport.lib.vnet.v1.ExchangeSSHKeysResponse
+	(*types.AppV3)(nil),                      // 38: types.AppV3
 }
 var file_teleport_lib_vnet_v1_client_application_service_proto_depIdxs = []int32{
 	4,  // 0: teleport.lib.vnet.v1.ReportNetworkStackInfoRequest.network_stack_info:type_name -> teleport.lib.vnet.v1.NetworkStackInfo
@@ -1638,37 +2317,51 @@ var file_teleport_lib_vnet_v1_client_application_service_proto_depIdxs = []int32
 	12, // 3: teleport.lib.vnet.v1.ResolveFQDNResponse.matched_cluster:type_name -> teleport.lib.vnet.v1.MatchedCluster
 	13, // 4: teleport.lib.vnet.v1.MatchedTCPApp.app_info:type_name -> teleport.lib.vnet.v1.AppInfo
 	14, // 5: teleport.lib.vnet.v1.AppInfo.app_key:type_name -> teleport.lib.vnet.v1.AppKey
-	27, // 6: teleport.lib.vnet.v1.AppInfo.app:type_name -> types.AppV3
+	38, // 6: teleport.lib.vnet.v1.AppInfo.app:type_name -> types.AppV3
 	15, // 7: teleport.lib.vnet.v1.AppInfo.dial_options:type_name -> teleport.lib.vnet.v1.DialOptions
 	13, // 8: teleport.lib.vnet.v1.ReissueAppCertRequest.app_info:type_name -> teleport.lib.vnet.v1.AppInfo
 	14, // 9: teleport.lib.vnet.v1.SignForAppRequest.app_key:type_name -> teleport.lib.vnet.v1.AppKey
-	0,  // 10: teleport.lib.vnet.v1.SignForAppRequest.hash:type_name -> teleport.lib.vnet.v1.Hash
-	14, // 11: teleport.lib.vnet.v1.OnNewConnectionRequest.app_key:type_name -> teleport.lib.vnet.v1.AppKey
-	13, // 12: teleport.lib.vnet.v1.OnInvalidLocalPortRequest.app_info:type_name -> teleport.lib.vnet.v1.AppInfo
-	26, // 13: teleport.lib.vnet.v1.GetTargetOSConfigurationResponse.target_os_configuration:type_name -> teleport.lib.vnet.v1.TargetOSConfiguration
-	1,  // 14: teleport.lib.vnet.v1.ClientApplicationService.AuthenticateProcess:input_type -> teleport.lib.vnet.v1.AuthenticateProcessRequest
-	3,  // 15: teleport.lib.vnet.v1.ClientApplicationService.ReportNetworkStackInfo:input_type -> teleport.lib.vnet.v1.ReportNetworkStackInfoRequest
-	6,  // 16: teleport.lib.vnet.v1.ClientApplicationService.Ping:input_type -> teleport.lib.vnet.v1.PingRequest
-	8,  // 17: teleport.lib.vnet.v1.ClientApplicationService.ResolveFQDN:input_type -> teleport.lib.vnet.v1.ResolveFQDNRequest
-	16, // 18: teleport.lib.vnet.v1.ClientApplicationService.ReissueAppCert:input_type -> teleport.lib.vnet.v1.ReissueAppCertRequest
-	18, // 19: teleport.lib.vnet.v1.ClientApplicationService.SignForApp:input_type -> teleport.lib.vnet.v1.SignForAppRequest
-	20, // 20: teleport.lib.vnet.v1.ClientApplicationService.OnNewConnection:input_type -> teleport.lib.vnet.v1.OnNewConnectionRequest
-	22, // 21: teleport.lib.vnet.v1.ClientApplicationService.OnInvalidLocalPort:input_type -> teleport.lib.vnet.v1.OnInvalidLocalPortRequest
-	24, // 22: teleport.lib.vnet.v1.ClientApplicationService.GetTargetOSConfiguration:input_type -> teleport.lib.vnet.v1.GetTargetOSConfigurationRequest
-	2,  // 23: teleport.lib.vnet.v1.ClientApplicationService.AuthenticateProcess:output_type -> teleport.lib.vnet.v1.AuthenticateProcessResponse
-	5,  // 24: teleport.lib.vnet.v1.ClientApplicationService.ReportNetworkStackInfo:output_type -> teleport.lib.vnet.v1.ReportNetworkStackInfoResponse
-	7,  // 25: teleport.lib.vnet.v1.ClientApplicationService.Ping:output_type -> teleport.lib.vnet.v1.PingResponse
-	9,  // 26: teleport.lib.vnet.v1.ClientApplicationService.ResolveFQDN:output_type -> teleport.lib.vnet.v1.ResolveFQDNResponse
-	17, // 27: teleport.lib.vnet.v1.ClientApplicationService.ReissueAppCert:output_type -> teleport.lib.vnet.v1.ReissueAppCertResponse
-	19, // 28: teleport.lib.vnet.v1.ClientApplicationService.SignForApp:output_type -> teleport.lib.vnet.v1.SignForAppResponse
-	21, // 29: teleport.lib.vnet.v1.ClientApplicationService.OnNewConnection:output_type -> teleport.lib.vnet.v1.OnNewConnectionResponse
-	23, // 30: teleport.lib.vnet.v1.ClientApplicationService.OnInvalidLocalPort:output_type -> teleport.lib.vnet.v1.OnInvalidLocalPortResponse
-	25, // 31: teleport.lib.vnet.v1.ClientApplicationService.GetTargetOSConfiguration:output_type -> teleport.lib.vnet.v1.GetTargetOSConfigurationResponse
-	23, // [23:32] is the sub-list for method output_type
-	14, // [14:23] is the sub-list for method input_type
-	14, // [14:14] is the sub-list for extension type_name
-	14, // [14:14] is the sub-list for extension extendee
-	0,  // [0:14] is the sub-list for field type_name
+	19, // 10: teleport.lib.vnet.v1.SignForAppRequest.sign:type_name -> teleport.lib.vnet.v1.SignRequest
+	0,  // 11: teleport.lib.vnet.v1.SignRequest.hash:type_name -> teleport.lib.vnet.v1.Hash
+	14, // 12: teleport.lib.vnet.v1.OnNewAppConnectionRequest.app_key:type_name -> teleport.lib.vnet.v1.AppKey
+	13, // 13: teleport.lib.vnet.v1.OnInvalidLocalPortRequest.app_info:type_name -> teleport.lib.vnet.v1.AppInfo
+	27, // 14: teleport.lib.vnet.v1.GetTargetOSConfigurationResponse.target_os_configuration:type_name -> teleport.lib.vnet.v1.TargetOSConfiguration
+	15, // 15: teleport.lib.vnet.v1.UserTLSCertResponse.dial_options:type_name -> teleport.lib.vnet.v1.DialOptions
+	19, // 16: teleport.lib.vnet.v1.SignForUserTLSRequest.sign:type_name -> teleport.lib.vnet.v1.SignRequest
+	19, // 17: teleport.lib.vnet.v1.SignForSSHSessionRequest.sign:type_name -> teleport.lib.vnet.v1.SignRequest
+	1,  // 18: teleport.lib.vnet.v1.ClientApplicationService.AuthenticateProcess:input_type -> teleport.lib.vnet.v1.AuthenticateProcessRequest
+	3,  // 19: teleport.lib.vnet.v1.ClientApplicationService.ReportNetworkStackInfo:input_type -> teleport.lib.vnet.v1.ReportNetworkStackInfoRequest
+	6,  // 20: teleport.lib.vnet.v1.ClientApplicationService.Ping:input_type -> teleport.lib.vnet.v1.PingRequest
+	8,  // 21: teleport.lib.vnet.v1.ClientApplicationService.ResolveFQDN:input_type -> teleport.lib.vnet.v1.ResolveFQDNRequest
+	16, // 22: teleport.lib.vnet.v1.ClientApplicationService.ReissueAppCert:input_type -> teleport.lib.vnet.v1.ReissueAppCertRequest
+	18, // 23: teleport.lib.vnet.v1.ClientApplicationService.SignForApp:input_type -> teleport.lib.vnet.v1.SignForAppRequest
+	21, // 24: teleport.lib.vnet.v1.ClientApplicationService.OnNewAppConnection:input_type -> teleport.lib.vnet.v1.OnNewAppConnectionRequest
+	23, // 25: teleport.lib.vnet.v1.ClientApplicationService.OnInvalidLocalPort:input_type -> teleport.lib.vnet.v1.OnInvalidLocalPortRequest
+	25, // 26: teleport.lib.vnet.v1.ClientApplicationService.GetTargetOSConfiguration:input_type -> teleport.lib.vnet.v1.GetTargetOSConfigurationRequest
+	28, // 27: teleport.lib.vnet.v1.ClientApplicationService.UserTLSCert:input_type -> teleport.lib.vnet.v1.UserTLSCertRequest
+	30, // 28: teleport.lib.vnet.v1.ClientApplicationService.SignForUserTLS:input_type -> teleport.lib.vnet.v1.SignForUserTLSRequest
+	32, // 29: teleport.lib.vnet.v1.ClientApplicationService.SessionSSHConfig:input_type -> teleport.lib.vnet.v1.SessionSSHConfigRequest
+	34, // 30: teleport.lib.vnet.v1.ClientApplicationService.SignForSSHSession:input_type -> teleport.lib.vnet.v1.SignForSSHSessionRequest
+	36, // 31: teleport.lib.vnet.v1.ClientApplicationService.ExchangeSSHKeys:input_type -> teleport.lib.vnet.v1.ExchangeSSHKeysRequest
+	2,  // 32: teleport.lib.vnet.v1.ClientApplicationService.AuthenticateProcess:output_type -> teleport.lib.vnet.v1.AuthenticateProcessResponse
+	5,  // 33: teleport.lib.vnet.v1.ClientApplicationService.ReportNetworkStackInfo:output_type -> teleport.lib.vnet.v1.ReportNetworkStackInfoResponse
+	7,  // 34: teleport.lib.vnet.v1.ClientApplicationService.Ping:output_type -> teleport.lib.vnet.v1.PingResponse
+	9,  // 35: teleport.lib.vnet.v1.ClientApplicationService.ResolveFQDN:output_type -> teleport.lib.vnet.v1.ResolveFQDNResponse
+	17, // 36: teleport.lib.vnet.v1.ClientApplicationService.ReissueAppCert:output_type -> teleport.lib.vnet.v1.ReissueAppCertResponse
+	20, // 37: teleport.lib.vnet.v1.ClientApplicationService.SignForApp:output_type -> teleport.lib.vnet.v1.SignForAppResponse
+	22, // 38: teleport.lib.vnet.v1.ClientApplicationService.OnNewAppConnection:output_type -> teleport.lib.vnet.v1.OnNewAppConnectionResponse
+	24, // 39: teleport.lib.vnet.v1.ClientApplicationService.OnInvalidLocalPort:output_type -> teleport.lib.vnet.v1.OnInvalidLocalPortResponse
+	26, // 40: teleport.lib.vnet.v1.ClientApplicationService.GetTargetOSConfiguration:output_type -> teleport.lib.vnet.v1.GetTargetOSConfigurationResponse
+	29, // 41: teleport.lib.vnet.v1.ClientApplicationService.UserTLSCert:output_type -> teleport.lib.vnet.v1.UserTLSCertResponse
+	31, // 42: teleport.lib.vnet.v1.ClientApplicationService.SignForUserTLS:output_type -> teleport.lib.vnet.v1.SignForUserTLSResponse
+	33, // 43: teleport.lib.vnet.v1.ClientApplicationService.SessionSSHConfig:output_type -> teleport.lib.vnet.v1.SessionSSHConfigResponse
+	35, // 44: teleport.lib.vnet.v1.ClientApplicationService.SignForSSHSession:output_type -> teleport.lib.vnet.v1.SignForSSHSessionResponse
+	37, // 45: teleport.lib.vnet.v1.ClientApplicationService.ExchangeSSHKeys:output_type -> teleport.lib.vnet.v1.ExchangeSSHKeysResponse
+	32, // [32:46] is the sub-list for method output_type
+	18, // [18:32] is the sub-list for method input_type
+	18, // [18:18] is the sub-list for extension type_name
+	18, // [18:18] is the sub-list for extension extendee
+	0,  // [0:18] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_vnet_v1_client_application_service_proto_init() }
@@ -1681,14 +2374,14 @@ func file_teleport_lib_vnet_v1_client_application_service_proto_init() {
 		(*ResolveFQDNResponse_MatchedWebApp)(nil),
 		(*ResolveFQDNResponse_MatchedCluster)(nil),
 	}
-	file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[17].OneofWrappers = []any{}
+	file_teleport_lib_vnet_v1_client_application_service_proto_msgTypes[18].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc), len(file_teleport_lib_vnet_v1_client_application_service_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   26,
+			NumMessages:   37,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/vnet/v1/client_application_service_grpc.pb.go b/gen/proto/go/teleport/lib/vnet/v1/client_application_service_grpc.pb.go
index 57af12d216082..1be07457d7424 100644
--- a/gen/proto/go/teleport/lib/vnet/v1/client_application_service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/vnet/v1/client_application_service_grpc.pb.go
@@ -41,9 +41,14 @@ const (
 	ClientApplicationService_ResolveFQDN_FullMethodName              = "/teleport.lib.vnet.v1.ClientApplicationService/ResolveFQDN"
 	ClientApplicationService_ReissueAppCert_FullMethodName           = "/teleport.lib.vnet.v1.ClientApplicationService/ReissueAppCert"
 	ClientApplicationService_SignForApp_FullMethodName               = "/teleport.lib.vnet.v1.ClientApplicationService/SignForApp"
-	ClientApplicationService_OnNewConnection_FullMethodName          = "/teleport.lib.vnet.v1.ClientApplicationService/OnNewConnection"
+	ClientApplicationService_OnNewAppConnection_FullMethodName       = "/teleport.lib.vnet.v1.ClientApplicationService/OnNewAppConnection"
 	ClientApplicationService_OnInvalidLocalPort_FullMethodName       = "/teleport.lib.vnet.v1.ClientApplicationService/OnInvalidLocalPort"
 	ClientApplicationService_GetTargetOSConfiguration_FullMethodName = "/teleport.lib.vnet.v1.ClientApplicationService/GetTargetOSConfiguration"
+	ClientApplicationService_UserTLSCert_FullMethodName              = "/teleport.lib.vnet.v1.ClientApplicationService/UserTLSCert"
+	ClientApplicationService_SignForUserTLS_FullMethodName           = "/teleport.lib.vnet.v1.ClientApplicationService/SignForUserTLS"
+	ClientApplicationService_SessionSSHConfig_FullMethodName         = "/teleport.lib.vnet.v1.ClientApplicationService/SessionSSHConfig"
+	ClientApplicationService_SignForSSHSession_FullMethodName        = "/teleport.lib.vnet.v1.ClientApplicationService/SignForSSHSession"
+	ClientApplicationService_ExchangeSSHKeys_FullMethodName          = "/teleport.lib.vnet.v1.ClientApplicationService/ExchangeSSHKeys"
 )
 
 // ClientApplicationServiceClient is the client API for ClientApplicationService service.
@@ -72,15 +77,27 @@ type ClientApplicationServiceClient interface {
 	// SignForApp issues a signature with the private key associated with an x509
 	// certificate previously issued for a requested app.
 	SignForApp(ctx context.Context, in *SignForAppRequest, opts ...grpc.CallOption) (*SignForAppResponse, error)
-	// OnNewConnection gets called whenever a new connection is about to be
+	// OnNewAppConnection gets called whenever a new app connection is about to be
 	// established through VNet for observability.
-	OnNewConnection(ctx context.Context, in *OnNewConnectionRequest, opts ...grpc.CallOption) (*OnNewConnectionResponse, error)
+	OnNewAppConnection(ctx context.Context, in *OnNewAppConnectionRequest, opts ...grpc.CallOption) (*OnNewAppConnectionResponse, error)
 	// OnInvalidLocalPort gets called before VNet refuses to handle a connection
 	// to a multi-port TCP app because the provided port does not match any of the
 	// TCP ports in the app spec.
 	OnInvalidLocalPort(ctx context.Context, in *OnInvalidLocalPortRequest, opts ...grpc.CallOption) (*OnInvalidLocalPortResponse, error)
 	// GetTargetOSConfiguration gets the target OS configuration.
 	GetTargetOSConfiguration(ctx context.Context, in *GetTargetOSConfigurationRequest, opts ...grpc.CallOption) (*GetTargetOSConfigurationResponse, error)
+	// UserTLSCert returns the user TLS certificate for a specific profile.
+	UserTLSCert(ctx context.Context, in *UserTLSCertRequest, opts ...grpc.CallOption) (*UserTLSCertResponse, error)
+	// SignForUserTLS signs a digest with the user TLS private key.
+	SignForUserTLS(ctx context.Context, in *SignForUserTLSRequest, opts ...grpc.CallOption) (*SignForUserTLSResponse, error)
+	// SessionSSHConfig returns the user SSH configuration for an SSH session.
+	SessionSSHConfig(ctx context.Context, in *SessionSSHConfigRequest, opts ...grpc.CallOption) (*SessionSSHConfigResponse, error)
+	// SignForSSHSession signs a digest with the SSH private key associated with the
+	// session from a previous call to SessionSSHConfig.
+	SignForSSHSession(ctx context.Context, in *SignForSSHSessionRequest, opts ...grpc.CallOption) (*SignForSSHSessionResponse, error)
+	// ExchangeSSHKeys sends VNet's SSH host CA key to the client application and
+	// returns the user public key.
+	ExchangeSSHKeys(ctx context.Context, in *ExchangeSSHKeysRequest, opts ...grpc.CallOption) (*ExchangeSSHKeysResponse, error)
 }
 
 type clientApplicationServiceClient struct {
@@ -151,10 +168,10 @@ func (c *clientApplicationServiceClient) SignForApp(ctx context.Context, in *Sig
 	return out, nil
 }
 
-func (c *clientApplicationServiceClient) OnNewConnection(ctx context.Context, in *OnNewConnectionRequest, opts ...grpc.CallOption) (*OnNewConnectionResponse, error) {
+func (c *clientApplicationServiceClient) OnNewAppConnection(ctx context.Context, in *OnNewAppConnectionRequest, opts ...grpc.CallOption) (*OnNewAppConnectionResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(OnNewConnectionResponse)
-	err := c.cc.Invoke(ctx, ClientApplicationService_OnNewConnection_FullMethodName, in, out, cOpts...)
+	out := new(OnNewAppConnectionResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_OnNewAppConnection_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -181,6 +198,56 @@ func (c *clientApplicationServiceClient) GetTargetOSConfiguration(ctx context.Co
 	return out, nil
 }
 
+func (c *clientApplicationServiceClient) UserTLSCert(ctx context.Context, in *UserTLSCertRequest, opts ...grpc.CallOption) (*UserTLSCertResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UserTLSCertResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_UserTLSCert_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *clientApplicationServiceClient) SignForUserTLS(ctx context.Context, in *SignForUserTLSRequest, opts ...grpc.CallOption) (*SignForUserTLSResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SignForUserTLSResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_SignForUserTLS_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *clientApplicationServiceClient) SessionSSHConfig(ctx context.Context, in *SessionSSHConfigRequest, opts ...grpc.CallOption) (*SessionSSHConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SessionSSHConfigResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_SessionSSHConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *clientApplicationServiceClient) SignForSSHSession(ctx context.Context, in *SignForSSHSessionRequest, opts ...grpc.CallOption) (*SignForSSHSessionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SignForSSHSessionResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_SignForSSHSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *clientApplicationServiceClient) ExchangeSSHKeys(ctx context.Context, in *ExchangeSSHKeysRequest, opts ...grpc.CallOption) (*ExchangeSSHKeysResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ExchangeSSHKeysResponse)
+	err := c.cc.Invoke(ctx, ClientApplicationService_ExchangeSSHKeys_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ClientApplicationServiceServer is the server API for ClientApplicationService service.
 // All implementations must embed UnimplementedClientApplicationServiceServer
 // for forward compatibility.
@@ -207,15 +274,27 @@ type ClientApplicationServiceServer interface {
 	// SignForApp issues a signature with the private key associated with an x509
 	// certificate previously issued for a requested app.
 	SignForApp(context.Context, *SignForAppRequest) (*SignForAppResponse, error)
-	// OnNewConnection gets called whenever a new connection is about to be
+	// OnNewAppConnection gets called whenever a new app connection is about to be
 	// established through VNet for observability.
-	OnNewConnection(context.Context, *OnNewConnectionRequest) (*OnNewConnectionResponse, error)
+	OnNewAppConnection(context.Context, *OnNewAppConnectionRequest) (*OnNewAppConnectionResponse, error)
 	// OnInvalidLocalPort gets called before VNet refuses to handle a connection
 	// to a multi-port TCP app because the provided port does not match any of the
 	// TCP ports in the app spec.
 	OnInvalidLocalPort(context.Context, *OnInvalidLocalPortRequest) (*OnInvalidLocalPortResponse, error)
 	// GetTargetOSConfiguration gets the target OS configuration.
 	GetTargetOSConfiguration(context.Context, *GetTargetOSConfigurationRequest) (*GetTargetOSConfigurationResponse, error)
+	// UserTLSCert returns the user TLS certificate for a specific profile.
+	UserTLSCert(context.Context, *UserTLSCertRequest) (*UserTLSCertResponse, error)
+	// SignForUserTLS signs a digest with the user TLS private key.
+	SignForUserTLS(context.Context, *SignForUserTLSRequest) (*SignForUserTLSResponse, error)
+	// SessionSSHConfig returns the user SSH configuration for an SSH session.
+	SessionSSHConfig(context.Context, *SessionSSHConfigRequest) (*SessionSSHConfigResponse, error)
+	// SignForSSHSession signs a digest with the SSH private key associated with the
+	// session from a previous call to SessionSSHConfig.
+	SignForSSHSession(context.Context, *SignForSSHSessionRequest) (*SignForSSHSessionResponse, error)
+	// ExchangeSSHKeys sends VNet's SSH host CA key to the client application and
+	// returns the user public key.
+	ExchangeSSHKeys(context.Context, *ExchangeSSHKeysRequest) (*ExchangeSSHKeysResponse, error)
 	mustEmbedUnimplementedClientApplicationServiceServer()
 }
 
@@ -244,8 +323,8 @@ func (UnimplementedClientApplicationServiceServer) ReissueAppCert(context.Contex
 func (UnimplementedClientApplicationServiceServer) SignForApp(context.Context, *SignForAppRequest) (*SignForAppResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SignForApp not implemented")
 }
-func (UnimplementedClientApplicationServiceServer) OnNewConnection(context.Context, *OnNewConnectionRequest) (*OnNewConnectionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method OnNewConnection not implemented")
+func (UnimplementedClientApplicationServiceServer) OnNewAppConnection(context.Context, *OnNewAppConnectionRequest) (*OnNewAppConnectionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method OnNewAppConnection not implemented")
 }
 func (UnimplementedClientApplicationServiceServer) OnInvalidLocalPort(context.Context, *OnInvalidLocalPortRequest) (*OnInvalidLocalPortResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method OnInvalidLocalPort not implemented")
@@ -253,6 +332,21 @@ func (UnimplementedClientApplicationServiceServer) OnInvalidLocalPort(context.Co
 func (UnimplementedClientApplicationServiceServer) GetTargetOSConfiguration(context.Context, *GetTargetOSConfigurationRequest) (*GetTargetOSConfigurationResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetTargetOSConfiguration not implemented")
 }
+func (UnimplementedClientApplicationServiceServer) UserTLSCert(context.Context, *UserTLSCertRequest) (*UserTLSCertResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UserTLSCert not implemented")
+}
+func (UnimplementedClientApplicationServiceServer) SignForUserTLS(context.Context, *SignForUserTLSRequest) (*SignForUserTLSResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SignForUserTLS not implemented")
+}
+func (UnimplementedClientApplicationServiceServer) SessionSSHConfig(context.Context, *SessionSSHConfigRequest) (*SessionSSHConfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SessionSSHConfig not implemented")
+}
+func (UnimplementedClientApplicationServiceServer) SignForSSHSession(context.Context, *SignForSSHSessionRequest) (*SignForSSHSessionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SignForSSHSession not implemented")
+}
+func (UnimplementedClientApplicationServiceServer) ExchangeSSHKeys(context.Context, *ExchangeSSHKeysRequest) (*ExchangeSSHKeysResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ExchangeSSHKeys not implemented")
+}
 func (UnimplementedClientApplicationServiceServer) mustEmbedUnimplementedClientApplicationServiceServer() {
 }
 func (UnimplementedClientApplicationServiceServer) testEmbeddedByValue() {}
@@ -383,20 +477,20 @@ func _ClientApplicationService_SignForApp_Handler(srv interface{}, ctx context.C
 	return interceptor(ctx, in, info, handler)
 }
 
-func _ClientApplicationService_OnNewConnection_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(OnNewConnectionRequest)
+func _ClientApplicationService_OnNewAppConnection_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(OnNewAppConnectionRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(ClientApplicationServiceServer).OnNewConnection(ctx, in)
+		return srv.(ClientApplicationServiceServer).OnNewAppConnection(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: ClientApplicationService_OnNewConnection_FullMethodName,
+		FullMethod: ClientApplicationService_OnNewAppConnection_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ClientApplicationServiceServer).OnNewConnection(ctx, req.(*OnNewConnectionRequest))
+		return srv.(ClientApplicationServiceServer).OnNewAppConnection(ctx, req.(*OnNewAppConnectionRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -437,6 +531,96 @@ func _ClientApplicationService_GetTargetOSConfiguration_Handler(srv interface{},
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ClientApplicationService_UserTLSCert_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UserTLSCertRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClientApplicationServiceServer).UserTLSCert(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ClientApplicationService_UserTLSCert_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClientApplicationServiceServer).UserTLSCert(ctx, req.(*UserTLSCertRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ClientApplicationService_SignForUserTLS_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SignForUserTLSRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClientApplicationServiceServer).SignForUserTLS(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ClientApplicationService_SignForUserTLS_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClientApplicationServiceServer).SignForUserTLS(ctx, req.(*SignForUserTLSRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ClientApplicationService_SessionSSHConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SessionSSHConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClientApplicationServiceServer).SessionSSHConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ClientApplicationService_SessionSSHConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClientApplicationServiceServer).SessionSSHConfig(ctx, req.(*SessionSSHConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ClientApplicationService_SignForSSHSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SignForSSHSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClientApplicationServiceServer).SignForSSHSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ClientApplicationService_SignForSSHSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClientApplicationServiceServer).SignForSSHSession(ctx, req.(*SignForSSHSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ClientApplicationService_ExchangeSSHKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExchangeSSHKeysRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClientApplicationServiceServer).ExchangeSSHKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ClientApplicationService_ExchangeSSHKeys_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClientApplicationServiceServer).ExchangeSSHKeys(ctx, req.(*ExchangeSSHKeysRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // ClientApplicationService_ServiceDesc is the grpc.ServiceDesc for ClientApplicationService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -469,8 +653,8 @@ var ClientApplicationService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _ClientApplicationService_SignForApp_Handler,
 		},
 		{
-			MethodName: "OnNewConnection",
-			Handler:    _ClientApplicationService_OnNewConnection_Handler,
+			MethodName: "OnNewAppConnection",
+			Handler:    _ClientApplicationService_OnNewAppConnection_Handler,
 		},
 		{
 			MethodName: "OnInvalidLocalPort",
@@ -480,6 +664,26 @@ var ClientApplicationService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetTargetOSConfiguration",
 			Handler:    _ClientApplicationService_GetTargetOSConfiguration_Handler,
 		},
+		{
+			MethodName: "UserTLSCert",
+			Handler:    _ClientApplicationService_UserTLSCert_Handler,
+		},
+		{
+			MethodName: "SignForUserTLS",
+			Handler:    _ClientApplicationService_SignForUserTLS_Handler,
+		},
+		{
+			MethodName: "SessionSSHConfig",
+			Handler:    _ClientApplicationService_SessionSSHConfig_Handler,
+		},
+		{
+			MethodName: "SignForSSHSession",
+			Handler:    _ClientApplicationService_SignForSSHSession_Handler,
+		},
+		{
+			MethodName: "ExchangeSSHKeys",
+			Handler:    _ClientApplicationService_ExchangeSSHKeys_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/lib/vnet/v1/client_application_service.proto",
diff --git a/gen/proto/go/teleport/quicpeering/v1alpha/dial.pb.go b/gen/proto/go/teleport/quicpeering/v1alpha/dial.pb.go
index 986afbc59f178..e0ff423d9d076 100644
--- a/gen/proto/go/teleport/quicpeering/v1alpha/dial.pb.go
+++ b/gen/proto/go/teleport/quicpeering/v1alpha/dial.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/quicpeering/v1alpha/dial.proto
 
diff --git a/gen/proto/go/teleport/relaypeering/v1alpha/dial.pb.go b/gen/proto/go/teleport/relaypeering/v1alpha/dial.pb.go
new file mode 100644
index 0000000000000..b62df93f0de33
--- /dev/null
+++ b/gen/proto/go/teleport/relaypeering/v1alpha/dial.pb.go
@@ -0,0 +1,284 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/relaypeering/v1alpha/dial.proto
+
+package relaypeeringv1alpha
+
+import (
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// the message sent by the client at the beginning of a connection
+type DialRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// the target agent for the connection attempt; should be "<host id>.<cluster name>"
+	TargetHostId string `protobuf:"bytes,1,opt,name=target_host_id,json=targetHostId,proto3" json:"target_host_id,omitempty"`
+	// the type of the connection as defined by api/types.TunnelType ("node",
+	// "app", "kube"...)
+	ConnectionType string `protobuf:"bytes,2,opt,name=connection_type,json=connectionType,proto3" json:"connection_type,omitempty"`
+	Source         *Addr  `protobuf:"bytes,3,opt,name=source,proto3" json:"source,omitempty"`
+	Destination    *Addr  `protobuf:"bytes,4,opt,name=destination,proto3" json:"destination,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *DialRequest) Reset() {
+	*x = DialRequest{}
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DialRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DialRequest) ProtoMessage() {}
+
+func (x *DialRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DialRequest.ProtoReflect.Descriptor instead.
+func (*DialRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_relaypeering_v1alpha_dial_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DialRequest) GetTargetHostId() string {
+	if x != nil {
+		return x.TargetHostId
+	}
+	return ""
+}
+
+func (x *DialRequest) GetConnectionType() string {
+	if x != nil {
+		return x.ConnectionType
+	}
+	return ""
+}
+
+func (x *DialRequest) GetSource() *Addr {
+	if x != nil {
+		return x.Source
+	}
+	return nil
+}
+
+func (x *DialRequest) GetDestination() *Addr {
+	if x != nil {
+		return x.Destination
+	}
+	return nil
+}
+
+// the message sent by the server as a response to a DialRequest; in case of
+// success (status is missing or reports "ok") the connection data follows on
+// the same stream, otherwise the stream ends and any data sent by the client is
+// to be treated as silently discarded
+type DialResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Status        *status.Status         `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DialResponse) Reset() {
+	*x = DialResponse{}
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DialResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DialResponse) ProtoMessage() {}
+
+func (x *DialResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DialResponse.ProtoReflect.Descriptor instead.
+func (*DialResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_relaypeering_v1alpha_dial_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *DialResponse) GetStatus() *status.Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// a stringy Go net.Addr, usually converted to and from lib/utils.NetAddr
+type Addr struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// likely always "tcp"
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	// depending on the network, likely "<ip address>:<port>"
+	Addr          string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Addr) Reset() {
+	*x = Addr{}
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Addr) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Addr) ProtoMessage() {}
+
+func (x *Addr) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaypeering_v1alpha_dial_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Addr.ProtoReflect.Descriptor instead.
+func (*Addr) Descriptor() ([]byte, []int) {
+	return file_teleport_relaypeering_v1alpha_dial_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Addr) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *Addr) GetAddr() string {
+	if x != nil {
+		return x.Addr
+	}
+	return ""
+}
+
+var File_teleport_relaypeering_v1alpha_dial_proto protoreflect.FileDescriptor
+
+const file_teleport_relaypeering_v1alpha_dial_proto_rawDesc = "" +
+	"\n" +
+	"(teleport/relaypeering/v1alpha/dial.proto\x12\x1dteleport.relaypeering.v1alpha\x1a\x17google/rpc/status.proto\"\xe0\x01\n" +
+	"\vDialRequest\x12$\n" +
+	"\x0etarget_host_id\x18\x01 \x01(\tR\ftargetHostId\x12'\n" +
+	"\x0fconnection_type\x18\x02 \x01(\tR\x0econnectionType\x12;\n" +
+	"\x06source\x18\x03 \x01(\v2#.teleport.relaypeering.v1alpha.AddrR\x06source\x12E\n" +
+	"\vdestination\x18\x04 \x01(\v2#.teleport.relaypeering.v1alpha.AddrR\vdestination\":\n" +
+	"\fDialResponse\x12*\n" +
+	"\x06status\x18\x01 \x01(\v2\x12.google.rpc.StatusR\x06status\"4\n" +
+	"\x04Addr\x12\x18\n" +
+	"\anetwork\x18\x01 \x01(\tR\anetwork\x12\x12\n" +
+	"\x04addr\x18\x02 \x01(\tR\x04addrBbZ`github.com/gravitational/teleport/gen/proto/go/teleport/relaypeering/v1alpha;relaypeeringv1alphab\x06proto3"
+
+var (
+	file_teleport_relaypeering_v1alpha_dial_proto_rawDescOnce sync.Once
+	file_teleport_relaypeering_v1alpha_dial_proto_rawDescData []byte
+)
+
+func file_teleport_relaypeering_v1alpha_dial_proto_rawDescGZIP() []byte {
+	file_teleport_relaypeering_v1alpha_dial_proto_rawDescOnce.Do(func() {
+		file_teleport_relaypeering_v1alpha_dial_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_relaypeering_v1alpha_dial_proto_rawDesc), len(file_teleport_relaypeering_v1alpha_dial_proto_rawDesc)))
+	})
+	return file_teleport_relaypeering_v1alpha_dial_proto_rawDescData
+}
+
+var file_teleport_relaypeering_v1alpha_dial_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_teleport_relaypeering_v1alpha_dial_proto_goTypes = []any{
+	(*DialRequest)(nil),   // 0: teleport.relaypeering.v1alpha.DialRequest
+	(*DialResponse)(nil),  // 1: teleport.relaypeering.v1alpha.DialResponse
+	(*Addr)(nil),          // 2: teleport.relaypeering.v1alpha.Addr
+	(*status.Status)(nil), // 3: google.rpc.Status
+}
+var file_teleport_relaypeering_v1alpha_dial_proto_depIdxs = []int32{
+	2, // 0: teleport.relaypeering.v1alpha.DialRequest.source:type_name -> teleport.relaypeering.v1alpha.Addr
+	2, // 1: teleport.relaypeering.v1alpha.DialRequest.destination:type_name -> teleport.relaypeering.v1alpha.Addr
+	3, // 2: teleport.relaypeering.v1alpha.DialResponse.status:type_name -> google.rpc.Status
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_relaypeering_v1alpha_dial_proto_init() }
+func file_teleport_relaypeering_v1alpha_dial_proto_init() {
+	if File_teleport_relaypeering_v1alpha_dial_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_relaypeering_v1alpha_dial_proto_rawDesc), len(file_teleport_relaypeering_v1alpha_dial_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_relaypeering_v1alpha_dial_proto_goTypes,
+		DependencyIndexes: file_teleport_relaypeering_v1alpha_dial_proto_depIdxs,
+		MessageInfos:      file_teleport_relaypeering_v1alpha_dial_proto_msgTypes,
+	}.Build()
+	File_teleport_relaypeering_v1alpha_dial_proto = out.File
+	file_teleport_relaypeering_v1alpha_dial_proto_goTypes = nil
+	file_teleport_relaypeering_v1alpha_dial_proto_depIdxs = nil
+}
diff --git a/gen/proto/go/teleport/relaytunnel/v1alpha/control.pb.go b/gen/proto/go/teleport/relaytunnel/v1alpha/control.pb.go
new file mode 100644
index 0000000000000..c47d57808f22c
--- /dev/null
+++ b/gen/proto/go/teleport/relaytunnel/v1alpha/control.pb.go
@@ -0,0 +1,306 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/relaytunnel/v1alpha/control.proto
+
+package relaytunnelv1alpha
+
+import (
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// sent by the client at the beginning of the control stream, the first and only
+// stream opened by the client at the beginning of the connection
+type ClientHello struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// a value from the api/types.TunnelType go enum, describing which tunnel the
+	// client wants to open
+	TunnelType    string `protobuf:"bytes,1,opt,name=tunnel_type,json=tunnelType,proto3" json:"tunnel_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClientHello) Reset() {
+	*x = ClientHello{}
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientHello) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientHello) ProtoMessage() {}
+
+func (x *ClientHello) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientHello.ProtoReflect.Descriptor instead.
+func (*ClientHello) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_control_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ClientHello) GetTunnelType() string {
+	if x != nil {
+		return x.TunnelType
+	}
+	return ""
+}
+
+// sent by the server in the control stream, as a response to the ClientHello
+// message; if the status is not "ok" (or missing) the stream and connection are
+// going to be terminated
+type ServerHello struct {
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Status *status.Status         `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	// these are the same values that would be returned by
+	// DiscoveryService.Discover
+	RelayGroup            string `protobuf:"bytes,2,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	TargetConnectionCount int32  `protobuf:"varint,4,opt,name=target_connection_count,json=targetConnectionCount,proto3" json:"target_connection_count,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
+}
+
+func (x *ServerHello) Reset() {
+	*x = ServerHello{}
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ServerHello) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerHello) ProtoMessage() {}
+
+func (x *ServerHello) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerHello.ProtoReflect.Descriptor instead.
+func (*ServerHello) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_control_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ServerHello) GetStatus() *status.Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *ServerHello) GetRelayGroup() string {
+	if x != nil {
+		return x.RelayGroup
+	}
+	return ""
+}
+
+func (x *ServerHello) GetTargetConnectionCount() int32 {
+	if x != nil {
+		return x.TargetConnectionCount
+	}
+	return 0
+}
+
+// sent by the client in the control stream
+type ClientControl struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClientControl) Reset() {
+	*x = ClientControl{}
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientControl) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientControl) ProtoMessage() {}
+
+func (x *ClientControl) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientControl.ProtoReflect.Descriptor instead.
+func (*ClientControl) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_control_proto_rawDescGZIP(), []int{2}
+}
+
+// sent by the server in the control stream
+type ServerControl struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// the relay server is going to shut down soon, so the client should consider
+	// opening a new connection to maintain its tunnel connection count
+	Terminating   bool `protobuf:"varint,2,opt,name=terminating,proto3" json:"terminating,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ServerControl) Reset() {
+	*x = ServerControl{}
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ServerControl) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerControl) ProtoMessage() {}
+
+func (x *ServerControl) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_control_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerControl.ProtoReflect.Descriptor instead.
+func (*ServerControl) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_control_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ServerControl) GetTerminating() bool {
+	if x != nil {
+		return x.Terminating
+	}
+	return false
+}
+
+var File_teleport_relaytunnel_v1alpha_control_proto protoreflect.FileDescriptor
+
+const file_teleport_relaytunnel_v1alpha_control_proto_rawDesc = "" +
+	"\n" +
+	"*teleport/relaytunnel/v1alpha/control.proto\x12\x1cteleport.relaytunnel.v1alpha\x1a\x17google/rpc/status.proto\".\n" +
+	"\vClientHello\x12\x1f\n" +
+	"\vtunnel_type\x18\x01 \x01(\tR\n" +
+	"tunnelType\"\xac\x01\n" +
+	"\vServerHello\x12*\n" +
+	"\x06status\x18\x01 \x01(\v2\x12.google.rpc.StatusR\x06status\x12\x1f\n" +
+	"\vrelay_group\x18\x02 \x01(\tR\n" +
+	"relayGroup\x126\n" +
+	"\x17target_connection_count\x18\x04 \x01(\x05R\x15targetConnectionCountJ\x04\b\x03\x10\x04R\x12tunnel_public_addr\"\x0f\n" +
+	"\rClientControl\"E\n" +
+	"\rServerControl\x12 \n" +
+	"\vterminating\x18\x02 \x01(\bR\vterminatingJ\x04\b\x01\x10\x02R\fknown_relaysB`Z^github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alphab\x06proto3"
+
+var (
+	file_teleport_relaytunnel_v1alpha_control_proto_rawDescOnce sync.Once
+	file_teleport_relaytunnel_v1alpha_control_proto_rawDescData []byte
+)
+
+func file_teleport_relaytunnel_v1alpha_control_proto_rawDescGZIP() []byte {
+	file_teleport_relaytunnel_v1alpha_control_proto_rawDescOnce.Do(func() {
+		file_teleport_relaytunnel_v1alpha_control_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_control_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_control_proto_rawDesc)))
+	})
+	return file_teleport_relaytunnel_v1alpha_control_proto_rawDescData
+}
+
+var file_teleport_relaytunnel_v1alpha_control_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_relaytunnel_v1alpha_control_proto_goTypes = []any{
+	(*ClientHello)(nil),   // 0: teleport.relaytunnel.v1alpha.ClientHello
+	(*ServerHello)(nil),   // 1: teleport.relaytunnel.v1alpha.ServerHello
+	(*ClientControl)(nil), // 2: teleport.relaytunnel.v1alpha.ClientControl
+	(*ServerControl)(nil), // 3: teleport.relaytunnel.v1alpha.ServerControl
+	(*status.Status)(nil), // 4: google.rpc.Status
+}
+var file_teleport_relaytunnel_v1alpha_control_proto_depIdxs = []int32{
+	4, // 0: teleport.relaytunnel.v1alpha.ServerHello.status:type_name -> google.rpc.Status
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_teleport_relaytunnel_v1alpha_control_proto_init() }
+func file_teleport_relaytunnel_v1alpha_control_proto_init() {
+	if File_teleport_relaytunnel_v1alpha_control_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_control_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_control_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_relaytunnel_v1alpha_control_proto_goTypes,
+		DependencyIndexes: file_teleport_relaytunnel_v1alpha_control_proto_depIdxs,
+		MessageInfos:      file_teleport_relaytunnel_v1alpha_control_proto_msgTypes,
+	}.Build()
+	File_teleport_relaytunnel_v1alpha_control_proto = out.File
+	file_teleport_relaytunnel_v1alpha_control_proto_goTypes = nil
+	file_teleport_relaytunnel_v1alpha_control_proto_depIdxs = nil
+}
diff --git a/gen/proto/go/teleport/relaytunnel/v1alpha/dial.pb.go b/gen/proto/go/teleport/relaytunnel/v1alpha/dial.pb.go
new file mode 100644
index 0000000000000..ece0e865e3db8
--- /dev/null
+++ b/gen/proto/go/teleport/relaytunnel/v1alpha/dial.pb.go
@@ -0,0 +1,264 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/relaytunnel/v1alpha/dial.proto
+
+package relaytunnelv1alpha
+
+import (
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// the message sent by the server at the beginning of a dial stream (any stream
+// opened by the server, in this version of the protocol)
+type DialRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Source        *Addr                  `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
+	Destination   *Addr                  `protobuf:"bytes,2,opt,name=destination,proto3" json:"destination,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DialRequest) Reset() {
+	*x = DialRequest{}
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DialRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DialRequest) ProtoMessage() {}
+
+func (x *DialRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DialRequest.ProtoReflect.Descriptor instead.
+func (*DialRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_dial_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DialRequest) GetSource() *Addr {
+	if x != nil {
+		return x.Source
+	}
+	return nil
+}
+
+func (x *DialRequest) GetDestination() *Addr {
+	if x != nil {
+		return x.Destination
+	}
+	return nil
+}
+
+// the message sent by the client as a response to a DialRequest; in case of
+// success (status is missing or reports "ok") the connection data follows on
+// the same stream, otherwise the stream ends and any data sent by the server is
+// to be treated as silently discarded
+type DialResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Status        *status.Status         `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DialResponse) Reset() {
+	*x = DialResponse{}
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DialResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DialResponse) ProtoMessage() {}
+
+func (x *DialResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DialResponse.ProtoReflect.Descriptor instead.
+func (*DialResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_dial_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *DialResponse) GetStatus() *status.Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// a stringy Go net.Addr, usually converted to and from lib/utils.NetAddr
+type Addr struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// likely always "tcp"
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	// depending on the network, likely "<ip address>:<port>"
+	Addr          string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Addr) Reset() {
+	*x = Addr{}
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Addr) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Addr) ProtoMessage() {}
+
+func (x *Addr) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Addr.ProtoReflect.Descriptor instead.
+func (*Addr) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_dial_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Addr) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *Addr) GetAddr() string {
+	if x != nil {
+		return x.Addr
+	}
+	return ""
+}
+
+var File_teleport_relaytunnel_v1alpha_dial_proto protoreflect.FileDescriptor
+
+const file_teleport_relaytunnel_v1alpha_dial_proto_rawDesc = "" +
+	"\n" +
+	"'teleport/relaytunnel/v1alpha/dial.proto\x12\x1cteleport.relaytunnel.v1alpha\x1a\x17google/rpc/status.proto\"\x8f\x01\n" +
+	"\vDialRequest\x12:\n" +
+	"\x06source\x18\x01 \x01(\v2\".teleport.relaytunnel.v1alpha.AddrR\x06source\x12D\n" +
+	"\vdestination\x18\x02 \x01(\v2\".teleport.relaytunnel.v1alpha.AddrR\vdestination\":\n" +
+	"\fDialResponse\x12*\n" +
+	"\x06status\x18\x01 \x01(\v2\x12.google.rpc.StatusR\x06status\"4\n" +
+	"\x04Addr\x12\x18\n" +
+	"\anetwork\x18\x01 \x01(\tR\anetwork\x12\x12\n" +
+	"\x04addr\x18\x02 \x01(\tR\x04addrB`Z^github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alphab\x06proto3"
+
+var (
+	file_teleport_relaytunnel_v1alpha_dial_proto_rawDescOnce sync.Once
+	file_teleport_relaytunnel_v1alpha_dial_proto_rawDescData []byte
+)
+
+func file_teleport_relaytunnel_v1alpha_dial_proto_rawDescGZIP() []byte {
+	file_teleport_relaytunnel_v1alpha_dial_proto_rawDescOnce.Do(func() {
+		file_teleport_relaytunnel_v1alpha_dial_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_dial_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_dial_proto_rawDesc)))
+	})
+	return file_teleport_relaytunnel_v1alpha_dial_proto_rawDescData
+}
+
+var file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_teleport_relaytunnel_v1alpha_dial_proto_goTypes = []any{
+	(*DialRequest)(nil),   // 0: teleport.relaytunnel.v1alpha.DialRequest
+	(*DialResponse)(nil),  // 1: teleport.relaytunnel.v1alpha.DialResponse
+	(*Addr)(nil),          // 2: teleport.relaytunnel.v1alpha.Addr
+	(*status.Status)(nil), // 3: google.rpc.Status
+}
+var file_teleport_relaytunnel_v1alpha_dial_proto_depIdxs = []int32{
+	2, // 0: teleport.relaytunnel.v1alpha.DialRequest.source:type_name -> teleport.relaytunnel.v1alpha.Addr
+	2, // 1: teleport.relaytunnel.v1alpha.DialRequest.destination:type_name -> teleport.relaytunnel.v1alpha.Addr
+	3, // 2: teleport.relaytunnel.v1alpha.DialResponse.status:type_name -> google.rpc.Status
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_relaytunnel_v1alpha_dial_proto_init() }
+func file_teleport_relaytunnel_v1alpha_dial_proto_init() {
+	if File_teleport_relaytunnel_v1alpha_dial_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_dial_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_dial_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_relaytunnel_v1alpha_dial_proto_goTypes,
+		DependencyIndexes: file_teleport_relaytunnel_v1alpha_dial_proto_depIdxs,
+		MessageInfos:      file_teleport_relaytunnel_v1alpha_dial_proto_msgTypes,
+	}.Build()
+	File_teleport_relaytunnel_v1alpha_dial_proto = out.File
+	file_teleport_relaytunnel_v1alpha_dial_proto_goTypes = nil
+	file_teleport_relaytunnel_v1alpha_dial_proto_depIdxs = nil
+}
diff --git a/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service.pb.go b/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service.pb.go
new file mode 100644
index 0000000000000..bde2195f618dd
--- /dev/null
+++ b/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service.pb.go
@@ -0,0 +1,203 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.8
+// 	protoc        (unknown)
+// source: teleport/relaytunnel/v1alpha/discovery_service.proto
+
+package relaytunnelv1alpha
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// request message for DiscoveryService.Discover
+type DiscoverRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DiscoverRequest) Reset() {
+	*x = DiscoverRequest{}
+	mi := &file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DiscoverRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DiscoverRequest) ProtoMessage() {}
+
+func (x *DiscoverRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DiscoverRequest.ProtoReflect.Descriptor instead.
+func (*DiscoverRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescGZIP(), []int{0}
+}
+
+// response message for DiscoveryService.Discover
+type DiscoverResponse struct {
+	state                 protoimpl.MessageState `protogen:"open.v1"`
+	RelayGroup            string                 `protobuf:"bytes,1,opt,name=relay_group,json=relayGroup,proto3" json:"relay_group,omitempty"`
+	TargetConnectionCount int32                  `protobuf:"varint,2,opt,name=target_connection_count,json=targetConnectionCount,proto3" json:"target_connection_count,omitempty"`
+	// the list of api/types.TunnelTypes supported by this Relay group; if empty,
+	// it should be treated as containing only types.NodeTunnel ("node")
+	SupportedTunnelTypes []string `protobuf:"bytes,3,rep,name=supported_tunnel_types,json=supportedTunnelTypes,proto3" json:"supported_tunnel_types,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
+}
+
+func (x *DiscoverResponse) Reset() {
+	*x = DiscoverResponse{}
+	mi := &file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DiscoverResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DiscoverResponse) ProtoMessage() {}
+
+func (x *DiscoverResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DiscoverResponse.ProtoReflect.Descriptor instead.
+func (*DiscoverResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *DiscoverResponse) GetRelayGroup() string {
+	if x != nil {
+		return x.RelayGroup
+	}
+	return ""
+}
+
+func (x *DiscoverResponse) GetTargetConnectionCount() int32 {
+	if x != nil {
+		return x.TargetConnectionCount
+	}
+	return 0
+}
+
+func (x *DiscoverResponse) GetSupportedTunnelTypes() []string {
+	if x != nil {
+		return x.SupportedTunnelTypes
+	}
+	return nil
+}
+
+var File_teleport_relaytunnel_v1alpha_discovery_service_proto protoreflect.FileDescriptor
+
+const file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDesc = "" +
+	"\n" +
+	"4teleport/relaytunnel/v1alpha/discovery_service.proto\x12\x1cteleport.relaytunnel.v1alpha\"\x11\n" +
+	"\x0fDiscoverRequest\"\xa1\x01\n" +
+	"\x10DiscoverResponse\x12\x1f\n" +
+	"\vrelay_group\x18\x01 \x01(\tR\n" +
+	"relayGroup\x126\n" +
+	"\x17target_connection_count\x18\x02 \x01(\x05R\x15targetConnectionCount\x124\n" +
+	"\x16supported_tunnel_types\x18\x03 \x03(\tR\x14supportedTunnelTypes2}\n" +
+	"\x10DiscoveryService\x12i\n" +
+	"\bDiscover\x12-.teleport.relaytunnel.v1alpha.DiscoverRequest\x1a..teleport.relaytunnel.v1alpha.DiscoverResponseB`Z^github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alphab\x06proto3"
+
+var (
+	file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescOnce sync.Once
+	file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescData []byte
+)
+
+func file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescGZIP() []byte {
+	file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescOnce.Do(func() {
+		file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDesc)))
+	})
+	return file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDescData
+}
+
+var file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_relaytunnel_v1alpha_discovery_service_proto_goTypes = []any{
+	(*DiscoverRequest)(nil),  // 0: teleport.relaytunnel.v1alpha.DiscoverRequest
+	(*DiscoverResponse)(nil), // 1: teleport.relaytunnel.v1alpha.DiscoverResponse
+}
+var file_teleport_relaytunnel_v1alpha_discovery_service_proto_depIdxs = []int32{
+	0, // 0: teleport.relaytunnel.v1alpha.DiscoveryService.Discover:input_type -> teleport.relaytunnel.v1alpha.DiscoverRequest
+	1, // 1: teleport.relaytunnel.v1alpha.DiscoveryService.Discover:output_type -> teleport.relaytunnel.v1alpha.DiscoverResponse
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_teleport_relaytunnel_v1alpha_discovery_service_proto_init() }
+func file_teleport_relaytunnel_v1alpha_discovery_service_proto_init() {
+	if File_teleport_relaytunnel_v1alpha_discovery_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDesc), len(file_teleport_relaytunnel_v1alpha_discovery_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_relaytunnel_v1alpha_discovery_service_proto_goTypes,
+		DependencyIndexes: file_teleport_relaytunnel_v1alpha_discovery_service_proto_depIdxs,
+		MessageInfos:      file_teleport_relaytunnel_v1alpha_discovery_service_proto_msgTypes,
+	}.Build()
+	File_teleport_relaytunnel_v1alpha_discovery_service_proto = out.File
+	file_teleport_relaytunnel_v1alpha_discovery_service_proto_goTypes = nil
+	file_teleport_relaytunnel_v1alpha_discovery_service_proto_depIdxs = nil
+}
diff --git a/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service_grpc.pb.go b/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service_grpc.pb.go
new file mode 100644
index 0000000000000..4cea59d3b452a
--- /dev/null
+++ b/gen/proto/go/teleport/relaytunnel/v1alpha/discovery_service_grpc.pb.go
@@ -0,0 +1,145 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: teleport/relaytunnel/v1alpha/discovery_service.proto
+
+package relaytunnelv1alpha
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	DiscoveryService_Discover_FullMethodName = "/teleport.relaytunnel.v1alpha.DiscoveryService/Discover"
+)
+
+// DiscoveryServiceClient is the client API for DiscoveryService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// rpcs related to the distribution of information about the relay group to
+// agents
+type DiscoveryServiceClient interface {
+	// returns info about the relay group and how agents should behave
+	Discover(ctx context.Context, in *DiscoverRequest, opts ...grpc.CallOption) (*DiscoverResponse, error)
+}
+
+type discoveryServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewDiscoveryServiceClient(cc grpc.ClientConnInterface) DiscoveryServiceClient {
+	return &discoveryServiceClient{cc}
+}
+
+func (c *discoveryServiceClient) Discover(ctx context.Context, in *DiscoverRequest, opts ...grpc.CallOption) (*DiscoverResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DiscoverResponse)
+	err := c.cc.Invoke(ctx, DiscoveryService_Discover_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// DiscoveryServiceServer is the server API for DiscoveryService service.
+// All implementations must embed UnimplementedDiscoveryServiceServer
+// for forward compatibility.
+//
+// rpcs related to the distribution of information about the relay group to
+// agents
+type DiscoveryServiceServer interface {
+	// returns info about the relay group and how agents should behave
+	Discover(context.Context, *DiscoverRequest) (*DiscoverResponse, error)
+	mustEmbedUnimplementedDiscoveryServiceServer()
+}
+
+// UnimplementedDiscoveryServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDiscoveryServiceServer struct{}
+
+func (UnimplementedDiscoveryServiceServer) Discover(context.Context, *DiscoverRequest) (*DiscoverResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Discover not implemented")
+}
+func (UnimplementedDiscoveryServiceServer) mustEmbedUnimplementedDiscoveryServiceServer() {}
+func (UnimplementedDiscoveryServiceServer) testEmbeddedByValue()                          {}
+
+// UnsafeDiscoveryServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DiscoveryServiceServer will
+// result in compilation errors.
+type UnsafeDiscoveryServiceServer interface {
+	mustEmbedUnimplementedDiscoveryServiceServer()
+}
+
+func RegisterDiscoveryServiceServer(s grpc.ServiceRegistrar, srv DiscoveryServiceServer) {
+	// If the following call pancis, it indicates UnimplementedDiscoveryServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&DiscoveryService_ServiceDesc, srv)
+}
+
+func _DiscoveryService_Discover_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DiscoverRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DiscoveryServiceServer).Discover(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DiscoveryService_Discover_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DiscoveryServiceServer).Discover(ctx, req.(*DiscoverRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// DiscoveryService_ServiceDesc is the grpc.ServiceDesc for DiscoveryService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var DiscoveryService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.relaytunnel.v1alpha.DiscoveryService",
+	HandlerType: (*DiscoveryServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Discover",
+			Handler:    _DiscoveryService_Discover_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/relaytunnel/v1alpha/discovery_service.proto",
+}
diff --git a/gen/proto/go/teleport/storage/local/stableunixusers/v1/stableunixusers.pb.go b/gen/proto/go/teleport/storage/local/stableunixusers/v1/stableunixusers.pb.go
index 24fb981a8b66c..43becbf109b70 100644
--- a/gen/proto/go/teleport/storage/local/stableunixusers/v1/stableunixusers.pb.go
+++ b/gen/proto/go/teleport/storage/local/stableunixusers/v1/stableunixusers.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/storage/local/stableunixusers/v1/stableunixusers.proto
 
diff --git a/gen/proto/ts/google/protobuf/descriptor_pb.ts b/gen/proto/ts/google/protobuf/descriptor_pb.ts
index c0f84db4647ad..7a0e7c5b04683 100644
--- a/gen/proto/ts/google/protobuf/descriptor_pb.ts
+++ b/gen/proto/ts/google/protobuf/descriptor_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/descriptor.proto" (package "google.protobuf", syntax proto2)
 // tslint:disable
 // @ts-nocheck
@@ -97,6 +97,13 @@ export interface FileDescriptorProto {
      * @generated from protobuf field: repeated int32 weak_dependency = 11;
      */
     weakDependency: number[];
+    /**
+     * Names of files imported by this file purely for the purpose of providing
+     * option extensions. These are excluded from the dependency list above.
+     *
+     * @generated from protobuf field: repeated string option_dependency = 15;
+     */
+    optionDependency: string[];
     /**
      * All top-level definitions in this file.
      *
@@ -133,12 +140,18 @@ export interface FileDescriptorProto {
      * The supported values are "proto2", "proto3", and "editions".
      *
      * If `edition` is present, this value must be "editions".
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional string syntax = 12;
      */
     syntax?: string;
     /**
      * The edition of the proto file.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.Edition edition = 14;
      */
@@ -193,6 +206,12 @@ export interface DescriptorProto {
      * @generated from protobuf field: repeated string reserved_name = 10;
      */
     reservedName: string[];
+    /**
+     * Support for `export` and `local` keywords on enums.
+     *
+     * @generated from protobuf field: optional google.protobuf.SymbolVisibility visibility = 11;
+     */
+    visibility?: SymbolVisibility;
 }
 /**
  * @generated from protobuf message google.protobuf.DescriptorProto.ExtensionRange
@@ -596,6 +615,12 @@ export interface EnumDescriptorProto {
      * @generated from protobuf field: repeated string reserved_name = 5;
      */
     reservedName: string[];
+    /**
+     * Support for `export` and `local` keywords on enums.
+     *
+     * @generated from protobuf field: optional google.protobuf.SymbolVisibility visibility = 6;
+     */
+    visibility?: SymbolVisibility;
 }
 /**
  * Range of reserved numeric values. Reserved values may not be used by
@@ -889,6 +914,9 @@ export interface FileOptions {
     rubyPackage?: string;
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 50;
      */
@@ -1020,6 +1048,9 @@ export interface MessageOptions {
     deprecatedLegacyJsonFieldConflicts?: boolean;
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 12;
      */
@@ -1146,6 +1177,9 @@ export interface FieldOptions {
     editionDefaults: FieldOptions_EditionDefault[];
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 21;
      */
@@ -1334,6 +1368,9 @@ export enum FieldOptions_OptionTargetType {
 export interface OneofOptions {
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 1;
      */
@@ -1379,6 +1416,9 @@ export interface EnumOptions {
     deprecatedLegacyJsonFieldConflicts?: boolean;
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 7;
      */
@@ -1405,6 +1445,9 @@ export interface EnumValueOptions {
     deprecated?: boolean;
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 2;
      */
@@ -1436,6 +1479,9 @@ export interface EnumValueOptions {
 export interface ServiceOptions {
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 34;
      */
@@ -1485,6 +1531,9 @@ export interface MethodOptions {
     idempotencyLevel?: MethodOptions_IdempotencyLevel;
     /**
      * Any features defined in the specific edition.
+     * WARNING: This field should only be used by protobuf plugins or special
+     * cases like the proto compiler. Other uses are discouraged and
+     * developers should rely on the protoreflect APIs for their client language.
      *
      * @generated from protobuf field: optional google.protobuf.FeatureSet features = 35;
      */
@@ -1621,6 +1670,54 @@ export interface FeatureSet {
      * @generated from protobuf field: optional google.protobuf.FeatureSet.JsonFormat json_format = 6;
      */
     jsonFormat?: FeatureSet_JsonFormat;
+    /**
+     * @generated from protobuf field: optional google.protobuf.FeatureSet.EnforceNamingStyle enforce_naming_style = 7;
+     */
+    enforceNamingStyle?: FeatureSet_EnforceNamingStyle;
+    /**
+     * @generated from protobuf field: optional google.protobuf.FeatureSet.VisibilityFeature.DefaultSymbolVisibility default_symbol_visibility = 8;
+     */
+    defaultSymbolVisibility?: FeatureSet_VisibilityFeature_DefaultSymbolVisibility;
+}
+/**
+ * @generated from protobuf message google.protobuf.FeatureSet.VisibilityFeature
+ */
+export interface FeatureSet_VisibilityFeature {
+}
+/**
+ * @generated from protobuf enum google.protobuf.FeatureSet.VisibilityFeature.DefaultSymbolVisibility
+ */
+export enum FeatureSet_VisibilityFeature_DefaultSymbolVisibility {
+    /**
+     * @generated from protobuf enum value: DEFAULT_SYMBOL_VISIBILITY_UNKNOWN = 0;
+     */
+    DEFAULT_SYMBOL_VISIBILITY_UNKNOWN = 0,
+    /**
+     * Default pre-EDITION_2024, all UNSET visibility are export.
+     *
+     * @generated from protobuf enum value: EXPORT_ALL = 1;
+     */
+    EXPORT_ALL = 1,
+    /**
+     * All top-level symbols default to export, nested default to local.
+     *
+     * @generated from protobuf enum value: EXPORT_TOP_LEVEL = 2;
+     */
+    EXPORT_TOP_LEVEL = 2,
+    /**
+     * All symbols default to local.
+     *
+     * @generated from protobuf enum value: LOCAL_ALL = 3;
+     */
+    LOCAL_ALL = 3,
+    /**
+     * All symbols local by default. Nested types cannot be exported.
+     * With special case caveat for message { enum {} reserved 1 to max; }
+     * This is the recommended setting for new protos.
+     *
+     * @generated from protobuf enum value: STRICT = 4;
+     */
+    STRICT = 4
 }
 /**
  * @generated from protobuf enum google.protobuf.FeatureSet.FieldPresence
@@ -1728,6 +1825,23 @@ export enum FeatureSet_JsonFormat {
      */
     LEGACY_BEST_EFFORT = 2
 }
+/**
+ * @generated from protobuf enum google.protobuf.FeatureSet.EnforceNamingStyle
+ */
+export enum FeatureSet_EnforceNamingStyle {
+    /**
+     * @generated from protobuf enum value: ENFORCE_NAMING_STYLE_UNKNOWN = 0;
+     */
+    ENFORCE_NAMING_STYLE_UNKNOWN = 0,
+    /**
+     * @generated from protobuf enum value: STYLE2024 = 1;
+     */
+    STYLE2024 = 1,
+    /**
+     * @generated from protobuf enum value: STYLE_LEGACY = 2;
+     */
+    STYLE_LEGACY = 2
+}
 /**
  * A compiled specification for the defaults of a set of features.  These
  * messages are generated from FeatureSet extensions and can be used to seed
@@ -2099,6 +2213,29 @@ export enum Edition {
      */
     EDITION_MAX = 2147483647
 }
+/**
+ * Describes the 'visibility' of a symbol with respect to the proto import
+ * system. Symbols can only be imported when the visibility rules do not prevent
+ * it (ex: local symbols cannot be imported).  Visibility modifiers can only set
+ * on `message` and `enum` as they are the only types available to be referenced
+ * from other files.
+ *
+ * @generated from protobuf enum google.protobuf.SymbolVisibility
+ */
+export enum SymbolVisibility {
+    /**
+     * @generated from protobuf enum value: VISIBILITY_UNSET = 0;
+     */
+    VISIBILITY_UNSET = 0,
+    /**
+     * @generated from protobuf enum value: VISIBILITY_LOCAL = 1;
+     */
+    VISIBILITY_LOCAL = 1,
+    /**
+     * @generated from protobuf enum value: VISIBILITY_EXPORT = 2;
+     */
+    VISIBILITY_EXPORT = 2
+}
 // @generated message type with reflection information, may provide speed optimized methods
 class FileDescriptorSet$Type extends MessageType<FileDescriptorSet> {
     constructor() {
@@ -2155,6 +2292,7 @@ class FileDescriptorProto$Type extends MessageType<FileDescriptorProto> {
             { no: 3, name: "dependency", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 10, name: "public_dependency", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 5 /*ScalarType.INT32*/ },
             { no: 11, name: "weak_dependency", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 5 /*ScalarType.INT32*/ },
+            { no: 15, name: "option_dependency", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "message_type", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => DescriptorProto },
             { no: 5, name: "enum_type", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => EnumDescriptorProto },
             { no: 6, name: "service", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => ServiceDescriptorProto },
@@ -2170,6 +2308,7 @@ class FileDescriptorProto$Type extends MessageType<FileDescriptorProto> {
         message.dependency = [];
         message.publicDependency = [];
         message.weakDependency = [];
+        message.optionDependency = [];
         message.messageType = [];
         message.enumType = [];
         message.service = [];
@@ -2206,6 +2345,9 @@ class FileDescriptorProto$Type extends MessageType<FileDescriptorProto> {
                     else
                         message.weakDependency.push(reader.int32());
                     break;
+                case /* repeated string option_dependency */ 15:
+                    message.optionDependency.push(reader.string());
+                    break;
                 case /* repeated google.protobuf.DescriptorProto message_type */ 4:
                     message.messageType.push(DescriptorProto.internalBinaryRead(reader, reader.uint32(), options));
                     break;
@@ -2257,6 +2399,9 @@ class FileDescriptorProto$Type extends MessageType<FileDescriptorProto> {
         /* repeated int32 weak_dependency = 11; */
         for (let i = 0; i < message.weakDependency.length; i++)
             writer.tag(11, WireType.Varint).int32(message.weakDependency[i]);
+        /* repeated string option_dependency = 15; */
+        for (let i = 0; i < message.optionDependency.length; i++)
+            writer.tag(15, WireType.LengthDelimited).string(message.optionDependency[i]);
         /* repeated google.protobuf.DescriptorProto message_type = 4; */
         for (let i = 0; i < message.messageType.length; i++)
             DescriptorProto.internalBinaryWrite(message.messageType[i], writer.tag(4, WireType.LengthDelimited).fork(), options).join();
@@ -2304,7 +2449,8 @@ class DescriptorProto$Type extends MessageType<DescriptorProto> {
             { no: 8, name: "oneof_decl", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => OneofDescriptorProto },
             { no: 7, name: "options", kind: "message", T: () => MessageOptions },
             { no: 9, name: "reserved_range", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => DescriptorProto_ReservedRange },
-            { no: 10, name: "reserved_name", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+            { no: 10, name: "reserved_name", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "visibility", kind: "enum", opt: true, T: () => ["google.protobuf.SymbolVisibility", SymbolVisibility] }
         ]);
     }
     create(value?: PartialMessage<DescriptorProto>): DescriptorProto {
@@ -2356,6 +2502,9 @@ class DescriptorProto$Type extends MessageType<DescriptorProto> {
                 case /* repeated string reserved_name */ 10:
                     message.reservedName.push(reader.string());
                     break;
+                case /* optional google.protobuf.SymbolVisibility visibility */ 11:
+                    message.visibility = reader.int32();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2398,6 +2547,9 @@ class DescriptorProto$Type extends MessageType<DescriptorProto> {
         /* repeated string reserved_name = 10; */
         for (let i = 0; i < message.reservedName.length; i++)
             writer.tag(10, WireType.LengthDelimited).string(message.reservedName[i]);
+        /* optional google.protobuf.SymbolVisibility visibility = 11; */
+        if (message.visibility !== undefined)
+            writer.tag(11, WireType.Varint).int32(message.visibility);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2841,7 +2993,8 @@ class EnumDescriptorProto$Type extends MessageType<EnumDescriptorProto> {
             { no: 2, name: "value", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => EnumValueDescriptorProto },
             { no: 3, name: "options", kind: "message", T: () => EnumOptions },
             { no: 4, name: "reserved_range", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => EnumDescriptorProto_EnumReservedRange },
-            { no: 5, name: "reserved_name", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+            { no: 5, name: "reserved_name", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "visibility", kind: "enum", opt: true, T: () => ["google.protobuf.SymbolVisibility", SymbolVisibility] }
         ]);
     }
     create(value?: PartialMessage<EnumDescriptorProto>): EnumDescriptorProto {
@@ -2873,6 +3026,9 @@ class EnumDescriptorProto$Type extends MessageType<EnumDescriptorProto> {
                 case /* repeated string reserved_name */ 5:
                     message.reservedName.push(reader.string());
                     break;
+                case /* optional google.protobuf.SymbolVisibility visibility */ 6:
+                    message.visibility = reader.int32();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2900,6 +3056,9 @@ class EnumDescriptorProto$Type extends MessageType<EnumDescriptorProto> {
         /* repeated string reserved_name = 5; */
         for (let i = 0; i < message.reservedName.length; i++)
             writer.tag(5, WireType.LengthDelimited).string(message.reservedName[i]);
+        /* optional google.protobuf.SymbolVisibility visibility = 6; */
+        if (message.visibility !== undefined)
+            writer.tag(6, WireType.Varint).int32(message.visibility);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4191,7 +4350,9 @@ class FeatureSet$Type extends MessageType<FeatureSet> {
             { no: 3, name: "repeated_field_encoding", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.RepeatedFieldEncoding", FeatureSet_RepeatedFieldEncoding] },
             { no: 4, name: "utf8_validation", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.Utf8Validation", FeatureSet_Utf8Validation] },
             { no: 5, name: "message_encoding", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.MessageEncoding", FeatureSet_MessageEncoding] },
-            { no: 6, name: "json_format", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.JsonFormat", FeatureSet_JsonFormat] }
+            { no: 6, name: "json_format", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.JsonFormat", FeatureSet_JsonFormat] },
+            { no: 7, name: "enforce_naming_style", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.EnforceNamingStyle", FeatureSet_EnforceNamingStyle] },
+            { no: 8, name: "default_symbol_visibility", kind: "enum", opt: true, T: () => ["google.protobuf.FeatureSet.VisibilityFeature.DefaultSymbolVisibility", FeatureSet_VisibilityFeature_DefaultSymbolVisibility] }
         ]);
     }
     create(value?: PartialMessage<FeatureSet>): FeatureSet {
@@ -4223,6 +4384,12 @@ class FeatureSet$Type extends MessageType<FeatureSet> {
                 case /* optional google.protobuf.FeatureSet.JsonFormat json_format */ 6:
                     message.jsonFormat = reader.int32();
                     break;
+                case /* optional google.protobuf.FeatureSet.EnforceNamingStyle enforce_naming_style */ 7:
+                    message.enforceNamingStyle = reader.int32();
+                    break;
+                case /* optional google.protobuf.FeatureSet.VisibilityFeature.DefaultSymbolVisibility default_symbol_visibility */ 8:
+                    message.defaultSymbolVisibility = reader.int32();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4253,6 +4420,12 @@ class FeatureSet$Type extends MessageType<FeatureSet> {
         /* optional google.protobuf.FeatureSet.JsonFormat json_format = 6; */
         if (message.jsonFormat !== undefined)
             writer.tag(6, WireType.Varint).int32(message.jsonFormat);
+        /* optional google.protobuf.FeatureSet.EnforceNamingStyle enforce_naming_style = 7; */
+        if (message.enforceNamingStyle !== undefined)
+            writer.tag(7, WireType.Varint).int32(message.enforceNamingStyle);
+        /* optional google.protobuf.FeatureSet.VisibilityFeature.DefaultSymbolVisibility default_symbol_visibility = 8; */
+        if (message.defaultSymbolVisibility !== undefined)
+            writer.tag(8, WireType.Varint).int32(message.defaultSymbolVisibility);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4264,6 +4437,31 @@ class FeatureSet$Type extends MessageType<FeatureSet> {
  */
 export const FeatureSet = new FeatureSet$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class FeatureSet_VisibilityFeature$Type extends MessageType<FeatureSet_VisibilityFeature> {
+    constructor() {
+        super("google.protobuf.FeatureSet.VisibilityFeature", []);
+    }
+    create(value?: PartialMessage<FeatureSet_VisibilityFeature>): FeatureSet_VisibilityFeature {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<FeatureSet_VisibilityFeature>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FeatureSet_VisibilityFeature): FeatureSet_VisibilityFeature {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: FeatureSet_VisibilityFeature, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.FeatureSet.VisibilityFeature
+ */
+export const FeatureSet_VisibilityFeature = new FeatureSet_VisibilityFeature$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class FeatureSetDefaults$Type extends MessageType<FeatureSetDefaults> {
     constructor() {
         super("google.protobuf.FeatureSetDefaults", [
diff --git a/gen/proto/ts/google/protobuf/duration_pb.ts b/gen/proto/ts/google/protobuf/duration_pb.ts
index 41d5e6afa4ba1..6ccacd051ed5f 100644
--- a/gen/proto/ts/google/protobuf/duration_pb.ts
+++ b/gen/proto/ts/google/protobuf/duration_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/duration.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/google/protobuf/empty_pb.ts b/gen/proto/ts/google/protobuf/empty_pb.ts
index c4e1f5eb70ead..eb6aa4ffcab5e 100644
--- a/gen/proto/ts/google/protobuf/empty_pb.ts
+++ b/gen/proto/ts/google/protobuf/empty_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/empty.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/google/protobuf/field_mask_pb.ts b/gen/proto/ts/google/protobuf/field_mask_pb.ts
deleted file mode 100644
index 4fda765a2bcff..0000000000000
--- a/gen/proto/ts/google/protobuf/field_mask_pb.ts
+++ /dev/null
@@ -1,338 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "google/protobuf/field_mask.proto" (package "google.protobuf", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { typeofJsonValue } from "@protobuf-ts/runtime";
-import type { JsonValue } from "@protobuf-ts/runtime";
-import { lowerCamelCase } from "@protobuf-ts/runtime";
-import type { JsonReadOptions } from "@protobuf-ts/runtime";
-import type { JsonWriteOptions } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-/**
- * `FieldMask` represents a set of symbolic field paths, for example:
- *
- *     paths: "f.a"
- *     paths: "f.b.d"
- *
- * Here `f` represents a field in some root message, `a` and `b`
- * fields in the message found in `f`, and `d` a field found in the
- * message in `f.b`.
- *
- * Field masks are used to specify a subset of fields that should be
- * returned by a get operation or modified by an update operation.
- * Field masks also have a custom JSON encoding (see below).
- *
- * # Field Masks in Projections
- *
- * When used in the context of a projection, a response message or
- * sub-message is filtered by the API to only contain those fields as
- * specified in the mask. For example, if the mask in the previous
- * example is applied to a response message as follows:
- *
- *     f {
- *       a : 22
- *       b {
- *         d : 1
- *         x : 2
- *       }
- *       y : 13
- *     }
- *     z: 8
- *
- * The result will not contain specific values for fields x,y and z
- * (their value will be set to the default, and omitted in proto text
- * output):
- *
- *
- *     f {
- *       a : 22
- *       b {
- *         d : 1
- *       }
- *     }
- *
- * A repeated field is not allowed except at the last position of a
- * paths string.
- *
- * If a FieldMask object is not present in a get operation, the
- * operation applies to all fields (as if a FieldMask of all fields
- * had been specified).
- *
- * Note that a field mask does not necessarily apply to the
- * top-level response message. In case of a REST get operation, the
- * field mask applies directly to the response, but in case of a REST
- * list operation, the mask instead applies to each individual message
- * in the returned resource list. In case of a REST custom method,
- * other definitions may be used. Where the mask applies will be
- * clearly documented together with its declaration in the API.  In
- * any case, the effect on the returned resource/resources is required
- * behavior for APIs.
- *
- * # Field Masks in Update Operations
- *
- * A field mask in update operations specifies which fields of the
- * targeted resource are going to be updated. The API is required
- * to only change the values of the fields as specified in the mask
- * and leave the others untouched. If a resource is passed in to
- * describe the updated values, the API ignores the values of all
- * fields not covered by the mask.
- *
- * If a repeated field is specified for an update operation, new values will
- * be appended to the existing repeated field in the target resource. Note that
- * a repeated field is only allowed in the last position of a `paths` string.
- *
- * If a sub-message is specified in the last position of the field mask for an
- * update operation, then new value will be merged into the existing sub-message
- * in the target resource.
- *
- * For example, given the target message:
- *
- *     f {
- *       b {
- *         d: 1
- *         x: 2
- *       }
- *       c: [1]
- *     }
- *
- * And an update message:
- *
- *     f {
- *       b {
- *         d: 10
- *       }
- *       c: [2]
- *     }
- *
- * then if the field mask is:
- *
- *  paths: ["f.b", "f.c"]
- *
- * then the result will be:
- *
- *     f {
- *       b {
- *         d: 10
- *         x: 2
- *       }
- *       c: [1, 2]
- *     }
- *
- * An implementation may provide options to override this default behavior for
- * repeated and message fields.
- *
- * In order to reset a field's value to the default, the field must
- * be in the mask and set to the default value in the provided resource.
- * Hence, in order to reset all fields of a resource, provide a default
- * instance of the resource and set all fields in the mask, or do
- * not provide a mask as described below.
- *
- * If a field mask is not present on update, the operation applies to
- * all fields (as if a field mask of all fields has been specified).
- * Note that in the presence of schema evolution, this may mean that
- * fields the client does not know and has therefore not filled into
- * the request will be reset to their default. If this is unwanted
- * behavior, a specific service may require a client to always specify
- * a field mask, producing an error if not.
- *
- * As with get operations, the location of the resource which
- * describes the updated values in the request message depends on the
- * operation kind. In any case, the effect of the field mask is
- * required to be honored by the API.
- *
- * ## Considerations for HTTP REST
- *
- * The HTTP kind of an update operation which uses a field mask must
- * be set to PATCH instead of PUT in order to satisfy HTTP semantics
- * (PUT must only be used for full updates).
- *
- * # JSON Encoding of Field Masks
- *
- * In JSON, a field mask is encoded as a single string where paths are
- * separated by a comma. Fields name in each path are converted
- * to/from lower-camel naming conventions.
- *
- * As an example, consider the following message declarations:
- *
- *     message Profile {
- *       User user = 1;
- *       Photo photo = 2;
- *     }
- *     message User {
- *       string display_name = 1;
- *       string address = 2;
- *     }
- *
- * In proto a field mask for `Profile` may look as such:
- *
- *     mask {
- *       paths: "user.display_name"
- *       paths: "photo"
- *     }
- *
- * In JSON, the same mask is represented as below:
- *
- *     {
- *       mask: "user.displayName,photo"
- *     }
- *
- * # Field Masks and Oneof Fields
- *
- * Field masks treat fields in oneofs just as regular fields. Consider the
- * following message:
- *
- *     message SampleMessage {
- *       oneof test_oneof {
- *         string name = 4;
- *         SubMessage sub_message = 9;
- *       }
- *     }
- *
- * The field mask can be:
- *
- *     mask {
- *       paths: "name"
- *     }
- *
- * Or:
- *
- *     mask {
- *       paths: "sub_message"
- *     }
- *
- * Note that oneof type names ("test_oneof" in this case) cannot be used in
- * paths.
- *
- * ## Field Mask Verification
- *
- * The implementation of any API method which has a FieldMask type field in the
- * request should verify the included field paths, and return an
- * `INVALID_ARGUMENT` error if any path is unmappable.
- *
- * @generated from protobuf message google.protobuf.FieldMask
- */
-export interface FieldMask {
-    /**
-     * The set of field mask paths.
-     *
-     * @generated from protobuf field: repeated string paths = 1;
-     */
-    paths: string[];
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class FieldMask$Type extends MessageType<FieldMask> {
-    constructor() {
-        super("google.protobuf.FieldMask", [
-            { no: 1, name: "paths", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    /**
-     * Encode `FieldMask` to JSON object.
-     */
-    internalJsonWrite(message: FieldMask, options: JsonWriteOptions): JsonValue {
-        const invalidFieldMaskJsonRegex = /[A-Z]|(_([.0-9_]|$))/g;
-        return message.paths.map(p => {
-            if (invalidFieldMaskJsonRegex.test(p))
-                throw new Error("Unable to encode FieldMask to JSON. lowerCamelCase of path name \"" + p + "\" is irreversible.");
-            return lowerCamelCase(p);
-        }).join(",");
-    }
-    /**
-     * Decode `FieldMask` from JSON object.
-     */
-    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: FieldMask): FieldMask {
-        if (typeof json !== "string")
-            throw new Error("Unable to parse FieldMask from JSON " + typeofJsonValue(json) + ". Expected string.");
-        if (!target)
-            target = this.create();
-        if (json === "")
-            return target;
-        let camelToSnake = (str: string) => {
-            if (str.includes("_"))
-                throw new Error("Unable to parse FieldMask from JSON. Path names must be lowerCamelCase.");
-            let sc = str.replace(/[A-Z]/g, letter => "_" + letter.toLowerCase());
-            return sc;
-        };
-        target.paths = json.split(",").map(camelToSnake);
-        return target;
-    }
-    create(value?: PartialMessage<FieldMask>): FieldMask {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.paths = [];
-        if (value !== undefined)
-            reflectionMergePartial<FieldMask>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FieldMask): FieldMask {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated string paths */ 1:
-                    message.paths.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: FieldMask, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated string paths = 1; */
-        for (let i = 0; i < message.paths.length; i++)
-            writer.tag(1, WireType.LengthDelimited).string(message.paths[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message google.protobuf.FieldMask
- */
-export const FieldMask = new FieldMask$Type();
diff --git a/gen/proto/ts/google/protobuf/timestamp_pb.ts b/gen/proto/ts/google/protobuf/timestamp_pb.ts
index 1636bf8f8ad27..adfc3b522661f 100644
--- a/gen/proto/ts/google/protobuf/timestamp_pb.ts
+++ b/gen/proto/ts/google/protobuf/timestamp_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/timestamp.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.client.ts b/gen/proto/ts/prehog/v1/teleport_pb.client.ts
index 28e508fc3d4d2..ea688317fc0b1 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.client.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts b/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
index 29ac05b28a022..360ce94d123a0 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.ts b/gen/proto/ts/prehog/v1/teleport_pb.ts
index db0b7c805fefc..307f58bcccd24 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -478,7 +478,15 @@ export enum UserKind {
      *
      * @generated from protobuf enum value: USER_KIND_BOT = 2;
      */
-    BOT = 2
+    BOT = 2,
+    /**
+     * Indicates that the user associated with this event is a system component e.g. Okta service.
+     *
+     * PostHog property value: "system"
+     *
+     * @generated from protobuf enum value: USER_KIND_SYSTEM = 3;
+     */
+    SYSTEM = 3
 }
 /**
  * UserOrigin is the origin of a user account.
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts
index 18dd628281c32..4bead8460a9f1 100644
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
index e9e2f0d6967a2..acd7174c755cb 100644
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.ts
index a7833a9aae23a..de28d442f3cc8 100644
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts
index 1df4887a53ca9..a22f6d185c3b8 100644
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
index 8fb849876c4e5..7de8e4774c1ff 100644
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
index df5d2a053c58b..eab98518e31c9 100644
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts
index 7ae4fd108331f..b0c465401a322 100644
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
index 87f55193ff58f..59abbae359c72 100644
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
index 0f81f7ef29d47..9568a6e952a79 100644
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -293,6 +293,13 @@ export interface SessionStartEvent {
      * @generated from protobuf field: prehog.v1alpha.SessionStartGitMetadata git = 7;
      */
     git?: SessionStartGitMetadata;
+    /**
+     * if session_type == "app_mcp" the mcp struct contains additional information
+     * about the MCP session.
+     *
+     * @generated from protobuf field: prehog.v1alpha.SessionStartMCPMetadata mcp = 8;
+     */
+    mcp?: SessionStartMCPMetadata;
 }
 /**
  * SessionStartDatabaseMetadata contains additional information about database session.
@@ -402,6 +409,49 @@ export interface SessionStartGitMetadata {
      */
     gitService: string;
 }
+/**
+ * SessionStartMCPMetadata contains additional information about an MCP session.
+ *
+ * @generated from protobuf message prehog.v1alpha.SessionStartMCPMetadata
+ */
+export interface SessionStartMCPMetadata {
+    /**
+     * Transport type of the MCP server. Value from types.GetMCPServerTransportType.
+     *
+     * @generated from protobuf field: string transport = 1;
+     */
+    transport: string;
+    /**
+     * MCP protocol version like "2025-06-18".
+     *
+     * @generated from protobuf field: string protocol_version = 2;
+     */
+    protocolVersion: string;
+    /**
+     * Indicates the client used on the session, e.g "claude-ai".
+     *
+     * @generated from protobuf field: string client_name = 3;
+     */
+    clientName: string;
+    /**
+     * Indicates the server used on the session, e.g "example-servers/everything".
+     *
+     * @generated from protobuf field: string server_name = 4;
+     */
+    serverName: string;
+    /**
+     * Indicates how the MCP session is authorized between MCP client and Teleport.
+     *
+     * @generated from protobuf field: string ingress_auth_type = 5;
+     */
+    ingressAuthType: string;
+    /**
+     * Indicates how the MCP session is authorized between Teleport and remote MCP server.
+     *
+     * @generated from protobuf field: string egress_auth_type = 6;
+     */
+    egressAuthType: string;
+}
 /**
  * the issuance of a user certificate from the user CA
  *
@@ -2103,6 +2153,110 @@ export interface UIIntegrationEnrollStepEvent {
      */
     status?: IntegrationEnrollStepStatus;
 }
+/**
+ * UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+ * a section (e.g. "Advanced Options") in an integration setup wizard.
+ *
+ * @generated from protobuf message prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent
+ */
+export interface UIIntegrationEnrollSectionOpenEvent {
+    /**
+     * Metadata of the event.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollMetadata metadata = 1;
+     */
+    metadata?: IntegrationEnrollMetadata;
+    /**
+     * Step where the section was opened.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollStep step = 2;
+     */
+    step: IntegrationEnrollStep;
+    /**
+     * Section that was opened.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollSection section = 3;
+     */
+    section: IntegrationEnrollSection;
+}
+/**
+ * UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+ * field in an integration setup wizard.
+ *
+ * @generated from protobuf message prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent
+ */
+export interface UIIntegrationEnrollFieldCompleteEvent {
+    /**
+     * Metadata of the event.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollMetadata metadata = 1;
+     */
+    metadata?: IntegrationEnrollMetadata;
+    /**
+     * Step where the field was completed.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollStep step = 2;
+     */
+    step: IntegrationEnrollStep;
+    /**
+     * Field that was completed.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollField field = 3;
+     */
+    field: IntegrationEnrollField;
+}
+/**
+ * UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+ * IaC (e.g. Terraform) code in an integration setup wizard.
+ *
+ * @generated from protobuf message prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent
+ */
+export interface UIIntegrationEnrollCodeCopyEvent {
+    /**
+     * Metadata of the event.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollMetadata metadata = 1;
+     */
+    metadata?: IntegrationEnrollMetadata;
+    /**
+     * Step where the code was copied.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollStep step = 2;
+     */
+    step: IntegrationEnrollStep;
+    /**
+     * Type of code that was copied.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollCodeType type = 3;
+     */
+    type: IntegrationEnrollCodeType;
+}
+/**
+ * UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+ * documentation, etc. in an integration setup wizard.
+ *
+ * @generated from protobuf message prehog.v1alpha.UIIntegrationEnrollLinkClickEvent
+ */
+export interface UIIntegrationEnrollLinkClickEvent {
+    /**
+     * Metadata of the event.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollMetadata metadata = 1;
+     */
+    metadata?: IntegrationEnrollMetadata;
+    /**
+     * Step where the link was clicked.
+     *
+     * @generated from protobuf field: prehog.v1alpha.IntegrationEnrollStep step = 2;
+     */
+    step: IntegrationEnrollStep;
+    /**
+     * Link that was clicked.
+     *
+     * @generated from protobuf field: string link = 3;
+     */
+    link: string;
+}
 /**
  * EditorChangeEvent is an event that is emitted when a user role set changes resulting in
  * a editor role being added on removed
@@ -3500,6 +3654,30 @@ export interface SubmitEventRequest {
          * @generated from protobuf field: prehog.v1alpha.AccessRequestReviewEvent access_request_review = 100;
          */
         accessRequestReview: AccessRequestReviewEvent;
+    } | {
+        oneofKind: "uiIntegrationEnrollSectionOpenEvent";
+        /**
+         * @generated from protobuf field: prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent ui_integration_enroll_section_open_event = 101;
+         */
+        uiIntegrationEnrollSectionOpenEvent: UIIntegrationEnrollSectionOpenEvent;
+    } | {
+        oneofKind: "uiIntegrationEnrollFieldCompleteEvent";
+        /**
+         * @generated from protobuf field: prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent ui_integration_enroll_field_complete_event = 102;
+         */
+        uiIntegrationEnrollFieldCompleteEvent: UIIntegrationEnrollFieldCompleteEvent;
+    } | {
+        oneofKind: "uiIntegrationEnrollCodeCopyEvent";
+        /**
+         * @generated from protobuf field: prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent ui_integration_enroll_code_copy_event = 103;
+         */
+        uiIntegrationEnrollCodeCopyEvent: UIIntegrationEnrollCodeCopyEvent;
+    } | {
+        oneofKind: "uiIntegrationEnrollLinkClickEvent";
+        /**
+         * @generated from protobuf field: prehog.v1alpha.UIIntegrationEnrollLinkClickEvent ui_integration_enroll_link_click_event = 104;
+         */
+        uiIntegrationEnrollLinkClickEvent: UIIntegrationEnrollLinkClickEvent;
     } | {
         oneofKind: undefined;
     };
@@ -3676,7 +3854,15 @@ export enum UserKind {
      *
      * @generated from protobuf enum value: USER_KIND_BOT = 2;
      */
-    BOT = 2
+    BOT = 2,
+    /**
+     * Indicates that the user associated with this event is a system component e.g. Okta service.
+     *
+     * PostHog property value: "system"
+     *
+     * @generated from protobuf enum value: USER_KIND_SYSTEM = 3;
+     */
+    SYSTEM = 3
 }
 /**
  * DiscoverResource represents a resource type.
@@ -3855,7 +4041,19 @@ export enum DiscoverResource {
     /**
      * @generated from protobuf enum value: DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE = 41;
      */
-    APPLICATION_AWS_CONSOLE = 41
+    APPLICATION_AWS_CONSOLE = 41,
+    /**
+     * @generated from protobuf enum value: DISCOVER_RESOURCE_MCP_STDIO = 42;
+     */
+    MCP_STDIO = 42,
+    /**
+     * @generated from protobuf enum value: DISCOVER_RESOURCE_MCP_SSE = 43;
+     */
+    MCP_SSE = 43,
+    /**
+     * @generated from protobuf enum value: DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP = 44;
+     */
+    MCP_STREAMABLE_HTTP = 44
 }
 /**
  * DiscoverStatus represents a Discover Step outcome.
@@ -4076,7 +4274,15 @@ export enum IntegrationEnrollKind {
     /**
      * @generated from protobuf enum value: INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS = 27;
      */
-    GITHUB_REPO_ACCESS = 27
+    GITHUB_REPO_ACCESS = 27,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD = 28;
+     */
+    MACHINE_ID_ARGOCD = 28,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES = 29;
+     */
+    MACHINE_ID_GITHUB_ACTIONS_KUBERNETES = 29
 }
 /**
  * IntegrationEnrollStep defines inner configuration steps
@@ -4124,7 +4330,25 @@ export enum IntegrationEnrollStep {
     /**
      * @generated from protobuf enum value: INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE = 8;
      */
-    GITHUBRA_CREATE_ROLE = 8
+    GITHUBRA_CREATE_ROLE = 8,
+    /**
+     * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+     *
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB = 9;
+     */
+    MWIGHAK8S_CONNECT_GITHUB = 9,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS = 10;
+     */
+    MWIGHAK8S_CONFIGURE_ACCESS = 10,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW = 11;
+     */
+    MWIGHAK8S_SETUP_WORKFLOW = 11,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME = 12;
+     */
+    MWIGHAK8S_WELCOME = 12
 }
 /**
  * IntegrationEnrollStatusCode defines status code for an integration enroll step.
@@ -4164,6 +4388,114 @@ export enum IntegrationEnrollStatusCode {
      */
     ABORTED = 4
 }
+/**
+ * IntegrationEnrollSection identifies a section the user opened or expanded in
+ * an integration setup wizard.
+ *
+ * @generated from protobuf enum prehog.v1alpha.IntegrationEnrollSection
+ */
+export enum IntegrationEnrollSection {
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_SECTION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+     *
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS = 1;
+     */
+    MWIGHAK8S_GITHUB_ADVANCED_OPTIONS = 1,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER = 2;
+     */
+    MWIGHAK8S_KUBERNETES_LABEL_PICKER = 2,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS = 3;
+     */
+    MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS = 3,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER = 4;
+     */
+    MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER = 4
+}
+/**
+ * IntegrationEnrollField identifies a field the user completed in an integration
+ * setup wizard.
+ *
+ * @generated from protobuf enum prehog.v1alpha.IntegrationEnrollField
+ */
+export enum IntegrationEnrollField {
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+     *
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL = 1;
+     */
+    MWIGHAK8S_GITHUB_REPOSITORY_URL = 1,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH = 2;
+     */
+    MWIGHAK8S_GITHUB_BRANCH = 2,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW = 3;
+     */
+    MWIGHAK8S_GITHUB_WORKFLOW = 3,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT = 4;
+     */
+    MWIGHAK8S_GITHUB_ENVIRONMENT = 4,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF = 5;
+     */
+    MWIGHAK8S_GITHUB_REF = 5,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG = 6;
+     */
+    MWIGHAK8S_GITHUB_ENTERPRISE_SLUG = 6,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS = 7;
+     */
+    MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS = 7,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS = 8;
+     */
+    MWIGHAK8S_KUBERNETES_LABELS = 8,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS = 9;
+     */
+    MWIGHAK8S_KUBERNETES_GROUPS = 9,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS = 10;
+     */
+    MWIGHAK8S_KUBERNETES_USERS = 10,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES = 11;
+     */
+    MWIGHAK8S_KUBERNETES_RESOURCE_RULES = 11
+}
+/**
+ * IntegrationEnrollCodeType identifies the type of code that was copied in an
+ * integration setup wizard.
+ *
+ * @generated from protobuf enum prehog.v1alpha.IntegrationEnrollCodeType
+ */
+export enum IntegrationEnrollCodeType {
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM = 1;
+     */
+    TERRAFORM = 1,
+    /**
+     * @generated from protobuf enum value: INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML = 2;
+     */
+    GITHUB_ACTIONS_YAML = 2
+}
 /**
  * EditorChangeStatus is the possible value of an EditorChangeEvent event status
  *
@@ -4645,7 +4977,8 @@ class SessionStartEvent$Type extends MessageType<SessionStartEvent> {
             { no: 4, name: "desktop", kind: "message", T: () => SessionStartDesktopMetadata },
             { no: 5, name: "user_kind", kind: "enum", T: () => ["prehog.v1alpha.UserKind", UserKind, "USER_KIND_"] },
             { no: 6, name: "app", kind: "message", T: () => SessionStartAppMetadata },
-            { no: 7, name: "git", kind: "message", T: () => SessionStartGitMetadata }
+            { no: 7, name: "git", kind: "message", T: () => SessionStartGitMetadata },
+            { no: 8, name: "mcp", kind: "message", T: () => SessionStartMCPMetadata }
         ]);
     }
     create(value?: PartialMessage<SessionStartEvent>): SessionStartEvent {
@@ -4683,6 +5016,9 @@ class SessionStartEvent$Type extends MessageType<SessionStartEvent> {
                 case /* prehog.v1alpha.SessionStartGitMetadata git */ 7:
                     message.git = SessionStartGitMetadata.internalBinaryRead(reader, reader.uint32(), options, message.git);
                     break;
+                case /* prehog.v1alpha.SessionStartMCPMetadata mcp */ 8:
+                    message.mcp = SessionStartMCPMetadata.internalBinaryRead(reader, reader.uint32(), options, message.mcp);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -4716,6 +5052,9 @@ class SessionStartEvent$Type extends MessageType<SessionStartEvent> {
         /* prehog.v1alpha.SessionStartGitMetadata git = 7; */
         if (message.git)
             SessionStartGitMetadata.internalBinaryWrite(message.git, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.SessionStartMCPMetadata mcp = 8; */
+        if (message.mcp)
+            SessionStartMCPMetadata.internalBinaryWrite(message.mcp, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -4979,6 +5318,93 @@ class SessionStartGitMetadata$Type extends MessageType<SessionStartGitMetadata>
  */
 export const SessionStartGitMetadata = new SessionStartGitMetadata$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class SessionStartMCPMetadata$Type extends MessageType<SessionStartMCPMetadata> {
+    constructor() {
+        super("prehog.v1alpha.SessionStartMCPMetadata", [
+            { no: 1, name: "transport", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "protocol_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "client_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "server_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "ingress_auth_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "egress_auth_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<SessionStartMCPMetadata>): SessionStartMCPMetadata {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.transport = "";
+        message.protocolVersion = "";
+        message.clientName = "";
+        message.serverName = "";
+        message.ingressAuthType = "";
+        message.egressAuthType = "";
+        if (value !== undefined)
+            reflectionMergePartial<SessionStartMCPMetadata>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SessionStartMCPMetadata): SessionStartMCPMetadata {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string transport */ 1:
+                    message.transport = reader.string();
+                    break;
+                case /* string protocol_version */ 2:
+                    message.protocolVersion = reader.string();
+                    break;
+                case /* string client_name */ 3:
+                    message.clientName = reader.string();
+                    break;
+                case /* string server_name */ 4:
+                    message.serverName = reader.string();
+                    break;
+                case /* string ingress_auth_type */ 5:
+                    message.ingressAuthType = reader.string();
+                    break;
+                case /* string egress_auth_type */ 6:
+                    message.egressAuthType = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: SessionStartMCPMetadata, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string transport = 1; */
+        if (message.transport !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.transport);
+        /* string protocol_version = 2; */
+        if (message.protocolVersion !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.protocolVersion);
+        /* string client_name = 3; */
+        if (message.clientName !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.clientName);
+        /* string server_name = 4; */
+        if (message.serverName !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.serverName);
+        /* string ingress_auth_type = 5; */
+        if (message.ingressAuthType !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.ingressAuthType);
+        /* string egress_auth_type = 6; */
+        if (message.egressAuthType !== "")
+            writer.tag(6, WireType.LengthDelimited).string(message.egressAuthType);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message prehog.v1alpha.SessionStartMCPMetadata
+ */
+export const SessionStartMCPMetadata = new SessionStartMCPMetadata$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class UserCertificateIssuedEvent$Type extends MessageType<UserCertificateIssuedEvent> {
     constructor() {
         super("prehog.v1alpha.UserCertificateIssuedEvent", [
@@ -9160,6 +9586,254 @@ class UIIntegrationEnrollStepEvent$Type extends MessageType<UIIntegrationEnrollS
  */
 export const UIIntegrationEnrollStepEvent = new UIIntegrationEnrollStepEvent$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class UIIntegrationEnrollSectionOpenEvent$Type extends MessageType<UIIntegrationEnrollSectionOpenEvent> {
+    constructor() {
+        super("prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent", [
+            { no: 1, name: "metadata", kind: "message", T: () => IntegrationEnrollMetadata },
+            { no: 2, name: "step", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollStep", IntegrationEnrollStep, "INTEGRATION_ENROLL_STEP_"] },
+            { no: 3, name: "section", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollSection", IntegrationEnrollSection, "INTEGRATION_ENROLL_SECTION_"] }
+        ]);
+    }
+    create(value?: PartialMessage<UIIntegrationEnrollSectionOpenEvent>): UIIntegrationEnrollSectionOpenEvent {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.step = 0;
+        message.section = 0;
+        if (value !== undefined)
+            reflectionMergePartial<UIIntegrationEnrollSectionOpenEvent>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UIIntegrationEnrollSectionOpenEvent): UIIntegrationEnrollSectionOpenEvent {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* prehog.v1alpha.IntegrationEnrollMetadata metadata */ 1:
+                    message.metadata = IntegrationEnrollMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollStep step */ 2:
+                    message.step = reader.int32();
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollSection section */ 3:
+                    message.section = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UIIntegrationEnrollSectionOpenEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* prehog.v1alpha.IntegrationEnrollMetadata metadata = 1; */
+        if (message.metadata)
+            IntegrationEnrollMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.IntegrationEnrollStep step = 2; */
+        if (message.step !== 0)
+            writer.tag(2, WireType.Varint).int32(message.step);
+        /* prehog.v1alpha.IntegrationEnrollSection section = 3; */
+        if (message.section !== 0)
+            writer.tag(3, WireType.Varint).int32(message.section);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent
+ */
+export const UIIntegrationEnrollSectionOpenEvent = new UIIntegrationEnrollSectionOpenEvent$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UIIntegrationEnrollFieldCompleteEvent$Type extends MessageType<UIIntegrationEnrollFieldCompleteEvent> {
+    constructor() {
+        super("prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent", [
+            { no: 1, name: "metadata", kind: "message", T: () => IntegrationEnrollMetadata },
+            { no: 2, name: "step", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollStep", IntegrationEnrollStep, "INTEGRATION_ENROLL_STEP_"] },
+            { no: 3, name: "field", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollField", IntegrationEnrollField, "INTEGRATION_ENROLL_FIELD_"] }
+        ]);
+    }
+    create(value?: PartialMessage<UIIntegrationEnrollFieldCompleteEvent>): UIIntegrationEnrollFieldCompleteEvent {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.step = 0;
+        message.field = 0;
+        if (value !== undefined)
+            reflectionMergePartial<UIIntegrationEnrollFieldCompleteEvent>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UIIntegrationEnrollFieldCompleteEvent): UIIntegrationEnrollFieldCompleteEvent {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* prehog.v1alpha.IntegrationEnrollMetadata metadata */ 1:
+                    message.metadata = IntegrationEnrollMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollStep step */ 2:
+                    message.step = reader.int32();
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollField field */ 3:
+                    message.field = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UIIntegrationEnrollFieldCompleteEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* prehog.v1alpha.IntegrationEnrollMetadata metadata = 1; */
+        if (message.metadata)
+            IntegrationEnrollMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.IntegrationEnrollStep step = 2; */
+        if (message.step !== 0)
+            writer.tag(2, WireType.Varint).int32(message.step);
+        /* prehog.v1alpha.IntegrationEnrollField field = 3; */
+        if (message.field !== 0)
+            writer.tag(3, WireType.Varint).int32(message.field);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent
+ */
+export const UIIntegrationEnrollFieldCompleteEvent = new UIIntegrationEnrollFieldCompleteEvent$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UIIntegrationEnrollCodeCopyEvent$Type extends MessageType<UIIntegrationEnrollCodeCopyEvent> {
+    constructor() {
+        super("prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent", [
+            { no: 1, name: "metadata", kind: "message", T: () => IntegrationEnrollMetadata },
+            { no: 2, name: "step", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollStep", IntegrationEnrollStep, "INTEGRATION_ENROLL_STEP_"] },
+            { no: 3, name: "type", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollCodeType", IntegrationEnrollCodeType, "INTEGRATION_ENROLL_CODE_TYPE_"] }
+        ]);
+    }
+    create(value?: PartialMessage<UIIntegrationEnrollCodeCopyEvent>): UIIntegrationEnrollCodeCopyEvent {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.step = 0;
+        message.type = 0;
+        if (value !== undefined)
+            reflectionMergePartial<UIIntegrationEnrollCodeCopyEvent>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UIIntegrationEnrollCodeCopyEvent): UIIntegrationEnrollCodeCopyEvent {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* prehog.v1alpha.IntegrationEnrollMetadata metadata */ 1:
+                    message.metadata = IntegrationEnrollMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollStep step */ 2:
+                    message.step = reader.int32();
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollCodeType type */ 3:
+                    message.type = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UIIntegrationEnrollCodeCopyEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* prehog.v1alpha.IntegrationEnrollMetadata metadata = 1; */
+        if (message.metadata)
+            IntegrationEnrollMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.IntegrationEnrollStep step = 2; */
+        if (message.step !== 0)
+            writer.tag(2, WireType.Varint).int32(message.step);
+        /* prehog.v1alpha.IntegrationEnrollCodeType type = 3; */
+        if (message.type !== 0)
+            writer.tag(3, WireType.Varint).int32(message.type);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent
+ */
+export const UIIntegrationEnrollCodeCopyEvent = new UIIntegrationEnrollCodeCopyEvent$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UIIntegrationEnrollLinkClickEvent$Type extends MessageType<UIIntegrationEnrollLinkClickEvent> {
+    constructor() {
+        super("prehog.v1alpha.UIIntegrationEnrollLinkClickEvent", [
+            { no: 1, name: "metadata", kind: "message", T: () => IntegrationEnrollMetadata },
+            { no: 2, name: "step", kind: "enum", T: () => ["prehog.v1alpha.IntegrationEnrollStep", IntegrationEnrollStep, "INTEGRATION_ENROLL_STEP_"] },
+            { no: 3, name: "link", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<UIIntegrationEnrollLinkClickEvent>): UIIntegrationEnrollLinkClickEvent {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.step = 0;
+        message.link = "";
+        if (value !== undefined)
+            reflectionMergePartial<UIIntegrationEnrollLinkClickEvent>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UIIntegrationEnrollLinkClickEvent): UIIntegrationEnrollLinkClickEvent {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* prehog.v1alpha.IntegrationEnrollMetadata metadata */ 1:
+                    message.metadata = IntegrationEnrollMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* prehog.v1alpha.IntegrationEnrollStep step */ 2:
+                    message.step = reader.int32();
+                    break;
+                case /* string link */ 3:
+                    message.link = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UIIntegrationEnrollLinkClickEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* prehog.v1alpha.IntegrationEnrollMetadata metadata = 1; */
+        if (message.metadata)
+            IntegrationEnrollMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.IntegrationEnrollStep step = 2; */
+        if (message.step !== 0)
+            writer.tag(2, WireType.Varint).int32(message.step);
+        /* string link = 3; */
+        if (message.link !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.link);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message prehog.v1alpha.UIIntegrationEnrollLinkClickEvent
+ */
+export const UIIntegrationEnrollLinkClickEvent = new UIIntegrationEnrollLinkClickEvent$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class EditorChangeEvent$Type extends MessageType<EditorChangeEvent> {
     constructor() {
         super("prehog.v1alpha.EditorChangeEvent", [
@@ -10883,7 +11557,11 @@ class SubmitEventRequest$Type extends MessageType<SubmitEventRequest> {
             { no: 94, name: "user_task_state", kind: "message", oneof: "event", T: () => UserTaskStateEvent },
             { no: 96, name: "ui_integration_enroll_step_event", kind: "message", oneof: "event", T: () => UIIntegrationEnrollStepEvent },
             { no: 99, name: "access_request_create", kind: "message", oneof: "event", T: () => AccessRequestCreateEvent },
-            { no: 100, name: "access_request_review", kind: "message", oneof: "event", T: () => AccessRequestReviewEvent }
+            { no: 100, name: "access_request_review", kind: "message", oneof: "event", T: () => AccessRequestReviewEvent },
+            { no: 101, name: "ui_integration_enroll_section_open_event", kind: "message", oneof: "event", T: () => UIIntegrationEnrollSectionOpenEvent },
+            { no: 102, name: "ui_integration_enroll_field_complete_event", kind: "message", oneof: "event", T: () => UIIntegrationEnrollFieldCompleteEvent },
+            { no: 103, name: "ui_integration_enroll_code_copy_event", kind: "message", oneof: "event", T: () => UIIntegrationEnrollCodeCopyEvent },
+            { no: 104, name: "ui_integration_enroll_link_click_event", kind: "message", oneof: "event", T: () => UIIntegrationEnrollLinkClickEvent }
         ]);
     }
     create(value?: PartialMessage<SubmitEventRequest>): SubmitEventRequest {
@@ -11473,6 +12151,30 @@ class SubmitEventRequest$Type extends MessageType<SubmitEventRequest> {
                         accessRequestReview: AccessRequestReviewEvent.internalBinaryRead(reader, reader.uint32(), options, (message.event as any).accessRequestReview)
                     };
                     break;
+                case /* prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent ui_integration_enroll_section_open_event */ 101:
+                    message.event = {
+                        oneofKind: "uiIntegrationEnrollSectionOpenEvent",
+                        uiIntegrationEnrollSectionOpenEvent: UIIntegrationEnrollSectionOpenEvent.internalBinaryRead(reader, reader.uint32(), options, (message.event as any).uiIntegrationEnrollSectionOpenEvent)
+                    };
+                    break;
+                case /* prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent ui_integration_enroll_field_complete_event */ 102:
+                    message.event = {
+                        oneofKind: "uiIntegrationEnrollFieldCompleteEvent",
+                        uiIntegrationEnrollFieldCompleteEvent: UIIntegrationEnrollFieldCompleteEvent.internalBinaryRead(reader, reader.uint32(), options, (message.event as any).uiIntegrationEnrollFieldCompleteEvent)
+                    };
+                    break;
+                case /* prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent ui_integration_enroll_code_copy_event */ 103:
+                    message.event = {
+                        oneofKind: "uiIntegrationEnrollCodeCopyEvent",
+                        uiIntegrationEnrollCodeCopyEvent: UIIntegrationEnrollCodeCopyEvent.internalBinaryRead(reader, reader.uint32(), options, (message.event as any).uiIntegrationEnrollCodeCopyEvent)
+                    };
+                    break;
+                case /* prehog.v1alpha.UIIntegrationEnrollLinkClickEvent ui_integration_enroll_link_click_event */ 104:
+                    message.event = {
+                        oneofKind: "uiIntegrationEnrollLinkClickEvent",
+                        uiIntegrationEnrollLinkClickEvent: UIIntegrationEnrollLinkClickEvent.internalBinaryRead(reader, reader.uint32(), options, (message.event as any).uiIntegrationEnrollLinkClickEvent)
+                    };
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -11776,6 +12478,18 @@ class SubmitEventRequest$Type extends MessageType<SubmitEventRequest> {
         /* prehog.v1alpha.AccessRequestReviewEvent access_request_review = 100; */
         if (message.event.oneofKind === "accessRequestReview")
             AccessRequestReviewEvent.internalBinaryWrite(message.event.accessRequestReview, writer.tag(100, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.UIIntegrationEnrollSectionOpenEvent ui_integration_enroll_section_open_event = 101; */
+        if (message.event.oneofKind === "uiIntegrationEnrollSectionOpenEvent")
+            UIIntegrationEnrollSectionOpenEvent.internalBinaryWrite(message.event.uiIntegrationEnrollSectionOpenEvent, writer.tag(101, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.UIIntegrationEnrollFieldCompleteEvent ui_integration_enroll_field_complete_event = 102; */
+        if (message.event.oneofKind === "uiIntegrationEnrollFieldCompleteEvent")
+            UIIntegrationEnrollFieldCompleteEvent.internalBinaryWrite(message.event.uiIntegrationEnrollFieldCompleteEvent, writer.tag(102, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.UIIntegrationEnrollCodeCopyEvent ui_integration_enroll_code_copy_event = 103; */
+        if (message.event.oneofKind === "uiIntegrationEnrollCodeCopyEvent")
+            UIIntegrationEnrollCodeCopyEvent.internalBinaryWrite(message.event.uiIntegrationEnrollCodeCopyEvent, writer.tag(103, WireType.LengthDelimited).fork(), options).join();
+        /* prehog.v1alpha.UIIntegrationEnrollLinkClickEvent ui_integration_enroll_link_click_event = 104; */
+        if (message.event.oneofKind === "uiIntegrationEnrollLinkClickEvent")
+            UIIntegrationEnrollLinkClickEvent.internalBinaryWrite(message.event.uiIntegrationEnrollLinkClickEvent, writer.tag(104, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
index 5d695378b9623..23d1137eec707 100644
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
+++ b/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/accesslist/v1/accesslist.proto" (package "teleport.accesslist.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -118,6 +118,14 @@ export interface AccessListSpec {
      * @generated from protobuf field: teleport.accesslist.v1.AccessListGrants owner_grants = 11;
      */
     ownerGrants?: AccessListGrants;
+    /**
+     * type can be an empty string which denotes a regular Access List, "scim" which represents
+     * an Access List created from SCIM group or "static" for Access Lists managed by IaC
+     * tools.
+     *
+     * @generated from protobuf field: string type = 12;
+     */
+    type: string;
 }
 /**
  * AccessListOwner is an owner of an Access List.
@@ -444,6 +452,25 @@ export interface CurrentUserAssignments {
      */
     membershipType: AccessListUserAssignmentType;
 }
+/**
+ * UserAssignments describes the requested user's ownership and membership assignment types in the access list.
+ *
+ * @generated from protobuf message teleport.accesslist.v1.UserAssignments
+ */
+export interface UserAssignments {
+    /**
+     * ownership_type represents the requested user's ownership type (explicit, inherited, or none) in the access list.
+     *
+     * @generated from protobuf field: teleport.accesslist.v1.AccessListUserAssignmentType ownership_type = 1;
+     */
+    ownershipType: AccessListUserAssignmentType;
+    /**
+     * membership_type represents the requested user's membership type (explicit, inherited, or none) in the access list.
+     *
+     * @generated from protobuf field: teleport.accesslist.v1.AccessListUserAssignmentType membership_type = 2;
+     */
+    membershipType: AccessListUserAssignmentType;
+}
 /**
  * AccessListStatus contains dynamic fields calculated during retrieval.
  *
@@ -480,6 +507,12 @@ export interface AccessListStatus {
      * @generated from protobuf field: teleport.accesslist.v1.CurrentUserAssignments current_user_assignments = 5;
      */
     currentUserAssignments?: CurrentUserAssignments;
+    /**
+     * user_assignments describes the requested user's ownership and membership assignment types in the access list.
+     *
+     * @generated from protobuf field: teleport.accesslist.v1.UserAssignments user_assignments = 6;
+     */
+    userAssignments?: UserAssignments;
 }
 /**
  * ReviewFrequency is the frequency of reviews.
@@ -695,7 +728,8 @@ class AccessListSpec$Type extends MessageType<AccessListSpec> {
             { no: 5, name: "ownership_requires", kind: "message", T: () => AccessListRequires },
             { no: 6, name: "grants", kind: "message", T: () => AccessListGrants },
             { no: 8, name: "title", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 11, name: "owner_grants", kind: "message", T: () => AccessListGrants }
+            { no: 11, name: "owner_grants", kind: "message", T: () => AccessListGrants },
+            { no: 12, name: "type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<AccessListSpec>): AccessListSpec {
@@ -703,6 +737,7 @@ class AccessListSpec$Type extends MessageType<AccessListSpec> {
         message.description = "";
         message.owners = [];
         message.title = "";
+        message.type = "";
         if (value !== undefined)
             reflectionMergePartial<AccessListSpec>(this, message, value);
         return message;
@@ -736,6 +771,9 @@ class AccessListSpec$Type extends MessageType<AccessListSpec> {
                 case /* teleport.accesslist.v1.AccessListGrants owner_grants */ 11:
                     message.ownerGrants = AccessListGrants.internalBinaryRead(reader, reader.uint32(), options, message.ownerGrants);
                     break;
+                case /* string type */ 12:
+                    message.type = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -772,6 +810,9 @@ class AccessListSpec$Type extends MessageType<AccessListSpec> {
         /* teleport.accesslist.v1.AccessListGrants owner_grants = 11; */
         if (message.ownerGrants)
             AccessListGrants.internalBinaryWrite(message.ownerGrants, writer.tag(11, WireType.LengthDelimited).fork(), options).join();
+        /* string type = 12; */
+        if (message.type !== "")
+            writer.tag(12, WireType.LengthDelimited).string(message.type);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1534,6 +1575,61 @@ class CurrentUserAssignments$Type extends MessageType<CurrentUserAssignments> {
  */
 export const CurrentUserAssignments = new CurrentUserAssignments$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class UserAssignments$Type extends MessageType<UserAssignments> {
+    constructor() {
+        super("teleport.accesslist.v1.UserAssignments", [
+            { no: 1, name: "ownership_type", kind: "enum", T: () => ["teleport.accesslist.v1.AccessListUserAssignmentType", AccessListUserAssignmentType, "ACCESS_LIST_USER_ASSIGNMENT_TYPE_"] },
+            { no: 2, name: "membership_type", kind: "enum", T: () => ["teleport.accesslist.v1.AccessListUserAssignmentType", AccessListUserAssignmentType, "ACCESS_LIST_USER_ASSIGNMENT_TYPE_"] }
+        ]);
+    }
+    create(value?: PartialMessage<UserAssignments>): UserAssignments {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.ownershipType = 0;
+        message.membershipType = 0;
+        if (value !== undefined)
+            reflectionMergePartial<UserAssignments>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UserAssignments): UserAssignments {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* teleport.accesslist.v1.AccessListUserAssignmentType ownership_type */ 1:
+                    message.ownershipType = reader.int32();
+                    break;
+                case /* teleport.accesslist.v1.AccessListUserAssignmentType membership_type */ 2:
+                    message.membershipType = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UserAssignments, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* teleport.accesslist.v1.AccessListUserAssignmentType ownership_type = 1; */
+        if (message.ownershipType !== 0)
+            writer.tag(1, WireType.Varint).int32(message.ownershipType);
+        /* teleport.accesslist.v1.AccessListUserAssignmentType membership_type = 2; */
+        if (message.membershipType !== 0)
+            writer.tag(2, WireType.Varint).int32(message.membershipType);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.accesslist.v1.UserAssignments
+ */
+export const UserAssignments = new UserAssignments$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class AccessListStatus$Type extends MessageType<AccessListStatus> {
     constructor() {
         super("teleport.accesslist.v1.AccessListStatus", [
@@ -1541,7 +1637,8 @@ class AccessListStatus$Type extends MessageType<AccessListStatus> {
             { no: 2, name: "member_list_count", kind: "scalar", opt: true, T: 13 /*ScalarType.UINT32*/ },
             { no: 3, name: "owner_of", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "member_of", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "current_user_assignments", kind: "message", T: () => CurrentUserAssignments }
+            { no: 5, name: "current_user_assignments", kind: "message", T: () => CurrentUserAssignments },
+            { no: 6, name: "user_assignments", kind: "message", T: () => UserAssignments }
         ]);
     }
     create(value?: PartialMessage<AccessListStatus>): AccessListStatus {
@@ -1572,6 +1669,9 @@ class AccessListStatus$Type extends MessageType<AccessListStatus> {
                 case /* teleport.accesslist.v1.CurrentUserAssignments current_user_assignments */ 5:
                     message.currentUserAssignments = CurrentUserAssignments.internalBinaryRead(reader, reader.uint32(), options, message.currentUserAssignments);
                     break;
+                case /* teleport.accesslist.v1.UserAssignments user_assignments */ 6:
+                    message.userAssignments = UserAssignments.internalBinaryRead(reader, reader.uint32(), options, message.userAssignments);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -1599,6 +1699,9 @@ class AccessListStatus$Type extends MessageType<AccessListStatus> {
         /* teleport.accesslist.v1.CurrentUserAssignments current_user_assignments = 5; */
         if (message.currentUserAssignments)
             CurrentUserAssignments.internalBinaryWrite(message.currentUserAssignments, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        /* teleport.accesslist.v1.UserAssignments user_assignments = 6; */
+        if (message.userAssignments)
+            UserAssignments.internalBinaryWrite(message.userAssignments, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts
deleted file mode 100644
index 47b6a4ed5197f..0000000000000
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts
+++ /dev/null
@@ -1,502 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
-import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
-import { AccessListService } from "./accesslist_service_pb";
-import type { GetInheritedGrantsResponse } from "./accesslist_service_pb";
-import type { GetInheritedGrantsRequest } from "./accesslist_service_pb";
-import type { GetSuggestedAccessListsResponse } from "./accesslist_service_pb";
-import type { GetSuggestedAccessListsRequest } from "./accesslist_service_pb";
-import type { AccessRequestPromoteResponse } from "./accesslist_service_pb";
-import type { AccessRequestPromoteRequest } from "./accesslist_service_pb";
-import type { DeleteAccessListReviewRequest } from "./accesslist_service_pb";
-import type { CreateAccessListReviewResponse } from "./accesslist_service_pb";
-import type { CreateAccessListReviewRequest } from "./accesslist_service_pb";
-import type { ListAllAccessListReviewsResponse } from "./accesslist_service_pb";
-import type { ListAllAccessListReviewsRequest } from "./accesslist_service_pb";
-import type { ListAccessListReviewsResponse } from "./accesslist_service_pb";
-import type { ListAccessListReviewsRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListWithMembersResponse } from "./accesslist_service_pb";
-import type { UpsertAccessListWithMembersRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListMembersRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListMembersForAccessListRequest } from "./accesslist_service_pb";
-import type { DeleteAccessListMemberRequest } from "./accesslist_service_pb";
-import type { UpdateAccessListMemberRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListMemberRequest } from "./accesslist_service_pb";
-import type { GetAccessListOwnersResponse } from "./accesslist_service_pb";
-import type { GetAccessListOwnersRequest } from "./accesslist_service_pb";
-import type { Member } from "./accesslist_pb";
-import type { GetAccessListMemberRequest } from "./accesslist_service_pb";
-import type { ListAllAccessListMembersResponse } from "./accesslist_service_pb";
-import type { ListAllAccessListMembersRequest } from "./accesslist_service_pb";
-import type { ListAccessListMembersResponse } from "./accesslist_service_pb";
-import type { ListAccessListMembersRequest } from "./accesslist_service_pb";
-import type { CountAccessListMembersResponse } from "./accesslist_service_pb";
-import type { CountAccessListMembersRequest } from "./accesslist_service_pb";
-import type { GetAccessListsToReviewResponse } from "./accesslist_service_pb";
-import type { GetAccessListsToReviewRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListsRequest } from "./accesslist_service_pb";
-import type { Empty } from "../../../google/protobuf/empty_pb";
-import type { DeleteAccessListRequest } from "./accesslist_service_pb";
-import type { UpdateAccessListRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListRequest } from "./accesslist_service_pb";
-import type { AccessList } from "./accesslist_pb";
-import type { GetAccessListRequest } from "./accesslist_service_pb";
-import type { ListAccessListsResponse } from "./accesslist_service_pb";
-import type { ListAccessListsRequest } from "./accesslist_service_pb";
-import { stackIntercept } from "@protobuf-ts/runtime-rpc";
-import type { GetAccessListsResponse } from "./accesslist_service_pb";
-import type { GetAccessListsRequest } from "./accesslist_service_pb";
-import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
-import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
-/**
- * AccessListService provides CRUD methods for Access List resources.
- *
- * @generated from protobuf service teleport.accesslist.v1.AccessListService
- */
-export interface IAccessListServiceClient {
-    /**
-     * GetAccessLists returns a list of all access lists.
-     *
-     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
-     */
-    getAccessLists(input: GetAccessListsRequest, options?: RpcOptions): UnaryCall<GetAccessListsRequest, GetAccessListsResponse>;
-    /**
-     * ListAccessLists returns a paginated list of all access lists.
-     *
-     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
-     */
-    listAccessLists(input: ListAccessListsRequest, options?: RpcOptions): UnaryCall<ListAccessListsRequest, ListAccessListsResponse>;
-    /**
-     * GetAccessList returns the specified access list resource.
-     *
-     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    getAccessList(input: GetAccessListRequest, options?: RpcOptions): UnaryCall<GetAccessListRequest, AccessList>;
-    /**
-     * UpsertAccessList creates or updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    upsertAccessList(input: UpsertAccessListRequest, options?: RpcOptions): UnaryCall<UpsertAccessListRequest, AccessList>;
-    /**
-     * UpdateAccessList updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessList(teleport.accesslist.v1.UpdateAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    updateAccessList(input: UpdateAccessListRequest, options?: RpcOptions): UnaryCall<UpdateAccessListRequest, AccessList>;
-    /**
-     * DeleteAccessList hard deletes the specified access list resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessList(input: DeleteAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAccessListRequest, Empty>;
-    /**
-     * DeleteAllAccessLists hard deletes all access lists.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListsRequest, Empty>;
-    /**
-     * GetAccessListsToReview will return access lists that need to be reviewed by
-     * the current user.
-     *
-     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
-     */
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, options?: RpcOptions): UnaryCall<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>;
-    /**
-     * CountAccessListMembers returns the count of access list members in an
-     * access list.
-     *
-     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
-     */
-    countAccessListMembers(input: CountAccessListMembersRequest, options?: RpcOptions): UnaryCall<CountAccessListMembersRequest, CountAccessListMembersResponse>;
-    /**
-     * ListAccessListMembers returns a paginated list of all access list members.
-     *
-     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
-     */
-    listAccessListMembers(input: ListAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAccessListMembersRequest, ListAccessListMembersResponse>;
-    /**
-     * ListAllAccessListMembers returns a paginated list of all access list
-     * members for all access lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
-     */
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>;
-    /**
-     * GetAccessListMember returns the specified access list member resource.
-     *
-     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    getAccessListMember(input: GetAccessListMemberRequest, options?: RpcOptions): UnaryCall<GetAccessListMemberRequest, Member>;
-    /**
-     * GetAccessListOwners returns a list of all owners in an Access List,
-     * including those inherited from nested Access Lists.
-     *
-     * @generated from protobuf rpc: GetAccessListOwners(teleport.accesslist.v1.GetAccessListOwnersRequest) returns (teleport.accesslist.v1.GetAccessListOwnersResponse);
-     */
-    getAccessListOwners(input: GetAccessListOwnersRequest, options?: RpcOptions): UnaryCall<GetAccessListOwnersRequest, GetAccessListOwnersResponse>;
-    /**
-     * UpsertAccessListMember creates or updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpsertAccessListMemberRequest, Member>;
-    /**
-     * UpdateAccessListMember conditionally updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessListMember(teleport.accesslist.v1.UpdateAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    updateAccessListMember(input: UpdateAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpdateAccessListMemberRequest, Member>;
-    /**
-     * DeleteAccessListMember hard deletes the specified access list member
-     * resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, options?: RpcOptions): UnaryCall<DeleteAccessListMemberRequest, Empty>;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersForAccessListRequest, Empty>;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersRequest, Empty>;
-    /**
-     * UpsertAccessListWithMembers creates or updates an access list with members.
-     *
-     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
-     */
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, options?: RpcOptions): UnaryCall<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>;
-    /**
-     * ListAccessListReviews will list access list reviews for a particular access
-     * list.
-     *
-     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
-     */
-    listAccessListReviews(input: ListAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAccessListReviewsRequest, ListAccessListReviewsResponse>;
-    /**
-     * ListAllAccessListReviews will list access list reviews for all access
-     * lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
-     */
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>;
-    /**
-     * CreateAccessListReview will create a new review for an access list. It will
-     * also modify the original access list and its members depending on the
-     * details of the review.
-     *
-     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
-     */
-    createAccessListReview(input: CreateAccessListReviewRequest, options?: RpcOptions): UnaryCall<CreateAccessListReviewRequest, CreateAccessListReviewResponse>;
-    /**
-     * DeleteAccessListReview will delete an access list review from the backend.
-     *
-     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, options?: RpcOptions): UnaryCall<DeleteAccessListReviewRequest, Empty>;
-    /**
-     * AccessRequestPromote promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
-     */
-    accessRequestPromote(input: AccessRequestPromoteRequest, options?: RpcOptions): UnaryCall<AccessRequestPromoteRequest, AccessRequestPromoteResponse>;
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access
-     * request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>;
-    /**
-     * GetInheritedGrants returns the inherited grants for an access list.
-     *
-     * @generated from protobuf rpc: GetInheritedGrants(teleport.accesslist.v1.GetInheritedGrantsRequest) returns (teleport.accesslist.v1.GetInheritedGrantsResponse);
-     */
-    getInheritedGrants(input: GetInheritedGrantsRequest, options?: RpcOptions): UnaryCall<GetInheritedGrantsRequest, GetInheritedGrantsResponse>;
-}
-/**
- * AccessListService provides CRUD methods for Access List resources.
- *
- * @generated from protobuf service teleport.accesslist.v1.AccessListService
- */
-export class AccessListServiceClient implements IAccessListServiceClient, ServiceInfo {
-    typeName = AccessListService.typeName;
-    methods = AccessListService.methods;
-    options = AccessListService.options;
-    constructor(private readonly _transport: RpcTransport) {
-    }
-    /**
-     * GetAccessLists returns a list of all access lists.
-     *
-     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
-     */
-    getAccessLists(input: GetAccessListsRequest, options?: RpcOptions): UnaryCall<GetAccessListsRequest, GetAccessListsResponse> {
-        const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetAccessListsRequest, GetAccessListsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListAccessLists returns a paginated list of all access lists.
-     *
-     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
-     */
-    listAccessLists(input: ListAccessListsRequest, options?: RpcOptions): UnaryCall<ListAccessListsRequest, ListAccessListsResponse> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListAccessListsRequest, ListAccessListsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetAccessList returns the specified access list resource.
-     *
-     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    getAccessList(input: GetAccessListRequest, options?: RpcOptions): UnaryCall<GetAccessListRequest, AccessList> {
-        const method = this.methods[2], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetAccessListRequest, AccessList>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpsertAccessList creates or updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    upsertAccessList(input: UpsertAccessListRequest, options?: RpcOptions): UnaryCall<UpsertAccessListRequest, AccessList> {
-        const method = this.methods[3], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpsertAccessListRequest, AccessList>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpdateAccessList updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessList(teleport.accesslist.v1.UpdateAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    updateAccessList(input: UpdateAccessListRequest, options?: RpcOptions): UnaryCall<UpdateAccessListRequest, AccessList> {
-        const method = this.methods[4], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpdateAccessListRequest, AccessList>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAccessList hard deletes the specified access list resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessList(input: DeleteAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAccessListRequest, Empty> {
-        const method = this.methods[5], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAccessListRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAllAccessLists hard deletes all access lists.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListsRequest, Empty> {
-        const method = this.methods[6], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAllAccessListsRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetAccessListsToReview will return access lists that need to be reviewed by
-     * the current user.
-     *
-     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
-     */
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, options?: RpcOptions): UnaryCall<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse> {
-        const method = this.methods[7], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * CountAccessListMembers returns the count of access list members in an
-     * access list.
-     *
-     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
-     */
-    countAccessListMembers(input: CountAccessListMembersRequest, options?: RpcOptions): UnaryCall<CountAccessListMembersRequest, CountAccessListMembersResponse> {
-        const method = this.methods[8], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CountAccessListMembersRequest, CountAccessListMembersResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListAccessListMembers returns a paginated list of all access list members.
-     *
-     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
-     */
-    listAccessListMembers(input: ListAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAccessListMembersRequest, ListAccessListMembersResponse> {
-        const method = this.methods[9], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListAccessListMembersRequest, ListAccessListMembersResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListAllAccessListMembers returns a paginated list of all access list
-     * members for all access lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
-     */
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse> {
-        const method = this.methods[10], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetAccessListMember returns the specified access list member resource.
-     *
-     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    getAccessListMember(input: GetAccessListMemberRequest, options?: RpcOptions): UnaryCall<GetAccessListMemberRequest, Member> {
-        const method = this.methods[11], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetAccessListMemberRequest, Member>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetAccessListOwners returns a list of all owners in an Access List,
-     * including those inherited from nested Access Lists.
-     *
-     * @generated from protobuf rpc: GetAccessListOwners(teleport.accesslist.v1.GetAccessListOwnersRequest) returns (teleport.accesslist.v1.GetAccessListOwnersResponse);
-     */
-    getAccessListOwners(input: GetAccessListOwnersRequest, options?: RpcOptions): UnaryCall<GetAccessListOwnersRequest, GetAccessListOwnersResponse> {
-        const method = this.methods[12], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetAccessListOwnersRequest, GetAccessListOwnersResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpsertAccessListMember creates or updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpsertAccessListMemberRequest, Member> {
-        const method = this.methods[13], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpsertAccessListMemberRequest, Member>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpdateAccessListMember conditionally updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessListMember(teleport.accesslist.v1.UpdateAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    updateAccessListMember(input: UpdateAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpdateAccessListMemberRequest, Member> {
-        const method = this.methods[14], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpdateAccessListMemberRequest, Member>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAccessListMember hard deletes the specified access list member
-     * resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, options?: RpcOptions): UnaryCall<DeleteAccessListMemberRequest, Empty> {
-        const method = this.methods[15], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAccessListMemberRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersForAccessListRequest, Empty> {
-        const method = this.methods[16], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAllAccessListMembersForAccessListRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersRequest, Empty> {
-        const method = this.methods[17], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAllAccessListMembersRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpsertAccessListWithMembers creates or updates an access list with members.
-     *
-     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
-     */
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, options?: RpcOptions): UnaryCall<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse> {
-        const method = this.methods[18], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListAccessListReviews will list access list reviews for a particular access
-     * list.
-     *
-     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
-     */
-    listAccessListReviews(input: ListAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAccessListReviewsRequest, ListAccessListReviewsResponse> {
-        const method = this.methods[19], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListAccessListReviewsRequest, ListAccessListReviewsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListAllAccessListReviews will list access list reviews for all access
-     * lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
-     */
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse> {
-        const method = this.methods[20], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * CreateAccessListReview will create a new review for an access list. It will
-     * also modify the original access list and its members depending on the
-     * details of the review.
-     *
-     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
-     */
-    createAccessListReview(input: CreateAccessListReviewRequest, options?: RpcOptions): UnaryCall<CreateAccessListReviewRequest, CreateAccessListReviewResponse> {
-        const method = this.methods[21], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CreateAccessListReviewRequest, CreateAccessListReviewResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteAccessListReview will delete an access list review from the backend.
-     *
-     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, options?: RpcOptions): UnaryCall<DeleteAccessListReviewRequest, Empty> {
-        const method = this.methods[22], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteAccessListReviewRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * AccessRequestPromote promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
-     */
-    accessRequestPromote(input: AccessRequestPromoteRequest, options?: RpcOptions): UnaryCall<AccessRequestPromoteRequest, AccessRequestPromoteResponse> {
-        const method = this.methods[23], opt = this._transport.mergeOptions(options);
-        return stackIntercept<AccessRequestPromoteRequest, AccessRequestPromoteResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access
-     * request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse> {
-        const method = this.methods[24], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetInheritedGrants returns the inherited grants for an access list.
-     *
-     * @generated from protobuf rpc: GetInheritedGrants(teleport.accesslist.v1.GetInheritedGrantsRequest) returns (teleport.accesslist.v1.GetInheritedGrantsResponse);
-     */
-    getInheritedGrants(input: GetInheritedGrantsRequest, options?: RpcOptions): UnaryCall<GetInheritedGrantsRequest, GetInheritedGrantsResponse> {
-        const method = this.methods[25], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetInheritedGrantsRequest, GetInheritedGrantsResponse>("unary", this._transport, method, opt, input);
-    }
-}
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts
deleted file mode 100644
index 87f2dfd96ffc6..0000000000000
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts
+++ /dev/null
@@ -1,512 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { GetInheritedGrantsResponse } from "./accesslist_service_pb";
-import { GetInheritedGrantsRequest } from "./accesslist_service_pb";
-import { GetSuggestedAccessListsResponse } from "./accesslist_service_pb";
-import { GetSuggestedAccessListsRequest } from "./accesslist_service_pb";
-import { AccessRequestPromoteResponse } from "./accesslist_service_pb";
-import { AccessRequestPromoteRequest } from "./accesslist_service_pb";
-import { DeleteAccessListReviewRequest } from "./accesslist_service_pb";
-import { CreateAccessListReviewResponse } from "./accesslist_service_pb";
-import { CreateAccessListReviewRequest } from "./accesslist_service_pb";
-import { ListAllAccessListReviewsResponse } from "./accesslist_service_pb";
-import { ListAllAccessListReviewsRequest } from "./accesslist_service_pb";
-import { ListAccessListReviewsResponse } from "./accesslist_service_pb";
-import { ListAccessListReviewsRequest } from "./accesslist_service_pb";
-import { UpsertAccessListWithMembersResponse } from "./accesslist_service_pb";
-import { UpsertAccessListWithMembersRequest } from "./accesslist_service_pb";
-import { DeleteAllAccessListMembersRequest } from "./accesslist_service_pb";
-import { DeleteAllAccessListMembersForAccessListRequest } from "./accesslist_service_pb";
-import { DeleteAccessListMemberRequest } from "./accesslist_service_pb";
-import { UpdateAccessListMemberRequest } from "./accesslist_service_pb";
-import { UpsertAccessListMemberRequest } from "./accesslist_service_pb";
-import { GetAccessListOwnersResponse } from "./accesslist_service_pb";
-import { GetAccessListOwnersRequest } from "./accesslist_service_pb";
-import { Member } from "./accesslist_pb";
-import { GetAccessListMemberRequest } from "./accesslist_service_pb";
-import { ListAllAccessListMembersResponse } from "./accesslist_service_pb";
-import { ListAllAccessListMembersRequest } from "./accesslist_service_pb";
-import { ListAccessListMembersResponse } from "./accesslist_service_pb";
-import { ListAccessListMembersRequest } from "./accesslist_service_pb";
-import { CountAccessListMembersResponse } from "./accesslist_service_pb";
-import { CountAccessListMembersRequest } from "./accesslist_service_pb";
-import { GetAccessListsToReviewResponse } from "./accesslist_service_pb";
-import { GetAccessListsToReviewRequest } from "./accesslist_service_pb";
-import { DeleteAllAccessListsRequest } from "./accesslist_service_pb";
-import { Empty } from "../../../google/protobuf/empty_pb";
-import { DeleteAccessListRequest } from "./accesslist_service_pb";
-import { UpdateAccessListRequest } from "./accesslist_service_pb";
-import { UpsertAccessListRequest } from "./accesslist_service_pb";
-import { AccessList } from "./accesslist_pb";
-import { GetAccessListRequest } from "./accesslist_service_pb";
-import { ListAccessListsResponse } from "./accesslist_service_pb";
-import { ListAccessListsRequest } from "./accesslist_service_pb";
-import { GetAccessListsResponse } from "./accesslist_service_pb";
-import { GetAccessListsRequest } from "./accesslist_service_pb";
-import type * as grpc from "@grpc/grpc-js";
-/**
- * AccessListService provides CRUD methods for Access List resources.
- *
- * @generated from protobuf service teleport.accesslist.v1.AccessListService
- */
-export interface IAccessListService extends grpc.UntypedServiceImplementation {
-    /**
-     * GetAccessLists returns a list of all access lists.
-     *
-     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
-     */
-    getAccessLists: grpc.handleUnaryCall<GetAccessListsRequest, GetAccessListsResponse>;
-    /**
-     * ListAccessLists returns a paginated list of all access lists.
-     *
-     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
-     */
-    listAccessLists: grpc.handleUnaryCall<ListAccessListsRequest, ListAccessListsResponse>;
-    /**
-     * GetAccessList returns the specified access list resource.
-     *
-     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    getAccessList: grpc.handleUnaryCall<GetAccessListRequest, AccessList>;
-    /**
-     * UpsertAccessList creates or updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    upsertAccessList: grpc.handleUnaryCall<UpsertAccessListRequest, AccessList>;
-    /**
-     * UpdateAccessList updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessList(teleport.accesslist.v1.UpdateAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    updateAccessList: grpc.handleUnaryCall<UpdateAccessListRequest, AccessList>;
-    /**
-     * DeleteAccessList hard deletes the specified access list resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessList: grpc.handleUnaryCall<DeleteAccessListRequest, Empty>;
-    /**
-     * DeleteAllAccessLists hard deletes all access lists.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessLists: grpc.handleUnaryCall<DeleteAllAccessListsRequest, Empty>;
-    /**
-     * GetAccessListsToReview will return access lists that need to be reviewed by
-     * the current user.
-     *
-     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
-     */
-    getAccessListsToReview: grpc.handleUnaryCall<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>;
-    /**
-     * CountAccessListMembers returns the count of access list members in an
-     * access list.
-     *
-     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
-     */
-    countAccessListMembers: grpc.handleUnaryCall<CountAccessListMembersRequest, CountAccessListMembersResponse>;
-    /**
-     * ListAccessListMembers returns a paginated list of all access list members.
-     *
-     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
-     */
-    listAccessListMembers: grpc.handleUnaryCall<ListAccessListMembersRequest, ListAccessListMembersResponse>;
-    /**
-     * ListAllAccessListMembers returns a paginated list of all access list
-     * members for all access lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
-     */
-    listAllAccessListMembers: grpc.handleUnaryCall<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>;
-    /**
-     * GetAccessListMember returns the specified access list member resource.
-     *
-     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    getAccessListMember: grpc.handleUnaryCall<GetAccessListMemberRequest, Member>;
-    /**
-     * GetAccessListOwners returns a list of all owners in an Access List,
-     * including those inherited from nested Access Lists.
-     *
-     * @generated from protobuf rpc: GetAccessListOwners(teleport.accesslist.v1.GetAccessListOwnersRequest) returns (teleport.accesslist.v1.GetAccessListOwnersResponse);
-     */
-    getAccessListOwners: grpc.handleUnaryCall<GetAccessListOwnersRequest, GetAccessListOwnersResponse>;
-    /**
-     * UpsertAccessListMember creates or updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    upsertAccessListMember: grpc.handleUnaryCall<UpsertAccessListMemberRequest, Member>;
-    /**
-     * UpdateAccessListMember conditionally updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpdateAccessListMember(teleport.accesslist.v1.UpdateAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    updateAccessListMember: grpc.handleUnaryCall<UpdateAccessListMemberRequest, Member>;
-    /**
-     * DeleteAccessListMember hard deletes the specified access list member
-     * resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListMember: grpc.handleUnaryCall<DeleteAccessListMemberRequest, Empty>;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembersForAccessList: grpc.handleUnaryCall<DeleteAllAccessListMembersForAccessListRequest, Empty>;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembers: grpc.handleUnaryCall<DeleteAllAccessListMembersRequest, Empty>;
-    /**
-     * UpsertAccessListWithMembers creates or updates an access list with members.
-     *
-     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
-     */
-    upsertAccessListWithMembers: grpc.handleUnaryCall<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>;
-    /**
-     * ListAccessListReviews will list access list reviews for a particular access
-     * list.
-     *
-     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
-     */
-    listAccessListReviews: grpc.handleUnaryCall<ListAccessListReviewsRequest, ListAccessListReviewsResponse>;
-    /**
-     * ListAllAccessListReviews will list access list reviews for all access
-     * lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
-     */
-    listAllAccessListReviews: grpc.handleUnaryCall<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>;
-    /**
-     * CreateAccessListReview will create a new review for an access list. It will
-     * also modify the original access list and its members depending on the
-     * details of the review.
-     *
-     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
-     */
-    createAccessListReview: grpc.handleUnaryCall<CreateAccessListReviewRequest, CreateAccessListReviewResponse>;
-    /**
-     * DeleteAccessListReview will delete an access list review from the backend.
-     *
-     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListReview: grpc.handleUnaryCall<DeleteAccessListReviewRequest, Empty>;
-    /**
-     * AccessRequestPromote promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
-     */
-    accessRequestPromote: grpc.handleUnaryCall<AccessRequestPromoteRequest, AccessRequestPromoteResponse>;
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access
-     * request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists: grpc.handleUnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>;
-    /**
-     * GetInheritedGrants returns the inherited grants for an access list.
-     *
-     * @generated from protobuf rpc: GetInheritedGrants(teleport.accesslist.v1.GetInheritedGrantsRequest) returns (teleport.accesslist.v1.GetInheritedGrantsResponse);
-     */
-    getInheritedGrants: grpc.handleUnaryCall<GetInheritedGrantsRequest, GetInheritedGrantsResponse>;
-}
-/**
- * @grpc/grpc-js definition for the protobuf service teleport.accesslist.v1.AccessListService.
- *
- * Usage: Implement the interface IAccessListService and add to a grpc server.
- *
- * ```typescript
- * const server = new grpc.Server();
- * const service: IAccessListService = ...
- * server.addService(accessListServiceDefinition, service);
- * ```
- */
-export const accessListServiceDefinition: grpc.ServiceDefinition<IAccessListService> = {
-    getAccessLists: {
-        path: "/teleport.accesslist.v1.AccessListService/GetAccessLists",
-        originalName: "GetAccessLists",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => GetAccessListsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => GetAccessListsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(GetAccessListsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetAccessListsRequest.toBinary(value))
-    },
-    listAccessLists: {
-        path: "/teleport.accesslist.v1.AccessListService/ListAccessLists",
-        originalName: "ListAccessLists",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListAccessListsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListAccessListsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListAccessListsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListAccessListsRequest.toBinary(value))
-    },
-    getAccessList: {
-        path: "/teleport.accesslist.v1.AccessListService/GetAccessList",
-        originalName: "GetAccessList",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => AccessList.fromBinary(bytes),
-        requestDeserialize: bytes => GetAccessListRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(AccessList.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetAccessListRequest.toBinary(value))
-    },
-    upsertAccessList: {
-        path: "/teleport.accesslist.v1.AccessListService/UpsertAccessList",
-        originalName: "UpsertAccessList",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => AccessList.fromBinary(bytes),
-        requestDeserialize: bytes => UpsertAccessListRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(AccessList.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpsertAccessListRequest.toBinary(value))
-    },
-    updateAccessList: {
-        path: "/teleport.accesslist.v1.AccessListService/UpdateAccessList",
-        originalName: "UpdateAccessList",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => AccessList.fromBinary(bytes),
-        requestDeserialize: bytes => UpdateAccessListRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(AccessList.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpdateAccessListRequest.toBinary(value))
-    },
-    deleteAccessList: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAccessList",
-        originalName: "DeleteAccessList",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAccessListRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAccessListRequest.toBinary(value))
-    },
-    deleteAllAccessLists: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAllAccessLists",
-        originalName: "DeleteAllAccessLists",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAllAccessListsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAllAccessListsRequest.toBinary(value))
-    },
-    getAccessListsToReview: {
-        path: "/teleport.accesslist.v1.AccessListService/GetAccessListsToReview",
-        originalName: "GetAccessListsToReview",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => GetAccessListsToReviewResponse.fromBinary(bytes),
-        requestDeserialize: bytes => GetAccessListsToReviewRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(GetAccessListsToReviewResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetAccessListsToReviewRequest.toBinary(value))
-    },
-    countAccessListMembers: {
-        path: "/teleport.accesslist.v1.AccessListService/CountAccessListMembers",
-        originalName: "CountAccessListMembers",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => CountAccessListMembersResponse.fromBinary(bytes),
-        requestDeserialize: bytes => CountAccessListMembersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(CountAccessListMembersResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(CountAccessListMembersRequest.toBinary(value))
-    },
-    listAccessListMembers: {
-        path: "/teleport.accesslist.v1.AccessListService/ListAccessListMembers",
-        originalName: "ListAccessListMembers",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListAccessListMembersResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListAccessListMembersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListAccessListMembersResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListAccessListMembersRequest.toBinary(value))
-    },
-    listAllAccessListMembers: {
-        path: "/teleport.accesslist.v1.AccessListService/ListAllAccessListMembers",
-        originalName: "ListAllAccessListMembers",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListAllAccessListMembersResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListAllAccessListMembersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListAllAccessListMembersResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListAllAccessListMembersRequest.toBinary(value))
-    },
-    getAccessListMember: {
-        path: "/teleport.accesslist.v1.AccessListService/GetAccessListMember",
-        originalName: "GetAccessListMember",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Member.fromBinary(bytes),
-        requestDeserialize: bytes => GetAccessListMemberRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Member.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetAccessListMemberRequest.toBinary(value))
-    },
-    getAccessListOwners: {
-        path: "/teleport.accesslist.v1.AccessListService/GetAccessListOwners",
-        originalName: "GetAccessListOwners",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => GetAccessListOwnersResponse.fromBinary(bytes),
-        requestDeserialize: bytes => GetAccessListOwnersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(GetAccessListOwnersResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetAccessListOwnersRequest.toBinary(value))
-    },
-    upsertAccessListMember: {
-        path: "/teleport.accesslist.v1.AccessListService/UpsertAccessListMember",
-        originalName: "UpsertAccessListMember",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Member.fromBinary(bytes),
-        requestDeserialize: bytes => UpsertAccessListMemberRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Member.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpsertAccessListMemberRequest.toBinary(value))
-    },
-    updateAccessListMember: {
-        path: "/teleport.accesslist.v1.AccessListService/UpdateAccessListMember",
-        originalName: "UpdateAccessListMember",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Member.fromBinary(bytes),
-        requestDeserialize: bytes => UpdateAccessListMemberRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Member.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpdateAccessListMemberRequest.toBinary(value))
-    },
-    deleteAccessListMember: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAccessListMember",
-        originalName: "DeleteAccessListMember",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAccessListMemberRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAccessListMemberRequest.toBinary(value))
-    },
-    deleteAllAccessListMembersForAccessList: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAllAccessListMembersForAccessList",
-        originalName: "DeleteAllAccessListMembersForAccessList",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAllAccessListMembersForAccessListRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAllAccessListMembersForAccessListRequest.toBinary(value))
-    },
-    deleteAllAccessListMembers: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAllAccessListMembers",
-        originalName: "DeleteAllAccessListMembers",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAllAccessListMembersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAllAccessListMembersRequest.toBinary(value))
-    },
-    upsertAccessListWithMembers: {
-        path: "/teleport.accesslist.v1.AccessListService/UpsertAccessListWithMembers",
-        originalName: "UpsertAccessListWithMembers",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => UpsertAccessListWithMembersResponse.fromBinary(bytes),
-        requestDeserialize: bytes => UpsertAccessListWithMembersRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(UpsertAccessListWithMembersResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpsertAccessListWithMembersRequest.toBinary(value))
-    },
-    listAccessListReviews: {
-        path: "/teleport.accesslist.v1.AccessListService/ListAccessListReviews",
-        originalName: "ListAccessListReviews",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListAccessListReviewsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListAccessListReviewsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListAccessListReviewsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListAccessListReviewsRequest.toBinary(value))
-    },
-    listAllAccessListReviews: {
-        path: "/teleport.accesslist.v1.AccessListService/ListAllAccessListReviews",
-        originalName: "ListAllAccessListReviews",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListAllAccessListReviewsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListAllAccessListReviewsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListAllAccessListReviewsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListAllAccessListReviewsRequest.toBinary(value))
-    },
-    createAccessListReview: {
-        path: "/teleport.accesslist.v1.AccessListService/CreateAccessListReview",
-        originalName: "CreateAccessListReview",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => CreateAccessListReviewResponse.fromBinary(bytes),
-        requestDeserialize: bytes => CreateAccessListReviewRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(CreateAccessListReviewResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(CreateAccessListReviewRequest.toBinary(value))
-    },
-    deleteAccessListReview: {
-        path: "/teleport.accesslist.v1.AccessListService/DeleteAccessListReview",
-        originalName: "DeleteAccessListReview",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteAccessListReviewRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteAccessListReviewRequest.toBinary(value))
-    },
-    accessRequestPromote: {
-        path: "/teleport.accesslist.v1.AccessListService/AccessRequestPromote",
-        originalName: "AccessRequestPromote",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => AccessRequestPromoteResponse.fromBinary(bytes),
-        requestDeserialize: bytes => AccessRequestPromoteRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(AccessRequestPromoteResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(AccessRequestPromoteRequest.toBinary(value))
-    },
-    getSuggestedAccessLists: {
-        path: "/teleport.accesslist.v1.AccessListService/GetSuggestedAccessLists",
-        originalName: "GetSuggestedAccessLists",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => GetSuggestedAccessListsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => GetSuggestedAccessListsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(GetSuggestedAccessListsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetSuggestedAccessListsRequest.toBinary(value))
-    },
-    getInheritedGrants: {
-        path: "/teleport.accesslist.v1.AccessListService/GetInheritedGrants",
-        originalName: "GetInheritedGrants",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => GetInheritedGrantsResponse.fromBinary(bytes),
-        requestDeserialize: bytes => GetInheritedGrantsRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(GetInheritedGrantsResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetInheritedGrantsRequest.toBinary(value))
-    }
-};
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts
deleted file mode 100644
index dd5c01b587893..0000000000000
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts
+++ /dev/null
@@ -1,2669 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { Empty } from "../../../google/protobuf/empty_pb";
-import { ServiceType } from "@protobuf-ts/runtime-rpc";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { AccessRequestV3 } from "../../legacy/types/types_pb";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-import { Review } from "./accesslist_pb";
-import { AccessListOwner } from "./accesslist_pb";
-import { Member } from "./accesslist_pb";
-import { AccessListGrants } from "./accesslist_pb";
-import { AccessList } from "./accesslist_pb";
-/**
- * GetAccessListsRequest is the request for getting all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListsRequest
- */
-export interface GetAccessListsRequest {
-}
-/**
- * GetAccessListsResponse is the response for getting all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListsResponse
- */
-export interface GetAccessListsResponse {
-    /**
-     * access_lists is the list of access lists.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.AccessList access_lists = 1;
-     */
-    accessLists: AccessList[];
-}
-/**
- * ListAccessListsRequest is the request for getting paginated access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListsRequest
- */
-export interface ListAccessListsRequest {
-    /**
-     * page_size is the size of the page to request.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * next_token is the page token.
-     *
-     * @generated from protobuf field: string next_token = 2;
-     */
-    nextToken: string;
-}
-/**
- * ListAccessListsResponse is the response for getting paginated access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListsResponse
- */
-export interface ListAccessListsResponse {
-    /**
-     * access_lists is the list of access lists.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.AccessList access_lists = 1;
-     */
-    accessLists: AccessList[];
-    /**
-     * next_token is the next page token.
-     *
-     * @generated from protobuf field: string next_token = 2;
-     */
-    nextToken: string;
-}
-/**
- * GetInheritedGrantsRequest is the request for getting inherited grants.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetInheritedGrantsRequest
- */
-export interface GetInheritedGrantsRequest {
-    /**
-     * access_list_id is the ID of the access list to retrieve.
-     *
-     * @generated from protobuf field: string access_list_id = 1;
-     */
-    accessListId: string;
-}
-/**
- * GetInheritedGrantsResponse is the response for getting inherited grants.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetInheritedGrantsResponse
- */
-export interface GetInheritedGrantsResponse {
-    /**
-     * grants is the list of inherited member grants.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.AccessListGrants grants = 1;
-     */
-    grants?: AccessListGrants;
-}
-/**
- * GetAccessListRequest is the request for retrieving an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListRequest
- */
-export interface GetAccessListRequest {
-    /**
-     * name is the name of the access list to retrieve.
-     *
-     * @generated from protobuf field: string name = 1;
-     */
-    name: string;
-}
-/**
- * UpsertAccessListRequest is the request for upserting an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpsertAccessListRequest
- */
-export interface UpsertAccessListRequest {
-    /**
-     * access_list is the access list to upsert.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.AccessList access_list = 1;
-     */
-    accessList?: AccessList;
-}
-/**
- * UpdateAccessListRequest is the request for updating an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpdateAccessListRequest
- */
-export interface UpdateAccessListRequest {
-    /**
-     * access_list is the access list to upsert.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.AccessList access_list = 1;
-     */
-    accessList?: AccessList;
-}
-/**
- * DeleteAccessListRequest is the request for deleting an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAccessListRequest
- */
-export interface DeleteAccessListRequest {
-    /**
-     * name is the name of the access list to delete.
-     *
-     * @generated from protobuf field: string name = 1;
-     */
-    name: string;
-}
-/**
- * DeleteAllAccessListsRequest is the request for deleting all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAllAccessListsRequest
- */
-export interface DeleteAllAccessListsRequest {
-}
-/**
- * GetAccessListsToReviewRequest is the request for getting access lists that
- * the current user needs to review.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListsToReviewRequest
- */
-export interface GetAccessListsToReviewRequest {
-}
-/**
- * GetAccessListsToReviewResponse is the response for getting access lists that
- * the current user needs to review.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListsToReviewResponse
- */
-export interface GetAccessListsToReviewResponse {
-    /**
-     * @generated from protobuf field: repeated teleport.accesslist.v1.AccessList access_lists = 1;
-     */
-    accessLists: AccessList[];
-}
-/**
- * CountAccessListMembersRequest is the request for counting access list
- * members.
- *
- * @generated from protobuf message teleport.accesslist.v1.CountAccessListMembersRequest
- */
-export interface CountAccessListMembersRequest {
-    /**
-     * access_list_name is the name of the access list to retrieve.
-     *
-     * @generated from protobuf field: string access_list_name = 1;
-     */
-    accessListName: string;
-}
-/**
- * CountAccessListMembersResponse is the response for counting access list
- * members.
- *
- * @generated from protobuf message teleport.accesslist.v1.CountAccessListMembersResponse
- */
-export interface CountAccessListMembersResponse {
-    /**
-     * count is the number of access list members in the access list.
-     *
-     * @generated from protobuf field: uint32 count = 1;
-     */
-    count: number;
-    /**
-     * list_count is the number of access list members of type list in the access list.
-     *
-     * @generated from protobuf field: uint32 list_count = 2;
-     */
-    listCount: number;
-}
-/**
- * ListAccessListMembersRequest is the request for getting paginated access list
- * members.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListMembersRequest
- */
-export interface ListAccessListMembersRequest {
-    /**
-     * page_size is the size of the page to request.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * page_token is the page token.
-     *
-     * @generated from protobuf field: string page_token = 2;
-     */
-    pageToken: string;
-    /**
-     * access_list is the name of the access list that the member belongs to.
-     *
-     * @generated from protobuf field: string access_list = 3;
-     */
-    accessList: string;
-}
-/**
- * ListAccessListMembersResponse is the response for getting paginated access
- * list members.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListMembersResponse
- */
-export interface ListAccessListMembersResponse {
-    /**
-     * members is the list of access list members.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Member members = 1;
-     */
-    members: Member[];
-    /**
-     * next_page_token is the next page token.
-     *
-     * @generated from protobuf field: string next_page_token = 2;
-     */
-    nextPageToken: string;
-}
-/**
- * ListAllAccessListMembersRequest is the request for getting paginated access
- * list members for all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAllAccessListMembersRequest
- */
-export interface ListAllAccessListMembersRequest {
-    /**
-     * page_size is the size of the page to request.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * page_token is the page token.
-     *
-     * @generated from protobuf field: string page_token = 2;
-     */
-    pageToken: string;
-}
-/**
- * ListAllAccessListMembersResponse is the response for getting paginated access
- * list members for all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAllAccessListMembersResponse
- */
-export interface ListAllAccessListMembersResponse {
-    /**
-     * members is the list of access list members.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Member members = 1;
-     */
-    members: Member[];
-    /**
-     * next_page_token is the next page token.
-     *
-     * @generated from protobuf field: string next_page_token = 2;
-     */
-    nextPageToken: string;
-}
-/**
- * UpsertAccessListWithMembers is the request for upserting an access list with
- * members.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpsertAccessListWithMembersRequest
- */
-export interface UpsertAccessListWithMembersRequest {
-    /**
-     * access_list is the access list to upsert.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.AccessList access_list = 1;
-     */
-    accessList?: AccessList;
-    /**
-     * members is the list of access list members.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Member members = 2;
-     */
-    members: Member[];
-}
-/**
- * UpsertAccessListWithMembersResponse is the response for upserting an access
- * list with members.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpsertAccessListWithMembersResponse
- */
-export interface UpsertAccessListWithMembersResponse {
-    /**
-     * access_list is the access list that was upserted.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.AccessList access_list = 1;
-     */
-    accessList?: AccessList;
-    /**
-     * members is the list of access list members that were upserted.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Member members = 2;
-     */
-    members: Member[];
-}
-/**
- * GetAccessListMemberRequest is the request for retrieving an access list
- * member.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListMemberRequest
- */
-export interface GetAccessListMemberRequest {
-    /**
-     * access_list is the name of the access list that the member belongs to.
-     *
-     * @generated from protobuf field: string access_list = 1;
-     */
-    accessList: string;
-    /**
-     * member_name is the name of the user that belongs to the access list.
-     *
-     * @generated from protobuf field: string member_name = 2;
-     */
-    memberName: string;
-}
-/**
- * GetAccessListOwnersRequest is the request for getting a list of all owners
- * in an Access List, including those inherited from nested Access Lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListOwnersRequest
- */
-export interface GetAccessListOwnersRequest {
-    /**
-     * access_list is the name of the access list.
-     *
-     * @generated from protobuf field: string access_list = 1;
-     */
-    accessList: string;
-}
-/**
- * GetAccessListOwnersResponse is the response for getting a list of all
- * owners in an Access List, including those inherited from nested Access Lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetAccessListOwnersResponse
- */
-export interface GetAccessListOwnersResponse {
-    /**
-     * owners is the list of all owners in the Access List, including those
-     * inherited from nested Access Lists.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.AccessListOwner owners = 1;
-     */
-    owners: AccessListOwner[];
-}
-/**
- * UpsertAccessListMemberRequest is the request for upserting an access list
- * member.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpsertAccessListMemberRequest
- */
-export interface UpsertAccessListMemberRequest {
-    /**
-     * member is the access list member to upsert.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.Member member = 4;
-     */
-    member?: Member;
-}
-/**
- * UpdateAccessListMemberRequest is the request for updating an access list
- * member.
- *
- * @generated from protobuf message teleport.accesslist.v1.UpdateAccessListMemberRequest
- */
-export interface UpdateAccessListMemberRequest {
-    /**
-     * member is the access list member to upsert.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.Member member = 1;
-     */
-    member?: Member;
-}
-/**
- * DeleteAccessListMemberRequest is the request for deleting a member from an
- * access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAccessListMemberRequest
- */
-export interface DeleteAccessListMemberRequest {
-    /**
-     * access_list is the name of access list.
-     *
-     * @generated from protobuf field: string access_list = 1;
-     */
-    accessList: string;
-    /**
-     * member_name is the name of the user to delete.
-     *
-     * @generated from protobuf field: string member_name = 3;
-     */
-    memberName: string;
-}
-/**
- * DeleteAllAccessListMembersForAccessListRequest is the request for deleting
- * all members from an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
- */
-export interface DeleteAllAccessListMembersForAccessListRequest {
-    /**
-     * access_list is the name of access list.
-     *
-     * @generated from protobuf field: string access_list = 1;
-     */
-    accessList: string;
-}
-/**
- * DeleteAllAccessListMembersRequest is the request for all access list members
- * in the backend.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAllAccessListMembersRequest
- */
-export interface DeleteAllAccessListMembersRequest {
-}
-/**
- * ListAccessListReviewsRequest is the request for getting paginated access list
- * reviews for a particular access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListReviewsRequest
- */
-export interface ListAccessListReviewsRequest {
-    /**
-     * access_list is the name of the access list that we're listing reviews for.
-     *
-     * @generated from protobuf field: string access_list = 1;
-     */
-    accessList: string;
-    /**
-     * page_size is the size of the page to request.
-     *
-     * @generated from protobuf field: int32 page_size = 2;
-     */
-    pageSize: number;
-    /**
-     * next_token is the page token.
-     *
-     * @generated from protobuf field: string next_token = 3;
-     */
-    nextToken: string;
-}
-/**
- * ListAccessListReviewsResponse is the response for getting paginated access
- * list reviews for a particular access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAccessListReviewsResponse
- */
-export interface ListAccessListReviewsResponse {
-    /**
-     * reviews is the list of access list reviews.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Review reviews = 1;
-     */
-    reviews: Review[];
-    /**
-     * next_token is the next page token.
-     *
-     * @generated from protobuf field: string next_token = 2;
-     */
-    nextToken: string;
-}
-/**
- * ListAllAccessListReviewsRequest is the request for getting paginated access
- * list reviews for all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAllAccessListReviewsRequest
- */
-export interface ListAllAccessListReviewsRequest {
-    /**
-     * page_size is the size of the page to request.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * next_token is the page token.
-     *
-     * @generated from protobuf field: string next_token = 2;
-     */
-    nextToken: string;
-}
-/**
- * ListAllAccessListReviewsResponse is the response for getting paginated access
- * list reviews for all access lists.
- *
- * @generated from protobuf message teleport.accesslist.v1.ListAllAccessListReviewsResponse
- */
-export interface ListAllAccessListReviewsResponse {
-    /**
-     * reviews is the list of access list reviews.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.Review reviews = 1;
-     */
-    reviews: Review[];
-    /**
-     * next_token is the next page token.
-     *
-     * @generated from protobuf field: string next_token = 2;
-     */
-    nextToken: string;
-}
-/**
- * CreateAccessListReviewRequest is the request for creating an access list
- * review.
- *
- * @generated from protobuf message teleport.accesslist.v1.CreateAccessListReviewRequest
- */
-export interface CreateAccessListReviewRequest {
-    /**
-     * review is the actual review to create.
-     *
-     * @generated from protobuf field: teleport.accesslist.v1.Review review = 1;
-     */
-    review?: Review;
-}
-/**
- * CreateAccessListReviewResponse is the response for creating an access list
- * review.
- *
- * @generated from protobuf message teleport.accesslist.v1.CreateAccessListReviewResponse
- */
-export interface CreateAccessListReviewResponse {
-    /**
-     * review_name is the name of the review that was just created.
-     *
-     * @generated from protobuf field: string review_name = 1;
-     */
-    reviewName: string;
-    /**
-     * next_audit_date is when the next audit should be done by.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp next_audit_date = 2;
-     */
-    nextAuditDate?: Timestamp;
-}
-/**
- * DeleteAccessListReviewRequest is the request for deleting an access list
- * review.
- *
- * @generated from protobuf message teleport.accesslist.v1.DeleteAccessListReviewRequest
- */
-export interface DeleteAccessListReviewRequest {
-    /**
-     * review_name is the name of the review to delete.
-     *
-     * @generated from protobuf field: string review_name = 1;
-     */
-    reviewName: string;
-    /**
-     * access_list_name is the name of the access list to delete the review from.
-     *
-     * @generated from protobuf field: string access_list_name = 2;
-     */
-    accessListName: string;
-}
-/**
- * AccessRequestPromoteRequest is the request for promoting an access request to
- * an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.AccessRequestPromoteRequest
- */
-export interface AccessRequestPromoteRequest {
-    /**
-     * RequestID is the unique ID of the request to be promoted.
-     *
-     * @generated from protobuf field: string request_id = 1;
-     */
-    requestId: string;
-    /**
-     * AccessListName is the name of the access list to promote the request to.
-     *
-     * @generated from protobuf field: string access_list_name = 2;
-     */
-    accessListName: string;
-    /**
-     * Reason is the access request review reason.
-     *
-     * @generated from protobuf field: string reason = 3;
-     */
-    reason: string;
-}
-/**
- * AccessRequestPromoteResponse is the response for promoting an access request
- * to an access list.
- *
- * @generated from protobuf message teleport.accesslist.v1.AccessRequestPromoteResponse
- */
-export interface AccessRequestPromoteResponse {
-    /**
-     * AccessRequest is the updated access request.
-     *
-     * @generated from protobuf field: types.AccessRequestV3 access_request = 1;
-     */
-    accessRequest?: AccessRequestV3;
-}
-/**
- * GetSuggestedAccessListsRequest is the request for suggested access lists for
- * an access request.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetSuggestedAccessListsRequest
- */
-export interface GetSuggestedAccessListsRequest {
-    /**
-     * access_request_id is the unique ID of the request.
-     *
-     * @generated from protobuf field: string access_request_id = 1;
-     */
-    accessRequestId: string;
-}
-/**
- * GetSuggestedAccessListsResponse is the response for suggested access lists
- * for an access request.
- *
- * @generated from protobuf message teleport.accesslist.v1.GetSuggestedAccessListsResponse
- */
-export interface GetSuggestedAccessListsResponse {
-    /**
-     * access_lists is the list of suggested lists.
-     *
-     * @generated from protobuf field: repeated teleport.accesslist.v1.AccessList access_lists = 1;
-     */
-    accessLists: AccessList[];
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListsRequest$Type extends MessageType<GetAccessListsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListsRequest", []);
-    }
-    create(value?: PartialMessage<GetAccessListsRequest>): GetAccessListsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListsRequest): GetAccessListsRequest {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: GetAccessListsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListsRequest
- */
-export const GetAccessListsRequest = new GetAccessListsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListsResponse$Type extends MessageType<GetAccessListsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListsResponse", [
-            { no: 1, name: "access_lists", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessList }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListsResponse>): GetAccessListsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessLists = [];
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListsResponse): GetAccessListsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.AccessList access_lists */ 1:
-                    message.accessLists.push(AccessList.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.AccessList access_lists = 1; */
-        for (let i = 0; i < message.accessLists.length; i++)
-            AccessList.internalBinaryWrite(message.accessLists[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListsResponse
- */
-export const GetAccessListsResponse = new GetAccessListsResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListsRequest$Type extends MessageType<ListAccessListsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListsRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListsRequest>): ListAccessListsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListsRequest): ListAccessListsRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string next_token */ 2:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string next_token = 2; */
-        if (message.nextToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListsRequest
- */
-export const ListAccessListsRequest = new ListAccessListsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListsResponse$Type extends MessageType<ListAccessListsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListsResponse", [
-            { no: 1, name: "access_lists", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessList },
-            { no: 2, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListsResponse>): ListAccessListsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessLists = [];
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListsResponse): ListAccessListsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.AccessList access_lists */ 1:
-                    message.accessLists.push(AccessList.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_token */ 2:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.AccessList access_lists = 1; */
-        for (let i = 0; i < message.accessLists.length; i++)
-            AccessList.internalBinaryWrite(message.accessLists[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_token = 2; */
-        if (message.nextToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListsResponse
- */
-export const ListAccessListsResponse = new ListAccessListsResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetInheritedGrantsRequest$Type extends MessageType<GetInheritedGrantsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetInheritedGrantsRequest", [
-            { no: 1, name: "access_list_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetInheritedGrantsRequest>): GetInheritedGrantsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessListId = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetInheritedGrantsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetInheritedGrantsRequest): GetInheritedGrantsRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list_id */ 1:
-                    message.accessListId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetInheritedGrantsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list_id = 1; */
-        if (message.accessListId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessListId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetInheritedGrantsRequest
- */
-export const GetInheritedGrantsRequest = new GetInheritedGrantsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetInheritedGrantsResponse$Type extends MessageType<GetInheritedGrantsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.GetInheritedGrantsResponse", [
-            { no: 1, name: "grants", kind: "message", T: () => AccessListGrants }
-        ]);
-    }
-    create(value?: PartialMessage<GetInheritedGrantsResponse>): GetInheritedGrantsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetInheritedGrantsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetInheritedGrantsResponse): GetInheritedGrantsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.AccessListGrants grants */ 1:
-                    message.grants = AccessListGrants.internalBinaryRead(reader, reader.uint32(), options, message.grants);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetInheritedGrantsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.AccessListGrants grants = 1; */
-        if (message.grants)
-            AccessListGrants.internalBinaryWrite(message.grants, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetInheritedGrantsResponse
- */
-export const GetInheritedGrantsResponse = new GetInheritedGrantsResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListRequest$Type extends MessageType<GetAccessListRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListRequest", [
-            { no: 1, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListRequest>): GetAccessListRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.name = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListRequest): GetAccessListRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string name */ 1:
-                    message.name = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string name = 1; */
-        if (message.name !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.name);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListRequest
- */
-export const GetAccessListRequest = new GetAccessListRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpsertAccessListRequest$Type extends MessageType<UpsertAccessListRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.UpsertAccessListRequest", [
-            { no: 1, name: "access_list", kind: "message", T: () => AccessList }
-        ]);
-    }
-    create(value?: PartialMessage<UpsertAccessListRequest>): UpsertAccessListRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<UpsertAccessListRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpsertAccessListRequest): UpsertAccessListRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.AccessList access_list */ 1:
-                    message.accessList = AccessList.internalBinaryRead(reader, reader.uint32(), options, message.accessList);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpsertAccessListRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.AccessList access_list = 1; */
-        if (message.accessList)
-            AccessList.internalBinaryWrite(message.accessList, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpsertAccessListRequest
- */
-export const UpsertAccessListRequest = new UpsertAccessListRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpdateAccessListRequest$Type extends MessageType<UpdateAccessListRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.UpdateAccessListRequest", [
-            { no: 1, name: "access_list", kind: "message", T: () => AccessList }
-        ]);
-    }
-    create(value?: PartialMessage<UpdateAccessListRequest>): UpdateAccessListRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<UpdateAccessListRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateAccessListRequest): UpdateAccessListRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.AccessList access_list */ 1:
-                    message.accessList = AccessList.internalBinaryRead(reader, reader.uint32(), options, message.accessList);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpdateAccessListRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.AccessList access_list = 1; */
-        if (message.accessList)
-            AccessList.internalBinaryWrite(message.accessList, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpdateAccessListRequest
- */
-export const UpdateAccessListRequest = new UpdateAccessListRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAccessListRequest$Type extends MessageType<DeleteAccessListRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAccessListRequest", [
-            { no: 1, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeleteAccessListRequest>): DeleteAccessListRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.name = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAccessListRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAccessListRequest): DeleteAccessListRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string name */ 1:
-                    message.name = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeleteAccessListRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string name = 1; */
-        if (message.name !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.name);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAccessListRequest
- */
-export const DeleteAccessListRequest = new DeleteAccessListRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAllAccessListsRequest$Type extends MessageType<DeleteAllAccessListsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAllAccessListsRequest", []);
-    }
-    create(value?: PartialMessage<DeleteAllAccessListsRequest>): DeleteAllAccessListsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAllAccessListsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAllAccessListsRequest): DeleteAllAccessListsRequest {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: DeleteAllAccessListsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAllAccessListsRequest
- */
-export const DeleteAllAccessListsRequest = new DeleteAllAccessListsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListsToReviewRequest$Type extends MessageType<GetAccessListsToReviewRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListsToReviewRequest", []);
-    }
-    create(value?: PartialMessage<GetAccessListsToReviewRequest>): GetAccessListsToReviewRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListsToReviewRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListsToReviewRequest): GetAccessListsToReviewRequest {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: GetAccessListsToReviewRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListsToReviewRequest
- */
-export const GetAccessListsToReviewRequest = new GetAccessListsToReviewRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListsToReviewResponse$Type extends MessageType<GetAccessListsToReviewResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListsToReviewResponse", [
-            { no: 1, name: "access_lists", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessList }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListsToReviewResponse>): GetAccessListsToReviewResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessLists = [];
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListsToReviewResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListsToReviewResponse): GetAccessListsToReviewResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.AccessList access_lists */ 1:
-                    message.accessLists.push(AccessList.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListsToReviewResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.AccessList access_lists = 1; */
-        for (let i = 0; i < message.accessLists.length; i++)
-            AccessList.internalBinaryWrite(message.accessLists[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListsToReviewResponse
- */
-export const GetAccessListsToReviewResponse = new GetAccessListsToReviewResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CountAccessListMembersRequest$Type extends MessageType<CountAccessListMembersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.CountAccessListMembersRequest", [
-            { no: 1, name: "access_list_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<CountAccessListMembersRequest>): CountAccessListMembersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessListName = "";
-        if (value !== undefined)
-            reflectionMergePartial<CountAccessListMembersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CountAccessListMembersRequest): CountAccessListMembersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list_name */ 1:
-                    message.accessListName = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CountAccessListMembersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list_name = 1; */
-        if (message.accessListName !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessListName);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.CountAccessListMembersRequest
- */
-export const CountAccessListMembersRequest = new CountAccessListMembersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CountAccessListMembersResponse$Type extends MessageType<CountAccessListMembersResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.CountAccessListMembersResponse", [
-            { no: 1, name: "count", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
-            { no: 2, name: "list_count", kind: "scalar", T: 13 /*ScalarType.UINT32*/ }
-        ]);
-    }
-    create(value?: PartialMessage<CountAccessListMembersResponse>): CountAccessListMembersResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.count = 0;
-        message.listCount = 0;
-        if (value !== undefined)
-            reflectionMergePartial<CountAccessListMembersResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CountAccessListMembersResponse): CountAccessListMembersResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* uint32 count */ 1:
-                    message.count = reader.uint32();
-                    break;
-                case /* uint32 list_count */ 2:
-                    message.listCount = reader.uint32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CountAccessListMembersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* uint32 count = 1; */
-        if (message.count !== 0)
-            writer.tag(1, WireType.Varint).uint32(message.count);
-        /* uint32 list_count = 2; */
-        if (message.listCount !== 0)
-            writer.tag(2, WireType.Varint).uint32(message.listCount);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.CountAccessListMembersResponse
- */
-export const CountAccessListMembersResponse = new CountAccessListMembersResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListMembersRequest$Type extends MessageType<ListAccessListMembersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListMembersRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListMembersRequest>): ListAccessListMembersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.pageToken = "";
-        message.accessList = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListMembersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListMembersRequest): ListAccessListMembersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string page_token */ 2:
-                    message.pageToken = reader.string();
-                    break;
-                case /* string access_list */ 3:
-                    message.accessList = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListMembersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 2; */
-        if (message.pageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
-        /* string access_list = 3; */
-        if (message.accessList !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.accessList);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListMembersRequest
- */
-export const ListAccessListMembersRequest = new ListAccessListMembersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListMembersResponse$Type extends MessageType<ListAccessListMembersResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListMembersResponse", [
-            { no: 1, name: "members", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Member },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListMembersResponse>): ListAccessListMembersResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.members = [];
-        message.nextPageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListMembersResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListMembersResponse): ListAccessListMembersResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.Member members */ 1:
-                    message.members.push(Member.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListMembersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.Member members = 1; */
-        for (let i = 0; i < message.members.length; i++)
-            Member.internalBinaryWrite(message.members[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListMembersResponse
- */
-export const ListAccessListMembersResponse = new ListAccessListMembersResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAllAccessListMembersRequest$Type extends MessageType<ListAllAccessListMembersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAllAccessListMembersRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAllAccessListMembersRequest>): ListAllAccessListMembersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.pageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAllAccessListMembersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAllAccessListMembersRequest): ListAllAccessListMembersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string page_token */ 2:
-                    message.pageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAllAccessListMembersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 2; */
-        if (message.pageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAllAccessListMembersRequest
- */
-export const ListAllAccessListMembersRequest = new ListAllAccessListMembersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAllAccessListMembersResponse$Type extends MessageType<ListAllAccessListMembersResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAllAccessListMembersResponse", [
-            { no: 1, name: "members", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Member },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAllAccessListMembersResponse>): ListAllAccessListMembersResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.members = [];
-        message.nextPageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAllAccessListMembersResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAllAccessListMembersResponse): ListAllAccessListMembersResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.Member members */ 1:
-                    message.members.push(Member.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAllAccessListMembersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.Member members = 1; */
-        for (let i = 0; i < message.members.length; i++)
-            Member.internalBinaryWrite(message.members[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAllAccessListMembersResponse
- */
-export const ListAllAccessListMembersResponse = new ListAllAccessListMembersResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpsertAccessListWithMembersRequest$Type extends MessageType<UpsertAccessListWithMembersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.UpsertAccessListWithMembersRequest", [
-            { no: 1, name: "access_list", kind: "message", T: () => AccessList },
-            { no: 2, name: "members", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Member }
-        ]);
-    }
-    create(value?: PartialMessage<UpsertAccessListWithMembersRequest>): UpsertAccessListWithMembersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.members = [];
-        if (value !== undefined)
-            reflectionMergePartial<UpsertAccessListWithMembersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpsertAccessListWithMembersRequest): UpsertAccessListWithMembersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.AccessList access_list */ 1:
-                    message.accessList = AccessList.internalBinaryRead(reader, reader.uint32(), options, message.accessList);
-                    break;
-                case /* repeated teleport.accesslist.v1.Member members */ 2:
-                    message.members.push(Member.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpsertAccessListWithMembersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.AccessList access_list = 1; */
-        if (message.accessList)
-            AccessList.internalBinaryWrite(message.accessList, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* repeated teleport.accesslist.v1.Member members = 2; */
-        for (let i = 0; i < message.members.length; i++)
-            Member.internalBinaryWrite(message.members[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpsertAccessListWithMembersRequest
- */
-export const UpsertAccessListWithMembersRequest = new UpsertAccessListWithMembersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpsertAccessListWithMembersResponse$Type extends MessageType<UpsertAccessListWithMembersResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.UpsertAccessListWithMembersResponse", [
-            { no: 1, name: "access_list", kind: "message", T: () => AccessList },
-            { no: 2, name: "members", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Member }
-        ]);
-    }
-    create(value?: PartialMessage<UpsertAccessListWithMembersResponse>): UpsertAccessListWithMembersResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.members = [];
-        if (value !== undefined)
-            reflectionMergePartial<UpsertAccessListWithMembersResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpsertAccessListWithMembersResponse): UpsertAccessListWithMembersResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.AccessList access_list */ 1:
-                    message.accessList = AccessList.internalBinaryRead(reader, reader.uint32(), options, message.accessList);
-                    break;
-                case /* repeated teleport.accesslist.v1.Member members */ 2:
-                    message.members.push(Member.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpsertAccessListWithMembersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.AccessList access_list = 1; */
-        if (message.accessList)
-            AccessList.internalBinaryWrite(message.accessList, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* repeated teleport.accesslist.v1.Member members = 2; */
-        for (let i = 0; i < message.members.length; i++)
-            Member.internalBinaryWrite(message.members[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpsertAccessListWithMembersResponse
- */
-export const UpsertAccessListWithMembersResponse = new UpsertAccessListWithMembersResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListMemberRequest$Type extends MessageType<GetAccessListMemberRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListMemberRequest", [
-            { no: 1, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "member_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListMemberRequest>): GetAccessListMemberRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessList = "";
-        message.memberName = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListMemberRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListMemberRequest): GetAccessListMemberRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list */ 1:
-                    message.accessList = reader.string();
-                    break;
-                case /* string member_name */ 2:
-                    message.memberName = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListMemberRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list = 1; */
-        if (message.accessList !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessList);
-        /* string member_name = 2; */
-        if (message.memberName !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.memberName);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListMemberRequest
- */
-export const GetAccessListMemberRequest = new GetAccessListMemberRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListOwnersRequest$Type extends MessageType<GetAccessListOwnersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListOwnersRequest", [
-            { no: 1, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListOwnersRequest>): GetAccessListOwnersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessList = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListOwnersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListOwnersRequest): GetAccessListOwnersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list */ 1:
-                    message.accessList = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListOwnersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list = 1; */
-        if (message.accessList !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessList);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListOwnersRequest
- */
-export const GetAccessListOwnersRequest = new GetAccessListOwnersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAccessListOwnersResponse$Type extends MessageType<GetAccessListOwnersResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.GetAccessListOwnersResponse", [
-            { no: 1, name: "owners", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessListOwner }
-        ]);
-    }
-    create(value?: PartialMessage<GetAccessListOwnersResponse>): GetAccessListOwnersResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.owners = [];
-        if (value !== undefined)
-            reflectionMergePartial<GetAccessListOwnersResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAccessListOwnersResponse): GetAccessListOwnersResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.AccessListOwner owners */ 1:
-                    message.owners.push(AccessListOwner.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAccessListOwnersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.AccessListOwner owners = 1; */
-        for (let i = 0; i < message.owners.length; i++)
-            AccessListOwner.internalBinaryWrite(message.owners[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetAccessListOwnersResponse
- */
-export const GetAccessListOwnersResponse = new GetAccessListOwnersResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpsertAccessListMemberRequest$Type extends MessageType<UpsertAccessListMemberRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.UpsertAccessListMemberRequest", [
-            { no: 4, name: "member", kind: "message", T: () => Member }
-        ]);
-    }
-    create(value?: PartialMessage<UpsertAccessListMemberRequest>): UpsertAccessListMemberRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<UpsertAccessListMemberRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpsertAccessListMemberRequest): UpsertAccessListMemberRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.Member member */ 4:
-                    message.member = Member.internalBinaryRead(reader, reader.uint32(), options, message.member);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpsertAccessListMemberRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.Member member = 4; */
-        if (message.member)
-            Member.internalBinaryWrite(message.member, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpsertAccessListMemberRequest
- */
-export const UpsertAccessListMemberRequest = new UpsertAccessListMemberRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpdateAccessListMemberRequest$Type extends MessageType<UpdateAccessListMemberRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.UpdateAccessListMemberRequest", [
-            { no: 1, name: "member", kind: "message", T: () => Member }
-        ]);
-    }
-    create(value?: PartialMessage<UpdateAccessListMemberRequest>): UpdateAccessListMemberRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<UpdateAccessListMemberRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateAccessListMemberRequest): UpdateAccessListMemberRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.Member member */ 1:
-                    message.member = Member.internalBinaryRead(reader, reader.uint32(), options, message.member);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpdateAccessListMemberRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.Member member = 1; */
-        if (message.member)
-            Member.internalBinaryWrite(message.member, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.UpdateAccessListMemberRequest
- */
-export const UpdateAccessListMemberRequest = new UpdateAccessListMemberRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAccessListMemberRequest$Type extends MessageType<DeleteAccessListMemberRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAccessListMemberRequest", [
-            { no: 1, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "member_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeleteAccessListMemberRequest>): DeleteAccessListMemberRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessList = "";
-        message.memberName = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAccessListMemberRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAccessListMemberRequest): DeleteAccessListMemberRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list */ 1:
-                    message.accessList = reader.string();
-                    break;
-                case /* string member_name */ 3:
-                    message.memberName = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeleteAccessListMemberRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list = 1; */
-        if (message.accessList !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessList);
-        /* string member_name = 3; */
-        if (message.memberName !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.memberName);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAccessListMemberRequest
- */
-export const DeleteAccessListMemberRequest = new DeleteAccessListMemberRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAllAccessListMembersForAccessListRequest$Type extends MessageType<DeleteAllAccessListMembersForAccessListRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest", [
-            { no: 1, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeleteAllAccessListMembersForAccessListRequest>): DeleteAllAccessListMembersForAccessListRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessList = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAllAccessListMembersForAccessListRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAllAccessListMembersForAccessListRequest): DeleteAllAccessListMembersForAccessListRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list */ 1:
-                    message.accessList = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeleteAllAccessListMembersForAccessListRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list = 1; */
-        if (message.accessList !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessList);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest
- */
-export const DeleteAllAccessListMembersForAccessListRequest = new DeleteAllAccessListMembersForAccessListRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAllAccessListMembersRequest$Type extends MessageType<DeleteAllAccessListMembersRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAllAccessListMembersRequest", []);
-    }
-    create(value?: PartialMessage<DeleteAllAccessListMembersRequest>): DeleteAllAccessListMembersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAllAccessListMembersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAllAccessListMembersRequest): DeleteAllAccessListMembersRequest {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: DeleteAllAccessListMembersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAllAccessListMembersRequest
- */
-export const DeleteAllAccessListMembersRequest = new DeleteAllAccessListMembersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListReviewsRequest$Type extends MessageType<ListAccessListReviewsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListReviewsRequest", [
-            { no: 1, name: "access_list", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 3, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListReviewsRequest>): ListAccessListReviewsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessList = "";
-        message.pageSize = 0;
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListReviewsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListReviewsRequest): ListAccessListReviewsRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_list */ 1:
-                    message.accessList = reader.string();
-                    break;
-                case /* int32 page_size */ 2:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string next_token */ 3:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListReviewsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_list = 1; */
-        if (message.accessList !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessList);
-        /* int32 page_size = 2; */
-        if (message.pageSize !== 0)
-            writer.tag(2, WireType.Varint).int32(message.pageSize);
-        /* string next_token = 3; */
-        if (message.nextToken !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListReviewsRequest
- */
-export const ListAccessListReviewsRequest = new ListAccessListReviewsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAccessListReviewsResponse$Type extends MessageType<ListAccessListReviewsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAccessListReviewsResponse", [
-            { no: 1, name: "reviews", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Review },
-            { no: 2, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAccessListReviewsResponse>): ListAccessListReviewsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.reviews = [];
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAccessListReviewsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAccessListReviewsResponse): ListAccessListReviewsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.Review reviews */ 1:
-                    message.reviews.push(Review.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_token */ 2:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAccessListReviewsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.Review reviews = 1; */
-        for (let i = 0; i < message.reviews.length; i++)
-            Review.internalBinaryWrite(message.reviews[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_token = 2; */
-        if (message.nextToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAccessListReviewsResponse
- */
-export const ListAccessListReviewsResponse = new ListAccessListReviewsResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAllAccessListReviewsRequest$Type extends MessageType<ListAllAccessListReviewsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAllAccessListReviewsRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAllAccessListReviewsRequest>): ListAllAccessListReviewsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAllAccessListReviewsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAllAccessListReviewsRequest): ListAllAccessListReviewsRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string next_token */ 2:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAllAccessListReviewsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string next_token = 2; */
-        if (message.nextToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAllAccessListReviewsRequest
- */
-export const ListAllAccessListReviewsRequest = new ListAllAccessListReviewsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAllAccessListReviewsResponse$Type extends MessageType<ListAllAccessListReviewsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.ListAllAccessListReviewsResponse", [
-            { no: 1, name: "reviews", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Review },
-            { no: 2, name: "next_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListAllAccessListReviewsResponse>): ListAllAccessListReviewsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.reviews = [];
-        message.nextToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListAllAccessListReviewsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAllAccessListReviewsResponse): ListAllAccessListReviewsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.Review reviews */ 1:
-                    message.reviews.push(Review.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_token */ 2:
-                    message.nextToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAllAccessListReviewsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.Review reviews = 1; */
-        for (let i = 0; i < message.reviews.length; i++)
-            Review.internalBinaryWrite(message.reviews[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_token = 2; */
-        if (message.nextToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.ListAllAccessListReviewsResponse
- */
-export const ListAllAccessListReviewsResponse = new ListAllAccessListReviewsResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CreateAccessListReviewRequest$Type extends MessageType<CreateAccessListReviewRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.CreateAccessListReviewRequest", [
-            { no: 1, name: "review", kind: "message", T: () => Review }
-        ]);
-    }
-    create(value?: PartialMessage<CreateAccessListReviewRequest>): CreateAccessListReviewRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<CreateAccessListReviewRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateAccessListReviewRequest): CreateAccessListReviewRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.accesslist.v1.Review review */ 1:
-                    message.review = Review.internalBinaryRead(reader, reader.uint32(), options, message.review);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CreateAccessListReviewRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.accesslist.v1.Review review = 1; */
-        if (message.review)
-            Review.internalBinaryWrite(message.review, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.CreateAccessListReviewRequest
- */
-export const CreateAccessListReviewRequest = new CreateAccessListReviewRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CreateAccessListReviewResponse$Type extends MessageType<CreateAccessListReviewResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.CreateAccessListReviewResponse", [
-            { no: 1, name: "review_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "next_audit_date", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<CreateAccessListReviewResponse>): CreateAccessListReviewResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.reviewName = "";
-        if (value !== undefined)
-            reflectionMergePartial<CreateAccessListReviewResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateAccessListReviewResponse): CreateAccessListReviewResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string review_name */ 1:
-                    message.reviewName = reader.string();
-                    break;
-                case /* google.protobuf.Timestamp next_audit_date */ 2:
-                    message.nextAuditDate = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.nextAuditDate);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CreateAccessListReviewResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string review_name = 1; */
-        if (message.reviewName !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.reviewName);
-        /* google.protobuf.Timestamp next_audit_date = 2; */
-        if (message.nextAuditDate)
-            Timestamp.internalBinaryWrite(message.nextAuditDate, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.CreateAccessListReviewResponse
- */
-export const CreateAccessListReviewResponse = new CreateAccessListReviewResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteAccessListReviewRequest$Type extends MessageType<DeleteAccessListReviewRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.DeleteAccessListReviewRequest", [
-            { no: 1, name: "review_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "access_list_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeleteAccessListReviewRequest>): DeleteAccessListReviewRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.reviewName = "";
-        message.accessListName = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeleteAccessListReviewRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteAccessListReviewRequest): DeleteAccessListReviewRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string review_name */ 1:
-                    message.reviewName = reader.string();
-                    break;
-                case /* string access_list_name */ 2:
-                    message.accessListName = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeleteAccessListReviewRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string review_name = 1; */
-        if (message.reviewName !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.reviewName);
-        /* string access_list_name = 2; */
-        if (message.accessListName !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.accessListName);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.DeleteAccessListReviewRequest
- */
-export const DeleteAccessListReviewRequest = new DeleteAccessListReviewRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AccessRequestPromoteRequest$Type extends MessageType<AccessRequestPromoteRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.AccessRequestPromoteRequest", [
-            { no: 1, name: "request_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "access_list_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "reason", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AccessRequestPromoteRequest>): AccessRequestPromoteRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.requestId = "";
-        message.accessListName = "";
-        message.reason = "";
-        if (value !== undefined)
-            reflectionMergePartial<AccessRequestPromoteRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AccessRequestPromoteRequest): AccessRequestPromoteRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string request_id */ 1:
-                    message.requestId = reader.string();
-                    break;
-                case /* string access_list_name */ 2:
-                    message.accessListName = reader.string();
-                    break;
-                case /* string reason */ 3:
-                    message.reason = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AccessRequestPromoteRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string request_id = 1; */
-        if (message.requestId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.requestId);
-        /* string access_list_name = 2; */
-        if (message.accessListName !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.accessListName);
-        /* string reason = 3; */
-        if (message.reason !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.reason);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.AccessRequestPromoteRequest
- */
-export const AccessRequestPromoteRequest = new AccessRequestPromoteRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AccessRequestPromoteResponse$Type extends MessageType<AccessRequestPromoteResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.AccessRequestPromoteResponse", [
-            { no: 1, name: "access_request", kind: "message", T: () => AccessRequestV3 }
-        ]);
-    }
-    create(value?: PartialMessage<AccessRequestPromoteResponse>): AccessRequestPromoteResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<AccessRequestPromoteResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AccessRequestPromoteResponse): AccessRequestPromoteResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* types.AccessRequestV3 access_request */ 1:
-                    message.accessRequest = AccessRequestV3.internalBinaryRead(reader, reader.uint32(), options, message.accessRequest);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AccessRequestPromoteResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* types.AccessRequestV3 access_request = 1; */
-        if (message.accessRequest)
-            AccessRequestV3.internalBinaryWrite(message.accessRequest, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.AccessRequestPromoteResponse
- */
-export const AccessRequestPromoteResponse = new AccessRequestPromoteResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetSuggestedAccessListsRequest$Type extends MessageType<GetSuggestedAccessListsRequest> {
-    constructor() {
-        super("teleport.accesslist.v1.GetSuggestedAccessListsRequest", [
-            { no: 1, name: "access_request_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetSuggestedAccessListsRequest>): GetSuggestedAccessListsRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessRequestId = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetSuggestedAccessListsRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSuggestedAccessListsRequest): GetSuggestedAccessListsRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string access_request_id */ 1:
-                    message.accessRequestId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetSuggestedAccessListsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string access_request_id = 1; */
-        if (message.accessRequestId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.accessRequestId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetSuggestedAccessListsRequest
- */
-export const GetSuggestedAccessListsRequest = new GetSuggestedAccessListsRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetSuggestedAccessListsResponse$Type extends MessageType<GetSuggestedAccessListsResponse> {
-    constructor() {
-        super("teleport.accesslist.v1.GetSuggestedAccessListsResponse", [
-            { no: 1, name: "access_lists", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessList }
-        ]);
-    }
-    create(value?: PartialMessage<GetSuggestedAccessListsResponse>): GetSuggestedAccessListsResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.accessLists = [];
-        if (value !== undefined)
-            reflectionMergePartial<GetSuggestedAccessListsResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSuggestedAccessListsResponse): GetSuggestedAccessListsResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.accesslist.v1.AccessList access_lists */ 1:
-                    message.accessLists.push(AccessList.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetSuggestedAccessListsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.accesslist.v1.AccessList access_lists = 1; */
-        for (let i = 0; i < message.accessLists.length; i++)
-            AccessList.internalBinaryWrite(message.accessLists[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.accesslist.v1.GetSuggestedAccessListsResponse
- */
-export const GetSuggestedAccessListsResponse = new GetSuggestedAccessListsResponse$Type();
-/**
- * @generated ServiceType for protobuf service teleport.accesslist.v1.AccessListService
- */
-export const AccessListService = new ServiceType("teleport.accesslist.v1.AccessListService", [
-    { name: "GetAccessLists", options: {}, I: GetAccessListsRequest, O: GetAccessListsResponse },
-    { name: "ListAccessLists", options: {}, I: ListAccessListsRequest, O: ListAccessListsResponse },
-    { name: "GetAccessList", options: {}, I: GetAccessListRequest, O: AccessList },
-    { name: "UpsertAccessList", options: {}, I: UpsertAccessListRequest, O: AccessList },
-    { name: "UpdateAccessList", options: {}, I: UpdateAccessListRequest, O: AccessList },
-    { name: "DeleteAccessList", options: {}, I: DeleteAccessListRequest, O: Empty },
-    { name: "DeleteAllAccessLists", options: {}, I: DeleteAllAccessListsRequest, O: Empty },
-    { name: "GetAccessListsToReview", options: {}, I: GetAccessListsToReviewRequest, O: GetAccessListsToReviewResponse },
-    { name: "CountAccessListMembers", options: {}, I: CountAccessListMembersRequest, O: CountAccessListMembersResponse },
-    { name: "ListAccessListMembers", options: {}, I: ListAccessListMembersRequest, O: ListAccessListMembersResponse },
-    { name: "ListAllAccessListMembers", options: {}, I: ListAllAccessListMembersRequest, O: ListAllAccessListMembersResponse },
-    { name: "GetAccessListMember", options: {}, I: GetAccessListMemberRequest, O: Member },
-    { name: "GetAccessListOwners", options: {}, I: GetAccessListOwnersRequest, O: GetAccessListOwnersResponse },
-    { name: "UpsertAccessListMember", options: {}, I: UpsertAccessListMemberRequest, O: Member },
-    { name: "UpdateAccessListMember", options: {}, I: UpdateAccessListMemberRequest, O: Member },
-    { name: "DeleteAccessListMember", options: {}, I: DeleteAccessListMemberRequest, O: Empty },
-    { name: "DeleteAllAccessListMembersForAccessList", options: {}, I: DeleteAllAccessListMembersForAccessListRequest, O: Empty },
-    { name: "DeleteAllAccessListMembers", options: {}, I: DeleteAllAccessListMembersRequest, O: Empty },
-    { name: "UpsertAccessListWithMembers", options: {}, I: UpsertAccessListWithMembersRequest, O: UpsertAccessListWithMembersResponse },
-    { name: "ListAccessListReviews", options: {}, I: ListAccessListReviewsRequest, O: ListAccessListReviewsResponse },
-    { name: "ListAllAccessListReviews", options: {}, I: ListAllAccessListReviewsRequest, O: ListAllAccessListReviewsResponse },
-    { name: "CreateAccessListReview", options: {}, I: CreateAccessListReviewRequest, O: CreateAccessListReviewResponse },
-    { name: "DeleteAccessListReview", options: {}, I: DeleteAccessListReviewRequest, O: Empty },
-    { name: "AccessRequestPromote", options: {}, I: AccessRequestPromoteRequest, O: AccessRequestPromoteResponse },
-    { name: "GetSuggestedAccessLists", options: {}, I: GetSuggestedAccessListsRequest, O: GetSuggestedAccessListsResponse },
-    { name: "GetInheritedGrants", options: {}, I: GetInheritedGrantsRequest, O: GetInheritedGrantsResponse }
-]);
diff --git a/gen/proto/ts/teleport/devicetrust/v1/assert_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/assert_pb.ts
deleted file mode 100644
index ef45d1cccdcdd..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/assert_pb.ts
+++ /dev/null
@@ -1,363 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/assert.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2024 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { DeviceCollectedData } from "./device_collected_data_pb";
-import { TPMAuthenticateDeviceChallenge } from "./authenticate_challenge_pb";
-import { AuthenticateDeviceChallenge } from "./authenticate_challenge_pb";
-import { TPMAuthenticateDeviceChallengeResponse } from "./authenticate_challenge_pb";
-import { AuthenticateDeviceChallengeResponse } from "./authenticate_challenge_pb";
-/**
- * Request to assert an enrolled device. Assertion authenticates the device,
- * regardless of the user driving the assertion.
- *
- * Assertion messages are meant to be included by other requests and responses,
- * either streams or multi-stage RPCs. The ceremony is resolved by a co-located
- * DeviceTrustService.
- *
- * See the lib/devicetrust/assert (client) and lib/devicetrust/assertserver
- * (server) packages.
- *
- * Assertion ceremony flow:
- * -> AssertDeviceInit (client)
- * <- AssertDeviceChallenge (server)
- * -> AssertDeviceChallengeResponse (client)
- * <- DeviceAsserted (server)
- *
- * A successful ceremony signifies that the device is registered, enrolled and
- * passed the authentication challenge.
- *
- * @generated from protobuf message teleport.devicetrust.v1.AssertDeviceRequest
- */
-export interface AssertDeviceRequest {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "init";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AssertDeviceInit init = 1;
-         */
-        init: AssertDeviceInit;
-    } | {
-        oneofKind: "challengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response = 2;
-         */
-        challengeResponse: AuthenticateDeviceChallengeResponse;
-    } | {
-        oneofKind: "tpmChallengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3;
-         */
-        tpmChallengeResponse: TPMAuthenticateDeviceChallengeResponse;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * Response of the device assertion ceremony.
- * See [AssertDeviceRequest].
- *
- * @generated from protobuf message teleport.devicetrust.v1.AssertDeviceResponse
- */
-export interface AssertDeviceResponse {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "challenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge = 1;
-         */
-        challenge: AuthenticateDeviceChallenge;
-    } | {
-        oneofKind: "tpmChallenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge = 2;
-         */
-        tpmChallenge: TPMAuthenticateDeviceChallenge;
-    } | {
-        oneofKind: "deviceAsserted";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.DeviceAsserted device_asserted = 3;
-         */
-        deviceAsserted: DeviceAsserted;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * AssertDeviceInit initiates the device assertion ceremony.
- * See [AssertDeviceRequest].
- *
- * @generated from protobuf message teleport.devicetrust.v1.AssertDeviceInit
- */
-export interface AssertDeviceInit {
-    /**
-     * ID of the enrolled device credential.
-     *
-     * @generated from protobuf field: string credential_id = 1;
-     */
-    credentialId: string;
-    /**
-     * Device collected data.
-     * Matched against the device registration information and any previously
-     * collected data.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceCollectedData device_data = 2;
-     */
-    deviceData?: DeviceCollectedData;
-}
-/**
- * DeviceAsserted marks a successful device assertion ceremony.
- * See [AssertDeviceRequest].
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceAsserted
- */
-export interface DeviceAsserted {
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class AssertDeviceRequest$Type extends MessageType<AssertDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.AssertDeviceRequest", [
-            { no: 1, name: "init", kind: "message", oneof: "payload", T: () => AssertDeviceInit },
-            { no: 2, name: "challenge_response", kind: "message", oneof: "payload", T: () => AuthenticateDeviceChallengeResponse },
-            { no: 3, name: "tpm_challenge_response", kind: "message", oneof: "payload", T: () => TPMAuthenticateDeviceChallengeResponse }
-        ]);
-    }
-    create(value?: PartialMessage<AssertDeviceRequest>): AssertDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<AssertDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AssertDeviceRequest): AssertDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.AssertDeviceInit init */ 1:
-                    message.payload = {
-                        oneofKind: "init",
-                        init: AssertDeviceInit.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).init)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response */ 2:
-                    message.payload = {
-                        oneofKind: "challengeResponse",
-                        challengeResponse: AuthenticateDeviceChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).challengeResponse)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response */ 3:
-                    message.payload = {
-                        oneofKind: "tpmChallengeResponse",
-                        tpmChallengeResponse: TPMAuthenticateDeviceChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallengeResponse)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AssertDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.AssertDeviceInit init = 1; */
-        if (message.payload.oneofKind === "init")
-            AssertDeviceInit.internalBinaryWrite(message.payload.init, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response = 2; */
-        if (message.payload.oneofKind === "challengeResponse")
-            AuthenticateDeviceChallengeResponse.internalBinaryWrite(message.payload.challengeResponse, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3; */
-        if (message.payload.oneofKind === "tpmChallengeResponse")
-            TPMAuthenticateDeviceChallengeResponse.internalBinaryWrite(message.payload.tpmChallengeResponse, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AssertDeviceRequest
- */
-export const AssertDeviceRequest = new AssertDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AssertDeviceResponse$Type extends MessageType<AssertDeviceResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.AssertDeviceResponse", [
-            { no: 1, name: "challenge", kind: "message", oneof: "payload", T: () => AuthenticateDeviceChallenge },
-            { no: 2, name: "tpm_challenge", kind: "message", oneof: "payload", T: () => TPMAuthenticateDeviceChallenge },
-            { no: 3, name: "device_asserted", kind: "message", oneof: "payload", T: () => DeviceAsserted }
-        ]);
-    }
-    create(value?: PartialMessage<AssertDeviceResponse>): AssertDeviceResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<AssertDeviceResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AssertDeviceResponse): AssertDeviceResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge */ 1:
-                    message.payload = {
-                        oneofKind: "challenge",
-                        challenge: AuthenticateDeviceChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).challenge)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge */ 2:
-                    message.payload = {
-                        oneofKind: "tpmChallenge",
-                        tpmChallenge: TPMAuthenticateDeviceChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallenge)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.DeviceAsserted device_asserted */ 3:
-                    message.payload = {
-                        oneofKind: "deviceAsserted",
-                        deviceAsserted: DeviceAsserted.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).deviceAsserted)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AssertDeviceResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge = 1; */
-        if (message.payload.oneofKind === "challenge")
-            AuthenticateDeviceChallenge.internalBinaryWrite(message.payload.challenge, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge = 2; */
-        if (message.payload.oneofKind === "tpmChallenge")
-            TPMAuthenticateDeviceChallenge.internalBinaryWrite(message.payload.tpmChallenge, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceAsserted device_asserted = 3; */
-        if (message.payload.oneofKind === "deviceAsserted")
-            DeviceAsserted.internalBinaryWrite(message.payload.deviceAsserted, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AssertDeviceResponse
- */
-export const AssertDeviceResponse = new AssertDeviceResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AssertDeviceInit$Type extends MessageType<AssertDeviceInit> {
-    constructor() {
-        super("teleport.devicetrust.v1.AssertDeviceInit", [
-            { no: 1, name: "credential_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "device_data", kind: "message", T: () => DeviceCollectedData }
-        ]);
-    }
-    create(value?: PartialMessage<AssertDeviceInit>): AssertDeviceInit {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.credentialId = "";
-        if (value !== undefined)
-            reflectionMergePartial<AssertDeviceInit>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AssertDeviceInit): AssertDeviceInit {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string credential_id */ 1:
-                    message.credentialId = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceCollectedData device_data */ 2:
-                    message.deviceData = DeviceCollectedData.internalBinaryRead(reader, reader.uint32(), options, message.deviceData);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AssertDeviceInit, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string credential_id = 1; */
-        if (message.credentialId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.credentialId);
-        /* teleport.devicetrust.v1.DeviceCollectedData device_data = 2; */
-        if (message.deviceData)
-            DeviceCollectedData.internalBinaryWrite(message.deviceData, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AssertDeviceInit
- */
-export const AssertDeviceInit = new AssertDeviceInit$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceAsserted$Type extends MessageType<DeviceAsserted> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceAsserted", []);
-    }
-    create(value?: PartialMessage<DeviceAsserted>): DeviceAsserted {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<DeviceAsserted>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceAsserted): DeviceAsserted {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: DeviceAsserted, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceAsserted
- */
-export const DeviceAsserted = new DeviceAsserted$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/authenticate_challenge_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/authenticate_challenge_pb.ts
deleted file mode 100644
index dae2e42a5f941..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/authenticate_challenge_pb.ts
+++ /dev/null
@@ -1,306 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/authenticate_challenge.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { TPMPlatformParameters } from "./tpm_pb";
-/**
- * AuthenticateDeviceChallenge carries the authentication challenge.
- *
- * @generated from protobuf message teleport.devicetrust.v1.AuthenticateDeviceChallenge
- */
-export interface AuthenticateDeviceChallenge {
-    /**
-     * Randomly-generated, opaque challenge to be signed using the device key.
-     *
-     * @generated from protobuf field: bytes challenge = 1;
-     */
-    challenge: Uint8Array;
-}
-/**
- * AuthenticateDeviceChallengeResponse carries the authentication challenge
- * response.
- *
- * @generated from protobuf message teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
- */
-export interface AuthenticateDeviceChallengeResponse {
-    /**
-     * Signature over the challenge, using the device key.
-     *
-     * @generated from protobuf field: bytes signature = 1;
-     */
-    signature: Uint8Array;
-    /**
-     * Signature over the challenge, using the SSH key. This is required when the
-     * SSH and TLS public keys do not match, to prove ownership of the private key
-     * associated with the SSH certificate being augmented.
-     *
-     * @generated from protobuf field: bytes ssh_signature = 2;
-     */
-    sshSignature: Uint8Array;
-}
-/**
- * TPMAuthenticateDeviceChallenge carries the authentication challenge
- * specific to TPMs.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
- */
-export interface TPMAuthenticateDeviceChallenge {
-    /**
-     * Randomly-generated nonce to be used during platform attestation by the
-     * TPM.
-     *
-     * @generated from protobuf field: bytes attestation_nonce = 1;
-     */
-    attestationNonce: Uint8Array;
-}
-/**
- * TPMAuthenticateDeviceChallengeResponse carries the authentication challenge
- * response specific to TPMs.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
- */
-export interface TPMAuthenticateDeviceChallengeResponse {
-    /**
-     * The result of the client's platform attestation with the nonce provided
-     * in `TPMAuthenticateDeviceChallenge`.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 1;
-     */
-    platformParameters?: TPMPlatformParameters;
-    /**
-     * Signature over the attestation_nonce, using the SSH key. This is required
-     * when the SSH and TLS public keys do not match, to prove ownership of the
-     * private key associated with the SSH certificate being augmented.
-     *
-     * @generated from protobuf field: bytes ssh_signature = 2;
-     */
-    sshSignature: Uint8Array;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class AuthenticateDeviceChallenge$Type extends MessageType<AuthenticateDeviceChallenge> {
-    constructor() {
-        super("teleport.devicetrust.v1.AuthenticateDeviceChallenge", [
-            { no: 1, name: "challenge", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AuthenticateDeviceChallenge>): AuthenticateDeviceChallenge {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.challenge = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<AuthenticateDeviceChallenge>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AuthenticateDeviceChallenge): AuthenticateDeviceChallenge {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes challenge */ 1:
-                    message.challenge = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AuthenticateDeviceChallenge, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes challenge = 1; */
-        if (message.challenge.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.challenge);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AuthenticateDeviceChallenge
- */
-export const AuthenticateDeviceChallenge = new AuthenticateDeviceChallenge$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AuthenticateDeviceChallengeResponse$Type extends MessageType<AuthenticateDeviceChallengeResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse", [
-            { no: 1, name: "signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "ssh_signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AuthenticateDeviceChallengeResponse>): AuthenticateDeviceChallengeResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.signature = new Uint8Array(0);
-        message.sshSignature = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<AuthenticateDeviceChallengeResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AuthenticateDeviceChallengeResponse): AuthenticateDeviceChallengeResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes signature */ 1:
-                    message.signature = reader.bytes();
-                    break;
-                case /* bytes ssh_signature */ 2:
-                    message.sshSignature = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AuthenticateDeviceChallengeResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes signature = 1; */
-        if (message.signature.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.signature);
-        /* bytes ssh_signature = 2; */
-        if (message.sshSignature.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.sshSignature);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
- */
-export const AuthenticateDeviceChallengeResponse = new AuthenticateDeviceChallengeResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMAuthenticateDeviceChallenge$Type extends MessageType<TPMAuthenticateDeviceChallenge> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge", [
-            { no: 1, name: "attestation_nonce", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMAuthenticateDeviceChallenge>): TPMAuthenticateDeviceChallenge {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.attestationNonce = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMAuthenticateDeviceChallenge>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMAuthenticateDeviceChallenge): TPMAuthenticateDeviceChallenge {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes attestation_nonce */ 1:
-                    message.attestationNonce = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMAuthenticateDeviceChallenge, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes attestation_nonce = 1; */
-        if (message.attestationNonce.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.attestationNonce);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
- */
-export const TPMAuthenticateDeviceChallenge = new TPMAuthenticateDeviceChallenge$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMAuthenticateDeviceChallengeResponse$Type extends MessageType<TPMAuthenticateDeviceChallengeResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse", [
-            { no: 1, name: "platform_parameters", kind: "message", T: () => TPMPlatformParameters },
-            { no: 2, name: "ssh_signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMAuthenticateDeviceChallengeResponse>): TPMAuthenticateDeviceChallengeResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.sshSignature = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMAuthenticateDeviceChallengeResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMAuthenticateDeviceChallengeResponse): TPMAuthenticateDeviceChallengeResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters */ 1:
-                    message.platformParameters = TPMPlatformParameters.internalBinaryRead(reader, reader.uint32(), options, message.platformParameters);
-                    break;
-                case /* bytes ssh_signature */ 2:
-                    message.sshSignature = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMAuthenticateDeviceChallengeResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 1; */
-        if (message.platformParameters)
-            TPMPlatformParameters.internalBinaryWrite(message.platformParameters, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bytes ssh_signature = 2; */
-        if (message.sshSignature.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.sshSignature);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
- */
-export const TPMAuthenticateDeviceChallengeResponse = new TPMAuthenticateDeviceChallengeResponse$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_collected_data_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_collected_data_pb.ts
deleted file mode 100644
index 0a52c70af2d2b..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/device_collected_data_pb.ts
+++ /dev/null
@@ -1,320 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/device_collected_data.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { TPMPlatformAttestation } from "./tpm_pb";
-import { OSType } from "./os_type_pb";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-/**
- * DeviceCollectedData contains information gathered from the device during
- * various ceremonies.
- * Gathered information must match, within reason, the original registration
- * data and previous instances of collected data.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceCollectedData
- */
-export interface DeviceCollectedData {
-    /**
-     * Time of data collection, set by the client.
-     * Required.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp collect_time = 1;
-     */
-    collectTime?: Timestamp;
-    /**
-     * Time of data collection, as received by the server.
-     * System managed.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp record_time = 2;
-     */
-    recordTime?: Timestamp;
-    /**
-     * Device operating system.
-     * Required.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.OSType os_type = 3;
-     */
-    osType: OSType;
-    /**
-     * Device serial number used to match the device with the inventory.
-     * This field is one of the three following
-     * values in this precedence:
-     * - reported_asset_tag
-     * - system_serial_number
-     * - base_board_serial_number
-     * Required.
-     *
-     * @generated from protobuf field: string serial_number = 4;
-     */
-    serialNumber: string;
-    /**
-     * Non-descriptive model identifier.
-     * Example: "MacBookPro9,2".
-     *
-     * @generated from protobuf field: string model_identifier = 5;
-     */
-    modelIdentifier: string;
-    /**
-     * OS version number, without the leading 'v'.
-     * Example: "13.2.1".
-     *
-     * @generated from protobuf field: string os_version = 6;
-     */
-    osVersion: string;
-    /**
-     * OS build identifier. Augments the os_version.
-     * May match either the DeviceProfile os_build or os_build_supplemental.
-     * Example: "22D68" or "22F770820d".
-     *
-     * @generated from protobuf field: string os_build = 7;
-     */
-    osBuild: string;
-    /**
-     * OS username (distinct from the Teleport user).
-     *
-     * @generated from protobuf field: string os_username = 8;
-     */
-    osUsername: string;
-    /**
-     * Jamf binary version, without the leading 'v'.
-     * Example: "9.27" or "10.44.1-t1677509507".
-     *
-     * @generated from protobuf field: string jamf_binary_version = 9;
-     */
-    jamfBinaryVersion: string;
-    /**
-     * Unmodified output of `/usr/bin/profiles status -type enrollment`.
-     * Used to verify the presence of an enrollment profile.
-     *
-     * @generated from protobuf field: string macos_enrollment_profiles = 10;
-     */
-    macosEnrollmentProfiles: string;
-    /**
-     * The asset tag of the device as reported by the BIOS DMI Type 3. Tools
-     * used by customers to manage their fleet may set this value.
-     *
-     * @generated from protobuf field: string reported_asset_tag = 11;
-     */
-    reportedAssetTag: string;
-    /**
-     * The serial number of the "system" as reported by the BIOS DMI Type 1.
-     * This field can be empty if no value has been configured.
-     *
-     * @generated from protobuf field: string system_serial_number = 12;
-     */
-    systemSerialNumber: string;
-    /**
-     * The serial number of the "base board" as reported by BIOS DMI Type 2.
-     * This field can be empty if no value has been configured.
-     *
-     * @generated from protobuf field: string base_board_serial_number = 13;
-     */
-    baseBoardSerialNumber: string;
-    /**
-     * If during the collection of this device data, the device performed a TPM
-     * platform attestation (e.g during enrollment or authentication), then this
-     * field holds the record of this attestation. This allows the state of the
-     * device to be compared to historical state, and allows for the platform
-     * attestations to be revalidated at a later date.
-     *
-     * This field is not explicitly sent up by the client, and any DCD sent by a
-     * client including this field should be rejected. The server should inject
-     * this field once verifying that the submitted platform attestation during
-     * the enrollment or authentication.
-     *
-     * System managed.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMPlatformAttestation tpm_platform_attestation = 14;
-     */
-    tpmPlatformAttestation?: TPMPlatformAttestation;
-    /**
-     * OS identifier.
-     * Mainly used to differentiate Linux distros, as there is be no variation
-     * for systems like macOS or Windows.
-     * Example: "ubuntu", "centos", "fedora", "rhel".
-     *
-     * @generated from protobuf field: string os_id = 15;
-     */
-    osId: string;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceCollectedData$Type extends MessageType<DeviceCollectedData> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceCollectedData", [
-            { no: 1, name: "collect_time", kind: "message", T: () => Timestamp },
-            { no: 2, name: "record_time", kind: "message", T: () => Timestamp },
-            { no: 3, name: "os_type", kind: "enum", T: () => ["teleport.devicetrust.v1.OSType", OSType] },
-            { no: 4, name: "serial_number", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "model_identifier", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "os_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "os_build", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "os_username", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "jamf_binary_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 10, name: "macos_enrollment_profiles", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 11, name: "reported_asset_tag", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 12, name: "system_serial_number", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 13, name: "base_board_serial_number", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 14, name: "tpm_platform_attestation", kind: "message", T: () => TPMPlatformAttestation },
-            { no: 15, name: "os_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceCollectedData>): DeviceCollectedData {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.osType = 0;
-        message.serialNumber = "";
-        message.modelIdentifier = "";
-        message.osVersion = "";
-        message.osBuild = "";
-        message.osUsername = "";
-        message.jamfBinaryVersion = "";
-        message.macosEnrollmentProfiles = "";
-        message.reportedAssetTag = "";
-        message.systemSerialNumber = "";
-        message.baseBoardSerialNumber = "";
-        message.osId = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeviceCollectedData>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceCollectedData): DeviceCollectedData {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* google.protobuf.Timestamp collect_time */ 1:
-                    message.collectTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.collectTime);
-                    break;
-                case /* google.protobuf.Timestamp record_time */ 2:
-                    message.recordTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.recordTime);
-                    break;
-                case /* teleport.devicetrust.v1.OSType os_type */ 3:
-                    message.osType = reader.int32();
-                    break;
-                case /* string serial_number */ 4:
-                    message.serialNumber = reader.string();
-                    break;
-                case /* string model_identifier */ 5:
-                    message.modelIdentifier = reader.string();
-                    break;
-                case /* string os_version */ 6:
-                    message.osVersion = reader.string();
-                    break;
-                case /* string os_build */ 7:
-                    message.osBuild = reader.string();
-                    break;
-                case /* string os_username */ 8:
-                    message.osUsername = reader.string();
-                    break;
-                case /* string jamf_binary_version */ 9:
-                    message.jamfBinaryVersion = reader.string();
-                    break;
-                case /* string macos_enrollment_profiles */ 10:
-                    message.macosEnrollmentProfiles = reader.string();
-                    break;
-                case /* string reported_asset_tag */ 11:
-                    message.reportedAssetTag = reader.string();
-                    break;
-                case /* string system_serial_number */ 12:
-                    message.systemSerialNumber = reader.string();
-                    break;
-                case /* string base_board_serial_number */ 13:
-                    message.baseBoardSerialNumber = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.TPMPlatformAttestation tpm_platform_attestation */ 14:
-                    message.tpmPlatformAttestation = TPMPlatformAttestation.internalBinaryRead(reader, reader.uint32(), options, message.tpmPlatformAttestation);
-                    break;
-                case /* string os_id */ 15:
-                    message.osId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceCollectedData, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* google.protobuf.Timestamp collect_time = 1; */
-        if (message.collectTime)
-            Timestamp.internalBinaryWrite(message.collectTime, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp record_time = 2; */
-        if (message.recordTime)
-            Timestamp.internalBinaryWrite(message.recordTime, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.OSType os_type = 3; */
-        if (message.osType !== 0)
-            writer.tag(3, WireType.Varint).int32(message.osType);
-        /* string serial_number = 4; */
-        if (message.serialNumber !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.serialNumber);
-        /* string model_identifier = 5; */
-        if (message.modelIdentifier !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.modelIdentifier);
-        /* string os_version = 6; */
-        if (message.osVersion !== "")
-            writer.tag(6, WireType.LengthDelimited).string(message.osVersion);
-        /* string os_build = 7; */
-        if (message.osBuild !== "")
-            writer.tag(7, WireType.LengthDelimited).string(message.osBuild);
-        /* string os_username = 8; */
-        if (message.osUsername !== "")
-            writer.tag(8, WireType.LengthDelimited).string(message.osUsername);
-        /* string jamf_binary_version = 9; */
-        if (message.jamfBinaryVersion !== "")
-            writer.tag(9, WireType.LengthDelimited).string(message.jamfBinaryVersion);
-        /* string macos_enrollment_profiles = 10; */
-        if (message.macosEnrollmentProfiles !== "")
-            writer.tag(10, WireType.LengthDelimited).string(message.macosEnrollmentProfiles);
-        /* string reported_asset_tag = 11; */
-        if (message.reportedAssetTag !== "")
-            writer.tag(11, WireType.LengthDelimited).string(message.reportedAssetTag);
-        /* string system_serial_number = 12; */
-        if (message.systemSerialNumber !== "")
-            writer.tag(12, WireType.LengthDelimited).string(message.systemSerialNumber);
-        /* string base_board_serial_number = 13; */
-        if (message.baseBoardSerialNumber !== "")
-            writer.tag(13, WireType.LengthDelimited).string(message.baseBoardSerialNumber);
-        /* teleport.devicetrust.v1.TPMPlatformAttestation tpm_platform_attestation = 14; */
-        if (message.tpmPlatformAttestation)
-            TPMPlatformAttestation.internalBinaryWrite(message.tpmPlatformAttestation, writer.tag(14, WireType.LengthDelimited).fork(), options).join();
-        /* string os_id = 15; */
-        if (message.osId !== "")
-            writer.tag(15, WireType.LengthDelimited).string(message.osId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceCollectedData
- */
-export const DeviceCollectedData = new DeviceCollectedData$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_confirmation_token_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_confirmation_token_pb.ts
index 2cb67b9611505..7cf8e74d22717 100644
--- a/gen/proto/ts/teleport/devicetrust/v1/device_confirmation_token_pb.ts
+++ b/gen/proto/ts/teleport/devicetrust/v1/device_confirmation_token_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/devicetrust/v1/device_confirmation_token.proto" (package "teleport.devicetrust.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_enroll_token_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_enroll_token_pb.ts
deleted file mode 100644
index f14376f92fdaf..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/device_enroll_token_pb.ts
+++ /dev/null
@@ -1,105 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/device_enroll_token.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-/**
- * DeviceEnrollToken encapsulates the permission, granted by a device
- * administrator to an user, to enroll a device.
- * An enrolled device allows its user to perform device-aware actions.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceEnrollToken
- */
-export interface DeviceEnrollToken {
-    /**
-     * Opaque enrollement token required by the EnrollDevice RPC.
-     *
-     * @generated from protobuf field: string token = 1;
-     */
-    token: string;
-    /**
-     * Expiration time for the token.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp expire_time = 2;
-     */
-    expireTime?: Timestamp;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceEnrollToken$Type extends MessageType<DeviceEnrollToken> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceEnrollToken", [
-            { no: 1, name: "token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "expire_time", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceEnrollToken>): DeviceEnrollToken {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.token = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeviceEnrollToken>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceEnrollToken): DeviceEnrollToken {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string token */ 1:
-                    message.token = reader.string();
-                    break;
-                case /* google.protobuf.Timestamp expire_time */ 2:
-                    message.expireTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expireTime);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceEnrollToken, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string token = 1; */
-        if (message.token !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.token);
-        /* google.protobuf.Timestamp expire_time = 2; */
-        if (message.expireTime)
-            Timestamp.internalBinaryWrite(message.expireTime, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceEnrollToken
- */
-export const DeviceEnrollToken = new DeviceEnrollToken$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_pb.ts
deleted file mode 100644
index 65420865aecb1..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/device_pb.ts
+++ /dev/null
@@ -1,461 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/device.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { DeviceProfile } from "./device_profile_pb";
-import { DeviceSource } from "./device_source_pb";
-import { DeviceCollectedData } from "./device_collected_data_pb";
-import { DeviceEnrollToken } from "./device_enroll_token_pb";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-import { OSType } from "./os_type_pb";
-/**
- * Device represents a registered device.
- * Registered devices may be enrolled. Enrolled devices are allowed to perform
- * device-aware actions.
- *
- * @generated from protobuf message teleport.devicetrust.v1.Device
- */
-export interface Device {
-    /**
-     * API version of the Device definition, present for compatibility with
-     * types.DeviceV1.
-     * Always "v1".
-     *
-     * @generated from protobuf field: string api_version = 1;
-     */
-    apiVersion: string;
-    /**
-     * Unique device identifier.
-     * System managed.
-     *
-     * @generated from protobuf field: string id = 2;
-     */
-    id: string;
-    /**
-     * Device operating system.
-     * Required.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.OSType os_type = 3;
-     */
-    osType: OSType;
-    /**
-     * Device inventory identifier.
-     * Takes different meanings depending on the device and operating system.
-     * For macOS devices it is the device serial number.
-     * Required.
-     *
-     * @generated from protobuf field: string asset_tag = 4;
-     */
-    assetTag: string;
-    /**
-     * Create time.
-     * System managed.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp create_time = 5;
-     */
-    createTime?: Timestamp;
-    /**
-     * Last update time.
-     * System managed.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp update_time = 6;
-     */
-    updateTime?: Timestamp;
-    /**
-     * Enrollment token for the device.
-     * Only present in situations where device creation and enrollment are rolled
-     * into a single operation.
-     * Transient.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceEnrollToken enroll_token = 7;
-     */
-    enrollToken?: DeviceEnrollToken;
-    /**
-     * Enrollment status of the device.
-     * May be changed to DEVICE_ENROLL_STATUS_NOT_ENROLLED at any time to
-     * forcefully unenroll a device (server-side only).
-     * System managed.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceEnrollStatus enroll_status = 8;
-     */
-    enrollStatus: DeviceEnrollStatus;
-    /**
-     * Currently enrolled device credential.
-     * Manually unenrolling a device clears the credential.
-     * System managed.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceCredential credential = 9;
-     */
-    credential?: DeviceCredential;
-    /**
-     * Device data collected during enrollment and device authentication.
-     * Enrollment data is always present, while authentication data is capped at N
-     * most recent events.
-     * Only present in certain read modes.
-     * Transient.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.DeviceCollectedData collected_data = 10;
-     */
-    collectedData: DeviceCollectedData[];
-    /**
-     * Source of the device.
-     * Devices managed directly via Teleport (`tctl`, Web UI, etc) have no
-     * assigned source.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceSource source = 11;
-     */
-    source?: DeviceSource;
-    /**
-     * Device information acquired from an external source.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceProfile profile = 12;
-     */
-    profile?: DeviceProfile;
-    /**
-     * Device owner.
-     * Usually the owner is the same user who performed the enrollment ceremony.
-     * May be empty for legacy devices (Teleport v13.2 and older).
-     * Manually unenrolling a device clears the owner.
-     * System-managed.
-     *
-     * @generated from protobuf field: string owner = 13;
-     */
-    owner: string;
-}
-/**
- * DeviceCredential represents the current enrolled public key of a device.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceCredential
- */
-export interface DeviceCredential {
-    /**
-     * Unique identifier of the credential, defined client-side.
-     *
-     * @generated from protobuf field: string id = 1;
-     */
-    id: string;
-    /**
-     * Device public key marshaled as a PKIX, ASN.1 DER. Used only on MacOS.
-     *
-     * @generated from protobuf field: bytes public_key_der = 2;
-     */
-    publicKeyDer: Uint8Array;
-    /**
-     * The degree to which the device credential is attested.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceAttestationType device_attestation_type = 3;
-     */
-    deviceAttestationType: DeviceAttestationType;
-    /**
-     * For TPM devices, the serial number of the TPM endorsement certificate.
-     *
-     * @generated from protobuf field: string tpm_ekcert_serial = 4;
-     */
-    tpmEkcertSerial: string;
-    /**
-     * For TPM devices, the encoded TPMT_PUBLIC structure containing the
-     * attestation public key and signing parameters.
-     *
-     * @generated from protobuf field: bytes tpm_ak_public = 5;
-     */
-    tpmAkPublic: Uint8Array;
-}
-/**
- * AttestationType indicates the degree to which the device credential has
- * been attested.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.DeviceAttestationType
- */
-export enum DeviceAttestationType {
-    /**
-     * Bare public key which has only verified with proof of ownership.
-     * Used on macOS.
-     *
-     * @generated from protobuf enum value: DEVICE_ATTESTATION_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Credential was verified through a TPM EK->AK chain on enrollment.
-     *
-     * @generated from protobuf enum value: DEVICE_ATTESTATION_TYPE_TPM_EKPUB = 1;
-     */
-    TPM_EKPUB = 1,
-    /**
-     * Credential was verified through a TPM EKCert->AK chain on enrollment,
-     * but no allow-listed CAs were configured to validate this EKCert against.
-     *
-     * @generated from protobuf enum value: DEVICE_ATTESTATION_TYPE_TPM_EKCERT = 2;
-     */
-    TPM_EKCERT = 2,
-    /**
-     * Credential was verified through a TPM EKCert->AK chain on enrollment, and
-     * the EKCert was signed by a configured allow-listed CA.
-     *
-     * @generated from protobuf enum value: DEVICE_ATTESTATION_TYPE_TPM_EKCERT_TRUSTED = 3;
-     */
-    TPM_EKCERT_TRUSTED = 3
-}
-/**
- * DeviceEnrollStatus represents the enrollment status of a device.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.DeviceEnrollStatus
- */
-export enum DeviceEnrollStatus {
-    /**
-     * @generated from protobuf enum value: DEVICE_ENROLL_STATUS_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Device is registered but not enrolled.
-     *
-     * @generated from protobuf enum value: DEVICE_ENROLL_STATUS_NOT_ENROLLED = 1;
-     */
-    NOT_ENROLLED = 1,
-    /**
-     * Device is registered and enrolled.
-     *
-     * @generated from protobuf enum value: DEVICE_ENROLL_STATUS_ENROLLED = 2;
-     */
-    ENROLLED = 2
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class Device$Type extends MessageType<Device> {
-    constructor() {
-        super("teleport.devicetrust.v1.Device", [
-            { no: 1, name: "api_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "os_type", kind: "enum", T: () => ["teleport.devicetrust.v1.OSType", OSType] },
-            { no: 4, name: "asset_tag", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "create_time", kind: "message", T: () => Timestamp },
-            { no: 6, name: "update_time", kind: "message", T: () => Timestamp },
-            { no: 7, name: "enroll_token", kind: "message", T: () => DeviceEnrollToken },
-            { no: 8, name: "enroll_status", kind: "enum", T: () => ["teleport.devicetrust.v1.DeviceEnrollStatus", DeviceEnrollStatus, "DEVICE_ENROLL_STATUS_"] },
-            { no: 9, name: "credential", kind: "message", T: () => DeviceCredential },
-            { no: 10, name: "collected_data", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => DeviceCollectedData },
-            { no: 11, name: "source", kind: "message", T: () => DeviceSource },
-            { no: 12, name: "profile", kind: "message", T: () => DeviceProfile },
-            { no: 13, name: "owner", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<Device>): Device {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.apiVersion = "";
-        message.id = "";
-        message.osType = 0;
-        message.assetTag = "";
-        message.enrollStatus = 0;
-        message.collectedData = [];
-        message.owner = "";
-        if (value !== undefined)
-            reflectionMergePartial<Device>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Device): Device {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string api_version */ 1:
-                    message.apiVersion = reader.string();
-                    break;
-                case /* string id */ 2:
-                    message.id = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.OSType os_type */ 3:
-                    message.osType = reader.int32();
-                    break;
-                case /* string asset_tag */ 4:
-                    message.assetTag = reader.string();
-                    break;
-                case /* google.protobuf.Timestamp create_time */ 5:
-                    message.createTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createTime);
-                    break;
-                case /* google.protobuf.Timestamp update_time */ 6:
-                    message.updateTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updateTime);
-                    break;
-                case /* teleport.devicetrust.v1.DeviceEnrollToken enroll_token */ 7:
-                    message.enrollToken = DeviceEnrollToken.internalBinaryRead(reader, reader.uint32(), options, message.enrollToken);
-                    break;
-                case /* teleport.devicetrust.v1.DeviceEnrollStatus enroll_status */ 8:
-                    message.enrollStatus = reader.int32();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceCredential credential */ 9:
-                    message.credential = DeviceCredential.internalBinaryRead(reader, reader.uint32(), options, message.credential);
-                    break;
-                case /* repeated teleport.devicetrust.v1.DeviceCollectedData collected_data */ 10:
-                    message.collectedData.push(DeviceCollectedData.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* teleport.devicetrust.v1.DeviceSource source */ 11:
-                    message.source = DeviceSource.internalBinaryRead(reader, reader.uint32(), options, message.source);
-                    break;
-                case /* teleport.devicetrust.v1.DeviceProfile profile */ 12:
-                    message.profile = DeviceProfile.internalBinaryRead(reader, reader.uint32(), options, message.profile);
-                    break;
-                case /* string owner */ 13:
-                    message.owner = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: Device, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string api_version = 1; */
-        if (message.apiVersion !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.apiVersion);
-        /* string id = 2; */
-        if (message.id !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.id);
-        /* teleport.devicetrust.v1.OSType os_type = 3; */
-        if (message.osType !== 0)
-            writer.tag(3, WireType.Varint).int32(message.osType);
-        /* string asset_tag = 4; */
-        if (message.assetTag !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.assetTag);
-        /* google.protobuf.Timestamp create_time = 5; */
-        if (message.createTime)
-            Timestamp.internalBinaryWrite(message.createTime, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp update_time = 6; */
-        if (message.updateTime)
-            Timestamp.internalBinaryWrite(message.updateTime, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceEnrollToken enroll_token = 7; */
-        if (message.enrollToken)
-            DeviceEnrollToken.internalBinaryWrite(message.enrollToken, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceEnrollStatus enroll_status = 8; */
-        if (message.enrollStatus !== 0)
-            writer.tag(8, WireType.Varint).int32(message.enrollStatus);
-        /* teleport.devicetrust.v1.DeviceCredential credential = 9; */
-        if (message.credential)
-            DeviceCredential.internalBinaryWrite(message.credential, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
-        /* repeated teleport.devicetrust.v1.DeviceCollectedData collected_data = 10; */
-        for (let i = 0; i < message.collectedData.length; i++)
-            DeviceCollectedData.internalBinaryWrite(message.collectedData[i], writer.tag(10, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceSource source = 11; */
-        if (message.source)
-            DeviceSource.internalBinaryWrite(message.source, writer.tag(11, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceProfile profile = 12; */
-        if (message.profile)
-            DeviceProfile.internalBinaryWrite(message.profile, writer.tag(12, WireType.LengthDelimited).fork(), options).join();
-        /* string owner = 13; */
-        if (message.owner !== "")
-            writer.tag(13, WireType.LengthDelimited).string(message.owner);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.Device
- */
-export const Device = new Device$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceCredential$Type extends MessageType<DeviceCredential> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceCredential", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "public_key_der", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "device_attestation_type", kind: "enum", T: () => ["teleport.devicetrust.v1.DeviceAttestationType", DeviceAttestationType, "DEVICE_ATTESTATION_TYPE_"] },
-            { no: 4, name: "tpm_ekcert_serial", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "tpm_ak_public", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceCredential>): DeviceCredential {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.publicKeyDer = new Uint8Array(0);
-        message.deviceAttestationType = 0;
-        message.tpmEkcertSerial = "";
-        message.tpmAkPublic = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<DeviceCredential>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceCredential): DeviceCredential {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* bytes public_key_der */ 2:
-                    message.publicKeyDer = reader.bytes();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceAttestationType device_attestation_type */ 3:
-                    message.deviceAttestationType = reader.int32();
-                    break;
-                case /* string tpm_ekcert_serial */ 4:
-                    message.tpmEkcertSerial = reader.string();
-                    break;
-                case /* bytes tpm_ak_public */ 5:
-                    message.tpmAkPublic = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceCredential, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* bytes public_key_der = 2; */
-        if (message.publicKeyDer.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.publicKeyDer);
-        /* teleport.devicetrust.v1.DeviceAttestationType device_attestation_type = 3; */
-        if (message.deviceAttestationType !== 0)
-            writer.tag(3, WireType.Varint).int32(message.deviceAttestationType);
-        /* string tpm_ekcert_serial = 4; */
-        if (message.tpmEkcertSerial !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.tpmEkcertSerial);
-        /* bytes tpm_ak_public = 5; */
-        if (message.tpmAkPublic.length)
-            writer.tag(5, WireType.LengthDelimited).bytes(message.tpmAkPublic);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceCredential
- */
-export const DeviceCredential = new DeviceCredential$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_profile_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_profile_pb.ts
deleted file mode 100644
index 2b5674e1239f6..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/device_profile_pb.ts
+++ /dev/null
@@ -1,214 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/device_profile.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-/**
- * Device profile information acquired from an external source.
- * If present, it's used to further validate collected data.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceProfile
- */
-export interface DeviceProfile {
-    /**
-     * Latest profile update time.
-     * System managed.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp update_time = 1;
-     */
-    updateTime?: Timestamp;
-    /**
-     * Non-descriptive model identifier.
-     * Example: "MacBookPro9,2".
-     *
-     * @generated from protobuf field: string model_identifier = 2;
-     */
-    modelIdentifier: string;
-    /**
-     * OS version number, without the leading 'v'.
-     * See the Device's os_type for the general OS category.
-     * Example: "13.2.1".
-     *
-     * @generated from protobuf field: string os_version = 3;
-     */
-    osVersion: string;
-    /**
-     * OS build identifier. Augments the os_version.
-     * Example: "22D68".
-     *
-     * @generated from protobuf field: string os_build = 4;
-     */
-    osBuild: string;
-    /**
-     * Known OS users (distinct from the Teleport user).
-     *
-     * @generated from protobuf field: repeated string os_usernames = 5;
-     */
-    osUsernames: string[];
-    /**
-     * Jamf binary version, without the leading 'v'.
-     * Example: "9.27" or "10.44.1-t1677509507".
-     *
-     * @generated from protobuf field: string jamf_binary_version = 6;
-     */
-    jamfBinaryVersion: string;
-    /**
-     * External device identifier, for example the Jamf or Intune ID.
-     *
-     * @generated from protobuf field: string external_id = 7;
-     */
-    externalId: string;
-    /**
-     * OS build supplemental number.
-     * May match `sw_vers` BuildVersion more closely in certain situations, like
-     * macOS rapid security response builds.
-     * Example: "22F770820d".
-     *
-     * @generated from protobuf field: string os_build_supplemental = 8;
-     */
-    osBuildSupplemental: string;
-    /**
-     * OS identifier.
-     * Mainly used to differentiate Linux distros, as there is be no variation
-     * for systems like macOS or Windows.
-     * Example: "ubuntu", "centos", "fedora", "rhel".
-     *
-     * @generated from protobuf field: string os_id = 9;
-     */
-    osId: string;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceProfile$Type extends MessageType<DeviceProfile> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceProfile", [
-            { no: 1, name: "update_time", kind: "message", T: () => Timestamp },
-            { no: 2, name: "model_identifier", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "os_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "os_build", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "os_usernames", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "jamf_binary_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "external_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "os_build_supplemental", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "os_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceProfile>): DeviceProfile {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.modelIdentifier = "";
-        message.osVersion = "";
-        message.osBuild = "";
-        message.osUsernames = [];
-        message.jamfBinaryVersion = "";
-        message.externalId = "";
-        message.osBuildSupplemental = "";
-        message.osId = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeviceProfile>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceProfile): DeviceProfile {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* google.protobuf.Timestamp update_time */ 1:
-                    message.updateTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updateTime);
-                    break;
-                case /* string model_identifier */ 2:
-                    message.modelIdentifier = reader.string();
-                    break;
-                case /* string os_version */ 3:
-                    message.osVersion = reader.string();
-                    break;
-                case /* string os_build */ 4:
-                    message.osBuild = reader.string();
-                    break;
-                case /* repeated string os_usernames */ 5:
-                    message.osUsernames.push(reader.string());
-                    break;
-                case /* string jamf_binary_version */ 6:
-                    message.jamfBinaryVersion = reader.string();
-                    break;
-                case /* string external_id */ 7:
-                    message.externalId = reader.string();
-                    break;
-                case /* string os_build_supplemental */ 8:
-                    message.osBuildSupplemental = reader.string();
-                    break;
-                case /* string os_id */ 9:
-                    message.osId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceProfile, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* google.protobuf.Timestamp update_time = 1; */
-        if (message.updateTime)
-            Timestamp.internalBinaryWrite(message.updateTime, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string model_identifier = 2; */
-        if (message.modelIdentifier !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.modelIdentifier);
-        /* string os_version = 3; */
-        if (message.osVersion !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.osVersion);
-        /* string os_build = 4; */
-        if (message.osBuild !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.osBuild);
-        /* repeated string os_usernames = 5; */
-        for (let i = 0; i < message.osUsernames.length; i++)
-            writer.tag(5, WireType.LengthDelimited).string(message.osUsernames[i]);
-        /* string jamf_binary_version = 6; */
-        if (message.jamfBinaryVersion !== "")
-            writer.tag(6, WireType.LengthDelimited).string(message.jamfBinaryVersion);
-        /* string external_id = 7; */
-        if (message.externalId !== "")
-            writer.tag(7, WireType.LengthDelimited).string(message.externalId);
-        /* string os_build_supplemental = 8; */
-        if (message.osBuildSupplemental !== "")
-            writer.tag(8, WireType.LengthDelimited).string(message.osBuildSupplemental);
-        /* string os_id = 9; */
-        if (message.osId !== "")
-            writer.tag(9, WireType.LengthDelimited).string(message.osId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceProfile
- */
-export const DeviceProfile = new DeviceProfile$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_source_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_source_pb.ts
deleted file mode 100644
index 14b2fa1be66fd..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/device_source_pb.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/device_source.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-/**
- * Source of device, for devices that are managed by external systems
- * (for example, MDMs).
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceSource
- */
-export interface DeviceSource {
-    /**
-     * Name of the source.
-     * Matches the name of the corresponding MDM service, if applicable.
-     * Readonly.
-     *
-     * @generated from protobuf field: string name = 1;
-     */
-    name: string;
-    /**
-     * Origin of the source.
-     * Readonly.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceOrigin origin = 2;
-     */
-    origin: DeviceOrigin;
-}
-/**
- * Origin of a device.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.DeviceOrigin
- */
-export enum DeviceOrigin {
-    /**
-     * Unspecified or absent origin.
-     *
-     * @generated from protobuf enum value: DEVICE_ORIGIN_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Devices originated from direct API usage.
-     *
-     * @generated from protobuf enum value: DEVICE_ORIGIN_API = 1;
-     */
-    API = 1,
-    /**
-     * Devices originated from Jamf sync.
-     *
-     * @generated from protobuf enum value: DEVICE_ORIGIN_JAMF = 2;
-     */
-    JAMF = 2,
-    /**
-     * Source originated from Microsoft Intune sync.
-     *
-     * @generated from protobuf enum value: DEVICE_ORIGIN_INTUNE = 3;
-     */
-    INTUNE = 3
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceSource$Type extends MessageType<DeviceSource> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceSource", [
-            { no: 1, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "origin", kind: "enum", T: () => ["teleport.devicetrust.v1.DeviceOrigin", DeviceOrigin, "DEVICE_ORIGIN_"] }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceSource>): DeviceSource {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.name = "";
-        message.origin = 0;
-        if (value !== undefined)
-            reflectionMergePartial<DeviceSource>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceSource): DeviceSource {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string name */ 1:
-                    message.name = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceOrigin origin */ 2:
-                    message.origin = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceSource, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string name = 1; */
-        if (message.name !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.name);
-        /* teleport.devicetrust.v1.DeviceOrigin origin = 2; */
-        if (message.origin !== 0)
-            writer.tag(2, WireType.Varint).int32(message.origin);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceSource
- */
-export const DeviceSource = new DeviceSource$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/device_web_token_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/device_web_token_pb.ts
index 14cf9ccb635ba..5c49576aae1d7 100644
--- a/gen/proto/ts/teleport/devicetrust/v1/device_web_token_pb.ts
+++ b/gen/proto/ts/teleport/devicetrust/v1/device_web_token_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/devicetrust/v1/device_web_token.proto" (package "teleport.devicetrust.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.client.ts b/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.client.ts
deleted file mode 100644
index 48e74f07f63e1..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.client.ts
+++ /dev/null
@@ -1,480 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/devicetrust_service.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
-import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
-import { DeviceTrustService } from "./devicetrust_service_pb";
-import type { DevicesUsage } from "./usage_pb";
-import type { GetDevicesUsageRequest } from "./devicetrust_service_pb";
-import type { SyncInventoryResponse } from "./devicetrust_service_pb";
-import type { SyncInventoryRequest } from "./devicetrust_service_pb";
-import type { ConfirmDeviceWebAuthenticationResponse } from "./devicetrust_service_pb";
-import type { ConfirmDeviceWebAuthenticationRequest } from "./devicetrust_service_pb";
-import type { AuthenticateDeviceResponse } from "./devicetrust_service_pb";
-import type { AuthenticateDeviceRequest } from "./devicetrust_service_pb";
-import type { EnrollDeviceResponse } from "./devicetrust_service_pb";
-import type { EnrollDeviceRequest } from "./devicetrust_service_pb";
-import type { DuplexStreamingCall } from "@protobuf-ts/runtime-rpc";
-import type { DeviceEnrollToken } from "./device_enroll_token_pb";
-import type { CreateDeviceEnrollTokenRequest } from "./devicetrust_service_pb";
-import type { BulkCreateDevicesResponse } from "./devicetrust_service_pb";
-import type { BulkCreateDevicesRequest } from "./devicetrust_service_pb";
-import type { ListDevicesByUserResponse } from "./devicetrust_service_pb";
-import type { ListDevicesByUserRequest } from "./devicetrust_service_pb";
-import type { ListDevicesResponse } from "./devicetrust_service_pb";
-import type { ListDevicesRequest } from "./devicetrust_service_pb";
-import type { GetDeviceRequest } from "./devicetrust_service_pb";
-import type { FindDevicesResponse } from "./devicetrust_service_pb";
-import type { FindDevicesRequest } from "./devicetrust_service_pb";
-import type { Empty } from "../../../google/protobuf/empty_pb";
-import type { DeleteDeviceRequest } from "./devicetrust_service_pb";
-import type { UpsertDeviceRequest } from "./devicetrust_service_pb";
-import type { UpdateDeviceRequest } from "./devicetrust_service_pb";
-import { stackIntercept } from "@protobuf-ts/runtime-rpc";
-import type { Device } from "./device_pb";
-import type { CreateDeviceRequest } from "./devicetrust_service_pb";
-import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
-import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
-/**
- * DeviceTrustService provides methods to manage, enroll and authenticate
- * trusted devices.
- *
- * A trusted device is a device that is registered and enrolled with Teleport,
- * thus allowing the system to provide some guarantees about its provenance and
- * state.
- *
- * Managing devices requires the corresponding CRUD "device" permission.
- * Additionally, creating enrollment tokens requires the "create_enroll_token"
- * permission and enrolling devices requires the "enroll" permission. See
- * CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
- *
- * An authenticated, trusted device allows its user to perform device-aware
- * actions. Such actions include accessing an SSH node, managing sensitive
- * resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
- * and/or per-role toggles. Device authentication is automatic for enrolled
- * devices communicating with Enterprise clusters. See AuthenticateDevice for
- * reference.
- *
- * Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
- * treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
- *
- * @generated from protobuf service teleport.devicetrust.v1.DeviceTrustService
- */
-export interface IDeviceTrustServiceClient {
-    /**
-     * CreateDevice creates a device, effectively registering it on Teleport.
-     * Devices need to be registered before they can be enrolled.
-     *
-     * It is possible to create both a Device and a DeviceEnrollToken in a
-     * single invocation, see CreateDeviceRequest.create_enroll_token.
-     *
-     * @generated from protobuf rpc: CreateDevice(teleport.devicetrust.v1.CreateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    createDevice(input: CreateDeviceRequest, options?: RpcOptions): UnaryCall<CreateDeviceRequest, Device>;
-    /**
-     * UpdateDevice is a masked device update.
-     *
-     * Only certain fields may be updated, see Device for details.
-     *
-     * @generated from protobuf rpc: UpdateDevice(teleport.devicetrust.v1.UpdateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    updateDevice(input: UpdateDeviceRequest, options?: RpcOptions): UnaryCall<UpdateDeviceRequest, Device>;
-    /**
-     * UpsertDevice creates or updates a device.
-     *
-     * UpsertDevice attempts a write of all mutable fields on updates, therefore
-     * reading a fresh copy of the device is recommended. Update semantics still
-     * apply.
-     *
-     * @generated from protobuf rpc: UpsertDevice(teleport.devicetrust.v1.UpsertDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    upsertDevice(input: UpsertDeviceRequest, options?: RpcOptions): UnaryCall<UpsertDeviceRequest, Device>;
-    /**
-     * DeleteDevice hard-deletes a device, removing it and all collected data
-     * history from the system.
-     *
-     * Prefer locking the device instead (see the `tctl lock` command). Deleting a
-     * device doesn't invalidate existing device certificates, but does prevent
-     * new device authentication ceremonies from occurring.
-     *
-     * Use with caution.
-     *
-     * @generated from protobuf rpc: DeleteDevice(teleport.devicetrust.v1.DeleteDeviceRequest) returns (google.protobuf.Empty);
-     */
-    deleteDevice(input: DeleteDeviceRequest, options?: RpcOptions): UnaryCall<DeleteDeviceRequest, Empty>;
-    /**
-     * FindDevices retrieves devices by device ID and/or asset tag.
-     *
-     * It provides an in-between search between fetching a device by ID and
-     * listing all devices.
-     *
-     * ID matches are guaranteed to be present in the response.
-     *
-     * @generated from protobuf rpc: FindDevices(teleport.devicetrust.v1.FindDevicesRequest) returns (teleport.devicetrust.v1.FindDevicesResponse);
-     */
-    findDevices(input: FindDevicesRequest, options?: RpcOptions): UnaryCall<FindDevicesRequest, FindDevicesResponse>;
-    /**
-     * GetDevice retrieves a device by ID.
-     *
-     * @generated from protobuf rpc: GetDevice(teleport.devicetrust.v1.GetDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    getDevice(input: GetDeviceRequest, options?: RpcOptions): UnaryCall<GetDeviceRequest, Device>;
-    /**
-     * ListDevices lists all registered devices.
-     *
-     * @generated from protobuf rpc: ListDevices(teleport.devicetrust.v1.ListDevicesRequest) returns (teleport.devicetrust.v1.ListDevicesResponse);
-     */
-    listDevices(input: ListDevicesRequest, options?: RpcOptions): UnaryCall<ListDevicesRequest, ListDevicesResponse>;
-    /**
-     * ListDevicesByUser lists all devices owned by the user
-     *
-     * @generated from protobuf rpc: ListDevicesByUser(teleport.devicetrust.v1.ListDevicesByUserRequest) returns (teleport.devicetrust.v1.ListDevicesByUserResponse);
-     */
-    listDevicesByUser(input: ListDevicesByUserRequest, options?: RpcOptions): UnaryCall<ListDevicesByUserRequest, ListDevicesByUserResponse>;
-    /**
-     * BulkCreateDevices is a bulk variant of CreateDevice.
-     *
-     * Unlike CreateDevice, it does not support creation of enrollment tokens, as
-     * it is meant for bulk inventory registration.
-     *
-     * @generated from protobuf rpc: BulkCreateDevices(teleport.devicetrust.v1.BulkCreateDevicesRequest) returns (teleport.devicetrust.v1.BulkCreateDevicesResponse);
-     */
-    bulkCreateDevices(input: BulkCreateDevicesRequest, options?: RpcOptions): UnaryCall<BulkCreateDevicesRequest, BulkCreateDevicesResponse>;
-    /**
-     * CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
-     * An enrollment token is required for the enrollment ceremony. See
-     * EnrollDevice.
-     *
-     * @generated from protobuf rpc: CreateDeviceEnrollToken(teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest) returns (teleport.devicetrust.v1.DeviceEnrollToken);
-     */
-    createDeviceEnrollToken(input: CreateDeviceEnrollTokenRequest, options?: RpcOptions): UnaryCall<CreateDeviceEnrollTokenRequest, DeviceEnrollToken>;
-    /**
-     * EnrollDevice performs the device enrollment ceremony.
-     *
-     * Enrollment requires a previously-registered Device and a DeviceEnrollToken,
-     * see CreateDevice and CreateDeviceEnrollToken.
-     *
-     * An enrolled device is allowed, via AuthenticateDevice, to acquire
-     * certificates containing device extensions, thus gaining access to
-     * device-aware actions.
-     *
-     * macOS enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- MacOSEnrollChallenge (server)
-     * -> MacOSEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * TPM enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- TPMEnrollChallenge (server)
-     * -> TPMEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * @generated from protobuf rpc: EnrollDevice(stream teleport.devicetrust.v1.EnrollDeviceRequest) returns (stream teleport.devicetrust.v1.EnrollDeviceResponse);
-     */
-    enrollDevice(options?: RpcOptions): DuplexStreamingCall<EnrollDeviceRequest, EnrollDeviceResponse>;
-    /**
-     * AuthenticateDevice performs the device authentication ceremony.
-     *
-     * Device authentication exchanges existing user certificates without device
-     * extensions for certificates augmented with device extensions. The new
-     * certificates allow the user to perform device-aware actions.
-     *
-     * Only registered and enrolled devices may perform device authentication.
-     *
-     * @generated from protobuf rpc: AuthenticateDevice(stream teleport.devicetrust.v1.AuthenticateDeviceRequest) returns (stream teleport.devicetrust.v1.AuthenticateDeviceResponse);
-     */
-    authenticateDevice(options?: RpcOptions): DuplexStreamingCall<AuthenticateDeviceRequest, AuthenticateDeviceResponse>;
-    /**
-     * ConfirmDeviceWebAuthentication finalizes the device web authentication
-     * ceremony started by the creation of a DeviceWebToken and subsequent
-     * AuthenticateDevice call.
-     *
-     * The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
-     * method, which consequently augments the corresponding Web Session
-     * certificates with device extensions.
-     *
-     * This method must be called by the Teleport Proxy, and the Proxy itself must
-     * be called by the same browser that started the on-behalf-of authentication
-     * attempt. See the /webapi/device/webconfirm endpoint.
-     *
-     * See
-     * https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
-     *
-     * @generated from protobuf rpc: ConfirmDeviceWebAuthentication(teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest) returns (teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse);
-     */
-    confirmDeviceWebAuthentication(input: ConfirmDeviceWebAuthenticationRequest, options?: RpcOptions): UnaryCall<ConfirmDeviceWebAuthenticationRequest, ConfirmDeviceWebAuthenticationResponse>;
-    /**
-     * Syncs device inventory from a source exterior to Teleport, for example an
-     * MDM.
-     * Allows both partial and full syncs; for the latter, devices missing from
-     * the external inventory are handled as specified.
-     * Authorized either by a valid MDM service certificate or the appropriate
-     * "device" permissions (create/update/delete).
-     *
-     * @generated from protobuf rpc: SyncInventory(stream teleport.devicetrust.v1.SyncInventoryRequest) returns (stream teleport.devicetrust.v1.SyncInventoryResponse);
-     */
-    syncInventory(options?: RpcOptions): DuplexStreamingCall<SyncInventoryRequest, SyncInventoryResponse>;
-    /**
-     * Superseded by ResourceUsageService.GetUsage.
-     *
-     * @deprecated
-     * @generated from protobuf rpc: GetDevicesUsage(teleport.devicetrust.v1.GetDevicesUsageRequest) returns (teleport.devicetrust.v1.DevicesUsage);
-     */
-    getDevicesUsage(input: GetDevicesUsageRequest, options?: RpcOptions): UnaryCall<GetDevicesUsageRequest, DevicesUsage>;
-}
-/**
- * DeviceTrustService provides methods to manage, enroll and authenticate
- * trusted devices.
- *
- * A trusted device is a device that is registered and enrolled with Teleport,
- * thus allowing the system to provide some guarantees about its provenance and
- * state.
- *
- * Managing devices requires the corresponding CRUD "device" permission.
- * Additionally, creating enrollment tokens requires the "create_enroll_token"
- * permission and enrolling devices requires the "enroll" permission. See
- * CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
- *
- * An authenticated, trusted device allows its user to perform device-aware
- * actions. Such actions include accessing an SSH node, managing sensitive
- * resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
- * and/or per-role toggles. Device authentication is automatic for enrolled
- * devices communicating with Enterprise clusters. See AuthenticateDevice for
- * reference.
- *
- * Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
- * treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
- *
- * @generated from protobuf service teleport.devicetrust.v1.DeviceTrustService
- */
-export class DeviceTrustServiceClient implements IDeviceTrustServiceClient, ServiceInfo {
-    typeName = DeviceTrustService.typeName;
-    methods = DeviceTrustService.methods;
-    options = DeviceTrustService.options;
-    constructor(private readonly _transport: RpcTransport) {
-    }
-    /**
-     * CreateDevice creates a device, effectively registering it on Teleport.
-     * Devices need to be registered before they can be enrolled.
-     *
-     * It is possible to create both a Device and a DeviceEnrollToken in a
-     * single invocation, see CreateDeviceRequest.create_enroll_token.
-     *
-     * @generated from protobuf rpc: CreateDevice(teleport.devicetrust.v1.CreateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    createDevice(input: CreateDeviceRequest, options?: RpcOptions): UnaryCall<CreateDeviceRequest, Device> {
-        const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CreateDeviceRequest, Device>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpdateDevice is a masked device update.
-     *
-     * Only certain fields may be updated, see Device for details.
-     *
-     * @generated from protobuf rpc: UpdateDevice(teleport.devicetrust.v1.UpdateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    updateDevice(input: UpdateDeviceRequest, options?: RpcOptions): UnaryCall<UpdateDeviceRequest, Device> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpdateDeviceRequest, Device>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UpsertDevice creates or updates a device.
-     *
-     * UpsertDevice attempts a write of all mutable fields on updates, therefore
-     * reading a fresh copy of the device is recommended. Update semantics still
-     * apply.
-     *
-     * @generated from protobuf rpc: UpsertDevice(teleport.devicetrust.v1.UpsertDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    upsertDevice(input: UpsertDeviceRequest, options?: RpcOptions): UnaryCall<UpsertDeviceRequest, Device> {
-        const method = this.methods[2], opt = this._transport.mergeOptions(options);
-        return stackIntercept<UpsertDeviceRequest, Device>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * DeleteDevice hard-deletes a device, removing it and all collected data
-     * history from the system.
-     *
-     * Prefer locking the device instead (see the `tctl lock` command). Deleting a
-     * device doesn't invalidate existing device certificates, but does prevent
-     * new device authentication ceremonies from occurring.
-     *
-     * Use with caution.
-     *
-     * @generated from protobuf rpc: DeleteDevice(teleport.devicetrust.v1.DeleteDeviceRequest) returns (google.protobuf.Empty);
-     */
-    deleteDevice(input: DeleteDeviceRequest, options?: RpcOptions): UnaryCall<DeleteDeviceRequest, Empty> {
-        const method = this.methods[3], opt = this._transport.mergeOptions(options);
-        return stackIntercept<DeleteDeviceRequest, Empty>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * FindDevices retrieves devices by device ID and/or asset tag.
-     *
-     * It provides an in-between search between fetching a device by ID and
-     * listing all devices.
-     *
-     * ID matches are guaranteed to be present in the response.
-     *
-     * @generated from protobuf rpc: FindDevices(teleport.devicetrust.v1.FindDevicesRequest) returns (teleport.devicetrust.v1.FindDevicesResponse);
-     */
-    findDevices(input: FindDevicesRequest, options?: RpcOptions): UnaryCall<FindDevicesRequest, FindDevicesResponse> {
-        const method = this.methods[4], opt = this._transport.mergeOptions(options);
-        return stackIntercept<FindDevicesRequest, FindDevicesResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * GetDevice retrieves a device by ID.
-     *
-     * @generated from protobuf rpc: GetDevice(teleport.devicetrust.v1.GetDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    getDevice(input: GetDeviceRequest, options?: RpcOptions): UnaryCall<GetDeviceRequest, Device> {
-        const method = this.methods[5], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetDeviceRequest, Device>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListDevices lists all registered devices.
-     *
-     * @generated from protobuf rpc: ListDevices(teleport.devicetrust.v1.ListDevicesRequest) returns (teleport.devicetrust.v1.ListDevicesResponse);
-     */
-    listDevices(input: ListDevicesRequest, options?: RpcOptions): UnaryCall<ListDevicesRequest, ListDevicesResponse> {
-        const method = this.methods[6], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListDevicesRequest, ListDevicesResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * ListDevicesByUser lists all devices owned by the user
-     *
-     * @generated from protobuf rpc: ListDevicesByUser(teleport.devicetrust.v1.ListDevicesByUserRequest) returns (teleport.devicetrust.v1.ListDevicesByUserResponse);
-     */
-    listDevicesByUser(input: ListDevicesByUserRequest, options?: RpcOptions): UnaryCall<ListDevicesByUserRequest, ListDevicesByUserResponse> {
-        const method = this.methods[7], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListDevicesByUserRequest, ListDevicesByUserResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * BulkCreateDevices is a bulk variant of CreateDevice.
-     *
-     * Unlike CreateDevice, it does not support creation of enrollment tokens, as
-     * it is meant for bulk inventory registration.
-     *
-     * @generated from protobuf rpc: BulkCreateDevices(teleport.devicetrust.v1.BulkCreateDevicesRequest) returns (teleport.devicetrust.v1.BulkCreateDevicesResponse);
-     */
-    bulkCreateDevices(input: BulkCreateDevicesRequest, options?: RpcOptions): UnaryCall<BulkCreateDevicesRequest, BulkCreateDevicesResponse> {
-        const method = this.methods[8], opt = this._transport.mergeOptions(options);
-        return stackIntercept<BulkCreateDevicesRequest, BulkCreateDevicesResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
-     * An enrollment token is required for the enrollment ceremony. See
-     * EnrollDevice.
-     *
-     * @generated from protobuf rpc: CreateDeviceEnrollToken(teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest) returns (teleport.devicetrust.v1.DeviceEnrollToken);
-     */
-    createDeviceEnrollToken(input: CreateDeviceEnrollTokenRequest, options?: RpcOptions): UnaryCall<CreateDeviceEnrollTokenRequest, DeviceEnrollToken> {
-        const method = this.methods[9], opt = this._transport.mergeOptions(options);
-        return stackIntercept<CreateDeviceEnrollTokenRequest, DeviceEnrollToken>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * EnrollDevice performs the device enrollment ceremony.
-     *
-     * Enrollment requires a previously-registered Device and a DeviceEnrollToken,
-     * see CreateDevice and CreateDeviceEnrollToken.
-     *
-     * An enrolled device is allowed, via AuthenticateDevice, to acquire
-     * certificates containing device extensions, thus gaining access to
-     * device-aware actions.
-     *
-     * macOS enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- MacOSEnrollChallenge (server)
-     * -> MacOSEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * TPM enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- TPMEnrollChallenge (server)
-     * -> TPMEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * @generated from protobuf rpc: EnrollDevice(stream teleport.devicetrust.v1.EnrollDeviceRequest) returns (stream teleport.devicetrust.v1.EnrollDeviceResponse);
-     */
-    enrollDevice(options?: RpcOptions): DuplexStreamingCall<EnrollDeviceRequest, EnrollDeviceResponse> {
-        const method = this.methods[10], opt = this._transport.mergeOptions(options);
-        return stackIntercept<EnrollDeviceRequest, EnrollDeviceResponse>("duplex", this._transport, method, opt);
-    }
-    /**
-     * AuthenticateDevice performs the device authentication ceremony.
-     *
-     * Device authentication exchanges existing user certificates without device
-     * extensions for certificates augmented with device extensions. The new
-     * certificates allow the user to perform device-aware actions.
-     *
-     * Only registered and enrolled devices may perform device authentication.
-     *
-     * @generated from protobuf rpc: AuthenticateDevice(stream teleport.devicetrust.v1.AuthenticateDeviceRequest) returns (stream teleport.devicetrust.v1.AuthenticateDeviceResponse);
-     */
-    authenticateDevice(options?: RpcOptions): DuplexStreamingCall<AuthenticateDeviceRequest, AuthenticateDeviceResponse> {
-        const method = this.methods[11], opt = this._transport.mergeOptions(options);
-        return stackIntercept<AuthenticateDeviceRequest, AuthenticateDeviceResponse>("duplex", this._transport, method, opt);
-    }
-    /**
-     * ConfirmDeviceWebAuthentication finalizes the device web authentication
-     * ceremony started by the creation of a DeviceWebToken and subsequent
-     * AuthenticateDevice call.
-     *
-     * The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
-     * method, which consequently augments the corresponding Web Session
-     * certificates with device extensions.
-     *
-     * This method must be called by the Teleport Proxy, and the Proxy itself must
-     * be called by the same browser that started the on-behalf-of authentication
-     * attempt. See the /webapi/device/webconfirm endpoint.
-     *
-     * See
-     * https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
-     *
-     * @generated from protobuf rpc: ConfirmDeviceWebAuthentication(teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest) returns (teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse);
-     */
-    confirmDeviceWebAuthentication(input: ConfirmDeviceWebAuthenticationRequest, options?: RpcOptions): UnaryCall<ConfirmDeviceWebAuthenticationRequest, ConfirmDeviceWebAuthenticationResponse> {
-        const method = this.methods[12], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ConfirmDeviceWebAuthenticationRequest, ConfirmDeviceWebAuthenticationResponse>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Syncs device inventory from a source exterior to Teleport, for example an
-     * MDM.
-     * Allows both partial and full syncs; for the latter, devices missing from
-     * the external inventory are handled as specified.
-     * Authorized either by a valid MDM service certificate or the appropriate
-     * "device" permissions (create/update/delete).
-     *
-     * @generated from protobuf rpc: SyncInventory(stream teleport.devicetrust.v1.SyncInventoryRequest) returns (stream teleport.devicetrust.v1.SyncInventoryResponse);
-     */
-    syncInventory(options?: RpcOptions): DuplexStreamingCall<SyncInventoryRequest, SyncInventoryResponse> {
-        const method = this.methods[13], opt = this._transport.mergeOptions(options);
-        return stackIntercept<SyncInventoryRequest, SyncInventoryResponse>("duplex", this._transport, method, opt);
-    }
-    /**
-     * Superseded by ResourceUsageService.GetUsage.
-     *
-     * @deprecated
-     * @generated from protobuf rpc: GetDevicesUsage(teleport.devicetrust.v1.GetDevicesUsageRequest) returns (teleport.devicetrust.v1.DevicesUsage);
-     */
-    getDevicesUsage(input: GetDevicesUsageRequest, options?: RpcOptions): UnaryCall<GetDevicesUsageRequest, DevicesUsage> {
-        const method = this.methods[14], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetDevicesUsageRequest, DevicesUsage>("unary", this._transport, method, opt, input);
-    }
-}
diff --git a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.grpc-server.ts b/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.grpc-server.ts
deleted file mode 100644
index fa960f88fe2d7..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.grpc-server.ts
+++ /dev/null
@@ -1,399 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/devicetrust_service.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { DevicesUsage } from "./usage_pb";
-import { GetDevicesUsageRequest } from "./devicetrust_service_pb";
-import { SyncInventoryResponse } from "./devicetrust_service_pb";
-import { SyncInventoryRequest } from "./devicetrust_service_pb";
-import { ConfirmDeviceWebAuthenticationResponse } from "./devicetrust_service_pb";
-import { ConfirmDeviceWebAuthenticationRequest } from "./devicetrust_service_pb";
-import { AuthenticateDeviceResponse } from "./devicetrust_service_pb";
-import { AuthenticateDeviceRequest } from "./devicetrust_service_pb";
-import { EnrollDeviceResponse } from "./devicetrust_service_pb";
-import { EnrollDeviceRequest } from "./devicetrust_service_pb";
-import { DeviceEnrollToken } from "./device_enroll_token_pb";
-import { CreateDeviceEnrollTokenRequest } from "./devicetrust_service_pb";
-import { BulkCreateDevicesResponse } from "./devicetrust_service_pb";
-import { BulkCreateDevicesRequest } from "./devicetrust_service_pb";
-import { ListDevicesByUserResponse } from "./devicetrust_service_pb";
-import { ListDevicesByUserRequest } from "./devicetrust_service_pb";
-import { ListDevicesResponse } from "./devicetrust_service_pb";
-import { ListDevicesRequest } from "./devicetrust_service_pb";
-import { GetDeviceRequest } from "./devicetrust_service_pb";
-import { FindDevicesResponse } from "./devicetrust_service_pb";
-import { FindDevicesRequest } from "./devicetrust_service_pb";
-import { Empty } from "../../../google/protobuf/empty_pb";
-import { DeleteDeviceRequest } from "./devicetrust_service_pb";
-import { UpsertDeviceRequest } from "./devicetrust_service_pb";
-import { UpdateDeviceRequest } from "./devicetrust_service_pb";
-import { Device } from "./device_pb";
-import { CreateDeviceRequest } from "./devicetrust_service_pb";
-import type * as grpc from "@grpc/grpc-js";
-/**
- * DeviceTrustService provides methods to manage, enroll and authenticate
- * trusted devices.
- *
- * A trusted device is a device that is registered and enrolled with Teleport,
- * thus allowing the system to provide some guarantees about its provenance and
- * state.
- *
- * Managing devices requires the corresponding CRUD "device" permission.
- * Additionally, creating enrollment tokens requires the "create_enroll_token"
- * permission and enrolling devices requires the "enroll" permission. See
- * CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
- *
- * An authenticated, trusted device allows its user to perform device-aware
- * actions. Such actions include accessing an SSH node, managing sensitive
- * resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
- * and/or per-role toggles. Device authentication is automatic for enrolled
- * devices communicating with Enterprise clusters. See AuthenticateDevice for
- * reference.
- *
- * Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
- * treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
- *
- * @generated from protobuf service teleport.devicetrust.v1.DeviceTrustService
- */
-export interface IDeviceTrustService extends grpc.UntypedServiceImplementation {
-    /**
-     * CreateDevice creates a device, effectively registering it on Teleport.
-     * Devices need to be registered before they can be enrolled.
-     *
-     * It is possible to create both a Device and a DeviceEnrollToken in a
-     * single invocation, see CreateDeviceRequest.create_enroll_token.
-     *
-     * @generated from protobuf rpc: CreateDevice(teleport.devicetrust.v1.CreateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    createDevice: grpc.handleUnaryCall<CreateDeviceRequest, Device>;
-    /**
-     * UpdateDevice is a masked device update.
-     *
-     * Only certain fields may be updated, see Device for details.
-     *
-     * @generated from protobuf rpc: UpdateDevice(teleport.devicetrust.v1.UpdateDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    updateDevice: grpc.handleUnaryCall<UpdateDeviceRequest, Device>;
-    /**
-     * UpsertDevice creates or updates a device.
-     *
-     * UpsertDevice attempts a write of all mutable fields on updates, therefore
-     * reading a fresh copy of the device is recommended. Update semantics still
-     * apply.
-     *
-     * @generated from protobuf rpc: UpsertDevice(teleport.devicetrust.v1.UpsertDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    upsertDevice: grpc.handleUnaryCall<UpsertDeviceRequest, Device>;
-    /**
-     * DeleteDevice hard-deletes a device, removing it and all collected data
-     * history from the system.
-     *
-     * Prefer locking the device instead (see the `tctl lock` command). Deleting a
-     * device doesn't invalidate existing device certificates, but does prevent
-     * new device authentication ceremonies from occurring.
-     *
-     * Use with caution.
-     *
-     * @generated from protobuf rpc: DeleteDevice(teleport.devicetrust.v1.DeleteDeviceRequest) returns (google.protobuf.Empty);
-     */
-    deleteDevice: grpc.handleUnaryCall<DeleteDeviceRequest, Empty>;
-    /**
-     * FindDevices retrieves devices by device ID and/or asset tag.
-     *
-     * It provides an in-between search between fetching a device by ID and
-     * listing all devices.
-     *
-     * ID matches are guaranteed to be present in the response.
-     *
-     * @generated from protobuf rpc: FindDevices(teleport.devicetrust.v1.FindDevicesRequest) returns (teleport.devicetrust.v1.FindDevicesResponse);
-     */
-    findDevices: grpc.handleUnaryCall<FindDevicesRequest, FindDevicesResponse>;
-    /**
-     * GetDevice retrieves a device by ID.
-     *
-     * @generated from protobuf rpc: GetDevice(teleport.devicetrust.v1.GetDeviceRequest) returns (teleport.devicetrust.v1.Device);
-     */
-    getDevice: grpc.handleUnaryCall<GetDeviceRequest, Device>;
-    /**
-     * ListDevices lists all registered devices.
-     *
-     * @generated from protobuf rpc: ListDevices(teleport.devicetrust.v1.ListDevicesRequest) returns (teleport.devicetrust.v1.ListDevicesResponse);
-     */
-    listDevices: grpc.handleUnaryCall<ListDevicesRequest, ListDevicesResponse>;
-    /**
-     * ListDevicesByUser lists all devices owned by the user
-     *
-     * @generated from protobuf rpc: ListDevicesByUser(teleport.devicetrust.v1.ListDevicesByUserRequest) returns (teleport.devicetrust.v1.ListDevicesByUserResponse);
-     */
-    listDevicesByUser: grpc.handleUnaryCall<ListDevicesByUserRequest, ListDevicesByUserResponse>;
-    /**
-     * BulkCreateDevices is a bulk variant of CreateDevice.
-     *
-     * Unlike CreateDevice, it does not support creation of enrollment tokens, as
-     * it is meant for bulk inventory registration.
-     *
-     * @generated from protobuf rpc: BulkCreateDevices(teleport.devicetrust.v1.BulkCreateDevicesRequest) returns (teleport.devicetrust.v1.BulkCreateDevicesResponse);
-     */
-    bulkCreateDevices: grpc.handleUnaryCall<BulkCreateDevicesRequest, BulkCreateDevicesResponse>;
-    /**
-     * CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
-     * An enrollment token is required for the enrollment ceremony. See
-     * EnrollDevice.
-     *
-     * @generated from protobuf rpc: CreateDeviceEnrollToken(teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest) returns (teleport.devicetrust.v1.DeviceEnrollToken);
-     */
-    createDeviceEnrollToken: grpc.handleUnaryCall<CreateDeviceEnrollTokenRequest, DeviceEnrollToken>;
-    /**
-     * EnrollDevice performs the device enrollment ceremony.
-     *
-     * Enrollment requires a previously-registered Device and a DeviceEnrollToken,
-     * see CreateDevice and CreateDeviceEnrollToken.
-     *
-     * An enrolled device is allowed, via AuthenticateDevice, to acquire
-     * certificates containing device extensions, thus gaining access to
-     * device-aware actions.
-     *
-     * macOS enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- MacOSEnrollChallenge (server)
-     * -> MacOSEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * TPM enrollment flow:
-     * -> EnrollDeviceInit (client)
-     * <- TPMEnrollChallenge (server)
-     * -> TPMEnrollChallengeResponse
-     * <- EnrollDeviceSuccess
-     *
-     * @generated from protobuf rpc: EnrollDevice(stream teleport.devicetrust.v1.EnrollDeviceRequest) returns (stream teleport.devicetrust.v1.EnrollDeviceResponse);
-     */
-    enrollDevice: grpc.handleBidiStreamingCall<EnrollDeviceRequest, EnrollDeviceResponse>;
-    /**
-     * AuthenticateDevice performs the device authentication ceremony.
-     *
-     * Device authentication exchanges existing user certificates without device
-     * extensions for certificates augmented with device extensions. The new
-     * certificates allow the user to perform device-aware actions.
-     *
-     * Only registered and enrolled devices may perform device authentication.
-     *
-     * @generated from protobuf rpc: AuthenticateDevice(stream teleport.devicetrust.v1.AuthenticateDeviceRequest) returns (stream teleport.devicetrust.v1.AuthenticateDeviceResponse);
-     */
-    authenticateDevice: grpc.handleBidiStreamingCall<AuthenticateDeviceRequest, AuthenticateDeviceResponse>;
-    /**
-     * ConfirmDeviceWebAuthentication finalizes the device web authentication
-     * ceremony started by the creation of a DeviceWebToken and subsequent
-     * AuthenticateDevice call.
-     *
-     * The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
-     * method, which consequently augments the corresponding Web Session
-     * certificates with device extensions.
-     *
-     * This method must be called by the Teleport Proxy, and the Proxy itself must
-     * be called by the same browser that started the on-behalf-of authentication
-     * attempt. See the /webapi/device/webconfirm endpoint.
-     *
-     * See
-     * https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
-     *
-     * @generated from protobuf rpc: ConfirmDeviceWebAuthentication(teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest) returns (teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse);
-     */
-    confirmDeviceWebAuthentication: grpc.handleUnaryCall<ConfirmDeviceWebAuthenticationRequest, ConfirmDeviceWebAuthenticationResponse>;
-    /**
-     * Syncs device inventory from a source exterior to Teleport, for example an
-     * MDM.
-     * Allows both partial and full syncs; for the latter, devices missing from
-     * the external inventory are handled as specified.
-     * Authorized either by a valid MDM service certificate or the appropriate
-     * "device" permissions (create/update/delete).
-     *
-     * @generated from protobuf rpc: SyncInventory(stream teleport.devicetrust.v1.SyncInventoryRequest) returns (stream teleport.devicetrust.v1.SyncInventoryResponse);
-     */
-    syncInventory: grpc.handleBidiStreamingCall<SyncInventoryRequest, SyncInventoryResponse>;
-    /**
-     * Superseded by ResourceUsageService.GetUsage.
-     *
-     * @deprecated
-     * @generated from protobuf rpc: GetDevicesUsage(teleport.devicetrust.v1.GetDevicesUsageRequest) returns (teleport.devicetrust.v1.DevicesUsage);
-     */
-    getDevicesUsage: grpc.handleUnaryCall<GetDevicesUsageRequest, DevicesUsage>;
-}
-/**
- * @grpc/grpc-js definition for the protobuf service teleport.devicetrust.v1.DeviceTrustService.
- *
- * Usage: Implement the interface IDeviceTrustService and add to a grpc server.
- *
- * ```typescript
- * const server = new grpc.Server();
- * const service: IDeviceTrustService = ...
- * server.addService(deviceTrustServiceDefinition, service);
- * ```
- */
-export const deviceTrustServiceDefinition: grpc.ServiceDefinition<IDeviceTrustService> = {
-    createDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/CreateDevice",
-        originalName: "CreateDevice",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Device.fromBinary(bytes),
-        requestDeserialize: bytes => CreateDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Device.toBinary(value)),
-        requestSerialize: value => Buffer.from(CreateDeviceRequest.toBinary(value))
-    },
-    updateDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/UpdateDevice",
-        originalName: "UpdateDevice",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Device.fromBinary(bytes),
-        requestDeserialize: bytes => UpdateDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Device.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpdateDeviceRequest.toBinary(value))
-    },
-    upsertDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/UpsertDevice",
-        originalName: "UpsertDevice",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Device.fromBinary(bytes),
-        requestDeserialize: bytes => UpsertDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Device.toBinary(value)),
-        requestSerialize: value => Buffer.from(UpsertDeviceRequest.toBinary(value))
-    },
-    deleteDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/DeleteDevice",
-        originalName: "DeleteDevice",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Empty.fromBinary(bytes),
-        requestDeserialize: bytes => DeleteDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Empty.toBinary(value)),
-        requestSerialize: value => Buffer.from(DeleteDeviceRequest.toBinary(value))
-    },
-    findDevices: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/FindDevices",
-        originalName: "FindDevices",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => FindDevicesResponse.fromBinary(bytes),
-        requestDeserialize: bytes => FindDevicesRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(FindDevicesResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(FindDevicesRequest.toBinary(value))
-    },
-    getDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/GetDevice",
-        originalName: "GetDevice",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => Device.fromBinary(bytes),
-        requestDeserialize: bytes => GetDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(Device.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetDeviceRequest.toBinary(value))
-    },
-    listDevices: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/ListDevices",
-        originalName: "ListDevices",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListDevicesResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListDevicesRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListDevicesResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListDevicesRequest.toBinary(value))
-    },
-    listDevicesByUser: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/ListDevicesByUser",
-        originalName: "ListDevicesByUser",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ListDevicesByUserResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListDevicesByUserRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListDevicesByUserResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListDevicesByUserRequest.toBinary(value))
-    },
-    bulkCreateDevices: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/BulkCreateDevices",
-        originalName: "BulkCreateDevices",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => BulkCreateDevicesResponse.fromBinary(bytes),
-        requestDeserialize: bytes => BulkCreateDevicesRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(BulkCreateDevicesResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(BulkCreateDevicesRequest.toBinary(value))
-    },
-    createDeviceEnrollToken: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/CreateDeviceEnrollToken",
-        originalName: "CreateDeviceEnrollToken",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => DeviceEnrollToken.fromBinary(bytes),
-        requestDeserialize: bytes => CreateDeviceEnrollTokenRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(DeviceEnrollToken.toBinary(value)),
-        requestSerialize: value => Buffer.from(CreateDeviceEnrollTokenRequest.toBinary(value))
-    },
-    enrollDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/EnrollDevice",
-        originalName: "EnrollDevice",
-        requestStream: true,
-        responseStream: true,
-        responseDeserialize: bytes => EnrollDeviceResponse.fromBinary(bytes),
-        requestDeserialize: bytes => EnrollDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(EnrollDeviceResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(EnrollDeviceRequest.toBinary(value))
-    },
-    authenticateDevice: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/AuthenticateDevice",
-        originalName: "AuthenticateDevice",
-        requestStream: true,
-        responseStream: true,
-        responseDeserialize: bytes => AuthenticateDeviceResponse.fromBinary(bytes),
-        requestDeserialize: bytes => AuthenticateDeviceRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(AuthenticateDeviceResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(AuthenticateDeviceRequest.toBinary(value))
-    },
-    confirmDeviceWebAuthentication: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/ConfirmDeviceWebAuthentication",
-        originalName: "ConfirmDeviceWebAuthentication",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => ConfirmDeviceWebAuthenticationResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ConfirmDeviceWebAuthenticationRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ConfirmDeviceWebAuthenticationResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ConfirmDeviceWebAuthenticationRequest.toBinary(value))
-    },
-    syncInventory: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/SyncInventory",
-        originalName: "SyncInventory",
-        requestStream: true,
-        responseStream: true,
-        responseDeserialize: bytes => SyncInventoryResponse.fromBinary(bytes),
-        requestDeserialize: bytes => SyncInventoryRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(SyncInventoryResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(SyncInventoryRequest.toBinary(value))
-    },
-    getDevicesUsage: {
-        path: "/teleport.devicetrust.v1.DeviceTrustService/GetDevicesUsage",
-        originalName: "GetDevicesUsage",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => DevicesUsage.fromBinary(bytes),
-        requestDeserialize: bytes => GetDevicesUsageRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(DevicesUsage.toBinary(value)),
-        requestSerialize: value => Buffer.from(GetDevicesUsageRequest.toBinary(value))
-    }
-};
diff --git a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.ts
deleted file mode 100644
index 0a908e8266912..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/devicetrust_service_pb.ts
+++ /dev/null
@@ -1,3301 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/devicetrust_service.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { DevicesUsage } from "./usage_pb";
-import { DeviceEnrollToken } from "./device_enroll_token_pb";
-import { Empty } from "../../../google/protobuf/empty_pb";
-import { ServiceType } from "@protobuf-ts/runtime-rpc";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { DeviceSource } from "./device_source_pb";
-import { DeviceWebToken } from "./device_web_token_pb";
-import { DeviceConfirmationToken } from "./device_confirmation_token_pb";
-import { TPMAuthenticateDeviceChallenge } from "./authenticate_challenge_pb";
-import { UserCertificates } from "./user_certificates_pb";
-import { AuthenticateDeviceChallenge } from "./authenticate_challenge_pb";
-import { TPMAuthenticateDeviceChallengeResponse } from "./authenticate_challenge_pb";
-import { AuthenticateDeviceChallengeResponse } from "./authenticate_challenge_pb";
-import { TPMPlatformParameters } from "./tpm_pb";
-import { DeviceCollectedData } from "./device_collected_data_pb";
-import { Status } from "../../../google/rpc/status_pb";
-import { FieldMask } from "../../../google/protobuf/field_mask_pb";
-import { Timestamp } from "../../../google/protobuf/timestamp_pb";
-import { Device } from "./device_pb";
-/**
- * Request for CreateDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.CreateDeviceRequest
- */
-export interface CreateDeviceRequest {
-    /**
-     * Device to create.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.Device device = 1;
-     */
-    device?: Device;
-    /**
-     * If true, a DeviceEnrollToken is created along with the Device.
-     *
-     * @generated from protobuf field: bool create_enroll_token = 2;
-     */
-    createEnrollToken: boolean;
-    /**
-     * If true, create the device as a Teleport resource, meaning that fields that
-     * are usually considered read-only or system managed are copied as provided
-     * to storage.
-     * Prefer using non-resource creation semantics if possible.
-     *
-     * @generated from protobuf field: bool create_as_resource = 3;
-     */
-    createAsResource: boolean;
-    /**
-     * Custom expiration time for enrollment tokens.
-     * A short (for humans) server default is used if unset.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp enroll_token_expire_time = 4;
-     */
-    enrollTokenExpireTime?: Timestamp;
-}
-/**
- * Request for UpdateDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.UpdateDeviceRequest
- */
-export interface UpdateDeviceRequest {
-    /**
-     * Device to update.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.Device device = 1;
-     */
-    device?: Device;
-    /**
-     * Update mask applied to the resource.
-     * Fields are masked according to their proto name.
-     *
-     * @generated from protobuf field: google.protobuf.FieldMask update_mask = 2;
-     */
-    updateMask?: FieldMask;
-}
-/**
- * Request for UpsertDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.UpsertDeviceRequest
- */
-export interface UpsertDeviceRequest {
-    /**
-     * Device to create or update.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.Device device = 1;
-     */
-    device?: Device;
-    /**
-     * If true, creates the device using resource semantics.
-     * Has no effect on device updates.
-     * See create_as_resource in CreateDeviceRequest.
-     *
-     * @generated from protobuf field: bool create_as_resource = 2;
-     */
-    createAsResource: boolean;
-}
-/**
- * Request for DeleteDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeleteDeviceRequest
- */
-export interface DeleteDeviceRequest {
-    /**
-     * ID of the Device to delete.
-     *
-     * @generated from protobuf field: string device_id = 1;
-     */
-    deviceId: string;
-}
-/**
- * Request for FindDevices.
- *
- * Inspect the returned devices to determine whether the match was by ID or
- * asset tag.
- *
- * @generated from protobuf message teleport.devicetrust.v1.FindDevicesRequest
- */
-export interface FindDevicesRequest {
-    /**
-     * Device ID or asset tag.
-     *
-     * @generated from protobuf field: string id_or_tag = 1;
-     */
-    idOrTag: string;
-}
-/**
- * Response for FindDevices.
- *
- * @generated from protobuf message teleport.devicetrust.v1.FindDevicesResponse
- */
-export interface FindDevicesResponse {
-    /**
-     * Devices that matched the search.
-     * The number of resulting devices is expected to be low and may be
-     * artificially capped by the server otherwise.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-}
-/**
- * Request for GetDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.GetDeviceRequest
- */
-export interface GetDeviceRequest {
-    /**
-     * ID of the device.
-     *
-     * @generated from protobuf field: string device_id = 1;
-     */
-    deviceId: string;
-}
-/**
- * Request for ListDevices.
- *
- * Follows the pagination semantics of
- * https://cloud.google.com/apis/design/standard_methods#list.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ListDevicesRequest
- */
-export interface ListDevicesRequest {
-    /**
-     * The maximum number of items to return.
-     * The server may impose a different page size at its discretion.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * The next_page_token value returned from a previous List request, if any.
-     *
-     * @generated from protobuf field: string page_token = 2;
-     */
-    pageToken: string;
-    /**
-     * Specifies which fields of the resource should be returned in the response.
-     * Defaults to DEVICE_VIEW_LIST.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceView view = 3;
-     */
-    view: DeviceView;
-}
-/**
- * Response for ListDevices.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ListDevicesResponse
- */
-export interface ListDevicesResponse {
-    /**
-     * Devices that matched the search.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-    /**
-     * Token to retrieve the next page of results, or empty if there are no
-     * more results in the list.
-     *
-     * @generated from protobuf field: string next_page_token = 2;
-     */
-    nextPageToken: string;
-}
-/**
- * Request for ListDevicesByUser.
- *
- * Follows the pagination semantics of
- * https://cloud.google.com/apis/design/standard_methods#list.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ListDevicesByUserRequest
- */
-export interface ListDevicesByUserRequest {
-    /**
-     * The maximum number of items to return.
-     * The server may impose a different page size at its discretion.
-     *
-     * @generated from protobuf field: int32 page_size = 1;
-     */
-    pageSize: number;
-    /**
-     * The next_page_token value returned from a previous List request, if any.
-     *
-     * @generated from protobuf field: string page_token = 2;
-     */
-    pageToken: string;
-}
-/**
- * Response for ListDevicesByUser.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ListDevicesByUserResponse
- */
-export interface ListDevicesByUserResponse {
-    /**
-     * Devices owned by the user.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-    /**
-     * Token to retrieve the next page of results, or empty if there are no
-     * more results in the list.
-     *
-     * @generated from protobuf field: string next_page_token = 2;
-     */
-    nextPageToken: string;
-}
-/**
- * Request for BulkCreateDevices.
- *
- * @generated from protobuf message teleport.devicetrust.v1.BulkCreateDevicesRequest
- */
-export interface BulkCreateDevicesRequest {
-    /**
-     * Devices to create.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-    /**
-     * If true, create the device as a Teleport resource, meaning that fields that
-     * are usually considered read-only or system managed are copied as provided
-     * to storage.
-     * Prefer using non-resource creation semantics if possible.
-     *
-     * @generated from protobuf field: bool create_as_resource = 2;
-     */
-    createAsResource: boolean;
-}
-/**
- * Response for BulkCreateDevices.
- *
- * @generated from protobuf message teleport.devicetrust.v1.BulkCreateDevicesResponse
- */
-export interface BulkCreateDevicesResponse {
-    /**
-     * Created devices or a failure reason.
-     * Responses are sorted according to the request.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.DeviceOrStatus devices = 1;
-     */
-    devices: DeviceOrStatus[];
-}
-/**
- * DeviceOrStatus contains either a device ID, in case of success, or a status
- * in case of failures.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DeviceOrStatus
- */
-export interface DeviceOrStatus {
-    /**
-     * Status of the operation.
-     * May either be absent or contain the OK code for successes, at the
-     * implementation's discretion.
-     *
-     * @generated from protobuf field: google.rpc.Status status = 1;
-     */
-    status?: Status;
-    /**
-     * ID of the created device.
-     * Only present if the status is OK.
-     *
-     * @generated from protobuf field: string id = 2;
-     */
-    id: string;
-    /**
-     * If true the action attempted against the device was a delete, instead of a
-     * create or update.
-     *
-     * @generated from protobuf field: bool deleted = 3;
-     */
-    deleted: boolean;
-}
-/**
- * Request for CreateDeviceEnrollToken.
- *
- * @generated from protobuf message teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
- */
-export interface CreateDeviceEnrollTokenRequest {
-    /**
-     * ID of the device.
-     *
-     * @generated from protobuf field: string device_id = 1;
-     */
-    deviceId: string;
-    /**
-     * Device collected data.
-     * Used to authorize issuance of device enrollment tokens for auto-enrollment.
-     * Not required otherwise.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceCollectedData device_data = 2;
-     */
-    deviceData?: DeviceCollectedData;
-    /**
-     * Custom expiration time for enrollment tokens.
-     * A short (for humans) server default is used if unset.
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp expire_time = 3;
-     */
-    expireTime?: Timestamp;
-}
-/**
- * Request for EnrollDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.EnrollDeviceRequest
- */
-export interface EnrollDeviceRequest {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "init";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.EnrollDeviceInit init = 1;
-         */
-        init: EnrollDeviceInit;
-    } | {
-        oneofKind: "macosChallengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.MacOSEnrollChallengeResponse macos_challenge_response = 2;
-         */
-        macosChallengeResponse: MacOSEnrollChallengeResponse;
-    } | {
-        oneofKind: "tpmChallengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMEnrollChallengeResponse tpm_challenge_response = 3;
-         */
-        tpmChallengeResponse: TPMEnrollChallengeResponse;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * Response for EnrollDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.EnrollDeviceResponse
- */
-export interface EnrollDeviceResponse {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "success";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.EnrollDeviceSuccess success = 1;
-         */
-        success: EnrollDeviceSuccess;
-    } | {
-        oneofKind: "macosChallenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.MacOSEnrollChallenge macos_challenge = 2;
-         */
-        macosChallenge: MacOSEnrollChallenge;
-    } | {
-        oneofKind: "tpmChallenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMEnrollChallenge tpm_challenge = 3;
-         */
-        tpmChallenge: TPMEnrollChallenge;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * EnrollDeviceInit initiates the enrollment ceremony.
- *
- * @generated from protobuf message teleport.devicetrust.v1.EnrollDeviceInit
- */
-export interface EnrollDeviceInit {
-    /**
-     * Device enrollment token.
-     * See CreateDevice or CreateDeviceEnrollToken.
-     *
-     * @generated from protobuf field: string token = 1;
-     */
-    token: string;
-    /**
-     * ID of the device credential.
-     *
-     * @generated from protobuf field: string credential_id = 2;
-     */
-    credentialId: string;
-    /**
-     * Device collected data.
-     * Matched against the device registration information and any previously
-     * collected data.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceCollectedData device_data = 3;
-     */
-    deviceData?: DeviceCollectedData;
-    /**
-     * Payload for macOS-specific data.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.MacOSEnrollPayload macos = 4;
-     */
-    macos?: MacOSEnrollPayload;
-    /**
-     * Payload for TPM-specific data. Used for Windows/Linux.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMEnrollPayload tpm = 5;
-     */
-    tpm?: TPMEnrollPayload;
-}
-/**
- * EnrollDeviceSuccess marks a successful device enrollment ceremony.
- *
- * @generated from protobuf message teleport.devicetrust.v1.EnrollDeviceSuccess
- */
-export interface EnrollDeviceSuccess {
-    /**
-     * The enrolled device.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.Device device = 1;
-     */
-    device?: Device;
-}
-/**
- * MacOSEnrollPayload is the macOS-specific enrollment payload.
- *
- * @generated from protobuf message teleport.devicetrust.v1.MacOSEnrollPayload
- */
-export interface MacOSEnrollPayload {
-    /**
-     * Device public key marshaled as a PKIX, ASN.1 DER.
-     *
-     * @generated from protobuf field: bytes public_key_der = 2;
-     */
-    publicKeyDer: Uint8Array;
-}
-/**
- * MacOSEnrollChallenge is a macOS enrollment challenge.
- *
- * @generated from protobuf message teleport.devicetrust.v1.MacOSEnrollChallenge
- */
-export interface MacOSEnrollChallenge {
-    /**
-     * Randomly-generated, opaque challenge to be signed using the device key.
-     *
-     * @generated from protobuf field: bytes challenge = 1;
-     */
-    challenge: Uint8Array;
-}
-/**
- * MacOSEnrollChallengeResponse is a macOS enrollment challenge response.
- *
- * @generated from protobuf message teleport.devicetrust.v1.MacOSEnrollChallengeResponse
- */
-export interface MacOSEnrollChallengeResponse {
-    /**
-     * Signature over the challenge, using the device key.
-     *
-     * @generated from protobuf field: bytes signature = 2;
-     */
-    signature: Uint8Array;
-}
-/**
- * The payload containing TPM specific information required on device
- * enrollment.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMEnrollPayload
- */
-export interface TPMEnrollPayload {
-    /**
-     * @generated from protobuf oneof: ek
-     */
-    ek: {
-        oneofKind: "ekCert";
-        /**
-         * The device's endorsement certificate in X509, ASN.1 DER form. This
-         * certificate contains the public key of the endorsement key. This is
-         * preferred to ek_key.
-         *
-         * @generated from protobuf field: bytes ek_cert = 1;
-         */
-        ekCert: Uint8Array;
-    } | {
-        oneofKind: "ekKey";
-        /**
-         * The device's public endorsement key in PKIX, ASN.1 DER form. This is
-         * used when a TPM does not contain any endorsement certificates.
-         *
-         * @generated from protobuf field: bytes ek_key = 2;
-         */
-        ekKey: Uint8Array;
-    } | {
-        oneofKind: undefined;
-    };
-    /**
-     * The attestation key and the parameters necessary to remotely verify it as
-     * related to the endorsement key.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMAttestationParameters attestation_parameters = 3;
-     */
-    attestationParameters?: TPMAttestationParameters;
-}
-/**
- * The attestation key and the parameters necessary to remotely verify it as
- * related to the endorsement key.
- * See https://pkg.go.dev/github.com/google/go-attestation/attest#AttestationParameters.
- * This message excludes the `UseTCSDActivationFormat` field from the link above
- * as it is TMP 1.x specific and always false.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMAttestationParameters
- */
-export interface TPMAttestationParameters {
-    /**
-     * The encoded TPMT_PUBLIC structure containing the attestation public key
-     * and signing parameters.
-     *
-     * @generated from protobuf field: bytes public = 1;
-     */
-    public: Uint8Array;
-    /**
-     * The properties of the attestation key, encoded as a TPMS_CREATION_DATA
-     * structure.
-     *
-     * @generated from protobuf field: bytes create_data = 2;
-     */
-    createData: Uint8Array;
-    /**
-     * An assertion as to the details of the key, encoded as a TPMS_ATTEST
-     * structure.
-     *
-     * @generated from protobuf field: bytes create_attestation = 3;
-     */
-    createAttestation: Uint8Array;
-    /**
-     * A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
-     *
-     * @generated from protobuf field: bytes create_signature = 4;
-     */
-    createSignature: Uint8Array;
-}
-/**
- * The challenge sent to the client by the server during enrollment.
- * The challenge involves two parts:
- * - Solving an encrypted credential with `ActivateCredential`.
- * - Producing a platform attestation using the provided nonce.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMEnrollChallenge
- */
-export interface TPMEnrollChallenge {
-    /**
-     * The encrypted credential for the client to prove possession of the EK and
-     * AK.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMEncryptedCredential encrypted_credential = 1;
-     */
-    encryptedCredential?: TPMEncryptedCredential;
-    /**
-     * The nonce to use when producing the quotes over the PCRs with the TPM
-     * during the platform attestation.
-     *
-     * @generated from protobuf field: bytes attestation_nonce = 2;
-     */
-    attestationNonce: Uint8Array;
-}
-/**
- * These values are used by the TPM2.0 `ActivateCredential` command to produce
- * the solution which proves possession of the EK and AK.
- *
- * For a more in-depth description see:
- * - https://pkg.go.dev/github.com/google/go-attestation/attest#EncryptedCredential
- * - https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_code_pub.pdf (Heading 12.5.1 "TPM2_ActivateCredential" "General Description")
- * - https://github.com/google/go-attestation/blob/v0.4.3/attest/activation.go#L199
- * - https://github.com/google/go-tpm/blob/v0.3.3/tpm2/credactivation/credential_activation.go#L61
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMEncryptedCredential
- */
-export interface TPMEncryptedCredential {
-    /**
-     * The `credential_blob` parameter to be used with the `ActivateCredential`
-     * command. This is used with the decrypted value of `secret` in a
-     * cryptographic process to decrypt the solution.
-     *
-     * @generated from protobuf field: bytes credential_blob = 1;
-     */
-    credentialBlob: Uint8Array;
-    /**
-     * The `secret` parameter to be used with `ActivateCredential`. This is a
-     * seed which can be decrypted with the EK. The decrypted seed is then used
-     * when decrypting `credential_blob`.
-     *
-     * @generated from protobuf field: bytes secret = 2;
-     */
-    secret: Uint8Array;
-}
-/**
- * The enrollment challenge response containing the solution returned by
- * calling the TPM2.0 `ActivateCredential` command on the client with the
- * parameters provided in `TPMEnrollChallenge`.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMEnrollChallengeResponse
- */
-export interface TPMEnrollChallengeResponse {
-    /**
-     * The client's solution to `TPMEncryptedCredential` included in
-     * `TPMEnrollChallenge` using ActivateCredential.
-     *
-     * @generated from protobuf field: bytes solution = 1;
-     */
-    solution: Uint8Array;
-    /**
-     * The result of the client's platform attestation with the nonce provided
-     * in `TPMEnrollChallenge`.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 2;
-     */
-    platformParameters?: TPMPlatformParameters;
-}
-/**
- * Request for AuthenticateDevice.
- *
- * Authentication ceremony flow:
- * -> AuthenticateDeviceInit (client)
- * <- AuthenticateDeviceChallenge (server)
- * -> AuthenticateDeviceChallengeResponse
- * <- UserCertificates (regular authn) or ConfirmationToken (web authn)
- *
- * @generated from protobuf message teleport.devicetrust.v1.AuthenticateDeviceRequest
- */
-export interface AuthenticateDeviceRequest {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "init";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AuthenticateDeviceInit init = 1;
-         */
-        init: AuthenticateDeviceInit;
-    } | {
-        oneofKind: "challengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response = 2;
-         */
-        challengeResponse: AuthenticateDeviceChallengeResponse;
-    } | {
-        oneofKind: "tpmChallengeResponse";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3;
-         */
-        tpmChallengeResponse: TPMAuthenticateDeviceChallengeResponse;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * Response for AuthenticateDevice.
- *
- * @generated from protobuf message teleport.devicetrust.v1.AuthenticateDeviceResponse
- */
-export interface AuthenticateDeviceResponse {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "challenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge = 1;
-         */
-        challenge: AuthenticateDeviceChallenge;
-    } | {
-        oneofKind: "userCertificates";
-        /**
-         * User certificates are returned as the result of a successful device
-         * authentication attempt ("regular" or non-web authentication).
-         *
-         * @generated from protobuf field: teleport.devicetrust.v1.UserCertificates user_certificates = 2;
-         */
-        userCertificates: UserCertificates;
-    } | {
-        oneofKind: "tpmChallenge";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge = 3;
-         */
-        tpmChallenge: TPMAuthenticateDeviceChallenge;
-    } | {
-        oneofKind: "confirmationToken";
-        /**
-         * A confirmation token is returned as the result of a successful device web
-         * authentication.
-         *
-         * See AuthenticateDeviceInit.device_web_token.
-         *
-         * @generated from protobuf field: teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token = 4;
-         */
-        confirmationToken: DeviceConfirmationToken;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * AuthenticateDeviceInit initiates the device authentication ceremony.
- *
- * @generated from protobuf message teleport.devicetrust.v1.AuthenticateDeviceInit
- */
-export interface AuthenticateDeviceInit {
-    /**
-     * In-band user certificates to augment with device extensions.
-     * - The x509 certificate is acquired from the mTLS connection, thus the
-     *   in-band certificate is ignored.
-     * - All certificates must be valid and issued by the Teleport CA.
-     * - TLS and SSH certificates must match (same Teleport user, plus whatever
-     *   additional checks the backend sees fit).
-     * - TLS and SSH certificates must either have matching public keys, or
-     *   (TPM)AuthenticateDeviceChallengeResponse.SshSignature must be a valid
-     *   signature over the challenge by the SSH private key.
-     * - Augmented certificates have the same expiration as the original
-     *   certificates.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.UserCertificates user_certificates = 1;
-     */
-    userCertificates?: UserCertificates;
-    /**
-     * ID of the enrolled device credential.
-     *
-     * @generated from protobuf field: string credential_id = 2;
-     */
-    credentialId: string;
-    /**
-     * Device collected data.
-     * Matched against the device registration information and any previously
-     * collected data.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceCollectedData device_data = 3;
-     */
-    deviceData?: DeviceCollectedData;
-    /**
-     * If present, on-behalf-of device authentication is performed.
-     * The user_certificates input field is ignored and no certificate data is
-     * returned to the caller, instead a confirmation_token is returned in
-     * the last step.
-     *
-     * See ConfirmDeviceWebAuthentication.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceWebToken device_web_token = 4;
-     */
-    deviceWebToken?: DeviceWebToken;
-}
-/**
- * Request for ConfirmDeviceWebAuthentication.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest
- */
-export interface ConfirmDeviceWebAuthenticationRequest {
-    /**
-     * Confirmation token to be spent.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token = 1;
-     */
-    confirmationToken?: DeviceConfirmationToken;
-    /**
-     * Web Session identifier of the session that started this request, via
-     * Teleport Proxy.
-     *
-     * For the request to be successful the Web Session must match the session
-     * that started the authentication attempt.
-     *
-     * @generated from protobuf field: string current_web_session_id = 2;
-     */
-    currentWebSessionId: string;
-}
-/**
- * Response for ConfirmDeviceWebAuthentication.
- *
- * @generated from protobuf message teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse
- */
-export interface ConfirmDeviceWebAuthenticationResponse {
-}
-/**
- * Request for SyncInventory.
- *
- * A typical message sequence is as follows:
- * (-> means client-to-server, <- means server-to-client)
- * -> SyncInventoryStart
- * <- SyncInventoryAck
- * (loop)
- * -> SyncInventoryDevices (add/remove devices)
- * <- SyncInventoryResult
- * (end loop)
- * -> SyncInventoryEnd
- * (loop until server closes the stream, zero or more times)
- * <- SyncInventoryMissingDevices
- * -> SyncInventoryDevices (removals only)
- * <- SyncInventoryResult
- * (end loop)
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryRequest
- */
-export interface SyncInventoryRequest {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "start";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryStart start = 1;
-         */
-        start: SyncInventoryStart;
-    } | {
-        oneofKind: "end";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryEnd end = 2;
-         */
-        end: SyncInventoryEnd;
-    } | {
-        oneofKind: "devicesToUpsert";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryDevices devices_to_upsert = 3;
-         */
-        devicesToUpsert: SyncInventoryDevices;
-    } | {
-        oneofKind: "devicesToRemove";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryDevices devices_to_remove = 4;
-         */
-        devicesToRemove: SyncInventoryDevices;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * Response for SyncInventory.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryResponse
- */
-export interface SyncInventoryResponse {
-    /**
-     * @generated from protobuf oneof: payload
-     */
-    payload: {
-        oneofKind: "ack";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryAck ack = 1;
-         */
-        ack: SyncInventoryAck;
-    } | {
-        oneofKind: "result";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryResult result = 2;
-         */
-        result: SyncInventoryResult;
-    } | {
-        oneofKind: "missingDevices";
-        /**
-         * @generated from protobuf field: teleport.devicetrust.v1.SyncInventoryMissingDevices missing_devices = 3;
-         */
-        missingDevices: SyncInventoryMissingDevices;
-    } | {
-        oneofKind: undefined;
-    };
-}
-/**
- * SyncInventoryStart starts the inventory sync.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryStart
- */
-export interface SyncInventoryStart {
-    /**
-     * Source of the inventory sync.
-     * Used for all devices. The `source` field in individual devices is ignored
-     * by this RPC.
-     *
-     * @generated from protobuf field: teleport.devicetrust.v1.DeviceSource source = 1;
-     */
-    source?: DeviceSource;
-    /**
-     * If true, the server keeps track of the devices upserted during the sync.
-     * After receiving the [SyncInventoryEnd] message, the server informs the
-     * client of all devices that are present in storage but not observed in the
-     * upserts.
-     * See [SyncInventoryRequest] and [SyncInventoryMissingDevices] for details.
-     *
-     * @generated from protobuf field: bool track_missing_devices = 4;
-     */
-    trackMissingDevices: boolean;
-}
-/**
- * SyncInventoryEnd ends the inventory sync, signaling that no more
- * SyncInventoryDevices messages will be sent by the client.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryEnd
- */
-export interface SyncInventoryEnd {
-}
-/**
- * SyncInventoryDevices transports devices to add/update/remove.
- * Removals only need identifying fields to be set.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryDevices
- */
-export interface SyncInventoryDevices {
-    /**
-     * Devices to sync.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-}
-/**
- * SyncInventoryAck is used to confirm successful processing of messages that
- * lack a more specific response.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryAck
- */
-export interface SyncInventoryAck {
-}
-/**
- * SyncInventoryResult is the response for SyncInventoryDevices or
- * SyncInventoryEnd
- * It lists all synced/deleted devices.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryResult
- */
-export interface SyncInventoryResult {
-    /**
-     * Devices modified, in the same order as the input when applicable.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.DeviceOrStatus devices = 1;
-     */
-    devices: DeviceOrStatus[];
-}
-/**
- * SyncInventoryMissingDevices informs the sync client of all stored devices
- * that were not observed in upserts during the sync.
- *
- * Requires `track_missing_devices` to be set in the [SyncInventoryStart]
- * message.
- *
- * The client must follow up with a [SyncInventoryDevices] message, including
- * any devices to be deleted.
- *
- * @generated from protobuf message teleport.devicetrust.v1.SyncInventoryMissingDevices
- */
-export interface SyncInventoryMissingDevices {
-    /**
-     * Devices missing from the client-side sync.
-     * Guaranteed to have the following fields: id, os_type, asset_tag and
-     * profile.external_id.
-     *
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.Device devices = 1;
-     */
-    devices: Device[];
-}
-/**
- * Superseded by ResourceUsageService.GetUsage.
- *
- * @generated from protobuf message teleport.devicetrust.v1.GetDevicesUsageRequest
- */
-export interface GetDevicesUsageRequest {
-}
-/**
- * DeviceView specifies which fields of returned devices should be present.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.DeviceView
- */
-export enum DeviceView {
-    /**
-     * @generated from protobuf enum value: DEVICE_VIEW_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * View for general device listings, like `tctl devices ls`.
-     * Contains only basic information, such as IDs and enrollment status.
-     *
-     * @generated from protobuf enum value: DEVICE_VIEW_LIST = 1;
-     */
-    LIST = 1,
-    /**
-     * View for detailed device queries, like `tctl get devices`.
-     * Presents a complete view of the device.
-     *
-     * @generated from protobuf enum value: DEVICE_VIEW_RESOURCE = 2;
-     */
-    RESOURCE = 2
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class CreateDeviceRequest$Type extends MessageType<CreateDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.CreateDeviceRequest", [
-            { no: 1, name: "device", kind: "message", T: () => Device },
-            { no: 2, name: "create_enroll_token", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 3, name: "create_as_resource", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "enroll_token_expire_time", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<CreateDeviceRequest>): CreateDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.createEnrollToken = false;
-        message.createAsResource = false;
-        if (value !== undefined)
-            reflectionMergePartial<CreateDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateDeviceRequest): CreateDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.Device device */ 1:
-                    message.device = Device.internalBinaryRead(reader, reader.uint32(), options, message.device);
-                    break;
-                case /* bool create_enroll_token */ 2:
-                    message.createEnrollToken = reader.bool();
-                    break;
-                case /* bool create_as_resource */ 3:
-                    message.createAsResource = reader.bool();
-                    break;
-                case /* google.protobuf.Timestamp enroll_token_expire_time */ 4:
-                    message.enrollTokenExpireTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.enrollTokenExpireTime);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CreateDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.Device device = 1; */
-        if (message.device)
-            Device.internalBinaryWrite(message.device, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bool create_enroll_token = 2; */
-        if (message.createEnrollToken !== false)
-            writer.tag(2, WireType.Varint).bool(message.createEnrollToken);
-        /* bool create_as_resource = 3; */
-        if (message.createAsResource !== false)
-            writer.tag(3, WireType.Varint).bool(message.createAsResource);
-        /* google.protobuf.Timestamp enroll_token_expire_time = 4; */
-        if (message.enrollTokenExpireTime)
-            Timestamp.internalBinaryWrite(message.enrollTokenExpireTime, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.CreateDeviceRequest
- */
-export const CreateDeviceRequest = new CreateDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpdateDeviceRequest$Type extends MessageType<UpdateDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.UpdateDeviceRequest", [
-            { no: 1, name: "device", kind: "message", T: () => Device },
-            { no: 2, name: "update_mask", kind: "message", T: () => FieldMask }
-        ]);
-    }
-    create(value?: PartialMessage<UpdateDeviceRequest>): UpdateDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<UpdateDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateDeviceRequest): UpdateDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.Device device */ 1:
-                    message.device = Device.internalBinaryRead(reader, reader.uint32(), options, message.device);
-                    break;
-                case /* google.protobuf.FieldMask update_mask */ 2:
-                    message.updateMask = FieldMask.internalBinaryRead(reader, reader.uint32(), options, message.updateMask);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpdateDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.Device device = 1; */
-        if (message.device)
-            Device.internalBinaryWrite(message.device, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.FieldMask update_mask = 2; */
-        if (message.updateMask)
-            FieldMask.internalBinaryWrite(message.updateMask, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.UpdateDeviceRequest
- */
-export const UpdateDeviceRequest = new UpdateDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UpsertDeviceRequest$Type extends MessageType<UpsertDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.UpsertDeviceRequest", [
-            { no: 1, name: "device", kind: "message", T: () => Device },
-            { no: 2, name: "create_as_resource", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<UpsertDeviceRequest>): UpsertDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.createAsResource = false;
-        if (value !== undefined)
-            reflectionMergePartial<UpsertDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpsertDeviceRequest): UpsertDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.Device device */ 1:
-                    message.device = Device.internalBinaryRead(reader, reader.uint32(), options, message.device);
-                    break;
-                case /* bool create_as_resource */ 2:
-                    message.createAsResource = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UpsertDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.Device device = 1; */
-        if (message.device)
-            Device.internalBinaryWrite(message.device, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bool create_as_resource = 2; */
-        if (message.createAsResource !== false)
-            writer.tag(2, WireType.Varint).bool(message.createAsResource);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.UpsertDeviceRequest
- */
-export const UpsertDeviceRequest = new UpsertDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeleteDeviceRequest$Type extends MessageType<DeleteDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeleteDeviceRequest", [
-            { no: 1, name: "device_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeleteDeviceRequest>): DeleteDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.deviceId = "";
-        if (value !== undefined)
-            reflectionMergePartial<DeleteDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteDeviceRequest): DeleteDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string device_id */ 1:
-                    message.deviceId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeleteDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string device_id = 1; */
-        if (message.deviceId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.deviceId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeleteDeviceRequest
- */
-export const DeleteDeviceRequest = new DeleteDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class FindDevicesRequest$Type extends MessageType<FindDevicesRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.FindDevicesRequest", [
-            { no: 1, name: "id_or_tag", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<FindDevicesRequest>): FindDevicesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.idOrTag = "";
-        if (value !== undefined)
-            reflectionMergePartial<FindDevicesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FindDevicesRequest): FindDevicesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id_or_tag */ 1:
-                    message.idOrTag = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: FindDevicesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id_or_tag = 1; */
-        if (message.idOrTag !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.idOrTag);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.FindDevicesRequest
- */
-export const FindDevicesRequest = new FindDevicesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class FindDevicesResponse$Type extends MessageType<FindDevicesResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.FindDevicesResponse", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device }
-        ]);
-    }
-    create(value?: PartialMessage<FindDevicesResponse>): FindDevicesResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        if (value !== undefined)
-            reflectionMergePartial<FindDevicesResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FindDevicesResponse): FindDevicesResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: FindDevicesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.FindDevicesResponse
- */
-export const FindDevicesResponse = new FindDevicesResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetDeviceRequest$Type extends MessageType<GetDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.GetDeviceRequest", [
-            { no: 1, name: "device_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetDeviceRequest>): GetDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.deviceId = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetDeviceRequest): GetDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string device_id */ 1:
-                    message.deviceId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string device_id = 1; */
-        if (message.deviceId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.deviceId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.GetDeviceRequest
- */
-export const GetDeviceRequest = new GetDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListDevicesRequest$Type extends MessageType<ListDevicesRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.ListDevicesRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "view", kind: "enum", T: () => ["teleport.devicetrust.v1.DeviceView", DeviceView, "DEVICE_VIEW_"] }
-        ]);
-    }
-    create(value?: PartialMessage<ListDevicesRequest>): ListDevicesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.pageToken = "";
-        message.view = 0;
-        if (value !== undefined)
-            reflectionMergePartial<ListDevicesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDevicesRequest): ListDevicesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string page_token */ 2:
-                    message.pageToken = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceView view */ 3:
-                    message.view = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListDevicesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 2; */
-        if (message.pageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
-        /* teleport.devicetrust.v1.DeviceView view = 3; */
-        if (message.view !== 0)
-            writer.tag(3, WireType.Varint).int32(message.view);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ListDevicesRequest
- */
-export const ListDevicesRequest = new ListDevicesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListDevicesResponse$Type extends MessageType<ListDevicesResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.ListDevicesResponse", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListDevicesResponse>): ListDevicesResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        message.nextPageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListDevicesResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDevicesResponse): ListDevicesResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListDevicesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ListDevicesResponse
- */
-export const ListDevicesResponse = new ListDevicesResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListDevicesByUserRequest$Type extends MessageType<ListDevicesByUserRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.ListDevicesByUserRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListDevicesByUserRequest>): ListDevicesByUserRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.pageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListDevicesByUserRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDevicesByUserRequest): ListDevicesByUserRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string page_token */ 2:
-                    message.pageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListDevicesByUserRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 2; */
-        if (message.pageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ListDevicesByUserRequest
- */
-export const ListDevicesByUserRequest = new ListDevicesByUserRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListDevicesByUserResponse$Type extends MessageType<ListDevicesByUserResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.ListDevicesByUserResponse", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ListDevicesByUserResponse>): ListDevicesByUserResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        message.nextPageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<ListDevicesByUserResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDevicesByUserResponse): ListDevicesByUserResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListDevicesByUserResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ListDevicesByUserResponse
- */
-export const ListDevicesByUserResponse = new ListDevicesByUserResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class BulkCreateDevicesRequest$Type extends MessageType<BulkCreateDevicesRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.BulkCreateDevicesRequest", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device },
-            { no: 2, name: "create_as_resource", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<BulkCreateDevicesRequest>): BulkCreateDevicesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        message.createAsResource = false;
-        if (value !== undefined)
-            reflectionMergePartial<BulkCreateDevicesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BulkCreateDevicesRequest): BulkCreateDevicesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* bool create_as_resource */ 2:
-                    message.createAsResource = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: BulkCreateDevicesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bool create_as_resource = 2; */
-        if (message.createAsResource !== false)
-            writer.tag(2, WireType.Varint).bool(message.createAsResource);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.BulkCreateDevicesRequest
- */
-export const BulkCreateDevicesRequest = new BulkCreateDevicesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class BulkCreateDevicesResponse$Type extends MessageType<BulkCreateDevicesResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.BulkCreateDevicesResponse", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => DeviceOrStatus }
-        ]);
-    }
-    create(value?: PartialMessage<BulkCreateDevicesResponse>): BulkCreateDevicesResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        if (value !== undefined)
-            reflectionMergePartial<BulkCreateDevicesResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BulkCreateDevicesResponse): BulkCreateDevicesResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.DeviceOrStatus devices */ 1:
-                    message.devices.push(DeviceOrStatus.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: BulkCreateDevicesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.DeviceOrStatus devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            DeviceOrStatus.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.BulkCreateDevicesResponse
- */
-export const BulkCreateDevicesResponse = new BulkCreateDevicesResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class DeviceOrStatus$Type extends MessageType<DeviceOrStatus> {
-    constructor() {
-        super("teleport.devicetrust.v1.DeviceOrStatus", [
-            { no: 1, name: "status", kind: "message", T: () => Status },
-            { no: 2, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "deleted", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<DeviceOrStatus>): DeviceOrStatus {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.deleted = false;
-        if (value !== undefined)
-            reflectionMergePartial<DeviceOrStatus>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeviceOrStatus): DeviceOrStatus {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* google.rpc.Status status */ 1:
-                    message.status = Status.internalBinaryRead(reader, reader.uint32(), options, message.status);
-                    break;
-                case /* string id */ 2:
-                    message.id = reader.string();
-                    break;
-                case /* bool deleted */ 3:
-                    message.deleted = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: DeviceOrStatus, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* google.rpc.Status status = 1; */
-        if (message.status)
-            Status.internalBinaryWrite(message.status, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string id = 2; */
-        if (message.id !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.id);
-        /* bool deleted = 3; */
-        if (message.deleted !== false)
-            writer.tag(3, WireType.Varint).bool(message.deleted);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DeviceOrStatus
- */
-export const DeviceOrStatus = new DeviceOrStatus$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CreateDeviceEnrollTokenRequest$Type extends MessageType<CreateDeviceEnrollTokenRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest", [
-            { no: 1, name: "device_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "device_data", kind: "message", T: () => DeviceCollectedData },
-            { no: 3, name: "expire_time", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<CreateDeviceEnrollTokenRequest>): CreateDeviceEnrollTokenRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.deviceId = "";
-        if (value !== undefined)
-            reflectionMergePartial<CreateDeviceEnrollTokenRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateDeviceEnrollTokenRequest): CreateDeviceEnrollTokenRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string device_id */ 1:
-                    message.deviceId = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceCollectedData device_data */ 2:
-                    message.deviceData = DeviceCollectedData.internalBinaryRead(reader, reader.uint32(), options, message.deviceData);
-                    break;
-                case /* google.protobuf.Timestamp expire_time */ 3:
-                    message.expireTime = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expireTime);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CreateDeviceEnrollTokenRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string device_id = 1; */
-        if (message.deviceId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.deviceId);
-        /* teleport.devicetrust.v1.DeviceCollectedData device_data = 2; */
-        if (message.deviceData)
-            DeviceCollectedData.internalBinaryWrite(message.deviceData, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp expire_time = 3; */
-        if (message.expireTime)
-            Timestamp.internalBinaryWrite(message.expireTime, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
- */
-export const CreateDeviceEnrollTokenRequest = new CreateDeviceEnrollTokenRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EnrollDeviceRequest$Type extends MessageType<EnrollDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.EnrollDeviceRequest", [
-            { no: 1, name: "init", kind: "message", oneof: "payload", T: () => EnrollDeviceInit },
-            { no: 2, name: "macos_challenge_response", kind: "message", oneof: "payload", T: () => MacOSEnrollChallengeResponse },
-            { no: 3, name: "tpm_challenge_response", kind: "message", oneof: "payload", T: () => TPMEnrollChallengeResponse }
-        ]);
-    }
-    create(value?: PartialMessage<EnrollDeviceRequest>): EnrollDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<EnrollDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EnrollDeviceRequest): EnrollDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.EnrollDeviceInit init */ 1:
-                    message.payload = {
-                        oneofKind: "init",
-                        init: EnrollDeviceInit.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).init)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.MacOSEnrollChallengeResponse macos_challenge_response */ 2:
-                    message.payload = {
-                        oneofKind: "macosChallengeResponse",
-                        macosChallengeResponse: MacOSEnrollChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).macosChallengeResponse)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMEnrollChallengeResponse tpm_challenge_response */ 3:
-                    message.payload = {
-                        oneofKind: "tpmChallengeResponse",
-                        tpmChallengeResponse: TPMEnrollChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallengeResponse)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EnrollDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.EnrollDeviceInit init = 1; */
-        if (message.payload.oneofKind === "init")
-            EnrollDeviceInit.internalBinaryWrite(message.payload.init, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.MacOSEnrollChallengeResponse macos_challenge_response = 2; */
-        if (message.payload.oneofKind === "macosChallengeResponse")
-            MacOSEnrollChallengeResponse.internalBinaryWrite(message.payload.macosChallengeResponse, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMEnrollChallengeResponse tpm_challenge_response = 3; */
-        if (message.payload.oneofKind === "tpmChallengeResponse")
-            TPMEnrollChallengeResponse.internalBinaryWrite(message.payload.tpmChallengeResponse, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.EnrollDeviceRequest
- */
-export const EnrollDeviceRequest = new EnrollDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EnrollDeviceResponse$Type extends MessageType<EnrollDeviceResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.EnrollDeviceResponse", [
-            { no: 1, name: "success", kind: "message", oneof: "payload", T: () => EnrollDeviceSuccess },
-            { no: 2, name: "macos_challenge", kind: "message", oneof: "payload", T: () => MacOSEnrollChallenge },
-            { no: 3, name: "tpm_challenge", kind: "message", oneof: "payload", T: () => TPMEnrollChallenge }
-        ]);
-    }
-    create(value?: PartialMessage<EnrollDeviceResponse>): EnrollDeviceResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<EnrollDeviceResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EnrollDeviceResponse): EnrollDeviceResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.EnrollDeviceSuccess success */ 1:
-                    message.payload = {
-                        oneofKind: "success",
-                        success: EnrollDeviceSuccess.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).success)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.MacOSEnrollChallenge macos_challenge */ 2:
-                    message.payload = {
-                        oneofKind: "macosChallenge",
-                        macosChallenge: MacOSEnrollChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).macosChallenge)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMEnrollChallenge tpm_challenge */ 3:
-                    message.payload = {
-                        oneofKind: "tpmChallenge",
-                        tpmChallenge: TPMEnrollChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallenge)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EnrollDeviceResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.EnrollDeviceSuccess success = 1; */
-        if (message.payload.oneofKind === "success")
-            EnrollDeviceSuccess.internalBinaryWrite(message.payload.success, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.MacOSEnrollChallenge macos_challenge = 2; */
-        if (message.payload.oneofKind === "macosChallenge")
-            MacOSEnrollChallenge.internalBinaryWrite(message.payload.macosChallenge, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMEnrollChallenge tpm_challenge = 3; */
-        if (message.payload.oneofKind === "tpmChallenge")
-            TPMEnrollChallenge.internalBinaryWrite(message.payload.tpmChallenge, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.EnrollDeviceResponse
- */
-export const EnrollDeviceResponse = new EnrollDeviceResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EnrollDeviceInit$Type extends MessageType<EnrollDeviceInit> {
-    constructor() {
-        super("teleport.devicetrust.v1.EnrollDeviceInit", [
-            { no: 1, name: "token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "credential_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "device_data", kind: "message", T: () => DeviceCollectedData },
-            { no: 4, name: "macos", kind: "message", T: () => MacOSEnrollPayload },
-            { no: 5, name: "tpm", kind: "message", T: () => TPMEnrollPayload }
-        ]);
-    }
-    create(value?: PartialMessage<EnrollDeviceInit>): EnrollDeviceInit {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.token = "";
-        message.credentialId = "";
-        if (value !== undefined)
-            reflectionMergePartial<EnrollDeviceInit>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EnrollDeviceInit): EnrollDeviceInit {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string token */ 1:
-                    message.token = reader.string();
-                    break;
-                case /* string credential_id */ 2:
-                    message.credentialId = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceCollectedData device_data */ 3:
-                    message.deviceData = DeviceCollectedData.internalBinaryRead(reader, reader.uint32(), options, message.deviceData);
-                    break;
-                case /* teleport.devicetrust.v1.MacOSEnrollPayload macos */ 4:
-                    message.macos = MacOSEnrollPayload.internalBinaryRead(reader, reader.uint32(), options, message.macos);
-                    break;
-                case /* teleport.devicetrust.v1.TPMEnrollPayload tpm */ 5:
-                    message.tpm = TPMEnrollPayload.internalBinaryRead(reader, reader.uint32(), options, message.tpm);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EnrollDeviceInit, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string token = 1; */
-        if (message.token !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.token);
-        /* string credential_id = 2; */
-        if (message.credentialId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.credentialId);
-        /* teleport.devicetrust.v1.DeviceCollectedData device_data = 3; */
-        if (message.deviceData)
-            DeviceCollectedData.internalBinaryWrite(message.deviceData, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.MacOSEnrollPayload macos = 4; */
-        if (message.macos)
-            MacOSEnrollPayload.internalBinaryWrite(message.macos, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMEnrollPayload tpm = 5; */
-        if (message.tpm)
-            TPMEnrollPayload.internalBinaryWrite(message.tpm, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.EnrollDeviceInit
- */
-export const EnrollDeviceInit = new EnrollDeviceInit$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EnrollDeviceSuccess$Type extends MessageType<EnrollDeviceSuccess> {
-    constructor() {
-        super("teleport.devicetrust.v1.EnrollDeviceSuccess", [
-            { no: 1, name: "device", kind: "message", T: () => Device }
-        ]);
-    }
-    create(value?: PartialMessage<EnrollDeviceSuccess>): EnrollDeviceSuccess {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<EnrollDeviceSuccess>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EnrollDeviceSuccess): EnrollDeviceSuccess {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.Device device */ 1:
-                    message.device = Device.internalBinaryRead(reader, reader.uint32(), options, message.device);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EnrollDeviceSuccess, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.Device device = 1; */
-        if (message.device)
-            Device.internalBinaryWrite(message.device, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.EnrollDeviceSuccess
- */
-export const EnrollDeviceSuccess = new EnrollDeviceSuccess$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class MacOSEnrollPayload$Type extends MessageType<MacOSEnrollPayload> {
-    constructor() {
-        super("teleport.devicetrust.v1.MacOSEnrollPayload", [
-            { no: 2, name: "public_key_der", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<MacOSEnrollPayload>): MacOSEnrollPayload {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.publicKeyDer = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<MacOSEnrollPayload>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: MacOSEnrollPayload): MacOSEnrollPayload {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes public_key_der */ 2:
-                    message.publicKeyDer = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: MacOSEnrollPayload, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes public_key_der = 2; */
-        if (message.publicKeyDer.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.publicKeyDer);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.MacOSEnrollPayload
- */
-export const MacOSEnrollPayload = new MacOSEnrollPayload$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class MacOSEnrollChallenge$Type extends MessageType<MacOSEnrollChallenge> {
-    constructor() {
-        super("teleport.devicetrust.v1.MacOSEnrollChallenge", [
-            { no: 1, name: "challenge", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<MacOSEnrollChallenge>): MacOSEnrollChallenge {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.challenge = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<MacOSEnrollChallenge>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: MacOSEnrollChallenge): MacOSEnrollChallenge {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes challenge */ 1:
-                    message.challenge = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: MacOSEnrollChallenge, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes challenge = 1; */
-        if (message.challenge.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.challenge);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.MacOSEnrollChallenge
- */
-export const MacOSEnrollChallenge = new MacOSEnrollChallenge$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class MacOSEnrollChallengeResponse$Type extends MessageType<MacOSEnrollChallengeResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.MacOSEnrollChallengeResponse", [
-            { no: 2, name: "signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<MacOSEnrollChallengeResponse>): MacOSEnrollChallengeResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.signature = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<MacOSEnrollChallengeResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: MacOSEnrollChallengeResponse): MacOSEnrollChallengeResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes signature */ 2:
-                    message.signature = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: MacOSEnrollChallengeResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes signature = 2; */
-        if (message.signature.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.signature);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.MacOSEnrollChallengeResponse
- */
-export const MacOSEnrollChallengeResponse = new MacOSEnrollChallengeResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMEnrollPayload$Type extends MessageType<TPMEnrollPayload> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMEnrollPayload", [
-            { no: 1, name: "ek_cert", kind: "scalar", oneof: "ek", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "ek_key", kind: "scalar", oneof: "ek", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "attestation_parameters", kind: "message", T: () => TPMAttestationParameters }
-        ]);
-    }
-    create(value?: PartialMessage<TPMEnrollPayload>): TPMEnrollPayload {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.ek = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<TPMEnrollPayload>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMEnrollPayload): TPMEnrollPayload {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes ek_cert */ 1:
-                    message.ek = {
-                        oneofKind: "ekCert",
-                        ekCert: reader.bytes()
-                    };
-                    break;
-                case /* bytes ek_key */ 2:
-                    message.ek = {
-                        oneofKind: "ekKey",
-                        ekKey: reader.bytes()
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMAttestationParameters attestation_parameters */ 3:
-                    message.attestationParameters = TPMAttestationParameters.internalBinaryRead(reader, reader.uint32(), options, message.attestationParameters);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMEnrollPayload, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes ek_cert = 1; */
-        if (message.ek.oneofKind === "ekCert")
-            writer.tag(1, WireType.LengthDelimited).bytes(message.ek.ekCert);
-        /* bytes ek_key = 2; */
-        if (message.ek.oneofKind === "ekKey")
-            writer.tag(2, WireType.LengthDelimited).bytes(message.ek.ekKey);
-        /* teleport.devicetrust.v1.TPMAttestationParameters attestation_parameters = 3; */
-        if (message.attestationParameters)
-            TPMAttestationParameters.internalBinaryWrite(message.attestationParameters, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMEnrollPayload
- */
-export const TPMEnrollPayload = new TPMEnrollPayload$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMAttestationParameters$Type extends MessageType<TPMAttestationParameters> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMAttestationParameters", [
-            { no: 1, name: "public", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "create_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "create_attestation", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "create_signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMAttestationParameters>): TPMAttestationParameters {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.public = new Uint8Array(0);
-        message.createData = new Uint8Array(0);
-        message.createAttestation = new Uint8Array(0);
-        message.createSignature = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMAttestationParameters>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMAttestationParameters): TPMAttestationParameters {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes public */ 1:
-                    message.public = reader.bytes();
-                    break;
-                case /* bytes create_data */ 2:
-                    message.createData = reader.bytes();
-                    break;
-                case /* bytes create_attestation */ 3:
-                    message.createAttestation = reader.bytes();
-                    break;
-                case /* bytes create_signature */ 4:
-                    message.createSignature = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMAttestationParameters, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes public = 1; */
-        if (message.public.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.public);
-        /* bytes create_data = 2; */
-        if (message.createData.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.createData);
-        /* bytes create_attestation = 3; */
-        if (message.createAttestation.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.createAttestation);
-        /* bytes create_signature = 4; */
-        if (message.createSignature.length)
-            writer.tag(4, WireType.LengthDelimited).bytes(message.createSignature);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMAttestationParameters
- */
-export const TPMAttestationParameters = new TPMAttestationParameters$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMEnrollChallenge$Type extends MessageType<TPMEnrollChallenge> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMEnrollChallenge", [
-            { no: 1, name: "encrypted_credential", kind: "message", T: () => TPMEncryptedCredential },
-            { no: 2, name: "attestation_nonce", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMEnrollChallenge>): TPMEnrollChallenge {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.attestationNonce = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMEnrollChallenge>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMEnrollChallenge): TPMEnrollChallenge {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.TPMEncryptedCredential encrypted_credential */ 1:
-                    message.encryptedCredential = TPMEncryptedCredential.internalBinaryRead(reader, reader.uint32(), options, message.encryptedCredential);
-                    break;
-                case /* bytes attestation_nonce */ 2:
-                    message.attestationNonce = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMEnrollChallenge, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.TPMEncryptedCredential encrypted_credential = 1; */
-        if (message.encryptedCredential)
-            TPMEncryptedCredential.internalBinaryWrite(message.encryptedCredential, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bytes attestation_nonce = 2; */
-        if (message.attestationNonce.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.attestationNonce);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMEnrollChallenge
- */
-export const TPMEnrollChallenge = new TPMEnrollChallenge$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMEncryptedCredential$Type extends MessageType<TPMEncryptedCredential> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMEncryptedCredential", [
-            { no: 1, name: "credential_blob", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "secret", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMEncryptedCredential>): TPMEncryptedCredential {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.credentialBlob = new Uint8Array(0);
-        message.secret = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMEncryptedCredential>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMEncryptedCredential): TPMEncryptedCredential {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes credential_blob */ 1:
-                    message.credentialBlob = reader.bytes();
-                    break;
-                case /* bytes secret */ 2:
-                    message.secret = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMEncryptedCredential, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes credential_blob = 1; */
-        if (message.credentialBlob.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.credentialBlob);
-        /* bytes secret = 2; */
-        if (message.secret.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.secret);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMEncryptedCredential
- */
-export const TPMEncryptedCredential = new TPMEncryptedCredential$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMEnrollChallengeResponse$Type extends MessageType<TPMEnrollChallengeResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMEnrollChallengeResponse", [
-            { no: 1, name: "solution", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "platform_parameters", kind: "message", T: () => TPMPlatformParameters }
-        ]);
-    }
-    create(value?: PartialMessage<TPMEnrollChallengeResponse>): TPMEnrollChallengeResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.solution = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMEnrollChallengeResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMEnrollChallengeResponse): TPMEnrollChallengeResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes solution */ 1:
-                    message.solution = reader.bytes();
-                    break;
-                case /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters */ 2:
-                    message.platformParameters = TPMPlatformParameters.internalBinaryRead(reader, reader.uint32(), options, message.platformParameters);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMEnrollChallengeResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes solution = 1; */
-        if (message.solution.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.solution);
-        /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 2; */
-        if (message.platformParameters)
-            TPMPlatformParameters.internalBinaryWrite(message.platformParameters, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMEnrollChallengeResponse
- */
-export const TPMEnrollChallengeResponse = new TPMEnrollChallengeResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AuthenticateDeviceRequest$Type extends MessageType<AuthenticateDeviceRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.AuthenticateDeviceRequest", [
-            { no: 1, name: "init", kind: "message", oneof: "payload", T: () => AuthenticateDeviceInit },
-            { no: 2, name: "challenge_response", kind: "message", oneof: "payload", T: () => AuthenticateDeviceChallengeResponse },
-            { no: 3, name: "tpm_challenge_response", kind: "message", oneof: "payload", T: () => TPMAuthenticateDeviceChallengeResponse }
-        ]);
-    }
-    create(value?: PartialMessage<AuthenticateDeviceRequest>): AuthenticateDeviceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<AuthenticateDeviceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AuthenticateDeviceRequest): AuthenticateDeviceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.AuthenticateDeviceInit init */ 1:
-                    message.payload = {
-                        oneofKind: "init",
-                        init: AuthenticateDeviceInit.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).init)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response */ 2:
-                    message.payload = {
-                        oneofKind: "challengeResponse",
-                        challengeResponse: AuthenticateDeviceChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).challengeResponse)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response */ 3:
-                    message.payload = {
-                        oneofKind: "tpmChallengeResponse",
-                        tpmChallengeResponse: TPMAuthenticateDeviceChallengeResponse.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallengeResponse)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AuthenticateDeviceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.AuthenticateDeviceInit init = 1; */
-        if (message.payload.oneofKind === "init")
-            AuthenticateDeviceInit.internalBinaryWrite(message.payload.init, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse challenge_response = 2; */
-        if (message.payload.oneofKind === "challengeResponse")
-            AuthenticateDeviceChallengeResponse.internalBinaryWrite(message.payload.challengeResponse, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3; */
-        if (message.payload.oneofKind === "tpmChallengeResponse")
-            TPMAuthenticateDeviceChallengeResponse.internalBinaryWrite(message.payload.tpmChallengeResponse, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AuthenticateDeviceRequest
- */
-export const AuthenticateDeviceRequest = new AuthenticateDeviceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AuthenticateDeviceResponse$Type extends MessageType<AuthenticateDeviceResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.AuthenticateDeviceResponse", [
-            { no: 1, name: "challenge", kind: "message", oneof: "payload", T: () => AuthenticateDeviceChallenge },
-            { no: 2, name: "user_certificates", kind: "message", oneof: "payload", T: () => UserCertificates },
-            { no: 3, name: "tpm_challenge", kind: "message", oneof: "payload", T: () => TPMAuthenticateDeviceChallenge },
-            { no: 4, name: "confirmation_token", kind: "message", oneof: "payload", T: () => DeviceConfirmationToken }
-        ]);
-    }
-    create(value?: PartialMessage<AuthenticateDeviceResponse>): AuthenticateDeviceResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<AuthenticateDeviceResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AuthenticateDeviceResponse): AuthenticateDeviceResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge */ 1:
-                    message.payload = {
-                        oneofKind: "challenge",
-                        challenge: AuthenticateDeviceChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).challenge)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.UserCertificates user_certificates */ 2:
-                    message.payload = {
-                        oneofKind: "userCertificates",
-                        userCertificates: UserCertificates.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).userCertificates)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge */ 3:
-                    message.payload = {
-                        oneofKind: "tpmChallenge",
-                        tpmChallenge: TPMAuthenticateDeviceChallenge.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).tpmChallenge)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token */ 4:
-                    message.payload = {
-                        oneofKind: "confirmationToken",
-                        confirmationToken: DeviceConfirmationToken.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).confirmationToken)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AuthenticateDeviceResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.AuthenticateDeviceChallenge challenge = 1; */
-        if (message.payload.oneofKind === "challenge")
-            AuthenticateDeviceChallenge.internalBinaryWrite(message.payload.challenge, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.UserCertificates user_certificates = 2; */
-        if (message.payload.oneofKind === "userCertificates")
-            UserCertificates.internalBinaryWrite(message.payload.userCertificates, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge tpm_challenge = 3; */
-        if (message.payload.oneofKind === "tpmChallenge")
-            TPMAuthenticateDeviceChallenge.internalBinaryWrite(message.payload.tpmChallenge, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token = 4; */
-        if (message.payload.oneofKind === "confirmationToken")
-            DeviceConfirmationToken.internalBinaryWrite(message.payload.confirmationToken, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AuthenticateDeviceResponse
- */
-export const AuthenticateDeviceResponse = new AuthenticateDeviceResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AuthenticateDeviceInit$Type extends MessageType<AuthenticateDeviceInit> {
-    constructor() {
-        super("teleport.devicetrust.v1.AuthenticateDeviceInit", [
-            { no: 1, name: "user_certificates", kind: "message", T: () => UserCertificates },
-            { no: 2, name: "credential_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "device_data", kind: "message", T: () => DeviceCollectedData },
-            { no: 4, name: "device_web_token", kind: "message", T: () => DeviceWebToken }
-        ]);
-    }
-    create(value?: PartialMessage<AuthenticateDeviceInit>): AuthenticateDeviceInit {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.credentialId = "";
-        if (value !== undefined)
-            reflectionMergePartial<AuthenticateDeviceInit>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AuthenticateDeviceInit): AuthenticateDeviceInit {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.UserCertificates user_certificates */ 1:
-                    message.userCertificates = UserCertificates.internalBinaryRead(reader, reader.uint32(), options, message.userCertificates);
-                    break;
-                case /* string credential_id */ 2:
-                    message.credentialId = reader.string();
-                    break;
-                case /* teleport.devicetrust.v1.DeviceCollectedData device_data */ 3:
-                    message.deviceData = DeviceCollectedData.internalBinaryRead(reader, reader.uint32(), options, message.deviceData);
-                    break;
-                case /* teleport.devicetrust.v1.DeviceWebToken device_web_token */ 4:
-                    message.deviceWebToken = DeviceWebToken.internalBinaryRead(reader, reader.uint32(), options, message.deviceWebToken);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AuthenticateDeviceInit, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.UserCertificates user_certificates = 1; */
-        if (message.userCertificates)
-            UserCertificates.internalBinaryWrite(message.userCertificates, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string credential_id = 2; */
-        if (message.credentialId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.credentialId);
-        /* teleport.devicetrust.v1.DeviceCollectedData device_data = 3; */
-        if (message.deviceData)
-            DeviceCollectedData.internalBinaryWrite(message.deviceData, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.DeviceWebToken device_web_token = 4; */
-        if (message.deviceWebToken)
-            DeviceWebToken.internalBinaryWrite(message.deviceWebToken, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.AuthenticateDeviceInit
- */
-export const AuthenticateDeviceInit = new AuthenticateDeviceInit$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ConfirmDeviceWebAuthenticationRequest$Type extends MessageType<ConfirmDeviceWebAuthenticationRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest", [
-            { no: 1, name: "confirmation_token", kind: "message", T: () => DeviceConfirmationToken },
-            { no: 2, name: "current_web_session_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ConfirmDeviceWebAuthenticationRequest>): ConfirmDeviceWebAuthenticationRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.currentWebSessionId = "";
-        if (value !== undefined)
-            reflectionMergePartial<ConfirmDeviceWebAuthenticationRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ConfirmDeviceWebAuthenticationRequest): ConfirmDeviceWebAuthenticationRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token */ 1:
-                    message.confirmationToken = DeviceConfirmationToken.internalBinaryRead(reader, reader.uint32(), options, message.confirmationToken);
-                    break;
-                case /* string current_web_session_id */ 2:
-                    message.currentWebSessionId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ConfirmDeviceWebAuthenticationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.DeviceConfirmationToken confirmation_token = 1; */
-        if (message.confirmationToken)
-            DeviceConfirmationToken.internalBinaryWrite(message.confirmationToken, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string current_web_session_id = 2; */
-        if (message.currentWebSessionId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.currentWebSessionId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationRequest
- */
-export const ConfirmDeviceWebAuthenticationRequest = new ConfirmDeviceWebAuthenticationRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ConfirmDeviceWebAuthenticationResponse$Type extends MessageType<ConfirmDeviceWebAuthenticationResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse", []);
-    }
-    create(value?: PartialMessage<ConfirmDeviceWebAuthenticationResponse>): ConfirmDeviceWebAuthenticationResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<ConfirmDeviceWebAuthenticationResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ConfirmDeviceWebAuthenticationResponse): ConfirmDeviceWebAuthenticationResponse {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: ConfirmDeviceWebAuthenticationResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.ConfirmDeviceWebAuthenticationResponse
- */
-export const ConfirmDeviceWebAuthenticationResponse = new ConfirmDeviceWebAuthenticationResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryRequest$Type extends MessageType<SyncInventoryRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryRequest", [
-            { no: 1, name: "start", kind: "message", oneof: "payload", T: () => SyncInventoryStart },
-            { no: 2, name: "end", kind: "message", oneof: "payload", T: () => SyncInventoryEnd },
-            { no: 3, name: "devices_to_upsert", kind: "message", oneof: "payload", T: () => SyncInventoryDevices },
-            { no: 4, name: "devices_to_remove", kind: "message", oneof: "payload", T: () => SyncInventoryDevices }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryRequest>): SyncInventoryRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryRequest): SyncInventoryRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.SyncInventoryStart start */ 1:
-                    message.payload = {
-                        oneofKind: "start",
-                        start: SyncInventoryStart.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).start)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.SyncInventoryEnd end */ 2:
-                    message.payload = {
-                        oneofKind: "end",
-                        end: SyncInventoryEnd.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).end)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.SyncInventoryDevices devices_to_upsert */ 3:
-                    message.payload = {
-                        oneofKind: "devicesToUpsert",
-                        devicesToUpsert: SyncInventoryDevices.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).devicesToUpsert)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.SyncInventoryDevices devices_to_remove */ 4:
-                    message.payload = {
-                        oneofKind: "devicesToRemove",
-                        devicesToRemove: SyncInventoryDevices.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).devicesToRemove)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.SyncInventoryStart start = 1; */
-        if (message.payload.oneofKind === "start")
-            SyncInventoryStart.internalBinaryWrite(message.payload.start, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.SyncInventoryEnd end = 2; */
-        if (message.payload.oneofKind === "end")
-            SyncInventoryEnd.internalBinaryWrite(message.payload.end, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.SyncInventoryDevices devices_to_upsert = 3; */
-        if (message.payload.oneofKind === "devicesToUpsert")
-            SyncInventoryDevices.internalBinaryWrite(message.payload.devicesToUpsert, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.SyncInventoryDevices devices_to_remove = 4; */
-        if (message.payload.oneofKind === "devicesToRemove")
-            SyncInventoryDevices.internalBinaryWrite(message.payload.devicesToRemove, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryRequest
- */
-export const SyncInventoryRequest = new SyncInventoryRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryResponse$Type extends MessageType<SyncInventoryResponse> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryResponse", [
-            { no: 1, name: "ack", kind: "message", oneof: "payload", T: () => SyncInventoryAck },
-            { no: 2, name: "result", kind: "message", oneof: "payload", T: () => SyncInventoryResult },
-            { no: 3, name: "missing_devices", kind: "message", oneof: "payload", T: () => SyncInventoryMissingDevices }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryResponse>): SyncInventoryResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.payload = { oneofKind: undefined };
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryResponse): SyncInventoryResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.SyncInventoryAck ack */ 1:
-                    message.payload = {
-                        oneofKind: "ack",
-                        ack: SyncInventoryAck.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).ack)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.SyncInventoryResult result */ 2:
-                    message.payload = {
-                        oneofKind: "result",
-                        result: SyncInventoryResult.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).result)
-                    };
-                    break;
-                case /* teleport.devicetrust.v1.SyncInventoryMissingDevices missing_devices */ 3:
-                    message.payload = {
-                        oneofKind: "missingDevices",
-                        missingDevices: SyncInventoryMissingDevices.internalBinaryRead(reader, reader.uint32(), options, (message.payload as any).missingDevices)
-                    };
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.SyncInventoryAck ack = 1; */
-        if (message.payload.oneofKind === "ack")
-            SyncInventoryAck.internalBinaryWrite(message.payload.ack, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.SyncInventoryResult result = 2; */
-        if (message.payload.oneofKind === "result")
-            SyncInventoryResult.internalBinaryWrite(message.payload.result, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* teleport.devicetrust.v1.SyncInventoryMissingDevices missing_devices = 3; */
-        if (message.payload.oneofKind === "missingDevices")
-            SyncInventoryMissingDevices.internalBinaryWrite(message.payload.missingDevices, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryResponse
- */
-export const SyncInventoryResponse = new SyncInventoryResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryStart$Type extends MessageType<SyncInventoryStart> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryStart", [
-            { no: 1, name: "source", kind: "message", T: () => DeviceSource },
-            { no: 4, name: "track_missing_devices", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryStart>): SyncInventoryStart {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.trackMissingDevices = false;
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryStart>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryStart): SyncInventoryStart {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* teleport.devicetrust.v1.DeviceSource source */ 1:
-                    message.source = DeviceSource.internalBinaryRead(reader, reader.uint32(), options, message.source);
-                    break;
-                case /* bool track_missing_devices */ 4:
-                    message.trackMissingDevices = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryStart, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* teleport.devicetrust.v1.DeviceSource source = 1; */
-        if (message.source)
-            DeviceSource.internalBinaryWrite(message.source, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* bool track_missing_devices = 4; */
-        if (message.trackMissingDevices !== false)
-            writer.tag(4, WireType.Varint).bool(message.trackMissingDevices);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryStart
- */
-export const SyncInventoryStart = new SyncInventoryStart$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryEnd$Type extends MessageType<SyncInventoryEnd> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryEnd", []);
-    }
-    create(value?: PartialMessage<SyncInventoryEnd>): SyncInventoryEnd {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryEnd>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryEnd): SyncInventoryEnd {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: SyncInventoryEnd, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryEnd
- */
-export const SyncInventoryEnd = new SyncInventoryEnd$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryDevices$Type extends MessageType<SyncInventoryDevices> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryDevices", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryDevices>): SyncInventoryDevices {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryDevices>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryDevices): SyncInventoryDevices {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryDevices, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryDevices
- */
-export const SyncInventoryDevices = new SyncInventoryDevices$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryAck$Type extends MessageType<SyncInventoryAck> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryAck", []);
-    }
-    create(value?: PartialMessage<SyncInventoryAck>): SyncInventoryAck {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryAck>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryAck): SyncInventoryAck {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: SyncInventoryAck, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryAck
- */
-export const SyncInventoryAck = new SyncInventoryAck$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryResult$Type extends MessageType<SyncInventoryResult> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryResult", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => DeviceOrStatus }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryResult>): SyncInventoryResult {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryResult>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryResult): SyncInventoryResult {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.DeviceOrStatus devices */ 1:
-                    message.devices.push(DeviceOrStatus.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryResult, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.DeviceOrStatus devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            DeviceOrStatus.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryResult
- */
-export const SyncInventoryResult = new SyncInventoryResult$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SyncInventoryMissingDevices$Type extends MessageType<SyncInventoryMissingDevices> {
-    constructor() {
-        super("teleport.devicetrust.v1.SyncInventoryMissingDevices", [
-            { no: 1, name: "devices", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Device }
-        ]);
-    }
-    create(value?: PartialMessage<SyncInventoryMissingDevices>): SyncInventoryMissingDevices {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.devices = [];
-        if (value !== undefined)
-            reflectionMergePartial<SyncInventoryMissingDevices>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SyncInventoryMissingDevices): SyncInventoryMissingDevices {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.Device devices */ 1:
-                    message.devices.push(Device.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SyncInventoryMissingDevices, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.Device devices = 1; */
-        for (let i = 0; i < message.devices.length; i++)
-            Device.internalBinaryWrite(message.devices[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.SyncInventoryMissingDevices
- */
-export const SyncInventoryMissingDevices = new SyncInventoryMissingDevices$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetDevicesUsageRequest$Type extends MessageType<GetDevicesUsageRequest> {
-    constructor() {
-        super("teleport.devicetrust.v1.GetDevicesUsageRequest", []);
-    }
-    create(value?: PartialMessage<GetDevicesUsageRequest>): GetDevicesUsageRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetDevicesUsageRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetDevicesUsageRequest): GetDevicesUsageRequest {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: GetDevicesUsageRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.GetDevicesUsageRequest
- */
-export const GetDevicesUsageRequest = new GetDevicesUsageRequest$Type();
-/**
- * @generated ServiceType for protobuf service teleport.devicetrust.v1.DeviceTrustService
- */
-export const DeviceTrustService = new ServiceType("teleport.devicetrust.v1.DeviceTrustService", [
-    { name: "CreateDevice", options: {}, I: CreateDeviceRequest, O: Device },
-    { name: "UpdateDevice", options: {}, I: UpdateDeviceRequest, O: Device },
-    { name: "UpsertDevice", options: {}, I: UpsertDeviceRequest, O: Device },
-    { name: "DeleteDevice", options: {}, I: DeleteDeviceRequest, O: Empty },
-    { name: "FindDevices", options: {}, I: FindDevicesRequest, O: FindDevicesResponse },
-    { name: "GetDevice", options: {}, I: GetDeviceRequest, O: Device },
-    { name: "ListDevices", options: {}, I: ListDevicesRequest, O: ListDevicesResponse },
-    { name: "ListDevicesByUser", options: {}, I: ListDevicesByUserRequest, O: ListDevicesByUserResponse },
-    { name: "BulkCreateDevices", options: {}, I: BulkCreateDevicesRequest, O: BulkCreateDevicesResponse },
-    { name: "CreateDeviceEnrollToken", options: {}, I: CreateDeviceEnrollTokenRequest, O: DeviceEnrollToken },
-    { name: "EnrollDevice", serverStreaming: true, clientStreaming: true, options: {}, I: EnrollDeviceRequest, O: EnrollDeviceResponse },
-    { name: "AuthenticateDevice", serverStreaming: true, clientStreaming: true, options: {}, I: AuthenticateDeviceRequest, O: AuthenticateDeviceResponse },
-    { name: "ConfirmDeviceWebAuthentication", options: {}, I: ConfirmDeviceWebAuthenticationRequest, O: ConfirmDeviceWebAuthenticationResponse },
-    { name: "SyncInventory", serverStreaming: true, clientStreaming: true, options: {}, I: SyncInventoryRequest, O: SyncInventoryResponse },
-    { name: "GetDevicesUsage", options: {}, I: GetDevicesUsageRequest, O: DevicesUsage }
-]);
diff --git a/gen/proto/ts/teleport/devicetrust/v1/os_type_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/os_type_pb.ts
deleted file mode 100644
index 524e52f5d11d3..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/os_type_pb.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/os_type.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-/**
- * OSType represents the operating system of a device.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.OSType
- */
-export enum OSType {
-    /**
-     * @generated from protobuf enum value: OS_TYPE_UNSPECIFIED = 0;
-     */
-    OS_TYPE_UNSPECIFIED = 0,
-    /**
-     * Linux.
-     *
-     * @generated from protobuf enum value: OS_TYPE_LINUX = 1;
-     */
-    OS_TYPE_LINUX = 1,
-    /**
-     * macOS.
-     *
-     * @generated from protobuf enum value: OS_TYPE_MACOS = 2;
-     */
-    OS_TYPE_MACOS = 2,
-    /**
-     * Windows.
-     *
-     * @generated from protobuf enum value: OS_TYPE_WINDOWS = 3;
-     */
-    OS_TYPE_WINDOWS = 3
-}
diff --git a/gen/proto/ts/teleport/devicetrust/v1/tpm_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/tpm_pb.ts
deleted file mode 100644
index 05d9680e69698..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/tpm_pb.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/tpm.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-/**
- * Encapsulates the value of a PCR at a point at time.
- * See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMPCR
- */
-export interface TPMPCR {
-    /**
-     * the PCR index in the PCR bank
-     *
-     * @generated from protobuf field: int32 index = 1;
-     */
-    index: number;
-    /**
-     * the digest currently held in the PCR
-     *
-     * @generated from protobuf field: bytes digest = 2;
-     */
-    digest: Uint8Array;
-    /**
-     * the hash algorithm used to produce the digest in this PCR bank. This value
-     * is the underlying value of the Go crypto.Hash type.
-     *
-     * @generated from protobuf field: uint64 digest_alg = 3;
-     */
-    digestAlg: bigint;
-}
-/**
- * Encapsulates the result of a quote operation against the TPM over a PCR
- * using an attestation key.
- * See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMQuote
- */
-export interface TPMQuote {
-    /**
-     * @generated from protobuf field: bytes quote = 1;
-     */
-    quote: Uint8Array;
-    /**
-     * @generated from protobuf field: bytes signature = 2;
-     */
-    signature: Uint8Array;
-}
-/**
- * The quotes, PCRs and event log from a TPM that attest to the booted state
- * of the machine.
- * See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
- * Excludes TPMVersion and Public since these are already known values.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMPlatformParameters
- */
-export interface TPMPlatformParameters {
-    /**
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.TPMQuote quotes = 1;
-     */
-    quotes: TPMQuote[];
-    /**
-     * @generated from protobuf field: repeated teleport.devicetrust.v1.TPMPCR pcrs = 2;
-     */
-    pcrs: TPMPCR[];
-    /**
-     * @generated from protobuf field: bytes event_log = 3;
-     */
-    eventLog: Uint8Array;
-}
-/**
- * Holds the record of a TPM platform attestation, including the platform
- * parameters sent by the device and the nonce the server generated. This allows
- * a historical platform attestation to be revalidated and allows us to compare
- * the incoming state of a device (e.g during authentication) against the
- * historical state in order to detect potentially malicious actions.
- *
- * @generated from protobuf message teleport.devicetrust.v1.TPMPlatformAttestation
- */
-export interface TPMPlatformAttestation {
-    /**
-     * @generated from protobuf field: bytes nonce = 1;
-     */
-    nonce: Uint8Array;
-    /**
-     * @generated from protobuf field: teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 2;
-     */
-    platformParameters?: TPMPlatformParameters;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMPCR$Type extends MessageType<TPMPCR> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMPCR", [
-            { no: 1, name: "index", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "digest", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "digest_alg", kind: "scalar", T: 4 /*ScalarType.UINT64*/, L: 0 /*LongType.BIGINT*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMPCR>): TPMPCR {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.index = 0;
-        message.digest = new Uint8Array(0);
-        message.digestAlg = 0n;
-        if (value !== undefined)
-            reflectionMergePartial<TPMPCR>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMPCR): TPMPCR {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 index */ 1:
-                    message.index = reader.int32();
-                    break;
-                case /* bytes digest */ 2:
-                    message.digest = reader.bytes();
-                    break;
-                case /* uint64 digest_alg */ 3:
-                    message.digestAlg = reader.uint64().toBigInt();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMPCR, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 index = 1; */
-        if (message.index !== 0)
-            writer.tag(1, WireType.Varint).int32(message.index);
-        /* bytes digest = 2; */
-        if (message.digest.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.digest);
-        /* uint64 digest_alg = 3; */
-        if (message.digestAlg !== 0n)
-            writer.tag(3, WireType.Varint).uint64(message.digestAlg);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMPCR
- */
-export const TPMPCR = new TPMPCR$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMQuote$Type extends MessageType<TPMQuote> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMQuote", [
-            { no: 1, name: "quote", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "signature", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMQuote>): TPMQuote {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.quote = new Uint8Array(0);
-        message.signature = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMQuote>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMQuote): TPMQuote {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes quote */ 1:
-                    message.quote = reader.bytes();
-                    break;
-                case /* bytes signature */ 2:
-                    message.signature = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMQuote, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes quote = 1; */
-        if (message.quote.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.quote);
-        /* bytes signature = 2; */
-        if (message.signature.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.signature);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMQuote
- */
-export const TPMQuote = new TPMQuote$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMPlatformParameters$Type extends MessageType<TPMPlatformParameters> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMPlatformParameters", [
-            { no: 1, name: "quotes", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => TPMQuote },
-            { no: 2, name: "pcrs", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => TPMPCR },
-            { no: 3, name: "event_log", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TPMPlatformParameters>): TPMPlatformParameters {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.quotes = [];
-        message.pcrs = [];
-        message.eventLog = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMPlatformParameters>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMPlatformParameters): TPMPlatformParameters {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated teleport.devicetrust.v1.TPMQuote quotes */ 1:
-                    message.quotes.push(TPMQuote.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* repeated teleport.devicetrust.v1.TPMPCR pcrs */ 2:
-                    message.pcrs.push(TPMPCR.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* bytes event_log */ 3:
-                    message.eventLog = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMPlatformParameters, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated teleport.devicetrust.v1.TPMQuote quotes = 1; */
-        for (let i = 0; i < message.quotes.length; i++)
-            TPMQuote.internalBinaryWrite(message.quotes[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* repeated teleport.devicetrust.v1.TPMPCR pcrs = 2; */
-        for (let i = 0; i < message.pcrs.length; i++)
-            TPMPCR.internalBinaryWrite(message.pcrs[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* bytes event_log = 3; */
-        if (message.eventLog.length)
-            writer.tag(3, WireType.LengthDelimited).bytes(message.eventLog);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMPlatformParameters
- */
-export const TPMPlatformParameters = new TPMPlatformParameters$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TPMPlatformAttestation$Type extends MessageType<TPMPlatformAttestation> {
-    constructor() {
-        super("teleport.devicetrust.v1.TPMPlatformAttestation", [
-            { no: 1, name: "nonce", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "platform_parameters", kind: "message", T: () => TPMPlatformParameters }
-        ]);
-    }
-    create(value?: PartialMessage<TPMPlatformAttestation>): TPMPlatformAttestation {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.nonce = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<TPMPlatformAttestation>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TPMPlatformAttestation): TPMPlatformAttestation {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes nonce */ 1:
-                    message.nonce = reader.bytes();
-                    break;
-                case /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters */ 2:
-                    message.platformParameters = TPMPlatformParameters.internalBinaryRead(reader, reader.uint32(), options, message.platformParameters);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TPMPlatformAttestation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes nonce = 1; */
-        if (message.nonce.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.nonce);
-        /* teleport.devicetrust.v1.TPMPlatformParameters platform_parameters = 2; */
-        if (message.platformParameters)
-            TPMPlatformParameters.internalBinaryWrite(message.platformParameters, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.TPMPlatformAttestation
- */
-export const TPMPlatformAttestation = new TPMPlatformAttestation$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/usage_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/usage_pb.ts
deleted file mode 100644
index dfb41cef817da..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/usage_pb.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/usage.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-/**
- * Superseded by ResourceUsageService.GetUsage.
- *
- * @generated from protobuf message teleport.devicetrust.v1.DevicesUsage
- */
-export interface DevicesUsage {
-}
-/**
- * Superseded by ResourceUsageService.GetUsage.
- *
- * @generated from protobuf enum teleport.devicetrust.v1.AccountUsageType
- */
-export enum AccountUsageType {
-    /**
-     * @generated from protobuf enum value: ACCOUNT_USAGE_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: ACCOUNT_USAGE_TYPE_UNLIMITED = 1;
-     */
-    UNLIMITED = 1,
-    /**
-     * @generated from protobuf enum value: ACCOUNT_USAGE_TYPE_USAGE_BASED = 2;
-     */
-    USAGE_BASED = 2
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class DevicesUsage$Type extends MessageType<DevicesUsage> {
-    constructor() {
-        super("teleport.devicetrust.v1.DevicesUsage", []);
-    }
-    create(value?: PartialMessage<DevicesUsage>): DevicesUsage {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<DevicesUsage>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DevicesUsage): DevicesUsage {
-        return target ?? this.create();
-    }
-    internalBinaryWrite(message: DevicesUsage, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.DevicesUsage
- */
-export const DevicesUsage = new DevicesUsage$Type();
diff --git a/gen/proto/ts/teleport/devicetrust/v1/user_certificates_pb.ts b/gen/proto/ts/teleport/devicetrust/v1/user_certificates_pb.ts
deleted file mode 100644
index eaaf09fb870db..0000000000000
--- a/gen/proto/ts/teleport/devicetrust/v1/user_certificates_pb.ts
+++ /dev/null
@@ -1,105 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/devicetrust/v1/user_certificates.proto" (package "teleport.devicetrust.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-/**
- * UserCertificates is used to transport X.509 and SSH certificates during
- * device authentication.
- * See the AuthenticateDevice RPC.
- *
- * @generated from protobuf message teleport.devicetrust.v1.UserCertificates
- */
-export interface UserCertificates {
-    /**
-     * DER-encoded X.509 user certificate.
-     *
-     * @generated from protobuf field: bytes x509_der = 1;
-     */
-    x509Der: Uint8Array;
-    /**
-     * SSH certificate marshaled in the authorized key format.
-     *
-     * @generated from protobuf field: bytes ssh_authorized_key = 2;
-     */
-    sshAuthorizedKey: Uint8Array;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class UserCertificates$Type extends MessageType<UserCertificates> {
-    constructor() {
-        super("teleport.devicetrust.v1.UserCertificates", [
-            { no: 1, name: "x509_der", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 2, name: "ssh_authorized_key", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<UserCertificates>): UserCertificates {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.x509Der = new Uint8Array(0);
-        message.sshAuthorizedKey = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<UserCertificates>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UserCertificates): UserCertificates {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bytes x509_der */ 1:
-                    message.x509Der = reader.bytes();
-                    break;
-                case /* bytes ssh_authorized_key */ 2:
-                    message.sshAuthorizedKey = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UserCertificates, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bytes x509_der = 1; */
-        if (message.x509Der.length)
-            writer.tag(1, WireType.LengthDelimited).bytes(message.x509Der);
-        /* bytes ssh_authorized_key = 2; */
-        if (message.sshAuthorizedKey.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.sshAuthorizedKey);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message teleport.devicetrust.v1.UserCertificates
- */
-export const UserCertificates = new UserCertificates$Type();
diff --git a/gen/proto/ts/teleport/header/v1/metadata_pb.ts b/gen/proto/ts/teleport/header/v1/metadata_pb.ts
index 7c53ca297d2a3..095f8b0eca322 100644
--- a/gen/proto/ts/teleport/header/v1/metadata_pb.ts
+++ b/gen/proto/ts/teleport/header/v1/metadata_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/header/v1/metadata.proto" (package "teleport.header.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts b/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
index b1edb393cb897..21affaf09b891 100644
--- a/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
+++ b/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/header/v1/resourceheader.proto" (package "teleport.header.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/legacy/types/trusted_device_requirement_pb.ts b/gen/proto/ts/teleport/legacy/types/trusted_device_requirement_pb.ts
index 179457ba7a2e3..e51d5fa2af68f 100644
--- a/gen/proto/ts/teleport/legacy/types/trusted_device_requirement_pb.ts
+++ b/gen/proto/ts/teleport/legacy/types/trusted_device_requirement_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/legacy/types/trusted_device_requirement.proto" (package "types", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.client.ts
new file mode 100644
index 0000000000000..667d930a94edf
--- /dev/null
+++ b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.client.ts
@@ -0,0 +1,85 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/lib/teleterm/auto_update/v1/auto_update_service.proto" (package "teleport.lib.teleterm.auto_update.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { AutoUpdateService } from "./auto_update_service_pb";
+import type { GetDownloadBaseUrlResponse } from "./auto_update_service_pb";
+import type { GetDownloadBaseUrlRequest } from "./auto_update_service_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { GetClusterVersionsResponse } from "./auto_update_service_pb";
+import type { GetClusterVersionsRequest } from "./auto_update_service_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * AutoUpdateService provides access to information about client tools updates.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.auto_update.v1.AutoUpdateService
+ */
+export interface IAutoUpdateServiceClient {
+    /**
+     * GetClusterVersions returns client tools versions for all clusters.
+     *
+     * @generated from protobuf rpc: GetClusterVersions(teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest) returns (teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse);
+     */
+    getClusterVersions(input: GetClusterVersionsRequest, options?: RpcOptions): UnaryCall<GetClusterVersionsRequest, GetClusterVersionsResponse>;
+    /**
+     * GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+     * Can be overridden with TELEPORT_CDN_BASE_URL env var.
+     * OSS builds require this env var to be set, otherwise an error is returned.
+     *
+     * @generated from protobuf rpc: GetDownloadBaseUrl(teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest) returns (teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse);
+     */
+    getDownloadBaseUrl(input: GetDownloadBaseUrlRequest, options?: RpcOptions): UnaryCall<GetDownloadBaseUrlRequest, GetDownloadBaseUrlResponse>;
+}
+/**
+ * AutoUpdateService provides access to information about client tools updates.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.auto_update.v1.AutoUpdateService
+ */
+export class AutoUpdateServiceClient implements IAutoUpdateServiceClient, ServiceInfo {
+    typeName = AutoUpdateService.typeName;
+    methods = AutoUpdateService.methods;
+    options = AutoUpdateService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * GetClusterVersions returns client tools versions for all clusters.
+     *
+     * @generated from protobuf rpc: GetClusterVersions(teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest) returns (teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse);
+     */
+    getClusterVersions(input: GetClusterVersionsRequest, options?: RpcOptions): UnaryCall<GetClusterVersionsRequest, GetClusterVersionsResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetClusterVersionsRequest, GetClusterVersionsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+     * Can be overridden with TELEPORT_CDN_BASE_URL env var.
+     * OSS builds require this env var to be set, otherwise an error is returned.
+     *
+     * @generated from protobuf rpc: GetDownloadBaseUrl(teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest) returns (teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse);
+     */
+    getDownloadBaseUrl(input: GetDownloadBaseUrlRequest, options?: RpcOptions): UnaryCall<GetDownloadBaseUrlRequest, GetDownloadBaseUrlResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetDownloadBaseUrlRequest, GetDownloadBaseUrlResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.grpc-server.ts
new file mode 100644
index 0000000000000..f48a7368e2cd2
--- /dev/null
+++ b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.grpc-server.ts
@@ -0,0 +1,81 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/lib/teleterm/auto_update/v1/auto_update_service.proto" (package "teleport.lib.teleterm.auto_update.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import { GetDownloadBaseUrlResponse } from "./auto_update_service_pb";
+import { GetDownloadBaseUrlRequest } from "./auto_update_service_pb";
+import { GetClusterVersionsResponse } from "./auto_update_service_pb";
+import { GetClusterVersionsRequest } from "./auto_update_service_pb";
+import type * as grpc from "@grpc/grpc-js";
+/**
+ * AutoUpdateService provides access to information about client tools updates.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.auto_update.v1.AutoUpdateService
+ */
+export interface IAutoUpdateService extends grpc.UntypedServiceImplementation {
+    /**
+     * GetClusterVersions returns client tools versions for all clusters.
+     *
+     * @generated from protobuf rpc: GetClusterVersions(teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest) returns (teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse);
+     */
+    getClusterVersions: grpc.handleUnaryCall<GetClusterVersionsRequest, GetClusterVersionsResponse>;
+    /**
+     * GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+     * Can be overridden with TELEPORT_CDN_BASE_URL env var.
+     * OSS builds require this env var to be set, otherwise an error is returned.
+     *
+     * @generated from protobuf rpc: GetDownloadBaseUrl(teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest) returns (teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse);
+     */
+    getDownloadBaseUrl: grpc.handleUnaryCall<GetDownloadBaseUrlRequest, GetDownloadBaseUrlResponse>;
+}
+/**
+ * @grpc/grpc-js definition for the protobuf service teleport.lib.teleterm.auto_update.v1.AutoUpdateService.
+ *
+ * Usage: Implement the interface IAutoUpdateService and add to a grpc server.
+ *
+ * ```typescript
+ * const server = new grpc.Server();
+ * const service: IAutoUpdateService = ...
+ * server.addService(autoUpdateServiceDefinition, service);
+ * ```
+ */
+export const autoUpdateServiceDefinition: grpc.ServiceDefinition<IAutoUpdateService> = {
+    getClusterVersions: {
+        path: "/teleport.lib.teleterm.auto_update.v1.AutoUpdateService/GetClusterVersions",
+        originalName: "GetClusterVersions",
+        requestStream: false,
+        responseStream: false,
+        responseDeserialize: bytes => GetClusterVersionsResponse.fromBinary(bytes),
+        requestDeserialize: bytes => GetClusterVersionsRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(GetClusterVersionsResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(GetClusterVersionsRequest.toBinary(value))
+    },
+    getDownloadBaseUrl: {
+        path: "/teleport.lib.teleterm.auto_update.v1.AutoUpdateService/GetDownloadBaseUrl",
+        originalName: "GetDownloadBaseUrl",
+        requestStream: false,
+        responseStream: false,
+        responseDeserialize: bytes => GetDownloadBaseUrlResponse.fromBinary(bytes),
+        requestDeserialize: bytes => GetDownloadBaseUrlRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(GetDownloadBaseUrlResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(GetDownloadBaseUrlRequest.toBinary(value))
+    }
+};
diff --git a/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.ts
new file mode 100644
index 0000000000000..0e4814b83caca
--- /dev/null
+++ b/gen/proto/ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.ts
@@ -0,0 +1,407 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/lib/teleterm/auto_update/v1/auto_update_service.proto" (package "teleport.lib.teleterm.auto_update.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+/**
+ * Request for GetClusterVersions.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest
+ */
+export interface GetClusterVersionsRequest {
+}
+/**
+ * Response for GetClusterVersions.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse
+ */
+export interface GetClusterVersionsResponse {
+    /**
+     * @generated from protobuf field: repeated teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo reachable_clusters = 1;
+     */
+    reachableClusters: ClusterVersionInfo[];
+    /**
+     * @generated from protobuf field: repeated teleport.lib.teleterm.auto_update.v1.UnreachableCluster unreachable_clusters = 2;
+     */
+    unreachableClusters: UnreachableCluster[];
+}
+/**
+ * ClusterVersionInfo contains tool version information for a reachable cluster.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo
+ */
+export interface ClusterVersionInfo {
+    /**
+     * URI of the cluster.
+     *
+     * @generated from protobuf field: string cluster_uri = 1;
+     */
+    clusterUri: string;
+    /**
+     * Whether the client should automatically update the tools version.
+     *
+     * @generated from protobuf field: bool tools_auto_update = 2;
+     */
+    toolsAutoUpdate: boolean;
+    /**
+     * Tools version required by this cluster.
+     *
+     * @generated from protobuf field: string tools_version = 3;
+     */
+    toolsVersion: string;
+    /**
+     * Minimum tools version allowed by this cluster.
+     *
+     * @generated from protobuf field: string min_tools_version = 4;
+     */
+    minToolsVersion: string;
+}
+/**
+ * UnreachableCluster represents a cluster from which version information could not be retrieved.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.UnreachableCluster
+ */
+export interface UnreachableCluster {
+    /**
+     * URI of the cluster.
+     *
+     * @generated from protobuf field: string cluster_uri = 1;
+     */
+    clusterUri: string;
+    /**
+     * Error that occurred while retrieving version information.
+     *
+     * @generated from protobuf field: string error_message = 2;
+     */
+    errorMessage: string;
+}
+/**
+ * Request for GetDownloadBaseUrl.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest
+ */
+export interface GetDownloadBaseUrlRequest {
+}
+/**
+ * Response for GetDownloadBaseUrl.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse
+ */
+export interface GetDownloadBaseUrlResponse {
+    /**
+     * @generated from protobuf field: string base_url = 1;
+     */
+    baseUrl: string;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class GetClusterVersionsRequest$Type extends MessageType<GetClusterVersionsRequest> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest", []);
+    }
+    create(value?: PartialMessage<GetClusterVersionsRequest>): GetClusterVersionsRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetClusterVersionsRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetClusterVersionsRequest): GetClusterVersionsRequest {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: GetClusterVersionsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.GetClusterVersionsRequest
+ */
+export const GetClusterVersionsRequest = new GetClusterVersionsRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetClusterVersionsResponse$Type extends MessageType<GetClusterVersionsResponse> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse", [
+            { no: 1, name: "reachable_clusters", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => ClusterVersionInfo },
+            { no: 2, name: "unreachable_clusters", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => UnreachableCluster }
+        ]);
+    }
+    create(value?: PartialMessage<GetClusterVersionsResponse>): GetClusterVersionsResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.reachableClusters = [];
+        message.unreachableClusters = [];
+        if (value !== undefined)
+            reflectionMergePartial<GetClusterVersionsResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetClusterVersionsResponse): GetClusterVersionsResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo reachable_clusters */ 1:
+                    message.reachableClusters.push(ClusterVersionInfo.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* repeated teleport.lib.teleterm.auto_update.v1.UnreachableCluster unreachable_clusters */ 2:
+                    message.unreachableClusters.push(UnreachableCluster.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetClusterVersionsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo reachable_clusters = 1; */
+        for (let i = 0; i < message.reachableClusters.length; i++)
+            ClusterVersionInfo.internalBinaryWrite(message.reachableClusters[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* repeated teleport.lib.teleterm.auto_update.v1.UnreachableCluster unreachable_clusters = 2; */
+        for (let i = 0; i < message.unreachableClusters.length; i++)
+            UnreachableCluster.internalBinaryWrite(message.unreachableClusters[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.GetClusterVersionsResponse
+ */
+export const GetClusterVersionsResponse = new GetClusterVersionsResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ClusterVersionInfo$Type extends MessageType<ClusterVersionInfo> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo", [
+            { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "tools_auto_update", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 3, name: "tools_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "min_tools_version", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ClusterVersionInfo>): ClusterVersionInfo {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clusterUri = "";
+        message.toolsAutoUpdate = false;
+        message.toolsVersion = "";
+        message.minToolsVersion = "";
+        if (value !== undefined)
+            reflectionMergePartial<ClusterVersionInfo>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ClusterVersionInfo): ClusterVersionInfo {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string cluster_uri */ 1:
+                    message.clusterUri = reader.string();
+                    break;
+                case /* bool tools_auto_update */ 2:
+                    message.toolsAutoUpdate = reader.bool();
+                    break;
+                case /* string tools_version */ 3:
+                    message.toolsVersion = reader.string();
+                    break;
+                case /* string min_tools_version */ 4:
+                    message.minToolsVersion = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ClusterVersionInfo, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string cluster_uri = 1; */
+        if (message.clusterUri !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clusterUri);
+        /* bool tools_auto_update = 2; */
+        if (message.toolsAutoUpdate !== false)
+            writer.tag(2, WireType.Varint).bool(message.toolsAutoUpdate);
+        /* string tools_version = 3; */
+        if (message.toolsVersion !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.toolsVersion);
+        /* string min_tools_version = 4; */
+        if (message.minToolsVersion !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.minToolsVersion);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.ClusterVersionInfo
+ */
+export const ClusterVersionInfo = new ClusterVersionInfo$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UnreachableCluster$Type extends MessageType<UnreachableCluster> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.UnreachableCluster", [
+            { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "error_message", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<UnreachableCluster>): UnreachableCluster {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clusterUri = "";
+        message.errorMessage = "";
+        if (value !== undefined)
+            reflectionMergePartial<UnreachableCluster>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UnreachableCluster): UnreachableCluster {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string cluster_uri */ 1:
+                    message.clusterUri = reader.string();
+                    break;
+                case /* string error_message */ 2:
+                    message.errorMessage = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UnreachableCluster, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string cluster_uri = 1; */
+        if (message.clusterUri !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clusterUri);
+        /* string error_message = 2; */
+        if (message.errorMessage !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.errorMessage);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.UnreachableCluster
+ */
+export const UnreachableCluster = new UnreachableCluster$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetDownloadBaseUrlRequest$Type extends MessageType<GetDownloadBaseUrlRequest> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest", []);
+    }
+    create(value?: PartialMessage<GetDownloadBaseUrlRequest>): GetDownloadBaseUrlRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetDownloadBaseUrlRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetDownloadBaseUrlRequest): GetDownloadBaseUrlRequest {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: GetDownloadBaseUrlRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlRequest
+ */
+export const GetDownloadBaseUrlRequest = new GetDownloadBaseUrlRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetDownloadBaseUrlResponse$Type extends MessageType<GetDownloadBaseUrlResponse> {
+    constructor() {
+        super("teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse", [
+            { no: 1, name: "base_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetDownloadBaseUrlResponse>): GetDownloadBaseUrlResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.baseUrl = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetDownloadBaseUrlResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetDownloadBaseUrlResponse): GetDownloadBaseUrlResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string base_url */ 1:
+                    message.baseUrl = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetDownloadBaseUrlResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string base_url = 1; */
+        if (message.baseUrl !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.baseUrl);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.auto_update.v1.GetDownloadBaseUrlResponse
+ */
+export const GetDownloadBaseUrlResponse = new GetDownloadBaseUrlResponse$Type();
+/**
+ * @generated ServiceType for protobuf service teleport.lib.teleterm.auto_update.v1.AutoUpdateService
+ */
+export const AutoUpdateService = new ServiceType("teleport.lib.teleterm.auto_update.v1.AutoUpdateService", [
+    { name: "GetClusterVersions", options: {}, I: GetClusterVersionsRequest, O: GetClusterVersionsResponse },
+    { name: "GetDownloadBaseUrl", options: {}, I: GetDownloadBaseUrlRequest, O: GetDownloadBaseUrlResponse }
+]);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
index 211af83e77a39..1989e109faed8 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/access_request.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -88,13 +88,8 @@ export interface AccessRequest {
      */
     thresholdNames: string[];
     /**
-     * TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-     * a list of resourceIDs requested in the AccessRequest
+     * List of requested resources.
      *
-     * @generated from protobuf field: repeated teleport.lib.teleterm.v1.ResourceID resource_ids = 12;
-     */
-    resourceIds: ResourceID[];
-    /**
      * @generated from protobuf field: repeated teleport.lib.teleterm.v1.Resource resources = 13;
      */
     resources: Resource[];
@@ -130,6 +125,20 @@ export interface AccessRequest {
      * @generated from protobuf field: google.protobuf.Timestamp session_ttl = 18;
      */
     sessionTtl?: Timestamp;
+    /**
+     * reason_mode specifies the reason mode for this Access Request. It can be either "optional" or
+     * "required". It's only added in response to a dry run request.
+     *
+     * @generated from protobuf field: string reason_mode = 19;
+     */
+    reasonMode: string;
+    /**
+     * reason_prompts is a sorted and deduplicated list of reason prompts for this Access Request.
+     * It's only added in response to a dry run request.
+     *
+     * @generated from protobuf field: repeated string reason_prompts = 20;
+     */
+    reasonPrompts: string[];
 }
 /**
  * @generated from protobuf message teleport.lib.teleterm.v1.AccessRequestReview
@@ -240,13 +249,14 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
             { no: 9, name: "reviews", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => AccessRequestReview },
             { no: 10, name: "suggested_reviewers", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 11, name: "threshold_names", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 12, name: "resource_ids", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => ResourceID },
             { no: 13, name: "resources", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Resource },
             { no: 14, name: "promoted_access_list_title", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 15, name: "assume_start_time", kind: "message", T: () => Timestamp },
             { no: 16, name: "max_duration", kind: "message", T: () => Timestamp },
             { no: 17, name: "request_ttl", kind: "message", T: () => Timestamp },
-            { no: 18, name: "session_ttl", kind: "message", T: () => Timestamp }
+            { no: 18, name: "session_ttl", kind: "message", T: () => Timestamp },
+            { no: 19, name: "reason_mode", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 20, name: "reason_prompts", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<AccessRequest>): AccessRequest {
@@ -260,9 +270,10 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
         message.reviews = [];
         message.suggestedReviewers = [];
         message.thresholdNames = [];
-        message.resourceIds = [];
         message.resources = [];
         message.promotedAccessListTitle = "";
+        message.reasonMode = "";
+        message.reasonPrompts = [];
         if (value !== undefined)
             reflectionMergePartial<AccessRequest>(this, message, value);
         return message;
@@ -305,9 +316,6 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
                 case /* repeated string threshold_names */ 11:
                     message.thresholdNames.push(reader.string());
                     break;
-                case /* repeated teleport.lib.teleterm.v1.ResourceID resource_ids */ 12:
-                    message.resourceIds.push(ResourceID.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
                 case /* repeated teleport.lib.teleterm.v1.Resource resources */ 13:
                     message.resources.push(Resource.internalBinaryRead(reader, reader.uint32(), options));
                     break;
@@ -326,6 +334,12 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
                 case /* google.protobuf.Timestamp session_ttl */ 18:
                     message.sessionTtl = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.sessionTtl);
                     break;
+                case /* string reason_mode */ 19:
+                    message.reasonMode = reader.string();
+                    break;
+                case /* repeated string reason_prompts */ 20:
+                    message.reasonPrompts.push(reader.string());
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -371,9 +385,6 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
         /* repeated string threshold_names = 11; */
         for (let i = 0; i < message.thresholdNames.length; i++)
             writer.tag(11, WireType.LengthDelimited).string(message.thresholdNames[i]);
-        /* repeated teleport.lib.teleterm.v1.ResourceID resource_ids = 12; */
-        for (let i = 0; i < message.resourceIds.length; i++)
-            ResourceID.internalBinaryWrite(message.resourceIds[i], writer.tag(12, WireType.LengthDelimited).fork(), options).join();
         /* repeated teleport.lib.teleterm.v1.Resource resources = 13; */
         for (let i = 0; i < message.resources.length; i++)
             Resource.internalBinaryWrite(message.resources[i], writer.tag(13, WireType.LengthDelimited).fork(), options).join();
@@ -392,6 +403,12 @@ class AccessRequest$Type extends MessageType<AccessRequest> {
         /* google.protobuf.Timestamp session_ttl = 18; */
         if (message.sessionTtl)
             Timestamp.internalBinaryWrite(message.sessionTtl, writer.tag(18, WireType.LengthDelimited).fork(), options).join();
+        /* string reason_mode = 19; */
+        if (message.reasonMode !== "")
+            writer.tag(19, WireType.LengthDelimited).string(message.reasonMode);
+        /* repeated string reason_prompts = 20; */
+        for (let i = 0; i < message.reasonPrompts.length; i++)
+            writer.tag(20, WireType.LengthDelimited).string(message.reasonPrompts[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
index faf0f10553d74..91158278b1d2f 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/app.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
index 74e2fee639776..8040eedb448a9 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/auth_settings.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
index 153c807785f4d..e570f209d1abd 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/cluster.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -30,6 +30,7 @@ import { UnknownFieldHandler } from "@protobuf-ts/runtime";
 import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
+import { Timestamp } from "../../../../google/protobuf/timestamp_pb";
 import { TrustedDeviceRequirement } from "../../../legacy/types/trusted_device_requirement_pb";
 /**
  * Cluster describes cluster fields.
@@ -50,7 +51,9 @@ export interface Cluster {
      */
     uri: string;
     /**
-     * name is used throughout the Teleport Connect codebase as the cluster name.
+     * name is the site name of Teleport cluster.
+     * Only present in root clusters if the user has logged in (the name comes from the certificate).
+     * Always available for leaf clusters.
      *
      * @generated from protobuf field: string name = 2;
      */
@@ -146,12 +149,6 @@ export interface LoggedInUser {
      * @generated from protobuf field: repeated string roles = 2;
      */
     roles: string[];
-    /**
-     * ssh_logins is the user ssh logins
-     *
-     * @generated from protobuf field: repeated string ssh_logins = 3;
-     */
-    sshLogins: string[];
     /**
      * acl is a user access control list.
      * It is available only after the cluster details are fetched, as it is not stored on disk.
@@ -195,6 +192,12 @@ export interface LoggedInUser {
      * @generated from protobuf field: types.TrustedDeviceRequirement trusted_device_requirement = 10;
      */
     trustedDeviceRequirement: TrustedDeviceRequirement;
+    /**
+     * Expiration time of the certificate.
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp valid_until = 11;
+     */
+    validUntil?: Timestamp;
 }
 /**
  * UserType indicates whether the user was created through an SSO provider or in Teleport itself.
@@ -539,21 +542,20 @@ class LoggedInUser$Type extends MessageType<LoggedInUser> {
         super("teleport.lib.teleterm.v1.LoggedInUser", [
             { no: 1, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "roles", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "ssh_logins", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "acl", kind: "message", T: () => ACL },
             { no: 5, name: "active_requests", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 6, name: "suggested_reviewers", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 7, name: "requestable_roles", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
             { no: 8, name: "user_type", kind: "enum", T: () => ["teleport.lib.teleterm.v1.LoggedInUser.UserType", LoggedInUser_UserType, "USER_TYPE_"] },
             { no: 9, name: "is_device_trusted", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 10, name: "trusted_device_requirement", kind: "enum", T: () => ["types.TrustedDeviceRequirement", TrustedDeviceRequirement, "TRUSTED_DEVICE_REQUIREMENT_"] }
+            { no: 10, name: "trusted_device_requirement", kind: "enum", T: () => ["types.TrustedDeviceRequirement", TrustedDeviceRequirement, "TRUSTED_DEVICE_REQUIREMENT_"] },
+            { no: 11, name: "valid_until", kind: "message", T: () => Timestamp }
         ]);
     }
     create(value?: PartialMessage<LoggedInUser>): LoggedInUser {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.name = "";
         message.roles = [];
-        message.sshLogins = [];
         message.activeRequests = [];
         message.suggestedReviewers = [];
         message.requestableRoles = [];
@@ -575,9 +577,6 @@ class LoggedInUser$Type extends MessageType<LoggedInUser> {
                 case /* repeated string roles */ 2:
                     message.roles.push(reader.string());
                     break;
-                case /* repeated string ssh_logins */ 3:
-                    message.sshLogins.push(reader.string());
-                    break;
                 case /* teleport.lib.teleterm.v1.ACL acl */ 4:
                     message.acl = ACL.internalBinaryRead(reader, reader.uint32(), options, message.acl);
                     break;
@@ -599,6 +598,9 @@ class LoggedInUser$Type extends MessageType<LoggedInUser> {
                 case /* types.TrustedDeviceRequirement trusted_device_requirement */ 10:
                     message.trustedDeviceRequirement = reader.int32();
                     break;
+                case /* google.protobuf.Timestamp valid_until */ 11:
+                    message.validUntil = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.validUntil);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -617,9 +619,6 @@ class LoggedInUser$Type extends MessageType<LoggedInUser> {
         /* repeated string roles = 2; */
         for (let i = 0; i < message.roles.length; i++)
             writer.tag(2, WireType.LengthDelimited).string(message.roles[i]);
-        /* repeated string ssh_logins = 3; */
-        for (let i = 0; i < message.sshLogins.length; i++)
-            writer.tag(3, WireType.LengthDelimited).string(message.sshLogins[i]);
         /* teleport.lib.teleterm.v1.ACL acl = 4; */
         if (message.acl)
             ACL.internalBinaryWrite(message.acl, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
@@ -641,6 +640,9 @@ class LoggedInUser$Type extends MessageType<LoggedInUser> {
         /* types.TrustedDeviceRequirement trusted_device_requirement = 10; */
         if (message.trustedDeviceRequirement !== 0)
             writer.tag(10, WireType.Varint).int32(message.trustedDeviceRequirement);
+        /* google.protobuf.Timestamp valid_until = 11; */
+        if (message.validUntil)
+            Timestamp.internalBinaryWrite(message.validUntil, writer.tag(11, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
index 9ed7875e3190d..4ea76f4d8ceb6 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/database.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -92,6 +92,12 @@ export interface Database {
      * @generated from protobuf field: teleport.lib.teleterm.v1.TargetHealth target_health = 9;
      */
     targetHealth?: TargetHealth;
+    /**
+     * gcp_project_id is optional project ID set for GCP Project databases.
+     *
+     * @generated from protobuf field: string gcp_project_id = 10;
+     */
+    gcpProjectId: string;
 }
 /**
  * DatabaseServer (db_server) describes a database heartbeat signal
@@ -130,7 +136,8 @@ class Database$Type extends MessageType<Database> {
             { no: 6, name: "hostname", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 7, name: "addr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 8, name: "labels", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Label },
-            { no: 9, name: "target_health", kind: "message", T: () => TargetHealth }
+            { no: 9, name: "target_health", kind: "message", T: () => TargetHealth },
+            { no: 10, name: "gcp_project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<Database>): Database {
@@ -143,6 +150,7 @@ class Database$Type extends MessageType<Database> {
         message.hostname = "";
         message.addr = "";
         message.labels = [];
+        message.gcpProjectId = "";
         if (value !== undefined)
             reflectionMergePartial<Database>(this, message, value);
         return message;
@@ -179,6 +187,9 @@ class Database$Type extends MessageType<Database> {
                 case /* teleport.lib.teleterm.v1.TargetHealth target_health */ 9:
                     message.targetHealth = TargetHealth.internalBinaryRead(reader, reader.uint32(), options, message.targetHealth);
                     break;
+                case /* string gcp_project_id */ 10:
+                    message.gcpProjectId = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -218,6 +229,9 @@ class Database$Type extends MessageType<Database> {
         /* teleport.lib.teleterm.v1.TargetHealth target_health = 9; */
         if (message.targetHealth)
             TargetHealth.internalBinaryWrite(message.targetHealth, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
+        /* string gcp_project_id = 10; */
+        if (message.gcpProjectId !== "")
+            writer.tag(10, WireType.LengthDelimited).string(message.gcpProjectId);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
index 194cc93867671..f548eca058e4d 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/gateway.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
index 19f6fba32b8a5..7094ec9594aaa 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/kube.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -30,6 +30,7 @@ import { UnknownFieldHandler } from "@protobuf-ts/runtime";
 import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
+import { TargetHealth } from "./target_health_pb";
 import { Label } from "./label_pb";
 /**
  * Kube describes connected Kubernetes cluster
@@ -55,6 +56,12 @@ export interface Kube {
      * @generated from protobuf field: repeated teleport.lib.teleterm.v1.Label labels = 3;
      */
     labels: Label[];
+    /**
+     * target_health is the health of the kube cluster
+     *
+     * @generated from protobuf field: teleport.lib.teleterm.v1.TargetHealth target_health = 4;
+     */
+    targetHealth?: TargetHealth;
 }
 /**
  * KubeResource describes a kube_cluster's subresource eg: pods, namespaces, etc.
@@ -102,13 +109,39 @@ export interface KubeResource {
      */
     namespace: string;
 }
+/**
+ * KubeServer (kube_server) describes a Kube heartbeat signal
+ * reported from an agent (kubernetes_service) that is proxying
+ * the Kubernetes cluster.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.v1.KubeServer
+ */
+export interface KubeServer {
+    /**
+     * @generated from protobuf field: string uri = 1;
+     */
+    uri: string;
+    /**
+     * @generated from protobuf field: string hostname = 2;
+     */
+    hostname: string;
+    /**
+     * @generated from protobuf field: string host_id = 3;
+     */
+    hostId: string;
+    /**
+     * @generated from protobuf field: teleport.lib.teleterm.v1.TargetHealth target_health = 4;
+     */
+    targetHealth?: TargetHealth;
+}
 // @generated message type with reflection information, may provide speed optimized methods
 class Kube$Type extends MessageType<Kube> {
     constructor() {
         super("teleport.lib.teleterm.v1.Kube", [
             { no: 1, name: "uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "labels", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Label }
+            { no: 3, name: "labels", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Label },
+            { no: 4, name: "target_health", kind: "message", T: () => TargetHealth }
         ]);
     }
     create(value?: PartialMessage<Kube>): Kube {
@@ -134,6 +167,9 @@ class Kube$Type extends MessageType<Kube> {
                 case /* repeated teleport.lib.teleterm.v1.Label labels */ 3:
                     message.labels.push(Label.internalBinaryRead(reader, reader.uint32(), options));
                     break;
+                case /* teleport.lib.teleterm.v1.TargetHealth target_health */ 4:
+                    message.targetHealth = TargetHealth.internalBinaryRead(reader, reader.uint32(), options, message.targetHealth);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -155,6 +191,9 @@ class Kube$Type extends MessageType<Kube> {
         /* repeated teleport.lib.teleterm.v1.Label labels = 3; */
         for (let i = 0; i < message.labels.length; i++)
             Label.internalBinaryWrite(message.labels[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        /* teleport.lib.teleterm.v1.TargetHealth target_health = 4; */
+        if (message.targetHealth)
+            TargetHealth.internalBinaryWrite(message.targetHealth, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -252,3 +291,73 @@ class KubeResource$Type extends MessageType<KubeResource> {
  * @generated MessageType for protobuf message teleport.lib.teleterm.v1.KubeResource
  */
 export const KubeResource = new KubeResource$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class KubeServer$Type extends MessageType<KubeServer> {
+    constructor() {
+        super("teleport.lib.teleterm.v1.KubeServer", [
+            { no: 1, name: "uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "hostname", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "host_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "target_health", kind: "message", T: () => TargetHealth }
+        ]);
+    }
+    create(value?: PartialMessage<KubeServer>): KubeServer {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.uri = "";
+        message.hostname = "";
+        message.hostId = "";
+        if (value !== undefined)
+            reflectionMergePartial<KubeServer>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: KubeServer): KubeServer {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string uri */ 1:
+                    message.uri = reader.string();
+                    break;
+                case /* string hostname */ 2:
+                    message.hostname = reader.string();
+                    break;
+                case /* string host_id */ 3:
+                    message.hostId = reader.string();
+                    break;
+                case /* teleport.lib.teleterm.v1.TargetHealth target_health */ 4:
+                    message.targetHealth = TargetHealth.internalBinaryRead(reader, reader.uint32(), options, message.targetHealth);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: KubeServer, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string uri = 1; */
+        if (message.uri !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.uri);
+        /* string hostname = 2; */
+        if (message.hostname !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.hostname);
+        /* string host_id = 3; */
+        if (message.hostId !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.hostId);
+        /* teleport.lib.teleterm.v1.TargetHealth target_health = 4; */
+        if (message.targetHealth)
+            TargetHealth.internalBinaryWrite(message.targetHealth, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.KubeServer
+ */
+export const KubeServer = new KubeServer$Type();
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
index 9501303a4dca7..10c537f00496d 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/label.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
index f87dddb1f1acc..adbd7eb5e0492 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/server.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -79,6 +79,12 @@ export interface Server {
      * @generated from protobuf field: string sub_kind = 7;
      */
     subKind: string;
+    /**
+     * Subset of logins allowed by the certificate and RBAC rules.
+     *
+     * @generated from protobuf field: repeated string logins = 8;
+     */
+    logins: string[];
 }
 // @generated message type with reflection information, may provide speed optimized methods
 class Server$Type extends MessageType<Server> {
@@ -90,7 +96,8 @@ class Server$Type extends MessageType<Server> {
             { no: 4, name: "hostname", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 5, name: "addr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 6, name: "labels", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Label },
-            { no: 7, name: "sub_kind", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 7, name: "sub_kind", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "logins", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<Server>): Server {
@@ -102,6 +109,7 @@ class Server$Type extends MessageType<Server> {
         message.addr = "";
         message.labels = [];
         message.subKind = "";
+        message.logins = [];
         if (value !== undefined)
             reflectionMergePartial<Server>(this, message, value);
         return message;
@@ -132,6 +140,9 @@ class Server$Type extends MessageType<Server> {
                 case /* string sub_kind */ 7:
                     message.subKind = reader.string();
                     break;
+                case /* repeated string logins */ 8:
+                    message.logins.push(reader.string());
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -165,6 +176,9 @@ class Server$Type extends MessageType<Server> {
         /* string sub_kind = 7; */
         if (message.subKind !== "")
             writer.tag(7, WireType.LengthDelimited).string(message.subKind);
+        /* repeated string logins = 8; */
+        for (let i = 0; i < message.logins.length; i++)
+            writer.tag(8, WireType.LengthDelimited).string(message.logins[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts
index f7058a048c356..f31ee81bb3625 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -54,6 +54,8 @@ import type { ReportUsageEventRequest } from "./usage_events_pb";
 import type { FileTransferProgress } from "./service_pb";
 import type { FileTransferRequest } from "./service_pb";
 import type { ServerStreamingCall } from "@protobuf-ts/runtime-rpc";
+import type { ClearStaleClusterClientsResponse } from "./service_pb";
+import type { ClearStaleClusterClientsRequest } from "./service_pb";
 import type { LogoutRequest } from "./service_pb";
 import type { LoginPasswordlessResponse } from "./service_pb";
 import type { LoginPasswordlessRequest } from "./service_pb";
@@ -69,9 +71,10 @@ import type { Gateway } from "./gateway_pb";
 import type { CreateGatewayRequest } from "./service_pb";
 import type { ListGatewaysResponse } from "./service_pb";
 import type { ListGatewaysRequest } from "./service_pb";
-import type { RemoveClusterRequest } from "./service_pb";
 import type { Cluster } from "./cluster_pb";
 import type { AddClusterRequest } from "./service_pb";
+import type { ListKubernetesServersResponse } from "./service_pb";
+import type { ListKubernetesServersRequest } from "./service_pb";
 import type { ListKubernetesResourcesResponse } from "./service_pb";
 import type { ListKubernetesResourcesRequest } from "./service_pb";
 import type { GetSuggestedAccessListsResponse } from "./service_pb";
@@ -221,17 +224,17 @@ export interface ITerminalServiceClient {
      */
     listKubernetesResources(input: ListKubernetesResourcesRequest, options?: RpcOptions): UnaryCall<ListKubernetesResourcesRequest, ListKubernetesResourcesResponse>;
     /**
-     * AddCluster adds a cluster to profile
+     * Lists Kubernetes servers.
      *
-     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     * @generated from protobuf rpc: ListKubernetesServers(teleport.lib.teleterm.v1.ListKubernetesServersRequest) returns (teleport.lib.teleterm.v1.ListKubernetesServersResponse);
      */
-    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster>;
+    listKubernetesServers(input: ListKubernetesServersRequest, options?: RpcOptions): UnaryCall<ListKubernetesServersRequest, ListKubernetesServersResponse>;
     /**
-     * RemoveCluster removes a cluster from profile
+     * AddCluster adds a cluster to profile
      *
-     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
      */
-    removeCluster(input: RemoveClusterRequest, options?: RpcOptions): UnaryCall<RemoveClusterRequest, EmptyResponse>;
+    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster>;
     /**
      * ListGateways lists gateways
      *
@@ -307,11 +310,19 @@ export interface ITerminalServiceClient {
      */
     loginPasswordless(options?: RpcOptions): DuplexStreamingCall<LoginPasswordlessRequest, LoginPasswordlessResponse>;
     /**
-     * ClusterLogin logs out a user from cluster
+     * Logs the user out of the cluster and cleans up associated resources.
+     * Optionally removes the profile.
+     * This operation is idempotent and can be safely invoked multiple times.
      *
      * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
      */
     logout(input: LogoutRequest, options?: RpcOptions): UnaryCall<LogoutRequest, EmptyResponse>;
+    /**
+     * Closes root and leaf cluster clients that use outdated TLS certificates.
+     *
+     * @generated from protobuf rpc: ClearStaleClusterClients(teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest) returns (teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse);
+     */
+    clearStaleClusterClients(input: ClearStaleClusterClientsRequest, options?: RpcOptions): UnaryCall<ClearStaleClusterClientsRequest, ClearStaleClusterClientsResponse>;
     /**
      * TransferFile sends a request to download/upload a file
      *
@@ -591,22 +602,22 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
         return stackIntercept<ListKubernetesResourcesRequest, ListKubernetesResourcesResponse>("unary", this._transport, method, opt, input);
     }
     /**
-     * AddCluster adds a cluster to profile
+     * Lists Kubernetes servers.
      *
-     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     * @generated from protobuf rpc: ListKubernetesServers(teleport.lib.teleterm.v1.ListKubernetesServersRequest) returns (teleport.lib.teleterm.v1.ListKubernetesServersResponse);
      */
-    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster> {
+    listKubernetesServers(input: ListKubernetesServersRequest, options?: RpcOptions): UnaryCall<ListKubernetesServersRequest, ListKubernetesServersResponse> {
         const method = this.methods[16], opt = this._transport.mergeOptions(options);
-        return stackIntercept<AddClusterRequest, Cluster>("unary", this._transport, method, opt, input);
+        return stackIntercept<ListKubernetesServersRequest, ListKubernetesServersResponse>("unary", this._transport, method, opt, input);
     }
     /**
-     * RemoveCluster removes a cluster from profile
+     * AddCluster adds a cluster to profile
      *
-     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
      */
-    removeCluster(input: RemoveClusterRequest, options?: RpcOptions): UnaryCall<RemoveClusterRequest, EmptyResponse> {
+    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster> {
         const method = this.methods[17], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RemoveClusterRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+        return stackIntercept<AddClusterRequest, Cluster>("unary", this._transport, method, opt, input);
     }
     /**
      * ListGateways lists gateways
@@ -710,7 +721,9 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
         return stackIntercept<LoginPasswordlessRequest, LoginPasswordlessResponse>("duplex", this._transport, method, opt);
     }
     /**
-     * ClusterLogin logs out a user from cluster
+     * Logs the user out of the cluster and cleans up associated resources.
+     * Optionally removes the profile.
+     * This operation is idempotent and can be safely invoked multiple times.
      *
      * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
      */
@@ -718,13 +731,22 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
         const method = this.methods[27], opt = this._transport.mergeOptions(options);
         return stackIntercept<LogoutRequest, EmptyResponse>("unary", this._transport, method, opt, input);
     }
+    /**
+     * Closes root and leaf cluster clients that use outdated TLS certificates.
+     *
+     * @generated from protobuf rpc: ClearStaleClusterClients(teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest) returns (teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse);
+     */
+    clearStaleClusterClients(input: ClearStaleClusterClientsRequest, options?: RpcOptions): UnaryCall<ClearStaleClusterClientsRequest, ClearStaleClusterClientsResponse> {
+        const method = this.methods[28], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ClearStaleClusterClientsRequest, ClearStaleClusterClientsResponse>("unary", this._transport, method, opt, input);
+    }
     /**
      * TransferFile sends a request to download/upload a file
      *
      * @generated from protobuf rpc: TransferFile(teleport.lib.teleterm.v1.FileTransferRequest) returns (stream teleport.lib.teleterm.v1.FileTransferProgress);
      */
     transferFile(input: FileTransferRequest, options?: RpcOptions): ServerStreamingCall<FileTransferRequest, FileTransferProgress> {
-        const method = this.methods[28], opt = this._transport.mergeOptions(options);
+        const method = this.methods[29], opt = this._transport.mergeOptions(options);
         return stackIntercept<FileTransferRequest, FileTransferProgress>("serverStreaming", this._transport, method, opt, input);
     }
     /**
@@ -733,7 +755,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: ReportUsageEvent(teleport.lib.teleterm.v1.ReportUsageEventRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
      */
     reportUsageEvent(input: ReportUsageEventRequest, options?: RpcOptions): UnaryCall<ReportUsageEventRequest, EmptyResponse> {
-        const method = this.methods[29], opt = this._transport.mergeOptions(options);
+        const method = this.methods[30], opt = this._transport.mergeOptions(options);
         return stackIntercept<ReportUsageEventRequest, EmptyResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -743,7 +765,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: UpdateHeadlessAuthenticationState(teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest) returns (teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse);
      */
     updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, options?: RpcOptions): UnaryCall<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse> {
-        const method = this.methods[30], opt = this._transport.mergeOptions(options);
+        const method = this.methods[31], opt = this._transport.mergeOptions(options);
         return stackIntercept<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -754,7 +776,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: CreateConnectMyComputerRole(teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse);
      */
     createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse> {
-        const method = this.methods[31], opt = this._transport.mergeOptions(options);
+        const method = this.methods[32], opt = this._transport.mergeOptions(options);
         return stackIntercept<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -763,7 +785,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: CreateConnectMyComputerNodeToken(teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse);
      */
     createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse> {
-        const method = this.methods[32], opt = this._transport.mergeOptions(options);
+        const method = this.methods[33], opt = this._transport.mergeOptions(options);
         return stackIntercept<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -777,7 +799,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: WaitForConnectMyComputerNodeJoin(teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest) returns (teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse);
      */
     waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, options?: RpcOptions): UnaryCall<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse> {
-        const method = this.methods[33], opt = this._transport.mergeOptions(options);
+        const method = this.methods[34], opt = this._transport.mergeOptions(options);
         return stackIntercept<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -786,7 +808,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: DeleteConnectMyComputerNode(teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest) returns (teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse);
      */
     deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, options?: RpcOptions): UnaryCall<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse> {
-        const method = this.methods[34], opt = this._transport.mergeOptions(options);
+        const method = this.methods[35], opt = this._transport.mergeOptions(options);
         return stackIntercept<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -795,7 +817,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: GetConnectMyComputerNodeName(teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest) returns (teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse);
      */
     getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, options?: RpcOptions): UnaryCall<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse> {
-        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        const method = this.methods[36], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -804,7 +826,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: ListUnifiedResources(teleport.lib.teleterm.v1.ListUnifiedResourcesRequest) returns (teleport.lib.teleterm.v1.ListUnifiedResourcesResponse);
      */
     listUnifiedResources(input: ListUnifiedResourcesRequest, options?: RpcOptions): UnaryCall<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse> {
-        const method = this.methods[36], opt = this._transport.mergeOptions(options);
+        const method = this.methods[37], opt = this._transport.mergeOptions(options);
         return stackIntercept<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -813,7 +835,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: GetUserPreferences(teleport.lib.teleterm.v1.GetUserPreferencesRequest) returns (teleport.lib.teleterm.v1.GetUserPreferencesResponse);
      */
     getUserPreferences(input: GetUserPreferencesRequest, options?: RpcOptions): UnaryCall<GetUserPreferencesRequest, GetUserPreferencesResponse> {
-        const method = this.methods[37], opt = this._transport.mergeOptions(options);
+        const method = this.methods[38], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetUserPreferencesRequest, GetUserPreferencesResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -823,7 +845,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: UpdateUserPreferences(teleport.lib.teleterm.v1.UpdateUserPreferencesRequest) returns (teleport.lib.teleterm.v1.UpdateUserPreferencesResponse);
      */
     updateUserPreferences(input: UpdateUserPreferencesRequest, options?: RpcOptions): UnaryCall<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse> {
-        const method = this.methods[38], opt = this._transport.mergeOptions(options);
+        const method = this.methods[39], opt = this._transport.mergeOptions(options);
         return stackIntercept<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -836,7 +858,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: AuthenticateWebDevice(teleport.lib.teleterm.v1.AuthenticateWebDeviceRequest) returns (teleport.lib.teleterm.v1.AuthenticateWebDeviceResponse);
      */
     authenticateWebDevice(input: AuthenticateWebDeviceRequest, options?: RpcOptions): UnaryCall<AuthenticateWebDeviceRequest, AuthenticateWebDeviceResponse> {
-        const method = this.methods[39], opt = this._transport.mergeOptions(options);
+        const method = this.methods[40], opt = this._transport.mergeOptions(options);
         return stackIntercept<AuthenticateWebDeviceRequest, AuthenticateWebDeviceResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -846,7 +868,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: GetApp(teleport.lib.teleterm.v1.GetAppRequest) returns (teleport.lib.teleterm.v1.GetAppResponse);
      */
     getApp(input: GetAppRequest, options?: RpcOptions): UnaryCall<GetAppRequest, GetAppResponse> {
-        const method = this.methods[40], opt = this._transport.mergeOptions(options);
+        const method = this.methods[41], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetAppRequest, GetAppResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -855,7 +877,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: ConnectToDesktop(stream teleport.lib.teleterm.v1.ConnectToDesktopRequest) returns (stream teleport.lib.teleterm.v1.ConnectToDesktopResponse);
      */
     connectToDesktop(options?: RpcOptions): DuplexStreamingCall<ConnectToDesktopRequest, ConnectToDesktopResponse> {
-        const method = this.methods[41], opt = this._transport.mergeOptions(options);
+        const method = this.methods[42], opt = this._transport.mergeOptions(options);
         return stackIntercept<ConnectToDesktopRequest, ConnectToDesktopResponse>("duplex", this._transport, method, opt);
     }
     /**
@@ -869,7 +891,7 @@ export class TerminalServiceClient implements ITerminalServiceClient, ServiceInf
      * @generated from protobuf rpc: SetSharedDirectoryForDesktopSession(teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionRequest) returns (teleport.lib.teleterm.v1.SetSharedDirectoryForDesktopSessionResponse);
      */
     setSharedDirectoryForDesktopSession(input: SetSharedDirectoryForDesktopSessionRequest, options?: RpcOptions): UnaryCall<SetSharedDirectoryForDesktopSessionRequest, SetSharedDirectoryForDesktopSessionResponse> {
-        const method = this.methods[42], opt = this._transport.mergeOptions(options);
+        const method = this.methods[43], opt = this._transport.mergeOptions(options);
         return stackIntercept<SetSharedDirectoryForDesktopSessionRequest, SetSharedDirectoryForDesktopSessionResponse>("unary", this._transport, method, opt, input);
     }
 }
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
index 87a9d98541bcb..f2d9f31ee3bfb 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -50,6 +50,8 @@ import { UpdateHeadlessAuthenticationStateRequest } from "./service_pb";
 import { ReportUsageEventRequest } from "./usage_events_pb";
 import { FileTransferProgress } from "./service_pb";
 import { FileTransferRequest } from "./service_pb";
+import { ClearStaleClusterClientsResponse } from "./service_pb";
+import { ClearStaleClusterClientsRequest } from "./service_pb";
 import { LogoutRequest } from "./service_pb";
 import { LoginPasswordlessResponse } from "./service_pb";
 import { LoginPasswordlessRequest } from "./service_pb";
@@ -64,9 +66,10 @@ import { Gateway } from "./gateway_pb";
 import { CreateGatewayRequest } from "./service_pb";
 import { ListGatewaysResponse } from "./service_pb";
 import { ListGatewaysRequest } from "./service_pb";
-import { RemoveClusterRequest } from "./service_pb";
 import { Cluster } from "./cluster_pb";
 import { AddClusterRequest } from "./service_pb";
+import { ListKubernetesServersResponse } from "./service_pb";
+import { ListKubernetesServersRequest } from "./service_pb";
 import { ListKubernetesResourcesResponse } from "./service_pb";
 import { ListKubernetesResourcesRequest } from "./service_pb";
 import { GetSuggestedAccessListsResponse } from "./service_pb";
@@ -214,17 +217,17 @@ export interface ITerminalService extends grpc.UntypedServiceImplementation {
      */
     listKubernetesResources: grpc.handleUnaryCall<ListKubernetesResourcesRequest, ListKubernetesResourcesResponse>;
     /**
-     * AddCluster adds a cluster to profile
+     * Lists Kubernetes servers.
      *
-     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     * @generated from protobuf rpc: ListKubernetesServers(teleport.lib.teleterm.v1.ListKubernetesServersRequest) returns (teleport.lib.teleterm.v1.ListKubernetesServersResponse);
      */
-    addCluster: grpc.handleUnaryCall<AddClusterRequest, Cluster>;
+    listKubernetesServers: grpc.handleUnaryCall<ListKubernetesServersRequest, ListKubernetesServersResponse>;
     /**
-     * RemoveCluster removes a cluster from profile
+     * AddCluster adds a cluster to profile
      *
-     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
      */
-    removeCluster: grpc.handleUnaryCall<RemoveClusterRequest, EmptyResponse>;
+    addCluster: grpc.handleUnaryCall<AddClusterRequest, Cluster>;
     /**
      * ListGateways lists gateways
      *
@@ -300,11 +303,19 @@ export interface ITerminalService extends grpc.UntypedServiceImplementation {
      */
     loginPasswordless: grpc.handleBidiStreamingCall<LoginPasswordlessRequest, LoginPasswordlessResponse>;
     /**
-     * ClusterLogin logs out a user from cluster
+     * Logs the user out of the cluster and cleans up associated resources.
+     * Optionally removes the profile.
+     * This operation is idempotent and can be safely invoked multiple times.
      *
      * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
      */
     logout: grpc.handleUnaryCall<LogoutRequest, EmptyResponse>;
+    /**
+     * Closes root and leaf cluster clients that use outdated TLS certificates.
+     *
+     * @generated from protobuf rpc: ClearStaleClusterClients(teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest) returns (teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse);
+     */
+    clearStaleClusterClients: grpc.handleUnaryCall<ClearStaleClusterClientsRequest, ClearStaleClusterClientsResponse>;
     /**
      * TransferFile sends a request to download/upload a file
      *
@@ -587,6 +598,16 @@ export const terminalServiceDefinition: grpc.ServiceDefinition<ITerminalService>
         responseSerialize: value => Buffer.from(ListKubernetesResourcesResponse.toBinary(value)),
         requestSerialize: value => Buffer.from(ListKubernetesResourcesRequest.toBinary(value))
     },
+    listKubernetesServers: {
+        path: "/teleport.lib.teleterm.v1.TerminalService/ListKubernetesServers",
+        originalName: "ListKubernetesServers",
+        requestStream: false,
+        responseStream: false,
+        responseDeserialize: bytes => ListKubernetesServersResponse.fromBinary(bytes),
+        requestDeserialize: bytes => ListKubernetesServersRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(ListKubernetesServersResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(ListKubernetesServersRequest.toBinary(value))
+    },
     addCluster: {
         path: "/teleport.lib.teleterm.v1.TerminalService/AddCluster",
         originalName: "AddCluster",
@@ -597,16 +618,6 @@ export const terminalServiceDefinition: grpc.ServiceDefinition<ITerminalService>
         responseSerialize: value => Buffer.from(Cluster.toBinary(value)),
         requestSerialize: value => Buffer.from(AddClusterRequest.toBinary(value))
     },
-    removeCluster: {
-        path: "/teleport.lib.teleterm.v1.TerminalService/RemoveCluster",
-        originalName: "RemoveCluster",
-        requestStream: false,
-        responseStream: false,
-        responseDeserialize: bytes => EmptyResponse.fromBinary(bytes),
-        requestDeserialize: bytes => RemoveClusterRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(EmptyResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(RemoveClusterRequest.toBinary(value))
-    },
     listGateways: {
         path: "/teleport.lib.teleterm.v1.TerminalService/ListGateways",
         originalName: "ListGateways",
@@ -707,6 +718,16 @@ export const terminalServiceDefinition: grpc.ServiceDefinition<ITerminalService>
         responseSerialize: value => Buffer.from(EmptyResponse.toBinary(value)),
         requestSerialize: value => Buffer.from(LogoutRequest.toBinary(value))
     },
+    clearStaleClusterClients: {
+        path: "/teleport.lib.teleterm.v1.TerminalService/ClearStaleClusterClients",
+        originalName: "ClearStaleClusterClients",
+        requestStream: false,
+        responseStream: false,
+        responseDeserialize: bytes => ClearStaleClusterClientsResponse.fromBinary(bytes),
+        requestDeserialize: bytes => ClearStaleClusterClientsRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(ClearStaleClusterClientsResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(ClearStaleClusterClientsRequest.toBinary(value))
+    },
     transferFile: {
         path: "/teleport.lib.teleterm.v1.TerminalService/TransferFile",
         originalName: "TransferFile",
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
index 4a2e966ae2e95..29d50da9529e9 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -45,6 +45,7 @@ import { Server } from "./server_pb";
 import { Gateway } from "./gateway_pb";
 import { DatabaseServer } from "./database_pb";
 import { Cluster } from "./cluster_pb";
+import { KubeServer } from "./kube_pb";
 import { KubeResource } from "./kube_pb";
 import { AccessList } from "../../../accesslist/v1/accesslist_pb";
 import { Timestamp } from "../../../../google/protobuf/timestamp_pb";
@@ -55,17 +56,6 @@ import { AccessRequest } from "./access_request_pb";
  */
 export interface EmptyResponse {
 }
-/**
- * RemoveClusterRequest describes RemoveClusterRequest
- *
- * @generated from protobuf message teleport.lib.teleterm.v1.RemoveClusterRequest
- */
-export interface RemoveClusterRequest {
-    /**
-     * @generated from protobuf field: string cluster_uri = 1;
-     */
-    clusterUri: string;
-}
 /**
  * GetClusterRequest describes GetClusterRequest
  *
@@ -78,8 +68,6 @@ export interface GetClusterRequest {
     clusterUri: string;
 }
 /**
- * LogoutRequest describes LogoutRequest
- *
  * @generated from protobuf message teleport.lib.teleterm.v1.LogoutRequest
  */
 export interface LogoutRequest {
@@ -87,6 +75,26 @@ export interface LogoutRequest {
      * @generated from protobuf field: string cluster_uri = 1;
      */
     clusterUri: string;
+    /**
+     * Whether to remove the associated YAML profile after logout.
+     *
+     * @generated from protobuf field: bool remove_profile = 2;
+     */
+    removeProfile: boolean;
+}
+/**
+ * @generated from protobuf message teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest
+ */
+export interface ClearStaleClusterClientsRequest {
+    /**
+     * @generated from protobuf field: string root_cluster_uri = 1;
+     */
+    rootClusterUri: string;
+}
+/**
+ * @generated from protobuf message teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse
+ */
+export interface ClearStaleClusterClientsResponse {
 }
 /**
  * @generated from protobuf message teleport.lib.teleterm.v1.StartHeadlessWatcherRequest
@@ -184,8 +192,7 @@ export interface CreateAccessRequestRequest {
      */
     suggestedReviewers: string[];
     /**
-     * TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-     * a list of resourceIDs requested in the AccessRequest
+     * List of resources to which access is being requested.
      *
      * @generated from protobuf field: repeated teleport.lib.teleterm.v1.ResourceID resource_ids = 5;
      */
@@ -431,6 +438,56 @@ export interface ListKubernetesResourcesResponse {
      */
     resources: KubeResource[];
 }
+/**
+ * Lists Kubernetes servers request.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.v1.ListKubernetesServersRequest
+ */
+export interface ListKubernetesServersRequest {
+    /**
+     * Maximum number of servers to return per page.
+     *
+     * @generated from protobuf field: int32 page_size = 1;
+     */
+    pageSize: number;
+    /**
+     * Pagination token from a previous response.
+     *
+     * @generated from protobuf field: string page_token = 2;
+     */
+    pageToken: string;
+    /**
+     * Target Kubernetes cluster URI.
+     *
+     * @generated from protobuf field: string cluster_uri = 3;
+     */
+    clusterUri: string;
+    /**
+     * Additional filters and sorting options.
+     *
+     * @generated from protobuf field: teleport.lib.teleterm.v1.ListResourcesParams params = 4;
+     */
+    params?: ListResourcesParams;
+}
+/**
+ * Lists Kubernetes servers response.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.v1.ListKubernetesServersResponse
+ */
+export interface ListKubernetesServersResponse {
+    /**
+     * Resources in this page of results.
+     *
+     * @generated from protobuf field: repeated teleport.lib.teleterm.v1.KubeServer resources = 1;
+     */
+    resources: KubeServer[];
+    /**
+     * Pagination token for the next page.
+     *
+     * @generated from protobuf field: string next_page_token = 2;
+     */
+    nextPageToken: string;
+}
 /**
  * CredentialInfo holds fields related to a user's WebAuthn credential.
  *
@@ -1392,20 +1449,20 @@ class EmptyResponse$Type extends MessageType<EmptyResponse> {
  */
 export const EmptyResponse = new EmptyResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class RemoveClusterRequest$Type extends MessageType<RemoveClusterRequest> {
+class GetClusterRequest$Type extends MessageType<GetClusterRequest> {
     constructor() {
-        super("teleport.lib.teleterm.v1.RemoveClusterRequest", [
+        super("teleport.lib.teleterm.v1.GetClusterRequest", [
             { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<RemoveClusterRequest>): RemoveClusterRequest {
+    create(value?: PartialMessage<GetClusterRequest>): GetClusterRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clusterUri = "";
         if (value !== undefined)
-            reflectionMergePartial<RemoveClusterRequest>(this, message, value);
+            reflectionMergePartial<GetClusterRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RemoveClusterRequest): RemoveClusterRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetClusterRequest): GetClusterRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
@@ -1424,7 +1481,7 @@ class RemoveClusterRequest$Type extends MessageType<RemoveClusterRequest> {
         }
         return message;
     }
-    internalBinaryWrite(message: RemoveClusterRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: GetClusterRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         /* string cluster_uri = 1; */
         if (message.clusterUri !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clusterUri);
@@ -1435,24 +1492,26 @@ class RemoveClusterRequest$Type extends MessageType<RemoveClusterRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message teleport.lib.teleterm.v1.RemoveClusterRequest
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.GetClusterRequest
  */
-export const RemoveClusterRequest = new RemoveClusterRequest$Type();
+export const GetClusterRequest = new GetClusterRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class GetClusterRequest$Type extends MessageType<GetClusterRequest> {
+class LogoutRequest$Type extends MessageType<LogoutRequest> {
     constructor() {
-        super("teleport.lib.teleterm.v1.GetClusterRequest", [
-            { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("teleport.lib.teleterm.v1.LogoutRequest", [
+            { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "remove_profile", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
         ]);
     }
-    create(value?: PartialMessage<GetClusterRequest>): GetClusterRequest {
+    create(value?: PartialMessage<LogoutRequest>): LogoutRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clusterUri = "";
+        message.removeProfile = false;
         if (value !== undefined)
-            reflectionMergePartial<GetClusterRequest>(this, message, value);
+            reflectionMergePartial<LogoutRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetClusterRequest): GetClusterRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: LogoutRequest): LogoutRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
@@ -1460,6 +1519,9 @@ class GetClusterRequest$Type extends MessageType<GetClusterRequest> {
                 case /* string cluster_uri */ 1:
                     message.clusterUri = reader.string();
                     break;
+                case /* bool remove_profile */ 2:
+                    message.removeProfile = reader.bool();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -1471,10 +1533,13 @@ class GetClusterRequest$Type extends MessageType<GetClusterRequest> {
         }
         return message;
     }
-    internalBinaryWrite(message: GetClusterRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: LogoutRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         /* string cluster_uri = 1; */
         if (message.clusterUri !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clusterUri);
+        /* bool remove_profile = 2; */
+        if (message.removeProfile !== false)
+            writer.tag(2, WireType.Varint).bool(message.removeProfile);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1482,30 +1547,30 @@ class GetClusterRequest$Type extends MessageType<GetClusterRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message teleport.lib.teleterm.v1.GetClusterRequest
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.LogoutRequest
  */
-export const GetClusterRequest = new GetClusterRequest$Type();
+export const LogoutRequest = new LogoutRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class LogoutRequest$Type extends MessageType<LogoutRequest> {
+class ClearStaleClusterClientsRequest$Type extends MessageType<ClearStaleClusterClientsRequest> {
     constructor() {
-        super("teleport.lib.teleterm.v1.LogoutRequest", [
-            { no: 1, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest", [
+            { no: 1, name: "root_cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<LogoutRequest>): LogoutRequest {
+    create(value?: PartialMessage<ClearStaleClusterClientsRequest>): ClearStaleClusterClientsRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.clusterUri = "";
+        message.rootClusterUri = "";
         if (value !== undefined)
-            reflectionMergePartial<LogoutRequest>(this, message, value);
+            reflectionMergePartial<ClearStaleClusterClientsRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: LogoutRequest): LogoutRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ClearStaleClusterClientsRequest): ClearStaleClusterClientsRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string cluster_uri */ 1:
-                    message.clusterUri = reader.string();
+                case /* string root_cluster_uri */ 1:
+                    message.rootClusterUri = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1518,10 +1583,10 @@ class LogoutRequest$Type extends MessageType<LogoutRequest> {
         }
         return message;
     }
-    internalBinaryWrite(message: LogoutRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string cluster_uri = 1; */
-        if (message.clusterUri !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.clusterUri);
+    internalBinaryWrite(message: ClearStaleClusterClientsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string root_cluster_uri = 1; */
+        if (message.rootClusterUri !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.rootClusterUri);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1529,9 +1594,34 @@ class LogoutRequest$Type extends MessageType<LogoutRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message teleport.lib.teleterm.v1.LogoutRequest
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.ClearStaleClusterClientsRequest
  */
-export const LogoutRequest = new LogoutRequest$Type();
+export const ClearStaleClusterClientsRequest = new ClearStaleClusterClientsRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ClearStaleClusterClientsResponse$Type extends MessageType<ClearStaleClusterClientsResponse> {
+    constructor() {
+        super("teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse", []);
+    }
+    create(value?: PartialMessage<ClearStaleClusterClientsResponse>): ClearStaleClusterClientsResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<ClearStaleClusterClientsResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ClearStaleClusterClientsResponse): ClearStaleClusterClientsResponse {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: ClearStaleClusterClientsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.ClearStaleClusterClientsResponse
+ */
+export const ClearStaleClusterClientsResponse = new ClearStaleClusterClientsResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
 class StartHeadlessWatcherRequest$Type extends MessageType<StartHeadlessWatcherRequest> {
     constructor() {
@@ -2691,6 +2781,131 @@ class ListKubernetesResourcesResponse$Type extends MessageType<ListKubernetesRes
  */
 export const ListKubernetesResourcesResponse = new ListKubernetesResourcesResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class ListKubernetesServersRequest$Type extends MessageType<ListKubernetesServersRequest> {
+    constructor() {
+        super("teleport.lib.teleterm.v1.ListKubernetesServersRequest", [
+            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "params", kind: "message", T: () => ListResourcesParams }
+        ]);
+    }
+    create(value?: PartialMessage<ListKubernetesServersRequest>): ListKubernetesServersRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.pageSize = 0;
+        message.pageToken = "";
+        message.clusterUri = "";
+        if (value !== undefined)
+            reflectionMergePartial<ListKubernetesServersRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListKubernetesServersRequest): ListKubernetesServersRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int32 page_size */ 1:
+                    message.pageSize = reader.int32();
+                    break;
+                case /* string page_token */ 2:
+                    message.pageToken = reader.string();
+                    break;
+                case /* string cluster_uri */ 3:
+                    message.clusterUri = reader.string();
+                    break;
+                case /* teleport.lib.teleterm.v1.ListResourcesParams params */ 4:
+                    message.params = ListResourcesParams.internalBinaryRead(reader, reader.uint32(), options, message.params);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListKubernetesServersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int32 page_size = 1; */
+        if (message.pageSize !== 0)
+            writer.tag(1, WireType.Varint).int32(message.pageSize);
+        /* string page_token = 2; */
+        if (message.pageToken !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
+        /* string cluster_uri = 3; */
+        if (message.clusterUri !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.clusterUri);
+        /* teleport.lib.teleterm.v1.ListResourcesParams params = 4; */
+        if (message.params)
+            ListResourcesParams.internalBinaryWrite(message.params, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.ListKubernetesServersRequest
+ */
+export const ListKubernetesServersRequest = new ListKubernetesServersRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListKubernetesServersResponse$Type extends MessageType<ListKubernetesServersResponse> {
+    constructor() {
+        super("teleport.lib.teleterm.v1.ListKubernetesServersResponse", [
+            { no: 1, name: "resources", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => KubeServer },
+            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ListKubernetesServersResponse>): ListKubernetesServersResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.resources = [];
+        message.nextPageToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<ListKubernetesServersResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListKubernetesServersResponse): ListKubernetesServersResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated teleport.lib.teleterm.v1.KubeServer resources */ 1:
+                    message.resources.push(KubeServer.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* string next_page_token */ 2:
+                    message.nextPageToken = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListKubernetesServersResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated teleport.lib.teleterm.v1.KubeServer resources = 1; */
+        for (let i = 0; i < message.resources.length; i++)
+            KubeServer.internalBinaryWrite(message.resources[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string next_page_token = 2; */
+        if (message.nextPageToken !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.ListKubernetesServersResponse
+ */
+export const ListKubernetesServersResponse = new ListKubernetesServersResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class CredentialInfo$Type extends MessageType<CredentialInfo> {
     constructor() {
         super("teleport.lib.teleterm.v1.CredentialInfo", [
@@ -5738,8 +5953,8 @@ export const TerminalService = new ServiceType("teleport.lib.teleterm.v1.Termina
     { name: "PromoteAccessRequest", options: {}, I: PromoteAccessRequestRequest, O: PromoteAccessRequestResponse },
     { name: "GetSuggestedAccessLists", options: {}, I: GetSuggestedAccessListsRequest, O: GetSuggestedAccessListsResponse },
     { name: "ListKubernetesResources", options: {}, I: ListKubernetesResourcesRequest, O: ListKubernetesResourcesResponse },
+    { name: "ListKubernetesServers", options: {}, I: ListKubernetesServersRequest, O: ListKubernetesServersResponse },
     { name: "AddCluster", options: {}, I: AddClusterRequest, O: Cluster },
-    { name: "RemoveCluster", options: {}, I: RemoveClusterRequest, O: EmptyResponse },
     { name: "ListGateways", options: {}, I: ListGatewaysRequest, O: ListGatewaysResponse },
     { name: "CreateGateway", options: {}, I: CreateGatewayRequest, O: Gateway },
     { name: "RemoveGateway", options: {}, I: RemoveGatewayRequest, O: EmptyResponse },
@@ -5750,6 +5965,7 @@ export const TerminalService = new ServiceType("teleport.lib.teleterm.v1.Termina
     { name: "Login", options: {}, I: LoginRequest, O: EmptyResponse },
     { name: "LoginPasswordless", serverStreaming: true, clientStreaming: true, options: {}, I: LoginPasswordlessRequest, O: LoginPasswordlessResponse },
     { name: "Logout", options: {}, I: LogoutRequest, O: EmptyResponse },
+    { name: "ClearStaleClusterClients", options: {}, I: ClearStaleClusterClientsRequest, O: ClearStaleClusterClientsResponse },
     { name: "TransferFile", serverStreaming: true, options: {}, I: FileTransferRequest, O: FileTransferProgress },
     { name: "ReportUsageEvent", options: {}, I: ReportUsageEventRequest, O: EmptyResponse },
     { name: "UpdateHeadlessAuthenticationState", options: {}, I: UpdateHeadlessAuthenticationStateRequest, O: UpdateHeadlessAuthenticationStateResponse },
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/target_health_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/target_health_pb.ts
index 04858db54fbe2..24a316f118d0c 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/target_health_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/target_health_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/target_health.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -50,19 +50,27 @@ export interface TargetHealth {
      * @generated from protobuf field: string error = 2;
      */
     error: string;
+    /**
+     * message is additional information meant for a user.
+     *
+     * @generated from protobuf field: string message = 3;
+     */
+    message: string;
 }
 // @generated message type with reflection information, may provide speed optimized methods
 class TargetHealth$Type extends MessageType<TargetHealth> {
     constructor() {
         super("teleport.lib.teleterm.v1.TargetHealth", [
             { no: 1, name: "status", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "error", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 2, name: "error", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "message", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<TargetHealth>): TargetHealth {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.status = "";
         message.error = "";
+        message.message = "";
         if (value !== undefined)
             reflectionMergePartial<TargetHealth>(this, message, value);
         return message;
@@ -78,6 +86,9 @@ class TargetHealth$Type extends MessageType<TargetHealth> {
                 case /* string error */ 2:
                     message.error = reader.string();
                     break;
+                case /* string message */ 3:
+                    message.message = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -96,6 +107,9 @@ class TargetHealth$Type extends MessageType<TargetHealth> {
         /* string error = 2; */
         if (message.error !== "")
             writer.tag(2, WireType.LengthDelimited).string(message.error);
+        /* string message = 3; */
+        if (message.message !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
index e0ded4ff476fc..42550601366d7 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
index 089af6b221d9e..71b9b048dcfba 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
index 145834a1108db..9baf7216fb509 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
index 5336cb3b9d387..e06e46bd6e609 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/usage_events.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/windows_desktop_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/windows_desktop_pb.ts
index 544ac08484cc6..cb4827ade5132 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/windows_desktop_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/windows_desktop_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/windows_desktop.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.client.ts
index f0240cdf36c14..bd3b7b8620f20 100644
--- a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.client.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/vnet/v1/vnet_service.proto" (package "teleport.lib.teleterm.vnet.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -23,12 +23,14 @@
 import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
 import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
 import { VnetService } from "./vnet_service_pb";
+import type { AutoConfigureSSHResponse } from "./vnet_service_pb";
+import type { AutoConfigureSSHRequest } from "./vnet_service_pb";
 import type { RunDiagnosticsResponse } from "./vnet_service_pb";
 import type { RunDiagnosticsRequest } from "./vnet_service_pb";
 import type { GetBackgroundItemStatusResponse } from "./vnet_service_pb";
 import type { GetBackgroundItemStatusRequest } from "./vnet_service_pb";
-import type { ListDNSZonesResponse } from "./vnet_service_pb";
-import type { ListDNSZonesRequest } from "./vnet_service_pb";
+import type { GetServiceInfoResponse } from "./vnet_service_pb";
+import type { GetServiceInfoRequest } from "./vnet_service_pb";
 import type { StopResponse } from "./vnet_service_pb";
 import type { StopRequest } from "./vnet_service_pb";
 import { stackIntercept } from "@protobuf-ts/runtime-rpc";
@@ -55,19 +57,11 @@ export interface IVnetServiceClient {
      */
     stop(input: StopRequest, options?: RpcOptions): UnaryCall<StopRequest, StopResponse>;
     /**
-     * ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-     * includes the proxy service hostnames and custom DNS zones configured in vnet_config.
+     * GetServiceInfo returns info about the running VNet service.
      *
-     * This is fetched independently of what the Electron app thinks the current state of the cluster
-     * looks like, since the VNet admin process also fetches this data independently of the Electron
-     * app.
-     *
-     * Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-     * be fetched (due to e.g., a network error or an expired cert).
-     *
-     * @generated from protobuf rpc: ListDNSZones(teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest) returns (teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse);
+     * @generated from protobuf rpc: GetServiceInfo(teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest) returns (teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse);
      */
-    listDNSZones(input: ListDNSZonesRequest, options?: RpcOptions): UnaryCall<ListDNSZonesRequest, ListDNSZonesResponse>;
+    getServiceInfo(input: GetServiceInfoRequest, options?: RpcOptions): UnaryCall<GetServiceInfoRequest, GetServiceInfoResponse>;
     /**
      * GetBackgroundItemStatus returns the status of the background item responsible for launching
      * VNet daemon. macOS only. tsh must be compiled with the vnetdaemon build tag.
@@ -82,6 +76,13 @@ export interface IVnetServiceClient {
      * @generated from protobuf rpc: RunDiagnostics(teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest) returns (teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse);
      */
     runDiagnostics(input: RunDiagnosticsRequest, options?: RpcOptions): UnaryCall<RunDiagnosticsRequest, RunDiagnosticsResponse>;
+    /**
+     * AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+     * connections to Teleport SSH hosts.
+     *
+     * @generated from protobuf rpc: AutoConfigureSSH(teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest) returns (teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse);
+     */
+    autoConfigureSSH(input: AutoConfigureSSHRequest, options?: RpcOptions): UnaryCall<AutoConfigureSSHRequest, AutoConfigureSSHResponse>;
 }
 /**
  * VnetService provides methods to manage a VNet instance.
@@ -113,21 +114,13 @@ export class VnetServiceClient implements IVnetServiceClient, ServiceInfo {
         return stackIntercept<StopRequest, StopResponse>("unary", this._transport, method, opt, input);
     }
     /**
-     * ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-     * includes the proxy service hostnames and custom DNS zones configured in vnet_config.
-     *
-     * This is fetched independently of what the Electron app thinks the current state of the cluster
-     * looks like, since the VNet admin process also fetches this data independently of the Electron
-     * app.
+     * GetServiceInfo returns info about the running VNet service.
      *
-     * Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-     * be fetched (due to e.g., a network error or an expired cert).
-     *
-     * @generated from protobuf rpc: ListDNSZones(teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest) returns (teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse);
+     * @generated from protobuf rpc: GetServiceInfo(teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest) returns (teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse);
      */
-    listDNSZones(input: ListDNSZonesRequest, options?: RpcOptions): UnaryCall<ListDNSZonesRequest, ListDNSZonesResponse> {
+    getServiceInfo(input: GetServiceInfoRequest, options?: RpcOptions): UnaryCall<GetServiceInfoRequest, GetServiceInfoResponse> {
         const method = this.methods[2], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ListDNSZonesRequest, ListDNSZonesResponse>("unary", this._transport, method, opt, input);
+        return stackIntercept<GetServiceInfoRequest, GetServiceInfoResponse>("unary", this._transport, method, opt, input);
     }
     /**
      * GetBackgroundItemStatus returns the status of the background item responsible for launching
@@ -149,4 +142,14 @@ export class VnetServiceClient implements IVnetServiceClient, ServiceInfo {
         const method = this.methods[4], opt = this._transport.mergeOptions(options);
         return stackIntercept<RunDiagnosticsRequest, RunDiagnosticsResponse>("unary", this._transport, method, opt, input);
     }
+    /**
+     * AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+     * connections to Teleport SSH hosts.
+     *
+     * @generated from protobuf rpc: AutoConfigureSSH(teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest) returns (teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse);
+     */
+    autoConfigureSSH(input: AutoConfigureSSHRequest, options?: RpcOptions): UnaryCall<AutoConfigureSSHRequest, AutoConfigureSSHResponse> {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AutoConfigureSSHRequest, AutoConfigureSSHResponse>("unary", this._transport, method, opt, input);
+    }
 }
diff --git a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.grpc-server.ts
index ffc239038e5f1..ea46ece0fcd38 100644
--- a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/vnet/v1/vnet_service.proto" (package "teleport.lib.teleterm.vnet.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -20,12 +20,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
+import { AutoConfigureSSHResponse } from "./vnet_service_pb";
+import { AutoConfigureSSHRequest } from "./vnet_service_pb";
 import { RunDiagnosticsResponse } from "./vnet_service_pb";
 import { RunDiagnosticsRequest } from "./vnet_service_pb";
 import { GetBackgroundItemStatusResponse } from "./vnet_service_pb";
 import { GetBackgroundItemStatusRequest } from "./vnet_service_pb";
-import { ListDNSZonesResponse } from "./vnet_service_pb";
-import { ListDNSZonesRequest } from "./vnet_service_pb";
+import { GetServiceInfoResponse } from "./vnet_service_pb";
+import { GetServiceInfoRequest } from "./vnet_service_pb";
 import { StopResponse } from "./vnet_service_pb";
 import { StopRequest } from "./vnet_service_pb";
 import { StartResponse } from "./vnet_service_pb";
@@ -50,19 +52,11 @@ export interface IVnetService extends grpc.UntypedServiceImplementation {
      */
     stop: grpc.handleUnaryCall<StopRequest, StopResponse>;
     /**
-     * ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-     * includes the proxy service hostnames and custom DNS zones configured in vnet_config.
+     * GetServiceInfo returns info about the running VNet service.
      *
-     * This is fetched independently of what the Electron app thinks the current state of the cluster
-     * looks like, since the VNet admin process also fetches this data independently of the Electron
-     * app.
-     *
-     * Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-     * be fetched (due to e.g., a network error or an expired cert).
-     *
-     * @generated from protobuf rpc: ListDNSZones(teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest) returns (teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse);
+     * @generated from protobuf rpc: GetServiceInfo(teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest) returns (teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse);
      */
-    listDNSZones: grpc.handleUnaryCall<ListDNSZonesRequest, ListDNSZonesResponse>;
+    getServiceInfo: grpc.handleUnaryCall<GetServiceInfoRequest, GetServiceInfoResponse>;
     /**
      * GetBackgroundItemStatus returns the status of the background item responsible for launching
      * VNet daemon. macOS only. tsh must be compiled with the vnetdaemon build tag.
@@ -77,6 +71,13 @@ export interface IVnetService extends grpc.UntypedServiceImplementation {
      * @generated from protobuf rpc: RunDiagnostics(teleport.lib.teleterm.vnet.v1.RunDiagnosticsRequest) returns (teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse);
      */
     runDiagnostics: grpc.handleUnaryCall<RunDiagnosticsRequest, RunDiagnosticsResponse>;
+    /**
+     * AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+     * connections to Teleport SSH hosts.
+     *
+     * @generated from protobuf rpc: AutoConfigureSSH(teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest) returns (teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse);
+     */
+    autoConfigureSSH: grpc.handleUnaryCall<AutoConfigureSSHRequest, AutoConfigureSSHResponse>;
 }
 /**
  * @grpc/grpc-js definition for the protobuf service teleport.lib.teleterm.vnet.v1.VnetService.
@@ -110,15 +111,15 @@ export const vnetServiceDefinition: grpc.ServiceDefinition<IVnetService> = {
         responseSerialize: value => Buffer.from(StopResponse.toBinary(value)),
         requestSerialize: value => Buffer.from(StopRequest.toBinary(value))
     },
-    listDNSZones: {
-        path: "/teleport.lib.teleterm.vnet.v1.VnetService/ListDNSZones",
-        originalName: "ListDNSZones",
+    getServiceInfo: {
+        path: "/teleport.lib.teleterm.vnet.v1.VnetService/GetServiceInfo",
+        originalName: "GetServiceInfo",
         requestStream: false,
         responseStream: false,
-        responseDeserialize: bytes => ListDNSZonesResponse.fromBinary(bytes),
-        requestDeserialize: bytes => ListDNSZonesRequest.fromBinary(bytes),
-        responseSerialize: value => Buffer.from(ListDNSZonesResponse.toBinary(value)),
-        requestSerialize: value => Buffer.from(ListDNSZonesRequest.toBinary(value))
+        responseDeserialize: bytes => GetServiceInfoResponse.fromBinary(bytes),
+        requestDeserialize: bytes => GetServiceInfoRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(GetServiceInfoResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(GetServiceInfoRequest.toBinary(value))
     },
     getBackgroundItemStatus: {
         path: "/teleport.lib.teleterm.vnet.v1.VnetService/GetBackgroundItemStatus",
@@ -139,5 +140,15 @@ export const vnetServiceDefinition: grpc.ServiceDefinition<IVnetService> = {
         requestDeserialize: bytes => RunDiagnosticsRequest.fromBinary(bytes),
         responseSerialize: value => Buffer.from(RunDiagnosticsResponse.toBinary(value)),
         requestSerialize: value => Buffer.from(RunDiagnosticsRequest.toBinary(value))
+    },
+    autoConfigureSSH: {
+        path: "/teleport.lib.teleterm.vnet.v1.VnetService/AutoConfigureSSH",
+        originalName: "AutoConfigureSSH",
+        requestStream: false,
+        responseStream: false,
+        responseDeserialize: bytes => AutoConfigureSSHResponse.fromBinary(bytes),
+        requestDeserialize: bytes => AutoConfigureSSHRequest.fromBinary(bytes),
+        responseSerialize: value => Buffer.from(AutoConfigureSSHResponse.toBinary(value)),
+        requestSerialize: value => Buffer.from(AutoConfigureSSHRequest.toBinary(value))
     }
 };
diff --git a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.ts
index 08f7483ad36b1..9a58c635851c0 100644
--- a/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/vnet/v1/vnet_service.proto" (package "teleport.lib.teleterm.vnet.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -60,24 +60,45 @@ export interface StopRequest {
 export interface StopResponse {
 }
 /**
- * Request for ListDNSZones.
+ * Request for GetServiceInfo.
  *
- * @generated from protobuf message teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest
+ * @generated from protobuf message teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest
  */
-export interface ListDNSZonesRequest {
+export interface GetServiceInfoRequest {
 }
 /**
- * Response for ListDNSZones.
+ * GetServiceInfoResponse contains the status of the running VNet service.
  *
- * @generated from protobuf message teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse
+ * @generated from protobuf message teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse
  */
-export interface ListDNSZonesResponse {
+export interface GetServiceInfoResponse {
     /**
-     * dns_zones is a deduplicated list of DNS zones.
+     * app_dns_zones is a deduplicated list of all DNS zones valid as DNS
+     * suffixes for connections to TCP apps.
      *
-     * @generated from protobuf field: repeated string dns_zones = 1;
+     * @generated from protobuf field: repeated string app_dns_zones = 1;
      */
-    dnsZones: string[];
+    appDnsZones: string[];
+    /**
+     * clusters is a list of cluster names valid as DNS suffixes for SSH hosts.
+     *
+     * @generated from protobuf field: repeated string clusters = 2;
+     */
+    clusters: string[];
+    /**
+     * ssh_configured is true if the user's SSH config file includes VNet's
+     * generated SSH config necessary for SSH access.
+     *
+     * @generated from protobuf field: bool ssh_configured = 3;
+     */
+    sshConfigured: boolean;
+    /**
+     * vnet_ssh_config_path is the path of VNet's generated OpenSSH-compatible
+     * config file.
+     *
+     * @generated from protobuf field: string vnet_ssh_config_path = 4;
+     */
+    vnetSshConfigPath: string;
 }
 /**
  * Request for GetBackgroundItemStatus.
@@ -115,6 +136,20 @@ export interface RunDiagnosticsResponse {
      */
     report?: Report;
 }
+/**
+ * Request for AutoConfigureSSH.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest
+ */
+export interface AutoConfigureSSHRequest {
+}
+/**
+ * Response for AutoConfigureSSH.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse
+ */
+export interface AutoConfigureSSHResponse {
+}
 /**
  * BackgroundItemStatus maps to SMAppServiceStatus of the Service Management framework in macOS.
  * https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.enum?language=objc
@@ -251,20 +286,20 @@ class StopResponse$Type extends MessageType<StopResponse> {
  */
 export const StopResponse = new StopResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class ListDNSZonesRequest$Type extends MessageType<ListDNSZonesRequest> {
+class GetServiceInfoRequest$Type extends MessageType<GetServiceInfoRequest> {
     constructor() {
-        super("teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest", []);
+        super("teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest", []);
     }
-    create(value?: PartialMessage<ListDNSZonesRequest>): ListDNSZonesRequest {
+    create(value?: PartialMessage<GetServiceInfoRequest>): GetServiceInfoRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         if (value !== undefined)
-            reflectionMergePartial<ListDNSZonesRequest>(this, message, value);
+            reflectionMergePartial<GetServiceInfoRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDNSZonesRequest): ListDNSZonesRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetServiceInfoRequest): GetServiceInfoRequest {
         return target ?? this.create();
     }
-    internalBinaryWrite(message: ListDNSZonesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: GetServiceInfoRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -272,30 +307,45 @@ class ListDNSZonesRequest$Type extends MessageType<ListDNSZonesRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.ListDNSZonesRequest
+ * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.GetServiceInfoRequest
  */
-export const ListDNSZonesRequest = new ListDNSZonesRequest$Type();
+export const GetServiceInfoRequest = new GetServiceInfoRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class ListDNSZonesResponse$Type extends MessageType<ListDNSZonesResponse> {
+class GetServiceInfoResponse$Type extends MessageType<GetServiceInfoResponse> {
     constructor() {
-        super("teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse", [
-            { no: 1, name: "dns_zones", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        super("teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse", [
+            { no: 1, name: "app_dns_zones", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "clusters", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "ssh_configured", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "vnet_ssh_config_path", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<ListDNSZonesResponse>): ListDNSZonesResponse {
+    create(value?: PartialMessage<GetServiceInfoResponse>): GetServiceInfoResponse {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.dnsZones = [];
+        message.appDnsZones = [];
+        message.clusters = [];
+        message.sshConfigured = false;
+        message.vnetSshConfigPath = "";
         if (value !== undefined)
-            reflectionMergePartial<ListDNSZonesResponse>(this, message, value);
+            reflectionMergePartial<GetServiceInfoResponse>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListDNSZonesResponse): ListDNSZonesResponse {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetServiceInfoResponse): GetServiceInfoResponse {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* repeated string dns_zones */ 1:
-                    message.dnsZones.push(reader.string());
+                case /* repeated string app_dns_zones */ 1:
+                    message.appDnsZones.push(reader.string());
+                    break;
+                case /* repeated string clusters */ 2:
+                    message.clusters.push(reader.string());
+                    break;
+                case /* bool ssh_configured */ 3:
+                    message.sshConfigured = reader.bool();
+                    break;
+                case /* string vnet_ssh_config_path */ 4:
+                    message.vnetSshConfigPath = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -308,10 +358,19 @@ class ListDNSZonesResponse$Type extends MessageType<ListDNSZonesResponse> {
         }
         return message;
     }
-    internalBinaryWrite(message: ListDNSZonesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated string dns_zones = 1; */
-        for (let i = 0; i < message.dnsZones.length; i++)
-            writer.tag(1, WireType.LengthDelimited).string(message.dnsZones[i]);
+    internalBinaryWrite(message: GetServiceInfoResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated string app_dns_zones = 1; */
+        for (let i = 0; i < message.appDnsZones.length; i++)
+            writer.tag(1, WireType.LengthDelimited).string(message.appDnsZones[i]);
+        /* repeated string clusters = 2; */
+        for (let i = 0; i < message.clusters.length; i++)
+            writer.tag(2, WireType.LengthDelimited).string(message.clusters[i]);
+        /* bool ssh_configured = 3; */
+        if (message.sshConfigured !== false)
+            writer.tag(3, WireType.Varint).bool(message.sshConfigured);
+        /* string vnet_ssh_config_path = 4; */
+        if (message.vnetSshConfigPath !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.vnetSshConfigPath);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -319,9 +378,9 @@ class ListDNSZonesResponse$Type extends MessageType<ListDNSZonesResponse> {
     }
 }
 /**
- * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.ListDNSZonesResponse
+ * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.GetServiceInfoResponse
  */
-export const ListDNSZonesResponse = new ListDNSZonesResponse$Type();
+export const GetServiceInfoResponse = new GetServiceInfoResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
 class GetBackgroundItemStatusRequest$Type extends MessageType<GetBackgroundItemStatusRequest> {
     constructor() {
@@ -465,13 +524,64 @@ class RunDiagnosticsResponse$Type extends MessageType<RunDiagnosticsResponse> {
  * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.RunDiagnosticsResponse
  */
 export const RunDiagnosticsResponse = new RunDiagnosticsResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AutoConfigureSSHRequest$Type extends MessageType<AutoConfigureSSHRequest> {
+    constructor() {
+        super("teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest", []);
+    }
+    create(value?: PartialMessage<AutoConfigureSSHRequest>): AutoConfigureSSHRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<AutoConfigureSSHRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AutoConfigureSSHRequest): AutoConfigureSSHRequest {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: AutoConfigureSSHRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.AutoConfigureSSHRequest
+ */
+export const AutoConfigureSSHRequest = new AutoConfigureSSHRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AutoConfigureSSHResponse$Type extends MessageType<AutoConfigureSSHResponse> {
+    constructor() {
+        super("teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse", []);
+    }
+    create(value?: PartialMessage<AutoConfigureSSHResponse>): AutoConfigureSSHResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<AutoConfigureSSHResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AutoConfigureSSHResponse): AutoConfigureSSHResponse {
+        return target ?? this.create();
+    }
+    internalBinaryWrite(message: AutoConfigureSSHResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.vnet.v1.AutoConfigureSSHResponse
+ */
+export const AutoConfigureSSHResponse = new AutoConfigureSSHResponse$Type();
 /**
  * @generated ServiceType for protobuf service teleport.lib.teleterm.vnet.v1.VnetService
  */
 export const VnetService = new ServiceType("teleport.lib.teleterm.vnet.v1.VnetService", [
     { name: "Start", options: {}, I: StartRequest, O: StartResponse },
     { name: "Stop", options: {}, I: StopRequest, O: StopResponse },
-    { name: "ListDNSZones", options: {}, I: ListDNSZonesRequest, O: ListDNSZonesResponse },
+    { name: "GetServiceInfo", options: {}, I: GetServiceInfoRequest, O: GetServiceInfoResponse },
     { name: "GetBackgroundItemStatus", options: {}, I: GetBackgroundItemStatusRequest, O: GetBackgroundItemStatusResponse },
-    { name: "RunDiagnostics", options: {}, I: RunDiagnosticsRequest, O: RunDiagnosticsResponse }
+    { name: "RunDiagnostics", options: {}, I: RunDiagnosticsRequest, O: RunDiagnosticsResponse },
+    { name: "AutoConfigureSSH", options: {}, I: AutoConfigureSSHRequest, O: AutoConfigureSSHResponse }
 ]);
diff --git a/gen/proto/ts/teleport/lib/vnet/diag/v1/diag_pb.ts b/gen/proto/ts/teleport/lib/vnet/diag/v1/diag_pb.ts
index dd193b224d559..91f492efb3a8a 100644
--- a/gen/proto/ts/teleport/lib/vnet/diag/v1/diag_pb.ts
+++ b/gen/proto/ts/teleport/lib/vnet/diag/v1/diag_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/vnet/diag/v1/diag.proto" (package "teleport.lib.vnet.diag.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -183,6 +183,14 @@ export interface CheckReport {
          * @generated from protobuf field: teleport.lib.vnet.diag.v1.RouteConflictReport route_conflict_report = 2;
          */
         routeConflictReport: RouteConflictReport;
+    } | {
+        oneofKind: "sshConfigurationReport";
+        /**
+         * ssh_configuration_report reports the status of the system's SSH configuration.
+         *
+         * @generated from protobuf field: teleport.lib.vnet.diag.v1.SSHConfigurationReport ssh_configuration_report = 3;
+         */
+        sshConfigurationReport: SSHConfigurationReport;
     } | {
         oneofKind: undefined;
     };
@@ -263,6 +271,48 @@ export interface RouteConflict {
      */
     interfaceApp: string;
 }
+/**
+ * SSHConfigurationReport describes the state of the system's SSH configuration.
+ *
+ * @generated from protobuf message teleport.lib.vnet.diag.v1.SSHConfigurationReport
+ */
+export interface SSHConfigurationReport {
+    /**
+     * user_openssh_config_path is the full path to the user's default OpenSSH
+     * config file (~/.ssh/config).
+     *
+     * @generated from protobuf field: string user_openssh_config_path = 1;
+     */
+    userOpensshConfigPath: string;
+    /**
+     * vnet_ssh_config_path is the path to VNet's generated OpenSSH-compatible
+     * config file.
+     *
+     * @generated from protobuf field: string vnet_ssh_config_path = 2;
+     */
+    vnetSshConfigPath: string;
+    /**
+     * user_openssh_config_includes_vnet_ssh_config is true if the default
+     * OpenSSH user configuration file includes VNet's SSH config file.
+     *
+     * @generated from protobuf field: bool user_openssh_config_includes_vnet_ssh_config = 3;
+     */
+    userOpensshConfigIncludesVnetSshConfig: boolean;
+    /**
+     * user_openssh_config_exists is true if a file exists at
+     * user_openssh_config_path (~/.ssh/config).
+     *
+     * @generated from protobuf field: bool user_openssh_config_exists = 4;
+     */
+    userOpensshConfigExists: boolean;
+    /**
+     * user_openssh_config_contents contains the contents of the file at
+     * user_openssh_config_path if it exists.
+     *
+     * @generated from protobuf field: string user_openssh_config_contents = 5;
+     */
+    userOpensshConfigContents: string;
+}
 /**
  * CheckAttemptStatus describes whether CheckAttempt finished successfully. This is different from
  * CheckReportStatus, which describes whether a successful attempt at running a check has found any
@@ -599,7 +649,8 @@ class CheckReport$Type extends MessageType<CheckReport> {
     constructor() {
         super("teleport.lib.vnet.diag.v1.CheckReport", [
             { no: 1, name: "status", kind: "enum", T: () => ["teleport.lib.vnet.diag.v1.CheckReportStatus", CheckReportStatus, "CHECK_REPORT_STATUS_"] },
-            { no: 2, name: "route_conflict_report", kind: "message", oneof: "report", T: () => RouteConflictReport }
+            { no: 2, name: "route_conflict_report", kind: "message", oneof: "report", T: () => RouteConflictReport },
+            { no: 3, name: "ssh_configuration_report", kind: "message", oneof: "report", T: () => SSHConfigurationReport }
         ]);
     }
     create(value?: PartialMessage<CheckReport>): CheckReport {
@@ -624,6 +675,12 @@ class CheckReport$Type extends MessageType<CheckReport> {
                         routeConflictReport: RouteConflictReport.internalBinaryRead(reader, reader.uint32(), options, (message.report as any).routeConflictReport)
                     };
                     break;
+                case /* teleport.lib.vnet.diag.v1.SSHConfigurationReport ssh_configuration_report */ 3:
+                    message.report = {
+                        oneofKind: "sshConfigurationReport",
+                        sshConfigurationReport: SSHConfigurationReport.internalBinaryRead(reader, reader.uint32(), options, (message.report as any).sshConfigurationReport)
+                    };
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -642,6 +699,9 @@ class CheckReport$Type extends MessageType<CheckReport> {
         /* teleport.lib.vnet.diag.v1.RouteConflictReport route_conflict_report = 2; */
         if (message.report.oneofKind === "routeConflictReport")
             RouteConflictReport.internalBinaryWrite(message.report.routeConflictReport, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        /* teleport.lib.vnet.diag.v1.SSHConfigurationReport ssh_configuration_report = 3; */
+        if (message.report.oneofKind === "sshConfigurationReport")
+            SSHConfigurationReport.internalBinaryWrite(message.report.sshConfigurationReport, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -841,3 +901,82 @@ class RouteConflict$Type extends MessageType<RouteConflict> {
  * @generated MessageType for protobuf message teleport.lib.vnet.diag.v1.RouteConflict
  */
 export const RouteConflict = new RouteConflict$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class SSHConfigurationReport$Type extends MessageType<SSHConfigurationReport> {
+    constructor() {
+        super("teleport.lib.vnet.diag.v1.SSHConfigurationReport", [
+            { no: 1, name: "user_openssh_config_path", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "vnet_ssh_config_path", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "user_openssh_config_includes_vnet_ssh_config", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "user_openssh_config_exists", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 5, name: "user_openssh_config_contents", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<SSHConfigurationReport>): SSHConfigurationReport {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.userOpensshConfigPath = "";
+        message.vnetSshConfigPath = "";
+        message.userOpensshConfigIncludesVnetSshConfig = false;
+        message.userOpensshConfigExists = false;
+        message.userOpensshConfigContents = "";
+        if (value !== undefined)
+            reflectionMergePartial<SSHConfigurationReport>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SSHConfigurationReport): SSHConfigurationReport {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string user_openssh_config_path */ 1:
+                    message.userOpensshConfigPath = reader.string();
+                    break;
+                case /* string vnet_ssh_config_path */ 2:
+                    message.vnetSshConfigPath = reader.string();
+                    break;
+                case /* bool user_openssh_config_includes_vnet_ssh_config */ 3:
+                    message.userOpensshConfigIncludesVnetSshConfig = reader.bool();
+                    break;
+                case /* bool user_openssh_config_exists */ 4:
+                    message.userOpensshConfigExists = reader.bool();
+                    break;
+                case /* string user_openssh_config_contents */ 5:
+                    message.userOpensshConfigContents = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: SSHConfigurationReport, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string user_openssh_config_path = 1; */
+        if (message.userOpensshConfigPath !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.userOpensshConfigPath);
+        /* string vnet_ssh_config_path = 2; */
+        if (message.vnetSshConfigPath !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.vnetSshConfigPath);
+        /* bool user_openssh_config_includes_vnet_ssh_config = 3; */
+        if (message.userOpensshConfigIncludesVnetSshConfig !== false)
+            writer.tag(3, WireType.Varint).bool(message.userOpensshConfigIncludesVnetSshConfig);
+        /* bool user_openssh_config_exists = 4; */
+        if (message.userOpensshConfigExists !== false)
+            writer.tag(4, WireType.Varint).bool(message.userOpensshConfigExists);
+        /* string user_openssh_config_contents = 5; */
+        if (message.userOpensshConfigContents !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.userOpensshConfigContents);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.vnet.diag.v1.SSHConfigurationReport
+ */
+export const SSHConfigurationReport = new SSHConfigurationReport$Type();
diff --git a/gen/proto/ts/teleport/trait/v1/trait_pb.ts b/gen/proto/ts/teleport/trait/v1/trait_pb.ts
index 75f0a4d515c84..557bc102b82a5 100644
--- a/gen/proto/ts/teleport/trait/v1/trait_pb.ts
+++ b/gen/proto/ts/teleport/trait/v1/trait_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/trait/v1/trait.proto" (package "teleport.trait.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/access_graph_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/access_graph_pb.ts
index 9021ff00a6cf6..1a3a13e4819a6 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/access_graph_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/access_graph_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/access_graph.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
index eeae5776314b9..b99c853720d32 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/assist.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
index 3c23d61452170..7c71a8da79045 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/cluster_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/discover_resource_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/discover_resource_preferences_pb.ts
index 763ba7ee433a1..2cdf55a900a53 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/discover_resource_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/discover_resource_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/discover_resource_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
index d2c0a3f0ba902..7e408a5831696 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/onboard.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/sidenav_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/sidenav_preferences_pb.ts
index c092fca00e3b8..5bf39cc74e878 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/sidenav_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/sidenav_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/sidenav_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
index d1830aa73d147..bea59882cb433 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/theme.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
index 3e1a9723b1b9e..2e42cdb61a868 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/unified_resource_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts
index 866979781ea53..418d79059ad7b 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
index 463b6a0e460ab..7f9b92db76565 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
index 26ea6a2cee305..0cbf9f06598ff 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter add_pb_suffix,eslint_disable,generate_dependencies,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/go.mod b/go.mod
index a905bdbb3da05..8e5d7a556398c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,22 +1,24 @@
 module github.com/gravitational/teleport
 
-go 1.24.3
+go 1.24.11
 
 require (
+	cloud.google.com/go/alloydb v1.16.1
 	cloud.google.com/go/cloudsqlconn v1.17.0
-	cloud.google.com/go/compute v1.37.0
-	cloud.google.com/go/compute/metadata v0.6.0
-	cloud.google.com/go/container v1.42.4
+	cloud.google.com/go/compute v1.38.0
+	cloud.google.com/go/compute/metadata v0.8.0
+	cloud.google.com/go/container v1.43.0
 	cloud.google.com/go/firestore v1.18.0
 	cloud.google.com/go/iam v1.5.2
-	cloud.google.com/go/kms v1.21.2
+	cloud.google.com/go/kms v1.22.0
 	cloud.google.com/go/resourcemanager v1.10.6
-	cloud.google.com/go/spanner v1.80.0
-	cloud.google.com/go/storage v1.52.0
+	cloud.google.com/go/spanner v1.85.0
+	cloud.google.com/go/storage v1.56.1
 	code.dny.dev/ssrf v0.2.0
 	connectrpc.com/connect v1.18.1
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0
+	filippo.io/age v1.2.1
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0
@@ -43,16 +45,19 @@ require (
 	github.com/andybalholm/brotli v1.1.1
 	github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2
 	github.com/armon/go-radix v1.0.0
-	github.com/aws/aws-sdk-go-v2 v1.36.3
-	github.com/aws/aws-sdk-go-v2/config v1.29.14
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.67
+	github.com/aws/aws-sdk-go-v2 v1.39.6
+	github.com/aws/aws-sdk-go-v2/config v1.31.0
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4
 	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0
 	github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0
 	github.com/aws/aws-sdk-go-v2/service/athena v1.50.4
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9
 	github.com/aws/aws-sdk-go-v2/service/dax v1.24.2
 	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1
 	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.3
@@ -64,7 +69,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/glue v1.109.2
 	github.com/aws/aws-sdk-go-v2/service/iam v1.41.1
 	github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2
-	github.com/aws/aws-sdk-go-v2/service/kms v1.38.3
+	github.com/aws/aws-sdk-go-v2/service/kms v1.44.0
 	github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2
 	github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0
 	github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3
@@ -72,6 +77,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/rds v1.95.0
 	github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3
 	github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1
+	github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4
 	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3
 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4
@@ -79,9 +85,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0
 	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.19
-	github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v1.1.0
-	github.com/aws/smithy-go v1.22.3
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0
+	github.com/aws/smithy-go v1.23.2
 	github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.9.1
 	github.com/beevik/etree v1.5.1
@@ -96,12 +101,11 @@ require (
 	github.com/creack/pty v1.1.24
 	github.com/crewjam/saml v0.4.14
 	github.com/datastax/go-cassandra-native-protocol v0.0.0-20220706104457-5e8aad05cf90
-	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352
+	github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.5.0+incompatible
-	github.com/docker/docker v28.1.1+incompatible
+	github.com/docker/cli v28.2.2+incompatible
+	github.com/docker/docker v28.3.3+incompatible
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/go-elasticsearch/v8 v8.18.0
 	github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4
 	github.com/evanphx/json-patch v5.9.11+incompatible
@@ -112,11 +116,11 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-jose/go-jose/v3 v3.0.4
-	github.com/go-jose/go-jose/v4 v4.0.5
+	github.com/go-jose/go-jose/v4 v4.1.1
 	github.com/go-ldap/ldap/v3 v3.4.11
-	github.com/go-logr/logr v1.4.2
+	github.com/go-logr/logr v1.4.3
 	github.com/go-mysql-org/go-mysql v1.9.1 // replaced
-	github.com/go-piv/piv-go v1.11.0
+	github.com/go-piv/piv-go/v2 v2.4.0
 	github.com/go-resty/resty/v2 v2.16.5
 	github.com/go-webauthn/webauthn v0.11.2
 	github.com/gobwas/ws v1.4.0
@@ -124,11 +128,11 @@ require (
 	github.com/gofrs/flock v0.12.1
 	github.com/gogo/protobuf v1.3.2 // replaced
 	github.com/golang-jwt/jwt/v4 v4.5.2
-	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/btree v1.1.3
 	github.com/google/go-attestation v0.5.1
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.20.3
+	github.com/google/go-containerregistry v0.20.6
 	github.com/google/go-github/v70 v70.0.0
 	github.com/google/go-querystring v1.1.0
 	github.com/google/go-tpm v0.9.4
@@ -137,17 +141,20 @@ require (
 	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.6.0
-	github.com/googleapis/gax-go/v2 v2.14.1
+	github.com/googleapis/gax-go/v2 v2.15.0
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
-	github.com/grafana/pyroscope-go v1.2.2
+	github.com/grafana/pyroscope-go v1.2.4
 	github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1
-	github.com/gravitational/roundtrip v1.0.2
+	github.com/gravitational/roundtrip v1.0.3
 	github.com/gravitational/teleport/api v0.0.0
 	github.com/gravitational/trace v1.5.1
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1
 	github.com/guptarohit/asciigraph v0.7.3
 	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/hashicorp/hcl/v2 v2.24.0
+	github.com/hashicorp/yamux v0.1.2
+	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02
 	github.com/icza/mjpeg v0.0.0-20230330134156-38318e5ab8f4
 	github.com/jackc/pgconn v1.14.3
 	github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438
@@ -156,7 +163,7 @@ require (
 	github.com/jackc/pgx/v4 v4.18.3
 	github.com/jackc/pgx/v5 v5.7.4
 	github.com/jcmturner/gokrb5/v8 v8.4.4
-	github.com/johannesboyne/gofakes3 v0.0.0-20240217095638-c55a48f17be6
+	github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3
 	github.com/jonboulle/clockwork v0.5.0
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531
 	github.com/json-iterator/go v1.1.12
@@ -164,6 +171,7 @@ require (
 	github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 // replaced
 	github.com/lib/pq v1.10.9
 	github.com/mailgun/mailgun-go/v4 v4.23.0
+	github.com/mark3labs/mcp-go v0.41.1
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/mattn/go-sqlite3 v1.14.28
 	github.com/mdlayher/netlink v1.7.2
@@ -171,7 +179,9 @@ require (
 	github.com/miekg/pkcs11 v1.1.1
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
 	github.com/moby/term v0.5.2
+	github.com/ohler55/ojg v1.26.8
 	github.com/okta/okta-sdk-golang/v2 v2.20.0
+	github.com/openai/openai-go v1.8.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/selinux v1.12.0
 	github.com/opensearch-project/opensearch-go/v2 v2.3.0
@@ -181,61 +191,67 @@ require (
 	github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/sftp v1.13.9
+	github.com/pkoukk/tiktoken-go v0.1.8
 	github.com/pquerna/otp v1.4.0
-	github.com/prometheus/client_golang v1.22.0
+	github.com/prometheus/client_golang v1.23.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.63.0
-	github.com/quic-go/quic-go v0.51.0
-	github.com/redis/go-redis/v9 v9.7.3 // replaced
+	github.com/prometheus/common v0.65.0
+	github.com/quic-go/quic-go v0.57.0
+	github.com/redis/go-redis/v9 v9.12.1 // replaced
 	github.com/russellhaering/gosaml2 v0.10.0
 	github.com/russellhaering/goxmldsig v1.5.0
 	github.com/schollz/progressbar/v3 v3.18.0
 	github.com/scim2/filter-parser/v2 v2.2.0
-	github.com/shirou/gopsutil/v4 v4.25.4
+	github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca
 	github.com/sigstore/cosign/v2 v2.5.0
-	github.com/sigstore/protobuf-specs v0.4.1
-	github.com/sigstore/sigstore v1.9.4
+	github.com/sigstore/protobuf-specs v0.5.0
+	github.com/sigstore/sigstore v1.9.5
 	github.com/sigstore/sigstore-go v0.7.1
 	github.com/sijms/go-ora/v2 v2.8.24
 	github.com/snowflakedb/gosnowflake v1.14.0
 	github.com/spf13/cobra v1.9.1
-	github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8
 	github.com/spiffe/go-spiffe/v2 v2.5.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
+	github.com/testcontainers/testcontainers-go v0.39.0
+	github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0
+	github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0
+	github.com/tidwall/pretty v1.2.1
+	github.com/tidwall/sjson v1.2.5
 	github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb
 	github.com/vulcand/predicate v1.2.0 // replaced
 	github.com/yusufpapurcu/wmi v1.2.4
-	github.com/zitadel/oidc/v3 v3.38.1
+	github.com/zclconf/go-cty v1.17.0
+	github.com/zitadel/oidc/v3 v3.43.0
 	gitlab.com/gitlab-org/api/client-go v0.127.0
 	go.etcd.io/etcd/api/v3 v3.5.21
 	go.etcd.io/etcd/client/v3 v3.5.21
-	go.mongodb.org/mongo-driver v1.14.0
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
-	go.opentelemetry.io/otel v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0
-	go.opentelemetry.io/otel/sdk v1.35.0
-	go.opentelemetry.io/otel/trace v1.35.0
-	go.opentelemetry.io/proto/otlp v1.6.0
-	golang.org/x/crypto v0.37.0
-	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8
-	golang.org/x/mod v0.24.0
-	golang.org/x/net v0.39.0
-	golang.org/x/oauth2 v0.29.0
-	golang.org/x/sync v0.13.0
-	golang.org/x/sys v0.32.0
-	golang.org/x/term v0.31.0
-	golang.org/x/text v0.24.0
-	golang.org/x/time v0.11.0
+	go.mongodb.org/mongo-driver v1.17.4
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0
+	go.opentelemetry.io/otel v1.37.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0
+	go.opentelemetry.io/otel/sdk v1.37.0
+	go.opentelemetry.io/otel/trace v1.37.0
+	go.opentelemetry.io/proto/otlp v1.7.0
+	golang.org/x/crypto v0.45.0
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
+	golang.org/x/mod v0.29.0
+	golang.org/x/net v0.47.0
+	golang.org/x/oauth2 v0.30.0
+	golang.org/x/sync v0.18.0
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0
+	golang.org/x/text v0.31.0
+	golang.org/x/time v0.12.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/api v0.230.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34
-	google.golang.org/grpc v1.72.1
+	google.golang.org/api v0.248.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c
+	google.golang.org/grpc v1.75.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.6
+	google.golang.org/protobuf v1.36.8
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
 	gopkg.in/dnaeon/go-vcr.v3 v3.2.0
 	gopkg.in/ini.v1 v1.67.0
@@ -243,78 +259,82 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259
-	helm.sh/helm/v3 v3.17.3
-	k8s.io/api v0.33.0
-	k8s.io/apiextensions-apiserver v0.33.0
-	k8s.io/apimachinery v0.33.0
-	k8s.io/apiserver v0.33.0
-	k8s.io/cli-runtime v0.33.0
-	k8s.io/client-go v0.33.0
-	k8s.io/component-base v0.33.0
+	helm.sh/helm/v3 v3.18.5
+	k8s.io/api v0.33.3
+	k8s.io/apiextensions-apiserver v0.33.3
+	k8s.io/apimachinery v0.33.3
+	k8s.io/apiserver v0.33.3
+	k8s.io/cli-runtime v0.33.3
+	k8s.io/client-go v0.33.3
+	k8s.io/component-base v0.33.3
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kubectl v0.33.0
+	k8s.io/kubectl v0.33.3
+	k8s.io/metrics v0.33.3
 	k8s.io/utils v0.0.0-20241210054802-24370beab758
 	sigs.k8s.io/controller-runtime v0.20.4
 	sigs.k8s.io/controller-tools v0.17.1
-	sigs.k8s.io/yaml v1.4.0
+	sigs.k8s.io/yaml v1.6.0
 	software.sslmate.com/src/go-pkcs12 v0.5.0
 )
 
 require (
-	cel.dev/expr v0.20.0 // indirect
-	cloud.google.com/go v0.120.0 // indirect
-	cloud.google.com/go/auth v0.16.1 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/longrunning v0.6.6 // indirect
-	cloud.google.com/go/monitoring v1.24.1 // indirect
-	cloud.google.com/go/pubsub v1.47.0 // indirect
-	dario.cat/mergo v1.0.1 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/pubsub v1.50.0 // indirect
+	cloud.google.com/go/pubsub/v2 v2.0.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/99designs/keyring v1.2.2 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
-	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 // indirect
 	github.com/apache/arrow-go/v18 v18.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go v1.55.6 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.40.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.31.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
-	github.com/aws/rolesanywhere-credential-helper v1.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.0 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
@@ -322,12 +342,14 @@ require (
 	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
-	github.com/containerd/containerd v1.7.27 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/crewjam/httperr v0.2.0 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
@@ -337,15 +359,14 @@ require (
 	github.com/di-wu/parser v0.3.0 // indirect
 	github.com/di-wu/xsd-datetime v1.0.0 // indirect
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
 	github.com/dmarkham/enumer v1.5.10 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
-	github.com/ebitengine/purego v0.8.3 // indirect
-	github.com/elastic/elastic-transport-go/v8 v8.7.0 // indirect
+	github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
@@ -355,8 +376,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
-	github.com/go-chi/chi v4.1.2+incompatible // indirect
-	github.com/go-chi/chi/v5 v5.2.1 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-faster/city v1.0.1 // indirect
 	github.com/go-faster/errors v0.7.1 // indirect
@@ -366,7 +386,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
@@ -375,8 +395,7 @@ require (
 	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-webauthn/x v0.1.20 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
@@ -394,7 +413,6 @@ require (
 	github.com/google/flatbuffers v24.12.23+incompatible // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
-	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
@@ -403,19 +421,20 @@ require (
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.8 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/in-toto/attestation v1.1.1 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
@@ -428,7 +447,6 @@ require (
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
-	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
@@ -447,6 +465,7 @@ require (
 	github.com/lithammer/dedent v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mailgun/errors v0.4.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
@@ -462,13 +481,17 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/montanaflynn/stats v0.7.0 // indirect
+	github.com/montanaflynn/stats v0.7.1 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
@@ -480,8 +503,7 @@ require (
 	github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
-	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pascaldekloe/name v1.0.1 // indirect
 	github.com/paulmach/orb v0.11.1 // indirect
@@ -498,31 +520,32 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
 	github.com/rs/zerolog v1.28.0 // indirect
-	github.com/rubenv/sql-migrate v1.7.1 // indirect
+	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sahilm/fuzzy v0.1.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect
-	github.com/shabbyrobe/gocovmerge v0.0.0-20230507112040-c3350d9342df // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 // indirect
 	github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 // indirect
-	github.com/sigstore/rekor v1.3.9 // indirect
+	github.com/sigstore/rekor v1.4.1 // indirect
 	github.com/sigstore/timestamp-authority v1.2.5 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.12.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/spf13/viper v1.20.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
@@ -530,21 +553,22 @@ require (
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.7.0 // indirect
 	github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/transparency-dev/merkle v0.0.2 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
@@ -554,29 +578,32 @@ require (
 	go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/tools v0.30.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/component-helpers v0.33.0 // indirect
+	k8s.io/component-helpers v0.33.3 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/metrics v0.33.0 // indirect
 	mvdan.cc/sh/v3 v3.7.0 // indirect
-	oras.land/oras-go v1.2.5 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.19.0 // indirect
 	sigs.k8s.io/kustomize/kustomize/v5 v5.6.0 // indirect
@@ -591,16 +618,17 @@ require (
 replace (
 	github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
 	github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
-	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1
+	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2
 	github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4
 	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-teleport.2
 	github.com/gravitational/teleport/api => ./api
+	github.com/hinshun/vt10x => github.com/gravitational/vt10x v0.0.3-teleport.1
 	github.com/julienschmidt/httprouter => github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5
 	github.com/keys-pub/go-libfido2 => github.com/gravitational/go-libfido2 v1.5.3-teleport.1
 	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v1.8.1-teleport.2
 	github.com/opencontainers/selinux => github.com/gravitational/selinux v1.13.0-teleport
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.2
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
 
 // this package was included in google.golang.org/grpc but because it's still
diff --git a/go.sum b/go.sum
index 6d2141171cf21..33af0bbd9cb9e 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
-cel.dev/expr v0.20.0 h1:OunBvVCfvpWlt4dN7zg3FM6TDkzOePe1+foGJ9AXeeI=
-cel.dev/expr v0.20.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -38,8 +40,8 @@ cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRY
 cloud.google.com/go v0.105.0/go.mod h1:PrLgOJNe5nfE9UMxKxgXj4mD3voiP+YQ6gdt6KMFOKM=
 cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
 cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
-cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA=
-cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
 cloud.google.com/go/accessapproval v1.4.0/go.mod h1:zybIuC3KpDOvotz59lFe5qxRZx6C75OtwbisN56xYB4=
 cloud.google.com/go/accessapproval v1.5.0/go.mod h1:HFy3tuiGvMdcd/u+Cu5b9NkO1pEICJ46IR82PoUdplw=
 cloud.google.com/go/accessapproval v1.6.0/go.mod h1:R0EiYnwV5fsRFiKZkPHr6mwyk2wxUJ30nL4j2pcFY2E=
@@ -53,6 +55,8 @@ cloud.google.com/go/aiplatform v1.27.0/go.mod h1:Bvxqtl40l0WImSb04d0hXFU7gDOiq9j
 cloud.google.com/go/aiplatform v1.35.0/go.mod h1:7MFT/vCaOyZT/4IIFfxH4ErVg/4ku6lKv3w0+tFTgXQ=
 cloud.google.com/go/aiplatform v1.36.1/go.mod h1:WTm12vJRPARNvJ+v6P52RDHCNe4AhvjcIZ/9/RRHy/k=
 cloud.google.com/go/aiplatform v1.37.0/go.mod h1:IU2Cv29Lv9oCn/9LkFiiuKfwrRTq+QQMbW+hPCxJGZw=
+cloud.google.com/go/alloydb v1.16.1 h1:pW4D0O2jAfAjoOEI1bgChPwMHWE8X8BjwSO0tfWkWvk=
+cloud.google.com/go/alloydb v1.16.1/go.mod h1:zeZuGJ5mEaQE70FMXEvZIp5hQLR9yrGnHo1YUOncWRY=
 cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
 cloud.google.com/go/analytics v0.12.0/go.mod h1:gkfj9h6XRf9+TS4bmuhPEShsh3hH8PAZzm/41OOhQd4=
 cloud.google.com/go/analytics v0.17.0/go.mod h1:WXFa3WSym4IZ+JiKmavYdJwGG/CvpqiqczmL59bTD9M=
@@ -101,8 +105,8 @@ cloud.google.com/go/assuredworkloads v1.7.0/go.mod h1:z/736/oNmtGAyU47reJgGN+KVo
 cloud.google.com/go/assuredworkloads v1.8.0/go.mod h1:AsX2cqyNCOvEQC8RMPnoc0yEarXQk6WEKkxYfL6kGIo=
 cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM0vVpRC7VVoJC3ZoT0=
 cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
-cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
-cloud.google.com/go/auth v0.16.1/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
@@ -182,14 +186,14 @@ cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63
 cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
 cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
-cloud.google.com/go/compute v1.37.0 h1:XxtZlXYkZXub3LNaLu90TTemcFqIU1yZ4E4q9VlR39A=
-cloud.google.com/go/compute v1.37.0/go.mod h1:AsK4VqrSyXBo4SMbRtfAO1VfaMjUEjEwv1UB/AwVp5Q=
+cloud.google.com/go/compute v1.38.0 h1:MilCLYQW2m7Dku8hRIIKo4r0oKastlD74sSu16riYKs=
+cloud.google.com/go/compute v1.38.0/go.mod h1:oAFNIuXOmXbK/ssXm3z4nZB8ckPdjltJ7xhHCdbWFZM=
 cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
 cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
 cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
 cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
@@ -198,8 +202,8 @@ cloud.google.com/go/container v1.7.0/go.mod h1:Dp5AHtmothHGX3DwwIHPgq45Y8KmNsgN3
 cloud.google.com/go/container v1.13.1/go.mod h1:6wgbMPeQRw9rSnKBCAJXnds3Pzj03C4JHamr8asWKy4=
 cloud.google.com/go/container v1.14.0/go.mod h1:3AoJMPhHfLDxLvrlVWaK57IXzaPnLaZq63WX59aQBfM=
 cloud.google.com/go/container v1.15.0/go.mod h1:ft+9S0WGjAyjDggg5S06DXj+fHJICWg8L7isCQe9pQA=
-cloud.google.com/go/container v1.42.4 h1:N8I+GiImhrSMUcKSOYTd8D6wBWyWSgPa4IJkSdlR2jk=
-cloud.google.com/go/container v1.42.4/go.mod h1:wf9lKc3ayWVbbV/IxKIDzT7E+1KQgzkzdxEJpj1pebE=
+cloud.google.com/go/container v1.43.0 h1:A6J92FJPfxTvyX7MHF+w4t2W9WCqvHOi9UB5SAeSy3w=
+cloud.google.com/go/container v1.43.0/go.mod h1:ETU9WZ1KM9ikEKLzrhRVao7KHtalDQu6aPqM34zDr/U=
 cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
 cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4=
 cloud.google.com/go/containeranalysis v0.7.0/go.mod h1:9aUL+/vZ55P2CXfuZjS4UjQ9AgXoSw8Ts6lemfmxBxI=
@@ -348,8 +352,8 @@ cloud.google.com/go/kms v1.8.0/go.mod h1:4xFEhYFqvW+4VMELtZyxomGSYtSQKzM178ylFW4
 cloud.google.com/go/kms v1.9.0/go.mod h1:qb1tPTgfF9RQP8e1wq4cLFErVuTJv7UsSC915J8dh3w=
 cloud.google.com/go/kms v1.10.0/go.mod h1:ng3KTUtQQU9bPX3+QGLsflZIHlkbn8amFAMY63m8d24=
 cloud.google.com/go/kms v1.10.1/go.mod h1:rIWk/TryCkR59GMC3YtHtXeLzd634lBbKenvyySAyYI=
-cloud.google.com/go/kms v1.21.2 h1:c/PRUSMNQ8zXrc1sdAUnsenWWaNXN+PzTXfXOcSFdoE=
-cloud.google.com/go/kms v1.21.2/go.mod h1:8wkMtHV/9Z8mLXEXr1GK7xPSBdi6knuLXIhqjuWcI6w=
+cloud.google.com/go/kms v1.22.0 h1:dBRIj7+GDeeEvatJeTB19oYZNV0aj6wEqSIT/7gLqtk=
+cloud.google.com/go/kms v1.22.0/go.mod h1:U7mf8Sva5jpOb4bxYZdtw/9zsbIjrklYwPcvMk34AL8=
 cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
 cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
 cloud.google.com/go/language v1.7.0/go.mod h1:DJ6dYN/W+SQOjF8e1hLQXMF21AkH2w9wiPzPCJa2MIE=
@@ -365,8 +369,8 @@ cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhX
 cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
 cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
 cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
-cloud.google.com/go/longrunning v0.6.6 h1:XJNDo5MUfMM05xK3ewpbSdmt7R2Zw+aQEMbdQR65Rbw=
-cloud.google.com/go/longrunning v0.6.6/go.mod h1:hyeGJUrPHcx0u2Uu1UFSoYZLn4lkMrccJig0t4FI7yw=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
 cloud.google.com/go/managedidentities v1.3.0/go.mod h1:UzlW3cBOiPrzucO5qWkNkh0w33KFtBJU281hacNvsdE=
 cloud.google.com/go/managedidentities v1.4.0/go.mod h1:NWSBYbEMgqmbZsLIyKvxrYbtqOsxY1ZrGM+9RgDqInM=
 cloud.google.com/go/managedidentities v1.5.0/go.mod h1:+dWcZ0JlUmpuxpIDfyP5pP5y0bLdRwOS4Lp7gMni/LA=
@@ -390,8 +394,8 @@ cloud.google.com/go/monitoring v1.7.0/go.mod h1:HpYse6kkGo//7p6sT0wsIC6IBDET0RhI
 cloud.google.com/go/monitoring v1.8.0/go.mod h1:E7PtoMJ1kQXWxPjB6mv2fhC5/15jInuulFdYYtlcvT4=
 cloud.google.com/go/monitoring v1.12.0/go.mod h1:yx8Jj2fZNEkL/GYZyTLS4ZtZEZN8WtDEiEqG4kLK50w=
 cloud.google.com/go/monitoring v1.13.0/go.mod h1:k2yMBAB1H9JT/QETjNkgdCGD9bPF712XiLTVr+cBrpw=
-cloud.google.com/go/monitoring v1.24.1 h1:vKiypZVFD/5a3BbQMvI4gZdl8445ITzXFh257XBgrS0=
-cloud.google.com/go/monitoring v1.24.1/go.mod h1:Z05d1/vn9NaujqY2voG6pVQXoJGbp+r3laV+LySt9K0=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
 cloud.google.com/go/networkconnectivity v1.4.0/go.mod h1:nOl7YL8odKyAOtzNX73/M5/mGZgqqMeryi6UPZTk/rA=
 cloud.google.com/go/networkconnectivity v1.5.0/go.mod h1:3GzqJx7uhtlM3kln0+x5wyFvuVH1pIBJjhCpjzSt75o=
 cloud.google.com/go/networkconnectivity v1.6.0/go.mod h1:OJOoEXW+0LAxHh89nXd64uGG+FbQoeH8DtxCHVOMlaM=
@@ -449,8 +453,10 @@ cloud.google.com/go/pubsub v1.26.0/go.mod h1:QgBH3U/jdJy/ftjPhTkyXNj543Tin1pRYcd
 cloud.google.com/go/pubsub v1.27.1/go.mod h1:hQN39ymbV9geqBnfQq6Xf63yNhUAhv9CZhzp5O6qsW0=
 cloud.google.com/go/pubsub v1.28.0/go.mod h1:vuXFpwaVoIPQMGXqRyUQigu/AX1S3IWugR9xznmcXX8=
 cloud.google.com/go/pubsub v1.30.0/go.mod h1:qWi1OPS0B+b5L+Sg6Gmc9zD1Y+HaM0MdUr7LsupY1P4=
-cloud.google.com/go/pubsub v1.47.0 h1:Ou2Qu4INnf7ykrFjGv2ntFOjVo8Nloh/+OffF4mUu9w=
-cloud.google.com/go/pubsub v1.47.0/go.mod h1:LaENesmga+2u0nDtLkIOILskxsfvn/BXX9Ak1NFxOs8=
+cloud.google.com/go/pubsub v1.50.0 h1:hnYpOIxVlgVD1Z8LN7est4DQZK3K6tvZNurZjIVjUe0=
+cloud.google.com/go/pubsub v1.50.0/go.mod h1:Di2Y+nqXBpIS+dXUEJPQzLh8PbIQZMLE9IVUFhf2zmM=
+cloud.google.com/go/pubsub/v2 v2.0.0 h1:0qS6mRJ41gD1lNmM/vdm6bR7DQu6coQcVwD+VPf0Bz0=
+cloud.google.com/go/pubsub/v2 v2.0.0/go.mod h1:0aztFxNzVQIRSZ8vUr79uH2bS3jwLebwK6q1sgEub+E=
 cloud.google.com/go/pubsublite v1.5.0/go.mod h1:xapqNQ1CuLfGi23Yda/9l4bBCKz/wC3KIJ5gKcxveZg=
 cloud.google.com/go/pubsublite v1.6.0/go.mod h1:1eFCS0U11xlOuMFV/0iBqw3zP12kddMeCbj/F3FSj9k=
 cloud.google.com/go/pubsublite v1.7.0/go.mod h1:8hVMwRXfDfvGm3fahVbtDbiLePT3gpoiJYJY+vxWxVM=
@@ -542,8 +548,8 @@ cloud.google.com/go/shell v1.6.0/go.mod h1:oHO8QACS90luWgxP3N9iZVuEiSF84zNyLytb+
 cloud.google.com/go/spanner v1.41.0/go.mod h1:MLYDBJR/dY4Wt7ZaMIQ7rXOTLjYrmxLE/5ve9vFfWos=
 cloud.google.com/go/spanner v1.44.0/go.mod h1:G8XIgYdOK+Fbcpbs7p2fiprDw4CaZX63whnSMLVBxjk=
 cloud.google.com/go/spanner v1.45.0/go.mod h1:FIws5LowYz8YAE1J8fOS7DJup8ff7xJeetWEo5REA2M=
-cloud.google.com/go/spanner v1.80.0 h1:4B2hoN1TF0qghiK7CYjYzjRt0/EEacIlS/UJl0k2hKA=
-cloud.google.com/go/spanner v1.80.0/go.mod h1:XQWUqx9r8Giw6gNh0Gu8xYfz7O+dAKouAkFCxG/mZC8=
+cloud.google.com/go/spanner v1.85.0 h1:VVO3yW+0+Yx9tg4SQaZvJHGAnU6qCnGXQ3NX4E3+src=
+cloud.google.com/go/spanner v1.85.0/go.mod h1:9zhmtOEoYV06nE4Orbin0dc/ugHzZW9yXuvaM61rpxs=
 cloud.google.com/go/speech v1.6.0/go.mod h1:79tcr4FHCimOp56lwC01xnt/WPJZc4v3gzyT7FoBkCM=
 cloud.google.com/go/speech v1.7.0/go.mod h1:KptqL+BAQIhMsj1kOP2la5DSEEerPDuOP/2mmkhHhZQ=
 cloud.google.com/go/speech v1.8.0/go.mod h1:9bYIl1/tjsAnMgKGHKmBZzXKEkGgtU+MpdDPTE9f7y0=
@@ -561,8 +567,8 @@ cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeL
 cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
 cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
 cloud.google.com/go/storage v1.29.0/go.mod h1:4puEjyTKnku6gfKoTfNOU/W+a9JyuVNxjpS5GBrB8h4=
-cloud.google.com/go/storage v1.52.0 h1:ROpzMW/IwipKtatA69ikxibdzQSiXJrY9f6IgBa9AlA=
-cloud.google.com/go/storage v1.52.0/go.mod h1:4wrBAbAYUvYkbrf19ahGm4I5kDQhESSqN3CGEkMGvOY=
+cloud.google.com/go/storage v1.56.1 h1:n6gy+yLnHn0hTwBFzNn8zJ1kqWfR91wzdM8hjRF4wP0=
+cloud.google.com/go/storage v1.56.1/go.mod h1:C9xuCZgFl3buo2HZU/1FncgvvOgTAs/rnh4gF4lMg0s=
 cloud.google.com/go/storagetransfer v1.5.0/go.mod h1:dxNzUopWy7RQevYFHewchb29POFv3/AaBgnhqzqiK0w=
 cloud.google.com/go/storagetransfer v1.6.0/go.mod h1:y77xm4CQV/ZhFZH75PLEXY0ROiS7Gh6pSKrM8dJyg6I=
 cloud.google.com/go/storagetransfer v1.7.0/go.mod h1:8Giuj1QNb1kfLAiWM1bN6dHzfdlDAVC9rv9abHot2W4=
@@ -582,8 +588,8 @@ cloud.google.com/go/trace v1.3.0/go.mod h1:FFUE83d9Ca57C+K8rDl/Ih8LwOzWIV1krKgxg
 cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
 cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
 cloud.google.com/go/trace v1.9.0/go.mod h1:lOQqpE5IaWY0Ixg7/r2SjixMuc6lfTFeO4QGM4dQWOk=
-cloud.google.com/go/trace v1.11.3 h1:c+I4YFjxRQjvAhRmSsmjpASUKq88chOX854ied0K/pE=
-cloud.google.com/go/trace v1.11.3/go.mod h1:pt7zCYiDSQjC9Y2oqCsh9jF4GStB/hmjrYLsxRR27q8=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 cloud.google.com/go/translate v1.3.0/go.mod h1:gzMUwRjvOqj5i69y/LYLd8RrNQk+hOmIXTi9+nb3Djs=
 cloud.google.com/go/translate v1.4.0/go.mod h1:06Dn/ppvLD6WvA5Rhdp029IX2Mi3Mn7fpMRLPvXT5Wg=
 cloud.google.com/go/translate v1.5.0/go.mod h1:29YDSYveqqpA1CQFD7NQuP49xymq17RXNaUDdc0mNu0=
@@ -638,9 +644,11 @@ cuelabs.dev/go/oci/ociregistry v0.0.0-20241125120445-2c00c104c6e1 h1:mRwydyTyhtR
 cuelabs.dev/go/oci/ociregistry v0.0.0-20241125120445-2c00c104c6e1/go.mod h1:5A4xfTzHTXfeVJBU6RAUf+QrlfTCW+017q/QiW+sMLg=
 cuelang.org/go v0.12.1 h1:5I+zxmXim9MmiN2tqRapIqowQxABv2NKTgbOspud1Eo=
 cuelang.org/go v0.12.1/go.mod h1:B4+kjvGGQnbkz+GuAv1dq/R308gTkp0sO28FdMrJ2Kw=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
+filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
@@ -649,22 +657,22 @@ github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMb
 github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
 github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
 github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
 github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.14.0 h1:kcnfY4vljxXliXDBrA9K9lwF8IoEZ4Up6Eg9kWTIm28=
 github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.14.0/go.mod h1:tlqp9mUGbsP+0z3Q+c0Q5MgSdq/OMwQhm5bffR3Q3ss=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 h1:OVoM452qUFBrX+URdH3VpR299ma4kfom0yB0URYky9g=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0/go.mod h1:kUjrAo8bgEwLeZ/CmHqNl3Z/kPm7y6FKfxxK0izYUg4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 h1:Hr5FTipp7SL07o2FvoVOX9HRiRH3CR3Mj8pxqCcdD5A=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2/go.mod h1:QyVsSSN64v5TGltphKLQ2sQxe4OBQg0J1eKRcVBnfgE=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 h1:MhRfI58HblXzCtWEZCO0feHs8LweePB3s90r7WaR1KU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0/go.mod h1:okZ+ZURbArNdlJ+ptXoyHNuOETzOl1Oww19rm8I2WLA=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 h1:Hp+EScFOu9HeCbeW8WU2yQPJd4gGwhMgKxWe+G6jNzw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0/go.mod h1:/pz8dyNQe+Ey3yBp/XuYz7oqX8YDNWVpPB0hH3XWfbc=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 h1:z7Mqz6l0EFH549GvHEqfjKvi+cRScxLWbaoeLm9wxVQ=
@@ -699,10 +707,10 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0/go.mod h1:DWAciXemNf++PQJLeXUB4HHH5OpsAh12HZnu2wXE1jA=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 h1:Wgf5rZba3YZqeTNJPtvqZoBu1sBN/L4sry+u2U3Y75w=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1/go.mod h1:xxCBG/f/4Vbmh2XQJBsOmNdxWUY5j/s27jujKPbQf14=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 h1:lhZdRq7TIx0GJQvSyX2Si406vrYsov2FXGp/RnSEtcs=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1/go.mod h1:8cl44BDmi+effbARHMQjgOKA2AYvcohNm7KEt42mSV8=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -730,8 +738,8 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mo
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
-github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ClickHouse/ch-go v0.65.1 h1:SLuxmLl5Mjj44/XbINsK2HFvzqup0s6rwKLFH347ZhU=
 github.com/ClickHouse/ch-go v0.65.1/go.mod h1:bsodgURwmrkvkBe5jw1qnGDgyITsYErfONKAHn05nv4=
@@ -741,16 +749,16 @@ github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7Oputl
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/DanielTitkov/go-adaptive-cards v0.2.2 h1:tBFExyvsbCcrBJEvPaV3FW4gcAkwQjXFKiKEBrE7Yuw=
 github.com/DanielTitkov/go-adaptive-cards v0.2.2/go.mod h1:RtCzt65p/zEos6+zhiCFQmiaHmro6M63l9NP7xXx/Lg=
-github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2 h1:DBjmt6/otSdULyJdVg2BlG0qGZO5tKL4VzOs0jpvw5Q=
-github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 h1:ErKg/3iS1AKcTkf3yixlZ54f9U1rljCkQyEXWUnIUxc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0/go.mod h1:yAZHSGnqScoU556rBOVkwLze6WP5N+U11RHuWaGVxwY=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 h1:fYE9p3esPxA/C0rQ0AHhP0drtPXDRhaWiwg1DPqO7IU=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0/go.mod h1:BnBReJLvVYx2CS/UHOgVz2BXKXD9wsQPxZug20nZhd0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.51.0 h1:OqVGm6Ei3x5+yZmSJG1Mh2NwHvpVmZ08CB5qJhT9Nuk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.51.0/go.mod h1:SZiPHWGOOk3bl8tkevxkoiwPgsIl6CwrWcbwjfHZpdM=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 h1:6/0iUd0xrnX7qt+mLNRwg5c0PGv8wpE8K90ryANQwMI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0/go.mod h1:otE2jQekW/PqXk1Awf5lmfokJx4uwuqcj1ab5SpGeW0=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 h1:2afWGsMzkIcN8Qm4mgPJKZWyroE5QBszMiDMYEBrnfw=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
@@ -770,25 +778,21 @@ github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
-github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
 github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
+github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tjT8=
+github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agnivade/levenshtein v1.2.0 h1:U9L4IOT0Y3i0TIlUIDJ7rVUziKi/zPbrJGaFrtYH3SY=
 github.com/agnivade/levenshtein v1.2.0/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
 github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
 github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
 github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
@@ -832,6 +836,8 @@ github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4x
 github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
 github.com/apache/thrift v0.21.0 h1:tdPmh/ptjE1IJnhbhrcl2++TauVjy242rkV/UzJChnE=
 github.com/apache/thrift v0.21.0/go.mod h1:W1H8aR/QRtYNvrPeFXBtobyRkd0/YVhTc6i07XIAgDw=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2 h1:Y7QB6jUsMyr0Bd+rAj67X2/ezNYLuxwp3kkjw5M3Q+4=
 github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2/go.mod h1:0rEApF1YBHGuZ4C8OYI9q5oDBVpgqtRqYATePl9mCDk=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
@@ -842,48 +848,52 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go v1.44.256/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go v1.49.12/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
-github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
-github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
+github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk=
+github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
 github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
-github.com/aws/aws-sdk-go-v2/config v1.29.14 h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
-github.com/aws/aws-sdk-go-v2/config v1.29.14/go.mod h1:wVPHWcIFv3WO89w0rE10gzf17ZYy+UVS1Geq8Iei34g=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0 h1:F3W0YqWZrpCcelbvXMP9LWSTOI620aAq1+8fZ/71TBg=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0/go.mod h1:34X+UzFJwsQfyk5U1hYiCO/gv9ZVL+Hh8w+bJQ6+HbU=
 github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0 h1:0LLh3sbmWgsUqUj/JZRvzmejQwlllh1HgHQoTzAIEcc=
 github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0/go.mod h1:to2lbD07ti4RR8JRgaYEFKan5XekRCmWxCZXlZvp6gQ=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 h1:qDk85oQdhwP4NR1RpkN+t40aN46/K96hF9J1vDRrkKM=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11/go.mod h1:f3MkXuZsT+wY24nLIP+gFUuIVQkpVopxbpUD/GUZK0Q=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74 h1:+1lc5oMFFHlVBclPXQf/POqlvdpBzjLaN2c3ujDCcZw=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74/go.mod h1:EiskBoFr4SpYnFIbw8UM7DP7CacQXDHEmJqLI1xpRFI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 h1:S61/E3N01oral6B3y9hZ2E1iFDqCZPPOBoBQretCnBI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75/go.mod h1:bDMQbkI1vJbNjnvJYpPTSNYBkI/VIv18ngWb/K84tkk=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0 h1:xwcxrq16ND5W+QqsGVpNHcjqyVqX4TX7vp3ifI4aYjg=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0/go.mod h1:Ie/714qgv6ohupWHUxe/6oyAfiCdq9vVJrp+TnJrcqs=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 h1:QWhxjrA0r+FQnDAATdGqLXUvYW0MdUIvCBK89BN3OfU=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4/go.mod h1:xsG8Y2fMenmHTdukyknTUO1uQhEZ/entaNHvPmD1klE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 h1:xdYdX+JpIFByMG8JQe9iWM9CqepyjhenukxTVQnuCbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0/go.mod h1:c1Ik+59wgLIJFhsSY8cAnw6QooiogpTZKP0rtkVcpCQ=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9 h1:+NSIzl59vBK3g3nLUuLSb/I2F2OIucW6hX/B+NAPWDg=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9/go.mod h1:9/Q0/HtqBTLMksFse42wZjUq0jJrUuo4XlnXy/uSoeg=
 github.com/aws/aws-sdk-go-v2/service/dax v1.24.2 h1:QFdCeROg/LwFkKOpM4TrzOPt9vcsbuu2WibzjiKTZqA=
 github.com/aws/aws-sdk-go-v2/service/dax v1.24.2/go.mod h1:FTMIKMqG/2AiO0P1LSCN6PeY4BNkQcxAzPSpne6oE6w=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1 h1:YYjNTAyPL0425ECmq6Xm48NSXdT6hDVQmLOJZxyhNTM=
@@ -910,19 +920,19 @@ github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk
 github.com/aws/aws-sdk-go-v2/service/iam v1.41.1/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 h1:hWqvzMaaiHhwndQhy1rF/qoHidaa4KzevkiDaMvjk3Q=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2/go.mod h1:7nGvrQXBNp7k5yYpwpmxGucYTPY39d0cxjmANAeWwYE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 h1:4nm2G6A4pV9rdlWzGMPv4BNtQp22v1hg3yrtkYpeLl8=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 h1:M1R1rud7HzDrfCdlBQ7NjnRsDNEhXO/vGhuD189Ggmk=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15/go.mod h1:uvFKBSq9yMPV4LGAi7N4awn4tLY+hKE35f8THes2mzQ=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3 h1:RivOtUH3eEu6SWnUMFHKAW4MqDOzWn1vGQ3S38Y5QMg=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 h1:Z95XCqqSnwXr0AY7PgsiOUBhUG2GoDM5getw6RfD1Lg=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0/go.mod h1:DqcSngL7jJeU1fOzh5Ll5rSvX/MlMV6OZlE4mVdFAQc=
 github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2 h1:z926KZ1Ysi8Mbi4biJSAIRFdKemwQpO9M0QUTRLDaXA=
 github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2/go.mod h1:c27kk10S36lBYgbG1jR3opn4OAS5Y/4wjJa1GiHK/X4=
 github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 h1:ggjjmfNX+nlv+nWHXOLr1pl36buP25Y9GZBEPMSofGw=
@@ -937,6 +947,8 @@ github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 h1:LNOKEsPjtoBrV2WYUb2zPLO
 github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3/go.mod h1:TC8pNvjiikrjpX2MEzX/cEJ4/T4XIoSY4BskVvHj8bk=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 h1:+nldYGx2Kdn7jzntjm2fG7sRonfQ08l1RqkLSTed8G8=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1/go.mod h1:gpRsJN3qxZbsj1NhAoCNX02zJ4RZUB5v/7o4QrnGTcA=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 h1:QqXnA7s6sxFe6B6dkocEfZ9ap1bAmEXp4W32n9n+cmU=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4/go.mod h1:cgPfPTC/V3JqwCKed7Q6d0FrgarV7ltz4Bz6S4Q+Dqk=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 h1:0LBxtAX2bHcfPr6VSzQSvJlR1nzlna7xp031gEjbWGU=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2/go.mod h1:NW+LcIadUUlDgM3gb8+97lr6zSKExHR58NRRWSWkXl8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 h1:BRXS0U76Z8wfF+bnkilA2QwpIch6URlm++yPUt9QPmQ=
@@ -950,23 +962,19 @@ github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5/go.mod h1:Bar4MrRxeqdn6XIh8JGfi
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 h1:KWArCwA/WkuHWKfygkNz0B6YS6OvdgoJUaJHX0Qby1s=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
 github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 h1:j3YvW9+qUFIzshXoPclOEUOSlXgr9vCU6OsB/CVRKGM=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2/go.mod h1:znVkl7Y14sZKEL/sbRQ6qgD8wj8VdTcVVQp5iRaKXcc=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
 github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
-github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v1.1.0 h1:EJsHUYgFBV7/N1YtL73lsfZODAOU+CnNSZfEAlqqQaA=
-github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v1.1.0/go.mod h1:AxKuXHc0zv2yYaeueUG7R3ONbcnQIuDj0bkdFmPVRzU=
-github.com/aws/rolesanywhere-credential-helper v1.2.0 h1:eLqJvSznH8nJk48dwFc0raWOpbTGgBeNYH3Q8UQFVx4=
-github.com/aws/rolesanywhere-credential-helper v1.2.0/go.mod h1:YRxmRrAaqbVVXPNH1gHT76nWaMGvpAziHAHw8UwKrpU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
 github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aws/smithy-go v1.22.3 h1:Z//5NuZCSW6R4PhQ93hShNbyBbn8BWCmCVCt+Q8Io5k=
-github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
+github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 h1:Gx4ipHtKfaABSHAVo4Zjo2E4ClKzYqZ2NrPO0gy6qvY=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4/go.mod h1:nnwXv9COKyqd4q7jpPrxRaW9L+Qfwb4aGTdZqsIpOho=
 github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.9.1 h1:50sS0RWhGpW/yZx2KcDNEb1u1MANv5BMEkJgcieEDTA=
@@ -975,11 +983,11 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
 github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
 github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
@@ -988,8 +996,8 @@ github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdn
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
-github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
+github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -1002,12 +1010,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd h1:rFt+Y/IK1aEZkEHchZRSq9OQbsSzIT/OrI8YFFmRIng=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/buildkite/agent/v3 v3.95.1 h1:soe8EyQf068snMYtsQM10+l/l2wwbZIz0P7aDbz+Zws=
 github.com/buildkite/agent/v3 v3.95.1/go.mod h1:k2rfXF1U6fl/wejFXuS4YWXX4nDXZFpvKjCc5KUOAXg=
 github.com/buildkite/bintest/v3 v3.3.0 h1:RTWcSaJRlOT6t/K311ejPf+0J3LE/QEODzVG3vlLnWo=
@@ -1022,6 +1026,8 @@ github.com/catppuccin/go v0.3.0 h1:d+0/YicIq+hSTo5oPuRi5kOpqkVA5tAsU6dNhvRu+aY=
 github.com/catppuccin/go v0.3.0/go.mod h1:8IHJuMGaUUjQM82qBrGNBv7LFq6JI3NnQCF6MOlZjpc=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
@@ -1030,6 +1036,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cevatbarisyilmaz/ara v0.0.4 h1:SGH10hXpBJhhTlObuZzTuFn1rrdmjQImITXnZVPSodc=
+github.com/cevatbarisyilmaz/ara v0.0.4/go.mod h1:BfFOxnUd6Mj6xmcvRxHN3Sr21Z1T3U2MYkYOmoQe4Ts=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
@@ -1087,8 +1095,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 h1:Om6kYQYDUk5wWbT0t0q6pvyM49i9XZAv9dDrkDA7gjk=
-github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
@@ -1097,20 +1105,18 @@ github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUo
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL2kskAlV9ckgEsNQXscjIaLiOYiZ75d4e94E6dcQ=
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
-github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
-github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
-github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
-github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
-github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4 h1:NZwojZ3+Cb8qxEkNdtmIrjwergNXvkTjvnM+yecyQoQ=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4/go.mod h1:s06tWAiJcXQo9/8AReBCIo/QxcXFZ2n4qfsRnpl71SM=
 github.com/coreos/go-oidc v2.3.0+incompatible h1:+5vEsrgprdLjjQ9FzIKAzQz1wwPD+83hQRfUIPh7rO0=
 github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
 github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
@@ -1121,6 +1127,8 @@ github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7
 github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -1146,48 +1154,44 @@ github.com/di-wu/parser v0.3.0/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX
 github.com/di-wu/xsd-datetime v1.0.0 h1:vZoGNkbzpBNoc+JyfVLEbutNDNydYV8XwHeV7eUJoxI=
 github.com/di-wu/xsd-datetime v1.0.0/go.mod h1:i3iEhrP3WchwseOBeIdW/zxeoleXTOzx1WyDXgdmOww=
 github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
 github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
+github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
+github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dmarkham/enumer v1.5.10 h1:ygL0L6quiTiH1jpp68DyvsWaea6MaZLZrTTkIS++R0M=
 github.com/dmarkham/enumer v1.5.10/go.mod h1:e4VILe2b1nYK3JKJpRmNdl5xbDQvELc6tQ8b+GsGk6E=
-github.com/docker/cli v27.5.0+incompatible h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM=
-github.com/docker/cli v27.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A=
+github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
-github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
-github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
-github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
-github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/elastic/elastic-transport-go/v8 v8.7.0 h1:OgTneVuXP2uip4BA658Xi6Hfw+PeIOod2rY3GVMGoVE=
-github.com/elastic/elastic-transport-go/v8 v8.7.0/go.mod h1:YLHer5cj0csTzNFXoNQ8qhtGY1GTvSqPnKWKaqQE3Hk=
-github.com/elastic/go-elasticsearch/v8 v8.18.0 h1:ANNq1h7DEiPUaALb8+5w3baQzaS08WfHV0DNzp0VG4M=
-github.com/elastic/go-elasticsearch/v8 v8.18.0/go.mod h1:WLqwXsJmQoYkoA9JBFeEwPkQhCfAZuUvfpdU/NvSSf0=
+github.com/dvsekhvalnov/jose2go v1.7.0 h1:bnQc8+GMnidJZA8zc6lLEAb4xNrIqHwO+9TzqvtQZPo=
+github.com/dvsekhvalnov/jose2go v1.7.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry/P5s8R4dYuLkhB9Nhso8ogFWNr4IQ=
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8/go.mod h1:JkjcmqbLW+khwt2fmBPJFBhx2zGZ8XobRZ+O0VhlwWo=
 github.com/emicklei/go-restful/v3 v3.11.3 h1:yagOQz/38xJmcNeZJtrUcKjkHRltIaIFXKWeG1SkWGE=
@@ -1254,10 +1258,8 @@ github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
-github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
-github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
-github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
@@ -1286,20 +1288,17 @@ github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
 github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpxhq9o2S/CELCSUxEWWAuoCUcVCQWv7G2OCk=
 github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
 github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -1308,8 +1307,8 @@ github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
-github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -1328,23 +1327,22 @@ github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3Bum
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
 github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
-github.com/go-piv/piv-go/v2 v2.3.0 h1:kKkrYlgLQTMPA6BiSL25A7/x4CEh2YCG7rtb/aTkx+g=
-github.com/go-piv/piv-go/v2 v2.3.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
-github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.11.2 h1:Fgx0/wlmkClTKlnOsdOQ+K5HcHDsDcYIvtYmfhEOSUc=
 github.com/go-webauthn/webauthn v0.11.2/go.mod h1:aOtudaF94pM71g3jRwTYYwQTG1KyTILTcZqN1srkmD0=
 github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
@@ -1362,7 +1360,6 @@ github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakr
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/gocql/gocql v0.0.0-20200624222514-34081eda590e/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=
 github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus=
 github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
@@ -1377,8 +1374,8 @@ github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPh
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
@@ -1423,13 +1420,10 @@ github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
-github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
@@ -1464,8 +1458,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
 github.com/google/go-github/v55 v55.0.0 h1:4pp/1tNMB9X/LuAhs5i0KQAE40NmiR/y6prLNb9x9cg=
 github.com/google/go-github/v55 v55.0.0/go.mod h1:JLahOTA1DnXzhxEymmFF5PP2tSS9JVNj68mSZNDwskA=
 github.com/google/go-github/v70 v70.0.0 h1:/tqCp5KPrcvqCc7vIvYyFYTiCGrYvaWoYMGHSQbo55o=
@@ -1511,8 +1505,8 @@ github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e h1:FJta/0WsADCe1r9vQjdHbd3KuiLPu7Y9WlyLGwMUNyE=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
@@ -1524,8 +1518,8 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
-github.com/google/trillian v1.7.1 h1:+zX8jLM3524bAMPS+VxaDIDgsMv3/ty6DuLWerHXcek=
-github.com/google/trillian v1.7.1/go.mod h1:E1UMAHqpZCA8AQdrKdWmHmtUfSeiD0sDWD1cv00Xa+c=
+github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js=
+github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -1548,8 +1542,8 @@ github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqE
 github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
 github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
 github.com/googleapis/gax-go/v2 v2.7.1/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
@@ -1565,12 +1559,12 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
-github.com/grafana/pyroscope-go v1.2.2 h1:uvKCyZMD724RkaCEMrSTC38Yn7AnFe8S2wiAIYdDPCE=
-github.com/grafana/pyroscope-go v1.2.2/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
+github.com/grafana/pyroscope-go v1.2.4 h1:B22GMXz+O0nWLatxLuaP7o7L9dvP0clLvIpmeEQQM0Q=
+github.com/grafana/pyroscope-go v1.2.4/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8 h1:iwOtYXeeVSAeYefJNaxDytgjKtUuKQbJqgAIjlnicKg=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
-github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1 h1:zGsdDzqXSuXI+1t+2TRRzdYiv+B3M4IgOPA8W/raFOA=
-github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1/go.mod h1:6FzirJfdffakAVqmHjwVfFkpru/gNbIazUOK5rIhndc=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2 h1:ygCC2LH+2TVWChc5x1AnjZsou48Kfq4NXYsfgdpnABs=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2/go.mod h1:6FzirJfdffakAVqmHjwVfFkpru/gNbIazUOK5rIhndc=
 github.com/gravitational/go-libfido2 v1.5.3-teleport.1 h1:nPfxiTH2Sr3J6zan280fbHOkWE7gRF/lMqvhcXKh2ek=
 github.com/gravitational/go-libfido2 v1.5.3-teleport.1/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo=
 github.com/gravitational/go-mssqldb v1.8.1-teleport.2 h1:vzt5i39yPLCQ8FL19wUXq4+BcJR53NPimAIAOAIl4I0=
@@ -1583,22 +1577,26 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
-github.com/gravitational/predicate v1.3.2 h1:NAdaWihgGVS3nuKDZZHTda4wwNjGlvG4a+UYQ4f3gQc=
-github.com/gravitational/predicate v1.3.2/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EMLfRWQVJMmK+MA6gV8AI=
 github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
-github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
-github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
+github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
+github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
 github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
 github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
 github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
 github.com/gravitational/selinux v1.13.0-teleport/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
 github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/gravitational/vt10x v0.0.3-teleport.1 h1:QYNPZGCQRcz1JehDn5m75UvRQbEJvT5X1pVblnCfZrY=
+github.com/gravitational/vt10x v0.0.3-teleport.1/go.mod h1:7p0/hpXPXby/VpuB6rFUq2pd7grku9KB+EcF0+jwqzQ=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 h1:KcFzXwzM/kGhIRHvc8jdixfIJjVzuUJdnv+5xsPutog=
@@ -1606,8 +1604,8 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1/go.mod h1:qOchhhIlmRcqk/O
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
 github.com/guptarohit/asciigraph v0.7.3 h1:p05XDDn7cBTWiBqWb30mrwxd6oU0claAjqeytllnsPY=
@@ -1623,8 +1621,8 @@ github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB1
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
@@ -1639,15 +1637,20 @@ github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
 github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
 github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
 github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
@@ -1666,6 +1669,8 @@ github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ
 github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
@@ -1739,21 +1744,20 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
-github.com/jellydator/ttlcache/v3 v3.3.0 h1:BdoC9cE81qXfrxeb9eoJi9dWrdhSuwXMAnHTbnBm4Wc=
-github.com/jellydator/ttlcache/v3 v3.3.0/go.mod h1:bj2/e0l4jRnQdrnSTaGTsh4GSXvMjQcy41i7th0GVGw=
+github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
+github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
 github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA=
 github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
 github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
 github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
 github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
-github.com/johannesboyne/gofakes3 v0.0.0-20240217095638-c55a48f17be6 h1:W8heH5NR7dfdB4FehSFI+DxjCbVKe9fPkPqKzCPJwnM=
-github.com/johannesboyne/gofakes3 v0.0.0-20240217095638-c55a48f17be6/go.mod h1:AxgWC4DDX54O2WDoQO1Ceabtn6IbktjU/7bigor+66g=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3 h1:2713fQZ560HxoNVgfJH41GKzjMjIG+DW4hH6nYXfXW8=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3/go.mod h1:S4S9jGBVlLri0OeqrSSbCGG5vsI6he06UJyuz1WT1EE=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -1764,8 +1768,6 @@ github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -1792,7 +1794,6 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxv
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
@@ -1828,12 +1829,16 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailgun/errors v0.4.0 h1:6LFBvod6VIW83CMIOT9sYNp28TCX0NejFPP4dSX++i8=
 github.com/mailgun/errors v0.4.0/go.mod h1:xGBaaKdEdQT0/FhwvoXv4oBaqqmVZz9P1XEnvD/onc0=
 github.com/mailgun/mailgun-go/v4 v4.23.0 h1:jPEMJzzin2s7lvehcfv/0UkyBu18GvcURPr2+xtZRbk=
 github.com/mailgun/mailgun-go/v4 v4.23.0/go.mod h1:imTtizoFtpfZqPqGP8vltVBB6q9yWcv6llBhfFeElZU=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mark3labs/mcp-go v0.41.1 h1:w78eWfiQam2i8ICL7AL0WFiq7KHNJQ6UB53ZVtH4KGA=
+github.com/mark3labs/mcp-go v0.41.1/go.mod h1:T7tUa2jO6MavG+3P25Oy/jR7iCeJPHImCZHRymCn39g=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -1859,7 +1864,8 @@ github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
+github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
@@ -1895,16 +1901,18 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
-github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
-github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -1912,15 +1920,13 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
-github.com/montanaflynn/stats v0.7.0 h1:r3y12KyNxj/Sb/iOE46ws+3mS1+MZca1wlHQFPsY/JU=
-github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mozillazg/docker-credential-acr-helper v0.4.0 h1:Uoh3Z9CcpEDnLiozDx+D7oDgRq7X+R296vAqAumnOcw=
@@ -1939,7 +1945,6 @@ github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/
 github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
@@ -1949,6 +1954,8 @@ github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
+github.com/ohler55/ojg v1.26.8 h1:njM65m+ej8sLHiFZIhJK9UkwOmDPsUikjGbTgcwu8CU=
+github.com/ohler55/ojg v1.26.8/go.mod h1:/Y5dGWkekv9ocnUixuETqiL58f+5pAsUfg5P8e7Pa2o=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/okta/okta-sdk-golang/v2 v2.20.0 h1:EDKM+uOPfihOMNwgHMdno+NAsIfyXkVnoFAYVPay0YU=
@@ -1973,10 +1980,12 @@ github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
 github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/open-policy-agent/opa v1.1.0 h1:HMz2evdEMTyNqtdLjmu3Vyx06BmhNYAx67Yz3Ll9q2s=
 github.com/open-policy-agent/opa v1.1.0/go.mod h1:T1pASQ1/vwfTa+e2fYcfpLCvWgYtqtiUv+IuA/dLPQs=
+github.com/openai/openai-go v1.8.2 h1:UqSkJ1vCOPUpz9Ka5tS0324EJFEuOvMc+lA/EarJWP8=
+github.com/openai/openai-go v1.8.2/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opensearch-project/opensearch-go/v2 v2.3.0 h1:nQIEMr+A92CkhHrZgUhcfsrZjibvB3APXf2a1VwCmMQ=
 github.com/opensearch-project/opensearch-go/v2 v2.3.0/go.mod h1:8LDr9FCgUTVoT+5ESjc2+iaZuldqE+23Iq0r1XeNue8=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
@@ -2022,7 +2031,6 @@ github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxu
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -2032,6 +2040,8 @@ github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
 github.com/pkg/xattr v0.4.10 h1:Qe0mtiNFHQZ296vRgUjRCoPHPqH7VdTOrZx3g0T+pGA=
 github.com/pkg/xattr v0.4.10/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
+github.com/pkoukk/tiktoken-go v0.1.8 h1:85ENo+3FpWgAACBaEUVp+lctuTcYUO7BtmfhlN/QTRo=
+github.com/pkoukk/tiktoken-go v0.1.8/go.mod h1:9NiV+i9mJKGj1rYOT+njbv+ZwA/zJxYdewGl6qVatpg=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -2043,33 +2053,27 @@ github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
-github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20241112170944-20d2c9ebc01d h1:HWfigq7lB31IeJL8iy7jkUmU/PG1Sr8jVGhS749dbUA=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20241112170944-20d2c9ebc01d/go.mod h1:jgxiZysxFPM+iWKwQwPR+y+Jvo54ARd4EisXxKYpB5c=
-github.com/quic-go/quic-go v0.51.0 h1:K8exxe9zXxeRKxaXxi/GpUqYiTrtdiWP8bo1KFya6Wc=
-github.com/quic-go/quic-go v0.51.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -2090,8 +2094,8 @@ github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OK
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/rs/zerolog v1.28.0 h1:MirSo27VyNi7RJYP3078AA1+Cyzd2GB66qy3aUHvsWY=
 github.com/rs/zerolog v1.28.0/go.mod h1:NILgTygv/Uej1ra5XxGf82ZFSLk58MFGAUS2o6usyD0=
-github.com/rubenv/sql-migrate v1.7.1 h1:f/o0WgfO/GqNuVg+6801K/KW3WdDSupzSjDYODmiUq4=
-github.com/rubenv/sql-migrate v1.7.1/go.mod h1:Ob2Psprc0/3ggbM6wCzyYVFFuc6FyZrb2AS+ezLDFb4=
+github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2Ns0o=
+github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
 github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
 github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
 github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
@@ -2106,6 +2110,10 @@ github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a
 github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
 github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
 github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
+github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
 github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
 github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
@@ -2115,21 +2123,18 @@ github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQ
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/scim2/filter-parser/v2 v2.2.0 h1:QGadEcsmypxg8gYChRSM2j1edLyE/2j72j+hdmI4BJM=
 github.com/scim2/filter-parser/v2 v2.2.0/go.mod h1:jWnkDToqX/Y0ugz0P5VvpVEUKcWcyHHj+X+je9ce5JA=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0 h1:rf1HIbL64nUpEIZnjLZ3mcNEL9NBPB0iuVjyxvq3LZc=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0/go.mod h1:DVHKMcZ+V4/woA/peqr+L0joiRXbPpQ042GgJckkFgw=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500/go.mod h1:+njLrG5wSeoG4Ds61rFgEzKvenR2UHbjMoDHsczxly0=
-github.com/shabbyrobe/gocovmerge v0.0.0-20230507112040-c3350d9342df h1:S77Pf5fIGMa7oSwp8SQPp7Hb4ZiI38K3RNBKD2LLeEM=
-github.com/shabbyrobe/gocovmerge v0.0.0-20230507112040-c3350d9342df/go.mod h1:dcuzJZ83w/SqN9k4eQqwKYMgmKWzg/KzJAURBhRL1tc=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
-github.com/shirou/gopsutil/v4 v4.25.4 h1:cdtFO363VEOOFrUCjZRh4XVJkb548lyF0q0uTeMqYPw=
-github.com/shirou/gopsutil/v4 v4.25.4/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca h1:Ti7KXq+i1d0jIaIaYN8tPyjxC4t69Wai6mOQvlA3XFY=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca/go.mod h1:4f4j4w8HLMPWEFs3BO2UBBLigKAaWYwkSkbIt/6Q4Ss=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
@@ -2142,27 +2147,26 @@ github.com/sigstore/cosign/v2 v2.5.0 h1:1aRfPgRQHHlODI3Mvs/JkPBS9dJT9bRLCuHZgnHx
 github.com/sigstore/cosign/v2 v2.5.0/go.mod h1:2V2hmo+jjFNnDb5Q5VL6PXvLU9Vujio7T5yldrpNTRw=
 github.com/sigstore/fulcio v1.6.6 h1:XaMYX6TNT+8n7Npe8D94nyZ7/ERjEsNGFC+REdi/wzw=
 github.com/sigstore/fulcio v1.6.6/go.mod h1:BhQ22lwaebDgIxVBEYOOqLRcN5+xOV+C9bh/GUXRhOk=
-github.com/sigstore/protobuf-specs v0.4.1 h1:5SsMqZbdkcO/DNHudaxuCUEjj6x29tS2Xby1BxGU7Zc=
-github.com/sigstore/protobuf-specs v0.4.1/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
-github.com/sigstore/rekor v1.3.9 h1:sUjRpKVh/hhgqGMs0t+TubgYsksArZ6poLEC3MsGAzU=
-github.com/sigstore/rekor v1.3.9/go.mod h1:xThNUhm6eNEmkJ/SiU/FVU7pLY2f380fSDZFsdDWlcM=
-github.com/sigstore/sigstore v1.9.4 h1:64+OGed80+A4mRlNzRd055vFcgBeDghjZw24rPLZgDU=
-github.com/sigstore/sigstore v1.9.4/go.mod h1:Q7tGTC3gbtK7c3jcxEmGc2MmK4rRpIRzi3bxRFWKvEY=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/rekor v1.4.1 h1:KK3McuHnptIE9mdNlrc9qh/OVE0AXf4rnScMxJE6xH4=
+github.com/sigstore/rekor v1.4.1/go.mod h1:/McBsz/vrtfi4EInxSIk/MGbDXzgv2+1FQUg1R/uSnE=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
 github.com/sigstore/sigstore-go v0.7.1 h1:lyzi3AjO6+BHc5zCf9fniycqPYOt3RaC08M/FRmQhVY=
 github.com/sigstore/sigstore-go v0.7.1/go.mod h1:AIRj4I3LC82qd07VFm3T2zXYiddxeBV1k/eoS8nTz0E=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1 h1:/YcNq687WnXpIRXl04nLfJX741G4iW+w+7Nem2Zy0f4=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1/go.mod h1:ApL9RpKsi7gkSYN0bMNdm/3jZ9EefxMmfYHfUmq2ZYM=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1 h1:FnusXyTIInnwfIOzzl5PFilRm1I97dxMSOcCkZBu9Kc=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1/go.mod h1:d5m5LOa/69a+t2YC9pDPwS1n2i/PhqB4cUKbpVDlKKE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1 h1:LFiYK1DEWQ6Hf/nroFzBMM+s5rVSjVL45Alpb5Ctl5A=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1/go.mod h1:GFyFmDsE2wDuIHZD+4+JErGpA0S4zJsKNz5l2JVJd8s=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1 h1:sIW6xe4yU5eIMH8fve2C78d+r29KmHnIb+7po+80bsY=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1/go.mod h1:3pNf99GnK9eu3XUa5ebHzgEQSVYf9hqAoPFwbwD6O6M=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5 h1:qp2VFyKuFQvTGmZwk5Q7m5nE4NwnF9tHwkyz0gtWAck=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5/go.mod h1:DKlQjjr+GsWljEYPycI0Sf8URLCk4EbGA9qYjF47j4g=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5 h1:CRZcdYn5AOptStsLRAAACudAVmb1qUbhMlzrvm7ju3o=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5/go.mod h1:b9rFfITq2fp1M3oJmq6lFFhSrAz5vOEJH1qzbMsZWN4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3 h1:a7Yz8C0aBa/LjeiTa9ZLYi9B74GNhFRnUIUdvN6ddVk=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3/go.mod h1:tRtJzSZ48MXJV9bmS8pkb3mP36PCad/Cs+BmVJ3Z4O4=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5 h1:S2ukEfN1orLKw2wEQIUHDDlzk0YcylhcheeZ5TGk8LI=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5/go.mod h1:m7sQxVJmDa+rsmS1m6biQxaLX83pzNS7ThUEyjOqkCU=
 github.com/sigstore/timestamp-authority v1.2.5 h1:W22JmwRv1Salr/NFFuP7iJuhytcZszQjldoB8GiEdnw=
 github.com/sigstore/timestamp-authority v1.2.5/go.mod h1:gWPKWq4HMWgPCETre0AakgBzcr9DRqHrsgbrRqsigOs=
 github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
 github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -2176,7 +2180,6 @@ github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJ
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
@@ -2186,12 +2189,11 @@ github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
 github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
-github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8 h1:KFHLQuNqUG4YZXo+QwMurqFxU5qWchFDCxYbl+uJz9w=
-github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8/go.mod h1:xhhvkBenvvbuEEw9YR2HwGzUPv0sQiHd3wv8avhra+U=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -2214,21 +2216,37 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDdvS342BElfbETmL1Aiz3i2t0zfRj16Hs=
 github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
 github.com/tchap/go-patricia/v2 v2.3.2 h1:xTHFutuitO2zqKAQ5rCROYgUb7Or/+IC3fts9/Yc7nM=
 github.com/tchap/go-patricia/v2 v2.3.2/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/testcontainers/testcontainers-go v0.39.0 h1:uCUJ5tA+fcxbFAB0uP3pIK3EJ2IjjDUHFSZ1H1UxAts=
+github.com/testcontainers/testcontainers-go v0.39.0/go.mod h1:qmHpkG7H5uPf/EvOORKvS6EuDkBUPE3zpVGaH9NL7f8=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0 h1:8iJ4itSuiSpPLevQ+fM6cR+9k74YSOM1glKI4XFF+Qw=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0/go.mod h1:EKJcSWfogRdiBc5kvar1tumSx7MImmkQ0RDvU0HZQZM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0 h1:REJz+XwNpGC/dCgTfYvM4SKqobNqDBfvhq74s2oHTUM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0/go.mod h1:4K2OhtHEeT+JSIFX4V8DkGKsyLa96Y2vLdd3xsxD5HE=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
 github.com/theupdateframework/go-tuf/v2 v2.0.2 h1:PyNnjV9BJNzN1ZE6BcWK+5JbF+if370jjzO84SS+Ebo=
 github.com/theupdateframework/go-tuf/v2 v2.0.2/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
@@ -2239,16 +2257,18 @@ github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
 github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
-github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
 github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
 github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb h1:Ywfo8sUltxogBpFuMOFRrrSifO788kAFxmvVw31PtQQ=
 github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb/go.mod h1:ikPs9bRWicNw3S7XpJ8sK/smGwU9WcSVU3dy9qahYBM=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
@@ -2259,13 +2279,10 @@ github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3k
 github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -2276,6 +2293,8 @@ github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZ
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
 github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
@@ -2290,14 +2309,12 @@ github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 h1:hlE8//ciYMztlGpl/VA+Zm1AcTPHYkHJPbHqE6WJUXE=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f h1:ERexzlUfuTvpE74urLSbIQW0Z/6hF9t8U4NsJLaioAY=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
 github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
 github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
@@ -2307,15 +2324,16 @@ github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaD
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 github.com/zitadel/logging v0.6.2 h1:MW2kDDR0ieQynPZ0KIZPrh9ote2WkxfBif5QoARDQcU=
 github.com/zitadel/logging v0.6.2/go.mod h1:z6VWLWUkJpnNVDSLzrPSQSQyttysKZ6bCRongw0ROK4=
-github.com/zitadel/oidc/v3 v3.38.1 h1:VTf1Bv/33UbSwJnIWbfEIdpUGYKfoHetuBNIqVTcjvA=
-github.com/zitadel/oidc/v3 v3.38.1/go.mod h1:muukzAasaWmn3vBwEVMglJfuTE0PKCvLJGombPwXIRw=
+github.com/zitadel/oidc/v3 v3.43.0 h1:LokviPoiTNNPbIAMO/eb6Kq9PNWPWp0mA1oWtdLc+Qs=
+github.com/zitadel/oidc/v3 v3.43.0/go.mod h1:5ki8s9CWoB4iGmtULndiVxwM8xt7IylZIaudro7jEq4=
 github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
 github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
 gitlab.com/gitlab-org/api/client-go v0.127.0 h1:8xnxcNKGF2gDazEoMs+hOZfOspSSw8D0vAoWhQk9U+U=
 gitlab.com/gitlab-org/api/client-go v0.127.0/go.mod h1:bYC6fPORKSmtuPRyD9Z2rtbAjE7UeNatu2VWHRf4/LE=
-go.einride.tech/aip v0.68.1 h1:16/AfSxcQISGN5z9C5lM+0mLYXihrHbQ1onvYTr93aQ=
-go.einride.tech/aip v0.68.1/go.mod h1:XaFtaj4HuA3Zwk9xoBtTWgNubZ0ZZXv9BZJCkuKuWbg=
-go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
+go.einride.tech/aip v0.73.0 h1:bPo4oqBo2ZQeBKo4ZzLb1kxYXTY1ysJhpvQyfuGzvps=
+go.einride.tech/aip v0.73.0/go.mod h1:Mj7rFbmXEgw0dq1dqJ7JGMvYCZZVxmGOR3S4ZcV5LvQ=
+go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
+go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
 go.etcd.io/etcd/api/v3 v3.5.21 h1:A6O2/JDb3tvHhiIz3xf9nJ7REHvtEFJJ3veW3FbCnS8=
 go.etcd.io/etcd/api/v3 v3.5.21/go.mod h1:c3aH5wcvXv/9dqIw2Y810LDXJfhSYdHQ0vxmP3CCHVY=
 go.etcd.io/etcd/client/pkg/v3 v3.5.21 h1:lPBu71Y7osQmzlflM9OfeIV2JlmpBjqBNlLtcoBqUTc=
@@ -2323,8 +2341,8 @@ go.etcd.io/etcd/client/pkg/v3 v3.5.21/go.mod h1:BgqT/IXPjK9NkeSDjbzwsHySX3yIle2+
 go.etcd.io/etcd/client/v3 v3.5.21 h1:T6b1Ow6fNjOLOtM0xSoKNQt1ASPCLWrF9XMHcH9pEyY=
 go.etcd.io/etcd/client/v3 v3.5.21/go.mod h1:mFYy67IOqmbRf/kRUvsHixzo3iG+1OF2W2+jVIQRAnU=
 go.mongodb.org/mongo-driver v1.11.4/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g=
-go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
-go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -2336,37 +2354,61 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0 h1:bGvFt68+KTiAKFlacHW6AhA56GF2rS0bdD3aJYEnmzA=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0/go.mod h1:qGWP8/+ILwMRIUf9uIVLloR1uo5ZYAslM4O6OqUi1DA=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0 h1:PB3Zrjs1sG1GBX51SXyTSoOTqcDglmsk7nT6tkKPb/k=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0/go.mod h1:U2R3XyVPzn0WX7wOIypPuptulsMcPDPs/oiSVOMVnHY=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGhfnFe5lwB0ic1JBVjzhk0w=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7ZSD+5yn+lo3sGV69nW04rRR0jhYnBwjuX3r0HvnK0=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0/go.mod h1:QyjcV9qDP6VeK5qPyKETvNjmaaEc7+gqjh4SS0ZYzDU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0/go.mod h1:zKU4zUgKiaRxrdovSS2amdM5gOc59slmo/zJwGX+YBg=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsux7Qmq8ToKAx1XCilTQECZ0KDZyTw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
+go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
+go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
+go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI=
-go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc=
-go.step.sm/crypto v0.60.0 h1:UgSw8DFG5xUOGB3GUID17UA32G4j1iNQ4qoMhBmsVFw=
-go.step.sm/crypto v0.60.0/go.mod h1:Ep83Lv818L4gV0vhFTdPWRKnL6/5fRMpi8SaoP5ArSw=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d h1:Ns9kd1Rwzw7t0BR8XMphenji4SmIoNZPn8zhYmaVKP8=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d/go.mod h1:92Uoe3l++MlthCm+koNi0tcUCX3anayogF0Pa/sp24k=
+go.step.sm/crypto v0.70.0 h1:Q9Ft7N637mucyZcHZd1+0VVQJVwDCKqcb9CYcYi7cds=
+go.step.sm/crypto v0.70.0/go.mod h1:pzfUhS5/ue7ev64PLlEgXvhx1opwbhFCjkvlhsxVds0=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -2378,8 +2420,8 @@ go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -2394,7 +2436,10 @@ go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -2411,14 +2456,13 @@ golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2434,8 +2478,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -2478,16 +2522,14 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -2495,7 +2537,6 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -2551,11 +2592,10 @@ golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2585,8 +2625,8 @@ golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
 golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2607,12 +2647,11 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2624,7 +2663,6 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2707,16 +2745,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8 h1:LvzTn0GQhWuvKH/kVRS3R3bVAsdQWI7hvfLHGgh9+lU=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2729,13 +2767,12 @@ golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2756,16 +2793,16 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2783,7 +2820,6 @@ golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190829051458-42f498d34c4d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -2837,11 +2873,14 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
+golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2866,8 +2905,8 @@ gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJ
 gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
 gonum.org/v1/gonum v0.9.3/go.mod h1:TZumC3NeyVQskjXqmyWt4S3bINhy7B4eYwW69EbyX+0=
 gonum.org/v1/gonum v0.11.0/go.mod h1:fSG4YDCxxUZQJ7rKsQrj0gMOg00Il0Z96/qMA4bVQhA=
-gonum.org/v1/gonum v0.15.1 h1:FNy7N6OUZVUaWG9pTiD+jlhdQ3lMP+/LcTpJ6+a8sQ0=
-gonum.org/v1/gonum v0.15.1/go.mod h1:eZTZuRFrzu5pcyjN5wJhcIhnUdNijYxX1T2IcrOGY0o=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
@@ -2929,8 +2968,8 @@ google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/
 google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
 google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
 google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/api v0.230.0 h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM=
-google.golang.org/api v0.230.0/go.mod h1:aqvtoMk7YkiXx+6U12arQFExiRV9D/ekvMCwCd/TksQ=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -3070,12 +3109,12 @@ google.golang.org/genproto v0.0.0-20230323212658-478b75c54725/go.mod h1:UUQDJDOl
 google.golang.org/genproto v0.0.0-20230330154414-c0448cd141ea/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
 google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 h1:0PeQib/pH3nB/5pEmFeVQJotzGohV0dq4Vcp09H5yhE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34/go.mod h1:0awUlEkap+Pb1UMeJwJQQAdJQrt3moU7J2moTy69irI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 h1:h6p3mQqrmT1XkHVTfzLdNz1u7IhINeZkz67/xTbOuWs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -3117,8 +3156,8 @@ google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5v
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
 google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
@@ -3139,9 +3178,8 @@ google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -3163,6 +3201,7 @@ gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/mail.v2 v2.3.1 h1:WYFn/oANrAGP2C0dcV6/pbkPzv8yGzqTjPmTeO7qoXk=
 gopkg.in/mail.v2 v2.3.1/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
+gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce h1:xcEWjVhvbDy+nHP67nPDDpbYrY+ILlfndk4bRioVHaU=
 gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
@@ -3171,7 +3210,6 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkep
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -3185,12 +3223,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 h1:TbRPT0HtzFP3Cno1zZo7yPzEEnfu8EjLfl6IU9VfqkQ=
 gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259/go.mod h1:AVgIgHMwK63XvmAzWG9vLQ41YnVHN0du0tEC46fI7yY=
-helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
-helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
+helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -3199,30 +3237,30 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-k8s.io/api v0.33.0 h1:yTgZVn1XEe6opVpP1FylmNrIFWuDqe2H0V8CT5gxfIU=
-k8s.io/api v0.33.0/go.mod h1:CTO61ECK/KU7haa3qq8sarQ0biLq2ju405IZAd9zsiM=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
-k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.0 h1:QqcM6c+qEEjkOODHppFXRiw/cE2zP85704YrQ9YaBbc=
-k8s.io/apiserver v0.33.0/go.mod h1:EixYOit0YTxt8zrO2kBU7ixAtxFce9gKGq367nFmqI8=
-k8s.io/cli-runtime v0.33.0 h1:Lbl/pq/1o8BaIuyn+aVLdEPHVN665tBAXUePs8wjX7c=
-k8s.io/cli-runtime v0.33.0/go.mod h1:QcA+r43HeUM9jXFJx7A+yiTPfCooau/iCcP1wQh4NFw=
-k8s.io/client-go v0.33.0 h1:UASR0sAYVUzs2kYuKn/ZakZlcs2bEHaizrrHUZg0G98=
-k8s.io/client-go v0.33.0/go.mod h1:kGkd+l/gNGg8GYWAPr0xF1rRKvVWvzh9vmZAMXtaKOg=
-k8s.io/component-base v0.33.0 h1:Ot4PyJI+0JAD9covDhwLp9UNkUja209OzsJ4FzScBNk=
-k8s.io/component-base v0.33.0/go.mod h1:aXYZLbw3kihdkOPMDhWbjGCO6sg+luw554KP51t8qCU=
-k8s.io/component-helpers v0.33.0 h1:0AdW0A0mIgljLgtG0hJDdJl52PPqTrtMgOgtm/9i/Ys=
-k8s.io/component-helpers v0.33.0/go.mod h1:9SRiXfLldPw9lEEuSsapMtvT8j/h1JyFFapbtybwKvU=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
+k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
+k8s.io/component-helpers v0.33.3 h1:fjWVORSQfI0WKzPeIFSju/gMD9sybwXBJ7oPbqQu6eM=
+k8s.io/component-helpers v0.33.3/go.mod h1:7iwv+Y9Guw6X4RrnNQOyQlXcvJrVjPveHVqUA5dm31c=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.0 h1:HiRb1yqibBSCqic4pRZP+viiOBAnIdwYDpzUFejs07g=
-k8s.io/kubectl v0.33.0/go.mod h1:gAlGBuS1Jq1fYZ9AjGWbI/5Vk3M/VW2DK4g10Fpyn/0=
-k8s.io/metrics v0.33.0 h1:sKe5sC9qb1RakMhs8LWYNuN2ne6OTCWexj8Jos3rO2Y=
-k8s.io/metrics v0.33.0/go.mod h1:XewckTFXmE2AJiP7PT3EXaY7hi7bler3t2ZLyOdQYzU=
+k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
+k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
+k8s.io/metrics v0.33.3 h1:9CcqBz15JZfISqwca33gdHS8I6XfsK1vA8WUdEnG70g=
+k8s.io/metrics v0.33.3/go.mod h1:Aw+cdg4AYHw0HvUY+lCyq40FOO84awrqvJRTw0cmXDs=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
@@ -3261,8 +3299,8 @@ modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg=
 mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8=
-oras.land/oras-go v1.2.5 h1:XpYuAwAb0DfQsunIyMfeET92emK8km3W4yEzZvUbsTo=
-oras.land/oras-go v1.2.5/go.mod h1:PuAwRShRZCsZb7g8Ar3jKKQR/2A/qN+pkYxIOd/FAoo=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
@@ -3282,11 +3320,12 @@ sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/r
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/release-utils v0.11.1 h1:hzvXGpHgHJfLOJB6TRuu14bzWc3XEglHmXHJqwClSZE=
-sigs.k8s.io/release-utils v0.11.1/go.mod h1:ybR2V/uQAOGxYfzYtBenSYeXWkBGNP2qnEiX77ACtpc=
+sigs.k8s.io/release-utils v0.12.1 h1:3p9w137wBTTApHlL8izdJHcCuaBe8wZhQz+B0QIAaBE=
+sigs.k8s.io/release-utils v0.12.1/go.mod h1:0z7JOb7iQcuDQcemQw5CSVrkH8evRHY0DMMjcyRB1e4=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
 software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/integration/appaccess/appaccess_test.go b/integration/appaccess/appaccess_test.go
index 8bb73e091754b..a556d5bbcb2ff 100644
--- a/integration/appaccess/appaccess_test.go
+++ b/integration/appaccess/appaccess_test.go
@@ -23,6 +23,7 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -35,6 +36,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
@@ -45,10 +48,12 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
 	"github.com/gravitational/teleport/lib/web/app"
 )
 
@@ -57,7 +62,27 @@ import (
 // It allows to make the entire cluster set up once, instead of per test,
 // which speeds things up significantly.
 func TestAppAccess(t *testing.T) {
-	pack := Setup(t)
+	// Enable MCP test servers.
+	sseServerURL := mcptest.MustStartSSETestServer(t)
+	streamableHTTPServer := mcpserver.NewTestStreamableHTTPServer(mcptest.NewServer())
+	streamableHTTPServerURL := fmt.Sprintf("mcp+%s/mcp", streamableHTTPServer.URL)
+	t.Cleanup(streamableHTTPServer.Close)
+
+	extraApps := []servicecfg.App{
+		{
+			Name: "test-sse",
+			URI:  "mcp+sse+" + sseServerURL,
+		},
+		{
+			Name: "test-http",
+			URI:  streamableHTTPServerURL,
+		},
+	}
+
+	// Reusing the pack as much as we can.
+	pack := SetupWithOptions(t, AppTestOptions{
+		ExtraRootApps: extraApps,
+	})
 
 	t.Run("Forward", bind(pack, testForward))
 	t.Run("Websockets", bind(pack, testWebsockets))
@@ -71,6 +96,9 @@ func TestAppAccess(t *testing.T) {
 	t.Run("NoHeaderOverrides", bind(pack, testNoHeaderOverrides))
 	t.Run("AuditEvents", bind(pack, testAuditEvents))
 
+	// MCP access tests.
+	t.Run("MCP", bind(pack, testMCP))
+
 	// This test should go last because it stops/starts app servers.
 	t.Run("TestAppServersHA", bind(pack, testServersHA))
 }
@@ -264,7 +292,7 @@ func testForwardModes(p *Pack, t *testing.T) {
 // testClientCert tests mutual TLS authentication flow with application
 // access typically used in CLI by curl and other clients.
 func testClientCert(p *Pack, t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -575,7 +603,7 @@ func testAuditEvents(p *Pack, t *testing.T) {
 	require.Contains(t, body, p.rootMessage)
 
 	// session start event
-	p.ensureAuditEvent(t, events.AppSessionStartEvent, func(event apievents.AuditEvent) {
+	p.ensureAuditEvent(t, events.AppSessionStartEvent, func(event apievents.AuditEvent) bool {
 		expectedEvent := &apievents.AppSessionStart{
 			Metadata: apievents.Metadata{
 				Type:        events.AppSessionStartEvent,
@@ -589,16 +617,16 @@ func testAuditEvents(p *Pack, t *testing.T) {
 			},
 			PublicAddr: p.rootAppPublicAddr,
 		}
-		require.Empty(t, cmp.Diff(
+		return len(cmp.Diff(
 			expectedEvent,
 			event,
 			cmpopts.IgnoreTypes(apievents.ServerMetadata{}, apievents.SessionMetadata{}, apievents.UserMetadata{}, apievents.ConnectionMetadata{}),
 			cmpopts.IgnoreFields(apievents.Metadata{}, "ID", "Time"),
-		))
+		)) == 0
 	})
 
 	// session chunk event
-	p.ensureAuditEvent(t, events.AppSessionChunkEvent, func(event apievents.AuditEvent) {
+	p.ensureAuditEvent(t, events.AppSessionChunkEvent, func(event apievents.AuditEvent) bool {
 		expectedEvent := &apievents.AppSessionChunk{
 			Metadata: apievents.Metadata{
 				Type:        events.AppSessionChunkEvent,
@@ -611,13 +639,13 @@ func testAuditEvents(p *Pack, t *testing.T) {
 				AppName:       p.rootAppName,
 			},
 		}
-		require.Empty(t, cmp.Diff(
+		return len(cmp.Diff(
 			expectedEvent,
 			event,
 			cmpopts.IgnoreTypes(apievents.ServerMetadata{}, apievents.SessionMetadata{}, apievents.UserMetadata{}, apievents.ConnectionMetadata{}),
 			cmpopts.IgnoreFields(apievents.Metadata{}, "ID", "Time", "Index"),
 			cmpopts.IgnoreFields(apievents.AppSessionChunk{}, "SessionChunkID"),
-		))
+		)) == 0
 	})
 }
 
@@ -1065,7 +1093,7 @@ func testServersHA(p *Pack, t *testing.T) {
 	}
 
 	// asserts that the response has error.
-	responseWithError := func(t *testing.T, status int, err error) {
+	responseWithError := func(t *assert.CollectT, status int, err error) {
 		if status > 0 {
 			require.NoError(t, err)
 			require.Equal(t, http.StatusFound, status)
@@ -1075,7 +1103,7 @@ func testServersHA(p *Pack, t *testing.T) {
 		require.Error(t, err)
 	}
 	// asserts that the response has no errors.
-	responseWithoutError := func(t *testing.T, status int, err error) {
+	responseWithoutError := func(t *assert.CollectT, status int, err error) {
 		if status > 0 {
 			require.NoError(t, err)
 			require.Equal(t, http.StatusOK, status)
@@ -1085,12 +1113,14 @@ func testServersHA(p *Pack, t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	makeRequests := func(t *testing.T, pack *Pack, httpCookies, wsCookies []*http.Cookie, responseAssertion func(*testing.T, int, error)) {
-		status, _, err := pack.MakeRequest(httpCookies, http.MethodGet, "/")
-		responseAssertion(t, status, err)
+	makeRequests := func(t *testing.T, pack *Pack, httpCookies, wsCookies []*http.Cookie, responseAssertion func(*assert.CollectT, int, error)) {
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			status, _, err := pack.MakeRequest(httpCookies, http.MethodGet, "/")
+			responseAssertion(t, status, err)
 
-		_, err = pack.makeWebsocketRequest(wsCookies, "/")
-		responseAssertion(t, 0, err)
+			_, err = pack.makeWebsocketRequest(wsCookies, "/")
+			responseAssertion(t, 0, err)
+		}, 10*time.Second, 200*time.Millisecond)
 	}
 
 	for name, test := range testCases {
diff --git a/integration/appaccess/fixtures.go b/integration/appaccess/fixtures.go
index 3bd9ee5475d6c..5cad700c81435 100644
--- a/integration/appaccess/fixtures.go
+++ b/integration/appaccess/fixtures.go
@@ -41,6 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type AppTestOptions struct {
@@ -65,7 +66,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Insecure development mode needs to be set because the web proxy uses a
 	// self-signed certificate during tests.
diff --git a/integration/appaccess/mcp_test.go b/integration/appaccess/mcp_test.go
new file mode 100644
index 0000000000000..263c1c1d8d978
--- /dev/null
+++ b/integration/appaccess/mcp_test.go
@@ -0,0 +1,157 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package appaccess
+
+import (
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/client"
+	clientmcp "github.com/gravitational/teleport/lib/client/mcp"
+	libmcp "github.com/gravitational/teleport/lib/srv/mcp"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+func testMCP(pack *Pack, t *testing.T) {
+	// SaveProfile before using the TeleportClient.
+	require.NoError(t, pack.tc.SaveProfile(false))
+
+	t.Run("stdio no server found", func(t *testing.T) {
+		testMCPDialStdioNoServerFound(t, pack)
+	})
+
+	t.Run("stdio success", func(t *testing.T) {
+		testMCPDialStdio(t, pack)
+	})
+
+	t.Run("stdio to sse success", func(t *testing.T) {
+		testMCPDialStdioToSSE(t, pack, "test-sse")
+	})
+
+	t.Run("proxy streamable HTTP success", func(t *testing.T) {
+		testMCPProxyStreamableHTTP(t, pack, "test-http")
+	})
+
+	t.Run("stdio to streamable HTTP success", func(t *testing.T) {
+		testMCPStdioToStreamableHTTP(t, pack, "test-http")
+	})
+}
+
+func testMCPDialStdioNoServerFound(t *testing.T, pack *Pack) {
+	// Single connection dial for stdio.
+	dialer := client.NewMCPServerDialer(pack.tc, "not-found")
+	_, err := dialer.DialALPN(t.Context())
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err))
+}
+
+func testMCPDialStdio(t *testing.T, pack *Pack) {
+	// Single connection dial for stdio.
+	dialer := client.NewMCPServerDialer(pack.tc, libmcp.DemoServerName)
+	serverConn, err := dialer.DialALPN(t.Context())
+	require.NoError(t, err)
+
+	ctx := t.Context()
+	stdioClient := mcptest.NewStdioClientFromConn(t, serverConn)
+
+	_, err = mcptest.InitializeClient(ctx, stdioClient)
+	require.NoError(t, err)
+
+	listTools, err := stdioClient.ListTools(ctx, mcp.ListToolsRequest{})
+	require.NoError(t, err)
+	require.Len(t, listTools.Tools, 3)
+}
+
+func testMCPDialStdioToSSE(t *testing.T, pack *Pack, appName string) {
+	// Single connection dial for stdio.
+	dialer := client.NewMCPServerDialer(pack.tc, appName)
+	serverConn, err := dialer.DialALPN(t.Context())
+	require.NoError(t, err)
+
+	stdioClient := mcptest.NewStdioClientFromConn(t, serverConn)
+	mcptest.MustInitializeClient(t, stdioClient)
+	mcptest.MustCallServerTool(t, stdioClient)
+}
+
+func testMCPProxyStreamableHTTP(t *testing.T, pack *Pack, appName string) {
+	// Use special dialer for HTTP client.
+	ctx := t.Context()
+	dialer := client.NewMCPServerDialer(pack.tc, appName)
+	mcpClientTransport, err := mcpclienttransport.NewStreamableHTTP(
+		"https://"+pack.rootCluster.Web,
+		mcpclienttransport.WithHTTPBasicClient(&http.Client{
+			Transport: &http.Transport{
+				DialTLSContext: dialer.DialContext,
+			},
+		}),
+	)
+	require.NoError(t, err)
+	client := mcpclient.NewClient(mcpClientTransport)
+	require.NoError(t, client.Start(ctx))
+	defer client.Close()
+
+	// Initialize client and call a tool.
+	mcptest.MustInitializeClient(t, client)
+	mcptest.MustCallServerTool(t, client)
+}
+
+func testMCPStdioToStreamableHTTP(t *testing.T, pack *Pack, appName string) {
+	clientConn, serverConn := net.Pipe()
+	t.Cleanup(func() {
+		assert.NoError(t, trace.NewAggregate(clientConn.Close(), serverConn.Close()))
+	})
+
+	// Use clientmcp.ProxyStdioConn to handle transport conversion.
+	// Use special dialer (on pack.tc) to dial Proxy.
+	dialer := client.NewMCPServerDialer(pack.tc, appName)
+	proxyErrChan := make(chan error, 1)
+	go func() {
+		err := clientmcp.ProxyStdioConn(
+			t.Context(),
+			clientmcp.ProxyStdioConnConfig{
+				ClientStdio: serverConn,
+				GetApp:      dialer.GetApp,
+				DialServer:  dialer.DialALPN,
+			},
+		)
+		proxyErrChan <- err
+	}()
+
+	stdioClient := mcptest.NewStdioClientFromConn(t, clientConn)
+	mcptest.MustInitializeClient(t, stdioClient)
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Shut done client and wait for proxy func to finish.
+	require.NoError(t, stdioClient.Close())
+	select {
+	case proxyErr := <-proxyErrChan:
+		require.NoError(t, proxyErr)
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for proxy to complete")
+	}
+}
diff --git a/integration/appaccess/pack.go b/integration/appaccess/pack.go
index b7eaf2f1f4e48..574a7aaee8533 100644
--- a/integration/appaccess/pack.go
+++ b/integration/appaccess/pack.go
@@ -29,6 +29,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"slices"
 	"testing"
 	"time"
 
@@ -43,6 +44,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/iterutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/auth"
@@ -58,6 +60,8 @@ import (
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	sliceutils "github.com/gravitational/teleport/lib/utils/slices"
 	"github.com/gravitational/teleport/lib/web"
 	"github.com/gravitational/teleport/lib/web/app"
 	websession "github.com/gravitational/teleport/lib/web/session"
@@ -497,24 +501,19 @@ func (p *Pack) makeWebapiRequest(method, endpoint string, payload []byte) (int,
 	return statusCode, []byte(body), trace.Wrap(err)
 }
 
-func (p *Pack) ensureAuditEvent(t *testing.T, eventType string, checkEvent func(event apievents.AuditEvent)) {
-	ctx := context.Background()
-	require.Eventuallyf(t, func() bool {
+func (p *Pack) ensureAuditEvent(t *testing.T, eventType string, matchEvent func(event apievents.AuditEvent) bool) {
+	ctx := t.Context()
+	require.EventuallyWithTf(t, func(t *assert.CollectT) {
 		events, _, err := p.rootCluster.Process.GetAuthServer().SearchEvents(ctx, events.SearchEventsRequest{
 			From:       time.Now().Add(-time.Hour),
 			To:         time.Now().Add(time.Hour),
 			EventTypes: []string{eventType},
-			Limit:      1,
+			Limit:      5,
 			Order:      types.EventOrderDescending,
 		})
 		require.NoError(t, err)
-		if len(events) == 0 {
-			return false
-		}
-
-		checkEvent(events[0])
-		return true
-	}, 500*time.Millisecond, 50*time.Millisecond, "failed to fetch audit event \"%s\"", eventType)
+		require.True(t, slices.ContainsFunc(events, matchEvent))
+	}, 5*time.Second, 100*time.Millisecond, "failed to fetch audit event \"%s\"", eventType)
 }
 
 // initCertPool initializes root cluster CA pool.
@@ -759,7 +758,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 	for i := 0; i < count; i++ {
 		raConf := servicecfg.MakeDefaultConfig()
 		raConf.Clock = opts.Clock
-		raConf.Logger = utils.NewSlogLoggerForTests()
+		raConf.Logger = logtest.NewLogger()
 		raConf.DataDir = t.TempDir()
 		raConf.SetToken("static-token-value")
 		raConf.SetAuthServerAddress(utils.NetAddr{
@@ -770,6 +769,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 		raConf.Proxy.Enabled = false
 		raConf.SSH.Enabled = false
 		raConf.Apps.Enabled = true
+		raConf.Apps.MCPDemoServer = true
 		raConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 		raConf.Apps.MonitorCloseChannel = opts.MonitorCloseChannel
 		raConf.Apps.Apps = append([]servicecfg.App{
@@ -910,16 +910,16 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 		t.Cleanup(func() {
 			require.NoError(t, srv.Close())
 		})
-		waitForAppServer(t, p.rootCluster.Tunnel, p.rootAppClusterName, srv.Config.HostUUID, configs[i].Apps.Apps)
+		waitForAppServer(t, p.rootCluster.Tunnel, p.rootAppClusterName, srv, configs[i].Apps.Apps)
 	}
 
 	return servers
 }
 
-func waitForAppServer(t *testing.T, tunnel reversetunnelclient.Server, name string, hostUUID string, apps []servicecfg.App) {
+func waitForAppServer(t *testing.T, tunnel reversetunnelclient.Server, clusterName string, srv *service.TeleportProcess, apps []servicecfg.App) {
 	// Make sure that the app server is ready to accept connections.
 	// The remote site cache needs to be filled with new registered application services.
-	waitForAppRegInRemoteSiteCache(t, tunnel, name, apps, hostUUID)
+	waitForAppInClusterCache(t, tunnel, clusterName, srv, apps)
 }
 
 func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions) []*service.TeleportProcess {
@@ -928,7 +928,7 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 	for i := 0; i < count; i++ {
 		laConf := servicecfg.MakeDefaultConfig()
 		laConf.Clock = opts.Clock
-		laConf.Logger = utils.NewSlogLoggerForTests()
+		laConf.Logger = logtest.NewLogger()
 		laConf.DataDir = t.TempDir()
 		laConf.SetToken("static-token-value")
 		laConf.SetAuthServerAddress(utils.NetAddr{
@@ -1055,29 +1055,47 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 		t.Cleanup(func() {
 			require.NoError(t, srv.Close())
 		})
-		waitForAppServer(t, p.leafCluster.Tunnel, p.leafAppClusterName, srv.Config.HostUUID, configs[i].Apps.Apps)
+		waitForAppServer(t, p.leafCluster.Tunnel, p.leafAppClusterName, srv, configs[i].Apps.Apps)
+		waitForAppServer(t, p.rootCluster.Tunnel, p.leafAppClusterName, srv, configs[i].Apps.Apps)
 	}
 
 	return servers
 }
 
-func waitForAppRegInRemoteSiteCache(t *testing.T, tunnel reversetunnelclient.Server, clusterName string, cfgApps []servicecfg.App, hostUUID string) {
+// waitForAppInClusterCache ensures the applications is present on the cache.
+// Given that the applications might be already served by other application
+// agent, we must assert the applications are served by the provided server.
+func waitForAppInClusterCache(t *testing.T, server reversetunnelclient.Server, clusterName string, srv *service.TeleportProcess, cfgApps []servicecfg.App) {
+	t.Helper()
+
+	ctx := t.Context()
+	hostID, err := srv.WaitForHostID(ctx)
+	require.NoError(t, err)
+
+	type appHost struct {
+		appID  string
+		hostID string
+	}
+
+	wantNames := sliceutils.Map(cfgApps, func(app servicecfg.App) appHost {
+		return appHost{appID: app.Name, hostID: hostID}
+	})
+
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		site, err := tunnel.GetSite(clusterName)
+		cluster, err := server.Cluster(ctx, clusterName)
 		assert.NoError(t, err)
 
-		ap, err := site.CachingAccessPoint()
+		ap, err := cluster.CachingAccessPoint()
 		assert.NoError(t, err)
 
-		apps, err := ap.GetApplicationServers(context.Background(), apidefaults.Namespace)
+		apps, err := ap.GetApplicationServers(ctx, apidefaults.Namespace)
 		assert.NoError(t, err)
 
-		counter := 0
-		for _, v := range apps {
-			if v.GetHostID() == hostUUID {
-				counter++
-			}
-		}
-		assert.Len(t, cfgApps, counter)
+		require.Subset(t,
+			slices.Collect(iterutils.Map(func(appServer types.AppServer) appHost {
+				return appHost{appID: appServer.GetApp().GetName(), hostID: appServer.GetHostID()}
+			}, slices.Values(apps))),
+			wantNames,
+		)
 	}, time.Minute*2, time.Millisecond*200)
 }
diff --git a/integration/autoupdate/tools/main_test.go b/integration/autoupdate/tools/main_test.go
index 55878b58611fd..8d5ad7c280e99 100644
--- a/integration/autoupdate/tools/main_test.go
+++ b/integration/autoupdate/tools/main_test.go
@@ -29,7 +29,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -38,8 +37,14 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/integration/autoupdate/tools/updater/tctl"
+	"github.com/gravitational/teleport/integration/autoupdate/tools/updater/tsh"
 	"github.com/gravitational/teleport/integration/helpers/archive"
+	"github.com/gravitational/teleport/lib/autoupdate"
+	"github.com/gravitational/teleport/lib/autoupdate/tools"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 const (
@@ -50,18 +55,38 @@ const (
 var (
 	// testVersions list of the pre-compiled binaries with encoded versions to check.
 	testVersions = []string{
-		"1.2.3",
-		"3.2.1",
+		"1.0.0",
+		"2.0.0",
+		"3.0.0",
+		"4.0.0",
 	}
 	limitedWriter = newLimitedResponseWriter()
 
 	toolsDir string
 	baseURL  string
+
+	// tshPath is the path to initial tsh binary version 1.0.0.
+	tshPath string
+	// tctlPath is the path to initial tctl binary version 1.0.0.
+	tctlPath string
 )
 
 func TestMain(m *testing.M) {
+	executable, err := os.Executable()
+	if err != nil {
+		log.Fatal("failed to get executable name", err)
+	}
+	switch filepath.Base(executable) {
+	case "tsh", "tsh.exe":
+		tsh.Main()
+		return
+	case "tctl", "tctl.exe":
+		tctl.Main()
+		return
+	}
+
 	modules.SetInsecureTestMode(true)
-	modules.SetModules(&modules.TestModules{TestBuildType: modules.BuildCommunity})
+	modules.SetModules(&modulestest.Modules{TestBuildType: modules.BuildCommunity})
 	ctx := context.Background()
 	tmp, err := os.MkdirTemp(os.TempDir(), testBinaryName)
 	if err != nil {
@@ -73,6 +98,12 @@ func TestMain(m *testing.M) {
 		log.Fatalf("failed to create temporary directory: %v", err)
 	}
 
+	for _, version := range testVersions {
+		if err := buildAndArchiveApps(ctx, tmp, version); err != nil {
+			log.Fatalf("failed to build testing app binary archive: %v", err)
+		}
+	}
+
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		filePath := filepath.Join(tmp, r.URL.Path)
 		switch {
@@ -83,10 +114,26 @@ func TestMain(m *testing.M) {
 		}
 	}))
 	baseURL = server.URL
-	for _, version := range testVersions {
-		if err := buildAndArchiveApps(ctx, tmp, version, server.URL); err != nil {
-			log.Fatalf("failed to build testing app binary archive: %v", err)
-		}
+	if err := os.Setenv(autoupdate.BaseURLEnvVar, server.URL); err != nil {
+		log.Fatalf("failed to set base URL environment variable: %v", err)
+	}
+
+	// Initial fetch the updater binary un-archive and replace.
+	updater := tools.NewUpdater(
+		toolsDir,
+		testVersions[0],
+		tools.WithBaseURL(baseURL),
+	)
+	if err := updater.Update(ctx, testVersions[0]); err != nil {
+		log.Fatalf("failed to update: %v", err)
+	}
+	tshPath, err = updater.ToolPath(tools.DefaultClientTools()[0], testVersions[0])
+	if err != nil {
+		log.Fatalf("failed to get tsh path: %v", err)
+	}
+	tctlPath, err = updater.ToolPath(tools.DefaultClientTools()[1], testVersions[0])
+	if err != nil {
+		log.Fatalf("failed to get tctl path: %v", err)
 	}
 
 	// Run tests after binary is built.
@@ -99,6 +146,9 @@ func TestMain(m *testing.M) {
 	if err := os.RemoveAll(toolsDir); err != nil {
 		log.Fatalf("failed to remove tools directory: %v", err)
 	}
+	if err := os.Unsetenv(autoupdate.BaseURLEnvVar); err != nil {
+		log.Fatalf("failed to unset %q environment variable: %v", autoupdate.BaseURLEnvVar, err)
+	}
 
 	os.Exit(code)
 }
@@ -132,18 +182,25 @@ func serve256File(w http.ResponseWriter, _ *http.Request, filePath string) {
 }
 
 // buildAndArchiveApps compiles the updater integration and pack it depends on platform is used.
-func buildAndArchiveApps(ctx context.Context, path string, version string, baseURL string) error {
+func buildAndArchiveApps(ctx context.Context, path string, version string) error {
 	versionPath := filepath.Join(path, version)
 	for _, app := range []string{"tsh", "tctl"} {
-		output := filepath.Join(versionPath, app)
+		output := filepath.Join(versionPath, version, app)
 		switch runtime.GOOS {
 		case constants.WindowsOS:
-			output = filepath.Join(versionPath, app+".exe")
+			output = filepath.Join(versionPath, version, app+".exe")
 		case constants.DarwinOS:
-			output = filepath.Join(versionPath, app+".app", "Contents", "MacOS", app)
+			output = filepath.Join(versionPath, app+".app", "Contents", "MacOS", version, app)
+		}
+		if err := os.MkdirAll(filepath.Dir(output), 0755); err != nil {
+			return err
 		}
-		if err := buildBinary(output, version, baseURL, app); err != nil {
-			return trace.Wrap(err)
+		testBinary, err := os.Executable()
+		if err != nil {
+			return err
+		}
+		if err := utils.CopyFile(testBinary, output, 0o755); err != nil {
+			return err
 		}
 	}
 	switch runtime.GOOS {
@@ -152,26 +209,9 @@ func buildAndArchiveApps(ctx context.Context, path string, version string, baseU
 		return trace.Wrap(archive.CompressDirToPkgFile(ctx, versionPath, archivePath, "com.example.pkgtest"))
 	case constants.WindowsOS:
 		archivePath := filepath.Join(path, fmt.Sprintf("teleport-v%s-windows-amd64-bin.zip", version))
-		return trace.Wrap(archive.CompressDirToZipFile(ctx, versionPath, archivePath))
+		return trace.Wrap(archive.CompressDirToZipFile(ctx, versionPath, archivePath, archive.WithNoCompress()))
 	default:
 		archivePath := filepath.Join(path, fmt.Sprintf("teleport-v%s-linux-%s-bin.tar.gz", version, runtime.GOARCH))
-		return trace.Wrap(archive.CompressDirToTarGzFile(ctx, versionPath, archivePath))
+		return trace.Wrap(archive.CompressDirToTarGzFile(ctx, versionPath, archivePath, archive.WithNoCompress()))
 	}
 }
-
-// buildBinary executes command to build client tool binary with updater logic for testing.
-func buildBinary(output string, version string, baseURL string, app string) error {
-	cmd := exec.Command(
-		"go", "build", "-o", output,
-		"-ldflags", strings.Join([]string{
-			fmt.Sprintf("-X 'github.com/gravitational/teleport/integration/autoupdate/tools/updater.version=%s'", version),
-			fmt.Sprintf("-X 'github.com/gravitational/teleport/lib/autoupdate/tools.version=%s'", version),
-			fmt.Sprintf("-X 'github.com/gravitational/teleport/lib/autoupdate/tools.baseURL=%s'", baseURL),
-		}, " "),
-		fmt.Sprintf("./updater/%s", app),
-	)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	return trace.Wrap(cmd.Run())
-}
diff --git a/integration/autoupdate/tools/updater/modules.go b/integration/autoupdate/tools/updater/modules.go
index 5aac39757a2e4..de91956a9ee07 100644
--- a/integration/autoupdate/tools/updater/modules.go
+++ b/integration/autoupdate/tools/updater/modules.go
@@ -23,16 +23,18 @@ import (
 	"crypto"
 	"fmt"
 	"os"
+	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/autoupdate/tools"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -44,12 +46,26 @@ const (
 	TestBuild = "UPDATER_TEST_BUILD"
 )
 
-var (
-	version = teleport.Version
-)
+func init() {
+	path, err := os.Executable()
+	if err != nil {
+		return
+	}
+	// For the integration test we use a pattern where the version is encoded
+	// in the directory name to simplify usage and avoid recompiling each
+	// individual binary.
+	parts := strings.Split(path, string(filepath.Separator))
+	if len(parts) > 2 {
+		tools.Version = parts[len(parts)-2]
+	}
+}
 
 type TestModules struct{}
 
+func (p *TestModules) GenerateLongTermResourceGrouping(context.Context, modules.AccessResourcesGetter, types.AccessRequest) (*types.LongTermResourceGrouping, error) {
+	return &types.LongTermResourceGrouping{}, nil
+}
+
 func (p *TestModules) GenerateAccessRequestPromotions(context.Context, modules.AccessResourcesGetter, types.AccessRequest) (*types.AccessRequestAllowedPromotions, error) {
 	return &types.AccessRequestAllowedPromotions{}, nil
 }
@@ -83,7 +99,7 @@ func (p *TestModules) LicenseExpiry() time.Time {
 
 // PrintVersion prints the Teleport version.
 func (p *TestModules) PrintVersion() {
-	fmt.Printf("Teleport v%v git\n", version)
+	fmt.Printf("Teleport v%v git\n", tools.Version)
 }
 
 // Features returns supported features
diff --git a/integration/autoupdate/tools/updater/tctl/main.go b/integration/autoupdate/tools/updater/tctl/main.go
index bbf894618e3f6..40338dc19a926 100644
--- a/integration/autoupdate/tools/updater/tctl/main.go
+++ b/integration/autoupdate/tools/updater/tctl/main.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package main
+package tctl
 
 import (
 	"context"
@@ -27,7 +27,7 @@ import (
 	tctl "github.com/gravitational/teleport/tool/tctl/common"
 )
 
-func main() {
+func Main() {
 	ctx, cancel := stacksignal.GetSignalHandler().NotifyContext(context.Background())
 	defer cancel()
 
diff --git a/integration/autoupdate/tools/updater/tsh/main.go b/integration/autoupdate/tools/updater/tsh/main.go
index 73abe237f6436..15680856c86ee 100644
--- a/integration/autoupdate/tools/updater/tsh/main.go
+++ b/integration/autoupdate/tools/updater/tsh/main.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package main
+package tsh
 
 import (
 	"context"
@@ -30,7 +30,7 @@ import (
 	tsh "github.com/gravitational/teleport/tool/tsh/common"
 )
 
-func main() {
+func Main() {
 	ctx, cancel := stacksignal.GetSignalHandler().NotifyContext(context.Background())
 	defer cancel()
 
diff --git a/integration/autoupdate/tools/updater_test.go b/integration/autoupdate/tools/updater_test.go
index 21f2962d75768..ba4dc45791cad 100644
--- a/integration/autoupdate/tools/updater_test.go
+++ b/integration/autoupdate/tools/updater_test.go
@@ -26,6 +26,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -51,27 +52,16 @@ func TestUpdate(t *testing.T) {
 	t.Setenv(types.HomeEnvVar, t.TempDir())
 	ctx := context.Background()
 
-	// Fetch compiled test binary with updater logic and install to $TELEPORT_HOME.
-	updater := tools.NewUpdater(
-		toolsDir,
-		testVersions[0],
-		tools.WithBaseURL(baseURL),
-	)
-	err := updater.Update(ctx, testVersions[0])
-	require.NoError(t, err)
-
 	// Verify that the installed version is equal to requested one.
-	cmd := exec.CommandContext(ctx, filepath.Join(toolsDir, "tctl"), "version")
+	cmd := exec.CommandContext(ctx, tctlPath, "version")
 	out, err := cmd.Output()
 	require.NoError(t, err)
 
-	matches := pattern.FindStringSubmatch(string(out))
-	require.Len(t, matches, 2)
-	require.Equal(t, testVersions[0], matches[1])
+	matchVersion(t, string(out), testVersions[0])
 
 	// Execute version command again with setting the new version which must
 	// trigger re-execution of the same command after downloading requested version.
-	cmd = exec.CommandContext(ctx, filepath.Join(toolsDir, "tsh"), "version")
+	cmd = exec.CommandContext(ctx, tshPath, "version")
 	cmd.Env = append(
 		os.Environ(),
 		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
@@ -79,9 +69,60 @@ func TestUpdate(t *testing.T) {
 	out, err = cmd.Output()
 	require.NoError(t, err)
 
-	matches = pattern.FindStringSubmatch(string(out))
-	require.Len(t, matches, 2)
-	require.Equal(t, testVersions[1], matches[1])
+	matchVersion(t, string(out), testVersions[1])
+}
+
+// TestUpdateDifferentOSArch verifies the update logic for matching operating system
+// and architecture. If they differ from the current system, a new download must be
+// initiated even when the same version is already installed.
+func TestUpdateDifferentOSArch(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv(types.HomeEnvVar, home)
+	ctx := context.Background()
+
+	// Execute version command with setting the new version which must trigger update and
+	// re-execution of the same command after downloading requested version.
+	cmd := exec.CommandContext(ctx, tshPath, "version")
+	cmd.Env = append(
+		os.Environ(),
+		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
+	)
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	matchVersion(t, string(out), testVersions[1])
+
+	configPath := filepath.Join(home, "bin")
+
+	ctc, err := tools.GetToolsConfig(configPath)
+	require.NoError(t, err)
+	require.Len(t, ctc.Tools, 1)
+	require.Equal(t, runtime.GOOS, ctc.Tools[0].OS)
+	require.Equal(t, runtime.GOARCH, ctc.Tools[0].Arch)
+
+	// Update the architecture to a non-existing value.
+	err = tools.UpdateToolsConfig(configPath, func(ctc *tools.ClientToolsConfig) error {
+		ctc.Tools[0].Arch = "unknown"
+		return nil
+	})
+	require.NoError(t, err)
+
+	// After executing the version command, we should not match the architecture of the
+	// previously installed tool version. Since the package does not match, we must
+	// re-download the package for the required architecture and re-execute.
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	cmd.Env = append(
+		os.Environ(),
+		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
+	)
+	out, err = cmd.Output()
+	require.NoError(t, err)
+	matchVersion(t, string(out), testVersions[1])
+
+	ctc, err = tools.GetToolsConfig(configPath)
+	require.NoError(t, err)
+	// The second call to the version command installs another package with the required
+	// OS and architecture, and we should then see two packages in the list.
+	require.Len(t, ctc.Tools, 2)
 }
 
 // TestParallelUpdate launches multiple updater commands in parallel while defining a new version.
@@ -92,33 +133,23 @@ func TestParallelUpdate(t *testing.T) {
 	t.Setenv(types.HomeEnvVar, t.TempDir())
 	ctx := context.Background()
 
-	// Initial fetch the updater binary un-archive and replace.
-	updater := tools.NewUpdater(
-		toolsDir,
-		testVersions[0],
-		tools.WithBaseURL(baseURL),
-	)
-	err := updater.Update(ctx, testVersions[0])
-	require.NoError(t, err)
-
-	// By setting the limit request next test http serving file going blocked until unlock is sent.
-	lock := make(chan struct{})
-	limitedWriter.SetLimitRequest(limitRequest{
-		limit: 1024,
-		lock:  lock,
-	})
+	tCtx, cancel := context.WithTimeout(ctx, time.Minute)
+	t.Cleanup(cancel)
 
+	// Spawn three parallel processes with an environment variable to request a version update.
+	// Only one process should initiate the update, while the other two must be locked and wait
+	// until the first process finishes downloading and unpacking the update.
 	outputs := make([]bytes.Buffer, 3)
 	errChan := make(chan error, 3)
-	for i := 0; i < len(outputs); i++ {
-		cmd := exec.Command(filepath.Join(toolsDir, "tsh"), "version")
+	for i := range outputs {
+		cmd := exec.CommandContext(tCtx, tshPath, "version")
 		cmd.Stdout = &outputs[i]
 		cmd.Stderr = &outputs[i]
 		cmd.Env = append(
 			os.Environ(),
 			fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
 		)
-		err = cmd.Start()
+		err := cmd.Start()
 		require.NoError(t, err, "failed to start updater")
 
 		go func(cmd *exec.Cmd) {
@@ -126,33 +157,20 @@ func TestParallelUpdate(t *testing.T) {
 		}(cmd)
 	}
 
-	select {
-	case err := <-errChan:
-		require.Fail(t, "we shouldn't receive any error", err)
-	case <-time.After(5 * time.Second):
-		require.Fail(t, "failed to wait till the download is started")
-	case <-lock:
-		// Wait for a short period to allow other processes to launch and attempt to acquire the lock.
-		time.Sleep(100 * time.Millisecond)
-		lock <- struct{}{}
-	}
-
 	// Wait till process finished with exit code 0, but we still should get progress
 	// bar in output content.
-	for i := 0; i < cap(outputs); i++ {
-		select {
-		case <-time.After(5 * time.Second):
-			require.Fail(t, "failed to wait till the process is finished")
-		case err := <-errChan:
-			require.NoError(t, err)
-		}
+	for range cap(outputs) {
+		require.NoError(t, <-errChan)
 	}
 
+	// Verify the output of all spawned processes to ensure that only one process
+	// indicates the client tools were updating. As a result, all outputs must show
+	// the updated version: the first process performs the update and re-executes,
+	// while the other two wait until the first process finishes before re-executing
+	// to the desired version.
 	var progressCount int
-	for i := 0; i < cap(outputs); i++ {
-		matches := pattern.FindStringSubmatch(outputs[i].String())
-		require.Len(t, matches, 2)
-		assert.Equal(t, testVersions[1], matches[1])
+	for i := range cap(outputs) {
+		matchVersion(t, outputs[i].String(), testVersions[1])
 		if strings.Contains(outputs[i].String(), "Update progress:") {
 			progressCount++
 		}
@@ -163,26 +181,16 @@ func TestParallelUpdate(t *testing.T) {
 // TestUpdateInterruptSignal verifies the interrupt signal send to the process must stop downloading.
 func TestUpdateInterruptSignal(t *testing.T) {
 	t.Setenv(types.HomeEnvVar, t.TempDir())
-	ctx := context.Background()
-
-	// Initial fetch the updater binary un-archive and replace.
-	updater := tools.NewUpdater(
-		toolsDir,
-		testVersions[0],
-		tools.WithBaseURL(baseURL),
-	)
-	err := updater.Update(ctx, testVersions[0])
-	require.NoError(t, err)
 
 	var output bytes.Buffer
-	cmd := exec.Command(filepath.Join(toolsDir, "tsh"), "version")
+	cmd := exec.Command(tshPath, "version")
 	cmd.Stdout = &output
 	cmd.Stderr = &output
 	cmd.Env = append(
 		os.Environ(),
 		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
 	)
-	err = cmd.Start()
+	err := cmd.Start()
 	require.NoError(t, err, "failed to start updater")
 	pid := cmd.Process.Pid
 
@@ -201,7 +209,7 @@ func TestUpdateInterruptSignal(t *testing.T) {
 	select {
 	case err := <-errChan:
 		require.Fail(t, "we shouldn't receive any error", err)
-	case <-time.After(5 * time.Second):
+	case <-time.After(10 * time.Second):
 		require.Fail(t, "failed to wait till the download is started")
 	case <-lock:
 		time.Sleep(100 * time.Millisecond)
@@ -212,7 +220,7 @@ func TestUpdateInterruptSignal(t *testing.T) {
 	// Wait till process finished with exit code 0, but we still should get progress
 	// bar in output content.
 	select {
-	case <-time.After(5 * time.Second):
+	case <-time.After(10 * time.Second):
 		require.Fail(t, "failed to wait till the process interrupted")
 	case err := <-errChan:
 		require.NoError(t, err)
@@ -228,18 +236,10 @@ func TestUpdateForOSSBuild(t *testing.T) {
 
 	// Enable OSS build.
 	t.Setenv(updater.TestBuild, modules.BuildOSS)
-
-	// Fetch compiled test binary with updater logic and install to $TELEPORT_HOME.
-	updater := tools.NewUpdater(
-		toolsDir,
-		testVersions[0],
-		tools.WithBaseURL(baseURL),
-	)
-	err := updater.Update(ctx, testVersions[0])
-	require.NoError(t, err)
+	t.Setenv(autoupdate.BaseURLEnvVar, "")
 
 	// Verify that requested update is ignored by OSS build and version wasn't updated.
-	cmd := exec.CommandContext(ctx, filepath.Join(toolsDir, "tsh"), "version")
+	cmd := exec.CommandContext(ctx, tshPath, "version")
 	cmd.Env = append(
 		os.Environ(),
 		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
@@ -247,13 +247,11 @@ func TestUpdateForOSSBuild(t *testing.T) {
 	out, err := cmd.Output()
 	require.NoError(t, err)
 
-	matches := pattern.FindStringSubmatch(string(out))
-	require.Len(t, matches, 2)
-	require.Equal(t, testVersions[0], matches[1])
+	matchVersion(t, string(out), testVersions[0])
 
 	// Next update is set with the base URL env variable, must download new version.
 	t.Setenv(autoupdate.BaseURLEnvVar, baseURL)
-	cmd = exec.CommandContext(ctx, filepath.Join(toolsDir, "tsh"), "version")
+	cmd = exec.CommandContext(ctx, tshPath, "version")
 	cmd.Env = append(
 		os.Environ(),
 		fmt.Sprintf("%s=%s", teleportToolsVersion, testVersions[1]),
@@ -261,7 +259,12 @@ func TestUpdateForOSSBuild(t *testing.T) {
 	out, err = cmd.Output()
 	require.NoError(t, err)
 
-	matches = pattern.FindStringSubmatch(string(out))
+	matchVersion(t, string(out), testVersions[1])
+}
+
+func matchVersion(t *testing.T, output string, version string) {
+	t.Helper()
+	matches := pattern.FindStringSubmatch(output)
 	require.Len(t, matches, 2)
-	require.Equal(t, testVersions[1], matches[1])
+	require.Equal(t, version, matches[1])
 }
diff --git a/integration/autoupdate/tools/updater_tsh_test.go b/integration/autoupdate/tools/updater_tsh_test.go
index 17816e34e4458..eafd687dd99ab 100644
--- a/integration/autoupdate/tools/updater_tsh_test.go
+++ b/integration/autoupdate/tools/updater_tsh_test.go
@@ -27,7 +27,9 @@ import (
 	"os/exec"
 	"path/filepath"
 	"testing"
+	"time"
 
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 
@@ -36,8 +38,10 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/autoupdate"
 	"github.com/gravitational/teleport/integration/autoupdate/tools/updater"
-	"github.com/gravitational/teleport/lib/autoupdate/tools"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
 )
@@ -45,107 +49,346 @@ import (
 // TestAliasLoginWithUpdater runs test cluster with enabled auto updates for client tools,
 // checks that defined alias in tsh configuration is replaced to the proper login command
 // and after auto update this not leads to recursive alias re-execution.
+//
+// # Managed updates: enabled.
+// $ tsh loginByAlias
+// $ tctl status
+// $ tsh version
+// Teleport v2.0.0
 func TestAliasLoginWithUpdater(t *testing.T) {
 	ctx := context.Background()
 
-	homeDir := filepath.Join(t.TempDir(), "home")
-	require.NoError(t, os.MkdirAll(homeDir, 0700))
-	installDir := filepath.Join(t.TempDir(), "local")
-	require.NoError(t, os.MkdirAll(installDir, 0700))
-
-	t.Setenv(types.HomeEnvVar, homeDir)
-
-	alice, err := types.NewUser("alice")
-	require.NoError(t, err)
-	alice.SetRoles([]string{"access"})
-
-	// Enable client tools auto updates and set the target version.
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
-			Mode: autoupdate.ToolsUpdateModeEnabled,
-		},
-	})
-	require.NoError(t, err)
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
-			TargetVersion: testVersions[1], // [v3.2.1]
-		},
-	})
-	require.NoError(t, err)
-
-	// Disable 2fa to simplify login for test.
-	ap, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
-		Type:         constants.Local,
-		SecondFactor: constants.SecondFactorOff,
-		Webauthn: &types.Webauthn{
-			RPID: "localhost",
-		},
-	})
-	require.NoError(t, err)
-
-	rootServer := testserver.MakeTestServer(t,
-		testserver.WithBootstrap(alice),
-		testserver.WithClusterName(t, "root"),
-		testserver.WithAuthPreference(ap),
-	)
-	authService := rootServer.GetAuthServer()
-	_, err = authService.UpsertAutoUpdateConfig(ctx, config)
-	require.NoError(t, err)
-	_, err = authService.UpsertAutoUpdateVersion(ctx, version)
-	require.NoError(t, err)
-	password, err := utils.CryptoRandomHex(6)
-	require.NoError(t, err)
-	t.Setenv(updater.TestPassword, password)
-	err = authService.UpsertPassword("alice", []byte(password))
-	require.NoError(t, err)
+	rootServer, homeDir := bootstrapTestServer(t)
+	setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeEnabled, testVersions[1])
 
 	// Assign alias to the login command for test cluster.
 	proxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
+
 	configPath := filepath.Join(homeDir, client.TSHConfigPath)
 	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0700))
-	executable := filepath.Join(installDir, "tsh")
 	out, err := yaml.Marshal(client.TSHConfig{
 		Aliases: map[string]string{
 			"loginalice": fmt.Sprintf(
 				"%s login --insecure --proxy %s --user alice --auth %s",
-				executable, proxyAddr, constants.LocalConnector,
+				tshPath, proxyAddr, constants.LocalConnector,
 			),
 		},
 	})
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(configPath, out, 0600))
 
-	// Fetch compiled test binary and install to tools dir [v1.2.3].
-	err = tools.NewUpdater(installDir, testVersions[0], tools.WithBaseURL(baseURL)).Update(ctx, testVersions[0])
-	require.NoError(t, err)
-
 	// Execute alias command which must be transformed to the login command.
 	// Since client tools autoupdates is enabled and target version is set
 	// in the test cluster, we have to update client tools to new version.
-	cmd := exec.CommandContext(ctx, executable, "loginalice")
+	cmd := exec.CommandContext(ctx, tshPath, "loginalice")
 	cmd.Env = os.Environ()
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	require.NoError(t, cmd.Run())
 
 	// Verify tctl status after login.
-	cmd = exec.CommandContext(ctx, filepath.Join(installDir, "tctl"), "status", "--insecure")
+	cmd = exec.CommandContext(ctx, tctlPath, "status", "--insecure")
 	cmd.Env = os.Environ()
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	require.NoError(t, cmd.Run())
 
 	// Run version command to verify that login command executed auto update and
-	// tsh was upgraded to [v3.2.1].
-	cmd = exec.CommandContext(ctx, executable, "version")
+	// tsh was upgraded to [v2.0.0].
+	cmd = exec.CommandContext(ctx, tshPath, "version")
 	out, err = cmd.Output()
 	require.NoError(t, err)
-
-	matches := pattern.FindStringSubmatch(string(out))
-	require.Len(t, matches, 2)
-	require.Equal(t, testVersions[1], matches[1])
+	matchVersion(t, string(out), testVersions[1])
 
 	// Verifies that version commands shows version re-executed from.
 	require.Contains(t, string(out), fmt.Sprintf("Re-executed from version: %s", testVersions[0]))
 }
+
+// TestSequentialUpdate runs test cluster with sequential changing version required for
+// client tools for managed updates. After each new login we should receive updated version.
+func TestSequentialUpdate(t *testing.T) {
+	ctx := context.Background()
+
+	rootServer, _ := bootstrapTestServer(t)
+
+	// Assign alias to the login command for test cluster.
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	for _, testVersion := range testVersions[1:] {
+		// Set cluster version to be upgraded.
+		setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeEnabled, testVersion)
+
+		cmd := exec.CommandContext(ctx, tshPath,
+			"login", "--proxy", proxyAddr.String(), "--insecure", "--user", "alice", "--auth", constants.LocalConnector)
+		cmd.Env = os.Environ()
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		require.NoError(t, cmd.Run())
+
+		// Run version command to verify that login command executed auto update and
+		// tsh was upgraded to [testVersion].
+		cmd = exec.CommandContext(ctx, tshPath, "version")
+		out, err := cmd.Output()
+		require.NoError(t, err)
+		matchVersion(t, string(out), testVersion)
+	}
+}
+
+// TestLoginWithUpdaterAndProfile runs test cluster with disabled managed updates for client tools,
+// verifies that if we set env variable during login we keep using updated version.
+//
+// # Managed updates: disabled.
+// $ TELEPORT_TOOLS_VERSION=2.0.0 tsh login --proxy proxy.example.com
+// # Check that created profile after login has enabled autoupdates flag.
+// $ tsh version
+// Teleport v2.0.0
+func TestLoginWithUpdaterAndProfile(t *testing.T) {
+	ctx := context.Background()
+
+	rootServer, _ := bootstrapTestServer(t)
+	setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeDisabled, testVersions[1])
+
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// First login with set version during login process
+	t.Setenv("TELEPORT_TOOLS_VERSION", testVersions[1])
+	cmd := exec.CommandContext(ctx, tshPath,
+		"login", "--proxy", proxyAddr.String(), "--insecure", "--user", "alice", "--auth", constants.LocalConnector)
+	cmd.Env = os.Environ()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	require.NoError(t, cmd.Run())
+	// Unset the version after update process.
+	require.NoError(t, os.Unsetenv("TELEPORT_TOOLS_VERSION"))
+
+	// Run version command to verify that login command executed auto update and
+	// tsh was upgraded to [v2.0.0].
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	matchVersion(t, string(out), testVersions[1])
+}
+
+// TestLoginWithDisabledUpdateInProfile runs test cluster with enabled managed updates for client tools,
+// verifies that after first update and disabling.
+//
+// # Managed updates: disabled.
+// $ TELEPORT_TOOLS_VERSION=2.0.0 tsh version
+// Teleport v2.0.0
+// $ tsh login --proxy proxy.example.com
+// $ tsh version
+// Teleport v1.0.0
+func TestLoginWithDisabledUpdateInProfile(t *testing.T) {
+	ctx := context.Background()
+
+	rootServer, _ := bootstrapTestServer(t)
+	setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeDisabled, testVersions[1])
+
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Set env variable to forcibly request update on version command.
+	t.Setenv("TELEPORT_TOOLS_VERSION", testVersions[1])
+	cmd := exec.CommandContext(ctx, tshPath, "version")
+	cmd.Env = os.Environ()
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	// Check the version.
+	matchVersion(t, string(out), testVersions[1])
+	// Unset the version after update process.
+	require.NoError(t, os.Unsetenv("TELEPORT_TOOLS_VERSION"))
+
+	// Second login has to update profile and disable further managed updates.
+	cmd = exec.CommandContext(ctx, tshPath,
+		"login", "--proxy", proxyAddr.String(), "--insecure", "--user", "alice", "--auth", constants.LocalConnector)
+	cmd.Env = os.Environ()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	require.NoError(t, cmd.Run())
+
+	// Run version command to verify that login command executed auto update and
+	// tsh was upgraded to [v2.0.0].
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	out, err = cmd.Output()
+	require.NoError(t, err)
+	// Check the version.
+	matchVersion(t, string(out), testVersions[0])
+}
+
+// TestLoginWithDisabledUpdateForcedByEnv verifies that on disabled cluster we are still
+// able to update client tools by always setting the environment variable.
+//
+// # Managed updates: disabled.
+// $ tsh login --proxy proxy.example.com
+// $ TELEPORT_TOOLS_VERSION=2.0.0 tsh version
+// Teleport v2.0.0
+// $ tsh version
+// Teleport v1.0.0
+func TestLoginWithDisabledUpdateForcedByEnv(t *testing.T) {
+	ctx := context.Background()
+
+	rootServer, _ := bootstrapTestServer(t)
+	setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeDisabled, testVersions[1])
+
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Second login has to update profile and disable further managed updates.
+	cmd := exec.CommandContext(ctx, tshPath,
+		"login", "--proxy", proxyAddr.String(), "--insecure", "--user", "alice", "--auth", constants.LocalConnector)
+	cmd.Env = os.Environ()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	require.NoError(t, cmd.Run())
+
+	// Trying to forcibly use specific version not during login.
+	t.Setenv("TELEPORT_TOOLS_VERSION", testVersions[1])
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	cmd.Env = os.Environ()
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	// Check that version is used that requested from env variable.
+	matchVersion(t, string(out), testVersions[1])
+	// Unset the version after update process.
+	require.NoError(t, os.Unsetenv("TELEPORT_TOOLS_VERSION"))
+
+	// Run version command to verify that login command executed auto update and
+	// tsh is version [v1.0.0] since it was requested not during login and cluster
+	// has disabled managed updates.
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	out, err = cmd.Output()
+	require.NoError(t, err)
+	matchVersion(t, string(out), testVersions[0])
+}
+
+// TestMigratedUpdateNotReExec verifies that the version is migrated without errors,
+// and that the previous version of the updated tools is ignored.
+func TestMigratedUpdateNotReExec(t *testing.T) {
+	testToolsDir := t.TempDir()
+	t.Setenv(types.HomeEnvVar, testToolsDir)
+	ctx := context.Background()
+
+	require.NoError(t, os.MkdirAll(filepath.Join(testToolsDir, "bin"), 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(testToolsDir, "bin", "tsh"), []byte("#!/bin/sh\n echo 'Teleport v5.5.5 git'\n"), 0755))
+
+	// Verify that the installed version is equal to requested one.
+	cmd := exec.CommandContext(ctx, tshPath, "version")
+	out, err := cmd.Output()
+	require.NoError(t, err)
+
+	require.NotContains(t, string(out), "version check failed")
+
+	matchVersion(t, string(out), testVersions[0])
+}
+
+// TestUpdateConfigReExecPath verifies that after update and re-execution we preserve the original
+// path of the executed binary, because `tsh config` is referencing this path for execution.
+func TestUpdateConfigReExecPath(t *testing.T) {
+	t.Setenv(types.HomeEnvVar, t.TempDir())
+	ctx := context.Background()
+
+	rootServer, _ := bootstrapTestServer(t)
+	setupManagedUpdates(t, rootServer.GetAuthServer(), autoupdate.ToolsUpdateModeEnabled, testVersions[1])
+
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	cmd := exec.CommandContext(ctx, tshPath,
+		"login", "--proxy", proxyAddr.String(), "--insecure", "--user", "alice", "--auth", constants.LocalConnector)
+	cmd.Env = os.Environ()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	require.NoError(t, cmd.Run())
+
+	// Execute version command again with setting the new version which must
+	// trigger re-execution of the same command after downloading requested version.
+	cmd = exec.CommandContext(ctx, tshPath, "version")
+	cmd.Env = os.Environ()
+	out, err := cmd.Output()
+	require.NoError(t, err)
+
+	matchVersion(t, string(out), testVersions[1])
+
+	cmd = exec.CommandContext(ctx, tshPath, "config", "--proxy", proxyAddr.String(), "--insecure")
+	cmd.Env = os.Environ()
+	out, err = cmd.Output()
+	require.NoError(t, err)
+
+	// Ensure that original path of tsh before update is present in configuration generated by
+	// config command.
+	require.Contains(t, string(out), `ProxyCommand "`+tshPath+`" `)
+}
+
+func bootstrapTestServer(t *testing.T) (*service.TeleportProcess, string) {
+	t.Helper()
+	homeDir := filepath.Join(t.TempDir(), "home")
+	require.NoError(t, os.MkdirAll(homeDir, 0700))
+
+	t.Setenv(types.HomeEnvVar, homeDir)
+
+	alice, err := types.NewUser("alice")
+	require.NoError(t, err)
+	alice.SetRoles([]string{"access"})
+
+	// Disable 2fa to simplify login for test.
+	ap, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
+		Type:         constants.Local,
+		SecondFactor: constants.SecondFactorOff,
+		Webauthn: &types.Webauthn{
+			RPID: "localhost",
+		},
+	})
+	require.NoError(t, err)
+
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(),
+		testserver.WithBootstrap(alice),
+		testserver.WithClusterName("root"),
+		testserver.WithAuthPreference(ap),
+		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Clock = clockwork.NewFakeClock()
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
+
+	authService := rootServer.GetAuthServer()
+
+	// Set password for the cluster login.
+	password, err := utils.CryptoRandomHex(6)
+	require.NoError(t, err)
+	t.Setenv(updater.TestPassword, password)
+	err = authService.UpsertPassword("alice", []byte(password))
+	require.NoError(t, err)
+
+	return rootServer, homeDir
+}
+
+func setupManagedUpdates(t *testing.T, server *auth.Server, muMode string, muVersion string) {
+	t.Helper()
+	ctx := context.Background()
+	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
+		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+			Mode: muMode,
+		},
+	})
+	require.NoError(t, err)
+	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
+		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+			TargetVersion: muVersion,
+		},
+	})
+	require.NoError(t, err)
+	_, err = server.UpsertAutoUpdateConfig(ctx, config)
+	require.NoError(t, err)
+	_, err = server.UpsertAutoUpdateVersion(ctx, version)
+	require.NoError(t, err)
+
+	// Expire the fn cache to force the next answer to be fresh.
+	server.GetClock().(*clockwork.FakeClock).Advance(20 * time.Second)
+}
diff --git a/integration/client_test.go b/integration/client_test.go
index c9ae4d4129abc..826676e588ba7 100644
--- a/integration/client_test.go
+++ b/integration/client_test.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestClientWithExpiredCredentialsAndDetailedErrorMessage creates and connects to the Auth service
@@ -41,7 +41,7 @@ func TestClientWithExpiredCredentialsAndDetailedErrorMessage(t *testing.T) {
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
diff --git a/integration/conntest/database_test.go b/integration/conntest/database_test.go
index b613879088f55..8b5f070dfda7d 100644
--- a/integration/conntest/database_test.go
+++ b/integration/conntest/database_test.go
@@ -224,7 +224,7 @@ func TestDiagnoseConnectionForPostgresDatabases(t *testing.T) {
 				DialTimeout:        time.Second,
 				InsecureSkipVerify: true,
 			}
-			respStatusCode, respBody := webPack.DoRequest(t, http.MethodPost, diagnoseConnectionEndpoint, diagnoseReq)
+			respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodPost, diagnoseConnectionEndpoint, diagnoseReq)
 			require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 			var connectionDiagnostic ui.ConnectionDiagnostic
@@ -310,7 +310,7 @@ func TestDiagnoseConnectionForPostgresDatabases(t *testing.T) {
 			TOTPCode: validToken,
 		},
 	}
-	respStatusCode, respBody := webPack.DoRequest(t, http.MethodPost, diagnoseConnectionEndpoint, diagnoseReq)
+	respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodPost, diagnoseConnectionEndpoint, diagnoseReq)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	var connectionDiagnostic ui.ConnectionDiagnostic
diff --git a/integration/db/database_service_test.go b/integration/db/database_service_test.go
index e83ecd8aa77a5..01398ac3f0328 100644
--- a/integration/db/database_service_test.go
+++ b/integration/db/database_service_test.go
@@ -90,7 +90,7 @@ func TestDatabaseServiceHeartbeat(t *testing.T) {
 
 	// List Database Services
 	listDBServicesEndpoint := strings.Join([]string{"sites", "$site", "databaseservices"}, "/")
-	respStatusCode, respBody := webPack.DoRequest(t, http.MethodGet, listDBServicesEndpoint, nil)
+	respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodGet, listDBServicesEndpoint, nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	var listResp listDatabaseServicesResp
diff --git a/integration/db/db_integration_test.go b/integration/db/db_integration_test.go
index bac905afdb65a..bee9bed7ddc29 100644
--- a/integration/db/db_integration_test.go
+++ b/integration/db/db_integration_test.go
@@ -31,6 +31,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/mongo"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
@@ -39,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db"
@@ -100,7 +102,7 @@ func TestDatabaseAccessSeparateListeners(t *testing.T) {
 // testIPPinning tests a scenario where a user with IP pinning
 // connects to a database
 func (p *DatabasePack) testIPPinning(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -356,9 +358,8 @@ func (p *DatabasePack) testMongoRootCluster(t *testing.T) {
 // testMongoConnectionCount tests if mongo service releases
 // resource after a mongo client disconnect.
 func (p *DatabasePack) testMongoConnectionCount(t *testing.T) {
-	connectMongoClient := func(t *testing.T) (serverConnectionCount int32) {
-		// Connect to the database service in root cluster.
-		client, err := mongodb.MakeTestClient(context.Background(), common.TestClientConfig{
+	makeClient := func(t *testing.T, dbUser string) (*mongo.Client, error) {
+		return mongodb.MakeTestClient(t.Context(), common.TestClientConfig{
 			AuthClient: p.Root.Cluster.GetSiteAPI(p.Root.Cluster.Secrets.SiteName),
 			AuthServer: p.Root.Cluster.Process.GetAuthServer(),
 			Address:    p.Root.Cluster.Web,
@@ -367,27 +368,31 @@ func (p *DatabasePack) testMongoConnectionCount(t *testing.T) {
 			RouteToDatabase: tlsca.RouteToDatabase{
 				ServiceName: p.Root.MongoService.Name,
 				Protocol:    p.Root.MongoService.Protocol,
-				Username:    "admin",
+				Username:    dbUser,
 			},
 		})
+	}
+
+	connectMongoClient := func(t *testing.T, dbUser string) (serverConnectionCount int32) {
+		client, err := makeClient(t, dbUser)
 		require.NoError(t, err)
 
 		// Execute a query.
-		_, err = client.Database("test").Collection("test").Find(context.Background(), bson.M{})
+		_, err = client.Database("test").Collection("test").Find(t.Context(), bson.M{})
 		require.NoError(t, err)
 
 		// Get a server connection count before disconnect.
 		serverConnectionCount = p.Root.mongo.GetActiveConnectionsCount()
 
 		// Disconnect.
-		err = client.Disconnect(context.Background())
+		err = client.Disconnect(t.Context())
 		require.NoError(t, err)
 
 		return serverConnectionCount
 	}
 
 	// Get connection count while the first client is connected.
-	initialConnectionCount := connectMongoClient(t)
+	initialConnectionCount := connectMongoClient(t, "admin")
 
 	// Check if active connections count is not growing over time when new
 	// clients connect to the mongo server.
@@ -395,22 +400,41 @@ func (p *DatabasePack) testMongoConnectionCount(t *testing.T) {
 	for i := 0; i < clientCount; i++ {
 		// Note that connection count per client fluctuates between 6 and 9.
 		// Use InDelta to avoid flaky test.
-		require.InDelta(t, initialConnectionCount, connectMongoClient(t), 3)
+		got := connectMongoClient(t, "admin")
+		require.InDelta(t, initialConnectionCount, got, 3)
+	}
+
+	client, err := makeClient(t, "nonexistent")
+	if !assert.Error(t, err) {
+		require.NoError(t, client.Disconnect(t.Context()))
+		return
 	}
+	require.ErrorContains(t, err, "does not exist")
 
 	// Wait until the server reports no more connections. This usually happens
 	// really quick but wait a little longer just in case.
-	waitUntilNoConnections := func() bool {
-		return p.Root.mongo.GetActiveConnectionsCount() == 0
-	}
-	require.Eventually(t, waitUntilNoConnections, 5*time.Second, 100*time.Millisecond)
+	var activeConns int32
+	require.Eventually(t, func() bool {
+		conns := p.Root.mongo.GetActiveConnectionsCount()
+		if conns != activeConns {
+			t.Logf("active connections to MongoDB changed from %d to %d", activeConns, conns)
+			activeConns = conns
+		}
+		return activeConns == 0
+	}, 5*time.Second, 100*time.Millisecond)
+
+	start := time.Now()
+	require.Never(t, func() bool {
+		return p.Root.mongo.GetActiveConnectionsCount() > 0
+	}, time.Second*5, time.Millisecond*100, "no connections should be left open. Found after %v", time.Since(start))
 }
 
 // testMongoLeafCluster tests a scenario where a user connects
 // to a Mongo database running in a leaf cluster.
 func (p *DatabasePack) testMongoLeafCluster(t *testing.T) {
+	ctx := t.Context()
 	// Connect to the database service in root cluster.
-	client, err := mongodb.MakeTestClient(context.Background(), common.TestClientConfig{
+	client, err := mongodb.MakeTestClient(ctx, common.TestClientConfig{
 		AuthClient: p.Root.Cluster.GetSiteAPI(p.Root.Cluster.Secrets.SiteName),
 		AuthServer: p.Root.Cluster.Process.GetAuthServer(),
 		Address:    p.Root.Cluster.Web, // Connecting via root cluster.
@@ -425,11 +449,11 @@ func (p *DatabasePack) testMongoLeafCluster(t *testing.T) {
 	require.NoError(t, err)
 
 	// Execute a query.
-	_, err = client.Database("test").Collection("test").Find(context.Background(), bson.M{})
+	_, err = client.Database("test").Collection("test").Find(ctx, bson.M{})
 	require.NoError(t, err)
 
 	// Disconnect.
-	err = client.Disconnect(context.Background())
+	err = client.Disconnect(ctx)
 	require.NoError(t, err)
 }
 
diff --git a/integration/db/fixture.go b/integration/db/fixture.go
index 855252e8352fa..6bcd37ba6cf70 100644
--- a/integration/db/fixture.go
+++ b/integration/db/fixture.go
@@ -28,6 +28,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
@@ -36,8 +37,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
@@ -51,6 +52,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type DatabasePack struct {
@@ -95,6 +97,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 	var err error
 
 	var postgresListener, mysqlListener, mongoListener, cassandaListener net.Listener
+	var dbProcessUUID string
 
 	postgresListener, pack.postgresAddr = mustListen(t)
 	pack.PostgresService = servicecfg.Database{
@@ -114,7 +117,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 	pack.MongoService = servicecfg.Database{
 		Name:     fmt.Sprintf("%s-mongo", pack.name),
 		Protocol: defaults.ProtocolMongoDB,
-		URI:      pack.mongoAddr,
+		URI:      fmt.Sprintf("mongodb://%s/?heartbeatintervalms=500", pack.mongoAddr),
 	}
 
 	cassandaListener, pack.cassandraAddr = mustListen(t)
@@ -142,7 +145,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 	}
 	conf.Clock = clock
 	conf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	pack.dbProcess, pack.dbAuthClient, err = pack.Cluster.StartDatabase(conf)
+	pack.dbProcess, pack.dbAuthClient, dbProcessUUID, err = pack.Cluster.StartDatabase(conf)
 	require.NoError(t, err)
 
 	t.Cleanup(func() { require.NoError(t, pack.dbProcess.Close()) })
@@ -172,7 +175,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 		AuthClient: pack.dbAuthClient,
 		Name:       pack.MongoService.Name,
 		Listener:   mongoListener,
-	})
+	}, mongodb.TestServerSetFakeUserAuthError("nonexistent", trace.NotFound("user does not exist")))
 	require.NoError(t, err)
 	go pack.mongo.Serve()
 	t.Cleanup(func() { pack.mongo.Close() })
@@ -186,6 +189,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 	go pack.cassandra.Serve()
 	t.Cleanup(func() { pack.cassandra.Close() })
 
+	helpers.WaitForDatabaseService(t, pack.Cluster.Process.GetAuthServer(), dbProcessUUID)
 	helpers.WaitForDatabaseServers(t, pack.Cluster.Process.GetAuthServer(), conf.Databases.Databases)
 }
 
@@ -253,7 +257,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 	tracer := utils.NewTracer(utils.ThisFunction()).Start()
 	t.Cleanup(func() { tracer.Stop() })
 	lib.SetInsecureDevMode(true)
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Generate keypair.
 	privateKey, publicKey, err := testauthority.New().GenerateKeyPair()
@@ -336,6 +340,14 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 	// Setup users and roles on both clusters.
 	p.setupUsersAndRoles(t)
 
+	// disable health checks to reduce log noise during tests
+	defaultHCC := services.VirtualDefaultHealthCheckConfigDB()
+	defaultHCC.GetSpec().GetMatch().Disabled = true
+	_, err = p.Root.Cluster.Process.GetAuthServer().UpsertHealthCheckConfig(ctx, defaultHCC)
+	require.NoError(t, err)
+	_, err = p.Leaf.Cluster.Process.GetAuthServer().UpsertHealthCheckConfig(ctx, defaultHCC)
+	require.NoError(t, err)
+
 	// Update root's certificate authority on leaf to configure role mapping.
 	ca, err := p.Leaf.Cluster.Process.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
@@ -358,7 +370,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 func (p *DatabasePack) setupUsersAndRoles(t *testing.T) {
 	var err error
 
-	p.Root.User, p.Root.role, err = auth.CreateUserAndRole(p.Root.Cluster.Process.GetAuthServer(), "root-user", nil, nil)
+	p.Root.User, p.Root.role, err = authtest.CreateUserAndRole(p.Root.Cluster.Process.GetAuthServer(), "root-user", nil, nil)
 	require.NoError(t, err)
 
 	p.Root.role.SetDatabaseUsers(types.Allow, []string{types.Wildcard})
@@ -366,7 +378,7 @@ func (p *DatabasePack) setupUsersAndRoles(t *testing.T) {
 	p.Root.role, err = p.Root.Cluster.Process.GetAuthServer().UpsertRole(context.Background(), p.Root.role)
 	require.NoError(t, err)
 
-	p.Leaf.User, p.Leaf.role, err = auth.CreateUserAndRole(p.Root.Cluster.Process.GetAuthServer(), "leaf-user", nil, nil)
+	p.Leaf.User, p.Leaf.role, err = authtest.CreateUserAndRole(p.Root.Cluster.Process.GetAuthServer(), "leaf-user", nil, nil)
 	require.NoError(t, err)
 
 	p.Leaf.role.SetDatabaseUsers(types.Allow, []string{types.Wildcard})
@@ -377,10 +389,10 @@ func (p *DatabasePack) setupUsersAndRoles(t *testing.T) {
 
 func (p *DatabasePack) WaitForLeaf(t *testing.T) {
 	helpers.WaitForProxyCount(p.Leaf.Cluster, p.Root.Cluster.Secrets.SiteName, 1)
-	site, err := p.Root.Cluster.Tunnel.GetSite(p.Leaf.Cluster.Secrets.SiteName)
+	cluster, err := p.Root.Cluster.Tunnel.Cluster(t.Context(), p.Leaf.Cluster.Secrets.SiteName)
 	require.NoError(t, err)
 
-	accessPoint, err := site.CachingAccessPoint()
+	accessPoint, err := cluster.CachingAccessPoint()
 	require.NoError(t, err)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
@@ -441,12 +453,13 @@ func (p *DatabasePack) startRootDatabaseAgent(t *testing.T, params databaseAgent
 	conf.Databases.ResourceMatchers = params.resourceMatchers
 	conf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 
-	server, authClient, err := p.Root.Cluster.StartDatabase(conf)
+	server, authClient, hostUUID, err := p.Root.Cluster.StartDatabase(conf)
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		server.Close()
 	})
 
+	helpers.WaitForDatabaseService(t, p.Root.Cluster.Process.GetAuthServer(), hostUUID)
 	helpers.WaitForDatabaseServers(t, p.Root.Cluster.Process.GetAuthServer(), conf.Databases.Databases)
 	return server, authClient
 }
diff --git a/integration/ec2_test.go b/integration/ec2_test.go
index b778729ab113b..81fc6adab6bbd 100644
--- a/integration/ec2_test.go
+++ b/integration/ec2_test.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/backend"
@@ -46,6 +47,7 @@ import (
 	cloudimds "github.com/gravitational/teleport/lib/cloud/imds"
 	cloudaws "github.com/gravitational/teleport/lib/cloud/imds/aws"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -67,6 +69,7 @@ func newNodeConfig(t *testing.T, tokenName string, joinMethod types.JoinMethod)
 	config.Logger = slog.New(slog.DiscardHandler)
 	config.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	config.InstanceMetadataClient = cloudimds.NewDisabledIMDSClient()
+	config.DebugService.Enabled = false
 	return config
 }
 
@@ -77,6 +80,7 @@ func newProxyConfig(t *testing.T, authAddr utils.NetAddr, tokenName string, join
 	config.JoinMethod = joinMethod
 	config.SSH.Enabled = false
 	config.Auth.Enabled = false
+	config.DebugService.Enabled = false
 
 	proxyAddr := helpers.NewListener(t, service.ListenerProxyWeb, &config.FileDescriptors)
 	config.Proxy.Enabled = true
@@ -122,6 +126,7 @@ func newAuthConfig(t *testing.T, clock clockwork.Clock) *servicecfg.Config {
 	config.Logger = slog.New(slog.DiscardHandler)
 	config.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	config.InstanceMetadataClient = cloudimds.NewDisabledIMDSClient()
+	config.DebugService.Enabled = false
 	return config
 }
 
@@ -257,7 +262,7 @@ func TestIAMNodeJoin(t *testing.T) {
 	require.NoError(t, err)
 
 	// sanity check there are no proxies to start with
-	proxies, err := authServer.GetProxies()
+	proxies, err := stream.Collect(clientutils.Resources(ctx, authServer.ListProxyServers))
 	require.NoError(t, err)
 	require.Empty(t, proxies)
 
@@ -271,7 +276,7 @@ func TestIAMNodeJoin(t *testing.T) {
 
 	// the proxy should eventually join the cluster and heartbeat
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		proxies, err := authServer.GetProxies()
+		proxies, err := stream.Collect(clientutils.Resources(ctx, authServer.ListProxyServers))
 		assert.NoError(t, err)
 		assert.NotEmpty(t, proxies)
 	}, 10*time.Second, 50*time.Millisecond, "waiting for proxy to join cluster")
diff --git a/integration/helpers/archive/packaging.go b/integration/helpers/archive/packaging.go
index ee237749115a3..e14b385960b83 100644
--- a/integration/helpers/archive/packaging.go
+++ b/integration/helpers/archive/packaging.go
@@ -35,9 +35,28 @@ import (
 	"github.com/gravitational/teleport"
 )
 
+// Option configures compression behavior.
+type Option func(*options)
+
+type options struct {
+	noCompress bool
+}
+
+// WithNoCompress disables compression.
+func WithNoCompress() Option {
+	return func(o *options) {
+		o.noCompress = true
+	}
+}
+
 // CompressDirToZipFile compresses a source directory into `.zip` format and stores at `archivePath`,
 // preserving the relative file path structure of the source directory.
-func CompressDirToZipFile(ctx context.Context, sourceDir, archivePath string) (err error) {
+func CompressDirToZipFile(ctx context.Context, sourceDir, archivePath string, opts ...Option) (err error) {
+	o := &options{}
+	for _, opt := range opts {
+		opt(o)
+	}
+
 	archive, err := os.Create(archivePath)
 	if err != nil {
 		return trace.Wrap(err)
@@ -71,7 +90,16 @@ func CompressDirToZipFile(ctx context.Context, sourceDir, archivePath string) (e
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		zipFileWriter, err := zipWriter.Create(relPath)
+		header, err := zip.FileInfoHeader(info)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		header.Name = relPath
+		header.Method = zip.Deflate
+		if o.noCompress {
+			header.Method = zip.Store
+		}
+		zipFileWriter, err := zipWriter.CreateHeader(header)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -92,7 +120,12 @@ func CompressDirToZipFile(ctx context.Context, sourceDir, archivePath string) (e
 
 // CompressDirToTarGzFile compresses a source directory into .tar.gz format and stores at `archivePath`,
 // preserving the relative file path structure of the source directory.
-func CompressDirToTarGzFile(ctx context.Context, sourceDir, archivePath string) (err error) {
+func CompressDirToTarGzFile(ctx context.Context, sourceDir, archivePath string, opts ...Option) (err error) {
+	o := &options{}
+	for _, opt := range opts {
+		opt(o)
+	}
+
 	archive, err := os.Create(archivePath)
 	if err != nil {
 		return trace.Wrap(err)
@@ -108,7 +141,14 @@ func CompressDirToTarGzFile(ctx context.Context, sourceDir, archivePath string)
 			}
 		}
 	}()
-	gzipWriter := gzip.NewWriter(archive)
+	level := gzip.DefaultCompression
+	if o.noCompress {
+		level = gzip.NoCompression
+	}
+	gzipWriter, err := gzip.NewWriterLevel(archive, level)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 	tarWriter := tar.NewWriter(gzipWriter)
 	err = filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
diff --git a/integration/helpers/helpers.go b/integration/helpers/helpers.go
index 170e2d161c287..4c0723d3897a1 100644
--- a/integration/helpers/helpers.go
+++ b/integration/helpers/helpers.go
@@ -27,6 +27,7 @@ import (
 	"os/exec"
 	"os/user"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -61,8 +62,9 @@ import (
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // CommandOptions controls how the SSH command is built.
@@ -140,7 +142,7 @@ func ExternalSSHCommand(o CommandOptions) (*exec.Cmd, error) {
 
 // CreateAgent creates a SSH agent with the passed in key ring that can be used
 // in tests. This is useful so tests don't clobber your system agent.
-func CreateAgent(keyRing *client.KeyRing) (*teleagent.AgentServer, string, string, error) {
+func CreateAgent(keyRing *client.KeyRing) (*sshagent.Server, string, string, error) {
 	// create a path to the unix socket
 	sockDirName := "int-test"
 	sockName := "agent.sock"
@@ -160,22 +162,20 @@ func CreateAgent(keyRing *client.KeyRing) (*teleagent.AgentServer, string, strin
 		return nil, "", "", trace.Wrap(err)
 	}
 
-	teleAgent := teleagent.NewServer(func() (teleagent.Agent, error) {
-		return teleagent.NopCloser(keyring), nil
-	})
+	agentServer := sshagent.NewServer(sshagent.NewStaticClientGetter(keyring))
 
 	// start the SSH agent
-	err = teleAgent.ListenUnixSocket(sockDirName, sockName, nil)
+	err = agentServer.ListenUnixSocket(sockDirName, sockName, nil)
 	if err != nil {
 		return nil, "", "", trace.Wrap(err)
 	}
-	go teleAgent.Serve()
+	go agentServer.Serve()
 
-	return teleAgent, teleAgent.Dir, teleAgent.Path, nil
+	return agentServer, agentServer.Dir, agentServer.Path, nil
 }
 
-func CloseAgent(teleAgent *teleagent.AgentServer, socketDirPath string) error {
-	err := teleAgent.Close()
+func CloseAgent(agent *sshagent.Server, socketDirPath string) error {
+	err := agent.Close()
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -206,7 +206,7 @@ func mustCreateUserKeyRingWithKeys(t *testing.T, tc *TeleInstance, username stri
 
 	tlsPub, err := keys.MarshalPublicKey(tlsKey.Public())
 	require.NoError(t, err)
-	sshCert, tlsCert, err := tc.Process.GetAuthServer().GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+	sshCert, tlsCert, err := tc.Process.GetAuthServer().GenerateUserTestCertsWithContext(t.Context(), auth.GenerateUserTestCertsRequest{
 		SSHPubKey:      keyRing.SSHPrivateKey.MarshalSSHPublicKey(),
 		TLSPubKey:      tlsPub,
 		Username:       username,
@@ -334,6 +334,23 @@ func WaitForDatabaseServers(t *testing.T, authServer *auth.Server, dbs []service
 	}
 }
 
+// WaitForDatabaseService waits until the database service heartbeat appears in
+// Auth. This is useful when the database service only listens for dynamic
+// resources without static databases, which makes WaitForDatabaseServers
+// unreliable for determining readiness.
+func WaitForDatabaseService(t *testing.T, authServer *auth.Server, hostUUID string) {
+	t.Helper()
+
+	ctx := t.Context()
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		resp, err := authServer.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindDatabaseService,
+		})
+		require.NoError(t, err)
+		require.Contains(t, slices.Collect(types.ResourceNames(resp.Resources)), hostUUID)
+	}, 10*time.Second, 200*time.Millisecond, "database service not started")
+}
+
 // CreatePROXYEnabledListener creates net.Listener that can handle receiving signed PROXY headers
 func CreatePROXYEnabledListener(ctx context.Context, t *testing.T, address string, caGetter multiplexer.CertAuthorityGetter, clusterName string) (net.Listener, error) {
 	t.Helper()
@@ -360,6 +377,7 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic
 	// We need this to get a random port assigned to it and allow parallel
 	// execution of this test.
 	cfg := servicecfg.MakeDefaultConfig()
+	cfg.DebugService.Enabled = false
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	cfg.Hostname = "localhost"
@@ -379,7 +397,7 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic
 	cfg.SSH.Enabled = false
 	cfg.Auth.Enabled = true
 	cfg.Proxy.Enabled = false
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 
 	auth, err = service.NewTeleport(cfg)
 	require.NoError(t, err)
@@ -401,6 +419,7 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic
 
 	// Set up a test proxy service.
 	cfg = servicecfg.MakeDefaultConfig()
+	cfg.DebugService.Enabled = false
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	cfg.Hostname = "localhost"
@@ -417,7 +436,7 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic
 		cfg.Proxy.WebAddr,
 	}
 	cfg.Proxy.DisableWebInterface = true
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 
 	proxy, err = service.NewTeleport(cfg)
 	require.NoError(t, err)
@@ -442,6 +461,7 @@ func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string,
 	lib.SetInsecureDevMode(true)
 
 	cfg := servicecfg.MakeDefaultConfig()
+	cfg.DebugService.Enabled = false
 	cfg.Hostname = "localhost"
 	cfg.DataDir = t.TempDir()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
@@ -454,7 +474,7 @@ func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string,
 	cfg.Databases.Enabled = true
 	cfg.Databases.Databases = dbs
 	cfg.Databases.ResourceMatchers = resMatchers
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 
 	db, err := service.NewTeleport(cfg)
 	require.NoError(t, err)
@@ -487,7 +507,7 @@ func MakeAgentServer(t *testing.T, cfg *servicecfg.Config, proxyAddr utils.NetAd
 	cfg.Auth.Enabled = false
 	cfg.Proxy.Enabled = false
 	cfg.Databases.Enabled = false
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 
 	agent, err := service.NewTeleport(cfg)
 	require.NoError(t, err)
diff --git a/integration/helpers/instance.go b/integration/helpers/instance.go
index 23e9d9a1aff44..7a350b6e54c05 100644
--- a/integration/helpers/instance.go
+++ b/integration/helpers/instance.go
@@ -457,18 +457,18 @@ func NewInstance(t *testing.T, cfg InstanceConfig) *TeleInstance {
 // GetSiteAPI is a helper which returns an API endpoint to a site with
 // a given name. i endpoint implements HTTP-over-SSH access to the
 // site's auth server.
-func (i *TeleInstance) GetSiteAPI(siteName string) authclient.ClientI {
-	siteTunnel, err := i.Tunnel.GetSite(siteName)
+func (i *TeleInstance) GetSiteAPI(clusterName string) authclient.ClientI {
+	cluster, err := i.Tunnel.Cluster(context.Background(), clusterName)
 	if err != nil {
-		i.Log.WarnContext(context.Background(), "failed to get site", "error", err, "siter", siteName)
+		i.Log.WarnContext(context.Background(), "failed to get site", "error", err, "cluster", clusterName)
 		return nil
 	}
-	siteAPI, err := siteTunnel.GetClient()
+	clusterClient, err := cluster.GetClient()
 	if err != nil {
-		i.Log.WarnContext(context.Background(), "failed to get site client", "error", err, "site", siteName)
+		i.Log.WarnContext(context.Background(), "failed to get site client", "error", err, "cluster", clusterName)
 		return nil
 	}
-	return siteAPI
+	return clusterClient
 }
 
 // Create creates a new instance of Teleport which trusts a list of other clusters (other
@@ -555,7 +555,6 @@ func (i *TeleInstance) GenerateConfig(t *testing.T, trustedSecrets []*InstanceSe
 			tconf.ReverseTunnels = []types.ReverseTunnel{rt}
 		}
 	}
-	tconf.HostUUID = i.Secrets.GetIdentity().ID.HostUUID
 	tconf.SSH.Addr.Addr = i.SSH
 	tconf.SSH.PublicAddrs = []utils.NetAddr{
 		{
@@ -623,7 +622,7 @@ func (i *TeleInstance) GenerateConfig(t *testing.T, trustedSecrets []*InstanceSe
 	tconf.Kube.CheckImpersonationPermissions = nullImpersonationCheck
 
 	tconf.Keygen = testauthority.New()
-	tconf.MaxRetryPeriod = defaults.HighResPollingPeriod
+	tconf.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(defaults.HighResPollingPeriod)
 	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	tconf.FileDescriptors = append(tconf.FileDescriptors, i.Fds...)
 
@@ -661,7 +660,7 @@ func (i *TeleInstance) createTeleportProcess(tconf *servicecfg.Config) (*service
 }
 
 // CreateWithConf creates a new instance of Teleport using the supplied config
-func (i *TeleInstance) CreateWithConf(_ *testing.T, tconf *servicecfg.Config) error {
+func (i *TeleInstance) CreateWithConf(t *testing.T, tconf *servicecfg.Config) error {
 	i.Config = tconf
 	var err error
 	i.Process, err = i.createTeleportProcess(tconf)
@@ -678,7 +677,7 @@ func (i *TeleInstance) CreateWithConf(_ *testing.T, tconf *servicecfg.Config) er
 	// create users and roles if they don't exist, or sign their keys if they're
 	// already present
 	auth := i.Process.GetAuthServer()
-	ctx := context.TODO()
+	ctx := t.Context()
 
 	for _, user := range i.Secrets.Users {
 		teleUser, err := types.NewUser(user.Username)
@@ -927,10 +926,10 @@ func (i *TeleInstance) StartApps(configs []*servicecfg.Config) ([]*service.Telep
 }
 
 // StartDatabase starts the database access service with the provided config.
-func (i *TeleInstance) StartDatabase(conf *servicecfg.Config) (*service.TeleportProcess, *authclient.Client, error) {
+func (i *TeleInstance) StartDatabase(conf *servicecfg.Config) (*service.TeleportProcess, *authclient.Client, string, error) {
 	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, nil, "", trace.Wrap(err)
 	}
 	i.tempDirs = append(i.tempDirs, dataDir)
 
@@ -952,7 +951,7 @@ func (i *TeleInstance) StartDatabase(conf *servicecfg.Config) (*service.Teleport
 	// compose this "cluster".
 	process, err := service.NewTeleport(conf)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, nil, "", trace.Wrap(err)
 	}
 	i.Nodes = append(i.Nodes, process)
 
@@ -967,22 +966,24 @@ func (i *TeleInstance) StartDatabase(conf *servicecfg.Config) (*service.Teleport
 	// Start the process and block until the expected events have arrived.
 	receivedEvents, err := StartAndWait(process, expectedEvents)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, nil, "", trace.Wrap(err)
 	}
 
 	// Retrieve auth server connector.
 	var client *authclient.Client
+	var hostUUID string
 	for _, event := range receivedEvents {
 		if event.Name == service.DatabasesIdentityEvent {
 			conn, ok := (event.Payload).(*service.Connector)
 			if !ok {
-				return nil, nil, trace.BadParameter("unsupported event payload type %q", event.Payload)
+				return nil, nil, "", trace.BadParameter("unsupported event payload type %q", event.Payload)
 			}
 			client = conn.Client
+			hostUUID = conn.HostUUID()
 		}
 	}
 	if client == nil {
-		return nil, nil, trace.BadParameter("failed to retrieve auth client")
+		return nil, nil, "", trace.BadParameter("failed to retrieve auth client")
 	}
 
 	i.Log.DebugContext(context.Background(), "Teleport Database Server started",
@@ -991,7 +992,7 @@ func (i *TeleInstance) StartDatabase(conf *servicecfg.Config) (*service.Teleport
 		"received_events_count", len(receivedEvents),
 	)
 
-	return process, client, nil
+	return process, client, hostUUID, nil
 }
 
 func (i *TeleInstance) StartKube(t *testing.T, conf *servicecfg.Config, clusterName string) (*service.TeleportProcess, error) {
@@ -1061,7 +1062,6 @@ func (i *TeleInstance) StartNodeAndProxy(t *testing.T, name string) (sshPort, we
 	authServer := utils.MustParseAddr(i.Auth)
 	tconf.SetAuthServerAddress(*authServer)
 	tconf.SetToken("token")
-	tconf.HostUUID = name
 	tconf.Hostname = name
 	tconf.Testing.UploadEventsC = i.UploadEventsC
 	tconf.DataDir = dataDir
@@ -1160,7 +1160,6 @@ func (i *TeleInstance) StartProxy(cfg ProxyConfig, opts ...Option) (reversetunne
 	tconf.CachePolicy = servicecfg.CachePolicy{Enabled: true}
 	tconf.DataDir = dataDir
 	tconf.Testing.UploadEventsC = i.UploadEventsC
-	tconf.HostUUID = cfg.Name
 	tconf.Hostname = cfg.Name
 	tconf.SetToken("token")
 
@@ -1327,7 +1326,12 @@ func (i *TeleInstance) Start() error {
 	if i.Config.Kube.Enabled {
 		expectedEvents = append(expectedEvents, service.KubernetesReady)
 	}
-
+	if i.Config.WindowsDesktop.Enabled {
+		expectedEvents = append(expectedEvents, service.WindowsDesktopReady)
+	}
+	if i.Config.Relay.Enabled {
+		expectedEvents = append(expectedEvents, service.RelayReady)
+	}
 	if i.Config.Discovery.Enabled {
 		expectedEvents = append(expectedEvents, service.DiscoveryReady)
 	}
@@ -1363,6 +1367,18 @@ func (i *TeleInstance) Start() error {
 		"received_events_count", len(receivedEvents),
 	)
 
+	// Wait for any SSH instances to be visible in the inventory before returning
+	// to prevent any immediate connection attempts from failing because the host
+	// has not yet been propagated to the caches.
+	expectedNodes := len(i.Nodes)
+	if i.Config.SSH.Enabled {
+		expectedNodes++
+	}
+
+	if err := i.WaitForNodeCount(context.Background(), i.Secrets.SiteName, expectedNodes); err != nil {
+		return trace.Wrap(err)
+	}
+
 	return nil
 }
 
@@ -1685,6 +1701,59 @@ func (w *WebClient) SSH(termReq web.TerminalRequest) (*terminal.Stream, error) {
 	return terminal.NewStream(context.Background(), terminal.StreamConfig{WS: ws}), nil
 }
 
+func (w *WebClient) SFTP(path string, upload []byte) ([]byte, error) {
+	u := &url.URL{
+		Host:   w.i.Web,
+		Scheme: client.HTTPS,
+		Path: fmt.Sprintf(
+			"/v1/webapi/sites/%s/nodes/%s/%s/scp",
+			w.i.Config.Auth.ClusterName.GetClusterName(),
+			w.tc.Host,
+			w.tc.HostLogin,
+		),
+	}
+
+	q := u.Query()
+	q.Set("location", path)
+	q.Set("filename", "foo.txt")
+	u.RawQuery = q.Encode()
+	header := http.Header{}
+	header.Add("Origin", "http://localhost")
+	for _, cookie := range w.cookies {
+		header.Add("Cookie", cookie.String())
+	}
+	header.Set("Authorization", "Bearer "+w.token)
+
+	ctx := w.i.Process.GracefulExitContext()
+	method := http.MethodGet
+	if upload != nil {
+		method = http.MethodPost
+	}
+	req, err := http.NewRequestWithContext(ctx, method, u.String(), bytes.NewReader(upload))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	req.Header = header
+	transport, err := defaults.Transport()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	transport.TLSClientConfig = &tls.Config{
+		InsecureSkipVerify: true,
+	}
+	clt := &http.Client{Transport: transport}
+	resp, err := clt.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return body, trace.ReadError(resp.StatusCode, body)
+}
+
 func (w *WebClient) JoinKubernetesSession(id string, mode types.SessionParticipantMode) (*terminal.Stream, error) {
 	u := url.URL{
 		Host:   w.i.Web,
@@ -1882,20 +1951,24 @@ func (i *TeleInstance) StopAll() error {
 // WaitForNodeCount waits for a certain number of nodes in the provided cluster
 // to be visible to the Proxy. This should be called prior to any client dialing
 // of nodes to be sure that the node is registered and routable.
-func (i *TeleInstance) WaitForNodeCount(ctx context.Context, cluster string, count int) error {
+func (i *TeleInstance) WaitForNodeCount(ctx context.Context, clusterName string, count int) error {
 	const (
 		deadline     = time.Second * 30
 		iterWaitTime = time.Second
 	)
 
+	if count <= 0 || i.Config == nil || !i.Config.Auth.Enabled || !i.Config.Proxy.Enabled {
+		return nil
+	}
+
 	err := retryutils.RetryStaticFor(deadline, iterWaitTime, func() error {
-		site, err := i.Tunnel.GetSite(cluster)
+		cluster, err := i.Tunnel.Cluster(ctx, clusterName)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		// Validate that the site cache contains the expected count.
-		accessPoint, err := site.CachingAccessPoint()
+		accessPoint, err := cluster.CachingAccessPoint()
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1909,7 +1982,7 @@ func (i *TeleInstance) WaitForNodeCount(ctx context.Context, cluster string, cou
 		}
 
 		// Validate that the site watcher contains the expected count.
-		watcher, err := site.NodeWatcher()
+		watcher, err := cluster.NodeWatcher()
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/integration/helpers/testmain.go b/integration/helpers/testmain.go
index 5bc37898bffcf..bf0d84a3ee5c8 100644
--- a/integration/helpers/testmain.go
+++ b/integration/helpers/testmain.go
@@ -19,32 +19,37 @@
 package helpers
 
 import (
+	"context"
 	"os"
 	"testing"
 	"time"
 
-	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/srv"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/teleport/common"
 )
 
 // TestMainImplementation will re-execute Teleport to run a command if "exec" is passed to
 // it as an argument. Otherwise, it will run tests as normal.
 func TestMainImplementation(m *testing.M) {
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
+	logtest.InitLogger(testing.Verbose)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
 	SetTestTimeouts(3 * time.Second)
 	modules.SetInsecureTestMode(true)
 	// If the test is re-executing itself, execute the command that comes over
 	// the pipe.
 	if srv.IsReexec() {
+		defer cancel()
 		common.Run(common.Options{Args: os.Args[1:]})
 		return
 	}
 
 	// Otherwise run tests as normal.
-	code := m.Run()
-	os.Exit(code)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
diff --git a/integration/helpers/trustedclusters.go b/integration/helpers/trustedclusters.go
index 7def24b31ff08..b517069f67340 100644
--- a/integration/helpers/trustedclusters.go
+++ b/integration/helpers/trustedclusters.go
@@ -130,11 +130,11 @@ func TryUpsertTrustedCluster(t *testing.T, authServer *auth.Server, trustedClust
 }
 
 func WaitForClusters(tun reversetunnelclient.Server, expected int) func() bool {
-	// GetSites will always return the local site
+	// Clusters will always return the local site
 	expected++
 
 	return func() (ok bool) {
-		clusters, err := tun.GetSites()
+		clusters, err := tun.Clusters(context.Background())
 		if err != nil {
 			return false
 		}
@@ -161,8 +161,9 @@ func WaitForClusters(tun reversetunnelclient.Server, expected int) func() bool {
 
 // WaitForActiveTunnelConnections waits for remote cluster to report a minimum number of active connections
 func WaitForActiveTunnelConnections(t *testing.T, tunnel reversetunnelclient.Server, clusterName string, expectedCount int) {
+	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		cluster, err := tunnel.GetSite(clusterName)
+		cluster, err := tunnel.Cluster(ctx, clusterName)
 		if !assert.NoError(t, err, "site not found") {
 			return
 		}
diff --git a/integration/helpers/usercreds.go b/integration/helpers/usercreds.go
index db72e768de5da..a6b4ccbc1cbcd 100644
--- a/integration/helpers/usercreds.go
+++ b/integration/helpers/usercreds.go
@@ -134,7 +134,7 @@ func GenerateUserCreds(req UserCredsRequest) (*UserCreds, error) {
 		return nil, trace.Wrap(err)
 	}
 	a := req.Process.GetAuthServer()
-	sshCert, x509Cert, err := a.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+	sshCert, x509Cert, err := a.GenerateUserTestCertsWithContext(context.Background(), auth.GenerateUserTestCertsRequest{
 		SSHPubKey:      sshPub,
 		TLSPubKey:      tlsPub,
 		Username:       req.Username,
diff --git a/integration/helpers/web.go b/integration/helpers/web.go
index b953376bc36f4..d74d05297b8a2 100644
--- a/integration/helpers/web.go
+++ b/integration/helpers/web.go
@@ -31,6 +31,7 @@ import (
 
 	"github.com/gorilla/websocket"
 	"github.com/gravitational/roundtrip"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -56,7 +57,7 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 		User: username,
 		Pass: password,
 	})
-	require.NoError(t, err)
+	require.NoError(t, err, "Setting password for user %q", username)
 
 	// Create POST request to create session.
 	u := url.URL{
@@ -65,7 +66,7 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 		Path:   "/v1/webapi/sessions/web",
 	}
 	req, err := http.NewRequest(http.MethodPost, u.String(), bytes.NewBuffer(csReq))
-	require.NoError(t, err)
+	require.NoError(t, err, "Creating session request for user %q", username)
 
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 
@@ -78,9 +79,9 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 		},
 	}
 	resp, err := client.Do(req)
-	require.NoError(t, err)
+	require.NoError(t, err, "Creating session for user %q", username)
 	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, http.StatusOK, resp.StatusCode, "Creating session for user %q", username)
 
 	// Read in response.
 	var csResp *web.CreateSessionResponse
@@ -99,7 +100,7 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 		bearerToken: csResp.Token,
 	}
 
-	respStatusCode, bs := webClient.DoRequest(t, http.MethodGet, "sites", nil)
+	respStatusCode, bs := webClient.DoWebAPIRequest(t, http.MethodGet, "sites", nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(bs))
 
 	var clusters []ui.Cluster
@@ -189,7 +190,7 @@ func LoginMFAWebClient(t *testing.T, host string, passwordlessDevice *mocku2f.Ke
 		bearerToken: csResp.Token,
 	}
 
-	respStatusCode, bs := webClient.DoRequest(t, http.MethodGet, "sites", nil)
+	respStatusCode, bs := webClient.DoWebAPIRequest(t, http.MethodGet, "sites", nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(bs))
 
 	var clusters []ui.Cluster
@@ -200,38 +201,77 @@ func LoginMFAWebClient(t *testing.T, host string, passwordlessDevice *mocku2f.Ke
 	return webClient
 }
 
-// DoRequest receives a method, endpoint and payload and sends an HTTP Request to the Teleport API.
+// DoWebAPIRequest receives a method, endpoint and payload and sends an HTTP Request to the Teleport API.
 // The endpoint must not contain the host neither the base path ('/v1/webapi/').
 // Status Code and Body are returned.
 // "$site" in the endpoint is substituted by the current site.
-func (w *WebClientPack) DoRequest(t *testing.T, method, endpoint string, payload any) (int, []byte) {
-	endpoint = fmt.Sprintf("https://%s/v1/webapi/%s", w.host, endpoint)
-	endpoint = strings.ReplaceAll(endpoint, "$site", w.clusterName)
-	u, err := url.Parse(endpoint)
+func (w *WebClientPack) DoWebAPIRequest(t *testing.T, method, endpoint string, payload any) (int, []byte) {
+	u, err := url.Parse(w.Endpoint("v1", "webapi", endpoint))
 	require.NoError(t, err)
+	return w.MustDoRequest(t, method, u.String(), payload)
+}
 
-	bs, err := json.Marshal(payload)
+// DoWebAPIRequest receives a method, endpoint and payload and sends an HTTP Request to the Teleport API.
+// Status Code and Body are returned.
+// "$site" in the endpoint is substituted by the current site.
+func (w *WebClientPack) MustDoRequest(t *testing.T, method, url string, payload any) (int, []byte) {
+	status, body, err := w.DoRequest(method, url, payload)
 	require.NoError(t, err)
+	return status, body
+}
 
-	req, err := http.NewRequest(method, u.String(), bytes.NewBuffer(bs))
-	require.NoError(t, err)
+// DoWebAPIRequest receives a method, endpoint and payload and sends an HTTP Request to the Teleport API.
+// Status Code and Body are returned.
+// "$site" in the endpoint is substituted by the current site.
+func (w *WebClientPack) DoRequest(method, url string, payload any) (int, []byte, error) {
+	var requestBody io.Reader
+	if payload != nil {
+		bs, err := json.Marshal(payload)
+		if err != nil {
+			return 0, nil, trace.Wrap(err)
+		}
+		requestBody = bytes.NewBuffer(bs)
+	}
+
+	req, err := http.NewRequest(method, url, requestBody)
+	if err != nil {
+		return 0, nil, trace.Wrap(err)
+	}
+	if requestBody != nil {
+		req.Header.Add("Content-Type", "application/json")
+	}
 
+	resp, err := w.Do(req)
+	if err != nil {
+		return 0, nil, trace.Wrap(err)
+	}
+
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return 0, nil, trace.Wrap(err)
+	}
+
+	return resp.StatusCode, body, nil
+}
+
+// Do sends an HTTP request with the web session cookie and bearer token.
+func (w *WebClientPack) Do(req *http.Request) (*http.Response, error) {
 	req.AddCookie(&http.Cookie{
 		Name:  websession.CookieName,
 		Value: w.webCookie,
 	})
 	req.Header.Add("Authorization", fmt.Sprintf("Bearer %v", w.bearerToken))
-	req.Header.Add("Content-Type", "application/json")
 
 	resp, err := w.clt.Do(req)
-	require.NoError(t, err)
-
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
+	return resp, err
+}
 
-	return resp.StatusCode, body
+// Endpoint returns a Teleport API endpoint URL.
+func (w *WebClientPack) Endpoint(params ...string) string {
+	endpoint := fmt.Sprintf("%s://%s/%s", client.HTTPS, w.host, strings.Join(params, "/"))
+	return strings.ReplaceAll(endpoint, "$site", w.clusterName)
 }
 
 // OpenWebsocket opens a websocket on a given Teleport API endpoint.
diff --git a/integration/hostuser_test.go b/integration/hostuser_test.go
index 02772133a3b35..2264584754b3c 100644
--- a/integration/hostuser_test.go
+++ b/integration/hostuser_test.go
@@ -54,6 +54,8 @@ import (
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 const testuser = "teleport-testuser"
@@ -78,7 +80,7 @@ func getUserShells(path string) (map[string]string, error) {
 }
 
 func TestRootHostUsersBackend(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 	sudoersTestDir := t.TempDir()
 	usersbk := srv.HostUsersProvisioningBackend{}
 	sudoersbk := srv.HostSudoersProvisioningBackend{
@@ -238,7 +240,7 @@ func sudoersPath(username, uuid string) string {
 }
 
 func TestRootHostUsers(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 	ctx := context.Background()
 	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
 	require.NoError(t, err)
@@ -456,7 +458,9 @@ func TestRootHostUsers(t *testing.T) {
 		namedShellUser := "named-shell"
 		absoluteShellUser := "absolute-shell"
 
-		t.Cleanup(func() { cleanupUsersAndGroups([]string{defaultShellUser, namedShellUser, absoluteShellUser}, nil) })
+		t.Cleanup(func() {
+			cleanupUsersAndGroups([]string{defaultShellUser, namedShellUser, absoluteShellUser}, nil)
+		})
 
 		// Create a user with a named shell expected to be available in the PATH
 		users := srv.NewHostUsers(context.Background(), presence, "host_uuid")
@@ -466,17 +470,16 @@ func TestRootHostUsers(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		// Create a user with an absolute path to a shell
-		_, err = users.UpsertUser(absoluteShellUser, &decisionpb.HostUsersInfo{
-			Mode:  decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
-			Shell: "/usr/bin/bash",
+		// Create a user with the host default shell (default behavior)
+		_, err = users.UpsertUser(defaultShellUser, &decisionpb.HostUsersInfo{
+			Mode: decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 		})
 		require.NoError(t, err)
 
-		// Create a user with the host default shell (default behavior)
-		_, err = users.UpsertUser(defaultShellUser, &decisionpb.HostUsersInfo{
+		// Create a user with an absolute path to a shell
+		_, err = users.UpsertUser(absoluteShellUser, &decisionpb.HostUsersInfo{
 			Mode:  decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
-			Shell: "zsh",
+			Shell: "/usr/bin/bash",
 		})
 		require.NoError(t, err)
 
@@ -501,7 +504,9 @@ func TestRootHostUsers(t *testing.T) {
 		assert.Equal(t, expectedShell, userShells[absoluteShellUser])
 		assert.NotEqual(t, expectedShell, userShells[defaultShellUser])
 
-		// User's shell should not be overwritten when updating, only when creating a new host user
+		// User's shell should be overwritten when a different shell
+		// is provided
+		expectedShell = "/usr/bin/sh"
 		_, err = users.UpsertUser(namedShellUser, &decisionpb.HostUsersInfo{
 			Mode:  decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 			Shell: "sh",
@@ -511,6 +516,18 @@ func TestRootHostUsers(t *testing.T) {
 		userShells, err = getUserShells("/etc/passwd")
 		require.NoError(t, err)
 		assert.Equal(t, expectedShell, userShells[namedShellUser])
+
+		// Make sure we can change the user's shell back again.
+		expectedShell = "/usr/bin/bash"
+		_, err = users.UpsertUser(namedShellUser, &decisionpb.HostUsersInfo{
+			Mode:  decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
+			Shell: "bash",
+		})
+		require.NoError(t, err)
+
+		userShells, err = getUserShells("/etc/passwd")
+		require.NoError(t, err)
+		assert.Equal(t, expectedShell, userShells[namedShellUser])
 	})
 
 	t.Run("Test expiration removal", func(t *testing.T) {
@@ -625,7 +642,7 @@ func (u *hostUsersBackendWithExp) CreateUser(name string, groups []string, opts
 }
 
 func TestRootLoginAsHostUser(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 	// Create test instance.
 	privateKey, publicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
@@ -636,12 +653,12 @@ func TestRootLoginAsHostUser(t *testing.T) {
 		NodeName:    Host,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	// Create a user that can create a host user.
 	username := "test-user"
-	login := utils.GenerateLocalUsername(t)
+	login := testutils.GenerateLocalUsername(t)
 	groups := []string{"foo", "bar"}
 	role, err := types.NewRole("ssh-host-user", types.RoleSpecV6{
 		Options: types.RoleOptions{
@@ -666,8 +683,6 @@ func TestRootLoginAsHostUser(t *testing.T) {
 		require.NoError(t, instance.StopAll())
 	})
 
-	instance.WaitForNodeCount(context.Background(), helpers.Site, 1)
-
 	tests := []struct {
 		name      string
 		command   []string
@@ -725,7 +740,7 @@ func TestRootLoginAsHostUser(t *testing.T) {
 }
 
 func TestRootStaticHostUsers(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 	// Create test instance.
 	privateKey, publicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
@@ -736,7 +751,7 @@ func TestRootStaticHostUsers(t *testing.T) {
 		NodeName:    Host,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	require.NoError(t, instance.Create(t, nil, false))
@@ -745,17 +760,21 @@ func TestRootStaticHostUsers(t *testing.T) {
 		require.NoError(t, instance.StopAll())
 	})
 	nodeCfg := servicecfg.MakeDefaultConfig()
+	nodeCfg.SSH.DisableCreateHostUser = false
 	nodeCfg.SSH.Labels = map[string]string{
 		"foo": "bar",
 	}
-	_, err = instance.StartNode(nodeCfg)
+	nodeProcess, err := instance.StartNode(nodeCfg)
+	require.NoError(t, err)
+
+	nodeUUID, err := nodeProcess.WaitForHostID(t.Context())
 	require.NoError(t, err)
 
 	instance.WaitForNodeCount(context.Background(), helpers.Site, 2)
 
 	// Create host user resources.
 	groups := []string{"foo", "bar"}
-	goodLogin := utils.GenerateLocalUsername(t)
+	goodLogin := testutils.GenerateLocalUsername(t)
 	goodUser := userprovisioning.NewStaticHostUser(goodLogin, &userprovisioningpb.StaticHostUserSpec{
 		Matchers: []*userprovisioningpb.Matcher{
 			{
@@ -770,7 +789,7 @@ func TestRootStaticHostUsers(t *testing.T) {
 			},
 		},
 	})
-	goodLoginWithShell := utils.GenerateLocalUsername(t)
+	goodLoginWithShell := testutils.GenerateLocalUsername(t)
 	goodUserWithShell := userprovisioning.NewStaticHostUser(goodLoginWithShell, &userprovisioningpb.StaticHostUserSpec{
 		Matchers: []*userprovisioningpb.Matcher{
 			{
@@ -785,7 +804,7 @@ func TestRootStaticHostUsers(t *testing.T) {
 			},
 		},
 	})
-	nonMatchingLogin := utils.GenerateLocalUsername(t)
+	nonMatchingLogin := testutils.GenerateLocalUsername(t)
 	nonMatchingUser := userprovisioning.NewStaticHostUser(nonMatchingLogin, &userprovisioningpb.StaticHostUserSpec{
 		Matchers: []*userprovisioningpb.Matcher{
 			{
@@ -799,7 +818,7 @@ func TestRootStaticHostUsers(t *testing.T) {
 			},
 		},
 	})
-	conflictingLogin := utils.GenerateLocalUsername(t)
+	conflictingLogin := testutils.GenerateLocalUsername(t)
 	conflictingUser := userprovisioning.NewStaticHostUser(conflictingLogin, &userprovisioningpb.StaticHostUserSpec{
 		Matchers: []*userprovisioningpb.Matcher{
 			{
@@ -826,14 +845,14 @@ func TestRootStaticHostUsers(t *testing.T) {
 	t.Cleanup(func() { cleanupUsersAndGroups([]string{goodLogin, nonMatchingLogin, conflictingLogin}, groups) })
 
 	// Test that a node picks up new host users from the cache.
-	testStaticHostUsers(t, nodeCfg.HostUUID, goodLogin, goodLoginWithShell, nonMatchingLogin, conflictingLogin, groups)
+	testStaticHostUsers(t, nodeUUID, goodLogin, goodLoginWithShell, nonMatchingLogin, conflictingLogin, groups)
 	cleanupUsersAndGroups([]string{goodLogin, nonMatchingLogin, conflictingLogin}, groups)
 
 	require.NoError(t, instance.StopNodes())
 	_, err = instance.StartNode(nodeCfg)
 	require.NoError(t, err)
 	// Test that a new node picks up existing host users on startup.
-	testStaticHostUsers(t, nodeCfg.HostUUID, goodLogin, goodLoginWithShell, nonMatchingLogin, conflictingLogin, groups)
+	testStaticHostUsers(t, nodeUUID, goodLogin, goodLoginWithShell, nonMatchingLogin, conflictingLogin, groups)
 
 	// Check that a deleted resource doesn't affect the host user.
 	require.NoError(t, clt.DeleteStaticHostUser(context.Background(), goodLogin))
@@ -844,7 +863,7 @@ func TestRootStaticHostUsers(t *testing.T) {
 	require.Never(t, func() bool {
 		_, lookupErr = user.Lookup(goodLogin)
 		_, homeDirErr = os.Stat("/home/" + goodLogin)
-		_, sudoerErr = os.Stat(sudoersPath(goodLogin, nodeCfg.HostUUID))
+		_, sudoerErr = os.Stat(sudoersPath(goodLogin, nodeUUID))
 		return lookupErr != nil || homeDirErr != nil || sudoerErr != nil
 	}, 5*time.Second, time.Second,
 		"lookup err: %v\nhome dir err: %v\nsudoer err: %v\n",
@@ -860,15 +879,15 @@ func testStaticHostUsers(t *testing.T, nodeUUID, goodLogin, goodLoginWithShell,
 	require.EventuallyWithT(t, func(collect *assert.CollectT) {
 		// Check that the user was created.
 		existingUser, err := user.Lookup(goodLogin)
-		assert.NoError(collect, err)
+		require.NoError(collect, err)
 		assert.DirExists(collect, existingUser.HomeDir)
 		// Check that the user has the right groups, including teleport-static.
 		groupIDs, err := existingUser.GroupIds()
-		assert.NoError(collect, err)
+		require.NoError(collect, err)
 		userGroups := make([]string, 0, len(groupIDs))
 		for _, gid := range groupIDs {
 			group, err := user.LookupGroupId(gid)
-			assert.NoError(collect, err)
+			require.NoError(collect, err)
 			userGroups = append(userGroups, group.Name)
 		}
 		assert.Subset(collect, userGroups, groups)
@@ -876,7 +895,7 @@ func testStaticHostUsers(t *testing.T, nodeUUID, goodLogin, goodLoginWithShell,
 		// Check that the sudoers file was created.
 		assert.FileExists(collect, sudoersPath(goodLogin, nodeUUID))
 		userShells, err := getUserShells("/etc/passwd")
-		assert.NoError(collect, err)
+		require.NoError(collect, err)
 		assert.Equal(collect, "/usr/bin/bash", userShells[goodLoginWithShell])
 	}, 10*time.Second, time.Second)
 
diff --git a/integration/hsm/helpers.go b/integration/hsm/helpers.go
index ec1891afca310..4e4d9150e5df2 100644
--- a/integration/hsm/helpers.go
+++ b/integration/hsm/helpers.go
@@ -97,6 +97,15 @@ func (t *teleportService) waitForShutdown(ctx context.Context) error {
 	}
 }
 
+func (t *teleportService) cleanup() error {
+	if err := t.process.Close(); err != nil {
+		return trace.Wrap(err, "closing auth process")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	return trace.Wrap(t.waitForShutdown(ctx), "waiting for auth process to shut down")
+}
+
 func (t *teleportService) waitForLocalAdditionalKeys(ctx context.Context) error {
 	t.log.DebugContext(ctx, "waiting for local additional keys")
 	authServer := t.process.GetAuthServer()
@@ -212,7 +221,7 @@ func newAuthConfig(t *testing.T, log *slog.Logger, clock clockwork.Clock) *servi
 	config.Proxy.Enabled = false
 	config.Logger = log
 	config.InstanceMetadataClient = imds.NewDisabledIMDSClient()
-	config.MaxRetryPeriod = 25 * time.Millisecond
+	config.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(25 * time.Millisecond)
 	config.PollingPeriod = 2 * time.Second
 	config.Clock = clock
 
@@ -255,7 +264,7 @@ func newProxyConfig(t *testing.T, authAddr utils.NetAddr, log *slog.Logger, cloc
 	config.SetAuthServerAddress(authAddr)
 	config.Logger = log
 	config.InstanceMetadataClient = imds.NewDisabledIMDSClient()
-	config.MaxRetryPeriod = 25 * time.Millisecond
+	config.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(25 * time.Millisecond)
 	config.PollingPeriod = 2 * time.Second
 	config.Clock = clock
 
diff --git a/integration/hsm/hsm_test.go b/integration/hsm/hsm_test.go
index 9c3447e12c601..3634eea3b80de 100644
--- a/integration/hsm/hsm_test.go
+++ b/integration/hsm/hsm_test.go
@@ -20,13 +20,19 @@ package hsm
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log/slog"
 	"net"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
@@ -38,23 +44,26 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/keystore"
-	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
+	// Enable verbose logging for HSM tests.
+	logtest.InitLogger(func() bool { return true })
+
 	// Enable HSM feature.
 	// This is safe to do here, as all tests in this package require HSM to be
 	// enabled.
-	modules.SetModules(&modules.TestModules{
+	modules.SetModules(&modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -69,7 +78,7 @@ func TestMain(m *testing.M) {
 func newHSMAuthConfig(t *testing.T, storageConfig *backend.Config, log *slog.Logger, clock clockwork.Clock) *servicecfg.Config {
 	config := newAuthConfig(t, log, clock)
 	config.Auth.StorageConfig = *storageConfig
-	config.Auth.KeyStore = keystore.HSMTestConfig(t)
+	config.Auth.KeyStore = HSMTestConfig(t)
 	authPref, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
 		SignatureAlgorithmSuite: types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_HSM_V1,
 	})
@@ -91,7 +100,7 @@ func liteBackendConfig(t *testing.T) *backend.Config {
 func TestHSMRotation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
-	log := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "TestHSMRotation")
+	log := logtest.With(teleport.ComponentKey, "TestHSMRotation")
 
 	log.DebugContext(ctx, "starting auth server")
 	authConfig := newHSMAuthConfig(t, liteBackendConfig(t), log, clockwork.NewRealClock())
@@ -100,7 +109,9 @@ func TestHSMRotation(t *testing.T) {
 	allServices := teleportServices{auth1}
 
 	t.Cleanup(func() {
-		require.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil))
+		assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
+			"failed to delete hsm keys during test cleanup")
+		assert.NoError(t, auth1.cleanup())
 	})
 
 	// start a proxy to make sure it can get creds at each stage of rotation
@@ -147,9 +158,9 @@ func TestHSMRotation(t *testing.T) {
 }
 
 func getAdminClient(authDataDir string, authAddr string) (*authclient.Client, error) {
-	identity, err := storage.ReadLocalIdentity(
+	identity, err := storage.ReadLocalIdentityForRole(
 		filepath.Join(authDataDir, teleport.ComponentProcess),
-		state.IdentityID{Role: types.RoleAdmin})
+		types.RoleAdmin)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -200,9 +211,8 @@ func testAdminClient(t *testing.T, authDataDir string, authAddr string) {
 // Tests multiple CA rotations and rollbacks with 2 HSM auth servers in an HA configuration
 func TestHSMDualAuthRotation(t *testing.T) {
 	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	log := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "TestHSMDualAuthRotation")
+	ctx := t.Context()
+	log := logtest.With(teleport.ComponentKey, "TestHSMDualAuthRotation")
 	storageConfig := liteBackendConfig(t)
 
 	// start a cluster with 1 auth server
@@ -211,8 +221,9 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	auth1, err := newTeleportService(ctx, auth1Config, "auth1")
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
+		assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
 			"failed to delete hsm keys during test cleanup")
+		assert.NoError(t, auth1.cleanup())
 	})
 	authServices := teleportServices{auth1}
 
@@ -225,7 +236,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, lb.Listen())
 	go lb.Serve()
-	t.Cleanup(func() { require.NoError(t, lb.Close()) })
+	t.Cleanup(func() { assert.NoError(t, lb.Close()) })
 
 	// add a new auth server
 	log.DebugContext(ctx, "Starting auth server 2")
@@ -233,7 +244,9 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	auth2, err := newTeleportService(ctx, auth2Config, "auth2")
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.NoError(t, auth2.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil))
+		assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
+			"failed to delete hsm keys during test cleanup")
+		assert.NoError(t, auth2.cleanup())
 	})
 	authServices = append(authServices, auth2)
 
@@ -382,9 +395,8 @@ func TestHSMDualAuthRotation(t *testing.T) {
 // Tests a dual-auth server migration from raw keys to HSM keys
 func TestHSMMigrate(t *testing.T) {
 	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	log := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "TestHSMMigrate")
+	ctx := t.Context()
+	log := logtest.With(teleport.ComponentKey, "TestHSMMigrate")
 	storageConfig := liteBackendConfig(t)
 
 	// start a dual auth non-hsm cluster
@@ -395,6 +407,11 @@ func TestHSMMigrate(t *testing.T) {
 	auth2Config.Auth.KeyStore = servicecfg.KeystoreConfig{}
 	auth1, err := newTeleportService(ctx, auth1Config, "auth1")
 	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
+			"failed to delete hsm keys during test cleanup")
+		assert.NoError(t, auth1.cleanup())
+	})
 	auth2, err := newTeleportService(ctx, auth2Config, "auth2")
 	require.NoError(t, err)
 
@@ -413,7 +430,7 @@ func TestHSMMigrate(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, lb.Listen())
 	go lb.Serve()
-	t.Cleanup(func() { require.NoError(t, lb.Close()) })
+	t.Cleanup(func() { assert.NoError(t, lb.Close()) })
 
 	testClient := func(t *testing.T) {
 		testAdminClient(t, auth1Config.DataDir, lb.Addr().String())
@@ -423,7 +440,7 @@ func TestHSMMigrate(t *testing.T) {
 	// Phase 1: migrate auth1 to HSM
 	auth1.process.Close()
 	require.NoError(t, auth1.waitForShutdown(ctx))
-	auth1Config.Auth.KeyStore = keystore.HSMTestConfig(t)
+	auth1Config.Auth.KeyStore = HSMTestConfig(t)
 	auth1, err = newTeleportService(ctx, auth1Config, "auth1")
 	require.NoError(t, err)
 
@@ -499,7 +516,7 @@ func TestHSMMigrate(t *testing.T) {
 	// Phase 2: migrate auth2 to HSM
 	auth2.process.Close()
 	require.NoError(t, auth2.waitForShutdown(ctx))
-	auth2Config.Auth.KeyStore = keystore.HSMTestConfig(t)
+	auth2Config.Auth.KeyStore = HSMTestConfig(t)
 	auth2, err = newTeleportService(ctx, auth2Config, "auth2")
 	require.NoError(t, err)
 	authServices = teleportServices{auth1, auth2}
@@ -529,16 +546,17 @@ func TestHSMMigrate(t *testing.T) {
 // software keys.
 func TestHSMRevert(t *testing.T) {
 	clock := clockwork.NewFakeClock()
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	log := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "TestHSMRevert")
+	ctx := t.Context()
+	log := logtest.With(teleport.ComponentKey, "TestHSMRevert")
 
 	log.DebugContext(ctx, "starting auth server")
 	auth1Config := newHSMAuthConfig(t, liteBackendConfig(t), log, clock)
 	auth1, err := newTeleportService(ctx, auth1Config, "auth1")
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil))
+		assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil),
+			"failed to delete hsm keys during test cleanup")
+		assert.NoError(t, auth1.cleanup())
 	})
 
 	// Switch config back to default (software) and restart.
@@ -549,10 +567,13 @@ func TestHSMRevert(t *testing.T) {
 	require.NoError(t, err)
 
 	// Make sure a cluster alert is created.
-	alerts, err := auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{})
-	require.NoError(t, err)
-	require.Len(t, alerts, 1)
-	alert := alerts[0]
+	var alert types.ClusterAlert
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		alerts, err := auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{})
+		require.NoError(t, err)
+		require.Len(t, alerts, 1)
+		alert = alerts[0]
+	}, time.Second*30, time.Millisecond*100, "waiting for cluster alert to be created")
 	assert.Equal(t, types.AlertSeverity_HIGH, alert.Spec.Severity)
 	assert.Contains(t, alert.Spec.Message, "configured to use raw software keys")
 	assert.Contains(t, alert.Spec.Message, "the following CAs do not contain any keys of that type:")
@@ -592,7 +613,7 @@ func TestHSMRevert(t *testing.T) {
 	// auth.AutoRotateCertAuthorities which reconciles the alert state.
 	clock.Advance(2 * defaults.HighResPollingPeriod)
 	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		alerts, err = auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{})
+		alerts, err := auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{})
 		assert.NoError(t, err)
 		assert.Empty(t, alerts)
 
@@ -600,3 +621,157 @@ func TestHSMRevert(t *testing.T) {
 		clock.Advance(2 * defaults.HighResPollingPeriod)
 	}, 5*time.Second, 100*time.Millisecond)
 }
+
+func HSMTestConfig(t *testing.T) servicecfg.KeystoreConfig {
+	if cfg, ok := yubiHSMTestConfig(t); ok {
+		t.Log("Running test with YubiHSM")
+		return cfg
+	}
+	if cfg, ok := cloudHSMTestConfig(t); ok {
+		t.Log("Running test with AWS CloudHSM")
+		return cfg
+	}
+	if cfg, ok := awsKMSTestConfig(t); ok {
+		t.Log("Running test with AWS KMS")
+		return cfg
+	}
+	if cfg, ok := gcpKMSTestConfig(t); ok {
+		t.Log("Running test with GCP KMS")
+		return cfg
+	}
+	if cfg, ok := softHSMTestConfig(t); ok {
+		t.Log("Running test with SoftHSM")
+		return cfg
+	}
+	t.Skip("No HSM available for test")
+	return servicecfg.KeystoreConfig{}
+}
+
+func yubiHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	yubiHSMPath := os.Getenv("TELEPORT_TEST_YUBIHSM_PKCS11_PATH")
+	yubiHSMPin := os.Getenv("TELEPORT_TEST_YUBIHSM_PIN")
+	if yubiHSMPath == "" || yubiHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	slotNumber := 0
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       yubiHSMPath,
+			SlotNumber: &slotNumber,
+			PIN:        yubiHSMPin,
+		},
+	}, true
+}
+
+func cloudHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	cloudHSMPin := os.Getenv("TELEPORT_TEST_CLOUDHSM_PIN")
+	if cloudHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so",
+			TokenLabel: "cavium",
+			PIN:        cloudHSMPin,
+		},
+	}, true
+}
+
+func awsKMSTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	awsKMSAccount := os.Getenv("TELEPORT_TEST_AWS_KMS_ACCOUNT")
+	awsKMSRegion := os.Getenv("TELEPORT_TEST_AWS_KMS_REGION")
+	if awsKMSAccount == "" || awsKMSRegion == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		AWSKMS: &servicecfg.AWSKMSConfig{
+			AWSAccount: awsKMSAccount,
+			AWSRegion:  awsKMSRegion,
+		},
+	}, true
+}
+
+func gcpKMSTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	gcpKeyring := os.Getenv("TELEPORT_TEST_GCP_KMS_KEYRING")
+	if gcpKeyring == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		GCPKMS: servicecfg.GCPKMSConfig{
+			KeyRing:         gcpKeyring,
+			ProtectionLevel: "SOFTWARE",
+		},
+	}, true
+}
+
+var (
+	cachedSoftHSMConfig      *servicecfg.KeystoreConfig
+	cachedSoftHSMConfigMutex sync.Mutex
+)
+
+// softHSMTestConfig is for use in tests only and creates a test SOFTHSM2 token.
+// This should be used for all tests which need to use SoftHSM because the
+// library can only be initialized once and SOFTHSM2_PATH and SOFTHSM2_CONF
+// cannot be changed. New tokens added after the library has been initialized
+// will not be found by the library.
+//
+// A new token will be used for each `go test` invocation, but it's difficult
+// to create a separate token for each test because because new tokens
+// added after the library has been initialized will not be found by the
+// library. It's also difficult to clean up the token because tests for all
+// packages are run in parallel there is not a good time to safely
+// delete the token or the entire token directory. Each test should clean up
+// all keys that it creates because SoftHSM2 gets really slow when there are
+// many keys for a given token.
+func softHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	path := os.Getenv("SOFTHSM2_PATH")
+	if path == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+
+	cachedSoftHSMConfigMutex.Lock()
+	defer cachedSoftHSMConfigMutex.Unlock()
+
+	if cachedSoftHSMConfig != nil {
+		return *cachedSoftHSMConfig, true
+	}
+
+	if os.Getenv("SOFTHSM2_CONF") == "" {
+		// create tokendir
+		tokenDir, err := os.MkdirTemp("", "tokens")
+		require.NoError(t, err)
+
+		// create config file
+		configFile, err := os.CreateTemp("", "softhsm2.conf")
+		require.NoError(t, err)
+
+		// write config file
+		_, err = fmt.Fprintf(configFile, "directories.tokendir = %s\nobjectstore.backend = file\nlog.level = DEBUG\n", tokenDir)
+		require.NoError(t, err)
+		require.NoError(t, configFile.Close())
+
+		// set env
+		os.Setenv("SOFTHSM2_CONF", configFile.Name())
+	}
+
+	// create test token (max length is 32 chars)
+	tokenLabel := strings.ReplaceAll(uuid.NewString(), "-", "")
+	cmd := exec.Command("softhsm2-util", "--init-token", "--free", "--label", tokenLabel, "--so-pin", "password", "--pin", "password")
+	t.Logf("Running command: %q", cmd)
+	if err := cmd.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			require.NoError(t, exitErr, "error creating test softhsm token: %s", string(exitErr.Stderr))
+		}
+		require.NoError(t, err, "error attempting to run softhsm2-util")
+	}
+
+	cachedSoftHSMConfig = &servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       path,
+			TokenLabel: tokenLabel,
+			PIN:        "password",
+		},
+	}
+	return *cachedSoftHSMConfig, true
+}
diff --git a/integration/instance_test.go b/integration/instance_test.go
deleted file mode 100644
index 35af71e53a385..0000000000000
--- a/integration/instance_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package integration
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sync/errgroup"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/breaker"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/cloud/imds"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/service"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// basicDirCopy performs a very simplistic recursive copy from one directory to another. this helper was
-// written specifically for setting up teleport data directories for testing purposes and may not be
-// suitable for other applications.
-func basicDirCopy(src string, dst string) error {
-	entries, err := os.ReadDir(src)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := os.MkdirAll(dst, teleport.PrivateDirMode); err != nil {
-		return trace.Wrap(err)
-	}
-
-	for _, entry := range entries {
-		if entry.IsDir() {
-			if err := basicDirCopy(filepath.Join(src, entry.Name()), filepath.Join(dst, entry.Name())); err != nil {
-				return trace.Wrap(err)
-			}
-			continue
-		}
-
-		data, err := os.ReadFile(filepath.Join(src, entry.Name()))
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if err := os.WriteFile(filepath.Join(dst, entry.Name()), data, teleport.PrivateDirMode); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return nil
-}
-
-// TestInstanceCertReissue tests the reissuance of an instance certificate when
-// the instance has malformed system roles using pre-constructed data directories
-// generated by an older teleport version that permitted token mix-and-match.
-func TestInstanceCertReissue(t *testing.T) {
-	t.Setenv("_insecuredevmode_no_parallel", "1") // panic if the test is or will become parallel
-	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
-	var eg errgroup.Group
-	defer func() { require.NoError(t, eg.Wait()) }()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Create temporary directories for the auth and agent data directories.
-	authDir, agentDir := t.TempDir(), t.TempDir()
-
-	// Write the instance assets to the temporary directories to set up pre-existing
-	// state for our teleport instances to use.
-	require.NoError(t, basicDirCopy("testdata/auth", authDir))
-	require.NoError(t, basicDirCopy("testdata/agent", agentDir))
-
-	authCfg := servicecfg.MakeDefaultConfig()
-	authCfg.Version = defaults.TeleportConfigVersionV3
-	authCfg.DataDir = authDir
-	authCfg.Auth.Enabled = true
-	authCfg.Auth.ListenAddr.Addr = helpers.NewListener(t, service.ListenerAuth, &authCfg.FileDescriptors)
-	authCfg.SetAuthServerAddress(authCfg.Auth.ListenAddr)
-	// ensure auth server is using the pre-constructed sqlite db
-	authCfg.Auth.StorageConfig.Params = backend.Params{defaults.BackendPath: filepath.Join(authDir, defaults.BackendDir)}
-	var err error
-	authCfg.Auth.ClusterName, err = services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-		ClusterName: "auth-server",
-	})
-	require.NoError(t, err)
-	authCfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
-
-	authCfg.Proxy.Enabled = true
-	authCfg.Proxy.DisableWebInterface = true
-	proxyAddr := helpers.NewListener(t, service.ListenerProxyWeb, &authCfg.FileDescriptors)
-	authCfg.Proxy.WebAddr.Addr = proxyAddr
-
-	authCfg.SSH.Enabled = true
-	authCfg.SSH.Addr.Addr = "localhost:0"
-	authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	authCfg.Logger = utils.NewSlogLoggerForTests()
-	authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
-
-	authProc, err := service.NewTeleport(authCfg)
-	require.NoError(t, err)
-	require.NoError(t, authProc.Start())
-	eg.Go(func() error { return authProc.WaitForSignals(ctx, nil) })
-
-	authIdentity, err := authProc.GetIdentityForTesting(t, types.RoleInstance)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy)}, authIdentity.SystemRoles)
-
-	authEventCh := make(chan service.Event)
-	authProc.ListenForEvents(ctx, service.TeleportCredentialsUpdatedEvent, authEventCh)
-
-	timeoutCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
-	defer cancel()
-
-	_, err = authProc.WaitForEvent(timeoutCtx, service.TeleportCredentialsUpdatedEvent)
-	require.NoError(t, err, "timed out waiting for second auth identity")
-
-	authIdentity, err = authProc.GetIdentityForTesting(t, types.RoleInstance)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy), string(types.RoleNode)}, authIdentity.SystemRoles)
-
-	agentCfg := servicecfg.MakeDefaultConfig()
-	agentCfg.Version = defaults.TeleportConfigVersionV3
-	agentCfg.DataDir = agentDir
-	agentCfg.ProxyServer = utils.NetAddr{
-		AddrNetwork: "tcp",
-		Addr:        proxyAddr,
-	}
-
-	agentCfg.Auth.Enabled = false
-	agentCfg.Proxy.Enabled = false
-	agentCfg.SSH.Enabled = true
-
-	agentCfg.WindowsDesktop.Enabled = true
-	agentCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	agentCfg.Logger = utils.NewSlogLoggerForTests()
-	agentCfg.MaxRetryPeriod = time.Second
-	agentCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
-
-	agentProc, err := service.NewTeleport(agentCfg)
-	require.NoError(t, err)
-	require.NoError(t, agentProc.Start())
-	eg.Go(func() error { return agentProc.WaitForSignals(ctx, nil) })
-
-	agentIdentity, err := agentProc.GetIdentityForTesting(t, types.RoleInstance)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{string(types.RoleNode)}, agentIdentity.SystemRoles)
-
-	_, err = agentProc.WaitForEvent(timeoutCtx, service.TeleportCredentialsUpdatedEvent)
-	require.NoError(t, err, "timed out waiting for second agent identity")
-
-	agentIdentity, err = agentProc.GetIdentityForTesting(t, types.RoleInstance)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{string(types.RoleNode), string(types.RoleWindowsDesktop)}, agentIdentity.SystemRoles)
-}
diff --git a/integration/integration_test.go b/integration/integration_test.go
index 8eab2b756d653..39a9acb8e800f 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -75,6 +75,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/prompt"
+	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
@@ -86,10 +87,12 @@ import (
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cloud/imds"
+	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/events/filesessions"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/pam"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -103,8 +106,8 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 type integrationTestSuite struct {
@@ -122,7 +125,7 @@ func (s *integrationTestSuite) bind(test integrationTest) func(t *testing.T) {
 		// Attempt to set a logger for the test. Be warned that parts of the
 		// Teleport codebase do not honor the logger passed in via config and
 		// will create their own. Do not expect to catch _all_ output with this.
-		s.Log = utils.NewSlogLoggerForTests()
+		s.Log = logtest.NewLogger()
 		os.RemoveAll(profile.FullProfilePath(""))
 		t.Cleanup(func() { s.Log = nil })
 		test(t, s)
@@ -146,8 +149,8 @@ func TestIntegrations(t *testing.T) {
 	t.Run("BPFSessionDifferentiation", suite.bind(testBPFSessionDifferentiation))
 	t.Run("ClientIdleConnection", suite.bind(testClientIdleConnection))
 	t.Run("CmdLabels", suite.bind(testCmdLabels))
+	t.Run("CreateAndUpdateTrustedClusters", suite.bind(testCreateAndUpdateTrustedClusters))
 	t.Run("ControlMaster", suite.bind(testControlMaster))
-	t.Run("X11Forwarding", suite.bind(testX11Forwarding))
 	t.Run("CustomReverseTunnel", suite.bind(testCustomReverseTunnel))
 	t.Run("DataTransfer", suite.bind(testDataTransfer))
 	t.Run("DifferentPinnedIP", suite.bind(testDifferentPinnedIP))
@@ -188,6 +191,7 @@ func TestIntegrations(t *testing.T) {
 	t.Run("SessionRecordingModes", suite.bind(testSessionRecordingModes))
 	t.Run("SessionStreaming", suite.bind(testSessionStreaming))
 	t.Run("SFTP", suite.bind(testSFTP))
+	t.Run("WebSFTP", suite.bind(testWebSFTP))
 	t.Run("SSHExitCode", suite.bind(testSSHExitCode))
 	t.Run("SSHTracker", suite.bind(testSSHTracker))
 	t.Run("Shutdown", suite.bind(testShutdown))
@@ -196,17 +200,17 @@ func TestIntegrations(t *testing.T) {
 	t.Run("TrustedClustersRoleMapChanges", suite.bind(testTrustedClustersRoleMapChanges))
 	t.Run("TrustedClustersWithLabels", suite.bind(testTrustedClustersWithLabels))
 	t.Run("TrustedClustersSkipNameValidation", suite.bind(testTrustedClustersSkipNameValidation))
-	t.Run("CreateAndUpdateTrustedClusters", suite.bind(testCreateAndUpdateTrustedClusters))
 	t.Run("TrustedTunnelNode", suite.bind(testTrustedTunnelNode))
 	t.Run("TwoClustersProxy", suite.bind(testTwoClustersProxy))
 	t.Run("TwoClustersTunnel", suite.bind(testTwoClustersTunnel))
 	t.Run("UUIDBasedProxy", suite.bind(testUUIDBasedProxy))
 	t.Run("WindowChange", suite.bind(testWindowChange))
+	t.Run("X11Forwarding", suite.bind(testX11Forwarding))
 }
 
 // testDifferentPinnedIP tests connection is rejected when source IP doesn't match the pinned one
 func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
@@ -214,10 +218,7 @@ func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) {
 	tconf := suite.defaultServiceConfig()
 	tconf.Auth.Enabled = true
 	tconf.Proxy.Enabled = true
-	tconf.Proxy.DisableWebService = true
-	tconf.Proxy.DisableWebInterface = true
 	tconf.SSH.Enabled = true
-	tconf.SSH.DisableCreateHostUser = true
 
 	teleInstance := suite.NewTeleportInstance(t)
 
@@ -236,7 +237,7 @@ func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) {
 	site := teleInstance.GetSiteAPI(helpers.Site)
 	require.NotNil(t, site)
 
-	connectionProblem := func(t require.TestingT, err error, i ...interface{}) {
+	connectionProblem := func(t require.TestingT, err error, i ...any) {
 		require.Error(t, err, i...)
 		require.True(t, trace.IsConnectionProblem(err), "expected a connection problem error, got: %v", err)
 	}
@@ -292,10 +293,7 @@ func testAuthLocalNodeControlStream(t *testing.T, suite *integrationTestSuite) {
 	tconf := suite.defaultServiceConfig()
 	tconf.Auth.Enabled = true
 	tconf.Proxy.Enabled = true
-	tconf.Proxy.DisableWebService = true
-	tconf.Proxy.DisableWebInterface = true
 	tconf.SSH.Enabled = true
-	tconf.SSH.DisableCreateHostUser = true
 
 	// deliberately create a teleport instance that will end up binding
 	// unspecified addr (`0.0.0.0`/`::`). we use this further down to confirm
@@ -417,8 +415,6 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 				tconf.Auth.AuditConfig = auditConfig
 				tconf.Auth.SessionRecordingConfig = recConfig
 				tconf.Proxy.Enabled = true
-				tconf.Proxy.DisableWebService = true
-				tconf.Proxy.DisableWebInterface = true
 				tconf.SSH.Enabled = true
 				return t, nil, nil, tconf
 			}
@@ -430,7 +426,6 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 
 			// Start a node.
 			nodeConf := suite.defaultServiceConfig()
-			nodeConf.HostUUID = "node"
 			nodeConf.Hostname = "node"
 			nodeConf.SSH.Enabled = true
 			nodeConf.SSH.Addr.Addr = helpers.NewListener(t, service.ListenerNodeSSH, &nodeConf.FileDescriptors)
@@ -441,7 +436,7 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 			site := teleport.GetSiteAPI(helpers.Site)
 			require.NotNil(t, site)
 
-			ctx := context.Background()
+			ctx := t.Context()
 
 			// wait for both nodes to show up, otherwise
 			// we'll have trouble connecting to the node below.
@@ -527,6 +522,7 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 				}
 			}
 
+			// Test streaming events and recording.
 			capturedStream, sessionEvents := streamSession(ctx, t, site, sessionID)
 
 			findByType := func(et string) apievents.AuditEvent {
@@ -537,19 +533,6 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 				}
 				return nil
 			}
-			// helper that asserts that a session event is also included in the
-			// general audit log.
-			requireInAuditLog := func(t *testing.T, sessionEvent apievents.AuditEvent) {
-				t.Helper()
-				auditEvents, _, err := site.SearchEvents(ctx, events.SearchEventsRequest{
-					To:         time.Now(),
-					EventTypes: []string{sessionEvent.GetType()},
-				})
-				require.NoError(t, err)
-				require.True(t, slices.ContainsFunc(auditEvents, func(ae apievents.AuditEvent) bool {
-					return ae.GetID() == sessionEvent.GetID()
-				}))
-			}
 
 			// there should always be 'session.start' event (and it must be first)
 			first := sessionEvents[0].(*apievents.SessionStart)
@@ -557,19 +540,16 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 			require.Equal(t, first, start)
 			require.Equal(t, sessionID, start.SessionID)
 			require.NotEmpty(t, start.TerminalSize)
-			requireInAuditLog(t, start)
 
 			// there should always be 'session.end' event
 			end := findByType(events.SessionEndEvent).(*apievents.SessionEnd)
 			require.NotNil(t, end)
 			require.Equal(t, sessionID, end.SessionID)
-			requireInAuditLog(t, end)
 
 			// there should always be 'session.leave' event
 			leave := findByType(events.SessionLeaveEvent).(*apievents.SessionLeave)
 			require.NotNil(t, leave)
 			require.Equal(t, sessionID, leave.SessionID)
-			requireInAuditLog(t, leave)
 
 			// all of them should have a proper time
 			for _, e := range sessionEvents {
@@ -580,6 +560,31 @@ func testAuditOn(t *testing.T, suite *integrationTestSuite) {
 			recorded := replaceNewlines(capturedStream)
 			require.Regexp(t, ".*exit.*", recorded)
 			require.Regexp(t, ".*echo hi.*", recorded)
+
+			sessionEvents, _, err = site.SearchEvents(ctx, events.SearchEventsRequest{
+				From: time.Time{},
+				To:   time.Now(),
+				EventTypes: []string{
+					events.SessionStartEvent,
+					events.SessionLeaveEvent,
+					events.SessionEndEvent,
+				},
+			})
+			require.NoError(t, err)
+
+			// Check that the events found above in the session stream show up in the backend.
+			require.True(t, slices.ContainsFunc(sessionEvents, func(ae apievents.AuditEvent) bool {
+				return ae.GetID() == start.GetID()
+			}), "expected session events to contain session.start event")
+			require.True(t, slices.ContainsFunc(sessionEvents, func(ae apievents.AuditEvent) bool {
+				return ae.GetID() == end.GetID()
+			}), "expected session events to contain session.end event")
+			require.True(t, slices.ContainsFunc(sessionEvents, func(ae apievents.AuditEvent) bool {
+				return ae.GetID() == leave.GetID()
+			}), "expected session events to contain session.leave event")
+
+			// Ensure there are no duplicate events, e.g. from proxy recording mode.
+			require.Len(t, sessionEvents, 3, "%d unexpected duplicate events", len(sessionEvents)-4)
 		})
 	}
 }
@@ -732,7 +737,6 @@ func (s *integrationTestSuite) newTeleportIoT(t *testing.T, logins []string) *he
 
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 
 		tconf.SSH.Enabled = false
 
@@ -771,7 +775,7 @@ func replaceNewlines(in string) string {
 // TestUUIDBasedProxy verifies that attempts to proxy to nodes using ambiguous
 // hostnames fails with the correct error, and that proxying by UUID succeeds.
 func testUUIDBasedProxy(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
@@ -793,7 +797,8 @@ func testUUIDBasedProxy(t *testing.T, suite *integrationTestSuite) {
 			return "", trace.Wrap(err)
 		}
 
-		return node.Config.HostUUID, nil
+		uuid, err := node.WaitForHostID(t.Context())
+		return uuid, trace.Wrap(err)
 	}
 
 	// add two nodes with the same hostname.
@@ -808,18 +813,18 @@ func testUUIDBasedProxy(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// attempting to run a command by hostname should generate NodeIsAmbiguous error.
-	_, err = runCommand(t, teleportSvr, []string{"echo", "Hello there!"}, helpers.ClientConfig{Login: suite.Me.Username, Cluster: helpers.Site, Host: Host}, 1)
+	_, err = runCommand(t.Context(), teleportSvr, []string{"echo", "Hello there!"}, helpers.ClientConfig{Login: suite.Me.Username, Cluster: helpers.Site, Host: Host}, 1)
 	require.Error(t, err)
 	require.ErrorContains(t, err, "ambiguous")
 
 	// attempting to run a command by uuid should succeed.
-	_, err = runCommand(t, teleportSvr, []string{"echo", "Hello there!"}, helpers.ClientConfig{Login: suite.Me.Username, Cluster: helpers.Site, Host: uuid1}, 1)
+	_, err = runCommand(t.Context(), teleportSvr, []string{"echo", "Hello there!"}, helpers.ClientConfig{Login: suite.Me.Username, Cluster: helpers.Site, Host: uuid1}, 1)
 	require.NoError(t, err)
 }
 
 // testSSHTracker verifies that an SSH session creates a tracker for sessions.
 func testSSHTracker(t *testing.T, suite *integrationTestSuite) {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
 
 	teleport := suite.newTeleport(t, nil, true)
@@ -880,7 +885,7 @@ func testInteractiveReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 }
 
 func testSessionRecordingModes(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -893,8 +898,6 @@ func testSessionRecordingModes(t *testing.T, suite *integrationTestSuite) {
 	cfg := suite.defaultServiceConfig()
 	cfg.Auth.Enabled = true
 	cfg.Auth.SessionRecordingConfig = recConfig
-	cfg.Proxy.DisableWebService = true
-	cfg.Proxy.DisableWebInterface = true
 	cfg.Proxy.Enabled = true
 	cfg.SSH.Enabled = true
 
@@ -945,7 +948,6 @@ func testSessionRecordingModes(t *testing.T, suite *integrationTestSuite) {
 		filesessions.SetOpenFileFunc(os.OpenFile)
 	}
 
-	teleport.WaitForNodeCount(ctx, helpers.Site, 1)
 	for name, test := range map[string]struct {
 		recordingMode        constants.SessionRecordingMode
 		expectSessionFailure bool
@@ -1105,7 +1107,7 @@ func testLeafProxySessionRecording(t *testing.T, suite *integrationTestSuite) {
 			})
 			require.NoError(t, err)
 
-			ctx := context.Background()
+			ctx := t.Context()
 			clt, err := tc.ConnectToCluster(ctx)
 			require.NoError(t, err)
 			t.Cleanup(func() {
@@ -1128,7 +1130,7 @@ func testLeafProxySessionRecording(t *testing.T, suite *integrationTestSuite) {
 				)
 				assert.NoError(t, err)
 
-				errCh <- nodeClient.RunInteractiveShell(ctx, types.SessionPeerMode, nil, nil, nil)
+				errCh <- nodeClient.RunInteractiveShell(ctx, "", "", nil)
 				assert.NoError(t, nodeClient.Close())
 			}()
 
@@ -1217,8 +1219,6 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 	conf.Auth.Enabled = true
 	conf.Proxy.Enabled = true
 	conf.Proxy.DisableWebService = false
-	conf.Proxy.DisableWebInterface = true
-	conf.Proxy.DisableDatabaseProxy = true
 	conf.Proxy.TunnelPublicAddrs = []utils.NetAddr{
 		{
 			// Connect on the address that refuses connection on purpose
@@ -1407,7 +1407,6 @@ func testIPPropagation(t *testing.T, suite *integrationTestSuite) {
 			conf.SetToken("token")
 			conf.Testing.UploadEventsC = i.UploadEventsC
 			conf.SetAuthServerAddress(*utils.MustParseAddr(net.JoinHostPort(i.Hostname, helpers.PortStr(t, i.Web))))
-			conf.HostUUID = name
 			conf.Hostname = name
 			conf.SSH.Enabled = true
 			conf.CachePolicy = servicecfg.CachePolicy{
@@ -1453,7 +1452,7 @@ func testIPPropagation(t *testing.T, suite *integrationTestSuite) {
 
 	testGRPCNodeConnection := func(t *testing.T, instance *helpers.TeleInstance, clusterName, nodeName string) {
 		person := NewTerminal(250)
-		ctx := context.Background()
+		ctx := t.Context()
 
 		tc, err := instance.NewClient(helpers.ClientConfig{
 			Login:   suite.Me.Username,
@@ -1502,7 +1501,7 @@ func testIPPropagation(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	testGRPCAuthConnection := func(t *testing.T, instance *helpers.TeleInstance, clusterName string) {
-		ctx := context.Background()
+		ctx := t.Context()
 
 		tc, err := instance.NewClient(helpers.ClientConfig{
 			Login:   suite.Me.Username,
@@ -1707,7 +1706,7 @@ func testShutdown(t *testing.T, suite *integrationTestSuite) {
 				tc.Stdin = term
 				tc.Stdout = term
 
-				sshCtx, sshCancel := context.WithCancel(context.Background())
+				sshCtx, sshCancel := context.WithCancel(t.Context())
 				t.Cleanup(sshCancel)
 				go func() {
 					sshErr <- tc.SSH(sshCtx, nil)
@@ -1732,7 +1731,7 @@ func testShutdown(t *testing.T, suite *integrationTestSuite) {
 				require.NoError(t, err)
 
 				go func() {
-					err := utils.ProxyConn(context.Background(), term, stream)
+					err := utils.ProxyConn(t.Context(), term, stream)
 					sshErr <- err
 				}()
 			},
@@ -1749,7 +1748,6 @@ func testShutdown(t *testing.T, suite *integrationTestSuite) {
 			cfg.Auth.Enabled = true
 			cfg.Auth.Preference.SetSecondFactor("off")
 			cfg.Proxy.DisableWebService = false
-			cfg.Proxy.DisableWebInterface = true
 			cfg.Proxy.Enabled = true
 			cfg.SSH.Enabled = true
 
@@ -1780,7 +1778,7 @@ func testShutdown(t *testing.T, suite *integrationTestSuite) {
 			}, 10*time.Second, 200*time.Millisecond)
 
 			// initiate shutdown
-			shutdownContext := teleport.Process.StartShutdown(context.Background())
+			shutdownContext := teleport.Process.StartShutdown(t.Context())
 
 			require.Eventually(t, func() bool {
 				// TODO: check that we either get a connection that fully works or a connection refused error
@@ -1841,7 +1839,6 @@ type disconnectTestCase struct {
 	concurrentConns   int
 	sessCtlTimeout    time.Duration
 	postFunc          func(context.Context, *testing.T, *helpers.TeleInstance)
-	clientConfigOpts  func(*helpers.ClientConfig)
 
 	// verifyError checks if `err` reflects the error expected by the test scenario.
 	// It returns nil if yes, non-nil otherwise.
@@ -1904,14 +1901,9 @@ func testClientIdleConnection(t *testing.T, suite *integrationTestSuite) {
 	netConfig := types.DefaultClusterNetworkingConfig()
 	netConfig.SetClientIdleTimeout(3 * time.Second)
 
-	tconf := servicecfg.MakeDefaultConfig()
+	tconf := suite.defaultServiceConfig()
 	tconf.SSH.Enabled = true
-	tconf.Logger = utils.NewSlogLoggerForTests()
-	tconf.Proxy.DisableWebService = true
-	tconf.Proxy.DisableWebInterface = true
 	tconf.Auth.NetworkingConfig = netConfig
-	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	tconf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 
 	instance := suite.NewTeleportWithConfig(t, nil, nil, tconf)
 	t.Cleanup(func() { require.NoError(t, instance.StopAll()) })
@@ -1939,7 +1931,7 @@ func testClientIdleConnection(t *testing.T, suite *integrationTestSuite) {
 		cl.Stdin = reader
 
 		// Terminate the session after 2x the idle timeout
-		ctx, cancel := context.WithTimeout(context.Background(), netConfig.GetClientIdleTimeout()*2)
+		ctx, cancel := context.WithTimeout(t.Context(), netConfig.GetClientIdleTimeout()*2)
 		defer cancel()
 		sessionErr <- cl.SSH(ctx, nil)
 	}
@@ -1991,7 +1983,6 @@ func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 				MaxSessionTTL:         types.NewDuration(2 * time.Second),
 			},
 			disconnectTimeout: 4 * time.Second,
-			clientConfigOpts:  func(cc *helpers.ClientConfig) { cc.DisableSSHResumption = true },
 		},
 		{
 			name:          "expired cert proxy recording",
@@ -2002,7 +1993,6 @@ func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 				MaxSessionTTL:         types.NewDuration(2 * time.Second),
 			},
 			disconnectTimeout: 4 * time.Second,
-			clientConfigOpts:  func(cc *helpers.ClientConfig) { cc.DisableSSHResumption = true },
 		},
 		{
 			name:          "concurrent connection limits exceeded node recording",
@@ -2033,17 +2023,23 @@ func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 			},
 			disconnectTimeout: time.Second,
 			sessCtlTimeout:    500 * time.Millisecond,
-			clientConfigOpts:  func(cc *helpers.ClientConfig) { cc.DisableSSHResumption = true },
 			// use postFunc to wait for the semaphore to be acquired and a session
 			// to be started, then shut down the auth server.
 			postFunc: func(ctx context.Context, t *testing.T, teleport *helpers.TeleInstance) {
 				site := teleport.GetSiteAPI(helpers.Site)
 				require.EventuallyWithT(t, func(t *assert.CollectT) {
-					sems, err := site.GetSemaphores(ctx, types.SemaphoreFilter{
+					filter := types.SemaphoreFilter{
 						SemaphoreKind: types.SemaphoreKindConnection,
-					})
-					assert.NoError(t, err)
-					assert.Len(t, sems, 1)
+					}
+					sems, err := site.GetSemaphores(ctx, filter)
+					require.NoError(t, err)
+					require.Len(t, sems, 1)
+
+					sems, next, err := site.ListSemaphores(ctx, 0, "", &filter)
+					require.Empty(t, next)
+					require.NoError(t, err)
+					require.Len(t, sems, 1)
+
 				}, 2*time.Second, 100*time.Millisecond)
 
 				timeoutCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
@@ -2065,7 +2061,7 @@ func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 }
 
 func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectTestCase) {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
 
 	teleport := suite.NewTeleportInstance(t)
@@ -2095,8 +2091,6 @@ func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectT
 	cfg.Auth.Enabled = true
 	cfg.Auth.NetworkingConfig = netConfig
 	cfg.Auth.SessionRecordingConfig = recConfig
-	cfg.Proxy.DisableWebService = true
-	cfg.Proxy.DisableWebInterface = true
 	cfg.Proxy.Enabled = true
 	cfg.SSH.Enabled = true
 
@@ -2109,9 +2103,6 @@ func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectT
 		tc.concurrentConns = 1
 	}
 
-	err = teleport.WaitForNodeCount(ctx, helpers.Site, 1)
-	require.NoError(t, err)
-
 	asyncErrors := make(chan error, 1)
 
 	for i := 0; i < tc.concurrentConns; i++ {
@@ -2120,13 +2111,11 @@ func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectT
 		openSession := func() {
 			defer cancel()
 			cc := helpers.ClientConfig{
-				Login:   username,
-				Cluster: helpers.Site,
-				Host:    Host,
-				Port:    helpers.Port(t, teleport.SSH),
-			}
-			if tc.clientConfigOpts != nil {
-				tc.clientConfigOpts(&cc)
+				Login:                username,
+				Cluster:              helpers.Site,
+				Host:                 Host,
+				Port:                 helpers.Port(t, teleport.SSH),
+				DisableSSHResumption: true,
 			}
 			cl, err := teleport.NewClient(cc)
 			if err != nil {
@@ -2230,7 +2219,7 @@ func enterInput(ctx context.Context, person *Terminal, command, pattern string)
 // testEnvironmentVariables validates that session specific environment
 // variables set by Teleport are present.
 func testEnvironmentVariables(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -2246,17 +2235,14 @@ func testEnvironmentVariables(t *testing.T, suite *integrationTestSuite) {
 	})
 	require.NoError(t, err)
 
-	tc.SessionID = uuid.NewString()
-
-	// The SessionID and Web address should be set in the session env vars.
-	cmd := []string{"printenv", sshutils.SessionEnvVar, ";", "printenv", teleport.SSHSessionWebProxyAddr}
+	// The Web address should be set in the session env vars.
+	cmd := []string{"printenv", teleport.SSHSessionWebProxyAddr}
 	out := &bytes.Buffer{}
 	tc.Stdout = out
 	tc.Stdin = nil
 	err = tc.SSH(ctx, cmd)
 	require.NoError(t, err)
 	output := out.String()
-	require.Contains(t, output, tc.SessionID)
 	require.Contains(t, output, tc.WebProxyAddr)
 
 	term := NewTerminal(250)
@@ -2265,7 +2251,6 @@ func testEnvironmentVariables(t *testing.T, suite *integrationTestSuite) {
 	err = tc.SSH(ctx, nil)
 	require.NoError(t, err)
 	output = term.AllOutput()
-	require.Contains(t, output, tc.SessionID)
 	require.Contains(t, output, tc.WebProxyAddr)
 }
 
@@ -2291,8 +2276,8 @@ func testInvalidLogins(t *testing.T, suite *integrationTestSuite) {
 	})
 	require.NoError(t, err)
 
-	err = tc.SSH(context.Background(), cmd)
-	require.ErrorIs(t, err, trace.NotFound("failed to dial target host\n\tlooking up remote cluster \"wrong-site\"\n\t\tnot found"))
+	err = tc.SSH(t.Context(), cmd)
+	require.ErrorContains(t, err, "failed connecting to host localhost: looking up remote cluster \"wrong-site\"\n\tnot found")
 }
 
 // TestTwoClustersTunnel creates two teleport clusters: "a" and "b" and creates a
@@ -2339,11 +2324,11 @@ func testTwoClustersTunnel(t *testing.T, suite *integrationTestSuite) {
 		})
 	}
 
-	slog.InfoContext(context.Background(), "Tests done,cleaning up")
+	slog.InfoContext(t.Context(), "Tests done,cleaning up")
 }
 
 func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time, proxyRecordMode string, execCountSiteA, execCountSiteB int) {
-	ctx := context.Background()
+	ctx := t.Context()
 	// start the http proxy, we need to make sure this was not used
 	ph := &helpers.ProxyHandler{}
 	ts := httptest.NewServer(ph)
@@ -2370,16 +2355,12 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 	acfg := suite.defaultServiceConfig()
 	acfg.Auth.Enabled = true
 	acfg.Proxy.Enabled = true
-	acfg.Proxy.DisableWebService = true
-	acfg.Proxy.DisableWebInterface = true
 	acfg.SSH.Enabled = true
 
 	bcfg := suite.defaultServiceConfig()
 	bcfg.Auth.Enabled = true
 	bcfg.Auth.SessionRecordingConfig = recConfig
 	bcfg.Proxy.Enabled = true
-	bcfg.Proxy.DisableWebService = true
-	bcfg.Proxy.DisableWebInterface = true
 	bcfg.SSH.Enabled = false
 
 	require.NoError(t, b.CreateEx(t, a.Secrets.AsSlice(), bcfg))
@@ -2455,6 +2436,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 	})
 	require.NoError(t, err)
 	tc.Stdout = &outputB
+
 	err = tc.SSH(ctx, cmd)
 	require.NoError(t, err)
 	require.Equal(t, outputA.String(), outputB.String())
@@ -2571,7 +2553,7 @@ func testTwoClustersProxy(t *testing.T, suite *integrationTestSuite) {
 // and we switch to local persistent caches
 func testHA(t *testing.T, suite *integrationTestSuite) {
 	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -2608,6 +2590,10 @@ func testHA(t *testing.T, suite *integrationTestSuite) {
 	require.Eventually(t, helpers.WaitForClusters(b.Tunnel, 1), 10*time.Second, 1*time.Second,
 		"Two clusters do not see each other: tunnels are not working.")
 
+	// Wait for nodes to be visible before attempting connections
+	err = b.WaitForNodeCount(ctx, "cluster-a", 2)
+	require.NoError(t, err)
+
 	cmd := []string{"echo", "hello world"}
 	tc, err := b.NewClient(helpers.ClientConfig{
 		Login:   username,
@@ -2617,19 +2603,16 @@ func testHA(t *testing.T, suite *integrationTestSuite) {
 	})
 	require.NoError(t, err)
 
+	// Wait for nodes to be visible before attempting connections
+	err = b.WaitForNodeCount(ctx, "cluster-a", 2)
+	require.NoError(t, err)
+
 	output := &bytes.Buffer{}
 	tc.Stdout = output
-	// try to execute an SSH command using the same old client  to helpers.Site-B
+	// try to execute an SSH command using the same old client to helpers.Site-B
 	// "site-A" and "site-B" reverse tunnels are supposed to reconnect,
 	// and 'tc' (client) is also supposed to reconnect
-	for i := 0; i < 10; i++ {
-		time.Sleep(time.Millisecond * 50)
-		err = tc.SSH(ctx, cmd)
-		if err == nil {
-			break
-		}
-	}
-	require.NoError(t, err)
+	require.NoError(t, tc.SSH(ctx, cmd))
 	require.Equal(t, "hello world\n", output.String())
 
 	// Stop cluster "a" to force existing tunnels to close.
@@ -2652,17 +2635,14 @@ func testHA(t *testing.T, suite *integrationTestSuite) {
 	require.Eventually(t, helpers.WaitForClusters(b.Tunnel, 1), 10*time.Second, 1*time.Second,
 		"Two clusters do not see each other: tunnels are not working.")
 
+	// Wait for nodes to be visible before attempting connections
+	err = b.WaitForNodeCount(ctx, "cluster-a", 2)
+	require.NoError(t, err)
+
 	// try to execute an SSH command using the same old client to site-B
 	// "site-A" and "site-B" reverse tunnels are supposed to reconnect,
 	// and 'tc' (client) is also supposed to reconnect
-	for i := 0; i < 30; i++ {
-		time.Sleep(1 * time.Second)
-		err = tc.SSH(ctx, cmd)
-		if err == nil {
-			break
-		}
-	}
-	require.NoError(t, err)
+	require.NoError(t, tc.SSH(ctx, cmd))
 
 	// stop cluster and remaining nodes
 	require.NoError(t, a.StopAll())
@@ -2671,7 +2651,7 @@ func testHA(t *testing.T, suite *integrationTestSuite) {
 
 // TestMapRoles tests local to remote role mapping and access patterns
 func testMapRoles(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -2700,7 +2680,6 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 		tconf.SSH.Enabled = enableSSH
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		return t, nil, tconf
 	}
 	lib.SetInsecureDevMode(true)
@@ -2980,7 +2959,7 @@ func standardPortsOrMuxSetup(t *testing.T, mux bool, fds *[]*servicecfg.FileDesc
 }
 
 func createAndUpdateTrustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClusterTest) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3023,7 +3002,6 @@ func createAndUpdateTrustedClusters(t *testing.T, suite *integrationTestSuite, t
 	makeConfig := func(instance *helpers.TeleInstance, enableSSH bool) (*testing.T, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		tconf, err := instance.GenerateConfig(t, nil, tconf)
 		require.NoError(t, err)
@@ -3090,7 +3068,7 @@ func createAndUpdateTrustedClusters(t *testing.T, suite *integrationTestSuite, t
 }
 
 func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClusterTest) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3150,7 +3128,6 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	makeConfig := func(enableSSH bool) (*testing.T, []*helpers.InstanceSecrets, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		return t, nil, tconf
 	}
@@ -3287,14 +3264,16 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	// after removing the remote cluster and trusted cluster, the connection will start failing
 	require.NoError(t, main.Process.GetAuthServer().DeleteRemoteCluster(ctx, clusterAux))
 	require.NoError(t, aux.Process.GetAuthServer().DeleteTrustedCluster(ctx, trustedCluster.GetName()))
-	for i := 0; i < 10; i++ {
-		time.Sleep(time.Millisecond * 50)
-		err = tc.SSH(ctx, cmd)
-		if err != nil {
-			break
-		}
-	}
-	require.Error(t, err, "expected tunnel to close and SSH client to start failing")
+
+	// wait for the leaf cluster to disappear
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err := main.Tunnel.Cluster(ctx, clusterAux)
+		require.True(t, trace.IsNotFound(err))
+	}, 20*time.Second, 500*time.Millisecond)
+
+	// validate connections fail
+	err = tc.SSH(ctx, cmd)
+	require.True(t, trace.IsNotFound(err))
 
 	// recreating the trusted cluster should re-establish connection
 	_, err = aux.Process.GetAuthServer().UpsertTrustedClusterV2(ctx, trustedCluster)
@@ -3317,14 +3296,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	// connection and client should recover and work again
 	output = &bytes.Buffer{}
 	tc.Stdout = output
-	for i := 0; i < 10; i++ {
-		time.Sleep(time.Millisecond * 50)
-		err = tc.SSH(ctx, cmd)
-		if err == nil {
-			break
-		}
-	}
-	require.NoError(t, err)
+	require.NoError(t, tc.SSH(ctx, cmd))
 	require.Equal(t, "hello world\n", output.String())
 
 	// stop clusters and remaining nodes
@@ -3333,7 +3305,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 }
 
 func trustedDisabledCluster(t *testing.T, suite *integrationTestSuite, test trustedClusterTest) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3396,7 +3368,6 @@ func trustedDisabledCluster(t *testing.T, suite *integrationTestSuite, test trus
 	makeConfig := func(instance *helpers.TeleInstance, enableSSH bool) (*testing.T, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		tconf, err := instance.GenerateConfig(t, nil, tconf)
 		require.NoError(t, err)
@@ -3473,7 +3444,7 @@ func trustedDisabledCluster(t *testing.T, suite *integrationTestSuite, test trus
 }
 
 func trustedClustersRoleMapChanges(t *testing.T, suite *integrationTestSuite, test trustedClusterTest) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3535,7 +3506,6 @@ func trustedClustersRoleMapChanges(t *testing.T, suite *integrationTestSuite, te
 	makeConfig := func(instance *helpers.TeleInstance, enableSSH bool) (*testing.T, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		tconf, err := instance.GenerateConfig(t, nil, tconf)
 		require.NoError(t, err)
@@ -3620,7 +3590,7 @@ func trustedClustersRoleMapChanges(t *testing.T, suite *integrationTestSuite, te
 }
 
 func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3644,7 +3614,6 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 	makeConfig := func(enableSSH bool) (*testing.T, []*helpers.InstanceSecrets, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500
 		return t, nil, tconf
@@ -3751,7 +3720,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 
 	// Use assert package to get access to the returned error. In this way we can log it.
 	if !assert.Eventually(t, func() bool {
-		err = tunnelClient.SSH(context.Background(), cmd)
+		err = tunnelClient.SSH(t.Context(), cmd)
 		return err == nil
 	}, 10*time.Second, 200*time.Millisecond) {
 		require.FailNow(t, "Failed to established SSH connection", err)
@@ -3765,7 +3734,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 }
 
 func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 
 	clusterMain := "cluster-main"
@@ -3787,7 +3756,6 @@ func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) {
 	makeConfig := func(enableSSH bool) (*testing.T, []*helpers.InstanceSecrets, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = enableSSH
 		return t, nil, tconf
 	}
@@ -3873,8 +3841,10 @@ func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) {
 		"Two clusters do not see each other: tunnels are not working.")
 
 	// create agentless node in leaf cluster
-	node := testenv.CreateAgentlessNode(t, leaf.Process.GetAuthServer(), clusterAux, "leaf-agentless-node")
+	node := CreateAgentlessNode(t, leaf.Process.GetAuthServer(), clusterAux, "leaf-agentless-node")
 
+	err = main.WaitForNodeCount(ctx, clusterAux, 1)
+	require.NoError(t, err)
 	// connect to leaf agentless node
 	creds, err := helpers.GenerateUserCreds(helpers.UserCredsRequest{
 		Process:        main.Process,
@@ -3911,7 +3881,7 @@ func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) {
 // TestDiscoveryRecovers ensures that discovery protocol recovers from a bad discovery
 // state (all known proxies are offline).
 func testDiscoveryRecovers(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -3997,7 +3967,7 @@ func testDiscoveryRecovers(t *testing.T, suite *integrationTestSuite) {
 			Port:    helpers.Port(t, remote.SSH),
 			Proxy:   conf,
 		}
-		output, err := runCommand(t, main, []string{"echo", "hello world"}, clientConf, 10)
+		output, err := runCommand(t.Context(), main, []string{"echo", "hello world"}, clientConf, 10)
 		if shouldFail {
 			require.Error(t, err)
 		} else {
@@ -4046,7 +4016,7 @@ func testDiscoveryRecovers(t *testing.T, suite *integrationTestSuite) {
 // TestDiscovery tests case for multiple proxies and a reverse tunnel
 // agent that eventually connnects to the right proxy
 func testDiscovery(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -4113,7 +4083,7 @@ func testDiscovery(t *testing.T, suite *integrationTestSuite) {
 		Host:    Loopback,
 		Port:    helpers.Port(t, remote.SSH),
 	}
-	output, err := runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	output, err := runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4128,7 +4098,7 @@ func testDiscovery(t *testing.T, suite *integrationTestSuite) {
 		Port:    helpers.Port(t, remote.SSH),
 		Proxy:   &proxyConfig,
 	}
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 10)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 10)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4137,11 +4107,11 @@ func testDiscovery(t *testing.T, suite *integrationTestSuite) {
 	helpers.WaitForActiveTunnelConnections(t, secondProxy, "cluster-remote", 1)
 
 	// Requests going via main proxy should fail.
-	_, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	_, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.Error(t, err)
 
 	// Requests going via second proxy should succeed.
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 1)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4159,7 +4129,7 @@ func testDiscovery(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// Requests going via main proxy should succeed.
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4179,7 +4149,7 @@ func testDiscovery(t *testing.T, suite *integrationTestSuite) {
 // nodes will reconnect when network connection between the proxy and node
 // is restored.
 func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	t.Cleanup(func() { tr.Stop() })
 
@@ -4208,8 +4178,6 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 			},
 		}
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
-		tconf.Proxy.DisableALPNSNIListener = true
 
 		tconf.SSH.Enabled = false
 
@@ -4278,7 +4246,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 		Cluster: helpers.Site,
 		Host:    "cluster-main-node",
 	}
-	_, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	_, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.Error(t, err)
 
 	cfgProxy := helpers.ClientConfig{
@@ -4288,7 +4256,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 		Proxy:   &proxyConfig,
 	}
 
-	output, err := runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 10)
+	output, err := runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 10)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4298,14 +4266,14 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 	helpers.WaitForActiveTunnelConnections(t, proxyTunnel, helpers.Site, 0)
 
 	// Requests going via both proxy will fail.
-	timeoutCtx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	timeoutCtx, cancel := context.WithTimeout(t.Context(), 1*time.Second)
 	defer invoke(cancel)
-	_, err = runCommandWithContext(timeoutCtx, t, main, []string{"echo", "hello world"}, cfg, 1)
+	_, err = runCommand(timeoutCtx, main, []string{"echo", "hello world"}, cfg, 1)
 	require.Error(t, err)
 
-	timeoutCtx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
+	timeoutCtx, cancel = context.WithTimeout(t.Context(), 1*time.Second)
 	defer invoke(cancel)
-	_, err = runCommandWithContext(timeoutCtx, t, main, []string{"echo", "hello world"}, cfgProxy, 1)
+	_, err = runCommand(timeoutCtx, main, []string{"echo", "hello world"}, cfgProxy, 1)
 	require.Error(t, err)
 
 	// wait for the node to reach a degraded state
@@ -4320,9 +4288,9 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 	helpers.WaitForActiveTunnelConnections(t, proxyTunnel, helpers.Site, 1)
 
 	// Requests going to the connected proxy should succeed.
-	_, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	_, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.Error(t, err)
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 40)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 40)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4333,7 +4301,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 
 // TestDiscoveryNode makes sure the discovery protocol works with nodes.
 func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
@@ -4363,8 +4331,6 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 			},
 		}
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
-		tconf.Proxy.DisableALPNSNIListener = true
 
 		tconf.SSH.Enabled = false
 
@@ -4427,7 +4393,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 		Host:    "cluster-main-node",
 	}
 
-	output, err := runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	output, err := runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4442,7 +4408,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 		Proxy:   &proxyConfig,
 	}
 
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 10)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 10)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4452,10 +4418,10 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 
 	// Requests going via main proxy will succeed. Requests going via second
 	// proxy will fail.
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
-	_, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 1)
+	_, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 1)
 	require.Error(t, err)
 
 	// Add second proxy to LB, both should have a connection.
@@ -4464,10 +4430,10 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 	helpers.WaitForActiveTunnelConnections(t, proxyTunnel, helpers.Site, 1)
 
 	// Requests going via both proxies will succeed.
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfg, 1)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfg, 1)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
-	output, err = runCommand(t, main, []string{"echo", "hello world"}, cfgProxy, 40)
+	output, err = runCommand(t.Context(), main, []string{"echo", "hello world"}, cfgProxy, 40)
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", output)
 
@@ -4555,8 +4521,6 @@ func testExternalClient(t *testing.T, suite *integrationTestSuite) {
 				tconf.Auth.SessionRecordingConfig = recConfig
 
 				tconf.Proxy.Enabled = true
-				tconf.Proxy.DisableWebService = true
-				tconf.Proxy.DisableWebInterface = true
 
 				tconf.SSH.Enabled = true
 
@@ -4651,8 +4615,6 @@ func testControlMaster(t *testing.T, suite *integrationTestSuite) {
 				tconf.Auth.SessionRecordingConfig = recConfig
 
 				tconf.Proxy.Enabled = true
-				tconf.Proxy.DisableWebService = true
-				tconf.Proxy.DisableWebInterface = true
 
 				tconf.SSH.Enabled = true
 
@@ -4745,8 +4707,6 @@ func testX11Forwarding(t *testing.T, suite *integrationTestSuite) {
 			tconf.Auth.SessionRecordingConfig = recConfig
 
 			tconf.Proxy.Enabled = true
-			tconf.Proxy.DisableWebService = true
-			tconf.Proxy.DisableWebInterface = true
 
 			tconf.SSH.Enabled = true
 			tconf.SSH.X11 = &x11.ServerConfig{
@@ -4905,9 +4865,6 @@ func testProxyHostKeyCheck(t *testing.T, suite *integrationTestSuite) {
 				tconf.Auth.SessionRecordingConfig = recConfig
 
 				tconf.Proxy.Enabled = true
-				tconf.Proxy.DisableWebService = true
-				tconf.Proxy.DisableWebInterface = true
-
 				return t, nil, nil, tconf
 			}
 			instance := suite.NewTeleportWithConfig(makeConfig())
@@ -4950,7 +4907,7 @@ func testProxyHostKeyCheck(t *testing.T, suite *integrationTestSuite) {
 			err = instance.WaitForNodeCount(context.Background(), helpers.Site, 2)
 			require.NoError(t, err)
 
-			_, err = runCommand(t, instance, []string{"echo hello"}, clientConfig, 1)
+			_, err = runCommand(t.Context(), instance, []string{"echo hello"}, clientConfig, 1)
 
 			// check if we were able to exec the command or not
 			if tt.outError {
@@ -4967,7 +4924,7 @@ func testProxyHostKeyCheck(t *testing.T, suite *integrationTestSuite) {
 func testAuditOff(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	var err error
 
@@ -4989,8 +4946,6 @@ func testAuditOff(t *testing.T, suite *integrationTestSuite) {
 		tconf.Auth.SessionRecordingConfig = recConfig
 
 		tconf.Proxy.Enabled = true
-		tconf.Proxy.DisableWebService = true
-		tconf.Proxy.DisableWebInterface = true
 
 		tconf.SSH.Enabled = true
 
@@ -5230,8 +5185,6 @@ func testPAM(t *testing.T, suite *integrationTestSuite) {
 				tconf.Auth.Enabled = true
 
 				tconf.Proxy.Enabled = true
-				tconf.Proxy.DisableWebService = true
-				tconf.Proxy.DisableWebInterface = true
 
 				tconf.SSH.Enabled = true
 				tconf.SSH.PAM.Enabled = tt.inEnabled
@@ -5830,13 +5783,11 @@ func (s *integrationTestSuite) rotationConfig(disableWebService bool) *servicecf
 	tconf := s.defaultServiceConfig()
 	tconf.SSH.Enabled = true
 	tconf.Proxy.DisableWebService = disableWebService
-	tconf.Proxy.DisableWebInterface = true
-	tconf.Proxy.DisableDatabaseProxy = true
 	tconf.Proxy.DisableALPNSNIListener = true
 	tconf.PollingPeriod = time.Second
 	tconf.Testing.ClientTimeout = time.Second
 	tconf.Testing.ShutdownTimeout = 2 * tconf.Testing.ClientTimeout
-	tconf.MaxRetryPeriod = time.Second
+	tconf.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(time.Second)
 	return tconf
 }
 
@@ -5876,7 +5827,7 @@ func runAndMatch(tc *client.TeleportClient, attempts int, command []string, patt
 func testWindowChange(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	teleport := suite.newTeleport(t, nil, true)
 	defer teleport.StopAll()
@@ -5993,7 +5944,7 @@ func testWindowChange(t *testing.T, suite *integrationTestSuite) {
 
 // testList checks that the list of servers returned is identity aware.
 func testList(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
@@ -6010,8 +5961,6 @@ func testList(t *testing.T, suite *integrationTestSuite) {
 		tconf.Auth.Enabled = true
 		tconf.Auth.SessionRecordingConfig = recConfig
 		tconf.Proxy.Enabled = true
-		tconf.Proxy.DisableWebService = true
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = true
 		tconf.SSH.Labels = map[string]string{
 			"role": "worker",
@@ -6139,7 +6088,6 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) {
 		tconf.Auth.SessionRecordingConfig = recConfig
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = true
 		tconf.SSH.Labels = map[string]string{
 			"role": "worker",
@@ -6220,7 +6168,7 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) {
 				Labels:  tt.labels,
 			}
 
-			output, err := runCommand(t, teleport, tt.command, cfg, 3)
+			output, err := runCommand(t.Context(), teleport, tt.command, cfg, 3)
 			require.NoError(t, err)
 			outputLines := strings.Split(strings.TrimSpace(output), "\n")
 			require.Len(t, outputLines, len(tt.expectLines), "raw output:\n%v", output)
@@ -6244,9 +6192,6 @@ func testDataTransfer(t *testing.T, suite *integrationTestSuite) {
 	main := suite.newTeleport(t, nil, true)
 	defer main.StopAll()
 
-	err := main.WaitForNodeCount(context.Background(), helpers.Site, 1)
-	require.NoError(t, err)
-
 	// Create a client to the above Teleport cluster.
 	clientConfig := helpers.ClientConfig{
 		Login:   suite.Me.Username,
@@ -6257,7 +6202,7 @@ func testDataTransfer(t *testing.T, suite *integrationTestSuite) {
 
 	// Write 1 MB to stdout.
 	command := []string{"dd", "if=/dev/zero", "bs=1024", "count=1024"}
-	output, err := runCommand(t, main, command, clientConfig, 1)
+	output, err := runCommand(t.Context(), main, command, clientConfig, 1)
 	require.NoError(t, err)
 
 	// Make sure exactly 1 MB was written to output.
@@ -6339,7 +6284,6 @@ func testBPFInteractive(t *testing.T, suite *integrationTestSuite) {
 				// Configure Proxy.
 				tconf.Proxy.Enabled = true
 				tconf.Proxy.DisableWebService = false
-				tconf.Proxy.DisableWebInterface = true
 
 				// Configure Node. If session are being recorded at the proxy, don't enable
 				// BPF to simulate an OpenSSH node.
@@ -6467,7 +6411,6 @@ func testBPFExec(t *testing.T, suite *integrationTestSuite) {
 				// Configure Proxy.
 				tconf.Proxy.Enabled = true
 				tconf.Proxy.DisableWebService = false
-				tconf.Proxy.DisableWebInterface = true
 
 				// Configure Node. If session are being recorded at the proxy, don't enable
 				// BPF to simulate an OpenSSH node.
@@ -6490,7 +6433,7 @@ func testBPFExec(t *testing.T, suite *integrationTestSuite) {
 			}
 
 			// Run exec command.
-			_, err = runCommand(t, main, []string{lsPath}, clientConfig, 1)
+			_, err = runCommand(t.Context(), main, []string{lsPath}, clientConfig, 1)
 			require.NoError(t, err)
 
 			// Enhanced events should show up for session recorded at the node but not
@@ -6588,7 +6531,6 @@ func testSSHExitCode(t *testing.T, suite *integrationTestSuite) {
 				// Configure Proxy.
 				tconf.Proxy.Enabled = true
 				tconf.Proxy.DisableWebService = false
-				tconf.Proxy.DisableWebInterface = true
 
 				// Configure Node.
 				tconf.SSH.Enabled = true
@@ -6670,7 +6612,6 @@ func testBPFSessionDifferentiation(t *testing.T, suite *integrationTestSuite) {
 		// Configure Proxy.
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 
 		// Configure Node. If session are being recorded at the proxy, don't enable
 		// BPF to simulate an OpenSSH node.
@@ -6816,7 +6757,7 @@ func testExecEvents(t *testing.T, suite *integrationTestSuite) {
 				Port:        helpers.Port(t, main.SSH),
 				Interactive: tt.isInteractive,
 			}
-			_, err := runCommand(t, main, []string{tt.command}, clientConfig, 1)
+			_, err := runCommand(t.Context(), main, []string{tt.command}, clientConfig, 1)
 			require.NoError(t, err)
 
 			expectedCommandPrefix := tt.command
@@ -6856,7 +6797,7 @@ func testExecEvents(t *testing.T, suite *integrationTestSuite) {
 
 		errC := make(chan error)
 		go func() {
-			_, err := runCommandWithContext(ctx, t, main, []string{cmd}, clientConfig, 1)
+			_, err := runCommand(ctx, main, []string{cmd}, clientConfig, 1)
 			errC <- err
 		}()
 
@@ -6903,7 +6844,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	main := suite.newTeleport(t, nil, true)
 	defer main.StopAll()
 
-	ctx := context.Background()
+	ctx := t.Context()
 	// Get auth server
 	authServer := main.Process.GetAuthServer()
 
@@ -7129,15 +7070,13 @@ func runCommandWithCertReissue(t *testing.T, instance *helpers.TeleInstance, cmd
 	return nil
 }
 
-func runCommandWithContext(ctx context.Context, t *testing.T, instance *helpers.TeleInstance, cmd []string, cfg helpers.ClientConfig, attempts int) (string, error) {
-	tc, err := instance.NewClient(cfg)
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
+func runCommandOnClient(ctx context.Context, tc *client.TeleportClient, cmd []string) (string, error) {
 	// since this helper is sometimes used for running commands on
 	// multiple nodes concurrently, we use io.Pipe to protect our
 	// output buffer from concurrent writes.
 	read, write := io.Pipe()
+	defer read.Close()
+	defer write.Close()
 	output := &bytes.Buffer{}
 	doneC := make(chan struct{})
 	go func() {
@@ -7145,19 +7084,47 @@ func runCommandWithContext(ctx context.Context, t *testing.T, instance *helpers.
 		close(doneC)
 	}()
 	tc.Stdout = write
-	for i := 0; i < attempts; i++ {
-		err = tc.SSH(ctx, cmd)
-		if err == nil {
-			break
-		}
-		time.Sleep(1 * time.Second)
+	if err := tc.SSH(ctx, cmd); err != nil {
+		return "", trace.Wrap(err)
 	}
 	write.Close()
+	select {
+	case <-doneC:
+	case <-ctx.Done():
+		return "", trace.Wrap(ctx.Err())
+	}
+	return output.String(), nil
+}
+
+// runCommand is a shortcut for running SSH command, it creates a client
+// connected to proxy of the passed in instance, runs the command, and returns
+// the result. If multiple attempts are requested, a one second delay is
+// added between them before giving up.
+func runCommand(
+	ctx context.Context,
+	instance *helpers.TeleInstance,
+	cmd []string,
+	cfg helpers.ClientConfig,
+	attempts int,
+) (string, error) {
+	tc, err := instance.NewClient(cfg)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	<-doneC
-	return output.String(), nil
+	var cmdErr error
+	for range attempts {
+		var out string
+		out, cmdErr = runCommandOnClient(ctx, tc, cmd)
+		if cmdErr == nil {
+			return out, nil
+		}
+		select {
+		case <-time.After(time.Second):
+		case <-ctx.Done():
+			return "", trace.Wrap(ctx.Err())
+		}
+	}
+	return "", trace.Wrap(cmdErr)
 }
 
 // invoke makes it easier to defer multiple cancelFuncs held by the same variable
@@ -7166,14 +7133,6 @@ func invoke(cancel context.CancelFunc) { //nolint:unused // unused as TestRevers
 	cancel()
 }
 
-// runCommand is a shortcut for running SSH command, it creates a client
-// connected to proxy of the passed in instance, runs the command, and returns
-// the result. If multiple attempts are requested, a 250 millisecond delay is
-// added between them before giving up.
-func runCommand(t *testing.T, instance *helpers.TeleInstance, cmd []string, cfg helpers.ClientConfig, attempts int) (string, error) {
-	return runCommandWithContext(context.TODO(), t, instance, cmd, cfg, attempts)
-}
-
 type InstanceConfigOption func(t *testing.T, config *helpers.InstanceConfig)
 
 func (s *integrationTestSuite) newNamedTeleportInstance(t *testing.T, clusterName string, opts ...InstanceConfigOption) *helpers.TeleInstance {
@@ -7215,6 +7174,10 @@ func (s *integrationTestSuite) defaultServiceConfig() *servicecfg.Config {
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	cfg.DebugService.Enabled = false
+	cfg.Proxy.DisableDatabaseProxy = true
+	cfg.Proxy.DisableWebInterface = true
+	cfg.Proxy.DisableWebService = true
+	cfg.SSH.DisableCreateHostUser = true
 	return cfg
 }
 
@@ -7295,7 +7258,7 @@ func TestWebProxyInsecure(t *testing.T) {
 		NodeName:    Host,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	rcConf := servicecfg.MakeDefaultConfig()
@@ -7328,8 +7291,8 @@ func TestWebProxyInsecure(t *testing.T) {
 // TestTraitsPropagation makes sure that user traits are applied properly to
 // roles in root and leaf clusters.
 func TestTraitsPropagation(t *testing.T) {
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	ctx := t.Context()
+	log := logtest.NewLogger()
 
 	privateKey, publicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
@@ -7421,7 +7384,7 @@ func TestTraitsPropagation(t *testing.T) {
 
 	// Run command in root.
 	require.Eventually(t, func() bool {
-		outputRoot, err := runCommand(t, rc, []string{"echo", "hello root"}, helpers.ClientConfig{
+		outputRoot, err := runCommand(t.Context(), rc, []string{"echo", "hello root"}, helpers.ClientConfig{
 			Login:   me.Username,
 			Cluster: "root.example.com",
 			Host:    Loopback,
@@ -7432,7 +7395,7 @@ func TestTraitsPropagation(t *testing.T) {
 
 	// Run command in leaf.
 	require.Eventually(t, func() bool {
-		outputLeaf, err := runCommand(t, rc, []string{"echo", "hello leaf"}, helpers.ClientConfig{
+		outputLeaf, err := runCommand(t.Context(), rc, []string{"echo", "hello leaf"}, helpers.ClientConfig{
 			Login:   me.Username,
 			Cluster: "leaf.example.com",
 			Host:    Loopback,
@@ -7444,7 +7407,7 @@ func TestTraitsPropagation(t *testing.T) {
 
 // testSessionStreaming tests streaming events from session recordings.
 func testSessionStreaming(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	sessionID := session.ID(uuid.New().String())
 	teleport := suite.newTeleport(t, nil, true)
 	defer teleport.StopAll()
@@ -7510,7 +7473,7 @@ outer:
 type serviceCfgOpt func(cfg *servicecfg.Config, isRoot bool)
 
 func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraServices func(*testing.T, *helpers.TeleInstance, *helpers.TeleInstance), cfgOpts ...serviceCfgOpt) (*client.TeleportClient, *helpers.TeleInstance, *helpers.TeleInstance) {
-	ctx := context.Background()
+	ctx := t.Context()
 	username := suite.Me.Username
 	rootName := "root-test"
 	leafName := "leaf-test"
@@ -7565,7 +7528,6 @@ func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraSe
 	makeConfig := func(isRoot bool) (*testing.T, []*helpers.InstanceSecrets, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 		tconf.SSH.Enabled = false
 		tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500
 
@@ -7663,7 +7625,6 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) {
 
 			mainConfig.Proxy.Enabled = true
 			mainConfig.Proxy.DisableWebService = false
-			mainConfig.Proxy.DisableWebInterface = true
 			mainConfig.Proxy.PROXYProtocolMode = proxyProtocolMode
 
 			mainConfig.SSH.Enabled = false
@@ -7714,7 +7675,6 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) {
 
 		mainConfig.Proxy.Enabled = true
 		mainConfig.Proxy.DisableWebService = false
-		mainConfig.Proxy.DisableWebInterface = true
 
 		mainConfig.SSH.Enabled = false
 
@@ -7768,7 +7728,7 @@ func isNilOrEOFErr(t *testing.T, err error) {
 }
 
 func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
@@ -7921,7 +7881,7 @@ func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) {
 	conn, details, err := modClusterClient.ProxyClient.DialHost(ctx, nodeDetails.Addr, nodeDetails.Cluster, modTC.LocalAgent().ExtendedAgent)
 	require.NoError(t, err)
 	sshConfig := modClusterClient.ProxyClient.SSHConfig(username)
-	modSSHConn, modSSHChans, modSSHReqs, err := tracessh.NewClientConn(ctx, conn, nodeDetails.ProxyFormat(), sshConfig)
+	modSSHConn, modSSHChans, modSSHReqs, err := tracessh.NewClientConnWithTimeout(ctx, conn, nodeDetails.ProxyFormat(), sshConfig)
 	require.NoError(t, err)
 
 	// We pass an empty channel which we close right away to ssh.NewClient
@@ -7950,138 +7910,195 @@ func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) {
 	err = modSess.Shell(ctx)
 	require.NoError(t, err)
 
-	// Create and approve a file download request
-	tempDir := t.TempDir()
-	reqFile := filepath.Join(tempDir, "req-file")
-	err = os.WriteFile(reqFile, []byte("contents"), 0o666)
-	require.NoError(t, err)
-
-	err = peerSess.RequestFileTransfer(ctx, tracessh.FileTransferReq{
-		Download: true,
-		Location: reqFile,
-	})
-	require.NoError(t, err)
-
 	sshReq := sshRquestIgnoringKeepalives(t, modSSHReqs)
 	var joinEvent apievents.SessionJoin
 	err = json.Unmarshal(sshReq.Payload, &joinEvent)
 	require.NoError(t, err)
 
-	sshReq = sshRquestIgnoringKeepalives(t, modSSHReqs)
-	var fileReq apievents.FileTransferRequestEvent
-	err = json.Unmarshal(sshReq.Payload, &fileReq)
+	peer2Client, err := instance.NewClient(helpers.ClientConfig{
+		TeleportUser: peerUsername,
+		Login:        teleport.SSHSessionJoinPrincipal,
+		Cluster:      helpers.Site,
+		Host:         Host,
+	})
 	require.NoError(t, err)
-
-	err = modSess.ApproveFileTransferRequest(ctx, fileReq.RequestID)
+	peer2ClusterClient, err := peer2Client.ConnectToCluster(ctx)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, peer2ClusterClient.Close()) })
+	peer2NodeClient, err := peer2Client.ConnectToNode(ctx, peer2ClusterClient, nodeDetails, username)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, peer2NodeClient.Close()) })
 
-	// Ignore file transfer request approve event
-	sshRquestIgnoringKeepalives(t, modSSHReqs)
-
-	// Test that only operations needed to complete the download
-	// are allowed
-	transferSess, err := peerSSH.NewSession(ctx)
+	peer2SSH := peer2NodeClient.Client
+	peer2Sess, err := peer2SSH.NewSession(ctx)
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		isNilOrEOFErr(t, transferSess.Close())
+		require.NoError(t, peer2Sess.Close())
 	})
 
-	err = transferSess.Setenv(ctx, string(telesftp.ModeratedSessionID), sessTracker.GetSessionID())
-	require.NoError(t, err)
-
-	err = transferSess.RequestSubsystem(ctx, teleport.SFTPSubsystem)
+	peer2Term := NewTerminal(250)
+	peer2Sess.Stdin = peer2Term
+	peer2Sess.Stdout = peer2Term
+	peer2Sess.Stderr = peer2Term
+	err = peer2Sess.Setenv(ctx, sshutils.SessionEnvVar, sessTracker.GetSessionID())
 	require.NoError(t, err)
-	w, err := transferSess.StdinPipe()
+	err = peer2Sess.Setenv(ctx, teleport.EnvSSHJoinMode, string(types.SessionPeerMode))
 	require.NoError(t, err)
-	r, err := transferSess.StdoutPipe()
+	err = peer2Sess.Shell(ctx)
 	require.NoError(t, err)
-	sftpClient, err := sftp.NewClientPipe(r, w)
+
+	sshReq = sshRquestIgnoringKeepalives(t, modSSHReqs)
+	err = json.Unmarshal(sshReq.Payload, &joinEvent)
 	require.NoError(t, err)
 
-	// A file not in the request shouldn't be allowed
-	_, err = sftpClient.Open(filepath.Join(tempDir, "bad-file"))
-	require.ErrorContains(t, err, `method get is not allowed`)
-	// Since this is a download no files should be allowed to be written to
-	_, err = sftpClient.OpenFile(filepath.Join(tempDir, reqFile), os.O_WRONLY)
-	require.ErrorContains(t, err, `method put is not allowed`)
-	// Only stats and reads should be allowed
-	err = sftpClient.Mkdir(filepath.Join(tempDir, "new-dir"))
-	require.ErrorContains(t, err, `method mkdir is not allowed`)
-	// Since this is a download no files should be allowed to have
-	// their permissions changed
-	err = sftpClient.Chmod(reqFile, 0o777)
-	require.ErrorContains(t, err, `method setstat is not allowed`)
+	tests := []struct {
+		name      string
+		sshClient *tracessh.Client
+		sess      *tracessh.Session
+	}{
+		{
+			name:      "session originator",
+			sshClient: peerSSH,
+			sess:      peerSess,
+		},
+		{
+			name:      "session joiner",
+			sshClient: peer2SSH,
+			sess:      peer2Sess,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create and approve a file download request
+			tempDir := t.TempDir()
+			reqFile := filepath.Join(tempDir, "req-file")
+			err = os.WriteFile(reqFile, []byte("contents"), 0o666)
+			require.NoError(t, err)
 
-	// Only necessary operations should be allowed
-	_, err = sftpClient.Stat(reqFile)
-	require.NoError(t, err)
-	_, err = sftpClient.Lstat(reqFile)
-	require.NoError(t, err)
-	rf, err := sftpClient.Open(reqFile)
-	require.NoError(t, err)
-	require.NoError(t, rf.Close())
+			err = tc.sess.RequestFileTransfer(ctx, tracessh.FileTransferReq{
+				Download: true,
+				Location: reqFile,
+			})
+			require.NoError(t, err)
 
-	require.NoError(t, sftpClient.Close())
+			sshReq = sshRquestIgnoringKeepalives(t, modSSHReqs)
+			var fileReq apievents.FileTransferRequestEvent
+			err = json.Unmarshal(sshReq.Payload, &fileReq)
+			require.NoError(t, err)
 
-	// Create and approve a file upload request
-	err = peerSess.RequestFileTransfer(ctx, tracessh.FileTransferReq{
-		Download: false,
-		Filename: "upload-file",
-		Location: reqFile,
-	})
-	require.NoError(t, err)
+			err = modSess.ApproveFileTransferRequest(ctx, fileReq.RequestID)
+			require.NoError(t, err)
 
-	sshReq = sshRquestIgnoringKeepalives(t, modSSHReqs)
-	err = json.Unmarshal(sshReq.Payload, &fileReq)
-	require.NoError(t, err)
+			// Ignore file transfer request approve event
+			sshRquestIgnoringKeepalives(t, modSSHReqs)
 
-	err = modSess.ApproveFileTransferRequest(ctx, fileReq.RequestID)
-	require.NoError(t, err)
+			// Test that only operations needed to complete the download
+			// are allowed
+			transferSess, err := tc.sshClient.NewSession(ctx)
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				isNilOrEOFErr(t, transferSess.Close())
+			})
 
-	// Ignore file transfer request approve event
-	sshRquestIgnoringKeepalives(t, modSSHReqs)
+			err = transferSess.Setenv(ctx, string(telesftp.EnvModeratedSessionID), sessTracker.GetSessionID())
+			require.NoError(t, err)
 
-	isNilOrEOFErr(t, transferSess.Close())
-	transferSess, err = peerSSH.NewSession(ctx)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, transferSess.Close())
-	})
+			err = transferSess.RequestSubsystem(ctx, teleport.SFTPSubsystem)
+			require.NoError(t, err)
+			w, err := transferSess.StdinPipe()
+			require.NoError(t, err)
+			r, err := transferSess.StdoutPipe()
+			require.NoError(t, err)
+			sftpClient, err := sftp.NewClientPipe(r, w)
+			require.NoError(t, err)
 
-	err = transferSess.Setenv(ctx, string(telesftp.ModeratedSessionID), sessTracker.GetSessionID())
-	require.NoError(t, err)
+			// A file not in the request shouldn't be allowed
+			badFile := filepath.Join(tempDir, "bad-file")
+			_, err = sftpClient.Open(badFile)
+			require.ErrorContains(t, err, fmt.Sprintf("operations are only allowed on %s, not %s", reqFile, badFile))
+			// Since this is a download no files should be allowed to be written to
+			_, err = sftpClient.OpenFile(reqFile, os.O_WRONLY)
+			require.ErrorContains(t, err, `writing is not allowed`)
+			// Only stats and reads should be allowed
+			err = sftpClient.Mkdir(reqFile)
+			require.ErrorContains(t, err, `method mkdir is not allowed on `+reqFile)
+			// Since this is a download no files should be allowed to have
+			// their permissions changed
+			err = sftpClient.Chmod(reqFile, 0o777)
+			require.ErrorContains(t, err, `writing is not allowed`)
+
+			// Only necessary operations should be allowed
+			_, err = sftpClient.Stat(reqFile)
+			require.NoError(t, err)
+			_, err = sftpClient.Lstat(reqFile)
+			require.NoError(t, err)
+			rf, err := sftpClient.Open(reqFile)
+			require.NoError(t, err)
+			require.NoError(t, rf.Close())
 
-	// Test that only operations needed to complete the download
-	// are allowed
-	err = transferSess.RequestSubsystem(ctx, teleport.SFTPSubsystem)
-	require.NoError(t, err)
-	w, err = transferSess.StdinPipe()
-	require.NoError(t, err)
-	r, err = transferSess.StdoutPipe()
-	require.NoError(t, err)
-	sftpClient, err = sftp.NewClientPipe(r, w)
-	require.NoError(t, err)
+			require.NoError(t, sftpClient.Close())
 
-	// A file not in the request shouldn't be allowed
-	_, err = sftpClient.Open(filepath.Join(tempDir, "bad-file"))
-	require.ErrorContains(t, err, `method get is not allowed`)
-	// Since this is an upload no files should be allowed to be read from
-	_, err = sftpClient.OpenFile(filepath.Join(tempDir, reqFile), os.O_RDONLY)
-	require.ErrorContains(t, err, `method get is not allowed`)
-	// Only stats, writes, and chmods should be allowed
-	err = sftpClient.Mkdir(filepath.Join(tempDir, "new-dir"))
-	require.ErrorContains(t, err, `method mkdir is not allowed`)
+			// Create and approve a file upload request
+			err = tc.sess.RequestFileTransfer(ctx, tracessh.FileTransferReq{
+				Download: false,
+				Filename: "upload-file",
+				Location: reqFile,
+			})
+			require.NoError(t, err)
 
-	// Only necessary operations should be allowed
-	_, err = sftpClient.Stat(reqFile)
-	require.NoError(t, err)
-	_, err = sftpClient.Lstat(reqFile)
-	require.NoError(t, err)
-	err = sftpClient.Chmod(reqFile, 0o777)
-	require.NoError(t, err)
-	wf, err := sftpClient.OpenFile(reqFile, os.O_WRONLY)
-	require.NoError(t, err)
-	require.NoError(t, wf.Close())
+			sshReq = sshRquestIgnoringKeepalives(t, modSSHReqs)
+			err = json.Unmarshal(sshReq.Payload, &fileReq)
+			require.NoError(t, err)
+
+			err = modSess.ApproveFileTransferRequest(ctx, fileReq.RequestID)
+			require.NoError(t, err)
+
+			// Ignore file transfer request approve event
+			sshRquestIgnoringKeepalives(t, modSSHReqs)
+
+			isNilOrEOFErr(t, transferSess.Close())
+			transferSess, err = tc.sshClient.NewSession(ctx)
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				require.NoError(t, transferSess.Close())
+			})
+
+			err = transferSess.Setenv(ctx, string(telesftp.EnvModeratedSessionID), sessTracker.GetSessionID())
+			require.NoError(t, err)
+
+			// Test that only operations needed to complete the download
+			// are allowed
+			err = transferSess.RequestSubsystem(ctx, teleport.SFTPSubsystem)
+			require.NoError(t, err)
+			w, err = transferSess.StdinPipe()
+			require.NoError(t, err)
+			r, err = transferSess.StdoutPipe()
+			require.NoError(t, err)
+			sftpClient, err = sftp.NewClientPipe(r, w)
+			require.NoError(t, err)
+
+			// A file not in the request shouldn't be allowed
+			_, err = sftpClient.Open(badFile)
+			require.ErrorContains(t, err, fmt.Sprintf("operations are only allowed on %s, not %s", reqFile, badFile))
+			// Since this is an upload no files should be allowed to be read from
+			_, err = sftpClient.OpenFile(reqFile, os.O_RDONLY)
+			require.ErrorContains(t, err, `reading is not allowed`)
+			// Only stats, writes, and chmods should be allowed
+			err = sftpClient.Mkdir(reqFile)
+			require.ErrorContains(t, err, `method mkdir is not allowed on `+reqFile)
+
+			// Only necessary operations should be allowed
+			_, err = sftpClient.Stat(reqFile)
+			require.NoError(t, err)
+			_, err = sftpClient.Lstat(reqFile)
+			require.NoError(t, err)
+			err = sftpClient.Chmod(reqFile, 0o777)
+			require.NoError(t, err)
+			wf, err := sftpClient.OpenFile(reqFile, os.O_WRONLY)
+			require.NoError(t, err)
+			require.NoError(t, wf.Close())
+		})
+	}
 }
 
 func sshRquestIgnoringKeepalives(t *testing.T, ch <-chan *ssh.Request) *ssh.Request {
@@ -8104,11 +8121,8 @@ func testSFTP(t *testing.T, suite *integrationTestSuite) {
 		teleport.StopAll()
 	})
 
-	err := teleport.WaitForNodeCount(context.Background(), helpers.Site, 1)
-	require.NoError(t, err)
-
 	agentlessHost := "agentless-node"
-	agentlessNode := testenv.CreateAgentlessNode(t, teleport.Process.GetAuthServer(), helpers.Site, agentlessHost)
+	agentlessNode := CreateAgentlessNode(t, teleport.Process.GetAuthServer(), helpers.Site, agentlessHost)
 
 	teleportClient, err := teleport.NewClient(helpers.ClientConfig{
 		Login:   suite.Me.Username,
@@ -8352,6 +8366,65 @@ func testSFTP(t *testing.T, suite *integrationTestSuite) {
 	}
 }
 
+func testWebSFTP(t *testing.T, suite *integrationTestSuite) {
+	for _, proxyProtocolMode := range []multiplexer.PROXYProtocolMode{
+		multiplexer.PROXYProtocolOff,
+		multiplexer.PROXYProtocolOn,
+	} {
+		t.Run(fmt.Sprintf("proxy protocol %v", proxyProtocolMode), func(t *testing.T) {
+			cfg := suite.defaultServiceConfig()
+			cfg.Auth.Enabled = true
+			cfg.Auth.Preference.SetSecondFactor("off")
+			cfg.Auth.PROXYProtocolMode = proxyProtocolMode
+			cfg.Proxy.DisableWebService = false
+			cfg.Proxy.Enabled = true
+			cfg.SSH.Enabled = true
+			teleport := suite.NewTeleportWithConfig(t, []string{"alice"}, nil, cfg)
+			t.Cleanup(func() { require.NoError(t, teleport.StopAll()) })
+			password := uuid.NewString()
+			teleport.CreateWebUser(t, suite.Me.Username, password)
+
+			lbFrontend := utils.MustParseAddr(net.JoinHostPort(Loopback, "0"))
+			webAddr, err := teleport.Process.ProxyWebAddr()
+			require.NoError(t, err)
+			lb, err := utils.NewLoadBalancer(context.Background(), *lbFrontend, *webAddr)
+			require.NoError(t, err)
+			if proxyProtocolMode == multiplexer.PROXYProtocolOn {
+				lb.PROXYHeader = []byte("PROXY TCP4 127.0.0.1 127.0.0.2 12345 42\r\n")
+			}
+			require.NoError(t, lb.Listen())
+			t.Cleanup(func() { _ = lb.Close() })
+			*lbFrontend = utils.FromAddr(lb.Addr())
+
+			webClient, err := teleport.NewWebClient(helpers.ClientConfig{
+				Login:    suite.Me.Username,
+				Password: password,
+				Cluster:  helpers.Site,
+				Host:     Loopback,
+				Port:     lbFrontend.Port(0),
+			})
+			require.NoError(t, err)
+
+			t.Run("upload", func(t *testing.T) {
+				localFile := filepath.Join(t.TempDir(), "foo.txt")
+				_, err := webClient.SFTP(localFile, []byte("foo"))
+				require.NoError(t, err)
+				require.FileExists(t, localFile)
+				fileContents, err := os.ReadFile(localFile)
+				require.NoError(t, err)
+				require.Equal(t, []byte("foo"), fileContents)
+			})
+			t.Run("download", func(t *testing.T) {
+				localFile := filepath.Join(t.TempDir(), "foo.txt")
+				require.NoError(t, os.WriteFile(localFile, []byte("foo"), 0o644))
+				out, err := webClient.SFTP(localFile, nil)
+				require.NoError(t, err)
+				require.Equal(t, []byte("foo"), out)
+			})
+		})
+	}
+}
+
 func testAgentlessConnection(t *testing.T, suite *integrationTestSuite) {
 	// create Teleport instance
 	teleInst := suite.newTeleport(t, nil, true)
@@ -8361,7 +8434,7 @@ func testAgentlessConnection(t *testing.T, suite *integrationTestSuite) {
 
 	// get OpenSSH CA public key and create host certs
 	authSrv := teleInst.Process.GetAuthServer()
-	node := testenv.CreateAgentlessNode(t, authSrv, helpers.Site, "agentless-node")
+	node := CreateAgentlessNode(t, authSrv, helpers.Site, "agentless-node")
 
 	// create client
 	tc, err := teleInst.NewClient(helpers.ClientConfig{
@@ -8378,7 +8451,7 @@ func testAgentlessConn(t *testing.T, tc, joinTC *client.TeleportClient, node *ty
 	t.Helper()
 
 	// connect to cluster
-	ctx := context.Background()
+	ctx := t.Context()
 	clt, err := tc.ConnectToCluster(ctx)
 	require.NoError(t, err)
 	t.Cleanup(func() {
@@ -8511,15 +8584,15 @@ func TestProxySSHPortMultiplexing(t *testing.T) {
 				NodeName:    Host,
 				Priv:        privateKey,
 				Pub:         publicKey,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			})
 
 			rcConf := servicecfg.MakeDefaultConfig()
 			rcConf.DataDir = t.TempDir()
 			rcConf.Auth.Preference.SetSecondFactor("off")
 			rcConf.SSH.Enabled = false
-			rcConf.Proxy.DisableWebInterface = true
 			rcConf.Proxy.DisableTLS = false
+			rcConf.Proxy.DisableWebInterface = true
 			rcConf.Proxy.DisableALPNSNIListener = test.disableTLSRouting
 			rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 
@@ -8573,7 +8646,7 @@ func TestProxySSHPortMultiplexing(t *testing.T) {
 // can/cannot be established with an existing certificate
 // based on cluster configuration or roles.
 func TestConnectivityWithoutAuth(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	tests := []struct {
 		name         string
@@ -8636,7 +8709,7 @@ func TestConnectivityWithoutAuth(t *testing.T) {
 
 			// Create auth config.
 			authCfg := servicecfg.MakeDefaultConfig()
-			authCfg.Logger = utils.NewSlogLoggerForTests()
+			authCfg.Logger = logtest.NewLogger()
 			authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 			authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 			authCfg.Auth.Preference.SetSecondFactor("off")
@@ -8654,7 +8727,7 @@ func TestConnectivityWithoutAuth(t *testing.T) {
 				NodeName:    Host,
 				Priv:        privateKey,
 				Pub:         publicKey,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			})
 
 			// Create a user and role.
@@ -8689,7 +8762,7 @@ func TestConnectivityWithoutAuth(t *testing.T) {
 				NodeName:    Host,
 				Priv:        privateKey,
 				Pub:         publicKey,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			})
 
 			// Create node config.
@@ -8698,19 +8771,20 @@ func TestConnectivityWithoutAuth(t *testing.T) {
 			nodeCfg.SetToken("token")
 			nodeCfg.CachePolicy.Enabled = true
 			nodeCfg.DataDir = t.TempDir()
-			nodeCfg.Logger = utils.NewSlogLoggerForTests()
+			nodeCfg.Logger = logtest.NewLogger()
 			nodeCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 			nodeCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 			nodeCfg.Auth.Enabled = false
+			nodeCfg.DebugService.Enabled = false
 			// Configure Proxy.
 			nodeCfg.Proxy.Enabled = true
 			nodeCfg.Proxy.DisableWebService = false
 			nodeCfg.Proxy.DisableWebInterface = true
+			nodeCfg.Proxy.DisableDatabaseProxy = true
 			nodeCfg.FileDescriptors = append(nodeCfg.FileDescriptors, node.Fds...)
 			nodeCfg.Proxy.SSHAddr.Addr = node.SSHProxy
 			nodeCfg.Proxy.WebAddr.Addr = node.Web
 			nodeCfg.Proxy.ReverseTunnelListenAddr.Addr = node.Secrets.TunnelAddr
-
 			// Configure Node.
 			nodeCfg.SSH.Enabled = true
 			nodeCfg.SSH.Addr.Addr = node.SSH
@@ -8778,7 +8852,7 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
 
 	// Create auth config.
 	authCfg := servicecfg.MakeDefaultConfig()
-	authCfg.Logger = utils.NewSlogLoggerForTests()
+	authCfg.Logger = logtest.NewLogger()
 	authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	authCfg.Auth.Preference.SetSecondFactor("off")
@@ -8796,7 +8870,7 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
 		NodeName:    Host,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	// Create a user and role.
@@ -8828,7 +8902,7 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
 		NodeName:    Host,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	// Create node config.
@@ -8837,14 +8911,16 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
 	nodeCfg.SetToken("token")
 	nodeCfg.CachePolicy.Enabled = true
 	nodeCfg.DataDir = t.TempDir()
-	nodeCfg.Logger = utils.NewSlogLoggerForTests()
+	nodeCfg.Logger = logtest.NewLogger()
 	nodeCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	nodeCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	nodeCfg.DiagnosticAddr = *utils.MustParseAddr(helpers.NewListener(t, service.ListenerType("diag"), &node.Fds))
 	nodeCfg.Auth.Enabled = false
+	nodeCfg.DebugService.Enabled = false
 	// Configure Proxy.
 	nodeCfg.Proxy.Enabled = true
 	nodeCfg.Proxy.DisableWebService = false
+	nodeCfg.Proxy.DisableDatabaseProxy = true
 	nodeCfg.Proxy.DisableWebInterface = true
 	nodeCfg.FileDescriptors = append(nodeCfg.FileDescriptors, node.Fds...)
 	nodeCfg.Proxy.SSHAddr.Addr = node.SSHProxy
@@ -8934,7 +9010,7 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
 }
 
 func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	const password = "supersecretpassword"
 	inputReader := prompt.NewFakeReader().
@@ -8971,7 +9047,6 @@ func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
 	cfg.Auth.Preference.(*types.AuthPreferenceV2).Spec.RequireMFAType = types.RequireMFAType_SESSION
 	cfg.Auth.Preference.SetWebauthn(&types.Webauthn{RPID: "127.0.0.1"})
 	cfg.Proxy.DisableWebService = false
-	cfg.Proxy.DisableWebInterface = true
 	cfg.Proxy.Enabled = true
 	cfg.SSH.Enabled = true
 
@@ -9152,8 +9227,8 @@ func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
 func testNegotiatedALPNProtocols(t *testing.T, suite *integrationTestSuite) {
 	cfg := suite.defaultServiceConfig()
 	cfg.Auth.Enabled = true
+	cfg.Proxy.DisableDatabaseProxy = false
 	cfg.Proxy.DisableWebService = false
-	cfg.Proxy.DisableWebInterface = true
 	cfg.Proxy.Enabled = true
 	cfg.Proxy.Kube.Enabled = true
 
@@ -9196,7 +9271,6 @@ func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) {
 
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
 
 		tconf.SSH.Enabled = false
 
@@ -9320,3 +9394,226 @@ func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) {
 		})
 	})
 }
+
+func CreateAgentlessNode(t *testing.T, authServer *auth.Server, clusterName, nodeHostname string) *types.ServerV2 {
+	t.Helper()
+
+	ctx := t.Context()
+	openSSHCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.OpenSSHCA,
+		DomainName: clusterName,
+	}, false)
+	require.NoError(t, err)
+
+	caCheckers, err := sshutils.GetCheckers(openSSHCA)
+	require.NoError(t, err)
+
+	key, err := cryptosuites.GenerateKey(ctx, cryptosuites.GetCurrentSuiteFromAuthPreference(authServer), cryptosuites.HostSSH)
+	require.NoError(t, err)
+	sshPub, err := ssh.NewPublicKey(key.Public())
+	require.NoError(t, err)
+
+	nodeUUID := uuid.New().String()
+	hostCertBytes, err := authServer.GenerateHostCert(
+		ctx,
+		ssh.MarshalAuthorizedKey(sshPub),
+		"",
+		"",
+		[]string{nodeUUID, nodeHostname, Loopback},
+		clusterName,
+		types.RoleNode,
+		0,
+	)
+	require.NoError(t, err)
+
+	hostCert, err := apisshutils.ParseCertificate(hostCertBytes)
+	require.NoError(t, err)
+	signer, err := ssh.NewSignerFromSigner(key)
+	require.NoError(t, err)
+	hostKeySigner, err := ssh.NewCertSigner(hostCert, signer)
+	require.NoError(t, err)
+
+	// start SSH server
+	sshAddr := startSSHServer(t, caCheckers, hostKeySigner)
+
+	// create node resource
+	node := &types.ServerV2{
+		Kind:    types.KindNode,
+		SubKind: types.SubKindOpenSSHNode,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name: nodeUUID,
+		},
+		Spec: types.ServerSpecV2{
+			Addr:     sshAddr,
+			Hostname: nodeHostname,
+		},
+	}
+	_, err = authServer.UpsertNode(ctx, node)
+	require.NoError(t, err)
+
+	// wait for node resource to be written to the backend
+	timedCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	t.Cleanup(cancel)
+	w, err := authServer.NewWatcher(timedCtx, types.Watch{
+		Name: "node-create watcher",
+		Kinds: []types.WatchKind{
+			{
+				Kind: types.KindNode,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	for nodeCreated := false; !nodeCreated; {
+		select {
+		case e := <-w.Events():
+			if e.Type == types.OpPut {
+				nodeCreated = true
+			}
+		case <-w.Done():
+			t.Fatal("Did not receive node create event")
+		}
+	}
+	require.NoError(t, w.Close())
+
+	return node
+}
+
+// startSSHServer starts a SSH server that roughly mimics an unregistered
+// OpenSSH (agentless) server. The SSH server started only handles a small
+// subset of SSH requests necessary for testing.
+func startSSHServer(t *testing.T, caPubKeys []ssh.PublicKey, hostKey ssh.Signer) string {
+	t.Helper()
+
+	sshCfg := ssh.ServerConfig{
+		PublicKeyCallback: func(_ ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			cert, ok := key.(*ssh.Certificate)
+			if !ok {
+				return nil, fmt.Errorf("expected *ssh.Certificate, got %T", key)
+			}
+
+			// Sanity check incoming cert from proxy has Ed25519 key.
+			if cert.Key.Type() != ssh.KeyAlgoED25519 {
+				return nil, trace.BadParameter("expected Ed25519 key, got %v", cert.Key.Type())
+			}
+
+			for _, pubKey := range caPubKeys {
+				if bytes.Equal(cert.SignatureKey.Marshal(), pubKey.Marshal()) {
+					return &ssh.Permissions{}, nil
+				}
+			}
+
+			return nil, fmt.Errorf("signature key %v does not match OpenSSH CA", cert.SignatureKey)
+		},
+	}
+	sshCfg.AddHostKey(hostKey)
+
+	lis, err := net.Listen("tcp", Loopback+":")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, lis.Close())
+	})
+
+	go func() {
+		nConn, err := lis.Accept()
+		if utils.IsOKNetworkError(err) {
+			return
+		}
+		assert.NoError(t, err)
+		t.Cleanup(func() {
+			if nConn != nil {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = nConn.Close()
+			}
+		})
+
+		conn, channels, reqs, err := ssh.NewServerConn(nConn, &sshCfg)
+		assert.NoError(t, err)
+		t.Cleanup(func() {
+			if conn != nil {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = conn.Close()
+			}
+		})
+		go ssh.DiscardRequests(reqs)
+
+		var agentForwarded bool
+		var shellRequested bool
+		var execRequested bool
+		var sftpRequested bool
+		for {
+			var channelReq ssh.NewChannel
+			select {
+			case channelReq = <-channels:
+				if channelReq == nil { // server is closed
+					return
+				}
+			case <-t.Context().Done():
+				return
+			}
+			if !assert.Equal(t, "session", channelReq.ChannelType()) {
+				assert.NoError(t, channelReq.Reject(ssh.Prohibited, "only session channels expected"))
+				continue
+			}
+			channel, reqs, err := channelReq.Accept()
+			assert.NoError(t, err)
+			t.Cleanup(func() {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = channel.Close()
+			})
+
+			go func() {
+			outer:
+				for {
+					var req *ssh.Request
+					select {
+					case req = <-reqs:
+						if req == nil { // channel is closed
+							return
+						}
+					case <-t.Context().Done():
+						break outer
+					}
+					if req.WantReply {
+						assert.NoError(t, req.Reply(true, nil))
+					}
+					switch req.Type {
+					case sshutils.AgentForwardRequest:
+						agentForwarded = true
+					case sshutils.ShellRequest:
+						assert.NoError(t, channel.Close())
+						shellRequested = true
+						break outer
+					case sshutils.ExecRequest:
+						_, err := channel.SendRequest("exit-status", false, ssh.Marshal(struct{ C uint32 }{C: 0}))
+						assert.NoError(t, err)
+						assert.NoError(t, channel.Close())
+						execRequested = true
+						break outer
+					case sshutils.SubsystemRequest:
+						var r sshutils.SubsystemReq
+						err := ssh.Unmarshal(req.Payload, &r)
+						assert.NoError(t, err)
+						assert.Equal(t, "sftp", r.Name)
+						sftpRequested = true
+
+						sftpServer, err := sftp.NewServer(channel)
+						assert.NoError(t, err)
+						go sftpServer.Serve()
+						t.Cleanup(func() {
+							err := sftpServer.Close()
+							if err != nil {
+								assert.ErrorIs(t, err, io.EOF)
+							}
+						})
+						break outer
+					}
+				}
+				assert.True(t, (agentForwarded && shellRequested) || execRequested || sftpRequested)
+			}()
+		}
+	}()
+
+	return lis.Addr().String()
+}
diff --git a/integration/integrations/integration_test.go b/integration/integrations/integration_test.go
index feceb376281fe..66d34258c3ff4 100644
--- a/integration/integrations/integration_test.go
+++ b/integration/integrations/integration_test.go
@@ -84,7 +84,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	webPack := helpers.LoginWebClient(t, proxyAddr.String(), username, userPassword)
 
 	// List integrations should return empty
-	respStatusCode, respBody := webPack.DoRequest(t, http.MethodGet, integrationsEndpoint, nil)
+	respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodGet, integrationsEndpoint, nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	listResp := ui.IntegrationsListResponse{}
@@ -103,7 +103,7 @@ func TestIntegrationCRUD(t *testing.T) {
 		},
 	}
 
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationReq)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationReq)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	// Create Integration without S3 location
@@ -115,11 +115,11 @@ func TestIntegrationCRUD(t *testing.T) {
 		},
 	}
 
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationWithoutS3LocationReq)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationWithoutS3LocationReq)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	// Get One Integration by name
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodGet, integrationsEndpoint+"/my-aws-account", nil)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodGet, integrationsEndpoint+"/my-aws-account", nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	integrationResp := ui.Integration{}
@@ -136,7 +136,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	}, integrationResp, string(respBody))
 
 	// Update the integration to another RoleARN
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodPut, integrationsEndpoint+"/my-aws-account", ui.UpdateIntegrationRequest{
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodPut, integrationsEndpoint+"/my-aws-account", ui.UpdateIntegrationRequest{
 		AWSOIDC: &ui.IntegrationAWSOIDCSpec{
 			RoleARN:        "arn:aws:iam::123456789012:role/OpsTeam",
 			IssuerS3Bucket: "my-bucket",
@@ -159,7 +159,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	}, integrationResp, string(respBody))
 
 	// Update the integration to remove the S3 Location
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodPut, integrationsEndpoint+"/my-aws-account", ui.UpdateIntegrationRequest{
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodPut, integrationsEndpoint+"/my-aws-account", ui.UpdateIntegrationRequest{
 		AWSOIDC: &ui.IntegrationAWSOIDCSpec{
 			RoleARN: "arn:aws:iam::123456789012:role/OpsTeam2",
 		},
@@ -178,7 +178,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	}, integrationResp, string(respBody))
 
 	// Delete resource
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodDelete, integrationsEndpoint+"/my-aws-account", nil)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodDelete, integrationsEndpoint+"/my-aws-account", nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	// Add multiple integrations to test pagination
@@ -196,12 +196,12 @@ func TestIntegrationCRUD(t *testing.T) {
 			},
 		}
 
-		respStatusCode, respBody := webPack.DoRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationReq)
+		respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodPost, integrationsEndpoint, createIntegrationReq)
 		require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 	}
 
 	// List integrations should return a full page
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10", nil)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10", nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	listResp = ui.IntegrationsListResponse{}
@@ -210,7 +210,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	require.Len(t, listResp.Items, pageSize)
 
 	// Requesting the 2nd page should return a full page
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10&startKey="+listResp.NextKey, nil)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10&startKey="+listResp.NextKey, nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	listResp = ui.IntegrationsListResponse{}
@@ -219,7 +219,7 @@ func TestIntegrationCRUD(t *testing.T) {
 	require.Len(t, listResp.Items, pageSize)
 
 	// Requesting the 3rd page should return two items and empty StartKey
-	respStatusCode, respBody = webPack.DoRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10&startKey="+listResp.NextKey, nil)
+	respStatusCode, respBody = webPack.DoWebAPIRequest(t, http.MethodGet, integrationsEndpoint+"?limit=10&startKey="+listResp.NextKey, nil)
 	require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 	listResp = ui.IntegrationsListResponse{}
diff --git a/integration/joinopenssh_test.go b/integration/joinopenssh_test.go
index 79a995889a7ef..ac490e799dc13 100644
--- a/integration/joinopenssh_test.go
+++ b/integration/joinopenssh_test.go
@@ -37,7 +37,7 @@ import (
 	"github.com/gravitational/teleport/lib/openssh"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestJoinOpenSSH(t *testing.T) {
@@ -47,7 +47,7 @@ func TestJoinOpenSSH(t *testing.T) {
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.StandardListenerSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
@@ -87,6 +87,7 @@ func TestJoinOpenSSH(t *testing.T) {
 	openSSHCfg := servicecfg.MakeDefaultConfig()
 
 	openSSHCfg.OpenSSH.Enabled = true
+	openSSHCfg.DebugService.Enabled = false
 	err = config.ConfigureOpenSSH(&config.CommandLineFlags{
 		DataDir:           teleportDataDir,
 		ProxyServer:       rc.Web,
diff --git a/integration/kube/fixtures.go b/integration/kube/fixtures.go
index 62223e9284119..f6e96cccb07f8 100644
--- a/integration/kube/fixtures.go
+++ b/integration/kube/fixtures.go
@@ -56,6 +56,14 @@ type ProxyConfig struct {
 // ProxyClient returns kubernetes client using local teleport proxy
 func ProxyClient(cfg ProxyConfig) (*kubernetes.Clientset, *rest.Config, error) {
 	ctx := context.Background()
+
+	// Require that the target Kubernetes cluster is specified rather than
+	// guessing it to avoid cache propagation delays which may falsely indicate that no
+	// clusters exist.
+	if cfg.KubeCluster == "" {
+		return nil, nil, trace.BadParameter("KubeCluster must be provided")
+	}
+
 	authServer := cfg.T.Process.GetAuthServer()
 	clusterName, err := authServer.GetClusterName(ctx)
 	if err != nil {
@@ -97,19 +105,13 @@ func ProxyClient(cfg ProxyConfig) (*kubernetes.Clientset, *rest.Config, error) {
 		return nil, nil, trace.Wrap(err)
 	}
 
-	kubeServers, _ := authServer.GetKubernetesServers(ctx)
-	kubeCluster := cfg.KubeCluster
-	if cfg.KubeCluster == "" && len(kubeServers) > 0 {
-		kubeCluster = kubeServers[0].GetCluster().GetName()
-	}
-
 	id := tlsca.Identity{
 		Username:          cfg.Username,
 		Groups:            user.GetRoles(),
 		KubernetesUsers:   cfg.KubeUsers,
 		KubernetesGroups:  cfg.KubeGroups,
 		RouteToCluster:    cfg.RouteToCluster,
-		KubernetesCluster: kubeCluster,
+		KubernetesCluster: cfg.KubeCluster,
 		PinnedIP:          cfg.PinnedIP,
 	}
 	subj, err := id.Subject()
diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go
index 582831f0d0195..12c95ba0e4647 100644
--- a/integration/kube_integration_test.go
+++ b/integration/kube_integration_test.go
@@ -78,15 +78,18 @@ import (
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/cloud/imds"
 	"github.com/gravitational/teleport/lib/defaults"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web"
 	"github.com/gravitational/teleport/lib/web/terminal"
 )
@@ -145,18 +148,18 @@ func newKubeSuite(t *testing.T) *KubeSuite {
 
 	// Create test namespace and pod to run k8s commands against.
 	ns := newNamespace(testNamespace)
-	_, err = suite.CoreV1().Namespaces().Create(context.Background(), ns, metav1.CreateOptions{})
+	_, err = suite.CoreV1().Namespaces().Create(t.Context(), ns, metav1.CreateOptions{})
 	if err != nil {
 		require.True(t, kubeerrors.IsAlreadyExists(err), "Failed to create namespace: %v:", err)
 	}
 	p := newPod(testNamespace, testPod)
-	_, err = suite.CoreV1().Pods(testNamespace).Create(context.Background(), p, metav1.CreateOptions{})
+	_, err = suite.CoreV1().Pods(testNamespace).Create(t.Context(), p, metav1.CreateOptions{})
 	if err != nil {
 		require.True(t, kubeerrors.IsAlreadyExists(err), "Failed to create test pod: %v", err)
 	}
 	// Wait for pod to be running.
 	require.Eventually(t, func() bool {
-		rsp, err := suite.CoreV1().Pods(testNamespace).Get(context.Background(), testPod, metav1.GetOptions{})
+		rsp, err := suite.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{})
 		if err != nil {
 			return false
 		}
@@ -169,7 +172,7 @@ type kubeIntegrationTest func(t *testing.T, suite *KubeSuite)
 
 func (s *KubeSuite) bind(test kubeIntegrationTest) func(t *testing.T) {
 	return func(t *testing.T) {
-		s.log = utils.NewSlogLoggerForTests()
+		s.log = logtest.NewLogger()
 		os.RemoveAll(profile.FullProfilePath(""))
 		t.Cleanup(func() { s.log = nil })
 		test(t, s)
@@ -181,6 +184,7 @@ func TestKube(t *testing.T) {
 	t.Run("Exec", suite.bind(testKubeExec))
 	t.Run("Deny", suite.bind(testKubeDeny))
 	t.Run("PortForward", suite.bind(testKubePortForward))
+	t.Run("PortForwardPodDisconnect", suite.bind(testKubePortForwardPodDisconnect))
 	t.Run("TransportProtocol", suite.bind(testKubeTransportProtocol))
 	t.Run("TrustedClustersClientCert", suite.bind(testKubeTrustedClustersClientCert))
 	t.Run("TrustedClustersSNI", suite.bind(testKubeTrustedClustersSNI))
@@ -248,24 +252,25 @@ func testExec(t *testing.T, suite *KubeSuite, pinnedIP string, clientError strin
 		PinnedIP:      pinnedIP,
 		KubeUsers:     kubeUsers,
 		KubeGroups:    kubeGroups,
+		KubeCluster:   teleport.Secrets.SiteName,
 		Impersonation: &rest.ImpersonationConfig{UserName: "bob", Groups: []string{kube.TestImpersonationGroup}},
 	})
 
 	require.NoError(t, err)
 
 	// try get request to fetch a pod
-	ctx := context.Background()
-	_, err = impersonatingProxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
+	_, err = impersonatingProxyClient.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{})
 	require.Error(t, err)
 
 	// scoped client requests will be allowed, as long as the impersonation headers
 	// are referencing users and groups allowed by existing roles
 	scopedProxyClient, scopedProxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		PinnedIP:   pinnedIP,
-		KubeUsers:  kubeUsers,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		PinnedIP:    pinnedIP,
+		KubeUsers:   kubeUsers,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 		Impersonation: &rest.ImpersonationConfig{
 			UserName: role.GetKubeUsers(types.Allow)[0],
 			Groups:   role.GetKubeGroups(types.Allow),
@@ -273,7 +278,7 @@ func testExec(t *testing.T, suite *KubeSuite, pinnedIP string, clientError strin
 	})
 	require.NoError(t, err)
 
-	_, err = scopedProxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
+	_, err = scopedProxyClient.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{})
 	if clientError != "" {
 		require.ErrorContains(t, err, clientError)
 		return
@@ -281,20 +286,21 @@ func testExec(t *testing.T, suite *KubeSuite, pinnedIP string, clientError strin
 
 	// set up kube configuration using proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeUsers:  kubeUsers,
-		PinnedIP:   pinnedIP,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeUsers:   kubeUsers,
+		PinnedIP:    pinnedIP,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
 	// try get request to fetch available pods
-	pod, err := proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
+	pod, err := proxyClient.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{})
 	require.NoError(t, err)
 
 	out := &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -312,7 +318,7 @@ func testExec(t *testing.T, suite *KubeSuite, pinnedIP string, clientError strin
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 
 	out = &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -343,7 +349,7 @@ loop:
 	}
 
 	// read back the entire session and verify that it matches the stated output
-	capturedStream, _ := streamSession(ctx, t, teleport.Process.GetAuthServer(), sessionID)
+	capturedStream, _ := streamSession(t.Context(), t, teleport.Process.GetAuthServer(), sessionID)
 	require.Equal(t, sessionStream, capturedStream)
 
 	// impersonating kube exec should be denied
@@ -351,7 +357,7 @@ loop:
 	term = NewTerminal(250)
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 	out = &bytes.Buffer{}
-	err = kubeExec(impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -368,7 +374,7 @@ loop:
 	term = NewTerminal(250)
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 	out = &bytes.Buffer{}
-	err = kubeExec(scopedProxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), scopedProxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -454,16 +460,16 @@ func testKubeDeny(t *testing.T, suite *KubeSuite) {
 
 	// set up kube configuration using proxy
 	proxyClient, _, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeUsers:  kubeUsers,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeUsers:   kubeUsers,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
 	// try get request to fetch available pods
-	ctx := context.Background()
-	_, err = proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
+	_, err = proxyClient.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{})
 	require.Error(t, err)
 }
 
@@ -508,9 +514,10 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 
 	// set up kube configuration using proxy
 	_, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
@@ -519,6 +526,7 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 		T:             teleport,
 		Username:      username,
 		KubeGroups:    kubeGroups,
+		KubeCluster:   teleport.Secrets.SiteName,
 		Impersonation: &rest.ImpersonationConfig{UserName: "bob", Groups: []string{kube.TestImpersonationGroup}},
 	})
 	require.NoError(t, err)
@@ -528,11 +536,11 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 		builder func(*rest.Config, kubePortForwardArgs) (*kubePortForwarder, error)
 	}{
 		{
-			name:    "SPDY portForwarder",
+			name:    "SPDY",
 			builder: newPortForwarder,
 		},
 		{
-			name:    "SPDY over Websocket portForwarder",
+			name:    "SPDY over Websocket",
 			builder: newPortForwarderSPDYOverWebsocket,
 		},
 	}
@@ -556,7 +564,9 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 				})
 				require.NoError(t, err)
 
+				// Forward local port to container port.
 				forwarderCh := make(chan error)
+				t.Cleanup(func() { forwarder.Close() })
 				go func() { forwarderCh <- forwarder.ForwardPorts() }()
 
 				select {
@@ -564,7 +574,6 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 					t.Fatalf("Timeout waiting for port forwarding.")
 				case <-forwarder.readyC:
 				}
-				t.Cleanup(func() {})
 
 				resp, err := http.Get(fmt.Sprintf("http://localhost:%v", localPort))
 				require.NoError(t, err)
@@ -588,13 +597,175 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 			},
 		)
 	}
+}
+
+// testKubePortForwardPodDisconnect tests Kubernetes port forwarding
+// with pod disconnection.
+func testKubePortForwardPodDisconnect(t *testing.T, suite *KubeSuite) {
+	tconf := suite.teleKubeConfig(Host)
+
+	teleport := helpers.NewInstance(t, helpers.InstanceConfig{
+		ClusterName: helpers.Site,
+		HostID:      helpers.HostID,
+		NodeName:    Host,
+		Priv:        suite.priv,
+		Pub:         suite.pub,
+		Logger:      suite.log,
+	})
+
+	username := suite.me.Username
+	kubeGroups := []string{kube.TestImpersonationGroup}
+	role, err := types.NewRole("kubemaster", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Logins:     []string{username},
+			KubeGroups: kubeGroups,
+			KubernetesLabels: types.Labels{
+				types.Wildcard: []string{types.Wildcard},
+			},
+			KubernetesResources: []types.KubernetesResource{
+				{
+					Kind: "pods", Name: types.Wildcard, Namespace: types.Wildcard, Verbs: []string{types.Wildcard}, APIGroup: types.Wildcard,
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	teleport.AddUserWithRole(username, role)
+
+	err = teleport.CreateEx(t, nil, tconf)
+	require.NoError(t, err)
+
+	err = teleport.Start()
+	require.NoError(t, err)
+	defer teleport.StopAll()
+
+	// set up kube configuration using proxy
+	_, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
+		T:           teleport,
+		Username:    username,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
+	})
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		builder func(*rest.Config, kubePortForwardArgs) (*kubePortForwarder, error)
+	}{
+		{
+			name:    "SPDY",
+			builder: newPortForwarder,
+		},
+		{
+			name:    "SPDY over Websocket",
+			builder: newPortForwarderSPDYOverWebsocket,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name,
+			func(t *testing.T) {
+				// TODO(rana): Improve k8s isolation per test.
+				// Each test can have an isolated k8s environment.
+				// The isolated environment may have it's own namespace, pods, etc.
+				// This would involve updating CI k8s RBAC (fixtures/ci-teleport-rbac/ci-teleport.yaml).
+				// Existing tests can be updated to use the an isolated k8s environment.
+				// Current k8s integration testing reuses a single k8s environment and pod across tests.
+				// Some tests which delete pods (this one), or require multiple pods would benefit
+				// from isolated k8s environments.
+				// In this test, with k8s isolation per test, pod creation would be moved
+				// from `t.Cleanup()` to test setup.
+				t.Cleanup(func() {
+					// Current CI RBAC allows only for a pod named "test-pod".
+					// Kube integration test suite uses a single instance of
+					// "test-pod" across multiple tests.
+					// Here we continue the use and maintenance of the single "test-pod" pod approach.
+					// On successful test, "test-pod" is deleted, and re-created for the next test.
+					pod := newPod(testNamespace, testPod)
+					if _, err := suite.CoreV1().Pods(testNamespace).Create(context.Background(), pod, metav1.CreateOptions{}); err != nil {
+						require.True(t, kubeerrors.IsAlreadyExists(err), "Failed to create test pod: %s.", err)
+					}
+
+					// Wait for pod to be running.
+					require.Eventually(t, func() bool {
+						rsp, err := suite.CoreV1().Pods(testNamespace).Get(context.Background(), testPod, metav1.GetOptions{})
+						if err != nil {
+							t.Logf("Get pod error: %s", err)
+							return false
+						}
+						if rsp.Status.Phase == v1.PodRunning {
+							return true
+						}
+						return false
+					}, 60*time.Second, 500*time.Millisecond)
+				})
+
+				// Setup port-forwarding configuration.
+				listener, err := net.Listen("tcp", "localhost:0")
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					require.NoError(t, listener.Close())
+				})
+				localPort := listener.Addr().(*net.TCPAddr).Port
+				forwarder, err := tt.builder(proxyClientConfig, kubePortForwardArgs{
+					ports:        []string{fmt.Sprintf("%d:80", localPort)},
+					podName:      testPod,
+					podNamespace: testNamespace,
+				})
+				require.NoError(t, err)
+
+				// Forward local port to container port.
+				forwarderCh := make(chan error, 1)
+				t.Cleanup(func() { forwarder.Close() })
+				go func() { forwarderCh <- forwarder.ForwardPorts() }()
+
+				// Wait for port-forwarding to be ready.
+				select {
+				case <-time.After(5 * time.Second):
+					t.Fatal("Timed out waiting for port forward start")
+				case <-forwarder.readyC:
+				}
+
+				// Validate that port-forwarding is working.
+				resp, err := http.Get(fmt.Sprintf("http://localhost:%d", localPort))
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, resp.StatusCode)
+				require.NoError(t, resp.Body.Close())
+
+				// Delete the pod.
+				err = suite.CoreV1().Pods(testNamespace).Delete(t.Context(), testPod, metav1.DeleteOptions{})
+				require.NoError(t, err)
 
+				// Wait for pod deletion.
+				require.Eventually(t, func() bool {
+					if _, err := suite.CoreV1().Pods(testNamespace).Get(t.Context(), testPod, metav1.GetOptions{}); err != nil {
+						return kubeerrors.IsNotFound(err)
+					}
+					return false
+				}, 60*time.Second, 500*time.Millisecond)
+
+				// Attempt an http GET after pod deletion.
+				// This enables error reporting from KubeAPI back to client.
+				//nolint:bodyclose // http response is expected to be nil and return an error
+				_, err = http.Get(fmt.Sprintf("http://localhost:%d", localPort))
+				require.Error(t, err)
+
+				// Wait for port-forwarding to exit.
+				select {
+				case <-time.After(5 * time.Second):
+					t.Fatal("Timed out waiting for port forward exit")
+				case err := <-forwarderCh:
+					require.Equal(t, err, portforward.ErrLostConnectionToPod)
+				}
+			},
+		)
+	}
 }
 
 // TestKubeTrustedClustersClientCert tests scenario with trusted clusters
 // using metadata encoded in the certificate
 func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 	clusterMain := "cluster-main"
 	mainConf := suite.teleKubeConfig(Host)
 	// Main cluster doesn't need a kubeconfig to forward requests to auxiliary
@@ -695,7 +866,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 
 	// try and upsert a trusted cluster
 	var upsertSuccess bool
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		_, err = aux.Process.GetAuthServer().UpsertTrustedClusterV2(ctx, trustedCluster)
 		if err != nil {
 			if trace.IsConnectionProblem(err) {
@@ -751,7 +922,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	require.NoError(t, err)
 
 	out := &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -769,7 +940,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 
 	out = &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -808,7 +979,7 @@ loop:
 	term = NewTerminal(250)
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 	out = &bytes.Buffer{}
-	err = kubeExec(impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -830,8 +1001,11 @@ loop:
 	})
 	require.NoError(t, err)
 
+	// Forward local port to container port.
 	forwarderCh := make(chan error)
+	t.Cleanup(func() { forwarder.Close() })
 	go func() { forwarderCh <- forwarder.ForwardPorts() }()
+
 	defer func() {
 		require.NoError(t, <-forwarderCh, "Forward ports exited with error")
 	}()
@@ -866,7 +1040,7 @@ loop:
 // using SNI-forwarding
 // DELETE IN(4.3.0)
 func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	clusterMain := "cluster-main"
 	mainConf := suite.teleKubeConfig(Host)
@@ -969,7 +1143,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 
 	// try and upsert a trusted cluster
 	var upsertSuccess bool
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		_, err = aux.Process.GetAuthServer().UpsertTrustedClusterV2(ctx, trustedCluster)
 		if err != nil {
 			if trace.IsConnectionProblem(err) {
@@ -1000,6 +1174,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 		T:             main,
 		Username:      username,
 		KubeGroups:    mainKubeGroups,
+		KubeCluster:   main.Secrets.SiteName,
 		Impersonation: &rest.ImpersonationConfig{UserName: "bob", Groups: []string{kube.TestImpersonationGroup}},
 	})
 	require.NoError(t, err)
@@ -1010,9 +1185,10 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 
 	// set up kube configuration using main proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          main,
-		Username:   username,
-		KubeGroups: mainKubeGroups,
+		T:           main,
+		Username:    username,
+		KubeGroups:  mainKubeGroups,
+		KubeCluster: main.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
@@ -1021,7 +1197,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	require.NoError(t, err)
 
 	out := &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -1039,7 +1215,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 
 	out = &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -1078,7 +1254,7 @@ loop:
 	term = NewTerminal(250)
 	term.Type("\aecho hi\n\r\aexit\n\r\a")
 	out = &bytes.Buffer{}
-	err = kubeExec(impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), impersonatingProxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -1099,9 +1275,12 @@ loop:
 		podNamespace: pod.Namespace,
 	})
 	require.NoError(t, err)
-	forwarderCh := make(chan error)
 
+	// Forward local port to container port.
+	forwarderCh := make(chan error)
+	t.Cleanup(func() { forwarder.Close() })
 	go func() { forwarderCh <- forwarder.ForwardPorts() }()
+
 	defer func() {
 		require.NoError(t, <-forwarderCh, "Forward ports exited with error")
 	}()
@@ -1155,7 +1334,7 @@ func testKubeDisconnect(t *testing.T, suite *KubeSuite) {
 		},
 	}
 
-	for i := 0; i < utils.GetIterations(); i++ {
+	for i := range utils.GetIterations() {
 		t.Run(fmt.Sprintf("Iteration=%d", i), func(t *testing.T) {
 			for _, tc := range testCases {
 				t.Run(tc.name, func(t *testing.T) {
@@ -1208,19 +1387,20 @@ func runKubeDisconnectTest(t *testing.T, suite *KubeSuite, tc disconnectTestCase
 
 	// set up kube configuration using proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
 	// try get request to fetch available pods
-	ctx := context.Background()
+	ctx := t.Context()
 	pod, err := proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
 	require.NoError(t, err)
 
 	out := &bytes.Buffer{}
-	err = kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 		podName:      pod.Name,
 		podNamespace: pod.Namespace,
 		container:    pod.Spec.Containers[0].Name,
@@ -1237,7 +1417,7 @@ func runKubeDisconnectTest(t *testing.T, suite *KubeSuite, tc disconnectTestCase
 	sessionCtx, sessionCancel := context.WithCancel(ctx)
 	go func() {
 		defer sessionCancel()
-		err := kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+		err := kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 			podName:      pod.Name,
 			podNamespace: pod.Namespace,
 			container:    pod.Spec.Containers[0].Name,
@@ -1307,13 +1487,14 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 
 	// set up kube configuration using proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
-	ctx := context.Background()
+	ctx := t.Context()
 	pod, err := proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
 	require.NoError(t, err)
 
@@ -1356,18 +1537,18 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 		command:      []string{"ls"},
 	}
 
-	err = kubeExec(proxyClientConfig, execInContainer, command)
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, command)
 	require.NoError(t, err)
 
 	// stream fails with an h2 transport
 	proxyClientConfig.TLSClientConfig.NextProtos = []string{"h2"}
-	err = kubeExec(proxyClientConfig, execInContainer, command)
+	err = kubeExec(t.Context(), proxyClientConfig, execInContainer, command)
 	require.Error(t, err)
 }
 
 // TODO: test against tsh kubectl
 func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -1453,15 +1634,16 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 
 	// set up kube configuration using proxy
 	proxyClient, kubeConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   username,
-		KubeUsers:  kubeUsers,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    username,
+		KubeUsers:   kubeUsers,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
 	// try get request to fetch available pods
-	ctx := context.Background()
+	ctx := t.Context()
 	podsClient := proxyClient.CoreV1().Pods(testNamespace)
 	pod, err := podsClient.Get(ctx, testPod, metav1.GetOptions{})
 	require.NoError(t, err)
@@ -1498,7 +1680,7 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 			return trace.Wrap(err)
 		}
 
-		err = kubeExec(kubeConfig, attachToContainer, kubeExecArgs{
+		err = kubeExec(t.Context(), kubeConfig, attachToContainer, kubeExecArgs{
 			podName:      pod.Name,
 			podNamespace: testNamespace,
 			container:    contName,
@@ -1522,10 +1704,9 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 		// We need to wait for the session to be created here. We can't use the
 		// session manager's WaitUntilExists method because it doesn't work for
 		// kubernetes sessions.
-		sessions, err := teleport.Process.GetAuthServer().GetActiveSessionTrackers(context.Background())
-		if !assert.NoError(t, err) || !assert.NotEmpty(t, sessions) {
-			return
-		}
+		sessions, err := teleport.Process.GetAuthServer().GetActiveSessionTrackers(ctx)
+		require.NoError(t, err)
+		require.NotEmpty(t, sessions, "no active sessions found")
 		session = sessions[0]
 	}, 10*time.Second, 100*time.Millisecond)
 
@@ -1533,10 +1714,11 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 	group.Go(func() error {
 		// verify that the ephemeral container hasn't actually been created yet
 		proxyClient, _, err := kube.ProxyClient(kube.ProxyConfig{
-			T:          teleport,
-			Username:   moderatorUser,
-			KubeUsers:  kubeUsers,
-			KubeGroups: kubeGroups,
+			T:           teleport,
+			Username:    moderatorUser,
+			KubeUsers:   kubeUsers,
+			KubeGroups:  kubeGroups,
+			KubeCluster: teleport.Secrets.SiteName,
 		})
 		require.NoError(t, err)
 
@@ -1561,10 +1743,11 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 		stream, err := kubeJoin(
 			ctx,
 			kube.ProxyConfig{
-				T:          teleport,
-				Username:   moderatorUser,
-				KubeUsers:  kubeUsers,
-				KubeGroups: kubeGroups,
+				T:           teleport,
+				Username:    moderatorUser,
+				KubeUsers:   kubeUsers,
+				KubeGroups:  kubeGroups,
+				KubeCluster: teleport.Secrets.SiteName,
 			},
 			tc,
 			session,
@@ -1781,7 +1964,7 @@ func testKubeExecWeb(t *testing.T, suite *KubeSuite) {
 
 		ws := openWebsocketAndReadSession(t, endpoint, req)
 
-		wsStream := terminal.NewWStream(context.Background(), ws, utils.NewSlogLoggerForTests(), nil)
+		wsStream := terminal.NewWStream(t.Context(), ws, logtest.NewLogger(), nil)
 
 		// Check for the expected string in the output.
 		findTextInReader(t, wsStream, testNamespace, time.Second*2)
@@ -1802,7 +1985,7 @@ func testKubeExecWeb(t *testing.T, suite *KubeSuite) {
 
 		ws := openWebsocketAndReadSession(t, endpoint, req)
 
-		wsStream := terminal.NewWStream(context.Background(), ws, utils.NewSlogLoggerForTests(), nil)
+		wsStream := terminal.NewWStream(t.Context(), ws, logtest.NewLogger(), nil)
 
 		// Read first prompt from the server.
 		readData := make([]byte, 255)
@@ -1819,7 +2002,6 @@ func testKubeExecWeb(t *testing.T, suite *KubeSuite) {
 		err = ws.Close()
 		require.NoError(t, err)
 	})
-
 }
 
 type ReaderWithDeadline interface {
@@ -1851,24 +2033,28 @@ type sessionMetadataResponse struct {
 func (s *KubeSuite) teleKubeConfig(hostname string) *servicecfg.Config {
 	tconf := servicecfg.MakeDefaultConfig()
 	tconf.Logger = s.log
-	tconf.SSH.Enabled = true
+	tconf.SSH.Enabled = false
 	tconf.Proxy.DisableWebInterface = true
+	tconf.Proxy.DisableDatabaseProxy = true
 	tconf.PollingPeriod = 500 * time.Millisecond
 	tconf.Testing.ClientTimeout = time.Second
 	tconf.Testing.ShutdownTimeout = 2 * tconf.Testing.ClientTimeout
+	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	tconf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+	tconf.DebugService.Enabled = false
+	tconf.Proxy.IdP.SAMLIdP.Enabled = false
 
 	// set kubernetes specific parameters
 	tconf.Proxy.Kube.Enabled = true
 	tconf.Proxy.Kube.ListenAddr.Addr = net.JoinHostPort(hostname, newPortStr())
 	tconf.Proxy.Kube.KubeconfigPath = s.kubeConfigPath
 	tconf.Proxy.Kube.LegacyKubeProxy = true
-	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 
 	return tconf
 }
 
-// teleKubeConfig sets up teleport with kubernetes turned on
-func (s *KubeSuite) teleAuthConfig(hostname string) *servicecfg.Config {
+// teleAuthConfig sets up teleport with Auth turned on
+func (s *KubeSuite) teleAuthConfig() *servicecfg.Config {
 	tconf := servicecfg.MakeDefaultConfig()
 	tconf.Logger = s.log
 	tconf.PollingPeriod = 500 * time.Millisecond
@@ -1877,6 +2063,7 @@ func (s *KubeSuite) teleAuthConfig(hostname string) *servicecfg.Config {
 	tconf.Proxy.Enabled = false
 	tconf.SSH.Enabled = false
 	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	tconf.DebugService.Enabled = false
 
 	return tconf
 }
@@ -2052,7 +2239,7 @@ const (
 )
 
 // kubeExec executes command against kubernetes API server
-func kubeExec(kubeConfig *rest.Config, mode execMode, args kubeExecArgs) error {
+func kubeExec(ctx context.Context, kubeConfig *rest.Config, mode execMode, args kubeExecArgs) error {
 	query := make(url.Values)
 	if mode == execInContainer {
 		for _, arg := range args.command {
@@ -2098,7 +2285,7 @@ func kubeExec(kubeConfig *rest.Config, mode execMode, args kubeExecArgs) error {
 		Stderr: args.stderr,
 		Tty:    args.tty,
 	}
-	return executor.StreamWithContext(context.Background(), opts)
+	return executor.StreamWithContext(ctx, opts)
 }
 
 func kubeJoin(ctx context.Context, kubeConfig kube.ProxyConfig, tc *client.TeleportClient, meta types.SessionTracker, mode types.SessionParticipantMode) (*client.KubeSession, error) {
@@ -2207,17 +2394,19 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 
 	err = teleport.Start()
 	require.NoError(t, err)
-	defer teleport.StopAll()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	t.Cleanup(func() {
+		_ = teleport.StopAll()
+	})
+	ctx, cancel := context.WithCancel(t.Context())
+	t.Cleanup(cancel)
 
 	// set up kube configuration using proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   hostUsername,
-		KubeUsers:  kubeUsers,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    hostUsername,
+		KubeUsers:   kubeUsers,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
@@ -2227,14 +2416,17 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 
 	// interactive command, allocate pty
 	term := NewTerminal(250)
+	t.Cleanup(func() {
+		_ = term.Close()
+	})
 
 	out := &bytes.Buffer{}
 
-	group := &errgroup.Group{}
+	group, ctx := errgroup.WithContext(ctx)
 
 	// Start the main session.
 	group.Go(func() error {
-		err := kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+		err := kubeExec(ctx, proxyClientConfig, execInContainer, kubeExecArgs{
 			podName:      pod.Name,
 			podNamespace: pod.Namespace,
 			container:    pod.Spec.Containers[0].Name,
@@ -2254,19 +2446,31 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 		// session manager's WaitUntilExists method because it doesn't work for
 		// kubernetes sessions.
 		sessions, err := teleport.Process.GetAuthServer().GetActiveSessionTrackers(ctx)
-		assert.NoError(t, err)
-		if assert.Len(t, sessions, 1) {
-			session = sessions[0]
-		}
+		require.NoError(t, err)
+		require.Len(t, sessions, 1, "no active sessions found")
+		session = sessions[0]
 	}, 10*time.Second, time.Second)
 
-	participantStdinR, participantStdinW, err := os.Pipe()
-	require.NoError(t, err)
-	participantStdoutR, participantStdoutW, err := os.Pipe()
-	require.NoError(t, err)
+	participantStdinR, participantStdinW := io.Pipe()
+	t.Cleanup(func() {
+		_ = participantStdinW.Close()
+		_ = participantStdinR.Close()
+	})
+	participantStdoutR, participantStdoutW := net.Pipe()
+	t.Cleanup(func() {
+		_ = participantStdoutW.Close()
+		_ = participantStdoutR.Close()
+	})
 
-	observerCaptures := make([]*bytes.Buffer, 2)
+	type observer struct {
+		username string
+		capture  *bytes.Buffer
+	}
+	observerCaptures := make([]observer, 2)
 	albProxy := helpers.MustStartMockALBProxy(t, teleport.Config.Proxy.WebAddr.Addr)
+	t.Cleanup(func() {
+		albProxy.Close()
+	})
 
 	// join peer by KubeProxyAddr
 	group.Go(func() error {
@@ -2290,10 +2494,11 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 		stream, err := kubeJoin(
 			ctx,
 			kube.ProxyConfig{
-				T:          teleport,
-				Username:   peerUsername,
-				KubeUsers:  kubeUsers,
-				KubeGroups: kubeGroups,
+				T:           teleport,
+				Username:    peerUsername,
+				KubeUsers:   kubeUsers,
+				KubeGroups:  kubeGroups,
+				KubeCluster: teleport.Secrets.SiteName,
 			},
 			tc,
 			session,
@@ -2318,7 +2523,10 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 			_ = stream.Close()
 		})
 
-		observerCaptures[0] = capture
+		observerCaptures[0] = observer{
+			username: observer1Username,
+			capture:  capture,
+		}
 		stream.Wait()
 		return nil
 	})
@@ -2330,7 +2538,10 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 			_ = stream.Close()
 		})
 
-		observerCaptures[1] = capture
+		observerCaptures[1] = observer{
+			username: observer2Username,
+			capture:  capture,
+		}
 		stream.Wait()
 		return nil
 	})
@@ -2338,38 +2549,91 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 	// Wait for all users to finish joining the session.
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		session, err := teleport.Process.GetAuthServer().GetSessionTracker(ctx, session.GetName())
-		assert.NoError(t, err)
-		assert.Len(t, session.GetParticipants(), 4)
+		require.NoError(t, err)
+		require.Len(t, session.GetParticipants(), 4)
 	}, 30*time.Second, 500*time.Millisecond)
 
 	// send a test message from the participant
-	participantStdinW.Write([]byte("\ahi from peer\n\r"))
+	participantStdinW.Write([]byte("echo \"hi from peer\"\n\r"))
 
-	// lets type "echo hi" followed by "enter" and then "exit" + "enter":
-	term.Type("\ahi from term\n\r")
+	// validate that the output from both messages above is
+	// written to the participant stdout in the expected order.
+	require.NoError(t, waitForOutput(t.Context(), participantStdoutR, "hi from peer"))
 
-	// Terminate the session after a moment to allow for the IO to reach the second client.
-	time.AfterFunc(5*time.Second, func() {
-		// send exit command to close the session
-		term.Type("exit 0\n\r\a")
-	})
+	// type "hi from term" followed by "enter" to broadcast data
+	// to all participants.
+	term.Type("\aecho \"hi from term\"\n\r")
+
+	require.NoError(t, waitForOutput(t.Context(), participantStdoutR, "hi from term"))
+
+	// send exit command to close the session
+	term.Type("\aexit 0\n\r")
+
+	// drain participant stdout to ensure it doesn't block on writes
+	go io.Copy(io.Discard, participantStdoutR)
+
+	_ = term.Close()
 
 	// wait for all clients to finish
 	require.NoError(t, group.Wait())
 
-	// Verify peer.
-	participantOutput, err := io.ReadAll(participantStdoutR)
-	require.NoError(t, err)
-	require.Contains(t, string(participantOutput), "hi from term")
-
 	// Verify original session.
 	require.Contains(t, out.String(), "hi from peer")
 
 	// Verify observers.
-	for _, capture := range observerCaptures {
-		assert.Contains(t, capture.String(), "hi from peer")
-		assert.Contains(t, capture.String(), "hi from term")
+	for _, observer := range observerCaptures {
+		output := observer.capture.String()
+		assert.Contains(t, output, "hi from peer", "observer %q did not receive peer message", observer.username)
+		assert.Contains(t, output, "hi from term", "observer %q did not receive term message", observer.username)
+	}
+}
+
+func waitForOutput(ctx context.Context, r ReaderWithDeadline, expected string) error {
+	var prev string
+	out := make([]byte, int64(len(expected)*3))
+	defer func() {
+		slog.DebugContext(ctx, "waitForOutput final read", "output", prev, "expected", expected)
+	}()
+	for {
+		select {
+		case <-ctx.Done():
+			return trace.BadParameter("timeout waiting on terminal for output: %v", expected)
+		default:
+		}
+
+		// Forward the context deadline to the read deadline.
+		if deadline, ok := ctx.Deadline(); ok {
+			if err := r.SetReadDeadline(deadline); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		n, err := r.Read(out)
+		outStr := removeSpace(string(out[:n]))
+
+		prev += outStr
+		slog.DebugContext(ctx, "waitForOutput read", "output", prev, "expected", expected)
+		// Check for [expected] before checking the error,
+		// as it's valid for n > 0 even when there is an error.
+		// The [expected] is checked against the current and previous
+		// output to account for scenarios where the [expected] is split
+		// across two reads. While we try to prevent this by reading
+		// twice the length of [expected] there are no guarantees the
+		// whole thing will arrive in a single read.
+		if n > 0 && strings.Contains(prev, expected) {
+			return nil
+		}
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+	}
+}
+
+func removeSpace(in string) string {
+	for _, c := range []string{"\n", "\r", "\t"} {
+		in = strings.ReplaceAll(in, c, " ")
 	}
+	return strings.TrimSpace(in)
 }
 
 // testKubeJoinWeb tests that joining an interactive exec session
@@ -2438,15 +2702,16 @@ func testKubeJoinWeb(t *testing.T, suite *KubeSuite) {
 	require.NoError(t, err)
 	defer teleport.StopAll()
 
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
 
 	// set up kube configuration using proxy
 	proxyClient, proxyClientConfig, err := kube.ProxyClient(kube.ProxyConfig{
-		T:          teleport,
-		Username:   hostUsername,
-		KubeUsers:  kubeUsers,
-		KubeGroups: kubeGroups,
+		T:           teleport,
+		Username:    hostUsername,
+		KubeUsers:   kubeUsers,
+		KubeGroups:  kubeGroups,
+		KubeCluster: teleport.Secrets.SiteName,
 	})
 	require.NoError(t, err)
 
@@ -2462,7 +2727,7 @@ func testKubeJoinWeb(t *testing.T, suite *KubeSuite) {
 
 	// Start the main session.
 	group.Go(func() error {
-		err := kubeExec(proxyClientConfig, execInContainer, kubeExecArgs{
+		err := kubeExec(t.Context(), proxyClientConfig, execInContainer, kubeExecArgs{
 			podName:      pod.Name,
 			podNamespace: pod.Namespace,
 			container:    pod.Spec.Containers[0].Name,
@@ -2482,10 +2747,9 @@ func testKubeJoinWeb(t *testing.T, suite *KubeSuite) {
 		// session manager's WaitUntilExists method because it doesn't work for
 		// kubernetes sessions.
 		sessions, err := teleport.Process.GetAuthServer().GetActiveSessionTrackers(ctx)
-		assert.NoError(t, err)
-		if assert.Len(t, sessions, 1) {
-			tracker = sessions[0]
-		}
+		require.NoError(t, err)
+		require.Len(t, sessions, 1)
+		tracker = sessions[0]
 	}, 10*time.Second, time.Second)
 
 	var observerOut, peerOut, moderatorOut bytes.Buffer
@@ -2539,10 +2803,8 @@ func testKubeJoinWeb(t *testing.T, suite *KubeSuite) {
 	// Wait for all users to finish joining the session.
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		session, err := teleport.Process.GetAuthServer().GetSessionTracker(ctx, tracker.GetName())
-		if !assert.NoError(t, err) {
-			return
-		}
-		assert.Len(t, session.GetParticipants(), 4)
+		require.NoError(t, err)
+		require.Len(t, session.GetParticipants(), 4)
 	}, 30*time.Second, 500*time.Millisecond)
 
 	// enter a command from the session creator
@@ -2660,6 +2922,7 @@ func kubeJoinObserverWithSNISet(ctx context.Context, t *testing.T, tc *client.Te
 			Username:            tc.Username,
 			KubeUsers:           kubeUsers,
 			KubeGroups:          kubeGroups,
+			KubeCluster:         teleport.Secrets.SiteName,
 			CustomTLSServerName: constants.KubeTeleportProxyALPNPrefix + Host,
 		},
 		tc,
@@ -2732,7 +2995,7 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 	})
 	require.NoError(t, err)
 	teleport.AddUserWithRole(userUsername, userRole)
-	authTconf := suite.teleAuthConfig(Host)
+	authTconf := suite.teleAuthConfig()
 	err = teleport.CreateEx(t, nil, authTconf)
 	require.NoError(t, err)
 	err = teleport.Start()
@@ -2766,11 +3029,12 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 			KubeUsers:     kubeUsers,
 			KubeGroups:    kubeGroups,
 			TargetAddress: *kubeAddr,
+			KubeCluster:   teleport.Secrets.SiteName,
 		})
 		if err != nil {
 			return false
 		}
-		ctx := context.Background()
+		ctx := t.Context()
 		// try get request to fetch available pods
 		_, err = proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
 		return err == nil
@@ -2781,6 +3045,7 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 		Username:      adminUsername,
 		KubeUsers:     kubeUsers,
 		KubeGroups:    kubeGroups,
+		KubeCluster:   teleport.Secrets.SiteName,
 		TargetAddress: *kubeAddr,
 	})
 	require.NoError(t, err)
@@ -2790,6 +3055,7 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 		Username:      userUsername,
 		KubeUsers:     kubeUsers,
 		KubeGroups:    kubeGroups,
+		KubeCluster:   teleport.Secrets.SiteName,
 		TargetAddress: *kubeAddr,
 	})
 	require.NoError(t, err)
@@ -2823,10 +3089,9 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			ctx := context.Background()
+			ctx := t.Context()
 			// try get request to fetch available pods
 			pod, err := tt.proxyClient.CoreV1().Pods(testNamespace).Get(ctx, testPod, metav1.GetOptions{})
 			require.NoError(t, err)
@@ -2836,7 +3101,7 @@ func testExecNoAuth(t *testing.T, suite *KubeSuite) {
 			term := NewTerminal(250)
 			// lets type "echo hi" followed by "enter" and then "exit" + "enter":
 			term.Type("\aecho hi\n\r\aexit\n\r\a")
-			err = kubeExec(tt.clientConfig, execInContainer, kubeExecArgs{
+			err = kubeExec(t.Context(), tt.clientConfig, execInContainer, kubeExecArgs{
 				podName:      pod.Name,
 				podNamespace: pod.Namespace,
 				container:    pod.Spec.Containers[0].Name,
diff --git a/integration/port_forwarding_test.go b/integration/port_forwarding_test.go
index cdef9e9b6f35a..9b415d627d852 100644
--- a/integration/port_forwarding_test.go
+++ b/integration/port_forwarding_test.go
@@ -40,7 +40,8 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 func extractPort(svr *httptest.Server) (int, error) {
@@ -96,7 +97,7 @@ func testPingLocalServer(t *testing.T, port int, expectSuccess bool) {
 }
 
 func testPortForwarding(t *testing.T, suite *integrationTestSuite) {
-	invalidOSLogin := utils.GenerateLocalUsername(t)
+	invalidOSLogin := testutils.GenerateLocalUsername(t)
 
 	// Providing our own logins to Teleport so we can verify that a user
 	// that exists within Teleport but does not exist on the local node
@@ -170,7 +171,7 @@ func testPortForwarding(t *testing.T, suite *integrationTestSuite) {
 				NodeName:    Host,
 				Priv:        privateKey,
 				Pub:         publicKey,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			})
 
 			for _, login := range logins {
@@ -196,7 +197,7 @@ func testPortForwarding(t *testing.T, suite *integrationTestSuite) {
 				NodeName:    Host,
 				Priv:        privateKey,
 				Pub:         publicKey,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			})
 
 			// Create node config.
@@ -210,6 +211,7 @@ func testPortForwarding(t *testing.T, suite *integrationTestSuite) {
 			nodeCfg.SSH.Enabled = true
 			nodeCfg.SSH.AllowTCPForwarding = tt.portForwardingAllowed
 			nodeCfg.SSH.Labels = map[string]string{"foo": "bar"}
+			nodeCfg.DebugService.Enabled = false
 
 			err = node.CreateWithConf(t, nodeCfg)
 			require.NoError(t, err)
@@ -279,11 +281,9 @@ func testPortForwarding(t *testing.T, suite *integrationTestSuite) {
 			cl.Stdin = term
 			cl.Labels = tt.labels
 
-			sshSessionCtx, sshSessionCancel := context.WithCancel(context.Background())
-			go cl.SSH(sshSessionCtx, []string{})
-			defer sshSessionCancel()
+			go cl.SSH(t.Context(), []string{})
 
-			timeout, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			timeout, cancel := context.WithTimeout(t.Context(), 15*time.Second)
 			defer cancel()
 			_, err = waitForSessionToBeEstablished(timeout, apidefaults.Namespace, site)
 			require.NoError(t, err)
diff --git a/integration/proxy/automaticupgrades_test.go b/integration/proxy/automaticupgrades_test.go
index 1818fb7acd4e4..c128c5121ecad 100644
--- a/integration/proxy/automaticupgrades_test.go
+++ b/integration/proxy/automaticupgrades_test.go
@@ -24,6 +24,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"path/filepath"
 	"testing"
@@ -35,10 +36,9 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
-	"github.com/gravitational/teleport/lib/automaticupgrades/basichttp"
 	"github.com/gravitational/teleport/lib/automaticupgrades/constants"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func createProxyWithChannels(t *testing.T, channels automaticupgrades.Channels) string {
@@ -49,7 +49,7 @@ func createProxyWithChannels(t *testing.T, channels automaticupgrades.Channels)
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
@@ -75,6 +75,40 @@ func createProxyWithChannels(t *testing.T, channels automaticupgrades.Channels)
 	return cfg.Listeners.Web
 }
 
+// ServerMock is a HTTP server whose response can be controlled from the tests.
+// This is used to mock external dependencies like s3 buckets or a remote HTTP server.
+type ServerMock struct {
+	Srv *httptest.Server
+
+	t        *testing.T
+	code     int
+	response string
+	path     string
+}
+
+// SetResponse sets the ServerMock's response.
+func (m *ServerMock) SetResponse(t *testing.T, code int, response string) {
+	m.t = t
+	m.code = code
+	m.response = response
+}
+
+// ServeHTTP implements the http.Handler interface.
+func (m *ServerMock) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	require.Equal(m.t, m.path, r.URL.Path)
+	w.WriteHeader(m.code)
+	_, err := io.WriteString(w, m.response)
+	require.NoError(m.t, err)
+}
+
+// NewServerMock builds a [ServerMock] that only
+// responds to requests for the given path.
+func NewServerMock(path string) *ServerMock {
+	mock := ServerMock{path: path}
+	mock.Srv = httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
+	return &mock
+}
+
 func TestVersionServer(t *testing.T) {
 	// Test setup
 	ctx, cancel := context.WithCancel(context.Background())
@@ -91,11 +125,11 @@ func TestVersionServer(t *testing.T) {
 	forwardNoVersionChannel := "forward/none"
 	forwardPath := "/version-server/"
 
-	upstreamServer := basichttp.NewServerMock(forwardPath + constants.VersionPath)
+	upstreamServer := NewServerMock(forwardPath + constants.VersionPath)
 	upstreamServer.SetResponse(t, http.StatusOK, testVersion)
-	upstreamHighServer := basichttp.NewServerMock(forwardPath + constants.VersionPath)
+	upstreamHighServer := NewServerMock(forwardPath + constants.VersionPath)
 	upstreamHighServer.SetResponse(t, http.StatusOK, testVersionMajorTooHigh)
-	upstreamNoVersionServer := basichttp.NewServerMock(forwardPath + constants.VersionPath)
+	upstreamNoVersionServer := NewServerMock(forwardPath + constants.VersionPath)
 	upstreamNoVersionServer.SetResponse(t, http.StatusOK, constants.NoVersion)
 
 	channels := automaticupgrades.Channels{
diff --git a/integration/proxy/proxy_helpers.go b/integration/proxy/proxy_helpers.go
index f41a6f4513b4e..3c14595c3dae1 100644
--- a/integration/proxy/proxy_helpers.go
+++ b/integration/proxy/proxy_helpers.go
@@ -52,10 +52,10 @@ import (
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth/join"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -69,6 +69,7 @@ import (
 	"github.com/gravitational/teleport/lib/teleterm/gateway"
 	"github.com/gravitational/teleport/lib/utils"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type Suite struct {
@@ -115,7 +116,7 @@ func newSuite(t *testing.T, opts ...proxySuiteOptionsFunc) *Suite {
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    options.rootClusterNodeName,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	rCfg.Listeners = options.rootClusterListeners(t, &rCfg.Fds)
 	rc := helpers.NewInstance(t, rCfg)
@@ -127,7 +128,7 @@ func newSuite(t *testing.T, opts ...proxySuiteOptionsFunc) *Suite {
 		NodeName:    options.leafClusterNodeName,
 		Priv:        rc.Secrets.PrivKey,
 		Pub:         rc.Secrets.PubKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	lCfg.Listeners = options.leafClusterListeners(t, &lCfg.Fds)
 	lc := helpers.NewInstance(t, lCfg)
@@ -195,7 +196,7 @@ func newSuite(t *testing.T, opts ...proxySuiteOptionsFunc) *Suite {
 func (p *Suite) addNodeToLeafCluster(t *testing.T, tunnelNodeHostname string) {
 	nodeConfig := func() *servicecfg.Config {
 		tconf := servicecfg.MakeDefaultConfig()
-		tconf.Logger = utils.NewSlogLoggerForTests()
+		tconf.Logger = logtest.NewLogger()
 		tconf.Hostname = tunnelNodeHostname
 		tconf.SetToken("token")
 		tconf.SetAuthServerAddress(utils.NetAddr{
@@ -652,11 +653,10 @@ func mustRegisterUsingIAMMethod(t *testing.T, proxyAddr utils.NetAddr, token str
 	t.Setenv("AWS_REGION", "us-west-2")
 
 	node := uuid.NewString()
-	_, err = join.Register(context.TODO(), join.RegisterParams{
+	_, err = joinclient.Join(t.Context(), joinclient.JoinParams{
 		Token: token,
 		ID: state.IdentityID{
-			Role:     types.RoleNode,
-			HostUUID: node,
+			Role:     types.RoleInstance,
 			NodeName: node,
 		},
 		ProxyServer: proxyAddr,
diff --git a/integration/proxy/proxy_test.go b/integration/proxy/proxy_test.go
index a9cfff208c02e..048a863255d63 100644
--- a/integration/proxy/proxy_test.go
+++ b/integration/proxy/proxy_test.go
@@ -68,6 +68,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestALPNSNIProxyMultiCluster tests SSH connection in multi-cluster setup with.
@@ -563,7 +564,7 @@ func TestKubePROXYProtocol(t *testing.T) {
 				ClusterName: "root.example.com",
 				HostID:      uuid.New().String(),
 				NodeName:    helpers.Loopback,
-				Logger:      utils.NewSlogLoggerForTests(),
+				Logger:      logtest.NewLogger(),
 			}
 			tconf := servicecfg.MakeDefaultConfig()
 			tconf.Proxy.Kube.ListenAddr = *utils.MustParseAddr(helpers.NewListener(t, service.ListenerProxyKube, &cfg.Fds))
@@ -1407,7 +1408,7 @@ func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) {
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
@@ -1511,7 +1512,7 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) {
 		NodeName:    helpers.Loopback,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	rootCfg.Listeners = helpers.StandardListenerSetup(t, &rootCfg.Fds)
 	rc := helpers.NewInstance(t, rootCfg)
@@ -1581,7 +1582,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
 		NodeName:    addr,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	instanceCfg.Listeners = helpers.SingleProxyPortSetupOn(addr)(t, &instanceCfg.Fds)
 	rc := helpers.NewInstance(t, instanceCfg)
@@ -1648,7 +1649,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
 	lib.SetInsecureDevMode(true)
 	defer lib.SetInsecureDevMode(false)
 
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// We need to use the non-loopback address for our Teleport cluster, as the
 	// Go HTTP library will recognize requests to the loopback address and
diff --git a/integration/proxy/proxy_tunnel_strategy_test.go b/integration/proxy/proxy_tunnel_strategy_test.go
index 1c2a22824807e..af5dbb4a2c777 100644
--- a/integration/proxy/proxy_tunnel_strategy_test.go
+++ b/integration/proxy/proxy_tunnel_strategy_test.go
@@ -35,18 +35,20 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/cloud/imds"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type proxyTunnelStrategy struct {
@@ -62,6 +64,8 @@ type proxyTunnelStrategy struct {
 	db           *helpers.TeleInstance
 	dbAuthClient *authclient.Client
 	postgresDB   *postgres.TestServer
+
+	expectedTunnels int
 }
 
 func newProxyTunnelStrategy(t *testing.T, cluster string, strategy *types.TunnelStrategyV1) *proxyTunnelStrategy {
@@ -149,11 +153,17 @@ func TestProxyTunnelStrategyAgentMesh(t *testing.T) {
 
 // TestProxyTunnelStrategyProxyPeering tests the proxy-peer tunnel strategy.
 func TestProxyTunnelStrategyProxyPeering(t *testing.T) {
-	// TODO(jakule): Fix the test.
-	t.Skip("this test is flaky as it very sensitive to our timeouts")
+	// NOTE(eriktate): Testing database tunnels appears to be flaky (or possibly never works?)
+	// so we currently skip adding a database altogether in order to ensure peered tunnels have
+	// some automatic test coverage. Gating this behind a flag in case we want to restore the
+	// database portion of the test at some point.
+	withDB := false
+	testProxyTunnelStrategyProxyPeering(t, withDB)
+}
 
+func testProxyTunnelStrategyProxyPeering(t *testing.T, withDB bool) {
 	// This test cannot run in parallel as set module changes the global state.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -183,11 +193,13 @@ func TestProxyTunnelStrategyProxyPeering(t *testing.T) {
 	// bootstrap a node instance.
 	p.makeNode(t)
 
-	// bootstrap a db instance.
-	p.makeDatabase(t)
+	if withDB {
+		// bootstrap a db instance.
+		p.makeDatabase(t)
+	}
 
 	// wait for the node and db to open reverse tunnels to the first proxy.
-	helpers.WaitForActiveTunnelConnections(t, p.proxies[0].Tunnel, p.cluster, 2)
+	helpers.WaitForActiveTunnelConnections(t, p.proxies[0].Tunnel, p.cluster, p.expectedTunnels)
 
 	// bootstrap the second proxy instance after the node and db have already
 	// established reverse tunnels to the first proxy.
@@ -202,13 +214,17 @@ func TestProxyTunnelStrategyProxyPeering(t *testing.T) {
 	p.waitForNodeToBeReachable(t)
 	p.dialNode(t)
 
-	// make sure we can connect to the database going through any proxy.
-	p.waitForDatabaseToBeReachable(t)
-	p.dialDatabase(t)
+	if withDB {
+		// make sure we can connect to the database going through any proxy.
+		p.waitForDatabaseToBeReachable(t)
+		p.dialDatabase(t)
+	}
 }
 
 // dialNode starts a client conn to a node reachable through a specific proxy.
 func (p *proxyTunnelStrategy) dialNode(t *testing.T) {
+	nodeID, err := p.node.Process.WaitForHostID(t.Context())
+	require.NoError(t, err)
 	for _, proxy := range p.proxies {
 		creds, err := helpers.GenerateUserCreds(helpers.UserCredsRequest{
 			Process:  p.auth.Process,
@@ -219,7 +235,7 @@ func (p *proxyTunnelStrategy) dialNode(t *testing.T) {
 		client, err := proxy.NewClientWithCreds(
 			helpers.ClientConfig{
 				Cluster: p.cluster,
-				Host:    p.node.Process.Config.HostUUID,
+				Host:    nodeID,
 			},
 			*creds,
 		)
@@ -299,7 +315,7 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) {
 		NodeName:    helpers.Loopback,
 		Priv:        privateKey,
 		Pub:         publicKey,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	auth.AddUser(p.username, []string{p.username})
@@ -327,12 +343,13 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) {
 		ClusterName: p.cluster,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	authAddr := utils.MustParseAddr(p.auth.Auth)
 
 	conf := servicecfg.MakeDefaultConfig()
+	conf.DebugService.Enabled = false
 	conf.SetAuthServerAddress(*authAddr)
 	conf.SetToken("token")
 	conf.DataDir = t.TempDir()
@@ -374,7 +391,7 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) {
 		ClusterName: p.cluster,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	conf := servicecfg.MakeDefaultConfig()
@@ -383,6 +400,7 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) {
 	conf.DataDir = t.TempDir()
 	conf.Logger = node.Log
 	conf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+	conf.DebugService.Enabled = false
 
 	conf.Auth.Enabled = false
 	conf.Proxy.Enabled = false
@@ -397,6 +415,7 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) {
 	require.NoError(t, node.Start())
 
 	p.node = node
+	p.expectedTunnels += 1
 }
 
 // makeDatabase bootstraps a new teleport db instance.
@@ -419,10 +438,11 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) {
 		ClusterName: p.cluster,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 
 	conf := servicecfg.MakeDefaultConfig()
+	conf.DebugService.Enabled = false
 	conf.Version = types.V3
 	conf.SetToken("token")
 	conf.DataDir = t.TempDir()
@@ -442,7 +462,7 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) {
 		},
 	}
 
-	_, role, err := auth.CreateUserAndRole(p.auth.Process.GetAuthServer(), p.username, []string{p.username}, nil)
+	_, role, err := authtest.CreateUserAndRole(p.auth.Process.GetAuthServer(), p.username, []string{p.username}, nil)
 	require.NoError(t, err)
 
 	role.SetDatabaseUsers(types.Allow, []string{types.Wildcard})
@@ -486,12 +506,15 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) {
 	p.db = db
 	p.dbAuthClient = client
 	p.postgresDB = postgresDB
+	p.expectedTunnels += 1
 }
 
 // waitForNodeToBeReachable waits for the node to be reachable from all
 // proxies by making sure the proxy peer connectivity info (if any) got
 // propagated to the auth server.
 func (p *proxyTunnelStrategy) waitForNodeToBeReachable(t *testing.T) {
+	nodeID, err := p.node.Process.WaitForHostID(t.Context())
+	require.NoError(t, err)
 	check := func(t *helpers.TeleInstance, availability int) (bool, error) {
 		nodes, err := t.GetSiteAPI(p.cluster).GetNodes(
 			context.Background(),
@@ -502,8 +525,7 @@ func (p *proxyTunnelStrategy) waitForNodeToBeReachable(t *testing.T) {
 		}
 
 		for _, node := range nodes {
-			if node.GetName() == p.node.Process.Config.HostUUID &&
-				len(node.GetProxyIDs()) == availability {
+			if node.GetName() == nodeID && len(node.GetProxyIDs()) == availability {
 				return true, nil
 			}
 		}
@@ -516,6 +538,8 @@ func (p *proxyTunnelStrategy) waitForNodeToBeReachable(t *testing.T) {
 // proxies by making sure the proxy peer connectivity info (if any) got
 // propagated to the auth server.
 func (p *proxyTunnelStrategy) waitForDatabaseToBeReachable(t *testing.T) {
+	dbID, err := p.db.Process.WaitForHostID(t.Context())
+	require.NoError(t, err)
 	check := func(t *helpers.TeleInstance, availability int) (bool, error) {
 		databases, err := t.GetSiteAPI(p.cluster).GetDatabaseServers(
 			context.Background(),
@@ -526,8 +550,7 @@ func (p *proxyTunnelStrategy) waitForDatabaseToBeReachable(t *testing.T) {
 		}
 
 		for _, db := range databases {
-			if db.GetHostID() == p.db.Process.Config.HostUUID &&
-				len(db.GetProxyIDs()) == availability {
+			if db.GetHostID() == dbID && len(db.GetProxyIDs()) == availability {
 				return true, nil
 			}
 		}
diff --git a/integration/readiness_test.go b/integration/readiness_test.go
new file mode 100644
index 0000000000000..292c13dc83575
--- /dev/null
+++ b/integration/readiness_test.go
@@ -0,0 +1,105 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package integration
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/client/debug"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+// TestReadiness is a smoke test making sure that Teleport eventually becomes ready.
+// It comes loaded with most services and fails if the instance did not turn ready
+// after 20 seconds.
+func TestReadiness(t *testing.T) {
+	testDir := t.TempDir()
+	prometheus.DefaultRegisterer = metricRegistryBlackHole{}
+	log := logtest.NewLogger()
+
+	// Test setup: creating a teleport instance running auth and proxy
+	const clusterName = "root.example.com"
+	cfg := helpers.InstanceConfig{
+		ClusterName: clusterName,
+		HostID:      uuid.New().String(),
+		NodeName:    helpers.Loopback,
+		Logger:      log.With("test_component", "test-instance"),
+	}
+	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
+
+	// Manually create the listeners for kube and windows.
+	kubeListener := helpers.NewListener(t, service.ListenerKube, &cfg.Fds)
+	kubeAddr, err := utils.ParseAddr(kubeListener)
+	require.NoError(t, err)
+	windowsListener := helpers.NewListener(t, service.ListenerWindowsDesktop, &cfg.Fds)
+	windowsAddr, err := utils.ParseAddr(windowsListener)
+
+	require.NoError(t, err)
+	rc := helpers.NewInstance(t, cfg)
+
+	matchAll := []services.ResourceMatcher{
+		{Labels: types.Labels{"*": []string{"*"}}},
+	}
+
+	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.DataDir = filepath.Join(testDir, "data")
+	rcConf.Auth.Enabled = true
+	rcConf.Proxy.Enabled = true
+	rcConf.Proxy.DisableWebInterface = true
+	rcConf.SSH.Enabled = true
+	rcConf.Apps.Enabled = true
+	rcConf.Apps.ResourceMatchers = matchAll
+	rcConf.Databases.Enabled = true
+	rcConf.Databases.ResourceMatchers = matchAll
+	rcConf.WindowsDesktop.Enabled = true
+	rcConf.WindowsDesktop.ResourceMatchers = matchAll
+	rcConf.WindowsDesktop.ListenAddr = *windowsAddr
+	rcConf.Kube.Enabled = true
+	rcConf.Kube.ResourceMatchers = matchAll
+	rcConf.Kube.ListenAddr = kubeAddr
+	rcConf.Version = "v3"
+	rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+	// We use the debug service unix socket to check health
+	rcConf.DebugService.Enabled = true
+
+	// Test setup: starting the Teleport instance
+	require.NoError(t, rc.CreateEx(t, nil, rcConf))
+	require.NoError(t, rc.Start())
+
+	ctx := t.Context()
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		debugClt := debug.NewClient(rcConf.DataDir)
+		rdy, err := debugClt.GetReadiness(ctx)
+		require.NoError(t, err)
+		require.True(t, rdy.Ready, "Not yet ready: %q", rdy.Status)
+	}, 20*time.Second, 500*time.Millisecond)
+}
diff --git a/integration/tctl_terraform_env_test.go b/integration/tctl_terraform_env_test.go
index 55d5685b3004b..e97233a911773 100644
--- a/integration/tctl_terraform_env_test.go
+++ b/integration/tctl_terraform_env_test.go
@@ -46,6 +46,7 @@ import (
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/tctl/common"
 )
 
@@ -62,7 +63,7 @@ func TestTCTLTerraformCommand_ProxyJoin(t *testing.T) {
 		ClusterName: clusterName,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
@@ -138,7 +139,7 @@ func TestTCTLTerraformCommand_AuthJoin(t *testing.T) {
 		ClusterName: clusterName,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	}
 	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
 	rc := helpers.NewInstance(t, cfg)
@@ -240,7 +241,7 @@ func getAuthClientForProxy(t *testing.T, tc *helpers.TeleInstance, username stri
 		TLS:                  tlsConfig,
 		SSH:                  sshConfig,
 		AuthServers:          []utils.NetAddr{*authAddr},
-		Log:                  utils.NewSlogLoggerForTests(),
+		Log:                  logtest.NewLogger(),
 		CircuitBreakerConfig: breaker.Config{},
 		DialTimeout:          0,
 		DialOpts:             nil,
@@ -293,7 +294,7 @@ func getAuthClientForAuth(t *testing.T, tc *helpers.TeleInstance, username strin
 	clientConfig := &authclient.Config{
 		TLS:                  tlsConfig,
 		AuthServers:          []utils.NetAddr{*authAddr},
-		Log:                  utils.NewSlogLoggerForTests(),
+		Log:                  logtest.NewLogger(),
 		CircuitBreakerConfig: breaker.Config{},
 		DialTimeout:          0,
 		DialOpts:             nil,
diff --git a/integration/tctl_token_kube_test.go b/integration/tctl_token_kube_test.go
new file mode 100644
index 0000000000000..3b1635cc159ae
--- /dev/null
+++ b/integration/tctl_token_kube_test.go
@@ -0,0 +1,328 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package integration
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/buildkite/bintest/v3"
+	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/integrations/lib/embeddedtbot"
+	"github.com/gravitational/teleport/lib/kube/token"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/tctl/common"
+)
+
+func setupCLusterForTCTLTokensKubeTests(t *testing.T, log *slog.Logger) (*helpers.TeleInstance, string, string) {
+	// This test is not Parallel because of the metrics black hole.
+	testDir := t.TempDir()
+	prometheus.DefaultRegisterer = metricRegistryBlackHole{}
+
+	// Test setup: creating a teleport instance running auth and proxy
+	clusterName := "root.example.com"
+	cfg := helpers.InstanceConfig{
+		ClusterName: clusterName,
+		HostID:      uuid.New().String(),
+		NodeName:    helpers.Loopback,
+		Logger:      log.With("test_component", "test-instance"),
+	}
+	cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
+	rc := helpers.NewInstance(t, cfg)
+
+	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.DataDir = filepath.Join(testDir, "data")
+	rcConf.Auth.Enabled = true
+	rcConf.Proxy.Enabled = true
+	rcConf.SSH.Enabled = false
+	rcConf.Proxy.DisableWebInterface = true
+	rcConf.Version = "v3"
+	rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+
+	// Test setup: create a test user that can create tokens.
+	testUsername := "test-user"
+	role, err := types.NewRole("test-role", types.RoleSpecV6{
+		Options: types.RoleOptions{},
+		Allow: types.RoleConditions{
+			Rules: []types.Rule{
+				{
+					Resources: []string{types.KindToken, types.KindBot},
+					Verbs:     []string{types.VerbRead, types.VerbCreate, types.VerbList, types.VerbUpdate},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	rc.AddUserWithRole(testUsername, role)
+
+	// Test setup: starting the Teleport instance
+	err = rc.CreateEx(t, nil, rcConf)
+	require.NoError(t, err)
+
+	err = rc.Start()
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, rc.StopAll())
+	})
+
+	return rc, testUsername, role.GetName()
+}
+
+// TestTCTLTokenConfigureKubeCommand_OIDC validates that the command `tctl tokens configure-kube --join-with oidc`
+// can run against a fake Kubernetes cluster, a Teleport cluster service and
+// generates a join token that allows workload from the kubernetes cluster to join.
+func TestTCTLTokenConfigureKubeCommand_OIDC(t *testing.T) {
+	const (
+		testKubeContext = "test-context"
+		testNamespace   = "test-namespace"
+		testRelease     = "test-release"
+		testBotName     = "test-bot"
+	)
+
+	log := logtest.NewLogger()
+
+	rc, testUsername, testRoleName := setupCLusterForTCTLTokensKubeTests(t, log)
+
+	// Test setup: obtaining and authclient connected via the proxy.
+	clt := getAuthClientForProxy(t, rc, testUsername, time.Hour)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	pong, err := clt.Ping(ctx)
+	require.NoError(t, err)
+
+	_, err = clt.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
+		Bot: &machineidv1.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: testBotName,
+			},
+			Spec: &machineidv1.BotSpec{
+				Roles: []string{testRoleName},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	addr, err := rc.Process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Test setup: creating a fake Kubernetes OIDC provider.
+	idp, err := fakeissuer.NewIDP(log.With("test_component", "fakeissuer"))
+	require.NoError(t, err)
+	kubectlOIDConfig := struct {
+		Issuer                 string   `json:"issuer"`
+		JWKSURI                string   `json:"jwks_uri"`
+		ResponseTypesSupported []string `json:"response_types_supported"`
+		SubjectTypesSupported  []string `json:"subject_types_supported"`
+		IDTokenSigningAlgs     []string `json:"id_token_signing_algs_values_supported"`
+	}{
+		Issuer:                 idp.IssuerURL(),
+		JWKSURI:                "not currently used",
+		ResponseTypesSupported: []string{"id_token"},
+		SubjectTypesSupported:  []string{"public"},
+		IDTokenSigningAlgs:     []string{"RS256"},
+	}
+	kubectlOIDConfigResponse, err := json.Marshal(kubectlOIDConfig)
+	require.NoError(t, err)
+
+	// Test setup: creating a mock kubectl binary simulating our cluster.
+	kubectlMock, err := bintest.NewMock("kubectl")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, kubectlMock.Close())
+	})
+
+	kubectlMock.Expect("config", "current-context").AndWriteToStdout(testKubeContext)
+	kubectlMock.Expect("--context", testKubeContext, "get", "--raw=/.well-known/openid-configuration").AndWriteToStdout(string(kubectlOIDConfigResponse))
+
+	// Test execution: create the tctl command.
+	stdout := &bytes.Buffer{}
+	tctlCfg := &servicecfg.Config{}
+	err = tctlCfg.SetAuthServerAddresses([]utils.NetAddr{*addr})
+	require.NoError(t, err)
+	tctlCommand := common.TokensCommand{
+		Stdout:     stdout,
+		BinKubectl: kubectlMock.Path,
+	}
+
+	tempDir := t.TempDir()
+	app := kingpin.New("test", "test")
+	tctlCommand.Initialize(app, nil, tctlCfg)
+	_, err = app.Parse([]string{"tokens", "configure-kube", "--join-with", "oidc", "-s", testRelease, "--bot", testBotName, "--namespace", testNamespace, "--out", tempDir + "/values.yaml"})
+	require.NoError(t, err)
+
+	// Test execution: run the command and validate it doesn't error.
+	err = tctlCommand.ConfigureKube(ctx, clt)
+	require.NoError(t, err)
+
+	// Test validation: obtain a kubernetes JWT from our fake IDP.
+	kubeToken, err := idp.IssueKubeToken("random-pod-name", testNamespace, testRelease, pong.ClusterName)
+	require.NoError(t, err)
+
+	tokenPath := tempDir + "/token"
+	t.Setenv(token.EnvVarCustomKubernetesTokenPath, tokenPath)
+	require.NoError(t, os.WriteFile(tokenPath, []byte(kubeToken), 0600))
+
+	// Test validation: configure a bot to join using our JWT and the token created by the tctl command.
+	botConfig := &embeddedtbot.BotConfig{
+		AuthServer: rc.Auth,
+		Onboarding: onboarding.Config{
+			TokenValue: testKubeContext + "-" + testBotName,
+			JoinMethod: types.JoinMethodKubernetes,
+		},
+		CredentialLifetime: bot.CredentialLifetime{
+			TTL:             time.Hour,
+			RenewalInterval: time.Hour,
+		},
+		Insecure: true,
+	}
+
+	// Test validation: run the bot and make sure it can join the cluster.
+	bot, err := embeddedtbot.New(botConfig, log.With("test_component", "tbot"))
+	require.NoError(t, err)
+	_, err = bot.Preflight(t.Context())
+	require.NoError(t, err)
+}
+
+// TestTCTLTokenConfigureKubeCommand_JWKS validates that the command `tctl tokens configure-kube --join-with jwks`
+// can run against a fake Kubernetes cluster, a Teleport cluster service and
+// generates a join token that allows workload from the kubernetes cluster to join.
+func TestTCTLTokenConfigureKubeCommand_JWKS(t *testing.T) {
+	const (
+		testKubeContext = "test-context"
+		testNamespace   = "test-namespace"
+		testRelease     = "test-release"
+		testBotName     = "test-bot"
+	)
+
+	log := logtest.NewLogger()
+
+	rc, testUsername, testRoleName := setupCLusterForTCTLTokensKubeTests(t, log)
+
+	// Test setup: obtaining and authclient connected via the proxy.
+	clt := getAuthClientForProxy(t, rc, testUsername, time.Hour)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	pong, err := clt.Ping(ctx)
+	require.NoError(t, err)
+
+	_, err = clt.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
+		Bot: &machineidv1.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: testBotName,
+			},
+			Spec: &machineidv1.BotSpec{
+				Roles: []string{testRoleName},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	addr, err := rc.Process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Test setup: creating a fake Kubernetes OIDC provider.
+	signer, err := fakeissuer.NewKubernetesSigner(clockwork.NewRealClock())
+	require.NoError(t, err)
+	kubectlJWKSResponse, err := signer.GetMarshaledJWKS()
+	require.NoError(t, err)
+
+	// Test setup: creating a mock kubectl binary simulating our cluster.
+	kubectlMock, err := bintest.NewMock("kubectl")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, kubectlMock.Close())
+	})
+
+	kubectlMock.Expect("config", "current-context").AndWriteToStdout(testKubeContext)
+	kubectlMock.Expect("--context", testKubeContext, "get", "--raw=/openid/v1/jwks").AndWriteToStdout(kubectlJWKSResponse)
+
+	// Test execution: create the tctl command.
+	stdout := &bytes.Buffer{}
+	tctlCfg := &servicecfg.Config{}
+	err = tctlCfg.SetAuthServerAddresses([]utils.NetAddr{*addr})
+	require.NoError(t, err)
+	tctlCommand := common.TokensCommand{
+		Stdout:     stdout,
+		BinKubectl: kubectlMock.Path,
+	}
+
+	tempDir := t.TempDir()
+	app := kingpin.New("test", "test")
+	tctlCommand.Initialize(app, nil, tctlCfg)
+	_, err = app.Parse([]string{"tokens", "configure-kube", "--join-with", "jwks", "-s", testRelease, "--bot", testBotName, "--namespace", testNamespace, "--out", tempDir + "/values.yaml"})
+	require.NoError(t, err)
+
+	// Test execution: run the command and validate it doesn't error.
+	err = tctlCommand.ConfigureKube(ctx, clt)
+	require.NoError(t, err)
+
+	// Test validation: obtain a kubernetes JWT from our fake IDP.
+	kubeToken, err := signer.SignServiceAccountJWT("random-pod-name", testNamespace, testRelease, pong.ClusterName)
+	require.NoError(t, err)
+
+	tokenPath := tempDir + "/token"
+	t.Setenv(token.EnvVarCustomKubernetesTokenPath, tokenPath)
+	require.NoError(t, os.WriteFile(tokenPath, []byte(kubeToken), 0600))
+
+	// Test validation: configure a bot to join using our JWT and the token created by the tctl command.
+	botConfig := &embeddedtbot.BotConfig{
+		AuthServer: rc.Auth,
+		Onboarding: onboarding.Config{
+			TokenValue: testKubeContext + "-" + testBotName,
+			JoinMethod: types.JoinMethodKubernetes,
+		},
+		CredentialLifetime: bot.CredentialLifetime{
+			TTL:             time.Hour,
+			RenewalInterval: time.Hour,
+		},
+		Insecure: true,
+	}
+
+	// Test validation: run the bot and make sure it can join the cluster.
+	bot, err := embeddedtbot.New(botConfig, log.With("test_component", "tbot"))
+	require.NoError(t, err)
+	_, err = bot.Preflight(t.Context())
+	require.NoError(t, err)
+
+}
diff --git a/integration/teleterm_test.go b/integration/teleterm_test.go
index 3574c168954b1..b3097cb62d683 100644
--- a/integration/teleterm_test.go
+++ b/integration/teleterm_test.go
@@ -46,13 +46,14 @@ import (
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	dbhelpers "github.com/gravitational/teleport/integration/db"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -62,7 +63,7 @@ import (
 	"github.com/gravitational/teleport/lib/teleterm/clusters"
 	"github.com/gravitational/teleport/lib/teleterm/daemon"
 	"github.com/gravitational/teleport/lib/tlsca"
-	libutils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestTeleterm(t *testing.T) {
@@ -133,6 +134,22 @@ func TestTeleterm(t *testing.T) {
 		testClientCache(t, pack, creds)
 	})
 
+	t.Run("clearing stale cached clients", func(t *testing.T) {
+		t.Parallel()
+
+		testClearingStaleCachedClients(t, pack, creds)
+	})
+
+	t.Run("logging out", func(t *testing.T) {
+		t.Parallel()
+		testLogout(t, pack, creds)
+	})
+
+	t.Run("setting site name", func(t *testing.T) {
+		t.Parallel()
+		testSettingSiteName(t, pack, creds)
+	})
+
 	t.Run("ListDatabaseUsers", func(t *testing.T) {
 		// ListDatabaseUsers cannot be run in parallel as it modifies the default roles of users set up
 		// through the test pack.
@@ -548,6 +565,172 @@ func testClientCache(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.
 	require.NotEqual(t, secondCallForClient, thirdCallForClient)
 }
 
+func testClearingStaleCachedClients(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) {
+	ctx := context.Background()
+
+	tc := mustLogin(t, pack.Root.User.GetName(), pack, creds)
+
+	storageFakeClock := clockwork.NewFakeClockAt(time.Now())
+
+	storage, err := clusters.NewStorage(clusters.Config{
+		ClientStore:        tc.ClientStore,
+		Clock:              storageFakeClock,
+		InsecureSkipVerify: tc.InsecureSkipVerify,
+	})
+	require.NoError(t, err)
+
+	cluster, _, err := storage.Add(ctx, tc.WebProxyAddr)
+	require.NoError(t, err)
+
+	tshdEventsClient := daemon.NewTshdEventsClient(func() (grpc.DialOption, error) {
+		return grpc.WithTransportCredentials(insecure.NewCredentials()), nil
+	})
+
+	daemonService, err := daemon.New(daemon.Config{
+		Storage:          storage,
+		TshdEventsClient: tshdEventsClient,
+		KubeconfigsDir:   t.TempDir(),
+		AgentsDir:        t.TempDir(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		daemonService.Stop()
+	})
+
+	firstCallForClient, err := daemonService.GetCachedClient(ctx, cluster.URI)
+	require.NoError(t, err)
+	err = daemonService.ClearStaleCachedClientsForRoot(cluster.URI)
+	require.NoError(t, err)
+	// Ensure the client wasn't closed.
+	secondCallForClient, err := daemonService.GetCachedClient(ctx, cluster.URI)
+	require.NoError(t, err)
+	require.Equal(t, firstCallForClient, secondCallForClient)
+	// Reissue user certs by assuming a role with a bogus ID in DropAccessRequests.
+	accessRequest := &api.AssumeRoleRequest{
+		RootClusterUri: cluster.URI.String(),
+		DropRequestIds: []string{"does-not-matter"},
+	}
+	err = cluster.AssumeRole(ctx, firstCallForClient, accessRequest)
+	require.NoError(t, err)
+	// The cert has changed, so after clearing stale clients,
+	// GetCachedClient should return a new client.
+	err = daemonService.ClearStaleCachedClientsForRoot(cluster.URI)
+	require.NoError(t, err)
+	thirdCallForClient, err := daemonService.GetCachedClient(ctx, cluster.URI)
+	require.NoError(t, err)
+	require.NotEqual(t, secondCallForClient, thirdCallForClient)
+}
+
+func testLogout(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) {
+	ctx := context.Background()
+
+	tc := mustLogin(t, pack.Root.User.GetName(), pack, creds)
+
+	storageFakeClock := clockwork.NewFakeClockAt(time.Now())
+
+	storage, err := clusters.NewStorage(clusters.Config{
+		ClientStore:        tc.ClientStore,
+		Clock:              storageFakeClock,
+		InsecureSkipVerify: tc.InsecureSkipVerify,
+	})
+	require.NoError(t, err)
+
+	cluster, _, err := storage.Add(ctx, tc.WebProxyAddr)
+	require.NoError(t, err)
+
+	tshdEventsClient := daemon.NewTshdEventsClient(func() (grpc.DialOption, error) {
+		return grpc.WithTransportCredentials(insecure.NewCredentials()), nil
+	})
+
+	daemonService, err := daemon.New(daemon.Config{
+		Storage:          storage,
+		TshdEventsClient: tshdEventsClient,
+		KubeconfigsDir:   t.TempDir(),
+		AgentsDir:        t.TempDir(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		daemonService.Stop()
+	})
+
+	// Ensure there is a cluster.
+	rootClusters, err := daemonService.ListRootClusters(ctx)
+	require.NoError(t, err)
+	require.Len(t, rootClusters, 1)
+
+	// Log out without removing the profile.
+	err = daemonService.ClusterLogout(ctx, cluster.URI, false)
+	require.NoError(t, err)
+	rootClusters, err = daemonService.ListRootClusters(ctx)
+	require.NoError(t, err)
+	require.Len(t, rootClusters, 1)
+	require.Empty(t, rootClusters[0].GetLoggedInUser().Name)
+
+	// Log out again, now also remove the profile.
+	err = daemonService.ClusterLogout(ctx, cluster.URI, true)
+	require.NoError(t, err)
+	rootClusters, err = daemonService.ListRootClusters(ctx)
+	require.NoError(t, err)
+	require.Empty(t, rootClusters)
+
+	// Log out again, the operation should be idempotent.
+	err = daemonService.ClusterLogout(ctx, cluster.URI, true)
+	require.NoError(t, err)
+}
+
+func testSettingSiteName(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) {
+	ctx := context.Background()
+
+	tc, err := pack.Root.Cluster.NewClient(helpers.ClientConfig{
+		TeleportUser: pack.Root.User.GetName(),
+		Cluster:      "root.example.com",
+	})
+	require.NoError(t, err)
+
+	storageFakeClock := clockwork.NewFakeClockAt(time.Now())
+
+	storage, err := clusters.NewStorage(clusters.Config{
+		ClientStore:        tc.ClientStore,
+		Clock:              storageFakeClock,
+		InsecureSkipVerify: tc.InsecureSkipVerify,
+	})
+	require.NoError(t, err)
+
+	// Add a cluster.
+	cluster, clusterClient, err := storage.Add(ctx, tc.WebProxyAddr)
+	require.NoError(t, err)
+	require.Equal(t, "root.example.com", clusterClient.SiteName)
+	require.Equal(t, "root.example.com", cluster.Name)
+	// Adding a cluster should set the site name in the profile.
+	profile, err := clusterClient.GetProfile(tc.WebProxyAddr)
+	require.NoError(t, err)
+	require.Equal(t, "root.example.com", profile.SiteName)
+
+	// Simulate logging into a leaf cluster, which changes the profile's site name.
+	clusterClient.SiteName = "leaf.example.com"
+	err = clusterClient.SaveProfile(false)
+	require.NoError(t, err)
+
+	// The URI should always resolve to the target cluster, even if the profile's site name points to a different cluster.
+	cluster, clusterClient, err = storage.ResolveCluster(cluster.URI)
+	require.NoError(t, err)
+	// These are empty because the user is not logged in, so there's no cert to retrieve the root cluster name.
+	require.Empty(t, clusterClient.SiteName)
+	require.Empty(t, cluster.Name)
+	// SiteName in the profile should still point to the leaf.
+	profile, err = clusterClient.GetProfile(tc.WebProxyAddr)
+	require.NoError(t, err)
+	require.Equal(t, "leaf.example.com", profile.SiteName)
+
+	// Saving the profile with SaveProfileAndPreserveSiteName doesn't overwrite the profile
+	// with the current clusterClient.SiteName.
+	err = clusters.SaveProfileAndPreserveSiteName(clusterClient, false)
+	require.NoError(t, err)
+	profile, err = clusterClient.GetProfile(tc.WebProxyAddr)
+	require.NoError(t, err)
+	require.Equal(t, "leaf.example.com", profile.SiteName)
+}
+
 func testCreateConnectMyComputerRole(t *testing.T, pack *dbhelpers.DatabasePack) {
 	systemUser, err := user.Current()
 	require.NoError(t, err)
@@ -744,7 +927,7 @@ func testCreateConnectMyComputerRole(t *testing.T, pack *dbhelpers.DatabasePack)
 				}
 				userRoles = append(userRoles, existingRole)
 			}
-			_, err = auth.CreateUser(ctx, authServer, userName, userRoles...)
+			_, err = authtest.CreateUser(ctx, authServer, userName, userRoles...)
 			require.NoError(t, err)
 
 			userPassword := uuid
@@ -845,7 +1028,7 @@ func testCreateConnectMyComputerToken(t *testing.T, pack *dbhelpers.DatabasePack
 	require.NoError(t, err)
 	userRoles := []types.Role{ruleWithAllowRules}
 
-	_, err = auth.CreateUser(ctx, authServer, userName, userRoles...)
+	_, err = authtest.CreateUser(ctx, authServer, userName, userRoles...)
 	require.NoError(t, err)
 
 	tshdEventsService, addr := newMockTSHDEventsServiceServer(t)
@@ -969,7 +1152,7 @@ func testWaitForConnectMyComputerNodeJoin(t *testing.T, pack *dbhelpers.Database
 	nodeConfig := newNodeConfig(t, "token", types.JoinMethodToken)
 	nodeConfig.SetAuthServerAddress(pack.Root.Cluster.Config.Auth.ListenAddr)
 	nodeConfig.DataDir = filepath.Join(agentsDir, profileName, "data")
-	nodeConfig.Logger = libutils.NewSlogLoggerForTests()
+	nodeConfig.Logger = logtest.NewLogger()
 	nodeSvc, err := service.NewTeleport(nodeConfig)
 	require.NoError(t, err)
 	require.NoError(t, nodeSvc.Start())
@@ -1002,7 +1185,7 @@ func testDeleteConnectMyComputerNode(t *testing.T, pack *dbhelpers.DatabasePack)
 	require.NoError(t, err)
 	userRoles := []types.Role{ruleWithAllowRules}
 
-	_, err = auth.CreateUser(ctx, authServer, userName, userRoles...)
+	_, err = authtest.CreateUser(ctx, authServer, userName, userRoles...)
 	require.NoError(t, err)
 
 	// Log in as the new user.
@@ -1044,15 +1227,18 @@ func testDeleteConnectMyComputerNode(t *testing.T, pack *dbhelpers.DatabasePack)
 	nodeConfig := newNodeConfig(t, "token", types.JoinMethodToken)
 	nodeConfig.SetAuthServerAddress(pack.Root.Cluster.Config.Auth.ListenAddr)
 	nodeConfig.DataDir = filepath.Join(agentsDir, profileName, "data")
-	nodeConfig.Logger = libutils.NewSlogLoggerForTests()
+	nodeConfig.Logger = logtest.NewLogger()
 	nodeSvc, err := service.NewTeleport(nodeConfig)
 	require.NoError(t, err)
 	require.NoError(t, nodeSvc.Start())
 	t.Cleanup(func() { require.NoError(t, nodeSvc.Close()) })
 
+	nodeID, err := nodeSvc.WaitForHostID(ctx)
+	require.NoError(t, err)
+
 	// waits for the node to be added
 	require.Eventually(t, func() bool {
-		_, err := authServer.GetNode(ctx, defaults.Namespace, nodeConfig.HostUUID)
+		_, err := authServer.GetNode(ctx, defaults.Namespace, nodeID)
 		return err == nil
 	}, time.Minute, time.Second, "waiting for node to join cluster")
 
@@ -1068,7 +1254,7 @@ func testDeleteConnectMyComputerNode(t *testing.T, pack *dbhelpers.DatabasePack)
 
 	// waits for the node to be deleted
 	require.Eventually(t, func() bool {
-		_, err := authServer.GetNode(ctx, defaults.Namespace, nodeConfig.HostUUID)
+		_, err := authServer.GetNode(ctx, defaults.Namespace, nodeID)
 		return trace.IsNotFound(err)
 	}, time.Minute, time.Second, "waiting for node to be deleted")
 }
@@ -1121,7 +1307,7 @@ func testListDatabaseUsers(t *testing.T, pack *dbhelpers.DatabasePack) {
 	// Allow resource access requests to be created.
 	currentModules := modules.GetModules()
 	t.Cleanup(func() { modules.SetModules(currentModules) })
-	modules.SetModules(&modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modules.SetModules(&modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	rootClusterName, _, err := net.SplitHostPort(pack.Root.Cluster.Web)
 	require.NoError(t, err)
diff --git a/integration/utmp_integration_test.go b/integration/utmp_integration_test.go
index 1e711ddd8c4ff..2b7c579232b4e 100644
--- a/integration/utmp_integration_test.go
+++ b/integration/utmp_integration_test.go
@@ -20,6 +20,7 @@ package integration
 
 import (
 	"context"
+	"database/sql"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -39,8 +40,8 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/bpf"
@@ -65,13 +66,20 @@ var wildcardAllow = types.Labels{
 type SrvCtx struct {
 	srv        *regular.Server
 	signer     ssh.Signer
-	server     *auth.TestServer
+	server     *authtest.Server
 	clock      *clockwork.FakeClock
 	nodeClient *authclient.Client
 	nodeID     string
 	utmpPath   string
 	wtmpPath   string
 	btmpPath   string
+	wtmpdbPath string
+}
+
+func checkUserInFile(t assert.TestingT, utmp *uacc.UtmpBackend, uaccFile, username string, expectPresent bool) {
+	inFile, err := utmp.IsUserInFile(uaccFile, username)
+	assert.NoError(t, err)
+	assert.Equal(t, expectPresent, inFile)
 }
 
 // TestRootUTMPEntryExists verifies that user accounting is done on supported systems.
@@ -89,6 +97,11 @@ func TestRootUTMPEntryExists(t *testing.T) {
 	up, err := newUpack(ctx, s, teleportTestUser, []string{teleportTestUser, teleportFakeUser}, wildcardAllow)
 	require.NoError(t, err)
 
+	utmp, err := uacc.NewUtmpBackend(s.utmpPath, s.wtmpPath, s.btmpPath)
+	require.NoError(t, err)
+	wtmpdb, err := uacc.NewWtmpdbBackend(s.wtmpdbPath)
+	require.NoError(t, err)
+
 	t.Run("successful login is logged in utmp and wtmp", func(t *testing.T) {
 		sshConfig := &ssh.ClientConfig{
 			User:            teleportTestUser,
@@ -118,10 +131,14 @@ func TestRootUTMPEntryExists(t *testing.T) {
 		require.NoError(t, err)
 
 		require.EventuallyWithTf(t, func(collect *assert.CollectT) {
-			assert.NoError(collect, uacc.UserWithPtyInDatabase(s.utmpPath, teleportTestUser))
-			assert.NoError(collect, uacc.UserWithPtyInDatabase(s.wtmpPath, teleportTestUser))
+			checkUserInFile(collect, utmp, s.utmpPath, teleportTestUser, true)
+			checkUserInFile(collect, utmp, s.wtmpPath, teleportTestUser, true)
 			// Ensure than an entry was not written to btmp.
-			assert.True(collect, trace.IsNotFound(uacc.UserWithPtyInDatabase(s.btmpPath, teleportTestUser)), "unexpected error: %v", err)
+			checkUserInFile(collect, utmp, s.btmpPath, teleportTestUser, false)
+
+			inWtmpdb, err := wtmpdb.IsUserLoggedIn(teleportTestUser)
+			assert.NoError(collect, err)
+			assert.True(collect, inWtmpdb)
 		}, 5*time.Minute, time.Second, "did not detect utmp entry within 5 minutes")
 	})
 
@@ -154,43 +171,19 @@ func TestRootUTMPEntryExists(t *testing.T) {
 		require.NoError(t, err)
 
 		require.EventuallyWithT(t, func(collect *assert.CollectT) {
-			assert.NoError(collect, uacc.UserWithPtyInDatabase(s.btmpPath, teleportFakeUser))
+			checkUserInFile(collect, utmp, s.btmpPath, teleportFakeUser, true)
 			// Ensure that entries were not written to utmp and wtmp
-			assert.True(collect, trace.IsNotFound(uacc.UserWithPtyInDatabase(s.utmpPath, teleportFakeUser)), "unexpected error: %v", err)
-			assert.True(collect, trace.IsNotFound(uacc.UserWithPtyInDatabase(s.wtmpPath, teleportFakeUser)), "unexpected error: %v", err)
+			checkUserInFile(collect, utmp, s.utmpPath, teleportFakeUser, false)
+			checkUserInFile(collect, utmp, s.wtmpPath, teleportFakeUser, false)
+
+			inWtmpdb, err := wtmpdb.IsUserLoggedIn(teleportFakeUser)
+			assert.NoError(collect, err)
+			assert.False(collect, inWtmpdb)
 		}, 5*time.Minute, time.Second, "did not detect btmp entry within 5 minutes")
 	})
 
 }
 
-// TestUsernameLimit tests that the maximum length of usernames is a hard error.
-func TestRootUsernameLimit(t *testing.T) {
-	if !isRoot() {
-		t.Skip("This test will be skipped because tests are not being run as root.")
-	}
-
-	dir := t.TempDir()
-	utmpPath := filepath.Join(dir, "utmp")
-	wtmpPath := filepath.Join(dir, "wtmp")
-
-	err := TouchFile(utmpPath)
-	require.NoError(t, err)
-	err = TouchFile(wtmpPath)
-	require.NoError(t, err)
-
-	// A 33 character long username.
-	username := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-	host := [4]int32{0, 0, 0, 0}
-	tty := os.NewFile(uintptr(0), "/proc/self/fd/0")
-	err = uacc.Open(utmpPath, wtmpPath, username, "localhost", host, tty)
-	require.True(t, trace.IsBadParameter(err))
-
-	// A 32 character long username.
-	username = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-	err = uacc.Open(utmpPath, wtmpPath, username, "localhost", host, tty)
-	require.False(t, trace.IsBadParameter(err))
-}
-
 // upack holds all ssh signing artifacts needed for signing and checking user keys
 type upack struct {
 	// key is a raw private user key
@@ -243,8 +236,8 @@ func newSrvCtx(ctx context.Context, t *testing.T) *SrvCtx {
 	tempdir := t.TempDir()
 
 	var err error
-	s.server, err = auth.NewTestServer(auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+	s.server, err = authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			ClusterName: "localhost",
 			Dir:         tempdir,
 			Clock:       s.clock,
@@ -270,7 +263,7 @@ func newSrvCtx(ctx context.Context, t *testing.T) *SrvCtx {
 			Role:         types.RoleNode,
 			PublicSSHKey: sshPublicKey,
 			PublicTLSKey: tlsPublicKey,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	// set up user CA and set up a user that has access to the server
@@ -278,7 +271,7 @@ func newSrvCtx(ctx context.Context, t *testing.T) *SrvCtx {
 	require.NoError(t, err)
 
 	s.nodeID = uuid.New().String()
-	s.nodeClient, err = s.server.NewClient(auth.TestIdentity{
+	s.nodeClient, err = s.server.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: s.nodeID,
@@ -290,12 +283,22 @@ func newSrvCtx(ctx context.Context, t *testing.T) *SrvCtx {
 	utmpPath := filepath.Join(uaccDir, "utmp")
 	wtmpPath := filepath.Join(uaccDir, "wtmp")
 	btmpPath := filepath.Join(uaccDir, "btmp")
+	wtmpdbPath := filepath.Join(uaccDir, "wtmp.db")
 	require.NoError(t, TouchFile(utmpPath))
 	require.NoError(t, TouchFile(wtmpPath))
 	require.NoError(t, TouchFile(btmpPath))
+	require.NoError(t, TouchFile(wtmpdbPath))
 	s.utmpPath = utmpPath
 	s.wtmpPath = wtmpPath
 	s.btmpPath = btmpPath
+	s.wtmpdbPath = wtmpdbPath
+
+	// Initialize wtmpdb database.
+	db, err := sql.Open("sqlite3", wtmpdbPath)
+	require.NoError(t, err)
+	// Schema: https://github.com/thkukuk/wtmpdb/blob/272b109f5b3bdfb3008604461b4ddbff03c28b77/lib/sqlite.c#L128
+	_, err = db.Exec("CREATE TABLE IF NOT EXISTS wtmp(ID INTEGER PRIMARY KEY, Type INTEGER, User TEXT NOT NULL, Login INTEGER, Logout INTEGER, TTY TEXT, RemoteHost TEXT, Service TEXT) STRICT;")
+	require.NoError(t, err)
 
 	lockWatcher, err := services.NewLockWatcher(ctx, services.LockWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
@@ -342,7 +345,7 @@ func newSrvCtx(ctx context.Context, t *testing.T) *SrvCtx {
 		),
 		regular.SetBPF(&bpf.NOP{}),
 		regular.SetClock(s.clock),
-		regular.SetUserAccountingPaths(utmpPath, wtmpPath, btmpPath),
+		regular.SetUserAccountingPaths(utmpPath, wtmpPath, btmpPath, wtmpdbPath),
 		regular.SetLockWatcher(lockWatcher),
 		regular.SetSessionController(nodeSessionController),
 	)
diff --git a/integration/web/web_test.go b/integration/web/web_test.go
index d0c7e6a4e6de2..696889b1b5016 100644
--- a/integration/web/web_test.go
+++ b/integration/web/web_test.go
@@ -21,17 +21,27 @@ package web
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"testing"
+	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/mocku2f"
+	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/web"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
@@ -65,12 +75,18 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 	require.NoError(t, err)
 	user.SetRoles([]string{"app-access", "app-access-mfa"})
 
+	rootAppServer := testserver.StartDummyHTTPServer("root-app")
+	t.Cleanup(rootAppServer.Close)
+
+	rootAppMFAServer := testserver.StartDummyHTTPServer("root-app-mfa")
+	t.Cleanup(rootAppMFAServer.Close)
+
 	// Create root and leaf cluster.
-	rootServer := testserver.MakeTestServer(t,
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithBootstrap(appAccessRole, appAccessMfaRole, user),
-		testserver.WithClusterName(t, "root"),
-		testserver.WithTestApp(t, "root-app"),
-		testserver.WithTestApp(t, "root-app-mfa"),
+		testserver.WithClusterName("root"),
+		testserver.WithTestApp("root-app", rootAppServer.URL),
+		testserver.WithTestApp("root-app-mfa", rootAppMFAServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = false
 			cfg.Auth.Preference = &types.AuthPreferenceV2{
@@ -87,21 +103,38 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
+
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
 
-	leafServer := testserver.MakeTestServer(t,
+	leafAppServer := testserver.StartDummyHTTPServer("leaf-app")
+	t.Cleanup(leafAppServer.Close)
+
+	leafAppMFAServer := testserver.StartDummyHTTPServer("leaf-app-mfa")
+	t.Cleanup(leafAppMFAServer.Close)
+
+	leafServer, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithBootstrap(appAccessRole, appAccessMfaRole),
-		testserver.WithClusterName(t, "leaf"),
-		testserver.WithTestApp(t, "leaf-app"),
-		testserver.WithTestApp(t, "leaf-app-mfa"),
+		testserver.WithClusterName("leaf"),
+		testserver.WithTestApp("leaf-app", leafAppServer.URL),
+		testserver.WithTestApp("leaf-app-mfa", leafAppMFAServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = false
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, leafServer.Close())
+		require.NoError(t, leafServer.Wait())
+	})
 	leafAuth := leafServer.GetAuthServer()
 
-	testserver.SetupTrustedCluster(ctx, t, rootServer, leafServer,
+	SetupTrustedCluster(ctx, t, rootServer, leafServer,
 		types.RoleMapping{
 			Remote: "app-access",
 			Local:  []string{"app-access"},
@@ -122,7 +155,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 	require.NoError(t, err)
 
 	// Setup user for login, then login.
-	device := testserver.RegisterPasswordlessDeviceForUser(t, rootServer, user.GetName())
+	device := RegisterPasswordlessDeviceForUser(t, rootServer, user.GetName())
 	webPack := helpers.LoginMFAWebClient(t, rootProxyAddr.String(), device)
 
 	endpoint, err := url.JoinPath("mfa", "authenticatechallenge")
@@ -142,7 +175,8 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 				FQDNHint:    "root-app.root",
 			},
 			expectMFARequired: false,
-		}, {
+		},
+		{
 			name: "root-app-mfa",
 			resolveAppParams: web.ResolveAppParams{
 				AppName:     "root-app-mfa",
@@ -160,7 +194,8 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 				FQDNHint:    "leaf-app.root",
 			},
 			expectMFARequired: false,
-		}, {
+		},
+		{
 			name: "leaf-app-mfa",
 			resolveAppParams: web.ResolveAppParams{
 				AppName:     "leaf-app-mfa",
@@ -196,7 +231,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 						},
 					}
 
-					respStatusCode, respBody := webPack.DoRequest(t, http.MethodPost, endpoint, req)
+					respStatusCode, respBody := webPack.DoWebAPIRequest(t, http.MethodPost, endpoint, req)
 					require.Equal(t, http.StatusOK, respStatusCode, string(respBody))
 
 					var resp client.MFAAuthenticateChallenge
@@ -212,3 +247,102 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 		})
 	}
 }
+
+// RegisterPasswordlessDeviceForUser registers a mocked passwordless device for the user
+// to use during login or pass other routine MFA checks. The cluster auth preference should
+// be set up to allow webauthn and passwordless before calling this helper.
+func RegisterPasswordlessDeviceForUser(t *testing.T, server *service.TeleportProcess, username string) *mocku2f.Key {
+	proxyAddr, err := server.ProxyWebAddr()
+	require.NoError(t, err)
+	origin := fmt.Sprintf("https://%v", proxyAddr.Host())
+
+	device, err := mocku2f.Create()
+	require.NoError(t, err)
+	device.SetPasswordless()
+
+	ctx := context.Background()
+	token, err := server.GetAuthServer().CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
+		Name: username,
+	})
+	require.NoError(t, err)
+
+	tokenID := token.GetName()
+	res, err := server.GetAuthServer().CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
+		TokenID:     tokenID,
+		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+	})
+	require.NoError(t, err)
+	cc := wantypes.CredentialCreationFromProto(res.GetWebauthn())
+
+	ccr, err := device.SignCredentialCreation(origin, cc)
+	require.NoError(t, err)
+	_, err = server.GetAuthServer().ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
+		TokenID: tokenID,
+		NewMFARegisterResponse: &proto.MFARegisterResponse{
+			Response: &proto.MFARegisterResponse_Webauthn{
+				Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	return device
+}
+
+func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) {
+	// Use insecure mode so that the trusted cluster can establish trust over reverse tunnel.
+	isInsecure := lib.IsInsecureDevMode()
+	lib.SetInsecureDevMode(true)
+	t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) })
+
+	rootProxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+	rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr()
+	require.NoError(t, err)
+
+	tc, err := types.NewTrustedCluster(rootServer.Config.Auth.ClusterName.GetClusterName(), types.TrustedClusterSpecV2{
+		Enabled:              true,
+		Token:                testserver.StaticToken,
+		ProxyAddress:         rootProxyAddr.String(),
+		ReverseTunnelAddress: rootProxyTunnelAddr.String(),
+		RoleMap: append(additionalRoleMappings,
+			types.RoleMapping{
+				Remote: "access",
+				Local:  []string{"access"},
+			},
+		),
+	})
+	require.NoError(t, err)
+
+	_, err = leafServer.GetAuthServer().UpsertTrustedClusterV2(ctx, tc)
+	require.NoError(t, err)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rt, err := rootServer.GetAuthServer().GetTunnelConnections(leafServer.Config.Auth.ClusterName.GetClusterName())
+		require.NoError(t, err)
+		require.Len(t, rt, 1)
+	}, time.Second*10, 200*time.Millisecond)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rts, err := rootServer.GetAuthServer().GetRemoteClusters(ctx)
+		require.NoError(t, err)
+		require.Len(t, rts, 1)
+	}, time.Second*10, 200*time.Millisecond)
+
+	tsrv, err := rootServer.GetReverseTunnelServer()
+	require.NoError(t, err)
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rts, err := tsrv.Cluster(ctx, leafServer.Config.Auth.ClusterName.GetClusterName())
+		require.NoError(t, err)
+		require.NotNil(t, rts)
+
+		require.Equal(t, 1, rts.GetTunnelsCount())
+
+		client, err := rts.CachingAccessPoint()
+		require.NoError(t, err)
+		appS, err := client.GetApplicationServers(ctx, defaults.Namespace)
+		require.NoError(t, err)
+		require.Len(t, appS, 2)
+	}, time.Second*10, 200*time.Millisecond)
+}
diff --git a/integrations/Makefile b/integrations/Makefile
index 68ed16762d839..7a5fab9050b68 100644
--- a/integrations/Makefile
+++ b/integrations/Makefile
@@ -1,13 +1,13 @@
 .PHONY: test
-test: test-access test-lib test-event-handler test-terraform-provider
+test: test-access test-lib test-event-handler test-terraform-provider test-terraform-provider-mwi
 
 .PHONY: test-access
 test-access:
-	go test -v ./access/...
+	gotestsum --junitfile unit-tests-integrations-access.xml --jsonfile unit-tests-integrations-access.json ./access/...
 
 .PHONY: test-lib
 test-lib:
-	go test ./lib/...
+	gotestsum --junitfile unit-tests-integrations-lib.xml --jsonfile unit-tests-integrations-lib.json ./lib/...
 
 .PHONY: test-event-handler
 test-event-handler:
@@ -16,3 +16,7 @@ test-event-handler:
 .PHONY: test-terraform-provider
 test-terraform-provider:
 	make -C terraform test
+
+.PHONY: test-terraform-provider-mwi
+test-terraform-provider-mwi:
+	make -C terraform-mwi test
diff --git a/integrations/access/Dockerfile b/integrations/access/Dockerfile
index a7fa663daa2d1..42d5692a6a4c8 100644
--- a/integrations/access/Dockerfile
+++ b/integrations/access/Dockerfile
@@ -2,7 +2,7 @@ ARG BASE_IMAGE=gcr.io/distroless/static-debian12
 
 # BUILDPLATFORM is provided by Docker/buildx
 # Extract the built tarball to reduce the final image size
-FROM --platform=${BUILDPLATFORM} alpine:3.20.0 as extractor
+FROM --platform=${BUILDPLATFORM} alpine:3.20.0 AS extractor
 
 ARG TARGETARCH
 ARG TARGETOS
@@ -19,7 +19,8 @@ RUN tar -xzvf /plugin.tar.gz && \
 
 # Create the image with the build operator on the $TARGETPLATFORM
 # TARGETPLATFORM is provided by Docker/buildx
-FROM --platform=${TARGETPLATFORM} ${BASE_IMAGE}
+# --platform=${TARGETPLATFORM} is set by default and the docker linter complains if we set it.
+FROM ${BASE_IMAGE}
 WORKDIR /
 COPY --from=extractor /teleport-plugin /usr/local/bin/teleport-plugin
 
diff --git a/integrations/access/accesslist/app.go b/integrations/access/accesslist/app.go
index ba40de3abf575..f2534670429eb 100644
--- a/integrations/access/accesslist/app.go
+++ b/integrations/access/accesslist/app.go
@@ -131,6 +131,12 @@ func (a *App) run(ctx context.Context) error {
 		select {
 		case <-timer.Chan():
 			if err := a.remindIfNecessary(ctx); err != nil {
+				// if the call returns NotImplemented, gracefully end the access list app,
+				// as we may be communicating with an OSS server, which does not support access lists.
+				if trace.IsNotImplemented(err) {
+					log.WarnContext(ctx, "Slack plugin is connected to an auth server that does not support access lists. Access list reminders will be disabled")
+					return nil
+				}
 				return trace.Wrap(err)
 			}
 			timer.Reset(jitter(reminderInterval))
@@ -157,7 +163,7 @@ func (a *App) remindIfNecessary(ctx context.Context) error {
 		accessLists, nextToken, err = a.apiClient.ListAccessLists(ctx, 0 /* default page size */, nextToken)
 		if err != nil {
 			if trace.IsNotImplemented(err) {
-				log.ErrorContext(ctx, "access list endpoint is not implemented on this auth server, so the access list app is ceasing to run")
+				log.WarnContext(ctx, "access list endpoint is not implemented on this auth server, so the access list app is ceasing to run")
 				return trace.Wrap(err)
 			} else if trace.IsAccessDenied(err) {
 				const msg = "Slack bot does not have permissions to list access lists. Please add access_list read and list permissions " +
@@ -170,6 +176,9 @@ func (a *App) remindIfNecessary(ctx context.Context) error {
 		}
 
 		for _, accessList := range accessLists {
+			if !accessList.IsReviewable() {
+				continue
+			}
 			recipients, err := a.getRecipientsRequiringReminders(ctx, accessList)
 			if err != nil {
 				log.WarnContext(ctx, "Error getting recipients to notify for review due for access list",
@@ -225,7 +234,7 @@ func (a *App) getRecipientsRequiringReminders(ctx context.Context, accessList *a
 		return nil, nil
 	}
 
-	allRecipients := a.fetchRecipients(ctx, accessList, now, notificationStart)
+	allRecipients := a.fetchRecipients(ctx, accessList)
 	if len(allRecipients) == 0 {
 		return nil, trace.NotFound("no recipients could be fetched for access list %s", accessList.GetName())
 	}
@@ -254,7 +263,7 @@ func (a *App) getRecipientsRequiringReminders(ctx context.Context, accessList *a
 }
 
 // fetchRecipients will return all recipients.
-func (a *App) fetchRecipients(ctx context.Context, accessList *accesslist.AccessList, now, notificationStart time.Time) map[string]common.Recipient {
+func (a *App) fetchRecipients(ctx context.Context, accessList *accesslist.AccessList) map[string]common.Recipient {
 	log := logger.Get(ctx)
 
 	var allOwners []*accesslist.Owner
diff --git a/integrations/access/accesslist/app_test.go b/integrations/access/accesslist/app_test.go
index 6e803ccb7ccef..7eb2f5f53fe8c 100644
--- a/integrations/access/accesslist/app_test.go
+++ b/integrations/access/accesslist/app_test.go
@@ -37,7 +37,9 @@ import (
 	"github.com/gravitational/teleport/integrations/access/common"
 	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -117,12 +119,7 @@ func TestAccessListReminders_Single(t *testing.T) {
 
 	clock := clockwork.NewFakeClockAt(time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC))
 
-	server := newTestAuth(t)
-
-	as := server.Auth()
-	t.Cleanup(func() {
-		require.NoError(t, as.Close())
-	})
+	authServer := newTestAuth(t)
 
 	bot := &mockMessagingBot{
 		recipients: map[string]*common.Recipient{
@@ -130,7 +127,7 @@ func TestAccessListReminders_Single(t *testing.T) {
 			"owner2": {Name: "owner2", ID: "owner2"},
 		},
 	}
-	app := common.NewApp(&mockPluginConfig{client: as, bot: bot}, "test-plugin")
+	app := common.NewApp(&mockPluginConfig{client: authServer, bot: bot}, "test-plugin")
 	app.Clock = clock
 	ctx := context.Background()
 	go func() {
@@ -147,67 +144,136 @@ func TestAccessListReminders_Single(t *testing.T) {
 		require.NoError(t, app.Err())
 	})
 
-	accessList, err := accesslist.NewAccessList(header.Metadata{
-		Name: "test-access-list",
-	}, accesslist.Spec{
-		Title:  "test access list",
-		Owners: []accesslist.Owner{{Name: "owner1"}, {Name: "not-found"}},
-		Grants: accesslist.Grants{
-			Roles: []string{"role"},
-		},
-		Audit: accesslist.Audit{
-			NextAuditDate: clock.Now().Add(28 * 24 * time.Hour), // Four weeks out from today
-			Notifications: accesslist.Notifications{
-				Start: oneDay * 14, // Start alerting at two weeks before audit date
+	for _, typ := range []accesslist.Type{accesslist.Default, accesslist.DeprecatedDynamic} {
+		accessList, err := accesslist.NewAccessList(header.Metadata{
+			Name: "test-access-list",
+		}, accesslist.Spec{
+			Type:   typ,
+			Title:  "test access list",
+			Owners: []accesslist.Owner{{Name: "owner1"}, {Name: "not-found"}},
+			Grants: accesslist.Grants{
+				Roles: []string{"role"},
 			},
-		},
-	})
-	require.NoError(t, err)
+			Audit: accesslist.Audit{
+				NextAuditDate: clock.Now().Add(28 * 24 * time.Hour), // Four weeks out from today
+				Notifications: accesslist.Notifications{
+					Start: oneDay * 14, // Start alerting at two weeks before audit date
+				},
+			},
+		})
+		require.NoError(t, err)
 
-	accessLists := []*accesslist.AccessList{accessList}
+		accessLists := []*accesslist.AccessList{accessList}
 
-	// No notifications for today
-	advanceAndLookForRecipients(t, bot, as, clock, 0, accessLists)
+		// No notifications for today
+		advanceAndLookForRecipients(t, bot, authServer, clock, 0, accessLists)
 
-	// Advance by one week, expect no notifications.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*7, accessLists)
+		// Advance by one week, expect no notifications.
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists)
 
-	// Advance by one week, expect a notification. "not-found" will be missing as a recipient.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*7, accessLists, "owner1")
+		// Advance by one week, expect a notification. "not-found" will be missing as a recipient.
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists, "owner1")
 
-	// Add a new owner.
-	accessList.Spec.Owners = append(accessList.Spec.Owners, accesslist.Owner{Name: "owner2"})
+		// Add a new owner.
+		accessList.Spec.Owners = append(accessList.Spec.Owners, accesslist.Owner{Name: "owner2"})
 
-	// Advance by one day, expect a notification only to the new owner.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay, accessLists, "owner2")
+		// Advance by one day, expect a notification only to the new owner.
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay, accessLists, "owner2")
 
-	// Advance by one day, expect no notifications.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay, accessLists)
+		// Advance by one day, expect no notifications.
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay, accessLists)
 
-	// Advance by five more days, to the next week, expect two notifications
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*5, accessLists, "owner1", "owner2")
+		// Advance by five more days, to the next week, expect two notifications
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*5, accessLists, "owner1", "owner2")
 
-	// Advance by one day, expect no notifications
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay, accessLists)
+		// Advance by one day, expect no notifications
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay, accessLists)
 
-	// Advance by one day, expect no notifications
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay, accessLists)
+		// Advance by one day, expect no notifications
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay, accessLists)
 
-	// Advance by five more days, to the next week, expect two notifications
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*5, accessLists, "owner1", "owner2")
+		// Advance by five more days, to the next week, expect two notifications
+		advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*5, accessLists, "owner1", "owner2")
 
-	// Advance 60 days a day at a time, expect two notifications each time.
-	for i := 0; i < 60; i++ {
-		// Make sure we only get a notification once per day by iterating through each 6 hours at a time.
-		for j := 0; j < 3; j++ {
-			advanceAndLookForRecipients(t, bot, as, clock, 6*time.Hour, accessLists)
+		// Advance 60 days a day at a time, expect two notifications each time.
+		for range 60 {
+			// Make sure we only get a notification once per day by iterating through each 6 hours at a time.
+			for range 3 {
+				advanceAndLookForRecipients(t, bot, authServer, clock, 6*time.Hour, accessLists)
+			}
+			advanceAndLookForRecipients(t, bot, authServer, clock, 6*time.Hour, accessLists, "owner1", "owner2")
 		}
-		advanceAndLookForRecipients(t, bot, as, clock, 6*time.Hour, accessLists, "owner1", "owner2")
+	}
+}
+
+func TestAccessListReminders_NoneForNonReviewable(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClockAt(time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC))
+
+	authServer := newTestAuth(t)
+
+	bot := &mockMessagingBot{
+		recipients: map[string]*common.Recipient{
+			"static-owner": {Name: "static-owner", ID: "static-owner"},
+		},
+	}
+	app := common.NewApp(&mockPluginConfig{client: authServer, bot: bot}, "test-plugin")
+	app.Clock = clock
+	ctx := context.Background()
+	go func() {
+		app.Run(ctx)
+	}()
+
+	ready, err := app.WaitReady(ctx)
+	require.NoError(t, err)
+	require.True(t, ready)
+
+	t.Cleanup(func() {
+		app.Terminate()
+		<-app.Done()
+		require.NoError(t, app.Err())
+	})
+
+	for _, typ := range []accesslist.Type{
+		accesslist.SCIM,
+		accesslist.Static,
+	} {
+		t.Run(string(typ), func(t *testing.T) {
+			const testAccessListName = "test-non-reviewable-access-list"
+
+			// Clean up the AccessList. A single one has to be reused, otherwise:
+			// cluster has reached its limit for creating access lists, please contact
+			// the cluster administrator
+			err := authServer.DeleteAccessList(ctx, testAccessListName)
+			require.True(t, err == nil || trace.IsNotFound(err), "err = %s", err)
+
+			nonReviewableAccessList, err := accesslist.NewAccessList(header.Metadata{
+				Name: testAccessListName,
+			}, accesslist.Spec{
+				Type:   typ,
+				Title:  "test static access list",
+				Owners: []accesslist.Owner{{Name: "static-owner"}},
+				Grants: accesslist.Grants{
+					Roles: []string{"role"},
+				},
+				Audit: accesslist.Audit{},
+			})
+			require.NoError(t, err)
+
+			accessLists := []*accesslist.AccessList{nonReviewableAccessList}
+
+			// No notifications for today
+			advanceAndLookForRecipients(t, bot, authServer, clock, 0, accessLists)
+
+			// Advance by one week, expect no notifications.
+			advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists)
+		})
 	}
 }
 
 func TestAccessListReminders_Batched(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.Identity: {Enabled: true},
@@ -217,12 +283,7 @@ func TestAccessListReminders_Batched(t *testing.T) {
 
 	clock := clockwork.NewFakeClockAt(time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC))
 
-	server := newTestAuth(t)
-
-	as := server.Auth()
-	t.Cleanup(func() {
-		require.NoError(t, as.Close())
-	})
+	authServer := newTestAuth(t)
 
 	bot := &mockMessagingBot{
 		recipients: map[string]*common.Recipient{
@@ -230,7 +291,7 @@ func TestAccessListReminders_Batched(t *testing.T) {
 			"owner2": {Name: "owner2", ID: "owner2"},
 		},
 	}
-	app := common.NewApp(&mockPluginConfig{client: as, bot: bot}, "test-plugin")
+	app := common.NewApp(&mockPluginConfig{client: authServer, bot: bot}, "test-plugin")
 	app.Clock = clock
 	ctx := context.Background()
 	go func() {
@@ -284,16 +345,16 @@ func TestAccessListReminders_Batched(t *testing.T) {
 	accessLists := []*accesslist.AccessList{accessList1, accessList2}
 
 	// No notifications for today
-	advanceAndLookForRecipients(t, bot, as, clock, 0, accessLists)
+	advanceAndLookForRecipients(t, bot, authServer, clock, 0, accessLists)
 
 	// Advance by one week, expect no notifications.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*7, accessLists)
+	advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists)
 
 	// Advance by one week, expect a notification. "not-found" will be missing as a recipient.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*7, accessLists, "owner1", "owner2")
+	advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists, "owner1", "owner2")
 
 	// Advance another week, expect notifications.
-	advanceAndLookForRecipients(t, bot, as, clock, oneDay*7, accessLists, "owner1", "owner2")
+	advanceAndLookForRecipients(t, bot, authServer, clock, oneDay*7, accessLists, "owner1", "owner2")
 }
 
 type mockClient struct {
@@ -311,15 +372,11 @@ func TestAccessListReminders_BadClient(t *testing.T) {
 
 	clock := clockwork.NewFakeClockAt(time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC))
 
-	server := newTestAuth(t)
-	as := server.Auth()
-	t.Cleanup(func() {
-		require.NoError(t, as.Close())
-	})
+	authServer := newTestAuth(t)
 
 	// Use this mock client so that we can force ListAccessLists to return an error.
 	client := &mockClient{
-		Client: as,
+		Client: authServer,
 	}
 	client.On("ListAccessLists", mock.Anything, mock.Anything, mock.Anything).Return(([]*accesslist.AccessList)(nil), "", trace.BadParameter("error"))
 
@@ -354,6 +411,51 @@ func TestAccessListReminders_BadClient(t *testing.T) {
 	}
 }
 
+// TestAccessListReminders_NotImplemented does not return error (crash) if ListAccessLists is not supported.
+func TestAccessListReminders_NotImplemented(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClockAt(time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC))
+
+	authServer := newTestAuth(t)
+
+	// Use this mock client so that we can force ListAccessLists to return an error.
+	// The error we force is NotImplemented, which should not cause the app to crash.
+	client := &mockClient{
+		Client: authServer,
+	}
+	client.On("ListAccessLists", mock.Anything, mock.Anything, mock.Anything).Return(([]*accesslist.AccessList)(nil), "", trace.NotImplemented("error"))
+
+	bot := &mockMessagingBot{
+		recipients: map[string]*common.Recipient{
+			"owner1": {Name: "owner1"},
+			"owner2": {Name: "owner2"},
+		},
+	}
+	app := common.NewApp(&mockPluginConfig{client: client, bot: bot}, "test-plugin")
+	app.Clock = clock
+	ctx := context.Background()
+
+	go func() {
+		app.Run(ctx)
+	}()
+
+	ready, err := app.WaitReady(ctx)
+	require.NoError(t, err)
+	require.True(t, ready)
+
+	err = clock.BlockUntilContext(ctx, 1)
+	require.NoError(t, err)
+	clock.Advance(3 * time.Hour)
+
+	// ensure ListAccessLists was called only once, and app returns no error on termination
+	app.Terminate()
+	<-app.Done()
+	require.NoError(t, app.Err())
+
+	client.AssertNumberOfCalls(t, "ListAccessLists", 1)
+}
+
 func advanceAndLookForRecipients(t *testing.T,
 	bot *mockMessagingBot,
 	alSvc services.AccessLists,
@@ -384,9 +486,9 @@ func advanceAndLookForRecipients(t *testing.T,
 	require.ElementsMatch(t, expectedRecipients, bot.getLastRecipients())
 }
 
-func newTestAuth(t *testing.T) *auth.TestServer {
-	server, err := auth.NewTestServer(auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+func newTestAuth(t *testing.T) *auth.Server {
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			Dir:   t.TempDir(),
 			Clock: clockwork.NewFakeClock(),
 			AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -398,5 +500,10 @@ func newTestAuth(t *testing.T) *auth.TestServer {
 		},
 	})
 	require.NoError(t, err)
-	return server
+
+	authServer := server.Auth()
+	t.Cleanup(func() {
+		require.NoError(t, authServer.Close())
+	})
+	return authServer
 }
diff --git a/integrations/access/accessmonitoring/access_monitoring_rules.go b/integrations/access/accessmonitoring/access_monitoring_rules.go
index 42b663d8abb01..126f84b1d34ff 100644
--- a/integrations/access/accessmonitoring/access_monitoring_rules.go
+++ b/integrations/access/accessmonitoring/access_monitoring_rules.go
@@ -26,13 +26,17 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/accessrequest"
+	"github.com/gravitational/teleport/api/client/proto"
 	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/trait"
 	"github.com/gravitational/teleport/integrations/access/common"
 	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/integrations/lib/logger"
-	"github.com/gravitational/teleport/integrations/lib/stringset"
 	"github.com/gravitational/teleport/lib/accessmonitoring"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 const (
@@ -145,25 +149,22 @@ func (amrh *RuleHandler) RecipientsFromAccessMonitoringRules(ctx context.Context
 	log := logger.Get(ctx)
 	recipientSet := common.NewRecipientSet()
 
-	for _, rule := range amrh.getAccessMonitoringRules() {
-		match, err := accessmonitoring.EvaluateCondition(rule.Spec.Condition, getAccessRequestExpressionEnv(req))
+	rawRecipients, err := amrh.recipients(ctx, req)
+	if err != nil {
+		log.WarnContext(ctx, "Failed to create expression env", "error", err)
+		return &recipientSet
+	}
+
+	for _, rawRecipient := range rawRecipients {
+		rec, err := amrh.fetchRecipientCallback(ctx, rawRecipient)
 		if err != nil {
-			log.WarnContext(ctx, "Failed to parse access monitoring notification rule",
+			log.WarnContext(ctx, "Failed to fetch plugin recipients based on Access monitoring rule recipients",
+				"recipient", rawRecipient,
 				"error", err,
-				"rule", rule.Metadata.Name,
 			)
-		}
-		if !match {
 			continue
 		}
-		for _, recipient := range rule.GetSpec().GetNotification().GetRecipients() {
-			rec, err := amrh.fetchRecipientCallback(ctx, recipient)
-			if err != nil {
-				log.WarnContext(ctx, "Failed to fetch plugin recipients based on Access monitoring rule recipients", "error", err)
-				continue
-			}
-			recipientSet.Add(*rec)
-		}
+		recipientSet.Add(*rec)
 	}
 	return &recipientSet
 }
@@ -171,23 +172,30 @@ func (amrh *RuleHandler) RecipientsFromAccessMonitoringRules(ctx context.Context
 // RawRecipientsFromAccessMonitoringRules returns the recipients that result from the Access Monitoring Rules being applied to the given Access Request without converting to the rich recipient type.
 func (amrh *RuleHandler) RawRecipientsFromAccessMonitoringRules(ctx context.Context, req types.AccessRequest) []string {
 	log := logger.Get(ctx)
-	recipientSet := stringset.New()
-	for _, rule := range amrh.getAccessMonitoringRules() {
-		match, err := accessmonitoring.EvaluateCondition(rule.Spec.Condition, getAccessRequestExpressionEnv(req))
-		if err != nil {
-			log.WarnContext(ctx, "Failed to parse access monitoring notification rule",
-				"error", err,
-				"rule", rule.Metadata.Name,
-			)
-		}
-		if !match {
-			continue
-		}
+	rawRecipients, err := amrh.recipients(ctx, req)
+	if err != nil {
+		log.WarnContext(ctx, "Failed to create expression env", "error", err)
+		return nil
+	}
+	return rawRecipients
+}
+
+func (amrh *RuleHandler) recipients(ctx context.Context, req types.AccessRequest) ([]string, error) {
+	log := logger.Get(ctx)
+	recipientSet := utils.NewSet[string]()
+
+	env, err := amrh.newExpressionEnv(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	matchingRules := accessmonitoring.EvaluateRules(ctx, log, env, amrh.getAccessMonitoringRules())
+	for _, rule := range matchingRules {
 		for _, recipient := range rule.GetSpec().GetNotification().GetRecipients() {
 			recipientSet.Add(recipient)
 		}
 	}
-	return recipientSet.ToSlice()
+	return recipientSet.Elements(), nil
 }
 
 func (amrh *RuleHandler) getAllAccessMonitoringRules(ctx context.Context) ([]*accessmonitoringrulesv1.AccessMonitoringRule, error) {
@@ -223,10 +231,10 @@ func (amrh *RuleHandler) getAllAccessMonitoringRules(ctx context.Context) ([]*ac
 	return resources, nil
 }
 
-func (amrh *RuleHandler) getAccessMonitoringRules() map[string]*accessmonitoringrulesv1.AccessMonitoringRule {
+func (amrh *RuleHandler) getAccessMonitoringRules() []*accessmonitoringrulesv1.AccessMonitoringRule {
 	amrh.accessMonitoringRules.RLock()
 	defer amrh.accessMonitoringRules.RUnlock()
-	return maps.Clone(amrh.accessMonitoringRules.rules)
+	return slices.Collect(maps.Values(maps.Clone(amrh.accessMonitoringRules.rules)))
 }
 
 func (amrh *RuleHandler) ruleApplies(amr *accessmonitoringrulesv1.AccessMonitoringRule) bool {
@@ -238,15 +246,35 @@ func (amrh *RuleHandler) ruleApplies(amr *accessmonitoringrulesv1.AccessMonitori
 	})
 }
 
-// getAccessRequestExpressionEnv returns the expression env of the access request.
-func getAccessRequestExpressionEnv(req types.AccessRequest) accessmonitoring.AccessRequestExpressionEnv {
-	return accessmonitoring.AccessRequestExpressionEnv{
-		Roles:              req.GetRoles(),
-		SuggestedReviewers: req.GetSuggestedReviewers(),
-		Annotations:        req.GetSystemAnnotations(),
-		User:               req.GetUser(),
-		RequestReason:      req.GetRequestReason(),
-		CreationTime:       req.GetCreationTime(),
-		Expiry:             req.Expiry(),
+// newExpressionEnv returns the expression env of the access request.
+func (amrh *RuleHandler) newExpressionEnv(ctx context.Context, req types.AccessRequest) (accessmonitoring.AccessRequestExpressionEnv, error) {
+	log := logger.Get(ctx)
+
+	var userTraits trait.Traits
+	userState, err := services.GetUserOrLoginState(ctx, amrh.apiClient, req.GetUser())
+	switch {
+	case trace.IsAccessDenied(err):
+		log.WarnContext(ctx, `Missing permissions to read user.traits, please use the preset "access-plugin" role`, "error", err)
+	case err != nil:
+		return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
+	default:
+		userTraits = userState.GetTraits()
+	}
+
+	// UsePreviewAsRoles option is required to fetch requested resource labels.
+	usePreviewAsRoles := func(req *proto.ListResourcesRequest) {
+		req.UsePreviewAsRoles = true
 	}
+
+	requestedResources, err := accessrequest.GetResourcesByResourceIDs(
+		ctx,
+		amrh.apiClient,
+		req.GetRequestedResourceIDs(),
+		usePreviewAsRoles,
+	)
+	if err != nil {
+		return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
+	}
+
+	return accessmonitoring.NewAccessRequestExpressionEnv(req, userTraits, requestedResources), nil
 }
diff --git a/integrations/access/accessmonitoring/access_monitoring_rules_test.go b/integrations/access/accessmonitoring/access_monitoring_rules_test.go
index 619016b049f4f..920a6316382fb 100644
--- a/integrations/access/accessmonitoring/access_monitoring_rules_test.go
+++ b/integrations/access/accessmonitoring/access_monitoring_rules_test.go
@@ -21,19 +21,289 @@ package accessmonitoring
 import (
 	"context"
 	"testing"
+	"time"
 
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/integrations/access/common"
+	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/lib/services"
 )
 
+type mockTeleportClient struct {
+	mock.Mock
+	teleport.Client
+}
+
+func (m *mockTeleportClient) GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error) {
+	args := m.Called(ctx, name, withSecrets)
+	return args.Get(0).(types.User), args.Error(1)
+}
+
+func (m *mockTeleportClient) GetUserLoginState(ctx context.Context, name string) (*userloginstate.UserLoginState, error) {
+	args := m.Called(ctx, name)
+	userLoginState, ok := args.Get(0).(*userloginstate.UserLoginState)
+	if ok {
+		return userLoginState, args.Error(1)
+	}
+	return nil, args.Error(1)
+}
+
+func (m *mockTeleportClient) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+	args := m.Called(ctx, req)
+	return args.Get(0).(*types.ListResourcesResponse), args.Error(1)
+}
+
 func mockFetchRecipient(ctx context.Context, recipient string) (*common.Recipient, error) {
 	return nil, nil
 }
 
+func TestRecipients(t *testing.T) {
+	const (
+		pluginName = "fakePluginName"
+		pluginType = "fakePluginType"
+		requester  = "requester@example.com"
+		noTraits   = "no-traits@example.com"
+		recipient  = "recipient@goteleport.com"
+	)
+
+	teleportClient := &mockTeleportClient{}
+
+	teleportClient.
+		On("GetUserLoginState", mock.Anything, requester).
+		Return(&userloginstate.UserLoginState{
+			Spec: userloginstate.Spec{
+				Traits: map[string][]string{
+					"team": {"example"},
+				},
+			},
+		}, nil)
+
+	teleportClient.
+		On("GetUserLoginState", mock.Anything, noTraits).
+		Return(&userloginstate.UserLoginState{
+			Spec: userloginstate.Spec{
+				Traits: map[string][]string{},
+			},
+		}, nil)
+
+	amrh := NewRuleHandler(RuleHandlerConfig{
+		Client:     teleportClient,
+		PluginType: pluginType,
+		PluginName: pluginName,
+		FetchRecipientCallback: func(ctx context.Context, recipient string) (*common.Recipient, error) {
+			return emailRecipient(recipient), nil
+		},
+	})
+
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+		Subjects:  []string{types.KindAccessRequest},
+		Condition: `user.traits["team"].contains("example")`,
+		Notification: &pb.Notification{
+			Name:       pluginName,
+			Recipients: []string{recipient},
+		},
+	})
+	require.NoError(t, err)
+	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
+		Type:     types.OpPut,
+		Resource: types.Resource153ToLegacy(rule1),
+	})
+	require.Len(t, amrh.getAccessMonitoringRules(), 1)
+
+	ctx := context.Background()
+
+	// Expect recipient from matching rule.
+	req := &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			User: requester,
+		},
+	}
+
+	recipients := amrh.RecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []common.Recipient{*emailRecipient(recipient)}, recipients.ToSlice())
+
+	rawRecipients := amrh.RawRecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []string{recipient}, rawRecipients)
+
+	// Expect no recipient from user with no traits.
+	req = &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			User: noTraits,
+		},
+	}
+
+	recipients = amrh.RecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []common.Recipient{}, recipients.ToSlice())
+
+	rawRecipients = amrh.RawRecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []string{}, rawRecipients)
+}
+
+func TestRecipientsWithResources(t *testing.T) {
+	const (
+		pluginName = "fakePluginName"
+		pluginType = "fakePluginType"
+		recipient  = "recipient@goteleport.com"
+	)
+
+	teleportClient := &mockTeleportClient{}
+	teleportClient.
+		On("GetUserLoginState", mock.Anything, mock.Anything).
+		Return(&userloginstate.UserLoginState{}, nil)
+
+	teleportClient.
+		On("ListResources", mock.Anything, mock.Anything).
+		Return(&types.ListResourcesResponse{
+			Resources: []types.ResourceWithLabels{
+				&types.ServerV2{
+					Metadata: types.Metadata{
+						Name:   "test-node",
+						Labels: map[string]string{"env": "dev"},
+					},
+				},
+			},
+			NextKey:    "",
+			TotalCount: 1,
+		}, nil)
+
+	amrh := NewRuleHandler(RuleHandlerConfig{
+		Client:     teleportClient,
+		PluginType: pluginType,
+		PluginName: pluginName,
+		FetchRecipientCallback: func(ctx context.Context, recipient string) (*common.Recipient, error) {
+			return emailRecipient(recipient), nil
+		},
+	})
+
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+		Subjects:  []string{types.KindAccessRequest},
+		Condition: `access_request.spec.resource_labels_intersection["env"].contains("dev")`,
+		Notification: &pb.Notification{
+			Name:       pluginName,
+			Recipients: []string{recipient},
+		},
+	})
+	require.NoError(t, err)
+	err = amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
+		Type:     types.OpPut,
+		Resource: types.Resource153ToLegacy(rule1),
+	})
+	require.NoError(t, err)
+	require.Len(t, amrh.getAccessMonitoringRules(), 1)
+
+	ctx := context.Background()
+
+	req := &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			RequestedResourceIDs: []types.ResourceID{
+				{
+					Kind: types.KindNode,
+					Name: "test-node",
+				},
+			},
+		},
+	}
+
+	recipients := amrh.RecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []common.Recipient{*emailRecipient(recipient)}, recipients.ToSlice())
+
+	rawRecipients := amrh.RawRecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []string{recipient}, rawRecipients)
+}
+
+func TestRecipientsWithSchedules(t *testing.T) {
+	const (
+		pluginName = "fakePluginName"
+		pluginType = "fakePluginType"
+		recipient  = "recipient@goteleport.com"
+	)
+
+	teleportClient := &mockTeleportClient{}
+	teleportClient.
+		On("GetUserLoginState", mock.Anything, mock.Anything).
+		Return(&userloginstate.UserLoginState{}, nil)
+
+	amrh := NewRuleHandler(RuleHandlerConfig{
+		Client:     teleportClient,
+		PluginType: pluginType,
+		PluginName: pluginName,
+		FetchRecipientCallback: func(ctx context.Context, recipient string) (*common.Recipient, error) {
+			return emailRecipient(recipient), nil
+		},
+	})
+
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+		Subjects: []string{types.KindAccessRequest},
+		Schedules: map[string]*pb.Schedule{
+			"default": {
+				Time: &pb.TimeSchedule{
+					Shifts: []*pb.TimeSchedule_Shift{
+						{
+							Weekday: time.Monday.String(),
+							Start:   "14:00",
+							End:     "15:00",
+						},
+					},
+				},
+			},
+		},
+		Condition: `true`,
+		Notification: &pb.Notification{
+			Name:       pluginName,
+			Recipients: []string{recipient},
+		},
+	})
+	require.NoError(t, err)
+	err = amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
+		Type:     types.OpPut,
+		Resource: types.Resource153ToLegacy(rule1),
+	})
+	require.NoError(t, err)
+	require.Len(t, amrh.getAccessMonitoringRules(), 1)
+
+	ctx := context.Background()
+
+	// Expect recipient from matching rule.
+	req := &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			Created: time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC),
+		},
+	}
+
+	recipients := amrh.RecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []common.Recipient{*emailRecipient(recipient)}, recipients.ToSlice())
+
+	rawRecipients := amrh.RawRecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []string{recipient}, rawRecipients)
+
+	// Expect no recipient when not in schedule.
+	req = &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			Created: time.Date(2025, time.August, 11, 15, 30, 0, 0, time.UTC),
+		},
+	}
+
+	recipients = amrh.RecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []common.Recipient{}, recipients.ToSlice())
+
+	rawRecipients = amrh.RawRecipientsFromAccessMonitoringRules(ctx, req)
+	require.ElementsMatch(t, []string{}, rawRecipients)
+}
+
+func emailRecipient(recipient string) *common.Recipient {
+	return &common.Recipient{
+		Name: recipient,
+		ID:   recipient,
+		Kind: common.RecipientKindEmail,
+	}
+}
+
 func TestHandleAccessMonitoringRule(t *testing.T) {
 	amrh := NewRuleHandler(RuleHandlerConfig{
 		PluginType:             "fakePluginType",
diff --git a/integrations/access/accessrequest/app.go b/integrations/access/accessrequest/app.go
index 26b4b7b60e7e2..178de91b78612 100644
--- a/integrations/access/accessrequest/app.go
+++ b/integrations/access/accessrequest/app.go
@@ -254,9 +254,7 @@ func (a *App) onPendingRequest(ctx context.Context, req types.AccessRequest) err
 	}
 
 	loginsByRole, err := a.getLoginsByRole(ctx, req)
-	if trace.IsAccessDenied(err) {
-		log.WarnContext(ctx, "Missing permissions to get logins by role, please add role.read to the associated role", "error", err)
-	} else if err != nil {
+	if err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -524,38 +522,61 @@ func (a *App) updateMessages(ctx context.Context, reqID string, tag pd.Resolutio
 	return nil
 }
 
+func getRoles(ctx context.Context, client services.RoleGetter, roleNames []string) ([]types.Role, error) {
+	var roles []types.Role
+	for _, roleName := range roleNames {
+		role, err := client.GetRole(ctx, roleName)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		roles = append(roles, role)
+	}
+	return roles, nil
+}
+
+func getAllowedLogins(roles []types.Role) map[string][]string {
+	allowedLogins := make(map[string][]string, len(roles))
+	for _, role := range roles {
+		logins := role.GetLogins(types.Allow)
+		if logins == nil {
+			logins = []string{}
+		}
+		allowedLogins[role.GetName()] = logins
+	}
+	return allowedLogins
+}
+
 func (a *App) getLoginsByRole(ctx context.Context, req types.AccessRequest) (map[string][]string, error) {
-	loginsByRole := make(map[string][]string, len(req.GetRoles()))
 	log := logger.Get(ctx)
 
-	user, err := a.apiClient.GetUser(ctx, req.GetUser(), false)
-	if err != nil {
-		log.WarnContext(ctx, "Missing permissions to apply user traits to login roles, please add user.read to the associated role", "error", err)
-		for _, role := range req.GetRoles() {
-			currentRole, err := a.apiClient.GetRole(ctx, role)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			loginsByRole[role] = currentRole.GetLogins(types.Allow)
-		}
-		return loginsByRole, nil
+	roles, err := getRoles(ctx, a.apiClient, req.GetRoles())
+	switch {
+	case trace.IsAccessDenied(err):
+		// Return an empty map if missing roles read permissions.
+		log.WarnContext(ctx, `Missing permissions to read user.roles, please use the preset "access-plugin" role`, "error", err)
+		return map[string][]string{}, nil
+	case err != nil:
+		return nil, trace.Wrap(err)
 	}
-	for _, role := range req.GetRoles() {
-		currentRole, err := a.apiClient.GetRole(ctx, role)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		currentRole, err = services.ApplyTraits(currentRole, user.GetTraits())
+
+	userState, err := services.GetUserOrLoginState(ctx, a.apiClient, req.GetUser())
+	switch {
+	case trace.IsAccessDenied(err):
+		// Return un-applied logins if missing user_login_state and user read permissions.
+		log.WarnContext(ctx, `Missing permissions to read user.traits, please use the preset "access-plugin" role`, "error", err)
+		return getAllowedLogins(roles), nil
+	case err != nil:
+		return nil, trace.Wrap(err)
+	}
+
+	userTraits := userState.GetTraits()
+	for _, role := range roles {
+		_, err := services.ApplyTraits(role, userTraits)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		logins := currentRole.GetLogins(types.Allow)
-		if logins == nil {
-			logins = []string{}
-		}
-		loginsByRole[role] = logins
 	}
-	return loginsByRole, nil
+	return getAllowedLogins(roles), nil
 }
 
 func (a *App) getResourceNames(ctx context.Context, req types.AccessRequest) ([]string, error) {
@@ -593,7 +614,12 @@ func (a *App) tryApproveRequest(ctx context.Context, reqID string, req types.Acc
 		return trace.Wrap(err)
 	}
 
-	if !slices.Contains(oncallUsers, req.GetUser()) {
+	// Ignore casing when matching users.
+	for index, oncallUser := range oncallUsers {
+		oncallUsers[index] = strings.ToLower(oncallUser)
+	}
+
+	if !slices.Contains(oncallUsers, strings.ToLower(req.GetUser())) {
 		log.DebugContext(ctx, "Skipping approval because user is not on-call")
 		return nil
 	}
diff --git a/integrations/access/accessrequest/app_test.go b/integrations/access/accessrequest/app_test.go
index e79480fd26375..f51d505c2ac52 100644
--- a/integrations/access/accessrequest/app_test.go
+++ b/integrations/access/accessrequest/app_test.go
@@ -21,13 +21,16 @@ package accessrequest
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/integrations/access/common/teleport"
 )
 
@@ -52,6 +55,15 @@ func (m *mockTeleportClient) GetUser(ctx context.Context, name string, withSecre
 	return args.Get(0).(types.User), args.Error(1)
 }
 
+func (m *mockTeleportClient) GetUserLoginState(ctx context.Context, name string) (*userloginstate.UserLoginState, error) {
+	args := m.Called(ctx, name)
+	userLoginState, ok := args.Get(0).(*userloginstate.UserLoginState)
+	if ok {
+		return userLoginState, args.Error(1)
+	}
+	return nil, args.Error(1)
+}
+
 type mockMessagingBot struct {
 	mock.Mock
 	MessagingBot
@@ -62,9 +74,54 @@ func (m *mockMessagingBot) FetchOncallUsers(ctx context.Context, req types.Acces
 	return args.Get(0).([]string), args.Error(1)
 }
 
+func TestGetLoginsByRoleWithUserLoginState(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
+	t.Cleanup(cancel)
+
+	teleportClient := &mockTeleportClient{}
+
+	teleportClient.On("GetRole", mock.Anything, "admin").
+		Return(&types.RoleV6{
+			Metadata: types.Metadata{Name: "admin"},
+			Spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Logins: []string{"root", "foo", "bar", "{{internal.logins}}"},
+				},
+			},
+		}, nil)
+
+	teleportClient.On("GetUserLoginState", mock.Anything, mock.Anything).
+		Return(&userloginstate.UserLoginState{
+			Spec: userloginstate.Spec{
+				Traits: map[string][]string{
+					"logins": {"buz"},
+				},
+			},
+		}, nil)
+
+	app := App{
+		apiClient: teleportClient,
+	}
+	loginsByRole, err := app.getLoginsByRole(ctx, &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			User:  "admin",
+			Roles: []string{"admin"},
+		},
+	})
+	require.NoError(t, err)
+
+	expected := map[string][]string{
+		"admin": {"root", "foo", "bar", "buz"},
+	}
+	require.Equal(t, expected, loginsByRole)
+}
+
 func TestGetLoginsByRole(t *testing.T) {
 	teleportClient := &mockTeleportClient{}
+	teleportClient.On("GetUserLoginState", mock.Anything, mock.Anything).
+		Return(nil, trace.AccessDenied("test error"))
 	teleportClient.On("GetRole", mock.Anything, "admin").Return(&types.RoleV6{
+		Metadata: types.Metadata{Name: "admin"},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
 				Logins: []string{"root", "foo", "bar", "{{internal.logins}}"},
@@ -72,6 +129,7 @@ func TestGetLoginsByRole(t *testing.T) {
 		},
 	}, (error)(nil))
 	teleportClient.On("GetRole", mock.Anything, "foo").Return(&types.RoleV6{
+		Metadata: types.Metadata{Name: "foo"},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
 				Logins: []string{"foo"},
@@ -79,6 +137,7 @@ func TestGetLoginsByRole(t *testing.T) {
 		},
 	}, (error)(nil))
 	teleportClient.On("GetRole", mock.Anything, "dev").Return(&types.RoleV6{
+		Metadata: types.Metadata{Name: "dev"},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
 				Logins: []string{},
@@ -86,6 +145,7 @@ func TestGetLoginsByRole(t *testing.T) {
 		},
 	}, (error)(nil))
 	teleportClient.On("GetUser", mock.Anything, "admin", mock.Anything).Return(&types.UserV2{
+		Metadata: types.Metadata{Name: "admin"},
 		Spec: types.UserSpecV2{
 			Traits: map[string][]string{
 				"logins": {"buz"},
@@ -146,6 +206,16 @@ func TestTryApproveRequest(t *testing.T) {
 		},
 	}).Return([]string{"admin@example.com"}, (error)(nil))
 
+	// Example with uppercase user
+	bot.On("FetchOncallUsers", mock.Anything, &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			User: user,
+			SystemAnnotations: map[string][]string{
+				"example-auto-approvals": {"uppercase-user"},
+			},
+		},
+	}).Return([]string{strings.ToUpper(user)}, (error)(nil))
+
 	// Successful review
 	teleportClient.On("SubmitAccessReview", mock.Anything, types.AccessReviewSubmission{
 		RequestID: requestID,
@@ -181,4 +251,16 @@ func TestTryApproveRequest(t *testing.T) {
 	}))
 	bot.AssertNumberOfCalls(t, "FetchOncallUsers", 2)
 	teleportClient.AssertNumberOfCalls(t, "SubmitAccessReview", 1)
+
+	// Test user is on-call ignore casing
+	require.NoError(t, app.tryApproveRequest(ctx, requestID, &types.AccessRequestV3{
+		Spec: types.AccessRequestSpecV3{
+			User: user,
+			SystemAnnotations: map[string][]string{
+				"example-auto-approvals": {"uppercase-user"},
+			},
+		},
+	}))
+	bot.AssertNumberOfCalls(t, "FetchOncallUsers", 3)
+	teleportClient.AssertNumberOfCalls(t, "SubmitAccessReview", 2)
 }
diff --git a/integrations/access/common/config.go b/integrations/access/common/config.go
index f6e3d51703f55..3f964197075b6 100644
--- a/integrations/access/common/config.go
+++ b/integrations/access/common/config.go
@@ -24,9 +24,10 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/client"
-	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+	"github.com/gravitational/teleport/api/client/accesslist"
+	"github.com/gravitational/teleport/api/client/accessmonitoringrules"
+	"github.com/gravitational/teleport/api/client/userloginstate"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/integrations/lib"
 	"github.com/gravitational/teleport/integrations/lib/logger"
@@ -56,27 +57,26 @@ func (c BaseConfig) GetRecipients() RawRecipientsMap {
 	return c.Recipients
 }
 
-type wrappedClient struct {
-	*client.Client
-}
-
-func (w *wrappedClient) ListAccessLists(ctx context.Context, pageSize int, pageToken string) ([]*accesslist.AccessList, string, error) {
-	return w.Client.AccessListClient().ListAccessLists(ctx, pageSize, pageToken)
-}
+// client type alias are used to embed the types in the wrappedClient
 
-func (w *wrappedClient) GetAccessListOwners(ctx context.Context, accessListName string) ([]*accesslist.Owner, error) {
-	return w.Client.AccessListClient().GetAccessListOwners(ctx, accessListName)
-}
+type accessListClient = *accesslist.Client
+type accessMonitoringRulesClient = *accessmonitoringrules.Client
+type userLoginStateClient = *userloginstate.Client
 
-// ListAccessMonitoringRulesWithFilter lists current access monitoring rules.
-func (w *wrappedClient) ListAccessMonitoringRulesWithFilter(ctx context.Context, req *accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest) ([]*accessmonitoringrulesv1.AccessMonitoringRule, string, error) {
-	return w.Client.AccessMonitoringRulesClient().ListAccessMonitoringRulesWithFilter(ctx, req)
+type wrappedClient struct {
+	*client.Client
+	accessListClient
+	accessMonitoringRulesClient
+	userLoginStateClient
 }
 
 // wrapAPIClient will wrap the API client such that it conforms to the Teleport plugin client interface.
 func wrapAPIClient(clt *client.Client) teleport.Client {
 	return &wrappedClient{
-		Client: clt,
+		Client:                      clt,
+		accessListClient:            clt.AccessListClient(),
+		accessMonitoringRulesClient: clt.AccessMonitoringRulesClient(),
+		userLoginStateClient:        clt.UserLoginStateClient(),
 	}
 }
 
diff --git a/integrations/access/common/teleport/client.go b/integrations/access/common/teleport/client.go
index 86d660fc0e893..c7072246312e7 100644
--- a/integrations/access/common/teleport/client.go
+++ b/integrations/access/common/teleport/client.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/integrations/lib/plugindata"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // Client aggregates the parts of Teleport API client interface
@@ -43,5 +44,5 @@ type Client interface {
 	ListAccessLists(context.Context, int, string) ([]*accesslist.AccessList, string, error)
 	ListAccessMonitoringRulesWithFilter(ctx context.Context, req *accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest) ([]*accessmonitoringrulesv1.AccessMonitoringRule, string, error)
 	GetAccessListOwners(ctx context.Context, accessListName string) ([]*accesslist.Owner, error)
-	GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error)
+	services.UserOrLoginStateGetter
 }
diff --git a/integrations/access/datadog/bot.go b/integrations/access/datadog/bot.go
index 4e1f52a6c218d..c219e72aec752 100644
--- a/integrations/access/datadog/bot.go
+++ b/integrations/access/datadog/bot.go
@@ -166,29 +166,50 @@ func (b Bot) FetchOncallUsers(ctx context.Context, req types.AccessRequest) ([]s
 		return nil, nil
 	}
 
-	// Fetch all on-call teams
-	oncallTeams, err := b.datadog.GetOncallTeams(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+	var teamIDs []string
+	var total int
+	var page int
+	for {
+		resp, err := b.datadog.ListTeamsPage(ctx, page)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		total = total + resp.Meta.Pagination.Size
+		page++
 
-	var oncallUserIDs []string
-	for _, oncallTeam := range oncallTeams.Data {
 		// Filter the list of teams to only the teams that match the datadog annotation.
-		if !slices.Contains(teamNames, oncallTeam.Attributes.Handle) &&
-			!slices.Contains(teamNames, oncallTeam.Attributes.Name) {
-			continue
+		for _, teamData := range resp.Data {
+			if !slices.Contains(teamNames, teamData.Attributes.Handle) &&
+				!slices.Contains(teamNames, teamData.Attributes.Name) {
+				continue
+			}
+			teamIDs = append(teamIDs, teamData.ID)
 		}
-		// Collect users that are on-call for the specified team.
-		for _, oncallUser := range oncallTeam.Relationships.OncallUsers.Data {
-			oncallUserIDs = append(oncallUserIDs, oncallUser.ID)
+
+		// Break if all teams have been listed or all team IDs have been identified.
+		if total >= resp.Meta.Pagination.Total || len(teamIDs) == len(teamNames) {
+			break
 		}
 	}
 
 	var oncallUserEmails []string
-	for _, user := range oncallTeams.Included {
-		if slices.Contains(oncallUserIDs, user.ID) {
-			oncallUserEmails = append(oncallUserEmails, user.Attributes.Email)
+	for _, teamID := range teamIDs {
+		resp, err := b.datadog.GetTeamOncall(ctx, teamID)
+		if err != nil {
+			log.WarnContext(ctx, "failed to get on-call users", "team_id", teamID)
+			continue
+		}
+
+		var oncallUserIDs []string
+		for _, oncallUser := range resp.Data.Relationships.Responders.Data {
+			oncallUserIDs = append(oncallUserIDs, oncallUser.ID)
+		}
+
+		for _, user := range resp.Included {
+			if slices.Contains(oncallUserIDs, user.ID) {
+				oncallUserEmails = append(oncallUserEmails, user.Attributes.Email)
+			}
 		}
 	}
 	return oncallUserEmails, nil
diff --git a/integrations/access/datadog/client.go b/integrations/access/datadog/client.go
index c5dffed60d6b5..24f3d9e2676c7 100644
--- a/integrations/access/datadog/client.go
+++ b/integrations/access/datadog/client.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -47,6 +48,20 @@ const (
 	// See documentation for more details:
 	// https://docs.datadoghq.com/account_management/rbac/permissions/#case-and-incident-management
 	IncidentWritePermissions = "incident_write"
+
+	// TeamsManagePermissions is a Datadog permission that allows the role to
+	// create, view, and maage teams in Datadog.
+	//
+	// See documentation for more details:
+	// https://docs.datadoghq.com/account_management/rbac/permissions/#teams
+	TeamsManagePermissions = "teams_manage"
+
+	// OnCallReadPermissions is a Datadog permission that allows the role to
+	// view on-call teams, schedules, escalation policies and overrides.
+	//
+	// See documentation for more details:
+	// https://docs.datadoghq.com/account_management/rbac/permissions/#on-call
+	OnCallReadPermissions = "on_call_read"
 )
 
 // Datadog is a wrapper around resty.Client.
@@ -58,10 +73,6 @@ type Datadog struct {
 	// simpler to integrate with the existing framework. Consider using the official
 	// datadog api client package: https://github.com/DataDog/datadog-api-client-go.
 	client *resty.Client
-
-	// TODO: Remove clientUnstable once on-call API is merged into official API.
-	// See: https://docs.datadoghq.com/api/latest/
-	clientUnstable *resty.Client
 }
 
 // NewDatadogClient creates a new Datadog client for managing incidents.
@@ -88,30 +99,9 @@ func NewDatadogClient(conf DatadogConfig, webProxyAddr string, statusSink common
 		}).
 		OnAfterResponse(onAfterDatadogResponse(statusSink))
 
-	apiEndpointUnstable, err := url.JoinPath(conf.APIEndpoint, APIUnstable)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	clientUnstable := resty.NewWithClient(&http.Client{
-		Timeout: datadogHTTPTimeout,
-		Transport: &http.Transport{
-			MaxConnsPerHost:     datadogMaxConns,
-			MaxIdleConnsPerHost: datadogMaxConns,
-		}}).
-		SetBaseURL(apiEndpointUnstable).
-		SetHeader("Accept", "application/json").
-		SetHeader("Content-Type", "application/json").
-		SetHeader("DD-API-KEY", conf.APIKey).
-		SetHeader("DD-APPLICATION-KEY", conf.ApplicationKey).
-		OnBeforeRequest(func(_ *resty.Client, req *resty.Request) error {
-			req.SetError(&ErrorResult{})
-			return nil
-		}).OnAfterResponse(onAfterDatadogResponse(statusSink))
-
 	return &Datadog{
-		DatadogConfig:  conf,
-		client:         client,
-		clientUnstable: clientUnstable,
+		DatadogConfig: conf,
+		client:        client,
 	}, nil
 }
 
@@ -143,6 +133,8 @@ func onAfterDatadogResponse(sink common.StatusSink) resty.ResponseMiddleware {
 }
 
 // CheckHealth pings Datadog and ensures required permissions.
+//
+// See: https://docs.datadoghq.com/api/latest/roles/#list-permissions
 func (d *Datadog) CheckHealth(ctx context.Context) error {
 	var result PermissionsBody
 	_, err := d.client.NewRequest().
@@ -153,19 +145,19 @@ func (d *Datadog) CheckHealth(ctx context.Context) error {
 		return trace.Wrap(err)
 	}
 	for _, permission := range result.Data {
-		// TODO: Verify on-call/teams permissions once required permissions have
-		// been published.
-		if permission.Attributes.Name == IncidentWritePermissions {
+		switch name := permission.Attributes.Name; name {
+		case IncidentWritePermissions, TeamsManagePermissions, OnCallReadPermissions:
 			if permission.Attributes.Restricted {
-				return trace.AccessDenied("missing incident_write permissions")
+				return trace.AccessDenied("missing %s permissions", name)
 			}
-			return nil
 		}
 	}
 	return nil
 }
 
 // Create Incident creates a new Datadog incident.
+//
+// See: https://docs.datadoghq.com/api/latest/incidents/#create-an-incident
 func (d *Datadog) CreateIncident(ctx context.Context, summary string, recipients []common.Recipient, reqData pd.AccessRequestData) (IncidentsData, error) {
 	teams := make([]string, 0, len(recipients))
 	emails := make([]NotificationHandle, 0, len(recipients))
@@ -252,6 +244,8 @@ func (d *Datadog) PostReviewNote(ctx context.Context, incidentID, note string) e
 }
 
 // ResolveIncident resolves an incident and posts a note with resolution details.
+//
+// See: https://docs.datadoghq.com/api/latest/incidents/#update-an-existing-incident
 func (d *Datadog) ResolveIncident(ctx context.Context, incidentID, state string) error {
 	body := IncidentsBody{
 		Data: IncidentsData{
@@ -277,12 +271,29 @@ func (d *Datadog) ResolveIncident(ctx context.Context, incidentID, state string)
 	return trace.Wrap(err)
 }
 
-// GetOncallTeams gets current on call teams.
-func (d *Datadog) GetOncallTeams(ctx context.Context) (OncallTeamsBody, error) {
+// ListTeamsPage returns a page of teams.
+//
+// See: https://docs.datadoghq.com/api/latest/teams/#get-all-teams
+func (d *Datadog) ListTeamsPage(ctx context.Context, pageNum int) (ListTeamsBody, error) {
+	var result ListTeamsBody
+	_, err := d.client.NewRequest().
+		SetContext(ctx).
+		SetResult(&result).
+		SetQueryParam("page[number]", strconv.Itoa(pageNum)).
+		Get("team")
+	return result, trace.Wrap(err)
+}
+
+// GetTeamOncall gets the team's current on-call users.
+//
+// See: https://docs.datadoghq.com/api/latest/on-call/?s=teams#get-team-on-call-users
+func (d *Datadog) GetTeamOncall(ctx context.Context, teamID string) (OncallTeamsBody, error) {
 	var result OncallTeamsBody
-	_, err := d.clientUnstable.NewRequest().
+	_, err := d.client.NewRequest().
 		SetContext(ctx).
 		SetResult(&result).
-		Get("on-call/teams")
+		SetPathParam("team_id", teamID).
+		SetQueryParam("include", "responders").
+		Get("on-call/teams/{team_id}/on-call")
 	return result, trace.Wrap(err)
 }
diff --git a/integrations/access/datadog/testlib/fake_datadog.go b/integrations/access/datadog/testlib/fake_datadog.go
index 5cfe8b539f454..11abf22337581 100644
--- a/integrations/access/datadog/testlib/fake_datadog.go
+++ b/integrations/access/datadog/testlib/fake_datadog.go
@@ -61,16 +61,11 @@ func NewFakeDatadog(concurrency int) *FakeDatadog {
 
 	// Ignore api version for tests
 	const apiPrefix = "/" + datadog.APIVersion
-	const unstablePrefix = "/" + datadog.APIUnstable
 	router.NotFound = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if strings.HasPrefix(r.URL.Path, apiPrefix) {
 			http.StripPrefix(apiPrefix, router).ServeHTTP(w, r)
 			return
 		}
-		if strings.HasPrefix(r.URL.Path, unstablePrefix) {
-			http.StripPrefix(unstablePrefix, router).ServeHTTP(w, r)
-			return
-		}
 		http.NotFound(w, r)
 	})
 
@@ -84,6 +79,18 @@ func NewFakeDatadog(concurrency int) *FakeDatadog {
 						Restricted: false,
 					},
 				},
+				{
+					Attributes: datadog.PermissionsAttributes{
+						Name:       datadog.TeamsManagePermissions,
+						Restricted: false,
+					},
+				},
+				{
+					Attributes: datadog.PermissionsAttributes{
+						Name:       datadog.OnCallReadPermissions,
+						Restricted: false,
+					},
+				},
 			},
 		})
 		panicIf(err)
@@ -142,7 +149,45 @@ func NewFakeDatadog(concurrency int) *FakeDatadog {
 		panicIf(err)
 	})
 
-	router.GET("/on-call/teams", func(rw http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+	router.GET("/team", func(rw http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		rw.Header().Add("Content-Type", "application/json")
+
+		oncallTeams, found := mock.GetOncallTeams()
+		if !found {
+			rw.WriteHeader(http.StatusNotFound)
+			err := json.NewEncoder(rw).Encode(&datadog.ErrorResult{Errors: []string{"Teams not found"}})
+			panicIf(err)
+			return
+		}
+
+		var teams []datadog.TeamsData
+		for team := range oncallTeams {
+			teams = append(teams, datadog.TeamsData{
+				Metadata: datadog.Metadata{
+					ID: team,
+				},
+				Attributes: datadog.TeamsAttributes{
+					Name:   team,
+					Handle: team,
+				},
+			})
+		}
+
+		body := datadog.ListTeamsBody{
+			Data: teams,
+			Meta: datadog.ListMetadata{
+				Pagination: datadog.PaginationMetadata{
+					Size:  len(teams),
+					Total: len(teams),
+				},
+			},
+		}
+
+		err := json.NewEncoder(rw).Encode(body)
+		panicIf(err)
+	})
+
+	router.GET("/on-call/teams/:team_id/on-call", func(rw http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		rw.Header().Add("Content-Type", "application/json")
 
 		oncallTeams, found := mock.GetOncallTeams()
@@ -153,43 +198,45 @@ func NewFakeDatadog(concurrency int) *FakeDatadog {
 			return
 		}
 
+		oncallUsers, ok := oncallTeams[ps.ByName("team_id")]
+		if !ok {
+			rw.WriteHeader(http.StatusNotFound)
+			err := json.NewEncoder(rw).Encode(&datadog.ErrorResult{Errors: []string{"On-call Teams not found"}})
+			panicIf(err)
+			return
+		}
+
 		body := datadog.OncallTeamsBody{
-			Data:     []datadog.OncallTeamsData{},
+			Data:     datadog.OncallTeamsData{},
 			Included: []datadog.OncallTeamsIncluded{},
 		}
 
-		for team, users := range oncallTeams {
-			oncallUsers := make([]datadog.OncallUsersData, 0, len(users))
-
-			for _, user := range users {
-				userID := strconv.FormatUint(atomic.AddUint64(&mock.userIDCounter, 1), 10)
-				oncallUsers = append(oncallUsers, datadog.OncallUsersData{
-					Metadata: datadog.Metadata{
-						ID: userID,
-					},
-				})
-				body.Included = append(body.Included, datadog.OncallTeamsIncluded{
-					Metadata: datadog.Metadata{
-						ID: userID,
-					},
-					Attributes: datadog.OncallTeamsIncludedAttributes{
-						Email: user,
-					},
-				})
-			}
-
-			body.Data = append(body.Data, datadog.OncallTeamsData{
-				Attributes: datadog.OncallTeamsAttributes{
-					Handle: team,
+		oncallUsersData := make([]datadog.OncallUsersData, 0, len(oncallUsers))
+		for _, user := range oncallUsers {
+			userID := strconv.FormatUint(atomic.AddUint64(&mock.userIDCounter, 1), 10)
+			oncallUsersData = append(oncallUsersData, datadog.OncallUsersData{
+				Metadata: datadog.Metadata{
+					ID: userID,
 				},
-				Relationships: datadog.OncallTeamsRelationships{
-					OncallUsers: datadog.OncallUsers{
-						Data: oncallUsers,
-					},
+			})
+			body.Included = append(body.Included, datadog.OncallTeamsIncluded{
+				Metadata: datadog.Metadata{
+					ID: userID,
+				},
+				Attributes: datadog.OncallTeamsIncludedAttributes{
+					Email: user,
 				},
 			})
 		}
 
+		body.Data = datadog.OncallTeamsData{
+			Relationships: datadog.OncallTeamsRelationships{
+				Responders: datadog.Responders{
+					Data: oncallUsersData,
+				},
+			},
+		}
+
 		err := json.NewEncoder(rw).Encode(body)
 		panicIf(err)
 	})
diff --git a/integrations/access/datadog/types.go b/integrations/access/datadog/types.go
index 194aa2f884a15..610abf3c3d54b 100644
--- a/integrations/access/datadog/types.go
+++ b/integrations/access/datadog/types.go
@@ -37,7 +37,7 @@ type PermissionsBody struct {
 // PermissionsData contains the permissions data.
 type PermissionsData struct {
 	Metadata
-	Attributes PermissionsAttributes `json:"attributes,omitempty"`
+	Attributes PermissionsAttributes `json:"attributes"`
 }
 
 // PermissionsAttributes contains the permissions attributes.
@@ -50,19 +50,19 @@ type PermissionsAttributes struct {
 //
 // See: https://docs.datadoghq.com/api/latest/incidents
 type IncidentsBody struct {
-	Data IncidentsData `json:"data,omitempty"`
+	Data IncidentsData `json:"data"`
 }
 
 // IncidentData contains the incident data.
 type IncidentsData struct {
 	Metadata
-	Attributes IncidentsAttributes `json:"attributes,omitempty"`
+	Attributes IncidentsAttributes `json:"attributes"`
 }
 
 // IncidentsAttributes contains the incident attributes.
 type IncidentsAttributes struct {
 	Title               string               `json:"title,omitempty"`
-	Fields              IncidentsFields      `json:"fields,omitempty"`
+	Fields              IncidentsFields      `json:"fields"`
 	NotificationHandles []NotificationHandle `json:"notification_handles,omitempty"`
 }
 
@@ -97,37 +97,65 @@ type NotificationHandle struct {
 
 // TimelineBody contains the request/response body for an incident timeline request.
 type TimelineBody struct {
-	Data TimelineData `json:"data,omitempty"`
+	Data TimelineData `json:"data"`
 }
 
 // TimelineData contains the incident timeline data.
 type TimelineData struct {
 	Metadata
-	Attributes TimelineAttributes `json:"attributes,omitempty"`
+	Attributes TimelineAttributes `json:"attributes"`
 }
 
 // TimelineAttributes contains the incident timeline attributes.
 type TimelineAttributes struct {
 	CellType string          `json:"cell_type,omitempty"`
-	Content  TimelineContent `json:"content,omitempty"`
+	Content  TimelineContent `json:"content"`
 }
 
-// TimelineContent contains the incident tineline content.
+// TimelineContent contains the incident timeline content.
 type TimelineContent struct {
 	Content string `json:"content,omitempty"`
 }
 
+// ListTeamsBody contains the list of teams data.
+type ListTeamsBody struct {
+	Data []TeamsData  `json:"data,omitempty"`
+	Meta ListMetadata `json:"meta"`
+}
+
+// ListMetadata contains metadata for a list request.
+type ListMetadata struct {
+	Pagination PaginationMetadata `json:"pagination"`
+}
+
+// PaginationMetadata contains pagination metadata.
+type PaginationMetadata struct {
+	Size  int `json:"size"`
+	Total int `json:"total"`
+}
+
+// TeamData contains a team metadata and attributes.
+type TeamsData struct {
+	Metadata
+	Attributes TeamsAttributes `json:"attributes"`
+}
+
+// TeamsAttributes contains a team's attributes.
+type TeamsAttributes struct {
+	Name   string `json:"name,omitempty"`
+	Handle string `json:"handle,omitempty"`
+}
+
 // OncallTeamsBody contains the response body for an on-call teams request.
 type OncallTeamsBody struct {
-	Data     []OncallTeamsData     `json:"data,omitempty"`
+	Data     OncallTeamsData       `json:"data,omitempty"`
 	Included []OncallTeamsIncluded `json:"included,omitempty"`
 }
 
 // OncallTeamsData contains the on-call teams data.
 type OncallTeamsData struct {
 	Metadata
-	Attributes    OncallTeamsAttributes    `json:"attributes,omitempty"`
-	Relationships OncallTeamsRelationships `json:"relationships,omitempty"`
+	Relationships OncallTeamsRelationships `json:"relationships"`
 }
 
 // OncallTeamsAttributes contains the on-call teams attributes.
@@ -138,11 +166,11 @@ type OncallTeamsAttributes struct {
 
 // OncallTeamsRelationships contains the on-call teams relationships.
 type OncallTeamsRelationships struct {
-	OncallUsers OncallUsers `json:"oncall_users,omitempty"`
+	Responders Responders `json:"responders"`
 }
 
-// OncallUsers contains the list of on-call users.
-type OncallUsers struct {
+// Responders contains the list of on-call users.
+type Responders struct {
 	Data []OncallUsersData `json:"data,omitempty"`
 }
 
@@ -154,7 +182,7 @@ type OncallUsersData struct {
 // OncallTeamsIncluded contains the on-call teams included related resources.
 type OncallTeamsIncluded struct {
 	Metadata
-	Attributes OncallTeamsIncludedAttributes `json:"attributes,omitempty"`
+	Attributes OncallTeamsIncludedAttributes `json:"attributes"`
 }
 
 // OncallTeamsIncludedAttributes contains the on-call teams included related resource
diff --git a/integrations/access/msteams/bot_test.go b/integrations/access/msteams/bot_test.go
index e54948b254163..6c1bd984c53a4 100644
--- a/integrations/access/msteams/bot_test.go
+++ b/integrations/access/msteams/bot_test.go
@@ -20,7 +20,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func mustParseURL(t *testing.T, urlString string) *url.URL {
@@ -31,7 +31,7 @@ func mustParseURL(t *testing.T, urlString string) *url.URL {
 
 func Test_CheckChannelURL(t *testing.T) {
 	b := &Bot{
-		log: utils.NewSlogLoggerForTests(),
+		log: logtest.NewLogger(),
 	}
 	tests := []struct {
 		name             string
diff --git a/integrations/access/pagerduty/testlib/suite.go b/integrations/access/pagerduty/testlib/suite.go
index b68c4d7e8d706..b10d111acde71 100644
--- a/integrations/access/pagerduty/testlib/suite.go
+++ b/integrations/access/pagerduty/testlib/suite.go
@@ -168,8 +168,7 @@ func (s *PagerdutySuiteEnterprise) SetupTest() {
 // specified in the role's annotation.
 func (s *PagerdutySuiteOSS) TestIncidentCreation() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -196,8 +195,7 @@ func (s *PagerdutySuiteOSS) TestIncidentCreation() {
 // is updated to reflect the new request state and a note is added to the incident.
 func (s *PagerdutySuiteOSS) TestApproval() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -228,8 +226,7 @@ func (s *PagerdutySuiteOSS) TestApproval() {
 // is updated to reflect the new request state and a note is added to the incident.
 func (s *PagerdutySuiteOSS) TestDenial() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -260,8 +257,7 @@ func (s *PagerdutySuiteOSS) TestDenial() {
 // is reviewed. Each review should create a new note.
 func (s *PagerdutySuiteEnterprise) TestReviewNotes() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -309,8 +305,7 @@ func (s *PagerdutySuiteEnterprise) TestReviewNotes() {
 // access request approval threshold is reached.
 func (s *PagerdutySuiteEnterprise) TestApprovalByReview() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -369,8 +364,7 @@ func (s *PagerdutySuiteEnterprise) TestApprovalByReview() {
 // access request denial threshold is reached.
 func (s *PagerdutySuiteEnterprise) TestDenialByReview() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -427,16 +421,15 @@ func (s *PagerdutySuiteEnterprise) TestDenialByReview() {
 
 func (s *PagerdutySuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	const ruleName = "test-pagerduty-amr"
 	var collectedNames []string
 	var mu sync.Mutex
 	s.appConfig.OnAccessMonitoringRuleCacheUpdateCallback = func(_ types.OpType, name string, _ *accessmonitoringrulesv1.AccessMonitoringRule) error {
 		mu.Lock()
+		defer mu.Unlock()
 		collectedNames = append(collectedNames, name)
-		mu.Unlock()
 		return nil
 	}
 	s.startApp()
@@ -460,14 +453,14 @@ func (s *PagerdutySuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 				},
 			},
 		})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Incident creation may happen before plugins Access Monitoring Rule cache
 	// has been updated with new rule. Retry until the new cache picks up the rule.
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		mu.Lock()
+		defer mu.Unlock()
 		require.Contains(t, collectedNames, ruleName)
-		mu.Unlock()
 	}, 3*time.Second, time.Millisecond*100, "new access monitoring rule did not begin applying")
 
 	// Test execution: create an access request
@@ -480,7 +473,7 @@ func (s *PagerdutySuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 	})
 
 	incident, err := s.fakePagerduty.CheckNewIncident(ctx)
-	assert.NoError(t, err, "no new incidents stored")
+	require.NoError(t, err, "no new incidents stored")
 	assert.Equal(t, incident.ID, pluginData.IncidentID)
 
 	assert.Equal(t, pagerduty.PdIncidentKeyPrefix+"/"+req.GetName(), incident.IncidentKey)
@@ -594,8 +587,7 @@ func (s *PagerdutyBaseSuite) assertNoReviewSubmitted(ctx context.Context, userNa
 // approved when the user is not on-call.
 func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenNotOnCall() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	// We use the OSS user for this advanced workflow test because their role
 	// doesn't have a threshold
@@ -612,8 +604,7 @@ func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenNotOnCall() {
 // approved when the user is on-call.
 func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCall() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	// We use the OSS user for this advanced workflow test because their role
 	// doesn't have a threshold
@@ -635,8 +626,7 @@ func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCall() {
 // escalation policy but is on-call for the second service.
 func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCallInSecondPolicy() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	// We use the OSS user for this advanced workflow test because their role
 	// doesn't have a threshold
@@ -659,8 +649,7 @@ func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCallInSecondPolicy() {
 // service.
 func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCallInSomeOtherPolicy() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	// We use the OSS user for this advanced workflow test because their role
 	// doesn't have a threshold
@@ -681,8 +670,7 @@ func (s *PagerdutySuiteEnterprise) TestAutoApprovalWhenOnCallInSomeOtherPolicy()
 // is updated to reflect the new request state and a note is added to the incident.
 func (s *PagerdutySuiteOSS) TestExpiration() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	s.startApp()
 
@@ -719,8 +707,7 @@ func (s *PagerdutySuiteOSS) TestExpiration() {
 // short time frame.
 func (s *PagerdutySuiteEnterprise) TestRace() {
 	t := s.T()
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	t.Cleanup(cancel)
+	ctx := t.Context()
 
 	err := logger.Setup(logger.Config{Severity: "info"}) // Turn off noisy debug logging
 	require.NoError(t, err)
diff --git a/integrations/event-handler/Dockerfile b/integrations/event-handler/Dockerfile
index a7fa663daa2d1..42d5692a6a4c8 100644
--- a/integrations/event-handler/Dockerfile
+++ b/integrations/event-handler/Dockerfile
@@ -2,7 +2,7 @@ ARG BASE_IMAGE=gcr.io/distroless/static-debian12
 
 # BUILDPLATFORM is provided by Docker/buildx
 # Extract the built tarball to reduce the final image size
-FROM --platform=${BUILDPLATFORM} alpine:3.20.0 as extractor
+FROM --platform=${BUILDPLATFORM} alpine:3.20.0 AS extractor
 
 ARG TARGETARCH
 ARG TARGETOS
@@ -19,7 +19,8 @@ RUN tar -xzvf /plugin.tar.gz && \
 
 # Create the image with the build operator on the $TARGETPLATFORM
 # TARGETPLATFORM is provided by Docker/buildx
-FROM --platform=${TARGETPLATFORM} ${BASE_IMAGE}
+# --platform=${TARGETPLATFORM} is set by default and the docker linter complains if we set it.
+FROM ${BASE_IMAGE}
 WORKDIR /
 COPY --from=extractor /teleport-plugin /usr/local/bin/teleport-plugin
 
diff --git a/integrations/event-handler/Makefile b/integrations/event-handler/Makefile
index fc49e294271f0..f34d8ac06fe10 100644
--- a/integrations/event-handler/Makefile
+++ b/integrations/event-handler/Makefile
@@ -96,7 +96,7 @@ install: build
 
 .PHONY: test
 test:
-	go test -coverprofile=cover.out
+	gotestsum --junitfile unit-tests-event-handler.xml --jsonfile unit-tests-event-handler.json
 
 .PHONY: configure
 configure: build
diff --git a/integrations/event-handler/README.md b/integrations/event-handler/README.md
index 001a23c2d6d8a..05f4ca2f1f7f0 100644
--- a/integrations/event-handler/README.md
+++ b/integrations/event-handler/README.md
@@ -21,31 +21,39 @@ You may specify configuration options via command line arguments, environment va
 |---------------------------|-------------------------------------------------------------------------------------------------------|---------------------------------|
 | teleport-addr             | Teleport host and port                                                                                | FDFWD_TELEPORT_ADDR             |
 | teleport-ca               | Teleport TLS CA file                                                                                  | FDFWD_TELEPORT_CA               |
-| teleport-cert             | Teleport TLS certificate file                                                                         | FDWRD_TELEPORT_CERT             |
+| teleport-cert             | Teleport TLS certificate file                                                                         | FDFWD_TELEPORT_CERT             |
 | teleport-key              | Teleport TLS key file                                                                                 | FDFWD_TELEPORT_KEY              |
 | teleport-identity         | Teleport identity file                                                                                | FDFWD_TELEPORT_IDENTITY         |
 | teleport-refresh-enabled  | Controls if the identity file should be reloaded from disk after the initial start on interval.       | FDFWD_TELEPORT_REFRESH_ENABLED  |
 | teleport-refresh-interval | How often to load the identity file from disk when teleport-refresh-enabled is specified. Default: 1m | FDFWD_TELEPORT_REFRESH_INTERVAL |
 | fluentd-url               | Fluentd URL                                                                                           | FDFWD_FLUENTD_URL               |
 | fluentd-session-url       | Fluentd session URL                                                                                   | FDFWD_FLUENTD_SESSION_URL       |
-| fluentd-ca                | fluentd TLS CA file                                                                                   | FDFWD_FLUENTD_CA                |
+| fluentd-ca                | Fluentd TLS CA file                                                                                   | FDFWD_FLUENTD_CA                |
 | fluentd-cert              | Fluentd TLS certificate file                                                                          | FDFWD_FLUENTD_CERT              |
 | fluentd-key               | Fluentd TLS key file                                                                                  | FDFWD_FLUENTD_KEY               |
+| fluentd-max-connections   | Maximum number of connections to Fluentd                                                              | FDFWD_MAX_CONNECTIONS           |
 | storage                   | Storage directory                                                                                     | FDFWD_STORAGE                   |
 | batch                     | Fetch batch size                                                                                      | FDFWD_BATCH                     |
 | types                     | Comma-separated list of event types to forward                                                        | FDFWD_TYPES                     |
-| skip-event-types              | Comma-separated list of event types to skip                                                           | FDFWD_SKIP_EVENT_TYPES              |
+| skip-event-types          | Comma-separated list of event types to skip                                                           | FDFWD_SKIP_EVENT_TYPES          |
 | skip-session-types        | Comma-separated list of session event types to skip                                                   | FDFWD_SKIP_SESSION_TYPES        |
 | start-time                | Minimum event time (RFC3339 format)                                                                   | FDFWD_START_TIME                |
 | timeout                   | Polling timeout                                                                                       | FDFWD_TIMEOUT                   |
-| cursor                    | Start cursor value                                                                                    | FDFWD_CURSOR                    |
 | debug                     | Debug logging                                                                                         | FDFWD_DEBUG                     |
+| dry-run                   | Simulates execution without sending events to Fluentd                                                 | FDFWD_DRY_RUN                   |
+| exit-on-last-event        | Exit when last event is processed                                                                     | FDFWD_EXIT_ON_LAST_EVENT        |
+| concurrency               | Number of concurrent sessions                                                                         | FDFWD_CONCURRENCY               |
+| window-size               | Window size to process events                                                                         | FDFWD_WINDOW_SIZE               |
+| lock-enabled              | Enable user auto-locking                                                                              | FDFWD_LOCKING_ENABLED           |
+| lock-failed-attempts-count| Number of failed attempts in lock-period which triggers locking                                       | FDFWD_LOCKING_FAILED_ATTEMPTS   |
+| lock-period               | Time period where lock-failed-attempts-count failed attempts will trigger locking                     | FDFWD_LOCKING_PERIOD            |
+| lock-for                  | Time period for which user gets lock                                                                  | FDFWD_LOCKING_FOR               |
 
 TOML configuration keys are the same as CLI args. Teleport and Fluentd variables can be grouped into sections. See [example TOML](example/config.toml). You can specify TOML file location using `--config` CLI flag.
 
 You could use `--dry-run` argument if you want event handler to simulate event export (it will not connect to Fluentd). `--exit-on-last-event` can be used to terminate service after the last event is processed.
 
-`--skip-session-types` is `['print']` by default. Please note that if you enable forwarding of print events (`--skip-session-types=''`) the `Data` field would also be sent.
+`--skip-session-types` is `['print', 'desktop.recording']` by default. Please note that if you enable forwarding of these events (`--skip-session-types=''`) the recorded data would also be sent.
 
 ## Advanced topics
 
diff --git a/integrations/event-handler/cli.go b/integrations/event-handler/cli.go
index 3b70838721196..6075eb9f3c7a7 100644
--- a/integrations/event-handler/cli.go
+++ b/integrations/event-handler/cli.go
@@ -19,6 +19,7 @@ package main
 import (
 	"context"
 	"log/slog"
+	"runtime"
 	"strings"
 	"time"
 
@@ -39,17 +40,17 @@ type FluentdConfig struct {
 	FluentdSessionURL string `help:"fluentd session url" required:"true" env:"FDFWD_FLUENTD_SESSION_URL"`
 
 	// FluentdCert is a path to fluentd cert
-	FluentdCert string `help:"fluentd TLS certificate file" type:"existingfile" env:"FDWRD_FLUENTD_CERT"`
+	FluentdCert string `help:"fluentd TLS certificate file" type:"existingfile" env:"FDFWD_FLUENTD_CERT,FDWRD_FLUENTD_CERT"`
 
 	// FluentdKey is a path to fluentd key
-	FluentdKey string `help:"fluentd TLS key file" type:"existingfile" env:"FDWRD_FLUENTD_KEY"`
+	FluentdKey string `help:"fluentd TLS key file" type:"existingfile" env:"FDFWD_FLUENTD_KEY,FDWRD_FLUENTD_KEY"`
 
 	// FluentdCA is a path to fluentd CA
-	FluentdCA string `help:"fluentd TLS CA file" type:"existingfile" env:"FDWRD_FLUENTD_CA"`
+	FluentdCA string `help:"fluentd TLS CA file" type:"existingfile" env:"FDFWD_FLUENTD_CA,FDWRD_FLUENTD_CA"`
 
 	// FluentdMaxConnections caps the number of connections to fluentd. Defaults to a dynamic value
 	// calculated relative to app-level concurrency.
-	FluentdMaxConnections int `help:"Maximum number of connections to fluentd" env:"FDWRD_MAX_CONNECTIONS"`
+	FluentdMaxConnections int `help:"Maximum number of connections to fluentd" env:"FDFWD_MAX_CONNECTIONS,FDWRD_MAX_CONNECTIONS"`
 }
 
 // TeleportConfig is Teleport instance configuration
@@ -72,7 +73,7 @@ type TeleportConfig struct {
 	TeleportCA string `help:"Teleport TLS CA file" type:"existingfile" env:"FDFWD_TELEPORT_CA"`
 
 	// TeleportCert is a path to Teleport cert file
-	TeleportCert string `help:"Teleport TLS certificate file" type:"existingfile" env:"FDWRD_TELEPORT_CERT"`
+	TeleportCert string `help:"Teleport TLS certificate file" type:"existingfile" env:"FDFWD_TELEPORT_CERT,FDWRD_TELEPORT_CERT"`
 
 	// TeleportKey is a path to Teleport key file
 	TeleportKey string `help:"Teleport TLS key file" type:"existingfile" env:"FDFWD_TELEPORT_KEY"`
@@ -125,17 +126,20 @@ type IngestConfig struct {
 	// BatchSize is a fetch batch size
 	BatchSize int `help:"Fetch batch size" default:"20" env:"FDFWD_BATCH" name:"batch"`
 
-	// Types are event types to log
-	Types []string `help:"Comma-separated list of event types to forward" env:"FDFWD_TYPES"`
+	// TypesRaw are event types to log
+	TypesRaw []string `name:"types" help:"Comma-separated list of event types to forward" env:"FDFWD_TYPES"`
+
+	// Types is a map generated from TypesRaw
+	Types map[string]struct{} `kong:"-"`
 
 	// SkipEventTypesRaw are event types to skip
-	SkipEventTypesRaw []string `name:"skip-event-types" help:"Comma-separated list of event types to skip" env:"FDFWD_SKIP_EVENT_TYPES"`
+	SkipEventTypesRaw []string `name:"skip-event-types" help:"Comma-separated list of audit log event types to skip" env:"FDFWD_SKIP_EVENT_TYPES"`
 
 	// SkipEventTypes is a map generated from SkipEventTypesRaw
 	SkipEventTypes map[string]struct{} `kong:"-"`
 
 	// SkipSessionTypes are session event types to skip
-	SkipSessionTypesRaw []string `name:"skip-session-types" help:"Comma-separated list of session event types to skip" default:"print" env:"FDFWD_SKIP_SESSION_TYPES"`
+	SkipSessionTypesRaw []string `name:"skip-session-types" help:"Comma-separated list of session recording event types to skip" default:"print,desktop.recording" env:"FDFWD_SKIP_SESSION_TYPES"`
 
 	// SkipSessionTypes is a map generated from SkipSessionTypes
 	SkipSessionTypes map[string]struct{} `kong:"-"`
@@ -144,19 +148,19 @@ type IngestConfig struct {
 	StartTime *time.Time `help:"Minimum event time in RFC3339 format" env:"FDFWD_START_TIME"`
 
 	// Timeout is the time poller will wait before the new request if there are no events in the queue
-	Timeout time.Duration `help:"Polling timeout" default:"5s" env:"FDFWD_TIMEOUT"`
+	Timeout time.Duration `help:"Polling timeout" default:"10s" env:"FDFWD_TIMEOUT"`
 
 	// DryRun is the flag which simulates execution without sending events to fluentd
-	DryRun bool `help:"Events are read from Teleport, but are not sent to fluentd. Separate storage is used. Debug flag."`
+	DryRun bool `help:"Events are read from Teleport, but are not sent to fluentd. Separate storage is used. Debug flag." env:"FDFWD_DRY_RUN"`
 
 	// ExitOnLastEvent exit when last event is processed
-	ExitOnLastEvent bool `help:"Exit when last event is processed"`
+	ExitOnLastEvent bool `help:"Exit when last event is processed" env:"FDFWD_EXIT_ON_LAST_EVENT"`
 
 	// Concurrency sets the number of concurrent sessions to ingest
-	Concurrency int `help:"Number of concurrent sessions" default:"5"`
+	Concurrency int `help:"Number of concurrent sessions" default:"5" env:"FDFWD_CONCURRENCY"`
 
-	//WindowSize is the size of the window to process events
-	WindowSize time.Duration `help:"Window size to process events" default:"24h"`
+	// WindowSize is the size of the window to process events
+	WindowSize time.Duration `help:"Window size to process events" default:"24h" env:"FDFWD_WINDOW_SIZE"`
 }
 
 // LockConfig represents locking configuration
@@ -239,6 +243,7 @@ func (c *StartCmdConfig) Validate() error {
 	if err := c.TeleportConfig.Check(); err != nil {
 		return trace.Wrap(err)
 	}
+	c.Types = lib.SliceToAnonymousMap(c.TypesRaw)
 	c.SkipSessionTypes = lib.SliceToAnonymousMap(c.SkipSessionTypesRaw)
 	c.SkipEventTypes = lib.SliceToAnonymousMap(c.SkipEventTypesRaw)
 
@@ -253,11 +258,20 @@ func (c *StartCmdConfig) Validate() error {
 // Dump dumps configuration values to the log
 func (c *StartCmdConfig) Dump(ctx context.Context, log *slog.Logger) {
 	// Log configuration variables
+	log.DebugContext(ctx, "Initializing plugin",
+		"name", "teleport-event-handler",
+		"version", slog.GroupValue(
+			slog.String("teleport", Version),
+			slog.String("teleport_git", Gitref),
+			slog.String("go", runtime.Version()),
+		),
+	)
+	log.InfoContext(ctx, "Using storage", "storage", c.StorageDir)
 	log.InfoContext(ctx, "Using batch size", "batch", c.BatchSize)
 	log.InfoContext(ctx, "Using concurrency", "concurrency", c.Concurrency)
 	log.InfoContext(ctx, "Using type filter", "types", c.Types)
-	log.InfoContext(ctx, "Using type exclude filter", "skip_event_types", c.SkipEventTypes)
-	log.InfoContext(ctx, "Skipping session events of type", "types", c.SkipSessionTypes)
+	log.InfoContext(ctx, "Skipping audit events of type", "types", c.SkipEventTypes)
+	log.InfoContext(ctx, "Skipping session recording events of type", "types", c.SkipSessionTypes)
 	log.InfoContext(ctx, "Using start time", "value", c.StartTime)
 	log.InfoContext(ctx, "Using timeout", "timeout", c.Timeout)
 	log.InfoContext(ctx, "Using Fluentd url", "url", c.FluentdURL)
@@ -283,10 +297,14 @@ func (c *StartCmdConfig) Dump(ctx context.Context, log *slog.Logger) {
 	}
 
 	if c.LockEnabled {
-		log.InfoContext(ctx, "Auto-locking enabled", "count", c.LockFailedAttemptsCount, "period", c.LockPeriod)
+		log.InfoContext(ctx, "Auto-locking enabled", "count", c.LockFailedAttemptsCount, "period", c.LockPeriod, "for", c.LockFor)
 	}
 
 	if c.DryRun {
 		log.WarnContext(ctx, "Dry run! Events are not sent to Fluentd. Separate storage is used.")
 	}
+
+	if c.ExitOnLastEvent {
+		log.WarnContext(ctx, "Exit on last event setting enabled")
+	}
 }
diff --git a/integrations/event-handler/cli_test.go b/integrations/event-handler/cli_test.go
index b0b408a89ddfd..a7e909d439959 100644
--- a/integrations/event-handler/cli_test.go
+++ b/integrations/event-handler/cli_test.go
@@ -61,10 +61,12 @@ func TestStartCmdConfig(t *testing.T) {
 					IngestConfig: IngestConfig{
 						StorageDir:          "./storage",
 						BatchSize:           20,
+						Types:               map[string]struct{}{},
 						SkipEventTypes:      map[string]struct{}{},
-						SkipSessionTypesRaw: []string{"print"},
+						SkipSessionTypesRaw: []string{"print", "desktop.recording"},
 						SkipSessionTypes: map[string]struct{}{
-							"print": {},
+							"print":             {},
+							"desktop.recording": {},
 						},
 						Timeout:     10 * time.Second,
 						Concurrency: 5,
@@ -100,10 +102,12 @@ func TestStartCmdConfig(t *testing.T) {
 					IngestConfig: IngestConfig{
 						StorageDir:          "./storage",
 						BatchSize:           20,
+						Types:               map[string]struct{}{},
 						SkipEventTypes:      map[string]struct{}{},
-						SkipSessionTypesRaw: []string{"print"},
+						SkipSessionTypesRaw: []string{"print", "desktop.recording"},
 						SkipSessionTypes: map[string]struct{}{
-							"print": {},
+							"print":             {},
+							"desktop.recording": {},
 						},
 						Timeout:     10 * time.Second,
 						Concurrency: 5,
@@ -139,10 +143,12 @@ func TestStartCmdConfig(t *testing.T) {
 					IngestConfig: IngestConfig{
 						StorageDir:          "./storage",
 						BatchSize:           20,
+						Types:               map[string]struct{}{},
 						SkipEventTypes:      map[string]struct{}{},
-						SkipSessionTypesRaw: []string{"print"},
+						SkipSessionTypesRaw: []string{"print", "desktop.recording"},
 						SkipSessionTypes: map[string]struct{}{
-							"print": {},
+							"print":             {},
+							"desktop.recording": {},
 						},
 						Timeout:     10 * time.Second,
 						Concurrency: 5,
diff --git a/integrations/event-handler/event_handler_test.go b/integrations/event-handler/event_handler_test.go
index 63efd444ce628..23471569981e8 100644
--- a/integrations/event-handler/event_handler_test.go
+++ b/integrations/event-handler/event_handler_test.go
@@ -25,42 +25,23 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
 
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/integrations/lib"
 	"github.com/gravitational/teleport/integrations/lib/logger"
 	"github.com/gravitational/teleport/integrations/lib/testing/integration"
 )
 
-type EventHandlerSuite struct {
-	suite.Suite
-	AuthHelper  integration.AuthHelper
-	appConfig   StartCmdConfig
-	fakeFluentd *FakeFluentd
-
-	client         *client.Client
-	teleportConfig lib.TeleportConfig
-}
-
 func TestEventHandler(t *testing.T) {
-	suite.Run(t, &EventHandlerSuite{
-		AuthHelper: &integration.MinimalAuthHelper{},
-	})
-}
-
-// SetupSuite starts a Teleport auth service and creates the event forwarder
-// user and role. This runs a once for the whole suite.
-func (s *EventHandlerSuite) SetupSuite() {
-	var err error
-	ctx, cancel := context.WithCancel(context.Background())
-	s.T().Cleanup(cancel)
+	authHelper := &integration.MinimalAuthHelper{}
 
+	// starts a Teleport auth service and creates the event forwarder
+	// user and role.
 	// Start the Teleport Auth server and get the admin client.
-	s.client = s.AuthHelper.StartServer(s.T())
-	_, err = s.client.Ping(ctx)
-	require.NoError(s.T(), err)
+	adminClient := authHelper.StartServer(t)
+	t.Cleanup(func() { require.NoError(t, authHelper.Auth().Close()) })
+	_, err := adminClient.Ping(t.Context())
+	require.NoError(t, err)
 
 	eventHandlerRole, err := types.NewRole("teleport-event-handler", types.RoleSpecV6{
 		Allow: types.RoleConditions{
@@ -73,88 +54,58 @@ func (s *EventHandlerSuite) SetupSuite() {
 		},
 		Deny: types.RoleConditions{},
 	})
-	require.NoError(s.T(), err)
+	require.NoError(t, err)
 
-	eventHandlerRole, err = s.client.CreateRole(ctx, eventHandlerRole)
-	require.NoError(s.T(), err)
+	eventHandlerRole, err = adminClient.CreateRole(t.Context(), eventHandlerRole)
+	require.NoError(t, err)
 
 	eventHandlerUser, err := types.NewUser("teleport-event-handler")
-	require.NoError(s.T(), err)
+	require.NoError(t, err)
 
 	eventHandlerUser.SetRoles([]string{eventHandlerRole.GetName()})
-	eventHandlerUser, err = s.client.CreateUser(ctx, eventHandlerUser)
-	require.NoError(s.T(), err)
-
-	s.teleportConfig.Addr = s.AuthHelper.ServerAddr()
-	s.teleportConfig.Identity = s.AuthHelper.SignIdentityForUser(s.T(), ctx, eventHandlerUser)
-}
-
-// SetupTest starts a fake fluentd server.
-// This runs before every test from the suite.
-func (s *EventHandlerSuite) SetupTest() {
-	t := s.T()
+	eventHandlerUser, err = adminClient.CreateUser(t.Context(), eventHandlerUser)
+	require.NoError(t, err)
 
-	// Start fake fluentd
-	err := logger.Setup(logger.Config{Severity: "debug"})
+	// Starts a fake fluentd server.
+	err = logger.Setup(logger.Config{Severity: "debug"})
 	require.NoError(t, err)
 
-	s.fakeFluentd = NewFakeFluentd(t)
-	s.fakeFluentd.Start()
-	t.Cleanup(s.fakeFluentd.Close)
+	fakeFluentd := NewFakeFluentd(t)
+	fakeFluentd.Start()
+	t.Cleanup(fakeFluentd.Close)
 
 	startTime := time.Now().Add(-time.Minute)
 
-	conf := StartCmdConfig{
+	fluentdConfig := fakeFluentd.GetClientConfig()
+	fluentdConfig.FluentdURL = fakeFluentd.GetURL()
+	fluentdConfig.FluentdSessionURL = fluentdConfig.FluentdURL + "/session"
+
+	appConfig := StartCmdConfig{
 		TeleportConfig: TeleportConfig{
-			TeleportAddr:         s.teleportConfig.Addr,
-			TeleportIdentityFile: s.teleportConfig.Identity,
+			TeleportAddr:         authHelper.ServerAddr(),
+			TeleportIdentityFile: authHelper.SignIdentityForUser(t, t.Context(), eventHandlerUser),
 		},
-		FluentdConfig: s.fakeFluentd.GetClientConfig(),
+		FluentdConfig: fluentdConfig,
 		IngestConfig: IngestConfig{
 			StorageDir:       t.TempDir(),
 			Timeout:          time.Second,
 			BatchSize:        100,
 			Concurrency:      5,
 			StartTime:        &startTime,
-			SkipSessionTypes: map[string]struct{}{"print": {}},
+			SkipSessionTypes: map[string]struct{}{"print": {}, "desktop.recording": {}},
 			WindowSize:       time.Hour * 24,
 		},
 	}
 
-	conf.FluentdURL = s.fakeFluentd.GetURL()
-	conf.FluentdSessionURL = conf.FluentdURL + "/session"
-
-	s.appConfig = conf
-}
-
-func (s *EventHandlerSuite) startApp() {
-	s.T().Helper()
-	t := s.T()
-	t.Helper()
-
-	app, err := NewApp(&s.appConfig, slog.Default())
-	require.NoError(t, err)
-
-	integration.RunAndWaitReady(s.T(), app)
-}
-
-// nonce is data produced to uniquely identify an event.
-// The nonce is propagated from the event generator to the event checker.
-// All events not matching the nonce are skipped.
-type nonce any
-
-func (s *EventHandlerSuite) TestEvent() {
-	ctx, cancel := context.WithCancel(context.Background())
-	s.T().Cleanup(cancel)
-
+	// Original TestEvent
 	tests := []struct {
 		name          string
-		generateEvent func(*testing.T, *client.Client) nonce
-		checkEvent    func(*testing.T, string, nonce) bool
+		generateEvent func(*testing.T, *client.Client) any
+		checkEvent    func(*testing.T, string, any) bool
 	}{
 		{
 			name: "new role",
-			generateEvent: func(t *testing.T, c *client.Client) nonce {
+			generateEvent: func(t *testing.T, c *client.Client) any {
 				roleName := uuid.New().String()
 				role, err := types.NewRole(roleName, types.RoleSpecV6{
 					Options: types.RoleOptions{},
@@ -162,11 +113,11 @@ func (s *EventHandlerSuite) TestEvent() {
 					Deny:    types.RoleConditions{},
 				})
 				require.NoError(t, err)
-				role, err = c.CreateRole(ctx, role)
+				role, err = c.CreateRole(t.Context(), role)
 				require.NoError(t, err)
 				return role.GetName()
 			},
-			checkEvent: func(t *testing.T, event string, n nonce) bool {
+			checkEvent: func(t *testing.T, event string, n any) bool {
 				roleName, ok := n.(string)
 				require.True(t, ok)
 				return strings.Contains(event, roleName)
@@ -174,35 +125,39 @@ func (s *EventHandlerSuite) TestEvent() {
 		},
 		{
 			name: "new token",
-			generateEvent: func(t *testing.T, c *client.Client) nonce {
+			generateEvent: func(t *testing.T, c *client.Client) any {
 				tokenName := uuid.New().String()
 				token, err := types.NewProvisionToken(tokenName, types.SystemRoles{types.RoleNode}, time.Time{})
 				require.NoError(t, err)
-				err = c.CreateToken(ctx, token)
+				err = c.CreateToken(t.Context(), token)
 				require.NoError(t, err)
 				return nil
 			},
-			checkEvent: func(t *testing.T, event string, _ nonce) bool {
+			checkEvent: func(t *testing.T, event string, _ any) bool {
 				return strings.Contains(event, "join_token.create")
 			},
 		},
 	}
 
 	// Start the event forwarder
-	s.startApp()
+	app, err := NewApp(&appConfig, slog.Default())
+	require.NoError(t, err)
+
+	t.Cleanup(app.Close)
+
+	integration.RunAndWaitReady(t, app)
 
 	for _, tt := range tests {
-		s.T().Run(tt.name, func(t *testing.T) {
-			nonce := tt.generateEvent(t, s.client)
+		t.Run(tt.name, func(t *testing.T) {
+			any := tt.generateEvent(t, adminClient)
 
-			waitCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-			s.T().Cleanup(cancel)
+			waitCtx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+			t.Cleanup(cancel)
 
-			eventFound := false
-			for !eventFound {
-				event, err := s.fakeFluentd.GetMessage(waitCtx)
-				require.NoError(s.T(), err, "did not receive the event after 5 seconds")
-				if tt.checkEvent(t, event, nonce) {
+			for eventFound := false; !eventFound; {
+				event, err := fakeFluentd.GetMessage(waitCtx)
+				require.NoError(t, err, "did not receive the event after 5 seconds")
+				if tt.checkEvent(t, event, any) {
 					t.Logf("Event matched: %s", event)
 					eventFound = true
 				} else {
diff --git a/integrations/event-handler/events_job.go b/integrations/event-handler/events_job.go
index 4a26c3cc4e531..8c0ca4000e687 100644
--- a/integrations/event-handler/events_job.go
+++ b/integrations/event-handler/events_job.go
@@ -122,6 +122,7 @@ func (j *EventsJob) runPolling(ctx context.Context) error {
 		if err := stream.Drain(chunks); err != nil {
 			if trace.IsNotImplemented(err) {
 				// fallback to legacy behavior
+				j.app.log.DebugContext(ctx, "Bulk event export API is not implemented on this server, reverting to legacy watcher")
 				return j.runLegacyPolling(ctx)
 			}
 			return trace.Wrap(err)
@@ -264,10 +265,13 @@ func (j *EventsJob) runLegacyPolling(ctx context.Context) error {
 
 // handleEventV2 processes an event from the newer export API.
 func (j *EventsJob) handleEventV2(ctx context.Context, evt *auditlogpb.ExportEventUnstructured) error {
-
 	// filter out unwanted event types (in the v1 event export logic this was an internal behavior
 	// of the event processing helper since it would perform conversion prior to storing the event
 	// in its internal buffer).
+	if _, ok := j.app.Config.Types[evt.Event.Type]; len(j.app.Config.Types) > 0 && !ok {
+		return nil
+	}
+
 	if _, ok := j.app.Config.SkipEventTypes[evt.Event.Type]; ok {
 		return nil
 	}
@@ -292,6 +296,7 @@ func (j *EventsJob) handleEvent(ctx context.Context, evt *TeleportEvent) error {
 
 	// Start session ingestion if needed
 	if evt.IsSessionEnd {
+		j.app.log.DebugContext(ctx, "Registering session", "sid", evt.SessionID)
 		j.app.RegisterSession(ctx, evt)
 	}
 
diff --git a/integrations/event-handler/events_job_test.go b/integrations/event-handler/events_job_test.go
new file mode 100644
index 0000000000000..d196db50bb552
--- /dev/null
+++ b/integrations/event-handler/events_job_test.go
@@ -0,0 +1,120 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"bytes"
+	"log/slog"
+	"regexp"
+	"testing"
+
+	"github.com/peterbourgon/diskv/v3"
+	"github.com/stretchr/testify/require"
+
+	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+)
+
+func TestEventHandlerFilters(t *testing.T) {
+	tests := []struct {
+		name         string
+		ingestConfig IngestConfig
+		events       []apievents.AuditEvent
+	}{
+		{
+			name: "types filter out role.created",
+			ingestConfig: IngestConfig{
+				Types:            map[string]struct{}{"join_token.create": {}},
+				SkipSessionTypes: map[string]struct{}{"print": {}, "desktop.recording": {}},
+				DryRun:           true,
+			},
+			events: []apievents.AuditEvent{
+				&apievents.RoleCreate{
+					Metadata: apievents.Metadata{
+						Type: events.RoleCreatedEvent,
+						Code: events.RoleCreatedCode,
+					},
+				},
+				&apievents.ProvisionTokenCreate{
+					Metadata: apievents.Metadata{
+						Type: events.ProvisionTokenCreateEvent,
+						Code: events.ProvisionTokenCreateCode,
+					},
+				},
+			},
+		},
+		{
+			name: "skip-event-types filter out role.created",
+			ingestConfig: IngestConfig{
+				SkipEventTypes:   map[string]struct{}{"role.created": {}},
+				SkipSessionTypes: map[string]struct{}{"print": {}, "desktop.recording": {}},
+				DryRun:           true,
+			},
+			events: []apievents.AuditEvent{
+				&apievents.RoleCreate{
+					Metadata: apievents.Metadata{
+						Type: events.RoleCreatedEvent,
+						Code: events.RoleCreatedCode,
+					},
+				},
+				&apievents.ProvisionTokenCreate{
+					Metadata: apievents.Metadata{
+						Type: events.ProvisionTokenCreateEvent,
+						Code: events.ProvisionTokenCreateCode,
+					},
+				},
+			},
+		},
+	}
+
+	skipEvent := regexp.MustCompile("\"Event sent\".*type=role.created")
+	checkEvent := regexp.MustCompile("\"Event sent\".*type=join_token.create")
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := &bytes.Buffer{}
+			log := slog.New(slog.NewTextHandler(out, &slog.HandlerOptions{Level: slog.LevelDebug}))
+
+			job := NewEventsJob(&App{
+				Config: &StartCmdConfig{
+					IngestConfig: tt.ingestConfig},
+				State: &State{
+					dv: diskv.New(diskv.Options{
+						BasePath: t.TempDir(),
+					}),
+				},
+				client: &mockClient{},
+				log:    log,
+			})
+
+			generateEvents, err := eventsToProto(tt.events)
+			require.NoError(t, err)
+
+			for _, event := range generateEvents {
+				exportEvent := &auditlogpb.ExportEventUnstructured{Event: event}
+
+				err := job.handleEventV2(t.Context(), exportEvent)
+				require.NoError(t, err)
+
+			}
+
+			require.NotRegexp(t, skipEvent, out.String())
+			require.Regexp(t, checkEvent, out.String())
+		})
+	}
+}
diff --git a/integrations/event-handler/fluentd_client.go b/integrations/event-handler/fluentd_client.go
index e1369adc8c661..955877aa843a8 100644
--- a/integrations/event-handler/fluentd_client.go
+++ b/integrations/event-handler/fluentd_client.go
@@ -130,7 +130,7 @@ func (f *FluentdClient) Send(ctx context.Context, url string, b []byte) error {
 	}
 	defer r.Body.Close()
 
-	if r.StatusCode != http.StatusOK {
+	if r.StatusCode != http.StatusOK && r.StatusCode != http.StatusNoContent {
 		return trace.Errorf("Failed to send event to fluentd (HTTP %v)", r.StatusCode)
 	}
 
diff --git a/integrations/event-handler/go.mod b/integrations/event-handler/go.mod
index a1b7a49e00261..476781282df7e 100644
--- a/integrations/event-handler/go.mod
+++ b/integrations/event-handler/go.mod
@@ -1,6 +1,6 @@
 module github.com/gravitational/teleport/integrations/event-handler
 
-go 1.24.3
+go 1.24.11
 
 require (
 	github.com/alecthomas/kong v1.10.0
@@ -14,29 +14,30 @@ require (
 	github.com/pelletier/go-toml v1.9.5
 	github.com/peterbourgon/diskv/v3 v3.0.1
 	github.com/sethvargo/go-limiter v1.0.0
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/net v0.39.0
-	golang.org/x/time v0.11.0
-	google.golang.org/protobuf v1.36.6
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.47.0
+	golang.org/x/time v0.12.0
+	google.golang.org/protobuf v1.36.8
 )
 
 require (
-	cloud.google.com/go v0.120.0 // indirect
-	cloud.google.com/go/auth v0.16.1 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/alloydb v1.16.1 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute v1.37.0 // indirect
-	cloud.google.com/go/compute/metadata v0.6.0 // indirect
-	cloud.google.com/go/container v1.42.4 // indirect
+	cloud.google.com/go/compute v1.38.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
+	cloud.google.com/go/container v1.43.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
-	cloud.google.com/go/kms v1.21.2 // indirect
-	cloud.google.com/go/longrunning v0.6.6 // indirect
+	cloud.google.com/go/kms v1.22.0 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
 	cloud.google.com/go/resourcemanager v1.10.6 // indirect
 	connectrpc.com/connect v1.18.1 // indirect
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	filippo.io/age v1.2.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0 // indirect
@@ -50,8 +51,9 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
@@ -62,17 +64,18 @@ require (
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.29.14 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.67 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.39.6 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
 	github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecs v1.56.2 // indirect
@@ -81,40 +84,44 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/glue v1.109.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.38.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/rds v1.95.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 // indirect
-	github.com/aws/smithy-go v1.22.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
 	github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 // indirect
 	github.com/beevik/etree v1.5.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.0 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/charlievieth/strcase v0.0.5 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/containerd/containerd v1.7.27 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
@@ -125,15 +132,9 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/di-wu/parser v0.3.0 // indirect
 	github.com/di-wu/xsd-datetime v1.0.0 // indirect
-	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v27.5.0+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.1.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
@@ -145,16 +146,17 @@ require (
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/go-chi/chi v4.1.2+incompatible // indirect
-	github.com/go-chi/chi/v5 v5.2.1 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.11 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
@@ -163,8 +165,8 @@ require (
 	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-webauthn/webauthn v0.12.3 // indirect
 	github.com/go-webauthn/x v0.1.20 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
@@ -174,39 +176,41 @@ require (
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/certificate-transparency-go v1.3.1 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-attestation v0.5.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
 	github.com/google/go-github/v70 v70.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/go-tpm v0.9.4 // indirect
 	github.com/google/go-tpm-tools v0.4.5 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
+	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
-	github.com/gravitational/roundtrip v1.0.2 // indirect
+	github.com/gravitational/roundtrip v1.0.3 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/in-toto/attestation v1.1.1 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
@@ -247,7 +251,6 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -257,10 +260,12 @@ require (
 	github.com/muhlemmer/httpforwarded v0.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/ohler55/ojg v1.26.8 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/okta/okta-sdk-golang/v2 v2.20.0 // indirect
+	github.com/openai/openai-go v1.8.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oracle/oci-go-sdk/v65 v65.89.3 // indirect
 	github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible // indirect
@@ -268,28 +273,30 @@ require (
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkoukk/tiktoken-go v0.1.8 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pquerna/otp v1.4.0 // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
-	github.com/rubenv/sql-migrate v1.7.1 // indirect
+	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russellhaering/gosaml2 v0.10.0 // indirect
 	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
 	github.com/scim2/filter-parser/v2 v2.2.0 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sigstore/protobuf-specs v0.4.1 // indirect
-	github.com/sigstore/rekor v1.3.9 // indirect
-	github.com/sigstore/sigstore v1.9.4 // indirect
+	github.com/sigstore/protobuf-specs v0.5.0 // indirect
+	github.com/sigstore/rekor v1.4.1 // indirect
+	github.com/sigstore/sigstore v1.9.5 // indirect
 	github.com/sigstore/sigstore-go v0.7.1 // indirect
 	github.com/sigstore/timestamp-authority v1.2.5 // indirect
 	github.com/sijms/go-ora/v2 v2.8.24 // indirect
@@ -299,7 +306,7 @@ require (
 	github.com/spf13/afero v1.12.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/spf13/viper v1.20.1 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
@@ -307,75 +314,81 @@ require (
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.7.0 // indirect
 	github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/transparency-dev/merkle v0.0.2 // indirect
 	github.com/vulcand/predicate v1.2.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	github.com/zitadel/logging v0.6.2 // indirect
-	github.com/zitadel/oidc/v3 v3.38.1 // indirect
+	github.com/zitadel/oidc/v3 v3.43.0 // indirect
 	github.com/zitadel/schema v1.3.1 // indirect
 	gitlab.com/gitlab-org/api/client-go v0.127.0 // indirect
-	go.mongodb.org/mongo-driver v1.14.0 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.6.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/term v0.31.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
-	google.golang.org/api v0.230.0 // indirect
-	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 // indirect
-	google.golang.org/grpc v1.72.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	google.golang.org/api v0.248.0 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/grpc v1.75.0 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.17.3 // indirect
-	k8s.io/api v0.33.0 // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
-	k8s.io/apimachinery v0.33.0 // indirect
-	k8s.io/apiserver v0.33.0 // indirect
-	k8s.io/cli-runtime v0.33.0 // indirect
-	k8s.io/client-go v0.33.0 // indirect
-	k8s.io/component-base v0.33.0 // indirect
+	helm.sh/helm/v3 v3.18.5 // indirect
+	k8s.io/api v0.33.3 // indirect
+	k8s.io/apiextensions-apiserver v0.33.3 // indirect
+	k8s.io/apimachinery v0.33.3 // indirect
+	k8s.io/apiserver v0.33.3 // indirect
+	k8s.io/cli-runtime v0.33.3 // indirect
+	k8s.io/client-go v0.33.3 // indirect
+	k8s.io/component-base v0.33.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubectl v0.33.0 // indirect
+	k8s.io/kubectl v0.33.3 // indirect
 	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
 	mvdan.cc/sh/v3 v3.7.0 // indirect
-	oras.land/oras-go v1.2.5 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
 	sigs.k8s.io/controller-runtime v0.20.4 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.19.0 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace (
@@ -387,12 +400,13 @@ replace (
 replace (
 	github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
 	github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
-	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1
+	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2
 	github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4
 	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-teleport.2
+	github.com/hinshun/vt10x => github.com/gravitational/vt10x v0.0.3-teleport.1
 	github.com/julienschmidt/httprouter => github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5
 	github.com/keys-pub/go-libfido2 => github.com/gravitational/go-libfido2 v1.5.3-teleport.1
 	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v1.8.1-teleport.2
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.2
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
diff --git a/integrations/event-handler/go.sum b/integrations/event-handler/go.sum
index 6a088f3c906b3..7abc954158eef 100644
--- a/integrations/event-handler/go.sum
+++ b/integrations/event-handler/go.sum
@@ -1,41 +1,47 @@
-cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA=
-cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q=
-cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
-cloud.google.com/go/auth v0.16.1/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go/alloydb v1.16.1 h1:pW4D0O2jAfAjoOEI1bgChPwMHWE8X8BjwSO0tfWkWvk=
+cloud.google.com/go/alloydb v1.16.1/go.mod h1:zeZuGJ5mEaQE70FMXEvZIp5hQLR9yrGnHo1YUOncWRY=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/compute v1.37.0 h1:XxtZlXYkZXub3LNaLu90TTemcFqIU1yZ4E4q9VlR39A=
-cloud.google.com/go/compute v1.37.0/go.mod h1:AsK4VqrSyXBo4SMbRtfAO1VfaMjUEjEwv1UB/AwVp5Q=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
-cloud.google.com/go/container v1.42.4 h1:N8I+GiImhrSMUcKSOYTd8D6wBWyWSgPa4IJkSdlR2jk=
-cloud.google.com/go/container v1.42.4/go.mod h1:wf9lKc3ayWVbbV/IxKIDzT7E+1KQgzkzdxEJpj1pebE=
+cloud.google.com/go/compute v1.38.0 h1:MilCLYQW2m7Dku8hRIIKo4r0oKastlD74sSu16riYKs=
+cloud.google.com/go/compute v1.38.0/go.mod h1:oAFNIuXOmXbK/ssXm3z4nZB8ckPdjltJ7xhHCdbWFZM=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
+cloud.google.com/go/container v1.43.0 h1:A6J92FJPfxTvyX7MHF+w4t2W9WCqvHOi9UB5SAeSy3w=
+cloud.google.com/go/container v1.43.0/go.mod h1:ETU9WZ1KM9ikEKLzrhRVao7KHtalDQu6aPqM34zDr/U=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
 cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
-cloud.google.com/go/kms v1.21.2 h1:c/PRUSMNQ8zXrc1sdAUnsenWWaNXN+PzTXfXOcSFdoE=
-cloud.google.com/go/kms v1.21.2/go.mod h1:8wkMtHV/9Z8mLXEXr1GK7xPSBdi6knuLXIhqjuWcI6w=
-cloud.google.com/go/longrunning v0.6.6 h1:XJNDo5MUfMM05xK3ewpbSdmt7R2Zw+aQEMbdQR65Rbw=
-cloud.google.com/go/longrunning v0.6.6/go.mod h1:hyeGJUrPHcx0u2Uu1UFSoYZLn4lkMrccJig0t4FI7yw=
+cloud.google.com/go/kms v1.22.0 h1:dBRIj7+GDeeEvatJeTB19oYZNV0aj6wEqSIT/7gLqtk=
+cloud.google.com/go/kms v1.22.0/go.mod h1:U7mf8Sva5jpOb4bxYZdtw/9zsbIjrklYwPcvMk34AL8=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
 cloud.google.com/go/resourcemanager v1.10.6 h1:LIa8kKE8HF71zm976oHMqpWFiaDHVw/H1YMO71lrGmo=
 cloud.google.com/go/resourcemanager v1.10.6/go.mod h1:VqMoDQ03W4yZmxzLPrB+RuAoVkHDS5tFUUQUhOtnRTg=
 connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
 connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
+filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 h1:OVoM452qUFBrX+URdH3VpR299ma4kfom0yB0URYky9g=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0/go.mod h1:kUjrAo8bgEwLeZ/CmHqNl3Z/kPm7y6FKfxxK0izYUg4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 h1:Hr5FTipp7SL07o2FvoVOX9HRiRH3CR3Mj8pxqCcdD5A=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2/go.mod h1:QyVsSSN64v5TGltphKLQ2sQxe4OBQg0J1eKRcVBnfgE=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 h1:MhRfI58HblXzCtWEZCO0feHs8LweePB3s90r7WaR1KU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0/go.mod h1:okZ+ZURbArNdlJ+ptXoyHNuOETzOl1Oww19rm8I2WLA=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 h1:Hp+EScFOu9HeCbeW8WU2yQPJd4gGwhMgKxWe+G6jNzw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0/go.mod h1:/pz8dyNQe+Ey3yBp/XuYz7oqX8YDNWVpPB0hH3XWfbc=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 h1:z7Mqz6l0EFH549GvHEqfjKvi+cRScxLWbaoeLm9wxVQ=
@@ -68,10 +74,10 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 h1:S087d
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0/go.mod h1:B4cEyXrWBmbfMDAPnpJ1di7MAt5DKP57jPEObAvZChg=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 h1:Wgf5rZba3YZqeTNJPtvqZoBu1sBN/L4sry+u2U3Y75w=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1/go.mod h1:xxCBG/f/4Vbmh2XQJBsOmNdxWUY5j/s27jujKPbQf14=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
@@ -80,8 +86,8 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
-github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
-github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/DanielTitkov/go-adaptive-cards v0.2.2 h1:tBFExyvsbCcrBJEvPaV3FW4gcAkwQjXFKiKEBrE7Yuw=
@@ -100,54 +106,56 @@ github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
-github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
 github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
+github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tjT8=
+github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/kong v1.10.0 h1:8K4rGDpT7Iu+jEXCIJUeKqvpwZHbsFRoebLbnzlmrpw=
 github.com/alecthomas/kong v1.10.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
-github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
-github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
-github.com/aws/aws-sdk-go-v2/config v1.29.14 h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
-github.com/aws/aws-sdk-go-v2/config v1.29.14/go.mod h1:wVPHWcIFv3WO89w0rE10gzf17ZYy+UVS1Geq8Iei34g=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74 h1:+1lc5oMFFHlVBclPXQf/POqlvdpBzjLaN2c3ujDCcZw=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74/go.mod h1:EiskBoFr4SpYnFIbw8UM7DP7CacQXDHEmJqLI1xpRFI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk=
+github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 h1:S61/E3N01oral6B3y9hZ2E1iFDqCZPPOBoBQretCnBI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75/go.mod h1:bDMQbkI1vJbNjnvJYpPTSNYBkI/VIv18ngWb/K84tkk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 h1:QWhxjrA0r+FQnDAATdGqLXUvYW0MdUIvCBK89BN3OfU=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4/go.mod h1:xsG8Y2fMenmHTdukyknTUO1uQhEZ/entaNHvPmD1klE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 h1:xdYdX+JpIFByMG8JQe9iWM9CqepyjhenukxTVQnuCbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0/go.mod h1:c1Ik+59wgLIJFhsSY8cAnw6QooiogpTZKP0rtkVcpCQ=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0 h1:9nUhN6dRT2chbA7E9y3JDGpIV1C7cZpfiRvX63EB5XA=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
 github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 h1:se3+XU16LNr8JoHdJBrBNJKvn1dnJcnW3qRlo5g2vKI=
@@ -164,16 +172,16 @@ github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk
 github.com/aws/aws-sdk-go-v2/service/iam v1.41.1/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 h1:hWqvzMaaiHhwndQhy1rF/qoHidaa4KzevkiDaMvjk3Q=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2/go.mod h1:7nGvrQXBNp7k5yYpwpmxGucYTPY39d0cxjmANAeWwYE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 h1:4nm2G6A4pV9rdlWzGMPv4BNtQp22v1hg3yrtkYpeLl8=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3 h1:RivOtUH3eEu6SWnUMFHKAW4MqDOzWn1vGQ3S38Y5QMg=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 h1:Z95XCqqSnwXr0AY7PgsiOUBhUG2GoDM5getw6RfD1Lg=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0/go.mod h1:DqcSngL7jJeU1fOzh5Ll5rSvX/MlMV6OZlE4mVdFAQc=
 github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 h1:ggjjmfNX+nlv+nWHXOLr1pl36buP25Y9GZBEPMSofGw=
 github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0/go.mod h1:pfuDC5zBwunXdE44WT1PRbtzuXWGohKFcFLtv+ezI6k=
 github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 h1:vWClqL1dTCuPtWkaGDW7Y6P9ocqHtfFrjlkWYARm1qI=
@@ -186,53 +194,53 @@ github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 h1:LNOKEsPjtoBrV2WYUb2zPLO
 github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3/go.mod h1:TC8pNvjiikrjpX2MEzX/cEJ4/T4XIoSY4BskVvHj8bk=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 h1:+nldYGx2Kdn7jzntjm2fG7sRonfQ08l1RqkLSTed8G8=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1/go.mod h1:gpRsJN3qxZbsj1NhAoCNX02zJ4RZUB5v/7o4QrnGTcA=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 h1:QqXnA7s6sxFe6B6dkocEfZ9ap1bAmEXp4W32n9n+cmU=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4/go.mod h1:cgPfPTC/V3JqwCKed7Q6d0FrgarV7ltz4Bz6S4Q+Dqk=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 h1:0LBxtAX2bHcfPr6VSzQSvJlR1nzlna7xp031gEjbWGU=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2/go.mod h1:NW+LcIadUUlDgM3gb8+97lr6zSKExHR58NRRWSWkXl8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 h1:BRXS0U76Z8wfF+bnkilA2QwpIch6URlm++yPUt9QPmQ=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3/go.mod h1:bNXKFFyaiVvWuR6O16h/I1724+aXe/tAkA9/QS01t5k=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 h1:EKXYJ8kgz4fiqef8xApu7eH0eae2SrVG+oHCLFybMRI=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4/go.mod h1:yGhDiLKguA3iFJYxbrQkQiNzuy+ddxesSZYWVeeEH5Q=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 h1:ihddI5wufQQCJiujUgAvWRqZcfDmSKIfXlAuX7T95cg=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4/go.mod h1:PJtxxMdj747j8DeZENRTTYAz/lx/pADn/U0k7YNNiUY=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 h1:KNgVWw8qbPzjYnIF1gL0EAszy6VKGnmUK6VSm1huYY8=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 h1:KWArCwA/WkuHWKfygkNz0B6YS6OvdgoJUaJHX0Qby1s=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 h1:j3YvW9+qUFIzshXoPclOEUOSlXgr9vCU6OsB/CVRKGM=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2/go.mod h1:znVkl7Y14sZKEL/sbRQ6qgD8wj8VdTcVVQp5iRaKXcc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
-github.com/aws/smithy-go v1.22.3 h1:Z//5NuZCSW6R4PhQ93hShNbyBbn8BWCmCVCt+Q8Io5k=
-github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
+github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
+github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 h1:Gx4ipHtKfaABSHAVo4Zjo2E4ClKzYqZ2NrPO0gy6qvY=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4/go.mod h1:nnwXv9COKyqd4q7jpPrxRaW9L+Qfwb4aGTdZqsIpOho=
 github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
 github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
-github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
+github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd h1:rFt+Y/IK1aEZkEHchZRSq9OQbsSzIT/OrI8YFFmRIng=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/buildkite/bintest/v3 v3.3.0 h1:RTWcSaJRlOT6t/K311ejPf+0J3LE/QEODzVG3vlLnWo=
 github.com/buildkite/bintest/v3 v3.3.0/go.mod h1:btqpTsVODiJcb0NMdkkmtMQ6xoFc2W/nY5yy+3I0zcs=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
@@ -250,20 +258,18 @@ github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
-github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
-github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
-github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
-github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
-github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
@@ -288,30 +294,22 @@ github.com/di-wu/parser v0.3.0/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX
 github.com/di-wu/xsd-datetime v1.0.0 h1:vZoGNkbzpBNoc+JyfVLEbutNDNydYV8XwHeV7eUJoxI=
 github.com/di-wu/xsd-datetime v1.0.0/go.mod h1:i3iEhrP3WchwseOBeIdW/zxeoleXTOzx1WyDXgdmOww=
 github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
+github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
+github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.5.0+incompatible h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM=
-github.com/docker/cli v27.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
-github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry/P5s8R4dYuLkhB9Nhso8ogFWNr4IQ=
@@ -340,34 +338,29 @@ github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
-github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
-github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
-github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
 github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
-github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -384,19 +377,19 @@ github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZ
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.12.3 h1:hHQl1xkUuabUU9uS+ISNCMLs9z50p9mDUZI/FmkayNE=
 github.com/go-webauthn/webauthn v0.12.3/go.mod h1:4JRe8Z3W7HIw8NGEWn2fnUwecoDzkkeach/NnvhkqGY=
 github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
@@ -417,25 +410,18 @@ github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
+github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
-github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
@@ -446,15 +432,14 @@ github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63Kqpo
 github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-attestation v0.5.1 h1:jqtOrLk5MNdliTKjPbIPrAaRKJaKW+0LIU2n/brJYms=
 github.com/google/go-attestation v0.5.1/go.mod h1:KqGatdUhg5kPFkokyzSBDxwSCFyRgIgtRkMp6c3lOBQ=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
 github.com/google/go-github/v70 v70.0.0 h1:/tqCp5KPrcvqCc7vIvYyFYTiCGrYvaWoYMGHSQbo55o=
 github.com/google/go-github/v70 v70.0.0/go.mod h1:xBUZgo8MI3lUL/hwxl3hlceJW1U8MVnXP3zUyI+rhQY=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
@@ -474,8 +459,10 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
 github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e h1:FJta/0WsADCe1r9vQjdHbd3KuiLPu7Y9WlyLGwMUNyE=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
+github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
+github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f h1:o2yGZLlsOj5H5uvtQNEdi6DeA0GbUP3lm0gWW5RvY0s=
@@ -484,14 +471,14 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
-github.com/google/trillian v1.7.1 h1:+zX8jLM3524bAMPS+VxaDIDgsMv3/ty6DuLWerHXcek=
-github.com/google/trillian v1.7.1/go.mod h1:E1UMAHqpZCA8AQdrKdWmHmtUfSeiD0sDWD1cv00Xa+c=
+github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js=
+github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -517,26 +504,30 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
-github.com/gravitational/predicate v1.3.2 h1:NAdaWihgGVS3nuKDZZHTda4wwNjGlvG4a+UYQ4f3gQc=
-github.com/gravitational/predicate v1.3.2/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EMLfRWQVJMmK+MA6gV8AI=
 github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
-github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
-github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
+github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
+github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
 github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
 github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
 github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
 github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/gravitational/vt10x v0.0.3-teleport.1 h1:QYNPZGCQRcz1JehDn5m75UvRQbEJvT5X1pVblnCfZrY=
+github.com/gravitational/vt10x v0.0.3-teleport.1/go.mod h1:7p0/hpXPXby/VpuB6rFUq2pd7grku9KB+EcF0+jwqzQ=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 h1:KcFzXwzM/kGhIRHvc8jdixfIJjVzuUJdnv+5xsPutog=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1/go.mod h1:qOchhhIlmRcqk/O9uCo/puJlyo07YINaIqdZfZG3Jkc=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -546,8 +537,8 @@ github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB1
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
@@ -559,12 +550,14 @@ github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjG
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
 github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
@@ -611,8 +604,8 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
-github.com/jellydator/ttlcache/v3 v3.3.0 h1:BdoC9cE81qXfrxeb9eoJi9dWrdhSuwXMAnHTbnBm4Wc=
-github.com/jellydator/ttlcache/v3 v3.3.0/go.mod h1:bj2/e0l4jRnQdrnSTaGTsh4GSXvMjQcy41i7th0GVGw=
+github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
+github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
 github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA=
 github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI=
 github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
@@ -625,8 +618,8 @@ github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbd
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
@@ -637,10 +630,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -676,7 +667,6 @@ github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
 github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
 github.com/miekg/pkcs11 v1.0.3-0.20190429190417-a667d056470f/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
@@ -694,36 +684,29 @@ github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374
 github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
-github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/montanaflynn/stats v0.7.0 h1:r3y12KyNxj/Sb/iOE46ws+3mS1+MZca1wlHQFPsY/JU=
-github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
 github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
 github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY=
 github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/ohler55/ojg v1.26.8 h1:njM65m+ej8sLHiFZIhJK9UkwOmDPsUikjGbTgcwu8CU=
+github.com/ohler55/ojg v1.26.8/go.mod h1:/Y5dGWkekv9ocnUixuETqiL58f+5pAsUfg5P8e7Pa2o=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/okta/okta-sdk-golang/v2 v2.20.0 h1:EDKM+uOPfihOMNwgHMdno+NAsIfyXkVnoFAYVPay0YU=
@@ -732,10 +715,12 @@ github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
 github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/openai/openai-go v1.8.2 h1:UqSkJ1vCOPUpz9Ka5tS0324EJFEuOvMc+lA/EarJWP8=
+github.com/openai/openai-go v1.8.2/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/oracle/oci-go-sdk/v65 v65.89.3 h1:KSUykb5Ou54jF4SeJNjBwcDg+umbAwcvT+xhrvNDog0=
@@ -763,12 +748,13 @@ github.com/pingcap/tidb/pkg/parser v0.0.0-20240930120915-74034d4ac243/go.mod h1:
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
+github.com/pkoukk/tiktoken-go v0.1.8 h1:85ENo+3FpWgAACBaEUVp+lctuTcYUO7BtmfhlN/QTRo=
+github.com/pkoukk/tiktoken-go v0.1.8/go.mod h1:9NiV+i9mJKGj1rYOT+njbv+ZwA/zJxYdewGl6qVatpg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -776,26 +762,20 @@ github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
-github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/quic-go/quic-go v0.51.0 h1:K8exxe9zXxeRKxaXxi/GpUqYiTrtdiWP8bo1KFya6Wc=
-github.com/quic-go/quic-go v0.51.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -804,8 +784,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
-github.com/rubenv/sql-migrate v1.7.1 h1:f/o0WgfO/GqNuVg+6801K/KW3WdDSupzSjDYODmiUq4=
-github.com/rubenv/sql-migrate v1.7.1/go.mod h1:Ob2Psprc0/3ggbM6wCzyYVFFuc6FyZrb2AS+ezLDFb4=
+github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2Ns0o=
+github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
 github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
 github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
 github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
@@ -816,6 +796,8 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
 github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
 github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
 github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
@@ -824,8 +806,8 @@ github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQ
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/scim2/filter-parser/v2 v2.2.0 h1:QGadEcsmypxg8gYChRSM2j1edLyE/2j72j+hdmI4BJM=
 github.com/scim2/filter-parser/v2 v2.2.0/go.mod h1:jWnkDToqX/Y0ugz0P5VvpVEUKcWcyHHj+X+je9ce5JA=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0 h1:rf1HIbL64nUpEIZnjLZ3mcNEL9NBPB0iuVjyxvq3LZc=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0/go.mod h1:DVHKMcZ+V4/woA/peqr+L0joiRXbPpQ042GgJckkFgw=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/sethvargo/go-limiter v1.0.0 h1:JqW13eWEMn0VFv86OKn8wiYJY/m250WoXdrjRV0kLe4=
@@ -838,27 +820,26 @@ github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8
 github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
 github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 h1:oI+RNwuC9jF2g2lP0u0cVEEZrc/AYBCuFdvwrLWM/6Q=
 github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07/go.mod h1:yFdBgwXP24JziuRl2NMUahT7nGLNOKi1SIiFxMttVD4=
-github.com/sigstore/protobuf-specs v0.4.1 h1:5SsMqZbdkcO/DNHudaxuCUEjj6x29tS2Xby1BxGU7Zc=
-github.com/sigstore/protobuf-specs v0.4.1/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
-github.com/sigstore/rekor v1.3.9 h1:sUjRpKVh/hhgqGMs0t+TubgYsksArZ6poLEC3MsGAzU=
-github.com/sigstore/rekor v1.3.9/go.mod h1:xThNUhm6eNEmkJ/SiU/FVU7pLY2f380fSDZFsdDWlcM=
-github.com/sigstore/sigstore v1.9.4 h1:64+OGed80+A4mRlNzRd055vFcgBeDghjZw24rPLZgDU=
-github.com/sigstore/sigstore v1.9.4/go.mod h1:Q7tGTC3gbtK7c3jcxEmGc2MmK4rRpIRzi3bxRFWKvEY=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/rekor v1.4.1 h1:KK3McuHnptIE9mdNlrc9qh/OVE0AXf4rnScMxJE6xH4=
+github.com/sigstore/rekor v1.4.1/go.mod h1:/McBsz/vrtfi4EInxSIk/MGbDXzgv2+1FQUg1R/uSnE=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
 github.com/sigstore/sigstore-go v0.7.1 h1:lyzi3AjO6+BHc5zCf9fniycqPYOt3RaC08M/FRmQhVY=
 github.com/sigstore/sigstore-go v0.7.1/go.mod h1:AIRj4I3LC82qd07VFm3T2zXYiddxeBV1k/eoS8nTz0E=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1 h1:/YcNq687WnXpIRXl04nLfJX741G4iW+w+7Nem2Zy0f4=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1/go.mod h1:ApL9RpKsi7gkSYN0bMNdm/3jZ9EefxMmfYHfUmq2ZYM=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1 h1:FnusXyTIInnwfIOzzl5PFilRm1I97dxMSOcCkZBu9Kc=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1/go.mod h1:d5m5LOa/69a+t2YC9pDPwS1n2i/PhqB4cUKbpVDlKKE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1 h1:LFiYK1DEWQ6Hf/nroFzBMM+s5rVSjVL45Alpb5Ctl5A=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1/go.mod h1:GFyFmDsE2wDuIHZD+4+JErGpA0S4zJsKNz5l2JVJd8s=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1 h1:sIW6xe4yU5eIMH8fve2C78d+r29KmHnIb+7po+80bsY=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1/go.mod h1:3pNf99GnK9eu3XUa5ebHzgEQSVYf9hqAoPFwbwD6O6M=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5 h1:qp2VFyKuFQvTGmZwk5Q7m5nE4NwnF9tHwkyz0gtWAck=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5/go.mod h1:DKlQjjr+GsWljEYPycI0Sf8URLCk4EbGA9qYjF47j4g=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5 h1:CRZcdYn5AOptStsLRAAACudAVmb1qUbhMlzrvm7ju3o=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5/go.mod h1:b9rFfITq2fp1M3oJmq6lFFhSrAz5vOEJH1qzbMsZWN4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3 h1:a7Yz8C0aBa/LjeiTa9ZLYi9B74GNhFRnUIUdvN6ddVk=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3/go.mod h1:tRtJzSZ48MXJV9bmS8pkb3mP36PCad/Cs+BmVJ3Z4O4=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5 h1:S2ukEfN1orLKw2wEQIUHDDlzk0YcylhcheeZ5TGk8LI=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5/go.mod h1:m7sQxVJmDa+rsmS1m6biQxaLX83pzNS7ThUEyjOqkCU=
 github.com/sigstore/timestamp-authority v1.2.5 h1:W22JmwRv1Salr/NFFuP7iJuhytcZszQjldoB8GiEdnw=
 github.com/sigstore/timestamp-authority v1.2.5/go.mod h1:gWPKWq4HMWgPCETre0AakgBzcr9DRqHrsgbrRqsigOs=
 github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
 github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
@@ -871,14 +852,14 @@ github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
 github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -893,8 +874,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
@@ -903,6 +884,16 @@ github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qv
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
 github.com/theupdateframework/go-tuf/v2 v2.0.2 h1:PyNnjV9BJNzN1ZE6BcWK+5JbF+if370jjzO84SS+Ebo=
 github.com/theupdateframework/go-tuf/v2 v2.0.2/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
@@ -921,13 +912,6 @@ github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
 github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -937,65 +921,84 @@ github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfS
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 h1:hlE8//ciYMztlGpl/VA+Zm1AcTPHYkHJPbHqE6WJUXE=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f h1:ERexzlUfuTvpE74urLSbIQW0Z/6hF9t8U4NsJLaioAY=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
 github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
 github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
 github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
 github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 github.com/zitadel/logging v0.6.2 h1:MW2kDDR0ieQynPZ0KIZPrh9ote2WkxfBif5QoARDQcU=
 github.com/zitadel/logging v0.6.2/go.mod h1:z6VWLWUkJpnNVDSLzrPSQSQyttysKZ6bCRongw0ROK4=
-github.com/zitadel/oidc/v3 v3.38.1 h1:VTf1Bv/33UbSwJnIWbfEIdpUGYKfoHetuBNIqVTcjvA=
-github.com/zitadel/oidc/v3 v3.38.1/go.mod h1:muukzAasaWmn3vBwEVMglJfuTE0PKCvLJGombPwXIRw=
+github.com/zitadel/oidc/v3 v3.43.0 h1:LokviPoiTNNPbIAMO/eb6Kq9PNWPWp0mA1oWtdLc+Qs=
+github.com/zitadel/oidc/v3 v3.43.0/go.mod h1:5ki8s9CWoB4iGmtULndiVxwM8xt7IylZIaudro7jEq4=
 github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
 github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
 gitlab.com/gitlab-org/api/client-go v0.127.0 h1:8xnxcNKGF2gDazEoMs+hOZfOspSSw8D0vAoWhQk9U+U=
 gitlab.com/gitlab-org/api/client-go v0.127.0/go.mod h1:bYC6fPORKSmtuPRyD9Z2rtbAjE7UeNatu2VWHRf4/LE=
-go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
-go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
-go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI=
-go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc=
-go.step.sm/crypto v0.60.0 h1:UgSw8DFG5xUOGB3GUID17UA32G4j1iNQ4qoMhBmsVFw=
-go.step.sm/crypto v0.60.0/go.mod h1:Ep83Lv818L4gV0vhFTdPWRKnL6/5fRMpi8SaoP5ArSw=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGhfnFe5lwB0ic1JBVjzhk0w=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7ZSD+5yn+lo3sGV69nW04rRR0jhYnBwjuX3r0HvnK0=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0/go.mod h1:QyjcV9qDP6VeK5qPyKETvNjmaaEc7+gqjh4SS0ZYzDU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0/go.mod h1:zKU4zUgKiaRxrdovSS2amdM5gOc59slmo/zJwGX+YBg=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.32.0 h1:SZmDnHcgp3zwlPBS2JX2urGYe/jBKEIT6ZedHRUyCz8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.32.0/go.mod h1:fdWW0HtZJ7+jNpTKUR0GpMEDP69nR8YBJQxNiVCE3jk=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsux7Qmq8ToKAx1XCilTQECZ0KDZyTw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
+go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
+go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
+go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.step.sm/crypto v0.70.0 h1:Q9Ft7N637mucyZcHZd1+0VVQJVwDCKqcb9CYcYi7cds=
+go.step.sm/crypto v0.70.0/go.mod h1:pzfUhS5/ue7ev64PLlEgXvhx1opwbhFCjkvlhsxVds0=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -1003,19 +1006,17 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1026,25 +1027,20 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1060,53 +1056,55 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.230.0 h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM=
-google.golang.org/api v0.230.0/go.mod h1:aqvtoMk7YkiXx+6U12arQFExiRV9D/ekvMCwCd/TksQ=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 h1:0PeQib/pH3nB/5pEmFeVQJotzGohV0dq4Vcp09H5yhE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34/go.mod h1:0awUlEkap+Pb1UMeJwJQQAdJQrt3moU7J2moTy69irI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 h1:h6p3mQqrmT1XkHVTfzLdNz1u7IhINeZkz67/xTbOuWs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -1120,7 +1118,6 @@ gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
@@ -1129,36 +1126,34 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
-helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
-k8s.io/api v0.33.0 h1:yTgZVn1XEe6opVpP1FylmNrIFWuDqe2H0V8CT5gxfIU=
-k8s.io/api v0.33.0/go.mod h1:CTO61ECK/KU7haa3qq8sarQ0biLq2ju405IZAd9zsiM=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
-k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.0 h1:QqcM6c+qEEjkOODHppFXRiw/cE2zP85704YrQ9YaBbc=
-k8s.io/apiserver v0.33.0/go.mod h1:EixYOit0YTxt8zrO2kBU7ixAtxFce9gKGq367nFmqI8=
-k8s.io/cli-runtime v0.33.0 h1:Lbl/pq/1o8BaIuyn+aVLdEPHVN665tBAXUePs8wjX7c=
-k8s.io/cli-runtime v0.33.0/go.mod h1:QcA+r43HeUM9jXFJx7A+yiTPfCooau/iCcP1wQh4NFw=
-k8s.io/client-go v0.33.0 h1:UASR0sAYVUzs2kYuKn/ZakZlcs2bEHaizrrHUZg0G98=
-k8s.io/client-go v0.33.0/go.mod h1:kGkd+l/gNGg8GYWAPr0xF1rRKvVWvzh9vmZAMXtaKOg=
-k8s.io/component-base v0.33.0 h1:Ot4PyJI+0JAD9covDhwLp9UNkUja209OzsJ4FzScBNk=
-k8s.io/component-base v0.33.0/go.mod h1:aXYZLbw3kihdkOPMDhWbjGCO6sg+luw554KP51t8qCU=
+helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
+helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
+k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.0 h1:HiRb1yqibBSCqic4pRZP+viiOBAnIdwYDpzUFejs07g=
-k8s.io/kubectl v0.33.0/go.mod h1:gAlGBuS1Jq1fYZ9AjGWbI/5Vk3M/VW2DK4g10Fpyn/0=
+k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
+k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg=
 mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8=
-oras.land/oras-go v1.2.5 h1:XpYuAwAb0DfQsunIyMfeET92emK8km3W4yEzZvUbsTo=
-oras.land/oras-go v1.2.5/go.mod h1:PuAwRShRZCsZb7g8Ar3jKKQR/2A/qN+pkYxIOd/FAoo=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
 sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
 sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
@@ -1172,7 +1167,8 @@ sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
 software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/integrations/event-handler/legacy_events_watcher.go b/integrations/event-handler/legacy_events_watcher.go
index 0bc48f13f43e6..98182fb66155e 100644
--- a/integrations/event-handler/legacy_events_watcher.go
+++ b/integrations/event-handler/legacy_events_watcher.go
@@ -278,7 +278,7 @@ func (t *LegacyEventsWatcher) getEventsInWindow(ctx context.Context, from, to ti
 		from,
 		to,
 		"default",
-		t.config.Types,
+		t.config.TypesRaw,
 		t.config.BatchSize,
 		types.EventOrderAscending,
 		t.cursor,
diff --git a/integrations/event-handler/session_events_job.go b/integrations/event-handler/session_events_job.go
index e462345cf3a86..66a1a31a3d2e5 100644
--- a/integrations/event-handler/session_events_job.go
+++ b/integrations/event-handler/session_events_job.go
@@ -16,7 +16,6 @@ package main
 
 import (
 	"context"
-	"log/slog"
 	"sync/atomic"
 	"time"
 
@@ -47,6 +46,10 @@ type session struct {
 	UploadTime time.Time
 }
 
+// processSessionFunc mimics the signature of
+// [SessionEventsJob.processSession].
+type processSessionFunc func(ctx context.Context, s session, processingAttempt int) error
+
 // SessionEventsJob incapsulates session events consumption logic
 type SessionEventsJob struct {
 	lib.ServiceJob
@@ -56,6 +59,7 @@ type SessionEventsJob struct {
 	logLimiter             *rate.Limiter
 	backpressureLogLimiter *rate.Limiter
 	sessionsProcessed      atomic.Uint64
+	processSessionFunc     processSessionFunc
 }
 
 // NewSessionEventsJob creates new EventsJob structure
@@ -68,6 +72,7 @@ func NewSessionEventsJob(app *App) *SessionEventsJob {
 		backpressureLogLimiter: rate.NewLimiter(rate.Every(time.Minute), 1),
 	}
 
+	j.processSessionFunc = j.processSession
 	j.ServiceJob = lib.NewServiceJob(j.run)
 
 	return j
@@ -110,33 +115,9 @@ func (j *SessionEventsJob) run(ctx context.Context) error {
 	for {
 		select {
 		case s := <-j.sessions:
-			log := j.app.log.With(
-				"id", s.ID,
-				"index", s.Index,
-			)
-
-			if j.logLimiter.Allow() {
-				log.DebugContext(ctx, "Starting session ingest")
-			}
-
-			select {
-			case j.semaphore <- struct{}{}:
-			case <-ctx.Done():
-				log.ErrorContext(ctx, "Failed to acquire semaphore", "error", ctx.Err())
-				return nil
+			if err := j.ingestSession(ctx, s, 0, nil); err != nil {
+				j.app.log.WarnContext(ctx, "Unable to ingest session event", "error", err)
 			}
-
-			func(s session, log *slog.Logger) {
-				j.app.SpawnCritical(func(ctx context.Context) error {
-					defer func() { <-j.semaphore }()
-
-					if err := j.processSession(ctx, s, 0); err != nil {
-						return trace.Wrap(err)
-					}
-
-					return nil
-				})
-			}(s, log)
 		case <-ctx.Done():
 			if lib.IsCanceled(ctx.Err()) {
 				return nil
@@ -146,6 +127,35 @@ func (j *SessionEventsJob) run(ctx context.Context) error {
 	}
 }
 
+func (j *SessionEventsJob) ingestSession(ctx context.Context, s session, attempt int, semaphore chan struct{}) error {
+	log := j.app.log.With(
+		"id", s.ID,
+		"index", s.Index,
+	)
+	if j.logLimiter.Allow() {
+		log.DebugContext(ctx, "Starting session ingest")
+	}
+
+	if semaphore == nil {
+		semaphore = j.semaphore
+	}
+	select {
+	case semaphore <- struct{}{}:
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	}
+
+	go func() {
+		defer func() { <-semaphore }()
+
+		if err := j.processSessionFunc(ctx, s, attempt); err != nil {
+			log.ErrorContext(ctx, "Failed processing session recording", "error", err)
+		}
+	}()
+
+	return nil
+}
+
 func (j *SessionEventsJob) processSession(ctx context.Context, s session, processingAttempt int) error {
 	const (
 		// maxNumberOfProcessingAttempts is the number of times a non-existent
@@ -228,9 +238,8 @@ func (j *SessionEventsJob) processSession(ctx context.Context, s session, proces
 // from session recordings that were previously not found.
 func (j *SessionEventsJob) processMissingRecordings(ctx context.Context) error {
 	const (
-		initialProcessingDelay      = time.Minute
-		processingInterval          = 3 * time.Minute
-		maxNumberOfInflightSessions = 10
+		initialProcessingDelay = time.Minute
+		processingInterval     = 3 * time.Minute
 	)
 
 	ctx, cancel := context.WithCancel(ctx)
@@ -243,7 +252,6 @@ func (j *SessionEventsJob) processMissingRecordings(ctx context.Context) error {
 	timer := time.NewTimer(jitter(initialProcessingDelay))
 	defer timer.Stop()
 
-	semaphore := make(chan struct{}, maxNumberOfInflightSessions)
 	for {
 		select {
 		case <-timer.C:
@@ -252,21 +260,9 @@ func (j *SessionEventsJob) processMissingRecordings(ctx context.Context) error {
 		}
 
 		err := j.app.State.IterateMissingRecordings(func(sess session, attempts int) error {
-			select {
-			case semaphore <- struct{}{}:
-			case <-ctx.Done():
-				return trace.Wrap(ctx.Err())
-			}
+			semaphore := make(chan struct{}, j.app.Config.Concurrency*2)
 
-			go func() {
-				defer func() { <-semaphore }()
-
-				if err := j.processSession(ctx, sess, attempts); err != nil {
-					j.app.log.DebugContext(ctx, "Failed processing session recording", "error", err)
-				}
-			}()
-
-			return nil
+			return j.ingestSession(ctx, sess, attempts, semaphore)
 		})
 		if err != nil && !lib.IsCanceled(err) {
 			j.app.log.WarnContext(ctx, "Unable to load previously failed sessions for processing", "error", err)
diff --git a/integrations/event-handler/session_events_job_test.go b/integrations/event-handler/session_events_job_test.go
index 79ec5bd497dec..4c92d63639702 100644
--- a/integrations/event-handler/session_events_job_test.go
+++ b/integrations/event-handler/session_events_job_test.go
@@ -15,15 +15,19 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"log/slog"
 	"testing"
+	"time"
 
+	"github.com/gravitational/trace"
 	"github.com/peterbourgon/diskv/v3"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client"
 	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 // TestConsumeSessionNoEventsFound tests that the consumeSession method returns without error
@@ -40,10 +44,54 @@ func TestConsumeSessionNoEventsFound(t *testing.T) {
 		client: &mockClient{},
 		log:    slog.Default(),
 	})
-	_, err := j.consumeSession(context.Background(), session{ID: sessionID})
+	_, err := j.consumeSession(t.Context(), session{ID: sessionID})
 	require.NoError(t, err)
 }
 
+// TestIngestSession tests that the ingestSession method returns without error if a malformed
+// session event is processed.
+func TestIngestSession(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		startTime := time.Now().Add(-time.Minute)
+		out := &bytes.Buffer{}
+		log := slog.New(slog.NewTextHandler(out, &slog.HandlerOptions{Level: slog.LevelError}))
+
+		j := NewSessionEventsJob(&App{
+			Config: &StartCmdConfig{
+				IngestConfig: IngestConfig{
+					StorageDir:       t.TempDir(),
+					Timeout:          time.Second,
+					BatchSize:        100,
+					Concurrency:      5,
+					StartTime:        &startTime,
+					SkipSessionTypes: map[string]struct{}{"print": {}, "desktop.recording": {}},
+					WindowSize:       time.Hour * 24,
+					DryRun:           true,
+				},
+			},
+			State: &State{
+				dv: diskv.New(diskv.Options{
+					BasePath: t.TempDir(),
+				}),
+			},
+			client: &mockClient{},
+			log:    log,
+		})
+
+		j.processSessionFunc = func(ctx context.Context, s session, processingAttempt int) error {
+			return trace.LimitExceeded("Session ingestion exceeded attempt limit")
+		}
+
+		err := j.ingestSession(t.Context(), session{ID: "test"}, 0, nil)
+		require.NoError(t, err)
+
+		synctest.Wait()
+
+		require.Contains(t, out.String(), "Failed processing session recording")
+		require.Contains(t, out.String(), "Session ingestion exceeded attempt limit")
+	})
+}
+
 type mockClient struct {
 	client.Client
 }
diff --git a/integrations/event-handler/teleport_event.go b/integrations/event-handler/teleport_event.go
index bb094eb0fb716..6c613c3097753 100644
--- a/integrations/event-handler/teleport_event.go
+++ b/integrations/event-handler/teleport_event.go
@@ -77,18 +77,18 @@ func NewTeleportEvent(e *auditlogpb.EventUnstructured) (*TeleportEvent, error) {
 		return nil, trace.Wrap(err)
 	}
 	evt := &TeleportEvent{
+		Event: payload,
+		ID:    e.Id,
 		Type:  e.GetType(),
 		Time:  e.Time.AsTime(),
 		Index: e.GetIndex(),
-		ID:    e.Id,
-		Event: payload,
 	}
 
-	switch e.GetType() {
+	switch evt.Type {
 	case sessionEndType:
-		err = evt.setSessionID(e)
+		err = evt.setSessionID()
 	case loginType:
-		err = evt.setLoginData(e)
+		err = evt.setLoginData()
 	}
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -111,7 +111,7 @@ func NewLegacyTeleportEvent(e *auditlogpb.EventUnstructured, cursor string, wind
 }
 
 // setSessionID sets session id for session end event
-func (e *TeleportEvent) setSessionID(evt *auditlogpb.EventUnstructured) error {
+func (e *TeleportEvent) setSessionID() error {
 	sessionUploadEvt := &events.SessionUpload{}
 	if err := json.Unmarshal(e.Event, sessionUploadEvt); err != nil {
 		return trace.Wrap(err)
@@ -124,8 +124,8 @@ func (e *TeleportEvent) setSessionID(evt *auditlogpb.EventUnstructured) error {
 	return nil
 }
 
-// setLoginValues sets values related to login event
-func (e *TeleportEvent) setLoginData(evt *auditlogpb.EventUnstructured) error {
+// setLoginData sets values related to login event
+func (e *TeleportEvent) setLoginData() error {
 	loginEvent := &events.UserLogin{}
 	if err := json.Unmarshal(e.Event, loginEvent); err != nil {
 		return trace.Wrap(err)
diff --git a/integrations/kube-agent-updater/Dockerfile b/integrations/kube-agent-updater/Dockerfile
index 853be7169bde8..77ef6fee16e6d 100644
--- a/integrations/kube-agent-updater/Dockerfile
+++ b/integrations/kube-agent-updater/Dockerfile
@@ -2,7 +2,7 @@ ARG BUILDBOX
 ARG BASE_IMAGE=gcr.io/distroless/static-debian12
 
 # BUILDPLATFORM is provided by Docker/buildx
-FROM --platform=$BUILDPLATFORM $BUILDBOX as builder
+FROM --platform=$BUILDPLATFORM $BUILDBOX AS builder
 
 WORKDIR /go/src/github.com/gravitational/teleport/integrations/kube-agent-updater
 
@@ -17,6 +17,7 @@ RUN go mod download
 
 # Copy in code
 COPY lib/ lib/
+COPY entitlements/ entitlements/
 COPY *.go ./
 COPY integrations/kube-agent-updater/ integrations/kube-agent-updater/
 
@@ -30,7 +31,8 @@ RUN echo "Targeting $TARGETOS/$TARGETARCH" && \
 
 # Create the image with the build operator on the $TARGETPLATFORM
 # TARGETPLATFORM is provided by Docker/buildx
-FROM --platform=$TARGETPLATFORM $BASE_IMAGE
+# --platform=${TARGETPLATFORM} is set by default and the docker linter complains if we set it.
+FROM $BASE_IMAGE
 WORKDIR /
 COPY --from=builder /go/bin/teleport-kube-agent-updater .
 
diff --git a/integrations/kube-agent-updater/Makefile b/integrations/kube-agent-updater/Makefile
index 207649628aced..c12a2ad0566ae 100644
--- a/integrations/kube-agent-updater/Makefile
+++ b/integrations/kube-agent-updater/Makefile
@@ -10,7 +10,7 @@ ARCH ?= $(shell go env GOARCH)
 
 .PHONY: test
 test: pkg/img/cosign_fixtures_test.go
-	go test ./...
+	gotestsum --junitfile unit-tests-kube-agent-updater.xml --jsonfile unit-tests-kube-agent-updater.json
 
 .PHONY: docker-build
 docker-build: ## Build docker image
diff --git a/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go b/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
index aef3c90d309d2..fe60e3124bd14 100644
--- a/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
+++ b/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
@@ -19,6 +19,7 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log/slog"
@@ -29,9 +30,12 @@ import (
 
 	"github.com/distribution/reference"
 	"github.com/go-logr/logr"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -39,6 +43,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
 	"github.com/gravitational/teleport/api/client/webclient"
@@ -48,12 +53,11 @@ import (
 	podmaintenance "github.com/gravitational/teleport/integrations/kube-agent-updater/pkg/maintenance"
 	"github.com/gravitational/teleport/lib/automaticupgrades/maintenance"
 	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+	"github.com/gravitational/teleport/lib/autoupdate/agent"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
-var (
-	scheme = runtime.NewScheme()
-)
+var scheme = runtime.NewScheme()
 
 func init() {
 	utilruntime.Must(appsv1.AddToScheme(scheme))
@@ -66,7 +70,7 @@ func main() {
 	ctx := ctrl.SetupSignalHandler()
 
 	// Setup early logger, using INFO level by default.
-	slogLogger, slogLeveler, err := logutils.Initialize(logutils.Config{
+	slogLogger, slogLeveler, _, err := logutils.Initialize(logutils.Config{
 		Severity:    slog.LevelInfo.String(),
 		Format:      "json",
 		ExtraFields: extraFields,
@@ -166,6 +170,20 @@ func main() {
 		os.Exit(1)
 	}
 
+	// The updater is only designed to work with a single deployment or statefulset.
+	// Pre-fetch the ID if it already exists, so that we can use it to lookup versions.
+	// This logic could be moved into the reconciler, but it would require refactoring
+	// all version getter implementations to accept an ID dynamically in GetVersion.
+	updateID, err := getUpdateID(ctx, mgr, kclient.ObjectKey{
+		Namespace: agentNamespace,
+		Name:      agentName + "-updater",
+	})
+	if err != nil {
+		ctrl.Log.Error(err, "failed to get updater ID, exiting")
+		os.Exit(1)
+	}
+	ctrl.Log.Info("update ID and group are set", "update_id", updateID, "update_group", updateGroup)
+
 	// Craft the version getter and update triggers based on the configuration (use RFD-109 APIs, RFD-184, or both).
 	var criticalUpdateTriggers []maintenance.Trigger
 	var plannedMaintenanceTriggers []maintenance.Trigger
@@ -180,6 +198,7 @@ func main() {
 			Context:     ctx,
 			ProxyAddr:   proxyAddress,
 			UpdateGroup: updateGroup,
+			UpdateID:    updateID.String(),
 		})
 		if err != nil {
 			ctrl.Log.Error(err, "failed to create proxy client, exiting")
@@ -282,9 +301,18 @@ func main() {
 		baseImage,
 	)
 
+	statusWriter := controller.StatusWriter{
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		UpdateID:     updateID,
+		UpdateGroup:  updateGroup,
+		ProxyAddress: proxyAddress,
+	}
+
 	// Controller registration
 	deploymentController := controller.DeploymentVersionUpdater{
 		VersionUpdater: versionUpdater,
+		StatusWriter:   statusWriter,
 		Client:         mgr.GetClient(),
 		Scheme:         mgr.GetScheme(),
 	}
@@ -296,6 +324,7 @@ func main() {
 
 	statefulsetController := controller.StatefulSetVersionUpdater{
 		VersionUpdater: versionUpdater,
+		StatusWriter:   statusWriter,
 		Client:         mgr.GetClient(),
 		Scheme:         mgr.GetScheme(),
 	}
@@ -321,3 +350,47 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+// getUpdateID returns the update ID from the updater configmap, creating it if it does not exist.
+func getUpdateID(ctx context.Context, mgr manager.Manager, ref kclient.ObjectKey) (uuid.UUID, error) {
+	// This should always succeed after two tries, as a conflict between read/create
+	// will always be resolved on the final read.
+	for range 2 {
+		var updateID uuid.UUID
+		var updateYAML v1.ConfigMap
+		err := mgr.GetAPIReader().Get(ctx, ref, &updateYAML)
+		if apierrors.IsNotFound(err) {
+			updateID, err = uuid.NewRandom()
+			if err != nil {
+				return uuid.Nil, trace.Wrap(err, "failed to generate updater ID")
+			}
+			updateYAML = v1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: ref.Namespace,
+					Name:      ref.Name,
+				},
+				Data: map[string]string{
+					agent.BinaryName + ".id": updateID.String(),
+				},
+			}
+			if err = mgr.GetClient().Create(ctx, &updateYAML); err != nil {
+				if apierrors.IsAlreadyExists(err) {
+					ctrl.Log.Info("retrying updater configmap read due to conflict")
+					continue
+				}
+				return uuid.Nil, trace.Wrap(err, "failed to persist updater configmap")
+			}
+			ctrl.Log.Info("generated new updater ID", "id", updateID)
+			return updateID, nil
+		}
+		if err != nil {
+			return uuid.Nil, trace.Wrap(err, "failed to retrieve updater configmap")
+		}
+		updateID, err = uuid.Parse(updateYAML.Data[agent.BinaryName+".id"])
+		if err != nil {
+			ctrl.Log.Error(err, "updater configmap is malformed, canary deployment may fail", "configmap", updateYAML)
+		}
+		return updateID, nil // proceed with empty UUID instead of crashing or deleting user data
+	}
+	return uuid.Nil, trace.Errorf("failing due to multiple conflicts")
+}
diff --git a/integrations/kube-agent-updater/pkg/controller/deployment.go b/integrations/kube-agent-updater/pkg/controller/deployment.go
index 5904c1f0cf929..ecf5aeac3786d 100644
--- a/integrations/kube-agent-updater/pkg/controller/deployment.go
+++ b/integrations/kube-agent-updater/pkg/controller/deployment.go
@@ -36,6 +36,7 @@ import (
 // DeploymentVersionUpdater Reconciles a podSpec by changing its image
 type DeploymentVersionUpdater struct {
 	VersionUpdater
+	StatusWriter
 	kclient.Client
 	Scheme *runtime.Scheme
 }
@@ -73,6 +74,10 @@ func (r *DeploymentVersionUpdater) Reconcile(ctx context.Context, req ctrl.Reque
 			log.Info("Teleport container found, but failed to get version from the img tag. Will continue and do a version update.")
 		default:
 			log.Error(err, "Unexpected error, not updating.")
+			if err := r.writeStatus(ctx, &obj, "", true); err != nil {
+				// If this fails, keep trying to ensure the pod starts.
+				return ctrl.Result{}, trace.Wrap(err)
+			}
 			return requeueLater, nil
 		}
 	}
@@ -87,17 +92,29 @@ func (r *DeploymentVersionUpdater) Reconcile(ctx context.Context, req ctrl.Reque
 	case errors.As(err, &noNewVersionErr):
 		// Error contains the detected versions
 		log.Info("Deployment is already up-to-date, not updating.", "err", err)
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), false); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case errors.As(err, &maintenanceErr):
 		// Not logging the error because it provides no other information than its type.
 		log.Info("No maintenance triggered, not updating.", "currentVersion", currentVersion)
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), false); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case errors.As(err, &trustErr):
 		// Logging as error as image verification should not fail under normal use
 		log.Error(trustErr.OrigError(), "Image verification failed, not updating.")
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case err != nil:
 		log.Error(err, "Unexpected error, not updating.")
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	}
 
@@ -105,6 +122,9 @@ func (r *DeploymentVersionUpdater) Reconcile(ctx context.Context, req ctrl.Reque
 	err = setContainerImageFromPodSpec(&obj.Spec.Template.Spec, teleportContainerName, image.String())
 	if err != nil {
 		log.Error(err, "Unexpected error, not updating.")
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	}
 
@@ -112,6 +132,11 @@ func (r *DeploymentVersionUpdater) Reconcile(ctx context.Context, req ctrl.Reque
 		log.Error(err, "Unexpected error, not updating.")
 		return requeueNow, nil
 	}
+	// If this fails on conflict, the next call to writeStatus will detect the version change
+	// and record the update as successful.
+	if err := r.writeStatus(ctx, &obj, image.Tag(), false); err != nil {
+		return ctrl.Result{}, trace.Wrap(err)
+	}
 	return requeueLater, nil
 }
 
diff --git a/integrations/kube-agent-updater/pkg/controller/statefulset.go b/integrations/kube-agent-updater/pkg/controller/statefulset.go
index b1f9107c60cee..5f098bd504594 100644
--- a/integrations/kube-agent-updater/pkg/controller/statefulset.go
+++ b/integrations/kube-agent-updater/pkg/controller/statefulset.go
@@ -39,6 +39,7 @@ import (
 
 type StatefulSetVersionUpdater struct {
 	VersionUpdater
+	StatusWriter
 	kclient.Client
 	Scheme *runtime.Scheme
 }
@@ -96,6 +97,12 @@ func (r *StatefulSetVersionUpdater) Reconcile(ctx context.Context, req ctrl.Requ
 			log.Info("Teleport container found, but failed to get version from the img tag. Will continue and do a version update.")
 		default:
 			log.Error(err, "Unexpected error, not updating.")
+			// Update the status (including timestamp) and each failed attempt.
+			// This also ensures that pods can still mount the configmap when the updater is failing.
+			if err := r.writeStatus(ctx, &obj, "", true); err != nil {
+				// If this fails, keep trying to ensure the pod starts.
+				return ctrl.Result{}, trace.Wrap(err)
+			}
 			return requeueLater, nil
 		}
 	}
@@ -113,12 +120,18 @@ func (r *StatefulSetVersionUpdater) Reconcile(ctx context.Context, req ctrl.Requ
 		if err := r.unblockStatefulSetRolloutIfStuck(ctx, &obj); err != nil {
 			log.Error(err, "statefulset unblocking failed, the rollout might get stuck")
 		}
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), false); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case errors.As(err, &maintenanceErr):
 		// Not logging the error because it provides no other information than its type.
 		log.Info("No maintenance triggered, not updating.", "currentVersion", currentVersion)
 		// No need to check for blocked rollout because the unhealthy workload
 		// trigger has not approved the maintenance
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), false); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case errors.As(err, &trustErr):
 		// Logging as error as image verification should not fail under normal use
@@ -126,11 +139,17 @@ func (r *StatefulSetVersionUpdater) Reconcile(ctx context.Context, req ctrl.Requ
 		if err := r.unblockStatefulSetRolloutIfStuck(ctx, &obj); err != nil {
 			log.Error(err, "statefulset unblocking failed, the rollout might get stuck")
 		}
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	case err != nil:
 		log.Error(err, "Unexpected error, not updating.")
 		// Not trying to unblock a stuck rollout because unknown error typically
 		// lead to infinite reconciliations, we don't want to DoS the apiserver
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	}
 
@@ -138,16 +157,28 @@ func (r *StatefulSetVersionUpdater) Reconcile(ctx context.Context, req ctrl.Requ
 	err = setContainerImageFromPodSpec(&obj.Spec.Template.Spec, teleportContainerName, image.String())
 	if err != nil {
 		log.Error(err, "Unexpected error, not updating.")
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueLater, nil
 	}
 
 	if err = r.Update(ctx, &obj); err != nil {
 		log.Error(err, "Unexpected error, not updating.")
+		if err := r.writeStatus(ctx, &obj, currentVersion.String(), true); err != nil {
+			return ctrl.Result{}, trace.Wrap(err)
+		}
 		return requeueNow, nil
 	}
 	if err := r.unblockStatefulSetRolloutIfStuck(ctx, &obj); err != nil {
 		log.Error(err, "statefulset unblocking failed, the rollout might get stuck")
 	}
+	// If this fails on conflict, the next call to writeStatus will detect the version change
+	// and record the update as successful.
+	if err := r.writeStatus(ctx, &obj, image.Tag(), false); err != nil {
+		return ctrl.Result{}, trace.Wrap(err)
+	}
+
 	return requeueLater, nil
 }
 
diff --git a/integrations/kube-agent-updater/pkg/controller/status_writer.go b/integrations/kube-agent-updater/pkg/controller/status_writer.go
new file mode 100644
index 0000000000000..3528141898a36
--- /dev/null
+++ b/integrations/kube-agent-updater/pkg/controller/status_writer.go
@@ -0,0 +1,135 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package controller
+
+import (
+	"context"
+	"path/filepath"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	ctrllog "sigs.k8s.io/controller-runtime/pkg/log"
+
+	"github.com/gravitational/teleport/lib/autoupdate/agent"
+)
+
+const updaterIDFile = agent.BinaryName + ".id"
+
+type StatusWriter struct {
+	kclient.Client
+	// Scheme for Kubernetes objects.
+	Scheme *runtime.Scheme
+	// UpdateID is the unique ID of the updater.
+	UpdateID uuid.UUID
+	// UpdateGroup is the group of the updater.
+	UpdateGroup string
+	// ProxyAddress is the address of the proxy.
+	ProxyAddress string
+}
+
+// writeStatus updates the configmap with the latest status of the updater.
+func (c *StatusWriter) writeStatus(ctx context.Context, owner metav1.Object, version string, failed bool) error {
+	log := ctrllog.FromContext(ctx)
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      owner.GetName() + "-updater",
+			Namespace: owner.GetNamespace(),
+		},
+	}
+	op, err := controllerutil.CreateOrUpdate(ctx, c.Client, cm, func() error {
+		if err := c.generateData(ctx, cm, version, failed, time.Now()); err != nil {
+			return trace.Wrap(err)
+		}
+		// Setting the owner ref ensures that the configmap is reset if the statefulset is deleted.
+		return controllerutil.SetOwnerReference(owner, cm, c.Scheme)
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	log.V(1).Info("updater configmap reconciled",
+		"name", cm.Name,
+		"namespace", owner.GetNamespace(),
+		"op", string(op),
+		"failed", failed,
+		"version", version,
+	)
+	return nil
+}
+
+// generateData generates the data for the configmap based on the provided version and failed flag.
+func (c *StatusWriter) generateData(ctx context.Context, cm *corev1.ConfigMap, version string, failed bool, updateTime time.Time) error {
+	log := ctrllog.FromContext(ctx)
+	spec := agent.UpdateSpec{
+		Enabled: true,
+		Proxy:   c.ProxyAddress,
+		Group:   c.UpdateGroup,
+	}
+
+	var config agent.UpdateConfig
+	switch s := cm.Data[agent.UpdateConfigName]; {
+	case len(s) > 0:
+		err := yaml.Unmarshal([]byte(s), &config)
+		// Update spec to match controller configuration
+		config.Spec = spec
+		if err == nil {
+			break
+		}
+		log.Error(err, "overwriting corrupted configmap data")
+		fallthrough
+	default:
+		config = agent.UpdateConfig{
+			Version: agent.UpdateConfigV1,
+			Kind:    agent.UpdateConfigKind,
+			Spec:    spec,
+			Status: agent.UpdateStatus{
+				IDFile: filepath.Join("/etc/updater-config", updaterIDFile),
+				Active: agent.Revision{
+					Version: version,
+					// TODO: add enterprise and FIPS flags
+				},
+			},
+		}
+	}
+	// Update the status if the update failed or if the version is present and different from the active one.
+	if failed ||
+		(version != "" && config.Status.Active.Version != version) {
+		config.Status.Active.Version = version
+		config.Status.LastUpdate = &agent.LastUpdate{
+			Success: !failed,
+			Time:    updateTime.UTC().Truncate(time.Millisecond),
+			// TODO: set target version for update, requires GetVersion refactor
+		}
+	}
+	out, err := yaml.Marshal(config)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	cm.Data = map[string]string{
+		updaterIDFile:          c.UpdateID.String(),
+		agent.UpdateConfigName: string(out),
+	}
+	return nil
+}
diff --git a/integrations/kube-agent-updater/pkg/controller/status_writer_test.go b/integrations/kube-agent-updater/pkg/controller/status_writer_test.go
new file mode 100644
index 0000000000000..f485d7c3e0a56
--- /dev/null
+++ b/integrations/kube-agent-updater/pkg/controller/status_writer_test.go
@@ -0,0 +1,184 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package controller
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/gravitational/teleport/lib/autoupdate/agent"
+)
+
+func TestGenerateData(t *testing.T) {
+	tests := []struct {
+		name           string
+		data           map[string]string
+		version        string
+		failed         bool
+		updateGroup    string
+		proxyAddress   string
+		expectedConfig string
+	}{
+		{
+			name:         "new configmap",
+			version:      "1.0.0",
+			updateGroup:  "test-group",
+			proxyAddress: "proxy.example.com",
+			expectedConfig: `version: v1
+kind: update_config
+spec:
+    proxy: proxy.example.com
+    path: ""
+    group: test-group
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    active:
+        version: 1.0.0
+`,
+		},
+		{
+			name: "success",
+			data: map[string]string{
+				updaterIDFile: "old",
+				agent.UpdateConfigName: `version: v1
+kind: update_config
+spec:
+    proxy: old-proxy.example.com
+    path: ""
+    group: test-group-old
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    active:
+       version: 0.9.0
+`,
+			},
+			version:      "1.0.0",
+			updateGroup:  "test-group",
+			proxyAddress: "proxy.example.com",
+			expectedConfig: `version: v1
+kind: update_config
+spec:
+    proxy: proxy.example.com
+    path: ""
+    group: test-group
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    last_update:
+        success: true
+        time: 1970-01-01T00:00:01Z
+        target:
+            version: ""
+    active:
+        version: 1.0.0
+`,
+		},
+		{
+			name: "failure",
+			data: map[string]string{
+				updaterIDFile: "old",
+				agent.UpdateConfigName: `version: v1
+kind: update_config
+spec:
+    proxy: proxy.example.com
+    path: ""
+    group: test-group
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    active:
+       version: 1.0.0
+`,
+			},
+			version:      "1.0.0",
+			failed:       true,
+			updateGroup:  "test-group",
+			proxyAddress: "proxy.example.com",
+			expectedConfig: `version: v1
+kind: update_config
+spec:
+    proxy: proxy.example.com
+    path: ""
+    group: test-group
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    last_update:
+        success: false
+        time: 1970-01-01T00:00:01Z
+        target:
+            version: ""
+    active:
+        version: 1.0.0
+`,
+		},
+		{
+			name: "invalid defaults",
+			data: map[string]string{
+				agent.UpdateConfigName: `bad`,
+			},
+			version:      "1.0.0",
+			updateGroup:  "test-group",
+			proxyAddress: "proxy.example.com",
+			expectedConfig: `version: v1
+kind: update_config
+spec:
+    proxy: proxy.example.com
+    path: ""
+    group: test-group
+    enabled: true
+    pinned: false
+status:
+    id_file: /etc/updater-config/teleport-update.id
+    active:
+        version: 1.0.0
+`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			sw := &StatusWriter{
+				UpdateID:     uuid.New(),
+				UpdateGroup:  tc.updateGroup,
+				ProxyAddress: tc.proxyAddress,
+			}
+			cm := &corev1.ConfigMap{
+				Data: tc.data,
+			}
+			updateTime := time.Unix(1, 0)
+			err := sw.generateData(t.Context(), cm, tc.version, tc.failed, updateTime)
+			require.NoError(t, err)
+			require.Len(t, cm.Data, 2)
+			require.Equal(t, tc.expectedConfig, cm.Data[agent.UpdateConfigName])
+			require.Equal(t, sw.UpdateID.String(), cm.Data[updaterIDFile])
+		})
+	}
+}
diff --git a/integrations/kube-agent-updater/pkg/controller/suite_test.go b/integrations/kube-agent-updater/pkg/controller/suite_test.go
index a7df8bbc0f745..79641046cecd8 100644
--- a/integrations/kube-agent-updater/pkg/controller/suite_test.go
+++ b/integrations/kube-agent-updater/pkg/controller/suite_test.go
@@ -19,7 +19,7 @@
 package controller
 
 import (
-	"golang.org/x/exp/rand"
+	"math/rand/v2"
 )
 
 var letterRunes = []rune("abcdefghijklmnopqrstuvwxyz1234567890")
@@ -27,7 +27,7 @@ var letterRunes = []rune("abcdefghijklmnopqrstuvwxyz1234567890")
 func validRandomResourceName(prefix string) string {
 	b := make([]rune, 5)
 	for i := range b {
-		b[i] = letterRunes[rand.Intn(len(letterRunes))]
+		b[i] = letterRunes[rand.IntN(len(letterRunes))]
 	}
 	return prefix + string(b)
 }
diff --git a/integrations/lib/embeddedtbot/bot.go b/integrations/lib/embeddedtbot/bot.go
index 720afd4ca5598..fdbf2fee685b0 100644
--- a/integrations/lib/embeddedtbot/bot.go
+++ b/integrations/lib/embeddedtbot/bot.go
@@ -29,16 +29,18 @@ import (
 
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/tbot"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/services/clientcredentials"
 )
 
 // EmbeddedBot is an embedded tBot instance to renew the operator certificates.
 type EmbeddedBot struct {
 	log *slog.Logger
-	cfg *config.BotConfig
+	cfg bot.Config
 
-	credential *config.UnstableClientCredentialOutput
+	credential *clientcredentials.UnstableConfig
 
 	// mutex protects started, cancelCtx and errCh
 	mutex     sync.Mutex
@@ -52,11 +54,27 @@ func New(botConfig *BotConfig, log *slog.Logger) (*EmbeddedBot, error) {
 	if log == nil {
 		return nil, trace.BadParameter("missing log")
 	}
-	credential := &config.UnstableClientCredentialOutput{}
-
-	cfg := (*config.BotConfig)(botConfig)
-	cfg.Storage = &config.StorageConfig{Destination: &config.DestinationMemory{}}
-	cfg.Services = config.ServiceConfigs{credential}
+	credential := &clientcredentials.UnstableConfig{}
+
+	cfg := bot.Config{
+		Kind: botConfig.Kind,
+		Connection: connection.Config{
+			Address:               botConfig.AuthServer,
+			AddressKind:           connection.AddressKindAuth,
+			AuthServerAddressMode: connection.AllowProxyAsAuthServer,
+			Insecure:              botConfig.Insecure,
+		},
+		Onboarding:         botConfig.Onboarding,
+		InternalStorage:    destination.NewMemory(),
+		Logger:             log,
+		CredentialLifetime: botConfig.CredentialLifetime,
+		Services: []bot.ServiceBuilder{
+			clientcredentials.ServiceBuilder(
+				credential,
+				botConfig.CredentialLifetime,
+			),
+		},
+	}
 
 	err := cfg.CheckAndSetDefaults()
 	if err != nil {
@@ -77,12 +95,14 @@ func New(botConfig *BotConfig, log *slog.Logger) (*EmbeddedBot, error) {
 // - return the server features
 // It allows us to fail fast and validate if something is broken before starting the manager.
 func (b *EmbeddedBot) Preflight(ctx context.Context) (*proto.PingResponse, error) {
-	b.cfg.Oneshot = true
-	bot := tbot.New(b.cfg, b.log)
-	err := bot.Run(ctx)
+	bot, err := bot.New(b.cfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if err := bot.OneShot(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	teleportClient, err := b.buildClient(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -96,11 +116,14 @@ func (b *EmbeddedBot) Preflight(ctx context.Context) (*proto.PingResponse, error
 // to be notified of the bot health there are two ways:
 // - if the bot just started, waitForClient to make sure it obtained its first certificates
 // - when the bot is running, call Start() that will wait for the bot to exit or the context being canceled.
-func (b *EmbeddedBot) start(ctx context.Context) {
+func (b *EmbeddedBot) start(ctx context.Context) error {
 	b.mutex.Lock()
 	defer b.mutex.Unlock()
-	b.cfg.Oneshot = false
-	bot := tbot.New(b.cfg, b.log)
+
+	bot, err := bot.New(b.cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
 	botCtx, cancel := context.WithCancel(ctx)
 	b.cancelCtx = cancel
@@ -116,6 +139,7 @@ func (b *EmbeddedBot) start(ctx context.Context) {
 		}
 		b.errCh <- trace.Wrap(err)
 	}()
+	return nil
 }
 
 // Start is a lie, the bot is already started. DO NOT CALL Start if you want to run the bot, call StartAndWaitForClient.
@@ -159,7 +183,10 @@ func (b *EmbeddedBot) waitForCredentials(ctx context.Context, deadline time.Dura
 // It returns an error if the EmbeddedBot is not able to get a certificate before the deadline.
 // If you need a client.Credentials instead, you can use StartAndWaitForCredentials.
 func (b *EmbeddedBot) StartAndWaitForClient(ctx context.Context, deadline time.Duration) (*client.Client, error) {
-	b.start(ctx)
+	if err := b.start(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	_, err := b.waitForCredentials(ctx, deadline)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -173,7 +200,10 @@ func (b *EmbeddedBot) StartAndWaitForClient(ctx context.Context, deadline time.D
 // It returns an error if the EmbeddedBot is not able to get a certificate before the deadline.
 // If you need a client.Client instead, you can use StartAndWaitForClient.
 func (b *EmbeddedBot) StartAndWaitForCredentials(ctx context.Context, deadline time.Duration) (client.Credentials, error) {
-	b.start(ctx)
+	if err := b.start(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	creds, err := b.waitForCredentials(ctx, deadline)
 	return creds, trace.Wrap(err)
 }
@@ -181,11 +211,11 @@ func (b *EmbeddedBot) StartAndWaitForCredentials(ctx context.Context, deadline t
 // buildClient reads tbot's memory disttination, retrieves the certificates
 // and builds a new Teleport client using those certs.
 func (b *EmbeddedBot) buildClient(ctx context.Context) (*client.Client, error) {
-	slog.InfoContext(ctx, "Building a new client to connect to cluster", "auth_server_address", b.cfg.AuthServer)
+	slog.InfoContext(ctx, "Building a new client to connect to cluster", "auth_server_address", b.cfg.Connection.Address)
 	c, err := client.New(ctx, client.Config{
-		Addrs:                    []string{b.cfg.AuthServer},
+		Addrs:                    []string{b.cfg.Connection.Address},
 		Credentials:              []client.Credentials{b.credential},
-		InsecureAddressDiscovery: b.cfg.Insecure,
+		InsecureAddressDiscovery: b.cfg.Connection.Insecure,
 	})
 	return c, trace.Wrap(err)
 }
diff --git a/integrations/lib/embeddedtbot/bot_test.go b/integrations/lib/embeddedtbot/bot_test.go
index 5eb00c05667fb..bd31e14fef2ca 100644
--- a/integrations/lib/embeddedtbot/bot_test.go
+++ b/integrations/lib/embeddedtbot/bot_test.go
@@ -33,15 +33,16 @@ import (
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestBotJoinAuth(t *testing.T) {
 	// Configure and start Teleport server
 	clusterName := "root.example.com"
 	ctx := context.Background()
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	teleportServer := helpers.NewInstance(t, helpers.InstanceConfig{
 		ClusterName: clusterName,
 		HostID:      uuid.New().String(),
@@ -119,17 +120,15 @@ func TestBotJoinAuth(t *testing.T) {
 	authAddr, err := teleportServer.Process.AuthAddr()
 	require.NoError(t, err)
 	botConfig := &BotConfig{
-		Onboarding: config.OnboardingConfig{
+		Onboarding: onboarding.Config{
 			TokenValue: tokenName,
 			JoinMethod: types.JoinMethodToken,
 		},
 		AuthServer: authAddr.Addr,
-		CredentialLifetime: config.CredentialLifetime{
+		CredentialLifetime: bot.CredentialLifetime{
 			TTL:             defaultCertificateTTL,
 			RenewalInterval: defaultRenewalInterval,
 		},
-		Oneshot: true,
-		Debug:   true,
 	}
 	bot, err := New(botConfig, logger)
 	require.NoError(t, err)
diff --git a/integrations/lib/embeddedtbot/config.go b/integrations/lib/embeddedtbot/config.go
index 08749ae1e4c94..6346b1f524070 100644
--- a/integrations/lib/embeddedtbot/config.go
+++ b/integrations/lib/embeddedtbot/config.go
@@ -24,7 +24,8 @@ import (
 	"time"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 )
 
 const (
@@ -32,11 +33,16 @@ const (
 	defaultRenewalInterval = 30 * time.Minute
 )
 
-// BotConfig contains the embedded tbot configuration.
-// This is a wrapper around the pure tbot config.BotConfig structure
-// and exposes utils to parse configuration from CLI flags and operator-specific
+// BotConfig contains the embedded tbot configuration. It's a simplified version
+// of the `lib/tbot/config.BotConfig` struct with CLI flags and operator-specific
 // defaults.
-type BotConfig config.BotConfig
+type BotConfig struct {
+	Kind               bot.Kind
+	AuthServer         string
+	Onboarding         onboarding.Config
+	CredentialLifetime bot.CredentialLifetime
+	Insecure           bool
+}
 
 // BindFlags binds BotConfig fields to CLI flags.
 // When calling flag.Parse(), the bot configuration will be parsed and
diff --git a/integrations/lib/logger/logger.go b/integrations/lib/logger/logger.go
index a1ce5bf7275ed..f831503c6b604 100644
--- a/integrations/lib/logger/logger.go
+++ b/integrations/lib/logger/logger.go
@@ -63,7 +63,7 @@ func Setup(conf Config) error {
 	default:
 	}
 
-	_, _, err := logutils.Initialize(logutils.Config{
+	_, _, _, err := logutils.Initialize(logutils.Config{
 		Output:       conf.Output,
 		Severity:     conf.Severity,
 		Format:       conf.Format,
diff --git a/integrations/lib/testing/integration/authhelper.go b/integrations/lib/testing/integration/authhelper.go
index 5816f512d6bbb..4dc998a38dc88 100644
--- a/integrations/lib/testing/integration/authhelper.go
+++ b/integrations/lib/testing/integration/authhelper.go
@@ -34,7 +34,8 @@ import (
 	"github.com/gravitational/teleport/api/identityfile"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
-	libauth "github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/plugin"
 )
@@ -43,11 +44,11 @@ import (
 // It starts an Auth server and a TLS server. This is not a full-featured
 // Teleport process.
 type MinimalAuthHelper struct {
-	server *libauth.TestTLSServer
+	server *authtest.TLSServer
 	// dir is where we put identity files, and start the auth server
 	// (unless AuthConfig.Dir is manually set).
 	dir            string
-	AuthConfig     libauth.TestAuthServerConfig
+	AuthConfig     authtest.AuthServerConfig
 	PluginRegistry plugin.Registry
 }
 
@@ -70,20 +71,21 @@ func (a *MinimalAuthHelper) StartServer(t *testing.T) *client.Client {
 		}
 	}
 
-	authServer, err := libauth.NewTestAuthServer(a.AuthConfig)
+	authServer, err := authtest.NewAuthServer(a.AuthConfig)
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
 		require.NoError(t, authServer.Close())
 	})
 
-	server, err := libauth.NewTestTLSServer(libauth.TestTLSServerConfig{
-		APIConfig: &libauth.APIConfig{
-			AuthServer:     authServer.AuthServer,
-			Authorizer:     authServer.Authorizer,
-			AuditLog:       authServer.AuditLog,
-			Emitter:        authServer.AuditLog,
-			PluginRegistry: a.PluginRegistry,
+	server, err := authtest.NewTestTLSServer(authtest.TLSServerConfig{
+		APIConfig: &auth.APIConfig{
+			AuthServer:       authServer.AuthServer,
+			Authorizer:       authServer.Authorizer,
+			ScopedAuthorizer: authServer.ScopedAuthorizer,
+			AuditLog:         authServer.AuditLog,
+			Emitter:          authServer.AuditLog,
+			PluginRegistry:   a.PluginRegistry,
 		},
 		AuthServer:    authServer,
 		AcceptedUsage: authServer.AcceptedUsage,
@@ -95,7 +97,7 @@ func (a *MinimalAuthHelper) StartServer(t *testing.T) *client.Client {
 		require.NoError(t, server.Close())
 	})
 
-	authClient, err := server.NewClient(libauth.TestAdmin())
+	authClient, err := server.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, authClient.Close())
@@ -126,9 +128,9 @@ type userCerts struct {
 // - the Authorized-key formatted SSH cert
 // - the PEM-encoded TLS cert
 func (a *MinimalAuthHelper) getUserCerts(t *testing.T, user types.User) userCerts {
-	auth := a.server.Auth()
+	authServer := a.server.Auth()
 
-	clusterName, err := auth.GetClusterName(context.TODO())
+	clusterName, err := authServer.GetClusterName(context.TODO())
 	require.NoError(t, err)
 	// Get user certs
 	userKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
@@ -137,7 +139,7 @@ func (a *MinimalAuthHelper) getUserCerts(t *testing.T, user types.User) userCert
 	require.NoError(t, err)
 	tlsPub, err := keys.MarshalPublicKey(userKey.Public())
 	require.NoError(t, err)
-	testCertsReq := libauth.GenerateUserTestCertsRequest{
+	testCertsReq := auth.GenerateUserTestCertsRequest{
 		SSHPubKey:      ssh.MarshalAuthorizedKey(sshPub),
 		TLSPubKey:      tlsPub,
 		Username:       user.GetName(),
@@ -145,7 +147,7 @@ func (a *MinimalAuthHelper) getUserCerts(t *testing.T, user types.User) userCert
 		Compatibility:  constants.CertificateFormatStandard,
 		RouteToCluster: clusterName.GetClusterName(),
 	}
-	sshCert, tlsCert, err := auth.GenerateUserTestCerts(testCertsReq)
+	sshCert, tlsCert, err := authServer.GenerateUserTestCerts(testCertsReq)
 	require.NoError(t, err)
 
 	// Build credentials from the certs
@@ -229,6 +231,6 @@ func (a *MinimalAuthHelper) SignIdentityForUser(t *testing.T, ctx context.Contex
 	return path
 }
 
-func (a *MinimalAuthHelper) Auth() *libauth.Server {
+func (a *MinimalAuthHelper) Auth() *auth.Server {
 	return a.server.Auth()
 }
diff --git a/integrations/operator/Dockerfile b/integrations/operator/Dockerfile
index 33eee89a5447e..1b136e6380ea8 100644
--- a/integrations/operator/Dockerfile
+++ b/integrations/operator/Dockerfile
@@ -1,7 +1,7 @@
 ARG BASE_IMAGE=gcr.io/distroless/cc-debian12
 
 # BUILDPLATFORM is provided by Docker/buildx
-FROM --platform=$BUILDPLATFORM docker.io/debian:12 as builder
+FROM --platform=$BUILDPLATFORM docker.io/debian:12 AS builder
 ARG BUILDARCH
 
 ## Install dependencies.
@@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Install Go.
 ARG GOLANG_VERSION
-RUN mkdir -p /opt && cd /opt && curl -fsSL https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | tar xz && \
+RUN mkdir -p /opt && cd /opt && curl -fsSL https://go.dev/dl/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | tar xz && \
     chmod a+w /var/lib && \
     chmod a-w /
 ENV GOPATH="/go" \
@@ -81,7 +81,8 @@ RUN echo "Targeting $TARGETOS/$TARGETARCH with CC=$COMPILER_NAME" && \
 
 # Create the image with the build operator on the $TARGETPLATFORM
 # TARGETPLATFORM is provided by Docker/buildx
-FROM --platform=$TARGETPLATFORM $BASE_IMAGE
+# --platform=${TARGETPLATFORM} is set by default and the docker linter complains if we set it.
+FROM $BASE_IMAGE
 WORKDIR /
 COPY --from=builder /go/bin/teleport-operator .
 
diff --git a/integrations/operator/Dockerfile.gha b/integrations/operator/Dockerfile.gha
index f8012173d8f37..3b992cbe02ccd 100644
--- a/integrations/operator/Dockerfile.gha
+++ b/integrations/operator/Dockerfile.gha
@@ -1,7 +1,7 @@
 ARG BASE_IMAGE=gcr.io/distroless/cc-debian12
 
 # BUILDPLATFORM is provided by Docker/buildx
-FROM --platform=$BUILDPLATFORM docker.io/debian:12 as builder
+FROM --platform=$BUILDPLATFORM docker.io/debian:12 AS builder
 ARG BUILDARCH
 
 ## Install dependencies.
@@ -34,7 +34,7 @@ EOT
 # Install Go.
 RUN GOLANG_VERSION=$(make -s -C /tmp/v print-go-version) && \
     mkdir -p /opt && \
-    curl -fsSL https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | \
+    curl -fsSL https://go.dev/dl/$GOLANG_VERSION.linux-${BUILDARCH}.tar.gz | \
       tar xz -C /opt && \
     chmod a+w /var/lib && \
     chmod a-w /
@@ -100,7 +100,8 @@ RUN case "$TARGETARCH" in \
 
 # Create the image with the build operator on the $TARGETPLATFORM
 # TARGETPLATFORM is provided by Docker/buildx
-FROM --platform=$TARGETPLATFORM $BASE_IMAGE
+# --platform=${TARGETPLATFORM} is set by default and the docker linter complains if we set it.
+FROM $BASE_IMAGE
 WORKDIR /
 COPY --from=builder /go/bin/teleport-operator .
 
diff --git a/integrations/operator/Makefile b/integrations/operator/Makefile
index e0c8faac35fae..ea856a7a653f8 100644
--- a/integrations/operator/Makefile
+++ b/integrations/operator/Makefile
@@ -132,7 +132,7 @@ crd-docs: crdgen/build/protoc-gen-crd-docs ## Generate CRD reference docs.
 			-I=../../api/proto \
 			-I=$(PROTOBUF_MOD_PATH) \
 			--plugin=./crdgen/build/protoc-gen-crd-docs \
-			--crd-docs_out=../../docs/pages/reference/operator-resources/ \
+			--crd-docs_out=../../docs/pages/reference/infrastructure-as-code/operator-resources/ \
 			"$${proto}"; \
 	done
 
@@ -176,7 +176,7 @@ debug-dump-request:
 test: generate $(ENVTEST) ## Run tests.
 test: export KUBEBUILDER_ASSETS=$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)
 test:
-	go test ./... -coverprofile cover.out
+	gotestsum --junitfile unit-tests-operator.xml --jsonfile unit-tests-operator.json
 
 .PHONY: echo-kubebuilder-assets
 echo-kubebuilder-assets:
@@ -213,8 +213,7 @@ $(LOCALBIN):
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v3.8.7
-CONTROLLER_TOOLS_VERSION ?= v0.16.2
+CONTROLLER_TOOLS_VERSION ?= v0.19.0
 
 .PHONY: controller-gen
 controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
diff --git a/integrations/operator/README.md b/integrations/operator/README.md
index 6706876d782ae..33a66d16098ea 100644
--- a/integrations/operator/README.md
+++ b/integrations/operator/README.md
@@ -12,25 +12,7 @@ For more details, read the corresponding [RFD](https://github.com/gravitational/
 
 ## Supported Resources
 
-The operator supports reconciling the following Kubernetes CRs:
-
-- TeleportUser
-- TeleportRole (creates role v5)
-- TeleportRoleV6 (creates role v6)
-- TeleportRoleV7 (creates role v7)
-- TeleportProvisionToken
-- TeleportGithubConnector
-- TeleportAccessList
-- TeleportOpenSSHEICEServerV2
-- TeleportOpenSSHServerV2
-- TeleportTrustedClusterV2
-- TeleportBotV1
-- TeleportSAMLConnector [1]
-- TeleportOIDCConnector [1]
-- TeleportLoginRule [1]
-- TeleportOktaImportRule [1]
-
-[1] Enterprise license required
+See the list of supported resources in the documentation: https://goteleport.com/docs/reference/operator-resources/
 
 ## Architecture
 Teleport Operator is a Kubernetes (K8s) operator based on the `operator-sdk`.
diff --git a/integrations/operator/apis/resources/v1/appv3_types.go b/integrations/operator/apis/resources/v1/appv3_types.go
new file mode 100644
index 0000000000000..f6782f00029fc
--- /dev/null
+++ b/integrations/operator/apis/resources/v1/appv3_types.go
@@ -0,0 +1,95 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/operator/apis/resources"
+)
+
+func init() {
+	SchemeBuilder.Register(&TeleportAppV3{}, &TeleportAppV3List{})
+}
+
+// TeleportAppV3Spec defines the desired state of TeleportAppV3
+type TeleportAppV3Spec types.AppSpecV3
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// TeleportAppV3 is the Schema for the roles API
+type TeleportAppV3 struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   TeleportAppV3Spec `json:"spec,omitempty"`
+	Status resources.Status  `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// TeleportAppV3List contains a list of TeleportAppV3
+type TeleportAppV3List struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TeleportAppV3 `json:"items"`
+}
+
+func (r TeleportAppV3) ToTeleport() types.Application {
+	return &types.AppV3{
+		Kind:    types.KindApp,
+		Version: types.V3,
+		Metadata: types.Metadata{
+			Name:        r.Name,
+			Labels:      r.Labels,
+			Description: r.Annotations[resources.DescriptionKey],
+		},
+		Spec: types.AppSpecV3(r.Spec),
+	}
+}
+
+// Marshal serializes a spec into binary data.
+func (spec *TeleportAppV3Spec) Marshal() ([]byte, error) {
+	return (*types.AppSpecV3)(spec).Marshal()
+}
+
+// Unmarshal deserializes a spec from binary data.
+func (spec *TeleportAppV3Spec) Unmarshal(data []byte) error {
+	return (*types.AppSpecV3)(spec).Unmarshal(data)
+}
+
+// DeepCopyInto deep-copies one role spec into another.
+// Required to satisfy runtime.Object interface.
+func (spec *TeleportAppV3Spec) DeepCopyInto(out *TeleportAppV3Spec) {
+	data, err := spec.Marshal()
+	if err != nil {
+		panic(err)
+	}
+	*out = TeleportAppV3Spec{}
+	if err = out.Unmarshal(data); err != nil {
+		panic(err)
+	}
+}
+
+// StatusConditions returns a pointer to Status.Conditions slice.
+func (r *TeleportAppV3) StatusConditions() *[]metav1.Condition {
+	return &r.Status.Conditions
+}
diff --git a/integrations/operator/apis/resources/v1/databasev3_types.go b/integrations/operator/apis/resources/v1/databasev3_types.go
new file mode 100644
index 0000000000000..c000e231c37b0
--- /dev/null
+++ b/integrations/operator/apis/resources/v1/databasev3_types.go
@@ -0,0 +1,95 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/operator/apis/resources"
+)
+
+func init() {
+	SchemeBuilder.Register(&TeleportDatabaseV3{}, &TeleportDatabaseV3List{})
+}
+
+// TeleportDatabaseV3Spec defines the desired state of TeleportDatabaseV3
+type TeleportDatabaseV3Spec types.DatabaseSpecV3
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// TeleportDatabaseV3 is the Schema for the roles API
+type TeleportDatabaseV3 struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   TeleportDatabaseV3Spec `json:"spec,omitempty"`
+	Status resources.Status       `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// TeleportDatabaseV3List contains a list of TeleportDatabaseV3
+type TeleportDatabaseV3List struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TeleportDatabaseV3 `json:"items"`
+}
+
+func (r TeleportDatabaseV3) ToTeleport() types.Database {
+	return &types.DatabaseV3{
+		Kind:    types.KindDatabase,
+		Version: types.V3,
+		Metadata: types.Metadata{
+			Name:        r.Name,
+			Labels:      r.Labels,
+			Description: r.Annotations[resources.DescriptionKey],
+		},
+		Spec: types.DatabaseSpecV3(r.Spec),
+	}
+}
+
+// Marshal serializes a spec into binary data.
+func (spec *TeleportDatabaseV3Spec) Marshal() ([]byte, error) {
+	return (*types.DatabaseSpecV3)(spec).Marshal()
+}
+
+// Unmarshal deserializes a spec from binary data.
+func (spec *TeleportDatabaseV3Spec) Unmarshal(data []byte) error {
+	return (*types.DatabaseSpecV3)(spec).Unmarshal(data)
+}
+
+// DeepCopyInto deep-copies one role spec into another.
+// Required to satisfy runtime.Object interface.
+func (spec *TeleportDatabaseV3Spec) DeepCopyInto(out *TeleportDatabaseV3Spec) {
+	data, err := spec.Marshal()
+	if err != nil {
+		panic(err)
+	}
+	*out = TeleportDatabaseV3Spec{}
+	if err = out.Unmarshal(data); err != nil {
+		panic(err)
+	}
+}
+
+// StatusConditions returns a pointer to Status.Conditions slice.
+func (r *TeleportDatabaseV3) StatusConditions() *[]metav1.Condition {
+	return &r.Status.Conditions
+}
diff --git a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
index cb03975acd04b..827087f54b140 100644
--- a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
+++ b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
@@ -95,6 +95,75 @@ func (in *TeleportAccessListSpec) DeepCopy() *TeleportAccessListSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportAppV3) DeepCopyInto(out *TeleportAppV3) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportAppV3.
+func (in *TeleportAppV3) DeepCopy() *TeleportAppV3 {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportAppV3)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportAppV3) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportAppV3List) DeepCopyInto(out *TeleportAppV3List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TeleportAppV3, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportAppV3List.
+func (in *TeleportAppV3List) DeepCopy() *TeleportAppV3List {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportAppV3List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportAppV3List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportAppV3Spec.
+func (in *TeleportAppV3Spec) DeepCopy() *TeleportAppV3Spec {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportAppV3Spec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TeleportAutoupdateConfigV1) DeepCopyInto(out *TeleportAutoupdateConfigV1) {
 	*out = *in
@@ -311,6 +380,75 @@ func (in *TeleportBotV1Spec) DeepCopy() *TeleportBotV1Spec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportDatabaseV3) DeepCopyInto(out *TeleportDatabaseV3) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportDatabaseV3.
+func (in *TeleportDatabaseV3) DeepCopy() *TeleportDatabaseV3 {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportDatabaseV3)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportDatabaseV3) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportDatabaseV3List) DeepCopyInto(out *TeleportDatabaseV3List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TeleportDatabaseV3, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportDatabaseV3List.
+func (in *TeleportDatabaseV3List) DeepCopy() *TeleportDatabaseV3List {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportDatabaseV3List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportDatabaseV3List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportDatabaseV3Spec.
+func (in *TeleportDatabaseV3Spec) DeepCopy() *TeleportDatabaseV3Spec {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportDatabaseV3Spec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TeleportLoginRule) DeepCopyInto(out *TeleportLoginRule) {
 	*out = *in
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_accesslists.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_accesslists.yaml
index 2c595617b69d3..5307894f3066a 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_accesslists.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_accesslists.yaml
@@ -190,6 +190,11 @@ spec:
                 description: title is a plaintext short description of the Access
                   List.
                 type: string
+              type:
+                description: type can be an empty string which denotes a regular Access
+                  List, "scim" which represents an Access List created from SCIM group
+                  or "static" for Access Lists managed by IaC tools.
+                type: string
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_appsv3.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_appsv3.yaml
new file mode 100644
index 0000000000000..e1feb5d38f100
--- /dev/null
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_appsv3.yaml
@@ -0,0 +1,353 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportappsv3.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportAppV3
+    listKind: TeleportAppV3List
+    plural: teleportappsv3
+    shortNames:
+    - appv3
+    - appsv3
+    singular: teleportappv3
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: AppV3 is the Schema for the appsv3 API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: App resource definition v3 from Teleport
+            properties:
+              UserGroups:
+                description: UserGroups are a list of user group IDs that this app
+                  is associated with.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              aws:
+                description: AWS contains additional options for AWS applications.
+                nullable: true
+                properties:
+                  external_id:
+                    description: ExternalID is the AWS External ID used when assuming
+                      roles in this app.
+                    type: string
+                  roles_anywhere_profile:
+                    description: RolesAnywhereProfile contains the IAM Roles Anywhere
+                      fields associated with this Application. These fields are set
+                      when performing the synchronization of AWS IAM Roles Anywhere
+                      Profiles into Teleport Apps.
+                    nullable: true
+                    properties:
+                      accept_role_session_name:
+                        description: 'Whether this Roles Anywhere Profile accepts
+                          a custom role session name. When not supported, the AWS
+                          Session Name will be the X.509 certificate''s serial number.
+                          When supported, the AWS Session Name will be the identity''s
+                          username. This values comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html
+                          / acceptRoleSessionName'
+                        type: boolean
+                      profile_arn:
+                        description: ProfileARN is the AWS IAM Roles Anywhere Profile
+                          ARN that originated this Teleport App.
+                        type: string
+                    type: object
+                type: object
+              cloud:
+                description: Cloud identifies the cloud instance the app represents.
+                type: string
+              cors:
+                description: CORSPolicy defines the Cross-Origin Resource Sharing
+                  settings for the app.
+                nullable: true
+                properties:
+                  allow_credentials:
+                    description: allow_credentials indicates whether credentials are
+                      allowed.
+                    type: boolean
+                  allowed_headers:
+                    description: allowed_headers specifies which headers can be used
+                      when accessing the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  allowed_methods:
+                    description: allowed_methods specifies which methods are allowed
+                      when accessing the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  allowed_origins:
+                    description: allowed_origins specifies which origins are allowed
+                      to access the app.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  exposed_headers:
+                    description: exposed_headers indicates which headers are made
+                      available to scripts via the browser.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  max_age:
+                    description: max_age indicates how long (in seconds) the results
+                      of a preflight request can be cached.
+                    format: int32
+                    type: integer
+                type: object
+              dynamic_labels:
+                description: DynamicLabels are the app's command labels.
+                properties:
+                  key:
+                    type: string
+                  value:
+                    nullable: true
+                    properties:
+                      command:
+                        description: Command is a command to run
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      period:
+                        description: Period is a time between command runs
+                        format: duration
+                        type: string
+                      result:
+                        description: Result captures standard output
+                        type: string
+                    type: object
+                type: object
+              identity_center:
+                description: IdentityCenter encasulates AWS identity-center specific
+                  information. Only valid for Identity Center account apps.
+                nullable: true
+                properties:
+                  account_id:
+                    description: Account ID is the AWS-assigned ID of the account
+                    type: string
+                  permission_sets:
+                    description: PermissionSets lists the available permission sets
+                      on the given account
+                    items:
+                      properties:
+                        arn:
+                          description: ARN is the fully-formed ARN of the Permission
+                            Set.
+                          type: string
+                        assignment_name:
+                          description: AssignmentID is the ID of the Teleport Account
+                            Assignment resource that represents this permission being
+                            assigned on the enclosing Account.
+                          type: string
+                        name:
+                          description: Name is the human-readable name of the Permission
+                            Set.
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                type: object
+              insecure_skip_verify:
+                description: InsecureSkipVerify disables app's TLS certificate verification.
+                type: boolean
+              integration:
+                description: Integration is the integration name that must be used
+                  to access this Application. Only applicable to AWS App Access. If
+                  present, the Application must use the Integration's credentials
+                  instead of ambient credentials to access Cloud APIs.
+                type: string
+              mcp:
+                description: MCP contains MCP server related configurations.
+                nullable: true
+                properties:
+                  args:
+                    description: Args to execute with the command.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  command:
+                    description: Command to launch stdio-based MCP servers.
+                    type: string
+                  run_as_host_user:
+                    description: RunAsHostUser is the host user account under which
+                      the command will be executed. Required for stdio-based MCP servers.
+                    type: string
+                type: object
+              public_addr:
+                description: PublicAddr is the public address the application is accessible
+                  at.
+                type: string
+              required_app_names:
+                description: RequiredAppNames is a list of app names that are required
+                  for this app to function. Any app listed here will be part of the
+                  authentication redirect flow and authenticate along side this app.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              rewrite:
+                description: Rewrite is a list of rewriting rules to apply to requests
+                  and responses.
+                nullable: true
+                properties:
+                  headers:
+                    description: Headers is a list of headers to inject when passing
+                      the request over to the application.
+                    items:
+                      properties:
+                        name:
+                          description: Name is the http header name.
+                          type: string
+                        value:
+                          description: Value is the http header value.
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                  jwt_claims:
+                    description: JWTClaims configures whether roles/traits are included
+                      in the JWT token.
+                    type: string
+                  redirect:
+                    description: Redirect defines a list of hosts which will be rewritten
+                      to the public address of the application if they occur in the
+                      "Location" header.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                type: object
+              tcp_ports:
+                description: TCPPorts is a list of ports and port ranges that an app
+                  agent can forward connections to. Only applicable to TCP App Access.
+                  If this field is not empty, URI is expected to contain no port number
+                  and start with the tcp protocol.
+                items:
+                  properties:
+                    end_port:
+                      description: EndPort describes the end of the range, inclusive.
+                        If set, it must be between 2 and 65535 and be greater than
+                        Port when describing a port range. When omitted or set to
+                        zero, it signifies that the port range defines a single port.
+                      format: int32
+                      type: integer
+                    port:
+                      description: Port describes the start of the range. It must
+                        be between 1 and 65535.
+                      format: int32
+                      type: integer
+                  type: object
+                nullable: true
+                type: array
+              uri:
+                description: URI is the web app endpoint.
+                type: string
+              use_any_proxy_public_addr:
+                description: UseAnyProxyPublicAddr will rebuild this app's fqdn based
+                  on the proxy public addr that the request originated from. This
+                  should be true if your proxy has multiple proxy public addrs and
+                  you want the app to be accessible from any of them. If `public_addr`
+                  is explicitly set in the app spec, setting this value to true will
+                  overwrite that public address in the web UI.
+                type: boolean
+            type: object
+          status:
+            description: Status defines the observed state of the Teleport resource
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateconfigsv1.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateconfigsv1.yaml
index f56da0ee7c415..8aaeff1d116ca 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateconfigsv1.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateconfigsv1.yaml
@@ -60,6 +60,15 @@ spec:
                         description: regular schedules for non-critical versions.
                         items:
                           properties:
+                            canary_count:
+                              description: canary_count is the number of canary agents
+                                that will be updated before the whole group is updated.
+                                when set to 0, the group does not enter the canary
+                                phase. This number is capped to 5. This number must
+                                always be lower than the total number of agents in
+                                the group, else the rollout will be stuck.
+                              format: int32
+                              type: integer
                             days:
                               description: days when the update can run. Supported
                                 values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat",
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateversionsv1.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateversionsv1.yaml
index dc35ecbd7a1b7..63a35618df0b9 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateversionsv1.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_autoupdateversionsv1.yaml
@@ -46,10 +46,12 @@ spec:
                     description: schedule to use for the rollout
                     type: string
                   start_version:
-                    description: start_version is the version to update from.
+                    description: start_version is the version used for newly installed
+                      agents before their update window.
                     type: string
                   target_version:
-                    description: target_version is the version to update to.
+                    description: target_version is the version that all agents will
+                      update to during their update window.
                     type: string
                 type: object
               tools:
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_databasesv3.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_databasesv3.yaml
new file mode 100644
index 0000000000000..e80b0a9e6ba4b
--- /dev/null
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_databasesv3.yaml
@@ -0,0 +1,495 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportdatabasesv3.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportDatabaseV3
+    listKind: TeleportDatabaseV3List
+    plural: teleportdatabasesv3
+    shortNames:
+    - databasev3
+    - databasesv3
+    singular: teleportdatabasev3
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: DatabaseV3 is the Schema for the databasesv3 API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Database resource definition v3 from Teleport
+            properties:
+              ad:
+                description: AD is the Active Directory configuration for the database.
+                properties:
+                  domain:
+                    description: Domain is the Active Directory domain the database
+                      resides in.
+                    type: string
+                  kdc_host_name:
+                    description: KDCHostName is the host name for a KDC for x509 Authentication.
+                    type: string
+                  keytab_file:
+                    description: KeytabFile is the path to the Kerberos keytab file.
+                    type: string
+                  krb5_file:
+                    description: Krb5File is the path to the Kerberos configuration
+                      file. Defaults to /etc/krb5.conf.
+                    type: string
+                  ldap_cert:
+                    description: LDAPCert is a certificate from Windows LDAP/AD, optional;
+                      only for x509 Authentication.
+                    type: string
+                  ldap_service_account_name:
+                    description: LDAPServiceAccountName is the name of service account
+                      for performing LDAP queries. Required for x509 Auth / PKINIT.
+                    type: string
+                  ldap_service_account_sid:
+                    description: LDAPServiceAccountSID is the SID of service account
+                      for performing LDAP queries. Required for x509 Auth / PKINIT.
+                    type: string
+                  spn:
+                    description: SPN is the service principal name for the database.
+                    type: string
+                type: object
+              admin_user:
+                description: AdminUser is the database admin user for automatic user
+                  provisioning.
+                nullable: true
+                properties:
+                  default_database:
+                    description: DefaultDatabase is the database that the privileged
+                      database user logs into by default.  Depending on the database
+                      type, this database may be used to store procedures or data
+                      for managing database users.
+                    type: string
+                  name:
+                    description: Name is the username of the privileged database user.
+                    type: string
+                type: object
+              aws:
+                description: AWS contains AWS specific settings for RDS/Aurora/Redshift
+                  databases.
+                properties:
+                  account_id:
+                    description: AccountID is the AWS account ID this database belongs
+                      to.
+                    type: string
+                  assume_role_arn:
+                    description: AssumeRoleARN is an optional AWS role ARN to assume
+                      when accessing a database. Set this field and ExternalID to
+                      enable access across AWS accounts.
+                    type: string
+                  docdb:
+                    description: DocumentDB contains Amazon DocumentDB-specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the cluster identifier.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      instance_id:
+                        description: InstanceID is the instance identifier.
+                        type: string
+                    type: object
+                  elasticache:
+                    description: ElastiCache contains Amazon ElastiCache Redis-specific
+                      metadata.
+                    properties:
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      replication_group_id:
+                        description: ReplicationGroupID is the Redis replication group
+                          ID.
+                        type: string
+                      transit_encryption_enabled:
+                        description: TransitEncryptionEnabled indicates whether in-transit
+                          encryption (TLS) is enabled.
+                        type: boolean
+                      user_group_ids:
+                        description: UserGroupIDs is a list of user group IDs.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
+                  elasticache_serverless:
+                    description: ElastiCacheServerless contains Amazon ElastiCache
+                      Serverless metadata.
+                    properties:
+                      cache_name:
+                        description: CacheName is an ElastiCache Serverless cache
+                          name.
+                        type: string
+                    type: object
+                  external_id:
+                    description: ExternalID is an optional AWS external ID used to
+                      enable assuming an AWS role across accounts.
+                    type: string
+                  iam_policy_status:
+                    description: 'IAMPolicyStatus indicates whether the IAM Policy
+                      is configured properly for database access. If not, the user
+                      must update the AWS profile identity to allow access to the
+                      Database. Eg for an RDS Database: the underlying AWS profile
+                      allows for `rds-db:connect` for the Database.'
+                    x-kubernetes-int-or-string: true
+                  memorydb:
+                    description: MemoryDB contains AWS MemoryDB specific metadata.
+                    properties:
+                      acl_name:
+                        description: ACLName is the name of the ACL associated with
+                          the cluster.
+                        type: string
+                      cluster_name:
+                        description: ClusterName is the name of the MemoryDB cluster.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                      tls_enabled:
+                        description: TLSEnabled indicates whether in-transit encryption
+                          (TLS) is enabled.
+                        type: boolean
+                    type: object
+                  opensearch:
+                    description: OpenSearch contains AWS OpenSearch specific metadata.
+                    properties:
+                      domain_id:
+                        description: DomainID is the ID of the domain.
+                        type: string
+                      domain_name:
+                        description: DomainName is the name of the domain.
+                        type: string
+                      endpoint_type:
+                        description: EndpointType is the type of the endpoint.
+                        type: string
+                    type: object
+                  rds:
+                    description: RDS contains RDS specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the RDS cluster (Aurora) identifier.
+                        type: string
+                      iam_auth:
+                        description: IAMAuth indicates whether database IAM authentication
+                          is enabled.
+                        type: boolean
+                      instance_id:
+                        description: InstanceID is the RDS instance identifier.
+                        type: string
+                      resource_id:
+                        description: ResourceID is the RDS instance resource identifier
+                          (db-xxx).
+                        type: string
+                      security_groups:
+                        description: SecurityGroups is a list of attached security
+                          groups for the RDS instance.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      subnets:
+                        description: Subnets is a list of subnets for the RDS instance.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      vpc_id:
+                        description: VPCID is the VPC where the RDS is running.
+                        type: string
+                    type: object
+                  rdsproxy:
+                    description: RDSProxy contains AWS Proxy specific metadata.
+                    properties:
+                      custom_endpoint_name:
+                        description: CustomEndpointName is the identifier of an RDS
+                          Proxy custom endpoint.
+                        type: string
+                      name:
+                        description: Name is the identifier of an RDS Proxy.
+                        type: string
+                      resource_id:
+                        description: ResourceID is the RDS instance resource identifier
+                          (prx-xxx).
+                        type: string
+                    type: object
+                  redshift:
+                    description: Redshift contains Redshift specific metadata.
+                    properties:
+                      cluster_id:
+                        description: ClusterID is the Redshift cluster identifier.
+                        type: string
+                    type: object
+                  redshift_serverless:
+                    description: RedshiftServerless contains Amazon Redshift Serverless-specific
+                      metadata.
+                    properties:
+                      endpoint_name:
+                        description: EndpointName is the VPC endpoint name.
+                        type: string
+                      workgroup_id:
+                        description: WorkgroupID is the workgroup ID.
+                        type: string
+                      workgroup_name:
+                        description: WorkgroupName is the workgroup name.
+                        type: string
+                    type: object
+                  region:
+                    description: Region is a AWS cloud region.
+                    type: string
+                  secret_store:
+                    description: SecretStore contains secret store configurations.
+                    properties:
+                      key_prefix:
+                        description: KeyPrefix specifies the secret key prefix.
+                        type: string
+                      kms_key_id:
+                        description: KMSKeyID specifies the AWS KMS key for encryption.
+                        type: string
+                    type: object
+                  session_tags:
+                    description: SessionTags is a list of AWS STS session tags.
+                    nullable: true
+                    properties:
+                      key:
+                        type: string
+                      value:
+                        type: string
+                    type: object
+                type: object
+              azure:
+                description: Azure contains Azure specific database metadata.
+                properties:
+                  is_flexi_server:
+                    description: IsFlexiServer is true if the database is an Azure
+                      Flexible server.
+                    type: boolean
+                  name:
+                    description: Name is the Azure database server name.
+                    type: string
+                  redis:
+                    description: Redis contains Azure Cache for Redis specific database
+                      metadata.
+                    properties:
+                      clustering_policy:
+                        description: ClusteringPolicy is the clustering policy for
+                          Redis Enterprise.
+                        type: string
+                    type: object
+                  resource_id:
+                    description: ResourceID is the Azure fully qualified ID for the
+                      resource.
+                    type: string
+                type: object
+              ca_cert:
+                description: 'CACert is the PEM-encoded database CA certificate.  DEPRECATED:
+                  Moved to TLS.CACert. DELETE IN 10.0.'
+                type: string
+              dynamic_labels:
+                description: DynamicLabels is the database dynamic labels.
+                properties:
+                  key:
+                    type: string
+                  value:
+                    nullable: true
+                    properties:
+                      command:
+                        description: Command is a command to run
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                      period:
+                        description: Period is a time between command runs
+                        format: duration
+                        type: string
+                      result:
+                        description: Result captures standard output
+                        type: string
+                    type: object
+                type: object
+              gcp:
+                description: GCP contains parameters specific to GCP Cloud SQL databases.
+                properties:
+                  alloydb:
+                    description: AlloyDB contains AlloyDB specific configuration elements.
+                    properties:
+                      endpoint_override:
+                        description: EndpointOverride is an override of endpoint address
+                          to use.
+                        type: string
+                      endpoint_type:
+                        description: 'EndpointType is the database endpoint type to
+                          use. Should be one of: "private", "public", "psc".'
+                        type: string
+                    type: object
+                  instance_id:
+                    description: InstanceID is the Cloud SQL instance ID.
+                    type: string
+                  project_id:
+                    description: ProjectID is the GCP project ID the Cloud SQL instance
+                      resides in.
+                    type: string
+                type: object
+              mongo_atlas:
+                description: MongoAtlas contains Atlas metadata about the database.
+                properties:
+                  name:
+                    description: Name is the Atlas database instance name.
+                    type: string
+                type: object
+              mysql:
+                description: MySQL is an additional section with MySQL database options.
+                properties:
+                  server_version:
+                    description: ServerVersion is the server version reported by DB
+                      proxy if the runtime information is not available.
+                    type: string
+                type: object
+              oracle:
+                description: Oracle is an additional Oracle configuration options.
+                properties:
+                  audit_user:
+                    description: AuditUser is the name of the Oracle database user
+                      that should be used to access the internal audit trail.
+                    type: string
+                  retry_count:
+                    description: RetryCount is the maximum number of times to retry
+                      connecting to a host upon failure. If not specified it defaults
+                      to 2, for a total of 3 connection attempts.
+                    format: int32
+                    type: integer
+                  shuffle_hostnames:
+                    description: ShuffleHostnames, when true, randomizes the order
+                      of hosts to connect to from the provided list.
+                    type: boolean
+                type: object
+              protocol:
+                description: 'Protocol is the database protocol: postgres, mysql,
+                  mongodb, etc.'
+                type: string
+              tls:
+                description: TLS is the TLS configuration used when establishing connection
+                  to target database. Allows to provide custom CA cert or override
+                  server name.
+                properties:
+                  ca_cert:
+                    description: CACert is an optional user provided CA certificate
+                      used for verifying database TLS connection.
+                    type: string
+                  mode:
+                    description: Mode is a TLS connection mode. 0 is "verify-full";
+                      1 is "verify-ca", 2 is "insecure".
+                    x-kubernetes-int-or-string: true
+                  server_name:
+                    description: ServerName allows to provide custom hostname. This
+                      value will override the servername/hostname on a certificate
+                      during validation.
+                    type: string
+                  trust_system_cert_pool:
+                    description: TrustSystemCertPool allows Teleport to trust certificate
+                      authorities available on the host system. If not set (by default),
+                      Teleport only trusts self-signed databases with TLS certificates
+                      signed by Teleport's Database Server CA or the ca_cert specified
+                      in this TLS setting. For cloud-hosted databases, Teleport downloads
+                      the corresponding required CAs for validation.
+                    type: boolean
+                type: object
+              uri:
+                description: URI is the database connection endpoint.
+                type: string
+            type: object
+          status:
+            description: Status defines the observed state of the Teleport resource
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_githubconnectors.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_githubconnectors.yaml
index 1832b3db75e21..0e59c787bdc41 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_githubconnectors.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_githubconnectors.yaml
@@ -99,6 +99,14 @@ spec:
                       type: string
                   type: object
                 type: array
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_oidcconnectors.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_oidcconnectors.yaml
index c3881a649fff2..f4026b004d413 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_oidcconnectors.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_oidcconnectors.yaml
@@ -96,6 +96,35 @@ spec:
               display:
                 description: Display is the friendly name for this provider.
                 type: string
+              entra_id_groups_provider:
+                description: EntraIDGroupsProvider configures out-of-band user groups
+                  provider. It works by following through the groups claim source,
+                  which is sent for the "groups" claim when the user's group membership
+                  exceeds 200 max item limit.
+                nullable: true
+                properties:
+                  disabled:
+                    description: Disabled specifies that the groups provider should
+                      be disabled even when Entra ID responds with a groups claim
+                      source. User may choose to disable it if they are using integrations
+                      such as SCIM or similar groups importer as connector based role
+                      mapping may be not needed in such a scenario.
+                    type: boolean
+                  graph_endpoint:
+                    description: GraphEndpoint is a Microsoft Graph API endpoint.
+                      The groups claim source endpoint provided by Entra ID points
+                      to the now-retired Azure AD Graph endpoint ("https://graph.windows.net").
+                      To convert it to the newer Microsoft Graph API endpoint, Teleport
+                      defaults to the Microsoft Graph global service endpoint ("https://graph.microsoft.com").
+                      Update GraphEndpoint to point to a different Microsoft Graph
+                      national cloud deployment endpoint.
+                    type: string
+                  group_type:
+                    description: GroupType is a user group type filter. Defaults to
+                      "security-groups". Value can be "security-groups", "directory-roles",
+                      "all-groups".
+                    type: string
+                type: object
               google_admin_email:
                 description: GoogleAdminEmail is the email of a google admin to impersonate.
                 type: string
@@ -151,6 +180,15 @@ spec:
                       omits prompt. If not specified, it defaults to select_account
                       for backwards compatibility.
                     type: string
+                  request_object_mode:
+                    description: RequestObjectMode determines how JWT-Secured Authorization
+                      Requests will be used for authorization requests. JARs, or request
+                      objects, can provide integrity protection, source authentication,
+                      and confidentiality for authorization request parameters. If
+                      omitted, MFA flows will default to the `RequestObjectMode` behavior
+                      specified in the base OIDC connector. Set this property to 'none'
+                      to explicitly disable request objects for the MFA client.
+                    type: string
                 type: object
               pkce_mode:
                 description: PKCEMode represents the configuration state for PKCE
@@ -174,12 +212,26 @@ spec:
                 items:
                   type: string
                 type: array
+              request_object_mode:
+                description: RequestObjectMode determines how JWT-Secured Authorization
+                  Requests will be used for authorization requests. JARs, or request
+                  objects, can provide integrity protection, source authentication,
+                  and confidentiality for authorization request parameters.
+                type: string
               scope:
                 description: Scope specifies additional scopes set by provider.
                 items:
                   type: string
                 nullable: true
                 type: array
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
               username_claim:
                 description: UsernameClaim specifies the name of the claim from the
                   OIDC connector to be used as the user's username.
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_openssheiceserversv2.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_openssheiceserversv2.yaml
index bad8469a76fb6..5d4cdf65d5d56 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_openssheiceserversv2.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_openssheiceserversv2.yaml
@@ -123,6 +123,17 @@ spec:
                   type: string
                 nullable: true
                 type: array
+              relay_group:
+                description: the name of the Relay group that the server is connected
+                  to
+                type: string
+              relay_ids:
+                description: the list of Relay host IDs that the server is connected
+                  to
+                items:
+                  type: string
+                nullable: true
+                type: array
               rotation:
                 description: Rotation specifies server rotation
                 properties:
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_opensshserversv2.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_opensshserversv2.yaml
index fe3d76a8db7a4..8ffb3d954abba 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_opensshserversv2.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_opensshserversv2.yaml
@@ -122,6 +122,17 @@ spec:
                   type: string
                 nullable: true
                 type: array
+              relay_group:
+                description: the name of the Relay group that the server is connected
+                  to
+                type: string
+              relay_ids:
+                description: the list of Relay host IDs that the server is connected
+                  to
+                items:
+                  type: string
+                nullable: true
+                type: array
               rotation:
                 description: Rotation specifies server rotation
                 properties:
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_provisiontokens.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_provisiontokens.yaml
index 2d8522dc4007a..4a4a0757890fb 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_provisiontokens.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_provisiontokens.yaml
@@ -236,6 +236,42 @@ spec:
                   organization_id:
                     type: string
                 type: object
+              env0:
+                description: Env0 allows the configuration of options specific to
+                  the "env0" join method.
+                nullable: true
+                properties:
+                  allow:
+                    description: Allow is a list of Rules, jobs using this token must
+                      match at least one allow rule to use this token.
+                    items:
+                      properties:
+                        deployer_email:
+                          type: string
+                        deployment_type:
+                          type: string
+                        env0_tag:
+                          type: string
+                        environment_id:
+                          type: string
+                        environment_name:
+                          type: string
+                        organization_id:
+                          type: string
+                        project_id:
+                          type: string
+                        project_name:
+                          type: string
+                        template_id:
+                          type: string
+                        template_name:
+                          type: string
+                        workspace_name:
+                          type: string
+                      type: object
+                    nullable: true
+                    type: array
+                type: object
               gcp:
                 description: GCP allows the configuration of options specific to the
                   "gcp" join method.
@@ -398,6 +434,15 @@ spec:
                       type: object
                     nullable: true
                     type: array
+                  oidc:
+                    description: OIDCConfig configures the `oidc` type.
+                    nullable: true
+                    properties:
+                      insecure_allow_http_issuer:
+                        type: boolean
+                      issuer:
+                        type: string
+                    type: object
                   static_jwks:
                     description: StaticJWKS is the configuration specific to the `static_jwks`
                       type.
@@ -409,7 +454,8 @@ spec:
                   type:
                     description: 'Type controls which behavior should be used for
                       validating the Kubernetes Service Account token. Support values:
-                      - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.'
+                      - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults
+                      to `in_cluster`.'
                     type: string
                 type: object
               oracle:
@@ -422,6 +468,11 @@ spec:
                       must match one allow rule to use this token.
                     items:
                       properties:
+                        instances:
+                          items:
+                            type: string
+                          nullable: true
+                          type: array
                         parent_compartments:
                           items:
                             type: string
@@ -467,6 +518,10 @@ spec:
                       type: object
                     nullable: true
                     type: array
+                  enable_glob_matching:
+                    description: EnableGlobMatching enables glob-style matching for
+                      the space_id and caller_id fields in the rules.
+                    type: boolean
                   hostname:
                     description: Hostname is the hostname of the Spacelift tenant
                       that tokens will originate from. E.g `example.app.spacelift.io`
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
index 09ce2f3da3ba5..43e41b8a7e869 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
@@ -305,6 +305,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -390,6 +405,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -901,6 +922,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -986,6 +1022,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -1794,6 +1836,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -1879,6 +1936,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -2390,6 +2453,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -2475,6 +2553,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv6.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv6.yaml
index 512eee6828114..43f1050b40222 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv6.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv6.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv7.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv7.yaml
index e72c51466862f..b5e2aa56a82ef 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv7.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv7.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv8.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv8.yaml
index c4847df93f7f0..a7a0bbc1b7785 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv8.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv8.yaml
@@ -308,6 +308,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -393,6 +408,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
@@ -904,6 +925,21 @@ spec:
                       type: string
                     nullable: true
                     type: array
+                  mcp:
+                    description: MCPPermissions defines MCP servers related permissions.
+                    nullable: true
+                    properties:
+                      tools:
+                        description: Tools defines the list of tools allowed or denied
+                          for this role. Each entry can be a literal string, a glob
+                          pattern (e.g. "prefix_*"), or a regular expression (must
+                          start with '^' and end with '$'). If the list is empty,
+                          no tools are allowed.
+                        items:
+                          type: string
+                        nullable: true
+                        type: array
+                    type: object
                   node_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
@@ -989,6 +1025,12 @@ spec:
                               or resources allowed by this role. It applies only to
                               users who have this role assigned.
                             type: string
+                          prompt:
+                            description: Prompt is a custom message prompted to the
+                              user for the requested roles or resources searchable
+                              as other roles. This is only applied to the requested
+                              roles and resources specifying the prompt.
+                            type: string
                         type: object
                       roles:
                         description: Roles is the name of roles which will match the
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_samlconnectors.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_samlconnectors.yaml
index caf7efa06472f..8b23b39d7cfb0 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_samlconnectors.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_samlconnectors.yaml
@@ -119,6 +119,12 @@ spec:
                 description: ForceAuthn specified whether re-authentication should
                   be forced on login. UNSPECIFIED is treated as NO.
                 x-kubernetes-int-or-string: true
+              include_subject:
+                description: 'IncludeSubject is a flag that indicates whether the
+                  Subject element is included in the SAML authentication request.
+                  Defaults to false. Note: Some IdPs will reject requests that contain
+                  a Subject.'
+                type: boolean
               issuer:
                 description: Issuer is the identity provider issuer.
                 type: string
@@ -197,6 +203,14 @@ spec:
               sso:
                 description: SSO is the URL of the identity provider's SSO service.
                 type: string
+              user_matchers:
+                description: UserMatchers is a set of glob patterns to narrow down
+                  which username(s) this auth connector should match for identifier-first
+                  login.
+                items:
+                  type: string
+                nullable: true
+                type: array
             type: object
           status:
             description: Status defines the observed state of the Teleport resource
diff --git a/integrations/operator/controllers/resources/appv3_controller.go b/integrations/operator/controllers/resources/appv3_controller.go
new file mode 100644
index 0000000000000..71297ea8ae786
--- /dev/null
+++ b/integrations/operator/controllers/resources/appv3_controller.go
@@ -0,0 +1,75 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package resources
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers"
+	"github.com/gravitational/teleport/integrations/operator/controllers/reconcilers"
+)
+
+// appClient implements TeleportResourceClient and offers CRUD methods needed to reconcile apps
+// Currently the same client is used by all app versions. If we need to treat
+// them differently at some point, for example by adding a Mutate function
+// functions, we can always split the client into separate clients.
+type appClient struct {
+	teleportClient *client.Client
+}
+
+// Get gets the Teleport app of a given name
+func (r appClient) Get(ctx context.Context, name string) (types.Application, error) {
+	app, err := r.teleportClient.GetApp(ctx, name)
+	return app, trace.Wrap(err)
+}
+
+// Create creates a Teleport app
+func (r appClient) Create(ctx context.Context, app types.Application) error {
+	return trace.Wrap(r.teleportClient.CreateApp(ctx, app))
+}
+
+// Update updates a Teleport app
+func (r appClient) Update(ctx context.Context, app types.Application) error {
+	return trace.Wrap(r.teleportClient.UpdateApp(ctx, app))
+}
+
+// Delete deletes a Teleport app
+func (r appClient) Delete(ctx context.Context, name string) error {
+	return trace.Wrap(r.teleportClient.DeleteApp(ctx, name))
+}
+
+// NewAppV3Reconciler instantiates a new Kubernetes controller reconciling app v6 resources
+func NewAppV3Reconciler(client kclient.Client, tClient *client.Client) (controllers.Reconciler, error) {
+	appClient := &appClient{
+		teleportClient: tClient,
+	}
+
+	resourceReconciler, err := reconcilers.NewTeleportResourceWithLabelsReconciler[types.Application, *resourcesv1.TeleportAppV3](
+		client,
+		appClient,
+	)
+
+	return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler")
+}
diff --git a/integrations/operator/controllers/resources/appv3_controller_test.go b/integrations/operator/controllers/resources/appv3_controller_test.go
new file mode 100644
index 0000000000000..d84c41822c466
--- /dev/null
+++ b/integrations/operator/controllers/resources/appv3_controller_test.go
@@ -0,0 +1,139 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package resources_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers/reconcilers"
+	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
+)
+
+var appV3Spec = types.AppSpecV3{
+	URI: "http://test.namespace.svc.cluster.local:8080",
+	Rewrite: &types.Rewrite{
+		Headers: []*types.Header{
+			{
+				Name:  "C-Custom-Header",
+				Value: "example",
+			},
+		},
+	},
+}
+
+type appV3TestingPrimitives struct {
+	setup *testSetup
+	reconcilers.ResourceWithLabelsAdapter[types.Application]
+}
+
+func (g *appV3TestingPrimitives) Init(setup *testSetup) {
+	g.setup = setup
+}
+
+func (g *appV3TestingPrimitives) SetupTeleportFixtures(ctx context.Context) error {
+	return nil
+}
+
+func (g *appV3TestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
+	meta := types.Metadata{
+		Name: name,
+	}
+	app, err := types.NewAppV3(meta, appV3Spec)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	app.SetOrigin(types.OriginKubernetes)
+	return trace.Wrap(g.setup.TeleportClient.CreateApp(ctx, app))
+}
+
+func (g *appV3TestingPrimitives) GetTeleportResource(ctx context.Context, name string) (types.Application, error) {
+	return g.setup.TeleportClient.GetApp(ctx, name)
+}
+
+func (g *appV3TestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
+	return trace.Wrap(g.setup.TeleportClient.DeleteApp(ctx, name))
+}
+
+func (g *appV3TestingPrimitives) CreateKubernetesResource(ctx context.Context, name string) error {
+	app := &resourcesv1.TeleportAppV3{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+		Spec: resourcesv1.TeleportAppV3Spec(appV3Spec),
+	}
+	return trace.Wrap(g.setup.K8sClient.Create(ctx, app))
+}
+
+func (g *appV3TestingPrimitives) DeleteKubernetesResource(ctx context.Context, name string) error {
+	app := &resourcesv1.TeleportAppV3{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+	}
+	return trace.Wrap(g.setup.K8sClient.Delete(ctx, app))
+}
+
+func (g *appV3TestingPrimitives) GetKubernetesResource(ctx context.Context, name string) (*resourcesv1.TeleportAppV3, error) {
+	app := &resourcesv1.TeleportAppV3{}
+	obj := kclient.ObjectKey{
+		Name:      name,
+		Namespace: g.setup.Namespace.Name,
+	}
+	err := g.setup.K8sClient.Get(ctx, obj, app)
+	return app, trace.Wrap(err)
+}
+
+func (g *appV3TestingPrimitives) ModifyKubernetesResource(ctx context.Context, name string) error {
+	app, err := g.GetKubernetesResource(ctx, name)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	app.Spec.Rewrite.Headers = append(app.Spec.Rewrite.Headers, &types.Header{Name: "Content-Type", Value: "application/json"})
+	return g.setup.K8sClient.Update(ctx, app)
+}
+
+func (g *appV3TestingPrimitives) CompareTeleportAndKubernetesResource(tResource types.Application, kubeResource *resourcesv1.TeleportAppV3) (bool, string) {
+	diff := cmp.Diff(tResource, kubeResource.ToTeleport(), testlib.CompareOptions()...)
+	return diff == "", diff
+}
+
+func TestTeleportAppV3Creation(t *testing.T) {
+	test := &appV3TestingPrimitives{}
+	testlib.ResourceCreationTest[types.Application, *resourcesv1.TeleportAppV3](t, test)
+}
+
+func TestTeleportAppV3DeletionDrift(t *testing.T) {
+	test := &appV3TestingPrimitives{}
+	testlib.ResourceDeletionDriftTest[types.Application, *resourcesv1.TeleportAppV3](t, test)
+}
+
+func TestTeleportAppV3Update(t *testing.T) {
+	test := &appV3TestingPrimitives{}
+	testlib.ResourceUpdateTest[types.Application, *resourcesv1.TeleportAppV3](t, test)
+}
diff --git a/integrations/operator/controllers/resources/databasev3_controller.go b/integrations/operator/controllers/resources/databasev3_controller.go
new file mode 100644
index 0000000000000..7987e3d434186
--- /dev/null
+++ b/integrations/operator/controllers/resources/databasev3_controller.go
@@ -0,0 +1,75 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package resources
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers"
+	"github.com/gravitational/teleport/integrations/operator/controllers/reconcilers"
+)
+
+// databaseClient implements TeleportResourceClient and offers CRUD methods needed to reconcile databases
+// Currently the same client is used by all database versions. If we need to treat
+// them differently at some point, for example by adding a Mutate function
+// functions, we can always split the client into separate clients.
+type databaseClient struct {
+	teleportClient *client.Client
+}
+
+// Get gets the Teleport database of a given name
+func (r databaseClient) Get(ctx context.Context, name string) (types.Database, error) {
+	database, err := r.teleportClient.GetDatabase(ctx, name)
+	return database, trace.Wrap(err)
+}
+
+// Create creates a Teleport database
+func (r databaseClient) Create(ctx context.Context, database types.Database) error {
+	return trace.Wrap(r.teleportClient.CreateDatabase(ctx, database))
+}
+
+// Update updates a Teleport database
+func (r databaseClient) Update(ctx context.Context, database types.Database) error {
+	return trace.Wrap(r.teleportClient.UpdateDatabase(ctx, database))
+}
+
+// Delete deletes a Teleport database
+func (r databaseClient) Delete(ctx context.Context, name string) error {
+	return trace.Wrap(r.teleportClient.DeleteDatabase(ctx, name))
+}
+
+// NewDatabaseV3Reconciler instantiates a new Kubernetes controller reconciling database v6 resources
+func NewDatabaseV3Reconciler(client kclient.Client, tClient *client.Client) (controllers.Reconciler, error) {
+	databaseClient := &databaseClient{
+		teleportClient: tClient,
+	}
+
+	resourceReconciler, err := reconcilers.NewTeleportResourceWithLabelsReconciler[types.Database, *resourcesv1.TeleportDatabaseV3](
+		client,
+		databaseClient,
+	)
+
+	return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler")
+}
diff --git a/integrations/operator/controllers/resources/databasev3_controller_test.go b/integrations/operator/controllers/resources/databasev3_controller_test.go
new file mode 100644
index 0000000000000..73c899da1a7da
--- /dev/null
+++ b/integrations/operator/controllers/resources/databasev3_controller_test.go
@@ -0,0 +1,132 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package resources_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers/reconcilers"
+	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
+)
+
+var databaseV3Spec = types.DatabaseSpecV3{
+	Protocol: types.DatabaseProtocolPostgreSQL,
+	URI:      "database.namespace.svc.cluster.local:5432",
+}
+
+type databaseV3TestingPrimitives struct {
+	setup *testSetup
+	reconcilers.ResourceWithLabelsAdapter[types.Database]
+}
+
+func (g *databaseV3TestingPrimitives) Init(setup *testSetup) {
+	g.setup = setup
+}
+
+func (g *databaseV3TestingPrimitives) SetupTeleportFixtures(ctx context.Context) error {
+	return nil
+}
+
+func (g *databaseV3TestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
+	meta := types.Metadata{
+		Name: name,
+	}
+	database, err := types.NewDatabaseV3(meta, databaseV3Spec)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	database.SetOrigin(types.OriginKubernetes)
+	return trace.Wrap(g.setup.TeleportClient.CreateDatabase(ctx, database))
+}
+
+func (g *databaseV3TestingPrimitives) GetTeleportResource(ctx context.Context, name string) (types.Database, error) {
+	return g.setup.TeleportClient.GetDatabase(ctx, name)
+}
+
+func (g *databaseV3TestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
+	return trace.Wrap(g.setup.TeleportClient.DeleteDatabase(ctx, name))
+}
+
+func (g *databaseV3TestingPrimitives) CreateKubernetesResource(ctx context.Context, name string) error {
+	database := &resourcesv1.TeleportDatabaseV3{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+		Spec: resourcesv1.TeleportDatabaseV3Spec(databaseV3Spec),
+	}
+	return trace.Wrap(g.setup.K8sClient.Create(ctx, database))
+}
+
+func (g *databaseV3TestingPrimitives) DeleteKubernetesResource(ctx context.Context, name string) error {
+	database := &resourcesv1.TeleportDatabaseV3{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+	}
+	return trace.Wrap(g.setup.K8sClient.Delete(ctx, database))
+}
+
+func (g *databaseV3TestingPrimitives) GetKubernetesResource(ctx context.Context, name string) (*resourcesv1.TeleportDatabaseV3, error) {
+	database := &resourcesv1.TeleportDatabaseV3{}
+	obj := kclient.ObjectKey{
+		Name:      name,
+		Namespace: g.setup.Namespace.Name,
+	}
+	err := g.setup.K8sClient.Get(ctx, obj, database)
+	return database, trace.Wrap(err)
+}
+
+func (g *databaseV3TestingPrimitives) ModifyKubernetesResource(ctx context.Context, name string) error {
+	database, err := g.GetKubernetesResource(ctx, name)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	database.Spec.Protocol = types.DatabaseProtocolMySQL
+	return g.setup.K8sClient.Update(ctx, database)
+}
+
+func (g *databaseV3TestingPrimitives) CompareTeleportAndKubernetesResource(tResource types.Database, kubeResource *resourcesv1.TeleportDatabaseV3) (bool, string) {
+	diff := cmp.Diff(tResource, kubeResource.ToTeleport(), testlib.CompareOptions()...)
+	return diff == "", diff
+}
+
+func TestTeleportDatabaseV3Creation(t *testing.T) {
+	test := &databaseV3TestingPrimitives{}
+	testlib.ResourceCreationTest[types.Database, *resourcesv1.TeleportDatabaseV3](t, test)
+}
+
+func TestTeleportDatabaseV3DeletionDrift(t *testing.T) {
+	test := &databaseV3TestingPrimitives{}
+	testlib.ResourceDeletionDriftTest[types.Database, *resourcesv1.TeleportDatabaseV3](t, test)
+}
+
+func TestTeleportDatabaseV3Update(t *testing.T) {
+	test := &databaseV3TestingPrimitives{}
+	testlib.ResourceUpdateTest[types.Database, *resourcesv1.TeleportDatabaseV3](t, test)
+}
diff --git a/integrations/operator/controllers/resources/rolev7_controller_test.go b/integrations/operator/controllers/resources/rolev7_controller_test.go
index c798a00f666d3..181c930b0ac76 100644
--- a/integrations/operator/controllers/resources/rolev7_controller_test.go
+++ b/integrations/operator/controllers/resources/rolev7_controller_test.go
@@ -63,7 +63,7 @@ func (g *roleV7TestingPrimitives) SetupTeleportFixtures(ctx context.Context) err
 }
 
 func (g *roleV7TestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	role, err := types.NewRoleWithVersion(name, types.V6, roleV6Spec)
+	role, err := types.NewRoleWithVersion(name, types.V7, roleV7Spec)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/integrations/operator/controllers/resources/rolev8_controller_test.go b/integrations/operator/controllers/resources/rolev8_controller_test.go
new file mode 100644
index 0000000000000..7ca36c297ab8d
--- /dev/null
+++ b/integrations/operator/controllers/resources/rolev8_controller_test.go
@@ -0,0 +1,147 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package resources_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers/reconcilers"
+	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
+)
+
+var roleV8Spec = types.RoleSpecV6{
+	Allow: types.RoleConditions{
+		Logins:           []string{"foo"},
+		KubernetesLabels: types.Labels{"env": {"dev", "prod"}},
+		KubernetesResources: []types.KubernetesResource{
+			{
+				Kind:      "*",
+				Namespace: "monitoring",
+				Name:      "^prometheus-.*",
+				// APIGroup is required for rolev8
+				APIGroup: "monitoring.coreos.com",
+			},
+		},
+	},
+	Deny: types.RoleConditions{},
+}
+
+type roleV8TestingPrimitives struct {
+	setup *testSetup
+	reconcilers.ResourceWithLabelsAdapter[types.Role]
+}
+
+func (g *roleV8TestingPrimitives) Init(setup *testSetup) {
+	g.setup = setup
+}
+
+func (g *roleV8TestingPrimitives) SetupTeleportFixtures(ctx context.Context) error {
+	return nil
+}
+
+func (g *roleV8TestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
+	role, err := types.NewRoleWithVersion(name, types.V8, roleV8Spec)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	role.SetOrigin(types.OriginKubernetes)
+	_, err = g.setup.TeleportClient.CreateRole(ctx, role)
+	return trace.Wrap(err)
+}
+
+func (g *roleV8TestingPrimitives) GetTeleportResource(ctx context.Context, name string) (types.Role, error) {
+	return g.setup.TeleportClient.GetRole(ctx, name)
+}
+
+func (g *roleV8TestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
+	return trace.Wrap(g.setup.TeleportClient.DeleteRole(ctx, name))
+}
+
+func (g *roleV8TestingPrimitives) CreateKubernetesResource(ctx context.Context, name string) error {
+	role := &resourcesv1.TeleportRoleV8{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+		Spec: resourcesv1.TeleportRoleV8Spec(roleV8Spec),
+	}
+	return trace.Wrap(g.setup.K8sClient.Create(ctx, role))
+}
+
+func (g *roleV8TestingPrimitives) DeleteKubernetesResource(ctx context.Context, name string) error {
+	role := &resourcesv1.TeleportRoleV8{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+	}
+	return trace.Wrap(g.setup.K8sClient.Delete(ctx, role))
+}
+
+func (g *roleV8TestingPrimitives) GetKubernetesResource(ctx context.Context, name string) (*resourcesv1.TeleportRoleV8, error) {
+	role := &resourcesv1.TeleportRoleV8{}
+	obj := kclient.ObjectKey{
+		Name:      name,
+		Namespace: g.setup.Namespace.Name,
+	}
+	err := g.setup.K8sClient.Get(ctx, obj, role)
+	return role, trace.Wrap(err)
+}
+
+func (g *roleV8TestingPrimitives) ModifyKubernetesResource(ctx context.Context, name string) error {
+	role, err := g.GetKubernetesResource(ctx, name)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	role.Spec.Allow.Logins = []string{"foo", "bar"}
+	return g.setup.K8sClient.Update(ctx, role)
+}
+
+func (g *roleV8TestingPrimitives) CompareTeleportAndKubernetesResource(tResource types.Role, kubeResource *resourcesv1.TeleportRoleV8) (bool, string) {
+	ignoreServerSideDefaults := []cmp.Option{
+		cmpopts.IgnoreFields(types.RoleSpecV6{}, "Options"),
+		cmpopts.IgnoreFields(types.RoleConditions{}, "Namespaces"),
+	}
+	diff := cmp.Diff(tResource, kubeResource.ToTeleport(), testlib.CompareOptions(ignoreServerSideDefaults...)...)
+	return diff == "", diff
+}
+
+func TestTeleportRoleV8Creation(t *testing.T) {
+	test := &roleV8TestingPrimitives{}
+	testlib.ResourceCreationTest[types.Role, *resourcesv1.TeleportRoleV8](t, test)
+}
+
+func TestTeleportRoleV8DeletionDrift(t *testing.T) {
+	test := &roleV8TestingPrimitives{}
+	testlib.ResourceDeletionDriftTest[types.Role, *resourcesv1.TeleportRoleV8](t, test)
+}
+
+func TestTeleportRoleV8Update(t *testing.T) {
+	test := &roleV8TestingPrimitives{}
+	testlib.ResourceUpdateTest[types.Role, *resourcesv1.TeleportRoleV8](t, test)
+}
diff --git a/integrations/operator/controllers/resources/rolevX_controller.go b/integrations/operator/controllers/resources/rolevX_controller.go
index 9cc847a2971e6..9f21c41b5ee48 100644
--- a/integrations/operator/controllers/resources/rolevX_controller.go
+++ b/integrations/operator/controllers/resources/rolevX_controller.go
@@ -104,3 +104,17 @@ func NewRoleV7Reconciler(client kclient.Client, tClient *client.Client) (control
 
 	return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler")
 }
+
+// NewRoleV8Reconciler instantiates a new Kubernetes controller reconciling role v8 resources
+func NewRoleV8Reconciler(client kclient.Client, tClient *client.Client) (controllers.Reconciler, error) {
+	roleClient := &roleClient{
+		teleportClient: tClient,
+	}
+
+	resourceReconciler, err := reconcilers.NewTeleportResourceWithLabelsReconciler[types.Role, *resourcesv1.TeleportRoleV8](
+		client,
+		roleClient,
+	)
+
+	return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler")
+}
diff --git a/integrations/operator/controllers/resources/setup.go b/integrations/operator/controllers/resources/setup.go
index 43eb6cc1b250c..0a1a20526ac9e 100644
--- a/integrations/operator/controllers/resources/setup.go
+++ b/integrations/operator/controllers/resources/setup.go
@@ -42,6 +42,7 @@ func SetupAllControllers(log logr.Logger, mgr manager.Manager, teleportClient *c
 		{"TeleportRole", NewRoleReconciler},
 		{"TeleportRoleV6", NewRoleV6Reconciler},
 		{"TeleportRoleV7", NewRoleV7Reconciler},
+		{"TeleportRoleV8", NewRoleV8Reconciler},
 		{"TeleportUser", NewUserReconciler},
 		{"TeleportGithubConnector", NewGithubConnectorReconciler},
 		{"TeleportProvisionToken", NewProvisionTokenReconciler},
@@ -52,6 +53,8 @@ func SetupAllControllers(log logr.Logger, mgr manager.Manager, teleportClient *c
 		{"TeleportWorkloadIdentityV1", NewWorkloadIdentityV1Reconciler},
 		{"TeleportAutoupdateConfigV1", NewAutoUpdateConfigV1Reconciler},
 		{"TeleportAutoupdateVersionV1", NewAutoUpdateVersionV1Reconciler},
+		{"TeleportAppV3", NewAppV3Reconciler},
+		{"TeleportDatabaseV3", NewDatabaseV3Reconciler},
 	}
 
 	oidc := modules.GetProtoEntitlement(features, entitlements.OIDC)
diff --git a/integrations/operator/controllers/resources/testlib/env.go b/integrations/operator/controllers/resources/testlib/env.go
index 1e8eaf4597be3..b5bde2934844b 100644
--- a/integrations/operator/controllers/resources/testlib/env.go
+++ b/integrations/operator/controllers/resources/testlib/env.go
@@ -55,8 +55,9 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers"
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // scheme is our own test-specific scheme to avoid using the global
@@ -97,7 +98,7 @@ func ValidRandomResourceName(prefix string) string {
 }
 
 func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -128,7 +129,9 @@ func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string)
 		Allow: types.RoleConditions{
 			// the operator has wildcard noe labs to be able to see them
 			// but has no login allowed, so it cannot SSH into them
-			NodeLabels: types.Labels{"*": []string{"*"}},
+			NodeLabels:     types.Labels{"*": []string{"*"}},
+			AppLabels:      types.Labels{"*": []string{"*"}},
+			DatabaseLabels: types.Labels{"*": []string{"*"}},
 			Rules: []types.Rule{
 				types.NewRule(types.KindRole, unrestricted),
 				types.NewRule(types.KindUser, unrestricted),
@@ -143,6 +146,8 @@ func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string)
 				types.NewRule(types.KindWorkloadIdentity, unrestricted),
 				types.NewRule(types.KindAutoUpdateConfig, unrestricted),
 				types.NewRule(types.KindAutoUpdateVersion, unrestricted),
+				types.NewRule(types.KindApp, unrestricted),
+				types.NewRule(types.KindDatabase, unrestricted),
 			},
 		},
 	})
@@ -213,7 +218,7 @@ func (s *TestSetup) StartKubernetesOperator(t *testing.T) {
 
 	slogLogger := s.log
 	if slogLogger == nil {
-		slogLogger = utils.NewSlogLoggerForTests()
+		slogLogger = logtest.NewLogger()
 	}
 
 	logger := logr.FromSlogHandler(slogLogger.Handler())
diff --git a/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go b/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go
index a3b1dc98de5ba..47abee4dbbdb0 100644
--- a/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go
+++ b/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go
@@ -42,7 +42,7 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type trustedClusterV2TestingPrimitives struct {
@@ -137,7 +137,7 @@ func (r *trustedClusterV2TestingPrimitives) setupTest(t *testing.T, clusterName
 		ClusterName: clusterName,
 		HostID:      uuid.New().String(),
 		NodeName:    helpers.Loopback,
-		Logger:      utils.NewSlogLoggerForTests(),
+		Logger:      logtest.NewLogger(),
 	})
 	r.remoteCluster = remoteCluster
 
diff --git a/integrations/operator/crdgen/format.go b/integrations/operator/crdgen/format.go
index b2193284c4271..56938ec51baa2 100644
--- a/integrations/operator/crdgen/format.go
+++ b/integrations/operator/crdgen/format.go
@@ -47,7 +47,6 @@ func formatAsCRD(crd apiextv1.CustomResourceDefinition, groupName, pluralName st
 var crdDocTmpl string = `---
 title: {{.Title}}
 description: {{.Description}}
-tocDepth: 3
 ---
 
 {/*Auto-generated file. Do not edit.*/}
diff --git a/integrations/operator/crdgen/handlerequest.go b/integrations/operator/crdgen/handlerequest.go
index 040f30e08f29a..29e5a3394b3aa 100644
--- a/integrations/operator/crdgen/handlerequest.go
+++ b/integrations/operator/crdgen/handlerequest.go
@@ -177,6 +177,8 @@ func generateSchema(file *File, groupName string, format crdFormatFunc, resp *go
 		// Role V7 and V8 is using the RoleV6 message
 		{name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V7), withVersionInKindOverride()}},
 		{name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V8), withVersionInKindOverride()}},
+		{name: "AppV3", opts: []resourceSchemaOption{withVersionOverride(types.V3), withVersionInKindOverride()}},
+		{name: "DatabaseV3", opts: []resourceSchemaOption{withVersionOverride(types.V3), withVersionInKindOverride()}},
 		{name: "SAMLConnectorV2"},
 		{name: "OIDCConnectorV3"},
 		{name: "GithubConnectorV3"},
diff --git a/integrations/operator/crdgen/ignored.go b/integrations/operator/crdgen/ignored.go
index 7b647756f12cc..8dfaceb2751e1 100644
--- a/integrations/operator/crdgen/ignored.go
+++ b/integrations/operator/crdgen/ignored.go
@@ -43,6 +43,8 @@ var ignoredFields = map[string]stringSet{
 		// Useless field for agentless servers, and potentially dangerous as it
 		// allows remote exec on agentful nodes.
 		"CmdLabels": struct{}{},
+		// Not intended for manual usage.
+		"component_features": struct{}{},
 	},
 	"TrustedClusterSpecV2": {
 		"Roles": struct{}{}, // Deprecated, use RoleMap instead.
diff --git a/integrations/operator/hack/fixture-operator-role.yaml b/integrations/operator/hack/fixture-operator-role.yaml
index f0c91a5db57f7..11c71c82b18d2 100644
--- a/integrations/operator/hack/fixture-operator-role.yaml
+++ b/integrations/operator/hack/fixture-operator-role.yaml
@@ -8,6 +8,10 @@ spec:
     # However, it has no login set, so it cannot SSH on them
     node_labels:
       "*": ["*"]
+    app_labels:
+      "*": ["*"]
+    db_labels:
+      "*": ["*"]
     rules:
       - resources:
           - role
@@ -97,6 +101,14 @@ spec:
           - read
           - update
           - delete
+      - resources:
+          - app
+        verbs:
+          - list
+          - create
+          - read
+          - update
+          - delete
       - resources:
           - autoupdate_version
         verbs:
@@ -113,5 +125,13 @@ spec:
           - read
           - update
           - delete
+      - resources:
+          - db
+        verbs:
+          - list
+          - create
+          - read
+          - update
+          - delete
   deny: {}
 version: v7
diff --git a/integrations/operator/main.go b/integrations/operator/main.go
index 391a57ce46cb6..067498eb68142 100644
--- a/integrations/operator/main.go
+++ b/integrations/operator/main.go
@@ -40,12 +40,11 @@ import (
 	"github.com/gravitational/teleport/integrations/lib/embeddedtbot"
 	"github.com/gravitational/teleport/integrations/operator/controllers"
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
-var (
-	scheme = controllers.Scheme
-)
+var scheme = controllers.Scheme
 
 var extraFields = []string{logutils.LevelField, logutils.ComponentField, logutils.TimestampField}
 
@@ -53,7 +52,7 @@ func main() {
 	ctx := ctrl.SetupSignalHandler()
 
 	// Setup early logger, using INFO level by default.
-	slogLogger, slogLeveler, err := logutils.Initialize(logutils.Config{
+	slogLogger, slogLeveler, _, err := logutils.Initialize(logutils.Config{
 		Severity:    slog.LevelInfo.String(),
 		Format:      "json",
 		ExtraFields: extraFields,
@@ -69,7 +68,7 @@ func main() {
 
 	config := &operatorConfig{}
 	config.BindFlags(flag.CommandLine)
-	botConfig := &embeddedtbot.BotConfig{}
+	botConfig := &embeddedtbot.BotConfig{Kind: bot.KindKubernetesOperator}
 	botConfig.BindFlags(flag.CommandLine)
 	flag.Parse()
 
diff --git a/integrations/teleport-spacelift-runner/Dockerfile b/integrations/teleport-spacelift-runner/Dockerfile
deleted file mode 100644
index 54624ab280e8e..0000000000000
--- a/integrations/teleport-spacelift-runner/Dockerfile
+++ /dev/null
@@ -1,42 +0,0 @@
-ARG BUILDBOX
-ARG BASE_IMAGE
-
-FROM $BUILDBOX-$TARGETARCH as builder
-
-WORKDIR /workspace
-
-# Copy the Go Modules manifests
-COPY go.mod go.mod
-COPY go.sum go.sum
-
-# We have to copy the API before `go mod download` because go.mod has a replace directive for it
-COPY api/ api/
-
-RUN go mod download
-
-# Copy in code
-COPY tool/tbot tool/tbot
-COPY lib/ lib/
-COPY api/ api/
-COPY gen/ gen/
-COPY build.assets/ build.assets/
-COPY entitlements/ entitlements/
-COPY *.go ./
-COPY Makefile Makefile
-COPY darwin-signing.mk darwin-signing.mk
-COPY common.mk common.mk
-
-RUN make build/tbot
-
-FROM $BASE_IMAGE
-# https://github.com/spacelift-io/runner-terraform/blob/main/Dockerfile
-
-# Switch to root so we can invoke chmod
-USER root
-
-# Copy in `tbot`
-COPY --from=builder /workspace/build/tbot /usr/local/bin
-RUN chmod 755 /usr/local/bin/tbot
-
-# Switch back to the default spacelift user.
-USER spacelift
diff --git a/integrations/teleport-spacelift-runner/Makefile b/integrations/teleport-spacelift-runner/Makefile
deleted file mode 100644
index 3d72cf62c427d..0000000000000
--- a/integrations/teleport-spacelift-runner/Makefile
+++ /dev/null
@@ -1,30 +0,0 @@
-# Image URL to use all building/pushing image targets
-IMG ?= teleport-spacelift-runner:latest
-BASE_IMAGE ?= public.ecr.aws/spacelift/runner-terraform:v1.4.2_20231120
-
-# Configure which compiler and buildbox to use
-OS ?= $(shell go env GOOS)
-# ARCH is the architecture of the current machine. For cross-compilation, use
-# TARGETARCH instead.
-ARCH ?= $(shell go env GOARCH)
-
-# include BUILDBOX_VERSION, BUILDBOX and BUILDBOX_variant variables
-include ../../build.assets/images.mk
-
-.PHONY: docker-build
-docker-build:
-	docker buildx build --platform="$(OS)/$(ARCH)" \
-		--build-arg BUILDBOX=$(BUILDBOX_CENTOS7_NOARCH) \
-		--build-arg BASE_IMAGE=$(BASE_IMAGE) \
-		--load \
-		-f ./Dockerfile \
-		-t $(IMG) \
-		 ../..
-
-.PHONY: docker-push
-docker-push:
-	docker push $(IMG)
-
-.PHONY:show-base-image
-show-base-image:
-	@echo "$(BASE_IMAGE)"
diff --git a/integrations/teleport-spacelift-runner/README.md b/integrations/teleport-spacelift-runner/README.md
deleted file mode 100644
index e32e2f164ffa6..0000000000000
--- a/integrations/teleport-spacelift-runner/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# teleport-spacelift-runner
-
-**⚠️ This image is deprecated as of Teleport V18.0.0 and will be removed in V19.0.0 ⚠️**
-
-See https://goteleport.com/docs/admin-guides/infrastructure-as-code/terraform-provider/spacelift/
-for instructions on migrating to the new supported way of using the `spacelift`
-join method with the Teleport Terraform provider.
-
----
-
-This Docker image is published for use as a custom image for Spacelift runs.
-
-It is based off the `public.ecr.aws/spacelift/runner-terraform` image and
-includes additionally `tbot` and any other dependencies required to run `tbot`.
-This allows Machine ID to be used to generate credentials on-the-fly for
-managing Teleport Clusters with Terraform.
diff --git a/integrations/terraform-mwi/CONTRIBUTING.md b/integrations/terraform-mwi/CONTRIBUTING.md
new file mode 100644
index 0000000000000..335d05e3da424
--- /dev/null
+++ b/integrations/terraform-mwi/CONTRIBUTING.md
@@ -0,0 +1,24 @@
+## Contributing
+
+### Testing local builds 
+
+Configure `dev_overrides` in `~/.terraformrc`, e.g:
+
+```hcl
+provider_installation {
+
+  dev_overrides {
+      "terraform.releases.teleport.dev/gravitational/teleportmwi" = "/Users/noah/code/teleport/integrations/terraform-mwi/build"
+  }
+
+  # For all other providers, install them directly from their origin provider
+  # registries as normal. If you omit this, Terraform will _only_ use
+  # the dev_overrides block, and so no other providers will be available.
+  direct {}
+}
+```
+
+and then run `make build`.
+
+See https://developer.hashicorp.com/terraform/cli/config/config-file#development-overrides-for-provider-developers
+for more information.
\ No newline at end of file
diff --git a/integrations/terraform-mwi/LICENSE b/integrations/terraform-mwi/LICENSE
new file mode 100644
index 0000000000000..261eeb9e9f8b2
--- /dev/null
+++ b/integrations/terraform-mwi/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/integrations/terraform-mwi/Makefile b/integrations/terraform-mwi/Makefile
new file mode 100644
index 0000000000000..d6e5b397aed6d
--- /dev/null
+++ b/integrations/terraform-mwi/Makefile
@@ -0,0 +1,80 @@
+VERSION ?= $(shell go run ../hack/get-version/get-version.go)
+
+OS ?= $(shell go env GOOS)
+ARCH ?= $(shell go env GOARCH)
+TERRAFORM_ARCH=$(OS)_$(ARCH)
+
+RELEASE = terraform-provider-teleportmwi-v$(VERSION)-$(OS)-$(ARCH)-bin
+
+BUILDDIR ?= build
+
+ADDFLAGS ?=
+BUILDFLAGS ?= $(ADDFLAGS) -trimpath -ldflags '-w -s'
+# CGO must NOT be enabled as hashicorp cloud does not support running providers using on CGO.
+CGOFLAG ?= CGO_ENABLED=0
+
+.PHONY: clean
+clean:
+	rm -rf $(BUILDDIR)/*
+	rm -rf $(RELEASE).tar.gz
+	go clean
+
+.PHONY: build
+build: clean
+# Turning off GOWORK to prevent missing package errors.
+	GOWORK=off GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -o $(BUILDDIR)/terraform-provider-teleportmwi $(BUILDFLAGS)
+
+build-darwin-universal: $(addprefix $(BUILDDIR)/terraform-provider-teleportmwi_,arm64 amd64)
+	lipo -create -output $(BUILDDIR)/terraform-provider-teleportmwi $^
+	rm -r $^ $(BUILDDIR)/$(OS)
+
+# Architecture-specific binaries for the universal binary are extracted from
+# the release tarball. make will not automatically build this; you will need
+# to run "make ARCH=amd64 release" and "make ARCH=arm64 release" first as is
+# done in the build workflow.
+$(BUILDDIR)/terraform-provider-teleportmwi_%: terraform-provider-teleportmwi-v$(VERSION)-$(OS)-%-bin.tar.gz
+	mkdir -p $(BUILDDIR)/$(OS)/$*
+	tar -xzf $< -C $(BUILDDIR)/$(OS)/$*
+	mv $(BUILDDIR)/$(OS)/$*/terraform-provider-teleportmwi $@
+
+# darwin-signed-build is a wrapper around the build target that ensures it is codesigned
+include ../../darwin-signing.mk
+.PHONY: darwin-signed-build
+darwin-signed-build: BINARIES=$(BUILDDIR)/terraform-provider-teleportmwi
+ifeq ($(OS)-$(ARCH),darwin-universal)
+darwin-signed-build: build-darwin-universal
+else
+darwin-signed-build: build
+endif
+	$(NOTARIZE_BINARIES)
+
+.PHONY: release
+ifeq ($(OS),darwin)
+release: darwin-signed-build
+else
+release: build
+endif
+	tar -C $(BUILDDIR) -czf $(RELEASE).tar.gz .
+
+PHONY: test
+test:
+	gotestsum --junitfile unit-tests-terraform-mwi.xml --jsonfile unit-tests-terraform-mwi.json
+
+PHONY: testacc
+testacc:
+	TF_ACC=1 go test -v -cover -timeout 120m ./...
+
+.PHONY: lint
+lint:
+	golangci-lint run -c ../../.golangci.yml
+
+.PHONY: docs
+docs: install
+	./gen/docs.sh $(VERSION)
+
+PROVIDER_PATH = ~/.terraform.d/plugins/terraform.releases.teleport.dev/gravitational/teleportmwi/$(VERSION)/$(TERRAFORM_ARCH)/
+
+.PHONY: install
+install: build
+	mkdir -p $(PROVIDER_PATH)
+	mv $(BUILDDIR)/terraform-provider-teleportmwi $(PROVIDER_PATH)
diff --git a/integrations/terraform-mwi/README.md b/integrations/terraform-mwi/README.md
new file mode 100644
index 0000000000000..760207b819cd8
--- /dev/null
+++ b/integrations/terraform-mwi/README.md
@@ -0,0 +1,12 @@
+# MWI Terraform Provider Plugin
+
+The MWI Terraform Provider Plugin provides ephemeral resources and data sources
+that can be used to provide other Terraform providers with access to resources
+through Teleport.
+
+This provider is work-in-progress and is not yet ready for production use.
+
+## Usage
+
+TODO: Link to official documentation.
+
diff --git a/integrations/terraform-mwi/build/.gitkeep b/integrations/terraform-mwi/build/.gitkeep
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/integrations/terraform-mwi/examples/data-sources/teleportmwi_kubernetes/data-source.tf b/integrations/terraform-mwi/examples/data-sources/teleportmwi_kubernetes/data-source.tf
new file mode 100644
index 0000000000000..9de67a867477f
--- /dev/null
+++ b/integrations/terraform-mwi/examples/data-sources/teleportmwi_kubernetes/data-source.tf
@@ -0,0 +1,19 @@
+// Warning: The teleportmwi_kubernetes data source will not function correctly
+// when the Teleport cluster is fronted by a L7 load balancer that terminates
+// TLS.
+data "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-k8s-cluster"
+  }
+  credential_ttl = "1h"
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = data.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = data.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = data.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = data.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = data.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
\ No newline at end of file
diff --git a/integrations/terraform-mwi/examples/ephemeral-resources/teleportmwi_kubernetes/ephemeral-resource.tf b/integrations/terraform-mwi/examples/ephemeral-resources/teleportmwi_kubernetes/ephemeral-resource.tf
new file mode 100644
index 0000000000000..0b4382bc59105
--- /dev/null
+++ b/integrations/terraform-mwi/examples/ephemeral-resources/teleportmwi_kubernetes/ephemeral-resource.tf
@@ -0,0 +1,19 @@
+// Warning: The teleportmwi_kubernetes ephemeral resource will not function
+// correctly when the Teleport cluster is fronted by a L7 load balancer that
+// terminates TLS.
+ephemeral "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-k8s-cluster"
+  }
+  credential_ttl = "1h"
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
\ No newline at end of file
diff --git a/integrations/terraform-mwi/gen/docs.sh b/integrations/terraform-mwi/gen/docs.sh
new file mode 100755
index 0000000000000..1ac132c660ff1
--- /dev/null
+++ b/integrations/terraform-mwi/gen/docs.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+# If someone runs a debug GitHub Actions task
+if [ -n "$RUNNER_DEBUG" ]; then
+  set -x
+fi
+set -euo pipefail
+
+info() {
+    printf "\e[1;32m%s\e[0m\n" "$1"
+}
+error() {
+    printf "\e[1;31m%s\e[0m\n" "$1"
+    exit 1
+}
+
+VERSION="$1"
+
+if [ -z "$VERSION" ]; then
+  error "Version parameter is required"
+fi
+
+TFDIR="$(pwd)"
+DOCSDIR="$(pwd)/../../docs/pages/reference/infrastructure-as-code/terraform-provider-mwi"
+TMPDIR="$(mktemp -d)"
+
+info "Generating provider's schema"
+
+pushd "$TMPDIR"
+cat > main.tf << EOF
+terraform {
+  required_providers {
+    teleportmwi = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleportmwi"
+      version = "= $VERSION"
+    }
+  }
+}
+EOF
+
+terraform init
+terraform providers schema -json > schema.json
+
+info "Rendering markdown files"
+
+popd
+go tool github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs generate \
+  --providers-schema "$TMPDIR/schema.json" \
+  --provider-name "terraform.releases.teleport.dev/gravitational/teleportmwi" \
+  --rendered-provider-name "teleportmwi" \
+  --rendered-website-dir="$TMPDIR/docs" \
+  --website-source-dir="$TFDIR/templates" \
+  --provider-dir "$TFDIR" \
+  --examples-dir="$TFDIR/examples" \
+  --website-temp-dir="$TMPDIR/temp" \
+  --hidden-attributes="id,kind,metadata.namespace,metadata.revision"
+
+info "Converting .md files to .mdx"
+
+cd "$TMPDIR/docs"
+find . -iname '*.md' -type f -exec sh -c 'i="$1"; mv "$i" "${i%.md}.mdx"' shell {} \;
+# renaming the resources and data-sources indexes because the names were reserved by the generator
+mv "$TMPDIR/docs/ephemeral-resources-index.mdx" "$TMPDIR/docs/ephemeral-resources/ephemeral-resources.mdx"
+mv "$TMPDIR/docs/data-sources-index.mdx" "$TMPDIR/docs/data-sources/data-sources.mdx"
+
+info "Copying generated documentation into the teleport docs directory"
+
+# Removing the apex terraform.mdx
+rm -rf "$DOCSDIR" "$DOCSDIR/terraform-provider.mdx"
+cp -r "$TMPDIR/docs" "$DOCSDIR"
+# unpacking the index to the apex terraform.mdx
+mv "$DOCSDIR/index.mdx" "$DOCSDIR/terraform-provider-mwi.mdx"
+
+info "TF documentation successfully generated"
diff --git a/integrations/terraform-mwi/go.mod b/integrations/terraform-mwi/go.mod
new file mode 100644
index 0000000000000..81fe25fffb32c
--- /dev/null
+++ b/integrations/terraform-mwi/go.mod
@@ -0,0 +1,561 @@
+module github.com/gravitational/teleport/integrations/terraform-mwi
+
+go 1.24.11
+
+require (
+	github.com/gravitational/teleport v0.0.0-00010101000000-000000000000
+	github.com/gravitational/teleport/api v0.0.0
+	github.com/gravitational/trace v1.5.1
+	github.com/hashicorp/terraform-plugin-framework v1.15.0
+	github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0
+	github.com/hashicorp/terraform-plugin-framework-validators v0.18.0
+	github.com/hashicorp/terraform-plugin-go v0.27.0
+	github.com/hashicorp/terraform-plugin-testing v1.13.1
+	github.com/jonboulle/clockwork v0.5.0
+	github.com/stretchr/testify v1.11.1
+	k8s.io/api v0.33.3
+	k8s.io/client-go v0.33.3
+)
+
+require (
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/alloydb v1.16.1 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/cloudsqlconn v1.17.1 // indirect
+	cloud.google.com/go/compute v1.38.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
+	cloud.google.com/go/container v1.43.0 // indirect
+	cloud.google.com/go/firestore v1.18.0 // indirect
+	cloud.google.com/go/iam v1.5.2 // indirect
+	cloud.google.com/go/kms v1.22.0 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/resourcemanager v1.10.6 // indirect
+	cloud.google.com/go/spanner v1.85.0 // indirect
+	cloud.google.com/go/storage v1.56.1 // indirect
+	connectrpc.com/connect v1.18.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	filippo.io/age v1.2.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v3 v3.3.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/ClickHouse/ch-go v0.66.0 // indirect
+	github.com/ClickHouse/clickhouse-go/v2 v2.35.0 // indirect
+	github.com/DanielTitkov/go-adaptive-cards v0.2.2 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
+	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
+	github.com/MakeNowJust/heredoc v1.0.0 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
+	github.com/agext/levenshtein v1.2.2 // indirect
+	github.com/alecthomas/kingpin/v2 v2.4.0 // indirect
+	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.39.6 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.77 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/athena v1.50.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dax v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.224.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.57.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/eks v1.64.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/elasticache v1.46.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/glue v1.113.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/iam v1.42.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rds v1.96.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
+	github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/beevik/etree v1.5.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bgentry/speakeasy v0.2.0 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.0 // indirect
+	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/charlievieth/strcase v0.0.5 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/creack/pty v1.1.24 // indirect
+	github.com/crewjam/httperr v0.2.0 // indirect
+	github.com/crewjam/saml v0.4.14 // indirect
+	github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/datastax/go-cassandra-native-protocol v0.0.0-20220706104457-5e8aad05cf90 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/di-wu/parser v0.3.0 // indirect
+	github.com/di-wu/xsd-datetime v1.0.0 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect
+	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
+	github.com/dmarkham/enumer v1.5.11 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/go-faster/city v1.0.1 // indirect
+	github.com/go-faster/errors v0.7.1 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-git/v5 v5.16.0 // indirect
+	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.11 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-mysql-org/go-mysql v1.9.1 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
+	github.com/go-resty/resty/v2 v2.16.5 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-webauthn/webauthn v0.11.2 // indirect
+	github.com/go-webauthn/x v0.1.21 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/gocql/gocql v1.7.0 // indirect
+	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/certificate-transparency-go v1.3.1 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/go-attestation v0.5.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
+	github.com/google/go-github/v70 v70.0.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-tpm v0.9.5 // indirect
+	github.com/google/go-tpm-tools v0.4.5 // indirect
+	github.com/google/go-tspi v0.3.0 // indirect
+	github.com/google/renameio/v2 v2.0.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/gosuri/uitable v0.0.4 // indirect
+	github.com/grafana/pyroscope-go v1.2.4 // indirect
+	github.com/grafana/pyroscope-go/godeltaprof v0.1.8 // indirect
+	github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
+	github.com/gravitational/roundtrip v1.0.3 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
+	github.com/hashicorp/cli v1.1.7 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-cty v1.5.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-plugin v1.6.3 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/hc-install v0.9.2 // indirect
+	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
+	github.com/hashicorp/logutils v1.0.0 // indirect
+	github.com/hashicorp/terraform-exec v0.23.0 // indirect
+	github.com/hashicorp/terraform-json v0.25.0 // indirect
+	github.com/hashicorp/terraform-plugin-docs v0.0.0-00010101000000-000000000000 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
+	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/in-toto/attestation v1.1.1 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
+	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
+	github.com/jackc/pgconn v1.14.3 // indirect
+	github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438 // indirect
+	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgtype v1.14.4 // indirect
+	github.com/jackc/pgx/v4 v4.18.3 // indirect
+	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
+	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
+	github.com/jcmturner/gofork v1.7.6 // indirect
+	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
+	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
+	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
+	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
+	github.com/jmoiron/sqlx v1.4.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/julienschmidt/httprouter v1.3.0 // indirect
+	github.com/kelseyhightower/envconfig v1.4.0 // indirect
+	github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/kr/fs v0.1.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
+	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mark3labs/mcp-go v0.41.1 // indirect
+	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/mattn/go-sqlite3 v1.14.28 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/microsoft/go-mssqldb v1.8.1 // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/montanaflynn/stats v0.7.1 // indirect
+	github.com/muhlemmer/gu v0.3.1 // indirect
+	github.com/muhlemmer/httpforwarded v0.1.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/ohler55/ojg v1.26.8 // indirect
+	github.com/oklog/run v1.0.0 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/okta/okta-sdk-golang/v2 v2.20.0 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/openai/openai-go v1.8.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
+	github.com/opensearch-project/opensearch-go/v2 v2.3.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/oracle/oci-go-sdk/v65 v65.92.0 // indirect
+	github.com/parquet-go/parquet-go v0.25.0 // indirect
+	github.com/pascaldekloe/name v1.0.1 // indirect
+	github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible // indirect
+	github.com/paulmach/orb v0.11.1 // indirect
+	github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb // indirect
+	github.com/pingcap/log v1.1.1-0.20230317032135-a0d097d16e22 // indirect
+	github.com/pingcap/tidb/pkg/parser v0.0.0-20240930120915-74034d4ac243 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/sftp v1.13.9 // indirect
+	github.com/pkoukk/tiktoken-go v0.1.8 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/posener/complete v1.2.3 // indirect
+	github.com/pquerna/otp v1.5.0 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/quic-go/quic-go v0.57.0 // indirect
+	github.com/redis/go-redis/v9 v9.12.1 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rs/cors v1.11.1 // indirect
+	github.com/rs/zerolog v1.28.0 // indirect
+	github.com/rubenv/sql-migrate v1.8.0 // indirect
+	github.com/russellhaering/gosaml2 v0.10.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/sassoftware/relic v7.2.1+incompatible // indirect
+	github.com/schollz/progressbar/v3 v3.18.0 // indirect
+	github.com/scim2/filter-parser/v2 v2.2.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 // indirect
+	github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 // indirect
+	github.com/sigstore/protobuf-specs v0.5.0 // indirect
+	github.com/sigstore/rekor v1.4.1 // indirect
+	github.com/sigstore/sigstore v1.9.5 // indirect
+	github.com/sigstore/sigstore-go v1.0.0 // indirect
+	github.com/sigstore/timestamp-authority v1.2.7 // indirect
+	github.com/sijms/go-ora/v2 v2.8.24 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sony/gobreaker v0.5.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.12.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/spf13/viper v1.20.1 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/thales-e-security/pool v0.0.2 // indirect
+	github.com/theupdateframework/go-tuf v0.7.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.1.1 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/transparency-dev/merkle v0.0.2 // indirect
+	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
+	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/vulcand/predicate v1.2.0 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
+	github.com/yuin/goldmark-meta v1.1.0 // indirect
+	github.com/zclconf/go-cty v1.17.0 // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
+	github.com/zitadel/logging v0.6.2 // indirect
+	github.com/zitadel/oidc/v3 v3.43.0 // indirect
+	github.com/zitadel/schema v1.3.1 // indirect
+	gitlab.com/gitlab-org/api/client-go v0.129.0 // indirect
+	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.0 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.0 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.0 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/api v0.248.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	helm.sh/helm/v3 v3.18.5 // indirect
+	k8s.io/apiextensions-apiserver v0.33.3 // indirect
+	k8s.io/apimachinery v0.33.3 // indirect
+	k8s.io/apiserver v0.33.3 // indirect
+	k8s.io/cli-runtime v0.33.3 // indirect
+	k8s.io/component-base v0.33.3 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/kubectl v0.33.3 // indirect
+	k8s.io/metrics v0.33.3 // indirect
+	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
+	mvdan.cc/sh/v3 v3.7.0 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
+	sigs.k8s.io/controller-runtime v0.21.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/kustomize/api v0.19.0 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+	software.sslmate.com/src/go-pkcs12 v0.5.0 // indirect
+)
+
+replace (
+	github.com/gravitational/teleport => ../..
+	github.com/gravitational/teleport/api => ../../api
+)
+
+// replace statements from teleport
+replace (
+	github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
+	github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
+	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2
+	github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4
+	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-teleport.2
+	github.com/hinshun/vt10x => github.com/gravitational/vt10x v0.0.3-teleport.1
+	github.com/julienschmidt/httprouter => github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5
+	github.com/keys-pub/go-libfido2 => github.com/gravitational/go-libfido2 v1.5.3-teleport.1
+	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v1.8.1-teleport.2
+	github.com/opencontainers/selinux => github.com/gravitational/selinux v1.13.0-teleport
+	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.2
+)
+
+// Doc generation tooling.
+// (using our fork of github.com/hashicorp/terraform-plugin-docs)
+tool github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
+
+replace github.com/hashicorp/terraform-plugin-docs => github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8
diff --git a/integrations/terraform-mwi/go.sum b/integrations/terraform-mwi/go.sum
new file mode 100644
index 0000000000000..37e69d0bd7f2b
--- /dev/null
+++ b/integrations/terraform-mwi/go.sum
@@ -0,0 +1,1798 @@
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go/alloydb v1.16.1 h1:pW4D0O2jAfAjoOEI1bgChPwMHWE8X8BjwSO0tfWkWvk=
+cloud.google.com/go/alloydb v1.16.1/go.mod h1:zeZuGJ5mEaQE70FMXEvZIp5hQLR9yrGnHo1YUOncWRY=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/cloudsqlconn v1.17.1 h1:jnBDOtliNASkHivU+gIs8Hk9govggDD0UYO1e/MnrYg=
+cloud.google.com/go/cloudsqlconn v1.17.1/go.mod h1:jfz0XbsYVQAfwbK4hFCjpgPnyQyA7sOektt2t2hXw3o=
+cloud.google.com/go/compute v1.38.0 h1:MilCLYQW2m7Dku8hRIIKo4r0oKastlD74sSu16riYKs=
+cloud.google.com/go/compute v1.38.0/go.mod h1:oAFNIuXOmXbK/ssXm3z4nZB8ckPdjltJ7xhHCdbWFZM=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
+cloud.google.com/go/container v1.43.0 h1:A6J92FJPfxTvyX7MHF+w4t2W9WCqvHOi9UB5SAeSy3w=
+cloud.google.com/go/container v1.43.0/go.mod h1:ETU9WZ1KM9ikEKLzrhRVao7KHtalDQu6aPqM34zDr/U=
+cloud.google.com/go/firestore v1.18.0 h1:cuydCaLS7Vl2SatAeivXyhbhDEIR8BDmtn4egDhIn2s=
+cloud.google.com/go/firestore v1.18.0/go.mod h1:5ye0v48PhseZBdcl0qbl3uttu7FIEwEYVaWm0UIEOEU=
+cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
+cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
+cloud.google.com/go/kms v1.22.0 h1:dBRIj7+GDeeEvatJeTB19oYZNV0aj6wEqSIT/7gLqtk=
+cloud.google.com/go/kms v1.22.0/go.mod h1:U7mf8Sva5jpOb4bxYZdtw/9zsbIjrklYwPcvMk34AL8=
+cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
+cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
+cloud.google.com/go/pubsub v1.50.0 h1:hnYpOIxVlgVD1Z8LN7est4DQZK3K6tvZNurZjIVjUe0=
+cloud.google.com/go/pubsub v1.50.0/go.mod h1:Di2Y+nqXBpIS+dXUEJPQzLh8PbIQZMLE9IVUFhf2zmM=
+cloud.google.com/go/pubsub/v2 v2.0.0 h1:0qS6mRJ41gD1lNmM/vdm6bR7DQu6coQcVwD+VPf0Bz0=
+cloud.google.com/go/pubsub/v2 v2.0.0/go.mod h1:0aztFxNzVQIRSZ8vUr79uH2bS3jwLebwK6q1sgEub+E=
+cloud.google.com/go/resourcemanager v1.10.6 h1:LIa8kKE8HF71zm976oHMqpWFiaDHVw/H1YMO71lrGmo=
+cloud.google.com/go/resourcemanager v1.10.6/go.mod h1:VqMoDQ03W4yZmxzLPrB+RuAoVkHDS5tFUUQUhOtnRTg=
+cloud.google.com/go/spanner v1.85.0 h1:VVO3yW+0+Yx9tg4SQaZvJHGAnU6qCnGXQ3NX4E3+src=
+cloud.google.com/go/spanner v1.85.0/go.mod h1:9zhmtOEoYV06nE4Orbin0dc/ugHzZW9yXuvaM61rpxs=
+cloud.google.com/go/storage v1.56.1 h1:n6gy+yLnHn0hTwBFzNn8zJ1kqWfR91wzdM8hjRF4wP0=
+cloud.google.com/go/storage v1.56.1/go.mod h1:C9xuCZgFl3buo2HZU/1FncgvvOgTAs/rnh4gF4lMg0s=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
+code.dny.dev/ssrf v0.2.0 h1:wCBP990rQQ1CYfRpW+YK1+8xhwUjv189AQ3WMo1jQaI=
+code.dny.dev/ssrf v0.2.0/go.mod h1:B+91l25OnyaLIeCx0WRJN5qfJ/4/ZTZxRXgm0lj/2w8=
+connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
+connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
+filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
+github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
+github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 h1:Hr5FTipp7SL07o2FvoVOX9HRiRH3CR3Mj8pxqCcdD5A=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2/go.mod h1:QyVsSSN64v5TGltphKLQ2sQxe4OBQg0J1eKRcVBnfgE=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 h1:MhRfI58HblXzCtWEZCO0feHs8LweePB3s90r7WaR1KU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0/go.mod h1:okZ+ZURbArNdlJ+ptXoyHNuOETzOl1Oww19rm8I2WLA=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 h1:Hp+EScFOu9HeCbeW8WU2yQPJd4gGwhMgKxWe+G6jNzw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0/go.mod h1:/pz8dyNQe+Ey3yBp/XuYz7oqX8YDNWVpPB0hH3XWfbc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 h1:z7Mqz6l0EFH549GvHEqfjKvi+cRScxLWbaoeLm9wxVQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0/go.mod h1:v6gbfH+7DG7xH2kUNs+ZJ9tF6O3iNnR85wMtmr+F54o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v5 v5.0.0 h1:5n7dPVqsWfVKw+ZiEKSd3Kzu7gwBkbEBkeXb8rgaE9Q=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v5 v5.0.0/go.mod h1:HcZY0PHPo/7d75p99lB6lK0qYOP4vLRJUBpiehYXtLQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0 h1:xkWEcbsnJWid3rOf/S/LOHy1I55JA+4kw/f8Tnm+Onc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0/go.mod h1:OWKfCmX4X3Vp2w7GSx1LZn8566tOHJBA6K0IAUVNYx0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0/go.mod h1:AW8VEadnhw9xox+VaVd9sP7NjzOAnaZBLRH6Tq3cJ38=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0 h1:z4YeiSXxnUI+PqB46Yj6MZA3nwb1CcJIkEMDrzUd8Cs=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0/go.mod h1:rko9SzMxcMk0NJsNAxALEGaTYyy79bNRwxgJfrH0Spw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql v1.2.0 h1:dhywcZH9yPDIje9aTqwy6psZSPzI6CJLYEprDahIBSQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql v1.2.0/go.mod h1:6z3b+JdBLH0eMzfBex/cvEIoEFVEwXuB0wbgdfN11iM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.2.0 h1:3jDMffAwnvs6qmOqhjNVHB29AKxs6brnzJeo65E1YwM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.2.0/go.mod h1:0mKVz3WT8oNjBunT1zD/HPwMleQ72QClMa7Gmsm+6Kc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.2.0 h1:0hXKrsbh2M6CQyW0TDC9Bsyd99vQmrOxiBTUfQHZjPA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.2.0/go.mod h1:bvZZor36Jg9q9kouuMyfJ+ay77+qK+YUfThXH1FdXjU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0 h1:HzqcSJWx32XQdr8KtxAu/SZJj0PqDo9tKf2YGPdynV0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0/go.mod h1:nKcJObAisSPDrO9lMuuCBoYY7Ki7ADt8p6XmBhpKNTk=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v3 v3.3.0 h1:EkL5dmUoy1OlzVfsbkcHayOvOJgheyRYL3wM/RHizzg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v3 v3.3.0/go.mod h1:DiazWkJHUUKUZGpIdV7JhDTjebBxdfsJ386dE5w7G3o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0 h1:hTmVmyvriwO+ymGLEsH7HZokVwinC2MZl8F0LjvPdHU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0/go.mod h1:uHEpZj4TWSZEp35rIByJ8RX7hQBm3bxfPxS4tiz+x+g=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 h1:S087deZ0kP1RUg4pU7w9U9xpUedTCbOtz+mnd0+hrkQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0/go.mod h1:B4cEyXrWBmbfMDAPnpJ1di7MAt5DKP57jPEObAvZChg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0 h1:LR0kAX9ykz8G4YgLCaRDVJ3+n43R8MneB5dTy2konZo=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0/go.mod h1:DWAciXemNf++PQJLeXUB4HHH5OpsAh12HZnu2wXE1jA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 h1:lhZdRq7TIx0GJQvSyX2Si406vrYsov2FXGp/RnSEtcs=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1/go.mod h1:8cl44BDmi+effbARHMQjgOKA2AYvcohNm7KEt42mSV8=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/ClickHouse/ch-go v0.66.0 h1:hLslxxAVb2PHpbHr4n0d6aP8CEIpUYGMVT1Yj/Q5Img=
+github.com/ClickHouse/ch-go v0.66.0/go.mod h1:noiHWyLMJAZ5wYuq3R/K0TcRhrNA8h7o1AqHX0klEhM=
+github.com/ClickHouse/clickhouse-go/v2 v2.35.0 h1:ZMLZqxu+NiW55f4JS32kzyEbMb7CthGn3ziCcULOvSE=
+github.com/ClickHouse/clickhouse-go/v2 v2.35.0/go.mod h1:O2FFT/rugdpGEW2VKyEGyMUWyQU0ahmenY9/emxLPxs=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/DanielTitkov/go-adaptive-cards v0.2.2 h1:tBFExyvsbCcrBJEvPaV3FW4gcAkwQjXFKiKEBrE7Yuw=
+github.com/DanielTitkov/go-adaptive-cards v0.2.2/go.mod h1:RtCzt65p/zEos6+zhiCFQmiaHmro6M63l9NP7xXx/Lg=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 h1:2afWGsMzkIcN8Qm4mgPJKZWyroE5QBszMiDMYEBrnfw=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
+github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
+github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
+github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
+github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
+github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
+github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
+github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
+github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
+github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
+github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
+github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis/v2 v2.34.0 h1:mBFWMaJSNL9RwdGRyEDoAAv8OQc5UlEhLDQggTglU/0=
+github.com/alicebob/miniredis/v2 v2.34.0/go.mod h1:kWShP4b58T1CW0Y5dViCd5ztzrDqRWqM3nksiyXk5s8=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/apache/arrow-go/v18 v18.0.0 h1:1dBDaSbH3LtulTyOVYaBCHO3yVRwjV+TZaqn3g6V7ZM=
+github.com/apache/arrow-go/v18 v18.0.0/go.mod h1:t6+cWRSmKgdQ6HsxisQjok+jBpKGhRDiqcf3p0p/F+A=
+github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2 h1:Y7QB6jUsMyr0Bd+rAj67X2/ezNYLuxwp3kkjw5M3Q+4=
+github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2/go.mod h1:0rEApF1YBHGuZ4C8OYI9q5oDBVpgqtRqYATePl9mCDk=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk=
+github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
+github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0 h1:F3W0YqWZrpCcelbvXMP9LWSTOI620aAq1+8fZ/71TBg=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0/go.mod h1:34X+UzFJwsQfyk5U1hYiCO/gv9ZVL+Hh8w+bJQ6+HbU=
+github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0 h1:0LLh3sbmWgsUqUj/JZRvzmejQwlllh1HgHQoTzAIEcc=
+github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0/go.mod h1:to2lbD07ti4RR8JRgaYEFKan5XekRCmWxCZXlZvp6gQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
+github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 h1:qDk85oQdhwP4NR1RpkN+t40aN46/K96hF9J1vDRrkKM=
+github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11/go.mod h1:f3MkXuZsT+wY24nLIP+gFUuIVQkpVopxbpUD/GUZK0Q=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.77 h1:xaRN9fags7iJznsMEjtcEuON1hGfCZ0y5MVfEMKtrx8=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.77/go.mod h1:lolsiGkT47AZ3DWqtxgEQM/wVMpayi7YWNjl3wHSRx8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
+github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.1 h1:LwY0saNiO7mUY+ijzC6FUX2wWdYkyDOAFSe4xJbbp7k=
+github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.1/go.mod h1:Ie/714qgv6ohupWHUxe/6oyAfiCdq9vVJrp+TnJrcqs=
+github.com/aws/aws-sdk-go-v2/service/athena v1.50.5 h1:jtjq2nXMt8eSB4gTcZwjbKURjrpKJuSQ5LVspf/hiJ4=
+github.com/aws/aws-sdk-go-v2/service/athena v1.50.5/go.mod h1:xsG8Y2fMenmHTdukyknTUO1uQhEZ/entaNHvPmD1klE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 h1:xdYdX+JpIFByMG8JQe9iWM9CqepyjhenukxTVQnuCbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0/go.mod h1:c1Ik+59wgLIJFhsSY8cAnw6QooiogpTZKP0rtkVcpCQ=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9 h1:+NSIzl59vBK3g3nLUuLSb/I2F2OIucW6hX/B+NAPWDg=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9/go.mod h1:9/Q0/HtqBTLMksFse42wZjUq0jJrUuo4XlnXy/uSoeg=
+github.com/aws/aws-sdk-go-v2/service/dax v1.24.2 h1:QFdCeROg/LwFkKOpM4TrzOPt9vcsbuu2WibzjiKTZqA=
+github.com/aws/aws-sdk-go-v2/service/dax v1.24.2/go.mod h1:FTMIKMqG/2AiO0P1LSCN6PeY4BNkQcxAzPSpne6oE6w=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1 h1:YYjNTAyPL0425ECmq6Xm48NSXdT6hDVQmLOJZxyhNTM=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1/go.mod h1:yYaWRnVSPyAmexW5t7G3TcuYoalYfT+xQwzWsvtUQ7M=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.3 h1:GHC1WTF3ZBZy+gvz2qtYB6ttALVx35hlwc4IzOIUY7g=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.3/go.mod h1:lUqWdw5/esjPTkITXhN4C66o1ltwDq2qQ12j3SOzhVg=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.224.0 h1:i7FB/N5pSvEzNOGHm7n6KQiBx2/X8UkrE/Ppb5Bh3QQ=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.224.0/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 h1:se3+XU16LNr8JoHdJBrBNJKvn1dnJcnW3qRlo5g2vKI=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2/go.mod h1:OCIzmvYHkq7q6zRwmTyBjWSsE4EfLRtbEoAEgY+iFD4=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.57.1 h1:XtNXJyT1WanVvCxd7kRKqE9KX+xyQfmRc+uqAglXeTw=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.57.1/go.mod h1:wAtdeFanDuF9Re/ge4DRDaYe3Wy1OGrU7jG042UcuI4=
+github.com/aws/aws-sdk-go-v2/service/eks v1.64.0 h1:EYeOThTRysemFtC6J6h6b7dNg3jN03QuO5cg92ojIQE=
+github.com/aws/aws-sdk-go-v2/service/eks v1.64.0/go.mod h1:v1xXy6ea0PHtWkjFUvAUh6B/5wv7UF909Nru0dOIJDk=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.46.0 h1:UficfhqlA7k0zQ/x9pNKmyIIeHfvJUfdbzOQJKGJkt8=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.46.0/go.mod h1:477YEP4FkrM0oUcw+w4vk4+XTB7WacLzPGPFj69kwkg=
+github.com/aws/aws-sdk-go-v2/service/glue v1.113.0 h1:ceM8p2ApgB7vAV90rEfCU5wyj/IOtYBE23twMegak7M=
+github.com/aws/aws-sdk-go-v2/service/glue v1.113.0/go.mod h1:6FqWCqW0Py6VOvY42NQyf9e7N+sNVnDEiHFklCCCoQc=
+github.com/aws/aws-sdk-go-v2/service/iam v1.42.0 h1:G6+UzGvubaet9QOh0664E9JeT+b6Zvop3AChozRqkrA=
+github.com/aws/aws-sdk-go-v2/service/iam v1.42.0/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.3 h1:zQMIlYXYHFzrurTKozpXFTGs0M5kwWgG8jL8EKGp8xg=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.3/go.mod h1:7nGvrQXBNp7k5yYpwpmxGucYTPY39d0cxjmANAeWwYE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 h1:BCG7DCXEXpNCcpwCxg1oi9pkJWH2+eZzTn9MY56MbVw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 h1:M1R1rud7HzDrfCdlBQ7NjnRsDNEhXO/vGhuD189Ggmk=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15/go.mod h1:uvFKBSq9yMPV4LGAi7N4awn4tLY+hKE35f8THes2mzQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 h1:Z95XCqqSnwXr0AY7PgsiOUBhUG2GoDM5getw6RfD1Lg=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0/go.mod h1:DqcSngL7jJeU1fOzh5Ll5rSvX/MlMV6OZlE4mVdFAQc=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2 h1:z926KZ1Ysi8Mbi4biJSAIRFdKemwQpO9M0QUTRLDaXA=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2/go.mod h1:c27kk10S36lBYgbG1jR3opn4OAS5Y/4wjJa1GiHK/X4=
+github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 h1:ggjjmfNX+nlv+nWHXOLr1pl36buP25Y9GZBEPMSofGw=
+github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0/go.mod h1:pfuDC5zBwunXdE44WT1PRbtzuXWGohKFcFLtv+ezI6k=
+github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 h1:vWClqL1dTCuPtWkaGDW7Y6P9ocqHtfFrjlkWYARm1qI=
+github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3/go.mod h1:51rUy2+lDiOQVlekScV044he709HMMhCdUDHqSBojgg=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 h1:rAUHsUFmux71j/4wQ5nUHsXyJxSMRgMlDnmFfahDhSk=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3/go.mod h1:iYC/SPpI4WveHr4ZzPFWTmXRODyJub5Aif75W7Ll+yM=
+github.com/aws/aws-sdk-go-v2/service/rds v1.96.0 h1:fiPuUrcO7GCZjP73NK2i0l2RQ1KY1xqoGcJyGcIikZ4=
+github.com/aws/aws-sdk-go-v2/service/rds v1.96.0/go.mod h1:CXiHj5rVyQ5Q3zNSoYzwaJfWm8IGDweyyCGfO8ei5fQ=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 h1:LNOKEsPjtoBrV2WYUb2zPLOOtD5sKt907LZ/h0cYHSk=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3/go.mod h1:TC8pNvjiikrjpX2MEzX/cEJ4/T4XIoSY4BskVvHj8bk=
+github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.2 h1:MSJQFSAZRhm8rWJ799PfjeBsXAvZfcblNT9fZ1rZF0M=
+github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.2/go.mod h1:gpRsJN3qxZbsj1NhAoCNX02zJ4RZUB5v/7o4QrnGTcA=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 h1:QqXnA7s6sxFe6B6dkocEfZ9ap1bAmEXp4W32n9n+cmU=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4/go.mod h1:cgPfPTC/V3JqwCKed7Q6d0FrgarV7ltz4Bz6S4Q+Dqk=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 h1:0LBxtAX2bHcfPr6VSzQSvJlR1nzlna7xp031gEjbWGU=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2/go.mod h1:NW+LcIadUUlDgM3gb8+97lr6zSKExHR58NRRWSWkXl8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0 h1:fV4XIU5sn/x8gjRouoJpDVHj+ExJaUk4prYF+eb6qTs=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0/go.mod h1:qbn305Je/IofWBJ4bJz/Q7pDEtnnoInw/dGt71v6rHE=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 h1:EKXYJ8kgz4fiqef8xApu7eH0eae2SrVG+oHCLFybMRI=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4/go.mod h1:yGhDiLKguA3iFJYxbrQkQiNzuy+ddxesSZYWVeeEH5Q=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 h1:ihddI5wufQQCJiujUgAvWRqZcfDmSKIfXlAuX7T95cg=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.4/go.mod h1:PJtxxMdj747j8DeZENRTTYAz/lx/pADn/U0k7YNNiUY=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 h1:KNgVWw8qbPzjYnIF1gL0EAszy6VKGnmUK6VSm1huYY8=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 h1:KWArCwA/WkuHWKfygkNz0B6YS6OvdgoJUaJHX0Qby1s=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
+github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.31.0 h1:mBlGhCX5dS6Z1qUiVMrUFaAZiZZ5ARYTrKLOBGfq0EU=
+github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.31.0/go.mod h1:znVkl7Y14sZKEL/sbRQ6qgD8wj8VdTcVVQp5iRaKXcc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
+github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 h1:Gx4ipHtKfaABSHAVo4Zjo2E4ClKzYqZ2NrPO0gy6qvY=
+github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4/go.mod h1:nnwXv9COKyqd4q7jpPrxRaW9L+Qfwb4aGTdZqsIpOho=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
+github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
+github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
+github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
+github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/bufbuild/protocompile v0.10.0 h1:+jW/wnLMLxaCEG8AX9lD0bQ5v9h1RUiMKOBOT5ll9dM=
+github.com/bufbuild/protocompile v0.10.0/go.mod h1:G9qQIQo0xZ6Uyj6CMNz0saGmx2so+KONo8/KrELABiY=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/buildkite/bintest/v3 v3.3.0 h1:RTWcSaJRlOT6t/K311ejPf+0J3LE/QEODzVG3vlLnWo=
+github.com/buildkite/bintest/v3 v3.3.0/go.mod h1:btqpTsVODiJcb0NMdkkmtMQ6xoFc2W/nY5yy+3I0zcs=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
+github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/charlievieth/strcase v0.0.5 h1:gV4iXVyD6eI5KdfOV+/vIVCKXZwtCWOmDMcu7Uy00Rs=
+github.com/charlievieth/strcase v0.0.5/go.mod h1:FIOYY1aDBMSIOFqmVomHBpoK+bteGlESRsgsdWjrhx8=
+github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
+github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
+github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4 h1:NZwojZ3+Cb8qxEkNdtmIrjwergNXvkTjvnM+yecyQoQ=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4/go.mod h1:s06tWAiJcXQo9/8AReBCIo/QxcXFZ2n4qfsRnpl71SM=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo=
+github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
+github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 h1:2Dx4IHfC1yHWI12AxQDJM1QbRCDfk6M+blLzlZCXdrc=
+github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/di-wu/parser v0.2.2/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX7nYo=
+github.com/di-wu/parser v0.3.0 h1:NMOvy5ifswgt4gsdhySVcKOQtvjC43cHZIfViWctqQY=
+github.com/di-wu/parser v0.3.0/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX7nYo=
+github.com/di-wu/xsd-datetime v1.0.0 h1:vZoGNkbzpBNoc+JyfVLEbutNDNydYV8XwHeV7eUJoxI=
+github.com/di-wu/xsd-datetime v1.0.0/go.mod h1:i3iEhrP3WchwseOBeIdW/zxeoleXTOzx1WyDXgdmOww=
+github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
+github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
+github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dmarkham/enumer v1.5.11 h1:quorLCaEfzjJ23Pf7PB9lyyaHseh91YfTM/sAD/4Mbo=
+github.com/dmarkham/enumer v1.5.11/go.mod h1:yixql+kDDQRYqcuBM2n9Vlt7NoT9ixgXhaXry8vmRg8=
+github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A=
+github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvsekhvalnov/jose2go v1.7.0 h1:bnQc8+GMnidJZA8zc6lLEAb4xNrIqHwO+9TzqvtQZPo=
+github.com/dvsekhvalnov/jose2go v1.7.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry/P5s8R4dYuLkhB9Nhso8ogFWNr4IQ=
+github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8/go.mod h1:JkjcmqbLW+khwt2fmBPJFBhx2zGZ8XobRZ+O0VhlwWo=
+github.com/emicklei/go-restful/v3 v3.11.3 h1:yagOQz/38xJmcNeZJtrUcKjkHRltIaIFXKWeG1SkWGE=
+github.com/emicklei/go-restful/v3 v3.11.3/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
+github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
+github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
+github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
+github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsouza/fake-gcs-server v1.52.2 h1:j6ne83nqHrlX5EEor7WWVIKdBsztGtwJ1J2mL+k+iio=
+github.com/fsouza/fake-gcs-server v1.52.2/go.mod h1:47HKyIkz6oLTes1R8vEaHLwXfzYsGfmDUk1ViHHAUsA=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
+github.com/go-faster/city v1.0.1/go.mod h1:jKcUJId49qdW3L1qKHH/3wPeUstCVpVSXTM6vO3VcTw=
+github.com/go-faster/errors v0.7.1 h1:MkJTnDoEdi9pDabt1dpWf7AA8/BaSYZqibYyhZ20AYg=
+github.com/go-faster/errors v0.7.1/go.mod h1:5ySTjWFiphBs07IKuiL69nxdfd5+fzh1u7FPGZP2quo=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
+github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
+github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
+github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
+github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
+github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
+github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
+github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
+github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
+github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
+github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
+github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
+github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
+github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
+github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.11.2 h1:Fgx0/wlmkClTKlnOsdOQ+K5HcHDsDcYIvtYmfhEOSUc=
+github.com/go-webauthn/webauthn v0.11.2/go.mod h1:aOtudaF94pM71g3jRwTYYwQTG1KyTILTcZqN1srkmD0=
+github.com/go-webauthn/x v0.1.21 h1:nFbckQxudvHEJn2uy1VEi713MeSpApoAv9eRqsb9AdQ=
+github.com/go-webauthn/x v0.1.21/go.mod h1:sEYohtg1zL4An1TXIUIQ5csdmoO+WO0R4R2pGKaHYKA=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
+github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
+github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
+github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus=
+github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
+github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
+github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
+github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
+github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
+github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
+github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
+github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go=
+github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
+github.com/google/flatbuffers v24.12.23+incompatible h1:ubBKR94NR4pXUCY/MUsRVzd9umNW7ht7EG9hHfS9FX8=
+github.com/google/flatbuffers v24.12.23+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/go-attestation v0.5.1 h1:jqtOrLk5MNdliTKjPbIPrAaRKJaKW+0LIU2n/brJYms=
+github.com/google/go-attestation v0.5.1/go.mod h1:KqGatdUhg5kPFkokyzSBDxwSCFyRgIgtRkMp6c3lOBQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
+github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
+github.com/google/go-github/v70 v70.0.0 h1:/tqCp5KPrcvqCc7vIvYyFYTiCGrYvaWoYMGHSQbo55o=
+github.com/google/go-github/v70 v70.0.0/go.mod h1:xBUZgo8MI3lUL/hwxl3hlceJW1U8MVnXP3zUyI+rhQY=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-sev-guest v0.12.1 h1:H4rFYnPIn8HtqEsNTmh56Zxcf9BI9n48ZSYCnpYLYvc=
+github.com/google/go-sev-guest v0.12.1/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760=
+github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843 h1:+MoPobRN9HrDhGyn6HnF5NYo4uMBKaiFqAtf/D/OB4A=
+github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843/go.mod h1:g/n8sKITIT9xRivBUbizo34DTsUm2nN2uU3A662h09g=
+github.com/google/go-tpm v0.9.5 h1:ocUmnDebX54dnW+MQWGQRbdaAcJELsa6PqZhJ48KwVU=
+github.com/google/go-tpm v0.9.5/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.4.5 h1:3fhthtyMDbIZFR5/0y1hvUoZ1Kf4i1eZ7C73R4Pvd+k=
+github.com/google/go-tpm-tools v0.4.5/go.mod h1:ktjTNq8yZFD6TzdBFefUfen96rF3NpYwpSb2d8bc+Y8=
+github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
+github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
+github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e h1:FJta/0WsADCe1r9vQjdHbd3KuiLPu7Y9WlyLGwMUNyE=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
+github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f h1:o2yGZLlsOj5H5uvtQNEdi6DeA0GbUP3lm0gWW5RvY0s=
+github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f/go.mod h1:H3K1Iu/utuCfa10JO+GsmKUYSWi7ug57Rk6GaDRHaaQ=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js=
+github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
+github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
+github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
+github.com/grafana/pyroscope-go v1.2.4 h1:B22GMXz+O0nWLatxLuaP7o7L9dvP0clLvIpmeEQQM0Q=
+github.com/grafana/pyroscope-go v1.2.4/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.8 h1:iwOtYXeeVSAeYefJNaxDytgjKtUuKQbJqgAIjlnicKg=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.8/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2 h1:ygCC2LH+2TVWChc5x1AnjZsou48Kfq4NXYsfgdpnABs=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2/go.mod h1:6FzirJfdffakAVqmHjwVfFkpru/gNbIazUOK5rIhndc=
+github.com/gravitational/go-libfido2 v1.5.3-teleport.1 h1:nPfxiTH2Sr3J6zan280fbHOkWE7gRF/lMqvhcXKh2ek=
+github.com/gravitational/go-libfido2 v1.5.3-teleport.1/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo=
+github.com/gravitational/go-mssqldb v1.8.1-teleport.2 h1:vzt5i39yPLCQ8FL19wUXq4+BcJR53NPimAIAOAIl4I0=
+github.com/gravitational/go-mssqldb v1.8.1-teleport.2/go.mod h1:vp38dT33FGfVotRiTmDo3bFyaHq+p3LektQrjTULowo=
+github.com/gravitational/go-mysql v1.9.1-teleport.4 h1:2Lt2fcEMrco6apu8jme0mj6OS2pXa/9+Tjl+5MpyVKY=
+github.com/gravitational/go-mysql v1.9.1-teleport.4/go.mod h1:pkllauQtJgHr2mTonYYysOznctozxiWgwpKAez0s+2U=
+github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5 h1:qg8FcGwRACSHortU1UxCSo9nF0t34rPWjk9Nef3j2Ic=
+github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFER/+0TfRypJhc9XeuggTtEZzhhe75DSVqMv/avHEU=
+github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
+github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
+github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
+github.com/gravitational/predicate v1.3.2 h1:NAdaWihgGVS3nuKDZZHTda4wwNjGlvG4a+UYQ4f3gQc=
+github.com/gravitational/predicate v1.3.2/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
+github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EMLfRWQVJMmK+MA6gV8AI=
+github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
+github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
+github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
+github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
+github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
+github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
+github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
+github.com/gravitational/selinux v1.13.0-teleport/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
+github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8 h1:FSfiARn271p3g3R0U2So5mUC6EiwaQ9KEtczU++LhQo=
+github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8/go.mod h1:A/+4SVMdAkQYtIBtaxV0H7AU862TxVZk/hhKaMDQB6Y=
+github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
+github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/gravitational/vt10x v0.0.3-teleport.1 h1:QYNPZGCQRcz1JehDn5m75UvRQbEJvT5X1pVblnCfZrY=
+github.com/gravitational/vt10x v0.0.3-teleport.1/go.mod h1:7p0/hpXPXby/VpuB6rFUq2pd7grku9KB+EcF0+jwqzQ=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 h1:sGm2vDRFUrQJO/Veii4h4zG2vvqG6uWNkBHSTqXOZk0=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2/go.mod h1:wd1YpapPLivG6nQgbf7ZkG1hhSOXDhhn4MLTknx2aAc=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
+github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-cty v1.5.0 h1:EkQ/v+dDNUqnuVpmS5fPqyY71NXVgT5gf32+57xY8g0=
+github.com/hashicorp/go-cty v1.5.0/go.mod h1:lFUCG5kd8exDobgSfyj4ONE/dc822kiYMguVKdHGMLM=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
+github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
+github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hc-install v0.9.2 h1:v80EtNX4fCVHqzL9Lg/2xkp62bbvQMnvPQ0G+OmtO24=
+github.com/hashicorp/hc-install v0.9.2/go.mod h1:XUqBQNnuT4RsxoxiM9ZaUk0NX8hi2h+Lb6/c0OZnC/I=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
+github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/terraform-exec v0.23.0 h1:MUiBM1s0CNlRFsCLJuM5wXZrzA3MnPYEsiXmzATMW/I=
+github.com/hashicorp/terraform-exec v0.23.0/go.mod h1:mA+qnx1R8eePycfwKkCRk3Wy65mwInvlpAeOwmA7vlY=
+github.com/hashicorp/terraform-json v0.25.0 h1:rmNqc/CIfcWawGiwXmRuiXJKEiJu1ntGoxseG1hLhoQ=
+github.com/hashicorp/terraform-json v0.25.0/go.mod h1:sMKS8fiRDX4rVlR6EJUMudg1WcanxCMoWwTLkgZP/vc=
+github.com/hashicorp/terraform-plugin-framework v1.15.0 h1:LQ2rsOfmDLxcn5EeIwdXFtr03FVsNktbbBci8cOKdb4=
+github.com/hashicorp/terraform-plugin-framework v1.15.0/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI=
+github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0 h1:v3DapR8gsp3EM8fKMh6up9cJUFQ2iRaFsYLP8UJnCco=
+github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0/go.mod h1:c3PnGE9pHBDfdEVG9t1S1C9ia5LW+gkFR0CygXlM8ak=
+github.com/hashicorp/terraform-plugin-framework-validators v0.18.0 h1:OQnlOt98ua//rCw+QhBbSqfW3QbwtVrcdWeQN5gI3Hw=
+github.com/hashicorp/terraform-plugin-framework-validators v0.18.0/go.mod h1:lZvZvagw5hsJwuY7mAY6KUz45/U6fiDR0CzQAwWD0CA=
+github.com/hashicorp/terraform-plugin-go v0.27.0 h1:ujykws/fWIdsi6oTUT5Or4ukvEan4aN9lY+LOxVP8EE=
+github.com/hashicorp/terraform-plugin-go v0.27.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
+github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
+github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 h1:NFPMacTrY/IdcIcnUB+7hsore1ZaRWU9cnB6jFoBnIM=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0/go.mod h1:QYmYnLfsosrxjCnGY1p9c7Zj6n9thnEE+7RObeYs3fA=
+github.com/hashicorp/terraform-plugin-testing v1.13.1 h1:0nhSm8lngGTggqXptU4vunFI0S2XjLAhJg3RylC5aLw=
+github.com/hashicorp/terraform-plugin-testing v1.13.1/go.mod h1:b/hl6YZLm9fjeud/3goqh/gdqhZXbRfbHMkEiY9dZwc=
+github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M=
+github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg=
+github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
+github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
+github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
+github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
+github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/in-toto/attestation v1.1.1 h1:QD3d+oATQ0dFsWoNh5oT0udQ3tUrOsZZ0Fc3tSgWbzI=
+github.com/in-toto/attestation v1.1.1/go.mod h1:Dcq1zVwA2V7Qin8I7rgOi+i837wEf/mOZwRm047Sjys=
+github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
+github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
+github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
+github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
+github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
+github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
+github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
+github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
+github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
+github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438 h1:Dj0L5fhJ9F82ZJyVOmBx6msDp/kfd1t9GRfny/mfJA0=
+github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
+github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
+github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
+github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
+github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
+github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
+github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
+github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
+github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.14.4 h1:fKuNiCumbKTAIxQwXfB/nsrnkEI6bPJrrSiMKgbJ2j8=
+github.com/jackc/pgtype v1.14.4/go.mod h1:aKeozOde08iifGosdJpz9MBZonJOUJxqNpPBcMJTlVA=
+github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
+github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
+github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
+github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
+github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
+github.com/jackc/pgx/v4 v4.18.3 h1:dE2/TrEsGX3RBprb3qryqSV9Y60iZN1C6i8IrmW9/BA=
+github.com/jackc/pgx/v4 v4.18.3/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
+github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
+github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
+github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
+github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
+github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
+github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA=
+github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI=
+github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+TBDg=
+github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
+github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3 h1:2713fQZ560HxoNVgfJH41GKzjMjIG+DW4hH6nYXfXW8=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3/go.mod h1:S4S9jGBVlLri0OeqrSSbCGG5vsI6he06UJyuz1WT1EE=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
+github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
+github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
+github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
+github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
+github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mark3labs/mcp-go v0.41.1 h1:w78eWfiQam2i8ICL7AL0WFiq7KHNJQ6UB53ZVtH4KGA=
+github.com/mark3labs/mcp-go v0.41.1/go.mod h1:T7tUa2jO6MavG+3P25Oy/jR7iCeJPHImCZHRymCn39g=
+github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
+github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
+github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
+github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
+github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
+github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
+github.com/miekg/pkcs11 v1.0.3-0.20190429190417-a667d056470f/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
+github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
+github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
+github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
+github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
+github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY=
+github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/ohler55/ojg v1.26.8 h1:njM65m+ej8sLHiFZIhJK9UkwOmDPsUikjGbTgcwu8CU=
+github.com/ohler55/ojg v1.26.8/go.mod h1:/Y5dGWkekv9ocnUixuETqiL58f+5pAsUfg5P8e7Pa2o=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/okta/okta-sdk-golang/v2 v2.20.0 h1:EDKM+uOPfihOMNwgHMdno+NAsIfyXkVnoFAYVPay0YU=
+github.com/okta/okta-sdk-golang/v2 v2.20.0/go.mod h1:FMy5hN5G8Rd/VoS0XrfyPPhIfOVo78ZK7lvwiQRS2+U=
+github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
+github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/openai/openai-go v1.8.2 h1:UqSkJ1vCOPUpz9Ka5tS0324EJFEuOvMc+lA/EarJWP8=
+github.com/openai/openai-go v1.8.2/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opensearch-project/opensearch-go/v2 v2.3.0 h1:nQIEMr+A92CkhHrZgUhcfsrZjibvB3APXf2a1VwCmMQ=
+github.com/opensearch-project/opensearch-go/v2 v2.3.0/go.mod h1:8LDr9FCgUTVoT+5ESjc2+iaZuldqE+23Iq0r1XeNue8=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+github.com/oracle/oci-go-sdk/v65 v65.92.0 h1:qLy3VH3aEO1c4RdKu58cmNrITtRbrgpRGOsYxgP2eXU=
+github.com/oracle/oci-go-sdk/v65 v65.92.0/go.mod h1:u6XRPsw9tPziBh76K7GrrRXPa8P8W3BQeqJ6ZZt9VLA=
+github.com/parquet-go/parquet-go v0.25.0 h1:GwKy11MuF+al/lV6nUsFw8w8HCiPOSAx1/y8yFxjH5c=
+github.com/parquet-go/parquet-go v0.25.0/go.mod h1:OqBBRGBl7+llplCvDMql8dEKaDqjaFA/VAPw+OJiNiw=
+github.com/pascaldekloe/name v1.0.1 h1:9lnXOHeqeHHnWLbKfH6X98+4+ETVqFqxN09UXSjcMb0=
+github.com/pascaldekloe/name v1.0.1/go.mod h1:Z//MfYJnH4jVpQ9wkclwu2I2MkHmXTlT9wR5UZScttM=
+github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible h1:IWzUvJ72xMjmrjR9q3H1PF+jwdN0uNQiR2t1BLNalyo=
+github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/paulmach/orb v0.11.1 h1:3koVegMC4X/WeiXYz9iswopaTwMem53NzTJuTF20JzU=
+github.com/paulmach/orb v0.11.1/go.mod h1:5mULz1xQfs3bmQm63QEJA6lNGujuRafwA5S/EnuLaLU=
+github.com/paulmach/protoscan v0.2.1/go.mod h1:SpcSwydNLrxUGSDvXvO0P7g7AuhJ7lcKfDlhJCDw2gY=
+github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0 h1:2nosf3P75OZv2/ZO/9Px5ZgZ5gbKrzA3joN1QMfOGMQ=
+github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0/go.mod h1:lAVhWwbNaveeJmxrxuSTxMgKpF6DjnuVpn6T8WiBwYQ=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
+github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pingcap/errors v0.11.0/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb h1:3pSi4EDG6hg0orE1ndHkXvX6Qdq2cZn8gAPir8ymKZk=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb/go.mod h1:X2r9ueLEUZgtx2cIogM0v4Zj5uvvzhuuiu7Pn8HzMPg=
+github.com/pingcap/log v1.1.1-0.20230317032135-a0d097d16e22 h1:2SOzvGvE8beiC1Y4g9Onkvu6UmuBBOeWRGQEjJaT/JY=
+github.com/pingcap/log v1.1.1-0.20230317032135-a0d097d16e22/go.mod h1:DWQW5jICDR7UJh4HtxXSM20Churx4CQL0fwL/SoOSA4=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20240930120915-74034d4ac243 h1:B3pF5adXRpuEDfSKY/bV2Lw+pPKtWH4FOaAX3Jx3X54=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20240930120915-74034d4ac243/go.mod h1:dXcO3Ts6jUVE1VwBZp3wbVdGO4pi9MXY6IvL4L1z62g=
+github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
+github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
+github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
+github.com/pkg/xattr v0.4.10 h1:Qe0mtiNFHQZ296vRgUjRCoPHPqH7VdTOrZx3g0T+pGA=
+github.com/pkg/xattr v0.4.10/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
+github.com/pkoukk/tiktoken-go v0.1.8 h1:85ENo+3FpWgAACBaEUVp+lctuTcYUO7BtmfhlN/QTRo=
+github.com/pkoukk/tiktoken-go v0.1.8/go.mod h1:9NiV+i9mJKGj1rYOT+njbv+ZwA/zJxYdewGl6qVatpg=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
+github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
+github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
+github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
+github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/rs/zerolog v1.28.0 h1:MirSo27VyNi7RJYP3078AA1+Cyzd2GB66qy3aUHvsWY=
+github.com/rs/zerolog v1.28.0/go.mod h1:NILgTygv/Uej1ra5XxGf82ZFSLk58MFGAUS2o6usyD0=
+github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2Ns0o=
+github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
+github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
+github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
+github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
+github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
+github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
+github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
+github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
+github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
+github.com/scim2/filter-parser/v2 v2.2.0 h1:QGadEcsmypxg8gYChRSM2j1edLyE/2j72j+hdmI4BJM=
+github.com/scim2/filter-parser/v2 v2.2.0/go.mod h1:jWnkDToqX/Y0ugz0P5VvpVEUKcWcyHHj+X+je9ce5JA=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
+github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
+github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca h1:Ti7KXq+i1d0jIaIaYN8tPyjxC4t69Wai6mOQvlA3XFY=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca/go.mod h1:4f4j4w8HLMPWEFs3BO2UBBLigKAaWYwkSkbIt/6Q4Ss=
+github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8iUrN18JYed2TvG9yN5ULG2jATM=
+github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
+github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 h1:oI+RNwuC9jF2g2lP0u0cVEEZrc/AYBCuFdvwrLWM/6Q=
+github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07/go.mod h1:yFdBgwXP24JziuRl2NMUahT7nGLNOKi1SIiFxMttVD4=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/rekor v1.4.1 h1:KK3McuHnptIE9mdNlrc9qh/OVE0AXf4rnScMxJE6xH4=
+github.com/sigstore/rekor v1.4.1/go.mod h1:/McBsz/vrtfi4EInxSIk/MGbDXzgv2+1FQUg1R/uSnE=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
+github.com/sigstore/sigstore-go v1.0.0 h1:4N07S2zLxf09nTRwaPKyAxbKzpM8WJYUS8lWWaYxneU=
+github.com/sigstore/sigstore-go v1.0.0/go.mod h1:UYsZ/XHE4eltv1o1Lu+n6poW1Z5to3f0+emvfXNxIN8=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5 h1:qp2VFyKuFQvTGmZwk5Q7m5nE4NwnF9tHwkyz0gtWAck=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5/go.mod h1:DKlQjjr+GsWljEYPycI0Sf8URLCk4EbGA9qYjF47j4g=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5 h1:CRZcdYn5AOptStsLRAAACudAVmb1qUbhMlzrvm7ju3o=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5/go.mod h1:b9rFfITq2fp1M3oJmq6lFFhSrAz5vOEJH1qzbMsZWN4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3 h1:a7Yz8C0aBa/LjeiTa9ZLYi9B74GNhFRnUIUdvN6ddVk=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3/go.mod h1:tRtJzSZ48MXJV9bmS8pkb3mP36PCad/Cs+BmVJ3Z4O4=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5 h1:S2ukEfN1orLKw2wEQIUHDDlzk0YcylhcheeZ5TGk8LI=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5/go.mod h1:m7sQxVJmDa+rsmS1m6biQxaLX83pzNS7ThUEyjOqkCU=
+github.com/sigstore/timestamp-authority v1.2.7 h1:HP/VT4wnL4uzP0fVo3eHXlt0reuNgW3PLt78+BV0I5I=
+github.com/sigstore/timestamp-authority v1.2.7/go.mod h1:te4ThQ3Q/CX1bzVsf5mMN0K7Z/cgc2OcoEGxAJiFqqI=
+github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
+github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/snowflakedb/gosnowflake v1.14.0 h1:lP91Y47ho3dzpTxWr7wjpvDXteh+ZttsLaw1WXzHS34=
+github.com/snowflakedb/gosnowflake v1.14.0/go.mod h1:NUxNYUdyPn9sRoYB/udq/fXBXuhLS3SBTPI2/OT79uc=
+github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
+github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
+github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
+github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
+github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/testcontainers/testcontainers-go v0.39.0 h1:uCUJ5tA+fcxbFAB0uP3pIK3EJ2IjjDUHFSZ1H1UxAts=
+github.com/testcontainers/testcontainers-go v0.39.0/go.mod h1:qmHpkG7H5uPf/EvOORKvS6EuDkBUPE3zpVGaH9NL7f8=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0 h1:8iJ4itSuiSpPLevQ+fM6cR+9k74YSOM1glKI4XFF+Qw=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0/go.mod h1:EKJcSWfogRdiBc5kvar1tumSx7MImmkQ0RDvU0HZQZM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0 h1:REJz+XwNpGC/dCgTfYvM4SKqobNqDBfvhq74s2oHTUM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0/go.mod h1:4K2OhtHEeT+JSIFX4V8DkGKsyLa96Y2vLdd3xsxD5HE=
+github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
+github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
+github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
+github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
+github.com/theupdateframework/go-tuf/v2 v2.1.1 h1:OWcoHItwsGO+7m0wLa7FDWPR4oB1cj0zOr1kosE4G+I=
+github.com/theupdateframework/go-tuf/v2 v2.1.1/go.mod h1:V675cQGhZONR0OGQ8r1feO0uwtsTBYPDWHzAAPn5rjE=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw=
+github.com/tink-crypto/tink-go-hcvault/v2 v2.3.0 h1:6nAX1aRGnkg2SEUMwO5toB2tQkP0Jd6cbmZ/K5Le1V0=
+github.com/tink-crypto/tink-go-hcvault/v2 v2.3.0/go.mod h1:HOC5NWW1wBI2Vke1FGcRBvDATkEYE7AUDiYbXqi2sBw=
+github.com/tink-crypto/tink-go/v2 v2.4.0 h1:8VPZeZI4EeZ8P/vB6SIkhlStrJfivTJn+cQ4dtyHNh0=
+github.com/tink-crypto/tink-go/v2 v2.4.0/go.mod h1:l//evrF2Y3MjdbpNDNGnKgCpo5zSmvUvnQ4MU+yE2sw=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
+github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
+github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
+github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
+github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
+github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
+github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
+github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
+github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
+github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
+github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
+github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
+github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
+github.com/zitadel/logging v0.6.2 h1:MW2kDDR0ieQynPZ0KIZPrh9ote2WkxfBif5QoARDQcU=
+github.com/zitadel/logging v0.6.2/go.mod h1:z6VWLWUkJpnNVDSLzrPSQSQyttysKZ6bCRongw0ROK4=
+github.com/zitadel/oidc/v3 v3.43.0 h1:LokviPoiTNNPbIAMO/eb6Kq9PNWPWp0mA1oWtdLc+Qs=
+github.com/zitadel/oidc/v3 v3.43.0/go.mod h1:5ki8s9CWoB4iGmtULndiVxwM8xt7IylZIaudro7jEq4=
+github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
+github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
+gitlab.com/gitlab-org/api/client-go v0.129.0 h1:o9KLn6fezmxBQWYnQrnilwyuOjlx4206KP0bUn3HuBE=
+gitlab.com/gitlab-org/api/client-go v0.129.0/go.mod h1:ZhSxLAWadqP6J9lMh40IAZOlOxBLPRh7yFOXR/bMJWM=
+go.abhg.dev/goldmark/frontmatter v0.2.0 h1:P8kPG0YkL12+aYk2yU3xHv4tcXzeVnN+gU0tJ5JnxRw=
+go.abhg.dev/goldmark/frontmatter v0.2.0/go.mod h1:XqrEkZuM57djk7zrlRUB02x8I5J0px76YjkOzhB4YlU=
+go.etcd.io/etcd/api/v3 v3.6.0 h1:vdbkcUBGLf1vfopoGE/uS3Nv0KPyIpUV/HM6w9yx2kM=
+go.etcd.io/etcd/api/v3 v3.6.0/go.mod h1:Wt5yZqEmxgTNJGHob7mTVBJDZNXiHPtXTcPab37iFOw=
+go.etcd.io/etcd/client/pkg/v3 v3.6.0 h1:nchnPqpuxvv3UuGGHaz0DQKYi5EIW5wOYsgUNRc365k=
+go.etcd.io/etcd/client/pkg/v3 v3.6.0/go.mod h1:Jv5SFWMnGvIBn8o3OaBq/PnT0jjsX8iNokAUessNjoA=
+go.etcd.io/etcd/client/v3 v3.6.0 h1:/yjKzD+HW5v/3DVj9tpwFxzNbu8hjcKID183ug9duWk=
+go.etcd.io/etcd/client/v3 v3.6.0/go.mod h1:Jzk/Knqe06pkOZPHXsQ0+vNDvMQrgIqJ0W8DwPdMJMg=
+go.mongodb.org/mongo-driver v1.11.4/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGhfnFe5lwB0ic1JBVjzhk0w=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7ZSD+5yn+lo3sGV69nW04rRR0jhYnBwjuX3r0HvnK0=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0/go.mod h1:QyjcV9qDP6VeK5qPyKETvNjmaaEc7+gqjh4SS0ZYzDU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0/go.mod h1:zKU4zUgKiaRxrdovSS2amdM5gOc59slmo/zJwGX+YBg=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsux7Qmq8ToKAx1XCilTQECZ0KDZyTw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
+go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
+go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
+go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d h1:Ns9kd1Rwzw7t0BR8XMphenji4SmIoNZPn8zhYmaVKP8=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d/go.mod h1:92Uoe3l++MlthCm+koNi0tcUCX3anayogF0Pa/sp24k=
+go.step.sm/crypto v0.70.0 h1:Q9Ft7N637mucyZcHZd1+0VVQJVwDCKqcb9CYcYi7cds=
+go.step.sm/crypto v0.70.0/go.mod h1:pzfUhS5/ue7ev64PLlEgXvhx1opwbhFCjkvlhsxVds0=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8 h1:LvzTn0GQhWuvKH/kVRS3R3bVAsdQWI7hvfLHGgh9+lU=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
+golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/dnaeon/go-vcr.v3 v3.2.0 h1:Rltp0Vf+Aq0u4rQXgmXgtgoRDStTnFN83cWgSGSoRzM=
+gopkg.in/dnaeon/go-vcr.v3 v3.2.0/go.mod h1:2IMOnnlx9I6u9x+YBsM3tAMx6AlOxnJ0pWxQAzZ79Ag=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
+helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
+k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
+k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
+k8s.io/metrics v0.33.3 h1:9CcqBz15JZfISqwca33gdHS8I6XfsK1vA8WUdEnG70g=
+k8s.io/metrics v0.33.3/go.mod h1:Aw+cdg4AYHw0HvUY+lCyq40FOO84awrqvJRTw0cmXDs=
+k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
+k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg=
+mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
+sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
+sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
+sigs.k8s.io/kustomize/kyaml v0.19.0 h1:RFge5qsO1uHhwJsu3ipV7RNolC7Uozc0jUBC/61XSlA=
+sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/rf9NNu1cwY=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
+software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
+software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/integrations/terraform-mwi/main.go b/integrations/terraform-mwi/main.go
new file mode 100644
index 0000000000000..e2484abfcf998
--- /dev/null
+++ b/integrations/terraform-mwi/main.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+
+	"github.com/hashicorp/terraform-plugin-framework/providerserver"
+
+	"github.com/gravitational/teleport/integrations/terraform-mwi/provider"
+)
+
+func main() {
+	ctx := context.Background()
+
+	var debug bool
+	flag.BoolVar(&debug, "debug", false, "Enable debug mode")
+	flag.Parse()
+
+	err := providerserver.Serve(
+		ctx,
+		provider.New(),
+		providerserver.ServeOpts{
+			Address: "terraform.releases.teleport.dev/gravitational/teleportmwi",
+			Debug:   debug,
+		},
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
diff --git a/integrations/terraform-mwi/provider/kubernetes_data_source.go b/integrations/terraform-mwi/provider/kubernetes_data_source.go
new file mode 100644
index 0000000000000..0796d532974cb
--- /dev/null
+++ b/integrations/terraform-mwi/provider/kubernetes_data_source.go
@@ -0,0 +1,276 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+)
+
+func NewKubernetesDataSource() datasource.DataSource {
+	return &KubernetesDataSource{}
+}
+
+type KubernetesDataSourceModelSelector struct {
+	Name types.String `tfsdk:"name"`
+}
+
+type KubernetesDataSourceModel struct {
+	// Arguments
+	Selector      KubernetesDataSourceModelSelector `tfsdk:"selector"`
+	CredentialTTL timetypes.GoDuration              `tfsdk:"credential_ttl"`
+
+	// Attributes
+	Output *KubernetesDataSourceModelOutput `tfsdk:"output"`
+}
+
+type KubernetesDataSourceModelOutput struct {
+	ClientKey            types.String `tfsdk:"client_key"`
+	Host                 types.String `tfsdk:"host"`
+	TLSServerName        types.String `tfsdk:"tls_server_name"`
+	ClientCertificate    types.String `tfsdk:"client_certificate"`
+	ClusterCACertificate types.String `tfsdk:"cluster_ca_certificate"`
+}
+
+type KubernetesDataSource struct {
+	pd *providerData // provider data, set in Configure
+}
+
+func (d *KubernetesDataSource) Metadata(
+	ctx context.Context,
+	req datasource.MetadataRequest,
+	resp *datasource.MetadataResponse,
+) {
+	resp.TypeName = req.ProviderTypeName + "_kubernetes"
+}
+
+func (d *KubernetesDataSource) Schema(
+	_ context.Context,
+	_ datasource.SchemaRequest,
+	resp *datasource.SchemaResponse,
+) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "The Kubernetes data source provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.",
+
+		Attributes: map[string]schema.Attribute{
+			// Arguments
+			"selector": schema.SingleNestedAttribute{
+				MarkdownDescription: "Selects the Kubernetes cluster to connect to.",
+				Attributes: map[string]schema.Attribute{
+					"name": schema.StringAttribute{
+						MarkdownDescription: "The name of the Kubernetes cluster to connect to.",
+						Required:            true,
+					},
+				},
+				Required: true,
+			},
+			"credential_ttl": schema.StringAttribute{
+				CustomType:          timetypes.GoDurationType{},
+				MarkdownDescription: "How long the issued credentials should be valid for. Defaults to 30 minutes.",
+				Optional:            true,
+				Computed:            true,
+			},
+			// Attributes
+			"output": schema.SingleNestedAttribute{
+				Computed: true,
+				Attributes: map[string]schema.Attribute{
+					"client_key": schema.StringAttribute{
+						Computed:            true,
+						Sensitive:           true,
+						MarkdownDescription: "Compatible with the `client_key` argument of the `kubernetes` provider.",
+					},
+					"host": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `host` argument of the `kubernetes` provider.",
+					},
+					"tls_server_name": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `tls_server_name` argument of the `kubernetes` provider.",
+					},
+					"client_certificate": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `client_certificate` argument of the `kubernetes` provider.",
+					},
+					"cluster_ca_certificate": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.",
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *KubernetesDataSource) Configure(
+	ctx context.Context,
+	req datasource.ConfigureRequest,
+	resp *datasource.ConfigureResponse,
+) {
+	if req.ProviderData == nil {
+		return
+	}
+	pd, ok := req.ProviderData.(*providerData)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected type",
+			fmt.Sprintf(
+				"Expected *providerData, got: %T. Please report this issue to the provider developers.",
+				req.ProviderData,
+			),
+		)
+
+		return
+	}
+	d.pd = pd
+}
+
+func (r *KubernetesDataSource) loadModelAndSetDefaults(
+	ctx context.Context,
+	req datasource.ReadRequest,
+	resp *datasource.ReadResponse,
+) KubernetesDataSourceModel {
+	var data KubernetesDataSourceModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return data
+	}
+
+	// Set default for credential TTL if not provided.
+	if data.CredentialTTL.IsNull() || data.CredentialTTL.IsUnknown() {
+		data.CredentialTTL = timetypes.NewGoDurationValue(
+			time.Minute * 30,
+		)
+	}
+
+	return data
+}
+
+func (d *KubernetesDataSource) Read(
+	ctx context.Context,
+	req datasource.ReadRequest,
+	resp *datasource.ReadResponse,
+) {
+	data := d.loadModelAndSetDefaults(ctx, req, resp)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	dest := destination.NewMemory()
+	botCfg := d.pd.newBotConfig()
+	botCfg.Services = []bot.ServiceBuilder{
+		k8s.OutputV2ServiceBuilder(
+			&k8s.OutputV2Config{
+				Destination: dest,
+				Selectors: []*k8s.KubernetesSelector{
+					{
+						Name: data.Selector.Name.ValueString(),
+					},
+				},
+				DisableExecPlugin: true,
+			},
+		),
+	}
+	if err := botCfg.CheckAndSetDefaults(); err != nil {
+		resp.Diagnostics.AddError(
+			"Error setting defaults for bot config",
+			"Failed to set defaults for bot config: "+err.Error(),
+		)
+		return
+	}
+
+	bot, err := bot.New(botCfg)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error creating tbot in data source",
+			"Failed to create tbot\n"+trace.DebugReport(err),
+		)
+		return
+	}
+	if err := bot.OneShot(ctx); err != nil {
+		resp.Diagnostics.AddError(
+			"Error running tbot in data source",
+			"Failed to run tbot\n"+trace.DebugReport(err),
+		)
+		return
+	}
+
+	// Parse kubeconfig from the destination.
+	destData, err := dest.Read(ctx, "kubeconfig.yaml")
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error reading kubeconfig",
+			"Failed to read kubeconfig: "+err.Error(),
+		)
+		return
+	}
+	cfg, err := clientcmd.Load(destData)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error parsing kubeconfig",
+			"Failed to load kubeconfig: "+err.Error(),
+		)
+		return
+	}
+
+	kubectx, ok := cfg.Contexts[cfg.CurrentContext]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig context",
+			"Failed to load kubeconfig context: current-context not found in contexts map",
+		)
+		return
+	}
+	cluster, ok := cfg.Clusters[kubectx.Cluster]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig cluster",
+			"Failed to load kubeconfig cluster: cluster not found in clusters map",
+		)
+		return
+	}
+	user, ok := cfg.AuthInfos[kubectx.AuthInfo]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig user",
+			"Failed to load kubeconfig user: user not found in users map",
+		)
+		return
+	}
+
+	out := KubernetesDataSourceModelOutput{
+		Host:                 types.StringValue(cluster.Server),
+		TLSServerName:        types.StringValue(cluster.TLSServerName),
+		ClientKey:            types.StringValue(string(user.ClientKeyData)),
+		ClientCertificate:    types.StringValue(string(user.ClientCertificateData)),
+		ClusterCACertificate: types.StringValue(string(cluster.CertificateAuthorityData)),
+	}
+
+	data.Output = &out
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/integrations/terraform-mwi/provider/kubernetes_data_source_test.go b/integrations/terraform-mwi/provider/kubernetes_data_source_test.go
new file mode 100644
index 0000000000000..9858f28c597c5
--- /dev/null
+++ b/integrations/terraform-mwi/provider/kubernetes_data_source_test.go
@@ -0,0 +1,101 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestAccKubernetesDataSource(t *testing.T) {
+	log := logtest.NewLogger()
+	ctx := t.Context()
+
+	process, kubeMock := setupKubernetesHarness(t, log)
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	if err != nil {
+		t.Fatalf("failed to create auth client: %v", err)
+	}
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	_, pt := setupKubernetesAccessBot(ctx, t, rootClient)
+
+	config := fmt.Sprintf(`
+provider "teleportmwi" {
+  proxy_server = "%[1]s"
+  join_method  = "kubernetes"
+  join_token   = "%[2]s"
+  insecure     = true
+}
+
+data "teleportmwi_kubernetes" "example" {
+  selector = {
+    name = "%[3]s"
+  } 
+}
+
+provider "kubernetes" {
+  host                   = data.teleportmwi_kubernetes.example.output.host
+  tls_server_name        = data.teleportmwi_kubernetes.example.output.tls_server_name
+  client_certificate     = data.teleportmwi_kubernetes.example.output.client_certificate
+  client_key             = data.teleportmwi_kubernetes.example.output.client_key
+  cluster_ca_certificate = data.teleportmwi_kubernetes.example.output.cluster_ca_certificate
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name = "tf-mwi-ds-test"
+  }
+}
+`, process.Config.Proxy.WebAddr.String(), pt.GetName(), kubeClusterName)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"kubernetes": {
+				Source: "hashicorp/kubernetes",
+			},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: func(state *terraform.State) error {
+					// Check that the namespace was actually created!
+					containsCreatedNamespace := slices.ContainsFunc(
+						kubeMock.ListNamespaces().Items,
+						func(ns corev1.Namespace) bool {
+							return ns.Name == "tf-mwi-ds-test"
+						},
+					)
+					if !containsCreatedNamespace {
+						return fmt.Errorf("expected to find created namespace in TF state")
+					}
+					return nil
+				},
+			},
+		},
+	})
+}
diff --git a/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource.go b/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource.go
new file mode 100644
index 0000000000000..e1fff25f3aea7
--- /dev/null
+++ b/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource.go
@@ -0,0 +1,278 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+)
+
+var _ ephemeral.EphemeralResourceWithConfigure = &KubernetesEphemeralResource{}
+
+func NewKubernetesEphemeralResource() ephemeral.EphemeralResource {
+	return &KubernetesEphemeralResource{}
+}
+
+type KubernetesEphemeralResource struct {
+	pd *providerData // provider data, set in Configure
+}
+
+func (r *KubernetesEphemeralResource) Metadata(
+	_ context.Context,
+	req ephemeral.MetadataRequest,
+	resp *ephemeral.MetadataResponse,
+) {
+	resp.TypeName = req.ProviderTypeName + "_kubernetes"
+}
+
+type KubernetesEphemeralResourceModelSelector struct {
+	Name types.String `tfsdk:"name"`
+}
+
+type KubernetesEphemeralResourceModel struct {
+	// Arguments
+	Selector      KubernetesEphemeralResourceModelSelector `tfsdk:"selector"`
+	CredentialTTL timetypes.GoDuration                     `tfsdk:"credential_ttl"`
+
+	// Attributes
+	Output *KubernetesEphemeralResourceModelOutput `tfsdk:"output"`
+}
+
+type KubernetesEphemeralResourceModelOutput struct {
+	ClientKey            types.String `tfsdk:"client_key"`
+	Host                 types.String `tfsdk:"host"`
+	TLSServerName        types.String `tfsdk:"tls_server_name"`
+	ClientCertificate    types.String `tfsdk:"client_certificate"`
+	ClusterCACertificate types.String `tfsdk:"cluster_ca_certificate"`
+}
+
+func (r *KubernetesEphemeralResource) Schema(
+	_ context.Context,
+	_ ephemeral.SchemaRequest,
+	resp *ephemeral.SchemaResponse,
+) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "The Kubernetes Ephemeral Resource provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.",
+
+		Attributes: map[string]schema.Attribute{
+			// Arguments
+			"selector": schema.SingleNestedAttribute{
+				MarkdownDescription: "Selects the Kubernetes cluster to connect to.",
+				Attributes: map[string]schema.Attribute{
+					"name": schema.StringAttribute{
+						MarkdownDescription: "The name of the Kubernetes cluster to connect to.",
+						Required:            true,
+					},
+				},
+				Required: true,
+			},
+			"credential_ttl": schema.StringAttribute{
+				CustomType:          timetypes.GoDurationType{},
+				MarkdownDescription: "How long the issued credentials should be valid for. Defaults to 30 minutes.",
+				Optional:            true,
+				Computed:            true,
+			},
+			// Attributes
+			"output": schema.SingleNestedAttribute{
+				Computed: true,
+				Attributes: map[string]schema.Attribute{
+					"client_key": schema.StringAttribute{
+						Computed:            true,
+						Sensitive:           true,
+						MarkdownDescription: "Compatible with the `client_key` argument of the `kubernetes` provider.",
+					},
+					"host": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `host` argument of the `kubernetes` provider.",
+					},
+					"tls_server_name": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `tls_server_name` argument of the `kubernetes` provider.",
+					},
+					"client_certificate": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `client_certificate` argument of the `kubernetes` provider.",
+					},
+					"cluster_ca_certificate": schema.StringAttribute{
+						Computed:            true,
+						MarkdownDescription: "Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.",
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *KubernetesEphemeralResource) Configure(
+	ctx context.Context,
+	req ephemeral.ConfigureRequest,
+	resp *ephemeral.ConfigureResponse,
+) {
+	if req.ProviderData == nil {
+		return
+	}
+	pd, ok := req.ProviderData.(*providerData)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected type",
+			fmt.Sprintf(
+				"Expected *providerData, got: %T. Please report this issue to the provider developers.",
+				req.ProviderData,
+			),
+		)
+
+		return
+	}
+	d.pd = pd
+}
+
+func (r *KubernetesEphemeralResource) loadModelAndSetDefaults(
+	ctx context.Context,
+	req ephemeral.OpenRequest,
+	resp *ephemeral.OpenResponse,
+) KubernetesEphemeralResourceModel {
+	var data KubernetesEphemeralResourceModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return data
+	}
+
+	// Set default for credential TTL if not provided.
+	if data.CredentialTTL.IsNull() || data.CredentialTTL.IsUnknown() {
+		data.CredentialTTL = timetypes.NewGoDurationValue(
+			time.Minute * 30,
+		)
+	}
+
+	return data
+}
+
+func (r *KubernetesEphemeralResource) Open(
+	ctx context.Context,
+	req ephemeral.OpenRequest,
+	resp *ephemeral.OpenResponse,
+) {
+	data := r.loadModelAndSetDefaults(ctx, req, resp)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	dest := destination.NewMemory()
+	botCfg := r.pd.newBotConfig()
+	botCfg.Services = []bot.ServiceBuilder{
+		k8s.OutputV2ServiceBuilder(
+			&k8s.OutputV2Config{
+				Destination: dest,
+				Selectors: []*k8s.KubernetesSelector{
+					{
+						Name: data.Selector.Name.ValueString(),
+					},
+				},
+				DisableExecPlugin: true,
+			},
+		),
+	}
+	if err := botCfg.CheckAndSetDefaults(); err != nil {
+		resp.Diagnostics.AddError(
+			"Error setting defaults for bot config",
+			"Failed to set defaults for bot config: "+err.Error(),
+		)
+		return
+	}
+
+	bot, err := bot.New(botCfg)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error creating tbot in ephemeral resource",
+			"Failed to create tbot\n"+trace.DebugReport(err),
+		)
+		return
+	}
+	if err := bot.OneShot(ctx); err != nil {
+		resp.Diagnostics.AddError(
+			"Error running tbot in ephemeral resource",
+			"Failed to run tbot\n"+trace.DebugReport(err),
+		)
+		return
+	}
+
+	// Parse kubeconfig from the destination.
+	destData, err := dest.Read(ctx, "kubeconfig.yaml")
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error reading kubeconfig",
+			"Failed to read kubeconfig: "+err.Error(),
+		)
+		return
+	}
+	cfg, err := clientcmd.Load(destData)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error parsing kubeconfig",
+			"Failed to load kubeconfig: "+err.Error(),
+		)
+		return
+	}
+
+	kubectx, ok := cfg.Contexts[cfg.CurrentContext]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig context",
+			"Failed to load kubeconfig context: current-context not found in contexts map",
+		)
+		return
+	}
+	cluster, ok := cfg.Clusters[kubectx.Cluster]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig cluster",
+			"Failed to load kubeconfig cluster: cluster not found in clusters map",
+		)
+		return
+	}
+	user, ok := cfg.AuthInfos[kubectx.AuthInfo]
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Error loading kubeconfig user",
+			"Failed to load kubeconfig user: user not found in users map",
+		)
+		return
+	}
+
+	out := KubernetesEphemeralResourceModelOutput{
+		Host:                 types.StringValue(cluster.Server),
+		TLSServerName:        types.StringValue(cluster.TLSServerName),
+		ClientKey:            types.StringValue(string(user.ClientKeyData)),
+		ClientCertificate:    types.StringValue(string(user.ClientCertificateData)),
+		ClusterCACertificate: types.StringValue(string(cluster.CertificateAuthorityData)),
+	}
+
+	data.Output = &out
+	resp.Diagnostics.Append(resp.Result.Set(ctx, &data)...)
+}
diff --git a/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource_test.go b/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource_test.go
new file mode 100644
index 0000000000000..e52b27d1bf16d
--- /dev/null
+++ b/integrations/terraform-mwi/provider/kubernetes_ephemeral_resource_test.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/tfversion"
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestAccKubernetesEphemeralResource(t *testing.T) {
+	log := logtest.NewLogger()
+	ctx := t.Context()
+
+	process, kubeMock := setupKubernetesHarness(t, log)
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	if err != nil {
+		t.Fatalf("failed to create auth client: %v", err)
+	}
+	t.Cleanup(func() { _ = rootClient.Close() })
+	_, pt := setupKubernetesAccessBot(ctx, t, rootClient)
+
+	config := fmt.Sprintf(`
+provider "teleportmwi" {
+  proxy_server = "%[1]s"
+  join_method  = "kubernetes"
+  join_token   = "%[2]s"
+  insecure     = true
+}
+
+ephemeral "teleportmwi_kubernetes" "example" {
+  selector = {
+    name = "%[3]s"
+  } 
+}
+
+provider "kubernetes" {
+  host                   = ephemeral.teleportmwi_kubernetes.example.output.host
+  tls_server_name        = ephemeral.teleportmwi_kubernetes.example.output.tls_server_name
+  client_certificate     = ephemeral.teleportmwi_kubernetes.example.output.client_certificate
+  client_key             = ephemeral.teleportmwi_kubernetes.example.output.client_key
+  cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.example.output.cluster_ca_certificate
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name = "tf-mwi-ers-test"
+  }
+}
+`, process.Config.Proxy.WebAddr.String(), pt.GetName(), kubeClusterName)
+
+	resource.Test(t, resource.TestCase{
+		TerraformVersionChecks: []tfversion.TerraformVersionCheck{
+			// Ephemeral resources were introduced in Terraform 1.10.0.
+			tfversion.SkipBelow(tfversion.Version1_10_0),
+		},
+		PreCheck: func() {
+			testAccPreCheck(t)
+		},
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactoriesWithEcho,
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"kubernetes": {
+				Source: "hashicorp/kubernetes",
+			},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: func(state *terraform.State) error {
+					// Check that the namespace was actually created!
+					containsCreatedNamespace := slices.ContainsFunc(
+						kubeMock.ListNamespaces().Items,
+						func(ns corev1.Namespace) bool {
+							return ns.Name == "tf-mwi-ers-test"
+						},
+					)
+					if !containsCreatedNamespace {
+						return fmt.Errorf("expected to find created namespace in TF state")
+					}
+					return nil
+				},
+			},
+		},
+	})
+}
diff --git a/integrations/terraform-mwi/provider/kubernetes_test.go b/integrations/terraform-mwi/provider/kubernetes_test.go
new file mode 100644
index 0000000000000..a14e6a954365d
--- /dev/null
+++ b/integrations/terraform-mwi/provider/kubernetes_test.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+const (
+	kubeClusterName = "test-cluster"
+	teleClusterName = "root"
+)
+
+func k8ClientConfig(serverAddr string) clientcmdapi.Config {
+	return clientcmdapi.Config{
+		Clusters: map[string]*clientcmdapi.Cluster{
+			kubeClusterName: {
+				Server:                serverAddr,
+				InsecureSkipTLSVerify: true,
+			},
+		},
+		Contexts: map[string]*clientcmdapi.Context{
+			kubeClusterName: {
+				Cluster:  kubeClusterName,
+				AuthInfo: kubeClusterName,
+			},
+		},
+		CurrentContext: kubeClusterName,
+	}
+}
+
+func startKubeAPIMock(t *testing.T) *testingkubemock.KubeMockServer {
+	kubeMock, err := testingkubemock.NewKubeAPIMock()
+	require.NoError(t, err)
+	t.Cleanup(func() { kubeMock.Close() })
+	return kubeMock
+}
+
+func mustCreateKubeConfigFile(t *testing.T, config clientcmdapi.Config) string {
+	t.Helper()
+
+	configPath := filepath.Join(t.TempDir(), "config.yaml")
+	err := clientcmd.WriteToFile(config, configPath)
+	require.NoError(t, err)
+	return configPath
+}
+
+func setupKubernetesHarness(
+	t *testing.T, log *slog.Logger,
+) (
+	*service.TeleportProcess,
+	*testingkubemock.KubeMockServer,
+) {
+	kubeMock := startKubeAPIMock(t)
+	kubeConfigPath := mustCreateKubeConfigFile(t, k8ClientConfig(kubeMock.URL))
+
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		testenv.WithClusterName(teleClusterName),
+		testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{
+					AddrNetwork: "tcp",
+					Addr: net.JoinHostPort(
+						"localhost",
+						strconv.Itoa(cfg.Proxy.WebAddr.Port(0)),
+					),
+				},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+
+			cfg.Kube.Enabled = true
+			cfg.Kube.KubeconfigPath = kubeConfigPath
+			cfg.Kube.ListenAddr = utils.MustParseAddr(
+				helpers.NewListener(t, service.ListenerKube, &cfg.FileDescriptors))
+		}),
+		testenv.WithProxyKube(),
+	)
+	if err != nil {
+		t.Fatalf("failed to create Teleport process: %v", err)
+	}
+
+	return process, kubeMock
+}
+
+func setupKubernetesAccessBot(
+	ctx context.Context,
+	t *testing.T,
+	client *authclient.Client,
+) (*machineidv1.Bot, types.ProvisionToken) {
+	role, err := types.NewRole("kube-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			KubeGroups: []string{
+				"system:masters",
+			},
+			KubernetesLabels: map[string]apiutils.Strings{
+				"*": {"*"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = client.CreateRole(ctx, role)
+	require.NoError(t, err)
+	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
+		Bot: &machineidv1.Bot{
+			Metadata: &headerv1.Metadata{
+				Name: "test-bot",
+			},
+			Spec: &machineidv1.BotSpec{
+				Roles: []string{role.GetName()},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	fakeJoinSigner, err := fakeissuer.NewKubernetesSigner(
+		clockwork.NewRealClock(),
+	)
+	require.NoError(t, err)
+	marshalledJWKS, err := fakeJoinSigner.GetMarshaledJWKS()
+	require.NoError(t, err)
+	pt, err := types.NewProvisionTokenFromSpec(
+		"test-bot",
+		time.Time{},
+		types.ProvisionTokenSpecV2{
+			BotName:    bot.Metadata.Name,
+			Roles:      []types.SystemRole{types.RoleBot},
+			JoinMethod: types.JoinMethodKubernetes,
+			Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+				Type: types.KubernetesJoinTypeStaticJWKS,
+				StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
+					JWKS: marshalledJWKS,
+				},
+				Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+					{
+						ServiceAccount: "default:bot",
+					},
+				},
+			},
+		},
+	)
+	require.NoError(t, err)
+	require.NoError(t, client.CreateToken(ctx, pt))
+
+	joinJWT, err := fakeJoinSigner.SignServiceAccountJWT(
+		"my-pod",
+		// default:bot as in provision token above
+		"default",
+		"bot",
+		teleClusterName,
+	)
+	require.NoError(t, err)
+	joinJWTPath := filepath.Join(t.TempDir(), "join")
+	err = os.WriteFile(joinJWTPath, []byte(joinJWT), 0666)
+	require.NoError(t, err)
+	t.Setenv("KUBERNETES_TOKEN_PATH", joinJWTPath)
+
+	return bot, pt
+}
diff --git a/integrations/terraform-mwi/provider/provider.go b/integrations/terraform-mwi/provider/provider.go
new file mode 100644
index 0000000000000..d4dcb555f8f6d
--- /dev/null
+++ b/integrations/terraform-mwi/provider/provider.go
@@ -0,0 +1,182 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"github.com/hashicorp/terraform-plugin-framework/provider"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+)
+
+var (
+	_ provider.Provider                       = &Provider{}
+	_ provider.ProviderWithEphemeralResources = &Provider{}
+)
+
+func New() func() provider.Provider {
+	return func() provider.Provider {
+		return &Provider{}
+	}
+}
+
+type Provider struct {
+}
+
+type ProviderModel struct {
+	// ProxyServer is the address of the Teleport proxy server. This should
+	// exclude the scheme, but include the port.
+	ProxyServer types.String `tfsdk:"proxy_server"`
+	// JoinMethod is the method used to join the cluster.
+	// Must be specified.
+	JoinMethod types.String `tfsdk:"join_method"`
+	// JoinToken is the token used to join the cluster.
+	// Must be specified.
+	JoinToken types.String `tfsdk:"join_token"`
+	// Insecure indicates whether to skip TLS verification for the proxy server.
+	Insecure types.Bool `tfsdk:"insecure"`
+}
+
+func (p *Provider) Metadata(ctx context.Context, req provider.MetadataRequest, resp *provider.MetadataResponse) {
+	resp.TypeName = "teleportmwi"
+}
+
+func (p *Provider) Schema(ctx context.Context, req provider.SchemaRequest, resp *provider.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"proxy_server": schema.StringAttribute{
+				MarkdownDescription: "The address of the Teleport Proxy service. This should exclude the scheme but should include the port.",
+				Required:            true,
+			},
+			"join_method": schema.StringAttribute{
+				MarkdownDescription: "The join method to use to authenticate to the Teleport cluster.",
+				Required:            true,
+				Validators: []validator.String{
+					stringvalidator.OneOf(onboarding.SupportedJoinMethods...),
+					// Explicitly prohibit the use of the token join method
+					// as we won't be able to persist state for it to work
+					// effectively.
+					stringvalidator.NoneOf(string(apitypes.JoinMethodToken)),
+				},
+			},
+			"join_token": schema.StringAttribute{
+				MarkdownDescription: "The name of the join token to use to authenticate to the Teleport cluster.",
+				Required:            true,
+			},
+			"insecure": schema.BoolAttribute{
+				MarkdownDescription: "When enabled, the certificates of the Proxy will not be verified. This is not recommended for production use.",
+				Optional:            true,
+			},
+		},
+	}
+}
+
+type providerData struct {
+	newBotConfig func() bot.Config
+}
+
+func (p *Provider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
+	var data ProviderModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Shared internal store for the bot.
+	botInternalStore := destination.NewMemory()
+	newBotConfig := func() bot.Config {
+		return bot.Config{
+			Kind: bot.KindTerraformProvider,
+			Connection: connection.Config{
+				Address:     data.ProxyServer.ValueString(),
+				AddressKind: connection.AddressKindProxy,
+				Insecure:    data.Insecure.ValueBool(),
+			},
+			Onboarding: onboarding.Config{
+				JoinMethod: apitypes.JoinMethod(data.JoinMethod.ValueString()),
+				TokenValue: data.JoinToken.ValueString(),
+			},
+			InternalStorage: botInternalStore,
+			Logger:          slog.Default(),
+		}
+	}
+
+	botCfg := newBotConfig()
+	if err := botCfg.CheckAndSetDefaults(); err != nil {
+		resp.Diagnostics.AddError(
+			"Error setting defaults for bot config",
+			"Failed to set defaults for bot config: "+err.Error(),
+		)
+		return
+	}
+
+	bot, err := bot.New(botCfg)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error creating tbot",
+			"Failed to create tbot: "+err.Error(),
+		)
+		return
+	}
+
+	// Run bot just to validate that the configuration is correct.
+	if err := bot.OneShot(ctx); err != nil {
+		resp.Diagnostics.AddError(
+			"Error running tbot in provider",
+			"Failed to run tbot\n"+trace.DebugReport(err),
+		)
+		return
+	}
+
+	providerData := providerData{
+		newBotConfig: newBotConfig,
+	}
+	resp.DataSourceData = &providerData
+	resp.EphemeralResourceData = &providerData
+}
+
+func (p *Provider) EphemeralResources(ctx context.Context) []func() ephemeral.EphemeralResource {
+	return []func() ephemeral.EphemeralResource{
+		NewKubernetesEphemeralResource,
+	}
+}
+
+func (p *Provider) DataSources(ctx context.Context) []func() datasource.DataSource {
+	return []func() datasource.DataSource{
+		NewKubernetesDataSource,
+	}
+}
+
+func (p *Provider) Resources(ctx context.Context) []func() resource.Resource {
+	// We have to implement this method to satisfy the provider.Provider
+	// interface - but we don't have any resources to return.
+	return []func() resource.Resource{}
+}
diff --git a/integrations/terraform-mwi/provider/provider_test.go b/integrations/terraform-mwi/provider/provider_test.go
new file mode 100644
index 0000000000000..3c6d3af615e4f
--- /dev/null
+++ b/integrations/terraform-mwi/provider/provider_test.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2015-2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/providerserver"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-testing/echoprovider"
+)
+
+var testAccProtoV6ProviderFactories = map[string]func() (tfprotov6.ProviderServer, error){
+	"teleportmwi": providerserver.NewProtocol6WithError(New()()),
+}
+
+var testAccProtoV6ProviderFactoriesWithEcho = map[string]func() (tfprotov6.ProviderServer, error){
+	"teleportmwi": providerserver.NewProtocol6WithError(New()()),
+	"echo":        echoprovider.NewProviderServer(),
+}
+
+func testAccPreCheck(t *testing.T) {
+	// Code to run before any acceptance test.
+}
diff --git a/integrations/terraform-mwi/templates/data-sources-index.mdx.tmpl b/integrations/terraform-mwi/templates/data-sources-index.mdx.tmpl
new file mode 100644
index 0000000000000..b638e2ef3d25f
--- /dev/null
+++ b/integrations/terraform-mwi/templates/data-sources-index.mdx.tmpl
@@ -0,0 +1,28 @@
+---
+title: "MWI Terraform data-sources index"
+description: "Index of all the data-sources supported by the Teleport MWI Terraform Provider"
+---
+
+{{ "{/*Auto-generated file. Do not edit.*/}" }}
+{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
+
+{/*
+    This file will be renamed data-sources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+<Admonition type="info">
+This is reference page is for the Teleport MWI Terraform provider, which
+generates short-lived credentials using Teleport Machine & Workload Identity.
+These short-lived credentials can be used to grant other Terraform providers
+access to resources through Teleport.
+
+If you are looking to manage the configuration of Teleport itself, use the
+[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
+instead.
+</Admonition>
+
+The Teleport MWI Terraform provider supports the following data-sources:
+{{ range $key, $value := .DataSourceFiles }}
+  - [`{{$key}}`](./{{$value}}.mdx)
+{{- end }}
diff --git a/integrations/terraform-mwi/templates/data-sources.md.tmpl b/integrations/terraform-mwi/templates/data-sources.md.tmpl
new file mode 100644
index 0000000000000..e0b9064eeb5ae
--- /dev/null
+++ b/integrations/terraform-mwi/templates/data-sources.md.tmpl
@@ -0,0 +1,27 @@
+---
+title: Reference for the {{.Name}} Terraform data-source
+sidebar_label: {{ slice .Name (len "teleportmwi_") }}
+description: This page describes the supported values of the {{.Name}} data-source of the Teleport MWI Terraform provider.
+---
+
+{{ "{/*Auto-generated file. Do not edit.*/}" }}
+{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
+
+{{ .Description | trimspace }}
+
+{{ if .HasExample -}}
+## Example Usage
+
+{{tffile .ExampleFile }}
+{{- end }}
+
+{{ .SchemaMarkdown | trimspace }}
+{{- if .HasImport }}
+
+## Import
+
+Import is supported using the following syntax:
+
+{{codefile "shell" .ImportFile }}
+{{- end }}
+
diff --git a/integrations/terraform-mwi/templates/ephemeral-resources-index.mdx.tmpl b/integrations/terraform-mwi/templates/ephemeral-resources-index.mdx.tmpl
new file mode 100644
index 0000000000000..f91038e8f68ca
--- /dev/null
+++ b/integrations/terraform-mwi/templates/ephemeral-resources-index.mdx.tmpl
@@ -0,0 +1,28 @@
+---
+title: "MWI Terraform ephemeral resources index"
+description: "Index of all the resources supported by the Teleport MWI Terraform Provider"
+---
+
+{{ "{/*Auto-generated file. Do not edit.*/}" }}
+{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
+
+{/*
+    This file will be renamed ephemeral-resources.mdx during build time.
+    The template name is reserved by tfplugindocs so we suffix with -index.
+*/}
+
+<Admonition type="info">
+This is reference page is for the Teleport MWI Terraform provider, which
+generates short-lived credentials using Teleport Machine & Workload Identity.
+These short-lived credentials can be used to grant other Terraform providers
+access to resources through Teleport.
+
+If you are looking to manage the configuration of Teleport itself, use the
+[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
+instead.
+</Admonition>
+
+The Teleport MWI Terraform provider supports the following ephemeral resources:
+{{ range $key, $value := .EphemeralResourceFiles }}
+  - [`{{$key}}`](./{{$value}}.mdx)
+{{- end }}
diff --git a/integrations/terraform-mwi/templates/ephemeral-resources.md.tmpl b/integrations/terraform-mwi/templates/ephemeral-resources.md.tmpl
new file mode 100644
index 0000000000000..212d975333dd0
--- /dev/null
+++ b/integrations/terraform-mwi/templates/ephemeral-resources.md.tmpl
@@ -0,0 +1,29 @@
+---
+title: Reference for the {{.Name}} Terraform ephemeral resource
+sidebar_label: {{ slice .Name (len "teleportmwi_") }}
+description: This page describes the supported values of the {{.Name}} ephemeral resource of the Teleport MWI Terraform provider.
+---
+
+{{ "{/*Auto-generated file. Do not edit.*/}" }}
+{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
+
+This page describes the supported values of the {{.Name}} ephemeral resource of the Teleport MWI Terraform provider.
+{{ includefileifexists (printf "./examples/resources/%s/introduction.md" .Name)}}
+
+{{ .Description | trimspace }}
+
+{{ if .HasExample -}}
+## Example Usage
+
+{{tffile .ExampleFile }}
+{{- end }}
+
+{{ .SchemaMarkdown | trimspace }}
+{{- if .HasImport }}
+
+## Import
+
+Import is supported using the following syntax:
+
+{{codefile "shell" .ImportFile }}
+{{- end }}
diff --git a/integrations/terraform-mwi/templates/index.md.tmpl b/integrations/terraform-mwi/templates/index.md.tmpl
new file mode 100644
index 0000000000000..4de5110d30b1d
--- /dev/null
+++ b/integrations/terraform-mwi/templates/index.md.tmpl
@@ -0,0 +1,104 @@
+---
+title: "Teleport MWI Terraform Provider"
+description: Reference documentation of the Teleport MWI Terraform provider.
+tags:
+  - infrastructure-as-code
+  - reference
+  - mwi
+---
+
+{{ "{/*Auto-generated file. Do not edit.*/}" }}
+{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
+
+The Teleport MWI Terraform provider generates short-lived credentials using
+[Teleport Machine & Workload Identity (MWI)](../../machine-workload-identity/machine-workload-identity.mdx)
+that can be used to grant other Terraform providers access to resources.
+
+To manage the configuration of Teleport itself, use the [Teleport Terraform
+Provider instead](../terraform-provider/terraform-provider.mdx).
+
+{/* Note: the awkward `resource-index` file names are here because `data-sources`
+is reserved by the generator for the catch-all resource template */}
+
+- [list of supported ephemeral resources](./ephemeral-resources/ephemeral-resources.mdx)
+- [list of supported data-sources](./data-sources/data-sources.mdx)
+
+## Example usage
+
+In this example, we will use the Teleport MWI Terraform provider to grant the
+Kubernetes provider access to a Kubernetes cluster through Teleport.
+
+Our Kubernetes cluster is enrolled in Teleport under the name `my-cluster`, and
+we've setup a Bot and Join Token to allow our Terraform provider to authenticate
+to Teleport.
+
+```hcl
+terraform {
+  required_providers {
+    teleportmwi = {
+      source = "terraform.releases.teleport.dev/gravitational/teleportmwi"
+      version = "~> (=teleport.major_version=).0"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+  }
+}
+
+provider "teleportmwi" {
+  join_method = "gitlab"
+  join_token = "my-join-token"
+  proxy_server = "example.teleport.sh:443"
+}
+
+ephemeral "teleportmwi_kubernetes" "my_cluster" {
+  selector = {
+    name = "my-cluster"
+  }
+}
+
+
+// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
+provider "kubernetes" {
+  host                   = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
+  tls_server_name        = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
+  client_certificate     = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
+  client_key             = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
+  cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name = "example-namespace"
+  }
+}
+```
+
+## Ephemeral resources vs data sources
+
+The MWI Terraform provider exposes functionality using two different kinds of
+entity in the Terraform ecosystem: **ephemeral resources** and **data sources**.
+
+Ephemeral resources are supported by Terraform 1.10 and later, and should be
+the preferred way to use the MWI Terraform provider. They have the following
+benefits over data sources:
+
+- The short-lived credentials generated by the MWI Terraform provider will not
+  be persisted within the Terraform state.
+- Fresh short-lived credentials will be generated in the apply phase, allowing
+  you to grant read-only privileges to plan runs and read-write privileges to
+  apply runs.
+
+When using a version of Terraform that does not support ephemeral resources,
+you can use the data source variants instead. When using the data sources,
+keep the following in mind:
+
+- The short-lived secrets generated by the MWI Terraform provider will be
+  persisted within the Terraform state. The secrets will be generated in the
+  plan phase and reused in the apply phase. We therefore highly recommend that
+  you encrypt your Terraform state file.
+- You will need to configure a `credential_ttl` that will ensure that credentials
+  generated during the plan phase will still be valid during the apply phase.
+
+{{ .SchemaMarkdown | trimspace }}
+
diff --git a/integrations/terraform/Makefile b/integrations/terraform/Makefile
index 8ee957b93c99c..7001c918bdaf8 100644
--- a/integrations/terraform/Makefile
+++ b/integrations/terraform/Makefile
@@ -11,8 +11,21 @@ BUILDFLAGS ?= $(ADDFLAGS) -trimpath -ldflags '-w -s'
 # CGO must NOT be enabled as hashicorp cloud does not support running providers using on CGO.
 CGOFLAG ?= CGO_ENABLED=0
 
+# base name for release archive (used for .tar.gz packaging across all platforms)
 RELEASE = terraform-provider-teleport-v$(VERSION)-$(OS)-$(ARCH)-bin
 
+# executable extension (.exe) for windows specific builds
+EXEEXT =
+ifeq ($(OS),windows)
+  EXEEXT = .exe
+endif
+
+# filename of the compiled binary $(BUILDDIR)
+BINARY_NAME = terraform-provider-teleport$(EXEEXT)
+
+# windows terraform provider filename as it will appear on downloads page
+WINDOWS_DOWNLOAD_FILENAME := terraform-provider-teleport-v$(VERSION)-windows-$(ARCH)$(EXEEXT)
+
 .PHONY: tfclean
 tfclean:
 	rm -rf $(TFDIR)/terraform.tfstate
@@ -25,12 +38,15 @@ clean: tfclean
 	rm -rf $(PROVIDER_PATH)*
 	rm -rf $(BUILDDIR)/*
 	rm -rf $(RELEASE).tar.gz
+	rm -rf $(RELEASE)$(EXEEXT)
 	go clean
 
 .PHONY: build
 build: clean
 # Turning off GOWORK to prevent missing package errors.
-	GOWORK=off GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -tags "kustomize_disable_go_plugin_support" -o $(BUILDDIR)/terraform-provider-teleport $(BUILDFLAGS)
+	GOWORK=off GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) \
+		go build -tags "kustomize_disable_go_plugin_support,terraformprovider" \
+		-o $(BUILDDIR)/$(BINARY_NAME) $(BUILDFLAGS)
 
 build-darwin-universal: $(addprefix $(BUILDDIR)/terraform-provider-teleport_,arm64 amd64)
 	lipo -create -output $(BUILDDIR)/terraform-provider-teleport $^
@@ -47,7 +63,7 @@ $(BUILDDIR)/terraform-provider-teleport_%: terraform-provider-teleport-v$(VERSIO
 
 CUSTOM_IMPORTS_TMP_DIR ?= /tmp/protoc-gen-terraform/custom-imports
 # This version must match the version installed by .github/workflows/lint.yaml
-PROTOC_GEN_TERRAFORM_VERSION ?= v3.0.2
+PROTOC_GEN_TERRAFORM_VERSION ?= v3.0.3
 PROTOC_GEN_TERRAFORM_EXISTS := $(shell $(PROTOC_GEN_TERRAFORM) version 2>&1 >/dev/null | grep 'protoc-gen-terraform $(PROTOC_GEN_TERRAFORM_VERSION)')
 
 .PHONY: gen-tfschema
@@ -126,6 +142,13 @@ endif
 		--terraform_out=config=protoc-gen-terraform-healthcheckconfig.yaml:./tfschema \
 		teleport/healthcheckconfig/v1/health_check_config.proto
 
+	@protoc \
+		-I=../../api/proto \
+		-I=$(PROTOBUF_MOD_PATH) \
+		--plugin=$(PROTOC_GEN_TERRAFORM) \
+		--terraform_out=config=protoc-gen-terraform-discoveryconfig.yaml:./tfschema \
+		teleport/discoveryconfig/v1/discoveryconfig.proto
+
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1/loginrule_terraform.go ./tfschema/loginrule/v1/
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1/accesslist_terraform.go ./tfschema/accesslist/v1/
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_terraform.go ./tfschema/accessmonitoringrules/v1/
@@ -133,6 +156,7 @@ endif
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1/resource_terraform.go ./tfschema/workloadidentity/v1/
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1/autoupdate_terraform.go ./tfschema/autoupdate/v1/
 	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1/health_check_config_terraform.go ./tfschema/healthcheckconfig/v1/
+	mv ./tfschema/github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_terraform.go ./tfschema/discoveryconfig/v1/
 	mv ./tfschema/github.com/gravitational/teleport/api/types/device_terraform.go ./tfschema/devicetrust/v1/
 	rm -r ./tfschema/github.com/
 	@go run ./gen/main.go
@@ -151,10 +175,18 @@ endif
 .PHONY: release
 ifeq ($(OS),darwin)
 release: darwin-signed-build
-else
+	tar -C $(BUILDDIR) -czf $(RELEASE).tar.gz .
+else ifeq ($(OS),linux)
 release: build
-endif
 	tar -C $(BUILDDIR) -czf $(RELEASE).tar.gz .
+else ifeq ($(OS),windows)
+release: build
+	# copy the built windows binary to its final release filename for public downloads
+	cp $(BUILDDIR)/$(BINARY_NAME) $(WINDOWS_DOWNLOAD_FILENAME)
+	# package ony the binary file into a .tar.gz archive, the release service will repackage this into a .zip
+	# for the Terraform registry
+	tar -C $(BUILDDIR) -czf $(RELEASE).tar.gz $(BINARY_NAME)
+endif
 
 TERRAFORM_EXISTS := $(shell terraform -version 2>/dev/null | grep 'Terraform v1.')
 CURRENT_ULIMIT := $(shell ulimit -n)
@@ -168,12 +200,8 @@ ifndef TERRAFORM_EXISTS
 	terraform -version
 	@exit -1
 endif
-# NOTE: This is related to an old bug in Terraform and will be fixed in future releases (possibly, by a workaround on our side)
-ifeq ($(shell expr $(CURRENT_ULIMIT) \< 1024), 1)
-	@echo "ulimit -n is too low ($(CURRENT_ULIMIT)), please set ulimit -n 1024"
-	@exit -1
-endif
-	go test ./testlib -v $(TEST_ARGS)
+
+	gotestsum --junitfile unit-tests-terraform.xml --jsonfile unit-tests-terraform.json -- ./testlib -v $(TEST_ARGS)
 
 .PHONY: test-full
 test-full: TEST_ARGS=--tags enterprisetests
diff --git a/integrations/terraform/README.md b/integrations/terraform/README.md
index dde74bc7b793b..fde91ae59d0f9 100644
--- a/integrations/terraform/README.md
+++ b/integrations/terraform/README.md
@@ -7,9 +7,9 @@ Please, refer to [official documentation](https://goteleport.com/docs/admin-guid
 ## Development
 
 1. Install [`protobuf`](https://grpc.io/docs/protoc-installation/).
-2. Install [`protoc-gen-terraform`](https://github.com/gravitational/protoc-gen-terraform) @v3.0.2.
+2. Install [`protoc-gen-terraform`](https://github.com/gravitational/protoc-gen-terraform) @v3.0.3.
 
-    ```go install github.com/gravitational/protoc-gen-terraform/v3@v3.0.2```
+    ```go install github.com/gravitational/protoc-gen-terraform/v3@v3.0.3```
 
 3. Install [`Terraform`](https://learn.hashicorp.com/tutorials/terraform/install-cli) v1.1.0+. Alternatively, you can use [`tfenv`](https://github.com/tfutils/tfenv). Please note that on Mac M1 you need to specify `TFENV_ARCH` (ex: `TFENV_ARCH=arm64 tfenv install 1.1.6`).
 
diff --git a/integrations/terraform/examples/resources/teleport_access_list/resource.tf b/integrations/terraform/examples/resources/teleport_access_list/resource.tf
index 46df26a305b6a..8a43fa297cf45 100644
--- a/integrations/terraform/examples/resources/teleport_access_list/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_access_list/resource.tf
@@ -1,5 +1,6 @@
 resource "teleport_access_list" "crane-operation" {
   header = {
+    version = "v1"
     metadata = {
       name = "crane-operation"
       labels = {
diff --git a/integrations/terraform/examples/resources/teleport_access_list_member/resource.tf b/integrations/terraform/examples/resources/teleport_access_list_member/resource.tf
new file mode 100644
index 0000000000000..246b2f5b2e20a
--- /dev/null
+++ b/integrations/terraform/examples/resources/teleport_access_list_member/resource.tf
@@ -0,0 +1,72 @@
+resource "teleport_access_list" "characters" {
+  header = {
+    metadata = {
+      name = "crane-operation"
+    }
+  }
+  spec = {
+    type        = "static" # the access list must be of type "static" to manage its members with Terraform
+    title       = "Characters"
+    description = "The list of game characters."
+    owners = [
+      { name = "dungeon_master" },
+    ]
+    grants = {
+      roles = ["dungeon_access"]
+    }
+  }
+}
+
+# User member:
+
+resource "teleport_access_list_member" "fighter" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = "fighter" # Teleport user name
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.characters.id
+    membership_kind = 1 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
+
+# Nested Access List member:
+
+resource "teleport_access_list" "npcs" {
+  header = {
+    metadata = {
+      name = "npcs"
+    }
+  }
+  spec = {
+    title       = "NPCs"
+    description = "Non-player characters."
+    owners = [
+      { name = "dungeon_master" }
+    ]
+    grants = {
+      roles = ["dungeon_access"]
+    }
+    audit = {
+      recurrence = {
+        frequency    = 3
+        day_of_month = 15
+      }
+    }
+  }
+}
+
+resource "teleport_access_list_member" "npcs" {
+  header = {
+    version = "v1"
+    metadata = {
+      name = teleport_access_list.npcs.id
+    }
+  }
+  spec = {
+    access_list     = teleport_access_list.characters.id
+    membership_kind = 2 # 1 for "MEMBERSHIP_KIND_USER", 2 for "MEMBERSHIP_KIND_LIST"
+  }
+}
diff --git a/integrations/terraform/examples/resources/teleport_access_monitoring_rule/resource.tf b/integrations/terraform/examples/resources/teleport_access_monitoring_rule/resource.tf
index 987ddd9fd2f18..cd49142390155 100644
--- a/integrations/terraform/examples/resources/teleport_access_monitoring_rule/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_access_monitoring_rule/resource.tf
@@ -1,3 +1,9 @@
+# Teleport Access Monitoring Rule enables notification routing or automatic
+# review rules based on specific conditions.
+#
+# This example automatically approves access requests for the role `your_role_name`
+# on Mondays and Tuesdays, and sends notifications to `#your-slack-channel`.
+
 resource "teleport_access_monitoring_rule" "test" {
   version = "v1"
   metadata = {
@@ -9,11 +15,31 @@ resource "teleport_access_monitoring_rule" "test" {
     desired_state = "reviewed"
     notification = {
       name       = "slack"
-      recipients = ["your-slack-channel"]
+      recipients = ["#your-slack-channel"]
     }
+
     automatic_review = {
       integration = "builtin"
       decision    = "APPROVED"
     }
+    schedules = {
+      default = {
+        time = {
+          timezone = "America/Los_Angeles"
+          shifts = [
+            {
+              weekday : "Monday"
+              start : "00:00"
+              end : "23:59"
+            },
+            {
+              weekday : "Tuesday"
+              start : "00:00"
+              end : "23:59"
+            },
+          ]
+        }
+      }
+    }
   }
 }
diff --git a/integrations/terraform/examples/resources/teleport_bot/resource.tf b/integrations/terraform/examples/resources/teleport_bot/resource.tf
index 0298ca1982f08..2738c225a9091 100644
--- a/integrations/terraform/examples/resources/teleport_bot/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_bot/resource.tf
@@ -1,34 +1,11 @@
 # Teleport Machine ID Bot creation example
 
-locals {
-  bot_name = "example"
-}
-
-resource "random_password" "bot_token" {
-  length  = 32
-  special = false
-}
-
-resource "time_offset" "bot_example_token_expiry" {
-  offset_hours = 1
-}
-
-resource "teleport_provision_token" "bot_example" {
+resource "teleport_bot" "example" {
   metadata = {
-    expires     = time_offset.bot_example_token_expiry.rfc3339
-    description = "Bot join token for ${local.bot_name} generated by Terraform"
-
-    name = random_password.bot_token.result
+    name = "example"
   }
 
   spec = {
-    roles       = ["Bot"]
-    bot_name    = local.bot_name
-    join_method = "token"
+    roles = ["access"]
   }
 }
-
-resource "teleport_bot" "example" {
-  name  = local.bot_name
-  roles = ["access"]
-}
diff --git a/integrations/terraform/examples/resources/teleport_database/introduction.md b/integrations/terraform/examples/resources/teleport_database/introduction.md
index 91e4b924b1d35..4089f6f64cee0 100644
--- a/integrations/terraform/examples/resources/teleport_database/introduction.md
+++ b/integrations/terraform/examples/resources/teleport_database/introduction.md
@@ -1,2 +1,2 @@
-Follow [the database dynamic registration guide](../../../enroll-resources/database-access/guides/dynamic-registration.mdx)
+Follow [the database dynamic registration guide](../../../../enroll-resources/database-access/guides/dynamic-registration.mdx)
 to complete deploying a database_service and access the database resource
diff --git a/integrations/terraform/examples/resources/teleport_discovery_config/resource.tf b/integrations/terraform/examples/resources/teleport_discovery_config/resource.tf
new file mode 100644
index 0000000000000..c44123932ae9d
--- /dev/null
+++ b/integrations/terraform/examples/resources/teleport_discovery_config/resource.tf
@@ -0,0 +1,74 @@
+# Teleport Discovery Config
+#
+# Discovery Config resources define matchers for the Teleport Discovery Service.
+# The Discovery Service automatically discovers and enrolls cloud resources
+# (EC2 instances, RDS databases, EKS clusters, Azure VMs, etc.) into your
+# Teleport cluster.
+#
+# Each Discovery Config is associated with a discovery_group. Discovery Services
+# load matchers from Discovery Configs that share the same discovery_group.
+
+# Example: AWS Discovery Config for EC2 instances and RDS databases
+resource "teleport_discovery_config" "aws_example" {
+  header = {
+    metadata = {
+      name        = "aws-discovery"
+      description = "Discover AWS EC2 instances and RDS databases"
+      labels = {
+        env = "production"
+      }
+    }
+    version = "v1"
+  }
+
+  spec = {
+    discovery_group = "aws-prod"
+
+    aws = [{
+      types   = ["ec2", "rds"]
+      regions = ["us-west-2", "us-east-1"]
+      tags = {
+        "env" = ["prod", "production"]
+      }
+      install_params = {
+        join_method = "iam"
+        join_token  = "aws-discovery-token"
+        script_name = "default-installer"
+      }
+    }]
+  }
+}
+
+# Example: Azure Discovery Config for VMs and AKS clusters
+resource "teleport_discovery_config" "azure_example" {
+  header = {
+    metadata = {
+      name        = "azure-discovery"
+      description = "Discover Azure VMs and AKS clusters"
+    }
+    version = "v1"
+  }
+
+  spec = {
+    discovery_group = "azure-prod"
+
+    azure = [{
+      types           = ["vm", "aks"]
+      regions         = ["eastus", "westus2"]
+      subscriptions   = ["00000000-0000-0000-0000-000000000000"]
+      resource_groups = ["my-resource-group"]
+      tags = {
+        "*" = ["*"]
+      }
+      install_params = {
+        join_method = "azure"
+        join_token  = "azure-discovery-token"
+        script_name = "default-installer"
+        azure = {
+          client_id = "00000000-0000-0000-0000-000000000000"
+        }
+      }
+    }]
+  }
+}
+
diff --git a/integrations/terraform/examples/resources/teleport_integration/resource.tf b/integrations/terraform/examples/resources/teleport_integration/resource.tf
new file mode 100644
index 0000000000000..b81ff44ea2ef7
--- /dev/null
+++ b/integrations/terraform/examples/resources/teleport_integration/resource.tf
@@ -0,0 +1,68 @@
+resource "teleport_integration" "aws_oidc" {
+  version  = "v1"
+  sub_kind = "aws-oidc"
+  metadata = {
+    name        = "example"
+    description = "AWS OIDC integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    aws_oidc = {
+      role_arn = "arn:aws:iam::123456789012:role/example-role-name"
+    }
+  }
+}
+
+resource "teleport_integration" "azure_oidc" {
+  version  = "v1"
+  sub_kind = "azure-oidc"
+  metadata = {
+    name        = "azure-oidc"
+    description = "Example Azure OIDC integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    azure_oidc = {
+      // Azure Entra ID tenant ID
+      tenant_id = "a1b2c3d4-f2e4-97a8-9abc-1234567890ab"
+      // Azure enterprise application client ID
+      client_id = "7f12e3b5-6789-4abc-def0-112233445566"
+    }
+  }
+}
+
+resource "teleport_integration" "aws_roles_anywhere" {
+  version  = "v1"
+  sub_kind = "aws-ra"
+  metadata = {
+    name        = "aws-ra"
+    description = "Example AWS Roles Anywhere integration"
+    labels = {
+      env = "dev"
+    }
+  }
+
+  spec = {
+    aws_ra = {
+      profile_sync_config = {
+        // sync AWS profiles as Teleport applications
+        enabled                           = true
+        profile_accepts_role_session_name = false
+        profile_arn                       = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/<random-uuid>"
+        role_arn                          = "arn:aws:iam::123456789012:role/example-role-name"
+        // only sync AWS profiles as Teleport applications if the profile name matches
+        profile_name_filters = [
+          "teleport-*",    // supports globs
+          "^teleport-.*$", // and regex if the string is enclosed in regex anchors
+        ]
+      }
+      trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/<random-uuid>"
+    }
+  }
+}
diff --git a/integrations/terraform/examples/resources/teleport_login_rule/resource.tf b/integrations/terraform/examples/resources/teleport_login_rule/resource.tf
index ba4a00122fa65..b3f4b79c7e5eb 100644
--- a/integrations/terraform/examples/resources/teleport_login_rule/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_login_rule/resource.tf
@@ -10,6 +10,8 @@ resource "teleport_login_rule" "example" {
 
   version  = "v1"
   priority = 0
+
+  # Either traits_map or traits_expression must be provided, but not both.
   traits_map = {
     "logins" = {
       values = [
@@ -23,4 +25,10 @@ resource "teleport_login_rule" "example" {
       ]
     }
   }
+  #   # This traits_expression is functionally equivalent to the traits_map above.
+  #   traits_expression = <<EOF
+  # dict(
+  #   pair("logins", union(external.logins, external.username))
+  #   pair("groups", external.groups))
+  # EOF
 }
diff --git a/integrations/terraform/examples/resources/teleport_provision_token/resource.tf b/integrations/terraform/examples/resources/teleport_provision_token/resource.tf
index 8761088fcd0b3..303805e9795ec 100644
--- a/integrations/terraform/examples/resources/teleport_provision_token/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_provision_token/resource.tf
@@ -1,6 +1,7 @@
 # Teleport Provision Token resource
 
 resource "teleport_provision_token" "example" {
+  version = "v2"
   metadata = {
     expires     = "2022-10-12T07:20:51Z"
     description = "Example token"
@@ -17,6 +18,7 @@ resource "teleport_provision_token" "example" {
 }
 
 resource "teleport_provision_token" "iam-token" {
+  version = "v2"
   metadata = {
     name = "iam-token"
   }
diff --git a/integrations/terraform/examples/resources/teleport_role/resource.tf b/integrations/terraform/examples/resources/teleport_role/resource.tf
index a34ab40a44552..50b4cdaa1313b 100644
--- a/integrations/terraform/examples/resources/teleport_role/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_role/resource.tf
@@ -1,7 +1,7 @@
 # Teleport Role resource
 
 resource "teleport_role" "example" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name        = "example"
     description = "Example Teleport Role"
diff --git a/integrations/terraform/examples/resources/teleport_trusted_device/resource.tf b/integrations/terraform/examples/resources/teleport_trusted_device/resource.tf
index 4eafa867a8719..f336fa94f66e8 100644
--- a/integrations/terraform/examples/resources/teleport_trusted_device/resource.tf
+++ b/integrations/terraform/examples/resources/teleport_trusted_device/resource.tf
@@ -1,6 +1,7 @@
 # Trusted device resource
 
 resource "teleport_trusted_device" "TESTDEVICE1" {
+  version = "v1"
   spec = {
     asset_tag = "TESTDEVICE1"
     os_type   = "macos"
diff --git a/integrations/terraform/gen/docs.sh b/integrations/terraform/gen/docs.sh
index ddddea1c03f3f..7e91b9ab0d8d1 100755
--- a/integrations/terraform/gen/docs.sh
+++ b/integrations/terraform/gen/docs.sh
@@ -22,7 +22,7 @@ if [ -z "$VERSION" ]; then
 fi
 
 TFDIR="$(pwd)"
-DOCSDIR="$(pwd)/../../docs/pages/reference/terraform-provider"
+DOCSDIR="$(pwd)/../../docs/pages/reference/infrastructure-as-code/terraform-provider"
 TMPDIR="$(mktemp -d)"
 
 info "Generating provider's schema"
diff --git a/integrations/terraform/gen/main.go b/integrations/terraform/gen/main.go
index 1ccc2c811a578..47b4bde84bceb 100644
--- a/integrations/terraform/gen/main.go
+++ b/integrations/terraform/gen/main.go
@@ -21,7 +21,10 @@ import (
 	"log"
 	"os"
 	"path"
+	"strings"
 	"text/template"
+
+	"github.com/gravitational/teleport/integrations/terraform/gen/strcase"
 )
 
 // payload represents template payload
@@ -50,6 +53,8 @@ type payload struct {
 	WithSecrets string
 	// ID id value on create and import
 	ID string
+	// IDPrefix is optional for resources which are stored with an prefix in the backend.
+	IDPrefix string
 	// RandomMetadataName indicates that Metadata.Name must be generated (supported by plural resources only)
 	RandomMetadataName bool
 	// UUIDMetadataName functions similar to RandomMetadataName but generates UUID instead of
@@ -90,6 +95,12 @@ type payload struct {
 	WithNonce bool
 	// ConvertPackagePath is the path of the package doing the conversion between protobuf and the go types.
 	ConvertPackagePath string
+	// ConvertToProtoFunc is the function converting the internal struct to the protobuf
+	// struct. Defaults to "ToProto" if empty.
+	ConvertToProtoFunc string
+	// ConvertFromProtoFunc is the function converting the protobuf struct to the internal
+	// struct. Defaults to "FromProto" if empty.
+	ConvertFromProtoFunc string
 	// PropagatedFields is a list of fields that must be copied from the
 	// existing resource when we're updating it. For example:
 	// "Spec.Audit.NextAuditDate" in AccessList resource
@@ -441,6 +452,30 @@ var (
 		PropagatedFields:       []string{"Spec.Audit.NextAuditDate"},
 	}
 
+	accessListMember = payload{
+		Name:                   "Member",
+		TypeName:               "Member",
+		VarName:                "accessListMember",
+		GetMethod:              "AccessListClient().GetStaticAccessListMember",
+		CreateMethod:           "AccessListClient().UpsertStaticAccessListMember",
+		UpsertMethodArity:      2,
+		UpdateMethod:           "AccessListClient().UpsertStaticAccessListMember",
+		DeleteMethod:           "AccessListClient().DeleteStaticAccessListMember",
+		IDPrefix:               "accessListMember.Spec.AccessList",
+		ID:                     "accessListMember.Header.Metadata.Name",
+		Kind:                   "access_list_member",
+		HasStaticID:            false,
+		SchemaPackage:          "schemav1",
+		SchemaPackagePath:      "github.com/gravitational/teleport/integrations/terraform/tfschema/accesslist/v1",
+		ProtoPackage:           "accesslist",
+		ProtoPackagePath:       "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1",
+		TerraformResourceType:  "teleport_access_list_member",
+		ConvertPackagePath:     "github.com/gravitational/teleport/api/types/accesslist/convert/v1",
+		ConvertToProtoFunc:     "ToMemberProto",
+		ConvertFromProtoFunc:   "FromMemberProto",
+		HasCheckAndSetDefaults: true,
+	}
+
 	server = payload{
 		Name:                   "Server",
 		TypeName:               "ServerV2",
@@ -630,6 +665,45 @@ var (
 		ExtraImports: []string{"apitypes \"github.com/gravitational/teleport/api/types\""},
 		ForceSetKind: "apitypes.KindHealthCheckConfig",
 	}
+
+	discoveryConfig = payload{
+		Name:                  "DiscoveryConfig",
+		TypeName:              "DiscoveryConfig",
+		VarName:               "discoveryConfig",
+		GetMethod:             "DiscoveryConfigClient().GetDiscoveryConfig",
+		CreateMethod:          "DiscoveryConfigClient().CreateDiscoveryConfig",
+		UpsertMethodArity:     2,
+		UpdateMethod:          "DiscoveryConfigClient().UpsertDiscoveryConfig",
+		DeleteMethod:          "DiscoveryConfigClient().DeleteDiscoveryConfig",
+		ID:                    "discoveryConfig.Header.Metadata.Name",
+		Kind:                  "discovery_config",
+		HasStaticID:           false,
+		ProtoPackage:          "discoveryconfigv1",
+		ProtoPackagePath:      "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1",
+		SchemaPackage:         "schemav1",
+		SchemaPackagePath:     "github.com/gravitational/teleport/integrations/terraform/tfschema/discoveryconfig/v1",
+		TerraformResourceType: "teleport_discovery_config",
+		ExtraImports:          []string{"apitypes \"github.com/gravitational/teleport/api/types\""},
+		ForceSetKind:          "apitypes.KindDiscoveryConfig",
+		ConvertPackagePath:    "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1",
+	}
+
+	integration = payload{
+		Name:                   "Integration",
+		VarName:                "integration",
+		TypeName:               "IntegrationV1",
+		IfaceName:              "Integration",
+		GetMethod:              "GetIntegration",
+		CreateMethod:           "CreateIntegration",
+		UpdateMethod:           "UpdateIntegration",
+		UpsertMethodArity:      2,
+		DeleteMethod:           "DeleteIntegration",
+		ID:                     "integration.Metadata.Name",
+		Kind:                   "integration",
+		HasStaticID:            false,
+		TerraformResourceType:  "teleport_integration",
+		HasCheckAndSetDefaults: true,
+	}
 )
 
 func main() {
@@ -673,6 +747,8 @@ func genTFSchema() {
 	generateDataSource(oktaImportRule, pluralDataSource)
 	generateResource(accessList, pluralResource)
 	generateDataSource(accessList, pluralDataSource)
+	generateResource(accessListMember, pluralResource)
+	generateDataSource(accessListMember, pluralDataSource)
 	generateResource(server, pluralResource)
 	generateDataSource(server, pluralDataSource)
 	generateResource(installer, pluralResource)
@@ -689,6 +765,10 @@ func genTFSchema() {
 	generateDataSource(autoUpdateConfig, singularDataSource)
 	generateResource(healthCheckConfig, pluralResource)
 	generateDataSource(healthCheckConfig, pluralDataSource)
+	generateResource(discoveryConfig, pluralResource)
+	generateDataSource(discoveryConfig, pluralDataSource)
+	generateResource(integration, pluralResource)
+	generateDataSource(integration, pluralDataSource)
 }
 
 func generateResource(p payload, tpl string) {
@@ -706,6 +786,9 @@ func generate(p payload, tpl, outFile string) {
 	}
 
 	funcs := template.FuncMap{
+		"join":    strings.Join,
+		"split":   strings.Split,
+		"toSnake": toSnake,
 		"schemaImport": func(p payload) string {
 			if p.SchemaPackage == "tfschema" {
 				return `"` + p.SchemaPackagePath + `"`
@@ -738,3 +821,8 @@ func generate(p payload, tpl, outFile string) {
 		log.Fatal(err)
 	}
 }
+
+// ToSnake converts a string to snake_case ignoring "." characters.
+func toSnake(s string) string {
+	return strcase.ToScreamingDelimited(s, '_', ".", false)
+}
diff --git a/integrations/terraform/gen/plural_data_source.go.tpl b/integrations/terraform/gen/plural_data_source.go.tpl
index 744b02f4d0f6d..ee8070fec3f18 100644
--- a/integrations/terraform/gen/plural_data_source.go.tpl
+++ b/integrations/terraform/gen/plural_data_source.go.tpl
@@ -57,18 +57,25 @@ func (r dataSourceTeleport{{.Name}}Type) NewDataSource(_ context.Context, p tfsd
 
 // Read reads teleport {{.Name}}
 func (r dataSourceTeleport{{.Name}}) Read(ctx context.Context, req tfsdk.ReadDataSourceRequest, resp *tfsdk.ReadDataSourceResponse) {
+	{{ if .IDPrefix -}}
+	{{ $idPrefixPath := slice (split (toSnake .IDPrefix) ".") 1 -}}
+	{{ $root := index $idPrefixPath 0 -}}
+	{{ $atNames := slice $idPrefixPath 1 -}}
+	var idPrefix types.String
+	diags := req.Config.GetAttribute(ctx, path.Root("{{ $root }}"){{ range $atNames }}.AtName("{{ . }}"){{ end }}, &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	{{ end -}}
 	var id types.String
-	{{- if .ConvertPackagePath}}
-	diags := req.Config.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
-	{{- else }}
-	diags := req.Config.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
-	{{- end}}
+	diags {{ if not .IDPrefix }}:{{ end }}= req.Config.GetAttribute(ctx, path.Root({{ if .ConvertPackagePath }}"header").AtName({{ end }}"metadata").AtName("name"), &id)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
-	{{.VarName}}I, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}id.Value{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	{{.VarName}}I, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix.Value, {{end}}id.Value{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(err), "{{.Kind}}"))
 		return
@@ -86,13 +93,17 @@ func (r dataSourceTeleport{{.Name}}) Read(ctx context.Context, req tfsdk.ReadDat
 	// https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
 	v, ok := state.Attrs["id"]
 	if !ok || v.IsNull() {
+		{{- if .IDPrefix }}
+		state.Attrs["id"] = types.String{Value: formatID(idPrefix.Value, id.Value)}
+		{{- else }}
 		state.Attrs["id"] = id
+		{{- end }}
 	}
 
 	{{if .IsPlainStruct -}}
 	{{.VarName}} := {{.VarName}}I
 	{{else if .ConvertPackagePath -}}
-	{{.VarName}} := convert.ToProto({{.VarName}}I)
+	{{.VarName}} := convert.{{ if .ConvertToProtoFunc }}{{.ConvertToProtoFunc}}{{ else }}ToProto{{ end }}({{.VarName}}I)
 	{{else}}
 	{{.VarName}} := {{.VarName}}I.(*{{.ProtoPackage}}.{{.TypeName}})
 	{{- end}}
diff --git a/integrations/terraform/gen/plural_resource.go.tpl b/integrations/terraform/gen/plural_resource.go.tpl
index 89b4557008a8f..9ac8072e4a26b 100644
--- a/integrations/terraform/gen/plural_resource.go.tpl
+++ b/integrations/terraform/gen/plural_resource.go.tpl
@@ -111,7 +111,7 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 	}
 	{{- end}}
 {{- if .ConvertPackagePath}}
-	{{.VarName}}Resource, err := convert.FromProto({{.VarName}})
+	{{.VarName}}Resource, err := convert.{{ if .ConvertFromProtoFunc }}{{.ConvertFromProtoFunc}}{{ else }}FromProto{{ end }}({{.VarName}})
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Errorf("Can not convert %T to {{.TypeName}}: %s", {{.VarName}}Resource, err), "{{.Kind}}"))
 		return
@@ -132,11 +132,17 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 	}
 {{- end}}
 
+	{{ if .IDPrefix -}}
+	idPrefix := {{.VarName}}Resource.{{ join (slice (split .IDPrefix ".") 1) "." }}
+	{{ end -}}
 	id := {{.VarName}}Resource.Metadata.Name
 
-	_, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}id{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	_, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix, {{end}}id{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 	if !trace.IsNotFound(err) {
 		if err == nil {
+			{{ if .IDPrefix -}}
+			id := formatID(idPrefix, id)
+			{{ end -}}
 			existErr := fmt.Sprintf("{{.Name}} exists in Teleport. Either remove it (tctl rm {{.Kind}}/%v)"+
 				" or import it to the existing state (terraform import {{.TerraformResourceType}}.%v %v)", id, id, id)
 
@@ -163,19 +169,21 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 	var {{.VarName}}I {{.ProtoPackage}}.{{ if ne .IfaceName ""}}{{.IfaceName}}{{else}}{{.Name}}{{end}}
 		{{- end}}
 	{{- end }}
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
-		{{.VarName}}I, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}id{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+		{{.VarName}}I, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix, {{end}}id{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(bErr), "{{.Kind}}"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(err), "{{.Kind}}"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading {{.Name}} (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "{{.Kind}}")
+				return
 			}
 			continue
 		}
@@ -198,7 +206,7 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 	{{- end}}
 
 	{{- if .ConvertPackagePath}}
-	{{.VarName}} = convert.ToProto({{.VarName}}Resource)
+	{{.VarName}} = convert.{{ if .ConvertToProtoFunc }}{{.ConvertToProtoFunc}}{{ else }}ToProto{{ end }}({{.VarName}}Resource)
 	{{else}}
 	{{.VarName}} = {{.VarName}}Resource
 	{{- end }}
@@ -209,7 +217,11 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 		return
 	}
 
+	{{ if .IDPrefix -}}
+	plan.Attrs["id"] = types.String{Value: formatID(idPrefix, {{.ID}})}
+	{{- else -}}
 	plan.Attrs["id"] = types.String{Value: {{.ID}}}
+	{{- end }}
 
 	diags = resp.State.Set(ctx, &plan)
 	resp.Diagnostics.Append(diags...)
@@ -227,6 +239,18 @@ func (r resourceTeleport{{.Name}}) Read(ctx context.Context, req tfsdk.ReadResou
 		return
 	}
 
+	{{ if .IDPrefix -}}
+	{{ $idPrefixPath := slice (split (toSnake .IDPrefix) ".") 1 -}}
+	{{ $root := index $idPrefixPath 0 -}}
+	{{ $atNames := slice $idPrefixPath 1 -}}
+	var idPrefix types.String
+	diags = req.State.GetAttribute(ctx, path.Root("{{ $root }}"){{ range $atNames }}.AtName("{{ . }}"){{ end }}, &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	{{ end -}}
 	var id types.String
 	{{- if .ConvertPackagePath}}
 	diags = req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
@@ -238,7 +262,7 @@ func (r resourceTeleport{{.Name}}) Read(ctx context.Context, req tfsdk.ReadResou
 		return
 	}
 
-	{{.VarName}}I, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}id.Value{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	{{.VarName}}I, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix.Value, {{end}}id.Value{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 	if trace.IsNotFound(err) {
 		resp.State.RemoveResource(ctx)
 		return
@@ -251,7 +275,7 @@ func (r resourceTeleport{{.Name}}) Read(ctx context.Context, req tfsdk.ReadResou
 	{{if .IsPlainStruct -}}
 	{{.VarName}} := {{.VarName}}I
 	{{else if .ConvertPackagePath -}}
-	{{.VarName}} := convert.ToProto({{.VarName}}I)
+	{{.VarName}} := convert.{{ if .ConvertToProtoFunc }}{{.ConvertToProtoFunc}}{{ else }}ToProto{{ end }}({{.VarName}}I)
 	{{ else }}
 	{{.VarName}} := {{.VarName}}I.(*{{.ProtoPackage}}.{{.TypeName}})
 	{{end -}}
@@ -290,7 +314,7 @@ func (r resourceTeleport{{.Name}}) Update(ctx context.Context, req tfsdk.UpdateR
 	}
 
 {{- if .ConvertPackagePath}}
-	{{.VarName}}Resource, err := convert.FromProto({{.VarName}})
+	{{.VarName}}Resource, err := convert.{{ if .ConvertFromProtoFunc }}{{.ConvertFromProtoFunc}}{{ else }}FromProto{{ end }}({{.VarName}})
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Errorf("Can not convert %T to {{.TypeName}}: %s", {{.VarName}}Resource, err), "{{.Kind}}"))
 		return
@@ -305,9 +329,13 @@ func (r resourceTeleport{{.Name}}) Update(ctx context.Context, req tfsdk.UpdateR
 		return
 	}
 	{{- end}}
+	{{ if .IDPrefix -}}
+	{{ $idPrefix := join (slice (split .IDPrefix ".") 1) "." -}}
+	idPrefix := {{.VarName}}Resource.{{$idPrefix}}
+	{{ end -}}
 	name := {{.VarName}}Resource.Metadata.Name
 
-	{{.VarName}}Before, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}name{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	{{.VarName}}Before, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix, {{end}}name{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", err, "{{.Kind}}"))
 		return
@@ -338,7 +366,7 @@ func (r resourceTeleport{{.Name}}) Update(ctx context.Context, req tfsdk.UpdateR
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
-		{{.VarName}}I, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}name{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+		{{.VarName}}I, err = r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix, {{end}}name{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", err, "{{.Kind}}"))
 			return
@@ -382,18 +410,30 @@ func (r resourceTeleport{{.Name}}) Update(ctx context.Context, req tfsdk.UpdateR
 
 // Delete deletes Teleport {{.Name}}
 func (r resourceTeleport{{.Name}}) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
+	{{ if .IDPrefix -}}
+	{{ $idPrefixPath := slice (split (toSnake .IDPrefix) ".") 1 -}}
+	{{ $root := index $idPrefixPath 0 -}}
+	{{ $atNames := slice $idPrefixPath 1 -}}
+	var idPrefix types.String
+	diags := req.State.GetAttribute(ctx, path.Root("{{ $root }}"){{ range $atNames }}.AtName("{{ . }}"){{ end }}, &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	{{ end -}}
 	var id types.String
 	{{- if .ConvertPackagePath}}
-	diags := req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	diags {{if not .IDPrefix}}:{{end}}= req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
 	{{- else }}
-	diags := req.State.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
+	diags {{if not .IDPrefix}}:{{end}}= req.State.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
 	{{- end}}
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
-	err := r.p.Client.{{.DeleteMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}id.Value)
+	err := r.p.Client.{{.DeleteMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}{{if .IDPrefix}}idPrefix.Value, {{end}}id.Value)
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting {{.TypeName}}", trace.Wrap(err), "{{.Kind}}"))
 		return
@@ -404,7 +444,16 @@ func (r resourceTeleport{{.Name}}) Delete(ctx context.Context, req tfsdk.DeleteR
 
 // ImportState imports {{.Name}} state
 func (r resourceTeleport{{.Name}}) ImportState(ctx context.Context, req tfsdk.ImportResourceStateRequest, resp *tfsdk.ImportResourceStateResponse) {
+	{{if .IDPrefix -}}
+	idPrefix, name, err := parseID(req.ID)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error parsing Member ID", trace.Wrap(err), "{{.Kind}}"))
+		return
+	}
+	{{.VarName}}, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}idPrefix, name{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	{{else -}}
 	{{.VarName}}, err := r.p.Client.{{.GetMethod}}(ctx, {{if .Namespaced}}defaults.Namespace, {{end}}req.ID{{if ne .WithSecrets ""}}, {{.WithSecrets}}{{end}})
+	{{end -}}
 	if err != nil {
 		resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(err), "{{.Kind}}"))
 		return
@@ -413,7 +462,7 @@ func (r resourceTeleport{{.Name}}) ImportState(ctx context.Context, req tfsdk.Im
 	{{if .IsPlainStruct -}}
 	{{.VarName}}Resource := {{.VarName}}
 	{{else if .ConvertPackagePath -}}
-	{{.VarName}}Resource := convert.ToProto({{.VarName}})
+	{{.VarName}}Resource := convert.{{ if .ConvertToProtoFunc }}{{.ConvertToProtoFunc}}{{ else }}ToProto{{ end }}({{.VarName}})
 	{{else}}
 	{{.VarName}}Resource := {{.VarName}}.(*{{.ProtoPackage}}.{{.TypeName}})
 	{{- end}}
@@ -432,7 +481,9 @@ func (r resourceTeleport{{.Name}}) ImportState(ctx context.Context, req tfsdk.Im
 		return
 	}
 
-{{- if or .IsPlainStruct .ConvertPackagePath}}
+{{- if .IDPrefix }}
+	id := req.ID
+{{- else if or .IsPlainStruct .ConvertPackagePath}}
 	id := {{.VarName}}.Metadata.Name
 {{- else }}
 	id := {{.VarName}}Resource.GetName()
diff --git a/integrations/terraform/gen/singular_resource.go.tpl b/integrations/terraform/gen/singular_resource.go.tpl
index 69584a90a74f6..3ff7e22962da6 100644
--- a/integrations/terraform/gen/singular_resource.go.tpl
+++ b/integrations/terraform/gen/singular_resource.go.tpl
@@ -140,11 +140,27 @@ func (r resourceTeleport{{.Name}}) Create(ctx context.Context, req tfsdk.CreateR
 	var {{.VarName}}I {{.ProtoPackage}}.{{ if ne .IfaceName ""}}{{.IfaceName}}{{else}}{{.Name}}{{end}}
 	{{- end}}
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		{{.VarName}}I, err = r.p.Client.{{.GetMethod}}(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(err), "{{.Kind}}"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading {{.Name}} (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "{{.Kind}}")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading {{.Name}}", trace.Wrap(err), "{{.Kind}}"))
 			return
diff --git a/integrations/terraform/gen/strcase/snake.go b/integrations/terraform/gen/strcase/snake.go
new file mode 100644
index 0000000000000..488476d078545
--- /dev/null
+++ b/integrations/terraform/gen/strcase/snake.go
@@ -0,0 +1,117 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2015 Ian Coleman
+ * Copyright (c) 2018 Ma_124, <github.com/Ma124>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, Subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or Substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+// Copy of https://github.com/iancoleman/strcase/blob/master/snake.go
+
+package strcase
+
+import (
+	"strings"
+)
+
+// ToSnake converts a string to snake_case
+func ToSnake(s string) string {
+	return ToDelimited(s, '_')
+}
+
+func ToSnakeWithIgnore(s string, ignore string) string {
+	return ToScreamingDelimited(s, '_', ignore, false)
+}
+
+// ToScreamingSnake converts a string to SCREAMING_SNAKE_CASE
+func ToScreamingSnake(s string) string {
+	return ToScreamingDelimited(s, '_', "", true)
+}
+
+// ToKebab converts a string to kebab-case
+func ToKebab(s string) string {
+	return ToDelimited(s, '-')
+}
+
+// ToScreamingKebab converts a string to SCREAMING-KEBAB-CASE
+func ToScreamingKebab(s string) string {
+	return ToScreamingDelimited(s, '-', "", true)
+}
+
+// ToDelimited converts a string to delimited.snake.case
+// (in this case `delimiter = '.'`)
+func ToDelimited(s string, delimiter uint8) string {
+	return ToScreamingDelimited(s, delimiter, "", false)
+}
+
+// ToScreamingDelimited converts a string to SCREAMING.DELIMITED.SNAKE.CASE
+// (in this case `delimiter = '.'; screaming = true`)
+// or delimited.snake.case
+// (in this case `delimiter = '.'; screaming = false`)
+func ToScreamingDelimited(s string, delimiter uint8, ignore string, screaming bool) string {
+	s = strings.TrimSpace(s)
+	n := strings.Builder{}
+	n.Grow(len(s) + 2) // nominal 2 bytes of extra space for inserted delimiters
+	for i, v := range []byte(s) {
+		vIsCap := v >= 'A' && v <= 'Z'
+		vIsLow := v >= 'a' && v <= 'z'
+		if vIsLow && screaming {
+			v += 'A'
+			v -= 'a'
+		} else if vIsCap && !screaming {
+			v += 'a'
+			v -= 'A'
+		}
+
+		// treat acronyms as words, eg for JSONData -> JSON is a whole word
+		if i+1 < len(s) {
+			next := s[i+1]
+			vIsNum := v >= '0' && v <= '9'
+			nextIsCap := next >= 'A' && next <= 'Z'
+			nextIsLow := next >= 'a' && next <= 'z'
+			nextIsNum := next >= '0' && next <= '9'
+			// add underscore if next letter case type is changed
+			if (vIsCap && (nextIsLow || nextIsNum)) || (vIsLow && (nextIsCap || nextIsNum)) || (vIsNum && (nextIsCap || nextIsLow)) {
+				prevIgnore := ignore != "" && i > 0 && strings.ContainsAny(string(s[i-1]), ignore)
+				if !prevIgnore {
+					if vIsCap && nextIsLow {
+						if prevIsCap := i > 0 && s[i-1] >= 'A' && s[i-1] <= 'Z'; prevIsCap {
+							n.WriteByte(delimiter)
+						}
+					}
+					n.WriteByte(v)
+					if vIsLow || vIsNum || nextIsNum {
+						n.WriteByte(delimiter)
+					}
+					continue
+				}
+			}
+		}
+
+		if (v == ' ' || v == '_' || v == '-' || v == '.') && !strings.ContainsAny(string(v), ignore) {
+			// replace space/underscore/hyphen/dot with delimiter
+			n.WriteByte(delimiter)
+		} else {
+			n.WriteByte(v)
+		}
+	}
+
+	return n.String()
+}
diff --git a/integrations/terraform/gen/strcase/snake_test.go b/integrations/terraform/gen/strcase/snake_test.go
new file mode 100644
index 0000000000000..cdb840ea3df8a
--- /dev/null
+++ b/integrations/terraform/gen/strcase/snake_test.go
@@ -0,0 +1,272 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2015 Ian Coleman
+ * Copyright (c) 2018 Ma_124, <github.com/Ma124>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, Subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or Substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+// Copy of https://github.com/iancoleman/strcase/blob/master/snake_test.go
+
+package strcase
+
+import (
+	"testing"
+)
+
+func toSnake(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "test_case"},
+		{"TestCase", "test_case"},
+		{"Test Case", "test_case"},
+		{" Test Case", "test_case"},
+		{"Test Case ", "test_case"},
+		{" Test Case ", "test_case"},
+		{"test", "test"},
+		{"test_case", "test_case"},
+		{"Test", "test"},
+		{"", ""},
+		{"ManyManyWords", "many_many_words"},
+		{"manyManyWords", "many_many_words"},
+		{"AnyKind of_string", "any_kind_of_string"},
+		{"numbers2and55with000", "numbers_2_and_55_with_000"},
+		{"JSONData", "json_data"},
+		{"userID", "user_id"},
+		{"AAAbbb", "aa_abbb"},
+		{"1A2", "1_a_2"},
+		{"A1B", "a_1_b"},
+		{"A1A2A3", "a_1_a_2_a_3"},
+		{"A1 A2 A3", "a_1_a_2_a_3"},
+		{"AB1AB2AB3", "ab_1_ab_2_ab_3"},
+		{"AB1 AB2 AB3", "ab_1_ab_2_ab_3"},
+		{"some string", "some_string"},
+		{" some string", "some_string"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToSnake(in)
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToSnake(t *testing.T) { toSnake(t) }
+
+func BenchmarkToSnake(b *testing.B) {
+	benchmarkSnakeTest(b, toSnake)
+}
+
+func toSnakeWithIgnore(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "test_case"},
+		{"TestCase", "test_case"},
+		{"Test Case", "test_case"},
+		{" Test Case", "test_case"},
+		{"Test Case ", "test_case"},
+		{" Test Case ", "test_case"},
+		{"test", "test"},
+		{"test_case", "test_case"},
+		{"Test", "test"},
+		{"", ""},
+		{"ManyManyWords", "many_many_words"},
+		{"manyManyWords", "many_many_words"},
+		{"AnyKind of_string", "any_kind_of_string"},
+		{"numbers2and55with000", "numbers_2_and_55_with_000"},
+		{"JSONData", "json_data"},
+		{"AwesomeActivity.UserID", "awesome_activity.user_id", "."},
+		{"AwesomeActivity.User.Id", "awesome_activity.user.id", "."},
+		{"AwesomeUsername@Awesome.Com", "awesome_username@awesome.com", ".@"},
+		{"lets-ignore all.of dots-and-dashes", "lets-ignore_all.of_dots-and-dashes", ".-"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		var ignore string
+		ignore = ""
+		if len(i) == 3 {
+			ignore = i[2]
+		}
+		result := ToSnakeWithIgnore(in, ignore)
+		if result != out {
+			istr := ""
+			if len(i) == 3 {
+				istr = " ignoring '" + i[2] + "'"
+			}
+			tb.Errorf("%q (%q != %q%s)", in, result, out, istr)
+		}
+	}
+}
+
+func TestToSnakeWithIgnore(t *testing.T) { toSnakeWithIgnore(t) }
+
+func BenchmarkToSnakeWithIgnore(b *testing.B) {
+	benchmarkSnakeTest(b, toSnakeWithIgnore)
+}
+
+func toDelimited(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "test@case"},
+		{"TestCase", "test@case"},
+		{"Test Case", "test@case"},
+		{" Test Case", "test@case"},
+		{"Test Case ", "test@case"},
+		{" Test Case ", "test@case"},
+		{"test", "test"},
+		{"test_case", "test@case"},
+		{"Test", "test"},
+		{"", ""},
+		{"ManyManyWords", "many@many@words"},
+		{"manyManyWords", "many@many@words"},
+		{"AnyKind of_string", "any@kind@of@string"},
+		{"numbers2and55with000", "numbers@2@and@55@with@000"},
+		{"JSONData", "json@data"},
+		{"userID", "user@id"},
+		{"AAAbbb", "aa@abbb"},
+		{"test-case", "test@case"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToDelimited(in, '@')
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToDelimited(t *testing.T) { toDelimited(t) }
+
+func BenchmarkToDelimited(b *testing.B) {
+	benchmarkSnakeTest(b, toDelimited)
+}
+
+func toScreamingSnake(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "TEST_CASE"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToScreamingSnake(in)
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToScreamingSnake(t *testing.T) { toScreamingSnake(t) }
+
+func BenchmarkToScreamingSnake(b *testing.B) {
+	benchmarkSnakeTest(b, toScreamingSnake)
+}
+
+func toKebab(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "test-case"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToKebab(in)
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToKebab(t *testing.T) { toKebab(t) }
+
+func BenchmarkToKebab(b *testing.B) {
+	benchmarkSnakeTest(b, toKebab)
+}
+
+func toScreamingKebab(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "TEST-CASE"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToScreamingKebab(in)
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToScreamingKebab(t *testing.T) { toScreamingKebab(t) }
+
+func BenchmarkToScreamingKebab(b *testing.B) {
+	benchmarkSnakeTest(b, toScreamingKebab)
+}
+
+func toScreamingDelimited(tb testing.TB) {
+	cases := [][]string{
+		{"testCase", "TEST.CASE"},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		result := ToScreamingDelimited(in, '.', "", true)
+		if result != out {
+			tb.Errorf("%q (%q != %q)", in, result, out)
+		}
+	}
+}
+
+func TestToScreamingDelimited(t *testing.T) { toScreamingDelimited(t) }
+
+func BenchmarkToScreamingDelimited(b *testing.B) {
+	benchmarkSnakeTest(b, toScreamingDelimited)
+}
+
+func toScreamingDelimitedWithIgnore(tb testing.TB) {
+	cases := [][]string{
+		{"AnyKind of_string", "ANY.KIND OF.STRING", ".", " "},
+	}
+	for _, i := range cases {
+		in := i[0]
+		out := i[1]
+		delimiter := i[2][0]
+		ignore := i[3][0]
+		result := ToScreamingDelimited(in, delimiter, string(ignore), true)
+		if result != out {
+			istr := ""
+			if len(i) == 4 {
+				istr = " ignoring '" + i[3] + "'"
+			}
+			tb.Errorf("%q (%q != %q%s)", in, result, out, istr)
+		}
+	}
+}
+
+func TestToScreamingDelimitedWithIgnore(t *testing.T) { toScreamingDelimitedWithIgnore(t) }
+
+func BenchmarkToScreamingDelimitedWithIgnore(b *testing.B) {
+	benchmarkSnakeTest(b, toScreamingDelimitedWithIgnore)
+}
+
+func benchmarkSnakeTest(b *testing.B, fn func(testing.TB)) {
+	for n := 0; n < b.N; n++ {
+		fn(b)
+	}
+}
diff --git a/integrations/terraform/go.mod b/integrations/terraform/go.mod
index beeb0f8b9dbe8..8ad91c0dc85c8 100644
--- a/integrations/terraform/go.mod
+++ b/integrations/terraform/go.mod
@@ -1,6 +1,6 @@
 module github.com/gravitational/teleport/integrations/terraform
 
-go 1.24.3
+go 1.24.11
 
 // TF provider dependencies
 require (
@@ -15,29 +15,35 @@ require (
 	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.10.1
 	github.com/jonboulle/clockwork v0.5.0
-	github.com/stretchr/testify v1.10.0
-	google.golang.org/grpc v1.72.1
-	google.golang.org/protobuf v1.36.6
+	github.com/stretchr/testify v1.11.1
+	google.golang.org/grpc v1.75.0
+	google.golang.org/protobuf v1.36.8
 )
 
 require (
-	cloud.google.com/go v0.120.0 // indirect
-	cloud.google.com/go/auth v0.16.1 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/alloydb v1.16.1 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute v1.37.0 // indirect
-	cloud.google.com/go/compute/metadata v0.6.0 // indirect
-	cloud.google.com/go/container v1.42.4 // indirect
+	cloud.google.com/go/cloudsqlconn v1.17.0 // indirect
+	cloud.google.com/go/compute v1.38.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
+	cloud.google.com/go/container v1.43.0 // indirect
+	cloud.google.com/go/firestore v1.18.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
-	cloud.google.com/go/kms v1.21.2 // indirect
-	cloud.google.com/go/longrunning v0.6.6 // indirect
+	cloud.google.com/go/kms v1.22.0 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
 	cloud.google.com/go/resourcemanager v1.10.6 // indirect
-	code.dny.dev/ssrf v0.2.0 // indirect
+	cloud.google.com/go/spanner v1.85.0 // indirect
+	cloud.google.com/go/storage v1.56.1 // indirect
 	connectrpc.com/connect v1.18.1 // indirect
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	filippo.io/age v1.2.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6 v6.6.0 // indirect
@@ -50,37 +56,56 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/ClickHouse/ch-go v0.65.1 // indirect
+	github.com/ClickHouse/clickhouse-go/v2 v2.34.0 // indirect
+	github.com/DanielTitkov/go-adaptive-cards v0.2.2 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.0-alpha.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alecthomas/kingpin/v2 v2.4.0 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
-	github.com/apparentlymart/go-textseg v1.0.0 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go v1.55.6 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.29.14 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.67 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.39.6 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/account v1.29.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dax v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.25.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.213.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.28.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecs v1.56.2 // indirect
@@ -89,67 +114,68 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/glue v1.109.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.38.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/organizations v1.38.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/rds v1.95.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 // indirect
-	github.com/aws/rolesanywhere-credential-helper v1.2.0 // indirect
-	github.com/aws/smithy-go v1.22.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
 	github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/beevik/etree v1.5.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.0 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/charlievieth/strcase v0.0.5 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
-	github.com/containerd/containerd v1.7.27 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/creack/pty v1.1.24 // indirect
 	github.com/crewjam/httperr v0.2.0 // indirect
 	github.com/crewjam/saml v0.4.14 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/datastax/go-cassandra-native-protocol v0.0.0-20220706104457-5e8aad05cf90 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/di-wu/parser v0.3.0 // indirect
 	github.com/di-wu/xsd-datetime v1.0.0 // indirect
-	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v27.5.0+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.1.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dlclark/regexp2 v1.11.0 // indirect
+	github.com/dmarkham/enumer v1.5.10 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.8.3 // indirect
 	github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
@@ -162,17 +188,23 @@ require (
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/go-chi/chi v4.1.2+incompatible // indirect
-	github.com/go-chi/chi/v5 v5.2.1 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/go-faster/city v1.0.1 // indirect
+	github.com/go-faster/errors v0.7.1 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-git/v5 v5.16.0 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.11 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/go-mysql-org/go-mysql v1.9.1 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
@@ -181,47 +213,53 @@ require (
 	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
-	github.com/go-piv/piv-go v1.11.0 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-piv/piv-go/v2 v2.4.0 // indirect
+	github.com/go-resty/resty/v2 v2.16.5 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-webauthn/webauthn v0.12.3 // indirect
 	github.com/go-webauthn/x v0.1.20 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gobwas/ws v1.4.0 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/gocql/gocql v1.7.0 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/certificate-transparency-go v1.3.1 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-attestation v0.5.1 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
 	github.com/google/go-github/v70 v70.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/go-tpm v0.9.4 // indirect
 	github.com/google/go-tpm-tools v0.4.5 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
-	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
 	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
+	github.com/grafana/pyroscope-go v1.2.4 // indirect
+	github.com/grafana/pyroscope-go/godeltaprof v0.1.8 // indirect
 	github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
-	github.com/gravitational/roundtrip v1.0.2 // indirect
+	github.com/gravitational/roundtrip v1.0.3 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/cli v1.1.6 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
@@ -230,31 +268,38 @@ require (
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.10 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hc-install v0.7.0 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
-	github.com/hashicorp/hcl/v2 v2.3.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.21.0 // indirect
 	github.com/hashicorp/terraform-json v0.22.1 // indirect
 	github.com/hashicorp/terraform-plugin-docs v0.0.0-00010101000000-000000000000 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.1 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/in-toto/attestation v1.1.1 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
+	github.com/jackc/pgconn v1.14.3 // indirect
+	github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgtype v1.14.4 // indirect
+	github.com/jackc/pgx/v4 v4.18.3 // indirect
 	github.com/jackc/pgx/v5 v5.7.4 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
@@ -262,9 +307,9 @@ require (
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
-	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/julienschmidt/httprouter v1.3.0 // indirect
@@ -280,75 +325,95 @@ require (
 	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mark3labs/mcp-go v0.41.1 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mattn/go-sqlite3 v1.14.28 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/microsoft/go-mssqldb v1.8.0 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/muhlemmer/gu v0.3.1 // indirect
 	github.com/muhlemmer/httpforwarded v0.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/ohler55/ojg v1.26.8 // indirect
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/okta/okta-sdk-golang/v2 v2.20.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/openai/openai-go v1.8.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
+	github.com/opensearch-project/opensearch-go/v2 v2.3.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oracle/oci-go-sdk/v65 v65.89.3 // indirect
+	github.com/parquet-go/parquet-go v0.25.0 // indirect
+	github.com/pascaldekloe/name v1.0.1 // indirect
 	github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible // indirect
+	github.com/paulmach/orb v0.11.1 // indirect
 	github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb // indirect
+	github.com/pingcap/log v1.1.1-0.20230317032135-a0d097d16e22 // indirect
+	github.com/pingcap/tidb/pkg/parser v0.0.0-20240930120915-74034d4ac243 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.9 // indirect
+	github.com/pkoukk/tiktoken-go v0.1.8 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/pquerna/otp v1.4.0 // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/quic-go/quic-go v0.51.0 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/quic-go/quic-go v0.57.0 // indirect
+	github.com/redis/go-redis/v9 v9.12.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
-	github.com/rubenv/sql-migrate v1.7.1 // indirect
+	github.com/rs/zerolog v1.28.0 // indirect
+	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russellhaering/gosaml2 v0.10.0 // indirect
 	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
 	github.com/schollz/progressbar/v3 v3.18.0 // indirect
 	github.com/scim2/filter-parser/v2 v2.2.0 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.4 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sigstore/protobuf-specs v0.4.1 // indirect
-	github.com/sigstore/rekor v1.3.9 // indirect
-	github.com/sigstore/sigstore v1.9.4 // indirect
+	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 // indirect
+	github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 // indirect
+	github.com/sigstore/protobuf-specs v0.5.0 // indirect
+	github.com/sigstore/rekor v1.4.1 // indirect
+	github.com/sigstore/sigstore v1.9.5 // indirect
 	github.com/sigstore/sigstore-go v0.7.1 // indirect
 	github.com/sigstore/timestamp-authority v1.2.5 // indirect
 	github.com/sijms/go-ora/v2 v2.8.24 // indirect
@@ -358,100 +423,112 @@ require (
 	github.com/spf13/afero v1.12.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/spf13/viper v1.20.1 // indirect
-	github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.7.0 // indirect
 	github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/transparency-dev/merkle v0.0.2 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/vulcand/predicate v1.2.0 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/yuin/goldmark v1.7.4 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zclconf/go-cty v1.14.4 // indirect
+	github.com/zclconf/go-cty v1.17.0 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	github.com/zitadel/logging v0.6.2 // indirect
-	github.com/zitadel/oidc/v3 v3.38.1 // indirect
+	github.com/zitadel/oidc/v3 v3.43.0 // indirect
 	github.com/zitadel/schema v1.3.1 // indirect
 	gitlab.com/gitlab-org/api/client-go v0.127.0 // indirect
 	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
-	go.mongodb.org/mongo-driver v1.14.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.21 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
+	go.etcd.io/etcd/client/v3 v3.5.21 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
+	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.6.0 // indirect
-	go.uber.org/mock v0.5.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/term v0.31.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.30.0 // indirect
-	google.golang.org/api v0.230.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/api v0.248.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.17.3 // indirect
-	k8s.io/api v0.33.0 // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
-	k8s.io/apimachinery v0.33.0 // indirect
-	k8s.io/apiserver v0.33.0 // indirect
-	k8s.io/cli-runtime v0.33.0 // indirect
-	k8s.io/client-go v0.33.0 // indirect
-	k8s.io/component-base v0.33.0 // indirect
+	helm.sh/helm/v3 v3.18.5 // indirect
+	k8s.io/api v0.33.3 // indirect
+	k8s.io/apiextensions-apiserver v0.33.3 // indirect
+	k8s.io/apimachinery v0.33.3 // indirect
+	k8s.io/apiserver v0.33.3 // indirect
+	k8s.io/cli-runtime v0.33.3 // indirect
+	k8s.io/client-go v0.33.3 // indirect
+	k8s.io/component-base v0.33.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubectl v0.33.0 // indirect
+	k8s.io/kubectl v0.33.3 // indirect
+	k8s.io/metrics v0.33.3 // indirect
 	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
 	mvdan.cc/sh/v3 v3.7.0 // indirect
-	oras.land/oras-go v1.2.5 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
 	sigs.k8s.io/controller-runtime v0.20.4 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.19.0 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 	software.sslmate.com/src/go-pkcs12 v0.5.0 // indirect
 )
 
@@ -464,14 +541,16 @@ replace (
 replace (
 	github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
 	github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
-	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1
+	github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2
 	github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4
 	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-teleport.2
+	github.com/hinshun/vt10x => github.com/gravitational/vt10x v0.0.3-teleport.1
 	github.com/julienschmidt/httprouter => github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5
 	github.com/keys-pub/go-libfido2 => github.com/gravitational/go-libfido2 v1.5.3-teleport.1
 	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v1.8.1-teleport.2
+	github.com/opencontainers/selinux => github.com/gravitational/selinux v1.13.0-teleport
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.2
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
 
 // Doc generation tooling.
diff --git a/integrations/terraform/go.sum b/integrations/terraform/go.sum
index 467f1948cc7a9..442861c5fa4d0 100644
--- a/integrations/terraform/go.sum
+++ b/integrations/terraform/go.sum
@@ -1,5 +1,7 @@
-cel.dev/expr v0.20.0 h1:OunBvVCfvpWlt4dN7zg3FM6TDkzOePe1+foGJ9AXeeI=
-cel.dev/expr v0.20.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -14,10 +16,12 @@ cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bP
 cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.61.0/go.mod h1:XukKJg4Y7QsUu0Hxg3qQKUWR4VuWivmyMK2+rUyxAqw=
-cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA=
-cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q=
-cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
-cloud.google.com/go/auth v0.16.1/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go/alloydb v1.16.1 h1:pW4D0O2jAfAjoOEI1bgChPwMHWE8X8BjwSO0tfWkWvk=
+cloud.google.com/go/alloydb v1.16.1/go.mod h1:zeZuGJ5mEaQE70FMXEvZIp5hQLR9yrGnHo1YUOncWRY=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -28,60 +32,74 @@ cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4g
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/cloudsqlconn v1.17.0 h1:PHFpif8l2kbgagUT5Qtsca8vi9g0xz812XE5mVMTRHA=
 cloud.google.com/go/cloudsqlconn v1.17.0/go.mod h1:mLn37nA1MirwLewKADIqZLnk5XmJc/FkKzGL/UzIDdM=
-cloud.google.com/go/compute v1.37.0 h1:XxtZlXYkZXub3LNaLu90TTemcFqIU1yZ4E4q9VlR39A=
-cloud.google.com/go/compute v1.37.0/go.mod h1:AsK4VqrSyXBo4SMbRtfAO1VfaMjUEjEwv1UB/AwVp5Q=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
-cloud.google.com/go/container v1.42.4 h1:N8I+GiImhrSMUcKSOYTd8D6wBWyWSgPa4IJkSdlR2jk=
-cloud.google.com/go/container v1.42.4/go.mod h1:wf9lKc3ayWVbbV/IxKIDzT7E+1KQgzkzdxEJpj1pebE=
+cloud.google.com/go/compute v1.38.0 h1:MilCLYQW2m7Dku8hRIIKo4r0oKastlD74sSu16riYKs=
+cloud.google.com/go/compute v1.38.0/go.mod h1:oAFNIuXOmXbK/ssXm3z4nZB8ckPdjltJ7xhHCdbWFZM=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
+cloud.google.com/go/container v1.43.0 h1:A6J92FJPfxTvyX7MHF+w4t2W9WCqvHOi9UB5SAeSy3w=
+cloud.google.com/go/container v1.43.0/go.mod h1:ETU9WZ1KM9ikEKLzrhRVao7KHtalDQu6aPqM34zDr/U=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.18.0 h1:cuydCaLS7Vl2SatAeivXyhbhDEIR8BDmtn4egDhIn2s=
 cloud.google.com/go/firestore v1.18.0/go.mod h1:5ye0v48PhseZBdcl0qbl3uttu7FIEwEYVaWm0UIEOEU=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
 cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
-cloud.google.com/go/kms v1.21.2 h1:c/PRUSMNQ8zXrc1sdAUnsenWWaNXN+PzTXfXOcSFdoE=
-cloud.google.com/go/kms v1.21.2/go.mod h1:8wkMtHV/9Z8mLXEXr1GK7xPSBdi6knuLXIhqjuWcI6w=
-cloud.google.com/go/longrunning v0.6.6 h1:XJNDo5MUfMM05xK3ewpbSdmt7R2Zw+aQEMbdQR65Rbw=
-cloud.google.com/go/longrunning v0.6.6/go.mod h1:hyeGJUrPHcx0u2Uu1UFSoYZLn4lkMrccJig0t4FI7yw=
-cloud.google.com/go/monitoring v1.24.1 h1:vKiypZVFD/5a3BbQMvI4gZdl8445ITzXFh257XBgrS0=
-cloud.google.com/go/monitoring v1.24.1/go.mod h1:Z05d1/vn9NaujqY2voG6pVQXoJGbp+r3laV+LySt9K0=
+cloud.google.com/go/kms v1.22.0 h1:dBRIj7+GDeeEvatJeTB19oYZNV0aj6wEqSIT/7gLqtk=
+cloud.google.com/go/kms v1.22.0/go.mod h1:U7mf8Sva5jpOb4bxYZdtw/9zsbIjrklYwPcvMk34AL8=
+cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
+cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/pubsub v1.50.0 h1:hnYpOIxVlgVD1Z8LN7est4DQZK3K6tvZNurZjIVjUe0=
+cloud.google.com/go/pubsub v1.50.0/go.mod h1:Di2Y+nqXBpIS+dXUEJPQzLh8PbIQZMLE9IVUFhf2zmM=
+cloud.google.com/go/pubsub/v2 v2.0.0 h1:0qS6mRJ41gD1lNmM/vdm6bR7DQu6coQcVwD+VPf0Bz0=
+cloud.google.com/go/pubsub/v2 v2.0.0/go.mod h1:0aztFxNzVQIRSZ8vUr79uH2bS3jwLebwK6q1sgEub+E=
 cloud.google.com/go/resourcemanager v1.10.6 h1:LIa8kKE8HF71zm976oHMqpWFiaDHVw/H1YMO71lrGmo=
 cloud.google.com/go/resourcemanager v1.10.6/go.mod h1:VqMoDQ03W4yZmxzLPrB+RuAoVkHDS5tFUUQUhOtnRTg=
-cloud.google.com/go/spanner v1.80.0 h1:4B2hoN1TF0qghiK7CYjYzjRt0/EEacIlS/UJl0k2hKA=
-cloud.google.com/go/spanner v1.80.0/go.mod h1:XQWUqx9r8Giw6gNh0Gu8xYfz7O+dAKouAkFCxG/mZC8=
+cloud.google.com/go/spanner v1.85.0 h1:VVO3yW+0+Yx9tg4SQaZvJHGAnU6qCnGXQ3NX4E3+src=
+cloud.google.com/go/spanner v1.85.0/go.mod h1:9zhmtOEoYV06nE4Orbin0dc/ugHzZW9yXuvaM61rpxs=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.52.0 h1:ROpzMW/IwipKtatA69ikxibdzQSiXJrY9f6IgBa9AlA=
-cloud.google.com/go/storage v1.52.0/go.mod h1:4wrBAbAYUvYkbrf19ahGm4I5kDQhESSqN3CGEkMGvOY=
+cloud.google.com/go/storage v1.56.1 h1:n6gy+yLnHn0hTwBFzNn8zJ1kqWfR91wzdM8hjRF4wP0=
+cloud.google.com/go/storage v1.56.1/go.mod h1:C9xuCZgFl3buo2HZU/1FncgvvOgTAs/rnh4gF4lMg0s=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 code.dny.dev/ssrf v0.2.0 h1:wCBP990rQQ1CYfRpW+YK1+8xhwUjv189AQ3WMo1jQaI=
 code.dny.dev/ssrf v0.2.0/go.mod h1:B+91l25OnyaLIeCx0WRJN5qfJ/4/ZTZxRXgm0lj/2w8=
 connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
 connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
+filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
+github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 h1:OVoM452qUFBrX+URdH3VpR299ma4kfom0yB0URYky9g=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0/go.mod h1:kUjrAo8bgEwLeZ/CmHqNl3Z/kPm7y6FKfxxK0izYUg4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 h1:Hr5FTipp7SL07o2FvoVOX9HRiRH3CR3Mj8pxqCcdD5A=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2/go.mod h1:QyVsSSN64v5TGltphKLQ2sQxe4OBQg0J1eKRcVBnfgE=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 h1:MhRfI58HblXzCtWEZCO0feHs8LweePB3s90r7WaR1KU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0/go.mod h1:okZ+ZURbArNdlJ+ptXoyHNuOETzOl1Oww19rm8I2WLA=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 h1:Hp+EScFOu9HeCbeW8WU2yQPJd4gGwhMgKxWe+G6jNzw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0/go.mod h1:/pz8dyNQe+Ey3yBp/XuYz7oqX8YDNWVpPB0hH3XWfbc=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6 v6.4.0 h1:z7Mqz6l0EFH549GvHEqfjKvi+cRScxLWbaoeLm9wxVQ=
@@ -112,12 +130,14 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0 h1:S087deZ0kP1RUg4pU7w9U9xpUedTCbOtz+mnd0+hrkQ=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0/go.mod h1:B4cEyXrWBmbfMDAPnpJ1di7MAt5DKP57jPEObAvZChg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0 h1:LR0kAX9ykz8G4YgLCaRDVJ3+n43R8MneB5dTy2konZo=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.0/go.mod h1:DWAciXemNf++PQJLeXUB4HHH5OpsAh12HZnu2wXE1jA=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 h1:Wgf5rZba3YZqeTNJPtvqZoBu1sBN/L4sry+u2U3Y75w=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1/go.mod h1:xxCBG/f/4Vbmh2XQJBsOmNdxWUY5j/s27jujKPbQf14=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1 h1:lhZdRq7TIx0GJQvSyX2Si406vrYsov2FXGp/RnSEtcs=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1/go.mod h1:8cl44BDmi+effbARHMQjgOKA2AYvcohNm7KEt42mSV8=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -129,8 +149,8 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mo
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
-github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ClickHouse/ch-go v0.65.1 h1:SLuxmLl5Mjj44/XbINsK2HFvzqup0s6rwKLFH347ZhU=
 github.com/ClickHouse/ch-go v0.65.1/go.mod h1:bsodgURwmrkvkBe5jw1qnGDgyITsYErfONKAHn05nv4=
@@ -140,14 +160,18 @@ github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7Oputl
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/DanielTitkov/go-adaptive-cards v0.2.2 h1:tBFExyvsbCcrBJEvPaV3FW4gcAkwQjXFKiKEBrE7Yuw=
 github.com/DanielTitkov/go-adaptive-cards v0.2.2/go.mod h1:RtCzt65p/zEos6+zhiCFQmiaHmro6M63l9NP7xXx/Lg=
-github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2 h1:DBjmt6/otSdULyJdVg2BlG0qGZO5tKL4VzOs0jpvw5Q=
-github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 h1:ErKg/3iS1AKcTkf3yixlZ54f9U1rljCkQyEXWUnIUxc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0/go.mod h1:yAZHSGnqScoU556rBOVkwLze6WP5N+U11RHuWaGVxwY=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 h1:fYE9p3esPxA/C0rQ0AHhP0drtPXDRhaWiwg1DPqO7IU=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0/go.mod h1:BnBReJLvVYx2CS/UHOgVz2BXKXD9wsQPxZug20nZhd0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 h1:6/0iUd0xrnX7qt+mLNRwg5c0PGv8wpE8K90ryANQwMI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0/go.mod h1:otE2jQekW/PqXk1Awf5lmfokJx4uwuqcj1ab5SpGeW0=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 h1:2afWGsMzkIcN8Qm4mgPJKZWyroE5QBszMiDMYEBrnfw=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
 github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
 github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
@@ -157,6 +181,7 @@ github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJ
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
 github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
@@ -168,25 +193,21 @@ github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jB
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
-github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.2 h1:bkyFVUP+ROOARdgCiJzNQo2V2kiB97LyUpzH9P6Hrlg=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
+github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
 github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
 github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
 github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
 github.com/alicebob/miniredis/v2 v2.34.0 h1:mBFWMaJSNL9RwdGRyEDoAAv8OQc5UlEhLDQggTglU/0=
@@ -195,11 +216,12 @@ github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7X
 github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/andybalholm/crlf v0.0.0-20171020200849-670099aa064f/go.mod h1:k8feO4+kXDxro6ErPXBRTJ/ro2mf0SsFG8s7doP9kJE=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
+github.com/apache/arrow-go/v18 v18.0.0 h1:1dBDaSbH3LtulTyOVYaBCHO3yVRwjV+TZaqn3g6V7ZM=
+github.com/apache/arrow-go/v18 v18.0.0/go.mod h1:t6+cWRSmKgdQ6HsxisQjok+jBpKGhRDiqcf3p0p/F+A=
 github.com/apparentlymart/go-cidr v1.0.1/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I=
 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
-github.com/apparentlymart/go-textseg v1.0.0 h1:rRmlIsPEEhUTIKQb7T++Nz/A5Q6C9IuX2wFoYVvnCs0=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
@@ -216,38 +238,52 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3ATZkfNZeM=
 github.com/aws/aws-sdk-go v1.25.3/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
-github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
-github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
-github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
-github.com/aws/aws-sdk-go-v2/config v1.29.14 h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
-github.com/aws/aws-sdk-go-v2/config v1.29.14/go.mod h1:wVPHWcIFv3WO89w0rE10gzf17ZYy+UVS1Geq8Iei34g=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
+github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk=
+github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
+github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0 h1:9yH0xiY5fUnVNLRWO0AtayqwU1ndriZdN78LlhruJR4=
+github.com/aws/aws-sdk-go-v2/config v1.31.0/go.mod h1:VeV3K72nXnhbe4EuxxhzsDc/ByrCSlZwUnWH52Nde/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4 h1:IPd0Algf1b+Qy9BcDp0sCUcIWdCQPSzDoMK3a8pcbUM=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.4/go.mod h1:nwg78FjH2qvsRM1EVZlX9WuGUJOL5od+0qvm0adEzHk=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0 h1:F3W0YqWZrpCcelbvXMP9LWSTOI620aAq1+8fZ/71TBg=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.0/go.mod h1:34X+UzFJwsQfyk5U1hYiCO/gv9ZVL+Hh8w+bJQ6+HbU=
 github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0 h1:0LLh3sbmWgsUqUj/JZRvzmejQwlllh1HgHQoTzAIEcc=
 github.com/aws/aws-sdk-go-v2/feature/dynamodbstreams/attributevalue v1.18.0/go.mod h1:to2lbD07ti4RR8JRgaYEFKan5XekRCmWxCZXlZvp6gQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3 h1:GicIdnekoJsjq9wqnvyi2elW6CGMSYKhdozE7/Svh78=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.3/go.mod h1:R7BIi6WNC5mc1kfRM7XM/VHC3uRWkjc396sfabq4iOo=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 h1:qDk85oQdhwP4NR1RpkN+t40aN46/K96hF9J1vDRrkKM=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11/go.mod h1:f3MkXuZsT+wY24nLIP+gFUuIVQkpVopxbpUD/GUZK0Q=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74 h1:+1lc5oMFFHlVBclPXQf/POqlvdpBzjLaN2c3ujDCcZw=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.74/go.mod h1:EiskBoFr4SpYnFIbw8UM7DP7CacQXDHEmJqLI1xpRFI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 h1:S61/E3N01oral6B3y9hZ2E1iFDqCZPPOBoBQretCnBI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75/go.mod h1:bDMQbkI1vJbNjnvJYpPTSNYBkI/VIv18ngWb/K84tkk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3 h1:EqpyKDfuTQZFL6Cr1dutmyUx+Z9eDN2oFR1hoMXbmCs=
+github.com/aws/aws-sdk-go-v2/service/account v1.29.3/go.mod h1:3LbGl+sLnaiyCVp2LJXj0gEoeV2Uw0QOsDpP1gDMBVA=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0 h1:xwcxrq16ND5W+QqsGVpNHcjqyVqX4TX7vp3ifI4aYjg=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.36.0/go.mod h1:Ie/714qgv6ohupWHUxe/6oyAfiCdq9vVJrp+TnJrcqs=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4 h1:QWhxjrA0r+FQnDAATdGqLXUvYW0MdUIvCBK89BN3OfU=
 github.com/aws/aws-sdk-go-v2/service/athena v1.50.4/go.mod h1:xsG8Y2fMenmHTdukyknTUO1uQhEZ/entaNHvPmD1klE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0 h1:xdYdX+JpIFByMG8JQe9iWM9CqepyjhenukxTVQnuCbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.0/go.mod h1:c1Ik+59wgLIJFhsSY8cAnw6QooiogpTZKP0rtkVcpCQ=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9 h1:+NSIzl59vBK3g3nLUuLSb/I2F2OIucW6hX/B+NAPWDg=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.9/go.mod h1:9/Q0/HtqBTLMksFse42wZjUq0jJrUuo4XlnXy/uSoeg=
 github.com/aws/aws-sdk-go-v2/service/dax v1.24.2 h1:QFdCeROg/LwFkKOpM4TrzOPt9vcsbuu2WibzjiKTZqA=
 github.com/aws/aws-sdk-go-v2/service/dax v1.24.2/go.mod h1:FTMIKMqG/2AiO0P1LSCN6PeY4BNkQcxAzPSpne6oE6w=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.43.1 h1:YYjNTAyPL0425ECmq6Xm48NSXdT6hDVQmLOJZxyhNTM=
@@ -270,18 +306,21 @@ github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk
 github.com/aws/aws-sdk-go-v2/service/iam v1.41.1/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2 h1:hWqvzMaaiHhwndQhy1rF/qoHidaa4KzevkiDaMvjk3Q=
 github.com/aws/aws-sdk-go-v2/service/identitystore v1.28.2/go.mod h1:7nGvrQXBNp7k5yYpwpmxGucYTPY39d0cxjmANAeWwYE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 h1:4nm2G6A4pV9rdlWzGMPv4BNtQp22v1hg3yrtkYpeLl8=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 h1:M1R1rud7HzDrfCdlBQ7NjnRsDNEhXO/vGhuD189Ggmk=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15/go.mod h1:uvFKBSq9yMPV4LGAi7N4awn4tLY+hKE35f8THes2mzQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 h1:ieRzyHXypu5ByllM7Sp4hC5f/1Fy5wqxqY0yB85hC7s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3/go.mod h1:O5ROz8jHiOAKAwx179v+7sHMhfobFVi6nZt8DEyiYoM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3 h1:RivOtUH3eEu6SWnUMFHKAW4MqDOzWn1vGQ3S38Y5QMg=
-github.com/aws/aws-sdk-go-v2/service/kms v1.38.3/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0 h1:Z95XCqqSnwXr0AY7PgsiOUBhUG2GoDM5getw6RfD1Lg=
+github.com/aws/aws-sdk-go-v2/service/kms v1.44.0/go.mod h1:DqcSngL7jJeU1fOzh5Ll5rSvX/MlMV6OZlE4mVdFAQc=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2 h1:z926KZ1Ysi8Mbi4biJSAIRFdKemwQpO9M0QUTRLDaXA=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.71.2/go.mod h1:c27kk10S36lBYgbG1jR3opn4OAS5Y/4wjJa1GiHK/X4=
 github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0 h1:ggjjmfNX+nlv+nWHXOLr1pl36buP25Y9GZBEPMSofGw=
 github.com/aws/aws-sdk-go-v2/service/memorydb v1.27.0/go.mod h1:pfuDC5zBwunXdE44WT1PRbtzuXWGohKFcFLtv+ezI6k=
 github.com/aws/aws-sdk-go-v2/service/opensearch v1.46.3 h1:vWClqL1dTCuPtWkaGDW7Y6P9ocqHtfFrjlkWYARm1qI=
@@ -294,6 +333,8 @@ github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3 h1:LNOKEsPjtoBrV2WYUb2zPLO
 github.com/aws/aws-sdk-go-v2/service/redshift v1.54.3/go.mod h1:TC8pNvjiikrjpX2MEzX/cEJ4/T4XIoSY4BskVvHj8bk=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1 h1:+nldYGx2Kdn7jzntjm2fG7sRonfQ08l1RqkLSTed8G8=
 github.com/aws/aws-sdk-go-v2/service/redshiftserverless v1.27.1/go.mod h1:gpRsJN3qxZbsj1NhAoCNX02zJ4RZUB5v/7o4QrnGTcA=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4 h1:QqXnA7s6sxFe6B6dkocEfZ9ap1bAmEXp4W32n9n+cmU=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.4/go.mod h1:cgPfPTC/V3JqwCKed7Q6d0FrgarV7ltz4Bz6S4Q+Dqk=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2 h1:0LBxtAX2bHcfPr6VSzQSvJlR1nzlna7xp031gEjbWGU=
 github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.17.2/go.mod h1:NW+LcIadUUlDgM3gb8+97lr6zSKExHR58NRRWSWkXl8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 h1:BRXS0U76Z8wfF+bnkilA2QwpIch6URlm++yPUt9QPmQ=
@@ -306,54 +347,61 @@ github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5 h1:KNgVWw8qbPzjYnIF1gL0EAszy6VK
 github.com/aws/aws-sdk-go-v2/service/sqs v1.38.5/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0 h1:KWArCwA/WkuHWKfygkNz0B6YS6OvdgoJUaJHX0Qby1s=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.59.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0 h1:Mc/MKBf2m4VynyJkABoVEN+QzkfLqGj0aiJuEe7cMeM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.0/go.mod h1:iS5OmxEcN4QIPXARGhavH7S8kETNL11kym6jhoS7IUQ=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2 h1:j3YvW9+qUFIzshXoPclOEUOSlXgr9vCU6OsB/CVRKGM=
 github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.30.2/go.mod h1:znVkl7Y14sZKEL/sbRQ6qgD8wj8VdTcVVQp5iRaKXcc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.19/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
-github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v1.1.0 h1:EJsHUYgFBV7/N1YtL73lsfZODAOU+CnNSZfEAlqqQaA=
-github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v1.1.0/go.mod h1:AxKuXHc0zv2yYaeueUG7R3ONbcnQIuDj0bkdFmPVRzU=
-github.com/aws/rolesanywhere-credential-helper v1.2.0 h1:eLqJvSznH8nJk48dwFc0raWOpbTGgBeNYH3Q8UQFVx4=
-github.com/aws/rolesanywhere-credential-helper v1.2.0/go.mod h1:YRxmRrAaqbVVXPNH1gHT76nWaMGvpAziHAHw8UwKrpU=
-github.com/aws/smithy-go v1.22.3 h1:Z//5NuZCSW6R4PhQ93hShNbyBbn8BWCmCVCt+Q8Io5k=
-github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0 h1:6csaS/aJmqZQbKhi1EyEMM7yBW653Wy/B9hnBofW+sw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.0/go.mod h1:59qHWaY5B+Rs7HGTuVGaC32m0rdpQ68N8QCN3khYiqs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0 h1:MG9VFW43M4A8BYeAfaJJZWrroinxeTi2r3+SnmLQfSA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.37.0/go.mod h1:JdeBDPgpJfuS6rU/hNglmOigKhyEZtBmbraLE4GK1J8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
+github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4 h1:Gx4ipHtKfaABSHAVo4Zjo2E4ClKzYqZ2NrPO0gy6qvY=
 github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.4/go.mod h1:nnwXv9COKyqd4q7jpPrxRaW9L+Qfwb4aGTdZqsIpOho=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
 github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
+github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
-github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
+github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/bufbuild/protocompile v0.10.0 h1:+jW/wnLMLxaCEG8AX9lD0bQ5v9h1RUiMKOBOT5ll9dM=
 github.com/bufbuild/protocompile v0.10.0/go.mod h1:G9qQIQo0xZ6Uyj6CMNz0saGmx2so+KONo8/KrELABiY=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd h1:rFt+Y/IK1aEZkEHchZRSq9OQbsSzIT/OrI8YFFmRIng=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/buildkite/bintest/v3 v3.3.0 h1:RTWcSaJRlOT6t/K311ejPf+0J3LE/QEODzVG3vlLnWo=
 github.com/buildkite/bintest/v3 v3.3.0/go.mod h1:btqpTsVODiJcb0NMdkkmtMQ6xoFc2W/nY5yy+3I0zcs=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -368,32 +416,38 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 h1:Om6kYQYDUk5wWbT0t0q6pvyM49i9XZAv9dDrkDA7gjk=
-github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
+github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
-github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
-github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
-github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
-github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
-github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4 h1:NZwojZ3+Cb8qxEkNdtmIrjwergNXvkTjvnM+yecyQoQ=
+github.com/containerd/stargz-snapshotter/estargz v0.17.1-0.20250814072747-99bfda8ce9c4/go.mod h1:s06tWAiJcXQo9/8AReBCIo/QxcXFZ2n4qfsRnpl71SM=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
@@ -417,42 +471,40 @@ github.com/di-wu/parser v0.3.0/go.mod h1:SLp58pW6WamdmznrVRrw2NTyn4wAvT9rrEFynKX
 github.com/di-wu/xsd-datetime v1.0.0 h1:vZoGNkbzpBNoc+JyfVLEbutNDNydYV8XwHeV7eUJoxI=
 github.com/di-wu/xsd-datetime v1.0.0/go.mod h1:i3iEhrP3WchwseOBeIdW/zxeoleXTOzx1WyDXgdmOww=
 github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
-github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0=
+github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
 github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
-github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
+github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
+github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dmarkham/enumer v1.5.10 h1:ygL0L6quiTiH1jpp68DyvsWaea6MaZLZrTTkIS++R0M=
 github.com/dmarkham/enumer v1.5.10/go.mod h1:e4VILe2b1nYK3JKJpRmNdl5xbDQvELc6tQ8b+GsGk6E=
-github.com/docker/cli v27.5.0+incompatible h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM=
-github.com/docker/cli v27.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A=
+github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
-github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
-github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/elastic/elastic-transport-go/v8 v8.7.0 h1:OgTneVuXP2uip4BA658Xi6Hfw+PeIOod2rY3GVMGoVE=
-github.com/elastic/elastic-transport-go/v8 v8.7.0/go.mod h1:YLHer5cj0csTzNFXoNQ8qhtGY1GTvSqPnKWKaqQE3Hk=
-github.com/elastic/go-elasticsearch/v8 v8.18.0 h1:ANNq1h7DEiPUaALb8+5w3baQzaS08WfHV0DNzp0VG4M=
-github.com/elastic/go-elasticsearch/v8 v8.18.0/go.mod h1:WLqwXsJmQoYkoA9JBFeEwPkQhCfAZuUvfpdU/NvSSf0=
+github.com/dvsekhvalnov/jose2go v1.7.0 h1:bnQc8+GMnidJZA8zc6lLEAb4xNrIqHwO+9TzqvtQZPo=
+github.com/dvsekhvalnov/jose2go v1.7.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry/P5s8R4dYuLkhB9Nhso8ogFWNr4IQ=
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8/go.mod h1:JkjcmqbLW+khwt2fmBPJFBhx2zGZ8XobRZ+O0VhlwWo=
 github.com/emicklei/go-restful/v3 v3.11.3 h1:yagOQz/38xJmcNeZJtrUcKjkHRltIaIFXKWeG1SkWGE=
@@ -463,8 +515,12 @@ github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FM
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
+github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
@@ -487,17 +543,19 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsouza/fake-gcs-server v1.52.2 h1:j6ne83nqHrlX5EEor7WWVIKdBsztGtwJ1J2mL+k+iio=
+github.com/fsouza/fake-gcs-server v1.52.2/go.mod h1:47HKyIkz6oLTes1R8vEaHLwXfzYsGfmDUk1ViHHAUsA=
 github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
 github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
-github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
-github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
-github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
@@ -512,6 +570,8 @@ github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI
 github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
 github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
 github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
@@ -522,16 +582,15 @@ github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
 github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -540,8 +599,8 @@ github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
-github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -558,20 +617,21 @@ github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZ
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
-github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
-github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
+github.com/go-piv/piv-go/v2 v2.4.0 h1:xamQ/fR4MJiw/Ndbk6yi7MVwhjrwlnDAPuaH9zcGb+I=
+github.com/go-piv/piv-go/v2 v2.4.0/go.mod h1:ShZi74nnrWNQEdWzRUd/3cSig3uNOcEZp+EWl0oewnI=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.12.3 h1:hHQl1xkUuabUU9uS+ISNCMLs9z50p9mDUZI/FmkayNE=
 github.com/go-webauthn/webauthn v0.12.3/go.mod h1:4JRe8Z3W7HIw8NGEWn2fnUwecoDzkkeach/NnvhkqGY=
 github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
@@ -588,16 +648,20 @@ github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus=
 github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
+github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
@@ -614,8 +678,8 @@ github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFU
 github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
+github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -630,14 +694,15 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
-github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
@@ -645,6 +710,8 @@ github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl76
 github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go=
 github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
+github.com/google/flatbuffers v24.12.23+incompatible h1:ubBKR94NR4pXUCY/MUsRVzd9umNW7ht7EG9hHfS9FX8=
+github.com/google/flatbuffers v24.12.23+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
 github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-attestation v0.5.1 h1:jqtOrLk5MNdliTKjPbIPrAaRKJaKW+0LIU2n/brJYms=
@@ -656,16 +723,18 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
 github.com/google/go-github/v70 v70.0.0 h1:/tqCp5KPrcvqCc7vIvYyFYTiCGrYvaWoYMGHSQbo55o=
 github.com/google/go-github/v70 v70.0.0/go.mod h1:xBUZgo8MI3lUL/hwxl3hlceJW1U8MVnXP3zUyI+rhQY=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
@@ -685,8 +754,11 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
 github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -694,8 +766,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e h1:FJta/0WsADCe1r9vQjdHbd3KuiLPu7Y9WlyLGwMUNyE=
+github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
@@ -707,8 +779,8 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
-github.com/google/trillian v1.7.1 h1:+zX8jLM3524bAMPS+VxaDIDgsMv3/ty6DuLWerHXcek=
-github.com/google/trillian v1.7.1/go.mod h1:E1UMAHqpZCA8AQdrKdWmHmtUfSeiD0sDWD1cv00Xa+c=
+github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js=
+github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -716,8 +788,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -731,12 +803,12 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
-github.com/grafana/pyroscope-go v1.2.2 h1:uvKCyZMD724RkaCEMrSTC38Yn7AnFe8S2wiAIYdDPCE=
-github.com/grafana/pyroscope-go v1.2.2/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
+github.com/grafana/pyroscope-go v1.2.4 h1:B22GMXz+O0nWLatxLuaP7o7L9dvP0clLvIpmeEQQM0Q=
+github.com/grafana/pyroscope-go v1.2.4/go.mod h1:zzT9QXQAp2Iz2ZdS216UiV8y9uXJYQiGE1q8v1FyhqU=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8 h1:iwOtYXeeVSAeYefJNaxDytgjKtUuKQbJqgAIjlnicKg=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
-github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1 h1:zGsdDzqXSuXI+1t+2TRRzdYiv+B3M4IgOPA8W/raFOA=
-github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1/go.mod h1:6FzirJfdffakAVqmHjwVfFkpru/gNbIazUOK5rIhndc=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2 h1:ygCC2LH+2TVWChc5x1AnjZsou48Kfq4NXYsfgdpnABs=
+github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.2/go.mod h1:6FzirJfdffakAVqmHjwVfFkpru/gNbIazUOK5rIhndc=
 github.com/gravitational/go-libfido2 v1.5.3-teleport.1 h1:nPfxiTH2Sr3J6zan280fbHOkWE7gRF/lMqvhcXKh2ek=
 github.com/gravitational/go-libfido2 v1.5.3-teleport.1/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo=
 github.com/gravitational/go-mssqldb v1.8.1-teleport.2 h1:vzt5i39yPLCQ8FL19wUXq4+BcJR53NPimAIAOAIl4I0=
@@ -749,28 +821,36 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
 github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
-github.com/gravitational/predicate v1.3.2 h1:NAdaWihgGVS3nuKDZZHTda4wwNjGlvG4a+UYQ4f3gQc=
-github.com/gravitational/predicate v1.3.2/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EMLfRWQVJMmK+MA6gV8AI=
 github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
-github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
-github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
+github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
+github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
 github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
 github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
+github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
+github.com/gravitational/selinux v1.13.0-teleport/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250326215846-2e10ca5fcbdf h1:bAsFak60gi442t2x3GuDp5Fww47zUs460NFIPiQJjzg=
 github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250326215846-2e10ca5fcbdf/go.mod h1:8eiBaRanEugPy3lh7UZ5NW6yaISaXXS4R56pi1D962k=
 github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
 github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
+github.com/gravitational/vt10x v0.0.3-teleport.1 h1:QYNPZGCQRcz1JehDn5m75UvRQbEJvT5X1pVblnCfZrY=
+github.com/gravitational/vt10x v0.0.3-teleport.1/go.mod h1:7p0/hpXPXby/VpuB6rFUq2pd7grku9KB+EcF0+jwqzQ=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1 h1:KcFzXwzM/kGhIRHvc8jdixfIJjVzuUJdnv+5xsPutog=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.1/go.mod h1:qOchhhIlmRcqk/O9uCo/puJlyo07YINaIqdZfZG3Jkc=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/cli v1.1.6 h1:CMOV+/LJfL1tXCOKrgAX0uRKnzjj/mpmqNXloRSy2K8=
@@ -799,8 +879,8 @@ github.com/hashicorp/go-plugin v1.3.0/go.mod h1:F9eH4LrE/ZsRdbwhfjs9k9HoDUwAHnYt
 github.com/hashicorp/go-plugin v1.4.1/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
 github.com/hashicorp/go-plugin v1.4.10 h1:xUbmA4jC6Dq163/fWcp8P3JuHilrHHMLNRxzGQJ9hNk=
 github.com/hashicorp/go-plugin v1.4.10/go.mod h1:6/1TEzT0eQznvI/gV2CM29DLSkAK/e58mUWKVsPaph0=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
@@ -820,9 +900,10 @@ github.com/hashicorp/go-version v1.3.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
 github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hc-install v0.3.1/go.mod h1:3LCdWcCDS1gaHC9mhHCGbkYfoY6vdsKohGjugbZdZak=
@@ -830,8 +911,9 @@ github.com/hashicorp/hc-install v0.7.0 h1:Uu9edVqjKQxxuD28mR5TikkKDd/p55S8vzPC16
 github.com/hashicorp/hc-install v0.7.0/go.mod h1:ELmmzZlGnEcqoUMKUuykHaPCIR1sYLYX+KSggWSKZuA=
 github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
 github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/hcl/v2 v2.3.0 h1:iRly8YaMwTBAKhn1Ybk7VSdzbnopghktCD031P8ggUE=
 github.com/hashicorp/hcl/v2 v2.3.0/go.mod h1:d+FwDBbOLvpAM3Z6J7gPj/VoAGkNe/gm352ZhjJ/Zv8=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/terraform-exec v0.15.0/go.mod h1:H4IG8ZxanU+NW0ZpDRNsvh9f0ul7C0nHP+rUR/CHs7I=
@@ -859,8 +941,11 @@ github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv2
 github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
 github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -875,27 +960,63 @@ github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ
 github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
+github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
 github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
+github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
+github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
+github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
 github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
 github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
 github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438 h1:Dj0L5fhJ9F82ZJyVOmBx6msDp/kfd1t9GRfny/mfJA0=
 github.com/jackc/pgerrcode v0.0.0-20240316143900-6e2875d9b438/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
+github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
 github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
+github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
+github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
+github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
+github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgtype v1.14.4 h1:fKuNiCumbKTAIxQwXfB/nsrnkEI6bPJrrSiMKgbJ2j8=
 github.com/jackc/pgtype v1.14.4/go.mod h1:aKeozOde08iifGosdJpz9MBZonJOUJxqNpPBcMJTlVA=
+github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
+github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
+github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
+github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
+github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
 github.com/jackc/pgx/v4 v4.18.3 h1:dE2/TrEsGX3RBprb3qryqSV9Y60iZN1C6i8IrmW9/BA=
 github.com/jackc/pgx/v4 v4.18.3/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
 github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
 github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
@@ -914,8 +1035,8 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
 github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
-github.com/jellydator/ttlcache/v3 v3.3.0 h1:BdoC9cE81qXfrxeb9eoJi9dWrdhSuwXMAnHTbnBm4Wc=
-github.com/jellydator/ttlcache/v3 v3.3.0/go.mod h1:bj2/e0l4jRnQdrnSTaGTsh4GSXvMjQcy41i7th0GVGw=
+github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
+github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
 github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA=
 github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
@@ -924,14 +1045,16 @@ github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+
 github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
 github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
 github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
 github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3 h1:2713fQZ560HxoNVgfJH41GKzjMjIG+DW4hH6nYXfXW8=
+github.com/johannesboyne/gofakes3 v0.0.0-20250916175020-ebf3e50324d3/go.mod h1:S4S9jGBVlLri0OeqrSSbCGG5vsI6he06UJyuz1WT1EE=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -942,8 +1065,6 @@ github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -958,17 +1079,21 @@ github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXw
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.11.2/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
+github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
@@ -981,25 +1106,37 @@ github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhR
 github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
 github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
 github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
+github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mark3labs/mcp-go v0.41.1 h1:w78eWfiQam2i8ICL7AL0WFiq7KHNJQ6UB53ZVtH4KGA=
+github.com/mark3labs/mcp-go v0.41.1/go.mod h1:T7tUa2jO6MavG+3P25Oy/jR7iCeJPHImCZHRymCn39g=
 github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
@@ -1008,6 +1145,7 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
@@ -1015,7 +1153,6 @@ github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lL
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
@@ -1050,16 +1187,16 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
-github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
-github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
-github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -1067,27 +1204,29 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/montanaflynn/stats v0.7.0 h1:r3y12KyNxj/Sb/iOE46ws+3mS1+MZca1wlHQFPsY/JU=
-github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
 github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
 github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
 github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY=
 github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nsf/jsondiff v0.0.0-20200515183724-f29ed568f4ce/go.mod h1:uFMI8w+ref4v2r9jz+c9i1IfIttS/OkmLfrk1jne5hs=
+github.com/ohler55/ojg v1.26.8 h1:njM65m+ej8sLHiFZIhJK9UkwOmDPsUikjGbTgcwu8CU=
+github.com/ohler55/ojg v1.26.8/go.mod h1:/Y5dGWkekv9ocnUixuETqiL58f+5pAsUfg5P8e7Pa2o=
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
@@ -1100,12 +1239,12 @@ github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
 github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/openai/openai-go v1.8.2 h1:UqSkJ1vCOPUpz9Ka5tS0324EJFEuOvMc+lA/EarJWP8=
+github.com/openai/openai-go v1.8.2/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
-github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opensearch-project/opensearch-go/v2 v2.3.0 h1:nQIEMr+A92CkhHrZgUhcfsrZjibvB3APXf2a1VwCmMQ=
 github.com/opensearch-project/opensearch-go/v2 v2.3.0/go.mod h1:8LDr9FCgUTVoT+5ESjc2+iaZuldqE+23Iq0r1XeNue8=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
@@ -1120,6 +1259,7 @@ github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible
 github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/paulmach/orb v0.11.1 h1:3koVegMC4X/WeiXYz9iswopaTwMem53NzTJuTF20JzU=
 github.com/paulmach/orb v0.11.1/go.mod h1:5mULz1xQfs3bmQm63QEJA6lNGujuRafwA5S/EnuLaLU=
+github.com/paulmach/protoscan v0.2.1/go.mod h1:SpcSwydNLrxUGSDvXvO0P7g7AuhJ7lcKfDlhJCDw2gY=
 github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0 h1:2nosf3P75OZv2/ZO/9Px5ZgZ5gbKrzA3joN1QMfOGMQ=
 github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0/go.mod h1:lAVhWwbNaveeJmxrxuSTxMgKpF6DjnuVpn6T8WiBwYQ=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
@@ -1132,6 +1272,7 @@ github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1H
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
 github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
 github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pingcap/errors v0.11.0/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
 github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb h1:3pSi4EDG6hg0orE1ndHkXvX6Qdq2cZn8gAPir8ymKZk=
 github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb/go.mod h1:X2r9ueLEUZgtx2cIogM0v4Zj5uvvzhuuiu7Pn8HzMPg=
 github.com/pingcap/log v1.1.1-0.20230317032135-a0d097d16e22 h1:2SOzvGvE8beiC1Y4g9Onkvu6UmuBBOeWRGQEjJaT/JY=
@@ -1143,12 +1284,15 @@ github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxu
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
+github.com/pkg/xattr v0.4.10 h1:Qe0mtiNFHQZ296vRgUjRCoPHPqH7VdTOrZx3g0T+pGA=
+github.com/pkg/xattr v0.4.10/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
+github.com/pkoukk/tiktoken-go v0.1.8 h1:85ENo+3FpWgAACBaEUVp+lctuTcYUO7BtmfhlN/QTRo=
+github.com/pkoukk/tiktoken-go v0.1.8/go.mod h1:9NiV+i9mJKGj1rYOT+njbv+ZwA/zJxYdewGl6qVatpg=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -1163,27 +1307,21 @@ github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
-github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/quic-go/quic-go v0.51.0 h1:K8exxe9zXxeRKxaXxi/GpUqYiTrtdiWP8bo1KFya6Wc=
-github.com/quic-go/quic-go v0.51.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -1193,10 +1331,14 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
+github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/rs/zerolog v1.28.0 h1:MirSo27VyNi7RJYP3078AA1+Cyzd2GB66qy3aUHvsWY=
 github.com/rs/zerolog v1.28.0/go.mod h1:NILgTygv/Uej1ra5XxGf82ZFSLk58MFGAUS2o6usyD0=
-github.com/rubenv/sql-migrate v1.7.1 h1:f/o0WgfO/GqNuVg+6801K/KW3WdDSupzSjDYODmiUq4=
-github.com/rubenv/sql-migrate v1.7.1/go.mod h1:Ob2Psprc0/3ggbM6wCzyYVFFuc6FyZrb2AS+ezLDFb4=
+github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2Ns0o=
+github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
 github.com/russellhaering/gosaml2 v0.10.0 h1:z7JTpKmC4JVG94tvSQz4lszUdKLt+uy5c6lEkhdEz3Y=
 github.com/russellhaering/gosaml2 v0.10.0/go.mod h1:XLwI/5aWV4E2X9p+qj6LgRwiYGv2nh4YS6pQBGlQ0Cc=
 github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
@@ -1205,19 +1347,24 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
 github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
 github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
 github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
 github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
 github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/scim2/filter-parser/v2 v2.2.0 h1:QGadEcsmypxg8gYChRSM2j1edLyE/2j72j+hdmI4BJM=
 github.com/scim2/filter-parser/v2 v2.2.0/go.mod h1:jWnkDToqX/Y0ugz0P5VvpVEUKcWcyHHj+X+je9ce5JA=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0 h1:rf1HIbL64nUpEIZnjLZ3mcNEL9NBPB0iuVjyxvq3LZc=
-github.com/secure-systems-lab/go-securesystemslib v0.9.0/go.mod h1:DVHKMcZ+V4/woA/peqr+L0joiRXbPpQ042GgJckkFgw=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
@@ -1227,40 +1374,45 @@ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
-github.com/shirou/gopsutil/v4 v4.25.4 h1:cdtFO363VEOOFrUCjZRh4XVJkb548lyF0q0uTeMqYPw=
-github.com/shirou/gopsutil/v4 v4.25.4/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA=
+github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca h1:Ti7KXq+i1d0jIaIaYN8tPyjxC4t69Wai6mOQvlA3XFY=
+github.com/shirou/gopsutil/v4 v4.25.8-0.20250814111814-5068034366ca/go.mod h1:4f4j4w8HLMPWEFs3BO2UBBLigKAaWYwkSkbIt/6Q4Ss=
+github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8iUrN18JYed2TvG9yN5ULG2jATM=
 github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
 github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 h1:oI+RNwuC9jF2g2lP0u0cVEEZrc/AYBCuFdvwrLWM/6Q=
 github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07/go.mod h1:yFdBgwXP24JziuRl2NMUahT7nGLNOKi1SIiFxMttVD4=
-github.com/sigstore/protobuf-specs v0.4.1 h1:5SsMqZbdkcO/DNHudaxuCUEjj6x29tS2Xby1BxGU7Zc=
-github.com/sigstore/protobuf-specs v0.4.1/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
-github.com/sigstore/rekor v1.3.9 h1:sUjRpKVh/hhgqGMs0t+TubgYsksArZ6poLEC3MsGAzU=
-github.com/sigstore/rekor v1.3.9/go.mod h1:xThNUhm6eNEmkJ/SiU/FVU7pLY2f380fSDZFsdDWlcM=
-github.com/sigstore/sigstore v1.9.4 h1:64+OGed80+A4mRlNzRd055vFcgBeDghjZw24rPLZgDU=
-github.com/sigstore/sigstore v1.9.4/go.mod h1:Q7tGTC3gbtK7c3jcxEmGc2MmK4rRpIRzi3bxRFWKvEY=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/rekor v1.4.1 h1:KK3McuHnptIE9mdNlrc9qh/OVE0AXf4rnScMxJE6xH4=
+github.com/sigstore/rekor v1.4.1/go.mod h1:/McBsz/vrtfi4EInxSIk/MGbDXzgv2+1FQUg1R/uSnE=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
 github.com/sigstore/sigstore-go v0.7.1 h1:lyzi3AjO6+BHc5zCf9fniycqPYOt3RaC08M/FRmQhVY=
 github.com/sigstore/sigstore-go v0.7.1/go.mod h1:AIRj4I3LC82qd07VFm3T2zXYiddxeBV1k/eoS8nTz0E=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1 h1:/YcNq687WnXpIRXl04nLfJX741G4iW+w+7Nem2Zy0f4=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.1/go.mod h1:ApL9RpKsi7gkSYN0bMNdm/3jZ9EefxMmfYHfUmq2ZYM=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1 h1:FnusXyTIInnwfIOzzl5PFilRm1I97dxMSOcCkZBu9Kc=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.1/go.mod h1:d5m5LOa/69a+t2YC9pDPwS1n2i/PhqB4cUKbpVDlKKE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1 h1:LFiYK1DEWQ6Hf/nroFzBMM+s5rVSjVL45Alpb5Ctl5A=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.1/go.mod h1:GFyFmDsE2wDuIHZD+4+JErGpA0S4zJsKNz5l2JVJd8s=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1 h1:sIW6xe4yU5eIMH8fve2C78d+r29KmHnIb+7po+80bsY=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.1/go.mod h1:3pNf99GnK9eu3XUa5ebHzgEQSVYf9hqAoPFwbwD6O6M=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5 h1:qp2VFyKuFQvTGmZwk5Q7m5nE4NwnF9tHwkyz0gtWAck=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.9.5/go.mod h1:DKlQjjr+GsWljEYPycI0Sf8URLCk4EbGA9qYjF47j4g=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5 h1:CRZcdYn5AOptStsLRAAACudAVmb1qUbhMlzrvm7ju3o=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.5/go.mod h1:b9rFfITq2fp1M3oJmq6lFFhSrAz5vOEJH1qzbMsZWN4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3 h1:a7Yz8C0aBa/LjeiTa9ZLYi9B74GNhFRnUIUdvN6ddVk=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.6-0.20250729224751-181c5d3339b3/go.mod h1:tRtJzSZ48MXJV9bmS8pkb3mP36PCad/Cs+BmVJ3Z4O4=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5 h1:S2ukEfN1orLKw2wEQIUHDDlzk0YcylhcheeZ5TGk8LI=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.9.5/go.mod h1:m7sQxVJmDa+rsmS1m6biQxaLX83pzNS7ThUEyjOqkCU=
 github.com/sigstore/timestamp-authority v1.2.5 h1:W22JmwRv1Salr/NFFuP7iJuhytcZszQjldoB8GiEdnw=
 github.com/sigstore/timestamp-authority v1.2.5/go.mod h1:gWPKWq4HMWgPCETre0AakgBzcr9DRqHrsgbrRqsigOs=
 github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
 github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
-github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/snowflakedb/gosnowflake v1.14.0 h1:lP91Y47ho3dzpTxWr7wjpvDXteh+ZttsLaw1WXzHS34=
+github.com/snowflakedb/gosnowflake v1.14.0/go.mod h1:NUxNYUdyPn9sRoYB/udq/fXBXuhLS3SBTPI2/OT79uc=
 github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
 github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
@@ -1272,16 +1424,16 @@ github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cA
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
 github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
-github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8 h1:KFHLQuNqUG4YZXo+QwMurqFxU5qWchFDCxYbl+uJz9w=
-github.com/spiffe/aws-spiffe-workload-helper v0.0.1-rc.8/go.mod h1:xhhvkBenvvbuEEw9YR2HwGzUPv0sQiHd3wv8avhra+U=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -1296,17 +1448,35 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/testcontainers/testcontainers-go v0.39.0 h1:uCUJ5tA+fcxbFAB0uP3pIK3EJ2IjjDUHFSZ1H1UxAts=
+github.com/testcontainers/testcontainers-go v0.39.0/go.mod h1:qmHpkG7H5uPf/EvOORKvS6EuDkBUPE3zpVGaH9NL7f8=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0 h1:8iJ4itSuiSpPLevQ+fM6cR+9k74YSOM1glKI4XFF+Qw=
+github.com/testcontainers/testcontainers-go/modules/mysql v0.39.0/go.mod h1:EKJcSWfogRdiBc5kvar1tumSx7MImmkQ0RDvU0HZQZM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0 h1:REJz+XwNpGC/dCgTfYvM4SKqobNqDBfvhq74s2oHTUM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0/go.mod h1:4K2OhtHEeT+JSIFX4V8DkGKsyLa96Y2vLdd3xsxD5HE=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
 github.com/theupdateframework/go-tuf/v2 v2.0.2 h1:PyNnjV9BJNzN1ZE6BcWK+5JbF+if370jjzO84SS+Ebo=
 github.com/theupdateframework/go-tuf/v2 v2.0.2/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
@@ -1315,15 +1485,15 @@ github.com/tink-crypto/tink-go/v2 v2.4.0 h1:8VPZeZI4EeZ8P/vB6SIkhlStrJfivTJn+cQ4
 github.com/tink-crypto/tink-go/v2 v2.4.0/go.mod h1:l//evrF2Y3MjdbpNDNGnKgCpo5zSmvUvnQ4MU+yE2sw=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
-github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
 github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -1333,6 +1503,8 @@ github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
@@ -1340,21 +1512,21 @@ github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
 github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -1370,26 +1542,25 @@ github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 h1:hlE8//ciYMztlGpl/VA+Zm1AcTPHYkHJPbHqE6WJUXE=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f h1:ERexzlUfuTvpE74urLSbIQW0Z/6hF9t8U4NsJLaioAY=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
 github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
 github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
 github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
 github.com/zclconf/go-cty v1.9.1/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
-github.com/zclconf/go-cty v1.14.4 h1:uXXczd9QDGsgu0i/QFR/hzI5NYCHLf6NQw/atrbnhq8=
-github.com/zclconf/go-cty v1.14.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
 github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
+github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 github.com/zitadel/logging v0.6.2 h1:MW2kDDR0ieQynPZ0KIZPrh9ote2WkxfBif5QoARDQcU=
 github.com/zitadel/logging v0.6.2/go.mod h1:z6VWLWUkJpnNVDSLzrPSQSQyttysKZ6bCRongw0ROK4=
-github.com/zitadel/oidc/v3 v3.38.1 h1:VTf1Bv/33UbSwJnIWbfEIdpUGYKfoHetuBNIqVTcjvA=
-github.com/zitadel/oidc/v3 v3.38.1/go.mod h1:muukzAasaWmn3vBwEVMglJfuTE0PKCvLJGombPwXIRw=
+github.com/zitadel/oidc/v3 v3.43.0 h1:LokviPoiTNNPbIAMO/eb6Kq9PNWPWp0mA1oWtdLc+Qs=
+github.com/zitadel/oidc/v3 v3.43.0/go.mod h1:5ki8s9CWoB4iGmtULndiVxwM8xt7IylZIaudro7jEq4=
 github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
 github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
 gitlab.com/gitlab-org/api/client-go v0.127.0 h1:8xnxcNKGF2gDazEoMs+hOZfOspSSw8D0vAoWhQk9U+U=
@@ -1402,8 +1573,9 @@ go.etcd.io/etcd/client/pkg/v3 v3.5.21 h1:lPBu71Y7osQmzlflM9OfeIV2JlmpBjqBNlLtcoB
 go.etcd.io/etcd/client/pkg/v3 v3.5.21/go.mod h1:BgqT/IXPjK9NkeSDjbzwsHySX3yIle2+ndz28nVsjUs=
 go.etcd.io/etcd/client/v3 v3.5.21 h1:T6b1Ow6fNjOLOtM0xSoKNQt1ASPCLWrF9XMHcH9pEyY=
 go.etcd.io/etcd/client/v3 v3.5.21/go.mod h1:mFYy67IOqmbRf/kRUvsHixzo3iG+1OF2W2+jVIQRAnU=
-go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
-go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
+go.mongodb.org/mongo-driver v1.11.4/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -1413,63 +1585,115 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0 h1:bGvFt68+KTiAKFlacHW6AhA56GF2rS0bdD3aJYEnmzA=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0/go.mod h1:qGWP8/+ILwMRIUf9uIVLloR1uo5ZYAslM4O6OqUi1DA=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
-go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI=
-go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc=
-go.step.sm/crypto v0.60.0 h1:UgSw8DFG5xUOGB3GUID17UA32G4j1iNQ4qoMhBmsVFw=
-go.step.sm/crypto v0.60.0/go.mod h1:Ep83Lv818L4gV0vhFTdPWRKnL6/5fRMpi8SaoP5ArSw=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGhfnFe5lwB0ic1JBVjzhk0w=
+go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7ZSD+5yn+lo3sGV69nW04rRR0jhYnBwjuX3r0HvnK0=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
+go.opentelemetry.io/otel/exporters/prometheus v0.54.0/go.mod h1:QyjcV9qDP6VeK5qPyKETvNjmaaEc7+gqjh4SS0ZYzDU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0/go.mod h1:zKU4zUgKiaRxrdovSS2amdM5gOc59slmo/zJwGX+YBg=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsux7Qmq8ToKAx1XCilTQECZ0KDZyTw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
+go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
+go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
+go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d h1:Ns9kd1Rwzw7t0BR8XMphenji4SmIoNZPn8zhYmaVKP8=
+go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d/go.mod h1:92Uoe3l++MlthCm+koNi0tcUCX3anayogF0Pa/sp24k=
+go.step.sm/crypto v0.70.0 h1:Q9Ft7N637mucyZcHZd1+0VVQJVwDCKqcb9CYcYi7cds=
+go.step.sm/crypto v0.70.0/go.mod h1:pzfUhS5/ue7ev64PLlEgXvhx1opwbhFCjkvlhsxVds0=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1480,8 +1704,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1507,13 +1731,12 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -1521,10 +1744,10 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1540,25 +1763,28 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1568,31 +1794,34 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1610,9 +1839,9 @@ golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1627,17 +1856,20 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8 h1:LvzTn0GQhWuvKH/kVRS3R3bVAsdQWI7hvfLHGgh9+lU=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
+golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
@@ -1645,29 +1877,32 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1675,14 +1910,19 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -1690,6 +1930,7 @@ golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
@@ -1712,14 +1953,20 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -1735,8 +1982,8 @@ google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/
 google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.230.0 h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM=
-google.golang.org/api v0.230.0/go.mod h1:aqvtoMk7YkiXx+6U12arQFExiRV9D/ekvMCwCd/TksQ=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1773,12 +2020,12 @@ google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1m
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200711021454-869866162049/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 h1:0PeQib/pH3nB/5pEmFeVQJotzGohV0dq4Vcp09H5yhE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34/go.mod h1:0awUlEkap+Pb1UMeJwJQQAdJQrt3moU7J2moTy69irI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 h1:h6p3mQqrmT1XkHVTfzLdNz1u7IhINeZkz67/xTbOuWs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -1792,8 +2039,9 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.32.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1808,9 +2056,9 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1823,15 +2071,16 @@ gopkg.in/dnaeon/go-vcr.v3 v3.2.0/go.mod h1:2IMOnnlx9I6u9x+YBsM3tAMx6AlOxnJ0pWxQA
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1839,14 +2088,13 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
-helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+helm.sh/helm/v3 v3.18.5 h1:Cc3Z5vd6kDrZq9wO9KxKLNEickiTho6/H/dBNRVSos4=
+helm.sh/helm/v3 v3.18.5/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1854,32 +2102,34 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.33.0 h1:yTgZVn1XEe6opVpP1FylmNrIFWuDqe2H0V8CT5gxfIU=
-k8s.io/api v0.33.0/go.mod h1:CTO61ECK/KU7haa3qq8sarQ0biLq2ju405IZAd9zsiM=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
-k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.0 h1:QqcM6c+qEEjkOODHppFXRiw/cE2zP85704YrQ9YaBbc=
-k8s.io/apiserver v0.33.0/go.mod h1:EixYOit0YTxt8zrO2kBU7ixAtxFce9gKGq367nFmqI8=
-k8s.io/cli-runtime v0.33.0 h1:Lbl/pq/1o8BaIuyn+aVLdEPHVN665tBAXUePs8wjX7c=
-k8s.io/cli-runtime v0.33.0/go.mod h1:QcA+r43HeUM9jXFJx7A+yiTPfCooau/iCcP1wQh4NFw=
-k8s.io/client-go v0.33.0 h1:UASR0sAYVUzs2kYuKn/ZakZlcs2bEHaizrrHUZg0G98=
-k8s.io/client-go v0.33.0/go.mod h1:kGkd+l/gNGg8GYWAPr0xF1rRKvVWvzh9vmZAMXtaKOg=
-k8s.io/component-base v0.33.0 h1:Ot4PyJI+0JAD9covDhwLp9UNkUja209OzsJ4FzScBNk=
-k8s.io/component-base v0.33.0/go.mod h1:aXYZLbw3kihdkOPMDhWbjGCO6sg+luw554KP51t8qCU=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
+k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.0 h1:HiRb1yqibBSCqic4pRZP+viiOBAnIdwYDpzUFejs07g=
-k8s.io/kubectl v0.33.0/go.mod h1:gAlGBuS1Jq1fYZ9AjGWbI/5Vk3M/VW2DK4g10Fpyn/0=
+k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
+k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
+k8s.io/metrics v0.33.3 h1:9CcqBz15JZfISqwca33gdHS8I6XfsK1vA8WUdEnG70g=
+k8s.io/metrics v0.33.3/go.mod h1:Aw+cdg4AYHw0HvUY+lCyq40FOO84awrqvJRTw0cmXDs=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg=
 mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8=
-oras.land/oras-go v1.2.5 h1:XpYuAwAb0DfQsunIyMfeET92emK8km3W4yEzZvUbsTo=
-oras.land/oras-go v1.2.5/go.mod h1:PuAwRShRZCsZb7g8Ar3jKKQR/2A/qN+pkYxIOd/FAoo=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
@@ -1896,7 +2146,8 @@ sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M=
 software.sslmate.com/src/go-pkcs12 v0.5.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/integrations/terraform/protoc-gen-terraform-accesslist.yaml b/integrations/terraform/protoc-gen-terraform-accesslist.yaml
index f7c7e26249447..e52d1b254f230 100644
--- a/integrations/terraform/protoc-gen-terraform-accesslist.yaml
+++ b/integrations/terraform/protoc-gen-terraform-accesslist.yaml
@@ -7,6 +7,7 @@ use_state_for_unknown_by_default: true
 # Top-level type names to export
 types:
     - "AccessList"
+    - "Member"
 
 # These import paths were not being automatically picked up by
 # protoc-gen-terraform without these overrides
@@ -29,6 +30,13 @@ injected_fields:
       computed: true
       plan_modifiers:
         - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
+  Member:
+    -
+      name: id
+      type: github.com/hashicorp/terraform-plugin-framework/types.StringType
+      computed: true
+      plan_modifiers:
+        - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
 
 # These fields will be excluded
 exclude_fields:
@@ -37,31 +45,49 @@ exclude_fields:
     # Read only field
     - "AccessList.spec.owners.ineligible_status"
     - "AccessList.status"
+    # Metadata (we id resources by name on our side)
+    - "Member.header.metadata.id"
+    # Read only field
+    - "Member.spec.ineligible_status"
 
 # These fields will be marked as Computed: true
 computed_fields:
-    # Metadata
     - "AccessList.header.kind"
     - "AccessList.header.metadata.expires"
     - "AccessList.header.metadata.namespace"
     - "AccessList.header.metadata.revision"
     - "AccessList.spec.audit.next_audit_date"
-
+    - "Member.header.kind"
+    - "Member.header.metadata.expires"
+    - "Member.header.metadata.namespace"
+    - "Member.header.metadata.revision"
+    - "Member.spec.name"
+    - "Member.spec.joined"
+    - "Member.spec.added_by"
 
 # These fields will be marked as Required: true
 required_fields:
     - "Metadata.name"
     - "AccessList.header.version"
     - "AccessList.spec.owners"
-    - "AccessList.spec.grants"
-    - "AccessList.spec.audit"
-    - "AccessList.spec.audit.recurrence"
-    - "AccessList.spec.audit.recurrence.frequency"
+    - "Member.header.version"
+    - "Member.spec.access_list"
+    - "Member.spec.membership_kind"
 
 plan_modifiers:
-    # Force to recreate resource if it's name changes
+    # Force to recreate resource if it's ID changes
     Metadata.name:
       - "github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()"
+    # spec.access_list is a part of access_list_member ID. In the backend member's ID is
+    # constructed like:
+    # "{access_list_member.spec.access_list}/{access_list_member.header.metadata.name}"
+    # So the resource should be recreated if the access_list field changes.
+    Member.spec.access_list:
+      - "github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()"
+    # If the membership kind changes, that basically means it's a different member now so it should
+    # be replaced.
+    Member.spec.membership_kind:
+      - "github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()"
 
 # This must be defined for the generator to be happy, but in reality all time
 # fields are overridden (because the protobuf timestamps contain locks and the
@@ -81,3 +107,6 @@ custom_types:
   "AccessList.spec.audit.next_audit_date": Timestamp
   "AccessList.spec.audit.frequency": Duration
   "AccessList.spec.audit.notifications.start": Duration
+  "Member.header.metadata.expires": Timestamp
+  "Member.spec.joined": Timestamp
+  "Member.spec.expires": Timestamp
diff --git a/integrations/terraform/protoc-gen-terraform-autoupdate.yaml b/integrations/terraform/protoc-gen-terraform-autoupdate.yaml
index 57dbbc65c4af2..240c35f0fb206 100644
--- a/integrations/terraform/protoc-gen-terraform-autoupdate.yaml
+++ b/integrations/terraform/protoc-gen-terraform-autoupdate.yaml
@@ -42,17 +42,19 @@ exclude_fields:
     # Metadata (we id resources by name on our side)
     - "AutoUpdateConfig.metadata.id"
     - "AutoUpdateVersion.metadata.id"
+    - "AutoUpdateVersion.metadata.namespace"
+    - "AutoUpdateConfig.metadata.namespace"
+    - "AutoUpdateVersion.metadata.revision"
+    - "AutoUpdateConfig.metadata.revision"
 
 # These fields will be marked as Computed: true
 computed_fields:
     # Metadata
     - "AutoUpdateVersion.metadata"
     - "AutoUpdateVersion.metadata.name"
-    - "AutoUpdateVersion.metadata.namespace"
     - "AutoUpdateVersion.kind"
     - "AutoUpdateConfig.metadata"
     - "AutoUpdateConfig.metadata.name"
-    - "AutoUpdateConfig.metadata.namespace"
     - "AutoUpdateConfig.kind"
 
 # These fields will be marked as Required: true
diff --git a/integrations/terraform/protoc-gen-terraform-discoveryconfig.yaml b/integrations/terraform/protoc-gen-terraform-discoveryconfig.yaml
new file mode 100644
index 0000000000000..95215e2699c25
--- /dev/null
+++ b/integrations/terraform/protoc-gen-terraform-discoveryconfig.yaml
@@ -0,0 +1,101 @@
+---
+target_package_name: 'v1'
+default_package_name: 'github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1'
+duration_custom_type: Duration
+use_state_for_unknown_by_default: true
+
+# Top-level type names to export
+types:
+  - 'DiscoveryConfig'
+
+# These import paths were not being automatically picked up by
+# protoc-gen-terraform without these overrides
+import_path_overrides:
+  'types': 'github.com/gravitational/teleport/api/types'
+  'wrappers': 'github.com/gravitational/teleport/api/types/wrappers'
+  'durationpb': 'google.golang.org/protobuf/types/known/durationpb'
+  'timestamppb': 'google.golang.org/protobuf/types/known/timestamppb'
+  'v1': 'github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1'
+  'v11': 'github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1'
+  'github_com_gravitational_teleport_integrations_terraform_tfschema': 'github.com/gravitational/teleport/integrations/terraform/tfschema'
+
+# id field is required for integration tests. It is not used by provider.
+# We have to add it manually (might be removed in the future versions).
+injected_fields:
+  DiscoveryConfig:
+    - name: id
+      type: github.com/hashicorp/terraform-plugin-framework/types.StringType
+      computed: true
+      plan_modifiers:
+        - 'github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()'
+
+# These fields will be excluded
+exclude_fields:
+  # Metadata (we id resources by name on our side)
+  - 'DiscoveryConfig.header.metadata.id'
+  # Read only field
+  - 'DiscoveryConfig.status'
+
+# These fields will be marked as Computed: true
+computed_fields:
+  # Metadata
+  - 'DiscoveryConfig.header.metadata.expires'
+  - 'DiscoveryConfig.header.metadata.namespace'
+  - 'DiscoveryConfig.header.metadata.revision'
+  - 'DiscoveryConfig.header.kind'
+  - 'DiscoveryConfig.header.sub_kind'
+  - 'DiscoveryConfig.spec.azure.Params'
+  - 'DiscoveryConfig.spec.azure.Params.ScriptName'
+  - 'DiscoveryConfig.spec.azure.Params.Azure'
+
+# These fields will be marked as Required: true
+required_fields:
+  - 'DiscoveryConfig.header'
+  - 'DiscoveryConfig.header.metadata'
+  - 'DiscoveryConfig.header.metadata.name'
+  - 'DiscoveryConfig.header.version'
+  - 'DiscoveryConfig.spec'
+  - 'DiscoveryConfig.spec.azure.Params.Azure.ClientID'
+  - 'DiscoveryConfig.spec.azure.Params.JoinToken'
+  - 'DiscoveryConfig.spec.azure.Params.JoinMethod'
+
+plan_modifiers:
+  # Force to recreate resource if it's name changes
+  Metadata.name:
+    - 'github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()'
+
+# This must be defined for the generator to be happy, but in reality all time
+# fields are overridden (because the protobuf timestamps contain locks and the
+# linter gets mad if we use raw structs instead of pointers).
+time_type:
+  type: 'PlaceholderType'
+duration_type:
+  type: "DurationType"
+  value_type: "DurationValue"
+  cast_to_type: "time.Duration"
+  cast_from_type: "time.Duration"
+
+validators:
+  # Expires must be in the future
+  Metadata.expires:
+    - github_com_gravitational_teleport_integrations_terraform_tfschema.MustTimeBeInFuture()
+
+custom_types:
+  'DiscoveryConfig.header.metadata.expires': Timestamp
+
+schema_types:
+  'DiscoveryConfig.spec.aws.Params.JoinMethod':
+    type: "github.com/hashicorp/terraform-plugin-framework/types.StringType"
+    value_type: "github.com/hashicorp/terraform-plugin-framework/types.String"
+    cast_to_type: "string"
+    cast_from_type: "github.com/gravitational/teleport/api/types.JoinMethod"
+  'DiscoveryConfig.spec.azure.Params.JoinMethod':
+    type: "github.com/hashicorp/terraform-plugin-framework/types.StringType"
+    value_type: "github.com/hashicorp/terraform-plugin-framework/types.String"
+    cast_to_type: "string"
+    cast_from_type: "github.com/gravitational/teleport/api/types.JoinMethod"
+  'DiscoveryConfig.spec.gcp.Params.JoinMethod':
+    type: "github.com/hashicorp/terraform-plugin-framework/types.StringType"
+    value_type: "github.com/hashicorp/terraform-plugin-framework/types.String"
+    cast_to_type: "string"
+    cast_from_type: "github.com/gravitational/teleport/api/types.JoinMethod"
diff --git a/integrations/terraform/protoc-gen-terraform-teleport.yaml b/integrations/terraform/protoc-gen-terraform-teleport.yaml
index 9d9a343261cd3..58395746bdc64 100644
--- a/integrations/terraform/protoc-gen-terraform-teleport.yaml
+++ b/integrations/terraform/protoc-gen-terraform-teleport.yaml
@@ -23,6 +23,7 @@ types:
     - "InstallerV1"
     - "DynamicWindowsDesktopV1"
     - "ProvisionTokenV2"
+    - "IntegrationV1"
 
 # id field is required for integration tests. It is not used by provider.
 # We have to add it manually (might be removed in the future versions).
@@ -146,6 +147,13 @@ injected_fields:
       computed: true
       plan_modifiers:
         - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
+  IntegrationV1:
+    -
+      name: id
+      type: github.com/hashicorp/terraform-plugin-framework/types.StringType
+      computed: true
+      plan_modifiers:
+        - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
 
 # These fields will be excluded
 exclude_fields:
@@ -170,6 +178,7 @@ exclude_fields:
 
     # Server
     - "ServerSpecV2.CmdLabels"
+    - "ServerSpecV2.component_features"
 
     # SessionRecordingConfig
     - "SessionRecordingConfigV2.Metadata.Name" # It's a singleton resource
@@ -180,6 +189,13 @@ exclude_fields:
     - "UserSpecV2.CreatedBy"
     - "UserSpecV2.Status"
 
+    # Integration
+    - "IntegrationV1.Status"
+    # only the "github" integration subkind uses credentials currently, but
+    # credentials is excluded intentionally so that we dont have to handle plugin credentials, which are stored separately.
+    - "IntegrationV1.Spec.credentials"
+    - "IntegrationV1.Spec.GitHub"
+    
 name_overrides:
 
 # These fields will be marked as Computed: true
@@ -310,6 +326,9 @@ computed_fields:
     # DynamicWindowsDesktop
     - "DynamicWindowsDesktopV1.Kind"
 
+    # Integration
+    - "IntegrationV1.Kind"
+
 # These fields will be marked as Required: true
 required_fields:
     # App
@@ -389,6 +408,13 @@ required_fields:
     - "DynamicWindowsDesktopV1.Metadata.Name"
     - "DynamicWindowsDesktopV1.Version"
 
+    # Integration
+    - "IntegrationV1.Metadata"
+    - "IntegrationV1.Metadata.Name"
+    - "IntegrationV1.SubKind"
+    - "IntegrationV1.Version"
+    - "IntegrationV1.Spec"
+
 # These fields must be marked as sensitive
 sensitive_fields:
     - "ProvisionTokenV2.Metadata.Name"
@@ -420,6 +446,8 @@ plan_modifiers:
       - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
     RoleV6.Spec.Options:
       - "DefaultRoleOptions()"
+    RoleV6.Spec.Allow.KubernetesResources:
+      - "DefaultKubernetesResources()"
 
 validators:
   # Expires must be in the future
@@ -448,7 +476,7 @@ validators:
   ProvisionTokenV2.Version:
     - UseVersionBetween(2,2)
   RoleV6.Version:
-    - UseVersionBetween(3,7)
+    - UseVersionBetween(3,8)
   SAMLConnectorV2.Version:
     - UseVersionBetween(2,2)
   SAMLConnectorV2.Spec:
@@ -469,6 +497,8 @@ validators:
     - UseVersionBetween(1,1)
   DynamicWindowsDesktopV1.Version:
     - UseVersionBetween(1,1)
+  IntegrationV1.Version:
+    - UseVersionBetween(1,1)
 
 time_type:
     type: "TimeType"
diff --git a/integrations/terraform/provider/credentials.go b/integrations/terraform/provider/credentials.go
index 3bc45d4185bc3..59400d1544a24 100644
--- a/integrations/terraform/provider/credentials.go
+++ b/integrations/terraform/provider/credentials.go
@@ -34,7 +34,8 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apitypes "github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/integrations/lib/embeddedtbot"
-	tbotconfig "github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 )
 
 var supportedCredentialSources = CredentialSources{
@@ -488,12 +489,13 @@ func (CredentialsFromNativeMachineID) Credentials(ctx context.Context, config pr
 	addr := stringFromConfigOrEnv(config.Addr, constants.EnvVarTerraformAddress, "")
 	caPath := stringFromConfigOrEnv(config.RootCaPath, constants.EnvVarTerraformRootCertificates, "")
 	gitlabIDTokenEnvVar := stringFromConfigOrEnv(config.GitlabIDTokenEnvVar, constants.EnvVarGitlabIDTokenEnvVar, "")
+	insecure := boolFromConfigOrEnv(config.Insecure, constants.EnvVarTerraformInsecure)
 
 	if joinMethod == "" {
 		return nil, trace.BadParameter("missing parameter %q or environment variable %q", attributeTerraformJoinMethod, constants.EnvVarTerraformJoinMethod)
 	}
 	if joinToken == "" {
-		return nil, trace.BadParameter("missing parameter %q or environment variable %q", attributeTerraformJoinMethod, constants.EnvVarTerraformJoinMethod)
+		return nil, trace.BadParameter("missing parameter %q or environment variable %q", attributeTerraformJoinToken, constants.EnvVarTerraformJoinToken)
 	}
 	if addr == "" {
 		return nil, trace.BadParameter("missing parameter %q or environment variable %q", attributeTerraformAddress, constants.EnvVarTerraformAddress)
@@ -514,22 +516,24 @@ See https://goteleport.com/docs/reference/join-methods for more details.`)
 		return nil, trace.Wrap(err, "Invalid Join Method")
 	}
 	botConfig := &embeddedtbot.BotConfig{
+		Kind:       bot.KindTerraformProvider,
 		AuthServer: addr,
-		Onboarding: tbotconfig.OnboardingConfig{
+		Onboarding: onboarding.Config{
 			TokenValue: joinToken,
 			CAPath:     caPath,
 			JoinMethod: apitypes.JoinMethod(joinMethod),
-			Terraform: tbotconfig.TerraformOnboardingConfig{
+			Terraform: onboarding.TerraformOnboardingConfig{
 				AudienceTag: audienceTag,
 			},
-			Gitlab: tbotconfig.GitlabOnboardingConfig{
+			Gitlab: onboarding.GitlabOnboardingConfig{
 				TokenEnvVarName: gitlabIDTokenEnvVar,
 			},
 		},
-		CredentialLifetime: tbotconfig.CredentialLifetime{
+		CredentialLifetime: bot.CredentialLifetime{
 			TTL:             time.Hour,
 			RenewalInterval: 20 * time.Minute,
 		},
+		Insecure: insecure,
 	}
 	// slog default logger has been configured during the provider init.
 	bot, err := embeddedtbot.New(botConfig, slog.Default())
diff --git a/integrations/terraform/provider/data_source_teleport_access_list_member.go b/integrations/terraform/provider/data_source_teleport_access_list_member.go
new file mode 100755
index 0000000000000..95980cd57bee4
--- /dev/null
+++ b/integrations/terraform/provider/data_source_teleport_access_list_member.go
@@ -0,0 +1,102 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+
+	convert "github.com/gravitational/teleport/api/types/accesslist/convert/v1"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	schemav1 "github.com/gravitational/teleport/integrations/terraform/tfschema/accesslist/v1"
+)
+
+// dataSourceTeleportMemberType is the data source metadata type
+type dataSourceTeleportMemberType struct{}
+
+// dataSourceTeleportMember is the resource
+type dataSourceTeleportMember struct {
+	p Provider
+}
+
+// GetSchema returns the data source schema
+func (r dataSourceTeleportMemberType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return schemav1.GenSchemaMember(ctx)
+}
+
+// NewDataSource creates the empty data source
+func (r dataSourceTeleportMemberType) NewDataSource(_ context.Context, p tfsdk.Provider) (tfsdk.DataSource, diag.Diagnostics) {
+	return dataSourceTeleportMember{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Read reads teleport Member
+func (r dataSourceTeleportMember) Read(ctx context.Context, req tfsdk.ReadDataSourceRequest, resp *tfsdk.ReadDataSourceResponse) {
+	var idPrefix types.String
+	diags := req.Config.GetAttribute(ctx, path.Root("spec").AtName("access_list"), &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	var id types.String
+	diags = req.Config.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	accessListMemberI, err := r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix.Value, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	var state types.Object
+	resp.Diagnostics.Append(req.Config.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Todo: Remove after updating terraform-plugin to >=v1.5.0.
+	// terraform-plugin-testing version <1.5.0 requires data resources to
+	// implement the 'id' attribute.
+	// https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
+	v, ok := state.Attrs["id"]
+	if !ok || v.IsNull() {
+		state.Attrs["id"] = types.String{Value: formatID(idPrefix.Value, id.Value)}
+	}
+
+	accessListMember := convert.ToMemberProto(accessListMemberI)
+	
+	diags = schemav1.CopyMemberToTerraform(ctx, accessListMember, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/data_source_teleport_discovery_config.go b/integrations/terraform/provider/data_source_teleport_discovery_config.go
new file mode 100755
index 0000000000000..c32e7c02bc8b3
--- /dev/null
+++ b/integrations/terraform/provider/data_source_teleport_discovery_config.go
@@ -0,0 +1,96 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+
+	convert "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	schemav1 "github.com/gravitational/teleport/integrations/terraform/tfschema/discoveryconfig/v1"
+)
+
+// dataSourceTeleportDiscoveryConfigType is the data source metadata type
+type dataSourceTeleportDiscoveryConfigType struct{}
+
+// dataSourceTeleportDiscoveryConfig is the resource
+type dataSourceTeleportDiscoveryConfig struct {
+	p Provider
+}
+
+// GetSchema returns the data source schema
+func (r dataSourceTeleportDiscoveryConfigType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return schemav1.GenSchemaDiscoveryConfig(ctx)
+}
+
+// NewDataSource creates the empty data source
+func (r dataSourceTeleportDiscoveryConfigType) NewDataSource(_ context.Context, p tfsdk.Provider) (tfsdk.DataSource, diag.Diagnostics) {
+	return dataSourceTeleportDiscoveryConfig{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Read reads teleport DiscoveryConfig
+func (r dataSourceTeleportDiscoveryConfig) Read(ctx context.Context, req tfsdk.ReadDataSourceRequest, resp *tfsdk.ReadDataSourceResponse) {
+	var id types.String
+	diags := req.Config.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	discoveryConfigI, err := r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+
+	var state types.Object
+	resp.Diagnostics.Append(req.Config.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Todo: Remove after updating terraform-plugin to >=v1.5.0.
+	// terraform-plugin-testing version <1.5.0 requires data resources to
+	// implement the 'id' attribute.
+	// https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
+	v, ok := state.Attrs["id"]
+	if !ok || v.IsNull() {
+		state.Attrs["id"] = id
+	}
+
+	discoveryConfig := convert.ToProto(discoveryConfigI)
+	
+	diags = schemav1.CopyDiscoveryConfigToTerraform(ctx, discoveryConfig, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/data_source_teleport_integration.go b/integrations/terraform/provider/data_source_teleport_integration.go
new file mode 100755
index 0000000000000..cc43a6b8963a3
--- /dev/null
+++ b/integrations/terraform/provider/data_source_teleport_integration.go
@@ -0,0 +1,96 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	"github.com/gravitational/teleport/integrations/terraform/tfschema"
+)
+
+// dataSourceTeleportIntegrationType is the data source metadata type
+type dataSourceTeleportIntegrationType struct{}
+
+// dataSourceTeleportIntegration is the resource
+type dataSourceTeleportIntegration struct {
+	p Provider
+}
+
+// GetSchema returns the data source schema
+func (r dataSourceTeleportIntegrationType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return tfschema.GenSchemaIntegrationV1(ctx)
+}
+
+// NewDataSource creates the empty data source
+func (r dataSourceTeleportIntegrationType) NewDataSource(_ context.Context, p tfsdk.Provider) (tfsdk.DataSource, diag.Diagnostics) {
+	return dataSourceTeleportIntegration{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Read reads teleport Integration
+func (r dataSourceTeleportIntegration) Read(ctx context.Context, req tfsdk.ReadDataSourceRequest, resp *tfsdk.ReadDataSourceResponse) {
+	var id types.String
+	diags := req.Config.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	integrationI, err := r.p.Client.GetIntegration(ctx, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+		return
+	}
+
+	var state types.Object
+	resp.Diagnostics.Append(req.Config.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Todo: Remove after updating terraform-plugin to >=v1.5.0.
+	// terraform-plugin-testing version <1.5.0 requires data resources to
+	// implement the 'id' attribute.
+	// https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
+	v, ok := state.Attrs["id"]
+	if !ok || v.IsNull() {
+		state.Attrs["id"] = id
+	}
+
+	
+	integration := integrationI.(*apitypes.IntegrationV1)
+	diags = tfschema.CopyIntegrationV1ToTerraform(ctx, integration, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/id.go b/integrations/terraform/provider/id.go
new file mode 100644
index 0000000000000..03031eb2b2267
--- /dev/null
+++ b/integrations/terraform/provider/id.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
+// formatID takes the prefix and the name of the resource and converts it to a string ID.
+func formatID(prefix, name string) string {
+	return prefix + "/" + name
+}
+
+// parseID takes the ID generated by [formatID] and splits it back to the prefix and resource name.
+func parseID(id string) (prefix, name string, err error) {
+	split := strings.Split(id, "/")
+	if len(split) != 2 {
+		return "", "", trace.BadParameter("expected id %q to have a single %q separator", id, "/")
+	}
+	prefix = split[0]
+	name = split[1]
+	if prefix == "" {
+		return "", "", trace.BadParameter("expected id %q prefix to be non-empty", id)
+	}
+	if name == "" {
+		return "", "", trace.BadParameter("expected id %q name to be non-empty", id)
+	}
+	return prefix, name, nil
+}
diff --git a/integrations/terraform/provider/provider.go b/integrations/terraform/provider/provider.go
index 15110380e6d81..cb4bf0f2cec90 100644
--- a/integrations/terraform/provider/provider.go
+++ b/integrations/terraform/provider/provider.go
@@ -75,6 +75,8 @@ const (
 	attributeTerraformIdentityFile = "identity_file"
 	// attributeTerraformIdentityFileBase64 is the attribute containing the base64-encoded identity file used by the Terraform provider.
 	attributeTerraformIdentityFileBase64 = "identity_file_base64"
+	// attributeTerraformInsecure is the attribute used to control whether the Terraform provider will skip verifying the proxy server's TLS certificate.
+	attributeTerraformInsecure = "insecure"
 	// attributeTerraformRetryBaseDuration is the attribute configuring the base duration between two Terraform provider retries.
 	attributeTerraformRetryBaseDuration = "retry_base_duration"
 	// attributeTerraformRetryCapDuration is the attribute configuring the maximum duration between two Terraform provider retries.
@@ -135,6 +137,8 @@ type providerData struct {
 	IdentityFile types.String `tfsdk:"identity_file"`
 	// IdentityFile identity file content encoded in base64
 	IdentityFileBase64 types.String `tfsdk:"identity_file_base64"`
+	// Insecure means the provider will skip verifying the proxy server's TLS certificate.
+	Insecure types.Bool `tfsdk:"insecure"`
 	// RetryBaseDuration is used to setup the retry algorithm when the API returns 'not found'
 	RetryBaseDuration types.String `tfsdk:"retry_base_duration"`
 	// RetryCapDuration is used to setup the retry algorithm when the API returns 'not found'
@@ -228,6 +232,11 @@ func (p *Provider) GetSchema(_ context.Context) (tfsdk.Schema, diag.Diagnostics)
 				Optional:    true,
 				Description: fmt.Sprintf("Teleport identity file content base64 encoded. This can also be set with the environment variable `%s`.", constants.EnvVarTerraformIdentityFileBase64),
 			},
+			attributeTerraformInsecure: {
+				Type:        types.BoolType,
+				Optional:    true,
+				Description: fmt.Sprintf("Skip proxy certificate verification when joining the Teleport cluster. This is not recommended for production use. This can also be set with the environment variable `%s`.", constants.EnvVarTerraformInsecure),
+			},
 			attributeTerraformRetryBaseDuration: {
 				Type:        types.StringType,
 				Sensitive:   false,
@@ -256,13 +265,13 @@ func (p *Provider) GetSchema(_ context.Context) (tfsdk.Schema, diag.Diagnostics)
 				Type:        types.StringType,
 				Sensitive:   false,
 				Optional:    true,
-				Description: fmt.Sprintf("Enables the native Terraform MachineID support. When set, Terraform uses MachineID to securely join the Teleport cluster and obtain credentials. See [the join method reference](../join-methods.mdx) for possible values. You must use [a delegated join method](../join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `%s`.", constants.EnvVarTerraformJoinMethod),
+				Description: fmt.Sprintf("Enables the native Terraform MachineID support. When set, Terraform uses MachineID to securely join the Teleport cluster and obtain credentials. See [the join method reference](../../deployment/join-methods.mdx) for possible values. You must use [a delegated join method](../../deployment/join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `%s`.", constants.EnvVarTerraformJoinMethod),
 			},
 			attributeTerraformJoinToken: {
 				Type:        types.StringType,
 				Sensitive:   false,
 				Optional:    true,
-				Description: fmt.Sprintf("Name of the token used for the native MachineID joining. This value is not sensitive for [delegated join methods](../join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `%s`.", constants.EnvVarTerraformJoinToken),
+				Description: fmt.Sprintf("Name of the token used for the native MachineID joining. This value is not sensitive for [delegated join methods](../../deployment/join-methods.mdx#secret-vs-delegated). This can also be set with the environment variable `%s`.", constants.EnvVarTerraformJoinToken),
 			},
 			attributeTerraformJoinAudienceTag: {
 				Type:        types.StringType,
@@ -315,6 +324,7 @@ func (p *Provider) Configure(ctx context.Context, req tfsdk.ConfigureProviderReq
 	retryCapDurationStr := stringFromConfigOrEnv(config.RetryCapDuration, constants.EnvVarTerraformRetryCapDuration, "5s")
 	maxTriesStr := stringFromConfigOrEnv(config.RetryMaxTries, constants.EnvVarTerraformRetryMaxTries, "10")
 	dialTimeoutDurationStr := stringFromConfigOrEnv(config.DialTimeoutDuration, constants.EnvVarTerraformDialTimeoutDuration, "30s")
+	insecure := boolFromConfigOrEnv(config.Insecure, constants.EnvVarTerraformInsecure)
 
 	if !p.validateAddr(addr, resp) {
 		return
@@ -349,6 +359,7 @@ func (p *Provider) Configure(ctx context.Context, req tfsdk.ConfigureProviderReq
 				grpc.WaitForReady(true),
 			),
 		},
+		InsecureAddressDiscovery: insecure,
 	}
 
 	clt, diags := activeSources.BuildClient(ctx, clientConfig, config)
@@ -449,6 +460,16 @@ func stringFromConfigOrEnv(value types.String, env string, def string) string {
 	return configValue
 }
 
+func boolFromConfigOrEnv(value types.Bool, env string) bool {
+	envVar := os.Getenv(env)
+	if envVar != "" && (value.Unknown || value.Null) {
+		if b, err := strconv.ParseBool(envVar); err == nil {
+			return b
+		}
+	}
+	return value.Value
+}
+
 // validateAddr validates passed addr
 func (p *Provider) validateAddr(addr string, resp *tfsdk.ConfigureProviderResponse) bool {
 	if addr == "" {
@@ -491,7 +512,7 @@ func (p *Provider) configureLog() {
 		level = logutils.TraceLevel
 	}
 
-	_, _, err := logutils.Initialize(logutils.Config{
+	_, _, _, err := logutils.Initialize(logutils.Config{
 		Severity: level.String(),
 		Format:   "text",
 	})
@@ -513,6 +534,7 @@ func (p *Provider) GetResources(_ context.Context) (map[string]tfsdk.ResourceTyp
 		"teleport_cluster_maintenance_config": resourceTeleportClusterMaintenanceConfigType{},
 		"teleport_cluster_networking_config":  resourceTeleportClusterNetworkingConfigType{},
 		"teleport_database":                   resourceTeleportDatabaseType{},
+		"teleport_discovery_config":           resourceTeleportDiscoveryConfigType{},
 		"teleport_dynamic_windows_desktop":    resourceTeleportDynamicWindowsDesktopType{},
 		"teleport_github_connector":           resourceTeleportGithubConnectorType{},
 		"teleport_provision_token":            resourceTeleportProvisionTokenType{},
@@ -527,6 +549,7 @@ func (p *Provider) GetResources(_ context.Context) (map[string]tfsdk.ResourceTyp
 		"teleport_trusted_device":             resourceTeleportDeviceV1Type{},
 		"teleport_okta_import_rule":           resourceTeleportOktaImportRuleType{},
 		"teleport_access_list":                resourceTeleportAccessListType{},
+		"teleport_access_list_member":         resourceTeleportMemberType{},
 		"teleport_server":                     resourceTeleportServerType{},
 		"teleport_installer":                  resourceTeleportInstallerType{},
 		"teleport_access_monitoring_rule":     resourceTeleportAccessMonitoringRuleType{},
@@ -535,6 +558,7 @@ func (p *Provider) GetResources(_ context.Context) (map[string]tfsdk.ResourceTyp
 		"teleport_autoupdate_version":         resourceTeleportAutoUpdateVersionType{},
 		"teleport_autoupdate_config":          resourceTeleportAutoUpdateConfigType{},
 		"teleport_health_check_config":        resourceTeleportHealthCheckConfigType{},
+		"teleport_integration":                resourceTeleportIntegrationType{},
 	}, nil
 }
 
@@ -546,6 +570,7 @@ func (p *Provider) GetDataSources(_ context.Context) (map[string]tfsdk.DataSourc
 		"teleport_cluster_maintenance_config": dataSourceTeleportClusterMaintenanceConfigType{},
 		"teleport_cluster_networking_config":  dataSourceTeleportClusterNetworkingConfigType{},
 		"teleport_database":                   dataSourceTeleportDatabaseType{},
+		"teleport_discovery_config":           dataSourceTeleportDiscoveryConfigType{},
 		"teleport_dynamic_windows_desktop":    dataSourceTeleportDynamicWindowsDesktopType{},
 		"teleport_github_connector":           dataSourceTeleportGithubConnectorType{},
 		"teleport_provision_token":            dataSourceTeleportProvisionTokenType{},
@@ -559,6 +584,7 @@ func (p *Provider) GetDataSources(_ context.Context) (map[string]tfsdk.DataSourc
 		"teleport_trusted_device":             dataSourceTeleportDeviceV1Type{},
 		"teleport_okta_import_rule":           dataSourceTeleportOktaImportRuleType{},
 		"teleport_access_list":                dataSourceTeleportAccessListType{},
+		"teleport_access_list_member":         dataSourceTeleportMemberType{},
 		"teleport_installer":                  dataSourceTeleportInstallerType{},
 		"teleport_access_monitoring_rule":     dataSourceTeleportAccessMonitoringRuleType{},
 		"teleport_static_host_user":           dataSourceTeleportStaticHostUserType{},
@@ -566,6 +592,7 @@ func (p *Provider) GetDataSources(_ context.Context) (map[string]tfsdk.DataSourc
 		"teleport_autoupdate_version":         dataSourceTeleportAutoUpdateVersionType{},
 		"teleport_autoupdate_config":          dataSourceTeleportAutoUpdateConfigType{},
 		"teleport_health_check_config":        dataSourceTeleportHealthCheckConfigType{},
+		"teleport_integration":                dataSourceTeleportIntegrationType{},
 	}, nil
 }
 
diff --git a/integrations/terraform/provider/resource_teleport_access_list.go b/integrations/terraform/provider/resource_teleport_access_list.go
index 340f1818cb0f5..3394454a255e0 100755
--- a/integrations/terraform/provider/resource_teleport_access_list.go
+++ b/integrations/terraform/provider/resource_teleport_access_list.go
@@ -109,6 +109,7 @@ func (r resourceTeleportAccessList) Create(ctx context.Context, req tfsdk.Create
 		return
 	}
 		var accessListI = accessListResource
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -116,12 +117,13 @@ func (r resourceTeleportAccessList) Create(ctx context.Context, req tfsdk.Create
 		accessListI, err = r.p.Client.AccessListClient().GetAccessList(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AccessList", trace.Wrap(bErr), "access_list"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AccessList", trace.Wrap(err), "access_list"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading AccessList (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "access_list")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_access_list_member.go b/integrations/terraform/provider/resource_teleport_access_list_member.go
new file mode 100755
index 0000000000000..019b815c2d3a5
--- /dev/null
+++ b/integrations/terraform/provider/resource_teleport_access_list_member.go
@@ -0,0 +1,355 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	accesslist "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	convert "github.com/gravitational/teleport/api/types/accesslist/convert/v1"
+	"github.com/gravitational/teleport/integrations/lib/backoff"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/jonboulle/clockwork"
+
+	schemav1 "github.com/gravitational/teleport/integrations/terraform/tfschema/accesslist/v1"
+)
+
+// resourceTeleportMemberType is the resource metadata type
+type resourceTeleportMemberType struct{}
+
+// resourceTeleportMember is the resource
+type resourceTeleportMember struct {
+	p Provider
+}
+
+// GetSchema returns the resource schema
+func (r resourceTeleportMemberType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return schemav1.GenSchemaMember(ctx)
+}
+
+// NewResource creates the empty resource
+func (r resourceTeleportMemberType) NewResource(_ context.Context, p tfsdk.Provider) (tfsdk.Resource, diag.Diagnostics) {
+	return resourceTeleportMember{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Create creates the Member
+func (r resourceTeleportMember) Create(ctx context.Context, req tfsdk.CreateResourceRequest, resp *tfsdk.CreateResourceResponse) {
+	var err error
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	accessListMember := &accesslist.Member{}
+	diags = schemav1.CopyMemberFromTerraform(ctx, plan, accessListMember)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	
+	accessListMemberResource, err := convert.FromMemberProto(accessListMember)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Errorf("Can not convert %T to Member: %s", accessListMemberResource, err), "access_list_member"))
+		return
+	}
+	err = accessListMemberResource.CheckAndSetDefaults()
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error setting Member defaults", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	idPrefix := accessListMemberResource.Spec.AccessList
+	id := accessListMemberResource.Metadata.Name
+
+	_, err = r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix, id)
+	if !trace.IsNotFound(err) {
+		if err == nil {
+			id := formatID(idPrefix, id)
+			existErr := fmt.Sprintf("Member exists in Teleport. Either remove it (tctl rm access_list_member/%v)"+
+				" or import it to the existing state (terraform import teleport_access_list_member.%v %v)", id, id, id)
+
+			resp.Diagnostics.Append(diagFromErr("Member exists in Teleport", trace.Errorf(existErr)))
+			return
+		}
+
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	_, err = r.p.Client.AccessListClient().UpsertStaticAccessListMember(ctx, accessListMemberResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error creating Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+		var accessListMemberI = accessListMemberResource
+	// Try getting the resource until it exists.
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		accessListMemberI, err = r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix, id)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading Member (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "access_list_member")
+				return
+			}
+			continue
+		}
+		break
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	accessListMemberResource = accessListMemberI
+	
+	accessListMember = convert.ToMemberProto(accessListMemberResource)
+	
+
+	diags = schemav1.CopyMemberToTerraform(ctx, accessListMember, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	plan.Attrs["id"] = types.String{Value: formatID(idPrefix, accessListMember.Header.Metadata.Name)}
+
+	diags = resp.State.Set(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Read reads teleport Member
+func (r resourceTeleportMember) Read(ctx context.Context, req tfsdk.ReadResourceRequest, resp *tfsdk.ReadResourceResponse) {
+	var state types.Object
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var idPrefix types.String
+	diags = req.State.GetAttribute(ctx, path.Root("spec").AtName("access_list"), &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var id types.String
+	diags = req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	accessListMemberI, err := r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix.Value, id.Value)
+	if trace.IsNotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+	accessListMember := convert.ToMemberProto(accessListMemberI)
+	diags = schemav1.CopyMemberToTerraform(ctx, accessListMember, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Update updates teleport Member
+func (r resourceTeleportMember) Update(ctx context.Context, req tfsdk.UpdateResourceRequest, resp *tfsdk.UpdateResourceResponse) {
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	accessListMember := &accesslist.Member{}
+	diags = schemav1.CopyMemberFromTerraform(ctx, plan, accessListMember)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	accessListMemberResource, err := convert.FromMemberProto(accessListMember)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Errorf("Can not convert %T to Member: %s", accessListMemberResource, err), "access_list_member"))
+		return
+	}
+
+	if err := accessListMemberResource.CheckAndSetDefaults(); err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating Member", err, "access_list_member"))
+		return
+	}
+	idPrefix := accessListMemberResource.Spec.AccessList
+	name := accessListMemberResource.Metadata.Name
+
+	accessListMemberBefore, err := r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix, name)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", err, "access_list_member"))
+		return
+	}
+
+	_, err = r.p.Client.AccessListClient().UpsertStaticAccessListMember(ctx, accessListMemberResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating Member", err, "access_list_member"))
+		return
+	}
+		var accessListMemberI = accessListMemberResource
+
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		accessListMemberI, err = r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix, name)
+		if err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", err, "access_list_member"))
+			return
+		}
+		if accessListMemberBefore.GetMetadata().Revision != accessListMemberI.GetMetadata().Revision || false {
+			break
+		}
+
+		if err := backoff.Do(ctx); err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+			return
+		}
+		if tries >= r.p.RetryConfig.MaxTries {
+			diagMessage := fmt.Sprintf("Error reading Member (tried %d times) - state outdated, please import resource", tries)
+			resp.Diagnostics.AddError(diagMessage, "access_list_member")
+			return
+		}
+	}
+
+	accessListMemberResource = accessListMemberI
+	
+	diags = schemav1.CopyMemberToTerraform(ctx, accessListMember, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Delete deletes Teleport Member
+func (r resourceTeleportMember) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
+	var idPrefix types.String
+	diags := req.State.GetAttribute(ctx, path.Root("spec").AtName("access_list"), &idPrefix)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var id types.String
+	diags = req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	err := r.p.Client.AccessListClient().DeleteStaticAccessListMember(ctx, idPrefix.Value, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	resp.State.RemoveResource(ctx)
+}
+
+// ImportState imports Member state
+func (r resourceTeleportMember) ImportState(ctx context.Context, req tfsdk.ImportResourceStateRequest, resp *tfsdk.ImportResourceStateResponse) {
+	idPrefix, name, err := parseID(req.ID)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error parsing Member ID", trace.Wrap(err), "access_list_member"))
+		return
+	}
+	accessListMember, err := r.p.Client.AccessListClient().GetStaticAccessListMember(ctx, idPrefix, name)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Member", trace.Wrap(err), "access_list_member"))
+		return
+	}
+
+	accessListMemberResource := convert.ToMemberProto(accessListMember)
+	
+
+	var state types.Object
+
+	diags := resp.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = schemav1.CopyMemberToTerraform(ctx, accessListMemberResource, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	id := req.ID
+
+	state.Attrs["id"] = types.String{Value: id}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/resource_teleport_access_monitoring_rule.go b/integrations/terraform/provider/resource_teleport_access_monitoring_rule.go
index 011cd58b37615..44c7306dd908d 100755
--- a/integrations/terraform/provider/resource_teleport_access_monitoring_rule.go
+++ b/integrations/terraform/provider/resource_teleport_access_monitoring_rule.go
@@ -103,6 +103,7 @@ func (r resourceTeleportAccessMonitoringRule) Create(ctx context.Context, req tf
 		return
 	}
 		var accessMonitoringRuleI *accessmonitoringrulesv1.AccessMonitoringRule
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -110,12 +111,13 @@ func (r resourceTeleportAccessMonitoringRule) Create(ctx context.Context, req tf
 		accessMonitoringRuleI, err = r.p.Client.AccessMonitoringRulesClient().GetAccessMonitoringRule(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AccessMonitoringRule", trace.Wrap(bErr), "access_monitoring_rule"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AccessMonitoringRule", trace.Wrap(err), "access_monitoring_rule"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading AccessMonitoringRule (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "access_monitoring_rule")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_app.go b/integrations/terraform/provider/resource_teleport_app.go
index 13ccba95012f9..adbfde525a05d 100755
--- a/integrations/terraform/provider/resource_teleport_app.go
+++ b/integrations/terraform/provider/resource_teleport_app.go
@@ -108,6 +108,7 @@ func (r resourceTeleportApp) Create(ctx context.Context, req tfsdk.CreateResourc
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var appI apitypes.Application
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportApp) Create(ctx context.Context, req tfsdk.CreateResourc
 		appI, err = r.p.Client.GetApp(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading App", trace.Wrap(bErr), "app"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading App", trace.Wrap(err), "app"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading App (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "app")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_auth_preference.go b/integrations/terraform/provider/resource_teleport_auth_preference.go
index a219050611251..363c8036e7583 100755
--- a/integrations/terraform/provider/resource_teleport_auth_preference.go
+++ b/integrations/terraform/provider/resource_teleport_auth_preference.go
@@ -94,11 +94,27 @@ func (r resourceTeleportAuthPreference) Create(ctx context.Context, req tfsdk.Cr
 
 	var authPreferenceI apitypes.AuthPreference
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		authPreferenceI, err = r.p.Client.GetAuthPreference(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AuthPreference", trace.Wrap(err), "cluster_auth_preference"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading AuthPreference (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "cluster_auth_preference")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading AuthPreference", trace.Wrap(err), "cluster_auth_preference"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_autoupdate_config.go b/integrations/terraform/provider/resource_teleport_autoupdate_config.go
index 695484bee0eed..ce0ba0e4b223a 100755
--- a/integrations/terraform/provider/resource_teleport_autoupdate_config.go
+++ b/integrations/terraform/provider/resource_teleport_autoupdate_config.go
@@ -99,11 +99,27 @@ func (r resourceTeleportAutoUpdateConfig) Create(ctx context.Context, req tfsdk.
 	var autoUpdateConfigI *autoupdatev1.AutoUpdateConfig
 	
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		autoUpdateConfigI, err = r.p.Client.GetAutoUpdateConfig(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AutoUpdateConfig", trace.Wrap(err), "autoupdate_config"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading AutoUpdateConfig (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "autoupdate_config")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading AutoUpdateConfig", trace.Wrap(err), "autoupdate_config"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_autoupdate_version.go b/integrations/terraform/provider/resource_teleport_autoupdate_version.go
index ff1b27cb1e75b..2a3216b99484c 100755
--- a/integrations/terraform/provider/resource_teleport_autoupdate_version.go
+++ b/integrations/terraform/provider/resource_teleport_autoupdate_version.go
@@ -99,11 +99,27 @@ func (r resourceTeleportAutoUpdateVersion) Create(ctx context.Context, req tfsdk
 	var autoUpdateVersionI *autoupdatev1.AutoUpdateVersion
 	
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		autoUpdateVersionI, err = r.p.Client.GetAutoUpdateVersion(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading AutoUpdateVersion", trace.Wrap(err), "autoupdate_version"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading AutoUpdateVersion (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "autoupdate_version")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading AutoUpdateVersion", trace.Wrap(err), "autoupdate_version"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_bot.go b/integrations/terraform/provider/resource_teleport_bot.go
index 80910de555fa7..068c4f45dfdb1 100644
--- a/integrations/terraform/provider/resource_teleport_bot.go
+++ b/integrations/terraform/provider/resource_teleport_bot.go
@@ -19,96 +19,210 @@ package provider
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
 	"github.com/hashicorp/terraform-plugin-framework/types"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	apitypes "github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/utils/slices"
 
 	"github.com/gravitational/teleport/integrations/terraform/tfschema"
 )
 
+// GenSchemaBot returns the schema of the `teleport_bot` resource.
+//
+// This is quite different to our other Terraform resources because it was hand-
+// written rather than generated from protobufs. As such, it originally did not
+// follow the RFD 153 conventions of having `metadata` and `spec` attributes,
+// but we added them later.
+//
+// In order to make migration as seamless as possible, and to avoid breaking the
+// user's existing configuration or introducing a new `teleport_bot_v2` resource,
+// this resource supports both the old (top-level) and new (spec.* and metadata.*)
+// attributes.
+//
+// See resourceTeleportBot.botFromProto for more information.
 func GenSchemaBot(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
 	return tfsdk.Schema{
 		Attributes: map[string]tfsdk.Attribute{
 			"id": {
-				Type:     types.StringType,
-				Computed: true,
+				Computed:      true,
+				PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.UseStateForUnknown()},
+				Type:          types.StringType,
 			},
+			"kind": {
+				Computed:      true,
+				Description:   "The kind of resource represented.",
+				Optional:      true,
+				PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.UseStateForUnknown()},
+				Type:          types.StringType,
+			},
+			"sub_kind": {
+				Computed:      true,
+				Description:   "Differentiates variations of the same kind. All resources should contain one, even if it is never populated.",
+				Optional:      true,
+				PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.UseStateForUnknown()},
+				Type:          types.StringType,
+			},
+			"version": {
+				Computed:      true,
+				Description:   "The version of the resource being represented.",
+				Optional:      true,
+				PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.UseStateForUnknown()},
+				Type:          types.StringType,
+				Validators:    []tfsdk.AttributeValidator{tfschema.UseVersionBetween(1, 1)},
+			},
+			"metadata": {
+				Attributes: tfsdk.SingleNestedAttributes(map[string]tfsdk.Attribute{
+					"description": {
+						Description: "Description is object description",
+						Optional:    true,
+						Type:        types.StringType,
+					},
+					"expires": {
+						Description: "Expires is a global expiry time header can be set on any resource in the system.",
+						Optional:    true,
+						Type:        tfschema.UseRFC3339Time(),
+						Validators:  []tfsdk.AttributeValidator{tfschema.MustTimeBeInFuture()},
+					},
+					"labels": {
+						Description: "Labels is a set of labels",
+						Optional:    true,
+						Type:        types.MapType{ElemType: types.StringType},
+						Validators:  []tfsdk.AttributeValidator{tfschema.UseMapKeysPresentValidator("teleport.dev/origin")},
+					},
+					"name": {
+						Description:   "Name is an object name",
+						PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.RequiresReplace()},
+						Required:      true,
+						Type:          types.StringType,
+					},
+					"namespace": {
+						Computed:      true,
+						Description:   "Namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
+						Optional:      true,
+						PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.UseStateForUnknown()},
+						Type:          types.StringType,
+					},
+					"revision": {
+						Description: "Revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
+						Optional:    true,
+						Type:        types.StringType,
+					},
+				}),
+				Description: "Requires provider v18.4.0 or newer. Common metadata that all resources share",
+				Optional:    true,
+				Validators: []tfsdk.AttributeValidator{
+					requiredUnlessLegacyValidator{},
+				},
+			},
+			"spec": {
+				Attributes: tfsdk.SingleNestedAttributes(map[string]tfsdk.Attribute{
+					"traits": tfschema.GenSchemaTraits(ctx, tfsdk.Attribute{
+						Description: "The traits that will be associated with the bot for the purposes of role templating.\n\nWhere multiple specified with the same name, these will be merged by the server.",
+					}),
+					"roles": {
+						Optional:    true,
+						Description: "A list of roles the created bot should be allowed to assume via role impersonation.",
+						Type:        types.ListType{ElemType: types.StringType},
+					},
+					"max_session_ttl": {
+						Optional:    true,
+						Computed:    true,
+						Description: "The max session TTL value for the bot's internal role. Unless specified, bots may not request a value beyond the default maximum TTL of 12 hours. This value may not be larger than 7 days (168 hours).",
+						Type:        tfschema.DurationType{},
+					},
+				}),
+				Description: "Requires provider v18.4.0 or newer. The configured properties of a bot.",
+				Optional:    true,
+				Validators: []tfsdk.AttributeValidator{
+					requiredUnlessLegacyValidator{},
+				},
+			},
+			"status": {
+				Attributes: tfsdk.SingleNestedAttributes(map[string]tfsdk.Attribute{
+					"user_name": {
+						Description: "The name of the user associated with the bot.",
+						Type:        types.StringType,
+						Computed:    true,
+					},
+					"role_name": {
+						Description: "The name of the role associated with the bot.",
+						Type:        types.StringType,
+						Computed:    true,
+					},
+				}),
+				Description: "Requires provider v18.4.0 or newer. Fields that are set by the server as results of operations. These should not be modified by users.",
+				Computed:    true,
+			},
+
+			// Deprecated fields.
 			"name": {
-				Type:        types.StringType,
-				Required:    true,
-				Description: "The name of the bot, i.e. the unprefixed User name",
-				PlanModifiers: []tfsdk.AttributePlanModifier{
-					tfsdk.RequiresReplace(),
+				Type:               types.StringType,
+				Optional:           true,
+				Description:        "The name of the bot, i.e. the unprefixed User name",
+				DeprecationMessage: "Deprecated in provider v18.4.0. Used `metadata.name` instead.",
+				Validators: []tfsdk.AttributeValidator{
+					rfd153OnlyValidator{},
 				},
+				PlanModifiers: []tfsdk.AttributePlanModifier{tfsdk.RequiresReplace()},
 			},
 			"user_name": {
-				Type:        types.StringType,
-				Computed:    true,
-				Description: "The name of the generated bot user",
+				Type:               types.StringType,
+				Computed:           true,
+				Description:        "The name of the generated bot user",
+				DeprecationMessage: "Deprecated in provider v18.4.0. Use `status.user_name` instead.",
 			},
 			"role_name": {
-				Type:        types.StringType,
-				Computed:    true,
-				Description: "The name of the generated bot role",
+				Type:               types.StringType,
+				Computed:           true,
+				Description:        "The name of the generated bot role",
+				DeprecationMessage: "Deprecated in provider v18.4.0. Use `status.role_name` instead.",
 			},
 			"token_ttl": {
-				Type:        types.StringType,
-				Optional:    true,
-				Computed:    true,
-				Description: "Deprecated. This field is not required anymore and has no effect.",
+				Type:               types.StringType,
+				Optional:           true,
+				Computed:           true,
+				DeprecationMessage: "Deprecated in provider v18.4.0. This field is not required anymore and has no effect.",
 			},
 			"token_id": {
 				Type: types.StringType,
 				// Implementation note: this is not used anymore, we can skip this
 				// This will go away eventually when we'll generate the bot provider instead
-				Optional:    true,
-				Sensitive:   true,
-				Description: "Deprecated. This field is not required anymore and has no effect.",
+				Optional:           true,
+				Sensitive:          true,
+				DeprecationMessage: "Deprecated in provider v18.4.0. This field is not required anymore and has no effect.",
 			},
 			"roles": {
 				Type: types.ListType{
 					ElemType: types.StringType,
 				},
-				Required:    true,
-				Description: "A list of roles the created bot should be allowed to assume via role impersonation.",
-
-				// TODO: Consider dropping RequiresReplace() in the future if a
-				// UpdateBotRoles() API becomes available that can modify the
-				// underlying bot user.
-				PlanModifiers: []tfsdk.AttributePlanModifier{
-					tfsdk.RequiresReplace(),
+				Optional:           true,
+				Description:        "A list of roles the created bot should be allowed to assume via role impersonation.",
+				DeprecationMessage: "Deprecated in provider v18.4.0. Use `spec.roles` instead.",
+				Validators: []tfsdk.AttributeValidator{
+					rfd153OnlyValidator{},
 				},
 			},
-			// Implementation note: This needs RequiresReplace() to handle
-			// updates properly but we aren't able to attach plan modifiers to
-			// fields from schema methods here. See ModifyPlan below.
-			"traits": tfschema.GenSchemaTraits(ctx, tfsdk.Attribute{}),
+			"traits": tfschema.GenSchemaTraits(ctx, tfsdk.Attribute{
+				DeprecationMessage: "Deprecated in provider v18.4.0. Use `spec.traits` instead.",
+				Validators: []tfsdk.AttributeValidator{
+					rfd153OnlyValidator{},
+				},
+			}),
 		},
 	}, nil
 }
 
-// Bot is a deserializes representation of the terraform state for this
-// resource.
-type Bot struct {
-	ID      types.String   `tfsdk:"id"`
-	Name    types.String   `tfsdk:"name"`
-	Roles   []types.String `tfsdk:"roles"`
-	TokenID types.String   `tfsdk:"token_id"`
-	Traits  types.Map      `tfsdk:"traits"`
-	TTL     types.String   `tfsdk:"token_ttl"`
-
-	UserName types.String `tfsdk:"user_name"`
-	RoleName types.String `tfsdk:"role_name"`
-}
-
 // resourceTeleportBotType is the resource metadata type
 type resourceTeleportBotType struct{}
 
@@ -143,117 +257,553 @@ func (r resourceTeleportBot) Create(ctx context.Context, req tfsdk.CreateResourc
 		return
 	}
 
-	var roles []string
-	for _, role := range plan.Roles {
-		roles = append(roles, role.Value)
+	response, err := r.p.Client.BotServiceClient().
+		CreateBot(ctx, &machineidv1.CreateBotRequest{Bot: plan.ToProto()})
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error creating Bot", trace.Wrap(err), "bot"))
+		return
 	}
 
-	traits := make([]*machineidv1.Trait, 0, len(plan.Traits.Elems))
-	for name, e := range plan.Traits.Elems {
-		l, ok := e.(types.List)
-		if !ok {
-			diags.AddError("Error reading from Terraform object", fmt.Sprintf("Can not convert %T to types.List", l))
-			return
+	diags = resp.State.Set(ctx, r.botFromProto(ctx, response, plan))
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+func (r resourceTeleportBot) Read(ctx context.Context, req tfsdk.ReadResourceRequest, resp *tfsdk.ReadResourceResponse) {
+	var state Bot
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	bot, err := r.p.Client.BotServiceClient().GetBot(ctx, &machineidv1.GetBotRequest{
+		BotName: state.GetName(),
+	})
+	switch {
+	case trace.IsNotFound(err):
+		resp.State.RemoveResource(ctx)
+		return
+	case err != nil:
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Bot", trace.Wrap(err), "bot"))
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, r.botFromProto(ctx, bot, state))...)
+}
+
+// botFromProto converts the server/protobuf representation of a bot to Terraform
+// using the given "base" (plan or state) to determine whether to fill the legacy
+// or new attributes.
+//
+// NOTE: Terraform is *very* fussy about non-computed attributes changing between
+// plan and apply, even in benign ways such as null becoming an empty list, so
+// exercise caution!
+func (r resourceTeleportBot) botFromProto(ctx context.Context, bot *machineidv1.Bot, base Bot) Bot {
+	schema, _ := GenSchemaBot(ctx)
+
+	attrTypes := func(key string) map[string]attr.Type {
+		result := make(map[string]attr.Type)
+		for k, v := range schema.Attributes[key].Attributes.GetAttributes() {
+			result[k] = v.Type
 		}
+		return result
+	}
 
-		values := make(utils.Strings, len(l.Elems))
+	stringValue := func(v string) types.String {
+		return types.String{Value: v, Null: v == ""}
+	}
 
-		for i, v := range l.Elems {
-			s, ok := v.(types.String)
-			if !ok {
-				diags.AddError("Error reading from Terraform object", fmt.Sprintf("Can not convert %T to types.String", s))
-				return
-			}
+	timeValue := func(v *timestamppb.Timestamp) tfschema.TimeValue {
+		if v == nil {
+			return tfschema.TimeValue{Null: true}
+		}
+		return tfschema.TimeValue{
+			Value:  v.AsTime(),
+			Format: time.RFC3339,
+		}
+	}
 
-			values[i] = s.Value
+	durationValue := func(v *durationpb.Duration) tfschema.DurationValue {
+		if v == nil {
+			return tfschema.DurationValue{Null: true}
 		}
-		traits = append(traits, &machineidv1.Trait{
-			Name:   name,
-			Values: values,
-		})
+		return tfschema.DurationValue{Value: v.AsDuration()}
 	}
 
-	// This is a temporary workaround to fix the provider compilation in v16 (the legacy RPC got removed).
-	// We must do a breaking change in v16 and rely on the new bot schema and the tf code generator.
-	response, err := r.p.Client.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{Bot: &machineidv1.Bot{
-		Kind:    apitypes.KindBot,
-		Version: apitypes.V1,
-		Metadata: &headerv1.Metadata{
-			Name: plan.Name.Value,
+	attrNull := func(obj types.Object, name string) bool {
+		if obj.IsNull() {
+			return true
+		}
+		if obj.Attrs == nil {
+			return true
+		}
+		attr, ok := obj.Attrs[name]
+		return !ok || attr.IsNull()
+	}
+
+	result := Bot{
+		// User-provided attributes. Will be marked as null based on whether the
+		// user provided legacy or RFD 153-style attributes.
+		Metadata: types.Object{AttrTypes: attrTypes("metadata")},
+		Spec:     types.Object{AttrTypes: attrTypes("spec")},
+
+		// Deprecated user-provided attributes.
+		Name: types.String{},
+
+		// Computed attributes.
+		ID:      stringValue(bot.GetMetadata().GetName()),
+		Kind:    stringValue(bot.GetKind()),
+		SubKind: stringValue(bot.GetSubKind()),
+		Version: stringValue(bot.GetVersion()),
+		Status: types.Object{
+			AttrTypes: attrTypes("status"),
+			Attrs: map[string]attr.Value{
+				"user_name": stringValue(bot.GetStatus().GetUserName()),
+				"role_name": stringValue(bot.GetStatus().GetRoleName()),
+			},
 		},
-		Spec: &machineidv1.BotSpec{
-			Roles:  roles,
-			Traits: traits,
+
+		// Deprecated computed attributes. We still set them for backward-compatibility.
+		UserName: stringValue(bot.GetStatus().GetUserName()),
+		RoleName: stringValue(bot.GetStatus().GetRoleName()),
+		TokenID:  base.TokenID,
+	}
+
+	if base.TTL.Unknown {
+		result.TTL = types.String{Null: true}
+	} else {
+		result.TTL = base.TTL
+	}
+
+	// If the plan or state includes the metadata or spec attribute, it means
+	// the user has "opted in" to the new RFD 153-style attributes. Otherwise,
+	// for backward-compatibility we'll populate the old fields.
+	rfd153Style := attrPresent(base.Metadata) || attrPresent(base.Spec)
+
+	if rfd153Style {
+		result.Name.Null = true
+
+		labels := types.Map{
+			Elems:    make(map[string]attr.Value),
+			ElemType: types.StringType,
+			Null:     len(bot.GetMetadata().GetLabels()) == 0 && attrNull(base.Metadata, "labels"),
+		}
+		for k, v := range bot.GetMetadata().GetLabels() {
+			labels.Elems[k] = types.String{Value: v}
+		}
+
+		result.Metadata.Attrs = map[string]attr.Value{
+			"description": stringValue(bot.GetMetadata().GetDescription()),
+			"expires":     timeValue(bot.GetMetadata().GetExpires()),
+			"name":        stringValue(bot.GetMetadata().GetName()),
+			"namespace":   stringValue(bot.GetMetadata().GetNamespace()),
+			"revision":    stringValue(bot.GetMetadata().GetRevision()),
+			"labels":      labels,
+		}
+	} else {
+		result.Metadata.Null = true
+		result.Name.Value = bot.GetMetadata().GetName()
+	}
+
+	// If the traits list is empty, check the plan or state for whether we
+	// should treat the attribute as null or an empty list.
+	traitsNull := (!rfd153Style && base.Traits.IsNull()) ||
+		(rfd153Style && attrNull(base.Spec, "traits"))
+
+	traits := types.Map{
+		Null:  len(bot.GetSpec().GetTraits()) == 0 && traitsNull,
+		Elems: map[string]attr.Value{},
+		ElemType: types.ListType{
+			ElemType: types.StringType,
 		},
-	}})
-	if err != nil {
-		resp.Diagnostics.Append(diagFromWrappedErr("Error creating Bot", trace.Wrap(err), "bot"))
-		return
+	}
+	for _, trait := range bot.GetSpec().GetTraits() {
+		traits.Elems[trait.GetName()] = types.List{
+			Elems: slices.Map(trait.GetValues(), func(s string) attr.Value {
+				return types.String{Value: s}
+			}),
+			ElemType: types.StringType,
+		}
+	}
+
+	if rfd153Style {
+		result.Spec.Attrs = map[string]attr.Value{
+			"traits": traits,
+			"roles": types.List{
+				Elems: slices.Map(bot.GetSpec().GetRoles(), func(s string) attr.Value {
+					return types.String{Value: s}
+				}),
+				ElemType: types.StringType,
+				Null:     len(bot.GetSpec().GetRoles()) == 0 && attrNull(base.Spec, "roles"),
+			},
+			"max_session_ttl": durationValue(bot.GetSpec().GetMaxSessionTtl()),
+		}
+
+		// Duration values can have different equivalent string representations
+		// that cause Terraform to believe state has drifted or changed between
+		// plan and apply (e.g. "5m" vs "5m0s").
+		//
+		// This is already handled by DurationValue.ToTerraformValue, but it
+		// relies on storing the raw string in an unexported struct member, so
+		// we restore the original value if it's equivalent to what the server
+		// returned.
+		if attrPresent(base.Spec) {
+			if prev, ok := base.Spec.Attrs["max_session_ttl"]; ok {
+				if dur, ok := prev.(tfschema.DurationValue); ok {
+					if dur.Value == bot.GetSpec().GetMaxSessionTtl().AsDuration() {
+						result.Spec.Attrs["max_session_ttl"] = prev
+					}
+				}
+			}
+		}
+
+		result.Traits = types.Map{
+			Null:     true,
+			ElemType: types.ListType{ElemType: types.StringType},
+		}
+	} else {
+		result.Spec.Null = true
+		result.Traits = traits
+
+		if len(bot.GetSpec().GetRoles()) != 0 || base.Roles != nil {
+			result.Roles = slices.Map(bot.GetSpec().GetRoles(), func(s string) types.String {
+				return types.String{Value: s}
+			})
+		}
 	}
 
-	plan.TTL = types.String{Value: ""}
-	plan.UserName = types.String{Value: response.Status.UserName}
-	plan.RoleName = types.String{Value: response.Status.RoleName}
+	return result
+}
 
-	// ID is for terraform-plugin-framework's acctests
-	plan.ID = types.String{Value: plan.Name.Value}
+func (r resourceTeleportBot) Update(ctx context.Context, req tfsdk.UpdateResourceRequest, resp *tfsdk.UpdateResourceResponse) {
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
 
-	diags = resp.State.Set(ctx, &plan)
+	var plan Bot
+	diags := req.Plan.Get(ctx, &plan)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
-}
 
-func (r resourceTeleportBot) Read(ctx context.Context, req tfsdk.ReadResourceRequest, resp *tfsdk.ReadResourceResponse) {
-	// Not much to do here: bots are currently immutable. We'll just check for
-	// deletion.
+	rsp, err := r.p.Client.BotServiceClient().
+		UpsertBot(ctx, &machineidv1.UpsertBotRequest{Bot: plan.ToProto()})
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating Bot", err, "bot"))
+		return
+	}
 
-	var plan Bot
-	diags := req.State.Get(ctx, &plan)
+	diags = resp.State.Set(ctx, r.botFromProto(ctx, rsp, plan))
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
+}
 
-	_, err := r.p.Client.GetUser(ctx, plan.UserName.Value, false)
-	if trace.IsNotFound(err) {
-		resp.State.RemoveResource(ctx)
+func (r resourceTeleportBot) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
+	var state Bot
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	_, err := r.p.Client.BotServiceClient().
+		DeleteBot(ctx, &machineidv1.DeleteBotRequest{BotName: state.GetName()})
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting Bot", trace.Wrap(err), "bot"))
 		return
 	}
 
+	resp.State.RemoveResource(ctx)
+}
+
+func (r resourceTeleportBot) ImportState(ctx context.Context, req tfsdk.ImportResourceStateRequest, rsp *tfsdk.ImportResourceStateResponse) {
+	bot, err := r.p.Client.BotServiceClient().
+		GetBot(ctx, &machineidv1.GetBotRequest{BotName: req.ID})
 	if err != nil {
-		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Bot", trace.Wrap(err), "bot"))
+		rsp.Diagnostics.Append(diagFromWrappedErr("Error reading Bot", trace.Wrap(err), "bot"))
+		return
+	}
+
+	diags := rsp.State.Set(ctx, r.botFromProto(ctx, bot, Bot{}))
+	rsp.Diagnostics.Append(diags...)
+	if rsp.Diagnostics.HasError() {
 		return
 	}
 }
 
-func (r resourceTeleportBot) Update(ctx context.Context, req tfsdk.UpdateResourceRequest, resp *tfsdk.UpdateResourceResponse) {
-	// Nothing to do here: bots are currently immutable. In the future we'd
-	// ideally want to add specific RPCs for desired mutable attributes, e.g.
-	// UpdateBotRoles(), UpdateBotToken(), etc.
+// rfd153OnlyValidator is used to ensure the user doesn't provide a mix of old
+// and new style attributes (e.g. `spec.roles` and `<root>.traits`).
+type rfd153OnlyValidator struct{}
+
+func (rfd153OnlyValidator) Description(context.Context) string {
+	return "Checks that deprecated attributes are not mixed and matched with their replacements"
 }
 
-func (r resourceTeleportBot) ModifyPlan(ctx context.Context, req tfsdk.ModifyResourcePlanRequest, resp *tfsdk.ModifyResourcePlanResponse) {
-	// Add .traits to RequiresReplace to ensure changes to this field trigger a
-	// replacement. We can't set it in the schema as the attribute is generated
-	// by a helper method.
-	resp.RequiresReplace = append(resp.RequiresReplace, path.Root("traits"))
+func (v rfd153OnlyValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
 }
 
-func (r resourceTeleportBot) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
-	var name types.String
-	diags := req.State.GetAttribute(ctx, path.Root("name"), &name)
-	resp.Diagnostics.Append(diags...)
-	if resp.Diagnostics.HasError() {
+func (v rfd153OnlyValidator) Validate(ctx context.Context, req tfsdk.ValidateAttributeRequest, rsp *tfsdk.ValidateAttributeResponse) {
+	if !attrPresent(req.AttributeConfig) {
 		return
 	}
 
-	_, err := r.p.Client.BotServiceClient().DeleteBot(ctx, &machineidv1.DeleteBotRequest{BotName: name.Value})
-	if err != nil {
-		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting Bot", trace.Wrap(err), "bot"))
+	var meta, spec types.Object
+	req.Config.GetAttribute(ctx, path.Root("metadata"), &meta)
+	req.Config.GetAttribute(ctx, path.Root("spec"), &spec)
+
+	if attrPresent(meta) || attrPresent(spec) {
+		rsp.Diagnostics.AddAttributeError(
+			req.AttributePath,
+			"Attribute Validation Error",
+			fmt.Sprintf("The deprecated `%s` attribute cannot be used in combination with `spec` or `metadata`.", req.AttributePath),
+		)
+	}
+}
+
+// requiredUnlessLegacyValidator makes the attribute required *unless* the user
+// provided a deprecated/legacy attribute instead (i.e. because they haven't yet
+// migrated their configuration).
+type requiredUnlessLegacyValidator struct{}
+
+func (requiredUnlessLegacyValidator) Description(context.Context) string {
+	return "Marks attributes required unless an equivalent legacy/deprecated attribute is provided"
+}
+
+func (v requiredUnlessLegacyValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+func (v requiredUnlessLegacyValidator) Validate(ctx context.Context, req tfsdk.ValidateAttributeRequest, rsp *tfsdk.ValidateAttributeResponse) {
+	if attrPresent(req.AttributeConfig) {
 		return
 	}
 
-	resp.State.RemoveResource(ctx)
+	var legacyConfig bool
+	for _, name := range []string{"name", "roles", "traits"} {
+		var attr attr.Value
+		req.Config.GetAttribute(ctx, path.Root(name), &attr)
+		if attrPresent(attr) {
+			legacyConfig = true
+			break
+		}
+	}
+
+	if !legacyConfig {
+		rsp.Diagnostics.AddAttributeError(
+			req.AttributePath,
+			"Missing required argument",
+			fmt.Sprintf("The argument `%s` is required, but not definition was found.", req.AttributePath),
+		)
+	}
+}
+
+var (
+	_ tfsdk.AttributeValidator = rfd153OnlyValidator{}
+	_ tfsdk.AttributeValidator = requiredUnlessLegacyValidator{}
+)
+
+// Bot is the Terraform (i.e. state or plan) representation of a bot.
+type Bot struct {
+	ID types.String `tfsdk:"id"`
+
+	Kind    types.String `tfsdk:"kind"`
+	SubKind types.String `tfsdk:"sub_kind"`
+	Version types.String `tfsdk:"version"`
+
+	Metadata types.Object `tfsdk:"metadata"`
+	Spec     types.Object `tfsdk:"spec"`
+	Status   types.Object `tfsdk:"status"`
+
+	// Deprecated fields
+	Name     types.String   `tfsdk:"name"`
+	Roles    []types.String `tfsdk:"roles"`
+	TokenID  types.String   `tfsdk:"token_id"`
+	Traits   types.Map      `tfsdk:"traits"`
+	TTL      types.String   `tfsdk:"token_ttl"`
+	UserName types.String   `tfsdk:"user_name"`
+	RoleName types.String   `tfsdk:"role_name"`
+}
+
+func (b Bot) ToProto() *machineidv1.Bot {
+	return &machineidv1.Bot{
+		Kind:     apitypes.KindBot,
+		Version:  apitypes.V1,
+		Metadata: b.GetMetadata(),
+		Spec:     b.GetSpec(),
+	}
+}
+
+func (b Bot) GetMetadata() *headerv1.Metadata {
+	return &headerv1.Metadata{
+		Name:        b.GetName(),
+		Description: b.GetDescription(),
+		Expires:     b.GetExpires(),
+		Namespace:   b.GetNamespace(),
+		Revision:    b.GetRevision(),
+		Labels:      b.GetLabels(),
+	}
+}
+
+func (b Bot) GetSpec() *machineidv1.BotSpec {
+	return &machineidv1.BotSpec{
+		Traits:        b.GetTraits(),
+		Roles:         b.GetRoles(),
+		MaxSessionTtl: b.GetMaxSessionTTL(),
+	}
+}
+
+func (b Bot) GetName() string {
+	if attrPresent(b.Name) {
+		return b.Name.Value
+	} else {
+		if nm, ok := b.Metadata.Attrs["name"]; ok {
+			if str, ok := nm.(types.String); ok {
+				return str.Value
+			}
+		}
+	}
+	return ""
+}
+
+func (b Bot) GetDescription() string {
+	if desc, ok := b.Metadata.Attrs["description"]; ok {
+		if str, ok := desc.(types.String); ok {
+			return str.Value
+		}
+	}
+	return ""
+}
+
+func (b Bot) GetExpires() *timestamppb.Timestamp {
+	if exp, ok := b.Metadata.Attrs["expires"]; ok {
+		if tv, ok := exp.(tfschema.TimeValue); ok {
+			return timestamppb.New(tv.Value)
+		}
+	}
+	return nil
+}
+
+func (b Bot) GetNamespace() string {
+	if ns, ok := b.Metadata.Attrs["namespace"]; ok {
+		if str, ok := ns.(types.String); ok {
+			return str.Value
+		}
+	}
+	return ""
+}
+
+func (b Bot) GetRevision() string {
+	if rev, ok := b.Metadata.Attrs["revision"]; ok {
+		if str, ok := rev.(types.String); ok {
+			return str.Value
+		}
+	}
+	return ""
+}
+
+func (b Bot) GetLabels() map[string]string {
+	if !attrPresent(b.Metadata) {
+		return nil
+	}
+
+	lbs, ok := b.Metadata.Attrs["labels"]
+	if !ok {
+		return nil
+	}
+
+	mp, ok := lbs.(types.Map)
+	if !ok {
+		return nil
+	}
+
+	labels := make(map[string]string, len(mp.Elems))
+	for key, val := range mp.Elems {
+		if str, ok := val.(types.String); ok {
+			labels[key] = str.Value
+		}
+	}
+	return labels
+}
+
+func (b Bot) GetTraits() []*machineidv1.Trait {
+	var traitMap map[string]attr.Value
+	if attrPresent(b.Spec) {
+		if ts, ok := b.Spec.Attrs["traits"]; ok && attrPresent(ts) {
+			if mp, ok := ts.(types.Map); ok {
+				traitMap = mp.Elems
+			}
+		}
+	} else if attrPresent(b.Traits) {
+		traitMap = b.Traits.Elems
+	}
+
+	if traitMap == nil {
+		return nil
+	}
+
+	traits := make([]*machineidv1.Trait, 0, len(traitMap))
+	for name, val := range traitMap {
+		list, ok := val.(types.List)
+		if !ok {
+			continue
+		}
+		values := slices.FilterMapUnique(list.Elems, func(v attr.Value) (string, bool) {
+			if str, ok := v.(types.String); ok {
+				return str.Value, true
+			}
+			return "", false
+		})
+		traits = append(traits, &machineidv1.Trait{
+			Name:   name,
+			Values: values,
+		})
+	}
+	return traits
+}
+
+func (b Bot) GetRoles() []string {
+	if attrPresent(b.Spec) {
+		if rs, ok := b.Spec.Attrs["roles"]; ok {
+			if list, ok := rs.(types.List); ok {
+				return slices.FilterMapUnique(list.Elems, func(v attr.Value) (string, bool) {
+					if str, ok := v.(types.String); ok {
+						return str.Value, true
+					}
+					return "", false
+				})
+			}
+		}
+		return nil
+	}
+
+	return slices.Map(b.Roles, func(v types.String) string {
+		return v.Value
+	})
+}
+
+func (b Bot) GetMaxSessionTTL() *durationpb.Duration {
+	if !attrPresent(b.Spec) {
+		return nil
+	}
+
+	ttl, ok := b.Spec.Attrs["max_session_ttl"]
+	if !ok {
+		return nil
+	}
+
+	dur, ok := ttl.(tfschema.DurationValue)
+	if !ok {
+		return nil
+	}
+
+	return durationpb.New(dur.Value)
+}
+
+func attrPresent(v attr.Value) bool {
+	return !v.IsNull() && !v.IsUnknown()
 }
diff --git a/integrations/terraform/provider/resource_teleport_cluster_maintenance_config.go b/integrations/terraform/provider/resource_teleport_cluster_maintenance_config.go
index e8780760a3805..9b796f4a8440e 100755
--- a/integrations/terraform/provider/resource_teleport_cluster_maintenance_config.go
+++ b/integrations/terraform/provider/resource_teleport_cluster_maintenance_config.go
@@ -100,11 +100,27 @@ func (r resourceTeleportClusterMaintenanceConfig) Create(ctx context.Context, re
 
 	var clusterMaintenanceConfigI apitypes.ClusterMaintenanceConfig
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		clusterMaintenanceConfigI, err = r.p.Client.GetClusterMaintenanceConfig(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading ClusterMaintenanceConfig", trace.Wrap(err), "cluster_maintenance_config"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading ClusterMaintenanceConfig (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "cluster_maintenance_config")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading ClusterMaintenanceConfig", trace.Wrap(err), "cluster_maintenance_config"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_cluster_networking_config.go b/integrations/terraform/provider/resource_teleport_cluster_networking_config.go
index 053789cd8501a..dc4ef793c931a 100755
--- a/integrations/terraform/provider/resource_teleport_cluster_networking_config.go
+++ b/integrations/terraform/provider/resource_teleport_cluster_networking_config.go
@@ -94,11 +94,27 @@ func (r resourceTeleportClusterNetworkingConfig) Create(ctx context.Context, req
 
 	var clusterNetworkingConfigI apitypes.ClusterNetworkingConfig
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		clusterNetworkingConfigI, err = r.p.Client.GetClusterNetworkingConfig(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading ClusterNetworkingConfig", trace.Wrap(err), "cluster_networking_config"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading ClusterNetworkingConfig (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "cluster_networking_config")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading ClusterNetworkingConfig", trace.Wrap(err), "cluster_networking_config"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_database.go b/integrations/terraform/provider/resource_teleport_database.go
index 91496c5221bef..ac3ec2787be9f 100755
--- a/integrations/terraform/provider/resource_teleport_database.go
+++ b/integrations/terraform/provider/resource_teleport_database.go
@@ -108,6 +108,7 @@ func (r resourceTeleportDatabase) Create(ctx context.Context, req tfsdk.CreateRe
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var databaseI apitypes.Database
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportDatabase) Create(ctx context.Context, req tfsdk.CreateRe
 		databaseI, err = r.p.Client.GetDatabase(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Database", trace.Wrap(bErr), "db"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Database", trace.Wrap(err), "db"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading Database (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "db")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_device_trust.go b/integrations/terraform/provider/resource_teleport_device_trust.go
index fd7e350159917..5d0261425f6cd 100755
--- a/integrations/terraform/provider/resource_teleport_device_trust.go
+++ b/integrations/terraform/provider/resource_teleport_device_trust.go
@@ -105,6 +105,7 @@ func (r resourceTeleportDeviceV1) Create(ctx context.Context, req tfsdk.CreateRe
 		return
 	}
 		var trustedDeviceI *apitypes.DeviceV1
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -112,12 +113,13 @@ func (r resourceTeleportDeviceV1) Create(ctx context.Context, req tfsdk.CreateRe
 		trustedDeviceI, err = r.p.Client.GetDeviceResource(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading DeviceV1", trace.Wrap(bErr), "device"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading DeviceV1", trace.Wrap(err), "device"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading DeviceV1 (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "device")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_discovery_config.go b/integrations/terraform/provider/resource_teleport_discovery_config.go
new file mode 100755
index 0000000000000..b9e03ef0c1027
--- /dev/null
+++ b/integrations/terraform/provider/resource_teleport_discovery_config.go
@@ -0,0 +1,327 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	apitypes "github.com/gravitational/teleport/api/types"
+
+	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	convert "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
+	"github.com/gravitational/teleport/integrations/lib/backoff"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/jonboulle/clockwork"
+
+	schemav1 "github.com/gravitational/teleport/integrations/terraform/tfschema/discoveryconfig/v1"
+)
+
+// resourceTeleportDiscoveryConfigType is the resource metadata type
+type resourceTeleportDiscoveryConfigType struct{}
+
+// resourceTeleportDiscoveryConfig is the resource
+type resourceTeleportDiscoveryConfig struct {
+	p Provider
+}
+
+// GetSchema returns the resource schema
+func (r resourceTeleportDiscoveryConfigType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return schemav1.GenSchemaDiscoveryConfig(ctx)
+}
+
+// NewResource creates the empty resource
+func (r resourceTeleportDiscoveryConfigType) NewResource(_ context.Context, p tfsdk.Provider) (tfsdk.Resource, diag.Diagnostics) {
+	return resourceTeleportDiscoveryConfig{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Create creates the DiscoveryConfig
+func (r resourceTeleportDiscoveryConfig) Create(ctx context.Context, req tfsdk.CreateResourceRequest, resp *tfsdk.CreateResourceResponse) {
+	var err error
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	discoveryConfig := &discoveryconfigv1.DiscoveryConfig{}
+	diags = schemav1.CopyDiscoveryConfigFromTerraform(ctx, plan, discoveryConfig)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	
+	discoveryConfigResource, err := convert.FromProto(discoveryConfig)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Errorf("Can not convert %T to DiscoveryConfig: %s", discoveryConfigResource, err), "discovery_config"))
+		return
+	}
+	discoveryConfigResource.Kind = apitypes.KindDiscoveryConfig
+
+	id := discoveryConfigResource.Metadata.Name
+
+	_, err = r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, id)
+	if !trace.IsNotFound(err) {
+		if err == nil {
+			existErr := fmt.Sprintf("DiscoveryConfig exists in Teleport. Either remove it (tctl rm discovery_config/%v)"+
+				" or import it to the existing state (terraform import teleport_discovery_config.%v %v)", id, id, id)
+
+			resp.Diagnostics.Append(diagFromErr("DiscoveryConfig exists in Teleport", trace.Errorf(existErr)))
+			return
+		}
+
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+
+	_, err = r.p.Client.DiscoveryConfigClient().CreateDiscoveryConfig(ctx, discoveryConfigResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error creating DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+		var discoveryConfigI = discoveryConfigResource
+	// Try getting the resource until it exists.
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		discoveryConfigI, err = r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, id)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading DiscoveryConfig (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "discovery_config")
+				return
+			}
+			continue
+		}
+		break
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+
+	discoveryConfigResource = discoveryConfigI
+	
+	discoveryConfig = convert.ToProto(discoveryConfigResource)
+	
+
+	diags = schemav1.CopyDiscoveryConfigToTerraform(ctx, discoveryConfig, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	plan.Attrs["id"] = types.String{Value: discoveryConfig.Header.Metadata.Name}
+
+	diags = resp.State.Set(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Read reads teleport DiscoveryConfig
+func (r resourceTeleportDiscoveryConfig) Read(ctx context.Context, req tfsdk.ReadResourceRequest, resp *tfsdk.ReadResourceResponse) {
+	var state types.Object
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var id types.String
+	diags = req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	discoveryConfigI, err := r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, id.Value)
+	if trace.IsNotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+	discoveryConfig := convert.ToProto(discoveryConfigI)
+	diags = schemav1.CopyDiscoveryConfigToTerraform(ctx, discoveryConfig, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Update updates teleport DiscoveryConfig
+func (r resourceTeleportDiscoveryConfig) Update(ctx context.Context, req tfsdk.UpdateResourceRequest, resp *tfsdk.UpdateResourceResponse) {
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	discoveryConfig := &discoveryconfigv1.DiscoveryConfig{}
+	diags = schemav1.CopyDiscoveryConfigFromTerraform(ctx, plan, discoveryConfig)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	discoveryConfigResource, err := convert.FromProto(discoveryConfig)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Errorf("Can not convert %T to DiscoveryConfig: %s", discoveryConfigResource, err), "discovery_config"))
+		return
+	}
+
+	
+	name := discoveryConfigResource.Metadata.Name
+
+	discoveryConfigBefore, err := r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, name)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", err, "discovery_config"))
+		return
+	}
+
+	_, err = r.p.Client.DiscoveryConfigClient().UpsertDiscoveryConfig(ctx, discoveryConfigResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating DiscoveryConfig", err, "discovery_config"))
+		return
+	}
+		var discoveryConfigI = discoveryConfigResource
+
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		discoveryConfigI, err = r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, name)
+		if err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", err, "discovery_config"))
+			return
+		}
+		if discoveryConfigBefore.GetMetadata().Revision != discoveryConfigI.GetMetadata().Revision || false {
+			break
+		}
+
+		if err := backoff.Do(ctx); err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+			return
+		}
+		if tries >= r.p.RetryConfig.MaxTries {
+			diagMessage := fmt.Sprintf("Error reading DiscoveryConfig (tried %d times) - state outdated, please import resource", tries)
+			resp.Diagnostics.AddError(diagMessage, "discovery_config")
+			return
+		}
+	}
+
+	discoveryConfigResource = discoveryConfigI
+	
+	diags = schemav1.CopyDiscoveryConfigToTerraform(ctx, discoveryConfig, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Delete deletes Teleport DiscoveryConfig
+func (r resourceTeleportDiscoveryConfig) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
+	var id types.String
+	diags := req.State.GetAttribute(ctx, path.Root("header").AtName("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	err := r.p.Client.DiscoveryConfigClient().DeleteDiscoveryConfig(ctx, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+
+	resp.State.RemoveResource(ctx)
+}
+
+// ImportState imports DiscoveryConfig state
+func (r resourceTeleportDiscoveryConfig) ImportState(ctx context.Context, req tfsdk.ImportResourceStateRequest, resp *tfsdk.ImportResourceStateResponse) {
+	discoveryConfig, err := r.p.Client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, req.ID)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading DiscoveryConfig", trace.Wrap(err), "discovery_config"))
+		return
+	}
+
+	discoveryConfigResource := convert.ToProto(discoveryConfig)
+	
+
+	var state types.Object
+
+	diags := resp.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = schemav1.CopyDiscoveryConfigToTerraform(ctx, discoveryConfigResource, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	id := discoveryConfig.Metadata.Name
+
+	state.Attrs["id"] = types.String{Value: id}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/resource_teleport_dynamic_windows_desktop.go b/integrations/terraform/provider/resource_teleport_dynamic_windows_desktop.go
index 9305bb538e716..e3facf4b00e15 100755
--- a/integrations/terraform/provider/resource_teleport_dynamic_windows_desktop.go
+++ b/integrations/terraform/provider/resource_teleport_dynamic_windows_desktop.go
@@ -108,6 +108,7 @@ func (r resourceTeleportDynamicWindowsDesktop) Create(ctx context.Context, req t
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var desktopI apitypes.DynamicWindowsDesktop
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportDynamicWindowsDesktop) Create(ctx context.Context, req t
 		desktopI, err = r.p.Client.DynamicDesktopClient().GetDynamicWindowsDesktop(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading DynamicWindowsDesktop", trace.Wrap(bErr), "dynamic_windows_desktop"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading DynamicWindowsDesktop", trace.Wrap(err), "dynamic_windows_desktop"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading DynamicWindowsDesktop (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "dynamic_windows_desktop")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_github_connector.go b/integrations/terraform/provider/resource_teleport_github_connector.go
index 74d91649735ab..ac8fe75cd5b30 100755
--- a/integrations/terraform/provider/resource_teleport_github_connector.go
+++ b/integrations/terraform/provider/resource_teleport_github_connector.go
@@ -108,6 +108,7 @@ func (r resourceTeleportGithubConnector) Create(ctx context.Context, req tfsdk.C
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var githubConnectorI apitypes.GithubConnector
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportGithubConnector) Create(ctx context.Context, req tfsdk.C
 		githubConnectorI, err = r.p.Client.GetGithubConnector(ctx, id, true)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading GithubConnector", trace.Wrap(bErr), "github"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading GithubConnector", trace.Wrap(err), "github"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading GithubConnector (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "github")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_health_check_config.go b/integrations/terraform/provider/resource_teleport_health_check_config.go
index ccbf137dfb893..a8ab7c7ae2e5a 100755
--- a/integrations/terraform/provider/resource_teleport_health_check_config.go
+++ b/integrations/terraform/provider/resource_teleport_health_check_config.go
@@ -103,6 +103,7 @@ func (r resourceTeleportHealthCheckConfig) Create(ctx context.Context, req tfsdk
 		return
 	}
 		var healthCheckConfigI *healthcheckconfigv1.HealthCheckConfig
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -110,12 +111,13 @@ func (r resourceTeleportHealthCheckConfig) Create(ctx context.Context, req tfsdk
 		healthCheckConfigI, err = r.p.Client.GetHealthCheckConfig(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading HealthCheckConfig", trace.Wrap(bErr), "health_check_config"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading HealthCheckConfig", trace.Wrap(err), "health_check_config"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading HealthCheckConfig (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "health_check_config")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_installer.go b/integrations/terraform/provider/resource_teleport_installer.go
index 9582e64e4a9c9..eb7631eabdd26 100755
--- a/integrations/terraform/provider/resource_teleport_installer.go
+++ b/integrations/terraform/provider/resource_teleport_installer.go
@@ -108,6 +108,7 @@ func (r resourceTeleportInstaller) Create(ctx context.Context, req tfsdk.CreateR
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var installerI apitypes.Installer
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportInstaller) Create(ctx context.Context, req tfsdk.CreateR
 		installerI, err = r.p.Client.GetInstaller(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Installer", trace.Wrap(bErr), "installer"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Installer", trace.Wrap(err), "installer"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading Installer (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "installer")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_integration.go b/integrations/terraform/provider/resource_teleport_integration.go
new file mode 100755
index 0000000000000..8b98c759811f5
--- /dev/null
+++ b/integrations/terraform/provider/resource_teleport_integration.go
@@ -0,0 +1,337 @@
+// Code generated by _gen/main.go DO NOT EDIT
+/*
+Copyright 2015-2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	apitypes "github.com/gravitational/teleport/api/types"
+	
+	"github.com/gravitational/teleport/integrations/lib/backoff"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/integrations/terraform/tfschema"
+)
+
+// resourceTeleportIntegrationType is the resource metadata type
+type resourceTeleportIntegrationType struct{}
+
+// resourceTeleportIntegration is the resource
+type resourceTeleportIntegration struct {
+	p Provider
+}
+
+// GetSchema returns the resource schema
+func (r resourceTeleportIntegrationType) GetSchema(ctx context.Context) (tfsdk.Schema, diag.Diagnostics) {
+	return tfschema.GenSchemaIntegrationV1(ctx)
+}
+
+// NewResource creates the empty resource
+func (r resourceTeleportIntegrationType) NewResource(_ context.Context, p tfsdk.Provider) (tfsdk.Resource, diag.Diagnostics) {
+	return resourceTeleportIntegration{
+		p: *(p.(*Provider)),
+	}, nil
+}
+
+// Create creates the Integration
+func (r resourceTeleportIntegration) Create(ctx context.Context, req tfsdk.CreateResourceRequest, resp *tfsdk.CreateResourceResponse) {
+	var err error
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	integration := &apitypes.IntegrationV1{}
+	diags = tfschema.CopyIntegrationV1FromTerraform(ctx, plan, integration)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	
+	integrationResource := integration
+
+	err = integrationResource.CheckAndSetDefaults()
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error setting Integration defaults", trace.Wrap(err), "integration"))
+		return
+	}
+
+	id := integrationResource.Metadata.Name
+
+	_, err = r.p.Client.GetIntegration(ctx, id)
+	if !trace.IsNotFound(err) {
+		if err == nil {
+			existErr := fmt.Sprintf("Integration exists in Teleport. Either remove it (tctl rm integration/%v)"+
+				" or import it to the existing state (terraform import teleport_integration.%v %v)", id, id, id)
+
+			resp.Diagnostics.Append(diagFromErr("Integration exists in Teleport", trace.Errorf(existErr)))
+			return
+		}
+
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+		return
+	}
+
+	_, err = r.p.Client.CreateIntegration(ctx, integrationResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error creating Integration", trace.Wrap(err), "integration"))
+		return
+	}
+		
+	// Not really an inferface, just using the same name for easier templating.
+	var integrationI apitypes.Integration
+	// Try getting the resource until it exists.
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		integrationI, err = r.p.Client.GetIntegration(ctx, id)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading Integration (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "integration")
+				return
+			}
+			continue
+		}
+		break
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+		return
+	}
+
+	integrationResource, ok := integrationI.(*apitypes.IntegrationV1)
+	if !ok {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Errorf("Can not convert %T to IntegrationV1", integrationI), "integration"))
+		return
+	}
+	integration = integrationResource
+
+	diags = tfschema.CopyIntegrationV1ToTerraform(ctx, integration, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	plan.Attrs["id"] = types.String{Value: integration.Metadata.Name}
+
+	diags = resp.State.Set(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Read reads teleport Integration
+func (r resourceTeleportIntegration) Read(ctx context.Context, req tfsdk.ReadResourceRequest, resp *tfsdk.ReadResourceResponse) {
+	var state types.Object
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var id types.String
+	diags = req.State.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	integrationI, err := r.p.Client.GetIntegration(ctx, id.Value)
+	if trace.IsNotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+		return
+	}
+	
+	integration := integrationI.(*apitypes.IntegrationV1)
+	diags = tfschema.CopyIntegrationV1ToTerraform(ctx, integration, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Update updates teleport Integration
+func (r resourceTeleportIntegration) Update(ctx context.Context, req tfsdk.UpdateResourceRequest, resp *tfsdk.UpdateResourceResponse) {
+	if !r.p.IsConfigured(resp.Diagnostics) {
+		return
+	}
+
+	var plan types.Object
+	diags := req.Plan.Get(ctx, &plan)
+
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	integration := &apitypes.IntegrationV1{}
+	diags = tfschema.CopyIntegrationV1FromTerraform(ctx, plan, integration)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	integrationResource := integration
+
+
+	if err := integrationResource.CheckAndSetDefaults(); err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating Integration", err, "integration"))
+		return
+	}
+	name := integrationResource.Metadata.Name
+
+	integrationBefore, err := r.p.Client.GetIntegration(ctx, name)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", err, "integration"))
+		return
+	}
+
+	_, err = r.p.Client.UpdateIntegration(ctx, integrationResource)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error updating Integration", err, "integration"))
+		return
+	}
+		
+	// Not really an inferface, just using the same name for easier templating.
+	var integrationI apitypes.Integration
+
+	tries := 0
+	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
+	for {
+		tries = tries + 1
+		integrationI, err = r.p.Client.GetIntegration(ctx, name)
+		if err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", err, "integration"))
+			return
+		}
+		if integrationBefore.GetMetadata().Revision != integrationI.GetMetadata().Revision || false {
+			break
+		}
+
+		if err := backoff.Do(ctx); err != nil {
+			resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+			return
+		}
+		if tries >= r.p.RetryConfig.MaxTries {
+			diagMessage := fmt.Sprintf("Error reading Integration (tried %d times) - state outdated, please import resource", tries)
+			resp.Diagnostics.AddError(diagMessage, "integration")
+			return
+		}
+	}
+
+	integrationResource, ok := integrationI.(*apitypes.IntegrationV1)
+	if !ok {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Errorf("Can not convert %T to IntegrationV1", integrationI), "integration"))
+		return
+	}
+	diags = tfschema.CopyIntegrationV1ToTerraform(ctx, integration, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
+
+// Delete deletes Teleport Integration
+func (r resourceTeleportIntegration) Delete(ctx context.Context, req tfsdk.DeleteResourceRequest, resp *tfsdk.DeleteResourceResponse) {
+	var id types.String
+	diags := req.State.GetAttribute(ctx, path.Root("metadata").AtName("name"), &id)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	err := r.p.Client.DeleteIntegration(ctx, id.Value)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error deleting IntegrationV1", trace.Wrap(err), "integration"))
+		return
+	}
+
+	resp.State.RemoveResource(ctx)
+}
+
+// ImportState imports Integration state
+func (r resourceTeleportIntegration) ImportState(ctx context.Context, req tfsdk.ImportResourceStateRequest, resp *tfsdk.ImportResourceStateResponse) {
+	integration, err := r.p.Client.GetIntegration(ctx, req.ID)
+	if err != nil {
+		resp.Diagnostics.Append(diagFromWrappedErr("Error reading Integration", trace.Wrap(err), "integration"))
+		return
+	}
+
+	
+	integrationResource := integration.(*apitypes.IntegrationV1)
+
+	var state types.Object
+
+	diags := resp.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = tfschema.CopyIntegrationV1ToTerraform(ctx, integrationResource, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	id := integrationResource.GetName()
+
+	state.Attrs["id"] = types.String{Value: id}
+
+	diags = resp.State.Set(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+}
diff --git a/integrations/terraform/provider/resource_teleport_login_rule.go b/integrations/terraform/provider/resource_teleport_login_rule.go
index 8e329896d9961..1f460a8d8d990 100755
--- a/integrations/terraform/provider/resource_teleport_login_rule.go
+++ b/integrations/terraform/provider/resource_teleport_login_rule.go
@@ -101,6 +101,7 @@ func (r resourceTeleportLoginRule) Create(ctx context.Context, req tfsdk.CreateR
 		return
 	}
 		var loginRuleI *loginrulev1.LoginRule
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -108,12 +109,13 @@ func (r resourceTeleportLoginRule) Create(ctx context.Context, req tfsdk.CreateR
 		loginRuleI, err = r.p.Client.GetLoginRule(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading LoginRule", trace.Wrap(bErr), "login_rule"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading LoginRule", trace.Wrap(err), "login_rule"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading LoginRule (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "login_rule")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_oidc_connector.go b/integrations/terraform/provider/resource_teleport_oidc_connector.go
index bd99743d97067..d825ed280a192 100755
--- a/integrations/terraform/provider/resource_teleport_oidc_connector.go
+++ b/integrations/terraform/provider/resource_teleport_oidc_connector.go
@@ -108,6 +108,7 @@ func (r resourceTeleportOIDCConnector) Create(ctx context.Context, req tfsdk.Cre
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var oidcConnectorI apitypes.OIDCConnector
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportOIDCConnector) Create(ctx context.Context, req tfsdk.Cre
 		oidcConnectorI, err = r.p.Client.GetOIDCConnector(ctx, id, true)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading OIDCConnector", trace.Wrap(bErr), "oidc"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading OIDCConnector", trace.Wrap(err), "oidc"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading OIDCConnector (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "oidc")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_okta_import_rule.go b/integrations/terraform/provider/resource_teleport_okta_import_rule.go
index 3e13f4bc8e06c..d7e45ac8ae2dc 100755
--- a/integrations/terraform/provider/resource_teleport_okta_import_rule.go
+++ b/integrations/terraform/provider/resource_teleport_okta_import_rule.go
@@ -108,6 +108,7 @@ func (r resourceTeleportOktaImportRule) Create(ctx context.Context, req tfsdk.Cr
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var oktaImportRuleI apitypes.OktaImportRule
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportOktaImportRule) Create(ctx context.Context, req tfsdk.Cr
 		oktaImportRuleI, err = r.p.Client.OktaClient().GetOktaImportRule(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading OktaImportRule", trace.Wrap(bErr), "okta_import_rule"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading OktaImportRule", trace.Wrap(err), "okta_import_rule"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading OktaImportRule (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "okta_import_rule")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_provision_token.go b/integrations/terraform/provider/resource_teleport_provision_token.go
index cc94f1e704186..135532d055c8c 100755
--- a/integrations/terraform/provider/resource_teleport_provision_token.go
+++ b/integrations/terraform/provider/resource_teleport_provision_token.go
@@ -119,6 +119,7 @@ func (r resourceTeleportProvisionToken) Create(ctx context.Context, req tfsdk.Cr
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var provisionTokenI apitypes.ProvisionToken
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -126,12 +127,13 @@ func (r resourceTeleportProvisionToken) Create(ctx context.Context, req tfsdk.Cr
 		provisionTokenI, err = r.p.Client.GetToken(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading ProvisionToken", trace.Wrap(bErr), "token"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading ProvisionToken", trace.Wrap(err), "token"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading ProvisionToken (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "token")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_role.go b/integrations/terraform/provider/resource_teleport_role.go
index 11e81415ce0d3..9824a28171932 100755
--- a/integrations/terraform/provider/resource_teleport_role.go
+++ b/integrations/terraform/provider/resource_teleport_role.go
@@ -108,6 +108,7 @@ func (r resourceTeleportRole) Create(ctx context.Context, req tfsdk.CreateResour
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var roleI apitypes.Role
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportRole) Create(ctx context.Context, req tfsdk.CreateResour
 		roleI, err = r.p.Client.GetRole(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Role", trace.Wrap(bErr), "role"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Role", trace.Wrap(err), "role"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading Role (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "role")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_saml_connector.go b/integrations/terraform/provider/resource_teleport_saml_connector.go
index ee4eaf4a71b98..905981378bd01 100755
--- a/integrations/terraform/provider/resource_teleport_saml_connector.go
+++ b/integrations/terraform/provider/resource_teleport_saml_connector.go
@@ -108,6 +108,7 @@ func (r resourceTeleportSAMLConnector) Create(ctx context.Context, req tfsdk.Cre
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var samlConnectorI apitypes.SAMLConnector
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportSAMLConnector) Create(ctx context.Context, req tfsdk.Cre
 		samlConnectorI, err = r.p.Client.GetSAMLConnector(ctx, id, true)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading SAMLConnector", trace.Wrap(bErr), "saml"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading SAMLConnector", trace.Wrap(err), "saml"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading SAMLConnector (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "saml")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_server.go b/integrations/terraform/provider/resource_teleport_server.go
index d19a4ab661064..a531bcb267a75 100755
--- a/integrations/terraform/provider/resource_teleport_server.go
+++ b/integrations/terraform/provider/resource_teleport_server.go
@@ -110,6 +110,7 @@ func (r resourceTeleportServer) Create(ctx context.Context, req tfsdk.CreateReso
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var serverI apitypes.Server
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -117,12 +118,13 @@ func (r resourceTeleportServer) Create(ctx context.Context, req tfsdk.CreateReso
 		serverI, err = r.p.Client.GetNode(ctx, defaults.Namespace, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Server", trace.Wrap(bErr), "node"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading Server", trace.Wrap(err), "node"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading Server (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "node")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_session_recording_config.go b/integrations/terraform/provider/resource_teleport_session_recording_config.go
index c1f7c1e5368ee..05262f0891ad7 100755
--- a/integrations/terraform/provider/resource_teleport_session_recording_config.go
+++ b/integrations/terraform/provider/resource_teleport_session_recording_config.go
@@ -94,11 +94,27 @@ func (r resourceTeleportSessionRecordingConfig) Create(ctx context.Context, req
 
 	var sessionRecordingConfigI apitypes.SessionRecordingConfig
 
+	// Try getting the resource until it exists and is different than the previous ones.
+	// There are two types of singleton resources:
+	// - the ones who can deleted and return a trace.NotFoundErr
+	// - the ones who cannot be deleted, only reset. In this case, the resource revision is used to know if the change got applied.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
 		tries = tries + 1
 		sessionRecordingConfigI, err = r.p.Client.GetSessionRecordingConfig(ctx)
+		if trace.IsNotFound(err) {
+			if bErr := backoff.Do(ctx); bErr != nil {
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading SessionRecordingConfig", trace.Wrap(err), "session_recording_config"))
+				return
+			}
+			if tries >= r.p.RetryConfig.MaxTries {
+				diagMessage := fmt.Sprintf("Error reading SessionRecordingConfig (tried %d times) - state outdated, please import resource", tries)
+				resp.Diagnostics.AddError(diagMessage, "session_recording_config")
+				return
+			}
+			continue
+		}
 		if err != nil {
 			resp.Diagnostics.Append(diagFromWrappedErr("Error reading SessionRecordingConfig", trace.Wrap(err), "session_recording_config"))
 			return
diff --git a/integrations/terraform/provider/resource_teleport_static_host_user.go b/integrations/terraform/provider/resource_teleport_static_host_user.go
index 61acd2e81fb26..ba4f0c4a12b17 100755
--- a/integrations/terraform/provider/resource_teleport_static_host_user.go
+++ b/integrations/terraform/provider/resource_teleport_static_host_user.go
@@ -103,6 +103,7 @@ func (r resourceTeleportStaticHostUser) Create(ctx context.Context, req tfsdk.Cr
 		return
 	}
 		var staticHostUserI *userprovisioningv2.StaticHostUser
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -110,12 +111,13 @@ func (r resourceTeleportStaticHostUser) Create(ctx context.Context, req tfsdk.Cr
 		staticHostUserI, err = r.p.Client.StaticHostUserClient().GetStaticHostUser(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading StaticHostUser", trace.Wrap(bErr), "static_host_user"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading StaticHostUser", trace.Wrap(err), "static_host_user"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading StaticHostUser (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "static_host_user")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_trusted_cluster.go b/integrations/terraform/provider/resource_teleport_trusted_cluster.go
index c1398989468f9..fe536ce2426c9 100755
--- a/integrations/terraform/provider/resource_teleport_trusted_cluster.go
+++ b/integrations/terraform/provider/resource_teleport_trusted_cluster.go
@@ -108,6 +108,7 @@ func (r resourceTeleportTrustedCluster) Create(ctx context.Context, req tfsdk.Cr
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var trustedClusterI apitypes.TrustedCluster
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportTrustedCluster) Create(ctx context.Context, req tfsdk.Cr
 		trustedClusterI, err = r.p.Client.GetTrustedCluster(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading TrustedCluster", trace.Wrap(bErr), "trusted_cluster"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading TrustedCluster", trace.Wrap(err), "trusted_cluster"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading TrustedCluster (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "trusted_cluster")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_user.go b/integrations/terraform/provider/resource_teleport_user.go
index 0064798bc07cf..7bca3c57d1bf5 100755
--- a/integrations/terraform/provider/resource_teleport_user.go
+++ b/integrations/terraform/provider/resource_teleport_user.go
@@ -108,6 +108,7 @@ func (r resourceTeleportUser) Create(ctx context.Context, req tfsdk.CreateResour
 		
 	// Not really an inferface, just using the same name for easier templating.
 	var userI apitypes.User
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -115,12 +116,13 @@ func (r resourceTeleportUser) Create(ctx context.Context, req tfsdk.CreateResour
 		userI, err = r.p.Client.GetUser(ctx, id, false)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading User", trace.Wrap(bErr), "user"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading User", trace.Wrap(err), "user"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading User (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "user")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/provider/resource_teleport_workload_identity.go b/integrations/terraform/provider/resource_teleport_workload_identity.go
index e5c59e0993b44..9120fb6edf36f 100755
--- a/integrations/terraform/provider/resource_teleport_workload_identity.go
+++ b/integrations/terraform/provider/resource_teleport_workload_identity.go
@@ -102,6 +102,7 @@ func (r resourceTeleportWorkloadIdentity) Create(ctx context.Context, req tfsdk.
 		return
 	}
 		var workloadIdentityI *workloadidentityv1.WorkloadIdentity
+	// Try getting the resource until it exists.
 	tries := 0
 	backoff := backoff.NewDecorr(r.p.RetryConfig.Base, r.p.RetryConfig.Cap, clockwork.NewRealClock())
 	for {
@@ -109,12 +110,13 @@ func (r resourceTeleportWorkloadIdentity) Create(ctx context.Context, req tfsdk.
 		workloadIdentityI, err = r.p.Client.GetWorkloadIdentity(ctx, id)
 		if trace.IsNotFound(err) {
 			if bErr := backoff.Do(ctx); bErr != nil {
-				resp.Diagnostics.Append(diagFromWrappedErr("Error reading WorkloadIdentity", trace.Wrap(bErr), "workload_identity"))
+				resp.Diagnostics.Append(diagFromWrappedErr("Error reading WorkloadIdentity", trace.Wrap(err), "workload_identity"))
 				return
 			}
 			if tries >= r.p.RetryConfig.MaxTries {
 				diagMessage := fmt.Sprintf("Error reading WorkloadIdentity (tried %d times) - state outdated, please import resource", tries)
 				resp.Diagnostics.AddError(diagMessage, "workload_identity")
+				return
 			}
 			continue
 		}
diff --git a/integrations/terraform/reference.mdx b/integrations/terraform/reference.mdx
index 09a5182721424..e75f3c7bacb4c 100755
--- a/integrations/terraform/reference.mdx
+++ b/integrations/terraform/reference.mdx
@@ -1,6 +1,9 @@
 ---
 title: Terraform provider resources
 description: Terraform provider resources reference
+labels:
+ - reference
+ - platform-wide
 ---
 
 {/* Content generated by teleport-plugins/terraform/gen/main.go DO NOT EDIT */}
@@ -108,6 +111,7 @@ To mitigate this, you should explicitly set the resource version.
   - v12 default role version is `v5`
   - v13 default role version is `v6`
   - v14 default role version is `v7`
+  - v18+ default role version is `v8`
 
   For example, before upgrading from v12 to v13, edit every unversioned role
   to pin the `v5` version:
@@ -1646,7 +1650,7 @@ resource "teleport_provision_token" "iam-token" {
 | metadata | object |          | Metadata is resource metadata                                                                              |
 | spec     | object |          | Spec is a role specification                                                                               |
 | sub_kind | string |          | SubKind is an optional resource sub kind, used in some resources                                           |
-| version  | string | *        | Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`. |
+| version  | string | *        | Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`. |
 
 ### metadata
 
diff --git a/integrations/terraform/templates/data-sources.md.tmpl b/integrations/terraform/templates/data-sources.md.tmpl
index 63df70314b65a..665e4d39394ed 100644
--- a/integrations/terraform/templates/data-sources.md.tmpl
+++ b/integrations/terraform/templates/data-sources.md.tmpl
@@ -7,6 +7,9 @@ description: This page describes the supported values of the {{.Name}} data-sour
 {{ "{/*Auto-generated file. Do not edit.*/}" }}
 {{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
 
+This page describes the supported values of the `{{.Name}}` data source of the
+Teleport Terraform provider.
+
 {{ .Description | trimspace }}
 
 {{ if .HasExample -}}
diff --git a/integrations/terraform/templates/index.md.tmpl b/integrations/terraform/templates/index.md.tmpl
index d0159b587c9f4..e76ee5b4b8a91 100644
--- a/integrations/terraform/templates/index.md.tmpl
+++ b/integrations/terraform/templates/index.md.tmpl
@@ -1,6 +1,11 @@
 ---
-title: "Teleport Terraform Provider"
+title: "Teleport Terraform Provider Reference"
+sidebar_label: Terraform Provider
 description: Reference documentation of the Teleport Terraform provider.
+tags:
+ - infrastructure-as-code
+ - reference
+ - platform-wide
 ---
 
 {{ "{/*Auto-generated file. Do not edit.*/}" }}
@@ -14,10 +19,9 @@ It lists all the supported resources and their fields.
 
 <Admonition type="tip">
 To get started with the Terraform provider, you must start with [the installation
-guide](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
+guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx).
 Once you got a working provider, we recommend you to follow the
-["Managing users and roles with IaC"](
-../../admin-guides/infrastructure-as-code/managing-resources/user-and-role.mdx) guide.
+["Managing users and roles with IaC"](../../../zero-trust-access/infrastructure-as-code/managing-resources/user-and-role.mdx) guide.
 </Admonition>
 
 The provider exposes Teleport resources both as Terraform data-sources and Terraform resources.
@@ -81,7 +85,7 @@ provider "teleport" {
 This section lists the different ways of passing credentials to the Terraform provider.
 You can find which method fits your use case in
 the [Teleport Terraform provider setup
-page](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
+page](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
 
 ### With an identity file
 
@@ -108,16 +112,16 @@ Detected security key tap
 ```
 
 You can find more information in
-the ["Run the Terraform provider locally" guide](../../admin-guides/infrastructure-as-code/terraform-provider/local.mdx)
+the ["Run the Terraform provider locally" guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/local.mdx)
 
 #### Obtaining an identity file via `tbot`
 
-`tbot` relies on [MachineID](../../enroll-resources/machine-id/introduction.mdx) to obtain and automatically renew
+`tbot` relies on [Machine & Workload Identity](../../../machine-workload-identity/machine-workload-identity.mdx) to obtain and automatically renew
 short-lived credentials. Such credentials are harder to exfiltrate, and you can control more precisely who has access to
 which roles (e.g. you can allow only GitHub Actions pipelines targeting the `prod` environment to get certificates).
 
 You can follow [the Terraform Provider
-guide](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-provider.mdx) to setup `tbot`
+guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/terraform-provider.mdx) to setup `tbot`
 and have Terraform use its identity.
 
 #### Obtaining an identity file via `tctl auth sign`
@@ -132,19 +136,20 @@ This auth method has the following limitations:
 - Such credentials are high-privileged and long-lived. They must be protected and rotated.
 - This auth method does not work against Teleport clusters with MFA set to `webauthn`.
   On such clusters, Teleport will reject any long-lived certificate and require
-  [an additional MFA challenge for administrative actions](../../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx).
+  [an additional MFA challenge for administrative
+  actions](../../../zero-trust-access/authentication/mfa-for-admin-actions.mdx).
 
-### With a token (native MachineID)
+### With a token (native Machine & Workload Identity)
 
-Starting with 16.2, the Teleport Terraform provider can natively use MachineID (without `tbot`) to join a Teleport
+Starting with 16.2, the Teleport Terraform provider can natively use Machine & Workload Identity (without `tbot`) to join a Teleport
 cluster. The Terraform Provider will rely on its runtime (AWS, GCP, Kubernetes, CI/CD system) to prove its identity to
 Teleport.
 
-You can use any [delegated join method](../join-methods.mdx#delegated-join-methods) by setting
+You can use any [delegated join method](../../deployment/join-methods.mdx#delegated-join-methods) by setting
 both `join_method` and `join_token` in the provider configuration.
 
 This setup is described in more details in
-the ["Run the Teleport Terraform provider in CI or Cloud" guide](../../admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx).
+the ["Run the Teleport Terraform provider in CI or Cloud" guide](../../../zero-trust-access/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx).
 
 ### With key, certificate, and CA certificate
 
@@ -160,7 +165,8 @@ This auth method has the following limitations:
 - Such credentials are high-privileged and long-lived. They must be protected and rotated.
 - This auth method does not work against Teleport clusters with MFA set to `webauthn`.
   On such clusters, Teleport will reject any long-lived certificate and require
-  [an additional MFA challenge for administrative actions](../../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx).
+  [an additional MFA challenge for administrative
+  actions](../../../zero-trust-access/authentication/mfa-for-admin-actions.mdx).
 
 {{ .SchemaMarkdown | trimspace }}
 
diff --git a/integrations/terraform/testlib/bot_test.go b/integrations/terraform/testlib/bot_test.go
index f83b995feef3e..9d6c0da12e7f2 100644
--- a/integrations/terraform/testlib/bot_test.go
+++ b/integrations/terraform/testlib/bot_test.go
@@ -18,10 +18,19 @@ package testlib
 
 import (
 	"context"
+	"fmt"
+	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
 )
 
 func (s *TerraformSuiteOSS) TestBot() {
@@ -47,6 +56,8 @@ func (s *TerraformSuiteOSS) TestBot() {
 
 	tokenName := "teleport_provision_token.bot_test"
 	botName := "teleport_bot.test"
+
+	// Test starting with old schema.
 	resource.Test(s.T(), resource.TestCase{
 		ProtoV6ProviderFactories: s.terraformProviders,
 		CheckDestroy:             checkResourcesDestroyed,
@@ -81,10 +92,69 @@ func (s *TerraformSuiteOSS) TestBot() {
 					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
 					resource.TestCheckResourceAttr(botName, "token_id", "bot-test"),
 					resource.TestCheckResourceAttr(botName, "roles.0", "terraform"),
+					resource.TestCheckResourceAttr(botName, "traits.logins1.0", "example"),
+				),
+			},
+			{
+				Config:   s.getFixture("bot_1_update.tf"),
+				PlanOnly: true,
+			},
+
+			// Switch to new schema (same resource attributes).
+			{
+				Config: s.getFixture("bot_2_new_schema.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tokenName, "kind", "token"),
+					resource.TestCheckResourceAttr(tokenName, "metadata.name", "bot-test"),
+					resource.TestCheckResourceAttr(tokenName, "spec.roles.0", "Bot"),
+					resource.TestCheckResourceAttr(botName, "metadata.name", "test"),
+					resource.TestCheckResourceAttr(botName, "user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "spec.roles.0", "terraform"),
+					resource.TestCheckResourceAttr(botName, "spec.traits.logins1.0", "example"),
+				),
+			},
+			{
+				Config:   s.getFixture("bot_2_new_schema.tf"),
+				PlanOnly: true,
+			},
 
-					// Note: traits are immutable and the plan will not converge
-					// if the resource is not recreated when traits are
-					// modified.
+			// Update with the new schema.
+			{
+				Config: s.getFixture("bot_3_new_schema_update.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tokenName, "kind", "token"),
+					resource.TestCheckResourceAttr(tokenName, "metadata.name", "bot-test"),
+					resource.TestCheckResourceAttr(tokenName, "spec.roles.0", "Bot"),
+					resource.TestCheckResourceAttr(botName, "metadata.name", "test"),
+					resource.TestCheckResourceAttr(botName, "metadata.labels.team", "engineering"),
+					resource.TestCheckResourceAttr(botName, "user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "spec.roles.1", "deployer"),
+					resource.TestCheckResourceAttr(botName, "spec.max_session_ttl", "1h"),
+				),
+			},
+			{
+				Config:   s.getFixture("bot_3_new_schema_update.tf"),
+				PlanOnly: true,
+			},
+
+			// Test reverting back to the old schema.
+			{
+				Config: s.getFixture("bot_1_update.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tokenName, "kind", "token"),
+					resource.TestCheckResourceAttr(tokenName, "metadata.name", "bot-test"),
+					resource.TestCheckResourceAttr(tokenName, "spec.roles.0", "Bot"),
+					resource.TestCheckResourceAttr(botName, "name", "test"),
+					resource.TestCheckResourceAttr(botName, "user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "token_id", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "roles.0", "terraform"),
 					resource.TestCheckResourceAttr(botName, "traits.logins1.0", "example"),
 				),
 			},
@@ -95,4 +165,105 @@ func (s *TerraformSuiteOSS) TestBot() {
 		},
 	})
 
+	// Test with only new schema.
+	resource.Test(s.T(), resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		CheckDestroy:             checkResourcesDestroyed,
+		IsUnitTest:               true,
+		Steps: []resource.TestStep{
+			{
+				Config: s.getFixture("bot_2_new_schema.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tokenName, "kind", "token"),
+					resource.TestCheckResourceAttr(tokenName, "metadata.name", "bot-test"),
+					resource.TestCheckResourceAttr(tokenName, "spec.roles.0", "Bot"),
+					resource.TestCheckResourceAttr(botName, "metadata.name", "test"),
+					resource.TestCheckResourceAttr(botName, "user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "spec.roles.0", "terraform"),
+					resource.TestCheckResourceAttr(botName, "spec.traits.logins1.0", "example"),
+				),
+			},
+			{
+				Config:   s.getFixture("bot_2_new_schema.tf"),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture("bot_3_new_schema_update.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tokenName, "kind", "token"),
+					resource.TestCheckResourceAttr(tokenName, "metadata.name", "bot-test"),
+					resource.TestCheckResourceAttr(tokenName, "spec.roles.0", "Bot"),
+					resource.TestCheckResourceAttr(botName, "metadata.name", "test"),
+					resource.TestCheckResourceAttr(botName, "metadata.labels.team", "engineering"),
+					resource.TestCheckResourceAttr(botName, "user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.user_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "status.role_name", "bot-test"),
+					resource.TestCheckResourceAttr(botName, "spec.roles.1", "deployer"),
+					resource.TestCheckResourceAttr(botName, "spec.max_session_ttl", "1h"),
+				),
+			},
+		},
+	})
+}
+
+func (s *TerraformSuiteOSS) TestImportBot() {
+	t := s.T()
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	r := "teleport_bot"
+	id := "test_import"
+	name := r + "." + id
+
+	bot := &machineidv1.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: id,
+		},
+		Spec: &machineidv1.BotSpec{
+			Roles: []string{"deployer"},
+			Traits: []*machineidv1.Trait{
+				{
+					Name:   "logins",
+					Values: []string{"root", "ubuntu"},
+				},
+			},
+			MaxSessionTtl: durationpb.New(5 * time.Minute),
+		},
+	}
+	bot, err := s.client.BotServiceClient().
+		CreateBot(ctx, &machineidv1.CreateBotRequest{Bot: bot})
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		_, err := s.client.BotServiceClient().
+			GetBot(ctx, &machineidv1.GetBotRequest{BotName: bot.Metadata.Name})
+		return err == nil
+	}, 5*time.Second, time.Second)
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		IsUnitTest:               true,
+		Steps: []resource.TestStep{
+			{
+				Config:        fmt.Sprintf("%s\nresource %q %q { }", s.terraformConfig, r, id),
+				ResourceName:  name,
+				ImportState:   true,
+				ImportStateId: id,
+				ImportStateCheck: func(state []*terraform.InstanceState) error {
+					assert.Equal(t, types.KindBot, state[0].Attributes["kind"])
+					assert.Equal(t, "5m0s", state[0].Attributes["spec.max_session_ttl"])
+					assert.Equal(t, "deployer", state[0].Attributes["spec.roles.0"])
+					assert.Equal(t, "root", state[0].Attributes["spec.traits.logins.0"])
+
+					return nil
+				},
+			},
+		},
+	})
 }
diff --git a/integrations/terraform/testlib/discovery_config_test.go b/integrations/terraform/testlib/discovery_config_test.go
new file mode 100644
index 0000000000000..8481d340e917b
--- /dev/null
+++ b/integrations/terraform/testlib/discovery_config_test.go
@@ -0,0 +1,283 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package testlib
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/discoveryconfig"
+	"github.com/gravitational/teleport/api/types/header"
+)
+
+func (s *TerraformSuiteOSS) TestDiscoveryConfig() {
+	t := s.T()
+	name := "teleport_discovery_config.test"
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories:  s.terraformProviders,
+		PreventPostDestroyRefresh: true,
+		IsUnitTest:                true,
+		Steps: []resource.TestStep{
+			{
+				Config: s.getFixture("discovery_config_0_create.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "spec.discovery_group", "azure_teleport"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.types.0", "vm"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.regions.0", "eastus"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.subscriptions.0", "123123-123123-123123-123123"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.resource_groups.0", "group"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.tags.%", "1"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.join_method", "azure"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.script_name", "default-installer"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.join_token", "azure-token"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.azure.client_id", "managed-identity-id"),
+				),
+			},
+			{
+				Config:   s.getFixture("discovery_config_0_create.tf"),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture("discovery_config_1_update.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "spec.discovery_group", "azure_teleport_updated"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.types.0", "vm"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.types.1", "aks"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.regions.0", "westus"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.regions.1", "eastus"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.subscriptions.0", "456456-456456-456456-456456"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.resource_groups.0", "group"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.resource_groups.1", "group2"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.tags.env.0", "prod"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.script_name", "updated-installer"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.join_token", "azure-token-updated"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.azure.client_id", "managed-identity-id-updated"),
+				),
+			},
+			{
+				Config:   s.getFixture("discovery_config_1_update.tf"),
+				PlanOnly: true,
+			},
+		},
+	})
+}
+
+func (s *TerraformSuiteOSS) TestImportDiscoveryConfig() {
+	t := s.T()
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	r := "teleport_discovery_config"
+	id := "test_import"
+	name := r + "." + id
+
+	discoveryCfg, err := discoveryconfig.NewDiscoveryConfig(
+		header.Metadata{
+			Name:        id,
+			Description: "Test discovery config for import",
+			Labels: map[string]string{
+				"purpose": "test",
+			},
+		},
+		discoveryconfig.Spec{
+			DiscoveryGroup: "test_group",
+		},
+	)
+	require.NoError(t, err)
+
+	_, err = s.client.DiscoveryConfigClient().CreateDiscoveryConfig(ctx, discoveryCfg)
+	require.NoError(t, err)
+
+	existing, err := s.client.DiscoveryConfigClient().GetDiscoveryConfig(ctx, id)
+	require.NoError(t, err)
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		IsUnitTest:               true,
+		Steps: []resource.TestStep{
+			{
+				Config:        s.terraformConfig + "\n" + `resource "` + r + `" "` + id + `" { }`,
+				ResourceName:  name,
+				ImportState:   true,
+				ImportStateId: id,
+				ImportStateCheck: func(state []*terraform.InstanceState) error {
+					require.Equal(t, existing.Metadata.Name, state[0].Attributes["header.metadata.name"])
+					require.Equal(t, existing.Metadata.Description, state[0].Attributes["header.metadata.description"])
+					require.Equal(t, "test", state[0].Attributes["header.metadata.labels.purpose"])
+					require.Equal(t, existing.Metadata.Revision, state[0].Attributes["header.metadata.revision"])
+					require.Equal(t, "test_group", state[0].Attributes["spec.discovery_group"])
+
+					return nil
+				},
+			},
+		},
+	})
+}
+
+func (s *TerraformSuiteOSS) TestDiscoveryConfigAzureRequiredFields() {
+	t := s.T()
+
+	baseConfig := `
+resource "teleport_discovery_config" "test" {
+  header = {
+    metadata = {
+      name = "test"
+    }
+    version = "v1"
+  }
+  spec = {
+    discovery_group = "azure_teleport"
+    azure = [{
+      types         = ["vm"]
+      regions       = ["eastus"]
+      subscriptions = ["123123-123123-123123-123123"]
+
+      install_params = {
+%s
+      }
+    }]
+  }
+}
+`
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		IsUnitTest:               true,
+		Steps: []resource.TestStep{
+			{
+				Config: s.terraformConfig + "\n" + fmt.Sprintf(baseConfig, `
+        join_token = "azure-token"
+        azure = {
+          client_id = "managed-identity-id"
+        }`),
+				ExpectError: regexp.MustCompile(`attribute "join_method" is required`),
+			},
+			{
+				Config: s.terraformConfig + "\n" + fmt.Sprintf(baseConfig, `
+        join_method = "azure"
+        azure = {
+          client_id = "managed-identity-id"
+        }`),
+				ExpectError: regexp.MustCompile(`attribute "join_token" is required`),
+			},
+			{
+				Config: s.terraformConfig + "\n" + fmt.Sprintf(baseConfig, `
+        join_method = "azure"
+        join_token  = "azure-token"
+        azure = {
+        }`),
+				ExpectError: regexp.MustCompile(`(?s)attribute "azure":.*attribute "client_id" is\s+required`),
+			},
+		},
+	})
+}
+
+func (s *TerraformSuiteOSS) TestDiscoveryConfigAzureComputedFields() {
+	t := s.T()
+	name := "teleport_discovery_config.test"
+
+	configWithoutInstallParams := s.terraformConfig + `
+resource "teleport_discovery_config" "test" {
+  header = {
+    metadata = {
+      name = "test"
+    }
+    version = "v1"
+  }
+  spec = {
+    discovery_group = "azure_teleport"
+    azure = [{
+      types           = ["vm"]
+      regions         = ["eastus"]
+      subscriptions   = ["123123-123123-123123-123123"]
+      resource_groups = ["group"]
+      tags = {
+        "*" = ["*"]
+      }
+    }]
+  }
+}
+`
+
+	configWithoutScriptName := s.terraformConfig + `
+resource "teleport_discovery_config" "test" {
+  header = {
+    metadata = {
+      name = "test"
+    }
+    version = "v1"
+  }
+  spec = {
+    discovery_group = "azure_teleport"
+    azure = [{
+      types           = ["vm"]
+      regions         = ["eastus"]
+      subscriptions   = ["123123-123123-123123-123123"]
+      resource_groups = ["group"]
+      tags = {
+        "*" = ["*"]
+      }
+
+      install_params = {
+        join_method = "azure"
+        join_token  = "azure-token"
+        azure = {
+          client_id = "managed-identity-id"
+        }
+      }
+    }]
+  }
+}
+`
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories:  s.terraformProviders,
+		PreventPostDestroyRefresh: true,
+		IsUnitTest:                true,
+		Steps: []resource.TestStep{
+			{
+				Config: configWithoutInstallParams,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "spec.discovery_group", "azure_teleport"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.types.0", "vm"),
+				),
+			},
+			{
+				Config:   configWithoutInstallParams,
+				PlanOnly: true,
+			},
+			{
+				Config: configWithoutScriptName,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.join_method", "azure"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.join_token", "azure-token"),
+					resource.TestCheckResourceAttr(name, "spec.azure.0.install_params.azure.client_id", "managed-identity-id"),
+				),
+			},
+			{
+				Config:   configWithoutScriptName,
+				PlanOnly: true,
+			},
+		},
+	})
+}
diff --git a/integrations/terraform/testlib/fixtures/bot_2_new_schema.tf b/integrations/terraform/testlib/fixtures/bot_2_new_schema.tf
new file mode 100644
index 0000000000000..3999b25027e9c
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/bot_2_new_schema.tf
@@ -0,0 +1,38 @@
+locals {
+  bot_name = "test"
+}
+
+resource "teleport_provision_token" "bot_test" {
+  version = "v2"
+  metadata = {
+    expires = "2038-01-01T00:00:00Z"
+    name    = "bot-test"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    bot_name    = local.bot_name
+    join_method = "token"
+  }
+}
+
+resource "teleport_bot" "test" {
+  version = "v1"
+
+  metadata = {
+    name = local.bot_name
+  }
+
+  spec = {
+    roles = ["terraform"]
+
+    traits = {
+      logins1 = ["example"]
+      logins2 = ["example"]
+    }
+  }
+
+  depends_on = [
+    teleport_provision_token.bot_test
+  ]
+}
diff --git a/integrations/terraform/testlib/fixtures/bot_3_new_schema_update.tf b/integrations/terraform/testlib/fixtures/bot_3_new_schema_update.tf
new file mode 100644
index 0000000000000..b3d757c64c588
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/bot_3_new_schema_update.tf
@@ -0,0 +1,39 @@
+locals {
+  bot_name = "test"
+}
+
+resource "teleport_provision_token" "bot_test" {
+  version = "v2"
+  metadata = {
+    expires = "2038-01-01T00:00:00Z"
+    name    = "bot-test"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    bot_name    = local.bot_name
+    join_method = "token"
+  }
+}
+
+resource "teleport_bot" "test" {
+  version = "v1"
+
+  metadata = {
+    name = local.bot_name
+    labels = {
+      "teleport.dev/origin" = "config-file"
+      "team"                = "engineering"
+    }
+    expires = "2038-01-01T00:00:00Z"
+  }
+
+  spec = {
+    max_session_ttl = "1h"
+    roles           = ["terraform", "deployer"]
+  }
+
+  depends_on = [
+    teleport_provision_token.bot_test
+  ]
+}
diff --git a/integrations/terraform/testlib/fixtures/discovery_config_0_create.tf b/integrations/terraform/testlib/fixtures/discovery_config_0_create.tf
new file mode 100644
index 0000000000000..24de081f0ce91
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/discovery_config_0_create.tf
@@ -0,0 +1,34 @@
+resource "teleport_discovery_config" "test" {
+  header = {
+    metadata = {
+      name        = "test"
+      description = "Example azure discovery config"
+      labels = {
+        foo = "bar"
+      }
+    }
+    version = "v1"
+  }
+  spec = {
+    discovery_group = "azure_teleport"
+    azure = [{
+      types           = ["vm"]
+      regions         = ["eastus"]
+      subscriptions   = ["123123-123123-123123-123123"]
+      resource_groups = ["group"]
+
+      tags = {
+        "*" = ["*"]
+      }
+
+      install_params = {
+        join_method = "azure"
+        script_name = "default-installer"
+        join_token  = "azure-token"
+        azure = {
+          client_id = "managed-identity-id"
+        }
+      }
+    }]
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/discovery_config_1_update.tf b/integrations/terraform/testlib/fixtures/discovery_config_1_update.tf
new file mode 100644
index 0000000000000..6ba3a51b85b3a
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/discovery_config_1_update.tf
@@ -0,0 +1,36 @@
+resource "teleport_discovery_config" "test" {
+  header = {
+    metadata = {
+      name        = "test"
+      description = "Updated example azure discovery config"
+      labels = {
+        foo = "baz"
+      }
+    }
+    version = "v1"
+  }
+  spec = {
+    discovery_group = "azure_teleport_updated"
+    azure = [{
+      types           = ["vm", "aks"]
+      regions         = ["westus", "eastus"]
+      subscriptions   = ["456456-456456-456456-456456"]
+      resource_groups = ["group", "group2"]
+
+      tags = {
+        "env" = ["prod"]
+      }
+
+      install_params = {
+        join_method = "azure"
+        script_name = "updated-installer"
+        join_token  = "azure-token-updated"
+        azure = {
+          client_id = "managed-identity-id-updated"
+        }
+      }
+    }]
+  }
+}
+
+
diff --git a/integrations/terraform/testlib/fixtures/integration_0_create_aws_oidc.tf b/integrations/terraform/testlib/fixtures/integration_0_create_aws_oidc.tf
new file mode 100644
index 0000000000000..edb736097a656
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_0_create_aws_oidc.tf
@@ -0,0 +1,18 @@
+resource "teleport_integration" "aws_oidc" {
+  version  = "v1"
+  sub_kind = "aws-oidc"
+  metadata = {
+    name        = "aws-oidc"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    aws_oidc = {
+      issuer_s3_uri = "s3://test-s3-bucket/some-prefix"
+      role_arn      = "arn:aws:iam::123456789012:role/test-role"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/integration_1_update_aws_oidc.tf b/integrations/terraform/testlib/fixtures/integration_1_update_aws_oidc.tf
new file mode 100644
index 0000000000000..5513c7e7510e3
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_1_update_aws_oidc.tf
@@ -0,0 +1,18 @@
+resource "teleport_integration" "aws_oidc" {
+  version  = "v1"
+  sub_kind = "aws-oidc"
+  metadata = {
+    name        = "aws-oidc"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    aws_oidc = {
+      audience = "aws-identity-center"
+      role_arn = "arn:aws:iam::123456789012:role/test-role-updated"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/integration_2_create_azure_oidc.tf b/integrations/terraform/testlib/fixtures/integration_2_create_azure_oidc.tf
new file mode 100644
index 0000000000000..28374196469e2
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_2_create_azure_oidc.tf
@@ -0,0 +1,18 @@
+resource "teleport_integration" "azure_oidc" {
+  version  = "v1"
+  sub_kind = "azure-oidc"
+  metadata = {
+    name        = "azure-oidc"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    azure_oidc = {
+      tenant_id = "some-tenant"
+      client_id = "some-client"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/integration_3_update_azure_oidc.tf b/integrations/terraform/testlib/fixtures/integration_3_update_azure_oidc.tf
new file mode 100644
index 0000000000000..db694a3079efc
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_3_update_azure_oidc.tf
@@ -0,0 +1,18 @@
+resource "teleport_integration" "azure_oidc" {
+  version  = "v1"
+  sub_kind = "azure-oidc"
+  metadata = {
+    name        = "azure-oidc"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    azure_oidc = {
+      tenant_id = "updated-tenant"
+      client_id = "updated-client"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/integration_4_create_aws_ra.tf b/integrations/terraform/testlib/fixtures/integration_4_create_aws_ra.tf
new file mode 100644
index 0000000000000..3ada2cf70fbfc
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_4_create_aws_ra.tf
@@ -0,0 +1,24 @@
+resource "teleport_integration" "aws_ra" {
+  version  = "v1"
+  sub_kind = "aws-ra"
+  metadata = {
+    name        = "aws-ra"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    aws_ra = {
+      profile_sync_config = {
+        enabled                           = true
+        profile_accepts_role_session_name = true
+        profile_arn                       = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/test-profile"
+        profile_name_filters              = ["*llama*", "^.*$"]
+        role_arn                          = "arn:aws:iam::123456789012:role/test-role"
+      }
+      trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/test-anchor"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/integration_5_update_aws_ra.tf b/integrations/terraform/testlib/fixtures/integration_5_update_aws_ra.tf
new file mode 100644
index 0000000000000..c7fad2a483765
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/integration_5_update_aws_ra.tf
@@ -0,0 +1,24 @@
+resource "teleport_integration" "aws_ra" {
+  version  = "v1"
+  sub_kind = "aws-ra"
+  metadata = {
+    name        = "aws-ra"
+    description = "Test integration"
+    labels = {
+      example = "yes"
+    }
+  }
+
+  spec = {
+    aws_ra = {
+      profile_sync_config = {
+        enabled                           = false
+        profile_accepts_role_session_name = false
+        profile_arn                       = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/updated"
+        profile_name_filters              = ["*updated*", "^.*$"]
+        role_arn                          = "arn:aws:iam::123456789012:role/updated"
+      }
+      trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/updated"
+    }
+  }
+}
diff --git a/integrations/terraform/testlib/fixtures/role_0_create.tf b/integrations/terraform/testlib/fixtures/role_0_create.tf
index fe772e0dd37b1..5d210ec5bf2aa 100644
--- a/integrations/terraform/testlib/fixtures/role_0_create.tf
+++ b/integrations/terraform/testlib/fixtures/role_0_create.tf
@@ -1,5 +1,5 @@
 resource "teleport_role" "test" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name = "test"
   }
diff --git a/integrations/terraform/testlib/fixtures/role_1_update.tf b/integrations/terraform/testlib/fixtures/role_1_update.tf
index 32b5f653cc70b..3477782472514 100644
--- a/integrations/terraform/testlib/fixtures/role_1_update.tf
+++ b/integrations/terraform/testlib/fixtures/role_1_update.tf
@@ -1,5 +1,5 @@
 resource "teleport_role" "test" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name        = "test"
     description = ""
diff --git a/integrations/terraform/testlib/fixtures/role_2_update.tf b/integrations/terraform/testlib/fixtures/role_2_update.tf
index affecea591de5..dee8515f5f206 100644
--- a/integrations/terraform/testlib/fixtures/role_2_update.tf
+++ b/integrations/terraform/testlib/fixtures/role_2_update.tf
@@ -1,5 +1,5 @@
 resource "teleport_role" "test" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name        = "test"
     description = "Test role"
diff --git a/integrations/terraform/testlib/fixtures/role_3_update.tf b/integrations/terraform/testlib/fixtures/role_3_update.tf
index 8de2044117233..8c4365dc8b7df 100644
--- a/integrations/terraform/testlib/fixtures/role_3_update.tf
+++ b/integrations/terraform/testlib/fixtures/role_3_update.tf
@@ -1,5 +1,5 @@
 resource "teleport_role" "test" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name    = "test"
     expires = "2032-12-12T00:00:00Z"
diff --git a/integrations/terraform/testlib/fixtures/role_data_source.tf b/integrations/terraform/testlib/fixtures/role_data_source.tf
index fb9f58832bb8e..98301b9f08c19 100644
--- a/integrations/terraform/testlib/fixtures/role_data_source.tf
+++ b/integrations/terraform/testlib/fixtures/role_data_source.tf
@@ -1,6 +1,6 @@
 data "teleport_role" "test" {
   kind    = "role"
-  version = "v7"
+  version = "v8"
   metadata = {
     name = "test"
   }
diff --git a/integrations/terraform/testlib/fixtures/role_drift_0.tf b/integrations/terraform/testlib/fixtures/role_drift_0.tf
index 76acae3c0c399..245f70b4e175c 100644
--- a/integrations/terraform/testlib/fixtures/role_drift_0.tf
+++ b/integrations/terraform/testlib/fixtures/role_drift_0.tf
@@ -1,5 +1,5 @@
 resource "teleport_role" "splitbrain" {
-  version = "v7"
+  version = "v8"
   metadata = {
     name = "splitbrain"
   }
diff --git a/integrations/terraform/testlib/fixtures/role_reviewers_0_two_roles.tf b/integrations/terraform/testlib/fixtures/role_reviewers_0_two_roles.tf
index 5ee1e58dd3b58..eb2b8b6d67cef 100644
--- a/integrations/terraform/testlib/fixtures/role_reviewers_0_two_roles.tf
+++ b/integrations/terraform/testlib/fixtures/role_reviewers_0_two_roles.tf
@@ -12,5 +12,5 @@ resource "teleport_role" "test_decrease_reviewers" {
     }
   }
 
-  version = "v6"
+  version = "v8"
 }
diff --git a/integrations/terraform/testlib/fixtures/role_reviewers_1_one_role.tf b/integrations/terraform/testlib/fixtures/role_reviewers_1_one_role.tf
index 7ea34ce6fd3bc..e51bd19f88366 100644
--- a/integrations/terraform/testlib/fixtures/role_reviewers_1_one_role.tf
+++ b/integrations/terraform/testlib/fixtures/role_reviewers_1_one_role.tf
@@ -12,5 +12,5 @@ resource "teleport_role" "test_decrease_reviewers" {
     }
   }
 
-  version = "v6"
+  version = "v8"
 }
diff --git a/integrations/terraform/testlib/fixtures/role_with_kube_resources.tf b/integrations/terraform/testlib/fixtures/role_upgrade_v6_with_kube_resources.tf
similarity index 100%
rename from integrations/terraform/testlib/fixtures/role_with_kube_resources.tf
rename to integrations/terraform/testlib/fixtures/role_upgrade_v6_with_kube_resources.tf
diff --git a/integrations/terraform/testlib/fixtures/role_upgrade_v7_with_kube_resources.tf b/integrations/terraform/testlib/fixtures/role_upgrade_v7_with_kube_resources.tf
new file mode 100644
index 0000000000000..82ed756eb2323
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/role_upgrade_v7_with_kube_resources.tf
@@ -0,0 +1,27 @@
+
+resource "teleport_role" "upgrade" {
+  metadata = {
+    name = "upgrade"
+  }
+
+  spec = {
+    allow = {
+      logins = ["onev7"]
+
+      kubernetes_labels = {
+        env = ["dev", "prod"]
+      }
+
+      kubernetes_resources = [
+        {
+          kind      = "deployment"
+          name      = "*"
+          namespace = "myns"
+          verbs     = ["get"]
+        }
+      ]
+    }
+  }
+
+  version = "v7"
+}
diff --git a/integrations/terraform/testlib/fixtures/role_upgrade_v8.tf b/integrations/terraform/testlib/fixtures/role_upgrade_v8.tf
new file mode 100644
index 0000000000000..564e886f1fbdc
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/role_upgrade_v8.tf
@@ -0,0 +1,17 @@
+resource "teleport_role" "upgrade" {
+  metadata = {
+    name = "upgrade"
+  }
+
+  spec = {
+    allow = {
+      logins = ["onev8"]
+      kubernetes_labels = {
+        env = ["dev", "prod"]
+      }
+    }
+  }
+
+  version = "v8"
+}
+
diff --git a/integrations/terraform/testlib/fixtures/role_with_kube_resources_v6.tf b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v6.tf
new file mode 100644
index 0000000000000..6410018330aa4
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v6.tf
@@ -0,0 +1,23 @@
+resource "teleport_role" "kube_resources_v6" {
+  metadata = {
+    name = "kube_resources_v6"
+  }
+
+  spec = {
+    allow = {
+      logins = ["onev6"]
+      kubernetes_labels = {
+        env = ["dev", "prod"]
+      }
+      kubernetes_resources = [
+        {
+          kind      = "pod"
+          name      = "*"
+          namespace = "myns"
+        }
+      ]
+    }
+  }
+
+  version = "v6"
+}
diff --git a/integrations/terraform/testlib/fixtures/role_with_kube_resources_v7.tf b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v7.tf
new file mode 100644
index 0000000000000..46ceaccf13eb6
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v7.tf
@@ -0,0 +1,27 @@
+
+resource "teleport_role" "kube_resources_v7" {
+  metadata = {
+    name = "kube_resources_v7"
+  }
+
+  spec = {
+    allow = {
+      logins = ["onev7"]
+
+      kubernetes_labels = {
+        env = ["dev", "prod"]
+      }
+
+      kubernetes_resources = [
+        {
+          kind      = "deployment"
+          name      = "*"
+          namespace = "myns"
+          verbs     = ["get"]
+        }
+      ]
+    }
+  }
+
+  version = "v7"
+}
diff --git a/integrations/terraform/testlib/fixtures/role_with_kube_resources_v8.tf b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v8.tf
new file mode 100644
index 0000000000000..ed0154bbe9fb2
--- /dev/null
+++ b/integrations/terraform/testlib/fixtures/role_with_kube_resources_v8.tf
@@ -0,0 +1,34 @@
+
+resource "teleport_role" "kube_resources_v8" {
+  metadata = {
+    name = "kube_resources_v8"
+  }
+
+  spec = {
+    allow = {
+      logins = ["onev8"]
+
+      kubernetes_labels = {
+        env = ["dev", "prod"]
+      }
+
+      kubernetes_resources = [
+        {
+          kind      = "pods"
+          name      = "*"
+          namespace = "myns"
+          verbs     = ["get"]
+        },
+        {
+          kind      = "deployments"
+          api_group = "apps"
+          name      = "*"
+          namespace = "myns"
+          verbs     = ["get"]
+        }
+      ]
+    }
+  }
+
+  version = "v8"
+}
diff --git a/integrations/terraform/testlib/fixtures/role_with_kube_verbs.tf b/integrations/terraform/testlib/fixtures/role_with_kube_verbs.tf
index 7a083142150a3..3cc1de5ffa8dd 100644
--- a/integrations/terraform/testlib/fixtures/role_with_kube_verbs.tf
+++ b/integrations/terraform/testlib/fixtures/role_with_kube_verbs.tf
@@ -5,10 +5,10 @@ resource "teleport_role" "kube_verbs" {
 
   spec = {
     allow = {
-      logins = ["onev6"]
+      logins = ["onev8"]
       kubernetes_resources = [
         {
-          kind      = "pod"
+          kind      = "pods"
           name      = "*"
           namespace = "myns"
           verbs     = ["get", "watch", "list"]
@@ -17,5 +17,5 @@ resource "teleport_role" "kube_verbs" {
     }
   }
 
-  version = "v7"
+  version = "v8"
 }
diff --git a/integrations/terraform/testlib/health_check_config_test.go b/integrations/terraform/testlib/health_check_config_test.go
index 23ad4b30aec24..5cf5560d02881 100644
--- a/integrations/terraform/testlib/health_check_config_test.go
+++ b/integrations/terraform/testlib/health_check_config_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	"github.com/gravitational/teleport"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
 	"github.com/gravitational/teleport/api/types/healthcheckconfig"
@@ -99,6 +100,11 @@ func (s *TerraformSuiteOSS) TestImportHealthCheckConfig() {
 					Values: []string{"one", "two"},
 				}},
 				DbLabelsExpression: "labels.env == `one`",
+				KubernetesLabels: []*labelv1.Label{{
+					Name:   "env",
+					Values: []string{"three", "four"},
+				}},
+				KubernetesLabelsExpression: "labels.env == `three`",
 			},
 		},
 	)
@@ -123,7 +129,7 @@ func (s *TerraformSuiteOSS) TestImportHealthCheckConfig() {
 	waitForResources := func() []*healthcheckconfigv1.HealthCheckConfig {
 		select {
 		case resources := <-w.ResourcesC:
-			return resources
+			return removeVirtualDefaultHealthChecks(resources)
 		case <-w.Done():
 			require.FailNow(t, "Watcher has unexpectedly exited.")
 		case <-time.After(2 * time.Second):
@@ -165,6 +171,10 @@ func (s *TerraformSuiteOSS) TestImportHealthCheckConfig() {
 					require.Equal(t, "one", state[0].Attributes["spec.match.db_labels.0.values.0"])
 					require.Equal(t, "two", state[0].Attributes["spec.match.db_labels.0.values.1"])
 					require.Equal(t, "labels.env == `one`", state[0].Attributes["spec.match.db_labels_expression"])
+					require.Equal(t, "env", state[0].Attributes["spec.match.kubernetes_labels.0.name"])
+					require.Equal(t, "three", state[0].Attributes["spec.match.kubernetes_labels.0.values.0"])
+					require.Equal(t, "four", state[0].Attributes["spec.match.kubernetes_labels.0.values.1"])
+					require.Equal(t, "labels.env == `three`", state[0].Attributes["spec.match.kubernetes_labels_expression"])
 
 					return nil
 				},
@@ -172,3 +182,16 @@ func (s *TerraformSuiteOSS) TestImportHealthCheckConfig() {
 		},
 	})
 }
+
+func removeVirtualDefaultHealthChecks(cfgs []*healthcheckconfigv1.HealthCheckConfig) []*healthcheckconfigv1.HealthCheckConfig {
+	filtered := make([]*healthcheckconfigv1.HealthCheckConfig, 0, len(cfgs))
+	for _, cfg := range cfgs {
+		switch cfg.GetMetadata().GetName() {
+		case teleport.VirtualDefaultHealthCheckConfigDBName,
+			teleport.VirtualDefaultHealthCheckConfigKubeName:
+			continue
+		}
+		filtered = append(filtered, cfg)
+	}
+	return filtered
+}
diff --git a/integrations/terraform/testlib/integration_test.go b/integrations/terraform/testlib/integration_test.go
new file mode 100644
index 0000000000000..c1a656b0a50f6
--- /dev/null
+++ b/integrations/terraform/testlib/integration_test.go
@@ -0,0 +1,313 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Config 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testlib
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func (s *TerraformSuiteOSS) TestIntegration() {
+	const (
+		resourceType = "teleport_integration"
+
+		createAWSOIDCIntegrationFixture = "integration_0_create_aws_oidc.tf"
+		updateAWSOIDCIntegrationFixture = "integration_1_update_aws_oidc.tf"
+		awsOIDCResourceName             = resourceType + "." + "aws_oidc"
+
+		createAzureOIDCIntegrationFixture = "integration_2_create_azure_oidc.tf"
+		updateAzureOIDCIntegrationFixture = "integration_3_update_azure_oidc.tf"
+		azureOIDCResourceName             = resourceType + "." + "azure_oidc"
+
+		createAWSRAIntegrationFixture = "integration_4_create_aws_ra.tf"
+		updateAWSRAIntegrationFixture = "integration_5_update_aws_ra.tf"
+		awsRAResourceName             = resourceType + "." + "aws_ra"
+	)
+	t := s.T()
+	ctx := t.Context()
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		CheckDestroy: func(state *terraform.State) error {
+			integrations, err := s.client.ListAllIntegrations(ctx)
+			if err != nil {
+				if trace.IsNotFound(err) {
+					return nil
+				}
+				return err
+			}
+			for _, ig := range integrations {
+				switch ig.GetName() {
+				case "aws-oidc", "azure-oidc", "aws-ra":
+					return trace.Errorf("created integrations still exist after destroy: %v", types.ResourceNames(integrations))
+				default:
+				}
+			}
+			return nil
+		},
+		IsUnitTest: true,
+		Steps: []resource.TestStep{
+			// aws subkind steps
+			{
+				Config: s.getFixture(createAWSOIDCIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "sub_kind", "aws-oidc"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.name", "aws-oidc"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckNoResourceAttr(awsOIDCResourceName, "spec.aws_oidc.audience"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "spec.aws_oidc.issuer_s3_uri", "s3://test-s3-bucket/some-prefix"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "spec.aws_oidc.role_arn", "arn:aws:iam::123456789012:role/test-role"),
+					resource.TestCheckNoResourceAttr(awsOIDCResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(createAWSOIDCIntegrationFixture),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture(updateAWSOIDCIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "sub_kind", "aws-oidc"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.name", "aws-oidc"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "spec.aws_oidc.audience", "aws-identity-center"),
+					resource.TestCheckNoResourceAttr(awsOIDCResourceName, "spec.aws_oidc.issuer_s3_uri"),
+					resource.TestCheckResourceAttr(awsOIDCResourceName, "spec.aws_oidc.role_arn", "arn:aws:iam::123456789012:role/test-role-updated"),
+					resource.TestCheckNoResourceAttr(awsOIDCResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(updateAWSOIDCIntegrationFixture),
+				PlanOnly: true,
+			},
+			// azure subkind steps
+			{
+				Config: s.getFixture(createAzureOIDCIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "sub_kind", "azure-oidc"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.name", "azure-oidc"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "spec.azure_oidc.tenant_id", "some-tenant"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "spec.azure_oidc.client_id", "some-client"),
+					resource.TestCheckNoResourceAttr(azureOIDCResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(createAzureOIDCIntegrationFixture),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture(updateAzureOIDCIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "sub_kind", "azure-oidc"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.name", "azure-oidc"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "spec.azure_oidc.tenant_id", "updated-tenant"),
+					resource.TestCheckResourceAttr(azureOIDCResourceName, "spec.azure_oidc.client_id", "updated-client"),
+					resource.TestCheckNoResourceAttr(azureOIDCResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(updateAzureOIDCIntegrationFixture),
+				PlanOnly: true,
+			},
+			// aws-ra subkind steps
+			{
+				Config: s.getFixture(createAWSRAIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(awsRAResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "sub_kind", "aws-ra"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.name", "aws-ra"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.enabled", "true"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_accepts_role_session_name", "true"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_arn", "arn:aws:rolesanywhere:us-east-1:123456789012:profile/test-profile"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_name_filters.0", "*llama*"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_name_filters.1", "^.*$"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.role_arn", "arn:aws:iam::123456789012:role/test-role"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.trust_anchor_arn", "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/test-anchor"),
+					resource.TestCheckNoResourceAttr(awsRAResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(createAWSRAIntegrationFixture),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture(updateAWSRAIntegrationFixture),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(awsRAResourceName, "kind", "integration"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "sub_kind", "aws-ra"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "version", "v1"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.name", "aws-ra"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.description", "Test integration"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "metadata.labels.example", "yes"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.enabled", "false"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_accepts_role_session_name", "false"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_arn", "arn:aws:rolesanywhere:us-east-1:123456789012:profile/updated"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_name_filters.0", "*updated*"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.profile_name_filters.1", "^.*$"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.profile_sync_config.role_arn", "arn:aws:iam::123456789012:role/updated"),
+					resource.TestCheckResourceAttr(awsRAResourceName, "spec.aws_ra.trust_anchor_arn", "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/updated"),
+					resource.TestCheckNoResourceAttr(awsRAResourceName, "spec.credentials"),
+				),
+			},
+			{
+				Config:   s.getFixture(updateAWSRAIntegrationFixture),
+				PlanOnly: true,
+			},
+		},
+	})
+}
+
+func (s *TerraformSuiteOSS) TestImportIntegration() {
+	const resourceType = "teleport_integration"
+	t := s.T()
+	ctx := t.Context()
+
+	awsOIDCIntegration, err := types.NewIntegrationAWSOIDC(types.Metadata{
+		Name:   "aws-oidc-import-me",
+		Labels: map[string]string{"foo": "bar"},
+	}, &types.AWSOIDCIntegrationSpecV1{
+		Audience:    "aws-identity-center",
+		IssuerS3URI: "s3://test-s3-bucket/some-prefix",
+		RoleARN:     "arn:aws:iam::123456789012:role/test-role",
+	})
+	require.NoError(t, err)
+
+	azureOIDCIntegration, err := types.NewIntegrationAzureOIDC(types.Metadata{
+		Name:   "azure-oidc-import-me",
+		Labels: map[string]string{"foo": "bar"},
+	}, &types.AzureOIDCIntegrationSpecV1{
+		ClientID: "a-client-id",
+		TenantID: "a-tenant-id",
+	})
+	require.NoError(t, err)
+
+	awsRAIntegration, err := types.NewIntegrationAWSRA(types.Metadata{
+		Name:   "aws-ra-import-me",
+		Labels: map[string]string{"foo": "bar"},
+	}, &types.AWSRAIntegrationSpecV1{
+		ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+			Enabled:                       true,
+			ProfileARN:                    "arn:aws:rolesanywhere:us-east-1:123456789012:profile/test",
+			ProfileAcceptsRoleSessionName: true,
+			RoleARN:                       "arn:aws:iam::123456789012:role/test",
+			ProfileNameFilters:            []string{"foo", "bar"},
+		},
+		TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/test",
+	})
+	require.NoError(t, err)
+
+	var created []types.Integration
+	for _, ig := range []types.Integration{awsOIDCIntegration, azureOIDCIntegration, awsRAIntegration} {
+		ig, err := s.client.CreateIntegration(ctx, ig)
+		require.NoError(t, err)
+		created = append(created, ig)
+	}
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		existing, err := s.client.ListAllIntegrations(ctx)
+		require.NoError(t, err)
+		require.Subset(t, existing, created)
+	}, 5*time.Second, 200*time.Millisecond, "waiting for all created integrations to be available")
+
+	tests := []struct {
+		integration types.Integration
+		stateCheck  func([]*terraform.InstanceState) error
+	}{
+		{
+			integration: awsOIDCIntegration,
+			stateCheck: func(state []*terraform.InstanceState) error {
+				require.Equal(t, "aws-oidc", state[0].Attributes["sub_kind"])
+				require.Equal(t, "aws-oidc-import-me", state[0].Attributes["metadata.name"])
+				require.Equal(t, "aws-identity-center", state[0].Attributes["spec.aws_oidc.audience"])
+				require.Equal(t, "s3://test-s3-bucket/some-prefix", state[0].Attributes["spec.aws_oidc.issuer_s3_uri"])
+				require.Equal(t, "arn:aws:iam::123456789012:role/test-role", state[0].Attributes["spec.aws_oidc.role_arn"])
+				return nil
+			},
+		},
+		{
+			integration: azureOIDCIntegration,
+			stateCheck: func(state []*terraform.InstanceState) error {
+				require.Equal(t, "azure-oidc", state[0].Attributes["sub_kind"])
+				require.Equal(t, "a-tenant-id", state[0].Attributes["spec.azure_oidc.tenant_id"])
+				require.Equal(t, "a-client-id", state[0].Attributes["spec.azure_oidc.client_id"])
+				return nil
+			},
+		},
+		{
+			integration: awsRAIntegration,
+			stateCheck: func(state []*terraform.InstanceState) error {
+				require.Equal(t, "aws-ra", state[0].Attributes["sub_kind"])
+				require.Equal(t, "true", state[0].Attributes["spec.aws_ra.profile_sync_config.enabled"])
+				require.Equal(t, "true", state[0].Attributes["spec.aws_ra.profile_sync_config.profile_accepts_role_session_name"])
+				require.Equal(t, "arn:aws:rolesanywhere:us-east-1:123456789012:profile/test", state[0].Attributes["spec.aws_ra.profile_sync_config.profile_arn"])
+				require.Equal(t, "foo", state[0].Attributes["spec.aws_ra.profile_sync_config.profile_name_filters.0"])
+				require.Equal(t, "bar", state[0].Attributes["spec.aws_ra.profile_sync_config.profile_name_filters.1"])
+				require.Equal(t, "arn:aws:iam::123456789012:role/test", state[0].Attributes["spec.aws_ra.profile_sync_config.role_arn"])
+				require.Equal(t, "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/test", state[0].Attributes["spec.aws_ra.trust_anchor_arn"])
+				return nil
+			},
+		},
+	}
+
+	var steps []resource.TestStep
+	for _, test := range tests {
+		steps = append(steps, resource.TestStep{
+			Config:        s.terraformConfig + "\n" + fmt.Sprintf(`resource %q %q {}`, resourceType, test.integration.GetName()),
+			ResourceName:  resourceType + "." + test.integration.GetName(),
+			ImportState:   true,
+			ImportStateId: test.integration.GetName(),
+			ImportStateCheck: func(state []*terraform.InstanceState) error {
+				// common checks
+				require.Equal(t, "integration", state[0].Attributes["kind"])
+				require.Equal(t, "v1", state[0].Attributes["version"])
+				require.Equal(t, test.integration.GetName(), state[0].Attributes["metadata.name"])
+				require.Equal(t, "bar", state[0].Attributes["metadata.labels.foo"])
+				// checks that are specific to each integration
+				return test.stateCheck(state)
+			},
+		})
+	}
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: s.terraformProviders,
+		IsUnitTest:               true,
+		Steps:                    steps,
+	})
+}
diff --git a/integrations/terraform/testlib/machineid_join_test.go b/integrations/terraform/testlib/machineid_join_test.go
index 49cd36d54e904..e921994db8552 100644
--- a/integrations/terraform/testlib/machineid_join_test.go
+++ b/integrations/terraform/testlib/machineid_join_test.go
@@ -30,13 +30,15 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/integrations/lib/testing/fakejoin"
 	"github.com/gravitational/teleport/integrations/lib/testing/integration"
 	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
 
 	"github.com/gravitational/teleport/integrations/terraform/provider"
 )
@@ -58,7 +60,7 @@ func TestTerraformJoin(t *testing.T) {
 
 	// Test setup: create a fake Kubernetes signer that will allow us to use the kubernetes/jwks join method
 	clock := clockwork.NewRealClock()
-	signer, err := fakejoin.NewKubernetesSigner(clock)
+	signer, err := fakeissuer.NewKubernetesSigner(clock)
 	require.NoError(t, err)
 
 	jwks, err := signer.GetMarshaledJWKS()
@@ -164,3 +166,135 @@ func TestTerraformJoin(t *testing.T) {
 		},
 	})
 }
+
+func TestTerraformJoinViaProxy(t *testing.T) {
+	require.NoError(t, os.Setenv("TF_ACC", "true"))
+
+	// Test setup: start a full Teleport process including a proxy.
+	process, err := testenv.NewTeleportProcess(t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
+
+	// Test setup: get the terraform role
+	tfRole, err := clt.GetRole(t.Context(), teleport.PresetTerraformProviderRoleName)
+	require.NoError(t, err)
+
+	// Test setup: create a fake Kubernetes signer that will allow us to use the kubernetes/jwks join method
+	clock := clockwork.NewRealClock()
+	signer, err := fakeissuer.NewKubernetesSigner(clock)
+	require.NoError(t, err)
+
+	jwks, err := signer.GetMarshaledJWKS()
+	require.NoError(t, err)
+
+	// Test setup: create a token and a bot that can join the cluster with JWT signed by our fake Kubernetes signer
+	testBotName := "testBot"
+	testTokenName := "testToken"
+	fakeNamespace := "test-namespace"
+	fakeServiceAccount := "test-service-account"
+	token, err := types.NewProvisionTokenFromSpec(
+		testTokenName,
+		clock.Now().Add(time.Hour),
+		types.ProvisionTokenSpecV2{
+			Roles:      types.SystemRoles{types.RoleBot},
+			JoinMethod: types.JoinMethodKubernetes,
+			BotName:    testBotName,
+			Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+				Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+					{
+						ServiceAccount: fmt.Sprintf("%s:%s", fakeNamespace, fakeServiceAccount),
+					},
+				},
+				Type: types.KubernetesJoinTypeStaticJWKS,
+				StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
+					JWKS: jwks,
+				},
+			},
+		})
+	require.NoError(t, err)
+	err = clt.CreateToken(t.Context(), token)
+	require.NoError(t, err)
+
+	bot := &machineidv1.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: testBotName,
+		},
+		Spec: &machineidv1.BotSpec{
+			Roles: []string{tfRole.GetName()},
+		},
+	}
+	_, err = clt.BotServiceClient().CreateBot(t.Context(), &machineidv1.CreateBotRequest{Bot: bot})
+	require.NoError(t, err)
+
+	// Test setup: sign a Kube JWT for our bot to join the cluster
+	// We sign the token, write it to a temporary file, and point the embedded tbot to it
+	// with an environment variable.
+	pong, err := clt.Ping(t.Context())
+	require.NoError(t, err)
+	clusterName := pong.ClusterName
+	jwt, err := signer.SignServiceAccountJWT("pod-name-doesnt-matter", fakeNamespace, fakeServiceAccount, clusterName)
+	require.NoError(t, err)
+
+	tempDir := t.TempDir()
+	jwtPath := filepath.Join(tempDir, "token")
+	require.NoError(t, os.WriteFile(jwtPath, []byte(jwt), 0600))
+	require.NoError(t, os.Setenv(kubetoken.EnvVarCustomKubernetesTokenPath, jwtPath))
+
+	// Test setup: craft a Terraform provider configuration
+	proxyAddr, err := process.ProxyTunnelAddr()
+	require.NoError(t, err)
+
+	terraformConfig := fmt.Sprintf(`
+		provider "teleport" {
+			addr = %q
+			join_token = %q
+			join_method = %q
+			insecure = true
+			retry_base_duration = "900ms"
+			retry_cap_duration = "4s"
+			retry_max_tries = "12"
+		}
+	`, proxyAddr, testTokenName, types.JoinMethodKubernetes)
+
+	terraformProvider := provider.New()
+	terraformProviders := make(map[string]func() (tfprotov6.ProviderServer, error))
+	terraformProviders["teleport"] = func() (tfprotov6.ProviderServer, error) {
+		// Terraform configures provider on every test step, but does not clean up previous one, which produces
+		// to "too many open files" at some point.
+		//
+		// With this statement we try to forcefully close previously opened client, which stays cached in
+		// the provider variable.
+		p, ok := terraformProvider.(*provider.Provider)
+		require.True(t, ok)
+		require.NoError(t, p.Close())
+		return providerserver.NewProtocol6(terraformProvider)(), nil
+	}
+
+	// Test execution: apply a TF resource with the provider joining via MachineID
+	dummyResource, err := fixtures.ReadFile(filepath.Join("fixtures", "app_0_create.tf"))
+	require.NoError(t, err)
+	testConfig := terraformConfig + "\n" + string(dummyResource)
+	name := "teleport_app.test"
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: terraformProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "kind", "app"),
+					resource.TestCheckResourceAttr(name, "spec.uri", "localhost:3000"),
+				),
+			},
+		},
+	})
+}
diff --git a/integrations/terraform/testlib/role_test.go b/integrations/terraform/testlib/role_test.go
index 69a235cb3335d..f406943f2fad8 100644
--- a/integrations/terraform/testlib/role_test.go
+++ b/integrations/terraform/testlib/role_test.go
@@ -96,7 +96,7 @@ func (s *TerraformSuiteOSS) TestRole() {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(name, "kind", "role"),
 					resource.TestCheckNoResourceAttr(name, "spec.options"),
-					resource.TestCheckResourceAttr(name, "version", "v7"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
 					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "anonymous"),
 				),
 			},
@@ -119,7 +119,7 @@ func (s *TerraformSuiteOSS) TestRole() {
 					resource.TestCheckResourceAttr(name, "spec.allow.node_labels.example.0", "yes"),
 					resource.TestCheckResourceAttr(name, "spec.allow.node_labels.example.1", "no"),
 
-					resource.TestCheckResourceAttr(name, "version", "v7"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
 				),
 			},
 			{
@@ -263,7 +263,7 @@ func (s *TerraformSuiteOSS) TestRoleLoginsSplitBrain() {
 				Config: s.getFixture("role_drift_0.tf"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(name, "kind", "role"),
-					resource.TestCheckResourceAttr(name, "version", "v7"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
 					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "one"),
 				),
 			},
@@ -287,7 +287,7 @@ func (s *TerraformSuiteOSS) TestRoleLoginsSplitBrain() {
 				Config: s.getFixture("role_drift_0.tf"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(name, "kind", "role"),
-					resource.TestCheckResourceAttr(name, "version", "v7"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
 					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "one"),
 				),
 			},
@@ -296,13 +296,6 @@ func (s *TerraformSuiteOSS) TestRoleLoginsSplitBrain() {
 }
 
 func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
-	// TODO(hugoShaka) Re-enable this test when we fix the role defaults in v16
-	// We had a bug in v14 and below that caused the defaults to be badly computed.
-	// We tried to fix this bug in v15 but it was too aggressive (forcing replacement is too destructive).
-	// In v16 we'll push a new plan modifier to fix this issue, this might be a
-	// breaking change for users who relied on the bug.
-	s.T().Skip("Test temporarily disabled until v16")
-
 	ctx, cancel := context.WithCancel(context.Background())
 	s.T().Cleanup(cancel)
 
@@ -335,7 +328,17 @@ func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
 		},
 	}
 
-	customWildcard := []types.KubernetesResource{
+	defaultV8Wildcard := []types.KubernetesResource{
+		{
+			Kind:      types.Wildcard,
+			Namespace: types.Wildcard,
+			Name:      types.Wildcard,
+			Verbs:     []string{types.Wildcard},
+			APIGroup:  types.Wildcard,
+		},
+	}
+
+	customV6KubeResources := []types.KubernetesResource{
 		{
 			Kind:      types.KindKubePod,
 			Namespace: "myns",
@@ -344,6 +347,15 @@ func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
 		},
 	}
 
+	customV7KubeResources := []types.KubernetesResource{
+		{
+			Kind:      types.KindKubeDeployment,
+			Namespace: "myns",
+			Name:      types.Wildcard,
+			Verbs:     []string{types.KubeVerbGet},
+		},
+	}
+
 	checkRoleResource := func(version string, expected []types.KubernetesResource) resource.TestCheckFunc {
 		return func(state *terraform.State) error {
 			role, err := s.client.GetRole(ctx, "upgrade")
@@ -414,7 +426,7 @@ func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
 				PlanOnly: true,
 			},
 			{
-				Config: s.getFixture("role_with_kube_resources.tf"),
+				Config: s.getFixture("role_upgrade_v6_with_kube_resources.tf"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(name, "kind", "role"),
 					resource.TestCheckResourceAttr(name, "version", "v6"),
@@ -422,11 +434,11 @@ func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.kind", "pod"),
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.name", "*"),
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.namespace", "myns"),
-					checkRoleResource(types.V6, customWildcard),
+					checkRoleResource(types.V6, customV6KubeResources),
 				),
 			},
 			{
-				Config:   s.getFixture("role_with_kube_resources.tf"),
+				Config:   s.getFixture("role_upgrade_v6_with_kube_resources.tf"),
 				PlanOnly: true,
 			},
 			{
@@ -442,6 +454,36 @@ func (s *TerraformSuiteOSS) TestRoleVersionUpgrade() {
 				Config:   s.getFixture("role_upgrade_v7.tf"),
 				PlanOnly: true,
 			},
+			{
+				Config: s.getFixture("role_upgrade_v7_with_kube_resources.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "kind", "role"),
+					resource.TestCheckResourceAttr(name, "version", "v7"),
+					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "onev7"),
+					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.kind", "deployment"),
+					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.name", "*"),
+					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.namespace", "myns"),
+					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.verbs.0", "get"),
+					checkRoleResource(types.V7, customV7KubeResources),
+				),
+			},
+			{
+				Config:   s.getFixture("role_upgrade_v7_with_kube_resources.tf"),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture("role_upgrade_v8.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, "kind", "role"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
+					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "onev8"),
+					checkRoleResource(types.V8, defaultV8Wildcard),
+				),
+			},
+			{
+				Config:   s.getFixture("role_upgrade_v8.tf"),
+				PlanOnly: true,
+			},
 		},
 	})
 }
@@ -451,34 +493,82 @@ func (s *TerraformSuiteOSS) TestRoleWithKubernetesResources() {
 	s.T().Cleanup(cancel)
 
 	checkDestroyed := func(state *terraform.State) error {
-		_, err := s.client.GetRole(ctx, "upgrade")
-		if trace.IsNotFound(err) {
-			return nil
+		_, err := s.client.GetRole(ctx, "kube_resources_v6")
+		if err != nil && !trace.IsNotFound(err) {
+			return err
 		}
-
-		return err
+		_, err = s.client.GetRole(ctx, "kube_resources_v7")
+		if err != nil && !trace.IsNotFound(err) {
+			return err
+		}
+		_, err = s.client.GetRole(ctx, "kube_resources_v8")
+		if err != nil && !trace.IsNotFound(err) {
+			return err
+		}
+		return nil
 	}
 
-	name := "teleport_role.upgrade"
+	nameV6 := "teleport_role.kube_resources_v6"
+	nameV7 := "teleport_role.kube_resources_v7"
+	nameV8 := "teleport_role.kube_resources_v8"
 
 	resource.Test(s.T(), resource.TestCase{
 		ProtoV6ProviderFactories: s.terraformProviders,
 		CheckDestroy:             checkDestroyed,
 		Steps: []resource.TestStep{
 			{
-				Config: s.getFixture("role_with_kube_resources.tf"),
+				Config: s.getFixture("role_with_kube_resources_v6.tf"),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(name, "kind", "role"),
-					resource.TestCheckResourceAttr(name, "version", "v6"),
-					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "onev6"),
-					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.kind", "pod"),
-					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.name", "*"),
-					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.namespace", "myns"),
-					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.verbs.0", "*"),
+					resource.TestCheckResourceAttr(nameV6, "kind", "role"),
+					resource.TestCheckResourceAttr(nameV6, "version", "v6"),
+					resource.TestCheckResourceAttr(nameV6, "spec.allow.logins.0", "onev6"),
+					resource.TestCheckResourceAttr(nameV6, "spec.allow.kubernetes_resources.0.kind", "pod"),
+					resource.TestCheckResourceAttr(nameV6, "spec.allow.kubernetes_resources.0.name", "*"),
+					resource.TestCheckResourceAttr(nameV6, "spec.allow.kubernetes_resources.0.namespace", "myns"),
+					resource.TestCheckResourceAttr(nameV6, "spec.allow.kubernetes_resources.0.verbs.0", "*"),
+				),
+			},
+			{
+				Config:   s.getFixture("role_with_kube_resources_v6.tf"),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture("role_with_kube_resources_v7.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(nameV7, "kind", "role"),
+					resource.TestCheckResourceAttr(nameV7, "version", "v7"),
+					resource.TestCheckResourceAttr(nameV7, "spec.allow.logins.0", "onev7"),
+					resource.TestCheckResourceAttr(nameV7, "spec.allow.kubernetes_resources.0.kind", "deployment"),
+					resource.TestCheckResourceAttr(nameV7, "spec.allow.kubernetes_resources.0.name", "*"),
+					resource.TestCheckResourceAttr(nameV7, "spec.allow.kubernetes_resources.0.namespace", "myns"),
+					resource.TestCheckResourceAttr(nameV7, "spec.allow.kubernetes_resources.0.verbs.0", "get"),
 				),
 			},
 			{
-				Config:   s.getFixture("role_with_kube_resources.tf"),
+				Config:   s.getFixture("role_with_kube_resources_v7.tf"),
+				PlanOnly: true,
+			},
+			{
+				Config: s.getFixture("role_with_kube_resources_v8.tf"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(nameV8, "kind", "role"),
+					resource.TestCheckResourceAttr(nameV8, "version", "v8"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.logins.0", "onev8"),
+
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.0.kind", "pods"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.0.name", "*"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.0.namespace", "myns"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.0.verbs.0", "get"),
+
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.1.kind", "deployments"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.1.api_group", "apps"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.1.name", "*"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.1.namespace", "myns"),
+					resource.TestCheckResourceAttr(nameV8, "spec.allow.kubernetes_resources.1.verbs.0", "get"),
+				),
+			},
+			{
+				Config:   s.getFixture("role_with_kube_resources_v8.tf"),
 				PlanOnly: true,
 			},
 		},
@@ -508,9 +598,9 @@ func (s *TerraformSuiteOSS) TestRoleWithKubernetesVerbs() {
 				Config: s.getFixture("role_with_kube_verbs.tf"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(name, "kind", "role"),
-					resource.TestCheckResourceAttr(name, "version", "v7"),
-					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "onev6"),
-					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.kind", "pod"),
+					resource.TestCheckResourceAttr(name, "version", "v8"),
+					resource.TestCheckResourceAttr(name, "spec.allow.logins.0", "onev8"),
+					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.kind", "pods"),
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.name", "*"),
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.namespace", "myns"),
 					resource.TestCheckResourceAttr(name, "spec.allow.kubernetes_resources.0.verbs.0", "get"),
diff --git a/integrations/terraform/testlib/terraform_oss_test.go b/integrations/terraform/testlib/terraform_oss_test.go
index 09923b89dc031..c8cd7acf11974 100644
--- a/integrations/terraform/testlib/terraform_oss_test.go
+++ b/integrations/terraform/testlib/terraform_oss_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/stretchr/testify/suite"
 
 	"github.com/gravitational/teleport/integrations/lib/testing/integration"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 )
 
 func TestTerraformOSS(t *testing.T) {
@@ -37,7 +37,7 @@ func TestTerraformOSSWithCache(t *testing.T) {
 	suite.Run(t, &TerraformSuiteOSSWithCache{
 		TerraformBaseSuite: TerraformBaseSuite{
 			AuthHelper: &integration.MinimalAuthHelper{
-				AuthConfig: auth.TestAuthServerConfig{CacheEnabled: true},
+				AuthConfig: authtest.AuthServerConfig{CacheEnabled: true},
 			},
 		},
 	})
diff --git a/integrations/terraform/tfschema/accesslist/v1/accesslist_terraform.go b/integrations/terraform/tfschema/accesslist/v1/accesslist_terraform.go
index 351fa29320af1..3357c7cccff0a 100644
--- a/integrations/terraform/tfschema/accesslist/v1/accesslist_terraform.go
+++ b/integrations/terraform/tfschema/accesslist/v1/accesslist_terraform.go
@@ -147,16 +147,16 @@ func GenSchemaAccessList(ctx context.Context) (github_com_hashicorp_terraform_pl
 								},
 								"frequency": {
 									Description: "frequency is the frequency of reviews. This represents the period in months between two reviews. Supported values are 0, 1, 3, 6, and 12.",
-									Required:    true,
+									Optional:    true,
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
 								},
 							}),
 							Description: "recurrence is the recurrence definition",
-							Required:    true,
+							Optional:    true,
 						},
 					}),
 					Description: "audit describes the frequency that this Access List must be audited.",
-					Required:    true,
+					Optional:    true,
 				},
 				"description": {
 					Description: "description is an optional plaintext description of the Access List.",
@@ -188,7 +188,7 @@ func GenSchemaAccessList(ctx context.Context) (github_com_hashicorp_terraform_pl
 						},
 					}),
 					Description: "grants describes the access granted by membership to this Access List.",
-					Required:    true,
+					Optional:    true,
 				},
 				"membership_requires": {
 					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
@@ -297,6 +297,11 @@ func GenSchemaAccessList(ctx context.Context) (github_com_hashicorp_terraform_pl
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
+				"type": {
+					Description: "type can be an empty string which denotes a regular Access List, \"scim\" which represents an Access List created from SCIM group or \"static\" for Access Lists managed by IaC tools.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
 			}),
 			Description: "spec is the specification for the Access List.",
 			Optional:    true,
@@ -304,6 +309,132 @@ func GenSchemaAccessList(ctx context.Context) (github_com_hashicorp_terraform_pl
 	}}, nil
 }
 
+// GenSchemaMember returns tfsdk.Schema definition for Member
+func GenSchemaMember(ctx context.Context) (github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema, github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics) {
+	return github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema{Attributes: map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+		"header": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"kind": {
+					Computed:      true,
+					Description:   "kind is a resource kind.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"metadata": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"description": {
+							Description: "description is object description.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"expires": GenSchemaTimestamp(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Computed:      true,
+							Description:   "expires is a global expiry time header can be set on any resource in the system.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Validators:    []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{github_com_gravitational_teleport_integrations_terraform_tfschema.MustTimeBeInFuture()},
+						}),
+						"labels": {
+							Description: "labels is a set of labels.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.MapType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"name": {
+							Description:   "name is an object name.",
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
+							Required:      true,
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"namespace": {
+							Computed:      true,
+							Description:   "namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"revision": {
+							Computed:      true,
+							Description:   "revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "metadata is resource metadata.",
+					Optional:    true,
+				},
+				"sub_kind": {
+					Description: "sub_kind is an optional resource sub kind, used in some resources.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"version": {
+					Description: "Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by \"v\". For example: `v1`",
+					Required:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+			}),
+			Description: "header is the header for the resource.",
+			Optional:    true,
+		},
+		"id": {
+			Computed:      true,
+			Optional:      false,
+			PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+			Required:      false,
+			Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
+		"spec": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"access_list": {
+					Description:   "associated Access List",
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
+					Required:      true,
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"added_by": {
+					Computed:      true,
+					Description:   "added_by is the user that added this user to the Access List.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"expires": GenSchemaTimestamp(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+					Description: "expires is when the user's membership to the Access List expires.",
+					Optional:    true,
+				}),
+				"joined": GenSchemaTimestamp(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+					Computed:      true,
+					Description:   "joined is when the user joined the Access List.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+				}),
+				"membership_kind": {
+					Description:   "membership_kind describes the type of membership, either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.",
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
+					Required:      true,
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+				},
+				"name": {
+					Computed:      true,
+					Description:   "name is the name of the member of the Access List.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"reason": {
+					Description: "reason is the reason this user was added to the Access List.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+			}),
+			Description: "spec is the specification for the Access List member.",
+			Optional:    true,
+		},
+	}}, nil
+}
+
 // CopyAccessListFromTerraform copies contents of the source Terraform object into a target struct
 func CopyAccessListFromTerraform(_ context.Context, tf github_com_hashicorp_terraform_plugin_framework_types.Object, obj *github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.AccessList) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
 	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
@@ -1198,6 +1329,23 @@ func CopyAccessListFromTerraform(_ context.Context, tf github_com_hashicorp_terr
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["type"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"AccessList.spec.type"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"AccessList.spec.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Type = t
+							}
+						}
+					}
 				}
 			}
 		}
@@ -2714,6 +2862,788 @@ func CopyAccessListToTerraform(ctx context.Context, obj *github_com_gravitationa
 							}
 						}
 					}
+					{
+						t, ok := tf.AttrTypes["type"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"AccessList.spec.type"})
+						} else {
+							v, ok := tf.Attrs["type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"AccessList.spec.type", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"AccessList.spec.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Type) == ""
+							}
+							v.Value = string(obj.Type)
+							v.Unknown = false
+							tf.Attrs["type"] = v
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["spec"] = v
+			}
+		}
+	}
+	return diags
+}
+
+// CopyMemberFromTerraform copies contents of the source Terraform object into a target struct
+func CopyMemberFromTerraform(_ context.Context, tf github_com_hashicorp_terraform_plugin_framework_types.Object, obj *github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.Member) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	{
+		a, ok := tf.Attrs["header"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"Member.header"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"Member.header", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Header = nil
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj.Header = &github_com_gravitational_teleport_api_gen_proto_go_teleport_header_v1.ResourceHeader{}
+					obj := obj.Header
+					{
+						a, ok := tf.Attrs["kind"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.header.kind"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.header.kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Kind = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["sub_kind"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.header.sub_kind"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.header.sub_kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.SubKind = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["version"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.header.version"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.header.version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Version = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["metadata"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.header.metadata"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.header.metadata", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.Metadata = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.Metadata = &github_com_gravitational_teleport_api_gen_proto_go_teleport_header_v1.Metadata{}
+									obj := obj.Metadata
+									{
+										a, ok := tf.Attrs["name"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.name"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Name = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["namespace"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.namespace"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Namespace = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["description"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.description"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Description = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["labels"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.labels"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Map)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.Map"})
+											} else {
+												obj.Labels = make(map[string]string, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.labels", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.Labels[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["expires"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.expires"})
+										}
+										CopyFromTimestamp(diags, a, &obj.Expires)
+									}
+									{
+										a, ok := tf.Attrs["revision"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"Member.header.metadata.revision"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"Member.header.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Revision = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["spec"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"Member.spec"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"Member.spec", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Spec = nil
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj.Spec = &github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.MemberSpec{}
+					obj := obj.Spec
+					{
+						a, ok := tf.Attrs["access_list"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.access_list"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.spec.access_list", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.AccessList = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["name"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.name"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.spec.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Name = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["joined"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.joined"})
+						}
+						CopyFromTimestamp(diags, a, &obj.Joined)
+					}
+					{
+						a, ok := tf.Attrs["expires"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.expires"})
+						}
+						CopyFromTimestamp(diags, a, &obj.Expires)
+					}
+					{
+						a, ok := tf.Attrs["reason"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.reason"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.spec.reason", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Reason = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["added_by"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.added_by"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.spec.added_by", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.AddedBy = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["membership_kind"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"Member.spec.membership_kind"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"Member.spec.membership_kind", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+							} else {
+								var t github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.MembershipKind
+								if !v.Null && !v.Unknown {
+									t = github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.MembershipKind(v.Value)
+								}
+								obj.MembershipKind = t
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return diags
+}
+
+// CopyMemberToTerraform copies contents of the source Terraform object into a target struct
+func CopyMemberToTerraform(ctx context.Context, obj *github_com_gravitational_teleport_api_gen_proto_go_teleport_accesslist_v1.Member, tf *github_com_hashicorp_terraform_plugin_framework_types.Object) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	tf.Null = false
+	tf.Unknown = false
+	if tf.Attrs == nil {
+		tf.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value)
+	}
+	{
+		a, ok := tf.AttrTypes["header"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"Member.header"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"Member.header", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["header"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				if obj.Header == nil {
+					v.Null = true
+				} else {
+					obj := obj.Header
+					tf := &v
+					{
+						t, ok := tf.AttrTypes["kind"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.header.kind"})
+						} else {
+							v, ok := tf.Attrs["kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.header.kind", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.header.kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Kind) == ""
+							}
+							v.Value = string(obj.Kind)
+							v.Unknown = false
+							tf.Attrs["kind"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["sub_kind"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.header.sub_kind"})
+						} else {
+							v, ok := tf.Attrs["sub_kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.header.sub_kind", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.header.sub_kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.SubKind) == ""
+							}
+							v.Value = string(obj.SubKind)
+							v.Unknown = false
+							tf.Attrs["sub_kind"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["version"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.header.version"})
+						} else {
+							v, ok := tf.Attrs["version"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.header.version", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.header.version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Version) == ""
+							}
+							v.Value = string(obj.Version)
+							v.Unknown = false
+							tf.Attrs["version"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["metadata"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.header.metadata"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["metadata"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.Metadata == nil {
+									v.Null = true
+								} else {
+									obj := obj.Metadata
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["name"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.name"})
+										} else {
+											v, ok := tf.Attrs["name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"Member.header.metadata.name", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Name) == ""
+											}
+											v.Value = string(obj.Name)
+											v.Unknown = false
+											tf.Attrs["name"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["namespace"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.namespace"})
+										} else {
+											v, ok := tf.Attrs["namespace"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"Member.header.metadata.namespace", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Namespace) == ""
+											}
+											v.Value = string(obj.Namespace)
+											v.Unknown = false
+											tf.Attrs["namespace"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["description"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.description"})
+										} else {
+											v, ok := tf.Attrs["description"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"Member.header.metadata.description", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Description) == ""
+											}
+											v.Value = string(obj.Description)
+											v.Unknown = false
+											tf.Attrs["description"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["labels"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.labels"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.MapType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.MapType"})
+											} else {
+												c, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.Map)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.Map{
+
+														ElemType: o.ElemType,
+														Elems:    make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels))
+													}
+												}
+												if obj.Labels != nil {
+													t := o.ElemType
+													for k, a := range obj.Labels {
+														v, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+															if err != nil {
+																diags.Append(attrWriteGeneralError{"Member.header.metadata.labels", err})
+															}
+															v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															}
+															v.Null = false
+														}
+														v.Value = string(a)
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.Labels) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["labels"] = c
+											}
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["expires"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.expires"})
+										} else {
+											v := CopyToTimestamp(diags, obj.Expires, t, tf.Attrs["expires"])
+											tf.Attrs["expires"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["revision"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"Member.header.metadata.revision"})
+										} else {
+											v, ok := tf.Attrs["revision"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"Member.header.metadata.revision", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"Member.header.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Revision) == ""
+											}
+											v.Value = string(obj.Revision)
+											v.Unknown = false
+											tf.Attrs["revision"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["metadata"] = v
+							}
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["header"] = v
+			}
+		}
+	}
+	{
+		a, ok := tf.AttrTypes["spec"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"Member.spec"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"Member.spec", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["spec"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				if obj.Spec == nil {
+					v.Null = true
+				} else {
+					obj := obj.Spec
+					tf := &v
+					{
+						t, ok := tf.AttrTypes["access_list"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.access_list"})
+						} else {
+							v, ok := tf.Attrs["access_list"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.spec.access_list", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.spec.access_list", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.AccessList) == ""
+							}
+							v.Value = string(obj.AccessList)
+							v.Unknown = false
+							tf.Attrs["access_list"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["name"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.name"})
+						} else {
+							v, ok := tf.Attrs["name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.spec.name", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.spec.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Name) == ""
+							}
+							v.Value = string(obj.Name)
+							v.Unknown = false
+							tf.Attrs["name"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["joined"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.joined"})
+						} else {
+							v := CopyToTimestamp(diags, obj.Joined, t, tf.Attrs["joined"])
+							tf.Attrs["joined"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["expires"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.expires"})
+						} else {
+							v := CopyToTimestamp(diags, obj.Expires, t, tf.Attrs["expires"])
+							tf.Attrs["expires"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["reason"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.reason"})
+						} else {
+							v, ok := tf.Attrs["reason"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.spec.reason", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.spec.reason", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Reason) == ""
+							}
+							v.Value = string(obj.Reason)
+							v.Unknown = false
+							tf.Attrs["reason"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["added_by"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.added_by"})
+						} else {
+							v, ok := tf.Attrs["added_by"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.spec.added_by", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.spec.added_by", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.AddedBy) == ""
+							}
+							v.Value = string(obj.AddedBy)
+							v.Unknown = false
+							tf.Attrs["added_by"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["membership_kind"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"Member.spec.membership_kind"})
+						} else {
+							v, ok := tf.Attrs["membership_kind"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"Member.spec.membership_kind", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"Member.spec.membership_kind", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+								}
+								v.Null = int64(obj.MembershipKind) == 0
+							}
+							v.Value = int64(obj.MembershipKind)
+							v.Unknown = false
+							tf.Attrs["membership_kind"] = v
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
diff --git a/integrations/terraform/tfschema/accessmonitoringrules/v1/access_monitoring_rules_terraform.go b/integrations/terraform/tfschema/accessmonitoringrules/v1/access_monitoring_rules_terraform.go
index a015b4c4ed63d..c7ebd95994ead 100644
--- a/integrations/terraform/tfschema/accessmonitoringrules/v1/access_monitoring_rules_terraform.go
+++ b/integrations/terraform/tfschema/accessmonitoringrules/v1/access_monitoring_rules_terraform.go
@@ -111,7 +111,7 @@ func GenSchemaAccessMonitoringRule(ctx context.Context) (github_com_hashicorp_te
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
 					}),
-					Description: "automatic_review defines automatic review configurations for access requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set.",
+					Description: "automatic_review defines automatic review configurations for Access Requests. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set.",
 					Optional:    true,
 				},
 				"condition": {
@@ -120,7 +120,7 @@ func GenSchemaAccessMonitoringRule(ctx context.Context) (github_com_hashicorp_te
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
 				"desired_state": {
-					Description: "desired_state defines the desired state of the subject. For access request subjects, the desired_state may be set to `reviewed` to indicate that the access request should be automatically reviewed.",
+					Description: "desired_state defines the desired state of the subject. For Access Request subjects, the desired_state may be set to `reviewed` to indicate that the Access Request should be automatically reviewed.",
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
@@ -140,6 +140,42 @@ func GenSchemaAccessMonitoringRule(ctx context.Context) (github_com_hashicorp_te
 					Description: "notification defines the plugin configuration for notifications if rule is triggered. Both notification and automatic_review may be set within the same access_monitoring_rule. If both fields are set, the rule will trigger both notifications and automatic reviews for the same set of access events. Separate plugins may be used if both notifications and automatic_reviews is set.",
 					Optional:    true,
 				},
+				"schedules": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.MapNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"time": {
+						Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							"shifts": {
+								Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+									"end": {
+										Description: "End specifies the end time in the format HH:MM, e.g., \"12:30\".",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									},
+									"start": {
+										Description: "Start specifies the start time in the format HH:MM, e.g., \"12:30\".",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									},
+									"weekday": {
+										Description: "Weekday specifies the day of the week, e.g., \"Sunday\", \"Monday\", \"Tuesday\".",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									},
+								}),
+								Description: "Shifts contains a set of shifts that make up the schedule.",
+								Optional:    true,
+							},
+							"timezone": {
+								Description: "Timezone specifies the schedule timezone. This field is optional and defaults to \"UTC\". Accepted values use timezone locations as defined in the IANA Time Zone Database, such as \"America/Los_Angeles\", \"Europe/Lisbon\", or \"Asia/Singapore\".  See https://data.iana.org/time-zones/tzdb/zone1970.tab for a list of supported values.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+						}),
+						Description: "TimeSchedule specifies an in-line schedule.",
+						Optional:    true,
+					}}),
+					Description: "schedules specifies a map of schedules that can be used to configure the access monitoring rule conditions.  Available in Teleport v18.2.8 or higher.",
+					Optional:    true,
+				},
 				"states": {
 					Description: "states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.",
 					Optional:    true,
@@ -557,6 +593,150 @@ func CopyAccessMonitoringRuleFromTerraform(_ context.Context, tf github_com_hash
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["schedules"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Map)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules", "github.com/hashicorp/terraform-plugin-framework/types.Map"})
+							} else {
+								obj.Schedules = make(map[string]*github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.Schedule, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.Schedule
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.Schedule{}
+												obj := t
+												{
+													a, ok := tf.Attrs["time"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.Time = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.Time = &github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.TimeSchedule{}
+																obj := obj.Time
+																{
+																	a, ok := tf.Attrs["shifts"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																		} else {
+																			obj.Shifts = make([]*github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.TimeSchedule_Shift, len(v.Elems))
+																			if !v.Null && !v.Unknown {
+																				for k, a := range v.Elems {
+																					v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																					if !ok {
+																						diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+																					} else {
+																						var t *github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.TimeSchedule_Shift
+																						if !v.Null && !v.Unknown {
+																							tf := v
+																							t = &github_com_gravitational_teleport_api_gen_proto_go_teleport_accessmonitoringrules_v1.TimeSchedule_Shift{}
+																							obj := t
+																							{
+																								a, ok := tf.Attrs["weekday"]
+																								if !ok {
+																									diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.weekday"})
+																								} else {
+																									v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.weekday", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																									} else {
+																										var t string
+																										if !v.Null && !v.Unknown {
+																											t = string(v.Value)
+																										}
+																										obj.Weekday = t
+																									}
+																								}
+																							}
+																							{
+																								a, ok := tf.Attrs["start"]
+																								if !ok {
+																									diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.start"})
+																								} else {
+																									v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.start", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																									} else {
+																										var t string
+																										if !v.Null && !v.Unknown {
+																											t = string(v.Value)
+																										}
+																										obj.Start = t
+																									}
+																								}
+																							}
+																							{
+																								a, ok := tf.Attrs["end"]
+																								if !ok {
+																									diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.end"})
+																								} else {
+																									v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.end", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																									} else {
+																										var t string
+																										if !v.Null && !v.Unknown {
+																											t = string(v.Value)
+																										}
+																										obj.End = t
+																									}
+																								}
+																							}
+																						}
+																						obj.Shifts[k] = t
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["timezone"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"AccessMonitoringRule.spec.schedules.time.timezone"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.timezone", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Timezone = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+											obj.Schedules[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -1176,6 +1356,239 @@ func CopyAccessMonitoringRuleToTerraform(ctx context.Context, obj *github_com_gr
 							tf.Attrs["desired_state"] = v
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["schedules"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.MapType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules", "github.com/hashicorp/terraform-plugin-framework/types.MapType"})
+							} else {
+								c, ok := tf.Attrs["schedules"].(github_com_hashicorp_terraform_plugin_framework_types.Map)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.Map{
+
+										ElemType: o.ElemType,
+										Elems:    make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Schedules)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Schedules))
+									}
+								}
+								if obj.Schedules != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									for k, a := range obj.Schedules {
+										v, ok := tf.Attrs["schedules"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												a, ok := tf.AttrTypes["time"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["time"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.Time == nil {
+															v.Null = true
+														} else {
+															obj := obj.Time
+															tf := &v
+															{
+																a, ok := tf.AttrTypes["shifts"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																	} else {
+																		c, ok := tf.Attrs["shifts"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																				ElemType: o.ElemType,
+																				Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Shifts)),
+																				Null:     true,
+																			}
+																		} else {
+																			if c.Elems == nil {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Shifts))
+																			}
+																		}
+																		if obj.Shifts != nil {
+																			o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																			if len(obj.Shifts) != len(c.Elems) {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Shifts))
+																			}
+																			for k, a := range obj.Shifts {
+																				v, ok := tf.Attrs["shifts"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																				if !ok {
+																					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																						AttrTypes: o.AttrTypes,
+																						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																					}
+																				} else {
+																					if v.Attrs == nil {
+																						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																					}
+																				}
+																				if a == nil {
+																					v.Null = true
+																				} else {
+																					obj := a
+																					tf := &v
+																					{
+																						t, ok := tf.AttrTypes["weekday"]
+																						if !ok {
+																							diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.weekday"})
+																						} else {
+																							v, ok := tf.Attrs["weekday"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																							if !ok {
+																								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																								if err != nil {
+																									diags.Append(attrWriteGeneralError{"AccessMonitoringRule.spec.schedules.time.shifts.weekday", err})
+																								}
+																								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																								if !ok {
+																									diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.weekday", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																								}
+																								v.Null = string(obj.Weekday) == ""
+																							}
+																							v.Value = string(obj.Weekday)
+																							v.Unknown = false
+																							tf.Attrs["weekday"] = v
+																						}
+																					}
+																					{
+																						t, ok := tf.AttrTypes["start"]
+																						if !ok {
+																							diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.start"})
+																						} else {
+																							v, ok := tf.Attrs["start"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																							if !ok {
+																								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																								if err != nil {
+																									diags.Append(attrWriteGeneralError{"AccessMonitoringRule.spec.schedules.time.shifts.start", err})
+																								}
+																								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																								if !ok {
+																									diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.start", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																								}
+																								v.Null = string(obj.Start) == ""
+																							}
+																							v.Value = string(obj.Start)
+																							v.Unknown = false
+																							tf.Attrs["start"] = v
+																						}
+																					}
+																					{
+																						t, ok := tf.AttrTypes["end"]
+																						if !ok {
+																							diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time.shifts.end"})
+																						} else {
+																							v, ok := tf.Attrs["end"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																							if !ok {
+																								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																								if err != nil {
+																									diags.Append(attrWriteGeneralError{"AccessMonitoringRule.spec.schedules.time.shifts.end", err})
+																								}
+																								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																								if !ok {
+																									diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.shifts.end", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																								}
+																								v.Null = string(obj.End) == ""
+																							}
+																							v.Value = string(obj.End)
+																							v.Unknown = false
+																							tf.Attrs["end"] = v
+																						}
+																					}
+																				}
+																				v.Unknown = false
+																				c.Elems[k] = v
+																			}
+																			if len(obj.Shifts) > 0 {
+																				c.Null = false
+																			}
+																		}
+																		c.Unknown = false
+																		tf.Attrs["shifts"] = c
+																	}
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["timezone"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"AccessMonitoringRule.spec.schedules.time.timezone"})
+																} else {
+																	v, ok := tf.Attrs["timezone"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"AccessMonitoringRule.spec.schedules.time.timezone", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"AccessMonitoringRule.spec.schedules.time.timezone", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Timezone) == ""
+																	}
+																	v.Value = string(obj.Timezone)
+																	v.Unknown = false
+																	tf.Attrs["timezone"] = v
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["time"] = v
+													}
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Schedules) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["schedules"] = c
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
diff --git a/integrations/terraform/tfschema/autoupdate/v1/autoupdate_terraform.go b/integrations/terraform/tfschema/autoupdate/v1/autoupdate_terraform.go
index fe0cbc478dd30..2112b52da0f6e 100644
--- a/integrations/terraform/tfschema/autoupdate/v1/autoupdate_terraform.go
+++ b/integrations/terraform/tfschema/autoupdate/v1/autoupdate_terraform.go
@@ -83,18 +83,6 @@ func GenSchemaAutoUpdateConfig(ctx context.Context) (github_com_hashicorp_terraf
 					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
 					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
-				"namespace": {
-					Computed:      true,
-					Description:   "namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
-					Optional:      true,
-					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
-					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
-				},
-				"revision": {
-					Description: "revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
-					Optional:    true,
-					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-				},
 			}),
 			Computed:      true,
 			Description:   "",
@@ -117,6 +105,11 @@ func GenSchemaAutoUpdateConfig(ctx context.Context) (github_com_hashicorp_terraf
 						"schedules": {
 							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"regular": {
 								Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+									"canary_count": {
+										Description: "canary_count is the number of canary agents that will be updated before the whole group is updated. when set to 0, the group does not enter the canary phase. This number is capped to 5. This number must always be lower than the total number of agents in the group, else the rollout will be stuck.",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+									},
 									"days": {
 										Description: "days when the update can run. Supported values are \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\", \"Sun\" and \"*\"",
 										Optional:    true,
@@ -220,18 +213,6 @@ func GenSchemaAutoUpdateVersion(ctx context.Context) (github_com_hashicorp_terra
 					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
 					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
-				"namespace": {
-					Computed:      true,
-					Description:   "namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
-					Optional:      true,
-					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
-					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
-				},
-				"revision": {
-					Description: "revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
-					Optional:    true,
-					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-				},
 			}),
 			Computed:      true,
 			Description:   "",
@@ -253,12 +234,12 @@ func GenSchemaAutoUpdateVersion(ctx context.Context) (github_com_hashicorp_terra
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
 						"start_version": {
-							Description: "start_version is the version to update from.",
+							Description: "start_version is the version used for newly installed agents before their update window.",
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
 						"target_version": {
-							Description: "target_version is the version to update to.",
+							Description: "target_version is the version that all agents will update to during their update window.",
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
@@ -377,23 +358,6 @@ func CopyAutoUpdateConfigFromTerraform(_ context.Context, tf github_com_hashicor
 							}
 						}
 					}
-					{
-						a, ok := tf.Attrs["namespace"]
-						if !ok {
-							diags.Append(attrReadMissingDiag{"AutoUpdateConfig.metadata.namespace"})
-						} else {
-							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								diags.Append(attrReadConversionFailureDiag{"AutoUpdateConfig.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-							} else {
-								var t string
-								if !v.Null && !v.Unknown {
-									t = string(v.Value)
-								}
-								obj.Namespace = t
-							}
-						}
-					}
 					{
 						a, ok := tf.Attrs["description"]
 						if !ok {
@@ -445,23 +409,6 @@ func CopyAutoUpdateConfigFromTerraform(_ context.Context, tf github_com_hashicor
 						}
 						CopyFromTimestamp(diags, a, &obj.Expires)
 					}
-					{
-						a, ok := tf.Attrs["revision"]
-						if !ok {
-							diags.Append(attrReadMissingDiag{"AutoUpdateConfig.metadata.revision"})
-						} else {
-							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								diags.Append(attrReadConversionFailureDiag{"AutoUpdateConfig.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-							} else {
-								var t string
-								if !v.Null && !v.Unknown {
-									t = string(v.Value)
-								}
-								obj.Revision = t
-							}
-						}
-					}
 				}
 			}
 		}
@@ -683,6 +630,23 @@ func CopyAutoUpdateConfigFromTerraform(_ context.Context, tf github_com_hashicor
 																						}
 																					}
 																				}
+																				{
+																					a, ok := tf.Attrs["canary_count"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"AutoUpdateConfig.spec.agents.schedules.regular.canary_count"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"AutoUpdateConfig.spec.agents.schedules.regular.canary_count", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																						} else {
+																							var t int32
+																							if !v.Null && !v.Unknown {
+																								t = int32(v.Value)
+																							}
+																							obj.CanaryCount = t
+																						}
+																					}
+																				}
 																			}
 																			obj.Regular[k] = t
 																		}
@@ -828,28 +792,6 @@ func CopyAutoUpdateConfigToTerraform(ctx context.Context, obj *github_com_gravit
 							tf.Attrs["name"] = v
 						}
 					}
-					{
-						t, ok := tf.AttrTypes["namespace"]
-						if !ok {
-							diags.Append(attrWriteMissingDiag{"AutoUpdateConfig.metadata.namespace"})
-						} else {
-							v, ok := tf.Attrs["namespace"].(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
-								if err != nil {
-									diags.Append(attrWriteGeneralError{"AutoUpdateConfig.metadata.namespace", err})
-								}
-								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
-								if !ok {
-									diags.Append(attrWriteConversionFailureDiag{"AutoUpdateConfig.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-								}
-								v.Null = string(obj.Namespace) == ""
-							}
-							v.Value = string(obj.Namespace)
-							v.Unknown = false
-							tf.Attrs["namespace"] = v
-						}
-					}
 					{
 						t, ok := tf.AttrTypes["description"]
 						if !ok {
@@ -931,28 +873,6 @@ func CopyAutoUpdateConfigToTerraform(ctx context.Context, obj *github_com_gravit
 							tf.Attrs["expires"] = v
 						}
 					}
-					{
-						t, ok := tf.AttrTypes["revision"]
-						if !ok {
-							diags.Append(attrWriteMissingDiag{"AutoUpdateConfig.metadata.revision"})
-						} else {
-							v, ok := tf.Attrs["revision"].(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
-								if err != nil {
-									diags.Append(attrWriteGeneralError{"AutoUpdateConfig.metadata.revision", err})
-								}
-								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
-								if !ok {
-									diags.Append(attrWriteConversionFailureDiag{"AutoUpdateConfig.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-								}
-								v.Null = string(obj.Revision) == ""
-							}
-							v.Value = string(obj.Revision)
-							v.Unknown = false
-							tf.Attrs["revision"] = v
-						}
-					}
 				}
 				v.Unknown = false
 				tf.Attrs["metadata"] = v
@@ -1308,6 +1228,28 @@ func CopyAutoUpdateConfigToTerraform(ctx context.Context, obj *github_com_gravit
 																					tf.Attrs["wait_hours"] = v
 																				}
 																			}
+																			{
+																				t, ok := tf.AttrTypes["canary_count"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"AutoUpdateConfig.spec.agents.schedules.regular.canary_count"})
+																				} else {
+																					v, ok := tf.Attrs["canary_count"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"AutoUpdateConfig.spec.agents.schedules.regular.canary_count", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"AutoUpdateConfig.spec.agents.schedules.regular.canary_count", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																						}
+																						v.Null = int64(obj.CanaryCount) == 0
+																					}
+																					v.Value = int64(obj.CanaryCount)
+																					v.Unknown = false
+																					tf.Attrs["canary_count"] = v
+																				}
+																			}
 																		}
 																		v.Unknown = false
 																		c.Elems[k] = v
@@ -1427,23 +1369,6 @@ func CopyAutoUpdateVersionFromTerraform(_ context.Context, tf github_com_hashico
 							}
 						}
 					}
-					{
-						a, ok := tf.Attrs["namespace"]
-						if !ok {
-							diags.Append(attrReadMissingDiag{"AutoUpdateVersion.metadata.namespace"})
-						} else {
-							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								diags.Append(attrReadConversionFailureDiag{"AutoUpdateVersion.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-							} else {
-								var t string
-								if !v.Null && !v.Unknown {
-									t = string(v.Value)
-								}
-								obj.Namespace = t
-							}
-						}
-					}
 					{
 						a, ok := tf.Attrs["description"]
 						if !ok {
@@ -1495,23 +1420,6 @@ func CopyAutoUpdateVersionFromTerraform(_ context.Context, tf github_com_hashico
 						}
 						CopyFromTimestamp(diags, a, &obj.Expires)
 					}
-					{
-						a, ok := tf.Attrs["revision"]
-						if !ok {
-							diags.Append(attrReadMissingDiag{"AutoUpdateVersion.metadata.revision"})
-						} else {
-							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								diags.Append(attrReadConversionFailureDiag{"AutoUpdateVersion.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-							} else {
-								var t string
-								if !v.Null && !v.Unknown {
-									t = string(v.Value)
-								}
-								obj.Revision = t
-							}
-						}
-					}
 				}
 			}
 		}
@@ -1780,28 +1688,6 @@ func CopyAutoUpdateVersionToTerraform(ctx context.Context, obj *github_com_gravi
 							tf.Attrs["name"] = v
 						}
 					}
-					{
-						t, ok := tf.AttrTypes["namespace"]
-						if !ok {
-							diags.Append(attrWriteMissingDiag{"AutoUpdateVersion.metadata.namespace"})
-						} else {
-							v, ok := tf.Attrs["namespace"].(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
-								if err != nil {
-									diags.Append(attrWriteGeneralError{"AutoUpdateVersion.metadata.namespace", err})
-								}
-								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
-								if !ok {
-									diags.Append(attrWriteConversionFailureDiag{"AutoUpdateVersion.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-								}
-								v.Null = string(obj.Namespace) == ""
-							}
-							v.Value = string(obj.Namespace)
-							v.Unknown = false
-							tf.Attrs["namespace"] = v
-						}
-					}
 					{
 						t, ok := tf.AttrTypes["description"]
 						if !ok {
@@ -1883,28 +1769,6 @@ func CopyAutoUpdateVersionToTerraform(ctx context.Context, obj *github_com_gravi
 							tf.Attrs["expires"] = v
 						}
 					}
-					{
-						t, ok := tf.AttrTypes["revision"]
-						if !ok {
-							diags.Append(attrWriteMissingDiag{"AutoUpdateVersion.metadata.revision"})
-						} else {
-							v, ok := tf.Attrs["revision"].(github_com_hashicorp_terraform_plugin_framework_types.String)
-							if !ok {
-								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
-								if err != nil {
-									diags.Append(attrWriteGeneralError{"AutoUpdateVersion.metadata.revision", err})
-								}
-								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
-								if !ok {
-									diags.Append(attrWriteConversionFailureDiag{"AutoUpdateVersion.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
-								}
-								v.Null = string(obj.Revision) == ""
-							}
-							v.Value = string(obj.Revision)
-							v.Unknown = false
-							tf.Attrs["revision"] = v
-						}
-					}
 				}
 				v.Unknown = false
 				tf.Attrs["metadata"] = v
diff --git a/integrations/terraform/tfschema/custom_types.go b/integrations/terraform/tfschema/custom_types.go
index 5a0fd458a629b..d05c2e1aae4d4 100644
--- a/integrations/terraform/tfschema/custom_types.go
+++ b/integrations/terraform/tfschema/custom_types.go
@@ -50,7 +50,9 @@ func GenSchemaTraits(_ context.Context, attr tfsdk.Attribute) tfsdk.Attribute {
 				ElemType: types.StringType,
 			},
 		},
-		Description: attr.Description,
+		Description:        attr.Description,
+		DeprecationMessage: attr.DeprecationMessage,
+		Validators:         attr.Validators,
 	}
 }
 
diff --git a/integrations/terraform/tfschema/discoveryconfig/v1/custom_types.go b/integrations/terraform/tfschema/discoveryconfig/v1/custom_types.go
new file mode 100644
index 0000000000000..f7f70a2069e03
--- /dev/null
+++ b/integrations/terraform/tfschema/discoveryconfig/v1/custom_types.go
@@ -0,0 +1,36 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package v1
+
+import (
+	"github.com/gravitational/teleport/integrations/terraform/tfschema"
+	"github.com/gravitational/teleport/integrations/terraform/tfschema/resource153"
+)
+
+type DurationType = tfschema.DurationType
+
+type DurationValue = tfschema.DurationValue
+
+var (
+	GenSchemaTimestamp = resource153.GenSchemaTimestamp
+	CopyToTimestamp    = resource153.CopyToTimestamp
+	CopyFromTimestamp  = resource153.CopyFromTimestamp
+
+	GenSchemaLabels = resource153.GenSchemaLabels
+	CopyFromLabels  = resource153.CopyFromLabels
+	CopyToLabels    = resource153.CopyToLabels
+)
diff --git a/integrations/terraform/tfschema/discoveryconfig/v1/discoveryconfig_terraform.go b/integrations/terraform/tfschema/discoveryconfig/v1/discoveryconfig_terraform.go
new file mode 100644
index 0000000000000..64f19246b3719
--- /dev/null
+++ b/integrations/terraform/tfschema/discoveryconfig/v1/discoveryconfig_terraform.go
@@ -0,0 +1,6139 @@
+/*
+Copyright 2015-2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: teleport/discoveryconfig/v1/discoveryconfig.proto
+
+package v1
+
+import (
+	context "context"
+	fmt "fmt"
+	math "math"
+	time "time"
+
+	proto "github.com/gogo/protobuf/proto"
+	github_com_gravitational_teleport_api_gen_proto_go_teleport_discoveryconfig_v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	github_com_gravitational_teleport_api_gen_proto_go_teleport_header_v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	_ "github.com/gravitational/teleport/api/types"
+	github_com_gravitational_teleport_api_types "github.com/gravitational/teleport/api/types"
+	github_com_gravitational_teleport_integrations_terraform_tfschema "github.com/gravitational/teleport/integrations/terraform/tfschema"
+	github_com_hashicorp_terraform_plugin_framework_attr "github.com/hashicorp/terraform-plugin-framework/attr"
+	github_com_hashicorp_terraform_plugin_framework_diag "github.com/hashicorp/terraform-plugin-framework/diag"
+	github_com_hashicorp_terraform_plugin_framework_tfsdk "github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	github_com_hashicorp_terraform_plugin_framework_types "github.com/hashicorp/terraform-plugin-framework/types"
+	github_com_hashicorp_terraform_plugin_go_tftypes "github.com/hashicorp/terraform-plugin-go/tftypes"
+	_ "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+var _ = time.Kitchen
+
+// GenSchemaDiscoveryConfig returns tfsdk.Schema definition for DiscoveryConfig
+func GenSchemaDiscoveryConfig(ctx context.Context) (github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema, github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics) {
+	return github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema{Attributes: map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+		"header": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"kind": {
+					Computed:      true,
+					Description:   "kind is a resource kind.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"metadata": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"description": {
+							Description: "description is object description.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"expires": GenSchemaTimestamp(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Computed:      true,
+							Description:   "expires is a global expiry time header can be set on any resource in the system.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Validators:    []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{github_com_gravitational_teleport_integrations_terraform_tfschema.MustTimeBeInFuture()},
+						}),
+						"labels": {
+							Description: "labels is a set of labels.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.MapType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"name": {
+							Description:   "name is an object name.",
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
+							Required:      true,
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"namespace": {
+							Computed:      true,
+							Description:   "namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"revision": {
+							Computed:      true,
+							Description:   "revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "metadata is resource metadata.",
+					Required:    true,
+				},
+				"sub_kind": {
+					Computed:      true,
+					Description:   "sub_kind is an optional resource sub kind, used in some resources.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"version": {
+					Description: "Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by \"v\". For example: `v1`",
+					Required:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+			}),
+			Description: "Header is the resource header.",
+			Required:    true,
+		},
+		"id": {
+			Computed:      true,
+			Optional:      false,
+			PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+			Required:      false,
+			Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
+		"spec": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"access_graph": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"aws": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"assume_role": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"external_id": {
+											Description: "ExternalID is the external ID used to assume a role in another account.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"role_arn": {
+											Description: "RoleARN is the fully specified AWS IAM role ARN.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "AssumeRoleARN is the AWS role to assume for database discovery.",
+									Optional:    true,
+								},
+								"cloud_trail_logs": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"region": {
+											Description: "The AWS region of the SQS queue for CloudTrail notifications, ex.: \"us-east-2\".",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"sqs_queue": {
+											Description: "The name or URL for CloudTrail log events, ex.: \"demo-cloudtrail-queue\".",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "Configuration settings for collecting AWS CloudTrail logs via an SQS queue.",
+									Optional:    true,
+								},
+								"eks_audit_logs": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"tags": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										Description: "The tags of EKS clusters for which apiserver audit logs should be fetched.",
+										Optional:    true,
+									})}),
+									Description: "",
+									Optional:    true,
+								},
+								"integration": {
+									Description: "Integration is the integration name used to generate credentials to interact with AWS APIs.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"regions": {
+									Description: "Regions are AWS regions to import resources from.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+								},
+							}),
+							Description: "AWS is a configuration for AWS Access Graph service poll service.",
+							Optional:    true,
+						},
+						"azure": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"integration": {
+									Description: "Integration is the integration name used to generate credentials to interact with AWS APIs.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"subscription_id": {
+									Description: "SubscriptionID Is the ID of the Azure subscription to sync resources from",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "Azure is a configuration for Azure Access Graph service poll service.",
+							Optional:    true,
+						},
+						"poll_interval": {
+							Description: "PollInterval is the frequency at which to poll for resources",
+							Optional:    true,
+							Type:        DurationType{},
+						},
+					}),
+					Description: "AccessGraph is the configurations for syncing Cloud accounts into Access Graph.",
+					Optional:    true,
+				},
+				"aws": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"assume_role": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"external_id": {
+									Description: "ExternalID is the external ID used to assume a role in another account.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"role_arn": {
+									Description: "RoleARN is the fully specified AWS IAM role ARN.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "AssumeRoleARN is the AWS role to assume for database discovery.",
+							Optional:    true,
+						},
+						"install": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"azure": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"client_id": {
+										Description: "ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									}}),
+									Description: "Azure is the set of Azure-specific installation parameters.",
+									Optional:    true,
+								},
+								"enroll_mode": {
+									Description: "EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+								},
+								"http_proxy_settings": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"http_proxy": {
+											Description: "HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"https_proxy": {
+											Description: "HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"no_proxy": {
+											Description: "NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.",
+									Optional:    true,
+								},
+								"install_teleport": {
+									Description: "InstallTeleport disables agentless discovery",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"join_method": {
+									Description: "JoinMethod is the method to use when joining the cluster",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"join_token": {
+									Description: "JoinToken is the token to use when joining the cluster",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"proxy_addr": {
+									Description: "PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"script_name": {
+									Description: "ScriptName is the name of the teleport installer script resource for the cloud instance to execute",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"sshd_config": {
+									Description: "SSHDConfig provides the path to write sshd configuration changes",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"suffix": {
+									Description: "Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"update_group": {
+									Description: "UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "Params sets the join method when installing on discovered EC2 nodes",
+							Optional:    true,
+						},
+						"integration": {
+							Description: "Integration is the integration name used to generate credentials to interact with AWS APIs. Environment credentials will not be used when this value is set.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"kube_app_discovery": {
+							Description: "KubeAppDiscovery controls whether Kubernetes App Discovery will be enabled for agents running on discovered clusters, currently only affects AWS EKS discovery in integration mode.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
+						"organization": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"organization_id": {
+									Description: "OrganizationID is the AWS Organization ID to match against. Required.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"organizational_units": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"exclude": {
+											Description: "Exclude is a list of AWS Organizational Unit IDs to exclude. Only exact matches or wildcard (*) are supported. If empty, no Organizational Units are excluded by default.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+										},
+										"include": {
+											Description: "Include is a list of AWS Organizational Unit IDs to match. Only exact matches or wildcard (*) are supported. If empty, all Organizational Units are included by default.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+										},
+									}),
+									Description: "OrganizationalUnits contains rules for matchings AWS accounts based on their Organizational Units.",
+									Optional:    true,
+								},
+							}),
+							Description: "Organization is an AWS Organization matcher for discovering resources accross multiple accounts under an Organization.",
+							Optional:    true,
+						},
+						"regions": {
+							Description: "Regions are AWS regions to query for databases.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"setup_access_for_arn": {
+							Description: "SetupAccessForARN is the role that the Discovery Service should create EKS Access Entries for. This value should match the IAM identity that Teleport Kubernetes Service uses. If this value is empty, the Discovery Service will attempt to set up access for its own identity (self).",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"ssm": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"document_name": {
+								Description: "DocumentName is the name of the document to use when executing an SSM command",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							}}),
+							Description: "SSM provides options to use when sending a document command to an EC2 node",
+							Optional:    true,
+						},
+						"tags": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Description: "Tags are AWS resource Tags to match.",
+							Optional:    true,
+						}),
+						"types": {
+							Description: "Types are AWS database types to match, \"ec2\", \"rds\", \"redshift\", \"elasticache\", or \"memorydb\".",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+					}),
+					Description: "AWS is a list of AWS Matchers.",
+					Optional:    true,
+				},
+				"azure": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"install_params": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"azure": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"client_id": {
+										Description: "ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.",
+										Required:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									}}),
+									Computed:      true,
+									Description:   "Azure is the set of Azure-specific installation parameters.",
+									Optional:      true,
+									PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+								},
+								"enroll_mode": {
+									Description: "EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+								},
+								"http_proxy_settings": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"http_proxy": {
+											Description: "HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"https_proxy": {
+											Description: "HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"no_proxy": {
+											Description: "NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.",
+									Optional:    true,
+								},
+								"install_teleport": {
+									Description: "InstallTeleport disables agentless discovery",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"join_method": {
+									Description: "JoinMethod is the method to use when joining the cluster",
+									Required:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"join_token": {
+									Description: "JoinToken is the token to use when joining the cluster",
+									Required:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"proxy_addr": {
+									Description: "PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"script_name": {
+									Computed:      true,
+									Description:   "ScriptName is the name of the teleport installer script resource for the cloud instance to execute",
+									Optional:      true,
+									PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+									Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"sshd_config": {
+									Description: "SSHDConfig provides the path to write sshd configuration changes",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"suffix": {
+									Description: "Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"update_group": {
+									Description: "UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Computed:      true,
+							Description:   "Params sets the join method when installing on discovered Azure nodes.",
+							Optional:      true,
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+						},
+						"integration": {
+							Description: "Integration is the integration name used to generate credentials to interact with Azure APIs. Environment credentials will not be used when this value is set.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"regions": {
+							Description: "Regions are Azure locations to match for databases.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"resource_groups": {
+							Description: "ResourceGroups are Azure resource groups to query for resources.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"subscriptions": {
+							Description: "Subscriptions are Azure subscriptions to query for resources.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"tags": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Description: "ResourceTags are Azure tags on resources to match.",
+							Optional:    true,
+						}),
+						"types": {
+							Description: "Types are Azure types to match: \"mysql\", \"postgres\", \"aks\", \"vm\"",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+					}),
+					Description: "Azure is a list of Azure Matchers.",
+					Optional:    true,
+				},
+				"discovery_group": {
+					Description: "DiscoveryGroup is used by discovery_service to add extra matchers. All the discovery_services that have the same discovery_group, will load the matchers of this resource.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"gcp": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"install_params": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"azure": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"client_id": {
+										Description: "ClientID is the client ID of the managed identity discovered nodes should use to join the cluster.",
+										Optional:    true,
+										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+									}}),
+									Description: "Azure is the set of Azure-specific installation parameters.",
+									Optional:    true,
+								},
+								"enroll_mode": {
+									Description: "EnrollMode indicates the enrollment mode to be used when adding a node. Valid values: 0: uses eice for EC2 matchers which use an integration and script for all the other methods 1: uses script mode 2: uses eice mode",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+								},
+								"http_proxy_settings": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"http_proxy": {
+											Description: "HTTPProxy is the URL for the HTTP proxy to use when making requests. When applied, this will set the HTTP_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"https_proxy": {
+											Description: "HTTPSProxy is the URL for the HTTPS Proxy to use when making requests. When applied, this will set the HTTPS_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"no_proxy": {
+											Description: "NoProxy is a comma separated list of URLs that will be excluded from proxying. When applied, this will set the NO_PROXY environment variable.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "HTTPProxySettings defines HTTP proxy settings for making HTTP requests. When set, this will set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables before running the installation.",
+									Optional:    true,
+								},
+								"install_teleport": {
+									Description: "InstallTeleport disables agentless discovery",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"join_method": {
+									Description: "JoinMethod is the method to use when joining the cluster",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"join_token": {
+									Description: "JoinToken is the token to use when joining the cluster",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"proxy_addr": {
+									Description: "PublicProxyAddr is the address of the proxy the discovered node should use to connect to the cluster.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"script_name": {
+									Description: "ScriptName is the name of the teleport installer script resource for the cloud instance to execute",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"sshd_config": {
+									Description: "SSHDConfig provides the path to write sshd configuration changes",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"suffix": {
+									Description: "Suffix indicates the installation suffix for the teleport installation. Set this value if you want multiple installations of Teleport. See --install-suffix flag in teleport-update program. Note: only supported for Amazon EC2. Suffix name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"update_group": {
+									Description: "UpdateGroup indicates the update group for the teleport installation. This value is used to group installations in order to update them in batches. See --group flag in teleport-update program. Note: only supported for Amazon EC2. Group name can only contain alphanumeric characters and hyphens.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "Params sets the join method when installing on discovered GCP nodes.",
+							Optional:    true,
+						},
+						"labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Description: "Labels are GCP labels to match.",
+							Optional:    true,
+						}),
+						"locations": {
+							Description: "Locations are GKE locations to search resources for.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"project_ids": {
+							Description: "ProjectIDs are the GCP project ID where the resources are deployed.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"service_accounts": {
+							Description: "ServiceAccounts are the emails of service accounts attached to VMs.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"tags": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Description: "Tags is obsolete and only exists for backwards compatibility. Use Labels instead.",
+							Optional:    true,
+						}),
+						"types": {
+							Description: "Types are GKE resource types to match: \"gke\", \"vm\".",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+					}),
+					Description: "GCP is a list of GCP Matchers.",
+					Optional:    true,
+				},
+				"kube": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							Description: "Labels are Kubernetes services labels to match.",
+							Optional:    true,
+						}),
+						"namespaces": {
+							Description: "Namespaces are Kubernetes namespaces in which to discover services",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"types": {
+							Description: "Types are Kubernetes services types to match. Currently only 'app' is supported.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+					}),
+					Description: "Kube is a list of Kubernetes Matchers.",
+					Optional:    true,
+				},
+			}),
+			Description: "Spec is an DiscoveryConfig specification.",
+			Required:    true,
+		},
+	}}, nil
+}
+
+// CopyDiscoveryConfigFromTerraform copies contents of the source Terraform object into a target struct
+func CopyDiscoveryConfigFromTerraform(_ context.Context, tf github_com_hashicorp_terraform_plugin_framework_types.Object, obj *github_com_gravitational_teleport_api_gen_proto_go_teleport_discoveryconfig_v1.DiscoveryConfig) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	{
+		a, ok := tf.Attrs["header"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"DiscoveryConfig.header"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Header = nil
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj.Header = &github_com_gravitational_teleport_api_gen_proto_go_teleport_header_v1.ResourceHeader{}
+					obj := obj.Header
+					{
+						a, ok := tf.Attrs["kind"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.kind"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Kind = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["sub_kind"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.sub_kind"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.sub_kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.SubKind = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["version"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.version"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Version = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["metadata"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.Metadata = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.Metadata = &github_com_gravitational_teleport_api_gen_proto_go_teleport_header_v1.Metadata{}
+									obj := obj.Metadata
+									{
+										a, ok := tf.Attrs["name"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.name"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Name = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["namespace"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.namespace"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Namespace = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["description"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.description"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Description = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["labels"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.labels"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Map)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.Map"})
+											} else {
+												obj.Labels = make(map[string]string, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.labels", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.Labels[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["expires"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.expires"})
+										}
+										CopyFromTimestamp(diags, a, &obj.Expires)
+									}
+									{
+										a, ok := tf.Attrs["revision"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.header.metadata.revision"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.header.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Revision = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["spec"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Spec = nil
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj.Spec = &github_com_gravitational_teleport_api_gen_proto_go_teleport_discoveryconfig_v1.DiscoveryConfigSpec{}
+					obj := obj.Spec
+					{
+						a, ok := tf.Attrs["discovery_group"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.discovery_group"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.discovery_group", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.DiscoveryGroup = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["aws"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.Aws = make([]*github_com_gravitational_teleport_api_types.AWSMatcher, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_types.AWSMatcher
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_types.AWSMatcher{}
+												obj := t
+												{
+													a, ok := tf.Attrs["types"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Types"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Types", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Types = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Types", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Types[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["regions"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Regions"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Regions", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Regions = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Regions", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Regions[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["assume_role"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.AssumeRole = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.AssumeRole = &github_com_gravitational_teleport_api_types.AssumeRole{}
+																obj := obj.AssumeRole
+																{
+																	a, ok := tf.Attrs["role_arn"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole.RoleARN"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.RoleARN = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["external_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole.ExternalID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole.ExternalID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ExternalID = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["tags"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Tags"})
+													}
+													CopyFromLabels(diags, a, &obj.Tags)
+												}
+												{
+													a, ok := tf.Attrs["install"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.Params = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.Params = &github_com_gravitational_teleport_api_types.InstallerParams{}
+																obj := obj.Params
+																{
+																	a, ok := tf.Attrs["join_method"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.JoinMethod"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.JoinMethod
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.JoinMethod(v.Value)
+																			}
+																			obj.JoinMethod = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["join_token"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.JoinToken"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.JoinToken = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["script_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.ScriptName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ScriptName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["install_teleport"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.InstallTeleport"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		} else {
+																			var t bool
+																			if !v.Null && !v.Unknown {
+																				t = bool(v.Value)
+																			}
+																			obj.InstallTeleport = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["sshd_config"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.SSHDConfig"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.SSHDConfig = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["proxy_addr"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.PublicProxyAddr"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.PublicProxyAddr = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["azure"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.Azure"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.Azure = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.Azure = &github_com_gravitational_teleport_api_types.AzureInstallerParams{}
+																				obj := obj.Azure
+																				{
+																					a, ok := tf.Attrs["client_id"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.Azure.ClientID"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.ClientID = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["enroll_mode"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.EnrollMode"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.InstallParamEnrollMode
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.InstallParamEnrollMode(v.Value)
+																			}
+																			obj.EnrollMode = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["suffix"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.Suffix"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Suffix = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["update_group"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.UpdateGroup"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.UpdateGroup = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["http_proxy_settings"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.HTTPProxySettings = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.HTTPProxySettings = &github_com_gravitational_teleport_api_types.HTTPProxySettings{}
+																				obj := obj.HTTPProxySettings
+																				{
+																					a, ok := tf.Attrs["http_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["https_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPSProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPSProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["no_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.NoProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.NoProxy = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["ssm"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.SSM"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.SSM", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.SSM = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.SSM = &github_com_gravitational_teleport_api_types.AWSSSM{}
+																obj := obj.SSM
+																{
+																	a, ok := tf.Attrs["document_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.SSM.DocumentName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.SSM.DocumentName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.DocumentName = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["integration"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Integration"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.Integration = t
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["kube_app_discovery"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.KubeAppDiscovery"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.KubeAppDiscovery", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+														} else {
+															var t bool
+															if !v.Null && !v.Unknown {
+																t = bool(v.Value)
+															}
+															obj.KubeAppDiscovery = t
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["setup_access_for_arn"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.SetupAccessForARN"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.SetupAccessForARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.SetupAccessForARN = t
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["organization"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Organization"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.Organization = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.Organization = &github_com_gravitational_teleport_api_types.AWSOrganizationMatcher{}
+																obj := obj.Organization
+																{
+																	a, ok := tf.Attrs["organization_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.OrganizationID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["organizational_units"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.OrganizationalUnits = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.OrganizationalUnits = &github_com_gravitational_teleport_api_types.AWSOrganizationUnitsMatcher{}
+																				obj := obj.OrganizationalUnits
+																				{
+																					a, ok := tf.Attrs["include"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																						} else {
+																							obj.Include = make([]string, len(v.Elems))
+																							if !v.Null && !v.Unknown {
+																								for k, a := range v.Elems {
+																									v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																									} else {
+																										var t string
+																										if !v.Null && !v.Unknown {
+																											t = string(v.Value)
+																										}
+																										obj.Include[k] = t
+																									}
+																								}
+																							}
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["exclude"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																						} else {
+																							obj.Exclude = make([]string, len(v.Elems))
+																							if !v.Null && !v.Unknown {
+																								for k, a := range v.Elems {
+																									v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																									} else {
+																										var t string
+																										if !v.Null && !v.Unknown {
+																											t = string(v.Value)
+																										}
+																										obj.Exclude[k] = t
+																									}
+																								}
+																							}
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+											obj.Aws[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["azure"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.Azure = make([]*github_com_gravitational_teleport_api_types.AzureMatcher, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_types.AzureMatcher
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_types.AzureMatcher{}
+												obj := t
+												{
+													a, ok := tf.Attrs["subscriptions"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Subscriptions"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Subscriptions", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Subscriptions = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Subscriptions", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Subscriptions[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["resource_groups"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.ResourceGroups"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.ResourceGroups", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.ResourceGroups = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.ResourceGroups", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.ResourceGroups[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["types"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Types"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Types", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Types = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Types", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Types[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["regions"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Regions"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Regions", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Regions = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Regions", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Regions[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["tags"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.ResourceTags"})
+													}
+													CopyFromLabels(diags, a, &obj.ResourceTags)
+												}
+												{
+													a, ok := tf.Attrs["install_params"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.Params = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.Params = &github_com_gravitational_teleport_api_types.InstallerParams{}
+																obj := obj.Params
+																{
+																	a, ok := tf.Attrs["join_method"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.JoinMethod"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.JoinMethod
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.JoinMethod(v.Value)
+																			}
+																			obj.JoinMethod = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["join_token"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.JoinToken"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.JoinToken = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["script_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.ScriptName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ScriptName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["install_teleport"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.InstallTeleport"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		} else {
+																			var t bool
+																			if !v.Null && !v.Unknown {
+																				t = bool(v.Value)
+																			}
+																			obj.InstallTeleport = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["sshd_config"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.SSHDConfig"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.SSHDConfig = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["proxy_addr"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.PublicProxyAddr"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.PublicProxyAddr = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["azure"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.Azure"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.Azure = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.Azure = &github_com_gravitational_teleport_api_types.AzureInstallerParams{}
+																				obj := obj.Azure
+																				{
+																					a, ok := tf.Attrs["client_id"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.Azure.ClientID"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.ClientID = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["enroll_mode"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.EnrollMode"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.InstallParamEnrollMode
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.InstallParamEnrollMode(v.Value)
+																			}
+																			obj.EnrollMode = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["suffix"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.Suffix"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Suffix = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["update_group"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.UpdateGroup"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.UpdateGroup = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["http_proxy_settings"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.HTTPProxySettings = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.HTTPProxySettings = &github_com_gravitational_teleport_api_types.HTTPProxySettings{}
+																				obj := obj.HTTPProxySettings
+																				{
+																					a, ok := tf.Attrs["http_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["https_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPSProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPSProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["no_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.NoProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.NoProxy = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["integration"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.azure.Integration"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.azure.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.Integration = t
+														}
+													}
+												}
+											}
+											obj.Azure[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["gcp"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.Gcp = make([]*github_com_gravitational_teleport_api_types.GCPMatcher, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_types.GCPMatcher
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_types.GCPMatcher{}
+												obj := t
+												{
+													a, ok := tf.Attrs["types"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Types"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Types", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Types = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Types", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Types[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["locations"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Locations"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Locations", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Locations = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Locations", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Locations[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["tags"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Tags"})
+													}
+													CopyFromLabels(diags, a, &obj.Tags)
+												}
+												{
+													a, ok := tf.Attrs["project_ids"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.ProjectIDs"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.ProjectIDs", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.ProjectIDs = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.ProjectIDs", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.ProjectIDs[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["service_accounts"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.ServiceAccounts = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.ServiceAccounts[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["install_params"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+														} else {
+															obj.Params = nil
+															if !v.Null && !v.Unknown {
+																tf := v
+																obj.Params = &github_com_gravitational_teleport_api_types.InstallerParams{}
+																obj := obj.Params
+																{
+																	a, ok := tf.Attrs["join_method"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.JoinMethod"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.JoinMethod
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.JoinMethod(v.Value)
+																			}
+																			obj.JoinMethod = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["join_token"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.JoinToken"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.JoinToken = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["script_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.ScriptName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ScriptName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["install_teleport"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.InstallTeleport"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		} else {
+																			var t bool
+																			if !v.Null && !v.Unknown {
+																				t = bool(v.Value)
+																			}
+																			obj.InstallTeleport = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["sshd_config"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.SSHDConfig"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.SSHDConfig = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["proxy_addr"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.PublicProxyAddr"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.PublicProxyAddr = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["azure"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.Azure"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.Azure = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.Azure = &github_com_gravitational_teleport_api_types.AzureInstallerParams{}
+																				obj := obj.Azure
+																				{
+																					a, ok := tf.Attrs["client_id"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.Azure.ClientID"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.ClientID = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["enroll_mode"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.EnrollMode"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		} else {
+																			var t github_com_gravitational_teleport_api_types.InstallParamEnrollMode
+																			if !v.Null && !v.Unknown {
+																				t = github_com_gravitational_teleport_api_types.InstallParamEnrollMode(v.Value)
+																			}
+																			obj.EnrollMode = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["suffix"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.Suffix"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Suffix = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["update_group"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.UpdateGroup"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.UpdateGroup = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["http_proxy_settings"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.HTTPProxySettings = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.HTTPProxySettings = &github_com_gravitational_teleport_api_types.HTTPProxySettings{}
+																				obj := obj.HTTPProxySettings
+																				{
+																					a, ok := tf.Attrs["http_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["https_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPSProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.HTTPSProxy = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["no_proxy"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.NoProxy"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.NoProxy = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["labels"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.gcp.Labels"})
+													}
+													CopyFromLabels(diags, a, &obj.Labels)
+												}
+											}
+											obj.Gcp[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["kube"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.kube"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.Kube = make([]*github_com_gravitational_teleport_api_types.KubernetesMatcher, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_types.KubernetesMatcher
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_types.KubernetesMatcher{}
+												obj := t
+												{
+													a, ok := tf.Attrs["types"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.kube.Types"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube.Types", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Types = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube.Types", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Types[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["namespaces"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.kube.Namespaces"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube.Namespaces", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+														} else {
+															obj.Namespaces = make([]string, len(v.Elems))
+															if !v.Null && !v.Unknown {
+																for k, a := range v.Elems {
+																	v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.kube.Namespaces", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																	} else {
+																		var t string
+																		if !v.Null && !v.Unknown {
+																			t = string(v.Value)
+																		}
+																		obj.Namespaces[k] = t
+																	}
+																}
+															}
+														}
+													}
+												}
+												{
+													a, ok := tf.Attrs["labels"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.kube.Labels"})
+													}
+													CopyFromLabels(diags, a, &obj.Labels)
+												}
+											}
+											obj.Kube[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["access_graph"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.AccessGraph = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.AccessGraph = &github_com_gravitational_teleport_api_types.AccessGraphSync{}
+									obj := obj.AccessGraph
+									{
+										a, ok := tf.Attrs["aws"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+											} else {
+												obj.AWS = make([]*github_com_gravitational_teleport_api_types.AccessGraphAWSSync, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+														} else {
+															var t *github_com_gravitational_teleport_api_types.AccessGraphAWSSync
+															if !v.Null && !v.Unknown {
+																tf := v
+																t = &github_com_gravitational_teleport_api_types.AccessGraphAWSSync{}
+																obj := t
+																{
+																	a, ok := tf.Attrs["regions"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																		} else {
+																			obj.Regions = make([]string, len(v.Elems))
+																			if !v.Null && !v.Unknown {
+																				for k, a := range v.Elems {
+																					v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																					} else {
+																						var t string
+																						if !v.Null && !v.Unknown {
+																							t = string(v.Value)
+																						}
+																						obj.Regions[k] = t
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["assume_role"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.AssumeRole = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.AssumeRole = &github_com_gravitational_teleport_api_types.AssumeRole{}
+																				obj := obj.AssumeRole
+																				{
+																					a, ok := tf.Attrs["role_arn"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.RoleARN"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.RoleARN = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["external_id"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.ExternalID"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.ExternalID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.ExternalID = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["integration"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.Integration"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Integration = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["cloud_trail_logs"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.CloudTrailLogs = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.CloudTrailLogs = &github_com_gravitational_teleport_api_types.AccessGraphAWSSyncCloudTrailLogs{}
+																				obj := obj.CloudTrailLogs
+																				{
+																					a, ok := tf.Attrs["region"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.Region"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.Region", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.Region = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["sqs_queue"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.SQSQueue"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.SQSQueue", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.SQSQueue = t
+																						}
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["eks_audit_logs"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+																		} else {
+																			obj.EksAuditLogs = nil
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				obj.EksAuditLogs = &github_com_gravitational_teleport_api_types.AccessGraphAWSSyncEKSAuditLogs{}
+																				obj := obj.EksAuditLogs
+																				{
+																					a, ok := tf.Attrs["tags"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs.Tags"})
+																					}
+																					CopyFromLabels(diags, a, &obj.Tags)
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+															obj.AWS[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["poll_interval"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.PollInterval"})
+										} else {
+											v, ok := a.(DurationValue)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.PollInterval", "DurationValue"})
+											} else {
+												var t time.Duration
+												if !v.Null && !v.Unknown {
+													t = time.Duration(v.Value)
+												}
+												obj.PollInterval = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["azure"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.Azure"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+											} else {
+												obj.Azure = make([]*github_com_gravitational_teleport_api_types.AccessGraphAzureSync, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+														} else {
+															var t *github_com_gravitational_teleport_api_types.AccessGraphAzureSync
+															if !v.Null && !v.Unknown {
+																tf := v
+																t = &github_com_gravitational_teleport_api_types.AccessGraphAzureSync{}
+																obj := t
+																{
+																	a, ok := tf.Attrs["subscription_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.Azure.SubscriptionID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure.SubscriptionID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.SubscriptionID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["integration"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"DiscoveryConfig.spec.access_graph.Azure.Integration"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Integration = t
+																		}
+																	}
+																}
+															}
+															obj.Azure[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return diags
+}
+
+// CopyDiscoveryConfigToTerraform copies contents of the source Terraform object into a target struct
+func CopyDiscoveryConfigToTerraform(ctx context.Context, obj *github_com_gravitational_teleport_api_gen_proto_go_teleport_discoveryconfig_v1.DiscoveryConfig, tf *github_com_hashicorp_terraform_plugin_framework_types.Object) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	tf.Null = false
+	tf.Unknown = false
+	if tf.Attrs == nil {
+		tf.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value)
+	}
+	{
+		a, ok := tf.AttrTypes["header"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["header"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				if obj.Header == nil {
+					v.Null = true
+				} else {
+					obj := obj.Header
+					tf := &v
+					{
+						t, ok := tf.AttrTypes["kind"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.kind"})
+						} else {
+							v, ok := tf.Attrs["kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.kind", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Kind) == ""
+							}
+							v.Value = string(obj.Kind)
+							v.Unknown = false
+							tf.Attrs["kind"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["sub_kind"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.sub_kind"})
+						} else {
+							v, ok := tf.Attrs["sub_kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.sub_kind", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.sub_kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.SubKind) == ""
+							}
+							v.Value = string(obj.SubKind)
+							v.Unknown = false
+							tf.Attrs["sub_kind"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["version"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.version"})
+						} else {
+							v, ok := tf.Attrs["version"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.version", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Version) == ""
+							}
+							v.Value = string(obj.Version)
+							v.Unknown = false
+							tf.Attrs["version"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["metadata"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["metadata"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.Metadata == nil {
+									v.Null = true
+								} else {
+									obj := obj.Metadata
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["name"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.name"})
+										} else {
+											v, ok := tf.Attrs["name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.metadata.name", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Name) == ""
+											}
+											v.Value = string(obj.Name)
+											v.Unknown = false
+											tf.Attrs["name"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["namespace"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.namespace"})
+										} else {
+											v, ok := tf.Attrs["namespace"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.metadata.namespace", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Namespace) == ""
+											}
+											v.Value = string(obj.Namespace)
+											v.Unknown = false
+											tf.Attrs["namespace"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["description"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.description"})
+										} else {
+											v, ok := tf.Attrs["description"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.metadata.description", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Description) == ""
+											}
+											v.Value = string(obj.Description)
+											v.Unknown = false
+											tf.Attrs["description"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["labels"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.labels"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.MapType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.MapType"})
+											} else {
+												c, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.Map)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.Map{
+
+														ElemType: o.ElemType,
+														Elems:    make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels))
+													}
+												}
+												if obj.Labels != nil {
+													t := o.ElemType
+													for k, a := range obj.Labels {
+														v, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+															if err != nil {
+																diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.metadata.labels", err})
+															}
+															v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.labels", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															}
+															v.Null = false
+														}
+														v.Value = string(a)
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.Labels) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["labels"] = c
+											}
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["expires"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.expires"})
+										} else {
+											v := CopyToTimestamp(diags, obj.Expires, t, tf.Attrs["expires"])
+											tf.Attrs["expires"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["revision"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.header.metadata.revision"})
+										} else {
+											v, ok := tf.Attrs["revision"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DiscoveryConfig.header.metadata.revision", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.header.metadata.revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Revision) == ""
+											}
+											v.Value = string(obj.Revision)
+											v.Unknown = false
+											tf.Attrs["revision"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["metadata"] = v
+							}
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["header"] = v
+			}
+		}
+	}
+	{
+		a, ok := tf.AttrTypes["spec"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["spec"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				if obj.Spec == nil {
+					v.Null = true
+				} else {
+					obj := obj.Spec
+					tf := &v
+					{
+						t, ok := tf.AttrTypes["discovery_group"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.discovery_group"})
+						} else {
+							v, ok := tf.Attrs["discovery_group"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.discovery_group", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.discovery_group", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.DiscoveryGroup) == ""
+							}
+							v.Value = string(obj.DiscoveryGroup)
+							v.Unknown = false
+							tf.Attrs["discovery_group"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["aws"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["aws"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Aws)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Aws))
+									}
+								}
+								if obj.Aws != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									if len(obj.Aws) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Aws))
+									}
+									for k, a := range obj.Aws {
+										v, ok := tf.Attrs["aws"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												a, ok := tf.AttrTypes["types"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Types"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Types", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+														}
+														if obj.Types != nil {
+															t := o.ElemType
+															if len(obj.Types) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+															for k, a := range obj.Types {
+																v, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Types", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Types", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Types) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["types"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["regions"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Regions"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Regions", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+															}
+														}
+														if obj.Regions != nil {
+															t := o.ElemType
+															if len(obj.Regions) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+															}
+															for k, a := range obj.Regions {
+																v, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Regions", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Regions", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Regions) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["regions"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["assume_role"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["assume_role"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.AssumeRole == nil {
+															v.Null = true
+														} else {
+															obj := obj.AssumeRole
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["role_arn"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole.RoleARN"})
+																} else {
+																	v, ok := tf.Attrs["role_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.AssumeRole.RoleARN", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.RoleARN) == ""
+																	}
+																	v.Value = string(obj.RoleARN)
+																	v.Unknown = false
+																	tf.Attrs["role_arn"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["external_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.AssumeRole.ExternalID"})
+																} else {
+																	v, ok := tf.Attrs["external_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.AssumeRole.ExternalID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.AssumeRole.ExternalID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ExternalID) == ""
+																	}
+																	v.Value = string(obj.ExternalID)
+																	v.Unknown = false
+																	tf.Attrs["external_id"] = v
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["assume_role"] = v
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["tags"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Tags"})
+												} else {
+													v := CopyToLabels(diags, obj.Tags, t, tf.Attrs["tags"])
+													tf.Attrs["tags"] = v
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["install"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["install"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.Params == nil {
+															v.Null = true
+														} else {
+															obj := obj.Params
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["join_method"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.JoinMethod"})
+																} else {
+																	v, ok := tf.Attrs["join_method"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.JoinMethod", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinMethod) == ""
+																	}
+																	v.Value = string(obj.JoinMethod)
+																	v.Unknown = false
+																	tf.Attrs["join_method"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["join_token"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.JoinToken"})
+																} else {
+																	v, ok := tf.Attrs["join_token"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.JoinToken", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinToken) == ""
+																	}
+																	v.Value = string(obj.JoinToken)
+																	v.Unknown = false
+																	tf.Attrs["join_token"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["script_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.ScriptName"})
+																} else {
+																	v, ok := tf.Attrs["script_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.ScriptName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ScriptName) == ""
+																	}
+																	v.Value = string(obj.ScriptName)
+																	v.Unknown = false
+																	tf.Attrs["script_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["install_teleport"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.InstallTeleport"})
+																} else {
+																	v, ok := tf.Attrs["install_teleport"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.InstallTeleport", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		}
+																		v.Null = bool(obj.InstallTeleport) == false
+																	}
+																	v.Value = bool(obj.InstallTeleport)
+																	v.Unknown = false
+																	tf.Attrs["install_teleport"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["sshd_config"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.SSHDConfig"})
+																} else {
+																	v, ok := tf.Attrs["sshd_config"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.SSHDConfig", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.SSHDConfig) == ""
+																	}
+																	v.Value = string(obj.SSHDConfig)
+																	v.Unknown = false
+																	tf.Attrs["sshd_config"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["proxy_addr"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.PublicProxyAddr"})
+																} else {
+																	v, ok := tf.Attrs["proxy_addr"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.PublicProxyAddr", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.PublicProxyAddr) == ""
+																	}
+																	v.Value = string(obj.PublicProxyAddr)
+																	v.Unknown = false
+																	tf.Attrs["proxy_addr"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["azure"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.Azure"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.Azure == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.Azure
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["client_id"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.Azure.ClientID"})
+																				} else {
+																					v, ok := tf.Attrs["client_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.Azure.ClientID", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.ClientID) == ""
+																					}
+																					v.Value = string(obj.ClientID)
+																					v.Unknown = false
+																					tf.Attrs["client_id"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["azure"] = v
+																	}
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["enroll_mode"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.EnrollMode"})
+																} else {
+																	v, ok := tf.Attrs["enroll_mode"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.EnrollMode", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		}
+																		v.Null = int64(obj.EnrollMode) == 0
+																	}
+																	v.Value = int64(obj.EnrollMode)
+																	v.Unknown = false
+																	tf.Attrs["enroll_mode"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["suffix"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.Suffix"})
+																} else {
+																	v, ok := tf.Attrs["suffix"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.Suffix", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Suffix) == ""
+																	}
+																	v.Value = string(obj.Suffix)
+																	v.Unknown = false
+																	tf.Attrs["suffix"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["update_group"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.UpdateGroup"})
+																} else {
+																	v, ok := tf.Attrs["update_group"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.UpdateGroup", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.UpdateGroup) == ""
+																	}
+																	v.Value = string(obj.UpdateGroup)
+																	v.Unknown = false
+																	tf.Attrs["update_group"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["http_proxy_settings"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["http_proxy_settings"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.HTTPProxySettings == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.HTTPProxySettings
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["http_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPProxy"})
+																				} else {
+																					v, ok := tf.Attrs["http_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPProxy)
+																					v.Unknown = false
+																					tf.Attrs["http_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["https_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPSProxy"})
+																				} else {
+																					v, ok := tf.Attrs["https_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPSProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPSProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPSProxy)
+																					v.Unknown = false
+																					tf.Attrs["https_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["no_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.NoProxy"})
+																				} else {
+																					v, ok := tf.Attrs["no_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.NoProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.NoProxy) == ""
+																					}
+																					v.Value = string(obj.NoProxy)
+																					v.Unknown = false
+																					tf.Attrs["no_proxy"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["http_proxy_settings"] = v
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["install"] = v
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["ssm"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.SSM"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.SSM", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["ssm"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.SSM == nil {
+															v.Null = true
+														} else {
+															obj := obj.SSM
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["document_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.SSM.DocumentName"})
+																} else {
+																	v, ok := tf.Attrs["document_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.SSM.DocumentName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.SSM.DocumentName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.DocumentName) == ""
+																	}
+																	v.Value = string(obj.DocumentName)
+																	v.Unknown = false
+																	tf.Attrs["document_name"] = v
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["ssm"] = v
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["integration"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Integration"})
+												} else {
+													v, ok := tf.Attrs["integration"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+													if !ok {
+														i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+														if err != nil {
+															diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Integration", err})
+														}
+														v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														}
+														v.Null = string(obj.Integration) == ""
+													}
+													v.Value = string(obj.Integration)
+													v.Unknown = false
+													tf.Attrs["integration"] = v
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["kube_app_discovery"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.KubeAppDiscovery"})
+												} else {
+													v, ok := tf.Attrs["kube_app_discovery"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+													if !ok {
+														i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+														if err != nil {
+															diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.KubeAppDiscovery", err})
+														}
+														v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+														if !ok {
+															diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.KubeAppDiscovery", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+														}
+														v.Null = bool(obj.KubeAppDiscovery) == false
+													}
+													v.Value = bool(obj.KubeAppDiscovery)
+													v.Unknown = false
+													tf.Attrs["kube_app_discovery"] = v
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["setup_access_for_arn"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.SetupAccessForARN"})
+												} else {
+													v, ok := tf.Attrs["setup_access_for_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+													if !ok {
+														i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+														if err != nil {
+															diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.SetupAccessForARN", err})
+														}
+														v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.SetupAccessForARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														}
+														v.Null = string(obj.SetupAccessForARN) == ""
+													}
+													v.Value = string(obj.SetupAccessForARN)
+													v.Unknown = false
+													tf.Attrs["setup_access_for_arn"] = v
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["organization"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Organization"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["organization"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.Organization == nil {
+															v.Null = true
+														} else {
+															obj := obj.Organization
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["organization_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationID"})
+																} else {
+																	v, ok := tf.Attrs["organization_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Organization.OrganizationID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.OrganizationID) == ""
+																	}
+																	v.Value = string(obj.OrganizationID)
+																	v.Unknown = false
+																	tf.Attrs["organization_id"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["organizational_units"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["organizational_units"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.OrganizationalUnits == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.OrganizationalUnits
+																			tf := &v
+																			{
+																				a, ok := tf.AttrTypes["include"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include"})
+																				} else {
+																					o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																					if !ok {
+																						diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																					} else {
+																						c, ok := tf.Attrs["include"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																						if !ok {
+																							c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																								ElemType: o.ElemType,
+																								Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Include)),
+																								Null:     true,
+																							}
+																						} else {
+																							if c.Elems == nil {
+																								c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Include))
+																							}
+																						}
+																						if obj.Include != nil {
+																							t := o.ElemType
+																							if len(obj.Include) != len(c.Elems) {
+																								c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Include))
+																							}
+																							for k, a := range obj.Include {
+																								v, ok := tf.Attrs["include"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																								if !ok {
+																									i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																									if err != nil {
+																										diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include", err})
+																									}
+																									v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Include", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																									}
+																									v.Null = string(a) == ""
+																								}
+																								v.Value = string(a)
+																								v.Unknown = false
+																								c.Elems[k] = v
+																							}
+																							if len(obj.Include) > 0 {
+																								c.Null = false
+																							}
+																						}
+																						c.Unknown = false
+																						tf.Attrs["include"] = c
+																					}
+																				}
+																			}
+																			{
+																				a, ok := tf.AttrTypes["exclude"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude"})
+																				} else {
+																					o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																					if !ok {
+																						diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																					} else {
+																						c, ok := tf.Attrs["exclude"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																						if !ok {
+																							c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																								ElemType: o.ElemType,
+																								Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Exclude)),
+																								Null:     true,
+																							}
+																						} else {
+																							if c.Elems == nil {
+																								c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Exclude))
+																							}
+																						}
+																						if obj.Exclude != nil {
+																							t := o.ElemType
+																							if len(obj.Exclude) != len(c.Elems) {
+																								c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Exclude))
+																							}
+																							for k, a := range obj.Exclude {
+																								v, ok := tf.Attrs["exclude"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																								if !ok {
+																									i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																									if err != nil {
+																										diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude", err})
+																									}
+																									v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																									if !ok {
+																										diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.aws.Organization.OrganizationalUnits.Exclude", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																									}
+																									v.Null = string(a) == ""
+																								}
+																								v.Value = string(a)
+																								v.Unknown = false
+																								c.Elems[k] = v
+																							}
+																							if len(obj.Exclude) > 0 {
+																								c.Null = false
+																							}
+																						}
+																						c.Unknown = false
+																						tf.Attrs["exclude"] = c
+																					}
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["organizational_units"] = v
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["organization"] = v
+													}
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Aws) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["aws"] = c
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["azure"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure))
+									}
+								}
+								if obj.Azure != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									if len(obj.Azure) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure))
+									}
+									for k, a := range obj.Azure {
+										v, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												a, ok := tf.AttrTypes["subscriptions"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Subscriptions"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Subscriptions", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["subscriptions"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Subscriptions)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Subscriptions))
+															}
+														}
+														if obj.Subscriptions != nil {
+															t := o.ElemType
+															if len(obj.Subscriptions) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Subscriptions))
+															}
+															for k, a := range obj.Subscriptions {
+																v, ok := tf.Attrs["subscriptions"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Subscriptions", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Subscriptions", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Subscriptions) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["subscriptions"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["resource_groups"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.ResourceGroups"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.ResourceGroups", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["resource_groups"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ResourceGroups)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ResourceGroups))
+															}
+														}
+														if obj.ResourceGroups != nil {
+															t := o.ElemType
+															if len(obj.ResourceGroups) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ResourceGroups))
+															}
+															for k, a := range obj.ResourceGroups {
+																v, ok := tf.Attrs["resource_groups"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.ResourceGroups", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.ResourceGroups", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.ResourceGroups) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["resource_groups"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["types"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Types"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Types", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+														}
+														if obj.Types != nil {
+															t := o.ElemType
+															if len(obj.Types) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+															for k, a := range obj.Types {
+																v, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Types", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Types", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Types) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["types"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["regions"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Regions"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Regions", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+															}
+														}
+														if obj.Regions != nil {
+															t := o.ElemType
+															if len(obj.Regions) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+															}
+															for k, a := range obj.Regions {
+																v, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Regions", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Regions", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Regions) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["regions"] = c
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["tags"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.ResourceTags"})
+												} else {
+													v := CopyToLabels(diags, obj.ResourceTags, t, tf.Attrs["tags"])
+													tf.Attrs["tags"] = v
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["install_params"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["install_params"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.Params == nil {
+															v.Null = true
+														} else {
+															obj := obj.Params
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["join_method"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.JoinMethod"})
+																} else {
+																	v, ok := tf.Attrs["join_method"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.JoinMethod", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinMethod) == ""
+																	}
+																	v.Value = string(obj.JoinMethod)
+																	v.Unknown = false
+																	tf.Attrs["join_method"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["join_token"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.JoinToken"})
+																} else {
+																	v, ok := tf.Attrs["join_token"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.JoinToken", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinToken) == ""
+																	}
+																	v.Value = string(obj.JoinToken)
+																	v.Unknown = false
+																	tf.Attrs["join_token"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["script_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.ScriptName"})
+																} else {
+																	v, ok := tf.Attrs["script_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.ScriptName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ScriptName) == ""
+																	}
+																	v.Value = string(obj.ScriptName)
+																	v.Unknown = false
+																	tf.Attrs["script_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["install_teleport"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.InstallTeleport"})
+																} else {
+																	v, ok := tf.Attrs["install_teleport"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.InstallTeleport", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		}
+																		v.Null = bool(obj.InstallTeleport) == false
+																	}
+																	v.Value = bool(obj.InstallTeleport)
+																	v.Unknown = false
+																	tf.Attrs["install_teleport"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["sshd_config"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.SSHDConfig"})
+																} else {
+																	v, ok := tf.Attrs["sshd_config"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.SSHDConfig", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.SSHDConfig) == ""
+																	}
+																	v.Value = string(obj.SSHDConfig)
+																	v.Unknown = false
+																	tf.Attrs["sshd_config"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["proxy_addr"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.PublicProxyAddr"})
+																} else {
+																	v, ok := tf.Attrs["proxy_addr"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.PublicProxyAddr", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.PublicProxyAddr) == ""
+																	}
+																	v.Value = string(obj.PublicProxyAddr)
+																	v.Unknown = false
+																	tf.Attrs["proxy_addr"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["azure"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.Azure"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.Azure == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.Azure
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["client_id"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.Azure.ClientID"})
+																				} else {
+																					v, ok := tf.Attrs["client_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.Azure.ClientID", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.ClientID) == ""
+																					}
+																					v.Value = string(obj.ClientID)
+																					v.Unknown = false
+																					tf.Attrs["client_id"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["azure"] = v
+																	}
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["enroll_mode"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.EnrollMode"})
+																} else {
+																	v, ok := tf.Attrs["enroll_mode"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.EnrollMode", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		}
+																		v.Null = int64(obj.EnrollMode) == 0
+																	}
+																	v.Value = int64(obj.EnrollMode)
+																	v.Unknown = false
+																	tf.Attrs["enroll_mode"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["suffix"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.Suffix"})
+																} else {
+																	v, ok := tf.Attrs["suffix"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.Suffix", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Suffix) == ""
+																	}
+																	v.Value = string(obj.Suffix)
+																	v.Unknown = false
+																	tf.Attrs["suffix"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["update_group"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.UpdateGroup"})
+																} else {
+																	v, ok := tf.Attrs["update_group"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.UpdateGroup", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.UpdateGroup) == ""
+																	}
+																	v.Value = string(obj.UpdateGroup)
+																	v.Unknown = false
+																	tf.Attrs["update_group"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["http_proxy_settings"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["http_proxy_settings"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.HTTPProxySettings == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.HTTPProxySettings
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["http_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPProxy"})
+																				} else {
+																					v, ok := tf.Attrs["http_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPProxy)
+																					v.Unknown = false
+																					tf.Attrs["http_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["https_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPSProxy"})
+																				} else {
+																					v, ok := tf.Attrs["https_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPSProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPSProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPSProxy)
+																					v.Unknown = false
+																					tf.Attrs["https_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["no_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.NoProxy"})
+																				} else {
+																					v, ok := tf.Attrs["no_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.NoProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.NoProxy) == ""
+																					}
+																					v.Value = string(obj.NoProxy)
+																					v.Unknown = false
+																					tf.Attrs["no_proxy"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["http_proxy_settings"] = v
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["install_params"] = v
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["integration"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.azure.Integration"})
+												} else {
+													v, ok := tf.Attrs["integration"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+													if !ok {
+														i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+														if err != nil {
+															diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.azure.Integration", err})
+														}
+														v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.azure.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														}
+														v.Null = string(obj.Integration) == ""
+													}
+													v.Value = string(obj.Integration)
+													v.Unknown = false
+													tf.Attrs["integration"] = v
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Azure) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["azure"] = c
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["gcp"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["gcp"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Gcp)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Gcp))
+									}
+								}
+								if obj.Gcp != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									if len(obj.Gcp) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Gcp))
+									}
+									for k, a := range obj.Gcp {
+										v, ok := tf.Attrs["gcp"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												a, ok := tf.AttrTypes["types"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Types"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Types", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+														}
+														if obj.Types != nil {
+															t := o.ElemType
+															if len(obj.Types) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+															for k, a := range obj.Types {
+																v, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Types", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Types", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Types) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["types"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["locations"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Locations"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Locations", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["locations"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Locations)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Locations))
+															}
+														}
+														if obj.Locations != nil {
+															t := o.ElemType
+															if len(obj.Locations) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Locations))
+															}
+															for k, a := range obj.Locations {
+																v, ok := tf.Attrs["locations"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Locations", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Locations", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Locations) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["locations"] = c
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["tags"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Tags"})
+												} else {
+													v := CopyToLabels(diags, obj.Tags, t, tf.Attrs["tags"])
+													tf.Attrs["tags"] = v
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["project_ids"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.ProjectIDs"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.ProjectIDs", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["project_ids"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProjectIDs)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProjectIDs))
+															}
+														}
+														if obj.ProjectIDs != nil {
+															t := o.ElemType
+															if len(obj.ProjectIDs) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProjectIDs))
+															}
+															for k, a := range obj.ProjectIDs {
+																v, ok := tf.Attrs["project_ids"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.ProjectIDs", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.ProjectIDs", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.ProjectIDs) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["project_ids"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["service_accounts"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["service_accounts"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ServiceAccounts)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ServiceAccounts))
+															}
+														}
+														if obj.ServiceAccounts != nil {
+															t := o.ElemType
+															if len(obj.ServiceAccounts) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ServiceAccounts))
+															}
+															for k, a := range obj.ServiceAccounts {
+																v, ok := tf.Attrs["service_accounts"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.ServiceAccounts", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.ServiceAccounts", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.ServiceAccounts) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["service_accounts"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["install_params"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+													} else {
+														v, ok := tf.Attrs["install_params"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if obj.Params == nil {
+															v.Null = true
+														} else {
+															obj := obj.Params
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["join_method"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.JoinMethod"})
+																} else {
+																	v, ok := tf.Attrs["join_method"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.JoinMethod", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.JoinMethod", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinMethod) == ""
+																	}
+																	v.Value = string(obj.JoinMethod)
+																	v.Unknown = false
+																	tf.Attrs["join_method"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["join_token"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.JoinToken"})
+																} else {
+																	v, ok := tf.Attrs["join_token"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.JoinToken", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.JoinToken", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.JoinToken) == ""
+																	}
+																	v.Value = string(obj.JoinToken)
+																	v.Unknown = false
+																	tf.Attrs["join_token"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["script_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.ScriptName"})
+																} else {
+																	v, ok := tf.Attrs["script_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.ScriptName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.ScriptName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ScriptName) == ""
+																	}
+																	v.Value = string(obj.ScriptName)
+																	v.Unknown = false
+																	tf.Attrs["script_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["install_teleport"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.InstallTeleport"})
+																} else {
+																	v, ok := tf.Attrs["install_teleport"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.InstallTeleport", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.InstallTeleport", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																		}
+																		v.Null = bool(obj.InstallTeleport) == false
+																	}
+																	v.Value = bool(obj.InstallTeleport)
+																	v.Unknown = false
+																	tf.Attrs["install_teleport"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["sshd_config"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.SSHDConfig"})
+																} else {
+																	v, ok := tf.Attrs["sshd_config"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.SSHDConfig", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.SSHDConfig", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.SSHDConfig) == ""
+																	}
+																	v.Value = string(obj.SSHDConfig)
+																	v.Unknown = false
+																	tf.Attrs["sshd_config"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["proxy_addr"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.PublicProxyAddr"})
+																} else {
+																	v, ok := tf.Attrs["proxy_addr"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.PublicProxyAddr", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.PublicProxyAddr", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.PublicProxyAddr) == ""
+																	}
+																	v.Value = string(obj.PublicProxyAddr)
+																	v.Unknown = false
+																	tf.Attrs["proxy_addr"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["azure"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.Azure"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Azure", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.Azure == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.Azure
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["client_id"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.Azure.ClientID"})
+																				} else {
+																					v, ok := tf.Attrs["client_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.Azure.ClientID", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Azure.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.ClientID) == ""
+																					}
+																					v.Value = string(obj.ClientID)
+																					v.Unknown = false
+																					tf.Attrs["client_id"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["azure"] = v
+																	}
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["enroll_mode"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.EnrollMode"})
+																} else {
+																	v, ok := tf.Attrs["enroll_mode"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.EnrollMode", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.EnrollMode", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+																		}
+																		v.Null = int64(obj.EnrollMode) == 0
+																	}
+																	v.Value = int64(obj.EnrollMode)
+																	v.Unknown = false
+																	tf.Attrs["enroll_mode"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["suffix"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.Suffix"})
+																} else {
+																	v, ok := tf.Attrs["suffix"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.Suffix", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.Suffix", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Suffix) == ""
+																	}
+																	v.Value = string(obj.Suffix)
+																	v.Unknown = false
+																	tf.Attrs["suffix"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["update_group"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.UpdateGroup"})
+																} else {
+																	v, ok := tf.Attrs["update_group"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.UpdateGroup", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.UpdateGroup", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.UpdateGroup) == ""
+																	}
+																	v.Value = string(obj.UpdateGroup)
+																	v.Unknown = false
+																	tf.Attrs["update_group"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["http_proxy_settings"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["http_proxy_settings"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.HTTPProxySettings == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.HTTPProxySettings
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["http_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPProxy"})
+																				} else {
+																					v, ok := tf.Attrs["http_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPProxy)
+																					v.Unknown = false
+																					tf.Attrs["http_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["https_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPSProxy"})
+																				} else {
+																					v, ok := tf.Attrs["https_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPSProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.HTTPSProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.HTTPSProxy) == ""
+																					}
+																					v.Value = string(obj.HTTPSProxy)
+																					v.Unknown = false
+																					tf.Attrs["https_proxy"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["no_proxy"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.NoProxy"})
+																				} else {
+																					v, ok := tf.Attrs["no_proxy"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.NoProxy", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.gcp.Params.HTTPProxySettings.NoProxy", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.NoProxy) == ""
+																					}
+																					v.Value = string(obj.NoProxy)
+																					v.Unknown = false
+																					tf.Attrs["no_proxy"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["http_proxy_settings"] = v
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														tf.Attrs["install_params"] = v
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["labels"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.gcp.Labels"})
+												} else {
+													v := CopyToLabels(diags, obj.Labels, t, tf.Attrs["labels"])
+													tf.Attrs["labels"] = v
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Gcp) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["gcp"] = c
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["kube"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.kube"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.kube", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["kube"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Kube)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Kube))
+									}
+								}
+								if obj.Kube != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									if len(obj.Kube) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Kube))
+									}
+									for k, a := range obj.Kube {
+										v, ok := tf.Attrs["kube"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												a, ok := tf.AttrTypes["types"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.kube.Types"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.kube.Types", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+														}
+														if obj.Types != nil {
+															t := o.ElemType
+															if len(obj.Types) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Types))
+															}
+															for k, a := range obj.Types {
+																v, ok := tf.Attrs["types"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.kube.Types", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.kube.Types", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Types) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["types"] = c
+													}
+												}
+											}
+											{
+												a, ok := tf.AttrTypes["namespaces"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.kube.Namespaces"})
+												} else {
+													o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+													if !ok {
+														diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.kube.Namespaces", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+													} else {
+														c, ok := tf.Attrs["namespaces"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+														if !ok {
+															c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																ElemType: o.ElemType,
+																Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Namespaces)),
+																Null:     true,
+															}
+														} else {
+															if c.Elems == nil {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Namespaces))
+															}
+														}
+														if obj.Namespaces != nil {
+															t := o.ElemType
+															if len(obj.Namespaces) != len(c.Elems) {
+																c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Namespaces))
+															}
+															for k, a := range obj.Namespaces {
+																v, ok := tf.Attrs["namespaces"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																	if err != nil {
+																		diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.kube.Namespaces", err})
+																	}
+																	v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.kube.Namespaces", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																	}
+																	v.Null = string(a) == ""
+																}
+																v.Value = string(a)
+																v.Unknown = false
+																c.Elems[k] = v
+															}
+															if len(obj.Namespaces) > 0 {
+																c.Null = false
+															}
+														}
+														c.Unknown = false
+														tf.Attrs["namespaces"] = c
+													}
+												}
+											}
+											{
+												t, ok := tf.AttrTypes["labels"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.kube.Labels"})
+												} else {
+													v := CopyToLabels(diags, obj.Labels, t, tf.Attrs["labels"])
+													tf.Attrs["labels"] = v
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Kube) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["kube"] = c
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["access_graph"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["access_graph"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.AccessGraph == nil {
+									v.Null = true
+								} else {
+									obj := obj.AccessGraph
+									tf := &v
+									{
+										a, ok := tf.AttrTypes["aws"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+											} else {
+												c, ok := tf.Attrs["aws"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+														ElemType: o.ElemType,
+														Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.AWS)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.AWS))
+													}
+												}
+												if obj.AWS != nil {
+													o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if len(obj.AWS) != len(c.Elems) {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.AWS))
+													}
+													for k, a := range obj.AWS {
+														v, ok := tf.Attrs["aws"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if a == nil {
+															v.Null = true
+														} else {
+															obj := a
+															tf := &v
+															{
+																a, ok := tf.AttrTypes["regions"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																	} else {
+																		c, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																				ElemType: o.ElemType,
+																				Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions)),
+																				Null:     true,
+																			}
+																		} else {
+																			if c.Elems == nil {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+																			}
+																		}
+																		if obj.Regions != nil {
+																			t := o.ElemType
+																			if len(obj.Regions) != len(c.Elems) {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Regions))
+																			}
+																			for k, a := range obj.Regions {
+																				v, ok := tf.Attrs["regions"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																				if !ok {
+																					i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																					if err != nil {
+																						diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.Regions", err})
+																					}
+																					v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Regions", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																					}
+																					v.Null = string(a) == ""
+																				}
+																				v.Value = string(a)
+																				v.Unknown = false
+																				c.Elems[k] = v
+																			}
+																			if len(obj.Regions) > 0 {
+																				c.Null = false
+																			}
+																		}
+																		c.Unknown = false
+																		tf.Attrs["regions"] = c
+																	}
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["assume_role"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["assume_role"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.AssumeRole == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.AssumeRole
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["role_arn"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.RoleARN"})
+																				} else {
+																					v, ok := tf.Attrs["role_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.RoleARN", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.RoleARN) == ""
+																					}
+																					v.Value = string(obj.RoleARN)
+																					v.Unknown = false
+																					tf.Attrs["role_arn"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["external_id"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.ExternalID"})
+																				} else {
+																					v, ok := tf.Attrs["external_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.ExternalID", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.AssumeRole.ExternalID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.ExternalID) == ""
+																					}
+																					v.Value = string(obj.ExternalID)
+																					v.Unknown = false
+																					tf.Attrs["external_id"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["assume_role"] = v
+																	}
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["integration"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.Integration"})
+																} else {
+																	v, ok := tf.Attrs["integration"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.Integration", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Integration) == ""
+																	}
+																	v.Value = string(obj.Integration)
+																	v.Unknown = false
+																	tf.Attrs["integration"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["cloud_trail_logs"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["cloud_trail_logs"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.CloudTrailLogs == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.CloudTrailLogs
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["region"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.Region"})
+																				} else {
+																					v, ok := tf.Attrs["region"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.Region", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.Region", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.Region) == ""
+																					}
+																					v.Value = string(obj.Region)
+																					v.Unknown = false
+																					tf.Attrs["region"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["sqs_queue"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.SQSQueue"})
+																				} else {
+																					v, ok := tf.Attrs["sqs_queue"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.SQSQueue", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.cloud_trail_logs.SQSQueue", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.SQSQueue) == ""
+																					}
+																					v.Value = string(obj.SQSQueue)
+																					v.Unknown = false
+																					tf.Attrs["sqs_queue"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["cloud_trail_logs"] = v
+																	}
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["eks_audit_logs"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+																	} else {
+																		v, ok := tf.Attrs["eks_audit_logs"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if obj.EksAuditLogs == nil {
+																			v.Null = true
+																		} else {
+																			obj := obj.EksAuditLogs
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["tags"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.AWS.eks_audit_logs.Tags"})
+																				} else {
+																					v := CopyToLabels(diags, obj.Tags, t, tf.Attrs["tags"])
+																					tf.Attrs["tags"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		tf.Attrs["eks_audit_logs"] = v
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.AWS) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["aws"] = c
+											}
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["poll_interval"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.PollInterval"})
+										} else {
+											v, ok := tf.Attrs["poll_interval"].(DurationValue)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.PollInterval", err})
+												}
+												v, ok = i.(DurationValue)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.PollInterval", "DurationValue"})
+												}
+												v.Null = false
+											}
+											v.Value = time.Duration(obj.PollInterval)
+											v.Unknown = false
+											tf.Attrs["poll_interval"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["azure"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.Azure"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+											} else {
+												c, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+														ElemType: o.ElemType,
+														Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure))
+													}
+												}
+												if obj.Azure != nil {
+													o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if len(obj.Azure) != len(c.Elems) {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Azure))
+													}
+													for k, a := range obj.Azure {
+														v, ok := tf.Attrs["azure"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if a == nil {
+															v.Null = true
+														} else {
+															obj := a
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["subscription_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.Azure.SubscriptionID"})
+																} else {
+																	v, ok := tf.Attrs["subscription_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.Azure.SubscriptionID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure.SubscriptionID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.SubscriptionID) == ""
+																	}
+																	v.Value = string(obj.SubscriptionID)
+																	v.Unknown = false
+																	tf.Attrs["subscription_id"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["integration"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"DiscoveryConfig.spec.access_graph.Azure.Integration"})
+																} else {
+																	v, ok := tf.Attrs["integration"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"DiscoveryConfig.spec.access_graph.Azure.Integration", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"DiscoveryConfig.spec.access_graph.Azure.Integration", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Integration) == ""
+																	}
+																	v.Value = string(obj.Integration)
+																	v.Unknown = false
+																	tf.Attrs["integration"] = v
+																}
+															}
+														}
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.Azure) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["azure"] = c
+											}
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["access_graph"] = v
+							}
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["spec"] = v
+			}
+		}
+	}
+	return diags
+}
+
+// attrReadMissingDiag represents diagnostic message on an attribute missing in the source object
+type attrReadMissingDiag struct {
+	Path string
+}
+
+func (d attrReadMissingDiag) Severity() github_com_hashicorp_terraform_plugin_framework_diag.Severity {
+	return github_com_hashicorp_terraform_plugin_framework_diag.SeverityError
+}
+
+func (d attrReadMissingDiag) Summary() string {
+	return "Error reading from Terraform object"
+}
+
+func (d attrReadMissingDiag) Detail() string {
+	return fmt.Sprintf("A value for %v is missing in the source Terraform object Attrs", d.Path)
+}
+
+func (d attrReadMissingDiag) Equal(o github_com_hashicorp_terraform_plugin_framework_diag.Diagnostic) bool {
+	return (d.Severity() == o.Severity()) && (d.Summary() == o.Summary()) && (d.Detail() == o.Detail())
+}
+
+// attrReadConversionFailureDiag represents diagnostic message on a failed type conversion on read
+type attrReadConversionFailureDiag struct {
+	Path string
+	Type string
+}
+
+func (d attrReadConversionFailureDiag) Severity() github_com_hashicorp_terraform_plugin_framework_diag.Severity {
+	return github_com_hashicorp_terraform_plugin_framework_diag.SeverityError
+}
+
+func (d attrReadConversionFailureDiag) Summary() string {
+	return "Error reading from Terraform object"
+}
+
+func (d attrReadConversionFailureDiag) Detail() string {
+	return fmt.Sprintf("A value for %v can not be converted to %v", d.Path, d.Type)
+}
+
+func (d attrReadConversionFailureDiag) Equal(o github_com_hashicorp_terraform_plugin_framework_diag.Diagnostic) bool {
+	return (d.Severity() == o.Severity()) && (d.Summary() == o.Summary()) && (d.Detail() == o.Detail())
+}
+
+// attrWriteMissingDiag represents diagnostic message on an attribute missing in the target object
+type attrWriteMissingDiag struct {
+	Path string
+}
+
+func (d attrWriteMissingDiag) Severity() github_com_hashicorp_terraform_plugin_framework_diag.Severity {
+	return github_com_hashicorp_terraform_plugin_framework_diag.SeverityError
+}
+
+func (d attrWriteMissingDiag) Summary() string {
+	return "Error writing to Terraform object"
+}
+
+func (d attrWriteMissingDiag) Detail() string {
+	return fmt.Sprintf("A value for %v is missing in the source Terraform object AttrTypes", d.Path)
+}
+
+func (d attrWriteMissingDiag) Equal(o github_com_hashicorp_terraform_plugin_framework_diag.Diagnostic) bool {
+	return (d.Severity() == o.Severity()) && (d.Summary() == o.Summary()) && (d.Detail() == o.Detail())
+}
+
+// attrWriteConversionFailureDiag represents diagnostic message on a failed type conversion on write
+type attrWriteConversionFailureDiag struct {
+	Path string
+	Type string
+}
+
+func (d attrWriteConversionFailureDiag) Severity() github_com_hashicorp_terraform_plugin_framework_diag.Severity {
+	return github_com_hashicorp_terraform_plugin_framework_diag.SeverityError
+}
+
+func (d attrWriteConversionFailureDiag) Summary() string {
+	return "Error writing to Terraform object"
+}
+
+func (d attrWriteConversionFailureDiag) Detail() string {
+	return fmt.Sprintf("A value for %v can not be converted to %v", d.Path, d.Type)
+}
+
+func (d attrWriteConversionFailureDiag) Equal(o github_com_hashicorp_terraform_plugin_framework_diag.Diagnostic) bool {
+	return (d.Severity() == o.Severity()) && (d.Summary() == o.Summary()) && (d.Detail() == o.Detail())
+}
+
+// attrWriteGeneralError represents diagnostic message on a generic error on write
+type attrWriteGeneralError struct {
+	Path string
+	Err  error
+}
+
+func (d attrWriteGeneralError) Severity() github_com_hashicorp_terraform_plugin_framework_diag.Severity {
+	return github_com_hashicorp_terraform_plugin_framework_diag.SeverityError
+}
+
+func (d attrWriteGeneralError) Summary() string {
+	return "Error writing to Terraform object"
+}
+
+func (d attrWriteGeneralError) Detail() string {
+	return fmt.Sprintf("%s: %s", d.Path, d.Err.Error())
+}
+
+func (d attrWriteGeneralError) Equal(o github_com_hashicorp_terraform_plugin_framework_diag.Diagnostic) bool {
+	return (d.Severity() == o.Severity()) && (d.Summary() == o.Summary()) && (d.Detail() == o.Detail())
+}
diff --git a/integrations/terraform/tfschema/healthcheckconfig/v1/health_check_config_terraform.go b/integrations/terraform/tfschema/healthcheckconfig/v1/health_check_config_terraform.go
index f2b216e75145a..f853bf82662be 100644
--- a/integrations/terraform/tfschema/healthcheckconfig/v1/health_check_config_terraform.go
+++ b/integrations/terraform/tfschema/healthcheckconfig/v1/health_check_config_terraform.go
@@ -137,6 +137,32 @@ func GenSchemaHealthCheckConfig(ctx context.Context) (github_com_hashicorp_terra
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
+						"disabled": {
+							Description: "Disabled disables matches for all labels and expressions.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
+						"kubernetes_labels": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"name": {
+									Description: "The name of the label.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"values": {
+									Description: "The values associated with the label.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+								},
+							}),
+							Description: "KubernetesLabels matches Kubernetes labels. An empty value is ignored. The match result is logically ANDed with KubernetesLabelsExpression, if both are non-empty.",
+							Optional:    true,
+						},
+						"kubernetes_labels_expression": {
+							Description: "KubernetesLabelsExpression is a label predicate expression to match Kubernetes. An empty value is ignored. The match result is logically ANDed with KubernetesLabels, if both are non-empty.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
 					}),
 					Description: "Match is used to select resources that these settings apply to.",
 					Required:    true,
@@ -461,6 +487,113 @@ func CopyHealthCheckConfigFromTerraform(_ context.Context, tf github_com_hashico
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["kubernetes_labels"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+											} else {
+												obj.KubernetesLabels = make([]*github_com_gravitational_teleport_api_gen_proto_go_teleport_label_v1.Label, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+														} else {
+															var t *github_com_gravitational_teleport_api_gen_proto_go_teleport_label_v1.Label
+															if !v.Null && !v.Unknown {
+																tf := v
+																t = &github_com_gravitational_teleport_api_gen_proto_go_teleport_label_v1.Label{}
+																obj := t
+																{
+																	a, ok := tf.Attrs["name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels.name"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Name = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["values"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																		} else {
+																			obj.Values = make([]string, len(v.Elems))
+																			if !v.Null && !v.Unknown {
+																				for k, a := range v.Elems {
+																					v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																					} else {
+																						var t string
+																						if !v.Null && !v.Unknown {
+																							t = string(v.Value)
+																						}
+																						obj.Values[k] = t
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
+															}
+															obj.KubernetesLabels[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["kubernetes_labels_expression"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels_expression"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels_expression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.KubernetesLabelsExpression = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["disabled"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"HealthCheckConfig.spec.match.disabled"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"HealthCheckConfig.spec.match.disabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+											} else {
+												var t bool
+												if !v.Null && !v.Unknown {
+													t = bool(v.Value)
+												}
+												obj.Disabled = t
+											}
+										}
+									}
 								}
 							}
 						}
@@ -980,6 +1113,183 @@ func CopyHealthCheckConfigToTerraform(ctx context.Context, obj *github_com_gravi
 											tf.Attrs["db_labels_expression"] = v
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["kubernetes_labels"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+											} else {
+												c, ok := tf.Attrs["kubernetes_labels"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+														ElemType: o.ElemType,
+														Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.KubernetesLabels)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.KubernetesLabels))
+													}
+												}
+												if obj.KubernetesLabels != nil {
+													o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if len(obj.KubernetesLabels) != len(c.Elems) {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.KubernetesLabels))
+													}
+													for k, a := range obj.KubernetesLabels {
+														v, ok := tf.Attrs["kubernetes_labels"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if a == nil {
+															v.Null = true
+														} else {
+															obj := a
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels.name"})
+																} else {
+																	v, ok := tf.Attrs["name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"HealthCheckConfig.spec.match.kubernetes_labels.name", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Name) == ""
+																	}
+																	v.Value = string(obj.Name)
+																	v.Unknown = false
+																	tf.Attrs["name"] = v
+																}
+															}
+															{
+																a, ok := tf.AttrTypes["values"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																	} else {
+																		c, ok := tf.Attrs["values"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																				ElemType: o.ElemType,
+																				Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Values)),
+																				Null:     true,
+																			}
+																		} else {
+																			if c.Elems == nil {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Values))
+																			}
+																		}
+																		if obj.Values != nil {
+																			t := o.ElemType
+																			if len(obj.Values) != len(c.Elems) {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Values))
+																			}
+																			for k, a := range obj.Values {
+																				v, ok := tf.Attrs["values"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																				if !ok {
+																					i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																					if err != nil {
+																						diags.Append(attrWriteGeneralError{"HealthCheckConfig.spec.match.kubernetes_labels.values", err})
+																					}
+																					v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels.values", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																					}
+																					v.Null = string(a) == ""
+																				}
+																				v.Value = string(a)
+																				v.Unknown = false
+																				c.Elems[k] = v
+																			}
+																			if len(obj.Values) > 0 {
+																				c.Null = false
+																			}
+																		}
+																		c.Unknown = false
+																		tf.Attrs["values"] = c
+																	}
+																}
+															}
+														}
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.KubernetesLabels) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["kubernetes_labels"] = c
+											}
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["kubernetes_labels_expression"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"HealthCheckConfig.spec.match.kubernetes_labels_expression"})
+										} else {
+											v, ok := tf.Attrs["kubernetes_labels_expression"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"HealthCheckConfig.spec.match.kubernetes_labels_expression", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.kubernetes_labels_expression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.KubernetesLabelsExpression) == ""
+											}
+											v.Value = string(obj.KubernetesLabelsExpression)
+											v.Unknown = false
+											tf.Attrs["kubernetes_labels_expression"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["disabled"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"HealthCheckConfig.spec.match.disabled"})
+										} else {
+											v, ok := tf.Attrs["disabled"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"HealthCheckConfig.spec.match.disabled", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"HealthCheckConfig.spec.match.disabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+												}
+												v.Null = bool(obj.Disabled) == false
+											}
+											v.Value = bool(obj.Disabled)
+											v.Unknown = false
+											tf.Attrs["disabled"] = v
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["match"] = v
diff --git a/integrations/terraform/tfschema/resource153/custom_types.go b/integrations/terraform/tfschema/resource153/custom_types.go
index 5b6c5072da1a1..90fe33f77e1eb 100644
--- a/integrations/terraform/tfschema/resource153/custom_types.go
+++ b/integrations/terraform/tfschema/resource153/custom_types.go
@@ -27,6 +27,8 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	apitypes "github.com/gravitational/teleport/api/types"
+
 	"github.com/gravitational/teleport/integrations/terraform/tfschema"
 )
 
@@ -102,3 +104,15 @@ func CopyToDuration(diags diag.Diagnostics, o *durationpb.Duration, t attr.Type,
 
 	return value
 }
+
+func GenSchemaLabels(ctx context.Context, attr tfsdk.Attribute) tfsdk.Attribute {
+	return tfschema.GenSchemaLabels(ctx, attr)
+}
+
+func CopyFromLabels(diags diag.Diagnostics, v attr.Value, o *apitypes.Labels) {
+	tfschema.CopyFromLabels(diags, v, o)
+}
+
+func CopyToLabels(diags diag.Diagnostics, o apitypes.Labels, t attr.Type, v attr.Value) attr.Value {
+	return tfschema.CopyToLabels(diags, o, t, v)
+}
diff --git a/integrations/terraform/tfschema/role_plan_modifier.go b/integrations/terraform/tfschema/role_plan_modifier.go
index 7d50439ac5adc..34da0065cc7d5 100644
--- a/integrations/terraform/tfschema/role_plan_modifier.go
+++ b/integrations/terraform/tfschema/role_plan_modifier.go
@@ -27,9 +27,10 @@ import (
 )
 
 const (
-	DefaultRoleOptionsModifierErrSummary  = "DefaultRoleOptions modifier failed"
-	DefaultRoleOptionsModifierDescription = `This modifier re-render the role.spec.options from the user provided config instead of using the state.
-The state contains server-generated defaults (in fact they are generated in the pre-apply plan).
+	DefaultRoleOptionsModifierErrSummary         = "DefaultRoleOptions modifier failed"
+	DefaultKubernetesResourcesModifierErrSummary = "DefaultKubernetesResources modifier failed"
+
+	DefaultModiferDescription = `The state contains server-generated defaults (in fact they are generated in the pre-apply plan).
 However, those defaults become outdated if the version or the default logic changes.
 One way to deal with version change is to force-recreate, but this is too destructive.
 The workaround we found was to use this plan modifier.`
@@ -47,12 +48,14 @@ type DefaultRoleOptionsModifier struct {
 
 // Description of the RoleOptions plan modifier
 func (d DefaultRoleOptionsModifier) Description(ctx context.Context) string {
-	return DefaultRoleOptionsModifierDescription
+	return "This modifier re-renders the role.spec.options from the user provided config instead of using the state. " +
+		DefaultModiferDescription
 }
 
 // MarkdownDescription of the RoleOptions plan modifier
 func (d DefaultRoleOptionsModifier) MarkdownDescription(ctx context.Context) string {
-	return DefaultRoleOptionsModifierDescription
+	return "This modifier re-renders the role.spec.options from the user provided config instead of using the state. " +
+		DefaultModiferDescription
 }
 
 // Modify the terraform plan to account for defaults applied to RoleOptions by CheckAndSetDefaults
@@ -82,7 +85,7 @@ func (d DefaultRoleOptionsModifier) Modify(ctx context.Context, req tfsdk.Modify
 	diags = CopyRoleV6ToTerraform(ctx, role, &config)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
-		resp.Diagnostics.AddError(DefaultRoleOptionsModifierErrSummary, "Failed to convert back the role into a TF Object.")
+		resp.Diagnostics.AddError(DefaultRoleOptionsModifierErrSummary, "Failed to convert back the role into a TF object.")
 		return
 	}
 
@@ -104,7 +107,98 @@ func (d DefaultRoleOptionsModifier) Modify(ctx context.Context, req tfsdk.Modify
 	options, ok := optionsRaw.(tftypes.Object)
 	if !ok {
 		resp.Diagnostics.AddError(DefaultRoleOptionsModifierErrSummary, "Failed to cast 'options' as a TF object.")
+		return
 	}
 	options.Null = false
 	resp.AttributePlan = options
 }
+
+// DefaultKubernetesResources returns the default implementation of the DefaultKubernetesResourcesModifier
+func DefaultKubernetesResources() tfsdk.AttributePlanModifier {
+	return DefaultKubernetesResourcesModifier{}
+}
+
+// DefaultKubernetesResourcesModifier implements the tfsdk.AttributePlanModifier interface. It accounts
+// for default values applied by CheckAndSetDefaults that would otherwise create inconsistent states
+type DefaultKubernetesResourcesModifier struct{}
+
+// Description of the KubernetesResources plan modifier
+func (d DefaultKubernetesResourcesModifier) Description(_ context.Context) string {
+	return "This modifier re-renders the role.spec.allow.kubernetes_resources from the user provided config instead of using the state. " +
+		DefaultModiferDescription
+}
+
+// MarkdownDescription of the KubernetesResources plan modifier
+func (d DefaultKubernetesResourcesModifier) MarkdownDescription(_ context.Context) string {
+	return "This modifier re-renders the role.spec.allow.kubernetes_resources from the user provided config instead of using the state. " +
+		DefaultModiferDescription
+}
+
+// Modify the terraform plan to account for defaults applied to KubernetesResources by CheckAndSetDefaults
+func (d DefaultKubernetesResourcesModifier) Modify(ctx context.Context, req tfsdk.ModifyAttributePlanRequest, resp *tfsdk.ModifyAttributePlanResponse) {
+	var config tftypes.Object
+	diags := req.Config.Get(ctx, &config)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to get config.")
+		return
+	}
+
+	role := &apitypes.RoleV6{}
+	diags = CopyRoleV6FromTerraform(ctx, config, role)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to create a role from the config.")
+		return
+	}
+
+	err := role.CheckAndSetDefaults()
+	if err != nil {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, fmt.Sprintf("Failed to set the role defaults: %s", err))
+		return
+	}
+
+	diags = CopyRoleV6ToTerraform(ctx, role, &config)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to convert back the role into a TF object.")
+		return
+	}
+
+	specRaw, ok := config.Attrs["spec"]
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to get 'spec' from TF object.")
+		return
+	}
+	spec, ok := specRaw.(tftypes.Object)
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to cast 'spec' as a TF object.")
+		return
+	}
+
+	allowRaw, ok := spec.Attrs["allow"]
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to cast 'allow' as a TF object.")
+		return
+	}
+
+	allow, ok := allowRaw.(tftypes.Object)
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to cast 'allow' as a TF object.")
+		return
+	}
+
+	kubernetesResourcesRaw, ok := allow.Attrs["kubernetes_resources"]
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to cast 'kubernetes_resources' as a TF list.")
+		return
+	}
+
+	kubernetesResources, ok := kubernetesResourcesRaw.(tftypes.List)
+	if !ok {
+		resp.Diagnostics.AddError(DefaultKubernetesResourcesModifierErrSummary, "Failed to cast 'kubernetes_resources' as a TF list.")
+		return
+	}
+	kubernetesResources.Null = false
+	resp.AttributePlan = kubernetesResources
+}
diff --git a/integrations/terraform/tfschema/types_terraform.go b/integrations/terraform/tfschema/types_terraform.go
index c7e83fe403d6a..1162336940d30 100644
--- a/integrations/terraform/tfschema/types_terraform.go
+++ b/integrations/terraform/tfschema/types_terraform.go
@@ -28,6 +28,7 @@ import (
 	proto "github.com/gogo/protobuf/proto"
 	github_com_gravitational_teleport_api_constants "github.com/gravitational/teleport/api/constants"
 	_ "github.com/gravitational/teleport/api/gen/proto/go/attestation/v1"
+	_ "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	github_com_gravitational_teleport_api_types "github.com/gravitational/teleport/api/types"
 	github_com_hashicorp_terraform_plugin_framework_attr "github.com/hashicorp/terraform-plugin-framework/attr"
 	github_com_hashicorp_terraform_plugin_framework_diag "github.com/hashicorp/terraform-plugin-framework/diag"
@@ -197,7 +198,7 @@ func GenSchemaDatabaseV3(ctx context.Context) (github_com_hashicorp_terraform_pl
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
 							}),
-							Description: "DocumentDB contains AWS DocumentDB specific metadata.",
+							Description: "DocumentDB contains Amazon DocumentDB-specific metadata.",
 							Optional:    true,
 						},
 						"elasticache": {
@@ -223,7 +224,16 @@ func GenSchemaDatabaseV3(ctx context.Context) (github_com_hashicorp_terraform_pl
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 								},
 							}),
-							Description: "ElastiCache contains AWS ElastiCache Redis specific metadata.",
+							Description: "ElastiCache contains Amazon ElastiCache Redis-specific metadata.",
+							Optional:    true,
+						},
+						"elasticache_serverless": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"cache_name": {
+								Description: "CacheName is an ElastiCache Serverless cache name.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							}}),
+							Description: "ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.",
 							Optional:    true,
 						},
 						"external_id": {
@@ -372,7 +382,7 @@ func GenSchemaDatabaseV3(ctx context.Context) (github_com_hashicorp_terraform_pl
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
 							}),
-							Description: "RedshiftServerless contains AWS Redshift Serverless specific metadata.",
+							Description: "RedshiftServerless contains Amazon Redshift Serverless-specific metadata.",
 							Optional:    true,
 						},
 						"region": {
@@ -463,6 +473,22 @@ func GenSchemaDatabaseV3(ctx context.Context) (github_com_hashicorp_terraform_pl
 				},
 				"gcp": {
 					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"alloydb": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"endpoint_override": {
+									Description: "EndpointOverride is an override of endpoint address to use.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"endpoint_type": {
+									Description: "EndpointType is the database endpoint type to use. Should be one of: \"private\", \"public\", \"psc\".",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "AlloyDB contains AlloyDB specific configuration elements.",
+							Optional:    true,
+						},
 						"instance_id": {
 							Description: "InstanceID is the Cloud SQL instance ID.",
 							Optional:    true,
@@ -496,11 +522,23 @@ func GenSchemaDatabaseV3(ctx context.Context) (github_com_hashicorp_terraform_pl
 					Optional:    true,
 				},
 				"oracle": {
-					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"audit_user": {
-						Description: "AuditUser is the Oracle database user privilege to access internal Oracle audit trail.",
-						Optional:    true,
-						Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-					}}),
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"audit_user": {
+							Description: "AuditUser is the name of the Oracle database user that should be used to access the internal audit trail.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"retry_count": {
+							Description: "RetryCount is the maximum number of times to retry connecting to a host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
+						},
+						"shuffle_hostnames": {
+							Description: "ShuffleHostnames, when true, randomizes the order of hosts to connect to from the provided list.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
+					}),
 					Description: "Oracle is an additional Oracle configuration options.",
 					Optional:    true,
 				},
@@ -618,6 +656,11 @@ func GenSchemaServerV2(ctx context.Context) (github_com_hashicorp_terraform_plug
 			Optional:      true,
 			PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
 		},
+		"scope": {
+			Description: "The advertized scope of the server which can not change once assigned.",
+			Optional:    true,
+			Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
 		"spec": {
 			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
 				"addr": {
@@ -701,6 +744,16 @@ func GenSchemaServerV2(ctx context.Context) (github_com_hashicorp_terraform_plug
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 				},
+				"relay_group": {
+					Description: "the name of the Relay group that the server is connected to",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"relay_ids": {
+					Description: "the list of Relay host IDs that the server is connected to",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+				},
 				"rotation": {
 					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
 						"current_id": {
@@ -984,6 +1037,27 @@ func GenSchemaAppV3(ctx context.Context) (github_com_hashicorp_terraform_plugin_
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
+				"mcp": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"args": {
+							Description: "Args to execute with the command.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+						},
+						"command": {
+							Description: "Command to launch stdio-based MCP servers.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"run_as_host_user": {
+							Description: "RunAsHostUser is the host user account under which the command will be executed. Required for stdio-based MCP servers.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "MCP contains MCP server related configurations.",
+					Optional:    true,
+				},
 				"public_addr": {
 					Description: "PublicAddr is the public address the application is accessible at.",
 					Optional:    true,
@@ -1303,12 +1377,12 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
 								"must_register_before": {
-									Description: "MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.",
+									Description: "MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.",
 									Optional:    true,
 									Type:        UseRFC3339Time(),
 								},
 								"registration_secret": {
-									Description: "RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.",
+									Description: "RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.",
 									Optional:    true,
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
@@ -1368,6 +1442,71 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 					Description: "CircleCI allows the configuration of options specific to the \"circleci\" join method.",
 					Optional:    true,
 				},
+				"env0": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"allow": {
+						Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							"deployer_email": {
+								Description: "DeployerEmail is the email of the person that triggered the deployment, corresponding to `deployerEmail` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"deployment_type": {
+								Description: "DeploymentType is the env0 deployment type, such as \"deploy\", \"destroy\", etc. Corresponds to `deploymentType` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"env0_tag": {
+								Description: "Env0Tag is a custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"environment_id": {
+								Description: "EnvironmentID is the unique identifier of the Env0 environment, corresponding to `environmentId` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"environment_name": {
+								Description: "EnvironmentName is the name of the Env0 environment, corresponding to `environmentName` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"organization_id": {
+								Description: "OrganizationID is the unique organization identifier, corresponding to `organizationId` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"project_id": {
+								Description: "ProjectID is a unique project identifier, corresponding to `projectId` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"project_name": {
+								Description: "ProjectName is the name of the project under which the job was run corresponding to `projectName` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"template_id": {
+								Description: "TemplateID is the unique identifier of the Env0 template, corresponding to `templateId` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"template_name": {
+								Description: "TemplateName is the name of the Env0 template, corresponding to `templateName` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+							"workspace_name": {
+								Description: "WorkspaceName is the name of the Env0 workspace, corresponding to `workspaceName` in an Env0 OIDC token.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+							},
+						}),
+						Description: "Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token.",
+						Optional:    true,
+					}}),
+					Description: "Env0 allows the configuration of options specific to the \"env0\" join method.",
+					Optional:    true,
+				},
 				"gcp": {
 					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"allow": {
 						Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
@@ -1576,6 +1715,22 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 							Description: "Allow is a list of Rules, nodes using this token must match one allow rule to use this token.",
 							Optional:    true,
 						},
+						"oidc": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"insecure_allow_http_issuer": {
+									Description: "InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"issuer": {
+									Description: "Issuer is the URI of the OIDC issuer. It must have an accessible and OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should be a valid URL and must exactly match the `issuer` field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "OIDCConfig configures the `oidc` type.",
+							Optional:    true,
+						},
 						"static_jwks": {
 							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"jwks": {
 								Description: "JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.",
@@ -1586,7 +1741,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 							Optional:    true,
 						},
 						"type": {
-							Description: "Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.",
+							Description: "Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults to `in_cluster`.",
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
@@ -1597,6 +1752,11 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 				"oracle": {
 					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"allow": {
 						Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+							"instances": {
+								Description: "Instances is a list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+							},
 							"parent_compartments": {
 								Description: "ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.",
 								Optional:    true,
@@ -1629,7 +1789,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 						"allow": {
 							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
 								"caller_id": {
-									Description: "CallerID is the ID of the caller, ie. the stack or module that generated the run.",
+									Description: "CallerID is the ID of the caller, ie. the stack or module that generated the run.  This field supports \"glob-style\" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.",
 									Optional:    true,
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
@@ -1644,7 +1804,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
 								"space_id": {
-									Description: "SpaceID is the ID of the space in which the run that owns the token was executed.",
+									Description: "SpaceID is the ID of the space in which the run that owns the token was executed.  This field supports \"glob-style\" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.",
 									Optional:    true,
 									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 								},
@@ -1652,6 +1812,11 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 							Description: "Allow is a list of Rules, nodes using this token must match one allow rule to use this token.",
 							Optional:    true,
 						},
+						"enable_glob_matching": {
+							Description: "EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
 						"hostname": {
 							Description: "Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`",
 							Optional:    true,
@@ -1776,7 +1941,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 						Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 					},
 					"last_recovered_at": {
-						Description: "LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does,  either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated.",
+						Description: "LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated.",
 						Optional:    true,
 						Type:        UseRFC3339Time(),
 					},
@@ -1791,7 +1956,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf
 						Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
 					},
 					"registration_secret": {
-						Description: "RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.",
+						Description: "RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.",
 						Optional:    true,
 						Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 					},
@@ -1920,7 +2085,7 @@ func GenSchemaClusterNetworkingConfigV2(ctx context.Context) (github_com_hashico
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
 				},
 				"session_control_timeout": {
-					Description: "SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the auth server before it begins terminating controlled sessions.",
+					Description: "SessionControlTimeout is the session control lease expiry and defines the upper limit of how long a node may be out of contact with the Auth Service before it begins terminating controlled sessions.",
 					Optional:    true,
 					Type:        DurationType{},
 				},
@@ -2033,6 +2198,60 @@ func GenSchemaSessionRecordingConfigV2(ctx context.Context) (github_com_hashicor
 		},
 		"spec": {
 			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"encryption": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"enabled": {
+							Description: "Enabled controls whether or not session recordings should be encrypted.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
+						"manual_key_management": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"active_keys": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"label": {
+											Description: "Label is a value that can be used with the related keystore in order to find relevant keys.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"type": {
+											Description: "Type represents which keystore should be searched when looking up keys by label.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "ActiveKeys describe which keys should be queried for active recording encryption and replay.",
+									Optional:    true,
+								},
+								"enabled": {
+									Description: "Enabled controls whether or recording encryption keys should be managed externally.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"rotated_keys": {
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"label": {
+											Description: "Label is a value that can be used with the related keystore in order to find relevant keys.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"type": {
+											Description: "Type represents which keystore should be searched when looking up keys by label.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
+									Description: "RotatedKeys describe which keys should be queried for historical replay.",
+									Optional:    true,
+								},
+							}),
+							Description: "ManualKeyManagement defines whether or not recording encryption keys should be managed externally and how to query those keys.",
+							Optional:    true,
+						},
+					}),
+					Description: "Encryption configures if and how session recordings should be encrypted.",
+					Optional:    true,
+				},
 				"mode": {
 					Computed:      true,
 					Description:   "Mode controls where (or if) the session is recorded.",
@@ -2048,6 +2267,19 @@ func GenSchemaSessionRecordingConfigV2(ctx context.Context) (github_com_hashicor
 			Description: "Spec is a SessionRecordingConfig specification",
 			Optional:    true,
 		},
+		"status": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"encryption_keys": {
+				Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.ListNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"public_key": {
+					Description: "A PKIX ASN.1 DER encoded public key used for key wrapping during age encryption. Expected to be RSA 4096.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				}}),
+				Description: "EncryptionKeys contain the currently active age encryption keys used for encrypted session recording.",
+				Optional:    true,
+			}}),
+			Description: "Status is the SessionRecordingConfig status containing active encryption keys",
+			Optional:    true,
+		},
 		"sub_kind": {
 			Description: "SubKind is an optional resource sub kind, used in some resources",
 			Optional:    true,
@@ -2159,7 +2391,7 @@ func GenSchemaAuthPreferenceV2(ctx context.Context) (github_com_hashicorp_terraf
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 						},
 						"mode": {
-							Description: "Mode of verification for trusted devices.  The following modes are supported:  - \"off\": disables both device authentication and authorization. - \"optional\": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - \"required\": enforces the presence of device extensions for sensitive endpoints.  Mode is always \"off\" for OSS. Defaults to \"optional\" for Enterprise.",
+							Description: "Mode of verification for trusted devices.  The following modes are supported:  - \"off\": disables both device authentication and authorization. - \"optional\": allows both device authentication and authorization, but doesn't enforce the presence of device extensions for sensitive endpoints. - \"required\": enforces the presence of device extensions for sensitive endpoints. - \"required-for-humans\": enforces the presence of device extensions for sensitive endpoints, for human users only (bots are exempt).  Mode is always \"off\" for OSS. Defaults to \"optional\" for Enterprise.",
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
@@ -2633,7 +2865,7 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 							Computed:      true,
 							Description:   "KubernetesResources is the Kubernetes Resources this Role grants access to.",
 							Optional:      true,
-							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+							PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{DefaultKubernetesResources()},
 						},
 						"kubernetes_users": {
 							Description: "KubeUsers is an optional kubernetes users to impersonate",
@@ -2645,6 +2877,15 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 						},
+						"mcp": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"tools": {
+								Description: "Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. \"prefix_*\"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+							}}),
+							Description: "MCPPermissions defines MCP servers related permissions.",
+							Optional:    true,
+						},
 						"node_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
 							Description: "NodeLabels is a map of node labels (used to dynamically grant access to nodes).",
 							Optional:    true,
@@ -2703,11 +2944,18 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 									Type:        DurationType{},
 								},
 								"reason": {
-									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"mode": {
-										Description: "Mode can be either \"required\" or \"optional\". Empty string is treated as \"optional\". If a role has the request reason mode set to \"required\", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.",
-										Optional:    true,
-										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-									}}),
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"mode": {
+											Description: "Mode can be either \"required\" or \"optional\". Empty string is treated as \"optional\". If a role has the request reason mode set to \"required\", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"prompt": {
+											Description: "Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
 									Description: "Reason defines settings for the reason for the access provided by the user.",
 									Optional:    true,
 								},
@@ -3142,6 +3390,15 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 						},
+						"mcp": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"tools": {
+								Description: "Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. \"prefix_*\"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.",
+								Optional:    true,
+								Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+							}}),
+							Description: "MCPPermissions defines MCP servers related permissions.",
+							Optional:    true,
+						},
 						"node_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
 							Description: "NodeLabels is a map of node labels (used to dynamically grant access to nodes).",
 							Optional:    true,
@@ -3200,11 +3457,18 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 									Type:        DurationType{},
 								},
 								"reason": {
-									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{"mode": {
-										Description: "Mode can be either \"required\" or \"optional\". Empty string is treated as \"optional\". If a role has the request reason mode set to \"required\", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.",
-										Optional:    true,
-										Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-									}}),
+									Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+										"mode": {
+											Description: "Mode can be either \"required\" or \"optional\". Empty string is treated as \"optional\". If a role has the request reason mode set to \"required\", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+										"prompt": {
+											Description: "Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.",
+											Optional:    true,
+											Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+										},
+									}),
 									Description: "Reason defines settings for the reason for the access provided by the user.",
 									Optional:    true,
 								},
@@ -3647,10 +3911,10 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
 			Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 		},
 		"version": {
-			Description: "Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`.",
+			Description: "Version is the resource version. It must be specified. Supported values are: `v3`, `v4`, `v5`, `v6`, `v7`, `v8`.",
 			Required:    true,
 			Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
-			Validators:  []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{UseVersionBetween(3, 7)},
+			Validators:  []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{UseVersionBetween(3, 8)},
 		},
 	}}, nil
 }
@@ -3962,6 +4226,27 @@ func GenSchemaOIDCConnectorV3(ctx context.Context) (github_com_hashicorp_terrafo
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
+				"entra_id_groups_provider": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"disabled": {
+							Description: "Disabled specifies that the groups provider should be disabled even when Entra ID responds with a groups claim source. User may choose to disable it if they are using integrations such as SCIM or similar groups importer as connector based role mapping may be not needed in such a scenario.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+						},
+						"graph_endpoint": {
+							Description: "GraphEndpoint is a Microsoft Graph API endpoint. The groups claim source endpoint provided by Entra ID points to the now-retired Azure AD Graph endpoint (\"https://graph.windows.net\"). To convert it to the newer Microsoft Graph API endpoint, Teleport defaults to the Microsoft Graph global service endpoint (\"https://graph.microsoft.com\"). Update GraphEndpoint to point to a different Microsoft Graph national cloud deployment endpoint.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"group_type": {
+							Description: "GroupType is a user group type filter. Defaults to \"security-groups\". Value can be \"security-groups\", \"directory-roles\", \"all-groups\".",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "EntraIDGroupsProvider configures out-of-band user groups provider. It works by following through the groups claim source, which is sent for the \"groups\" claim when the user's group membership exceeds 200 max item limit.",
+					Optional:    true,
+				},
 				"google_admin_email": {
 					Description: "GoogleAdminEmail is the email of a google admin to impersonate.",
 					Optional:    true,
@@ -4020,6 +4305,11 @@ func GenSchemaOIDCConnectorV3(ctx context.Context) (github_com_hashicorp_terrafo
 							Optional:    true,
 							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
 						},
+						"request_object_mode": {
+							Description: "RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters. If omitted, MFA flows will default to the `RequestObjectMode` behavior specified in the base OIDC connector. Set this property to 'none' to explicitly disable request objects for the MFA client.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
 					}),
 					Description: "MFASettings contains settings to enable SSO MFA checks through this auth connector.",
 					Optional:    true,
@@ -4043,11 +4333,21 @@ func GenSchemaOIDCConnectorV3(ctx context.Context) (github_com_hashicorp_terrafo
 					Description: "RedirectURLs is a list of callback URLs which the identity provider can use to redirect the client back to the Teleport Proxy to complete authentication. This list should match the URLs on the provider's side. The URL used for a given auth request will be chosen to match the requesting Proxy's public address. If there is no match, the first url in the list will be used.",
 					Optional:    true,
 				}),
+				"request_object_mode": {
+					Description: "RequestObjectMode determines how JWT-Secured Authorization Requests will be used for authorization requests. JARs, or request objects, can provide integrity protection, source authentication, and confidentiality for authorization request parameters.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
 				"scope": {
 					Description: "Scope specifies additional scopes set by provider.",
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
 				},
+				"user_matchers": {
+					Description: "UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+				},
 				"username_claim": {
 					Description: "UsernameClaim specifies the name of the claim from the OIDC connector to be used as the user's username.",
 					Optional:    true,
@@ -4232,6 +4532,11 @@ func GenSchemaSAMLConnectorV2(ctx context.Context) (github_com_hashicorp_terrafo
 					Optional:    true,
 					Type:        github_com_hashicorp_terraform_plugin_framework_types.Int64Type,
 				},
+				"include_subject": {
+					Description: "IncludeSubject is a flag that indicates whether the Subject element is included in the SAML authentication request. Defaults to false. Note: Some IdPs will reject requests that contain a Subject.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+				},
 				"issuer": {
 					Computed:      true,
 					Description:   "Issuer is the identity provider issuer.",
@@ -4332,6 +4637,11 @@ func GenSchemaSAMLConnectorV2(ctx context.Context) (github_com_hashicorp_terrafo
 					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
 					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
 				},
+				"user_matchers": {
+					Description: "UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+				},
 			}),
 			Description: "Spec is an SAML connector specification.",
 			Required:    true,
@@ -4509,6 +4819,11 @@ func GenSchemaGithubConnectorV3(ctx context.Context) (github_com_hashicorp_terra
 					Description: "TeamsToRoles maps Github team memberships onto allowed roles.",
 					Optional:    true,
 				},
+				"user_matchers": {
+					Description: "UserMatchers is a set of glob patterns to narrow down which username(s) this auth connector should match for identifier-first login.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+				},
 			}),
 			Description: "Spec is an Github connector specification.",
 			Required:    true,
@@ -5042,6 +5357,162 @@ func GenSchemaOktaImportRuleV1(ctx context.Context) (github_com_hashicorp_terraf
 	}}, nil
 }
 
+// GenSchemaIntegrationV1 returns tfsdk.Schema definition for IntegrationV1
+func GenSchemaIntegrationV1(ctx context.Context) (github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema, github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics) {
+	return github_com_hashicorp_terraform_plugin_framework_tfsdk.Schema{Attributes: map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+		"id": {
+			Computed:      true,
+			Optional:      false,
+			PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+			Required:      false,
+			Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
+		"kind": {
+			Computed:      true,
+			Description:   "Kind is a resource kind",
+			Optional:      true,
+			PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+			Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
+		"metadata": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"description": {
+					Description: "Description is object description",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"expires": {
+					Description: "Expires is a global expiry time header can be set on any resource in the system.",
+					Optional:    true,
+					Type:        UseRFC3339Time(),
+					Validators:  []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{MustTimeBeInFuture()},
+				},
+				"labels": {
+					Description: "Labels is a set of labels",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.MapType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+				},
+				"name": {
+					Description:   "Name is an object name",
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.RequiresReplace()},
+					Required:      true,
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"namespace": {
+					Computed:      true,
+					Description:   "Namespace is object namespace. The field should be called \"namespace\" when it returns in Teleport 2.4.",
+					Optional:      true,
+					PlanModifiers: []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributePlanModifier{github_com_hashicorp_terraform_plugin_framework_tfsdk.UseStateForUnknown()},
+					Type:          github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+				"revision": {
+					Description: "Revision is an opaque identifier which tracks the versions of a resource over time. Clients should ignore and not alter its value but must return the revision in any updates of a resource.",
+					Optional:    true,
+					Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+				},
+			}),
+			Description: "Metadata is resource metadata",
+			Required:    true,
+		},
+		"spec": {
+			Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+				"aws_oidc": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"audience": {
+							Description: "Audience is used to record a name of a plugin or a discover service in Teleport that depends on this integration. Audience value can either be empty or \"aws-identity-center\". Preset audience may impose specific behavior on the integration CRUD API, such as preventing integration from update or deletion. Empty audience value should be treated as a default and backward-compatible behavior of the integration.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"issuer_s3_uri": {
+							Description: "IssuerS3URI is the Identity Provider that was configured in AWS. This bucket/prefix/* files must be publicly accessible and contain the following: > .well-known/openid-configuration > .well-known/jwks Format: `s3://<bucket>/<prefix>` Optional. The proxy's endpoint is used if it is not specified.  DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate. Amazon had some whitelisted providers where the thumbprint was ignored. S3 hosted providers was in that list. Amazon is now trusting all the root certificate authorities, and this workaround is no longer needed. DELETE IN 18.0.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"role_arn": {
+							Description: "RoleARN contains the Role ARN used to set up the Integration. This is the AWS Role that Teleport will use to issue tokens for API Calls.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "AWSOIDC contains the specific fields to handle the AWS OIDC Integration subkind",
+					Optional:    true,
+				},
+				"aws_ra": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"profile_sync_config": {
+							Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+								"enabled": {
+									Description: "Enabled is set to true if this integration should sync profiles as application servers.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"profile_accepts_role_session_name": {
+									Description: "ProfileAcceptsRoleSessionName indicates whether the profile accepts a custom Role Session name.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.BoolType,
+								},
+								"profile_arn": {
+									Description: "ProfileARN is the ARN of the Roles Anywhere Profile used to generate credentials to access the AWS APIs.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+								"profile_name_filters": {
+									Description: "ProfileNameFilters is a list of filters applied to the profile name. Only matching profiles will be synchronized as application servers. If empty, no filtering is applied.  Filters can be globs, for example:  profile* *name*  Or regexes if they're prefixed and suffixed with ^ and $, for example:  ^profile.*$ ^.*name.*$",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
+								},
+								"role_arn": {
+									Description: "RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.",
+									Optional:    true,
+									Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+								},
+							}),
+							Description: "ProfileSyncConfig contains the configuration for the AWS Roles Anywhere Profile sync. This is used to create AWS Roles Anywhere profiles as application servers.",
+							Optional:    true,
+						},
+						"trust_anchor_arn": {
+							Description: "TrustAnchorARN contains the AWS IAM Roles Anywhere Trust Anchor ARN used to set up the Integration.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "AWSRA contains the specific fields to handle the AWS Roles Anywhere Integration subkind.",
+					Optional:    true,
+				},
+				"azure_oidc": {
+					Attributes: github_com_hashicorp_terraform_plugin_framework_tfsdk.SingleNestedAttributes(map[string]github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
+						"client_id": {
+							Description: "ClientID specifies the ID of Azure enterprise application (client) that corresponds to this plugin.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+						"tenant_id": {
+							Description: "TenantID specifies the ID of Entra Tenant (Directory) that this plugin integrates with.",
+							Optional:    true,
+							Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+						},
+					}),
+					Description: "AzureOIDC contains the specific fields to handle the Azure OIDC Integration subkind",
+					Optional:    true,
+				},
+			}),
+			Description: "Spec is an Integration specification.",
+			Required:    true,
+		},
+		"sub_kind": {
+			Description: "SubKind is an optional resource sub kind, used in some resources",
+			Required:    true,
+			Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+		},
+		"version": {
+			Description: "Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by \"v\". For example: `v1`",
+			Required:    true,
+			Type:        github_com_hashicorp_terraform_plugin_framework_types.StringType,
+			Validators:  []github_com_hashicorp_terraform_plugin_framework_tfsdk.AttributeValidator{UseVersionBetween(1, 1)},
+		},
+	}}, nil
+}
+
 // CopyDatabaseV3FromTerraform copies contents of the source Terraform object into a target struct
 func CopyDatabaseV3FromTerraform(_ context.Context, tf github_com_hashicorp_terraform_plugin_framework_types.Object, obj *github_com_gravitational_teleport_api_types.DatabaseV3) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
 	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
@@ -6197,6 +6668,40 @@ func CopyDatabaseV3FromTerraform(_ context.Context, tf github_com_hashicorp_terr
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["elasticache_serverless"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.ElastiCacheServerless = github_com_gravitational_teleport_api_types.ElastiCacheServerless{}
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj := &obj.ElastiCacheServerless
+													{
+														a, ok := tf.Attrs["cache_name"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless.CacheName"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless.CacheName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.CacheName = t
+															}
+														}
+													}
+												}
+											}
+										}
+									}
 								}
 							}
 						}
@@ -6248,6 +6753,57 @@ func CopyDatabaseV3FromTerraform(_ context.Context, tf github_com_hashicorp_terr
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["alloydb"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.AlloyDB = github_com_gravitational_teleport_api_types.AlloyDB{}
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj := &obj.AlloyDB
+													{
+														a, ok := tf.Attrs["endpoint_type"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointType"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointType", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.EndpointType = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["endpoint_override"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointOverride"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointOverride", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.EndpointOverride = t
+															}
+														}
+													}
+												}
+											}
+										}
+									}
 								}
 							}
 						}
@@ -6742,6 +7298,40 @@ func CopyDatabaseV3FromTerraform(_ context.Context, tf github_com_hashicorp_terr
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["retry_count"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.Oracle.RetryCount"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.Oracle.RetryCount", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+											} else {
+												var t int32
+												if !v.Null && !v.Unknown {
+													t = int32(v.Value)
+												}
+												obj.RetryCount = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["shuffle_hostnames"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"DatabaseV3.Spec.Oracle.ShuffleHostnames"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"DatabaseV3.Spec.Oracle.ShuffleHostnames", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+											} else {
+												var t bool
+												if !v.Null && !v.Unknown {
+													t = bool(v.Value)
+												}
+												obj.ShuffleHostnames = t
+											}
+										}
+									}
 								}
 							}
 						}
@@ -8469,6 +9059,58 @@ func CopyDatabaseV3ToTerraform(ctx context.Context, obj *github_com_gravitationa
 											}
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["elasticache_serverless"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["elasticache_serverless"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												{
+													obj := obj.ElastiCacheServerless
+													tf := &v
+													{
+														t, ok := tf.AttrTypes["cache_name"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless.CacheName"})
+														} else {
+															v, ok := tf.Attrs["cache_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"DatabaseV3.Spec.AWS.ElastiCacheServerless.CacheName", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.AWS.ElastiCacheServerless.CacheName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.CacheName) == ""
+															}
+															v.Value = string(obj.CacheName)
+															v.Unknown = false
+															tf.Attrs["cache_name"] = v
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["elasticache_serverless"] = v
+											}
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["aws"] = v
@@ -8543,6 +9185,80 @@ func CopyDatabaseV3ToTerraform(ctx context.Context, obj *github_com_gravitationa
 											tf.Attrs["instance_id"] = v
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["alloydb"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["alloydb"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												{
+													obj := obj.AlloyDB
+													tf := &v
+													{
+														t, ok := tf.AttrTypes["endpoint_type"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointType"})
+														} else {
+															v, ok := tf.Attrs["endpoint_type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"DatabaseV3.Spec.GCP.AlloyDB.EndpointType", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointType", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.EndpointType) == ""
+															}
+															v.Value = string(obj.EndpointType)
+															v.Unknown = false
+															tf.Attrs["endpoint_type"] = v
+														}
+													}
+													{
+														t, ok := tf.AttrTypes["endpoint_override"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointOverride"})
+														} else {
+															v, ok := tf.Attrs["endpoint_override"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"DatabaseV3.Spec.GCP.AlloyDB.EndpointOverride", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.GCP.AlloyDB.EndpointOverride", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.EndpointOverride) == ""
+															}
+															v.Value = string(obj.EndpointOverride)
+															v.Unknown = false
+															tf.Attrs["endpoint_override"] = v
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["alloydb"] = v
+											}
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["gcp"] = v
@@ -9247,6 +9963,50 @@ func CopyDatabaseV3ToTerraform(ctx context.Context, obj *github_com_gravitationa
 											tf.Attrs["audit_user"] = v
 										}
 									}
+									{
+										t, ok := tf.AttrTypes["retry_count"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.Oracle.RetryCount"})
+										} else {
+											v, ok := tf.Attrs["retry_count"].(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DatabaseV3.Spec.Oracle.RetryCount", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Int64)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.Oracle.RetryCount", "github.com/hashicorp/terraform-plugin-framework/types.Int64"})
+												}
+												v.Null = int64(obj.RetryCount) == 0
+											}
+											v.Value = int64(obj.RetryCount)
+											v.Unknown = false
+											tf.Attrs["retry_count"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["shuffle_hostnames"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"DatabaseV3.Spec.Oracle.ShuffleHostnames"})
+										} else {
+											v, ok := tf.Attrs["shuffle_hostnames"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"DatabaseV3.Spec.Oracle.ShuffleHostnames", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"DatabaseV3.Spec.Oracle.ShuffleHostnames", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+												}
+												v.Null = bool(obj.ShuffleHostnames) == false
+											}
+											v.Value = bool(obj.ShuffleHostnames)
+											v.Unknown = false
+											tf.Attrs["shuffle_hostnames"] = v
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["oracle"] = v
@@ -9992,7 +10752,68 @@ func CopyServerV2FromTerraform(_ context.Context, tf github_com_hashicorp_terraf
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["relay_group"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"ServerV2.Spec.relay_group"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"ServerV2.Spec.relay_group", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.RelayGroup = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["relay_ids"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"ServerV2.Spec.relay_ids"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"ServerV2.Spec.relay_ids", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.RelayIds = make([]string, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"ServerV2.Spec.relay_ids", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+										} else {
+											var t string
+											if !v.Null && !v.Unknown {
+												t = string(v.Value)
+											}
+											obj.RelayIds[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["scope"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"ServerV2.scope"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"ServerV2.scope", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+			} else {
+				var t string
+				if !v.Null && !v.Unknown {
+					t = string(v.Value)
 				}
+				obj.Scope = t
 			}
 		}
 	}
@@ -11060,12 +11881,109 @@ func CopyServerV2ToTerraform(ctx context.Context, obj *github_com_gravitational_
 							}
 						}
 					}
+					{
+						t, ok := tf.AttrTypes["relay_group"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"ServerV2.Spec.relay_group"})
+						} else {
+							v, ok := tf.Attrs["relay_group"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"ServerV2.Spec.relay_group", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"ServerV2.Spec.relay_group", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.RelayGroup) == ""
+							}
+							v.Value = string(obj.RelayGroup)
+							v.Unknown = false
+							tf.Attrs["relay_group"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["relay_ids"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"ServerV2.Spec.relay_ids"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"ServerV2.Spec.relay_ids", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["relay_ids"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RelayIds)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RelayIds))
+									}
+								}
+								if obj.RelayIds != nil {
+									t := o.ElemType
+									if len(obj.RelayIds) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RelayIds))
+									}
+									for k, a := range obj.RelayIds {
+										v, ok := tf.Attrs["relay_ids"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+											if err != nil {
+												diags.Append(attrWriteGeneralError{"ServerV2.Spec.relay_ids", err})
+											}
+											v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"ServerV2.Spec.relay_ids", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											}
+											v.Null = string(a) == ""
+										}
+										v.Value = string(a)
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.RelayIds) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["relay_ids"] = c
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
 			}
 		}
 	}
+	{
+		t, ok := tf.AttrTypes["scope"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"ServerV2.scope"})
+		} else {
+			v, ok := tf.Attrs["scope"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+				if err != nil {
+					diags.Append(attrWriteGeneralError{"ServerV2.scope", err})
+				}
+				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+				if !ok {
+					diags.Append(attrWriteConversionFailureDiag{"ServerV2.scope", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+				}
+				v.Null = string(obj.Scope) == ""
+			}
+			v.Value = string(obj.Scope)
+			v.Unknown = false
+			tf.Attrs["scope"] = v
+		}
+	}
 	return diags
 }
 
@@ -12061,6 +12979,85 @@ func CopyAppV3FromTerraform(_ context.Context, tf github_com_hashicorp_terraform
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["mcp"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"AppV3.Spec.MCP"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"AppV3.Spec.MCP", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.MCP = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.MCP = &github_com_gravitational_teleport_api_types.MCP{}
+									obj := obj.MCP
+									{
+										a, ok := tf.Attrs["command"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"AppV3.Spec.MCP.command"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"AppV3.Spec.MCP.command", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Command = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["args"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"AppV3.Spec.MCP.args"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"AppV3.Spec.MCP.args", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+											} else {
+												obj.Args = make([]string, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"AppV3.Spec.MCP.args", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+														} else {
+															var t string
+															if !v.Null && !v.Unknown {
+																t = string(v.Value)
+															}
+															obj.Args[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["run_as_host_user"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"AppV3.Spec.MCP.run_as_host_user"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"AppV3.Spec.MCP.run_as_host_user", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.RunAsHostUser = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -13656,6 +14653,135 @@ func CopyAppV3ToTerraform(ctx context.Context, obj *github_com_gravitational_tel
 							tf.Attrs["use_any_proxy_public_addr"] = v
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["mcp"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"AppV3.Spec.MCP"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"AppV3.Spec.MCP", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["mcp"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.MCP == nil {
+									v.Null = true
+								} else {
+									obj := obj.MCP
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["command"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"AppV3.Spec.MCP.command"})
+										} else {
+											v, ok := tf.Attrs["command"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"AppV3.Spec.MCP.command", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"AppV3.Spec.MCP.command", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Command) == ""
+											}
+											v.Value = string(obj.Command)
+											v.Unknown = false
+											tf.Attrs["command"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["args"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"AppV3.Spec.MCP.args"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"AppV3.Spec.MCP.args", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+											} else {
+												c, ok := tf.Attrs["args"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+														ElemType: o.ElemType,
+														Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Args)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Args))
+													}
+												}
+												if obj.Args != nil {
+													t := o.ElemType
+													if len(obj.Args) != len(c.Elems) {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Args))
+													}
+													for k, a := range obj.Args {
+														v, ok := tf.Attrs["args"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+															if err != nil {
+																diags.Append(attrWriteGeneralError{"AppV3.Spec.MCP.args", err})
+															}
+															v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"AppV3.Spec.MCP.args", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															}
+															v.Null = string(a) == ""
+														}
+														v.Value = string(a)
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.Args) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["args"] = c
+											}
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["run_as_host_user"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"AppV3.Spec.MCP.run_as_host_user"})
+										} else {
+											v, ok := tf.Attrs["run_as_host_user"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"AppV3.Spec.MCP.run_as_host_user", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"AppV3.Spec.MCP.run_as_host_user", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.RunAsHostUser) == ""
+											}
+											v.Value = string(obj.RunAsHostUser)
+											v.Unknown = false
+											tf.Attrs["run_as_host_user"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["mcp"] = v
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
@@ -14505,6 +15631,58 @@ func CopyProvisionTokenV2FromTerraform(_ context.Context, tf github_com_hashicor
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["oidc"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.OIDC = nil
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj.OIDC = &github_com_gravitational_teleport_api_types.ProvisionTokenSpecV2Kubernetes_OIDCConfig{}
+													obj := obj.OIDC
+													{
+														a, ok := tf.Attrs["issuer"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.Issuer"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.Issuer", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.Issuer = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["insecure_allow_http_issuer"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.InsecureAllowHTTPIssuer"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.InsecureAllowHTTPIssuer", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+															} else {
+																var t bool
+																if !v.Null && !v.Unknown {
+																	t = bool(v.Value)
+																}
+																obj.InsecureAllowHTTPIssuer = t
+															}
+														}
+													}
+												}
+											}
+										}
+									}
 								}
 							}
 						}
@@ -15189,6 +16367,23 @@ func CopyProvisionTokenV2FromTerraform(_ context.Context, tf github_com_hashicor
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["enable_glob_matching"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Spacelift.EnableGlobMatching"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Spacelift.EnableGlobMatching", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+											} else {
+												var t bool
+												if !v.Null && !v.Unknown {
+													t = bool(v.Value)
+												}
+												obj.EnableGlobMatching = t
+											}
+										}
+									}
 								}
 							}
 						}
@@ -15773,6 +16968,33 @@ func CopyProvisionTokenV2FromTerraform(_ context.Context, tf github_com_hashicor
 																		}
 																	}
 																}
+																{
+																	a, ok := tf.Attrs["instances"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+																		} else {
+																			obj.Instances = make([]string, len(v.Elems))
+																			if !v.Null && !v.Unknown {
+																				for k, a := range v.Elems {
+																					v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																					} else {
+																						var t string
+																						if !v.Null && !v.Unknown {
+																							t = string(v.Value)
+																						}
+																						obj.Instances[k] = t
+																					}
+																				}
+																			}
+																		}
+																	}
+																}
 															}
 															obj.Allow[k] = t
 														}
@@ -16143,6 +17365,240 @@ func CopyProvisionTokenV2FromTerraform(_ context.Context, tf github_com_hashicor
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["env0"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.Env0 = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.Env0 = &github_com_gravitational_teleport_api_types.ProvisionTokenSpecV2Env0{}
+									obj := obj.Env0
+									{
+										a, ok := tf.Attrs["allow"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+											} else {
+												obj.Allow = make([]*github_com_gravitational_teleport_api_types.ProvisionTokenSpecV2Env0_Rule, len(v.Elems))
+												if !v.Null && !v.Unknown {
+													for k, a := range v.Elems {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+														} else {
+															var t *github_com_gravitational_teleport_api_types.ProvisionTokenSpecV2Env0_Rule
+															if !v.Null && !v.Unknown {
+																tf := v
+																t = &github_com_gravitational_teleport_api_types.ProvisionTokenSpecV2Env0_Rule{}
+																obj := t
+																{
+																	a, ok := tf.Attrs["organization_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.OrganizationID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.OrganizationID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.OrganizationID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["project_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ProjectID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["project_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ProjectName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["template_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.TemplateID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["template_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.TemplateName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["environment_id"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentID"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.EnvironmentID = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["environment_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.EnvironmentName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["workspace_name"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.WorkspaceName"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.WorkspaceName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.WorkspaceName = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["deployment_type"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeploymentType"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeploymentType", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.DeploymentType = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["deployer_email"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeployerEmail"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeployerEmail", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.DeployerEmail = t
+																		}
+																	}
+																}
+																{
+																	a, ok := tf.Attrs["env0_tag"]
+																	if !ok {
+																		diags.Append(attrReadMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.Env0Tag"})
+																	} else {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.Env0Tag", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Env0Tag = t
+																		}
+																	}
+																}
+															}
+															obj.Allow[k] = t
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -17567,6 +19023,82 @@ func CopyProvisionTokenV2ToTerraform(ctx context.Context, obj *github_com_gravit
 											}
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["oidc"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["oidc"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												if obj.OIDC == nil {
+													v.Null = true
+												} else {
+													obj := obj.OIDC
+													tf := &v
+													{
+														t, ok := tf.AttrTypes["issuer"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.Issuer"})
+														} else {
+															v, ok := tf.Attrs["issuer"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Kubernetes.OIDC.Issuer", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.Issuer", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.Issuer) == ""
+															}
+															v.Value = string(obj.Issuer)
+															v.Unknown = false
+															tf.Attrs["issuer"] = v
+														}
+													}
+													{
+														t, ok := tf.AttrTypes["insecure_allow_http_issuer"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.InsecureAllowHTTPIssuer"})
+														} else {
+															v, ok := tf.Attrs["insecure_allow_http_issuer"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Kubernetes.OIDC.InsecureAllowHTTPIssuer", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Kubernetes.OIDC.InsecureAllowHTTPIssuer", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																}
+																v.Null = bool(obj.InsecureAllowHTTPIssuer) == false
+															}
+															v.Value = bool(obj.InsecureAllowHTTPIssuer)
+															v.Unknown = false
+															tf.Attrs["insecure_allow_http_issuer"] = v
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["oidc"] = v
+											}
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["kubernetes"] = v
@@ -18641,6 +20173,28 @@ func CopyProvisionTokenV2ToTerraform(ctx context.Context, obj *github_com_gravit
 											tf.Attrs["hostname"] = v
 										}
 									}
+									{
+										t, ok := tf.AttrTypes["enable_glob_matching"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Spacelift.EnableGlobMatching"})
+										} else {
+											v, ok := tf.Attrs["enable_glob_matching"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Spacelift.EnableGlobMatching", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Spacelift.EnableGlobMatching", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+												}
+												v.Null = bool(obj.EnableGlobMatching) == false
+											}
+											v.Value = bool(obj.EnableGlobMatching)
+											v.Unknown = false
+											tf.Attrs["enable_glob_matching"] = v
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["spacelift"] = v
@@ -19565,6 +21119,59 @@ func CopyProvisionTokenV2ToTerraform(ctx context.Context, obj *github_com_gravit
 																	}
 																}
 															}
+															{
+																a, ok := tf.AttrTypes["instances"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances"})
+																} else {
+																	o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+																	if !ok {
+																		diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+																	} else {
+																		c, ok := tf.Attrs["instances"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																		if !ok {
+																			c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																				ElemType: o.ElemType,
+																				Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Instances)),
+																				Null:     true,
+																			}
+																		} else {
+																			if c.Elems == nil {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Instances))
+																			}
+																		}
+																		if obj.Instances != nil {
+																			t := o.ElemType
+																			if len(obj.Instances) != len(c.Elems) {
+																				c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Instances))
+																			}
+																			for k, a := range obj.Instances {
+																				v, ok := tf.Attrs["instances"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																				if !ok {
+																					i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																					if err != nil {
+																						diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Oracle.Allow.Instances", err})
+																					}
+																					v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Oracle.Allow.Instances", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																					}
+																					v.Null = string(a) == ""
+																				}
+																				v.Value = string(a)
+																				v.Unknown = false
+																				c.Elems[k] = v
+																			}
+																			if len(obj.Instances) > 0 {
+																				c.Null = false
+																			}
+																		}
+																		c.Unknown = false
+																		tf.Attrs["instances"] = c
+																	}
+																}
+															}
 														}
 														v.Unknown = false
 														c.Elems[k] = v
@@ -20110,6 +21717,338 @@ func CopyProvisionTokenV2ToTerraform(ctx context.Context, obj *github_com_gravit
 							}
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["env0"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["env0"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.Env0 == nil {
+									v.Null = true
+								} else {
+									obj := obj.Env0
+									tf := &v
+									{
+										a, ok := tf.AttrTypes["allow"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+											} else {
+												c, ok := tf.Attrs["allow"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+												if !ok {
+													c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+														ElemType: o.ElemType,
+														Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Allow)),
+														Null:     true,
+													}
+												} else {
+													if c.Elems == nil {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Allow))
+													}
+												}
+												if obj.Allow != nil {
+													o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+													if len(obj.Allow) != len(c.Elems) {
+														c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Allow))
+													}
+													for k, a := range obj.Allow {
+														v, ok := tf.Attrs["allow"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+														if !ok {
+															v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																AttrTypes: o.AttrTypes,
+																Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+															}
+														} else {
+															if v.Attrs == nil {
+																v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+															}
+														}
+														if a == nil {
+															v.Null = true
+														} else {
+															obj := a
+															tf := &v
+															{
+																t, ok := tf.AttrTypes["organization_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.OrganizationID"})
+																} else {
+																	v, ok := tf.Attrs["organization_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.OrganizationID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.OrganizationID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.OrganizationID) == ""
+																	}
+																	v.Value = string(obj.OrganizationID)
+																	v.Unknown = false
+																	tf.Attrs["organization_id"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["project_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectID"})
+																} else {
+																	v, ok := tf.Attrs["project_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.ProjectID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ProjectID) == ""
+																	}
+																	v.Value = string(obj.ProjectID)
+																	v.Unknown = false
+																	tf.Attrs["project_id"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["project_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectName"})
+																} else {
+																	v, ok := tf.Attrs["project_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.ProjectName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.ProjectName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.ProjectName) == ""
+																	}
+																	v.Value = string(obj.ProjectName)
+																	v.Unknown = false
+																	tf.Attrs["project_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["template_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateID"})
+																} else {
+																	v, ok := tf.Attrs["template_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.TemplateID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.TemplateID) == ""
+																	}
+																	v.Value = string(obj.TemplateID)
+																	v.Unknown = false
+																	tf.Attrs["template_id"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["template_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateName"})
+																} else {
+																	v, ok := tf.Attrs["template_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.TemplateName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.TemplateName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.TemplateName) == ""
+																	}
+																	v.Value = string(obj.TemplateName)
+																	v.Unknown = false
+																	tf.Attrs["template_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["environment_id"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentID"})
+																} else {
+																	v, ok := tf.Attrs["environment_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentID", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.EnvironmentID) == ""
+																	}
+																	v.Value = string(obj.EnvironmentID)
+																	v.Unknown = false
+																	tf.Attrs["environment_id"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["environment_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentName"})
+																} else {
+																	v, ok := tf.Attrs["environment_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.EnvironmentName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.EnvironmentName) == ""
+																	}
+																	v.Value = string(obj.EnvironmentName)
+																	v.Unknown = false
+																	tf.Attrs["environment_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["workspace_name"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.WorkspaceName"})
+																} else {
+																	v, ok := tf.Attrs["workspace_name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.WorkspaceName", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.WorkspaceName", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.WorkspaceName) == ""
+																	}
+																	v.Value = string(obj.WorkspaceName)
+																	v.Unknown = false
+																	tf.Attrs["workspace_name"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["deployment_type"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeploymentType"})
+																} else {
+																	v, ok := tf.Attrs["deployment_type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.DeploymentType", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeploymentType", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.DeploymentType) == ""
+																	}
+																	v.Value = string(obj.DeploymentType)
+																	v.Unknown = false
+																	tf.Attrs["deployment_type"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["deployer_email"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeployerEmail"})
+																} else {
+																	v, ok := tf.Attrs["deployer_email"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.DeployerEmail", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.DeployerEmail", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.DeployerEmail) == ""
+																	}
+																	v.Value = string(obj.DeployerEmail)
+																	v.Unknown = false
+																	tf.Attrs["deployer_email"] = v
+																}
+															}
+															{
+																t, ok := tf.AttrTypes["env0_tag"]
+																if !ok {
+																	diags.Append(attrWriteMissingDiag{"ProvisionTokenV2.Spec.Env0.Allow.Env0Tag"})
+																} else {
+																	v, ok := tf.Attrs["env0_tag"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																	if !ok {
+																		i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																		if err != nil {
+																			diags.Append(attrWriteGeneralError{"ProvisionTokenV2.Spec.Env0.Allow.Env0Tag", err})
+																		}
+																		v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrWriteConversionFailureDiag{"ProvisionTokenV2.Spec.Env0.Allow.Env0Tag", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																		}
+																		v.Null = string(obj.Env0Tag) == ""
+																	}
+																	v.Value = string(obj.Env0Tag)
+																	v.Unknown = false
+																	tf.Attrs["env0_tag"] = v
+																}
+															}
+														}
+														v.Unknown = false
+														c.Elems[k] = v
+													}
+													if len(obj.Allow) > 0 {
+														c.Null = false
+													}
+												}
+												c.Unknown = false
+												tf.Attrs["allow"] = c
+											}
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["env0"] = v
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
@@ -21680,6 +23619,266 @@ func CopySessionRecordingConfigV2FromTerraform(_ context.Context, tf github_com_
 						}
 						CopyFromBoolOption(diags, a, &obj.ProxyChecksHostKeys)
 					}
+					{
+						a, ok := tf.Attrs["encryption"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.Encryption = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.Encryption = &github_com_gravitational_teleport_api_types.SessionRecordingEncryptionConfig{}
+									obj := obj.Encryption
+									{
+										a, ok := tf.Attrs["enabled"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.enabled"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+											} else {
+												var t bool
+												if !v.Null && !v.Unknown {
+													t = bool(v.Value)
+												}
+												obj.Enabled = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["manual_key_management"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.ManualKeyManagement = nil
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj.ManualKeyManagement = &github_com_gravitational_teleport_api_types.ManualKeyManagementConfig{}
+													obj := obj.ManualKeyManagement
+													{
+														a, ok := tf.Attrs["enabled"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.enabled"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+															} else {
+																var t bool
+																if !v.Null && !v.Unknown {
+																	t = bool(v.Value)
+																}
+																obj.Enabled = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["active_keys"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+															} else {
+																obj.ActiveKeys = make([]*github_com_gravitational_teleport_api_types.KeyLabel, len(v.Elems))
+																if !v.Null && !v.Unknown {
+																	for k, a := range v.Elems {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+																		} else {
+																			var t *github_com_gravitational_teleport_api_types.KeyLabel
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				t = &github_com_gravitational_teleport_api_types.KeyLabel{}
+																				obj := t
+																				{
+																					a, ok := tf.Attrs["type"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.type"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.Type = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["label"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.label"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.label", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.Label = t
+																						}
+																					}
+																				}
+																			}
+																			obj.ActiveKeys[k] = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["rotated_keys"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+															} else {
+																obj.RotatedKeys = make([]*github_com_gravitational_teleport_api_types.KeyLabel, len(v.Elems))
+																if !v.Null && !v.Unknown {
+																	for k, a := range v.Elems {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+																		} else {
+																			var t *github_com_gravitational_teleport_api_types.KeyLabel
+																			if !v.Null && !v.Unknown {
+																				tf := v
+																				t = &github_com_gravitational_teleport_api_types.KeyLabel{}
+																				obj := t
+																				{
+																					a, ok := tf.Attrs["type"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.type"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.Type = t
+																						}
+																					}
+																				}
+																				{
+																					a, ok := tf.Attrs["label"]
+																					if !ok {
+																						diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.label"})
+																					} else {
+																						v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.label", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						} else {
+																							var t string
+																							if !v.Null && !v.Unknown {
+																								t = string(v.Value)
+																							}
+																							obj.Label = t
+																						}
+																					}
+																				}
+																			}
+																			obj.RotatedKeys[k] = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["status"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Status"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Status", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Status = nil
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj.Status = &github_com_gravitational_teleport_api_types.SessionRecordingConfigStatus{}
+					obj := obj.Status
+					{
+						a, ok := tf.Attrs["encryption_keys"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Status.encryption_keys"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Status.encryption_keys", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.EncryptionKeys = make([]*github_com_gravitational_teleport_api_types.AgeEncryptionKey, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Status.encryption_keys", "github_com_hashicorp_terraform_plugin_framework_types.Object"})
+										} else {
+											var t *github_com_gravitational_teleport_api_types.AgeEncryptionKey
+											if !v.Null && !v.Unknown {
+												tf := v
+												t = &github_com_gravitational_teleport_api_types.AgeEncryptionKey{}
+												obj := t
+												{
+													a, ok := tf.Attrs["public_key"]
+													if !ok {
+														diags.Append(attrReadMissingDiag{"SessionRecordingConfigV2.Status.encryption_keys.public_key"})
+													} else {
+														v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrReadConversionFailureDiag{"SessionRecordingConfigV2.Status.encryption_keys.public_key", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														} else {
+															var t []byte
+															if !v.Null && !v.Unknown {
+																t = []byte(v.Value)
+															}
+															obj.PublicKey = t
+														}
+													}
+												}
+											}
+											obj.EncryptionKeys[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -21989,12 +24188,436 @@ func CopySessionRecordingConfigV2ToTerraform(ctx context.Context, obj *github_co
 							tf.Attrs["proxy_checks_host_keys"] = v
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["encryption"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["encryption"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.Encryption == nil {
+									v.Null = true
+								} else {
+									obj := obj.Encryption
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["enabled"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.enabled"})
+										} else {
+											v, ok := tf.Attrs["enabled"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.enabled", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+												}
+												v.Null = bool(obj.Enabled) == false
+											}
+											v.Value = bool(obj.Enabled)
+											v.Unknown = false
+											tf.Attrs["enabled"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["manual_key_management"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["manual_key_management"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												if obj.ManualKeyManagement == nil {
+													v.Null = true
+												} else {
+													obj := obj.ManualKeyManagement
+													tf := &v
+													{
+														t, ok := tf.AttrTypes["enabled"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.enabled"})
+														} else {
+															v, ok := tf.Attrs["enabled"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.enabled", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																}
+																v.Null = bool(obj.Enabled) == false
+															}
+															v.Value = bool(obj.Enabled)
+															v.Unknown = false
+															tf.Attrs["enabled"] = v
+														}
+													}
+													{
+														a, ok := tf.AttrTypes["active_keys"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys"})
+														} else {
+															o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+															} else {
+																c, ok := tf.Attrs["active_keys"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																if !ok {
+																	c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																		ElemType: o.ElemType,
+																		Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ActiveKeys)),
+																		Null:     true,
+																	}
+																} else {
+																	if c.Elems == nil {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ActiveKeys))
+																	}
+																}
+																if obj.ActiveKeys != nil {
+																	o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if len(obj.ActiveKeys) != len(c.Elems) {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ActiveKeys))
+																	}
+																	for k, a := range obj.ActiveKeys {
+																		v, ok := tf.Attrs["active_keys"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if a == nil {
+																			v.Null = true
+																		} else {
+																			obj := a
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["type"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.type"})
+																				} else {
+																					v, ok := tf.Attrs["type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.type", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.Type) == ""
+																					}
+																					v.Value = string(obj.Type)
+																					v.Unknown = false
+																					tf.Attrs["type"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["label"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.label"})
+																				} else {
+																					v, ok := tf.Attrs["label"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.label", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.active_keys.label", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.Label) == ""
+																					}
+																					v.Value = string(obj.Label)
+																					v.Unknown = false
+																					tf.Attrs["label"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		c.Elems[k] = v
+																	}
+																	if len(obj.ActiveKeys) > 0 {
+																		c.Null = false
+																	}
+																}
+																c.Unknown = false
+																tf.Attrs["active_keys"] = c
+															}
+														}
+													}
+													{
+														a, ok := tf.AttrTypes["rotated_keys"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys"})
+														} else {
+															o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+															} else {
+																c, ok := tf.Attrs["rotated_keys"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																if !ok {
+																	c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																		ElemType: o.ElemType,
+																		Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RotatedKeys)),
+																		Null:     true,
+																	}
+																} else {
+																	if c.Elems == nil {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RotatedKeys))
+																	}
+																}
+																if obj.RotatedKeys != nil {
+																	o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+																	if len(obj.RotatedKeys) != len(c.Elems) {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.RotatedKeys))
+																	}
+																	for k, a := range obj.RotatedKeys {
+																		v, ok := tf.Attrs["rotated_keys"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+																		if !ok {
+																			v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+																				AttrTypes: o.AttrTypes,
+																				Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+																			}
+																		} else {
+																			if v.Attrs == nil {
+																				v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+																			}
+																		}
+																		if a == nil {
+																			v.Null = true
+																		} else {
+																			obj := a
+																			tf := &v
+																			{
+																				t, ok := tf.AttrTypes["type"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.type"})
+																				} else {
+																					v, ok := tf.Attrs["type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.type", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.Type) == ""
+																					}
+																					v.Value = string(obj.Type)
+																					v.Unknown = false
+																					tf.Attrs["type"] = v
+																				}
+																			}
+																			{
+																				t, ok := tf.AttrTypes["label"]
+																				if !ok {
+																					diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.label"})
+																				} else {
+																					v, ok := tf.Attrs["label"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																					if !ok {
+																						i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																						if err != nil {
+																							diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.label", err})
+																						}
+																						v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																						if !ok {
+																							diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Spec.encryption.manual_key_management.rotated_keys.label", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																						}
+																						v.Null = string(obj.Label) == ""
+																					}
+																					v.Value = string(obj.Label)
+																					v.Unknown = false
+																					tf.Attrs["label"] = v
+																				}
+																			}
+																		}
+																		v.Unknown = false
+																		c.Elems[k] = v
+																	}
+																	if len(obj.RotatedKeys) > 0 {
+																		c.Null = false
+																	}
+																}
+																c.Unknown = false
+																tf.Attrs["rotated_keys"] = c
+															}
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["manual_key_management"] = v
+											}
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["encryption"] = v
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
 			}
 		}
 	}
+	{
+		a, ok := tf.AttrTypes["status"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Status"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Status", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["status"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				if obj.Status == nil {
+					v.Null = true
+				} else {
+					obj := obj.Status
+					tf := &v
+					{
+						a, ok := tf.AttrTypes["encryption_keys"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Status.encryption_keys"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Status.encryption_keys", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["encryption_keys"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.EncryptionKeys)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.EncryptionKeys))
+									}
+								}
+								if obj.EncryptionKeys != nil {
+									o := o.ElemType.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+									if len(obj.EncryptionKeys) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.EncryptionKeys))
+									}
+									for k, a := range obj.EncryptionKeys {
+										v, ok := tf.Attrs["encryption_keys"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+										if !ok {
+											v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+												AttrTypes: o.AttrTypes,
+												Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+											}
+										} else {
+											if v.Attrs == nil {
+												v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+											}
+										}
+										if a == nil {
+											v.Null = true
+										} else {
+											obj := a
+											tf := &v
+											{
+												t, ok := tf.AttrTypes["public_key"]
+												if !ok {
+													diags.Append(attrWriteMissingDiag{"SessionRecordingConfigV2.Status.encryption_keys.public_key"})
+												} else {
+													v, ok := tf.Attrs["public_key"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+													if !ok {
+														i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+														if err != nil {
+															diags.Append(attrWriteGeneralError{"SessionRecordingConfigV2.Status.encryption_keys.public_key", err})
+														}
+														v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+														if !ok {
+															diags.Append(attrWriteConversionFailureDiag{"SessionRecordingConfigV2.Status.encryption_keys.public_key", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+														}
+														v.Null = string(obj.PublicKey) == ""
+													}
+													v.Value = string(obj.PublicKey)
+													v.Unknown = false
+													tf.Attrs["public_key"] = v
+												}
+											}
+										}
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.EncryptionKeys) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["encryption_keys"] = c
+							}
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["status"] = v
+			}
+		}
+	}
 	return diags
 }
 
@@ -25732,6 +28355,23 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
 																			}
 																		}
 																	}
+																	{
+																		a, ok := tf.Attrs["prompt"]
+																		if !ok {
+																			diags.Append(attrReadMissingDiag{"RoleV6.Spec.Allow.Request.Reason.Prompt"})
+																		} else {
+																			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Allow.Request.Reason.Prompt", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																			} else {
+																				var t string
+																				if !v.Null && !v.Unknown {
+																					t = string(v.Value)
+																				}
+																				obj.Prompt = t
+																			}
+																		}
+																	}
 																}
 															}
 														}
@@ -27193,6 +29833,51 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["mcp"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"RoleV6.Spec.Allow.MCP"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Allow.MCP", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.MCP = nil
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj.MCP = &github_com_gravitational_teleport_api_types.MCPPermissions{}
+													obj := obj.MCP
+													{
+														a, ok := tf.Attrs["tools"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"RoleV6.Spec.Allow.MCP.tools"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Allow.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+															} else {
+																obj.Tools = make([]string, len(v.Elems))
+																if !v.Null && !v.Unknown {
+																	for k, a := range v.Elems {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Allow.MCP.tools", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Tools[k] = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+										}
+									}
 								}
 							}
 						}
@@ -27794,6 +30479,23 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
 																			}
 																		}
 																	}
+																	{
+																		a, ok := tf.Attrs["prompt"]
+																		if !ok {
+																			diags.Append(attrReadMissingDiag{"RoleV6.Spec.Deny.Request.Reason.Prompt"})
+																		} else {
+																			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Deny.Request.Reason.Prompt", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																			} else {
+																				var t string
+																				if !v.Null && !v.Unknown {
+																					t = string(v.Value)
+																				}
+																				obj.Prompt = t
+																			}
+																		}
+																	}
 																}
 															}
 														}
@@ -29255,6 +31957,51 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["mcp"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"RoleV6.Spec.Deny.MCP"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Deny.MCP", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.MCP = nil
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj.MCP = &github_com_gravitational_teleport_api_types.MCPPermissions{}
+													obj := obj.MCP
+													{
+														a, ok := tf.Attrs["tools"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"RoleV6.Spec.Deny.MCP.tools"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Deny.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+															} else {
+																obj.Tools = make([]string, len(v.Elems))
+																if !v.Null && !v.Unknown {
+																	for k, a := range v.Elems {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Deny.MCP.tools", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.Tools[k] = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+										}
+									}
 								}
 							}
 						}
@@ -31578,6 +34325,28 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
 																			tf.Attrs["mode"] = v
 																		}
 																	}
+																	{
+																		t, ok := tf.AttrTypes["prompt"]
+																		if !ok {
+																			diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Allow.Request.Reason.Prompt"})
+																		} else {
+																			v, ok := tf.Attrs["prompt"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																				if err != nil {
+																					diags.Append(attrWriteGeneralError{"RoleV6.Spec.Allow.Request.Reason.Prompt", err})
+																				}
+																				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																				if !ok {
+																					diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Allow.Request.Reason.Prompt", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																				}
+																				v.Null = string(obj.Prompt) == ""
+																			}
+																			v.Value = string(obj.Prompt)
+																			v.Unknown = false
+																			tf.Attrs["prompt"] = v
+																		}
+																	}
 																}
 																v.Unknown = false
 																tf.Attrs["reason"] = v
@@ -34117,6 +36886,91 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
 											tf.Attrs["workload_identity_labels_expression"] = v
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["mcp"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Allow.MCP"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Allow.MCP", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["mcp"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												if obj.MCP == nil {
+													v.Null = true
+												} else {
+													obj := obj.MCP
+													tf := &v
+													{
+														a, ok := tf.AttrTypes["tools"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Allow.MCP.tools"})
+														} else {
+															o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Allow.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+															} else {
+																c, ok := tf.Attrs["tools"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																if !ok {
+																	c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																		ElemType: o.ElemType,
+																		Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools)),
+																		Null:     true,
+																	}
+																} else {
+																	if c.Elems == nil {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools))
+																	}
+																}
+																if obj.Tools != nil {
+																	t := o.ElemType
+																	if len(obj.Tools) != len(c.Elems) {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools))
+																	}
+																	for k, a := range obj.Tools {
+																		v, ok := tf.Attrs["tools"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																			if err != nil {
+																				diags.Append(attrWriteGeneralError{"RoleV6.Spec.Allow.MCP.tools", err})
+																			}
+																			v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Allow.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																			}
+																			v.Null = string(a) == ""
+																		}
+																		v.Value = string(a)
+																		v.Unknown = false
+																		c.Elems[k] = v
+																	}
+																	if len(obj.Tools) > 0 {
+																		c.Null = false
+																	}
+																}
+																c.Unknown = false
+																tf.Attrs["tools"] = c
+															}
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["mcp"] = v
+											}
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["allow"] = v
@@ -35160,6 +38014,28 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
 																			tf.Attrs["mode"] = v
 																		}
 																	}
+																	{
+																		t, ok := tf.AttrTypes["prompt"]
+																		if !ok {
+																			diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Deny.Request.Reason.Prompt"})
+																		} else {
+																			v, ok := tf.Attrs["prompt"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																				if err != nil {
+																					diags.Append(attrWriteGeneralError{"RoleV6.Spec.Deny.Request.Reason.Prompt", err})
+																				}
+																				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																				if !ok {
+																					diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Deny.Request.Reason.Prompt", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																				}
+																				v.Null = string(obj.Prompt) == ""
+																			}
+																			v.Value = string(obj.Prompt)
+																			v.Unknown = false
+																			tf.Attrs["prompt"] = v
+																		}
+																	}
 																}
 																v.Unknown = false
 																tf.Attrs["reason"] = v
@@ -37699,6 +40575,91 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
 											tf.Attrs["workload_identity_labels_expression"] = v
 										}
 									}
+									{
+										a, ok := tf.AttrTypes["mcp"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Deny.MCP"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Deny.MCP", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["mcp"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												if obj.MCP == nil {
+													v.Null = true
+												} else {
+													obj := obj.MCP
+													tf := &v
+													{
+														a, ok := tf.AttrTypes["tools"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Deny.MCP.tools"})
+														} else {
+															o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Deny.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+															} else {
+																c, ok := tf.Attrs["tools"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																if !ok {
+																	c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																		ElemType: o.ElemType,
+																		Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools)),
+																		Null:     true,
+																	}
+																} else {
+																	if c.Elems == nil {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools))
+																	}
+																}
+																if obj.Tools != nil {
+																	t := o.ElemType
+																	if len(obj.Tools) != len(c.Elems) {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Tools))
+																	}
+																	for k, a := range obj.Tools {
+																		v, ok := tf.Attrs["tools"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																			if err != nil {
+																				diags.Append(attrWriteGeneralError{"RoleV6.Spec.Deny.MCP.tools", err})
+																			}
+																			v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Deny.MCP.tools", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																			}
+																			v.Null = string(a) == ""
+																		}
+																		v.Value = string(a)
+																		v.Unknown = false
+																		c.Elems[k] = v
+																	}
+																	if len(obj.Tools) > 0 {
+																		c.Null = false
+																	}
+																}
+																c.Unknown = false
+																tf.Attrs["tools"] = c
+															}
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["mcp"] = v
+											}
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["deny"] = v
@@ -39975,6 +42936,23 @@ func CopyOIDCConnectorV3FromTerraform(_ context.Context, tf github_com_hashicorp
 											}
 										}
 									}
+									{
+										a, ok := tf.Attrs["request_object_mode"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.MFASettings.RequestObjectMode"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.MFASettings.RequestObjectMode", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.RequestObjectMode = t
+											}
+										}
+									}
 								}
 							}
 						}
@@ -39996,6 +42974,119 @@ func CopyOIDCConnectorV3FromTerraform(_ context.Context, tf github_com_hashicorp
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["user_matchers"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.UserMatchers"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.UserMatchers = make([]string, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.UserMatchers", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+										} else {
+											var t string
+											if !v.Null && !v.Unknown {
+												t = string(v.Value)
+											}
+											obj.UserMatchers[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["request_object_mode"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.RequestObjectMode"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.RequestObjectMode", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.RequestObjectMode = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["entra_id_groups_provider"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								obj.EntraIdGroupsProvider = nil
+								if !v.Null && !v.Unknown {
+									tf := v
+									obj.EntraIdGroupsProvider = &github_com_gravitational_teleport_api_types.EntraIDGroupsProvider{}
+									obj := obj.EntraIdGroupsProvider
+									{
+										a, ok := tf.Attrs["disabled"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.disabled"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.disabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+											} else {
+												var t bool
+												if !v.Null && !v.Unknown {
+													t = bool(v.Value)
+												}
+												obj.Disabled = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["group_type"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.group_type"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.group_type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.GroupType = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["graph_endpoint"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.graph_endpoint"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.graph_endpoint", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.GraphEndpoint = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -41097,6 +44188,28 @@ func CopyOIDCConnectorV3ToTerraform(ctx context.Context, obj *github_com_gravita
 											tf.Attrs["max_age"] = v
 										}
 									}
+									{
+										t, ok := tf.AttrTypes["request_object_mode"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.MFASettings.RequestObjectMode"})
+										} else {
+											v, ok := tf.Attrs["request_object_mode"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.MFASettings.RequestObjectMode", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.MFASettings.RequestObjectMode", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.RequestObjectMode) == ""
+											}
+											v.Value = string(obj.RequestObjectMode)
+											v.Unknown = false
+											tf.Attrs["request_object_mode"] = v
+										}
+									}
 								}
 								v.Unknown = false
 								tf.Attrs["mfa"] = v
@@ -41125,6 +44238,179 @@ func CopyOIDCConnectorV3ToTerraform(ctx context.Context, obj *github_com_gravita
 							tf.Attrs["pkce_mode"] = v
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["user_matchers"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.UserMatchers"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+								}
+								if obj.UserMatchers != nil {
+									t := o.ElemType
+									if len(obj.UserMatchers) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+									for k, a := range obj.UserMatchers {
+										v, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+											if err != nil {
+												diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.UserMatchers", err})
+											}
+											v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											}
+											v.Null = string(a) == ""
+										}
+										v.Value = string(a)
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.UserMatchers) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["user_matchers"] = c
+							}
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["request_object_mode"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.RequestObjectMode"})
+						} else {
+							v, ok := tf.Attrs["request_object_mode"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.RequestObjectMode", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.RequestObjectMode", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.RequestObjectMode) == ""
+							}
+							v.Value = string(obj.RequestObjectMode)
+							v.Unknown = false
+							tf.Attrs["request_object_mode"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["entra_id_groups_provider"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["entra_id_groups_provider"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.EntraIdGroupsProvider == nil {
+									v.Null = true
+								} else {
+									obj := obj.EntraIdGroupsProvider
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["disabled"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.disabled"})
+										} else {
+											v, ok := tf.Attrs["disabled"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.entra_id_groups_provider.disabled", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.disabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+												}
+												v.Null = bool(obj.Disabled) == false
+											}
+											v.Value = bool(obj.Disabled)
+											v.Unknown = false
+											tf.Attrs["disabled"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["group_type"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.group_type"})
+										} else {
+											v, ok := tf.Attrs["group_type"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.entra_id_groups_provider.group_type", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.group_type", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.GroupType) == ""
+											}
+											v.Value = string(obj.GroupType)
+											v.Unknown = false
+											tf.Attrs["group_type"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["graph_endpoint"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.graph_endpoint"})
+										} else {
+											v, ok := tf.Attrs["graph_endpoint"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"OIDCConnectorV3.Spec.entra_id_groups_provider.graph_endpoint", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"OIDCConnectorV3.Spec.entra_id_groups_provider.graph_endpoint", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.GraphEndpoint) == ""
+											}
+											v.Value = string(obj.GraphEndpoint)
+											v.Unknown = false
+											tf.Attrs["graph_endpoint"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["entra_id_groups_provider"] = v
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
@@ -41971,6 +45257,50 @@ func CopySAMLConnectorV2FromTerraform(_ context.Context, tf github_com_hashicorp
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["user_matchers"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"SAMLConnectorV2.Spec.UserMatchers"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"SAMLConnectorV2.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.UserMatchers = make([]string, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"SAMLConnectorV2.Spec.UserMatchers", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+										} else {
+											var t string
+											if !v.Null && !v.Unknown {
+												t = string(v.Value)
+											}
+											obj.UserMatchers[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["include_subject"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"SAMLConnectorV2.Spec.IncludeSubject"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"SAMLConnectorV2.Spec.IncludeSubject", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+							} else {
+								var t bool
+								if !v.Null && !v.Unknown {
+									t = bool(v.Value)
+								}
+								obj.IncludeSubject = t
+							}
+						}
+					}
 				}
 			}
 		}
@@ -43208,6 +46538,81 @@ func CopySAMLConnectorV2ToTerraform(ctx context.Context, obj *github_com_gravita
 							tf.Attrs["preferred_request_binding"] = v
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["user_matchers"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"SAMLConnectorV2.Spec.UserMatchers"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"SAMLConnectorV2.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+								}
+								if obj.UserMatchers != nil {
+									t := o.ElemType
+									if len(obj.UserMatchers) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+									for k, a := range obj.UserMatchers {
+										v, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+											if err != nil {
+												diags.Append(attrWriteGeneralError{"SAMLConnectorV2.Spec.UserMatchers", err})
+											}
+											v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"SAMLConnectorV2.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											}
+											v.Null = string(a) == ""
+										}
+										v.Value = string(a)
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.UserMatchers) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["user_matchers"] = c
+							}
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["include_subject"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"SAMLConnectorV2.Spec.IncludeSubject"})
+						} else {
+							v, ok := tf.Attrs["include_subject"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"SAMLConnectorV2.Spec.IncludeSubject", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"SAMLConnectorV2.Spec.IncludeSubject", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+								}
+								v.Null = bool(obj.IncludeSubject) == false
+							}
+							v.Value = bool(obj.IncludeSubject)
+							v.Unknown = false
+							tf.Attrs["include_subject"] = v
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
@@ -43820,6 +47225,33 @@ func CopyGithubConnectorV3FromTerraform(_ context.Context, tf github_com_hashico
 							}
 						}
 					}
+					{
+						a, ok := tf.Attrs["user_matchers"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"GithubConnectorV3.Spec.UserMatchers"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"GithubConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+							} else {
+								obj.UserMatchers = make([]string, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"GithubConnectorV3.Spec.UserMatchers", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+										} else {
+											var t string
+											if !v.Null && !v.Unknown {
+												t = string(v.Value)
+											}
+											obj.UserMatchers[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			}
 		}
@@ -44802,6 +48234,59 @@ func CopyGithubConnectorV3ToTerraform(ctx context.Context, obj *github_com_gravi
 							}
 						}
 					}
+					{
+						a, ok := tf.AttrTypes["user_matchers"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"GithubConnectorV3.Spec.UserMatchers"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"GithubConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+							} else {
+								c, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+										ElemType: o.ElemType,
+										Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+								}
+								if obj.UserMatchers != nil {
+									t := o.ElemType
+									if len(obj.UserMatchers) != len(c.Elems) {
+										c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.UserMatchers))
+									}
+									for k, a := range obj.UserMatchers {
+										v, ok := tf.Attrs["user_matchers"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+											if err != nil {
+												diags.Append(attrWriteGeneralError{"GithubConnectorV3.Spec.UserMatchers", err})
+											}
+											v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"GithubConnectorV3.Spec.UserMatchers", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											}
+											v.Null = string(a) == ""
+										}
+										v.Value = string(a)
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.UserMatchers) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["user_matchers"] = c
+							}
+						}
+					}
 				}
 				v.Unknown = false
 				tf.Attrs["spec"] = v
@@ -48843,6 +52328,1195 @@ func CopyOktaImportRuleV1ToTerraform(ctx context.Context, obj *github_com_gravit
 	return diags
 }
 
+// CopyIntegrationV1FromTerraform copies contents of the source Terraform object into a target struct
+func CopyIntegrationV1FromTerraform(_ context.Context, tf github_com_hashicorp_terraform_plugin_framework_types.Object, obj *github_com_gravitational_teleport_api_types.IntegrationV1) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	{
+		a, ok := tf.Attrs["kind"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"IntegrationV1.Kind"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+			} else {
+				var t string
+				if !v.Null && !v.Unknown {
+					t = string(v.Value)
+				}
+				obj.Kind = t
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["sub_kind"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"IntegrationV1.SubKind"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"IntegrationV1.SubKind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+			} else {
+				var t string
+				if !v.Null && !v.Unknown {
+					t = string(v.Value)
+				}
+				obj.SubKind = t
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["version"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"IntegrationV1.Version"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+			} else {
+				var t string
+				if !v.Null && !v.Unknown {
+					t = string(v.Value)
+				}
+				obj.Version = t
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["metadata"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Metadata = github_com_gravitational_teleport_api_types.Metadata{}
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj := &obj.Metadata
+					{
+						a, ok := tf.Attrs["name"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Name"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Name = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["namespace"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Namespace"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Namespace = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["description"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Description"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Description = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["labels"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Labels"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Map)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Labels", "github.com/hashicorp/terraform-plugin-framework/types.Map"})
+							} else {
+								obj.Labels = make(map[string]string, len(v.Elems))
+								if !v.Null && !v.Unknown {
+									for k, a := range v.Elems {
+										v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Labels", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+										} else {
+											var t string
+											if !v.Null && !v.Unknown {
+												t = string(v.Value)
+											}
+											obj.Labels[k] = t
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["expires"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Expires"})
+						} else {
+							v, ok := a.(TimeValue)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Expires", "TimeValue"})
+							} else {
+								var t *time.Time
+								if !v.Null && !v.Unknown {
+									c := time.Time(v.Value)
+									t = &c
+								}
+								obj.Expires = t
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["revision"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Metadata.Revision"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Metadata.Revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+							} else {
+								var t string
+								if !v.Null && !v.Unknown {
+									t = string(v.Value)
+								}
+								obj.Revision = t
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	{
+		a, ok := tf.Attrs["spec"]
+		if !ok {
+			diags.Append(attrReadMissingDiag{"IntegrationV1.Spec"})
+		} else {
+			v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+			if !ok {
+				diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+			} else {
+				obj.Spec = github_com_gravitational_teleport_api_types.IntegrationSpecV1{}
+				if !v.Null && !v.Unknown {
+					tf := v
+					obj := &obj.Spec
+					obj.SubKindSpec = nil
+					{
+						a, ok := tf.Attrs["aws_oidc"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSOIDC"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								if !v.Null && !v.Unknown {
+									b := &github_com_gravitational_teleport_api_types.AWSOIDCIntegrationSpecV1{}
+									obj.SubKindSpec = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSOIDC{AWSOIDC: b}
+									obj := b
+									tf := v
+									{
+										a, ok := tf.Attrs["role_arn"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSOIDC.RoleARN"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.RoleARN = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["issuer_s3_uri"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSOIDC.IssuerS3URI"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.IssuerS3URI", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.IssuerS3URI = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["audience"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSOIDC.audience"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.audience", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.Audience = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["azure_oidc"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AzureOIDC"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								if !v.Null && !v.Unknown {
+									b := &github_com_gravitational_teleport_api_types.AzureOIDCIntegrationSpecV1{}
+									obj.SubKindSpec = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AzureOIDC{AzureOIDC: b}
+									obj := b
+									tf := v
+									{
+										a, ok := tf.Attrs["tenant_id"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AzureOIDC.TenantID"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC.TenantID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.TenantID = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["client_id"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AzureOIDC.ClientID"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.ClientID = t
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+					{
+						a, ok := tf.Attrs["aws_ra"]
+						if !ok {
+							diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA"})
+						} else {
+							v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+							if !ok {
+								diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+							} else {
+								if !v.Null && !v.Unknown {
+									b := &github_com_gravitational_teleport_api_types.AWSRAIntegrationSpecV1{}
+									obj.SubKindSpec = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSRA{AWSRA: b}
+									obj := b
+									tf := v
+									{
+										a, ok := tf.Attrs["trust_anchor_arn"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.TrustAnchorARN"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.TrustAnchorARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											} else {
+												var t string
+												if !v.Null && !v.Unknown {
+													t = string(v.Value)
+												}
+												obj.TrustAnchorARN = t
+											}
+										}
+									}
+									{
+										a, ok := tf.Attrs["profile_sync_config"]
+										if !ok {
+											diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig"})
+										} else {
+											v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Object)
+											if !ok {
+												diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig", "github.com/hashicorp/terraform-plugin-framework/types.Object"})
+											} else {
+												obj.ProfileSyncConfig = nil
+												if !v.Null && !v.Unknown {
+													tf := v
+													obj.ProfileSyncConfig = &github_com_gravitational_teleport_api_types.AWSRolesAnywhereProfileSyncConfig{}
+													obj := obj.ProfileSyncConfig
+													{
+														a, ok := tf.Attrs["enabled"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.Enabled"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.Enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+															} else {
+																var t bool
+																if !v.Null && !v.Unknown {
+																	t = bool(v.Value)
+																}
+																obj.Enabled = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["profile_arn"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileARN"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.ProfileARN = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["profile_accepts_role_session_name"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileAcceptsRoleSessionName"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileAcceptsRoleSessionName", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+															} else {
+																var t bool
+																if !v.Null && !v.Unknown {
+																	t = bool(v.Value)
+																}
+																obj.ProfileAcceptsRoleSessionName = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["role_arn"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.RoleARN"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+															} else {
+																var t string
+																if !v.Null && !v.Unknown {
+																	t = string(v.Value)
+																}
+																obj.RoleARN = t
+															}
+														}
+													}
+													{
+														a, ok := tf.Attrs["profile_name_filters"]
+														if !ok {
+															diags.Append(attrReadMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters"})
+														} else {
+															v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.List)
+															if !ok {
+																diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters", "github.com/hashicorp/terraform-plugin-framework/types.List"})
+															} else {
+																obj.ProfileNameFilters = make([]string, len(v.Elems))
+																if !v.Null && !v.Unknown {
+																	for k, a := range v.Elems {
+																		v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			diags.Append(attrReadConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters", "github_com_hashicorp_terraform_plugin_framework_types.String"})
+																		} else {
+																			var t string
+																			if !v.Null && !v.Unknown {
+																				t = string(v.Value)
+																			}
+																			obj.ProfileNameFilters[k] = t
+																		}
+																	}
+																}
+															}
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return diags
+}
+
+// CopyIntegrationV1ToTerraform copies contents of the source Terraform object into a target struct
+func CopyIntegrationV1ToTerraform(ctx context.Context, obj *github_com_gravitational_teleport_api_types.IntegrationV1, tf *github_com_hashicorp_terraform_plugin_framework_types.Object) github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics {
+	var diags github_com_hashicorp_terraform_plugin_framework_diag.Diagnostics
+	tf.Null = false
+	tf.Unknown = false
+	if tf.Attrs == nil {
+		tf.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value)
+	}
+	{
+		t, ok := tf.AttrTypes["kind"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"IntegrationV1.Kind"})
+		} else {
+			v, ok := tf.Attrs["kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+				if err != nil {
+					diags.Append(attrWriteGeneralError{"IntegrationV1.Kind", err})
+				}
+				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+				if !ok {
+					diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Kind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+				}
+				v.Null = string(obj.Kind) == ""
+			}
+			v.Value = string(obj.Kind)
+			v.Unknown = false
+			tf.Attrs["kind"] = v
+		}
+	}
+	{
+		t, ok := tf.AttrTypes["sub_kind"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"IntegrationV1.SubKind"})
+		} else {
+			v, ok := tf.Attrs["sub_kind"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+				if err != nil {
+					diags.Append(attrWriteGeneralError{"IntegrationV1.SubKind", err})
+				}
+				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+				if !ok {
+					diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.SubKind", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+				}
+				v.Null = string(obj.SubKind) == ""
+			}
+			v.Value = string(obj.SubKind)
+			v.Unknown = false
+			tf.Attrs["sub_kind"] = v
+		}
+	}
+	{
+		t, ok := tf.AttrTypes["version"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"IntegrationV1.Version"})
+		} else {
+			v, ok := tf.Attrs["version"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+			if !ok {
+				i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+				if err != nil {
+					diags.Append(attrWriteGeneralError{"IntegrationV1.Version", err})
+				}
+				v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+				if !ok {
+					diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Version", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+				}
+				v.Null = string(obj.Version) == ""
+			}
+			v.Value = string(obj.Version)
+			v.Unknown = false
+			tf.Attrs["version"] = v
+		}
+	}
+	{
+		a, ok := tf.AttrTypes["metadata"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["metadata"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				{
+					obj := obj.Metadata
+					tf := &v
+					{
+						t, ok := tf.AttrTypes["name"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Name"})
+						} else {
+							v, ok := tf.Attrs["name"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Name", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Name", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Name) == ""
+							}
+							v.Value = string(obj.Name)
+							v.Unknown = false
+							tf.Attrs["name"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["namespace"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Namespace"})
+						} else {
+							v, ok := tf.Attrs["namespace"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Namespace", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Namespace", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Namespace) == ""
+							}
+							v.Value = string(obj.Namespace)
+							v.Unknown = false
+							tf.Attrs["namespace"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["description"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Description"})
+						} else {
+							v, ok := tf.Attrs["description"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Description", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Description", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Description) == ""
+							}
+							v.Value = string(obj.Description)
+							v.Unknown = false
+							tf.Attrs["description"] = v
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["labels"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Labels"})
+						} else {
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.MapType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Labels", "github.com/hashicorp/terraform-plugin-framework/types.MapType"})
+							} else {
+								c, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.Map)
+								if !ok {
+									c = github_com_hashicorp_terraform_plugin_framework_types.Map{
+
+										ElemType: o.ElemType,
+										Elems:    make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels)),
+										Null:     true,
+									}
+								} else {
+									if c.Elems == nil {
+										c.Elems = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.Labels))
+									}
+								}
+								if obj.Labels != nil {
+									t := o.ElemType
+									for k, a := range obj.Labels {
+										v, ok := tf.Attrs["labels"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+										if !ok {
+											i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+											if err != nil {
+												diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Labels", err})
+											}
+											v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Labels", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+											}
+											v.Null = false
+										}
+										v.Value = string(a)
+										v.Unknown = false
+										c.Elems[k] = v
+									}
+									if len(obj.Labels) > 0 {
+										c.Null = false
+									}
+								}
+								c.Unknown = false
+								tf.Attrs["labels"] = c
+							}
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["expires"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Expires"})
+						} else {
+							v, ok := tf.Attrs["expires"].(TimeValue)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Expires", err})
+								}
+								v, ok = i.(TimeValue)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Expires", "TimeValue"})
+								}
+								v.Null = false
+							}
+							if obj.Expires == nil {
+								v.Null = true
+							} else {
+								v.Null = false
+								v.Value = time.Time(*obj.Expires)
+							}
+							v.Unknown = false
+							tf.Attrs["expires"] = v
+						}
+					}
+					{
+						t, ok := tf.AttrTypes["revision"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Metadata.Revision"})
+						} else {
+							v, ok := tf.Attrs["revision"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+							if !ok {
+								i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+								if err != nil {
+									diags.Append(attrWriteGeneralError{"IntegrationV1.Metadata.Revision", err})
+								}
+								v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+								if !ok {
+									diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Metadata.Revision", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+								}
+								v.Null = string(obj.Revision) == ""
+							}
+							v.Value = string(obj.Revision)
+							v.Unknown = false
+							tf.Attrs["revision"] = v
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["metadata"] = v
+			}
+		}
+	}
+	{
+		a, ok := tf.AttrTypes["spec"]
+		if !ok {
+			diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec"})
+		} else {
+			o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+			if !ok {
+				diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+			} else {
+				v, ok := tf.Attrs["spec"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+				if !ok {
+					v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+						AttrTypes: o.AttrTypes,
+						Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+					}
+				} else {
+					if v.Attrs == nil {
+						v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+					}
+				}
+				{
+					obj := obj.Spec
+					tf := &v
+					{
+						a, ok := tf.AttrTypes["aws_oidc"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSOIDC"})
+						} else {
+							obj, ok := obj.SubKindSpec.(*github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSOIDC)
+							if !ok {
+								obj = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSOIDC{}
+							}
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["aws_oidc"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.AWSOIDC == nil {
+									v.Null = true
+								} else {
+									obj := obj.AWSOIDC
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["role_arn"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSOIDC.RoleARN"})
+										} else {
+											v, ok := tf.Attrs["role_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSOIDC.RoleARN", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.RoleARN) == ""
+											}
+											v.Value = string(obj.RoleARN)
+											v.Unknown = false
+											tf.Attrs["role_arn"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["issuer_s3_uri"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSOIDC.IssuerS3URI"})
+										} else {
+											v, ok := tf.Attrs["issuer_s3_uri"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSOIDC.IssuerS3URI", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.IssuerS3URI", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.IssuerS3URI) == ""
+											}
+											v.Value = string(obj.IssuerS3URI)
+											v.Unknown = false
+											tf.Attrs["issuer_s3_uri"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["audience"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSOIDC.audience"})
+										} else {
+											v, ok := tf.Attrs["audience"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSOIDC.audience", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSOIDC.audience", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.Audience) == ""
+											}
+											v.Value = string(obj.Audience)
+											v.Unknown = false
+											tf.Attrs["audience"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["aws_oidc"] = v
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["azure_oidc"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AzureOIDC"})
+						} else {
+							obj, ok := obj.SubKindSpec.(*github_com_gravitational_teleport_api_types.IntegrationSpecV1_AzureOIDC)
+							if !ok {
+								obj = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AzureOIDC{}
+							}
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["azure_oidc"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.AzureOIDC == nil {
+									v.Null = true
+								} else {
+									obj := obj.AzureOIDC
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["tenant_id"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AzureOIDC.TenantID"})
+										} else {
+											v, ok := tf.Attrs["tenant_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AzureOIDC.TenantID", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC.TenantID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.TenantID) == ""
+											}
+											v.Value = string(obj.TenantID)
+											v.Unknown = false
+											tf.Attrs["tenant_id"] = v
+										}
+									}
+									{
+										t, ok := tf.AttrTypes["client_id"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AzureOIDC.ClientID"})
+										} else {
+											v, ok := tf.Attrs["client_id"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AzureOIDC.ClientID", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AzureOIDC.ClientID", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.ClientID) == ""
+											}
+											v.Value = string(obj.ClientID)
+											v.Unknown = false
+											tf.Attrs["client_id"] = v
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["azure_oidc"] = v
+							}
+						}
+					}
+					{
+						a, ok := tf.AttrTypes["aws_ra"]
+						if !ok {
+							diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA"})
+						} else {
+							obj, ok := obj.SubKindSpec.(*github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSRA)
+							if !ok {
+								obj = &github_com_gravitational_teleport_api_types.IntegrationSpecV1_AWSRA{}
+							}
+							o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+							if !ok {
+								diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+							} else {
+								v, ok := tf.Attrs["aws_ra"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+								if !ok {
+									v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+										AttrTypes: o.AttrTypes,
+										Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+									}
+								} else {
+									if v.Attrs == nil {
+										v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+									}
+								}
+								if obj.AWSRA == nil {
+									v.Null = true
+								} else {
+									obj := obj.AWSRA
+									tf := &v
+									{
+										t, ok := tf.AttrTypes["trust_anchor_arn"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.TrustAnchorARN"})
+										} else {
+											v, ok := tf.Attrs["trust_anchor_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+											if !ok {
+												i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+												if err != nil {
+													diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.TrustAnchorARN", err})
+												}
+												v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+												if !ok {
+													diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.TrustAnchorARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+												}
+												v.Null = string(obj.TrustAnchorARN) == ""
+											}
+											v.Value = string(obj.TrustAnchorARN)
+											v.Unknown = false
+											tf.Attrs["trust_anchor_arn"] = v
+										}
+									}
+									{
+										a, ok := tf.AttrTypes["profile_sync_config"]
+										if !ok {
+											diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig"})
+										} else {
+											o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ObjectType)
+											if !ok {
+												diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig", "github.com/hashicorp/terraform-plugin-framework/types.ObjectType"})
+											} else {
+												v, ok := tf.Attrs["profile_sync_config"].(github_com_hashicorp_terraform_plugin_framework_types.Object)
+												if !ok {
+													v = github_com_hashicorp_terraform_plugin_framework_types.Object{
+
+														AttrTypes: o.AttrTypes,
+														Attrs:     make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(o.AttrTypes)),
+													}
+												} else {
+													if v.Attrs == nil {
+														v.Attrs = make(map[string]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(tf.AttrTypes))
+													}
+												}
+												if obj.ProfileSyncConfig == nil {
+													v.Null = true
+												} else {
+													obj := obj.ProfileSyncConfig
+													tf := &v
+													{
+														t, ok := tf.AttrTypes["enabled"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.Enabled"})
+														} else {
+															v, ok := tf.Attrs["enabled"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.Enabled", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.Enabled", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																}
+																v.Null = bool(obj.Enabled) == false
+															}
+															v.Value = bool(obj.Enabled)
+															v.Unknown = false
+															tf.Attrs["enabled"] = v
+														}
+													}
+													{
+														t, ok := tf.AttrTypes["profile_arn"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileARN"})
+														} else {
+															v, ok := tf.Attrs["profile_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileARN", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.ProfileARN) == ""
+															}
+															v.Value = string(obj.ProfileARN)
+															v.Unknown = false
+															tf.Attrs["profile_arn"] = v
+														}
+													}
+													{
+														t, ok := tf.AttrTypes["profile_accepts_role_session_name"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileAcceptsRoleSessionName"})
+														} else {
+															v, ok := tf.Attrs["profile_accepts_role_session_name"].(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileAcceptsRoleSessionName", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.Bool)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileAcceptsRoleSessionName", "github.com/hashicorp/terraform-plugin-framework/types.Bool"})
+																}
+																v.Null = bool(obj.ProfileAcceptsRoleSessionName) == false
+															}
+															v.Value = bool(obj.ProfileAcceptsRoleSessionName)
+															v.Unknown = false
+															tf.Attrs["profile_accepts_role_session_name"] = v
+														}
+													}
+													{
+														t, ok := tf.AttrTypes["role_arn"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.RoleARN"})
+														} else {
+															v, ok := tf.Attrs["role_arn"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+															if !ok {
+																i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																if err != nil {
+																	diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.RoleARN", err})
+																}
+																v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																if !ok {
+																	diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.RoleARN", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																}
+																v.Null = string(obj.RoleARN) == ""
+															}
+															v.Value = string(obj.RoleARN)
+															v.Unknown = false
+															tf.Attrs["role_arn"] = v
+														}
+													}
+													{
+														a, ok := tf.AttrTypes["profile_name_filters"]
+														if !ok {
+															diags.Append(attrWriteMissingDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters"})
+														} else {
+															o, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.ListType)
+															if !ok {
+																diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters", "github.com/hashicorp/terraform-plugin-framework/types.ListType"})
+															} else {
+																c, ok := tf.Attrs["profile_name_filters"].(github_com_hashicorp_terraform_plugin_framework_types.List)
+																if !ok {
+																	c = github_com_hashicorp_terraform_plugin_framework_types.List{
+
+																		ElemType: o.ElemType,
+																		Elems:    make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProfileNameFilters)),
+																		Null:     true,
+																	}
+																} else {
+																	if c.Elems == nil {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProfileNameFilters))
+																	}
+																}
+																if obj.ProfileNameFilters != nil {
+																	t := o.ElemType
+																	if len(obj.ProfileNameFilters) != len(c.Elems) {
+																		c.Elems = make([]github_com_hashicorp_terraform_plugin_framework_attr.Value, len(obj.ProfileNameFilters))
+																	}
+																	for k, a := range obj.ProfileNameFilters {
+																		v, ok := tf.Attrs["profile_name_filters"].(github_com_hashicorp_terraform_plugin_framework_types.String)
+																		if !ok {
+																			i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
+																			if err != nil {
+																				diags.Append(attrWriteGeneralError{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters", err})
+																			}
+																			v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
+																			if !ok {
+																				diags.Append(attrWriteConversionFailureDiag{"IntegrationV1.Spec.AWSRA.ProfileSyncConfig.ProfileNameFilters", "github.com/hashicorp/terraform-plugin-framework/types.String"})
+																			}
+																			v.Null = string(a) == ""
+																		}
+																		v.Value = string(a)
+																		v.Unknown = false
+																		c.Elems[k] = v
+																	}
+																	if len(obj.ProfileNameFilters) > 0 {
+																		c.Null = false
+																	}
+																}
+																c.Unknown = false
+																tf.Attrs["profile_name_filters"] = c
+															}
+														}
+													}
+												}
+												v.Unknown = false
+												tf.Attrs["profile_sync_config"] = v
+											}
+										}
+									}
+								}
+								v.Unknown = false
+								tf.Attrs["aws_ra"] = v
+							}
+						}
+					}
+				}
+				v.Unknown = false
+				tf.Attrs["spec"] = v
+			}
+		}
+	}
+	return diags
+}
+
 // attrReadMissingDiag represents diagnostic message on an attribute missing in the source object
 type attrReadMissingDiag struct {
 	Path string
diff --git a/jest.config.js b/jest.config.js
index 94ff914451f0d..23891def8d825 100644
--- a/jest.config.js
+++ b/jest.config.js
@@ -16,6 +16,7 @@ const esModules = [
   'd3-path',
   'internmap',
   '@nivo/bar',
+  'react-error-boundary',
 ].join('|');
 
 /** @type {import('@jest/types').Config.InitialOptions} */
diff --git a/lib/accesslists/collection.go b/lib/accesslists/collection.go
new file mode 100644
index 0000000000000..0cbbec19f98b0
--- /dev/null
+++ b/lib/accesslists/collection.go
@@ -0,0 +1,196 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accesslists
+
+import (
+	"context"
+	"slices"
+	"strconv"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types/accesslist"
+)
+
+// Collection represents a complete batch of access from one source (e.g. entraID or okta)
+// That implies that all access lists and members in the batch are expected to be created/updated together
+// because snapshot have a final complete state of the access lists and their members hierarchy.
+// For instance imagine an access list import from EntraID directory where the access list
+// can't be modified outside EntraID and teleport only fetches the complete state of access lists and members from EntraID
+// This is useful to validate nested hierarchy on the fly and preset the reference updates (Status.MemberOf and Status.OwnerOf)
+// before starting the actual creation/update process in the backend.
+// Where the relation between access list outside the Collection is not possible because collection source are
+// aware only of the access lists and members they contain.
+type Collection struct {
+	// MembersByAccessList maps access list names to their members
+	MembersByAccessList map[string][]*accesslist.AccessListMember
+	// AccessListsByName is an internal map for fast lookup by name
+	AccessListsByName map[string]*accesslist.AccessList
+}
+
+// Validate validates all access lists and members in the batch.
+func (b *Collection) Validate(ctx context.Context) error {
+	for _, accessList := range b.AccessListsByName {
+		if err := accessList.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	for _, members := range b.MembersByAccessList {
+		for _, member := range members {
+			if err := member.CheckAndSetDefaults(); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+	for _, accessList := range b.AccessListsByName {
+		members := b.MembersByAccessList[accessList.GetName()]
+		if err := ValidateAccessListWithMembers(ctx, nil, accessList, members, b); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	if err := b.RefUpdates(); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// AddAccessList adds an access list and its members to the batch.
+func (b *Collection) AddAccessList(accessList *accesslist.AccessList, members []*accesslist.AccessListMember) error {
+	if accessList == nil {
+		return trace.BadParameter("access list is nil")
+	}
+	if b.MembersByAccessList == nil {
+		b.MembersByAccessList = make(map[string][]*accesslist.AccessListMember)
+	}
+	if b.AccessListsByName == nil {
+		b.AccessListsByName = make(map[string]*accesslist.AccessList)
+	}
+	b.MembersByAccessList[accessList.GetName()] = members
+	b.AccessListsByName[accessList.GetName()] = accessList
+
+	if accessList.Status.MemberOf == nil {
+		accessList.Status.MemberOf = []string{}
+	}
+	if accessList.Status.OwnerOf == nil {
+		accessList.Status.OwnerOf = []string{}
+	}
+	return nil
+}
+
+// GetAccessList retrieves an access list from the batch by name.
+// Implements accesslists.AccessListAndMembersGetter interface.
+func (b *Collection) GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error) {
+	al, exists := b.AccessListsByName[name]
+	if !exists {
+		return nil, trace.NotFound("access list %q not found in batch", name)
+	}
+	return al, nil
+}
+
+// ListAccessListMembers retrieves members for an access list from the batch.
+// Implements accesslists.AccessListAndMembersGetter interface.
+func (b *Collection) ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) ([]*accesslist.AccessListMember, string, error) {
+	members, exists := b.MembersByAccessList[accessListName]
+	if !exists {
+		return nil, "", trace.NotFound("access list %q not found in batch", accessListName)
+	}
+
+	// Handle pagination
+	startIdx := 0
+	if pageToken != "" {
+		idx, err := strconv.Atoi(pageToken)
+		if err != nil {
+			return nil, "", trace.BadParameter("invalid page token: %v", err)
+		}
+		startIdx = idx
+	}
+
+	// If startIdx is beyond the members slice, return empty result
+	if startIdx >= len(members) {
+		return []*accesslist.AccessListMember{}, "", nil
+	}
+
+	// Calculate end index based on pageSize
+	endIdx := len(members)
+	if pageSize > 0 {
+		endIdx = startIdx + pageSize
+		if endIdx > len(members) {
+			endIdx = len(members)
+		}
+	}
+
+	// Slice members for this page
+	pageMembers := members[startIdx:endIdx]
+
+	// Generate next page token if there are more members
+	nextToken := ""
+	if endIdx < len(members) {
+		nextToken = strconv.Itoa(endIdx)
+	}
+
+	return pageMembers, nextToken, nil
+}
+
+// GetAccessListMember retrieves a specific member from an access list in the batch.
+// Implements accesslists.AccessListAndMembersGetter interface.
+func (b *Collection) GetAccessListMember(ctx context.Context, accessListName, memberName string) (*accesslist.AccessListMember, error) {
+	members, exists := b.MembersByAccessList[accessListName]
+	if !exists {
+		return nil, trace.NotFound("access list %q not found in batch", accessListName)
+	}
+	for _, member := range members {
+		if member.GetName() == memberName {
+			return member, nil
+		}
+	}
+	return nil, trace.NotFound("member %q not found in access list %q", memberName, accessListName)
+}
+
+// RefUpdates calculates and applies reference updates (Status.MemberOf and Status.OwnerOf)
+// based on the nested access list relationships in the collection.
+func (b *Collection) RefUpdates() error {
+	for name, accessList := range b.AccessListsByName {
+		for _, owner := range accessList.Spec.Owners {
+			if owner.MembershipKind != accesslist.MembershipKindList {
+				continue
+			}
+			if targetList, exists := b.AccessListsByName[owner.Name]; exists {
+				if slices.Contains(targetList.Status.OwnerOf, name) {
+					continue
+				}
+				targetList.Status.OwnerOf = append(targetList.Status.OwnerOf, name)
+			}
+		}
+	}
+
+	for accessListName, members := range b.MembersByAccessList {
+		for _, member := range members {
+			if member.Spec.MembershipKind != accesslist.MembershipKindList {
+				continue
+			}
+			if targetList, exists := b.AccessListsByName[member.Spec.Name]; exists {
+				if slices.Contains(targetList.Status.MemberOf, accessListName) {
+					continue
+				}
+				targetList.Status.MemberOf = append(targetList.Status.MemberOf, accessListName)
+			}
+		}
+	}
+	return nil
+}
diff --git a/lib/accesslists/collection_test.go b/lib/accesslists/collection_test.go
new file mode 100644
index 0000000000000..b30ddb101ba2e
--- /dev/null
+++ b/lib/accesslists/collection_test.go
@@ -0,0 +1,464 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accesslists
+
+import (
+	"context"
+	"testing"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/accesslist"
+)
+
+func TestCollection_RefUpdates(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+
+	t.Run("handles complex nested relationships", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+		list3 := newAccessList(t, "list3", clock)
+
+		list1.Spec.Owners = append(list1.Spec.Owners, accesslist.Owner{
+			Name:           list2.GetName(),
+			Description:    "list2 owner",
+			MembershipKind: accesslist.MembershipKindList,
+		})
+
+		list2Member := newAccessListMember(t, list2.GetName(), list3.GetName(), accesslist.MembershipKindList, clock)
+
+		list3Member := newAccessListMember(t, list3.GetName(), list1.GetName(), accesslist.MembershipKindList, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+		collection.AddAccessList(list2, []*accesslist.AccessListMember{list2Member})
+		collection.AddAccessList(list3, []*accesslist.AccessListMember{list3Member})
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+
+		// Verify relationships
+		require.Contains(t, list2.Status.OwnerOf, list1.GetName())
+		require.Contains(t, list3.Status.MemberOf, list2.GetName())
+		require.Contains(t, list1.Status.MemberOf, list3.GetName())
+	})
+
+	t.Run("ignores non-list membership kinds for owners", func(t *testing.T) {
+		// Create access lists
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+
+		list1.Spec.Owners = append(list1.Spec.Owners, accesslist.Owner{
+			Name:           list2.GetName(),
+			Description:    "user owner",
+			MembershipKind: accesslist.MembershipKindUser,
+		})
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+		collection.AddAccessList(list2, nil)
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+
+		require.NotContains(t, list2.Status.OwnerOf, list1.GetName())
+	})
+
+	t.Run("ignores non-list membership kinds for members", func(t *testing.T) {
+		// Create access lists
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+
+		// Add list2 as a User member of list1 (should be ignored)
+		member := newAccessListMember(t, list1.GetName(), list2.GetName(), accesslist.MembershipKindUser, clock)
+
+		// Create collection
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member})
+		collection.AddAccessList(list2, nil)
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+
+		require.NotContains(t, list2.Status.MemberOf, list1.GetName())
+	})
+
+	t.Run("avoids duplicate entries in OwnerOf", func(t *testing.T) {
+		ownerList := newAccessList(t, "owner-list", clock)
+		ownedList := newAccessList(t, "owned-list", clock)
+
+		// Set ownerList as an owner of ownedList
+		ownedList.Spec.Owners = append(ownedList.Spec.Owners, accesslist.Owner{
+			Name:           ownerList.GetName(),
+			Description:    "owner access list",
+			MembershipKind: accesslist.MembershipKindList,
+		})
+
+		ownerList.Status.OwnerOf = []string{ownedList.GetName()}
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(ownerList, nil)
+		collection.AddAccessList(ownedList, nil)
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+
+		// Verify no duplicates
+		require.Len(t, ownerList.Status.OwnerOf, 1)
+		require.Equal(t, ownedList.GetName(), ownerList.Status.OwnerOf[0])
+	})
+
+	t.Run("handles empty collection", func(t *testing.T) {
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+	})
+
+	t.Run("handles multiple owners of same list", func(t *testing.T) {
+		ownerList1 := newAccessList(t, "owner-list-1", clock)
+		ownerList2 := newAccessList(t, "owner-list-2", clock)
+		ownedList := newAccessList(t, "owned-list", clock)
+
+		// Both ownerList1 and ownerList2 are owners of ownedList
+		ownedList.Spec.Owners = append(ownedList.Spec.Owners,
+			accesslist.Owner{
+				Name:           ownerList1.GetName(),
+				Description:    "first owner",
+				MembershipKind: accesslist.MembershipKindList,
+			},
+			accesslist.Owner{
+				Name:           ownerList2.GetName(),
+				Description:    "second owner",
+				MembershipKind: accesslist.MembershipKindList,
+			},
+		)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(ownerList1, nil)
+		collection.AddAccessList(ownerList2, nil)
+		collection.AddAccessList(ownedList, nil)
+
+		err := collection.RefUpdates()
+		require.NoError(t, err)
+
+		// Verify both owners have the owned list in their OwnerOf
+		require.Contains(t, ownerList1.Status.OwnerOf, ownedList.GetName())
+		require.Contains(t, ownerList2.Status.OwnerOf, ownedList.GetName())
+	})
+}
+
+func TestCollection_Validate(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	ctx := context.Background()
+
+	t.Run("validates successfully with valid access lists and members", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+		collection.AddAccessList(list2, nil)
+
+		err := collection.Validate(ctx)
+		require.NoError(t, err)
+	})
+
+	t.Run("fails when access list is invalid", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		// Make the list invalid by removing owners
+		list1.Spec.Owners = []accesslist.Owner{}
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+
+		err := collection.Validate(ctx)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "owners")
+	})
+
+	t.Run("fails when member is invalid", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		member := newAccessListMember(t, list1.GetName(), "user1", accesslist.MembershipKindUser, clock)
+		// Make the member invalid by clearing required field
+		member.Spec.AccessList = ""
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member})
+
+		err := collection.Validate(ctx)
+		require.Error(t, err)
+	})
+
+	t.Run("applies RefUpdates during validation", func(t *testing.T) {
+		ownerList := newAccessList(t, "owner-list", clock)
+		ownedList := newAccessList(t, "owned-list", clock)
+
+		// Set ownerList as an owner of ownedList
+		ownedList.Spec.Owners = append(ownedList.Spec.Owners, accesslist.Owner{
+			Name:           ownerList.GetName(),
+			Description:    "owner access list",
+			MembershipKind: accesslist.MembershipKindList,
+		})
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(ownerList, nil)
+		collection.AddAccessList(ownedList, nil)
+
+		err := collection.Validate(ctx)
+		require.NoError(t, err)
+
+		// Verify that RefUpdates was applied
+		require.Contains(t, ownerList.Status.OwnerOf, ownedList.GetName())
+	})
+
+	t.Run("validates access list hierarchy with nested members", func(t *testing.T) {
+		parentList := newAccessList(t, "parent", clock)
+		childList := newAccessList(t, "child", clock)
+
+		// Add childList as member of parentList
+		member := newAccessListMember(t, parentList.GetName(), childList.GetName(), accesslist.MembershipKindList, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(parentList, []*accesslist.AccessListMember{member})
+		collection.AddAccessList(childList, nil)
+
+		err := collection.Validate(ctx)
+		require.NoError(t, err)
+
+		// Verify that MemberOf was updated
+		require.Contains(t, childList.Status.MemberOf, parentList.GetName())
+	})
+
+	t.Run("validates empty collection", func(t *testing.T) {
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+
+		err := collection.Validate(ctx)
+		require.NoError(t, err)
+	})
+
+	t.Run("validates multiple access lists with mixed relationships", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+		list3 := newAccessList(t, "list3", clock)
+
+		// list2 is owner of list1
+		list1.Spec.Owners = append(list1.Spec.Owners, accesslist.Owner{
+			Name:           list2.GetName(),
+			Description:    "owner",
+			MembershipKind: accesslist.MembershipKindList,
+		})
+
+		member := newAccessListMember(t, list2.GetName(), list3.GetName(), accesslist.MembershipKindList, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+		collection.AddAccessList(list2, []*accesslist.AccessListMember{member})
+		collection.AddAccessList(list3, nil)
+
+		err := collection.Validate(ctx)
+		require.NoError(t, err)
+
+		require.Contains(t, list2.Status.OwnerOf, list1.GetName())
+		require.Contains(t, list3.Status.MemberOf, list2.GetName())
+	})
+
+	t.Run("calls ValidateAccessListWithMembers for each list", func(t *testing.T) {
+		// This test ensures that ValidateAccessListWithMembers is being called
+		// by creating a scenario that would fail ValidateAccessListWithMembers
+		// Create a circular reference that ValidateAccessListWithMembers should catch
+
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+
+		// list1 -> list2 (member)
+		member1 := newAccessListMember(t, list1.GetName(), list2.GetName(), accesslist.MembershipKindList, clock)
+
+		// list2 -> list1 (member) - creates circular reference
+		member2 := newAccessListMember(t, list2.GetName(), list1.GetName(), accesslist.MembershipKindList, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member1})
+		collection.AddAccessList(list2, []*accesslist.AccessListMember{member2})
+
+		err := collection.Validate(ctx)
+		// circular reference should cause validation to fail
+		require.Error(t, err)
+	})
+}
+
+func TestCollection_ListAccessListMembers(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	ctx := context.Background()
+
+	t.Run("returns all members when pageSize is 0", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		member1 := newAccessListMember(t, list1.GetName(), "user1", accesslist.MembershipKindUser, clock)
+		member2 := newAccessListMember(t, list1.GetName(), "user2", accesslist.MembershipKindUser, clock)
+		member3 := newAccessListMember(t, list1.GetName(), "user3", accesslist.MembershipKindUser, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member1, member2, member3})
+
+		members, nextToken, err := collection.ListAccessListMembers(ctx, list1.GetName(), 0, "")
+		require.NoError(t, err)
+		require.Empty(t, nextToken)
+		require.Len(t, members, 3)
+	})
+
+	t.Run("paginates correctly with pageSize", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		member1 := newAccessListMember(t, list1.GetName(), "user1", accesslist.MembershipKindUser, clock)
+		member2 := newAccessListMember(t, list1.GetName(), "user2", accesslist.MembershipKindUser, clock)
+		member3 := newAccessListMember(t, list1.GetName(), "user3", accesslist.MembershipKindUser, clock)
+		member4 := newAccessListMember(t, list1.GetName(), "user4", accesslist.MembershipKindUser, clock)
+		member5 := newAccessListMember(t, list1.GetName(), "user5", accesslist.MembershipKindUser, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member1, member2, member3, member4, member5})
+
+		// First page
+		members, nextToken, err := collection.ListAccessListMembers(ctx, list1.GetName(), 2, "")
+		require.NoError(t, err)
+		require.NotEmpty(t, nextToken)
+		require.Len(t, members, 2)
+		require.Equal(t, "user1", members[0].GetName())
+		require.Equal(t, "user2", members[1].GetName())
+
+		// Second page
+		members, nextToken, err = collection.ListAccessListMembers(ctx, list1.GetName(), 2, nextToken)
+		require.NoError(t, err)
+		require.NotEmpty(t, nextToken)
+		require.Len(t, members, 2)
+		require.Equal(t, "user3", members[0].GetName())
+		require.Equal(t, "user4", members[1].GetName())
+
+		// Third page (last)
+		members, nextToken, err = collection.ListAccessListMembers(ctx, list1.GetName(), 2, nextToken)
+		require.NoError(t, err)
+		require.Empty(t, nextToken)
+		require.Len(t, members, 1)
+		require.Equal(t, "user5", members[0].GetName())
+	})
+
+	t.Run("returns empty when pageToken is beyond members", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+		member1 := newAccessListMember(t, list1.GetName(), "user1", accesslist.MembershipKindUser, clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, []*accesslist.AccessListMember{member1})
+
+		members, nextToken, err := collection.ListAccessListMembers(ctx, list1.GetName(), 10, "100")
+		require.NoError(t, err)
+		require.Empty(t, nextToken)
+		require.Empty(t, members)
+	})
+
+	t.Run("returns error for invalid pageToken", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+
+		_, _, err := collection.ListAccessListMembers(ctx, list1.GetName(), 10, "invalid")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid page token")
+	})
+
+	t.Run("returns not found for non-existent access list", func(t *testing.T) {
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+
+		_, _, err := collection.ListAccessListMembers(ctx, "non-existent", 10, "")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("handles empty member list", func(t *testing.T) {
+		list1 := newAccessList(t, "list1", clock)
+
+		collection := &Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		collection.AddAccessList(list1, nil)
+
+		members, nextToken, err := collection.ListAccessListMembers(ctx, list1.GetName(), 10, "")
+		require.NoError(t, err)
+		require.Empty(t, nextToken)
+		require.Empty(t, members)
+	})
+}
diff --git a/lib/accesslists/hierarchy.go b/lib/accesslists/hierarchy.go
index 2cd9d7428d135..b8a6143b1bdf0 100644
--- a/lib/accesslists/hierarchy.go
+++ b/lib/accesslists/hierarchy.go
@@ -31,7 +31,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/trait"
-	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 )
 
 // RelationshipKind represents the type of relationship: member or owner.
@@ -46,6 +46,15 @@ const (
 type AccessListAndMembersGetter interface {
 	ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
 	GetAccessList(ctx context.Context, accessListName string) (*accesslist.AccessList, error)
+	GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error)
+}
+
+// lockGetter is a service that gets locks.
+type lockGetter interface {
+	// GetLocks is here for compatibility with older Teleport versions.
+	// TODO(okraport): DELETE IN v21
+	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
+	ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error)
 }
 
 // GetMembersFor returns a flattened list of Members for an Access List, including inherited Members.
@@ -105,35 +114,6 @@ func fetchMembers(ctx context.Context, accessListName string, g AccessListAndMem
 	return allMembers, nil
 }
 
-// ValidateAccessListWithMembers validates a new or existing AccessList with a list of AccessListMembers.
-func ValidateAccessListWithMembers(ctx context.Context, accessList *accesslist.AccessList, members []*accesslist.AccessListMember, g AccessListAndMembersGetter) error {
-	for _, owner := range accessList.Spec.Owners {
-		if owner.MembershipKind != accesslist.MembershipKindList {
-			continue
-		}
-		ownerList, err := g.GetAccessList(ctx, owner.Name)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if err := validateAddition(ctx, accessList, ownerList, RelationshipKindOwner, g); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-	for _, member := range members {
-		if member.Spec.MembershipKind != accesslist.MembershipKindList {
-			continue
-		}
-		memberList, err := g.GetAccessList(ctx, member.GetName())
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if err := validateAddition(ctx, accessList, memberList, RelationshipKindMember, g); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-	return nil
-}
-
 // collectOwners is a helper to recursively collect all Owners for an Access List, including inherited Owners.
 func collectOwners(ctx context.Context, accessList *accesslist.AccessList, g AccessListAndMembersGetter, owners map[string]*accesslist.Owner, visited map[string]struct{}) error {
 	if _, ok := visited[accessList.GetName()]; ok {
@@ -202,175 +182,6 @@ func GetOwnersFor(ctx context.Context, accessList *accesslist.AccessList, g Acce
 	return owners, nil
 }
 
-// ValidateAccessListMember validates a new or existing AccessListMember for an Access List.
-func ValidateAccessListMember(
-	ctx context.Context,
-	parentList *accesslist.AccessList,
-	member *accesslist.AccessListMember,
-	g AccessListAndMembersGetter,
-) error {
-	if member.Spec.MembershipKind != accesslist.MembershipKindList {
-		return nil
-	}
-	return validateAccessListMemberOrOwner(ctx, parentList, member.GetName(), RelationshipKindMember, g)
-}
-
-// ValidateAccessListOwner validates a new or existing AccessListOwner for an Access List.
-func ValidateAccessListOwner(
-	ctx context.Context,
-	parentList *accesslist.AccessList,
-	owner *accesslist.Owner,
-	g AccessListAndMembersGetter,
-) error {
-	if owner.MembershipKind != accesslist.MembershipKindList {
-		return nil
-	}
-	return validateAccessListMemberOrOwner(ctx, parentList, owner.Name, RelationshipKindOwner, g)
-}
-
-func validateAccessListMemberOrOwner(
-	ctx context.Context,
-	parentList *accesslist.AccessList,
-	memberOrOwnerName string,
-	kind RelationshipKind,
-	g AccessListAndMembersGetter,
-) error {
-	// Ensure member or owner list exists
-	memberOrOwnerList, err := g.GetAccessList(ctx, memberOrOwnerName)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Validate addition
-	if err := validateAddition(ctx, parentList, memberOrOwnerList, kind, g); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func validateAddition(
-	ctx context.Context,
-	parentList *accesslist.AccessList,
-	childList *accesslist.AccessList,
-	kind RelationshipKind,
-	g AccessListAndMembersGetter,
-) error {
-	kindStr := "a Member"
-	if kind == RelationshipKindOwner {
-		kindStr = "an Owner"
-	}
-
-	// Cycle detection
-	reachable, err := isReachable(ctx, childList, parentList, make(map[string]struct{}), g)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if reachable {
-		return trace.BadParameter(
-			"Access List '%s' can't be added as %s of '%s' because '%s' is already included as a Member or Owner in '%s'",
-			childList.Spec.Title, kindStr, parentList.Spec.Title, parentList.Spec.Title, childList.Spec.Title)
-	}
-
-	// Max depth check
-	exceeds, err := exceedsMaxDepth(ctx, parentList, childList, kind, g)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if exceeds {
-		return trace.BadParameter(
-			"Access List '%s' can't be added as %s of '%s' because it would exceed the maximum nesting depth of %d",
-			childList.Spec.Title, kindStr, parentList.Spec.Title, accesslist.MaxAllowedDepth)
-	}
-
-	return nil
-}
-
-func isReachable(
-	ctx context.Context,
-	currentList *accesslist.AccessList,
-	targetList *accesslist.AccessList,
-	visited map[string]struct{},
-	g AccessListAndMembersGetter,
-) (bool, error) {
-	if currentList.GetName() == targetList.GetName() {
-		return true, nil
-	}
-	if _, ok := visited[currentList.GetName()]; ok {
-		return false, nil
-	}
-	visited[currentList.GetName()] = struct{}{}
-
-	// Traverse member lists
-	listMembers, err := fetchMembers(ctx, currentList.GetName(), g)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	for _, member := range listMembers {
-		if member.Spec.MembershipKind == accesslist.MembershipKindList {
-			childList, err := g.GetAccessList(ctx, member.GetName())
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
-			reachable, err := isReachable(ctx, childList, targetList, visited, g)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
-			if reachable {
-				return true, nil
-			}
-		}
-	}
-
-	// Traverse owner lists
-	for _, owner := range currentList.Spec.Owners {
-		if owner.MembershipKind == accesslist.MembershipKindList {
-			ownerList, err := g.GetAccessList(ctx, owner.Name)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
-			reachable, err := isReachable(ctx, ownerList, targetList, visited, g)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
-			if reachable {
-				return true, nil
-			}
-		}
-	}
-
-	return false, nil
-}
-
-func exceedsMaxDepth(
-	ctx context.Context,
-	parentList *accesslist.AccessList,
-	childList *accesslist.AccessList,
-	kind RelationshipKind,
-	g AccessListAndMembersGetter,
-) (bool, error) {
-	switch kind {
-	case RelationshipKindOwner:
-		// For Owners, only consider the depth downwards from the child node
-		depthDownwards, err := maxDepthDownwards(ctx, childList.GetName(), make(map[string]struct{}), g)
-		if err != nil {
-			return false, trace.Wrap(err)
-		}
-		return depthDownwards > accesslist.MaxAllowedDepth, nil
-	default:
-		// For Members, consider the depth upwards from the parent node, downwards from the child node, and the edge between them
-		depthUpwards, err := maxDepthUpwards(ctx, parentList, make(map[string]struct{}), g)
-		if err != nil {
-			return false, trace.Wrap(err)
-		}
-		depthDownwards, err := maxDepthDownwards(ctx, childList.GetName(), make(map[string]struct{}), g)
-		if err != nil {
-			return false, trace.Wrap(err)
-		}
-		totalDepth := depthUpwards + depthDownwards + 1 // +1 for the edge between parent and child
-		return totalDepth > accesslist.MaxAllowedDepth, nil
-	}
-}
-
 func maxDepthDownwards(
 	ctx context.Context,
 	currentListName string,
@@ -459,20 +270,35 @@ func IsUserLocked(err error) bool {
 	return errors.As(err, &userLockedError{})
 }
 
-// IsAccessListOwner checks if the given user is the Access List owner. It returns an error matched
-// by [IsUserLocked] if the user is locked.
+// IsAccessListOwner checks if the given user is the Access List owner.
+// It returns an error matched by [IsUserLocked] if the user is locked.
+// If the user is not an owner, it returns a trace.AccessDenied error.
 func IsAccessListOwner(
 	ctx context.Context,
 	user types.User,
 	accessList *accesslist.AccessList,
 	g AccessListAndMembersGetter,
-	lockGetter services.LockGetter,
+	lockGetter lockGetter,
 	clock clockwork.Clock,
 ) (accesslistv1.AccessListUserAssignmentType, error) {
 	if lockGetter != nil {
-		locks, err := lockGetter.GetLocks(ctx, true, types.LockTarget{
-			User: user.GetName(),
-		})
+		locks, err := clientutils.CollectWithFallback(
+			ctx,
+			func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return lockGetter.ListLocks(ctx, limit, start, &types.LockFilter{
+					InForceOnly: true,
+					Targets:     []*types.LockTarget{{User: user.GetName()}},
+				})
+			},
+			func(ctx context.Context) ([]types.Lock, error) {
+				// TODO(okraport): DELETE IN v21
+				const inForceOnlyTrue = true
+				return lockGetter.GetLocks(ctx, inForceOnlyTrue, types.LockTarget{
+					User: user.GetName(),
+				})
+			},
+		)
+
 		if err != nil {
 			return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
 		}
@@ -498,42 +324,59 @@ func IsAccessListOwner(
 		if owner.MembershipKind == accesslist.MembershipKindList {
 			ownerAccessList, err := g.GetAccessList(ctx, owner.Name)
 			if err != nil {
-				ownershipErr = trace.Wrap(err)
-				continue
+				return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
 			}
 			// Since we already verified that the user is not locked, don't provide lockGetter here
-			membershipType, err := IsAccessListMember(ctx, user, ownerAccessList, g, nil, clock)
-			if err != nil {
-				ownershipErr = trace.Wrap(err)
-				continue
-			}
-			if membershipType != accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED {
-				if !UserMeetsRequirements(user, accessList.Spec.OwnershipRequires) {
-					ownershipErr = trace.AccessDenied("User '%s' does not meet the ownership requirements for Access List '%s'", user.GetName(), accessList.Spec.Title)
+			if _, err := IsAccessListMember(ctx, user, ownerAccessList, g, nil, clock); err != nil {
+				if trace.IsAccessDenied(err) {
+					ownershipErr = trace.Wrap(err)
 					continue
 				}
-				return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, nil
+				return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
+			}
+			if !UserMeetsRequirements(user, accessList.Spec.OwnershipRequires) {
+				ownershipErr = trace.AccessDenied("User '%s' does not meet the ownership requirements for Access List '%s'", user.GetName(), accessList.Spec.Title)
+				continue
 			}
+			return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, nil
 		}
 	}
 
+	if ownershipErr == nil {
+		ownershipErr = trace.AccessDenied("no ownership path found")
+	}
+
 	return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(ownershipErr)
 }
 
-// IsAccessListMember checks if the given user is the Access List member. It returns an error
-// matched by [IsUserLocked] if the user is locked.
+// IsAccessListMember checks if the given user is the Access List member.
+// It returns an error matched by [IsUserLocked] if the user is locked.
+// If the user is not a member, it returns a trace.AccessDenied error.
 func IsAccessListMember(
 	ctx context.Context,
 	user types.User,
 	accessList *accesslist.AccessList,
 	g AccessListAndMembersGetter,
-	lockGetter services.LockGetter,
+	lockGetter lockGetter,
 	clock clockwork.Clock,
 ) (accesslistv1.AccessListUserAssignmentType, error) {
 	if lockGetter != nil {
-		locks, err := lockGetter.GetLocks(ctx, true, types.LockTarget{
-			User: user.GetName(),
-		})
+		locks, err := clientutils.CollectWithFallback(
+			ctx,
+			func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return lockGetter.ListLocks(ctx, limit, start, &types.LockFilter{
+					InForceOnly: true,
+					Targets:     []*types.LockTarget{{User: user.GetName()}},
+				})
+			},
+			func(ctx context.Context) ([]types.Lock, error) {
+				// TODO(okraport): DELETE IN v21
+				const inForceOnlyTrue = true
+				return lockGetter.GetLocks(ctx, inForceOnlyTrue, types.LockTarget{
+					User: user.GetName(),
+				})
+			},
+		)
 		if err != nil {
 			return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
 		}
@@ -544,7 +387,7 @@ func IsAccessListMember(
 
 	members, err := fetchMembers(ctx, accessList.GetName(), g)
 	if err != nil {
-		return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
+		return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err, "fetching access list %q members", accessList.GetName())
 	}
 
 	var membershipErr error
@@ -568,14 +411,19 @@ func IsAccessListMember(
 		if member.Spec.MembershipKind == accesslist.MembershipKindList {
 			memberAccessList, err := g.GetAccessList(ctx, member.GetName())
 			if err != nil {
-				membershipErr = trace.Wrap(err)
-				continue
+				if trace.IsNotFound(err) {
+					continue
+				}
+				return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err, "getting access list %q", member.GetName())
 			}
 			// Since we already verified that the user is not locked, don't provide lockGetter here
 			membershipType, err := IsAccessListMember(ctx, user, memberAccessList, g, nil, clock)
 			if err != nil {
-				membershipErr = trace.Wrap(err)
-				continue
+				if trace.IsAccessDenied(err) {
+					membershipErr = err
+					continue
+				}
+				return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(err)
 			}
 			if membershipType != accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED {
 				if !UserMeetsRequirements(user, accessList.Spec.MembershipRequires) {
@@ -591,11 +439,20 @@ func IsAccessListMember(
 		}
 	}
 
+	if membershipErr == nil {
+		membershipErr = trace.AccessDenied("no access path found")
+	}
+
 	return accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, trace.Wrap(membershipErr)
 }
 
 // UserMeetsRequirements is a helper which will return whether the User meets the AccessList Ownership/MembershipRequires.
 func UserMeetsRequirements(identity types.User, requires accesslist.Requires) bool {
+	if requires.IsEmpty() {
+		// No requirements to meet return early to avoid unnecessary work
+		return true
+	}
+
 	// Assemble the user's roles for easy look up.
 	userRolesMap := map[string]struct{}{}
 	for _, role := range identity.GetRoles() {
@@ -638,60 +495,307 @@ func UserMeetsRequirements(identity types.User, requires accesslist.Requires) bo
 	return true
 }
 
+type ancestorOptions struct {
+	validateUserRequirement bool
+	clock                   clockwork.Clock
+	user                    types.User
+}
+
+func (o *ancestorOptions) validate() error {
+	if o.validateUserRequirement {
+		if o.user == nil {
+			return trace.BadParameter("user is required when validateUserRequirement is true")
+		}
+		if o.clock == nil {
+			o.clock = clockwork.NewRealClock()
+		}
+	}
+	return nil
+}
+
+// ancestorOption is a functional option for configuring the behavior of GetAncestorsFor.
+type ancestorOption func(*ancestorOptions)
+
+func withUserRequirementsCheck(user types.User, clock clockwork.Clock) ancestorOption {
+	return func(opts *ancestorOptions) {
+		opts.validateUserRequirement = true
+		opts.user = user
+		opts.clock = clock
+	}
+}
+
+// HierarchyConfig holds dependencies for building access list hierarchies.
+type HierarchyConfig struct {
+	// AccessListService is used to fetch Access Lists and their members.
+	AccessListsService AccessListAndMembersGetter
+	// Getter is used to fetch Access Lists and their members.
+	Clock clockwork.Clock
+}
+
+// CheckAndSetDefaults validates the config and sets default values.
+func (c *HierarchyConfig) CheckAndSetDefaults() error {
+	if c.AccessListsService == nil {
+		return trace.BadParameter("AccessListsService is required")
+	}
+	if c.Clock == nil {
+		c.Clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// Hierarchy provides methods to compute access list hierarchies.
+type Hierarchy struct {
+	HierarchyConfig
+}
+
+// NewHierarchy constructs a HierarchyService with the given config.
+func NewHierarchy(cfg HierarchyConfig) (*Hierarchy, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Hierarchy{
+		HierarchyConfig: cfg,
+	}, nil
+}
+
+// GetHierarchyForUser builds the hierarchy of Access Lists for a given user,
+// starting from the provided list and traversing upward through its ancestors
+// using MemberOf/OwnerOf relationships. The returned hierarchy includes the
+// starting list (if the user meets the requirements) and may include ancestor
+// lists where the user satisfies membership or ownership requirements.
+// If the user fails to meet the requirements at any point, that branch is excluded.
+func (s *Hierarchy) GetHierarchyForUser(ctx context.Context, accessList *accesslist.AccessList, user types.User) (memberHierarchy, ownerHierarchy []*accesslist.AccessList, err error) {
+	if s.validDirectOwner(user, accessList) {
+		// User Is direct owner and meet the ownership requirements
+		// Include access list from the owner hierarchy
+		// and check if there is more ownership via nested ownership
+		// or via chained membership -> ownership relationships
+		// e.g. A has nested ownership B, B has nested membership C, C has direct members like alice
+		ownerHierarchy = append(ownerHierarchy, accessList)
+	}
+	ok, err := s.validMembership(ctx, accessList, user)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	if !ok {
+		// User is not a valid member of the starting access list
+		// return current owner hierarchy (not empty if user has a direct ownership)
+		// and empty member hierarchy
+		return memberHierarchy, ownerHierarchy, nil
+	}
+	// User is a valid member of the starting access list
+	// Include access list in the member hierarchy
+	memberHierarchy = append(memberHierarchy, accessList)
+
+	// Fetch ancestors via MemberOf edges while checking user requirements
+	ancestors, err := getAncestors(ctx, accessList, RelationshipKindMember, s.AccessListsService, withUserRequirementsCheck(user, s.Clock))
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// We need to consider 2 scenarios:
+	// - An access list can be configured as 1 level owner of another access list
+	//   like access list A.Owners = [B], {B.members = [alice], B.Status.OwnerOf = [A]
+	//   In that case we need to explore the OwnerOf edges directly from input accessList and check if the user meets
+	//   the ownership requirements of the parent access list.
+	//
+	// - An access list can be configured as 2+ level owner of another access list
+	//   like access list A.Owners = [B], {B.members = [C], B.Status.OwnerOf = [A]}, {C.members = [alice], C.Status.MemberOf = [B]
+	//   where the access list traversal start from Access List C and goes up via MemberOf to build ancestors and then to A via OwnerOf edges.
+	owners, err := s.expandOwnerOf(ctx, accessList, ancestors, user)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return append(memberHierarchy, ancestors...), append(ownerHierarchy, owners...), nil
+}
+
+func (s *Hierarchy) validMembership(ctx context.Context, list *accesslist.AccessList, user types.User) (bool, error) {
+	m, err := s.AccessListsService.GetAccessListMember(ctx, list.GetName(), user.GetName())
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return false, nil
+		}
+		return false, trace.Wrap(err)
+	}
+	// Only user membership are valid. It can happen that username overlaps with the access list name.
+	// So we need to ensure the membership kind always is verified.
+	if !m.IsUser() {
+		return false, nil
+	}
+	if m.IsExpired(s.Clock.Now()) || !UserMeetsRequirements(user, list.GetMembershipRequires()) {
+		return false, nil
+	}
+	return true, nil
+}
+
+// Expand ancestors via OwnerOf edges while checking user requirements
+func (s *Hierarchy) expandOwnerOf(ctx context.Context, accessList *accesslist.AccessList, ancestors []*accesslist.AccessList, user types.User) ([]*accesslist.AccessList, error) {
+	var out []*accesslist.AccessList
+	processFn := func(al *accesslist.AccessList) error {
+		for _, name := range al.Status.OwnerOf {
+			ownerList, err := s.AccessListsService.GetAccessList(ctx, name)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if UserMeetsRequirements(user, ownerList.GetOwnershipRequires()) {
+				out = append(out, ownerList)
+			}
+		}
+		return nil
+	}
+
+	if err := processFn(accessList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	for _, al := range ancestors {
+		if err := processFn(al); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return out, nil
+}
+
+func (s *Hierarchy) validDirectOwner(user types.User, acl *accesslist.AccessList) bool {
+	if !UserMeetsRequirements(user, acl.GetOwnershipRequires()) {
+		return false
+	}
+	for _, v := range acl.Spec.Owners {
+		// Only user membership are valid. It can happen that username overlaps with the access list name.
+		// So we need to ensure the  membership kind is verified as user.
+		if !v.IsMembershipKindUser() {
+			continue
+		}
+		if v.Name == user.GetName() {
+			return true
+		}
+	}
+	return false
+}
+
 // GetAncestorsFor calculates and returns the set of Ancestor ACLs depending on
 // the supplied relationship criteria. Order of the ancestor list is undefined.
 func GetAncestorsFor(ctx context.Context, accessList *accesslist.AccessList, kind RelationshipKind, g AccessListAndMembersGetter) ([]*accesslist.AccessList, error) {
+	return getAncestors(ctx, accessList, kind, g)
+}
+
+func getAncestors(ctx context.Context, accessList *accesslist.AccessList, kind RelationshipKind, g AccessListAndMembersGetter, opts ...ancestorOption) ([]*accesslist.AccessList, trace.Error) {
 	ancestorsMap := make(map[string]*accesslist.AccessList)
-	if err := collectAncestors(ctx, accessList, kind, g, make(map[string]struct{}), ancestorsMap); err != nil {
+	if err := collectAncestors(ctx, accessList, kind, g, make(map[string]struct{}), ancestorsMap, opts...); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	ancestors := slices.Collect(maps.Values(ancestorsMap))
 	return ancestors, nil
 }
 
-func collectAncestors(ctx context.Context, accessList *accesslist.AccessList, kind RelationshipKind, g AccessListAndMembersGetter, visited map[string]struct{}, ancestors map[string]*accesslist.AccessList) error {
+func collectAncestors(ctx context.Context, accessList *accesslist.AccessList, kind RelationshipKind, g AccessListAndMembersGetter, visited map[string]struct{}, ancestors map[string]*accesslist.AccessList, opts ...ancestorOption) error {
+	options := &ancestorOptions{}
+	for _, opt := range opts {
+		opt(options)
+	}
+	if err := options.validate(); err != nil {
+		return trace.Wrap(err)
+	}
 	if _, ok := visited[accessList.GetName()]; ok {
 		return nil
 	}
 	visited[accessList.GetName()] = struct{}{}
 
-	switch kind {
-	case RelationshipKindOwner:
+	isDirectMembershipExpired := func(acl, member string) (bool, error) {
+		if !options.validateUserRequirement {
+			return false, nil
+		}
+		m, err := g.GetAccessListMember(ctx, acl, member)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		return m.IsExpired(options.clock.Now()), nil
+	}
+
+	userMeetsRequirements := func(r accesslist.Requires) bool {
+		if options.user == nil {
+			return true
+		}
+		return UserMeetsRequirements(options.user, r)
+	}
+
+	if kind == RelationshipKindOwner {
 		// Add parents where this list is an owner to ancestors
 		for _, ownerParent := range accessList.Status.OwnerOf {
 			ownerParentAcl, err := g.GetAccessList(ctx, ownerParent)
 			if err != nil {
 				return trace.Wrap(err)
 			}
+			if !userMeetsRequirements(ownerParentAcl.Spec.OwnershipRequires) {
+				continue
+			}
 			ancestors[ownerParent] = ownerParentAcl
 		}
-		// Recursively traverse parents where this list is a member
-		for _, memberParent := range accessList.Status.MemberOf {
-			memberParentAcl, err := g.GetAccessList(ctx, memberParent)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			if err := collectAncestors(ctx, memberParentAcl, kind, g, visited, ancestors); err != nil {
-				return trace.Wrap(err)
-			}
+	}
+	for _, memberParent := range accessList.Status.MemberOf {
+		memberParentAcl, err := g.GetAccessList(ctx, memberParent)
+		if err != nil {
+			return trace.Wrap(err)
 		}
-	default:
-		// Only collect parents where this list is a member
-		for _, memberParent := range accessList.Status.MemberOf {
-			memberParentAcl, err := g.GetAccessList(ctx, memberParent)
-			if err != nil {
-				return trace.Wrap(err)
-			}
+		expired, err := isDirectMembershipExpired(memberParent, accessList.GetName())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if expired || !userMeetsRequirements(memberParentAcl.Spec.MembershipRequires) {
+			continue
+		}
+
+		if kind == RelationshipKindMember {
 			ancestors[memberParent] = memberParentAcl
-			if err := collectAncestors(ctx, memberParentAcl, kind, g, visited, ancestors); err != nil {
-				return trace.Wrap(err)
-			}
+		}
+		if err := collectAncestors(ctx, memberParentAcl, kind, g, visited, ancestors, opts...); err != nil {
+			return trace.Wrap(err)
 		}
 	}
 
 	return nil
 }
 
+// GetInheritedMembershipRequires returns the combined Requires for an Access List's members,
+// inherited from any ancestor lists, and the Access List's own MembershipRequires.
+func GetInheritedMembershipRequires(ctx context.Context, accessList *accesslist.AccessList, g AccessListAndMembersGetter) (*accesslist.Requires, error) {
+	ownRequires := accessList.GetMembershipRequires()
+	ownRequires = ownRequires.Clone()
+	ancestors, err := GetAncestorsFor(ctx, accessList, RelationshipKindMember, g)
+	if err != nil {
+		return &ownRequires, trace.Wrap(err)
+	}
+
+	roles := ownRequires.Roles
+	traits := ownRequires.Traits
+	if traits == nil {
+		traits = trait.Traits{}
+	}
+
+	for _, ancestor := range ancestors {
+		requires := ancestor.GetMembershipRequires()
+		roles = append(roles, requires.Roles...)
+		for traitKey, traitValues := range requires.Traits {
+			if _, exists := traits[traitKey]; !exists {
+				traits[traitKey] = []string{}
+			}
+			traits[traitKey] = append(traits[traitKey], traitValues...)
+		}
+	}
+
+	slices.Sort(roles)
+	roles = slices.Compact(roles)
+
+	for k, v := range traits {
+		slices.Sort(v)
+		traits[k] = slices.Compact(v)
+	}
+
+	return &accesslist.Requires{
+		Roles:  roles,
+		Traits: traits,
+	}, nil
+}
+
 // GetInheritedGrants returns the combined Grants for an Access List's members, inherited from any ancestor lists.
 func GetInheritedGrants(ctx context.Context, accessList *accesslist.AccessList, g AccessListAndMembersGetter) (*accesslist.Grants, error) {
 	grants := accesslist.Grants{
diff --git a/lib/accesslists/hierarchy_test.go b/lib/accesslists/hierarchy_test.go
index d13cfeb1b25e2..f46b3fcd98a52 100644
--- a/lib/accesslists/hierarchy_test.go
+++ b/lib/accesslists/hierarchy_test.go
@@ -20,11 +20,13 @@ package accesslists
 
 import (
 	"context"
-	"fmt"
+	"iter"
+	"slices"
 	"sort"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
@@ -33,6 +35,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/types/trait"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 // Mock implementation of AccessListAndMembersGetter.
@@ -41,6 +45,19 @@ type mockAccessListAndMembersGetter struct {
 	members     map[string][]*accesslist.AccessListMember
 }
 
+func (m *mockAccessListAndMembersGetter) GetAccessListMember(ctx context.Context, accessListName, memberName string) (*accesslist.AccessListMember, error) {
+	member, exists := m.members[accessListName]
+	if !exists {
+		return nil, trace.NotFound("access list %v member %v not found", accessListName, memberName)
+	}
+	for _, m := range member {
+		if m.GetName() == memberName {
+			return m, nil
+		}
+	}
+	return nil, trace.NotFound("access list %v member %v not found", accessListName, memberName)
+}
+
 func (m *mockAccessListAndMembersGetter) GetAccessList(ctx context.Context, accessListName string) (*accesslist.AccessList, error) {
 	accessList, exists := m.accessLists[accessListName]
 	if !exists {
@@ -73,236 +90,46 @@ func (m *mockLocksGetter) GetLocks(ctx context.Context, inForceOnly bool, target
 	return locks, nil
 }
 
-const (
-	ownerUser  = "ownerUser"
-	ownerUser2 = "ownerUser2"
-	member1    = "member1"
-	member2    = "member2"
-)
-
-func TestAccessListHierarchyDepthCheck(t *testing.T) {
-	clock := clockwork.NewFakeClock()
-	ctx := context.Background()
-
-	numAcls := accesslist.MaxAllowedDepth + 2 // Extra 2 to test exceeding the max depth
-
-	acls := make([]*accesslist.AccessList, numAcls)
-	for i := 0; i < numAcls; i++ {
-		acls[i] = newAccessList(t, fmt.Sprintf("acl%d", i+1), clock)
+func (m *mockLocksGetter) ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error) {
+	if limit > 0 || startKey != "" {
+		return nil, "", trace.NotImplemented("limit and start are not supported")
 	}
 
-	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
-		members:     make(map[string][]*accesslist.AccessListMember),
-		accessLists: make(map[string]*accesslist.AccessList),
+	if filter == nil {
+		return nil, "", trace.BadParameter("missing filter")
 	}
 
-	// Create members up to MaxAllowedDepth
-	for i := 0; i < accesslist.MaxAllowedDepth; i++ {
-		member := newAccessListMember(t, acls[i].GetName(), acls[i+1].GetName(), accesslist.MembershipKindList, clock)
-		acls[i+1].Status.MemberOf = append(acls[i+1].Status.MemberOf, acls[i].GetName())
-		accessListAndMembersGetter.members[acls[i].GetName()] = []*accesslist.AccessListMember{member}
-		accessListAndMembersGetter.accessLists[acls[i].GetName()] = acls[i]
-	}
-	// Set remaining Access Lists' members to empty slices
-	for i := accesslist.MaxAllowedDepth; i < numAcls; i++ {
-		accessListAndMembersGetter.members[acls[i].GetName()] = []*accesslist.AccessListMember{}
-		accessListAndMembersGetter.accessLists[acls[i].GetName()] = acls[i]
+	var locks []types.Lock
+	for _, target := range filter.Targets {
+		locks = append(locks, m.targets[target.User]...)
 	}
-
-	// Should be valid with existing member < MaxAllowedDepth
-	err := ValidateAccessListMember(ctx, acls[accesslist.MaxAllowedDepth-1], accessListAndMembersGetter.members[acls[accesslist.MaxAllowedDepth-1].GetName()][0], accessListAndMembersGetter)
-	require.NoError(t, err)
-
-	// Now, attempt to add a member that increases the depth beyond MaxAllowedDepth
-	extraMember := newAccessListMember(
-		t,
-		acls[accesslist.MaxAllowedDepth].GetName(),
-		acls[accesslist.MaxAllowedDepth+1].GetName(),
-		accesslist.MembershipKindList,
-		clock,
-	)
-
-	// Validate adding this member should fail due to exceeding max depth
-	err = ValidateAccessListMember(ctx, acls[accesslist.MaxAllowedDepth], extraMember, accessListAndMembersGetter)
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", acls[accesslist.MaxAllowedDepth+1].Spec.Title, acls[accesslist.MaxAllowedDepth].Spec.Title, accesslist.MaxAllowedDepth))
+	return locks, "", nil
 }
 
-func TestAccessListValidateWithMembers(t *testing.T) {
-	clock := clockwork.NewFakeClock()
-	ctx := context.Background()
-
-	// We're creating a hierarchy with a depth of 10, and then trying to add it as a Member of a 'root' Access List. This should fail.
-	rootAcl := newAccessList(t, "root", clock)
-	nestedAcls := make([]*accesslist.AccessList, 0, accesslist.MaxAllowedDepth)
-	for i := 0; i < accesslist.MaxAllowedDepth+1; i++ {
-		acl := newAccessList(t, fmt.Sprintf("acl-%d", i), clock)
-		nestedAcls = append(nestedAcls, acl)
-	}
-	rootAclMember := newAccessListMember(t, rootAcl.GetName(), nestedAcls[0].GetName(), accesslist.MembershipKindList, clock)
-	members := make([]*accesslist.AccessListMember, 0, accesslist.MaxAllowedDepth-1)
-	for i := 0; i < accesslist.MaxAllowedDepth; i++ {
-		member := newAccessListMember(t, nestedAcls[i].GetName(), nestedAcls[i+1].GetName(), accesslist.MembershipKindList, clock)
-		nestedAcls[i+1].Status.MemberOf = append(nestedAcls[i+1].Status.MemberOf, nestedAcls[i].GetName())
-		members = append(members, member)
-	}
-
-	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
-		members: map[string][]*accesslist.AccessListMember{
-			rootAcl.GetName(): {},
-		},
-		accessLists: map[string]*accesslist.AccessList{
-			rootAcl.GetName(): rootAcl,
-		},
-	}
-	for i := 0; i < accesslist.MaxAllowedDepth+1; i++ {
-		if i < accesslist.MaxAllowedDepth {
-			accessListAndMembersGetter.members[nestedAcls[i].GetName()] = []*accesslist.AccessListMember{members[i]}
-		}
-		accessListAndMembersGetter.accessLists[nestedAcls[i].GetName()] = nestedAcls[i]
-	}
-
-	// Should validate successfully, as acl-0 -> acl-10 is a valid hierarchy of depth 10.
-	err := ValidateAccessListWithMembers(ctx, rootAcl, []*accesslist.AccessListMember{}, accessListAndMembersGetter)
-	require.NoError(t, err)
-	err = ValidateAccessListWithMembers(ctx, nestedAcls[0], []*accesslist.AccessListMember{accessListAndMembersGetter.members[nestedAcls[0].GetName()][0]}, accessListAndMembersGetter)
-	require.NoError(t, err)
-
-	// Calling `ValidateAccessListWithMembers`, with `rootAclm1`, should fail, as it would exceed the maximum nesting depth.
-	err = ValidateAccessListWithMembers(ctx, rootAcl, []*accesslist.AccessListMember{rootAclMember}, accessListAndMembersGetter)
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", nestedAcls[0].Spec.Title, rootAcl.Spec.Title, accesslist.MaxAllowedDepth))
-
-	const Length = accesslist.MaxAllowedDepth/2 + 1
-
-	// Next, we're creating two separate hierarchies, each with a depth of `MaxAllowedDepth/2`. When testing the validation, we'll try to connect the two hierarchies, which should fail.
-	nestedAcls1 := make([]*accesslist.AccessList, 0, Length)
-	for i := 0; i <= Length; i++ {
-		acl := newAccessList(t, fmt.Sprintf("acl1-%d", i), clock)
-		nestedAcls1 = append(nestedAcls1, acl)
+func (m *mockLocksGetter) RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error] {
+	if start != "" || end != "" {
+		return stream.Fail[types.Lock](trace.NotImplemented("start and end are not supported"))
 	}
 
-	// Create the second hierarchy.
-	nestedAcls2 := make([]*accesslist.AccessList, 0, Length)
-	for i := 0; i <= Length; i++ {
-		acl := newAccessList(t, fmt.Sprintf("acl2-%d", i), clock)
-		nestedAcls2 = append(nestedAcls2, acl)
+	if filter == nil {
+		return stream.Fail[types.Lock](trace.BadParameter("missing filter"))
 	}
 
-	accessListAndMembersGetter = &mockAccessListAndMembersGetter{
-		members:     map[string][]*accesslist.AccessListMember{},
-		accessLists: map[string]*accesslist.AccessList{},
-	}
+	var sliceStreams []stream.Stream[types.Lock]
 
-	// Create the members for the first hierarchy.
-	for i := 0; i < Length; i++ {
-		member := newAccessListMember(t, nestedAcls1[i].GetName(), nestedAcls1[i+1].GetName(), accesslist.MembershipKindList, clock)
-		nestedAcls1[i+1].Status.MemberOf = append(nestedAcls1[i+1].Status.MemberOf, nestedAcls1[i].GetName())
-		accessListAndMembersGetter.members[nestedAcls1[i].GetName()] = []*accesslist.AccessListMember{member}
-		accessListAndMembersGetter.accessLists[nestedAcls1[i].GetName()] = nestedAcls1[i]
+	for _, target := range filter.Targets {
+		sliceStreams = append(sliceStreams, stream.Slice(m.targets[target.User]))
 	}
 
-	// Create the members for the second hierarchy.
-	for i := 0; i < Length; i++ {
-		member := newAccessListMember(t, nestedAcls2[i].GetName(), nestedAcls2[i+1].GetName(), accesslist.MembershipKindList, clock)
-		nestedAcls2[i+1].Status.MemberOf = append(nestedAcls2[i+1].Status.MemberOf, nestedAcls2[i].GetName())
-		accessListAndMembersGetter.members[nestedAcls2[i].GetName()] = []*accesslist.AccessListMember{member}
-		accessListAndMembersGetter.accessLists[nestedAcls2[i].GetName()] = nestedAcls2[i]
-	}
-
-	// For the first hierarchy
-	nestedAcls1Last := nestedAcls1[len(nestedAcls1)-1]
-	accessListAndMembersGetter.accessLists[nestedAcls1Last.GetName()] = nestedAcls1Last
-
-	// For the second hierarchy
-	nestedAcls2Last := nestedAcls2[len(nestedAcls2)-1]
-	accessListAndMembersGetter.accessLists[nestedAcls2Last.GetName()] = nestedAcls2Last
-
-	// Should validate successfully when adding another list, as both hierarchies are valid.
-	err = ValidateAccessListWithMembers(ctx, nestedAcls1Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls1Last.GetName(), nestedAcls2Last.GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
-	require.NoError(t, err)
-	err = ValidateAccessListWithMembers(ctx, nestedAcls2Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls2Last.GetName(), nestedAcls1Last.GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
-	require.NoError(t, err)
-
-	// Now, we'll try to connect the two hierarchies, which should fail.
-	err = ValidateAccessListWithMembers(ctx, nestedAcls1Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls1Last.GetName(), nestedAcls2[0].GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", nestedAcls2[0].Spec.Title, nestedAcls1[len(nestedAcls1)-1].Spec.Title, accesslist.MaxAllowedDepth))
+	return stream.Chain(sliceStreams...)
 }
 
-func TestAccessListHierarchyCircularRefsCheck(t *testing.T) {
-	clock := clockwork.NewFakeClock()
-	ctx := context.Background()
-
-	acl1 := newAccessList(t, "1", clock)
-	acl2 := newAccessList(t, "2", clock)
-	acl3 := newAccessList(t, "3", clock)
-
-	// acl1 -> acl2 -> acl3
-	acl1m1 := newAccessListMember(t, acl1.GetName(), acl2.GetName(), accesslist.MembershipKindList, clock)
-	acl2.Status.MemberOf = append(acl2.Status.MemberOf, acl1.GetName())
-	acl2m1 := newAccessListMember(t, acl2.GetName(), acl3.GetName(), accesslist.MembershipKindList, clock)
-	acl3.Status.MemberOf = append(acl3.Status.MemberOf, acl2.GetName())
-
-	// acl3 -> acl1
-	acl3m1 := newAccessListMember(t, acl3.GetName(), acl1.GetName(), accesslist.MembershipKindList, clock)
-
-	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
-		members: map[string][]*accesslist.AccessListMember{
-			acl1.GetName(): {acl1m1},
-			acl2.GetName(): {acl2m1},
-			acl3.GetName(): {},
-		},
-		accessLists: map[string]*accesslist.AccessList{
-			acl1.GetName(): acl1,
-			acl2.GetName(): acl2,
-			acl3.GetName(): acl3,
-		},
-	}
-
-	// Circular references should not be allowed.
-	err := ValidateAccessListMember(ctx, acl3, acl3m1, accessListAndMembersGetter)
-	//err = hierarchy.ValidateAccessListMember(acl3.GetName(), acl3m1)
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because '%s' is already included as a Member or Owner in '%s'", acl1.Spec.Title, acl3.Spec.Title, acl3.Spec.Title, acl1.Spec.Title))
-
-	// By removing acl3 as a member of acl2, the relationship should be valid.
-	accessListAndMembersGetter.members[acl2.GetName()] = []*accesslist.AccessListMember{}
-	accessListAndMembersGetter.accessLists[acl3.GetName()].Status.MemberOf = []string{}
-	err = ValidateAccessListMember(ctx, acl3, acl3m1, accessListAndMembersGetter)
-	require.NoError(t, err)
-
-	// Circular references with Ownership should also be disallowed.
-	acl4 := newAccessList(t, "4", clock)
-	acl5 := newAccessList(t, "5", clock)
-
-	// acl4 includes acl5 as a Member
-	acl4m1 := newAccessListMember(t, acl4.GetName(), acl5.GetName(), accesslist.MembershipKindList, clock)
-	acl5.Status.MemberOf = append(acl5.Status.MemberOf, acl4.GetName())
-
-	// acl5 includes acl4 as an Owner.
-	acl5.Spec.Owners = append(acl5.Spec.Owners, accesslist.Owner{
-		Name:           acl4.GetName(),
-		Description:    "asdf",
-		MembershipKind: accesslist.MembershipKindList,
-	})
-	acl4.Status.OwnerOf = append(acl4.Status.OwnerOf, acl5.GetName())
-
-	accessListAndMembersGetter = &mockAccessListAndMembersGetter{
-		members: map[string][]*accesslist.AccessListMember{
-			acl4.GetName(): {acl4m1},
-			acl5.GetName(): {},
-		},
-		accessLists: map[string]*accesslist.AccessList{
-			acl4.GetName(): acl4,
-			acl5.GetName(): acl5,
-		},
-	}
-
-	err = ValidateAccessListWithMembers(ctx, acl5, []*accesslist.AccessListMember{acl4m1}, accessListAndMembersGetter)
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as an Owner of '%s' because '%s' is already included as a Member or Owner in '%s'", acl4.Spec.Title, acl5.Spec.Title, acl5.Spec.Title, acl4.Spec.Title))
-}
+const (
+	ownerUser  = "ownerUser"
+	ownerUser2 = "ownerUser2"
+	member1    = "member1"
+	member2    = "member2"
+)
 
 func Test_userLockedError_IsUserLocked(t *testing.T) {
 	userLockedErr := newUserLockedError("alice")
@@ -359,7 +186,7 @@ func TestAccessListHierarchyIsOwner(t *testing.T) {
 
 	ownershipType, err := IsAccessListOwner(ctx, stubUserNoRequires, acl4, accessListAndMembersGetter, nil, clock)
 	require.Error(t, err)
-	require.ErrorIs(t, err, trace.AccessDenied("User '%s' does not meet the membership requirements for Access List '%s'", member1, acl1.Spec.Title))
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 	// Should not have inherited ownership due to missing OwnershipRequires.
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, ownershipType)
 
@@ -374,7 +201,7 @@ func TestAccessListHierarchyIsOwner(t *testing.T) {
 
 	ownershipType, err = IsAccessListOwner(ctx, stubUserMeetsMemberRequires, acl4, accessListAndMembersGetter, nil, clock)
 	require.Error(t, err)
-	require.ErrorIs(t, err, trace.AccessDenied("User '%s' does not meet the ownership requirements for Access List '%s'", member1, acl4.Spec.Title))
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, ownershipType)
 
 	// User which meets acl1's Membership and acl1's Ownership requirements.
@@ -395,8 +222,9 @@ func TestAccessListHierarchyIsOwner(t *testing.T) {
 
 	stubUserMeetsAllRequires.SetName(member2)
 	ownershipType, err = IsAccessListOwner(ctx, stubUserMeetsAllRequires, acl4, accessListAndMembersGetter, nil, clock)
-	require.NoError(t, err)
 	// Should not have ownership.
+	require.Error(t, err)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, ownershipType)
 }
 
@@ -441,7 +269,8 @@ func TestAccessListIsMember(t *testing.T) {
 	locksGetter.targets[member1] = []types.Lock{lock}
 
 	membershipType, err = IsAccessListMember(ctx, stubMember1, acl1, accessListAndMembersGetter, locksGetter, clock)
-	require.ErrorIs(t, err, trace.AccessDenied("User %q is currently locked", member1))
+	require.Error(t, err)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, membershipType)
 }
 
@@ -464,8 +293,9 @@ func TestAccessListIsMember_RequirementsAndExpiry(t *testing.T) {
 
 	// Missing membershipRequires should be AccessDenied
 	typ, err := IsAccessListMember(ctx, u, acl, aclGetter, locks, clock)
+	require.Error(t, err)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
-	require.ErrorIs(t, err, trace.AccessDenied("User '%s' does not meet the membership requirements for Access List '%s'", u.GetName(), acl.GetName()))
 
 	// Give correct traits/roles, but expire the membership
 	u.SetRoles([]string{"mrole1", "mrole2"})
@@ -478,7 +308,210 @@ func TestAccessListIsMember_RequirementsAndExpiry(t *testing.T) {
 
 	typ, err = IsAccessListMember(ctx, u, acl, aclGetter, locks, clock)
 	require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
-	require.ErrorIs(t, err, trace.AccessDenied("User '%s's membership in Access List '%s' has expired", u.GetName(), acl.GetName()))
+	require.Error(t, err)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+}
+
+func TestAccessListIsMember_NestedRequirements(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	ctx := t.Context()
+	locks := &mockLocksGetter{}
+
+	t.Run("nested lists with requirements at multiple levels", func(t *testing.T) {
+		rootList := newAccessList(t, "root", clock)
+		rootList.Spec.MembershipRequires = accesslist.Requires{
+			Roles: []string{"root-role"},
+		}
+
+		middleList := newAccessList(t, "middle", clock)
+		middleList.Spec.MembershipRequires = accesslist.Requires{
+			Roles: []string{"middle-role"},
+		}
+
+		leafList := newAccessList(t, "leaf", clock)
+		leafList.Spec.MembershipRequires = accesslist.Requires{
+			Roles: []string{"leaf-role"},
+		}
+
+		const userName = "alice"
+
+		userMember := newAccessListMember(t, leafList.GetName(), userName, accesslist.MembershipKindUser, clock)
+		leafInMiddle := newAccessListMember(t, middleList.GetName(), leafList.GetName(), accesslist.MembershipKindList, clock)
+		middleInRoot := newAccessListMember(t, rootList.GetName(), middleList.GetName(), accesslist.MembershipKindList, clock)
+
+		aclGetter := &mockAccessListAndMembersGetter{
+			accessLists: map[string]*accesslist.AccessList{
+				"root":   rootList,
+				"middle": middleList,
+				"leaf":   leafList,
+			},
+			members: map[string][]*accesslist.AccessListMember{
+				"root":   {middleInRoot},
+				"middle": {leafInMiddle},
+				"leaf":   {userMember},
+			},
+		}
+
+		user, err := types.NewUser(userName)
+		require.NoError(t, err)
+		allRoles := slices.Concat(
+			rootList.Spec.MembershipRequires.Roles,
+			middleList.Spec.MembershipRequires.Roles,
+			leafList.Spec.MembershipRequires.Roles,
+		)
+		user.SetRoles(allRoles)
+
+		typ, err := IsAccessListMember(ctx, user, rootList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, typ)
+
+		typ, err = IsAccessListMember(ctx, user, middleList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, typ)
+
+		typ, err = IsAccessListMember(ctx, user, leafList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_EXPLICIT, typ)
+
+		// User missing middle role
+		missingMiddleRoles := slices.Concat(
+			rootList.Spec.MembershipRequires.Roles,
+			leafList.Spec.MembershipRequires.Roles,
+		)
+		user.SetRoles(missingMiddleRoles)
+
+		typ, err = IsAccessListMember(ctx, user, rootList, aclGetter, locks, clock)
+		require.Error(t, err)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
+	})
+
+	t.Run("nested lists with expired list membership in the middle", func(t *testing.T) {
+		rootList := newAccessList(t, "root", clock)
+		middleList := newAccessList(t, "middle", clock)
+		leafList := newAccessList(t, "leaf", clock)
+
+		const userName = "alice"
+
+		userMember := newAccessListMember(t, leafList.GetName(), userName, accesslist.MembershipKindUser, clock)
+		// middle -> leaf membership expires in 12 hours while the other memberships expire in 24h
+		leafInMiddle := newAccessListMember(t, middleList.GetName(), leafList.GetName(), accesslist.MembershipKindList, clockwork.NewFakeClockAt(clock.Now().Add(-12*time.Hour)))
+		middleInRoot := newAccessListMember(t, rootList.GetName(), middleList.GetName(), accesslist.MembershipKindList, clock)
+
+		aclGetter := &mockAccessListAndMembersGetter{
+			accessLists: map[string]*accesslist.AccessList{
+				"root":   rootList,
+				"middle": middleList,
+				"leaf":   leafList,
+			},
+			members: map[string][]*accesslist.AccessListMember{
+				"root":   {middleInRoot},
+				"middle": {leafInMiddle},
+				"leaf":   {userMember},
+			},
+		}
+
+		user, err := types.NewUser(userName)
+		require.NoError(t, err)
+		user.SetRoles(rootList.Spec.MembershipRequires.Roles)
+		user.SetTraits(rootList.Spec.MembershipRequires.Traits)
+
+		typ, err := IsAccessListMember(ctx, user, rootList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, typ)
+
+		// advancing the clock makes the middle -> leaf membership expire
+		clock.Advance(14 * time.Hour)
+
+		typ, err = IsAccessListMember(ctx, user, rootList, aclGetter, locks, clock)
+		require.Error(t, err)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
+	})
+
+	t.Run("cyclic graph, no membership", func(t *testing.T) {
+		t.Skip("cyclic graph not supported yet")
+		firstList := newAccessList(t, "first", clock)
+		secondList := newAccessList(t, "second", clock)
+		thirdList := newAccessList(t, "third", clock)
+
+		firstArc := newAccessListMember(t, firstList.GetName(), secondList.GetName(), accesslist.MembershipKindList, clock)
+		secondArc := newAccessListMember(t, secondList.GetName(), thirdList.GetName(), accesslist.MembershipKindList, clock)
+		thirdArc := newAccessListMember(t, thirdList.GetName(), firstList.GetName(), accesslist.MembershipKindList, clock)
+
+		aclGetter := &mockAccessListAndMembersGetter{
+			accessLists: map[string]*accesslist.AccessList{
+				firstList.GetName():  firstList,
+				secondList.GetName(): secondList,
+				thirdList.GetName():  thirdList,
+			},
+			members: map[string][]*accesslist.AccessListMember{
+				firstList.GetName():  {firstArc},
+				secondList.GetName(): {secondArc},
+				thirdList.GetName():  {thirdArc},
+			},
+		}
+
+		user, err := types.NewUser("alice")
+		require.NoError(t, err)
+		// Make sure the user meets the membership requirements.
+		user.SetRoles(firstList.Spec.MembershipRequires.Roles)
+		user.SetTraits(firstList.Spec.MembershipRequires.Traits)
+
+		typ, err := IsAccessListMember(ctx, user, firstList, aclGetter, locks, clock)
+		require.Error(t, err)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
+		typ, err = IsAccessListMember(ctx, user, secondList, aclGetter, locks, clock)
+		require.Error(t, err)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
+		typ, err = IsAccessListMember(ctx, user, thirdList, aclGetter, locks, clock)
+		require.Error(t, err)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED, typ)
+	})
+
+	t.Run("cyclic graph, user membership", func(t *testing.T) {
+		t.Skip("cyclic graph not supported yet")
+		firstList := newAccessList(t, "first", clock)
+		secondList := newAccessList(t, "second", clock)
+		thirdList := newAccessList(t, "third", clock)
+
+		user, err := types.NewUser("alice")
+		require.NoError(t, err)
+		// Make sure the user meets the membership requirements.
+		user.SetRoles(firstList.Spec.MembershipRequires.Roles)
+		user.SetTraits(firstList.Spec.MembershipRequires.Traits)
+
+		firstArc := newAccessListMember(t, firstList.GetName(), secondList.GetName(), accesslist.MembershipKindList, clock)
+		secondArc := newAccessListMember(t, secondList.GetName(), thirdList.GetName(), accesslist.MembershipKindList, clock)
+		thirdArc := newAccessListMember(t, thirdList.GetName(), firstList.GetName(), accesslist.MembershipKindList, clock)
+		userMembership := newAccessListMember(t, thirdList.GetName(), user.GetName(), accesslist.MembershipKindUser, clock)
+
+		aclGetter := &mockAccessListAndMembersGetter{
+			accessLists: map[string]*accesslist.AccessList{
+				firstList.GetName():  firstList,
+				secondList.GetName(): secondList,
+				thirdList.GetName():  thirdList,
+			},
+			members: map[string][]*accesslist.AccessListMember{
+				firstList.GetName():  {firstArc},
+				secondList.GetName(): {secondArc},
+				thirdList.GetName():  {thirdArc, userMembership},
+			},
+		}
+
+		typ, err := IsAccessListMember(ctx, user, firstList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, typ)
+		typ, err = IsAccessListMember(ctx, user, secondList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED, typ)
+		typ, err = IsAccessListMember(ctx, user, thirdList, aclGetter, locks, clock)
+		require.NoError(t, err)
+		require.Equal(t, accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_EXPLICIT, typ)
+	})
 }
 
 func TestGetOwners(t *testing.T) {
@@ -642,6 +675,209 @@ func TestGetInheritedGrants(t *testing.T) {
 	require.Equal(t, expectedGrants, grants)
 }
 
+func TestGetInheritedRequires(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	clock := clockwork.NewFakeClock()
+
+	type testListSpec struct {
+		name     string
+		requires accesslist.Requires
+		memberOf []string
+	}
+
+	tests := []struct {
+		name       string
+		lists      []testListSpec
+		targetName string
+		expected   *accesslist.Requires
+	}{
+		{
+			name: "NilLeafRequires_Chain3",
+			lists: []testListSpec{
+				{
+					name: "root",
+					requires: accesslist.Requires{
+						Roles: []string{"root-role"},
+						Traits: map[string][]string{
+							"env": {"prod"},
+						},
+					},
+				},
+				{
+					name: "intermediate",
+					requires: accesslist.Requires{
+						Roles: []string{"intermediate-role"},
+						Traits: map[string][]string{
+							"env":  {"testing"},
+							"team": {"backend"},
+						},
+					},
+					memberOf: []string{"root"},
+				},
+				{
+					name:     "leaf",
+					requires: accesslist.Requires{},
+					memberOf: []string{"intermediate"},
+				},
+			},
+			targetName: "leaf",
+			expected: &accesslist.Requires{
+				Roles: []string{"intermediate-role", "root-role"},
+				Traits: trait.Traits{
+					"env":  {"prod", "testing"},
+					"team": {"backend"},
+				},
+			},
+		},
+		{
+			name: "LeafHasOwnRequires_Chain3",
+			lists: []testListSpec{
+				{
+					name: "root",
+					requires: accesslist.Requires{
+						Roles: []string{"root-role"},
+						Traits: trait.Traits{
+							"env": {"prod"},
+						},
+					},
+				},
+				{
+					name: "intermediate",
+					requires: accesslist.Requires{
+						Roles: []string{"app-role"},
+						Traits: trait.Traits{
+							"env":  {"staging"},
+							"team": {"backend"},
+						},
+					},
+					memberOf: []string{"root"},
+				},
+				{
+					name: "leaf",
+					requires: accesslist.Requires{
+						Roles: []string{"leaf-role"},
+						Traits: trait.Traits{
+							"team":   {"infra"},
+							"region": {"us-east-1"},
+						},
+					},
+					memberOf: []string{"intermediate"},
+				},
+			},
+			targetName: "leaf",
+			expected: &accesslist.Requires{
+				Roles: []string{"app-role", "leaf-role", "root-role"},
+				Traits: trait.Traits{
+					"env":    {"prod", "staging"},
+					"team":   {"backend", "infra"},
+					"region": {"us-east-1"},
+				},
+			},
+		},
+		{
+			name: "NilLeafRequires_Diamond",
+			lists: []testListSpec{
+				{
+					name: "root",
+					requires: accesslist.Requires{
+						Roles: []string{"root-role"},
+						Traits: trait.Traits{
+							"env": {"prod"},
+						},
+					},
+				},
+				{
+					name: "parent-a",
+					requires: accesslist.Requires{
+						Roles: []string{"a-role"},
+						Traits: trait.Traits{
+							"env":  {"staging"},
+							"team": {"a-team"},
+						},
+					},
+					memberOf: []string{"root"},
+				},
+				{
+					name: "parent-b",
+					requires: accesslist.Requires{
+						Roles: []string{"b-role"},
+						Traits: trait.Traits{
+							"team":   {"b-team"},
+							"region": {"eu-west-1"},
+						},
+					},
+					memberOf: []string{"root"},
+				},
+				{
+					name:     "leaf",
+					requires: accesslist.Requires{},
+					memberOf: []string{"parent-a", "parent-b"},
+				},
+			},
+			targetName: "leaf",
+			expected: &accesslist.Requires{
+				Roles: []string{"a-role", "b-role", "root-role"},
+				Traits: trait.Traits{
+					"env":    {"prod", "staging"},
+					"team":   {"a-team", "b-team"},
+					"region": {"eu-west-1"},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			listsByID := make(map[string]*accesslist.AccessList, len(tc.lists))
+			listsByName := make(map[string]*accesslist.AccessList, len(tc.lists))
+			for _, ls := range tc.lists {
+				acl, err := accesslist.NewAccessList(
+					header.Metadata{
+						Name: uuid.NewString(),
+					},
+					accesslist.Spec{
+						Title:              ls.name,
+						Description:        ls.name,
+						MembershipRequires: ls.requires,
+					},
+				)
+				require.NoError(t, err)
+				listsByID[acl.GetName()] = acl
+				listsByName[ls.name] = acl
+			}
+
+			members := make(map[string][]*accesslist.AccessListMember)
+			for _, ls := range tc.lists {
+				child := listsByName[ls.name]
+				for _, parentName := range ls.memberOf {
+					parent := listsByName[parentName]
+					child.Status.MemberOf = append(child.Status.MemberOf, parent.GetName())
+					members[parent.GetName()] = append(members[parent.GetName()], newAccessListMember(t, parent.GetName(), child.GetName(), accesslist.MembershipKindList, clock))
+				}
+			}
+
+			getter := &mockAccessListAndMembersGetter{
+				accessLists: listsByID,
+				members:     members,
+			}
+
+			leaf := listsByName[tc.targetName]
+			originalLeafRequires := leaf.Spec.MembershipRequires.Clone()
+
+			requires, err := GetInheritedMembershipRequires(ctx, leaf, getter)
+			require.NoError(t, err)
+			// Should be expected
+			require.Equal(t, tc.expected, requires)
+			// Original should not be mutated
+			require.Equal(t, originalLeafRequires, leaf.Spec.MembershipRequires)
+		})
+	}
+}
+
 func TestGetMembersFor_FlattensAndStopsOnCycles(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	ctx := context.Background()
diff --git a/lib/accesslists/hierarchy_user_test.go b/lib/accesslists/hierarchy_user_test.go
new file mode 100644
index 0000000000000..a3a23a292f504
--- /dev/null
+++ b/lib/accesslists/hierarchy_user_test.go
@@ -0,0 +1,580 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package accesslists_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/accesslist"
+	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/types/trait"
+	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/accesslists"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+func TestGetHierarchyForUser(t *testing.T) {
+	modulestest.SetTestModules(t, modulestest.Modules{
+		TestBuildType: modules.BuildEnterprise,
+		TestFeatures: modules.Features{
+			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
+				entitlements.AccessLists: {Enabled: true},
+			},
+		},
+	})
+	clock := clockwork.NewFakeClock()
+
+	tests := []struct {
+		name   string
+		start  string
+		state  state
+		traits trait.Traits
+		user   types.User
+		kind   accesslists.RelationshipKind
+		want   []string
+	}{
+		{
+			name: "access list hierarchy for user",
+			state: state{
+				mustMakeAccessList("root"):   {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  []string{"root", "level1", "level2"},
+		},
+		{
+			name: "member/expired direct user membership => empty",
+			state: state{
+				mustMakeAccessList("root"):   {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice", withExpiration(clock.Now().Add(-time.Hour)))},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  nil,
+		},
+		{
+			name: "member/stops at expired parent edge",
+			state: state{
+				mustMakeAccessList("root"):   {mustCreateMember("level1", withACLMemKind(), withExpiration(clock.Now().Add(-time.Hour)))},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  []string{"level1", "level2"},
+		},
+		{
+			name: "owner/includes start when user is direct owner (and member)",
+			state: state{
+				mustMakeAccessList("start", withOwners("alice")): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "start",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"start"},
+		},
+		{
+			name: "owner/expired direct user membership stops traversal but keeps start if direct owner",
+			state: state{
+				mustMakeAccessList("start", withOwners("alice")): {mustCreateMember("alice", withExpiration(clock.Now().Add(-time.Hour)))},
+			},
+			user:  makeUser("alice"),
+			start: "start",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"start"},
+		},
+		{
+			name: "member/no direct user membership => empty",
+			state: state{
+				mustMakeAccessList("root"):   {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("bob")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  nil,
+		},
+		{
+			name: "member/parent filtered by membership requirements",
+			state: state{
+				mustMakeAccessList("root"): {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1", withMemberTraitReq("need")): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  []string{"level2"},
+		},
+		{
+			name: "owner/owner target filtered by ownership requirements",
+			state: state{
+				mustMakeAccessList("root", withOwners("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "owner/user is indirect owner of two root access list where meets only one ownership requirement",
+			state: state{
+				mustMakeAccessList("side", withOwnerList("level1")): {},
+				mustMakeAccessList("root", withOwners("level1"), withOwnerTraitReq("need")): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"side"},
+		},
+		{
+			name: "owner/user is indirect owner of two root access list and don't meet ownership requirements for both",
+			state: state{
+				mustMakeAccessList("side", withOwnerList("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("root", withOwners("level1"), withOwnerTraitReq("need")): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{},
+		},
+		{
+			name: "owner/user is indirect owner of two root access list and meet ownership requirements for both",
+			state: state{
+				mustMakeAccessList("side", withOwnerList("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("root", withOwnerList("level1"), withOwnerTraitReq("need")): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice", mkTrait("need")),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"root", "side"},
+		},
+		{
+			name: "owner/owner target filtered by ownership requirements",
+			state: state{
+				mustMakeAccessList("root", withOwners("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "owner/collect owner targets from ancestors' OwnerOf",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1")): {},
+				mustMakeAccessList("level1"):                        {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"):                        {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"root"},
+		},
+		{
+			name: "owner/not a direct owner and no owner targets => empty",
+			state: state{
+				mustMakeAccessList("lonely"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "lonely",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "owner/owner via direct nested ownerships requirements are met",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("level1"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice", mkTrait("need")),
+			start: "level1",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"root"},
+		},
+		{
+			name: "owner/owner via direct nested ownerships requirements not met",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("level1"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level1",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "owner/owner many levels up the ownership chain",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1")): {},
+				mustMakeAccessList("level1"):                        {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"):                        {mustCreateMember("level3", withACLMemKind())},
+				mustMakeAccessList("level3"):                        {mustCreateMember("level4", withACLMemKind())},
+				mustMakeAccessList("level4"):                        {mustCreateMember("levelTail", withACLMemKind())},
+				mustMakeAccessList("levelTail"):                     {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "levelTail",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"root"},
+		},
+		{
+			name: "member/multiple parents included",
+			state: state{
+				mustMakeAccessList("rootA"):  {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("rootB"):  {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  []string{"rootA", "rootB", "level2"},
+		},
+		{
+			name: "member/parent included when membership requirements are met",
+			state: state{
+				mustMakeAccessList("root"): {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1", withMemberTraitReq("ok")): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice", mkTrait("ok")),
+			start: "level2",
+			kind:  accesslists.RelationshipKindMember,
+			want:  []string{"root", "level1", "level2"},
+		},
+		{
+			name: "owner/owner target included when ownership requirements are met",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1"), withOwnerTraitReq("need")): {},
+				mustMakeAccessList("level1"): {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice", mkTrait("need")),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"root"},
+		},
+		{
+			name: "owner/multiple owner targets discovered via ancestors",
+			state: state{
+				mustMakeAccessList("rootA", withOwnerList("level1")): {},
+				mustMakeAccessList("rootB", withOwnerList("level1")): {},
+				mustMakeAccessList("level1"):                         {mustCreateMember("level2", withACLMemKind())},
+				mustMakeAccessList("level2"):                         {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"rootA", "rootB"},
+		},
+		{
+			name: "member/start filtered out when start has unmet membership requirements",
+			state: state{
+				mustMakeAccessList("start", withMemberTraitReq("must")): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "start",
+			kind:  accesslists.RelationshipKindMember,
+			want:  nil,
+		},
+		{
+			name: "owner/start NOT included when ownership requirements are NOT met",
+			state: state{
+				mustMakeAccessList("start", withOwners("alice"), withOwnerTraitReq("need")): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "start",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "owner/start included when user is among multiple direct owners",
+			state: state{
+				mustMakeAccessList("start", withOwners("bob", "alice")): {mustCreateMember("alice")},
+			},
+			user:  makeUser("alice"),
+			start: "start",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"start"},
+		},
+		{
+			name: "owner/direct and indirect owner => include both",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1")): {},
+				mustMakeAccessList("level1"): {
+					mustCreateMember("level2", withACLMemKind()),
+				},
+				mustMakeAccessList("level2", withOwners("alice")): {
+					mustCreateMember("alice"),
+				},
+			},
+			user:  makeUser("alice"),
+			start: "level2",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  []string{"level2", "root"},
+		},
+		{
+			name: "user is excluded from owners when user is not an owner and username overlaps with owning Access List name",
+			state: state{
+				mustMakeAccessList("root", withOwnerList("level1")): {},
+				mustMakeAccessList("level1"):                        {},
+			},
+			user:  makeUser("level1"),
+			start: "root",
+			kind:  accesslists.RelationshipKindOwner,
+			want:  nil,
+		},
+		{
+			name: "member/access list name and username overlaps",
+			state: state{
+				mustMakeAccessList("root"):   {mustCreateMember("level1", withACLMemKind())},
+				mustMakeAccessList("level1"): {},
+			},
+			user:  makeUser("level1"),
+			start: "root",
+			kind:  accesslists.RelationshipKindMember,
+			want:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			bk, err := memory.New(memory.Config{
+				Context: ctx,
+				Clock:   clock,
+			})
+			require.NoError(t, err)
+			svc, err := local.NewAccessListService(bk, clock)
+			require.NoError(t, err)
+
+			require.NoError(t, upsertState(svc, tt.state))
+
+			acl, err := svc.GetAccessList(ctx, tt.start)
+			require.NoError(t, err)
+
+			h, err := accesslists.NewHierarchy(accesslists.HierarchyConfig{
+				AccessListsService: svc,
+				Clock:              clock,
+			})
+			require.NoError(t, err)
+
+			memberOf, ownerOf, err := h.GetHierarchyForUser(t.Context(), acl, tt.user)
+			require.NoError(t, err)
+
+			accessList := memberOf
+			if tt.kind == accesslists.RelationshipKindOwner {
+				accessList = ownerOf
+			}
+
+			got := make([]string, 0, len(accessList))
+			for _, a := range accessList {
+				got = append(got, a.GetName())
+			}
+			require.ElementsMatch(t, got, tt.want)
+		})
+	}
+}
+
+func withOwnerTraitReq(name string) option {
+	return func(opts *options) {
+		opts.ownershipRequire = accesslist.Requires{
+			Traits: mkTrait(name),
+		}
+	}
+}
+
+func withMemberTraitReq(name string) option {
+	return func(opts *options) {
+		opts.membershipRequire = accesslist.Requires{
+			Traits: mkTrait(name),
+		}
+	}
+}
+
+func mkTrait(name string) trait.Traits {
+	return trait.Traits{name: nil}
+}
+
+type state map[*accesslist.AccessList][]*accesslist.AccessListMember
+
+func upsertState(svc *local.AccessListService, state state) error {
+	ctx := context.Background()
+	for acl := range state {
+		for _, owner := range acl.GetOwners() {
+			if owner.MembershipKind == accesslist.MembershipKindList {
+				// Create placeholder access list for owner lists.
+				// to prevent backend check for the nested access list.
+				_, err := svc.UpsertAccessList(ctx, mustMakeAccessList(owner.Name))
+				if err != nil {
+					return trace.Wrap(err)
+				}
+			}
+		}
+		if _, err := svc.UpsertAccessList(ctx, acl); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	for acl, members := range state {
+		for _, member := range members {
+			member.Spec.AccessList = acl.GetName()
+			if _, err := svc.UpsertAccessListMember(ctx, member); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+	return nil
+}
+func makeUser(name string, traits ...trait.Traits) types.User {
+	user, err := types.NewUser(name)
+	if err != nil {
+		panic(err)
+	}
+	for _, t := range traits {
+		user.SetTraits(t)
+	}
+	return user
+}
+
+func withOwners(owners ...string) option {
+	return func(opts *options) {
+		for _, owner := range owners {
+			opts.owners = append(opts.owners, accesslist.Owner{Name: owner})
+		}
+	}
+}
+
+func withOwnerList(owners ...string) option {
+	return func(opts *options) {
+		for _, owner := range owners {
+			opts.owners = append(opts.owners, accesslist.Owner{Name: owner, MembershipKind: accesslist.MembershipKindList})
+		}
+	}
+}
+
+func mustMakeAccessList(name string, opts ...option) *accesslist.AccessList {
+	cfg := options{
+		owners: []accesslist.Owner{{Name: "system"}},
+	}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+	acl, err := accesslist.NewAccessList(header.Metadata{
+		Name: name,
+	}, accesslist.Spec{
+		Title:              name,
+		Owners:             cfg.owners,
+		Audit:              accesslist.Audit{NextAuditDate: time.Now()},
+		MembershipRequires: cfg.membershipRequire,
+		OwnershipRequires:  cfg.ownershipRequire,
+	})
+	if err != nil {
+		panic(err)
+	}
+	return acl
+}
+
+type options struct {
+	kind              string
+	Expiration        time.Time
+	membershipRequire accesslist.Requires
+	ownershipRequire  accesslist.Requires
+	owners            []accesslist.Owner
+}
+
+type option func(*options)
+
+func withKind(kind string) option {
+	return func(opts *options) {
+		opts.kind = kind
+	}
+}
+
+func withACLMemKind() option {
+	return withKind(accesslist.MembershipKindList)
+}
+
+func withExpiration(expiration time.Time) option {
+	return func(opts *options) {
+		opts.Expiration = expiration
+	}
+}
+
+func mustCreateMember(memberName string, opts ...option) *accesslist.AccessListMember {
+	var cfg options
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
+	clock := clockwork.NewRealClock()
+	member, err := accesslist.NewAccessListMember(
+		header.Metadata{
+			Name: memberName,
+		},
+		accesslist.AccessListMemberSpec{
+			AccessList:     "random", // will be updated during insert
+			Name:           memberName,
+			Joined:         clock.Now(),
+			AddedBy:        "added by",
+			Expires:        cfg.Expiration,
+			MembershipKind: cfg.kind,
+		},
+	)
+	if err != nil {
+		panic(err)
+	}
+	return member
+}
diff --git a/lib/accesslists/validate.go b/lib/accesslists/validate.go
new file mode 100644
index 0000000000000..1e60829950455
--- /dev/null
+++ b/lib/accesslists/validate.go
@@ -0,0 +1,317 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accesslists
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types/accesslist"
+)
+
+// ValidateAccessListWithMembers makes sure the given AccessList and it's members is valid before
+// storing it. If the existingAccessList is non-nil it also checks if this is a valid update
+// transition. It takes into account validation of the nested access lists membership.
+func ValidateAccessListWithMembers(ctx context.Context, existingAccessList, accessList *accesslist.AccessList, members []*accesslist.AccessListMember, g AccessListAndMembersGetter) error {
+	if err := validateAccessList(accessList); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := validateAccessListUpdate(existingAccessList, accessList); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := validateAccessListNesting(ctx, accessList, members, g); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// validateAccessList makes sure the given AccessList is valid before storing in the backend.
+func validateAccessList(a *accesslist.AccessList) error {
+	if err := validateType(a.Spec.Type); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if len(a.Spec.Owners) == 0 {
+		return trace.BadParameter("owners are missing")
+	}
+
+	if a.IsReviewable() || a.Spec.Audit.Recurrence.Frequency != 0 {
+		switch a.Spec.Audit.Recurrence.Frequency {
+		case accesslist.OneMonth, accesslist.ThreeMonths, accesslist.SixMonths, accesslist.OneYear:
+		default:
+			return trace.BadParameter("audit recurrence frequency is an invalid value")
+		}
+	}
+
+	if a.IsReviewable() || a.Spec.Audit.Recurrence.DayOfMonth != 0 {
+		switch a.Spec.Audit.Recurrence.DayOfMonth {
+		case accesslist.FirstDayOfMonth, accesslist.FifteenthDayOfMonth, accesslist.LastDayOfMonth:
+		default:
+			return trace.BadParameter("audit recurrence day of month is an invalid value")
+		}
+	}
+
+	if a.IsReviewable() {
+		if a.Spec.Audit.NextAuditDate.IsZero() {
+			return trace.BadParameter("next audit date is not set")
+
+		}
+
+		if a.Spec.Audit.Notifications.Start == 0 {
+			return trace.BadParameter("audit notifications start is not set")
+		}
+	}
+
+	return nil
+}
+
+// validateType validates if access list type is a known value. It deliberately excludes
+// [accesslist.DeprecatedDynamic] as it should be converted to [accesslist.Default] in the
+// [accesslist.AccessList.CheckAndSetDefaults].
+func validateType(t accesslist.Type) error {
+	switch t {
+	case accesslist.Default, accesslist.Static, accesslist.SCIM:
+		return nil
+	default:
+		return trace.BadParameter("unknown access list type %q", t)
+	}
+}
+
+// validateAccessListUpdate checks if the AccessList update is valid. In particular it verifies
+// that immutable fields are not changed. It does nothing if the existingAccessList is nil.
+func validateAccessListUpdate(existingAccessList, accessList *accesslist.AccessList) error {
+	if existingAccessList == nil {
+		return nil
+	}
+	if !accessList.Spec.Type.Equals(existingAccessList.Spec.Type) {
+		return trace.BadParameter("access_list %q type %q cannot be changed to %q",
+			accessList.Metadata.Name, existingAccessList.Spec.Type, accessList.Spec.Type)
+	}
+	return nil
+}
+
+// validateAccessListNesting validates if nested AccessList owners and members meet max depth (of
+// 10) requirement and don't create cycles.
+func validateAccessListNesting(ctx context.Context, accessList *accesslist.AccessList, members []*accesslist.AccessListMember, g AccessListAndMembersGetter) error {
+	for _, owner := range accessList.Spec.Owners {
+		if err := validateAccessListOwner(ctx, accessList, owner, g); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	for _, member := range members {
+		if err := ValidateAccessListMember(ctx, accessList, member, g); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
+// ValidateAccessListMember validates AccessListMember. That includes nested AccessList members
+// validation.
+func ValidateAccessListMember(
+	ctx context.Context,
+	parentList *accesslist.AccessList,
+	member *accesslist.AccessListMember,
+	g AccessListAndMembersGetter,
+) error {
+	if err := validateAccessListMemberBasic(member); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := validateAccessListMemberOrOwnerNesting(ctx, parentList, member.GetName(), RelationshipKindMember, member.Spec.MembershipKind, g); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// validateAccessListMemberBasic performs basic fields validation for AccessListMember.
+func validateAccessListMemberBasic(member *accesslist.AccessListMember) error {
+	if member.Spec.AccessList == "" {
+		return trace.BadParameter("member %s: access_list field empty", member.Metadata.Name)
+	}
+	if member.Spec.Name != member.Metadata.Name {
+		return trace.BadParameter("member metadata name = %q and spec name = %q must be equal", member.Metadata.Name, member.Spec.Name)
+	}
+	if member.Spec.Joined.IsZero() || member.Spec.Joined.Unix() == 0 {
+		return trace.BadParameter("member %s: joined field empty or missing", member.Metadata.Name)
+	}
+	if member.Spec.AddedBy == "" {
+		return trace.BadParameter("member %s: added_by field is empty", member.Metadata.Name)
+	}
+	return nil
+}
+
+// validateAccessListOwner Owner for an AccessList. That includes nested AccessList owners
+// validation.
+func validateAccessListOwner(
+	ctx context.Context,
+	parentList *accesslist.AccessList,
+	owner accesslist.Owner,
+	g AccessListAndMembersGetter,
+) error {
+	if err := validateAccessListMemberOrOwnerNesting(ctx, parentList, owner.Name, RelationshipKindOwner, owner.MembershipKind, g); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func validateAccessListMemberOrOwnerNesting(
+	ctx context.Context,
+	parentList *accesslist.AccessList,
+	memberOrOwnerName string,
+	relationshipKind RelationshipKind,
+	membershipKind string,
+	g AccessListAndMembersGetter,
+) error {
+	if membershipKind != accesslist.MembershipKindList {
+		return nil
+	}
+	// If it is a AccessList member/owner then the referenced AccessList must exist.
+	memberOrOwnerList, err := g.GetAccessList(ctx, memberOrOwnerName)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if err := validateAddition(ctx, parentList, memberOrOwnerList, relationshipKind, g); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func validateAddition(
+	ctx context.Context,
+	parentList *accesslist.AccessList,
+	childList *accesslist.AccessList,
+	kind RelationshipKind,
+	g AccessListAndMembersGetter,
+) error {
+	kindStr := "a Member"
+	if kind == RelationshipKindOwner {
+		kindStr = "an Owner"
+	}
+
+	// Cycle detection
+	reachable, err := isReachable(ctx, childList, parentList, make(map[string]struct{}), g)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if reachable {
+		return trace.BadParameter(
+			"Access List '%s' can't be added as %s of '%s' because '%s' is already included as a Member or Owner in '%s'",
+			childList.Spec.Title, kindStr, parentList.Spec.Title, parentList.Spec.Title, childList.Spec.Title)
+	}
+
+	// Max depth check
+	exceeds, err := exceedsMaxDepth(ctx, parentList, childList, kind, g)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if exceeds {
+		return trace.BadParameter(
+			"Access List '%s' can't be added as %s of '%s' because it would exceed the maximum nesting depth of %d",
+			childList.Spec.Title, kindStr, parentList.Spec.Title, accesslist.MaxAllowedDepth)
+	}
+
+	return nil
+}
+
+func isReachable(
+	ctx context.Context,
+	currentList *accesslist.AccessList,
+	targetList *accesslist.AccessList,
+	visited map[string]struct{},
+	g AccessListAndMembersGetter,
+) (bool, error) {
+	if currentList.GetName() == targetList.GetName() {
+		return true, nil
+	}
+	if _, ok := visited[currentList.GetName()]; ok {
+		return false, nil
+	}
+	visited[currentList.GetName()] = struct{}{}
+
+	// Traverse member lists
+	listMembers, err := fetchMembers(ctx, currentList.GetName(), g)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	for _, member := range listMembers {
+		if member.Spec.MembershipKind == accesslist.MembershipKindList {
+			childList, err := g.GetAccessList(ctx, member.GetName())
+			if err != nil {
+				return false, trace.Wrap(err)
+			}
+			reachable, err := isReachable(ctx, childList, targetList, visited, g)
+			if err != nil {
+				return false, trace.Wrap(err)
+			}
+			if reachable {
+				return true, nil
+			}
+		}
+	}
+
+	// Traverse owner lists
+	for _, owner := range currentList.Spec.Owners {
+		if owner.MembershipKind == accesslist.MembershipKindList {
+			ownerList, err := g.GetAccessList(ctx, owner.Name)
+			if err != nil {
+				return false, trace.Wrap(err)
+			}
+			reachable, err := isReachable(ctx, ownerList, targetList, visited, g)
+			if err != nil {
+				return false, trace.Wrap(err)
+			}
+			if reachable {
+				return true, nil
+			}
+		}
+	}
+
+	return false, nil
+}
+
+func exceedsMaxDepth(
+	ctx context.Context,
+	parentList *accesslist.AccessList,
+	childList *accesslist.AccessList,
+	kind RelationshipKind,
+	g AccessListAndMembersGetter,
+) (bool, error) {
+	switch kind {
+	case RelationshipKindOwner:
+		// For Owners, only consider the depth downwards from the child node
+		depthDownwards, err := maxDepthDownwards(ctx, childList.GetName(), make(map[string]struct{}), g)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		return depthDownwards > accesslist.MaxAllowedDepth, nil
+	default:
+		// For Members, consider the depth upwards from the parent node, downwards from the child node, and the edge between them
+		depthUpwards, err := maxDepthUpwards(ctx, parentList, make(map[string]struct{}), g)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		depthDownwards, err := maxDepthDownwards(ctx, childList.GetName(), make(map[string]struct{}), g)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		totalDepth := depthUpwards + depthDownwards + 1 // +1 for the edge between parent and child
+		return totalDepth > accesslist.MaxAllowedDepth, nil
+	}
+}
diff --git a/lib/accesslists/validate_test.go b/lib/accesslists/validate_test.go
new file mode 100644
index 0000000000000..259f0c223a106
--- /dev/null
+++ b/lib/accesslists/validate_test.go
@@ -0,0 +1,462 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accesslists
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/accesslist"
+)
+
+func TestAccessListHierarchyCircularRefsCheck(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	ctx := context.Background()
+
+	acl1 := newAccessList(t, "1", clock)
+	acl2 := newAccessList(t, "2", clock)
+	acl3 := newAccessList(t, "3", clock)
+
+	// acl1 -> acl2 -> acl3
+	acl1m1 := newAccessListMember(t, acl1.GetName(), acl2.GetName(), accesslist.MembershipKindList, clock)
+	acl2.Status.MemberOf = append(acl2.Status.MemberOf, acl1.GetName())
+	acl2m1 := newAccessListMember(t, acl2.GetName(), acl3.GetName(), accesslist.MembershipKindList, clock)
+	acl3.Status.MemberOf = append(acl3.Status.MemberOf, acl2.GetName())
+
+	// acl3 -> acl1
+	acl3m1 := newAccessListMember(t, acl3.GetName(), acl1.GetName(), accesslist.MembershipKindList, clock)
+
+	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
+		members: map[string][]*accesslist.AccessListMember{
+			acl1.GetName(): {acl1m1},
+			acl2.GetName(): {acl2m1},
+			acl3.GetName(): {},
+		},
+		accessLists: map[string]*accesslist.AccessList{
+			acl1.GetName(): acl1,
+			acl2.GetName(): acl2,
+			acl3.GetName(): acl3,
+		},
+	}
+
+	// Circular references should not be allowed.
+	err := ValidateAccessListMember(ctx, acl3, acl3m1, accessListAndMembersGetter)
+	//err = hierarchy.ValidateAccessListMember(acl3.GetName(), acl3m1)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because '%s' is already included as a Member or Owner in '%s'", acl1.Spec.Title, acl3.Spec.Title, acl3.Spec.Title, acl1.Spec.Title))
+
+	// By removing acl3 as a member of acl2, the relationship should be valid.
+	accessListAndMembersGetter.members[acl2.GetName()] = []*accesslist.AccessListMember{}
+	accessListAndMembersGetter.accessLists[acl3.GetName()].Status.MemberOf = []string{}
+	err = ValidateAccessListMember(ctx, acl3, acl3m1, accessListAndMembersGetter)
+	require.NoError(t, err)
+
+	// Circular references with Ownership should also be disallowed.
+	acl4 := newAccessList(t, "4", clock)
+	acl5 := newAccessList(t, "5", clock)
+
+	// acl4 includes acl5 as a Member
+	acl4m1 := newAccessListMember(t, acl4.GetName(), acl5.GetName(), accesslist.MembershipKindList, clock)
+	acl5.Status.MemberOf = append(acl5.Status.MemberOf, acl4.GetName())
+
+	// acl5 includes acl4 as an Owner.
+	acl5.Spec.Owners = append(acl5.Spec.Owners, accesslist.Owner{
+		Name:           acl4.GetName(),
+		Description:    "asdf",
+		MembershipKind: accesslist.MembershipKindList,
+	})
+	acl4.Status.OwnerOf = append(acl4.Status.OwnerOf, acl5.GetName())
+
+	accessListAndMembersGetter = &mockAccessListAndMembersGetter{
+		members: map[string][]*accesslist.AccessListMember{
+			acl4.GetName(): {acl4m1},
+			acl5.GetName(): {},
+		},
+		accessLists: map[string]*accesslist.AccessList{
+			acl4.GetName(): acl4,
+			acl5.GetName(): acl5,
+		},
+	}
+
+	err = ValidateAccessListWithMembers(ctx, nil, acl5, []*accesslist.AccessListMember{acl4m1}, accessListAndMembersGetter)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as an Owner of '%s' because '%s' is already included as a Member or Owner in '%s'", acl4.Spec.Title, acl5.Spec.Title, acl5.Spec.Title, acl4.Spec.Title))
+}
+
+func TestAccessListHierarchyDepthCheck(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	ctx := context.Background()
+
+	numAcls := accesslist.MaxAllowedDepth + 2 // Extra 2 to test exceeding the max depth
+
+	acls := make([]*accesslist.AccessList, numAcls)
+	for i := range numAcls {
+		acls[i] = newAccessList(t, fmt.Sprintf("acl%d", i+1), clock)
+	}
+
+	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
+		members:     make(map[string][]*accesslist.AccessListMember),
+		accessLists: make(map[string]*accesslist.AccessList),
+	}
+
+	// Create members up to MaxAllowedDepth
+	for i := range accesslist.MaxAllowedDepth {
+		member := newAccessListMember(t, acls[i].GetName(), acls[i+1].GetName(), accesslist.MembershipKindList, clock)
+		acls[i+1].Status.MemberOf = append(acls[i+1].Status.MemberOf, acls[i].GetName())
+		accessListAndMembersGetter.members[acls[i].GetName()] = []*accesslist.AccessListMember{member}
+		accessListAndMembersGetter.accessLists[acls[i].GetName()] = acls[i]
+	}
+	// Set remaining Access Lists' members to empty slices
+	for i := accesslist.MaxAllowedDepth; i < numAcls; i++ {
+		accessListAndMembersGetter.members[acls[i].GetName()] = []*accesslist.AccessListMember{}
+		accessListAndMembersGetter.accessLists[acls[i].GetName()] = acls[i]
+	}
+
+	// Should be valid with existing member < MaxAllowedDepth
+	err := ValidateAccessListMember(ctx, acls[accesslist.MaxAllowedDepth-1], accessListAndMembersGetter.members[acls[accesslist.MaxAllowedDepth-1].GetName()][0], accessListAndMembersGetter)
+	require.NoError(t, err)
+
+	// Now, attempt to add a member that increases the depth beyond MaxAllowedDepth
+	extraMember := newAccessListMember(
+		t,
+		acls[accesslist.MaxAllowedDepth].GetName(),
+		acls[accesslist.MaxAllowedDepth+1].GetName(),
+		accesslist.MembershipKindList,
+		clock,
+	)
+
+	// Validate adding this member should fail due to exceeding max depth
+	err = ValidateAccessListMember(ctx, acls[accesslist.MaxAllowedDepth], extraMember, accessListAndMembersGetter)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", acls[accesslist.MaxAllowedDepth+1].Spec.Title, acls[accesslist.MaxAllowedDepth].Spec.Title, accesslist.MaxAllowedDepth))
+}
+
+func TestAccessListValidateWithMembers_basic(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	t.Run("type is validated", func(t *testing.T) {
+		accessList := newAccessList(t, "test_access_list", clock)
+		accessList.Spec.Type = "test_unknown_type"
+
+		err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+		require.Error(t, err)
+		require.ErrorContains(t, err, `unknown access list type "test_unknown_type"`)
+	})
+
+	for _, typ := range accesslist.AllTypes {
+		t.Run("for type: "+string(typ), func(t *testing.T) {
+			if typ == accesslist.DeprecatedDynamic {
+				t.Skip("DeprecatedDynamic type can be skipped because it's defaulted to Default in CheckAndSetDefaults")
+			}
+
+			t.Run("valid", func(t *testing.T) {
+				accessList := newAccessList(t, "test_access_list", clock)
+
+				err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+				require.NoError(t, err)
+			})
+
+			t.Run("owners are required", func(t *testing.T) {
+				accessList := newAccessList(t, "test_access_list", clock)
+				accessList.Spec.Type = typ
+				accessList.Spec.Owners = []accesslist.Owner{}
+
+				err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+				require.Error(t, err)
+				require.ErrorContains(t, err, "owners")
+			})
+
+			if typ.IsReviewable() {
+				t.Run("audit is required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit = accesslist.Audit{}
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.Error(t, err)
+					require.ErrorContains(t, err, "audit")
+				})
+				t.Run("audit.recurrence.frequency is required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.Frequency = 0
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.Error(t, err)
+					require.ErrorContains(t, err, "audit recurrence frequency")
+				})
+				t.Run("audit.recurrence.day_of_month is required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.DayOfMonth = 0
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.Error(t, err)
+					require.ErrorContains(t, err, "audit recurrence day of month")
+				})
+				t.Run("audit.recurrence.next_audit_date is required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.NextAuditDate = time.Time{}
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.Error(t, err)
+					require.ErrorContains(t, err, "next audit date")
+				})
+				t.Run("audit.notifications.start is required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Notifications.Start = 0
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.Error(t, err)
+					require.ErrorContains(t, err, "audit notifications start")
+				})
+			} else {
+				t.Run("audit is not required", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit = accesslist.Audit{}
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.NoError(t, err)
+				})
+				t.Run("audit can be set", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.NoError(t, err)
+				})
+				t.Run("audit can be partially set", func(t *testing.T) {
+					accessList := newAccessList(t, "test_access_list", clock)
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit = accesslist.Audit{}
+					accessList.Spec.Audit.Recurrence.DayOfMonth = accesslist.FifteenthDayOfMonth
+					accessList.Spec.Audit.Notifications.Start = 3 * time.Hour
+
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, &mockAccessListAndMembersGetter{})
+					require.NoError(t, err)
+				})
+			}
+		})
+	}
+
+}
+
+func TestAccessListValidateWithMembers_members(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	// We're creating a hierarchy with a depth of 10, and then trying to add it as a Member of a 'root' Access List. This should fail.
+	rootAcl := newAccessList(t, "root", clock)
+	nestedAcls := make([]*accesslist.AccessList, 0, accesslist.MaxAllowedDepth)
+	for i := range accesslist.MaxAllowedDepth + 1 {
+		acl := newAccessList(t, fmt.Sprintf("acl-%d", i), clock)
+		nestedAcls = append(nestedAcls, acl)
+	}
+	rootAclMember := newAccessListMember(t, rootAcl.GetName(), nestedAcls[0].GetName(), accesslist.MembershipKindList, clock)
+	members := make([]*accesslist.AccessListMember, 0, accesslist.MaxAllowedDepth-1)
+	for i := range accesslist.MaxAllowedDepth {
+		member := newAccessListMember(t, nestedAcls[i].GetName(), nestedAcls[i+1].GetName(), accesslist.MembershipKindList, clock)
+		nestedAcls[i+1].Status.MemberOf = append(nestedAcls[i+1].Status.MemberOf, nestedAcls[i].GetName())
+		members = append(members, member)
+	}
+
+	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
+		members: map[string][]*accesslist.AccessListMember{
+			rootAcl.GetName(): {},
+		},
+		accessLists: map[string]*accesslist.AccessList{
+			rootAcl.GetName(): rootAcl,
+		},
+	}
+	for i := range accesslist.MaxAllowedDepth + 1 {
+		if i < accesslist.MaxAllowedDepth {
+			accessListAndMembersGetter.members[nestedAcls[i].GetName()] = []*accesslist.AccessListMember{members[i]}
+		}
+		accessListAndMembersGetter.accessLists[nestedAcls[i].GetName()] = nestedAcls[i]
+	}
+
+	// Should validate successfully, as acl-0 -> acl-10 is a valid hierarchy of depth 10.
+	err := ValidateAccessListWithMembers(ctx, nil, rootAcl, []*accesslist.AccessListMember{}, accessListAndMembersGetter)
+	require.NoError(t, err)
+	err = ValidateAccessListWithMembers(ctx, nil, nestedAcls[0], []*accesslist.AccessListMember{accessListAndMembersGetter.members[nestedAcls[0].GetName()][0]}, accessListAndMembersGetter)
+	require.NoError(t, err)
+
+	// Calling `ValidateAccessListWithMembers`, with `rootAclm1`, should fail, as it would exceed the maximum nesting depth.
+	err = ValidateAccessListWithMembers(ctx, nil, rootAcl, []*accesslist.AccessListMember{rootAclMember}, accessListAndMembersGetter)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", nestedAcls[0].Spec.Title, rootAcl.Spec.Title, accesslist.MaxAllowedDepth))
+
+	const Length = accesslist.MaxAllowedDepth/2 + 1
+
+	// Next, we're creating two separate hierarchies, each with a depth of `MaxAllowedDepth/2`. When testing the validation, we'll try to connect the two hierarchies, which should fail.
+	nestedAcls1 := make([]*accesslist.AccessList, 0, Length)
+	for i := 0; i <= Length; i++ {
+		acl := newAccessList(t, fmt.Sprintf("acl1-%d", i), clock)
+		nestedAcls1 = append(nestedAcls1, acl)
+	}
+
+	// Create the second hierarchy.
+	nestedAcls2 := make([]*accesslist.AccessList, 0, Length)
+	for i := 0; i <= Length; i++ {
+		acl := newAccessList(t, fmt.Sprintf("acl2-%d", i), clock)
+		nestedAcls2 = append(nestedAcls2, acl)
+	}
+
+	accessListAndMembersGetter = &mockAccessListAndMembersGetter{
+		members:     map[string][]*accesslist.AccessListMember{},
+		accessLists: map[string]*accesslist.AccessList{},
+	}
+
+	// Create the members for the first hierarchy.
+	for i := range Length {
+		member := newAccessListMember(t, nestedAcls1[i].GetName(), nestedAcls1[i+1].GetName(), accesslist.MembershipKindList, clock)
+		nestedAcls1[i+1].Status.MemberOf = append(nestedAcls1[i+1].Status.MemberOf, nestedAcls1[i].GetName())
+		accessListAndMembersGetter.members[nestedAcls1[i].GetName()] = []*accesslist.AccessListMember{member}
+		accessListAndMembersGetter.accessLists[nestedAcls1[i].GetName()] = nestedAcls1[i]
+	}
+
+	// Create the members for the second hierarchy.
+	for i := range Length {
+		member := newAccessListMember(t, nestedAcls2[i].GetName(), nestedAcls2[i+1].GetName(), accesslist.MembershipKindList, clock)
+		nestedAcls2[i+1].Status.MemberOf = append(nestedAcls2[i+1].Status.MemberOf, nestedAcls2[i].GetName())
+		accessListAndMembersGetter.members[nestedAcls2[i].GetName()] = []*accesslist.AccessListMember{member}
+		accessListAndMembersGetter.accessLists[nestedAcls2[i].GetName()] = nestedAcls2[i]
+	}
+
+	// For the first hierarchy
+	nestedAcls1Last := nestedAcls1[len(nestedAcls1)-1]
+	accessListAndMembersGetter.accessLists[nestedAcls1Last.GetName()] = nestedAcls1Last
+
+	// For the second hierarchy
+	nestedAcls2Last := nestedAcls2[len(nestedAcls2)-1]
+	accessListAndMembersGetter.accessLists[nestedAcls2Last.GetName()] = nestedAcls2Last
+
+	// Should validate successfully when adding another list, as both hierarchies are valid.
+	err = ValidateAccessListWithMembers(ctx, nil, nestedAcls1Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls1Last.GetName(), nestedAcls2Last.GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
+	require.NoError(t, err)
+	err = ValidateAccessListWithMembers(ctx, nil, nestedAcls2Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls2Last.GetName(), nestedAcls1Last.GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
+	require.NoError(t, err)
+
+	// Now, we'll try to connect the two hierarchies, which should fail.
+	err = ValidateAccessListWithMembers(ctx, nil, nestedAcls1Last, []*accesslist.AccessListMember{newAccessListMember(t, nestedAcls1Last.GetName(), nestedAcls2[0].GetName(), accesslist.MembershipKindList, clock)}, accessListAndMembersGetter)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.BadParameter("Access List '%s' can't be added as a Member of '%s' because it would exceed the maximum nesting depth of %d", nestedAcls2[0].Spec.Title, nestedAcls1[len(nestedAcls1)-1].Spec.Title, accesslist.MaxAllowedDepth))
+}
+
+func Test_ValidateAccessListWithMembers_audit(t *testing.T) {
+	ctx := context.Background()
+
+	accessListName := "test_list"
+	var accessList *accesslist.AccessList
+
+	accessListAndMembersGetter := &mockAccessListAndMembersGetter{
+		members: map[string][]*accesslist.AccessListMember{},
+		accessLists: map[string]*accesslist.AccessList{
+			accessListName: accessList,
+		},
+	}
+
+	t.Run("audit frequency", func(t *testing.T) {
+		accessList = newAccessList(t, accessListName, clockwork.NewFakeClockAt(time.Now()))
+		t.Run("must be non-zero for reviewable access lists", func(t *testing.T) {
+			for _, typ := range []accesslist.Type{accesslist.Default} {
+				t.Run(string(typ), func(t *testing.T) {
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.Frequency = 0
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.ErrorContains(t, err, "frequency")
+				})
+			}
+		})
+		t.Run("can be zero for non-reviewable access lists", func(t *testing.T) {
+			for _, typ := range []accesslist.Type{accesslist.SCIM, accesslist.Static} {
+				t.Run(string(typ), func(t *testing.T) {
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.Frequency = 0
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.NoError(t, err)
+				})
+			}
+		})
+
+		t.Run("if set must be a valid value for all access list types", func(t *testing.T) {
+			for _, typ := range accesslist.AllTypes {
+				t.Run(string(typ), func(t *testing.T) {
+					if typ == accesslist.DeprecatedDynamic {
+						t.Skip("deprecated dynamic type is not handled here as it's supposed to be changed in CheckAndSetDefaults; see [validateType]")
+					}
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.Frequency = 399
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.ErrorContains(t, err, "frequency")
+				})
+			}
+		})
+	})
+
+	t.Run("audit day_of_month", func(t *testing.T) {
+		accessList = newAccessList(t, accessListName, clockwork.NewFakeClockAt(time.Now()))
+		t.Run("must be non-zero for reviewable access lists", func(t *testing.T) {
+			for _, typ := range []accesslist.Type{accesslist.Default} {
+				t.Run(string(typ), func(t *testing.T) {
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.DayOfMonth = 0
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.ErrorContains(t, err, "day of month")
+				})
+			}
+		})
+		t.Run("can be zero for non-reviewable access lists", func(t *testing.T) {
+			for _, typ := range []accesslist.Type{accesslist.SCIM, accesslist.Static} {
+				t.Run(string(typ), func(t *testing.T) {
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.DayOfMonth = 0
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.NoError(t, err)
+				})
+			}
+		})
+
+		t.Run("if set must be a valid value for all access list types", func(t *testing.T) {
+			for _, typ := range accesslist.AllTypes {
+				t.Run(string(typ), func(t *testing.T) {
+					if typ == accesslist.DeprecatedDynamic {
+						t.Skip("deprecated dynamic type is not handled here as it's supposed to be changed in CheckAndSetDefaults; see [validateType]")
+					}
+					accessList.Spec.Type = typ
+					accessList.Spec.Audit.Recurrence.DayOfMonth = 40
+					err := ValidateAccessListWithMembers(ctx, nil, accessList, nil, accessListAndMembersGetter)
+					require.ErrorContains(t, err, "day of month")
+				})
+			}
+		})
+	})
+}
diff --git a/lib/accessmonitoring/access_monitoring_rule.go b/lib/accessmonitoring/access_monitoring_rule.go
new file mode 100644
index 0000000000000..a0044f5bfab76
--- /dev/null
+++ b/lib/accessmonitoring/access_monitoring_rule.go
@@ -0,0 +1,63 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accessmonitoring
+
+import (
+	"context"
+	"log/slog"
+
+	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+)
+
+// EvaluateRules evalutes the rules againast the request environment and
+// returns the list of rules that match the conditions.
+func EvaluateRules(
+	ctx context.Context,
+	log *slog.Logger,
+	env AccessRequestExpressionEnv,
+	rules []*accessmonitoringrulesv1.AccessMonitoringRule,
+) []*accessmonitoringrulesv1.AccessMonitoringRule {
+	var matchingRules []*accessmonitoringrulesv1.AccessMonitoringRule
+	for _, rule := range rules {
+		log = log.With("rule", rule.GetMetadata().GetName())
+
+		// Check if creation time is within rule schedules.
+		schedule := rule.GetSpec().GetSchedules()
+		isInSchedules, err := InSchedules(schedule, env.CreationTime)
+		if err != nil {
+			log.WarnContext(ctx, "Failed to evaluate access monitoring rule schedules", "error", err)
+			continue
+		}
+		if len(schedule) != 0 && !isInSchedules {
+			log.DebugContext(ctx, "Access request does not satisfy schedule condition")
+			continue
+		}
+
+		// Check if environment matches rule conditions.
+		conditionMatch, err := EvaluateCondition(rule.GetSpec().GetCondition(), env)
+		if err != nil {
+			log.WarnContext(ctx, "Failed to evaluate access monitoring rule condition", "error", err)
+			continue
+		}
+		if conditionMatch {
+			matchingRules = append(matchingRules, rule)
+		}
+	}
+	return matchingRules
+}
diff --git a/lib/accessmonitoring/access_monitoring_rule_test.go b/lib/accessmonitoring/access_monitoring_rule_test.go
new file mode 100644
index 0000000000000..24ba82b1c1eb0
--- /dev/null
+++ b/lib/accessmonitoring/access_monitoring_rule_test.go
@@ -0,0 +1,128 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package accessmonitoring
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+// TestEvaluateRules verifies proper rules validation.
+func TestEvaluateRules(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
+	t.Cleanup(cancel)
+
+	tests := []struct {
+		description string
+		env         AccessRequestExpressionEnv
+		rules       []*accessmonitoringrulesv1.AccessMonitoringRule
+		expected    []string
+	}{
+		{
+			description: "condition and schedule match 1 rule",
+			env: AccessRequestExpressionEnv{
+				CreationTime: time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC),
+			},
+			rules: []*accessmonitoringrulesv1.AccessMonitoringRule{
+				makeRule("test-rule", "true", time.Monday, "14:00", "15:00"),
+			},
+			expected: []string{"test-rule"},
+		},
+		{
+			description: "condition and schedule match multiple rules",
+			env: AccessRequestExpressionEnv{
+				CreationTime: time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC),
+			},
+			rules: []*accessmonitoringrulesv1.AccessMonitoringRule{
+				makeRule("test-rule-1", "true", time.Monday, "14:00", "15:00"),
+				makeRule("test-rule-2", "true", time.Monday, "14:00", "15:00"),
+			},
+			expected: []string{"test-rule-1", "test-rule-2"},
+		},
+		{
+			description: "condition does not match",
+			env: AccessRequestExpressionEnv{
+				CreationTime: time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC),
+			},
+			rules: []*accessmonitoringrulesv1.AccessMonitoringRule{
+				makeRule("test-rule-1", "false", time.Monday, "14:00", "15:00"),
+			},
+			expected: []string{},
+		},
+		{
+			description: "schedule does not match",
+			env: AccessRequestExpressionEnv{
+				CreationTime: time.Date(2025, time.August, 11, 15, 30, 0, 0, time.UTC),
+			},
+			rules: []*accessmonitoringrulesv1.AccessMonitoringRule{
+				makeRule("test-rule-1", "true", time.Monday, "14:00", "15:00"),
+			},
+			expected: []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			t.Parallel()
+
+			rules := EvaluateRules(ctx, logtest.NewLogger(), test.env, test.rules)
+			require.Len(t, rules, len(test.expected))
+			for _, rule := range rules {
+				require.Contains(t, test.expected, rule.Metadata.GetName())
+			}
+		})
+	}
+}
+
+func makeRule(
+	name, condition string,
+	weekday time.Weekday,
+	start, end string,
+) *accessmonitoringrulesv1.AccessMonitoringRule {
+	return &accessmonitoringrulesv1.AccessMonitoringRule{
+		Kind:    types.KindAccessMonitoringRule,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+		},
+		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			Subjects:  []string{types.KindAccessRequest},
+			Condition: condition,
+			Schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{{
+							Weekday: weekday.String(),
+							Start:   start,
+							End:     end,
+						}},
+					},
+				},
+			},
+		},
+	}
+}
diff --git a/lib/accessmonitoring/request_mapping.go b/lib/accessmonitoring/request_mapping.go
index f03e42052149e..cc163e196f091 100644
--- a/lib/accessmonitoring/request_mapping.go
+++ b/lib/accessmonitoring/request_mapping.go
@@ -17,10 +17,13 @@ limitations under the License.
 package accessmonitoring
 
 import (
+	"slices"
 	"time"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/trait"
 	"github.com/gravitational/teleport/lib/expression"
 	"github.com/gravitational/teleport/lib/utils/typical"
 )
@@ -30,6 +33,7 @@ import (
 type AccessRequestExpressionEnv struct {
 	Roles              []string
 	SuggestedReviewers []string
+	RequestedResources []types.ResourceWithLabels
 	Annotations        map[string][]string
 	User               string
 	RequestReason      string
@@ -38,7 +42,27 @@ type AccessRequestExpressionEnv struct {
 
 	// UserTraits includes arbitrary user traits dynamically provided by the
 	// access monitoring rule handler.
-	UserTraits map[string][]string
+	UserTraits trait.Traits
+}
+
+// NewAccessRequestExpressionEnv constructs an AccessRequestExpressionEnv from
+// the provided request and additional fields.
+func NewAccessRequestExpressionEnv(
+	req types.AccessRequest,
+	userTraits trait.Traits,
+	requestedResources []types.ResourceWithLabels,
+) AccessRequestExpressionEnv {
+	return AccessRequestExpressionEnv{
+		Roles:              req.GetRoles(),
+		RequestedResources: requestedResources,
+		SuggestedReviewers: req.GetSuggestedReviewers(),
+		Annotations:        req.GetSystemAnnotations(),
+		User:               req.GetUser(),
+		RequestReason:      req.GetRequestReason(),
+		CreationTime:       req.GetCreationTime(),
+		Expiry:             req.Expiry(),
+		UserTraits:         userTraits,
+	}
 }
 
 type accessRequestExpression typical.Expression[AccessRequestExpressionEnv, any]
@@ -87,10 +111,45 @@ func newRequestConditionParser() (*typical.Parser[AccessRequestExpressionEnv, an
 			return env.Expiry, nil
 		}),
 
+		"access_request.spec.resource_labels_union": typical.DynamicMap(func(env AccessRequestExpressionEnv) (expression.Dict, error) {
+			union := make(map[string][]string)
+			for _, resource := range env.RequestedResources {
+				for k, v := range resource.GetAllLabels() {
+					union[k] = append(union[k], v)
+				}
+			}
+			return expression.DictFromStringSliceMap(union), nil
+		}),
+		"access_request.spec.resource_labels_intersection": typical.DynamicMap(func(env AccessRequestExpressionEnv) (expression.Dict, error) {
+			if len(env.RequestedResources) == 0 {
+				return expression.Dict{}, nil
+			}
+
+			intersection := make(map[string][]string)
+
+			// Get first resource labels.
+			labels := env.RequestedResources[0].GetAllLabels()
+			for k, v := range labels {
+				intersection[k] = append(intersection[k], v)
+			}
+
+			// Remove non-intersecting labels.
+			for _, resource := range env.RequestedResources {
+				labels := resource.GetAllLabels()
+				for k, v := range intersection {
+					if label, ok := labels[k]; !ok || !slices.Contains(v, label) {
+						delete(intersection, k)
+					}
+				}
+			}
+			return expression.DictFromStringSliceMap(intersection), nil
+		}),
+
 		"user.traits": typical.DynamicMap(func(env AccessRequestExpressionEnv) (expression.Dict, error) {
 			return expression.DictFromStringSliceMap(env.UserTraits), nil
 		}),
 	}
+
 	defParserSpec := expression.DefaultParserSpec[AccessRequestExpressionEnv]()
 	defParserSpec.Variables = typicalEnvVar
 
diff --git a/lib/accessmonitoring/request_mapping_test.go b/lib/accessmonitoring/request_mapping_test.go
index d2a0fb0fc796d..20d7aff759092 100644
--- a/lib/accessmonitoring/request_mapping_test.go
+++ b/lib/accessmonitoring/request_mapping_test.go
@@ -22,6 +22,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
 )
 
 func TestEvaluateCondition(t *testing.T) {
@@ -54,9 +56,9 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "matches all user traits",
 			condition: `
-				contains_any(user.traits["level"], set("L1", "L2")) &&
-				contains_any(user.traits["team"], set("Cloud")) &&
-				contains_any(user.traits["location"], set("Seattle"))`,
+                contains_any(user.traits["level"], set("L1", "L2")) &&
+                contains_any(user.traits["team"], set("Cloud")) &&
+                contains_any(user.traits["location"], set("Seattle"))`,
 			env: AccessRequestExpressionEnv{
 				UserTraits: map[string][]string{
 					"level":    {"L1"},
@@ -69,9 +71,9 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "matches some user traits",
 			condition: `
-				contains_any(user.traits["level"], set("L1", "L2")) &&
-				contains_any(user.traits["team"], set("Cloud")) &&
-				contains_any(user.traits["location"], set("Seattle"))`,
+                contains_any(user.traits["level"], set("L1", "L2")) &&
+                contains_any(user.traits["team"], set("Cloud")) &&
+                contains_any(user.traits["location"], set("Seattle"))`,
 			env: AccessRequestExpressionEnv{
 				UserTraits: map[string][]string{
 					"level":    {"L1"},
@@ -84,8 +86,8 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "match at least one role",
 			condition: `
-				contains_any(access_request.spec.roles, set("dev")) &&
-				access_request.spec.roles.contains_any(set("dev"))`,
+                contains_any(access_request.spec.roles, set("dev")) &&
+                access_request.spec.roles.contains_any(set("dev"))`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{"dev", "stage", "prod"},
 			},
@@ -94,8 +96,8 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "does not match any role",
 			condition: `
-				contains_any(access_request.spec.roles, set("no-match")) ||
-				access_request.spec.roles.contains_any(set("no-match"))`,
+                contains_any(access_request.spec.roles, set("no-match")) ||
+                access_request.spec.roles.contains_any(set("no-match"))`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{"dev", "stage", "prod"},
 			},
@@ -104,8 +106,8 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "matches all requested roles",
 			condition: `
-				contains_all(set("dev", "stage", "prod"), access_request.spec.roles) &&
-				set("dev", "stage", "prod").contains_all(access_request.spec.roles)`,
+                contains_all(set("dev", "stage", "prod"), access_request.spec.roles) &&
+                set("dev", "stage", "prod").contains_all(access_request.spec.roles)`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{"dev", "stage", "prod"},
 			},
@@ -114,8 +116,8 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "does not match all requested roles",
 			condition: `
-				contains_all(set("dev"), access_request.spec.roles) ||
-				set("dev").contains_all(access_request.spec.roles)`,
+                contains_all(set("dev"), access_request.spec.roles) ||
+                set("dev").contains_all(access_request.spec.roles)`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{"dev", "stage", "prod"},
 			},
@@ -124,8 +126,8 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "requested roles is empty",
 			condition: `
-				contains_all(set("dev"), access_request.spec.roles) ||
-				set("dev").contains_all(access_request.spec.roles)`,
+                contains_all(set("dev"), access_request.spec.roles) ||
+                set("dev").contains_all(access_request.spec.roles)`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{},
 			},
@@ -134,13 +136,175 @@ func TestEvaluateCondition(t *testing.T) {
 		{
 			description: "both sets are empty",
 			condition: `
-				contains_all(set(), access_request.spec.roles) ||
-				set().contains_all(access_request.spec.roles)`,
+                contains_all(set(), access_request.spec.roles) ||
+                set().contains_all(access_request.spec.roles)`,
 			env: AccessRequestExpressionEnv{
 				Roles: []string{},
 			},
 			match: false,
 		},
+		{
+			description: "(union) single resource has label",
+			condition: `
+                access_request.spec.resource_labels_union["env"].
+                    contains("test")`,
+			env: AccessRequestExpressionEnv{
+				RequestedResources: []types.ResourceWithLabels{
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(union) multiple resources have label",
+			condition: `
+                access_request.spec.resource_labels_union["env"].
+                    contains_all(set("test", "dev"))`,
+			env: AccessRequestExpressionEnv{
+				RequestedResources: []types.ResourceWithLabels{
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "dev"},
+						},
+					},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(intersection) single resource has label",
+			condition: `
+                access_request.spec.resource_labels_intersection["env"].
+                    contains("test")`,
+			env: AccessRequestExpressionEnv{
+				RequestedResources: []types.ResourceWithLabels{
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(intersection) multiple resources have label",
+			condition: `
+                access_request.spec.resource_labels_intersection["env"].
+                    contains("test")`,
+			env: AccessRequestExpressionEnv{
+				RequestedResources: []types.ResourceWithLabels{
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(intersection) multiple resource labels do not intersect",
+			condition: `
+                access_request.spec.resource_labels_intersection["env"].
+                    contains("test")`,
+			env: AccessRequestExpressionEnv{
+				RequestedResources: []types.ResourceWithLabels{
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "test"},
+						},
+					},
+					&types.ServerV2{
+						Metadata: types.Metadata{
+							Labels: map[string]string{"env": "dev"},
+						},
+					},
+				},
+			},
+			match: false,
+		},
+		{
+			description: "(regexp.match) matches one of user 'level' trait",
+			condition:   `regexp.match(user.traits["level"], "^(L1|L2)$")`,
+			env: AccessRequestExpressionEnv{
+				UserTraits: map[string][]string{
+					"level": {"L1"},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(regexp.match) does not match user 'level' trait",
+			condition:   `regexp.match(user.traits["level"], "^L1$")`,
+			env: AccessRequestExpressionEnv{
+				UserTraits: map[string][]string{
+					"level": {"L2"},
+				},
+			},
+			match: false,
+		},
+		{
+			description: "(regexp.match) matches a user's teams",
+			condition: `
+		        regexp.match(user.traits["teams"], "^Cloud$")`,
+			env: AccessRequestExpressionEnv{
+				UserTraits: map[string][]string{
+					"teams": {"Tools", "Cloud"},
+				},
+			},
+			match: true,
+		},
+		{
+			description: "(regexp.match) matches request reason",
+			condition: `
+                regexp.match(set(access_request.spec.request_reason), "*I am on-call*")`,
+			env: AccessRequestExpressionEnv{
+				RequestReason: "Reference: ___. I am on-call!",
+			},
+			match: true,
+		},
+		{
+			description: "(==) matches user",
+			condition: `
+                access_request.spec.user == "example_user"`,
+			env: AccessRequestExpressionEnv{
+				User: "example_user",
+			},
+			match: true,
+		},
+		{
+			description: "(!=) does not match user",
+			condition: `
+                access_request.spec.user != "example_user"`,
+			env: AccessRequestExpressionEnv{
+				User: "example_user",
+			},
+			match: false,
+		},
+		{
+			description: "(is_empty) request contains at least one role",
+			condition: `
+				!is_empty(access_request.spec.roles)`,
+			env: AccessRequestExpressionEnv{
+				Roles: []string{"dev"},
+			},
+			match: true,
+		},
 	}
 
 	for _, test := range tests {
diff --git a/lib/accessmonitoring/review/review.go b/lib/accessmonitoring/review/review.go
index 269fa1f580899..5192caaf24722 100644
--- a/lib/accessmonitoring/review/review.go
+++ b/lib/accessmonitoring/review/review.go
@@ -29,9 +29,12 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/accessrequest"
+	"github.com/gravitational/teleport/api/client"
 	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/accessmonitoring"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // Client aggregates the parts of Teleport API client interface
@@ -40,7 +43,8 @@ import (
 type Client interface {
 	SubmitAccessReview(ctx context.Context, params types.AccessReviewSubmission) (types.AccessRequest, error)
 	ListAccessMonitoringRulesWithFilter(ctx context.Context, req *accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest) ([]*accessmonitoringrulesv1.AccessMonitoringRule, string, error)
-	GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error)
+	client.ListResourcesClient
+	services.UserOrLoginStateGetter
 }
 
 // Config specifies access review handler configuration.
@@ -190,18 +194,11 @@ func (handler *Handler) onPendingRequest(ctx context.Context, req types.AccessRe
 		"req_id", req.GetName(),
 		"user", req.GetUser())
 
-	// Automatic reviews are only supported with role requests.
-	if len(req.GetRequestedResourceIDs()) > 0 {
-		return trace.BadParameter("cannot automatically review access requests for resources other than 'roles'")
-	}
-
-	const withSecretsFalse = false
-	user, err := handler.Client.GetUser(ctx, req.GetUser(), withSecretsFalse)
+	env, err := handler.newExpressionEnv(ctx, req)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	env := getAccessRequestExpressionEnv(req, user.GetTraits())
 	reviewRule := handler.getMatchingRule(ctx, env)
 	if reviewRule == nil {
 		// This access request does not match any access monitoring rules.
@@ -211,7 +208,9 @@ func (handler *Handler) onPendingRequest(ctx context.Context, req types.AccessRe
 	review, err := newAccessReview(
 		req.GetUser(),
 		reviewRule.GetMetadata().GetName(),
-		reviewRule.GetSpec().GetAutomaticReview().GetDecision())
+		reviewRule.GetSpec().GetAutomaticReview().GetDecision(),
+		time.Now(),
+	)
 	if err != nil {
 		return trace.Wrap(err, "failed to create new access review")
 	}
@@ -241,21 +240,8 @@ func (handler *Handler) getMatchingRule(
 	env accessmonitoring.AccessRequestExpressionEnv,
 ) *accessmonitoringrulesv1.AccessMonitoringRule {
 	var reviewRule *accessmonitoringrulesv1.AccessMonitoringRule
-
-	for _, rule := range handler.rules.Get() {
-		conditionMatch, err := accessmonitoring.EvaluateCondition(rule.GetSpec().GetCondition(), env)
-		if err != nil {
-			handler.Logger.WarnContext(ctx, "Failed to evaluate access monitoring rule",
-				"error", err,
-				"rule", rule.GetMetadata().GetName(),
-			)
-			continue
-		}
-
-		if !conditionMatch {
-			continue
-		}
-
+	matchingRules := accessmonitoring.EvaluateRules(ctx, handler.Logger, env, handler.rules.Get())
+	for _, rule := range matchingRules {
 		if rule.GetSpec().GetAutomaticReview().GetDecision() == types.RequestState_DENIED.String() {
 			return rule
 		}
@@ -267,7 +253,7 @@ func (handler *Handler) getMatchingRule(
 	return reviewRule
 }
 
-func newAccessReview(userName, ruleName, state string) (types.AccessReview, error) {
+func newAccessReview(userName, ruleName, state string, created time.Time) (types.AccessReview, error) {
 	var proposedState types.RequestState
 	switch state {
 	case types.RequestState_APPROVED.String():
@@ -284,7 +270,7 @@ func newAccessReview(userName, ruleName, state string) (types.AccessReview, erro
 		Reason: fmt.Sprintf("Access request has been automatically %[4]s by %[1]q. "+
 			"User %[2]q is %[4]s by access_monitoring_rule %[3]q.",
 			teleport.SystemAccessApproverUserName, userName, ruleName, strings.ToLower(state)),
-		Created: time.Now(),
+		Created: created,
 	}, nil
 }
 
@@ -296,16 +282,16 @@ func isAlreadyReviewedError(err error) bool {
 	return trace.IsAlreadyExists(err) || strings.HasSuffix(err.Error(), "has already reviewed this request")
 }
 
-// getAccessRequestExpressionEnv returns the expression env of the access request.
-func getAccessRequestExpressionEnv(req types.AccessRequest, traits map[string][]string) accessmonitoring.AccessRequestExpressionEnv {
-	return accessmonitoring.AccessRequestExpressionEnv{
-		Roles:              req.GetRoles(),
-		SuggestedReviewers: req.GetSuggestedReviewers(),
-		Annotations:        req.GetSystemAnnotations(),
-		User:               req.GetUser(),
-		RequestReason:      req.GetRequestReason(),
-		CreationTime:       req.GetCreationTime(),
-		Expiry:             req.Expiry(),
-		UserTraits:         traits,
+func (handler *Handler) newExpressionEnv(ctx context.Context, req types.AccessRequest) (accessmonitoring.AccessRequestExpressionEnv, error) {
+	userState, err := services.GetUserOrLoginState(ctx, handler.Client, req.GetUser())
+	if err != nil {
+		return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
+	}
+
+	requestedResources, err := accessrequest.GetResourcesByResourceIDs(ctx, handler.Client, req.GetRequestedResourceIDs())
+	if err != nil {
+		return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
 	}
+
+	return accessmonitoring.NewAccessRequestExpressionEnv(req, userState.GetTraits(), requestedResources), nil
 }
diff --git a/lib/accessmonitoring/review/review_test.go b/lib/accessmonitoring/review/review_test.go
index 95748581c467e..4274cb0414136 100644
--- a/lib/accessmonitoring/review/review_test.go
+++ b/lib/accessmonitoring/review/review_test.go
@@ -30,9 +30,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 
+	pb "github.com/gravitational/teleport/api/client/proto"
 	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/types/trait"
+	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/lib/accessmonitoring"
 )
 
@@ -148,7 +152,6 @@ func TestConflictingRules(t *testing.T) {
 	t.Cleanup(cancel)
 
 	testReqID := uuid.New().String()
-	withSecretsFalse := false
 	requesterUserName := "requester"
 	approvedRule := newApprovedRule("approved-rule", "true")
 	deniedRule := newDeniedRule("denied-rule", "true")
@@ -160,19 +163,23 @@ func TestConflictingRules(t *testing.T) {
 		deniedRule,
 	})
 
-	requester, err := types.NewUser(requesterUserName)
+	userLoginState, err := userloginstate.New(
+		header.Metadata{Name: requesterUserName},
+		userloginstate.Spec{},
+	)
 	require.NoError(t, err)
 
 	client := &mockClient{}
-	client.On("GetUser", mock.Anything, requesterUserName, withSecretsFalse).
-		Return(requester, nil)
+	client.On("GetUserLoginState", mock.Anything, requesterUserName).
+		Return(userLoginState, nil)
 
 	review, err := newAccessReview(
 		requesterUserName,
 		deniedRule.GetMetadata().GetName(),
-		deniedRule.GetSpec().GetAutomaticReview().GetDecision())
+		deniedRule.GetSpec().GetAutomaticReview().GetDecision(),
+		time.Time{},
+	)
 	require.NoError(t, err)
-	review.Created = time.Time{}
 
 	client.On("SubmitAccessReview", mock.Anything, types.AccessReviewSubmission{
 		RequestID: testReqID,
@@ -196,44 +203,252 @@ func TestConflictingRules(t *testing.T) {
 	require.NoError(t, handler.HandleAccessRequest(ctx, event))
 }
 
-func TestResourceRequest(t *testing.T) {
+func TestScheduleRequest(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
 	t.Cleanup(cancel)
 
 	testReqID := uuid.New().String()
-	withSecretsFalse := false
+	testRuleName := "test-rule"
 	requesterUserName := "requester"
 
+	userLoginState, err := userloginstate.New(
+		header.Metadata{Name: requesterUserName},
+		userloginstate.Spec{},
+	)
+	require.NoError(t, err)
+
+	testRule := newApprovedRule(
+		testRuleName,
+		`true`)
+
+	testRule.Spec.Schedules = map[string]*accessmonitoringrulesv1.Schedule{
+		"test-schedule": {
+			Time: &accessmonitoringrulesv1.TimeSchedule{
+				Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+					{
+						Weekday: time.Monday.String(),
+						Start:   "14:00",
+						End:     "15:00",
+					},
+				},
+			},
+		},
+	}
+
 	cache := accessmonitoring.NewCache()
-	cache.Put([]*accessmonitoringrulesv1.AccessMonitoringRule{
-		newApprovedRule("approved-rule", "true"),
-	})
+	cache.Put([]*accessmonitoringrulesv1.AccessMonitoringRule{testRule})
 
-	requester, err := types.NewUser(requesterUserName)
-	require.NoError(t, err)
+	tests := []struct {
+		description  string
+		setupMock    func(m *mockClient)
+		creationTime time.Time
+		assertErr    require.ErrorAssertionFunc
+	}{
+		{
+			description: "test within schedule",
+			setupMock: func(m *mockClient) {
+				m.On("GetUserLoginState", mock.Anything, requesterUserName).
+					Return(userLoginState, nil)
+
+				review, err := newAccessReview(
+					requesterUserName,
+					testRuleName,
+					types.RequestState_APPROVED.String(),
+					time.Time{},
+				)
+				require.NoError(t, err)
 
-	client := &mockClient{}
-	client.On("GetUser", mock.Anything, requesterUserName, withSecretsFalse).
-		Return(requester, nil)
+				m.On("SubmitAccessReview", mock.Anything, types.AccessReviewSubmission{
+					RequestID: testReqID,
+					Review:    review,
+				}).Return(mock.Anything, nil)
+			},
+			creationTime: time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC),
+			assertErr:    require.NoError,
+		},
+		{
+			description: "test outside schedule",
+			setupMock: func(m *mockClient) {
+				m.On("GetUserLoginState", mock.Anything, requesterUserName).
+					Return(userLoginState, nil)
 
-	handler, err := NewHandler(Config{
-		HandlerName: handlerName,
-		Client:      client,
-		Cache:       cache,
-	})
-	require.NoError(t, err)
+				m.AssertNotCalled(t, "SubmitAccessReview")
+			},
+			creationTime: time.Date(2025, time.August, 11, 15, 30, 0, 0, time.UTC),
+			assertErr:    require.NoError,
+		},
+	}
 
-	// Create a request for both a role and node.
-	req, err := types.NewAccessRequest(testReqID, "requester", "role")
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			t.Parallel()
+
+			client := &mockClient{}
+			if test.setupMock != nil {
+				test.setupMock(client)
+			}
+
+			handler, err := NewHandler(Config{
+				HandlerName: handlerName,
+				Client:      client,
+				Cache:       cache,
+			})
+			require.NoError(t, err)
+
+			req, err := types.NewAccessRequest(
+				testReqID,
+				requesterUserName,
+				"role",
+			)
+			require.NoError(t, err)
+			req.SetCreationTime(test.creationTime)
+
+			test.assertErr(t, handler.HandleAccessRequest(ctx, types.Event{
+				Type:     types.OpPut,
+				Resource: req,
+			}))
+			client.AssertExpectations(t)
+		})
+	}
+}
+
+func TestResourceRequest(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
+	t.Cleanup(cancel)
+
+	testReqID := uuid.New().String()
+	testRuleName := "test-rule"
+	requesterUserName := "requester"
+
+	userLoginState, err := userloginstate.New(
+		header.Metadata{Name: requesterUserName},
+		userloginstate.Spec{},
+	)
 	require.NoError(t, err)
-	req.SetRequestedResourceIDs([]types.ResourceID{{Kind: "node"}})
 
-	event := types.Event{
-		Type:     types.OpPut,
-		Resource: req,
+	testRule := newApprovedRule(
+		testRuleName,
+		`access_request.spec.resource_labels_intersection["env"].contains("test")`)
+
+	cache := accessmonitoring.NewCache()
+	cache.Put([]*accessmonitoringrulesv1.AccessMonitoringRule{testRule})
+
+	tests := []struct {
+		description string
+		setupMock   func(m *mockClient)
+		assertErr   require.ErrorAssertionFunc
+	}{
+		{
+			description: "test 0 requested resources",
+			setupMock: func(m *mockClient) {
+				m.On("GetUserLoginState", mock.Anything, requesterUserName).
+					Return(userLoginState, nil)
+
+				m.On("ListResources", mock.Anything, mock.Anything).
+					Return(&types.ListResourcesResponse{
+						Resources:  []types.ResourceWithLabels{},
+						TotalCount: 0,
+					}, nil)
+
+				m.AssertNotCalled(t, "SubmitAccessReview")
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "test !matching resource labels",
+			setupMock: func(m *mockClient) {
+				m.On("GetUserLoginState", mock.Anything, requesterUserName).
+					Return(userLoginState, nil)
+
+				m.On("ListResources", mock.Anything, mock.Anything).
+					Return(&types.ListResourcesResponse{
+						Resources: []types.ResourceWithLabels{
+							&types.ServerV2{
+								Metadata: types.Metadata{
+									Labels: map[string]string{"env": "prod"},
+								},
+							},
+						},
+						TotalCount: 1,
+					}, nil)
+
+				m.AssertNotCalled(t, "SubmitAccessReview")
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "test matching resource labels",
+			setupMock: func(m *mockClient) {
+				m.On("GetUserLoginState", mock.Anything, requesterUserName).
+					Return(userLoginState, nil)
+
+				m.On("ListResources", mock.Anything, mock.Anything).
+					Return(&types.ListResourcesResponse{
+						Resources: []types.ResourceWithLabels{
+							&types.ServerV2{
+								Metadata: types.Metadata{
+									Labels: map[string]string{"env": "test"},
+								},
+							},
+						},
+						TotalCount: 1,
+					}, nil)
+
+				review, err := newAccessReview(
+					requesterUserName,
+					testRuleName,
+					types.RequestState_APPROVED.String(),
+					time.Time{},
+				)
+				require.NoError(t, err)
+
+				m.On("SubmitAccessReview", mock.Anything, types.AccessReviewSubmission{
+					RequestID: testReqID,
+					Review:    review,
+				}).Return(mock.Anything, nil)
+			},
+			assertErr: require.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			t.Parallel()
+
+			client := &mockClient{}
+			if test.setupMock != nil {
+				test.setupMock(client)
+			}
+
+			handler, err := NewHandler(Config{
+				HandlerName: handlerName,
+				Client:      client,
+				Cache:       cache,
+			})
+			require.NoError(t, err)
+
+			req, err := types.NewAccessRequestWithResources(
+				testReqID,
+				requesterUserName,
+				[]string{"role"},
+				[]types.ResourceID{
+					{
+						ClusterName:     "test-cluster",
+						Kind:            types.KindNode,
+						Name:            "test-node",
+						SubResourceName: types.SubKindTeleportNode,
+					},
+				},
+			)
+			require.NoError(t, err)
+
+			test.assertErr(t, handler.HandleAccessRequest(ctx, types.Event{
+				Type:     types.OpPut,
+				Resource: req,
+			}))
+			client.AssertExpectations(t)
+		})
 	}
-	require.ErrorContains(t, handler.HandleAccessRequest(ctx, event),
-		"cannot automatically review access requests for resources other than 'roles")
 }
 
 func TestHandleAccessRequest(t *testing.T) {
@@ -247,8 +462,6 @@ func TestHandleAccessRequest(t *testing.T) {
 		approvedUserTraitVal = "approved-trait-value"
 		approvedRole         = "approved-role"
 		testRuleName         = "test-rule"
-
-		withSecretsFalse = false
 	)
 
 	testReqID := uuid.New().String()
@@ -263,15 +476,22 @@ func TestHandleAccessRequest(t *testing.T) {
 			approvedRole, approvedUserTraitKey, approvedUserTraitVal))
 	cache.Put([]*accessmonitoringrulesv1.AccessMonitoringRule{rule})
 
-	// Setup approved user
-	approvedUser, err := types.NewUser(approvedUserName)
+	// Setup approved user login state
+	approvedUserLoginState, err := userloginstate.New(
+		header.Metadata{Name: approvedUserName},
+		userloginstate.Spec{
+			Traits: trait.Traits{
+				approvedUserTraitKey: {approvedUserTraitVal},
+			},
+		},
+	)
 	require.NoError(t, err)
-	approvedUser.SetTraits(map[string][]string{
-		approvedUserTraitKey: {approvedUserTraitVal},
-	})
 
-	// Setup unapproved user
-	unapprovedUser, err := types.NewUser(unapprovedUserName)
+	// Setup unapproved user login state
+	unapprovedUserLoginState, err := userloginstate.New(
+		header.Metadata{Name: unapprovedUserName},
+		userloginstate.Spec{},
+	)
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -286,7 +506,9 @@ func TestHandleAccessRequest(t *testing.T) {
 			requester:     "non-existent-user",
 			requestedRole: "non-existent-role",
 			setupMock: func(m *mockClient) {
-				m.On("GetUser", mock.Anything, "non-existent-user", withSecretsFalse).
+				m.On("GetUserLoginState", mock.Anything, "non-existent-user").
+					Return(nil, trace.NotFound("user not found"))
+				m.On("GetUser", mock.Anything, "non-existent-user", false).
 					Return(nil, trace.NotFound("user not found"))
 			},
 			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
@@ -298,8 +520,8 @@ func TestHandleAccessRequest(t *testing.T) {
 			requester:     approvedUserName,
 			requestedRole: "unapproved-role",
 			setupMock: func(m *mockClient) {
-				m.On("GetUser", mock.Anything, approvedUserName, withSecretsFalse).
-					Return(approvedUser, nil)
+				m.On("GetUserLoginState", mock.Anything, approvedUserName).
+					Return(approvedUserLoginState, nil)
 
 				m.AssertNotCalled(t, "SubmitAccessReview",
 					"user is not automatically approved for this role")
@@ -311,8 +533,8 @@ func TestHandleAccessRequest(t *testing.T) {
 			requester:     unapprovedUserName,
 			requestedRole: approvedRole,
 			setupMock: func(m *mockClient) {
-				m.On("GetUser", mock.Anything, unapprovedUserName, withSecretsFalse).
-					Return(unapprovedUser, nil)
+				m.On("GetUserLoginState", mock.Anything, unapprovedUserName).
+					Return(unapprovedUserLoginState, nil)
 
 				m.AssertNotCalled(t, "SubmitAccessReview",
 					"user is not automatically approved for this role")
@@ -324,12 +546,16 @@ func TestHandleAccessRequest(t *testing.T) {
 			requester:     approvedUserName,
 			requestedRole: approvedRole,
 			setupMock: func(m *mockClient) {
-				m.On("GetUser", mock.Anything, approvedUserName, withSecretsFalse).
-					Return(approvedUser, nil)
-
-				review, err := newAccessReview(approvedUserName, testRuleName, types.RequestState_APPROVED.String())
+				m.On("GetUserLoginState", mock.Anything, approvedUserName).
+					Return(approvedUserLoginState, nil)
+
+				review, err := newAccessReview(
+					approvedUserName,
+					testRuleName,
+					types.RequestState_APPROVED.String(),
+					time.Time{},
+				)
 				require.NoError(t, err)
-				review.Created = time.Time{}
 
 				m.On("SubmitAccessReview", mock.Anything, types.AccessReviewSubmission{
 					RequestID: testReqID,
@@ -396,6 +622,7 @@ func newReviewRule(name, condition, decision string) *accessmonitoringrulesv1.Ac
 // mockClient is a mock implementation of the Teleport API client.
 type mockClient struct {
 	mock.Mock
+	Client
 }
 
 func (m *mockClient) SubmitAccessReview(ctx context.Context, review types.AccessReviewSubmission) (types.AccessRequest, error) {
@@ -430,3 +657,21 @@ func (m *mockClient) GetUser(ctx context.Context, name string, withSecrets bool)
 	}
 	return nil, args.Error(1)
 }
+
+func (m *mockClient) GetUserLoginState(ctx context.Context, name string) (*userloginstate.UserLoginState, error) {
+	args := m.Called(ctx, name)
+	userLoginState, ok := args.Get(0).(*userloginstate.UserLoginState)
+	if ok {
+		return userLoginState, args.Error(1)
+	}
+	return nil, args.Error(1)
+}
+
+func (m *mockClient) ListResources(ctx context.Context, req pb.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+	args := m.Called(ctx, req)
+	resp, ok := args.Get(0).(*types.ListResourcesResponse)
+	if ok {
+		return resp, args.Error(1)
+	}
+	return nil, args.Error(1)
+}
diff --git a/lib/accessmonitoring/schedule.go b/lib/accessmonitoring/schedule.go
new file mode 100644
index 0000000000000..69510a721fab5
--- /dev/null
+++ b/lib/accessmonitoring/schedule.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package accessmonitoring
+
+import (
+	"time"
+
+	"github.com/gravitational/trace"
+
+	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+)
+
+// ClockTime returns a new time value overriding the hour and minute.
+func ClockTime(timestamp time.Time, hourMinute string) (time.Time, error) {
+	const hourMinuteFormat = "15:04" // 24-hour HH:MM format
+
+	parsed, err := time.ParseInLocation(hourMinuteFormat, hourMinute, timestamp.Location())
+	if err != nil {
+		return time.Time{}, trace.Wrap(err)
+	}
+
+	return time.Date(timestamp.Year(), timestamp.Month(), timestamp.Day(),
+		parsed.Hour(), parsed.Minute(), 0, 0, timestamp.Location()), nil
+}
+
+// inSchedule returns true if the timestamp is within the schedule.
+func inSchedule(schedule *accessmonitoringrulesv1.Schedule, timestamp time.Time) (bool, error) {
+	if schedule.GetTime() == nil {
+		return false, nil
+	}
+
+	if len(schedule.GetTime().GetShifts()) == 0 {
+		return false, nil
+	}
+
+	loc, err := time.LoadLocation(schedule.GetTime().GetTimezone())
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	timestamp = timestamp.In(loc)
+	weekday := timestamp.Weekday().String()
+
+	for _, shift := range schedule.GetTime().GetShifts() {
+		if weekday != shift.Weekday {
+			continue
+		}
+
+		startTime, err := ClockTime(timestamp, shift.Start)
+		if err != nil {
+			return false, trace.Wrap(err, "invalid start time: %q", shift.Start)
+		}
+
+		endTime, err := ClockTime(timestamp, shift.End)
+		if err != nil {
+			return false, trace.Wrap(err, "invalid end time: %q", shift.End)
+		}
+
+		if !timestamp.Before(startTime) && !timestamp.After(endTime) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// InSchedules returns true if the provided timestamp is within an of the provided
+// schedules. Returns false if schedules is empty.
+func InSchedules(schedules map[string]*accessmonitoringrulesv1.Schedule, timestamp time.Time) (bool, error) {
+	for _, schedule := range schedules {
+		isInSchedule, err := inSchedule(schedule, timestamp)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		if isInSchedule {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/lib/accessmonitoring/schedule_test.go b/lib/accessmonitoring/schedule_test.go
new file mode 100644
index 0000000000000..08316b84fcff5
--- /dev/null
+++ b/lib/accessmonitoring/schedule_test.go
@@ -0,0 +1,260 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package accessmonitoring
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+)
+
+func TestClockTime(t *testing.T) {
+	timestamp := time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC)
+	tests := []struct {
+		description string
+		clockTime   string
+		assertErr   require.ErrorAssertionFunc
+		assertTime  require.ValueAssertionFunc
+	}{
+		{
+			description: "min clock time",
+			clockTime:   "00:00",
+			assertErr:   require.NoError,
+			assertTime: func(t require.TestingT, ts any, _ ...any) {
+				require.Equal(t, time.Date(2025, time.August, 11, 0, 0, 0, 0, time.UTC), ts)
+			},
+		},
+		{
+			description: "max clock time",
+			clockTime:   "23:59",
+			assertErr:   require.NoError,
+			assertTime: func(t require.TestingT, ts any, _ ...any) {
+				require.Equal(t, time.Date(2025, time.August, 11, 23, 59, 0, 0, time.UTC), ts)
+			},
+		},
+		{
+			description: "24 hour out of range",
+			clockTime:   "24:00",
+			assertErr: func(t require.TestingT, err error, _ ...any) {
+				require.ErrorContains(t, err, "hour out of range")
+			},
+		},
+		{
+			description: "60 minute out of range",
+			clockTime:   "00:60",
+			assertErr: func(t require.TestingT, err error, _ ...any) {
+				require.ErrorContains(t, err, "minute out of range")
+			},
+		},
+		{
+			description: "seconds specified",
+			clockTime:   "12:34:56",
+			assertErr: func(t require.TestingT, err error, _ ...any) {
+				require.ErrorContains(t, err, "extra text")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			t.Parallel()
+			ts, err := ClockTime(timestamp, tt.clockTime)
+			tt.assertErr(t, err)
+			if tt.assertTime != nil {
+				tt.assertTime(t, ts)
+			}
+		})
+	}
+}
+
+func TestInSchedule(t *testing.T) {
+	timestamp := time.Date(2025, time.August, 11, 14, 30, 0, 0, time.UTC) // Monday 14:30
+	tests := []struct {
+		description      string
+		schedules        map[string]*accessmonitoringrulesv1.Schedule
+		assertErr        require.ErrorAssertionFunc
+		assertInSchedule require.BoolAssertionFunc
+	}{
+		{
+			description: "in schedule",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:00",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.True,
+		},
+		{
+			description: "schedule does not contain any shifts",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.False,
+		},
+		{
+			description: "invalid timezone",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "invalid",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:00",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, _ ...any) {
+				require.ErrorContains(t, err, "unknown time zone")
+			},
+			assertInSchedule: require.False,
+		},
+		{
+			description: "different timezone",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "America/Los_Angeles",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:00",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.False,
+		},
+		{
+			description: "different weekday",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Tuesday.String(),
+								Start:   "14:00",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.False,
+		},
+		{
+			description: "before schedule",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:31",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.False,
+		},
+		{
+			description: "exact start time",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:30",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.True,
+		},
+		{
+			description: "multiple schedules",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"schedule1": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "14:30",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+				"schedule2": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Tuesday.String(),
+								Start:   "14:30",
+								End:     "15:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr:        require.NoError,
+			assertInSchedule: require.True,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			t.Parallel()
+			ts, err := InSchedules(tt.schedules, timestamp)
+			tt.assertErr(t, err)
+			if tt.assertInSchedule != nil {
+				tt.assertInSchedule(t, ts)
+			}
+		})
+	}
+}
diff --git a/lib/asciitable/example_test.go b/lib/asciitable/example_test.go
index d3d6f739e4d40..fc310062b84bc 100644
--- a/lib/asciitable/example_test.go
+++ b/lib/asciitable/example_test.go
@@ -34,3 +34,28 @@ func ExampleMakeTable() {
 	// Write the table to stdout.
 	fmt.Println(t.AsBuffer().String())
 }
+
+func ExampleMakeColumnsAndRows() {
+	type dbResourceRow struct {
+		DatabaseName string `asciitable:"DB Name"` // This column will appear in the table under a custom name.
+		Skip         string `asciitable:"-"`       // This column will be skipped entirely.
+		ResourceID   string // It will derive the name "Resource ID"
+	}
+
+	rows := []dbResourceRow{
+		{DatabaseName: "orders", Skip: "ignored", ResourceID: "db-1"},
+		{DatabaseName: "users", Skip: "ignored", ResourceID: "db-2"},
+	}
+
+	// Build table columns + rows.
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	// Create asciitable table.
+	table := MakeTable(cols, data...)
+
+	// Write the table to stdout.
+	fmt.Println(table.AsBuffer().String())
+}
diff --git a/lib/asciitable/struct.go b/lib/asciitable/struct.go
new file mode 100644
index 0000000000000..b53e700a60e27
--- /dev/null
+++ b/lib/asciitable/struct.go
@@ -0,0 +1,93 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package asciitable
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+	"slices"
+
+	"github.com/gravitational/trace"
+)
+
+const asciitableTag = "asciitable"
+
+// Regular expression to convert from "DatabaseRoles" to "Database Roles" etc.
+var headerSplitRe = regexp.MustCompile(`([a-z])([A-Z])`)
+
+// MakeColumnsAndRows converts a slice of structs into column headers and
+// row data suitable for use with asciitable.MakeTable.
+// T must be a struct type. If T is not a struct, the function returns an error.
+//
+// Column headers are determined by the `asciitable` struct tag. If the tag is
+// empty, the header is derived from the field name (e.g., "DatabaseRoles"
+// becomes "Database Roles").
+//
+// includeColumns optionally restricts which columns are returned. Each value
+// must match the final header name (tag value is used if present, otherwise the
+// derived name). If includeColumns is empty or nil, all fields are included.
+func MakeColumnsAndRows[T any](rows []T, includeColumns []string) ([]string, [][]string, error) {
+	t := reflect.TypeOf((*T)(nil)).Elem()
+	if t.Kind() != reflect.Struct {
+		return nil, nil, trace.Errorf("only slices of struct are supported: got slice of %s", t.Kind())
+	}
+
+	type fieldInfo struct {
+		index int
+		name  string
+	}
+
+	var fields []fieldInfo
+	var columns []string
+
+	for i := 0; i < t.NumField(); i++ {
+		f := t.Field(i)
+
+		header := f.Tag.Get(asciitableTag)
+		if header == "-" {
+			continue
+		}
+		if header == "" {
+			header = headerSplitRe.ReplaceAllString(f.Name, "${1} ${2}")
+		}
+
+		if len(includeColumns) > 0 && !slices.Contains(includeColumns, header) {
+			continue
+		}
+
+		fields = append(fields, fieldInfo{
+			index: i,
+			name:  header,
+		})
+		columns = append(columns, header)
+	}
+
+	outRows := make([][]string, 0, len(rows))
+	for _, row := range rows {
+		v := reflect.ValueOf(row)
+		rowValues := make([]string, 0, len(fields))
+		for _, fi := range fields {
+			rowValues = append(rowValues, fmt.Sprintf("%v", v.Field(fi.index)))
+		}
+		outRows = append(outRows, rowValues)
+	}
+
+	return columns, outRows, nil
+}
diff --git a/lib/asciitable/struct_test.go b/lib/asciitable/struct_test.go
new file mode 100644
index 0000000000000..11eb321e5d7bb
--- /dev/null
+++ b/lib/asciitable/struct_test.go
@@ -0,0 +1,178 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package asciitable
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMakeColumnsAndRows(t *testing.T) {
+	type row struct {
+		Name       string
+		ResourceID string
+	}
+
+	rows := []row{
+		{Name: "n1", ResourceID: "id1"},
+		{Name: "n2", ResourceID: "id2"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, []string{"Name", "Resource ID"}, cols)
+	require.Equal(t, [][]string{
+		{"n1", "id1"},
+		{"n2", "id2"},
+	}, data)
+}
+
+func TestMakeColumnsAndRowsWithTagsAndSkip(t *testing.T) {
+	type row struct {
+		Name       string `asciitable:"Custom Name"`
+		Skip       string `asciitable:"-"`
+		ResourceID string `asciitable:"Resource ID"`
+	}
+
+	rows := []row{
+		{Name: "n1", Skip: "skip1", ResourceID: "id1"},
+		{Name: "n2", Skip: "skip2", ResourceID: "id2"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, []string{"Custom Name", "Resource ID"}, cols)
+	require.Equal(t, [][]string{
+		{"n1", "id1"},
+		{"n2", "id2"},
+	}, data)
+}
+
+func TestMakeColumnsAndRowsIncludeColumns(t *testing.T) {
+	type row struct {
+		Name       string
+		Hostname   string
+		Labels     string
+		ResourceID string
+	}
+
+	rows := []row{
+		{Name: "n1", Hostname: "h1", Labels: "a=1", ResourceID: "id1"},
+		{Name: "n2", Hostname: "h2", Labels: "b=2", ResourceID: "id2"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, []string{"Name", "Labels"})
+	require.NoError(t, err)
+
+	require.Equal(t, []string{"Name", "Labels"}, cols)
+	require.Equal(t, [][]string{
+		{"n1", "a=1"},
+		{"n2", "b=2"},
+	}, data)
+}
+
+func TestMakeColumnsAndRowsIncludeColumnsWithTags(t *testing.T) {
+	type row struct {
+		Name       string `asciitable:"Custom Name"`
+		ResourceID string `asciitable:"Resource ID"`
+	}
+
+	rows := []row{
+		{Name: "n1", ResourceID: "id1"},
+		{Name: "n2", ResourceID: "id2"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, []string{"Custom Name"})
+	require.NoError(t, err)
+
+	require.Equal(t, []string{"Custom Name"}, cols)
+	require.Equal(t, [][]string{
+		{"n1"},
+		{"n2"},
+	}, data)
+}
+
+func TestMakeColumnsAndRowsCamelCaseLongName(t *testing.T) {
+	type row struct {
+		VeryLongFieldName string
+	}
+
+	rows := []row{
+		{VeryLongFieldName: "value1"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	require.NoError(t, err)
+
+	require.Len(t, cols, 1)
+	require.Equal(t, "Very Long Field Name", cols[0])
+	require.Equal(t, [][]string{{"value1"}}, data)
+}
+
+func TestMakeColumnsAndRowsEmptySlice(t *testing.T) {
+	type row struct {
+		Name       string
+		ResourceID string
+	}
+
+	var rows []row
+
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, []string{"Name", "Resource ID"}, cols)
+	require.Empty(t, data)
+}
+
+func TestMakeColumnsAndRowsNonStructType(t *testing.T) {
+	rows := []int{1, 2, 3}
+
+	cols, data, err := MakeColumnsAndRows(rows, nil)
+	require.Error(t, err)
+	require.Nil(t, cols)
+	require.Nil(t, data)
+
+	var traceErr trace.Error
+	ok := errors.As(err, &traceErr)
+	require.True(t, ok)
+
+	require.Contains(t, err.Error(), "only slices of struct are supported")
+}
+
+func TestMakeColumnsAndRowsIncludeColumnsUnknown(t *testing.T) {
+	type row struct {
+		Name string
+	}
+
+	rows := []row{
+		{Name: "n1"},
+	}
+
+	cols, data, err := MakeColumnsAndRows(rows, []string{"Unknown"})
+	require.NoError(t, err)
+
+	require.Empty(t, cols)
+	require.Equal(t, [][]string{{}}, data)
+	require.Len(t, data, 1)
+}
diff --git a/lib/auth/access.go b/lib/auth/access.go
index 4020484ac1855..efa047547e7fb 100644
--- a/lib/auth/access.go
+++ b/lib/auth/access.go
@@ -148,7 +148,7 @@ func (a *Server) DeleteRole(ctx context.Context, name string) error {
 	for {
 		var accessLists []*accesslist.AccessList
 		var err error
-		accessLists, nextToken, err = a.Services.AccessLists.ListAccessLists(ctx, 0 /* default page size */, nextToken)
+		accessLists, nextToken, err = a.Services.AccessListsInternal.ListAccessLists(ctx, 0 /* default page size */, nextToken)
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/lib/auth/access_request_test.go b/lib/auth/access_request_test.go
index e280d1e8122be..7d1f3ee9ab24a 100644
--- a/lib/auth/access_request_test.go
+++ b/lib/auth/access_request_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"cmp"
@@ -45,9 +45,12 @@ import (
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/sshca"
@@ -55,7 +58,7 @@ import (
 )
 
 type accessRequestTestPack struct {
-	tlsServer   *TestTLSServer
+	tlsServer   *authtest.TLSServer
 	clusterName string
 	roles       map[string]types.RoleSpecV6
 	users       map[string][]string
@@ -66,7 +69,7 @@ type accessRequestTestPack struct {
 }
 
 func newAccessRequestTestPack(ctx context.Context, t *testing.T) *accessRequestTestPack {
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err, "%s", trace.DebugReport(err))
@@ -189,7 +192,7 @@ func newAccessRequestTestPack(ctx context.Context, t *testing.T) *accessRequestT
 }
 
 func TestAccessRequest(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
@@ -252,7 +255,7 @@ func TestAccessRequestResourceRBACLimits(t *testing.T) {
 
 	clock := clockwork.NewFakeClock()
 
-	authServer, err := NewTestAuthServer(TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clock,
 	})
@@ -301,7 +304,7 @@ func TestAccessRequestResourceRBACLimits(t *testing.T) {
 	_, err = tlsServer.Auth().UpsertUser(ctx, otherUser)
 	require.NoError(t, err)
 
-	clt, err := tlsServer.NewClient(TestUser(userName))
+	clt, err := tlsServer.NewClient(authtest.TestUser(userName))
 	require.NoError(t, err)
 	defer clt.Close()
 
@@ -371,7 +374,7 @@ func TestListAccessRequests(t *testing.T) {
 
 	clock := clockwork.NewFakeClock()
 
-	authServer, err := NewTestAuthServer(TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clock,
 	})
@@ -423,11 +426,11 @@ func TestListAccessRequests(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	clientA, err := tlsServer.NewClient(TestUser(userA))
+	clientA, err := tlsServer.NewClient(authtest.TestUser(userA))
 	require.NoError(t, err)
 	defer clientA.Close()
 
-	clientB, err := tlsServer.NewClient(TestUser(userB))
+	clientB, err := tlsServer.NewClient(authtest.TestUser(userB))
 	require.NoError(t, err)
 	defer clientB.Close()
 
@@ -765,7 +768,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 			_, err = testPack.tlsServer.Auth().UpsertUser(ctx, user)
 			require.NoError(t, err)
 
-			client, err := testPack.tlsServer.NewClient(TestUser(userName))
+			client, err := testPack.tlsServer.NewClient(authtest.TestUser(userName))
 			require.NoError(t, err)
 
 			_, err = client.GetAccessRequests(ctx, types.AccessRequestFilter{})
@@ -868,7 +871,7 @@ func testSingleAccessRequests(t *testing.T, testPack *accessRequestTestPack) {
 		tc := tc
 		t.Run(tc.desc, func(t *testing.T) {
 			t.Parallel()
-			requester := TestUser(tc.requester)
+			requester := authtest.TestUser(tc.requester)
 			requesterClient, err := testPack.tlsServer.NewClient(requester)
 			require.NoError(t, err)
 
@@ -927,7 +930,7 @@ func testSingleAccessRequests(t *testing.T, testPack *accessRequestTestPack) {
 			_, err = generateCerts(req.GetName())
 			require.ErrorIs(t, err, trace.AccessDenied("access request %q is awaiting approval", req.GetName()))
 
-			reviewer := TestUser(tc.reviewer)
+			reviewer := authtest.TestUser(tc.reviewer)
 			reviewerClient, err := testPack.tlsServer.NewClient(reviewer)
 			require.NoError(t, err)
 
@@ -961,7 +964,8 @@ func testSingleAccessRequests(t *testing.T, testPack *accessRequestTestPack) {
 
 			elevatedCert, err := tls.X509KeyPair(certs.TLS, testPack.tlsPrivKey)
 			require.NoError(t, err)
-			elevatedClient := testPack.tlsServer.NewClientWithCert(elevatedCert)
+			elevatedClient, err := testPack.tlsServer.NewClientWithCert(elevatedCert)
+			require.NoError(t, err)
 
 			// should be able to list the expected nodes
 			nodes, err = elevatedClient.GetNodes(ctx, defaults.Namespace)
@@ -1037,7 +1041,7 @@ func testBotAccessRequestReview(t *testing.T, testPack *accessRequestTestPack) {
 	t.Cleanup(cancel)
 
 	// Create the bot
-	adminClient, err := testPack.tlsServer.NewClient(TestAdmin())
+	adminClient, err := testPack.tlsServer.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	defer adminClient.Close()
 	bot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
@@ -1059,7 +1063,7 @@ func testBotAccessRequestReview(t *testing.T, testPack *accessRequestTestPack) {
 
 	// Use the bot user to generate some certs using role impersonation.
 	// This mimics what the bot actually does.
-	botClient, err := testPack.tlsServer.NewClient(TestUser(bot.Status.UserName))
+	botClient, err := testPack.tlsServer.NewClient(authtest.TestUser(bot.Status.UserName))
 	require.NoError(t, err)
 	defer botClient.Close()
 	certRes, err := botClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
@@ -1073,11 +1077,12 @@ func testBotAccessRequestReview(t *testing.T, testPack *accessRequestTestPack) {
 	require.NoError(t, err)
 	tlsCert, err := tls.X509KeyPair(certRes.TLS, testPack.tlsPrivKey)
 	require.NoError(t, err)
-	impersonatedBotClient := testPack.tlsServer.NewClientWithCert(tlsCert)
+	impersonatedBotClient, err := testPack.tlsServer.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
 	defer impersonatedBotClient.Close()
 
 	// Create an access request for the bot to approve
-	requesterClient, err := testPack.tlsServer.NewClient(TestUser("requester"))
+	requesterClient, err := testPack.tlsServer.NewClient(authtest.TestUser("requester"))
 	require.NoError(t, err)
 	defer requesterClient.Close()
 	accessRequest, err := services.NewAccessRequest("requester", "admins")
@@ -1144,7 +1149,7 @@ func testMultiAccessRequests(t *testing.T, testPack *accessRequestTestPack) {
 		require.NoError(t, testPack.tlsServer.Auth().UpsertAccessRequest(ctx, request))
 	}
 
-	requester := TestUser(username)
+	requester := authtest.TestUser(username)
 	requesterClient, err := testPack.tlsServer.NewClient(requester)
 	require.NoError(t, err)
 
@@ -1162,7 +1167,9 @@ func testMultiAccessRequests(t *testing.T, testPack *accessRequestTestPack) {
 			require.NoError(t, err)
 			tlsCert, err := tls.X509KeyPair(certs.TLS, testPack.tlsPrivKey)
 			require.NoError(t, err)
-			return testPack.tlsServer.NewClientWithCert(tlsCert), certs
+			client, err := testPack.tlsServer.NewClientWithCert(tlsCert)
+			require.NoError(t, err)
+			return client, certs
 		}
 	}
 	applyAccessRequests := func(newRequests ...string) newClientFunc {
@@ -1332,7 +1339,7 @@ func testRoleRefreshWithBogusRequestID(t *testing.T, testPack *accessRequestTest
 	require.NoError(t, err)
 
 	// Create a client with the old set of roles.
-	clt, err := testPack.tlsServer.NewClient(TestUser(username))
+	clt, err := testPack.tlsServer.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
 	// Add a new role to the user on the server.
@@ -1406,7 +1413,7 @@ func checkCerts(t *testing.T,
 func TestCreateSuggestions(t *testing.T) {
 	t.Parallel()
 
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
@@ -1444,14 +1451,14 @@ func TestCreateSuggestions(t *testing.T) {
 }
 
 func TestPromotedRequest(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
 	testPack := newAccessRequestTestPack(ctx, t)
 
 	const requesterUserName = "requester"
-	requester := TestUser(requesterUserName)
+	requester := authtest.TestUser(requesterUserName)
 	requesterClient, err := testPack.tlsServer.NewClient(requester)
 	require.NoError(t, err)
 
@@ -1467,7 +1474,7 @@ func TestPromotedRequest(t *testing.T) {
 
 	const adminUser = "admin"
 	approveAs := func(reviewerName string) (types.AccessRequest, error) {
-		reviewer := TestUser(reviewerName)
+		reviewer := authtest.TestUser(reviewerName)
 		reviewerClient, err := testPack.tlsServer.NewClient(reviewer)
 		require.NoError(t, err)
 
@@ -1546,7 +1553,7 @@ func TestPromotedRequest(t *testing.T) {
 func TestUpdateAccessRequestWithAdditionalReviewers(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.Identity: {Enabled: true},
@@ -1757,7 +1764,7 @@ func TestUpdateAccessRequestWithAdditionalReviewers(t *testing.T) {
 			}
 
 			req := test.req.Copy()
-			updateAccessRequestWithAdditionalReviewers(ctx, req, accessLists, test.promotions)
+			auth.UpdateAccessRequestWithAdditionalReviewers(ctx, req, accessLists, test.promotions)
 			require.ElementsMatch(t, test.expectedReviewers, req.GetSuggestedReviewers())
 		})
 	}
@@ -1919,14 +1926,14 @@ type accessRequestWithStartTime struct {
 func createAccessRequestWithStartTime(t *testing.T) accessRequestWithStartTime {
 	t.Helper()
 
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
 	testPack := newAccessRequestTestPack(ctx, t)
 
 	const requesterUserName = "requester"
-	requester := TestUser(requesterUserName)
+	requester := authtest.TestUser(requesterUserName)
 	requesterClient, err := testPack.tlsServer.NewClient(requester)
 	require.NoError(t, err)
 
diff --git a/lib/auth/access_test.go b/lib/auth/access_test.go
index fff752186931f..7945ff418d7d8 100644
--- a/lib/auth/access_test.go
+++ b/lib/auth/access_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -37,6 +37,8 @@ import (
 	"github.com/gravitational/teleport/api/types/accesslist"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
@@ -122,7 +124,7 @@ func TestUpsertDeleteDependentRoles(t *testing.T) {
 	require.NoError(t, err)
 
 	// Deletion should fail.
-	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), errDeleteRoleUser)
+	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), auth.ErrDeleteRoleUser)
 	require.NoError(t, p.a.DeleteUser(ctx, user.GetName()))
 
 	clusterName, err := p.a.GetClusterName(ctx)
@@ -135,7 +137,7 @@ func TestUpsertDeleteDependentRoles(t *testing.T) {
 	require.NoError(t, p.a.UpsertCertAuthority(ctx, ca))
 
 	// Deletion should fail.
-	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), errDeleteRoleCA)
+	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), auth.ErrDeleteRoleCA)
 
 	// Clear out the roles for the CA.
 	ca.SetRoles([]string{})
@@ -167,21 +169,21 @@ func TestUpsertDeleteDependentRoles(t *testing.T) {
 	require.NoError(t, err)
 
 	// Deletion should fail due to the grant.
-	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), errDeleteRoleAccessList)
+	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), auth.ErrDeleteRoleAccessList)
 
 	accessList.Spec.Grants.Roles = []string{"non-existent-role"}
 	_, err = p.a.UpsertAccessList(ctx, accessList)
 	require.NoError(t, err)
 
 	// Deletion should fail due to membership requires.
-	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), errDeleteRoleAccessList)
+	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), auth.ErrDeleteRoleAccessList)
 
 	accessList.Spec.MembershipRequires.Roles = []string{"non-existent-role"}
 	_, err = p.a.UpsertAccessList(ctx, accessList)
 	require.NoError(t, err)
 
 	// Deletion should fail due to ownership requires.
-	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), errDeleteRoleAccessList)
+	require.ErrorIs(t, p.a.DeleteRole(ctx, role.GetName()), auth.ErrDeleteRoleAccessList)
 
 	accessList.Spec.OwnershipRequires.Roles = []string{"non-existent-role"}
 	_, err = p.a.UpsertAccessList(ctx, accessList)
@@ -319,7 +321,7 @@ func TestCreateRole(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			got, err := clt.CreateRole(ctx, test.createRole)
@@ -473,7 +475,7 @@ func TestUpdateRole(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 			test.updateRole.SetRevision(revision)
 
@@ -617,7 +619,7 @@ func TestUpsertRole(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 			test.upsertRole.SetRevision(revision)
 
@@ -735,7 +737,7 @@ func TestGetRole(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			got, err := clt.GetRole(ctx, test.roleToGet)
@@ -847,7 +849,7 @@ func TestGetRoles(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			got, err := clt.GetRoles(ctx)
@@ -979,7 +981,7 @@ func TestListRolesFiltering(t *testing.T) {
 			t.Parallel()
 			srv := newTestTLSServer(t)
 
-			clt, err := srv.NewClient(TestAdmin())
+			clt, err := srv.NewClient(authtest.TestAdmin())
 			require.NoError(t, err)
 
 			// Only create the role if it's been supplied.
@@ -1114,7 +1116,7 @@ func TestDeleteRole(t *testing.T) {
 			require.NoError(t, err)
 			_, err = as.CreateUser(ctx, user)
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			test.wantErr(t, clt.DeleteRole(ctx, test.roleToDelete))
diff --git a/lib/auth/accesspoint/accesspoint.go b/lib/auth/accesspoint/accesspoint.go
index 4904076472e36..8dd01078c9a96 100644
--- a/lib/auth/accesspoint/accesspoint.go
+++ b/lib/auth/accesspoint/accesspoint.go
@@ -23,17 +23,15 @@ package accesspoint
 
 import (
 	"context"
-	"log/slog"
 	"slices"
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
 	oteltrace "go.opentelemetry.io/otel/trace"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/cache"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/services"
@@ -63,6 +61,8 @@ type Config struct {
 	// TracingProvider is the provider to be used for exporting
 	// traces. No-op tracers will be used if no provider is set.
 	TracingProvider *tracing.Provider
+	// Registerer is used to register prometheus metrics.
+	Registerer prometheus.Registerer
 
 	// The following services are provided to the Cache to allow it to
 	// populate its resource collections. They will either be the local service
@@ -73,7 +73,8 @@ type Config struct {
 	AccessLists             services.AccessLists
 	AccessMonitoringRules   services.AccessMonitoringRules
 	AppSession              services.AppSession
-	Apps                    services.Apps
+	Apps                    services.Applications
+	BotInstance             services.BotInstance
 	ClusterConfig           services.ClusterConfiguration
 	CrownJewels             services.CrownJewels
 	DatabaseObjects         services.DatabaseObjects
@@ -101,7 +102,7 @@ type Config struct {
 	UserLoginStates         services.UserLoginStates
 	Users                   services.UsersService
 	WebSession              types.WebSessionInterface
-	WebToken                types.WebTokenInterface
+	WebToken                services.WebToken
 	WorkloadIdentity        services.WorkloadIdentities
 	DynamicWindowsDesktops  services.DynamicWindowsDesktops
 	WindowsDesktops         services.WindowsDesktops
@@ -111,6 +112,8 @@ type Config struct {
 	PluginStaticCredentials services.PluginStaticCredentials
 	GitServers              services.GitServers
 	HealthCheckConfig       services.HealthCheckConfigReader
+	Plugin                  services.Plugins
+	RecordingEncryption     services.RecordingEncryption
 }
 
 func (c *Config) CheckAndSetDefaults() error {
@@ -130,27 +133,11 @@ func NewCache(cfg Config) (*cache.Cache, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	slog.DebugContext(cfg.Context, "Creating in-memory backend cache.", "cache_name", cfg.CacheName)
-	mem, err := memory.New(memory.Config{
-		Context:   cfg.Context,
-		EventsOff: !cfg.EventsSystem,
-		Mirror:    true,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+
 	var tracer oteltrace.Tracer
 	if cfg.TracingProvider != nil {
 		tracer = cfg.TracingProvider.Tracer(teleport.ComponentCache)
 	}
-	reporter, err := backend.NewReporter(backend.ReporterConfig{
-		Component: teleport.ComponentCache,
-		Backend:   mem,
-		Tracer:    tracer,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 
 	component := slices.Clone(cfg.CacheName)
 	if cfg.ProcessID != "" {
@@ -161,14 +148,13 @@ func NewCache(cfg Config) (*cache.Cache, error) {
 	metricComponent := append(slices.Clone(cfg.CacheName), teleport.ComponentCache)
 
 	cacheCfg := cache.Config{
-		Context:         cfg.Context,
-		Backend:         reporter,
-		Component:       teleport.Component(component...),
-		MetricComponent: teleport.Component(metricComponent...),
-		Tracer:          tracer,
-		MaxRetryPeriod:  cfg.MaxRetryPeriod,
-		Unstarted:       cfg.Unstarted,
-
+		Context:                 cfg.Context,
+		Component:               teleport.Component(component...),
+		MetricComponent:         teleport.Component(metricComponent...),
+		Tracer:                  tracer,
+		Registerer:              cfg.Registerer,
+		MaxRetryPeriod:          cfg.MaxRetryPeriod,
+		Unstarted:               cfg.Unstarted,
 		Access:                  cfg.Access,
 		AccessLists:             cfg.AccessLists,
 		AccessMonitoringRules:   cfg.AccessMonitoringRules,
@@ -211,6 +197,9 @@ func NewCache(cfg Config) (*cache.Cache, error) {
 		PluginStaticCredentials: cfg.PluginStaticCredentials,
 		GitServers:              cfg.GitServers,
 		HealthCheckConfig:       cfg.HealthCheckConfig,
+		BotInstanceService:      cfg.BotInstance,
+		Plugin:                  cfg.Plugin,
+		RecordingEncryption:     cfg.RecordingEncryption,
 	}
 
 	return cache.New(cfg.Setup(cacheCfg))
diff --git a/lib/auth/accountrecovery_test.go b/lib/auth/accountrecovery_test.go
index 0ab77ddb4faee..4ca60cae0f97b 100644
--- a/lib/auth/accountrecovery_test.go
+++ b/lib/auth/accountrecovery_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -40,11 +40,14 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	wanpb "github.com/gravitational/teleport/api/types/webauthn"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 // TestGenerateAndUpsertRecoveryCodes tests the following:
@@ -58,9 +61,9 @@ func TestGenerateAndUpsertRecoveryCodes(t *testing.T) {
 	ctx := context.Background()
 
 	user := "fake@fake.com"
-	rc, err := srv.Auth().generateAndUpsertRecoveryCodes(ctx, user)
+	rc, err := srv.Auth().GenerateAndUpsertRecoveryCodes(ctx, user)
 	require.NoError(t, err)
-	require.Len(t, rc.Codes, numOfRecoveryCodes)
+	require.Len(t, rc.Codes, auth.NumOfRecoveryCodes)
 	require.NotEmpty(t, rc.Created)
 
 	// Test codes are not marked used.
@@ -79,7 +82,7 @@ func TestGenerateAndUpsertRecoveryCodes(t *testing.T) {
 		require.True(t, strings.HasPrefix(code, "tele-"))
 
 		// Test codes match.
-		err := srv.Auth().verifyRecoveryCode(ctx, user, []byte(code))
+		err := srv.Auth().VerifyRecoveryCode(ctx, user, []byte(code))
 		require.NoError(t, err)
 	}
 
@@ -91,15 +94,15 @@ func TestGenerateAndUpsertRecoveryCodes(t *testing.T) {
 	}
 
 	// Test with a used code returns error.
-	err = srv.Auth().verifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
+	err = srv.Auth().VerifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Test with invalid recovery code returns error.
-	err = srv.Auth().verifyRecoveryCode(ctx, user, []byte("invalidcode"))
+	err = srv.Auth().VerifyRecoveryCode(ctx, user, []byte("invalidcode"))
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Test with non-existing user returns error.
-	err = srv.Auth().verifyRecoveryCode(ctx, "doesnotexist", []byte(rc.Codes[0]))
+	err = srv.Auth().VerifyRecoveryCode(ctx, "doesnotexist", []byte(rc.Codes[0]))
 	require.True(t, trace.IsAccessDenied(err))
 }
 
@@ -108,26 +111,26 @@ func TestRecoveryCodeEventsEmitted(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
 	user := "fake@fake.com"
 
 	// Test generated recovery codes event.
-	rc, err := srv.Auth().generateAndUpsertRecoveryCodes(ctx, user)
+	rc, err := srv.Auth().GenerateAndUpsertRecoveryCodes(ctx, user)
 	require.NoError(t, err)
 	event := mockEmitter.LastEvent()
 	require.Equal(t, events.RecoveryCodeGeneratedEvent, event.GetType())
 	require.Equal(t, events.RecoveryCodesGenerateCode, event.GetCode())
 
 	// Test used recovery code event.
-	err = srv.Auth().verifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
+	err = srv.Auth().VerifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
 	require.NoError(t, err)
 	event = mockEmitter.LastEvent()
 	require.Equal(t, events.RecoveryCodeUsedEvent, event.GetType())
 	require.Equal(t, events.RecoveryCodeUseSuccessCode, event.GetCode())
 
 	// Re-using the same token emits failed event.
-	err = srv.Auth().verifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
+	err = srv.Auth().VerifyRecoveryCode(ctx, user, []byte(rc.Codes[0]))
 	require.Error(t, err)
 	event = mockEmitter.LastEvent()
 	require.Equal(t, events.RecoveryCodeUsedEvent, event.GetType())
@@ -139,9 +142,9 @@ func TestStartAccountRecovery(t *testing.T) {
 	ctx := context.Background()
 	fakeClock := srv.Clock().(*clockwork.FakeClock)
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -209,7 +212,7 @@ func TestStartAccountRecovery_WithLock(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -234,7 +237,7 @@ func TestStartAccountRecovery_UserErrors(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -250,21 +253,21 @@ func TestStartAccountRecovery_UserErrors(t *testing.T) {
 	}{
 		{
 			desc:      "username not in valid email format",
-			expErrMsg: startRecoveryGenericErrMsg,
+			expErrMsg: auth.StartRecoveryGenericErrMsg,
 			req: &proto.StartAccountRecoveryRequest{
 				Username: "malformed-email",
 			},
 		},
 		{
 			desc:      "user does not exist",
-			expErrMsg: startRecoveryBadAuthnErrMsg,
+			expErrMsg: auth.StartRecoveryBadAuthnErrMsg,
 			req: &proto.StartAccountRecoveryRequest{
 				Username: "dne@test.com",
 			},
 		},
 		{
 			desc:      "invalid recovery code",
-			expErrMsg: startRecoveryBadAuthnErrMsg,
+			expErrMsg: auth.StartRecoveryBadAuthnErrMsg,
 			req: &proto.StartAccountRecoveryRequest{
 				Username:     u.username,
 				RecoveryCode: []byte("invalid-code"),
@@ -272,7 +275,7 @@ func TestStartAccountRecovery_UserErrors(t *testing.T) {
 		},
 		{
 			desc:      "missing recover type in request",
-			expErrMsg: startRecoveryGenericErrMsg,
+			expErrMsg: auth.StartRecoveryGenericErrMsg,
 			req: &proto.StartAccountRecoveryRequest{
 				Username:     u.username,
 				RecoveryCode: []byte(u.recoveryCodes[0]),
@@ -294,9 +297,9 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
 	ctx := context.Background()
 	fakeClock := srv.Clock().(*clockwork.FakeClock)
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -368,7 +371,7 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			// Acquire a start token.
-			startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, c.recoverType)
+			startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, c.recoverType)
 			require.NoError(t, err)
 
 			// Try a failed attempt, to test it gets cleared later.
@@ -376,7 +379,7 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
 			c.invalidReq.RecoveryStartTokenID = startToken.GetName()
 			_, err = srv.Auth().VerifyAccountRecovery(ctx, c.invalidReq)
 			require.True(t, trace.IsAccessDenied(err))
-			require.Equal(t, verifyRecoveryBadAuthnErrMsg, err.Error())
+			require.Equal(t, auth.VerifyRecoveryBadAuthnErrMsg, err.Error())
 
 			// Get request with authn.
 			mfaChallenge, err := srv.Auth().CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
@@ -417,9 +420,9 @@ func TestVerifyAccountRecovery_WithLock(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -429,7 +432,7 @@ func TestVerifyAccountRecovery_WithLock(t *testing.T) {
 	require.NoError(t, err)
 
 	// Acquire a start token.
-	startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+	startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 	require.NoError(t, err)
 
 	// Trigger login lock.
@@ -448,9 +451,9 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -468,7 +471,7 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 			name: "invalid token type",
 			getRequest: func() *proto.VerifyAccountRecoveryRequest {
 				// Generate an incorrect token type.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.VerifyAccountRecoveryRequest{
@@ -478,7 +481,7 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "token not found",
-			expErrMsg: verifyRecoveryGenericErrMsg,
+			expErrMsg: auth.VerifyRecoveryGenericErrMsg,
 			getRequest: func() *proto.VerifyAccountRecoveryRequest {
 				return &proto.VerifyAccountRecoveryRequest{
 					RecoveryStartTokenID: "non-existent-token-id",
@@ -487,10 +490,10 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "username does not match",
-			expErrMsg: verifyRecoveryBadAuthnErrMsg,
+			expErrMsg: auth.VerifyRecoveryBadAuthnErrMsg,
 			getRequest: func() *proto.VerifyAccountRecoveryRequest {
 				// Acquire a start token.
-				startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.VerifyAccountRecoveryRequest{
@@ -501,10 +504,10 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "provide password when it expects MFA authn response",
-			expErrMsg: verifyRecoveryBadAuthnErrMsg,
+			expErrMsg: auth.VerifyRecoveryBadAuthnErrMsg,
 			getRequest: func() *proto.VerifyAccountRecoveryRequest {
 				// Acquire a start token for recovering second factor.
-				startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.VerifyAccountRecoveryRequest{
@@ -515,10 +518,10 @@ func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "provide MFA authn response when it expects password",
-			expErrMsg: verifyRecoveryBadAuthnErrMsg,
+			expErrMsg: auth.VerifyRecoveryBadAuthnErrMsg,
 			getRequest: func() *proto.VerifyAccountRecoveryRequest {
 				// Acquire a start token for recovering password.
-				startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+				startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 				require.NoError(t, err)
 
 				return &proto.VerifyAccountRecoveryRequest{
@@ -547,9 +550,9 @@ func TestCompleteAccountRecovery(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -562,7 +565,7 @@ func TestCompleteAccountRecovery(t *testing.T) {
 	triggerLoginLock(t, srv.Auth(), u.username)
 
 	// Acquire an approved token for recovering password.
-	approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+	approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 	require.NoError(t, err)
 
 	err = srv.Auth().CompleteAccountRecovery(ctx, &proto.CompleteAccountRecoveryRequest{
@@ -583,7 +586,7 @@ func TestCompleteAccountRecovery(t *testing.T) {
 	require.Empty(t, attempts)
 
 	// Test adding MFA devices.
-	approvedToken, err = srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+	approvedToken, err = srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 	require.NoError(t, err)
 
 	cases := []struct {
@@ -599,7 +602,7 @@ func TestCompleteAccountRecovery(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal, WithTestDeviceClock(srv.Clock()))
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal, authtest.WithTestDeviceClock(srv.Clock()))
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -621,7 +624,7 @@ func TestCompleteAccountRecovery(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -668,9 +671,9 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -691,7 +694,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 			// expectErrMsg not supplied on purpose, there is no const err message for this error.
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Generate an incorrect token type.
-				startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -701,7 +704,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "token not found",
-			expErrMsg: completeRecoveryGenericErrMsg,
+			expErrMsg: auth.CompleteRecoveryGenericErrMsg,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				return &proto.CompleteAccountRecoveryRequest{
 					RecoveryApprovedTokenID: "non-existent-token-id",
@@ -710,10 +713,10 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "provide new password when it expects new MFA register response",
-			expErrMsg: completeRecoveryGenericErrMsg,
+			expErrMsg: auth.CompleteRecoveryGenericErrMsg,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Acquire an approved token for recovering second factor.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -724,10 +727,10 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 		},
 		{
 			name:      "provide new MFA register response when it expects new password",
-			expErrMsg: completeRecoveryGenericErrMsg,
+			expErrMsg: auth.CompleteRecoveryGenericErrMsg,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Acquire an approved token for recovering password.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 				require.NoError(t, err)
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -741,7 +744,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 			isDuplicate: true,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Acquire an approved token for recovering second factor.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				// Retrieve list of devices to get the name of an existing device.
@@ -756,7 +759,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -773,7 +776,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 			isBadParameter: true,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Acquire an approved token for recovering second factor.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				ap, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
@@ -800,7 +803,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
 			isBadParameter: true,
 			getRequest: func(t *testing.T) *proto.CompleteAccountRecoveryRequest {
 				// Acquire an approved token for recovering second factor.
-				approvedToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				approvedToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				ap, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
@@ -847,7 +850,7 @@ func TestAccountRecoveryFlow(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -939,7 +942,7 @@ func TestAccountRecoveryFlow(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.CompleteAccountRecoveryRequest{
@@ -1029,7 +1032,7 @@ func TestGetAccountRecoveryToken(t *testing.T) {
 			name:    "invalid token type",
 			wantErr: true,
 			getRequest: func() *proto.GetAccountRecoveryTokenRequest {
-				wrongTokenType, err := srv.Auth().newUserToken(authclient.CreateUserTokenRequest{
+				wrongTokenType, err := srv.Auth().NewUserToken(ctx, authclient.CreateUserTokenRequest{
 					Name: "llama",
 					TTL:  5 * time.Minute,
 					Type: authclient.UserTokenTypeResetPassword,
@@ -1057,7 +1060,7 @@ func TestGetAccountRecoveryToken(t *testing.T) {
 			name:      "recovery start token",
 			tokenType: authclient.UserTokenTypeRecoveryStart,
 			getRequest: func() *proto.GetAccountRecoveryTokenRequest {
-				token, err := srv.Auth().createRecoveryToken(ctx, "llama", authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				token, err := srv.Auth().CreateRecoveryToken(ctx, "llama", authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.GetAccountRecoveryTokenRequest{
@@ -1069,7 +1072,7 @@ func TestGetAccountRecoveryToken(t *testing.T) {
 			name:      "recovery approve token",
 			tokenType: authclient.UserTokenTypeRecoveryApproved,
 			getRequest: func() *proto.GetAccountRecoveryTokenRequest {
-				token, err := srv.Auth().createRecoveryToken(ctx, "llama", authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				token, err := srv.Auth().CreateRecoveryToken(ctx, "llama", authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.GetAccountRecoveryTokenRequest{
@@ -1101,7 +1104,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -1118,7 +1121,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 	require.NoError(t, err)
 
 	const user = "llama@example.com"
-	_, _, err = CreateUserAndRole(srv.Auth(), user, []string{user}, nil /* allowRules */)
+	_, _, err = authtest.CreateUserAndRole(srv.Auth(), user, []string{user}, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole failed")
 
 	cases := []struct {
@@ -1130,7 +1133,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 			name:    "invalid token type",
 			wantErr: true,
 			getRequest: func() *proto.CreateAccountRecoveryCodesRequest {
-				token, err := srv.Auth().createRecoveryToken(ctx, user, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				token, err := srv.Auth().CreateRecoveryToken(ctx, user, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.CreateAccountRecoveryCodesRequest{
@@ -1151,7 +1154,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 			name:    "invalid user name",
 			wantErr: true,
 			getRequest: func() *proto.CreateAccountRecoveryCodesRequest {
-				token, err := srv.Auth().createRecoveryToken(ctx, "invalid-username", authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				token, err := srv.Auth().CreateRecoveryToken(ctx, "invalid-username", authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.CreateAccountRecoveryCodesRequest{
@@ -1162,7 +1165,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 		{
 			name: "recovery approved token",
 			getRequest: func() *proto.CreateAccountRecoveryCodesRequest {
-				token, err := srv.Auth().createRecoveryToken(ctx, user, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
+				token, err := srv.Auth().CreateRecoveryToken(ctx, user, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
 				require.NoError(t, err)
 
 				return &proto.CreateAccountRecoveryCodesRequest{
@@ -1173,7 +1176,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 		{
 			name: "privilege token",
 			getRequest: func() *proto.CreateAccountRecoveryCodesRequest {
-				token, err := srv.Auth().createPrivilegeToken(ctx, user, authclient.UserTokenTypePrivilege)
+				token, err := auth.CreatePrivilegeToken(ctx, srv.Auth(), user, authclient.UserTokenTypePrivilege)
 				require.NoError(t, err)
 
 				return &proto.CreateAccountRecoveryCodesRequest{
@@ -1194,7 +1197,7 @@ func TestCreateAccountRecoveryCodes(t *testing.T) {
 
 			default:
 				require.NoError(t, err)
-				require.Len(t, res.GetCodes(), numOfRecoveryCodes)
+				require.Len(t, res.GetCodes(), auth.NumOfRecoveryCodes)
 				require.NotEmpty(t, res.GetCreated())
 
 				// Check token is deleted after success.
@@ -1209,7 +1212,7 @@ func TestGetAccountRecoveryCodes(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -1229,7 +1232,7 @@ func TestGetAccountRecoveryCodes(t *testing.T) {
 	u, err := createUserWithSecondFactors(srv)
 	require.NoError(t, err)
 
-	clt, err := srv.NewClient(TestUser(u.username))
+	clt, err := srv.NewClient(authtest.TestUser(u.username))
 	require.NoError(t, err)
 
 	rc, err := clt.GetAccountRecoveryCodes(ctx, &proto.GetAccountRecoveryCodesRequest{})
@@ -1238,9 +1241,9 @@ func TestGetAccountRecoveryCodes(t *testing.T) {
 	require.NotEmpty(t, rc.Created)
 }
 
-func triggerLoginLock(t *testing.T, srv *Server, username string) {
+func triggerLoginLock(t *testing.T, srv *auth.Server, username string) {
 	for i := 1; i <= defaults.MaxLoginAttempts; i++ {
-		_, _, _, err := srv.authenticateUser(
+		_, _, _, err := srv.AuthenticateUser(
 			context.Background(),
 			authclient.AuthenticateUserRequest{
 				Username: username,
@@ -1252,9 +1255,9 @@ func triggerLoginLock(t *testing.T, srv *Server, username string) {
 
 		// Test last attempt returns locked error.
 		if i == defaults.MaxLoginAttempts {
-			require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
+			require.Equal(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 		} else {
-			require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
+			require.NotEqual(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 		}
 	}
 }
@@ -1264,10 +1267,10 @@ type userAuthCreds struct {
 	username      string
 	password      []byte
 
-	totpDev, webDev *TestDevice
+	totpDev, webDev *authtest.Device
 }
 
-func createUserWithSecondFactors(testServer *TestTLSServer) (*userAuthCreds, error) {
+func createUserWithSecondFactors(testServer *authtest.TLSServer) (*userAuthCreds, error) {
 	ctx := context.Background()
 	username := fmt.Sprintf("llama%v@goteleport.com", rand.Int())
 	password := []byte("abcdef123456")
@@ -1289,7 +1292,7 @@ func createUserWithSecondFactors(testServer *TestTLSServer) (*userAuthCreds, err
 		return nil, trace.Wrap(err)
 	}
 
-	_, _, err = CreateUserAndRole(authServer, username, []string{username}, nil)
+	_, _, err = authtest.CreateUserAndRole(authServer, username, []string{username}, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1309,7 +1312,7 @@ func createUserWithSecondFactors(testServer *TestTLSServer) (*userAuthCreds, err
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	webDev, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+	webDev, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1322,7 +1325,7 @@ func createUserWithSecondFactors(testServer *TestTLSServer) (*userAuthCreds, err
 		return nil, trace.Wrap(err)
 	}
 
-	userClient, err := testServer.NewClient(TestUser(username))
+	userClient, err := testServer.NewClient(authtest.TestUser(username))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1338,12 +1341,12 @@ func createUserWithSecondFactors(testServer *TestTLSServer) (*userAuthCreds, err
 	webDev.MFA = devicesResp.Devices[0]
 
 	// Register a TOTP device.
-	totpDev, err := RegisterTestDevice(
+	totpDev, err := authtest.RegisterTestDevice(
 		ctx,
 		userClient,
 		"otp-1", proto.DeviceType_DEVICE_TYPE_TOTP,
 		webDev, /* authenticator */
-		WithTestDeviceClock(testServer.Clock()))
+		authtest.WithTestDeviceClock(testServer.Clock()))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1383,7 +1386,7 @@ func TestProquint(t *testing.T) {
 		addr4 := addr.As4()
 
 		hi, lo := binary.BigEndian.Uint16(addr4[:2]), binary.BigEndian.Uint16(addr4[2:])
-		proquint := encodeProquint(hi) + "-" + encodeProquint(lo)
+		proquint := auth.EncodeProquint(hi) + "-" + auth.EncodeProquint(lo)
 		require.Equal(t, tc.proquint, proquint, "wrong encoding for address %v", addr)
 	}
 }
diff --git a/lib/auth/agent_version_report.go b/lib/auth/agent_version_report.go
deleted file mode 100644
index 6dc3c4fc7f7af..0000000000000
--- a/lib/auth/agent_version_report.go
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"time"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/gravitational/teleport/api/constants"
-	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/autoupdate"
-	"github.com/gravitational/teleport/lib/inventory"
-)
-
-const (
-	omissionReasonUpdaterDisabled   = "updater is disabled"
-	omissionReasonUpdaterPinned     = "updater is pinning a specific version"
-	omissionReasonUpdaterUnreadable = "agent cannot read updater status"
-	omissionReasonUpdaterUnknown    = "unknown updater status"
-	omissionReasonUpdaterV1         = "managed updates v1 updater does not support agent reports"
-	omissionReasonUpdaterTooOld     = "updater version does not support agent reports"
-	omissionReasonNoUpdater         = "agent has no updater"
-)
-
-type instanceReport struct {
-	data      map[string]instanceGroupReport
-	timestamp time.Time
-	omissions map[string]int
-}
-
-func (ir instanceReport) collectInstance(handle inventory.UpstreamHandle) {
-	// If the instance is being soft-reloaded or shut down, we ignore it.
-	if goodbye := handle.Goodbye(); goodbye.GetSoftReload() || goodbye.GetDeleteResources() {
-		return
-	}
-
-	// We skip servers that joined less than a minute ago as they might have been
-	// connected to another auth instance a few seconds ago, which would lead to double-counting.
-	if ir.timestamp.Sub(handle.RegistrationTime()) < constants.AutoUpdateAgentReportPeriod {
-		return
-	}
-	// We skip control planes instances because we don't update them.
-	if handle.HasControlPlaneService() {
-		return
-	}
-
-	hello := handle.Hello()
-
-	switch hello.ExternalUpgrader {
-	case "":
-		ir.omissions[omissionReasonNoUpdater] += 1
-		return
-	case types.UpgraderKindSystemdUnit:
-		ir.omissions[omissionReasonUpdaterV1] += 1
-		return
-	}
-
-	// If the machine has no updater, we skip it
-	if hello.ExternalUpgrader == "" {
-		return
-	}
-
-	// Reject instance not advertising updater info
-	updaterInfo := hello.GetUpdaterInfo()
-	if updaterInfo == nil {
-		ir.omissions[omissionReasonUpdaterTooOld] += 1
-		return
-	}
-
-	// Reject instances who are not advertising the group properly.
-	// They might be running too old versions.
-	updateGroup := updaterInfo.UpdateGroup
-	if updateGroup == "" {
-		ir.omissions[omissionReasonUpdaterTooOld] += 1
-		return
-	}
-
-	// We skip instances whose updater status is not OK.
-	status := updaterInfo.UpdaterStatus
-	switch status {
-	case types.UpdaterStatus_UPDATER_STATUS_OK:
-	case types.UpdaterStatus_UPDATER_STATUS_DISABLED:
-		ir.omissions[omissionReasonUpdaterDisabled] += 1
-		return
-	case types.UpdaterStatus_UPDATER_STATUS_PINNED:
-		ir.omissions[omissionReasonUpdaterPinned] += 1
-		return
-	case types.UpdaterStatus_UPDATER_STATUS_UNREADABLE:
-		ir.omissions[omissionReasonUpdaterUnreadable] += 1
-		return
-	default:
-		ir.omissions[omissionReasonUpdaterUnknown] += 1
-		return
-	}
-
-	if _, ok := ir.data[updateGroup]; !ok {
-		ir.data[updateGroup] = instanceGroupReport{}
-	}
-
-	ir.data[updateGroup].collectInstance(handle)
-}
-
-type instanceGroupReport map[string]instanceGroupVersionReport
-
-func (ir instanceGroupReport) collectInstance(handle inventory.UpstreamHandle) {
-	hello := handle.Hello()
-
-	stats, ok := ir[hello.Version]
-	if !ok {
-		stats = instanceGroupVersionReport{}
-	}
-
-	stats.count += 1
-
-	ir[hello.Version] = stats
-}
-
-type instanceGroupVersionReport struct {
-	count int
-	// Leaving room here to add the lowest UUID, as described in RFD 184.
-}
-
-func (a *Server) generateAgentVersionReport(ctx context.Context) (*autoupdatev1pb.AutoUpdateAgentReport, error) {
-	now := a.clock.Now()
-
-	a.logger.DebugContext(ctx, "Collecting agent versions from inventory")
-	rawreport := instanceReport{
-		timestamp: now,
-		data:      make(map[string]instanceGroupReport),
-		omissions: make(map[string]int),
-	}
-	a.inventory.AllHandles(rawreport.collectInstance)
-
-	a.logger.DebugContext(ctx, "Building the agent version report")
-	spec := &autoupdatev1pb.AutoUpdateAgentReportSpec{
-		Timestamp: timestamppb.New(a.clock.Now()),
-		Groups:    make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup, len(rawreport.data)),
-		Omitted:   make([]*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted, 0, len(rawreport.omissions)),
-	}
-
-	// TODO(hugoShaka): gracefully handle too many groups or versions (sort and report only the largest ones).
-	// Currently the agent version report will just fail validation if there are too many groups.
-
-	for groupName, groupData := range rawreport.data {
-		versions := make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion, len(groupData))
-		for versionName, groupVersionData := range groupData {
-			versions[versionName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-				Count: int32(groupVersionData.count),
-			}
-		}
-		spec.Groups[groupName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-			Versions: versions,
-		}
-	}
-
-	for reason, count := range rawreport.omissions {
-		spec.Omitted = append(spec.Omitted, &autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
-			Reason: reason,
-			Count:  int64(count),
-		})
-	}
-
-	report, err := autoupdate.NewAutoUpdateAgentReport(spec, a.ServerID)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to generate agent version report")
-	}
-
-	return report, nil
-}
-
-func (a *Server) reportAgentVersions(ctx context.Context) {
-	if _, err := a.GetAutoUpdateAgentRollout(ctx); err != nil {
-		if trace.IsNotFound(err) {
-			a.logger.DebugContext(ctx, "Skipping periodic agent report because the cluster doesn't contain an autoupdate_agent_rollout.")
-			return
-		}
-		a.logger.WarnContext(ctx, "Failed to check if autoupdate_agent_rollout resource exists, aborting periodic agent report", "error", err)
-	}
-
-	a.logger.DebugContext(ctx, "Periodic agent version report routine started")
-	report, err := a.generateAgentVersionReport(ctx)
-	if err != nil {
-		a.logger.WarnContext(ctx, "Failed to report agent versions", "error", err)
-		return
-	}
-
-	a.logger.DebugContext(ctx, "Writing agent version report to the backend", "name", report.GetMetadata().GetName())
-	_, err = a.UpsertAutoUpdateAgentReport(ctx, report)
-	if err != nil {
-		a.logger.ErrorContext(ctx, "Failed to write agent version report", "error", err)
-	}
-	a.logger.DebugContext(ctx, "Finished exporting the agent version report")
-
-}
diff --git a/lib/auth/agent_version_report_test.go b/lib/auth/agent_version_report_test.go
deleted file mode 100644
index edd85d28b6fa1..0000000000000
--- a/lib/auth/agent_version_report_test.go
+++ /dev/null
@@ -1,342 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/uuid"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/autoupdate"
-	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/inventory"
-	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func newFakeControlStream() fakeControlStream {
-	return fakeControlStream{
-		msgChan:  make(chan proto.UpstreamInventoryMessage),
-		doneChan: make(chan struct{}),
-	}
-}
-
-type fakeControlStream struct {
-	client.UpstreamInventoryControlStream
-	msgChan  chan proto.UpstreamInventoryMessage
-	doneChan chan struct{}
-}
-
-func (f fakeControlStream) CloseWithError(err error) error {
-	return nil
-}
-
-func (f fakeControlStream) Close() error {
-	return nil
-}
-
-func (f fakeControlStream) Recv() <-chan proto.UpstreamInventoryMessage {
-	return f.msgChan
-}
-
-func (f fakeControlStream) Done() <-chan struct{} {
-	return f.doneChan
-}
-
-func (f fakeControlStream) fakeMsg(msg proto.UpstreamInventoryMessage) {
-	f.msgChan <- msg
-}
-
-func (f fakeControlStream) close() {
-	close(f.msgChan)
-}
-
-type fakeServer struct {
-	version       string
-	updateGroup   string
-	delay         time.Duration
-	roles         types.SystemRoles
-	updaterStatus types.UpdaterStatus
-	goodbye       *proto.UpstreamInventoryGoodbye
-}
-
-func TestServer_generateAgentVersionReport(t *testing.T) {
-	ctx := context.Background()
-	now := time.Now()
-	twoMinutesAgo := now.Add(-time.Minute * 2)
-	// agentRole are typicial roles an agent can have
-	agentRoles := types.SystemRoles{types.RoleNode, types.RoleApp}
-	updaterOK := types.UpdaterStatus_UPDATER_STATUS_OK
-
-	tests := []struct {
-		name     string
-		fixtures []fakeServer
-		expected *autoupdatev1pb.AutoUpdateAgentReportSpec
-	}{
-		{
-			name: "no servers",
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-			},
-		},
-		{
-			name: "no group, same version",
-			fixtures: []fakeServer{
-				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 4},
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "control plane servers are ignored",
-			fixtures: []fakeServer{
-				{version: "1.2.3", roles: types.SystemRoles{types.RoleKube, types.RoleAuth}, updateGroup: "default"},
-				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleProxy}, updateGroup: "default"},
-				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleKube}, updateGroup: "default"},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "disabled or pinned updaters are ignored",
-			fixtures: []fakeServer{
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_PINNED, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_DISABLED, updateGroup: "default"},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-						},
-					},
-				},
-				Omitted: []*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
-					{Reason: omissionReasonUpdaterPinned, Count: 1},
-					{Reason: omissionReasonUpdaterDisabled, Count: 1},
-				},
-			},
-		},
-		{
-			name: "reloaded and terminating instances are ignored",
-			fixtures: []fakeServer{
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{SoftReload: true}},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{DeleteResources: true}},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "too recent servers are ignored",
-			fixtures: []fakeServer{
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", delay: 90 * time.Second, roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "multiple versions and groups",
-			fixtures: []fakeServer{
-				{version: "1.2.3", updateGroup: "default", roles: agentRoles, updaterStatus: updaterOK},
-				{version: "1.2.4", updateGroup: "default", roles: agentRoles, updaterStatus: updaterOK},
-				{version: "1.2.5", updateGroup: "prod", roles: agentRoles, updaterStatus: updaterOK},
-				{version: "1.2.5", updateGroup: "prod", roles: agentRoles, updaterStatus: updaterOK},
-				{version: "1.2.5", updateGroup: "dev", roles: agentRoles, updaterStatus: updaterOK},
-			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
-				Timestamp: timestamppb.New(now),
-				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-							"1.2.4": {Count: 1},
-						},
-					},
-					"dev": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.5": {Count: 1},
-						},
-					},
-					"prod": {
-						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.5": {Count: 2},
-						},
-					},
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			clock := clockwork.NewFakeClockAt(twoMinutesAgo)
-			auth := &Server{
-				logger:   utils.NewSlogLoggerForTests(),
-				ServerID: uuid.NewString(),
-			}
-			controller := inventory.NewController(auth, nil, inventory.WithClock(clock))
-			for _, fixture := range tt.fixtures {
-				clock.Advance(fixture.delay)
-				stream := newFakeControlStream()
-				status := fixture.updaterStatus
-				if status == types.UpdaterStatus_UPDATER_STATUS_UNSPECIFIED {
-					status = types.UpdaterStatus_UPDATER_STATUS_OK
-				}
-				controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
-					Services:         fixture.roles.StringSlice(),
-					ServerID:         uuid.New().String(),
-					Version:          fixture.version,
-					ExternalUpgrader: types.UpgraderKindTeleportUpdate,
-					UpdaterInfo:      &types.UpdaterV2Info{UpdaterStatus: status, UpdateGroup: fixture.updateGroup},
-				})
-				if fixture.goodbye != nil {
-					stream.fakeMsg(fixture.goodbye)
-				}
-				t.Cleanup(stream.close)
-			}
-			auth.inventory = controller
-			auth.clock = clockwork.NewFakeClockAt(now)
-
-			report, err := auth.generateAgentVersionReport(ctx)
-			require.NoError(t, err)
-			require.Empty(t, cmp.Diff(
-				tt.expected, report.GetSpec(),
-				protocmp.Transform(),
-				protocmp.SortRepeatedFields(&autoupdatev1pb.AutoUpdateAgentReportSpec{}, "omitted")))
-		})
-	}
-}
-
-func TestServer_reportAgentVersions(t *testing.T) {
-	// Test setup: create auth.
-	bk, err := memory.New(memory.Config{})
-	require.NoError(t, err)
-
-	svc, err := local.NewAutoUpdateService(bk)
-	require.NoError(t, err)
-
-	now := time.Now()
-	twoMinutesAgo := now.Add(-time.Minute * 2)
-	clock := clockwork.NewFakeClockAt(twoMinutesAgo)
-
-	// Test setup: load fixtures.
-	const testNodeCount = 10
-	auth := &Server{
-		clock:    clock,
-		ServerID: uuid.NewString(),
-		Services: &Services{AutoUpdateService: svc},
-		logger:   utils.NewSlogLoggerForTests(),
-	}
-	auth.Cache = auth.Services
-	controller := inventory.NewController(auth, nil, inventory.WithClock(clock))
-	auth.inventory = controller
-
-	for range testNodeCount {
-		stream := newFakeControlStream()
-		controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
-			Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
-			Version:          "1.2.3",
-			ServerID:         uuid.NewString(),
-			ExternalUpgrader: types.UpgraderKindTeleportUpdate,
-			UpdaterInfo: &types.UpdaterV2Info{
-				UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
-				UpdateGroup:   "default",
-			},
-		})
-		t.Cleanup(stream.close)
-	}
-	ctx := context.Background()
-	rollout, err := autoupdate.NewAutoUpdateAgentRollout(&autoupdatev1pb.AutoUpdateAgentRolloutSpec{
-		StartVersion:              "1.2.3",
-		TargetVersion:             "1.2.4",
-		Schedule:                  autoupdate.AgentsScheduleRegular,
-		AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
-		Strategy:                  autoupdate.AgentsStrategyHaltOnError,
-		MaintenanceWindowDuration: nil,
-	})
-	require.NoError(t, err)
-	_, err = svc.CreateAutoUpdateAgentRollout(ctx, rollout)
-	require.NoError(t, err)
-
-	// Test execution: compute and write report.
-	clock.Advance(2 * time.Minute)
-	auth.reportAgentVersions(ctx)
-
-	// Test validation
-	report, err := svc.GetAutoUpdateAgentReport(ctx, auth.ServerID)
-	require.NoError(t, err)
-
-	require.NotNil(t, report)
-	require.NotEmpty(t, report.GetSpec().GetGroups())
-	require.NotNil(t, report.GetSpec().GetGroups()["default"])
-	require.NotNil(t, report.GetSpec().GetGroups()["default"].GetVersions())
-	require.NotNil(t, report.GetSpec().GetGroups()["default"].GetVersions()["1.2.3"])
-	require.Equal(t, testNodeCount, int(report.GetSpec().GetGroups()["default"].GetVersions()["1.2.3"].GetCount()))
-}
diff --git a/lib/auth/apiserver.go b/lib/auth/apiserver.go
index f86d1e22a81ed..bc391cf1f842e 100644
--- a/lib/auth/apiserver.go
+++ b/lib/auth/apiserver.go
@@ -44,11 +44,12 @@ import (
 )
 
 type APIConfig struct {
-	PluginRegistry plugin.Registry
-	AuthServer     *Server
-	AuditLog       events.AuditLogSessionStreamer
-	Authorizer     authz.Authorizer
-	Emitter        apievents.Emitter
+	PluginRegistry   plugin.Registry
+	AuthServer       *Server
+	AuditLog         events.AuditLogSessionStreamer
+	Authorizer       authz.Authorizer
+	ScopedAuthorizer authz.ScopedAuthorizer
+	Emitter          apievents.Emitter
 	// KeepAlivePeriod defines period between keep alives
 	KeepAlivePeriod time.Duration
 	// KeepAliveCount specifies amount of missed keep alives
@@ -62,6 +63,9 @@ type APIConfig struct {
 	// MutateRevocationsServiceConfig is a function that allows to mutate
 	// the revocation service configuration for testing.
 	MutateRevocationsServiceConfig func(config *workloadidentityv1.RevocationServiceConfig)
+	// OracleHTTPClient (optional) overrides the HTTP client used to make
+	// requests to the Oracle API for the Oracle join method.
+	OracleHTTPClient utils.HTTPDoClient
 }
 
 // CheckAndSetDefaults checks and sets default values
@@ -119,9 +123,11 @@ func NewAPIServer(config *APIConfig) (http.Handler, error) {
 	// Servers and presence heartbeat
 	srv.POST("/:version/namespaces/:namespace/nodes/keepalive", srv.WithAuth(srv.keepAliveNode))
 	srv.POST("/:version/authservers", srv.WithAuth(srv.upsertAuthServer))
-	srv.GET("/:version/authservers", srv.WithAuth(srv.getAuthServers))
+	// TODO(kiosion) DELETE IN 21.0.0
+	srv.GET("/:version/authservers", srv.WithScopedAuth(srv.getAuthServers))
 	srv.POST("/:version/proxies", srv.WithAuth(srv.upsertProxy))
-	srv.GET("/:version/proxies", srv.WithAuth(srv.getProxies))
+	// TODO(kiosion) DELETE IN 21.0.0
+	srv.GET("/:version/proxies", srv.WithScopedAuth(srv.getProxies))
 	srv.DELETE("/:version/proxies", srv.WithAuth(srv.deleteAllProxies))
 	srv.DELETE("/:version/proxies/:name", srv.WithAuth(srv.deleteProxy))
 	srv.POST("/:version/tunnelconnections", srv.WithAuth(srv.upsertTunnelConnection))
@@ -186,6 +192,7 @@ func (s *APIServer) WithAuth(handler HandlerWithAuthFunc) httprouter.Handle {
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+
 		auth := &ServerWithRoles{
 			authServer: s.AuthServer,
 			context:    *authContext,
@@ -199,6 +206,32 @@ func (s *APIServer) WithAuth(handler HandlerWithAuthFunc) httprouter.Handle {
 	})
 }
 
+func (s *APIServer) WithScopedAuth(handler HandlerWithAuthFunc) httprouter.Handle {
+	return httplib.MakeHandler(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+		// HTTPS server expects auth context to be set by the auth middleware
+		scopedContext, err := s.ScopedAuthorizer.AuthorizeScoped(r.Context())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		authContext, ok := scopedContext.UnscopedContext()
+		if !ok {
+			authContext = &authz.Context{}
+		}
+
+		auth := &ServerWithRoles{
+			authServer:    s.AuthServer,
+			context:       *authContext,
+			scopedContext: scopedContext,
+			alog:          s.AuthServer,
+		}
+		version := p.ByName("version")
+		if version == "" {
+			return nil, trace.BadParameter("missing version")
+		}
+		return handler(auth, w, r, p, version)
+	})
+}
+
 type upsertServerRawReq struct {
 	Server json.RawMessage `json:"server"`
 	TTL    time.Duration   `json:"ttl"`
@@ -282,7 +315,10 @@ func (s *APIServer) upsertProxy(auth *ServerWithRoles, w http.ResponseWriter, r
 }
 
 // getProxies returns registered proxies
+//
+// TODO(kiosion) DELETE IN 21.0.0
 func (s *APIServer) getProxies(auth *ServerWithRoles, w http.ResponseWriter, r *http.Request, p httprouter.Params, version string) (interface{}, error) {
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 	servers, err := auth.GetProxies()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -318,7 +354,10 @@ func (s *APIServer) upsertAuthServer(auth *ServerWithRoles, w http.ResponseWrite
 }
 
 // getAuthServers returns registered auth servers
+//
+// TODO(kiosion) DELETE IN 21.0.0
 func (s *APIServer) getAuthServers(auth *ServerWithRoles, w http.ResponseWriter, r *http.Request, p httprouter.Params, version string) (interface{}, error) {
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 	servers, err := auth.GetAuthServers()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -459,6 +498,9 @@ type githubAuthRawResponse struct {
 	// HostSigners is a list of signing host public keys
 	// trusted by proxy, used in console login
 	HostSigners []json.RawMessage `json:"host_signers"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions authclient.ClientOptions `json:"client_options"`
 }
 
 /*
@@ -478,11 +520,12 @@ func (s *APIServer) validateGithubAuthCallback(auth *ServerWithRoles, w http.Res
 		return nil, trace.Wrap(err)
 	}
 	raw := githubAuthRawResponse{
-		Username: response.Username,
-		Identity: response.Identity,
-		Cert:     response.Cert,
-		TLSCert:  response.TLSCert,
-		Req:      response.Req,
+		Username:      response.Username,
+		Identity:      response.Identity,
+		Cert:          response.Cert,
+		TLSCert:       response.TLSCert,
+		Req:           response.Req,
+		ClientOptions: response.ClientOptions,
 	}
 	if response.Session != nil {
 		rawSession, err := services.MarshalWebSession(
diff --git a/lib/auth/apiserver_test.go b/lib/auth/apiserver_test.go
index b330f20a3d12f..66740b4e324a4 100644
--- a/lib/auth/apiserver_test.go
+++ b/lib/auth/apiserver_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"bytes"
@@ -33,6 +33,7 @@ import (
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -115,13 +116,13 @@ func TestUpsertServer(t *testing.T) {
 			// Create a fake HTTP request.
 			inSrv, err := services.MarshalServer(tt.reqServer)
 			require.NoError(t, err)
-			body, err := json.Marshal(upsertServerRawReq{Server: inSrv})
+			body, err := json.Marshal(auth.UpsertServerRawReq{Server: inSrv})
 			require.NoError(t, err)
 			req := httptest.NewRequest(http.MethodPost, "http://localhost", bytes.NewReader(body))
 			req.RemoteAddr = remoteAddr
 			req.Header.Add("Content-Type", "application/json")
 
-			_, err = new(APIServer).upsertServer(s, tt.role, req, httprouter.Params{httprouter.Param{Key: "namespace", Value: apidefaults.Namespace}})
+			_, err = auth.UpsertServer(new(auth.APIServer), s, tt.role, req, httprouter.Params{httprouter.Param{Key: "namespace", Value: apidefaults.Namespace}})
 			tt.assertErr(t, err)
 			if err != nil {
 				return
@@ -133,8 +134,10 @@ func TestUpsertServer(t *testing.T) {
 				require.NoError(t, err)
 				allServers = append(allServers, servers...)
 			}
+			//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 			addServers(s.GetAuthServers())
 			addServers(s.GetNodes(ctx, apidefaults.Namespace))
+			//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 			addServers(s.GetProxies())
 			require.Empty(t, cmp.Diff(allServers, []types.Server{tt.wantServer}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 		})
diff --git a/lib/auth/app_access_aws_credentials.go b/lib/auth/app_access_aws_credentials.go
new file mode 100644
index 0000000000000..952c720b997a1
--- /dev/null
+++ b/lib/auth/app_access_aws_credentials.go
@@ -0,0 +1,142 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
+)
+
+var errAppWithoutAWSClientSideCredentials = errors.New("target resource is not an application that sends credentials to the client")
+
+// generateAWSClientSideCredentials generates AWS Credentials for the given application.
+// If the target resource is not an application with an associated AWS Roles Anywhere integration,
+// it returns errAppWithoutAWSClientSideCredentials error, which should be handled gracefully by the caller.
+//
+// The AWS Credentials returned are in the format expected by the AWS CLI/SDK config file `credential_process` (usually located at ~/.aws/config).
+// Expected format documentation: https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html
+func generateAWSClientSideCredentials(
+	ctx context.Context,
+	a *Server,
+	req certRequest,
+	notAfter time.Time,
+) (string, error) {
+	if req.appName == "" || req.awsRoleARN == "" {
+		return "", errAppWithoutAWSClientSideCredentials
+	}
+
+	appInfo, err := getAppServerByName(ctx, a, req.appName)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	// Only integrations can generate credentials.
+	integrationName := appInfo.GetIntegration()
+	if integrationName == "" {
+		return "", errAppWithoutAWSClientSideCredentials
+	}
+
+	integration, err := a.GetIntegration(ctx, integrationName)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	switch integration.GetSubKind() {
+	case types.IntegrationSubKindAWSRolesAnywhere:
+		// Only AWS Roles Anywhere integrations can generate credentials.
+		return generateAWSRolesAnywhereCredentials(ctx, a, req, appInfo, integration, notAfter)
+
+	case types.IntegrationSubKindAWSOIDC:
+		// AWS access using AWS OIDC integration will proxy requests, but will not send any credentials to the client.
+		return "", errAppWithoutAWSClientSideCredentials
+
+	default:
+		return "", trace.BadParameter("application %q is using integration %q for access, which does not support AWS credential generation", req.appName, integrationName)
+	}
+}
+
+func getAppServerByName(ctx context.Context, a *Server, appServerName string) (types.Application, error) {
+	appServers, err := a.GetApplicationServers(ctx, apidefaults.Namespace)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	for _, s := range appServers {
+		if s.GetName() == appServerName {
+			return s.GetApp(), nil
+		}
+	}
+	return nil, trace.NotFound("application %q not found", appServerName)
+}
+
+func generateAWSRolesAnywhereCredentials(
+	ctx context.Context,
+	a *Server,
+	req certRequest,
+	appInfo types.Application,
+	integration types.Integration,
+	notAfter time.Time,
+) (string, error) {
+	integrationSpec := integration.GetAWSRolesAnywhereIntegrationSpec()
+	if integrationSpec == nil || integrationSpec.TrustAnchorARN == "" {
+		return "", trace.BadParameter("roles anywhere integration %q does not have a valid spec", integration.GetName())
+	}
+
+	awsProfileARN := appInfo.GetAWSRolesAnywhereProfileARN()
+	acceptRoleSessionName := appInfo.GetAWSRolesAnywhereAcceptRoleSessionName()
+	if awsProfileARN == "" {
+		return "", trace.BadParameter("application %q does not have a valid AWS Roles Anywhere Profile ARN", req.appName)
+	}
+
+	durationSeconds := int(notAfter.Sub(a.clock.Now()).Seconds())
+
+	generateCredentialsRequest := awsra.GenerateCredentialsRequest{
+		Clock:                 a.clock,
+		TrustAnchorARN:        integrationSpec.TrustAnchorARN,
+		ProfileARN:            awsProfileARN,
+		RoleARN:               req.awsRoleARN,
+		SubjectCommonName:     req.user.GetName(),
+		KeyStoreManager:       a.keyStore,
+		AcceptRoleSessionName: acceptRoleSessionName,
+		DurationSeconds:       &durationSeconds,
+		Cache:                 a.Cache,
+	}
+
+	// Replace by the override function if it is set.
+	// This method does an HTTP call to AWS services, so this is useful for mocking that call.
+	// Only used in tests.
+	if a.AWSRolesAnywhereCreateSessionOverride != nil {
+		generateCredentialsRequest.CreateSession = a.AWSRolesAnywhereCreateSessionOverride
+	}
+
+	resp, err := awsra.GenerateCredentials(ctx, generateCredentialsRequest)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	encodedCredentials, err := resp.EncodeCredentialProcessFormat()
+	return encodedCredentials, trace.Wrap(err)
+}
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index cf689942be48a..e74f7d9dafca3 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -32,13 +32,13 @@ import (
 	"crypto/rand"
 	"crypto/subtle"
 	"crypto/x509"
+	"encoding/base32"
 	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"maps"
-	"math/big"
 	mathrand "math/rand/v2"
 	"net"
 	"os"
@@ -72,6 +72,7 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/metadata"
@@ -81,6 +82,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
 	"github.com/gravitational/teleport/api/utils/retryutils"
@@ -89,28 +91,42 @@ import (
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/auth/machineid/workloadidentityv1"
 	"github.com/gravitational/teleport/lib/auth/okta"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/auth/userloginstate"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/azuredevops"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/bitbucket"
 	"github.com/gravitational/teleport/lib/boundkeypair"
 	"github.com/gravitational/teleport/lib/cache"
-	"github.com/gravitational/teleport/lib/circleci"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/decision"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/devicetrust/assertserver"
 	dtconfig "github.com/gravitational/teleport/lib/devicetrust/config"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/gcp"
-	"github.com/gravitational/teleport/lib/githubactions"
-	"github.com/gravitational/teleport/lib/gitlab"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
 	"github.com/gravitational/teleport/lib/inventory"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/join"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	joinboundkeypair "github.com/gravitational/teleport/lib/join/boundkeypair"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/ec2join"
+	"github.com/gravitational/teleport/lib/join/env0"
+	"github.com/gravitational/teleport/lib/join/gcp"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
+	"github.com/gravitational/teleport/lib/join/tpmjoin"
 	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/loginrule"
@@ -119,15 +135,14 @@ import (
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/release"
 	"github.com/gravitational/teleport/lib/resourceusage"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccesscache "github.com/gravitational/teleport/lib/scopes/cache/access"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/services/readonly"
-	"github.com/gravitational/teleport/lib/spacelift"
-	"github.com/gravitational/teleport/lib/srv/db/common/role"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/terraformcloud"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/tpm"
 	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
@@ -176,7 +191,19 @@ const (
 const (
 	notificationsPageReadInterval = 5 * time.Millisecond
 	notificationsWriteInterval    = 40 * time.Millisecond
-	accessListsPageReadInterval   = 5 * time.Millisecond
+
+	accessListsPageReadInterval = 5 * time.Millisecond
+	accessListsPageSize         = 20
+)
+
+const (
+	// tagUserAgentType is a prometheus label for identifying user agent type
+	// of Teleport client (e.g. web or api).
+	tagUserAgentType = "user_agent_type"
+	// tagProxyGroupID is a prometheus label for identifying the proxy group ID.
+	tagProxyGroupID = "proxy_group_id"
+	// tagVersion is a prometheus label for version of Teleport built.
+	tagVersion = "version"
 )
 
 var ErrRequiresEnterprise = services.ErrRequiresEnterprise
@@ -185,8 +212,15 @@ var ErrRequiresEnterprise = services.ErrRequiresEnterprise
 type ServerOption func(*Server) error
 
 // NewServer creates and configures a new Server instance
-func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
-	err := metrics.RegisterPrometheusCollectors(prometheusCollectors...)
+func NewServer(cfg *InitConfig, opts ...ServerOption) (as *Server, err error) {
+	closeCtx, cancelFunc := context.WithCancel(context.TODO())
+	defer func() {
+		if err != nil {
+			cancelFunc()
+		}
+	}()
+
+	err = metrics.RegisterPrometheusCollectors(prometheusCollectors...)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -222,6 +256,59 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		}
 		cfg.ClusterConfiguration = clusterConfig
 	}
+	if cfg.KeyStore == nil {
+		keystoreOpts := &keystore.Options{
+			HostUUID:             cfg.HostUUID,
+			ClusterName:          cfg.ClusterName,
+			AuthPreferenceGetter: cfg.ClusterConfiguration,
+			FIPS:                 cfg.FIPS,
+		}
+		if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
+			if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+				return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
+			}
+		} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
+			if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+				return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
+			}
+		} else if cfg.KeyStoreConfig.AWSKMS != nil {
+			if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+				return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
+			}
+		}
+		cfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	if cfg.RecordingEncryption == nil {
+		localRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		recordingEncryptionManager, err := recordingencryption.NewManager(closeCtx, recordingencryption.ManagerConfig{
+			Backend:                       localRecordingEncryption,
+			Cache:                         localRecordingEncryption,
+			ClusterConfig:                 cfg.ClusterConfiguration,
+			KeyStore:                      cfg.KeyStore,
+			Logger:                        cfg.Logger,
+			InitialSessionRecordingConfig: cfg.SessionRecordingConfig,
+			LockConfig: backend.RunWhileLockedConfig{
+				LockConfiguration: backend.LockConfiguration{
+					Backend:            cfg.Backend,
+					TTL:                time.Second * 30,
+					LockNameComponents: []string{"recording_encryption"},
+				},
+			},
+		})
+		if err != nil {
+			return nil, trace.Wrap(err, "initializing session recording encryption")
+		}
+
+		cfg.RecordingEncryption = recordingEncryptionManager
+		cfg.ClusterConfiguration = recordingEncryptionManager
+	}
 	if cfg.AutoUpdateService == nil {
 		cfg.AutoUpdateService, err = local.NewAutoUpdateService(cfg.Backend)
 		if err != nil {
@@ -417,6 +504,23 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		}
 		cfg.WorkloadIdentity = workloadIdentity
 	}
+	if cfg.Summarizer == nil {
+		summarizer, err := local.NewSummarizerService(local.SummarizerServiceConfig{
+			Backend: cfg.Backend,
+			// TODO(bl-nero): Relax this condition once we implement spend controls.
+			EnableBedrock: !modules.GetModules().Features().Cloud,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err, "creating Summarizer service")
+		}
+		cfg.Summarizer = summarizer
+	}
+	if cfg.SessionSummarizerProvider == nil {
+		cfg.SessionSummarizerProvider = summarizer.NewSessionSummarizerProvider()
+	}
+	if cfg.RecordingMetadataProvider == nil {
+		cfg.RecordingMetadataProvider = recordingmetadata.NewProvider()
+	}
 	if cfg.WorkloadIdentityX509Revocations == nil {
 		cfg.WorkloadIdentityX509Revocations, err = local.NewWorkloadIdentityX509RevocationService(cfg.Backend)
 		if err != nil {
@@ -458,6 +562,9 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 			return nil, trace.Wrap(err, "creating VnetConfigService")
 		}
 	}
+	if cfg.ScopedAccess == nil {
+		cfg.ScopedAccess = local.NewScopedAccessService(cfg.Backend)
+	}
 
 	if cfg.Logger == nil {
 		cfg.Logger = slog.With(teleport.ComponentKey, teleport.ComponentAuth)
@@ -465,30 +572,6 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 
 	limiter := limiter.NewConnectionsLimiter(defaults.LimiterMaxConcurrentSignatures)
 
-	keystoreOpts := &keystore.Options{
-		HostUUID:             cfg.HostUUID,
-		ClusterName:          cfg.ClusterName,
-		AuthPreferenceGetter: cfg.ClusterConfiguration,
-		FIPS:                 cfg.FIPS,
-	}
-	if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
-		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
-			return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
-		}
-	} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
-		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
-			return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
-		}
-	} else if cfg.KeyStoreConfig.AWSKMS != nil {
-		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
-			return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
-		}
-	}
-	keyStore, err := keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	if cfg.KubeWaitingContainers == nil {
 		cfg.KubeWaitingContainers, err = local.NewKubeWaitingContainerService(cfg.Backend)
 		if err != nil {
@@ -510,7 +593,21 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		}
 	}
 
-	closeCtx, cancelFunc := context.WithCancel(context.TODO())
+	if cfg.ScopedTokenService == nil {
+		cfg.ScopedTokenService, err = local.NewScopedTokenService(cfg.Backend)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	scopedAccessCache, err := scopedaccesscache.NewCache(scopedaccesscache.CacheConfig{
+		Events: cfg.Events,
+		Reader: cfg.ScopedAccess,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	services := &Services{
 		TrustInternal:                   cfg.Trust,
 		PresenceInternal:                cfg.Presence,
@@ -521,7 +618,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		ClusterConfigurationInternal:    cfg.ClusterConfiguration,
 		AutoUpdateService:               cfg.AutoUpdateService,
 		Restrictions:                    cfg.Restrictions,
-		Apps:                            cfg.Apps,
+		Applications:                    cfg.Apps,
 		Kubernetes:                      cfg.Kubernetes,
 		Databases:                       cfg.Databases,
 		DatabaseServices:                cfg.DatabaseServices,
@@ -537,7 +634,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		UserTasks:                       cfg.UserTasks,
 		DiscoveryConfigs:                cfg.DiscoveryConfigs,
 		Okta:                            cfg.Okta,
-		AccessLists:                     cfg.AccessLists,
+		AccessListsInternal:             cfg.AccessLists,
 		DatabaseObjectImportRules:       cfg.DatabaseObjectImportRules,
 		DatabaseObjects:                 cfg.DatabaseObjects,
 		SecReports:                      cfg.SecReports,
@@ -566,31 +663,39 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		HealthCheckConfig:               cfg.HealthCheckConfig,
 		BackendInfoService:              cfg.BackendInfo,
 		VnetConfigService:               cfg.VnetConfigService,
-	}
-
-	as := Server{
-		bk:                      cfg.Backend,
-		clock:                   cfg.Clock,
-		limiter:                 limiter,
-		Authority:               cfg.Authority,
-		AuthServiceName:         cfg.AuthServiceName,
-		ServerID:                cfg.HostUUID,
-		cancelFunc:              cancelFunc,
-		closeCtx:                closeCtx,
-		emitter:                 cfg.Emitter,
-		Streamer:                cfg.Streamer,
-		Unstable:                local.NewUnstableService(cfg.Backend, cfg.AssertionReplayService),
-		Services:                services,
-		Cache:                   services,
-		keyStore:                keyStore,
-		traceClient:             cfg.TraceClient,
-		fips:                    cfg.FIPS,
-		loadAllCAs:              cfg.LoadAllCAs,
-		httpClientForAWSSTS:     cfg.HTTPClientForAWSSTS,
-		accessMonitoringEnabled: cfg.AccessMonitoringEnabled,
-		logger:                  cfg.Logger,
-	}
-	as.inventory = inventory.NewController(&as, services,
+		MultipartHandler:                cfg.MultipartHandler,
+		Summarizer:                      cfg.Summarizer,
+		RecordingEncryptionManager:      cfg.RecordingEncryption,
+		ScopedTokenService:              cfg.ScopedTokenService,
+	}
+
+	as = &Server{
+		bk:                        cfg.Backend,
+		clock:                     cfg.Clock,
+		limiter:                   limiter,
+		Authority:                 cfg.Authority,
+		AuthServiceName:           cfg.AuthServiceName,
+		ServerID:                  cfg.HostUUID,
+		cancelFunc:                cancelFunc,
+		closeCtx:                  closeCtx,
+		emitter:                   cfg.Emitter,
+		Streamer:                  cfg.Streamer,
+		Unstable:                  local.NewUnstableService(cfg.Backend, cfg.AssertionReplayService),
+		Services:                  services,
+		Cache:                     services,
+		scopedAccessBackend:       cfg.ScopedAccess,
+		ScopedAccessCache:         scopedAccessCache,
+		keyStore:                  cfg.KeyStore,
+		traceClient:               cfg.TraceClient,
+		fips:                      cfg.FIPS,
+		loadAllCAs:                cfg.LoadAllCAs,
+		httpClientForAWSSTS:       cfg.HTTPClientForAWSSTS,
+		accessMonitoringEnabled:   cfg.AccessMonitoringEnabled,
+		logger:                    cfg.Logger,
+		sessionSummarizerProvider: cfg.SessionSummarizerProvider,
+		recordingMetadataProvider: cfg.RecordingMetadataProvider,
+	}
+	as.inventory = inventory.NewController(as, services,
 		inventory.WithAuthServerID(cfg.HostUUID),
 		inventory.WithClock(cfg.Clock),
 		inventory.WithOnConnect(func(s string) {
@@ -610,7 +715,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 	)
 
 	for _, o := range opts {
-		if err := o(&as); err != nil {
+		if err := o(as); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -673,13 +778,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		as.azureDevopsIDTokenValidator = azuredevops.NewIDTokenValidator()
 	}
 	if as.circleCITokenValidate == nil {
-		as.circleCITokenValidate = func(
-			ctx context.Context, organizationID, token string,
-		) (*circleci.IDTokenClaims, error) {
-			return circleci.ValidateToken(
-				ctx, circleci.IssuerURLTemplate, organizationID, token,
-			)
-		}
+		as.circleCITokenValidate = circleci.ValidateToken
 	}
 	if as.tpmValidator == nil {
 		as.tpmValidator = tpm.Validate
@@ -690,6 +789,14 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 	if as.k8sJWKSValidator == nil {
 		as.k8sJWKSValidator = kubetoken.ValidateTokenWithJWKS
 	}
+	if as.k8sOIDCValidator == nil {
+		validator, err := kubetoken.NewKubernetesOIDCTokenValidator()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		as.k8sOIDCValidator = validator
+	}
 
 	if as.gcpIDTokenValidator == nil {
 		as.gcpIDTokenValidator = gcp.NewIDTokenValidator(
@@ -706,17 +813,26 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 	}
 
 	if as.createBoundKeypairValidator == nil {
-		as.createBoundKeypairValidator = func(subject, clusterName string, publicKey crypto.PublicKey) (boundKeypairValidator, error) {
+		as.createBoundKeypairValidator = func(subject, clusterName string, publicKey crypto.PublicKey) (joinboundkeypair.BoundKeypairValidator, error) {
 			return boundkeypair.NewChallengeValidator(subject, clusterName, publicKey)
 		}
 	}
 
+	if as.env0IDTokenValidator == nil {
+		validator, err := env0.NewIDTokenValidator()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		as.env0IDTokenValidator = validator
+	}
+
 	// Add in a login hook for generating state during user login.
 	as.ulsGenerator, err = userloginstate.NewGenerator(userloginstate.GeneratorConfig{
 		Log:         as.logger,
-		AccessLists: &as,
-		Access:      &as,
-		UsageEvents: &as,
+		AccessLists: as,
+		Access:      as,
+		UsageEvents: as,
 		Clock:       cfg.Clock,
 		Emitter:     as.emitter,
 	})
@@ -734,11 +850,26 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		return nil, trace.Wrap(err)
 	}
 
+	as.BotInstanceVersionReporter, err = machineidv1.NewAutoUpdateVersionReporter(machineidv1.AutoUpdateVersionReporterConfig{
+		Clock: cfg.Clock,
+		Logger: as.logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentAuth, "bot-version-reporter"),
+		),
+		Semaphores: as,
+		HostUUID:   cfg.HostUUID,
+		Store:      as,
+		Cache:      as.Cache,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	if _, ok := as.getCache(); !ok {
 		as.logger.WarnContext(closeCtx, "Auth server starting without cache (may have negative performance implications)")
 	}
 
-	return &as, nil
+	return as, nil
 }
 
 // Services is a collection of services that are used by the auth server.
@@ -755,7 +886,7 @@ type Services struct {
 	services.DynamicAccessExt
 	services.ClusterConfigurationInternal
 	services.Restrictions
-	services.Apps
+	services.Applications
 	services.Kubernetes
 	services.Databases
 	services.DatabaseServices
@@ -771,7 +902,7 @@ type Services struct {
 	services.UserTasks
 	services.DiscoveryConfigs
 	services.Okta
-	services.AccessLists
+	services.AccessListsInternal
 	services.DatabaseObjectImportRules
 	services.DatabaseObjects
 	services.UserLoginStates
@@ -805,6 +936,10 @@ type Services struct {
 	services.HealthCheckConfig
 	services.BackendInfoService
 	services.VnetConfigService
+	events.MultipartHandler
+	services.Summarizer
+	RecordingEncryptionManager
+	services.ScopedTokenService
 }
 
 // GetWebSession returns existing web session described by req.
@@ -813,12 +948,6 @@ func (r *Services) GetWebSession(ctx context.Context, req types.GetWebSessionReq
 	return r.Identity.WebSessions().Get(ctx, req)
 }
 
-// GetWebToken returns existing web token described by req.
-// Implements ReadAccessPoint
-func (r *Services) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
-	return r.Identity.WebTokens().Get(ctx, req)
-}
-
 // GenerateAWSOIDCToken generates a token to be used to execute an AWS OIDC Integration action.
 func (r *Services) GenerateAWSOIDCToken(ctx context.Context, integration string) (string, error) {
 	return r.IntegrationsTokenGenerator.GenerateAWSOIDCToken(ctx, integration)
@@ -864,6 +993,19 @@ var (
 			Help: "Number of times there was a user login",
 		},
 	)
+	userLoginCountPerClient = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name:      "user_login_per_client",
+			Namespace: teleport.MetricNamespace,
+			Help: "The number of successful user authentications by client tool (tsh, tctl, etc.), client tool version, " +
+				"and proxy that handled the request. The metric is reset hourly. ",
+		},
+		[]string{
+			tagUserAgentType,
+			tagProxyGroupID,
+			tagVersion,
+		},
+	)
 
 	heartbeatsMissedByAuth = prometheus.NewGauge(
 		prometheus.GaugeOpts{
@@ -887,6 +1029,7 @@ var (
 			Help:      "The number of Teleport services that are connected to an auth server.",
 		},
 		[]string{
+			teleport.TagOS,
 			teleport.TagVersion,
 			teleport.TagAutomaticUpdates,
 		},
@@ -935,6 +1078,7 @@ var (
 		[]string{
 			teleport.TagUpgrader,
 			teleport.TagVersion,
+			teleport.TagUpgraderStatus,
 		},
 	)
 
@@ -956,15 +1100,28 @@ var (
 		[]string{teleport.TagPrivateKeyPolicy},
 	)
 
+	botInstancesMetric = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBotInstances,
+			Help:      "The number of bot instances across the entire cluster",
+		},
+		[]string{
+			teleport.TagVersion,
+			teleport.TagAutomaticUpdates,
+		},
+	)
+
 	prometheusCollectors = []prometheus.Collector{
 		generateRequestsCount, generateThrottledRequestsCount,
-		generateRequestsCurrent, generateRequestsLatencies, UserLoginCount, heartbeatsMissedByAuth,
+		generateRequestsCurrent, generateRequestsLatencies, UserLoginCount, userLoginCountPerClient, heartbeatsMissedByAuth,
 		registeredAgents, migrations,
 		totalInstancesMetric, enrolledInUpgradesMetric, upgraderCountsMetric,
 		accessRequestsCreatedMetric,
 		registeredAgentsInstallMethod,
 		userCertificatesGeneratedMetric,
 		roleCount,
+		botInstancesMetric,
 	}
 )
 
@@ -1040,6 +1197,13 @@ type Server struct {
 	// method on Services instead.
 	authclient.Cache
 
+	// ScopedAccessCache is a specialized cache that provides read methods for select
+	// scoped access control resources.
+	ScopedAccessCache *scopedaccesscache.Cache
+
+	// scopedAccessBackend is the backend service for scoped access control resources.
+	scopedAccessBackend services.ScopedAccess
+
 	// ReadOnlyCache is a specialized cache that provides read-only shared references
 	// in certain performance-critical paths where deserialization/cloning may be too
 	// expensive at scale.
@@ -1101,63 +1265,73 @@ type Server struct {
 	// within the cluster that don't have a direct connection to said collector
 	traceClient otlptrace.Client
 
-	// fips means FedRAMP/FIPS 140-2 compliant configuration was requested.
+	// fips means FedRAMP/FIPS compliant configuration was requested.
 	fips bool
 
 	// ghaIDTokenValidator allows ID tokens from GitHub Actions to be validated
 	// by the auth server. It can be overridden for the purpose of tests.
-	ghaIDTokenValidator ghaIDTokenValidator
+	ghaIDTokenValidator githubactions.GithubIDTokenValidator
 	// ghaIDTokenJWKSValidator allows ID tokens from GitHub Actions to be
 	// validated by the auth server using a known JWKS. It can be overridden for
 	// the purpose of tests.
-	ghaIDTokenJWKSValidator ghaIDTokenJWKSValidator
+	ghaIDTokenJWKSValidator githubactions.GithubIDTokenJWKSValidator
 
 	// spaceliftIDTokenValidator allows ID tokens from Spacelift to be validated
 	// by the auth server. It can be overridden for the purpose of tests.
-	spaceliftIDTokenValidator spaceliftIDTokenValidator
+	spaceliftIDTokenValidator spacelift.Validator
 
 	// gitlabIDTokenValidator allows ID tokens from GitLab CI to be validated by
 	// the auth server. It can be overridden for the purpose of tests.
-	gitlabIDTokenValidator gitlabIDTokenValidator
+	gitlabIDTokenValidator gitlab.Validator
 
 	// azureDevopsIDTokenValidator allows ID tokens from Azure DevOps to be
 	// validated by the auth server. It can be overridden for the purpose of
 	// tests.
-	azureDevopsIDTokenValidator azureDevopsIDTokenValidator
+	azureDevopsIDTokenValidator azuredevops.Validator
 
 	// tpmValidator allows TPMs to be validated by the auth server. It can be
 	// overridden for the purpose of tests.
-	tpmValidator func(
-		ctx context.Context, log *slog.Logger, params tpm.ValidateParams,
-	) (*tpm.ValidatedTPM, error)
+	tpmValidator tpmjoin.TPMValidator
 
 	// circleCITokenValidate allows ID tokens from CircleCI to be validated by
 	// the auth server. It can be overridden for the purpose of tests.
-	circleCITokenValidate func(ctx context.Context, organizationID, token string) (*circleci.IDTokenClaims, error)
+	circleCITokenValidate circleci.Validator
 
 	// k8sTokenReviewValidator allows tokens from Kubernetes to be validated
 	// by the auth server using k8s Token Review API. It can be overridden for
 	// the purpose of tests.
-	k8sTokenReviewValidator k8sTokenReviewValidator
+	k8sTokenReviewValidator kubetoken.InClusterValidator
 	// k8sJWKSValidator allows tokens from Kubernetes to be validated
 	// by the auth server using a known JWKS. It can be overridden for the
 	// purpose of tests.
-	k8sJWKSValidator k8sJWKSValidator
+	k8sJWKSValidator kubetoken.JWKSValidator
+	// k8sOIDCValidator allows tokens from Kubernetes to be validated by the
+	// auth server using a known OIDC endpoint. It can be overridden in tests.
+	k8sOIDCValidator *kubetoken.KubernetesOIDCTokenValidator
 
 	// gcpIDTokenValidator allows ID tokens from GCP to be validated by the auth
 	// server. It can be overridden for the purpose of tests.
-	gcpIDTokenValidator gcpIDTokenValidator
+	gcpIDTokenValidator gcp.Validator
 
 	// terraformIDTokenValidator allows JWTs from Terraform Cloud to be
 	// validated by the auth server using a known JWKS. It can be overridden for
 	// the purpose of tests.
-	terraformIDTokenValidator terraformCloudIDTokenValidator
+	terraformIDTokenValidator terraformcloud.Validator
 
-	bitbucketIDTokenValidator bitbucketIDTokenValidator
+	// bitbucketIDTokenValidator allows JWTs from Bitbucket to be validated by
+	// the auth server.
+	bitbucketIDTokenValidator bitbucket.Validator
 
 	// createBoundKeypairValidator is a helper to create new bound keypair
 	// challenge validators. Used to override the implementation used in tests.
-	createBoundKeypairValidator createBoundKeypairValidator
+	createBoundKeypairValidator joinboundkeypair.CreateBoundKeypairValidator
+
+	// env0IDTokenValidator is a helper to validate env0 OIDC tokens. Used to
+	// override the implementation used in tests.
+	env0IDTokenValidator join.Env0TokenValidator
+
+	// azureJoinConfig holds configuration for the Azure join method.
+	azureJoinConfig *azurejoin.AzureJoinConfig
 
 	// loadAllCAs tells tsh to load the host CAs for all clusters when trying to ssh into a node.
 	loadAllCAs bool
@@ -1177,6 +1351,10 @@ type Server struct {
 	// STS requests.
 	httpClientForAWSSTS utils.HTTPDoClient
 
+	// ec2ClientForEC2JoinMethod overrides the default client used for making
+	// requests to the AWS ec2 service during EC2 join attempt verification.
+	ec2ClientForEC2JoinMethod ec2join.EC2Client
+
 	// accessMonitoringEnabled is a flag that indicates whether access monitoring is enabled.
 	accessMonitoringEnabled bool
 
@@ -1205,12 +1383,32 @@ type Server struct {
 	// normally be fetched from the GitHub API. Used for testing.
 	GithubUserAndTeamsOverride func() (*GithubUserResponse, []GithubTeamResponse, error)
 
+	// AWSRolesAnywhereCreateSessionOverride overrides the AWS Roles Anywhere Create Session API wrapper with a mocked one.
+	// Used for testing.
+	AWSRolesAnywhereCreateSessionOverride func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error)
+
 	// sigstorePolicyEvaluator checks workload signatures and attestations
 	// against Sigstore policies.
 	sigstorePolicyEvaluator workloadidentityv1.SigstorePolicyEvaluator
 
 	// logger is the logger used by the auth server.
 	logger *slog.Logger
+
+	// sessionSummarizerProvider is a provider of the session summarizer service.
+	// It allows for late initialization of the summarizer in the enterprise
+	// plugin. The summarizer itself summarizes session recordings.
+	sessionSummarizerProvider *summarizer.SessionSummarizerProvider
+
+	// recordingMetadataProvider provides recording metadata for session recordings.
+	recordingMetadataProvider *recordingmetadata.Provider
+
+	// BotInstanceVersionReporter is called periodically to generate a report of
+	// the number of bot instances by version and update group.
+	BotInstanceVersionReporter *machineidv1.AutoUpdateVersionReporter
+
+	// EncryptedIO provides encryption for session related data such as
+	// recordings, thumbnails, and metadata.
+	EncryptedIO *recordingencryption.EncryptedIO
 }
 
 // SetSAMLService registers svc as the SAMLService that provides the SAML
@@ -1237,6 +1435,25 @@ func (a *Server) SetReleaseService(svc release.Client) {
 	a.releaseService = svc
 }
 
+// ScopedAccess returns an implementation of services.ScopedAccess with all read methods routed
+// to the scoped access cache.
+func (a *Server) ScopedAccess() services.ScopedAccess {
+	return struct {
+		services.ScopedAccessReader
+		services.ScopedAccessWriter
+	}{
+		ScopedAccessReader: a.ScopedAccessCache,
+		ScopedAccessWriter: a.scopedAccessBackend,
+	}
+}
+
+// ScopedRoleReader returns a read-only scoped role client. This is here to satisfy interfaces
+// used by agent-side logic, which only has access to the ScopedRoleReader subset of the
+// broader ScopedAccess interface.
+func (a *Server) ScopedRoleReader() services.ScopedRoleReader {
+	return a.ScopedAccessCache
+}
+
 // SetUpgradeWindowStartHourGetter sets the getter used to sync the ClusterMaintenanceConfig resource
 // with the cloud UpgradeWindowStartHour value.
 func (a *Server) SetUpgradeWindowStartHourGetter(fn func(context.Context) (int64, error)) {
@@ -1285,7 +1502,18 @@ func (a *Server) CallLoginHooks(ctx context.Context, user types.User) error {
 	if len(loginHooks) == 0 {
 		return nil
 	}
-
+	// Clone the input user so that hooks never mutate the original object.
+	//
+	// Currently, login hook share state via UserLoginState resources.
+	// The login hook calls GetUserLoginState to read the state, updates it,
+	// and then saves the changes  when a next looking hood loads the state from storage.
+	//
+	// Note: We intentionally do not write access-list–derived roles/traits back
+	// to the user record. Doing so could create inconsistencies with user objects
+	// provisioned by Entra ID / Okta Sync or via SCIM. If we choose to persist
+	// these attributes in the future, we should first define a single source of
+	// truth and a clear reconciliation strategy.
+	user = user.Clone()
 	var errs []error
 	for _, hook := range loginHooks {
 		errs = append(errs, hook(ctx, user))
@@ -1301,6 +1529,12 @@ func (a *Server) ResetLoginHooks() {
 	a.loginHooksMu.Unlock()
 }
 
+// SetSummarizerService sets an implementation of the summarizer service used
+// by this server and its underlying services.
+func (a *Server) SetSummarizerService(s summarizer.SessionSummarizer) {
+	a.sessionSummarizerProvider.SetSummarizer(s)
+}
+
 // CloseContext returns the close context
 func (a *Server) CloseContext() context.Context {
 	return a.closeCtx
@@ -1340,6 +1574,12 @@ func (a *Server) SetLockWatcher(lockWatcher *services.LockWatcher) {
 	a.lockWatcher = lockWatcher
 }
 
+// CheckLockInForce returns an AccessDenied error if there is a lock in force
+// matching at least one of the targets.
+func (a *Server) CheckLockInForce(mode constants.LockingMode, targets []types.LockTarget) error {
+	return a.checkLockInForce(mode, targets)
+}
+
 func (a *Server) checkLockInForce(mode constants.LockingMode, targets []types.LockTarget) error {
 	a.lock.RLock()
 	defer a.lock.RUnlock()
@@ -1455,6 +1695,9 @@ const (
 	roleCountKey
 	accessListReminderNotificationsKey
 	autoUpdateAgentReportKey
+	autoUpdateBotInstanceReportKey
+	autoUpdateBotInstanceMetricsKey
+	hourlyCleanUpKey
 )
 
 // runPeriodicOperations runs some periodic bookkeeping operations
@@ -1510,6 +1753,12 @@ func (a *Server) runPeriodicOperations() {
 			FirstDuration: retryutils.FullJitter(time.Hour),
 			Jitter:        retryutils.SeventhJitter,
 		},
+		interval.SubInterval[periodicIntervalKey]{
+			Key:           hourlyCleanUpKey,
+			Duration:      time.Hour,
+			FirstDuration: retryutils.FullJitter(time.Hour),
+			Jitter:        retryutils.SeventhJitter,
+		},
 	)
 
 	defer ticker.Stop()
@@ -1550,6 +1799,18 @@ func (a *Server) runPeriodicOperations() {
 			FirstDuration: retryutils.FullJitter(constants.AutoUpdateAgentReportPeriod),
 			// No jitter here, this is intentional and required for accurate tracking across auths.
 		})
+		ticker.Push(interval.SubInterval[periodicIntervalKey]{
+			Key:           autoUpdateBotInstanceReportKey,
+			Duration:      constants.AutoUpdateBotInstanceReportPeriod,
+			FirstDuration: retryutils.HalfJitter(10 * time.Second),
+			Jitter:        retryutils.SeventhJitter,
+		})
+		ticker.Push(interval.SubInterval[periodicIntervalKey]{
+			Key:           autoUpdateBotInstanceMetricsKey,
+			Duration:      constants.AutoUpdateAgentReportPeriod / 2,
+			FirstDuration: retryutils.HalfJitter(10 * time.Second),
+			Jitter:        retryutils.SeventhJitter,
+		})
 	}
 
 	if modules.GetModules().IsOSSBuild() {
@@ -1676,6 +1937,12 @@ func (a *Server) runPeriodicOperations() {
 				go a.CreateAccessListReminderNotifications(a.closeCtx)
 			case autoUpdateAgentReportKey:
 				go a.reportAgentVersions(a.closeCtx)
+			case autoUpdateBotInstanceReportKey:
+				go a.BotInstanceVersionReporter.Report(a.closeCtx)
+			case autoUpdateBotInstanceMetricsKey:
+				go a.updateBotInstanceMetrics()
+			case hourlyCleanUpKey:
+				userLoginCountPerClient.Reset()
 			}
 		}
 	}
@@ -1972,6 +2239,7 @@ func (a *Server) updateAgentMetrics() {
 	registeredAgents.Reset()
 	for agent, count := range imp.RegisteredAgentsCount() {
 		registeredAgents.With(prometheus.Labels{
+			teleport.TagOS:               agent.os,
 			teleport.TagVersion:          agent.version,
 			teleport.TagAutomaticUpdates: agent.automaticUpdates,
 		}).Set(float64(count))
@@ -1987,12 +2255,25 @@ func (a *Server) updateAgentMetrics() {
 	upgraderCountsMetric.Reset()
 	for metadata, count := range imp.UpgraderCounts() {
 		upgraderCountsMetric.With(prometheus.Labels{
-			teleport.TagUpgrader: metadata.upgraderType,
-			teleport.TagVersion:  metadata.version,
+			teleport.TagUpgrader:       metadata.upgraderType,
+			teleport.TagVersion:        metadata.version,
+			teleport.TagUpgraderStatus: metadata.status,
 		}).Set(float64(count))
 	}
 }
 
+func (a *Server) updateBotInstanceMetrics() {
+	report, err := a.GetAutoUpdateBotInstanceReport(a.closeCtx)
+	switch {
+	case trace.IsNotFound(err):
+		// No report to emit.
+	case err != nil:
+		a.logger.ErrorContext(a.closeCtx, "Failed to get bot instance report", "error", err)
+	default:
+		machineidv1.EmitInstancesMetric(report, botInstancesMetric)
+	}
+}
+
 var (
 	// remoteClusterRefreshLimit is the maximum number of backend updates that will be performed
 	// during periodic remote cluster connection status refresh.
@@ -2061,6 +2342,12 @@ func (a *Server) Close() error {
 		}
 	}
 
+	if a.ScopedAccessCache != nil {
+		if err := a.ScopedAccessCache.Close(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
 	if a.AccessRequestCache != nil {
 		if err := a.AccessRequestCache.Close(); err != nil {
 			errs = append(errs, err)
@@ -2095,6 +2382,13 @@ func (a *Server) SetClock(clock clockwork.Clock) {
 	a.clock = clock
 }
 
+// SetBcryptCost sets bcryptCostOverride, used in tests
+func (a *Server) SetBcryptCost(cost int) {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+	a.bcryptCostOverride = &cost
+}
+
 func (a *Server) SetSCIMService(scim services.SCIM) {
 	a.Services.SCIM = scim
 }
@@ -2295,8 +2589,12 @@ type certRequest struct {
 	// impersonator is a user who generates the certificate,
 	// is set when different from the user in the certificate
 	impersonator string
-	// checker is used to perform RBAC checks.
-	checker services.AccessChecker
+
+	// checker is an access checker that may either be scoped or unscoped. used to generate various
+	// certificate parameters, some of which differ depending on whether the cert being generated
+	// is scoped or not.
+	checker *services.SplitAccessChecker
+
 	// ttl is Duration of the certificate
 	ttl time.Duration
 	// compatibility is compatibility mode
@@ -2391,9 +2689,15 @@ type certRequest struct {
 	// botInstanceID is the unique identifier of the bot instance associated
 	// with this cert, if any
 	botInstanceID string
+	// joinToken is the name of the join token used to join, set only for bot
+	// identities. It is unset for token-joined bots, whose token names are
+	// secret values.
+	joinToken string
 	// joinAttributes holds attributes derived from attested metadata from the
 	// join process, should any exist.
 	joinAttributes *workloadidentityv1pb.JoinAttrs
+	// requesterName is the name of the service that sent the request.
+	requesterName proto.UserCertsRequest_Requester
 }
 
 // check verifies the cert request is valid.
@@ -2437,9 +2741,14 @@ func certRequestDeviceExtensions(ext tlsca.DeviceExtensions) certRequestOption {
 	}
 }
 
-// GetUserOrLoginState will return the given user or the login state associated with the user.
+// GetUserOrLoginState will return the given user login state or if not found, the user itself.
 func (a *Server) GetUserOrLoginState(ctx context.Context, username string) (services.UserState, error) {
-	return services.GetUserOrLoginState(ctx, a, username)
+	// use Services (real backend instead of cache) to make sure that the GetUserOrLoginState function
+	// return always the up-to-date user state.
+	// During Login webhooks evaluation the user state is created an upserted into backend where next Login steps
+	// fetches the state from store and relies to have the latest version.
+	// TODO(smallinsky): Get rid of sharing user state via backend and use the proper param forwarding instead.
+	return services.GetUserOrLoginState(ctx, a.Services, username)
 }
 
 func (a *Server) GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCertRequest) (*proto.OpenSSHCert, error) {
@@ -2506,7 +2815,7 @@ func (a *Server) GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCert
 		user:            req.User,
 		sshPublicKey:    req.PublicKey,
 		compatibility:   constants.CertificateFormatStandard,
-		checker:         checker,
+		checker:         services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to OpenSSH certs.
 		ttl:             sessionTTL,
 		traits:          req.User.GetTraits(),
 		routeToCluster:  req.Cluster,
@@ -2522,6 +2831,7 @@ func (a *Server) GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCert
 }
 
 // GenerateUserTestCertsRequest is a request to generate test certificates.
+// TODO(tross): Figure out how to move this into test only code.
 type GenerateUserTestCertsRequest struct {
 	SSHPubKey               []byte
 	TLSPubKey               []byte
@@ -2535,11 +2845,23 @@ type GenerateUserTestCertsRequest struct {
 	TLSAttestationStatement *hardwarekey.AttestationStatement
 	AppName                 string
 	AppSessionID            string
+	DeviceExtensions        DeviceExtensions
+	Renewable               bool
+	Generation              uint64
+	ActiveRequests          []string
+	KubernetesCluster       string
+	Usage                   []string
 }
 
 // GenerateUserTestCerts is used to generate user certificate, used internally for tests
+// TODO(tross): Figure out how to move this into test only code.
 func (a *Server) GenerateUserTestCerts(req GenerateUserTestCertsRequest) ([]byte, []byte, error) {
-	ctx := context.Background()
+	return a.GenerateUserTestCertsWithContext(context.TODO(), req)
+}
+
+// GenerateUserTestCertsWithContext is used to generate user certificate, used internally for tests
+// TODO(tross): Figure out how to move this into test only code.
+func (a *Server) GenerateUserTestCertsWithContext(ctx context.Context, req GenerateUserTestCertsRequest) ([]byte, []byte, error) {
 	userState, err := a.GetUserOrLoginState(ctx, req.Username)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -2554,14 +2876,14 @@ func (a *Server) GenerateUserTestCerts(req GenerateUserTestCertsRequest) ([]byte
 		return nil, nil, trace.Wrap(err)
 	}
 
-	certs, err := a.generateUserCert(ctx, certRequest{
+	certReq := certRequest{
 		user:                             userState,
 		ttl:                              req.TTL,
 		compatibility:                    req.Compatibility,
 		sshPublicKey:                     req.SSHPubKey,
 		tlsPublicKey:                     req.TLSPubKey,
 		routeToCluster:                   req.RouteToCluster,
-		checker:                          checker,
+		checker:                          services.NewUnscopedSplitAccessChecker(checker),
 		traits:                           userState.GetTraits(),
 		loginIP:                          req.PinnedIP,
 		pinIP:                            req.PinnedIP != "",
@@ -2570,7 +2892,20 @@ func (a *Server) GenerateUserTestCerts(req GenerateUserTestCertsRequest) ([]byte
 		tlsPublicKeyAttestationStatement: req.TLSAttestationStatement,
 		appName:                          req.AppName,
 		appSessionID:                     req.AppSessionID,
-	})
+		deviceExtensions:                 req.DeviceExtensions,
+		generation:                       req.Generation,
+		renewable:                        req.Renewable,
+		activeRequests:                   req.ActiveRequests,
+		kubernetesCluster:                req.KubernetesCluster,
+		usage:                            req.Usage,
+	}
+
+	if botName, isBot := userState.GetLabel(types.BotLabel); isBot {
+		certReq.botName = botName
+		certReq.botInstanceID = uuid.NewString()
+	}
+
+	certs, err := a.generateUserCert(ctx, certReq)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -2635,7 +2970,7 @@ func (a *Server) GenerateUserAppTestCert(req AppTestCertRequest) ([]byte, error)
 	certs, err := a.generateUserCert(ctx, certRequest{
 		user:         userState,
 		tlsPublicKey: req.PublicKey,
-		checker:      checker,
+		checker:      services.NewUnscopedSplitAccessChecker(checker),
 		ttl:          req.TTL,
 		// Set the login to be a random string. Application certificates are never
 		// used to log into servers but SSH certificate generation code requires a
@@ -2699,7 +3034,7 @@ func (a *Server) GenerateDatabaseTestCert(req DatabaseTestCertRequest) ([]byte,
 		tlsPublicKey: req.PublicKey,
 		loginIP:      req.PinnedIP,
 		pinIP:        req.PinnedIP != "",
-		checker:      checker,
+		checker:      services.NewUnscopedSplitAccessChecker(checker),
 		ttl:          time.Hour,
 		traits: map[string][]string{
 			constants.TraitLogins: {req.Username},
@@ -2843,7 +3178,7 @@ func (a *Server) AugmentWebSessionCertificates(ctx context.Context, opts *Augmen
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(*x509Identity, a)
+	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(*x509Identity)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -3033,7 +3368,7 @@ func (a *Server) augmentUserCertificates(
 		return nil, trace.Wrap(err)
 	}
 	if err := a.verifyLocksForUserCerts(verifyLocksForUserCertsReq{
-		checker:              opts.checker,
+		checker:              services.NewUnscopedSplitAccessChecker(opts.checker), // TODO(fspmarshall/scopes): add scoping support to AugmentUserCertificates.
 		defaultMode:          readOnlyAuthPref.GetLockingMode(),
 		username:             x509Identity.Username,
 		mfaVerified:          x509Identity.MFAVerified,
@@ -3089,7 +3424,7 @@ func (a *Server) augmentUserCertificates(
 	}
 
 	// Issue audit event on success, same as [Server.generateCert].
-	a.emitCertCreateEvent(ctx, newIdentity, notAfter)
+	a.emitCertCreateEvent(ctx, tlsCA, newIdentity, notAfter)
 
 	return &proto.Certs{
 		SSH: newAuthorizedKey,
@@ -3163,8 +3498,17 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		return nil, trace.Wrap(err)
 	}
 
-	if len(req.checker.GetAllowedResourceIDs()) > 0 && modules.GetModules().BuildType() != modules.BuildEnterprise {
-		return nil, fmt.Errorf("resource access requests: %w", ErrRequiresEnterprise)
+	if _, ok := req.checker.Scoped(); ok {
+		// require that the scope feature is enabled for scoped certificate creation
+		if err := scopes.AssertFeatureEnabled(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	if unscopedChecker, ok := req.checker.Unscoped(); ok {
+		if len(unscopedChecker.GetAllowedResourceIDs()) > 0 && modules.GetModules().BuildType() != modules.BuildEnterprise {
+			return nil, trace.Errorf("resource access requests: %w", ErrRequiresEnterprise)
+		}
 	}
 
 	// Reject the cert request if there is a matching lock in force.
@@ -3179,6 +3523,8 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		mfaVerified:          req.mfaVerified,
 		activeAccessRequests: req.activeRequests,
 		deviceID:             req.deviceExtensions.DeviceID,
+		botInstanceID:        req.botInstanceID,
+		joinToken:            req.joinToken,
 	}); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3189,8 +3535,21 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if certificateFormat == teleport.CertificateFormatUnspecified {
-		certificateFormat = req.checker.CertificateFormat()
+
+	// scoped identities must use the standard certificate format, unscoped identities may have their
+	// certificate format customized by request parameters and/or role settings.
+	if unscopedChecker, ok := req.checker.Unscoped(); ok {
+		if certificateFormat == teleport.CertificateFormatUnspecified {
+			certificateFormat = unscopedChecker.CertificateFormat()
+		}
+	} else {
+		switch certificateFormat {
+		case constants.CertificateFormatStandard:
+		case teleport.CertificateFormatUnspecified:
+			certificateFormat = constants.CertificateFormatStandard
+		default:
+			return nil, trace.BadParameter("certificate format %q is not supported for scoped access", certificateFormat)
+		}
 	}
 
 	var sessionTTL time.Duration
@@ -3208,7 +3567,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		// Take whatever was passed in. Pass in 0 to CheckLoginDuration so all
 		// logins are returned for the role set.
 		sessionTTL = req.ttl
-		allowedLogins, err = req.checker.CheckLoginDuration(0)
+		allowedLogins, err = req.checker.Common().CheckLoginDuration(0)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3216,11 +3575,11 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		// Adjust session TTL to the smaller of two values: the session TTL requested
 		// in tsh (possibly using default_session_ttl) or the session TTL for the
 		// role.
-		sessionTTL = req.checker.AdjustSessionTTL(req.ttl)
+		sessionTTL = req.checker.Common().AdjustSessionTTL(req.ttl)
 		// Return a list of logins that meet the session TTL limit. This means if
 		// the requested session TTL is larger than the max session TTL for a login,
 		// that login will not be included in the list of allowed logins.
-		allowedLogins, err = req.checker.CheckLoginDuration(sessionTTL)
+		allowedLogins, err = req.checker.Common().CheckLoginDuration(sessionTTL)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3228,7 +3587,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 	notAfter := a.clock.Now().UTC().Add(sessionTTL)
 
 	attestedKeyPolicy := keys.PrivateKeyPolicyNone
-	requiredKeyPolicy, err := req.checker.PrivateKeyPolicy(readOnlyAuthPref.GetPrivateKeyPolicy())
+	requiredKeyPolicy, err := req.checker.Common().PrivateKeyPolicy(readOnlyAuthPref.GetPrivateKeyPolicy())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3250,7 +3609,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 				sessionTTL:           sessionTTL,
 				readOnlyAuthPref:     readOnlyAuthPref,
 				userName:             req.user.GetName(),
-				userTraits:           req.checker.Traits(),
+				userTraits:           req.checker.Common().Traits(),
 			})
 			if err != nil {
 				return nil, trace.Wrap(err, "attesting SSH key")
@@ -3268,7 +3627,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 				sessionTTL:           sessionTTL,
 				readOnlyAuthPref:     readOnlyAuthPref,
 				userName:             req.user.GetName(),
-				userTraits:           req.checker.Traits(),
+				userTraits:           req.checker.Common().Traits(),
 			})
 			if err != nil {
 				return nil, trace.Wrap(err, "attesting TLS key")
@@ -3289,12 +3648,17 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		req.routeToCluster = clusterName
 	}
 	if req.routeToCluster != clusterName {
+		unscopedChecker, ok := req.checker.Unscoped()
+		if !ok {
+			return nil, trace.BadParameter("cannot generate certs for remote cluster %q, remote cluster access is only supported for unscoped certs", req.routeToCluster)
+		}
+
 		// Authorize access to a remote cluster.
 		rc, err := a.GetRemoteCluster(ctx, req.routeToCluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		if err := req.checker.CheckAccessToRemoteCluster(rc); err != nil {
+		if err := unscopedChecker.CheckAccessToRemoteCluster(rc); err != nil {
 			if trace.IsAccessDenied(err) {
 				return nil, trace.NotFound("remote cluster %q not found", req.routeToCluster)
 			}
@@ -3307,7 +3671,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 	allowedLogins = append(allowedLogins, teleport.SSHSessionJoinPrincipal)
 
 	pinnedIP := ""
-	if caType == types.UserCA && (req.checker.PinSourceIP() || req.pinIP) {
+	if caType == types.UserCA && (req.checker.Common().PinSourceIP() || req.pinIP) {
 		if req.loginIP == "" {
 			return nil, trace.BadParameter("IP pinning is enabled for user %q but there is no client IP information", req.user.GetName())
 		}
@@ -3330,6 +3694,22 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		githubUsername = githubIdentities[0].Username
 	}
 
+	// collect fields which are mutually exclusive to scoped or unscoped certs
+	var (
+		scopePin           *scopesv1.Pin
+		roleNames          []string
+		allowedResourceIDs []types.ResourceID
+	)
+
+	if scopedChecker, ok := req.checker.Scoped(); ok {
+		scopePin = scopedChecker.ScopePin()
+	}
+
+	if unscopedChecker, ok := req.checker.Unscoped(); ok {
+		roleNames = unscopedChecker.RoleNames()
+		allowedResourceIDs = unscopedChecker.GetAllowedResourceIDs()
+	}
+
 	var signedSSHCert []byte
 	if req.sshPublicKey != nil {
 		sshSigner, err := a.keyStore.GetSSHSigner(ctx, ca)
@@ -3337,6 +3717,12 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 			return nil, trace.Wrap(err)
 		}
 
+		// certificate extensions are only supported for unscoped ssh certs
+		var certificateExtensions []*types.CertExtension
+		if unscopedChecker, ok := req.checker.Unscoped(); ok {
+			certificateExtensions = unscopedChecker.CertificateExtensions()
+		}
+
 		params := sshca.UserCertificateRequest{
 			CASigner:          sshSigner,
 			PublicUserKey:     req.sshPublicKey,
@@ -3346,10 +3732,11 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 				Username:                req.user.GetName(),
 				Impersonator:            req.impersonator,
 				Principals:              allowedLogins,
-				Roles:                   req.checker.RoleNames(),
-				PermitPortForwarding:    req.checker.CanPortForward(),
-				PermitAgentForwarding:   req.checker.CanForwardAgents(),
-				PermitX11Forwarding:     req.checker.PermitX11Forwarding(),
+				ScopePin:                scopePin,
+				Roles:                   roleNames,
+				PermitPortForwarding:    req.checker.Common().CanPortForward(),
+				PermitAgentForwarding:   req.checker.Common().CanForwardAgents(),
+				PermitX11Forwarding:     req.checker.Common().PermitX11Forwarding(),
 				RouteToCluster:          req.routeToCluster,
 				Traits:                  req.traits,
 				ActiveRequests:          req.activeRequests,
@@ -3362,8 +3749,9 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 				Generation:              req.generation,
 				BotName:                 req.botName,
 				BotInstanceID:           req.botInstanceID,
-				CertificateExtensions:   req.checker.CertificateExtensions(),
-				AllowedResourceIDs:      req.checker.GetAllowedResourceIDs(),
+				JoinToken:               req.joinToken,
+				CertificateExtensions:   certificateExtensions,
+				AllowedResourceIDs:      allowedResourceIDs,
 				ConnectionDiagnosticID:  req.connectionDiagnosticID,
 				PrivateKeyPolicy:        attestedKeyPolicy,
 				DeviceID:                req.deviceExtensions.DeviceID,
@@ -3379,12 +3767,6 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		}
 	}
 
-	kubeGroups, kubeUsers, err := req.checker.CheckKubeGroupsAndUsers(sessionTTL, req.overrideRoleTTL)
-	// NotFound errors are acceptable - this user may have no k8s access
-	// granted and that shouldn't prevent us from issuing a TLS cert.
-	if err != nil && !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
-	}
 	// Ensure that the Kubernetes cluster name specified in the request exists
 	// when the certificate is intended for a local Kubernetes cluster.
 	// If the certificate is targeting a trusted Teleport cluster, it is the
@@ -3406,34 +3788,66 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		}
 	}
 
-	// See which database names and users this user is allowed to use.
-	dbNames, dbUsers, err := req.checker.CheckDatabaseNamesAndUsers(sessionTTL, req.overrideRoleTTL)
-	if err != nil && !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
-	}
+	var (
+		kubeGroups, kubeUsers []string
+		dbNames, dbUsers      []string
+		roleARNs              []string
+		azureIdentities       []string
+		gcpAccounts           []string
+	)
 
-	// See which AWS role ARNs this user is allowed to assume.
-	roleARNs, err := req.checker.CheckAWSRoleARNs(sessionTTL, req.overrideRoleTTL)
-	if err != nil && !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
-	}
+	// only unscoped identities currently support kube groups/users.
+	if unscopedChecker, ok := req.checker.Unscoped(); ok {
+		kubeGroups, kubeUsers, err = unscopedChecker.CheckKubeGroupsAndUsers(sessionTTL, req.overrideRoleTTL)
+		// NotFound errors are acceptable - this user may have no k8s access
+		// granted and that shouldn't prevent us from issuing a TLS cert.
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
 
-	// See which Azure identities this user is allowed to assume.
-	azureIdentities, err := req.checker.CheckAzureIdentities(sessionTTL, req.overrideRoleTTL)
-	if err != nil && !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
+		// See which database names and users this user is allowed to use.
+		dbNames, dbUsers, err = unscopedChecker.CheckDatabaseNamesAndUsers(sessionTTL, req.overrideRoleTTL)
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+
+		// See which AWS role ARNs this user is allowed to assume.
+		roleARNs, err = unscopedChecker.CheckAWSRoleARNs(sessionTTL, req.overrideRoleTTL)
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+
+		// See which Azure identities this user is allowed to assume.
+		azureIdentities, err = unscopedChecker.CheckAzureIdentities(sessionTTL, req.overrideRoleTTL)
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+
+		// Enumerate allowed GCP service accounts.
+		gcpAccounts, err = unscopedChecker.CheckGCPServiceAccounts(sessionTTL, req.overrideRoleTTL)
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
 	}
 
-	// Enumerate allowed GCP service accounts.
-	gcpAccounts, err := req.checker.CheckGCPServiceAccounts(sessionTTL, req.overrideRoleTTL)
-	if err != nil && !trace.IsNotFound(err) {
+	// Generate AWS client side credentials if the user is trying to access an AWS App with an AWS Roles Anywhere Integration.
+	awsCredentialProcessCredentials, err := generateAWSClientSideCredentials(ctx, a, req, notAfter)
+	switch {
+	case errors.Is(err, errAppWithoutAWSClientSideCredentials):
+		// Requesting AWS credential_process credentials for Apps without AWS client side credentials is a client error.
+		if req.requesterName == proto.UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS {
+			return nil, trace.BadParameter("client requested aws credentials for an invalid resource")
+		}
+
+	case err != nil:
 		return nil, trace.Wrap(err)
 	}
 
 	identity := tlsca.Identity{
 		Username:          req.user.GetName(),
 		Impersonator:      req.impersonator,
-		Groups:            req.checker.RoleNames(),
+		ScopePin:          scopePin,
+		Groups:            roleNames,
 		Principals:        allowedLogins,
 		Usage:             req.usage,
 		RouteToCluster:    req.routeToCluster,
@@ -3442,17 +3856,19 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		KubernetesGroups:  kubeGroups,
 		KubernetesUsers:   kubeUsers,
 		RouteToApp: tlsca.RouteToApp{
-			SessionID:         req.appSessionID,
-			URI:               req.appURI,
-			TargetPort:        req.appTargetPort,
-			PublicAddr:        req.appPublicAddr,
-			ClusterName:       req.appClusterName,
-			Name:              req.appName,
-			AWSRoleARN:        req.awsRoleARN,
-			AzureIdentity:     req.azureIdentity,
-			GCPServiceAccount: req.gcpServiceAccount,
+			SessionID:                       req.appSessionID,
+			URI:                             req.appURI,
+			TargetPort:                      req.appTargetPort,
+			PublicAddr:                      req.appPublicAddr,
+			ClusterName:                     req.appClusterName,
+			Name:                            req.appName,
+			AWSRoleARN:                      req.awsRoleARN,
+			AWSCredentialProcessCredentials: awsCredentialProcessCredentials,
+			AzureIdentity:                   req.azureIdentity,
+			GCPServiceAccount:               req.gcpServiceAccount,
 		},
-		TeleportCluster: clusterName,
+		TeleportCluster:   clusterName,
+		OriginClusterName: clusterName,
 		RouteToDatabase: tlsca.RouteToDatabase{
 			ServiceName: req.dbService,
 			Protocol:    req.dbProtocol,
@@ -3475,7 +3891,8 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		Generation:              req.generation,
 		BotName:                 req.botName,
 		BotInstanceID:           req.botInstanceID,
-		AllowedResourceIDs:      req.checker.GetAllowedResourceIDs(),
+		JoinToken:               req.joinToken,
+		AllowedResourceIDs:      allowedResourceIDs,
 		PrivateKeyPolicy:        attestedKeyPolicy,
 		ConnectionDiagnosticID:  req.connectionDiagnosticID,
 		DeviceExtensions: tlsca.DeviceExtensions{
@@ -3488,6 +3905,7 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 	}
 
 	var signedTLSCert []byte
+	var tlsIssuer *tlsca.CertAuthority
 	if req.tlsPublicKey != nil {
 		tlsCryptoPubKey, err := keys.ParsePublicKey(req.tlsPublicKey)
 		if err != nil {
@@ -3515,9 +3933,10 @@ func generateCert(ctx context.Context, a *Server, req certRequest, caType types.
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		tlsIssuer = tlsCA
 	}
 
-	a.emitCertCreateEvent(ctx, &identity, notAfter)
+	a.emitCertCreateEvent(ctx, tlsIssuer, &identity, notAfter)
 
 	// create certs struct to return to user
 	certs := &proto.Certs{
@@ -3624,8 +4043,8 @@ func (a *Server) attestHardwareKey(ctx context.Context, params *attestHardwareKe
 }
 
 type verifyLocksForUserCertsReq struct {
-	checker services.AccessChecker
-
+	// checker is a split access checker which may be scoped or unscoped.
+	checker *services.SplitAccessChecker
 	// defaultMode is the default locking mode, as recorded in the cluster
 	// Auth Preferences.
 	defaultMode constants.LockingMode
@@ -3641,25 +4060,40 @@ type verifyLocksForUserCertsReq struct {
 	// deviceID is the trusted device ID.
 	// Eg: tlsca.Identity.DeviceExtensions.DeviceID
 	deviceID string
+	// botInstanceID is the bot instance UUID, set only for bots.
+	botInstanceID string
+	// joinMethod is the join token name, set only for non-token bots.
+	joinToken string
 }
 
 // verifyLocksForUserCerts verifies if any locks are in place before issuing new
 // user certificates.
 func (a *Server) verifyLocksForUserCerts(req verifyLocksForUserCertsReq) error {
-	checker := req.checker
-	lockingMode := checker.LockingMode(req.defaultMode)
+	lockingMode := req.checker.Common().LockingMode(req.defaultMode)
 
 	lockTargets := []types.LockTarget{
 		{User: req.username},
 		{MFADevice: req.mfaVerified},
 		{Device: req.deviceID},
 	}
-	lockTargets = append(lockTargets,
-		services.RolesToLockTargets(checker.RoleNames())...,
-	)
+
+	if unscopedChecker, ok := req.checker.Unscoped(); ok {
+		lockTargets = append(lockTargets,
+			services.RolesToLockTargets(unscopedChecker.RoleNames())...,
+		)
+	}
+
+	// TODO(fspmarshall/scopes): implement scoped role locking.
+
 	lockTargets = append(lockTargets,
 		services.AccessRequestsToLockTargets(req.activeAccessRequests)...,
 	)
+	if req.botInstanceID != "" {
+		lockTargets = append(lockTargets, types.LockTarget{BotInstanceID: req.botInstanceID})
+	}
+	if req.joinToken != "" {
+		lockTargets = append(lockTargets, types.LockTarget{JoinToken: req.joinToken})
+	}
 
 	return trace.Wrap(a.checkLockInForce(lockingMode, lockTargets))
 }
@@ -3692,9 +4126,17 @@ func (a *Server) getSigningCAs(ctx context.Context, domainName string, caType ty
 	return tlsCA, sshSigner, ca, nil
 }
 
-func (a *Server) emitCertCreateEvent(ctx context.Context, identity *tlsca.Identity, notAfter time.Time) {
+func (a *Server) emitCertCreateEvent(ctx context.Context, issuer *tlsca.CertAuthority, identity *tlsca.Identity, notAfter time.Time) {
 	eventIdentity := identity.GetEventIdentity()
 	eventIdentity.Expires = notAfter
+	var certAuthority *apievents.CertificateAuthority
+	if issuer != nil {
+		certAuthority = &apievents.CertificateAuthority{
+			Type:         string(types.UserCA),
+			Domain:       issuer.Cert.Issuer.CommonName,
+			SubjectKeyID: base32.HexEncoding.EncodeToString(issuer.Cert.SubjectKeyId),
+		}
+	}
 	if err := a.emitter.EmitAuditEvent(a.closeCtx, &apievents.CertificateCreate{
 		Metadata: apievents.Metadata{
 			Type: events.CertificateCreateEvent,
@@ -3707,6 +4149,7 @@ func (a *Server) emitCertCreateEvent(ctx context.Context, identity *tlsca.Identi
 			// fetched. Need to propagate user-agent from HTTP calls.
 			UserAgent: trimUserAgent(metadata.UserAgentFromContext(ctx)),
 		},
+		CertificateAuthority: certAuthority,
 	}); err != nil {
 		a.logger.WarnContext(ctx, "Failed to emit certificate create event", "error", err)
 	}
@@ -3993,7 +4436,7 @@ func (a *Server) createTOTPPrivilegeToken(ctx context.Context, username string)
 		return nil, trace.Wrap(err)
 	}
 
-	token, err := a.newUserToken(tokenReq)
+	token, err := a.newUserToken(ctx, tokenReq)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4032,7 +4475,7 @@ func (a *Server) createRegisterChallenge(ctx context.Context, req *newRegisterCh
 			return nil, trace.BadParameter("all TOTP registrations require a privilege token")
 		}
 
-		otpKey, otpOpts, err := a.newTOTPKey(req.username)
+		otpKey, otpOpts, err := a.newTOTPKey(ctx, req.username)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -4499,7 +4942,7 @@ func (a *Server) ExtendWebSession(ctx context.Context, req authclient.WebSession
 		return nil, trace.NotFound("web session has expired")
 	}
 
-	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(identity, a)
+	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(identity)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4746,7 +5189,7 @@ func ExtractHostID(hostName string, clusterName string) (string, error) {
 
 // GenerateHostCerts generates new host certificates (signed
 // by the host certificate authority) for a node.
-func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequest) (*proto.Certs, error) {
+func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequest, scope string) (*proto.Certs, error) {
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4879,6 +5322,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 			ClusterName: clusterName.GetClusterName(),
 			SystemRole:  req.Role,
 			Principals:  req.AdditionalPrincipals,
+			AgentScope:  scope,
 		},
 	})
 	if err != nil {
@@ -4900,6 +5344,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 		Groups:          []string{req.Role.String()},
 		TeleportCluster: clusterName.GetClusterName(),
 		SystemRoles:     systemRoles,
+		AgentScope:      scope,
 	}
 	subject, err := identity.Subject()
 	if err != nil {
@@ -4918,13 +5363,21 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	certRequest.DNSNames = append(certRequest.DNSNames, DefaultDNSNamesForRole(req.Role)...)
 	// Unlike additional principals, DNS Names is x509 specific and is limited
 	// to services with TLS endpoints (e.g. auth, proxies, kubernetes)
-	if (types.SystemRoles{req.Role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleWindowsDesktop) {
+	if (types.SystemRoles{req.Role}).IncludeAny(
+		types.RoleAuth,
+		types.RoleAdmin,
+		types.RoleProxy,
+		types.RoleRelay,
+		types.RoleKube,
+		types.RoleWindowsDesktop,
+	) {
 		certRequest.DNSNames = append(certRequest.DNSNames, req.DNSNames...)
 	}
 	hostTLSCert, err := tlsAuthority.GenerateCertificate(certRequest)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	return &proto.Certs{
 		SSH:        hostSSHCert,
 		TLS:        hostTLSCert,
@@ -4958,13 +5411,15 @@ func (a *Server) RegisterInventoryControlStream(ics client.UpstreamInventoryCont
 		Version:  teleport.Version,
 		ServerID: a.ServerID,
 		Capabilities: &proto.DownstreamInventoryHello_SupportedCapabilities{
-			NodeHeartbeats:       true,
-			AppHeartbeats:        true,
-			AppCleanup:           true,
-			DatabaseHeartbeats:   true,
-			DatabaseCleanup:      true,
-			KubernetesHeartbeats: true,
-			KubernetesCleanup:    true,
+			NodeHeartbeats:                true,
+			AppHeartbeats:                 true,
+			AppCleanup:                    true,
+			DatabaseHeartbeats:            true,
+			DatabaseHeartbeatGracefulStop: true,
+			DatabaseCleanup:               true,
+			KubernetesHeartbeats:          true,
+			KubernetesCleanup:             true,
+			RelayServerHeartbeatsCleanup:  true,
 		},
 	}
 	if err := ics.Send(a.CloseContext(), downstreamHello); err != nil {
@@ -5087,7 +5542,7 @@ const TokenExpiredOrNotFound = "token expired or not found"
 // a list of roles this token allows its owner to assume and token labels, or an error if the token
 // cannot be found.
 func (a *Server) ValidateToken(ctx context.Context, token string) (types.ProvisionToken, error) {
-	tkns, err := a.GetStaticTokens()
+	tkns, err := a.GetStaticTokens(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -5142,7 +5597,7 @@ func (a *Server) checkTokenTTL(tok types.ProvisionToken) bool {
 }
 
 func (a *Server) DeleteToken(ctx context.Context, token string) (err error) {
-	tkns, err := a.GetStaticTokens()
+	tkns, err := a.GetStaticTokens(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -5166,14 +5621,25 @@ func (a *Server) DeleteToken(ctx context.Context, token string) (err error) {
 
 // GetTokens returns all tokens (machine provisioning ones and user tokens). Machine
 // tokens usually have "node roles", like auth,proxy,node and user invitation tokens have 'signup' role
-func (a *Server) GetTokens(ctx context.Context, opts ...services.MarshalOption) (tokens []types.ProvisionToken, err error) {
+// Deprecated: Use [ListProvisionTokens], [ListUserTokens], and [GetStaticTokens] instead.
+// TODO(hugoShaka): DELETE IN 21.0.0
+func (a *Server) GetTokens(ctx context.Context, opts ...services.MarshalOption) ([]types.ProvisionToken, error) {
 	// get node tokens:
-	tokens, err = a.Services.GetTokens(ctx)
+	tokens, err := iterstream.Collect(
+		clientutils.Resources(
+			ctx,
+			// ListProvisionTokens take too many arguments for [clientutils.Resources]
+			// so we wrap it to get the usual paginated signature.
+			func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+				return a.Services.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+			},
+		),
+	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	// get static tokens:
-	tkns, err := a.GetStaticTokens()
+	tkns, err := a.GetStaticTokens(ctx)
 	if err != nil && !trace.IsNotFound(err) {
 		return nil, trace.Wrap(err)
 	}
@@ -5181,9 +5647,9 @@ func (a *Server) GetTokens(ctx context.Context, opts ...services.MarshalOption)
 		tokens = append(tokens, tkns.GetStaticTokens()...)
 	}
 	// get user tokens:
-	userTokens, err := a.GetUserTokens(ctx)
+	userTokens, err := iterstream.Collect(clientutils.Resources(ctx, a.Services.ListUserTokens))
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, trace.Wrap(err, "retrieving user tokens")
 	}
 	// convert user tokens to machine tokens:
 	for _, t := range userTokens {
@@ -5311,10 +5777,37 @@ func (a *Server) CreateAccessRequestV2(ctx context.Context, req types.AccessRequ
 		return nil, trace.Wrap(err)
 	}
 
+	// Fetch all Access Lists from the Cache, for use in generating Request promotions and validating long-term grouping
+	allAccessLists, err := a.Cache.GetAccessLists(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var longTermResourceGrouping *types.LongTermResourceGrouping
+
+	if req.GetRequestKind().IsLongTerm() {
+		longTermResourceGrouping, err = a.generateLongTermResourceGrouping(ctx, req, allAccessLists)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if longTermResourceGrouping == nil {
+			return nil, trace.Errorf("Failed to find optimal resource grouping for long-term access")
+		}
+		if !longTermResourceGrouping.CanProceed && !req.GetDryRun() {
+			return nil, trace.BadParameter("%s", longTermResourceGrouping.ValidationMessage)
+		}
+	}
+
 	if req.GetDryRun() {
 		// NOTE: Some dry-run options are set in [services.ValidateAccessRequestForUser].
-		_, promotions := a.generateAccessRequestPromotions(ctx, req)
-		updateAccessRequestWithAdditionalReviewers(ctx, req, a.AccessLists, promotions)
+		_, promotions := a.generateAccessRequestPromotions(ctx, req, allAccessLists)
+		// TODO(kiosion): if long-term, skip promotion generation, and instead, use info from LongTermResourceGrouping to add additional reviewers.
+		updateAccessRequestWithAdditionalReviewers(ctx, req, a.AccessListsInternal, promotions)
+
+		if req.GetRequestKind().IsLongTerm() {
+			req.SetLongTermResourceGrouping(longTermResourceGrouping)
+		}
+
 		// Return before creating the request if this is a dry run.
 		return req, nil
 	}
@@ -5332,6 +5825,12 @@ func (a *Server) CreateAccessRequestV2(ctx context.Context, req types.AccessRequ
 		return nil, trace.Wrap(err)
 	}
 
+	// We want the long-term grouping info present in the returned request,
+	// but don't want it persisted via setting before saving the request.
+	if req.GetRequestKind().IsLongTerm() {
+		req.SetLongTermResourceGrouping(longTermResourceGrouping)
+	}
+
 	var annotations *apievents.Struct
 	if sa := req.GetSystemAnnotations(); len(sa) > 0 {
 		var err error
@@ -5366,7 +5865,7 @@ func (a *Server) CreateAccessRequestV2(ctx context.Context, req types.AccessRequ
 		a.logger.WarnContext(ctx, "Failed to emit access request create event", "error", err)
 	}
 
-	var resources = []string{}
+	resources := []string{}
 	if len(req.GetRoles()) != 0 {
 		resources = append(resources, types.KindRole)
 	}
@@ -5425,7 +5924,7 @@ func (a *Server) CreateAccessRequestV2(ctx context.Context, req types.AccessRequ
 	}
 
 	// calculate the promotions
-	reqCopy, promotions := a.generateAccessRequestPromotions(ctx, req)
+	reqCopy, promotions := a.generateAccessRequestPromotions(ctx, req, allAccessLists)
 	if promotions != nil {
 		// Create the promotion entry even if the allowed promotion is empty. Otherwise, we won't
 		// be able to distinguish between an allowed empty set and generation failure.
@@ -5482,8 +5981,7 @@ func (a *Server) appendImplicitlyRequiredResources(ctx context.Context, resource
 		// The UI needs access to the account associated with an Account Assignment
 		// in order to display the enclosing Account, otherwise the user will not
 		// be able to see their assigned permission sets.
-		assignmentID := services.IdentityCenterAccountAssignmentID(resource.Name)
-		asmt, err := a.Services.IdentityCenter.GetAccountAssignment(ctx, assignmentID)
+		asmt, err := a.GetIdentityCenterAccountAssignment(ctx, resource.Name)
 		if err != nil {
 			return nil, trace.Wrap(err, "fetching identity center account assignment")
 		}
@@ -5508,10 +6006,7 @@ func (a *Server) checkResourcesRequestable(ctx context.Context, resourceIDs []ty
 		return nil
 	}
 
-	err := okta.CheckResourcesRequestable(ctx, resourceIDs, okta.AccessPoint{
-		Plugins:              a.Plugins,
-		UnifiedResourceCache: a.UnifiedResourceCache,
-	})
+	err := okta.CheckResourcesRequestable(ctx, resourceIDs, a)
 	if errors.Is(err, okta.OktaResourceNotRequestableError) {
 		return trace.Wrap(err)
 	} else if err != nil {
@@ -5521,11 +6016,32 @@ func (a *Server) checkResourcesRequestable(ctx context.Context, resourceIDs []ty
 	return nil
 }
 
+// cacheWithFetchedAccessLists is a wrapper around authclient.Cache to provide pre-fetched Access Lists
+// for use in both generating long-term resource groupings, and generating access request promotions.
+// This avoids the need to fetch Access Lists from the backend multiple times per-CreateAccessRequest call.
+type cacheWithFetchedAccessLists struct {
+	authclient.Cache
+	fetchedACLs []*accesslist.AccessList
+}
+
+func (c *cacheWithFetchedAccessLists) GetAccessLists(context.Context) ([]*accesslist.AccessList, error) {
+	return c.fetchedACLs, nil
+}
+
+func (c *cacheWithFetchedAccessLists) ListAccessLists(context.Context, int, string) ([]*accesslist.AccessList, string, error) {
+	return c.fetchedACLs, "", nil
+}
+
+// generateLongTermResourceGrouping will validate and group resources based on coverage by access lists.
+func (a *Server) generateLongTermResourceGrouping(ctx context.Context, req types.AccessRequest, acls []*accesslist.AccessList) (*types.LongTermResourceGrouping, error) {
+	return modules.GetModules().GenerateLongTermResourceGrouping(ctx, &cacheWithFetchedAccessLists{a.Cache, acls}, req)
+}
+
 // generateAccessRequestPromotions will return potential access list promotions for an access request. On error, this function will log
 // the error and return whatever it has. The caller is expected to deal with the possibility of a nil promotions object.
-func (a *Server) generateAccessRequestPromotions(ctx context.Context, req types.AccessRequest) (types.AccessRequest, *types.AccessRequestAllowedPromotions) {
+func (a *Server) generateAccessRequestPromotions(ctx context.Context, req types.AccessRequest, acls []*accesslist.AccessList) (types.AccessRequest, *types.AccessRequestAllowedPromotions) {
 	reqCopy := req.Copy()
-	promotions, err := modules.GetModules().GenerateAccessRequestPromotions(ctx, a.Cache, reqCopy)
+	promotions, err := modules.GetModules().GenerateAccessRequestPromotions(ctx, &cacheWithFetchedAccessLists{a.Cache, acls}, reqCopy)
 	if err != nil {
 		// Do not fail the request if the promotions failed to generate.
 		// The request promotion will be blocked, but the request can still be approved.
@@ -5715,7 +6231,7 @@ func (a *Server) submitAccessReview(
 		a.logger.WarnContext(ctx, "Failed to emit access request update event", "error", err)
 	}
 
-	var resources = []string{}
+	resources := []string{}
 	if len(req.GetRoles()) != 0 {
 		resources = append(resources, types.KindRole)
 	}
@@ -6116,21 +6632,18 @@ func (a *Server) UpsertWindowsDesktop(ctx context.Context, desktop types.Windows
 	return nil
 }
 
-func (a *Server) streamWindowsDesktops(ctx context.Context, startKey string) stream.Stream[types.WindowsDesktop] {
+func (a *Server) streamWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) stream.Stream[types.WindowsDesktop] {
 	var done bool
 	return stream.PageFunc(func() ([]types.WindowsDesktop, error) {
 		if done {
 			return nil, io.EOF
 		}
-		resp, err := a.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-			Limit:    50,
-			StartKey: startKey,
-		})
+		resp, err := a.ListWindowsDesktops(ctx, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		startKey = resp.NextKey
-		done = startKey == ""
+		req.StartKey = resp.NextKey
+		done = req.StartKey == ""
 		return resp.Desktops, nil
 	})
 }
@@ -6165,7 +6678,7 @@ func (a *Server) desktopsLimitExceeded(ctx context.Context) (bool, error) {
 	}
 
 	desktops := stream.FilterMap(
-		a.streamWindowsDesktops(ctx, ""),
+		a.streamWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{Limit: 50}),
 		func(d types.WindowsDesktop) (struct{}, bool) {
 			return struct{}{}, d.NonAD()
 		},
@@ -6396,15 +6909,18 @@ func (a *Server) CreateAccessListReminderNotifications(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		}
-		response, nextKey, err := a.Cache.ListAccessLists(ctx, 20, accessListsPageKey)
+		response, nextKey, err := a.Cache.ListAccessLists(ctx, accessListsPageSize, accessListsPageKey)
 		if err != nil {
 			a.logger.WarnContext(ctx, "failed to list access lists for periodic reminder notification check", "error", err)
 		}
 
 		for _, al := range response {
-			daysDiff := int(al.Spec.Audit.NextAuditDate.Sub(now).Hours() / 24)
+			if !al.IsReviewable() {
+				continue
+			}
+
 			// Only keep access lists that fall within our thresholds in memory
-			if daysDiff <= 15 {
+			if al.Spec.Audit.NextAuditDate.Sub(now) <= 15*24*time.Hour {
 				accessLists = append(accessLists, al)
 			}
 		}
@@ -6435,16 +6951,12 @@ func (a *Server) CreateAccessListReminderNotifications(ctx context.Context) {
 		for _, al := range accessLists {
 			dueDate := al.Spec.Audit.NextAuditDate
 			timeDiff := dueDate.Sub(now)
-			daysDiff := int(timeDiff.Hours() / 24)
+			threshold := time.Hour * 24 * time.Duration(threshold.days)
 
-			if threshold.days < 0 {
-				if daysDiff <= threshold.days {
-					relevantLists = append(relevantLists, al)
-				}
-			} else {
-				if daysDiff >= 0 && daysDiff <= threshold.days {
-					relevantLists = append(relevantLists, al)
-				}
+			if threshold < 0 && timeDiff <= threshold {
+				relevantLists = append(relevantLists, al)
+			} else if timeDiff >= 0 && timeDiff <= threshold {
+				relevantLists = append(relevantLists, al)
 			}
 		}
 
@@ -6584,6 +7096,9 @@ func (a *Server) createAccessListReminderNotification(ctx context.Context, owner
 }
 
 // GenerateCertAuthorityCRL generates an empty CRL for the local CA of a given type.
+//
+// WARNING: This is not safe for use in clusters using HSMs or KMS for private key material.
+// Instead, you should prefer using the CRLs that are already present in the certificate_authority resource.
 func (a *Server) GenerateCertAuthorityCRL(ctx context.Context, caType types.CertAuthType) ([]byte, error) {
 	// Generate a CRL for the current cluster CA.
 	clusterName, err := a.GetClusterName(ctx)
@@ -6598,10 +7113,8 @@ func (a *Server) GenerateCertAuthorityCRL(ctx context.Context, caType types.Cert
 		return nil, trace.Wrap(err)
 	}
 
-	// TODO(awly): this will only create a CRL for an active signer.
-	// If there are multiple signers (multiple HSMs), we won't have the full CRL coverage.
-	// Generate a CRL per signer and return all of them separately.
-
+	// Note: this will only create a CRL for a single active signer.
+	// If there are multiple signers (HSMs), we won't have the full CRL coverage.
 	cert, signer, err := a.keyStore.GetTLSCertAndSigner(ctx, ca)
 	if trace.IsNotFound(err) {
 		// If there is no local TLS signer found in the host CA ActiveKeys, this
@@ -6618,13 +7131,8 @@ func (a *Server) GenerateCertAuthorityCRL(ctx context.Context, caType types.Cert
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	// Empty CRL valid for 1yr.
-	template := &x509.RevocationList{
-		Number:     big.NewInt(1),
-		ThisUpdate: time.Now().Add(-1 * time.Minute), // 1 min in the past to account for clock skew.
-		NextUpdate: time.Now().Add(365 * 24 * time.Hour),
-	}
-	crl, err := x509.CreateRevocationList(rand.Reader, template, tlsAuthority.Cert, tlsAuthority.Signer)
+
+	crl, err := keystore.GenerateCRL(tlsAuthority.Cert, tlsAuthority.Signer)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -6992,7 +7500,7 @@ func (a *Server) Ping(ctx context.Context) (proto.PingResponse, error) {
 		ClusterName:             cn.GetClusterName(),
 		ServerVersion:           teleport.Version,
 		ServerFeatures:          features,
-		ProxyPublicAddr:         a.getProxyPublicAddr(),
+		ProxyPublicAddr:         a.getProxyPublicAddr(ctx),
 		IsBoring:                modules.GetModules().IsBoringBinary(),
 		LoadAllCAs:              a.loadAllCAs,
 		SignatureAlgorithmSuite: authPref.GetSignatureAlgorithmSuite(),
@@ -7235,25 +7743,11 @@ func (a *Server) isMFARequired(ctx context.Context, checker services.AccessCheck
 			return nil, trace.NotFound("database service %q not found", t.Database.ServiceName)
 		}
 
-		autoCreate, err := checker.DatabaseAutoUserMode(db)
-		switch {
-		case errors.Is(err, services.ErrSessionMFARequired):
-			noMFAAccessErr = err
-		case err != nil:
-			return nil, trace.Wrap(err)
-		default:
-			dbRoleMatchers := role.GetDatabaseRoleMatchers(role.RoleMatchersConfig{
-				Database:       db,
-				DatabaseUser:   t.Database.Username,
-				DatabaseName:   t.Database.GetDatabase(),
-				AutoCreateUser: autoCreate.IsEnabled(),
-			})
-			noMFAAccessErr = checker.CheckAccess(
-				db,
-				services.AccessState{},
-				dbRoleMatchers...,
-			)
-		}
+		// Note that we are not checking RoleMatchers for db user/name/roles.
+		// Per-session MFA requirement is only tested on the resource itself by
+		// db_labels/db_labels_expression, so db user/name/roles are irrelevant.
+		// Those will be enforced at protocol level on the database service.
+		noMFAAccessErr = checker.CheckAccess(db, services.AccessState{})
 
 	case *proto.IsMFARequiredRequest_WindowsDesktop:
 		desktops, err := a.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{Name: t.WindowsDesktop.GetWindowsDesktop()})
@@ -7930,8 +8424,10 @@ func (a *Server) verifyAccessRequestMonthlyLimit(ctx context.Context) error {
 
 // getProxyPublicAddr returns the first valid, non-empty proxy public address it
 // finds, or empty otherwise.
-func (a *Server) getProxyPublicAddr() string {
-	if proxies, err := a.GetProxies(); err == nil {
+func (a *Server) getProxyPublicAddr(ctx context.Context) string {
+	if proxies, err := iterstream.Collect(
+		clientutils.Resources(ctx, a.ListProxyServers),
+	); err == nil {
 		for _, p := range proxies {
 			addr := p.GetPublicAddr()
 			if addr == "" {
diff --git a/lib/auth/auth_login_test.go b/lib/auth/auth_login_test.go
index 24a2e31ab9105..55149fd25e4cf 100644
--- a/lib/auth/auth_login_test.go
+++ b/lib/auth/auth_login_test.go
@@ -16,33 +16,47 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
 	"fmt"
+	"slices"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/sshca"
+	"github.com/gravitational/teleport/lib/tlsca"
 )
 
 func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
@@ -231,7 +245,7 @@ func TestCreateAuthenticateChallenge_WithAuth(t *testing.T) {
 	u, err := createUserWithSecondFactors(srv)
 	require.NoError(t, err)
 
-	clt, err := srv.NewClient(TestUser(u.username))
+	clt, err := srv.NewClient(authtest.TestUser(u.username))
 	require.NoError(t, err)
 
 	res, err := clt.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
@@ -327,9 +341,9 @@ func TestCreateAuthenticateChallenge_WithUserCredentials_WithLock(t *testing.T)
 
 		// Test last attempt returns locked error.
 		if i == defaults.MaxLoginAttempts {
-			require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
+			require.Equal(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 		} else {
-			require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
+			require.NotEqual(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 		}
 	}
 }
@@ -351,7 +365,7 @@ func TestCreateAuthenticateChallenge_WithRecoveryStartToken(t *testing.T) {
 			name:    "invalid token type",
 			wantErr: true,
 			getRequest: func() *proto.CreateAuthenticateChallengeRequest {
-				wrongToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+				wrongToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 				require.NoError(t, err)
 
 				return &proto.CreateAuthenticateChallengeRequest{
@@ -371,7 +385,7 @@ func TestCreateAuthenticateChallenge_WithRecoveryStartToken(t *testing.T) {
 		{
 			name: "valid token",
 			getRequest: func() *proto.CreateAuthenticateChallengeRequest {
-				startToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+				startToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 				require.NoError(t, err)
 
 				return &proto.CreateAuthenticateChallengeRequest{
@@ -405,7 +419,7 @@ func TestCreateAuthenticateChallenge_mfaVerification(t *testing.T) {
 	testServer := newTestTLSServer(t)
 	ctx := context.Background()
 
-	adminClient, err := testServer.NewClient(TestBuiltin(types.RoleAdmin))
+	adminClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err, "NewClient(types.RoleAdmin)")
 
 	// Register a couple of SSH nodes.
@@ -507,7 +521,7 @@ func TestCreateAuthenticateChallenge_mfaVerification(t *testing.T) {
 		_, err = adminClient.UpdateUser(ctx, user.(*types.UserV2))
 		require.NoError(t, err, "UpdateUser(%q)", username)
 
-		userClient, err := testServer.NewClient(TestUser(username))
+		userClient, err := testServer.NewClient(authtest.TestUser(username))
 		require.NoError(t, err, "NewClient(%q)", username)
 
 		return userClient
@@ -637,7 +651,7 @@ func TestCreateAuthenticateChallenge_failedLoginAudit(t *testing.T) {
 	mfa := configureForMFA(t, testServer)
 
 	// Proxy identity is used during login.
-	proxyClient, err := testServer.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err, "NewClient(RoleProxy) failed")
 
 	t.Run("emits audit event", func(t *testing.T) {
@@ -671,7 +685,7 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	require.NoError(t, err)
 
 	// Test invalid token type.
-	wrongToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+	wrongToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryStart, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 	require.NoError(t, err)
 	_, err = srv.Auth().CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
 		TokenID:    wrongToken.GetName(),
@@ -680,7 +694,7 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Create a valid token.
-	validToken, err := srv.Auth().createRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
+	validToken, err := srv.Auth().CreateRecoveryToken(ctx, u.username, authclient.UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_PASSWORD)
 	require.NoError(t, err)
 
 	// Test unspecified token returns error.
@@ -723,7 +737,7 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	}
 
 	t.Run("register using context user", func(t *testing.T) {
-		authClient, err := srv.NewClient(TestUser(u.username))
+		authClient, err := srv.NewClient(authtest.TestUser(u.username))
 		require.NoError(t, err, "NewClient(%q)", u.username)
 
 		// Attempt without a token or a solved authn challenge should fail.
@@ -812,20 +826,20 @@ func TestCreateRegisterChallenge_unusableDevice(t *testing.T) {
 		},
 	}
 
-	devOpts := []TestDeviceOpt{WithTestDeviceClock(clock)}
+	devOpts := []authtest.TestDeviceOpt{authtest.WithTestDeviceClock(clock)}
 	for i, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			setAuthPref(t, initialPref) // restore permissive settings.
 
 			// Create user.
 			username := fmt.Sprintf("llama-%d", i)
-			user, _, err := CreateUserAndRole(authServer, username, []string{username} /* logins */, nil /* allowRules */)
+			user, _, err := authtest.CreateUserAndRole(authServer, username, []string{username} /* logins */, nil /* allowRules */)
 			require.NoError(t, err, "CreateUserAndRole")
-			userClient, err := testServer.NewClient(TestUser(user.GetName()))
+			userClient, err := testServer.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err, "NewClient")
 
 			// Register initial MFA device.
-			_, err = RegisterTestDevice(
+			_, err = authtest.RegisterTestDevice(
 				ctx,
 				userClient,
 				"existing", test.existingType, nil /* authenticator */, devOpts...)
@@ -895,13 +909,13 @@ func TestServer_AuthenticateUser_passwordOnly(t *testing.T) {
 
 	const username = "bowman"
 	const password = "it's full of stars!"
-	_, _, err := CreateUserAndRole(authServer, username, nil, nil)
+	_, _, err := authtest.CreateUserAndRole(authServer, username, nil, nil)
 	require.NoError(t, err)
 	require.NoError(t, authServer.UpsertPassword(username, []byte(password)))
 
 	// makeRun is used to test both SSH and Web login by switching the
 	// authenticate function.
-	makeRun := func(authenticate func(*Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
+	makeRun := func(authenticate func(*auth.Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
 		return func(t *testing.T) {
 			require.NoError(t, authenticate(authServer, authclient.AuthenticateUserRequest{
 				Username: "bowman",
@@ -909,7 +923,7 @@ func TestServer_AuthenticateUser_passwordOnly(t *testing.T) {
 			}))
 		}
 	}
-	t.Run("ssh", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+	t.Run("ssh", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 		req.SSHPublicKey = []byte(sshPubKey)
 		req.TLSPublicKey = []byte(tlsPubKey)
 		_, err := s.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
@@ -918,12 +932,195 @@ func TestServer_AuthenticateUser_passwordOnly(t *testing.T) {
 		})
 		return err
 	}))
-	t.Run("web", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+	t.Run("web", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 		_, err := s.AuthenticateWebUser(ctx, req)
 		return err
 	}))
 }
 
+// TestBasicSSHScopedLogin verifies the basic expected behavior of a scoped login attempt using password-only
+// auth and a rudimentary set of scoped roles.
+func TestBasicSSHScopedLogin(t *testing.T) {
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+
+	ctx := context.Background()
+	testServer := newTestTLSServer(t)
+	authServer := testServer.Auth()
+
+	adminClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleAdmin))
+	require.NoError(t, err)
+
+	username := "alice"
+	password := uuid.NewString()
+
+	_, _, err = authtest.CreateUserAndRole(authServer, username, nil, nil)
+	require.NoError(t, err)
+
+	require.NoError(t, authServer.UpsertPassword(username, []byte(password)))
+
+	req := authclient.AuthenticateUserRequest{
+		Username: username,
+		Scope:    "/aa/bb",
+		Pass: &authclient.PassCreds{
+			Password: []byte(password),
+		},
+		SSHPublicKey: []byte(sshPubKey),
+		TLSPublicKey: []byte(tlsPubKey),
+	}
+
+	// user is not assigned any scoped roles applicable to /aa/bb, so login attempt should fail
+	_, err = authServer.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
+		AuthenticateUserRequest: req,
+	})
+	require.Error(t, err)
+
+	// set up some scoped roles
+	scopedRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-a",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/aa"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-b",
+			},
+			Scope: "/aa/bb",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/aa/bb"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-c",
+			},
+			Scope: "/aa/bb/cc",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/aa/bb/cc"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-x",
+			},
+			Scope: "/xx",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/xx"},
+			},
+			Version: types.V1,
+		},
+	}
+
+	// Create the roles.
+	for _, role := range scopedRoles {
+		_, err := adminClient.ScopedAccessServiceClient().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+	}
+
+	var assignmentIDs []string
+	for _, role := range scopedRoles {
+		assignmentID := uuid.NewString()
+		assignmentIDs = append(assignmentIDs, assignmentID)
+		_, err = adminClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: scopedaccess.KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: assignmentID,
+				},
+				Scope: role.GetScope(),
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  role.GetMetadata().GetName(),
+							Scope: role.GetScope(),
+						},
+					},
+				},
+				Version: types.V1,
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	// wait for assignment cache propagation
+	timeout := time.After(30 * time.Second)
+	for {
+		unseen := slices.Clone(assignmentIDs)
+		for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, adminClient.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+			require.NoError(t, err)
+			id := assignment.GetMetadata().GetName()
+			unseen = slices.DeleteFunc(unseen, func(unseenID string) bool { return id == unseenID })
+		}
+		if len(unseen) == 0 {
+			break
+		}
+		select {
+		case <-timeout:
+			t.Fatalf("timed out waiting for scoped role assignments to be visible: %v", unseen)
+		case <-time.After(200 * time.Millisecond):
+			// retry
+		}
+	}
+
+	// the same authentication request should now succeed
+	authrsp, err := authServer.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
+		AuthenticateUserRequest: req,
+	})
+	require.NoError(t, err)
+
+	// verify that the expected scope pin is applied to ssh and tls certificates
+	expectedPin := &scopesv1.Pin{
+		Scope: "/aa/bb",
+		Assignments: map[string]*scopesv1.PinnedAssignments{
+			"/aa": {
+				Roles: []string{"role-a"},
+			},
+			"/aa/bb": {
+				Roles: []string{"role-b"},
+			},
+			"/aa/bb/cc": {
+				Roles: []string{"role-c"},
+			},
+		},
+	}
+
+	// parse and examine the ssh cert
+	sshCert, err := sshutils.ParseCertificate(authrsp.Cert)
+	require.NoError(t, err)
+
+	sshIdent, err := sshca.DecodeIdentity(sshCert)
+	require.NoError(t, err)
+
+	require.NotNil(t, sshIdent.ScopePin)
+	require.Empty(t, cmp.Diff(expectedPin, sshIdent.ScopePin, protocmp.Transform()))
+	require.Empty(t, sshIdent.Roles)
+
+	// parse and examine the tls cert
+	tlsCert, err := tlsca.ParseCertificatePEM(authrsp.TLSCert)
+	require.NoError(t, err)
+
+	tlsIdent, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
+	require.NoError(t, err)
+
+	require.NotNil(t, tlsIdent.ScopePin)
+	require.Empty(t, cmp.Diff(expectedPin, tlsIdent.ScopePin, protocmp.Transform()))
+	require.Empty(t, tlsIdent.Groups)
+}
+
 func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 	t.Parallel()
 
@@ -933,15 +1130,15 @@ func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 
 	const username = "capybara"
 
-	setPassword := func(pwd string) func(*testing.T, *Server) {
-		return func(t *testing.T, s *Server) {
+	setPassword := func(pwd string) func(*testing.T, *auth.Server) {
+		return func(t *testing.T, s *auth.Server) {
 			require.NoError(t, s.UpsertPassword(username, []byte(pwd)))
 		}
 	}
 
 	tests := []struct {
 		name         string
-		setup        func(*testing.T, *Server)
+		setup        func(*testing.T, *auth.Server)
 		authUser     string
 		authPassword string
 	}{
@@ -959,7 +1156,7 @@ func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 		},
 		{
 			name:         "password not found",
-			setup:        func(*testing.T, *Server) {},
+			setup:        func(*testing.T, *auth.Server) {},
 			authUser:     username,
 			authPassword: "secure password",
 		},
@@ -968,9 +1165,9 @@ func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 	for _, test := range tests {
 		// makeRun is used to test both SSH and Web login by switching the
 		// authenticate function.
-		makeRun := func(authenticate func(*Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
+		makeRun := func(authenticate func(*auth.Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
 			return func(t *testing.T) {
-				_, _, err := CreateUserAndRole(authServer, username, nil, nil)
+				_, _, err := authtest.CreateUserAndRole(authServer, username, nil, nil)
 				require.NoError(t, err)
 				t.Cleanup(func() {
 					assert.NoError(t, authServer.DeleteUser(ctx, username), "failed to delete user %s", username)
@@ -985,7 +1182,7 @@ func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 				assert.True(t, trace.IsAccessDenied(err), "got %T: %v, want AccessDenied", trace.Unwrap(err), err)
 			}
 		}
-		t.Run(test.name+"/ssh", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+		t.Run(test.name+"/ssh", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 			req.SSHPublicKey = []byte(sshPubKey)
 			req.TLSPublicKey = []byte(tlsPubKey)
 			_, err := s.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
@@ -994,7 +1191,7 @@ func TestServer_AuthenticateUser_passwordOnly_failure(t *testing.T) {
 			})
 			return err
 		}))
-		t.Run(test.name+"/web", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+		t.Run(test.name+"/web", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 			_, err := s.AuthenticateWebUser(ctx, req)
 			return err
 		}))
@@ -1010,13 +1207,13 @@ func TestServer_AuthenticateUser_setsPasswordState(t *testing.T) {
 
 	const username = "bowman"
 	const password = "it's full of stars!"
-	_, _, err := CreateUserAndRole(authServer, username, nil, nil)
+	_, _, err := authtest.CreateUserAndRole(authServer, username, nil, nil)
 	require.NoError(t, err)
 	require.NoError(t, authServer.UpsertPassword(username, []byte(password)))
 
 	// makeRun is used to test both SSH and Web login by switching the
 	// authenticate function.
-	makeRun := func(authenticate func(*Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
+	makeRun := func(authenticate func(*auth.Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
 		return func(t *testing.T) {
 			// Enforce unspecified password state.
 			u, err := authServer.Identity.UpdateAndSwapUser(ctx, username, false, /* withSecrets */
@@ -1041,7 +1238,7 @@ func TestServer_AuthenticateUser_setsPasswordState(t *testing.T) {
 			assert.Equal(t, types.PasswordState_PASSWORD_STATE_SET, u.GetPasswordState())
 		}
 	}
-	t.Run("ssh", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+	t.Run("ssh", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 		req.SSHPublicKey = []byte(sshPubKey)
 		req.TLSPublicKey = []byte(tlsPubKey)
 		_, err := s.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
@@ -1050,7 +1247,7 @@ func TestServer_AuthenticateUser_setsPasswordState(t *testing.T) {
 		})
 		return err
 	}))
-	t.Run("web", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+	t.Run("web", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 		_, err := s.AuthenticateWebUser(ctx, req)
 		return err
 	}))
@@ -1077,7 +1274,7 @@ func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
 		test := test
 		// makeRun is used to test both SSH and Web login by switching the
 		// authenticate function.
-		makeRun := func(authenticate func(*Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
+		makeRun := func(authenticate func(*auth.Server, authclient.AuthenticateUserRequest) error) func(t *testing.T) {
 			return func(t *testing.T) {
 				// 1st step: acquire challenge
 				challenge, err := authServer.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
@@ -1113,14 +1310,14 @@ func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
 				require.NoError(t, authenticate(authServer, authReq))
 			}
 		}
-		t.Run(test.name+"/ssh", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+		t.Run(test.name+"/ssh", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 			_, err := s.AuthenticateSSHUser(ctx, authclient.AuthenticateSSHRequest{
 				AuthenticateUserRequest: req,
 				TTL:                     24 * time.Hour,
 			})
 			return err
 		}))
-		t.Run(test.name+"/web", makeRun(func(s *Server, req authclient.AuthenticateUserRequest) error {
+		t.Run(test.name+"/web", makeRun(func(s *auth.Server, req authclient.AuthenticateUserRequest) error {
 			_, err := s.AuthenticateWebUser(ctx, req)
 			return err
 		}))
@@ -1149,12 +1346,12 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
 	// Create user and initial WebAuthn device (MFA).
 	const user = "llama"
 	const password = "p@ssw0rd1234"
-	_, _, err = CreateUserAndRole(authServer, user, []string{"llama", "root"}, nil)
+	_, _, err = authtest.CreateUserAndRole(authServer, user, []string{"llama", "root"}, nil)
 	require.NoError(t, err)
 	require.NoError(t, authServer.UpsertPassword(user, []byte(password)))
-	userClient, err := svr.NewClient(TestUser(user))
+	userClient, err := svr.NewClient(authtest.TestUser(user))
 	require.NoError(t, err)
-	webDev, err := RegisterTestDevice(
+	webDev, err := authtest.RegisterTestDevice(
 		ctx, userClient, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
 
@@ -1201,19 +1398,19 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
 	require.NoError(t, err, "Failed to register passwordless device")
 
 	// Use a proxy client for now on; the user's identity isn't established yet.
-	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := svr.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// used to keep track of calls to login hooks.
 	var loginHookCounter atomic.Int32
-	var loginHook LoginHook = func(_ context.Context, _ types.User) error {
+	var loginHook auth.LoginHook = func(_ context.Context, _ types.User) error {
 		loginHookCounter.Add(1)
 		return nil
 	}
 
 	tests := []struct {
 		name         string
-		loginHooks   []LoginHook
+		loginHooks   []auth.LoginHook
 		authenticate func(t *testing.T, resp *wantypes.CredentialAssertionResponse)
 	}{
 		{
@@ -1235,7 +1432,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
 		},
 		{
 			name: "ssh with login hooks",
-			loginHooks: []LoginHook{
+			loginHooks: []auth.LoginHook{
 				loginHook,
 				loginHook,
 			},
@@ -1266,7 +1463,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
 		},
 		{
 			name: "web with login hooks",
-			loginHooks: []LoginHook{
+			loginHooks: []auth.LoginHook{
 				loginHook,
 			},
 			authenticate: func(t *testing.T, resp *wantypes.CredentialAssertionResponse) {
@@ -1340,9 +1537,9 @@ func TestPasswordlessProhibitedForSSO(t *testing.T) {
 	ctx := context.Background()
 
 	// Register a passwordless device.
-	userClient, err := testServer.NewClient(TestUser(mfa.User))
+	userClient, err := testServer.NewClient(authtest.TestUser(mfa.User))
 	require.NoError(t, err, "NewClient failed")
-	pwdlessDev, err := RegisterTestDevice(ctx, userClient, "pwdless", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, mfa.WebDev, WithPasswordless())
+	pwdlessDev, err := authtest.RegisterTestDevice(ctx, userClient, "pwdless", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, mfa.WebDev, authtest.WithPasswordless())
 	require.NoError(t, err, "RegisterTestDevice failed")
 
 	// Edit the configured user so it looks like an SSO user attempting local
@@ -1364,7 +1561,7 @@ func TestPasswordlessProhibitedForSSO(t *testing.T) {
 	require.NoError(t, err, "UpdateAndSwapUser failed")
 
 	// Authentication happens through the Proxy identity.
-	proxyClient, err := testServer.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -1452,7 +1649,7 @@ func TestSSOPasswordBypass(t *testing.T) {
 	// and proceed from there.
 
 	// Authentication happens through the Proxy identity.
-	proxyClient, err := testServer.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	createAuthenticateChallenge := func(t *testing.T) *proto.MFAAuthenticateChallenge {
@@ -1579,7 +1776,7 @@ func TestSSOPasswordBypass(t *testing.T) {
 		mfaResp, err := mfa.TOTPDev.SolveAuthn(chal)
 		require.NoError(t, err, "SolveAuthn failed")
 
-		userClient, err := testServer.NewClient(TestUser(mfa.User))
+		userClient, err := testServer.NewClient(authtest.TestUser(mfa.User))
 		require.NoError(t, err, "NewClient failed")
 
 		err = userClient.ChangePassword(ctx, &proto.ChangePasswordRequest{
@@ -1594,7 +1791,7 @@ func TestSSOPasswordBypass(t *testing.T) {
 	t.Run("CreateResetPasswordToken", func(t *testing.T) {
 		t.Parallel()
 
-		adminClient, err := testServer.NewClient(TestBuiltin(types.RoleAdmin))
+		adminClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 		require.NoError(t, err, "NewClient failed")
 
 		_, err = adminClient.CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
@@ -1617,7 +1814,7 @@ func TestSSOAccountRecoveryProhibited(t *testing.T) {
 	ctx := context.Background()
 
 	// Enable RecoveryCodes feature.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -1638,7 +1835,7 @@ func TestSSOAccountRecoveryProhibited(t *testing.T) {
 	// Create a user that looks like an SSO user. The name must be an e-mail for
 	// account recovery to work.
 	const user = "llama@example.com"
-	_, _, err = CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
+	_, _, err = authtest.CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	_, err = authServer.UpdateAndSwapUser(ctx, user, false /* withSecrets */, func(u types.User) (changed bool, err error) {
 		u.SetCreatedBy(types.CreatedBy{
@@ -1657,9 +1854,9 @@ func TestSSOAccountRecoveryProhibited(t *testing.T) {
 	require.NoError(t, err, "UpdateAndSwapUser failed")
 
 	// Register an MFA device.
-	userClient, err := testServer.NewClient(TestUser(user))
+	userClient, err := testServer.NewClient(authtest.TestUser(user))
 	require.NoError(t, err, "NewClient failed")
-	totpDev, err := RegisterTestDevice(ctx, userClient, "totp", proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, WithTestDeviceClock(clock))
+	totpDev, err := authtest.RegisterTestDevice(ctx, userClient, "totp", proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, authtest.WithTestDeviceClock(clock))
 	require.NoError(t, err, "RegisterTestDevice failed")
 
 	t.Run("CreateAccountRecoveryCodes", func(t *testing.T) {
@@ -1709,15 +1906,15 @@ func TestServer_Authenticate_nonPasswordlessRequiresUsername(t *testing.T) {
 	username := mfa.User
 	password := mfa.Password
 
-	userClient, err := svr.NewClient(TestUser(username))
+	userClient, err := svr.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := svr.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	ctx := context.Background()
 	tests := []struct {
 		name    string
-		dev     *TestDevice
+		dev     *authtest.Device
 		wantErr string
 	}{
 		{
@@ -1832,7 +2029,7 @@ func TestServer_Authenticate_headless(t *testing.T) {
 			t.Parallel()
 
 			srv := newTestTLSServer(t)
-			proxyClient, err := srv.NewClient(TestBuiltin(types.RoleProxy))
+			proxyClient, err := srv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 			require.NoError(t, err)
 
 			// We don't mind about the specifics of the configuration, as long as we have
@@ -1900,10 +2097,10 @@ func TestServer_Authenticate_headless(t *testing.T) {
 
 type configureMFAResp struct {
 	User, Password  string
-	TOTPDev, WebDev *TestDevice
+	TOTPDev, WebDev *authtest.Device
 }
 
-func configureForMFA(t *testing.T, srv *TestTLSServer) *configureMFAResp {
+func configureForMFA(t *testing.T, srv *authtest.TLSServer) *configureMFAResp {
 	authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
 		Type:         constants.Local,
 		SecondFactor: constants.SecondFactorOptional,
@@ -1921,17 +2118,17 @@ func configureForMFA(t *testing.T, srv *TestTLSServer) *configureMFAResp {
 	// Create user with a default password.
 	const username = "llama@goteleport.com"
 	const password = "supersecurepass"
-	_, _, err = CreateUserAndRole(authServer, username, []string{"llama", "root"}, nil)
+	_, _, err = authtest.CreateUserAndRole(authServer, username, []string{"llama", "root"}, nil)
 	require.NoError(t, err)
 	require.NoError(t, authServer.UpsertPassword(username, []byte(password)))
 
-	clt, err := srv.NewClient(TestUser(username))
+	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
-	totpDev, err := RegisterTestDevice(ctx, clt, "totp-1", proto.DeviceType_DEVICE_TYPE_TOTP, nil, WithTestDeviceClock(srv.Clock()))
+	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "totp-1", proto.DeviceType_DEVICE_TYPE_TOTP, nil, authtest.WithTestDeviceClock(srv.Clock()))
 	require.NoError(t, err)
 
-	webDev, err := RegisterTestDevice(ctx, clt, "web-1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web-1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev)
 	require.NoError(t, err)
 
 	return &configureMFAResp{
diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go
index 1c0803c10a741..bced9f22d8ab2 100644
--- a/lib/auth/auth_test.go
+++ b/lib/auth/auth_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"cmp"
@@ -63,10 +63,13 @@ import (
 	"github.com/gravitational/teleport/api/types/trait"
 	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
@@ -74,29 +77,34 @@ import (
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/slices"
 )
 
 type testPack struct {
 	bk             backend.Backend
-	versionStorage VersionStorage
+	versionStorage auth.VersionStorage
 	clusterName    types.ClusterName
-	a              *Server
+	a              *auth.Server
 	mockEmitter    *eventstest.MockRecorderEmitter
 }
 
 func newTestPack(
-	ctx context.Context, dataDir string, opts ...ServerOption,
+	ctx context.Context, dataDir string, opts ...auth.ServerOption,
 ) (testPack, error) {
 	var (
 		p   testPack
@@ -113,7 +121,7 @@ func newTestPack(
 		return p, trace.Wrap(err)
 	}
 
-	p.versionStorage = NewFakeTeleportVersion()
+	p.versionStorage = authtest.NewFakeTeleportVersion()
 
 	identityService, err := local.NewTestIdentityService(p.bk)
 	if err != nil {
@@ -121,7 +129,7 @@ func newTestPack(
 	}
 
 	p.mockEmitter = &eventstest.MockRecorderEmitter{}
-	authConfig := &InitConfig{
+	authConfig := &auth.InitConfig{
 		DataDir:        dataDir,
 		Backend:        p.bk,
 		VersionStorage: p.versionStorage,
@@ -131,8 +139,9 @@ func newTestPack(
 		// This uses lower bcrypt costs for faster tests.
 		Identity:               identityService,
 		SkipPeriodicOperations: true,
+		HostUUID:               uuid.NewString(),
 	}
-	p.a, err = NewServer(authConfig, opts...)
+	p.a, err = auth.NewServer(authConfig, opts...)
 	if err != nil {
 		return p, trace.Wrap(err)
 	}
@@ -150,7 +159,7 @@ func newTestPack(
 	p.a.SetLockWatcher(lockWatcher)
 
 	urc, err := services.NewUnifiedResourceCache(ctx, services.UnifiedResourceCacheConfig{
-		Clock: p.a.clock,
+		Clock: p.a.GetClock(),
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
 			Component: teleport.ComponentAuth,
 			Client:    p.a,
@@ -200,13 +209,13 @@ func newTestPack(
 		return p, trace.Wrap(err)
 	}
 
-	if err := p.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.UserCA, p.clusterName.GetClusterName())); err != nil {
+	if err := p.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.UserCA, p.clusterName.GetClusterName())); err != nil {
 		return p, trace.Wrap(err)
 	}
-	if err := p.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.HostCA, p.clusterName.GetClusterName())); err != nil {
+	if err := p.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.HostCA, p.clusterName.GetClusterName())); err != nil {
 		return p, trace.Wrap(err)
 	}
-	if err := p.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.OpenSSHCA, p.clusterName.GetClusterName())); err != nil {
+	if err := p.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.OpenSSHCA, p.clusterName.GetClusterName())); err != nil {
 		return p, trace.Wrap(err)
 	}
 
@@ -226,10 +235,14 @@ func newAuthSuite(t *testing.T) *testPack {
 }
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
+	logtest.InitLogger(testing.Verbose)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
 	modules.SetInsecureTestMode(true)
-	os.Exit(m.Run())
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 func TestSessions(t *testing.T) {
@@ -241,7 +254,7 @@ func TestSessions(t *testing.T) {
 	user := "user1"
 	pass := []byte("abcdef123456")
 
-	_, _, err := CreateUserAndRole(s.a, user, []string{user}, nil)
+	_, _, err := authtest.CreateUserAndRole(s.a, user, []string{user}, nil)
 	require.NoError(t, err)
 
 	err = s.a.UpsertPassword(user, pass)
@@ -350,7 +363,7 @@ func TestAuthenticateWebUser_deviceWebToken(t *testing.T) {
 
 	// Prepare user and password.
 	// 2nd factors are not important for this test.
-	_, _, err := CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
+	_, _, err := authtest.CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	require.NoError(t,
 		authServer.UpsertPassword(user, []byte(pass)),
@@ -486,7 +499,7 @@ func TestAuthenticateWebUser_deviceWebToken(t *testing.T) {
 
 func TestAuthenticateWebUser_trustedDeviceRequirement(t *testing.T) {
 	// Can't t.Parallel because of modules.SetTestModules.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
@@ -513,7 +526,7 @@ func TestAuthenticateWebUser_trustedDeviceRequirement(t *testing.T) {
 		{user: user1, pass: pass1},
 		{user: user2, pass: pass2, roles: []string{rtdRole.GetName()}},
 	} {
-		user, _, err := CreateUserAndRole(
+		user, _, err := authtest.CreateUserAndRole(
 			authServer,
 			u.user,
 			append(u.roles, u.user),
@@ -634,7 +647,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	require.ErrorAs(t, err, &accessDeniedErr)
 
 	// Create the user.
-	_, role, err := CreateUserAndRole(s.a, user, []string{user}, nil)
+	_, role, err := authtest.CreateUserAndRole(s.a, user, []string{user}, nil)
 	require.NoError(t, err)
 	err = s.a.UpsertPassword(user, pass)
 	require.NoError(t, err)
@@ -672,16 +685,17 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, gotTLSCert.PublicKey, inTLSPub)
 	wantID := tlsca.Identity{
-		Username:         user,
-		Groups:           []string{role.GetName()},
-		Principals:       []string{user, teleport.SSHSessionJoinPrincipal},
-		KubernetesUsers:  []string{user},
-		KubernetesGroups: []string{"system:masters"},
-		Expires:          gotTLSCert.NotAfter,
-		RouteToCluster:   s.clusterName.GetClusterName(),
-		TeleportCluster:  s.clusterName.GetClusterName(),
-		PrivateKeyPolicy: keys.PrivateKeyPolicyNone,
-		UserType:         "local",
+		Username:          user,
+		Groups:            []string{role.GetName()},
+		Principals:        []string{user, teleport.SSHSessionJoinPrincipal},
+		KubernetesUsers:   []string{user},
+		KubernetesGroups:  []string{"system:masters"},
+		Expires:           gotTLSCert.NotAfter,
+		RouteToCluster:    s.clusterName.GetClusterName(),
+		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
+		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
+		UserType:          "local",
 	}
 	gotID, err := tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
@@ -715,6 +729,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		Expires:           gotTLSCert.NotAfter,
 		RouteToCluster:    "leaf.localhost",
 		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
 		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
 		UserType:          "local",
 	}
@@ -771,6 +786,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		Expires:           gotTLSCert.NotAfter,
 		RouteToCluster:    s.clusterName.GetClusterName(),
 		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
 		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
 		UserType:          "local",
 	}
@@ -797,16 +813,17 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	gotTLSCert, err = tlsca.ParseCertificatePEM(resp.TLSCert)
 	require.NoError(t, err)
 	wantID = tlsca.Identity{
-		Username:         user,
-		Groups:           []string{role.GetName()},
-		Principals:       []string{user, teleport.SSHSessionJoinPrincipal},
-		KubernetesUsers:  []string{user},
-		KubernetesGroups: []string{"system:masters"},
-		Expires:          gotTLSCert.NotAfter,
-		RouteToCluster:   s.clusterName.GetClusterName(),
-		TeleportCluster:  s.clusterName.GetClusterName(),
-		PrivateKeyPolicy: keys.PrivateKeyPolicyNone,
-		UserType:         "local",
+		Username:          user,
+		Groups:            []string{role.GetName()},
+		Principals:        []string{user, teleport.SSHSessionJoinPrincipal},
+		KubernetesUsers:   []string{user},
+		KubernetesGroups:  []string{"system:masters"},
+		Expires:           gotTLSCert.NotAfter,
+		RouteToCluster:    s.clusterName.GetClusterName(),
+		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
+		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
+		UserType:          "local",
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
@@ -838,6 +855,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		Expires:           gotTLSCert.NotAfter,
 		RouteToCluster:    s.clusterName.GetClusterName(),
 		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
 		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
 		UserType:          "local",
 	}
@@ -864,16 +882,17 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	gotTLSCert, err = tlsca.ParseCertificatePEM(resp.TLSCert)
 	require.NoError(t, err)
 	wantID = tlsca.Identity{
-		Username:         user,
-		Groups:           []string{role.GetName()},
-		Principals:       []string{user, teleport.SSHSessionJoinPrincipal},
-		KubernetesUsers:  []string{user},
-		KubernetesGroups: []string{"system:masters"},
-		Expires:          gotTLSCert.NotAfter,
-		RouteToCluster:   s.clusterName.GetClusterName(),
-		TeleportCluster:  s.clusterName.GetClusterName(),
-		PrivateKeyPolicy: keys.PrivateKeyPolicyNone,
-		UserType:         "local",
+		Username:          user,
+		Groups:            []string{role.GetName()},
+		Principals:        []string{user, teleport.SSHSessionJoinPrincipal},
+		KubernetesUsers:   []string{user},
+		KubernetesGroups:  []string{"system:masters"},
+		Expires:           gotTLSCert.NotAfter,
+		RouteToCluster:    s.clusterName.GetClusterName(),
+		TeleportCluster:   s.clusterName.GetClusterName(),
+		OriginClusterName: s.clusterName.GetClusterName(),
+		PrivateKeyPolicy:  keys.PrivateKeyPolicyNone,
+		UserType:          "local",
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
@@ -915,27 +934,27 @@ func TestAuthenticateUser_mfaDeviceLocked(t *testing.T) {
 	require.NoError(t, err, "UpdateAuthPreference")
 
 	// Prepare user, password and MFA device.
-	_, _, err = CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
+	_, _, err = authtest.CreateUserAndRole(authServer, user, []string{user}, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole")
 	require.NoError(t,
 		authServer.UpsertPassword(user, []byte(pass)),
 		"UpsertPassword")
 
-	userClient, err := testServer.NewClient(TestUser(user))
+	userClient, err := testServer.NewClient(authtest.TestUser(user))
 	require.NoError(t, err, "NewClient")
 
 	// OTP devices would work for this test too.
-	dev1, err := RegisterTestDevice(ctx, userClient, "dev1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	dev1, err := authtest.RegisterTestDevice(ctx, userClient, "dev1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
-	dev2, err := RegisterTestDevice(ctx, userClient, "dev2", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, dev1 /* authenticator */)
+	dev2, err := authtest.RegisterTestDevice(ctx, userClient, "dev2", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, dev1 /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
 
 	// Users initially authenticate via Proxy, as there isn't a userClient before
 	// authn.
-	proxyClient, err := testServer.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := testServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err, "NewClient")
 
-	authenticateSSH := func(dev *TestDevice) (*authclient.SSHLoginResponse, error) {
+	authenticateSSH := func(dev *authtest.Device) (*authclient.SSHLoginResponse, error) {
 		chal, err := proxyClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
 			Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{
 				UserCredentials: &proto.UserCredentials{
@@ -1030,7 +1049,7 @@ func TestUserLock(t *testing.T) {
 	})
 	require.Error(t, err)
 
-	_, _, err = CreateUserAndRole(s.a, username, []string{username}, nil)
+	_, _, err = authtest.CreateUserAndRole(s.a, username, []string{username}, nil)
 	require.NoError(t, err)
 
 	err = s.a.UpsertPassword(username, pass)
@@ -1170,7 +1189,7 @@ func TestLocalControlStream(t *testing.T) {
 	// wait for control stream to get inserted into the controller (happens after
 	// hello exchange is finished).
 	require.Eventually(t, func() bool {
-		_, ok := s.a.inventory.GetControlStream(serverID)
+		_, ok := s.a.Inventory().GetControlStream(serverID)
 		return ok
 	}, time.Second*5, time.Millisecond*200)
 
@@ -1197,7 +1216,7 @@ func TestUpdateConfig(t *testing.T) {
 	cn, err := s.a.GetClusterName(ctx)
 	require.NoError(t, err)
 	require.Equal(t, cn.GetClusterName(), s.clusterName.GetClusterName())
-	st, err := s.a.GetStaticTokens()
+	st, err := s.a.GetStaticTokens(ctx)
 	require.NoError(t, err)
 	require.Empty(t, st.GetStaticTokens())
 
@@ -1208,14 +1227,15 @@ func TestUpdateConfig(t *testing.T) {
 	})
 	require.NoError(t, err)
 	// use same backend but start a new auth server with different config.
-	authConfig := &InitConfig{
+	authConfig := &auth.InitConfig{
 		ClusterName:            clusterName,
 		Backend:                s.bk,
 		VersionStorage:         s.versionStorage,
 		Authority:              testauthority.New(),
 		SkipPeriodicOperations: true,
+		HostUUID:               uuid.NewString(),
 	}
-	authServer, err := NewServer(authConfig)
+	authServer, err := auth.NewServer(authConfig)
 	require.NoError(t, err)
 
 	err = authServer.SetClusterName(clusterName)
@@ -1237,7 +1257,7 @@ func TestUpdateConfig(t *testing.T) {
 	cn, err = s.a.GetClusterName(ctx)
 	require.NoError(t, err)
 	require.Equal(t, cn.GetClusterName(), s.clusterName.GetClusterName())
-	st, err = s.a.GetStaticTokens()
+	st, err = s.a.GetStaticTokens(ctx)
 	require.NoError(t, err)
 	require.Equal(t, st.GetStaticTokens(), types.ProvisionTokensFromStatic([]types.ProvisionTokenV1{{
 		Token: "bar",
@@ -1246,7 +1266,7 @@ func TestUpdateConfig(t *testing.T) {
 
 	// check second auth server and make sure it also has the correct values
 	// new static tokens
-	st, err = authServer.GetStaticTokens()
+	st, err = authServer.GetStaticTokens(ctx)
 	require.NoError(t, err)
 	require.Equal(t, st.GetStaticTokens(), types.ProvisionTokensFromStatic([]types.ProvisionTokenV1{{
 		Token: "bar",
@@ -1260,7 +1280,7 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
 
 	clientAddr := &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0)}
 	ctx := authz.ContextWithClientSrcAddr(context.Background(), clientAddr)
-	s.a.emitter = s.mockEmitter
+	s.a.SetEmitter(s.mockEmitter)
 
 	// set up existing cluster to bypass switch cases that
 	// makes a network request when creating new clusters
@@ -1275,10 +1295,10 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
 	_, err = s.a.Services.UpsertTrustedCluster(ctx, tc)
 	require.NoError(t, err)
 
-	require.NoError(t, s.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.UserCA, "test")))
-	require.NoError(t, s.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.HostCA, "test")))
+	require.NoError(t, s.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.UserCA, "test")))
+	require.NoError(t, s.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.HostCA, "test")))
 
-	err = s.a.createReverseTunnel(ctx, tc)
+	err = s.a.CreateReverseTunnel(ctx, tc)
 	require.NoError(t, err)
 
 	// test create event for switch case: when tc exists but enabled is false
@@ -1326,7 +1346,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 	})
 	// test github create event
 	require.NoError(t, err)
-	github, err = s.a.createGithubConnector(ctx, github)
+	github, err = auth.CreateGithubConnector(ctx, s.a, github)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorCreate{}, s.mockEmitter.LastEvent())
 	require.Equal(t, events.GithubConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
@@ -1336,7 +1356,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 
 	// test github update event
 	github.SetDisplay("llama")
-	github, err = s.a.updateGithubConnector(ctx, github)
+	github, err = auth.UpdateGithubConnector(ctx, s.a, github)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorUpdate{}, s.mockEmitter.LastEvent())
 	require.Equal(t, events.GithubConnectorUpdatedEvent, s.mockEmitter.LastEvent().GetType())
@@ -1346,7 +1366,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 
 	// test github upsert event
 	github.SetDisplay("alpaca")
-	upserted, err := s.a.upsertGithubConnector(ctx, github)
+	upserted, err := auth.UpsertGithubConnector(ctx, s.a, github)
 	require.NoError(t, err)
 	require.NotNil(t, upserted)
 	require.IsType(t, &apievents.GithubConnectorCreate{}, s.mockEmitter.LastEvent())
@@ -1356,7 +1376,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 	s.mockEmitter.Reset()
 
 	// test github delete event
-	err = s.a.deleteGithubConnector(ctx, "test")
+	err = auth.DeleteGithubConnector(ctx, s.a, "test")
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorDelete{}, s.mockEmitter.LastEvent())
 	require.Equal(t, events.GithubConnectorDeletedEvent, s.mockEmitter.LastEvent().GetType())
@@ -1489,7 +1509,7 @@ func TestSAMLConnectorCRUDEventsEmitted(t *testing.T) {
 func TestEmitSSOLoginFailureEvent(t *testing.T) {
 	mockE := &eventstest.MockRecorderEmitter{}
 
-	emitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), false)
+	auth.EmitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), false)
 
 	expectedLoginFailure := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
@@ -1505,7 +1525,7 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 	}
 	require.Equal(t, expectedLoginFailure, mockE.LastEvent())
 
-	emitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), true)
+	auth.EmitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), true)
 
 	expectedTestFailure := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
@@ -1528,7 +1548,7 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 	testServer := newTestTLSServer(t)
 	authServer := testServer.Auth()
 	emitter := &eventstest.MockRecorderEmitter{}
-	authServer.emitter = emitter
+	authServer.SetEmitter(emitter)
 	ctx := context.Background()
 
 	const username = "llama"
@@ -1540,7 +1560,7 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 	principals := []string{"login0", username, "-teleport-internal-join"}
 
 	// Prepare the user to test with.
-	_, _, err := CreateUserAndRole(authServer, username, principals, nil)
+	_, _, err := authtest.CreateUserAndRole(authServer, username, principals, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	require.NoError(t,
 		authServer.UpsertPassword(username, []byte(pass)),
@@ -1573,7 +1593,7 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 	tests := []struct {
 		name           string
 		x509PEM        []byte
-		opts           *AugmentUserCertificateOpts
+		opts           *auth.AugmentUserCertificateOpts
 		wantSSHCert    bool
 		assertX509Cert func(t *testing.T, c *x509.Certificate)
 		assertSSHCert  func(t *testing.T, c *ssh.Certificate)
@@ -1581,10 +1601,10 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 		{
 			name:    "device extensions",
 			x509PEM: authResp.TLSCert,
-			opts: &AugmentUserCertificateOpts{
+			opts: &auth.AugmentUserCertificateOpts{
 				SSHAuthorizedKey:         authResp.Cert,
 				SSHKeySatisfiedChallenge: true,
-				DeviceExtensions: &DeviceExtensions{
+				DeviceExtensions: &auth.DeviceExtensions{
 					DeviceID:     devID,
 					AssetTag:     devTag,
 					CredentialID: devCred,
@@ -1607,8 +1627,8 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 		{
 			name:    "augment without SSH",
 			x509PEM: authResp.TLSCert,
-			opts: &AugmentUserCertificateOpts{
-				DeviceExtensions: &DeviceExtensions{
+			opts: &auth.AugmentUserCertificateOpts{
+				DeviceExtensions: &auth.DeviceExtensions{
 					DeviceID:     devID,
 					AssetTag:     devTag,
 					CredentialID: devCred,
@@ -1697,19 +1717,19 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 	const pass3 = "secret!!3!!!"
 
 	// Prepare a few distinct users.
-	user1, _, err := CreateUserAndRole(authServer, "llama", []string{"llama"}, nil)
+	user1, _, err := authtest.CreateUserAndRole(authServer, "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	require.NoError(t,
 		authServer.UpsertPassword(user1.GetName(), []byte(pass1)),
 		"UpsertPassword failed")
 
-	user2, _, err := CreateUserAndRole(authServer, "alpaca", []string{"alpaca"}, nil)
+	user2, _, err := authtest.CreateUserAndRole(authServer, "alpaca", []string{"alpaca"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	require.NoError(t,
 		authServer.UpsertPassword(user2.GetName(), []byte(pass2)),
 		"UpsertPassword failed")
 
-	user3, _, err := CreateUserAndRole(authServer, "camel", []string{"camel"}, nil)
+	user3, _, err := authtest.CreateUserAndRole(authServer, "camel", []string{"camel"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	require.NoError(t,
 		authServer.UpsertPassword(user3.GetName(), []byte(pass3)),
@@ -1797,10 +1817,10 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 	})
 	aaCtx, err := ctxFromAuthorize(aCtx)
 	require.NoError(t, err, "ctxFromAuthorize failed")
-	augResp, err := authServer.AugmentContextUserCertificates(aCtx, aaCtx, &AugmentUserCertificateOpts{
+	augResp, err := authServer.AugmentContextUserCertificates(aCtx, aaCtx, &auth.AugmentUserCertificateOpts{
 		SSHAuthorizedKey:         sshRaw1,
 		SSHKeySatisfiedChallenge: true,
-		DeviceExtensions: &DeviceExtensions{
+		DeviceExtensions: &auth.DeviceExtensions{
 			DeviceID:     "device1",
 			AssetTag:     "tag1",
 			CredentialID: "credential1",
@@ -1822,15 +1842,15 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 		return ssh.MarshalAuthorizedKey(c)
 	}
 
-	baseOpts := &AugmentUserCertificateOpts{
-		DeviceExtensions: &DeviceExtensions{
+	baseOpts := &auth.AugmentUserCertificateOpts{
+		DeviceExtensions: &auth.DeviceExtensions{
 			DeviceID:     "deviceid1",
 			AssetTag:     "devicetag1",
 			CredentialID: "credentialid1",
 		},
 		SSHKeySatisfiedChallenge: true,
 	}
-	optsFromBase := func(_ *testing.T) *AugmentUserCertificateOpts { return baseOpts }
+	optsFromBase := func(_ *testing.T) *auth.AugmentUserCertificateOpts { return baseOpts }
 
 	tests := []struct {
 		name     string
@@ -1839,7 +1859,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 		// createAuthCtx defaults to ctxFromAuthorize.
 		createAuthCtx func(ctx context.Context) (*authz.Context, error)
 		// createOpts defaults to optsFromBase.
-		createOpts func(t *testing.T) *AugmentUserCertificateOpts
+		createOpts func(t *testing.T) *auth.AugmentUserCertificateOpts
 		wantErr    string
 	}{
 		// Simple input validation errors.
@@ -1854,14 +1874,14 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:       "opts nil",
 			x509Cert:   xCert1,
 			identity:   identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts { return nil },
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts { return nil },
 			wantErr:    "opts",
 		},
 		{
 			name:     "opts missing extensions",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
 				cp.DeviceExtensions = nil
 				return &cp
@@ -1874,9 +1894,9 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "opts.DeviceExtensions.DeviceID empty",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
-				cp.DeviceExtensions = &DeviceExtensions{
+				cp.DeviceExtensions = &auth.DeviceExtensions{
 					DeviceID:     "",
 					AssetTag:     "asset1",
 					CredentialID: "credential1",
@@ -1889,9 +1909,9 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "opts.DeviceExtensions.AssetTag empty",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
-				cp.DeviceExtensions = &DeviceExtensions{
+				cp.DeviceExtensions = &auth.DeviceExtensions{
 					DeviceID:     "id1",
 					AssetTag:     "",
 					CredentialID: "credential1",
@@ -1904,9 +1924,9 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "opts.DeviceExtensions.CredentialID empty",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
-				cp.DeviceExtensions = &DeviceExtensions{
+				cp.DeviceExtensions = &auth.DeviceExtensions{
 					DeviceID:     "id1",
 					AssetTag:     "asset1",
 					CredentialID: "",
@@ -1927,7 +1947,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH challenge not satisfied and x509/SSH public key mismatch",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
 				cp.SSHAuthorizedKey = sshRaw11 // should be sshRaw1
 				cp.SSHKeySatisfiedChallenge = false
@@ -1939,7 +1959,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH/identity mismatch",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
 				cp.SSHAuthorizedKey = sshRaw2 // should be sshRaw1
 				return &cp
@@ -1950,7 +1970,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH/identity principals mismatch",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(t *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(t *testing.T) *auth.AugmentUserCertificateOpts {
 				changedPrincipals := *sshCert1
 				changedPrincipals.ValidPrincipals = append(changedPrincipals.ValidPrincipals, "camel")
 				sshRaw := signAndMarshalSSH(t, &changedPrincipals)
@@ -1965,7 +1985,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH cert type mismatch",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(t *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(t *testing.T) *auth.AugmentUserCertificateOpts {
 				changedType := *sshCert1
 				changedType.CertType = ssh.HostCert // shouldn't happen!
 				sshRaw := signAndMarshalSSH(t, &changedType)
@@ -1988,7 +2008,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH cert unknown authority",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
 				cp.SSHAuthorizedKey = wrongSSHRaw1 // signed by a different CA
 				return &cp
@@ -1999,7 +2019,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH cert expired",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(t *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(t *testing.T) *auth.AugmentUserCertificateOpts {
 				// Fake a 1h TTL, expired cert.
 				now := testServer.Clock().Now()
 				after := now.Add(-1 * time.Hour)
@@ -2028,7 +2048,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "SSH cert with device extensions not reissued",
 			x509Cert: xCert1,
 			identity: identity1,
-			createOpts: func(_ *testing.T) *AugmentUserCertificateOpts {
+			createOpts: func(_ *testing.T) *auth.AugmentUserCertificateOpts {
 				cp := *baseOpts
 				cp.SSHAuthorizedKey = augSSHRaw1 // already has extensions.
 				return &cp
@@ -2051,7 +2071,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 				lockTarget := types.LockTarget{
 					User: user3.GetName(),
 				}
-				watcher, err := authServer.lockWatcher.Subscribe(ctx, lockTarget)
+				watcher, err := authServer.SubscribeToLockTarget(ctx, lockTarget)
 				if err != nil {
 					return nil, err
 				}
@@ -2079,9 +2099,9 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 			name:     "locked device",
 			x509Cert: xCert1,
 			identity: identity1, // device locked below.
-			createOpts: func(t *testing.T) *AugmentUserCertificateOpts {
-				opts := &AugmentUserCertificateOpts{
-					DeviceExtensions: &DeviceExtensions{
+			createOpts: func(t *testing.T) *auth.AugmentUserCertificateOpts {
+				opts := &auth.AugmentUserCertificateOpts{
+					DeviceExtensions: &auth.DeviceExtensions{
 						DeviceID:     "bad-device-1",
 						AssetTag:     "bad-device-tag",
 						CredentialID: "bad-device-credential",
@@ -2092,7 +2112,7 @@ func TestServer_AugmentContextUserCertificates_errors(t *testing.T) {
 				lockTarget := types.LockTarget{
 					Device: opts.DeviceExtensions.DeviceID,
 				}
-				watcher, err := authServer.lockWatcher.Subscribe(ctx, lockTarget)
+				watcher, err := authServer.SubscribeToLockTarget(ctx, lockTarget)
 				require.NoError(t, err, "Subscribe failed")
 				defer watcher.Close()
 
@@ -2148,7 +2168,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 	userData := setupUserForAugmentWebSessionCertificatesTest(t, testServer)
 
 	// Safe to reuse, user-independent.
-	deviceExts := &DeviceExtensions{
+	deviceExts := &auth.DeviceExtensions{
 		DeviceID:     "my-device-id",
 		AssetTag:     "my-device-asset-tag",
 		CredentialID: "my-device-credential-id",
@@ -2176,7 +2196,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 	t.Run("ok", func(t *testing.T) {
 		t.Parallel() // Get the errors suite going asap.
 
-		opts := &AugmentWebSessionCertificatesOpts{
+		opts := &auth.AugmentWebSessionCertificatesOpts{
 			WebSessionID:     userData.webSessionID,
 			User:             userData.user,
 			DeviceExtensions: deviceExts,
@@ -2203,7 +2223,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 	})
 
 	user2Data := setupUserForAugmentWebSessionCertificatesTest(t, testServer)
-	user2Opts := &AugmentWebSessionCertificatesOpts{
+	user2Opts := &auth.AugmentWebSessionCertificatesOpts{
 		WebSessionID:     user2Data.webSessionID,
 		User:             user2Data.user,
 		DeviceExtensions: deviceExts,
@@ -2212,7 +2232,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 	t.Run("errors", func(t *testing.T) {
 		tests := []struct {
 			name      string
-			opts      *AugmentWebSessionCertificatesOpts
+			opts      *auth.AugmentWebSessionCertificatesOpts
 			wantErr   string
 			assertErr func(error) bool // defaults to trace.IsBadParameter
 		}{
@@ -2222,7 +2242,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 			},
 			{
 				name: "opts.WebSessionID is empty",
-				opts: func() *AugmentWebSessionCertificatesOpts {
+				opts: func() *auth.AugmentWebSessionCertificatesOpts {
 					opts := *user2Opts
 					opts.WebSessionID = ""
 					return &opts
@@ -2231,7 +2251,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 			},
 			{
 				name: "opts.User is empty",
-				opts: func() *AugmentWebSessionCertificatesOpts {
+				opts: func() *auth.AugmentWebSessionCertificatesOpts {
 					opts := *user2Opts
 					opts.User = ""
 					return &opts
@@ -2240,7 +2260,7 @@ func TestServer_AugmentWebSessionCertificates(t *testing.T) {
 			},
 			{
 				name: "opts.DeviceExtensions nil",
-				opts: func() *AugmentWebSessionCertificatesOpts {
+				opts: func() *auth.AugmentWebSessionCertificatesOpts {
 					opts := *user2Opts
 					opts.DeviceExtensions = nil
 					return &opts
@@ -2277,14 +2297,14 @@ func TestServer_ExtendWebSession_deviceExtensions(t *testing.T) {
 
 	userData := setupUserForAugmentWebSessionCertificatesTest(t, testServer)
 
-	deviceExts := &DeviceExtensions{
+	deviceExts := &auth.DeviceExtensions{
 		DeviceID:     "my-device-id",
 		AssetTag:     "my-device-asset-tag",
 		CredentialID: "my-device-credential-id",
 	}
 
 	// Augment the user's session, then later extend it.
-	err := authServer.AugmentWebSessionCertificates(ctx, &AugmentWebSessionCertificatesOpts{
+	err := authServer.AugmentWebSessionCertificates(ctx, &auth.AugmentWebSessionCertificatesOpts{
 		WebSessionID:     userData.webSessionID,
 		User:             userData.user,
 		DeviceExtensions: deviceExts,
@@ -2342,7 +2362,7 @@ type augmentUserData struct {
 	webSessionID string
 }
 
-func setupUserForAugmentWebSessionCertificatesTest(t *testing.T, testServer *TestTLSServer) *augmentUserData {
+func setupUserForAugmentWebSessionCertificatesTest(t *testing.T, testServer *authtest.TLSServer) *augmentUserData {
 	authServer := testServer.Auth()
 	ctx := context.Background()
 
@@ -2352,7 +2372,7 @@ func setupUserForAugmentWebSessionCertificatesTest(t *testing.T, testServer *Tes
 	}
 
 	// Create user and assign a password.
-	_, _, err := CreateUserAndRole(authServer, user.user, []string{user.user}, nil /* allowRules */)
+	_, _, err := authtest.CreateUserAndRole(authServer, user.user, []string{user.user}, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole")
 	require.NoError(t,
 		authServer.UpsertPassword(user.user, user.pass),
@@ -2378,7 +2398,7 @@ func setupUserForAugmentWebSessionCertificatesTest(t *testing.T, testServer *Tes
 }
 
 func TestGenerateUserCertIPPinning(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	s := newAuthSuite(t)
 
@@ -2389,13 +2409,13 @@ func TestGenerateUserCertIPPinning(t *testing.T) {
 	pass := []byte("abcdef123456")
 
 	// Create the user without IP pinning
-	_, _, err := CreateUserAndRole(s.a, unpinnedUser, []string{unpinnedUser}, nil)
+	_, _, err := authtest.CreateUserAndRole(s.a, unpinnedUser, []string{unpinnedUser}, nil)
 	require.NoError(t, err)
 	err = s.a.UpsertPassword(unpinnedUser, pass)
 	require.NoError(t, err)
 
 	// Create the user with IP pinning enabled
-	_, pinnedRole, err := CreateUserAndRole(s.a, pinnedUser, []string{pinnedUser}, nil)
+	_, pinnedRole, err := authtest.CreateUserAndRole(s.a, pinnedUser, []string{pinnedUser}, nil)
 	require.NoError(t, err)
 	err = s.a.UpsertPassword(pinnedUser, pass)
 	require.NoError(t, err)
@@ -2529,7 +2549,7 @@ func TestGenerateUserCertWithCertExtension(t *testing.T) {
 	p, err := newTestPack(ctx, t.TempDir())
 	require.NoError(t, err)
 
-	user, role, err := CreateUserAndRole(p.a, "test-user", []string{}, nil)
+	user, role, err := authtest.CreateUserAndRole(p.a, "test-user", []string{}, nil)
 	require.NoError(t, err)
 
 	extension := types.CertExtension{
@@ -2544,21 +2564,16 @@ func TestGenerateUserCertWithCertExtension(t *testing.T) {
 	_, err = p.a.UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	accessInfo := services.AccessInfoFromUserState(user)
-	accessChecker, err := services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
-	require.NoError(t, err)
-
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
-	certReq := certRequest{
-		user:         user,
-		checker:      accessChecker,
-		sshPublicKey: sshPubKey,
-		tlsPublicKey: tlsPubKey,
-	}
-	certs, err := p.a.generateUserCert(ctx, certReq)
+
+	sshCert, _, err := p.a.GenerateUserTestCertsWithContext(ctx, auth.GenerateUserTestCertsRequest{
+		SSHPubKey: sshPubKey,
+		TLSPubKey: tlsPubKey,
+		Username:  user.GetName(),
+	})
 	require.NoError(t, err)
 
-	key, err := sshutils.ParseCertificate(certs.SSH)
+	key, err := sshutils.ParseCertificate(sshCert)
 	require.NoError(t, err)
 
 	val, ok := key.Extensions[extension.Name]
@@ -2585,9 +2600,14 @@ func TestGenerateUserCertWithCertExtension(t *testing.T) {
 			ClientMetadata: apievents.ClientMetadata{
 				UserAgent: "test-user-agent/1.0",
 			},
+			CertificateAuthority: &apievents.CertificateAuthority{
+				Type:   "user",
+				Domain: "test.localhost",
+			},
 		},
 		lastEvent.(*apievents.CertificateCreate),
 		cmpopts.IgnoreFields(apievents.Identity{}, "Logins", "Expires"),
+		cmpopts.IgnoreFields(apievents.CertificateAuthority{}, "SubjectKeyID"),
 	))
 }
 
@@ -2600,7 +2620,7 @@ func TestGenerateOpenSSHCert(t *testing.T) {
 
 	// create keypair and sign with OpenSSH CA
 	logins := []string{"login1", "login2"}
-	u, r, err := CreateUserAndRole(p.a, "test-user", logins, nil)
+	u, r, err := authtest.CreateUserAndRole(p.a, "test-user", logins, nil)
 	require.NoError(t, err)
 
 	user, ok := u.(*types.UserV2)
@@ -2652,30 +2672,29 @@ func TestGenerateUserCertWithLocks(t *testing.T) {
 	p, err := newTestPack(ctx, t.TempDir())
 	require.NoError(t, err)
 
-	user, _, err := CreateUserAndRole(p.a, "test-user", []string{}, nil)
-	require.NoError(t, err)
-	accessInfo := services.AccessInfoFromUserState(user)
-	accessChecker, err := services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
+	user, _, err := authtest.CreateUserAndRole(p.a, "test-user", []string{}, nil)
 	require.NoError(t, err)
+
 	const mfaID = "test-mfa-id"
 	const requestID = "test-access-request"
 	const deviceID = "deviceid1"
 
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
-	certReq := certRequest{
-		user:           user,
-		checker:        accessChecker,
-		mfaVerified:    mfaID,
-		sshPublicKey:   sshPubKey,
-		tlsPublicKey:   tlsPubKey,
-		activeRequests: []string{requestID},
-		deviceExtensions: DeviceExtensions{
+
+	certReq := auth.GenerateUserTestCertsRequest{
+		SSHPubKey:      sshPubKey,
+		TLSPubKey:      tlsPubKey,
+		Username:       user.GetName(),
+		ActiveRequests: []string{requestID},
+		MFAVerified:    mfaID,
+		DeviceExtensions: auth.DeviceExtensions{
 			DeviceID:     deviceID,
 			AssetTag:     "assettag1",
 			CredentialID: "credentialid1",
 		},
 	}
-	_, err = p.a.generateUserCert(ctx, certReq)
+
+	_, _, err = p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 	require.NoError(t, err)
 
 	testTargets := append(
@@ -2689,7 +2708,7 @@ func TestGenerateUserCertWithLocks(t *testing.T) {
 	)
 	for _, target := range testTargets {
 		t.Run(fmt.Sprintf("lock targeting %v", target), func(t *testing.T) {
-			lockWatch, err := p.a.lockWatcher.Subscribe(ctx, target)
+			lockWatch, err := p.a.SubscribeToLockTarget(ctx, target)
 			require.NoError(t, err)
 			defer lockWatch.Close()
 			lock, err := types.NewLock("test-lock", types.LockSpecV2{Target: target})
@@ -2705,7 +2724,8 @@ func TestGenerateUserCertWithLocks(t *testing.T) {
 			case <-time.After(2 * time.Second):
 				t.Fatal("Timeout waiting for lock update.")
 			}
-			_, err = p.a.generateUserCert(ctx, certReq)
+
+			_, _, err = p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 			require.Error(t, err)
 			require.EqualError(t, err, services.LockInForceAccessDenied(lock).Error())
 		})
@@ -2727,7 +2747,7 @@ func TestGenerateHostCertWithLocks(t *testing.T) {
 	require.NoError(t, err)
 
 	target := types.LockTarget{ServerID: hostID}
-	lockWatch, err := p.a.lockWatcher.Subscribe(ctx, target)
+	lockWatch, err := p.a.SubscribeToLockTarget(ctx, target)
 	require.NoError(t, err)
 	defer lockWatch.Close()
 	lock, err := types.NewLock("test-lock", types.LockSpecV2{Target: target})
@@ -2758,27 +2778,22 @@ func TestGenerateUserCertWithUserLoginState(t *testing.T) {
 	p, err := newTestPack(ctx, t.TempDir())
 	require.NoError(t, err)
 
-	user, role, err := CreateUserAndRole(p.a, "test-user", []string{}, nil)
-	require.NoError(t, err)
-	userState, err := p.a.GetUserOrLoginState(ctx, user.GetName())
-	require.NoError(t, err)
-	accessInfo := services.AccessInfoFromUserState(userState)
-	accessChecker, err := services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
+	user, role, err := authtest.CreateUserAndRole(p.a, "test-user", []string{}, nil)
 	require.NoError(t, err)
+
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
 
 	// Generate cert with no user login state.
-	certReq := certRequest{
-		user:         user,
-		checker:      accessChecker,
-		sshPublicKey: sshPubKey,
-		tlsPublicKey: tlsPubKey,
-		traits:       accessChecker.Traits(),
+	certReq := auth.GenerateUserTestCertsRequest{
+		SSHPubKey: sshPubKey,
+		TLSPubKey: tlsPubKey,
+		Username:  user.GetName(),
 	}
-	resp, err := p.a.generateUserCert(ctx, certReq)
+
+	rawSSHCert, _, err := p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 	require.NoError(t, err)
 
-	sshCert, err := sshutils.ParseCertificate(resp.SSH)
+	sshCert, err := sshutils.ParseCertificate(rawSSHCert)
 	require.NoError(t, err)
 
 	sshIdent, err := sshca.DecodeIdentity(sshCert)
@@ -2821,24 +2836,16 @@ func TestGenerateUserCertWithUserLoginState(t *testing.T) {
 	_, err = p.a.UpsertRole(ctx, ulsRole2)
 	require.NoError(t, err)
 
-	userState, err = p.a.GetUserOrLoginState(ctx, user.GetName())
-	require.NoError(t, err)
-	accessInfo = services.AccessInfoFromUserState(userState)
-	accessChecker, err = services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
-	require.NoError(t, err)
-
-	certReq = certRequest{
-		user:         user,
-		checker:      accessChecker,
-		sshPublicKey: sshPubKey,
-		tlsPublicKey: tlsPubKey,
-		traits:       accessChecker.Traits(),
+	certReq = auth.GenerateUserTestCertsRequest{
+		SSHPubKey: sshPubKey,
+		TLSPubKey: tlsPubKey,
+		Username:  user.GetName(),
 	}
 
-	resp, err = p.a.generateUserCert(ctx, certReq)
+	rawSSHCert, _, err = p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 	require.NoError(t, err)
 
-	sshCert, err = sshutils.ParseCertificate(resp.SSH)
+	sshCert, err = sshutils.ParseCertificate(rawSSHCert)
 	require.NoError(t, err)
 
 	sshIdent, err = sshca.DecodeIdentity(sshCert)
@@ -2859,7 +2866,7 @@ func TestGenerateUserCertWithHardwareKeySupport(t *testing.T) {
 	p, err := newTestPack(ctx, t.TempDir())
 	require.NoError(t, err)
 
-	user, _, err := CreateUserAndRole(p.a, "test-user", []string{}, nil)
+	user, _, err := authtest.CreateUserAndRole(p.a, "test-user", []string{}, nil)
 	require.NoError(t, err)
 	user.SetTraits(map[string][]string{
 		// add in other random serial numbers to test comparison logic.
@@ -2870,16 +2877,12 @@ func TestGenerateUserCertWithHardwareKeySupport(t *testing.T) {
 	_, err = p.a.UpdateUser(ctx, user)
 	require.NoError(t, err)
 
-	accessInfo := services.AccessInfoFromUserState(user)
-	accessChecker, err := services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
-	require.NoError(t, err)
-
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
-	certReq := certRequest{
-		user:         user,
-		checker:      accessChecker,
-		sshPublicKey: sshPubKey,
-		tlsPublicKey: tlsPubKey,
+
+	certReq := auth.GenerateUserTestCertsRequest{
+		SSHPubKey: sshPubKey,
+		TLSPubKey: tlsPubKey,
+		Username:  user.GetName(),
 	}
 
 	for _, tt := range []struct {
@@ -3008,7 +3011,7 @@ func TestGenerateUserCertWithHardwareKeySupport(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				MockAttestationData: tt.mockAttestationData,
 			})
 
@@ -3017,7 +3020,7 @@ func TestGenerateUserCertWithHardwareKeySupport(t *testing.T) {
 			_, err = p.a.UpsertAuthPreference(ctx, authPref)
 			require.NoError(t, err)
 
-			_, err = p.a.generateUserCert(ctx, certReq)
+			_, _, err = p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 			tt.assertErr(t, err)
 		})
 	}
@@ -3028,7 +3031,7 @@ func TestGenerateKubernetesUserCert(t *testing.T) {
 	p, err := newTestPack(ctx, t.TempDir())
 	require.NoError(t, err)
 
-	user, _, err := CreateUserAndRole(p.a, "test-user", []string{}, nil)
+	user, _, err := authtest.CreateUserAndRole(p.a, "test-user", []string{}, nil)
 	require.NoError(t, err)
 
 	rc, err := types.NewRemoteCluster("leaf")
@@ -3056,10 +3059,6 @@ func TestGenerateKubernetesUserCert(t *testing.T) {
 		assert.Contains(t, gotNames, kubeCluster.GetName(), "missing kube cluster")
 	}, 15*time.Second, 100*time.Millisecond)
 
-	accessInfo := services.AccessInfoFromUserState(user)
-	accessChecker, err := services.NewAccessChecker(accessInfo, p.clusterName.GetClusterName(), p.a)
-	require.NoError(t, err)
-
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
 
 	for _, tt := range []struct {
@@ -3088,16 +3087,15 @@ func TestGenerateKubernetesUserCert(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			certReq := certRequest{
-				user:              user,
-				checker:           accessChecker,
-				sshPublicKey:      sshPubKey,
-				tlsPublicKey:      tlsPubKey,
-				routeToCluster:    tt.teleportCluster,
-				kubernetesCluster: tt.kubernetesCluster,
+			certReq := auth.GenerateUserTestCertsRequest{
+				SSHPubKey:         sshPubKey,
+				TLSPubKey:         tlsPubKey,
+				Username:          user.GetName(),
+				RouteToCluster:    tt.teleportCluster,
+				KubernetesCluster: tt.kubernetesCluster,
 			}
 
-			_, err = p.a.generateUserCert(ctx, certReq)
+			_, _, err = p.a.GenerateUserTestCertsWithContext(ctx, certReq)
 			tt.assertErr(t, err)
 		})
 	}
@@ -3117,20 +3115,20 @@ func TestNewWebSession(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a user.
-	user, _, err := CreateUserAndRole(p.a, "test-user", []string{"test-role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(p.a, "test-user", []string{"test-role"}, nil)
 	require.NoError(t, err)
 
 	// Create a new web session.
-	req := NewWebSessionRequest{
+	req := auth.NewWebSessionRequest{
 		User:       user.GetName(),
 		Roles:      user.GetRoles(),
 		Traits:     user.GetTraits(),
-		LoginTime:  p.a.clock.Now().UTC(),
+		LoginTime:  p.a.GetClock().Now().UTC(),
 		SessionTTL: apidefaults.CertDuration,
 	}
-	bearerTokenTTL := min(req.SessionTTL, defaults.BearerTokenTTL)
+	bearerTokenTTL := min(req.SessionTTL, duration)
 
-	ws, _, err := p.a.newWebSession(ctx, req, nil /* opts */)
+	ws, _, err := p.a.NewWebSession(ctx, req, nil /* opts */)
 	require.NoError(t, err)
 	require.Equal(t, user.GetName(), ws.GetUser())
 	require.Equal(t, duration, ws.GetIdleTimeout())
@@ -3150,12 +3148,12 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 	testServer := newTestTLSServer(t)
 	authServer := testServer.Auth()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	authServer.emitter = mockEmitter
+	authServer.SetEmitter(mockEmitter)
 
 	ctx := context.Background()
 
 	const username = "llama@goteleport.com"
-	_, _, err := CreateUserAndRole(authServer, username, []string{username}, nil /* allowRules */)
+	_, _, err := authtest.CreateUserAndRole(authServer, username, []string{username}, nil /* allowRules */)
 	require.NoError(t, err)
 
 	authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
@@ -3169,18 +3167,18 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 	_, err = authServer.UpsertAuthPreference(ctx, authPreference)
 	require.NoError(t, err)
 
-	userClient, err := testServer.NewClient(TestUser(username))
+	userClient, err := testServer.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
 	// webDev1 is used as the authenticator for various checks.
-	webDev1, err := RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev1, err := authtest.RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice(web1)")
 
 	// Insert devices for deletion.
-	deviceOpts := []TestDeviceOpt{WithTestDeviceClock(testServer.Clock())}
-	registerDevice := func(t *testing.T, deviceName string, deviceType proto.DeviceType) *TestDevice {
+	deviceOpts := []authtest.TestDeviceOpt{authtest.WithTestDeviceClock(testServer.Clock())}
+	registerDevice := func(t *testing.T, deviceName string, deviceType proto.DeviceType) *authtest.Device {
 		t.Helper()
-		testDev, err := RegisterTestDevice(
+		testDev, err := authtest.RegisterTestDevice(
 			ctx, userClient, deviceName, deviceType, webDev1 /* authenticator */, deviceOpts...)
 		require.NoError(t, err, "RegisterTestDevice(%v)", deviceName)
 		return testDev
@@ -3192,7 +3190,7 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 
 	deleteReqUsingToken := func(tokenReq authclient.CreateUserTokenRequest) func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
 		return func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
-			token, err := authServer.newUserToken(tokenReq)
+			token, err := authServer.NewUserToken(ctx, tokenReq)
 			require.NoError(t, err, "newUserToken")
 
 			_, err = authServer.CreateUserToken(ctx, token)
@@ -3204,7 +3202,7 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 		}
 	}
 
-	deleteReqUsingChallenge := func(authenticator *TestDevice) func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
+	deleteReqUsingChallenge := func(authenticator *authtest.Device) func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
 		return func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
 			authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
 				Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
@@ -3300,7 +3298,7 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 	ctx := context.Background()
 
 	const username = "llama@goteleport.com"
-	_, _, err := CreateUserAndRole(authServer, username, []string{username}, nil)
+	_, _, err := authtest.CreateUserAndRole(authServer, username, []string{username}, nil)
 	require.NoError(t, err)
 
 	const origin = "localhost"
@@ -3315,13 +3313,13 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 	_, err = authServer.UpsertAuthPreference(ctx, authPreference)
 	require.NoError(t, err)
 
-	userClient, err := testServer.NewClient(TestUser(username))
+	userClient, err := testServer.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
 	// Insert a device.
 	const devName = "otp"
-	_, err = RegisterTestDevice(
-		ctx, userClient, devName, proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, WithTestDeviceClock(clock))
+	_, err = authtest.RegisterTestDevice(
+		ctx, userClient, devName, proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, authtest.WithTestDeviceClock(clock))
 	require.NoError(t, err)
 
 	createReq := func(name string) *proto.DeleteMFADeviceSyncRequest {
@@ -3397,7 +3395,7 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 			deleteReq := test.deleteReq
 
 			if test.tokenRequest != nil {
-				token, err := authServer.newUserToken(*test.tokenRequest)
+				token, err := authServer.NewUserToken(ctx, *test.tokenRequest)
 				require.NoError(t, err)
 				_, err = authServer.CreateUserToken(context.Background(), token)
 				require.NoError(t, err)
@@ -3427,7 +3425,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 	userCreds, err := createUserWithSecondFactors(testServer)
 	require.NoError(t, err, "createUserWithSecondFactors")
 
-	userClient, err := testServer.NewClient(TestUser(userCreds.username))
+	userClient, err := testServer.NewClient(authtest.TestUser(userCreds.username))
 	require.NoError(t, err, "NewClient")
 	totpDev := userCreds.totpDev
 	webDev := userCreds.webDev
@@ -3449,7 +3447,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 		require.NoError(t, err, "UpsertAuthPreference")
 	}
 
-	deleteDevice := func(userClient *authclient.Client, testDev *TestDevice) error {
+	deleteDevice := func(userClient *authclient.Client, testDev *authtest.Device) error {
 		// Issue and solve authn challenge.
 		authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
 			Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
@@ -3473,7 +3471,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 		})
 	}
 
-	makeTest := func(sf constants.SecondFactorType, deviceToDelete *TestDevice) func(t *testing.T) {
+	makeTest := func(sf constants.SecondFactorType, deviceToDelete *authtest.Device) func(t *testing.T) {
 		return func(t *testing.T) {
 			t.Helper()
 
@@ -3512,7 +3510,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 	t.Run("second factor on, otp device", makeTest(constants.SecondFactorOn, totpDev))
 
 	// Same as above, but now delete the last Webauthn device.
-	webDev, err = RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev /* authenticator */)
+	webDev, err = authtest.RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
 	require.NoError(t,
 		deleteDevice(userClient, totpDev),
@@ -3545,7 +3543,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 	u, err := createUserWithSecondFactors(testServer)
 	require.NoError(t, err)
 
-	userClient, err := testServer.NewClient(TestUser(u.username))
+	userClient, err := testServer.NewClient(authtest.TestUser(u.username))
 	require.NoError(t, err)
 
 	solveChallengeWithToken := func(
@@ -3553,8 +3551,8 @@ func TestAddMFADeviceSync(t *testing.T) {
 		tokenType string,
 		deviceType proto.DeviceType,
 		deviceUsage proto.DeviceUsage,
-	) (token string, testDev *TestDevice, registerSolved *proto.MFARegisterResponse) {
-		privilegeToken, err := authServer.createPrivilegeToken(ctx, u.username, tokenType)
+	) (token string, testDev *authtest.Device, registerSolved *proto.MFARegisterResponse) {
+		privilegeToken, err := auth.CreatePrivilegeToken(ctx, authServer, u.username, tokenType)
 		require.NoError(t, err, "createPrivilegeToken")
 		token = privilegeToken.GetName()
 
@@ -3565,7 +3563,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 		})
 		require.NoError(t, err, "CreateRegisterChallenge")
 
-		testDev, registerSolved, err = NewTestDeviceFromChallenge(registerChal, WithTestDeviceClock(clock))
+		testDev, registerSolved, err = authtest.NewTestDeviceFromChallenge(registerChal, authtest.WithTestDeviceClock(clock))
 		require.NoError(t, err, "NewTestDeviceFromChallenge")
 		return token, testDev, registerSolved
 	}
@@ -3574,7 +3572,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 		t *testing.T,
 		deviceType proto.DeviceType,
 		deviceUsage proto.DeviceUsage,
-	) (*TestDevice, *proto.MFARegisterResponse) {
+	) (*authtest.Device, *proto.MFARegisterResponse) {
 		// Create and solve a registration challenge.
 		authChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
 			Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
@@ -3596,9 +3594,9 @@ func TestAddMFADeviceSync(t *testing.T) {
 		})
 		require.NoError(t, err, "CreateRegisterChallenge")
 
-		testDev, registerSolved, err := NewTestDeviceFromChallenge(
+		testDev, registerSolved, err := authtest.NewTestDeviceFromChallenge(
 			registerChal,
-			WithTestDeviceClock(clock),
+			authtest.WithTestDeviceClock(clock),
 		)
 		require.NoError(t, err, "NewTestDeviceFromChallenge")
 		return testDev, registerSolved
@@ -3615,7 +3613,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 			wantErr: true,
 			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
 				// Obtain a non privilege token.
-				token, err := authServer.newUserToken(authclient.CreateUserTokenRequest{
+				token, err := authServer.NewUserToken(ctx, authclient.CreateUserTokenRequest{
 					Name: u.username,
 					TTL:  5 * time.Minute,
 					Type: authclient.UserTokenTypeResetPassword,
@@ -3660,7 +3658,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 		},
 		{
 			name:       "invalid device name length",
-			deviceName: strings.Repeat("A", mfaDeviceNameMaxLen+1),
+			deviceName: strings.Repeat("A", auth.MFADeviceNameMaxLen+1),
 			wantErr:    true,
 			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
 				token, _, registerSolved := solveChallengeWithToken(
@@ -3761,14 +3759,14 @@ func TestGetMFADevices_WithToken(t *testing.T) {
 	require.NoError(t, err)
 
 	username := "llama@goteleport.com"
-	_, _, err = CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
+	_, _, err = authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
-	clt, err := srv.NewClient(TestUser(username))
+	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	webDev, err := RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
-	totpDev, err := RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, WithTestDeviceClock(srv.Clock()))
+	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -3805,7 +3803,7 @@ func TestGetMFADevices_WithToken(t *testing.T) {
 			tokenID := "test-token-not-found"
 
 			if tc.tokenRequest != nil {
-				token, err := srv.Auth().newUserToken(*tc.tokenRequest)
+				token, err := srv.Auth().NewUserToken(ctx, *tc.tokenRequest)
 				require.NoError(t, err)
 				_, err = srv.Auth().CreateUserToken(context.Background(), token)
 				require.NoError(t, err)
@@ -3845,14 +3843,14 @@ func TestGetMFADevices_WithAuth(t *testing.T) {
 	require.NoError(t, err)
 
 	username := "llama@goteleport.com"
-	_, _, err = CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
+	_, _, err = authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
-	clt, err := srv.NewClient(TestUser(username))
+	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	webDev, err := RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
-	totpDev, err := RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, WithTestDeviceClock(srv.Clock()))
+	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
 	require.NoError(t, err)
 
 	res, err := clt.GetMFADevices(ctx, &proto.GetMFADevicesRequest{})
@@ -3860,7 +3858,7 @@ func TestGetMFADevices_WithAuth(t *testing.T) {
 	compareDevices(t, true /* ignoreUpdateAndCounter */, res.GetDevices(), webDev.MFA, totpDev.MFA)
 }
 
-func newTestServices(t *testing.T) Services {
+func newTestServices(t *testing.T) auth.Services {
 	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
 
@@ -3870,7 +3868,7 @@ func newTestServices(t *testing.T) Services {
 	identityService, err := local.NewTestIdentityService(bk)
 	require.NoError(t, err)
 
-	return Services{
+	return auth.Services{
 		TrustInternal:                local.NewCAService(bk),
 		PresenceInternal:             local.NewPresenceService(bk),
 		Provisioner:                  local.NewProvisioningService(bk),
@@ -3972,7 +3970,7 @@ func TestFilterResources(t *testing.T) {
 			cache:          mockCache{resources: nodes},
 			errorAssertion: require.NoError,
 			filterFn: func(labels types.ResourceWithLabels) error {
-				return ErrDone
+				return auth.ErrDone
 			},
 		},
 		{
@@ -4001,7 +3999,7 @@ func TestFilterResources(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			srv := &Server{Cache: tt.cache}
+			srv := &auth.Server{Cache: tt.cache}
 
 			err := srv.IterateResources(ctx, proto.ListResourcesRequest{
 				ResourceType: types.KindNode,
@@ -4013,6 +4011,12 @@ func TestFilterResources(t *testing.T) {
 	}
 }
 
+type fakeAuthPreferenceGetter struct{}
+
+func (f *fakeAuthPreferenceGetter) GetAuthPreference(context.Context) (types.AuthPreference, error) {
+	return types.DefaultAuthPreference(), nil
+}
+
 func TestCAGeneration(t *testing.T) {
 	ctx := context.Background()
 	const (
@@ -4023,16 +4027,19 @@ func TestCAGeneration(t *testing.T) {
 	privKey, pubKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	keyStore := keystore.NewSoftwareKeystoreForTests(t,
-		keystore.WithRSAKeyPairSource(func() (priv []byte, pub []byte, err error) {
+	keyStoreManager, err := keystore.NewManager(t.Context(), &servicecfg.KeystoreConfig{}, &keystore.Options{
+		ClusterName:          &types.ClusterNameV2{Metadata: types.Metadata{Name: clusterName}},
+		AuthPreferenceGetter: &fakeAuthPreferenceGetter{},
+		RSAKeyPairSource: func(alg cryptosuites.Algorithm) (priv []byte, pub []byte, err error) {
 			return privKey, pubKey, nil
-		}),
-	)
+		},
+	})
+	require.NoError(t, err)
 
 	for _, caType := range types.CertAuthTypes {
 		t.Run(string(caType), func(t *testing.T) {
-			testKeySet := suite.NewTestCA(caType, clusterName, privKey).Spec.ActiveKeys
-			keySet, err := newKeySet(ctx, keyStore, types.CertAuthID{Type: caType, DomainName: clusterName})
+			testKeySet := authtest.NewTestCA(caType, clusterName, privKey).Spec.ActiveKeys
+			keySet, err := auth.NewKeySet(ctx, keyStoreManager, types.CertAuthID{Type: caType, DomainName: clusterName})
 			require.NoError(t, err)
 
 			// Don't compare values as those are different. Only check if the key is set/not set in both cases.
@@ -4091,17 +4098,33 @@ func TestInstallerCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, newContents, newInst.GetScript())
 
-	instcoll, err := s.a.GetInstallers(ctx)
-	require.NoError(t, err)
-	var instScripts []string
-	for _, inst := range instcoll {
-		instScripts = append(instScripts, inst.GetScript())
-	}
+	t.Run("GetInstallers", func(t *testing.T) {
+		instcoll, err := s.a.GetInstallers(ctx)
+		require.NoError(t, err)
+		var instScripts []string
+		for _, inst := range instcoll {
+			instScripts = append(instScripts, inst.GetScript())
+		}
 
-	require.ElementsMatch(t,
-		[]string{inst.GetScript(), newInst.GetScript()},
-		instScripts,
-	)
+		require.ElementsMatch(t,
+			[]string{inst.GetScript(), newInst.GetScript()},
+			instScripts,
+		)
+	})
+
+	t.Run("ListInstallers", func(t *testing.T) {
+		instcoll, err := stream.Collect(clientutils.Resources(ctx, s.a.ListInstallers))
+		require.NoError(t, err)
+		var instScripts []string
+		for _, inst := range instcoll {
+			instScripts = append(instScripts, inst.GetScript())
+		}
+
+		require.ElementsMatch(t,
+			[]string{inst.GetScript(), newInst.GetScript()},
+			instScripts,
+		)
+	})
 
 	err = s.a.DeleteInstaller(ctx, installers.InstallerScriptName)
 	require.NoError(t, err)
@@ -4116,7 +4139,7 @@ func TestGetTokens(t *testing.T) {
 	s := newAuthSuite(t)
 	ctx := context.Background()
 
-	_, _, err := CreateUserAndRole(s.a, "username", []string{"username"}, nil)
+	_, _, err := authtest.CreateUserAndRole(s.a, "username", []string{"username"}, nil)
 	require.NoError(t, err)
 	_, err = s.a.CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
 		Name: "username",
@@ -4172,7 +4195,7 @@ func TestAccessRequestAuditLog(t *testing.T) {
 
 	accessRequest, err := types.NewAccessRequest(uuid.NewString(), requester, "requestRole")
 	require.NoError(t, err)
-	req, err := p.a.CreateAccessRequestV2(ctx, accessRequest, TestUser(requester).I.GetIdentity())
+	req, err := p.a.CreateAccessRequestV2(ctx, accessRequest, authtest.TestUser(requester).I.GetIdentity())
 	require.NoError(t, err)
 
 	expectedAnnotations, err := apievents.EncodeMapStrings(paymentsRole.GetAccessRequestConditions(types.Allow).Annotations)
@@ -4195,7 +4218,7 @@ func TestAccessRequestAuditLog(t *testing.T) {
 	require.Equal(t, "APPROVED", arc.RequestState)
 }
 
-func testCreateRole(t *testing.T, server *TestTLSServer, name string, setup func(*types.RoleSpecV6)) types.Role {
+func testCreateRole(t *testing.T, server *authtest.TLSServer, name string, setup func(*types.RoleSpecV6)) types.Role {
 	t.Helper()
 	ctx := context.Background()
 
@@ -4222,7 +4245,7 @@ func testCreateRole(t *testing.T, server *TestTLSServer, name string, setup func
 	return createdRole
 }
 
-func testCreateUserWithRoles(t *testing.T, server *TestTLSServer, user string, roles ...string) (TestIdentity, *authclient.Client) {
+func testCreateUserWithRoles(t *testing.T, server *authtest.TLSServer, user string, roles ...string) (authtest.TestIdentity, *authclient.Client) {
 	t.Helper()
 	ctx := context.Background()
 
@@ -4232,7 +4255,7 @@ func testCreateUserWithRoles(t *testing.T, server *TestTLSServer, user string, r
 	_, err = server.AuthServer.AuthServer.UpsertUser(ctx, u)
 	require.NoError(t, err, "AuthServer.UpsertUser")
 
-	identity := TestUser(user)
+	identity := authtest.TestUser(user)
 	client, err := server.NewClient(identity)
 	require.NoError(t, err, "server.NewClient")
 
@@ -4245,13 +4268,16 @@ func TestAccessRequestNotifications(t *testing.T) {
 
 	fakeClock := clockwork.NewFakeClock()
 
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: fakeClock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
 	testTLSServer, err := testAuthServer.NewTestTLSServer()
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testTLSServer.Close()) })
 
 	reviewerUsername := "reviewer"
 	requesterUsername := "requester"
@@ -4304,7 +4330,7 @@ func TestAccessRequestNotifications(t *testing.T) {
 	// Create another access request.
 	accessRequest, err = types.NewAccessRequest(uuid.NewString(), requester.GetUsername(), requestRole.GetName())
 	require.NoError(t, err)
-	req, err = testTLSServer.AuthServer.AuthServer.CreateAccessRequestV2(ctx, accessRequest, TestUser(requester.GetUsername()).I.GetIdentity())
+	req, err = testTLSServer.AuthServer.AuthServer.CreateAccessRequestV2(ctx, accessRequest, authtest.TestUser(requester.GetUsername()).I.GetIdentity())
 	require.NoError(t, err)
 
 	// Deny the request.
@@ -4333,7 +4359,7 @@ func TestAccessRequestDryRunEnrichment(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
@@ -4487,12 +4513,13 @@ func TestCleanupNotifications(t *testing.T) {
 
 	fakeClock := clockwork.NewFakeClock()
 
-	authServer, err := NewTestAuthServer(TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:          t.TempDir(),
 		Clock:        fakeClock,
 		CacheEnabled: true,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
 
 	srv, err := authServer.NewTestTLSServer()
 	require.NoError(t, err)
@@ -4617,7 +4644,7 @@ func TestCleanupNotifications(t *testing.T) {
 func TestCreateAccessListReminderNotifications(t *testing.T) {
 	ctx := context.Background()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -4647,35 +4674,8 @@ func TestCreateAccessListReminderNotifications(t *testing.T) {
 	_, err = authServer.UpsertUser(ctx, user)
 	require.NoError(t, err)
 
-	client, err := testServer.NewClient(TestUser(testUsername))
-	require.NoError(t, err)
-
-	// Helper to create access lists with specific next audit dates
-	createAccessList := func(t *testing.T, name string, nextAuditDate time.Time) {
-		al, err := accesslist.NewAccessList(header.Metadata{
-			Name: name,
-		}, accesslist.Spec{
-			Title:       fmt.Sprintf("Access List %s", name),
-			Description: fmt.Sprintf("Test access list %s", name),
-			Owners: []accesslist.Owner{{
-				Name:           testUsername,
-				Description:    "",
-				MembershipKind: "",
-			}},
-			Audit: accesslist.Audit{
-				NextAuditDate: nextAuditDate,
-				Recurrence:    accesslist.Recurrence{},
-				Notifications: accesslist.Notifications{},
-			},
-			Grants: accesslist.Grants{
-				Roles: []string{"grant"},
-			},
-		})
-		require.NoError(t, err)
-
-		_, err = authServer.UpsertAccessList(ctx, al)
-		require.NoError(t, err)
-	}
+	client, err := testServer.NewClient(authtest.TestUser(testUsername))
+	require.NoError(t, err)
 
 	// Create access lists with different expiry times
 	accessLists := []struct {
@@ -4700,41 +4700,118 @@ func TestCreateAccessListReminderNotifications(t *testing.T) {
 	}
 
 	for _, al := range accessLists {
-		createAccessList(t, al.name, authServer.clock.Now().Add(time.Duration(al.dueInDays)*24*time.Hour))
+		createAccessList(t, authServer, al.name+"-static",
+			withType(accesslist.Static),
+			withOwners([]accesslist.Owner{{Name: testUsername}}),
+			withNextAuditDate(authServer.GetClock().Now().Add(time.Duration(al.dueInDays)*24*time.Hour)),
+		)
+		createAccessList(t, authServer, al.name+"-scim",
+			withType(accesslist.SCIM),
+			withOwners([]accesslist.Owner{{Name: testUsername}}),
+			withNextAuditDate(authServer.GetClock().Now().Add(time.Duration(al.dueInDays)*24*time.Hour)),
+		)
+		createAccessList(t, authServer, al.name,
+			withOwners([]accesslist.Owner{{Name: testUsername}}),
+			withNextAuditDate(authServer.GetClock().Now().Add(time.Duration(al.dueInDays)*24*time.Hour)),
+		)
 	}
 
 	// Run CreateAccessListReminderNotifications()
 	authServer.CreateAccessListReminderNotifications(ctx)
 
+	reminderNotificationSubKind := func(n *notificationsv1.Notification) string { return n.GetSubKind() }
+	expectedSubKinds := []string{
+		"access-list-review-overdue-7d",
+		"access-list-review-overdue-3d",
+		"access-list-review-due-0d",
+		"access-list-review-due-3d",
+		"access-list-review-due-7d",
+		"access-list-review-due-14d",
+	}
+
 	// Check notifications
-	resp, err := client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 50,
-	})
+	resp, err := client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 6)
+	require.ElementsMatch(t, expectedSubKinds, slices.Map(resp.Notifications, reminderNotificationSubKind))
 
-	// Run CreateAccessListReminderNotifications() again to verify no duplicates are created if it's run again.
+	// Run CreateAccessListReminderNotifications() again to verify no duplicates are created
 	authServer.CreateAccessListReminderNotifications(ctx)
 
 	// Check notifications again, counts should remain the same.
-	resp, err = client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 50,
+	resp, err = client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
+	require.NoError(t, err)
+	require.ElementsMatch(t, expectedSubKinds, slices.Map(resp.Notifications, reminderNotificationSubKind),
+		"notifications should not have changed after second reconciliation")
+}
+
+type createAccessListOptions struct {
+	typ           accesslist.Type
+	nextAuditDate time.Time
+	owners        []accesslist.Owner
+}
+
+type createAccessListOpt func(*createAccessListOptions)
+
+func withType(typ accesslist.Type) createAccessListOpt {
+	return func(o *createAccessListOptions) {
+		o.typ = typ
+	}
+}
+
+func withNextAuditDate(nextAuditDate time.Time) createAccessListOpt {
+	return func(o *createAccessListOptions) {
+		o.nextAuditDate = nextAuditDate
+	}
+}
+
+func withOwners(owners []accesslist.Owner) createAccessListOpt {
+	return func(o *createAccessListOptions) {
+		o.owners = owners
+	}
+}
+
+func createAccessList(t *testing.T, authServer *auth.Server, name string, opts ...createAccessListOpt) {
+	t.Helper()
+	ctx := t.Context()
+
+	options := createAccessListOptions{}
+	for _, o := range opts {
+		o(&options)
+	}
+
+	al, err := accesslist.NewAccessList(header.Metadata{
+		Name: name,
+	}, accesslist.Spec{
+		Type:        options.typ,
+		Title:       fmt.Sprintf("Test Access List %s", name),
+		Description: fmt.Sprintf("Test Access List %s description", name),
+		Owners:      options.owners,
+		Audit: accesslist.Audit{
+			NextAuditDate: options.nextAuditDate,
+			Recurrence:    accesslist.Recurrence{},
+			Notifications: accesslist.Notifications{},
+		},
+		Grants: accesslist.Grants{
+			Roles: []string{"grant"},
+		},
 	})
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 6)
+
+	_, err = authServer.UpsertAccessList(ctx, al)
+	require.NoError(t, err)
 }
 
 func TestServer_GetAnonymizationKey(t *testing.T) {
 	tests := []struct {
 		name        string
-		testModules *modules.TestModules
+		testModules modulestest.Modules
 		license     *license.License
 		want        string
 		errCheck    require.ErrorAssertionFunc
 	}{
 		{
 			name: "returns CloudAnonymizationKey if present",
-			testModules: &modules.TestModules{
+			testModules: modulestest.Modules{
 				TestFeatures: modules.Features{CloudAnonymizationKey: []byte("cloud-key")},
 			},
 			license: &license.License{
@@ -4745,7 +4822,7 @@ func TestServer_GetAnonymizationKey(t *testing.T) {
 		},
 		{
 			name:        "Returns license AnonymizationKey if no Cloud Key is present",
-			testModules: &modules.TestModules{},
+			testModules: modulestest.Modules{},
 			license: &license.License{
 				AnonymizationKey: []byte("license-key"),
 			},
@@ -4754,7 +4831,7 @@ func TestServer_GetAnonymizationKey(t *testing.T) {
 		},
 		{
 			name:        "Returns clusterID if no cloud key nor license key is present",
-			testModules: &modules.TestModules{},
+			testModules: modulestest.Modules{},
 			license:     &license.License{},
 			want:        "cluster-id",
 			errCheck:    require.NoError,
@@ -4763,7 +4840,7 @@ func TestServer_GetAnonymizationKey(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir:       t.TempDir(),
 				Clock:     clockwork.NewFakeClock(),
 				ClusterID: "cluster-id",
@@ -4775,7 +4852,7 @@ func TestServer_GetAnonymizationKey(t *testing.T) {
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, testTLSServer.Close()) })
 
-			modules.SetTestModules(t, tt.testModules)
+			modulestest.SetTestModules(t, tt.testModules)
 
 			testTLSServer.AuthServer.AuthServer.SetLicense(tt.license)
 
@@ -4835,8 +4912,9 @@ func newGlobalNotificationWithExpiry(t *testing.T, title string, expires *timest
 func TestServerHostnameSanitization(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
 	cases := []struct {
 		name            string
@@ -4872,7 +4950,7 @@ func TestServerHostnameSanitization(t *testing.T) {
 		},
 		{
 			name:            "exceptionally long hostname",
-			hostname:        strings.Repeat("a", serverHostnameMaxLen*2),
+			hostname:        strings.Repeat("a", auth.ServerHostnameMaxLen*2),
 			invalidHostname: true,
 		},
 		{
@@ -4989,7 +5067,7 @@ func TestValidServerHostname(t *testing.T) {
 		},
 		{
 			name:     "super long hostname",
-			hostname: strings.Repeat("a", serverHostnameMaxLen*2),
+			hostname: strings.Repeat("a", auth.ServerHostnameMaxLen*2),
 			want:     false,
 		},
 		{
@@ -5010,7 +5088,7 @@ func TestValidServerHostname(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := validServerHostname(tt.hostname)
+			got := auth.ValidServerHostname(tt.hostname)
 			require.Equal(t, tt.want, got)
 		})
 	}
@@ -5019,7 +5097,7 @@ func TestValidServerHostname(t *testing.T) {
 func TestCreateAuthPreference(t *testing.T) {
 	cases := []struct {
 		name       string
-		modules    modules.Modules
+		modules    *modulestest.Modules
 		preference func(p types.AuthPreference)
 		assertion  func(t *testing.T, created types.AuthPreference, err error)
 	}{
@@ -5036,7 +5114,7 @@ func TestCreateAuthPreference(t *testing.T) {
 		},
 		{
 			name:    "creation allowed when hardware key policy is set in enterprise",
-			modules: &modules.TestModules{TestBuildType: modules.BuildEnterprise},
+			modules: &modulestest.Modules{TestBuildType: modules.BuildEnterprise},
 			preference: func(p types.AuthPreference) {
 				pp := p.(*types.AuthPreferenceV2)
 				pp.Spec.RequireMFAType = types.RequireMFAType_HARDWARE_KEY_PIN
@@ -5063,7 +5141,7 @@ func TestCreateAuthPreference(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			if test.modules != nil {
-				modules.SetTestModules(t, test.modules)
+				modulestest.SetTestModules(t, *test.modules)
 			}
 
 			bk, err := memory.New(memory.Config{})
@@ -5078,15 +5156,16 @@ func TestCreateAuthPreference(t *testing.T) {
 			clusterConfigService, err := local.NewClusterConfigurationService(bk)
 			require.NoError(t, err)
 
-			server, err := NewServer(&InitConfig{
+			server, err := auth.NewServer(&auth.InitConfig{
 				DataDir:                t.TempDir(),
 				Backend:                bk,
 				ClusterName:            clusterName,
-				VersionStorage:         NewFakeTeleportVersion(),
+				VersionStorage:         authtest.NewFakeTeleportVersion(),
 				Authority:              testauthority.New(),
 				Emitter:                &eventstest.MockRecorderEmitter{},
 				ClusterConfiguration:   clusterConfigService,
 				SkipPeriodicOperations: true,
+				HostUUID:               uuid.NewString(),
 			})
 			require.NoError(t, err)
 
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index 6d64e07fe407e..b2dbb9b6a8791 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -19,8 +19,11 @@
 package auth
 
 import (
+	"cmp"
 	"context"
 	"fmt"
+	"iter"
+	"log/slog"
 	"maps"
 	"net/url"
 	"os"
@@ -48,22 +51,26 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/clusterconfig/clusterconfigv1"
 	"github.com/gravitational/teleport/lib/auth/join/oracle"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/auth/okta"
-	"github.com/gravitational/teleport/lib/auth/userloginstate"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/defaults"
 	dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
 	dtconfig "github.com/gravitational/teleport/lib/devicetrust/config"
 	"github.com/gravitational/teleport/lib/events"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -76,6 +83,12 @@ type ServerWithRoles struct {
 	alog       events.AuditLogSessionStreamer
 	// context holds authorization context
 	context authz.Context
+
+	// scopedContext is an authz context that may or may not be scoped, some methods which have been
+	// converted to support scoped identities will be supplied with this context instead of the standard
+	// context field above. Only one of the two is non-nil at a time, so care must be taken to ensure
+	// that the correct one is used for a given method.
+	scopedContext *authz.ScopedContext
 }
 
 // CloseContext is closed when the auth server shuts down
@@ -84,45 +97,56 @@ func (a *ServerWithRoles) CloseContext() context.Context {
 }
 
 // actionForResource will determine if a user has access to the given resource. This call respects where clauses.
-func (a *ServerWithRoles) actionForResource(resource types.Resource, kind string, verbs ...string) error {
+func (a *ServerWithRoles) actionForResource(resource types.Resource, kind string, verb string, extraVerbs ...string) error {
 	sctx := &services.Context{User: a.context.User}
 	if resource != nil {
 		sctx.Resource = resource
 	}
-	return trace.Wrap(a.actionWithContext(sctx, kind, verbs...))
+	return trace.Wrap(a.actionWithContext(sctx, kind, verb, extraVerbs...))
 }
 
 // actionWithContext will determine if a user has access given a services.Context. This call respects where clauses.
-func (a *ServerWithRoles) actionWithContext(ctx *services.Context, resource string, verbs ...string) error {
-	if len(verbs) == 0 {
-		return trace.BadParameter("no verbs provided for authorization check on resource %q", resource)
-	}
+func (a *ServerWithRoles) actionWithContext(ctx *services.Context, resource string, verb string, extraVerbs ...string) error {
 	var errs []error
-	for _, verb := range verbs {
-		errs = append(errs, a.context.Checker.CheckAccessToRule(ctx, apidefaults.Namespace, resource, verb))
+	if err := a.context.Checker.CheckAccessToRule(ctx, apidefaults.Namespace, resource, verb); err != nil {
+		errs = append(errs, err)
 	}
-	if err := trace.NewAggregate(errs...); err != nil {
-		return err
+
+	for _, verb := range extraVerbs {
+		if err := a.context.Checker.CheckAccessToRule(ctx, apidefaults.Namespace, resource, verb); err != nil {
+			errs = append(errs, err)
+		}
 	}
-	return nil
+
+	return trace.NewAggregate(errs...)
 }
 
-func (a *ServerWithRoles) actionNamespace(namespace, resource string, verbs ...string) error {
-	if len(verbs) == 0 {
-		return trace.BadParameter("no verbs provided for authorization check on resource %q", resource)
-	}
+func (a *ServerWithRoles) actionNamespace(namespace, resource string, verb string, extraVerbs ...string) error {
 	var errs []error
-	for _, verb := range verbs {
-		errs = append(errs, a.context.Checker.CheckAccessToRule(&services.Context{User: a.context.User}, namespace, resource, verb))
+
+	if err := a.context.Checker.CheckAccessToRule(&services.Context{User: a.context.User}, namespace, resource, verb); err != nil {
+		errs = append(errs, err)
 	}
-	if err := trace.NewAggregate(errs...); err != nil {
-		return err
+
+	for _, verb := range extraVerbs {
+		if err := a.context.Checker.CheckAccessToRule(&services.Context{User: a.context.User}, namespace, resource, verb); err != nil {
+			errs = append(errs, err)
+		}
 	}
-	return nil
+
+	return trace.NewAggregate(errs...)
 }
 
-func (a *ServerWithRoles) action(resource string, verbs ...string) error {
-	return a.actionNamespace(apidefaults.Namespace, resource, verbs...)
+func (a *ServerWithRoles) authorizeActionWithOrigin(resourceKind string, origin string) error {
+	if origin == types.OriginConfigFile {
+		return a.actionNamespace(apidefaults.Namespace, resourceKind, types.VerbUpdate, types.VerbCreate)
+	}
+
+	return a.actionNamespace(apidefaults.Namespace, resourceKind, types.VerbUpdate)
+}
+
+func (a *ServerWithRoles) authorizeAction(resource string, verb string, extraVerbs ...string) error {
+	return a.actionNamespace(apidefaults.Namespace, resource, verb, extraVerbs...)
 }
 
 // currentUserAction is a special checker that allows certain actions for users
@@ -155,22 +179,23 @@ func (a *ServerWithRoles) authConnectorAction(resource string, verb string) erro
 // `KindIdentityCenter` resource kind. This means that if access to the target
 // resource is not explicitly denied, then the user has a second chance to get
 // access via the generic resource kind.
-func (a *ServerWithRoles) identityCenterAction(namespace string, resource string, verbs ...string) error {
-	err := a.actionNamespace(namespace, resource, verbs...)
+func (a *ServerWithRoles) identityCenterAction(namespace string, resource string, verb string, extraVerbs ...string) error {
+	err := a.actionNamespace(namespace, resource, verb, extraVerbs...)
 	if err == nil || services.IsAccessExplicitlyDenied(err) {
 		return trace.Wrap(err)
 	}
-	return trace.Wrap(a.actionNamespace(namespace, types.KindIdentityCenter, verbs...))
+	return trace.Wrap(a.actionNamespace(namespace, types.KindIdentityCenter, verb, extraVerbs...))
 }
 
 // actionForListWithCondition extracts a restrictive filter condition to be
 // added to a list query after a simple resource check fails.
-func (a *ServerWithRoles) actionForListWithCondition(ctx context.Context, resource, identifier string) (*types.WhereExpr, error) {
-	origErr := a.action(resource, types.VerbList)
+func (a *ServerWithRoles) actionForListWithCondition(ctx context.Context, resource, identifier string) (*utils.ToFieldsConditionConfig, error) {
+	origErr := a.authorizeAction(resource, types.VerbList)
 	if origErr == nil || !trace.IsAccessDenied(origErr) {
 		return nil, trace.Wrap(origErr)
 	}
-	cond, err := a.context.Checker.ExtractConditionForIdentifier(&services.Context{User: a.context.User}, apidefaults.Namespace, resource, types.VerbList, identifier)
+	svcCtx := &services.Context{User: a.context.User}
+	cond, err := a.context.Checker.ExtractConditionForIdentifier(svcCtx, apidefaults.Namespace, resource, types.VerbList, identifier)
 	if trace.IsAccessDenied(err) {
 		a.authServer.logger.InfoContext(ctx, "Access to list resource denied",
 			"error", err,
@@ -179,7 +204,19 @@ func (a *ServerWithRoles) actionForListWithCondition(ctx context.Context, resour
 		// Return the original AccessDenied to avoid leaking information.
 		return nil, trace.Wrap(origErr)
 	}
-	return cond, trace.Wrap(err)
+	return &utils.ToFieldsConditionConfig{
+		CanView: func(ef utils.Fields) bool {
+			au, err := events.FromEventFields(events.EventFields(ef))
+			if err != nil {
+				slog.WarnContext(ctx, "Failed to convert event fields", "error", err)
+				return false
+			}
+			canViewCtx := services.Context{User: a.context.User}
+			canViewCtx.ExtendWithSessionEnd(au, a.context.Checker)
+			return services.CanViewResourceFunc(&canViewCtx)()()
+		},
+		Expr: cond,
+	}, trace.Wrap(err)
 }
 
 // actionWithExtendedContext performs an additional RBAC check with extended
@@ -204,7 +241,18 @@ func (a *ServerWithRoles) actionWithExtendedContext(ctx context.Context, kind, v
 func (a *ServerWithRoles) actionForKindSession(ctx context.Context, sid session.ID) error {
 	extendContext := func(servicesCtx *services.Context) error {
 		sessionEnd, err := a.findSessionEndEvent(ctx, sid)
-		servicesCtx.Session = sessionEnd
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		servicesCtx.ExtendWithSessionEnd(sessionEnd, a.context.Checker)
+		return nil
+	}
+
+	// First try a simple check without the extended context.
+	if err := a.actionWithContext(&services.Context{User: a.context.User}, types.KindSession, types.VerbRead); err == nil {
+		return nil
+	} else if !trace.IsAccessDenied(err) {
+		// If the error is something other than AccessDenied, return it.
 		return trace.Wrap(err)
 	}
 
@@ -308,9 +356,10 @@ func (a *ServerWithRoles) filterSessionTracker(joinerRoles []types.Role, tracker
 		}
 
 		for _, participant := range tracker.GetParticipants() {
-			// We only need to fill in User here since other fields get discarded anyway.
+			// We only need to fill in User and cluster here since other fields get discarded anyway.
 			ruleCtx.SSHSession.Parties = append(ruleCtx.SSHSession.Parties, session.Party{
-				User: participant.User,
+				User:    participant.User,
+				Cluster: participant.Cluster,
 			})
 		}
 
@@ -325,8 +374,8 @@ func (a *ServerWithRoles) filterSessionTracker(joinerRoles []types.Role, tracker
 		return true
 	}
 
-	evaluator := NewSessionAccessEvaluator(tracker.GetHostPolicySets(), tracker.GetSessionKind(), tracker.GetHostUser())
-	modes := evaluator.CanJoin(SessionAccessContext{Username: a.context.User.GetName(), Roles: joinerRoles})
+	evaluator := moderation.NewSessionAccessEvaluator(tracker.GetHostPolicySets(), tracker.GetSessionKind(), tracker.GetHostUser())
+	modes := evaluator.CanJoin(moderation.SessionAccessContext{Username: a.context.User.GetName(), Roles: joinerRoles})
 	return len(modes) != 0
 }
 
@@ -560,7 +609,7 @@ func (a *ServerWithRoles) GenerateOpenSSHCert(ctx context.Context, req *proto.Op
 // CompareAndSwapCertAuthority updates existing cert authority if the existing cert authority
 // value matches the value stored in the backend.
 func (a *ServerWithRoles) CompareAndSwapCertAuthority(new, existing types.CertAuthority) error {
-	if err := a.action(types.KindCertAuthority, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindCertAuthority, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.CompareAndSwapCertAuthority(new, existing)
@@ -612,7 +661,8 @@ func (a *ServerWithRoles) GenerateHostCerts(ctx context.Context, req *proto.Host
 	if !a.hasBuiltinRole(req.Role) && req.Role != types.RoleInstance {
 		return nil, trace.AccessDenied("roles do not match: %v and %v", existingRoles, req.Role)
 	}
-	return a.authServer.GenerateHostCerts(ctx, req)
+	identity := a.context.Identity.GetIdentity()
+	return a.authServer.GenerateHostCerts(ctx, req, identity.AgentScope)
 }
 
 // checkAdditionalSystemRoles verifies additional system roles in host cert request.
@@ -744,11 +794,20 @@ func (a *ServerWithRoles) RegisterInventoryControlStream(ics client.UpstreamInve
 
 	hello.Services = filteredServices
 
+	// If the hello message's scope is non-empty, we can verify that it matches the authenticated
+	// scope in the identity. Otherwise, in order to support agents unaware of scopes, we fall back
+	// to the authenticated identity's scope.
+	agentScope := a.context.Identity.GetIdentity().AgentScope
+	if hello.Scope != "" && hello.Scope != agentScope {
+		return nil, trace.AccessDenied("provided scope %q does not match agent identity %q", hello.Scope, agentScope)
+	}
+	hello.Scope = agentScope
+
 	return hello, a.authServer.RegisterInventoryControlStream(ics, hello)
 }
 
 func (a *ServerWithRoles) GetInventoryStatus(ctx context.Context, req *proto.InventoryStatusRequest) (*proto.InventoryStatusSummary, error) {
-	if err := a.action(types.KindInstance, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindInstance, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -781,7 +840,7 @@ func (a *ServerWithRoles) PingInventory(ctx context.Context, req proto.Inventory
 }
 
 func (a *ServerWithRoles) GetInstances(ctx context.Context, filter types.InstanceFilter) stream.Stream[types.Instance] {
-	if err := a.action(types.KindInstance, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindInstance, types.VerbList, types.VerbRead); err != nil {
 		return stream.Fail[types.Instance](trace.Wrap(err))
 	}
 
@@ -816,7 +875,7 @@ func (a *ServerWithRoles) GetClusterAlerts(ctx context.Context, query types.GetC
 	// with permissions to view all resources of kind 'cluster_alert' can opt into viewing all alerts
 	// regardless of labels for management/debug purposes.
 	var resourceLevelPermit bool
-	if query.WithUntargeted && a.action(types.KindClusterAlert, types.VerbRead, types.VerbList) == nil {
+	if query.WithUntargeted && a.authorizeAction(types.KindClusterAlert, types.VerbRead, types.VerbList) == nil {
 		resourceLevelPermit = true
 	}
 
@@ -855,7 +914,7 @@ Outer:
 				continue Verbs
 			}
 
-			if a.action(rv[0], rv[1]) == nil {
+			if a.authorizeAction(rv[0], rv[1]) == nil {
 				// user holds at least one of the resource:verb pairs specified by
 				// the verb-permit label.
 				filtered = append(filtered, alert)
@@ -895,7 +954,7 @@ Outer:
 }
 
 func (a *ServerWithRoles) UpsertClusterAlert(ctx context.Context, alert types.ClusterAlert) error {
-	if err := a.action(types.KindClusterAlert, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindClusterAlert, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -904,7 +963,7 @@ func (a *ServerWithRoles) UpsertClusterAlert(ctx context.Context, alert types.Cl
 
 func (a *ServerWithRoles) CreateAlertAck(ctx context.Context, ack types.AlertAcknowledgement) error {
 	// we treat alert acks as an extension of the cluster alert resource rather than its own resource
-	if err := a.action(types.KindClusterAlert, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindClusterAlert, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -913,7 +972,7 @@ func (a *ServerWithRoles) CreateAlertAck(ctx context.Context, ack types.AlertAck
 
 func (a *ServerWithRoles) GetAlertAcks(ctx context.Context) ([]types.AlertAcknowledgement, error) {
 	// we treat alert acks as an extension of the cluster alert resource rather than its own resource.
-	if err := a.action(types.KindClusterAlert, types.VerbRead, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindClusterAlert, types.VerbRead, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -922,7 +981,7 @@ func (a *ServerWithRoles) GetAlertAcks(ctx context.Context) ([]types.AlertAcknow
 
 func (a *ServerWithRoles) ClearAlertAcks(ctx context.Context, req proto.ClearAlertAcksRequest) error {
 	// we treat alert acks as an extension of the cluster alert resource rather than its own resource
-	if err := a.action(types.KindClusterAlert, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindClusterAlert, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -931,9 +990,12 @@ func (a *ServerWithRoles) ClearAlertAcks(ctx context.Context, req proto.ClearAle
 
 func (a *ServerWithRoles) UpsertNode(ctx context.Context, s types.Server) (*types.KeepAlive, error) {
 	// Note: UpsertNode doesn't allow any namespaces but "default".
-	if err := a.action(types.KindNode, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindNode, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if s.GetScope() != "" {
+		return nil, trace.BadParameter("UpsertNode does not yet support scoped resources")
+	}
 	return a.authServer.UpsertNode(ctx, s)
 }
 
@@ -956,7 +1018,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleNode) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindNode, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindNode, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	case constants.KeepAliveApp:
@@ -972,7 +1034,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleApp) && !a.hasBuiltinRole(types.RoleOkta) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindAppServer, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindAppServer, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	case constants.KeepAliveDatabase:
@@ -985,7 +1047,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleDatabase) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindDatabaseServer, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindDatabaseServer, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	case constants.KeepAliveWindowsDesktopService:
@@ -995,7 +1057,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleWindowsDesktop) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindWindowsDesktopService, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	case constants.KeepAliveKube:
@@ -1009,7 +1071,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleKube, types.RoleProxy) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindKubeServer, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindKubeServer, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	case constants.KeepAliveDatabaseService:
@@ -1019,7 +1081,7 @@ func (a *ServerWithRoles) KeepAliveServer(ctx context.Context, handle types.Keep
 		if !a.hasBuiltinRole(types.RoleDatabase) {
 			return trace.AccessDenied("access denied")
 		}
-		if err := a.action(types.KindDatabaseService, types.VerbUpdate); err != nil {
+		if err := a.authorizeAction(types.KindDatabaseService, types.VerbUpdate); err != nil {
 			return trace.Wrap(err)
 		}
 	default:
@@ -1137,7 +1199,7 @@ func (a *ServerWithRoles) hasWatchPermissionForKind(kind types.WatchKind) error
 
 		return nil
 	}
-	return trace.Wrap(a.action(kind.Kind, verb))
+	return trace.Wrap(a.authorizeAction(kind.Kind, verb))
 }
 
 // DeleteAllNodes deletes all nodes in a given namespace
@@ -1260,14 +1322,14 @@ func (l *unifiedResourceLister) getAllowedLogins(resource services.AccessCheckab
 	}
 }
 
-func (a *ServerWithRoles) checkAction(namespace, resourceKind string, verbs ...string) error {
+func (a *ServerWithRoles) checkAction(namespace, resourceKind string, verb string, extraVerbs ...string) error {
 	switch resourceKind {
 	case types.KindIdentityCenterAccount, types.KindIdentityCenterAccountAssignment:
 		// Identity Center resources can be specified multiple ways in a Role
 		// Condition statement, so we need a special checker to handle it.
-		return trace.Wrap(a.identityCenterAction(namespace, resourceKind, verbs...))
+		return trace.Wrap(a.identityCenterAction(namespace, resourceKind, verb, extraVerbs...))
 	default:
-		return trace.Wrap(a.actionNamespace(namespace, resourceKind, verbs...))
+		return trace.Wrap(a.actionNamespace(namespace, resourceKind, verb, extraVerbs...))
 	}
 }
 
@@ -1282,14 +1344,21 @@ var (
 		types.KindNode:                   {},
 		types.KindSAMLIdPServiceProvider: {},
 		types.KindWindowsDesktop:         {},
+		types.KindMCP:                    {},
 	}
 
 	defaultUnifiedResourceKinds = slices.Collect(maps.Keys(supportedUnifiedResourceKinds))
 )
 
 func (a *ServerWithRoles) checkKindAccess(kind string) error {
+	// MCP are apps internally atm.
+	if kind == types.KindMCP {
+		kind = types.KindApp
+	}
 	if _, ok := supportedUnifiedResourceKinds[kind]; !ok {
-		return trace.BadParameter("unsupported kind %q requested", kind)
+		// Treat unknown kinds as an access denied error instead of a bad parameter
+		// to prevent rejecting the request if users have access to other kinds requested.
+		return trace.AccessDenied("unsupported kind %q requested", kind)
 	}
 	switch kind {
 	case types.KindNode:
@@ -1302,7 +1371,6 @@ func (a *ServerWithRoles) checkKindAccess(kind string) error {
 	default:
 		return trace.Wrap(a.checkAction(apidefaults.Namespace, kind, types.VerbList, types.VerbRead))
 	}
-
 }
 
 // ListUnifiedResources returns a paginated list of unified resources filtered by user access.
@@ -1485,6 +1553,104 @@ func (a *ServerWithRoles) ListUnifiedResources(ctx context.Context, req *proto.L
 	}, nil
 }
 
+func (a *ServerWithRoles) scopedListUnifiedResources(ctx context.Context, req *proto.ListUnifiedResourcesRequest) (*proto.ListUnifiedResourcesResponse, error) {
+	// most advanced features don't work for scoped identities yet
+	switch {
+	case req.UseSearchAsRoles:
+		return nil, trace.AccessDenied("search_as_roles is not supported for scoped identities")
+	case req.UsePreviewAsRoles:
+		return nil, trace.AccessDenied("preview_as_roles is not supported for scoped identities")
+	case req.IncludeRequestable:
+		return nil, trace.AccessDenied("include_requestable is not supported for scoped identities")
+	case req.PinnedOnly:
+		return nil, trace.AccessDenied("pinned_only is not supported for scoped identities")
+	case req.IncludeLogins:
+		return nil, trace.AccessDenied("include_logins is not supported for scoped identities")
+	}
+
+	if len(req.Kinds) != 1 || req.Kinds[0] != types.KindNode {
+		return nil, trace.AccessDenied("only node kind is supported for scoped identities")
+	}
+
+	userFilter := services.MatchResourceFilter{
+		Labels:         req.Labels,
+		SearchKeywords: req.SearchKeywords,
+		Kinds:          req.Kinds,
+	}
+
+	if req.PredicateExpression != "" {
+		expression, err := services.NewResourceExpression(req.PredicateExpression)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		userFilter.PredicateExpression = expression
+	}
+
+	ruleCtx := a.scopedContext.RuleContext()
+
+	if err := a.scopedContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, types.KindNode, types.VerbList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	unifiedResources, nextKey, err := a.authServer.UnifiedResourceCache.IterateUnifiedResources(ctx, func(resource types.ResourceWithLabels) (bool, error) {
+		// currently only nodes are supported
+		if resource.GetKind() != types.KindNode {
+			return false, nil
+		}
+
+		// Filter first and only check RBAC if there is a match to improve perf.
+		match, err := services.MatchResourceByFilters(resource, userFilter, nil)
+		if err != nil {
+			logger.WarnContext(ctx, "Unable to determine access to resource, matching with filter failed",
+				"resource_name", resource.GetName(),
+				"resource_kind", resource.GetKind(),
+				"error", err,
+			)
+			return false, nil
+		}
+		if !match {
+			return false, nil
+		}
+
+		server, ok := resource.(*types.ServerV2)
+		if !ok {
+			logger.WarnContext(ctx, "Unable to cast unified resource to server",
+				"resource_name", resource.GetName(),
+				"resource_kind", resource.GetKind(),
+			)
+			return false, nil
+		}
+
+		serverScope := scopes.Root
+		if server.Scope != "" {
+			serverScope = server.Scope
+		}
+
+		if err := a.scopedContext.CheckerContext.Decision(ctx, serverScope, func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CanAccessSSHServer(server)
+		}); err == nil {
+			return true, nil
+		} else if !trace.IsAccessDenied(err) {
+			return false, trace.Wrap(err)
+		}
+
+		return false, nil
+	}, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	paginatedResources, err := services.MakePaginatedResources(types.KindUnifiedResource, unifiedResources, nil /* requestable resources map */)
+	if err != nil {
+		return nil, trace.Wrap(err, "making paginated unified resources")
+	}
+
+	return &proto.ListUnifiedResourcesResponse{
+		NextKey:   nextKey,
+		Resources: paginatedResources,
+	}, nil
+}
+
 func (a *ServerWithRoles) filterICPermissionSets(r *proto.PaginatedResource, app types.Application, checker *unifiedResourceLister) error {
 	appV3, ok := app.(*types.AppV3)
 	if !ok {
@@ -1635,13 +1801,21 @@ func (a *ServerWithRoles) GetSSHTargets(ctx context.Context, req *proto.GetSSHTa
 	lreq := &proto.ListUnifiedResourcesRequest{
 		Kinds:            []string{types.KindNode},
 		SortBy:           types.SortBy{Field: types.ResourceMetadataName},
-		UseSearchAsRoles: true,
+		UseSearchAsRoles: a.scopedContext == nil, // TODO(fspmarshall/scopes): switch this to always be true once we support search_as_roles with scoped identities
 	}
+
+	// note that we're using a ServerWithRoles level method here rather than some internal method. We are
+	// delegating all RBAC filtering to the lister and then performing additional filtering on top of that.
+	// Until we unify scoped/unscoped resource listing this bifurcation is necessary to ensure that search_as_roles
+	// results are available for unscoped identities.
+	lister := a.ListUnifiedResources
+	if a.scopedContext != nil {
+		lister = a.scopedListUnifiedResources
+	}
+
 	var servers []*types.ServerV2
 	for {
-		// note that we're calling ServerWithRoles.ListUnifiedResources here rather than some internal method. This method
-		// delegates all RBAC filtering to ListResources, and then performs additional filtering on top of that.
-		lrsp, err := a.ListUnifiedResources(ctx, lreq)
+		lrsp, err := lister(ctx, lreq)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1813,7 +1987,6 @@ func (a *ServerWithRoles) ListResources(ctx context.Context, req proto.ListResou
 	}
 
 	limit := int(req.Limit)
-	actionVerbs := []string{types.VerbList, types.VerbRead}
 	switch req.ResourceType {
 	case types.KindNode:
 		// We are checking list only for Nodes to keep backwards compatibility.
@@ -1821,8 +1994,9 @@ func (a *ServerWithRoles) ListResources(ctx context.Context, req proto.ListResou
 		//   https://github.com/gravitational/teleport/pull/1209
 		// but got removed shortly afterwards in:
 		//   https://github.com/gravitational/teleport/pull/1224
-		actionVerbs = []string{types.VerbList}
-
+		if err := a.checkAction(req.Namespace, req.ResourceType, types.VerbList); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	case types.KindDatabaseServer,
 		types.KindDatabaseService,
 		types.KindAppServer,
@@ -1831,31 +2005,22 @@ func (a *ServerWithRoles) ListResources(ctx context.Context, req proto.ListResou
 		types.KindWindowsDesktopService,
 		types.KindUserGroup,
 		types.KindSAMLIdPServiceProvider,
+		types.KindIdentityCenterAccount,
+		types.KindIdentityCenterAccountAssignment,
 		types.KindGitServer:
-
+		if err := a.checkAction(req.Namespace, req.ResourceType, types.VerbList, types.VerbRead); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	default:
 		return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
 	}
 
-	if err := a.checkAction(req.Namespace, req.ResourceType, actionVerbs...); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	// Perform the label/search/expr filtering here (instead of at the backend
 	// `ListResources`) to ensure that it will be applied only to resources
 	// the user has access to.
-	filter := services.MatchResourceFilter{
-		ResourceKind:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
-	}
-
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		filter.PredicateExpression = expression
+	filter, err := services.MatchResourceFilterFromListResourceRequest(&req)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	req.Labels = nil
@@ -2081,7 +2246,7 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 		// Only add SAMLIdPServiceProviders to the list if the caller has an enterprise license.
 		if modules.GetModules().BuildType() == modules.BuildEnterprise {
 			// Only attempt to list SAMLIdPServiceProviders if the caller has the permission to.
-			if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbList); err == nil {
+			if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbList); err == nil {
 				var serviceProviders []types.SAMLIdPServiceProvider
 				var startKey string
 				for {
@@ -2233,44 +2398,132 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 }
 
 func (a *ServerWithRoles) UpsertAuthServer(ctx context.Context, s types.Server) error {
-	if err := a.action(types.KindAuthServer, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindAuthServer, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.UpsertAuthServer(ctx, s)
 }
 
+// Deprecated: Prefer paginated variant [ListAuthServers].
+//
+// TODO(kiosion) DELETE IN 21.0.0
 func (a *ServerWithRoles) GetAuthServers() ([]types.Server, error) {
-	if err := a.action(types.KindAuthServer, types.VerbList, types.VerbRead); err != nil {
+	if a.scopedContext != nil {
+		ruleCtx := a.scopedContext.RuleContext()
+		// For auth server reads we do not enforce scope pinning. This ensures that auths are readable for
+		// all scoped identities regardless of their current scope pinning. This pattern should not
+		// be used for any checks save essential global configuration reads that are necessary for basic
+		// teleport functionality.
+		if err := a.scopedContext.CheckerContext.RiskyUnpinnedDecision(a.CloseContext(), scopes.Root, func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, types.KindAuthServer, types.VerbList, types.VerbRead)
+		}); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		out, err := iterstream.Collect(clientutils.Resources(context.TODO(), a.authServer.ListAuthServers))
+		return out, trace.Wrap(err)
+	}
+
+	if err := a.authorizeAction(types.KindAuthServer, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return a.authServer.GetAuthServers()
+
+	out, err := iterstream.Collect(clientutils.Resources(context.TODO(), a.authServer.ListAuthServers))
+	return out, trace.Wrap(err)
+}
+
+func (a *ServerWithRoles) ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	if a.scopedContext != nil {
+		ruleCtx := a.scopedContext.RuleContext()
+		// For auth server reads we do not enforce scope pinning. This ensures that auths are readable for
+		// all scoped identities regardless of their current scope pinning. This pattern should not
+		// be used for any checks save essential global configuration reads that are necessary for basic
+		// teleport functionality.
+		if err := a.scopedContext.CheckerContext.RiskyUnpinnedDecision(a.CloseContext(), scopes.Root, func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, types.KindAuthServer, types.VerbList, types.VerbRead)
+		}); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		return a.authServer.ListAuthServers(ctx, pageSize, pageToken)
+	}
+
+	if err := a.authorizeAction(types.KindAuthServer, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return a.authServer.ListAuthServers(ctx, pageSize, pageToken)
 }
 
 // DeleteAuthServer deletes auth server by name
 func (a *ServerWithRoles) DeleteAuthServer(name string) error {
-	if err := a.action(types.KindAuthServer, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindAuthServer, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAuthServer(name)
 }
 
 func (a *ServerWithRoles) UpsertProxy(ctx context.Context, s types.Server) error {
-	if err := a.action(types.KindProxy, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindProxy, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.UpsertProxy(ctx, s)
 }
 
+// Deprecated: Prefer paginated variant [ListProxyServers].
+//
+// TODO(kiosion) DELETE IN 21.0.0
 func (a *ServerWithRoles) GetProxies() ([]types.Server, error) {
-	if err := a.action(types.KindProxy, types.VerbList, types.VerbRead); err != nil {
+	if a.scopedContext != nil {
+		ruleCtx := a.scopedContext.RuleContext()
+		// For proxy reads we do not enforce scope pinning. This ensures that proxies are readable for
+		// all scoped identities regardless of their current scope pinning. This pattern should not
+		// be used for any checks save essential global configuration reads that are necessary for basic
+		// teleport functionality.
+		if err := a.scopedContext.CheckerContext.RiskyUnpinnedDecision(a.CloseContext(), scopes.Root, func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, types.KindProxy, types.VerbList, types.VerbRead)
+		}); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		out, err := iterstream.Collect(clientutils.Resources(context.TODO(), a.authServer.ListProxyServers))
+		return out, trace.Wrap(err)
+	}
+
+	if err := a.authorizeAction(types.KindProxy, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return a.authServer.GetProxies()
+
+	out, err := iterstream.Collect(clientutils.Resources(context.TODO(), a.authServer.ListProxyServers))
+	return out, trace.Wrap(err)
+}
+
+func (a *ServerWithRoles) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	if a.scopedContext != nil {
+		ruleCtx := a.scopedContext.RuleContext()
+		// For proxy reads we do not enforce scope pinning. This ensures that proxies are readable for
+		// all scoped identities regardless of their current scope pinning. This pattern should not
+		// be used for any checks save essential global configuration reads that are necessary for basic
+		// teleport functionality.
+		if err := a.scopedContext.CheckerContext.RiskyUnpinnedDecision(a.CloseContext(), scopes.Root, func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, types.KindProxy, types.VerbList, types.VerbRead)
+		}); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		return a.authServer.ListProxyServers(ctx, pageSize, pageToken)
+	}
+
+	if err := a.authorizeAction(types.KindProxy, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return a.authServer.ListProxyServers(ctx, pageSize, pageToken)
 }
 
 // DeleteAllProxies deletes all proxies
 func (a *ServerWithRoles) DeleteAllProxies() error {
-	if err := a.action(types.KindProxy, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindProxy, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAllProxies()
@@ -2278,14 +2531,14 @@ func (a *ServerWithRoles) DeleteAllProxies() error {
 
 // DeleteProxy deletes proxy by name
 func (a *ServerWithRoles) DeleteProxy(ctx context.Context, name string) error {
-	if err := a.action(types.KindProxy, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindProxy, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteProxy(ctx, name)
 }
 
 func (a *ServerWithRoles) DeleteToken(ctx context.Context, token string) error {
-	if err := a.action(types.KindToken, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindToken, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -2296,8 +2549,11 @@ func (a *ServerWithRoles) DeleteToken(ctx context.Context, token string) error {
 	return a.authServer.DeleteToken(ctx, token)
 }
 
+// GetTokens retrieves all tokens.
+// Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+// TODO(hugoShaka): DELETE IN 21.0.0
 func (a *ServerWithRoles) GetTokens(ctx context.Context) ([]types.ProvisionToken, error) {
-	if err := a.action(types.KindToken, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindToken, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2308,11 +2564,35 @@ func (a *ServerWithRoles) GetTokens(ctx context.Context) ([]types.ProvisionToken
 	return a.authServer.GetTokens(ctx)
 }
 
+func (a *ServerWithRoles) GetStaticTokens(ctx context.Context) (types.StaticTokens, error) {
+	if err := a.authorizeAction(types.KindToken, types.VerbList, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := a.context.AuthorizeAdminActionAllowReusedMFA(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return a.authServer.GetStaticTokens(ctx)
+}
+
+func (a *ServerWithRoles) ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error) {
+	if err := a.authorizeAction(types.KindToken, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	if err := a.context.AuthorizeAdminActionAllowReusedMFA(); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return a.authServer.Cache.ListProvisionTokens(ctx, pageSize, pageToken, anyRoles, botName)
+}
+
 func (a *ServerWithRoles) GetToken(ctx context.Context, token string) (types.ProvisionToken, error) {
 	// The Proxy has permission to look up tokens by name in order to validate
 	// attempts to use the node join script.
 	if isProxy := a.hasBuiltinRole(types.RoleProxy); !isProxy {
-		if err := a.action(types.KindToken, types.VerbRead); err != nil {
+		if err := a.authorizeAction(types.KindToken, types.VerbRead); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -2387,6 +2667,11 @@ func validateOracleJoinToken(token types.ProvisionToken) error {
 				return trace.BadParameter("invalid region: %v", region)
 			}
 		}
+		for _, instanceID := range allow.Instances {
+			if _, err := oracle.ParseRegionFromOCID(instanceID); err != nil {
+				return trace.BadParameter("invalid instance OCID: %s", instanceID)
+			}
+		}
 	}
 	return nil
 }
@@ -2415,7 +2700,7 @@ func emitTokenEvent(ctx context.Context, e apievents.Emitter, token types.Provis
 }
 
 func (a *ServerWithRoles) UpsertToken(ctx context.Context, token types.ProvisionToken) error {
-	if err := a.action(types.KindToken, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindToken, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -2447,7 +2732,7 @@ func (a *ServerWithRoles) UpsertToken(ctx context.Context, token types.Provision
 }
 
 func (a *ServerWithRoles) CreateToken(ctx context.Context, token types.ProvisionToken) error {
-	if err := a.action(types.KindToken, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindToken, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -2530,7 +2815,7 @@ func (a *ServerWithRoles) WebSessions() types.WebSessionInterface {
 
 // Get returns the web session specified with req.
 func (r *webSessionsWithRoles) Get(ctx context.Context, req types.GetWebSessionRequest) (types.WebSession, error) {
-	if err := r.c.action(types.KindWebSession, types.VerbRead); err != nil {
+	if err := r.c.authorizeAction(types.KindWebSession, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return r.ws.Get(ctx, req)
@@ -2538,10 +2823,10 @@ func (r *webSessionsWithRoles) Get(ctx context.Context, req types.GetWebSessionR
 
 // List returns the list of all web sessions.
 func (r *webSessionsWithRoles) List(ctx context.Context) ([]types.WebSession, error) {
-	if err := r.c.action(types.KindWebSession, types.VerbList); err != nil {
+	if err := r.c.authorizeAction(types.KindWebSession, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := r.c.action(types.KindWebSession, types.VerbRead); err != nil {
+	if err := r.c.authorizeAction(types.KindWebSession, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return r.ws.List(ctx)
@@ -2568,85 +2853,90 @@ func (r *webSessionsWithRoles) Delete(ctx context.Context, req types.DeleteWebSe
 
 // DeleteAll removes all web sessions.
 func (r *webSessionsWithRoles) DeleteAll(ctx context.Context) error {
-	if err := r.c.action(types.KindWebSession, types.VerbList); err != nil {
+	if err := r.c.authorizeAction(types.KindWebSession, types.VerbList); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := r.c.action(types.KindWebSession, types.VerbDelete); err != nil {
+	if err := r.c.authorizeAction(types.KindWebSession, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return r.ws.DeleteAll(ctx)
 }
 
-// GetWebToken returns the web token specified with req.
-// Implements auth.ReadAccessPoint.
-func (a *ServerWithRoles) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
-	return a.WebTokens().Get(ctx, req)
-}
-
 type webSessionsWithRoles struct {
 	c  accessChecker
 	ws types.WebSessionInterface
 }
 
-// WebTokens returns the web token manager.
-// Implements services.WebTokensGetter.
-func (a *ServerWithRoles) WebTokens() types.WebTokenInterface {
-	return &webTokensWithRoles{c: a, t: a.authServer.WebTokens()}
-}
-
-// Get returns the web token specified with req.
-func (r *webTokensWithRoles) Get(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
-	if err := r.c.currentUserAction(req.User); err != nil {
-		if err := r.c.action(types.KindWebToken, types.VerbRead); err != nil {
+// GetWebToken returns the web token specified with req.
+func (a *ServerWithRoles) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
+	if err := a.currentUserAction(req.User); err != nil {
+		if err := a.authorizeAction(types.KindWebToken, types.VerbRead); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
-	return r.t.Get(ctx, req)
+
+	token, err := a.authServer.GetWebToken(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return token, nil
 }
 
-// List returns the list of all web tokens.
-func (r *webTokensWithRoles) List(ctx context.Context) ([]types.WebToken, error) {
-	if err := r.c.action(types.KindWebToken, types.VerbList); err != nil {
+// GetWebTokens returns the list of all web tokens.
+func (a *ServerWithRoles) GetWebTokens(ctx context.Context) ([]types.WebToken, error) {
+	if err := a.authorizeAction(types.KindWebToken, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return r.t.List(ctx)
+
+	tokens, err := a.authServer.GetWebTokens(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return tokens, nil
 }
 
-// Upsert creates a new or updates the existing web token from the specified token.
-// TODO(dmitri): this is currently only implemented for local invocations. This needs to be
-// moved into a more appropriate API
-func (*webTokensWithRoles) Upsert(ctx context.Context, session types.WebToken) error {
-	return trace.NotImplemented(notImplementedMessage)
+// ListWebTokens returns a page of web tokens
+func (a *ServerWithRoles) ListWebTokens(ctx context.Context, limit int, start string) ([]types.WebToken, string, error) {
+	if err := a.authorizeAction(types.KindWebToken, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	tokens, next, err := a.authServer.ListWebTokens(ctx, limit, start)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return tokens, next, nil
+
 }
 
-// Delete removes the web token specified with req.
-func (r *webTokensWithRoles) Delete(ctx context.Context, req types.DeleteWebTokenRequest) error {
-	if err := r.c.currentUserAction(req.User); err != nil {
-		if err := r.c.action(types.KindWebToken, types.VerbDelete); err != nil {
+// DeleteWebToken removes the web token specified with req.
+func (a *ServerWithRoles) DeleteWebToken(ctx context.Context, req types.DeleteWebTokenRequest) error {
+	if err := a.currentUserAction(req.User); err != nil {
+		if err := a.authorizeAction(types.KindWebToken, types.VerbDelete); err != nil {
 			return trace.Wrap(err)
 		}
 	}
-	return r.t.Delete(ctx, req)
+	return a.authServer.DeleteWebToken(ctx, req)
 }
 
-// DeleteAll removes all web tokens.
-func (r *webTokensWithRoles) DeleteAll(ctx context.Context) error {
-	if err := r.c.action(types.KindWebToken, types.VerbList); err != nil {
+// DeleteAllWebTokens removes all web tokens.
+func (a *ServerWithRoles) DeleteAllWebTokens(ctx context.Context) error {
+	if err := a.authorizeAction(types.KindWebToken, types.VerbList); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := r.c.action(types.KindWebToken, types.VerbDelete); err != nil {
+
+	if err := a.authorizeAction(types.KindWebToken, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
-	return r.t.DeleteAll(ctx)
-}
 
-type webTokensWithRoles struct {
-	c accessChecker
-	t types.WebTokenInterface
+	return a.authServer.DeleteAllWebTokens(ctx)
 }
 
 type accessChecker interface {
-	action(resource string, verbs ...string) error
+	authorizeAction(resource string, verb string, extraVerbs ...string) error
 	currentUserAction(user string) error
 	canDeleteWebSession(username string) error
 }
@@ -2686,7 +2976,7 @@ func (a *ServerWithRoles) ListAccessRequests(ctx context.Context, req *proto.Lis
 	// and will be overwritten if set elsewhere
 	req.Filter.Requester = a.context.User.GetName()
 
-	if err := a.action(types.KindAccessRequest, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindAccessRequest, types.VerbList, types.VerbRead); err != nil {
 		// Users are allowed to read + list their own access requests and
 		// requests they are allowed to review, unless access was *explicitly*
 		// denied. This means deny rules block the action but allow rules are
@@ -2758,7 +3048,7 @@ func (a *ServerWithRoles) ListAccessRequests(ctx context.Context, req *proto.Lis
 }
 
 func (a *ServerWithRoles) CreateAccessRequestV2(ctx context.Context, req types.AccessRequest) (types.AccessRequest, error) {
-	if err := a.action(types.KindAccessRequest, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindAccessRequest, types.VerbCreate); err != nil {
 		// An exception is made to allow users to create *pending* access requests
 		// for themselves unless the create verb was explicitly denied.
 		if services.IsAccessExplicitlyDenied(err) || !req.GetState().IsPending() || a.currentUserAction(req.GetUser()) != nil {
@@ -2796,7 +3086,7 @@ func (a *ServerWithRoles) CreateAccessRequestV2(ctx context.Context, req types.A
 }
 
 func (a *ServerWithRoles) SetAccessRequestState(ctx context.Context, params types.AccessRequestUpdate) error {
-	if err := a.action(types.KindAccessRequest, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindAccessRequest, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -2888,10 +3178,10 @@ func (a *ServerWithRoles) GetAccessCapabilities(ctx context.Context, req types.A
 
 	// all users can check their own capabilities
 	if a.currentUserAction(req.User) != nil {
-		if err := a.action(types.KindUser, types.VerbRead); err != nil {
+		if err := a.authorizeAction(types.KindUser, types.VerbRead); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		if err := a.action(types.KindRole, types.VerbList, types.VerbRead); err != nil {
+		if err := a.authorizeAction(types.KindRole, types.VerbList, types.VerbRead); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -2899,19 +3189,88 @@ func (a *ServerWithRoles) GetAccessCapabilities(ctx context.Context, req types.A
 	return a.authServer.GetAccessCapabilities(ctx, req)
 }
 
+// GetRemoteAccessCapabilities computes and returns what remote roles the user
+// needs to assume in order access resources in this cluster. In order to do so,
+// the method will:
+//   - maps the supplied remote search_as roles into local roles,
+//   - computes which subset of the local search_as roles are required to access
+//     the target resources, and finally
+//   - maps the required local roles *back* onto a subset of the supplied remote
+//     roles
+func (a *ServerWithRoles) GetRemoteAccessCapabilities(ctx context.Context, req types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error) {
+	if !authz.IsRemoteUser(a.context) {
+		return nil, trace.AccessDenied("only remote users can invoke GetRemoteAccessCapabilities")
+	}
+
+	localIdentity := a.context.Identity.GetIdentity()
+	remoteIdentity := a.context.UnmappedIdentity.GetIdentity()
+
+	if req.User == "" {
+		req.User = remoteIdentity.Username
+	}
+	if req.User != remoteIdentity.Username {
+		return nil, trace.AccessDenied("users may only query their own access")
+	}
+
+	remoteCluster, err := a.authServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.UserCA,
+		DomainName: localIdentity.RouteToCluster,
+	}, false /* do not load keys */)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	localSearchAsRoles, err := services.MapRoles(remoteCluster.GetRoleMap(), req.SearchAsRoles)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(localSearchAsRoles) == 0 {
+		return &types.RemoteAccessCapabilities{ApplicableRolesForResources: []string{}}, nil
+	}
+
+	a.authServer.logger.DebugContext(ctx, "Mapped search_as roles",
+		"remote_roles", req.SearchAsRoles,
+		"local_roles", localSearchAsRoles)
+
+	localAccessRoles, err := services.PruneMappedSearchAsRoles(ctx, a.authServer.clock, a.authServer, a.context.User, localSearchAsRoles, req.ResourceIDs, "")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	a.authServer.logger.DebugContext(ctx, "Pruned search_as roles",
+		"remote_roles", req.SearchAsRoles,
+		"local_roles", localSearchAsRoles,
+		"local_access_roles", localAccessRoles)
+
+	remoteAccessRoles, err := services.UnmapRoles(remoteCluster.GetRoleMap(), req.SearchAsRoles, localAccessRoles)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	a.authServer.logger.DebugContext(ctx, "Mapped local access roles to remote access roles",
+		"local_access_roles", localAccessRoles,
+		"remote_access_roles", remoteAccessRoles)
+
+	caps := &types.RemoteAccessCapabilities{
+		ApplicableRolesForResources: remoteAccessRoles,
+	}
+	return caps, nil
+}
+
 // GetPluginData loads all plugin data matching the supplied filter.
 func (a *ServerWithRoles) GetPluginData(ctx context.Context, filter types.PluginDataFilter) ([]types.PluginData, error) {
 	switch filter.Kind {
 	case types.KindAccessRequest, types.KindAccessList:
 		// for backwards compatibility, we allow list/read against kinds to also grant list/read for
 		// access request related plugin data.
-		if a.action(filter.Kind, types.VerbList) != nil {
-			if err := a.action(types.KindAccessPluginData, types.VerbList); err != nil {
+		if a.authorizeAction(filter.Kind, types.VerbList) != nil {
+			if err := a.authorizeAction(types.KindAccessPluginData, types.VerbList); err != nil {
 				return nil, trace.Wrap(err)
 			}
 		}
-		if a.action(filter.Kind, types.VerbRead) != nil {
-			if err := a.action(types.KindAccessPluginData, types.VerbRead); err != nil {
+		if a.authorizeAction(filter.Kind, types.VerbRead) != nil {
+			if err := a.authorizeAction(types.KindAccessPluginData, types.VerbRead); err != nil {
 				return nil, trace.Wrap(err)
 			}
 		}
@@ -2927,8 +3286,8 @@ func (a *ServerWithRoles) UpdatePluginData(ctx context.Context, params types.Plu
 	case types.KindAccessRequest, types.KindAccessList:
 		// for backwards compatibility, we allow update against access requests to also grant update for
 		// access request related plugin data.
-		if a.action(params.Kind, types.VerbUpdate) != nil {
-			if err := a.action(types.KindAccessPluginData, types.VerbUpdate); err != nil {
+		if a.authorizeAction(params.Kind, types.VerbUpdate) != nil {
+			if err := a.authorizeAction(types.KindAccessPluginData, types.VerbUpdate); err != nil {
 				return trace.Wrap(err)
 			}
 		}
@@ -2947,7 +3306,7 @@ func (a *ServerWithRoles) Ping(ctx context.Context) (proto.PingResponse, error)
 }
 
 func (a *ServerWithRoles) DeleteAccessRequest(ctx context.Context, name string) error {
-	if err := a.action(types.KindAccessRequest, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindAccessRequest, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -3046,7 +3405,7 @@ func (a *ServerWithRoles) desiredAccessInfoForUser(ctx context.Context, req *pro
 	// considering new or dropped access requests. This will include roles from
 	// currently assumed role access requests, and allowed resources from
 	// currently assumed resource access requests.
-	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(currentIdentity, a.authServer)
+	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(currentIdentity)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3232,8 +3591,15 @@ func (a *ServerWithRoles) generateUserCerts(ctx context.Context, req proto.UserC
 	// preserved in user login state, where local users may get updated roles
 	// from ConnectMyComputer setup. So here we retrieve additional fields from
 	// user login state. Ideally we should solve this some other way.
-	if err := userloginstate.UpdatePreservedAttributes(ctx, user, a.authServer.Services); err != nil {
-		return nil, trace.Wrap(err, "updating preserved attributes")
+	if githubIdentities := user.GetGithubIdentities(); len(githubIdentities) == 0 {
+		uls, err := a.authServer.Services.GetUserLoginState(ctx, user.GetName())
+		if trace.IsNotFound(err) {
+			// Nothing to do.
+		} else if err != nil {
+			return nil, trace.Wrap(err, "updating GitHub identities")
+		} else if githubIdentities := uls.GetGithubIdentities(); len(githubIdentities) > 0 {
+			user.SetGithubIdentities(githubIdentities)
+		}
 	}
 
 	// Do not allow SSO users to be impersonated.
@@ -3266,9 +3632,10 @@ func (a *ServerWithRoles) generateUserCerts(ctx context.Context, req proto.UserC
 			if maxTime := a.authServer.GetClock().Now().Add(defaults.MaxRenewableCertTTL); req.Expires.After(maxTime) {
 				req.Expires = maxTime
 			}
-		} else if isLocalProxyCertReq(&req) {
-			// If requested certificate is for headless Kubernetes access of local proxy it is limited by max session ttl
-			// or mfa_verification_interval or req.Expires.
+		} else if !isCertWrittenToDiskFlow(&req) {
+			// If requested certificate is for a flow that does not involve writing the certificate to disk
+			// (e.g. tsh proxy of DB, Kube, App, and AWS App Access using credential process)
+			// it is limited by max session ttl or mfa_verification_interval or req.Expires.
 
 			// Calculate the expiration time.
 			roleSet, err := services.FetchRoles(user.GetRoles(), a, user.GetTraits())
@@ -3449,6 +3816,7 @@ func (a *ServerWithRoles) generateUserCerts(ctx context.Context, req proto.UserC
 		tlsPublicKeyAttestationStatement: hardwarekey.AttestationStatementFromProto(req.TLSPublicKeyAttestationStatement),
 		overrideRoleTTL:                  a.hasBuiltinRole(types.RoleAdmin),
 		routeToCluster:                   req.RouteToCluster,
+		requesterName:                    req.RequesterName,
 		kubernetesCluster:                req.KubernetesCluster,
 		dbService:                        req.RouteToDatabase.ServiceName,
 		dbProtocol:                       req.RouteToDatabase.Protocol,
@@ -3464,7 +3832,7 @@ func (a *ServerWithRoles) generateUserCerts(ctx context.Context, req proto.UserC
 		awsRoleARN:                       req.RouteToApp.AWSRoleARN,
 		azureIdentity:                    req.RouteToApp.AzureIdentity,
 		gcpServiceAccount:                req.RouteToApp.GCPServiceAccount,
-		checker:                          checker,
+		checker:                          services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to generateUserCerts.
 		// Copy IP from current identity to the generated certificate, if present,
 		// to avoid generateUserCerts() being used to drop IP pinning in the new certificates.
 		loginIP:                a.context.Identity.GetIdentity().LoginIP,
@@ -3478,6 +3846,7 @@ func (a *ServerWithRoles) generateUserCerts(ctx context.Context, req proto.UserC
 		// `updateBotInstance()` is called below, and this (empty) value will be
 		// overridden.
 		botInstanceID: a.context.Identity.GetIdentity().BotInstanceID,
+		joinToken:     a.context.Identity.GetIdentity().JoinToken,
 		// Propagate any join attributes from the current identity to the new
 		// identity.
 		joinAttributes: a.context.Identity.GetIdentity().JoinAttributes,
@@ -3591,7 +3960,7 @@ func (a *ServerWithRoles) verifyUserDeviceForCertIssuance(ctx context.Context, u
 }
 
 func (a *ServerWithRoles) CreateResetPasswordToken(ctx context.Context, req authclient.CreateUserTokenRequest) (types.UserToken, error) {
-	if err := a.action(types.KindUser, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindUser, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -3612,6 +3981,18 @@ func (a *ServerWithRoles) GetResetPasswordToken(ctx context.Context, tokenID str
 	return a.authServer.getResetPasswordToken(ctx, tokenID)
 }
 
+func (a *ServerWithRoles) ListResetPasswordTokens(ctx context.Context, pageSize int, pageToken string) ([]types.UserToken, string, error) {
+	if err := a.authorizeAction(types.KindToken, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	if err := a.context.AuthorizeAdminActionAllowReusedMFA(); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return a.authServer.ListUserTokens(ctx, pageSize, pageToken)
+}
+
 // ChangeUserAuthentication is implemented by AuthService.ChangeUserAuthentication.
 func (a *ServerWithRoles) ChangeUserAuthentication(ctx context.Context, req *proto.ChangeUserAuthenticationRequest) (*proto.ChangeUserAuthenticationResponse, error) {
 	// Token is its own authentication, no need to double check.
@@ -3696,7 +4077,7 @@ func hasOneNonPresetUser(users []types.User) bool {
 // backend's value does not match the expected value.
 // Captures the auth user who modified the user record.
 func (a *ServerWithRoles) CompareAndSwapUser(ctx context.Context, new, existing types.User) error {
-	if err := a.action(types.KindUser, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindUser, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -3808,6 +4189,24 @@ func (a *ServerWithRoles) GetOIDCConnectors(ctx context.Context, withSecrets boo
 	return a.authServer.GetOIDCConnectors(ctx, withSecrets)
 }
 
+// ListOIDCConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (a *ServerWithRoles) ListOIDCConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.OIDCConnector, string, error) {
+	if err := a.authConnectorAction(types.KindOIDC, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if err := a.authConnectorAction(types.KindOIDC, types.VerbReadNoSecrets); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if withSecrets {
+		if err := a.authConnectorAction(types.KindOIDC, types.VerbRead); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return a.authServer.ListOIDCConnectors(ctx, limit, start, withSecrets)
+}
+
 func (a *ServerWithRoles) CreateOIDCAuthRequest(ctx context.Context, req types.OIDCAuthRequest) (*types.OIDCAuthRequest, error) {
 	if !modules.GetModules().Features().GetEntitlement(entitlements.OIDC).Enabled {
 		// TODO(zmb3): ideally we would wrap ErrRequiresEnterprise here, but
@@ -3816,7 +4215,7 @@ func (a *ServerWithRoles) CreateOIDCAuthRequest(ctx context.Context, req types.O
 		return nil, trace.AccessDenied("OIDC is only available in Teleport Enterprise")
 	}
 
-	if err := a.action(types.KindOIDCRequest, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindOIDCRequest, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -3854,7 +4253,7 @@ func (a *ServerWithRoles) CreateOIDCAuthRequest(ctx context.Context, req types.O
 
 // GetOIDCAuthRequest returns OIDC auth request if found.
 func (a *ServerWithRoles) GetOIDCAuthRequest(ctx context.Context, id string) (*types.OIDCAuthRequest, error) {
-	if err := a.action(types.KindOIDCRequest, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindOIDCRequest, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -3975,12 +4374,30 @@ func (a *ServerWithRoles) GetSAMLConnectors(ctx context.Context, withSecrets boo
 	return a.authServer.GetSAMLConnectorsWithValidationOptions(ctx, withSecrets, opts...)
 }
 
+// ListSAMLConnectorsWithOptions returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (a *ServerWithRoles) ListSAMLConnectorsWithOptions(ctx context.Context, limit int, start string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, string, error) {
+	if err := a.authConnectorAction(types.KindSAML, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if err := a.authConnectorAction(types.KindSAML, types.VerbReadNoSecrets); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if withSecrets {
+		if err := a.authConnectorAction(types.KindSAML, types.VerbRead); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return a.authServer.ListSAMLConnectorsWithOptions(ctx, limit, start, withSecrets, opts...)
+}
+
 func (a *ServerWithRoles) CreateSAMLAuthRequest(ctx context.Context, req types.SAMLAuthRequest) (*types.SAMLAuthRequest, error) {
 	if !modules.GetModules().Features().GetEntitlement(entitlements.SAML).Enabled {
 		return nil, trace.Wrap(ErrSAMLRequiresEnterprise)
 	}
 
-	if err := a.action(types.KindSAMLRequest, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindSAMLRequest, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -4039,7 +4456,7 @@ func (a *ServerWithRoles) ValidateSAMLResponse(ctx context.Context, samlResponse
 
 // GetSAMLAuthRequest returns SAML auth request if found.
 func (a *ServerWithRoles) GetSAMLAuthRequest(ctx context.Context, id string) (*types.SAMLAuthRequest, error) {
-	if err := a.action(types.KindSAMLRequest, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindSAMLRequest, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -4061,7 +4478,7 @@ func (a *ServerWithRoles) GetSSODiagnosticInfo(ctx context.Context, authKind str
 		return nil, trace.BadParameter("unsupported authKind %q", authKind)
 	}
 
-	if err := a.action(resource, types.VerbRead); err != nil {
+	if err := a.authorizeAction(resource, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -4187,6 +4604,24 @@ func (a *ServerWithRoles) GetGithubConnectors(ctx context.Context, withSecrets b
 	return a.authServer.GetGithubConnectors(ctx, withSecrets)
 }
 
+// ListGithubConnectors returns a page of valid registered Github connectors.
+// withSecrets adds or removes client secret from return results.
+func (a *ServerWithRoles) ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error) {
+	if err := a.authConnectorAction(types.KindGithub, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if err := a.authConnectorAction(types.KindGithub, types.VerbReadNoSecrets); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	if withSecrets {
+		if err := a.authConnectorAction(types.KindGithub, types.VerbRead); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return a.authServer.ListGithubConnectors(ctx, limit, start, withSecrets)
+}
+
 // DeleteGithubConnector deletes a Github connector by name.
 func (a *ServerWithRoles) DeleteGithubConnector(ctx context.Context, connectorID string) error {
 	if err := a.authConnectorAction(types.KindGithub, types.VerbDelete); err != nil {
@@ -4201,7 +4636,7 @@ func (a *ServerWithRoles) DeleteGithubConnector(ctx context.Context, connectorID
 }
 
 func (a *ServerWithRoles) CreateGithubAuthRequest(ctx context.Context, req types.GithubAuthRequest) (*types.GithubAuthRequest, error) {
-	if err := a.action(types.KindGithubRequest, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindGithubRequest, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -4239,7 +4674,7 @@ func (a *ServerWithRoles) CreateGithubAuthRequest(ctx context.Context, req types
 
 // GetGithubAuthRequest returns Github auth request if found.
 func (a *ServerWithRoles) GetGithubAuthRequest(ctx context.Context, stateToken string) (*types.GithubAuthRequest, error) {
-	if err := a.action(types.KindGithubRequest, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindGithubRequest, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -4264,7 +4699,7 @@ func (a *ServerWithRoles) ValidateGithubAuthCallback(ctx context.Context, q url.
 // EmitAuditEvent emits a single audit event
 func (a *ServerWithRoles) EmitAuditEvent(ctx context.Context, event apievents.AuditEvent) error {
 	ctx = context.WithoutCancel(ctx)
-	if err := a.action(types.KindEvent, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	role, ok := a.context.Identity.(authz.BuiltinRole)
@@ -4290,7 +4725,7 @@ func (a *ServerWithRoles) EmitAuditEvent(ctx context.Context, event apievents.Au
 
 // CreateAuditStream creates audit event stream
 func (a *ServerWithRoles) CreateAuditStream(ctx context.Context, sid session.ID) (apievents.Stream, error) {
-	if err := a.action(types.KindEvent, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	role, ok := a.context.Identity.(authz.BuiltinRole)
@@ -4310,7 +4745,7 @@ func (a *ServerWithRoles) CreateAuditStream(ctx context.Context, sid session.ID)
 
 // ResumeAuditStream resumes the stream that has been created
 func (a *ServerWithRoles) ResumeAuditStream(ctx context.Context, sid session.ID, uploadID string) (apievents.Stream, error) {
-	if err := a.action(types.KindEvent, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	role, ok := a.context.Identity.(authz.BuiltinRole)
@@ -4383,10 +4818,12 @@ func (a *ServerWithRoles) findSessionEndEvent(ctx context.Context, sid session.I
 		To:    a.authServer.clock.Now().UTC(),
 		Limit: defaults.EventsIterationLimit,
 		Order: types.EventOrderAscending,
-		Cond: &types.WhereExpr{Equals: types.WhereExpr2{
-			L: &types.WhereExpr{Field: events.SessionEventID},
-			R: &types.WhereExpr{Literal: sid.String()},
-		}},
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr: &types.WhereExpr{Equals: types.WhereExpr2{
+				L: &types.WhereExpr{Field: events.SessionEventID},
+				R: &types.WhereExpr{Literal: sid.String()},
+			}},
+		},
 		SessionID: sid.String(),
 	})
 	if err != nil {
@@ -4425,7 +4862,7 @@ func (a *ServerWithRoles) GetRoles(ctx context.Context) ([]types.Role, error) {
 
 // ListRoles is a paginated role getter.
 func (a *ServerWithRoles) ListRoles(ctx context.Context, req *proto.ListRolesRequest) (*proto.ListRolesResponse, error) {
-	authErr := a.action(types.KindRole, types.VerbList, types.VerbRead)
+	authErr := a.authorizeAction(types.KindRole, types.VerbList, types.VerbRead)
 	if authErr == nil {
 		rsp, err := a.authServer.ListRoles(ctx, req)
 		return rsp, trace.Wrap(err)
@@ -4452,6 +4889,78 @@ func (a *ServerWithRoles) ListRoles(ctx context.Context, req *proto.ListRolesReq
 	}, nil
 }
 
+// ListRequestableRoles is a paginated requestable role getter. Unlike ListRoles, this only returns a list of roles that the user can request in an access request.
+// This does not use the resource verbs for RBAC, and all users are allowed to call this endpoint. The requestable roles returned here are only the ones that the user
+// has been granted permission to request. If a user has not been granted permission to request any roles, this will return an empty list.
+func (a *ServerWithRoles) ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error) {
+	if req.PageSize == 0 || req.PageSize > apidefaults.DefaultChunkSize {
+		req.PageSize = apidefaults.DefaultChunkSize
+	}
+
+	requestValidator, err := services.NewRequestValidator(ctx, a.authServer.clock, a.authServer, a.context.GetUserMetadata().User)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Convert ListRequestableRolesRequest to ListRolesRequest for compatibility with `IterateRoles`
+	listReq := &proto.ListRolesRequest{
+		Limit:    req.PageSize,
+		StartKey: req.PageToken,
+	}
+
+	var roleFilter *types.RoleFilter
+	if req.Filter != nil {
+		roleFilter = &types.RoleFilter{
+			SearchKeywords:  req.Filter.SearchKeywords,
+			SkipSystemRoles: true,
+		}
+	}
+	// matchFunc is the function that will be run on each retrieved role to verify that it is requestable and matches the provided filters (if any).
+	matchFunc := func(role *types.RoleV6) (bool, error) {
+		roleName := role.GetName()
+
+		// Users can't request their own roles
+		if slices.Contains(a.context.User.GetRoles(), roleName) {
+			return false, nil
+		}
+
+		// Apply any RoleFilters if defined.
+		if req.Filter != nil && !roleFilter.Match(role) {
+			return false, nil
+		}
+
+		if requestValidator.CanRequestRole(roleName) {
+			return true, nil
+		}
+
+		return false, nil
+	}
+
+	out, nextKey, err := a.authServer.IterateRoles(ctx, listReq, matchFunc)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &proto.ListRequestableRolesResponse{
+		Roles:         convertRolesToRequestableRoles(out),
+		NextPageToken: nextKey,
+	}, nil
+}
+
+// convertRolesToRequestableRoles turns a slice of Roles into RequestableRoles, stripping all data except the name and description.
+func convertRolesToRequestableRoles(roles []*types.RoleV6) []*proto.ListRequestableRolesResponse_RequestableRole {
+	items := make([]*proto.ListRequestableRolesResponse_RequestableRole, 0, len(roles))
+	for _, role := range roles {
+		item := &proto.ListRequestableRolesResponse_RequestableRole{
+			Name:        role.GetName(),
+			Description: role.GetMetadata().Description,
+		}
+		items = append(items, item)
+	}
+
+	return items
+}
+
 func (a *ServerWithRoles) validateRole(role types.Role) error {
 	if downgradeReason := role.GetMetadata().Labels[types.TeleportDowngradedLabel]; downgradeReason != "" {
 		return trace.BadParameter("refusing to upsert role because %s label is set with reason %q",
@@ -4551,16 +5060,20 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) (type
 		return nil, trace.Wrap(err)
 	}
 
-	verbs := []string{types.VerbCreate}
-	if oldRole != nil {
-		verbs = []string{types.VerbUpdate}
-		if err := a.actionForResource(oldRole, types.KindRole, verbs...); err != nil {
+	switch {
+	case oldRole != nil:
+		// if the role already exists, then require update permission
+		// on both the current state of the role and the new state of the role
+		if err := a.actionForResource(oldRole, types.KindRole, types.VerbUpdate); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if err := a.actionForResource(role, types.KindRole, types.VerbUpdate); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	default:
+		if err := a.actionForResource(role, types.KindRole, types.VerbCreate); err != nil {
 			return nil, trace.Wrap(err)
 		}
-	}
-
-	if err := a.actionForResource(role, types.KindRole, verbs...); err != nil {
-		return nil, trace.Wrap(err)
 	}
 
 	// Support reused MFA for bulk tctl create requests.
@@ -4615,10 +5128,17 @@ func (a *ServerWithRoles) GetRole(ctx context.Context, name string) (types.Role,
 	// that they hold.  This requirement is checked first to avoid
 	// misleading denial messages in the logs.
 	if slices.Contains(a.context.User.GetRoles(), name) {
-		return a.authServer.GetRole(ctx, name)
+		role, err := a.authServer.GetRole(ctx, name)
+		if err != nil && trace.IsNotFound(err) {
+			// Add the UserSessionRoleNotFoundErrorMsg message to indicate this role not found error was
+			// encountered while the user was looking up one of their own roles. At this point, the
+			// role not found error can only happen if a role in their session cert doesn't exist anymore.
+			return nil, trace.Wrap(err, services.UserSessionRoleNotFoundErrorMsg)
+		}
+		return role, trace.Wrap(err)
 	}
 
-	authErr := a.action(types.KindRole, types.VerbRead)
+	authErr := a.authorizeAction(types.KindRole, types.VerbRead)
 	if authErr == nil {
 		return a.authServer.GetRole(ctx, name)
 	}
@@ -4669,7 +5189,7 @@ func (a *ServerWithRoles) DeleteRole(ctx context.Context, name string) error {
 // TODO(noah): DELETE IN v19.0.0 - when the apiserver getClusterName method is also
 // deleted.
 func (a *ServerWithRoles) GetClusterName(ctx context.Context) (types.ClusterName, error) {
-	if err := a.action(types.KindClusterName, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindClusterName, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetClusterName(ctx)
@@ -4677,7 +5197,7 @@ func (a *ServerWithRoles) GetClusterName(ctx context.Context) (types.ClusterName
 
 // GetAuthPreference gets cluster auth preference.
 func (a *ServerWithRoles) GetAuthPreference(ctx context.Context) (types.AuthPreference, error) {
-	if err := a.action(types.KindClusterAuthPreference, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindClusterAuthPreference, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	cfg, err := a.authServer.GetReadOnlyAuthPreference(ctx)
@@ -4688,7 +5208,7 @@ func (a *ServerWithRoles) GetAuthPreference(ctx context.Context) (types.AuthPref
 }
 
 func (a *ServerWithRoles) GetUIConfig(ctx context.Context) (types.UIConfig, error) {
-	if err := a.action(types.KindUIConfig, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindUIConfig, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	cfg, err := a.authServer.GetUIConfig(ctx)
@@ -4696,14 +5216,14 @@ func (a *ServerWithRoles) GetUIConfig(ctx context.Context) (types.UIConfig, erro
 }
 
 func (a *ServerWithRoles) SetUIConfig(ctx context.Context, uic types.UIConfig) error {
-	if err := a.action(types.KindUIConfig, types.VerbUpdate, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindUIConfig, types.VerbUpdate, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	return trace.Wrap(a.authServer.SetUIConfig(ctx, uic))
 }
 
 func (a *ServerWithRoles) DeleteUIConfig(ctx context.Context) error {
-	if err := a.action(types.KindUIConfig, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindUIConfig, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return trace.Wrap(a.authServer.DeleteUIConfig(ctx))
@@ -4711,7 +5231,7 @@ func (a *ServerWithRoles) DeleteUIConfig(ctx context.Context) error {
 
 // GetInstaller retrieves an installer script resource
 func (a *ServerWithRoles) GetInstaller(ctx context.Context, name string) (types.Installer, error) {
-	if err := a.action(types.KindInstaller, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetInstaller(ctx, name)
@@ -4719,15 +5239,31 @@ func (a *ServerWithRoles) GetInstaller(ctx context.Context, name string) (types.
 
 // GetInstallers gets all the installer resources.
 func (a *ServerWithRoles) GetInstallers(ctx context.Context) ([]types.Installer, error) {
-	if err := a.action(types.KindInstaller, types.VerbRead, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbRead, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetInstallers(ctx)
 }
 
+// ListInstallers returns a page of installer script resources.
+func (a *ServerWithRoles) ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error) {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbRead, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	return a.authServer.ListInstallers(ctx, limit, start)
+}
+
+// RangeInstallers returns installer script resources within the range [start, end).
+func (a *ServerWithRoles) RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error] {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbRead, types.VerbList); err != nil {
+		return iterstream.Fail[types.Installer](trace.Wrap(err))
+	}
+	return a.authServer.RangeInstallers(ctx, start, end)
+}
+
 // SetInstaller sets an Installer script resource
 func (a *ServerWithRoles) SetInstaller(ctx context.Context, inst types.Installer) error {
-	if err := a.action(types.KindInstaller, types.VerbUpdate, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbUpdate, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	return trace.Wrap(a.authServer.SetInstaller(ctx, inst))
@@ -4735,7 +5271,7 @@ func (a *ServerWithRoles) SetInstaller(ctx context.Context, inst types.Installer
 
 // DeleteInstaller removes an installer script resource
 func (a *ServerWithRoles) DeleteInstaller(ctx context.Context, name string) error {
-	if err := a.action(types.KindInstaller, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return trace.Wrap(a.authServer.DeleteInstaller(ctx, name))
@@ -4743,7 +5279,7 @@ func (a *ServerWithRoles) DeleteInstaller(ctx context.Context, name string) erro
 
 // DeleteAllInstallers removes all installer script resources
 func (a *ServerWithRoles) DeleteAllInstallers(ctx context.Context) error {
-	if err := a.action(types.KindInstaller, types.VerbDelete, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindInstaller, types.VerbDelete, types.VerbList); err != nil {
 		return trace.Wrap(err)
 	}
 	return trace.Wrap(a.authServer.DeleteAllInstallers(ctx))
@@ -4757,7 +5293,7 @@ func (a *ServerWithRoles) SetAuthPreference(ctx context.Context, newAuthPref typ
 		return trace.Wrap(err)
 	}
 
-	if err := a.action(types.KindClusterAuthPreference, verbsToReplaceResourceWithOrigin(storedAuthPref)...); err != nil {
+	if err := a.authorizeActionWithOrigin(types.KindClusterAuthPreference, storedAuthPref.Origin()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -4826,7 +5362,7 @@ func (a *ServerWithRoles) ResetAuthPreference(ctx context.Context) error {
 		return trace.BadParameter("config-file configuration cannot be reset")
 	}
 
-	if err := a.action(types.KindClusterAuthPreference, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindClusterAuthPreference, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -4868,8 +5404,8 @@ func (a *ServerWithRoles) ResetAuthPreference(ctx context.Context) error {
 
 // GetClusterAuditConfig gets cluster audit configuration.
 func (a *ServerWithRoles) GetClusterAuditConfig(ctx context.Context) (types.ClusterAuditConfig, error) {
-	if err := a.action(types.KindClusterAuditConfig, types.VerbRead); err != nil {
-		if err2 := a.action(types.KindClusterConfig, types.VerbRead); err2 != nil {
+	if err := a.authorizeAction(types.KindClusterAuditConfig, types.VerbRead); err != nil {
+		if err2 := a.authorizeAction(types.KindClusterConfig, types.VerbRead); err2 != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -4878,8 +5414,8 @@ func (a *ServerWithRoles) GetClusterAuditConfig(ctx context.Context) (types.Clus
 
 // GetClusterNetworkingConfig gets cluster networking configuration.
 func (a *ServerWithRoles) GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error) {
-	if err := a.action(types.KindClusterNetworkingConfig, types.VerbRead); err != nil {
-		if err2 := a.action(types.KindClusterConfig, types.VerbRead); err2 != nil {
+	if err := a.authorizeAction(types.KindClusterNetworkingConfig, types.VerbRead); err != nil {
+		if err2 := a.authorizeAction(types.KindClusterConfig, types.VerbRead); err2 != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -4897,10 +5433,12 @@ func (a *ServerWithRoles) SetClusterNetworkingConfig(ctx context.Context, newNet
 		return trace.Wrap(err)
 	}
 
-	if err := a.action(types.KindClusterNetworkingConfig, verbsToReplaceResourceWithOrigin(storedNetConfig)...); err != nil {
-		if err2 := a.action(types.KindClusterConfig, verbsToReplaceResourceWithOrigin(storedNetConfig)...); err2 != nil {
+	if err := a.authorizeActionWithOrigin(types.KindClusterNetworkingConfig, storedNetConfig.Origin()); err != nil {
+		if err2 := a.authorizeActionWithOrigin(types.KindClusterConfig, storedNetConfig.Origin()); err2 != nil {
 			return trace.Wrap(err)
 		}
+
+		return trace.Wrap(err)
 	}
 
 	// Support reused MFA for bulk tctl create requests.
@@ -4959,8 +5497,8 @@ func (a *ServerWithRoles) ResetClusterNetworkingConfig(ctx context.Context) erro
 		return trace.BadParameter("config-file configuration cannot be reset")
 	}
 
-	if err := a.action(types.KindClusterNetworkingConfig, types.VerbUpdate); err != nil {
-		if err2 := a.action(types.KindClusterConfig, types.VerbUpdate); err2 != nil {
+	if err := a.authorizeAction(types.KindClusterNetworkingConfig, types.VerbUpdate); err != nil {
+		if err2 := a.authorizeAction(types.KindClusterConfig, types.VerbUpdate); err2 != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -5004,8 +5542,8 @@ func (a *ServerWithRoles) ResetClusterNetworkingConfig(ctx context.Context) erro
 
 // GetSessionRecordingConfig gets session recording configuration.
 func (a *ServerWithRoles) GetSessionRecordingConfig(ctx context.Context) (types.SessionRecordingConfig, error) {
-	if err := a.action(types.KindSessionRecordingConfig, types.VerbRead); err != nil {
-		if err2 := a.action(types.KindClusterConfig, types.VerbRead); err2 != nil {
+	if err := a.authorizeAction(types.KindSessionRecordingConfig, types.VerbRead); err != nil {
+		if err2 := a.authorizeAction(types.KindClusterConfig, types.VerbRead); err2 != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -5019,10 +5557,12 @@ func (a *ServerWithRoles) SetSessionRecordingConfig(ctx context.Context, newRecC
 		return trace.Wrap(err)
 	}
 
-	if err := a.action(types.KindSessionRecordingConfig, verbsToReplaceResourceWithOrigin(storedRecConfig)...); err != nil {
-		if err2 := a.action(types.KindClusterConfig, verbsToReplaceResourceWithOrigin(storedRecConfig)...); err2 != nil {
+	if err := a.authorizeActionWithOrigin(types.KindSessionRecordingConfig, storedRecConfig.Origin()); err != nil {
+		if err2 := a.authorizeActionWithOrigin(types.KindClusterConfig, storedRecConfig.Origin()); err2 != nil {
 			return trace.Wrap(err)
 		}
+
+		return trace.Wrap(err)
 	}
 
 	// Support reused MFA for bulk tctl create requests.
@@ -5065,8 +5605,8 @@ func (a *ServerWithRoles) ResetSessionRecordingConfig(ctx context.Context) error
 		return trace.BadParameter("config-file configuration cannot be reset")
 	}
 
-	if err := a.action(types.KindSessionRecordingConfig, types.VerbUpdate); err != nil {
-		if err2 := a.action(types.KindClusterConfig, types.VerbUpdate); err2 != nil {
+	if err := a.authorizeAction(types.KindSessionRecordingConfig, types.VerbUpdate); err != nil {
+		if err2 := a.authorizeAction(types.KindClusterConfig, types.VerbUpdate); err2 != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -5102,7 +5642,7 @@ func (a *ServerWithRoles) ResetSessionRecordingConfig(ctx context.Context) error
 
 // GetServerInfos returns a stream of ServerInfos.
 func (a *ServerWithRoles) GetServerInfos(ctx context.Context) stream.Stream[types.ServerInfo] {
-	if err := a.action(types.KindServerInfo, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindServerInfo, types.VerbList, types.VerbRead); err != nil {
 		return stream.Fail[types.ServerInfo](trace.Wrap(err))
 	}
 
@@ -5111,7 +5651,7 @@ func (a *ServerWithRoles) GetServerInfos(ctx context.Context) stream.Stream[type
 
 // GetServerInfo returns a ServerInfo by name.
 func (a *ServerWithRoles) GetServerInfo(ctx context.Context, name string) (types.ServerInfo, error) {
-	if err := a.action(types.KindServerInfo, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindServerInfo, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -5121,7 +5661,7 @@ func (a *ServerWithRoles) GetServerInfo(ctx context.Context, name string) (types
 
 // UpsertServerInfo upserts a ServerInfo.
 func (a *ServerWithRoles) UpsertServerInfo(ctx context.Context, si types.ServerInfo) error {
-	if err := a.action(types.KindServerInfo, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindServerInfo, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5130,7 +5670,7 @@ func (a *ServerWithRoles) UpsertServerInfo(ctx context.Context, si types.ServerI
 
 // DeleteServerInfo deletes a ServerInfo by name.
 func (a *ServerWithRoles) DeleteServerInfo(ctx context.Context, name string) error {
-	if err := a.action(types.KindServerInfo, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindServerInfo, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5139,7 +5679,7 @@ func (a *ServerWithRoles) DeleteServerInfo(ctx context.Context, name string) err
 
 // DeleteAllServerInfos deletes all ServerInfos.
 func (a *ServerWithRoles) DeleteAllServerInfos(ctx context.Context) error {
-	if err := a.action(types.KindServerInfo, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindServerInfo, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5147,7 +5687,7 @@ func (a *ServerWithRoles) DeleteAllServerInfos(ctx context.Context) error {
 }
 
 func (a *ServerWithRoles) GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster, error) {
-	if err := a.action(types.KindTrustedCluster, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindTrustedCluster, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -5155,7 +5695,7 @@ func (a *ServerWithRoles) GetTrustedClusters(ctx context.Context) ([]types.Trust
 }
 
 func (a *ServerWithRoles) GetTrustedCluster(ctx context.Context, name string) (types.TrustedCluster, error) {
-	if err := a.action(types.KindTrustedCluster, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindTrustedCluster, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -5169,7 +5709,7 @@ func (a *ServerWithRoles) UpsertTrustedCluster(ctx context.Context, tc types.Tru
 		return nil, trace.NotImplemented("cloud tenants cannot be leaf clusters")
 	}
 
-	if err := a.action(types.KindTrustedCluster, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindTrustedCluster, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -5192,7 +5732,7 @@ func (a *ServerWithRoles) ValidateTrustedCluster(ctx context.Context, validateRe
 
 // DeleteTrustedCluster deletes a trusted cluster by name.
 func (a *ServerWithRoles) DeleteTrustedCluster(ctx context.Context, name string) error {
-	if err := a.action(types.KindTrustedCluster, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindTrustedCluster, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5204,42 +5744,42 @@ func (a *ServerWithRoles) DeleteTrustedCluster(ctx context.Context, name string)
 }
 
 func (a *ServerWithRoles) UpsertTunnelConnection(conn types.TunnelConnection) error {
-	if err := a.action(types.KindTunnelConnection, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.UpsertTunnelConnection(conn)
 }
 
 func (a *ServerWithRoles) GetTunnelConnections(clusterName string, opts ...services.MarshalOption) ([]types.TunnelConnection, error) {
-	if err := a.action(types.KindTunnelConnection, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetTunnelConnections(clusterName, opts...)
 }
 
 func (a *ServerWithRoles) GetAllTunnelConnections(opts ...services.MarshalOption) ([]types.TunnelConnection, error) {
-	if err := a.action(types.KindTunnelConnection, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetAllTunnelConnections(opts...)
 }
 
 func (a *ServerWithRoles) DeleteTunnelConnection(clusterName string, connName string) error {
-	if err := a.action(types.KindTunnelConnection, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteTunnelConnection(clusterName, connName)
 }
 
 func (a *ServerWithRoles) DeleteTunnelConnections(clusterName string) error {
-	if err := a.action(types.KindTunnelConnection, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteTunnelConnections(clusterName)
 }
 
 func (a *ServerWithRoles) DeleteAllTunnelConnections() error {
-	if err := a.action(types.KindTunnelConnection, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindTunnelConnection, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAllTunnelConnections()
@@ -5247,7 +5787,7 @@ func (a *ServerWithRoles) DeleteAllTunnelConnections() error {
 
 // AcquireSemaphore acquires lease with requested resources from semaphore.
 func (a *ServerWithRoles) AcquireSemaphore(ctx context.Context, params types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error) {
-	if err := a.action(types.KindSemaphore, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.AcquireSemaphore(ctx, params)
@@ -5255,7 +5795,7 @@ func (a *ServerWithRoles) AcquireSemaphore(ctx context.Context, params types.Acq
 
 // KeepAliveSemaphoreLease updates semaphore lease.
 func (a *ServerWithRoles) KeepAliveSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error {
-	if err := a.action(types.KindSemaphore, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.KeepAliveSemaphoreLease(ctx, lease)
@@ -5263,7 +5803,7 @@ func (a *ServerWithRoles) KeepAliveSemaphoreLease(ctx context.Context, lease typ
 
 // CancelSemaphoreLease cancels semaphore lease early.
 func (a *ServerWithRoles) CancelSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error {
-	if err := a.action(types.KindSemaphore, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.CancelSemaphoreLease(ctx, lease)
@@ -5271,15 +5811,23 @@ func (a *ServerWithRoles) CancelSemaphoreLease(ctx context.Context, lease types.
 
 // GetSemaphores returns a list of all semaphores matching the supplied filter.
 func (a *ServerWithRoles) GetSemaphores(ctx context.Context, filter types.SemaphoreFilter) ([]types.Semaphore, error) {
-	if err := a.action(types.KindSemaphore, types.VerbReadNoSecrets, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbReadNoSecrets, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetSemaphores(ctx, filter)
 }
 
+// ListSemaphores returns a page of semaphores matching supplied filter.
+func (a *ServerWithRoles) ListSemaphores(ctx context.Context, limit int, start string, filter *types.SemaphoreFilter) ([]types.Semaphore, string, error) {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbReadNoSecrets, types.VerbList); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	return a.authServer.ListSemaphores(ctx, limit, start, filter)
+}
+
 // DeleteSemaphore deletes a semaphore matching the supplied filter.
 func (a *ServerWithRoles) DeleteSemaphore(ctx context.Context, filter types.SemaphoreFilter) error {
-	if err := a.action(types.KindSemaphore, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindSemaphore, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteSemaphore(ctx, filter)
@@ -5312,6 +5860,9 @@ func (a *ServerWithRoles) UpsertDatabaseServer(ctx context.Context, server types
 	if err := a.actionNamespace(server.GetNamespace(), types.KindDatabaseServer, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if server.GetScope() != "" {
+		return nil, trace.BadParameter("scoped database server must register a control stream")
+	}
 	return a.authServer.UpsertDatabaseServer(ctx, server)
 }
 
@@ -5341,7 +5892,7 @@ func (a *ServerWithRoles) UpsertDatabaseService(ctx context.Context, service typ
 
 // DeleteAllDatabaseServices removes all DatabaseService resources.
 func (a *ServerWithRoles) DeleteAllDatabaseServices(ctx context.Context) error {
-	if err := a.action(types.KindDatabaseService, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindDatabaseService, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAllDatabaseServices(ctx)
@@ -5349,7 +5900,7 @@ func (a *ServerWithRoles) DeleteAllDatabaseServices(ctx context.Context) error {
 
 // DeleteDatabaseService removes a specific DatabaseService resource.
 func (a *ServerWithRoles) DeleteDatabaseService(ctx context.Context, name string) error {
-	if err := a.action(types.KindDatabaseService, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindDatabaseService, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteDatabaseService(ctx, name)
@@ -5396,7 +5947,7 @@ func (a *ServerWithRoles) GenerateDatabaseCert(ctx context.Context, req *proto.D
 func (a *ServerWithRoles) checkAccessToGenerateDatabaseCert(resourceKind string) error {
 	const verb = types.VerbCreate
 	// Check if the User can `create` Database Certificates
-	err := a.action(resourceKind, verb)
+	err := a.authorizeAction(resourceKind, verb)
 	if err != nil {
 		if !trace.IsAccessDenied(err) {
 			return trace.Wrap(err)
@@ -5488,6 +6039,9 @@ func (a *ServerWithRoles) UpsertApplicationServer(ctx context.Context, server ty
 	if err := a.actionNamespace(server.GetNamespace(), types.KindAppServer, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if server.GetScope() != "" {
+		return nil, trace.BadParameter("scoped app server must register a control stream")
+	}
 	return a.authServer.UpsertApplicationServer(ctx, server)
 }
 
@@ -5514,7 +6068,7 @@ func (a *ServerWithRoles) GetAppSession(ctx context.Context, req types.GetAppSes
 		return nil, trace.Wrap(err)
 	}
 
-	authErr := a.action(types.KindWebSession, types.VerbRead)
+	authErr := a.authorizeAction(types.KindWebSession, types.VerbRead)
 	if authErr == nil {
 		return session, nil
 	}
@@ -5540,7 +6094,7 @@ func (a *ServerWithRoles) GetSnowflakeSession(ctx context.Context, req types.Get
 	if !a.hasBuiltinRole(types.RoleDatabase) {
 		// Users can only fetch their own web sessions.
 		if err := a.currentUserAction(session.GetUser()); err != nil {
-			if err := a.action(types.KindWebSession, types.VerbRead); err != nil {
+			if err := a.authorizeAction(types.KindWebSession, types.VerbRead); err != nil {
 				return nil, trace.Wrap(err)
 			}
 		}
@@ -5550,7 +6104,7 @@ func (a *ServerWithRoles) GetSnowflakeSession(ctx context.Context, req types.Get
 
 // ListAppSessions gets a paginated list of application web sessions.
 func (a *ServerWithRoles) ListAppSessions(ctx context.Context, pageSize int, pageToken, user string) ([]types.WebSession, string, error) {
-	if err := a.action(types.KindWebSession, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbRead); err != nil {
 		return nil, "", trace.Wrap(err)
 	}
 
@@ -5562,16 +6116,32 @@ func (a *ServerWithRoles) ListAppSessions(ctx context.Context, pageSize int, pag
 func (a *ServerWithRoles) GetSnowflakeSessions(ctx context.Context) ([]types.WebSession, error) {
 	// Check if this a database service.
 	if !a.hasBuiltinRole(types.RoleDatabase) {
-		if err := a.action(types.KindWebSession, types.VerbList, types.VerbRead); err != nil {
+		if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbRead); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
 
-	sessions, err := a.authServer.GetSnowflakeSessions(ctx)
+	out, err := iterstream.Collect(a.authServer.RangeSnowflakeSessions(ctx, "", ""))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return sessions, nil
+
+	return out, nil
+}
+
+// ListSnowflakeSessions returns a page of Snowflake web sessions.
+func (a *ServerWithRoles) ListSnowflakeSessions(ctx context.Context, limit int, start string) ([]types.WebSession, string, error) {
+	if !a.hasBuiltinRole(types.RoleDatabase) {
+		if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbRead); err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	return generic.CollectPageAndCursor(
+		a.authServer.RangeSnowflakeSessions(ctx, start, ""),
+		limit,
+		types.WebSession.GetName,
+	)
 }
 
 // CreateAppSession creates an application web session. Application web
@@ -5642,7 +6212,7 @@ func (a *ServerWithRoles) DeleteSnowflakeSession(ctx context.Context, req types.
 // DeleteAllSnowflakeSessions removes all Snowflake web sessions.
 func (a *ServerWithRoles) DeleteAllSnowflakeSessions(ctx context.Context) error {
 	if !a.hasBuiltinRole(types.RoleDatabase) {
-		if err := a.action(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
+		if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -5655,7 +6225,7 @@ func (a *ServerWithRoles) DeleteAllSnowflakeSessions(ctx context.Context) error
 
 // DeleteAllAppSessions removes all application web sessions.
 func (a *ServerWithRoles) DeleteAllAppSessions(ctx context.Context) error {
-	if err := a.action(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5683,7 +6253,7 @@ func (a *ServerWithRoles) DeleteUserAppSessions(ctx context.Context, req *proto.
 // WebSessions from the provided `username`.
 func (a *ServerWithRoles) canDeleteWebSession(username string) error {
 	if err := a.currentUserAction(username); err != nil {
-		if err := a.action(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
+		if err := a.authorizeAction(types.KindWebSession, types.VerbList, types.VerbDelete); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -5693,7 +6263,7 @@ func (a *ServerWithRoles) canDeleteWebSession(username string) error {
 
 // GenerateAppToken creates a JWT token with application access.
 func (a *ServerWithRoles) GenerateAppToken(ctx context.Context, req types.GenerateAppTokenRequest) (string, error) {
-	if err := a.action(types.KindJWT, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindJWT, types.VerbCreate); err != nil {
 		return "", trace.Wrap(err)
 	}
 
@@ -5718,7 +6288,7 @@ func (a *ServerWithRoles) checkAccessToKubeCluster(cluster types.KubeCluster) er
 
 // GetKubernetesServers returns all registered kubernetes servers.
 func (a *ServerWithRoles) GetKubernetesServers(ctx context.Context) ([]types.KubeServer, error) {
-	if err := a.action(types.KindKubeServer, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindKubeServer, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -5743,15 +6313,18 @@ func (a *ServerWithRoles) GetKubernetesServers(ctx context.Context) ([]types.Kub
 // UpsertKubernetesServer creates or updates a Server representing a teleport
 // kubernetes server.
 func (a *ServerWithRoles) UpsertKubernetesServer(ctx context.Context, s types.KubeServer) (*types.KeepAlive, error) {
-	if err := a.action(types.KindKubeServer, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindKubeServer, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if s.GetScope() != "" {
+		return nil, trace.BadParameter("scoped kubernetes server must register a control stream")
+	}
 	return a.authServer.UpsertKubernetesServer(ctx, s)
 }
 
 // DeleteKubernetesServer deletes specified kubernetes server.
 func (a *ServerWithRoles) DeleteKubernetesServer(ctx context.Context, hostID, name string) error {
-	if err := a.action(types.KindKubeServer, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindKubeServer, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteKubernetesServer(ctx, hostID, name)
@@ -5759,7 +6332,7 @@ func (a *ServerWithRoles) DeleteKubernetesServer(ctx context.Context, hostID, na
 
 // DeleteAllKubernetesServers deletes all registered kubernetes servers.
 func (a *ServerWithRoles) DeleteAllKubernetesServers(ctx context.Context) error {
-	if err := a.action(types.KindKubeServer, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindKubeServer, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAllKubernetesServers(ctx)
@@ -5767,7 +6340,7 @@ func (a *ServerWithRoles) DeleteAllKubernetesServers(ctx context.Context) error
 
 // GetNetworkRestrictions retrieves all the network restrictions (allow/deny lists).
 func (a *ServerWithRoles) GetNetworkRestrictions(ctx context.Context) (types.NetworkRestrictions, error) {
-	if err := a.action(types.KindNetworkRestrictions, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindNetworkRestrictions, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetNetworkRestrictions(ctx)
@@ -5775,7 +6348,7 @@ func (a *ServerWithRoles) GetNetworkRestrictions(ctx context.Context) (types.Net
 
 // SetNetworkRestrictions updates the network restrictions.
 func (a *ServerWithRoles) SetNetworkRestrictions(ctx context.Context, nr types.NetworkRestrictions) error {
-	if err := a.action(types.KindNetworkRestrictions, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindNetworkRestrictions, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5789,7 +6362,7 @@ func (a *ServerWithRoles) SetNetworkRestrictions(ctx context.Context, nr types.N
 
 // DeleteNetworkRestrictions deletes the network restrictions.
 func (a *ServerWithRoles) DeleteNetworkRestrictions(ctx context.Context) error {
-	if err := a.action(types.KindNetworkRestrictions, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindNetworkRestrictions, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5878,7 +6451,7 @@ func (a *ServerWithRoles) IsMFARequired(ctx context.Context, req *proto.IsMFAReq
 
 // SearchEvents allows searching audit events with pagination support.
 func (a *ServerWithRoles) SearchEvents(ctx context.Context, req events.SearchEventsRequest) (outEvents []apievents.AuditEvent, lastKey string, err error) {
-	if err := a.action(types.KindEvent, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbList); err != nil {
 		return nil, "", trace.Wrap(err)
 	}
 
@@ -5893,7 +6466,7 @@ func (a *ServerWithRoles) SearchEvents(ctx context.Context, req events.SearchEve
 // ExportUnstructuredEvents exports events from a given event chunk returned by GetEventExportChunks. This API prioritizes
 // performance over ordering and filtering, and is intended for bulk export of events.
 func (a *ServerWithRoles) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
-	if err := a.action(types.KindEvent, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbList); err != nil {
 		return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.Wrap(err))
 	}
 
@@ -5903,7 +6476,7 @@ func (a *ServerWithRoles) ExportUnstructuredEvents(ctx context.Context, req *aud
 // GetEventExportChunks returns a stream of event chunks that can be exported via ExportUnstructuredEvents. The returned
 // list isn't ordered and polling for new chunks requires re-consuming the entire stream from the beginning.
 func (a *ServerWithRoles) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
-	if err := a.action(types.KindEvent, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindEvent, types.VerbList); err != nil {
 		return stream.Fail[*auditlogpb.EventExportChunk](trace.Wrap(err))
 	}
 
@@ -5933,7 +6506,7 @@ func (a *ServerWithRoles) SearchSessionEvents(ctx context.Context, req events.Se
 
 // GetLock gets a lock by name.
 func (a *ServerWithRoles) GetLock(ctx context.Context, name string) (types.Lock, error) {
-	if err := a.action(types.KindLock, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindLock, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.GetLock(ctx, name)
@@ -5941,15 +6514,24 @@ func (a *ServerWithRoles) GetLock(ctx context.Context, name string) (types.Lock,
 
 // GetLocks gets all/in-force locks that match at least one of the targets when specified.
 func (a *ServerWithRoles) GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error) {
-	if err := a.action(types.KindLock, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindLock, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return a.authServer.GetLocks(ctx, inForceOnly, targets...)
+	return a.authServer.Cache.GetLocks(ctx, inForceOnly, targets...)
+}
+
+// ListLocks returns a page of locks
+func (a *ServerWithRoles) ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error) {
+	if err := a.authorizeAction(types.KindLock, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return a.authServer.Cache.ListLocks(ctx, limit, startKey, filter)
 }
 
 // UpsertLock upserts a lock.
 func (a *ServerWithRoles) UpsertLock(ctx context.Context, lock types.Lock) error {
-	if err := a.action(types.KindLock, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindLock, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -5983,7 +6565,7 @@ func (a *ServerWithRoles) UpsertLock(ctx context.Context, lock types.Lock) error
 
 // DeleteLock deletes a lock.
 func (a *ServerWithRoles) DeleteLock(ctx context.Context, name string) error {
-	if err := a.action(types.KindLock, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindLock, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6065,7 +6647,7 @@ func sessionTypeFromStartEvent(sessionStart apievents.AuditEvent) types.SessionK
 
 // CreateApp creates a new application resource.
 func (a *ServerWithRoles) CreateApp(ctx context.Context, app types.Application) error {
-	if err := a.action(types.KindApp, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users create apps they wouldn't have access to (e.g.
@@ -6078,7 +6660,7 @@ func (a *ServerWithRoles) CreateApp(ctx context.Context, app types.Application)
 
 // UpdateApp updates existing application resource.
 func (a *ServerWithRoles) UpdateApp(ctx context.Context, app types.Application) error {
-	if err := a.action(types.KindApp, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users update apps they don't have access to (e.g.
@@ -6098,7 +6680,7 @@ func (a *ServerWithRoles) UpdateApp(ctx context.Context, app types.Application)
 
 // GetApp returns specified application resource.
 func (a *ServerWithRoles) GetApp(ctx context.Context, name string) (types.Application, error) {
-	if err := a.action(types.KindApp, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	app, err := a.authServer.GetApp(ctx, name)
@@ -6113,7 +6695,7 @@ func (a *ServerWithRoles) GetApp(ctx context.Context, name string) (types.Applic
 
 // GetApps returns all application resources.
 func (a *ServerWithRoles) GetApps(ctx context.Context) (result []types.Application, err error) {
-	if err := a.action(types.KindApp, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	// Filter out apps user doesn't have access to.
@@ -6129,9 +6711,37 @@ func (a *ServerWithRoles) GetApps(ctx context.Context) (result []types.Applicati
 	return result, nil
 }
 
+// ListApps returns a page of application resources.
+func (a *ServerWithRoles) ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error) {
+	if err := a.authorizeAction(types.KindApp, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	if limit <= 0 || limit > apidefaults.DefaultChunkSize {
+		limit = apidefaults.DefaultChunkSize
+	}
+
+	var result []types.Application
+	// Filter out apps user doesn't have access to.
+	for app, err := range a.authServer.Apps(ctx, startKey, "") {
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		if err := a.checkAccessToApp(app); err == nil {
+			if len(result) == limit {
+				return result, app.GetName(), nil
+			}
+
+			result = append(result, app)
+		}
+	}
+	return result, "", nil
+}
+
 // DeleteApp removes the specified application resource.
 func (a *ServerWithRoles) DeleteApp(ctx context.Context, name string) error {
-	if err := a.action(types.KindApp, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure user has access to the application before deleting.
@@ -6147,7 +6757,7 @@ func (a *ServerWithRoles) DeleteApp(ctx context.Context, name string) error {
 
 // DeleteAllApps removes all application resources.
 func (a *ServerWithRoles) DeleteAllApps(ctx context.Context) error {
-	if err := a.action(types.KindApp, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindApp, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure to only delete apps user has access to.
@@ -6167,7 +6777,7 @@ func (a *ServerWithRoles) DeleteAllApps(ctx context.Context) error {
 
 // CreateKubernetesCluster creates a new kubernetes cluster resource.
 func (a *ServerWithRoles) CreateKubernetesCluster(ctx context.Context, cluster types.KubeCluster) error {
-	if err := a.action(types.KindKubernetesCluster, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users create clusters they wouldn't have access to (e.g.
@@ -6184,7 +6794,7 @@ func (a *ServerWithRoles) CreateKubernetesCluster(ctx context.Context, cluster t
 
 // UpdateKubernetesCluster updates existing kubernetes cluster resource.
 func (a *ServerWithRoles) UpdateKubernetesCluster(ctx context.Context, cluster types.KubeCluster) error {
-	if err := a.action(types.KindKubernetesCluster, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users update clusters they don't have access to (e.g.
@@ -6208,7 +6818,7 @@ func (a *ServerWithRoles) UpdateKubernetesCluster(ctx context.Context, cluster t
 
 // GetKubernetesCluster returns specified kubernetes cluster resource.
 func (a *ServerWithRoles) GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error) {
-	if err := a.action(types.KindKubernetesCluster, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	kubeCluster, err := a.authServer.GetKubernetesCluster(ctx, name)
@@ -6223,25 +6833,75 @@ func (a *ServerWithRoles) GetKubernetesCluster(ctx context.Context, name string)
 
 // GetKubernetesClusters returns all kubernetes cluster resources.
 func (a *ServerWithRoles) GetKubernetesClusters(ctx context.Context) (result []types.KubeCluster, err error) {
-	if err := a.action(types.KindKubernetesCluster, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	// Filter out kube clusters user doesn't have access to.
-	clusters, err := a.authServer.GetKubernetesClusters(ctx)
+	out, err := iterstream.Collect(
+		iterstream.FilterMap(
+			a.authServer.RangeKubernetesClusters(ctx, "", ""),
+			func(cluster types.KubeCluster) (types.KubeCluster, bool) {
+				// Filter out kube clusters user doesn't have access to.
+				if a.checkAccessToKubeCluster(cluster) == nil {
+					return cluster, true
+				}
+				return nil, false
+			},
+		),
+	)
+
 	if err != nil {
 		return nil, trace.Wrap(err)
+
 	}
-	for _, cluster := range clusters {
-		if err := a.checkAccessToKubeCluster(cluster); err == nil {
-			result = append(result, cluster)
-		}
+
+	return out, nil
+}
+
+// ListKubernetesClusters returns a page of registered kubernetes clusters.
+func (a *ServerWithRoles) ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error) {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
 	}
-	return result, nil
+
+	if limit <= 0 || limit > apidefaults.DefaultChunkSize {
+		limit = apidefaults.DefaultChunkSize
+	}
+
+	var next string
+	var seen int
+	out, err := iterstream.Collect(
+		iterstream.TakeWhile(
+			iterstream.FilterMap(
+				a.authServer.RangeKubernetesClusters(ctx, start, ""),
+				func(cluster types.KubeCluster) (types.KubeCluster, bool) {
+					// Filter out kube clusters user doesn't have access to.
+					if a.checkAccessToKubeCluster(cluster) == nil {
+						return cluster, true
+					}
+					return nil, false
+				},
+			),
+			func(cluster types.KubeCluster) bool {
+				if seen < limit {
+					seen++
+					return true
+				}
+				next = cluster.GetName()
+				return false
+			},
+		),
+	)
+
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return out, next, nil
 }
 
 // DeleteKubernetesCluster removes the specified kubernetes cluster resource.
 func (a *ServerWithRoles) DeleteKubernetesCluster(ctx context.Context, name string) error {
-	if err := a.action(types.KindKubernetesCluster, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure user has access to the kubernetes cluster before deleting.
@@ -6257,7 +6917,7 @@ func (a *ServerWithRoles) DeleteKubernetesCluster(ctx context.Context, name stri
 
 // DeleteAllKubernetesClusters removes all kubernetes cluster resources.
 func (a *ServerWithRoles) DeleteAllKubernetesClusters(ctx context.Context) error {
-	if err := a.action(types.KindKubernetesCluster, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindKubernetesCluster, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure to only delete kubernetes cluster user has access to.
@@ -6305,7 +6965,7 @@ func (a *ServerWithRoles) checkAccessToDatabase(database types.Database) error {
 
 // CreateDatabase creates a new database resource.
 func (a *ServerWithRoles) CreateDatabase(ctx context.Context, database types.Database) error {
-	if err := a.action(types.KindDatabase, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users create databases they wouldn't have access to (e.g.
@@ -6322,7 +6982,7 @@ func (a *ServerWithRoles) CreateDatabase(ctx context.Context, database types.Dat
 
 // UpdateDatabase updates existing database resource.
 func (a *ServerWithRoles) UpdateDatabase(ctx context.Context, database types.Database) error {
-	if err := a.action(types.KindDatabase, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 	// Don't allow users update databases they don't have access to (e.g.
@@ -6346,7 +7006,7 @@ func (a *ServerWithRoles) UpdateDatabase(ctx context.Context, database types.Dat
 
 // GetDatabase returns specified database resource.
 func (a *ServerWithRoles) GetDatabase(ctx context.Context, name string) (types.Database, error) {
-	if err := a.action(types.KindDatabase, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	database, err := a.authServer.GetDatabase(ctx, name)
@@ -6361,7 +7021,7 @@ func (a *ServerWithRoles) GetDatabase(ctx context.Context, name string) (types.D
 
 // GetDatabases returns all database resources.
 func (a *ServerWithRoles) GetDatabases(ctx context.Context) (result []types.Database, err error) {
-	if err := a.action(types.KindDatabase, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	// Filter out databases user doesn't have access to.
@@ -6377,9 +7037,30 @@ func (a *ServerWithRoles) GetDatabases(ctx context.Context) (result []types.Data
 	return result, nil
 }
 
+// ListDatabases returns a page of database resources.
+func (a *ServerWithRoles) ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error) {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbList, types.VerbRead); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return generic.CollectPageAndCursor(
+		iterstream.FilterMap(
+			a.authServer.RangeDatabases(ctx, startKey, ""),
+			func(db types.Database) (types.Database, bool) {
+				if a.checkAccessToDatabase(db) == nil {
+					return db, true
+				}
+				return nil, false
+			},
+		),
+		limit,
+		types.Database.GetName,
+	)
+}
+
 // DeleteDatabase removes the specified database resource.
 func (a *ServerWithRoles) DeleteDatabase(ctx context.Context, name string) error {
-	if err := a.action(types.KindDatabase, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure user has access to the database before deleting.
@@ -6395,7 +7076,7 @@ func (a *ServerWithRoles) DeleteDatabase(ctx context.Context, name string) error
 
 // DeleteAllDatabases removes all database resources.
 func (a *ServerWithRoles) DeleteAllDatabases(ctx context.Context) error {
-	if err := a.action(types.KindDatabase, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindDatabase, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Make sure to only delete databases user has access to.
@@ -6415,7 +7096,7 @@ func (a *ServerWithRoles) DeleteAllDatabases(ctx context.Context) error {
 
 // GetWindowsDesktopServices returns all registered windows desktop services.
 func (a *ServerWithRoles) GetWindowsDesktopServices(ctx context.Context) ([]types.WindowsDesktopService, error) {
-	if err := a.action(types.KindWindowsDesktopService, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	services, err := a.authServer.GetWindowsDesktopServices(ctx)
@@ -6427,7 +7108,7 @@ func (a *ServerWithRoles) GetWindowsDesktopServices(ctx context.Context) ([]type
 
 // GetWindowsDesktopService returns a registered windows desktop service by name.
 func (a *ServerWithRoles) GetWindowsDesktopService(ctx context.Context, name string) (types.WindowsDesktopService, error) {
-	if err := a.action(types.KindWindowsDesktopService, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	service, err := a.authServer.GetWindowsDesktopService(ctx, name)
@@ -6439,7 +7120,7 @@ func (a *ServerWithRoles) GetWindowsDesktopService(ctx context.Context, name str
 
 // UpsertWindowsDesktopService creates or updates a new windows desktop service.
 func (a *ServerWithRoles) UpsertWindowsDesktopService(ctx context.Context, s types.WindowsDesktopService) (*types.KeepAlive, error) {
-	if err := a.action(types.KindWindowsDesktopService, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return a.authServer.UpsertWindowsDesktopService(ctx, s)
@@ -6447,7 +7128,7 @@ func (a *ServerWithRoles) UpsertWindowsDesktopService(ctx context.Context, s typ
 
 // DeleteWindowsDesktopService removes the specified windows desktop service.
 func (a *ServerWithRoles) DeleteWindowsDesktopService(ctx context.Context, name string) error {
-	if err := a.action(types.KindWindowsDesktopService, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteWindowsDesktopService(ctx, name)
@@ -6455,7 +7136,7 @@ func (a *ServerWithRoles) DeleteWindowsDesktopService(ctx context.Context, name
 
 // DeleteAllWindowsDesktopServices removes all registered windows desktop services.
 func (a *ServerWithRoles) DeleteAllWindowsDesktopServices(ctx context.Context) error {
-	if err := a.action(types.KindWindowsDesktopService, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktopService, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAllWindowsDesktopServices(ctx)
@@ -6463,7 +7144,7 @@ func (a *ServerWithRoles) DeleteAllWindowsDesktopServices(ctx context.Context) e
 
 // GetWindowsDesktops returns all registered windows desktop hosts.
 func (a *ServerWithRoles) GetWindowsDesktops(ctx context.Context, filter types.WindowsDesktopFilter) ([]types.WindowsDesktop, error) {
-	if err := a.action(types.KindWindowsDesktop, types.VerbList, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbList, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	hosts, err := a.authServer.GetWindowsDesktops(ctx, filter)
@@ -6477,9 +7158,43 @@ func (a *ServerWithRoles) GetWindowsDesktops(ctx context.Context, filter types.W
 	return filtered, nil
 }
 
+// ListWindowsDesktops returns a page of registered Windows desktop hosts.
+func (a *ServerWithRoles) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbList, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var resp types.ListWindowsDesktopsResponse
+	desktopStream := stream.FilterMap(a.authServer.streamWindowsDesktops(ctx, req), func(d types.WindowsDesktop) (types.WindowsDesktop, bool) {
+		if a.hasBuiltinRole(types.RoleAdmin, types.RoleProxy, types.RoleWindowsDesktop) {
+			return d, true
+		}
+
+		if err := a.checkAccessToWindowsDesktop(d); err == nil {
+			return d, true
+		}
+
+		return nil, false
+	})
+
+	limit := cmp.Or(req.Limit, apidefaults.DefaultChunkSize)
+	for desktopStream.Next() {
+		desktop := desktopStream.Item()
+		if len(resp.Desktops) == limit {
+			resp.NextKey = desktop.GetHostID() + "/" + desktop.GetName()
+			desktopStream.Done()
+			break
+		}
+
+		resp.Desktops = append(resp.Desktops, desktop)
+	}
+
+	return &resp, nil
+}
+
 // CreateWindowsDesktop creates a new windows desktop host.
 func (a *ServerWithRoles) CreateWindowsDesktop(ctx context.Context, s types.WindowsDesktop) error {
-	if err := a.action(types.KindWindowsDesktop, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.CreateWindowsDesktop(ctx, s)
@@ -6487,7 +7202,7 @@ func (a *ServerWithRoles) CreateWindowsDesktop(ctx context.Context, s types.Wind
 
 // UpdateWindowsDesktop updates an existing windows desktop host.
 func (a *ServerWithRoles) UpdateWindowsDesktop(ctx context.Context, s types.WindowsDesktop) error {
-	if err := a.action(types.KindWindowsDesktop, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6513,7 +7228,7 @@ func (a *ServerWithRoles) UpdateWindowsDesktop(ctx context.Context, s types.Wind
 // UpsertWindowsDesktop updates a windows desktop resource, creating it if it doesn't exist.
 func (a *ServerWithRoles) UpsertWindowsDesktop(ctx context.Context, s types.WindowsDesktop) error {
 	// Ensure caller has both Create and Update permissions.
-	if err := a.action(types.KindWindowsDesktop, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6545,7 +7260,7 @@ func (a *ServerWithRoles) UpsertWindowsDesktop(ctx context.Context, s types.Wind
 // Passing an empty host ID will not trigger "delete all" behavior. To delete
 // all desktops, use DeleteAllWindowsDesktops.
 func (a *ServerWithRoles) DeleteWindowsDesktop(ctx context.Context, hostID, name string) error {
-	if err := a.action(types.KindWindowsDesktop, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	desktop, err := a.authServer.GetWindowsDesktops(ctx,
@@ -6565,7 +7280,7 @@ func (a *ServerWithRoles) DeleteWindowsDesktop(ctx context.Context, hostID, name
 
 // DeleteAllWindowsDesktops removes all registered windows desktop hosts.
 func (a *ServerWithRoles) DeleteAllWindowsDesktops(ctx context.Context) error {
-	if err := a.action(types.KindWindowsDesktop, types.VerbList, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindWindowsDesktop, types.VerbList, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	// Only delete the desktops the user has access to.
@@ -6626,7 +7341,7 @@ func (a *ServerWithRoles) GetDesktopBootstrapScript(ctx context.Context) (*proto
 
 // GetConnectionDiagnostic returns the connection diagnostic with the matching name
 func (a *ServerWithRoles) GetConnectionDiagnostic(ctx context.Context, name string) (types.ConnectionDiagnostic, error) {
-	if err := a.action(types.KindConnectionDiagnostic, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindConnectionDiagnostic, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -6640,7 +7355,7 @@ func (a *ServerWithRoles) GetConnectionDiagnostic(ctx context.Context, name stri
 
 // CreateConnectionDiagnostic creates a new connection diagnostic.
 func (a *ServerWithRoles) CreateConnectionDiagnostic(ctx context.Context, connectionDiagnostic types.ConnectionDiagnostic) error {
-	if err := a.action(types.KindConnectionDiagnostic, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindConnectionDiagnostic, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6653,7 +7368,7 @@ func (a *ServerWithRoles) CreateConnectionDiagnostic(ctx context.Context, connec
 
 // UpdateConnectionDiagnostic updates a connection diagnostic.
 func (a *ServerWithRoles) UpdateConnectionDiagnostic(ctx context.Context, connectionDiagnostic types.ConnectionDiagnostic) error {
-	if err := a.action(types.KindConnectionDiagnostic, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindConnectionDiagnostic, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6666,7 +7381,7 @@ func (a *ServerWithRoles) UpdateConnectionDiagnostic(ctx context.Context, connec
 
 // AppendDiagnosticTrace adds a new trace for the given ConnectionDiagnostic.
 func (a *ServerWithRoles) AppendDiagnosticTrace(ctx context.Context, name string, t *types.ConnectionDiagnosticTrace) (types.ConnectionDiagnostic, error) {
-	if err := a.action(types.KindConnectionDiagnostic, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindConnectionDiagnostic, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -6826,7 +7541,7 @@ func (a *ServerWithRoles) GetAccountRecoveryCodes(ctx context.Context, req *prot
 //     certificate authorities.
 func (a *ServerWithRoles) GenerateCertAuthorityCRL(ctx context.Context, caType types.CertAuthType) ([]byte, error) {
 	// Assume this is a user request, check if the user has permission to read CAs.
-	err := a.action(types.KindCertAuthority, types.VerbReadNoSecrets)
+	err := a.authorizeAction(types.KindCertAuthority, types.VerbReadNoSecrets)
 	if err != nil {
 		// An error means the user doesn't have permission to read CAs, or this
 		// is an admin on the auth server or the windows desktop service. We
@@ -6852,7 +7567,7 @@ func (a *ServerWithRoles) GenerateCertAuthorityCRL(ctx context.Context, caType t
 
 // SubmitUsageEvent submits an external usage event.
 func (a *ServerWithRoles) SubmitUsageEvent(ctx context.Context, req *proto.SubmitUsageEventRequest) error {
-	if err := a.action(types.KindUsageEvent, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindUsageEvent, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6865,7 +7580,7 @@ func (a *ServerWithRoles) SubmitUsageEvent(ctx context.Context, req *proto.Submi
 
 // GetLicense returns the license used to start the auth server
 func (a *ServerWithRoles) GetLicense(ctx context.Context) (string, error) {
-	if err := a.action(types.KindLicense, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindLicense, types.VerbRead); err != nil {
 		return "", trace.Wrap(err)
 	}
 	return a.authServer.GetLicense(ctx)
@@ -6875,7 +7590,7 @@ func (a *ServerWithRoles) GetLicense(ctx context.Context) (string, error) {
 func (a *ServerWithRoles) ListReleases(ctx context.Context) ([]*types.Release, error) {
 	// on Cloud, any user is allowed to list releases
 	if !modules.GetModules().Features().Cloud {
-		if err := a.action(types.KindDownload, types.VerbList); err != nil {
+		if err := a.authorizeAction(types.KindDownload, types.VerbList); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -6897,9 +7612,31 @@ func (a *ServerWithRoles) checkAccessToSAMLIdPServiceProvider(ctx context.Contex
 		services.AccessState{MFAVerified: true})
 }
 
+// samlAppLabelFriendlyMsg returns a user friendly RBAC message to be displayed
+// in the Web UI or tctl when creating or updating a service provider resource.
+// It is only processed for errors that may have occurred due to missing
+// app_labels in role version 8.
+func samlAppLabelFriendlyMsg(err error, action string, emptyLabel bool) string {
+	if err == nil {
+		return ""
+	}
+	if !strings.Contains(err.Error(), "app_labels") {
+		return ""
+	}
+
+	const docs = "https://goteleport.com/docs/identity-governance/idps/saml-idp-rbac"
+	// TODO(sshah): adjust error message once we land Teleport role version 9.
+	if emptyLabel {
+		return fmt.Sprintf(`%s this resource with an empty label requires a version 8 role permitting wildcard "app_labels". `+
+			`Consider applying labels for granular access: %s `, action, docs)
+	}
+	return fmt.Sprintf(`You need a version 8 role with "app_labels" permitting label(s) configured for this resource. `+
+		`Check the SAML IdP RBAC guide for more details: %s`, docs)
+}
+
 // ListSAMLIdPServiceProviders returns a paginated list of SAML IdP service provider resources.
 func (a *ServerWithRoles) ListSAMLIdPServiceProviders(ctx context.Context, pageSize int, nextToken string) ([]types.SAMLIdPServiceProvider, string, error) {
-	if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbList); err != nil {
 		return nil, "", trace.Wrap(err)
 	}
 
@@ -6924,7 +7661,7 @@ func (a *ServerWithRoles) ListSAMLIdPServiceProviders(ctx context.Context, pageS
 
 // GetSAMLIdPServiceProvider returns the specified SAML IdP service provider resources.
 func (a *ServerWithRoles) GetSAMLIdPServiceProvider(ctx context.Context, name string) (types.SAMLIdPServiceProvider, error) {
-	if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -6966,7 +7703,7 @@ func (a *ServerWithRoles) CreateSAMLIdPServiceProvider(ctx context.Context, sp t
 		}
 	}()
 
-	if err = a.action(types.KindSAMLIdPServiceProvider, types.VerbCreate); err != nil {
+	if err = a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -6976,7 +7713,7 @@ func (a *ServerWithRoles) CreateSAMLIdPServiceProvider(ctx context.Context, sp t
 	}
 
 	if err = a.checkAccessToSAMLIdPServiceProvider(ctx, sp); err != nil {
-		return trace.Wrap(err)
+		return trace.WrapWithMessage(err, samlAppLabelFriendlyMsg(err, "Creating", len(sp.GetAllLabels()) == 0))
 	}
 
 	if err := services.ValidateSAMLIdPACSURLAndRelayStateInputs(sp); err != nil {
@@ -7019,7 +7756,7 @@ func (a *ServerWithRoles) UpdateSAMLIdPServiceProvider(ctx context.Context, sp t
 		}
 	}()
 
-	if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7033,10 +7770,10 @@ func (a *ServerWithRoles) UpdateSAMLIdPServiceProvider(ctx context.Context, sp t
 		return trace.Wrap(err)
 	}
 	if err = a.checkAccessToSAMLIdPServiceProvider(ctx, existingSP); err != nil {
-		return trace.Wrap(err)
+		return trace.WrapWithMessage(err, samlAppLabelFriendlyMsg(err, "Updating", len(sp.GetAllLabels()) == 0))
 	}
 	if err = a.checkAccessToSAMLIdPServiceProvider(ctx, sp); err != nil {
-		return trace.Wrap(err)
+		return trace.WrapWithMessage(err, samlAppLabelFriendlyMsg(err, "Updating", len(sp.GetAllLabels()) == 0))
 	}
 
 	if err := services.ValidateSAMLIdPACSURLAndRelayStateInputs(sp); err != nil {
@@ -7085,7 +7822,7 @@ func (a *ServerWithRoles) DeleteSAMLIdPServiceProvider(ctx context.Context, name
 		}
 	}()
 
-	if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7133,7 +7870,7 @@ func (a *ServerWithRoles) DeleteAllSAMLIdPServiceProviders(ctx context.Context)
 		}
 	}()
 
-	if err := a.action(types.KindSAMLIdPServiceProvider, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindSAMLIdPServiceProvider, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7171,7 +7908,7 @@ func (a *ServerWithRoles) checkAccessToUserGroup(userGroup types.UserGroup) erro
 
 // ListUserGroups returns a paginated list of user group resources.
 func (a *ServerWithRoles) ListUserGroups(ctx context.Context, pageSize int, nextToken string) ([]types.UserGroup, string, error) {
-	if err := a.action(types.KindUserGroup, types.VerbList); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbList); err != nil {
 		return nil, "", trace.Wrap(err)
 	}
 
@@ -7217,7 +7954,7 @@ func (a *ServerWithRoles) ListUserGroups(ctx context.Context, pageSize int, next
 
 // GetUserGroup returns the specified user group resources.
 func (a *ServerWithRoles) GetUserGroup(ctx context.Context, name string) (types.UserGroup, error) {
-	if err := a.action(types.KindUserGroup, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -7235,7 +7972,7 @@ func (a *ServerWithRoles) GetUserGroup(ctx context.Context, name string) (types.
 
 // CreateUserGroup creates a new user group resource.
 func (a *ServerWithRoles) CreateUserGroup(ctx context.Context, userGroup types.UserGroup) error {
-	if err := a.action(types.KindUserGroup, types.VerbCreate); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbCreate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7252,7 +7989,7 @@ func (a *ServerWithRoles) CreateUserGroup(ctx context.Context, userGroup types.U
 
 // UpdateUserGroup updates an existing user group resource.
 func (a *ServerWithRoles) UpdateUserGroup(ctx context.Context, userGroup types.UserGroup) error {
-	if err := a.action(types.KindUserGroup, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7274,7 +8011,7 @@ func (a *ServerWithRoles) UpdateUserGroup(ctx context.Context, userGroup types.U
 
 // DeleteUserGroup removes the specified user group resource.
 func (a *ServerWithRoles) DeleteUserGroup(ctx context.Context, name string) error {
-	if err := a.action(types.KindUserGroup, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7296,7 +8033,7 @@ func (a *ServerWithRoles) DeleteUserGroup(ctx context.Context, name string) erro
 
 // DeleteAllUserGroups removes all user groups.
 func (a *ServerWithRoles) DeleteAllUserGroups(ctx context.Context) error {
-	if err := a.action(types.KindUserGroup, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindUserGroup, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7480,7 +8217,7 @@ func (a *ServerWithRoles) ExportUpgradeWindows(ctx context.Context, req proto.Ex
 
 // GetClusterMaintenanceConfig gets the current maintenance config singleton.
 func (a *ServerWithRoles) GetClusterMaintenanceConfig(ctx context.Context) (types.ClusterMaintenanceConfig, error) {
-	if err := a.action(types.KindClusterMaintenanceConfig, types.VerbRead); err != nil {
+	if err := a.authorizeAction(types.KindClusterMaintenanceConfig, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -7489,7 +8226,7 @@ func (a *ServerWithRoles) GetClusterMaintenanceConfig(ctx context.Context) (type
 
 // UpdateClusterMaintenanceConfig updates the current maintenance config singleton.
 func (a *ServerWithRoles) UpdateClusterMaintenanceConfig(ctx context.Context, cmc types.ClusterMaintenanceConfig) error {
-	if err := a.action(types.KindClusterMaintenanceConfig, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := a.authorizeAction(types.KindClusterMaintenanceConfig, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -7503,7 +8240,7 @@ func (a *ServerWithRoles) UpdateClusterMaintenanceConfig(ctx context.Context, cm
 }
 
 func (a *ServerWithRoles) DeleteClusterMaintenanceConfig(ctx context.Context) error {
-	if err := a.action(types.KindClusterMaintenanceConfig, types.VerbDelete); err != nil {
+	if err := a.authorizeAction(types.KindClusterMaintenanceConfig, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	if modules.GetModules().Features().Cloud {
@@ -7586,16 +8323,6 @@ func emitSSOLoginFailureEvent(ctx context.Context, emitter apievents.Emitter, me
 	}
 }
 
-// verbsToReplaceResourceWithOrigin determines the verbs/actions required of a role
-// to replace the resource currently stored in the backend.
-func verbsToReplaceResourceWithOrigin(stored types.ResourceWithOrigin) []string {
-	verbs := []string{types.VerbUpdate}
-	if stored.Origin() == types.OriginConfigFile {
-		verbs = append(verbs, types.VerbCreate)
-	}
-	return verbs
-}
-
 // checkOktaLockTarget prevents the okta service from locking users that are not
 // controlled by the Okta service.
 func checkOktaLockTarget(ctx context.Context, authzCtx *authz.Context, users services.UserGetter, lock types.Lock) error {
diff --git a/lib/auth/auth_with_roles_okta_rbac_test.go b/lib/auth/auth_with_roles_okta_rbac_test.go
index 5335fb1dfb844..8bc4d3588971c 100644
--- a/lib/auth/auth_with_roles_okta_rbac_test.go
+++ b/lib/auth/auth_with_roles_okta_rbac_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -29,7 +29,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 )
 
@@ -51,17 +53,17 @@ func newOktaUser(t *testing.T) types.User {
 
 // newTestServerWithRoles creates a self-cleaning `ServerWithRoles`, configured
 // with a given
-func newTestServerWithRoles(t *testing.T, srv *TestAuthServer, role types.SystemRole) *ServerWithRoles {
+func newTestServerWithRoles(t *testing.T, srv *authtest.AuthServer, role types.SystemRole) *auth.ServerWithRoles {
 
-	authzContext := authz.ContextWithUser(context.Background(), TestBuiltin(role).I)
+	authzContext := authz.ContextWithUser(context.Background(), authtest.TestBuiltin(role).I)
 	ctxIdentity, err := srv.Authorizer.Authorize(authzContext)
 	require.NoError(t, err)
 
-	authWithRole := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		alog:       srv.AuditLog,
-		context:    *ctxIdentity,
-	}
+	authWithRole := auth.NewServerWithRoles(
+		srv.AuthServer,
+		srv.AuditLog,
+		*ctxIdentity,
+	)
 
 	t.Cleanup(func() { authWithRole.Close() })
 
@@ -72,7 +74,7 @@ func TestOktaMayNotResetPasswords(t *testing.T) {
 	ctx := context.Background()
 
 	// Given an auth server...
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
 	t.Cleanup(func() { srv.Close() })
 
@@ -135,7 +137,7 @@ func TestOktaServiceLockCRUD(t *testing.T) {
 	ctx := context.Background()
 
 	// Given an auth server...
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
 	t.Cleanup(func() { srv.Close() })
 
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index 4d3ddebfaf790..355df3ad80b86 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -42,6 +42,7 @@ import (
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/gravitational/teleport"
@@ -52,6 +53,7 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
 	"github.com/gravitational/teleport/api/metadata"
@@ -65,7 +67,9 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/okta"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
@@ -73,14 +77,18 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/okta/oktatest"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 func TestGenerateUserCerts_MFAVerifiedFieldSet(t *testing.T) {
@@ -89,7 +97,7 @@ func TestGenerateUserCerts_MFAVerifiedFieldSet(t *testing.T) {
 
 	u, err := createUserWithSecondFactors(srv)
 	require.NoError(t, err)
-	client, err := srv.NewClient(TestUser(u.username))
+	client, err := srv.NewClient(authtest.TestUser(u.username))
 	require.NoError(t, err)
 
 	// GenerateUserCerts requires MFA.
@@ -182,7 +190,7 @@ func TestLocalUserCanReissueCerts(t *testing.T) {
 
 	start := srv.AuthServer.Clock().Now()
 
-	botSessionTTLOverride := WithRoleMutator(func(role types.Role) {
+	botSessionTTLOverride := authtest.WithRoleMutator(func(role types.Role) {
 		// Bots have a longer max TTL than the default MaxSessionTTL value
 		// (30h), so the longer value must be manually set to actually get certs
 		// of the longer duration. The bot service manages this value when it
@@ -257,7 +265,7 @@ func TestLocalUserCanReissueCerts(t *testing.T) {
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			ctx := context.Background()
-			user, role, err := CreateUserAndRole(srv.Auth(), test.desc, []string{"role"}, nil, botSessionTTLOverride)
+			user, role, err := authtest.CreateUserAndRole(srv.Auth(), test.desc, []string{"role"}, nil, botSessionTTLOverride)
 
 			require.NoError(t, err)
 			authPref, err := srv.Auth().GetAuthPreference(ctx)
@@ -266,9 +274,9 @@ func TestLocalUserCanReissueCerts(t *testing.T) {
 			_, err = srv.Auth().UpsertAuthPreference(ctx, authPref)
 			require.NoError(t, err)
 
-			var id TestIdentity
+			var id authtest.TestIdentity
 			if test.renewable {
-				id = TestRenewableUser(user.GetName(), 0)
+				id = authtest.TestRenewableUser(user.GetName(), 0)
 
 				meta := user.GetMetadata()
 				meta.Labels = map[string]string{
@@ -278,14 +286,14 @@ func TestLocalUserCanReissueCerts(t *testing.T) {
 				user, err = srv.Auth().UpsertUser(ctx, user)
 				require.NoError(t, err)
 			} else {
-				id = TestUser(user.GetName())
+				id = authtest.TestUser(user.GetName())
 			}
 
 			// Simulate authenticated GitHub OAuth flow where GitHub identity is
 			// saved in login state.
 			if test.githubIdentity != nil {
 				user.SetGithubIdentities([]types.ExternalIdentity{*test.githubIdentity})
-				_, err := srv.Auth().ulsGenerator.Refresh(ctx, user, srv.Auth().UserLoginStates)
+				_, err := srv.Auth().RefreshULS(ctx, user, srv.Auth().UserLoginStates)
 				require.NoError(t, err)
 			}
 
@@ -340,7 +348,7 @@ func TestSSOUserCanReissueCert(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	// Create test SSO user.
-	user, _, err := CreateUserAndRole(srv.Auth(), "sso-user", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "sso-user", []string{"role"}, nil)
 	require.NoError(t, err)
 	user.SetCreatedBy(types.CreatedBy{
 		Connector: &types.ConnectorRef{Type: "oidc", ID: "google"},
@@ -348,7 +356,7 @@ func TestSSOUserCanReissueCert(t *testing.T) {
 	user, err = srv.Auth().UpdateUser(ctx, user)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
@@ -365,10 +373,10 @@ func TestInstaller(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	_, err := CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	_, err = CreateRole(ctx, srv.Auth(), "test-read", types.RoleSpecV6{
+	_, err = authtest.CreateRole(ctx, srv.Auth(), "test-read", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -379,7 +387,7 @@ func TestInstaller(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	_, err = CreateRole(ctx, srv.Auth(), "test-update", types.RoleSpecV6{
+	_, err = authtest.CreateRole(ctx, srv.Auth(), "test-update", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -390,7 +398,7 @@ func TestInstaller(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	_, err = CreateRole(ctx, srv.Auth(), "test-delete", types.RoleSpecV6{
+	_, err = authtest.CreateRole(ctx, srv.Auth(), "test-delete", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -401,7 +409,7 @@ func TestInstaller(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	user, err := CreateUser(ctx, srv.Auth(), "testuser")
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "testuser")
 	require.NoError(t, err)
 
 	inst, err := types.NewInstallerV1(installers.InstallerScriptName, "contents")
@@ -447,7 +455,7 @@ func TestInstaller(t *testing.T) {
 		user, err = srv.Auth().UpsertUser(ctx, user)
 		require.NoError(t, err)
 
-		client, err := srv.NewClient(TestUser(user.GetName()))
+		client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 		require.NoError(t, err)
 		tc.assert(t, tc.installerAction(client))
 	}
@@ -457,10 +465,10 @@ func TestGithubAuthRequest(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	emptyRole, err := CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
+	emptyRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	access1Role, err := CreateRole(ctx, srv.Auth(), "test-access-1", types.RoleSpecV6{
+	access1Role, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-1", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -472,7 +480,7 @@ func TestGithubAuthRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	access2Role, err := CreateRole(ctx, srv.Auth(), "test-access-2", types.RoleSpecV6{
+	access2Role, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-2", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -484,7 +492,7 @@ func TestGithubAuthRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	access3Role, err := CreateRole(ctx, srv.Auth(), "test-access-3", types.RoleSpecV6{
+	access3Role, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-3", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -496,7 +504,7 @@ func TestGithubAuthRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	readerRole, err := CreateRole(ctx, srv.Auth(), "test-access-4", types.RoleSpecV6{
+	readerRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-4", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -523,7 +531,7 @@ func TestGithubAuthRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	upserted, err := srv.Auth().UpsertGithubConnector(context.Background(), conn)
+	upserted, err := auth.UpsertGithubConnector(context.Background(), srv.Auth(), conn)
 	require.NoError(t, err)
 	require.NotNil(t, upserted)
 
@@ -592,13 +600,13 @@ func TestGithubAuthRequest(t *testing.T) {
 		},
 	}
 
-	user, err := CreateUser(ctx, srv.Auth(), "dummy")
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "dummy")
 	require.NoError(t, err)
 
-	userReader, err := CreateUser(ctx, srv.Auth(), "dummy-reader", readerRole)
+	userReader, err := authtest.CreateUser(ctx, srv.Auth(), "dummy-reader", readerRole)
 	require.NoError(t, err)
 
-	clientReader, err := srv.NewClient(TestUser(userReader.GetName()))
+	clientReader, err := srv.NewClient(authtest.TestUser(userReader.GetName()))
 	require.NoError(t, err)
 
 	for _, tt := range tests {
@@ -607,7 +615,7 @@ func TestGithubAuthRequest(t *testing.T) {
 			user, err = srv.Auth().UpsertUser(ctx, user)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			request, err := client.CreateGithubAuthRequest(ctx, tt.request)
@@ -653,23 +661,23 @@ func TestGithubAuthCompat(t *testing.T) {
 		}},
 	})
 	require.NoError(t, err)
-	_, err = srv.Auth().UpsertGithubConnector(context.Background(), connector)
+	_, err = auth.UpsertGithubConnector(context.Background(), srv.Auth(), connector)
 	require.NoError(t, err)
 
-	srv.Auth().GithubUserAndTeamsOverride = func() (*GithubUserResponse, []GithubTeamResponse, error) {
-		return &GithubUserResponse{
+	srv.Auth().GithubUserAndTeamsOverride = func() (*auth.GithubUserResponse, []auth.GithubTeamResponse, error) {
+		return &auth.GithubUserResponse{
 				Login: "alice",
-			}, []GithubTeamResponse{{
+			}, []auth.GithubTeamResponse{{
 				Name: "devs",
 				Slug: "devs",
-				Org:  GithubOrgResponse{Login: "octocats"},
+				Org:  auth.GithubOrgResponse{Login: "octocats"},
 			}}, nil
 	}
 
-	_, err = CreateRole(ctx, srv.Auth(), "access", types.RoleSpecV6{})
+	_, err = authtest.CreateRole(ctx, srv.Auth(), "access", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	proxyClient, err := srv.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := srv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	sshKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
@@ -759,16 +767,210 @@ func TestGithubAuthCompat(t *testing.T) {
 	}
 }
 
+func TestAWSRolesAnywhereCredentialGenerationForApps(t *testing.T) {
+	ctx := t.Context()
+	srv := newTestTLSServer(t)
+
+	// Set up a new Integration for AWS Roles Anywhere.
+	awsRAIntegration := "awsra-integration"
+	ig, err := types.NewIntegrationAWSRA(types.Metadata{Name: awsRAIntegration}, &types.AWSRAIntegrationSpecV1{
+		TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/ExampleTrustAnchor",
+		ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+			Enabled:                       true,
+			ProfileARN:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+			ProfileAcceptsRoleSessionName: true,
+			RoleARN:                       "arn:aws:iam::123456789012:role/SyncRole",
+		},
+	})
+	require.NoError(t, err)
+	_, err = srv.Auth().Integrations.CreateIntegration(ctx, ig)
+	require.NoError(t, err)
+
+	// Set up a new AWS App created from a Roles Anywhere Profile.
+	appName := "my-aws-access"
+	app, err := types.NewAppServerV3(
+		types.Metadata{Name: appName},
+		types.AppServerSpecV3{
+			HostID: uuid.NewString(),
+			App: &types.AppV3{
+				Metadata: types.Metadata{Name: appName},
+				Spec: types.AppSpecV3{
+					URI:         constants.AWSConsoleURL,
+					Integration: awsRAIntegration,
+					PublicAddr:  "my-app.example.com",
+					AWS: &types.AppAWS{
+						RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
+							ProfileARN:            "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1",
+							AcceptRoleSessionName: true,
+						},
+					},
+				},
+			},
+		},
+	)
+	require.NoError(t, err)
+	_, err = srv.Auth().UpsertApplicationServer(ctx, app)
+	require.NoError(t, err)
+
+	// Mock the credential generation function to return fixed credentials.
+	// This is required because the generator calls AWS endpoints to convert a teleport created certificate into valid AWS credentials.
+	srv.Auth().AWSRolesAnywhereCreateSessionOverride = func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+		return &createsession.CreateSessionResponse{
+			Version:         1,
+			AccessKeyID:     "aki",
+			SecretAccessKey: "sak",
+			SessionToken:    "st",
+			Expiration:      "2025-06-25T12:07:02.474135Z",
+		}, nil
+	}
+
+	// Set up a user with the necessary roles to access the AWS App.
+	username := "aws-access-user"
+	roleARN := "arn:aws:iam::123456789012:role/MyRole"
+	awsAccessRole, err := authtest.CreateRole(ctx, srv.Auth(), "aws-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: types.Labels{
+				types.Wildcard: []string{types.Wildcard},
+			},
+			AWSRoleARNs: []string{roleARN},
+		},
+	})
+	require.NoError(t, err)
+
+	user, err := authtest.CreateUser(ctx, srv.Auth(), username, awsAccessRole)
+	require.NoError(t, err)
+
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
+	require.NoError(t, err)
+
+	// Create credentials for the AWS App
+	priv, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	pub, err := keys.MarshalPublicKey(priv.Public())
+	require.NoError(t, err)
+
+	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
+		TLSPublicKey: pub,
+		Username:     user.GetName(),
+		Expires:      time.Now().Add(time.Hour),
+		RouteToApp: proto.RouteToApp{
+			Name:       app.GetApp().GetName(),
+			AWSRoleARN: roleARN,
+		},
+	})
+	require.NoError(t, err)
+
+	// Parse the Identity and check the AWS Role ARN and credentials.
+	tlsCert, err := tlsca.ParseCertificatePEM(certs.TLS)
+	require.NoError(t, err)
+	identity, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
+	require.NoError(t, err)
+
+	require.Equal(t, roleARN, identity.AWSRoleARNs[0], "Expected AWS Role ARN to match the one requested")
+	require.JSONEq(t, `{"Version":1,"AccessKeyId":"aki","SecretAccessKey":"sak","SessionToken":"st","Expiration":"2025-06-25T12:07:02.474135Z"}`, identity.RouteToApp.AWSCredentialProcessCredentials)
+}
+
+func TestAppAccessUsingAWSOIDC_doesntGenerateClientCredentials(t *testing.T) {
+	ctx := t.Context()
+	srv := newTestTLSServer(t)
+
+	// Set up a user with the necessary roles to access the AWS App.
+	username := "aws-access-user"
+	roleARN := "arn:aws:iam::123456789012:role/MyRole"
+	awsAccessRole, err := authtest.CreateRole(ctx, srv.Auth(), "aws-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: types.Labels{
+				types.Wildcard: []string{types.Wildcard},
+			},
+			AWSRoleARNs: []string{roleARN},
+		},
+	})
+	require.NoError(t, err)
+
+	awsOIDCIntegration := "aws-oidc-integration"
+	ig, err := types.NewIntegrationAWSOIDC(types.Metadata{Name: awsOIDCIntegration}, &types.AWSOIDCIntegrationSpecV1{
+		RoleARN: "arn:aws:iam::123456789012:role/MyRole",
+	})
+	require.NoError(t, err)
+	_, err = srv.Auth().Integrations.CreateIntegration(ctx, ig)
+	require.NoError(t, err)
+
+	// Set up a new AWS App created from a Roles Anywhere Profile.
+	appName := "my-aws-access-using-awsoidc"
+	app, err := types.NewAppServerV3(
+		types.Metadata{Name: appName},
+		types.AppServerSpecV3{
+			HostID: uuid.NewString(),
+			App: &types.AppV3{
+				Metadata: types.Metadata{Name: appName},
+				Spec: types.AppSpecV3{
+					URI:         constants.AWSConsoleURL,
+					Integration: awsOIDCIntegration,
+					PublicAddr:  "my-app.example.com",
+				},
+			},
+		},
+	)
+	require.NoError(t, err)
+	_, err = srv.Auth().UpsertApplicationServer(ctx, app)
+	require.NoError(t, err)
+
+	user, err := authtest.CreateUser(ctx, srv.Auth(), username, awsAccessRole)
+	require.NoError(t, err)
+
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
+	require.NoError(t, err)
+
+	// Create credentials for the AWS App
+	priv, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	pub, err := keys.MarshalPublicKey(priv.Public())
+	require.NoError(t, err)
+
+	// Impersonating the requester name fails.
+	_, err = client.GenerateUserCerts(ctx, proto.UserCertsRequest{
+		TLSPublicKey: pub,
+		Username:     user.GetName(),
+		Expires:      time.Now().Add(time.Hour),
+		RouteToApp: proto.RouteToApp{
+			Name:       appName,
+			AWSRoleARN: roleARN,
+		},
+		RequesterName: proto.UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS,
+	})
+	require.Error(t, err)
+
+	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
+		TLSPublicKey: pub,
+		Username:     user.GetName(),
+		Expires:      time.Now().Add(time.Hour),
+		RouteToApp: proto.RouteToApp{
+			Name:       appName,
+			AWSRoleARN: roleARN,
+		},
+	})
+	require.NoError(t, err)
+
+	// Parse the Identity and check the AWS Role ARN and credentials.
+	tlsCert, err := tlsca.ParseCertificatePEM(certs.TLS)
+	require.NoError(t, err)
+	identity, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
+	require.NoError(t, err)
+
+	require.Equal(t, roleARN, identity.AWSRoleARNs[0], "Expected AWS Role ARN to match the one requested")
+	require.Empty(t, identity.RouteToApp.AWSCredentialProcessCredentials)
+}
+
 func TestSSODiagnosticInfo(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
 	// empty role
-	emptyRole, err := CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
+	emptyRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// privileged role
-	privRole, err := CreateRole(ctx, srv.Auth(), "priv-access", types.RoleSpecV6{
+	privRole, err := authtest.CreateRole(ctx, srv.Auth(), "priv-access", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -780,16 +982,16 @@ func TestSSODiagnosticInfo(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	user, err := CreateUser(ctx, srv.Auth(), "dummy", emptyRole)
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "dummy", emptyRole)
 	require.NoError(t, err)
 
-	userPriv, err := CreateUser(ctx, srv.Auth(), "superDummy", privRole)
+	userPriv, err := authtest.CreateUser(ctx, srv.Auth(), "superDummy", privRole)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
-	clientPriv, err := srv.NewClient(TestUser(userPriv.GetName()))
+	clientPriv, err := srv.NewClient(authtest.TestUser(userPriv.GetName()))
 	require.NoError(t, err)
 
 	// fresh server, no SSO diag info, request fails
@@ -856,11 +1058,11 @@ func TestGenerateUserCertsForHeadlessKube(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create test user1.
-	user1, _, err := CreateUserAndRole(srv.Auth(), "user1", []string{"role1"}, nil)
+	user1, _, err := authtest.CreateUserAndRole(srv.Auth(), "user1", []string{"role1"}, nil)
 	require.NoError(t, err)
 
 	// Create test user2.
-	user2, role2, err := CreateUserAndRole(srv.Auth(), "user2", []string{"role2"}, nil)
+	user2, role2, err := authtest.CreateUserAndRole(srv.Auth(), "user2", []string{"role2"}, nil)
 	require.NoError(t, err)
 
 	role2Opts := role2.GetOptions()
@@ -900,7 +1102,7 @@ func TestGenerateUserCertsForHeadlessKube(t *testing.T) {
 
 	for _, tt := range testCases {
 		t.Run(tt.desc, func(t *testing.T) {
-			user := TestUser(tt.user.GetName())
+			user := authtest.TestUser(tt.user.GetName())
 			user.TTL = defaultDuration
 			client, err := srv.NewClient(user)
 			require.NoError(t, err)
@@ -968,11 +1170,11 @@ func TestGenerateUserCertsWithMFAVerification(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create test user1.
-	user1, _, err := CreateUserAndRole(srv.Auth(), "user1", []string{"role1"}, nil)
+	user1, _, err := authtest.CreateUserAndRole(srv.Auth(), "user1", []string{"role1"}, nil)
 	require.NoError(t, err)
 
 	// Create test user2.
-	user2, role2, err := CreateUserAndRole(srv.Auth(), "user2", []string{"role2"}, nil)
+	user2, role2, err := authtest.CreateUserAndRole(srv.Auth(), "user2", []string{"role2"}, nil)
 	require.NoError(t, err)
 
 	role2Opts := role2.GetOptions()
@@ -984,7 +1186,7 @@ func TestGenerateUserCertsWithMFAVerification(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create test user3.
-	user3, role3, err := CreateUserAndRole(srv.Auth(), "user3", []string{"role3"}, nil)
+	user3, role3, err := authtest.CreateUserAndRole(srv.Auth(), "user3", []string{"role3"}, nil)
 	require.NoError(t, err)
 
 	role3Opts := role3.GetOptions()
@@ -1071,7 +1273,7 @@ func TestGenerateUserCertsWithMFAVerification(t *testing.T) {
 
 	for _, tt := range testCases {
 		t.Run(tt.desc, func(t *testing.T) {
-			user := TestUser(tt.user.GetName())
+			user := authtest.TestUser(tt.user.GetName())
 			user.TTL = defaultDuration
 			client, err := srv.NewClient(user)
 			require.NoError(t, err)
@@ -1120,31 +1322,31 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	emptyRole, err := CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
+	emptyRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-empty", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	accessFooRole, err := CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
+	accessFooRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"foo"},
 		},
 	})
 	require.NoError(t, err)
 
-	accessBarRole, err := CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
+	accessBarRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"bar"},
 		},
 	})
 	require.NoError(t, err)
 
-	loginsTraitsRole, err := CreateRole(ctx, srv.Auth(), "test-access-traits", types.RoleSpecV6{
+	loginsTraitsRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-traits", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"{{internal.logins}}"},
 		},
 	})
 	require.NoError(t, err)
 
-	impersonatorRole, err := CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
+	impersonatorRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Impersonate: &types.ImpersonateConditions{
 				Roles: []string{
@@ -1157,7 +1359,7 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	denyBarRole, err := CreateRole(ctx, srv.Auth(), "test-deny", types.RoleSpecV6{
+	denyBarRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-deny", types.RoleSpecV6{
 		Deny: types.RoleConditions{
 			Impersonate: &types.ImpersonateConditions{
 				Roles: []string{accessBarRole.GetName()},
@@ -1169,10 +1371,10 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	dummyUserRole, err := types.NewRole("dummy-user-role", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	dummyUser, err := CreateUser(ctx, srv.Auth(), "dummy-user", dummyUserRole)
+	dummyUser, err := authtest.CreateUser(ctx, srv.Auth(), "dummy-user", dummyUserRole)
 	require.NoError(t, err)
 
-	dummyUserImpersonatorRole, err := CreateRole(ctx, srv.Auth(), "dummy-user-impersonator", types.RoleSpecV6{
+	dummyUserImpersonatorRole, err := authtest.CreateRole(ctx, srv.Auth(), "dummy-user-impersonator", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Impersonate: &types.ImpersonateConditions{
 				Users: []string{dummyUser.GetName()},
@@ -1301,7 +1503,7 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			user, err := CreateUser(ctx, srv.Auth(), tt.username)
+			user, err := authtest.CreateUser(ctx, srv.Auth(), tt.username)
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, srv.Auth().DeleteUser(ctx, tt.username), "failed cleaning up testing user: %s", tt.username)
@@ -1315,7 +1517,7 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 			user, err = srv.Auth().UpsertUser(ctx, user)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
@@ -1399,7 +1601,7 @@ func TestRolesRequestsExplicitAllowReissue(t *testing.T) {
 	_, err = srv.Auth().UpsertApplicationServer(ctx, app)
 	require.NoError(t, err)
 
-	accessFooRole, err := CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
+	accessFooRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"foo"},
 			AppLabels: types.Labels{
@@ -1409,14 +1611,14 @@ func TestRolesRequestsExplicitAllowReissue(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	accessBarRole, err := CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
+	accessBarRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"bar"},
 		},
 	})
 	require.NoError(t, err)
 
-	impersonatorRole, err := CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
+	impersonatorRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Impersonate: &types.ImpersonateConditions{
 				Roles: []string{accessFooRole.GetName(), accessBarRole.GetName()},
@@ -1426,14 +1628,14 @@ func TestRolesRequestsExplicitAllowReissue(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a testing user.
-	user, err := CreateUser(ctx, srv.Auth(), "alice")
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "alice")
 	require.NoError(t, err)
 	user.AddRole(impersonatorRole.GetName())
 	user, err = srv.Auth().UpsertUser(ctx, user)
 	require.NoError(t, err)
 
 	// Generate cert with a role request.
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	_, sshPubKey, tlsPrivKey, tlsPubKey := newSSHAndTLSKeyPairs(t)
@@ -1452,7 +1654,8 @@ func TestRolesRequestsExplicitAllowReissue(t *testing.T) {
 	// Make an impersonated client.
 	impersonatedTLSCert, err := tls.X509KeyPair(certs.TLS, tlsPrivKey)
 	require.NoError(t, err)
-	impersonatedClient := srv.NewClientWithCert(impersonatedTLSCert)
+	impersonatedClient, err := srv.NewClientWithCert(impersonatedTLSCert)
+	require.NoError(t, err)
 
 	ident, err := tlsca.FromSubject(
 		impersonatedTLSCert.Leaf.Subject,
@@ -1526,21 +1729,21 @@ func TestRoleRequestDenyReimpersonation(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	accessFooRole, err := CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
+	accessFooRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-foo", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"foo"},
 		},
 	})
 	require.NoError(t, err)
 
-	accessBarRole, err := CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
+	accessBarRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-access-bar", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Logins: []string{"bar"},
 		},
 	})
 	require.NoError(t, err)
 
-	impersonatorRole, err := CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
+	impersonatorRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-impersonator", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Impersonate: &types.ImpersonateConditions{
 				Roles: []string{accessFooRole.GetName(), accessBarRole.GetName()},
@@ -1550,14 +1753,14 @@ func TestRoleRequestDenyReimpersonation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a testing user.
-	user, err := CreateUser(ctx, srv.Auth(), "alice")
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "alice")
 	require.NoError(t, err)
 	user.AddRole(impersonatorRole.GetName())
 	user, err = srv.Auth().UpsertUser(ctx, user)
 	require.NoError(t, err)
 
 	// Generate cert with a role request.
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	_, sshPubKey, tlsPrivKey, tlsPubKey := newSSHAndTLSKeyPairs(t)
@@ -1575,7 +1778,8 @@ func TestRoleRequestDenyReimpersonation(t *testing.T) {
 	// Make an impersonated client.
 	impersonatedTLSCert, err := tls.X509KeyPair(certs.TLS, tlsPrivKey)
 	require.NoError(t, err)
-	impersonatedClient := srv.NewClientWithCert(impersonatedTLSCert)
+	impersonatedClient, err := srv.NewClientWithCert(impersonatedTLSCert)
+	require.NoError(t, err)
 
 	// Attempt a request.
 	_, err = impersonatedClient.GetClusterName(ctx)
@@ -1624,11 +1828,11 @@ func TestGenerateDatabaseCert(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	// This user can't impersonate anyone and can't generate database certs.
-	userWithoutAccess, _, err := CreateUserAndRole(srv.Auth(), "user", []string{"role1"}, nil)
+	userWithoutAccess, _, err := authtest.CreateUserAndRole(srv.Auth(), "user", []string{"role1"}, nil)
 	require.NoError(t, err)
 
 	// This user can impersonate system role Db.
-	userImpersonateDb, roleDb, err := CreateUserAndRole(srv.Auth(), "user-impersonate-db", []string{"role2"}, nil)
+	userImpersonateDb, roleDb, err := authtest.CreateUserAndRole(srv.Auth(), "user-impersonate-db", []string{"role2"}, nil)
 	require.NoError(t, err)
 	roleDb.SetImpersonateConditions(types.Allow, types.ImpersonateConditions{
 		Users: []string{string(types.RoleDatabase)},
@@ -1639,29 +1843,29 @@ func TestGenerateDatabaseCert(t *testing.T) {
 
 	tests := []struct {
 		desc      string
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		requester proto.DatabaseCertRequest_Requester
 		err       string
 	}{
 		{
 			desc:      "user can't sign database certs",
-			identity:  TestUser(userWithoutAccess.GetName()),
+			identity:  authtest.TestUser(userWithoutAccess.GetName()),
 			requester: proto.DatabaseCertRequest_TCTL,
 			err:       "access denied",
 		},
 		{
 			desc:      "user can impersonate Db and sign database certs",
-			identity:  TestUser(userImpersonateDb.GetName()),
+			identity:  authtest.TestUser(userImpersonateDb.GetName()),
 			requester: proto.DatabaseCertRequest_TCTL,
 		},
 		{
 			desc:      "built-in admin can sign database certs",
-			identity:  TestAdmin(),
+			identity:  authtest.TestAdmin(),
 			requester: proto.DatabaseCertRequest_TCTL,
 		},
 		{
 			desc:     "database service can sign database certs",
-			identity: TestBuiltin(types.RoleDatabase),
+			identity: authtest.TestBuiltin(types.RoleDatabase),
 		},
 	}
 
@@ -1689,18 +1893,19 @@ func TestGenerateDatabaseCert(t *testing.T) {
 
 type testDynamicallyConfigurableRBACParams struct {
 	kind                          string
-	storeDefault, storeConfigFile func(*Server)
-	get, set, reset               func(*ServerWithRoles) error
+	storeDefault, storeConfigFile func(*auth.Server)
+	get, set, reset               func(*auth.ServerWithRoles) error
 	alwaysReadable                bool
 }
 
 // TestDynamicConfigurationRBACVerbs tests the dynamic configuration RBAC verbs described
 // in rfd/0016-dynamic-configuration.md § Implementation.
 func testDynamicallyConfigurableRBAC(t *testing.T, p testDynamicallyConfigurableRBACParams) {
-	testAuth, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
 
-	testOperation := func(op func(*ServerWithRoles) error, allowRules []types.Rule, expectErr, withConfigFile bool) func(*testing.T) {
+	testOperation := func(op func(*auth.ServerWithRoles) error, allowRules []types.Rule, expectErr, withConfigFile bool) func(*testing.T) {
 		return func(t *testing.T) {
 			if withConfigFile {
 				p.storeConfigFile(testAuth.AuthServer)
@@ -1767,22 +1972,22 @@ func TestAuthPreferenceRBAC(t *testing.T) {
 	ctx := context.Background()
 	testDynamicallyConfigurableRBAC(t, testDynamicallyConfigurableRBACParams{
 		kind: types.KindClusterAuthPreference,
-		storeDefault: func(s *Server) {
+		storeDefault: func(s *auth.Server) {
 			s.UpsertAuthPreference(ctx, types.DefaultAuthPreference())
 		},
-		storeConfigFile: func(s *Server) {
+		storeConfigFile: func(s *auth.Server) {
 			authPref := types.DefaultAuthPreference()
 			authPref.SetOrigin(types.OriginConfigFile)
 			s.UpsertAuthPreference(ctx, authPref)
 		},
-		get: func(s *ServerWithRoles) error {
+		get: func(s *auth.ServerWithRoles) error {
 			_, err := s.GetAuthPreference(ctx)
 			return err
 		},
-		set: func(s *ServerWithRoles) error {
+		set: func(s *auth.ServerWithRoles) error {
 			return s.SetAuthPreference(ctx, types.DefaultAuthPreference())
 		},
-		reset: func(s *ServerWithRoles) error {
+		reset: func(s *auth.ServerWithRoles) error {
 			return s.ResetAuthPreference(ctx)
 		},
 		alwaysReadable: true,
@@ -1795,7 +2000,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 	_, err := srv.Auth().UpsertClusterNetworkingConfig(ctx, types.DefaultClusterNetworkingConfig())
 	require.NoError(t, err)
 
-	user, _, err := CreateUserAndRole(srv.Auth(), "username", []string{}, []types.Rule{
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "username", []string{}, []types.Rule{
 		{
 			Resources: []string{
 				types.KindClusterNetworkingConfig,
@@ -1807,7 +2012,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 
 	for _, tc := range []struct {
 		cloud                   bool
-		identity                TestIdentity
+		identity                authtest.TestIdentity
 		expectSetErr            string
 		clusterNetworkingConfig types.ClusterNetworkingConfig
 		name                    string
@@ -1815,13 +2020,13 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:                    "non admin user can set existing values to the same value",
 			cloud:                   true,
-			identity:                TestUser(user.GetName()),
+			identity:                authtest.TestUser(user.GetName()),
 			clusterNetworkingConfig: types.DefaultClusterNetworkingConfig(),
 		},
 		{
 			name:         "non admin user cannot set keep_alive_interval",
 			cloud:        true,
-			identity:     TestUser(user.GetName()),
+			identity:     authtest.TestUser(user.GetName()),
 			expectSetErr: "keep_alive_interval",
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				KeepAliveInterval: types.Duration(time.Second * 20),
@@ -1830,7 +2035,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:         "non admin user cannot set tunnel_strategy",
 			cloud:        true,
-			identity:     TestUser(user.GetName()),
+			identity:     authtest.TestUser(user.GetName()),
 			expectSetErr: "tunnel_strategy",
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				TunnelStrategy: &types.TunnelStrategyV1{
@@ -1843,7 +2048,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:         "non admin user cannot set proxy_listener_mode",
 			cloud:        true,
-			identity:     TestUser(user.GetName()),
+			identity:     authtest.TestUser(user.GetName()),
 			expectSetErr: "proxy_listener_mode",
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				ProxyListenerMode: types.ProxyListenerMode_Multiplex,
@@ -1852,7 +2057,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:         "non admin user cannot set keep_alive_count_max",
 			cloud:        true,
-			identity:     TestUser(user.GetName()),
+			identity:     authtest.TestUser(user.GetName()),
 			expectSetErr: "keep_alive_count_max",
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				KeepAliveCountMax: 55,
@@ -1861,7 +2066,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:     "non admin user can set client_idle_timeout",
 			cloud:    true,
-			identity: TestUser(user.GetName()),
+			identity: authtest.TestUser(user.GetName()),
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				ClientIdleTimeout: types.Duration(time.Second * 67),
 			}),
@@ -1869,7 +2074,7 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:     "admin user can set keep_alive_interval",
 			cloud:    true,
-			identity: TestAdmin(),
+			identity: authtest.TestAdmin(),
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				KeepAliveInterval: types.Duration(time.Second * 67),
 			}),
@@ -1877,14 +2082,14 @@ func TestClusterNetworkingCloudUpdates(t *testing.T) {
 		{
 			name:     "non admin user can set keep_alive_interval on non cloud cluster",
 			cloud:    false,
-			identity: TestUser(user.GetName()),
+			identity: authtest.TestUser(user.GetName()),
 			clusterNetworkingConfig: newClusterNetworkingConf(t, types.ClusterNetworkingConfigSpecV2{
 				KeepAliveInterval: types.Duration(time.Second * 67),
 			}),
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: modules.BuildEnterprise,
 				TestFeatures: modules.Features{
 					Cloud: tc.cloud,
@@ -1930,22 +2135,22 @@ func TestClusterNetworkingConfigRBAC(t *testing.T) {
 	ctx := context.Background()
 	testDynamicallyConfigurableRBAC(t, testDynamicallyConfigurableRBACParams{
 		kind: types.KindClusterNetworkingConfig,
-		storeDefault: func(s *Server) {
+		storeDefault: func(s *auth.Server) {
 			s.UpsertClusterNetworkingConfig(ctx, types.DefaultClusterNetworkingConfig())
 		},
-		storeConfigFile: func(s *Server) {
+		storeConfigFile: func(s *auth.Server) {
 			netConfig := types.DefaultClusterNetworkingConfig()
 			netConfig.SetOrigin(types.OriginConfigFile)
 			s.UpsertClusterNetworkingConfig(ctx, netConfig)
 		},
-		get: func(s *ServerWithRoles) error {
+		get: func(s *auth.ServerWithRoles) error {
 			_, err := s.GetClusterNetworkingConfig(ctx)
 			return err
 		},
-		set: func(s *ServerWithRoles) error {
+		set: func(s *auth.ServerWithRoles) error {
 			return s.SetClusterNetworkingConfig(ctx, types.DefaultClusterNetworkingConfig())
 		},
-		reset: func(s *ServerWithRoles) error {
+		reset: func(s *auth.ServerWithRoles) error {
 			return s.ResetClusterNetworkingConfig(ctx)
 		},
 	})
@@ -1956,22 +2161,22 @@ func TestSessionRecordingConfigRBAC(t *testing.T) {
 	ctx := context.Background()
 	testDynamicallyConfigurableRBAC(t, testDynamicallyConfigurableRBACParams{
 		kind: types.KindSessionRecordingConfig,
-		storeDefault: func(s *Server) {
+		storeDefault: func(s *auth.Server) {
 			s.UpsertSessionRecordingConfig(ctx, types.DefaultSessionRecordingConfig())
 		},
-		storeConfigFile: func(s *Server) {
+		storeConfigFile: func(s *auth.Server) {
 			recConfig := types.DefaultSessionRecordingConfig()
 			recConfig.SetOrigin(types.OriginConfigFile)
 			s.UpsertSessionRecordingConfig(ctx, recConfig)
 		},
-		get: func(s *ServerWithRoles) error {
+		get: func(s *auth.ServerWithRoles) error {
 			_, err := s.GetSessionRecordingConfig(ctx)
 			return err
 		},
-		set: func(s *ServerWithRoles) error {
+		set: func(s *auth.ServerWithRoles) error {
 			return s.SetSessionRecordingConfig(ctx, types.DefaultSessionRecordingConfig())
 		},
-		reset: func(s *ServerWithRoles) error {
+		reset: func(s *auth.ServerWithRoles) error {
 			return s.ResetSessionRecordingConfig(ctx)
 		},
 	})
@@ -2138,7 +2343,7 @@ func BenchmarkListNodes(b *testing.B) {
 func benchmarkListNodes(
 	b *testing.B, ctx context.Context,
 	nodeCount, hiddenNodes int,
-	srv *TestTLSServer,
+	srv *authtest.TLSServer,
 	ids []string,
 	editRole func(r types.Role, id string),
 ) {
@@ -2153,7 +2358,7 @@ func benchmarkListNodes(
 	// create user, role, and client
 	username := "user"
 
-	user, err := CreateUser(ctx, srv.Auth(), username, roles...)
+	user, err := authtest.CreateUser(ctx, srv.Auth(), username, roles...)
 	require.NoError(b, err)
 	user.SetTraits(map[string][]string{
 		"group": {"users"},
@@ -2161,7 +2366,7 @@ func benchmarkListNodes(
 	})
 	user, err = srv.Auth().UpsertUser(ctx, user)
 	require.NoError(b, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(b, err)
 
@@ -2215,9 +2420,9 @@ func TestGetAndList_Nodes(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -2312,10 +2517,10 @@ func TestStreamSessionEventsRBAC(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 
-	user, err := CreateUser(context.Background(), srv.Auth(), "user", role)
+	user, err := authtest.CreateUser(context.Background(), srv.Auth(), "user", role)
 	require.NoError(t, err)
 
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -2339,10 +2544,10 @@ func TestStreamSessionEvents_User(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	username := "user"
-	user, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
 
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -2374,7 +2579,7 @@ func TestStreamSessionEvents_Builtin(t *testing.T) {
 	defer cancel()
 	srv := newTestTLSServer(t)
 
-	identity := TestBuiltin(types.RoleProxy)
+	identity := authtest.TestBuiltin(types.RoleProxy)
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -2404,10 +2609,10 @@ func TestStreamSessionEvents(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	username := "user"
-	user, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
 
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -2437,7 +2642,7 @@ func TestStreamSessionEvents(t *testing.T) {
 func TestStreamSessionEvents_SessionType(t *testing.T) {
 	t.Parallel()
 
-	authServerConfig := TestAuthServerConfig{
+	authServerConfig := authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	}
@@ -2453,8 +2658,9 @@ func TestStreamSessionEvents_SessionType(t *testing.T) {
 	require.NoError(t, err)
 	authServerConfig.AuditLog = localLog
 
-	as, err := NewTestAuthServer(authServerConfig)
+	as, err := authtest.NewAuthServer(authServerConfig)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 	srv, err := as.NewTestTLSServer()
 	require.NoError(t, err)
@@ -2464,10 +2670,10 @@ func TestStreamSessionEvents_SessionType(t *testing.T) {
 	t.Cleanup(cancel)
 
 	username := "user"
-	user, _, err := CreateUserAndRole(srv.Auth(), username, []string{}, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, []string{}, nil)
 	require.NoError(t, err)
 
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 	sessionID := session.NewID()
@@ -2522,9 +2728,9 @@ func TestAPILockedOut(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	// Create user, role and client.
-	user, role, err := CreateUserAndRole(srv.Auth(), "test-user", nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), "test-user", nil, nil)
 	require.NoError(t, err)
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// Prepare an operation requiring authorization.
@@ -2557,25 +2763,25 @@ func TestAPILockedOut(t *testing.T) {
 	require.Eventually(t, func() bool { return trace.IsAccessDenied(testOp()) }, time.Second, time.Second/10)
 }
 
-func serverWithAllowRules(t *testing.T, srv *TestAuthServer, allowRules []types.Rule) *ServerWithRoles {
+func serverWithAllowRules(t *testing.T, srv *authtest.AuthServer, allowRules []types.Rule) *auth.ServerWithRoles {
 	username := "test-user"
 	ctx := context.Background()
-	_, role, err := CreateUserAndRoleWithoutRoles(srv.AuthServer, username, nil)
+	_, role, err := authtest.CreateUserAndRoleWithoutRoles(srv.AuthServer, username, nil)
 	require.NoError(t, err)
 	role.SetRules(types.Allow, allowRules)
 	_, err = srv.AuthServer.UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	localUser := authz.LocalUser{Username: username, Identity: tlsca.Identity{Username: username}}
+	localUser := authz.LocalUser{Username: username, Identity: tlsca.Identity{Username: username, Groups: []string{role.GetName()}}}
 	authContext, err := authz.ContextForLocalUser(ctx, localUser, srv.AuthServer.Services, srv.ClusterName, true /* disableDeviceAuthz */)
 	require.NoError(t, err)
 	authContext.AdminActionAuthState = authz.AdminActionAuthMFAVerified
 
-	return &ServerWithRoles{
-		authServer: srv.AuthServer,
-		alog:       srv.AuditLog,
-		context:    *authContext,
-	}
+	return auth.NewServerWithRoles(
+		srv.AuthServer,
+		srv.AuditLog,
+		*authContext,
+	)
 }
 
 // TestDatabasesCRUDRBAC verifies RBAC is applied to database CRUD methods.
@@ -2587,20 +2793,20 @@ func TestDatabasesCRUDRBAC(t *testing.T) {
 	// Setup a couple of users:
 	// - "dev" only has access to databases with labels env=dev
 	// - "admin" has access to all databases
-	dev, devRole, err := CreateUserAndRole(srv.Auth(), "dev", nil, nil)
+	dev, devRole, err := authtest.CreateUserAndRole(srv.Auth(), "dev", nil, nil)
 	require.NoError(t, err)
 	devRole.SetDatabaseLabels(types.Allow, types.Labels{"env": {"dev"}})
 	_, err = srv.Auth().UpsertRole(ctx, devRole)
 	require.NoError(t, err)
-	devClt, err := srv.NewClient(TestUser(dev.GetName()))
+	devClt, err := srv.NewClient(authtest.TestUser(dev.GetName()))
 	require.NoError(t, err)
 
-	admin, adminRole, err := CreateUserAndRole(srv.Auth(), "admin", nil, nil)
+	admin, adminRole, err := authtest.CreateUserAndRole(srv.Auth(), "admin", nil, nil)
 	require.NoError(t, err)
 	adminRole.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
 	_, err = srv.Auth().UpsertRole(ctx, adminRole)
 	require.NoError(t, err)
-	adminClt, err := srv.NewClient(TestUser(admin.GetName()))
+	adminClt, err := srv.NewClient(authtest.TestUser(admin.GetName()))
 	require.NoError(t, err)
 
 	// Prepare a couple of database resources.
@@ -2677,6 +2883,13 @@ func TestDatabasesCRUDRBAC(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	dbs, next, err := devClt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Database{devDatabase}, dbs,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Admin should see both.
 	dbs, err = adminClt.GetDatabases(ctx)
 	require.NoError(t, err)
@@ -2684,6 +2897,21 @@ func TestDatabasesCRUDRBAC(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	dbs, next, err = adminClt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Database{adminDatabase, devDatabase}, dbs,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// With limit, next should be dev
+	dbs, next, err = adminClt.ListDatabases(ctx, 1, "")
+	require.NoError(t, err)
+	require.Equal(t, devDatabase.GetName(), next)
+	require.Empty(t, cmp.Diff([]types.Database{adminDatabase}, dbs,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Dev shouldn't be able to delete dev database...
 	err = devClt.DeleteDatabase(ctx, adminDatabase.GetName())
 	require.True(t, trace.IsAccessDenied(err))
@@ -2716,7 +2944,7 @@ func TestDatabasesCRUDRBAC(t *testing.T) {
 		})
 
 		// Prepare discovery service client.
-		discoveryClt, err := srv.NewClient(TestBuiltin(types.RoleDiscovery))
+		discoveryClt, err := srv.NewClient(authtest.TestBuiltin(types.RoleDiscovery))
 		require.NoError(t, err)
 
 		cloudDatabase, err := types.NewDatabaseV3(types.Metadata{
@@ -2778,6 +3006,14 @@ func mustGetDatabases(t *testing.T, client *authclient.Client, wantDatabases []t
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		cmpopts.EquateEmpty(),
 	))
+
+	actualDatabases, err = stream.Collect(client.RangeDatabases(t.Context(), "", ""))
+	require.NoError(t, err)
+
+	require.Empty(t, cmp.Diff(wantDatabases, actualDatabases,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+		cmpopts.EquateEmpty(),
+	))
 }
 
 func TestKubernetesClusterCRUD_DiscoveryService(t *testing.T) {
@@ -2785,7 +3021,7 @@ func TestKubernetesClusterCRUD_DiscoveryService(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	discoveryClt, err := srv.NewClient(TestBuiltin(types.RoleDiscovery))
+	discoveryClt, err := srv.NewClient(authtest.TestBuiltin(types.RoleDiscovery))
 	require.NoError(t, err)
 
 	eksCluster, err := common.NewKubeClusterFromAWSEKS(
@@ -2828,10 +3064,22 @@ func TestKubernetesClusterCRUD_DiscoveryService(t *testing.T) {
 		require.True(t, trace.IsAccessDenied(discoveryClt.CreateKubernetesCluster(ctx, clusterWithDynamicLabels)))
 	})
 	t.Run("Read", func(t *testing.T) {
+		diffopt := cmpopts.IgnoreFields(types.Metadata{}, "Revision")
+
 		clusters, err := discoveryClt.GetKubernetesClusters(ctx)
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff([]types.KubeCluster{eksCluster}, clusters, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+		require.Empty(t, cmp.Diff([]types.KubeCluster{eksCluster}, clusters, diffopt))
+
+		clusters, next, err := discoveryClt.ListKubernetesClusters(ctx, 0, "")
+		require.Empty(t, next)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff([]types.KubeCluster{eksCluster}, clusters, diffopt))
+
+		clusters, err = stream.Collect(discoveryClt.RangeKubernetesClusters(ctx, "", ""))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff([]types.KubeCluster{eksCluster}, clusters, diffopt))
 	})
+
 	t.Run("Update", func(t *testing.T) {
 		require.NoError(t, discoveryClt.UpdateKubernetesCluster(ctx, eksCluster))
 		require.True(t, trace.IsAccessDenied(discoveryClt.UpdateKubernetesCluster(ctx, nonCloudCluster)))
@@ -2842,10 +3090,18 @@ func TestKubernetesClusterCRUD_DiscoveryService(t *testing.T) {
 		require.NoError(t, err)
 		require.Empty(t, clusters)
 
+		clusters, err = stream.Collect(discoveryClt.RangeKubernetesClusters(ctx, "", ""))
+		require.NoError(t, err)
+		require.Empty(t, clusters)
+
 		// Discovery service cannot delete non-cloud clusters.
 		clusters, err = srv.Auth().GetKubernetesClusters(ctx)
 		require.NoError(t, err)
 		require.Len(t, clusters, 1)
+
+		clusters, err = stream.Collect(srv.Auth().RangeKubernetesClusters(ctx, "", ""))
+		require.NoError(t, err)
+		require.Len(t, clusters, 1)
 	})
 }
 
@@ -2892,9 +3148,9 @@ func TestGetAndList_DatabaseServers(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -3026,9 +3282,9 @@ func TestGetAndList_ApplicationServers(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -3114,11 +3370,60 @@ func TestGetAndList_ApplicationServers(t *testing.T) {
 	require.Empty(t, resp.Resources)
 }
 
+func TestListSAMLIdPServiceProviderWithCache(t *testing.T) {
+	// Set license to enterprise in order to be able to list SAML IdP service providers.
+	modulestest.SetTestModules(t, modulestest.Modules{
+		TestBuildType: modules.BuildEnterprise,
+	})
+	ctx := context.Background()
+	srv := newTestTLSServer(t, withCacheEnabled(true))
+
+	sp, err := types.NewSAMLIdPServiceProvider(types.Metadata{
+		Name: "saml-app",
+	}, types.SAMLIdPServiceProviderSpecV1{
+		ACSURL:   "https://example.com/acs",
+		EntityID: "https://example.com/entity-id",
+	})
+	require.NoError(t, err)
+	err = srv.Auth().CreateSAMLIdPServiceProvider(ctx, sp)
+	require.NoError(t, err)
+
+	var sps []types.SAMLIdPServiceProvider
+	inlineEventually(t, func() bool {
+		var err error
+		sps, _, err = srv.Auth().ListSAMLIdPServiceProviders(ctx, 0, "")
+		require.NoError(t, err)
+		return len(sps) == 1
+	}, 5*time.Second, 200*time.Millisecond, "SAMLIdPServiceProviders from auth")
+
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), "user", nil, []types.Rule{
+		types.NewRule(types.KindSAMLIdPServiceProvider, services.RO()),
+	})
+	require.NoError(t, err)
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
+	require.NoError(t, err)
+
+	role.SetAppLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
+	_, err = srv.Auth().UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		sps_cache, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			Namespace:    apidefaults.Namespace,
+			Limit:        int32(len(sps)),
+			ResourceType: types.KindSAMLIdPServiceProvider,
+		})
+		require.NoError(t, err)
+		require.Equal(t, sps_cache.Resources[0].GetName(), sp.GetName())
+		return len(sps_cache.Resources) == len(sps)
+	}, 5*time.Second, 200*time.Millisecond, "SAMLIdPServiceProviders from cache")
+}
+
 // TestListSAMLIdPServiceProviderAndListResources verifies
 // RBAC and search filters when fetching SAML IdP service providers.
 func TestListSAMLIdPServiceProviderAndListResources(t *testing.T) {
 	// Set license to enterprise in order to be able to list SAML IdP service providers.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
@@ -3156,9 +3461,9 @@ func TestListSAMLIdPServiceProviderAndListResources(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -3254,20 +3559,20 @@ func TestApps(t *testing.T) {
 	// Setup a couple of users:
 	// - "dev" only has access to apps with labels env=dev
 	// - "admin" has access to all apps
-	dev, devRole, err := CreateUserAndRole(srv.Auth(), "dev", nil, nil)
+	dev, devRole, err := authtest.CreateUserAndRole(srv.Auth(), "dev", nil, nil)
 	require.NoError(t, err)
 	devRole.SetAppLabels(types.Allow, types.Labels{"env": {"dev"}})
 	_, err = srv.Auth().UpsertRole(ctx, devRole)
 	require.NoError(t, err)
-	devClt, err := srv.NewClient(TestUser(dev.GetName()))
+	devClt, err := srv.NewClient(authtest.TestUser(dev.GetName()))
 	require.NoError(t, err)
 
-	admin, adminRole, err := CreateUserAndRole(srv.Auth(), "admin", nil, nil)
+	admin, adminRole, err := authtest.CreateUserAndRole(srv.Auth(), "admin", nil, nil)
 	require.NoError(t, err)
 	adminRole.SetAppLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
 	_, err = srv.Auth().UpsertRole(ctx, adminRole)
 	require.NoError(t, err)
-	adminClt, err := srv.NewClient(TestUser(admin.GetName()))
+	adminClt, err := srv.NewClient(authtest.TestUser(admin.GetName()))
 	require.NoError(t, err)
 
 	// Prepare a couple of app resources.
@@ -3342,6 +3647,13 @@ func TestApps(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err := devClt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Application{devApp}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Admin should see both.
 	apps, err = adminClt.GetApps(ctx)
 	require.NoError(t, err)
@@ -3349,6 +3661,13 @@ func TestApps(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err = adminClt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Application{adminApp, devApp}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Dev shouldn't be able to delete dev app...
 	err = devClt.DeleteApp(ctx, adminApp.GetName())
 	require.True(t, trace.IsAccessDenied(err))
@@ -3368,18 +3687,41 @@ func TestApps(t *testing.T) {
 	// Dev should only be able to delete dev app.
 	err = devClt.DeleteAllApps(ctx)
 	require.NoError(t, err)
+
+	apps, err = devClt.GetApps(ctx)
+	require.NoError(t, err)
+	require.Empty(t, apps)
+
+	out, next, err = devClt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
 	apps, err = adminClt.GetApps(ctx)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff([]types.Application{adminApp}, apps,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err = adminClt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Application{adminApp}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Admin should be able to delete all.
 	err = adminClt.DeleteAllApps(ctx)
 	require.NoError(t, err)
+
 	apps, err = adminClt.GetApps(ctx)
 	require.NoError(t, err)
 	require.Empty(t, apps)
+
+	out, next, err = adminClt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
 }
 
 // TestReplaceRemoteLocksRBAC verifies that only a remote proxy may replace the
@@ -3387,36 +3729,37 @@ func TestApps(t *testing.T) {
 func TestReplaceRemoteLocksRBAC(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
-	user, _, err := CreateUserAndRole(srv.AuthServer, "test-user", []string{}, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.AuthServer, "test-user", []string{}, nil)
 	require.NoError(t, err)
 
 	targetCluster := "cluster"
 	tests := []struct {
 		desc     string
-		identity TestIdentity
+		identity authtest.TestIdentity
 		checkErr func(error) bool
 	}{
 		{
 			desc:     "users may not replace remote locks",
-			identity: TestUser(user.GetName()),
+			identity: authtest.TestUserWithRoles(user.GetName(), []string{role.GetName()}),
 			checkErr: trace.IsAccessDenied,
 		},
 		{
 			desc:     "local proxy may not replace remote locks",
-			identity: TestBuiltin(types.RoleProxy),
+			identity: authtest.TestBuiltin(types.RoleProxy),
 			checkErr: trace.IsAccessDenied,
 		},
 		{
 			desc:     "remote proxy of a non-target cluster may not replace the target's remote locks",
-			identity: TestRemoteBuiltin(types.RoleProxy, "non-"+targetCluster),
+			identity: authtest.TestRemoteBuiltin(types.RoleProxy, "non-"+targetCluster),
 			checkErr: trace.IsAccessDenied,
 		},
 		{
 			desc:     "remote proxy of the target cluster may replace its remote locks",
-			identity: TestRemoteBuiltin(types.RoleProxy, targetCluster),
+			identity: authtest.TestRemoteBuiltin(types.RoleProxy, targetCluster),
 			checkErr: func(err error) bool { return err == nil },
 		},
 	}
@@ -3429,11 +3772,11 @@ func TestReplaceRemoteLocksRBAC(t *testing.T) {
 			authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, test.identity.I))
 			require.NoError(t, err)
 
-			s := &ServerWithRoles{
-				authServer: srv.AuthServer,
-				alog:       srv.AuditLog,
-				context:    *authContext,
-			}
+			s := auth.NewServerWithRoles(
+				srv.AuthServer,
+				srv.AuditLog,
+				*authContext,
+			)
 
 			err = s.ReplaceRemoteLocks(ctx, targetCluster, []types.Lock{lock})
 			require.True(t, test.checkErr(err), trace.DebugReport(err))
@@ -3527,7 +3870,9 @@ func TestIsMFARequired_databaseProtocols(t *testing.T) {
 				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
 				role.SetDatabaseNames(types.Allow, nil)
 			},
-			want: proto.MFARequired_MFA_REQUIRED_NO,
+			// MFA should be required if the role says so, regardless of whether
+			// the database name matches or not.
+			want: proto.MFARequired_MFA_REQUIRED_YES,
 		},
 		{
 			name:       "RequireSessionMFA on Postgres protocol database name matches",
@@ -3553,6 +3898,32 @@ func TestIsMFARequired_databaseProtocols(t *testing.T) {
 			},
 			want: proto.MFARequired_MFA_REQUIRED_YES,
 		},
+		{
+			name:       "RequireSessionMFA database user does not match",
+			dbProtocol: defaults.ProtocolPostgres,
+			req: &proto.IsMFARequiredRequest{
+				Target: &proto.IsMFARequiredRequest_Database{
+					Database: &proto.RouteToDatabase{
+						ServiceName: databaseName,
+						Protocol:    defaults.ProtocolPostgres,
+						Username:    userName,
+						Database:    "example",
+					},
+				},
+			},
+			modifyRoleFunc: func(role types.Role) {
+				roleOpt := role.GetOptions()
+				roleOpt.RequireMFAType = types.RequireMFAType_SESSION
+				role.SetOptions(roleOpt)
+
+				role.SetDatabaseUsers(types.Allow, nil)
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
+				role.SetDatabaseNames(types.Allow, []string{"example"})
+			},
+			// MFA should be required if the role says so, regardless of whether
+			// the database user matches or not.
+			want: proto.MFARequired_MFA_REQUIRED_YES,
+		},
 	}
 
 	for _, tc := range tests {
@@ -3601,7 +3972,7 @@ func TestIsMFARequired_databaseProtocols(t *testing.T) {
 			_, err = srv.Auth().UpsertDatabaseServer(ctx, database)
 			require.NoError(t, err)
 
-			user, role, err := CreateUserAndRole(srv.Auth(), userName, []string{"test-role"}, nil)
+			user, role, err := authtest.CreateUserAndRole(srv.Auth(), userName, []string{"test-role"}, nil)
 			require.NoError(t, err)
 
 			if tc.modifyRoleFunc != nil {
@@ -3610,13 +3981,13 @@ func TestIsMFARequired_databaseProtocols(t *testing.T) {
 			_, err = srv.Auth().UpsertRole(ctx, role)
 			require.NoError(t, err)
 
-			cl, err := srv.NewClient(TestUser(user.GetName()))
+			cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			resp, err := cl.IsMFARequired(ctx, tc.req)
 			require.NoError(t, err)
 			assert.Equal(t, tc.want, resp.MFARequired, "MFARequired mismatch")
-			assert.Equal(t, MFARequiredToBool(tc.want), resp.Required, "Required mismatch")
+			assert.Equal(t, auth.MFARequiredToBool(tc.want), resp.Required, "Required mismatch")
 		})
 	}
 }
@@ -3627,17 +3998,18 @@ func TestIsMFARequired_databaseProtocols(t *testing.T) {
 func TestKindClusterConfig(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
 	getClusterConfigResources := func(ctx context.Context, user types.User) []error {
-		authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, TestUser(user.GetName()).I))
+		authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, authtest.TestUserWithRoles(user.GetName(), user.GetRoles()).I))
 		require.NoError(t, err, trace.DebugReport(err))
-		s := &ServerWithRoles{
-			authServer: srv.AuthServer,
-			alog:       srv.AuditLog,
-			context:    *authContext,
-		}
+		s := auth.NewServerWithRoles(
+			srv.AuthServer,
+			srv.AuditLog,
+			*authContext,
+		)
 		_, err1 := s.GetClusterAuditConfig(ctx)
 		_, err2 := s.GetClusterNetworkingConfig(ctx)
 		_, err3 := s.GetSessionRecordingConfig(ctx)
@@ -3645,7 +4017,9 @@ func TestKindClusterConfig(t *testing.T) {
 	}
 
 	t.Run("without KindClusterConfig privilege", func(t *testing.T) {
-		user, err := CreateUser(ctx, srv.AuthServer, "test-user")
+		role, err := types.NewRole("test-role", types.RoleSpecV6{})
+		require.NoError(t, err)
+		user, err := authtest.CreateUser(ctx, srv.AuthServer, "test-user", role)
 		require.NoError(t, err)
 		for _, err := range getClusterConfigResources(ctx, user) {
 			require.Error(t, err)
@@ -3662,7 +4036,7 @@ func TestKindClusterConfig(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
-		user, err := CreateUser(ctx, srv.AuthServer, "test-user", role)
+		user, err := authtest.CreateUser(ctx, srv.AuthServer, "test-user", role)
 		require.NoError(t, err)
 		for _, err := range getClusterConfigResources(ctx, user) {
 			require.NoError(t, err)
@@ -3715,9 +4089,9 @@ func TestGetAndList_KubernetesServers(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -3841,9 +4215,9 @@ func TestListDatabaseServices(t *testing.T) {
 
 	// Create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -3967,9 +4341,9 @@ func TestListResources_NeedTotalCountFlag(t *testing.T) {
 	require.Len(t, testNodes, 3)
 
 	// create user and client
-	user, _, err := CreateUserAndRole(srv.Auth(), "user", nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "user", nil, nil)
 	require.NoError(t, err)
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// Total returned.
@@ -4020,7 +4394,7 @@ func TestListResources_SearchAsRoles(t *testing.T) {
 	require.Len(t, testNodes, numTestNodes)
 
 	// create user and client
-	requester, role, err := CreateUserAndRole(srv.Auth(), "requester", []string{"requester"}, nil)
+	requester, role, err := authtest.CreateUserAndRole(srv.Auth(), "requester", []string{"requester"}, nil)
 	require.NoError(t, err)
 
 	// only allow user to see first node
@@ -4047,14 +4421,14 @@ func TestListResources_SearchAsRoles(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	requesterClt, err := srv.NewClient(TestUser(requester.GetName()))
+	requesterClt, err := srv.NewClient(authtest.TestUser(requester.GetName()))
 	require.NoError(t, err)
 
 	// create another user that can see all nodes but has no search_as_roles or
 	// preview_as_roles
-	admin, _, err := CreateUserAndRole(srv.Auth(), "admin", []string{"admin"}, nil)
+	admin, _, err := authtest.CreateUserAndRole(srv.Auth(), "admin", []string{"admin"}, nil)
 	require.NoError(t, err)
-	adminClt, err := srv.NewClient(TestUser(admin.GetName()))
+	adminClt, err := srv.NewClient(authtest.TestUser(admin.GetName()))
 	require.NoError(t, err)
 
 	for _, tc := range []struct {
@@ -4200,7 +4574,7 @@ func TestListResources_WithLogins(t *testing.T) {
 
 	// create user and client
 	logins := []string{"llama", "fish"}
-	user, role, err := CreateUserAndRole(srv.Auth(), "user", logins, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), "user", logins, nil)
 	require.NoError(t, err)
 	role.SetWindowsDesktopLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 	role.SetWindowsLogins(types.Allow, logins)
@@ -4209,7 +4583,7 @@ func TestListResources_WithLogins(t *testing.T) {
 	_, err = srv.Auth().UpdateRole(ctx, role)
 	require.NoError(t, err)
 
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	t.Run("with fake pagination", func(t *testing.T) {
@@ -4301,9 +4675,9 @@ func TestGetAndList_WindowsDesktops(t *testing.T) {
 
 	// Create user, role, and client.
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -4417,17 +4791,18 @@ func TestGetAndList_WindowsDesktops(t *testing.T) {
 func TestListResources_KindKubernetesCluster(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
-	authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, TestBuiltin(types.RoleProxy).I))
+	authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, authtest.TestBuiltin(types.RoleProxy).I))
 	require.NoError(t, err)
 
-	s := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		alog:       srv.AuditLog,
-		context:    *authContext,
-	}
+	s := auth.NewServerWithRoles(
+		srv.AuthServer,
+		srv.AuditLog,
+		*authContext,
+	)
 
 	testNames := []string{"a", "b", "c", "d"}
 
@@ -4510,7 +4885,7 @@ func TestListResources_KindKubernetesCluster(t *testing.T) {
 	})
 }
 
-func createKubeServer(t *testing.T, s *ServerWithRoles, clusterNames []string, hostID string) {
+func createKubeServer(t *testing.T, s *auth.ServerWithRoles, clusterNames []string, hostID string) {
 	for _, clusterName := range clusterNames {
 		kubeCluster, err := types.NewKubernetesClusterV3(types.Metadata{
 			Name: clusterName,
@@ -4526,8 +4901,9 @@ func createKubeServer(t *testing.T, s *ServerWithRoles, clusterNames []string, h
 func TestListResources_KindUserGroup(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
 	role, err := types.NewRole("test-role", types.RoleSpecV6{
 		Allow: types.RoleConditions{
@@ -4552,32 +4928,19 @@ func TestListResources_KindUserGroup(t *testing.T) {
 	user, err = srv.AuthServer.UpsertUser(ctx, user)
 	require.NoError(t, err)
 
-	// Create the admin context so that we can create all the user groups we need.
-	authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, TestBuiltin(types.RoleAdmin).I))
-	require.NoError(t, err)
-
-	s := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		alog:       srv.AuditLog,
-		context:    *authContext,
-	}
-
 	// Add user groups.
-	testUg1 := createUserGroup(t, s, "c", map[string]string{"label": "value"})
-	testUg2 := createUserGroup(t, s, "a", map[string]string{"label": "value"})
-	testUg3 := createUserGroup(t, s, "b", map[string]string{"label": "value"})
-
-	// This user group should never should up because the user doesn't have group label access to it.
-	_ = createUserGroup(t, s, "d", map[string]string{"inaccessible": "value"})
+	testUg1 := createUserGroup(t, srv.AuthServer, "c", map[string]string{"label": "value"})
+	testUg2 := createUserGroup(t, srv.AuthServer, "a", map[string]string{"label": "value"})
+	testUg3 := createUserGroup(t, srv.AuthServer, "b", map[string]string{"label": "value"})
 
-	authContext, err = srv.Authorizer.Authorize(authz.ContextWithUser(ctx, TestUser(user.GetName()).I))
+	authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, authtest.TestUserWithRoles(user.GetName(), []string{role.GetName()}).I))
 	require.NoError(t, err)
 
-	s = &ServerWithRoles{
-		authServer: srv.AuthServer,
-		alog:       srv.AuditLog,
-		context:    *authContext,
-	}
+	s := auth.NewServerWithRoles(
+		srv.AuthServer,
+		srv.AuditLog,
+		*authContext,
+	)
 
 	// Test create.
 	userGroups, _, err := s.ListUserGroups(ctx, 0, "")
@@ -4653,13 +5016,15 @@ func TestListResources_KindUserGroup(t *testing.T) {
 	})
 }
 
-func createUserGroup(t *testing.T, s *ServerWithRoles, name string, labels map[string]string) types.UserGroup {
+func createUserGroup(t *testing.T, s *auth.Server, name string, labels map[string]string) types.UserGroup {
+	t.Helper()
+	ctx := t.Context()
 	userGroup, err := types.NewUserGroup(types.Metadata{
 		Name:   name,
 		Labels: labels,
 	}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
-	err = s.CreateUserGroup(context.Background(), userGroup)
+	err = s.CreateUserGroup(ctx, userGroup)
 	require.NoError(t, err)
 	return userGroup
 }
@@ -4672,9 +5037,9 @@ func TestDeleteUserAppSessions(t *testing.T) {
 
 	// Generates a new user client.
 	userClient := func(username string) *authclient.Client {
-		user, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+		user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 		require.NoError(t, err)
-		identity := TestUser(user.GetName())
+		identity := authtest.TestUser(user.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		return clt
@@ -4777,9 +5142,9 @@ func TestListResources_SortAndDeduplicate(t *testing.T) {
 
 	// Create user, role, and client.
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -4944,7 +5309,7 @@ func TestListResources_WithRoles(t *testing.T) {
 	const nodePerPool = 3
 
 	// inserts a pool nodes with different labels
-	insertNodes := func(ctx context.Context, t *testing.T, srv *Server, nodeCount int, labels map[string]string) {
+	insertNodes := func(ctx context.Context, t *testing.T, srv *auth.Server, nodeCount int, labels map[string]string) {
 		for i := 0; i < nodeCount; i++ {
 			name := uuid.NewString()
 			addr := fmt.Sprintf("node-%s.example.com", name)
@@ -4968,7 +5333,7 @@ func TestListResources_WithRoles(t *testing.T) {
 	}
 
 	// creates roles that deny the given labels
-	createRole := func(ctx context.Context, t *testing.T, srv *Server, name string, labels map[string]apiutils.Strings) {
+	createRole := func(ctx context.Context, t *testing.T, srv *auth.Server, name string, labels map[string]apiutils.Strings) {
 		role, err := types.NewRole(name, types.RoleSpecV6{
 			Allow: types.RoleConditions{
 				NodeLabels: types.Labels{
@@ -5103,7 +5468,7 @@ func TestListResources_WithRoles(t *testing.T) {
 				t.Run(fmt.Sprintf("needTotal=%t", total), func(t *testing.T) {
 					t.Parallel()
 
-					clt, err := srv.NewClient(TestUser(user.GetName()))
+					clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 					require.NoError(t, err)
 
 					var resp *types.ListResourcesResponse
@@ -5149,8 +5514,8 @@ func TestListUnifiedResources_WithLogins(t *testing.T) {
 
 	// create user and client
 	logins := []string{"llama", "fish"}
-	user, _, err := CreateUserAndRole(srv.Auth(), "user", nil /*mutated with role mutator*/, nil,
-		WithRoleMutator(
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "user", nil /*mutated with role mutator*/, nil,
+		authtest.WithRoleMutator(
 			func(role types.Role) {
 				role.SetLogins(types.Allow, logins)
 				role.SetWindowsLogins(types.Allow, logins)
@@ -5217,7 +5582,7 @@ func TestListUnifiedResources_WithLogins(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	resultsC := make(chan []*proto.PaginatedResource, 1)
@@ -5300,7 +5665,7 @@ func TestListUnifiedResources_IncludeRequestable(t *testing.T) {
 	require.Len(t, testNodes, numTestNodes)
 
 	// create user and client
-	requester, role, err := CreateUserAndRole(srv.Auth(), "requester", []string{"requester"}, nil)
+	requester, role, err := authtest.CreateUserAndRole(srv.Auth(), "requester", []string{"requester"}, nil)
 	require.NoError(t, err)
 
 	// only allow user to see first node
@@ -5318,7 +5683,7 @@ func TestListUnifiedResources_IncludeRequestable(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	requesterClt, err := srv.NewClient(TestUser(requester.GetName()))
+	requesterClt, err := srv.NewClient(authtest.TestUser(requester.GetName()))
 	require.NoError(t, err)
 
 	type expected struct {
@@ -5386,27 +5751,41 @@ func TestCreateAccessRequestV2_oktaReadOnly(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	// 1. Create Okta-originated app server in the backend.
+	// 1. Create Okta-originated app_server and user_group in the backend.
 
-	searchableOktaApp := newTestAppServerV3(t, srv.Auth(), "serachable-okta-app", map[string]string{
-		"name":            "serachable-okta-app",
-		types.OriginLabel: types.OriginOkta,
-	})
+	searchableOktaApp := createTestAppServerV3(t, srv.Auth(),
+		"serachable-okta-app",
+		map[string]string{
+			"name":            "serachable-okta-app",
+			types.OriginLabel: types.OriginOkta,
+		},
+	)
+
+	searchableUserGroup := createUserGroup(t, srv.Auth(),
+		"serachable-okta-group",
+		map[string]string{
+			"name":            "serachable-okta-group",
+			types.OriginLabel: types.OriginOkta,
+		},
+	)
 
 	// 2. Create a role allowing the Okta app (used for search_as_roles)
 
-	searchRole, err := CreateRole(ctx, srv.Auth(), "serach_role", types.RoleSpecV6{
+	searchRole, err := authtest.CreateRole(ctx, srv.Auth(), "serach_role", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			AppLabels: types.Labels{
 				"name": {searchableOktaApp.GetName()},
 			},
+			GroupLabels: types.Labels{
+				"name": {searchableUserGroup.GetName()},
+			},
 		},
 	})
 	require.NoError(t, err)
 
 	// 3. Create the user role allowing to search Okta app
 
-	aliceRole, err := CreateRole(ctx, srv.Auth(), "alice_role", types.RoleSpecV6{
+	aliceRole, err := authtest.CreateRole(ctx, srv.Auth(), "alice_role", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
 				SearchAsRoles: []string{
@@ -5419,12 +5798,12 @@ func TestCreateAccessRequestV2_oktaReadOnly(t *testing.T) {
 
 	// 4. Create the user
 
-	alice, err := CreateUser(ctx, srv.Auth(), "alice", aliceRole)
+	alice, err := authtest.CreateUser(ctx, srv.Auth(), "alice", aliceRole)
 	require.NoError(t, err)
 
 	// 5. Create a client for the user
 
-	aliceClt, err := srv.NewClient(TestUser(alice.GetName()))
+	aliceClt, err := srv.NewClient(authtest.TestUser(alice.GetName()))
 	require.NoError(t, err)
 
 	// 6. Prepare access requests
@@ -5444,6 +5823,13 @@ func TestCreateAccessRequestV2_oktaReadOnly(t *testing.T) {
 				mustResourceID(srv.ClusterName(), types.KindAppServer, searchableOktaApp.GetName()),
 			},
 		),
+		// requesting user_group
+		mustAccessRequest(t, alice.GetName(), types.RequestState_PENDING, srv.Clock().Now(), srv.Clock().Now().Add(time.Hour),
+			[]string{}, // roles
+			[]types.ResourceID{
+				mustResourceID(srv.ClusterName(), types.KindUserGroup, searchableUserGroup.GetName()),
+			},
+		),
 	}
 
 	// 7. Run tests
@@ -5454,20 +5840,22 @@ func TestCreateAccessRequestV2_oktaReadOnly(t *testing.T) {
 		// heartbeats for the Okta apps haven't expired yet. This is an edge-case so the
 		// error is a bit confusing.
 		for _, accessRequest := range testAccessRequests {
+			msg := fmt.Sprintf("requested resources = %v", accessRequest.GetRequestedResourceIDs())
 			_, err := aliceClt.CreateAccessRequestV2(ctx, accessRequest)
-			require.Error(t, err)
-			require.True(t, trace.IsBadParameter(err))
-			require.ErrorContains(t, err, okta.OktaResourceNotRequestableError.Error())
+			require.Error(t, err, msg)
+			require.True(t, trace.IsBadParameter(err), msg)
+			require.ErrorContains(t, err, okta.OktaResourceNotRequestableError.Error(), msg)
 		}
 	})
 
-	t.Run("requesting okta resources and okta bidirectional sync enabled", func(t *testing.T) {
+	t.Run("requesting okta resources and okta bidirectional sync enabled for access list sync", func(t *testing.T) {
 		oktatest.UpsertPlugin(t, srv.Auth().Plugins,
 			oktatest.NewPlugin(t,
 				oktatest.WithSyncSettings(&types.PluginOktaSyncSettings{
 					SsoConnectorId:           "test-okta-conn-id",
 					SyncUsers:                true,
 					DisableSyncAppGroups:     false,
+					SyncAccessLists:          true,
 					DefaultOwners:            []string{"the-owner"},
 					DisableBidirectionalSync: false,
 				}),
@@ -5475,31 +5863,76 @@ func TestCreateAccessRequestV2_oktaReadOnly(t *testing.T) {
 		)
 
 		for _, accessRequest := range testAccessRequests {
+			msg := fmt.Sprintf("requested resources = %v", accessRequest.GetRequestedResourceIDs())
 			_, err := aliceClt.CreateAccessRequestV2(ctx, accessRequest)
-			require.NoError(t, err)
+			require.NoError(t, err, msg)
 		}
 	})
 
-	t.Run("requesting okta resources and okta bidirectional sync disabled", func(t *testing.T) {
+	t.Run("requesting okta resources and okta bidirectional sync enabled for app and group only sync", func(t *testing.T) {
 		oktatest.UpsertPlugin(t, srv.Auth().Plugins,
 			oktatest.NewPlugin(t,
 				oktatest.WithSyncSettings(&types.PluginOktaSyncSettings{
 					SsoConnectorId:           "test-okta-conn-id",
 					SyncUsers:                true,
-					DisableSyncAppGroups:     true,
+					DisableSyncAppGroups:     false,
+					SyncAccessLists:          false,
 					DefaultOwners:            []string{"the-owner"},
-					DisableBidirectionalSync: true,
+					DisableBidirectionalSync: false,
 				}),
 			),
 		)
 
 		for _, accessRequest := range testAccessRequests {
 			_, err := aliceClt.CreateAccessRequestV2(ctx, accessRequest)
-			require.Error(t, err)
+			require.NoError(t, err)
+		}
+	})
+
+	t.Run("requesting okta resources and okta bidirectional sync disabled for access list sync", func(t *testing.T) {
+		oktatest.UpsertPlugin(t, srv.Auth().Plugins,
+			oktatest.NewPlugin(t,
+				oktatest.WithSyncSettings(&types.PluginOktaSyncSettings{
+					SsoConnectorId:           "test-okta-conn-id",
+					SyncUsers:                true,
+					DisableSyncAppGroups:     false,
+					SyncAccessLists:          true,
+					DefaultOwners:            []string{"the-owner"},
+					DisableBidirectionalSync: true,
+				}),
+			),
+		)
+
+		for _, accessRequest := range testAccessRequests {
+			_, err := aliceClt.CreateAccessRequestV2(ctx, accessRequest)
+			require.Error(t, err)
 			require.True(t, trace.IsBadParameter(err))
 			require.ErrorContains(t, err, okta.OktaResourceNotRequestableError.Error())
 		}
 	})
+
+	t.Run("requesting okta resources and okta bidirectional sync disabled for app and group only sync", func(t *testing.T) {
+		oktatest.UpsertPlugin(t, srv.Auth().Plugins,
+			oktatest.NewPlugin(t,
+				oktatest.WithSyncSettings(&types.PluginOktaSyncSettings{
+					SsoConnectorId:           "test-okta-conn-id",
+					SyncUsers:                true,
+					DisableSyncAppGroups:     false,
+					SyncAccessLists:          false,
+					DefaultOwners:            []string{"the-owner"},
+					DisableBidirectionalSync: true,
+				}),
+			),
+		)
+
+		for _, accessRequest := range testAccessRequests {
+			msg := fmt.Sprintf("requested resources = %v", accessRequest.GetRequestedResourceIDs())
+			_, err := aliceClt.CreateAccessRequestV2(ctx, accessRequest)
+			require.Error(t, err, msg)
+			require.True(t, trace.IsBadParameter(err), msg)
+			require.ErrorContains(t, err, okta.OktaResourceNotRequestableError.Error(), msg)
+		}
+	})
 }
 
 func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
@@ -5509,14 +5942,14 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 
 	// 1. Create app resources
 
-	searchableGenericApp := newTestAppServerV3(t, srv.Auth(),
+	searchableGenericApp := createTestAppServerV3(t, srv.Auth(),
 		"test_generic_app",
 		map[string]string{
 			"find_me": "please",
 		},
 	)
 
-	searchableOktaApp := newTestAppServerV3(t, srv.Auth(),
+	searchableOktaApp := createTestAppServerV3(t, srv.Auth(),
 		"test_searchable_okta_app",
 		map[string]string{
 			"find_me":         "please",
@@ -5524,7 +5957,7 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 		},
 	)
 
-	assignedOktaApp := newTestAppServerV3(t, srv.Auth(),
+	assignedOktaApp := createTestAppServerV3(t, srv.Auth(),
 		"test_assigned_okta_app",
 		map[string]string{
 			"owner":           "alice",
@@ -5534,7 +5967,7 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 
 	// 2. Create a role allowing the Okta app (used for search_as_roles)
 
-	searchRole, err := CreateRole(ctx, srv.Auth(), "serach_role", types.RoleSpecV6{
+	searchRole, err := authtest.CreateRole(ctx, srv.Auth(), "serach_role", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			AppLabels: types.Labels{
 				"find_me": {"please"},
@@ -5545,7 +5978,7 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 
 	// 3. Create the user role allowing access to one Okta app and allowing to search the other Okta app
 
-	aliceRole, err := CreateRole(ctx, srv.Auth(), "alice_role", types.RoleSpecV6{
+	aliceRole, err := authtest.CreateRole(ctx, srv.Auth(), "alice_role", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			AppLabels: types.Labels{
 				"owner": []string{"alice"},
@@ -5561,7 +5994,7 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 
 	// 4. Create the user
 
-	alice, err := CreateUser(ctx, srv.Auth(), "alice", aliceRole)
+	alice, err := authtest.CreateUser(ctx, srv.Auth(), "alice", aliceRole)
 	require.NoError(t, err)
 
 	// 5. Run tests
@@ -5635,7 +6068,7 @@ func TestListUnifiedResources_search_as_roles_oktaReadOnly(t *testing.T) {
 				})),
 			)
 
-			aliceClt, err := srv.NewClient(TestUser(alice.GetName()))
+			aliceClt, err := srv.NewClient(authtest.TestUser(alice.GetName()))
 			require.NoError(t, err)
 
 			resp, err := aliceClt.ListUnifiedResources(ctx, &req)
@@ -5692,12 +6125,15 @@ func TestListUnifiedResources_KindsFilter(t *testing.T) {
 		require.NoError(t, err)
 		_, err = srv.Auth().UpsertDatabaseServer(ctx, db)
 		require.NoError(t, err)
+
+		createTestAppServerV3(t, srv.Auth(), name, nil)
+		createTestMCPAppServer(t, srv.Auth(), "mcp-"+name, nil)
 	}
 
 	// create user and client
-	user, _, err := CreateUserAndRole(srv.Auth(), "user", nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "user", nil, nil)
 	require.NoError(t, err)
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	var resp *proto.ListUnifiedResourcesResponse
@@ -5724,6 +6160,21 @@ func TestListUnifiedResources_KindsFilter(t *testing.T) {
 		Limit: 5,
 	})
 	require.NoError(t, err, "sort field is not required")
+
+	t.Run("KindApp", func(t *testing.T) {
+		resp, err = clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+			Kinds: []string{types.KindApp},
+		})
+		require.NoError(t, err)
+		require.Len(t, resp.Resources, 10) // 5 app + 5 mcp server
+	})
+	t.Run("KindMCP", func(t *testing.T) {
+		resp, err = clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+			Kinds: []string{types.KindMCP},
+		})
+		require.NoError(t, err)
+		require.Len(t, resp.Resources, 5)
+	})
 }
 
 func TestListUnifiedResources_WithPinnedResources(t *testing.T) {
@@ -5755,9 +6206,9 @@ func TestListUnifiedResources_WithPinnedResources(t *testing.T) {
 
 	// create user, role, and client
 	username := "theuser"
-	user, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 
 	// pin a resource
 	pinned := &userpreferencesv1.PinnedResourcesUserPreferences{
@@ -5841,9 +6292,9 @@ func TestListUnifiedResources_WithSearch(t *testing.T) {
 	require.NoError(t, srv.Auth().CreateSAMLIdPServiceProvider(ctx, sp))
 
 	// create user and client
-	user, _, err := CreateUserAndRole(srv.Auth(), "user", nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "user", nil, nil)
 	require.NoError(t, err)
-	clt, err := srv.NewClient(TestUser(user.GetName()))
+	clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	var resp *proto.ListUnifiedResourcesResponse
@@ -5943,7 +6394,7 @@ func TestListUnifiedResources_MixedAccess(t *testing.T) {
 
 	// create user, role, and client
 	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
 
 	role.SetNodeLabels(types.Allow, types.Labels{"*": {"*"}})
@@ -5962,14 +6413,14 @@ func TestListUnifiedResources_MixedAccess(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 	// require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
 	// ensure updated roles have propagated to auth cache. Since ListUnifiedResources
 	// uses a separate, custom cache, this is not guaranteed to flush that cache, so
 	// we still use an Eventually loop below.
-	flushCache(t, srv.Auth())
+	authtest.FlushCache(t, srv.Auth())
 
 	var resp *proto.ListUnifiedResourcesResponse
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
@@ -5996,7 +6447,7 @@ func TestListUnifiedResources_MixedAccess(t *testing.T) {
 	// ensure updated roles have propagated to auth cache. Since ListUnifiedResources
 	// uses a separate, custom cache, this is not guaranteed to flush that cache, so
 	// we still use an Eventually loop below.
-	flushCache(t, srv.Auth())
+	authtest.FlushCache(t, srv.Auth())
 
 	// Get a new client to test with the new roles.
 	clt, err = srv.NewClient(identity)
@@ -6060,9 +6511,9 @@ func TestListUnifiedResources_WithPredicate(t *testing.T) {
 
 	// create user, role, and client
 	username := "theuser"
-	user, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(t, err)
 
@@ -6084,8 +6535,8 @@ func TestListUnifiedResources_WithPredicate(t *testing.T) {
 	require.Error(t, err)
 }
 
-func withAccountAssignment(condition types.RoleConditionType, accountID, permissionSet string) CreateUserAndRoleOption {
-	return WithRoleMutator(func(role types.Role) {
+func withAccountAssignment(condition types.RoleConditionType, accountID, permissionSet string) authtest.CreateUserAndRoleOption {
+	return authtest.WithRoleMutator(func(role types.Role) {
 		r := role.(*types.RoleV6)
 		cond := &r.Spec.Deny
 		if condition == types.Allow {
@@ -6122,22 +6573,20 @@ func TestUnifiedResources_IdentityCenter(t *testing.T) {
 	withMatchingAccountAssignment := withAccountAssignment(types.Allow,
 		validAccountID, validPermissionSetARN)
 
-	acct, err := srv.Auth().CreateIdentityCenterAccount(ctx, services.IdentityCenterAccount{
-		Account: &identitycenterv1.Account{
-			Kind:    types.KindIdentityCenterAccount,
-			Version: types.V1,
-			Metadata: &headerv1.Metadata{
-				Name: "test-account",
-				Labels: map[string]string{
-					types.OriginLabel: apicommon.OriginAWSIdentityCenter,
-				},
-			},
-			Spec: &identitycenterv1.AccountSpec{
-				Id:   validAccountID,
-				Arn:  "some:account:arn",
-				Name: "Test Account",
+	acct, err := srv.Auth().CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+		Kind:    types.KindIdentityCenterAccount,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "test-account",
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
 		},
+		Spec: &identitycenterv1.AccountSpec{
+			Id:   validAccountID,
+			Arn:  "some:account:arn",
+			Name: "Test Account",
+		},
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() {
@@ -6147,8 +6596,7 @@ func TestUnifiedResources_IdentityCenter(t *testing.T) {
 
 	inlineEventually(t,
 		func() bool {
-			accounts, _, err := srv.Auth().ListIdentityCenterAccounts(
-				ctx, 100, &pagination.PageRequestToken{})
+			accounts, _, err := srv.Auth().ListIdentityCenterAccounts(ctx, 100, "")
 			require.NoError(t, err)
 			return len(accounts) == 1
 		},
@@ -6159,118 +6607,163 @@ func TestUnifiedResources_IdentityCenter(t *testing.T) {
 	}
 
 	t.Run("no access", func(t *testing.T) {
-		userNoAccess, _, err := CreateUserAndRole(srv.Auth(), "no-access", nil, nil)
+		userNoAccess, _, err := authtest.CreateUserAndRole(srv.Auth(), "no-access", nil, nil)
 		require.NoError(t, err)
 
-		identity := TestUser(userNoAccess.GetName())
+		identity := authtest.TestUser(userNoAccess.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
 
-		resp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+		unifiedResp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
 			Kinds: []string{types.KindApp},
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
 		})
 		require.NoError(t, err)
+		require.Empty(t, unifiedResp.Resources)
+
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+		require.NoError(t, err)
 		require.Empty(t, resp.Resources)
 	})
 
 	t.Run("no access via no matching account condition ", func(t *testing.T) {
-		userNoAccess, _, err := CreateUserAndRole(srv.Auth(), "no-access-account-mismatch", nil,
+		userNoAccess, _, err := authtest.CreateUserAndRole(srv.Auth(), "no-access-account-mismatch", nil,
 			allowByGenericKind,
 			withAccountAssignment(types.Allow, "22222222", validPermissionSetARN))
 		require.NoError(t, err)
 
-		identity := TestUser(userNoAccess.GetName())
+		identity := authtest.TestUser(userNoAccess.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
 
-		resp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+		unifiedResp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
 			Kinds: []string{types.KindApp},
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
 		})
 		require.NoError(t, err)
+		require.Empty(t, unifiedResp.Resources)
+
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+		require.NoError(t, err)
 		require.Empty(t, resp.Resources)
 	})
 
 	t.Run("access denied by account deny condition", func(t *testing.T) {
-		userNoAccess, _, err := CreateUserAndRole(srv.Auth(), "no-access-account-mismatch", nil,
+		userNoAccess, _, err := authtest.CreateUserAndRole(srv.Auth(), "no-access-account-mismatch", nil,
 			allowBySpecificKind,
 			withMatchingAccountAssignment,
 			withAccountAssignment(types.Deny, validAccountID, "*"))
 		require.NoError(t, err)
 
-		identity := TestUser(userNoAccess.GetName())
+		identity := authtest.TestUser(userNoAccess.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
 
-		resp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+		unifiedResp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
 			Kinds: []string{types.KindApp},
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
 		})
 		require.NoError(t, err)
+		require.Empty(t, unifiedResp.Resources)
+
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+		require.NoError(t, err)
 		require.Empty(t, resp.Resources)
 	})
 
 	t.Run("access via generic kind", func(t *testing.T) {
-		user, _, err := CreateUserAndRole(srv.Auth(), "read-generic", nil,
+		user, _, err := authtest.CreateUserAndRole(srv.Auth(), "read-generic", nil,
 			allowByGenericKind,
 			withMatchingAccountAssignment)
 		require.NoError(t, err)
 
-		identity := TestUser(user.GetName())
+		identity := authtest.TestUser(user.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
 
-		resp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+		unifiedResp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
 			Kinds: []string{types.KindApp},
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
 		})
 		require.NoError(t, err)
+		require.Len(t, unifiedResp.Resources, 1)
+
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+		require.NoError(t, err)
 		require.Len(t, resp.Resources, 1)
 	})
 
 	t.Run("access via specific kind", func(t *testing.T) {
-		user, _, err := CreateUserAndRole(srv.Auth(), "read-specific", nil,
+		user, _, err := authtest.CreateUserAndRole(srv.Auth(), "read-specific", nil,
 			allowBySpecificKind,
 			withMatchingAccountAssignment)
 		require.NoError(t, err)
 
-		identity := TestUser(user.GetName())
+		identity := authtest.TestUser(user.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
 
-		resp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
+		unifiedResp, err := clt.ListUnifiedResources(ctx, &proto.ListUnifiedResourcesRequest{
 			Kinds: []string{types.KindApp},
 		})
 		require.NoError(t, err)
+		require.Len(t, unifiedResp.Resources, 1)
+
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+		require.NoError(t, err)
 		require.Len(t, resp.Resources, 1)
 	})
 
 	t.Run("access denied via specific kind beats allow via generic kind", func(t *testing.T) {
-		user, _, err := CreateUserAndRole(srv.Auth(), "specific-beats-generic", nil,
+		user, _, err := authtest.CreateUserAndRole(srv.Auth(), "specific-beats-generic", nil,
 			allowByGenericKind,
 			withMatchingAccountAssignment,
-			WithRoleMutator(func(r types.Role) {
+			authtest.WithRoleMutator(func(r types.Role) {
 				r.SetRules(types.Deny, []types.Rule{
 					types.NewRule(types.KindIdentityCenterAccount, services.RO()),
 				})
 			}))
 		require.NoError(t, err)
 
-		identity := TestUser(user.GetName())
+		identity := authtest.TestUser(user.GetName())
 		clt, err := srv.NewClient(identity)
 		require.NoError(t, err)
 		defer clt.Close()
@@ -6280,18 +6773,29 @@ func TestUnifiedResources_IdentityCenter(t *testing.T) {
 		})
 		require.True(t, trace.IsAccessDenied(err),
 			"Expected Access Denied, got %v", err)
+
+		_, err = clt.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindIdentityCenterAccount,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
+			},
+		})
+
+		require.True(t, trace.IsAccessDenied(err),
+			"Expected Access Denied, got %v", err)
 	})
 }
 
 func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 	const nodeCount = 150_000
 	const roleCount = 32
+	const dbCount = 150_000
 
 	ctx := context.Background()
 	srv := newTestTLSServer(b)
 
 	var ids []string
-	for i := 0; i < roleCount; i++ {
+	for range roleCount {
 		ids = append(ids, uuid.New().String())
 	}
 
@@ -6299,7 +6803,7 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 
 	var hiddenNodes int
 	// Create test nodes.
-	for i := 0; i < nodeCount; i++ {
+	for i := range nodeCount {
 		name := uuid.New().String()
 		id := ids[i%len(ids)]
 		if id == "hidden" {
@@ -6331,16 +6835,64 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 		require.NoError(b, err)
 	}
 
+	// Create test HA databases (multiple agents per database)
+	var hiddenDBs int
+	for i := range dbCount {
+		id := ids[i%len(ids)]
+		if id == "hidden" {
+			hiddenDBs++
+		}
+		name := "db-" + strconv.Itoa(i)
+		labels := map[string]string{
+			"kEy":   id,
+			"grouP": "useRs",
+		}
+		if i == 10 {
+			labels["ip"] = "10.20.30.40"
+			labels["ADDRESS"] = "10.20.30.41"
+			labels["food"] = "POTATO"
+		}
+
+		db, err := types.NewDatabaseV3(types.Metadata{
+			Name:   name,
+			Labels: labels,
+		}, types.DatabaseSpecV3{
+			Protocol: "test-protocol",
+			URI:      "test-uri:1234",
+		})
+		require.NoError(b, err)
+
+		statuses := []string{"healthy", "unknown", "healthy"}
+		if i == 10 {
+			statuses = []string{"unhealthy", "unhealthy", "unhealthy"}
+		}
+		for _, healthStatus := range statuses {
+			dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+				Name: db.GetName(),
+			}, types.DatabaseServerSpecV3{
+				Database: db.Copy(),
+				Hostname: name,
+				HostID:   uuid.New().String(),
+			})
+			require.NoError(b, err)
+			dbServer.SetTargetHealth(types.TargetHealth{Status: healthStatus})
+			_, err = srv.Auth().UpsertDatabaseServer(ctx, dbServer)
+			require.NoError(b, err)
+		}
+	}
+
 	b.Run("labels", func(b *testing.B) {
 		benchmarkListUnifiedResources(
 			b, ctx,
-			1,
+			2,
 			srv,
 			ids,
 			func(role types.Role, id string) {
 				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 			},
 			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
 				req.Labels = map[string]string{"ip": "10.20.30.40"}
 			},
 		)
@@ -6348,13 +6900,15 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 	b.Run("predicate path", func(b *testing.B) {
 		benchmarkListUnifiedResources(
 			b, ctx,
-			1,
+			2,
 			srv,
 			ids,
 			func(role types.Role, id string) {
 				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 			},
 			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
 				req.PredicateExpression = `labels.ip == "10.20.30.40"`
 			},
 		)
@@ -6362,18 +6916,20 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 	b.Run("predicate index", func(b *testing.B) {
 		benchmarkListUnifiedResources(
 			b, ctx,
-			1,
+			2,
 			srv,
 			ids,
 			func(role types.Role, id string) {
 				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 			},
 			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
 				req.PredicateExpression = `labels["ip"] == "10.20.30.40"`
 			},
 		)
 	})
-	b.Run("search lower", func(b *testing.B) {
+	b.Run("predicate health status", func(b *testing.B) {
 		benchmarkListUnifiedResources(
 			b, ctx,
 			1,
@@ -6381,8 +6937,26 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 			ids,
 			func(role types.Role, id string) {
 				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+			},
+			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
+				req.PredicateExpression = `health.status == "unhealthy"`
+			},
+		)
+	})
+	b.Run("search lower", func(b *testing.B) {
+		benchmarkListUnifiedResources(
+			b, ctx,
+			2,
+			srv,
+			ids,
+			func(role types.Role, id string) {
+				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 			},
 			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
 				req.SearchKeywords = []string{"10.20.30.40"}
 			},
 		)
@@ -6390,13 +6964,15 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 	b.Run("search upper", func(b *testing.B) {
 		benchmarkListUnifiedResources(
 			b, ctx,
-			1,
+			2,
 			srv,
 			ids,
 			func(role types.Role, id string) {
 				role.SetNodeLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+				role.SetDatabaseLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
 			},
 			func(req *proto.ListUnifiedResourcesRequest) {
+				req.Kinds = []string{types.KindNode, types.KindDatabase}
 				req.SearchKeywords = []string{"POTATO"}
 			},
 		)
@@ -6415,12 +6991,13 @@ func BenchmarkListUnifiedResourcesFilter(b *testing.B) {
 func BenchmarkListUnifiedResources(b *testing.B) {
 	const nodeCount = 150_000
 	const roleCount = 32
+	const dbCount = 150_000
 
 	ctx := context.Background()
 	srv := newTestTLSServer(b)
 
 	var ids []string
-	for i := 0; i < roleCount; i++ {
+	for range roleCount {
 		ids = append(ids, uuid.New().String())
 	}
 
@@ -6428,7 +7005,7 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 
 	var hiddenNodes int
 	// Create test nodes.
-	for i := 0; i < nodeCount; i++ {
+	for i := range nodeCount {
 		name := uuid.New().String()
 		id := ids[i%len(ids)]
 		if id == "hidden" {
@@ -6451,6 +7028,40 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 		require.NoError(b, err)
 	}
 
+	// Create test HA databases (multiple agents per database)
+	var hiddenDBs int
+	for i := range dbCount {
+		id := ids[i%len(ids)]
+		if id == "hidden" {
+			hiddenDBs++
+		}
+		name := "db-" + strconv.Itoa(i)
+		db, err := types.NewDatabaseV3(types.Metadata{
+			Name: name,
+			Labels: map[string]string{
+				"key":   id,
+				"group": "users",
+			},
+		}, types.DatabaseSpecV3{
+			Protocol: "test-protocol",
+			URI:      "test-uri:1234",
+		})
+		require.NoError(b, err)
+		for _, healthStatus := range []string{"healthy", "unhealthy", "unknown"} {
+			dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+				Name: db.GetName(),
+			}, types.DatabaseServerSpecV3{
+				Database: db.Copy(),
+				Hostname: name,
+				HostID:   uuid.New().String(),
+			})
+			require.NoError(b, err)
+			dbServer.SetTargetHealth(types.TargetHealth{Status: healthStatus})
+			_, err = srv.Auth().UpsertDatabaseServer(ctx, dbServer)
+			require.NoError(b, err)
+		}
+	}
+
 	for _, tc := range []struct {
 		desc     string
 		editRole func(types.Role, string)
@@ -6460,8 +7071,10 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 			editRole: func(r types.Role, id string) {
 				if id == "hidden" {
 					r.SetNodeLabels(types.Deny, types.Labels{"key": {id}})
+					r.SetDatabaseLabels(types.Deny, types.Labels{"key": {id}})
 				} else {
 					r.SetNodeLabels(types.Allow, types.Labels{"key": {id}})
+					r.SetDatabaseLabels(types.Allow, types.Labels{"key": {id}})
 				}
 			},
 		},
@@ -6469,11 +7082,13 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 		b.Run(tc.desc, func(b *testing.B) {
 			benchmarkListUnifiedResources(
 				b, ctx,
-				nodeCount-hiddenNodes,
+				nodeCount-hiddenNodes+dbCount-hiddenDBs,
 				srv,
 				ids,
 				tc.editRole,
-				func(req *proto.ListUnifiedResourcesRequest) {},
+				func(req *proto.ListUnifiedResourcesRequest) {
+					req.Kinds = []string{types.KindNode, types.KindDatabase}
+				},
 			)
 		})
 	}
@@ -6482,7 +7097,7 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 func benchmarkListUnifiedResources(
 	b *testing.B, ctx context.Context,
 	expectedCount int,
-	srv *TestTLSServer,
+	srv *authtest.TLSServer,
 	ids []string,
 	editRole func(r types.Role, id string),
 	editReq func(req *proto.ListUnifiedResourcesRequest),
@@ -6498,7 +7113,7 @@ func benchmarkListUnifiedResources(
 	// create user, role, and client
 	username := "user"
 
-	user, err := CreateUser(ctx, srv.Auth(), username, roles...)
+	user, err := authtest.CreateUser(ctx, srv.Auth(), username, roles...)
 	require.NoError(b, err)
 	user.SetTraits(map[string][]string{
 		"group": {"users"},
@@ -6506,7 +7121,7 @@ func benchmarkListUnifiedResources(
 	})
 	user, err = srv.Auth().UpsertUser(ctx, user)
 	require.NoError(b, err)
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(b, err)
 
@@ -6660,16 +7275,16 @@ func TestGenerateHostCert(t *testing.T) {
 				})
 			}
 
-			role, err := CreateRole(ctx, srv.Auth(), test.desc, types.RoleSpecV6{
+			role, err := authtest.CreateRole(ctx, srv.Auth(), test.desc, types.RoleSpecV6{
 				Allow: types.RoleConditions{Rules: rules},
 				Deny:  types.RoleConditions{Rules: denyRules},
 			})
 			require.NoError(t, err)
 
-			user, err := CreateUser(ctx, srv.Auth(), test.desc, role)
+			user, err := authtest.CreateUser(ctx, srv.Auth(), test.desc, role)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			// Try by calling new gRPC endpoint directly
@@ -6687,13 +7302,74 @@ func TestGenerateHostCert(t *testing.T) {
 	}
 }
 
+// newScopedTestServerForHost creates a self-cleaning `ServerWithRoles`, configured
+// for a given host
+func newScopedTestServerForHost(t *testing.T, srv *authtest.AuthServer, hostID, scope string, role types.SystemRole) *auth.ServerWithRoles {
+	authzContext := authz.ContextWithUser(t.Context(), authtest.TestScopedHost(srv.ClusterName, hostID, scope, role).I)
+	ctxIdentity, err := srv.Authorizer.Authorize(authzContext)
+	require.NoError(t, err)
+
+	authWithRole := auth.NewServerWithRoles(
+		srv.AuthServer,
+		srv.AuditLog,
+		*ctxIdentity,
+	)
+
+	t.Cleanup(func() { authWithRole.Close() })
+
+	return authWithRole
+}
+
+func TestGenerateHostCertsScoped(t *testing.T) {
+	ctx := context.Background()
+	srv := newTestTLSServer(t)
+
+	scope := "/aa/bb"
+	hostID := "testhost"
+	roles := types.SystemRoles{types.RoleNode}
+
+	s := newScopedTestServerForHost(t, srv.AuthServer, hostID, scope, types.RoleNode)
+
+	_, sshPub, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	tlsPubPEM, err := keys.MarshalPublicKey(tlsKey.Public())
+	require.NoError(t, err)
+
+	certs, err := s.GenerateHostCerts(ctx, &proto.HostCertsRequest{
+		PublicTLSKey: tlsPubPEM,
+		PublicSSHKey: sshPub,
+		HostID:       hostID,
+		Role:         types.RoleInstance,
+		SystemRoles:  roles,
+	})
+	require.NoError(t, err)
+
+	// ensure scope encoded in TLS cert matches the auth identity
+	tlsCert, err := tlsca.ParseCertificatePEM(certs.TLS)
+	require.NoError(t, err)
+
+	tlsIdent, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
+	require.NoError(t, err)
+	require.Equal(t, scope, tlsIdent.AgentScope)
+
+	// ensure scope encoded in SSH cert matches the auth identity
+	sshCert, err := sshutils.ParseCertificate(certs.SSH)
+	require.NoError(t, err)
+	sshIdent, err := sshca.DecodeIdentity(sshCert)
+	require.NoError(t, err)
+	require.Equal(t, scope, sshIdent.AgentScope)
+}
+
 // TestLocalServiceRolesHavePermissionsForUploaderService verifies that all of Teleport's
 // builtin roles have permissions to execute the calls required by the uploader service.
 // This is because only one uploader service runs per Teleport process, and it will use
 // the first available identity.
 func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
 	require.NoError(t, err, trace.DebugReport(err))
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
 	roles := types.LocalServiceMappings()
 	for _, role := range roles {
@@ -6702,10 +7378,15 @@ func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
 		if role == types.RoleAuth || role == types.RoleMDM || role == types.RoleAccessGraphPlugin {
 			continue
 		}
+		// TODO(espadolini): figure out if the relay service needs to emit
+		// events or not (and if it needs blanket event write access or not).
+		if role == types.RoleRelay {
+			continue
+		}
 
 		t.Run(role.String(), func(t *testing.T) {
 			ctx := context.Background()
-			identity := TestIdentity{
+			identity := authtest.TestIdentity{
 				I: authz.BuiltinRole{
 					Role:                  types.RoleInstance,
 					AdditionalSystemRoles: []types.SystemRole{role},
@@ -6716,13 +7397,13 @@ func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
 			authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, identity.I))
 			require.NoError(t, err)
 
-			s := &ServerWithRoles{
-				authServer: srv.AuthServer,
-				alog:       srv.AuditLog,
-				context:    *authContext,
-			}
-
 			t.Run("GetSessionTracker", func(t *testing.T) {
+				s := auth.NewServerWithRoles(
+					srv.AuthServer,
+					srv.AuditLog,
+					*authContext,
+				)
+
 				sid := session.NewID()
 				tracker, err := s.CreateSessionTracker(ctx, &types.SessionTrackerV1{
 					ResourceHeader: types.ResourceHeader{
@@ -6741,6 +7422,12 @@ func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
 			})
 
 			t.Run("EmitAuditEvent", func(t *testing.T) {
+				s := auth.NewServerWithRoles(
+					srv.AuthServer,
+					srv.AuditLog,
+					*authContext,
+				)
+
 				err := s.EmitAuditEvent(ctx, &apievents.UserLogin{
 					Metadata: apievents.Metadata{
 						Type: events.UserLoginEvent,
@@ -6753,12 +7440,14 @@ func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
 			})
 
 			t.Run("StreamSessionEvents", func(t *testing.T) {
-				// swap out the audit log with a discard log because we don't care if
+				// use a discard log because we don't care if
 				// the streaming actually succeeds, we just want to make sure RBAC checks
 				// pass and allow us to enter the audit log code
-				originalLog := s.alog
-				t.Cleanup(func() { s.alog = originalLog })
-				s.alog = events.NewDiscardAuditLog()
+				s := auth.NewServerWithRoles(
+					srv.AuthServer,
+					events.NewDiscardAuditLog(),
+					*authContext,
+				)
 
 				eventC, errC := s.StreamSessionEvents(ctx, "foo", 0)
 				select {
@@ -6772,12 +7461,24 @@ func TestLocalServiceRolesHavePermissionsForUploaderService(t *testing.T) {
 			})
 
 			t.Run("CreateAuditStream", func(t *testing.T) {
+				s := auth.NewServerWithRoles(
+					srv.AuthServer,
+					srv.AuditLog,
+					*authContext,
+				)
+
 				stream, err := s.CreateAuditStream(ctx, session.ID("streamer"))
 				require.NoError(t, err)
 				require.NoError(t, stream.Close(ctx))
 			})
 
 			t.Run("ResumeAuditStream", func(t *testing.T) {
+				s := auth.NewServerWithRoles(
+					srv.AuthServer,
+					srv.AuditLog,
+					*authContext,
+				)
+
 				stream, err := s.ResumeAuditStream(ctx, session.ID("streamer"), "upload")
 				require.NoError(t, err)
 				require.NoError(t, stream.Close(ctx))
@@ -6793,7 +7494,7 @@ func TestGetActiveSessionTrackers(t *testing.T) {
 		name        string
 		makeRole    func() (types.Role, error)
 		makeTracker func(testUser types.User) (types.SessionTracker, error)
-		extraSetup  func(*testing.T, *TestTLSServer)
+		extraSetup  func(*testing.T, *authtest.TLSServer)
 
 		checkSessionTrackers require.ValueAssertionFunc
 	}
@@ -6959,7 +7660,7 @@ func TestGetActiveSessionTrackers(t *testing.T) {
 					},
 				})
 			},
-			extraSetup: func(t *testing.T, srv *TestTLSServer) {
+			extraSetup: func(t *testing.T, srv *authtest.TLSServer) {
 				originator, err := types.NewUser("session-originator")
 				require.NoError(t, err)
 
@@ -7003,7 +7704,7 @@ func TestGetActiveSessionTrackers(t *testing.T) {
 					},
 				})
 			},
-			extraSetup: func(t *testing.T, srv *TestTLSServer) {
+			extraSetup: func(t *testing.T, srv *authtest.TLSServer) {
 				originator, err := types.NewUser("session-originator")
 				require.NoError(t, err)
 
@@ -7047,7 +7748,7 @@ func TestGetActiveSessionTrackers(t *testing.T) {
 					},
 				})
 			},
-			extraSetup: func(t *testing.T, srv *TestTLSServer) {
+			extraSetup: func(t *testing.T, srv *authtest.TLSServer) {
 				originator, err := types.NewUser("session-originator")
 				require.NoError(t, err)
 
@@ -7095,7 +7796,7 @@ func TestGetActiveSessionTrackers(t *testing.T) {
 			_, err = srv.Auth().CreateSessionTracker(ctx, tracker)
 			require.NoError(t, err)
 
-			clt, err := srv.NewClient(TestUser(user.GetName()))
+			clt, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			found, err := clt.GetActiveSessionTrackers(ctx)
@@ -7146,13 +7847,13 @@ func TestListReleasesPermissions(t *testing.T) {
 
 	for _, tc := range tt {
 		t.Run(tc.Name, func(t *testing.T) {
-			role, err := CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
+			role, err := authtest.CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
 			require.NoError(t, err)
 
-			user, err := CreateUser(ctx, srv.Auth(), "test-user", role)
+			user, err := authtest.CreateUser(ctx, srv.Auth(), "test-user", role)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			_, err = client.ListReleases(ctx)
@@ -7201,13 +7902,13 @@ func TestGetLicensePermissions(t *testing.T) {
 
 	for _, tc := range tt {
 		t.Run(tc.Name, func(t *testing.T) {
-			role, err := CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
+			role, err := authtest.CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
 			require.NoError(t, err)
 
-			user, err := CreateUser(ctx, srv.Auth(), "test-user", role)
+			user, err := authtest.CreateUser(ctx, srv.Auth(), "test-user", role)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			_, err = client.GetLicense(ctx)
@@ -7355,7 +8056,7 @@ func TestCreateSAMLIdPServiceProvider(t *testing.T) {
 	for _, tc := range tt {
 		t.Run(tc.name, func(t *testing.T) {
 			user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: tc.allowRule, Deny: tc.denyRule})
-			client, err := srv.NewClient(TestUser(user))
+			client, err := srv.NewClient(authtest.TestUser(user))
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, client.Close())
@@ -7527,7 +8228,7 @@ func TestUpdateSAMLIdPServiceProvider(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: tc.allowRule, Deny: tc.denyRule})
 
-			client, err := srv.NewClient(TestUser(user))
+			client, err := srv.NewClient(authtest.TestUser(user))
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, client.Close())
@@ -7547,7 +8248,7 @@ func TestCreateSAMLIdPServiceProviderInvalidInputs(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 	user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: samlIdPRoleCondition(types.Labels{"*": []string{"*"}}, types.VerbCreate)})
-	client, err := srv.NewClient(TestUser(user))
+	client, err := srv.NewClient(authtest.TestUser(user))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -7651,7 +8352,7 @@ func TestUpdateSAMLIdPServiceProviderInvalidInputs(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 	user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: samlIdPRoleCondition(types.Labels{"*": []string{"*"}}, types.VerbCreate, types.VerbUpdate)})
-	client, err := srv.NewClient(TestUser(user))
+	client, err := srv.NewClient(authtest.TestUser(user))
 	require.NoError(t, err)
 
 	sp, err := types.NewSAMLIdPServiceProvider(types.Metadata{
@@ -7815,7 +8516,7 @@ func TestDeleteSAMLIdPServiceProvider(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: tc.allowRule, Deny: tc.denyRule})
 
-			client, err := srv.NewClient(TestUser(user))
+			client, err := srv.NewClient(authtest.TestUser(user))
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, client.Close())
@@ -7913,7 +8614,7 @@ func TestDeleteAllSAMLIdPServiceProviders(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			user := createSAMLIdPTestUser(t, srv.Auth(), types.RoleSpecV6{Allow: tc.allowRule, Deny: tc.denyRule})
 
-			client, err := srv.NewClient(TestUser(user))
+			client, err := srv.NewClient(authtest.TestUser(user))
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, client.Close())
@@ -7926,13 +8627,13 @@ func TestDeleteAllSAMLIdPServiceProviders(t *testing.T) {
 	}
 }
 
-func createSAMLIdPTestUser(t *testing.T, server *Server, userRole types.RoleSpecV6) string {
+func createSAMLIdPTestUser(t *testing.T, server *auth.Server, userRole types.RoleSpecV6) string {
 	ctx := context.Background()
 
-	role, err := CreateRole(ctx, server, "test-empty", userRole)
+	role, err := authtest.CreateRole(ctx, server, "test-empty", userRole)
 	require.NoError(t, err)
 
-	user, err := CreateUser(ctx, server, "test-user", role)
+	user, err := authtest.CreateUser(ctx, server, "test-user", role)
 	require.NoError(t, err)
 
 	return user.GetName()
@@ -7954,14 +8655,14 @@ func samlIdPRoleCondition(label types.Labels, verb ...string) (rc types.RoleCond
 }
 
 // modifyAndWaitForEvent performs the function fn() and then waits for the given event.
-func modifyAndWaitForEvent(t *testing.T, errFn require.ErrorAssertionFunc, srv *TestTLSServer, eventCode string, fn func() error) apievents.AuditEvent {
+func modifyAndWaitForEvent(t *testing.T, errFn require.ErrorAssertionFunc, srv *authtest.TLSServer, eventCode string, fn func() error) apievents.AuditEvent {
 	t.Helper()
 	// Make sure we ignore events after consuming this one.
 	defer func() {
-		srv.AuthServer.AuthServer.emitter = events.NewDiscardEmitter()
+		srv.AuthServer.AuthServer.SetEmitter(events.NewDiscardEmitter())
 	}()
 	chanEmitter := eventstest.NewChannelEmitter(1)
-	srv.AuthServer.AuthServer.emitter = chanEmitter
+	srv.AuthServer.AuthServer.SetEmitter(chanEmitter)
 	err := fn()
 	errFn(t, err)
 	select {
@@ -8015,9 +8716,9 @@ func TestGetHeadlessAuthentication(t *testing.T) {
 	otherUsername := "other-user"
 
 	srv := newTestTLSServer(t)
-	_, _, err := CreateUserAndRole(srv.Auth(), username, nil, nil)
+	_, _, err := authtest.CreateUserAndRole(srv.Auth(), username, nil, nil)
 	require.NoError(t, err)
-	_, _, err = CreateUserAndRole(srv.Auth(), otherUsername, nil, nil)
+	_, _, err = authtest.CreateUserAndRole(srv.Auth(), otherUsername, nil, nil)
 	require.NoError(t, err)
 
 	assertTimeout := func(t require.TestingT, err error, _ ...any) {
@@ -8041,26 +8742,26 @@ func TestGetHeadlessAuthentication(t *testing.T) {
 	for _, tc := range []struct {
 		name                  string
 		headlessID            string
-		identity              TestIdentity
+		identity              authtest.TestIdentity
 		assertError           require.ErrorAssertionFunc
 		expectedHeadlessAuthn *types.HeadlessAuthentication
 	}{
 		{
 			name:        "OK same user",
-			identity:    TestUser(username),
+			identity:    authtest.TestUser(username),
 			assertError: require.NoError,
 		}, {
 			name:        "NOK not found",
 			headlessID:  uuid.NewString(),
-			identity:    TestUser(username),
+			identity:    authtest.TestUser(username),
 			assertError: assertTimeout,
 		}, {
 			name:        "NOK different user",
-			identity:    TestUser(otherUsername),
+			identity:    authtest.TestUser(otherUsername),
 			assertError: assertTimeout,
 		}, {
 			name:        "NOK admin",
-			identity:    TestAdmin(),
+			identity:    authtest.TestAdmin(),
 			assertError: assertAccessDenied,
 		},
 	} {
@@ -8069,7 +8770,7 @@ func TestGetHeadlessAuthentication(t *testing.T) {
 			t.Parallel()
 
 			// create headless authn
-			headlessAuthn := newTestHeadlessAuthn(t, username, srv.Auth().clock)
+			headlessAuthn := newTestHeadlessAuthn(t, username, srv.Auth().GetClock())
 			err := srv.Auth().UpsertHeadlessAuthentication(ctx, headlessAuthn)
 			require.NoError(t, err)
 			client, err := srv.NewClient(tc.identity)
@@ -8100,10 +8801,10 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 	mfa := configureForMFA(t, srv)
 
-	_, _, err := CreateUserAndRole(srv.Auth(), otherUsername, nil, nil)
+	_, _, err := authtest.CreateUserAndRole(srv.Auth(), otherUsername, nil, nil)
 	require.NoError(t, err)
 
 	assertNotFound := func(t require.TestingT, err error, i ...interface{}) {
@@ -8119,7 +8820,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 	for _, tc := range []struct {
 		name string
 		// defaults to the mfa identity tied to the headless authentication created
-		identity TestIdentity
+		identity authtest.TestIdentity
 		// defaults to id of the headless authentication created
 		headlessID   string
 		state        types.HeadlessAuthenticationState
@@ -8163,36 +8864,36 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 		}, {
 			name:        "NOK different user not found",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
-			identity:    TestUser(otherUsername),
+			identity:    authtest.TestUser(otherUsername),
 			assertError: assertNotFound,
 		}, {
 			name:        "NOK different user approved",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
-			identity:    TestUser(otherUsername),
+			identity:    authtest.TestUser(otherUsername),
 			assertError: assertNotFound,
 		}, {
 			name:        "NOK admin denied",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
-			identity:    TestAdmin(),
+			identity:    authtest.TestAdmin(),
 			assertError: assertAccessDenied,
 		}, {
 			name:        "NOK admin approved",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
-			identity:    TestAdmin(),
+			identity:    authtest.TestAdmin(),
 			assertError: assertAccessDenied,
 		},
 	} {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			// create headless authn
-			headlessAuthn := newTestHeadlessAuthn(t, mfa.User, srv.Auth().clock)
+			headlessAuthn := newTestHeadlessAuthn(t, mfa.User, srv.Auth().GetClock())
 			headlessAuthn.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING
 			err := srv.Auth().UpsertHeadlessAuthentication(ctx, headlessAuthn)
 			require.NoError(t, err)
 
 			// default to mfa user
 			if tc.identity.I == nil {
-				tc.identity = TestUser(mfa.User)
+				tc.identity = authtest.TestUser(mfa.User)
 			}
 
 			client, err := srv.NewClient(tc.identity)
@@ -8208,7 +8909,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 			}
 
 			if tc.withMFA {
-				client, err := srv.NewClient(TestUser(mfa.User))
+				client, err := srv.NewClient(authtest.TestUser(mfa.User))
 				require.NoError(t, err)
 
 				challenge, err := client.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
@@ -8247,31 +8948,35 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 func TestGenerateCertAuthorityCRL(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	srv, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
+
+	_, err = authtest.CreateRole(ctx, srv.AuthServer.Services, "rolename", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a test user.
-	_, err = CreateUser(ctx, srv.AuthServer.Services, "username")
+	_, err = authtest.CreateUser(ctx, srv.AuthServer.Services, "username")
 	require.NoError(t, err)
 
 	for _, tc := range []struct {
 		desc      string
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		{
 			desc:      "AdminRole",
-			identity:  TestAdmin(),
+			identity:  authtest.TestAdmin(),
 			assertErr: require.NoError,
 		},
 		{
 			desc:      "User",
-			identity:  TestUser("username"),
+			identity:  authtest.TestUserWithRoles("username", []string{"rolename"}),
 			assertErr: require.NoError,
 		},
 		{
 			desc:      "WindowsDesktopService",
-			identity:  TestBuiltin(types.RoleWindowsDesktop),
+			identity:  authtest.TestBuiltin(types.RoleWindowsDesktop),
 			assertErr: require.NoError,
 		},
 	} {
@@ -8279,11 +8984,11 @@ func TestGenerateCertAuthorityCRL(t *testing.T) {
 			authContext, err := srv.Authorizer.Authorize(authz.ContextWithUser(ctx, tc.identity.I))
 			require.NoError(t, err)
 
-			s := &ServerWithRoles{
-				authServer: srv.AuthServer,
-				alog:       srv.AuditLog,
-				context:    *authContext,
-			}
+			s := auth.NewServerWithRoles(
+				srv.AuthServer,
+				srv.AuditLog,
+				*authContext,
+			)
 
 			_, err = s.GenerateCertAuthorityCRL(ctx, types.UserCA)
 			tc.assertErr(t, err)
@@ -8297,23 +9002,23 @@ func TestCreateSnowflakeSession(t *testing.T) {
 	alice, bob, admin := createSessionTestUsers(t, srv.Auth())
 
 	tests := map[string]struct {
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		"as db service": {
-			identity:  TestBuiltin(types.RoleDatabase),
+			identity:  authtest.TestBuiltin(types.RoleDatabase),
 			assertErr: require.NoError,
 		},
 		"as session user": {
-			identity:  TestUser(alice),
+			identity:  authtest.TestUser(alice),
 			assertErr: require.NoError,
 		},
 		"as other user": {
-			identity:  TestUser(bob),
+			identity:  authtest.TestUser(bob),
 			assertErr: require.Error,
 		},
 		"as admin user": {
-			identity:  TestUser(admin),
+			identity:  authtest.TestUser(admin),
 			assertErr: require.NoError,
 		},
 	}
@@ -8339,7 +9044,7 @@ func TestGetSnowflakeSession(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
 	alice, bob, admin := createSessionTestUsers(t, srv.Auth())
-	dbClient, err := srv.NewClient(TestBuiltin(types.RoleDatabase))
+	dbClient, err := srv.NewClient(authtest.TestBuiltin(types.RoleDatabase))
 	require.NoError(t, err)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -8353,23 +9058,23 @@ func TestGetSnowflakeSession(t *testing.T) {
 	require.NoError(t, err)
 
 	tests := map[string]struct {
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		"as db service": {
-			identity:  TestBuiltin(types.RoleDatabase),
+			identity:  authtest.TestBuiltin(types.RoleDatabase),
 			assertErr: require.NoError,
 		},
 		"as session user": {
-			identity:  TestUser(alice),
+			identity:  authtest.TestUser(alice),
 			assertErr: require.NoError,
 		},
 		"as other user": {
-			identity:  TestUser(bob),
+			identity:  authtest.TestUser(bob),
 			assertErr: require.Error,
 		},
 		"as admin user": {
-			identity:  TestUser(admin),
+			identity:  authtest.TestUser(admin),
 			assertErr: require.NoError,
 		},
 	}
@@ -8396,19 +9101,19 @@ func TestGetSnowflakeSessions(t *testing.T) {
 	alice, _, admin := createSessionTestUsers(t, srv.Auth())
 
 	tests := map[string]struct {
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		"as db service": {
-			identity:  TestBuiltin(types.RoleDatabase),
+			identity:  authtest.TestBuiltin(types.RoleDatabase),
 			assertErr: require.NoError,
 		},
 		"as user": {
-			identity:  TestUser(alice),
+			identity:  authtest.TestUser(alice),
 			assertErr: require.Error,
 		},
 		"as admin": {
-			identity:  TestUser(admin),
+			identity:  authtest.TestUser(admin),
 			assertErr: require.NoError,
 		},
 	}
@@ -8427,33 +9132,83 @@ func TestGetSnowflakeSessions(t *testing.T) {
 	}
 }
 
+func TestListSnowflakeSessions(t *testing.T) {
+	t.Parallel()
+	srv := newTestTLSServer(t)
+	alice, bob, admin := createSessionTestUsers(t, srv.Auth())
+
+	client, err := srv.NewClient(authtest.TestBuiltin(types.RoleDatabase))
+	require.NoError(t, err)
+	ctx := t.Context()
+	opts := []cmp.Option{
+		cmpopts.SortSlices(func(a, b types.WebSession) bool {
+			return a.GetName() < b.GetName()
+		}),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	}
+
+	createSession := func(user string) types.WebSession {
+		session, err := client.CreateSnowflakeSession(ctx, types.CreateSnowflakeSessionRequest{
+			Username:     user,
+			TokenTTL:     time.Minute * 15,
+			SessionToken: "test-token-" + user,
+		})
+		require.NoError(t, err)
+		return session
+	}
+
+	expected := []types.WebSession{
+		createSession(alice),
+		createSession(bob),
+		createSession(admin),
+	}
+
+	sessions, next, err := client.ListSnowflakeSessions(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Len(t, sessions, 3)
+	require.Empty(t, cmp.Diff(expected, sessions, opts...))
+
+	page1, next, err := client.ListSnowflakeSessions(ctx, 2, "")
+	require.NoError(t, err)
+	require.NotEmpty(t, next)
+	require.Len(t, page1, 2)
+
+	page2, next, err := client.ListSnowflakeSessions(ctx, 0, next)
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Len(t, page2, 1)
+	require.Empty(t, cmp.Diff(expected, append(page1, page2...), opts...))
+
+}
+
 func TestDeleteSnowflakeSession(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
 	alice, bob, admin := createSessionTestUsers(t, srv.Auth())
 	tests := map[string]struct {
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		"as db service": {
-			identity:  TestBuiltin(types.RoleDatabase),
+			identity:  authtest.TestBuiltin(types.RoleDatabase),
 			assertErr: require.NoError,
 		},
 		"as session user": {
-			identity:  TestUser(alice),
+			identity:  authtest.TestUser(alice),
 			assertErr: require.NoError,
 		},
 		"as other user": {
-			identity:  TestUser(bob),
+			identity:  authtest.TestUser(bob),
 			assertErr: require.Error,
 		},
 		"as admin user": {
-			identity:  TestUser(admin),
+			identity:  authtest.TestUser(admin),
 			assertErr: require.NoError,
 		},
 	}
 
-	dbClient, err := srv.NewClient(TestBuiltin(types.RoleDatabase))
+	dbClient, err := srv.NewClient(authtest.TestBuiltin(types.RoleDatabase))
 	require.NoError(t, err)
 	for name, test := range tests {
 		test := test
@@ -8483,19 +9238,19 @@ func TestDeleteAllSnowflakeSessions(t *testing.T) {
 	alice, _, admin := createSessionTestUsers(t, srv.Auth())
 
 	tests := map[string]struct {
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 		assertErr require.ErrorAssertionFunc
 	}{
 		"as db service": {
-			identity:  TestBuiltin(types.RoleDatabase),
+			identity:  authtest.TestBuiltin(types.RoleDatabase),
 			assertErr: require.NoError,
 		},
 		"as user": {
-			identity:  TestUser(alice),
+			identity:  authtest.TestUser(alice),
 			assertErr: require.Error,
 		},
 		"as admin user": {
-			identity:  TestUser(admin),
+			identity:  authtest.TestUser(admin),
 			assertErr: require.NoError,
 		},
 	}
@@ -8515,15 +9270,15 @@ func TestDeleteAllSnowflakeSessions(t *testing.T) {
 }
 
 // Create test users for web session CRUD authz tests.
-func createSessionTestUsers(t *testing.T, authServer *Server) (string, string, string) {
+func createSessionTestUsers(t *testing.T, authServer *auth.Server) (string, string, string) {
 	t.Helper()
 	// create alice and bob who have no permissions.
-	_, _, err := CreateUserAndRole(authServer, "alice", nil, []types.Rule{})
+	_, _, err := authtest.CreateUserAndRole(authServer, "alice", nil, []types.Rule{})
 	require.NoError(t, err)
-	_, _, err = CreateUserAndRole(authServer, "bob", nil, []types.Rule{})
+	_, _, err = authtest.CreateUserAndRole(authServer, "bob", nil, []types.Rule{})
 	require.NoError(t, err)
 	// create "admin" who has read/write on users and web sessions.
-	_, _, err = CreateUserAndRole(authServer, "admin", nil, []types.Rule{
+	_, _, err = authtest.CreateUserAndRole(authServer, "admin", nil, []types.Rule{
 		types.NewRule(types.KindUser, services.RW()),
 		types.NewRule(types.KindWebSession, services.RW()),
 	})
@@ -8685,7 +9440,7 @@ func TestCreateAccessRequest(t *testing.T) {
 			ctx := context.Background()
 			require.NoError(t, srv.Auth().DeleteAllAccessRequests(ctx))
 
-			client, err := srv.NewClient(TestUser(test.user))
+			client, err := srv.NewClient(authtest.TestUser(test.user))
 			require.NoError(t, err)
 
 			req, err := client.CreateAccessRequestV2(ctx, test.accessRequest)
@@ -9135,7 +9890,7 @@ func TestAccessRequestNonGreedyAnnotations(t *testing.T) {
 			}
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 			res, err := client.CreateAccessRequestV2(ctx, req)
 			if tc.errfn == nil {
@@ -9213,7 +9968,7 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 
 	testCases := []*struct {
 		name             string
-		identity         TestIdentity
+		identity         authtest.TestIdentity
 		filter           types.HeadlessAuthenticationFilter
 		expectWatchError string
 		expectEvents     []types.Event
@@ -9221,18 +9976,18 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 	}{
 		{
 			name:             "NOK non local users cannot watch headless authentications",
-			identity:         TestAdmin(),
+			identity:         authtest.TestAdmin(),
 			expectWatchError: "non-local user roles cannot watch headless authentications",
 		},
 		{
 			name:             "NOK must filter for username",
-			identity:         TestUser(admin),
+			identity:         authtest.TestUser(admin),
 			filter:           types.HeadlessAuthenticationFilter{},
 			expectWatchError: "user cannot watch headless authentications without a filter for their username",
 		},
 		{
 			name:     "NOK alice cannot filter for username=bob",
-			identity: TestUser(alice),
+			identity: authtest.TestUser(alice),
 			filter: types.HeadlessAuthenticationFilter{
 				Username: bob,
 			},
@@ -9240,7 +9995,7 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 		},
 		{
 			name:     "OK alice can filter for username=alice",
-			identity: TestUser(alice),
+			identity: authtest.TestUser(alice),
 			filter: types.HeadlessAuthenticationFilter{
 				Username: alice,
 			},
@@ -9248,7 +10003,7 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 		},
 		{
 			name:     "OK bob can filter for username=bob",
-			identity: TestUser(bob),
+			identity: authtest.TestUser(bob),
 			filter: types.HeadlessAuthenticationFilter{
 				Username: bob,
 			},
@@ -9256,7 +10011,7 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 		},
 		{
 			name:     "OK alice can filter for pending requests",
-			identity: TestUser(alice),
+			identity: authtest.TestUser(alice),
 			filter: types.HeadlessAuthenticationFilter{
 				Username: alice,
 				State:    types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING,
@@ -9265,7 +10020,7 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 		},
 		{
 			name:     "OK alice can filter for a specific request",
-			identity: TestUser(alice),
+			identity: authtest.TestUser(alice),
 			filter: types.HeadlessAuthenticationFilter{
 				Username: alice,
 				Name:     headlessAuthns[2].GetName(),
@@ -9353,6 +10108,146 @@ func TestWatchHeadlessAuthentications_usersCanOnlyWatchThemselves(t *testing.T)
 	})
 }
 
+// TestScopedRoleEvents verifies the basic functionality of the events API for the ScopedRole family of types.
+func TestScopedRoleEvents(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	srv := newTestTLSServer(t, withCacheEnabled(true))
+
+	// get an admin client
+	client, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	watcher, err := client.NewWatcher(ctx, types.Watch{
+		Kinds: []types.WatchKind{
+			{
+				Kind: scopedaccess.KindScopedRole,
+			},
+			{
+				Kind: scopedaccess.KindScopedRoleAssignment,
+			},
+		},
+	})
+	require.NoError(t, err)
+	defer watcher.Close()
+
+	// as of time of writing, CRUD methods for scoped access resources are not
+	// exposed yet, so for the purposes of this test we're just going to write
+	// to the backend directly.
+	service := local.NewScopedAccessService(srv.AuthServer.Backend)
+
+	getNextEvent := func() types.Event {
+		select {
+		case event := <-watcher.Events():
+			return event
+		case <-watcher.Done():
+			require.FailNow(t, "Watcher exited with error", watcher.Error())
+		case <-time.After(time.Second * 5):
+			require.FailNow(t, "Timeout waiting for event", watcher.Error())
+		}
+
+		panic("unreachable")
+	}
+
+	event := getNextEvent()
+	require.Equal(t, types.OpInit, event.Type)
+
+	// Create a ScopedRole and verify create event is well-formed.
+	role := &scopedaccessv1.ScopedRole{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: &headerv1.Metadata{
+			Name: "test-role",
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleSpec{
+			AssignableScopes: []string{"/foo", "/bar"},
+		},
+		Version: types.V1,
+	}
+
+	crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: role,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpPut, event.Type)
+
+	resource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]).UnwrapT()
+	require.Empty(t, cmp.Diff(crsp.Role, resource, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// delete the role and verify delete event is well-formed.
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: role.Metadata.Name,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpDelete, event.Type)
+
+	require.Empty(t, cmp.Diff(&types.ResourceHeader{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: types.Metadata{
+			Name: role.Metadata.Name,
+		},
+	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
+
+	// recreate scoped role so that we can use it for testing assignment events
+	crsp, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: role,
+	})
+	require.NoError(t, err)
+
+	_ = getNextEvent() // drain the role create event
+
+	assignment := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "alice",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  role.Metadata.Name,
+					Scope: "/foo",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	acrsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment,
+		RoleRevisions: map[string]string{
+			role.Metadata.Name: crsp.Role.Metadata.Revision,
+		},
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpPut, event.Type)
+	assignmentResource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]).UnwrapT()
+	require.Empty(t, cmp.Diff(acrsp.Assignment, assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// delete the assignment and verify delete event is well-formed.
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: assignment.Metadata.Name,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpDelete, event.Type)
+
+	require.Empty(t, cmp.Diff(&types.ResourceHeader{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: types.Metadata{
+			Name: assignment.Metadata.Name,
+		},
+	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
+}
+
 func TestKubeKeepAliveServer(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
@@ -9423,10 +10318,11 @@ func TestKubeKeepAliveServer(t *testing.T) {
 			require.NoError(t, err)
 
 			// Create a server with the built-in role.
-			srv := ServerWithRoles{
-				authServer: srv.Auth(),
-				context:    *authContext,
-			}
+			srv := auth.NewServerWithRoles(
+				srv.Auth(),
+				events.NewDiscardAuditLog(),
+				*authContext,
+			)
 			// Keep alive the server.
 			err = srv.KeepAliveServer(context.Background(),
 				types.KeepAlive{
@@ -9503,11 +10399,12 @@ func TestIsMFARequired_AdminAction(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			server := ServerWithRoles{
-				context: authz.Context{
+			server := auth.NewServerWithRoles(
+				nil, nil,
+				authz.Context{
 					AdminActionAuthState: tt.adminActionAuthState,
-				},
-			}
+				})
+
 			resp, err := server.IsMFARequired(context.Background(), &proto.IsMFARequiredRequest{
 				Target: &proto.IsMFARequiredRequest_AdminAction{},
 			})
@@ -9568,7 +10465,7 @@ func TestCloudDefaultPasswordless(t *testing.T) {
 			ctx := context.Background()
 			srv := newTestTLSServer(t)
 
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: modules.BuildEnterprise,
 				TestFeatures: modules.Features{
 					Cloud: tc.cloud,
@@ -9589,12 +10486,12 @@ func TestCloudDefaultPasswordless(t *testing.T) {
 
 			// the test server doesn't create the preset users, so we call createPresetUsers manually
 			if tc.withPresetUsers {
-				createPresetUsers(ctx, srv.Auth())
+				auth.CreatePresetUsers(ctx, srv.Auth())
 			}
 
 			// create preexisting users
 			for i := 0; i < tc.qtyPreexistingUsers; i += 1 {
-				_, _, err = CreateUserAndRole(srv.Auth(), fmt.Sprintf("testuser-%d", i), nil /* allowedLogins */, nil /* allowRules */)
+				_, _, err = authtest.CreateUserAndRole(srv.Auth(), fmt.Sprintf("testuser-%d", i), nil /* allowedLogins */, nil /* allowRules */)
 				require.NoError(t, err)
 			}
 
@@ -9616,7 +10513,7 @@ func TestCloudDefaultPasswordless(t *testing.T) {
 			_, err = srv.Auth().UpsertRole(ctx, role)
 			require.NoError(t, err)
 
-			client, err := srv.NewClient(TestUser(user.GetName()))
+			client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			// setup to change authentication method to passkey
@@ -9633,7 +10530,7 @@ func TestCloudDefaultPasswordless(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			_, registerSolved, err := NewTestDeviceFromChallenge(registerChal, WithPasswordless())
+			_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal, authtest.WithPasswordless())
 			require.NoError(t, err)
 
 			_, err = client.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
@@ -9776,7 +10673,6 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 	// GIVEN a test cluster...
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
-	s := newTestServerWithRoles(t, srv.AuthServer, types.RoleAdmin)
 
 	// GIVEN an Identity Center Account with some associated Permission Set
 	// resources
@@ -9798,26 +10694,23 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		},
 	}
 
-	_, err := s.authServer.CreateIdentityCenterAccount(ctx,
-		services.IdentityCenterAccount{
-			Account: &identitycenterv1.Account{
-				Kind:    types.KindIdentityCenterAccount,
-				Version: types.V1,
-				Metadata: &headerv1.Metadata{
-					Name: accountID,
-					Labels: map[string]string{
-						types.OriginLabel: apicommon.OriginAWSIdentityCenter,
-					},
-				},
-				Spec: &identitycenterv1.AccountSpec{
-					Id:                accountID,
-					Arn:               "aws:arn:test:account",
-					Name:              "Test Account",
-					Description:       "An account for testing",
-					PermissionSetInfo: permissionSets,
-				},
+	_, err := srv.AuthServer.AuthServer.CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+		Kind:    types.KindIdentityCenterAccount,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: accountID,
+			Labels: map[string]string{
+				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
-		})
+		},
+		Spec: &identitycenterv1.AccountSpec{
+			Id:                accountID,
+			Arn:               "aws:arn:test:account",
+			Name:              "Test Account",
+			Description:       "An account for testing",
+			PermissionSetInfo: permissionSets,
+		},
+	})
 	require.NoError(t, err)
 
 	// GIVEN a role that allows access to all permission sets on the target
@@ -9834,9 +10727,9 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 	})
 	require.NoError(t, err, "Constructing role should succeed")
 	_, err = srv.Auth().CreateRole(ctx, roleAccessAll)
-	require.NoError(t, err, "Cretaing role should succeed")
+	require.NoError(t, err, "Creating role should succeed")
 
-	withRequesterRole := WithRoleMutator(func(role types.Role) {
+	withRequesterRole := authtest.WithRoleMutator(func(role types.Role) {
 		r := role.(*types.RoleV6)
 		r.Spec.Allow.Request = &types.AccessRequestConditions{
 			SearchAsRoles: []string{allAccessRoleName},
@@ -9846,8 +10739,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 	// EXPECT that the IC Account has made it to the cache
 	inlineEventually(t,
 		func() bool {
-			testAssignments, _, err := srv.Auth().ListIdentityCenterAccounts(
-				ctx, 100, &pagination.PageRequestToken{})
+			testAssignments, _, err := srv.Auth().ListIdentityCenterAccounts(ctx, 100, "")
 			require.NoError(t, err)
 			return len(testAssignments) == 1
 		},
@@ -9856,14 +10748,14 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 
 	testCases := []struct {
 		name                   string
-		roleModifiers          []CreateUserAndRoleOption
+		roleModifiers          []authtest.CreateUserAndRoleOption
 		includeRequestable     bool
 		expectedPSs            []*types.IdentityCenterPermissionSet
 		expectedRequireRequest require.BoolAssertionFunc
 	}{
 		{
 			name: "basic access",
-			roleModifiers: []CreateUserAndRoleOption{
+			roleModifiers: []authtest.CreateUserAndRoleOption{
 				withAccountAssignment(types.Allow, accountID, permissionSets[0].Arn),
 				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
 			},
@@ -9875,7 +10767,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		},
 		{
 			name: "ignore search as roles when disabled",
-			roleModifiers: []CreateUserAndRoleOption{
+			roleModifiers: []authtest.CreateUserAndRoleOption{
 				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
 				withRequesterRole,
 			},
@@ -9887,7 +10779,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		},
 		{
 			name: "requestable access",
-			roleModifiers: []CreateUserAndRoleOption{
+			roleModifiers: []authtest.CreateUserAndRoleOption{
 				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
 				withRequesterRole,
 			},
@@ -9901,7 +10793,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		},
 		{
 			name: "no access",
-			roleModifiers: []CreateUserAndRoleOption{
+			roleModifiers: []authtest.CreateUserAndRoleOption{
 				withAccountAssignment(types.Allow, accountID, "some-non-existent-ps"),
 			},
 			expectedRequireRequest: require.False,
@@ -9912,12 +10804,12 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			// GIVEN a user who has a role that allows a test-defined level of
 			// Identity Center access
-			user, _, err := CreateUserAndRole(srv.Auth(), testUserName(test.name),
+			user, _, err := authtest.CreateUserAndRole(srv.Auth(), testUserName(test.name),
 				nil, nil, test.roleModifiers...)
 			require.NoError(t, err)
 
 			// GIVEN an auth client using the above user
-			identity := TestUser(user.GetName())
+			identity := authtest.TestUser(user.GetName())
 			clt, err := srv.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { clt.Close() })
@@ -10044,16 +10936,14 @@ func TestValidateOracleJoinToken(t *testing.T) {
 		}
 		for _, tc := range tests {
 			t.Run(tc.name, func(t *testing.T) {
-				tc.assert(t, validateOracleJoinToken(tc.token))
+				tc.assert(t, auth.ValidateOracleJoinToken(tc.token))
 			})
 		}
 	})
 }
 
-func newTestAppServerV3(t *testing.T, auth *Server, name string, labels map[string]string) *types.AppServerV3 {
+func createTestAppServerV3(t *testing.T, auth *auth.Server, name string, labels map[string]string) *types.AppServerV3 {
 	t.Helper()
-	ctx := context.Background()
-
 	app, err := types.NewAppV3(
 		types.Metadata{
 			Name:   name,
@@ -10064,10 +10954,15 @@ func newTestAppServerV3(t *testing.T, auth *Server, name string, labels map[stri
 		},
 	)
 	require.NoError(t, err)
+	return createTestAppServerFromApp(t, auth, app)
+}
+
+func createTestAppServerFromApp(t *testing.T, auth *auth.Server, app *types.AppV3) *types.AppServerV3 {
+	t.Helper()
 	appServer, err := types.NewAppServerV3(
 		types.Metadata{
-			Name:   name,
-			Labels: labels,
+			Name:   app.GetName(),
+			Labels: app.GetAllLabels(),
 		},
 		types.AppServerSpecV3{
 			HostID: "test-host-id",
@@ -10076,12 +10971,30 @@ func newTestAppServerV3(t *testing.T, auth *Server, name string, labels map[stri
 	)
 	require.NoError(t, err)
 
-	_, err = auth.UpsertApplicationServer(ctx, appServer)
+	_, err = auth.UpsertApplicationServer(t.Context(), appServer)
 	require.NoError(t, err, "upserting test Application Server")
 
 	return appServer
 }
 
+func createTestMCPAppServer(t *testing.T, auth *auth.Server, name string, labels map[string]string) *types.AppServerV3 {
+	t.Helper()
+	mcp, err := types.NewAppV3(
+		types.Metadata{
+			Name:   name,
+			Labels: labels,
+		},
+		types.AppSpecV3{
+			MCP: &types.MCP{
+				Command:       "test",
+				RunAsHostUser: "test",
+			},
+		},
+	)
+	require.NoError(t, err)
+	return createTestAppServerFromApp(t, auth, mcp)
+}
+
 func TestSAMLIdPRoleOptionCreateUpdateValidation(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
diff --git a/lib/auth/authclient/api.go b/lib/auth/authclient/api.go
index ab837bd47562e..5bde70c6413ff 100644
--- a/lib/auth/authclient/api.go
+++ b/lib/auth/authclient/api.go
@@ -21,6 +21,7 @@ package authclient
 import (
 	"context"
 	"io"
+	"iter"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -28,13 +29,16 @@ import (
 
 	"github.com/gravitational/teleport/api/client/gitserver"
 	"github.com/gravitational/teleport/api/client/proto"
+	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
 	accessmonitoringrules "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
 	crownjewelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/crownjewel/v1"
+	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
@@ -43,9 +47,9 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 // Announcer specifies interface responsible for announcing presence
@@ -157,6 +161,9 @@ type NodeAccessPoint interface {
 
 	// accessPoint provides common access point functionality
 	accessPoint
+
+	// ScopedRoleReader returns a read-only scoped role client.
+	ScopedRoleReader() services.ScopedRoleReader
 }
 
 // ReadProxyAccessPoint is a read only API interface implemented by a certificate authority (CA) to be
@@ -167,6 +174,10 @@ type ReadProxyAccessPoint interface {
 	// Closer closes all the resources
 	io.Closer
 
+	// HealthCheckConfigReader defines methods for fetching health check config
+	// resources.
+	services.HealthCheckConfigReader
+
 	// NewWatcher returns a new event watcher.
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
@@ -194,6 +205,9 @@ type ReadProxyAccessPoint interface {
 	// GetUIConfig returns configuration for the UI served by the proxy service
 	GetUIConfig(ctx context.Context) (types.UIConfig, error)
 
+	// GetToken finds and returns token by ID
+	GetToken(ctx context.Context, token string) (types.ProvisionToken, error)
+
 	// GetRole returns role by name
 	GetRole(ctx context.Context, name string) (types.Role, error)
 
@@ -210,11 +224,25 @@ type ReadProxyAccessPoint interface {
 	GetNodes(ctx context.Context, namespace string) ([]types.Server, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetAuthServers returns a list of auth servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListAuthServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetAuthServers() ([]types.Server, error)
 
+	// ListAuthServers returns a paginated list of auth servers registered in the cluster
+	ListAuthServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// ListReverseTunnels returns a list of reverse tunnels with pagination.
 	ListReverseTunnels(ctx context.Context, pageSize int, nextToken string) ([]types.ReverseTunnel, string, error)
 
@@ -230,6 +258,12 @@ type ReadProxyAccessPoint interface {
 	// GetApps returns all application resources.
 	GetApps(ctx context.Context) ([]types.Application, error)
 
+	// ListApps returns a page of application resources.
+	ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error)
+
+	// Apps returns application resources within the range [start, end).
+	Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error]
+
 	// GetApp returns the specified application resource.
 	GetApp(ctx context.Context, name string) (types.Application, error)
 
@@ -270,6 +304,12 @@ type ReadProxyAccessPoint interface {
 	// GetDatabases returns all database resources.
 	GetDatabases(ctx context.Context) ([]types.Database, error)
 
+	// ListDatabases returns a page of database resources.
+	ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error)
+
+	// RangeDatabases returns database resources within the range [start, end).
+	RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error]
+
 	// GetDatabase returns the specified database resource.
 	GetDatabase(ctx context.Context, name string) (types.Database, error)
 
@@ -283,6 +323,10 @@ type ReadProxyAccessPoint interface {
 
 	// GetKubernetesClusters returns all kubernetes cluster resources.
 	GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error)
+	// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+	RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error]
 	// GetKubernetesCluster returns the specified kubernetes cluster resource.
 	GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error)
 
@@ -309,6 +353,14 @@ type ReadProxyAccessPoint interface {
 
 	// GitServerReadOnlyClient returns the read-only client for Git servers.
 	GitServerReadOnlyClient() gitserver.ReadOnlyClient
+
+	// GetRelayServer returns the relay server heartbeat with a given name.
+	GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error)
+	// ListRelayServers returns a paginated list of relay server heartbeats.
+	ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencev1.RelayServer, nextPageToken string, _ error)
+
+	// ListIntegrations returns a paginated list of all integration resources.
+	ListIntegrations(ctx context.Context, pageSize int, nextToken string) ([]types.Integration, string, error)
 }
 
 // SnowflakeSessionWatcher is watcher interface used by Snowflake web session watcher.
@@ -327,6 +379,38 @@ type ProxyAccessPoint interface {
 
 	// accessPoint provides common access point functionality
 	accessPoint
+
+	// ScopedRoleReader returns a read-only scoped role client.
+	ScopedRoleReader() services.ScopedRoleReader
+}
+
+// ReadRelayAccessPoint is a read only API interface to be used by a Relay
+// service.
+//
+// NOTE: This interface must be a subset of the [*cache.Cache] methods usable in the
+// cache configured by [cache.ForRelay].
+type ReadRelayAccessPoint interface {
+	io.Closer
+	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
+
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool) (types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool) ([]types.CertAuthority, error)
+
+	GetAuthPreference(ctx context.Context) (types.AuthPreference, error)
+
+	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
+
+	GetNodes(ctx context.Context, namespace string) ([]types.Server, error)
+
+	GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error)
+
+	GetRole(ctx context.Context, name string) (types.Role, error)
+
+	GetSessionRecordingConfig(ctx context.Context) (types.SessionRecordingConfig, error)
+
+	GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error)
+
+	GetKubernetesServers(ctx context.Context) ([]types.KubeServer, error)
 }
 
 // ReadRemoteProxyAccessPoint is a read only API interface implemented by a certificate authority (CA) to be
@@ -374,11 +458,25 @@ type ReadRemoteProxyAccessPoint interface {
 	GetNodes(ctx context.Context, namespace string) ([]types.Server, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetAuthServers returns a list of auth servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListAuthServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetAuthServers() ([]types.Server, error)
 
+	// ListAuthServers returns a paginated list of auth servers registered in the cluster
+	ListAuthServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetAllTunnelConnections returns all tunnel connections
 	GetAllTunnelConnections(opts ...services.MarshalOption) ([]types.TunnelConnection, error)
 
@@ -407,6 +505,15 @@ type ReadRemoteProxyAccessPoint interface {
 	GetWindowsDesktopService(ctx context.Context, name string) (types.WindowsDesktopService, error)
 }
 
+// RelayAccessPoint is the top-level access point interface required by a Relay service.
+type RelayAccessPoint interface {
+	// ReadRelayAccessPoint provides methods to read data
+	ReadRelayAccessPoint
+
+	// ScopedRoleReader returns a read-only scoped role client.
+	ScopedRoleReader() services.ScopedRoleReader
+}
+
 // RemoteProxyAccessPoint is an API interface implemented by a certificate authority (CA) to be
 // used by a teleport.ComponentProxy.
 type RemoteProxyAccessPoint interface {
@@ -415,6 +522,11 @@ type RemoteProxyAccessPoint interface {
 
 	// accessPoint provides common access point functionality
 	accessPoint
+
+	// ScopedRoleReader returns a read-only scoped role client.
+	// TODO(fspmarshall/scopes): remove the need for this. this is only here to satisfy the common
+	// interface used by lib/srv components. scoped access is not support for cross-cluster operations.
+	ScopedRoleReader() services.ScopedRoleReader
 }
 
 // ReadKubernetesAccessPoint is an API interface implemented by a certificate authority (CA) to be
@@ -425,6 +537,10 @@ type ReadKubernetesAccessPoint interface {
 	// Closer closes all the resources
 	io.Closer
 
+	// HealthCheckConfigReader defines methods for fetching health check config
+	// resources.
+	services.HealthCheckConfigReader
+
 	// NewWatcher returns a new event watcher.
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
@@ -473,6 +589,10 @@ type ReadKubernetesAccessPoint interface {
 
 	// GetKubernetesClusters returns all kubernetes cluster resources.
 	GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error)
+	// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+	RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error]
 	// GetKubernetesCluster returns the specified kubernetes cluster resource.
 	GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error)
 }
@@ -529,11 +649,24 @@ type ReadAppsAccessPoint interface {
 	GetRoles(ctx context.Context) ([]types.Role, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetApps returns all application resources.
 	GetApps(ctx context.Context) ([]types.Application, error)
 
+	// ListApps returns a page of application resources.
+	ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error)
+
+	// Apps returns application resources within the range [start, end).
+	Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error]
+
 	// GetApp returns the specified application resource.
 	GetApp(ctx context.Context, name string) (types.Application, error)
 }
@@ -599,6 +732,12 @@ type ReadDatabaseAccessPoint interface {
 	// GetDatabases returns all database resources.
 	GetDatabases(ctx context.Context) ([]types.Database, error)
 
+	// ListDatabases returns a page of database resources.
+	ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error)
+
+	// RangeDatabases returns database resources within the range [start, end).
+	RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error]
+
 	// GetDatabase returns the specified database resource.
 	GetDatabase(ctx context.Context, name string) (types.Database, error)
 }
@@ -654,14 +793,20 @@ type ReadWindowsDesktopAccessPoint interface {
 	// GetRoles returns a list of roles
 	GetRoles(ctx context.Context) ([]types.Role, error)
 
-	// GetWindowsDesktops returns windows desktop hosts.
-	GetWindowsDesktops(ctx context.Context, filter types.WindowsDesktopFilter) ([]types.WindowsDesktop, error)
+	// ListWindowsDesktops returns Windows desktop hosts.
+	ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error)
 
-	// GetWindowsDesktopServices returns windows desktop hosts.
-	GetWindowsDesktopServices(ctx context.Context) ([]types.WindowsDesktopService, error)
+	// ListWindowsDesktopServices returns Windows desktop services.
+	ListWindowsDesktopServices(ctx context.Context, req types.ListWindowsDesktopServicesRequest) (*types.ListWindowsDesktopServicesResponse, error)
 
-	// GetWindowsDesktopService returns a windows desktop host by name.
+	// GetWindowsDesktopService returns a Windows desktop service by name.
 	GetWindowsDesktopService(ctx context.Context, name string) (types.WindowsDesktopService, error)
+
+	// GetDynamicWindowsDesktop gets a dynamic Windows desktop by name.
+	GetDynamicWindowsDesktop(ctx context.Context, name string) (types.DynamicWindowsDesktop, error)
+
+	// ListDynamicWindowsDesktops returns dynamic Windows desktops.
+	ListDynamicWindowsDesktops(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error)
 }
 
 // WindowsDesktopAccessPoint is an API interface implemented by a certificate authority (CA) to be
@@ -700,16 +845,34 @@ type ReadDiscoveryAccessPoint interface {
 	GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error)
 	// GetKubernetesClusters returns all kubernetes cluster resources.
 	GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error)
+	// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+	RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error]
 	// GetKubernetesServers returns all registered kubernetes servers.
 	GetKubernetesServers(ctx context.Context) ([]types.KubeServer, error)
 
 	// GetDatabases returns all database resources.
 	GetDatabases(ctx context.Context) ([]types.Database, error)
+
+	// ListDatabases returns a page of database resources.
+	ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error)
+
+	// RangeDatabases returns database resources within the range [start, end).
+	RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error]
+
 	// GetDatabase returns a database resource with the given name if it exists.
 	GetDatabase(ctx context.Context, name string) (types.Database, error)
 
 	// GetApps returns all application resources.
 	GetApps(context.Context) ([]types.Application, error)
+
+	// ListApps returns a page of application resources.
+	ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error)
+
+	// Apps returns application resources within the range [start, end).
+	Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error]
+
 	// GetApp returns the specified application resource.
 	GetApp(ctx context.Context, name string) (types.Application, error)
 
@@ -720,8 +883,15 @@ type ReadDiscoveryAccessPoint interface {
 	GetIntegration(ctx context.Context, name string) (types.Integration, error)
 
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetUserTask gets a single User Task by its name.
 	GetUserTask(ctx context.Context, name string) (*usertasksv1.UserTask, error)
 }
@@ -806,8 +976,15 @@ type ReadOktaAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, nextToken string) ([]types.Server, string, error)
+
 	// GetAuthPreference returns the cluster authentication configuration.
 	GetAuthPreference(ctx context.Context) (types.AuthPreference, error)
 
@@ -846,6 +1023,12 @@ type ReadOktaAccessPoint interface {
 
 	// GetLocks lists the locks that target a given set of resources.
 	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
+
+	// ListLocks returns a page of locks matching a filter.
+	ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error)
+
+	// RangeLocks returns locks within the range [start, end) matching a filter.
+	RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error]
 }
 
 // OktaAccessPoint is a read caching interface used by an Okta component.
@@ -961,11 +1144,25 @@ type Cache interface {
 	GetNodes(ctx context.Context, namespace string) ([]types.Server, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of proxy servers registered in the cluster
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+
 	// GetAuthServers returns a list of auth servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListAuthServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetAuthServers() ([]types.Server, error)
 
+	// ListAuthServers returns a paginated list of auth servers registered in the cluster
+	ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+
 	// GetCertAuthority returns cert authority by id
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 
@@ -996,6 +1193,12 @@ type Cache interface {
 	// GetApps returns all application resources.
 	GetApps(ctx context.Context) ([]types.Application, error)
 
+	// ListApps returns a page of application resources.
+	ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error)
+
+	// Apps returns application resources within the range [start, end).
+	Apps(ctx context.Context, startKey, endKey string) iter.Seq2[types.Application, error]
+
 	// GetApp returns the specified application resource.
 	GetApp(ctx context.Context, name string) (types.Application, error)
 
@@ -1011,6 +1214,15 @@ type Cache interface {
 	// GetSnowflakeSession gets a Snowflake web session.
 	GetSnowflakeSession(context.Context, types.GetSnowflakeSessionRequest) (types.WebSession, error)
 
+	// GetSnowflakeSessions returns all Snowflake session resources.
+	GetSnowflakeSessions(ctx context.Context) ([]types.WebSession, error)
+
+	// ListSnowflakeSessions returns a page of Snowflake session resources.
+	ListSnowflakeSessions(ctx context.Context, limit int, startKey string) ([]types.WebSession, string, error)
+
+	// RangeSnowflakeSessions returns Snowflake session resources within the range [start, end).
+	RangeSnowflakeSessions(ctx context.Context, start, end string) iter.Seq2[types.WebSession, error]
+
 	// GetWebSession gets a web session for the given request
 	GetWebSession(context.Context, types.GetWebSessionRequest) (types.WebSession, error)
 
@@ -1042,6 +1254,12 @@ type Cache interface {
 	// GetDatabases returns all database resources.
 	GetDatabases(ctx context.Context) ([]types.Database, error)
 
+	// ListDatabases returns a page of database resources.
+	ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error)
+
+	// RangeDatabases returns database resources within the range [start, end).
+	RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error]
+
 	// GetDatabase returns the specified database resource.
 	GetDatabase(ctx context.Context, name string) (types.Database, error)
 
@@ -1064,10 +1282,7 @@ type Cache interface {
 	ListDynamicWindowsDesktops(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error)
 
 	// GetStaticTokens gets the list of static tokens used to provision nodes.
-	GetStaticTokens() (types.StaticTokens, error)
-
-	// GetTokens returns all active (non-expired) provisioning tokens
-	GetTokens(ctx context.Context) ([]types.ProvisionToken, error)
+	GetStaticTokens(ctx context.Context) (types.StaticTokens, error)
 
 	// GetToken finds and returns token by ID
 	GetToken(ctx context.Context, token string) (types.ProvisionToken, error)
@@ -1085,6 +1300,18 @@ type Cache interface {
 	// services.LockWatcher that provides the necessary freshness guarantees.
 	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
 
+	// ListLocks returns a page of locks.
+	// NOTE: This method is intentionally available only for the auth server
+	// cache, the other Teleport components should make use of
+	// services.LockWatcher that provides the necessary freshness guarantees.
+	ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error)
+
+	// RangeLocks returns locks within the range [start, end).
+	// NOTE: This method is intentionally available only for the auth server
+	// cache, the other Teleport components should make use of
+	// services.LockWatcher that provides the necessary freshness guarantees.
+	RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error]
+
 	// ListResources returns a paginated list of resources.
 	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
 	// ListWindowsDesktops returns a paginated list of windows desktops.
@@ -1100,9 +1327,17 @@ type Cache interface {
 
 	// GetInstallers gets all the installer resources.
 	GetInstallers(ctx context.Context) ([]types.Installer, error)
+	// ListInstallers returns a page of installer script resources.
+	ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error)
+	// RangeInstallers returns installer script resources within the range [start, end).
+	RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error]
 
 	// GetKubernetesClusters returns all kubernetes cluster resources.
 	GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error)
+	// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+	RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error]
 	// GetKubernetesCluster returns the specified kubernetes cluster resource.
 	GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error)
 
@@ -1125,22 +1360,18 @@ type Cache interface {
 	GetAccessLists(context.Context) ([]*accesslist.AccessList, error)
 	// ListAccessLists returns a paginated list of access lists.
 	ListAccessLists(context.Context, int, string) ([]*accesslist.AccessList, string, error)
+	// ListAccessListsV2 returns a paginated list of access lists.
+	ListAccessListsV2(context.Context, *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error)
 	// GetAccessList returns the specified access list resource.
 	GetAccessList(context.Context, string) (*accesslist.AccessList, error)
 
 	// CountAccessListMembers will count all access list members.
 	CountAccessListMembers(ctx context.Context, accessListName string) (users uint32, lists uint32, err error)
 	// ListAccessListMembers returns a paginated list of all access list members.
-	// May return a DynamicAccessListError if the requested access list has an
-	// implicit member list and the underlying implementation does not have
-	// enough information to compute the dynamic member list.
 	ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
 	// ListAllAccessListMembers returns a paginated list of all members of all access lists.
 	ListAllAccessListMembers(ctx context.Context, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
 	// GetAccessListMember returns the specified access list member resource.
-	// May return a DynamicAccessListError if the requested access list has an
-	// implicit member list and the underlying implementation does not have
-	// enough information to compute the dynamic member record.
 	GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error)
 
 	// ListAccessListReviews will list access list reviews for a particular access list.
@@ -1188,6 +1419,9 @@ type Cache interface {
 	// ListAutoUpdateAgentReports lists all AutoUpdateAgentReports from the backend.
 	ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pageToken string) ([]*autoupdate.AutoUpdateAgentReport, string, error)
 
+	// GetAutoUpdateBotInstanceReport gets the singleton AutoUpdateBotInstanceReport from the backend.
+	GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdate.AutoUpdateBotInstanceReport, error)
+
 	// GetAccessGraphSettings returns the access graph settings.
 	GetAccessGraphSettings(context.Context) (*clusterconfigpb.AccessGraphSettings, error)
 
@@ -1201,7 +1435,7 @@ type Cache interface {
 	GetWorkloadIdentity(ctx context.Context, name string) (*workloadidentityv1pb.WorkloadIdentity, error)
 	// ListWorkloadIdentities lists all SPIFFE Federations using Google style
 	// pagination.
-	ListWorkloadIdentities(ctx context.Context, pageSize int, lastToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error)
+	ListWorkloadIdentities(ctx context.Context, pageSize int, lastToken string, options *services.ListWorkloadIdentitiesRequestOptions) ([]*workloadidentityv1pb.WorkloadIdentity, string, error)
 
 	// ListStaticHostUsers lists static host users.
 	ListStaticHostUsers(ctx context.Context, pageSize int, startKey string) ([]*userprovisioningpb.StaticHostUser, string, error)
@@ -1212,10 +1446,16 @@ type Cache interface {
 	GetProvisioningState(context.Context, services.DownstreamID, services.ProvisioningStateID) (*provisioningv1.PrincipalState, error)
 
 	// GetAccountAssignment fetches specific IdentityCenter Account Assignment
-	GetAccountAssignment(context.Context, services.IdentityCenterAccountAssignmentID) (services.IdentityCenterAccountAssignment, error)
+	GetIdentityCenterAccountAssignment(context.Context, string) (*identitycenterv1.AccountAssignment, error)
 
+	// ListIdentityCenterAccounts fetches a paginated list of IdentityCenter Accounts.
+	ListIdentityCenterAccounts(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.Account, string, error)
 	// ListAccountAssignments fetches a paginated list of IdentityCenter Account Assignments
-	ListAccountAssignments(context.Context, int, *pagination.PageRequestToken) ([]services.IdentityCenterAccountAssignment, pagination.NextPageToken, error)
+	ListIdentityCenterAccountAssignments(context.Context, int, string) ([]*identitycenterv1.AccountAssignment, string, error)
+	// ListPrincipalAssignments fetches a paginated list of IdentityCenter Principal Assignments.
+	ListPrincipalAssignments(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PrincipalAssignment, string, error)
+	// ListProvisioningStatesForAllDownstreams fetches a paginated list of ProvisioningStates.
+	ListProvisioningStatesForAllDownstreams(ctx context.Context, pageSize int, pageToken string) ([]*provisioningv1.PrincipalState, string, error)
 
 	// GetPluginStaticCredentialsByLabels will get a list of plugin static credentials resource by matching labels.
 	GetPluginStaticCredentialsByLabels(ctx context.Context, labels map[string]string) ([]types.PluginStaticCredentials, error)
@@ -1223,9 +1463,29 @@ type Cache interface {
 	// GitServerGetter defines methods for fetching Git servers.
 	services.GitServerGetter
 
-	// HealthCheckConfigReader defines methods for fetching health checkc config
+	// HealthCheckConfigReader defines methods for fetching health check config
 	// resources.
 	services.HealthCheckConfigReader
+
+	// GetRelayServer returns the relay server heartbeat with a given name.
+	GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error)
+	// ListRelayServers returns a paginated list of relay server heartbeats.
+	ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencev1.RelayServer, nextPageToken string, _ error)
+
+	// GetBotInstance returns the specified BotInstance resource.
+	GetBotInstance(ctx context.Context, botName, instanceID string) (*machineidv1.BotInstance, error)
+
+	// ListBotInstances returns a page of BotInstance resources.
+	ListBotInstances(ctx context.Context, pageSize int, lastToken string, options *services.ListBotInstancesRequestOptions) ([]*machineidv1.BotInstance, string, error)
+
+	// ListProvisionTokens returns a paginated list of provision tokens.
+	ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error)
+
+	// UserLoginStatesGetter defines methods for fetching user login states.
+	services.UserLoginStatesGetter
+
+	// DiscoveryConfigsGetter defines methods for fetching discovery configs.
+	services.DiscoveryConfigsGetter
 }
 
 type NodeWrapper struct {
@@ -1242,6 +1502,12 @@ func NewNodeWrapper(base NodeAccessPoint, cache ReadNodeAccessPoint) NodeAccessP
 	}
 }
 
+func (w *NodeWrapper) ScopedRoleReader() services.ScopedRoleReader {
+	// TODO(fspmarshall/scopes): implement caching for scoped roles
+	// on node agents.
+	return w.NoCache.ScopedRoleReader()
+}
+
 // Close closes all associated resources
 func (w *NodeWrapper) Close() error {
 	err := w.NoCache.Close()
@@ -1263,6 +1529,12 @@ func NewProxyWrapper(base ProxyAccessPoint, cache ReadProxyAccessPoint) ProxyAcc
 	}
 }
 
+func (w *ProxyWrapper) ScopedRoleReader() services.ScopedRoleReader {
+	// TODO(fspmarshall/scopes): implement caching for scoped roles
+	// on proxies.
+	return w.NoCache.ScopedRoleReader()
+}
+
 // Close closes all associated resources
 func (w *ProxyWrapper) Close() error {
 	err := w.NoCache.Close()
@@ -1270,6 +1542,33 @@ func (w *ProxyWrapper) Close() error {
 	return trace.NewAggregate(err, err2)
 }
 
+// RelayWrapper is a wrapper around a RelayAccessPoint that manages delegation
+// of read and write operations between a cached and non-cached access point.
+type RelayWrapper struct {
+	ReadRelayAccessPoint
+	NoCache RelayAccessPoint
+}
+
+// NewRelayWrapper creates a new RelayWrapper from the provided cache and upstream.
+func NewRelayWrapper(base RelayAccessPoint, cache ReadRelayAccessPoint) RelayAccessPoint {
+	return &RelayWrapper{
+		NoCache:              base,
+		ReadRelayAccessPoint: cache,
+	}
+}
+
+// ScopedRoleReader returns the scoped role reader from the non-cached access point.
+func (w *RelayWrapper) ScopedRoleReader() services.ScopedRoleReader {
+	return w.NoCache.ScopedRoleReader()
+}
+
+// Close closes all associated resources
+func (w *RelayWrapper) Close() error {
+	err := w.NoCache.Close()
+	err2 := w.ReadRelayAccessPoint.Close()
+	return trace.NewAggregate(err, err2)
+}
+
 type RemoteProxyWrapper struct {
 	ReadRemoteProxyAccessPoint
 	accessPoint
@@ -1284,6 +1583,10 @@ func NewRemoteProxyWrapper(base RemoteProxyAccessPoint, cache ReadRemoteProxyAcc
 	}
 }
 
+func (w *RemoteProxyWrapper) ScopedRoleReader() services.ScopedRoleReader {
+	return w.NoCache.ScopedRoleReader()
+}
+
 // Close closes all associated resources
 func (w *RemoteProxyWrapper) Close() error {
 	err := w.NoCache.Close()
@@ -1565,7 +1868,23 @@ func (w *OktaWrapper) DeleteApplicationServer(ctx context.Context, namespace, ho
 
 // GetLocks fetches locks that target a given set of resources
 func (w *OktaWrapper) GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error) {
-	return w.NoCache.GetLocks(ctx, inForceOnly, targets...)
+	return clientutils.CollectWithFallback(
+		ctx,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			filter := &types.LockFilter{
+				InForceOnly: inForceOnly,
+				Targets:     make([]*types.LockTarget, 0, len(targets)),
+			}
+			for _, tgt := range targets {
+				filter.Targets = append(filter.Targets, &tgt)
+			}
+			return w.NoCache.ListLocks(ctx, limit, start, filter)
+		},
+		func(ctx context.Context) ([]types.Lock, error) {
+			// TODO(okraport): DELETE IN v21
+			return w.NoCache.GetLocks(ctx, inForceOnly, targets...)
+		},
+	)
 }
 
 // UpsertLock creates and/or updates lock resources
diff --git a/lib/auth/authclient/clt.go b/lib/auth/authclient/clt.go
index 1fe16a082c6fe..b91f1dc9564c0 100644
--- a/lib/auth/authclient/clt.go
+++ b/lib/auth/authclient/clt.go
@@ -21,6 +21,7 @@ package authclient
 import (
 	"context"
 	"errors"
+	"iter"
 	"net"
 	"net/url"
 	"time"
@@ -43,16 +44,16 @@ import (
 	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
 	dbobjectimportrulev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobjectimportrule/v1"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
-	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
-	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingmetadatav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
 	resourceusagepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/resourceusage/v1"
 	samlidppb "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
 	stableunixusersv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/stableunixusers/v1"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
@@ -84,7 +85,7 @@ var (
 	// ErrNoMFADevices is returned when an MFA ceremony is performed without possible devices to
 	// complete the challenge with.
 	ErrNoMFADevices = &trace.AccessDeniedError{
-		Message: "MFA is required to access this resource but user has no MFA devices; see Account Settings in the Web UI or use 'tsh mfa add' to register MFA devices",
+		Message: "Multi-factor authentication (MFA) is required to access this resource but the current user has no supported MFA devices enrolled; see Account Settings in the Web UI or use 'tsh mfa add' to register an MFA device",
 	}
 	// InvalidUserPassError is the error for when either the provided username or
 	// password is incorrect.
@@ -379,16 +380,6 @@ func (c *Client) PatchRemoteCluster(ctx context.Context, name string, updateFn f
 	return nil, trace.NotImplemented(notImplementedMessage)
 }
 
-// ListWindowsDesktops not implemented: can only be called locally.
-func (c *Client) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	return nil, trace.NotImplemented(notImplementedMessage)
-}
-
-// ListWindowsDesktopServices not implemented: can only be called locally.
-func (c *Client) ListWindowsDesktopServices(ctx context.Context, req types.ListWindowsDesktopServicesRequest) (*types.ListWindowsDesktopServicesResponse, error) {
-	return nil, trace.NotImplemented(notImplementedMessage)
-}
-
 const (
 	// UserTokenTypeResetPasswordInvite is a token type used for the UI invite flow that
 	// allows users to change their password and set second factor (if enabled).
@@ -567,7 +558,7 @@ func (c *Client) DeleteClusterAuditConfig(ctx context.Context) error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
-func (c *Client) UpdatePresence(ctx context.Context, sessionID, user string) error {
+func (c *Client) UpdatePresence(ctx context.Context, _, _, _ string) error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
@@ -621,6 +612,10 @@ func (c *Client) IntegrationAWSOIDCClient() integrationv1.AWSOIDCServiceClient {
 	return integrationv1.NewAWSOIDCServiceClient(c.APIClient.GetConnection())
 }
 
+func (c *Client) IntegrationAWSRolesAnywhereClient() integrationv1.AWSRolesAnywhereServiceClient {
+	return integrationv1.NewAWSRolesAnywhereServiceClient(c.APIClient.GetConnection())
+}
+
 // UserTasksClient returns a client for managing User Task resources.
 func (c *Client) UserTasksClient() services.UserTasks {
 	return c.APIClient.UserTasksServiceClient()
@@ -656,8 +651,8 @@ func (c *Client) DeleteStaticTokens() error {
 }
 
 // GetStaticTokens returns a list of static register tokens
-func (c *Client) GetStaticTokens() (types.StaticTokens, error) {
-	return nil, trace.NotImplemented(notImplementedMessage)
+func (c *Client) GetStaticTokens(ctx context.Context) (types.StaticTokens, error) {
+	return c.APIClient.GetStaticTokens(ctx)
 }
 
 // SetStaticTokens sets a list of static register tokens
@@ -665,6 +660,12 @@ func (c *Client) SetStaticTokens(st types.StaticTokens) error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
+// ScopedRoleReader returns a read-only scoped role client. Having this method lets us reduce the surface
+// are of the scoped access API available in agent access points to only what is necessary.
+func (c *Client) ScopedRoleReader() services.ScopedRoleReader {
+	return c.APIClient.ScopedAccessServiceClient()
+}
+
 // UpsertUserNotificationState creates or updates a user notification state which records whether the user has clicked on or dismissed a notification.
 func (c *Client) UpsertUserNotificationState(ctx context.Context, username string, uns *notificationsv1.UserNotificationState) (*notificationsv1.UserNotificationState, error) {
 	return c.APIClient.UpsertUserNotificationState(ctx, &notificationsv1.UpsertUserNotificationStateRequest{
@@ -856,6 +857,9 @@ type OIDCAuthResponse struct {
 	HostSigners []types.CertAuthority `json:"host_signers"`
 	// MFAToken is an SSO MFA token.
 	MFAToken string `json:"mfa_token"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // OIDCAuthRequest is an OIDC auth request that supports standard json marshaling.
@@ -903,6 +907,9 @@ type SAMLAuthResponse struct {
 	HostSigners []types.CertAuthority `json:"host_signers"`
 	// MFAToken is an SSO MFA token.
 	MFAToken string `json:"mfa_token"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // SAMLAuthRequest is a SAML auth request that supports standard json marshaling.
@@ -942,6 +949,9 @@ type GithubAuthResponse struct {
 	// HostSigners is a list of signing host public keys
 	// trusted by proxy, used in console login
 	HostSigners []types.CertAuthority `json:"host_signers"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // GithubAuthRequest is an Github auth request that supports standard json marshaling
@@ -981,6 +991,12 @@ type IdentityService interface {
 	GetOIDCConnector(ctx context.Context, id string, withSecrets bool) (types.OIDCConnector, error)
 	// GetOIDCConnectors gets valid OIDC connectors list
 	GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]types.OIDCConnector, error)
+	// ListOIDCConnectors returns a page of valid registered connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListOIDCConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.OIDCConnector, string, error)
+	// RangeOIDCConnectors returns valid registered connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeOIDCConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.OIDCConnector, error]
 	// DeleteOIDCConnector deletes OIDC connector by ID
 	DeleteOIDCConnector(ctx context.Context, connectorID string) error
 	// CreateOIDCAuthRequest creates OIDCAuthRequest
@@ -1004,6 +1020,13 @@ type IdentityService interface {
 	GetSAMLConnectors(ctx context.Context, withSecrets bool) ([]types.SAMLConnector, error)
 	// GetSAMLConnectorsWithValidationOptions gets valid SAML connectors list
 	GetSAMLConnectorsWithValidationOptions(ctx context.Context, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, error)
+	// ListSAMLConnectorsWithOptions returns a page of valid registered SAML connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListSAMLConnectorsWithOptions(ctx context.Context, limit int, start string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, string, error)
+	// RangeSAMLConnectorsWithOptions returns valid registered SAML connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeSAMLConnectorsWithOptions(ctx context.Context, start, end string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) iter.Seq2[types.SAMLConnector, error]
+
 	// DeleteSAMLConnector deletes SAML connector by ID
 	DeleteSAMLConnector(ctx context.Context, connectorID string) error
 	// CreateSAMLAuthRequest creates SAML AuthnRequest
@@ -1021,6 +1044,12 @@ type IdentityService interface {
 	UpsertGithubConnector(ctx context.Context, connector types.GithubConnector) (types.GithubConnector, error)
 	// GetGithubConnectors returns valid Github connectors
 	GetGithubConnectors(ctx context.Context, withSecrets bool) ([]types.GithubConnector, error)
+	// ListGithubConnectors returns a page of valid registered Github connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error)
+	// RangeGithubConnectors returns valid registered Github connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error]
 	// GetGithubConnector returns the specified Github connector
 	GetGithubConnector(ctx context.Context, id string, withSecrets bool) (types.GithubConnector, error)
 	// DeleteGithubConnector deletes the specified Github connector
@@ -1094,6 +1123,8 @@ type IdentityService interface {
 
 	// GetResetPasswordToken returns a reset password token.
 	GetResetPasswordToken(ctx context.Context, username string) (types.UserToken, error)
+	// ListResetPasswordTokens returns a page of user tokens.
+	ListResetPasswordTokens(ctx context.Context, pageSize int, nextKey string) ([]types.UserToken, string, error)
 
 	// GetMFADevices fetches all MFA devices registered for the calling user.
 	GetMFADevices(ctx context.Context, in *proto.GetMFADevicesRequest) (*proto.GetMFADevicesResponse, error)
@@ -1146,6 +1177,8 @@ type IdentityService interface {
 // of adding new nodes, auth servers and proxies to the cluster
 type ProvisioningService interface {
 	// GetTokens returns a list of active invitation tokens for nodes and users
+	// Deprecated: use [ListProvisionTokens] istead.
+	// TODO(hugoShaka): DELETE IN 19.0.0
 	GetTokens(ctx context.Context) (tokens []types.ProvisionToken, err error)
 
 	// GetToken returns provisioning token
@@ -1172,6 +1205,9 @@ type ProvisioningService interface {
 	// RegisterUsingToken calls the auth service API to register a new node via registration token
 	// which has been previously issued via GenerateToken
 	RegisterUsingToken(ctx context.Context, req *types.RegisterUsingTokenRequest) (*proto.Certs, error)
+
+	// ListProvisionTokens retrieves a paginated list of provision tokens.
+	ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error)
 }
 
 type ValidateTrustedClusterRequest struct {
@@ -1271,6 +1307,11 @@ type AuthenticateUserRequest struct {
 	// Username is a username
 	Username string `json:"username"`
 
+	// Scope, if non-empty, makes the authentication scoped. Scoping does not change core authentication
+	// behavior, but results in a more limited (scoped) set of credentials being issued upon successful
+	// authentication and some differences in locking behavior.
+	Scope string `json:"scope,omitempty"`
+
 	// SSHPublicKey is a public key in ssh authorized_keys format.
 	SSHPublicKey []byte `json:"ssh_public_key,omitempty"`
 	// TLSPublicKey is a public key in PEM-encoded PKCS#1 or PKIX format.
@@ -1298,6 +1339,9 @@ type ForwardedClientMetadata struct {
 	// either from a direct client connection, or from a PROXY protocol header
 	// if the connection is forwarded through a load balancer.
 	RemoteAddr string `json:"remote_addr,omitempty"`
+	// ProxyGroupID is reverse tunnel group ID, used by reverse tunnel agents
+	// in proxy peering mode.
+	ProxyGroupID string `json:"proxy_group_id,omitempty"`
 }
 
 // CheckAndSetDefaults checks and sets defaults
@@ -1384,6 +1428,17 @@ type SSHLoginResponse struct {
 	SAMLSingleLogoutEnabled bool `json:"samlSingleLogoutEnabled"`
 	// MFAToken is an SSO MFA token.
 	MFAToken string `json:"mfa_token"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
+}
+
+// ClientOptions contains options passed from the control plane to the client at
+// login time.
+type ClientOptions struct {
+	// DefaultRelayAddr is the cluster-specified address of the relay in use, to
+	// be used if the client does not otherwise specify a relay.
+	DefaultRelayAddr string `json:"default_relay_addr"`
 }
 
 // TrustedCerts contains host certificates, it preserves backwards compatibility
@@ -1440,7 +1495,7 @@ type ClientI interface {
 	services.DynamicAccess
 	services.DynamicAccessOracle
 	services.Restrictions
-	services.Apps
+	services.Applications
 	services.Databases
 	services.DatabaseServices
 	services.Kubernetes
@@ -1459,11 +1514,14 @@ type ClientI interface {
 	services.VnetConfigGetter
 	services.HealthCheckConfig
 	types.Events
+	services.ScopedAccessClientGetter
 
 	types.WebSessionsGetter
-	types.WebTokensGetter
+	services.WebToken
 
 	DynamicDesktopClient() *dynamicwindows.Client
+	GetDynamicWindowsDesktop(ctx context.Context, name string) (types.DynamicWindowsDesktop, error)
+	ListDynamicWindowsDesktops(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error)
 
 	// TrustClient returns a client to the Trust service.
 	TrustClient() trustpb.TrustServiceClient
@@ -1488,6 +1546,9 @@ type ClientI interface {
 	// IntegrationAWSOIDCClient returns a client to the Integration AWS OIDC gRPC service.
 	IntegrationAWSOIDCClient() integrationv1.AWSOIDCServiceClient
 
+	// IntegrationAWSRolesAnywhereClient returns a client to the Integration AWS OIDC gRPC service.
+	IntegrationAWSRolesAnywhereClient() integrationv1.AWSRolesAnywhereServiceClient
+
 	// UserTasksServiceClient returns an User Task service client.
 	UserTasksServiceClient() *usertask.Client
 
@@ -1648,6 +1709,13 @@ type ClientI interface {
 	// (as per the default gRPC behavior).
 	BotInstanceServiceClient() machineidv1pb.BotInstanceServiceClient
 
+	// WorkloadIdentityResourceServiceClient returns a client for interacting
+	// with workload identity resources.
+	// Clients connecting to  older Teleport versions, still get an access list
+	// client when calling this method, but all RPCs will return "not
+	// implemented" errors (as per the default gRPC behavior).
+	WorkloadIdentityResourceServiceClient() workloadidentityv1pb.WorkloadIdentityResourceServiceClient
+
 	// UserLoginStateClient returns a user login state client.
 	// Clients connecting to older Teleport versions still get a user login state client
 	// when calling this method, but all RPCs will return "not implemented" errors
@@ -1752,12 +1820,6 @@ type ClientI interface {
 	// GenerateAppToken creates a JWT token with application access.
 	GenerateAppToken(ctx context.Context, req types.GenerateAppTokenRequest) (string, error)
 
-	// IdentityCenterClient returns Identity Center service client.
-	IdentityCenterClient() identitycenterv1.IdentityCenterServiceClient
-
-	// ProvisioningServiceClient returns provisioning service client.
-	ProvisioningServiceClient() provisioningv1.ProvisioningServiceClient
-
 	// IntegrationsClient returns integrations client.
 	IntegrationsClient() integrationv1.IntegrationServiceClient
 
@@ -1766,4 +1828,19 @@ type ClientI interface {
 
 	// GitServerReadOnlyClient returns the read-only client for Git servers.
 	GitServerReadOnlyClient() gitserver.ReadOnlyClient
+
+	// RecordingMetadataServiceClient returns a client for the session recording
+	// metadata service.
+	RecordingMetadataServiceClient() recordingmetadatav1.RecordingMetadataServiceClient
+
+	// SummarizerServiceClient returns a client for the session recording
+	// summarizer service.
+	SummarizerServiceClient() summarizerv1.SummarizerServiceClient
+
+	// ListRequestableRoles is a paginated requestable role getter.
+	ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error)
+
+	// ScopedRoleReader returns a read-only scoped role client. Having this method lets us reduce the surface
+	// are of the scoped access API available in agent access points to only what is necessary.
+	ScopedRoleReader() services.ScopedRoleReader
 }
diff --git a/lib/auth/authclient/http_client.go b/lib/auth/authclient/http_client.go
index 10a0bbfb68081..4a3abe7573b9b 100644
--- a/lib/auth/authclient/http_client.go
+++ b/lib/auth/authclient/http_client.go
@@ -423,27 +423,6 @@ func (c *HTTPClient) UpsertAuthServer(ctx context.Context, s types.Server) error
 	return trace.Wrap(err)
 }
 
-// GetAuthServers returns the list of auth servers registered in the cluster.
-func (c *HTTPClient) GetAuthServers() ([]types.Server, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("authservers"), url.Values{})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	var items []json.RawMessage
-	if err := json.Unmarshal(out.Bytes(), &items); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	re := make([]types.Server, len(items))
-	for i, raw := range items {
-		server, err := services.UnmarshalServer(raw, types.KindAuthServer)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		re[i] = server
-	}
-	return re, nil
-}
-
 // UpsertProxy is used by proxies to report their presence
 // to other auth servers in form of heartbeat expiring after ttl period.
 func (c *HTTPClient) UpsertProxy(ctx context.Context, s types.Server) error {
@@ -458,27 +437,6 @@ func (c *HTTPClient) UpsertProxy(ctx context.Context, s types.Server) error {
 	return trace.Wrap(err)
 }
 
-// GetProxies returns the list of auth servers registered in the cluster.
-func (c *HTTPClient) GetProxies() ([]types.Server, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("proxies"), url.Values{})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	var items []json.RawMessage
-	if err := json.Unmarshal(out.Bytes(), &items); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	re := make([]types.Server, len(items))
-	for i, raw := range items {
-		server, err := services.UnmarshalServer(raw, types.KindProxy)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		re[i] = server
-	}
-	return re, nil
-}
-
 // DeleteAllProxies deletes all proxies
 func (c *HTTPClient) DeleteAllProxies() error {
 	_, err := c.Delete(context.TODO(), c.Endpoint("proxies"))
@@ -600,6 +558,9 @@ type OIDCAuthRawResponse struct {
 	HostSigners []json.RawMessage `json:"host_signers"`
 	// MFAToken is an SSO MFA token.
 	MFAToken string `json:"mfa_token"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // ValidateOIDCAuthCallback validates OIDC auth callback returned from redirect
@@ -615,12 +576,13 @@ func (c *HTTPClient) ValidateOIDCAuthCallback(ctx context.Context, q url.Values)
 		return nil, trace.Wrap(err)
 	}
 	response := OIDCAuthResponse{
-		Username: rawResponse.Username,
-		Identity: rawResponse.Identity,
-		Cert:     rawResponse.Cert,
-		Req:      rawResponse.Req,
-		TLSCert:  rawResponse.TLSCert,
-		MFAToken: rawResponse.MFAToken,
+		Username:      rawResponse.Username,
+		Identity:      rawResponse.Identity,
+		Cert:          rawResponse.Cert,
+		Req:           rawResponse.Req,
+		TLSCert:       rawResponse.TLSCert,
+		MFAToken:      rawResponse.MFAToken,
+		ClientOptions: rawResponse.ClientOptions,
 	}
 	if len(rawResponse.Session) != 0 {
 		session, err := services.UnmarshalWebSession(rawResponse.Session)
@@ -672,6 +634,9 @@ type SAMLAuthRawResponse struct {
 	TLSCert []byte `json:"tls_cert,omitempty"`
 	// MFAToken is an SSO MFA token.
 	MFAToken string `json:"mfa_token"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // ValidateSAMLResponse validates response returned by SAML identity provider
@@ -689,12 +654,13 @@ func (c *HTTPClient) ValidateSAMLResponse(ctx context.Context, samlResponse, con
 		return nil, trace.Wrap(err)
 	}
 	response := SAMLAuthResponse{
-		Username: rawResponse.Username,
-		Identity: rawResponse.Identity,
-		Cert:     rawResponse.Cert,
-		Req:      rawResponse.Req,
-		TLSCert:  rawResponse.TLSCert,
-		MFAToken: rawResponse.MFAToken,
+		Username:      rawResponse.Username,
+		Identity:      rawResponse.Identity,
+		Cert:          rawResponse.Cert,
+		Req:           rawResponse.Req,
+		TLSCert:       rawResponse.TLSCert,
+		MFAToken:      rawResponse.MFAToken,
+		ClientOptions: rawResponse.ClientOptions,
 	}
 	if len(rawResponse.Session) != 0 {
 		session, err := services.UnmarshalWebSession(rawResponse.Session)
@@ -738,6 +704,9 @@ type githubAuthRawResponse struct {
 	// HostSigners is a list of signing host public keys
 	// trusted by proxy, used in console login
 	HostSigners []json.RawMessage `json:"host_signers"`
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions ClientOptions `json:"client_options"`
 }
 
 // ValidateGithubAuthCallback validates Github auth callback returned from redirect
@@ -752,11 +721,12 @@ func (c *HTTPClient) ValidateGithubAuthCallback(ctx context.Context, q url.Value
 		return nil, trace.Wrap(err)
 	}
 	response := GithubAuthResponse{
-		Username: rawResponse.Username,
-		Identity: rawResponse.Identity,
-		Cert:     rawResponse.Cert,
-		Req:      rawResponse.Req,
-		TLSCert:  rawResponse.TLSCert,
+		Username:      rawResponse.Username,
+		Identity:      rawResponse.Identity,
+		Cert:          rawResponse.Cert,
+		Req:           rawResponse.Req,
+		TLSCert:       rawResponse.TLSCert,
+		ClientOptions: rawResponse.ClientOptions,
 	}
 	if len(rawResponse.Session) != 0 {
 		session, err := services.UnmarshalWebSession(
diff --git a/lib/auth/authclient/httpfallback.go b/lib/auth/authclient/httpfallback.go
index 0fd2125f79aaf..023a10dfa0825 100644
--- a/lib/auth/authclient/httpfallback.go
+++ b/lib/auth/authclient/httpfallback.go
@@ -20,6 +20,7 @@ package authclient
 
 import (
 	"context"
+	"encoding/json"
 	"net/url"
 
 	"github.com/gravitational/trace"
@@ -58,3 +59,53 @@ func (c *HTTPClient) getClusterName(ctx context.Context) (types.ClusterName, err
 
 	return cn, err
 }
+
+// GetAuthServers returns the list of auth servers registered in the cluster.
+//
+// Deprecated: Prefer paginated variant [APIClient.ListAuthServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
+func (c *HTTPClient) GetAuthServers() ([]types.Server, error) {
+	out, err := c.Get(context.TODO(), c.Endpoint("authservers"), url.Values{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	var items []json.RawMessage
+	if err := json.Unmarshal(out.Bytes(), &items); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	re := make([]types.Server, len(items))
+	for i, raw := range items {
+		server, err := services.UnmarshalServer(raw, types.KindAuthServer)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		re[i] = server
+	}
+	return re, nil
+}
+
+// GetProxies returns the list of auth servers registered in the cluster.
+//
+// Deprecated: Prefer paginated variant [APIClient.ListProxyServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
+func (c *HTTPClient) GetProxies() ([]types.Server, error) {
+	out, err := c.Get(context.TODO(), c.Endpoint("proxies"), url.Values{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	var items []json.RawMessage
+	if err := json.Unmarshal(out.Bytes(), &items); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	re := make([]types.Server, len(items))
+	for i, raw := range items {
+		server, err := services.UnmarshalServer(raw, types.KindProxy)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		re[i] = server
+	}
+	return re, nil
+}
diff --git a/lib/auth/authtest/authtest.go b/lib/auth/authtest/authtest.go
new file mode 100644
index 0000000000000..febaf0b8ee082
--- /dev/null
+++ b/lib/auth/authtest/authtest.go
@@ -0,0 +1,1758 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package authtest
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/breaker"
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/accesspoint"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
+	authority "github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/cache"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/limiter"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// AuthServerConfig is auth server test config
+type AuthServerConfig struct {
+	// ClusterName is cluster name
+	ClusterName string
+	// ClusterID is the cluster ID; optional - sets to random UUID string if not present
+	ClusterID string
+	// Dir is directory for local backend
+	Dir string
+	// AcceptedUsage is an optional list of restricted
+	// server usage
+	AcceptedUsage []string
+	// CipherSuites is the list of ciphers that the server supports.
+	CipherSuites []uint16
+	// Clock is used to control time in tests.
+	Clock clockwork.Clock
+	// ClusterNetworkingConfig allows a test to change the default
+	// networking configuration.
+	ClusterNetworkingConfig types.ClusterNetworkingConfig
+	// UploadHandler allows a test to set its own upload handler. This setting is
+	// propagated to AuditLog, but only if they are not customized here.
+	UploadHandler events.MultipartHandler
+	// Streamer allows a test to set its own session recording streamer.
+	Streamer events.Streamer
+	// AuditLog allows a test to configure its own audit log.
+	AuditLog events.AuditLogSessionStreamer
+	// SessionSummarizerProvider allows a test to configure its own session
+	// summarizer provider.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider allows a test to configure its own recording
+	RecordingMetadataProvider *recordingmetadata.Provider
+	// TraceClient allows a test to configure the trace client
+	TraceClient otlptrace.Client
+	// AuthPreferenceSpec is custom initial AuthPreference spec for the test.
+	AuthPreferenceSpec *types.AuthPreferenceSpecV2
+	// CacheEnabled enables the primary auth server cache.
+	CacheEnabled bool
+	// RunWhileLockedRetryInterval is the interval to retry the run while locked
+	// operation.
+	RunWhileLockedRetryInterval time.Duration
+	// FIPS means the cluster should run in FIPS mode.
+	FIPS bool
+	// KeystoreConfig is configuration for the CA keystore.
+	KeystoreConfig servicecfg.KeystoreConfig
+}
+
+// CheckAndSetDefaults checks and sets defaults
+func (cfg *AuthServerConfig) CheckAndSetDefaults() error {
+	if cfg.ClusterName == "" {
+		cfg.ClusterName = "localhost"
+	}
+	if cfg.Dir == "" {
+		return trace.BadParameter("missing parameter Dir")
+	}
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewFakeClock()
+	}
+	if len(cfg.CipherSuites) == 0 {
+		cfg.CipherSuites = utils.DefaultCipherSuites()
+	}
+	if cfg.AuthPreferenceSpec == nil {
+		cfg.AuthPreferenceSpec = &types.AuthPreferenceSpecV2{
+			Type:         constants.Local,
+			SecondFactor: constants.SecondFactorOff,
+		}
+	}
+	if cfg.UploadHandler == nil {
+		cfg.UploadHandler = eventstest.NewMemoryUploader()
+	}
+	return nil
+}
+
+// Server defines the set of server components for a test
+type Server struct {
+	TLS        *TLSServer
+	AuthServer *AuthServer
+}
+
+// ServerConfig defines the configuration for all server components
+type ServerConfig struct {
+	// Auth specifies the auth server configuration
+	Auth AuthServerConfig
+	// TLS optionally specifies the configuration for the TLS server.
+	// If unspecified, will be generated automatically
+	TLS *TLSServerConfig
+}
+
+// NewTestServer creates a new test server configuration
+func NewTestServer(cfg ServerConfig) (*Server, error) {
+	authServer, err := NewAuthServer(cfg.Auth)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Set the (test) auth server in cfg.TLS and set any defaults that
+	// are not set.
+	tlsCfg := cfg.TLS
+	if tlsCfg == nil {
+		tlsCfg = &TLSServerConfig{}
+	}
+	if tlsCfg.APIConfig == nil {
+		tlsCfg.APIConfig = &auth.APIConfig{}
+	}
+
+	tlsCfg.AuthServer = authServer
+	tlsCfg.APIConfig.AuthServer = authServer.AuthServer
+
+	if tlsCfg.APIConfig.Authorizer == nil {
+		tlsCfg.APIConfig.Authorizer = authServer.Authorizer
+	}
+	if tlsCfg.APIConfig.ScopedAuthorizer == nil {
+		tlsCfg.APIConfig.ScopedAuthorizer = authServer.ScopedAuthorizer
+	}
+	if tlsCfg.APIConfig.AuditLog == nil {
+		tlsCfg.APIConfig.AuditLog = authServer.AuditLog
+	}
+	if tlsCfg.APIConfig.Emitter == nil {
+		tlsCfg.APIConfig.Emitter = authServer.AuthServer
+	}
+	if tlsCfg.AcceptedUsage == nil {
+		tlsCfg.AcceptedUsage = authServer.AcceptedUsage
+	}
+
+	tlsServer, err := NewTestTLSServer(*tlsCfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Server{
+		AuthServer: authServer,
+		TLS:        tlsServer,
+	}, nil
+}
+
+// Auth returns the underlying auth server instance
+func (a *Server) Auth() *auth.Server {
+	return a.AuthServer.AuthServer
+}
+
+func (a *Server) NewClient(identity TestIdentity) (*authclient.Client, error) {
+	return a.TLS.NewClient(identity)
+}
+
+func (a *Server) ClusterName() string {
+	return a.TLS.ClusterName()
+}
+
+// Close stops this server immediately.
+func (a *Server) Close() error {
+	return trace.NewAggregate(
+		a.TLS.Close(),
+		a.AuthServer.Close(),
+	)
+}
+
+// Shutdown stops this server instance gracefully
+func (a *Server) Shutdown(ctx context.Context) error {
+	return trace.NewAggregate(
+		a.TLS.Shutdown(ctx),
+		a.AuthServer.Close(),
+	)
+}
+
+// WithClock is a functional server option that sets the server's clock
+func WithClock(clock clockwork.Clock) auth.ServerOption {
+	return func(s *auth.Server) error {
+		s.SetClock(clock)
+		return nil
+	}
+}
+
+// WithBcryptCost is a functional server option that sets the server's bcrypt cost.
+func WithBcryptCost(cost int) auth.ServerOption {
+	return func(s *auth.Server) error {
+		s.SetBcryptCost(cost)
+		return nil
+	}
+}
+
+// AuthServer is an auth server using local filesystem backend
+// and test certificate authority key generation that speeds up
+// keygen by using the same private key
+type AuthServer struct {
+	// AuthServer config is configuration used for auth server setup
+	AuthServerConfig
+	// AuthServer is an auth server
+	AuthServer *auth.Server
+	// AuditLog is an event audit log
+	AuditLog events.AuditLogSessionStreamer
+	// Backend is a backend for auth server
+	Backend backend.Backend
+	// Authorizer is an authorizer used in tests
+	Authorizer authz.Authorizer
+	// ScopedAuthorizer is a scoped authorizer used in tests.
+	ScopedAuthorizer authz.ScopedAuthorizer
+	// LockWatcher is a lock watcher used in tests.
+	LockWatcher *services.LockWatcher
+}
+
+// NewAuthServer returns a new test auth server.
+// The caller should close the server when it is no longer needed.
+func NewAuthServer(cfg AuthServerConfig) (*AuthServer, error) {
+	ctx := context.Background()
+
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	srv := &AuthServer{
+		AuthServerConfig: cfg,
+	}
+	b, err := memory.New(memory.Config{
+		Context:   ctx,
+		Clock:     cfg.Clock,
+		EventsOff: false,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Wrap backend in sanitizer like in production.
+	srv.Backend = backend.NewSanitizer(b)
+
+	if cfg.AuditLog != nil {
+		srv.AuditLog = cfg.AuditLog
+	} else {
+		localLog, err := events.NewAuditLog(events.AuditLogConfig{
+			DataDir:       cfg.Dir,
+			ServerID:      cfg.ClusterName,
+			Clock:         cfg.Clock,
+			UploadHandler: cfg.UploadHandler,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		srv.AuditLog = localLog
+	}
+
+	access := local.NewAccessService(srv.Backend)
+	identity, err := local.NewTestIdentityService(srv.Backend)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	emitter, err := events.NewCheckingEmitter(events.CheckingEmitterConfig{
+		Inner: srv.AuditLog,
+		Clock: cfg.Clock,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	accessLists, err := local.NewAccessListService(srv.Backend, cfg.Clock, local.WithRunWhileLockedRetryInterval(cfg.RunWhileLockedRetryInterval))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+		ClusterName: cfg.ClusterName,
+		ClusterID:   cfg.ClusterID,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.AuthServer, err = auth.NewServer(&auth.InitConfig{
+		DataDir:                   cfg.Dir,
+		Backend:                   srv.Backend,
+		VersionStorage:            NewFakeTeleportVersion(),
+		Authority:                 authority.NewWithClock(cfg.Clock),
+		Access:                    access,
+		Identity:                  identity,
+		AuditLog:                  srv.AuditLog,
+		Streamer:                  cfg.Streamer,
+		SkipPeriodicOperations:    true,
+		Emitter:                   emitter,
+		TraceClient:               cfg.TraceClient,
+		Clock:                     cfg.Clock,
+		ClusterName:               clusterName,
+		HostUUID:                  uuid.New().String(),
+		AccessLists:               accessLists,
+		FIPS:                      cfg.FIPS,
+		KeyStoreConfig:            cfg.KeystoreConfig,
+		MultipartHandler:          cfg.UploadHandler,
+		SessionSummarizerProvider: cfg.SessionSummarizerProvider,
+		RecordingMetadataProvider: cfg.RecordingMetadataProvider,
+	},
+		WithClock(cfg.Clock),
+		// Reduce auth.Server bcrypt costs when testing.
+		WithBcryptCost(bcrypt.MinCost),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if cfg.CacheEnabled {
+		if err := InitAuthCache(AuthCacheParams{
+			AuthServer: srv.AuthServer,
+			Unstarted:  true,
+		}); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	err = srv.AuthServer.SetClusterAuditConfig(ctx, types.DefaultClusterAuditConfig())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clusterNetworkingCfg := cfg.ClusterNetworkingConfig
+	if clusterNetworkingCfg == nil {
+		clusterNetworkingCfg = types.DefaultClusterNetworkingConfig()
+	}
+
+	_, err = srv.AuthServer.UpsertClusterNetworkingConfig(ctx, clusterNetworkingCfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	_, err = srv.AuthServer.UpsertSessionRecordingConfig(ctx, types.DefaultSessionRecordingConfig())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	err = srv.AuthServer.SetClusterName(clusterName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authPreference, err := types.NewAuthPreferenceFromConfigFile(*cfg.AuthPreferenceSpec)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if authPreference.GetSignatureAlgorithmSuite() == types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_UNSPECIFIED {
+		authPreference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1)
+	}
+	_, err = srv.AuthServer.UpsertAuthPreference(ctx, authPreference)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	token, err := types.NewProvisionTokenFromSpec("static-token", time.Unix(0, 0).UTC(), types.ProvisionTokenSpecV2{
+		Roles: types.SystemRoles{types.RoleNode},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// set static tokens
+	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+		StaticTokens: []types.ProvisionTokenV1{
+			*token.V1(),
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	err = srv.AuthServer.SetStaticTokens(staticTokens)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// create the default role
+	if _, err := srv.AuthServer.UpsertRole(ctx, services.NewImplicitRole()); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Setup certificate and signing authorities.
+	for _, caType := range types.CertAuthTypes {
+		if err = srv.AuthServer.UpsertCertAuthority(ctx, NewTestCAWithConfig(TestCAConfig{
+			Type:        caType,
+			ClusterName: srv.ClusterName,
+			Clock:       cfg.Clock,
+		})); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	srv.LockWatcher, err = services.NewLockWatcher(ctx, services.LockWatcherConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			Component:      teleport.ComponentAuth,
+			Client:         srv.AuthServer,
+			Clock:          cfg.Clock,
+			MaxRetryPeriod: defaults.HighResPollingPeriod,
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	srv.AuthServer.SetLockWatcher(srv.LockWatcher)
+
+	unifiedResourcesCache, err := services.NewUnifiedResourceCache(srv.AuthServer.CloseContext(), services.UnifiedResourceCacheConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			QueueSize:    defaults.UnifiedResourcesQueueSize,
+			Component:    teleport.ComponentUnifiedResource,
+			Client:       srv.AuthServer,
+			MaxStaleness: time.Minute,
+		},
+		ResourceGetter: srv.AuthServer,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.AuthServer.SetUnifiedResourcesCache(unifiedResourcesCache)
+
+	accessRequestCache, err := services.NewAccessRequestCache(services.AccessRequestCacheConfig{
+		Events: srv.AuthServer.Services,
+		Getter: srv.AuthServer.Services,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.AuthServer.SetAccessRequestCache(accessRequestCache)
+
+	headlessAuthenticationWatcher, err := local.NewHeadlessAuthenticationWatcher(srv.AuthServer.CloseContext(), local.HeadlessAuthenticationWatcherConfig{
+		Backend: b,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := headlessAuthenticationWatcher.WaitInit(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	srv.AuthServer.SetHeadlessAuthenticationWatcher(headlessAuthenticationWatcher)
+
+	authorizerOpts := authz.AuthorizerOpts{
+		ClusterName:         srv.ClusterName,
+		AccessPoint:         srv.AuthServer,
+		ReadOnlyAccessPoint: srv.AuthServer.ReadOnlyCache,
+		ScopedRoleReader:    srv.AuthServer.ScopedAccessCache,
+		LockWatcher:         srv.LockWatcher,
+		// AuthServer does explicit device authorization checks.
+		DeviceAuthorization: authz.DeviceAuthorizationOpts{
+			DisableGlobalMode: true,
+			DisableRoleMode:   true,
+		},
+	}
+	srv.Authorizer, err = authz.NewAuthorizer(authorizerOpts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.ScopedAuthorizer, err = authz.NewScopedAuthorizer(authorizerOpts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	userNotificationCache, err := services.NewUserNotificationCache(services.NotificationCacheConfig{
+		Events: srv.AuthServer.Services,
+		Getter: srv.AuthServer.Cache,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.AuthServer.SetUserNotificationCache(userNotificationCache)
+
+	globalNotificationCache, err := services.NewGlobalNotificationCache(services.NotificationCacheConfig{
+		Events: srv.AuthServer.Services,
+		Getter: srv.AuthServer.Cache,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.AuthServer.SetGlobalNotificationCache(globalNotificationCache)
+
+	// Auth initialization is done (including creation/updating of all singleton
+	// configuration resources) so now we can start the cache.
+	if c, ok := srv.AuthServer.Cache.(*cache.Cache); ok {
+		if err := c.Start(); err != nil {
+			return nil, trace.NewAggregate(err, c.Close())
+		}
+	}
+	return srv, nil
+}
+
+type AuthCacheParams struct {
+	AuthServer *auth.Server
+	Unstarted  bool
+}
+
+func InitAuthCache(p AuthCacheParams) error {
+	c, err := accesspoint.NewCache(accesspoint.Config{
+		Context:      p.AuthServer.CloseContext(),
+		Setup:        cache.ForAuth,
+		CacheName:    []string{teleport.ComponentAuth},
+		EventsSystem: true,
+		Unstarted:    p.Unstarted,
+
+		Access:                  p.AuthServer.Services.Access,
+		AccessLists:             p.AuthServer.Services.AccessListsInternal,
+		AccessMonitoringRules:   p.AuthServer.Services.AccessMonitoringRules,
+		AppSession:              p.AuthServer.Services.Identity,
+		Apps:                    p.AuthServer.Services.Applications,
+		ClusterConfig:           p.AuthServer.Services.ClusterConfigurationInternal,
+		CrownJewels:             p.AuthServer.Services.CrownJewels,
+		DatabaseObjects:         p.AuthServer.Services.DatabaseObjects,
+		DatabaseServices:        p.AuthServer.Services.DatabaseServices,
+		Databases:               p.AuthServer.Services.Databases,
+		DiscoveryConfigs:        p.AuthServer.Services.DiscoveryConfigs,
+		DynamicAccess:           p.AuthServer.Services.DynamicAccessExt,
+		Events:                  p.AuthServer.Services.Events,
+		Integrations:            p.AuthServer.Services.Integrations,
+		KubeWaitingContainers:   p.AuthServer.Services.KubeWaitingContainer,
+		Kubernetes:              p.AuthServer.Services.Kubernetes,
+		Notifications:           p.AuthServer.Services.Notifications,
+		Okta:                    p.AuthServer.Services.Okta,
+		Presence:                p.AuthServer.Services.PresenceInternal,
+		Provisioner:             p.AuthServer.Services.Provisioner,
+		Restrictions:            p.AuthServer.Services.Restrictions,
+		SAMLIdPServiceProviders: p.AuthServer.Services.SAMLIdPServiceProviders,
+		SecReports:              p.AuthServer.Services.SecReports,
+		SnowflakeSession:        p.AuthServer.Services.Identity,
+		SPIFFEFederations:       p.AuthServer.Services.SPIFFEFederations,
+		StaticHostUsers:         p.AuthServer.Services.StaticHostUser,
+		Trust:                   p.AuthServer.Services.TrustInternal,
+		UserGroups:              p.AuthServer.Services.UserGroups,
+		UserTasks:               p.AuthServer.Services.UserTasks,
+		UserLoginStates:         p.AuthServer.Services.UserLoginStates,
+		Users:                   p.AuthServer.Services.Identity,
+		WebSession:              p.AuthServer.Services.Identity.WebSessions(),
+		WebToken:                p.AuthServer.Services.Identity,
+		WorkloadIdentity:        p.AuthServer.Services.WorkloadIdentities,
+		DynamicWindowsDesktops:  p.AuthServer.Services.DynamicWindowsDesktops,
+		WindowsDesktops:         p.AuthServer.Services.WindowsDesktops,
+		AutoUpdateService:       p.AuthServer.Services.AutoUpdateService,
+		ProvisioningStates:      p.AuthServer.Services.ProvisioningStates,
+		IdentityCenter:          p.AuthServer.Services.IdentityCenter,
+		PluginStaticCredentials: p.AuthServer.Services.PluginStaticCredentials,
+		GitServers:              p.AuthServer.Services.GitServers,
+		HealthCheckConfig:       p.AuthServer.Services.HealthCheckConfig,
+		BotInstance:             p.AuthServer.Services.BotInstance,
+		Plugin:                  p.AuthServer.Services.Plugins,
+		RecordingEncryption:     p.AuthServer.Services.RecordingEncryptionManager,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	p.AuthServer.Cache = c
+	return nil
+}
+
+func (a *AuthServer) Close() error {
+	defer a.LockWatcher.Close()
+
+	return trace.NewAggregate(
+		a.AuthServer.Close(),
+		a.Backend.Close(),
+		a.AuditLog.Close(),
+	)
+}
+
+// GenerateUserCert takes the public key in the OpenSSH `authorized_keys`
+// plain text format, signs it using User Certificate Authority signing key and returns the
+// resulting certificate.
+func (a *AuthServer) GenerateUserCert(key []byte, username string, ttl time.Duration, compatibility string) ([]byte, error) {
+	sshCert, _, err := a.AuthServer.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+		SSHPubKey:     key,
+		Username:      username,
+		TTL:           ttl,
+		Compatibility: compatibility,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return sshCert, nil
+}
+
+// PrivateKeyToPublicKeyTLS gets the TLS public key from a raw private key.
+func PrivateKeyToPublicKeyTLS(privateKey []byte) (tlsPublicKey []byte, err error) {
+	sshPrivate, err := ssh.ParseRawPrivateKey(privateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tlsPublicKey, err = tlsca.MarshalPublicKeyFromPrivateKeyPEM(sshPrivate)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return tlsPublicKey, nil
+}
+
+// generateCertificate generates certificate for identity,
+// returns private public key pair
+func generateCertificate(authServer *auth.Server, identity TestIdentity) ([]byte, []byte, error) {
+	ctx := context.TODO()
+
+	key, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	privateKeyPEM, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	tlsPublicKeyPEM, err := keys.MarshalPublicKey(key.Public())
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	sshPublicKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	sshPublicKeyPEM := ssh.MarshalAuthorizedKey(sshPublicKey)
+
+	switch id := identity.I.(type) {
+	case authz.LocalUser:
+		if identity.TTL == 0 {
+			identity.TTL = time.Hour
+		}
+
+		_, tlsCert, err := authServer.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+			SSHPubKey:        sshPublicKeyPEM,
+			TLSPubKey:        tlsPublicKeyPEM,
+			Username:         id.Username,
+			TTL:              identity.TTL,
+			RouteToCluster:   identity.RouteToCluster,
+			PinnedIP:         id.Identity.PinnedIP,
+			MFAVerified:      id.Identity.MFAVerified,
+			DeviceExtensions: auth.DeviceExtensions(id.Identity.DeviceExtensions),
+			Generation:       id.Identity.Generation,
+			Renewable:        identity.Renewable,
+			Usage:            identity.AcceptedUsage,
+		})
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		return tlsCert, privateKeyPEM, nil
+	case authz.BuiltinRole:
+		certs, err := authServer.GenerateHostCerts(ctx,
+			&proto.HostCertsRequest{
+				HostID:       id.Username,
+				NodeName:     id.Username,
+				Role:         id.Role,
+				PublicTLSKey: tlsPublicKeyPEM,
+				PublicSSHKey: sshPublicKeyPEM,
+				SystemRoles:  id.AdditionalSystemRoles,
+			}, "")
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		return certs.TLS, privateKeyPEM, nil
+	case authz.RemoteBuiltinRole:
+		certs, err := authServer.GenerateHostCerts(ctx,
+			&proto.HostCertsRequest{
+				HostID:       id.Username,
+				NodeName:     id.Username,
+				Role:         id.Role,
+				PublicTLSKey: tlsPublicKeyPEM,
+				PublicSSHKey: sshPublicKeyPEM,
+			}, "")
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		return certs.TLS, privateKeyPEM, nil
+	default:
+		return nil, nil, trace.BadParameter("identity of unknown type %T is unsupported", identity)
+	}
+}
+
+// NewCertificate returns new TLS credentials generated by test auth server
+func (a *AuthServer) NewCertificate(identity TestIdentity) (*tls.Certificate, error) {
+	cert, key, err := generateCertificate(a.AuthServer, identity)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsCert, err := tls.X509KeyPair(cert, key)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &tlsCert, nil
+}
+
+// Clock returns clock used by auth server
+func (a *AuthServer) Clock() clockwork.Clock {
+	return a.AuthServer.GetClock()
+}
+
+// Trust adds other server host certificate authority as trusted
+func (a *AuthServer) Trust(ctx context.Context, remote *AuthServer, roleMap types.RoleMap) error {
+	remoteCA, err := remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.HostCA,
+		DomainName: remote.ClusterName,
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.DatabaseCA,
+		DomainName: remote.ClusterName,
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.DatabaseClientCA,
+		DomainName: remote.ClusterName,
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.OpenSSHCA,
+		DomainName: remote.ClusterName,
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.UserCA,
+		DomainName: remote.ClusterName,
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	remoteCA.SetRoleMap(roleMap)
+	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// NewTestTLSServer returns new test TLS server
+func (a *AuthServer) NewTestTLSServer(opts ...TestTLSServerOption) (*TLSServer, error) {
+	apiConfig := &auth.APIConfig{
+		AuthServer:       a.AuthServer,
+		Authorizer:       a.Authorizer,
+		ScopedAuthorizer: a.ScopedAuthorizer,
+		AuditLog:         a.AuditLog,
+		Emitter:          a.AuthServer,
+	}
+	cfg := TLSServerConfig{
+		APIConfig:     apiConfig,
+		AuthServer:    a,
+		AcceptedUsage: a.AcceptedUsage,
+	}
+	for _, o := range opts {
+		o(&cfg)
+	}
+	srv, err := NewTestTLSServer(cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return srv, nil
+}
+
+// TestTLSServerOption is a functional option passed to NewTestTLSServer
+type TestTLSServerOption func(*TLSServerConfig)
+
+// WithLimiterConfig sets connection and request limiter configuration.
+func WithLimiterConfig(config *limiter.Config) TestTLSServerOption {
+	return func(cfg *TLSServerConfig) {
+		cfg.Limiter = config
+	}
+}
+
+// WithAccessGraphConfig sets the access graph configuration.
+func WithAccessGraphConfig(config auth.AccessGraphConfig) TestTLSServerOption {
+	return func(cfg *TLSServerConfig) {
+		cfg.APIConfig.AccessGraph = config
+	}
+}
+
+// NewRemoteClient creates new client to the remote server using identity
+// generated for this certificate authority
+func (a *AuthServer) NewRemoteClient(identity TestIdentity, addr net.Addr, pool *x509.CertPool) (*authclient.Client, error) {
+	tlsConfig := utils.TLSConfig(a.CipherSuites)
+	cert, err := a.NewCertificate(identity)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsConfig.Certificates = []tls.Certificate{*cert}
+	tlsConfig.RootCAs = pool
+	tlsConfig.ServerName = apiutils.EncodeClusterName(a.ClusterName)
+	tlsConfig.Time = a.AuthServer.GetClock().Now
+
+	return authclient.NewClient(client.Config{
+		Addrs: []string{addr.String()},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+	})
+}
+
+// TLSServerConfig is a configuration for test TLS server
+type TLSServerConfig struct {
+	// APIConfig is a configuration of API server
+	APIConfig *auth.APIConfig
+	// AuthServer is a test auth server used to serve requests
+	AuthServer *AuthServer
+	// Limiter is a connection and request limiter
+	Limiter *limiter.Config
+	// Listener is a listener to serve requests on
+	Listener net.Listener
+	// AcceptedUsage is a list of accepted usage restrictions
+	AcceptedUsage []string
+}
+
+// Auth returns auth server used by this TLS server
+func (t *TLSServer) Auth() *auth.Server {
+	return t.AuthServer.AuthServer
+}
+
+// TLSServer is a test TLS server
+type TLSServer struct {
+	// TLSServerConfig is a configuration for TLS server
+	TLSServerConfig
+	// Identity is a generated TLS/SSH identity used to answer in TLS
+	Identity *state.Identity
+	// TLSServer is a configured TLS server
+	TLSServer *auth.TLSServer
+}
+
+// ClusterName returns name of test TLS server cluster
+func (t *TLSServer) ClusterName() string {
+	return t.AuthServer.ClusterName
+}
+
+// Clock returns clock used by auth server
+func (t *TLSServer) Clock() clockwork.Clock {
+	return t.AuthServer.Clock()
+}
+
+// CheckAndSetDefaults checks and sets limiter defaults
+func (cfg *TLSServerConfig) CheckAndSetDefaults() error {
+	if cfg.APIConfig == nil {
+		return trace.BadParameter("missing parameter APIConfig")
+	}
+	if cfg.AuthServer == nil {
+		return trace.BadParameter("missing parameter AuthServer")
+	}
+	// use very permissive limiter configuration by default
+	if cfg.Limiter == nil {
+		cfg.Limiter = &limiter.Config{
+			MaxConnections: 1000,
+		}
+	}
+	return nil
+}
+
+// NewTestTLSServer returns new test TLS server that is started and is listening
+// on 127.0.0.1 loopback on any available port
+func NewTestTLSServer(cfg TLSServerConfig) (*TLSServer, error) {
+	err := cfg.CheckAndSetDefaults()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	srv := &TLSServer{
+		TLSServerConfig: cfg,
+	}
+	srv.Identity, err = NewServerIdentity(srv.AuthServer.AuthServer, "test-tls-server", types.RoleAuth)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Register TLS endpoint of the auth service
+	tlsConfig, err := srv.Identity.TLSConfig(srv.AuthServer.CipherSuites)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsConfig.Time = cfg.AuthServer.Clock().Now
+	tlsCert := tlsConfig.Certificates[0]
+
+	srv.Listener, err = net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	srv.TLSServer, err = auth.NewTLSServer(context.Background(), auth.TLSServerConfig{
+		Listener:             srv.Listener,
+		AccessPoint:          srv.AuthServer.AuthServer.Cache,
+		TLS:                  tlsConfig,
+		GetClientCertificate: func() (*tls.Certificate, error) { return &tlsCert, nil },
+		APIConfig:            *srv.APIConfig,
+		LimiterConfig:        *srv.Limiter,
+		AcceptedUsage:        cfg.AcceptedUsage,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := srv.Start(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return srv, nil
+}
+
+// TestIdentity is test identity spec used to generate identities in tests
+type TestIdentity struct {
+	I              authz.IdentityGetter
+	TTL            time.Duration
+	AcceptedUsage  []string
+	RouteToCluster string
+	Renewable      bool
+	Generation     uint64
+}
+
+// TestUser returns TestIdentity for local user. Note that this constructor only produces a
+// test identity suitable for use with the `NewClient` methods defined in this file, as those helpers
+// auto-populate roles.  Prefer using TestUserWithRoles for most usecases.
+func TestUser(username string) TestIdentity {
+	return TestUserWithRoles(username, nil)
+}
+
+// TestUserWithRoles returns a local user TestIdentity with the specified username and roles.
+func TestUserWithRoles(username string, roles []string) TestIdentity {
+	return TestIdentity{
+		I: authz.LocalUser{
+			Username: username,
+			Identity: tlsca.Identity{
+				Username: username,
+				Groups:   roles,
+			},
+		},
+	}
+}
+
+// TestUserWithDeviceExtensions returns a TestIdentity for a local user,
+// including the supplied device extensions in the tlsca.Identity.
+func TestUserWithDeviceExtensions(username string, exts tlsca.DeviceExtensions) TestIdentity {
+	return TestIdentity{
+		I: authz.LocalUser{
+			Username: username,
+			Identity: tlsca.Identity{
+				Username:         username,
+				DeviceExtensions: exts,
+			},
+		},
+	}
+}
+
+// TestRenewableUser returns a TestIdentity for a local user
+// with renewable credentials.
+func TestRenewableUser(username string, generation uint64) TestIdentity {
+	return TestIdentity{
+		I: authz.LocalUser{
+			Username: username,
+			Identity: tlsca.Identity{
+				Username: username,
+			},
+		},
+		Renewable:  true,
+		Generation: generation,
+	}
+}
+
+// TestNop returns "Nop" - unauthenticated identity
+func TestNop() TestIdentity {
+	return TestIdentity{
+		I: nil,
+	}
+}
+
+// TestAdmin returns TestIdentity for admin user
+func TestAdmin() TestIdentity {
+	return TestBuiltin(types.RoleAdmin)
+}
+
+// TestBuiltin returns TestIdentity for builtin user
+func TestBuiltin(role types.SystemRole) TestIdentity {
+	return TestIdentity{
+		I: authz.BuiltinRole{
+			Role:     role,
+			Username: string(role),
+		},
+	}
+}
+
+// TestScopedHost returns TestIdentity for a scoped host
+func TestScopedHost(clusterName, hostID, scope string, role types.SystemRole) TestIdentity {
+	username := hostID
+	if clusterName != "" {
+		username = utils.HostFQDN(hostID, clusterName)
+	}
+	return TestIdentity{
+		I: authz.BuiltinRole{
+			Role:                  types.RoleInstance,
+			Username:              username,
+			AdditionalSystemRoles: types.SystemRoles{role},
+			Identity: tlsca.Identity{
+				AgentScope: scope,
+			},
+		},
+	}
+}
+
+// TestServerID returns a TestIdentity for a node with the passed in serverID.
+func TestServerID(role types.SystemRole, serverID string) TestIdentity {
+	return TestIdentity{
+		I: authz.BuiltinRole{
+			Role:                  types.RoleInstance,
+			Username:              serverID,
+			AdditionalSystemRoles: types.SystemRoles{role},
+			Identity: tlsca.Identity{
+				Username: serverID,
+			},
+		},
+	}
+}
+
+// TestRemoteBuiltin returns TestIdentity for a remote builtin role.
+func TestRemoteBuiltin(role types.SystemRole, remoteCluster string) TestIdentity {
+	return TestIdentity{
+		I: authz.RemoteBuiltinRole{
+			Role:        role,
+			Username:    string(role),
+			ClusterName: remoteCluster,
+		},
+	}
+}
+
+func (i TestIdentity) GetUsername() string {
+	return i.I.GetIdentity().Username
+}
+
+// NewClientFromWebSession returns new authenticated client from web session
+func (t *TLSServer) NewClientFromWebSession(sess types.WebSession) (*authclient.Client, error) {
+	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsCert, err := tls.X509KeyPair(sess.GetTLSCert(), sess.GetTLSPriv())
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to parse TLS cert and key")
+	}
+	tlsConfig.Certificates = []tls.Certificate{tlsCert}
+	tlsConfig.Time = t.AuthServer.AuthServer.GetClock().Now
+
+	return authclient.NewClient(client.Config{
+		Addrs: []string{t.Addr().String()},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+	})
+}
+
+// CertPool returns cert pool that auth server represents
+func (t *TLSServer) CertPool() (*x509.CertPool, error) {
+	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return tlsConfig.RootCAs, nil
+}
+
+// ClientTLSConfig returns client TLS config based on the identity
+func (t *TLSServer) ClientTLSConfig(identity TestIdentity) (*tls.Config, error) {
+	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if identity.I != nil {
+		cert, err := t.AuthServer.NewCertificate(identity)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		tlsConfig.Certificates = []tls.Certificate{*cert}
+	} else {
+		// this client is not authenticated, which means that auth
+		// server should apply Nop builtin role
+		tlsConfig.Certificates = nil
+	}
+	tlsConfig.Time = t.AuthServer.AuthServer.GetClock().Now
+	return tlsConfig, nil
+}
+
+// CloneClient uses the same credentials as the passed client
+// but forces the client to be recreated
+func (t *TLSServer) CloneClient(tt *testing.T, clt *authclient.Client) *authclient.Client {
+	tt.Helper()
+
+	tlsConfig := clt.Config()
+	// When cloning a client, we want to make sure that we don't reuse
+	// the same session ticket cache. The session ticket cache should not be
+	// shared between all clients that use the same TLS config.
+	// Reusing the cache will skip the TLS handshake and may introduce a weird
+	// behavior in tests.
+	if tlsConfig.ClientSessionCache != nil {
+		tlsConfig = tlsConfig.Clone()
+		tlsConfig.ClientSessionCache = tls.NewLRUClientSessionCache(utils.DefaultLRUCapacity)
+	}
+
+	newClient, err := authclient.NewClient(client.Config{
+		Addrs: []string{t.Addr().String()},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+	})
+	if err != nil {
+		tt.Fatalf("error creating auth client: %v", err.Error())
+	}
+
+	tt.Cleanup(func() { _ = newClient.Close() })
+	return newClient
+}
+
+// NewClientWithCert creates a new client using given cert and private key
+func (t *TLSServer) NewClientWithCert(clientCert tls.Certificate) (*authclient.Client, error) {
+	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
+	if err != nil {
+		return nil, err
+	}
+	tlsConfig.Time = t.AuthServer.AuthServer.GetClock().Now
+	tlsConfig.Certificates = []tls.Certificate{clientCert}
+	newClient, err := authclient.NewClient(client.Config{
+		Addrs: []string{t.Addr().String()},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return newClient, nil
+}
+
+// NewClient returns new client to test server authenticated with identity
+func (t *TLSServer) NewClient(identity TestIdentity) (*authclient.Client, error) {
+	if localUser, ok := identity.I.(authz.LocalUser); ok && len(localUser.Identity.Groups) == 0 {
+		user, err := t.AuthServer.AuthServer.GetUser(context.TODO(), localUser.Username, false)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		localUser.Identity.Groups = user.GetRoles()
+		identity.I = localUser
+	}
+	tlsConfig, err := t.ClientTLSConfig(identity)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	newClient, err := authclient.NewClient(client.Config{
+		DialInBackground: true,
+		Addrs:            []string{t.Addr().String()},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return newClient, nil
+}
+
+// Addr returns address of TLS server
+func (t *TLSServer) Addr() net.Addr {
+	return t.Listener.Addr()
+}
+
+// Start starts TLS server on loopback address on the first listening socket
+func (t *TLSServer) Start() error {
+	go t.TLSServer.Serve()
+	return nil
+}
+
+// Close closes the listener and HTTP server
+func (t *TLSServer) Close() error {
+	var errs []error
+	if err := t.Stop(); err != nil {
+		errs = append(errs, err)
+	}
+
+	if t.AuthServer.Backend != nil {
+		if err := t.AuthServer.Backend.Close(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return trace.NewAggregate(errs...)
+}
+
+// Shutdown closes the listener and HTTP server gracefully
+func (t *TLSServer) Shutdown(ctx context.Context) error {
+	var errs []error
+	if err := t.TLSServer.Shutdown(ctx); err != nil {
+		errs = append(errs, err)
+	}
+
+	if t.Listener != nil {
+		if err := t.Listener.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+			errs = append(errs, err)
+		}
+
+	}
+	if t.AuthServer.Backend != nil {
+		if err := t.AuthServer.Backend.Close(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return trace.NewAggregate(errs...)
+}
+
+// Stop stops listening server, but does not close the auth backend
+func (t *TLSServer) Stop() error {
+	var errs []error
+	if err := t.TLSServer.Close(); err != nil {
+		errs = append(errs, err)
+	}
+	if t.Listener != nil {
+		if err := t.Listener.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+			errs = append(errs, err)
+		}
+	}
+
+	return trace.NewAggregate(errs...)
+}
+
+// FakeTeleportVersion fake version storage implementation always return current version.
+type FakeTeleportVersion struct{}
+
+// NewFakeTeleportVersion creates fake version storage.
+func NewFakeTeleportVersion() *FakeTeleportVersion {
+	return &FakeTeleportVersion{}
+}
+
+// GetTeleportVersion returns current Teleport version.
+func (s FakeTeleportVersion) GetTeleportVersion(_ context.Context) (semver.Version, error) {
+	return *teleport.SemVer(), nil
+}
+
+// WriteTeleportVersion stub function for writing.
+func (s FakeTeleportVersion) WriteTeleportVersion(_ context.Context, _ semver.Version) error {
+	return nil
+}
+
+// DeleteTeleportVersion error stub function for deleting.
+func (s FakeTeleportVersion) DeleteTeleportVersion(_ context.Context) error {
+	return nil
+}
+
+// NewServerIdentity generates new server identity, used in tests
+func NewServerIdentity(clt *auth.Server, hostID string, role types.SystemRole) (*state.Identity, error) {
+	key, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	privateKeyPEM, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tlsPubKey, err := keys.MarshalPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	certs, err := clt.GenerateHostCerts(context.Background(),
+		&proto.HostCertsRequest{
+			HostID:       hostID,
+			NodeName:     hostID,
+			Role:         role,
+			PublicSSHKey: ssh.MarshalAuthorizedKey(sshPubKey),
+			PublicTLSKey: tlsPubKey,
+		}, "")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.ReadIdentityFromKeyPair(privateKeyPEM, certs)
+}
+
+// UserClient allows overwriting a user.
+type UserClient interface {
+	UpsertUser(context.Context, types.User) (types.User, error)
+}
+
+// RoleClient allows overwriting a role.
+type RoleClient interface {
+	UpsertRole(context.Context, types.Role) (types.Role, error)
+}
+
+// UserRoleClient allows overwriting uesrs and roles.
+type UserRoleClient interface {
+	UserClient
+	RoleClient
+}
+
+// CreateRole creates a role without assigning any users. Used in tests.
+func CreateRole(ctx context.Context, clt RoleClient, name string, spec types.RoleSpecV6) (types.Role, error) {
+	role, err := types.NewRole(name, spec)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	upserted, err := clt.UpsertRole(ctx, role)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return upserted, nil
+}
+
+// CreateUserRoleAndRequestable creates two roles for a user, one base role with allowed login
+// matching username, and another role with a login matching rolename that can be requested.
+func CreateUserRoleAndRequestable(clt UserRoleClient, username string, rolename string) (types.User, error) {
+	ctx := context.TODO()
+	user, err := types.NewUser(username)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	baseRole := services.RoleForUser(user)
+	baseRole.SetAccessRequestConditions(types.Allow, types.AccessRequestConditions{
+		Roles: []string{rolename},
+	})
+	baseRole.SetLogins(types.Allow, nil)
+	baseRole, err = clt.UpsertRole(ctx, baseRole)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	user.AddRole(baseRole.GetName())
+	_, err = clt.UpsertUser(ctx, user)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	requestableRole := services.RoleForUser(user)
+	requestableRole.SetName(rolename)
+	requestableRole.SetLogins(types.Allow, []string{rolename})
+	_, err = clt.UpsertRole(ctx, requestableRole)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return user, nil
+}
+
+// CreateAccessPluginUser creates a user with list/read abilites for access requests, and list/read/update
+// abilities for access plugin data.
+func CreateAccessPluginUser(ctx context.Context, clt UserRoleClient, username string) (types.User, error) {
+	user, err := types.NewUser(username)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	role := services.RoleForUser(user)
+	rules := role.GetRules(types.Allow)
+	rules = append(rules,
+		types.Rule{
+			Resources: []string{types.KindAccessRequest},
+			Verbs:     []string{types.VerbRead, types.VerbList},
+		},
+		types.Rule{
+			Resources: []string{types.KindAccessPluginData},
+			Verbs:     []string{types.VerbRead, types.VerbList, types.VerbUpdate},
+		},
+	)
+	role.SetRules(types.Allow, rules)
+	role.SetLogins(types.Allow, nil)
+	upsertedRole, err := clt.UpsertRole(ctx, role)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	user.AddRole(upsertedRole.GetName())
+	if _, err := clt.UpsertUser(ctx, user); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return user, nil
+}
+
+// CreateUser creates user and role and assigns role to a user, used in tests
+func CreateUser(ctx context.Context, clt UserRoleClient, username string, roles ...types.Role) (types.User, error) {
+	user, err := types.NewUser(username)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	for _, role := range roles {
+		upsertedRole, err := clt.UpsertRole(ctx, role)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		user.AddRole(upsertedRole.GetName())
+	}
+
+	created, err := clt.UpsertUser(ctx, user)
+	return created, trace.Wrap(err)
+}
+
+// createUserAndRoleOptions is a set of options for CreateUserAndRole
+type createUserAndRoleOptions struct {
+	mutateUser []func(user types.User)
+	mutateRole []func(role types.Role)
+	version    string
+}
+
+// CreateUserAndRoleOption is a functional option for CreateUserAndRole
+type CreateUserAndRoleOption func(*createUserAndRoleOptions)
+
+// WithRoleVersion sets the version of the role to be created.
+func WithRoleVersion(version string) CreateUserAndRoleOption {
+	return func(o *createUserAndRoleOptions) {
+		o.version = version
+	}
+}
+
+// WithUserMutator sets a function that will be called to mutate the user before it is created
+func WithUserMutator(mutate ...func(user types.User)) CreateUserAndRoleOption {
+	return func(o *createUserAndRoleOptions) {
+		o.mutateUser = append(o.mutateUser, mutate...)
+	}
+}
+
+// WithRoleMutator sets a function that will be called to mutate the role before it is created
+func WithRoleMutator(mutate ...func(role types.Role)) CreateUserAndRoleOption {
+	return func(o *createUserAndRoleOptions) {
+		o.mutateRole = append(o.mutateRole, mutate...)
+	}
+}
+
+// CreateUserAndRole creates user and role and assigns role to a user, used in tests
+// If allowRules is nil, the role has admin privileges.
+// If allowRules is not-nil, then the rules associated with the role will be
+// replaced with those specified.
+func CreateUserAndRole(clt UserRoleClient, username string, allowedLogins []string, allowRules []types.Rule, opts ...CreateUserAndRoleOption) (types.User, types.Role, error) {
+	o := createUserAndRoleOptions{
+		version: types.DefaultRoleVersion,
+	}
+	for _, opt := range opts {
+		opt(&o)
+	}
+	ctx := context.TODO()
+	user, err := types.NewUser(username)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	role := services.RoleWithVersionForUser(user, o.version)
+	role.SetLogins(types.Allow, allowedLogins)
+	if allowRules != nil {
+		role.SetRules(types.Allow, allowRules)
+	}
+	for _, mutate := range o.mutateRole {
+		mutate(role)
+	}
+	upsertedRole, err := clt.UpsertRole(ctx, role)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	user.AddRole(upsertedRole.GetName())
+	for _, mutate := range o.mutateUser {
+		mutate(user)
+	}
+	created, err := clt.UpsertUser(ctx, user)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return created, role, nil
+}
+
+// CreateUserAndRoleWithoutRoles creates user and role, but does not assign user to a role, used in tests
+func CreateUserAndRoleWithoutRoles(clt UserRoleClient, username string, allowedLogins []string) (types.User, types.Role, error) {
+	ctx := context.TODO()
+	user, err := types.NewUser(username)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	role := services.RoleForUser(user)
+	set := services.MakeRuleSet(role.GetRules(types.Allow))
+	delete(set, types.KindRole)
+	role.SetRules(types.Allow, set.Slice())
+	role.SetLogins(types.Allow, []string{user.GetName()})
+	upsertedRole, err := clt.UpsertRole(ctx, role)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	user.AddRole(upsertedRole.GetName())
+	created, err := clt.UpsertUser(ctx, user)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return created, upsertedRole, nil
+}
+
+// Flusher is the set of methods expected by the FlushCache helper.
+type Flusher interface {
+	// GetRole returns role by name
+	GetRole(ctx context.Context, name string) (types.Role, error)
+	// CreateRole creates a new role.
+	CreateRole(context.Context, types.Role) (types.Role, error)
+	// DeleteRole deletes the role by name.
+	DeleteRole(ctx context.Context, name string) error
+}
+
+// FlushCache is a helper for waiting until preceding changes have propagated to the
+// cache during a test. this is useful for writing tests that may want to update backend
+// state and then perform some operation that depends on the auth server knowing that state.
+// note that this is only intended for use with the memory backend, as this helper relies on the assumption that
+// write events for different keys show up in the order in which the writes were performed, which
+// is not necessarily true for all backends.
+func FlushCache(t *testing.T, clt Flusher) {
+	ctx := context.Background()
+
+	// the pattern of writing a resource and then waiting for it to appear
+	// works for any resource type (when using memory backend).
+	name := strings.ReplaceAll(uuid.NewString(), "-", "")
+	defer clt.DeleteRole(ctx, name)
+
+	role, err := types.NewRole(name, types.RoleSpecV6{})
+	if err != nil {
+		t.Fatalf("Failed to instantiate new role: %v", err)
+	}
+
+	role, err = clt.CreateRole(ctx, role)
+	if err != nil {
+		t.Fatalf("Failed to create new role: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	for {
+		r, err := clt.GetRole(ctx, name)
+		if err == nil && r.GetRevision() == role.GetRevision() {
+			return
+		}
+
+		select {
+		case <-time.After(200 * time.Millisecond):
+		case <-ctx.Done():
+			t.Fatal("Time out waiting for role to be replicated")
+		}
+	}
+}
+
+// TestCAConfig defines the configuration for generating
+// a test certificate authority
+type TestCAConfig struct {
+	Type        types.CertAuthType
+	PrivateKeys [][]byte
+	Clock       clockwork.Clock
+	ClusterName string
+	// the below string fields default to ClusterName if left empty
+	ResourceName        string
+	SubjectOrganization string
+}
+
+// NewTestCA returns new test authority with a test key as a public and
+// signing key
+func NewTestCA(caType types.CertAuthType, clusterName string, privateKeys ...[]byte) *types.CertAuthorityV2 {
+	return NewTestCAWithConfig(TestCAConfig{
+		Type:        caType,
+		ClusterName: clusterName,
+		PrivateKeys: privateKeys,
+		Clock:       clockwork.NewRealClock(),
+	})
+}
+
+// NewTestCAWithConfig generates a new certificate authority with the specified
+// configuration
+// Keep this function in-sync with lib/auth/auth.go:newKeySet().
+// TODO(jakule): reuse keystore.KeyStore interface to match newKeySet().
+func NewTestCAWithConfig(config TestCAConfig) *types.CertAuthorityV2 {
+	var keyPEM []byte
+	var key *keys.PrivateKey
+
+	if config.ResourceName == "" {
+		config.ResourceName = config.ClusterName
+	}
+	if config.SubjectOrganization == "" {
+		config.SubjectOrganization = config.ClusterName
+	}
+
+	switch config.Type {
+	case types.DatabaseCA, types.SAMLIDPCA, types.OIDCIdPCA:
+		// These CAs only support RSA.
+		keyPEM = fixtures.PEMBytes["rsa"]
+	case types.DatabaseClientCA:
+		// The db client CA also only supports RSA, but some tests rely on it
+		// being different than the DB CA.
+		keyPEM = fixtures.PEMBytes["rsa-db-client"]
+	}
+	if len(config.PrivateKeys) > 0 {
+		// Allow test to override the private key.
+		keyPEM = config.PrivateKeys[0]
+	}
+
+	if keyPEM != nil {
+		var err error
+		key, err = keys.ParsePrivateKey(keyPEM)
+		if err != nil {
+			panic(err)
+		}
+	} else {
+		// If config.PrivateKeys was not set and this CA does not exclusively
+		// support RSA, generate an ECDSA key. Signatures are ~10x faster than
+		// RSA and generating a new key is actually faster than parsing a PEM
+		// fixture.
+		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+		if err != nil {
+			panic(err)
+		}
+		key, err = keys.NewPrivateKey(signer)
+		if err != nil {
+			panic(err)
+		}
+		keyPEM = key.PrivateKeyPEM()
+	}
+
+	ca := &types.CertAuthorityV2{
+		Kind:    types.KindCertAuthority,
+		SubKind: string(config.Type),
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      config.ResourceName,
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.CertAuthoritySpecV2{
+			Type:        config.Type,
+			ClusterName: config.ClusterName,
+		},
+	}
+
+	// Add SSH keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.OpenSSHCA:
+		ca.Spec.ActiveKeys.SSH = []*types.SSHKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  key.MarshalSSHPublicKey(),
+		}}
+	}
+
+	// Add TLS keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.DatabaseCA, types.DatabaseClientCA, types.SAMLIDPCA, types.SPIFFECA, types.AWSRACA:
+		cert, err := tlsca.GenerateSelfSignedCAWithConfig(tlsca.GenerateCAConfig{
+			Signer: key.Signer,
+			Entity: pkix.Name{
+				CommonName:   config.ClusterName,
+				Organization: []string{config.SubjectOrganization},
+			},
+			TTL:   defaults.CATTL,
+			Clock: config.Clock,
+		})
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.TLS = []*types.TLSKeyPair{{
+			Key:  keyPEM,
+			Cert: cert,
+		}}
+	}
+
+	// Add JWT keys if necessary.
+	switch config.Type {
+	case types.JWTSigner, types.OIDCIdPCA, types.SPIFFECA, types.OktaCA, types.BoundKeypairCA:
+		pubKeyPEM, err := keys.MarshalPublicKey(key.Public())
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.JWT = []*types.JWTKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  pubKeyPEM,
+		}}
+	}
+
+	return ca
+}
diff --git a/lib/auth/helpers_mfa.go b/lib/auth/authtest/helpers_mfa.go
similarity index 85%
rename from lib/auth/helpers_mfa.go
rename to lib/auth/authtest/helpers_mfa.go
index 3eddd890b3d4e..3be2a8a8efec8 100644
--- a/lib/auth/helpers_mfa.go
+++ b/lib/auth/authtest/helpers_mfa.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package authtest
 
 import (
 	"context"
@@ -36,8 +36,8 @@ import (
 	"github.com/gravitational/teleport/lib/utils/clocki"
 )
 
-// TestDevice is a test MFA device.
-type TestDevice struct {
+// Device is a test MFA device.
+type Device struct {
 	MFA        *types.MFADevice
 	TOTPSecret string
 	Key        *mocku2f.Key
@@ -48,22 +48,22 @@ type TestDevice struct {
 }
 
 // TestDeviceOpt is a creation option for TestDevice.
-type TestDeviceOpt func(d *TestDevice)
+type TestDeviceOpt func(d *Device)
 
 func WithTestDeviceClock(clock clockwork.Clock) TestDeviceOpt {
-	return func(d *TestDevice) {
+	return func(d *Device) {
 		d.clock = clock
 	}
 }
 
 func WithPasswordless() TestDeviceOpt {
-	return func(d *TestDevice) {
+	return func(d *Device) {
 		d.passwordless = true
 	}
 }
 
-func NewTestDeviceFromChallenge(c *proto.MFARegisterChallenge, opts ...TestDeviceOpt) (*TestDevice, *proto.MFARegisterResponse, error) {
-	dev := &TestDevice{}
+func NewTestDeviceFromChallenge(c *proto.MFARegisterChallenge, opts ...TestDeviceOpt) (*Device, *proto.MFARegisterResponse, error) {
+	dev := &Device{}
 	for _, opt := range opts {
 		opt(dev)
 	}
@@ -79,9 +79,9 @@ func NewTestDeviceFromChallenge(c *proto.MFARegisterChallenge, opts ...TestDevic
 // RegisterTestDevice creates and registers a TestDevice.
 // TOTP devices require a clock option.
 func RegisterTestDevice(
-	ctx context.Context, clt authClientI, devName string, devType proto.DeviceType, authenticator *TestDevice, opts ...TestDeviceOpt,
-) (*TestDevice, error) {
-	dev := &TestDevice{} // Remaining parameters set during registration
+	ctx context.Context, clt authClientI, devName string, devType proto.DeviceType, authenticator *Device, opts ...TestDeviceOpt,
+) (*Device, error) {
+	dev := &Device{} // Remaining parameters set during registration
 	for _, opt := range opts {
 		opt(dev)
 	}
@@ -91,7 +91,7 @@ func RegisterTestDevice(
 	return dev, dev.registerDevice(ctx, clt, devName, devType, authenticator)
 }
 
-func (d *TestDevice) Origin() string {
+func (d *Device) Origin() string {
 	if d.origin == "" {
 		return "https://localhost"
 	}
@@ -104,7 +104,7 @@ type authClientI interface {
 	AddMFADeviceSync(context.Context, *proto.AddMFADeviceSyncRequest) (*proto.AddMFADeviceSyncResponse, error)
 }
 
-func (d *TestDevice) registerDevice(ctx context.Context, authClient authClientI, devName string, devType proto.DeviceType, authenticator *TestDevice) error {
+func (d *Device) registerDevice(ctx context.Context, authClient authClientI, devName string, devType proto.DeviceType, authenticator *Device) error {
 	mfaCeremony := &mfa.Ceremony{
 		PromptConstructor: func(opts ...mfa.PromptOpt) mfa.Prompt {
 			return mfa.PromptFunc(func(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
@@ -155,7 +155,7 @@ func (d *TestDevice) registerDevice(ctx context.Context, authClient authClientI,
 	return nil
 }
 
-func (d *TestDevice) SolveAuthn(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+func (d *Device) SolveAuthn(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
 	switch {
 	case c.TOTP == nil && c.WebauthnChallenge == nil:
 		return &proto.MFAAuthenticateResponse{}, nil // no challenge
@@ -168,7 +168,7 @@ func (d *TestDevice) SolveAuthn(c *proto.MFAAuthenticateChallenge) (*proto.MFAAu
 	}
 }
 
-func (d *TestDevice) solveAuthnKey(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+func (d *Device) solveAuthnKey(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
 	if c.WebauthnChallenge == nil {
 		return nil, trace.BadParameter("key-based challenge not present")
 	}
@@ -183,7 +183,7 @@ func (d *TestDevice) solveAuthnKey(c *proto.MFAAuthenticateChallenge) (*proto.MF
 	}, nil
 }
 
-func (d *TestDevice) solveAuthnTOTP(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+func (d *Device) solveAuthnTOTP(c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
 	if c.TOTP == nil {
 		return nil, trace.BadParameter("TOTP challenge not present")
 	}
@@ -206,7 +206,7 @@ func (d *TestDevice) solveAuthnTOTP(c *proto.MFAAuthenticateChallenge) (*proto.M
 	}, nil
 }
 
-func (d *TestDevice) solveRegister(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
+func (d *Device) solveRegister(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
 	switch {
 	case c.GetWebauthn() != nil:
 		return d.solveRegisterWebauthn(c)
@@ -217,7 +217,7 @@ func (d *TestDevice) solveRegister(c *proto.MFARegisterChallenge) (*proto.MFAReg
 	}
 }
 
-func (d *TestDevice) solveRegisterWebauthn(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
+func (d *Device) solveRegisterWebauthn(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
 	var err error
 	d.Key, err = mocku2f.Create()
 	if err != nil {
@@ -240,7 +240,7 @@ func (d *TestDevice) solveRegisterWebauthn(c *proto.MFARegisterChallenge) (*prot
 	}, nil
 }
 
-func (d *TestDevice) solveRegisterTOTP(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
+func (d *Device) solveRegisterTOTP(c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
 	if d.clock == nil {
 		return nil, trace.BadParameter("clock not set")
 	}
diff --git a/lib/auth/autoupdate/autoupdatev1/service.go b/lib/auth/autoupdate/autoupdatev1/service.go
index 596faae55fa08..f11eb88291c1a 100644
--- a/lib/auth/autoupdate/autoupdatev1/service.go
+++ b/lib/auth/autoupdate/autoupdatev1/service.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"log/slog"
 	"maps"
+	"slices"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -55,6 +56,9 @@ type Cache interface {
 
 	// ListAutoUpdateAgentReports lists all AutoUpdateAgentReport from the backend.
 	ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pageToken string) ([]*autoupdate.AutoUpdateAgentReport, string, error)
+
+	// GetAutoUpdateBotInstanceReport gets the singleton AutoUpdateBotInstanceReport from the backend.
+	GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdate.AutoUpdateBotInstanceReport, error)
 }
 
 // ServiceConfig holds configuration options for the auto update gRPC service.
@@ -1045,6 +1049,63 @@ func (s *Service) DeleteAutoUpdateAgentReport(ctx context.Context, req *autoupda
 	return &emptypb.Empty{}, nil
 }
 
+// GetAutoUpdateBotInstanceReport gets the singleton AutoUpdateBotInstanceReport.
+func (s *Service) GetAutoUpdateBotInstanceReport(ctx context.Context, _ *autoupdate.GetAutoUpdateBotInstanceReportRequest) (*autoupdate.AutoUpdateBotInstanceReport, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Because this report also powers the bot instance dashboard in the Web UI
+	// we allow users with `bot_instance:list` as well as `autoupdate_bot_instance_report:read`
+	// and return the first error if both checks fail.
+	authErrors := []error{
+		authCtx.CheckAccessToKind(types.KindAutoUpdateBotInstanceReport, types.VerbRead),
+		authCtx.CheckAccessToKind(types.KindBotInstance, types.VerbList),
+	}
+	if !slices.Contains(authErrors, nil) {
+		return nil, trace.NewAggregate(authErrors...)
+	}
+
+	report, err := s.backend.GetAutoUpdateBotInstanceReport(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return report, nil
+}
+
+// DeleteAutoUpdateBotInstanceReport gets the singleton AutoUpdateBotInstanceReport.
+func (s *Service) DeleteAutoUpdateBotInstanceReport(ctx context.Context, _ *autoupdate.DeleteAutoUpdateBotInstanceReportRequest) (*emptypb.Empty, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Editing an agent report is restricted to cluster administrators.
+	// As of today we don't have any way of having
+	// resources that can only be edited by Teleport Cloud (when running cloud-hosted).
+	// The workaround is to check if the caller has the auth/admin system role.
+	// This is not ideal as it forces local tctl usage and can be bypassed if the user is very creative.
+	// In the future, if we expand the permission system and make cloud
+	// a first class citizen, we'll want to update this permission check.
+	if !authz.HasBuiltinRole(*authCtx, string(types.RoleAuth)) && !authz.HasBuiltinRole(*authCtx, string(types.RoleAdmin)) {
+		return nil, trace.AccessDenied("this request can be only executed by an auth server")
+	}
+
+	if err := authCtx.CheckAccessToKind(types.KindAutoUpdateBotInstanceReport, types.VerbDelete); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := authCtx.AuthorizeAdminActionAllowReusedMFA(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.backend.DeleteAutoUpdateBotInstanceReport(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &emptypb.Empty{}, nil
+}
+
 func (s *Service) emitEvent(ctx context.Context, e apievents.AuditEvent) {
 	if err := s.emitter.EmitAuditEvent(ctx, e); err != nil {
 		slog.WarnContext(ctx, "Failed to emit audit event",
diff --git a/lib/auth/autoupdate/autoupdatev1/service_test.go b/lib/auth/autoupdate/autoupdatev1/service_test.go
index 20829179fd848..4234e33e99f5e 100644
--- a/lib/auth/autoupdate/autoupdatev1/service_test.go
+++ b/lib/auth/autoupdate/autoupdatev1/service_test.go
@@ -38,6 +38,7 @@ import (
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/utils"
@@ -349,6 +350,40 @@ func TestServiceAccess(t *testing.T) {
 			allowedVerbs: []string{types.VerbDelete},
 			builtinRole:  &authz.BuiltinRole{Role: types.RoleAuth},
 		},
+		// Autoupdate bot report check
+		{
+			name: "GetAutoUpdateBotInstanceReport",
+			allowedStates: []authz.AdminActionAuthState{
+				authz.AdminActionAuthUnauthorized,
+				authz.AdminActionAuthNotRequired,
+				authz.AdminActionAuthMFAVerified,
+				authz.AdminActionAuthMFAVerifiedWithReuse,
+			},
+			kind:         types.KindAutoUpdateBotInstanceReport,
+			allowedVerbs: []string{types.VerbRead},
+		},
+		{
+			name: "GetAutoUpdateBotInstanceReport",
+			allowedStates: []authz.AdminActionAuthState{
+				authz.AdminActionAuthUnauthorized,
+				authz.AdminActionAuthNotRequired,
+				authz.AdminActionAuthMFAVerified,
+				authz.AdminActionAuthMFAVerifiedWithReuse,
+			},
+			kind:         types.KindBotInstance,
+			allowedVerbs: []string{types.VerbList},
+		},
+		{
+			name: "DeleteAutoUpdateBotInstanceReport",
+			allowedStates: []authz.AdminActionAuthState{
+				authz.AdminActionAuthNotRequired,
+				authz.AdminActionAuthMFAVerified,
+				authz.AdminActionAuthMFAVerifiedWithReuse,
+			},
+			kind:         types.KindAutoUpdateBotInstanceReport,
+			allowedVerbs: []string{types.VerbDelete},
+			builtinRole:  &authz.BuiltinRole{Role: types.RoleAuth},
+		},
 	}
 
 	for _, tt := range testCases {
@@ -879,12 +914,12 @@ func generateGroups(n int, days []string) []*autoupdatev1pb.AgentAutoUpdateGroup
 }
 
 func TestValidateServerSideAgentConfig(t *testing.T) {
-	cloudModules := &modules.TestModules{
+	cloudModules := modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 		},
 	}
-	cloudUnlimitedModules := &modules.TestModules{
+	cloudUnlimitedModules := modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -892,7 +927,7 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 			},
 		},
 	}
-	selfHostedModules := &modules.TestModules{
+	selfHostedModules := modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: false,
 		},
@@ -900,7 +935,7 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 	tests := []struct {
 		name      string
 		config    *autoupdatev1pb.AutoUpdateConfigSpecAgents
-		modules   modules.Modules
+		modules   modulestest.Modules
 		expectErr require.ErrorAssertionFunc
 	}{
 		{
@@ -1049,7 +1084,7 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 					Agents: tt.config,
 				})
 			require.NoError(t, err)
-			modules.SetTestModules(t, tt.modules)
+			modulestest.SetTestModules(t, tt.modules)
 
 			// Test execution.
 			tt.expectErr(t, validateServerSideAgentConfig(config))
diff --git a/lib/auth/autoupdate_agent_version_report.go b/lib/auth/autoupdate_agent_version_report.go
new file mode 100644
index 0000000000000..1991ea851387d
--- /dev/null
+++ b/lib/auth/autoupdate_agent_version_report.go
@@ -0,0 +1,262 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport/api/constants"
+	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/inventory"
+)
+
+const (
+	omissionReasonUpdaterDisabled   = "updater is disabled"
+	omissionReasonUpdaterPinned     = "updater is pinning a specific version"
+	omissionReasonUpdaterUnreadable = "agent cannot read updater status"
+	omissionReasonUpdaterUnknown    = "unknown updater status"
+	omissionReasonUpdaterV1         = "managed updates v1 updater does not support agent reports"
+	omissionReasonUpdaterTooOld     = "updater version does not support agent reports"
+	omissionReasonNoUpdater         = "agent has no updater"
+)
+
+type instanceReport struct {
+	data      map[string]instanceGroupReport
+	timestamp time.Time
+	omissions map[string]int
+}
+
+type autoUpdateFilterResult int
+
+const (
+	// The zero value should not be used, but if it is, it should not match anything.
+	autoUpdateFilterResultUnknown autoUpdateFilterResult = iota
+	autoUpdateFilterResultMatching
+	autoUpdateFilterResultTerminating
+	autoUpdateFilterResultRecentlyConnected
+	autoUpdaterFilterResultIsControlPlane
+	autoUpdateFilterResultNoUpdater
+	autoUpdateFilterResultUpdaterTooOld
+	autoUpdateFilterResultUpdaterDisabled
+	autoUpdateFilterResultUpdaterPinned
+	autoUpdateFilterResultUpdaterUnreadable
+	autoUpdateFilterResultUpdaterUnknown
+	autoUpdateFilterResultUpdaterV1
+)
+
+// String returns a user-facing message explaining the filter decision.
+// If the filter result reason is not actionable, it returns an empty string.
+func (r autoUpdateFilterResult) String() string {
+	switch r {
+	case autoUpdateFilterResultNoUpdater:
+		return omissionReasonNoUpdater
+	case autoUpdateFilterResultUpdaterTooOld:
+		return omissionReasonUpdaterTooOld
+	case autoUpdateFilterResultUpdaterDisabled:
+		return omissionReasonUpdaterDisabled
+	case autoUpdateFilterResultUpdaterPinned:
+		return omissionReasonUpdaterPinned
+	case autoUpdateFilterResultUpdaterUnreadable:
+		return omissionReasonUpdaterUnreadable
+	case autoUpdateFilterResultUpdaterUnknown:
+		return omissionReasonUpdaterUnknown
+	case autoUpdateFilterResultUpdaterV1:
+		return omissionReasonUpdaterV1
+	default:
+		return ""
+	}
+}
+
+// filterHandler filters handles than can or cannot be used for automatic update
+// purposes. It returns true if the handle can be used, false otherwise.
+// If the handle cannot be used, the function might also return a non-empty string
+// explaining why.
+func filterHandler(handle inventory.UpstreamHandle, now time.Time) autoUpdateFilterResult {
+	// If the instance is being soft-reloaded or shut down, we ignore it.
+	if goodbye := handle.Goodbye(); goodbye.GetSoftReload() || goodbye.GetDeleteResources() {
+		return autoUpdateFilterResultTerminating
+	}
+
+	// We skip servers that joined less than a minute ago as they might have been
+	// connected to another auth instance a few seconds ago, which would lead to double-counting.
+	if now.Sub(handle.RegistrationTime()) < constants.AutoUpdateAgentReportPeriod {
+		return autoUpdateFilterResultRecentlyConnected
+	}
+	// We skip control planes instances because we don't update them.
+	if handle.HasControlPlaneService() {
+		return autoUpdaterFilterResultIsControlPlane
+	}
+
+	hello := handle.Hello()
+
+	// If the machine has no updater, we skip it
+	switch hello.ExternalUpgrader {
+	case "":
+		return autoUpdateFilterResultNoUpdater
+	case types.UpgraderKindSystemdUnit:
+		return autoUpdateFilterResultUpdaterV1
+	}
+
+	// Reject instance not advertising updater info
+	updaterInfo := hello.GetUpdaterInfo()
+	if updaterInfo == nil {
+		return autoUpdateFilterResultUpdaterTooOld
+	}
+
+	// Reject instances who are not advertising the group properly.
+	// They might be running too old versions.
+	updateGroup := updaterInfo.UpdateGroup
+	if updateGroup == "" {
+		return autoUpdateFilterResultUpdaterTooOld
+	}
+
+	// We skip instances whose updater status is not OK.
+	status := updaterInfo.UpdaterStatus
+	switch status {
+	case types.UpdaterStatus_UPDATER_STATUS_OK:
+	case types.UpdaterStatus_UPDATER_STATUS_DISABLED:
+		return autoUpdateFilterResultUpdaterDisabled
+	case types.UpdaterStatus_UPDATER_STATUS_PINNED:
+		return autoUpdateFilterResultUpdaterPinned
+	case types.UpdaterStatus_UPDATER_STATUS_UNREADABLE:
+		return autoUpdateFilterResultUpdaterUnreadable
+	default:
+		return autoUpdateFilterResultUnknown
+	}
+	return autoUpdateFilterResultMatching
+}
+
+// collectInstance is meant to be a callback that is passed to inventory.AllHandles().
+func (ir instanceReport) collectInstance(handle inventory.UpstreamHandle) {
+	result := filterHandler(handle, ir.timestamp)
+	if result != autoUpdateFilterResultMatching {
+		if reason := result.String(); reason != "" {
+			ir.omissions[reason] += 1
+		}
+		return
+	}
+
+	// No need to check for UpdaterInfo being nil, it would have been filtered
+	// out by filterHandler().
+	updateGroup := handle.Hello().UpdaterInfo.UpdateGroup
+
+	if _, ok := ir.data[updateGroup]; !ok {
+		ir.data[updateGroup] = instanceGroupReport{}
+	}
+
+	ir.data[updateGroup].collectInstance(handle)
+}
+
+type instanceGroupReport map[string]instanceGroupVersionReport
+
+func (ir instanceGroupReport) collectInstance(handle inventory.UpstreamHandle) {
+	hello := handle.Hello()
+
+	stats, ok := ir[hello.Version]
+	if !ok {
+		stats = instanceGroupVersionReport{}
+	}
+
+	stats.count += 1
+
+	ir[hello.Version] = stats
+}
+
+type instanceGroupVersionReport struct {
+	count int
+	// Leaving room here to add the lowest UUID, as described in RFD 184.
+}
+
+func (a *Server) generateAgentVersionReport(ctx context.Context) (*autoupdatev1pb.AutoUpdateAgentReport, error) {
+	now := a.clock.Now()
+
+	a.logger.DebugContext(ctx, "Collecting agent versions from inventory")
+	rawreport := instanceReport{
+		timestamp: now,
+		data:      make(map[string]instanceGroupReport),
+		omissions: make(map[string]int),
+	}
+	a.inventory.AllHandles(rawreport.collectInstance)
+
+	a.logger.DebugContext(ctx, "Building the agent version report")
+	spec := &autoupdatev1pb.AutoUpdateAgentReportSpec{
+		Timestamp: timestamppb.New(a.clock.Now()),
+		Groups:    make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup, len(rawreport.data)),
+		Omitted:   make([]*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted, 0, len(rawreport.omissions)),
+	}
+
+	// TODO(hugoShaka): gracefully handle too many groups or versions (sort and report only the largest ones).
+	// Currently the agent version report will just fail validation if there are too many groups.
+
+	for groupName, groupData := range rawreport.data {
+		versions := make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion, len(groupData))
+		for versionName, groupVersionData := range groupData {
+			versions[versionName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+				Count: int32(groupVersionData.count),
+			}
+		}
+		spec.Groups[groupName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+			Versions: versions,
+		}
+	}
+
+	for reason, count := range rawreport.omissions {
+		spec.Omitted = append(spec.Omitted, &autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
+			Reason: reason,
+			Count:  int64(count),
+		})
+	}
+
+	report, err := autoupdate.NewAutoUpdateAgentReport(spec, a.ServerID)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to generate agent version report")
+	}
+
+	return report, nil
+}
+
+func (a *Server) reportAgentVersions(ctx context.Context) {
+	if _, err := a.GetAutoUpdateAgentRollout(ctx); err != nil {
+		if trace.IsNotFound(err) {
+			a.logger.DebugContext(ctx, "Skipping periodic agent report because the cluster doesn't contain an autoupdate_agent_rollout.")
+			return
+		}
+		a.logger.WarnContext(ctx, "Failed to check if autoupdate_agent_rollout resource exists, aborting periodic agent report", "error", err)
+	}
+
+	a.logger.DebugContext(ctx, "Periodic agent version report routine started")
+	report, err := a.generateAgentVersionReport(ctx)
+	if err != nil {
+		a.logger.WarnContext(ctx, "Failed to report agent versions", "error", err)
+		return
+	}
+
+	a.logger.DebugContext(ctx, "Writing agent version report to the backend", "name", report.GetMetadata().GetName())
+	_, err = a.UpsertAutoUpdateAgentReport(ctx, report)
+	if err != nil {
+		a.logger.ErrorContext(ctx, "Failed to write agent version report", "error", err)
+	}
+	a.logger.DebugContext(ctx, "Finished exporting the agent version report")
+}
diff --git a/lib/auth/autoupdate_agent_version_report_test.go b/lib/auth/autoupdate_agent_version_report_test.go
new file mode 100644
index 0000000000000..04cb0bc68c5da
--- /dev/null
+++ b/lib/auth/autoupdate_agent_version_report_test.go
@@ -0,0 +1,375 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/inventory"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func newFakeControlStream() fakeControlStream {
+	return fakeControlStream{
+		msgChan:  make(chan proto.UpstreamInventoryMessage),
+		doneChan: make(chan struct{}),
+	}
+}
+
+type fakeControlStream struct {
+	client.UpstreamInventoryControlStream
+	msgChan  chan proto.UpstreamInventoryMessage
+	doneChan chan struct{}
+}
+
+func (f fakeControlStream) CloseWithError(err error) error {
+	return nil
+}
+
+func (f fakeControlStream) Close() error {
+	return nil
+}
+
+func (f fakeControlStream) Recv() <-chan proto.UpstreamInventoryMessage {
+	return f.msgChan
+}
+
+func (f fakeControlStream) Done() <-chan struct{} {
+	return f.doneChan
+}
+
+func (f fakeControlStream) Send(ctx context.Context, msg proto.DownstreamInventoryMessage) error {
+	return nil
+}
+
+func (f fakeControlStream) fakeMsg(msg proto.UpstreamInventoryMessage) {
+	f.msgChan <- msg
+}
+
+func (f fakeControlStream) close() {
+	close(f.msgChan)
+}
+
+type fakeServer struct {
+	version       string
+	updateGroup   string
+	delay         time.Duration
+	roles         types.SystemRoles
+	updaterStatus types.UpdaterStatus
+	goodbye       *proto.UpstreamInventoryGoodbye
+}
+
+func TestServer_generateAgentVersionReport(t *testing.T) {
+	ctx := context.Background()
+	now := time.Now()
+	twoMinutesAgo := now.Add(-time.Minute * 2)
+	// agentRole are typicial roles an agent can have
+	agentRoles := types.SystemRoles{types.RoleNode, types.RoleApp}
+	updaterOK := types.UpdaterStatus_UPDATER_STATUS_OK
+
+	tests := []struct {
+		name     string
+		fixtures []fakeServer
+		expected *autoupdatev1pb.AutoUpdateAgentReportSpec
+	}{
+		{
+			name: "no servers",
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+			},
+		},
+		{
+			name: "no group, same version",
+			fixtures: []fakeServer{
+				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 4},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "control plane servers are ignored",
+			fixtures: []fakeServer{
+				{version: "1.2.3", roles: types.SystemRoles{types.RoleKube, types.RoleAuth}, updateGroup: "default"},
+				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleProxy}, updateGroup: "default"},
+				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleKube}, updateGroup: "default"},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 1},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "disabled or pinned updaters are ignored",
+			fixtures: []fakeServer{
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_PINNED, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_DISABLED, updateGroup: "default"},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 1},
+						},
+					},
+				},
+				Omitted: []*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
+					{Reason: omissionReasonUpdaterPinned, Count: 1},
+					{Reason: omissionReasonUpdaterDisabled, Count: 1},
+				},
+			},
+		},
+		{
+			name: "reloaded and terminating instances are ignored",
+			fixtures: []fakeServer{
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{SoftReload: true}},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{DeleteResources: true}},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 1},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "too recent servers are ignored",
+			fixtures: []fakeServer{
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+				{version: "1.2.3", delay: 90 * time.Second, roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 1},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "multiple versions and groups",
+			fixtures: []fakeServer{
+				{version: "1.2.3", updateGroup: "default", roles: agentRoles, updaterStatus: updaterOK},
+				{version: "1.2.4", updateGroup: "default", roles: agentRoles, updaterStatus: updaterOK},
+				{version: "1.2.5", updateGroup: "prod", roles: agentRoles, updaterStatus: updaterOK},
+				{version: "1.2.5", updateGroup: "prod", roles: agentRoles, updaterStatus: updaterOK},
+				{version: "1.2.5", updateGroup: "dev", roles: agentRoles, updaterStatus: updaterOK},
+			},
+			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(now),
+				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+					"default": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.3": {Count: 1},
+							"1.2.4": {Count: 1},
+						},
+					},
+					"dev": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.5": {Count: 1},
+						},
+					},
+					"prod": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+							"1.2.5": {Count: 2},
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clock := clockwork.NewFakeClockAt(twoMinutesAgo)
+			bk, err := memory.New(memory.Config{})
+			require.NoError(t, err)
+			auth := &Server{
+				cancelFunc: func() {},
+				logger:     logtest.NewLogger(),
+				ServerID:   uuid.NewString(),
+				Services: &Services{
+					// The inventory is running heartbeats on the background.
+					// If we don't create a presence service this will cause panics.
+					PresenceInternal: local.NewPresenceService(bk),
+				},
+			}
+			t.Cleanup(func() {
+				auth.Close()
+			})
+			controller := inventory.NewController(auth, nil, inventory.WithClock(clock))
+			for _, fixture := range tt.fixtures {
+				clock.Advance(fixture.delay)
+				stream := newFakeControlStream()
+				status := fixture.updaterStatus
+				if status == types.UpdaterStatus_UPDATER_STATUS_UNSPECIFIED {
+					status = types.UpdaterStatus_UPDATER_STATUS_OK
+				}
+				controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+					Services:         fixture.roles.StringSlice(),
+					ServerID:         uuid.New().String(),
+					Version:          fixture.version,
+					ExternalUpgrader: types.UpgraderKindTeleportUpdate,
+					UpdaterInfo:      &types.UpdaterV2Info{UpdaterStatus: status, UpdateGroup: fixture.updateGroup},
+				})
+				if fixture.goodbye != nil {
+					// Sending the message twice is a little hack to make sure that the auth received the goodbye at
+					// least once. Else, the auth might still be in the small frame when it received the message
+					// over the channel but has not stored it yet. When this happens the test becomes flaky.
+					// Ideally we would peek into the inventory internals and wait for the goodbye to be stored,
+					// but we don't have access to inventory's private field.
+					// Because the channel is not buffered and a single go routine is reading on the other side, we know
+					// that the routine is done processing the first messages if we can send the second.
+					stream.fakeMsg(fixture.goodbye)
+					stream.fakeMsg(fixture.goodbye)
+				}
+				t.Cleanup(stream.close)
+			}
+			auth.inventory = controller
+			auth.clock = clockwork.NewFakeClockAt(now)
+
+			report, err := auth.generateAgentVersionReport(ctx)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(
+				tt.expected, report.GetSpec(),
+				protocmp.Transform(),
+				protocmp.SortRepeatedFields(&autoupdatev1pb.AutoUpdateAgentReportSpec{}, "omitted")))
+		})
+	}
+}
+
+func TestServer_reportAgentVersions(t *testing.T) {
+	// Test setup: create auth.
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+
+	svc, err := local.NewAutoUpdateService(bk)
+	require.NoError(t, err)
+
+	now := time.Now()
+	twoMinutesAgo := now.Add(-time.Minute * 2)
+	clock := clockwork.NewFakeClockAt(twoMinutesAgo)
+
+	// Test setup: load fixtures.
+	const testNodeCount = 10
+	auth := &Server{
+		cancelFunc: func() {},
+		clock:      clock,
+		ServerID:   uuid.NewString(),
+		Services: &Services{
+			AutoUpdateService: svc,
+			// The inventory is running heartbeats on the background.
+			// If we don't create a presence service this will cause panics.
+			PresenceInternal: local.NewPresenceService(bk),
+		},
+		logger: logtest.NewLogger(),
+	}
+	t.Cleanup(func() {
+		auth.Close()
+	})
+	auth.Cache = auth.Services
+	controller := inventory.NewController(auth, nil,
+		inventory.WithClock(clock))
+	auth.inventory = controller
+
+	for range testNodeCount {
+		stream := newFakeControlStream()
+		controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+			Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
+			Version:          "1.2.3",
+			ServerID:         uuid.NewString(),
+			ExternalUpgrader: types.UpgraderKindTeleportUpdate,
+			UpdaterInfo: &types.UpdaterV2Info{
+				UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+				UpdateGroup:   "default",
+			},
+		})
+		t.Cleanup(stream.close)
+	}
+	ctx := context.Background()
+	rollout, err := autoupdate.NewAutoUpdateAgentRollout(&autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+		StartVersion:              "1.2.3",
+		TargetVersion:             "1.2.4",
+		Schedule:                  autoupdate.AgentsScheduleRegular,
+		AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
+		Strategy:                  autoupdate.AgentsStrategyHaltOnError,
+		MaintenanceWindowDuration: nil,
+	})
+	require.NoError(t, err)
+	_, err = svc.CreateAutoUpdateAgentRollout(ctx, rollout)
+	require.NoError(t, err)
+
+	// Test execution: compute and write report.
+	clock.Advance(2 * time.Minute)
+	auth.reportAgentVersions(ctx)
+
+	// Test validation
+	report, err := svc.GetAutoUpdateAgentReport(ctx, auth.ServerID)
+	require.NoError(t, err)
+
+	require.NotNil(t, report)
+	require.NotEmpty(t, report.GetSpec().GetGroups())
+	require.NotNil(t, report.GetSpec().GetGroups()["default"])
+	require.NotNil(t, report.GetSpec().GetGroups()["default"].GetVersions())
+	require.NotNil(t, report.GetSpec().GetGroups()["default"].GetVersions()["1.2.3"])
+	require.Equal(t, testNodeCount, int(report.GetSpec().GetGroups()["default"].GetVersions()["1.2.3"].GetCount()))
+}
diff --git a/lib/auth/autoupdate_rollout.go b/lib/auth/autoupdate_rollout.go
new file mode 100644
index 0000000000000..c3371c80f9a1f
--- /dev/null
+++ b/lib/auth/autoupdate_rollout.go
@@ -0,0 +1,174 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+	"math/rand/v2"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/constants"
+	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/lib/inventory"
+)
+
+// SampleAgentsFromAutoUpdateGroup iterates over every handle in the inventory to
+// build a random sample of agents belonging to a given group.
+// The main use-case for this function is to pick canaries that can be updated.
+func (a *Server) SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName string, sampleSize int, groups []string) ([]*autoupdatev1pb.Canary, error) {
+	if len(groups) == 0 {
+		return nil, trace.BadParameter("no groups specified")
+	}
+	isCatchAll := groupName == groups[len(groups)-1]
+	var groupSet map[string]struct{}
+
+	// Small optimization, we only need to build the groupSet if we are sampling the catch-all group
+	if isCatchAll {
+		groupSet = make(map[string]struct{})
+		for _, group := range groups {
+			groupSet[group] = struct{}{}
+		}
+	}
+
+	filter := func(handle inventory.UpstreamHandle) bool {
+		if result := filterHandler(handle, a.clock.Now()); result != autoUpdateFilterResultMatching {
+			return false
+		}
+
+		// If the agent group matches, we keep it.
+		if handle.Hello().UpdaterInfo.UpdateGroup == groupName {
+			// No need to check for UpdaterInfo being nil, it would have been filtered
+			// out by filterHandler().
+			return true
+		}
+
+		// If this is not the catch-all group, we filter the agent out
+		if !isCatchAll {
+			return false
+		}
+
+		// This is the catch-call group, it matches agents from every group not in groups.
+		_, ok := groupSet[handle.Hello().UpdaterInfo.UpdateGroup]
+		// If the agent group is not in the group list, it falls into the catch-all.
+		return !ok
+	}
+
+	sampler := newHandlerSampler(sampleSize, filter)
+
+	a.inventory.UniqueHandles(sampler.visit)
+
+	sampled := sampler.Sampled()
+	canaries := make([]*autoupdatev1pb.Canary, 0, len(sampled))
+	for _, h := range sampled {
+		hello := h.Hello()
+		updaterID, err := uuid.FromBytes(hello.UpdaterInfo.UpdateUUID)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		canaries = append(canaries, &autoupdatev1pb.Canary{
+			UpdaterId: updaterID.String(),
+			HostId:    hello.ServerID,
+			Hostname:  hello.Hostname,
+			Success:   false,
+		})
+	}
+	return canaries, nil
+}
+
+// handleSampler randomly samples handles from the inventory.
+// It implements Alan Waterman's Reservoir Sampling Algorithm R
+// (The Art of Computer Programming Volume 2).
+// See https://en.wikipedia.org/wiki/Reservoir_sampling for more details.
+type handleSampler struct {
+	sampleSize int
+	seenCount  int
+	filter     func(handle inventory.UpstreamHandle) bool
+	sample     []inventory.UpstreamHandle
+}
+
+func newHandlerSampler(sampleSize int, filter func(handle inventory.UpstreamHandle) bool) *handleSampler {
+	return &handleSampler{
+		sampleSize: sampleSize,
+		seenCount:  sampleSize,
+		filter:     filter,
+		sample:     make([]inventory.UpstreamHandle, 0, sampleSize),
+	}
+}
+
+// pass this function to inventory.AllHandles()
+func (h *handleSampler) visit(handle inventory.UpstreamHandle) {
+	// filter out everything we don't want
+	if !h.filter(handle) {
+		return
+	}
+
+	// Fill the reservoir
+	if len(h.sample) < h.sampleSize {
+		h.sample = append(h.sample, handle)
+		h.seenCount++
+		return
+	}
+
+	// Reservoir is already filled, replace existing elements.
+	if j := rand.N(h.seenCount); j < h.sampleSize {
+		h.sample[j] = handle
+	}
+	h.seenCount++
+}
+
+func (h *handleSampler) Sampled() []inventory.UpstreamHandle {
+	return h.sample
+}
+
+// LookupAgentInInventory looks for a specific hostID in the local inventory
+// and returns all the Hello messages associated to those agents.
+// Agents that joined less than a minute ago or that are terminating/restarting
+// are ignored.
+func (a *Server) LookupAgentInInventory(ctx context.Context, hostID string) ([]*proto.UpstreamInventoryHello, error) {
+	handles := a.inventory.Handles(hostID)
+	now := a.clock.Now()
+
+	var qualifiedHellos []*proto.UpstreamInventoryHello
+
+	for handle := range handles {
+		// If the instance is being soft-reloaded or shut down, we ignore it.
+		if goodbye := handle.Goodbye(); goodbye.GetSoftReload() || goodbye.GetDeleteResources() {
+			continue
+		}
+
+		// We skip servers that joined less than a minute ago as they might have been
+		// connected to another auth instance a few seconds ago, which would lead to double-counting.
+		if now.Sub(handle.RegistrationTime()) < constants.AutoUpdateAgentReportPeriod {
+			continue
+		}
+		// Do don't apply other filtering logic like filterHandle() does because the instance already
+		// got selected with strict constraints earlier during sampling. We don't want a filtering rule change, or an instance change, to make the lookup fail and block the rollout.
+		qualifiedHellos = append(qualifiedHellos, handle.Hello())
+	}
+
+	if len(qualifiedHellos) == 0 {
+		return nil, trace.NotFound("no control streams meet requirements for host %v", hostID)
+	}
+
+	return qualifiedHellos, nil
+
+}
diff --git a/lib/auth/autoupdate_rollout_test.go b/lib/auth/autoupdate_rollout_test.go
new file mode 100644
index 0000000000000..2a0618af08371
--- /dev/null
+++ b/lib/auth/autoupdate_rollout_test.go
@@ -0,0 +1,321 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"fmt"
+	"iter"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/inventory"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestSampleAgentsFromGroup(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+
+	auth := &Server{
+		cancelFunc: func() {},
+		clock:      clock,
+		ServerID:   uuid.NewString(),
+		logger:     logtest.NewLogger(),
+		Services: &Services{
+			// The inventory is running heartbeats on the background.
+			// If we don't create a presence service this will cause panics.
+			PresenceInternal: local.NewPresenceService(bk),
+		},
+	}
+	controller := inventory.NewController(auth, nil, inventory.WithClock(clock))
+	auth.inventory = controller
+	t.Cleanup(func() {
+		auth.Close()
+	})
+
+	const (
+		testNodeCount         = 1000
+		testGroupName         = "my-group"
+		testCatchAllGroupName = "catch-all-group"
+	)
+
+	testGroups := []string{testGroupName, testCatchAllGroupName}
+
+	for range testNodeCount {
+		updaterID := uuid.New()
+		stream := newFakeControlStream()
+		controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+			Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
+			Version:          "1.2.3",
+			ServerID:         uuid.NewString(),
+			ExternalUpgrader: types.UpgraderKindTeleportUpdate,
+			UpdaterInfo: &types.UpdaterV2Info{
+				UpdateUUID:    updaterID[:],
+				UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+				UpdateGroup:   testGroupName,
+			},
+		})
+		t.Cleanup(stream.close)
+	}
+
+	// Nodes that just registered are ignored, we advance the clock so our fixtures are not filtered out by filterHandler().
+	clock.Advance(2 * time.Minute)
+
+	// Text execution: check that we sample the correct amount of canaries
+	const sampleSize = 10
+	canaries, err := auth.SampleAgentsFromAutoUpdateGroup(t.Context(), testGroupName, sampleSize, testGroups)
+	require.NoError(t, err)
+	require.Len(t, canaries, sampleSize)
+
+	// Test execution: check that there were no duplicates in the samples
+	canarySet := make(map[string]*autoupdatev1pb.Canary)
+	for _, canary := range canaries {
+		canarySet[canary.UpdaterId] = canary
+	}
+	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
+
+	canaries2, err := auth.SampleAgentsFromAutoUpdateGroup(t.Context(), testGroupName, sampleSize, testGroups)
+	require.NoError(t, err)
+	require.Len(t, canaries2, sampleSize)
+	canarySet = make(map[string]*autoupdatev1pb.Canary)
+	for _, canary := range canaries2 {
+		canarySet[canary.UpdaterId] = canary
+	}
+	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
+
+	// Text execution: check that the random looks sane
+	var conflicts int
+	for i := range sampleSize {
+		if canaries[i].UpdaterId == canaries2[i].UpdaterId {
+			conflicts++
+		}
+	}
+	// The probability of having 4 nodes sampled at the same position twice in
+	// a row is 2e-10.
+	require.Less(t, conflicts, 4)
+
+	// Test execution: check that agents not belonging to any group are sampled whe requesting the catch-all group.
+	canariesCatchAll, err := auth.SampleAgentsFromAutoUpdateGroup(t.Context(), testCatchAllGroupName, sampleSize, []string{"group-a", testCatchAllGroupName})
+	require.NoError(t, err)
+	require.Len(t, canariesCatchAll, sampleSize)
+	canarySet = make(map[string]*autoupdatev1pb.Canary)
+	for _, canary := range canariesCatchAll {
+		canarySet[canary.UpdaterId] = canary
+	}
+	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
+
+	// Test execution: check that agents belonging to the catch-all group are sampled.
+	canariesCatchAll, err = auth.SampleAgentsFromAutoUpdateGroup(t.Context(), testGroupName, sampleSize, []string{"group-a", testGroupName})
+	require.NoError(t, err)
+	require.Len(t, canariesCatchAll, sampleSize)
+	canarySet = make(map[string]*autoupdatev1pb.Canary)
+	for _, canary := range canariesCatchAll {
+		canarySet[canary.UpdaterId] = canary
+	}
+	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
+}
+
+func TestLookupAgentInInventory(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+
+	auth := &Server{
+		cancelFunc: func() {},
+		clock:      clock,
+		ServerID:   uuid.NewString(),
+		logger:     logtest.NewLogger(),
+		Services: &Services{
+			// The inventory is running heartbeats on the background.
+			// If we don't create a presence service this will cause panics.
+			PresenceInternal: local.NewPresenceService(bk),
+		},
+	}
+	controller := inventory.NewController(auth, nil, inventory.WithClock(clock))
+	auth.inventory = controller
+	t.Cleanup(func() {
+		auth.Close()
+	})
+
+	const testNodeCount = 5
+	const testGroupName = "my-group"
+
+	hosts := make(map[string][]*proto.UpstreamInventoryHello, testNodeCount)
+
+	// Test setup:
+	// We register X nodes, node number 1 has 1 handler, node 2 has 2, ...
+	for i := range testNodeCount {
+		hostID := uuid.New().String()
+		updaterID := uuid.New()
+		hellos := make([]*proto.UpstreamInventoryHello, i+1)
+		for j := range i + 1 {
+			hello := &proto.UpstreamInventoryHello{
+				Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
+				Version:          fmt.Sprintf("1.2.%d", j),
+				ServerID:         hostID,
+				ExternalUpgrader: types.UpgraderKindTeleportUpdate,
+				UpdaterInfo: &types.UpdaterV2Info{
+					UpdateUUID:    updaterID[:],
+					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+					UpdateGroup:   testGroupName,
+				},
+			}
+			hellos[j] = hello
+
+			stream := newFakeControlStream()
+			controller.RegisterControlStream(stream, hello)
+			t.Cleanup(stream.close)
+		}
+		hosts[hostID] = hellos
+	}
+
+	clock.Advance(2 * time.Minute)
+
+	// Test execution: for each hostID registered, we get the handles and make sure we have the right length
+	// and content matches.
+
+	opts := cmp.Options{
+		cmpopts.SortSlices(func(a, b *proto.UpstreamInventoryHello) bool { return a.Version > b.Version }),
+		protocmp.Transform(),
+	}
+	for hostID, handles := range hosts {
+		result, err := auth.LookupAgentInInventory(t.Context(), hostID)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(handles, result, opts))
+	}
+}
+
+type fakeHandle struct {
+	inventory.UpstreamHandle
+	id int
+}
+
+func (f *fakeHandle) Hello() *proto.UpstreamInventoryHello {
+	return &proto.UpstreamInventoryHello{
+		Hostname: fmt.Sprintf("hostname-%d", f.id),
+	}
+}
+
+func TestHandlerSampler(t *testing.T) {
+	filterOK := func(handle inventory.UpstreamHandle) bool {
+		return true
+	}
+	filterKO := func(handle inventory.UpstreamHandle) bool {
+		return false
+	}
+
+	generateHandles := func(i int) iter.Seq[inventory.UpstreamHandle] {
+		return func(yield func(inventory.UpstreamHandle) bool) {
+			for j := range i {
+				yield(&fakeHandle{id: j})
+			}
+		}
+	}
+
+	const testSampleSize = 10
+	// no agents to sample
+	// reservoir not filled yet
+	// reservoir filled
+	// filter always rejecting
+	tests := []struct {
+		name              string
+		filter            func(handle inventory.UpstreamHandle) bool
+		initialSeenCount  int
+		handleFixtures    iter.Seq[inventory.UpstreamHandle]
+		expectedSeenCount int
+		assertSample      func(t *testing.T, reservoir []inventory.UpstreamHandle)
+	}{
+		{
+			name:              "filter rejects all",
+			filter:            filterKO,
+			initialSeenCount:  0,
+			handleFixtures:    generateHandles(100),
+			expectedSeenCount: 0,
+			assertSample: func(t *testing.T, reservoir []inventory.UpstreamHandle) {
+				require.Empty(t, reservoir)
+			},
+		},
+		{
+			name:              "no agent to sample",
+			filter:            filterOK,
+			initialSeenCount:  0,
+			handleFixtures:    generateHandles(0),
+			expectedSeenCount: 0,
+			assertSample: func(t *testing.T, reservoir []inventory.UpstreamHandle) {
+				require.Empty(t, reservoir)
+			},
+		},
+		{
+			name:              "reservoir not filled entirely",
+			filter:            filterOK,
+			initialSeenCount:  0,
+			handleFixtures:    generateHandles(5),
+			expectedSeenCount: 5,
+			assertSample: func(t *testing.T, reservoir []inventory.UpstreamHandle) {
+				require.Len(t, reservoir, 5)
+				for i, h := range reservoir {
+					expectedHostname := fmt.Sprintf("hostname-%d", i)
+					require.Equal(t, expectedHostname, h.Hello().Hostname)
+				}
+			},
+		},
+		{
+			name:              "overflowing reservoir",
+			filter:            filterOK,
+			initialSeenCount:  0,
+			handleFixtures:    generateHandles(110),
+			expectedSeenCount: 110,
+			assertSample: func(t *testing.T, reservoir []inventory.UpstreamHandle) {
+				require.Len(t, reservoir, testSampleSize)
+				// the probability of no elements being sampled in the last 100 elements is 10e-200
+				require.NotElementsMatch(t, slices.Collect(generateHandles(testSampleSize)), reservoir)
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sampler := handleSampler{
+				sampleSize: testSampleSize,
+				seenCount:  test.initialSeenCount,
+				filter:     test.filter,
+				sample:     make([]inventory.UpstreamHandle, 0, testSampleSize),
+			}
+			for handle := range test.handleFixtures {
+				sampler.visit(handle)
+			}
+
+			require.Equal(t, test.expectedSeenCount, sampler.seenCount)
+			test.assertSample(t, sampler.sample)
+		})
+	}
+}
diff --git a/lib/auth/aws_certs.go b/lib/auth/aws_certs.go
deleted file mode 100644
index c867b9d8a9599..0000000000000
--- a/lib/auth/aws_certs.go
+++ /dev/null
@@ -1,756 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-// These certificates can be found at
-// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-rsa2048.html
-var awsRSA2048CertBytes = map[string][]byte{
-	"af-south-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAIFI+O5A6/ZIMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTA2MDQx
-MjQ4MDRaGA8yMTk4MTEwNzEyNDgwNFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAy7/WHBBHOrk+20aumT07g8rxrSM0UXgki3eYgKauPCG4Xx//vwQbuZwI
-oeVmR9nqnhfij2wOcQdbLandh0EGtbxerete3IoXzd1KXJb11PVmzrzyu5SPBPuP
-iCeV4qdjjkXo2YWM6t9YQ911hcG96YSp89TBXFYUh3KLxfqAdTVhuC0NRGhXpyii
-j/czo9njofHhqhTr7UEyPun8NVS2QWctLQ86N5zWR3Q0GRoVqqMrJs0cowHTrVw2
-9Qr7QBjjBOVbyYmtYxm/DtiKprYV/e6bCAVok015X1sZDd3oCOQNoGlv5XbHJe2o
-JFD8GRRy2rkWO/lNwVFDcwec6zC3QwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCE
-goqzjpCpmMgCpszFHwvRaSMbspKtK7wNImUjrSBOfBJsfFulyg1Zgn2nDCK7kQhx
-jMJmNIvXbps3yMqQ2cHUkKcKf5t+WldfeT4Vk1Rz6HSA8sd0kgVcIesIaoy2aaXU
-VEB/oQziRGyKdN1d4TGYVZXG44CkrzSDvlbmfiTq5tL+kAieznVF3bzHgPZW6hKP
-EXC3G/IXrXicFEe6YyE1Rakl62VncYSXiGe/i2XvsiNH3Qlmnx5XS7W0SCN0oAxW
-EH9twibauv82DVg1WOkQu8EwFw8hFde9X0Rkiu0qVcuU8lJgFEvPWMDFU5sGB6ZM
-gkEKTzMvlZpPbBhg99Jl
------END CERTIFICATE-----`),
-	"ap-east-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAMoxixvs3YssMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA3MjAw
-ODQ0NDRaGA8yMTk3MTIyMzA4NDQ0NFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA4T1PNsOg0FDrGlWePoHeOSmOJTA3HCRy5LSbYD33GFU2eBrOIxoU/+SM
-rInKu3GghAMfH7WxPW3etIAZiyTDDU5RLcUq2Qwdr/ZpXAWpYocNc/CEmBFtfbxF
-z4uwBIN3/drM0RSbe/wP9EcgmNUGQMMZWeAji8sMtwpOblNWAP9BniUG0Flcz6Dp
-uPovwDTLdAYT3TyhzlohKL3f6O48TR5yTaV+3Ran2SGRhyJjfh3FRpP4VC+z5LnT
-WPQHN74Kdq35UgrUxNhJraMGCzznolUuoR/tFMwR93401GsM9fVA7SW3jjCGF81z
-PSzjy+ArKyQqIpLW1YGWDFk3sf08FQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDK
-2/+C3nPMgtyOFX/I3Cyk+Pui44IgOwCsIdNGwuJysdqp5VIfnjegEu2zIMWJSKGO
-lMZoQXjffkVZZ97J7RNDW06oB7kj3WVE8a7U4WEOfnO/CbMUf/x99CckNDwpjgW+
-K8V8SzAsQDvYZs2KaE+18GFfLVF1TGUYK2rPSZMHyX+v/TIlc/qUceBycrIQ/kke
-jDFsihUMLqgmOV2hXKUpIsmiWMGrFQV4AeV0iXP8L/ZhcepLf1t5SbsGdUA3AUY1
-3If8s81uTheiQjwY5t9nM0SY/1Th/tL3+RaEI79VNEVfG1FQ8mgqCK0ar4m0oZJl
-tmmEJM7xeURdpBBx36Di
------END CERTIFICATE-----`),
-	"ap-northeast-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAL9KIB7Fgvg/MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
-OTAwMjVaGA8yMTk1MDExNzA5MDAyNVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAz0djWUcmRW85C5CiCKPFiTIvj6y2OuopFxNE5d3Wtab10bm06vnXVKXu
-tz3AndG+Dg0zIL0gMlU+QmrSR0PH2PfV9iejfLak9iwdm1WbwRrCEAj5VxPe0Q+I
-KeznOtxzqQ5Wo5NLE9bA61sziUAFNVsTFUzphEwRohcekYyd3bBC4v/RuAjCXHVx
-40z6AIksnAOGN2VABMlTeMNvPItKOCIeRLlllSqXX1gbtL1gxSW40JWdF3WPB68E
-e+/1U3F7OEr7XqmNODOL6yh92QqZ8fHjG+afOL9Y2Hc4g+P1nk4w4iohQOPABqzb
-MPjK7B2Rze0f9OEc51GBQu13kxkWWQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU5DS5IFdU/QwYbikgtWvkU3fDwRgwgY4GA1UdIwSBhjCBg4AU5DS5
-IFdU/QwYbikgtWvkU3fDwRihYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAL9KIB7Fgvg/MBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAG/N7ua8IE9IMyno0n5T57erBvLTOQ79fIJN
-Mf+mKRM7qRRsdg/eumFft0rLOKo54pJ+Kim2cngCWNhkzctRHBV567AJNt4+ZDG5
-hDgV0IxWO1+eaLE4qzqWP/9VrO+p3reuumgFZLVpvVpwXBBeBFUf2drUR14aWfI2
-L/6VGINXYs7uP8v/2VBS7r6XZRnPBUy/R4hv5efYXnjwA9gq8+a3stC2ur8m5ySl
-faKSwE4H320yAyaZWH4gpwUdbUlYgPHtm/ohRtiWPrN7KEG5Wq/REzMIjZCnxOfS
-6KR6PNjlhxBsImQhmBvz6j5PLQxOxBZIpDoiK278e/1Wqm9LrBc=
------END CERTIFICATE-----`),
-	"ap-northeast-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJANuCgCcHtOJhMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA5MTQx
-NTU3NDRaGA8yMTk1MDIxNzE1NTc0NFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA66iNv6pJPmGM20W8HbVYJSlKcAg2vUGx8xeAbzZIQdpGfkabVcUHGB6m
-Gy59VXDMDlrJckDDk6dxUOhmcX9z785TtVZURq1fua9QosdbTzX4kAgHGdp4xQEs
-mO6QZqg5qKjBP6xr3+PshfQ1rB8Bmwg0gXEm22CC7o77+7N7Mu2sWzWbiUR7vil4
-9FjWS8XmMNwFTlShp4l1TDTevDWW/uYmC30RThM9S4QPvTZ0rAS18hHVam8BCTxa
-LHaVCH/Yy52rsz0hM/FlghnSnK105ZKj+b+KIp3adBL8OMCjgc/Pxi0+j3HQLdYE
-32+FaXWU84D2iP2gDT28evnstzuYTQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC1
-mA4q+12pxy7By6g3nBk1s34PmWikNRJBwOqhF8ucGRv8aiNhRRye9lokcXomwo8r
-KHbbqvtK85l0xUZp/Cx4sm4aTgcMvfJP29jGLclDzeqADIvkWEJ4+xncxSYVlS9x
-+78TvF/+8h9U2LnSl64PXaKdxHy2IsHIVRN4GtoaP2Xhpa1S0M328Jykq/571nfN
-1WRD1c/fQf1edgzRjhQ4whcAhv7WRRF+qTbfQJ/vDxy8lkiOsvU9XzUaZ0fZSfXX
-wXxZamQbONvFcxVHY/0PSiM8nQoUmkkBQuKleDwRWvkoJKYKyr3jvXK7HIWtMrO4
-jmXe0aMy3thyK6g5sJVg
------END CERTIFICATE-----`),
-	"ap-northeast-3": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAMn1yPk22ditMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNzA3MTkx
-MTEyNThaGA8yMTk2MTIyMjExMTI1OFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEArznEYef8IjhrJoazI0QGZkmlmHm/4rEbyQbMNifxjsDE8YWtHNwaM91z
-zmyK6Sk/tKlWxcnl3g31iq305ziyFPEewe5Qbwf1iz2cMsvfNBcTh/E6u+mBPH3J
-gvGanqUJt6c4IbipdEouIjjnynyVWd4D6erLl/ENijeR1OxVpaqSW5SBK7jms49E
-pw3wtbchEl3qsE42Ip4IYmWxqjgaxB7vps91n4kfyzAjUmklcqTfMfPCkzmJCRgp
-Vh1C79vRQhmriVKD6BXwfZ8tG3a7mijeDn7kTsQzgO07Z2SAE63PIO48JK8HcObH
-tXORUQ/XF1jzi/SIaUJZT7kq3kWl8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBj
-ThtO9dLvU2QmKuXAhxXjsIdlQgGG3ZGh/Vke4If1ymgLx95v2Vj9Moxk+gJuUSRL
-BzFte3TT6b3jPolbECgmAorjj8NxjC17N8QAAI1d0S0gI8kqkG7V8iRyPIFekv+M
-pcai1+cIv5IV5qAz8QOMGYfGdYkcoBjsgiyvMJu/2N2UbZJNGWvcEGkdjGJUYYOO
-NaspCAFm+6HA/K7BD9zXB1IKsprLgqhiIUgEaW3UFEbThJT+z8UfHG9fQjzzfN/J
-nT6vuY/0RRu1xAZPyh2gr5okN/s6rnmh2zmBHU1n8cbCc64MVfXe2g3EZ9Glq/9n
-izPrI09hMypJDP04ugQc
------END CERTIFICATE-----`),
-	"ap-south-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAPRYyD8TtmC0MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjAzMDcx
-MDQ1MDFaGA8yMTk1MDgxMTEwNDUwMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA0LSS5I/eCT2PM0+qusorBx67QL26BIWQHd/yF6ARtHBb/1DdFLRqE5Dj
-07Xw7eENC+T79mOxOAbeWg91KaODOzw6i9I/2/HpK0+NDEdD6sPKDA1d45jRra+v
-CqAjI+nV9Vw91wv7HjMk3RcjWGziM8/hw+3YNIutt7aQzZRwIWlBpcqx3/AFd8Eu
-2UsRMSHgkGUW6UzUF+h/U8218XfrauKNGmNKDYUhtmyBrHT+k6J0hQ4pN7fe6h+Z
-w9RVHm24BGhlLxLHLmsOIxvbrF277uX9Dxu1HfKfu5D2kimTY7xSZDNLR2dt+kNY
-/+iWdIeEFpPT0PLSILt52wP6stF+3QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBI
-E6w+WWC2gCfoJO6c9HMyGLMFEpqZmz1n5IcQt1h9iyO7Vkm1wkJiZsMhXpk73zXf
-TPxuXEacTX3SOEa07OIMCFwkusO5f6leOyFTynHCzBgZ3U0UkRVZA3WcpbNB6Dwy
-h7ysVlqyT9WZd7EOYm5j5oue2G2xdei+6etgn5UjyWm6liZGrcOF6WPTdmzqa6WG
-ApEqanpkQd/HM+hUYex/ZS6zEhd4CCDLgYkIjlrFbFb3pJ1OVLztIfSN5J4Oolpu
-JVCfIq5u1NkpzL7ys/Ub8eYipbzI6P+yxXiUSuF0v9b98ymczMYjrSQXIf1e8In3
-OP2CclCHoZ8XDQcvvKAh
------END CERTIFICATE-----`),
-	"ap-south-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAIVWfPw/X82fMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MDQx
-NDMwMjhaGA8yMjAxMTIwODE0MzAyOFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAg29QEFriG+qFEjYW/v62nN70lMJY/Hevx5TtmU/VIYBPQa3HUGTBAbbI
-2Tmy8UMpa8kZeaYeI3RAfiQWt0Ws7wUrBuO2Pdp518WDPaJUH7RWEuu1BDDkyZRW
-NAMNPCn3ph7Od243IFcLGku7HVekel5poqRpSfojrMasjlf+CvixUeAJbmFoxUHK
-kh5unzG2sZyO4wHXcJPQkRf5a8zSTPe9YZP1kXPPEv4p/jTSggaYPxXyS6QVaTlV
-zLeLFZ0fesLPMeil3KYQtV7IKLQiEA2F6dxWnxNWQlyMHtdq6PucfEmVx17i/Xza
-yNBRo0azY8WUNVkEXrRhp/pU8Nh3GQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU9AO1aZk9RLXk2ZvRVoUxYvQy9uwwgY4GA1UdIwSBhjCBg4AU9AO1
-aZk9RLXk2ZvRVoUxYvQy9uyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAIVWfPw/X82fMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBADexluMRQRftqViahCnauEWGdMvLCBr8A+Yr
-6hJq0guoxEk/lahxR137DnfMPuSbi1Rx5QKo7oBrWfG/zsgQUnF2IwHTzwD+i/2m
-XCane6FiS5RpK3lGdILq8ZmlhQk+6iI8yoZLr0LCfTh+CLgIKHOknfR5lFzgzAiF
-SI8/Q9mm+uvYtSTZECI6Zh57QZPoETAG/yl+9jiOy2lAelqa/k1i+Qo8gMfOc+Pm
-dwY7o6fV+oucgRlsdey6VM45LeyILQqv0RXtVzjuowanzmCCFMjgqiO9oZAWu4Oh
-+F3unijELo01vZJs8s2N3KGlo3/jtUFTX6RTKShZlAPLwBi5GMI=
------END CERTIFICATE-----`),
-	"ap-southeast-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAJVMGw5SHkcvMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
-ODU3MTlaGA8yMTk1MDQwMzA4NTcxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAlaSSLfBl7OgmikjLReHuNhVuvM20dCsVzptUyRbut+KmIEEc24wd/xVy
-2RMIrydGedkW4tUjkUyOyfET5OAyT43jTzDPHZTkRSVkYjBdcYbe9o/0Q4P7IVS3
-XlvwrUu0qo9nSID0mxMnOoF1l8KAqnn10tQ0W+lNSTkasW7QVzcb+3okPEVhPAOq
-MnlY3vkMQGI8zX4iOKbEcSVIzf6wuIffXMGHVC/JjwihJ2USQ8fq6oy686g54P4w
-ROg415kLYcodjqThmGJPNUpAZ7MOc5Z4pymFuCHgNAZNvjhZDA842Ojecqm62zcm
-Tzh/pNMNeGCRYq2EQX0aQtYOIj7bOQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU6SSB+3qALorPMVNjToM1Bj3oJMswgY4GA1UdIwSBhjCBg4AU6SSB
-+3qALorPMVNjToM1Bj3oJMuhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAJVMGw5SHkcvMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAF/0dWqkIEZKg5rca8o0P0VS+tolJJE/FRZO
-atHOeaQbWzyac6NEwjYeeV2kY63skJ+QPuYbSuIBLM8p/uTRIvYM4LZYImLGUvoO
-IdtJ8mAzq8CZ3ipdMs1hRqF5GRp8lg4w2QpX+PfhnW47iIOBiqSAUkIr3Y3BDaDn
-EjeXF6qS4iPIvBaQQ0cvdddNh/pE33/ceghbkZNTYkrwMyBkQlRTTVKXFN7pCRUV
-+L9FuQ9y8mP0BYZa5e1sdkwebydU+eqVzsil98ntkhpjvRkaJ5+Drs8TjGaJWlRw
-5WuOr8unKj7YxdL1bv7//RtVYVVi296ldoRUYv4SCvJF11z0OdQ=
------END CERTIFICATE-----`),
-	"ap-southeast-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAL2bOgb+dq9rMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
-OTAwNTdaGA8yMTk1MDQwMzA5MDA1N1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAmRcyLWraysQS8yDC1b5Abs3TUaJabjqWu7d5gHik5Icd6dKl8EYpQSeS
-vz6pLhkgO4xBbCRGlgE8LS/OijcZ5HwdrxBiKbicR1YvIPaIyEQQvF5sX6UWkGYw
-Ma5IRGj4YbRmJkBybw+AAV9Icb5LJNOMWPi34OWM+2tMh+8L234v/JA6ogpdPuDr
-sM6YFHMZ0NWo58MQ0FnEj2D7H58Ti//vFPl0TaaPWaAIRF85zBiJtKcFJ6vPidqK
-f2/SDuAvZmyHC8ZBHg1moX9bR5FsU3QazfbW+c+JzAQWHj2AaQrGSCITxCMlS9sJ
-l51DeoZBjnx8cnRe+HCaC4YoRBiqIQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU/wHIo+r5U31VIsPoWoRVsNXGxowwgY4GA1UdIwSBhjCBg4AU/wHI
-o+r5U31VIsPoWoRVsNXGxoyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAL2bOgb+dq9rMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBACobLvj8IxlQyORTz/9q7/VJL509/p4HAeve
-92riHp6+Moi0/dSEYPeFTgdWB9W3YCNc34Ss9TJq2D7t/zLGGlbI4wYXU6VJjL0S
-hCjWeIyBXUZOZKFCb0DSJeUElsTRSXSFuVrZ9EAwjLvHni3BaC9Ve34iP71ifr75
-8Tpk6PEj0+JwiijFH8E4GhcV5chB0/iooU6ioQqJrMwFYnwo1cVZJD5v6D0mu9bS
-TMIJLJKv4QQQqPsNdjiB7G9bfkB6trP8fUVYLHLsVlIy5lGx+tgwFEYkG1N8IOO/
-2LCawwaWm8FYAFd3IZl04RImNs/IMG7VmH1bf4swHOBHgCN1uYo=
------END CERTIFICATE-----`),
-	"ap-southeast-3": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAMtdyRcH51j9MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA0MDgx
-MjM5MTZaGA8yMjAxMDkxMjEyMzkxNlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvUsKCxoH6KXRYJLeYTWAQfaBQeCwhJaR56mfUeFHJE4g8aFjWkiN4uc1
-TvOyYNnIZKTHWmzmulmdinWNbwP0GiROHb/i7ro0HhvnptyycGt8ag8affiIbx5X
-7ohdwSN2KJ6G0IKflIx7f2NEI0oAMM/9k+T1eVF+MVWzpZoiDp8frLNkqp8+RAgz
-ScZsbRfwv3u/if5xJAvdg2nCkIWDMSHEVPoz0lJo7v0ZuDtWWsL1LHnL5ozvsKEk
-+ZJyEi23r+U1hIT1NTBdp4yoigNQexedtwCSr7q36oOdDwvZpqYlkLi3uxZ4ta+a
-01pzOSTwMLgQZSbKWQrpMvsIAPrxoQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU1GgnGdNpbnL3lLF30Jomg7Ji9hYwgY4GA1UdIwSBhjCBg4AU1Ggn
-GdNpbnL3lLF30Jomg7Ji9hahYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAMtdyRcH51j9MBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBACVl00qQlatBKVeiWMrhpczsJroxDxlZTOba
-6wTMZk7c3akb6XMOSZFbGaifkebPZqTHEhDlrClM2j9AIlYcCx6YCrTf4cuhn2mD
-gcJN33143eOWSaeRY3ee4j+V9ne98y3kO2wLz95VrRgclPFR8po2iWGzGhwUi+FG
-q8dXeCH3N0DZgQsSgQWwmdNQXZZej6RHLU/8In5trHKLY0ppnLBjn/UZQbeTyW5q
-RJB3GaveXjfgFUWj2qOcDuRGaikdS+dYaLsi5z9cA3FolHzWxx9MOs8io8vKqQzV
-XUrLTNWwuhZy88cOlqGPxnoRbw7TmifwPw/cunNrsjUUOgs6ZTk=
------END CERTIFICATE-----`),
-	"ap-southeast-4": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAN4GTQ64zVs8MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTMx
-MzMzMDBaGA8yMjAxMTIxNzEzMzMwMFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA2BYgeCr+Rk/jIAEDOHS7wJql62vc83QEwjuzk0qOFEReIZzlN1fBRNXK
-g0T178Kd3gLYcE59wEFbTe/X5yOA1Lo95x1anSAo7R+Cisf9C2HQuJp+gVb+zx71
-lniPF7gHziGpm0M8DdAU/IW+wkZwGbP4z7Hq9+bJ0P2ltvPJ5yxSgkFuDsI9VBHa
-CLoprHsCHh2VdP8KcMgQQMmHe1NmBpyTk0ul/aLmQkCQEX6ZIRGOeq228fwlh/t+
-Ho+jv87duihVKic6MrL32SlD+maX0LSDUydWdaOLLTGkh7oV7+bFuH6msrXUu+Ur
-ZEP1r/MidCWMhfgrFzeTBzOHA97qxQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUcHMd1cHqzmsQ5hpUK3EMLhHdsi4wgY4GA1UdIwSBhjCBg4AUcHMd
-1cHqzmsQ5hpUK3EMLhHdsi6hYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAN4GTQ64zVs8MBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAI4PFyVN+7EGSObioiPnv0LL0f70SSzUZJ8p
-XO90d4rWea7jIbgZ2AKb+ErynkU9xVg7XQQ5k6KDWgp/4jYFL2dqnt/YAY4PS0un
-RSrYElawxLT0BcLn4rcSDC79vQe1xGC5//wDdV6b399COAHRAK6axWYy5w32u9PL
-uw0cIp3Ch8JoNwcgTHKRRGzePmBeR4PNqhHTArG4/dJk6/aUO4OpX0WzI6L67CGY
-6Nex3dau+gkLCK93dTEkrXtyXHu4wB0J9zd1w+iQ0SEa9eKc78/NjEsF/FZdGrWC
-t57lIMOOXJhQ1kRgSwNeZdQWV1dRakvO6sfcvVYkfj1wAvZvvAw=
------END CERTIFICATE-----`),
-	"ca-central-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAJNKhJhaJOuMMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA3Mjkx
-MTM3MTdaGA8yMTk2MDEwMjExMzcxN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAhDUh6j1ACSt057nSxAcwMaGr8Ez87VA2RW2HyY8l9XoHndnxmP50Cqld
-+26AJtltlqHpI1YdtnZ6OrVgVhXcVtbvte0lZ3ldEzC3PMvmISBhHs6A3SWHA9ln
-InHbToLX/SWqBHLOX78HkPRaG2k0COHpRy+fG9gvz8HCiQaXCbWNFDHZev9OToNI
-xhXBVzIa3AgUnGMalCYZuh5AfVRCEeALG60kxMMC8IoAN7+HG+pMdqAhJxGUcMO0
-LBvmTGGeWhi04MUZWfOkwn9JjQZuyLg6B1OD4Y6s0LB2P1MovmSJKGY4JcF8Qu3z
-xxUbl7Bh9pvzFR5gJN1pjM2n3gJEPwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAJ
-UNKM+gIIHNk0G0tzv6vZBT+o/vt+tIp8lEoZwaPQh1121iw/I7ZvhMLAigx7eyvf
-IxUt9/nf8pxWaeGzi98RbSmbap+uxYRynqe1p5rifTamOsguuPrhVpl12OgRWLcT
-rjg/K60UMXRsmg2w/cxV45pUBcyVb5h6Op5uEVAVq+CVns13ExiQL6kk3guG4+Yq
-LvP1p4DZfeC33a2Rfre2IHLsJH5D4SdWcYqBsfTpf3FQThH0l0KoacGrXtsedsxs
-9aRd7OzuSEJ+mBxmzxSjSwM84Ooh78DjkdpQgv967p3d+8NiSLt3/n7MgnUy6WwB
-KtDujDnB+ttEHwRRngX7
------END CERTIFICATE-----`),
-	"ca-west-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJALyTn5IHrIZjMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMzEyMDcx
-NTM3MDFaGA8yMjAzMDUxMzE1MzcwMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA1GP5os424BJmGPCKOSgOclP7lzUiB85du03M4hfjzSOszsBpmBGFDLz1
-owYHtIxlq3+Vi1Lt5Qlx3id/ov1QyaBPFWXVeklHVXy9vieCcI3TdjGjTl1W/8MM
-m3X26QPcsnHM/Kk2wJ7s186MrqmdSsp3SCPpxv4vEG2Q9yR2bXY41hpc2rWlW8qU
-D0JGXluvmmAdFnto20l1XWZ6xFen1h60DRugek/ufCbN+ljKy0xLqPoavH0Ybjsb
-UpsAsBs7phaoN+X/5hIERfbp5LfVnqq54pNG5KNu4KynfW9+kA/WS4cJ6FTTN5t+
-y0P1HvcL+BL2RuDy6T2bB21xw5WqtQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQURTvu/Dd4zDnmS5G5CfVLnmUBNOswgY4GA1UdIwSBhjCBg4AURTvu
-/Dd4zDnmS5G5CfVLnmUBNOuhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJALyTn5IHrIZjMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAFt523A3Aug6/F8xxyITgA8gkU0btFhlXNSP
-U4U2OQ9n0tWI9WqnKNWH3KBxwY5EPitU6b3LM4xc9lDWpz7h2Pto+WhxP9LVKe6f
-r8r7teTLCVZ7cfYZHzHg+flZjVpAgzE5BVfrRlj3QKpv0hYT3J1wMtI++Vorq5Nf
-aPjzedehJLhmZVALwnfqfLrgv6/gmraP9Vmoa8U4D6AljNiQGYaLwyoPoRm3bUs2
-v1Mh9GkEQ1b9+1pFXcqgzJJTGRuiPCyPbECI79FAnx5JM/CkGJV8HlOmjIW1qkK1
-Y2qT7wzErrKLJyB53Pw15BdIM1onbDAQreZb0yZQLdoEl/tx7Uk=
------END CERTIFICATE-----`),
-	"cn-north-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAOtrM5XLDSjCMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQx
-MDAxNDJaGA8yMTk1MDExNzEwMDE0MlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvVBz+WQNdPiM9S+aUULOQEriTmNDUrjLWLr7SfaOJScBzis5D5ju0jh1
-+qJdkbuGKtFX5OTWTm8pWhInX+hIOoS3exC4BaANoa1A3o6quoG+Rsv72qQf8LLH
-sgEi6+LMlCN9TwnRKOToEabmDKorss4zFl7VSsbQJwcBSfOcIwbdRRaW9Ab6uJHu
-79L+mBR3Ea+G7vSDrVIA8goAPkae6jY9WGw9KxsOrcvNdQoEkqRVtHo4bs9fMRHU
-Etphj2gh4ObXlFN92VtvzD6QBs3CcoFWgyWGvzg+dNG5VCbsiiuRdmii3kcijZ3H
-Nv1wCcZoEAqH72etVhsuvNRC/xAP8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA8
-ezx5LRjzUU9EYWYhyYIEShFlP1qDHs7F4L46/5lc4pL8FPoQm5CZuAF31DJhYi/b
-fcV7i3n++/ymQbCLC6kAg8DUB7NrcROll5ag8d/JXGzcTCnlDXLXx1905fPNa+jI
-0q5quTmdmiSi0taeaKZmyUdhrB+a7ohWdSdlokEIOtbH1P+g5yll3bI2leYE6Tm8
-LKbyfK/532xJPqO9abx4Ddn89ZEC6vvWVNDgTsxERg992Wi+/xoSw3XxkgAryIv1
-zQ4dQ6irFmXwCWJqc6kHg/M5W+z60S/94+wGTXmp+19U6Rkq5jVMLh16XJXrXwHe
-4KcgIS/aQGVgjM6wivVA
------END CERTIFICATE-----`),
-	"cn-northwest-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAPu4ssY3BlzcMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEyMDMy
-MTI5MzJaGA8yMTk1MDUwODIxMjkzMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAsOiGi4A6+YTLzCdIyP8b8SCT2M/6PGKwzKJ5XbSBoL3gsnSWiFYqPg9c
-uJPNbiy9wSA9vlyfWMd90qvTfiNrT6vewP813QdJ3EENZOx4ERcf/Wd22tV72kxD
-yw1Q3I1OMH4bOItGQAxU5OtXCjBZEEUZooOkU8RoUQOU2Pql4NTiUpzWacNutAn5
-HHS7MDc4lUlsJqbN+5QW6fFrcNG/0Mrib3JbwdFUNhrQ5j+Yq5h78HarnUivnX/3
-Ap+oPbentv1qd7wvPJu556LZuhfqI0TohiIT1Ah+yUdN5osoaMxTHKKtf/CsSJ1F
-w3qXqFJQA0VWsqjFyHXFI32I/GOupwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCn
-Um00QHvUsJSN6KATbghowLynHn3wZSQsuS8E0COpcFJFxP2SV0NYkERbXu0n/Vhi
-yq5F8v4/bRA2/xpedLWmvFs7QWlomuXhSnYFkd33Z5gnXPb9vRkLwiMSw4uXls35
-qQraczUJ9EXDhrv7VmngIk9H3YsxYrlDGEqh/oz4Ze4ULOgnfkauanHikk+BUEsg
-/jsTD+7e+niEzJPihHdsvKFDlud5pakEzyxovHwNJ1GS2I//yxrJFIL91mehjqEk
-RLPdNse7N6UvSnuXcOokwu6l6kfzigGkJBxkcq4gre3szZFdCQcUioj7Z4xtuTL8
-YMqfiDtN5cbD8R8ojw9Y
------END CERTIFICATE-----`),
-	"eu-central-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAKD+v6LeR/WrMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
-OTA4MTlaGA8yMTk1MDExNzA5MDgxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAka8FLhxs1cSJGK+Q+q/vTf8zVnDAPZ3U6oqppOW/cupCtpwMAQcky8DY
-Yb62GF7+C6usniaq/9W6xPn/3o//wti0cNt6MLsiUeHqNl5H/4U/Q/fR+GA8pJ+L
-npqZDG2tFi1WMvvGhGgIbScrjR4VO3TuKy+rZXMYvMRk1RXZ9gPhk6evFnviwHsE
-jV5AEjxLz3duD+u/SjPp1vloxe2KuWnyC+EKInnka909sl4ZAUh+qIYfZK85DAjm
-GJP4W036E9wTJQF2hZJrzsiB1MGyC1WI9veRISd30izZZL6VVXLXUtHwVHnVASrS
-zZDVpzj+3yD5hRXsvFigGhY0FCVFnwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUxC2l6pvJaRflgu3MUdN6zTuP6YcwgY4GA1UdIwSBhjCBg4AUxC2l
-6pvJaRflgu3MUdN6zTuP6YehYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAKD+v6LeR/WrMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAIK+DtbUPppJXFqQMv1f2Gky5/82ZwgbbfXa
-HBeGSii55b3tsyC3ZW5ZlMJ7Dtnr3vUkiWbV1EUaZGOUlndUFtXUMABCb/coDndw
-CAr53XTv7UwGVNe/AFO/6pQDdPxXn3xBhF0mTKPrOGdvYmjZUtQMSVb9lbMWCFfs
-w+SwDLnm5NF4yZchIcTs2fdpoyZpOHDXy0xgxO1gWhKTnYbaZOxkJvEvcckxVAwJ
-obF8NyJla0/pWdjhlHafEXEN8lyxyTTyOa0BGTuYOBD2cTYYynauVKY4fqHUkr3v
-Z6fboaHEd4RFamShM8uvSu6eEFD+qRmvqlcodbpsSOhuGNLzhOQ=
------END CERTIFICATE-----`),
-	"eu-central-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJALvT012pxTxNMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTgx
-NTEyMDdaGA8yMjAxMTIyMjE1MTIwN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAyn+Lsnq1ykrfYlZkk6aAAYNReNd9Iw8AUwCBkgOr2eBiBBepYxHwU85N
-++moQ+j0EV2VaahBeTLShGZZS1HsyK8+cYT2QzpghIoamcYhrPXyIxlWiRQlaqSg
-OFiE9bsqL3rCF5Vz+tOiTe5W/7ojfOFls6++g7ZpobwJlpMbuJepqyeHMPyjvO5A
-age81lJewc4bxo2ntaW0HCqNksqfYB78j6X6kn3PFpX7FaYAwZA+Xx6C7UCY7rNi
-UdQzfAo8htfJi4chz7frpUdQ9kl3IOQrsLshBB5fFUjl09NiFipCGBwi+8ZMeSn1
-5qwBI01BWXPfG7WX6Owyjhmh6JtE1wIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU8HN4vvJrsZgPQeksMBgJb9xR1yYwgY4GA1UdIwSBhjCBg4AU8HN4
-vvJrsZgPQeksMBgJb9xR1yahYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJALvT012pxTxNMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAGlHYDtcHpfBvdHx9HeQE8HgNugJUPdEqxun
-t9U33p8VFrs+uLPtrOd9HDJEGvvs5h84EUie/oGJxRt7V1Vlid1PvHf6cRmpjgqY
-YdggAVkZtY/PnFVmzf2bMVlSQPrqCl7U0zaw2Kvnj4zgX0rZyCetgrRZSUSxotyp
-978Wy9ccXwVSeYG/YAr5rJpS6ZH7eRQvUY0IzwFNeaOPgOTEVpcjWlV6+MQEvsEx
-W85q+s6AVr49eppEx8SLJsl0C23yB+L+t32tAveQImRWtJMpzZ5cxh/sYgDVeoC0
-85H1NK/7H9fAzT1cPu1oHSnB0xYzzHGOAmXmusMfwUk8fL1RQkE=
------END CERTIFICATE-----`),
-	"eu-north-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJALc/uRxg++EnMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA0MTAx
-NDAwMTFaGA8yMTk3MDkxMzE0MDAxMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAzwCGJEJIxqtr2PD2a1mA6LhRzKhTBa1AZsg3eYfpETXIVlrpojMfvVoN
-qHvGshWLgrGTT6os/3gsaADheSaJKavxwX3X6tJA8fvEGqr3a1C1MffH9hBWbQqC
-LbfUTAbkwis4GdTUwOwPjT1Cm3u9R/VzilCNwkj7iQ65AFAI8Enmsw3UGldEsop4
-yChKB3KW3WI0FTh0+gD0YtjrqqYJxpGOYBpJp5vwdd3fZ4t1vidmDMs7liv4f9Bx
-p0oSmUobU4GUlFhBchK1DukICVQdnOVzdMonYm7s+HtpFbVHR8yf6QoixBKGdSal
-mBf7+y0ixjCn0pnC0VLVooGo4mi17QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDG
-4ONZiixgk2sjJctwbyD5WKLTH6+mxYcDw+3y/F0fWz561YORhP2FNnPOmEkf0Sl/
-Jqk4svzJbCbQeMzRoyaya/46d7UioXMHRZam5IaGBhOdQbi97R4VsQjwQj0RmQsq
-yDueDyuKTwWLK9KnvI+ZA6e6bRkdNGflK4N8GGKQ+fBhPwVELkbT9f16OJkezeeN
-S+F/gDADGJgmPXfjogICb4Kvshq0H5Lm/xZlDULF2g/cYhyNY6EOI/eS5m1I7R8p
-D/m6WoyZdpInxJfxW616OMkxQMRVsruLTNGtby3u1g6ScjmpFtvAMhYejBSdzKG4
-FEyxIdEjoeO1jhTsck3R
------END CERTIFICATE-----`),
-	"eu-south-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJAO/+DgYF78KwMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTA0Mjky
-MDM1MjJaGA8yMTk4MTAwMjIwMzUyMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAv1ZLV+Z/P6INq+R1qLkzETBg7sFGKPiwHekbpuB6lrRxKHhj8V9vaReM
-lnv1Ur5LAPpMPYDsuJ4WoUbPYAqVqyMAo7ikJHCCM1cXgZJefgN6z9bpS+uA3YVh
-V/0ipHh/X2hc2S9wvxKWiSHu6Aq9GVpqL035tJQD+NJuqFd+nXrtcw4yGtmvA6wl
-5Bjn8WdsP3xOTKjrByYY1BhXpP/f1ohU9jE9dstsRXLa+XTgTPWcWdCS2oRTWPGR
-c5Aeh47nnDsyQfP9gLxHeYeQItV/BD9kU/2Hn6mnRg/B9/TYH8qzlRTzLapXp4/5
-iNwusrTNexGl8BgvAPrfhjDpdgYuTwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB7
-5ya11K/hKgvaRTvZwVV8GlVZt0CGPtNvOi4AR/UN6TMm51BzUB5nurB4z0R2MoYO
-Uts9sLGvSFALJ4otoB77hyNpH3drttU1CVVwal/yK/RQLSon/IoUkaGEbqalu+mH
-nYad5IG4tEbmepX456XXcO58MKmnczNbPyw3FRzUZQtI/sf94qBwJ1Xo6XbzPKMy
-xjL57LHIZCssD+XPifXay69OFlsCIgLim11HgPkRIHEOXLSf3dsW9r+4CjoZqB/Z
-jj/P4TLCxbYCLkvglwaMjgEWF40Img0fhx7yT2X92MiSrs3oncv/IqfdVTiN8OXq
-jgnq1bf+EZEZKvb6UCQV
------END CERTIFICATE-----`),
-	"eu-south-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJALWSmO6DvSpQMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTgx
-MzU4NDNaGA8yMjAxMTIyMjEzNTg0M1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAuAAhuSpsHC00/fD2zNlBDpNLRndi9qbHsNeuz3WqN7Samj2aSrM2hS+i
-hUxx0BspZj0tZCOsbpPZ+i74NOEQtFeqQoEGvKhB1nJiF4y5I81HDhs5qHvoIivm
-7rbbik3zgm1PqS/DmDjVQaXPcD31Rd9ILwBmWEwJqHigyNVlxYtCzTQcrlBrvNZM
-dnNgCDAdX/HBEFxx9O12xeu0bSt0s+PJWZ1RTbYrNe7LIH6ntUqHxP/ziQ5trXEZ
-uqy7aWk1L8uK4jmyNph0lbaqBa3Y6pYmU1nC27UE4i3fnPB0LSiAr+SrwVvX1g4z
-ilo8kr+tbIF+JmcgYLBvO8Jwp+EUqQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUwvGzKJL9A5LReJ4Fxo5K6I20xcowgY4GA1UdIwSBhjCBg4AUwvGz
-KJL9A5LReJ4Fxo5K6I20xcqhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJALWSmO6DvSpQMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAJAZd31jyoTGLawAD2+v/vQsaB9vZIx5EImi
-G8YGkd61uFWeNhAmtrwyE/i6FDSIphDrMHBkvw/D3BsqK+Ev/JOK/VYuaYDx/8fp
-H4cwp9jC57CXzdIDREWNf6M9PsHFg2WA9XNNtClOZL5WJiJwel8eDSg+sqJUxE0l
-MW+QChq/20F6niyaRK4bXrZq14as7h+F9u3A9xHEOVP7Zk9C2ehrBXzCMLSDt3GV
-fEuMea2RxMhozwz34Hkdb6j18qoCfygubulovRNQjKw/cEmgPR16KfZPP5caILVt
-9qkYPvePmbiVswZDee73cDymJYxLqILpOZwyXvUH8StiH42FHZQ=
------END CERTIFICATE-----`),
-	"eu-west-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAOrmqHuaUt0vMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
-OTA2MTlaGA8yMTk1MDQwMzA5MDYxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAjE7nVu+aHLtzp9FYV25Qs1mvJ1JXD7J0iQ1Gs/RirW9a5ZECCtc4ssnf
-zQHq2JRVr0GRchvDrbm1HaP/avtFQR/Thvfltwu9AROVT22dUOTvERdkNzveoFCy
-hf52Rqf0DMrLXG8ZmQPPXPDFAv+sVMWCDftcChxRYZ6mP9O+TpgYNT1krD5PdvJU
-7HcXrkNHDYqbsg8A+Mu2hzl0QkvUET83Csg1ibeK54HP9w+FsD6F5W+6ZSHGJ88l
-FI+qYKs7xsjJQYgXWfEt6bbckWs1kZIaIOyMzYdPF6ClYzEec/UhIe/uJyUUNfpT
-VIsI5OltBbcPF4c7Y20jOIwwI2SgOQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUF2DgPUZivKQR/Zl8mB/MxIkjZDUwgY4GA1UdIwSBhjCBg4AUF2Dg
-PUZivKQR/Zl8mB/MxIkjZDWhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAOrmqHuaUt0vMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAGm6+57W5brzJ3+T8/XsIdLTuiBSe5ALgSqI
-qnO5usUKAeQsa+kZIJPyEri5i8LEodh46DAF1RlXTMYgXXxl0YggX88XPmPtok17
-l4hib/D9/lu4IaFIyLzYNSzsETYWKWoGVe7ZFz60MTRTwY2u8YgJ5dec7gQgPSGj
-avB0vTIgoW41G58sfw5b+wjXCsh0nROon79RcQFFhGnvup0MZ+JbljyhZUYFzCli
-31jPZiKzqWa87xh2DbAyvj2KZrZtTe2LQ48Z4G8wWytJzxEeZdREe4NoETf+Mu5G
-4CqoaPR05KWkdNUdGNwXewydb3+agdCgfTs+uAjeXKNdSpbhMYg=
------END CERTIFICATE-----`),
-	"eu-west-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJANBx0E2bOCEPMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA4MTEx
-NDU2NDJaGA8yMTk2MDExNTE0NTY0MlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEArYS3mJLGaMrh2DmiPLbqr4Z+xWXTzBWCjOwpsuHE9H6dWUUyl2Bgnu+Z
-d8QvW306Yleec45M4F2RA3J4hWHtShzsMlOJVRt+YulGeTf9OCPr26QmIFfs5nD4
-fgsJQEry2MBSGA9Fxq3Cw6qkWcrOPsCR+bHOU0XykdKl0MnIbpBf0kTfciAupQEA
-dEHnM2J1L2iI0NTLBgKxy5PXLH9weX20BFauNmHH9/J07OpwL20SN5f8TxcM9+pj
-Lbk8h1V4KdIwVQpdWkbDL9BCGlYjyadQJxSxz1J343NzrnDM0M4h4HtVaKOS7bQo
-Bqt2ruopLRCYgcuFHck/1348iAmbRQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBG
-wujwU1Otpi3iBgmhjMClgZyMMn0aQIxMigoFNqXMUNx1Mq/e/Tx+SNaOEAu0n2FF
-aiYjvY0/hXOx75ewzZvM7/zJWIdLdsgewpUqOBH4DXFhbSk2TxggSPb0WRqTBxq5
-Ed7F7+7GRIeBbRzdLqmISDnfqey8ufW0ks51XcQNomDIRG5s9XZ5KHviDCar8FgL
-HngBCdFI04CMagM+pwTO9XN1Ivt+NzUj208ca3oP1IwEAd5KhIhPLcihBQA5/Lpi
-h1s3170z1JQ1HZbDrH1pgp+8hSI0DwwDVb3IIH8kPR/J0Qn+hvOl2HOpaUg2Ly0E
-pt1RCZe+W7/dF4zsbqwK
------END CERTIFICATE-----`),
-	"eu-west-3": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJALWSfgHuT/ARMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNzA1MzEx
-MTE4MTZaGA8yMTk2MTEwMzExMTgxNlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAy5V7KDqnEvF3DrSProFcgu/oL+QYD62b1U+Naq8aPuljJe127Sm9WnWA
-EBdOSASkOaQ9fzjCPoG5SGgWKxYoZjsevHpmzjVv9+Ci+F57bSuMbjgUbvbRIFUB
-bxQojVoXQPHgK5v433ODxkQ4sjRyUbf4YV1AFdfU7zabC698YgPVOExGhXPlTvco
-8mlc631ubw2g52j0lzaozUkHPSbknTomhQIvO6kUfX0e0TDMH4jLDG2ZIrUB1L4r
-OWKG4KetduFrRZyDHF6ILZu+s6ywiMicUd+2UllDFC6oas+a8D11hmO/rpWU/ieV
-jj4rWAFrsebpn+Nhgy96iiVUGS2LuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDE
-iYv6FQ6knXCg+svlcaQG9q59xUC5z8HvJZ1+SxzPKKC4PKQdKvIIfE8GxVXqlZG1
-cl5WKTFDMapnzb9RV/DTaVzWx3cMYT77vm1Hl1XGjhx611CGcENH1egI3lOTILsa
-+KfopuJEQQ9TDMAIkGjhA+KieU/U5Ctv9fdej6d0GC6OEuwKkTNzPWue6UMq8d4H
-2xqJboWsE1t4nybEosvZfQJcZ8jyIYcYBnsG13vCLM+ixjuU5MVVQNMY/gBJzqJB
-V+U0QiGiuT5cYgY/QihxdHt99zwGaE0ZBC7213NKrlNuLSrqhDI2NLu8NsExqOFy
-OmY0v/xVmQUQl26jJXaM
------END CERTIFICATE-----`),
-	"il-central-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAOVp1h2I9wW7MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTUx
-MjQ0MTJaGA8yMjAxMTIxOTEyNDQxMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA13PkyWvl61iV/SYfO1UFO76UpDfPm2SF/Rz/o33cm699X++EYPxTnoEc
-vmWeS0I7eDXc4OCUiToG0sEx0klE0CX1Z1tK6qJ+zgWQLZ9SZEC9H0NsSA6LhrHu
-Nq0dzeK3LjhdfcX46/4GqdiptpdTuM4m/hOQ5yx4JMQ/n1sdpv4M5VLRWwWW9Lem
-ufb79Id7O9SispxgRsz1KXIjp7N9S4BY7itSXz97uSyzTqEjWZ6mDUhTu3t21GKC
-6flALGTTrG2yghEhz53rkvLsvwzjPSSlT6LIf0mrRPzHaf+EdaKoasElE1SHh+ZH
-9mI81HywpE+HZ+W+5hBCvjYp90Y1fwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU58tN2JO+yEGq5JbIXxGi4vRVPyIwgY4GA1UdIwSBhjCBg4AU58tN
-2JO+yEGq5JbIXxGi4vRVPyKhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAOVp1h2I9wW7MBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBANBN0e1EqNy4+IU2yQzMJ+Wy5ZIOtTP6GSBR
-7muVY1bDeAwtNTEOpwgrZVlC7/xq5Q0LC1y0Z70hHXEf8au7qStaAoUtxzvhTAZI
-NC0lwoFU56UFw4N0vZII17iqEfoqRC4PpI3OxqEJHFy0VLlvAzJoKB4QLLqDAYVA
-LXCiOLoVT+y9tRYsxw5MyO0Bi6fxQIIADl2bE9xkunTN1Jkkwqo3LxNy/ryz4QWR
-8K7jHUItifv4h/hxBKpHEquN8CkdvM9oeGl7I8PFrSFEpGr1euDXY0euZzzYiDBV
-m6GpTJgzpVsEuIX52dPcPemwQncoIfZyhWDW85MJUnby2WTEcFo=
------END CERTIFICATE-----`),
-	"me-central-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAM4h7b1CVhqqMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA0MTEx
-MDE1MDNaGA8yMjAxMDkxNTEwMTUwM1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEApybTWfMOhSoMpqPo72eqAmnn1dXGZM+G8EoZXzwHwT/+IHEXNB4q5N6k
-tudYLre1bJxuzEw+iProSHjmb9bB9YscRTofjVhBlt35Fc+i8BaMeH94SR/eE8QO
-mll8gnLNW3d62lyuhzuyv1e5wVlRqzYw+X2zRH4/wRDOCOpzjKoHIgyPKsMgwsw5
-aTZhNMsGxZN9dbkf0iCGeQLDytwU/JTh/HqvSr3VfUOapTJJiyAxoCtZWgp1/7wC
-RvOCSMRJobpUqxZgl/VsttwNkikSFz1wGkcYeSQvk+odbnYQckA8tdddoVI56eD4
-qtREQvfpMAX5v7fcqLexl5d5vH8uZQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUOadrbTs+OhzwoAgUJ7RqQNdwufkwgY4GA1UdIwSBhjCBg4AUOadr
-bTs+OhzwoAgUJ7RqQNdwufmhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAM4h7b1CVhqqMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAICTdAOGEOnII8HaGCpCB8us/hGFaLptJaAf
-D5SJAyVy66/mdfjGzE1BKkKxnbxemEVUIzbRidOnyilB+pKwN3edAjTZtWdpVA0V
-R/G/qQPmcVljtycBz4VC6SuOUYflGzLH1GZ6GJWbuDtFzw8r7HGdRN1wrEPe3UF2
-sMpuVezqnRUdvVRoVQP4jFgNsE7kNvtn2NiPhb/CtrxpcwIQ7r6YeoHcBSheuV1Z
-xZDHynC3KUprQGx1+Z9QqPrDf180MaoqAlTl4+W6Pr2NJYrVUFGS/ivYshMg574l
-CPU6r4wWZSKwEUXq4BInYX6z6iclp/p/J5QnJp2mAwyi6M+I13Y=
------END CERTIFICATE-----`),
-	"me-south-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJANZkFlQR2rKqMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTAyMDUx
-MzA2MjBaGA8yMTk4MDcxMTEzMDYyMFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAy4Vnit2eBpEjKgOKBmyupJzJAiT4fr74tuGJNwwa+Is2vH12jMZn9Il1
-UpvvEUYTIboIgISpf6SJ5LmV5rCv4jT4a1Wm0kjfNbiIlkUi8SxZrPypcw24m6ke
-BVuxQZrZDs+xDUYIZifTmdgD50u5YE+TLg+YmXKnVgxBU6WZjbuK2INohi71aPBw
-2zWUR7Gr/ggIpf635JLU3KIBLNEmrkXCVSnDFlsK4eeCrB7+UNak+4BwgpuykSGG
-Op9+2vsuNqFeU1l9daQeG9roHR+4rIWSPa0opmMxv5nctgypOrE6zKXx2dNXQldd
-VULv+WH7s6Vm4+yBeG8ctPYH5GOo+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBs
-ZcViiZdFdpcXESZP/KmZNDxB/kktlIEIhsQ+MNn29jayE5oLmtGjHj5dtA3XNKlr
-f6PVygVTKbtQLQqunRT83e8+7iCZMKI5ev7pITUQVvTUwI+Fc01JkYZxRFlVBuFA
-WGZO+98kxCS4n6tTwVt+nSuJr9BJRVC17apfHBgSS8c5OWna0VU/Cc9ka4eAfQR4
-7pYSDU3wSRE01cs30q34lXZ629IyFirSJ5TTOIc0osNL7vwMQYj8HOn4OBYqxKy8
-ZJyvfXsIPh0Na76PaBIs6ZlqAOflLrjGzxBPiwRM/XrGmF8ze4KzoUqJEnK13O6A
-KHKgfiigQZ1+gv5FlyXH
------END CERTIFICATE-----`),
-	"sa-east-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAMcyoxx4U0xxMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
-ODU4MDJaGA8yMTk1MDExNzA4NTgwMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAw45IhGZVbQcy1fHBqzROhO8CsrDzxj/WP4cRbJo/2DAnimVrCCDs5O86
-FA39Zo1xsDuJHDlwMKqeXYXkJXHYbcPWc6EYYAnR+PlLG+aNSOGUzsy202S03hT0
-B20hWPCqpPp39itIRhG4id6nbNRJOzLm6evHuepMAHR4/OV7hyGOiGaV/v9zqiNA
-pMCLhbh2xk0PO35HCVBuWt3HUjsgeks2eEsu9Ws6H3JXTCfiqp0TjyRWapM29OhA
-cRJfJ/d/+wBTz1fkWOZ7TF+EWRIN5ITEadlDTPnF1r8kBRuDcS/lIGFwrOOHLo4C
-cKoNgXkhTqDDBDu6oNBb2rS0K+sz3QIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUqBy7D847Ya/w321Dfr+rBJGsGTwwgY4GA1UdIwSBhjCBg4AUqBy7
-D847Ya/w321Dfr+rBJGsGTyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAMcyoxx4U0xxMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBACOoWSBf7b9AlcNrl4lr3QWWSc7k90/tUZal
-PlT0G3Obl2x9T/ZiBsQpbUvs0lfotG0XqGVVHcIxF38EbVwbw9KJGXbGSCJSEJkW
-vGCtc/jYMHXfhx67Szmftm/MTYNvnzsyQQ3v8y3Rdah+xe1NPdpFrwmfL6xe3pFF
-cY33KdHA/3PNLdn9CaEsHmcmj3ctaaXLFIzZhQyyjtsrgGfTLvXeXRokktvsLDS/
-YgKedQ+jFjzVJqgr4NjfY/Wt7/8kbbdhzaqlB5pCPjLLzv0zp/XmO6k+JvOePOGh
-JzGk5t1QrSju+MqNPFk3+1O7o910Vrhqw1QRB0gr1ExrviLbyfU=
------END CERTIFICATE-----`),
-	"us-east-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJALFpzEAVWaQZMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
-ODU5MTJaGA8yMTk1MDExNzA4NTkxMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAjS2vqZu9mEOhOq+0bRpAbCUiapbZMFNQqRg7kTlr7Cf+gDqXKpHPjsng
-SfNz+JHQd8WPI+pmNs+q0Z2aTe23klmf2U52KH9/j1k8RlIbap/yFibFTSedmegX
-E5r447GbJRsHUmuIIfZTZ/oRlpuIIO5/Vz7SOj22tdkdY2ADp7caZkNxhSP915fk
-2jJMTBUOzyXUS2rBU/ulNHbTTeePjcEkvzVYPahD30TeQ+/A+uWUu89bHSQOJR8h
-Um4cFApzZgN3aD5j2LrSMu2pctkQwf9CaWyVznqrsGYjYOY66LuFzSCXwqSnFBfv
-fFBAFsjCgY24G2DoMyYkF3MyZlu+rwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUrynSPp4uqSECwy+PiO4qyJ8TWSkwgY4GA1UdIwSBhjCBg4AUrynS
-Pp4uqSECwy+PiO4qyJ8TWSmhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJALFpzEAVWaQZMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBADW/s8lXijwdP6NkEoH1m9XLrvK4YTqkNfR6
-er/uRRgTx2QjFcMNrx+g87gAml11z+D0crAZ5LbEhDMs+JtZYR3ty0HkDk6SJM85
-haoJNAFF7EQ/zCp1EJRIkLLsC7bcDL/Eriv1swt78/BB4RnC9W9kSp/sxd5svJMg
-N9a6FAplpNRsWAnbP8JBlAP93oJzblX2LQXgykTghMkQO7NaY5hg/H5o4dMPclTK
-lYGqlFUCH6A2vdrxmpKDLmTn5//5pujdD2MN0df6sZWtxwZ0osljV4rDjm9Q3VpA
-NWIsDEcp3GUB4proOR+C7PNkY+VGODitBOw09qBGosCBstwyEqY=
------END CERTIFICATE-----`),
-	"us-east-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJAM07oeX4xevdMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA2MTAx
-MjU4MThaGA8yMTk1MTExNDEyNTgxOFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA6v6kGMnRmFDLxBEqXzP4npnL65OO0kmQ7w8YXQygSdmNIoScGSU5wfh9
-mZdcvCxCdxgALFsFqPvH8fqiE9ttI0fEfuZvHOs8wUsIdKr0Zz0MjSx3cik4tKET
-ch0EKfMnzKOgDBavraCDeX1rUDU0Rg7HFqNAOry3uqDmnqtk00XC9GenS3z/7ebJ
-fIBEPAam5oYMVFpX6M6St77WdNE8wEU8SuerQughiMVx9kMB07imeVHBiELbMQ0N
-lwSWRL/61fA02keGSTfSp/0m3u+lesf2VwVFhqIJs+JbsEscPxOkIRlzy8mGd/JV
-ONb/DQpTedzUKLgXbw7KtO3HTG9iXQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU2CTGYE5fTjx7gQXzdZSGPEWAJY4wgY4GA1UdIwSBhjCBg4AU2CTG
-YE5fTjx7gQXzdZSGPEWAJY6hYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJAM07oeX4xevdMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBANdqkIpVypr2PveqUsAKke1wKCOSuw1UmH9k
-xX1/VRoHbrI/UznrXtPQOPMmHA2LKSTedwsJuorUn3cFH6qNs8ixBDrl8pZwfKOY
-IBJcTFBbI1xBEFkZoO3wczzo5+8vPQ60RVqAaYb+iCa1HFJpccC3Ovajfa4GRdNb
-n6FYnluIcDbmpcQePoVQwX7W3oOYLB1QLN7fE6H1j4TBIsFdO3OuKzmaifQlwLYt
-DVxVCNDabpOr6Uozd5ASm4ihPPoEoKo7Ilp0fOT6fZ41U2xWA4+HF/89UoygZSo7
-K+cQ90xGxJ+gmlYbLFR5rbJOLfjrgDAb2ogbFy8LzHo2ZtSe60M=
------END CERTIFICATE-----`),
-	"us-gov-east-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJALPB6hxFhay8MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA0MTAx
-MjMyNDlaGA8yMTk3MDkxMzEyMzI0OVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAva9xsI9237KYb/SPWmeCVzi7giKNron8hoRDwlwwMC9+uHPd53UxzKLb
-pTgtJWAPkZVxEdl2Gdhwr3SULoKcKmkqE6ltVFrVuPT33La1UufguT9k8ZDDuO9C
-hQNHUdSVEuVrK3bLjaSsMOS7Uxmnn7lYT990IReowvnBNBsBlcabfQTBV04xfUG0
-/m0XUiUFjOxDBqbNzkEIblW7vK7ydSJtFMSljga54UAVXibQt9EAIF7B8k9l2iLa
-mu9yEjyQy+ZQICTuAvPUEWe6va2CHVY9gYQLA31/zU0VBKZPTNExjaqK4j8bKs1/
-7dOV1so39sIGBz21cUBec1o+yCS5SwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBt
-hO2W/Lm+Nk0qsXW6mqQFsAou0cASc/vtGNCyBfoFNX6aKXsVCHxq2aq2TUKWENs+
-mKmYu1lZVhBOmLshyllh3RRoL3Ohp3jCwXytkWQ7ElcGjDzNGc0FArzB8xFyQNdK
-MNvXDi/ErzgrHGSpcvmGHiOhMf3UzChMWbIr6udoDlMbSIO7+8F+jUJkh4Xl1lKb
-YeN5fsLZp7T/6YvbFSPpmbn1YoE2vKtuGKxObRrhU3h4JHdp1Zel1pZ6lh5iM0ec
-SD11SximGIYCjfZpRqI3q50mbxCd7ckULz+UUPwLrfOds4VrVVSj+x0ZdY19Plv2
-9shw5ez6Cn7E3IfzqNHO
------END CERTIFICATE-----`),
-	"us-gov-west-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIDOzCCAiOgAwIBAgIJANCOF0Q6ohnuMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA5MTAx
-OTQyNDdaGA8yMTk1MDIxMzE5NDI0N1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAzIcGTzNqie3f1olrrqcfzGfbymSM2QfbTzDIOG6xXXeFrCDAmOq0wUhi
-3fRCuoeHlKOWAPu76B9os71+zgF22dIDEVkpqHCjBrGzDQZXXUwOzhm+PmBUI8Z1
-qvbVD4ZYhjCujWWzrsX6Z4yEK7PEFjtf4M4W8euw0RmiNwjy+knIFa+VxK6aQv94
-lW98URFP2fD84xedHp6ozZlr3+RZSIFZsOiyxYsgiwTbesRMI0Y7LnkKGCIHQ/XJ
-OwSISWaCddbu59BZeADnyhl4f+pWaSQpQQ1DpXvZAVBYvCH97J1oAxLfH8xcwgSQ
-/se3wtn095VBt5b7qTVjOvy6vKZazwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA/
-S8+a9csfASkdtQUOLsBynAbsBCH9Gykq2m8JS7YE4TGvqlpnWehz78rFTzQwmz4D
-fwq8byPkl6DjdF9utqZ0JUo/Fxelxom0h6oievtBlSkmZJNbgc2WYm1zi6ptViup
-Y+4S2+vWZyg/X1PXD7wyRWuETmykk73uEyeWFBYKCHWsO9sI+62O4Vf8Jkuj/cie
-1NSJX8fkervfLrZSHBYhxLbL+actVEo00tiyZz8GnhgWx5faCY38D/k4Y/j5Vz99
-7lUX/+fWHT3+lTL8ZZK7fOQWh6NQpI0wTP9KtWqfOUwMIbgFQPoxkP00TWRmdmPz
-WOwTObEf9ouTnjG9OZ20
------END CERTIFICATE-----`),
-	"us-west-1": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJANNPkIpcyEtIMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
-OTAzMDdaGA8yMTk1MDQwMzA5MDMwN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEApHQGvHvq3SVCzDrC7575BW7GWLzcj8CLqYcL3YY7Jffupz7OjcftO57Z
-4fo5Pj0CaS8DtPzh8+8vdwUSMbiJ6cDd3ooio3MnCq6DwzmsY+pY7CiI3UVG7KcH
-4TriDqr1Iii7nB5MiPJ8wTeAqX89T3SYaf6Vo+4GCb3LCDGvnkZ9TrGcz2CHkJsj
-AIGwgopFpwhIjVYm7obmuIxSIUv+oNH0wXgDL029Zd98SnIYQd/njiqkzE+lvXgk
-4h4Tu17xZIKBgFcTtWPky+POGu81DYFqiWVEyR2JKKm2/iR1dL1YsT39kbNg47xY
-aR129sS4nB5Vw3TRQA2jL0ToTIxzhQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQUgepyiONs8j+q67dmcWu+mKKDa+gwgY4GA1UdIwSBhjCBg4AUgepy
-iONs8j+q67dmcWu+mKKDa+ihYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJANNPkIpcyEtIMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAGLFWyutf1u0xcAc+kmnMPqtc/Q6b79VIX0E
-tNoKMI2KR8lcV8ZElXDb0NC6v8UeLpe1WBKjaWQtEjL1ifKg9hdY9RJj4RXIDSK7
-33qCQ8juF4vep2U5TTBd6hfWxt1Izi88xudjixmbpUU4YKr8UPbmixldYR+BEx0u
-B1KJi9l1lxvuc/Igy/xeHOAZEjAXzVvHp8Bne33VVwMiMxWECZCiJxE4I7+Y6fqJ
-pLLSFFJKbNaFyXlDiJ3kXyePEZSc1xiWeyRB2ZbTi5eu7vMG4i3AYWuFVLthaBgu
-lPfHafJpj/JDcqt2vKUKfur5edQ6j1CGdxqqjawhOTEqcN8m7us=
------END CERTIFICATE-----`),
-	"us-west-2": []byte(`-----BEGIN CERTIFICATE-----
-MIIEEjCCAvqgAwIBAgIJALZL3lrQCSTMMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
-BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
-dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
-OTAxMzJaGA8yMTk1MDExNzA5MDEzMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
-EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA02Y59qtAA0a6uzo7nEQcnJ26OKF+LRPwZfixBH+EbEN/Fx0gYy1jpjCP
-s5+VRNg6/WbfqAsV6X2VSjUKN59ZMnMY9ALA/Ipz0n00Huxj38EBZmX/NdNqKm7C
-qWu1q5kmIvYjKGiadfboU8wLwLcHo8ywvfgI6FiGGsEO9VMC56E/hL6Cohko11LW
-dizyvRcvg/IidazVkJQCN/4zC9PUOVyKdhW33jXy8BTg/QH927QuNk+ZzD7HH//y
-tIYxDhR6TIZsSnRjz3bOcEHxt1nsidc65mY0ejQty4hy7ioSiapw316mdbtE+RTN
-fcH9FPIFKQNBpiqfAW5Ebp3Lal3/+wIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
-BgNVHQ4EFgQU7coQx8Qnd75qA9XotSWT3IhvJmowgY4GA1UdIwSBhjCBg4AU7coQ
-x8Qnd75qA9XotSWT3IhvJmqhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
-YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQ4IJALZL3lrQCSTMMBIGA1UdEwEB/wQIMAYBAf8C
-AQAwDQYJKoZIhvcNAQELBQADggEBAFZ1e2MnzRaXCaLwEC1pW/f0oRG8nHrlPZ9W
-OYZEWbh+QanRgaikBNDtVTwARQcZm3z+HWSkaIx3cyb6vM0DSkZuiwzm1LJ9rDPc
-aBm03SEt5v8mcc7sXWvgFjCnUpzosmky6JheCD4O1Cf8k0olZ93FQnTrbg62OK0h
-83mGCDeVKU3hLH97FYoUq+3N/IliWFDhvibAYYKFJydZLhIdlCiiB99AM6Sg53rm
-oukS3csyUxZyTU2hQfdjyo1nqW9yhvFAKjnnggiwxNKTTPZzstKW8+cnYwiiTwJN
-QpVoZdt0SfbuNnmwRUMi+QbuccXweav29QeQ3ADqjgB0CZdSRKk=
------END CERTIFICATE-----`),
-}
diff --git a/lib/auth/bot.go b/lib/auth/bot.go
index 1f431c3fa4834..bb0a9da54a6a1 100644
--- a/lib/auth/bot.go
+++ b/lib/auth/bot.go
@@ -121,7 +121,13 @@ func (a *Server) legacyValidateGenerationLabel(ctx context.Context, username str
 
 	// The current generations must match to continue:
 	if currentIdentityGeneration != currentUserGeneration {
-		if err := a.tryLockBotDueToGenerationMismatch(ctx, user.GetName()); err != nil {
+		if err := a.tryLockBotDueToGenerationMismatch(
+			ctx,
+			certReq.botName,
+			certReq.botInstanceID,
+			certReq.joinToken,
+			certReq.renewable,
+		); err != nil {
 			a.logger.WarnContext(ctx, "Failed to lock bot when a generation mismatch was detected",
 				"error", err,
 				"bot", user.GetName(),
@@ -223,19 +229,44 @@ func (a *Server) commitLegacyGenerationCounterToBotUser(ctx context.Context, use
 
 // tryLockBotDueToGenerationMismatch creates a lock for the given bot user and
 // emits a `RenewableCertificateGenerationMismatch` audit event.
-func (a *Server) tryLockBotDueToGenerationMismatch(ctx context.Context, username string) error {
-	// TODO: In the future, consider only locking the current join method / token.
+func (a *Server) tryLockBotDueToGenerationMismatch(
+	ctx context.Context, botName, botInstanceID, joinTokenName string, renewable bool,
+) error {
+	var spec types.LockSpecV2
+	if renewable {
+		// Renewable implies `token` joining. These are one-time use secrets
+		// and will not be embedded in the TLS identity, so we can't target
+		// the join token and should instead rely on the bot instance ID. As
+		// there is a 1:1 relationship between bot instance and "token"-type
+		// token, this should be functionally equivalent.
+		spec = types.LockSpecV2{
+			Target: types.LockTarget{
+				BotInstanceID: botInstanceID,
+			},
+			Message: fmt.Sprintf(
+				"The bot instance %s/%s has been locked due to a certificate "+
+					"generation mismatch, possibly indicating a stolen "+
+					"certificate.",
+				botName, botInstanceID,
+			),
+			CreatedAt: a.clock.Now(),
+		}
+	} else {
+		spec = types.LockSpecV2{
+			Target: types.LockTarget{
+				JoinToken: joinTokenName,
+			},
+			Message: fmt.Sprintf(
+				"Bot joins via the token %q have been locked due to a "+
+					"certificate generation mismatch by %s/%s, possibly "+
+					"indicating a stolen certificate.",
+				joinTokenName, botName, botInstanceID,
+			),
+			CreatedAt: a.clock.Now(),
+		}
+	}
 
-	// Lock the bot user indefinitely.
-	lock, err := types.NewLock(uuid.New().String(), types.LockSpecV2{
-		Target: types.LockTarget{
-			User: username,
-		},
-		Message: fmt.Sprintf(
-			"The bot user %q has been locked due to a certificate generation mismatch, possibly indicating a stolen certificate.",
-			username,
-		),
-	})
+	lock, err := types.NewLock(uuid.New().String(), spec)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -258,6 +289,26 @@ func (a *Server) tryLockBotDueToGenerationMismatch(ctx context.Context, username
 	return nil
 }
 
+// shouldEnforceGenerationCounter decides if generation counter checks should be
+// enforced for a given join method. Note that in certain situations the counter
+// may still not technically be enforced, for example, when onboarding a new bot
+// or recovering a bound keypair bot.
+func shouldEnforceGenerationCounter(renewable bool, joinMethod string) bool {
+	if renewable {
+		return true
+	}
+
+	// Note: token renewals are handled by the `renewable` check above, since
+	// those certs are issued via `ServerWithRoles.generateUserCerts()` and do
+	// not have an associated join method.
+	switch joinMethod {
+	case string(types.JoinMethodBoundKeypair):
+		return true
+	default:
+		return false
+	}
+}
+
 // updateBotInstance updates the bot instance associated with the context
 // identity, if any. If the optional `templateAuthRecord` is provided, various
 // metadata fields will be copied into the newly generated auth record.
@@ -340,7 +391,12 @@ func (a *Server) updateBotInstance(
 			// If the incoming identity has a nonzero generation, validate it
 			// using the legacy check. This will increment the counter on the
 			// request automatically
-			if err := a.legacyValidateGenerationLabel(ctx, username, req, uint64(currentIdentityGeneration)); err != nil {
+			if err := a.legacyValidateGenerationLabel(
+				ctx,
+				username,
+				req,
+				uint64(currentIdentityGeneration),
+			); err != nil {
 				return trace.Wrap(err)
 			}
 
@@ -386,10 +442,10 @@ func (a *Server) updateBotInstance(
 
 		return trace.AccessDenied("a current identity generation must be provided")
 	} else if currentIdentityGeneration > 0 && currentIdentityGeneration != instanceGeneration {
-		// For now, continue to only enforce generation counter checks on
-		// renewable (i.e. token) identities.
-		if req.renewable {
-			if err := a.tryLockBotDueToGenerationMismatch(ctx, username); err != nil {
+		// Generation counter enforcement depends on the type of cert and join
+		// method (if any - token renewals technically have no join method.)
+		if shouldEnforceGenerationCounter(req.renewable, authRecord.JoinMethod) {
+			if err := a.tryLockBotDueToGenerationMismatch(ctx, botName, botInstanceID, req.joinToken, req.renewable); err != nil {
 				log.WarnContext(ctx, "Failed to lock bot when a generation mismatch was detected", "error", err)
 			}
 
@@ -422,6 +478,8 @@ func (a *Server) updateBotInstance(
 	// compatibility, but only if this is a renewable identity. Previous
 	// versions only expect a nonzero generation counter for token joins, so
 	// setting this for other methods will break compatibility.
+	// Note: new join methods that enforce generation counter checks will not
+	// write a generation counter to user labels (e.g. bound keypair).
 	if req.renewable {
 		if err := a.commitLegacyGenerationCounterToBotUser(ctx, username, uint64(newGeneration)); err != nil {
 			log.WarnContext(ctx, "unable to commit legacy generation counter to bot user", "error", err)
@@ -541,7 +599,7 @@ func (a *Server) generateInitialBotCerts(
 		ttl:            expires.Sub(a.GetClock().Now()),
 		sshPublicKey:   sshPubKey,
 		tlsPublicKey:   tlsPubKey,
-		checker:        checker,
+		checker:        services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to generateInitialBotCerts (likely not necessary until bot scoping work begins).
 		traits:         accessInfo.Traits,
 		renewable:      renewable,
 		includeHostCA:  true,
@@ -550,6 +608,14 @@ func (a *Server) generateInitialBotCerts(
 		joinAttributes: joinAttrs,
 	}
 
+	// Set the join token cert field for non-renewable identities. This is used
+	// for lock targeting; token name lock targets are particularly useful for
+	// token-joined bots and it's a secret value, so we don't bother setting it.
+	// (The renewable flag implies token joining.)
+	if !renewable {
+		certReq.joinToken = initialAuth.JoinToken
+	}
+
 	if existingInstanceID == "" {
 		// If no existing instance ID is known, create a new one.
 		uuid, err := uuid.NewRandom()
diff --git a/lib/auth/bot_test.go b/lib/auth/bot_test.go
index 0f188a4fc6c1e..fbcd010fd723d 100644
--- a/lib/auth/bot_test.go
+++ b/lib/auth/bot_test.go
@@ -16,26 +16,24 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"bytes"
 	"context"
 	"crypto"
 	"crypto/tls"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"testing"
+	"text/template"
 	"time"
 
-	"github.com/digitorus/pkcs7"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
@@ -54,26 +52,29 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/integrations/lib/testing/fakejoin"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/cloud/azure"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
-	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/join/iamjoin"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/kube/token"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
+var errMockInvalidToken = errors.New("invalid token")
+
 func renewBotCerts(
 	ctx context.Context,
-	srv *TestTLSServer,
+	srv *authtest.TLSServer,
 	tlsCertPEM []byte,
 	botUser string,
 	key crypto.Signer,
@@ -89,7 +90,11 @@ func renewBotCerts(
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	client := srv.NewClientWithCert(tlsCert)
+
+	client, err := srv.NewClientWithCert(tlsCert)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
 
 	sshPub, err := ssh.NewPublicKey(key.Public())
 	if err != nil {
@@ -120,11 +125,11 @@ func TestRegisterBotCertificateGenerationCheck(t *testing.T) {
 	ctx := context.Background()
 	fakeClock := srv.Clock().(*clockwork.FakeClock)
 
-	_, err := CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a new bot.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -147,7 +152,7 @@ func TestRegisterBotCertificateGenerationCheck(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
 
-	result, err := join.Register(ctx, join.RegisterParams{
+	result, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: token.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
@@ -232,11 +237,11 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	role, err := CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
+	role, err := authtest.CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a new bot.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -252,7 +257,7 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	k8s, err := fakejoin.NewKubernetesSigner(srv.Clock())
+	k8s, err := fakeissuer.NewKubernetesSigner(srv.Clock())
 	require.NoError(t, err)
 	jwks, err := k8s.GetMarshaledJWKS()
 	require.NoError(t, err)
@@ -287,7 +292,7 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, tok))
 
-	result, err := join.Register(ctx, join.RegisterParams{
+	result, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token:      tok.GetName(),
 		JoinMethod: types.JoinMethodKubernetes,
 		ID: state.IdentityID{
@@ -337,7 +342,8 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	require.NoError(t, err)
 	tlsPub, err := keys.MarshalPublicKey(result.PrivateKey.Public())
 	require.NoError(t, err)
-	botClient := srv.NewClientWithCert(tlsCert)
+	botClient, err := srv.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
 	roleCerts, err := botClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
 		SSHPublicKey: ssh.MarshalAuthorizedKey(sshPub),
 		TLSPublicKey: tlsPub,
@@ -371,11 +377,11 @@ func TestRegisterBotInstance(t *testing.T) {
 	srv.Auth().SetEmitter(mockEmitter)
 	ctx := context.Background()
 
-	_, err := CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a new bot.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -398,7 +404,7 @@ func TestRegisterBotInstance(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
 
-	result, err := join.Register(ctx, join.RegisterParams{
+	result, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: token.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
@@ -497,10 +503,15 @@ func TestRegisterBotInstance(t *testing.T) {
 				BotName:          "test",
 				BotInstanceID:    ident.BotInstanceID,
 			},
+			CertificateAuthority: &events.CertificateAuthority{
+				Type:   "user",
+				Domain: "localhost",
+			},
 		},
 			cmpopts.IgnoreFields(events.Metadata{}, "Time"),
 			cmpopts.IgnoreFields(events.Identity{}, "Logins", "Expires"),
 			cmpopts.IgnoreFields(events.ClientMetadata{}, "UserAgent"),
+			cmpopts.IgnoreFields(events.CertificateAuthority{}, "SubjectKeyID"),
 			cmpopts.EquateEmpty(),
 		),
 	)
@@ -512,11 +523,11 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
-	_, err := CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a new bot.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -539,7 +550,7 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
 
-	result, err := join.Register(ctx, join.RegisterParams{
+	result, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: token.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
@@ -549,7 +560,11 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	require.NoError(t, err)
 
 	// Renew the certs once (e.g. this is the actual bot process)
-	_, certsReal, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.Status.UserName, result.PrivateKey)
+	renewedClient, certsReal, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.Status.UserName, result.PrivateKey)
+	require.NoError(t, err)
+
+	// This client should be able to ping.
+	_, err = renewedClient.Ping(ctx)
 	require.NoError(t, err)
 
 	// Check the generation, it should be 2.
@@ -564,12 +579,18 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
-	// The user should now be locked.
+	// The bot instance should now be locked.
 	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
-		User: "bot-test",
+		BotInstanceID: impersonatedIdent.BotInstanceID,
 	})
 	require.NoError(t, err)
 	require.NotEmpty(t, locks)
+
+	// The original client should be locked out.
+	require.Eventually(t, func() bool {
+		_, err = renewedClient.Ping(ctx)
+		return err != nil && strings.Contains(err.Error(), "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 // TestRegisterBotCertificateExtensions ensures bot cert extensions are present.
@@ -578,11 +599,11 @@ func TestRegisterBotCertificateExtensions(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	_, err := CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, srv.Auth(), "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	// Create a new bot.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -605,7 +626,7 @@ func TestRegisterBotCertificateExtensions(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
 
-	result, err := join.Register(ctx, join.RegisterParams{
+	result, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: token.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
@@ -647,7 +668,7 @@ func TestRegisterBot_RemoteAddr(t *testing.T) {
 	_, sshPubKey, _, tlsPubKey := newSSHAndTLSKeyPairs(t)
 
 	roleName := "test-role"
-	_, err = CreateRole(ctx, a, roleName, types.RoleSpecV6{})
+	_, err = authtest.CreateRole(ctx, a, roleName, types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	botName := "botty"
@@ -660,19 +681,19 @@ func TestRegisterBot_RemoteAddr(t *testing.T) {
 		Spec: &machineidv1pb.BotSpec{
 			Roles: []string{roleName},
 		},
-	}, a.clock.Now(), "")
+	}, a.GetClock().Now(), "")
 	require.NoError(t, err)
 
 	remoteAddr := "42.42.42.42:42"
 
 	t.Run("IAM method", func(t *testing.T) {
-		a.httpClientForAWSSTS = &mockClient{
+		a.SetHTTPClientForAWSSTS(&mockSTSClient{
 			respStatusCode: http.StatusOK,
-			respBody: responseFromAWSIdentity(awsIdentity{
+			respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
 				Account: "1234",
 				Arn:     "arn:aws::1111",
 			}),
-		}
+		})
 
 		// add token to auth server
 		awsTokenName := "aws-test-token"
@@ -714,94 +735,59 @@ func TestRegisterBot_RemoteAddr(t *testing.T) {
 		require.NoError(t, err)
 		checkCertLoginIP(t, certs.TLS, remoteAddr)
 	})
+}
 
-	t.Run("Azure method", func(t *testing.T) {
-		subID := uuid.NewString()
-		resourceGroup := "rg"
-		rsID := vmResourceID(subID, resourceGroup, "test-vm")
-		vmID := "vmID"
-
-		accessToken, err := makeToken(rsID, "", a.clock.Now())
-		require.NoError(t, err)
-
-		// add token to auth server
-		azureTokenName := "azure-test-token"
-		azureToken, err := types.NewProvisionTokenFromSpec(
-			azureTokenName,
-			time.Now().Add(time.Minute),
-			types.ProvisionTokenSpecV2{
-				Roles:      []types.SystemRole{types.RoleBot},
-				Azure:      &types.ProvisionTokenSpecV2Azure{Allow: []*types.ProvisionTokenSpecV2Azure_Rule{{Subscription: subID}}},
-				BotName:    botName,
-				JoinMethod: types.JoinMethodAzure,
-			})
-		require.NoError(t, err)
-		require.NoError(t, a.UpsertToken(ctx, azureToken))
-
-		vmClient := &mockAzureVMClient{
-			vms: map[string]*azure.VirtualMachine{
-				rsID: {
-					ID:            rsID,
-					Name:          "test-vm",
-					Subscription:  subID,
-					ResourceGroup: resourceGroup,
-					VMID:          vmID,
-				},
-			},
-		}
-		getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
-			subID: vmClient,
-		})
+func responseFromAWSIdentity(id iamjoin.AWSIdentity) string {
+	return fmt.Sprintf(`{
+		"GetCallerIdentityResponse": {
+			"GetCallerIdentityResult": {
+				"Account": "%s",
+				"Arn": "%s"
+			}}}`, id.Account, id.Arn)
+}
 
-		tlsConfig, err := fixtures.LocalTLSConfig()
-		require.NoError(t, err)
+type mockSTSClient struct {
+	respStatusCode int
+	respBody       string
+}
 
-		block, _ := pem.Decode(fixtures.LocalhostKey)
-		pkey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-		require.NoError(t, err)
+func (c *mockSTSClient) Do(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: c.respStatusCode,
+		Body:       io.NopCloser(strings.NewReader(c.respBody)),
+	}, nil
+}
 
-		certs, err := a.RegisterUsingAzureMethodWithOpts(context.Background(), func(challenge string) (*proto.RegisterUsingAzureMethodRequest, error) {
-			ad := attestedData{
-				Nonce:          challenge,
-				SubscriptionID: subID,
-				ID:             vmID,
-			}
-			adBytes, err := json.Marshal(&ad)
-			require.NoError(t, err)
-			s, err := pkcs7.NewSignedData(adBytes)
-			require.NoError(t, err)
-			require.NoError(t, s.AddSigner(tlsConfig.Certificate, pkey, pkcs7.SignerInfoConfig{}))
-			signature, err := s.Finish()
-			require.NoError(t, err)
-			signedAD := signedAttestedData{
-				Encoding:  "pkcs7",
-				Signature: base64.StdEncoding.EncodeToString(signature),
-			}
-			signedADBytes, err := json.Marshal(&signedAD)
-			require.NoError(t, err)
+var identityRequestTemplate = template.Must(template.New("sts-request").Parse(`POST / HTTP/1.1
+Host: {{.Host}}
+User-Agent: aws-sdk-go/1.37.17 (go1.17.1; darwin; amd64)
+Content-Length: 43
+Accept: application/json
+Authorization: AWS4-HMAC-SHA256 Credential=AAAAAAAAAAAAAAAAAAAA/20211102/us-east-1/sts/aws4_request, SignedHeaders=accept;content-length;content-type;host;x-amz-date;x-amz-security-token;{{.SignedHeader}}, Signature=111
+Content-Type: application/x-www-form-urlencoded; charset=utf-8
+X-Amz-Date: 20211102T204300Z
+X-Amz-Security-Token: aaa
+X-Teleport-Challenge: {{.Challenge}}
+
+Action=GetCallerIdentity&Version=2011-06-15`))
+
+type identityRequestTemplateInput struct {
+	Host         string
+	SignedHeader string
+	Challenge    string
+}
 
-			req := &proto.RegisterUsingAzureMethodRequest{
-				RegisterUsingTokenRequest: &types.RegisterUsingTokenRequest{
-					Token:        azureTokenName,
-					HostID:       "test-node",
-					Role:         types.RoleBot,
-					PublicSSHKey: sshPubKey,
-					PublicTLSKey: tlsPubKey,
-					RemoteAddr:   remoteAddr,
-				},
-				AttestedData: signedADBytes,
-				AccessToken:  accessToken,
-			}
-			return req, nil
-		}, withCerts([]*x509.Certificate{tlsConfig.Certificate}), withVerifyFunc(mockVerifyToken(nil)), withVMClientGetter(getVMClient))
-		require.NoError(t, err)
-		checkCertLoginIP(t, certs.TLS, remoteAddr)
-	})
+func defaultIdentityRequestTemplateInput(challenge string) identityRequestTemplateInput {
+	return identityRequestTemplateInput{
+		Host:         "sts.amazonaws.com",
+		SignedHeader: "x-teleport-challenge;",
+		Challenge:    challenge,
+	}
 }
 
 // authClientForRegisterResult is a test helper that creats an auth client for
-// the given [*join.RegisterResult].
-func authClientForRegisterResult(t *testing.T, ctx context.Context, addr *utils.NetAddr, result *join.RegisterResult) *authclient.Client {
+// the given [*joinclient.JoinResult].
+func authClientForRegisterResult(t *testing.T, ctx context.Context, addr *utils.NetAddr, result *joinclient.JoinResult) *authclient.Client {
 	privateKeyPEM, err := keys.MarshalPrivateKey(result.PrivateKey)
 	require.NoError(t, err)
 	sshPub, err := ssh.NewPublicKey(result.PrivateKey.Public())
@@ -830,7 +816,7 @@ func authClientForRegisterResult(t *testing.T, ctx context.Context, addr *utils.
 		nil /* clock */)
 	require.NoError(t, err)
 
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
 		Resolver:              resolver,
 		ClientConfig:          sshConfig,
@@ -872,14 +858,14 @@ func instanceIDFromCerts(t *testing.T, certs *proto.Certs) (string, uint64) {
 	return ident.BotInstanceID, ident.Generation
 }
 
-// registerHelper calls `join.Register` with the given token, prefilling params
+// registerHelper calls `joinclient.Join` with the given token, prefilling params
 // where possible. Overrides may be applied with `fns`.
 func registerHelper(
 	ctx context.Context, token types.ProvisionToken,
 	addr *utils.NetAddr,
-	fns ...func(*join.RegisterParams),
-) (*join.RegisterResult, error) {
-	params := join.RegisterParams{
+	fns ...func(*joinclient.JoinParams),
+) (*joinclient.JoinResult, error) {
+	params := joinclient.JoinParams{
 		JoinMethod: token.GetJoinMethod(),
 		Token:      token.GetName(),
 		ID: state.IdentityID{
@@ -895,7 +881,7 @@ func registerHelper(
 		fn(&params)
 	}
 
-	result, err := join.Register(ctx, params)
+	result, err := joinclient.Join(ctx, params)
 	return result, trace.Wrap(err)
 }
 
@@ -917,21 +903,21 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 	k8sReadFileFunc := func(name string) ([]byte, error) {
 		return []byte(k8sTokenName), nil
 	}
-	a.k8sJWKSValidator = func(_ time.Time, _ []byte, _ string, tkn string) (*token.ValidationResult, error) {
+	a.SetK8sJWKSValidator(func(_ time.Time, _ []byte, _ string, tkn string) (*token.ValidationResult, error) {
 		if tkn == k8sTokenName {
 			return &token.ValidationResult{Username: "system:serviceaccount:static-jwks:matching"}, nil
 		}
 
 		return nil, errMockInvalidToken
-	}
+	})
 
-	a.httpClientForAWSSTS = &mockClient{
+	a.SetHTTPClientForAWSSTS(&mockSTSClient{
 		respStatusCode: http.StatusOK,
-		respBody: responseFromAWSIdentity(awsIdentity{
+		respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
 			Account: "1234",
 			Arn:     "arn:aws::1111",
 		}),
-	}
+	})
 
 	t.Setenv("AWS_ACCESS_KEY_ID", "FAKE_ID")
 	t.Setenv("AWS_SECRET_ACCESS_KEY", "FAKE_KEY")
@@ -940,7 +926,7 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 
 	// Create a bot
 	roleName := "test-role"
-	_, err := CreateRole(ctx, a, roleName, types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, a, roleName, types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	botName := "bot"
@@ -953,7 +939,7 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 		Spec: &machineidv1pb.BotSpec{
 			Roles: []string{roleName},
 		},
-	}, a.clock.Now(), "")
+	}, a.GetClock().Now(), "")
 	require.NoError(t, err)
 
 	// Create k8s and IAM join tokens
@@ -992,7 +978,7 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 	require.NoError(t, a.UpsertToken(ctx, awsToken))
 
 	// Join as a "bot" with both token types.
-	k8sResult, err := registerHelper(ctx, k8sToken, addr, func(p *join.RegisterParams) {
+	k8sResult, err := registerHelper(ctx, k8sToken, addr, func(p *joinclient.JoinParams) {
 		p.KubernetesReadFileFunc = k8sReadFileFunc
 	})
 	require.NoError(t, err)
@@ -1012,7 +998,7 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 	// Rejoin using the k8s client and make sure we're issued certs with the
 	// same instance ID.
 	k8sClient := authClientForRegisterResult(t, ctx, addr, k8sResult)
-	rejoinedK8sResult, err := registerHelper(ctx, k8sToken, addr, func(p *join.RegisterParams) {
+	rejoinedK8sResult, err := registerHelper(ctx, k8sToken, addr, func(p *joinclient.JoinParams) {
 		p.KubernetesReadFileFunc = k8sReadFileFunc
 		p.AuthClient = k8sClient
 	})
@@ -1026,7 +1012,7 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 	// join service, the instance ID must be provided to auth by the proxy as
 	// part of the `RegisterUsingTokenRequest`.
 	iamClient := authClientForRegisterResult(t, ctx, addr, awsResult)
-	rejoinedAWSResult, err := registerHelper(ctx, awsToken, addr, func(p *join.RegisterParams) {
+	rejoinedAWSResult, err := registerHelper(ctx, awsToken, addr, func(p *joinclient.JoinParams) {
 		p.AuthClient = iamClient
 	})
 	require.NoError(t, err)
@@ -1072,13 +1058,13 @@ func TestRegisterBotWithInvalidInstanceID(t *testing.T) {
 
 	botName := "bot"
 	k8sTokenName := "jwks-matching-service-account"
-	a.k8sJWKSValidator = func(_ time.Time, _ []byte, _ string, tkn string) (*token.ValidationResult, error) {
+	a.SetK8sJWKSValidator(func(_ time.Time, _ []byte, _ string, tkn string) (*token.ValidationResult, error) {
 		if tkn == k8sTokenName {
 			return &token.ValidationResult{Username: "system:serviceaccount:static-jwks:matching"}, nil
 		}
 
 		return nil, errMockInvalidToken
-	}
+	})
 	token, err := types.NewProvisionTokenFromSpec("static-jwks", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
 		JoinMethod: types.JoinMethodKubernetes,
 		Roles:      []types.SystemRole{types.RoleBot},
@@ -1097,7 +1083,7 @@ func TestRegisterBotWithInvalidInstanceID(t *testing.T) {
 	require.NoError(t, a.CreateToken(ctx, token))
 
 	roleName := "test-role"
-	_, err = CreateRole(ctx, a, roleName, types.RoleSpecV6{})
+	_, err = authtest.CreateRole(ctx, a, roleName, types.RoleSpecV6{})
 	require.NoError(t, err)
 
 	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
@@ -1109,10 +1095,10 @@ func TestRegisterBotWithInvalidInstanceID(t *testing.T) {
 		Spec: &machineidv1pb.BotSpec{
 			Roles: []string{roleName},
 		},
-	}, a.clock.Now(), "")
+	}, a.GetClock().Now(), "")
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	privateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
@@ -1176,7 +1162,7 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	// Initial setup, create a bot and join token.
-	client, err := srv.NewClient(TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -1206,7 +1192,7 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, tokenB))
 
-	resultA, err := join.Register(ctx, join.RegisterParams{
+	resultA, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: tokenA.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
@@ -1219,7 +1205,7 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	initialInstanceA, _ := instanceIDFromCerts(t, certsA)
 	require.NotEmpty(t, initialInstanceA)
 
-	resultB, err := join.Register(ctx, join.RegisterParams{
+	resultB, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token: tokenB.GetName(),
 		ID: state.IdentityID{
 			Role: types.RoleBot,
diff --git a/lib/auth/bound_keypair_tokens.go b/lib/auth/bound_keypair_tokens.go
new file mode 100644
index 0000000000000..82af4823345e5
--- /dev/null
+++ b/lib/auth/bound_keypair_tokens.go
@@ -0,0 +1,148 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package auth
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// validateBoundKeypairTokenSpec performs some basic validation checks on a
+// bound_keypair-type join token.
+func validateBoundKeypairTokenSpec(spec *types.ProvisionTokenSpecV2BoundKeypair) error {
+	if spec.Recovery == nil {
+		return trace.BadParameter("spec.bound_keypair.recovery: field is required")
+	}
+
+	return nil
+}
+
+// populateRegistrationSecret populates the
+// `status.BoundKeypair.RegistrationSecret` field of a bound keypair token. It
+// should be called as part of any token creation or update to ensure the
+// registration secret is made available if needed.
+func populateRegistrationSecret(v2 *types.ProvisionTokenV2) error {
+	if v2.GetJoinMethod() != types.JoinMethodBoundKeypair {
+		return trace.BadParameter("must be called with a bound keypair token")
+	}
+
+	if v2.Spec.BoundKeypair == nil {
+		v2.Spec.BoundKeypair = &types.ProvisionTokenSpecV2BoundKeypair{}
+	}
+
+	if v2.Status == nil {
+		v2.Status = &types.ProvisionTokenStatusV2{}
+	}
+	if v2.Status.BoundKeypair == nil {
+		v2.Status.BoundKeypair = &types.ProvisionTokenStatusV2BoundKeypair{}
+	}
+	if v2.Spec.BoundKeypair.Onboarding == nil {
+		v2.Spec.BoundKeypair.Onboarding = &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{}
+	}
+
+	spec := v2.Spec.BoundKeypair
+	status := v2.Status.BoundKeypair
+
+	if status.BoundPublicKey != "" || spec.Onboarding.InitialPublicKey != "" {
+		// A key has already been bound or preregistered, nothing to do.
+		return nil
+	}
+
+	if status.RegistrationSecret != "" {
+		// A secret has already been generated, nothing to do.
+		return nil
+	}
+
+	if spec.Onboarding.RegistrationSecret != "" {
+		// An explicit registration secret was provided, so copy it to status.
+		status.RegistrationSecret = spec.Onboarding.RegistrationSecret
+		return nil
+	}
+
+	// Otherwise, we have no key and no secret, so generate one now.
+	s, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	status.RegistrationSecret = s
+	return nil
+}
+
+func (a *Server) CreateBoundKeypairToken(ctx context.Context, token types.ProvisionToken) error {
+	if token.GetJoinMethod() != types.JoinMethodBoundKeypair {
+		return trace.BadParameter("must be called with a bound keypair token")
+	}
+
+	tokenV2, ok := token.(*types.ProvisionTokenV2)
+	if !ok {
+		return trace.BadParameter("%v join method requires ProvisionTokenV2", types.JoinMethodOracle)
+	}
+
+	spec := tokenV2.Spec.BoundKeypair
+	if spec == nil {
+		return trace.BadParameter("bound_keypair token requires non-nil spec.bound_keypair")
+	}
+
+	if err := validateBoundKeypairTokenSpec(spec); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Not as much to do here - ideally we'd like to prevent users from
+	// tampering with the status field, but we don't have a good mechanism to
+	// stop that that wouldn't also break backup and restore. For now, it's
+	// simpler and easier to just tell users not to edit those fields.
+
+	if err := populateRegistrationSecret(tokenV2); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(a.CreateToken(ctx, tokenV2))
+}
+
+func (a *Server) UpsertBoundKeypairToken(ctx context.Context, token types.ProvisionToken) error {
+	if token.GetJoinMethod() != types.JoinMethodBoundKeypair {
+		return trace.BadParameter("must be called with a bound keypair token")
+	}
+
+	tokenV2, ok := token.(*types.ProvisionTokenV2)
+	if !ok {
+		return trace.BadParameter("%v join method requires ProvisionTokenV2", types.JoinMethodOracle)
+	}
+
+	spec := tokenV2.Spec.BoundKeypair
+	if spec == nil {
+		return trace.BadParameter("bound_keypair token requires non-nil spec.bound_keypair")
+	}
+
+	if err := validateBoundKeypairTokenSpec(spec); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := populateRegistrationSecret(tokenV2); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Implementation note: checkAndSetDefaults() impl for this token type is
+	// called at insertion time as part of `tokenToItem()`
+	return trace.Wrap(a.UpsertToken(ctx, token))
+}
diff --git a/lib/auth/clusterconfig/clusterconfigv1/service.go b/lib/auth/clusterconfig/clusterconfigv1/service.go
index 0baa958a37a2e..017f8130318f7 100644
--- a/lib/auth/clusterconfig/clusterconfigv1/service.go
+++ b/lib/auth/clusterconfig/clusterconfigv1/service.go
@@ -738,6 +738,10 @@ func (s *Service) CreateSessionRecordingConfig(ctx context.Context, cfg types.Se
 		return nil, trace.AccessDenied("this request can be only executed by an auth server")
 	}
 
+	if err := services.ValidateSessionRecordingConfig(cfg, s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	created, err := s.backend.CreateSessionRecordingConfig(ctx, cfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -772,6 +776,10 @@ func (s *Service) UpdateSessionRecordingConfig(ctx context.Context, req *cluster
 
 	req.SessionRecordingConfig.SetOrigin(types.OriginDynamic)
 
+	if err := services.ValidateSessionRecordingConfig(req.SessionRecordingConfig, s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	updated, err := s.backend.UpdateSessionRecordingConfig(ctx, req.SessionRecordingConfig)
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.SessionRecordingConfigUpdate{
@@ -818,6 +826,10 @@ func (s *Service) UpsertSessionRecordingConfig(ctx context.Context, req *cluster
 
 	req.SessionRecordingConfig.SetOrigin(types.OriginDynamic)
 
+	if err := services.ValidateSessionRecordingConfig(req.SessionRecordingConfig, s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	upserted, err := s.backend.UpsertSessionRecordingConfig(ctx, req.SessionRecordingConfig)
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.SessionRecordingConfigUpdate{
diff --git a/lib/auth/clusterconfig/clusterconfigv1/service_test.go b/lib/auth/clusterconfig/clusterconfigv1/service_test.go
index ea8a4030c6bbc..1a3b189afb48d 100644
--- a/lib/auth/clusterconfig/clusterconfigv1/service_test.go
+++ b/lib/auth/clusterconfig/clusterconfigv1/service_test.go
@@ -42,6 +42,7 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -422,7 +423,7 @@ func TestCreateClusterNetworkingConfig(t *testing.T) {
 
 	cases := []struct {
 		name       string
-		modules    modules.Modules
+		modules    *modulestest.Modules
 		authorizer authz.Authorizer
 		config     func(p types.ClusterNetworkingConfig)
 		assertion  func(t *testing.T, created types.ClusterNetworkingConfig, err error)
@@ -472,7 +473,7 @@ func TestCreateClusterNetworkingConfig(t *testing.T) {
 			authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 				return authRoleContext, nil
 			}),
-			modules: &modules.TestModules{TestBuildType: modules.BuildEnterprise},
+			modules: &modulestest.Modules{TestBuildType: modules.BuildEnterprise},
 			config: func(p types.ClusterNetworkingConfig) {
 				p.SetTunnelStrategy(&types.TunnelStrategyV1{
 					Strategy: &types.TunnelStrategyV1_ProxyPeering{
@@ -490,7 +491,7 @@ func TestCreateClusterNetworkingConfig(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			if test.modules != nil {
-				modules.SetTestModules(t, test.modules)
+				modulestest.SetTestModules(t, *test.modules)
 			}
 
 			var opts []serviceOpt
@@ -655,7 +656,7 @@ func TestUpdateClusterNetworkingConfig(t *testing.T) {
 				return cnc
 			}(),
 			config: func(p types.ClusterNetworkingConfig) {
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestBuildType: modules.BuildEnterprise,
 					TestFeatures: modules.Features{
 						Cloud: true,
@@ -683,7 +684,7 @@ func TestUpdateClusterNetworkingConfig(t *testing.T) {
 				}, nil
 			}),
 			config: func(p types.ClusterNetworkingConfig) {
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestBuildType: modules.BuildEnterprise,
 					TestFeatures: modules.Features{
 						Cloud: true,
@@ -716,7 +717,7 @@ func TestUpdateClusterNetworkingConfig(t *testing.T) {
 				return cnc
 			}(),
 			config: func(p types.ClusterNetworkingConfig) {
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestBuildType: modules.BuildEnterprise,
 					TestFeatures: modules.Features{
 						Cloud: true,
@@ -966,7 +967,7 @@ func TestCreateSessionRecordingConfig(t *testing.T) {
 
 	cases := []struct {
 		name       string
-		modules    modules.Modules
+		modules    *modulestest.Modules
 		authorizer authz.Authorizer
 		assertion  func(t *testing.T, created types.SessionRecordingConfig, err error)
 	}{
@@ -998,7 +999,7 @@ func TestCreateSessionRecordingConfig(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			if test.modules != nil {
-				modules.SetTestModules(t, test.modules)
+				modulestest.SetTestModules(t, *test.modules)
 			}
 
 			var opts []serviceOpt
@@ -1866,14 +1867,14 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			name: "authorized proxy with non empty access graph config; Policy module is enabled",
 			role: types.RoleProxy,
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			accessGraphConfig: cfgEnabled,
 			errorAssertion:    require.NoError,
@@ -1891,14 +1892,14 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			name: "authorized discovery with non empty access graph config; Policy module is enabled",
 			role: types.RoleDiscovery,
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			accessGraphConfig: cfgEnabled,
 			errorAssertion:    require.NoError,
@@ -1916,14 +1917,14 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			name: "Policy module is enabled with secrets scan option",
 			role: types.RoleDiscovery,
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			accessGraphConfig:   cfgEnabled,
 			accessGraphSettings: settings,
@@ -2074,14 +2075,14 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
 		{
 			name: "updated",
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 				return &authz.Context{
@@ -2199,14 +2200,14 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
 		{
 			name: "upserted",
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 				return &authz.Context{
@@ -2293,14 +2294,14 @@ func TestResetAccessGraphSettings(t *testing.T) {
 		{
 			name: "reset",
 			testSetup: func(t *testing.T) {
-				m := modules.TestModules{
+				m := modulestest.Modules{
 					TestFeatures: modules.Features{
 						Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 							entitlements.Policy: {Enabled: true},
 						},
 					},
 				}
-				modules.SetTestModules(t, &m)
+				modulestest.SetTestModules(t, m)
 			},
 			authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 				return &authz.Context{
diff --git a/lib/auth/db.go b/lib/auth/db.go
index e6446a03e7bff..47edc16e188ec 100644
--- a/lib/auth/db.go
+++ b/lib/auth/db.go
@@ -45,6 +45,7 @@ import (
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/winpki"
 )
 
 // GenerateDatabaseCert generates client certificate used by a database
@@ -155,14 +156,28 @@ func (a *Server) generateDatabaseCert(ctx context.Context, req *proto.DatabaseCe
 		Subject:   csr.Subject,
 		NotAfter:  a.clock.Now().UTC().Add(req.TTL.Get()),
 	}
+
 	if req.CertificateExtensions == proto.DatabaseCertRequest_WINDOWS_SMARTCARD {
 		// Pass through ExtKeyUsage (which we need for Smartcard Logon usage)
 		// and SubjectAltName (which we need for otherName SAN, not supported
 		// out of the box in crypto/x509) extensions only.
 		certReq.ExtraExtensions = filterExtensions(a.CloseContext(), a.logger, csr.Extensions, oidExtKeyUsage, oidSubjectAltName, oidADUserMapping)
 		certReq.KeyUsage = x509.KeyUsageDigitalSignature
-		// CRL is required for Windows smartcard certs.
-		certReq.CRLDistributionPoints = []string{req.CRLEndpoint}
+		// CRL Distribution Points (CDP) are required for Windows smartcard certs.
+		// The CDP is computed here by the auth server issuing the cert and not provided
+		// by the client because the CDP is based on the identity of the issuer, which is
+		// necessary in order to support clusters with multiple issuing certs (HSMs).
+		// If there's only 1 active key we don't include SKID in CDP for backward compatibility.
+		if req.CRLDomain != "" {
+			includeSKID := len(ca.GetActiveKeys().TLS) > 1
+			cdp := winpki.CRLDistributionPoint(req.CRLDomain, types.DatabaseClientCA, tlsCA, includeSKID)
+			certReq.CRLDistributionPoints = []string{cdp}
+		} else if req.CRLEndpoint != "" {
+			// legacy clients will specify CRL endpoint instead of CRL domain
+			// DELETE IN v20 (zmb3)
+			certReq.CRLDistributionPoints = []string{req.CRLEndpoint}
+			a.logger.DebugContext(ctx, "Generating Database cert with legacy CDP")
+		}
 	} else {
 		// Include provided server names as SANs in the certificate, CommonName
 		// has been deprecated since Go 1.15:
diff --git a/lib/auth/db_test.go b/lib/auth/db_test.go
index 9d532819d3e1c..19f74f10d68f6 100644
--- a/lib/auth/db_test.go
+++ b/lib/auth/db_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -32,6 +32,8 @@ import (
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -92,7 +94,7 @@ func Test_getSnowflakeJWTParams(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			subject, issuer := getSnowflakeJWTParams(context.Background(), tt.args.accountName, tt.args.userName, tt.args.publicKey)
+			subject, issuer := auth.GetSnowflakeJWTParams(context.Background(), tt.args.accountName, tt.args.userName, tt.args.publicKey)
 
 			require.Equal(t, tt.wantSubject, subject)
 			require.Equal(t, tt.wantIssuer, issuer)
@@ -102,7 +104,7 @@ func Test_getSnowflakeJWTParams(t *testing.T) {
 
 func TestDBCertSigning(t *testing.T) {
 	t.Parallel()
-	authServer, err := NewTestAuthServer(TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
 		ClusterName: "local.me",
 		Dir:         t.TempDir(),
@@ -156,9 +158,11 @@ func TestDBCertSigning(t *testing.T) {
 		name           string
 		requester      proto.DatabaseCertRequest_Requester
 		extensions     proto.DatabaseCertRequest_Extensions
+		crlDomain      string
 		wantCertSigner []byte
 		wantCACerts    [][]byte
 		wantKeyUsage   []x509.ExtKeyUsage
+		wantCDP        []string
 	}{
 		{
 			name:           "DB service request is signed by active db client CA and trusts db CAs",
@@ -188,6 +192,16 @@ func TestDBCertSigning(t *testing.T) {
 			wantCACerts:    [][]byte{activeDBClientCACert, newDBClientCACert},
 			wantKeyUsage:   []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		},
+		{
+			name:           "tctl request for SQL Server database with CDPs",
+			requester:      proto.DatabaseCertRequest_TCTL,
+			extensions:     proto.DatabaseCertRequest_WINDOWS_SMARTCARD,
+			crlDomain:      "example.com",
+			wantCertSigner: newDBCACert,
+			wantCACerts:    [][]byte{activeDBClientCACert, newDBClientCACert},
+			wantKeyUsage:   []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			wantCDP:        []string{"ldap:///CN=local.me,CN=TeleportDB,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint"},
+		},
 	}
 	for _, tt := range tests {
 		tt := tt
@@ -199,25 +213,30 @@ func TestDBCertSigning(t *testing.T) {
 				TTL:                   proto.Duration(time.Hour),
 				RequesterName:         tt.requester,
 				CertificateExtensions: tt.extensions,
+				CRLDomain:             tt.crlDomain,
 			})
 			require.NoError(t, err)
 			require.Equal(t, tt.wantCACerts, certResp.CACerts)
 
 			// verify that the response cert is a DB CA cert.
-			mustVerifyCert(t, tt.wantCertSigner, certResp.Cert, tt.wantKeyUsage...)
+			mustVerifyCert(t, tt.wantCertSigner, certResp.Cert, tt.wantCDP, tt.wantKeyUsage...)
 		})
 	}
 }
 
 // mustVerifyCert is a helper func that verifies leaf cert with root cert.
-func mustVerifyCert(t *testing.T, rootPEM, leafPEM []byte, keyUsages ...x509.ExtKeyUsage) {
+func mustVerifyCert(t *testing.T, rootPEM, leafPEM []byte, cdps []string, keyUsages ...x509.ExtKeyUsage) {
 	t.Helper()
+
 	leafCert, err := tlsca.ParseCertificatePEM(leafPEM)
 	require.NoError(t, err)
 
 	certPool := x509.NewCertPool()
 	ok := certPool.AppendCertsFromPEM(rootPEM)
 	require.True(t, ok)
+
+	require.Equal(t, cdps, leafCert.CRLDistributionPoints)
+
 	opts := x509.VerifyOptions{
 		Roots:     certPool,
 		KeyUsages: keyUsages,
@@ -261,7 +280,7 @@ func TestFilterExtensions(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := filterExtensions(context.Background(), slog.Default(), tt.input, tt.allowedOIDs...)
+			got := auth.FilterExtensions(context.Background(), slog.Default(), tt.input, tt.allowedOIDs...)
 			require.Equal(t, tt.expected, got)
 		})
 	}
diff --git a/lib/auth/desktop.go b/lib/auth/desktop.go
index e795d8c32e2a9..530b018a7c4db 100644
--- a/lib/auth/desktop.go
+++ b/lib/auth/desktop.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/winpki"
 )
 
 // GenerateWindowsDesktopCert generates client certificate for Windows RDP
@@ -48,6 +49,12 @@ func (a *Server) GenerateWindowsDesktopCert(ctx context.Context, req *proto.Wind
 		return nil, trace.AccessDenied(
 			"this Teleport cluster is not licensed for desktop access, please contact the cluster administrator")
 	}
+
+	limitExceeded, err := a.desktopsLimitExceeded(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	csr, err := tlsca.ParseCertificateRequestPEM(req.CSR)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -71,6 +78,7 @@ func (a *Server) GenerateWindowsDesktopCert(ctx context.Context, req *proto.Wind
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	// See https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/enabling-smart-card-logon-third-party-certification-authorities
 	// for cert requirements for Windows authn.
 	certReq := tlsca.CertificateRequest{
@@ -85,14 +93,20 @@ func (a *Server) GenerateWindowsDesktopCert(ctx context.Context, req *proto.Wind
 	// CRL Distribution Points (CDP) are required for Windows smartcard certs
 	// for users wanting to RDP. They are not required for the service account
 	// cert that Teleport itself uses to authenticate for LDAP.
-	if req.CRLEndpoint != "" {
+	//
+	// The CDP is computed here by the auth server issuing the cert and not provided
+	// by the client because the CDP is based on the identity of the issuer, which is
+	// necessary in order to support clusters with multiple issuing certs (HSMs).
+	if req.CRLDomain != "" {
+		cdp := winpki.CRLDistributionPoint(req.CRLDomain, types.UserCA, tlsCA, true)
+		certReq.CRLDistributionPoints = []string{cdp}
+	} else if req.CRLEndpoint != "" {
+		// Legacy clients will specify CRL endpoint instead of CRL domain.
+		// DELETE IN v20 (zmb3): v19 clients will no longer be setting CRLEndpoint
 		certReq.CRLDistributionPoints = []string{req.CRLEndpoint}
+		a.logger.DebugContext(ctx, "Generating Windows desktop cert with legacy CDP")
 	}
 
-	limitExceeded, err := a.desktopsLimitExceeded(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 	certReq.ExtraExtensions = append(certReq.ExtraExtensions, pkix.Extension{
 		Id:    tlsca.LicenseOID,
 		Value: []byte(modules.GetModules().BuildType()),
diff --git a/lib/auth/desktop_test.go b/lib/auth/desktop_test.go
index 0a6fcb2eb597f..120463157d1e4 100644
--- a/lib/auth/desktop_test.go
+++ b/lib/auth/desktop_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -27,12 +27,13 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 // TestDesktopAccessDisabled makes sure desktop access can be disabled via modules.
 // Since desktop connections require a cert, this is mediated via the cert generating function.
 func TestDesktopAccessDisabled(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.Desktop: {Enabled: false}, // Explicitly turn off desktop access.
diff --git a/lib/auth/discoveryconfig/discoveryconfigv1/service.go b/lib/auth/discoveryconfig/discoveryconfigv1/service.go
index 97450b5e0246b..6235642af8256 100644
--- a/lib/auth/discoveryconfig/discoveryconfigv1/service.go
+++ b/lib/auth/discoveryconfig/discoveryconfigv1/service.go
@@ -20,21 +20,26 @@ package discoveryconfigv1
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport"
 	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	conv "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/aws"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // ServiceConfig holds configuration options for the DiscoveryConfig gRPC service.
@@ -124,7 +129,11 @@ func (s *Service) ListDiscoveryConfigs(ctx context.Context, req *discoveryconfig
 
 	dcs := make([]*discoveryconfigv1.DiscoveryConfig, len(results))
 	for i, r := range results {
-		dcs[i] = conv.ToProto(r)
+		downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, r)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		dcs[i] = conv.ToProto(downgraded)
 	}
 
 	return &discoveryconfigv1.ListDiscoveryConfigsResponse{
@@ -149,7 +158,12 @@ func (s *Service) GetDiscoveryConfig(ctx context.Context, req *discoveryconfigv1
 		return nil, trace.Wrap(err)
 	}
 
-	return conv.ToProto(dc), nil
+	downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, dc)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return conv.ToProto(downgraded), nil
 }
 
 // CreateDiscoveryConfig creates a new DiscoveryConfig resource.
@@ -377,3 +391,67 @@ func (s *Service) UpdateDiscoveryConfigStatus(ctx context.Context, req *discover
 		return conv.ToProto(resp), nil
 	}
 }
+
+// MaybeDowngradeDiscoveryConfig tests the client version passed through the gRPC metadata,
+// and if necessary downgrades the Discovery Config resource for compatibility with the older client.
+// The following rules are applied:
+//   - if version is lower than 18.5.0, the AWS wildcard region is replaced with "aws-global" sentinel region
+//     this ensures the client can still discover other resources without erroring out.
+func MaybeDowngradeDiscoveryConfig(ctx context.Context, dc *discoveryconfig.DiscoveryConfig) (*discoveryconfig.DiscoveryConfig, error) {
+	clientVersionString, ok := metadata.ClientVersionFromContext(ctx)
+	if !ok {
+		// This client is not reporting its version via gRPC metadata, which means it's a client really old or a third-party client.
+		// For those, downgrading the resource will do more harm than good, so the resource is returned as is.
+		return dc, nil
+	}
+
+	clientVersion, err := semver.NewVersion(clientVersionString)
+	if err != nil {
+		return nil, trace.BadParameter("unrecognized client version: %s is not a valid semver", clientVersionString)
+	}
+
+	dc = maybeDowngradeDiscoveryConfigAWSWildcardRegion(dc, clientVersion)
+	return dc, nil
+}
+
+var minSupportedDiscoveryConfigAWSWildcardRegionVersion = semver.Version{Major: 18, Minor: 5, Patch: 0}
+
+// For Auth Server v20.0.0, the expected minimum supported client version is v19.0.0, which supports the AWS wildcard region.
+// This function should be deleted at that time.
+//
+// TODO(@marco): DELETE IN v20.0.0.
+func maybeDowngradeDiscoveryConfigAWSWildcardRegion(dc *discoveryconfig.DiscoveryConfig, clientVersion *semver.Version) *discoveryconfig.DiscoveryConfig {
+	if supported, err := utils.MinVerWithoutPreRelease(
+		clientVersion.String(),
+		minSupportedDiscoveryConfigAWSWildcardRegionVersion.String()); supported || err != nil {
+		return dc
+	}
+
+	var changed bool
+
+	originalDiscoveryConfig := dc
+
+	dc = dc.Clone()
+	awsMatchers := dc.Spec.AWS
+	awsMatchersWithoutRegionWildcard := make([]types.AWSMatcher, 0, len(awsMatchers))
+	for _, awsMatcher := range awsMatchers {
+		if len(awsMatcher.Regions) == 1 && awsMatcher.Regions[0] == types.Wildcard {
+			awsMatcher.Regions = []string{aws.AWSGlobalRegion}
+			changed = true
+		}
+		awsMatchersWithoutRegionWildcard = append(awsMatchersWithoutRegionWildcard, awsMatcher)
+	}
+
+	if !changed {
+		return originalDiscoveryConfig
+	}
+
+	dc.Spec.AWS = awsMatchersWithoutRegionWildcard
+	reason := fmt.Sprintf(`Client version %q does not support discovering all regions. Either update the Discovery Service agent to at least %s or enumerate all the regions in %q discovery config.`,
+		clientVersion, minSupportedDiscoveryConfigAWSWildcardRegionVersion, dc.GetName())
+	if dc.Metadata.Labels == nil {
+		dc.Metadata.Labels = make(map[string]string, 1)
+	}
+	dc.Metadata.Labels[types.TeleportDowngradedLabel] = reason
+	return dc
+}
diff --git a/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go b/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
index 8b25cb8774424..a3d86e63f613f 100644
--- a/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
+++ b/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
@@ -29,6 +29,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	discoveryconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	convert "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
@@ -561,3 +562,94 @@ func initSvc(t *testing.T, clusterName string) (context.Context, localClient, *S
 		DiscoveryConfigService: localResourceService,
 	}, resourceSvc
 }
+
+func TestDowngrade(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		clientVersion string
+		input         *discoveryconfig.DiscoveryConfig
+		expected      *discoveryconfig.DiscoveryConfig
+	}{
+		{
+			name:          "no downgrade for recent client",
+			clientVersion: "18.5.0",
+			input: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+			expected: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+		},
+		{
+			name:          "downgrade for old client",
+			clientVersion: "18.4.2",
+			input: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+			expected: func() *discoveryconfig.DiscoveryConfig {
+				dc, err := discoveryconfig.NewDiscoveryConfig(
+					header.Metadata{Name: "dc1"},
+					discoveryconfig.Spec{
+						DiscoveryGroup: "group1",
+						AWS: []types.AWSMatcher{
+							{
+								Regions: []string{types.Wildcard},
+								Types:   []string{"ec2"},
+							},
+						},
+					},
+				)
+				require.NoError(t, err)
+				return dc
+			}(),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := metadata.AddMetadataToContext(t.Context(), map[string]string{
+				metadata.VersionKey: tc.clientVersion,
+			})
+			downgraded, err := MaybeDowngradeDiscoveryConfig(ctx, tc.input)
+			require.NoError(t, err)
+			require.Equal(t, tc.expected, downgraded)
+		})
+	}
+}
diff --git a/lib/auth/export_test.go b/lib/auth/export_test.go
new file mode 100644
index 0000000000000..738840e80f3e6
--- /dev/null
+++ b/lib/auth/export_test.go
@@ -0,0 +1,336 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package auth
+
+import (
+	"context"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/julienschmidt/httprouter"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/types/userloginstate"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/inventory"
+	"github.com/gravitational/teleport/lib/join/boundkeypair"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// The items exported here exist solely to prevent import cycles and facilitate
+// preexisting tests in lib/auth which relied on unexported items. All new
+// tests in lib/auth should exist in the auth_test package and not rely on
+// internal state.
+
+const (
+	NumOfRecoveryCodes     = numOfRecoveryCodes
+	NumWordsInRecoveryCode = numWordsInRecoveryCode
+
+	StartRecoveryGenericErrMsg  = startRecoveryGenericErrMsg
+	StartRecoveryBadAuthnErrMsg = startRecoveryBadAuthnErrMsg
+
+	VerifyRecoveryGenericErrMsg  = verifyRecoveryGenericErrMsg
+	VerifyRecoveryBadAuthnErrMsg = verifyRecoveryBadAuthnErrMsg
+
+	CompleteRecoveryGenericErrMsg = completeRecoveryGenericErrMsg
+
+	MFADeviceNameMaxLen = mfaDeviceNameMaxLen
+
+	ServerHostnameMaxLen = serverHostnameMaxLen
+
+	MaxUserAgentLen = maxUserAgentLen
+	ForwardedTag    = forwardedTag
+)
+
+var (
+	ErrDeleteRoleUser       = errDeleteRoleUser
+	ErrDeleteRoleCA         = errDeleteRoleCA
+	ErrDeleteRoleAccessList = errDeleteRoleAccessList
+
+	CreateAuditStreamAcceptedTotalMetric = createAuditStreamAcceptedTotalMetric
+)
+
+func (a *Server) SetRemoteClusterRefreshLimit(limit int) {
+	remoteClusterRefreshLimit = limit
+}
+
+func (a *Server) RemoteClusterRefreshBuckets(buckets int) {
+	remoteClusterRefreshBuckets = buckets
+}
+
+func (a *Server) VerifyRecoveryCode(ctx context.Context, username string, recoveryCode []byte) (errResult error) {
+	return a.verifyRecoveryCode(ctx, username, recoveryCode)
+}
+
+func (a *Server) CreateRecoveryToken(ctx context.Context, username, tokenType string, usage types.UserTokenUsage) (types.UserToken, error) {
+	return a.createRecoveryToken(ctx, username, tokenType, usage)
+}
+
+func (a *Server) NewUserToken(ctx context.Context, req authclient.CreateUserTokenRequest) (types.UserToken, error) {
+	return a.newUserToken(ctx, req)
+}
+
+func CreatePrivilegeToken(ctx context.Context, srv *Server, username, tokenKind string) (*types.UserTokenV3, error) {
+	return srv.createPrivilegeToken(ctx, username, tokenKind)
+}
+
+func (a *Server) GenerateAndUpsertRecoveryCodes(ctx context.Context, username string) (*proto.RecoveryCodes, error) {
+	return a.generateAndUpsertRecoveryCodes(ctx, username)
+}
+
+func (p *HostAndUserCAPoolInfo) VerifyPeerCert() func([][]byte, [][]*x509.Certificate) error {
+	return p.verifyPeerCert()
+}
+
+func (a *Server) CheckPassword(ctx context.Context, user string, password []byte, otpToken string) error {
+	_, err := a.checkPassword(ctx, user, password, otpToken)
+	return err
+}
+
+func (a *Server) SetPrivateKey(key []byte) {
+	a.privateKey = key
+}
+
+func (a *Server) SyncUpgradeWindowStartHour(ctx context.Context) error {
+	return a.syncUpgradeWindowStartHour(ctx)
+}
+
+func (a *Server) ValidateTrustedCluster(ctx context.Context, req *authclient.ValidateTrustedClusterRequest) (*authclient.ValidateTrustedClusterResponse, error) {
+	return a.validateTrustedCluster(ctx, req)
+}
+
+func (a *Server) CreateReverseTunnel(ctx context.Context, t types.TrustedCluster) error {
+	return a.createReverseTunnel(ctx, t)
+}
+
+func (a *Server) RefreshRemoteClusters(ctx context.Context) {
+	a.refreshRemoteClusters(ctx)
+}
+
+func CreateGithubConnector(ctx context.Context, srv *Server, connector types.GithubConnector) (types.GithubConnector, error) {
+	return srv.createGithubConnector(ctx, connector)
+}
+
+func UpdateGithubConnector(ctx context.Context, srv *Server, connector types.GithubConnector) (types.GithubConnector, error) {
+	return srv.updateGithubConnector(ctx, connector)
+}
+
+func UpsertGithubConnector(ctx context.Context, srv *Server, connector types.GithubConnector) (types.GithubConnector, error) {
+	return srv.upsertGithubConnector(ctx, connector)
+}
+
+func DeleteGithubConnector(ctx context.Context, srv *Server, name string) error {
+	return srv.deleteGithubConnector(ctx, name)
+}
+
+func (a *Server) CalculateGithubUser(ctx context.Context, diagCtx *SSODiagContext, connector types.GithubConnector, claims *types.GithubClaims, request *types.GithubAuthRequest) (*CreateUserParams, error) {
+	return a.calculateGithubUser(ctx, diagCtx, connector, claims, request)
+}
+
+func (a *Server) SubscribeToLockTarget(ctx context.Context, targets ...types.LockTarget) (types.Watcher, error) {
+	return a.lockWatcher.Subscribe(ctx, targets...)
+}
+
+func (a *Server) NewWebSession(
+	ctx context.Context,
+	req NewWebSessionRequest,
+	opts *newWebSessionOpts,
+) (types.WebSession, services.AccessChecker, error) {
+	return a.newWebSession(ctx, req, opts)
+}
+
+func (a *Server) AuthenticateUser(
+	ctx context.Context,
+	req authclient.AuthenticateUserRequest,
+	requiredExt mfav1.ChallengeExtensions,
+) (verifyLocks func(verifyMFADeviceLocksParams) error, mfaDev *types.MFADevice, user string, err error) {
+	return a.authenticateUser(ctx, req, requiredExt)
+}
+
+func (a *Server) Inventory() *inventory.Controller {
+	return a.inventory
+}
+
+func (a *Server) CheckPasswordWOToken(ctx context.Context, user string, password []byte) error {
+	return a.checkPasswordWOToken(ctx, user, password)
+}
+
+func (a *Server) ResetPassword(ctx context.Context, username string) error {
+	return a.resetPassword(ctx, username)
+}
+
+func (a *Server) SetCreateBoundKeypairValidator(validator boundkeypair.CreateBoundKeypairValidator) {
+	a.createBoundKeypairValidator = validator
+}
+
+func (a *Server) AuthenticateUserLogin(ctx context.Context, req authclient.AuthenticateUserRequest) (services.UserState, *services.SplitAccessChecker, error) {
+	return a.authenticateUserLogin(ctx, req)
+}
+
+func (a *Server) RefreshULS(ctx context.Context, user types.User, ulsService services.UserLoginStates) (*userloginstate.UserLoginState, error) {
+	return a.ulsGenerator.Refresh(ctx, user, ulsService)
+}
+
+func (a *Server) CreateGithubUser(ctx context.Context, p *CreateUserParams, dryRun bool) (types.User, error) {
+	return a.createGithubUser(ctx, p, dryRun)
+}
+
+func BuildAPIEndpoint(apiEndpointURLStr string) (string, error) {
+	return buildAPIEndpoint(apiEndpointURLStr)
+}
+
+func FormatGithubURL(host string, path string) string {
+	return formatGithubURL(host, path)
+}
+
+func CheckGithubOrgSSOSupport(ctx context.Context, conn types.GithubConnector, userTeams []GithubTeamResponse, orgCache *utils.FnCache, client httpRequester) error {
+	return checkGithubOrgSSOSupport(ctx, conn, userTeams, orgCache, client)
+}
+
+func ChangeUserAuthentication(ctx context.Context, a *Server, req *proto.ChangeUserAuthenticationRequest) (types.User, error) {
+	return a.changeUserAuthentication(ctx, req)
+}
+
+func ValidateOracleJoinToken(token types.ProvisionToken) error {
+	return validateOracleJoinToken(token)
+}
+
+func CreatePresetUsers(ctx context.Context, um PresetUsers) error {
+	return createPresetUsers(ctx, um)
+}
+
+func CreatePresetRoles(ctx context.Context, um PresetRoleManager) error {
+	return createPresetRoles(ctx, um)
+}
+
+func GetPresetUsers() []types.User {
+	return getPresetUsers()
+}
+
+func CreatePresetDatabaseObjectImportRule(ctx context.Context, rules services.DatabaseObjectImportRules) error {
+	return createPresetDatabaseObjectImportRule(ctx, rules)
+}
+
+func ValidServerHostname(hostname string) bool {
+	return validServerHostname(hostname)
+}
+
+func FormatAccountName(s proxyDomainGetter, username string, authHostname string) (string, error) {
+	return formatAccountName(context.TODO(), s, username, authHostname)
+}
+
+func ConfigureCAsForTrustedCluster(tc types.TrustedCluster, cas []types.CertAuthority) {
+	configureCAsForTrustedCluster(tc, cas)
+}
+
+func UpdateAccessRequestWithAdditionalReviewers(ctx context.Context, req types.AccessRequest, accessLists services.AccessListsGetter, promotions *types.AccessRequestAllowedPromotions) {
+	updateAccessRequestWithAdditionalReviewers(ctx, req, accessLists, promotions)
+}
+
+func EncodeProquint(x uint16) string {
+	return encodeProquint(x)
+}
+
+func EmitSSOLoginFailureEvent(ctx context.Context, emitter apievents.Emitter, method string, err error, testFlow bool) {
+	emitSSOLoginFailureEvent(ctx, emitter, method, err, testFlow)
+}
+
+type UpsertServerRawReq = upsertServerRawReq
+
+func UpsertServer(srv *APIServer, auth presenceForAPIServer, role types.SystemRole, r *http.Request, p httprouter.Params) (any, error) {
+	return srv.upsertServer(auth, role, r, p)
+}
+
+func NewServerWithRoles(srv *Server, alog events.AuditLogSessionStreamer, authzContext authz.Context) *ServerWithRoles {
+	return &ServerWithRoles{
+		authServer: srv,
+		alog:       alog,
+		context:    authzContext,
+	}
+}
+
+func NewKeySet(ctx context.Context, keyStore *keystore.Manager, caID types.CertAuthID) (types.CAKeySet, error) {
+	return newKeySet(ctx, keyStore, caID)
+}
+
+func ValidateIdentity(c *TransportCredentials, conn net.Conn, tlsInfo *credentials.TLSInfo) (net.Conn, IdentityInfo, error) {
+	return c.validateIdentity(conn, tlsInfo)
+}
+
+func (m *Middleware) SetLastRejectedTime(t time.Time) {
+	m.lastRejectedAlertTime.Store(t.UnixNano())
+}
+
+func RegisterUsingOracleMethod(
+	ctx context.Context,
+	srv *Server,
+	tokenReq *types.RegisterUsingTokenRequest,
+	challengeResponse client.RegisterOracleChallengeResponseFunc,
+	fetchClaims oracleClaimsFetcher,
+) (certs *proto.Certs, err error) {
+	return srv.registerUsingOracleMethod(ctx, tokenReq, challengeResponse, fetchClaims)
+}
+
+func TrimUserAgent(userAgent string) string {
+	return trimUserAgent(userAgent)
+}
+
+func GetSnowflakeJWTParams(ctx context.Context, accountName, userName string, publicKey []byte) (string, string) {
+	return getSnowflakeJWTParams(ctx, accountName, userName, publicKey)
+}
+
+func FilterExtensions(ctx context.Context, logger *slog.Logger, extensions []pkix.Extension, oids ...asn1.ObjectIdentifier) []pkix.Extension {
+	return filterExtensions(ctx, logger, extensions, oids...)
+}
+
+func PopulateGithubClaims(user *GithubUserResponse, teams []GithubTeamResponse) (*types.GithubClaims, error) {
+	return populateGithubClaims(user, teams)
+}
+
+func ValidateGithubAuthCallbackHelper(ctx context.Context, m GitHubManager, diagCtx *SSODiagContext, q url.Values, emitter apievents.Emitter, logger *slog.Logger) (*authclient.GithubAuthResponse, error) {
+	return validateGithubAuthCallbackHelper(ctx, m, diagCtx, q, emitter, logger)
+}
+
+func FormatHeaderFromMap(m map[string]string) http.Header {
+	return formatHeaderFromMap(m)
+}
+
+func CheckHeaders(headers http.Header, challenge string, clock clockwork.Clock) error {
+	return checkHeaders(headers, challenge, clock)
+}
+
+type GitHubManager = githubManager
+
+func (s *TLSServer) GRPCServer() *GRPCServer {
+	return s.grpcServer
+}
diff --git a/lib/auth/fuzz_test.go b/lib/auth/fuzz_test.go
deleted file mode 100644
index ab18f5c1378b9..0000000000000
--- a/lib/auth/fuzz_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func FuzzParseAndVerifyIID(f *testing.F) {
-	f.Fuzz(func(t *testing.T, iidBytes []byte) {
-		require.NotPanics(t, func() {
-			parseAndVerifyIID(iidBytes)
-		})
-	})
-}
diff --git a/lib/auth/github.go b/lib/auth/github.go
index d055ee8650b19..0e33ac00a5a40 100644
--- a/lib/auth/github.go
+++ b/lib/auth/github.go
@@ -26,9 +26,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
-	"net/netip"
 	"net/url"
-	"slices"
 	"strings"
 	"time"
 
@@ -153,7 +151,12 @@ func (a *Server) CreateGithubAuthRequest(ctx context.Context, req types.GithubAu
 	// checked, as they will point the browser away from the IdP or the web UI
 	// after the authentication is done
 	if !req.CreateWebSession {
-		if err := ValidateClientRedirect(req.ClientRedirectURL, req.SSOTestFlow, connector.GetClientRedirectSettings()); err != nil {
+		ceremonyType := sso.CeremonyTypeLogin
+		if req.SSOTestFlow {
+			ceremonyType = sso.CeremonyTypeTest
+		}
+
+		if err := sso.ValidateClientRedirect(req.ClientRedirectURL, ceremonyType, connector.GetClientRedirectSettings()); err != nil {
 			return nil, trace.Wrap(err, InvalidClientRedirectErrorMessage)
 		}
 	}
@@ -424,7 +427,7 @@ func GithubAuthRequestFromProto(req *types.GithubAuthRequest) authclient.GithubA
 }
 
 type githubManager interface {
-	validateGithubAuthCallback(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error)
+	ValidateGithubAuthRedirect(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error)
 }
 
 // ValidateGithubAuthCallback validates Github auth callback redirect
@@ -442,7 +445,7 @@ func validateGithubAuthCallbackHelper(ctx context.Context, m githubManager, diag
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 	}
 
-	auth, err := m.validateGithubAuthCallback(ctx, diagCtx, q)
+	auth, err := m.ValidateGithubAuthRedirect(ctx, diagCtx, q)
 	diagCtx.Info.Error = trace.UserMessage(err)
 	event.AppliedLoginRules = diagCtx.Info.AppliedLoginRules
 
@@ -532,8 +535,8 @@ func newGithubOAuth2Config(connector types.GithubConnector) oauth2.Config {
 	}
 }
 
-// ValidateGithubAuthCallback validates Github auth callback redirect
-func (a *Server) validateGithubAuthCallback(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+// ValidateGithubAuthRedirect validates Github auth callback redirect
+func (a *Server) ValidateGithubAuthRedirect(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 	logger := a.logger.With(teleport.ComponentKey, "github")
 
 	if errParam := q.Get("error"); errParam != "" {
@@ -725,6 +728,12 @@ func (a *Server) makeGithubAuthResponse(
 		auth.HostSigners = append(auth.HostSigners, authority)
 	}
 
+	if o, err := a.ClientOptionsForLogin(userState); err == nil {
+		auth.ClientOptions = o
+	} else {
+		logger.WarnContext(ctx, "Failed to calculate client options for GitHub login", "username", userState.GetName(), "error", err)
+	}
+
 	return &auth, nil
 }
 
@@ -1005,8 +1014,6 @@ func (a *Server) createGithubUser(ctx context.Context, p *CreateUserParams, dryR
 	return user, nil
 }
 
-const unknownRedirectHostnameErrMsg = "unknown custom client redirect URL hostname"
-
 // ValidateClientRedirect checks a desktop client redirect URL for SSO logins
 // against some (potentially nil) settings from an auth connector; in the
 // current implementation, that means either "http" schema with a hostname of
@@ -1018,94 +1025,14 @@ const unknownRedirectHostnameErrMsg = "unknown custom client redirect URL hostna
 // list is non-empty URLs in both the "http" and "https" schema are allowed
 // if the hostname is an IP address that is contained in a specified CIDR
 // range on any port.
+//
+// TODO(Joerger): Replaced by [sso.ValidateClientRedirect], remove once /e no longer depends on it
 func ValidateClientRedirect(clientRedirect string, ssoTestFlow bool, settings *types.SSOClientRedirectSettings) error {
-	if clientRedirect == "" {
-		// empty redirects are non-functional and harmless, so we allow them as
-		// they're used a lot in test code
-		return nil
-	}
-	u, err := url.Parse(clientRedirect)
-	if err != nil {
-		return trace.Wrap(err, "parsing client redirect URL")
-	}
-	if u.Path == sso.WebMFARedirect {
-		// If this is a SSO redirect in the WebUI, allow.
-		return nil
-	}
-	if u.Opaque != "" {
-		return trace.BadParameter("unexpected opaque client redirect URL")
-	}
-	if u.User != nil {
-		return trace.BadParameter("unexpected userinfo in client redirect URL")
-	}
-	if u.EscapedPath() != "/callback" {
-		return trace.BadParameter("invalid path in client redirect URL")
-	}
-	if q, err := url.ParseQuery(u.RawQuery); err != nil {
-		return trace.Wrap(err, "parsing query in client redirect URL")
-	} else if len(q) != 1 || len(q["secret_key"]) != 1 {
-		return trace.BadParameter("malformed query parameters in client redirect URL")
-	}
-	if u.Fragment != "" || u.RawFragment != "" {
-		return trace.BadParameter("unexpected fragment in client redirect URL")
-	}
-
-	// we checked everything but u.Scheme and u.Host now
-	if u.Scheme != "http" && u.Scheme != "https" {
-		return trace.BadParameter("invalid scheme in client redirect URL")
-	}
-
-	// allow HTTP redirects to local addresses
-	allowedHTTPLocalAddrs := []string{"localhost", "127.0.0.1", "::1"}
-	if u.Scheme == "http" && slices.Contains(allowedHTTPLocalAddrs, u.Hostname()) {
-		return nil
-	}
-
+	ceremonyType := sso.CeremonyTypeLogin
 	if ssoTestFlow {
-		return trace.AccessDenied("custom client redirect URLs are not allowed in SSO test")
-	}
-
-	if settings == nil {
-		return trace.AccessDenied("%s", unknownRedirectHostnameErrMsg)
-	}
-
-	// allow HTTP or HTTPS redirects from IPs in specified CIDR ranges
-	hostIP, err := netip.ParseAddr(u.Hostname())
-	if err == nil {
-		hostIP = hostIP.Unmap()
-
-		for _, cidrStr := range settings.InsecureAllowedCidrRanges {
-			cidr, err := netip.ParsePrefix(cidrStr)
-			if err != nil {
-				slog.WarnContext(context.Background(), "error parsing OIDC connector CIDR prefix", "cidr", cidrStr, "err", err)
-				continue
-			}
-			if cidr.Contains(hostIP) {
-				return nil
-			}
-		}
-	}
-
-	if u.Scheme == "https" {
-		switch u.Port() {
-		default:
-			return trace.BadParameter("invalid port in client redirect URL")
-		case "", "443":
-		}
-
-		for _, expression := range settings.AllowedHttpsHostnames {
-			ok, err := utils.MatchString(u.Hostname(), expression)
-			if err != nil {
-				slog.WarnContext(context.Background(), "error compiling OIDC connector allowed HTTPS hostname regex", "regex", expression, "err", err)
-				continue
-			}
-			if ok {
-				return nil
-			}
-		}
+		ceremonyType = sso.CeremonyTypeTest
 	}
-
-	return trace.AccessDenied("%s", unknownRedirectHostnameErrMsg)
+	return sso.ValidateClientRedirect(clientRedirect, ceremonyType, settings)
 }
 
 // populateGithubClaims builds a GithubClaims using queried
diff --git a/lib/auth/github_test.go b/lib/auth/github_test.go
index abeba08850046..019615f35aeda 100644
--- a/lib/auth/github_test.go
+++ b/lib/auth/github_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"bytes"
@@ -38,7 +38,9 @@ import (
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend"
@@ -47,12 +49,14 @@ import (
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/loginrule"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type githubContext struct {
-	a           *Server
+	a           *auth.Server
 	mockEmitter *eventstest.MockRecorderEmitter
 	b           backend.Backend
 	c           *clockwork.FakeClock
@@ -79,18 +83,19 @@ func setupGithubContext(ctx context.Context, t *testing.T) *githubContext {
 		require.NoError(t, tt.b.Close())
 	})
 
-	authConfig := &InitConfig{
+	authConfig := &auth.InitConfig{
 		ClusterName:            clusterName,
 		Backend:                tt.b,
-		VersionStorage:         NewFakeTeleportVersion(),
+		VersionStorage:         authtest.NewFakeTeleportVersion(),
 		Authority:              authority.New(),
 		SkipPeriodicOperations: true,
+		HostUUID:               uuid.NewString(),
 	}
-	tt.a, err = NewServer(authConfig)
+	tt.a, err = auth.NewServer(authConfig)
 	require.NoError(t, err)
 
 	tt.mockEmitter = &eventstest.MockRecorderEmitter{}
-	tt.a.emitter = tt.mockEmitter
+	tt.a.SetEmitter(tt.mockEmitter)
 
 	return &tt
 }
@@ -108,7 +113,7 @@ func TestPopulateClaims(t *testing.T) {
 	teams, err := client.getTeams()
 	require.NoError(t, err)
 
-	claims, err := populateGithubClaims(user, teams)
+	claims, err := auth.PopulateGithubClaims(user, teams)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(claims, &types.GithubClaims{
 		Username: "octocat",
@@ -126,7 +131,7 @@ func TestCreateGithubUser(t *testing.T) {
 	tt := setupGithubContext(ctx, t)
 
 	// Dry-run creation of Github user.
-	user, err := tt.a.createGithubUser(ctx, &CreateUserParams{
+	user, err := tt.a.CreateGithubUser(ctx, &auth.CreateUserParams{
 		ConnectorName: "github",
 		Username:      "foo@example.com",
 		Roles:         []string{"admin"},
@@ -140,7 +145,7 @@ func TestCreateGithubUser(t *testing.T) {
 	require.Error(t, err)
 
 	// Create GitHub user with 1 minute expiry.
-	_, err = tt.a.createGithubUser(ctx, &CreateUserParams{
+	_, err = tt.a.CreateGithubUser(ctx, &auth.CreateUserParams{
 		ConnectorName: "github",
 		Username:      "foo",
 		Roles:         []string{"admin"},
@@ -160,26 +165,26 @@ func TestCreateGithubUser(t *testing.T) {
 
 type testGithubAPIClient struct{}
 
-func (c *testGithubAPIClient) getUser() (*GithubUserResponse, error) {
-	return &GithubUserResponse{Login: "octocat", ID: 1234567}, nil
+func (c *testGithubAPIClient) getUser() (*auth.GithubUserResponse, error) {
+	return &auth.GithubUserResponse{Login: "octocat", ID: 1234567}, nil
 }
 
-func (c *testGithubAPIClient) getTeams() ([]GithubTeamResponse, error) {
-	return []GithubTeamResponse{
+func (c *testGithubAPIClient) getTeams() ([]auth.GithubTeamResponse, error) {
+	return []auth.GithubTeamResponse{
 		{
 			Name: "team1",
 			Slug: "team1",
-			Org:  GithubOrgResponse{Login: "org1"},
+			Org:  auth.GithubOrgResponse{Login: "org1"},
 		},
 		{
 			Name: "team2",
 			Slug: "team2",
-			Org:  GithubOrgResponse{Login: "org1"},
+			Org:  auth.GithubOrgResponse{Login: "org1"},
 		},
 		{
 			Name: "team1",
 			Slug: "team1",
-			Org:  GithubOrgResponse{Login: "org2"},
+			Org:  auth.GithubOrgResponse{Login: "org2"},
 		},
 	}, nil
 }
@@ -188,9 +193,9 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 	clientAddr := &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0)}
 	ctx := authz.ContextWithClientSrcAddr(context.Background(), clientAddr)
 	tt := setupGithubContext(ctx, t)
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
-	auth := &authclient.GithubAuthResponse{
+	resp := &authclient.GithubAuthResponse{
 		Username: "test-name",
 	}
 
@@ -206,8 +211,8 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 		return nil
 	}
 
-	ssoDiagContextFixture := func(testFlow bool) *SSODiagContext {
-		diagCtx := NewSSODiagContext(types.KindGithub, SSODiagServiceFunc(createSSODiagnosticInfoStub))
+	ssoDiagContextFixture := func(testFlow bool) *auth.SSODiagContext {
+		diagCtx := auth.NewSSODiagContext(types.KindGithub, auth.SSODiagServiceFunc(createSSODiagnosticInfoStub))
 		diagCtx.RequestID = uuid.New().String()
 		diagCtx.Info.TestFlow = testFlow
 		return diagCtx
@@ -216,12 +221,12 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 
 	// Test success event, non-test-flow.
 	diagCtx := ssoDiagContextFixture(false /* testFlow */)
-	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 		diagCtx.Info.GithubClaims = claims
 		diagCtx.Info.AppliedLoginRules = []string{"login-rule"}
-		return auth, nil
+		return resp, nil
 	}
-	_, _ = validateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.emitter, logger)
+	_, _ = auth.ValidateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.GetEmitter(), logger)
 	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
 	require.Equal(t, events.UserSSOLoginCode, tt.mockEmitter.LastEvent().GetCode())
 	loginEvt := tt.mockEmitter.LastEvent().(*apievents.UserLogin)
@@ -232,11 +237,11 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 
 	// Test failure event, non-test-flow.
 	diagCtx = ssoDiagContextFixture(false /* testFlow */)
-	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 		diagCtx.Info.GithubClaims = claims
-		return auth, trace.BadParameter("")
+		return resp, trace.BadParameter("")
 	}
-	_, _ = validateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.emitter, logger)
+	_, _ = auth.ValidateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.GetEmitter(), logger)
 	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
 	require.Equal(t, events.UserSSOLoginFailureCode, tt.mockEmitter.LastEvent().GetCode())
 	loginEvt = tt.mockEmitter.LastEvent().(*apievents.UserLogin)
@@ -245,11 +250,11 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 
 	// Test success event, test-flow.
 	diagCtx = ssoDiagContextFixture(true /* testFlow */)
-	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 		diagCtx.Info.GithubClaims = claims
-		return auth, nil
+		return resp, nil
 	}
-	_, _ = validateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.emitter, logger)
+	_, _ = auth.ValidateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.GetEmitter(), logger)
 	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
 	require.Equal(t, events.UserSSOTestFlowLoginCode, tt.mockEmitter.LastEvent().GetCode())
 	loginEvt = tt.mockEmitter.LastEvent().(*apievents.UserLogin)
@@ -259,11 +264,11 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 
 	// Test failure event, test-flow.
 	diagCtx = ssoDiagContextFixture(true /* testFlow */)
-	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 		diagCtx.Info.GithubClaims = claims
-		return auth, trace.BadParameter("")
+		return resp, trace.BadParameter("")
 	}
-	_, _ = validateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.emitter, logger)
+	_, _ = auth.ValidateGithubAuthCallbackHelper(ctx, m, diagCtx, nil, tt.a.GetEmitter(), logger)
 	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
 	require.Equal(t, events.UserSSOTestFlowLoginFailureCode, tt.mockEmitter.LastEvent().GetCode())
 	loginEvt = tt.mockEmitter.LastEvent().(*apievents.UserLogin)
@@ -272,10 +277,10 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 }
 
 type mockedGithubManager struct {
-	mockValidateGithubAuthCallback func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error)
+	mockValidateGithubAuthCallback func(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error)
 }
 
-func (m *mockedGithubManager) validateGithubAuthCallback(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
+func (m *mockedGithubManager) ValidateGithubAuthRedirect(ctx context.Context, diagCtx *auth.SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
 	if m.mockValidateGithubAuthCallback != nil {
 		return m.mockValidateGithubAuthCallback(ctx, diagCtx, q)
 	}
@@ -285,7 +290,7 @@ func (m *mockedGithubManager) validateGithubAuthCallback(ctx context.Context, di
 
 func TestCalculateGithubUserNoTeams(t *testing.T) {
 	ctx := context.Background()
-	a := &Server{}
+	a := &auth.Server{}
 	connector, err := types.NewGithubConnector("github", types.GithubConnectorSpecV3{
 		TeamsToRoles: []types.TeamRolesMapping{
 			{
@@ -297,9 +302,9 @@ func TestCalculateGithubUserNoTeams(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	diagCtx := &SSODiagContext{}
+	diagCtx := &auth.SSODiagContext{}
 
-	_, err = a.calculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
+	_, err = a.CalculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
 		Username: "octocat",
 		OrganizationToTeams: map[string][]string{
 			"org1": {"team1", "team2"},
@@ -307,7 +312,7 @@ func TestCalculateGithubUserNoTeams(t *testing.T) {
 		},
 		Teams: []string{"team1", "team2", "team1"},
 	}, &types.GithubAuthRequest{})
-	require.ErrorIs(t, err, ErrGithubNoTeams)
+	require.ErrorIs(t, err, auth.ErrGithubNoTeams)
 }
 
 // Test that calculateGithubUser calls the login rule evaluator, evaluated
@@ -328,7 +333,7 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 			},
 		},
 	}
-	a := &Server{
+	a := &auth.Server{
 		Cache: &mockRoleCache{
 			roles: roles,
 		},
@@ -360,9 +365,9 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	diagCtx := &SSODiagContext{}
+	diagCtx := &auth.SSODiagContext{}
 
-	userParams, err := a.calculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
+	userParams, err := a.CalculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
 		Username: "octocat",
 		OrganizationToTeams: map[string][]string{
 			"org1": {"team1"},
@@ -371,7 +376,7 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 	}, &types.GithubAuthRequest{})
 	require.NoError(t, err)
 
-	require.Equal(t, &CreateUserParams{
+	require.Equal(t, &auth.CreateUserParams{
 		ConnectorName: "github",
 		Username:      "octocat",
 		KubeGroups:    evaluatedTraits[constants.TraitKubeGroups],
@@ -523,7 +528,7 @@ func TestCheckGithubOrgSSOSupport(t *testing.T) {
 			}
 
 			if tt.isEnterprise {
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestBuildType: modules.BuildEnterprise,
 				})
 			}
@@ -535,7 +540,7 @@ func TestCheckGithubOrgSSOSupport(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			err := checkGithubOrgSSOSupport(ctx, tt.connector, nil, orgCache, client)
+			err := auth.CheckGithubOrgSSOSupport(ctx, tt.connector, nil, orgCache, client)
 			if tt.errFunc == nil {
 				require.NoError(t, err)
 			} else {
@@ -570,7 +575,7 @@ func TestGithubURLFormat(t *testing.T) {
 	}
 
 	for _, tt := range tts {
-		require.Equal(t, tt.expect, formatGithubURL(tt.host, tt.path))
+		require.Equal(t, tt.expect, auth.FormatGithubURL(tt.host, tt.path))
 	}
 }
 
@@ -604,184 +609,9 @@ func TestBuildAPIEndpoint(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := buildAPIEndpoint(tt.input)
+			got, err := auth.BuildAPIEndpoint(tt.input)
 			require.NoError(t, err)
 			require.Equal(t, tt.expected, got)
 		})
 	}
 }
-
-func TestValidateClientRedirect(t *testing.T) {
-	t.Run("StandardLocalhost", func(t *testing.T) {
-		for _, goodURL := range []string{
-			"http://127.0.0.1/callback",
-			"http://127.0.0.1:1234/callback",
-			"http://[::1]/callback",
-			"http://[::1]:1234/callback",
-			"http://localhost/callback",
-			"http://localhost:1234/callback",
-		} {
-			const ssoTestFlowFalse = false
-			var defaultSettings *types.SSOClientRedirectSettings
-			require.NoError(t, ValidateClientRedirect(goodURL+"?secret_key=", ssoTestFlowFalse, defaultSettings))
-		}
-	})
-
-	t.Run("InvalidLocalhostLike", func(t *testing.T) {
-		for _, badURL := range []string{
-			"http://127.0.0.1:12345/notcallback",
-			"http://127a0.0.1/callback",
-			"http://127a0.0.1:1234/callback",
-			"http://::1/callback",
-			"http://notlocalhost/callback",
-			"http://sub.localhost/callback",
-			"http://localhost.com/callback",
-			"http://127.0.0.1.example.com/callback",
-			"http://[::1].example.com/callback",
-			"http://username@127.0.0.1:12345/callback",
-			"http://@localhost:12345/callback",
-			"http://localhost@example.com/callback",
-			"http://127.0.0.1:12345@example.com/callback",
-			"https://127.0.0.1:12345/callback",
-			"https://localhost:12345/callback",
-			"https://localhost/callback",
-			"ftp://localhost/callback",
-			"ftp://127.0.0.1/callback",
-			"ftp://[::1]/callback",
-		} {
-			const ssoTestFlowFalse = false
-			var defaultSettings *types.SSOClientRedirectSettings
-			require.Error(t, ValidateClientRedirect(badURL+"?secret_key=", ssoTestFlowFalse, defaultSettings))
-		}
-	})
-
-	t.Run("BadQuery", func(t *testing.T) {
-		for _, badURL := range []string{
-			"http://127.0.0.1:12345/callback",
-			"http://127.0.0.1:12345/callback?secret=a",
-			"http://127.0.0.1:12345/callback?secret_key=a&foo=b",
-		} {
-			const ssoTestFlowFalse = false
-			var defaultSettings *types.SSOClientRedirectSettings
-			require.Error(t, ValidateClientRedirect(badURL, ssoTestFlowFalse, defaultSettings))
-		}
-	})
-
-	t.Run("AllowedHttpsHostnames", func(t *testing.T) {
-		for _, goodURL := range []string{
-			"https://allowed.domain.invalid/callback",
-			"https://foo.allowed.with.subdomain.invalid/callback",
-			"https://but.no.subsubdomain.invalid/callback",
-		} {
-			const ssoTestFlowFalse = false
-			settings := &types.SSOClientRedirectSettings{
-				AllowedHttpsHostnames: []string{
-					"allowed.domain.invalid",
-					"*.allowed.with.subdomain.invalid",
-					"^[-a-zA-Z0-9]+.no.subsubdomain.invalid$",
-				},
-			}
-			require.NoError(t, ValidateClientRedirect(goodURL+"?secret_key=", ssoTestFlowFalse, settings))
-		}
-
-		for _, badURL := range []string{
-			"https://allowed.domain.invalid/notcallback",
-			"https://allowed.domain.invalid:12345/callback",
-			"http://allowed.domain.invalid/callback",
-			"https://not.allowed.domain.invalid/callback",
-			"https://allowed.with.subdomain.invalid/callback",
-			"https://i.said.no.subsubdomain.invalid/callback",
-		} {
-			const ssoTestFlowFalse = false
-			settings := &types.SSOClientRedirectSettings{
-				AllowedHttpsHostnames: []string{
-					"allowed.domain.invalid",
-					"*.allowed.with.subdomain.invalid",
-					"^[-a-zA-Z0-9]+.no.subsubdomain.invalid",
-				},
-			}
-			require.Error(t, ValidateClientRedirect(badURL+"?secret_key=", ssoTestFlowFalse, settings))
-		}
-	})
-
-	t.Run("InsecureAllowedCidrRanges", func(t *testing.T) {
-		for _, goodURL := range []string{
-			"http://192.168.0.27/callback",
-			"https://192.168.0.27/callback",
-			"http://192.168.0.27:1337/callback",
-			"https://192.168.0.27:1337/callback",
-			"http://[2001:db8::aaaa:bbbb]/callback",
-			"https://[2001:db8::aaaa:bbbb]/callback",
-			"http://[2001:db8::aaaa:bbbb]:1337/callback",
-			"https://[2001:db8::aaaa:bbbb]:1337/callback",
-			"http://[2001:db8::1]/callback",
-			"https://[2001:db8::1]/callback",
-			"http://[2001:db8::1]:1337/callback",
-			"https://[2001:db8::1]:1337/callback",
-		} {
-			const ssoTestFlowFalse = false
-			settings := &types.SSOClientRedirectSettings{
-				InsecureAllowedCidrRanges: []string{
-					"192.168.0.0/24",
-					"2001:db8::/96",
-				},
-			}
-			require.NoError(t, ValidateClientRedirect(goodURL+"?secret_key=", ssoTestFlowFalse, settings))
-		}
-
-		for _, badURL := range []string{
-			"http://192.168.1.1/callback",
-			"https://192.168.1.1/callback",
-			"http://192.168.1.1:80/callback",
-			"https://192.168.1.1:443/callback",
-			"http://[2001:db8::1:aaaa:bbbb]/callback",
-			"https://[2001:db8::1:aaaa:bbbb]/callback",
-			"http://[2001:db8::1:aaaa:bbbb]:80/callback",
-			"https://[2001:db8::1:aaaa:bbbb]:443/callback",
-			"http://[2001:db9::]/callback",
-			"https://[2001:db9::]/callback",
-			"http://not.an.ip/callback",
-			"https://not.an.ip/callback",
-			"http://192.168.0.27/nocallback",
-			"https://192.168.0.27/nocallback",
-			"http://[2001:db8::1]/notacallback",
-			"https://[2001:db8::1]/notacallback",
-		} {
-			const ssoTestFlowFalse = false
-			settings := &types.SSOClientRedirectSettings{
-				InsecureAllowedCidrRanges: []string{
-					"192.168.0.0/24",
-					"2001:db8::/96",
-				},
-			}
-			require.Error(t, ValidateClientRedirect(badURL+"?secret_key=", ssoTestFlowFalse, settings))
-		}
-	})
-
-	t.Run("SSOTestFlow", func(t *testing.T) {
-		for _, goodURL := range []string{
-			"http://127.0.0.1:12345/callback",
-		} {
-			const ssoTestFlowTrue = true
-			settings := &types.SSOClientRedirectSettings{
-				AllowedHttpsHostnames: []string{
-					"allowed.domain.invalid",
-				},
-			}
-			require.NoError(t, ValidateClientRedirect(goodURL+"?secret_key=", ssoTestFlowTrue, settings))
-		}
-
-		for _, badURL := range []string{
-			"https://allowed.domain.invalid/callback",
-			"http://allowed.domain.invalid/callback",
-		} {
-			const ssoTestFlowTrue = true
-			settings := &types.SSOClientRedirectSettings{
-				AllowedHttpsHostnames: []string{
-					"allowed.domain.invalid",
-				},
-			}
-			require.Error(t, ValidateClientRedirect(badURL+"?secret_key=", ssoTestFlowTrue, settings))
-		}
-	})
-}
diff --git a/lib/auth/gitserver/gitserverv1/github.go b/lib/auth/gitserver/gitserverv1/github.go
index 17aaa60436c67..66463b764da9e 100644
--- a/lib/auth/gitserver/gitserverv1/github.go
+++ b/lib/auth/gitserver/gitserverv1/github.go
@@ -124,7 +124,7 @@ func (s *Service) makeGithubConnectorSpec(ctx context.Context, uuid, org, integr
 	return &types.GithubConnectorSpecV3{
 		ClientID:       clientID,
 		ClientSecret:   clientSecret,
-		RedirectURL:    fmt.Sprintf("https://%s/v1/webapi/github/callback", s.cfg.ProxyPublicAddrGetter()),
+		RedirectURL:    fmt.Sprintf("https://%s/v1/webapi/github/callback", s.cfg.ProxyPublicAddrGetter(ctx)),
 		EndpointURL:    types.GithubURL,
 		APIEndpointURL: types.GithubAPIURL,
 		// TODO(greedy52) the GitHub OAuth flow for authenticated user does not
diff --git a/lib/auth/gitserver/gitserverv1/service.go b/lib/auth/gitserver/gitserverv1/service.go
index e263e7259f97f..795841dcb23a3 100644
--- a/lib/auth/gitserver/gitserverv1/service.go
+++ b/lib/auth/gitserver/gitserverv1/service.go
@@ -56,7 +56,7 @@ type Config struct {
 	// Log is the slog logger.
 	Log *slog.Logger
 	// ProxyPublicAddrGetter gets the public proxy address.
-	ProxyPublicAddrGetter func() string
+	ProxyPublicAddrGetter func(context.Context) string
 	// GitHubAuthRequestCreator is a callback to create the prepared request in
 	// the backend.
 	GitHubAuthRequestCreator GitHubAuthRequestCreator
diff --git a/lib/auth/gitserver/gitserverv1/service_test.go b/lib/auth/gitserver/gitserverv1/service_test.go
index 96db35882cb77..e0ba093ecbb32 100644
--- a/lib/auth/gitserver/gitserverv1/service_test.go
+++ b/lib/auth/gitserver/gitserverv1/service_test.go
@@ -345,7 +345,7 @@ func newService(t *testing.T, checker services.AccessChecker, existing ...*types
 		Backend: testBackend{
 			GitServers: gitServersService,
 		},
-		ProxyPublicAddrGetter: func() string {
+		ProxyPublicAddrGetter: func(context.Context) string {
 			return fakeProxyAddr
 		},
 		GitHubAuthRequestCreator: func(_ context.Context, req types.GithubAuthRequest) (*types.GithubAuthRequest, error) {
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 0a055838d6b11..5119e418194ba 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -24,16 +24,20 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"iter"
 	"log/slog"
 	"net"
 	"os"
+	goslices "slices"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/coreos/go-semver/semver"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	collectortracepb "go.opentelemetry.io/proto/otlp/collector/trace/v1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -60,7 +64,6 @@ import (
 	dynamicwindowsv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/dynamicwindows/v1"
 	gitserverv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1"
 	healthcheckconfigv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
-	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	integrationv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	kubewaitingcontainerv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	loginrulev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
@@ -68,9 +71,13 @@ import (
 	mfav1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	notificationsv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
 	presencev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
-	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingencryptionv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	recordingmetadatav1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopedjoiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
 	secreportsv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
 	stableunixusersv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/stableunixusers/v1"
+	summarizerv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
 	trustv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	userloginstatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userloginstate/v1"
 	userprovisioningv2pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
@@ -83,6 +90,7 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/installers"
 	"github.com/gravitational/teleport/api/types/wrappers"
@@ -105,8 +113,13 @@ import (
 	"github.com/gravitational/teleport/lib/auth/machineid/workloadidentityv1"
 	"github.com/gravitational/teleport/lib/auth/notifications/notificationsv1"
 	"github.com/gravitational/teleport/lib/auth/presence/presencev1"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption/recordingencryptionv1"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata/recordingmetadatav1"
+	scopedaccess "github.com/gravitational/teleport/lib/auth/scopes/access"
+	scopedjoining "github.com/gravitational/teleport/lib/auth/scopes/joining"
 	"github.com/gravitational/teleport/lib/auth/secreports/secreportsv1"
 	"github.com/gravitational/teleport/lib/auth/stableunixusers"
+	"github.com/gravitational/teleport/lib/auth/summarizer/summarizerv1"
 	"github.com/gravitational/teleport/lib/auth/trust/trustv1"
 	"github.com/gravitational/teleport/lib/auth/userloginstate/userloginstatev1"
 	"github.com/gravitational/teleport/lib/auth/userpreferences/userpreferencesv1"
@@ -120,16 +133,21 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/joinserver"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/join"
+	"github.com/gravitational/teleport/lib/join/joinv1"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv/server/installer"
 	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/slices"
 )
 
 var (
@@ -249,6 +267,7 @@ var connectedResourceGauges = map[string]prometheus.Gauge{
 	constants.KeepAliveDatabase:              connectedResources.WithLabelValues(constants.KeepAliveDatabase),
 	constants.KeepAliveDatabaseService:       connectedResources.WithLabelValues(constants.KeepAliveDatabaseService),
 	constants.KeepAliveWindowsDesktopService: connectedResources.WithLabelValues(constants.KeepAliveWindowsDesktopService),
+	teleport.ComponentRelay:                  connectedResources.WithLabelValues(teleport.ComponentRelay),
 }
 
 // SendKeepAlives allows node to send a stream of keep alive requests
@@ -567,6 +586,13 @@ func WatchEvents(watch *authpb.Watch, stream WatchEvent, componentName string, a
 			}
 			event.Resource = downgraded
 		}
+		if dc, ok := event.Resource.(*discoveryconfig.DiscoveryConfig); ok {
+			downgraded, err := discoveryconfigv1.MaybeDowngradeDiscoveryConfig(stream.Context(), dc)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			event.Resource = downgraded
+		}
 		out, err := client.EventToGRPC(event)
 		if err != nil {
 			return trace.Wrap(err)
@@ -880,6 +906,14 @@ func (g *GRPCServer) GetInstances(filter *types.InstanceFilter, stream authpb.Au
 func (g *GRPCServer) GetClusterAlerts(ctx context.Context, query *types.GetClusterAlertsRequest) (*authpb.GetClusterAlertsResponse, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
+		if errors.Is(err, services.ErrScopedIdentity) {
+			// NOTE: scoped alerts do not currently exist. a lot of client logic wants to incidentally load cluster alerts
+			// as part of other operations. ordinarily we just return an access denied when a scoped identity is used to
+			// call an API that doesn't support scoping yet, but doing so here would complicate client logic a lot. it is
+			// therefore preferable to instead consider a scoped invocation a valid call that just happens to not match
+			// any alerts.
+			return &authpb.GetClusterAlertsResponse{}, nil
+		}
 		return nil, trail.ToGRPC(err)
 	}
 
@@ -1132,6 +1166,18 @@ func (g *GRPCServer) GetAccessCapabilities(ctx context.Context, req *types.Acces
 	return caps, nil
 }
 
+func (g *GRPCServer) GetRemoteAccessCapabilities(ctx context.Context, req *types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caps, err := auth.ServerWithRoles.GetRemoteAccessCapabilities(ctx, *req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return caps, nil
+}
+
 func (g *GRPCServer) CreateResetPasswordToken(ctx context.Context, req *authpb.CreateResetPasswordTokenRequest) (*types.UserTokenV3, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
@@ -1185,6 +1231,29 @@ func (g *GRPCServer) GetResetPasswordToken(ctx context.Context, req *authpb.GetR
 	return r, nil
 }
 
+func (g *GRPCServer) ListResetPasswordTokens(ctx context.Context, req *authpb.ListResetPasswordTokenRequest) (*authpb.ListResetPasswordTokenResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ts, nextToken, err := auth.ServerWithRoles.ListResetPasswordTokens(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	userTokensV3 := make([]*types.UserTokenV3, len(ts))
+	for i, t := range ts {
+		var ok bool
+		if userTokensV3[i], ok = t.(*types.UserTokenV3); !ok {
+			return nil, trace.Errorf("encountered unexpected token type: %T", t)
+		}
+	}
+	return &authpb.ListResetPasswordTokenResponse{
+		UserTokens:    userTokensV3,
+		NextPageToken: nextToken,
+	}, nil
+}
+
 // GetPluginData loads all plugin data matching the supplied filter.
 func (g *GRPCServer) GetPluginData(ctx context.Context, filter *types.PluginDataFilter) (*authpb.PluginDataSeq, error) {
 	// TODO(fspmarshall): Implement rate-limiting to prevent misbehaving plugins from
@@ -1226,7 +1295,7 @@ func (g *GRPCServer) UpdatePluginData(ctx context.Context, params *types.PluginD
 }
 
 func (g *GRPCServer) Ping(ctx context.Context, req *authpb.PingRequest) (*authpb.PingResponse, error) {
-	auth, err := g.authenticate(ctx)
+	auth, err := g.scopedAuthenticate(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1301,6 +1370,34 @@ func (g *GRPCServer) GetSemaphores(ctx context.Context, req *types.SemaphoreFilt
 	}, nil
 }
 
+// ListSemaphores returns a page of semaphores matching supplied filter.
+func (g *GRPCServer) ListSemaphores(ctx context.Context, req *authpb.ListSemaphoresRequest) (*authpb.ListSemaphoresResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	semaphores, next, err := auth.ListSemaphores(ctx, int(req.GetPageSize()), req.GetPageToken(), req.GetFilter())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListSemaphoresResponse{
+		Semaphores:    make([]*types.SemaphoreV3, 0, len(semaphores)),
+		NextPageToken: next,
+	}
+
+	for _, sem := range semaphores {
+		v3, ok := sem.(*types.SemaphoreV3)
+		if !ok {
+			return nil, trace.BadParameter("unexpected semaphore type: %T", sem)
+		}
+		resp.Semaphores = append(resp.Semaphores, v3)
+	}
+
+	return resp, nil
+}
+
 // DeleteSemaphore deletes a semaphore matching the supplied filter.
 func (g *GRPCServer) DeleteSemaphore(ctx context.Context, req *types.SemaphoreFilter) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -1455,6 +1552,10 @@ func (g *GRPCServer) UpsertApplicationServer(ctx context.Context, req *authpb.Up
 		}
 	}
 
+	if err := services.ValidateApp(app, auth); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	keepAlive, err := auth.UpsertApplicationServer(ctx, server)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1580,6 +1681,34 @@ func (g *GRPCServer) GetSnowflakeSessions(ctx context.Context, e *emptypb.Empty)
 	}, nil
 }
 
+// ListSnowflakeSessions returns a page of Snowflake sessions.
+func (g *GRPCServer) ListSnowflakeSessions(ctx context.Context, req *authpb.ListSnowflakeSessionsRequest) (*authpb.ListSnowflakeSessionsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sessions, next, err := auth.ListSnowflakeSessions(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListSnowflakeSessionsResponse{
+		Sessions:      make([]*types.WebSessionV2, 0, len(sessions)),
+		NextPageToken: next,
+	}
+
+	for _, session := range sessions {
+		webessionV2, ok := session.(*types.WebSessionV2)
+		if !ok {
+			return nil, trace.BadParameter("unsupported web session type %T", session)
+		}
+		resp.Sessions = append(resp.Sessions, webessionV2)
+	}
+
+	return resp, nil
+}
+
 func (g *GRPCServer) DeleteSnowflakeSession(ctx context.Context, req *authpb.DeleteSnowflakeSessionRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
@@ -1833,7 +1962,7 @@ func (g *GRPCServer) GetWebToken(ctx context.Context, req *types.GetWebTokenRequ
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := auth.WebTokens().Get(ctx, *req)
+	resp, err := auth.GetWebToken(ctx, *req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1854,7 +1983,7 @@ func (g *GRPCServer) GetWebTokens(ctx context.Context, _ *emptypb.Empty) (*authp
 		return nil, trace.Wrap(err)
 	}
 
-	tokens, err := auth.WebTokens().List(ctx)
+	tokens, err := auth.GetWebTokens(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1873,6 +2002,34 @@ func (g *GRPCServer) GetWebTokens(ctx context.Context, _ *emptypb.Empty) (*authp
 	}, nil
 }
 
+// ListWebTokens returns a page of web tokens
+func (g *GRPCServer) ListWebTokens(ctx context.Context, req *authpb.ListWebTokensRequest) (*authpb.ListWebTokensResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tokens, next, err := auth.ListWebTokens(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListWebTokensResponse{
+		Tokens:        make([]*types.WebTokenV3, 0, len(tokens)),
+		NextPageToken: next,
+	}
+
+	for _, t := range tokens {
+		tokenV3, ok := t.(*types.WebTokenV3)
+		if !ok {
+			return nil, trace.BadParameter("unexpected type %T", t)
+		}
+		resp.Tokens = append(resp.Tokens, tokenV3)
+	}
+
+	return resp, nil
+}
+
 // DeleteWebToken removes the web token given with req.
 func (g *GRPCServer) DeleteWebToken(ctx context.Context, req *types.DeleteWebTokenRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -1880,7 +2037,7 @@ func (g *GRPCServer) DeleteWebToken(ctx context.Context, req *types.DeleteWebTok
 		return nil, trace.Wrap(err)
 	}
 
-	if err := auth.WebTokens().Delete(ctx, *req); err != nil {
+	if err := auth.DeleteWebToken(ctx, *req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -1894,7 +2051,7 @@ func (g *GRPCServer) DeleteAllWebTokens(ctx context.Context, _ *emptypb.Empty) (
 		return nil, trace.Wrap(err)
 	}
 
-	if err := auth.WebTokens().DeleteAll(ctx); err != nil {
+	if err := auth.DeleteAllWebTokens(ctx); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2021,48 +2178,75 @@ func downgradeSAMLIdPRBAC(downgradedRole *types.RoleV6) *types.RoleV6 {
 	return downgradedRole
 }
 
-func maybeDowngradeRoleK8sAPIGroupToV7(role *types.RoleV6) *types.RoleV6 {
-	downgrade := func(resources []types.KubernetesResource) ([]types.KubernetesResource, bool) {
-		var out []types.KubernetesResource
-		for _, elem := range resources {
-			// If group is '*', simply remove it as the behavior in v7 would be the same.
-			if elem.APIGroup == types.Wildcard {
-				elem.APIGroup = ""
-			}
-
-			// If Kind is known in v7 and group is known, remove it the api group and keep the resource.
-			if v, ok := defaultRBACResources[allowedResourcesKey{elem.APIGroup, elem.Kind}]; ok {
-				elem.APIGroup = ""
-				elem.Kind = v
-				out = append(out, elem)
-				continue
-			}
+func downgradeKubeResources[T types.KubeResource](role *types.RoleV6, resources []T) []T {
+	var out []T
+	for _, elem := range resources {
+		apiGroup, kind, namespace := elem.GetAPIGroup(), elem.GetKind(), elem.GetNamespace()
+		// If group is '*', simply remove it as the behavior in v7 would be the same.
+		if apiGroup == types.Wildcard {
+			elem.SetAPIGroup("")
+			apiGroup = ""
+		}
+		// If we have a wildcard kind, only keep it if the namespace is also a wildcard.
+		if kind == types.Wildcard && namespace == types.Wildcard && apiGroup == "" {
+			out = append(out, elem)
+			continue
+		}
+		// If Kind is known in v7 and group is known, remove it.
+		if v, ok := defaultRBACResources[allowedResourcesKey{apiGroup, kind}]; ok {
+			elem.SetAPIGroup("")
+			elem.SetKind(v)
+			out = append(out, elem)
+			continue
+		}
 
-			// If we reach this point, we are dealing with a resource we don't know about or a wildcard
-			// As the scope of permissions granted differs, deny everything.
-			role.Spec.Allow.KubernetesResources = nil
-			role.Spec.Deny.KubernetesLabels = types.Labels{
-				types.Wildcard: {types.Wildcard},
-			}
-			role.Spec.Deny.KubernetesResources = []types.KubernetesResource{
-				{
-					Kind:      types.Wildcard,
-					Name:      types.Wildcard,
-					Namespace: types.Wildcard,
-					Verbs:     []string{types.Wildcard},
-				},
-			}
-			return nil, false
+		// If we reach this point, we are dealing with a resource we don't know about or a wildcard
+		// As the scope of permissions granted differs, deny everything.
+		role.Spec.Allow.KubernetesResources = nil
+		role.Spec.Deny.KubernetesLabels = types.Labels{
+			types.Wildcard: {types.Wildcard},
 		}
-		return out, true
+		role.Spec.Deny.KubernetesResources = []types.KubernetesResource{
+			{
+				Kind:      types.Wildcard,
+				Name:      types.Wildcard,
+				Namespace: types.Wildcard,
+				Verbs:     []string{types.Wildcard},
+			},
+		}
+		return nil
 	}
+	return out
+}
 
-	var ok bool
-	role.Spec.Allow.KubernetesResources, ok = downgrade(role.Spec.Allow.KubernetesResources)
-	if !ok {
-		return role
+// maybeDowngradeRoleK8sAPIGroupToV7 downgrades the role to kubernetes resources to role v7 if the client
+// is below the minimum supported version.
+//
+// If there is an unsupported resource, clear them and inject deny all at the label level as well as setting the resource to be a wildcard deny.
+//
+// In the case of access requests, if there is a deny, also inject a wildcard deny in the request level.
+func maybeDowngradeRoleK8sAPIGroupToV7(role *types.RoleV6) *types.RoleV6 {
+	role.Spec.Allow.KubernetesResources = slices.FromPointers(downgradeKubeResources(role, slices.ToPointers(role.Spec.Allow.KubernetesResources)))
+	role.Spec.Deny.KubernetesResources = slices.FromPointers(downgradeKubeResources(role, slices.ToPointers(role.Spec.Deny.KubernetesResources)))
+
+	// NOTE: Make sure to handle access request deny before the allow.
+	if role.Spec.Deny.Request != nil && len(role.Spec.Deny.Request.KubernetesResources) > 0 {
+		role.Spec.Deny.Request.KubernetesResources = slices.FromPointers(downgradeKubeResources(role, slices.ToPointers(role.Spec.Deny.Request.KubernetesResources)))
+		// If we cleared the Deny, inject a wildcard.
+		if len(role.Spec.Deny.Request.KubernetesResources) == 0 {
+			role.Spec.Deny.Request.KubernetesResources = []types.RequestKubernetesResource{{Kind: types.Wildcard}}
+		}
+	}
+	if role.Spec.Allow.Request != nil && len(role.Spec.Allow.Request.KubernetesResources) > 0 {
+		role.Spec.Allow.Request.KubernetesResources = slices.FromPointers(downgradeKubeResources(role, slices.ToPointers(role.Spec.Allow.Request.KubernetesResources)))
+		// If we cleared out the Allow, inject a wildcard in Deny.
+		if len(role.Spec.Allow.Request.KubernetesResources) == 0 {
+			if role.Spec.Deny.Request == nil {
+				role.Spec.Deny.Request = &types.AccessRequestConditions{}
+			}
+			role.Spec.Deny.Request.KubernetesResources = append(role.Spec.Deny.Request.KubernetesResources, types.RequestKubernetesResource{Kind: types.Wildcard})
+		}
 	}
-	role.Spec.Deny.KubernetesResources, _ = downgrade(role.Spec.Deny.KubernetesResources)
 
 	return role
 }
@@ -2224,6 +2408,21 @@ func (g *GRPCServer) ListRoles(ctx context.Context, req *authpb.ListRolesRequest
 	return rsp, nil
 }
 
+// ListRequestableRoles is a paginated requestable role getter.
+func (g *GRPCServer) ListRequestableRoles(ctx context.Context, req *authpb.ListRequestableRolesRequest) (*authpb.ListRequestableRolesResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rsp, err := auth.ServerWithRoles.ListRequestableRoles(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return rsp, nil
+}
+
 // CreateRole creates a new role.
 func (g *GRPCServer) CreateRole(ctx context.Context, req *authpb.CreateRoleRequest) (*types.RoleV6, error) {
 	auth, err := g.authenticate(ctx)
@@ -2400,12 +2599,28 @@ func doMFAPresenceChallenge(ctx context.Context, actx *grpcContext, stream authp
 		return trace.Wrap(err)
 	}
 
-	err = actx.authServer.UpdatePresence(ctx, challengeReq.SessionID, user)
-	if err != nil {
-		return trace.Wrap(err)
+	// We must use the real username associated with the identity.
+	// GetUser() can be remote-{user}-{cluster} if we are using
+	// a leaf cluster.
+	realUsername := actx.Identity.GetIdentity().Username
+	originCluster := actx.Identity.GetIdentity().OriginClusterName
+	origErr := actx.authServer.UpdatePresence(ctx, challengeReq.SessionID, realUsername, originCluster)
+	switch {
+	case trace.IsNotFound(origErr):
+		// If the user was not found, it may be because the session tracker
+		// was created with the .GetUser() value (remote-{user}-{cluster}).
+		// Try again with that username as a fallback.
+		// TODO(tigrato): DELETE IN 20.0.0
+		if fallbackErr := actx.authServer.UpdatePresence(ctx, challengeReq.SessionID, user, originCluster); fallbackErr != nil {
+			// Return the original error, as that is more relevant to the client.
+			return trace.Wrap(origErr)
+		}
+		return nil
+	case origErr != nil:
+		return trace.Wrap(origErr)
+	default:
+		return nil
 	}
-
-	return nil
 }
 
 // MaintainSessionPresence establishes a channel used to continuously verify the presence for a session.
@@ -2497,11 +2712,10 @@ func (g *GRPCServer) GenerateUserSingleUseCerts(stream authpb.AuthService_Genera
 }
 
 func setUserSingleUseCertsTTL(actx *grpcContext, req *authpb.UserCertsRequest) {
-	if isLocalProxyCertReq(req) {
-		// don't limit the cert expiry to 1 minute for db local proxy tunnel or kube local proxy,
-		// because the certs will be kept in-memory by the client to protect
-		// against cert/key exfiltration. When MFA is required, cert expiration
-		// time is bounded by the lifetime of the local proxy process or the mfa verification interval.
+	if !isCertWrittenToDiskFlow(req) {
+		// Don't limit the cert expiry to 1 minute for certs that are not written to disk.
+		// When MFA is required, cert expiration time is bounded by the lifetime of the local proxy process
+		// or the mfa verification interval.
 		return
 	}
 
@@ -2511,8 +2725,11 @@ func setUserSingleUseCertsTTL(actx *grpcContext, req *authpb.UserCertsRequest) {
 	}
 }
 
-// isLocalProxyCertReq returns whether a cert request is for a local proxy cert.
-func isLocalProxyCertReq(req *authpb.UserCertsRequest) bool {
+// isInMemoryCertRequest returns whether a cert request is for a flow where the certificate is kept in-memory by the client.
+// The certificate should not be exposed through disk, stdout, a socket, etc.
+// For those scenarios, we can issue certs with longer TTLs even when they are single-use certs.
+// This is the case for cert requests made by tsh db/kube/app local proxy.
+func isInMemoryCertRequest(req *authpb.UserCertsRequest) bool {
 	return (req.Usage == authpb.UserCertsRequest_Database &&
 		req.RequesterName == authpb.UserCertsRequest_TSH_DB_LOCAL_PROXY_TUNNEL) ||
 		(req.Usage == authpb.UserCertsRequest_Kubernetes &&
@@ -2521,6 +2738,20 @@ func isLocalProxyCertReq(req *authpb.UserCertsRequest) bool {
 			req.RequesterName == authpb.UserCertsRequest_TSH_APP_LOCAL_PROXY)
 }
 
+// isCredentialsStdoutCertRequest returns whether a cert request is for a flow where the credentials are not written to disk, but are sent to stdout.
+// For those scenarios, we can issue certs with longer TTLs even when they are single-use certs.
+// This is the case for cert requests made by tsh for an AWS App access which writes the credentials to stdout.
+// Note: this is different from isInMemoryCertRequest because the credentials are written to stdout instead of being kept in-memory.
+func isCredentialsStdoutCertRequest(req *authpb.UserCertsRequest) bool {
+	return req.Usage == authpb.UserCertsRequest_App && req.RequesterName == authpb.UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS
+}
+
+// isCertWrittenToDiskFlow returns whether a cert request is for a flow where the certificate is written to disk.
+// For those scenarios, we need to limit the cert TTL to avoid long-lived single-use certs.
+func isCertWrittenToDiskFlow(req *authpb.UserCertsRequest) bool {
+	return !isInMemoryCertRequest(req) && !isCredentialsStdoutCertRequest(req)
+}
+
 func userSingleUseCertsGenerate(ctx context.Context, actx *grpcContext, req authpb.UserCertsRequest) (*authpb.Certs, error) {
 	// Get the client IP.
 	clientPeer, ok := peer.FromContext(ctx)
@@ -2611,6 +2842,31 @@ func (g *GRPCServer) GetOIDCConnectors(ctx context.Context, req *types.Resources
 	}, nil
 }
 
+// ListOIDCConnectors returns a page of valid registered connectors.
+func (g *GRPCServer) ListOIDCConnectors(ctx context.Context, req *authpb.ListOIDCConnectorsRequest) (*authpb.ListOIDCConnectorsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	ocs, next, err := auth.ServerWithRoles.ListOIDCConnectors(ctx, int(req.PageSize), req.PageToken, req.WithSecrets)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	connectors := make([]*types.OIDCConnectorV3, len(ocs))
+	for i, oc := range ocs {
+		var ok bool
+		if connectors[i], ok = oc.(*types.OIDCConnectorV3); !ok {
+			return nil, trace.Errorf("encountered unexpected OIDC connector type %T", oc)
+		}
+	}
+
+	return &authpb.ListOIDCConnectorsResponse{
+		Connectors:    connectors,
+		NextPageToken: next,
+	}, nil
+}
+
 // CreateOIDCConnector creates a new OIDC connector.
 func (g *GRPCServer) CreateOIDCConnector(ctx context.Context, req *authpb.CreateOIDCConnectorRequest) (*types.OIDCConnectorV3, error) {
 	auth, err := g.authenticate(ctx)
@@ -2755,6 +3011,40 @@ func (g *GRPCServer) GetSAMLConnectors(ctx context.Context, req *types.Resources
 	}, nil
 }
 
+// ListSAMLConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (g *GRPCServer) ListSAMLConnectors(ctx context.Context, req *authpb.ListSAMLConnectorsRequest) (*authpb.ListSAMLConnectorsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	scs, next, err := auth.ServerWithRoles.ListSAMLConnectorsWithOptions(
+		ctx,
+		int(req.PageSize),
+		req.PageToken,
+		req.WithSecrets,
+		types.SAMLConnectorValidationFollowURLs(!req.NoFollowUrls),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListSAMLConnectorsResponse{
+		NextPageToken: next,
+		Connectors:    make([]*types.SAMLConnectorV2, 0, len(scs)),
+	}
+	for _, sc := range scs {
+		scpb, ok := sc.(*types.SAMLConnectorV2)
+		if !ok {
+			return nil, trace.Errorf("encountered unexpected SAML connector type: %T", sc)
+		}
+		resp.Connectors = append(resp.Connectors, scpb)
+	}
+
+	return resp, nil
+}
+
 // CreateSAMLConnector creates a new SAML connector.
 func (g *GRPCServer) CreateSAMLConnector(ctx context.Context, req *authpb.CreateSAMLConnectorRequest) (*types.SAMLConnectorV2, error) {
 	auth, err := g.authenticate(ctx)
@@ -2901,6 +3191,33 @@ func (g *GRPCServer) GetGithubConnectors(ctx context.Context, req *types.Resourc
 	}, nil
 }
 
+// ListGithubConnectors returns a page of valid registered Github connectors.
+func (g *GRPCServer) ListGithubConnectors(ctx context.Context, req *authpb.ListGithubConnectorsRequest) (*authpb.ListGithubConnectorsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	connectors, next, err := auth.ServerWithRoles.ListGithubConnectors(ctx, int(req.PageSize), req.PageToken, req.WithSecrets)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListGithubConnectorsResponse{
+		Connectors:    make([]*types.GithubConnectorV3, 0, len(connectors)),
+		NextPageToken: next,
+	}
+
+	for _, connector := range connectors {
+		if v3, ok := connector.(*types.GithubConnectorV3); ok {
+			resp.Connectors = append(resp.Connectors, v3)
+		} else {
+			return nil, trace.Errorf("encountered unexpected Github connector type %T", connector)
+		}
+	}
+
+	return resp, nil
+}
+
 // UpsertGithubConnectorV2 creates a new or replaces an existing Github connector.
 func (g *GRPCServer) UpsertGithubConnectorV2(ctx context.Context, req *authpb.UpsertGithubConnectorRequest) (*types.GithubConnectorV3, error) {
 	auth, err := g.authenticate(ctx)
@@ -3194,6 +3511,8 @@ func (g *GRPCServer) GetToken(ctx context.Context, req *types.ResourceRequest) (
 }
 
 // GetTokens retrieves all tokens.
+// Deprecated: Use [ListProvisionTokens], [GetStaticTokens], and [ListResetPasswordTokens] instead.
+// TODO(hugoShaka): DELETE IN 21.0.0
 func (g *GRPCServer) GetTokens(ctx context.Context, _ *emptypb.Empty) (*types.ProvisionTokenV2List, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
@@ -3215,6 +3534,53 @@ func (g *GRPCServer) GetTokens(ctx context.Context, _ *emptypb.Empty) (*types.Pr
 	}, nil
 }
 
+// GetStaticTokens returns the static tokens.
+func (g *GRPCServer) GetStaticTokens(ctx context.Context, _ *emptypb.Empty) (*types.StaticTokensV2, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	st, err := auth.ServerWithRoles.GetStaticTokens(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	result, ok := st.(*types.StaticTokensV2)
+	if !ok {
+		return nil, trace.Errorf("encountered unexpected static token type: %T", st)
+	}
+	return result, nil
+}
+
+// ListProvisionTokens retrieves a paginated list of provision tokens.
+func (g *GRPCServer) ListProvisionTokens(ctx context.Context, req *authpb.ListProvisionTokensRequest) (*authpb.ListProvisionTokensResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	roles, err := types.NewTeleportRoles(req.FilterRoles)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ts, nextKey, err := auth.ServerWithRoles.ListProvisionTokens(ctx, int(req.Limit), req.StartKey, roles, req.FilterBotName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	provisionTokensV2 := make([]*types.ProvisionTokenV2, len(ts))
+	for i, t := range ts {
+		var ok bool
+		if provisionTokensV2[i], ok = t.(*types.ProvisionTokenV2); !ok {
+			return nil, trace.Errorf("encountered unexpected token type: %T", t)
+		}
+	}
+	return &authpb.ListProvisionTokensResponse{
+		Tokens:  provisionTokensV2,
+		NextKey: nextKey,
+	}, nil
+}
+
 // UpsertTokenV2 upserts a token.
 func (g *GRPCServer) UpsertTokenV2(ctx context.Context, req *authpb.UpsertTokenV2Request) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -3269,6 +3635,60 @@ func (g *GRPCServer) DeleteToken(ctx context.Context, req *types.ResourceRequest
 	return &emptypb.Empty{}, nil
 }
 
+// ListAuthServers returns a paginated list of auth servers.
+func (g *GRPCServer) ListAuthServers(ctx context.Context, req *presencev1pb.ListAuthServersRequest) (*presencev1pb.ListAuthServersResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	servers, next, err := auth.ListAuthServers(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	serverV2s := make([]*types.ServerV2, 0, len(servers))
+	for _, server := range servers {
+		srv, ok := server.(*types.ServerV2)
+		if !ok {
+			return nil, trace.Errorf("encountered unexpected server type: %T", server)
+		}
+		serverV2s = append(serverV2s, srv)
+	}
+
+	return &presencev1pb.ListAuthServersResponse{
+		Servers:       serverV2s,
+		NextPageToken: next,
+	}, nil
+}
+
+// ListProxyServers returns a paginated list of proxy servers.
+func (g *GRPCServer) ListProxyServers(ctx context.Context, req *presencev1pb.ListProxyServersRequest) (*presencev1pb.ListProxyServersResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	servers, next, err := auth.ListProxyServers(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	serverV2s := make([]*types.ServerV2, 0, len(servers))
+	for _, server := range servers {
+		srv, ok := server.(*types.ServerV2)
+		if !ok {
+			return nil, trace.Errorf("encountered unexpected server type: %T", server)
+		}
+		serverV2s = append(serverV2s, srv)
+	}
+
+	return &presencev1pb.ListProxyServersResponse{
+		Servers:       serverV2s,
+		NextPageToken: next,
+	}, nil
+}
+
 // GetNode retrieves a node by name and namespace.
 func (g *GRPCServer) GetNode(ctx context.Context, req *types.ResourceInNamespaceRequest) (*types.ServerV2, error) {
 	if req.Namespace == "" {
@@ -3672,6 +4092,39 @@ func (g *GRPCServer) GetLocks(ctx context.Context, req *authpb.GetLocksRequest)
 	}, nil
 }
 
+// ListLocks returns a page of locks matching a filter
+func (g *GRPCServer) ListLocks(ctx context.Context, req *authpb.ListLocksRequest) (*authpb.ListLocksResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	locks, next, err := auth.ListLocks(
+		ctx,
+		int(req.PageSize),
+		req.PageToken,
+		req.Filter,
+	)
+
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	lockV2s := make([]*types.LockV2, 0, len(locks))
+	for _, lock := range locks {
+		lockV2, ok := lock.(*types.LockV2)
+		if !ok {
+			return nil, trace.BadParameter("unexpected lock type %T", lock)
+		}
+		lockV2s = append(lockV2s, lockV2)
+	}
+
+	return &authpb.ListLocksResponse{
+		Locks:         lockV2s,
+		NextPageToken: next,
+	}, nil
+}
+
 // UpsertLock upserts a lock.
 func (g *GRPCServer) UpsertLock(ctx context.Context, lock *types.LockV2) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -3721,6 +4174,9 @@ func (g *GRPCServer) CreateApp(ctx context.Context, app *types.AppV3) (*emptypb.
 	if app.Origin() == "" {
 		app.SetOrigin(types.OriginDynamic)
 	}
+	if err := services.ValidateApp(app, auth); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	if err := auth.CreateApp(ctx, app); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3736,6 +4192,9 @@ func (g *GRPCServer) UpdateApp(ctx context.Context, app *types.AppV3) (*emptypb.
 	if app.Origin() == "" {
 		app.SetOrigin(types.OriginDynamic)
 	}
+	if err := services.ValidateApp(app, auth); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	if err := auth.UpdateApp(ctx, app); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3782,6 +4241,32 @@ func (g *GRPCServer) GetApps(ctx context.Context, _ *emptypb.Empty) (*types.AppV
 	}, nil
 }
 
+// ListApps returns a page of application resources.
+func (g *GRPCServer) ListApps(ctx context.Context, req *authpb.ListAppsRequest) (*authpb.ListAppsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	apps, next, err := auth.ListApps(ctx, int(req.Limit), req.StartKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListAppsResponse{
+		Applications: make([]*types.AppV3, 0, len(apps)),
+		NextKey:      next,
+	}
+
+	for _, app := range apps {
+		appV3, ok := app.(*types.AppV3)
+		if !ok {
+			return nil, trace.BadParameter("unsupported application type %T", app)
+		}
+		resp.Applications = append(resp.Applications, appV3)
+	}
+	return resp, nil
+}
+
 // DeleteApp removes the specified application resource.
 func (g *GRPCServer) DeleteApp(ctx context.Context, req *types.ResourceRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -3882,6 +4367,34 @@ func (g *GRPCServer) GetDatabases(ctx context.Context, _ *emptypb.Empty) (*types
 	}, nil
 }
 
+// ListDatabases returns a page of database resources.
+func (g *GRPCServer) ListDatabases(ctx context.Context, req *authpb.ListDatabasesRequest) (*authpb.ListDatabasesResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	databases, next, err := auth.ListDatabases(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListDatabasesResponse{
+		Databases:     make([]*types.DatabaseV3, 0, len(databases)),
+		NextPageToken: next,
+	}
+
+	for _, database := range databases {
+		databaseV3, ok := database.(*types.DatabaseV3)
+		if !ok {
+			return nil, trace.BadParameter("unsupported database type %T", database)
+		}
+		resp.Databases = append(resp.Databases, databaseV3)
+	}
+
+	return resp, nil
+}
+
 // DeleteDatabase removes the specified database.
 func (g *GRPCServer) DeleteDatabase(ctx context.Context, req *types.ResourceRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -4025,6 +4538,39 @@ func (g *GRPCServer) GetWindowsDesktops(ctx context.Context, filter *types.Windo
 	}, nil
 }
 
+// ListWindowsDesktops returns a page of registered Windows desktop hosts.
+func (g *GRPCServer) ListWindowsDesktops(ctx context.Context, req *authpb.ListWindowsDesktopsRequest) (*authpb.ListWindowsDesktopsResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp, err := auth.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		WindowsDesktopFilter: req.WindowsDesktopFilter,
+		Limit:                int(req.Limit),
+		StartKey:             req.StartKey,
+		PredicateExpression:  req.PredicateExpression,
+		Labels:               req.Labels,
+		SearchKeywords:       req.SearchKeywords,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	out := &authpb.ListWindowsDesktopsResponse{
+		Desktops: make([]*types.WindowsDesktopV3, 0, len(resp.Desktops)),
+		NextKey:  resp.NextKey,
+	}
+
+	for _, d := range resp.Desktops {
+		if v3, ok := d.(*types.WindowsDesktopV3); ok {
+			out.Desktops = append(out.Desktops, v3)
+		}
+	}
+
+	return out, nil
+}
+
 // CreateWindowsDesktop registers a new Windows desktop host.
 func (g *GRPCServer) CreateWindowsDesktop(ctx context.Context, desktop *types.WindowsDesktopV3) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -4225,10 +4771,50 @@ func (g *GRPCServer) GetAccountRecoveryCodes(ctx context.Context, req *authpb.Ge
 	return rc, nil
 }
 
+// isScopePinnedLocalUserCredential returns true if the credentials associated with a given context
+// are specifically for a local user with a scope pin. this is used to help determine if it is safe to
+// perform a fallback operation when an API that isn't ported to scopes gets called with a scoped identity.
+// In theory, this check is redundant as this is the only condition where Authorizer.Authorize currently
+// returns ErrScopedIdentity, but having this extra check here helps us better describe the *security model*
+// of the fallback, which may not be sane in potential future scenarios where scoped identity errors are produced
+// for system roles or non-local users.
+func isScopePinnedLocalUserCredential(ctx context.Context) bool {
+	userI, err := authz.UserFromContext(ctx)
+	if err != nil {
+		return false
+	}
+
+	if user, ok := userI.(authz.LocalUser); ok && user.Identity.ScopePin != nil {
+		return true
+	}
+
+	return false
+}
+
 // CreateAuthenticateChallenge is implemented by AuthService.CreateAuthenticateChallenge.
 func (g *GRPCServer) CreateAuthenticateChallenge(ctx context.Context, req *authpb.CreateAuthenticateChallengeRequest) (*authpb.MFAAuthenticateChallenge, error) {
 	actx, err := g.authenticate(ctx)
 	if err != nil {
+		if errors.Is(err, services.ErrScopedIdentity) && isScopePinnedLocalUserCredential(ctx) && req.MFARequiredCheck != nil {
+			switch req.MFARequiredCheck.Target.(type) {
+			case *authpb.IsMFARequiredRequest_AdminAction:
+			case *authpb.IsMFARequiredRequest_Node:
+			default:
+				// we are only suppressing the subset of MFA required checks that need to be suppressed for currently
+				// supported scoped workflows.
+				return nil, trace.Wrap(err)
+			}
+
+			// NOTE: scopes don't currently have a concept of MFA. a lot of client logic wants to do a preemtive
+			// check to see if MFA is required. ordinarily we just return an access denied when a scoped identity is used to
+			// call an API that doesn't support scoping yet, but doing so here in all cases would complicate client logic a lot. it is
+			// therefore preferable to instead consider a scoped invocation a valid call that just happens to result in a
+			// no mfa required result.
+			return &authpb.MFAAuthenticateChallenge{
+				MFARequired: authpb.MFARequired_MFA_REQUIRED_NO,
+			}, nil
+		}
+
 		return nil, trace.Wrap(err)
 	}
 
@@ -4283,12 +4869,30 @@ func (g *GRPCServer) GenerateCertAuthorityCRL(ctx context.Context, req *authpb.C
 func (g *GRPCServer) ListUnifiedResources(ctx context.Context, req *authpb.ListUnifiedResourcesRequest) (*authpb.ListUnifiedResourcesResponse, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
+		if errors.Is(err, services.ErrScopedIdentity) {
+			// TODO(fspmarshall/scopes): Do away with this bifurcated implementation in favor of making ListUnifiedResources
+			// able to support scoped callers directly.
+			return g.scopedListUnifiedResources(ctx, req)
+		}
 		return nil, trace.Wrap(err)
 	}
 
 	return auth.ListUnifiedResources(ctx, req)
 }
 
+// scopedListUnifiedResources handles ListUnifiedResources requests for scoped identities. eventually we want to do away with
+// this in favor of fully porting over the ListUnifiedResources API to support scopes natively. for the time being, we use
+// this method to specifically make it possible to use 'tsh ls' with scoped credentials. usecases other than that are not
+// guaranteed to work properly at this time.
+func (g *GRPCServer) scopedListUnifiedResources(ctx context.Context, req *authpb.ListUnifiedResourcesRequest) (*authpb.ListUnifiedResourcesResponse, error) {
+	auth, err := g.scopedAuthenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return auth.scopedListUnifiedResources(ctx, req)
+}
+
 // ListResources retrieves a paginated list of resources.
 func (g *GRPCServer) ListResources(ctx context.Context, req *authpb.ListResourcesRequest) (*authpb.ListResourcesResponse, error) {
 	auth, err := g.authenticate(ctx)
@@ -4317,6 +4921,13 @@ func (g *GRPCServer) ListResources(ctx context.Context, req *authpb.ListResource
 func (g *GRPCServer) GetSSHTargets(ctx context.Context, req *authpb.GetSSHTargetsRequest) (*authpb.GetSSHTargetsResponse, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
+		if errors.Is(err, services.ErrScopedIdentity) {
+			// NOTE: this pattern of having separate code paths for scoped identities is temporary. GetSSHTargets
+			// relies upon ListUnifiedResources internally, which hasn't yet been fully ported to support scopes.
+			// until that work is done, we need to have this separate code path to ensure that search_as_roles
+			// functions as expected for unscoped callers.
+			return g.scopedGetSSHTargets(ctx, req)
+		}
 		return nil, trace.Wrap(err)
 	}
 
@@ -4328,6 +4939,20 @@ func (g *GRPCServer) GetSSHTargets(ctx context.Context, req *authpb.GetSSHTarget
 	return rsp, nil
 }
 
+func (g *GRPCServer) scopedGetSSHTargets(ctx context.Context, req *authpb.GetSSHTargetsRequest) (*authpb.GetSSHTargetsResponse, error) {
+	auth, err := g.scopedAuthenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rsp, err := auth.GetSSHTargets(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return rsp, nil
+}
+
 // ResolveSSHTarget gets a server that would match an equivalent ssh dial request.
 func (g *GRPCServer) ResolveSSHTarget(ctx context.Context, req *authpb.ResolveSSHTargetRequest) (*authpb.ResolveSSHTargetResponse, error) {
 	auth, err := g.authenticate(ctx)
@@ -4488,7 +5113,7 @@ func (g *GRPCServer) GetDomainName(ctx context.Context, req *emptypb.Empty) (*au
 func (g *GRPCServer) GetClusterCACert(
 	ctx context.Context, req *emptypb.Empty,
 ) (*authpb.GetClusterCACertResponse, error) {
-	auth, err := g.authenticate(ctx)
+	auth, err := g.scopedAuthenticate(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4656,6 +5281,91 @@ func (g *GRPCServer) GetInstallers(ctx context.Context, _ *emptypb.Empty) (*type
 	}, nil
 }
 
+// rangeDefaultInstallers returns implicit default installer scripts within the range [start, end).
+//
+// TODO(okraport): This should really belong in [services.ClusterConfigurationService], however moving
+// this to the service layer affects the event stream which may lead to inconsistencies when operating on implicit default keys.
+// Investigate the feasiablity of adding implicit builtin default keys to the service layer and refactor.
+func (g *GRPCServer) rangeDefaultInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error] {
+	isInRange := func(value, start, end string) bool {
+		if start == "" && end == "" {
+			return true
+		}
+		if start == "" {
+			return value < end
+		}
+		if end == "" {
+			return value >= start
+		}
+		return value >= start && value < end
+	}
+
+	return func(yield func(types.Installer, error) bool) {
+		var defaultInstallers []types.Installer
+
+		if isInRange(installers.InstallerScriptNameAgentless, start, end) {
+			defaultInstallers = append(defaultInstallers, installers.DefaultAgentlessInstaller)
+		}
+
+		if isInRange(types.DefaultInstallerScriptName, start, end) {
+			defaultInstaller, err := g.defaultInstaller(ctx)
+			if err != nil {
+				if !yield(*new(types.Installer), err) {
+					return
+				}
+			}
+			defaultInstallers = append(defaultInstallers, defaultInstaller)
+		}
+
+		// Sort in case the names change in the future as the streams must be sorted.
+		goslices.SortFunc(defaultInstallers, func(a, b types.Installer) int {
+			return strings.Compare(a.GetName(), b.GetName())
+		})
+
+		for _, installer := range defaultInstallers {
+			if !yield(installer, nil) {
+				return
+			}
+		}
+	}
+}
+
+// ListInstallers returns a page of installer script resources.
+func (g *GRPCServer) ListInstallers(ctx context.Context, req *authpb.ListInstallersRequest) (*authpb.ListInstallersResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	page, next, err := generic.CollectPageAndCursor(
+		iterstream.MergeStreamsWithPriority(
+			auth.RangeInstallers(ctx, req.PageToken, ""),
+			g.rangeDefaultInstallers(ctx, req.PageToken, ""),
+			func(a, b types.Installer) int { return strings.Compare(a.GetName(), b.GetName()) },
+		),
+		int(req.PageSize),
+		types.Installer.GetName,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListInstallersResponse{
+		Installers:    make([]*types.InstallerV1, 0, len(page)),
+		NextPageToken: next,
+	}
+
+	for _, inst := range page {
+		installersV1, ok := inst.(*types.InstallerV1)
+		if !ok {
+			return nil, trace.BadParameter("unsupported installer type %T", inst)
+		}
+		resp.Installers = append(resp.Installers, installersV1)
+	}
+
+	return resp, nil
+}
+
 // DeleteInstaller sets the installer script resource to its default
 func (g *GRPCServer) DeleteInstaller(ctx context.Context, req *types.ResourceRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -4787,6 +5497,34 @@ func (g *GRPCServer) GetKubernetesClusters(ctx context.Context, _ *emptypb.Empty
 	}, nil
 }
 
+// ListKubernetesClusters returns a page of registered kubernetes clusters.
+func (g *GRPCServer) ListKubernetesClusters(ctx context.Context, req *authpb.ListKubernetesClustersRequest) (*authpb.ListKubernetesClustersResponse, error) {
+	auth, err := g.authenticate(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clusters, next, err := auth.ListKubernetesClusters(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &authpb.ListKubernetesClustersResponse{
+		KubernetesClusters: make([]*types.KubernetesClusterV3, 0, len(clusters)),
+		NextPageToken:      next,
+	}
+
+	for _, cluster := range clusters {
+		clusterV3, ok := cluster.(*types.KubernetesClusterV3)
+		if !ok {
+			return nil, trace.BadParameter("unsupported kubernetes cluster type %T", clusterV3)
+		}
+		resp.KubernetesClusters = append(resp.KubernetesClusters, clusterV3)
+	}
+
+	return resp, nil
+}
+
 // DeleteKubernetesCluster removes the specified kubernetes cluster.
 func (g *GRPCServer) DeleteKubernetesCluster(ctx context.Context, req *types.ResourceRequest) (*emptypb.Empty, error) {
 	auth, err := g.authenticate(ctx)
@@ -5247,6 +5985,7 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 
 	server := grpc.NewServer(
 		grpc.Creds(creds),
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
 		grpc.ChainUnaryInterceptor(cfg.UnaryInterceptors...),
 		grpc.ChainStreamInterceptor(cfg.StreamInterceptors...),
 		grpc.KeepaliveParams(
@@ -5309,6 +6048,7 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 
 	botInstanceService, err := machineidv1.NewBotInstanceService(machineidv1.BotInstanceServiceConfig{
 		Authorizer: cfg.Authorizer,
+		Cache:      cfg.AuthServer.Cache,
 		Backend:    cfg.AuthServer.Services.BotInstance,
 		Clock:      cfg.AuthServer.GetClock(),
 	})
@@ -5436,6 +6176,28 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 		stableUNIXUsersServiceServer,
 	)
 
+	scopedAccessControl, err := scopedaccess.New(scopedaccess.Config{
+		ScopedAuthorizer: cfg.ScopedAuthorizer,
+		Reader:           cfg.AuthServer.ScopedAccessCache,
+		Writer:           cfg.AuthServer.scopedAccessBackend,
+		BackendReader:    cfg.AuthServer.scopedAccessBackend,
+		Logger:           logger,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "creating scoped access control service")
+	}
+	scopedaccessv1.RegisterScopedAccessServiceServer(server, scopedAccessControl)
+
+	scopedJoining, err := scopedjoining.New(scopedjoining.Config{
+		ScopedAuthorizer: cfg.ScopedAuthorizer,
+		Backend:          cfg.AuthServer,
+		Logger:           logger,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "creating scoped provisioning service")
+	}
+	scopedjoiningv1.RegisterScopedJoiningServiceServer(server, scopedJoining)
+
 	authServer := &GRPCServer{
 		APIConfig: cfg.APIConfig,
 		logger:    logger,
@@ -5477,18 +6239,27 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	dynamicwindowsv1pb.RegisterDynamicWindowsServiceServer(server, dynamicWindows)
 
 	trust, err := trustv1.NewService(&trustv1.ServiceConfig{
-		Authorizer: cfg.Authorizer,
-		Cache:      cfg.AuthServer.Cache,
-		Backend:    cfg.AuthServer.Services,
-		AuthServer: cfg.AuthServer,
+		Authorizer:       cfg.Authorizer,
+		ScopedAuthorizer: cfg.ScopedAuthorizer,
+		Cache:            cfg.AuthServer.Cache,
+		Backend:          cfg.AuthServer.Services,
+		AuthServer:       cfg.AuthServer,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	trustv1pb.RegisterTrustServiceServer(server, trust)
 
-	joinServiceServer := joinserver.NewJoinServiceGRPCServer(cfg.AuthServer)
-	authpb.RegisterJoinServiceServer(server, joinServiceServer)
+	legacyJoinServiceServer := legacyjoin.NewJoinServiceGRPCServer(cfg.AuthServer)
+	authpb.RegisterJoinServiceServer(server, legacyJoinServiceServer)
+
+	joinv1.RegisterJoinServiceServer(server, join.NewServer(&join.ServerConfig{
+		Authorizer:         cfg.Authorizer,
+		AuthService:        cfg.AuthServer,
+		FIPS:               cfg.AuthServer.fips,
+		OracleHTTPClient:   cfg.OracleHTTPClient,
+		ScopedTokenService: cfg.AuthServer.Services,
+	}))
 
 	integrationServiceServer, err := integrationv1.NewService(&integrationv1.ServiceConfig{
 		Authorizer:      cfg.Authorizer,
@@ -5507,7 +6278,8 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	integrationAWSOIDCServiceServer, err := integrationv1.NewAWSOIDCService(&integrationv1.AWSOIDCServiceConfig{
 		Authorizer:            cfg.Authorizer,
 		IntegrationService:    integrationServiceServer,
-		Cache:                 cfg.AuthServer,
+		Cache:                 cfg.AuthServer.Cache,
+		TokenCreator:          cfg.AuthServer,
 		ProxyPublicAddrGetter: cfg.AuthServer.getProxyPublicAddr,
 		Clock:                 cfg.AuthServer.clock,
 	})
@@ -5516,6 +6288,16 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	}
 	integrationv1pb.RegisterAWSOIDCServiceServer(server, integrationAWSOIDCServiceServer)
 
+	integrationAWSRolesAnywhereServiceServer, err := integrationv1.NewAWSRolesAnywhereService(&integrationv1.AWSRolesAnywhereServiceConfig{
+		Authorizer:         cfg.Authorizer,
+		IntegrationService: integrationServiceServer,
+		Clock:              cfg.AuthServer.clock,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	integrationv1pb.RegisterAWSRolesAnywhereServiceServer(server, integrationAWSRolesAnywhereServiceServer)
+
 	userTask, err := usertasksv1.NewService(usertasksv1.ServiceConfig{
 		Authorizer: cfg.Authorizer,
 		Backend:    cfg.AuthServer.Services,
@@ -5578,6 +6360,20 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	}
 	userloginstatev1pb.RegisterUserLoginStateServiceServer(server, userLoginStateServer)
 
+	recordingEncryptionService, err := recordingencryptionv1.NewService(recordingencryptionv1.ServiceConfig{
+		Authorizer:                cfg.Authorizer,
+		Uploader:                  cfg.AuthServer.Services,
+		KeyRotater:                cfg.AuthServer.Services,
+		Logger:                    cfg.AuthServer.logger.With(teleport.ComponentKey, teleport.ComponentRecordingEncryption),
+		SessionSummarizerProvider: cfg.APIConfig.AuthServer.sessionSummarizerProvider,
+		RecordingMetadataProvider: cfg.AuthServer.recordingMetadataProvider,
+		SessionStreamer:           cfg.AuthServer,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	recordingencryptionv1pb.RegisterRecordingEncryptionServiceServer(server, recordingEncryptionService)
+
 	clusterConfigService, err := clusterconfigv1.NewService(clusterconfigv1.ServiceConfig{
 		Cache:      cfg.AuthServer.Cache,
 		Backend:    cfg.AuthServer.Services,
@@ -5636,7 +6432,14 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	}
 	notificationsv1pb.RegisterNotificationServiceServer(server, notificationsServer)
 
-	vnetConfigServiceServer := vnetconfigv1.NewService(cfg.AuthServer.VnetConfigService, cfg.Authorizer)
+	vnetConfigServiceServer, err := vnetconfigv1.NewService(vnetconfigv1.ServiceConfig{
+		Authorizer: cfg.Authorizer,
+		Storage:    cfg.AuthServer.VnetConfigService,
+		Emitter:    cfg.Emitter,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	vnetv1pb.RegisterVnetConfigServiceServer(server, vnetConfigServiceServer)
 
 	staticHostUserServer, err := userprovisioningv2.NewService(userprovisioningv2.ServiceConfig{
@@ -5661,20 +6464,6 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	}
 	autoupdatev1pb.RegisterAutoUpdateServiceServer(server, autoUpdateServiceServer)
 
-	identityCenterService, err := local.NewIdentityCenterService(local.IdentityCenterServiceConfig{
-		Backend: cfg.AuthServer.bk,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	identitycenterv1.RegisterIdentityCenterServiceServer(server, identityCenterService)
-
-	provisioningStateService, err := local.NewProvisioningStateService(cfg.AuthServer.bk)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	provisioningv1.RegisterProvisioningServiceServer(server, provisioningStateService)
-
 	gitServerService, err := gitserverv1.NewService(gitserverv1.Config{
 		Authorizer:               cfg.Authorizer,
 		Backend:                  cfg.AuthServer.Services,
@@ -5706,8 +6495,23 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 		workloadidentityv1pb.RegisterX509OverridesServiceServer(server, srv)
 		workloadidentityv1pb.RegisterSigstorePolicyResourceServiceServer(server, workloadidentityv1.NewSigstorePolicyResourceService())
 
+		summarizerv1pb.RegisterSummarizerServiceServer(server, summarizerv1.NewService())
 	}
 
+	recordingMetadataService, err := recordingmetadatav1.NewService(recordingmetadatav1.ServiceConfig{
+		Authorizer: NewSessionRecordingAuthorizer(
+			cfg.AuthServer,
+			cfg.Authorizer,
+		),
+		Streamer:        cfg.AuthServer,
+		DownloadHandler: cfg.AuthServer,
+		Decrypter:       cfg.AuthServer.EncryptedIO,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "creating recording metadata service")
+	}
+	recordingmetadatav1pb.RegisterRecordingMetadataServiceServer(server, recordingMetadataService)
+
 	decisionService, err := decisionv1.NewService(decisionv1.ServiceConfig{
 		DecisionService: cfg.AuthServer.pdp,
 		Authorizer:      cfg.Authorizer,
@@ -5753,6 +6557,29 @@ func (g *GRPCServer) authenticate(ctx context.Context) (*grpcContext, error) {
 	}, nil
 }
 
+// scopedGRPCContext servers the same role as [grpcContext] but for scoped identities. It is currently
+// a thin wrapper around [ServerWithRoles] since we don't have any need to embed an [authz.Context] yet,
+// but we may embed one in the future.
+type scopedGRPCContext struct {
+	*ServerWithRoles
+}
+
+// scopedAuthenticate functions similarly to authenticate but supports scoped identities. It returns an initialized auth server
+// that has been set up with a scoped access checker, which may be based off of either a scoped or unscoped identity.
+func (g *GRPCServer) scopedAuthenticate(ctx context.Context) (*scopedGRPCContext, error) {
+	authContext, err := g.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &scopedGRPCContext{
+		ServerWithRoles: &ServerWithRoles{
+			authServer:    g.AuthServer,
+			scopedContext: authContext,
+			alog:          g.AuthServer,
+		},
+	}, nil
+}
+
 // GetUnstructuredEvents searches for events on the backend and sends them back in an unstructured format.
 func (g *GRPCServer) GetUnstructuredEvents(ctx context.Context, req *auditlogpb.GetUnstructuredEventsRequest) (*auditlogpb.EventsUnstructured, error) {
 	auth, err := g.authenticate(ctx)
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index 281145695ad21..fc068fa8bd131 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -72,7 +72,9 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
@@ -80,7 +82,10 @@ import (
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv/server/installer"
@@ -111,9 +116,9 @@ func TestMFADeviceManagement(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake user.
-	user, _, err := CreateUserAndRole(authServer, "mfa-user", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(authServer, "mfa-user", []string{"role"}, nil)
 	require.NoError(t, err)
-	userClient, err := testServer.NewClient(TestUser(user.GetName()))
+	userClient, err := testServer.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// No MFA devices should exist for a new user.
@@ -305,7 +310,7 @@ func TestMFADeviceManagement(t *testing.T) {
 	// Register an extra device to test allow deletion of other devices and test that
 	// the last device cannot be deleted.
 	const lastDeviceName = "lastDevice"
-	lastDevice, err := RegisterTestDevice(ctx, userClient, lastDeviceName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, devs.WebDev)
+	lastDevice, err := authtest.RegisterTestDevice(ctx, userClient, lastDeviceName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, devs.WebDev)
 	require.NoError(t, err, "RegisterTestDevice failed")
 
 	// Also add a password so we can testing add last non-passkey MFA device. Testing the
@@ -472,9 +477,9 @@ func TestMFADeviceManagement_SSO(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake user.
-	user, _, err := CreateUserAndRole(authServer, "mfa-user", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(authServer, "mfa-user", []string{"role"}, nil)
 	require.NoError(t, err)
-	userClient, err := testServer.NewClient(TestUser(user.GetName()))
+	userClient, err := testServer.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// Create an auth connector.
@@ -492,7 +497,7 @@ func TestMFADeviceManagement_SSO(t *testing.T) {
 	require.NoError(t, err)
 
 	// Convert the user to an SSO user for this auth connector.
-	userCreatedAt := authServer.clock.Now()
+	userCreatedAt := authServer.GetClock().Now()
 	user.SetCreatedBy(types.CreatedBy{
 		Time: userCreatedAt,
 		Connector: &types.ConnectorRef{
@@ -510,7 +515,7 @@ func TestMFADeviceManagement_SSO(t *testing.T) {
 
 	// prepare a passwordless device.
 	passkeyName := "passkey"
-	passkey, err := RegisterTestDevice(ctx, userClient, passkeyName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil, WithPasswordless())
+	passkey, err := authtest.RegisterTestDevice(ctx, userClient, passkeyName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil, authtest.WithPasswordless())
 	require.NoError(t, err, "RegisterTestDevice")
 
 	passkeyWebAuthnHandler := func(t *testing.T, challenge *proto.MFAAuthenticateChallenge) *proto.MFAAuthenticateResponse {
@@ -575,12 +580,12 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		setup    func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice)
+		setup    func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device)
 		checkErr require.ErrorAssertionFunc
 	}{
 		{
 			name:  "NOK no other MFA device",
-			setup: func(*testing.T, string, *authclient.Client, *TestDevice) {},
+			setup: func(*testing.T, string, *authclient.Client, *authtest.Device) {},
 			checkErr: func(t require.TestingT, err error, _ ...any) {
 				require.ErrorContains(t,
 					err,
@@ -591,18 +596,18 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 		},
 		{
 			name: "OK extra passwordless device",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
-				_, err := RegisterTestDevice(ctx, userClient, "another-passkey", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, pwdlessDev, WithPasswordless())
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
+				_, err := authtest.RegisterTestDevice(ctx, userClient, "another-passkey", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, pwdlessDev, authtest.WithPasswordless())
 				require.NoError(t, err, "RegisterTestDevice failed")
 			},
 			checkErr: require.NoError,
 		},
 		{
 			name: "OK password set with other WebAuthn device",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
 				err := authServer.UpsertPassword(username, []byte("living on the edge"))
 				require.NoError(t, err, "UpsertPassword")
-				_, err = RegisterTestDevice(
+				_, err = authtest.RegisterTestDevice(
 					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, pwdlessDev)
 				require.NoError(t, err, "RegisterTestDevice")
 			},
@@ -610,18 +615,18 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 		},
 		{
 			name: "OK password set with other TOTP device",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
 				err := authServer.UpsertPassword(username, []byte("living on the edge"))
 				require.NoError(t, err, "UpsertPassword")
-				_, err = RegisterTestDevice(
-					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, WithTestDeviceClock(clock))
+				_, err = authtest.RegisterTestDevice(
+					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, authtest.WithTestDeviceClock(clock))
 				require.NoError(t, err, "RegisterTestDevice")
 			},
 			checkErr: require.NoError,
 		},
 		{
 			name: "OK SSO user with other device",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
 				user, err := authServer.GetUser(ctx, username, false)
 				require.NoError(t, err, "GetUser")
 				user.SetCreatedBy(types.CreatedBy{
@@ -629,7 +634,7 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 				})
 				_, err = authServer.UpsertUser(ctx, user)
 				require.NoError(t, err, "UpsertUser")
-				_, err = RegisterTestDevice(
+				_, err = authtest.RegisterTestDevice(
 					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, pwdlessDev)
 				require.NoError(t, err, "RegisterTestDevice")
 			},
@@ -637,7 +642,7 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 		},
 		{
 			name: "NOK password set but no other MFAs",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
 				err := authServer.UpsertPassword(username, []byte("living on the edge"))
 				require.NoError(t, err, "UpsertPassword")
 			},
@@ -651,9 +656,9 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 		},
 		{
 			name: "NOK other MFAs, but no password set",
-			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *TestDevice) {
-				_, err := RegisterTestDevice(
-					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, WithTestDeviceClock(clock))
+			setup: func(t *testing.T, username string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
+				_, err := authtest.RegisterTestDevice(
+					ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, authtest.WithTestDeviceClock(clock))
 				require.NoError(t, err, "RegisterTestDevice")
 			},
 			checkErr: func(t require.TestingT, err error, _ ...any) {
@@ -666,9 +671,9 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 		},
 		{
 			name: "NOK other MFAs, but no password set, passwordless is off",
-			setup: func(t *testing.T, _ string, userClient *authclient.Client, pwdlessDev *TestDevice) {
+			setup: func(t *testing.T, _ string, userClient *authclient.Client, pwdlessDev *authtest.Device) {
 				// Register a non-passwordless device without adding a password.
-				_, err := RegisterTestDevice(ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, WithTestDeviceClock(clock))
+				_, err := authtest.RegisterTestDevice(ctx, userClient, "another-dev", proto.DeviceType_DEVICE_TYPE_TOTP, pwdlessDev, authtest.WithTestDeviceClock(clock))
 				require.NoError(t, err, "RegisterTestDevice")
 
 				authPref, err := authServer.GetAuthPreference(ctx)
@@ -708,9 +713,9 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 
 			// Create a fake user.
 			username := fmt.Sprintf("mfa-user-%d", i)
-			user, _, err := CreateUserAndRole(authServer, username, []string{"role"}, nil)
+			user, _, err := authtest.CreateUserAndRole(authServer, username, []string{"role"}, nil)
 			require.NoError(t, err)
-			userClient, err := testServer.NewClient(TestUser(user.GetName()))
+			userClient, err := testServer.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			// No MFA devices should exist for a new user.
@@ -720,8 +725,8 @@ func TestDeletingLastPasswordlessDevice(t *testing.T) {
 
 			// Add the passwordless device to be deleted.
 			pwdlessDevName := "pwdless-dev"
-			pwdlessDev, err := RegisterTestDevice(
-				ctx, userClient, pwdlessDevName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil, WithPasswordless())
+			pwdlessDev, err := authtest.RegisterTestDevice(
+				ctx, userClient, pwdlessDevName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil, authtest.WithPasswordless())
 			require.NoError(t, err)
 
 			// Case-specific setup.
@@ -749,10 +754,10 @@ type mfaDevices struct {
 	webOrigin string
 
 	TOTPName string
-	TOTPDev  *TestDevice
+	TOTPDev  *authtest.Device
 
 	WebName string
-	WebDev  *TestDevice
+	WebDev  *authtest.Device
 }
 
 func (d *mfaDevices) totpAuthHandler(t *testing.T, challenge *proto.MFAAuthenticateChallenge) *proto.MFAAuthenticateResponse {
@@ -783,11 +788,11 @@ func addOneOfEachMFADevice(t *testing.T, userClient *authclient.Client, clock cl
 
 	ctx := context.Background()
 
-	totpDev, err := RegisterTestDevice(
-		ctx, userClient, totpName, proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, WithTestDeviceClock(clock))
+	totpDev, err := authtest.RegisterTestDevice(
+		ctx, userClient, totpName, proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, authtest.WithTestDeviceClock(clock))
 	require.NoError(t, err, "RegisterTestDevice(totp)")
 
-	webDev, err := RegisterTestDevice(
+	webDev, err := authtest.RegisterTestDevice(
 		ctx, userClient, webName, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice(totp)")
 
@@ -883,7 +888,7 @@ func TestCreateAppSession_deviceExtensions(t *testing.T) {
 	authServer := testServer.Auth()
 
 	// Create an user for testing.
-	user, _, err := CreateUserAndRole(authServer, "llama", []string{"llama"}, nil)
+	user, _, err := authtest.CreateUserAndRole(authServer, "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 
 	// Register an application.
@@ -908,7 +913,7 @@ func TestCreateAppSession_deviceExtensions(t *testing.T) {
 
 	tests := []struct {
 		name       string
-		modifyUser func(u *TestIdentity)
+		modifyUser func(u *authtest.TestIdentity)
 		assertCert func(t *testing.T, cert *x509.Certificate)
 	}{
 		{
@@ -918,7 +923,7 @@ func TestCreateAppSession_deviceExtensions(t *testing.T) {
 		},
 		{
 			name: "user with device extensions",
-			modifyUser: func(u *TestIdentity) {
+			modifyUser: func(u *authtest.TestIdentity) {
 				lu := u.I.(authz.LocalUser)
 				lu.Identity.DeviceExtensions = *wantExtensions
 				u.I = lu
@@ -935,7 +940,7 @@ func TestCreateAppSession_deviceExtensions(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			u := TestUser(user.GetName())
+			u := authtest.TestUser(user.GetName())
 			if test.modifyUser != nil {
 				test.modifyUser(&u)
 			}
@@ -967,7 +972,7 @@ func TestGenerateUserCerts_deviceExtensions(t *testing.T) {
 	testServer := newTestTLSServer(t)
 
 	// Create an user for testing.
-	user, _, err := CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
+	user, _, err := authtest.CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 
 	key, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
@@ -983,7 +988,7 @@ func TestGenerateUserCerts_deviceExtensions(t *testing.T) {
 
 	tests := []struct {
 		name       string
-		modifyUser func(u *TestIdentity)
+		modifyUser func(u *authtest.TestIdentity)
 		assertCert func(t *testing.T, cert *x509.Certificate)
 	}{
 		{
@@ -993,7 +998,7 @@ func TestGenerateUserCerts_deviceExtensions(t *testing.T) {
 		},
 		{
 			name: "user with device extensions",
-			modifyUser: func(u *TestIdentity) {
+			modifyUser: func(u *authtest.TestIdentity) {
 				lu := u.I.(authz.LocalUser)
 				lu.Identity.DeviceExtensions = *wantExtensions
 				u.I = lu
@@ -1010,7 +1015,7 @@ func TestGenerateUserCerts_deviceExtensions(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			u := TestUser(user.GetName())
+			u := authtest.TestUser(user.GetName())
 			if test.modifyUser != nil {
 				test.modifyUser(&u)
 			}
@@ -1038,7 +1043,7 @@ func TestGenerateUserCerts_deviceExtensions(t *testing.T) {
 }
 
 func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise, // required for Device Trust.
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -1055,7 +1060,7 @@ func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
 	authServer := testServer.Auth()
 
 	// Create a user for testing.
-	user, role, err := CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
+	user, role, err := authtest.CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	username := user.GetName()
 
@@ -1082,17 +1087,32 @@ func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create clients with and without device extensions.
-	clientWithoutDevice, err := testServer.NewClient(TestUser(username))
+	clientWithoutDevice, err := testServer.NewClient(authtest.TestUser(username))
 	require.NoError(t, err, "NewClient failed")
 
 	clientWithDevice, err := testServer.NewClient(
-		TestUserWithDeviceExtensions(username, tlsca.DeviceExtensions{
+		authtest.TestUserWithDeviceExtensions(username, tlsca.DeviceExtensions{
 			DeviceID:     "deviceid1",
 			AssetTag:     "assettag1",
 			CredentialID: "credentialid1",
 		}))
 	require.NoError(t, err, "NewClient failed")
 
+	// Create bot user for testing.
+	botUser, _, err := authtest.CreateUserAndRole(testServer.Auth(), "wall-e", []string{"wall-e-role"}, nil)
+	require.NoError(t, err, "CreateUserAndRole failed")
+
+	botMeta := botUser.GetMetadata()
+	botMeta.Labels = map[string]string{
+		types.BotLabel: "wall-e",
+	}
+	botUser.SetMetadata(botMeta)
+	botUser, err = testServer.Auth().UpsertUser(ctx, botUser)
+	require.NoError(t, err)
+
+	botClient, err := testServer.NewClient(authtest.TestUser(botUser.GetName()))
+	require.NoError(t, err)
+
 	// updateAuthPref is a helper used throughout the test.
 	updateAuthPref := func(t *testing.T, modify func(ap types.AuthPreference)) {
 		authPref, err := authServer.GetAuthPreference(ctx)
@@ -1162,6 +1182,15 @@ func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
 			Login:          username,
 		},
 	}
+	botSSHReq := proto.UserCertsRequest{
+		SSHPublicKey:   sshPub,
+		Username:       botUser.GetName(),
+		Expires:        expires,
+		RouteToCluster: clusterName,
+		NodeName:       "mynode",
+		Usage:          proto.UserCertsRequest_SSH,
+		SSHLogin:       "llama",
+	}
 
 	assertSuccess := func(t *testing.T, err error) {
 		assert.NoError(t, err, "GenerateUserCerts error mismatch")
@@ -1254,6 +1283,22 @@ func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
 			req:               winReq,
 			assertErr:         assertSuccess,
 		},
+		{
+			name:               "nok: mode=required with bot",
+			clusterDeviceMode:  constants.DeviceTrustModeRequired,
+			client:             botClient,
+			req:                botSSHReq,
+			skipSingleUseCerts: true,
+			assertErr:          assertAccessDenied,
+		},
+		{
+			name:               "ok: mode=required-for-humans with bot",
+			clusterDeviceMode:  constants.DeviceTrustModeRequiredForHumans,
+			client:             botClient,
+			req:                botSSHReq,
+			skipSingleUseCerts: true,
+			assertErr:          assertSuccess,
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -1282,7 +1327,7 @@ func TestGenerateUserCerts_deviceAuthz(t *testing.T) {
 
 // Test that device trust is required for a user registering their first MFA device.
 func TestRegisterFirstDevice_deviceAuthz(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise, // required for Device Trust.
 	})
 
@@ -1292,16 +1337,16 @@ func TestRegisterFirstDevice_deviceAuthz(t *testing.T) {
 	authServer := testServer.Auth()
 
 	// Create a user for testing.
-	user, _, err := CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
+	user, _, err := authtest.CreateUserAndRole(testServer.Auth(), "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole failed")
 	username := user.GetName()
 
 	// Create clients with and without device extensions.
-	clientWithoutDevice, err := testServer.NewClient(TestUser(username))
+	clientWithoutDevice, err := testServer.NewClient(authtest.TestUser(username))
 	require.NoError(t, err, "NewClient failed")
 
 	clientWithDevice, err := testServer.NewClient(
-		TestUserWithDeviceExtensions(username, tlsca.DeviceExtensions{
+		authtest.TestUserWithDeviceExtensions(username, tlsca.DeviceExtensions{
 			DeviceID:     "deviceid1",
 			AssetTag:     "assettag1",
 			CredentialID: "credentialid1",
@@ -1410,7 +1455,7 @@ func mustCreateDatabase(t *testing.T, name, protocol, uri string) *types.Databas
 }
 
 func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise, // required for IP pinning.
 		TestFeatures:  modules.GetModules().Features(),
 	})
@@ -1492,6 +1537,49 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 	_, err = srv.Auth().UpsertApplicationServer(ctx, appServer)
 	require.NoError(t, err)
 
+	// Roles Anywhere set up.
+	srv.Auth().AWSRolesAnywhereCreateSessionOverride = func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+		return &createsession.CreateSessionResponse{
+			Version:         1,
+			AccessKeyID:     "aki",
+			SecretAccessKey: "sak",
+			SessionToken:    "st",
+			Expiration:      "2025-06-25T12:07:02.474135Z",
+		}, nil
+	}
+	awsRAIntegration := "ra-integration"
+	ig, err := types.NewIntegrationAWSRA(types.Metadata{Name: awsRAIntegration}, &types.AWSRAIntegrationSpecV1{
+		TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/ExampleTrustAnchor",
+		ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+			ProfileARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+			RoleARN:    "arn:aws:iam::123456789012:role/SyncRole",
+		},
+	})
+	require.NoError(t, err)
+	_, err = srv.Auth().Integrations.CreateIntegration(ctx, ig)
+	require.NoError(t, err)
+
+	awsAppUsingRolesAnywhere, err := types.NewAppServerV3(types.Metadata{
+		Name: "app-roles-anywhere",
+	}, types.AppServerSpecV3{
+		HostID: srv.Auth().ServerID,
+		App: &types.AppV3{Metadata: types.Metadata{
+			Name: "app-roles-anywhere",
+		}, Spec: types.AppSpecV3{
+			URI:         constants.AWSConsoleURL,
+			Integration: awsRAIntegration,
+			AWS: &types.AppAWS{
+				RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
+					ProfileARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+				},
+			},
+			PublicAddr: "example.com",
+		}},
+	})
+	require.NoError(t, err)
+	_, err = srv.Auth().UpsertApplicationServer(ctx, awsAppUsingRolesAnywhere)
+	require.NoError(t, err)
+
 	leaf, err := types.NewRemoteCluster("leaf")
 	require.NoError(t, err)
 
@@ -1500,7 +1588,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake user.
-	user, role, err := CreateUserAndRole(srv.Auth(), "mfa-user", []string{"role"}, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), "mfa-user", []string{"role"}, nil)
 	require.NoError(t, err)
 	// Make sure MFA is required for this user.
 	roleOpt := role.GetOptions()
@@ -1513,7 +1601,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 	role.SetOptions(roleOpt)
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
-	testUser := TestUser(user.GetName())
+	testUser := authtest.TestUser(user.GetName())
 	testUser.TTL = userCertTTL
 	cl, err := srv.NewClient(testUser)
 	require.NoError(t, err)
@@ -1961,6 +2049,36 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "aws app using roles anywhere should not limit ttl to 1m",
+			opts: generateUserSingleUseCertsTestOpts{
+				initReq: &proto.UserCertsRequest{
+					TLSPublicKey: tlsPub,
+					Username:     user.GetName(),
+					// Expiration should be adjusted to user cert ttl, but not to single user cert TTL (1min).
+					Expires: clock.Now().Add(1000 * time.Hour),
+					Usage:   proto.UserCertsRequest_App,
+					RouteToApp: proto.RouteToApp{
+						Name:       "app-roles-anywhere",
+						AWSRoleARN: "arn:aws:iam::123456789012:role/MyRole",
+					},
+					RequesterName: proto.UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS,
+				},
+				authnHandler: registered.webAuthHandler,
+				verifyErr:    require.NoError,
+				verifyCert: func(t *testing.T, c *proto.Certs) {
+					cert, err := tlsca.ParseCertificatePEM(c.TLS)
+					require.NoError(t, err)
+					require.Equal(t, userCertExpires, cert.NotAfter)
+					identity, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
+					require.NoError(t, err)
+					require.Equal(t, webDevID, identity.MFAVerified)
+					require.Equal(t, userCertExpires, identity.PreviousIdentityExpires)
+					require.Equal(t, []string{teleport.UsageAppsOnly}, identity.Usage)
+					require.NotEmpty(t, identity.RouteToApp.AWSCredentialProcessCredentials)
+				},
+			},
+		},
 		{
 			desc: "desktops",
 			opts: generateUserSingleUseCertsTestOpts{
@@ -2035,7 +2153,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 		{
 			desc: "device extensions copied SSH cert",
 			newClient: func() (*authclient.Client, error) {
-				u := TestUser(user.GetName())
+				u := authtest.TestUser(user.GetName())
 				u.TTL = 1 * time.Hour
 
 				// Add device extensions to the fake user's identity.
@@ -2079,7 +2197,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 		{
 			desc: "device extensions copied TLS cert",
 			newClient: func() (*authclient.Client, error) {
-				u := TestUser(user.GetName())
+				u := authtest.TestUser(user.GetName())
 				u.TTL = 1 * time.Hour
 
 				// Add device extensions to the fake user's identity.
@@ -2436,11 +2554,11 @@ var requireMFATypes = []types.RequireMFAType{
 }
 
 func TestIsMFARequired(t *testing.T) {
-	testModules := &modules.TestModules{
+	testModules := modulestest.Modules{
 		TestBuildType:       modules.BuildEnterprise,
 		MockAttestationData: &keys.AttestationData{},
 	}
-	modules.SetTestModules(t, testModules)
+	modulestest.SetTestModules(t, testModules)
 
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
@@ -2500,7 +2618,7 @@ func TestIsMFARequired(t *testing.T) {
 						testModules.MockAttestationData.PrivateKeyPolicy = keys.PrivateKeyPolicyHardwareKey
 					}
 
-					cl, err := srv.NewClient(TestUser(user.GetName()))
+					cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 					require.NoError(t, err)
 
 					resp, err := cl.IsMFARequired(ctx, &proto.IsMFARequiredRequest{
@@ -2578,7 +2696,7 @@ func TestIsMFARequired_unauthorized(t *testing.T) {
 	_, err = srv.Auth().UpsertNode(ctx, node2)
 	require.NoError(t, err)
 
-	user, role, err := CreateUserAndRole(srv.Auth(), "alice", []string{"alice"}, nil)
+	user, role, err := authtest.CreateUserAndRole(srv.Auth(), "alice", []string{"alice"}, nil)
 	require.NoError(t, err)
 
 	// Require MFA.
@@ -2589,7 +2707,7 @@ func TestIsMFARequired_unauthorized(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	cl, err := srv.NewClient(TestUser(user.GetName()))
+	cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// Call the endpoint for an authorized login. The user is only authorized
@@ -2617,7 +2735,7 @@ func TestIsMFARequired_unauthorized(t *testing.T) {
 }
 
 func TestIsMFARequired_nodeMatch(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
@@ -2633,7 +2751,7 @@ func TestIsMFARequired_nodeMatch(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake user with per session mfa required for all nodes.
-	role, err := CreateRole(ctx, srv.Auth(), "mfa-user", types.RoleSpecV6{
+	role, err := authtest.CreateRole(ctx, srv.Auth(), "mfa-user", types.RoleSpecV6{
 		Options: types.RoleOptions{
 			RequireMFAType: types.RequireMFAType_SESSION,
 		},
@@ -2644,10 +2762,10 @@ func TestIsMFARequired_nodeMatch(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	user, err := CreateUser(ctx, srv.Auth(), "mfa-user", role)
+	user, err := authtest.CreateUser(ctx, srv.Auth(), "mfa-user", role)
 	require.NoError(t, err)
 
-	cl, err := srv.NewClient(TestUser(user.GetName()))
+	cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	for _, tc := range []struct {
@@ -2710,7 +2828,7 @@ func TestIsMFARequired_nodeMatch(t *testing.T) {
 			require.NoError(t, err, "IsMFARequired")
 
 			assert.Equal(t, tc.want, resp.MFARequired, "MFARequired mismatch")
-			assert.Equal(t, MFARequiredToBool(tc.want), resp.Required, "Required mismatch")
+			assert.Equal(t, auth.MFARequiredToBool(tc.want), resp.Required, "Required mismatch")
 		})
 	}
 }
@@ -2821,7 +2939,7 @@ func TestIsMFARequired_App(t *testing.T) {
 		user, err = srv.Auth().UpsertUser(ctx, user)
 		require.NoError(t, err)
 
-		cl, err := srv.NewClient(TestUser(user.GetName()))
+		cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 		require.NoError(t, err)
 
 		resp, err := cl.IsMFARequired(ctx, &proto.IsMFARequiredRequest{
@@ -2838,13 +2956,13 @@ func TestIsMFARequired_App(t *testing.T) {
 
 // testOriginDynamicStored tests setting a ResourceWithOrigin via the server
 // API always results in the resource being stored with OriginDynamic.
-func testOriginDynamicStored(t *testing.T, setWithOrigin func(*authclient.Client, string) error, getStored func(*Server) (types.ResourceWithOrigin, error)) {
+func testOriginDynamicStored(t *testing.T, setWithOrigin func(*authclient.Client, string) error, getStored func(*auth.Server) (types.ResourceWithOrigin, error)) {
 	srv := newTestTLSServer(t)
 
 	// Create a fake user.
-	user, _, err := CreateUserAndRole(srv.Auth(), "configurer", []string{}, nil)
+	user, _, err := authtest.CreateUserAndRole(srv.Auth(), "configurer", []string{}, nil)
 	require.NoError(t, err)
-	cl, err := srv.NewClient(TestUser(user.GetName()))
+	cl, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	for _, origin := range types.OriginValues {
@@ -2870,7 +2988,7 @@ func TestAuthPreferenceOriginDynamic(t *testing.T) {
 		return err
 	}
 
-	getStored := func(asrv *Server) (types.ResourceWithOrigin, error) {
+	getStored := func(asrv *auth.Server) (types.ResourceWithOrigin, error) {
 		return asrv.GetAuthPreference(ctx)
 	}
 
@@ -2888,7 +3006,7 @@ func TestClusterNetworkingConfigOriginDynamic(t *testing.T) {
 		return trace.Wrap(err)
 	}
 
-	getStored := func(asrv *Server) (types.ResourceWithOrigin, error) {
+	getStored := func(asrv *auth.Server) (types.ResourceWithOrigin, error) {
 		return asrv.GetClusterNetworkingConfig(ctx)
 	}
 
@@ -2906,7 +3024,7 @@ func TestSessionRecordingConfigOriginDynamic(t *testing.T) {
 		return err
 	}
 
-	getStored := func(asrv *Server) (types.ResourceWithOrigin, error) {
+	getStored := func(asrv *auth.Server) (types.ResourceWithOrigin, error) {
 		return asrv.GetSessionRecordingConfig(ctx)
 	}
 
@@ -2918,13 +3036,13 @@ func TestGenerateHostCerts(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	pubTLS, err := PrivateKeyToPublicKeyTLS(priv)
+	pubTLS, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	certs, err := clt.GenerateHostCerts(ctx, &proto.HostCertsRequest{
@@ -2945,7 +3063,7 @@ func TestGenerateDatabaseCerts(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Generate CSR once for speed sake.
@@ -2980,14 +3098,14 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 		types.RoleProxy,
 	}
 
-	clt, err := srv.NewClient(TestServerID(types.RoleNode, serverID))
+	clt, err := srv.NewClient(authtest.TestServerID(types.RoleNode, serverID))
 	require.NoError(t, err)
 	defer clt.Close()
 
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	pubTLS, err := PrivateKeyToPublicKeyTLS(priv)
+	pubTLS, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	req := proto.HostCertsRequest{
@@ -3007,7 +3125,7 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 	// perform assertions
 	for _, role := range roles {
 		func() {
-			clt, err := srv.NewClient(TestServerID(role, serverID))
+			clt, err := srv.NewClient(authtest.TestServerID(role, serverID))
 			require.NoError(t, err)
 			defer clt.Close()
 
@@ -3030,7 +3148,8 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 	// make an instance client
 	instanceCert, err := tls.X509KeyPair(certs.TLS, priv)
 	require.NoError(t, err)
-	instanceClt := srv.NewClientWithCert(instanceCert)
+	instanceClt, err := srv.NewClientWithCert(instanceCert)
+	require.NoError(t, err)
 
 	// instance cert can self-renew without assertions
 	req.SystemRoleAssertionID = ""
@@ -3061,7 +3180,7 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 	go func() {
 		defer close(pingErr)
 		// get an admin client so that we can test pings
-		clt, err := srv.NewClient(TestAdmin())
+		clt, err := srv.NewClient(authtest.TestAdmin())
 		if err != nil {
 			pingErr <- err
 			return
@@ -3096,7 +3215,7 @@ func TestGetSSHTargets(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	upper, err := types.NewServerWithLabels(uuid.New().String(), types.KindNode, types.ServerSpecV2{
@@ -3149,7 +3268,7 @@ func TestResolveSSHTarget(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	upper, err := types.NewServerWithLabels(uuid.New().String(), types.KindNode, types.ServerSpecV2{
@@ -3212,7 +3331,7 @@ func TestNodesCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// node1 and node2 will be added to default namespace
@@ -3306,10 +3425,22 @@ func TestNodesCRUD(t *testing.T) {
 
 func TestLocksCRUD(t *testing.T) {
 	t.Parallel()
+
+	newLockFilter := func(inForceOnly bool, targets ...types.LockTarget) *types.LockFilter {
+		filter := &types.LockFilter{
+			InForceOnly: inForceOnly,
+			Targets:     make([]*types.LockTarget, 0, len(targets)),
+		}
+		for _, tgt := range targets {
+			filter.Targets = append(filter.Targets, &tgt)
+		}
+		return filter
+	}
+
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	now := srv.Clock().Now()
@@ -3357,6 +3488,55 @@ func TestLocksCRUD(t *testing.T) {
 			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
 				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 		})
+		t.Run("ListLocks", func(t *testing.T) {
+			t.Parallel()
+			locks, next, err := clt.ListLocks(ctx, 0, "", nil)
+			require.Empty(t, next)
+			require.NoError(t, err)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			page1, page2Start, err := clt.ListLocks(ctx, 1, "", nil)
+			require.NotEmpty(t, page2Start)
+			require.NoError(t, err)
+			require.Len(t, page1, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, page1,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			page2, next, err := clt.ListLocks(ctx, 0, page2Start, nil)
+			require.Empty(t, next)
+			require.NoError(t, err)
+			require.Len(t, page2, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, page2,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, append(page1, page2...),
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		})
+		t.Run("RangeLocks", func(t *testing.T) {
+			t.Parallel()
+			locks, err := iterstream.Collect(clt.RangeLocks(ctx, "", "", nil))
+			require.NoError(t, err)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			_, page2Start, _ := clt.ListLocks(ctx, 1, "", nil)
+
+			page1, err := iterstream.Collect(clt.RangeLocks(ctx, "", page2Start, nil))
+			require.NoError(t, err)
+			require.Len(t, page1, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, page1,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			page2, err := iterstream.Collect(clt.RangeLocks(ctx, page2Start, "", nil))
+			require.NoError(t, err)
+			require.Len(t, page2, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, page2,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+		})
 		t.Run("GetLocks with targets", func(t *testing.T) {
 			t.Parallel()
 			// Match both locks with the targets.
@@ -3379,6 +3559,54 @@ func TestLocksCRUD(t *testing.T) {
 			require.NoError(t, err)
 			require.Empty(t, locks)
 		})
+
+		t.Run("ListLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			// Match both locks with the targets.
+			locks, next, err := clt.ListLocks(ctx, 0, "", newLockFilter(false, lock1.Target(), lock2.Target()))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match only one of the locks.
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, next, err = clt.ListLocks(ctx, 0, "", newLockFilter(false, lock1.Target(), roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match none of the locks.
+			locks, next, err = clt.ListLocks(ctx, 0, "", newLockFilter(false, roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Empty(t, locks)
+		})
+		t.Run("RangeLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			// Match both locks with the targets.
+			locks, err := iterstream.Collect(clt.RangeLocks(ctx, "", "", newLockFilter(false, lock1.Target(), lock2.Target())))
+			require.NoError(t, err)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match only one of the locks.
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, err = iterstream.Collect(clt.RangeLocks(ctx, "", "", newLockFilter(false, lock1.Target(), roleTarget)))
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match none of the locks.
+			locks, err = iterstream.Collect(clt.RangeLocks(ctx, "", "", newLockFilter(false, roleTarget)))
+			require.NoError(t, err)
+			require.Empty(t, locks)
+		})
 		t.Run("GetLock", func(t *testing.T) {
 			t.Parallel()
 			// Get one of the locks.
@@ -3428,7 +3656,7 @@ func TestApplicationServersCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Create a couple app servers.
@@ -3501,7 +3729,7 @@ func TestAppsCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Create a couple apps.
@@ -3525,6 +3753,18 @@ func TestAppsCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, out)
 
+	out, next, err := clt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	var iterOut []types.Application
+	for app, err := range clt.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, iterOut)
+
 	// Create both apps.
 	err = clt.CreateApp(ctx, app1)
 	require.NoError(t, err)
@@ -3538,6 +3778,22 @@ func TestAppsCRUD(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err = clt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.Application{app1, app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range clt.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, cmp.Diff([]types.Application{app1, app2}, iterOut,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Fetch a specific app.
 	app, err := clt.GetApp(ctx, app2.GetName())
 	require.NoError(t, err)
@@ -3572,6 +3828,22 @@ func TestAppsCRUD(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err = clt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.Application{app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range clt.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, cmp.Diff([]types.Application{app2}, iterOut,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Try to delete an app that doesn't exist.
 	err = clt.DeleteApp(ctx, "doesnotexist")
 	require.IsType(t, trace.NotFound(""), err)
@@ -3579,9 +3851,61 @@ func TestAppsCRUD(t *testing.T) {
 	// Delete all apps.
 	err = clt.DeleteAllApps(ctx)
 	require.NoError(t, err)
+
 	out, err = clt.GetApps(ctx)
 	require.NoError(t, err)
 	require.Empty(t, out)
+
+	out, next, err = clt.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range clt.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, iterOut)
+
+	err = srv.Auth().UpsertProxy(ctx, &types.ServerV2{
+		Kind: types.KindProxy,
+		Metadata: types.Metadata{
+			Name: "proxy",
+		},
+		Spec: types.ServerSpecV2{
+			PublicAddrs: []string{"proxy.example.com:443"},
+		},
+	})
+	require.NoError(t, err)
+
+	t.Run("Creating an app with a public address matching a proxy address should fail", func(t *testing.T) {
+		misconfiguredApp, err := types.NewAppV3(types.Metadata{
+			Name:   "misconfigured-app",
+			Labels: map[string]string{types.OriginLabel: types.OriginDynamic},
+		}, types.AppSpecV3{
+			URI:        "localhost1",
+			PublicAddr: "proxy.example.com",
+		})
+		require.NoError(t, err)
+
+		err = clt.CreateApp(ctx, misconfiguredApp)
+		require.ErrorIs(t, err, trace.BadParameter(`Application "misconfigured-app" public address "proxy.example.com" conflicts with the Teleport Proxy public address. Configure the application to use a unique public address that does not match the proxy's public addresses. Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/#customize-public-address.`))
+	})
+
+	t.Run("Updating an app with a public address matching a proxy address should fail", func(t *testing.T) {
+		misconfiguredApp, err := types.NewAppV3(types.Metadata{
+			Name:   "misconfigured-app",
+			Labels: map[string]string{types.OriginLabel: types.OriginDynamic},
+		}, types.AppSpecV3{
+			URI:        "localhost1",
+			PublicAddr: "proxy.example.com",
+		})
+		require.NoError(t, err)
+
+		err = clt.UpdateApp(ctx, misconfiguredApp)
+		require.ErrorIs(t, err, trace.BadParameter(`Application "misconfigured-app" public address "proxy.example.com" conflicts with the Teleport Proxy public address. Configure the application to use a unique public address that does not match the proxy's public addresses. Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/#customize-public-address.`))
+	})
 }
 
 // TestAppServersCRUD tests application server resource operations.
@@ -3591,7 +3915,7 @@ func TestAppServersCRUD(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	// Create an app server, expected origin dynamic.
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	app1, err := types.NewAppV3(types.Metadata{
@@ -3650,7 +3974,7 @@ func TestAppServersCRUD(t *testing.T) {
 	require.ErrorIs(t, err, trace.BadParameter("only the Okta role can create app servers and apps with an Okta origin"))
 
 	// Create an app server with Okta labels using the Okta role.
-	clt, err = srv.NewClient(TestBuiltin(types.RoleOkta))
+	clt, err = srv.NewClient(authtest.TestBuiltin(types.RoleOkta))
 	require.NoError(t, err)
 
 	app2.SetOrigin(types.OriginOkta)
@@ -3680,6 +4004,34 @@ func TestAppServersCRUD(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Empty(t, resources.Resources)
+
+	t.Run("App server with an app that has a public address matching a proxy address should fail", func(t *testing.T) {
+		err = srv.Auth().UpsertProxy(ctx, &types.ServerV2{
+			Kind: types.KindProxy,
+			Metadata: types.Metadata{
+				Name: "proxy",
+			},
+			Spec: types.ServerSpecV2{
+				PublicAddrs: []string{"proxy.example.com:443"},
+			},
+		})
+		require.NoError(t, err)
+
+		misconfiguredApp, err := types.NewAppV3(types.Metadata{
+			Name:   "misconfigured-app",
+			Labels: map[string]string{types.OriginLabel: types.OriginDynamic},
+		}, types.AppSpecV3{
+			URI:        "localhost1",
+			PublicAddr: "proxy.example.com",
+		})
+		require.NoError(t, err)
+
+		appServer, err := types.NewAppServerV3FromApp(misconfiguredApp, "misconfigured-app", "hostID")
+		require.NoError(t, err)
+
+		_, err = clt.UpsertApplicationServer(ctx, appServer)
+		require.ErrorIs(t, err, trace.BadParameter(`Application "misconfigured-app" public address "proxy.example.com" conflicts with the Teleport Proxy public address. Configure the application to use a unique public address that does not match the proxy's public addresses. Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/#customize-public-address.`))
+	})
 }
 
 // TestDatabasesCRUD tests database resource operations.
@@ -3688,7 +4040,7 @@ func TestDatabasesCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Create a couple databases.
@@ -3714,6 +4066,11 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, out)
 
+	out, next, err := clt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
 	// Create both databases.
 	err = clt.CreateDatabase(ctx, db1)
 	require.NoError(t, err)
@@ -3727,6 +4084,13 @@ func TestDatabasesCRUD(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	out, next, err = clt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Database{db1, db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Fetch a specific database.
 	db, err := clt.GetDatabase(ctx, db2.GetName())
 	require.NoError(t, err)
@@ -3760,6 +4124,12 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.Empty(t, cmp.Diff([]types.Database{db2}, out,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
+	out, next, err = clt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff([]types.Database{db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
 
 	// Try to delete a database that doesn't exist.
 	err = clt.DeleteDatabase(ctx, "doesnotexist")
@@ -3771,6 +4141,10 @@ func TestDatabasesCRUD(t *testing.T) {
 	out, err = clt.GetDatabases(ctx)
 	require.NoError(t, err)
 	require.Empty(t, out)
+	out, next, err = clt.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Empty(t, out)
 }
 
 // TestDatabaseServicesCRUD tests DatabaseService resource operations.
@@ -3779,7 +4153,7 @@ func TestDatabaseServicesCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Create two DatabaseServices.
@@ -3905,7 +4279,7 @@ func TestServerInfoCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	serverInfo1, err := types.NewServerInfo(types.Metadata{
@@ -4002,7 +4376,7 @@ func TestSAMLIdPServiceProvidersCRUD(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// Create two SAML IdP service providers.
@@ -4087,7 +4461,7 @@ func TestListResources(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	clt, err := srv.NewClient(TestAdmin())
+	clt, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	testCases := map[string]struct {
@@ -4320,7 +4694,7 @@ func TestCustomRateLimiting(t *testing.T) {
 			// specifically failed, otherwise multiple cases can fail from running
 			// cases in parallel.
 			srv := newTestTLSServer(t)
-			clt, err := srv.NewClient(TestNop())
+			clt, err := srv.NewClient(authtest.TestNop())
 			require.NoError(t, err)
 
 			var attempts int
@@ -4378,7 +4752,7 @@ func TestExport(t *testing.T) {
 	validateResource := func(forwardedFor string, resourceSpan *otlptracev1.ResourceSpans) {
 		var forwarded []string
 		for _, attribute := range resourceSpan.Resource.Attributes {
-			if attribute.Key == forwardedTag {
+			if attribute.Key == auth.ForwardedTag {
 				forwarded = append(forwarded, attribute.Value.GetStringValue())
 			}
 		}
@@ -4388,7 +4762,7 @@ func TestExport(t *testing.T) {
 		for _, scopeSpan := range resourceSpan.ScopeSpans {
 			for _, span := range scopeSpan.Spans {
 				for _, attribute := range span.Attributes {
-					if attribute.Key == forwardedTag {
+					if attribute.Key == auth.ForwardedTag {
 						forwarded = append(forwarded, attribute.Value.GetStringValue())
 					}
 				}
@@ -4417,7 +4791,7 @@ func TestExport(t *testing.T) {
 					for _, span := range scopeSpan.Spans {
 						var foundForwardedTag bool
 						for _, attribute := range span.Attributes {
-							if attribute.Key == forwardedTag {
+							if attribute.Key == auth.ForwardedTag {
 								require.False(t, foundForwardedTag)
 								foundForwardedTag = true
 								require.Equal(t, forwardedFor, attribute.Value.GetStringValue())
@@ -4478,7 +4852,7 @@ func TestExport(t *testing.T) {
 						},
 						{
 							Name:       "with-tag",
-							Attributes: []*otlpcommonv1.KeyValue{{Key: forwardedTag, Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "test"}}}},
+							Attributes: []*otlpcommonv1.KeyValue{{Key: auth.ForwardedTag, Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "test"}}}},
 						},
 						{
 							Name: "no-attributes",
@@ -4516,7 +4890,7 @@ func TestExport(t *testing.T) {
 							Name: "already-tagged",
 							Attributes: []*otlpcommonv1.KeyValue{
 								{
-									Key: forwardedTag,
+									Key: auth.ForwardedTag,
 									Value: &otlpcommonv1.AnyValue{
 										Value: &otlpcommonv1.AnyValue_StringValue{
 											StringValue: user,
@@ -4541,7 +4915,7 @@ func TestExport(t *testing.T) {
 
 	cases := []struct {
 		name              string
-		identity          TestIdentity
+		identity          authtest.TestIdentity
 		errAssertion      require.ErrorAssertionFunc
 		uploadedAssertion require.ValueAssertionFunc
 		spans             []*otlptracev1.ResourceSpans
@@ -4550,7 +4924,7 @@ func TestExport(t *testing.T) {
 	}{
 		{
 			name:              "error when unauthorized",
-			identity:          TestNop(),
+			identity:          authtest.TestNop(),
 			errAssertion:      require.Error,
 			uploadedAssertion: require.Empty,
 			spans:             make([]*otlptracev1.ResourceSpans, 1),
@@ -4558,13 +4932,13 @@ func TestExport(t *testing.T) {
 		},
 		{
 			name:              "nop for empty spans",
-			identity:          TestBuiltin(types.RoleNode),
+			identity:          authtest.TestBuiltin(types.RoleNode),
 			errAssertion:      require.NoError,
 			uploadedAssertion: require.Empty,
 		},
 		{
 			name:     "failure to forward spans",
-			identity: TestBuiltin(types.RoleNode),
+			identity: authtest.TestBuiltin(types.RoleNode),
 			errAssertion: func(t require.TestingT, err error, i ...interface{}) {
 				require.Error(t, err)
 				require.ErrorIs(t, trail.FromGRPC(trace.Unwrap(err)), uploadErr)
@@ -4578,14 +4952,14 @@ func TestExport(t *testing.T) {
 		},
 		{
 			name:              "forwarded spans get tagged for system roles",
-			identity:          TestBuiltin(types.RoleProxy),
+			identity:          authtest.TestBuiltin(types.RoleProxy),
 			errAssertion:      require.NoError,
 			spans:             testSpans,
 			uploadedAssertion: validateTaggedSpans(fmt.Sprintf("%s.localhost:%s", types.RoleProxy, types.RoleProxy)),
 		},
 		{
 			name:              "forwarded spans get tagged for users",
-			identity:          TestUser(user),
+			identity:          authtest.TestUser(user),
 			errAssertion:      require.NoError,
 			spans:             testSpans,
 			uploadedAssertion: validateTaggedSpans(user),
@@ -4598,12 +4972,13 @@ func TestExport(t *testing.T) {
 			t.Parallel()
 
 			ctx := context.Background()
-			as, err := NewTestAuthServer(TestAuthServerConfig{
+			as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir:         t.TempDir(),
 				Clock:       clockwork.NewFakeClock(),
 				TraceClient: &tt.mockTraceClient,
 			})
 			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 			srv, err := as.NewTestTLSServer()
 			require.NoError(t, err)
@@ -4611,12 +4986,12 @@ func TestExport(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, srv.Close()) })
 
 			// Create a fake user.
-			_, _, err = CreateUserAndRole(srv.Auth(), user, []string{"role"}, nil)
+			_, _, err = authtest.CreateUserAndRole(srv.Auth(), user, []string{"role"}, nil)
 			require.NoError(t, err)
 
 			// Setup the server
 			if tt.authorizer != nil {
-				srv.TLSServer.grpcServer.Authorizer = tt.authorizer
+				srv.TLSServer.GRPCServer().Authorizer = tt.authorizer
 				require.NoError(t, err)
 			}
 
@@ -4639,7 +5014,7 @@ func TestExport(t *testing.T) {
 // request if the calling user does not have permissions to create or update
 // a SAML connector.
 func TestSAMLValidation(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.SAML: {Enabled: true},
@@ -4704,9 +5079,9 @@ func TestSAMLValidation(t *testing.T) {
 				require.NoError(t, err)
 			}))
 
-			role, err := CreateRole(ctx, server.Auth(), "test_role", types.RoleSpecV6{Allow: tc.allow})
+			role, err := authtest.CreateRole(ctx, server.Auth(), "test_role", types.RoleSpecV6{Allow: tc.allow})
 			require.NoError(t, err)
-			user, err := CreateUser(ctx, server.Auth(), "test_user", role)
+			user, err := authtest.CreateUser(ctx, server.Auth(), "test_user", role)
 			require.NoError(t, err)
 
 			connector, err := types.NewSAMLConnector("test_connector", types.SAMLConnectorSpecV2{
@@ -4719,7 +5094,7 @@ func TestSAMLValidation(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			client, err := server.NewClient(TestUser(user.GetName()))
+			client, err := server.NewClient(authtest.TestUser(user.GetName()))
 			require.NoError(t, err)
 
 			_, err = client.UpsertSAMLConnector(ctx, connector)
@@ -4759,9 +5134,9 @@ func TestGRPCServer_GetInstallers(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 	server := newTestTLSServer(t)
-	grpc := server.TLSServer.grpcServer
+	grpc := server.TLSServer.GRPCServer()
 
-	user := TestAdmin()
+	user := authtest.TestAdmin()
 	ctx = authz.ContextWithUser(ctx, user.I)
 
 	tests := []struct {
@@ -4840,14 +5215,35 @@ func TestGRPCServer_GetInstallers(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			outputInstallerList, err := grpc.GetInstallers(ctx, &emptypb.Empty{})
-			require.NoError(t, err)
-			outputInstallers := make(map[string]string, len(tc.expectedInstallers))
-			for _, installer := range outputInstallerList.Installers {
-				outputInstallers[installer.GetName()] = installer.GetScript()
-			}
+			t.Run("GetInstallers", func(t *testing.T) {
+				outputInstallerList, err := grpc.GetInstallers(ctx, &emptypb.Empty{})
+				require.NoError(t, err)
+				outputInstallers := make(map[string]string, len(tc.expectedInstallers))
+				for _, installer := range outputInstallerList.Installers {
+					outputInstallers[installer.GetName()] = installer.GetScript()
+				}
+
+				require.Equal(t, tc.expectedInstallers, outputInstallers)
+			})
+
+			t.Run("ListInstallers", func(t *testing.T) {
+				// no limits, returns all
+				outputInstallerList, err := grpc.ListInstallers(ctx, &proto.ListInstallersRequest{})
+				require.NoError(t, err)
+				outputInstallers := make(map[string]string, len(tc.expectedInstallers))
+				for _, installer := range outputInstallerList.Installers {
+					outputInstallers[installer.GetName()] = installer.GetScript()
+				}
+
+				require.Equal(t, tc.expectedInstallers, outputInstallers)
 
-			require.Equal(t, tc.expectedInstallers, outputInstallers)
+				page1Resp, err := grpc.ListInstallers(ctx, &proto.ListInstallersRequest{PageSize: 1})
+				require.NoError(t, err)
+				page2Resp, err := grpc.ListInstallers(ctx, &proto.ListInstallersRequest{PageToken: page1Resp.GetNextPageToken()})
+				require.NoError(t, err)
+
+				require.Equal(t, outputInstallerList.Installers, append(page1Resp.Installers, page2Resp.Installers...))
+			})
 		})
 	}
 }
@@ -4908,10 +5304,10 @@ func TestRoleVersions(t *testing.T) {
 		},
 	})
 
-	user, err := CreateUser(context.Background(), srv.Auth(), "user", enabledRole, disabledRole, undefinedRole)
+	user, err := authtest.CreateUser(context.Background(), srv.Auth(), "user", enabledRole, disabledRole, undefinedRole)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	for _, tc := range []struct {
@@ -5124,7 +5520,7 @@ func TestUpsertApplicationServerOrigin(t *testing.T) {
 	parentCtx := context.Background()
 	server := newTestTLSServer(t)
 
-	admin := TestAdmin()
+	admin := authtest.TestAdmin()
 
 	client, err := server.NewClient(admin)
 	require.NoError(t, err)
@@ -5155,7 +5551,7 @@ func TestUpsertApplicationServerOrigin(t *testing.T) {
 	require.ErrorContains(t, err, "only the Okta role can create app servers and apps with an Okta origin")
 
 	// Okta origin should not work with instance and node roles.
-	client, err = server.NewClient(TestIdentity{
+	client, err = server.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role: types.RoleInstance,
 			AdditionalSystemRoles: []types.SystemRole{
@@ -5172,7 +5568,7 @@ func TestUpsertApplicationServerOrigin(t *testing.T) {
 	require.ErrorContains(t, err, "only the Okta role can create app servers and apps with an Okta origin")
 
 	// Okta origin should work with Okta role in role field.
-	node := TestIdentity{
+	node := authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role: types.RoleOkta,
 			AdditionalSystemRoles: []types.SystemRole{
@@ -5189,7 +5585,7 @@ func TestUpsertApplicationServerOrigin(t *testing.T) {
 	require.NoError(t, err)
 
 	// Okta origin should work with Okta role in additional system roles.
-	node = TestIdentity{
+	node = authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role: types.RoleInstance,
 			AdditionalSystemRoles: []types.SystemRole{
@@ -5208,7 +5604,7 @@ func TestUpsertApplicationServerOrigin(t *testing.T) {
 }
 
 func TestGetAccessGraphConfig(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.Policy: {Enabled: true},
@@ -5216,13 +5612,13 @@ func TestGetAccessGraphConfig(t *testing.T) {
 		},
 	})
 	server := newTestTLSServer(t,
-		withAccessGraphConfig(AccessGraphConfig{
+		withAccessGraphConfig(auth.AccessGraphConfig{
 			Enabled: true,
 			CA:      []byte("ca"),
 			Address: "addr",
 		}),
 	)
-	user, _, err := CreateUserAndRole(server.Auth(), "test", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(server.Auth(), "test", []string{"role"}, nil)
 	require.NoError(t, err)
 	positiveResponse := &clusterconfigpb.AccessGraphConfig{
 		Enabled:           true,
@@ -5266,7 +5662,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-			client, err := server.NewClient(TestIdentity{
+			client, err := server.NewClient(authtest.TestIdentity{
 				I: test.identity,
 			})
 			require.NoError(t, err)
@@ -5279,7 +5675,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
 
 func TestGetVnetConfig(t *testing.T) {
 	server := newTestTLSServer(t)
-	user, _, err := CreateUserAndRole(server.Auth(), "test", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(server.Auth(), "test", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	// Create newConfig.
@@ -5295,7 +5691,7 @@ func TestGetVnetConfig(t *testing.T) {
 	identity := authz.LocalUser{
 		Username: user.GetName(),
 	}
-	client, err := server.NewClient(TestIdentity{I: identity})
+	client, err := server.NewClient(authtest.TestIdentity{I: identity})
 	require.NoError(t, err)
 	actualConfig, err := client.GetVnetConfig(t.Context())
 	require.NoError(t, err)
@@ -5310,7 +5706,7 @@ func TestCreateAuditStreamLimit(t *testing.T) {
 	defer cancel()
 
 	server := newTestTLSServer(t)
-	clt, err := server.NewClient(TestServerID(types.RoleNode, uuid.NewString()))
+	clt, err := server.NewClient(authtest.TestServerID(types.RoleNode, uuid.NewString()))
 	require.NoError(t, err)
 
 	// HACK(espadolini): we're piggybacking on the prometheus counter which
@@ -5322,7 +5718,7 @@ func TestCreateAuditStreamLimit(t *testing.T) {
 	// server uses a discard emitter which never ends up sending anything
 	getAcceptedTotal := func() int {
 		var m prom_client_model.Metric
-		require.NoError(t, createAuditStreamAcceptedTotalMetric.Write(&m))
+		require.NoError(t, auth.CreateAuditStreamAcceptedTotalMetric.Write(&m))
 		return int(m.Counter.GetValue())
 	}
 	currentAcceptedTotal := getAcceptedTotal()
@@ -5365,6 +5761,14 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 	downgradev7comptibleK8sResourcesRole := newRole("downgrade_v7_compatible_k8s_resources", types.V8, types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			KubernetesResources: []types.KubernetesResource{
+				{
+					// Full wildcard has the same behavior in v7 and v8, so we can keep it.
+					Kind:      types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Verbs:     []string{types.Wildcard},
+					APIGroup:  types.Wildcard,
+				},
 				{
 					Kind:      "pods",
 					Name:      types.Wildcard,
@@ -5460,6 +5864,7 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 		Allow: types.RoleConditions{
 			KubernetesResources: []types.KubernetesResource{
 				{
+					// In v17, this would also grant access to cluster-wide resources, so we need to reject.
 					Kind:      types.Wildcard,
 					Name:      "foo",
 					Namespace: "bar",
@@ -5473,6 +5878,7 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 		Allow: types.RoleConditions{
 			KubernetesResources: []types.KubernetesResource{
 				{
+					// In v17, this wasn't supported.
 					Kind:      types.Wildcard,
 					Name:      "bar",
 					Namespace: "", // Cluster wide.
@@ -5534,7 +5940,73 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 			},
 		},
 	})
-	user, err := CreateUser(context.Background(), srv.Auth(), "user",
+	downgradev7ValidAccessRequest := newRole("downgrade_v7_valid_access_request", types.V8, types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				SearchAsRoles: []string{"test_role_1"},
+				KubernetesResources: []types.RequestKubernetesResource{
+					{
+						Kind: "pods",
+					},
+					{
+						Kind:     "clusterroles",
+						APIGroup: "rbac.authorization.k8s.io",
+					},
+					{
+						Kind:     "deployments",
+						APIGroup: "*",
+					},
+				},
+			},
+		},
+		Deny: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				SearchAsRoles: []string{"test_role_1"},
+				KubernetesResources: []types.RequestKubernetesResource{
+					{
+						Kind: "pods",
+					},
+					{
+						Kind:     "clusterroles",
+						APIGroup: "rbac.authorization.k8s.io",
+					},
+					{
+						Kind:     "deployments",
+						APIGroup: "*",
+					},
+				},
+			},
+		},
+	})
+
+	downgradeInvalidAccessRequestAllow := newRole("downgrade_v7_invalid_access_request_allow", types.V8, types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				SearchAsRoles: []string{"test_role_1"},
+				KubernetesResources: []types.RequestKubernetesResource{
+					{
+						Kind:     "crontabs",
+						APIGroup: "stable.example.com",
+					},
+				},
+			},
+		},
+	})
+	downgradeInvalidAccessRequestDeny := newRole("downgrade_v7_invalid_access_request_deny", types.V8, types.RoleSpecV6{
+		Deny: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				SearchAsRoles: []string{"test_role_1"},
+				KubernetesResources: []types.RequestKubernetesResource{
+					{
+						Kind:     "crontabs",
+						APIGroup: "stable.example.com",
+					},
+				},
+			},
+		},
+	})
+
+	user, err := authtest.CreateUser(context.Background(), srv.Auth(), "user",
 		testRole1,
 		downgradev7comptibleK8sResourcesRole,
 		downgradev7incompatibleK8sResourcesRole,
@@ -5542,10 +6014,13 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 		downgradev7incompatibleNamespacedWildcard,
 		downgradev7incompatibleClusterWideWildcard,
 		downgradev7mixedK8sResourcesRole,
+		downgradev7ValidAccessRequest,
+		downgradeInvalidAccessRequestAllow,
+		downgradeInvalidAccessRequestDeny,
 	)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(TestUser(user.GetName()))
+	client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	for _, tc := range []struct {
@@ -5572,6 +6047,12 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 			expectedRole: newRole(downgradev7comptibleK8sResourcesRole.GetName(), types.V7, types.RoleSpecV6{
 				Allow: types.RoleConditions{
 					KubernetesResources: []types.KubernetesResource{
+						{
+							Kind:      types.Wildcard,
+							Name:      types.Wildcard,
+							Namespace: types.Wildcard,
+							Verbs:     []string{types.Wildcard},
+						},
 						{
 							Kind:      types.KindKubePod,
 							Name:      types.Wildcard,
@@ -5811,6 +6292,139 @@ func TestRoleVersionV8ToV7Downgrade(t *testing.T) {
 			}),
 			expectDowngraded: true,
 		},
+		{
+			desc: "downgrade valid access request role version to v7",
+			clientVersions: []string{
+				"17.2.7",
+			},
+			inputRole: downgradev7ValidAccessRequest,
+			expectedRole: newRole(downgradev7ValidAccessRequest.GetName(), types.V7, types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Request: &types.AccessRequestConditions{
+						SearchAsRoles: []string{"test_role_1"},
+						KubernetesResources: []types.RequestKubernetesResource{
+							{
+								Kind: types.KindKubePod,
+							},
+							{
+								Kind: types.KindKubeClusterRole,
+							},
+							{
+								Kind: types.KindKubeDeployment,
+							},
+						},
+					},
+				},
+				Deny: types.RoleConditions{
+					Request: &types.AccessRequestConditions{
+						SearchAsRoles: []string{"test_role_1"},
+						KubernetesResources: []types.RequestKubernetesResource{
+							{
+								Kind: types.KindKubePod,
+							},
+							{
+								Kind: types.KindKubeClusterRole,
+							},
+							{
+								Kind: types.KindKubeDeployment,
+							},
+						},
+					},
+				},
+
+				Options: types.RoleOptions{
+					IDP: &types.IdPOptions{
+						SAML: &types.IdPSAMLOptions{
+							Enabled: types.NewBoolOption(false),
+						},
+					},
+				},
+			}),
+			expectDowngraded: true,
+		},
+		{
+			desc: "downgrade invalid access request allow role version to v7",
+			clientVersions: []string{
+				"17.2.7",
+			},
+			inputRole: downgradeInvalidAccessRequestAllow,
+			expectedRole: newRole(downgradeInvalidAccessRequestAllow.GetName(), types.V7, types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Request: &types.AccessRequestConditions{
+						SearchAsRoles:       []string{"test_role_1"},
+						KubernetesResources: nil,
+					},
+				},
+				Deny: types.RoleConditions{
+					KubernetesLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					KubernetesResources: []types.KubernetesResource{
+						{
+							Kind:      types.Wildcard,
+							Name:      types.Wildcard,
+							Namespace: types.Wildcard,
+							Verbs:     []string{types.Wildcard},
+						},
+					},
+					Request: &types.AccessRequestConditions{
+						KubernetesResources: []types.RequestKubernetesResource{
+							{
+								Kind: types.Wildcard,
+							},
+						},
+					},
+				},
+
+				Options: types.RoleOptions{
+					IDP: &types.IdPOptions{
+						SAML: &types.IdPSAMLOptions{
+							Enabled: types.NewBoolOption(false),
+						},
+					},
+				},
+			}),
+			expectDowngraded: true,
+		},
+		{
+			desc: "downgrade invalid access request deny role version to v7",
+			clientVersions: []string{
+				"17.2.7",
+			},
+			inputRole: downgradeInvalidAccessRequestDeny,
+			expectedRole: newRole(downgradeInvalidAccessRequestDeny.GetName(), types.V7, types.RoleSpecV6{
+				Deny: types.RoleConditions{
+					KubernetesLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					KubernetesResources: []types.KubernetesResource{
+						{
+							Kind:      types.Wildcard,
+							Name:      types.Wildcard,
+							Namespace: types.Wildcard,
+							Verbs:     []string{types.Wildcard},
+						},
+					},
+					Request: &types.AccessRequestConditions{
+						SearchAsRoles: []string{"test_role_1"},
+						KubernetesResources: []types.RequestKubernetesResource{
+							{
+								Kind: types.Wildcard,
+							},
+						},
+					},
+				},
+
+				Options: types.RoleOptions{
+					IDP: &types.IdPOptions{
+						SAML: &types.IdPSAMLOptions{
+							Enabled: types.NewBoolOption(false),
+						},
+					},
+				},
+			}),
+			expectDowngraded: true,
+		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			for _, clientVersion := range tc.clientVersions {
diff --git a/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go b/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
index 1c47661e9b65b..381da2a9fa00a 100644
--- a/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
+++ b/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -39,11 +40,11 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -98,7 +99,8 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 				resp, err := clt.ServiceUnderTest.ListHealthCheckConfigs(ctx, &healthcheckconfigv1.ListHealthCheckConfigsRequest{})
 				if err == nil {
 					require.NotNil(t, resp)
-					require.Len(t, resp.Configs, 2, "the test bootstrapped exactly 2 health_check_config resources")
+					require.Len(t, resp.Configs, 2+teleport.VirtualDefaultHealthCheckConfigCount,
+						"expected 2 inserted and virtual defaults")
 				}
 				return err
 			},
@@ -199,7 +201,7 @@ func (c *accessTest) run(t *testing.T) {
 		ctx, clt := c.setup(t, spec)
 		err := c.actionFn(t, ctx, clt)
 		require.Error(t, err)
-		require.IsType(t, trace.AccessDenied(""), err)
+		require.True(t, trace.IsAccessDenied(err))
 	})
 
 	t.Run(fmt.Sprintf("%s is denied", c.name), func(t *testing.T) {
@@ -210,7 +212,7 @@ func (c *accessTest) run(t *testing.T) {
 		ctx, clt := c.setup(t, spec)
 		err := c.actionFn(t, ctx, clt)
 		require.Error(t, err)
-		require.IsType(t, trace.AccessDenied(""), err)
+		require.True(t, trace.IsAccessDenied(err))
 	})
 }
 
diff --git a/lib/auth/helpers.go b/lib/auth/helpers.go
deleted file mode 100644
index 1dc6e73a0204e..0000000000000
--- a/lib/auth/helpers.go
+++ /dev/null
@@ -1,1540 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"net"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/coreos/go-semver/semver"
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/breaker"
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/constants"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth/accesspoint"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/state"
-	authority "github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/cache"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/events/eventstest"
-	"github.com/gravitational/teleport/lib/limiter"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/services/suite"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// TestAuthServerConfig is auth server test config
-type TestAuthServerConfig struct {
-	// ClusterName is cluster name
-	ClusterName string
-	// ClusterID is the cluster ID; optional - sets to random UUID string if not present
-	ClusterID string
-	// Dir is directory for local backend
-	Dir string
-	// AcceptedUsage is an optional list of restricted
-	// server usage
-	AcceptedUsage []string
-	// CipherSuites is the list of ciphers that the server supports.
-	CipherSuites []uint16
-	// Clock is used to control time in tests.
-	Clock clockwork.Clock
-	// ClusterNetworkingConfig allows a test to change the default
-	// networking configuration.
-	ClusterNetworkingConfig types.ClusterNetworkingConfig
-	// Streamer allows a test to set its own session recording streamer.
-	Streamer events.Streamer
-	// AuditLog allows a test to configure its own audit log.
-	AuditLog events.AuditLogSessionStreamer
-	// TraceClient allows a test to configure the trace client
-	TraceClient otlptrace.Client
-	// AuthPreferenceSpec is custom initial AuthPreference spec for the test.
-	AuthPreferenceSpec *types.AuthPreferenceSpecV2
-	// CacheEnabled enables the primary auth server cache.
-	CacheEnabled bool
-	// RunWhileLockedRetryInterval is the interval to retry the run while locked
-	// operation.
-	RunWhileLockedRetryInterval time.Duration
-	// FIPS means the cluster should run in FIPS mode.
-	FIPS bool
-	// KeystoreConfig is configuration for the CA keystore.
-	KeystoreConfig servicecfg.KeystoreConfig
-}
-
-// CheckAndSetDefaults checks and sets defaults
-func (cfg *TestAuthServerConfig) CheckAndSetDefaults() error {
-	if cfg.ClusterName == "" {
-		cfg.ClusterName = "localhost"
-	}
-	if cfg.Dir == "" {
-		return trace.BadParameter("missing parameter Dir")
-	}
-	if cfg.Clock == nil {
-		cfg.Clock = clockwork.NewFakeClock()
-	}
-	if len(cfg.CipherSuites) == 0 {
-		cfg.CipherSuites = utils.DefaultCipherSuites()
-	}
-	if cfg.AuthPreferenceSpec == nil {
-		cfg.AuthPreferenceSpec = &types.AuthPreferenceSpecV2{
-			Type:         constants.Local,
-			SecondFactor: constants.SecondFactorOff,
-		}
-	}
-	return nil
-}
-
-// TestServer defines the set of server components for a test
-type TestServer struct {
-	TLS        *TestTLSServer
-	AuthServer *TestAuthServer
-}
-
-// TestServerConfig defines the configuration for all server components
-type TestServerConfig struct {
-	// Auth specifies the auth server configuration
-	Auth TestAuthServerConfig
-	// TLS optionally specifies the configuration for the TLS server.
-	// If unspecified, will be generated automatically
-	TLS *TestTLSServerConfig
-}
-
-// NewTestServer creates a new test server configuration
-func NewTestServer(cfg TestServerConfig) (*TestServer, error) {
-	authServer, err := NewTestAuthServer(cfg.Auth)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// Set the (test) auth server in cfg.TLS and set any defaults that
-	// are not set.
-	tlsCfg := cfg.TLS
-	if tlsCfg == nil {
-		tlsCfg = &TestTLSServerConfig{}
-	}
-	if tlsCfg.APIConfig == nil {
-		tlsCfg.APIConfig = &APIConfig{}
-	}
-
-	tlsCfg.AuthServer = authServer
-	tlsCfg.APIConfig.AuthServer = authServer.AuthServer
-
-	if tlsCfg.APIConfig.Authorizer == nil {
-		tlsCfg.APIConfig.Authorizer = authServer.Authorizer
-	}
-	if tlsCfg.APIConfig.AuditLog == nil {
-		tlsCfg.APIConfig.AuditLog = authServer.AuditLog
-	}
-	if tlsCfg.APIConfig.Emitter == nil {
-		tlsCfg.APIConfig.Emitter = authServer.AuthServer
-	}
-	if tlsCfg.AcceptedUsage == nil {
-		tlsCfg.AcceptedUsage = authServer.AcceptedUsage
-	}
-
-	tlsServer, err := NewTestTLSServer(*tlsCfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &TestServer{
-		AuthServer: authServer,
-		TLS:        tlsServer,
-	}, nil
-}
-
-// Auth returns the underlying auth server instance
-func (a *TestServer) Auth() *Server {
-	return a.AuthServer.AuthServer
-}
-
-func (a *TestServer) NewClient(identity TestIdentity) (*authclient.Client, error) {
-	return a.TLS.NewClient(identity)
-}
-
-func (a *TestServer) ClusterName() string {
-	return a.TLS.ClusterName()
-}
-
-// Shutdown stops this server instance gracefully
-func (a *TestServer) Shutdown(ctx context.Context) error {
-	return trace.NewAggregate(
-		a.TLS.Shutdown(ctx),
-		a.AuthServer.Close(),
-	)
-}
-
-// WithClock is a functional server option that sets the server's clock
-func WithClock(clock clockwork.Clock) ServerOption {
-	return func(s *Server) error {
-		s.clock = clock
-		return nil
-	}
-}
-
-// TestAuthServer is auth server using local filesystem backend
-// and test certificate authority key generation that speeds up
-// keygen by using the same private key
-type TestAuthServer struct {
-	// TestAuthServer config is configuration used for auth server setup
-	TestAuthServerConfig
-	// AuthServer is an auth server
-	AuthServer *Server
-	// AuditLog is an event audit log
-	AuditLog events.AuditLogSessionStreamer
-	// Backend is a backend for auth server
-	Backend backend.Backend
-	// Authorizer is an authorizer used in tests
-	Authorizer authz.Authorizer
-	// LockWatcher is a lock watcher used in tests.
-	LockWatcher *services.LockWatcher
-}
-
-// NewTestAuthServer returns new instances of Auth server
-func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
-	ctx := context.Background()
-
-	if err := cfg.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	srv := &TestAuthServer{
-		TestAuthServerConfig: cfg,
-	}
-	b, err := memory.New(memory.Config{
-		Context:   ctx,
-		Clock:     cfg.Clock,
-		EventsOff: false,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Wrap backend in sanitizer like in production.
-	srv.Backend = backend.NewSanitizer(b)
-
-	if cfg.AuditLog != nil {
-		srv.AuditLog = cfg.AuditLog
-	} else {
-		localLog, err := events.NewAuditLog(events.AuditLogConfig{
-			DataDir:       cfg.Dir,
-			ServerID:      cfg.ClusterName,
-			Clock:         cfg.Clock,
-			UploadHandler: eventstest.NewMemoryUploader(),
-		})
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		srv.AuditLog = localLog
-	}
-
-	access := local.NewAccessService(srv.Backend)
-	identity, err := local.NewTestIdentityService(srv.Backend)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	emitter, err := events.NewCheckingEmitter(events.CheckingEmitterConfig{
-		Inner: srv.AuditLog,
-		Clock: cfg.Clock,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	accessLists, err := local.NewAccessListService(srv.Backend, cfg.Clock, local.WithRunWhileLockedRetryInterval(cfg.RunWhileLockedRetryInterval))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-		ClusterName: cfg.ClusterName,
-		ClusterID:   cfg.ClusterID,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.AuthServer, err = NewServer(&InitConfig{
-		DataDir:                cfg.Dir,
-		Backend:                srv.Backend,
-		VersionStorage:         NewFakeTeleportVersion(),
-		Authority:              authority.NewWithClock(cfg.Clock),
-		Access:                 access,
-		Identity:               identity,
-		AuditLog:               srv.AuditLog,
-		Streamer:               cfg.Streamer,
-		SkipPeriodicOperations: true,
-		Emitter:                emitter,
-		TraceClient:            cfg.TraceClient,
-		Clock:                  cfg.Clock,
-		ClusterName:            clusterName,
-		HostUUID:               uuid.New().String(),
-		AccessLists:            accessLists,
-		FIPS:                   cfg.FIPS,
-		KeyStoreConfig:         cfg.KeystoreConfig,
-	},
-		WithClock(cfg.Clock),
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Reduce auth.Server bcrypt costs when testing.
-	minCost := bcrypt.MinCost
-	srv.AuthServer.bcryptCostOverride = &minCost
-
-	if cfg.CacheEnabled {
-		if err := InitTestAuthCache(TestAuthCacheParams{
-			AuthServer: srv.AuthServer,
-			Unstarted:  true,
-		}); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	err = srv.AuthServer.SetClusterAuditConfig(ctx, types.DefaultClusterAuditConfig())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	clusterNetworkingCfg := cfg.ClusterNetworkingConfig
-	if clusterNetworkingCfg == nil {
-		clusterNetworkingCfg = types.DefaultClusterNetworkingConfig()
-	}
-
-	_, err = srv.AuthServer.UpsertClusterNetworkingConfig(ctx, clusterNetworkingCfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	_, err = srv.AuthServer.UpsertSessionRecordingConfig(ctx, types.DefaultSessionRecordingConfig())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	err = srv.AuthServer.SetClusterName(clusterName)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	authPreference, err := types.NewAuthPreferenceFromConfigFile(*cfg.AuthPreferenceSpec)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if authPreference.GetSignatureAlgorithmSuite() == types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_UNSPECIFIED {
-		authPreference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1)
-	}
-	_, err = srv.AuthServer.UpsertAuthPreference(ctx, authPreference)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	token, err := types.NewProvisionTokenFromSpec("static-token", time.Unix(0, 0).UTC(), types.ProvisionTokenSpecV2{
-		Roles: types.SystemRoles{types.RoleNode},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// set static tokens
-	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
-		StaticTokens: []types.ProvisionTokenV1{
-			*token.V1(),
-		},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	err = srv.AuthServer.SetStaticTokens(staticTokens)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// create the default role
-	if _, err := srv.AuthServer.UpsertRole(ctx, services.NewImplicitRole()); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Setup certificate and signing authorities.
-	for _, caType := range types.CertAuthTypes {
-		if err = srv.AuthServer.UpsertCertAuthority(ctx, suite.NewTestCAWithConfig(suite.TestCAConfig{
-			Type:        caType,
-			ClusterName: srv.ClusterName,
-			Clock:       cfg.Clock,
-		})); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	srv.LockWatcher, err = services.NewLockWatcher(ctx, services.LockWatcherConfig{
-		ResourceWatcherConfig: services.ResourceWatcherConfig{
-			Component:      teleport.ComponentAuth,
-			Client:         srv.AuthServer,
-			Clock:          cfg.Clock,
-			MaxRetryPeriod: defaults.HighResPollingPeriod,
-		},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	srv.AuthServer.SetLockWatcher(srv.LockWatcher)
-
-	unifiedResourcesCache, err := services.NewUnifiedResourceCache(srv.AuthServer.CloseContext(), services.UnifiedResourceCacheConfig{
-		ResourceWatcherConfig: services.ResourceWatcherConfig{
-			QueueSize:    defaults.UnifiedResourcesQueueSize,
-			Component:    teleport.ComponentUnifiedResource,
-			Client:       srv.AuthServer,
-			MaxStaleness: time.Minute,
-		},
-		ResourceGetter: srv.AuthServer,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.AuthServer.SetUnifiedResourcesCache(unifiedResourcesCache)
-
-	accessRequestCache, err := services.NewAccessRequestCache(services.AccessRequestCacheConfig{
-		Events: srv.AuthServer.Services,
-		Getter: srv.AuthServer.Services,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.AuthServer.SetAccessRequestCache(accessRequestCache)
-
-	headlessAuthenticationWatcher, err := local.NewHeadlessAuthenticationWatcher(srv.AuthServer.CloseContext(), local.HeadlessAuthenticationWatcherConfig{
-		Backend: b,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if err := headlessAuthenticationWatcher.WaitInit(ctx); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	srv.AuthServer.SetHeadlessAuthenticationWatcher(headlessAuthenticationWatcher)
-
-	srv.Authorizer, err = authz.NewAuthorizer(authz.AuthorizerOpts{
-		ClusterName:         srv.ClusterName,
-		AccessPoint:         srv.AuthServer,
-		ReadOnlyAccessPoint: srv.AuthServer.ReadOnlyCache,
-		LockWatcher:         srv.LockWatcher,
-		// AuthServer does explicit device authorization checks.
-		DeviceAuthorization: authz.DeviceAuthorizationOpts{
-			DisableGlobalMode: true,
-			DisableRoleMode:   true,
-		},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	userNotificationCache, err := services.NewUserNotificationCache(services.NotificationCacheConfig{
-		Events: srv.AuthServer.Services,
-		Getter: srv.AuthServer.Cache,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.AuthServer.SetUserNotificationCache(userNotificationCache)
-
-	globalNotificationCache, err := services.NewGlobalNotificationCache(services.NotificationCacheConfig{
-		Events: srv.AuthServer.Services,
-		Getter: srv.AuthServer.Cache,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.AuthServer.SetGlobalNotificationCache(globalNotificationCache)
-
-	// Auth initialization is done (including creation/updating of all singleton
-	// configuration resources) so now we can start the cache.
-	if c, ok := srv.AuthServer.Cache.(*cache.Cache); ok {
-		if err := c.Start(); err != nil {
-			return nil, trace.NewAggregate(err, c.Close())
-		}
-	}
-	return srv, nil
-}
-
-type TestAuthCacheParams struct {
-	AuthServer *Server
-	Unstarted  bool
-}
-
-func InitTestAuthCache(p TestAuthCacheParams) error {
-	c, err := accesspoint.NewCache(accesspoint.Config{
-		Context:      p.AuthServer.CloseContext(),
-		Setup:        cache.ForAuth,
-		CacheName:    []string{teleport.ComponentAuth},
-		EventsSystem: true,
-		Unstarted:    p.Unstarted,
-
-		Access:                  p.AuthServer.Services.Access,
-		AccessLists:             p.AuthServer.Services.AccessLists,
-		AccessMonitoringRules:   p.AuthServer.Services.AccessMonitoringRules,
-		AppSession:              p.AuthServer.Services.Identity,
-		Apps:                    p.AuthServer.Services.Apps,
-		ClusterConfig:           p.AuthServer.Services.ClusterConfigurationInternal,
-		CrownJewels:             p.AuthServer.Services.CrownJewels,
-		DatabaseObjects:         p.AuthServer.Services.DatabaseObjects,
-		DatabaseServices:        p.AuthServer.Services.DatabaseServices,
-		Databases:               p.AuthServer.Services.Databases,
-		DiscoveryConfigs:        p.AuthServer.Services.DiscoveryConfigs,
-		DynamicAccess:           p.AuthServer.Services.DynamicAccessExt,
-		Events:                  p.AuthServer.Services.Events,
-		Integrations:            p.AuthServer.Services.Integrations,
-		KubeWaitingContainers:   p.AuthServer.Services.KubeWaitingContainer,
-		Kubernetes:              p.AuthServer.Services.Kubernetes,
-		Notifications:           p.AuthServer.Services.Notifications,
-		Okta:                    p.AuthServer.Services.Okta,
-		Presence:                p.AuthServer.Services.PresenceInternal,
-		Provisioner:             p.AuthServer.Services.Provisioner,
-		Restrictions:            p.AuthServer.Services.Restrictions,
-		SAMLIdPServiceProviders: p.AuthServer.Services.SAMLIdPServiceProviders,
-		SecReports:              p.AuthServer.Services.SecReports,
-		SnowflakeSession:        p.AuthServer.Services.Identity,
-		SPIFFEFederations:       p.AuthServer.Services.SPIFFEFederations,
-		StaticHostUsers:         p.AuthServer.Services.StaticHostUser,
-		Trust:                   p.AuthServer.Services.TrustInternal,
-		UserGroups:              p.AuthServer.Services.UserGroups,
-		UserTasks:               p.AuthServer.Services.UserTasks,
-		UserLoginStates:         p.AuthServer.Services.UserLoginStates,
-		Users:                   p.AuthServer.Services.Identity,
-		WebSession:              p.AuthServer.Services.Identity.WebSessions(),
-		WebToken:                p.AuthServer.Services.WebTokens(),
-		WorkloadIdentity:        p.AuthServer.Services.WorkloadIdentities,
-		DynamicWindowsDesktops:  p.AuthServer.Services.DynamicWindowsDesktops,
-		WindowsDesktops:         p.AuthServer.Services.WindowsDesktops,
-		AutoUpdateService:       p.AuthServer.Services.AutoUpdateService,
-		ProvisioningStates:      p.AuthServer.Services.ProvisioningStates,
-		IdentityCenter:          p.AuthServer.Services.IdentityCenter,
-		PluginStaticCredentials: p.AuthServer.Services.PluginStaticCredentials,
-		GitServers:              p.AuthServer.Services.GitServers,
-		HealthCheckConfig:       p.AuthServer.Services.HealthCheckConfig,
-	})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	p.AuthServer.Cache = c
-	return nil
-}
-
-func (a *TestAuthServer) Close() error {
-	defer a.LockWatcher.Close()
-
-	return trace.NewAggregate(
-		a.AuthServer.Close(),
-		a.Backend.Close(),
-		a.AuditLog.Close(),
-	)
-}
-
-// GenerateUserCert takes the public key in the OpenSSH `authorized_keys`
-// plain text format, signs it using User Certificate Authority signing key and returns the
-// resulting certificate.
-func (a *TestAuthServer) GenerateUserCert(key []byte, username string, ttl time.Duration, compatibility string) ([]byte, error) {
-	ctx := context.TODO()
-	user, err := a.AuthServer.GetUser(ctx, username, false)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	userState, err := a.AuthServer.GetUserOrLoginState(ctx, user.GetName())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	accessInfo := services.AccessInfoFromUserState(userState)
-	checker, err := services.NewAccessChecker(accessInfo, a.ClusterName, a.AuthServer)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	certs, err := a.AuthServer.generateUserCert(ctx, certRequest{
-		user:          userState,
-		ttl:           ttl,
-		compatibility: compatibility,
-		sshPublicKey:  key,
-		checker:       checker,
-		traits:        userState.GetTraits(),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return certs.SSH, nil
-}
-
-// PrivateKeyToPublicKeyTLS gets the TLS public key from a raw private key.
-func PrivateKeyToPublicKeyTLS(privateKey []byte) (tlsPublicKey []byte, err error) {
-	sshPrivate, err := ssh.ParseRawPrivateKey(privateKey)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	tlsPublicKey, err = tlsca.MarshalPublicKeyFromPrivateKeyPEM(sshPrivate)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return tlsPublicKey, nil
-}
-
-// generateCertificate generates certificate for identity,
-// returns private public key pair
-func generateCertificate(authServer *Server, identity TestIdentity) ([]byte, []byte, error) {
-	ctx := context.TODO()
-
-	key, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	privateKeyPEM, err := keys.MarshalPrivateKey(key)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	tlsPublicKeyPEM, err := keys.MarshalPublicKey(key.Public())
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	sshPublicKey, err := ssh.NewPublicKey(key.Public())
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	sshPublicKeyPEM := ssh.MarshalAuthorizedKey(sshPublicKey)
-
-	clusterName, err := authServer.GetClusterName(ctx)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	switch id := identity.I.(type) {
-	case authz.LocalUser:
-		user, err := authServer.GetUser(ctx, id.Username, false)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		userState, err := authServer.GetUserOrLoginState(ctx, user.GetName())
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		accessInfo := services.AccessInfoFromUserState(userState)
-		checker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), authServer)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		if identity.TTL == 0 {
-			identity.TTL = time.Hour
-		}
-
-		certs, err := authServer.generateUserCert(ctx, certRequest{
-			tlsPublicKey:     tlsPublicKeyPEM,
-			user:             userState,
-			ttl:              identity.TTL,
-			usage:            identity.AcceptedUsage,
-			routeToCluster:   identity.RouteToCluster,
-			checker:          checker,
-			traits:           userState.GetTraits(),
-			renewable:        identity.Renewable,
-			generation:       identity.Generation,
-			deviceExtensions: DeviceExtensions(id.Identity.DeviceExtensions),
-		})
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		return certs.TLS, privateKeyPEM, nil
-	case authz.BuiltinRole:
-		certs, err := authServer.GenerateHostCerts(ctx,
-			&proto.HostCertsRequest{
-				HostID:       id.Username,
-				NodeName:     id.Username,
-				Role:         id.Role,
-				PublicTLSKey: tlsPublicKeyPEM,
-				PublicSSHKey: sshPublicKeyPEM,
-				SystemRoles:  id.AdditionalSystemRoles,
-			})
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		return certs.TLS, privateKeyPEM, nil
-	case authz.RemoteBuiltinRole:
-		certs, err := authServer.GenerateHostCerts(ctx,
-			&proto.HostCertsRequest{
-				HostID:       id.Username,
-				NodeName:     id.Username,
-				Role:         id.Role,
-				PublicTLSKey: tlsPublicKeyPEM,
-				PublicSSHKey: sshPublicKeyPEM,
-			})
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		return certs.TLS, privateKeyPEM, nil
-	default:
-		return nil, nil, trace.BadParameter("identity of unknown type %T is unsupported", identity)
-	}
-}
-
-// NewCertificate returns new TLS credentials generated by test auth server
-func (a *TestAuthServer) NewCertificate(identity TestIdentity) (*tls.Certificate, error) {
-	cert, key, err := generateCertificate(a.AuthServer, identity)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	tlsCert, err := tls.X509KeyPair(cert, key)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &tlsCert, nil
-}
-
-// Clock returns clock used by auth server
-func (a *TestAuthServer) Clock() clockwork.Clock {
-	return a.AuthServer.GetClock()
-}
-
-// Trust adds other server host certificate authority as trusted
-func (a *TestAuthServer) Trust(ctx context.Context, remote *TestAuthServer, roleMap types.RoleMap) error {
-	remoteCA, err := remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.HostCA,
-		DomainName: remote.ClusterName,
-	}, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.DatabaseCA,
-		DomainName: remote.ClusterName,
-	}, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.DatabaseClientCA,
-		DomainName: remote.ClusterName,
-	}, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.OpenSSHCA,
-		DomainName: remote.ClusterName,
-	}, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.UserCA,
-		DomainName: remote.ClusterName,
-	}, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	remoteCA.SetRoleMap(roleMap)
-	err = a.AuthServer.UpsertCertAuthority(ctx, remoteCA)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-// NewTestTLSServer returns new test TLS server
-func (a *TestAuthServer) NewTestTLSServer(opts ...TestTLSServerOption) (*TestTLSServer, error) {
-	apiConfig := &APIConfig{
-		AuthServer: a.AuthServer,
-		Authorizer: a.Authorizer,
-		AuditLog:   a.AuditLog,
-		Emitter:    a.AuthServer,
-	}
-	cfg := TestTLSServerConfig{
-		APIConfig:     apiConfig,
-		AuthServer:    a,
-		AcceptedUsage: a.AcceptedUsage,
-	}
-	for _, o := range opts {
-		o(&cfg)
-	}
-	srv, err := NewTestTLSServer(cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return srv, nil
-}
-
-// TestTLSServerOption is a functional option passed to NewTestTLSServer
-type TestTLSServerOption func(*TestTLSServerConfig)
-
-// WithLimiterConfig sets connection and request limiter configuration.
-func WithLimiterConfig(config *limiter.Config) TestTLSServerOption {
-	return func(cfg *TestTLSServerConfig) {
-		cfg.Limiter = config
-	}
-}
-
-// WithAccessGraphConfig sets the access graph configuration.
-func WithAccessGraphConfig(config AccessGraphConfig) TestTLSServerOption {
-	return func(cfg *TestTLSServerConfig) {
-		cfg.APIConfig.AccessGraph = config
-	}
-}
-
-// NewRemoteClient creates new client to the remote server using identity
-// generated for this certificate authority
-func (a *TestAuthServer) NewRemoteClient(identity TestIdentity, addr net.Addr, pool *x509.CertPool) (*authclient.Client, error) {
-	tlsConfig := utils.TLSConfig(a.CipherSuites)
-	cert, err := a.NewCertificate(identity)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	tlsConfig.Certificates = []tls.Certificate{*cert}
-	tlsConfig.RootCAs = pool
-	tlsConfig.ServerName = apiutils.EncodeClusterName(a.ClusterName)
-	tlsConfig.Time = a.AuthServer.clock.Now
-
-	return authclient.NewClient(client.Config{
-		Addrs: []string{addr.String()},
-		Credentials: []client.Credentials{
-			client.LoadTLS(tlsConfig),
-		},
-		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-	})
-}
-
-// TestTLSServerConfig is a configuration for test TLS server
-type TestTLSServerConfig struct {
-	// APIConfig is a configuration of API server
-	APIConfig *APIConfig
-	// AuthServer is a test auth server used to serve requests
-	AuthServer *TestAuthServer
-	// Limiter is a connection and request limiter
-	Limiter *limiter.Config
-	// Listener is a listener to serve requests on
-	Listener net.Listener
-	// AcceptedUsage is a list of accepted usage restrictions
-	AcceptedUsage []string
-}
-
-// Auth returns auth server used by this TLS server
-func (t *TestTLSServer) Auth() *Server {
-	return t.AuthServer.AuthServer
-}
-
-// TestTLSServer is a test TLS server
-type TestTLSServer struct {
-	// TestTLSServerConfig is a configuration for TLS server
-	TestTLSServerConfig
-	// Identity is a generated TLS/SSH identity used to answer in TLS
-	Identity *state.Identity
-	// TLSServer is a configured TLS server
-	TLSServer *TLSServer
-}
-
-// ClusterName returns name of test TLS server cluster
-func (t *TestTLSServer) ClusterName() string {
-	return t.AuthServer.ClusterName
-}
-
-// Clock returns clock used by auth server
-func (t *TestTLSServer) Clock() clockwork.Clock {
-	return t.AuthServer.Clock()
-}
-
-// CheckAndSetDefaults checks and sets limiter defaults
-func (cfg *TestTLSServerConfig) CheckAndSetDefaults() error {
-	if cfg.APIConfig == nil {
-		return trace.BadParameter("missing parameter APIConfig")
-	}
-	if cfg.AuthServer == nil {
-		return trace.BadParameter("missing parameter AuthServer")
-	}
-	// use very permissive limiter configuration by default
-	if cfg.Limiter == nil {
-		cfg.Limiter = &limiter.Config{
-			MaxConnections: 1000,
-		}
-	}
-	return nil
-}
-
-// NewTestTLSServer returns new test TLS server that is started and is listening
-// on 127.0.0.1 loopback on any available port
-func NewTestTLSServer(cfg TestTLSServerConfig) (*TestTLSServer, error) {
-	err := cfg.CheckAndSetDefaults()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	srv := &TestTLSServer{
-		TestTLSServerConfig: cfg,
-	}
-	srv.Identity, err = NewServerIdentity(srv.AuthServer.AuthServer, "test-tls-server", types.RoleAuth)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Register TLS endpoint of the auth service
-	tlsConfig, err := srv.Identity.TLSConfig(srv.AuthServer.CipherSuites)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	tlsConfig.Time = cfg.AuthServer.Clock().Now
-	tlsCert := tlsConfig.Certificates[0]
-
-	srv.Listener, err = net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	srv.TLSServer, err = NewTLSServer(context.Background(), TLSServerConfig{
-		Listener:             srv.Listener,
-		AccessPoint:          srv.AuthServer.AuthServer.Cache,
-		TLS:                  tlsConfig,
-		GetClientCertificate: func() (*tls.Certificate, error) { return &tlsCert, nil },
-		APIConfig:            *srv.APIConfig,
-		LimiterConfig:        *srv.Limiter,
-		AcceptedUsage:        cfg.AcceptedUsage,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if err := srv.Start(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return srv, nil
-}
-
-// TestIdentity is test identity spec used to generate identities in tests
-type TestIdentity struct {
-	I              authz.IdentityGetter
-	TTL            time.Duration
-	AcceptedUsage  []string
-	RouteToCluster string
-	Renewable      bool
-	Generation     uint64
-}
-
-// TestUser returns TestIdentity for local user
-func TestUser(username string) TestIdentity {
-	return TestIdentity{
-		I: authz.LocalUser{
-			Username: username,
-			Identity: tlsca.Identity{Username: username},
-		},
-	}
-}
-
-// TestUserWithDeviceExtensions returns a TestIdentity for a local user,
-// including the supplied device extensions in the tlsca.Identity.
-func TestUserWithDeviceExtensions(username string, exts tlsca.DeviceExtensions) TestIdentity {
-	return TestIdentity{
-		I: authz.LocalUser{
-			Username: username,
-			Identity: tlsca.Identity{
-				Username:         username,
-				DeviceExtensions: exts,
-			},
-		},
-	}
-}
-
-// TestRenewableUser returns a TestIdentity for a local user
-// with renewable credentials.
-func TestRenewableUser(username string, generation uint64) TestIdentity {
-	return TestIdentity{
-		I: authz.LocalUser{
-			Username: username,
-			Identity: tlsca.Identity{
-				Username: username,
-			},
-		},
-		Renewable:  true,
-		Generation: generation,
-	}
-}
-
-// TestNop returns "Nop" - unauthenticated identity
-func TestNop() TestIdentity {
-	return TestIdentity{
-		I: nil,
-	}
-}
-
-// TestAdmin returns TestIdentity for admin user
-func TestAdmin() TestIdentity {
-	return TestBuiltin(types.RoleAdmin)
-}
-
-// TestBuiltin returns TestIdentity for builtin user
-func TestBuiltin(role types.SystemRole) TestIdentity {
-	return TestIdentity{
-		I: authz.BuiltinRole{
-			Role:     role,
-			Username: string(role),
-		},
-	}
-}
-
-// TestServerID returns a TestIdentity for a node with the passed in serverID.
-func TestServerID(role types.SystemRole, serverID string) TestIdentity {
-	return TestIdentity{
-		I: authz.BuiltinRole{
-			Role:                  types.RoleInstance,
-			Username:              serverID,
-			AdditionalSystemRoles: types.SystemRoles{role},
-			Identity: tlsca.Identity{
-				Username: serverID,
-			},
-		},
-	}
-}
-
-// TestRemoteBuiltin returns TestIdentity for a remote builtin role.
-func TestRemoteBuiltin(role types.SystemRole, remoteCluster string) TestIdentity {
-	return TestIdentity{
-		I: authz.RemoteBuiltinRole{
-			Role:        role,
-			Username:    string(role),
-			ClusterName: remoteCluster,
-		},
-	}
-}
-
-func (i TestIdentity) GetUsername() string {
-	return i.I.GetIdentity().Username
-}
-
-// NewClientFromWebSession returns new authenticated client from web session
-func (t *TestTLSServer) NewClientFromWebSession(sess types.WebSession) (*authclient.Client, error) {
-	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	tlsCert, err := tls.X509KeyPair(sess.GetTLSCert(), sess.GetTLSPriv())
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to parse TLS cert and key")
-	}
-	tlsConfig.Certificates = []tls.Certificate{tlsCert}
-	tlsConfig.Time = t.AuthServer.AuthServer.clock.Now
-
-	return authclient.NewClient(client.Config{
-		Addrs: []string{t.Addr().String()},
-		Credentials: []client.Credentials{
-			client.LoadTLS(tlsConfig),
-		},
-		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-	})
-}
-
-// CertPool returns cert pool that auth server represents
-func (t *TestTLSServer) CertPool() (*x509.CertPool, error) {
-	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return tlsConfig.RootCAs, nil
-}
-
-// ClientTLSConfig returns client TLS config based on the identity
-func (t *TestTLSServer) ClientTLSConfig(identity TestIdentity) (*tls.Config, error) {
-	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if identity.I != nil {
-		cert, err := t.AuthServer.NewCertificate(identity)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		tlsConfig.Certificates = []tls.Certificate{*cert}
-	} else {
-		// this client is not authenticated, which means that auth
-		// server should apply Nop builtin role
-		tlsConfig.Certificates = nil
-	}
-	tlsConfig.Time = t.AuthServer.AuthServer.clock.Now
-	return tlsConfig, nil
-}
-
-// CloneClient uses the same credentials as the passed client
-// but forces the client to be recreated
-func (t *TestTLSServer) CloneClient(tt *testing.T, clt *authclient.Client) *authclient.Client {
-	tlsConfig := clt.Config()
-	// When cloning a client, we want to make sure that we don't reuse
-	// the same session ticket cache. The session ticket cache should not be
-	// shared between all clients that use the same TLS config.
-	// Reusing the cache will skip the TLS handshake and may introduce a weird
-	// behavior in tests.
-	if tlsConfig.ClientSessionCache != nil {
-		tlsConfig = tlsConfig.Clone()
-		tlsConfig.ClientSessionCache = tls.NewLRUClientSessionCache(utils.DefaultLRUCapacity)
-	}
-
-	newClient, err := authclient.NewClient(client.Config{
-		Addrs: []string{t.Addr().String()},
-		Credentials: []client.Credentials{
-			client.LoadTLS(tlsConfig),
-		},
-		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-	})
-	if err != nil {
-		tt.Fatalf("error creating auth client: %v", err.Error())
-	}
-
-	tt.Cleanup(func() { _ = newClient.Close() })
-	return newClient
-}
-
-// NewClientWithCert creates a new client using given cert and private key
-func (t *TestTLSServer) NewClientWithCert(clientCert tls.Certificate) *authclient.Client {
-	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
-	if err != nil {
-		panic(err)
-	}
-	tlsConfig.Time = t.AuthServer.AuthServer.clock.Now
-	tlsConfig.Certificates = []tls.Certificate{clientCert}
-	newClient, err := authclient.NewClient(client.Config{
-		Addrs: []string{t.Addr().String()},
-		Credentials: []client.Credentials{
-			client.LoadTLS(tlsConfig),
-		},
-		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-	})
-	if err != nil {
-		panic(err)
-	}
-	return newClient
-}
-
-// NewClient returns new client to test server authenticated with identity
-func (t *TestTLSServer) NewClient(identity TestIdentity) (*authclient.Client, error) {
-	tlsConfig, err := t.ClientTLSConfig(identity)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	newClient, err := authclient.NewClient(client.Config{
-		DialInBackground: true,
-		Addrs:            []string{t.Addr().String()},
-		Credentials: []client.Credentials{
-			client.LoadTLS(tlsConfig),
-		},
-		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return newClient, nil
-}
-
-// Addr returns address of TLS server
-func (t *TestTLSServer) Addr() net.Addr {
-	return t.Listener.Addr()
-}
-
-// Start starts TLS server on loopback address on the first listening socket
-func (t *TestTLSServer) Start() error {
-	go t.TLSServer.Serve()
-	return nil
-}
-
-// Close closes the listener and HTTP server
-func (t *TestTLSServer) Close() error {
-	err := t.TLSServer.Close()
-	if t.Listener != nil {
-		t.Listener.Close()
-	}
-	if t.AuthServer.Backend != nil {
-		t.AuthServer.Backend.Close()
-	}
-	return err
-}
-
-// Shutdown closes the listener and HTTP server gracefully
-func (t *TestTLSServer) Shutdown(ctx context.Context) error {
-	errs := []error{t.TLSServer.Shutdown(ctx)}
-	if t.Listener != nil {
-		errs = append(errs, t.Listener.Close())
-	}
-	if t.AuthServer.Backend != nil {
-		errs = append(errs, t.AuthServer.Backend.Close())
-	}
-	return trace.NewAggregate(errs...)
-}
-
-// Stop stops listening server, but does not close the auth backend
-func (t *TestTLSServer) Stop() error {
-	err := t.TLSServer.Close()
-	if t.Listener != nil {
-		t.Listener.Close()
-	}
-	return err
-}
-
-// FakeTeleportVersion fake version storage implementation always return current version.
-type FakeTeleportVersion struct{}
-
-// NewFakeTeleportVersion creates fake version storage.
-func NewFakeTeleportVersion() *FakeTeleportVersion {
-	return &FakeTeleportVersion{}
-}
-
-// GetTeleportVersion returns current Teleport version.
-func (s FakeTeleportVersion) GetTeleportVersion(_ context.Context) (semver.Version, error) {
-	return *teleport.SemVer(), nil
-}
-
-// WriteTeleportVersion stub function for writing.
-func (s FakeTeleportVersion) WriteTeleportVersion(_ context.Context, _ semver.Version) error {
-	return nil
-}
-
-// DeleteTeleportVersion error stub function for deleting.
-func (s FakeTeleportVersion) DeleteTeleportVersion(_ context.Context) error {
-	return nil
-}
-
-// NewServerIdentity generates new server identity, used in tests
-func NewServerIdentity(clt *Server, hostID string, role types.SystemRole) (*state.Identity, error) {
-	key, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	privateKeyPEM, err := keys.MarshalPrivateKey(key)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	sshPubKey, err := ssh.NewPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	tlsPubKey, err := keys.MarshalPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	certs, err := clt.GenerateHostCerts(context.Background(),
-		&proto.HostCertsRequest{
-			HostID:       hostID,
-			NodeName:     hostID,
-			Role:         role,
-			PublicSSHKey: ssh.MarshalAuthorizedKey(sshPubKey),
-			PublicTLSKey: tlsPubKey,
-		})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return state.ReadIdentityFromKeyPair(privateKeyPEM, certs)
-}
-
-// clt limits required interface to the necessary methods
-// used to pass different clients in tests
-type clt interface {
-	UpsertRole(context.Context, types.Role) (types.Role, error)
-	UpsertUser(context.Context, types.User) (types.User, error)
-}
-
-// CreateRole creates a role without assigning any users. Used in tests.
-func CreateRole(ctx context.Context, clt clt, name string, spec types.RoleSpecV6) (types.Role, error) {
-	role, err := types.NewRole(name, spec)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	upserted, err := clt.UpsertRole(ctx, role)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return upserted, nil
-}
-
-// CreateUserRoleAndRequestable creates two roles for a user, one base role with allowed login
-// matching username, and another role with a login matching rolename that can be requested.
-func CreateUserRoleAndRequestable(clt clt, username string, rolename string) (types.User, error) {
-	ctx := context.TODO()
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	baseRole := services.RoleForUser(user)
-	baseRole.SetAccessRequestConditions(types.Allow, types.AccessRequestConditions{
-		Roles: []string{rolename},
-	})
-	baseRole.SetLogins(types.Allow, nil)
-	baseRole, err = clt.UpsertRole(ctx, baseRole)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	user.AddRole(baseRole.GetName())
-	_, err = clt.UpsertUser(ctx, user)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	requestableRole := services.RoleForUser(user)
-	requestableRole.SetName(rolename)
-	requestableRole.SetLogins(types.Allow, []string{rolename})
-	_, err = clt.UpsertRole(ctx, requestableRole)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return user, nil
-}
-
-// CreateAccessPluginUser creates a user with list/read abilites for access requests, and list/read/update
-// abilities for access plugin data.
-func CreateAccessPluginUser(ctx context.Context, clt clt, username string) (types.User, error) {
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	role := services.RoleForUser(user)
-	rules := role.GetRules(types.Allow)
-	rules = append(rules,
-		types.Rule{
-			Resources: []string{types.KindAccessRequest},
-			Verbs:     []string{types.VerbRead, types.VerbList},
-		},
-		types.Rule{
-			Resources: []string{types.KindAccessPluginData},
-			Verbs:     []string{types.VerbRead, types.VerbList, types.VerbUpdate},
-		},
-	)
-	role.SetRules(types.Allow, rules)
-	role.SetLogins(types.Allow, nil)
-	upsertedRole, err := clt.UpsertRole(ctx, role)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	user.AddRole(upsertedRole.GetName())
-	if _, err := clt.UpsertUser(ctx, user); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return user, nil
-}
-
-// CreateUser creates user and role and assigns role to a user, used in tests
-func CreateUser(ctx context.Context, clt clt, username string, roles ...types.Role) (types.User, error) {
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	for _, role := range roles {
-		upsertedRole, err := clt.UpsertRole(ctx, role)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		user.AddRole(upsertedRole.GetName())
-	}
-
-	created, err := clt.UpsertUser(ctx, user)
-	return created, trace.Wrap(err)
-}
-
-// createUserAndRoleOptions is a set of options for CreateUserAndRole
-type createUserAndRoleOptions struct {
-	mutateUser []func(user types.User)
-	mutateRole []func(role types.Role)
-	version    string
-}
-
-// CreateUserAndRoleOption is a functional option for CreateUserAndRole
-type CreateUserAndRoleOption func(*createUserAndRoleOptions)
-
-// WithRoleVersion sets the version of the role to be created.
-func WithRoleVersion(version string) CreateUserAndRoleOption {
-	return func(o *createUserAndRoleOptions) {
-		o.version = version
-	}
-}
-
-// WithUserMutator sets a function that will be called to mutate the user before it is created
-func WithUserMutator(mutate ...func(user types.User)) CreateUserAndRoleOption {
-	return func(o *createUserAndRoleOptions) {
-		o.mutateUser = append(o.mutateUser, mutate...)
-	}
-}
-
-// WithRoleMutator sets a function that will be called to mutate the role before it is created
-func WithRoleMutator(mutate ...func(role types.Role)) CreateUserAndRoleOption {
-	return func(o *createUserAndRoleOptions) {
-		o.mutateRole = append(o.mutateRole, mutate...)
-	}
-}
-
-// CreateUserAndRole creates user and role and assigns role to a user, used in tests
-// If allowRules is nil, the role has admin privileges.
-// If allowRules is not-nil, then the rules associated with the role will be
-// replaced with those specified.
-func CreateUserAndRole(clt clt, username string, allowedLogins []string, allowRules []types.Rule, opts ...CreateUserAndRoleOption) (types.User, types.Role, error) {
-	o := createUserAndRoleOptions{
-		version: types.DefaultRoleVersion,
-	}
-	for _, opt := range opts {
-		opt(&o)
-	}
-	ctx := context.TODO()
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	role := services.RoleWithVersionForUser(user, o.version)
-	role.SetLogins(types.Allow, allowedLogins)
-	if allowRules != nil {
-		role.SetRules(types.Allow, allowRules)
-	}
-	for _, mutate := range o.mutateRole {
-		mutate(role)
-	}
-	upsertedRole, err := clt.UpsertRole(ctx, role)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	user.AddRole(upsertedRole.GetName())
-	for _, mutate := range o.mutateUser {
-		mutate(user)
-	}
-	created, err := clt.UpsertUser(ctx, user)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	return created, role, nil
-}
-
-// CreateUserAndRoleWithoutRoles creates user and role, but does not assign user to a role, used in tests
-func CreateUserAndRoleWithoutRoles(clt clt, username string, allowedLogins []string) (types.User, types.Role, error) {
-	ctx := context.TODO()
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	role := services.RoleForUser(user)
-	set := services.MakeRuleSet(role.GetRules(types.Allow))
-	delete(set, types.KindRole)
-	role.SetRules(types.Allow, set.Slice())
-	role.SetLogins(types.Allow, []string{user.GetName()})
-	upsertedRole, err := clt.UpsertRole(ctx, role)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	user.AddRole(upsertedRole.GetName())
-	created, err := clt.UpsertUser(ctx, user)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	return created, upsertedRole, nil
-}
-
-// flushClt is the set of methods expected by the flushCache helper.
-type flushClt interface {
-	// GetRole returns role by name
-	GetRole(ctx context.Context, name string) (types.Role, error)
-	// CreateRole creates a new role.
-	CreateRole(context.Context, types.Role) (types.Role, error)
-	// DeleteRole deletes the role by name.
-	DeleteRole(ctx context.Context, name string) error
-}
-
-// flushCache is a helper for waiting until preceding changes have propagated to the
-// cache during a test. this is useful for writing tests that may want to update backend
-// state and then perform some operation that depends on the auth server knoowing that state.
-// note that this is only intended for use with the memory backend, as this helper relies on the assumption that
-// write events for different keys show up in the order in which the writes were performed, which
-// is not necessarily true for all backends.
-func flushCache(t *testing.T, clt flushClt) {
-	ctx := context.Background()
-
-	// the pattern of writing a resource and then waiting for it to appear
-	// works for any resource type (when using memory backend).
-	name := strings.ReplaceAll(uuid.NewString(), "-", "")
-	defer clt.DeleteRole(ctx, name)
-
-	role, err := types.NewRole(name, types.RoleSpecV6{})
-	if err != nil {
-		t.Fatalf("Failed to instantiate new role: %v", err)
-	}
-
-	role, err = clt.CreateRole(ctx, role)
-	if err != nil {
-		t.Fatalf("Failed to create new role: %v", err)
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	for {
-		r, err := clt.GetRole(ctx, name)
-		if err == nil && r.GetRevision() == role.GetRevision() {
-			return
-		}
-
-		select {
-		case <-time.After(200 * time.Millisecond):
-		case <-ctx.Done():
-			t.Fatal("Time out waiting for role to be replicated")
-		}
-	}
-}
diff --git a/lib/auth/init.go b/lib/auth/init.go
index 9a77b33218abe..b19d160370711 100644
--- a/lib/auth/init.go
+++ b/lib/auth/init.go
@@ -57,7 +57,11 @@ import (
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/auth/migration"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption/recordingencryptionv1"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
 	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
@@ -85,6 +89,15 @@ type VersionStorage interface {
 	DeleteTeleportVersion(ctx context.Context) error
 }
 
+// RecordingEncryptionManager wraps a RecordingEncryption backend service with higher level
+// operations.
+type RecordingEncryptionManager interface {
+	services.RecordingEncryption
+	recordingencryption.KeyUnwrapper
+	recordingencryptionv1.KeyRotater
+	SetCache(cache recordingencryption.Cache)
+}
+
 // InitConfig is auth server init config
 type InitConfig struct {
 	// Backend is auth backend to use
@@ -100,6 +113,10 @@ type InitConfig struct {
 	// keys that may be held in an HSM.
 	KeyStoreConfig servicecfg.KeystoreConfig
 
+	// KeyStore handles private CA keys and encryption keys that may be held
+	// in an HSM.
+	KeyStore *keystore.Manager
+
 	// HostUUID is a UUID of this host
 	HostUUID string
 
@@ -168,7 +185,7 @@ type InitConfig struct {
 	Restrictions services.Restrictions
 
 	// Apps is a service that manages application resources.
-	Apps services.Apps
+	Apps services.Applications
 
 	// Databases is a service that manages database resources.
 	Databases services.Databases
@@ -261,7 +278,7 @@ type InitConfig struct {
 	// AssertionReplayService is a service that mitigates SSO assertion replay.
 	*local.AssertionReplayService
 
-	// FIPS means FedRAMP/FIPS 140-2 compliant configuration was requested.
+	// FIPS means FedRAMP/FIPS compliant configuration was requested.
 	FIPS bool
 
 	// UsageReporter is a service that forwards cluster usage events.
@@ -271,7 +288,7 @@ type InitConfig struct {
 	Okta services.Okta
 
 	// AccessLists is a service that manages access list resources.
-	AccessLists services.AccessLists
+	AccessLists services.AccessListsInternal
 
 	// DatabaseObjectImportRule is a service that manages database object import rules.
 	DatabaseObjectImportRules services.DatabaseObjectImportRules
@@ -367,11 +384,42 @@ type InitConfig struct {
 	// BackendInfo is a service of backend information.
 	BackendInfo services.BackendInfoService
 
+	// RecordingEncryption manages state for encrypted session recording.
+	RecordingEncryption RecordingEncryptionManager
+
 	// SkipVersionCheck skips version check during major version upgrade/downgrade.
 	SkipVersionCheck bool
 
 	// VnetConfigService manages the VNet config resource.
 	VnetConfigService services.VnetConfigService
+
+	// MultipartHandler handles multipart uploads.
+	MultipartHandler events.MultipartHandler
+
+	// Summarizer manages summary inference configuration resources.
+	Summarizer services.Summarizer
+
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It allows for late initialization of the summarizer in the enterprise
+	// plugin. The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+
+	// RecordingMetadataProvider provides recording metadata for session recordings.
+	RecordingMetadataProvider *recordingmetadata.Provider
+
+	// RunWhileLockedRetryInterval defines the interval at which the auth server retries
+	// a locking operation for backend objects.
+	// This setting is particularly useful in test environments,
+	// as it can help accelerate operations such as updating the access list,
+	// especially when the list is also being modified concurrently by the background
+	// eligibility handler.
+	RunWhileLockedRetryInterval time.Duration
+
+	// ScopedAccess is a service that manages scoped access resources.
+	ScopedAccess services.ScopedAccess
+
+	// ScopedTokenService is a service that manages scoped join token resources.
+	ScopedTokenService services.ScopedTokenService
 }
 
 // Init instantiates and configures an instance of AuthServer
@@ -510,7 +558,14 @@ func initCluster(ctx context.Context, cfg InitConfig, asrv *Server) error {
 	})
 
 	g.Go(func() error {
-		ctx, span := cfg.Tracer.Start(gctx, "auth/InitializeSessionRecordingConfig")
+		ctx, span := cfg.Tracer.Start(gctx, "auth/initializeAuthPreference")
+		if err := initializeAuthPreference(ctx, asrv, cfg.AuthPreference); err != nil {
+			span.End()
+			return trace.Wrap(err)
+		}
+		span.End()
+
+		ctx, span = cfg.Tracer.Start(gctx, "auth/InitializeSessionRecordingConfig")
 		defer span.End()
 		return trace.Wrap(initializeSessionRecordingConfig(ctx, asrv, cfg.SessionRecordingConfig))
 	})
@@ -527,12 +582,6 @@ func initCluster(ctx context.Context, cfg InitConfig, asrv *Server) error {
 		return trace.Wrap(initializeVnetConfig(ctx, asrv))
 	})
 
-	g.Go(func() error {
-		ctx, span := cfg.Tracer.Start(gctx, "auth/initializeAuthPreference")
-		defer span.End()
-		return trace.Wrap(initializeAuthPreference(ctx, asrv, cfg.AuthPreference))
-	})
-
 	g.Go(func() error {
 		_, span := cfg.Tracer.Start(gctx, "auth/SetStaticTokens")
 		defer span.End()
@@ -637,12 +686,6 @@ func initCluster(ctx context.Context, cfg InitConfig, asrv *Server) error {
 			asrv.logger.WarnContext(ctx, "error creating preset database object import rules", "error", err)
 		}
 		span.AddEvent("completed creating database object import rules")
-
-		span.AddEvent("creating preset health check config")
-		if err := createPresetHealthCheckConfig(ctx, asrv); err != nil {
-			return trace.Wrap(err)
-		}
-		span.AddEvent("completed creating preset health check config")
 	} else {
 		asrv.logger.InfoContext(ctx, "skipping preset role and user creation")
 	}
@@ -692,7 +735,11 @@ func initializeAuthorities(ctx context.Context, asrv *Server, cfg *InitConfig) e
 	}
 
 	// Collect CAs from integrations to avoid deleting them.
-	err := clientutils.IterateResources(ctx, asrv.Services.ListIntegrations, func(ig types.Integration) error {
+	for ig, err := range clientutils.Resources(ctx, asrv.Services.ListIntegrations) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
 		caKeySet, err := igcredentials.GetIntegrationCertAuthorities(ctx, ig, asrv.Services)
 		switch {
 		case trace.IsNotImplemented(err):
@@ -704,9 +751,6 @@ func initializeAuthorities(ctx context.Context, asrv *Server, cfg *InitConfig) e
 			allKeysInUse = append(allKeysInUse, collectKeysInUse(*caKeySet)...)
 		}
 		return nil
-	})
-	if err != nil {
-		return trace.Wrap(err)
 	}
 
 	// Delete any unused keys from the keyStore. This is to avoid exhausting
@@ -737,6 +781,62 @@ func initializeAuthority(ctx context.Context, asrv *Server, caID types.CertAuthI
 		}
 	}
 
+	// Add [empty] CRLs to any issuers that are missing them.
+	// These are valid for 10 years and regenerated on CA rotation.
+	// DELETE IN v20(probakowski, zmb3): by v20 all auths will have
+	// at least been on v19, and all versions of 19 backfill missing CRLs.
+	updated := false
+	for _, kp := range ca.GetActiveKeys().TLS {
+		cert, err := tlsca.ParseCertificatePEM(kp.Cert)
+		if err != nil {
+			asrv.logger.WarnContext(ctx, "Couldn't parse CA certificate", "ca_type", caID.Type, "error", err)
+			continue
+		}
+
+		needsNewCRL := len(kp.CRL) == 0
+		if !needsNewCRL {
+			// An earlier version of this code generated CRLs that may have been signed with the wrong keypair.
+			// To fix this, we must also validate the signature of existing CRLs.
+			if crl, err := x509.ParseRevocationList(kp.CRL); err != nil {
+				needsNewCRL = true
+			} else if err := crl.CheckSignatureFrom(cert); err != nil {
+				asrv.logger.WarnContext(ctx, "Detected CRL with invalid signature, regenerating", "ca_type", caID.Type, "ca", ca.GetName(), "error", err)
+				needsNewCRL = true
+			}
+		}
+
+		if !needsNewCRL {
+			continue
+		}
+
+		signer, err := asrv.keyStore.TLSSigner(ctx, kp)
+		if err != nil {
+			if !errors.Is(err, keystore.ErrUnusableKey) {
+				asrv.logger.WarnContext(ctx, "Couldn't get TLS signer for CA", "ca", ca.GetName(), "ca_type", caID.Type, "error", err)
+			}
+			continue
+		}
+
+		if cert.KeyUsage&x509.KeyUsageCRLSign == 0 {
+			asrv.logger.WarnContext(ctx, "Certificate authority can't sign CRLs, some Active Directory integrations will require a CA rotation", "ca_type", caID.Type)
+			continue
+		}
+
+		crl, err := keystore.GenerateCRL(cert, signer)
+		if err != nil {
+			asrv.logger.WarnContext(ctx, "Failed to generate CRL", "ca_type", caID.Type, "error", err)
+			continue
+		}
+		kp.CRL = crl
+		updated = true
+	}
+
+	if updated {
+		if ca, err = asrv.UpdateCertAuthority(ctx, ca); err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+	}
+
 	// Make sure the keystore has usable keys. This is a bit redundant if the CA
 	// was just generated above, but cheap relative to generating the CA, and
 	// it's nice to get the usableKeysResult.
@@ -1230,6 +1330,9 @@ func GetPresetRoles() []types.Role {
 		services.NewPresetTerraformProviderRole(),
 		services.NewSystemIdentityCenterAccessRole(),
 		services.NewPresetWildcardWorkloadIdentityIssuerRole(),
+		services.NewPresetAccessPluginRole(),
+		services.NewPresetListAccessRequestResourcesRole(),
+		services.NewPresetMCPUserRole(),
 	}
 
 	// Certain `New$FooRole()` functions will return a nil role if the
@@ -1385,27 +1488,6 @@ func createPresetDatabaseObjectImportRule(ctx context.Context, rules services.Da
 	return nil
 }
 
-// createPresetHealthCheckConfig creates a default preset health check config
-// resource that enables health checks on all resources.
-func createPresetHealthCheckConfig(ctx context.Context, svc services.HealthCheckConfig) error {
-	page, _, err := svc.ListHealthCheckConfigs(ctx, 0, "")
-	if err != nil {
-		return trace.Wrap(err, "failed listing available health check configs")
-	}
-	if len(page) > 0 {
-		return nil
-	}
-	preset := services.NewPresetHealthCheckConfig()
-	_, err = svc.CreateHealthCheckConfig(ctx, preset)
-	if err != nil && !trace.IsAlreadyExists(err) {
-		return trace.Wrap(err,
-			"failed creating preset health_check_config %s",
-			preset.GetMetadata().GetName(),
-		)
-	}
-	return nil
-}
-
 // isFirstStart returns 'true' if the auth server is starting for the 1st time
 // on this server.
 func isFirstStart(ctx context.Context, authServer *Server, cfg InitConfig) (bool, error) {
@@ -1508,7 +1590,7 @@ func GenerateIdentity(a *Server, id state.IdentityID, additionalPrincipals, dnsN
 			DNSNames:             dnsNames,
 			PublicSSHKey:         ssh.MarshalAuthorizedKey(sshPub),
 			PublicTLSKey:         tlsPub,
-		})
+		}, "")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go
index 8082d62bda8bd..9b36792dd93aa 100644
--- a/lib/auth/init_test.go
+++ b/lib/auth/init_test.go
@@ -16,13 +16,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"math"
+	"os"
+	"os/exec"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -42,7 +45,6 @@ import (
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/durationpb"
 	kyaml "k8s.io/apimachinery/pkg/util/yaml"
 
 	"github.com/gravitational/teleport"
@@ -58,18 +60,19 @@ import (
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/observability/tracing"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/srv/db/common/databaseobjectimportrule"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -136,7 +139,7 @@ func TestBadIdentity(t *testing.T) {
 
 	// bad cert type
 	_, err = state.ReadSSHIdentityFromKeyPair(priv, pub)
-	require.IsType(t, trace.BadParameter(""), err)
+	require.ErrorAs(t, err, new(*trace.BadParameterError))
 
 	// missing authority domain
 	cert, err := a.GenerateHostCert(sshca.HostCertificateRequest{
@@ -153,7 +156,7 @@ func TestBadIdentity(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = state.ReadSSHIdentityFromKeyPair(priv, cert)
-	require.IsType(t, trace.BadParameter(""), err)
+	require.ErrorAs(t, err, new(*trace.BadParameterError))
 
 	// missing host uuid
 	cert, err = a.GenerateHostCert(sshca.HostCertificateRequest{
@@ -170,7 +173,7 @@ func TestBadIdentity(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = state.ReadSSHIdentityFromKeyPair(priv, cert)
-	require.IsType(t, trace.BadParameter(""), err)
+	require.ErrorAs(t, err, new(*trace.BadParameterError))
 
 	// unrecognized role
 	cert, err = a.GenerateHostCert(sshca.HostCertificateRequest{
@@ -187,7 +190,7 @@ func TestBadIdentity(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = state.ReadSSHIdentityFromKeyPair(priv, cert)
-	require.IsType(t, trace.BadParameter(""), err)
+	require.ErrorAs(t, err, new(*trace.BadParameterError))
 }
 
 func TestSignatureAlgorithmSuite(t *testing.T) {
@@ -204,7 +207,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 		assert.Equal(t, suiteName(expected), suiteName(actual))
 	}
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.HSM: {Enabled: true},
@@ -212,11 +215,11 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 		},
 	})
 
-	setupInitConfig := func(t *testing.T, capOrigin string, fips, hsm bool) InitConfig {
+	setupInitConfig := func(t *testing.T, capOrigin string, fips, hsm bool) auth.InitConfig {
 		cfg := setupConfig(t)
 		cfg.FIPS = fips
 		if hsm {
-			cfg.KeyStoreConfig = keystore.HSMTestConfig(t)
+			cfg.KeyStoreConfig = HSMTestConfig(t)
 		}
 		cfg.AuthPreference.SetOrigin(capOrigin)
 		if capOrigin != types.OriginDefaults {
@@ -224,7 +227,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 		}
 		// Pre-generate all CAs to keep tests fast esp. with SoftHSM.
 		for _, caType := range types.CertAuthTypes {
-			cfg.BootstrapResources = append(cfg.BootstrapResources, suite.NewTestCAWithConfig(suite.TestCAConfig{
+			cfg.BootstrapResources = append(cfg.BootstrapResources, authtest.NewTestCAWithConfig(authtest.TestCAConfig{
 				Type:        caType,
 				ClusterName: cfg.ClusterName.GetClusterName(),
 				Clock:       cfg.Clock,
@@ -285,7 +288,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 				for desc, tc := range testCases {
 					t.Run(desc, func(t *testing.T) {
 						if tc.cloud {
-							modules.SetTestModules(t, &modules.TestModules{
+							modulestest.SetTestModules(t, modulestest.Modules{
 								TestFeatures: modules.Features{
 									Cloud: true,
 									Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -299,7 +302,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 						// configured gets the expected default suite, whether
 						// or not anything else in the cluster auth preference is set.
 						cfg := setupInitConfig(t, origin, tc.fips, tc.hsm)
-						auth1, err := Init(ctx, cfg)
+						auth1, err := auth.Init(ctx, cfg)
 						require.NoError(t, err)
 						t.Cleanup(func() { auth1.Close() })
 						authPref, err := auth1.GetAuthPreference(ctx)
@@ -309,7 +312,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 
 						// Start a second auth server with the same backend and
 						// config, assert that the default suite remains.
-						auth2, err := Init(ctx, cfg)
+						auth2, err := auth.Init(ctx, cfg)
 						require.NoError(t, err)
 						t.Cleanup(func() { auth2.Close() })
 						authPref, err = auth2.GetAuthPreference(ctx)
@@ -339,7 +342,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 						// server upgraded to v17 will still have an unspecified
 						// signature algorithm suite and won't get a new one
 						// until explicitly opting in.
-						auth3, err := Init(ctx, cfg)
+						auth3, err := auth.Init(ctx, cfg)
 						require.NoError(t, err)
 						t.Cleanup(func() { auth3.Close() })
 						authPref, err = auth3.GetAuthPreference(ctx)
@@ -366,7 +369,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 		for desc, tc := range testCases {
 			t.Run(desc, func(t *testing.T) {
 				if tc.cloud {
-					modules.SetTestModules(t, &modules.TestModules{
+					modulestest.SetTestModules(t, modulestest.Modules{
 						TestFeatures: modules.Features{
 							Cloud: true,
 							Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -375,7 +378,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 						},
 					})
 				}
-				cfg := TestAuthServerConfig{
+				cfg := authtest.AuthServerConfig{
 					Dir:  t.TempDir(),
 					FIPS: tc.fips,
 					AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -387,14 +390,19 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 					},
 				}
 				if tc.hsm {
-					cfg.KeystoreConfig = keystore.HSMTestConfig(t)
+					cfg.KeystoreConfig = HSMTestConfig(t)
 				}
-				testAuthServer, err := NewTestAuthServer(cfg)
+				testAuthServer, err := authtest.NewAuthServer(cfg)
 				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
 				tlsServer, err := testAuthServer.NewTestTLSServer()
 				require.NoError(t, err)
-				clt, err := tlsServer.NewClient(TestAdmin())
+				t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
+
+				clt, err := tlsServer.NewClient(authtest.TestAdmin())
 				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, clt.Close()) })
 
 				for _, suiteValue := range types.SignatureAlgorithmSuite_value {
 					suite := types.SignatureAlgorithmSuite(suiteValue)
@@ -427,15 +435,169 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 	})
 }
 
+func HSMTestConfig(t *testing.T) servicecfg.KeystoreConfig {
+	if cfg, ok := yubiHSMTestConfig(); ok {
+		t.Log("Running test with YubiHSM")
+		return cfg
+	}
+	if cfg, ok := cloudHSMTestConfig(); ok {
+		t.Log("Running test with AWS CloudHSM")
+		return cfg
+	}
+	if cfg, ok := awsKMSTestConfig(); ok {
+		t.Log("Running test with AWS KMS")
+		return cfg
+	}
+	if cfg, ok := gcpKMSTestConfig(); ok {
+		t.Log("Running test with GCP KMS")
+		return cfg
+	}
+	if cfg, ok := softHSMTestConfig(t); ok {
+		t.Log("Running test with SoftHSM")
+		return cfg
+	}
+	t.Skip("No HSM available for test")
+	return servicecfg.KeystoreConfig{}
+}
+
+func yubiHSMTestConfig() (servicecfg.KeystoreConfig, bool) {
+	yubiHSMPath := os.Getenv("TELEPORT_TEST_YUBIHSM_PKCS11_PATH")
+	yubiHSMPin := os.Getenv("TELEPORT_TEST_YUBIHSM_PIN")
+	if yubiHSMPath == "" || yubiHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	slotNumber := 0
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       yubiHSMPath,
+			SlotNumber: &slotNumber,
+			PIN:        yubiHSMPin,
+		},
+	}, true
+}
+
+func cloudHSMTestConfig() (servicecfg.KeystoreConfig, bool) {
+	cloudHSMPin := os.Getenv("TELEPORT_TEST_CLOUDHSM_PIN")
+	if cloudHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so",
+			TokenLabel: "cavium",
+			PIN:        cloudHSMPin,
+		},
+	}, true
+}
+
+func awsKMSTestConfig() (servicecfg.KeystoreConfig, bool) {
+	awsKMSAccount := os.Getenv("TELEPORT_TEST_AWS_KMS_ACCOUNT")
+	awsKMSRegion := os.Getenv("TELEPORT_TEST_AWS_KMS_REGION")
+	if awsKMSAccount == "" || awsKMSRegion == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		AWSKMS: &servicecfg.AWSKMSConfig{
+			AWSAccount: awsKMSAccount,
+			AWSRegion:  awsKMSRegion,
+		},
+	}, true
+}
+
+func gcpKMSTestConfig() (servicecfg.KeystoreConfig, bool) {
+	gcpKeyring := os.Getenv("TELEPORT_TEST_GCP_KMS_KEYRING")
+	if gcpKeyring == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		GCPKMS: servicecfg.GCPKMSConfig{
+			KeyRing:         gcpKeyring,
+			ProtectionLevel: "SOFTWARE",
+		},
+	}, true
+}
+
+var (
+	cachedSoftHSMConfig      *servicecfg.KeystoreConfig
+	cachedSoftHSMConfigMutex sync.Mutex
+)
+
+// softHSMTestConfig is for use in tests only and creates a test SOFTHSM2 token.
+// This should be used for all tests which need to use SoftHSM because the
+// library can only be initialized once and SOFTHSM2_PATH and SOFTHSM2_CONF
+// cannot be changed. New tokens added after the library has been initialized
+// will not be found by the library.
+//
+// A new token will be used for each `go test` invocation, but it's difficult
+// to create a separate token for each test because because new tokens
+// added after the library has been initialized will not be found by the
+// library. It's also difficult to clean up the token because tests for all
+// packages are run in parallel there is not a good time to safely
+// delete the token or the entire token directory. Each test should clean up
+// all keys that it creates because SoftHSM2 gets really slow when there are
+// many keys for a given token.
+func softHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	path := os.Getenv("SOFTHSM2_PATH")
+	if path == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+
+	cachedSoftHSMConfigMutex.Lock()
+	defer cachedSoftHSMConfigMutex.Unlock()
+
+	if cachedSoftHSMConfig != nil {
+		return *cachedSoftHSMConfig, true
+	}
+
+	if os.Getenv("SOFTHSM2_CONF") == "" {
+		// create tokendir
+		tokenDir, err := os.MkdirTemp("", "tokens")
+		require.NoError(t, err)
+
+		// create config file
+		configFile, err := os.CreateTemp("", "softhsm2.conf")
+		require.NoError(t, err)
+
+		// write config file
+		_, err = fmt.Fprintf(configFile, "directories.tokendir = %s\nobjectstore.backend = file\nlog.level = DEBUG\n", tokenDir)
+		require.NoError(t, err)
+		require.NoError(t, configFile.Close())
+
+		// set env
+		os.Setenv("SOFTHSM2_CONF", configFile.Name())
+	}
+
+	// create test token (max length is 32 chars)
+	tokenLabel := strings.ReplaceAll(uuid.NewString(), "-", "")
+	cmd := exec.Command("softhsm2-util", "--init-token", "--free", "--label", tokenLabel, "--so-pin", "password", "--pin", "password")
+	t.Logf("Running command: %q", cmd)
+	if err := cmd.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			require.NoError(t, exitErr, "error creating test softhsm token: %s", string(exitErr.Stderr))
+		}
+		require.NoError(t, err, "error attempting to run softhsm2-util")
+	}
+
+	cachedSoftHSMConfig = &servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       path,
+			TokenLabel: tokenLabel,
+			PIN:        "password",
+		},
+	}
+	return *cachedSoftHSMConfig, true
+}
+
 type testDynamicallyConfigurableParams struct {
-	withDefaults, withConfigFile, withAnotherConfigFile func(*testing.T, *InitConfig) types.ResourceWithOrigin
-	setDynamic                                          func(*testing.T, *Server)
-	getStored                                           func(*testing.T, *Server) types.ResourceWithOrigin
+	withDefaults, withConfigFile, withAnotherConfigFile func(*testing.T, *auth.InitConfig) types.ResourceWithOrigin
+	setDynamic                                          func(*testing.T, *auth.Server)
+	getStored                                           func(*testing.T, *auth.Server) types.ResourceWithOrigin
 }
 
 func testDynamicallyConfigurable(t *testing.T, p testDynamicallyConfigurableParams) {
-	initAuthServer := func(t *testing.T, conf InitConfig) *Server {
-		authServer, err := Init(context.Background(), conf)
+	initAuthServer := func(t *testing.T, conf auth.InitConfig) *auth.Server {
+		authServer, err := auth.Init(context.Background(), conf)
 		require.NoError(t, err)
 		t.Cleanup(func() { authServer.Close() })
 		return authServer
@@ -555,11 +717,11 @@ func TestAuthPreference(t *testing.T) {
 	ctx := context.Background()
 
 	testDynamicallyConfigurable(t, testDynamicallyConfigurableParams{
-		withDefaults: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withDefaults: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			conf.AuthPreference = types.DefaultAuthPreference()
 			return conf.AuthPreference
 		},
-		withConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			fromConfigFile, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
 				Type:                    constants.OIDC,
 				SignatureAlgorithmSuite: types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1,
@@ -568,12 +730,12 @@ func TestAuthPreference(t *testing.T) {
 			conf.AuthPreference = fromConfigFile
 			return conf.AuthPreference
 		},
-		withAnotherConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withAnotherConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			conf.AuthPreference = newWebauthnAuthPreferenceConfigFromFile(t)
 			conf.AuthPreference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_HSM_V1)
 			return conf.AuthPreference
 		},
-		setDynamic: func(t *testing.T, authServer *Server) {
+		setDynamic: func(t *testing.T, authServer *auth.Server) {
 			dynamically, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
 				SecondFactor: constants.SecondFactorOff,
 			})
@@ -581,7 +743,7 @@ func TestAuthPreference(t *testing.T) {
 			_, err = authServer.UpsertAuthPreference(ctx, dynamically)
 			require.NoError(t, err)
 		},
-		getStored: func(t *testing.T, authServer *Server) types.ResourceWithOrigin {
+		getStored: func(t *testing.T, authServer *auth.Server) types.ResourceWithOrigin {
 			authPref, err := authServer.GetAuthPreference(ctx)
 			require.NoError(t, err)
 			return authPref
@@ -593,7 +755,7 @@ func TestVnetConfig(t *testing.T) {
 	t.Parallel()
 
 	conf := setupConfig(t)
-	authServer, err := Init(context.Background(), conf)
+	authServer, err := auth.Init(context.Background(), conf)
 	require.NoError(t, err)
 	t.Cleanup(func() { authServer.Close() })
 
@@ -617,7 +779,7 @@ func TestAuthPreferenceSecondFactorOnly(t *testing.T) {
 	require.NoError(t, err)
 
 	conf.AuthPreference = authPref
-	_, err = Init(ctx, conf)
+	_, err = auth.Init(ctx, conf)
 	require.Error(t, err)
 }
 
@@ -626,11 +788,11 @@ func TestClusterNetworkingConfig(t *testing.T) {
 	ctx := context.Background()
 
 	testDynamicallyConfigurable(t, testDynamicallyConfigurableParams{
-		withDefaults: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withDefaults: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			conf.ClusterNetworkingConfig = types.DefaultClusterNetworkingConfig()
 			return conf.ClusterNetworkingConfig
 		},
-		withConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			fromConfigFile, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
 				ClientIdleTimeout: types.Duration(7 * time.Minute),
 			})
@@ -638,7 +800,7 @@ func TestClusterNetworkingConfig(t *testing.T) {
 			conf.ClusterNetworkingConfig = fromConfigFile
 			return conf.ClusterNetworkingConfig
 		},
-		withAnotherConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withAnotherConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			anotherFromConfigFile, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
 				ClientIdleTimeout: types.Duration(10 * time.Minute),
 				KeepAliveInterval: types.Duration(3 * time.Minute),
@@ -647,7 +809,7 @@ func TestClusterNetworkingConfig(t *testing.T) {
 			conf.ClusterNetworkingConfig = anotherFromConfigFile
 			return conf.ClusterNetworkingConfig
 		},
-		setDynamic: func(t *testing.T, authServer *Server) {
+		setDynamic: func(t *testing.T, authServer *auth.Server) {
 			dynamically, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
 				KeepAliveInterval: types.Duration(4 * time.Minute),
 			})
@@ -656,7 +818,7 @@ func TestClusterNetworkingConfig(t *testing.T) {
 			_, err = authServer.UpsertClusterNetworkingConfig(ctx, dynamically)
 			require.NoError(t, err)
 		},
-		getStored: func(t *testing.T, authServer *Server) types.ResourceWithOrigin {
+		getStored: func(t *testing.T, authServer *auth.Server) types.ResourceWithOrigin {
 			authPref, err := authServer.GetClusterNetworkingConfig(ctx)
 			require.NoError(t, err)
 			return authPref
@@ -669,11 +831,11 @@ func TestSessionRecordingConfig(t *testing.T) {
 	ctx := context.Background()
 
 	testDynamicallyConfigurable(t, testDynamicallyConfigurableParams{
-		withDefaults: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withDefaults: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			conf.SessionRecordingConfig = types.DefaultSessionRecordingConfig()
 			return conf.SessionRecordingConfig
 		},
-		withConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			fromConfigFile, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
 				Mode: types.RecordOff,
 			})
@@ -681,7 +843,7 @@ func TestSessionRecordingConfig(t *testing.T) {
 			conf.SessionRecordingConfig = fromConfigFile
 			return conf.SessionRecordingConfig
 		},
-		withAnotherConfigFile: func(t *testing.T, conf *InitConfig) types.ResourceWithOrigin {
+		withAnotherConfigFile: func(t *testing.T, conf *auth.InitConfig) types.ResourceWithOrigin {
 			anotherFromConfigFile, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
 				Mode: types.RecordAtProxySync,
 			})
@@ -689,7 +851,7 @@ func TestSessionRecordingConfig(t *testing.T) {
 			conf.SessionRecordingConfig = anotherFromConfigFile
 			return conf.SessionRecordingConfig
 		},
-		setDynamic: func(t *testing.T, authServer *Server) {
+		setDynamic: func(t *testing.T, authServer *auth.Server) {
 			dynamically, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
 				Mode: types.RecordAtNodeSync,
 			})
@@ -698,7 +860,7 @@ func TestSessionRecordingConfig(t *testing.T) {
 			_, err = authServer.UpsertSessionRecordingConfig(ctx, dynamically)
 			require.NoError(t, err)
 		},
-		getStored: func(t *testing.T, authServer *Server) types.ResourceWithOrigin {
+		getStored: func(t *testing.T, authServer *auth.Server) types.ResourceWithOrigin {
 			authPref, err := authServer.GetSessionRecordingConfig(ctx)
 			require.NoError(t, err)
 			return authPref
@@ -709,7 +871,7 @@ func TestSessionRecordingConfig(t *testing.T) {
 func TestClusterID(t *testing.T) {
 	conf := setupConfig(t)
 	ctx := context.Background()
-	authServer, err := Init(ctx, conf)
+	authServer, err := auth.Init(ctx, conf)
 	require.NoError(t, err)
 	defer authServer.Close()
 
@@ -719,7 +881,7 @@ func TestClusterID(t *testing.T) {
 	require.NotEmpty(t, clusterID)
 
 	// do it again and make sure cluster ID hasn't changed
-	authServer, err = Init(ctx, conf)
+	authServer, err = auth.Init(ctx, conf)
 	require.NoError(t, err)
 	defer authServer.Close()
 
@@ -732,7 +894,7 @@ func TestClusterID(t *testing.T) {
 func TestClusterName(t *testing.T) {
 	conf := setupConfig(t)
 	ctx := context.Background()
-	authServer, err := Init(ctx, conf)
+	authServer, err := auth.Init(ctx, conf)
 	require.NoError(t, err)
 	defer authServer.Close()
 
@@ -743,7 +905,7 @@ func TestClusterName(t *testing.T) {
 		ClusterName: "dev.localhost",
 	})
 	require.NoError(t, err)
-	authServer, err = Init(context.Background(), newConfig)
+	authServer, err = auth.Init(context.Background(), newConfig)
 	require.NoError(t, err)
 	defer authServer.Close()
 
@@ -775,7 +937,7 @@ func TestInitCertFailureRecovery(t *testing.T) {
 	// BootstrapResources have lead to an unrecoverable state in the past.
 	// See https://github.com/gravitational/teleport/pull/49638.
 	conf.BootstrapResources = []types.Resource{cap}
-	_, err = Init(ctx, conf, func(s *Server) error {
+	_, err = auth.Init(ctx, conf, func(s *auth.Server) error {
 		s.TrustInternal = &failingTrustInternal{
 			TrustInternal: s.TrustInternal,
 		}
@@ -783,7 +945,7 @@ func TestInitCertFailureRecovery(t *testing.T) {
 	})
 	require.Error(t, err)
 
-	_, err = Init(ctx, conf)
+	_, err = auth.Init(ctx, conf)
 	require.NoError(t, err)
 }
 
@@ -797,6 +959,9 @@ func TestPresets(t *testing.T) {
 		teleport.PresetAuditorRoleName,
 		teleport.PresetTerraformProviderRoleName,
 		teleport.PresetWildcardWorkloadIdentityIssuerRoleName,
+		teleport.PresetAccessPluginRoleName,
+		teleport.PresetListAccessRequestResourcesRoleName,
+		teleport.PresetMCPUserRoleName,
 	}
 
 	t.Run("EmptyCluster", func(t *testing.T) {
@@ -804,17 +969,11 @@ func TestPresets(t *testing.T) {
 		clock := clockwork.NewFakeClock()
 		as.SetClock(clock)
 
-		err := createPresetRoles(ctx, as)
-		require.NoError(t, err)
-
-		err = createPresetHealthCheckConfig(ctx, as)
+		err := auth.CreatePresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Second call should not fail
-		err = createPresetRoles(ctx, as)
-		require.NoError(t, err)
-
-		err = createPresetHealthCheckConfig(ctx, as)
+		err = auth.CreatePresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Presets were created
@@ -822,10 +981,6 @@ func TestPresets(t *testing.T) {
 			_, err := as.GetRole(ctx, role)
 			require.NoError(t, err)
 		}
-
-		cfg, err := as.GetHealthCheckConfig(ctx, teleport.PresetDefaultHealthCheckConfigName)
-		require.NoError(t, err)
-		require.NotNil(t, cfg)
 	})
 
 	// Makes sure that existing role with the same name is not modified
@@ -839,7 +994,7 @@ func TestPresets(t *testing.T) {
 		access, err := as.CreateRole(ctx, access)
 		require.NoError(t, err)
 
-		err = createPresetRoles(ctx, as)
+		err = auth.CreatePresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Presets were created
@@ -853,26 +1008,6 @@ func TestPresets(t *testing.T) {
 		require.Equal(t, access.GetLogins(types.Allow), out.GetLogins(types.Allow))
 	})
 
-	t.Run("ExistingHealthCheckConfig", func(t *testing.T) {
-		as := newTestAuthServer(ctx, t)
-		clock := clockwork.NewFakeClock()
-		as.SetClock(clock)
-
-		// an existing health check config should not be modified by init
-		cfg := services.NewPresetHealthCheckConfig()
-		cfg.Spec.Interval = durationpb.New(42 * time.Second)
-		cfg, err := as.CreateHealthCheckConfig(ctx, cfg)
-		require.NoError(t, err)
-
-		err = createPresetHealthCheckConfig(ctx, as)
-		require.NoError(t, err)
-
-		// Preset was created. Ensure it didn't overwrite the existing config
-		got, err := as.GetHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
-		require.NoError(t, err)
-		require.Equal(t, cfg.Spec.Interval.AsDuration(), got.Spec.Interval.AsDuration())
-	})
-
 	// If a default allow condition is not present, ensure it gets added.
 	t.Run("AddDefaultAllowConditions", func(t *testing.T) {
 		as := newTestAuthServer(ctx, t)
@@ -902,7 +1037,7 @@ func TestPresets(t *testing.T) {
 		accessRole, err = as.CreateRole(ctx, accessRole)
 		require.NoError(t, err)
 
-		err = createPresetRoles(ctx, as)
+		err = auth.CreatePresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		outEditor, err := as.GetRole(ctx, editorRole.GetName())
@@ -966,7 +1101,7 @@ func TestPresets(t *testing.T) {
 		require.NoError(t, err)
 
 		// Apply defaults.
-		err = createPresetRoles(ctx, as)
+		err = auth.CreatePresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		outEditor, err := as.GetRole(ctx, editorRole.GetName())
@@ -1037,7 +1172,7 @@ func TestPresets(t *testing.T) {
 				return r, nil
 			})
 
-		err := createPresetRoles(ctx, roleManager)
+		err := auth.CreatePresetRoles(ctx, roleManager)
 		require.NoError(t, err)
 		require.ElementsMatch(t, slices.Collect(maps.Keys(createdPresets)), expectedPresetRoles)
 		require.ElementsMatch(t, slices.Collect(maps.Keys(createdSystemRoles)), expectedSystemRoles)
@@ -1077,7 +1212,7 @@ func TestPresets(t *testing.T) {
 				Return(role, nil)
 		}
 
-		err = createPresetRoles(ctx, roleManager)
+		err = auth.CreatePresetRoles(ctx, roleManager)
 		require.NoError(t, err)
 		roleManager.AssertExpectations(t)
 
@@ -1134,7 +1269,7 @@ func TestPresets(t *testing.T) {
 				return r, nil
 			})
 
-		err = createPresetRoles(ctx, roleManager)
+		err = auth.CreatePresetRoles(ctx, roleManager)
 		require.NoError(t, err)
 		require.Empty(t, remainingPresets)
 		roleManager.AssertExpectations(t)
@@ -1145,7 +1280,7 @@ func TestPresets(t *testing.T) {
 	})
 
 	t.Run("Enterprise", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestBuildType: modules.BuildEnterprise,
 		})
 
@@ -1178,10 +1313,10 @@ func TestPresets(t *testing.T) {
 			// existing cluster and asserting that everything still
 			// returns success
 			for range 2 {
-				err := createPresetRoles(ctx, as)
+				err := auth.CreatePresetRoles(ctx, as)
 				require.NoError(t, err)
 
-				err = createPresetUsers(ctx, as)
+				err = auth.CreatePresetUsers(ctx, as)
 				require.NoError(t, err)
 			}
 
@@ -1207,18 +1342,18 @@ func TestPresets(t *testing.T) {
 			sysUser := services.NewSystemAutomaticAccessBotUser().(*types.UserV2)
 
 			// GIVEN a user database...
-			auth := newMockUserManager(t)
+			manager := newMockUserManager(t)
 
 			// Set the expectation that all user creations will succeed EXCEPT
 			// for our known system user
-			auth.On("CreateUser", mock.Anything, mock.Anything).
+			manager.On("CreateUser", mock.Anything, mock.Anything).
 				Run(requireSystemResource(t, 1)).
 				Maybe().
 				Return(sysUser, nil)
 
 			// All attempts to upsert should succeed, and record the being upserted
 			var upsertedUsers []string
-			auth.On("UpsertUser", mock.Anything, mock.Anything).
+			manager.On("UpsertUser", mock.Anything, mock.Anything).
 				Run(func(args mock.Arguments) {
 					u := args.Get(1).(types.User)
 					upsertedUsers = append(upsertedUsers, u.GetName())
@@ -1226,30 +1361,69 @@ func TestPresets(t *testing.T) {
 				Return(sysUser, nil)
 
 			// WHEN I attempt to create the preset users...
-			err := createPresetUsers(ctx, auth)
+			err := auth.CreatePresetUsers(ctx, manager)
 
 			// EXPECT that the process succeeds and the system user was upserted
 			require.NoError(t, err)
-			auth.AssertExpectations(t)
+			manager.AssertExpectations(t)
 			require.Contains(t, upsertedUsers, sysUser.Metadata.Name)
 		})
 	})
 }
 
+func TestDashboardMode(t *testing.T) {
+	// dashboard mode is determined via cloud and recovery codes
+	modulestest.SetTestModules(t, modulestest.Modules{
+		TestFeatures: modules.Features{
+			Cloud:         false,
+			RecoveryCodes: true,
+		},
+	})
+
+	conf := setupConfig(t)
+	ctx := t.Context()
+	authServer, err := auth.Init(ctx, conf)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err = authServer.Close()
+		require.NoError(t, err)
+	})
+
+	// verify auth server is functional
+	_, err = authServer.GetClusterName(ctx)
+	require.NoError(t, err)
+
+	// verify that preset roles were NOT created in dashboard mode
+	presetRoles := auth.GetPresetRoles()
+
+	for _, role := range presetRoles {
+		_, err := authServer.GetRole(ctx, role.GetName())
+		require.True(t, trace.IsNotFound(err), "expected preset role %q to not exist in dashboard mode", role.GetName())
+	}
+
+	// verify preset users were NOT created in dashboard mode
+	presetUsers := auth.GetPresetUsers()
+
+	for _, user := range presetUsers {
+		_, err := authServer.GetUser(ctx, user.GetName(), false)
+		require.True(t, trace.IsNotFound(err), "expected preset user %q to not exist in dashboard mode", user.GetName())
+	}
+}
+
 func TestGetPresetUsers(t *testing.T) {
 	// no preset users for OSS
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildOSS,
 	})
-	require.Empty(t, getPresetUsers())
+	require.Empty(t, auth.GetPresetUsers())
 
 	// preset user @teleport-access-approval-bot on enterprise
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 	require.Equal(t, []types.User{
 		services.NewSystemAutomaticAccessBotUser(),
-	}, getPresetUsers())
+	}, auth.GetPresetUsers())
 }
 
 type mockUserManager struct {
@@ -1289,13 +1463,13 @@ func (m *mockUserManager) UpsertUser(ctx context.Context, user types.User) (type
 	return args.Get(0).(types.User), args.Error(1)
 }
 
-var _ PresetUsers = &mockUserManager{}
+var _ auth.PresetUsers = &mockUserManager{}
 
 type mockRoleManager struct {
 	mock.Mock
 }
 
-var _ PresetRoleManager = &mockRoleManager{}
+var _ auth.PresetRoleManager = &mockRoleManager{}
 
 func newMockRoleManager(t *testing.T) *mockRoleManager {
 	m := &mockRoleManager{}
@@ -1353,10 +1527,10 @@ func toSet(items []string) map[string]struct{} {
 	return result
 }
 
-func setupConfig(t *testing.T) InitConfig {
+func setupConfig(t *testing.T) auth.InitConfig {
 	tempDir := t.TempDir()
 
-	bk, err := lite.New(context.TODO(), backend.Params{"path": tempDir})
+	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
 
 	processStorage, err := storage.NewProcessStorage(
@@ -1375,7 +1549,7 @@ func setupConfig(t *testing.T) InitConfig {
 		processStorage.Close()
 	})
 
-	return InitConfig{
+	return auth.InitConfig{
 		DataDir:                 tempDir,
 		HostUUID:                "00000000-0000-0000-0000-000000000000",
 		NodeName:                "foo",
@@ -1553,13 +1727,13 @@ func TestInit_bootstrap(t *testing.T) {
 
 	tests := []struct {
 		name         string
-		modifyConfig func(*InitConfig)
+		modifyConfig func(*auth.InitConfig)
 		assertError  require.ErrorAssertionFunc
 	}{
 		{
 			// Issue https://github.com/gravitational/teleport/issues/7853.
 			name: "OK bootstrap CAs",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1575,7 +1749,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "OK bootstrap health check config",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					newHealthCheckConfig(t),
@@ -1585,7 +1759,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap health check config invalid",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					newHealthCheckConfig(t, func(hcc *healthcheckconfigv1.HealthCheckConfig) {
@@ -1597,7 +1771,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap Host CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					invalidHostCA.Clone(),
@@ -1613,7 +1787,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap User CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1629,7 +1803,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap JWT CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1645,7 +1819,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap Database CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1660,7 +1834,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap Database Client CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1676,7 +1850,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap OpenSSH CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1692,7 +1866,7 @@ func TestInit_bootstrap(t *testing.T) {
 		},
 		{
 			name: "NOK bootstrap SAML IdP CA missing keys",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					hostCA.Clone(),
@@ -1712,7 +1886,7 @@ func TestInit_bootstrap(t *testing.T) {
 			cfg := setupConfig(t)
 			test.modifyConfig(&cfg)
 
-			_, err := Init(context.Background(), cfg)
+			_, err := auth.Init(context.Background(), cfg)
 			test.assertError(t, err)
 		})
 	}
@@ -1803,12 +1977,12 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 
 	tests := []struct {
 		name         string
-		modifyConfig func(*InitConfig)
+		modifyConfig func(*auth.InitConfig)
 		assertError  require.ErrorAssertionFunc
 	}{
 		{
 			name: "Apply unsupported resource",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, lock)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, user)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
@@ -1818,14 +1992,14 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 		},
 		{
 			name: "Apply ProvisionToken",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, token)
 			},
 			assertError: require.NoError,
 		},
 		{
 			name: "Apply User (invalid, missing role)",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, user)
 			},
 			assertError: require.Error,
@@ -1833,7 +2007,7 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 		// We test both user+role and role+user to validate that ordering doesn't matter
 		{
 			name: "Apply User+Role",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, user)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
 			},
@@ -1841,7 +2015,7 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 		},
 		{
 			name: "Apply Role+User",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, user)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
 			},
@@ -1849,28 +2023,28 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 		},
 		{
 			name: "Apply Role",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
 			},
 			assertError: require.NoError,
 		},
 		{
 			name: "Apply ClusterNetworkingConfig",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, clusterNetworkingConfig)
 			},
 			assertError: require.NoError,
 		},
 		{
 			name: "Apply AuthPreference",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, authPref)
 			},
 			assertError: require.NoError,
 		},
 		{
 			name: "Apply Role+Bot",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, bot)
 			},
@@ -1878,7 +2052,7 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 		},
 		{
 			name: "Apply Bot+Role",
-			modifyConfig: func(cfg *InitConfig) {
+			modifyConfig: func(cfg *auth.InitConfig) {
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, bot)
 				cfg.ApplyOnStartupResources = append(cfg.ApplyOnStartupResources, role)
 			},
@@ -1890,7 +2064,7 @@ func TestInit_ApplyOnStartup(t *testing.T) {
 			cfg := setupConfig(t)
 			test.modifyConfig(&cfg)
 
-			_, err := Init(context.Background(), cfg)
+			_, err := auth.Init(context.Background(), cfg)
 			test.assertError(t, err)
 		})
 	}
@@ -1929,12 +2103,12 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	ctx := context.Background()
 
 	conf := setupConfig(t)
-	authServer, err := Init(ctx, conf)
+	authServer, err := auth.Init(ctx, conf)
 	require.NoError(t, err)
 	t.Cleanup(func() { authServer.Close() })
 
 	// no getter is registered, sync should fail
-	require.Error(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.Error(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	// maintenance config does not exist yet
 	cmc, err := authServer.GetClusterMaintenanceConfig(ctx)
@@ -1953,7 +2127,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	})
 
 	// sync should now succeed
-	require.NoError(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.NoError(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -1969,7 +2143,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	fakeHour = 16
 	mu.Unlock()
 
-	require.NoError(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.NoError(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -1984,7 +2158,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	fakeHour = 36
 	mu.Unlock()
 
-	require.Error(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.Error(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -2000,7 +2174,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	fakeHour = math.MaxInt64
 	mu.Unlock()
 
-	require.Error(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.Error(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -2016,7 +2190,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	mu.Unlock()
 
 	// sync should now succeed again
-	require.NoError(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.NoError(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -2033,7 +2207,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	fakeError = fmt.Errorf("uh-oh")
 	mu.Unlock()
 
-	require.Error(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.Error(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -2051,7 +2225,7 @@ func TestSyncUpgradeWindowStartHour(t *testing.T) {
 	mu.Unlock()
 
 	// sync should now succeed again
-	require.NoError(t, authServer.syncUpgradeWindowStartHour(ctx))
+	require.NoError(t, authServer.SyncUpgradeWindowStartHour(ctx))
 
 	cmc, err = authServer.GetClusterMaintenanceConfig(ctx)
 	require.NoError(t, err)
@@ -2069,7 +2243,7 @@ func TestIdentityChecker(t *testing.T) {
 	ctx := context.Background()
 
 	conf := setupConfig(t)
-	authServer, err := Init(ctx, conf)
+	authServer, err := auth.Init(ctx, conf)
 	require.NoError(t, err)
 	t.Cleanup(func() { authServer.Close() })
 
@@ -2137,7 +2311,7 @@ func TestIdentityChecker(t *testing.T) {
 			t.Cleanup(func() { sshServer.Close() })
 			require.NoError(t, sshServer.Start())
 
-			identity, err := GenerateIdentity(authServer, state.IdentityID{
+			identity, err := auth.GenerateIdentity(authServer, state.IdentityID{
 				Role:     types.RoleNode,
 				HostUUID: uuid.New().String(),
 				NodeName: "node-1",
@@ -2162,7 +2336,7 @@ func TestIdentityChecker(t *testing.T) {
 func TestInitCreatesCertsIfMissing(t *testing.T) {
 	ctx := context.Background()
 	conf := setupConfig(t)
-	auth, err := Init(ctx, conf)
+	auth, err := auth.Init(ctx, conf)
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		err = auth.Close()
@@ -2280,7 +2454,7 @@ func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) {
 				authCfg.SkipVersionCheck = true
 			}
 
-			_, err = Init(ctx, authCfg)
+			_, err = auth.Init(ctx, authCfg)
 			if test.expectError {
 				require.Error(t, err)
 			} else {
@@ -2397,7 +2571,7 @@ func Test_createPresetDatabaseObjectImportRule(t *testing.T) {
 				listRules: test.existingRules,
 			}
 
-			err := createPresetDatabaseObjectImportRule(context.Background(), m)
+			err := auth.CreatePresetDatabaseObjectImportRule(context.Background(), m)
 			require.NoError(t, err)
 			require.True(t, proto.Equal(test.expectCreate, m.created))
 			require.True(t, proto.Equal(test.expectUpsert, m.upserted))
@@ -2434,15 +2608,15 @@ version: v1`
 
 	for _, test := range []struct {
 		name string
-		fn   func(cfg *InitConfig)
+		fn   func(cfg *auth.InitConfig)
 	}{
-		{name: "bootstrap", fn: func(cfg *InitConfig) { cfg.BootstrapResources = resources }},
-		{name: "apply", fn: func(cfg *InitConfig) { cfg.ApplyOnStartupResources = resources }},
+		{name: "bootstrap", fn: func(cfg *auth.InitConfig) { cfg.BootstrapResources = resources }},
+		{name: "apply", fn: func(cfg *auth.InitConfig) { cfg.ApplyOnStartupResources = resources }},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			cfg := setupConfig(t)
 			test.fn(&cfg)
-			auth, err := Init(ctx, cfg)
+			auth, err := auth.Init(ctx, cfg)
 			require.NoError(t, err)
 
 			config, err := auth.GetAutoUpdateConfig(ctx)
diff --git a/lib/auth/integration/integrationv1/awsoidc.go b/lib/auth/integration/integrationv1/awsoidc.go
index 90d0ef9464846..bb5098df90496 100644
--- a/lib/auth/integration/integrationv1/awsoidc.go
+++ b/lib/auth/integration/integrationv1/awsoidc.go
@@ -21,14 +21,19 @@ package integrationv1
 import (
 	"context"
 	"log/slog"
+	"slices"
+	"strings"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/defaults"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
 	awsutils "github.com/gravitational/teleport/api/utils/aws"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
 	"github.com/gravitational/teleport/lib/modules"
@@ -79,11 +84,105 @@ type AWSOIDCServiceConfig struct {
 	IntegrationService    *Service
 	Authorizer            authz.Authorizer
 	Cache                 CacheAWSOIDC
+	TokenCreator          TokenCreator
 	Clock                 clockwork.Clock
-	ProxyPublicAddrGetter func() string
+	ProxyPublicAddrGetter func(context.Context) string
 	Logger                *slog.Logger
 }
 
+// deleteAWSOIDCAssociatedResources deletes associated discovery_configs and
+// app_servers created by the integration being deleted.  Should only be used by
+// methods that check access for VerbDelete on KindIntegration
+func (s *Service) deleteAWSOIDCAssociatedResources(ctx context.Context, authCtx *authz.Context, ig types.Integration) error {
+	// TODO(alexhemard): follow up work needed to add explicit labels for
+	// resources created by integration rather than rely on implicit rules
+
+	// Delete discovery_configs created by this integration
+	var configsRequireCleanup []string
+	var configsToDelete []string
+
+	for config, err := range clientutils.Resources(ctx, s.cache.ListDiscoveryConfigs) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		awsMatchers := config.Spec.AWS
+
+		config.Spec.AWS = slices.DeleteFunc(config.Spec.AWS, func(matcher types.AWSMatcher) bool {
+			return matcher.Integration == ig.GetName()
+		})
+
+		if len(awsMatchers) == len(config.Spec.AWS) {
+			continue
+		}
+
+		// discovery_configs can be assumed to be created by the integration
+		// and deleted if
+		// 1. only has matchers referencing this integration
+		// 2. has valid uuid name
+		if config.IsMatchersEmpty() {
+			_, err := uuid.Parse(config.GetName())
+
+			if err == nil {
+				configsToDelete = append(configsToDelete, config.GetName())
+				continue
+			}
+		}
+
+		configsRequireCleanup = append(configsRequireCleanup, config.GetName())
+	}
+
+	if len(configsRequireCleanup) > 0 {
+		var qualifiedConfigs []string
+		for _, config := range configsRequireCleanup {
+			qualifiedConfigs = append(qualifiedConfigs, "discovery_config/"+config)
+		}
+
+		return trace.BadParameter("cannot delete integration, "+
+			"Discovery Configs referencing this integration must be removed first: %s\n\n"+
+			"Use `tsh rm %s` to remove them.",
+			strings.Join(configsRequireCleanup, ", "),
+			strings.Join(qualifiedConfigs, " "))
+	}
+
+	for _, configName := range configsToDelete {
+		s.logger.DebugContext(ctx, "Deleting discovery_config associated with integration",
+			"discovery_config", configName,
+			"integration", ig.GetName())
+
+		err := s.backend.DeleteDiscoveryConfig(ctx, configName)
+
+		if err != nil && !trace.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+	}
+
+	// Delete AWS access app_server associated with this integration
+	appServers, err := s.cache.GetApplicationServers(ctx, defaults.Namespace)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, appServer := range appServers {
+		if appServer.GetApp().GetIntegration() == ig.GetName() {
+			s.logger.DebugContext(ctx, "Deleting app_server associated with integration",
+				"app_server", appServer.GetName(),
+				"integration", ig.GetName())
+
+			err := s.backend.DeleteApplicationServer(ctx,
+				appServer.GetNamespace(), appServer.GetHostID(), appServer.GetName())
+
+			if err != nil && !trace.IsNotFound(err) {
+				return trace.Wrap(err)
+			}
+
+			break
+		}
+	}
+
+	return nil
+}
+
 // CheckAndSetDefaults checks the AWSOIDCServiceConfig fields and returns an error if a required param is not provided.
 // Authorizer and IntegrationService are required params.
 func (s *AWSOIDCServiceConfig) CheckAndSetDefaults() error {
@@ -99,6 +198,10 @@ func (s *AWSOIDCServiceConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("cache is required")
 	}
 
+	if s.TokenCreator == nil {
+		return trace.BadParameter("token creator is required")
+	}
+
 	if s.Clock == nil {
 		s.Clock = clockwork.NewRealClock()
 	}
@@ -122,8 +225,9 @@ type AWSOIDCService struct {
 	authorizer            authz.Authorizer
 	logger                *slog.Logger
 	clock                 clockwork.Clock
-	proxyPublicAddrGetter func() string
+	proxyPublicAddrGetter func(context.Context) string
 	cache                 CacheAWSOIDC
+	tokenCreator          TokenCreator
 }
 
 // CacheAWSOIDC is the subset of the cached resources that the Service queries.
@@ -131,13 +235,16 @@ type CacheAWSOIDC interface {
 	// GetToken returns a provision token by name.
 	GetToken(ctx context.Context, name string) (types.ProvisionToken, error)
 
-	// UpsertToken creates or updates a provision token.
-	UpsertToken(ctx context.Context, token types.ProvisionToken) error
-
 	// GetClusterName returns the current cluster name.
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 }
 
+// TokenCreator is a subset of the auth server methods used to create tokens.
+type TokenCreator interface {
+	// UpsertToken creates or updates a provision token.
+	UpsertToken(ctx context.Context, token types.ProvisionToken) error
+}
+
 // NewAWSOIDCService returns a new AWSOIDCService.
 func NewAWSOIDCService(cfg *AWSOIDCServiceConfig) (*AWSOIDCService, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
@@ -151,6 +258,7 @@ func NewAWSOIDCService(cfg *AWSOIDCServiceConfig) (*AWSOIDCService, error) {
 		proxyPublicAddrGetter: cfg.ProxyPublicAddrGetter,
 		clock:                 cfg.Clock,
 		cache:                 cfg.Cache,
+		tokenCreator:          cfg.TokenCreator,
 	}, nil
 }
 
@@ -464,7 +572,7 @@ func (s *AWSOIDCService) DeployDatabaseService(ctx context.Context, req *integra
 		return nil, trace.Wrap(err)
 	}
 
-	deployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, awsClientReq, s.cache)
+	deployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, awsClientReq, s.cache, s.tokenCreator)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -561,7 +669,7 @@ func (s *AWSOIDCService) EnrollEKSClusters(ctx context.Context, req *integration
 		return nil, trace.Wrap(err)
 	}
 
-	publicProxyAddr := s.proxyPublicAddrGetter()
+	publicProxyAddr := s.proxyPublicAddrGetter(ctx)
 	if publicProxyAddr == "" {
 		return nil, trace.BadParameter("could not get public proxy address.")
 	}
@@ -571,7 +679,7 @@ func (s *AWSOIDCService) EnrollEKSClusters(ctx context.Context, req *integration
 		return nil, trace.Wrap(err)
 	}
 
-	enrollEKSClient, err := awsoidc.NewEnrollEKSClustersClient(ctx, awsClientReq, s.cache.UpsertToken)
+	enrollEKSClient, err := awsoidc.NewEnrollEKSClustersClient(ctx, awsClientReq, s.tokenCreator.UpsertToken)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -634,7 +742,7 @@ func (s *AWSOIDCService) DeployService(ctx context.Context, req *integrationpb.D
 		return nil, trace.Wrap(err)
 	}
 
-	deployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, awsClientReq, s.cache)
+	deployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, awsClientReq, s.cache, s.tokenCreator)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/integration/integrationv1/awsoidc_test.go b/lib/auth/integration/integrationv1/awsoidc_test.go
index f5fff709faabb..3fbbf83facdb6 100644
--- a/lib/auth/integration/integrationv1/awsoidc_test.go
+++ b/lib/auth/integration/integrationv1/awsoidc_test.go
@@ -19,6 +19,7 @@
 package integrationv1
 
 import (
+	"context"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -216,12 +217,14 @@ func TestRBAC(t *testing.T) {
 
 	_, err = localClient.CreateIntegration(ctx, ig)
 	require.NoError(t, err)
+	backend := &mockCache{}
 
 	awsoidService, err := NewAWSOIDCService(&AWSOIDCServiceConfig{
 		IntegrationService:    resourceSvc,
 		Authorizer:            resourceSvc.authorizer,
-		ProxyPublicAddrGetter: func() string { return "128.0.0.1" },
-		Cache:                 &mockCache{},
+		ProxyPublicAddrGetter: func(context.Context) string { return "128.0.0.1" },
+		Cache:                 backend,
+		TokenCreator:          backend,
 	})
 	require.NoError(t, err)
 
diff --git a/lib/auth/integration/integrationv1/awsra.go b/lib/auth/integration/integrationv1/awsra.go
new file mode 100644
index 0000000000000..ff12884ea66c3
--- /dev/null
+++ b/lib/auth/integration/integrationv1/awsra.go
@@ -0,0 +1,338 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package integrationv1
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
+)
+
+// GenerateAWSRACredentials generates a set of AWS credentials which uses the AWS Roles Anywhere integration.
+func (s *Service) GenerateAWSRACredentials(ctx context.Context, req *integrationpb.GenerateAWSRACredentialsRequest) (*integrationpb.GenerateAWSRACredentialsResponse, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	for _, allowedRole := range []types.SystemRole{types.RoleAuth, types.RoleProxy} {
+		if authz.HasBuiltinRole(*authCtx, string(allowedRole)) {
+			return s.generateAWSRACredentialsWithoutAuthZ(ctx, req, "" /* trustAnchor */)
+		}
+	}
+
+	return nil, trace.AccessDenied("credential generation is only available to auth or proxy services")
+}
+
+// generateAWSRACredentialsWithoutAuthZ generates a set of AWS credentials which uses the AWS Roles Anywhere integration.
+// Bypasses authz and should only be used by other methods that validate AuthZ.
+// If trustAnchor is unset, it will use the trust anchor from the integration spec.
+func (s *Service) generateAWSRACredentialsWithoutAuthZ(ctx context.Context, req *integrationpb.GenerateAWSRACredentialsRequest, trustAnchor string) (*integrationpb.GenerateAWSRACredentialsResponse, error) {
+	if trustAnchor == "" {
+		spec, err := s.getAWSRolesAnywhereIntegrationSpec(ctx, req.GetIntegration())
+		if err != nil {
+			return nil, trace.BadParameter("trust anchor not provided and could not be fetched from the integration: %v", err)
+		}
+
+		trustAnchor = spec.TrustAnchorARN
+	}
+
+	var durationSeconds *int
+	if req.GetSessionMaxDuration().AsDuration() != 0 {
+		d := int(req.GetSessionMaxDuration().AsDuration().Seconds())
+		durationSeconds = &d
+	}
+
+	awsCredentials, err := awsra.GenerateCredentials(ctx, awsra.GenerateCredentialsRequest{
+		Clock:                 s.clock,
+		TrustAnchorARN:        trustAnchor,
+		ProfileARN:            req.GetProfileArn(),
+		RoleARN:               req.GetRoleArn(),
+		SubjectCommonName:     req.GetSubjectName(),
+		DurationSeconds:       durationSeconds,
+		AcceptRoleSessionName: req.GetProfileAcceptsRoleSessionName(),
+		KeyStoreManager:       s.keyStoreManager,
+		Cache:                 s.cache,
+		CreateSession:         s.awsRolesAnywhereCreateSessionFn,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &integrationpb.GenerateAWSRACredentialsResponse{
+		AccessKeyId:     awsCredentials.AccessKeyID,
+		SecretAccessKey: awsCredentials.SecretAccessKey,
+		SessionToken:    awsCredentials.SessionToken,
+		Expiration:      timestamppb.New(awsCredentials.Expiration),
+	}, nil
+}
+
+func (s *Service) getAWSRolesAnywhereIntegrationSpec(ctx context.Context, integrationName string) (*types.AWSRAIntegrationSpecV1, error) {
+	integration, err := s.cache.GetIntegration(ctx, integrationName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	spec := integration.GetAWSRolesAnywhereIntegrationSpec()
+	if spec == nil {
+		return nil, trace.BadParameter("integration %q is not an AWSRA integration", integrationName)
+	}
+
+	return spec, nil
+}
+
+// AWSRolesAnywhereServiceConfig holds configuration options for the AWSRolesAnywhere Integration gRPC service.
+type AWSRolesAnywhereServiceConfig struct {
+	// IntegrationService is the service that provides access to integration credentials.
+	IntegrationService *Service
+	// Authorizer is the authorizer used to check access to the integration.
+	Authorizer authz.Authorizer
+
+	Clock  clockwork.Clock
+	Logger *slog.Logger
+
+	// newPingClient is used to initialize a PingClient.
+	// If nil, the service will create a new PingClient using the AWS client config.
+	// This is useful for testing purposes, allowing to inject a mock client.
+	newPingClient func(ctx context.Context, req *awsra.AWSClientConfig) (awsra.PingClient, error)
+}
+
+// CheckAndSetDefaults checks the AWSRolesAnywhereServiceConfig fields and returns an error if a required param is not provided.
+func (s *AWSRolesAnywhereServiceConfig) CheckAndSetDefaults() error {
+	if s.Authorizer == nil {
+		return trace.BadParameter("authorizer is required")
+	}
+
+	if s.IntegrationService == nil {
+		return trace.BadParameter("integration service is required")
+	}
+
+	if s.Clock == nil {
+		s.Clock = clockwork.NewRealClock()
+	}
+
+	if s.Logger == nil {
+		s.Logger = slog.With(teleport.ComponentKey, "integrations.awsra.service")
+	}
+
+	if s.newPingClient == nil {
+		s.newPingClient = awsra.NewPingClient
+	}
+
+	return nil
+}
+
+// AWSRolesAnywhereService implements the teleport.integration.v1.AWSRolesAnywhereService RPC service.
+type AWSRolesAnywhereService struct {
+	integrationpb.UnimplementedAWSRolesAnywhereServiceServer
+
+	integrationService *Service
+	authorizer         authz.Authorizer
+	logger             *slog.Logger
+	clock              clockwork.Clock
+
+	// newPingClient is used to initialize a PingClient.
+	// If nil, the service will create a new PingClient using the AWS client config.
+	// This is useful for testing purposes, allowing to inject a mock client.
+	newPingClient func(ctx context.Context, req *awsra.AWSClientConfig) (awsra.PingClient, error)
+}
+
+// NewAWSRolesAnywhereService returns a new AWSRolesAnywhereService.
+func NewAWSRolesAnywhereService(cfg *AWSRolesAnywhereServiceConfig) (*AWSRolesAnywhereService, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ret := &AWSRolesAnywhereService{
+		integrationService: cfg.IntegrationService,
+		logger:             cfg.Logger,
+		authorizer:         cfg.Authorizer,
+		clock:              cfg.Clock,
+		newPingClient:      cfg.newPingClient,
+	}
+
+	return ret, nil
+}
+
+var _ integrationpb.AWSRolesAnywhereServiceServer = (*AWSRolesAnywhereService)(nil)
+
+// ListRolesAnywhereProfiles returns a paginated list of Roles Anywhere Profiles.
+func (s *AWSRolesAnywhereService) ListRolesAnywhereProfiles(ctx context.Context, req *integrationpb.ListRolesAnywhereProfilesRequest) (*integrationpb.ListRolesAnywhereProfilesResponse, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := authCtx.CheckAccessToKind(types.KindIntegration, types.VerbUse); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// ListRolesAnywhereProfiles uses the ProfileSync config's Profile and Role.
+	spec, err := s.integrationService.getAWSRolesAnywhereIntegrationSpec(ctx, req.GetIntegration())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	trustAnchor := spec.TrustAnchorARN
+
+	credentials, err := s.integrationService.generateAWSRACredentialsWithoutAuthZ(ctx, &integrationpb.GenerateAWSRACredentialsRequest{
+		ProfileArn:                    spec.ProfileSyncConfig.ProfileARN,
+		RoleArn:                       spec.ProfileSyncConfig.RoleARN,
+		ProfileAcceptsRoleSessionName: spec.ProfileSyncConfig.ProfileAcceptsRoleSessionName,
+		SubjectName:                   authCtx.Identity.GetIdentity().Username,
+	}, trustAnchor)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	trustAnchorARNParsed, err := arn.Parse(trustAnchor)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	trustAnchorRegion := trustAnchorARNParsed.Region
+
+	listRolesAnywhereClient, err := awsra.NewListRolesAnywhereProfilesClient(ctx, &awsra.AWSClientConfig{
+		Credentials: awsra.Credentials{
+			AccessKeyID:     credentials.AccessKeyId,
+			SecretAccessKey: credentials.SecretAccessKey,
+			SessionToken:    credentials.SessionToken,
+			Expiration:      credentials.Expiration.AsTime(),
+			Version:         1,
+		},
+		Region: trustAnchorRegion,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	profileList, err := awsra.ListRolesAnywhereProfiles(ctx, listRolesAnywhereClient, awsra.ListRolesAnywhereProfilesRequest{
+		NextToken:          req.GetNextPageToken(),
+		ProfileNameFilters: req.GetProfileNameFilters(),
+		IgnoredProfileARNs: []string{spec.ProfileSyncConfig.ProfileARN},
+		PageSize:           int(req.GetPageSize()),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &integrationpb.ListRolesAnywhereProfilesResponse{
+		Profiles:      profileList.Profiles,
+		NextPageToken: profileList.NextToken,
+	}, nil
+}
+
+// AWSRolesAnywherePing performs a health check for the AWS Roles Anywhere integration.
+// If the integration is absent from the request, then it will use the trust anchor, profile and role from the request.
+// This is useful for testing an integration that was not yet created.
+//
+// If the integration is present in the request, it will use the trust anchor and the profile, role from the integration's ProfileSync config.
+//
+// It returns the caller identity and the number of AWS Roles Anywhere Profiles that are active.
+func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req *integrationpb.AWSRolesAnywherePingRequest) (*integrationpb.AWSRolesAnywherePingResponse, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := authCtx.CheckAccessToKind(types.KindIntegration, types.VerbUse); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var trustAnchorARN, profileARN, roleARN string
+
+	switch req.Mode.(type) {
+	case *integrationpb.AWSRolesAnywherePingRequest_Integration:
+		spec, err := s.integrationService.getAWSRolesAnywhereIntegrationSpec(ctx, req.GetIntegration())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		trustAnchorARN = spec.TrustAnchorARN
+		profileARN = spec.ProfileSyncConfig.ProfileARN
+		roleARN = spec.ProfileSyncConfig.RoleARN
+
+	case *integrationpb.AWSRolesAnywherePingRequest_Custom:
+		trustAnchorARN = req.GetCustom().GetTrustAnchorArn()
+		profileARN = req.GetCustom().GetProfileArn()
+		roleARN = req.GetCustom().GetRoleArn()
+
+	default:
+		return nil, trace.BadParameter("either integration or custom request must be provided")
+	}
+
+	s.logger.DebugContext(ctx, "Testing AWS IAM Roles Anywhere integration",
+		"integration", req.GetIntegration(),
+		"trust_anchor", trustAnchorARN,
+		"profile_arn", profileARN,
+		"role_arn", roleARN,
+	)
+
+	credentialsRequest := &integrationpb.GenerateAWSRACredentialsRequest{
+		ProfileArn:  profileARN,
+		RoleArn:     roleARN,
+		SubjectName: authCtx.Identity.GetIdentity().Username,
+	}
+
+	trustAnchorARNParsed, err := arn.Parse(trustAnchorARN)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	trustAnchorRegion := trustAnchorARNParsed.Region
+
+	credentials, err := s.integrationService.generateAWSRACredentialsWithoutAuthZ(ctx, credentialsRequest, trustAnchorARN)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	pingClient, err := s.newPingClient(ctx, &awsra.AWSClientConfig{
+		Credentials: awsra.Credentials{
+			AccessKeyID:     credentials.AccessKeyId,
+			SecretAccessKey: credentials.SecretAccessKey,
+			SessionToken:    credentials.SessionToken,
+			Expiration:      credentials.Expiration.AsTime(),
+			Version:         1,
+		},
+		Region: trustAnchorRegion,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ignoredProfiles := []string{profileARN}
+
+	pingResp, err := awsra.Ping(ctx, pingClient, ignoredProfiles)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &integrationpb.AWSRolesAnywherePingResponse{
+		ProfileCount: int32(pingResp.EnabledProfileCounter),
+		AccountId:    pingResp.AccountID,
+		Arn:          pingResp.ARN,
+		UserId:       pingResp.UserID,
+	}, nil
+}
diff --git a/lib/auth/integration/integrationv1/awsra_test.go b/lib/auth/integration/integrationv1/awsra_test.go
new file mode 100644
index 0000000000000..f244f0d0e310d
--- /dev/null
+++ b/lib/auth/integration/integrationv1/awsra_test.go
@@ -0,0 +1,279 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package integrationv1
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+func TestGenerateAWSRACredentials(t *testing.T) {
+	t.Parallel()
+	clusterName := "test-cluster"
+	integrationName := "my-integration"
+	proxyPublicAddr := "example.com:443"
+
+	ca := newCertAuthority(t, types.AWSRACA, clusterName)
+	ctx, localClient, resourceSvc := initSvc(t, ca, clusterName, proxyPublicAddr)
+
+	ig, err := types.NewIntegrationAWSRA(
+		types.Metadata{Name: integrationName},
+		&types.AWSRAIntegrationSpecV1{
+			TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+		},
+	)
+	require.NoError(t, err)
+	_, err = localClient.CreateIntegration(ctx, ig)
+	require.NoError(t, err)
+
+	ctx = authorizerForDummyUser(t, ctx, types.RoleSpecV6{
+		Allow: types.RoleConditions{Rules: []types.Rule{
+			{Resources: []string{types.KindIntegration}, Verbs: []string{types.VerbUse}},
+		}},
+	}, localClient)
+
+	t.Run("requesting with an user should return access denied", func(t *testing.T) {
+		ctx = authorizerForDummyUser(t, ctx, types.RoleSpecV6{
+			Allow: types.RoleConditions{Rules: []types.Rule{
+				{Resources: []string{types.KindIntegration}, Verbs: []string{types.VerbUse}},
+			}},
+		}, localClient)
+
+		_, err := resourceSvc.GenerateAWSRACredentials(ctx, &integrationv1.GenerateAWSRACredentialsRequest{
+			Integration: integrationName,
+			RoleArn:     "arn:aws:iam::123456789012:role/OpsTeam",
+			ProfileArn:  "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+			SubjectName: "test",
+		})
+		require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %T", err)
+	})
+
+	t.Run("auth and proxy can request credentials", func(t *testing.T) {
+		for _, allowedRole := range []types.SystemRole{types.RoleAuth, types.RoleProxy} {
+			ctx = authz.ContextWithUser(ctx, authz.BuiltinRole{
+				Role:                  types.RoleInstance,
+				AdditionalSystemRoles: []types.SystemRole{allowedRole},
+				Username:              string(allowedRole),
+				Identity: tlsca.Identity{
+					Username: string(allowedRole),
+				},
+			})
+
+			_, err := resourceSvc.GenerateAWSRACredentials(ctx, &integrationv1.GenerateAWSRACredentialsRequest{
+				Integration:                   integrationName,
+				RoleArn:                       "arn:aws:iam::123456789012:role/OpsTeam",
+				ProfileArn:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+				ProfileAcceptsRoleSessionName: true,
+				SubjectName:                   "test",
+			})
+			require.NoError(t, err)
+		}
+	})
+}
+
+func TestAWSRolesAnywhereProfileSyncFilters(t *testing.T) {
+	t.Parallel()
+	clusterName := "test-cluster"
+	proxyPublicAddr := "example.com:443"
+
+	ca := newCertAuthority(t, types.AWSRACA, clusterName)
+	ctx, localClient, resourceSvc := initSvc(t, ca, clusterName, proxyPublicAddr)
+
+	ctx = authorizerForDummyUser(t, ctx, types.RoleSpecV6{
+		Allow: types.RoleConditions{Rules: []types.Rule{
+			{Resources: []string{types.KindIntegration}, Verbs: []string{types.VerbCreate, types.VerbUpdate}},
+		}},
+	}, localClient)
+
+	integrationWithFilters := func(t *testing.T, integrationName string, filters []string) *types.IntegrationV1 {
+		ig, err := types.NewIntegrationAWSRA(
+			types.Metadata{Name: integrationName},
+			&types.AWSRAIntegrationSpecV1{
+				TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+				ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+					Enabled:            true,
+					ProfileARN:         "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+					RoleARN:            "arn:aws:iam::123456789012:role/SyncRole",
+					ProfileNameFilters: filters,
+				},
+			},
+		)
+		require.NoError(t, err)
+		return ig
+	}
+
+	t.Run("valid without filters", func(t *testing.T) {
+		ig := integrationWithFilters(t, "integration1", []string{})
+		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+			Integration: ig,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("valid with glob filter", func(t *testing.T) {
+		ig := integrationWithFilters(t, "integration2", []string{"MyTeam-*"})
+		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+			Integration: ig,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("valid with regex filter", func(t *testing.T) {
+		ig := integrationWithFilters(t, "integration3", []string{"^MyTeam-.*$"})
+		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+			Integration: ig,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("invalid with invalid regex", func(t *testing.T) {
+		ig := integrationWithFilters(t, "integration5", []string{`^[invalid-regex{$`})
+		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+			Integration: ig,
+		})
+		require.Error(t, err)
+	})
+}
+
+func TestAWSRolesAnywherePing(t *testing.T) {
+	t.Parallel()
+	clusterName := "test-cluster"
+	integrationName := "my-integration"
+	proxyPublicAddr := "example.com:443"
+
+	ca := newCertAuthority(t, types.AWSRACA, clusterName)
+	ctx, localClient, resourceSvc := initSvc(t, ca, clusterName, proxyPublicAddr)
+
+	ig, err := types.NewIntegrationAWSRA(
+		types.Metadata{Name: integrationName},
+		&types.AWSRAIntegrationSpecV1{
+			TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+			ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+				Enabled:    false,
+				ProfileARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+				RoleARN:    "arn:aws:iam::123456789012:role/SyncRole",
+			},
+		},
+	)
+	require.NoError(t, err)
+	_, err = localClient.CreateIntegration(ctx, ig)
+	require.NoError(t, err)
+
+	ctx = authorizerForDummyUser(t, ctx, types.RoleSpecV6{
+		Allow: types.RoleConditions{Rules: []types.Rule{
+			{Resources: []string{types.KindIntegration}, Verbs: []string{types.VerbUse}},
+		}},
+	}, localClient)
+
+	exampleProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("ExampleProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+		RoleArns: []string{
+			"arn:aws:iam::123456789012:role/ExampleRole",
+			"arn:aws:iam::123456789012:role/SyncRole",
+		},
+	}
+
+	awsRolesAnywhereService, err := NewAWSRolesAnywhereService(&AWSRolesAnywhereServiceConfig{
+		IntegrationService: resourceSvc,
+		Authorizer:         resourceSvc.authorizer,
+		Clock:              resourceSvc.clock,
+		Logger:             resourceSvc.logger,
+		newPingClient: func(ctx context.Context, req *awsra.AWSClientConfig) (awsra.PingClient, error) {
+			return &mockPingClient{
+				accountID: "123456789012",
+				profiles: []ratypes.ProfileDetail{
+					exampleProfile,
+				},
+			}, nil
+		},
+	})
+	require.NoError(t, err)
+
+	t.Run("test connection using an integration", func(t *testing.T) {
+		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, &integrationv1.AWSRolesAnywherePingRequest{
+			Mode: &integrationv1.AWSRolesAnywherePingRequest_Integration{
+				Integration: integrationName,
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, pingResp)
+		require.Equal(t, "123456789012", pingResp.AccountId)
+		require.Equal(t, int32(1), pingResp.ProfileCount)
+	})
+
+	t.Run("test connection using provided trust anchor", func(t *testing.T) {
+		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, &integrationv1.AWSRolesAnywherePingRequest{
+			Mode: &integrationv1.AWSRolesAnywherePingRequest_Custom{
+				Custom: &integrationv1.AWSRolesAnywherePingRequestWithoutIntegration{
+					TrustAnchorArn: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+					RoleArn:        "arn:aws:iam::123456789012:role/SyncRole",
+					ProfileArn:     "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+				},
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, pingResp)
+		require.Equal(t, "123456789012", pingResp.AccountId)
+		require.Equal(t, int32(1), pingResp.ProfileCount)
+	})
+}
+
+type mockPingClient struct {
+	accountID string
+	profiles  []ratypes.ProfileDetail
+}
+
+func (m *mockPingClient) ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error) {
+	return &rolesanywhere.ListProfilesOutput{
+		Profiles:  m.profiles,
+		NextToken: nil,
+	}, nil
+}
+
+func (m *mockPingClient) ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error) {
+	return &rolesanywhere.ListTagsForResourceOutput{
+		Tags: []ratypes.Tag{
+			{Key: aws.String("MyTagKey"), Value: aws.String("my-tag-value")},
+		},
+	}, nil
+}
+
+func (m *mockPingClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return &sts.GetCallerIdentityOutput{
+		Account: aws.String(m.accountID),
+		Arn:     aws.String("arn:aws:iam::123456789012:user/test-user"),
+		UserId:  aws.String("USERID1234567890"),
+	}, nil
+}
diff --git a/lib/auth/integration/integrationv1/credentials_test.go b/lib/auth/integration/integrationv1/credentials_test.go
index 1ef332e913cc8..437c6f48a6685 100644
--- a/lib/auth/integration/integrationv1/credentials_test.go
+++ b/lib/auth/integration/integrationv1/credentials_test.go
@@ -30,10 +30,11 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestExportIntegrationCertAuthorities(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	ca := newCertAuthority(t, types.HostCA, "test-cluster")
 	ctx, localClient, resourceSvc := initSvc(t, ca, ca.GetClusterName(), "127.0.0.1")
diff --git a/lib/auth/integration/integrationv1/github_test.go b/lib/auth/integration/integrationv1/github_test.go
index 35ae05f3f8f78..7800cdece92a5 100644
--- a/lib/auth/integration/integrationv1/github_test.go
+++ b/lib/auth/integration/integrationv1/github_test.go
@@ -33,10 +33,11 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestGenerateGitHubUserCert(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	ca := newCertAuthority(t, types.HostCA, "test-cluster")
 	ctx, _, resourceSvc := initSvc(t, ca, ca.GetClusterName(), "127.0.0.1.nip.io")
diff --git a/lib/auth/integration/integrationv1/service.go b/lib/auth/integration/integrationv1/service.go
index af6444ac64185..6aae9ed7d7a94 100644
--- a/lib/auth/integration/integrationv1/service.go
+++ b/lib/auth/integration/integrationv1/service.go
@@ -28,7 +28,6 @@ import (
 	"github.com/jonboulle/clockwork"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"k8s.io/apimachinery/pkg/util/validation"
 
 	"github.com/gravitational/teleport"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
@@ -38,8 +37,11 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/integrations/awscommon"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // Cache is the subset of the cached resources that the Service queries.
@@ -52,11 +54,24 @@ type Cache interface {
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool) (types.CertAuthority, error)
 
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of registered proxies.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+
 	// IntegrationsGetter defines methods to access Integration resources.
 	services.IntegrationsGetter
 
+	// DiscoveryConfigsGetter defines methods to access DiscoveryConfig resources.
+	services.DiscoveryConfigsGetter
+
+	// AppServersGetter defines methods to access application servers.
+	services.AppServersGetter
+
 	// GetPluginStaticCredentialsByLabels will get a list of plugin static credentials resource by matching labels.
 	GetPluginStaticCredentialsByLabels(ctx context.Context, labels map[string]string) ([]types.PluginStaticCredentials, error)
 }
@@ -69,6 +84,9 @@ type KeyStoreManager interface {
 	NewSSHKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.SSHKeyPair, error)
 	// GetSSHSignerFromKeySet selects a usable SSH keypair from the provided key set.
 	GetSSHSignerFromKeySet(ctx context.Context, keySet types.CAKeySet) (ssh.Signer, error)
+	// GetTLSCertAndSigner selects a usable TLS keypair from the given CA
+	// and returns the PEM-encoded TLS certificate and a [crypto.Signer].
+	GetTLSCertAndSigner(ctx context.Context, ca types.CertAuthority) ([]byte, crypto.Signer, error)
 }
 
 // Backend defines the interface for all the backend services that the
@@ -77,6 +95,8 @@ type Backend interface {
 	services.Integrations
 	services.PluginStaticCredentials
 	services.GitServers
+	services.DiscoveryConfigs
+	services.Presence
 }
 
 // ServiceConfig holds configuration options for
@@ -89,6 +109,11 @@ type ServiceConfig struct {
 	Logger          *slog.Logger
 	Clock           clockwork.Clock
 	Emitter         apievents.Emitter
+
+	// awsRolesAnywhereCreateSessionFn is a function that creates an AWS Roles Anywhere session.
+	// This is used to allow mocking in tests, because the real implementation does
+	// If not set, the default implementation is used.
+	awsRolesAnywhereCreateSessionFn func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error)
 }
 
 // CheckAndSetDefaults checks the ServiceConfig fields and returns an error if
@@ -136,6 +161,8 @@ type Service struct {
 	logger          *slog.Logger
 	clock           clockwork.Clock
 	emitter         apievents.Emitter
+
+	awsRolesAnywhereCreateSessionFn func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error)
 }
 
 // NewService returns a new Integrations gRPC service.
@@ -152,6 +179,8 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		backend:         cfg.Backend,
 		clock:           cfg.Clock,
 		emitter:         cfg.Emitter,
+
+		awsRolesAnywhereCreateSessionFn: cfg.awsRolesAnywhereCreateSessionFn,
 	}, nil
 }
 
@@ -233,12 +262,13 @@ func (s *Service) CreateIntegration(ctx context.Context, req *integrationpb.Crea
 		if err := s.createGitHubCredentials(ctx, req.Integration); err != nil {
 			return nil, trace.Wrap(err)
 		}
-	case types.IntegrationSubKindAWSOIDC:
-		// AWS OIDC Integration can be used as source of credentials to access AWS Web/CLI.
-		// This creates a new AppServer whose endpoint is <integrationName>.<proxyURL>, which can fail if integrationName is not a valid DNS Label.
-		// Instead of failing when the integration is already created, it fails at creation time.
-		if errs := validation.IsDNS1035Label(req.GetIntegration().GetName()); len(errs) > 0 {
-			return nil, trace.BadParameter("integration name %q must be a lower case valid DNS subdomain so that it can be used to allow Web/CLI access", req.GetIntegration().GetName())
+	case types.IntegrationSubKindAWSOIDC, types.IntegrationSubKindAWSRolesAnywhere:
+		if err := awscommon.ValidIntegrationName(req.Integration.GetName()); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if err := validateAWSRolesAnywhereProfileFilters(req.Integration); err != nil {
+			return nil, trace.Wrap(err)
 		}
 	}
 
@@ -288,6 +318,10 @@ func (s *Service) UpdateIntegration(ctx context.Context, req *integrationpb.Upda
 		return nil, trace.Wrap(err)
 	}
 
+	if err := validateAWSRolesAnywhereProfileFilters(req.Integration); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	if err := s.maybeUpdateStaticCredentials(ctx, req.Integration); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -327,6 +361,24 @@ func (s *Service) UpdateIntegration(ctx context.Context, req *integrationpb.Upda
 	return igV1, nil
 }
 
+func validateAWSRolesAnywhereProfileFilters(ig types.Integration) error {
+	rolesAnywhereSpec := ig.GetAWSRolesAnywhereIntegrationSpec()
+	if rolesAnywhereSpec == nil {
+		return nil
+	}
+
+	if rolesAnywhereSpec.ProfileSyncConfig == nil {
+		return nil
+	}
+
+	for _, profileNameFilter := range rolesAnywhereSpec.ProfileSyncConfig.ProfileNameFilters {
+		if _, err := utils.CompileExpression(profileNameFilter); err != nil {
+			return trace.BadParameter("invalid filter %q, use glob-like matching or regex by adding the anchors (eg, ^regex$): %v", profileNameFilter, err)
+		}
+	}
+	return nil
+}
+
 // DeleteIntegration removes the specified Integration resource.
 //
 // This RPC may remove multiple resources in the backend:
@@ -443,16 +495,23 @@ func (s *Service) ensureNoAssociatedResources(ctx context.Context, ig types.Inte
 
 func (s *Service) ensureNoGitHubAssociatedResources(ctx context.Context, ig types.Integration) error {
 	s.logger.DebugContext(ctx, "Checking GitHub integration associated resources", "integration", ig.GetName())
-	return trace.Wrap(clientutils.IterateResources(ctx, s.backend.ListGitServers, func(server types.Server) error {
+	for server, err := range clientutils.Resources(ctx, s.backend.ListGitServers) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
 		if server.GetGitHub() != nil && server.GetGitHub().Integration == ig.GetName() {
 			return trace.BadParameter("git servers associated with integration %s must be deleted first", ig.GetName())
 		}
-		return nil
-	}))
+	}
+
+	return nil
 }
 
 func (s *Service) deleteAssociatedResources(ctx context.Context, authCtx *authz.Context, ig types.Integration) error {
 	switch ig.GetSubKind() {
+	case types.IntegrationSubKindAWSOIDC:
+		return trace.Wrap(s.deleteAWSOIDCAssociatedResources(ctx, authCtx, ig))
 	case types.IntegrationSubKindGitHub:
 		return trace.Wrap(s.deleteGitHubAssociatedResources(ctx, authCtx, ig))
 	default:
@@ -471,10 +530,15 @@ func (s *Service) deleteGitHubAssociatedResources(ctx context.Context, authCtx *
 		return trace.Wrap(err)
 	}
 
-	return trace.Wrap(clientutils.IterateResources(ctx, s.backend.ListGitServers, func(server types.Server) error {
-		if server.GetGitHub() == nil || server.GetGitHub().Integration != ig.GetName() {
-			return nil
+	for server, err := range clientutils.Resources(ctx, s.backend.ListGitServers) {
+		if err != nil {
+			return trace.Wrap(err)
 		}
-		return trace.Wrap(s.backend.DeleteGitServer(ctx, server.GetName()))
-	}))
+
+		if server.GetGitHub() != nil && server.GetGitHub().Integration == ig.GetName() {
+			return trace.Wrap(s.backend.DeleteGitServer(ctx, server.GetName()))
+		}
+	}
+
+	return nil
 }
diff --git a/lib/auth/integration/integrationv1/service_test.go b/lib/auth/integration/integrationv1/service_test.go
index a130e07b3b8fd..8c59f1a4f67bd 100644
--- a/lib/auth/integration/integrationv1/service_test.go
+++ b/lib/auth/integration/integrationv1/service_test.go
@@ -21,38 +21,45 @@ package integrationv1
 import (
 	"cmp"
 	"context"
+	"crypto/x509/pkix"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/defaults"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	"github.com/gravitational/teleport/api/types/externalauditstorage"
+	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/lib/auth/integration/credentials"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
 func TestIntegrationCRUD(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	clusterName := "test-cluster"
 	proxyPublicAddr := "127.0.0.1.nip.io"
@@ -463,15 +470,19 @@ func TestIntegrationCRUD(t *testing.T) {
 				_, err := localClient.CreateIntegration(ctx, sampleIntegrationFn(t, igName))
 				require.NoError(t, err)
 				// other existing plugin should not affect identity center plugin referenced integration.
-				require.NoError(t, localClient.CreatePlugin(ctx, fixtures.NewMattermostPlugin(t)))
-				require.NoError(t, localClient.CreatePlugin(ctx, fixtures.NewIdentityCenterPlugin(t, igName, igName)))
+				_, err = localClient.CreateIntegration(ctx, sampleIntegrationFn(t, "another-plugin"))
+				require.NoError(t, err)
+				require.NoError(t, localClient.CreatePlugin(ctx, NewMattermostPlugin()))
+				require.NoError(t, localClient.CreatePlugin(ctx, NewIdentityCenterPlugin(igName, igName)))
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: "another-plugin"})
+				require.NoError(t, err)
+				require.NoError(t, localClient.DeletePlugin(ctx, types.PluginTypeMattermost))
+				_, err = resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
 				return err
 			},
 			Cleanup: func(t *testing.T, igName string) {
-				require.NoError(t, localClient.DeletePlugin(ctx, types.PluginTypeMattermost))
 				require.NoError(t, localClient.DeletePlugin(ctx, types.PluginTypeAWSIdentityCenter))
 			},
 			ErrAssertion: trace.IsBadParameter,
@@ -658,6 +669,108 @@ func TestIntegrationCRUD(t *testing.T) {
 			},
 			ErrAssertion: noError,
 		},
+		{
+			Name: "cannot delete AWS OIDC integration with user-created discovery config",
+			Role: types.RoleSpecV6{
+				Allow: types.RoleConditions{Rules: []types.Rule{
+					{
+						Resources: []string{types.KindIntegration},
+						Verbs:     []string{types.VerbDelete},
+					},
+				}},
+			},
+			Setup: func(t *testing.T, igName string) {
+				t.Helper()
+				ig := sampleIntegrationFn(t, igName)
+				_, err := localClient.CreateIntegration(ctx, ig)
+				require.NoError(t, err)
+				_, err = localClient.CreateDiscoveryConfig(ctx, mustMakeDiscoveryConfig(t, ig))
+				require.NoError(t, err)
+				problematicConfig := mustMakeDiscoveryConfig(t, ig)
+				problematicConfig.Metadata.Name = "problematicconfig"
+				_, err = localClient.CreateDiscoveryConfig(ctx, problematicConfig)
+				require.NoError(t, err)
+			},
+			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
+				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+					Name:                      igName,
+					DeleteAssociatedResources: true,
+				})
+				return err
+			},
+			Validate: func(t *testing.T, igName string) {
+				t.Helper()
+				_, err := localClient.GetIntegration(context.Background(), igName)
+				require.NoError(t, err)
+				_, err = localClient.GetDiscoveryConfig(context.Background(), igName)
+				require.NoError(t, err)
+				_, err = localClient.GetDiscoveryConfig(context.Background(), "problematicconfig")
+				require.NoError(t, err)
+			},
+			ErrAssertion: trace.IsBadParameter,
+		},
+		{
+			Name: "delete AWS OIDC integration with associated resources",
+			Role: types.RoleSpecV6{
+				Allow: types.RoleConditions{Rules: []types.Rule{
+					{
+						Resources: []string{types.KindIntegration},
+						Verbs:     []string{types.VerbDelete},
+					},
+				}},
+			},
+			Setup: func(t *testing.T, igName string) {
+				t.Helper()
+
+				ig := sampleIntegrationFn(t, igName)
+				_, err := localClient.CreateIntegration(ctx, ig)
+				require.NoError(t, err)
+				_, err = localClient.CreateDiscoveryConfig(ctx, mustMakeDiscoveryConfig(t, ig))
+				require.NoError(t, err)
+				_, err = localClient.UpsertApplicationServer(ctx, mustMakeAppServer(t, ig))
+				require.NoError(t, err)
+
+				anotherIg := sampleIntegrationFn(t, igName+igName)
+				_, err = localClient.CreateIntegration(ctx, anotherIg)
+				require.NoError(t, err)
+				_, err = localClient.CreateDiscoveryConfig(ctx, mustMakeDiscoveryConfig(t, anotherIg))
+				require.NoError(t, err)
+				_, err = localClient.UpsertApplicationServer(ctx, mustMakeAppServer(t, anotherIg))
+				require.NoError(t, err)
+			},
+			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
+				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+					Name:                      igName,
+					DeleteAssociatedResources: true,
+				})
+				return err
+			},
+			Validate: func(t *testing.T, igName string) {
+				t.Helper()
+				// discovery_config associated with the integration is removed
+				_, err := localClient.GetDiscoveryConfig(context.Background(), igName)
+				require.True(t, trace.IsNotFound(err))
+				// app_server associated with the integration is removed
+				appServers, err := localClient.GetApplicationServers(context.Background(), defaults.Namespace)
+				require.NoError(t, err)
+				for _, appServer := range appServers {
+					require.NotEqual(t, igName, appServer.GetApp().GetIntegration(),
+						"app server with integration %s should have been deleted", igName)
+				}
+				// other integrations' associated resources should remain
+				_, err = localClient.GetDiscoveryConfig(context.Background(), igName+igName)
+				require.NoError(t, err)
+				require.Condition(t, func() bool {
+					for _, appServer := range appServers {
+						if appServer.GetApp().GetIntegration() == igName+igName {
+							return true
+						}
+					}
+					return false
+				}, "app server with integration %s should still exist", igName+igName)
+			},
+			ErrAssertion: noError,
+		},
 
 		// Delete all
 		{
@@ -738,6 +851,8 @@ type localClient interface {
 	services.PluginStaticCredentials
 	services.Integrations
 	services.GitServers
+	services.DiscoveryConfigs
+	services.Presence
 }
 
 type testClient struct {
@@ -747,6 +862,64 @@ type testClient struct {
 	services.UserGetter
 }
 
+// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_Mattermost settings.
+func NewMattermostPlugin() *types.PluginV1 {
+	return &types.PluginV1{
+		SubKind: types.PluginSubkindAccess,
+		Metadata: types.Metadata{
+			Labels: map[string]string{
+				"teleport.dev/hosted-plugin": "true",
+			},
+			Name: types.PluginTypeMattermost,
+		},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_Mattermost{
+				Mattermost: &types.PluginMattermostSettings{
+					ServerUrl:     "https://example.com",
+					Channel:       "test_channel",
+					Team:          "test_team",
+					ReportToEmail: "test@example.com",
+				},
+			},
+		},
+		Credentials: &types.PluginCredentialsV1{
+			Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
+				StaticCredentialsRef: &types.PluginStaticCredentialsRef{
+					Labels: map[string]string{
+						"plugin": "mattermost",
+					},
+				},
+			},
+		},
+	}
+}
+
+// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_AwsIc settings.
+func NewIdentityCenterPlugin(serviceProviderName, integrationName string) *types.PluginV1 {
+	return &types.PluginV1{
+		Metadata: types.Metadata{
+			Name: types.PluginTypeAWSIdentityCenter,
+			Labels: map[string]string{
+				types.HostedPluginLabel: "true",
+			},
+		},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_AwsIc{
+				AwsIc: &types.PluginAWSICSettings{
+					IntegrationName:         integrationName,
+					Region:                  "test-region",
+					Arn:                     "test-arn",
+					AccessListDefaultOwners: []string{"user1", "user2"},
+					ProvisioningSpec: &types.AWSICProvisioningSpec{
+						BaseUrl: "https://example.com",
+					},
+					SamlIdpServiceProviderName: serviceProviderName,
+				},
+			},
+		},
+	}
+}
+
 func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPublicAddr string) (context.Context, localClient, *Service) {
 	ctx := context.Background()
 	backend, err := memory.New(memory.Config{})
@@ -788,6 +961,8 @@ func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPubl
 	require.NoError(t, err)
 	gitServerService, err := local.NewGitServerService(backend)
 	require.NoError(t, err)
+	discoveryConfigService, err := local.NewDiscoveryConfigService(backend)
+	require.NoError(t, err)
 
 	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
 		ClusterName: clusterName,
@@ -800,15 +975,20 @@ func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPubl
 	require.NoError(t, err)
 	localCredService, err := local.NewPluginStaticCredentialsService(backend)
 	require.NoError(t, err)
+	presenceService := local.NewPresenceService(backend)
 
 	backendSvc := struct {
 		services.Integrations
 		services.PluginStaticCredentials
 		services.GitServers
+		services.DiscoveryConfigs
+		services.Presence
 	}{
 		Integrations:            localResourceService,
 		PluginStaticCredentials: localCredService,
 		GitServers:              gitServerService,
+		DiscoveryConfigs:        discoveryConfigService,
+		Presence:                presenceService,
 	}
 
 	cacheResourceService, err := local.NewIntegrationsService(backend, local.WithIntegrationsServiceCacheMode(true))
@@ -824,14 +1004,31 @@ func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPubl
 		},
 		IntegrationsService:            *cacheResourceService,
 		PluginStaticCredentialsService: localCredService,
+		DiscoveryConfigService:         discoveryConfigService,
+		PresenceService:                presenceService,
 	}
 
+	keystoreManager, err := keystore.NewManager(t.Context(), &servicecfg.KeystoreConfig{}, &keystore.Options{
+		ClusterName:          &types.ClusterNameV2{Metadata: types.Metadata{Name: clusterName}},
+		AuthPreferenceGetter: clusterConfigSvc,
+	})
+	require.NoError(t, err)
+
 	resourceSvc, err := NewService(&ServiceConfig{
 		Backend:         backendSvc,
 		Authorizer:      authorizer,
 		Cache:           cache,
-		KeyStoreManager: keystore.NewSoftwareKeystoreForTests(t),
+		KeyStoreManager: keystoreManager,
 		Emitter:         events.NewDiscardEmitter(),
+		awsRolesAnywhereCreateSessionFn: func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+			return &createsession.CreateSessionResponse{
+				Version:         1,
+				AccessKeyID:     "access-key-id",
+				SecretAccessKey: "secret-access-key",
+				SessionToken:    "session-token",
+				Expiration:      time.Now().Add(1 * time.Hour).Format(time.RFC3339),
+			}, nil
+		},
 	})
 	require.NoError(t, err)
 
@@ -843,6 +1040,8 @@ func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPubl
 		*local.PluginsService
 		*local.PluginStaticCredentialsService
 		*local.GitServerService
+		*local.DiscoveryConfigService
+		*local.PresenceService
 	}{
 		AccessService:                  roleSvc,
 		IdentityService:                userSvc,
@@ -851,6 +1050,8 @@ func initSvc(t *testing.T, ca types.CertAuthority, clusterName string, proxyPubl
 		PluginsService:                 pluginSvc,
 		PluginStaticCredentialsService: localCredService,
 		GitServerService:               gitServerService,
+		DiscoveryConfigService:         discoveryConfigService,
+		PresenceService:                presenceService,
 	}, resourceSvc
 }
 
@@ -863,6 +1064,8 @@ type mockCache struct {
 
 	local.IntegrationsService
 	*local.PluginStaticCredentialsService
+	*local.DiscoveryConfigService
+	*local.PresenceService
 }
 
 func (m *mockCache) GetProxies() ([]types.Server, error) {
@@ -872,6 +1075,13 @@ func (m *mockCache) GetProxies() ([]types.Server, error) {
 	return m.proxies, nil
 }
 
+func (m *mockCache) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	if m.returnErr != nil {
+		return nil, "", m.returnErr
+	}
+	return m.proxies, "", nil
+}
+
 func (m *mockCache) GetToken(ctx context.Context, token string) (types.ProvisionToken, error) {
 	return nil, nil
 }
@@ -902,6 +1112,9 @@ func newCertAuthority(t *testing.T, caType types.CertAuthType, domain string) ty
 	pub, priv, err := ta.GenerateJWT()
 	require.NoError(t, err)
 
+	key, cert, err := tlsca.GenerateSelfSignedCA(pkix.Name{CommonName: domain}, nil, time.Minute)
+	require.NoError(t, err)
+
 	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
 		Type:        caType,
 		ClusterName: domain,
@@ -911,6 +1124,10 @@ func newCertAuthority(t *testing.T, caType types.CertAuthType, domain string) ty
 				PrivateKey:     priv,
 				PrivateKeyType: types.PrivateKeyType_RAW,
 			}},
+			TLS: []*types.TLSKeyPair{{
+				Key:  key,
+				Cert: cert,
+			}},
 		},
 	})
 	require.NoError(t, err)
@@ -985,3 +1202,42 @@ func mustMakeGitHubServer(t *testing.T, ig types.Integration) types.Server {
 	server.SetName(ig.GetName())
 	return server
 }
+
+func mustMakeDiscoveryConfig(t *testing.T, ig types.Integration) *discoveryconfig.DiscoveryConfig {
+	t.Helper()
+	discoveryConfig, err := discoveryconfig.NewDiscoveryConfig(
+		header.Metadata{Name: ig.GetName()},
+		discoveryconfig.Spec{
+			DiscoveryGroup: ig.GetName(),
+			AWS: []types.AWSMatcher{
+				{
+					Types:       []string{"ec2"},
+					Regions:     []string{"us-west-2"},
+					Integration: ig.GetName(),
+				},
+			},
+		},
+	)
+	require.NoError(t, err)
+	return discoveryConfig
+}
+
+func mustMakeAppServer(t *testing.T, ig types.Integration) types.AppServer {
+	t.Helper()
+	appServer, err := types.NewAppServerV3(types.Metadata{
+		Name: ig.GetName(),
+	}, types.AppServerSpecV3{
+		HostID: ig.GetName(),
+		App: &types.AppV3{
+			Metadata: types.Metadata{
+				Name: ig.GetName(),
+			},
+			Spec: types.AppSpecV3{
+				URI:         "https://example.com",
+				Integration: ig.GetName(),
+			},
+		},
+	})
+	require.NoError(t, err)
+	return appServer
+}
diff --git a/lib/auth/join.go b/lib/auth/join.go
index b73dc61690d5f..9ec86812d0dcf 100644
--- a/lib/auth/join.go
+++ b/lib/auth/join.go
@@ -20,11 +20,10 @@ package auth
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"log/slog"
+	"maps"
 	"slices"
 	"strings"
 
@@ -42,6 +41,10 @@ import (
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
+	"github.com/gravitational/teleport/lib/join/provision"
 )
 
 // checkTokenJoinRequestCommon checks all token join rules that are common to
@@ -64,34 +67,9 @@ func (a *Server) checkTokenJoinRequestCommon(ctx context.Context, req *types.Reg
 		return nil, trace.AccessDenied("%q can not join the cluster with role %q, %s", req.NodeName, req.Role, msg)
 	}
 
-	// instance certs can be requested by any agent that has at least one local service role (e.g. proxy, node, etc).
-	if req.Role == types.RoleInstance {
-		hasLocalServiceRole := false
-		for _, role := range provisionToken.GetRoles() {
-			if role.IsLocalService() {
-				hasLocalServiceRole = true
-				break
-			}
-		}
-		if !hasLocalServiceRole {
-			a.logger.WarnContext(ctx, "cannot requisition instance certs (token contains no local service roles)",
-				"node_name", req.NodeName,
-				"host_id", req.HostID,
-			)
-			return nil, trace.AccessDenied("%s [%v] cannot requisition instance certs (token contains no local service roles)", req.NodeName, req.HostID)
-		}
-	}
-
-	// make sure the caller is requesting a role allowed by the token
-	if !provisionToken.GetRoles().Include(req.Role) && req.Role != types.RoleInstance {
-		a.logger.WarnContext(ctx, "token does not allow role to join the cluster",
-			"node_name", req.NodeName,
-			"host_id", req.HostID,
-			"role", req.Role,
-		)
-		return nil, trace.BadParameter("node %q [%v] can not join the cluster, the token does not allow %q role", req.NodeName, req.HostID, req.Role)
+	if err := join.TokenAllowsRole(provisionToken, req.Role); err != nil {
+		return nil, trace.Wrap(err)
 	}
-
 	return provisionToken, nil
 }
 
@@ -115,7 +93,7 @@ func (a *Server) handleJoinFailure(
 	}
 
 	// Fetch and encode rawJoinAttrs if they are available.
-	attributesStruct, err := rawJoinAttrsToStruct(rawJoinAttrs)
+	attributesStruct, err := joinutils.RawJoinAttrsToStruct(rawJoinAttrs)
 	if err != nil {
 		a.logger.WarnContext(ctx, "Unable to fetch join attributes from join method", "error", err)
 	}
@@ -195,6 +173,8 @@ func (a *Server) handleJoinFailure(
 //
 // If the token includes a specific join method, the rules for that join method
 // will be checked.
+//
+// This method is being phased out in favor of [join.Server.Join].
 func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsingTokenRequest) (certs *proto.Certs, err error) {
 	attrs := &workloadidentityv1pb.JoinAttrs{}
 	var rawClaims any
@@ -206,6 +186,10 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		}
 	}()
 
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
+	}
+
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -327,30 +311,51 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 	// With all elements of the token validated, we can now generate & return
 	// certificates.
 	if req.Role == types.RoleBot {
-		certs, _, err = a.generateCertsBot(
-			ctx,
-			provisionToken,
-			req,
-			rawClaims,
-			attrs,
-		)
-		return certs, trace.Wrap(err)
+		certs, _, err = a.GenerateBotCertsForJoin(ctx, provisionToken, makeBotCertsParams(req, rawClaims, attrs))
+	} else {
+		certs, err = a.GenerateHostCertsForJoin(ctx, provisionToken, makeHostCertsParams(req, rawClaims))
 	}
-	certs, err = a.generateCerts(ctx, provisionToken, req, rawClaims)
 	return certs, trace.Wrap(err)
 }
 
-func (a *Server) generateCertsBot(
+func makeHostCertsParams(req *types.RegisterUsingTokenRequest, rawClaims any) *join.HostCertsParams {
+	return &join.HostCertsParams{
+		HostID:               req.HostID,
+		HostName:             req.NodeName,
+		SystemRole:           req.Role,
+		PublicTLSKey:         req.PublicTLSKey,
+		PublicSSHKey:         req.PublicSSHKey,
+		AdditionalPrincipals: req.AdditionalPrincipals,
+		DNSNames:             req.DNSNames,
+		RemoteAddr:           req.RemoteAddr,
+		RawJoinClaims:        rawClaims,
+	}
+}
+
+func makeBotCertsParams(req *types.RegisterUsingTokenRequest, rawClaims any, attrs *workloadidentityv1pb.JoinAttrs) *join.BotCertsParams {
+	return &join.BotCertsParams{
+		PublicTLSKey:  req.PublicTLSKey,
+		PublicSSHKey:  req.PublicSSHKey,
+		BotInstanceID: req.BotInstanceID,
+		BotGeneration: req.BotGeneration,
+		Expires:       req.Expires,
+		RemoteAddr:    req.RemoteAddr,
+		RawJoinClaims: rawClaims,
+		Attrs:         attrs,
+	}
+}
+
+// GenerateBotCertsForJoin generates and returns bot certificates as the result
+// of a cluster join attempt.
+func (a *Server) GenerateBotCertsForJoin(
 	ctx context.Context,
-	provisionToken types.ProvisionToken,
-	req *types.RegisterUsingTokenRequest,
-	rawJoinClaims any,
-	attrs *workloadidentityv1pb.JoinAttrs,
+	token provision.Token,
+	params *join.BotCertsParams,
 ) (*proto.Certs, string, error) {
 	// bots use this endpoint but get a user cert
 	// botResourceName must be set, enforced in CheckAndSetDefaults
-	botName := provisionToken.GetBotName()
-	joinMethod := provisionToken.GetJoinMethod()
+	botName := token.GetBotName()
+	joinMethod := token.GetJoinMethod()
 
 	// Check this is a join method for bots we support.
 	if !slices.Contains(machineidv1.SupportedJoinMethods, joinMethod) {
@@ -372,8 +377,8 @@ func (a *Server) generateCertsBot(
 	}
 
 	expires := a.GetClock().Now().Add(defaults.DefaultRenewableCertTTL)
-	if req.Expires != nil {
-		expires = *req.Expires
+	if params.Expires != nil {
+		expires = *params.Expires
 	}
 
 	// Construct a Join event to be sent later.
@@ -387,14 +392,14 @@ func (a *Server) generateCertsBot(
 		},
 		BotName:   botName,
 		Method:    string(joinMethod),
-		TokenName: provisionToken.GetSafeName(),
+		TokenName: token.GetSafeName(),
 		UserName:  machineidv1.BotResourceName(botName),
 		ConnectionMetadata: apievents.ConnectionMetadata{
-			RemoteAddr: req.RemoteAddr,
+			RemoteAddr: params.RemoteAddr,
 		},
 	}
 	var err error
-	joinEvent.Attributes, err = rawJoinAttrsToStruct(rawJoinClaims)
+	joinEvent.Attributes, err = joinutils.RawJoinAttrsToStruct(params.RawJoinClaims)
 	if err != nil {
 		a.logger.WarnContext(
 			ctx,
@@ -405,14 +410,14 @@ func (a *Server) generateCertsBot(
 
 	// Prepare join attributes for encoding into the X509 cert and for inclusion
 	// in audit logs.
-	if attrs == nil {
-		attrs = &workloadidentityv1pb.JoinAttrs{}
+	if params.Attrs == nil {
+		params.Attrs = &workloadidentityv1pb.JoinAttrs{}
 	}
-	attrs.Meta = &workloadidentityv1pb.JoinAttrsMeta{
+	params.Attrs.Meta = &workloadidentityv1pb.JoinAttrsMeta{
 		JoinMethod: string(joinMethod),
 	}
 	if joinMethod != types.JoinMethodToken {
-		attrs.Meta.JoinTokenName = provisionToken.GetName()
+		params.Attrs.Meta.JoinTokenName = token.GetName()
 	}
 
 	auth := &machineidv1pb.BotInstanceStatusAuthentication{
@@ -420,16 +425,14 @@ func (a *Server) generateCertsBot(
 		// TODO: GetSafeName may not return an appropriate value for later
 		// comparison / locking purposes, and this also shouldn't contain
 		// secrets. Should we hash it?
-		JoinToken:  provisionToken.GetSafeName(),
-		JoinMethod: string(provisionToken.GetJoinMethod()),
-		// TODO(nklaassen): consider logging the SSH public key as well, for now
-		// the SSH and TLS public keys are still identical for tbot.
-		PublicKey: req.PublicTLSKey,
-		JoinAttrs: attrs,
+		JoinToken:  token.GetSafeName(),
+		JoinMethod: string(token.GetJoinMethod()),
+		PublicKey:  params.PublicTLSKey,
+		JoinAttrs:  params.Attrs,
 	}
 
 	// TODO(noah): In v19, we can drop writing to the deprecated Metadata field.
-	auth.Metadata, err = rawJoinAttrsToGoogleStruct(rawJoinClaims)
+	auth.Metadata, err = rawJoinAttrsToGoogleStruct(params.RawJoinClaims)
 	if err != nil {
 		a.logger.WarnContext(ctx, "Unable to encode struct value for join metadata", "error", err)
 	}
@@ -438,16 +441,16 @@ func (a *Server) generateCertsBot(
 		ctx,
 		botName,
 		machineidv1.BotResourceName(botName),
-		req.RemoteAddr,
-		req.PublicSSHKey,
-		req.PublicTLSKey,
+		params.RemoteAddr,
+		params.PublicSSHKey,
+		params.PublicTLSKey,
 		expires,
 		renewable,
 		auth,
-		req.BotInstanceID,
-		req.PreviousBotInstanceID,
-		req.BotGeneration,
-		attrs,
+		params.BotInstanceID,
+		params.PreviousBotInstanceID,
+		params.BotGeneration,
+		params.Attrs,
 	)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
@@ -456,9 +459,9 @@ func (a *Server) generateCertsBot(
 
 	if shouldDeleteToken {
 		// delete ephemeral bot join tokens so they can't be re-used
-		if err := a.DeleteToken(ctx, provisionToken.GetName()); err != nil {
+		if err := a.DeleteToken(ctx, token.GetName()); err != nil {
 			a.logger.WarnContext(ctx, "Could not delete bot provision token after generating certs",
-				"provision_token", provisionToken.GetSafeName(),
+				"provision_token", token.GetSafeName(),
 				"error", err,
 			)
 		}
@@ -475,59 +478,65 @@ func (a *Server) generateCertsBot(
 	return certs, botInstanceID, nil
 }
 
-func (a *Server) generateCerts(
+// GenerateHostCertsForJoin generates and returns host certificates as the
+// result of a cluster join attempt.
+func (a *Server) GenerateHostCertsForJoin(
 	ctx context.Context,
-	provisionToken types.ProvisionToken,
-	req *types.RegisterUsingTokenRequest,
-	rawJoinClaims any,
+	token provision.Token,
+	params *join.HostCertsParams,
 ) (*proto.Certs, error) {
-	if req.Expires != nil {
-		return nil, trace.BadParameter("'expires' cannot be set on join for non-bot certificates")
-	}
-
 	// instance certs include an additional field that specifies the list of
 	// all services authorized by the token.
-	var systemRoles []types.SystemRole
-	if req.Role == types.RoleInstance {
-		for _, r := range provisionToken.GetRoles() {
+	var systemRoles types.SystemRoles
+	if params.SystemRole == types.RoleInstance {
+		systemRolesSet := make(map[types.SystemRole]struct{})
+		for _, r := range token.GetRoles() {
 			if r.IsLocalService() {
-				systemRoles = append(systemRoles, r)
+				systemRolesSet[r] = struct{}{}
 			} else {
 				a.logger.WarnContext(ctx, "Omitting non-service system role from instance cert", "system_role", string(r))
 			}
 		}
+		for _, r := range params.AuthenticatedSystemRoles {
+			if r.IsLocalService() {
+				systemRolesSet[r] = struct{}{}
+			} else {
+				a.logger.WarnContext(ctx, "Omitting non-service system role from instance cert", "system_role", string(r))
+			}
+		}
+		systemRoles = types.SystemRoles(slices.Collect(maps.Keys(systemRolesSet)))
 	}
 
 	// generate and return host certificate and keys
 	certs, err := a.GenerateHostCerts(ctx,
 		&proto.HostCertsRequest{
-			HostID:               req.HostID,
-			NodeName:             req.NodeName,
-			Role:                 req.Role,
-			AdditionalPrincipals: req.AdditionalPrincipals,
-			PublicTLSKey:         req.PublicTLSKey,
-			PublicSSHKey:         req.PublicSSHKey,
-			RemoteAddr:           req.RemoteAddr,
-			DNSNames:             req.DNSNames,
+			HostID:               params.HostID,
+			NodeName:             params.HostName,
+			Role:                 params.SystemRole,
+			AdditionalPrincipals: params.AdditionalPrincipals,
+			PublicTLSKey:         params.PublicTLSKey,
+			PublicSSHKey:         params.PublicSSHKey,
+			RemoteAddr:           params.RemoteAddr,
+			DNSNames:             params.DNSNames,
 			SystemRoles:          systemRoles,
-		})
+		}, token.GetAssignedScope())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Emit audit event
-	if req.Role == types.RoleInstance {
+	if params.SystemRole == types.RoleInstance {
 		a.logger.InfoContext(ctx, "Instance has joined the cluster",
-			"node_name", req.NodeName,
-			"host_id", req.HostID,
-			"role", req.Role,
+			"node_name", params.HostName,
+			"host_id", params.HostID,
+			"role", params.SystemRole,
 			"system_roles", systemRoles,
 		)
 	} else {
 		a.logger.InfoContext(ctx, "Instance has joined the cluster",
-			"node_name", req.NodeName,
-			"host_id", req.HostID,
-			"role", req.Role,
+			"node_name", params.HostName,
+			"host_id", params.HostID,
+			"role", params.SystemRole,
 		)
 	}
 	joinEvent := &apievents.InstanceJoin{
@@ -538,17 +547,17 @@ func (a *Server) generateCerts(
 		Status: apievents.Status{
 			Success: true,
 		},
-		NodeName:     req.NodeName,
-		Role:         string(req.Role),
-		Method:       string(provisionToken.GetJoinMethod()),
-		TokenName:    provisionToken.GetSafeName(),
-		TokenExpires: provisionToken.Expiry(),
-		HostID:       req.HostID,
+		NodeName:     params.HostName,
+		Role:         string(params.SystemRole),
+		Method:       string(token.GetJoinMethod()),
+		TokenName:    token.GetSafeName(),
+		TokenExpires: token.Expiry(),
+		HostID:       params.HostID,
 		ConnectionMetadata: apievents.ConnectionMetadata{
-			RemoteAddr: req.RemoteAddr,
+			RemoteAddr: params.RemoteAddr,
 		},
 	}
-	joinEvent.Attributes, err = rawJoinAttrsToStruct(rawJoinClaims)
+	joinEvent.Attributes, err = joinutils.RawJoinAttrsToStruct(params.RawJoinClaims)
 	if err != nil {
 		a.logger.WarnContext(ctx, "Unable to fetch join attributes from join method", "error", err)
 	}
@@ -558,21 +567,6 @@ func (a *Server) generateCerts(
 	return certs, nil
 }
 
-func rawJoinAttrsToStruct(in any) (*apievents.Struct, error) {
-	if in == nil {
-		return nil, nil
-	}
-	attrBytes, err := json.Marshal(in)
-	if err != nil {
-		return nil, trace.Wrap(err, "marshaling join attributes")
-	}
-	out := &apievents.Struct{}
-	if err := out.UnmarshalJSON(attrBytes); err != nil {
-		return nil, trace.Wrap(err, "unmarshaling join attributes")
-	}
-	return out, nil
-}
-
 func rawJoinAttrsToGoogleStruct(in any) (*structpb.Struct, error) {
 	if in == nil {
 		return nil, nil
@@ -587,14 +581,3 @@ func rawJoinAttrsToGoogleStruct(in any) (*structpb.Struct, error) {
 	}
 	return out, nil
 }
-
-func generateChallenge(encoding *base64.Encoding, length int) (string, error) {
-	// read crypto-random bytes to generate the challenge
-	challengeRawBytes := make([]byte, length)
-	if _, err := rand.Read(challengeRawBytes); err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	// encode the challenge to base64 so it can be sent over HTTP
-	return encoding.EncodeToString(challengeRawBytes), nil
-}
diff --git a/lib/auth/join/boundkeypair/boundkeypair.go b/lib/auth/join/boundkeypair/boundkeypair.go
index ffff96253cacf..ebde7c09a3fa2 100644
--- a/lib/auth/join/boundkeypair/boundkeypair.go
+++ b/lib/auth/join/boundkeypair/boundkeypair.go
@@ -20,8 +20,13 @@ package boundkeypair
 
 import (
 	"context"
+	"crypto"
+	"encoding/json"
+	"log/slog"
 	"os"
 	"path/filepath"
+	"sync"
+	"time"
 
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
@@ -29,71 +34,140 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/join"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/sshutils"
 )
 
 const (
-	PrivateKeyPath = "id_bkp"
-	PublicKeyPath  = PrivateKeyPath + ".pub"
-	JoinStatePath  = "bkp_state"
+	PrivateKeyPath   = "id_bkp"
+	PublicKeyPath    = PrivateKeyPath + ".pub"
+	JoinStatePath    = "bkp_state"
+	KeyHistoryPath   = "bkp_key_history.json"
+	KeyHistoryLength = 10
 
 	StandardFileWriteMode = 0600
 )
 
-// ClientState contains state parameters stored on disk needed to complete the
+// KeyHistoryEntry records a private key and the timestamp it was generated.
+type KeyHistoryEntry struct {
+	// Time is the time this key was inserted into the history.
+	Time time.Time `json:"time"`
+
+	// PrivateKey is the private key, encoded in PEM format.
+	PrivateKey string `json:"private_key"`
+}
+
+// KeyHistory is a collection of `KeyHistoryEntry`.
+type KeyHistory struct {
+	Entries []KeyHistoryEntry `json:"entries"`
+}
+
+// ClientParams contains optional parameters host processes (tbot, teleport
+// agents, etc) may expose as user config values.
+type ClientParams struct {
+	// RegistrationSecret is a one-time secret used to authenticate an initial
+	// join when a public key has not been preregistered.
+	RegistrationSecret string
+}
+
+// ClientState is the minimal interface needed to generate joining parameters.
+type ClientState interface {
+	ToJoinParams(params ClientParams) *join.BoundKeypairParams
+	UpdateFromRegisterResult(result *join.RegisterResult) error
+	Store(ctx context.Context) error
+}
+
+// FSClientState contains state parameters stored on disk needed to complete the
 // bound keypair join process.
-type ClientState struct {
+type FSClientState struct {
+	mu sync.Mutex
+	fs FS
+
 	// PrivateKey is the parsed private key.
 	PrivateKey *keys.PrivateKey
 
-	// PrivateKeyBytes contains the private key bytes. This value should always
-	// be nonempty.
+	// PrivateKeyBytes contains the active private key bytes. This value should
+	// always be nonempty.
 	PrivateKeyBytes []byte
 
-	// PublicKeyBytes contains the public key bytes. This value is not used at
-	// runtime, and is only set when a public key should be written to disk,
-	// like on first creation or during rotation. To consistently access the
-	// public key, use `.PrivateKey.Public()`.
+	// PublicKeyBytes contains the active public key bytes. This value is not
+	// used at runtime, and is only set when a public key should be written to
+	// disk, like on first creation or during rotation. To consistently access
+	// the public key, use `.PrivateKey.Public()`.
 	PublicKeyBytes []byte
 
 	// JoinStateBytes contains join state bytes. This value will be empty if
 	// this client has not yet joined.
 	JoinStateBytes []byte
+
+	// KeyHistory records previous keypairs. In the event of a cluster rollback,
+	// this history will allow clients to rejoin if the cluster requests a
+	// keypair not currently marked as active.
+	KeyHistory []KeyHistoryEntry
 }
 
 // ToJoinParams creates joining parameters for use with `join.Register()` from
 // this client state.
-func (c *ClientState) ToJoinParams(initialJoinSecret string) *join.BoundKeypairParams {
+func (c *FSClientState) ToJoinParams(params ClientParams) *join.BoundKeypairParams {
+	registrationSecret := params.RegistrationSecret
 	if len(c.JoinStateBytes) > 0 {
 		// This identity has been bound, so don't pass along the join secret (if
 		// any)
-		initialJoinSecret = ""
+		registrationSecret = ""
 	}
 
 	return &join.BoundKeypairParams{
-		// Note: pass the internal signer because go-jose does type assertions
-		// on the standard library types.
-		CurrentKey:        c.PrivateKey.Signer,
-		PreviousJoinState: c.JoinStateBytes,
-		InitialJoinSecret: initialJoinSecret,
+		PreviousJoinState:  c.JoinStateBytes,
+		RegistrationSecret: registrationSecret,
+		GetSigner: func(pubKey string) (crypto.Signer, error) {
+			return c.SignerForPublicKey([]byte(pubKey))
+		},
+		RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+			signer, err := c.GenerateKeypair(ctx, getSuite)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			// Make sure to store the intermediate state. We don't want to risk
+			// losing a private key if an error occurs between here and the end
+			// of the join process, but also don't want to force
+			// `GenerateKeypair()` to trigger a `Store()` on every call, so it's
+			// reasonably done here.
+			if err := c.Store(ctx); err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return signer, nil
+		},
 	}
 }
 
 // UpdateFromRegisterResult updates this client state from the register result.
-func (c *ClientState) UpdateFromRegisterResult(result *join.RegisterResult) error {
+func (c *FSClientState) UpdateFromRegisterResult(result *join.RegisterResult) error {
 	if result.BoundKeypair == nil {
 		return trace.BadParameter("register result is missing bound keypair parameters")
 	}
 
-	c.JoinStateBytes = result.BoundKeypair.JoinState
+	signer, err := c.SignerForPublicKey([]byte(result.BoundKeypair.BoundPublicKey))
+	if err != nil {
+		return trace.Wrap(err, "fetching key requested by auth")
+	}
 
-	// TODO: When implementing rotation, use the bound public key value to set
-	// the current public key.
+	if err := c.SetActiveKey(signer); err != nil {
+		return trace.Wrap(err, "setting new active key")
+	}
+
+	// The helpers above may lock the mutex, so don't lock it until we're
+	// touching fields directly.
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.JoinStateBytes = result.BoundKeypair.JoinState
 
 	return nil
 }
 
-// ToPublicKeyBytes returns the public key bytes in ssh authorized_keys format.
-func (c *ClientState) ToPublicKeyBytes() ([]byte, error) {
+// ToPublicKeyBytes returns the active public key in ssh authorized_keys format.
+func (c *FSClientState) ToPublicKeyBytes() ([]byte, error) {
 	sshPubKey, err := ssh.NewPublicKey(c.PrivateKey.Public())
 	if err != nil {
 		return nil, trace.Wrap(err, "creating ssh public key")
@@ -102,6 +176,149 @@ func (c *ClientState) ToPublicKeyBytes() ([]byte, error) {
 	return ssh.MarshalAuthorizedKey(sshPubKey), nil
 }
 
+// pubKeyEqual compares the two public keys per their `Equal()` implementation.
+func pubKeyEqual(a, b crypto.PublicKey) (bool, error) {
+	aEq, ok := a.(interface {
+		Equal(x crypto.PublicKey) bool
+	})
+	if !ok {
+		return false, trace.BadParameter("unsupported key type %T", a)
+	}
+
+	return aEq.Equal(b), nil
+}
+
+// SignerForPublicKey attempts to resolve a signer for the given public key
+// encoded in authorized_keys format.
+func (c *FSClientState) SignerForPublicKey(authorizedKeysBytes []byte) (crypto.Signer, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	desiredPubKey, err := sshutils.CryptoPublicKey(authorizedKeysBytes)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Check the active key first, if available.
+	if c.PrivateKey != nil {
+		activePubKey := c.PrivateKey.Public()
+
+		equal, err := pubKeyEqual(desiredPubKey, activePubKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		} else if equal {
+			// Parse a fresh copy of the key since this will escape the mutex and we
+			// can't be sure our local copy is thread safe.
+			key, err := keys.ParsePrivateKey(c.PrivateKeyBytes)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return key.Signer, nil
+		}
+	}
+
+	// Otherwise, search through the key history. If a keypair rotation was
+	// requested an `GenerateKeypair` was called, the new keypair should have
+	// been inserted at the top of this list.
+	for _, entry := range c.KeyHistory {
+		pk, err := keys.ParsePrivateKey([]byte(entry.PrivateKey))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		equal, err := pubKeyEqual(desiredPubKey, pk.Signer.Public())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if equal {
+			return pk.Signer, nil
+		}
+	}
+
+	return nil, trace.NotFound("no matching key found")
+}
+
+// GenerateKeypair generates a new keypair, adds it to the key history, and
+// returns the resulting signer signer.
+func (c *FSClientState) GenerateKeypair(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+	key, err := cryptosuites.GenerateKey(ctx, getSuite, cryptosuites.BoundKeypairJoining)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating keypair")
+	}
+
+	privateKeyBytes, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return nil, trace.Wrap(err, "marshallng private key")
+	}
+
+	// prepend the new key to the top of the list for faster lookup
+	c.KeyHistory = append([]KeyHistoryEntry{{
+		Time:       time.Now(),
+		PrivateKey: string(privateKeyBytes),
+	}}, c.KeyHistory...)
+
+	// Trim if necessary.
+	if len(c.KeyHistory) > KeyHistoryLength {
+		c.KeyHistory = c.KeyHistory[:min(len(c.KeyHistory), KeyHistoryLength)]
+	}
+
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err, "creating ssh public key")
+	}
+
+	slog.InfoContext(ctx, "Generated new keypair", "public_key", string(ssh.MarshalAuthorizedKey(sshPubKey)))
+
+	return key, nil
+}
+
+// SetActiveKey updates the active keypair to reflect the given signer. Has no
+// effect if the active keypair's public key is already equal to the given
+// signer's public key, per its `Equals` implementation. Note that
+// `StoreClientState` still must be called after this to commit the changes to
+// the storage backend.
+func (c *FSClientState) SetActiveKey(signer crypto.Signer) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.PrivateKey != nil {
+		equal, err := pubKeyEqual(signer.Public(), c.PrivateKey.Public())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if equal {
+			// nothing to do; specified key is already the active key
+			return nil
+		}
+	}
+
+	key, err := keys.NewPrivateKey(signer)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	privateKeyBytes, err := keys.MarshalPrivateKey(key.Signer)
+	if err != nil {
+		return trace.Wrap(err, "marshallng private key")
+	}
+
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return trace.Wrap(err, "creating ssh public key")
+	}
+
+	c.PrivateKey = key
+	c.PrivateKeyBytes = privateKeyBytes
+	c.PublicKeyBytes = ssh.MarshalAuthorizedKey(sshPubKey)
+
+	slog.InfoContext(context.Background(), "Set new active keypair", "public_key", string(c.PublicKeyBytes))
+
+	return nil
+}
+
 type FS interface {
 	Read(ctx context.Context, name string) ([]byte, error)
 	Write(ctx context.Context, name string, data []byte) error
@@ -133,6 +350,16 @@ func NewStandardFS(parentDir string) FS {
 	}
 }
 
+// parseKeyHistory parses marshaled key history from JSON bytes
+func parseKeyHistory(data []byte) (KeyHistory, error) {
+	var history KeyHistory
+	if err := json.Unmarshal(data, &history); err != nil {
+		return KeyHistory{}, trace.Wrap(err)
+	}
+
+	return history, nil
+}
+
 // LoadClientState attempts to load bound keypair client state from the given
 // filesystem implementation. Callers should expect to handle NotFound errors
 // returned here if a private key is not found; this indicates no prior client
@@ -140,12 +367,19 @@ func NewStandardFS(parentDir string) FS {
 // a keypair has been pregenerated, no prior join state will exist, and the
 // join state will be empty; any corresponding errors while reading nonexistent
 // join state documents will be ignored.
-func LoadClientState(ctx context.Context, fs FS) (*ClientState, error) {
+func LoadClientState(ctx context.Context, fs FS) (*FSClientState, error) {
 	privateKeyBytes, err := fs.Read(ctx, PrivateKeyPath)
 	if err != nil {
 		return nil, trace.Wrap(err, "reading private key")
 	}
 
+	// The private key may be empty if this is an initial join attempt using a
+	// configured registration secret. This is allowed, but callers should
+	// handle this via `NewEmptyClientState()`
+	if len(privateKeyBytes) == 0 {
+		return nil, trace.NotFound("no active private key found")
+	}
+
 	joinStateBytes, err := fs.Read(ctx, JoinStatePath)
 	if trace.IsNotFound(err) {
 		// Join state doesn't exist, this is allowed.
@@ -158,46 +392,84 @@ func LoadClientState(ctx context.Context, fs FS) (*ClientState, error) {
 		return nil, trace.Wrap(err, "parsing private key")
 	}
 
-	return &ClientState{
-		PrivateKey: pk,
+	var keyHistory KeyHistory
+	keyHistoryBytes, err := fs.Read(ctx, KeyHistoryPath)
+	if trace.IsNotFound(err) {
+		// No history, this is allowed.
+	} else if err != nil {
+		slog.WarnContext(ctx, "unable to read key history, may be unable to recover in the event of a cluster rollback", "error", err)
+	} else if len(keyHistoryBytes) > 0 {
+		keyHistory, err = parseKeyHistory(keyHistoryBytes)
+		if err != nil {
+			slog.WarnContext(ctx, "unable to parse key history, may be unable to recover in the event of a cluster rollback", "error", err)
+		}
+	}
+
+	// If the key history is empty, initialize it with just the current key.
+	if len(keyHistory.Entries) == 0 {
+		keyHistory.Entries = []KeyHistoryEntry{{
+			Time:       time.Now(),
+			PrivateKey: string(privateKeyBytes),
+		}}
+	}
+
+	return &FSClientState{
+		fs: fs,
 
+		PrivateKey:      pk,
 		PrivateKeyBytes: privateKeyBytes,
 		JoinStateBytes:  joinStateBytes,
+		KeyHistory:      keyHistory.Entries,
 	}, nil
 }
 
 // StoreClientState writes bound keypair client state to the given filesystem
 // wrapper. Public keys and join state will only be written if
-func StoreClientState(ctx context.Context, fs FS, state *ClientState) error {
-	if err := fs.Write(ctx, PrivateKeyPath, state.PrivateKeyBytes); err != nil {
+func (c *FSClientState) Store(ctx context.Context) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.fs.Write(ctx, PrivateKeyPath, c.PrivateKeyBytes); err != nil {
 		return trace.Wrap(err, "writing private key")
 	}
 
-	// TODO: maybe consider just not writing the public key at all. End users
-	// aren't really meant to look in the internal storage, and we can just
-	// derive the public key whenever we want.
-
 	// Only write the public key if it was explicitly provided. This helps save
 	// an unnecessary file write.
-	if len(state.PublicKeyBytes) > 0 {
-		if err := fs.Write(ctx, PublicKeyPath, state.PublicKeyBytes); err != nil {
+	if len(c.PublicKeyBytes) > 0 {
+		if err := c.fs.Write(ctx, PublicKeyPath, c.PublicKeyBytes); err != nil {
 			return trace.Wrap(err, "writing public key")
 		}
 	}
 
-	if len(state.JoinStateBytes) > 0 {
-		if err := fs.Write(ctx, JoinStatePath, state.JoinStateBytes); err != nil {
+	if len(c.JoinStateBytes) > 0 {
+		if err := c.fs.Write(ctx, JoinStatePath, c.JoinStateBytes); err != nil {
 			return trace.Wrap(err, "writing previous join state")
 		}
 	}
 
+	if len(c.KeyHistory) > 0 {
+		bytes, err := json.Marshal(KeyHistory{
+			Entries: c.KeyHistory,
+		})
+		if err != nil {
+			return trace.Wrap(err, "marshaling key key history")
+		}
+
+		if err := c.fs.Write(ctx, KeyHistoryPath, bytes); err != nil {
+			return trace.Wrap(err, "writing key history")
+		}
+	}
+
+	slog.DebugContext(ctx, "stored new bound keypair client state")
+
 	return nil
 }
 
 // NewUnboundClientState creates a new client state that has not yet been bound,
 // i.e. a new keypair that has not been registered with Auth, and no prior join
-// state.
-func NewUnboundClientState(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (*ClientState, error) {
+// state. Join attempts using registration secrets should instead use
+// `NewEmptyClientState`, which does not immediately generate a keypair.
+func NewUnboundClientState(ctx context.Context, fs FS, getSuite cryptosuites.GetSuiteFunc) (*FSClientState, error) {
 	key, err := cryptosuites.GenerateKey(ctx, getSuite, cryptosuites.BoundKeypairJoining)
 	if err != nil {
 		return nil, trace.Wrap(err, "generating keypair")
@@ -205,7 +477,7 @@ func NewUnboundClientState(ctx context.Context, getSuite cryptosuites.GetSuiteFu
 
 	privateKeyBytes, err := keys.MarshalPrivateKey(key)
 	if err != nil {
-		return nil, trace.Wrap(err, "marshallng private key")
+		return nil, trace.Wrap(err, "marshaling private key")
 	}
 
 	sshPubKey, err := ssh.NewPublicKey(key.Public())
@@ -220,9 +492,102 @@ func NewUnboundClientState(ctx context.Context, getSuite cryptosuites.GetSuiteFu
 		return nil, trace.Wrap(err)
 	}
 
-	return &ClientState{
+	history := []KeyHistoryEntry{
+		{
+			Time:       time.Now(),
+			PrivateKey: string(privateKeyBytes),
+		},
+	}
+
+	return &FSClientState{
+		fs: fs,
+
 		PrivateKeyBytes: privateKeyBytes,
 		PublicKeyBytes:  publicKeyBytes,
 		PrivateKey:      pk,
+		KeyHistory:      history,
 	}, nil
 }
+
+// NewEmptyFSClientState creates a new ClientState with no existing active
+// private key or key history. This is only appropriate when a registration
+// secret should be used.
+func NewEmptyFSClientState(fs FS) *FSClientState {
+	return &FSClientState{
+		fs: fs,
+	}
+}
+
+// StaticClientState is a client state backed by an immutable private key. It
+// does not interact with the filesystem and  does not support rotation.
+type StaticClientState struct {
+	privateKeyBytes []byte
+}
+
+func (s *StaticClientState) checkedSigner(expectPubKey []byte) (crypto.Signer, error) {
+	desiredPubKey, err := sshutils.CryptoPublicKey(expectPubKey)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing expected public key")
+	}
+
+	privateKey, err := keys.ParsePrivateKey(s.privateKeyBytes)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing configured static private key")
+	}
+
+	pubKey := privateKey.Public()
+
+	equal, err := pubKeyEqual(desiredPubKey, pubKey)
+	if err != nil {
+		return nil, trace.Wrap(err, "comparing public keys")
+	} else if !equal {
+		return nil, trace.BadParameter("configured static private key does match the value requested by the server, cannot continue")
+	}
+
+	// Return the internal signer since `jose.NewSigner` does type checking
+	return privateKey.Signer, nil
+}
+
+// ToJoinParams returns join parameters for this static client state. It does
+// not support registration secrets or key rotation, and will produce a warning
+// or error if unsupported operations are attempted.
+func (s *StaticClientState) ToJoinParams(params ClientParams) *join.BoundKeypairParams {
+	if params.RegistrationSecret != "" {
+		slog.WarnContext(context.Background(), "A registration secret was specified while using a static private key and will be ignored")
+	}
+
+	return &join.BoundKeypairParams{
+		// Note: no registration secret or previous join state.
+
+		GetSigner: func(pubKey string) (crypto.Signer, error) {
+			return s.checkedSigner([]byte(pubKey))
+		},
+		RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+			return nil, trace.BadParameter("static private keys do not support automatic rotation, `rotate_after` must be unset in the token to continue")
+		},
+	}
+}
+
+func (s *StaticClientState) UpdateFromRegisterResult(result *join.RegisterResult) error {
+	// TODO: We could parse the returned join state JWT and examine the recovery
+	// mode claim to log a warning if it is anything but `insecure`.
+
+	// no-op: any new active key would fail during the rotation attempt, and
+	// if join state is required due to a misconfigured join, we should fail
+	// ASAP rather update join state in memory and fail on restart
+	return nil
+}
+
+func (s *StaticClientState) Store(ctx context.Context) error {
+	// no-op. don't bother logging anything since there's nothing that can be
+	// done.
+	return nil
+}
+
+// NewStaticClientState returns a client state implementation backed by a static
+// private key. The private key must be PEM encoded.
+func NewStaticClientState(privateKeyBytes []byte) *StaticClientState {
+	return &StaticClientState{
+		privateKeyBytes: privateKeyBytes,
+	}
+}
diff --git a/lib/auth/join/boundkeypair/boundkeypair_test.go b/lib/auth/join/boundkeypair/boundkeypair_test.go
new file mode 100644
index 0000000000000..b4d2f637c78ac
--- /dev/null
+++ b/lib/auth/join/boundkeypair/boundkeypair_test.go
@@ -0,0 +1,187 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package boundkeypair
+
+import (
+	"context"
+	"crypto"
+	"strings"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
+
+// memoryFS is a trivial in memory fs backend for testing use.
+type memoryFS struct {
+	files  map[string][]byte
+	writes uint
+}
+
+func (f *memoryFS) Read(ctx context.Context, name string) ([]byte, error) {
+	data, ok := f.files[name]
+	if !ok {
+		return nil, trace.NotFound("not found: %s", name)
+	}
+
+	return data, nil
+}
+
+func (f *memoryFS) Write(ctx context.Context, name string, data []byte) error {
+	f.writes++
+	f.files[name] = data
+	return nil
+}
+
+func TestClientState(t *testing.T) {
+	ctx := context.Background()
+	fs := &memoryFS{
+		files: map[string][]byte{},
+	}
+
+	getSuite := cryptosuites.StaticAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1)
+
+	state, err := NewUnboundClientState(ctx, fs, getSuite)
+	require.NoError(t, err)
+
+	// Nothing should be written until `Store` is called explicitly
+	require.Empty(t, fs.files)
+
+	require.NoError(t, state.Store(ctx))
+	require.Len(t, fs.files, 3)
+	require.Len(t, state.KeyHistory, 1)
+	require.EqualValues(t, 3, fs.writes)
+
+	require.Equal(t, fs.files[PrivateKeyPath], state.PrivateKeyBytes)
+
+	// Keep the original key for later.
+	firstKey := state.PublicKeyBytes
+
+	prevKey := firstKey
+	expectWrites := 3
+
+	// Simulate writes up to the key history recording length.
+	for i := 0; i < KeyHistoryLength-1; i++ {
+		// We should still be able to load the original signer (< KeyHistoryLength)
+		_, err := state.SignerForPublicKey(firstKey)
+		require.NoError(t, err)
+
+		// Similarly, the previous key should still be accessible.
+		_, err = state.SignerForPublicKey(prevKey)
+		require.NoError(t, err)
+
+		prevKey = state.PrivateKey.MarshalSSHPublicKey()
+
+		// Generate a new keypair. It should be added to the history, but not marked
+		// as active.
+		signer, err := state.GenerateKeypair(ctx, getSuite)
+		require.NoError(t, err)
+		require.Len(t, state.KeyHistory, 2+i)
+		require.EqualValues(t, expectWrites, fs.writes, "no new writes expected")
+		require.Equal(t, fs.files[PrivateKeyPath], state.PrivateKeyBytes, "active key should not change on generation")
+		require.NotEqual(t, state.KeyHistory[0].PrivateKey, state.KeyHistory[1].PrivateKey)
+
+		// Now explicitly set the new active key
+		require.NoError(t, state.SetActiveKey(signer))
+		require.NotEqual(t, state.PublicKeyBytes, prevKey, "public key bytes must change for new key")
+
+		require.NoError(t, state.Store(ctx))
+		expectWrites += 3
+
+		// Load a fresh state for the next iteration.
+		state, err = LoadClientState(ctx, fs)
+		require.NoError(t, err)
+	}
+
+	// Generate a final keypair. This should push out the initial key. We'll
+	// have reached the history limit, so the total length should not change.
+	require.Len(t, state.KeyHistory, 10)
+	_, err = state.GenerateKeypair(ctx, getSuite)
+	require.NoError(t, err)
+	require.Len(t, state.KeyHistory, 10)
+
+	require.NoError(t, state.Store(ctx))
+	state, err = LoadClientState(ctx, fs)
+	require.NoError(t, err)
+
+	// Try to load the original key again; it should fail.
+	_, err = state.SignerForPublicKey(firstKey)
+	require.Error(t, err)
+}
+
+func TestStaticClientState(t *testing.T) {
+	getSuite := cryptosuites.StaticAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1)
+	key, err := cryptosuites.GenerateKey(t.Context(), getSuite, cryptosuites.BoundKeypairJoining)
+	require.NoError(t, err)
+
+	keyEq, ok := key.Public().(interface {
+		Equal(x crypto.PublicKey) bool
+	})
+	require.True(t, ok)
+
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	require.NoError(t, err)
+
+	publicKeyBytes := ssh.MarshalAuthorizedKey(sshPubKey)
+	publicKeyString := strings.TrimSpace(string(publicKeyBytes))
+
+	wrongKey, err := cryptosuites.GenerateKey(t.Context(), getSuite, cryptosuites.BoundKeypairJoining)
+	require.NoError(t, err)
+
+	wrongSSHPubKey, err := ssh.NewPublicKey(wrongKey.Public())
+	require.NoError(t, err)
+	wrongPublicKeyBytes := ssh.MarshalAuthorizedKey(wrongSSHPubKey)
+	wrongPublicKeyString := strings.TrimSpace(string(wrongPublicKeyBytes))
+
+	privateKeyBytes, err := keys.MarshalPrivateKey(key)
+	require.NoError(t, err)
+
+	static := NewStaticClientState(privateKeyBytes)
+
+	params := static.ToJoinParams(ClientParams{
+		RegistrationSecret: "test",
+	})
+	require.Empty(t, params.RegistrationSecret, "registration secret must not be passed through")
+	require.Empty(t, params.PreviousJoinState, "previous join state must always be empty")
+
+	signer, err := params.GetSigner(publicKeyString)
+	require.NoError(t, err)
+
+	// We should actually retrieve a signer for the public key we requested
+	require.True(t, keyEq.Equal(signer.Public()))
+
+	_, err = params.GetSigner(wrongPublicKeyString)
+	require.ErrorContains(t, err, "configured static private key does match the value requested by the server")
+
+	invalidSigner, err := params.RequestNewKeypair(t.Context(), getSuite)
+	require.Nil(t, invalidSigner)
+	require.ErrorContains(t, err, "static private keys do not support automatic rotation")
+
+	// no-op, but shouldn't return an error
+	require.NoError(t, static.Store(t.Context()))
+
+	// no-op, but shouldn't return an error
+	require.NoError(t, static.UpdateFromRegisterResult(&join.RegisterResult{}))
+}
diff --git a/lib/auth/join/iam/iam.go b/lib/auth/join/iam/iam.go
index 951c0175ca3f9..408b00c2f3a9d 100644
--- a/lib/auth/join/iam/iam.go
+++ b/lib/auth/join/iam/iam.go
@@ -48,18 +48,18 @@ type stsIdentityRequestOptions struct {
 	imdsClient imdsClient
 }
 
-type stsIdentityRequestOption func(cfg *stsIdentityRequestOptions)
+type STSIdentityRequestOption func(cfg *stsIdentityRequestOptions)
 
 // WithFIPSEndpoint is a functional option to use a FIPS STS endpoint. In non-US
 // regions, this will use the us-east-1 FIPS endpoint.
-func WithFIPSEndpoint(useFIPS bool) stsIdentityRequestOption {
+func WithFIPSEndpoint(useFIPS bool) STSIdentityRequestOption {
 	return func(opts *stsIdentityRequestOptions) {
 		opts.useFIPS = useFIPS
 	}
 }
 
 // WithIMDSClient is a functional option to use a custom IMDS client.
-func WithIMDSClient(clt imdsClient) stsIdentityRequestOption {
+func WithIMDSClient(clt imdsClient) STSIdentityRequestOption {
 	return func(opts *stsIdentityRequestOptions) {
 		opts.imdsClient = clt
 	}
@@ -75,7 +75,7 @@ type imdsClient interface {
 
 // CreateSignedSTSIdentityRequest is called on the client side and returns an
 // sts:GetCallerIdentity request signed with the local AWS credentials
-func CreateSignedSTSIdentityRequest(ctx context.Context, challenge string, opts ...stsIdentityRequestOption) ([]byte, error) {
+func CreateSignedSTSIdentityRequest(ctx context.Context, challenge string, opts ...STSIdentityRequestOption) ([]byte, error) {
 	var options stsIdentityRequestOptions
 	for _, opt := range opts {
 		opt(&options)
diff --git a/lib/auth/join/iam/iam_test.go b/lib/auth/join/iam/iam_test.go
index 134050913830b..9a993d9087cf6 100644
--- a/lib/auth/join/iam/iam_test.go
+++ b/lib/auth/join/iam/iam_test.go
@@ -41,6 +41,8 @@ func TestCreateSignedSTSIdentityRequest(t *testing.T) {
 	// If the user has an AWS config file that sets a region, it conflicts with
 	// the test cases. Disable loading a config file by setting a nonexistent path.
 	t.Setenv("AWS_CONFIG_FILE", "fake-file-this-must-not-exist")
+	// Ensure we don't try to use the user's profile.
+	t.Setenv("AWS_PROFILE", "")
 
 	const challenge = "asdf12345"
 
diff --git a/lib/auth/join/join.go b/lib/auth/join/join.go
index d63c1ae3c9a44..2ee999a97bfb5 100644
--- a/lib/auth/join/join.go
+++ b/lib/auth/join/join.go
@@ -37,6 +37,7 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/webclient"
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
 	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/aws"
@@ -45,23 +46,24 @@ import (
 	"github.com/gravitational/teleport/lib/auth/join/iam"
 	"github.com/gravitational/teleport/lib/auth/join/oracle"
 	"github.com/gravitational/teleport/lib/auth/state"
-	"github.com/gravitational/teleport/lib/azuredevops"
-	"github.com/gravitational/teleport/lib/bitbucket"
-	"github.com/gravitational/teleport/lib/circleci"
 	proxyinsecureclient "github.com/gravitational/teleport/lib/client/proxy/insecure"
 	"github.com/gravitational/teleport/lib/cloud/imds/azure"
 	"github.com/gravitational/teleport/lib/cloud/imds/gcp"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/githubactions"
-	"github.com/gravitational/teleport/lib/gitlab"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
 	"github.com/gravitational/teleport/lib/jwt"
 	kubetoken "github.com/gravitational/teleport/lib/kube/token"
-	"github.com/gravitational/teleport/lib/spacelift"
-	"github.com/gravitational/teleport/lib/terraformcloud"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/tpm"
 	"github.com/gravitational/teleport/lib/utils"
+	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 )
 
 var tracer = otel.Tracer("github.com/gravitational/teleport/lib/auth/join")
@@ -76,6 +78,19 @@ type AzureParams struct {
 	// ClientID is the client ID of the managed identity for Teleport to assume
 	// when authenticating a node.
 	ClientID string
+	// IMDSClient overrides the client used to fetch data from Azure IMDS.
+	IMDSClient AzureIMDSClient
+	// IssuerHTTPClient, if set, overrides the default HTTP client used to
+	// fetch the intermediate CA which issued the attested data document
+	// signing certificate. Only used when joining via the new join service.
+	IssuerHTTPClient utils.HTTPDoClient
+}
+
+// AzureIMDSClient is a client to Azure's IMDS.
+type AzureIMDSClient interface {
+	IsAvailable(context.Context) bool
+	GetAttestedData(ctx context.Context, nonce string) ([]byte, error)
+	GetAccessToken(ctx context.Context, clientID string) (string, error)
 }
 
 // GitlabParams is the parameters specific to the gitlab join method.
@@ -85,20 +100,34 @@ type GitlabParams struct {
 	EnvVarName string
 }
 
+// GetSignerFunc is a function that fetches a keypair from bound keypair client
+// state.
+type GetSignerFunc func(pubKey string) (crypto.Signer, error)
+
+// KeygenFunc is a function to generate a new keypair for bound keypair joining.
+// Clients will generally need to store this for future use, so this function
+// should include some mechanism for storage and retrieval.
+type KeygenFunc func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error)
+
 // BoundKeypairParams are parameters specific to bound-keypair joining.
 type BoundKeypairParams struct {
-	// InitialJoinSecret is a one-time-use joining token for use on first join.
+	// RegistrationSecret is a one-time-use joining token for use on first join.
 	// May be unset if a keypair was registered with Auth out of band.
-	InitialJoinSecret string
-
-	// CurrentKey is the keypair currently registered with Auth. On initial
-	// join using `InitialJoinSecret`, this should be nil in favor of `NewKey`.
-	CurrentKey crypto.Signer
+	RegistrationSecret string
 
 	// PreviousJoinState is the previous join state document provided by Auth
 	// alongside the previous set of certs. If this is initial registration, it
 	// can be empty.
 	PreviousJoinState []byte
+
+	// GetSigner is a function that fetches a signer from the client keystore.
+	GetSigner GetSignerFunc
+
+	// RequestNewKeypair is a callback function used to request a new keypair.
+	// This may be called at initial onboarding when `InitialJoinSecret` is set,
+	// or on any join (including the initial join) if `RotateAfter` is set on
+	// the backing token and its value has elapsed.
+	RequestNewKeypair KeygenFunc
 }
 
 // RegisterParams specifies parameters
@@ -145,7 +174,7 @@ type RegisterParams struct {
 	// CircuitBreakerConfig defines how the circuit breaker should behave.
 	// Ignored if AuthClient is provided.
 	CircuitBreakerConfig breaker.Config
-	// FIPS means FedRAMP/FIPS 140-2 compliant configuration was requested.
+	// FIPS means FedRAMP/FIPS compliant configuration was requested.
 	// Ignored if AuthClient is provided.
 	FIPS bool
 	// IDToken is a token retrieved from a workload identity provider for
@@ -174,9 +203,20 @@ type RegisterParams struct {
 	GitlabParams GitlabParams
 	// BoundKeypairParams contains parameters specific to bound keypair joining.
 	BoundKeypairParams *BoundKeypairParams
+	// CreateSignedSTSIdentityRequestFunc overrides the function used to
+	// generate a signed AWs sts:GetCallerIdentity request.
+	CreateSignedSTSIdentityRequestFunc func(ctx context.Context, challenge string, opts ...iam.STSIdentityRequestOption) ([]byte, error)
+	// GetInstanceIdentityDocumentFunc overrides the function used to get an
+	// EC2 Instance Identity Document for the host.
+	GetInstanceIdentityDocumentFunc func(ctx context.Context) ([]byte, error)
+	// OracleIMDSClient overrides the HTTP client used to make requests to the
+	// OCI Instance Metadata Service.
+	OracleIMDSClient utils.HTTPDoClient
+	// AttestTPM overrides the function used to attest the host TPM for the TPM join method.
+	AttestTPM func(context.Context, *slog.Logger) (*tpm.Attestation, func() error, error)
 }
 
-func (r *RegisterParams) checkAndSetDefaults() error {
+func (r *RegisterParams) CheckAndSetDefaults() error {
 	if r.Clock == nil {
 		r.Clock = clockwork.NewRealClock()
 	}
@@ -189,6 +229,26 @@ func (r *RegisterParams) checkAndSetDefaults() error {
 		return trace.BadParameter("no auth or proxy servers set")
 	}
 
+	if r.CreateSignedSTSIdentityRequestFunc == nil {
+		r.CreateSignedSTSIdentityRequestFunc = iam.CreateSignedSTSIdentityRequest
+	}
+
+	if r.GetInstanceIdentityDocumentFunc == nil {
+		r.GetInstanceIdentityDocumentFunc = awsutils.GetRawEC2IdentityDocument
+	}
+
+	if r.OracleIMDSClient == nil {
+		var err error
+		r.OracleIMDSClient, err = defaults.HTTPClient()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if r.AttestTPM == nil {
+		r.AttestTPM = tpm.Attest
+	}
+
 	return nil
 }
 
@@ -245,11 +305,15 @@ type RegisterResult struct {
 // running on a different host than the auth server. This method requires a
 // provision token that will be used to authenticate as an identity that should
 // be allowed to join the cluster.
+//
+// Deprecated: this function is superceded by lib/join/joinclient.Join
+//
+// TODO(nklaassen): DELETE IN 20
 func Register(ctx context.Context, params RegisterParams) (result *RegisterResult, err error) {
 	ctx, span := tracer.Start(ctx, "Register")
 	defer func() { tracing.EndSpan(span, err) }()
 
-	if err := params.checkAndSetDefaults(); err != nil {
+	if err := params.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	// Read in the token. The token can either be passed in or come from a file
@@ -269,56 +333,75 @@ func Register(ctx context.Context, params RegisterParams) (result *RegisterResul
 					`(e.g. /var/lib/teleport/host_uuid)`,
 				params.ID.HostUUID)
 		}
-		params.ec2IdentityDocument, err = utils.GetRawEC2IdentityDocument(ctx)
+		params.ec2IdentityDocument, err = params.GetInstanceIdentityDocumentFunc(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	case types.JoinMethodGitHub:
-		params.IDToken, err = githubactions.NewIDTokenSource().GetIDToken(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		// Tests might specify an IDToken so don't overwrite it when present.
+		if params.IDToken == "" {
+			params.IDToken, err = githubactions.NewIDTokenSource().GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodGitLab:
-		params.IDToken, err = gitlab.NewIDTokenSource(gitlab.IDTokenSourceConfig{
-			EnvVarName: params.GitlabParams.EnvVarName,
-		}).GetIDToken()
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = gitlab.NewIDTokenSource(gitlab.IDTokenSourceConfig{
+				EnvVarName: params.GitlabParams.EnvVarName,
+			}).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodCircleCI:
-		params.IDToken, err = circleci.GetIDToken(os.Getenv)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = circleci.GetIDToken(os.Getenv)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodKubernetes:
-		params.IDToken, err = kubetoken.GetIDToken(os.Getenv, params.KubernetesReadFileFunc)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = kubetoken.GetIDToken(os.Getenv, params.KubernetesReadFileFunc)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodGCP:
-		params.IDToken, err = gcp.GetIDToken(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = gcp.GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodSpacelift:
-		params.IDToken, err = spacelift.NewIDTokenSource(os.Getenv).GetIDToken()
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = spacelift.NewIDTokenSource(os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodTerraformCloud:
-		params.IDToken, err = terraformcloud.NewIDTokenSource(params.TerraformCloudAudienceTag, os.Getenv).GetIDToken()
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = terraformcloud.NewIDTokenSource(params.TerraformCloudAudienceTag, os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodBitbucket:
-		params.IDToken, err = bitbucket.NewIDTokenSource(os.Getenv).GetIDToken()
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = bitbucket.NewIDTokenSource(os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodAzureDevops:
-		params.IDToken, err = azuredevops.NewIDTokenSource(os.Getenv).GetIDToken(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if params.IDToken == "" {
+			params.IDToken, err = azuredevops.NewIDTokenSource(os.Getenv).GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 	case types.JoinMethodBoundKeypair:
 		if params.BoundKeypairParams == nil {
@@ -363,7 +446,7 @@ func Register(ctx context.Context, params RegisterParams) (result *RegisterResul
 		if params.GetHostCredentials == nil {
 			slog.DebugContext(ctx, "Missing client, it is not possible to register through proxy.")
 			registerMethods = []registerMethod{registerThroughAuth}
-		} else if authServerIsProxy(params.AuthServers) {
+		} else if LooksLikeProxy(params.AuthServers) {
 			slog.DebugContext(ctx, "The first specified auth server appears to be a proxy.")
 			registerMethods = []registerMethod{registerThroughProxy, registerThroughAuth}
 		}
@@ -384,9 +467,9 @@ func Register(ctx context.Context, params RegisterParams) (result *RegisterResul
 	return nil, trace.NewAggregate(collectedErrs...)
 }
 
-// authServerIsProxy returns true if the first specified auth server
+// LooksLikeProxy returns true if the first specified auth server
 // to register with appears to be a proxy.
-func authServerIsProxy(servers []utils.NetAddr) bool {
+func LooksLikeProxy(servers []utils.NetAddr) bool {
 	if len(servers) == 0 {
 		return false
 	}
@@ -491,25 +574,7 @@ func registerThroughAuth(
 	ctx, span := tracer.Start(ctx, "registerThroughAuth")
 	defer func() { tracing.EndSpan(span, err) }()
 
-	var client *authclient.Client
-	// Build a client for the Auth Server with different certificate validation
-	// depending on the configured values for Insecure, CAPins and CAPath.
-	switch {
-	case params.Insecure:
-		slog.WarnContext(ctx, "Insecure mode enabled. Auth Server cert will not be validated and CAPins and CAPath value will be ignored.")
-		client, err = insecureRegisterClient(ctx, params)
-	case len(params.CAPins) != 0:
-		// CAPins takes precedence over CAPath
-		client, err = pinRegisterClient(ctx, params)
-	case params.CAPath != "":
-		client, err = caPathRegisterClient(ctx, params)
-	default:
-		// We fall back to insecure mode here - this is a little odd but is
-		// necessary to preserve the behavior of registration. At a later date,
-		// we may consider making this an error asking the user to provide
-		// Insecure, CAPins or CAPath.
-		client, err = insecureRegisterClient(ctx, params)
-	}
+	client, err := NewAuthClient(ctx, params)
 	if err != nil {
 		return nil, trace.Wrap(err, "building auth client")
 	}
@@ -525,6 +590,7 @@ type AuthJoinClient interface {
 	joinServiceClient
 	RegisterUsingToken(ctx context.Context, req *types.RegisterUsingTokenRequest) (*proto.Certs, error)
 	Ping(ctx context.Context) (proto.PingResponse, error)
+	JoinV1Client() joinv1.JoinServiceClient
 }
 
 func registerThroughAuthClient(
@@ -578,6 +644,28 @@ func getHostAddresses(params RegisterParams) []string {
 	return utils.NetAddrsToStrings(params.AuthServers)
 }
 
+// NewAuthClient returns a new auth client built according to the register
+// params, preferring the authenticate the server via CA pins or a CA path and
+// falling back to an insecure connection, unless insecure mode was explicitly enabled.
+func NewAuthClient(ctx context.Context, params RegisterParams) (*authclient.Client, error) {
+	switch {
+	case params.Insecure:
+		slog.WarnContext(ctx, "Insecure mode enabled. Auth Server cert will not be validated and CAPins and CAPath value will be ignored.")
+		return insecureRegisterClient(ctx, params)
+	case len(params.CAPins) != 0:
+		// CAPins takes precedence over CAPath
+		return pinRegisterClient(ctx, params)
+	case params.CAPath != "":
+		return caPathRegisterClient(ctx, params)
+	default:
+		// We fall back to insecure mode here - this is a little odd but is
+		// necessary to preserve the behavior of registration. At a later date,
+		// we may consider making this an error asking the user to provide
+		// Insecure, CAPins or CAPath.
+		return insecureRegisterClient(ctx, params)
+	}
+}
+
 // insecureRegisterClient attempts to connects to the Auth Server using the
 // CA on disk. If no CA is found on disk, Teleport will not verify the Auth
 // Server it is connecting to.
@@ -772,7 +860,7 @@ func registerUsingIAMMethod(
 	// Call RegisterUsingIAMMethod and pass a callback to respond to the challenge with a signed join request.
 	certs, err := joinServiceClient.RegisterUsingIAMMethod(ctx, func(challenge string) (*proto.RegisterUsingIAMMethodRequest, error) {
 		// create the signed sts:GetCallerIdentity request and include the challenge
-		signedRequest, err := iam.CreateSignedSTSIdentityRequest(ctx, challenge,
+		signedRequest, err := params.CreateSignedSTSIdentityRequestFunc(ctx, challenge,
 			iam.WithFIPSEndpoint(params.FIPS),
 		)
 		if err != nil {
@@ -800,7 +888,10 @@ func registerUsingAzureMethod(
 	ctx context.Context, client joinServiceClient, token string, hostKeys *newHostKeys, params RegisterParams,
 ) (*proto.Certs, error) {
 	certs, err := client.RegisterUsingAzureMethod(ctx, func(challenge string) (*proto.RegisterUsingAzureMethodRequest, error) {
-		imds := azure.NewInstanceMetadataClient()
+		imds := params.AzureParams.IMDSClient
+		if imds == nil {
+			imds = azure.NewInstanceMetadataClient()
+		}
 		if !imds.IsAvailable(ctx) {
 			return nil, trace.AccessDenied("could not reach instance metadata. Is Teleport running on an Azure VM?")
 		}
@@ -837,7 +928,7 @@ func registerUsingTPMMethod(
 		JoinRequest: registerUsingTokenRequestForParams(token, hostKeys, params),
 	}
 
-	attestation, close, err := tpm.Attest(ctx, log)
+	attestation, close, err := params.AttestTPM(ctx, log)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -947,47 +1038,23 @@ func registerUsingBoundKeypairMethod(
 ) (*RegisterResult, error) {
 	bkParams := params.BoundKeypairParams
 
-	// Build a map of all public keys to signers. At the moment, this is just
-	// the current key, but may include e.g. previous and next keys for use in
-	// case of a failed rotation attempt.
-	// TODO: This implementation is likely to change when rotation is
-	// implemented.
-	signers := map[string]crypto.Signer{}
-
-	if bkParams.CurrentKey != nil {
-		pub, err := sshPubKeyFromSigner(bkParams.CurrentKey)
-		if err != nil {
-			return nil, trace.Wrap(err, "generating ssh public key from current key signer")
-		}
-
-		signers[pub] = bkParams.CurrentKey
-	}
-
 	initReq := &proto.RegisterUsingBoundKeypairInitialRequest{
 		JoinRequest:       registerUsingTokenRequestForParams(token, hostKeys, params),
-		InitialJoinSecret: bkParams.InitialJoinSecret,
+		InitialJoinSecret: bkParams.RegistrationSecret,
 		PreviousJoinState: bkParams.PreviousJoinState,
 	}
 
-	// TODO: When implementing rotation, we should make use of the returned
-	// public key to ensure that key is marked as the primary.
 	regResponse, err := client.RegisterUsingBoundKeypairMethod(
 		ctx,
 		initReq,
 		func(resp *proto.RegisterUsingBoundKeypairMethodResponse) (*proto.RegisterUsingBoundKeypairMethodRequest, error) {
 			switch kind := resp.GetResponse().(type) {
 			case *proto.RegisterUsingBoundKeypairMethodResponse_Challenge:
-				// Unlike other join methods, this function may be called multiple
-				// times to complete challenges using one or both signers, so we'll
-				// use the passed publicKey hint to resolve the proper signer to
-				// use.
-				signer, ok := signers[kind.Challenge.PublicKey]
-				if !ok {
-					return nil, trace.NotFound("could not complete challenge for unknown public key: %+#v", kind.Challenge.PublicKey)
+				signer, err := bkParams.GetSigner(kind.Challenge.PublicKey)
+				if err != nil {
+					return nil, trace.Wrap(err, "could not lookup signer for public key %+v", kind.Challenge.PublicKey)
 				}
 
-				// TODO: might not be worth exporting this func; may be cheaper to
-				// just copy the function here instead.
 				alg, err := jwt.AlgorithmForPublicKey(signer.Public())
 				if err != nil {
 					return nil, trace.Wrap(err, "determining signing algorithm for public key")
@@ -1001,7 +1068,7 @@ func registerUsingBoundKeypairMethod(
 
 				joseSigner, err := jose.NewSigner(key, opts)
 				if err != nil {
-					return nil, trace.Wrap(err, "creating signer")
+					return nil, trace.Wrap(err, "creating signer (%T)", signer)
 				}
 
 				jws, err := joseSigner.Sign([]byte(kind.Challenge.Challenge))
@@ -1022,8 +1089,29 @@ func registerUsingBoundKeypairMethod(
 					},
 				}, nil
 			case *proto.RegisterUsingBoundKeypairMethodResponse_Rotation:
-				// TODO: Follow up implementation
-				return nil, trace.NotImplemented("keypair rotation not yet implemented")
+				if bkParams.RequestNewKeypair == nil {
+					return nil, trace.BadParameter("RequestNewKeypair is required")
+				}
+
+				slog.InfoContext(ctx, "Server has requested keypair rotation", "suite", kind.Rotation.SignatureAlgorithmSuite)
+
+				newSigner, err := bkParams.RequestNewKeypair(ctx, cryptosuites.StaticAlgorithmSuite(kind.Rotation.SignatureAlgorithmSuite))
+				if err != nil {
+					return nil, trace.Wrap(err, "requesting new keypair")
+				}
+
+				newPubkey, err := sshPubKeyFromSigner(newSigner)
+				if err != nil {
+					return nil, trace.Wrap(err)
+				}
+
+				return &proto.RegisterUsingBoundKeypairMethodRequest{
+					Payload: &proto.RegisterUsingBoundKeypairMethodRequest_RotationResponse{
+						RotationResponse: &proto.RegisterUsingBoundKeypairRotationResponse{
+							PublicKey: newPubkey,
+						},
+					},
+				}, nil
 			default:
 				// Note: certs variant is handled by RegisterUsingBoundKeypairMethod()
 				return nil, trace.BadParameter("received unexpected challenge response: %v", resp.GetResponse())
@@ -1033,6 +1121,7 @@ func registerUsingBoundKeypairMethod(
 		return nil, trace.Wrap(err)
 	}
 
+	// Implementation note, callers are expected to call
 	return &RegisterResult{
 		PrivateKey: hostKeys.privateKey,
 		Certs:      regResponse.Certs,
diff --git a/lib/auth/join/join_test.go b/lib/auth/join/join_test.go
index a4bb804b392eb..0c7af4a85699b 100644
--- a/lib/auth/join/join_test.go
+++ b/lib/auth/join/join_test.go
@@ -42,7 +42,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -57,12 +57,13 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }
 
-func newTestTLSServer(t testing.TB) *auth.TestTLSServer {
-	as, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+func newTestTLSServer(t testing.TB) *authtest.TLSServer {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 	srv, err := as.NewTestTLSServer()
 	require.NoError(t, err)
diff --git a/lib/auth/join/oracle/oracle.go b/lib/auth/join/oracle/oracle.go
index 651d6915b8d15..11ad2746a6169 100644
--- a/lib/auth/join/oracle/oracle.go
+++ b/lib/auth/join/oracle/oracle.go
@@ -14,6 +14,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// Package oracle includes functions and types used by the legacy oracle join
+// method, which will be removed in v20.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
 package oracle
 
 import (
@@ -31,11 +35,23 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
+// Claims are the claims extracted from the instance certificate.
+type Claims = oraclejoin.Claims
+
+var (
+	// ParseRegion parses a string into a full (not abbreviated) Oracle Cloud
+	// region. It returns the empty string if the input is not a valid region.
+	ParseRegion = oraclejoin.ParseRegion
+	// ParseRegionFromOCID parses an Oracle OCID and returns the embedded region.
+	// It returns an error if the input is not a valid OCID.
+	ParseRegionFromOCID = oraclejoin.ParseRegionFromOCID
+)
+
 const teleportUserAgent = "teleport/" + api.Version
 
 const (
@@ -63,37 +79,6 @@ type authenticateClientRequest struct {
 	Details   authenticateClientDetails `contributesTo:"body"`
 }
 
-// Claims are the claims returned by the authenticateClient endpoint.
-type Claims struct {
-	// TenancyID is the ID of the instance's tenant.
-	TenancyID string `json:"tenant_id"`
-	// CompartmentID is the ID of the instance's compartment.
-	CompartmentID string `json:"compartment_id"`
-	// InstanceID is the instance's ID.
-	InstanceID string `json:"-"`
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c Claims) JoinAttrs() *workloadidentityv1pb.JoinAttrsOracle {
-	attrs := &workloadidentityv1pb.JoinAttrsOracle{
-		TenancyId:     c.TenancyID,
-		CompartmentId: c.CompartmentID,
-		InstanceId:    c.InstanceID,
-	}
-	return attrs
-}
-
-// Region extracts the region from an instance's claims.
-func (c Claims) Region() string {
-	region, err := ParseRegionFromOCID(c.InstanceID)
-	if err != nil {
-		return ""
-	}
-	return region
-}
-
 type claim struct {
 	Key   string `json:"key"`
 	Value string `json:"value"`
@@ -307,72 +292,14 @@ func FetchOraclePrincipalClaims(ctx context.Context, req *http.Request) (Claims,
 		if msg == "" {
 			msg = authResp.Status
 		}
-		return Claims{}, trace.AccessDenied("%v", msg)
+		if authResp.StatusCode == http.StatusNotFound {
+			msg += "\nThis may mean that the joining instance has insufficient permissions for authentication. " +
+				"For help with configuring permissions, see https://goteleport.com/docs/enroll-resources/agents/oracle/#step-25-configure-permissions."
+		}
+		return Claims{}, trace.AccessDenied("oci api error: %s", msg)
 	}
 	if unmarshalErr != nil {
 		return Claims{}, trace.Wrap(unmarshalErr)
 	}
 	return resp.Result.Principal.getClaims(), nil
 }
-
-// Hack: StringToRegion will lazily load regions from a config file if its
-// input isn't in its hard-coded list, in a non-threadsafe way. Call it here
-// to load the config ahead of time so future calls are threadsafe.
-var _ = common.StringToRegion("")
-
-// ParseRegion parses a string into a full (not abbreviated) Oracle Cloud
-// region. It returns the empty string if the input is not a valid region.
-func ParseRegion(rawRegion string) (region, realm string) {
-	canonicalRegion := common.StringToRegion(rawRegion)
-	realm, err := canonicalRegion.RealmID()
-	if err != nil {
-		return "", ""
-	}
-	return string(canonicalRegion), realm
-}
-
-var ociRealms = map[string]struct{}{
-	"oc1": {}, "oc2": {}, "oc3": {}, "oc4": {}, "oc8": {}, "oc9": {},
-	"oc10": {}, "oc14": {}, "oc15": {}, "oc19": {}, "oc20": {}, "oc21": {},
-	"oc23": {}, "oc24": {}, "oc26": {}, "oc29": {}, "oc35": {},
-}
-
-// ParseRegionFromOCID parses an Oracle OCID and returns the embedded region.
-// It returns an error if the input is not a valid OCID.
-func ParseRegionFromOCID(ocid string) (string, error) {
-	// OCID format: ocid1.<RESOURCE TYPE>.<REALM>.[REGION][.FUTURE USE].<UNIQUE ID>
-	// Check format.
-	ocidParts := strings.Split(ocid, ".")
-	switch len(ocidParts) {
-	case 5, 6:
-	default:
-		return "", trace.BadParameter("not an ocid")
-	}
-	// Check version.
-	if ocidParts[0] != "ocid1" {
-		return "", trace.BadParameter("invalid ocid version: %v", ocidParts[0])
-	}
-	// Check realm.
-	if _, ok := ociRealms[ocidParts[2]]; !ok {
-		return "", trace.BadParameter("invalid realm: %v", ocidParts[2])
-	}
-	resourceType := ocidParts[1]
-	region, realm := ParseRegion(ocidParts[3])
-	// Check type. Only instance OCIDs should have a region.
-	switch resourceType {
-	case "instance":
-		if region == "" {
-			return "", trace.BadParameter("invalid region: %v", region)
-		}
-		if realm != ocidParts[2] {
-			return "", trace.BadParameter("invalid realm %q for region %q", ocidParts[2], region)
-		}
-	case "compartment", "tenancy":
-		if ocidParts[3] != "" {
-			return "", trace.BadParameter("resource type %v should not have a region", resourceType)
-		}
-	default:
-		return "", trace.BadParameter("unsupported resource type: %v", resourceType)
-	}
-	return region, nil
-}
diff --git a/lib/auth/join_azure.go b/lib/auth/join_azure.go
deleted file mode 100644
index d259ec15de91a..0000000000000
--- a/lib/auth/join_azure.go
+++ /dev/null
@@ -1,531 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"cmp"
-	"context"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/pem"
-	"log/slog"
-	"net/url"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	armpolicy "github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/policy"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
-	"github.com/digitorus/pkcs7"
-	"github.com/go-jose/go-jose/v3/jwt"
-	"github.com/gravitational/trace"
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud/azure"
-	liboidc "github.com/gravitational/teleport/lib/oidc"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-const (
-	azureAccessTokenAudience = "https://management.azure.com/"
-
-	// azureUserAgent specifies the Azure User-Agent identification for telemetry.
-	azureUserAgent = "teleport"
-	// azureVirtualMachine specifies the Azure virtual machine resource type.
-	azureVirtualMachine = "virtualMachines"
-)
-
-// Structs for unmarshaling attested data. Schema can be found at
-// https://learn.microsoft.com/en-us/azure/virtual-machines/linux/instance-metadata-service?tabs=linux#response-2
-
-type signedAttestedData struct {
-	Encoding  string `json:"encoding"`
-	Signature string `json:"signature"`
-}
-
-type plan struct {
-	Name      string `json:"name"`
-	Product   string `json:"product"`
-	Publisher string `json:"publisher"`
-}
-
-type timestamp struct {
-	CreatedOn string `json:"createdOn"`
-	ExpiresOn string `json:"expiresOn"`
-}
-
-type attestedData struct {
-	LicenseType    string    `json:"licenseType"`
-	Nonce          string    `json:"nonce"`
-	Plan           plan      `json:"plan"`
-	Timestamp      timestamp `json:"timestamp"`
-	ID             string    `json:"vmId"`
-	SubscriptionID string    `json:"subscriptionId"`
-	SKU            string    `json:"sku"`
-}
-
-type accessTokenClaims struct {
-	oidc.TokenClaims
-	TenantID string `json:"tid"`
-	Version  string `json:"ver"`
-
-	// Azure JWT tokens include two optional claims that can be used to validate
-	// the subscription and resource group of a joining node. These claims hold
-	// different values depending on the assigned Managed Identity of the Azure VM:
-	// - xms_mirid:
-	//   - For System-Assigned Identity it represents the resource id of the VM.
-	//   - For User-Assigned Identity it represents the resource id of the user-assigned identity.
-	// - xms_az_rid:
-	//   - For System-Assigned Identity this claim is omitted.
-	//   - For User-Assigned Identity it represents the resource id of the VM.
-	//
-	// More details at: https://learn.microsoft.com/en-us/answers/questions/1282788/existence-of-xms-az-rid-field-in-activity-logs-of
-
-	ManangedIdentityResourceID string `json:"xms_mirid"`
-	AzureResourceID            string `json:"xms_az_rid"`
-}
-
-func (c *accessTokenClaims) AsJWTClaims() jwt.Claims {
-	return jwt.Claims{
-		Issuer:    c.Issuer,
-		Subject:   c.Subject,
-		Audience:  jwt.Audience(c.Audience),
-		Expiry:    jwt.NewNumericDate(c.Expiration.AsTime()),
-		NotBefore: jwt.NewNumericDate(c.NotBefore.AsTime()),
-		IssuedAt:  jwt.NewNumericDate(c.IssuedAt.AsTime()),
-		ID:        c.JWTID,
-	}
-}
-
-type azureVerifyTokenFunc func(ctx context.Context, rawIDToken string) (*accessTokenClaims, error)
-
-type vmClientGetter func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error)
-
-type azureRegisterConfig struct {
-	certificateAuthorities []*x509.Certificate
-	verify                 azureVerifyTokenFunc
-	getVMClient            vmClientGetter
-}
-
-func azureVerifyFuncFromOIDCVerifier(clientID string) azureVerifyTokenFunc {
-	return func(ctx context.Context, rawIDToken string) (*accessTokenClaims, error) {
-		token, err := jwt.ParseSigned(rawIDToken)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		// Need to get the tenant ID before we verify so we can construct the issuer URL.
-		var unverifiedClaims accessTokenClaims
-		if err := token.UnsafeClaimsWithoutVerification(&unverifiedClaims); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		issuer, err := url.JoinPath("https://sts.windows.net", unverifiedClaims.TenantID, "/")
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return liboidc.ValidateToken[*accessTokenClaims](ctx, issuer, clientID, rawIDToken)
-	}
-}
-
-func (cfg *azureRegisterConfig) CheckAndSetDefaults(ctx context.Context) error {
-	if cfg.verify == nil {
-		cfg.verify = azureVerifyFuncFromOIDCVerifier(azureAccessTokenAudience)
-	}
-
-	if cfg.certificateAuthorities == nil {
-		certs, err := getAzureRootCerts()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		cfg.certificateAuthorities = certs
-	}
-	if cfg.getVMClient == nil {
-		cfg.getVMClient = func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error) {
-			// The User-Agent is added for debugging purposes. It helps identify
-			// and isolate teleport traffic.
-			opts := &armpolicy.ClientOptions{
-				ClientOptions: policy.ClientOptions{
-					Telemetry: policy.TelemetryOptions{
-						ApplicationID: azureUserAgent,
-					},
-				},
-			}
-			client, err := azure.NewVirtualMachinesClient(subscriptionID, token, opts)
-			return client, trace.Wrap(err)
-		}
-	}
-	return nil
-}
-
-type azureRegisterOption func(cfg *azureRegisterConfig)
-
-// parseAndVeryAttestedData verifies that an attested data document was signed
-// by Azure. If verification is successful, it returns the ID of the VM that
-// produced the document.
-func parseAndVerifyAttestedData(ctx context.Context, adBytes []byte, challenge string, certs []*x509.Certificate) (subscriptionID, vmID string, err error) {
-	var signedAD signedAttestedData
-	if err := utils.FastUnmarshal(adBytes, &signedAD); err != nil {
-		return "", "", trace.Wrap(err)
-	}
-	if signedAD.Encoding != "pkcs7" {
-		return "", "", trace.AccessDenied("unsupported signature type: %v", signedAD.Encoding)
-	}
-
-	sigPEM := "-----BEGIN PKCS7-----\n" + signedAD.Signature + "\n-----END PKCS7-----"
-	sigBER, _ := pem.Decode([]byte(sigPEM))
-	if sigBER == nil {
-		return "", "", trace.AccessDenied("unable to decode attested data document")
-	}
-
-	p7, err := pkcs7.Parse(sigBER.Bytes)
-	if err != nil {
-		return "", "", trace.Wrap(err)
-	}
-	var ad attestedData
-	if err := utils.FastUnmarshal(p7.Content, &ad); err != nil {
-		return "", "", trace.Wrap(err)
-	}
-	if ad.Nonce != challenge {
-		return "", "", trace.AccessDenied("challenge is missing or does not match")
-	}
-
-	if len(p7.Certificates) == 0 {
-		return "", "", trace.AccessDenied("no certificates for signature")
-	}
-	fixAzureSigningAlgorithm(p7)
-
-	// Azure only sends the leaf cert, so we have to fetch the intermediate.
-	intermediate, err := getAzureIssuerCert(ctx, p7.Certificates[0])
-	if err != nil {
-		return "", "", trace.Wrap(err)
-	}
-	if intermediate != nil {
-		p7.Certificates = append(p7.Certificates, intermediate)
-	}
-
-	pool := x509.NewCertPool()
-	for _, cert := range certs {
-		pool.AddCert(cert)
-	}
-
-	if err := p7.VerifyWithChain(pool); err != nil {
-		return "", "", trace.Wrap(err)
-	}
-
-	return ad.SubscriptionID, ad.ID, nil
-}
-
-// verifyVMIdentity verifies that the provided access token came from the
-// correct Azure VM. Returns the Azure join attributes
-func verifyVMIdentity(
-	ctx context.Context,
-	cfg *azureRegisterConfig,
-	accessToken,
-	subscriptionID,
-	vmID string,
-	requestStart time.Time,
-	logger *slog.Logger,
-) (joinAttrs *workloadidentityv1pb.JoinAttrsAzure, err error) {
-	tokenClaims, err := cfg.verify(ctx, accessToken)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	expectedIssuer, err := url.JoinPath("https://sts.windows.net", tokenClaims.TenantID, "/")
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// v2 tokens have the version appended to the issuer.
-	if tokenClaims.Version == "2.0" {
-		expectedIssuer, err = url.JoinPath(expectedIssuer, "2.0")
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	expectedClaims := jwt.Expected{
-		Issuer:   expectedIssuer,
-		Audience: jwt.Audience{azureAccessTokenAudience},
-		Time:     requestStart,
-	}
-
-	if err := tokenClaims.AsJWTClaims().Validate(expectedClaims); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Listing all VMs in an Azure subscription during the verification process
-	// is problematic when there are a large number of VMs in an Azure subscription.
-	// In some cases this can lead to throttling due to Azure API rate limits.
-	// To address the issue, the verification process will first attempt to
-	// parse required VM identifiers from the token claims. If this method fails,
-	// fallback to the original method of listing VMs and parsing the VM identifiers
-	// from the VM resource.
-	vmSubscription, vmResourceGroup, err := claimsToIdentifiers(tokenClaims)
-	if err == nil {
-		if subscriptionID != vmSubscription {
-			return nil, trace.AccessDenied("subscription ID mismatch between attested data and access token")
-		}
-		return azureJoinToAttrs(vmSubscription, vmResourceGroup), nil
-	}
-	logger.WarnContext(ctx, "Failed to parse VM identifiers from claims. Retrying with Azure VM API.",
-		"error", err)
-
-	tokenCredential := azure.NewStaticCredential(azcore.AccessToken{
-		Token:     accessToken,
-		ExpiresOn: tokenClaims.GetExpiration(),
-	})
-	vmClient, err := cfg.getVMClient(subscriptionID, tokenCredential)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	resourceID, err := arm.ParseResourceID(tokenClaims.ManangedIdentityResourceID)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var vm *azure.VirtualMachine
-
-	// If the token is from the system-assigned managed identity, the resource ID
-	// is for the VM itself and we can use it to look up the VM.
-	// This will also match scale set VMs (VMSS), the vmClient is responsible
-	// for properly retrieving their information.
-	if slices.Contains(resourceID.ResourceType.Types, azureVirtualMachine) {
-		vm, err = vmClient.Get(ctx, tokenClaims.ManangedIdentityResourceID)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if vm.VMID != vmID {
-			return nil, trace.AccessDenied("vm ID does not match")
-		}
-
-		// If the token is from a user-assigned managed identity, the resource ID is
-		// for the identity and we need to look the VM up by VM ID.
-	} else {
-		vm, err = vmClient.GetByVMID(ctx, vmID)
-		if err != nil {
-			if trace.IsNotFound(err) {
-				return nil, trace.AccessDenied("no VM found with matching VM ID")
-			}
-			return nil, trace.Wrap(err)
-		}
-	}
-	return azureJoinToAttrs(vm.Subscription, vm.ResourceGroup), nil
-}
-
-// claimsToIdentifiers returns the vm identifiers from the provided claims.
-func claimsToIdentifiers(tokenClaims *accessTokenClaims) (subscriptionID, resourceGroupID string, err error) {
-	// xms_az_rid claim is omitted when the VM is assigned a System-Assigned Identity.
-	// The xms_mirid claim should be used instead.
-	rid := cmp.Or(tokenClaims.AzureResourceID, tokenClaims.ManangedIdentityResourceID)
-	resourceID, err := arm.ParseResourceID(rid)
-	if err != nil {
-		return "", "", trace.Wrap(err, "failed to parse resource id from claims")
-	}
-	if !slices.Contains(resourceID.ResourceType.Types, azureVirtualMachine) {
-		return "", "", trace.BadParameter("unexpected resource type: %q", resourceID.ResourceType.Type)
-	}
-	return resourceID.SubscriptionID, resourceID.ResourceGroupName, nil
-}
-
-func checkAzureAllowRules(vmID string, attrs *workloadidentityv1pb.JoinAttrsAzure, token *types.ProvisionTokenV2) error {
-	for _, rule := range token.Spec.Azure.Allow {
-		if rule.Subscription != attrs.Subscription {
-			continue
-		}
-		if !azureResourceGroupIsAllowed(rule.ResourceGroups, attrs.ResourceGroup) {
-			continue
-		}
-		return nil
-	}
-	return trace.AccessDenied("instance %v did not match any allow rules in token %v", vmID, token.GetName())
-}
-func azureResourceGroupIsAllowed(allowedResourceGroups []string, vmResourceGroup string) bool {
-	if len(allowedResourceGroups) == 0 {
-		return true
-	}
-
-	// ResourceGroups are case insensitive.
-	// https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/frequently-asked-questions#are-resource-group-names-case-sensitive
-	// The API returns them using capital case, but docs don't mention a specific case.
-	// Converting everything to the same case will ensure a proper comparison.
-	resourceGroup := strings.ToUpper(vmResourceGroup)
-	for _, allowedResourceGroup := range allowedResourceGroups {
-		if strings.EqualFold(resourceGroup, allowedResourceGroup) {
-			return true
-		}
-	}
-
-	return false
-}
-
-func azureJoinToAttrs(subscriptionID, resourceGroupID string) *workloadidentityv1pb.JoinAttrsAzure {
-	return &workloadidentityv1pb.JoinAttrsAzure{
-		Subscription:  subscriptionID,
-		ResourceGroup: resourceGroupID,
-	}
-}
-
-func (a *Server) checkAzureRequest(
-	ctx context.Context,
-	challenge string,
-	req *proto.RegisterUsingAzureMethodRequest,
-	cfg *azureRegisterConfig,
-) (*workloadidentityv1pb.JoinAttrsAzure, error) {
-	requestStart := a.clock.Now()
-	tokenName := req.RegisterUsingTokenRequest.Token
-	provisionToken, err := a.GetToken(ctx, tokenName)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if provisionToken.GetJoinMethod() != types.JoinMethodAzure {
-		return nil, trace.AccessDenied("this token does not support the Azure join method")
-	}
-	token, ok := provisionToken.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("azure join method only supports ProvisionTokenV2, '%T' was provided", provisionToken)
-	}
-
-	subID, vmID, err := parseAndVerifyAttestedData(ctx, req.AttestedData, challenge, cfg.certificateAuthorities)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	attrs, err := verifyVMIdentity(ctx, cfg, req.AccessToken, subID, vmID, requestStart, a.logger)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if err := checkAzureAllowRules(vmID, attrs, token); err != nil {
-		return attrs, trace.Wrap(err)
-	}
-
-	return attrs, nil
-}
-
-func generateAzureChallenge() (string, error) {
-	challenge, err := generateChallenge(base64.RawURLEncoding, 24)
-	return challenge, trace.Wrap(err)
-}
-
-// RegisterUsingAzureMethodWithOpts registers the caller using the Azure join method
-// and returns signed certs to join the cluster.
-//
-// The caller must provide a ChallengeResponseFunc which returns a
-// *proto.RegisterUsingAzureMethodRequest with a signed attested data document
-// including the challenge as a nonce.
-func (a *Server) RegisterUsingAzureMethodWithOpts(
-	ctx context.Context,
-	challengeResponse client.RegisterAzureChallengeResponseFunc,
-	opts ...azureRegisterOption,
-) (certs *proto.Certs, err error) {
-	var provisionToken types.ProvisionToken
-	var joinRequest *types.RegisterUsingTokenRequest
-	defer func() {
-		// Emit a log message and audit event on join failure.
-		if err != nil {
-			a.handleJoinFailure(ctx, err, provisionToken, nil, joinRequest)
-		}
-	}()
-
-	cfg := &azureRegisterConfig{}
-	for _, opt := range opts {
-		opt(cfg)
-	}
-	if err := cfg.CheckAndSetDefaults(ctx); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	challenge, err := generateAzureChallenge()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	req, err := challengeResponse(challenge)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	joinRequest = req.RegisterUsingTokenRequest
-
-	if err := req.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	provisionToken, err = a.checkTokenJoinRequestCommon(ctx, req.RegisterUsingTokenRequest)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	joinAttrs, err := a.checkAzureRequest(ctx, challenge, req, cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if req.RegisterUsingTokenRequest.Role == types.RoleBot {
-		certs, _, err := a.generateCertsBot(
-			ctx,
-			provisionToken,
-			req.RegisterUsingTokenRequest,
-			nil,
-			&workloadidentityv1pb.JoinAttrs{
-				Azure: joinAttrs,
-			},
-		)
-		return certs, trace.Wrap(err)
-	}
-	certs, err = a.generateCerts(
-		ctx,
-		provisionToken,
-		req.RegisterUsingTokenRequest,
-		nil,
-	)
-	return certs, trace.Wrap(err)
-}
-
-// RegisterUsingAzureMethod registers the caller using the Azure join method
-// and returns signed certs to join the cluster.
-//
-// The caller must provide a ChallengeResponseFunc which returns a
-// *proto.RegisterUsingAzureMethodRequest with a signed attested data document
-// including the challenge as a nonce.
-func (a *Server) RegisterUsingAzureMethod(
-	ctx context.Context,
-	challengeResponse client.RegisterAzureChallengeResponseFunc,
-) (certs *proto.Certs, err error) {
-	return a.RegisterUsingAzureMethodWithOpts(ctx, challengeResponse)
-}
-
-// fixAzureSigningAlgorithm fixes a mismatch between the object IDs of the
-// hashing algorithm sent by Azure vs the ones expected by the pkcs7 library.
-// Specifically, Azure (incorrectly?) sends a [digest encryption algorithm]
-// where the pkcs7 structure's [signerInfo] expects a [digest algorithm].
-//
-// [signerInfo]: https://www.rfc-editor.org/rfc/rfc2315#section-6.4
-// [digest algorithm]: https://www.rfc-editor.org/rfc/rfc2315#section-6.3
-// [digest encryption algorithm]: https://www.rfc-editor.org/rfc/rfc2315#section-6.4
-func fixAzureSigningAlgorithm(p7 *pkcs7.PKCS7) {
-	for i, signer := range p7.Signers {
-		if signer.DigestAlgorithm.Algorithm.Equal(pkcs7.OIDEncryptionAlgorithmRSASHA256) {
-			p7.Signers[i].DigestAlgorithm.Algorithm = pkcs7.OIDDigestAlgorithmSHA256
-		}
-	}
-}
diff --git a/lib/auth/join_azure_devops.go b/lib/auth/join_azure_devops.go
index 03674cdb02938..4d91646249634 100644
--- a/lib/auth/join_azure_devops.go
+++ b/lib/auth/join_azure_devops.go
@@ -24,13 +24,9 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/azuredevops"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
 )
 
-type azureDevopsIDTokenValidator interface {
-	Validate(ctx context.Context, organizationID string, idToken string) (*azuredevops.IDTokenClaims, error)
-}
-
 func (a *Server) checkAzureDevopsJoinRequest(
 	ctx context.Context,
 	req *types.RegisterUsingTokenRequest,
@@ -44,47 +40,22 @@ func (a *Server) checkAzureDevopsJoinRequest(
 		return nil, trace.BadParameter("%q join method only support ProvisionTokenV2, '%T' was provided", types.JoinMethodAzureDevops, pt)
 	}
 
-	claims, err := a.azureDevopsIDTokenValidator.Validate(
-		ctx,
-		token.Spec.AzureDevops.OrganizationID,
-		req.IDToken,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return claims, trace.Wrap(checkAzureDevopsAllowRules(token, claims))
+	claims, err := azuredevops.CheckIDToken(ctx, &azuredevops.CheckIDTokenParams{
+		ProvisionToken: token,
+		IDToken:        req.IDToken,
+		Validator:      a.azureDevopsIDTokenValidator,
+	})
+	return claims, trace.Wrap(err)
 }
 
-func checkAzureDevopsAllowRules(token *types.ProvisionTokenV2, claims *azuredevops.IDTokenClaims) error {
-	// If a single rule passes, accept the IDToken
-	for _, rule := range token.Spec.AzureDevops.Allow {
-		if rule.Sub != "" && rule.Sub != claims.Sub {
-			continue
-		}
-		if rule.ProjectName != "" && rule.ProjectName != claims.ProjectName {
-			continue
-		}
-		if rule.PipelineName != "" && rule.PipelineName != claims.PipelineName {
-			continue
-		}
-		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
-			continue
-		}
-		if rule.DefinitionID != "" && claims.DefinitionID != rule.DefinitionID {
-			continue
-		}
-		if rule.RepositoryURI != "" && claims.RepositoryURI != rule.RepositoryURI {
-			continue
-		}
-		if rule.RepositoryVersion != "" && claims.RepositoryVersion != rule.RepositoryVersion {
-			continue
-		}
-		if rule.RepositoryRef != "" && claims.RepositoryRef != rule.RepositoryRef {
-			continue
-		}
-		return nil
-	}
+// GetAzureDevopsIDTokenValidator returns the currently configured token validator
+// for Azure Devops.
+func (a *Server) GetAzureDevopsIDTokenValidator() azuredevops.Validator {
+	return a.azureDevopsIDTokenValidator
+}
 
-	return trace.AccessDenied("id token claims failed to match any allow rules")
+// SetAzureDevopsIDTokenValidator sets the current token validator for Azure
+// Devops.
+func (a *Server) SetAzureDevopsIDTokenValidator(validator azuredevops.Validator) {
+	a.azureDevopsIDTokenValidator = validator
 }
diff --git a/lib/auth/join_azure_devops_test.go b/lib/auth/join_azure_devops_test.go
deleted file mode 100644
index dcae909be7952..0000000000000
--- a/lib/auth/join_azure_devops_test.go
+++ /dev/null
@@ -1,338 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/azuredevops"
-)
-
-type mockAzureDevopsTokenValidator struct {
-	tokens map[string]map[string]azuredevops.IDTokenClaims
-}
-
-func (m *mockAzureDevopsTokenValidator) Validate(
-	_ context.Context, organizationID string, token string,
-) (*azuredevops.IDTokenClaims, error) {
-	orgTokens := m.tokens[organizationID]
-	if orgTokens == nil {
-		return nil, fmt.Errorf("bad organization ID: %s", organizationID)
-	}
-	claims, ok := orgTokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-
-	return &claims, nil
-}
-
-func TestAuth_RegisterUsingToken_AzureDevops(t *testing.T) {
-	const (
-		validIDToken          = "test.fake.jwt"
-		validOrgID            = "0000-0000-0000-1337"
-		fakeSub               = "p://my-org/my-project/my-pipeline"
-		fakeOrgName           = "my-org"
-		fakeProjectName       = "my-project"
-		fakePipelineName      = "my-pipeline"
-		fakeProjectID         = "711ef6f7-0000-0000-0000-4b54d912999"
-		fakeDefinitionID      = "1"
-		fakeRepositoryURI     = "https://github.com/gravitational/teleport.git"
-		fakeRepositoryVersion = "e6b9eb29a288b27a3a82cc19c48b9d94b80aff36"
-		fakeRepositoryRef     = "refs/heads/main"
-	)
-
-	idTokenValidator := &mockAzureDevopsTokenValidator{
-		tokens: map[string]map[string]azuredevops.IDTokenClaims{
-			validOrgID: {
-				validIDToken: {
-					Sub:               fakeSub,
-					ProjectName:       fakeProjectName,
-					OrganizationName:  fakeOrgName,
-					ProjectID:         fakeProjectID,
-					DefinitionID:      fakeDefinitionID,
-					RepositoryURI:     fakeRepositoryURI,
-					RepositoryVersion: fakeRepositoryVersion,
-					RepositoryRef:     fakeRepositoryRef,
-					PipelineName:      fakePipelineName,
-				},
-			},
-		},
-	}
-
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), func(server *Server) error {
-		server.azureDevopsIDTokenValidator = idTokenValidator
-		return nil
-	})
-	require.NoError(t, err)
-	auth := p.a
-
-	// helper for creating RegisterUsingTokenRequest
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	allowRule := func(modifier func(devops *types.ProvisionTokenSpecV2AzureDevops_Rule)) *types.ProvisionTokenSpecV2AzureDevops_Rule {
-		rule := &types.ProvisionTokenSpecV2AzureDevops_Rule{
-			Sub:               fakeSub,
-			ProjectName:       fakeProjectName,
-			PipelineName:      fakePipelineName,
-			ProjectID:         fakeProjectID,
-			DefinitionID:      fakeDefinitionID,
-			RepositoryURI:     fakeRepositoryURI,
-			RepositoryVersion: fakeRepositoryVersion,
-			RepositoryRef:     fakeRepositoryRef,
-		}
-		if modifier != nil {
-			modifier(rule)
-		}
-		return rule
-	}
-
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorContains(t, err, "id token claims failed to match any allow rules")
-		require.True(t, trace.IsAccessDenied(err))
-	})
-
-	tests := []struct {
-		name        string
-		request     *types.RegisterUsingTokenRequest
-		tokenSpec   types.ProvisionTokenSpecV2
-		assertError require.ErrorAssertionFunc
-	}{
-		{
-			name: "success",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "multiple allow rules",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.Sub = "no-match"
-						}),
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "incorrect sub",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.Sub = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect project_name",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.ProjectName = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect pipeline name",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.PipelineName = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect project id",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.ProjectID = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect definition id",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.DefinitionID = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect repository uri",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.RepositoryURI = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect repository version",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.RepositoryVersion = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect repository ref",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
-							rule.RepositoryRef = "wrong"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "invalid token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodAzureDevops,
-				Roles:      []types.SystemRole{types.RoleNode},
-				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
-					OrganizationID: validOrgID,
-					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request: newRequest("some other token"),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, errMockInvalidToken)
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			token, err := types.NewProvisionTokenFromSpec(
-				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tt.request.Token = tt.name
-
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
-		})
-	}
-}
diff --git a/lib/auth/join_azure_legacy.go b/lib/auth/join_azure_legacy.go
new file mode 100644
index 0000000000000..9032f084e6aeb
--- /dev/null
+++ b/lib/auth/join_azure_legacy.go
@@ -0,0 +1,119 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
+)
+
+// RegisterUsingAzureMethod registers the caller using the Azure join method
+// and returns signed certs to join the cluster.
+//
+// The caller must provide a ChallengeResponseFunc which returns a
+// *proto.RegisterUsingAzureMethodRequest with a signed attested data document
+// including the challenge as a nonce.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
+func (a *Server) RegisterUsingAzureMethod(
+	ctx context.Context,
+	challengeResponse client.RegisterAzureChallengeResponseFunc,
+) (certs *proto.Certs, err error) {
+	var provisionToken types.ProvisionToken
+	var joinRequest *types.RegisterUsingTokenRequest
+	defer func() {
+		// Emit a log message and audit event on join failure.
+		if err != nil {
+			a.handleJoinFailure(ctx, err, provisionToken, nil, joinRequest)
+		}
+	}()
+
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
+	}
+
+	challenge, err := azurejoin.GenerateAzureChallenge()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	req, err := challengeResponse(challenge)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	joinRequest = req.RegisterUsingTokenRequest
+
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	provisionToken, err = a.checkTokenJoinRequestCommon(ctx, req.RegisterUsingTokenRequest)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if provisionToken.GetJoinMethod() != types.JoinMethodAzure {
+		return nil, trace.AccessDenied("this token does not support the Azure join method")
+	}
+
+	ptv2, ok := provisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.Wrap(err, "Azure join method only supports ProvisionTokenV2, got %T", provisionToken)
+	}
+
+	joinAttrs, err := azurejoin.CheckAzureRequest(ctx, azurejoin.CheckAzureRequestParams{
+		AzureJoinConfig: a.GetAzureJoinConfig(),
+		Token:           ptv2,
+		Challenge:       challenge,
+		AttestedData:    req.AttestedData,
+		AccessToken:     req.AccessToken,
+		Logger:          a.logger,
+		Clock:           a.GetClock(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "checking Azure challenge response")
+	}
+
+	if req.RegisterUsingTokenRequest.Role == types.RoleBot {
+		params := makeBotCertsParams(req.RegisterUsingTokenRequest, nil /*rawClaims*/, &workloadidentityv1pb.JoinAttrs{
+			Azure: joinAttrs,
+		})
+		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
+		return certs, trace.Wrap(err)
+	}
+	params := makeHostCertsParams(req.RegisterUsingTokenRequest, nil /*rawClaims*/)
+	certs, err = a.GenerateHostCertsForJoin(ctx, provisionToken, params)
+	return certs, trace.Wrap(err)
+}
+
+// GetAzureJoinConfig gets configuration options for azure joining.
+func (a *Server) GetAzureJoinConfig() *azurejoin.AzureJoinConfig {
+	return a.azureJoinConfig
+}
+
+// SetAzureJoinConfig sets configuration options for azure joining.
+func (a *Server) SetAzureJoinConfig(c *azurejoin.AzureJoinConfig) {
+	a.azureJoinConfig = c
+}
diff --git a/lib/auth/join_azure_test.go b/lib/auth/join_azure_test.go
deleted file mode 100644
index 5392681a71098..0000000000000
--- a/lib/auth/join_azure_test.go
+++ /dev/null
@@ -1,847 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/digitorus/pkcs7"
-	"github.com/go-jose/go-jose/v3"
-	"github.com/go-jose/go-jose/v3/jwt"
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/cloud/azure"
-	"github.com/gravitational/teleport/lib/fixtures"
-)
-
-func withCerts(certs []*x509.Certificate) azureRegisterOption {
-	return func(cfg *azureRegisterConfig) {
-		cfg.certificateAuthorities = certs
-	}
-}
-
-func withVerifyFunc(verify azureVerifyTokenFunc) azureRegisterOption {
-	return func(cfg *azureRegisterConfig) {
-		cfg.verify = verify
-	}
-}
-
-func withVMClientGetter(getVMClient vmClientGetter) azureRegisterOption {
-	return func(cfg *azureRegisterConfig) {
-		cfg.getVMClient = getVMClient
-	}
-}
-
-type mockAzureVMClient struct {
-	azure.VirtualMachinesClient
-	vms map[string]*azure.VirtualMachine
-}
-
-func (m *mockAzureVMClient) Get(_ context.Context, resourceID string) (*azure.VirtualMachine, error) {
-	vm, ok := m.vms[resourceID]
-	if !ok {
-		return nil, trace.NotFound("no vm with resource id %q", resourceID)
-	}
-	return vm, nil
-}
-
-func (m *mockAzureVMClient) GetByVMID(_ context.Context, vmID string) (*azure.VirtualMachine, error) {
-	for _, vm := range m.vms {
-		if vm.VMID == vmID {
-			return vm, nil
-		}
-	}
-	return nil, trace.NotFound("no vm with id %q", vmID)
-}
-
-func makeVMClientGetter(clients map[string]*mockAzureVMClient) vmClientGetter {
-	return func(subscriptionID string, _ *azure.StaticCredential) (azure.VirtualMachinesClient, error) {
-		if client, ok := clients[subscriptionID]; ok {
-			return client, nil
-		}
-		return nil, trace.NotFound("no client for subscription %q", subscriptionID)
-	}
-}
-
-type azureChallengeResponseConfig struct {
-	Challenge string
-}
-
-type azureChallengeResponseOption func(*azureChallengeResponseConfig)
-
-func withChallengeAzure(challenge string) azureChallengeResponseOption {
-	return func(cfg *azureChallengeResponseConfig) {
-		cfg.Challenge = challenge
-	}
-}
-
-func vmResourceID(subscription, resourceGroup, name string) string {
-	return resourceID("Microsoft.Compute/virtualMachines", subscription, resourceGroup, name)
-}
-
-func identityResourceID(subscription, resourceGroup, name string) string {
-	return resourceID("Microsoft.ManagedIdentity/userAssignedIdentities", subscription, resourceGroup, name)
-}
-
-func resourceID(resourceType, subscription, resourceGroup, name string) string {
-	return fmt.Sprintf(
-		"/subscriptions/%v/resourcegroups/%v/providers/%v/%v",
-		subscription, resourceGroup, resourceType, name,
-	)
-}
-
-func mockVerifyToken(err error) azureVerifyTokenFunc {
-	return func(_ context.Context, rawToken string) (*accessTokenClaims, error) {
-		if err != nil {
-			return nil, err
-		}
-		tok, err := jwt.ParseSigned(rawToken)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		var claims accessTokenClaims
-		if err := tok.UnsafeClaimsWithoutVerification(&claims); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return &claims, nil
-	}
-}
-
-func makeToken(managedIdentityResourceID, azureResourceID string, issueTime time.Time) (string, error) {
-	sig, err := jose.NewSigner(jose.SigningKey{
-		Algorithm: jose.HS256,
-		Key:       []byte("test-key"),
-	}, &jose.SignerOptions{})
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	claims := accessTokenClaims{
-		TokenClaims: oidc.TokenClaims{
-			Issuer:     "https://sts.windows.net/test-tenant-id/",
-			Audience:   []string{azureAccessTokenAudience},
-			Subject:    "test",
-			IssuedAt:   oidc.FromTime(issueTime),
-			NotBefore:  oidc.FromTime(issueTime),
-			Expiration: oidc.FromTime(issueTime.Add(time.Minute)),
-			JWTID:      "id",
-		},
-		ManangedIdentityResourceID: managedIdentityResourceID,
-		AzureResourceID:            azureResourceID,
-		TenantID:                   "test-tenant-id",
-		Version:                    "1.0",
-	}
-	raw, err := jwt.Signed(sig).Claims(claims).CompactSerialize()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return raw, nil
-}
-
-func TestAuth_RegisterUsingAzureMethod(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-	a := p.a
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-
-	tlsConfig, err := fixtures.LocalTLSConfig()
-	require.NoError(t, err)
-
-	block, _ := pem.Decode(fixtures.LocalhostKey)
-	pkey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	require.NoError(t, err)
-
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	isAccessDenied := func(t require.TestingT, err error, _ ...any) {
-		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
-	}
-	isBadParameter := func(t require.TestingT, err error, _ ...any) {
-		require.True(t, trace.IsBadParameter(err), "expected Bad Parameter error, actual error: %v", err)
-	}
-
-	defaultSubscription := uuid.NewString()
-	defaultResourceGroup := "my-resource-group"
-	defaultVMName := "test-vm"
-	defaultIdentityName := "test-id"
-	defaultVMID := "my-vm-id"
-	defaultVMResourceID := vmResourceID(defaultSubscription, defaultResourceGroup, defaultVMName)
-	defaultIdentityResourceID := identityResourceID(defaultSubscription, defaultResourceGroup, defaultIdentityName)
-
-	tests := []struct {
-		name                           string
-		tokenManagedIdentityResourceID string
-		tokenAzureResourceID           string
-		tokenSubscription              string
-		tokenVMID                      string
-		requestTokenName               string
-		tokenSpec                      types.ProvisionTokenSpecV2
-		challengeResponseOptions       []azureChallengeResponseOption
-		challengeResponseErr           error
-		certs                          []*x509.Certificate
-		verify                         azureVerifyTokenFunc
-		assertError                    require.ErrorAssertionFunc
-	}{
-		{
-			name:              "basic passing case",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   defaultSubscription,
-							ResourceGroups: []string{defaultResourceGroup},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:              "resource group is case insensitive",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   defaultSubscription,
-							ResourceGroups: []string{"MY-resource-GROUP"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:              "wrong token",
-			requestTokenName:  "wrong-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:              "challenge response error",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:               mockVerifyToken(nil),
-			certs:                []*x509.Certificate{tlsConfig.Certificate},
-			challengeResponseErr: trace.BadParameter("test error"),
-			assertError:          isBadParameter,
-		},
-		{
-			name:              "wrong subscription",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: "alternate-subscription-id",
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:              "wrong resource group",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   defaultSubscription,
-							ResourceGroups: []string{"alternate-resource-group"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:              "wrong challenge",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			challengeResponseOptions: []azureChallengeResponseOption{
-				withChallengeAzure("wrong-challenge"),
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:              "invalid signature",
-			requestTokenName:  "test-token",
-			tokenSubscription: defaultSubscription,
-			tokenVMID:         defaultVMID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{},
-			assertError: require.Error,
-		},
-		{
-			name:                           "attested data and access token from different VMs",
-			requestTokenName:               "test-token",
-			tokenSubscription:              defaultSubscription,
-			tokenVMID:                      "some-other-vm-id",
-			tokenManagedIdentityResourceID: defaultIdentityResourceID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "vm not found",
-			requestTokenName:               "test-token",
-			tokenSubscription:              defaultSubscription,
-			tokenVMID:                      "invalid-id",
-			tokenManagedIdentityResourceID: identityResourceID(defaultSubscription, defaultResourceGroup, "invalid-vm"),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "lookup vm by id",
-			requestTokenName:               "test-token",
-			tokenSubscription:              defaultSubscription,
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: defaultIdentityResourceID,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:                           "vm is in a different subscription than the token it provides",
-			requestTokenName:               "test-token",
-			tokenSubscription:              defaultSubscription,
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: identityResourceID("some-other-subscription", defaultResourceGroup, defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription: defaultSubscription,
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			token, err := types.NewProvisionTokenFromSpec(
-				"test-token",
-				time.Now().Add(time.Minute),
-				tc.tokenSpec)
-			require.NoError(t, err)
-			require.NoError(t, a.UpsertToken(ctx, token))
-			t.Cleanup(func() {
-				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
-			})
-
-			mirID := tc.tokenManagedIdentityResourceID
-			if mirID == "" {
-				mirID = vmResourceID(defaultSubscription, defaultResourceGroup, defaultVMName)
-			}
-
-			accessToken, err := makeToken(mirID, "", a.clock.Now())
-			require.NoError(t, err)
-
-			vmClient := &mockAzureVMClient{
-				vms: map[string]*azure.VirtualMachine{
-					defaultVMResourceID: {
-						ID:            defaultVMResourceID,
-						Name:          defaultVMName,
-						Subscription:  defaultSubscription,
-						ResourceGroup: defaultResourceGroup,
-						VMID:          defaultVMID,
-					},
-				},
-			}
-			getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
-				defaultSubscription: vmClient,
-			})
-
-			_, err = a.RegisterUsingAzureMethodWithOpts(context.Background(), func(challenge string) (*proto.RegisterUsingAzureMethodRequest, error) {
-				cfg := &azureChallengeResponseConfig{Challenge: challenge}
-				for _, opt := range tc.challengeResponseOptions {
-					opt(cfg)
-				}
-
-				ad := attestedData{
-					Nonce:          cfg.Challenge,
-					SubscriptionID: tc.tokenSubscription,
-					ID:             tc.tokenVMID,
-				}
-				adBytes, err := json.Marshal(&ad)
-				require.NoError(t, err)
-				s, err := pkcs7.NewSignedData(adBytes)
-				require.NoError(t, err)
-				require.NoError(t, s.AddSigner(tlsConfig.Certificate, pkey, pkcs7.SignerInfoConfig{}))
-				signature, err := s.Finish()
-				require.NoError(t, err)
-				signedAD := signedAttestedData{
-					Encoding:  "pkcs7",
-					Signature: base64.StdEncoding.EncodeToString(signature),
-				}
-				signedADBytes, err := json.Marshal(&signedAD)
-				require.NoError(t, err)
-
-				req := &proto.RegisterUsingAzureMethodRequest{
-					RegisterUsingTokenRequest: &types.RegisterUsingTokenRequest{
-						Token:        tc.requestTokenName,
-						HostID:       "test-node",
-						Role:         types.RoleNode,
-						PublicSSHKey: sshPublicKey,
-						PublicTLSKey: tlsPublicKey,
-					},
-					AttestedData: signedADBytes,
-					AccessToken:  accessToken,
-				}
-				return req, tc.challengeResponseErr
-			}, withCerts(tc.certs), withVerifyFunc(tc.verify), withVMClientGetter(getVMClient))
-			tc.assertError(t, err)
-		})
-	}
-}
-
-// TestAuth_RegisterUsingAzureClaims tests the Azure join method by verifying
-// joining VMs by the token claims rather than from the Azure VM API.
-func TestAuth_RegisterUsingAzureClaims(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-	a := p.a
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-
-	tlsConfig, err := fixtures.LocalTLSConfig()
-	require.NoError(t, err)
-
-	block, _ := pem.Decode(fixtures.LocalhostKey)
-	pkey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	require.NoError(t, err)
-
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	isAccessDenied := func(t require.TestingT, err error, _ ...any) {
-		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
-	}
-	defaultSubscription := uuid.NewString()
-	defaultResourceGroup := "my-resource-group"
-	defaultVMName := "test-vm"
-	defaultIdentityName := "test-id"
-	defaultVMID := "my-vm-id"
-
-	tests := []struct {
-		name                           string
-		tokenManagedIdentityResourceID string
-		tokenAzureResourceID           string
-		tokenSubscription              string
-		tokenVMID                      string
-		requestTokenName               string
-		tokenSpec                      types.ProvisionTokenSpecV2
-		challengeResponseOptions       []azureChallengeResponseOption
-		challengeResponseErr           error
-		certs                          []*x509.Certificate
-		verify                         azureVerifyTokenFunc
-		assertError                    require.ErrorAssertionFunc
-	}{
-		{
-			name:                           "system-managed identity ok",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "system-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "system-managed-test",
-							ResourceGroups: []string{"system-managed-test"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:                           "system-managed identity with wrong subscription",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "system-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   defaultSubscription,
-							ResourceGroups: []string{"system-managed-test"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "system-managed identity with wrong resource group",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "system-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "system-managed-test",
-							ResourceGroups: []string{defaultResourceGroup},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "user-managed identity ok",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "user-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
-			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "user-managed-test",
-							ResourceGroups: []string{"user-managed-test"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:                           "user-managed identity with wrong subscription",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "user-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
-			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   defaultSubscription,
-							ResourceGroups: []string{"user-managed-test"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "user-managed identity with wrong resource group",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "user-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
-			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "user-managed-test",
-							ResourceGroups: []string{defaultResourceGroup},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-		{
-			name:                           "user-managed identity from different subscription",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "user-managed-test",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: identityResourceID("invalid-user-managed-test", "invalid-user-managed-test", defaultIdentityName),
-			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "user-managed-test",
-							ResourceGroups: []string{"user-managed-test"},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: require.NoError,
-		},
-		{
-			name:                           "subscription mismatch between attestation and token",
-			requestTokenName:               "test-token",
-			tokenSubscription:              "attested-subscription",
-			tokenVMID:                      defaultVMID,
-			tokenManagedIdentityResourceID: vmResourceID("token-subscription", defaultResourceGroup, defaultVMName),
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Azure: &types.ProvisionTokenSpecV2Azure{
-					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
-						{
-							Subscription:   "token-subscription",
-							ResourceGroups: []string{defaultResourceGroup},
-						},
-					},
-				},
-				JoinMethod: types.JoinMethodAzure,
-			},
-			verify:      mockVerifyToken(nil),
-			certs:       []*x509.Certificate{tlsConfig.Certificate},
-			assertError: isAccessDenied,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			token, err := types.NewProvisionTokenFromSpec(
-				"test-token",
-				time.Now().Add(time.Minute),
-				tc.tokenSpec)
-			require.NoError(t, err)
-			require.NoError(t, a.UpsertToken(ctx, token))
-			t.Cleanup(func() {
-				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
-			})
-
-			mirID := tc.tokenManagedIdentityResourceID
-			azrID := tc.tokenAzureResourceID
-			accessToken, err := makeToken(mirID, azrID, a.clock.Now())
-			require.NoError(t, err)
-
-			vmClient := &mockAzureVMClient{
-				vms: map[string]*azure.VirtualMachine{},
-			}
-			getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
-				defaultSubscription: vmClient,
-			})
-
-			_, err = a.RegisterUsingAzureMethodWithOpts(context.Background(), func(challenge string) (*proto.RegisterUsingAzureMethodRequest, error) {
-				cfg := &azureChallengeResponseConfig{Challenge: challenge}
-				for _, opt := range tc.challengeResponseOptions {
-					opt(cfg)
-				}
-
-				ad := attestedData{
-					Nonce:          cfg.Challenge,
-					SubscriptionID: tc.tokenSubscription,
-					ID:             tc.tokenVMID,
-				}
-				adBytes, err := json.Marshal(&ad)
-				require.NoError(t, err)
-				s, err := pkcs7.NewSignedData(adBytes)
-				require.NoError(t, err)
-				require.NoError(t, s.AddSigner(tlsConfig.Certificate, pkey, pkcs7.SignerInfoConfig{}))
-				signature, err := s.Finish()
-				require.NoError(t, err)
-				signedAD := signedAttestedData{
-					Encoding:  "pkcs7",
-					Signature: base64.StdEncoding.EncodeToString(signature),
-				}
-				signedADBytes, err := json.Marshal(&signedAD)
-				require.NoError(t, err)
-
-				req := &proto.RegisterUsingAzureMethodRequest{
-					RegisterUsingTokenRequest: &types.RegisterUsingTokenRequest{
-						Token:        tc.requestTokenName,
-						HostID:       "test-node",
-						Role:         types.RoleNode,
-						PublicSSHKey: sshPublicKey,
-						PublicTLSKey: tlsPublicKey,
-					},
-					AttestedData: signedADBytes,
-					AccessToken:  accessToken,
-				}
-				return req, tc.challengeResponseErr
-			}, withCerts(tc.certs), withVerifyFunc(tc.verify), withVMClientGetter(getVMClient))
-			tc.assertError(t, err)
-		})
-	}
-}
diff --git a/lib/auth/join_bitbucket.go b/lib/auth/join_bitbucket.go
index 6560a5d8377de..922b017ff1a72 100644
--- a/lib/auth/join_bitbucket.go
+++ b/lib/auth/join_bitbucket.go
@@ -24,13 +24,19 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/bitbucket"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
 )
 
-type bitbucketIDTokenValidator interface {
-	Validate(
-		ctx context.Context, idpURL, audience, token string,
-	) (*bitbucket.IDTokenClaims, error)
+// GetBitbucketIDTokenValidator returns the currently configured token validator
+// for Bitbucket.
+func (a *Server) GetBitbucketIDTokenValidator() bitbucket.Validator {
+	return a.bitbucketIDTokenValidator
+}
+
+// SetBitbucketIDTokenValidator sets the current Bitbucket token validator
+// implementation. Used in tests.
+func (a *Server) SetBitbucketIDTokenValidator(validator bitbucket.Validator) {
+	a.bitbucketIDTokenValidator = validator
 }
 
 func (a *Server) checkBitbucketJoinRequest(
@@ -38,51 +44,14 @@ func (a *Server) checkBitbucketJoinRequest(
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*bitbucket.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("id_token not provided for bitbucket join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("bitbucket join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	claims, err := a.bitbucketIDTokenValidator.Validate(
-		ctx, token.Spec.Bitbucket.IdentityProviderURL, token.Spec.Bitbucket.Audience, req.IDToken,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	a.logger.InfoContext(ctx, "Bitbucket run trying to join cluster", "claims", claims, "token", pt.GetName())
-
-	return claims, trace.Wrap(checkBitbucketAllowRules(token, claims))
-}
-
-func checkBitbucketAllowRules(token *types.ProvisionTokenV2, claims *bitbucket.IDTokenClaims) error {
-	// If a single rule passes, accept the IDToken
-	for _, rule := range token.Spec.Bitbucket.Allow {
-		// Please consider keeping these field validators in the same order they
-		// are defined within the ProvisionTokenSpecV2Bitbucket proto spec.
-
-		if rule.WorkspaceUUID != "" && claims.WorkspaceUUID != rule.WorkspaceUUID {
-			continue
-		}
-
-		if rule.RepositoryUUID != "" && claims.RepositoryUUID != rule.RepositoryUUID {
-			continue
-		}
-
-		if rule.DeploymentEnvironmentUUID != "" && claims.DeploymentEnvironmentUUID != rule.DeploymentEnvironmentUUID {
-			continue
-		}
-
-		if rule.BranchName != "" && claims.BranchName != rule.BranchName {
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
-
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	claims, err := bitbucket.CheckIDToken(ctx, &bitbucket.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Clock:          a.GetClock(),
+		Validator:      a.bitbucketIDTokenValidator,
+	})
+
+	// Note: We try to return claims regardless of whether or not an error is
+	// returned for downstream logging.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_bound_keypair.go b/lib/auth/join_bound_keypair.go
deleted file mode 100644
index f87d50bbc5325..0000000000000
--- a/lib/auth/join_bound_keypair.go
+++ /dev/null
@@ -1,563 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"crypto"
-	"encoding/json"
-	"time"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/boundkeypair"
-	"github.com/gravitational/teleport/lib/boundkeypair/boundkeypairexperiment"
-	"github.com/gravitational/teleport/lib/jwt"
-	libsshutils "github.com/gravitational/teleport/lib/sshutils"
-)
-
-type boundKeypairValidator interface {
-	IssueChallenge() (*boundkeypair.ChallengeDocument, error)
-	ValidateChallengeResponse(issued *boundkeypair.ChallengeDocument, compactResponse string) error
-}
-
-type createBoundKeypairValidator func(subject string, clusterName string, publicKey crypto.PublicKey) (boundKeypairValidator, error)
-
-// validateBoundKeypairTokenSpec performs some basic validation checks on a
-// bound_keypair-type join token.
-func validateBoundKeypairTokenSpec(spec *types.ProvisionTokenSpecV2BoundKeypair) error {
-	// Various constant checks, shared between creation and update. Many of
-	// these checks are temporary and will be removed alongside the experiment
-	// flag.
-	if !boundkeypairexperiment.Enabled() {
-		return trace.BadParameter("bound keypair joining experiment is not enabled")
-	}
-
-	if spec.RotateAfter != nil {
-		return trace.NotImplemented("spec.bound_keypair.rotate_after is not yet implemented")
-	}
-
-	if spec.Onboarding.RegistrationSecret != "" {
-		return trace.NotImplemented("spec.bound_keypair.onboarding.registration_secret is not yet implemented")
-	}
-
-	if spec.Onboarding.InitialPublicKey == "" {
-		return trace.NotImplemented("spec.bound_keypair.onboarding.initial_public_key is currently required")
-	}
-
-	if spec.Recovery == nil {
-		return trace.BadParameter("spec.recovery: field is required")
-	}
-
-	return nil
-}
-
-func (a *Server) CreateBoundKeypairToken(ctx context.Context, token types.ProvisionToken) error {
-	if token.GetJoinMethod() != types.JoinMethodBoundKeypair {
-		return trace.BadParameter("must be called with a bound keypair token")
-	}
-
-	tokenV2, ok := token.(*types.ProvisionTokenV2)
-	if !ok {
-		return trace.BadParameter("%v join method requires ProvisionTokenV2", types.JoinMethodOracle)
-	}
-
-	spec := tokenV2.Spec.BoundKeypair
-	if spec == nil {
-		return trace.BadParameter("bound_keypair token requires non-nil spec.bound_keypair")
-	}
-
-	if err := validateBoundKeypairTokenSpec(spec); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Not as much to do here - ideally we'd like to prevent users from
-	// tampering with the status field, but we don't have a good mechanism to
-	// stop that that wouldn't also break backup and restore. For now, it's
-	// simpler and easier to just tell users not to edit those fields.
-
-	// TODO (follow up PR): Populate initial_join_secret if needed.
-
-	return trace.Wrap(a.CreateToken(ctx, tokenV2))
-}
-
-func (a *Server) UpsertBoundKeypairToken(ctx context.Context, token types.ProvisionToken) error {
-	if token.GetJoinMethod() != types.JoinMethodBoundKeypair {
-		return trace.BadParameter("must be called with a bound keypair token")
-	}
-
-	tokenV2, ok := token.(*types.ProvisionTokenV2)
-	if !ok {
-		return trace.BadParameter("%v join method requires ProvisionTokenV2", types.JoinMethodOracle)
-	}
-
-	spec := tokenV2.Spec.BoundKeypair
-	if spec == nil {
-		return trace.BadParameter("bound_keypair token requires non-nil spec.bound_keypair")
-	}
-
-	if err := validateBoundKeypairTokenSpec(spec); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// TODO: Follow up with proper checking for a preexisting resource so
-	// generated fields are handled properly, i.e. initial secret generation.
-
-	// Implementation note: checkAndSetDefaults() impl for this token type is
-	// called at insertion time as part of `tokenToItem()`
-	return trace.Wrap(a.UpsertToken(ctx, token))
-}
-
-// issueBoundKeypairChallenge creates a new challenge for the given marshaled
-// public key in ssh authorized_keys format, requests a solution from the
-// client using the given `challengeResponse` function, and validates the
-// response.
-func (a *Server) issueBoundKeypairChallenge(
-	ctx context.Context,
-	marshalledKey string,
-	challengeResponse client.RegisterUsingBoundKeypairChallengeResponseFunc,
-) error {
-	key, err := libsshutils.CryptoPublicKey([]byte(marshalledKey))
-	if err != nil {
-		return trace.Wrap(err, "parsing bound public key")
-	}
-
-	// The particular subject value doesn't strictly need to be the name of the
-	// bot or node (which may not be known, yet). Instead, we'll use the key ID,
-	// which could at least be useful for the client to know which key the
-	// challenge should be signed with.
-	keyID, err := jwt.KeyID(key)
-	if err != nil {
-		return trace.Wrap(err, "determining the key ID")
-	}
-
-	clusterName, err := a.GetClusterName(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	a.logger.DebugContext(ctx, "issuing bound keypair challenge", "key_id", keyID)
-
-	validator, err := a.createBoundKeypairValidator(keyID, clusterName.GetClusterName(), key)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	challenge, err := validator.IssueChallenge()
-	if err != nil {
-		return trace.Wrap(err, "generating a challenge document")
-	}
-
-	marshalledChallenge, err := json.Marshal(challenge)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	response, err := challengeResponse(&proto.RegisterUsingBoundKeypairMethodResponse{
-		Response: &proto.RegisterUsingBoundKeypairMethodResponse_Challenge{
-			Challenge: &proto.RegisterUsingBoundKeypairChallenge{
-				PublicKey: marshalledKey,
-				Challenge: string(marshalledChallenge),
-			},
-		},
-	})
-	if err != nil {
-		return trace.Wrap(err, "requesting a signed challenge")
-	}
-
-	solutionResponse, ok := response.Payload.(*proto.RegisterUsingBoundKeypairMethodRequest_ChallengeResponse)
-	if !ok {
-		return trace.BadParameter("client provided unexpected challenge response type %T", response.Payload)
-	}
-
-	if err := validator.ValidateChallengeResponse(
-		challenge,
-		string(solutionResponse.ChallengeResponse.Solution),
-	); err != nil {
-		// TODO: Consider access denied instead?
-		return trace.Wrap(err, "validating challenge response")
-	}
-
-	a.logger.InfoContext(ctx, "bound keypair challenge response verified successfully", "key_id", keyID)
-
-	return nil
-}
-
-// boundKeypairStatusMutator is a function called to mutate a bound keypair
-// status during a call to PatchProvisionToken(). These functions may be called
-// repeatedly if e.g. revision checks fail. To ensure invariants remain in
-// place, mutator functions may make assertions to ensure the provided backend
-// state is still sane before the update is committed.
-type boundKeypairStatusMutator func(*types.ProvisionTokenSpecV2BoundKeypair, *types.ProvisionTokenStatusV2BoundKeypair) error
-
-// mutateStatusConsumeJoin consumes a "hard" join on the backend, incrementing
-// the recovery counter. This verifies that the backend recovery count has not
-// changed, and that total join count is at least the value when the mutator was
-// created.
-func mutateStatusConsumeJoin(mode boundkeypair.RecoveryMode, expectRecoveryCount uint32, expectMinRecoveryLimit uint32) boundKeypairStatusMutator {
-	now := time.Now()
-
-	return func(spec *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
-		// Ensure we have the expected number of rejoins left to prevent going
-		// below zero.
-		if status.RecoveryCount != expectRecoveryCount {
-			return trace.AccessDenied("unexpected backend state")
-		}
-
-		// Ensure the allowed join count has at least not decreased, but allow
-		// for collision with potentially increased values.
-		if spec.Recovery.Limit < expectMinRecoveryLimit {
-			return trace.AccessDenied("unexpected backend state")
-		}
-
-		status.RecoveryCount += 1
-		status.LastRecoveredAt = &now
-
-		return nil
-	}
-}
-
-// mutateStatusBoundPublicKey is a mutator that updates the bound public key
-// value. It ensures the backend public key is still the expected value before
-// performing the update.
-func mutateStatusBoundPublicKey(newPublicKey, expectPreviousKey string) boundKeypairStatusMutator {
-	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
-		if status.BoundPublicKey != expectPreviousKey {
-			return trace.AccessDenied("unexpected backend state")
-		}
-
-		status.BoundPublicKey = newPublicKey
-
-		return nil
-	}
-}
-
-// mutateStatusBoundBotInstance updates the bot instance ID currently bound to
-// this token. It ensures the expected previous ID is still the bound value
-// before performing the update.
-func mutateStatusBoundBotInstance(newBotInstance, expectPreviousBotInstance string) boundKeypairStatusMutator {
-	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
-		if status.BoundBotInstanceID != expectPreviousBotInstance {
-			return trace.AccessDenied("unexpected backend state")
-		}
-
-		status.BoundBotInstanceID = newBotInstance
-
-		return nil
-	}
-}
-
-// RegisterUsingBoundKeypairMethod handles joining requests for the bound
-// keypair join method. If successful, returns
-func (a *Server) RegisterUsingBoundKeypairMethod(
-	ctx context.Context,
-	req *proto.RegisterUsingBoundKeypairInitialRequest,
-	challengeResponse client.RegisterUsingBoundKeypairChallengeResponseFunc,
-) (_ *client.BoundKeypairRegistrationResponse, err error) {
-	var provisionToken types.ProvisionToken
-	var joinFailureMetadata any
-	defer func() {
-		// Emit a log message and audit event on join failure.
-		if err != nil {
-			a.handleJoinFailure(
-				ctx, err, provisionToken, joinFailureMetadata, req.JoinRequest,
-			)
-		}
-	}()
-
-	// First, check the specified token exists, and is a bound keypair-type join
-	// token.
-	if err := req.JoinRequest.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Only bot joining is supported at the moment - unique ID verification is
-	// required and this is currently only implemented for bots.
-	if req.JoinRequest.Role != types.RoleBot {
-		return nil, trace.BadParameter("bound keypair joining is only supported for bots")
-	}
-
-	provisionToken, err = a.checkTokenJoinRequestCommon(ctx, req.JoinRequest)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	ptv2, ok := provisionToken.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", provisionToken)
-	}
-	if ptv2.Spec.JoinMethod != types.JoinMethodBoundKeypair {
-		return nil, trace.BadParameter("specified join token is not for `%s` method", types.JoinMethodBoundKeypair)
-	}
-
-	if ptv2.Status == nil {
-		ptv2.Status = &types.ProvisionTokenStatusV2{}
-	}
-	if ptv2.Status.BoundKeypair == nil {
-		ptv2.Status.BoundKeypair = &types.ProvisionTokenStatusV2BoundKeypair{}
-	}
-
-	clusterName, err := a.GetClusterName(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	spec := ptv2.Spec.BoundKeypair
-	status := ptv2.Status.BoundKeypair
-	hasBoundPublicKey := status.BoundPublicKey != ""
-	hasBoundBotInstance := status.BoundBotInstanceID != ""
-	hasIncomingBotInstance := req.JoinRequest.BotInstanceID != ""
-	hasJoinsRemaining := status.RecoveryCount < spec.Recovery.Limit
-
-	recoveryMode, err := boundkeypair.ParseRecoveryMode(spec.Recovery.Mode)
-	if err != nil {
-		return nil, trace.Wrap(err, "parsing recovery mode")
-	}
-
-	// Join state is required after the initial join (first recovery), so long
-	// as the mode is not insecure.
-	joinStateRequired := status.RecoveryCount > 0 && recoveryMode != boundkeypair.RecoveryModeInsecure
-	hasIncomingJoinState := len(req.PreviousJoinState) > 0
-
-	// if set, the bound bot instance will be updated in the backend
-	expectNewBotInstance := false
-
-	// the bound public key; may change during initial join or rotation. used to
-	// inform the returned public key value.
-	boundPublicKey := status.BoundPublicKey
-
-	// Mutators to use during the token resource status patch at the end.
-	var mutators []boundKeypairStatusMutator
-
-	// Get the join state JWT signer CA
-	ca, err := a.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.BoundKeypairCA,
-		DomainName: clusterName.GetClusterName(),
-	}, /* loadKeys */ true)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var joinState *boundkeypair.JoinState
-	if joinStateRequired {
-		// If join state is required but missing, raise an error.
-		if !hasIncomingJoinState {
-			return nil, trace.AccessDenied("previous join state is required but was not provided")
-		}
-
-		a.logger.DebugContext(ctx, "join state verification required, verifying")
-		joinState, err = boundkeypair.VerifyJoinState(
-			ca,
-			string(req.PreviousJoinState),
-			&boundkeypair.JoinStateParams{
-				Clock:       a.clock,
-				ClusterName: clusterName.GetClusterName(),
-				Token:       ptv2,
-			},
-		)
-		if err != nil {
-			// TODO: Once we have token-specific locking, generate a lock; this
-			// indicates the keypair may have been compromised.
-			// TODO: Audit log event for this.
-			a.logger.ErrorContext(ctx, "bound keypair join state verification failed", "error", err)
-			return nil, trace.AccessDenied("join state verification failed")
-		}
-
-		// Now that we've verified it, make sure the previous bot instance ID is
-		// passed along to generateCerts. This will only be used if a new bot
-		// instance is generated.
-		req.JoinRequest.PreviousBotInstanceID = joinState.BotInstanceID
-
-		a.logger.DebugContext(ctx, "join state verified successfully", "join_state", joinState)
-
-		// Note: we don't verify join state if it isn't expected. This is partly
-		// to ensure server-side recovery will work if join state desyncs - a
-		// cluster admin can change the recovery mode to insecure or reset the
-		// recovery counter to zero and start over with a fresh join state, with
-		// no client intervention.
-	}
-
-	switch {
-	case !hasBoundPublicKey && !hasIncomingBotInstance:
-		// Normal initial join attempt. No bound key, and no incoming bot
-		// instance. Consumes a recovery attempt.
-		if spec.Onboarding.RegistrationSecret != "" {
-			return nil, trace.NotImplemented("initial joining secrets are not yet supported")
-		}
-
-		if spec.Onboarding.InitialPublicKey == "" {
-			return nil, trace.BadParameter("an initial public key is required")
-		}
-
-		if recoveryMode == boundkeypair.RecoveryModeStandard && !hasJoinsRemaining {
-			return nil, trace.AccessDenied("no recovery attempts remaining")
-		}
-
-		if err := a.issueBoundKeypairChallenge(
-			ctx,
-			spec.Onboarding.InitialPublicKey,
-			challengeResponse,
-		); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		// Now that we've confirmed the key, we can consider it bound.
-		mutators = append(
-			mutators,
-			mutateStatusBoundPublicKey(spec.Onboarding.InitialPublicKey, ""),
-			mutateStatusConsumeJoin(recoveryMode, status.RecoveryCount, spec.Recovery.Limit),
-		)
-
-		expectNewBotInstance = true
-		boundPublicKey = spec.Onboarding.InitialPublicKey
-	case !hasBoundPublicKey && hasIncomingBotInstance:
-		// Not allowed, at least at the moment. This would imply e.g. trying to
-		// change auth methods.
-		return nil, trace.BadParameter("cannot perform first bound keypair join with existing credentials")
-	case hasBoundPublicKey && !hasBoundBotInstance:
-		// TODO: Bad backend state, or maybe an incomplete previous join
-		// attempt. This shouldn't be a possible state, but we should handle it
-		// sanely anyway.
-		return nil, trace.BadParameter("bad backend state, please recreate the join token")
-	case hasBoundPublicKey && hasBoundBotInstance && hasIncomingBotInstance:
-		// Standard rejoin case, does not consume a rejoin.
-		if status.BoundBotInstanceID != req.JoinRequest.BotInstanceID {
-			return nil, trace.AccessDenied("bot instance mismatch")
-		}
-
-		if err := a.issueBoundKeypairChallenge(
-			ctx,
-			spec.Onboarding.InitialPublicKey,
-			challengeResponse,
-		); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		// Nothing else to do, no key change
-	case hasBoundPublicKey && hasBoundBotInstance && !hasIncomingBotInstance:
-		// Hard rejoin case, the client identity expired and a new bot instance
-		// is required. Consumes a rejoin.
-		if recoveryMode == boundkeypair.RecoveryModeStandard && !hasJoinsRemaining {
-			// Recovery limit only applies in "standard" mode.
-			return nil, trace.AccessDenied("no rejoins remaining")
-		}
-
-		if err := a.issueBoundKeypairChallenge(
-			ctx,
-			status.BoundPublicKey,
-			challengeResponse,
-		); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		mutators = append(
-			mutators,
-			mutateStatusConsumeJoin(recoveryMode, status.RecoveryCount, spec.Recovery.Limit),
-		)
-
-		expectNewBotInstance = true
-	default:
-		a.logger.ErrorContext(
-			ctx, "unexpected state",
-			"has_bound_public_key", hasBoundPublicKey,
-			"has_bound_bot_instance", hasBoundBotInstance,
-			"has_incoming_bot_instance", hasIncomingBotInstance,
-			"spec", spec,
-			"status", status,
-		)
-		return nil, trace.BadParameter("unexpected state")
-	}
-
-	if spec.RotateAfter != nil {
-		// TODO, to be implemented in a future PR. `boundPublicKey` will need to
-		// be updated.
-		return nil, trace.NotImplemented("key rotation not yet supported")
-	}
-
-	certs, botInstanceID, err := a.generateCertsBot(
-		ctx,
-		ptv2,
-		req.JoinRequest,
-		nil, // TODO: extended claims for this type?
-		nil, // TODO: workload id claims
-	)
-
-	if expectNewBotInstance {
-		mutators = append(
-			mutators,
-			mutateStatusBoundBotInstance(botInstanceID, status.BoundBotInstanceID),
-		)
-	}
-
-	// A reference to the final provision token state; may be modified below via
-	// mutators.
-	finalToken := ptv2
-
-	if len(mutators) > 0 {
-		patched, err := a.PatchToken(ctx, ptv2.GetName(), func(token types.ProvisionToken) (types.ProvisionToken, error) {
-			ptv2, ok := provisionToken.(*types.ProvisionTokenV2)
-			if !ok {
-				return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", provisionToken)
-			}
-
-			// Apply all mutators. Individual mutators may make additional
-			// assertions to ensure invariants haven't changed.
-			for _, mutator := range mutators {
-				if err := mutator(ptv2.Spec.BoundKeypair, ptv2.Status.BoundKeypair); err != nil {
-					return nil, trace.Wrap(err, "applying status mutator")
-				}
-			}
-
-			return ptv2, nil
-		})
-		if err != nil {
-			return nil, trace.Wrap(err, "committing updated token state, please try again")
-		}
-
-		finalToken, ok = patched.(*types.ProvisionTokenV2)
-		if !ok {
-			// This should be impossible, but if it did fail, we can't generate
-			// a join state without an accurate token. The certs we just
-			// generated will be useless, so just return an error.
-			return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", provisionToken)
-		}
-	}
-
-	signer, err := a.GetKeyStore().GetJWTSigner(ctx, ca)
-	if err != nil {
-		return nil, trace.Wrap(err, "issuing join state document")
-	}
-
-	newJoinState, err := boundkeypair.IssueJoinState(signer, &boundkeypair.JoinStateParams{
-		Clock:       a.clock,
-		ClusterName: clusterName.GetClusterName(),
-		Token:       finalToken,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "issuing join state document")
-	}
-
-	return &client.BoundKeypairRegistrationResponse{
-		Certs:          certs,
-		BoundPublicKey: boundPublicKey,
-		JoinState:      []byte(newJoinState),
-	}, nil
-}
diff --git a/lib/auth/join_bound_keypair_adapter.go b/lib/auth/join_bound_keypair_adapter.go
new file mode 100644
index 0000000000000..dce5da8b59082
--- /dev/null
+++ b/lib/auth/join_bound_keypair_adapter.go
@@ -0,0 +1,38 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package auth
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/lib/join"
+)
+
+// RegisterUsingBoundKeypairMethod handles bound keypair joining for the legacy
+// join service and accepts the legacy protobuf message types. It calls into
+// the common logic implemented in lib/join.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
+func (a *Server) RegisterUsingBoundKeypairMethod(
+	ctx context.Context,
+	req *proto.RegisterUsingBoundKeypairInitialRequest,
+	challengeResponse client.RegisterUsingBoundKeypairChallengeResponseFunc,
+) (*client.BoundKeypairRegistrationResponse, error) {
+	return join.AdaptRegisterUsingBoundKeypairMethod(ctx, a, a.createBoundKeypairValidator, req, challengeResponse)
+}
diff --git a/lib/auth/join_bound_keypair_test.go b/lib/auth/join_bound_keypair_test.go
index 0f641af61742c..7ae8f08257f81 100644
--- a/lib/auth/join_bound_keypair_test.go
+++ b/lib/auth/join_bound_keypair_test.go
@@ -16,16 +16,20 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
 	"crypto"
+	"crypto/tls"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client"
@@ -33,10 +37,13 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/boundkeypair"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	joinboundkeypair "github.com/gravitational/teleport/lib/join/boundkeypair"
 	"github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/tlsca"
 )
 
 type mockBoundKeypairValidator struct {
@@ -92,26 +99,35 @@ func parseJoinState(t *testing.T, state []byte) *boundkeypair.JoinState {
 	return &doc
 }
 
+// TODO(nklaassen): DELETE IN 20 when the legacy join service is removed, this
+// test is superceded by lib/join.TestJoinBoundKeypair which exercises the new
+// join service.
 func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
+	t.Parallel()
+
 	ctx := context.Background()
 
 	_, correctPublicKey := testBoundKeypair(t)
+	_, rotatedPublicKey := testBoundKeypair(t)
 	_, incorrectPublicKey := testBoundKeypair(t)
 
-	srv := newTestTLSServer(t)
-	auth := srv.Auth()
-	auth.createBoundKeypairValidator = func(subject, clusterName string, publicKey crypto.PublicKey) (boundKeypairValidator, error) {
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+	startTime := clock.Now()
+
+	srv := newTestTLSServer(t, withClock(clock))
+	authServer := srv.Auth()
+	authServer.SetCreateBoundKeypairValidator(func(subject, clusterName string, publicKey crypto.PublicKey) (joinboundkeypair.BoundKeypairValidator, error) {
 		return &mockBoundKeypairValidator{
 			subject:     subject,
 			clusterName: clusterName,
 			publicKey:   publicKey,
 		}, nil
-	}
+	})
 
-	_, err := CreateRole(ctx, auth, "example", types.RoleSpecV6{})
+	_, err := authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	adminClient, err := srv.NewClient(TestAdmin())
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
@@ -130,16 +146,16 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 
-	jwtCA, err := auth.GetCertAuthority(ctx, types.CertAuthID{
+	jwtCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.BoundKeypairCA,
 		DomainName: srv.ClusterName(),
 	}, /* loadKeys */ true)
 	require.NoError(t, err)
 
-	jwtSigner, err := auth.GetKeyStore().GetJWTSigner(ctx, jwtCA)
+	jwtSigner, err := authServer.GetKeyStore().GetJWTSigner(ctx, jwtCA)
 	require.NoError(t, err)
 
 	// An invalid signer for signing "fake" JWTs.
@@ -152,11 +168,8 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 				Roles:      []types.SystemRole{types.RoleBot},
 				BotName:    "test",
 				BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
-					Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
-						InitialPublicKey: correctPublicKey,
-					},
+					Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{},
 					Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
-						// Only insecure is supported for now.
 						Mode: boundkeypair.RecoveryModeInsecure,
 					},
 				},
@@ -180,6 +193,18 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		}
 	}
 
+	withInitialKey := func(key string) func(*types.ProvisionTokenV2) {
+		return func(v2 *types.ProvisionTokenV2) {
+			v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = key
+		}
+	}
+
+	withBoundKey := func(key string) func(*types.ProvisionTokenV2) {
+		return func(v2 *types.ProvisionTokenV2) {
+			v2.Status.BoundKeypair.BoundPublicKey = key
+		}
+	}
+
 	makeJoinState := func(signer crypto.Signer, mutators ...func(s *boundkeypair.JoinStateParams)) string {
 		params := &boundkeypair.JoinStateParams{
 			Clock:       srv.Clock(),
@@ -225,20 +250,57 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		}
 	}
 
-	makeSolver := func(publicKey string) client.RegisterUsingBoundKeypairChallengeResponseFunc {
-		return func(challenge *proto.RegisterUsingBoundKeypairMethodResponse) (*proto.RegisterUsingBoundKeypairMethodRequest, error) {
+	type wrappedSolver struct {
+		rotatedPubKey string
+
+		rotationCount  uint32
+		challengeCount uint32
+		solutions      []string
+
+		wrapped client.RegisterUsingBoundKeypairChallengeResponseFunc
+	}
+
+	makeSolver := func(initialPubKey string, mutators ...func(s *wrappedSolver)) *wrappedSolver {
+		wrapper := &wrappedSolver{
+			solutions: []string{},
+		}
+		for _, mutator := range mutators {
+			mutator(wrapper)
+		}
+
+		wrapper.wrapped = func(challenge *proto.RegisterUsingBoundKeypairMethodResponse) (*proto.RegisterUsingBoundKeypairMethodRequest, error) {
 			switch r := challenge.Response.(type) {
 			case *proto.RegisterUsingBoundKeypairMethodResponse_Challenge:
-				if r.Challenge.PublicKey != publicKey {
+				wrapper.challengeCount++
+
+				switch r.Challenge.PublicKey {
+				case initialPubKey:
+				case wrapper.rotatedPubKey:
+				default:
 					return nil, trace.BadParameter("wrong public key")
 				}
 
+				wrapper.solutions = append(wrapper.solutions, r.Challenge.PublicKey)
+
 				return &proto.RegisterUsingBoundKeypairMethodRequest{
 					Payload: &proto.RegisterUsingBoundKeypairMethodRequest_ChallengeResponse{
 						ChallengeResponse: &proto.RegisterUsingBoundKeypairChallengeResponse{
 							// For testing purposes, we'll just reply with the
 							// public key, to avoid needing to parse the JWT.
-							Solution: []byte(publicKey),
+							Solution: []byte(r.Challenge.PublicKey),
+						},
+					},
+				}, nil
+			case *proto.RegisterUsingBoundKeypairMethodResponse_Rotation:
+				wrapper.rotationCount++
+				if wrapper.rotatedPubKey == "" {
+					return nil, trace.BadParameter("can't generate key")
+				}
+
+				return &proto.RegisterUsingBoundKeypairMethodRequest{
+					Payload: &proto.RegisterUsingBoundKeypairMethodRequest_RotationResponse{
+						RotationResponse: &proto.RegisterUsingBoundKeypairRotationResponse{
+							PublicKey: wrapper.rotatedPubKey,
 						},
 					},
 				}, nil
@@ -246,29 +308,42 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 				return nil, trace.BadParameter("invalid response type")
 			}
 		}
+
+		return wrapper
+	}
+
+	withRotatedPubKey := func(pubKey string) func(s *wrappedSolver) {
+		return func(s *wrappedSolver) {
+			s.rotatedPubKey = pubKey
+		}
 	}
 
+	// Advance the clock a bit. Tests may reference `startTime` for a past
+	// reference point.
+	clock.Advance(time.Hour)
+
 	tests := []struct {
 		name string
 
 		token   types.ProvisionTokenV2
 		initReq *proto.RegisterUsingBoundKeypairInitialRequest
-		solver  client.RegisterUsingBoundKeypairChallengeResponseFunc
+		solver  *wrappedSolver
 
-		assertError   require.ErrorAssertionFunc
-		assertSuccess func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse)
+		assertError       require.ErrorAssertionFunc
+		assertResponse    func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse)
+		assertSolverState func(t *testing.T, s *wrappedSolver)
 	}{
 		{
-			// no bound key, no bound bot instance, aka initial join without
-			// secret
+			// an initial key but no bound key, and no bound bot instance. aka,
+			// initial join with preregistered key
 			name: "initial-join-success",
 
-			token:   makeToken(),
+			token:   makeToken(withInitialKey(correctPublicKey)),
 			initReq: makeInitReq(),
 			solver:  makeSolver(correctPublicKey),
 
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
 				// join count should be incremented
 				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
 				require.NotEmpty(t, v2.Status.BoundKeypair.BoundBotInstanceID)
@@ -280,21 +355,20 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 			// secret
 			name: "initial-join-with-wrong-key",
 
-			token:   makeToken(),
+			token:   makeToken(withInitialKey(correctPublicKey)),
 			initReq: makeInitReq(),
 			solver:  makeSolver(incorrectPublicKey),
 
 			assertError: func(tt require.TestingT, err error, i ...interface{}) {
 				require.Error(tt, err)
-				require.ErrorContains(tt, err, "wrong public key")
+				require.ErrorContains(tt, err, "failed to complete challenge")
 			},
 		},
 		{
 			// bound key, valid bound bot instance, aka "soft join"
 			name: "reauth-success",
 
-			token: makeToken(func(v2 *types.ProvisionTokenV2) {
-				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+			token: makeToken(withBoundKey(correctPublicKey), func(v2 *types.ProvisionTokenV2) {
 				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
 			}),
 			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
@@ -303,7 +377,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 			solver: makeSolver(correctPublicKey),
 
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
 				// join count should not be incremented
 				require.Equal(t, uint32(0), v2.Status.BoundKeypair.RecoveryCount)
 			},
@@ -313,8 +387,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 			// (should be impossible, but should fail anyway)
 			name: "reauth-with-wrong-key",
 
-			token: makeToken(func(v2 *types.ProvisionTokenV2) {
-				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+			token: makeToken(withBoundKey(correctPublicKey), func(v2 *types.ProvisionTokenV2) {
 				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
 			}),
 			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
@@ -332,15 +405,14 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 			// expired and triggered a hard rejoin
 			name: "rejoin-success",
 
-			token: makeToken(func(v2 *types.ProvisionTokenV2) {
-				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+			token: makeToken(withBoundKey(correctPublicKey), func(v2 *types.ProvisionTokenV2) {
 				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
 			}),
 			initReq: makeInitReq(),
 			solver:  makeSolver(correctPublicKey),
 
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *client.BoundKeypairRegistrationResponse) {
 				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
 
 				// Should generate a new bot instance
@@ -353,9 +425,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 			// This should fail and prompt the user to recreate the token.
 			name: "bound-key-no-instance",
 
-			token: makeToken(func(v2 *types.ProvisionTokenV2) {
-				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
-			}),
+			token:   makeToken(withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(),
 			solver:  makeSolver(correctPublicKey),
 
@@ -383,32 +453,13 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 				require.ErrorContains(tt, err, "bot instance mismatch")
 			},
 		},
-		{
-			// TODO: rotation is not yet implemented.
-			name: "rotation-requested",
-
-			token: makeToken(func(v2 *types.ProvisionTokenV2) {
-				t := time.Now()
-				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
-				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
-				v2.Spec.BoundKeypair.RotateAfter = &t
-				// TODO: test clock?
-			}),
-			initReq: makeInitReq(),
-			solver:  makeSolver(correctPublicKey),
-
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.Error(tt, err)
-				require.ErrorContains(tt, err, "key rotation not yet supported")
-			},
-		},
 		{
 			name:        "standard-initial-recovery-success",
-			token:       makeToken(withRecovery("standard", 0, 1, "")),
+			token:       makeToken(withRecovery("standard", 0, 1, ""), withInitialKey(correctPublicKey)),
 			initReq:     makeInitReq(),
 			solver:      makeSolver(correctPublicKey),
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
 				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
 
 				require.NotNil(t, res)
@@ -417,11 +468,11 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:        "standard-success-second-recovery",
-			token:       makeToken(withRecovery("standard", 1, 2, "id")),
+			token:       makeToken(withRecovery("standard", 1, 2, "id"), withInitialKey(correctPublicKey)),
 			initReq:     makeInitReq(withJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id")))),
 			solver:      makeSolver(correctPublicKey),
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
 				require.Equal(t, uint32(2), v2.Status.BoundKeypair.RecoveryCount)
 				require.NotNil(t, res)
 				state := parseJoinState(t, res.JoinState)
@@ -430,11 +481,11 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:    "standard-failure-missing-join-state",
-			token:   makeToken(withRecovery("standard", 1, 2, "id")),
+			token:   makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(),
 			solver:  makeSolver(correctPublicKey),
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(tt, err, "previous join state is required")
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
 			},
 		},
 		{
@@ -449,7 +500,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		{
 			// Attempts to join with an outdated join state document should fail.
 			name:    "standard-failure-recovery-count-mismatch",
-			token:   makeToken(withRecovery("standard", 2, 3, "id")),
+			token:   makeToken(withRecovery("standard", 2, 3, "id"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(withJoinState(jwtSigner, withToken(withRecovery("standard", 1, 3, "id")))),
 			solver:  makeSolver(correctPublicKey),
 			assertError: func(tt require.TestingT, err error, i ...interface{}) {
@@ -458,7 +509,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:  "standard-failure-invalid-jwt",
-			token: makeToken(withRecovery("standard", 1, 2, "id")),
+			token: makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
 				r.PreviousJoinState = []byte("asdf")
 			}),
@@ -469,7 +520,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:    "standard-failure-invalid-jwt-signature",
-			token:   makeToken(withRecovery("standard", 1, 2, "id")),
+			token:   makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(withJoinState(invalidJWTSigner, withToken(withRecovery("standard", 1, 2, "id")))),
 			solver:  makeSolver(correctPublicKey),
 			assertError: func(tt require.TestingT, err error, i ...interface{}) {
@@ -478,7 +529,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:    "standard-failure-invalid-instance-id",
-			token:   makeToken(withRecovery("standard", 1, 2, "foo")),
+			token:   makeToken(withRecovery("standard", 1, 2, "foo"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(withJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id")))),
 			solver:  makeSolver(correctPublicKey),
 			assertError: func(tt require.TestingT, err error, i ...interface{}) {
@@ -487,7 +538,7 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:  "standard-failure-invalid-cluster",
-			token: makeToken(withRecovery("standard", 1, 2, "foo")),
+			token: makeToken(withRecovery("standard", 1, 2, "foo"), withBoundKey(correctPublicKey)),
 			initReq: makeInitReq(withJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id")), func(s *boundkeypair.JoinStateParams) {
 				s.ClusterName = "wrong-cluster"
 			})),
@@ -498,11 +549,11 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 		},
 		{
 			name:        "relaxed-success-count-over-limit",
-			token:       makeToken(withRecovery("relaxed", 1, 0, "id")),
+			token:       makeToken(withRecovery("relaxed", 1, 0, "id"), withBoundKey(correctPublicKey)),
 			initReq:     makeInitReq(withJoinState(jwtSigner, withToken(withRecovery("relaxed", 1, 0, "id")))),
 			solver:      makeSolver(correctPublicKey),
 			assertError: require.NoError,
-			assertSuccess: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
 				require.Equal(t, uint32(2), v2.Status.BoundKeypair.RecoveryCount)
 
 				require.NotNil(t, res)
@@ -512,28 +563,1038 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 				require.Equal(t, v2.Status.BoundKeypair.RecoveryCount, state.RecoverySequence)
 			},
 		},
+		{
+			// Initial rotation, i.e. `LastRotatedAt` isn't set. This should
+			// trigger as soon as the `RotateAfter` threshold has been crossed.
+			name: "first-rotation-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey, withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, rotatedPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, rotatedPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey, rotatedPublicKey}, s.solutions)
+			},
+		},
+		{
+			// Initial rotation timestamp hasn't been reached
+			name: "first-rotation-skipped",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				rotateAfter := clock.Now().Add(time.Minute)
+				v2.Spec.BoundKeypair.RotateAfter = &rotateAfter
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey, withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutions)
+			},
+		},
+		{
+			// This should only trigger after `RotateAfter` has been crossed and
+			// `LastRotatedAt` isn't after it.
+			name: "second-rotation-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				rotateAfter := startTime.Add(10 * time.Minute)
+				v2.Spec.BoundKeypair.RotateAfter = &rotateAfter
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+				v2.Status.BoundKeypair.LastRotatedAt = &startTime
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey, withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, rotatedPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, rotatedPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey, rotatedPublicKey}, s.solutions)
+			},
+		},
+		{
+			// We shouldn't try to rotate again if LastRotatedAt is greater than
+			// RotateAfter.
+			name: "second-rotation-skipped",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+
+				rotatedAt := startTime.Add(10 * time.Minute)
+				v2.Status.BoundKeypair.LastRotatedAt = &rotatedAt
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey, withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutions)
+			},
+		},
+		{
+			// If the client doesn't complete rotation, an error should be
+			// returned and the key should not change on the server.
+			name: "rotation-failure",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey),
+
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(tt, err, "requesting a new public key")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "rotation-same-key-not-allowed",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			initReq: makeInitReq(),
+			solver:  makeSolver(correctPublicKey, withRotatedPubKey(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(tt, err, "public key may not be reused after rotation")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+
+				// note: the client does complete the challenge for the
+				// duplicate key, but the attempt will ultimately be rejected
+				require.Equal(t, []string{correctPublicKey, correctPublicKey}, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "registration-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+			}),
+			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				// note that we'll need to specify a secret here since there's
+				// not a good way to plumb the auto-generated secret back to the
+				// test.
+				r.InitialJoinSecret = "secret"
+			}),
+			solver: makeSolver("", withRotatedPubKey(correctPublicKey)),
+
+			assertError: require.NoError,
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+
+				// we'll only be asked for one challenge
+				require.Equal(t, []string{correctPublicKey}, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+		},
+		{
+			name: "registration-failure-wrong-secret",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+			}),
+			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				r.InitialJoinSecret = "asdf"
+			}),
+			solver: makeSolver("", withRotatedPubKey(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(t, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Empty(t, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			// in this case, the server will generate a registration secret
+			// automatically since nothing was set in .Onboarding. we won't know
+			// it in the test, but will know it tried to check the provided
+			// secret due to the error message.
+			name: "registration-failure-wrong-secret-autogenerated",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = ""
+			}),
+			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				r.InitialJoinSecret = "asdf"
+			}),
+			solver: makeSolver(""),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{}, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			// Joining with the a secret when a key was expected should be
+			// handled as if the client couldn't complete the challenge (which
+			// it can't)
+			name: "registration-failure-expected-key",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = correctPublicKey
+			}),
+			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				r.InitialJoinSecret = "asdf"
+			}),
+			solver: makeSolver("", withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "failed to complete challenge")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{}, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "registration-failure-secret-expired",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+				v2.Spec.BoundKeypair.Onboarding.MustRegisterBefore = &startTime
+			}),
+			initReq: makeInitReq(func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				r.InitialJoinSecret = "secret"
+			}),
+			solver: makeSolver("", withRotatedPubKey(rotatedPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *wrappedSolver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Empty(t, s.solutions)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *client.BoundKeypairRegistrationResponse) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			token, err := types.NewProvisionTokenFromSpecAndStatus(
-				tt.name, time.Now().Add(time.Minute), tt.token.Spec, tt.token.Status,
+				tt.name, time.Now().Add(2*time.Hour), tt.token.Spec, tt.token.Status,
 			)
 			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
+
+			// note: we only override CreateToken in ServerWithRoles, so we'll
+			// need to call CreateBoundKeypairToken() directly to ensure
+			// computed fields (i.e. registration secrets) are handled properly.
+			require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
 			tt.initReq.JoinRequest.Token = tt.name
 
-			response, err := auth.RegisterUsingBoundKeypairMethod(ctx, tt.initReq, tt.solver)
+			response, err := authServer.RegisterUsingBoundKeypairMethod(ctx, tt.initReq, tt.solver.wrapped)
 			tt.assertError(t, err)
 
-			if tt.assertSuccess != nil {
-				pt, err := auth.GetToken(ctx, tt.name)
+			if tt.assertResponse != nil {
+				pt, err := authServer.GetToken(ctx, tt.name)
 				require.NoError(t, err)
 
 				ptv2, ok := pt.(*types.ProvisionTokenV2)
 				require.True(t, ok)
 
-				tt.assertSuccess(t, ptv2, response)
+				tt.assertResponse(t, ptv2, response)
+			}
+
+			if tt.assertSolverState != nil {
+				tt.assertSolverState(t, tt.solver)
+			}
+		})
+	}
+}
+
+type mockSolver struct {
+	publicKey string
+}
+
+func (m *mockSolver) solver() client.RegisterUsingBoundKeypairChallengeResponseFunc {
+	return func(challenge *proto.RegisterUsingBoundKeypairMethodResponse) (*proto.RegisterUsingBoundKeypairMethodRequest, error) {
+		switch r := challenge.Response.(type) {
+		case *proto.RegisterUsingBoundKeypairMethodResponse_Rotation:
+			return &proto.RegisterUsingBoundKeypairMethodRequest{
+				Payload: &proto.RegisterUsingBoundKeypairMethodRequest_RotationResponse{
+					RotationResponse: &proto.RegisterUsingBoundKeypairRotationResponse{
+						PublicKey: m.publicKey,
+					},
+				},
+			}, nil
+		case *proto.RegisterUsingBoundKeypairMethodResponse_Challenge:
+			return &proto.RegisterUsingBoundKeypairMethodRequest{
+				Payload: &proto.RegisterUsingBoundKeypairMethodRequest_ChallengeResponse{
+					ChallengeResponse: &proto.RegisterUsingBoundKeypairChallengeResponse{
+						// For testing purposes, we'll just reply with the
+						// public key, to avoid needing to parse the JWT.
+						Solution: []byte(r.Challenge.PublicKey),
+					},
+				},
+			}, nil
+		default:
+			return nil, trace.BadParameter("not supported")
+
+		}
+	}
+}
+
+func newMockSolver(t *testing.T, pubKey string) *mockSolver {
+	t.Helper()
+
+	return &mockSolver{
+		publicKey: pubKey,
+	}
+}
+
+type tHelper interface {
+	Helper()
+}
+
+func testExtractBotParamsFromCerts(t require.TestingT, certs *proto.Certs) (string, uint64) {
+	// we might not have .Helper() available for require.CollectT
+	if h, ok := t.(tHelper); ok {
+		h.Helper()
+	}
+
+	parsed, err := tlsca.ParseCertificatePEM(certs.TLS)
+	require.NoError(t, err)
+	ident, err := tlsca.FromSubject(parsed.Subject, parsed.NotAfter)
+	require.NoError(t, err)
+
+	return ident.BotInstanceID, ident.Generation
+}
+
+// TODO(nklaassen): DELETE IN 20 when the legacy join service is removed, this
+// test is superceded by lib/join.TestJoinBoundKeypair_GenerationCounter which
+// exercises the new join service.
+func TestServer_RegisterUsingBoundKeypairMethod_GenerationCounter(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+
+	_, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, withClock(clock))
+	authServer := srv.Auth()
+	authServer.SetCreateBoundKeypairValidator(func(subject, clusterName string, publicKey crypto.PublicKey) (joinboundkeypair.BoundKeypairValidator, error) {
+		return &mockBoundKeypairValidator{
+			subject:     subject,
+			clusterName: clusterName,
+			publicKey:   publicKey,
+		}, nil
+	})
+
+	_, err = authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 2,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	makeInitReq := func(mutators ...func(r *proto.RegisterUsingBoundKeypairInitialRequest)) *proto.RegisterUsingBoundKeypairInitialRequest {
+		req := &proto.RegisterUsingBoundKeypairInitialRequest{
+			JoinRequest: &types.RegisterUsingTokenRequest{
+				HostID:       "host-id",
+				Role:         types.RoleBot,
+				PublicTLSKey: tlsPublicKey,
+				PublicSSHKey: sshPublicKey,
+				Token:        "bound-keypair-test",
+			},
+		}
+		for _, mutator := range mutators {
+			mutator(req)
+		}
+		return req
+	}
+
+	withJoinState := func(state []byte) func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+		return func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+			r.PreviousJoinState = state
+		}
+	}
+
+	withBotParamsFromIdent := func(t require.TestingT, certs *proto.Certs) func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+		id, gen := testExtractBotParamsFromCerts(t, certs)
+
+		return func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+			r.JoinRequest.BotInstanceID = id
+			r.JoinRequest.BotGeneration = int32(gen)
+		}
+	}
+
+	solver := newMockSolver(t, correctPublicKey)
+	response, err := authServer.RegisterUsingBoundKeypairMethod(ctx, makeInitReq(), solver.solver())
+	require.NoError(t, err)
+
+	instance, generation := testExtractBotParamsFromCerts(t, response.Certs)
+	require.Equal(t, uint64(1), generation)
+
+	firstInstance := instance
+
+	// Register several times.
+	for i := range 10 {
+		response, err = authServer.RegisterUsingBoundKeypairMethod(
+			ctx,
+			makeInitReq(withJoinState(response.JoinState), withBotParamsFromIdent(t, response.Certs)),
+			solver.solver(),
+		)
+		require.NoError(t, err)
+
+		instance, generation := testExtractBotParamsFromCerts(t, response.Certs)
+		require.Equal(t, uint64(i+2), generation)
+		require.Equal(t, firstInstance, instance)
+	}
+
+	// Perform a recovery to get a new instance and reset the counter.
+	response, err = authServer.RegisterUsingBoundKeypairMethod(ctx, makeInitReq(withJoinState(response.JoinState)), solver.solver())
+	require.NoError(t, err)
+
+	instance, generation = testExtractBotParamsFromCerts(t, response.Certs)
+	require.Equal(t, uint64(1), generation, "generation counter should reset")
+	require.NotEqual(t, instance, firstInstance)
+
+	secondInstance := instance
+
+	// Register several more times.
+	for i := range 10 {
+		response, err = authServer.RegisterUsingBoundKeypairMethod(
+			ctx,
+			makeInitReq(withJoinState(response.JoinState), withBotParamsFromIdent(t, response.Certs)),
+			solver.solver(),
+		)
+		require.NoError(t, err)
+
+		instance, generation := testExtractBotParamsFromCerts(t, response.Certs)
+		require.Equal(t, uint64(i+2), generation)
+		require.Equal(t, secondInstance, instance)
+	}
+
+	// Try an API call with these certs.
+	tlsCert, err := tls.X509KeyPair(response.Certs.TLS, sshPrivateKey)
+	require.NoError(t, err)
+
+	client, err := srv.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
+
+	_, err = client.Ping(ctx)
+	require.NoError(t, err)
+
+	// Provide an incorrect generation counter value.
+	nextResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+		ctx,
+		makeInitReq(
+			withJoinState(response.JoinState),
+			withBotParamsFromIdent(t, response.Certs),
+			func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+				r.JoinRequest.BotGeneration = 1
+			},
+		),
+		solver.solver(),
+	)
+	require.Nil(t, nextResponse)
+
+	// Note: exact error message depends on lock enforcement which may take some
+	// time, especially in CI. We'll check the exact message later.
+	require.Error(t, err)
+
+	// The token should now be locked.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: "bound-keypair-test",
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "only one lock should be generated")
+	require.Contains(t, locks[0].Message(), "certificate generation mismatch")
+
+	// Using the previously working client, make sure API calls no longer work.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err = client.Ping(ctx)
+		assert.ErrorContains(t, err, "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Try registering again now that we know the lock is properly in force.
+	// This should produce a new error message.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		nextResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+			ctx,
+			makeInitReq(
+				withJoinState(response.JoinState),
+				withBotParamsFromIdent(t, response.Certs),
+				func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+					r.JoinRequest.BotGeneration = 1
+				},
+			),
+			solver.solver(),
+		)
+		require.Nil(t, nextResponse)
+		require.ErrorContains(t, err, "have been locked due to a certificate generation mismatch")
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+// TODO(nklaassen): DELETE IN 20 when the legacy join service is removed, this
+// test is superceded by lib/join.TestJoinBoundKeypair_JoinStateFailure which
+// exercises the new join service.
+func TestServer_RegisterUsingBoundKeypairMethod_JoinStateFailure(t *testing.T) {
+	// This tests that join state verification will trigger a lock if the
+	// original client and a secondary client both attempt to recover in
+	// sequence.
+	t.Parallel()
+
+	ctx := context.Background()
+
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+
+	_, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, withClock(clock))
+	authServer := srv.Auth()
+	authServer.SetCreateBoundKeypairValidator(func(subject, clusterName string, publicKey crypto.PublicKey) (joinboundkeypair.BoundKeypairValidator, error) {
+		return &mockBoundKeypairValidator{
+			subject:     subject,
+			clusterName: clusterName,
+			publicKey:   publicKey,
+		}, nil
+	})
+
+	_, err = authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 3,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	makeInitReq := func(mutators ...func(r *proto.RegisterUsingBoundKeypairInitialRequest)) *proto.RegisterUsingBoundKeypairInitialRequest {
+		req := &proto.RegisterUsingBoundKeypairInitialRequest{
+			JoinRequest: &types.RegisterUsingTokenRequest{
+				HostID:       "host-id",
+				Role:         types.RoleBot,
+				PublicTLSKey: tlsPublicKey,
+				PublicSSHKey: sshPublicKey,
+				Token:        "bound-keypair-test",
+			},
+		}
+		for _, mutator := range mutators {
+			mutator(req)
+		}
+		return req
+	}
+
+	withJoinState := func(state []byte) func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+		return func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+			r.PreviousJoinState = state
+		}
+	}
+
+	// Perform the initial registration.
+	solver := newMockSolver(t, correctPublicKey)
+	firstResponse, err := authServer.RegisterUsingBoundKeypairMethod(ctx, makeInitReq(), solver.solver())
+	require.NoError(t, err)
+
+	// Perform a recovery, this time with a join state.
+	secondResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+		ctx,
+		makeInitReq(withJoinState(firstResponse.JoinState)),
+		solver.solver(),
+	)
+	require.NotNil(t, secondResponse)
+	require.NoError(t, err)
+
+	// Try an API call with these certs.
+	tlsCert, err := tls.X509KeyPair(secondResponse.Certs.TLS, sshPrivateKey)
+	require.NoError(t, err)
+
+	client, err := srv.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
+
+	_, err = client.Ping(ctx)
+	require.NoError(t, err)
+
+	// Try once more, but this time with the first join state.
+	thirdResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+		ctx,
+		makeInitReq(withJoinState(firstResponse.JoinState)),
+		solver.solver(),
+	)
+	require.Nil(t, thirdResponse)
+
+	// Note: Exact error message depends on whether or not the lock is in
+	// effect, so we won't check it right now.
+	require.Error(t, err)
+
+	// The token should now be locked - but only once.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: "bound-keypair-test",
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "only one lock should be generated")
+	require.Contains(t, locks[0].Message(), "failed to verify its join state")
+
+	// The previously working client should be locked.
+	require.Eventually(t, func() bool {
+		_, err = client.Ping(ctx)
+		return err != nil && strings.Contains(err.Error(), "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Repeat the above but with an Eventually() to consistently check the error
+	// message. Depending on exact timing / cache propagation / etc the lock may
+	// or may not be in force, but we also need to be absolutely certain to try
+	// to generate at least 2 locking events.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		nextResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+			ctx,
+			makeInitReq(withJoinState(firstResponse.JoinState)),
+			solver.solver(),
+		)
+		require.Nil(t, nextResponse)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "a client failed to verify its join state")
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+// TODO(nklaassen): DELETE IN 20 when the legacy join service is removed, this
+// test is superceded by lib/join.TestJoinBoundKeypair_JoinStateFailureDuringRenewal
+// which exercises the new join service.
+func TestServer_RegisterUsingBoundKeypairMethod_JoinStateFailureDuringRenewal(t *testing.T) {
+	// Similar to _JoinStateFailure above, this exercises the case where the
+	// original client still has valid certs and isn't attempting a recovery of
+	// its own.
+	t.Parallel()
+
+	ctx := context.Background()
+
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+
+	_, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, withClock(clock))
+	authServer := srv.Auth()
+	authServer.SetCreateBoundKeypairValidator(func(subject, clusterName string, publicKey crypto.PublicKey) (joinboundkeypair.BoundKeypairValidator, error) {
+		return &mockBoundKeypairValidator{
+			subject:     subject,
+			clusterName: clusterName,
+			publicKey:   publicKey,
+		}, nil
+	})
+
+	_, err = authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 3,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	makeInitReq := func(mutators ...func(r *proto.RegisterUsingBoundKeypairInitialRequest)) *proto.RegisterUsingBoundKeypairInitialRequest {
+		req := &proto.RegisterUsingBoundKeypairInitialRequest{
+			JoinRequest: &types.RegisterUsingTokenRequest{
+				HostID:       "host-id",
+				Role:         types.RoleBot,
+				PublicTLSKey: tlsPublicKey,
+				PublicSSHKey: sshPublicKey,
+				Token:        "bound-keypair-test",
+			},
+		}
+		for _, mutator := range mutators {
+			mutator(req)
+		}
+		return req
+	}
+
+	withJoinState := func(state []byte) func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+		return func(r *proto.RegisterUsingBoundKeypairInitialRequest) {
+			r.PreviousJoinState = state
+		}
+	}
+
+	withBotInstance := func(ident *tlsca.Identity) func(req *proto.RegisterUsingBoundKeypairInitialRequest) {
+		return func(req *proto.RegisterUsingBoundKeypairInitialRequest) {
+			req.JoinRequest.BotGeneration = int32(ident.Generation)
+			req.JoinRequest.BotInstanceID = ident.BotInstanceID
+		}
+	}
+
+	// Perform the initial registration.
+	solver := newMockSolver(t, correctPublicKey)
+	firstResponse, err := authServer.RegisterUsingBoundKeypairMethod(ctx, makeInitReq(), solver.solver())
+	require.NoError(t, err)
+
+	// Parse the identity for subsequent use of the bot instance.
+	firstCert, err := tlsca.ParseCertificatePEM(firstResponse.Certs.TLS)
+	require.NoError(t, err)
+	firstIdent, err := tlsca.FromSubject(firstCert.Subject, firstCert.NotAfter)
+	require.NoError(t, err)
+
+	// Perform a recovery, this time with a join state, simulating an attacker
+	// that has copied the certs.
+	secondResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+		ctx,
+		makeInitReq(withJoinState(firstResponse.JoinState)),
+		solver.solver(),
+	)
+	require.NotNil(t, secondResponse)
+	require.NoError(t, err)
+
+	// Try an API call with these certs.
+	tlsCert, err := tls.X509KeyPair(secondResponse.Certs.TLS, sshPrivateKey)
+	require.NoError(t, err)
+
+	client, err := srv.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
+	_, err = client.Ping(ctx)
+	require.NoError(t, err)
+
+	// Try once more, but this time with the first join state, simulating the
+	// original client authenticating again.
+	thirdResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+		ctx,
+		makeInitReq(
+			withJoinState(firstResponse.JoinState),
+
+			// Provide the previous identity to trigger the "standard rejoin" /
+			// renewal flow, rather than recovery.
+			withBotInstance(firstIdent),
+		),
+		solver.solver(),
+	)
+	require.Nil(t, thirdResponse)
+
+	// Note: Exact error message depends on whether or not the lock is in
+	// effect, so we won't check it right now.
+	require.Error(t, err)
+
+	// The token should now be locked - but only once.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: "bound-keypair-test",
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "exactly one lock should be generated")
+	require.Contains(t, locks[0].Message(), "failed to verify its join state")
+
+	// The previously working client should be locked.
+	require.Eventually(t, func() bool {
+		_, err = client.Ping(ctx)
+		return err != nil && strings.Contains(err.Error(), "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Repeat the above but with an Eventually() to consistently check the error
+	// message. Depending on exact timing / cache propagation / etc the lock may
+	// or may not be in force, but we also need to be absolutely certain to try
+	// to generate at least 2 locking events.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		nextResponse, err := authServer.RegisterUsingBoundKeypairMethod(
+			ctx,
+			makeInitReq(withJoinState(firstResponse.JoinState)),
+			solver.solver(),
+		)
+		require.Nil(t, nextResponse)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "a client failed to verify its join state")
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+func TestServer_CreateBoundKeypairToken(t *testing.T) {
+	t.Parallel()
+	// Most creation/validation functionality is tested in api/ as part of
+	// CheckAndSetDefaults() or in lib/services, but there's some specific logic
+	// at this layer to generate the default registration secret if needed we
+	// should test.
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+	srv := newTestTLSServer(t, withClock(clock))
+	authServer := srv.Auth()
+
+	tests := []struct {
+		name      string
+		token     *types.ProvisionTokenV2
+		wantErr   require.ErrorAssertionFunc
+		assertion func(t require.TestingT, token *types.ProvisionTokenV2)
+	}{
+		{
+			name: "nil onboarding spec",
+			token: &types.ProvisionTokenV2{
+				Kind:    types.KindToken,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name: "empty-onboarding",
+				},
+				Spec: types.ProvisionTokenSpecV2{
+					JoinMethod: types.JoinMethodBoundKeypair,
+					Roles:      []types.SystemRole{types.RoleBot},
+					BotName:    "test",
+					BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+						Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+							Mode: "insecure",
+						},
+					},
+				},
+			},
+			wantErr: require.NoError,
+			assertion: func(t require.TestingT, token *types.ProvisionTokenV2) {
+				require.NotEmpty(t, token.Status.BoundKeypair.RegistrationSecret)
+			},
+		},
+		{
+			name: "set onboarding spec with secret",
+			token: &types.ProvisionTokenV2{
+				Kind:    types.KindToken,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name: "set-onboarding-with-secret",
+				},
+				Spec: types.ProvisionTokenSpecV2{
+					JoinMethod: types.JoinMethodBoundKeypair,
+					Roles:      []types.SystemRole{types.RoleBot},
+					BotName:    "test",
+					BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+						Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+							RegistrationSecret: "my-initial-secret",
+						},
+						Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+							Mode: "insecure",
+						},
+					},
+				},
+			},
+			wantErr: require.NoError,
+			assertion: func(t require.TestingT, token *types.ProvisionTokenV2) {
+				require.Equal(t, "my-initial-secret", token.Status.BoundKeypair.RegistrationSecret)
+			},
+		},
+		{
+			name: "set onboarding spec with no secret",
+			token: &types.ProvisionTokenV2{
+				Kind:    types.KindToken,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name: "set-onboarding-with-no-secret",
+				},
+				Spec: types.ProvisionTokenSpecV2{
+					JoinMethod: types.JoinMethodBoundKeypair,
+					Roles:      []types.SystemRole{types.RoleBot},
+					BotName:    "test",
+					BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+						Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{},
+						Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+							Mode: "insecure",
+						},
+					},
+				},
+			},
+			wantErr: require.NoError,
+			assertion: func(t require.TestingT, token *types.ProvisionTokenV2) {
+				require.NotEmpty(t, token.Status.BoundKeypair.RegistrationSecret)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := authServer.CreateBoundKeypairToken(t.Context(), tt.token)
+			tt.wantErr(t, err)
+
+			if tt.assertion != nil {
+				got, err := authServer.GetToken(t.Context(), tt.token.GetName())
+				require.NoError(t, err)
+				tt.assertion(t, got.(*types.ProvisionTokenV2))
 			}
 		})
 	}
diff --git a/lib/auth/join_circleci.go b/lib/auth/join_circleci.go
index c83aabf961df8..825107e0467b8 100644
--- a/lib/auth/join_circleci.go
+++ b/lib/auth/join_circleci.go
@@ -20,55 +20,37 @@ package auth
 
 import (
 	"context"
-	"slices"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/circleci"
+	"github.com/gravitational/teleport/lib/join/circleci"
 )
 
+// GetCircleCITokenValidate returns the currently configured CircleCI OIDC token
+// validator.
+func (a *Server) GetCircleCITokenValidator() circleci.Validator {
+	return a.circleCITokenValidate
+}
+
+// SetCircleCITokenValidate sets the CircleCI OIDC token validator
+// implementation. Used in tests.
+func (a *Server) SetCircleCITokenValidator(validator circleci.Validator) {
+	a.circleCITokenValidate = validator
+}
+
 func (a *Server) checkCircleCIJoinRequest(
 	ctx context.Context,
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*circleci.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("IDToken not provided for %q join request", types.JoinMethodCircleCI)
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("%q join method only support ProvisionTokenV2, '%T' was provided", types.JoinMethodCircleCI, pt)
-	}
-
-	claims, err := a.circleCITokenValidate(
-		ctx,
-		token.Spec.CircleCI.OrganizationID,
-		req.IDToken,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return claims, trace.Wrap(checkCircleCIAllowRules(token, claims))
-}
-
-func checkCircleCIAllowRules(token *types.ProvisionTokenV2, claims *circleci.IDTokenClaims) error {
-	// If a single rule passes, accept the IDToken
-	for _, rule := range token.Spec.CircleCI.Allow {
-		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
-			continue
-		}
-
-		// If ContextID is specified in rule, it must be contained in the slice
-		// of ContextIDs within the claims.
-		if rule.ContextID != "" && !slices.Contains(claims.ContextIDs, rule.ContextID) {
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
-
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	claims, err := circleci.CheckIDToken(ctx, &circleci.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Validator:      a.circleCITokenValidate,
+	})
+
+	// Note: try to return claims even if there was an error, they may provide
+	// useful auditing context.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_circleci_test.go b/lib/auth/join_circleci_test.go
deleted file mode 100644
index 0ba813af1d9a3..0000000000000
--- a/lib/auth/join_circleci_test.go
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/circleci"
-)
-
-func TestAuth_RegisterUsingToken_CircleCI(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	var (
-		validIDToken  = "valid-token"
-		validOrg      = "valid-org"
-		validProject  = "valid-project"
-		validContextA = "valid-context-a"
-		validContextB = "valid-context-b"
-	)
-	// stand up auth server with mocked CircleCI token validator
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.circleCITokenValidate = func(
-			ctx context.Context, organizationID, token string,
-		) (*circleci.IDTokenClaims, error) {
-			if organizationID == validOrg && token == validIDToken {
-				return &circleci.IDTokenClaims{
-					Sub:        "org/valid-org/project/valid-project/user/USER_ID",
-					ProjectID:  validProject,
-					ContextIDs: []string{validContextA, validContextB},
-				}, nil
-			}
-			return nil, errMockInvalidToken
-		}
-		return nil
-	}
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
-	require.NoError(t, err)
-	auth := p.a
-
-	// helper for creating RegisterUsingTokenRequest
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-	provisionTokenSpec := func(spec *types.ProvisionTokenSpecV2CircleCI) types.ProvisionTokenSpecV2 {
-		return types.ProvisionTokenSpecV2{
-			JoinMethod: types.JoinMethodCircleCI,
-			Roles:      types.SystemRoles{types.RoleNode},
-			CircleCI:   spec,
-		}
-	}
-
-	// helpers for error assertions
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		messageMatch := assert.ErrorContains(t, err, "id token claims did not match any allow rules")
-		typeMatch := assert.True(t, trace.IsAccessDenied(err))
-		require.True(t, messageMatch && typeMatch)
-	})
-	tokenNotMatched := func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorIs(t, err, errMockInvalidToken)
-	}
-	tests := []struct {
-		name        string
-		request     *types.RegisterUsingTokenRequest
-		tokenSpec   types.ProvisionTokenSpecV2
-		assertError require.ErrorAssertionFunc
-	}{
-		{
-			name:    "matching all",
-			request: newRequest(validIDToken),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ProjectID: validProject,
-						ContextID: validContextA,
-					},
-				},
-			}),
-			assertError: require.NoError,
-		},
-		{
-			name:    "matching second context",
-			request: newRequest(validIDToken),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ContextID: validContextB,
-					},
-				},
-			}),
-			assertError: require.NoError,
-		},
-		{
-			name:    "invalid org",
-			request: newRequest(validIDToken),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: "not-this-org",
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ContextID: validContextB,
-					},
-				},
-			}),
-			assertError: tokenNotMatched,
-		},
-		{
-			name:    "invalid IDToken",
-			request: newRequest("not-this-token"),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ContextID: validContextB,
-					},
-				},
-			}),
-			assertError: tokenNotMatched,
-		},
-		{
-			name:    "missing IDToken in request",
-			request: newRequest(""),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ContextID: validContextB,
-					},
-				},
-			}),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.True(t, trace.IsBadParameter(err))
-				require.ErrorContains(t, err, "IDToken not provided")
-			},
-		},
-		{
-			name:    "invalid context",
-			request: newRequest(validIDToken),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ProjectID: validProject,
-						ContextID: "not-this-context",
-					},
-				},
-			}),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name:    "invalid project",
-			request: newRequest(validIDToken),
-			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
-				OrganizationID: validOrg,
-				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
-					{
-						ProjectID: "invalid-project",
-						ContextID: validContextA,
-					},
-				},
-			}),
-			assertError: allowRulesNotMatched,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Create Token resource for use in test
-			token, err := types.NewProvisionTokenFromSpec(
-				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tt.request.Token = token.GetName()
-
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
-		})
-	}
-
-}
diff --git a/lib/auth/join_ec2.go b/lib/auth/join_ec2.go
index 3bf273c34056a..fa87a52c4206a 100644
--- a/lib/auth/join_ec2.go
+++ b/lib/auth/join_ec2.go
@@ -20,316 +20,23 @@ package auth
 
 import (
 	"context"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"slices"
-	"time"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
-	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
-	"github.com/aws/aws-sdk-go-v2/service/sts"
-	"github.com/aws/smithy-go/tracing/smithyoteltracing"
-	"github.com/digitorus/pkcs7"
 	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"go.opentelemetry.io/otel"
 
-	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+	"github.com/gravitational/teleport/lib/join/ec2join"
 )
 
-type ec2Client interface {
-	DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error)
+// SetEC2ClientForEC2JoinMethod sets an AWS EC2 client that will be used to
+// check hosts joining via EC2 join method.
+func (a *Server) SetEC2ClientForEC2JoinMethod(clt ec2join.EC2Client) {
+	a.ec2ClientForEC2JoinMethod = clt
 }
 
-type ec2ClientKey struct{}
-
-func ec2ClientFromContext(ctx context.Context) (ec2Client, bool) {
-	ec2Client, ok := ctx.Value(ec2ClientKey{}).(ec2Client)
-	return ec2Client, ok
-}
-
-// ec2ClientFromConfig returns a new ec2 client from the given aws config, or
-// may load the client from the passed context if one has been set (for tests).
-func ec2ClientFromConfig(ctx context.Context, cfg aws.Config) ec2Client {
-	ec2Client, ok := ec2ClientFromContext(ctx)
-	if ok {
-		return ec2Client
-	}
-	return ec2.NewFromConfig(cfg, func(o *ec2.Options) {
-		o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
-	})
-}
-
-// checkEC2AllowRules checks that the iid matches at least one of the allow
-// rules of the given token.
-func checkEC2AllowRules(ctx context.Context, iid *imds.InstanceIdentityDocument, provisionToken types.ProvisionToken) error {
-	allowRules := provisionToken.GetAllowRules()
-	for _, rule := range allowRules {
-		// if this rule specifies an AWS account, the IID must match
-		if len(rule.AWSAccount) > 0 {
-			if rule.AWSAccount != iid.AccountID {
-				continue
-			}
-		}
-		// if this rule specifies any AWS regions, the IID must match one of them
-		if len(rule.AWSRegions) > 0 {
-			if !slices.Contains(rule.AWSRegions, iid.Region) {
-				continue
-			}
-		}
-		// iid matches this allow rule. Check if it is running.
-		return trace.Wrap(checkInstanceRunning(ctx, iid.InstanceID, iid.Region, rule.AWSRole))
-	}
-	return trace.AccessDenied("instance %v did not match any allow rules in token %v", iid.InstanceID, provisionToken.GetName())
-}
-
-func checkInstanceRunning(ctx context.Context, instanceID, region, IAMRole string) error {
-	awsClientConfig, err := config.LoadDefaultConfig(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	awsClientConfig.Region = region
-
-	// assume the configured IAM role if necessary
-	if IAMRole != "" {
-		stsClient := stsutils.NewFromConfig(awsClientConfig, func(o *sts.Options) {
-			o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
-		})
-		creds := stscreds.NewAssumeRoleProvider(stsClient, IAMRole)
-		awsClientConfig.Credentials = aws.NewCredentialsCache(creds)
-	}
-
-	ec2Client := ec2ClientFromConfig(ctx, awsClientConfig)
-
-	output, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{
-		InstanceIds: []string{instanceID},
-	})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if len(output.Reservations) == 0 || len(output.Reservations[0].Instances) == 0 {
-		return trace.AccessDenied("failed to get instance state")
-	}
-	instance := output.Reservations[0].Instances[0]
-	if instance.InstanceId == nil || *instance.InstanceId != instanceID {
-		return trace.AccessDenied("failed to get instance state")
-	}
-	if instance.State == nil || instance.State.Name != ec2types.InstanceStateNameRunning {
-		return trace.AccessDenied("instance is not running")
-	}
-	return nil
-}
-
-// parseAndVerifyIID parses the given Instance Identity Document and checks that
-// the signature is valid.
-func parseAndVerifyIID(iidBytes []byte) (*imds.InstanceIdentityDocument, error) {
-	sigPEM := fmt.Sprintf("-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----", string(iidBytes))
-	sigBER, _ := pem.Decode([]byte(sigPEM))
-	if sigBER == nil {
-		return nil, trace.AccessDenied("unable to decode Instance Identity Document")
-	}
-
-	p7, err := pkcs7.Parse(sigBER.Bytes)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var iid imds.InstanceIdentityDocument
-	if err := json.Unmarshal(p7.Content, &iid); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	rawCert, ok := awsRSA2048CertBytes[iid.Region]
-	if !ok {
-		return nil, trace.AccessDenied("unsupported EC2 region: %q", iid.Region)
-	}
-	certPEM, _ := pem.Decode(rawCert)
-	cert, err := x509.ParseCertificate(certPEM.Bytes)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	p7.Certificates = []*x509.Certificate{cert}
-	if err = p7.Verify(); err != nil {
-		return nil, trace.AccessDenied("invalid signature")
-	}
-
-	return &iid, nil
-}
-
-func checkPendingTime(iid *imds.InstanceIdentityDocument, provisionToken types.ProvisionToken, clock clockwork.Clock) error {
-	timeSinceInstanceStart := clock.Since(iid.PendingTime)
-	// Sanity check IID is not from the future. Allow 1 minute of clock drift.
-	if timeSinceInstanceStart < -1*time.Minute {
-		return trace.AccessDenied("Instance Identity Document PendingTime appears to be in the future")
-	}
-	ttl := time.Duration(provisionToken.GetAWSIIDTTL())
-	if timeSinceInstanceStart > ttl {
-		return trace.AccessDenied("Instance Identity Document with PendingTime %v is older than configured TTL of %v", iid.PendingTime, ttl)
-	}
-	return nil
-}
-
-func nodeExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	_, err := presence.GetNode(ctx, defaults.Namespace, hostID)
-	switch {
-	case trace.IsNotFound(err):
-		return false, nil
-	case err != nil:
-		return false, trace.Wrap(err)
-	default:
-		return true, nil
-	}
-}
-
-func proxyExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	proxies, err := presence.GetProxies()
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	for _, proxy := range proxies {
-		if proxy.GetName() == hostID {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-func kubeExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	kubes, err := presence.GetKubernetesServers(ctx)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	for _, kube := range kubes {
-		if kube.GetHostID() == hostID {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-func appExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	apps, err := presence.GetApplicationServers(ctx, defaults.Namespace)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-
-	for _, app := range apps {
-		if app.GetName() == hostID {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func dbExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	dbs, err := presence.GetDatabaseServers(ctx, defaults.Namespace)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-
-	for _, db := range dbs {
-		if db.GetName() == hostID {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func oktaExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	apps, err := presence.GetApplicationServers(ctx, defaults.Namespace)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	for _, app := range apps {
-		if app.GetName() == hostID && app.Origin() == types.OriginOkta {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func desktopServiceExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
-	svcs, err := presence.GetWindowsDesktopServices(ctx)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-
-	for _, wds := range svcs {
-		if wds.GetName() == hostID {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// tryToDetectIdentityReuse performs a best-effort check to see if the specified role+id combination
-// is already in use by an instance. This will only detect re-use in the case where a recent heartbeat
-// clearly shows the combination in use since teleport maintains no long-term per-instance state.
-func (a *Server) tryToDetectIdentityReuse(ctx context.Context, req *types.RegisterUsingTokenRequest, iid *imds.InstanceIdentityDocument) error {
-	requestedHostID := req.HostID
-	expectedHostID := utils.NodeIDFromIID(iid)
-	if requestedHostID != expectedHostID {
-		return trace.AccessDenied("invalid host ID %q, expected %q", requestedHostID, expectedHostID)
-	}
-
-	var instanceExists bool
-	var err error
-
-	switch req.Role {
-	case types.RoleNode:
-		instanceExists, err = nodeExists(ctx, a, req.HostID)
-	case types.RoleProxy:
-		instanceExists, err = proxyExists(ctx, a, req.HostID)
-	case types.RoleKube:
-		instanceExists, err = kubeExists(ctx, a, req.HostID)
-	case types.RoleApp:
-		instanceExists, err = appExists(ctx, a, req.HostID)
-	case types.RoleDatabase:
-		instanceExists, err = dbExists(ctx, a, req.HostID)
-	case types.RoleWindowsDesktop:
-		instanceExists, err = desktopServiceExists(ctx, a, req.HostID)
-	case types.RoleOkta:
-		instanceExists, err = oktaExists(ctx, a, req.HostID)
-	case types.RoleInstance:
-		// no appropriate check exists for the Instance role
-		instanceExists = false
-	case types.RoleDiscovery:
-		// no appropriate check exists for the Discovery role
-		instanceExists = false
-	case types.RoleMDM:
-		// no appropriate check exists for the MDM role
-		instanceExists = false
-	default:
-		return trace.BadParameter("unsupported role: %q", req.Role)
-	}
-
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if instanceExists {
-		const msg = "Server is attempting to join the cluster with a Simplified Node Joining request, but" +
-			" a server with this ID is already present in the cluster"
-		a.logger.WarnContext(ctx, msg,
-			"host_id", req.HostID,
-			"role", req.Role,
-		)
-		return trace.AccessDenied("server with host ID %q and role %q already exists", req.HostID, req.Role)
-	}
-	return nil
+// GetEC2ClientForEC2JoinMethod returns an AWS EC2 client that should be used to
+// check hosts joining via EC2 join method.
+func (a *Server) GetEC2ClientForEC2JoinMethod() ec2join.EC2Client {
+	return a.ec2ClientForEC2JoinMethod
 }
 
 // checkEC2JoinRequest checks register requests which use EC2 Simplified Node
@@ -343,6 +50,8 @@ func (a *Server) tryToDetectIdentityReuse(ctx context.Context, req *types.Regist
 // If the request does not include an Instance Identity Document, and the
 // token does not include any allow rules, this method returns nil and the
 // normal token checking logic resumes.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
 func (a *Server) checkEC2JoinRequest(ctx context.Context, req *types.RegisterUsingTokenRequest) error {
 	tokenName := req.Token
 	provisionToken, err := a.GetToken(ctx, tokenName)
@@ -358,22 +67,18 @@ func (a *Server) checkEC2JoinRequest(ctx context.Context, req *types.RegisterUsi
 			"Document, make sure your node is configured to use the EC2 join method")
 	}
 
-	iid, err := parseAndVerifyIID(req.EC2IdentityDocument)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := checkPendingTime(iid, provisionToken, a.clock); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := a.tryToDetectIdentityReuse(ctx, req, iid); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := checkEC2AllowRules(ctx, iid, provisionToken); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
+	_, err = ec2join.CheckEC2Request(ctx, &ec2join.CheckEC2RequestParams{
+		ProvisionToken:  provisionToken,
+		Role:            req.Role,
+		Document:        req.EC2IdentityDocument,
+		RequestedHostID: &req.HostID,
+		Presence:        a,
+		EC2Client:       a.GetEC2ClientForEC2JoinMethod(),
+		// Hosts calling this legacy join RPC may join with the Instance role
+		// after already joining with another role, so the Instance identity
+		// reuse check must be skipped.
+		SkipInstanceReuseCheck: true,
+		Clock:                  a.GetClock(),
+	})
+	return trace.Wrap(err)
 }
diff --git a/lib/auth/join_ec2_test.go b/lib/auth/join_ec2_test.go
deleted file mode 100644
index b396f0c9c77ac..0000000000000
--- a/lib/auth/join_ec2_test.go
+++ /dev/null
@@ -1,812 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/pem"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-)
-
-type ec2Instance struct {
-	iid         []byte
-	account     string
-	region      string
-	instanceID  string
-	pendingTime time.Time
-}
-
-var (
-	instance1 = ec2Instance{
-		iid: []byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
-23sKICAiYWNjb3VudElkIiA6ICIyNzg1NzYyMjA0NTMiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
-Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMmEiLAogICJiaWxsaW5nUHJv
-ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
-YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wZmE5ZTFmNjQxNDJj
-ZGUxNyIsCiAgImluc3RhbmNlSWQiIDogImktMDc4NTE3Y2E4YTcwYTFkZGUiLAogICJpbnN0YW5j
-ZVR5cGUiIDogInQyLm1lZGl1bSIsCiAgImtlcm5lbElkIiA6IG51bGwsCiAgInBlbmRpbmdUaW1l
-IiA6ICIyMDIxLTA5LTAzVDIxOjI1OjQ0WiIsCiAgInByaXZhdGVJcCIgOiAiMTAuMC4wLjIwOSIs
-CiAgInJhbWRpc2tJZCIgOiBudWxsLAogICJyZWdpb24iIDogInVzLXdlc3QtMiIsCiAgInZlcnNp
-b24iIDogIjIwMTctMDktMzAiCn0AAAAAAAAxggIvMIICKwIBATBpMFwxCzAJBgNVBAYTAlVTMRkw
-FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
-b24gV2ViIFNlcnZpY2VzIExMQwIJALZL3lrQCSTMMA0GCWCGSAFlAwQCAQUAoIGYMBgGCSqGSIb3
-DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIxMDkwMzIxMjU0N1owLQYJKoZIhvcN
-AQk0MSAwHjANBglghkgBZQMEAgEFAKENBgkqhkiG9w0BAQsFADAvBgkqhkiG9w0BCQQxIgQgCH2d
-JiKmdx9uhxlm8ObWAvFOhqJb7k79+DW/T3ezwVUwDQYJKoZIhvcNAQELBQAEggEANWautigs/qZ6
-w8g5/EfWsAFj8kHgUD+xqsQ1HDrBUx3IQ498NMBZ78379B8RBfuzeVjbaf+yugov0fYrDbGvSRRw
-myy49TfZ9gdlpWQXzwSg3OPMDNToRoKw00/LQjSxcTCaPP4vMDEIjYMUqZ3i4uWYJJJ0Lb7fDMDk
-Anu7yHolVfbnvIAuZe8lGpc7ofCSBG5wulm+/pqzO25YPMH1cLEvOadE+3N2GxK6gRTLJoE98rsm
-LDp6OuU/b2QfaxU0ec6OogdtSJto/URI0/ygHmNAzBis470A29yh5nVwm6AkY4krjPsK7uiBIRhs
-lr5x0X6+ggQfF2BKAJ/BRcAHNgAAAAAAAA==`),
-		account:     "278576220453",
-		region:      "us-west-2",
-		instanceID:  "i-078517ca8a70a1dde",
-		pendingTime: time.Date(2021, time.September, 3, 21, 25, 44, 0, time.UTC),
-	}
-	instance2 = ec2Instance{
-		iid: []byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
-3XsKICAiYWNjb3VudElkIiA6ICI4ODM0NzQ2NjI4ODgiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
-Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMWMiLAogICJiaWxsaW5nUHJv
-ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
-YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wY2UzYzU1YTMxZDI5
-MDQwZSIsCiAgImluc3RhbmNlSWQiIDogImktMDFiOTQwYzQ1ZmQxMWZlNzQiLAogICJpbnN0YW5j
-ZVR5cGUiIDogInQyLm1pY3JvIiwKICAia2VybmVsSWQiIDogbnVsbCwKICAicGVuZGluZ1RpbWUi
-IDogIjIwMjEtMDktMTFUMDA6MTQ6MThaIiwKICAicHJpdmF0ZUlwIiA6ICIxNzIuMzEuMTIuMjUx
-IiwKICAicmFtZGlza0lkIiA6IG51bGwsCiAgInJlZ2lvbiIgOiAidXMtd2VzdC0xIiwKICAidmVy
-c2lvbiIgOiAiMjAxNy0wOS0zMCIKfQAAAAAAADGCAi8wggIrAgEBMGkwXDELMAkGA1UEBhMCVVMx
-GTAXBgNVBAgTEFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
-YXpvbiBXZWIgU2VydmljZXMgTExDAgkA00+QilzIS0gwDQYJYIZIAWUDBAIBBQCggZgwGAYJKoZI
-hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjEwOTExMDAxNDIyWjAtBgkqhkiG
-9w0BCTQxIDAeMA0GCWCGSAFlAwQCAQUAoQ0GCSqGSIb3DQEBCwUAMC8GCSqGSIb3DQEJBDEiBCDS
-1gNvxbYnEL6plVu8X/QmKPJFJwIJfi+2hIVjyKAOtjANBgkqhkiG9w0BAQsFAASCAQABKmghATg8
-VXkdiIGcTIPfKrc2v/zEIdLUAi+Ew5lrGUVjnNqrP9irGK4d9sVtcu/8UKp9RDoeJOQ6I/pRcwvT
-PJVHlhGnLyybr5ZVqkxiC09GASNnPe12dzCKkKD2rvW6mGR91cxpM94Xqi5UA/ZRqiXwpHo3LECN
-Gu38Hpdv6sBgD/av2Ohd+vEH2zvYVkp7ZfnFuDLWRSBQZgmKwVKVdOjrMmP32vb3vzhMBuOj+jbQ
-RwEmYIkRaEGNbrZgatjMJYmTWuLG26zws3avOK6kL6u38DV3wJPVB/G0Ira5MvC/ojGya+DrVngW
-VUP+3jgenPrd7OyCWPSwOoOBMhSlAAAAAAAA`),
-		account:     "883474662888",
-		region:      "us-west-1",
-		instanceID:  "i-01b940c45fd11fe74",
-		pendingTime: time.Date(2021, time.September, 11, 0, 14, 18, 0, time.UTC),
-	}
-)
-
-type (
-	ec2ClientNoInstance struct{}
-	ec2ClientNotRunning struct{}
-	ec2ClientRunning    struct{}
-)
-
-func (c ec2ClientNoInstance) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
-	return &ec2.DescribeInstancesOutput{}, nil
-}
-
-func (c ec2ClientNotRunning) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
-	return &ec2.DescribeInstancesOutput{
-		Reservations: []ec2types.Reservation{
-			{
-				Instances: []ec2types.Instance{
-					{
-						InstanceId: &params.InstanceIds[0],
-						State: &ec2types.InstanceState{
-							Name: ec2types.InstanceStateNameTerminated,
-						},
-					},
-				},
-			},
-		},
-	}, nil
-}
-
-func (c ec2ClientRunning) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
-	return &ec2.DescribeInstancesOutput{
-		Reservations: []ec2types.Reservation{
-			{
-				Instances: []ec2types.Instance{
-					{
-						InstanceId: &params.InstanceIds[0],
-						State: &ec2types.InstanceState{
-							Name: ec2types.InstanceStateNameRunning,
-						},
-					},
-				},
-			},
-		},
-	}, nil
-}
-
-func TestAuth_RegisterUsingToken_EC2(t *testing.T) {
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-	a := p.a
-
-	// upsert a node to test duplicates
-	node := &types.ServerV2{
-		Kind:    types.KindNode,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      instance2.account + "-" + instance2.instanceID,
-			Namespace: defaults.Namespace,
-		},
-	}
-	_, err = a.UpsertNode(ctx, node)
-	require.NoError(t, err)
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	isNil := func(err error) bool {
-		return err == nil
-	}
-
-	testCases := []struct {
-		desc        string
-		tokenSpec   types.ProvisionTokenSpecV2
-		ec2Client   ec2Client
-		request     types.RegisterUsingTokenRequest
-		expectError func(error) bool
-		clock       clockwork.Clock
-	}{
-		{
-			desc: "basic passing case",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: isNil,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "pass with multiple rules",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance2.account,
-						AWSRegions: []string{instance2.region},
-					},
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: isNil,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "pass with multiple regions",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{"us-east-1", instance1.region, "us-east-2"},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: isNil,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "pass with no regions",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: isNil,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "wrong account",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "bad account",
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "wrong region",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{"bad region"},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "bad HostID",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              "bad host id",
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "no identity document",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:    "test_token",
-				NodeName: "node_name",
-				Role:     types.RoleNode,
-				HostID:   instance1.account + "-" + instance1.instanceID,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "bad identity document",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: []byte("bad document"),
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "instance already joined",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance2.account,
-						AWSRegions: []string{instance2.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance2.account + "-" + instance2.instanceID,
-				EC2IdentityDocument: instance2.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance2.pendingTime),
-		},
-		{
-			desc: "instance already joined, fake ID",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance2.account,
-						AWSRegions: []string{instance2.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              "fake id",
-				EC2IdentityDocument: instance2.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance2.pendingTime),
-		},
-		{
-			desc: "instance not running",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientNotRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "instance not exists",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientNoInstance{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime),
-		},
-		{
-			desc: "TTL expired",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime.Add(5*time.Minute + time.Second)),
-		},
-		{
-			desc: "custom TTL pass",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-				AWSIIDTTL: types.Duration(10 * time.Minute),
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: isNil,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime.Add(9 * time.Minute)),
-		},
-		{
-			desc: "custom TTL fail",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: instance1.account,
-						AWSRegions: []string{instance1.region},
-					},
-				},
-				AWSIIDTTL: types.Duration(10 * time.Minute),
-			},
-			ec2Client: ec2ClientRunning{},
-			request: types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                types.RoleNode,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-			},
-			expectError: trace.IsAccessDenied,
-			clock:       clockwork.NewFakeClockAt(instance1.pendingTime.Add(11 * time.Minute)),
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			clock := tc.clock
-			if clock == nil {
-				clock = clockwork.NewRealClock()
-			}
-			a.clock = clock
-
-			token, err := types.NewProvisionTokenFromSpec(
-				"test_token",
-				time.Now().Add(time.Minute),
-				tc.tokenSpec)
-			require.NoError(t, err)
-
-			err = a.UpsertToken(context.Background(), token)
-			require.NoError(t, err)
-
-			ctx := context.WithValue(context.Background(), ec2ClientKey{}, tc.ec2Client)
-
-			// set common request values here to avoid setting them in every
-			// testcase
-			tc.request.PublicSSHKey = sshPublicKey
-			tc.request.PublicTLSKey = tlsPublicKey
-
-			_, err = a.RegisterUsingToken(ctx, &tc.request)
-			require.True(t, tc.expectError(err))
-
-			err = a.DeleteToken(context.Background(), token.GetName())
-			require.NoError(t, err)
-		})
-	}
-}
-
-// TestAWSCerts asserts that all certificates parse
-func TestAWSCerts(t *testing.T) {
-	for _, certBytes := range awsRSA2048CertBytes {
-		certPEM, _ := pem.Decode(certBytes)
-		_, err := x509.ParseCertificate(certPEM.Bytes)
-		require.NoError(t, err)
-	}
-}
-
-// TestHostUniqueCheck tests the uniqueness check used by checkEC2JoinRequest
-func TestHostUniqueCheck(t *testing.T) {
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-	a := p.a
-
-	a.clock = clockwork.NewFakeClockAt(instance1.pendingTime)
-
-	token, err := types.NewProvisionTokenFromSpec(
-		"test_token",
-		time.Now().Add(time.Minute),
-		types.ProvisionTokenSpecV2{
-			Roles: []types.SystemRole{
-				types.RoleNode,
-				types.RoleProxy,
-				types.RoleKube,
-				types.RoleDatabase,
-				types.RoleApp,
-				types.RoleWindowsDesktop,
-				types.RoleMDM,
-				types.RoleDiscovery,
-				types.RoleOkta,
-			},
-			Allow: []*types.TokenRule{
-				{
-					AWSAccount: instance1.account,
-					AWSRegions: []string{instance1.region},
-				},
-			},
-		})
-	require.NoError(t, err)
-
-	err = a.UpsertToken(context.Background(), token)
-	require.NoError(t, err)
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	testCases := []struct {
-		role     types.SystemRole
-		upserter func(name string)
-	}{
-		{
-			role: types.RoleNode,
-			upserter: func(name string) {
-				node := &types.ServerV2{
-					Kind:    types.KindNode,
-					Version: types.V2,
-					Metadata: types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-				}
-				_, err := a.UpsertNode(context.Background(), node)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleProxy,
-			upserter: func(name string) {
-				proxy := &types.ServerV2{
-					Kind:    types.KindProxy,
-					Version: types.V2,
-					Metadata: types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-				}
-				err := a.UpsertProxy(context.Background(), proxy)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleKube,
-			upserter: func(name string) {
-				kube, err := types.NewKubernetesServerV3(
-					types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-					types.KubernetesServerSpecV3{
-						HostID:   name,
-						Hostname: "test-kuge",
-						Cluster: &types.KubernetesClusterV3{
-							Metadata: types.Metadata{
-								Name:      name,
-								Namespace: defaults.Namespace,
-							},
-						},
-					})
-				require.NoError(t, err)
-				_, err = a.UpsertKubernetesServer(context.Background(), kube)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleDatabase,
-			upserter: func(name string) {
-				db, err := types.NewDatabaseServerV3(
-					types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-					types.DatabaseServerSpecV3{
-						HostID:   name,
-						Hostname: "test-db",
-						Database: &types.DatabaseV3{
-							Metadata: types.Metadata{
-								Name:      "test-db",
-								Namespace: defaults.Namespace,
-							},
-							Spec: types.DatabaseSpecV3{
-								Protocol: types.DatabaseProtocolPostgreSQL,
-								URI:      "https://db.localhost",
-							},
-						},
-					})
-				require.NoError(t, err)
-				_, err = a.UpsertDatabaseServer(context.Background(), db)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleApp,
-			upserter: func(name string) {
-				app, err := types.NewAppV3(
-					types.Metadata{
-						Name:      "test-app",
-						Namespace: defaults.Namespace,
-					},
-					types.AppSpecV3{
-						URI: "https://app.localhost",
-					})
-				require.NoError(t, err)
-				appServer, err := types.NewAppServerV3(
-					types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-					types.AppServerSpecV3{
-						HostID: name,
-						App:    app,
-					})
-				require.NoError(t, err)
-				_, err = a.UpsertApplicationServer(context.Background(), appServer)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleWindowsDesktop,
-			upserter: func(name string) {
-				wds, err := types.NewWindowsDesktopServiceV3(types.Metadata{Name: instance1.account + "-" + instance1.instanceID},
-					types.WindowsDesktopServiceSpecV3{
-						Addr:            "localhost:3028",
-						TeleportVersion: "10.2.2",
-					})
-				require.NoError(t, err)
-
-				_, err = a.UpsertWindowsDesktopService(context.Background(), wds)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleOkta,
-			upserter: func(name string) {
-				app, err := types.NewAppV3(
-					types.Metadata{
-						Name:      "test-app",
-						Namespace: defaults.Namespace,
-					},
-					types.AppSpecV3{
-						URI: "https://app.localhost",
-					})
-				require.NoError(t, err)
-				appServer, err := types.NewAppServerV3(
-					types.Metadata{
-						Name:      name,
-						Namespace: defaults.Namespace,
-					},
-					types.AppServerSpecV3{
-						HostID: name,
-						App:    app,
-					})
-				require.NoError(t, err)
-				appServer.SetOrigin(types.OriginOkta)
-				_, err = a.UpsertApplicationServer(context.Background(), appServer)
-				require.NoError(t, err)
-			},
-		},
-		{
-			role: types.RoleDiscovery,
-		},
-		{
-			role: types.RoleMDM,
-		},
-	}
-
-	ctx = context.WithValue(ctx, ec2ClientKey{}, ec2ClientRunning{})
-
-	for _, tc := range testCases {
-		t.Run(string(tc.role), func(t *testing.T) {
-			request := types.RegisterUsingTokenRequest{
-				Token:               "test_token",
-				NodeName:            "node_name",
-				Role:                tc.role,
-				HostID:              instance1.account + "-" + instance1.instanceID,
-				EC2IdentityDocument: instance1.iid,
-				PublicSSHKey:        sshPublicKey,
-				PublicTLSKey:        tlsPublicKey,
-			}
-
-			// request works with no existing host
-			_, err = a.RegisterUsingToken(ctx, &request)
-			require.NoError(t, err)
-
-			if tc.upserter != nil {
-				// add the server
-				name := instance1.account + "-" + instance1.instanceID
-				tc.upserter(name)
-
-				// request should fail
-				_, err = a.RegisterUsingToken(ctx, &request)
-				expectedErr := &trace.AccessDeniedError{}
-				require.ErrorAs(t, err, &expectedErr, err)
-			}
-		})
-	}
-}
diff --git a/lib/auth/join_env0.go b/lib/auth/join_env0.go
new file mode 100644
index 0000000000000..82b33ad7f3850
--- /dev/null
+++ b/lib/auth/join_env0.go
@@ -0,0 +1,35 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"github.com/gravitational/teleport/lib/join"
+)
+
+// SetEnv0IDTokenValidator sets the validator implementation for env0 OIDC
+// tokens, used in tests.
+func (a *Server) SetEnv0IDTokenValidator(validator join.Env0TokenValidator) {
+	a.env0IDTokenValidator = validator
+}
+
+// GetEnv0IDTokenValidator returns the validator implementation for env0 OIDC
+// tokens.
+func (a *Server) GetEnv0IDTokenValidator() join.Env0TokenValidator {
+	return a.env0IDTokenValidator
+}
diff --git a/lib/auth/join_gcp.go b/lib/auth/join_gcp.go
index 46fcd8a0638ab..089069cdb04f0 100644
--- a/lib/auth/join_gcp.go
+++ b/lib/auth/join_gcp.go
@@ -20,17 +20,22 @@ package auth
 
 import (
 	"context"
-	"slices"
-	"strings"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/gcp"
+	"github.com/gravitational/teleport/lib/join/gcp"
 )
 
-type gcpIDTokenValidator interface {
-	Validate(ctx context.Context, token string) (*gcp.IDTokenClaims, error)
+// GetGCPIDTokenValidator returns the server's configured GCP ID token
+// validator.
+func (a *Server) GetGCPIDTokenValidator() gcp.Validator {
+	return a.gcpIDTokenValidator
+}
+
+// SetGCPIDTokenValidator sets a new GCP ID token validator, used in tests.
+func (a *Server) SetGCPIDTokenValidator(validator gcp.Validator) {
+	a.gcpIDTokenValidator = validator
 }
 
 func (a *Server) checkGCPJoinRequest(
@@ -38,112 +43,13 @@ func (a *Server) checkGCPJoinRequest(
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*gcp.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("IDToken not provided for GCP join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("gcp join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	claims, err := a.gcpIDTokenValidator.Validate(ctx, req.IDToken)
-	if err != nil {
-		a.logger.WarnContext(ctx, "Unable to validate GCP IDToken",
-			"error", err,
-			"claims", claims,
-			"token", pt.GetName(),
-		)
-		return nil, trace.Wrap(err)
-	}
-
-	a.logger.InfoContext(ctx, "GCP VM trying to join cluster",
-		"claims", claims,
-		"token", pt.GetName(),
-	)
-
-	if err := checkGCPAllowRules(token, claims); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return claims, nil
-}
-
-func checkGCPAllowRules(token *types.ProvisionTokenV2, claims *gcp.IDTokenClaims) error {
-	compute := claims.Google.ComputeEngine
-	// unmatchedLocation is true if the location restriction is set and the "google.compute_engine.zone"
-	// claim is not present in the IDToken. This happens when the joining node is not a GCE VM.
-	unmatchedLocation := false
-	// If a single rule passes, accept the IDToken.
-	for _, rule := range token.Spec.GCP.Allow {
-		if !slices.Contains(rule.ProjectIDs, compute.ProjectID) {
-			continue
-		}
-
-		if len(rule.ServiceAccounts) > 0 && !slices.Contains(rule.ServiceAccounts, claims.Email) {
-			continue
-		}
-
-		if len(rule.Locations) > 0 && !slices.ContainsFunc(rule.Locations, func(location string) bool {
-			return isGCPZoneInLocation(location, compute.Zone)
-		}) {
-			unmatchedLocation = true
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
-
-	// If the location restriction is set and the "google.compute_engine.zone" claim is not present in the IDToken,
-	// return a more specific error message.
-	if unmatchedLocation && compute.Zone == "" {
-		return trace.CompareFailed("id token %q claim is empty and didn't match the %q. "+
-			"Services running outside of GCE VM instances are incompatible with %q restriction.", "google.compute_engine.zone", "locations", "location")
-	}
-	return trace.AccessDenied("id token claims did not match any allow rules")
-}
-
-type gcpLocation struct {
-	globalLocation string
-	region         string
-	zone           string
-}
-
-func parseGCPLocation(location string) (*gcpLocation, error) {
-	parts := strings.Split(location, "-")
-	if len(parts) < 2 || len(parts) > 3 {
-		return nil, trace.BadParameter("location %q is not a valid GCP region or zone", location)
-	}
-	globalLocation, region := parts[0], parts[1]
-	var zone string
-	if len(parts) == 3 {
-		zone = parts[2]
-	}
-	return &gcpLocation{
-		globalLocation: globalLocation,
-		region:         region,
-		zone:           zone,
-	}, nil
-}
-
-// isGCPZoneInLocation checks if a zone belongs to a location, which can be
-// either a zone or region.
-func isGCPZoneInLocation(rawLocation, rawZone string) bool {
-	location, err := parseGCPLocation(rawLocation)
-	if err != nil {
-		return false
-	}
-	zone, err := parseGCPLocation(rawZone)
-	if err != nil {
-		return false
-	}
-	// Make sure zone is, in fact, a zone.
-	if zone.zone == "" {
-		return false
-	}
-
-	if location.globalLocation != zone.globalLocation || location.region != zone.region {
-		return false
-	}
-	return location.zone == "" || location.zone == zone.zone
+	claims, err := gcp.CheckIDToken(ctx, &gcp.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Validator:      a.gcpIDTokenValidator,
+	})
+
+	// Where possible, try to return any extracted claims along with the error
+	// to improve audit logs for failed join attempts.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_gcp_test.go b/lib/auth/join_gcp_test.go
deleted file mode 100644
index 186c432a0cc21..0000000000000
--- a/lib/auth/join_gcp_test.go
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/gcp"
-)
-
-type mockGCPTokenValidator struct {
-	tokens map[string]gcp.IDTokenClaims
-}
-
-func (m *mockGCPTokenValidator) Validate(_ context.Context, token string) (*gcp.IDTokenClaims, error) {
-	claims, ok := m.tokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-	return &claims, nil
-}
-
-func TestAuth_RegisterUsingToken_GCP(t *testing.T) {
-	t.Parallel()
-
-	validIDToken := "test.fake.jwt"
-	idTokenValidator := &mockGCPTokenValidator{
-		tokens: map[string]gcp.IDTokenClaims{
-			validIDToken: {
-				Email: "service-account@example.com",
-				Google: gcp.Google{
-					ComputeEngine: gcp.ComputeEngine{
-						ProjectID:    "project1",
-						Zone:         "us-west1-b",
-						InstanceID:   "1234",
-						InstanceName: "test-instance",
-					},
-				},
-			},
-		},
-	}
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.gcpIDTokenValidator = idTokenValidator
-		return nil
-	}
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
-	require.NoError(t, err)
-	auth := p.a
-
-	// helper for creating RegisterUsingTokenRequest
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	allowRule := func(modifier func(*types.ProvisionTokenSpecV2GCP_Rule)) *types.ProvisionTokenSpecV2GCP_Rule {
-		rule := &types.ProvisionTokenSpecV2GCP_Rule{
-			ProjectIDs:      []string{"project1"},
-			Locations:       []string{"us-west1-b"},
-			ServiceAccounts: []string{"service-account@example.com"},
-		}
-		if modifier != nil {
-			modifier(rule)
-		}
-		return rule
-	}
-
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorContains(t, err, "id token claims did not match any allow rules")
-		require.True(t, trace.IsAccessDenied(err))
-	})
-	tests := []struct {
-		name        string
-		request     *types.RegisterUsingTokenRequest
-		tokenSpec   types.ProvisionTokenSpecV2
-		assertError require.ErrorAssertionFunc
-	}{
-		{
-			name: "success",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "multiple allow rules",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
-							rule.ProjectIDs = []string{"not-matching"}
-						}),
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "match region to zone",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
-							rule.Locations = []string{"us-west1"}
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "incorrect project id",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
-							rule.ProjectIDs = []string{"not matching"}
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect location",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
-							rule.Locations = []string{"somewhere else"}
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect service account",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGCP,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GCP: &types.ProvisionTokenSpecV2GCP{
-					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
-							rule.ServiceAccounts = []string{"something-else@example.com"}
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			token, err := types.NewProvisionTokenFromSpec(
-				tc.name, time.Now().Add(time.Minute), tc.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tc.request.Token = tc.name
-
-			_, err = auth.RegisterUsingToken(ctx, tc.request)
-			tc.assertError(t, err)
-		})
-	}
-}
-
-func TestIsGCPZoneInLocation(t *testing.T) {
-	t.Parallel()
-	passingCases := []struct {
-		name     string
-		location string
-		zone     string
-	}{
-		{
-			name:     "matching zone",
-			location: "us-west1-b",
-			zone:     "us-west1-b",
-		},
-		{
-			name:     "matching region",
-			location: "us-west1",
-			zone:     "us-west1-b",
-		},
-	}
-	for _, tc := range passingCases {
-		t.Run("accept "+tc.name, func(t *testing.T) {
-			require.True(t, isGCPZoneInLocation(tc.location, tc.zone))
-		})
-	}
-
-	failingCases := []struct {
-		name     string
-		location string
-		zone     string
-	}{
-		{
-			name:     "non-matching zone",
-			location: "europe-southwest1-b",
-			zone:     "us-west1-b",
-		},
-		{
-			name:     "non-matching region",
-			location: "europe-southwest1",
-			zone:     "us-west1-b",
-		},
-		{
-			name:     "malformed location",
-			location: "us",
-			zone:     "us-west1-b",
-		},
-		{
-			name:     "similar but non-matching region",
-			location: "europe-west1",
-			zone:     "europe-west12-a",
-		},
-		{
-			name:     "empty zone",
-			location: "us-west1",
-			zone:     "",
-		},
-		{
-			name:     "empty location",
-			location: "",
-			zone:     "us-west1-b",
-		},
-		{
-			name:     "invalid zone",
-			location: "us-west1",
-			zone:     "us-west1",
-		},
-	}
-	for _, tc := range failingCases {
-		t.Run("reject "+tc.name, func(t *testing.T) {
-			require.False(t, isGCPZoneInLocation(tc.location, tc.zone))
-		})
-	}
-}
diff --git a/lib/auth/join_github.go b/lib/auth/join_github.go
index 8d16e33cbb40b..124dc2bc88c61 100644
--- a/lib/auth/join_github.go
+++ b/lib/auth/join_github.go
@@ -20,113 +20,53 @@ package auth
 
 import (
 	"context"
-	"fmt"
-	"time"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/githubactions"
-	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/join/githubactions"
 )
 
-type ghaIDTokenValidator interface {
-	Validate(
-		ctx context.Context, GHESHost string, enterpriseSlug string, token string,
-	) (*githubactions.IDTokenClaims, error)
+// GetGHAIDTokenValidator returns the validator implementation for GitHub
+// OIDC tokens.
+func (a *Server) GetGHAIDTokenValidator() githubactions.GithubIDTokenValidator {
+	return a.ghaIDTokenValidator
 }
 
-type ghaIDTokenJWKSValidator func(
-	now time.Time, jwksData []byte, token string,
-) (*githubactions.IDTokenClaims, error)
+// SetGHAIDTokenValidator sets the validator implementation for GitHub OIDC
+// tokens, used in tests.
+func (a *Server) SetGHAIDTokenValidator(validator githubactions.GithubIDTokenValidator) {
+	// Note: Unfortunately tests now live in lib/join/ so exporting these
+	// test-only functions in exporter_test.go isn't sufficient.
+	a.ghaIDTokenValidator = validator
+}
+
+// GetGHAIDTokenJWKSValidator returns the validator implementation for GitHub
+// OIDC tokens. This validator is for static JWKS cases where OIDC endpoints are
+// not accessible to Teleport.
+func (a *Server) GetGHAIDTokenJWKSValidator() githubactions.GithubIDTokenJWKSValidator {
+	return a.ghaIDTokenJWKSValidator
+}
+
+// SetGHAIDTokenJWKSValidator returns the validator implementation for GitHub
+// OIDC tokens. This validator is for static JWKS cases where OIDC endpoints are
+// not accessible to Teleport. Used in tests.
+func (a *Server) SetGHAIDTokenJWKSValidator(validator githubactions.GithubIDTokenJWKSValidator) {
+	a.ghaIDTokenJWKSValidator = validator
+}
 
 func (a *Server) checkGitHubJoinRequest(
 	ctx context.Context,
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*githubactions.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("IDToken not provided for Github join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("github join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	// enterpriseOverride is a hostname to use instead of github.com when
-	// validating tokens. This allows GHES instances to be connected.
-	enterpriseOverride := token.Spec.GitHub.EnterpriseServerHost
-	enterpriseSlug := token.Spec.GitHub.EnterpriseSlug
-	if enterpriseOverride != "" || enterpriseSlug != "" {
-		if modules.GetModules().BuildType() != modules.BuildEnterprise {
-			return nil, fmt.Errorf(
-				"github enterprise server joining: %w",
-				ErrRequiresEnterprise,
-			)
-		}
-	}
-
-	var claims *githubactions.IDTokenClaims
-	var err error
-	if token.Spec.GitHub.StaticJWKS != "" {
-		claims, err = a.ghaIDTokenJWKSValidator(
-			a.clock.Now().UTC(),
-			[]byte(token.Spec.GitHub.StaticJWKS),
-			req.IDToken,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "validating with jwks")
-		}
-	} else {
-		claims, err = a.ghaIDTokenValidator.Validate(
-			ctx, enterpriseOverride, enterpriseSlug, req.IDToken,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "validating with oidc")
-		}
-	}
-
-	a.logger.InfoContext(ctx, "Github actions run trying to join cluster",
-		"claims", claims,
-		"token", pt.GetName(),
-	)
-
-	return claims, trace.Wrap(checkGithubAllowRules(token, claims))
-}
-
-func checkGithubAllowRules(token *types.ProvisionTokenV2, claims *githubactions.IDTokenClaims) error {
-	// If a single rule passes, accept the IDToken
-	for _, rule := range token.Spec.GitHub.Allow {
-		// Please consider keeping these field validators in the same order they
-		// are defined within the ProvisionTokenSpecV2Github proto spec.
-		if rule.Sub != "" && claims.Sub != rule.Sub {
-			continue
-		}
-		if rule.Repository != "" && claims.Repository != rule.Repository {
-			continue
-		}
-		if rule.RepositoryOwner != "" && claims.RepositoryOwner != rule.RepositoryOwner {
-			continue
-		}
-		if rule.Workflow != "" && claims.Workflow != rule.Workflow {
-			continue
-		}
-		if rule.Environment != "" && claims.Environment != rule.Environment {
-			continue
-		}
-		if rule.Actor != "" && claims.Actor != rule.Actor {
-			continue
-		}
-		if rule.Ref != "" && claims.Ref != rule.Ref {
-			continue
-		}
-		if rule.RefType != "" && claims.RefType != rule.RefType {
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
+	claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Clock:          a.GetClock(),
+		Validator:      a.ghaIDTokenValidator,
+		JWKSValidator:  a.ghaIDTokenJWKSValidator,
+	})
 
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_github_test.go b/lib/auth/join_github_test.go
deleted file mode 100644
index db4406bde0db4..0000000000000
--- a/lib/auth/join_github_test.go
+++ /dev/null
@@ -1,439 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/githubactions"
-	"github.com/gravitational/teleport/lib/modules"
-)
-
-type mockIDTokenValidator struct {
-	tokens                   map[string]githubactions.IDTokenClaims
-	lastCalledGHESHost       string
-	lastCalledEnterpriseSlug string
-	lastCalledJWKS           string
-}
-
-var errMockInvalidToken = errors.New("invalid token")
-
-func (m *mockIDTokenValidator) Validate(
-	_ context.Context, ghes, enterpriseSlug, token string,
-) (*githubactions.IDTokenClaims, error) {
-	m.lastCalledGHESHost = ghes
-	m.lastCalledEnterpriseSlug = enterpriseSlug
-	claims, ok := m.tokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-
-	return &claims, nil
-}
-
-func (m *mockIDTokenValidator) reset() {
-	m.lastCalledGHESHost = ""
-	m.lastCalledEnterpriseSlug = ""
-	m.lastCalledJWKS = ""
-}
-
-func (m *mockIDTokenValidator) ValidateJWKS(
-	_ time.Time, jwks []byte, token string,
-) (*githubactions.IDTokenClaims, error) {
-	m.lastCalledJWKS = string(jwks)
-	claims, ok := m.tokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-	return &claims, nil
-}
-
-func TestAuth_RegisterUsingToken_GHA(t *testing.T) {
-	validIDToken := "test.fake.jwt"
-	idTokenValidator := &mockIDTokenValidator{
-		tokens: map[string]githubactions.IDTokenClaims{
-			validIDToken: {
-				Sub:             "repo:octo-org/octo-repo:environment:prod",
-				Repository:      "octo-org/octo-repo",
-				RepositoryOwner: "octo-org",
-				Workflow:        "example-workflow",
-				Environment:     "prod",
-				Actor:           "octocat",
-				Ref:             "refs/heads/main",
-				RefType:         "branch",
-			},
-		},
-	}
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.ghaIDTokenValidator = idTokenValidator
-		server.ghaIDTokenJWKSValidator = idTokenValidator.ValidateJWKS
-		return nil
-	}
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
-	require.NoError(t, err)
-	auth := p.a
-
-	// helper for creating RegisterUsingTokenRequest
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	allowRule := func(modifier func(*types.ProvisionTokenSpecV2GitHub_Rule)) *types.ProvisionTokenSpecV2GitHub_Rule {
-		rule := &types.ProvisionTokenSpecV2GitHub_Rule{
-			Sub:             "repo:octo-org/octo-repo:environment:prod",
-			Repository:      "octo-org/octo-repo",
-			RepositoryOwner: "octo-org",
-			Workflow:        "example-workflow",
-			Environment:     "prod",
-			Actor:           "octocat",
-			Ref:             "refs/heads/main",
-			RefType:         "branch",
-		}
-		if modifier != nil {
-			modifier(rule)
-		}
-		return rule
-	}
-
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorContains(t, err, "id token claims did not match any allow rules")
-		require.True(t, trace.IsAccessDenied(err))
-	})
-	tests := []struct {
-		name          string
-		request       *types.RegisterUsingTokenRequest
-		tokenSpec     types.ProvisionTokenSpecV2
-		assertError   require.ErrorAssertionFunc
-		setEnterprise bool
-	}{
-		{
-			name: "success",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "success with jwks",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-					StaticJWKS: "my-jwks",
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "failure with jwks",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-					StaticJWKS: "my-jwks",
-				},
-			},
-			request:     newRequest("invalid"),
-			assertError: require.Error,
-		},
-		{
-			name: "ghes override",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					EnterpriseServerHost: "my.ghes.instance",
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request:       newRequest(validIDToken),
-			assertError:   require.NoError,
-			setEnterprise: true,
-		},
-		{
-			name: "enterprise slug",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					EnterpriseSlug: "slug",
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			setEnterprise: true,
-			request:       newRequest(validIDToken),
-			assertError:   require.NoError,
-		},
-		{
-			name: "ghes override requires enterprise license",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					EnterpriseServerHost: "my.ghes.instance",
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request: newRequest(validIDToken),
-			assertError: require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, ErrRequiresEnterprise)
-			}),
-		},
-		{
-			name: "enterprise slug requires enterprise license",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					EnterpriseSlug: "slug",
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request: newRequest(validIDToken),
-			assertError: require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, ErrRequiresEnterprise)
-			}),
-		},
-		{
-			name: "multiple allow rules",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Sub = "not matching"
-						}),
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name: "incorrect sub",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Sub = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect repository",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Repository = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect repository owner",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.RepositoryOwner = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect workflow",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Workflow = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect environment",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Environment = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect actor",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Actor = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect ref",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.Ref = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name: "incorrect ref type",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodGitHub,
-				Roles:      []types.SystemRole{types.RoleNode},
-				GitHub: &types.ProvisionTokenSpecV2GitHub{
-					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
-							rule.RefType = "not matching"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Cleanup(idTokenValidator.reset)
-			if tt.setEnterprise {
-				modules.SetTestModules(
-					t,
-					&modules.TestModules{TestBuildType: modules.BuildEnterprise},
-				)
-			}
-			token, err := types.NewProvisionTokenFromSpec(
-				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tt.request.Token = tt.name
-
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
-			if err != nil {
-				return
-			}
-
-			require.Equal(
-				t,
-				tt.tokenSpec.GitHub.EnterpriseServerHost,
-				idTokenValidator.lastCalledGHESHost,
-			)
-			require.Equal(
-				t,
-				tt.tokenSpec.GitHub.EnterpriseSlug,
-				idTokenValidator.lastCalledEnterpriseSlug,
-			)
-			require.Equal(
-				t,
-				tt.tokenSpec.GitHub.StaticJWKS,
-				idTokenValidator.lastCalledJWKS,
-			)
-		})
-	}
-}
diff --git a/lib/auth/join_gitlab.go b/lib/auth/join_gitlab.go
index f8820afbf1590..0ec89c2214143 100644
--- a/lib/auth/join_gitlab.go
+++ b/lib/auth/join_gitlab.go
@@ -20,22 +20,23 @@ package auth
 
 import (
 	"context"
-	"regexp"
-	"strings"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/gitlab"
+	"github.com/gravitational/teleport/lib/join/gitlab"
 )
 
-type gitlabIDTokenValidator interface {
-	Validate(
-		ctx context.Context, domain string, token string,
-	) (*gitlab.IDTokenClaims, error)
-	ValidateTokenWithJWKS(
-		ctx context.Context, jwks []byte, token string,
-	) (*gitlab.IDTokenClaims, error)
+// GetGitlabIDTokenValidator returns the currently configured gitlab OIDC token
+// validator.
+func (a *Server) GetGitlabIDTokenValidator() gitlab.Validator {
+	return a.gitlabIDTokenValidator
+}
+
+// SetGitlabIDTokenValidator sets the validator implementation used to verify
+// GitLab OIDC tokens. Used in tests to provide mock implementations.
+func (a *Server) SetGitlabIDTokenValidator(validator gitlab.Validator) {
+	a.gitlabIDTokenValidator = validator
 }
 
 func (a *Server) checkGitLabJoinRequest(
@@ -43,147 +44,13 @@ func (a *Server) checkGitLabJoinRequest(
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*gitlab.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("IDToken not provided for gitlab join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("gitlab join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	var claims *gitlab.IDTokenClaims
-	var err error
-	if token.Spec.GitLab.StaticJWKS != "" {
-		claims, err = a.gitlabIDTokenValidator.ValidateTokenWithJWKS(
-			ctx, []byte(token.Spec.GitLab.StaticJWKS), req.IDToken,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "validating with static jwks")
-		}
-	} else {
-		claims, err = a.gitlabIDTokenValidator.Validate(
-			ctx, token.Spec.GitLab.Domain, req.IDToken,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "validating with oidc")
-		}
-	}
-
-	a.logger.InfoContext(ctx, "GitLab CI run trying to join cluster",
-		"claims", claims,
-		"token", pt.GetName(),
-	)
-
-	return claims, trace.Wrap(checkGitLabAllowRules(token, claims))
-}
-
-// joinRuleGlobMatch is used when comparing some rule fields from a
-// ProvisionToken  against a claim from a token. It allows simple pattern
-// matching:
-// - '*' matches zero or more characters.
-// - '?' matches any single character.
-// It returns true if a match is detected.
-func joinRuleGlobMatch(want string, got string) (bool, error) {
-	if want == "" {
-		return true, nil
-	}
-	return globMatch(want, got)
-}
-
-// globMatch performs simple a simple glob-style match test on a string.
-// - '*' matches zero or more characters.
-// - '?' matches any single character.
-// It returns true if a match is detected.
-func globMatch(pattern, str string) (bool, error) {
-	pattern = regexp.QuoteMeta(pattern)
-	pattern = strings.ReplaceAll(pattern, `\*`, ".*")
-	pattern = strings.ReplaceAll(pattern, `\?`, ".")
-	pattern = "^" + pattern + "$"
-	matched, err := regexp.MatchString(pattern, str)
-	return matched, trace.Wrap(err)
-}
-
-func checkGitLabAllowRules(token *types.ProvisionTokenV2, claims *gitlab.IDTokenClaims) error {
-	// Helper for comparing a BoolOption with GitLabs string bool.
-	// Returns true if OK - returns false if not OK
-	boolEqual := func(want *types.BoolOption, got string) bool {
-		if want == nil {
-			return true
-		}
-		return (want.Value && got == "true") || (!want.Value && got == "false")
-	}
-
-	// If a single rule passes, accept the IDToken
-	for i, rule := range token.Spec.GitLab.Allow {
-		// Please consider keeping these field validators in the same order they
-		// are defined within the ProvisionTokenSpecV2GitLab proto spec.
-		subMatches, err := joinRuleGlobMatch(rule.Sub, claims.Sub)
-		if err != nil {
-			return trace.Wrap(err, "evaluating rule (%d) sub match", i)
-		}
-		if !subMatches {
-			continue
-		}
-		refMatches, err := joinRuleGlobMatch(rule.Ref, claims.Ref)
-		if err != nil {
-			return trace.Wrap(err, "evaluating rule (%d) ref match", i)
-		}
-		if !refMatches {
-			continue
-		}
-		if rule.RefType != "" && claims.RefType != rule.RefType {
-			continue
-		}
-		namespacePathMatches, err := joinRuleGlobMatch(rule.NamespacePath, claims.NamespacePath)
-		if err != nil {
-			return trace.Wrap(err, "evaluating rule (%d) namespace_path match", i)
-		}
-		if !namespacePathMatches {
-			continue
-		}
-		projectPathMatches, err := joinRuleGlobMatch(rule.ProjectPath, claims.ProjectPath)
-		if err != nil {
-			return trace.Wrap(err, "evaluating rule (%d) project_path match", i)
-		}
-		if !projectPathMatches {
-			continue
-		}
-		if rule.PipelineSource != "" && claims.PipelineSource != rule.PipelineSource {
-			continue
-		}
-		if rule.Environment != "" && claims.Environment != rule.Environment {
-			continue
-		}
-		if rule.UserLogin != "" && claims.UserLogin != rule.UserLogin {
-			continue
-		}
-		if rule.UserID != "" && claims.UserID != rule.UserID {
-			continue
-		}
-		if rule.UserEmail != "" && claims.UserEmail != rule.UserEmail {
-			continue
-		}
-		if !boolEqual(rule.RefProtected, claims.RefProtected) {
-			continue
-		}
-		if !boolEqual(rule.EnvironmentProtected, claims.EnvironmentProtected) {
-			continue
-		}
-		if rule.CIConfigSHA != "" && claims.CIConfigSHA != rule.CIConfigSHA {
-			continue
-		}
-		if rule.CIConfigRefURI != "" && claims.CIConfigRefURI != rule.CIConfigRefURI {
-			continue
-		}
-		if rule.DeploymentTier != "" && claims.DeploymentTier != rule.DeploymentTier {
-			continue
-		}
-		if rule.ProjectVisibility != "" && claims.ProjectVisibility != rule.ProjectVisibility {
-			continue
-		}
-		// All provided rules met.
-		return nil
-	}
-
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	claims, err := gitlab.CheckIDToken(ctx, &gitlab.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Validator:      a.gitlabIDTokenValidator,
+	})
+
+	// Where possible, we try to return any extracted claims along with the
+	// error to provide better audit logs of failed join attempts.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_iam.go b/lib/auth/join_iam.go
index d20a3ddcb6b38..f7d20ef42c06e 100644
--- a/lib/auth/join_iam.go
+++ b/lib/auth/join_iam.go
@@ -19,345 +19,42 @@
 package auth
 
 import (
-	"bufio"
-	"bytes"
 	"context"
-	"encoding/base64"
-	"encoding/json"
-	"net/http"
-	"net/url"
-	"slices"
 
-	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/join/iam"
+	"github.com/gravitational/teleport/lib/join/iamjoin"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/aws"
 )
 
-const (
-	// Hardcoding the sts API version here may be more strict than necessary,
-	// but this is set by the Teleport node and can only be changed when we
-	// update our AWS SDK dependency. Since Auth should always be upgraded
-	// before nodes, we will have a chance to update the check on Auth if we
-	// ever have a need to allow a newer API version.
-	expectedSTSIdentityRequestBody = "Action=GetCallerIdentity&Version=2011-06-15"
-
-	// AWS SignedHeaders will always be lowercase
-	// https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html#sigv4-auth-header-overview
-	challengeHeaderKey = "x-teleport-challenge"
-)
-
-// validateSTSHost returns an error if the given stsHost is not a valid regional
-// endpoint for the AWS STS service, or nil if it is valid. If fips is true, the
-// endpoint must be a valid FIPS endpoint.
-//
-// This is a security-critical check: we are allowing the client to tell us
-// which URL we should use to validate their identity. If the client could pass
-// off an attacker-controlled URL as the STS endpoint, the entire security
-// mechanism of the IAM join method would be compromised.
-//
-// To keep this validation simple and secure, we check the given endpoint
-// against a static list of known valid endpoints. We will need to update this
-// list as AWS adds new regions.
-func validateSTSHost(stsHost string, cfg *iamRegisterConfig) error {
-	valid := slices.Contains(iam.ValidSTSEndpoints(), stsHost)
-	if !valid {
-		return trace.AccessDenied("IAM join request uses unknown STS host %q. "+
-			"This could mean that the Teleport Node attempting to join the cluster is "+
-			"running in a new AWS region which is unknown to this Teleport auth server. "+
-			"Alternatively, if this URL looks suspicious, an attacker may be attempting to "+
-			"join your Teleport cluster. "+
-			"Following is the list of valid STS endpoints known to this auth server. "+
-			"If a legitimate STS endpoint is not included, please file an issue at "+
-			"https://github.com/gravitational/teleport. %v",
-			stsHost, iam.ValidSTSEndpoints())
-	}
-
-	if cfg.fips && !slices.Contains(iam.FIPSSTSEndpoints(), stsHost) {
-		return trace.AccessDenied("node selected non-FIPS STS endpoint (%s) for the IAM join method", stsHost)
-	}
-
-	return nil
-}
-
-// validateSTSIdentityRequest checks that a received sts:GetCallerIdentity
-// request is valid and includes the challenge as a signed header. An example
-// valid request looks like:
-// ```
-// POST / HTTP/1.1
-// Host: sts.amazonaws.com
-// Accept: application/json
-// Authorization: AWS4-HMAC-SHA256 Credential=AAAAAAAAAAAAAAAAAAAA/20211108/us-east-1/sts/aws4_request, SignedHeaders=accept;content-length;content-type;host;x-amz-date;x-amz-security-token;x-teleport-challenge, Signature=999...
-// Content-Length: 43
-// Content-Type: application/x-www-form-urlencoded; charset=utf-8
-// User-Agent: aws-sdk-go/1.37.17 (go1.17.1; darwin; amd64)
-// X-Amz-Date: 20211108T190420Z
-// X-Amz-Security-Token: aaa...
-// X-Teleport-Challenge: 0ezlc3usTAkXeZTcfOazUq0BGrRaKmb4EwODk8U7J5A
-//
-// Action=GetCallerIdentity&Version=2011-06-15
-// ```
-func validateSTSIdentityRequest(req *http.Request, challenge string, cfg *iamRegisterConfig) (err error) {
-	defer func() {
-		// Always log a warning on the Auth server if the function detects an
-		// invalid sts:GetCallerIdentity request, it's either going to be caused
-		// by a node in a unknown region or an attacker.
-		if err != nil {
-			logger.WarnContext(req.Context(), "Detected an invalid sts:GetCallerIdentity used by a client attempting to use the IAM join method", "error", err)
-		}
-	}()
-
-	if err := validateSTSHost(req.Host, cfg); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if req.Method != http.MethodPost {
-		return trace.AccessDenied("sts identity request method %q does not match expected method %q", req.RequestURI, http.MethodPost)
-	}
-
-	if req.Header.Get(challengeHeaderKey) != challenge {
-		return trace.AccessDenied("sts identity request does not include challenge header or it does not match")
-	}
-
-	authHeader := req.Header.Get(aws.AuthorizationHeader)
-
-	sigV4, err := aws.ParseSigV4(authHeader)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if !slices.Contains(sigV4.SignedHeaders, challengeHeaderKey) {
-		return trace.AccessDenied("sts identity request auth header %q does not include "+
-			challengeHeaderKey+" as a signed header", authHeader)
-	}
-
-	body, err := utils.GetAndReplaceRequestBody(req)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if !bytes.Equal([]byte(expectedSTSIdentityRequestBody), body) {
-		return trace.BadParameter("sts request body %q does not equal expected %q", string(body), expectedSTSIdentityRequestBody)
-	}
-
-	return nil
-}
-
-func parseSTSRequest(req []byte) (*http.Request, error) {
-	httpReq, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(req)))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Unset RequestURI and set req.URL instead (necessary quirk of sending a
-	// request parsed by http.ReadRequest). Also, force https here.
-	if httpReq.RequestURI != "/" {
-		return nil, trace.AccessDenied("unexpected sts identity request URI: %q", httpReq.RequestURI)
-	}
-	httpReq.RequestURI = ""
-	httpReq.URL = &url.URL{
-		Scheme: "https",
-		Host:   httpReq.Host,
-	}
-	return httpReq, nil
-}
-
-// awsIdentity holds aws Account and Arn, used for JSON parsing
-type awsIdentity struct {
-	Account string `json:"Account"`
-	Arn     string `json:"Arn"`
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *awsIdentity) JoinAttrs() *workloadidentityv1pb.JoinAttrsAWSIAM {
-	attrs := &workloadidentityv1pb.JoinAttrsAWSIAM{
-		Account: c.Account,
-		Arn:     c.Arn,
-	}
-
-	return attrs
-}
-
-// getCallerIdentityReponse is used for JSON parsing
-type getCallerIdentityResponse struct {
-	GetCallerIdentityResult awsIdentity `json:"GetCallerIdentityResult"`
-}
-
-// stsIdentityResponse is used for JSON parsing
-type stsIdentityResponse struct {
-	GetCallerIdentityResponse getCallerIdentityResponse `json:"GetCallerIdentityResponse"`
-}
-
-// executeSTSIdentityRequest sends the sts:GetCallerIdentity HTTP request to the
-// AWS API, parses the response, and returns the awsIdentity
-func executeSTSIdentityRequest(ctx context.Context, client utils.HTTPDoClient, req *http.Request) (*awsIdentity, error) {
-	if client == nil {
-		client = http.DefaultClient
-	}
-
-	// set the http request context so it can be canceled
-	req = req.WithContext(ctx)
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer resp.Body.Close()
-
-	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, trace.AccessDenied("aws sts api returned status: %q body: %q",
-			resp.Status, body)
-	}
-
-	var identityResponse stsIdentityResponse
-	if err := json.Unmarshal(body, &identityResponse); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	id := &identityResponse.GetCallerIdentityResponse.GetCallerIdentityResult
-	if id.Account == "" {
-		return nil, trace.BadParameter("received empty AWS account ID from sts API")
-	}
-	if id.Arn == "" {
-		return nil, trace.BadParameter("received empty AWS identity ARN from sts API")
-	}
-	return id, nil
-}
-
-// arnMatches returns true if arn matches the pattern.
-// Pattern should be an AWS ARN which may include "*" to match any combination
-// of zero or more characters and "?" to match any single character.
-// See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html
-func arnMatches(pattern, arn string) (bool, error) {
-	return globMatch(pattern, arn)
-}
-
-// checkIAMAllowRules checks if the given identity matches any of the given
-// allowRules.
-func checkIAMAllowRules(identity *awsIdentity, token string, allowRules []*types.TokenRule) error {
-	for _, rule := range allowRules {
-		// if this rule specifies an AWS account, the identity must match
-		if len(rule.AWSAccount) > 0 {
-			if rule.AWSAccount != identity.Account {
-				// account doesn't match, continue to check the next rule
-				continue
-			}
-		}
-		// if this rule specifies an AWS ARN, the identity must match
-		if len(rule.AWSARN) > 0 {
-			matches, err := arnMatches(rule.AWSARN, identity.Arn)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			if !matches {
-				// arn doesn't match, continue to check the next rule
-				continue
-			}
-		}
-		// node identity matches this allow rule
-		return nil
-	}
-	return trace.AccessDenied("instance %v did not match any allow rules in token %v", identity.Arn, token)
-}
-
-// checkIAMRequest checks if the given request satisfies the token rules and
-// included the required challenge.
-//
-// If the joining entity presents a valid IAM identity, this will be returned,
-// even if the identity does not match the token's allow rules. This is to
-// support inclusion in audit logs.
-func (a *Server) checkIAMRequest(ctx context.Context, challenge string, req *proto.RegisterUsingIAMMethodRequest, cfg *iamRegisterConfig) (*awsIdentity, error) {
-	tokenName := req.RegisterUsingTokenRequest.Token
-	provisionToken, err := a.GetToken(ctx, tokenName)
-	if err != nil {
-		return nil, trace.Wrap(err, "getting token")
-	}
-	if provisionToken.GetJoinMethod() != types.JoinMethodIAM {
-		return nil, trace.AccessDenied("this token does not support the IAM join method")
-	}
-
-	// parse the incoming http request to the sts:GetCallerIdentity endpoint
-	identityRequest, err := parseSTSRequest(req.StsIdentityRequest)
-	if err != nil {
-		return nil, trace.Wrap(err, "parsing STS request")
-	}
-
-	// validate that the host, method, and headers are correct and the expected
-	// challenge is included in the signed portion of the request
-	if err := validateSTSIdentityRequest(identityRequest, challenge, cfg); err != nil {
-		return nil, trace.Wrap(err, "validating STS request")
-	}
-
-	// send the signed request to the public AWS API and get the node identity
-	// from the response
-	identity, err := executeSTSIdentityRequest(ctx, a.httpClientForAWSSTS, identityRequest)
-	if err != nil {
-		return nil, trace.Wrap(err, "executing STS request")
-	}
-
-	// check that the node identity matches an allow rule for this token
-	if err := checkIAMAllowRules(identity, provisionToken.GetName(), provisionToken.GetAllowRules()); err != nil {
-		// We return the identity since it's "validated" but does not match the
-		// rules. This allows us to include it in a failed join audit event
-		// as additional context to help the user understand why the join failed.
-		return identity, trace.Wrap(err, "checking allow rules")
-	}
-
-	return identity, nil
-}
-
-func generateIAMChallenge() (string, error) {
-	challenge, err := generateChallenge(base64.RawStdEncoding, 32)
-	return challenge, trace.Wrap(err)
+// SetHTTPClientForAWSSTS sets an HTTP client that will be used for sending
+// client-signed sts:GetCallerIdentity requests to AWS, for tests.
+func (a *Server) SetHTTPClientForAWSSTS(clt utils.HTTPDoClient) {
+	a.httpClientForAWSSTS = clt
 }
 
-type iamRegisterConfig struct {
-	authVersion *semver.Version
-	fips        bool
+// GetHTTPClientForAWSSTS returns an HTTP client that should be used for sending
+// client-signed sts:GetCallerIdentity requests to AWS.
+func (a *Server) GetHTTPClientForAWSSTS() utils.HTTPDoClient {
+	return a.httpClientForAWSSTS
 }
 
-func defaultIAMRegisterConfig(fips bool) *iamRegisterConfig {
-	return &iamRegisterConfig{
-		authVersion: teleport.SemVer(),
-		fips:        fips,
-	}
-}
-
-type iamRegisterOption func(cfg *iamRegisterConfig)
-
-func withAuthVersion(v *semver.Version) iamRegisterOption {
-	return func(cfg *iamRegisterConfig) {
-		cfg.authVersion = v
-	}
-}
-
-func withFips(fips bool) iamRegisterOption {
-	return func(cfg *iamRegisterConfig) {
-		cfg.fips = fips
-	}
-}
-
-// RegisterUsingIAMMethodWithOpts registers the caller using the IAM join method and
+// RegisterUsingIAMMethod registers the caller using the IAM join method and
 // returns signed certs to join the cluster.
 //
 // The caller must provide a ChallengeResponseFunc which returns a
 // *types.RegisterUsingTokenRequest with a signed sts:GetCallerIdentity request
 // including the challenge as a signed header.
-func (a *Server) RegisterUsingIAMMethodWithOpts(
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
+func (a *Server) RegisterUsingIAMMethod(
 	ctx context.Context,
 	challengeResponse client.RegisterIAMChallengeResponseFunc,
-	opts ...iamRegisterOption,
 ) (certs *proto.Certs, err error) {
 	var provisionToken types.ProvisionToken
 	var joinRequest *types.RegisterUsingTokenRequest
@@ -371,12 +68,11 @@ func (a *Server) RegisterUsingIAMMethodWithOpts(
 		}
 	}()
 
-	cfg := defaultIAMRegisterConfig(a.fips)
-	for _, opt := range opts {
-		opt(cfg)
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
 	}
 
-	challenge, err := generateIAMChallenge()
+	challenge, err := iamjoin.GenerateIAMChallenge()
 	if err != nil {
 		return nil, trace.Wrap(err, "generating IAM challenge")
 	}
@@ -398,7 +94,13 @@ func (a *Server) RegisterUsingIAMMethodWithOpts(
 	}
 
 	// check that the GetCallerIdentity request is valid and matches the token
-	verifiedIdentity, err := a.checkIAMRequest(ctx, challenge, req, cfg)
+	verifiedIdentity, err := iamjoin.CheckIAMRequest(ctx, &iamjoin.CheckIAMRequestParams{
+		Challenge:          challenge,
+		ProvisionToken:     provisionToken,
+		STSIdentityRequest: req.StsIdentityRequest,
+		HTTPClient:         a.GetHTTPClientForAWSSTS(),
+		FIPS:               a.fips,
+	})
 	if verifiedIdentity != nil {
 		joinFailureMetadata = verifiedIdentity
 	}
@@ -407,30 +109,13 @@ func (a *Server) RegisterUsingIAMMethodWithOpts(
 	}
 
 	if req.RegisterUsingTokenRequest.Role == types.RoleBot {
-		certs, _, err := a.generateCertsBot(
-			ctx,
-			provisionToken,
-			req.RegisterUsingTokenRequest,
-			verifiedIdentity,
-			&workloadidentityv1pb.JoinAttrs{
-				Iam: verifiedIdentity.JoinAttrs(),
-			},
-		)
+		params := makeBotCertsParams(req.RegisterUsingTokenRequest, verifiedIdentity, &workloadidentityv1pb.JoinAttrs{
+			Iam: verifiedIdentity.JoinAttrs(),
+		})
+		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
 		return certs, trace.Wrap(err, "generating bot certs")
 	}
-	certs, err = a.generateCerts(ctx, provisionToken, req.RegisterUsingTokenRequest, verifiedIdentity)
+	params := makeHostCertsParams(req.RegisterUsingTokenRequest, verifiedIdentity)
+	certs, err = a.GenerateHostCertsForJoin(ctx, provisionToken, params)
 	return certs, trace.Wrap(err, "generating certs")
 }
-
-// RegisterUsingIAMMethod registers the caller using the IAM join method and
-// returns signed certs to join the cluster.
-//
-// The caller must provide a ChallengeResponseFunc which returns a
-// *types.RegisterUsingTokenRequest with a signed sts:GetCallerIdentity request
-// including the challenge as a signed header.
-func (a *Server) RegisterUsingIAMMethod(
-	ctx context.Context,
-	challengeResponse client.RegisterIAMChallengeResponseFunc,
-) (certs *proto.Certs, err error) {
-	return a.RegisterUsingIAMMethodWithOpts(ctx, challengeResponse)
-}
diff --git a/lib/auth/join_iam_test.go b/lib/auth/join_iam_test.go
deleted file mode 100644
index a64399d6e7136..0000000000000
--- a/lib/auth/join_iam_test.go
+++ /dev/null
@@ -1,646 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-	"text/template"
-	"time"
-
-	"github.com/coreos/go-semver/semver"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func responseFromAWSIdentity(id awsIdentity) string {
-	return fmt.Sprintf(`{
-		"GetCallerIdentityResponse": {
-			"GetCallerIdentityResult": {
-				"Account": "%s",
-				"Arn": "%s"
-			}}}`, id.Account, id.Arn)
-}
-
-type mockClient struct {
-	respStatusCode int
-	respBody       string
-}
-
-func (c *mockClient) Do(req *http.Request) (*http.Response, error) {
-	return &http.Response{
-		StatusCode: c.respStatusCode,
-		Body:       io.NopCloser(strings.NewReader(c.respBody)),
-	}, nil
-}
-
-var identityRequestTemplate = template.Must(template.New("sts-request").Parse(`POST / HTTP/1.1
-Host: {{.Host}}
-User-Agent: aws-sdk-go/1.37.17 (go1.17.1; darwin; amd64)
-Content-Length: 43
-Accept: application/json
-Authorization: AWS4-HMAC-SHA256 Credential=AAAAAAAAAAAAAAAAAAAA/20211102/us-east-1/sts/aws4_request, SignedHeaders=accept;content-length;content-type;host;x-amz-date;x-amz-security-token;{{.SignedHeader}}, Signature=111
-Content-Type: application/x-www-form-urlencoded; charset=utf-8
-X-Amz-Date: 20211102T204300Z
-X-Amz-Security-Token: aaa
-X-Teleport-Challenge: {{.Challenge}}
-
-Action=GetCallerIdentity&Version=2011-06-15`))
-
-type identityRequestTemplateInput struct {
-	Host         string
-	SignedHeader string
-	Challenge    string
-}
-
-func defaultIdentityRequestTemplateInput(challenge string) identityRequestTemplateInput {
-	return identityRequestTemplateInput{
-		Host:         "sts.amazonaws.com",
-		SignedHeader: "x-teleport-challenge;",
-		Challenge:    challenge,
-	}
-}
-
-type challengeResponseOption func(*identityRequestTemplateInput)
-
-func withHost(host string) challengeResponseOption {
-	return func(templateInput *identityRequestTemplateInput) {
-		templateInput.Host = host
-	}
-}
-
-func withSignedHeader(signedHeader string) challengeResponseOption {
-	return func(templateInput *identityRequestTemplateInput) {
-		templateInput.SignedHeader = signedHeader
-	}
-}
-
-func withChallenge(challenge string) challengeResponseOption {
-	return func(templateInput *identityRequestTemplateInput) {
-		templateInput.Challenge = challenge
-	}
-}
-
-func TestAuth_RegisterUsingIAMMethod(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-	a := p.a
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	isAccessDenied := func(t require.TestingT, err error, _ ...interface{}) {
-		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
-	}
-	isBadParameter := func(t require.TestingT, err error, _ ...interface{}) {
-		require.True(t, trace.IsBadParameter(err), "expected Bad Parameter error, actual error: %v", err)
-	}
-
-	testCases := []struct {
-		desc                     string
-		tokenName                string
-		requestTokenName         string
-		tokenSpec                types.ProvisionTokenSpecV2
-		stsClient                utils.HTTPDoClient
-		iamRegisterOptions       []iamRegisterOption
-		challengeResponseOptions []challengeResponseOption
-		challengeResponseErr     error
-		assertError              require.ErrorAssertionFunc
-	}{
-		{
-			desc:             "basic passing case",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "wildcard arn 1",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::role/admins-*",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::role/admins-test",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "wildcard arn 2",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::role/admins-???",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::role/admins-123",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "arn assumed role",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "123456789012",
-						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "123456789012",
-					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "wildcard arn assumed role",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "123456789012",
-						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role/my-session-name",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "123456789012",
-					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "wildcard 2 arn assumed role",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "123456789012",
-						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role/*",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "123456789012",
-					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
-				}),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "wrong wildcard arn assumed role",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "123456789012",
-						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "123456789012",
-					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-002-test-role/my-session-name",
-				}),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "wrong wildcard 2 arn assumed role",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "123456789012",
-						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "123456789012",
-					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-002-test-role/my-session-name2",
-				}),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "wrong token",
-			tokenName:        "test-token",
-			requestTokenName: "wrong-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "challenge response error",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			challengeResponseErr: trace.BadParameter("test error"),
-			assertError:          isBadParameter,
-		},
-		{
-			desc:             "wrong arn",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::role/admins-???",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::role/admins-1234",
-				}),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "wrong challenge",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withChallenge("wrong-challenge"),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "wrong account",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "5678",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "sts api error",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusForbidden,
-				respBody:       "access denied",
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "wrong sts host",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withHost("sts.wrong-host.amazonaws.com"),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "regional sts endpoint",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withHost("sts.us-west-2.amazonaws.com"),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "unsigned challenge header",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withSignedHeader(""),
-			},
-			assertError: isAccessDenied,
-		},
-		{
-			desc:             "fips pass",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			iamRegisterOptions: []iamRegisterOption{
-				withFips(true),
-				withAuthVersion(&semver.Version{Major: 12}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withHost("sts-fips.us-east-1.amazonaws.com"),
-			},
-			assertError: require.NoError,
-		},
-		{
-			desc:             "non-fips client fail v12",
-			tokenName:        "test-token",
-			requestTokenName: "test-token",
-			tokenSpec: types.ProvisionTokenSpecV2{
-				Roles: []types.SystemRole{types.RoleNode},
-				Allow: []*types.TokenRule{
-					{
-						AWSAccount: "1234",
-						AWSARN:     "arn:aws::1111",
-					},
-				},
-				JoinMethod: types.JoinMethodIAM,
-			},
-			stsClient: &mockClient{
-				respStatusCode: http.StatusOK,
-				respBody: responseFromAWSIdentity(awsIdentity{
-					Account: "1234",
-					Arn:     "arn:aws::1111",
-				}),
-			},
-			iamRegisterOptions: []iamRegisterOption{
-				withFips(true),
-				withAuthVersion(&semver.Version{Major: 12}),
-			},
-			challengeResponseOptions: []challengeResponseOption{
-				withHost("sts.us-east-1.amazonaws.com"),
-			},
-			assertError: isAccessDenied,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			// Set mock client.
-			a.httpClientForAWSSTS = tc.stsClient
-
-			// add token to auth server
-			token, err := types.NewProvisionTokenFromSpec(
-				tc.tokenName,
-				time.Now().Add(time.Minute),
-				tc.tokenSpec)
-			require.NoError(t, err)
-			require.NoError(t, a.UpsertToken(ctx, token))
-			defer func() {
-				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
-			}()
-
-			_, err = a.RegisterUsingIAMMethodWithOpts(context.Background(), func(challenge string) (*proto.RegisterUsingIAMMethodRequest, error) {
-				templateInput := defaultIdentityRequestTemplateInput(challenge)
-				for _, opt := range tc.challengeResponseOptions {
-					opt(&templateInput)
-				}
-				var identityRequest bytes.Buffer
-				require.NoError(t, identityRequestTemplate.Execute(&identityRequest, templateInput))
-
-				req := &proto.RegisterUsingIAMMethodRequest{
-					RegisterUsingTokenRequest: &types.RegisterUsingTokenRequest{
-						Token:        tc.requestTokenName,
-						HostID:       "test-node",
-						Role:         types.RoleNode,
-						PublicSSHKey: sshPublicKey,
-						PublicTLSKey: tlsPublicKey,
-					},
-					StsIdentityRequest: identityRequest.Bytes(),
-				}
-				return req, tc.challengeResponseErr
-			}, tc.iamRegisterOptions...)
-			tc.assertError(t, err)
-		})
-	}
-}
diff --git a/lib/auth/join_kubernetes.go b/lib/auth/join_kubernetes.go
index 27f3d39a6db34..f4d23451c0668 100644
--- a/lib/auth/join_kubernetes.go
+++ b/lib/auth/join_kubernetes.go
@@ -20,8 +20,6 @@ package auth
 
 import (
 	"context"
-	"fmt"
-	"time"
 
 	"github.com/gravitational/trace"
 
@@ -29,75 +27,55 @@ import (
 	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 )
 
-type k8sTokenReviewValidator interface {
-	Validate(ctx context.Context, token, clusterName string) (*kubetoken.ValidationResult, error)
+// GetK8sTokenReviewValidator returns the currently configured validator for
+// Kubernetes Token Review API (in-cluster) tokens.
+func (a *Server) GetK8sTokenReviewValidator() kubetoken.InClusterValidator {
+	return a.k8sTokenReviewValidator
 }
 
-type k8sJWKSValidator func(now time.Time, jwksData []byte, clusterName string, token string) (*kubetoken.ValidationResult, error)
+// SetK8sTokenReviewValidator sets the token review validator implementation,
+// used in tests.
+func (a *Server) SetK8sTokenReviewValidator(validator kubetoken.InClusterValidator) {
+	a.k8sTokenReviewValidator = validator
+}
+
+// GetK8sJWKSValidator returns the currently configured validator for Kubernetes
+// static_jwks tokens.
+func (a *Server) GetK8sJWKSValidator() kubetoken.JWKSValidator {
+	return a.k8sJWKSValidator
+}
+
+// SetK8sJWKSValidator sets the Kubernetes JWKS validator implementation, used
+// in tests.
+func (a *Server) SetK8sJWKSValidator(validator kubetoken.JWKSValidator) {
+	a.k8sJWKSValidator = validator
+}
+
+// GetK8sOIDCValidator returns the currently configured validator for Kubernetes
+// OIDC tokens.
+func (a *Server) GetK8sOIDCValidator() *kubetoken.KubernetesOIDCTokenValidator {
+	return a.k8sOIDCValidator
+}
 
 func (a *Server) checkKubernetesJoinRequest(
 	ctx context.Context,
 	req *types.RegisterUsingTokenRequest,
 	unversionedToken types.ProvisionToken,
 ) (*kubetoken.ValidationResult, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("IDToken not provided for Kubernetes join request")
-	}
-	token, ok := unversionedToken.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter(
-			"kubernetes join method only supports ProvisionTokenV2, '%T' was provided",
-			unversionedToken,
-		)
-	}
-
 	clusterName, err := a.GetDomainName()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	// Switch to join method subtype token validation.
-	var result *kubetoken.ValidationResult
-	switch token.Spec.Kubernetes.Type {
-	case types.KubernetesJoinTypeStaticJWKS:
-		result, err = a.k8sJWKSValidator(
-			a.clock.Now(),
-			[]byte(token.Spec.Kubernetes.StaticJWKS.JWKS),
-			clusterName,
-			req.IDToken,
-		)
-		if err != nil {
-			return nil, trace.WrapWithMessage(err, "reviewing kubernetes token with static_jwks")
-		}
-	case types.KubernetesJoinTypeInCluster, types.KubernetesJoinTypeUnspecified:
-		result, err = a.k8sTokenReviewValidator.Validate(ctx, req.IDToken, clusterName)
-		if err != nil {
-			return nil, trace.WrapWithMessage(err, "reviewing kubernetes token with in_cluster")
-		}
-	default:
-		return nil, trace.BadParameter(
-			"unsupported kubernetes join method type (%s)",
-			token.Spec.Kubernetes.Type,
-		)
-	}
-
-	a.logger.InfoContext(ctx, "Kubernetes workload trying to join cluster",
-		"validated_identity", result,
-		"token", token.GetName(),
-	)
-
-	return result, trace.Wrap(checkKubernetesAllowRules(token, result))
-}
-
-func checkKubernetesAllowRules(pt *types.ProvisionTokenV2, got *kubetoken.ValidationResult) error {
-	// If a single rule passes, accept the token
-	for _, rule := range pt.Spec.Kubernetes.Allow {
-		wantUsername := fmt.Sprintf("%s:%s", kubetoken.ServiceAccountNamePrefix, rule.ServiceAccount)
-		if wantUsername != got.Username {
-			continue
-		}
-		return nil
-	}
+	result, err := kubetoken.CheckIDToken(ctx, &kubetoken.CheckIDTokenParams{
+		ProvisionToken:     unversionedToken,
+		Clock:              a.GetClock(),
+		ClusterName:        clusterName,
+		IDToken:            []byte(req.IDToken),
+		InClusterValidator: a.k8sTokenReviewValidator,
+		JWKSValidator:      a.k8sJWKSValidator,
+		OIDCValidator:      a.k8sOIDCValidator,
+	})
 
-	return trace.AccessDenied("kubernetes token did not match any allow rules")
+	return result, trace.Wrap(err)
 }
diff --git a/lib/auth/join_kubernetes_test.go b/lib/auth/join_kubernetes_test.go
deleted file mode 100644
index 00090d70a124d..0000000000000
--- a/lib/auth/join_kubernetes_test.go
+++ /dev/null
@@ -1,200 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
-)
-
-type mockK8STokenReviewValidator struct {
-	tokens map[string]*kubetoken.ValidationResult
-}
-
-func (m *mockK8STokenReviewValidator) Validate(_ context.Context, token, _ string) (*kubetoken.ValidationResult, error) {
-	result, ok := m.tokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-
-	return result, nil
-}
-
-func TestAuth_RegisterUsingToken_Kubernetes(t *testing.T) {
-	// Test setup
-
-	// Creating an auth server with mock Kubernetes token validator
-	tokenReviewTokens := map[string]*kubetoken.ValidationResult{
-		"matching-implicit-in-cluster": {Username: "system:serviceaccount:namespace1:service-account1"},
-		// "matching-explicit-in-cluster" intentionally matches the second allow
-		// rule of explicitInCluster to ensure all rules are processed.
-		"matching-explicit-in-cluster": {Username: "system:serviceaccount:namespace2:service-account2"},
-		"user-token":                   {Username: "namespace1:service-account1"},
-	}
-	jwksTokens := map[string]*kubetoken.ValidationResult{
-		"jwks-matching-service-account":   {Username: "system:serviceaccount:static-jwks:matching"},
-		"jwks-mismatched-service-account": {Username: "system:serviceaccount:static-jwks:mismatched"},
-	}
-
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), func(server *Server) error {
-		server.k8sTokenReviewValidator = &mockK8STokenReviewValidator{tokens: tokenReviewTokens}
-		server.k8sJWKSValidator = func(_ time.Time, _ []byte, _ string, token string) (*kubetoken.ValidationResult, error) {
-			result, ok := jwksTokens[token]
-			if !ok {
-				return nil, errMockInvalidToken
-			}
-			return result, nil
-		}
-		return nil
-	})
-	require.NoError(t, err)
-	auth := p.a
-
-	// Creating and loading our two Kubernetes ProvisionTokens
-	implicitInClusterPT, err := types.NewProvisionTokenFromSpec("implicit-in-cluster", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
-		JoinMethod: types.JoinMethodKubernetes,
-		Roles:      []types.SystemRole{types.RoleNode},
-		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
-			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
-				{ServiceAccount: "namespace1:service-account1"},
-				{ServiceAccount: "namespace1:service-account2"},
-			},
-		},
-	})
-	require.NoError(t, err)
-	explicitInClusterPT, err := types.NewProvisionTokenFromSpec("explicit-in-cluster", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
-		JoinMethod: types.JoinMethodKubernetes,
-		Roles:      []types.SystemRole{types.RoleNode},
-		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
-			Type: types.KubernetesJoinTypeInCluster,
-			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
-				{ServiceAccount: "namespace2:service-account1"},
-				{ServiceAccount: "namespace2:service-account2"},
-			},
-		},
-	})
-	require.NoError(t, err)
-	staticJWKSPT, err := types.NewProvisionTokenFromSpec("static-jwks", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
-		JoinMethod: types.JoinMethodKubernetes,
-		Roles:      []types.SystemRole{types.RoleNode},
-		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
-			Type: types.KubernetesJoinTypeStaticJWKS,
-			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
-				{ServiceAccount: "static-jwks:matching"},
-			},
-			StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
-				JWKS: "fake-jwks",
-			},
-		},
-	})
-	require.NoError(t, err)
-	require.NoError(t, auth.CreateToken(ctx, implicitInClusterPT))
-	require.NoError(t, auth.CreateToken(ctx, explicitInClusterPT))
-	require.NoError(t, auth.CreateToken(ctx, staticJWKSPT))
-
-	// Building a joinRequest builder
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	newRequest := func(token, idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			Token:        token,
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	tests := []struct {
-		name           string
-		kubeToken      string
-		provisionToken types.ProvisionToken
-		expectedErr    error
-	}{
-		{
-			"in_cluster (implicit): success",
-			"matching-implicit-in-cluster",
-			implicitInClusterPT,
-			nil,
-		},
-		{
-			"in_cluster (explicit): success",
-			"matching-explicit-in-cluster",
-			explicitInClusterPT,
-			nil,
-		},
-		{
-			"in_cluster: service account rule mismatch",
-			"matching-explicit-in-cluster",
-			implicitInClusterPT,
-			trace.AccessDenied("kubernetes token did not match any allow rules"),
-		},
-		{
-			"in_cluster: failed token join (unknown kubeToken)",
-			"unknown",
-			implicitInClusterPT,
-			errMockInvalidToken,
-		},
-		{
-			"in_cluster: failed token join (user token)",
-			"user-token",
-			implicitInClusterPT,
-			trace.AccessDenied("kubernetes token did not match any allow rules"),
-		},
-		{
-			"static_jwks: success",
-			"jwks-matching-service-account",
-			staticJWKSPT,
-			nil,
-		},
-		{
-			"static_jwks: service account rule mismatch",
-			"jwks-mismatched-service-account",
-			staticJWKSPT,
-			trace.AccessDenied("kubernetes token did not match any allow rules"),
-		},
-		{
-			"static_jwks: validation fails",
-			"unknown",
-			staticJWKSPT,
-			errMockInvalidToken,
-		},
-	}
-
-	// Doing the real test
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, err := auth.RegisterUsingToken(ctx, newRequest(tt.provisionToken.GetName(), tt.kubeToken))
-			require.ErrorIs(t, err, tt.expectedErr)
-		})
-	}
-}
diff --git a/lib/auth/join_oracle.go b/lib/auth/join_oracle.go
index 95349ed8c7056..a37bd912e3e67 100644
--- a/lib/auth/join_oracle.go
+++ b/lib/auth/join_oracle.go
@@ -32,10 +32,15 @@ import (
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/join/oracle"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
 )
 
-// RegisterUsingOracleMethod registers the caller using the Oracle join method and
-// returns signed certs to join the cluster.
+// RegisterUsingOracleMethod registers the caller using the legacy Oracle join
+// method and returns signed certs to join the cluster.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
 func (a *Server) RegisterUsingOracleMethod(
 	ctx context.Context,
 	tokenReq *types.RegisterUsingTokenRequest,
@@ -64,6 +69,10 @@ func (a *Server) registerUsingOracleMethod(
 		}
 	}()
 
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
+	}
+
 	challenge, err := generateOracleChallenge()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -83,28 +92,19 @@ func (a *Server) registerUsingOracleMethod(
 	}
 
 	if tokenReq.Role == types.RoleBot {
-		certs, _, err := a.generateCertsBot(
-			ctx,
-			provisionToken,
-			tokenReq,
-			claims,
-			&workloadidentityv1pb.JoinAttrs{
-				Oracle: claims.JoinAttrs(),
-			},
-		)
-		return certs, trace.Wrap(err)
-	}
-	certs, err = a.generateCerts(
-		ctx,
-		provisionToken,
-		tokenReq,
-		claims,
-	)
-	return certs, trace.Wrap(err)
+		params := makeBotCertsParams(tokenReq, claims, &workloadidentityv1pb.JoinAttrs{
+			Oracle: claims.JoinAttrs(),
+		})
+		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
+		return certs, trace.Wrap(err, "generating bot certs")
+	}
+	params := makeHostCertsParams(tokenReq, claims)
+	certs, err = a.GenerateHostCertsForJoin(ctx, provisionToken, params)
+	return certs, trace.Wrap(err, "generating certs")
 }
 
 func generateOracleChallenge() (string, error) {
-	challenge, err := generateChallenge(base64.StdEncoding, 32)
+	challenge, err := joinutils.GenerateChallenge(base64.StdEncoding, 32)
 	return challenge, trace.Wrap(err)
 }
 
@@ -145,25 +145,6 @@ func checkHeaders(headers http.Header, challenge string, clock clockwork.Clock)
 	return nil
 }
 
-func checkOracleAllowRules(claims oracle.Claims, token string, allowRules []*types.ProvisionTokenSpecV2Oracle_Rule) error {
-	for _, rule := range allowRules {
-		if rule.Tenancy != claims.TenancyID {
-			continue
-		}
-		if len(rule.ParentCompartments) != 0 && !slices.Contains(rule.ParentCompartments, claims.CompartmentID) {
-			continue
-		}
-		if len(rule.Regions) != 0 && !slices.ContainsFunc(rule.Regions, func(region string) bool {
-			canonicalRegion, _ := oracle.ParseRegion(region)
-			return canonicalRegion == claims.Region()
-		}) {
-			continue
-		}
-		return nil
-	}
-	return trace.AccessDenied("instance %v did not match any allow rules in token %v", claims.InstanceID, token)
-}
-
 func formatHeaderFromMap(m map[string]string) http.Header {
 	header := make(http.Header, len(m))
 	for k, v := range m {
@@ -226,12 +207,8 @@ func (a *Server) checkOracleRequest(
 	}
 
 	// Check allow rules.
-	tokenV2, ok := provisionToken.(*types.ProvisionTokenV2)
-	if !ok {
-		return oracle.Claims{}, trace.BadParameter("oracle join method only supports ProvisionTokenV2")
-	}
-	if err := checkOracleAllowRules(claims, provisionToken.GetName(), tokenV2.Spec.Oracle.Allow); err != nil {
-		return oracle.Claims{}, trace.Wrap(err)
+	if err := oraclejoin.CheckOracleAllowRules(&claims, provisionToken); err != nil {
+		return claims, trace.Wrap(err)
 	}
 
 	return claims, nil
diff --git a/lib/auth/join_oracle_test.go b/lib/auth/join_oracle_test.go
index 9bf603ff6de4d..264b49ba3511b 100644
--- a/lib/auth/join_oracle_test.go
+++ b/lib/auth/join_oracle_test.go
@@ -14,7 +14,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -26,10 +26,13 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/oracle/oci-go-sdk/v65/common"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/join/oracle"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/fixtures"
@@ -43,12 +46,12 @@ func TestCheckHeaders(t *testing.T) {
 	defaultAuthHeader := `Signature headers="x-date x-teleport-challenge"`
 
 	t.Run("ok", func(t *testing.T) {
-		headers := formatHeaderFromMap(map[string]string{
+		headers := auth.FormatHeaderFromMap(map[string]string{
 			"Authorization":        defaultAuthHeader,
 			oracle.DateHeader:      clock.Now().UTC().Format(http.TimeFormat),
 			oracle.ChallengeHeader: defaultChallenge,
 		})
-		require.NoError(t, checkHeaders(headers, defaultChallenge, clock))
+		require.NoError(t, auth.CheckHeaders(headers, defaultChallenge, clock))
 	})
 
 	tests := []struct {
@@ -112,7 +115,7 @@ func TestCheckHeaders(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			require.Error(t, checkHeaders(formatHeaderFromMap(tc.headers), defaultChallenge, clock))
+			require.Error(t, auth.CheckHeaders(auth.FormatHeaderFromMap(tc.headers), defaultChallenge, clock))
 		})
 	}
 }
@@ -133,174 +136,109 @@ func makeInstanceID(region, id string) string {
 	return makeOCID("instance", region, id)
 }
 
-func TestCheckOracleAllowRules(t *testing.T) {
+func mapFromHeader(header http.Header) map[string]string {
+	out := make(map[string]string, len(header))
+	for k := range header {
+		out[k] = header.Get(k)
+	}
+	return out
+}
+
+func TestOracleTokenValidation(t *testing.T) {
 	t.Parallel()
-	tests := []struct {
-		name       string
-		claims     oracle.Claims
-		allowRules []*types.ProvisionTokenSpecV2Oracle_Rule
-		assert     require.ErrorAssertionFunc
-	}{
-		{
-			name: "ok",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
-			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"us-phoenix-1"},
-				},
-			},
-			assert: require.NoError,
-		},
-		{
-			name: "ok with compartment wildcard",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
-			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy: makeTenancyID("foo"),
-					Regions: []string{"us-phoenix-1"},
-				},
-			},
-			assert: require.NoError,
-		},
-		{
-			name: "ok with region wildcard",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
-			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-				},
-			},
-			assert: require.NoError,
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
 		},
+	})
+	require.NoError(t, err)
+	a, err := server.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	for _, tc := range []struct {
+		desc      string
+		rule      types.ProvisionTokenSpecV2Oracle_Rule
+		assertion assert.ErrorAssertionFunc
+	}{
 		{
-			name: "ok with region abbreviation in id",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("phx", "baz"),
-			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"us-phoenix-1"},
-				},
+			desc: "valid",
+			rule: types.ProvisionTokenSpecV2Oracle_Rule{
+				Tenancy:            "ocid1.tenancy.oc1..mytenant",
+				ParentCompartments: []string{"ocid1.compartment.oc1..mycompartment"},
+				Regions:            []string{"us-phoenix-1"},
+				Instances:          []string{"ocid1.instance.oc1.phx.myinstance"},
 			},
-			assert: require.NoError,
+			assertion: assert.NoError,
 		},
 		{
-			name: "ok with region abbreviation in token",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			desc: "invalid tenant",
+			rule: types.ProvisionTokenSpecV2Oracle_Rule{
+				Tenancy:            "ocid1.badtenancy.oc1..mytenant",
+				ParentCompartments: []string{"ocid1.compartment.oc1..mycompartment"},
+				Regions:            []string{"us-phoenix-1"},
+				Instances:          []string{"ocid1.instance.oc1.phx.myinstance"},
 			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"phx"},
-				},
+			assertion: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				return assert.ErrorAs(t, err, new(*trace.BadParameterError), msgAndArgs...) &&
+					assert.ErrorContains(t, err, "invalid tenant", msgAndArgs...)
 			},
-			assert: require.NoError,
 		},
 		{
-			name: "wrong tenancy",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("something-else"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			desc: "invalid compartment",
+			rule: types.ProvisionTokenSpecV2Oracle_Rule{
+				Tenancy:            "ocid1.tenancy.oc1..mytenant",
+				ParentCompartments: []string{"ocid1.badcompartment.oc1..mycompartment"},
+				Regions:            []string{"us-phoenix-1"},
+				Instances:          []string{"ocid1.instance.oc1.phx.myinstance"},
 			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"us-phoenix-1"},
-				},
+			assertion: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				return assert.ErrorAs(t, err, new(*trace.BadParameterError), msgAndArgs...) &&
+					assert.ErrorContains(t, err, "invalid compartment", msgAndArgs...)
 			},
-			assert: require.Error,
 		},
 		{
-			name: "wrong compartment",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("something-else"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			desc: "invalid region",
+			rule: types.ProvisionTokenSpecV2Oracle_Rule{
+				Tenancy:            "ocid1.tenancy.oc1..mytenant",
+				ParentCompartments: []string{"ocid1.compartment.oc1..mycompartment"},
+				Regions:            []string{"badregion"},
+				Instances:          []string{"ocid1.instance.oc1.phx.myinstance"},
 			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"us-phoenix-1"},
-				},
+			assertion: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				return assert.ErrorAs(t, err, new(*trace.BadParameterError), msgAndArgs...) &&
+					assert.ErrorContains(t, err, "invalid region", msgAndArgs...)
 			},
-			assert: require.Error,
 		},
 		{
-			name: "wrong region",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-ashburn-1", "baz"),
+			desc: "invalid instance",
+			rule: types.ProvisionTokenSpecV2Oracle_Rule{
+				Tenancy:            "ocid1.tenancy.oc1..mytenant",
+				ParentCompartments: []string{"ocid1.compartment.oc1..mycompartment"},
+				Regions:            []string{"us-phoenix-1"},
+				Instances:          []string{"ocid1.badinstance.oc1.phx.myinstance"},
 			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy:            makeTenancyID("foo"),
-					ParentCompartments: []string{makeCompartmentID("bar")},
-					Regions:            []string{"us-phoenix-1"},
-				},
+			assertion: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				return assert.ErrorAs(t, err, new(*trace.BadParameterError), msgAndArgs...) &&
+					assert.ErrorContains(t, err, "invalid instance", msgAndArgs...)
 			},
-			assert: require.Error,
 		},
-		{
-			name: "block match across rules",
-			claims: oracle.Claims{
-				TenancyID:     makeTenancyID("foo"),
-				CompartmentID: makeCompartmentID("bar"),
-				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
-			},
-			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
-				{
-					Tenancy: makeTenancyID("foo"),
-					Regions: []string{"us-ashburn-1"},
-				},
-				{
-					Tenancy: makeTenancyID("something-else"),
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			tokenSpec := types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodOracle,
+				Oracle: &types.ProvisionTokenSpecV2Oracle{
+					Allow: []*types.ProvisionTokenSpecV2Oracle_Rule{&tc.rule},
 				},
-			},
-			assert: require.Error,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			tc.assert(t, checkOracleAllowRules(tc.claims, "mytoken", tc.allowRules))
+			}
+			token, err := types.NewProvisionTokenFromSpec("my-token", time.Now().Add(time.Minute), tokenSpec)
+			require.NoError(t, err)
+			err = a.UpsertToken(t.Context(), token)
+			tc.assertion(t, err)
 		})
 	}
 }
 
-func mapFromHeader(header http.Header) map[string]string {
-	out := make(map[string]string, len(header))
-	for k := range header {
-		out[k] = header.Get(k)
-	}
-	return out
-}
-
 func TestRegisterUsingOracleMethod(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -323,7 +261,7 @@ func TestRegisterUsingOracleMethod(t *testing.T) {
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpec(
@@ -411,8 +349,9 @@ func TestRegisterUsingOracleMethod(t *testing.T) {
 			if tc.modifyTokenRequest != nil {
 				tc.modifyTokenRequest(tokenReq)
 			}
-			_, err = a.registerUsingOracleMethod(
+			_, err = auth.RegisterUsingOracleMethod(
 				ctx,
+				a,
 				tokenReq,
 				func(challenge string) (*proto.OracleSignedRequest, error) {
 					innerHeaders, outerHeaders, err := oracle.CreateSignedRequestWithProvider(provider, challenge)
diff --git a/lib/auth/join_spacelift.go b/lib/auth/join_spacelift.go
index 8797eb4b681c7..891808fd17654 100644
--- a/lib/auth/join_spacelift.go
+++ b/lib/auth/join_spacelift.go
@@ -20,19 +20,23 @@ package auth
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/spacelift"
+	"github.com/gravitational/teleport/lib/join/spacelift"
 )
 
-type spaceliftIDTokenValidator interface {
-	Validate(
-		ctx context.Context, domain string, token string,
-	) (*spacelift.IDTokenClaims, error)
+// GetSpaceliftIDTokenValidator returns the server's currently configured
+// Spacelift OIDC token validator.
+func (a *Server) GetSpaceliftIDTokenValidator() spacelift.Validator {
+	return a.spaceliftIDTokenValidator
+}
+
+// SetSpaceliftIDTokenValidator sets the current Spacelift OIDC token validator,
+// used in tests.
+func (a *Server) SetSpaceliftIDTokenValidator(validator spacelift.Validator) {
+	a.spaceliftIDTokenValidator = validator
 }
 
 func (a *Server) checkSpaceliftJoinRequest(
@@ -40,57 +44,13 @@ func (a *Server) checkSpaceliftJoinRequest(
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*spacelift.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("id_token not provided for spacelift join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("spacelift join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	if modules.GetModules().BuildType() != modules.BuildEnterprise {
-		return nil, fmt.Errorf(
-			"spacelift joining: %w",
-			ErrRequiresEnterprise,
-		)
-	}
-
-	claims, err := a.spaceliftIDTokenValidator.Validate(
-		ctx, token.Spec.Spacelift.Hostname, req.IDToken,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	a.logger.InfoContext(ctx, "Spacelift run trying to join cluster",
-		"claims", claims,
-		"token", pt.GetName(),
-	)
-
-	return claims, trace.Wrap(checkSpaceliftAllowRules(token, claims))
-}
-
-func checkSpaceliftAllowRules(token *types.ProvisionTokenV2, claims *spacelift.IDTokenClaims) error {
-	// If a single rule passes, accept the IDToken
-	for _, rule := range token.Spec.Spacelift.Allow {
-		// Please consider keeping these field validators in the same order they
-		// are defined within the ProvisionTokenSpecV2Spacelift proto spec.
-		if rule.SpaceID != "" && claims.SpaceID != rule.SpaceID {
-			continue
-		}
-		if rule.CallerID != "" && claims.CallerID != rule.CallerID {
-			continue
-		}
-		if rule.CallerType != "" && claims.CallerType != rule.CallerType {
-			continue
-		}
-		if rule.Scope != "" && claims.Scope != rule.Scope {
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
-
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Validator:      a.spaceliftIDTokenValidator,
+	})
+
+	// Attempt to return any claims along with the error, used to improve audit
+	// logging on failed join attempts.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_spacelift_test.go b/lib/auth/join_spacelift_test.go
deleted file mode 100644
index d0694e95c5ff8..0000000000000
--- a/lib/auth/join_spacelift_test.go
+++ /dev/null
@@ -1,282 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/spacelift"
-)
-
-type mockSpaceliftTokenValidator struct {
-	tokens map[string]spacelift.IDTokenClaims
-}
-
-func (m *mockSpaceliftTokenValidator) Validate(
-	_ context.Context, hostname string, token string,
-) (*spacelift.IDTokenClaims, error) {
-	if hostname != "example.app.spacelift.io" {
-		return nil, fmt.Errorf("bad hostname: %s", hostname)
-	}
-
-	claims, ok := m.tokens[token]
-	if !ok {
-		return nil, errMockInvalidToken
-	}
-
-	return &claims, nil
-}
-
-func TestAuth_RegisterUsingToken_Spacelift(t *testing.T) {
-	validIDToken := "test.fake.jwt"
-	idTokenValidator := &mockSpaceliftTokenValidator{
-		tokens: map[string]spacelift.IDTokenClaims{
-			validIDToken: {
-				Sub:        "space:root:stack:machineid-spacelift-test:run_type:TASK:scope:write",
-				SpaceID:    "root",
-				CallerType: "stack",
-				CallerID:   "machineid-spacelift-test",
-				RunType:    "TASK",
-				RunID:      "01HEQ9W9CJ5GWD35SKJ46X789V",
-				Scope:      "write",
-			},
-		},
-	}
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.spaceliftIDTokenValidator = idTokenValidator
-		return nil
-	}
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
-	require.NoError(t, err)
-	auth := p.a
-
-	// helper for creating RegisterUsingTokenRequest
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			IDToken:      idToken,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	allowRule := func(modifier func(*types.ProvisionTokenSpecV2Spacelift_Rule)) *types.ProvisionTokenSpecV2Spacelift_Rule {
-		rule := &types.ProvisionTokenSpecV2Spacelift_Rule{
-			SpaceID:    "root",
-			CallerID:   "machineid-spacelift-test",
-			CallerType: "stack",
-			Scope:      "write",
-		}
-		if modifier != nil {
-			modifier(rule)
-		}
-		return rule
-	}
-
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorContains(t, err, "id token claims did not match any allow rules")
-		require.True(t, trace.IsAccessDenied(err))
-	})
-	tests := []struct {
-		name          string
-		setEnterprise bool
-		request       *types.RegisterUsingTokenRequest
-		tokenSpec     types.ProvisionTokenSpecV2
-		assertError   require.ErrorAssertionFunc
-	}{
-		{
-			name:          "success",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name:          "missing enterprise",
-			setEnterprise: false,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request: newRequest(validIDToken),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(t, err, "requires Teleport Enterprise")
-			},
-		},
-		{
-			name:          "multiple allow rules",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
-							rule.SpaceID = "bar"
-						}),
-						allowRule(nil),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: require.NoError,
-		},
-		{
-			name:          "incorrect space_id",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
-							rule.SpaceID = "bar"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name:          "incorrect caller_id",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
-							rule.CallerID = "bar"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name:          "incorrect caller_type",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
-							rule.CallerType = "bar"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name:          "incorrect scope",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
-							rule.Scope = "bar"
-						}),
-					},
-				},
-			},
-			request:     newRequest(validIDToken),
-			assertError: allowRulesNotMatched,
-		},
-		{
-			name:          "invalid token",
-			setEnterprise: true,
-			tokenSpec: types.ProvisionTokenSpecV2{
-				JoinMethod: types.JoinMethodSpacelift,
-				Roles:      []types.SystemRole{types.RoleNode},
-				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
-					Hostname: "example.app.spacelift.io",
-					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
-						allowRule(nil),
-					},
-				},
-			},
-			request: newRequest("some other token"),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, errMockInvalidToken)
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.setEnterprise {
-				modules.SetTestModules(
-					t,
-					&modules.TestModules{TestBuildType: modules.BuildEnterprise},
-				)
-			}
-
-			token, err := types.NewProvisionTokenFromSpec(
-				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tt.request.Token = tt.name
-
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
-		})
-	}
-}
diff --git a/lib/auth/join_terraformcloud.go b/lib/auth/join_terraformcloud.go
index a7707bd20a88e..a1f5ef0608128 100644
--- a/lib/auth/join_terraformcloud.go
+++ b/lib/auth/join_terraformcloud.go
@@ -20,19 +20,23 @@ package auth
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/terraformcloud"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
 )
 
-type terraformCloudIDTokenValidator interface {
-	Validate(
-		ctx context.Context, audience, hostname, token string,
-	) (*terraformcloud.IDTokenClaims, error)
+// GetTerraformIDTokenValidator returns the server's currently configured
+// Terraform Cloud ID token validator
+func (a *Server) GetTerraformIDTokenValidator() terraformcloud.Validator {
+	return a.terraformIDTokenValidator
+}
+
+// SetTerraformIDTokenValidator sets the current Terraform Cloud OIDC token
+// validator, used in tests.
+func (a *Server) SetTerraformIDTokenValidator(validator terraformcloud.Validator) {
+	a.terraformIDTokenValidator = validator
 }
 
 func (a *Server) checkTerraformCloudJoinRequest(
@@ -40,74 +44,19 @@ func (a *Server) checkTerraformCloudJoinRequest(
 	req *types.RegisterUsingTokenRequest,
 	pt types.ProvisionToken,
 ) (*terraformcloud.IDTokenClaims, error) {
-	if req.IDToken == "" {
-		return nil, trace.BadParameter("id_token not provided for terraform_cloud join request")
-	}
-	token, ok := pt.(*types.ProvisionTokenV2)
-	if !ok {
-		return nil, trace.BadParameter("terraform_cloud join method only supports ProvisionTokenV2, '%T' was provided", pt)
-	}
-
-	hostnameOverride := token.Spec.TerraformCloud.Hostname
-	if hostnameOverride != "" && modules.GetModules().BuildType() != modules.BuildEnterprise {
-		return nil, fmt.Errorf(
-			"terraform_cloud joining for Terraform Enterprise: %w",
-			ErrRequiresEnterprise,
-		)
-	}
-
-	aud := token.Spec.TerraformCloud.Audience
-	if aud == "" {
-		clusterName, err := a.GetClusterName(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		aud = clusterName.GetClusterName()
-	}
-
-	claims, err := a.terraformIDTokenValidator.Validate(
-		ctx, aud, hostnameOverride, req.IDToken,
-	)
+	clusterName, err := a.GetClusterName(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	a.logger.InfoContext(ctx, "Terraform Cloud run trying to join cluster",
-		"claims", claims,
-		"token", pt.GetName(),
-	)
-
-	return claims, trace.Wrap(checkTerraformCloudAllowRules(token, claims))
-}
-
-func checkTerraformCloudAllowRules(token *types.ProvisionTokenV2, claims *terraformcloud.IDTokenClaims) error {
-	for _, rule := range token.Spec.TerraformCloud.Allow {
-		if rule.OrganizationID != "" && claims.OrganizationID != rule.OrganizationID {
-			continue
-		}
-		if rule.OrganizationName != "" && claims.OrganizationName != rule.OrganizationName {
-			continue
-		}
-		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
-			continue
-		}
-		if rule.ProjectName != "" && claims.ProjectName != rule.ProjectName {
-			continue
-		}
-		if rule.WorkspaceID != "" && claims.WorkspaceID != rule.WorkspaceID {
-			continue
-		}
-		if rule.WorkspaceName != "" && claims.WorkspaceName != rule.WorkspaceName {
-			continue
-		}
-		if rule.RunPhase != "" && claims.RunPhase != rule.RunPhase {
-			continue
-		}
-
-		// All provided rules met.
-		return nil
-	}
+	claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        []byte(req.IDToken),
+		Validator:      a.terraformIDTokenValidator,
+		ClusterName:    clusterName.GetClusterName(),
+	})
 
-	return trace.AccessDenied("id token claims did not match any allow rules")
+	// As usual, attempt to return claims regardless of whether or not an error
+	// was encountered.
+	return claims, trace.Wrap(err)
 }
diff --git a/lib/auth/join_test.go b/lib/auth/join_test.go
index 622469434c298..6d35271fc0e9a 100644
--- a/lib/auth/join_test.go
+++ b/lib/auth/join_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -34,12 +34,14 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -82,7 +84,7 @@ func TestAuth_RegisterUsingToken(t *testing.T) {
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 
 	testcases := []struct {
@@ -262,7 +264,7 @@ func TestAuth_RegisterUsingToken(t *testing.T) {
 				if tc.waitTokenDeleted {
 					require.Eventually(t, func() bool {
 						_, err := p.a.ValidateToken(ctx, tc.req.Token)
-						return err != nil && strings.Contains(err.Error(), TokenExpiredOrNotFound)
+						return err != nil && strings.Contains(err.Error(), auth.TokenExpiredOrNotFound)
 					}, time.Millisecond*100, time.Millisecond*10)
 				}
 				return
@@ -297,9 +299,9 @@ func newBotToken(t *testing.T, tokenName, botName string, role types.SystemRole,
 	return token
 }
 
-// TestRegister_Bot tests that a provision token can be used to generate
+// TestJoin_Bot tests that a provision token can be used to generate
 // renewable certificates for a non-interactive user.
-func TestRegister_Bot(t *testing.T) {
+func TestJoin_Bot(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
@@ -367,7 +369,7 @@ func TestRegister_Bot(t *testing.T) {
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			start := srv.Clock().Now()
-			result, err := join.Register(ctx, join.RegisterParams{
+			result, err := joinclient.Join(ctx, joinclient.JoinParams{
 				Token: test.token.GetName(),
 				ID: state.IdentityID{
 					Role: types.RoleBot,
@@ -411,9 +413,9 @@ func TestRegister_Bot(t *testing.T) {
 	}
 }
 
-// TestRegister_Bot_Expiry checks that bot certificate expiry can be set, and
+// TestJoin_Bot_Expiry checks that bot certificate expiry can be set, and
 // does not exceed the limit.
-func TestRegister_Bot_Expiry(t *testing.T) {
+func TestJoin_Bot_Expiry(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
@@ -463,7 +465,7 @@ func TestRegister_Bot_Expiry(t *testing.T) {
 			tok := newBotToken(t, uuid.NewString(), botName, types.RoleBot, srv.Clock().Now().Add(time.Hour))
 			require.NoError(t, srv.Auth().UpsertToken(ctx, tok))
 
-			result, err := join.Register(ctx, join.RegisterParams{
+			result, err := joinclient.Join(ctx, joinclient.JoinParams{
 				Token: tok.GetName(),
 				ID: state.IdentityID{
 					Role: types.RoleBot,
diff --git a/lib/auth/join_tpm.go b/lib/auth/join_tpm.go
index 31334855ddd61..b6f54d71aa83a 100644
--- a/lib/auth/join_tpm.go
+++ b/lib/auth/join_tpm.go
@@ -20,8 +20,6 @@ package auth
 
 import (
 	"context"
-	"crypto/x509"
-	"log/slog"
 
 	"github.com/google/go-attestation/attest"
 	"github.com/gravitational/trace"
@@ -30,7 +28,8 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
+	"github.com/gravitational/teleport/lib/join/tpmjoin"
 	"github.com/gravitational/teleport/lib/tpm"
 )
 
@@ -50,6 +49,10 @@ func (a *Server) RegisterUsingTPMMethod(
 		}
 	}()
 
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
+	}
+
 	// First, check the specified token exists, and is a TPM-type join token.
 	if err := initReq.JoinRequest.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
@@ -66,81 +69,47 @@ func (a *Server) RegisterUsingTPMMethod(
 		return nil, trace.BadParameter("specified join token is not for `tpm` method")
 	}
 
-	if modules.GetModules().BuildType() != modules.BuildEnterprise {
-		return nil, trace.Wrap(
-			ErrRequiresEnterprise,
-			"tpm joining",
-		)
-	}
-
-	// Convert configured CAs to a CAPool
-	var certPool *x509.CertPool
-	if len(ptv2.Spec.TPM.EKCertAllowedCAs) > 0 {
-		certPool = x509.NewCertPool()
-		for i, ca := range ptv2.Spec.TPM.EKCertAllowedCAs {
-			if ok := certPool.AppendCertsFromPEM([]byte(ca)); !ok {
-				return nil, trace.BadParameter(
-					"ekcert_allowed_cas[%d] has an invalid or malformed PEM", i,
-				)
-			}
+	solve := func(ec *attest.EncryptedCredential) ([]byte, error) {
+		solution, err := solveChallenge(tpm.EncryptedCredentialToProto(ec))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+		return solution.Solution, nil
 	}
 
-	// TODO(noah): Use logger from TeleportProcess.
-	validatedEK, err := a.tpmValidator(ctx, slog.Default(), tpm.ValidateParams{
+	validatedEK, err := tpmjoin.CheckTPMRequest(ctx, tpmjoin.CheckTPMRequestParams{
+		Token:        ptv2,
+		TPMValidator: a.GetTPMValidator(),
 		EKCert:       initReq.GetEkCert(),
 		EKKey:        initReq.GetEkKey(),
 		AttestParams: tpm.AttestationParametersFromProto(initReq.AttestationParams),
-		AllowedCAs:   certPool,
-		Solve: func(ec *attest.EncryptedCredential) ([]byte, error) {
-			solution, err := solveChallenge(tpm.EncryptedCredentialToProto(ec))
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return solution.Solution, nil
-		},
+		Solve:        solve,
 	})
 	if validatedEK != nil {
 		joinFailureMetadata = validatedEK
 	}
 	if err != nil {
-		return nil, trace.Wrap(err, "validating TPM EK")
-	}
-
-	if err := checkTPMAllowRules(validatedEK, ptv2.Spec.TPM.Allow); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	if initReq.JoinRequest.Role == types.RoleBot {
-		certs, _, err := a.generateCertsBot(
-			ctx,
-			ptv2,
-			initReq.JoinRequest,
-			validatedEK,
-			&workloadidentityv1pb.JoinAttrs{
-				Tpm: validatedEK.JoinAttrs(),
-			},
-		)
+		params := makeBotCertsParams(initReq.JoinRequest, validatedEK, &workloadidentityv1pb.JoinAttrs{
+			Tpm: validatedEK.JoinAttrs(),
+		})
+		certs, _, err := a.GenerateBotCertsForJoin(ctx, ptv2, params)
 		return certs, trace.Wrap(err, "generating certs for bot")
 	}
-	certs, err := a.generateCerts(
-		ctx, ptv2, initReq.JoinRequest, validatedEK,
-	)
+	params := makeHostCertsParams(initReq.JoinRequest, validatedEK)
+	certs, err := a.GenerateHostCertsForJoin(ctx, ptv2, params)
 	return certs, trace.Wrap(err, "generating certs for host")
 }
 
-func checkTPMAllowRules(tpm *tpm.ValidatedTPM, rules []*types.ProvisionTokenSpecV2TPM_Rule) error {
-	// If a single rule passes, accept the TPM
-	for _, rule := range rules {
-		if rule.EKPublicHash != "" && tpm.EKPubHash != rule.EKPublicHash {
-			continue
-		}
-		if rule.EKCertificateSerial != "" && tpm.EKCertSerial != rule.EKCertificateSerial {
-			continue
-		}
+// GetTPMValidator returns the server's TPM validator.
+func (a *Server) GetTPMValidator() tpmjoin.TPMValidator {
+	return a.tpmValidator
+}
 
-		// All rules met.
-		return nil
-	}
-	return trace.AccessDenied("validated tpm attributes did not match any allow rules")
+// SetTPMValidator sets the server's TPM validator.
+func (a *Server) SetTPMValidator(v tpmjoin.TPMValidator) {
+	a.tpmValidator = v
 }
diff --git a/lib/auth/join_tpm_test.go b/lib/auth/join_tpm_test.go
deleted file mode 100644
index edfe2b4481152..0000000000000
--- a/lib/auth/join_tpm_test.go
+++ /dev/null
@@ -1,358 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package auth
-
-import (
-	"bytes"
-	"context"
-	"crypto/x509"
-	"errors"
-	"log/slog"
-	"testing"
-	"time"
-
-	"github.com/google/go-attestation/attest"
-	gocmp "github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	apifixtures "github.com/gravitational/teleport/api/fixtures"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/tpm"
-)
-
-type mockTPMValidator struct {
-	lastCalledParams   *tpm.ValidateParams
-	returnErr          error
-	returnValidatedTPM *tpm.ValidatedTPM
-}
-
-func (m *mockTPMValidator) setup(returns *tpm.ValidatedTPM, err error) {
-	m.lastCalledParams = nil
-	m.returnErr = err
-	m.returnValidatedTPM = returns
-}
-
-func (m *mockTPMValidator) validate(
-	_ context.Context, _ *slog.Logger, params tpm.ValidateParams,
-) (*tpm.ValidatedTPM, error) {
-	m.lastCalledParams = &params
-
-	solution, err := params.Solve(&attest.EncryptedCredential{
-		Secret:     []byte("mock-secret"),
-		Credential: []byte("mock-credential"),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if !bytes.Equal(solution, []byte("mock-solution")) {
-		return nil, trace.AccessDenied("invalid solution")
-	}
-
-	return m.returnValidatedTPM, m.returnErr
-}
-
-func TestServer_RegisterUsingTPMMethod(t *testing.T) {
-	ctx := context.Background()
-	mockValidator := &mockTPMValidator{}
-	p, err := newTestPack(ctx, t.TempDir(), func(server *Server) error {
-		server.tpmValidator = mockValidator.validate
-		return nil
-	})
-	require.NoError(t, err)
-	auth := p.a
-
-	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
-	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
-	require.NoError(t, err)
-
-	attParams := &proto.TPMAttestationParameters{
-		Public: []byte("mock-public"),
-	}
-
-	const (
-		goodEKPubHash       = "mock-ekpub-hashed"
-		goodEKCertSerial    = "mock-ekcert-serial"
-		goodEKPubHashAlt    = "mock-ekpub-hashed-alt"
-		goodEKCertSerialAlt = "mock-ekcert-serial-alt"
-	)
-	tokenSpec := func(mutate func(v2 *types.ProvisionTokenSpecV2)) types.ProvisionTokenSpecV2 {
-		spec := types.ProvisionTokenSpecV2{
-			JoinMethod: types.JoinMethodTPM,
-			Roles:      []types.SystemRole{types.RoleNode},
-			TPM: &types.ProvisionTokenSpecV2TPM{
-				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
-					{
-						Description:  "ekpub only",
-						EKPublicHash: goodEKPubHash,
-					},
-					{
-						Description:         "ekcert only",
-						EKCertificateSerial: goodEKCertSerial,
-					},
-					{
-						Description:         "both",
-						EKPublicHash:        goodEKPubHashAlt,
-						EKCertificateSerial: goodEKCertSerialAlt,
-					},
-				},
-			},
-		}
-		if mutate != nil {
-			mutate(&spec)
-		}
-		return spec
-	}
-	joinRequest := func() *types.RegisterUsingTokenRequest {
-		return &types.RegisterUsingTokenRequest{
-			HostID:       "host-id",
-			Role:         types.RoleNode,
-			PublicTLSKey: tlsPublicKey,
-			PublicSSHKey: sshPublicKey,
-		}
-	}
-
-	caPool := x509.NewCertPool()
-	require.True(t, caPool.AppendCertsFromPEM([]byte(apifixtures.TLSCACertPEM)))
-
-	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
-		require.ErrorContains(t, err, "validated tpm attributes did not match any allow rules")
-		require.True(t, trace.IsAccessDenied(err))
-	})
-	tests := []struct {
-		name   string
-		setOSS bool
-
-		tokenSpec types.ProvisionTokenSpecV2
-
-		validateReturnTPM *tpm.ValidatedTPM
-		validateReturnErr error
-
-		initReq    *proto.RegisterUsingTPMMethodInitialRequest
-		wantParams *tpm.ValidateParams
-
-		assertError require.ErrorAssertionFunc
-	}{
-		{
-			name:        "success, ekpub",
-			assertError: require.NoError,
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkKey{
-					EkKey: []byte("mock-ekpub"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKKey:        []byte("mock-ekpub"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-			},
-
-			tokenSpec: tokenSpec(nil),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKPubHash: goodEKPubHash,
-			},
-		},
-		{
-			name:        "success, ekcert",
-			assertError: require.NoError,
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkCert{
-					EkCert: []byte("mock-ekcert"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKCert:       []byte("mock-ekcert"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-				AllowedCAs:   caPool,
-			},
-
-			tokenSpec: tokenSpec(func(v2 *types.ProvisionTokenSpecV2) {
-				v2.TPM.EKCertAllowedCAs = []string{apifixtures.TLSCACertPEM}
-			}),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKCertSerial:   goodEKCertSerial,
-				EKCertVerified: true,
-			},
-		},
-		{
-			name:        "success, both ek cert serial and ek pub hash match",
-			assertError: require.NoError,
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkCert{
-					EkCert: []byte("mock-ekcert"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKCert:       []byte("mock-ekcert"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-			},
-
-			tokenSpec: tokenSpec(nil),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKCertSerial:   goodEKCertSerialAlt,
-				EKPubHash:      goodEKPubHashAlt,
-				EKCertVerified: true,
-			},
-		},
-		{
-			name:        "failure, mismatched ekpub",
-			assertError: allowRulesNotMatched,
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkKey{
-					EkKey: []byte("mock-ekpub"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKKey:        []byte("mock-ekpub"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-			},
-
-			tokenSpec: tokenSpec(nil),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKPubHash: "mock-ekpub-hashed-mismatched!",
-			},
-		},
-		{
-			name:        "failure, mismatched ekcert",
-			assertError: allowRulesNotMatched,
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkCert{
-					EkCert: []byte("mock-ekcert"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKCert:       []byte("mock-ekcert"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-			},
-
-			tokenSpec: tokenSpec(nil),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKCertSerial: "mock-ekcert-serial-mismatched!",
-			},
-		},
-		{
-			name: "failure, verification",
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				assert.ErrorContains(t, err, "capacitor overcharged")
-			},
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkCert{
-					EkCert: []byte("mock-ekcert"),
-				},
-				AttestationParams: attParams,
-			},
-			wantParams: &tpm.ValidateParams{
-				EKCert:       []byte("mock-ekcert"),
-				AttestParams: tpm.AttestationParametersFromProto(attParams),
-			},
-
-			tokenSpec: tokenSpec(nil),
-			validateReturnTPM: &tpm.ValidatedTPM{
-				EKCertSerial: goodEKCertSerial,
-			},
-			validateReturnErr: errors.New("capacitor overcharged"),
-		},
-		{
-			name:   "failure, no enterprise",
-			setOSS: true,
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				assert.ErrorIs(t, err, ErrRequiresEnterprise)
-			},
-
-			initReq: &proto.RegisterUsingTPMMethodInitialRequest{
-				JoinRequest: joinRequest(),
-				Ek: &proto.RegisterUsingTPMMethodInitialRequest_EkCert{
-					EkCert: []byte("mock-ekcert"),
-				},
-				AttestationParams: attParams,
-			},
-
-			tokenSpec: tokenSpec(nil),
-		},
-	}
-
-	solver := func(t *testing.T) func(ec *proto.TPMEncryptedCredential) (
-		*proto.RegisterUsingTPMMethodChallengeResponse, error,
-	) {
-		return func(ec *proto.TPMEncryptedCredential) (
-			*proto.RegisterUsingTPMMethodChallengeResponse, error,
-		) {
-			assert.Equal(t, []byte("mock-secret"), ec.Secret)
-			assert.Equal(t, []byte("mock-credential"), ec.CredentialBlob)
-			return &proto.RegisterUsingTPMMethodChallengeResponse{
-				Solution: []byte("mock-solution"),
-			}, nil
-		}
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			mockValidator.setup(tt.validateReturnTPM, tt.validateReturnErr)
-			if !tt.setOSS {
-				modules.SetTestModules(
-					t,
-					&modules.TestModules{TestBuildType: modules.BuildEnterprise},
-				)
-			}
-
-			token, err := types.NewProvisionTokenFromSpec(
-				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
-			)
-			require.NoError(t, err)
-			require.NoError(t, auth.CreateToken(ctx, token))
-			tt.initReq.JoinRequest.Token = tt.name
-
-			_, err = auth.RegisterUsingTPMMethod(
-				ctx,
-				tt.initReq,
-				solver(t))
-			tt.assertError(t, err)
-
-			assert.Empty(t,
-				gocmp.Diff(
-					tt.wantParams,
-					mockValidator.lastCalledParams,
-					cmpopts.IgnoreFields(tpm.ValidateParams{}, "Solve"),
-				),
-			)
-		})
-	}
-}
diff --git a/lib/auth/keygen/keygen.go b/lib/auth/keygen/keygen.go
index 6133a90c907c7..e3aa58facaaa2 100644
--- a/lib/auth/keygen/keygen.go
+++ b/lib/auth/keygen/keygen.go
@@ -36,8 +36,8 @@ import (
 	"github.com/gravitational/teleport/lib/sshca"
 )
 
-// Keygen is a key generator that precomputes keys to provide quick access to
-// public/private key pairs.
+// Keygen is named poorly, it provides methods for generating and signing SSH
+// certificates.
 type Keygen struct {
 	// clock is used to control time.
 	clock clockwork.Clock
diff --git a/lib/auth/keygen/keygen_test.go b/lib/auth/keygen/keygen_test.go
index 9e5c65213a3b5..cefaad2278520 100644
--- a/lib/auth/keygen/keygen_test.go
+++ b/lib/auth/keygen/keygen_test.go
@@ -27,29 +27,44 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth/test"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/sshca"
 )
 
-type nativeContext struct {
-	suite *test.AuthSuite
+type authSuite struct {
+	A      sshca.Authority
+	Keygen func() ([]byte, []byte, error)
+	Clock  clockwork.Clock
 }
 
-func setupNativeContext(ctx context.Context, _ *testing.T) *nativeContext {
-	var tt nativeContext
+func checkCertExpiry(t *testing.T, cert []byte, clock clockwork.Clock, before, after time.Duration) {
+	t.Helper()
 
-	clock := clockwork.NewFakeClockAt(time.Date(2016, 9, 8, 7, 6, 5, 0, time.UTC))
+	certificate, err := sshutils.ParseCertificate(cert)
+	require.NoError(t, err)
+
+	// Check the valid time is not more than 1 minute before the current time.
+	validAfter := time.Unix(int64(certificate.ValidAfter), 0)
+	require.Equal(t, validAfter.Unix(), clock.Now().UTC().Add(before).Unix())
+
+	// Check the valid time is not more than 1 hour after the current time.
+	validBefore := time.Unix(int64(certificate.ValidBefore), 0)
+	require.Equal(t, validBefore.Unix(), clock.Now().UTC().Add(after).Unix())
+}
 
-	tt.suite = &test.AuthSuite{
+func setupAuthSuite(ctx context.Context) *authSuite {
+	clock := clockwork.NewFakeClockAt(time.Now().UTC())
+	return &authSuite{
 		A: New(ctx, SetClock(clock)),
 		Keygen: func() ([]byte, []byte, error) {
 			privateKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
@@ -60,29 +75,216 @@ func setupNativeContext(ctx context.Context, _ *testing.T) *nativeContext {
 		},
 		Clock: clock,
 	}
-
-	return &tt
 }
 
 func TestGenerateKeypairEmptyPass(t *testing.T) {
 	t.Parallel()
 
-	tt := setupNativeContext(context.Background(), t)
-	tt.suite.GenerateKeypairEmptyPass(t)
+	suite := setupAuthSuite(context.Background())
+
+	priv, pub, err := suite.Keygen()
+	require.NoError(t, err)
+
+	// make sure we can parse the private and public key
+	_, err = ssh.ParsePrivateKey(priv)
+	require.NoError(t, err)
+
+	_, _, _, _, err = ssh.ParseAuthorizedKey(pub)
+	require.NoError(t, err)
 }
 
 func TestGenerateHostCert(t *testing.T) {
 	t.Parallel()
 
-	tt := setupNativeContext(context.Background(), t)
-	tt.suite.GenerateHostCert(t)
+	suite := setupAuthSuite(context.Background())
+	priv, pub, err := suite.Keygen()
+	require.NoError(t, err)
+
+	caSigner, err := ssh.ParsePrivateKey(priv)
+	require.NoError(t, err)
+
+	cert, err := suite.A.GenerateHostCert(sshca.HostCertificateRequest{
+		CASigner:      caSigner,
+		PublicHostKey: pub,
+		HostID:        "00000000-0000-0000-0000-000000000000",
+		NodeName:      "auth.example.com",
+		TTL:           time.Hour,
+		Identity: sshca.Identity{
+			ClusterName: "example.com",
+			SystemRole:  types.RoleAdmin,
+		},
+	})
+	require.NoError(t, err)
+
+	checkCertExpiry(t, cert, suite.Clock, -1*time.Minute, time.Hour)
 }
 
 func TestGenerateUserCert(t *testing.T) {
 	t.Parallel()
 
-	tt := setupNativeContext(context.Background(), t)
-	tt.suite.GenerateUserCert(t)
+	suite := setupAuthSuite(context.Background())
+	priv, pub, err := suite.Keygen()
+	require.NoError(t, err)
+
+	caSigner, err := ssh.ParsePrivateKey(priv)
+	require.NoError(t, err)
+
+	cert, err := suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               time.Hour,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:              "user",
+			Principals:            []string{"centos", "root"},
+			PermitAgentForwarding: true,
+			PermitPortForwarding:  true,
+		},
+	})
+	require.NoError(t, err)
+
+	checkCertExpiry(t, cert, suite.Clock, -1*time.Minute, time.Hour)
+
+	cert, err = suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               -20,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:              "user",
+			Principals:            []string{"root"},
+			PermitAgentForwarding: true,
+			PermitPortForwarding:  true,
+		},
+	})
+	require.NoError(t, err)
+
+	checkCertExpiry(t, cert, suite.Clock, -1*time.Minute, defaults.MinCertDuration)
+
+	_, err = suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               0,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:              "user",
+			Principals:            []string{"root"},
+			PermitAgentForwarding: true,
+			PermitPortForwarding:  true,
+		},
+	})
+	require.NoError(t, err)
+
+	checkCertExpiry(t, cert, suite.Clock, -1*time.Minute, defaults.MinCertDuration)
+
+	_, err = suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               time.Hour,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:              "user",
+			Principals:            []string{"root"},
+			PermitAgentForwarding: true,
+			PermitPortForwarding:  true,
+		},
+	})
+	require.NoError(t, err)
+
+	inRoles := []string{"role-1", "role-2"}
+	impersonator := "alice"
+	cert, err = suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               time.Hour,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:              "user",
+			Impersonator:          impersonator,
+			Principals:            []string{"root"},
+			PermitAgentForwarding: true,
+			PermitPortForwarding:  true,
+			Roles:                 inRoles,
+		},
+	})
+	require.NoError(t, err)
+	parsedCert, err := sshutils.ParseCertificate(cert)
+	require.NoError(t, err)
+
+	parsedIdent, err := sshca.DecodeIdentity(parsedCert)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(parsedIdent.Roles, inRoles))
+
+	require.Empty(t, cmp.Diff(parsedIdent.Impersonator, impersonator))
+
+	// Check that MFAVerified and PreviousIdentityExpires are encoded into ssh cert
+	clock := clockwork.NewFakeClock()
+	cert, err = suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:          caSigner,
+		PublicUserKey:     pub,
+		TTL:               time.Minute,
+		CertificateFormat: constants.CertificateFormatStandard,
+		Identity: sshca.Identity{
+			Username:                "user",
+			Principals:              []string{"root"},
+			MFAVerified:             "mfa-device-id",
+			PreviousIdentityExpires: clock.Now().Add(time.Hour),
+		},
+	})
+	require.NoError(t, err)
+	parsedCert, err = sshutils.ParseCertificate(cert)
+	require.NoError(t, err)
+	require.Contains(t, parsedCert.Extensions, teleport.CertExtensionMFAVerified)
+	require.Equal(t, "mfa-device-id", parsedCert.Extensions[teleport.CertExtensionMFAVerified])
+	require.Contains(t, parsedCert.Extensions, teleport.CertExtensionPreviousIdentityExpires)
+	prevIDExpires, err := time.Parse(time.RFC3339, parsedCert.Extensions[teleport.CertExtensionPreviousIdentityExpires])
+	require.NoError(t, err)
+	require.WithinDuration(t, clock.Now().Add(time.Hour), prevIDExpires, time.Second)
+
+	t.Run("device extensions", func(t *testing.T) {
+		const devID = "deviceid1"
+		const devTag = "devicetag1"
+		const devCred = "devicecred1"
+		certRaw, err := suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+			CASigner:      caSigner, // Required.
+			PublicUserKey: pub,      // Required.
+			Identity: sshca.Identity{
+				Username:           "llama",           // Required.
+				Principals:         []string{"llama"}, // Required.
+				DeviceID:           devID,
+				DeviceAssetTag:     devTag,
+				DeviceCredentialID: devCred,
+			},
+		})
+		require.NoError(t, err, "GenerateUserCert failed")
+
+		sshCert, err := sshutils.ParseCertificate(certRaw)
+		require.NoError(t, err, "ParseCertificate failed")
+		assert.Equal(t, devID, sshCert.Extensions[teleport.CertExtensionDeviceID], "DeviceID mismatch")
+		assert.Equal(t, devTag, sshCert.Extensions[teleport.CertExtensionDeviceAssetTag], "AssetTag mismatch")
+		assert.Equal(t, devCred, sshCert.Extensions[teleport.CertExtensionDeviceCredentialID], "CredentialID mismatch")
+	})
+
+	t.Run("github identity", func(t *testing.T) {
+		githubUserID := "1234567"
+		githubUsername := "github-user"
+		certRaw, err := suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+			CASigner:      caSigner, // Required.
+			PublicUserKey: pub,      // Required.
+			Identity: sshca.Identity{
+				Username:       "llama",           // Required.
+				Principals:     []string{"llama"}, // Required.
+				GitHubUserID:   githubUserID,
+				GitHubUsername: githubUsername,
+			},
+		})
+		require.NoError(t, err, "GenerateUserCert failed")
+
+		sshCert, err := sshutils.ParseCertificate(certRaw)
+		require.NoError(t, err, "ParseCertificate failed")
+		assert.Equal(t, githubUserID, sshCert.Extensions[teleport.CertExtensionGitHubUserID])
+		assert.Equal(t, githubUsername, sshCert.Extensions[teleport.CertExtensionGitHubUsername])
+	})
 }
 
 // TestBuildPrincipals makes sure that the list of principals for a host
@@ -97,7 +299,7 @@ func TestGenerateUserCert(t *testing.T) {
 func TestBuildPrincipals(t *testing.T) {
 	t.Parallel()
 
-	tt := setupNativeContext(context.Background(), t)
+	suite := setupAuthSuite(context.Background())
 
 	caPrivateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
 	require.NoError(t, err)
@@ -175,7 +377,7 @@ func TestBuildPrincipals(t *testing.T) {
 	// run tests
 	for _, tc := range tests {
 		t.Logf("Running test case: %q", tc.desc)
-		hostCertificateBytes, err := tt.suite.A.GenerateHostCert(sshca.HostCertificateRequest{
+		hostCertificateBytes, err := suite.A.GenerateHostCert(sshca.HostCertificateRequest{
 			CASigner:      caSigner,
 			PublicHostKey: hostPublicKey,
 			HostID:        tc.inHostID,
@@ -200,7 +402,7 @@ func TestBuildPrincipals(t *testing.T) {
 func TestUserCertCompatibility(t *testing.T) {
 	t.Parallel()
 
-	tt := setupNativeContext(context.Background(), t)
+	suite := setupAuthSuite(context.Background())
 
 	caKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
 	require.NoError(t, err)
@@ -227,7 +429,7 @@ func TestUserCertCompatibility(t *testing.T) {
 	for i, tc := range tests {
 		comment := fmt.Sprintf("Test %v", i)
 
-		userCertificateBytes, err := tt.suite.A.GenerateUserCert(sshca.UserCertificateRequest{
+		userCertificateBytes, err := suite.A.GenerateUserCert(sshca.UserCertificateRequest{
 			CASigner:          caSigner,
 			PublicUserKey:     ssh.MarshalAuthorizedKey(caSigner.PublicKey()),
 			TTL:               time.Hour,
diff --git a/lib/auth/keystore/aws_kms.go b/lib/auth/keystore/aws_kms.go
index 7bb0a784e378b..a09507abb7681 100644
--- a/lib/auth/keystore/aws_kms.go
+++ b/lib/auth/keystore/aws_kms.go
@@ -26,6 +26,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"os"
 	"slices"
 	"strings"
 	"sync"
@@ -36,6 +37,8 @@ import (
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/kms"
 	kmstypes "github.com/aws/aws-sdk-go-v2/service/kms/types"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi"
+	rgttypes "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/aws/smithy-go/tracing/smithyoteltracing"
 	"github.com/gravitational/trace"
@@ -51,8 +54,10 @@ import (
 )
 
 const (
-	awskmsPrefix  = "awskms:"
-	clusterTagKey = "TeleportCluster"
+	awskmsPrefix           = "awskms:"
+	clusterTagKey          = "TeleportCluster"
+	encryptedClusterTagKey = "TeleportClusterEncryption"
+	awsOAEPHash            = crypto.SHA256
 
 	pendingKeyBaseRetryInterval = time.Second / 2
 	pendingKeyMaxRetryInterval  = 4 * time.Second
@@ -64,6 +69,7 @@ const (
 type awsKMSKeystore struct {
 	kms                kmsClient
 	mrk                mrkClient
+	rgt                rgtClient
 	awsAccount         string
 	awsRegion          string
 	multiRegionEnabled bool
@@ -75,10 +81,10 @@ type awsKMSKeystore struct {
 }
 
 func newAWSKMSKeystore(ctx context.Context, cfg *servicecfg.AWSKMSConfig, opts *Options) (*awsKMSKeystore, error) {
-	stsClient, kmsClient := opts.awsSTSClient, opts.awsKMSClient
+	stsClient, kmsClient, rgtClient := opts.awsSTSClient, opts.awsKMSClient, opts.awsRGTClient
 	mrkClient := opts.mrkClient
 
-	if stsClient == nil || kmsClient == nil {
+	if stsClient == nil || kmsClient == nil || rgtClient == nil {
 		useFIPSEndpoint := aws.FIPSEndpointStateUnset
 		if opts.FIPS {
 			useFIPSEndpoint = aws.FIPSEndpointStateEnabled
@@ -108,6 +114,12 @@ func newAWSKMSKeystore(ctx context.Context, cfg *servicecfg.AWSKMSConfig, opts *
 				mrkClient = realKMS
 			}
 		}
+		if rgtClient == nil {
+			rgtClient = resourcegroupstaggingapi.NewFromConfig(awsCfg, func(o *resourcegroupstaggingapi.Options) {
+				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
+				o.Region = cfg.AWSRegion
+			})
+		}
 	}
 	id, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
 	if err != nil {
@@ -120,7 +132,7 @@ func newAWSKMSKeystore(ctx context.Context, cfg *servicecfg.AWSKMSConfig, opts *
 
 	tags := cfg.Tags
 	if tags == nil {
-		tags = make(map[string]string, 1)
+		tags = make(map[string]string, 2)
 	}
 	if _, ok := tags[clusterTagKey]; !ok {
 		tags[clusterTagKey] = opts.ClusterName.GetClusterName()
@@ -148,6 +160,7 @@ func newAWSKMSKeystore(ctx context.Context, cfg *servicecfg.AWSKMSConfig, opts *
 		replicaRegions:     replicas,
 		kms:                kmsClient,
 		mrk:                mrkClient,
+		rgt:                rgtClient,
 		clock:              clock,
 		logger:             opts.Logger,
 	}, nil
@@ -163,12 +176,19 @@ func (a *awsKMSKeystore) keyTypeDescription() string {
 	return fmt.Sprintf("AWS KMS keys in account %s and region %s", a.awsAccount, a.awsRegion)
 }
 
-// generateKey creates a new private key and returns its identifier and a crypto.Signer. The returned
-// identifier can be passed to getSigner later to get an equivalent crypto.Signer.
-func (a *awsKMSKeystore) generateKey(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
+func (u keyUsage) toAWS() kmstypes.KeyUsageType {
+	switch u {
+	case keyUsageDecrypt:
+		return kmstypes.KeyUsageTypeEncryptDecrypt
+	default:
+		return kmstypes.KeyUsageTypeSignVerify
+	}
+}
+
+func (a *awsKMSKeystore) generateKey(ctx context.Context, algorithm cryptosuites.Algorithm, usage keyUsage) (awsKMSKeyID, error) {
 	alg, err := awsAlgorithm(algorithm)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return awsKMSKeyID{}, trace.Wrap(err)
 	}
 
 	a.logger.InfoContext(ctx, "Creating new AWS KMS keypair.",
@@ -177,6 +197,9 @@ func (a *awsKMSKeystore) generateKey(ctx context.Context, algorithm cryptosuites
 
 	tags := make([]kmstypes.Tag, 0, len(a.tags))
 	for k, v := range a.tags {
+		if k == clusterTagKey && usage == keyUsageDecrypt {
+			k = encryptedClusterTagKey
+		}
 		tags = append(tags, kmstypes.Tag{
 			TagKey:   aws.String(k),
 			TagValue: aws.String(v),
@@ -186,18 +209,29 @@ func (a *awsKMSKeystore) generateKey(ctx context.Context, algorithm cryptosuites
 	output, err := a.kms.CreateKey(ctx, &kms.CreateKeyInput{
 		Description: aws.String("Teleport CA key"),
 		KeySpec:     alg,
-		KeyUsage:    kmstypes.KeyUsageTypeSignVerify,
+		KeyUsage:    usage.toAWS(),
 		Tags:        tags,
 		MultiRegion: aws.Bool(a.multiRegionEnabled),
 	})
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return awsKMSKeyID{}, trace.Wrap(err)
 	}
 	if output.KeyMetadata == nil {
-		return nil, nil, trace.Errorf("KeyMetadata of generated key is nil")
+		return awsKMSKeyID{}, trace.Errorf("KeyMetadata of generated key is nil")
 	}
 	keyARN := aws.ToString(output.KeyMetadata.Arn)
 	key, err := keyIDFromArn(keyARN)
+	if err != nil {
+		return awsKMSKeyID{}, trace.Wrap(err)
+	}
+
+	return key, nil
+}
+
+// generateSigner creates a new private key and returns its identifier and a crypto.Signer. The returned
+// identifier can be passed to getSigner later to get an equivalent crypto.Signer.
+func (a *awsKMSKeystore) generateSigner(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
+	key, err := a.generateKey(ctx, algorithm, keyUsageSign)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -205,17 +239,37 @@ func (a *awsKMSKeystore) generateKey(ctx context.Context, algorithm cryptosuites
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	signer, err := a.newSigner(ctx, key)
+	signer, err := a.newKMSKey(ctx, key)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 	return keyID, signer, nil
 }
 
+// generateDecrypter creates a new private key and returns its identifier and a crypto.Decrypter. The returned
+// identifier can be passed to getDecrypter later to get an equivalent crypto.Decrypter.
+func (a *awsKMSKeystore) generateDecrypter(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Decrypter, crypto.Hash, error) {
+	key, err := a.generateKey(ctx, algorithm, keyUsageDecrypt)
+	if err != nil {
+		return nil, nil, awsOAEPHash, trace.Wrap(err)
+	}
+	keyID, err := a.applyMRKConfig(ctx, key)
+	if err != nil {
+		return nil, nil, awsOAEPHash, trace.Wrap(err)
+	}
+	decrypter, err := a.newKMSKey(ctx, key)
+	if err != nil {
+		return nil, nil, awsOAEPHash, trace.Wrap(err)
+	}
+	return keyID, decrypter, awsOAEPHash, nil
+}
+
 func awsAlgorithm(alg cryptosuites.Algorithm) (kmstypes.KeySpec, error) {
 	switch alg {
 	case cryptosuites.RSA2048:
 		return kmstypes.KeySpecRsa2048, nil
+	case cryptosuites.RSA4096:
+		return kmstypes.KeySpecRsa4096, nil
 	case cryptosuites.ECDSAP256:
 		return kmstypes.KeySpecEccNistP256, nil
 	}
@@ -228,16 +282,67 @@ func (a *awsKMSKeystore) getSigner(ctx context.Context, rawKey []byte, publicKey
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return a.newSignerWithPublicKey(ctx, key, publicKey)
+	return a.newKMSKeyWithPublicKey(ctx, key, publicKey)
 }
 
-type awsKMSSigner struct {
+// getDecrypter returns a crypto.Decrypter for the given key identifier, if it is found.
+func (a *awsKMSKeystore) getDecrypter(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey, hash crypto.Hash) (crypto.Decrypter, error) {
+	key, err := parseAWSKMSKeyID(rawKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return a.newKMSKeyWithPublicKey(ctx, key, publicKey)
+}
+
+func (a *awsKMSKeystore) findDecryptersByLabel(ctx context.Context, label *types.KeyLabel) ([]crypto.Decrypter, error) {
+	if label == nil || label.Type != storeAWS {
+		return nil, nil
+	}
+
+	describeOut, err := a.kms.DescribeKey(ctx, &kms.DescribeKeyInput{
+		KeyId: aws.String(label.Label),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if describeOut.KeyMetadata.KeyUsage != kmstypes.KeyUsageTypeEncryptDecrypt {
+		return nil, trace.BadParameter("key usage must be encrypt/decrypt to be used as a decrypter")
+	}
+
+	if describeOut.KeyMetadata.KeySpec != kmstypes.KeySpecRsa4096 {
+		return nil, trace.BadParameter("key spec must be RSA 4096 to be used as a decrypter")
+	}
+
+	pubKeyOut, err := a.kms.GetPublicKey(ctx, &kms.GetPublicKeyInput{
+		KeyId: aws.String(label.Label),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	pubKey, err := x509.ParsePKIXPublicKey(pubKeyOut.PublicKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	keyID, err := keyIDFromArn(*describeOut.KeyMetadata.Arn)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	decrypter, err := a.newKMSKeyWithPublicKey(ctx, keyID, pubKey)
+	return []crypto.Decrypter{decrypter}, trace.Wrap(err)
+
+}
+
+type awsKMSKey struct {
 	key awsKMSKeyID
 	pub crypto.PublicKey
 	kms kmsClient
 }
 
-func (a *awsKMSKeystore) newSigner(ctx context.Context, key awsKMSKeyID) (*awsKMSSigner, error) {
+func (a *awsKMSKeystore) newKMSKey(ctx context.Context, key awsKMSKeyID) (*awsKMSKey, error) {
 	var pubkeyDER []byte
 	err := a.retryOnConsistencyError(ctx, func(ctx context.Context) error {
 		a.logger.DebugContext(ctx, "Fetching public key", "key_arn", key.arn)
@@ -259,7 +364,7 @@ func (a *awsKMSKeystore) newSigner(ctx context.Context, key awsKMSKeyID) (*awsKM
 	if err != nil {
 		return nil, trace.Wrap(err, "unexpected error parsing public key der")
 	}
-	return a.newSignerWithPublicKey(ctx, key, pub)
+	return a.newKMSKeyWithPublicKey(ctx, key, pub)
 }
 
 // retryOnConsistencyError handles retrying KMS key operations that may fail
@@ -304,8 +409,8 @@ func (a *awsKMSKeystore) retryOnConsistencyError(ctx context.Context, fn func(ct
 	}
 }
 
-func (a *awsKMSKeystore) newSignerWithPublicKey(_ context.Context, key awsKMSKeyID, publicKey crypto.PublicKey) (*awsKMSSigner, error) {
-	return &awsKMSSigner{
+func (a *awsKMSKeystore) newKMSKeyWithPublicKey(_ context.Context, key awsKMSKeyID, publicKey crypto.PublicKey) (*awsKMSKey, error) {
+	return &awsKMSKey{
 		key: key,
 		pub: publicKey,
 		kms: a.kms,
@@ -313,12 +418,12 @@ func (a *awsKMSKeystore) newSignerWithPublicKey(_ context.Context, key awsKMSKey
 }
 
 // Public returns the public key for the signer.
-func (a *awsKMSSigner) Public() crypto.PublicKey {
+func (a *awsKMSKey) Public() crypto.PublicKey {
 	return a.pub
 }
 
 // Sign signs the message digest.
-func (a *awsKMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
+func (a *awsKMSKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
 	var signingAlg kmstypes.SigningAlgorithmSpec
 	switch opts.HashFunc() {
 	case crypto.SHA256:
@@ -354,6 +459,27 @@ func (a *awsKMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpt
 	return output.Signature, nil
 }
 
+// Decrypt decrypts data encrypted with the public key
+func (a *awsKMSKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error) {
+	var encAlg kmstypes.EncryptionAlgorithmSpec
+	switch a.pub.(type) {
+	case *rsa.PublicKey:
+		encAlg = kmstypes.EncryptionAlgorithmSpecRsaesOaepSha256
+	default:
+		return nil, trace.BadParameter("unsupported key algorithm for AWS KMS decryption")
+	}
+
+	output, err := a.kms.Decrypt(context.TODO(), &kms.DecryptInput{
+		KeyId:               aws.String(a.key.id),
+		CiphertextBlob:      ciphertext,
+		EncryptionAlgorithm: encAlg,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return output.Plaintext, nil
+}
+
 // deleteKey deletes the given key from the KeyStore.
 func (a *awsKMSKeystore) deleteKey(ctx context.Context, rawKey []byte) error {
 	keyID, err := parseAWSKMSKeyID(rawKey)
@@ -367,9 +493,9 @@ func (a *awsKMSKeystore) deleteKey(ctx context.Context, rawKey []byte) error {
 	return trace.Wrap(err, "error deleting AWS KMS key")
 }
 
-// canSignWithKey returns true if this KeyStore is able to sign with the given
+// canUseKey returns true if this KeyStore is able to sign with the given
 // key.
-func (a *awsKMSKeystore) canSignWithKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
+func (a *awsKMSKeystore) canUseKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
 	if keyType != types.PrivateKeyType_AWS_KMS {
 		return false, nil
 	}
@@ -397,7 +523,7 @@ func (a *awsKMSKeystore) canSignWithKey(ctx context.Context, raw []byte, keyType
 func (a *awsKMSKeystore) deleteUnusedKeys(ctx context.Context, activeKeys [][]byte) error {
 	activeAWSKMSKeys := make(map[string]int)
 	for _, activeKey := range activeKeys {
-		keyIsRelevent, err := a.canSignWithKey(ctx, activeKey, keyType(activeKey))
+		keyIsRelevent, err := a.canUseKey(ctx, activeKey, keyType(activeKey))
 		if err != nil {
 			// Don't expect this error to ever hit, safer to return if it does.
 			return trace.Wrap(err)
@@ -418,7 +544,19 @@ func (a *awsKMSKeystore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 
 	var keysToDelete []string
 	var mu sync.RWMutex
-	err := a.forEachKey(ctx, func(ctx context.Context, arn string) error {
+	scopedKeyDeletion := os.Getenv("TELEPORT_UNSTABLE_SCOPED_KMS_KEY_DELETION") == "yes"
+	keyListFn := a.forEachKey
+	if scopedKeyDeletion {
+		keyListFn = a.forEachOwnedKey
+	}
+	err := keyListFn(ctx, func(ctx context.Context, arn string, tags []rgttypes.Tag) error {
+		if slices.ContainsFunc(tags, func(tag rgttypes.Tag) bool {
+			return aws.ToString(tag.Key) == encryptedClusterTagKey
+		}) {
+			// do nothing for keys marked with delete prevention
+			return nil
+		}
+
 		key, err := keyIDFromArn(arn)
 		if err != nil {
 			return trace.Wrap(err)
@@ -435,24 +573,28 @@ func (a *awsKMSKeystore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 			return nil
 		}
 
-		// Check if this key was created by this Teleport cluster.
-		output, err := a.kms.ListResourceTags(ctx, &kms.ListResourceTagsInput{
-			KeyId: aws.String(key.id),
-		})
-		if err != nil {
-			// It's entirely expected that we won't be allowed to fetch
-			// tags for some keys, don't worry about deleting those.
-			a.logger.DebugContext(ctx, "failed to fetch tags for AWS KMS key, skipping", "key_arn", arn, "error", err)
-			return nil
-		}
-
-		// All tags must match for this key to be considered for deletion.
-		for k, v := range a.tags {
-			if !slices.ContainsFunc(output.Tags, func(tag kmstypes.Tag) bool {
-				return aws.ToString(tag.TagKey) == k && aws.ToString(tag.TagValue) == v
-			}) {
+		// When not using the filtered tagging api, check if this key was created by this Teleport
+		// cluster. The ListResourceTags tags API has a much lower rate limit than DescribeKey so
+		// this allows us to do more before getting rate limited.
+		if !scopedKeyDeletion {
+			output, err := a.kms.ListResourceTags(ctx, &kms.ListResourceTagsInput{
+				KeyId: aws.String(key.id),
+			})
+			if err != nil {
+				// It's entirely expected that we won't be allowed to fetch
+				// tags for some keys, don't worry about deleting those.
+				a.logger.DebugContext(ctx, "failed to fetch tags for AWS KMS key, skipping", "key_arn", arn, "error", err)
 				return nil
 			}
+
+			// All tags must match for this key to be considered for deletion.
+			for k, v := range a.tags {
+				if !slices.ContainsFunc(output.Tags, func(tag kmstypes.Tag) bool {
+					return aws.ToString(tag.TagKey) == k && aws.ToString(tag.TagValue) == v
+				}) {
+					return nil
+				}
+			}
 		}
 
 		// Check if this key is not enabled or was created in the past 5 minutes.
@@ -514,7 +656,7 @@ func (a *awsKMSKeystore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 
 // forEachKey calls fn with the AWS key ID of all keys in the AWS account and
 // region that would be returned by ListKeys. It may call fn concurrently.
-func (a *awsKMSKeystore) forEachKey(ctx context.Context, fn func(ctx context.Context, keyARN string) error) error {
+func (a *awsKMSKeystore) forEachKey(ctx context.Context, fn func(ctx context.Context, keyARN string, tags []rgttypes.Tag) error) error {
 	errGroup, ctx := errgroup.WithContext(ctx)
 	marker := ""
 	more := true
@@ -535,13 +677,53 @@ func (a *awsKMSKeystore) forEachKey(ctx context.Context, fn func(ctx context.Con
 		for _, keyEntry := range output.Keys {
 			keyID := aws.ToString(keyEntry.KeyArn)
 			errGroup.Go(func() error {
-				return trace.Wrap(fn(ctx, keyID))
+				return trace.Wrap(fn(ctx, keyID, nil))
 			})
 		}
 	}
 	return trace.Wrap(errGroup.Wait())
 }
 
+// forEachOwnedKey calls fn with the AWS key ID of all owned keys in the AWS account and
+// region that would be returned by GetResources. It may call fn concurrently.
+func (a *awsKMSKeystore) forEachOwnedKey(ctx context.Context, fn func(ctx context.Context, keyARN string, tags []rgttypes.Tag) error) error {
+	const maxGoRoutines = 5
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.SetLimit(maxGoRoutines)
+
+	tagFilters := make([]rgttypes.TagFilter, 0, len(a.tags))
+	for k, v := range a.tags {
+		tagFilters = append(tagFilters, rgttypes.TagFilter{
+			Key: aws.String(k),
+			Values: []string{
+				v,
+			},
+		})
+	}
+
+	var paginationToken string
+	for more := true; more; more = paginationToken != "" {
+		var output, err = a.rgt.GetResources(ctx, &resourcegroupstaggingapi.GetResourcesInput{
+			ResourceTypeFilters: []string{"kms:key"},
+			TagFilters:          tagFilters,
+			ResourcesPerPage:    aws.Int32(100),
+			PaginationToken:     aws.String(paginationToken),
+		})
+		if err != nil {
+			return trace.Wrap(err, "failed to list AWS KMS keys")
+		}
+		paginationToken = aws.ToString(output.PaginationToken)
+		for _, keyEntry := range output.ResourceTagMappingList {
+			keyID := aws.ToString(keyEntry.ResourceARN)
+			errGroup.Go(func() error {
+				return trace.Wrap(fn(ctx, keyID, keyEntry.Tags))
+			})
+		}
+	}
+
+	return trace.Wrap(errGroup.Wait())
+}
+
 func (a *awsKMSKeystore) applyMultiRegionConfig(ctx context.Context, keyID []byte) ([]byte, error) {
 	if keyType(keyID) != types.PrivateKeyType_AWS_KMS {
 		return keyID, nil
@@ -574,8 +756,16 @@ func (a *awsKMSKeystore) applyMRKConfig(ctx context.Context, key awsKMSKeyID) ([
 	}
 
 	client := a.mrk
-	describeKeyOut, err := client.DescribeKey(ctx, &kms.DescribeKeyInput{
-		KeyId: aws.String(key.id),
+	var describeKeyOut *kms.DescribeKeyOutput
+	err := a.retryOnConsistencyError(ctx, func(ctx context.Context) error {
+		var err error
+		describeKeyOut, err = client.DescribeKey(ctx, &kms.DescribeKeyInput{
+			KeyId: aws.String(key.id),
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		return nil
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -731,6 +921,7 @@ type kmsClient interface {
 	DescribeKey(context.Context, *kms.DescribeKeyInput, ...func(*kms.Options)) (*kms.DescribeKeyOutput, error)
 	ListResourceTags(context.Context, *kms.ListResourceTagsInput, ...func(*kms.Options)) (*kms.ListResourceTagsOutput, error)
 	Sign(context.Context, *kms.SignInput, ...func(*kms.Options)) (*kms.SignOutput, error)
+	Decrypt(context.Context, *kms.DecryptInput, ...func(*kms.Options)) (*kms.DecryptOutput, error)
 }
 
 // mrkClient is a client for managing multi-region keys.
@@ -743,3 +934,7 @@ type mrkClient interface {
 type stsClient interface {
 	GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error)
 }
+
+type rgtClient interface {
+	GetResources(context.Context, *resourcegroupstaggingapi.GetResourcesInput, ...func(*resourcegroupstaggingapi.Options)) (*resourcegroupstaggingapi.GetResourcesOutput, error)
+}
diff --git a/lib/auth/keystore/aws_kms_test.go b/lib/auth/keystore/aws_kms_test.go
index f5e02c9ec9db2..7886d7ade84e2 100644
--- a/lib/auth/keystore/aws_kms_test.go
+++ b/lib/auth/keystore/aws_kms_test.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/x509"
 	"fmt"
 	"slices"
@@ -32,6 +33,8 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/kms"
 	kmstypes "github.com/aws/aws-sdk-go-v2/service/kms/types"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi"
+	rgttypes "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
@@ -59,6 +62,7 @@ func TestAWSKMS_DeleteUnusedKeys(t *testing.T) {
 	for _, tc := range []struct {
 		name string
 		tags map[string]string
+		env  map[string]string
 	}{
 		{
 			name: "delete keys with default tags",
@@ -75,10 +79,20 @@ func TestAWSKMS_DeleteUnusedKeys(t *testing.T) {
 				"TeleportCluster": "test-cluster-2",
 			},
 		},
+		{
+			name: "delete keys with tagging api lookup",
+			env: map[string]string{
+				"TELEPORT_UNSTABLE_SCOPED_KMS_KEY_DELETION": "yes",
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			const pageSize int = 4
 			fakeKMS := newFakeAWSKMSService(t, clock, "123456789012", "us-west-2", pageSize)
+			fakeRGT := newFakeAWSRGTService(t, clock, "123456789012", "us-west-2", pageSize, fakeKMS)
+			for key, value := range tc.env {
+				t.Setenv(key, value)
+			}
 			cfg := servicecfg.KeystoreConfig{
 				AWSKMS: &servicecfg.AWSKMSConfig{
 					AWSAccount: "123456789012",
@@ -93,6 +107,7 @@ func TestAWSKMS_DeleteUnusedKeys(t *testing.T) {
 				HostUUID:             "uuid",
 				AuthPreferenceGetter: &fakeAuthPreferenceGetter{types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_HSM_V1},
 				awsKMSClient:         fakeKMS,
+				awsRGTClient:         fakeRGT,
 				awsSTSClient: &fakeAWSSTSClient{
 					account: "123456789012",
 				},
@@ -334,6 +349,65 @@ func TestAWSKeyCreationParameters(t *testing.T) {
 	}
 }
 
+type fakeAWSRGTService struct {
+	kms       *fakeAWSKMSService
+	clock     clockwork.Clock
+	account   string
+	region    string
+	pageLimit int
+}
+
+func newFakeAWSRGTService(t *testing.T, clock clockwork.Clock, account string, region string, pageLimit int, kms *fakeAWSKMSService) *fakeAWSRGTService {
+	return &fakeAWSRGTService{
+		clock:     clock,
+		account:   account,
+		region:    region,
+		pageLimit: pageLimit,
+		kms:       kms,
+	}
+}
+
+func (f *fakeAWSRGTService) GetResources(_ context.Context, input *resourcegroupstaggingapi.GetResourcesInput, _ ...func(*resourcegroupstaggingapi.Options)) (*resourcegroupstaggingapi.GetResourcesOutput, error) {
+	pageLimit := min(int(aws.ToInt32(input.ResourcesPerPage)), f.pageLimit)
+	output := &resourcegroupstaggingapi.GetResourcesOutput{}
+	i := 0
+	if input.PaginationToken != nil && *input.PaginationToken != "" {
+		var err error
+		i, err = strconv.Atoi(aws.ToString(input.PaginationToken))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+keys:
+	for ; i < len(f.kms.keys) && len(output.ResourceTagMappingList) < pageLimit; i++ {
+		for _, t := range input.TagFilters {
+			if !f.kms.keys[i].satisfiesFilter(t) {
+				continue keys
+			}
+		}
+		convertedTags := convertKMSTagsToRGT(f.kms.keys[i].tags)
+		output.ResourceTagMappingList = append(output.ResourceTagMappingList, rgttypes.ResourceTagMapping{
+			ResourceARN: aws.String(f.kms.keys[i].arn.String()),
+			Tags:        convertedTags,
+		})
+	}
+	if i < len(f.kms.keys) {
+		output.PaginationToken = aws.String(strconv.Itoa(i))
+	}
+	return output, nil
+}
+
+func convertKMSTagsToRGT(kmsTags []kmstypes.Tag) []rgttypes.Tag {
+	out := make([]rgttypes.Tag, 0, len(kmsTags))
+	for _, t := range kmsTags {
+		out = append(out, rgttypes.Tag{
+			Key:   t.TagKey,
+			Value: t.TagValue,
+		})
+	}
+	return out
+}
+
 type fakeAWSKMSService struct {
 	keys               []*fakeAWSKMSKey
 	clock              clockwork.Clock
@@ -355,6 +429,7 @@ func newFakeAWSKMSService(t *testing.T, clock clockwork.Clock, account string, r
 type fakeAWSKMSKey struct {
 	arn          arn.ARN
 	privKeyPEM   []byte
+	keyUsage     kmstypes.KeyUsageType
 	tags         []kmstypes.Tag
 	creationDate time.Time
 	state        kmstypes.KeyState
@@ -372,6 +447,24 @@ func (f fakeAWSKMSKey) hasReplica(region string) bool {
 	return region == f.region || slices.Contains(f.replicas, region)
 }
 
+func (f *fakeAWSKMSKey) satisfiesFilter(filter rgttypes.TagFilter) bool {
+	for _, tag := range f.tags {
+		if aws.ToString(tag.TagKey) != aws.ToString(filter.Key) {
+			continue
+		}
+		if len(filter.Values) == 0 {
+			return true
+		}
+		for _, val := range filter.Values {
+			if aws.ToString(tag.TagValue) == aws.ToString(&val) {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 func (f *fakeAWSKMSService) CreateKey(_ context.Context, input *kms.CreateKeyInput, _ ...func(*kms.Options)) (*kms.CreateKeyOutput, error) {
 	id := uuid.NewString()
 	if aws.ToBool(input.MultiRegion) {
@@ -393,6 +486,8 @@ func (f *fakeAWSKMSService) CreateKey(_ context.Context, input *kms.CreateKeyInp
 	switch input.KeySpec {
 	case kmstypes.KeySpecRsa2048:
 		privKeyPEM = testRSA2048PrivateKeyPEM
+	case kmstypes.KeySpecRsa4096:
+		privKeyPEM = testRSA4096PrivateKeyPEM
 	case kmstypes.KeySpecEccNistP256:
 		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
 		if err != nil {
@@ -408,6 +503,7 @@ func (f *fakeAWSKMSService) CreateKey(_ context.Context, input *kms.CreateKeyInp
 	f.keys = append(f.keys, &fakeAWSKMSKey{
 		arn:          a,
 		privKeyPEM:   privKeyPEM,
+		keyUsage:     input.KeyUsage,
 		tags:         input.Tags,
 		creationDate: f.clock.Now(),
 		region:       f.region,
@@ -450,6 +546,9 @@ func (f *fakeAWSKMSService) Sign(_ context.Context, input *kms.SignInput, _ ...f
 	if key.state != kmstypes.KeyStateEnabled {
 		return nil, trace.NotFound("key %q is not enabled", aws.ToString(input.KeyId))
 	}
+	if key.keyUsage != kmstypes.KeyUsageTypeSignVerify {
+		return nil, trace.BadParameter("key %q is not a signing key", aws.ToString(input.KeyId))
+	}
 	signer, err := keys.ParsePrivateKey(key.privKeyPEM)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -472,6 +571,39 @@ func (f *fakeAWSKMSService) Sign(_ context.Context, input *kms.SignInput, _ ...f
 	}, nil
 }
 
+func (f *fakeAWSKMSService) Decrypt(_ context.Context, input *kms.DecryptInput, _ ...func(*kms.Options)) (*kms.DecryptOutput, error) {
+	key, err := f.findKey(aws.ToString(input.KeyId))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if key.state != kmstypes.KeyStateEnabled {
+		return nil, trace.NotFound("key %q is not enabled", aws.ToString(input.KeyId))
+	}
+	if key.keyUsage != kmstypes.KeyUsageTypeEncryptDecrypt {
+		return nil, trace.BadParameter("key %q is not a decryption key", aws.ToString(input.KeyId))
+	}
+	signer, err := keys.ParsePrivateKey(key.privKeyPEM)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	decrypter, ok := signer.Signer.(crypto.Decrypter)
+	if !ok {
+		return nil, trace.Errorf("private key is not a decrypter")
+	}
+	switch input.EncryptionAlgorithm {
+	case kmstypes.EncryptionAlgorithmSpecRsaesOaepSha256:
+	default:
+		return nil, trace.BadParameter("unsupported EncryptionAlgorithm %q", input.EncryptionAlgorithm)
+	}
+	plaintext, err := decrypter.Decrypt(rand.Reader, input.CiphertextBlob, &rsa.OAEPOptions{Hash: crypto.SHA256})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &kms.DecryptOutput{
+		Plaintext: plaintext,
+	}, nil
+}
+
 func (f *fakeAWSKMSService) ScheduleKeyDeletion(_ context.Context, input *kms.ScheduleKeyDeletionInput, _ ...func(*kms.Options)) (*kms.ScheduleKeyDeletionOutput, error) {
 	key, err := f.findKey(aws.ToString(input.KeyId))
 	if err != nil {
@@ -797,5 +929,16 @@ func TestMultiRegionKeyReplication(t *testing.T) {
 			}
 		})
 	}
+}
 
+type fakeAuthPreferenceGetter struct {
+	suite types.SignatureAlgorithmSuite
+}
+
+func (f *fakeAuthPreferenceGetter) GetAuthPreference(context.Context) (types.AuthPreference, error) {
+	return &types.AuthPreferenceV2{
+		Spec: types.AuthPreferenceSpecV2{
+			SignatureAlgorithmSuite: f.suite,
+		},
+	}, nil
 }
diff --git a/lib/auth/keystore/gcp_kms.go b/lib/auth/keystore/gcp_kms.go
index 917487f5fa1da..0cd36d1aebf51 100644
--- a/lib/auth/keystore/gcp_kms.go
+++ b/lib/auth/keystore/gcp_kms.go
@@ -45,7 +45,9 @@ import (
 const (
 	// GCP does not allow "." or "/" in labels
 	hostLabel                      = "teleport_auth_host"
+	encryptedHostLabel             = "teleport_encryption_auth_host"
 	gcpkmsPrefix                   = "gcpkms:"
+	gcpOAEPHash                    = crypto.SHA256
 	defaultGCPRequestTimeout       = 30 * time.Second
 	defaultGCPPendingTimeout       = 2 * time.Minute
 	defaultGCPPendingRetryInterval = 5 * time.Second
@@ -110,25 +112,27 @@ func (g *gcpKMSKeyStore) keyTypeDescription() string {
 	return fmt.Sprintf("GCP KMS keys in keyring %s", g.keyRing)
 }
 
-// generateKey creates a new private key and returns its identifier and a crypto.Signer. The returned
-// identifier for gcpKMSKeyStore encodes the full GCP KMS key version name, and can be passed to getSigner
-// later to get an equivalent crypto.Signer.
-func (g *gcpKMSKeyStore) generateKey(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
-	alg, err := gcpAlgorithm(algorithm)
+func (g *gcpKMSKeyStore) generateKey(ctx context.Context, algorithm cryptosuites.Algorithm, usage keyUsage) (gcpKMSKeyID, error) {
+	alg, err := gcpAlgorithm(usage, algorithm)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return gcpKMSKeyID{}, trace.Wrap(err)
 	}
 
 	keyUUID := uuid.NewString()
 	g.log.InfoContext(ctx, "Creating new GCP KMS keypair.", "id", keyUUID, "algorithm", alg.String())
 
+	label := hostLabel
+	if usage == keyUsageDecrypt {
+		label = encryptedHostLabel
+	}
+
 	req := &kmspb.CreateCryptoKeyRequest{
 		Parent:      g.keyRing,
 		CryptoKeyId: keyUUID,
 		CryptoKey: &kmspb.CryptoKey{
-			Purpose: kmspb.CryptoKey_ASYMMETRIC_SIGN,
+			Purpose: usage.toGCP(),
 			Labels: map[string]string{
-				hostLabel: g.hostUUID,
+				label: g.hostUUID,
 			},
 			VersionTemplate: &kmspb.CryptoKeyVersionTemplate{
 				ProtectionLevel: g.protectionLevel,
@@ -138,40 +142,115 @@ func (g *gcpKMSKeyStore) generateKey(ctx context.Context, algorithm cryptosuites
 	}
 	resp, err := doGCPRequest(ctx, g, g.kmsClient.CreateCryptoKey, req)
 	if err != nil {
-		return nil, nil, trace.Wrap(err, "error while attempting to generate new GCP KMS key")
+		return gcpKMSKeyID{}, trace.Wrap(err, "error while attempting to generate new GCP KMS key")
 	}
 
-	keyID := gcpKMSKeyID{
+	return gcpKMSKeyID{
 		keyVersionName: resp.Name + keyVersionSuffix,
+	}, nil
+}
+
+// generateSigner creates a new private key and returns its identifier and a crypto.Signer. The returned
+// identifier for gcpKMSKeyStore encodes the full GCP KMS key version name, and can be passed to getSigner
+// later to get an equivalent crypto.Signer.
+func (g *gcpKMSKeyStore) generateSigner(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
+	keyID, err := g.generateKey(ctx, algorithm, keyUsageSign)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
 	}
 
-	signer, err := g.newKmsSigner(ctx, keyID)
+	signer, err := g.newKmsKey(ctx, keyID)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 	return keyID.marshal(), signer, nil
 }
 
-func gcpAlgorithm(alg cryptosuites.Algorithm) (kmspb.CryptoKeyVersion_CryptoKeyVersionAlgorithm, error) {
+// generateDecrypter creates a new private key and returns its identifier and a crypto.Decrypter. The returned
+// identifier for gcpKMSKeyStore encodes the full GCP KMS key version name, and can be passed to getDecrypter
+// later to get an equivalent crypto.Decrypter.
+func (g *gcpKMSKeyStore) generateDecrypter(ctx context.Context, algorithm cryptosuites.Algorithm) ([]byte, crypto.Decrypter, crypto.Hash, error) {
+	keyID, err := g.generateKey(ctx, algorithm, keyUsageDecrypt)
+	if err != nil {
+		return nil, nil, gcpOAEPHash, trace.Wrap(err)
+	}
+
+	decrypter, err := g.newKmsKey(ctx, keyID)
+	if err != nil {
+		return nil, nil, gcpOAEPHash, trace.Wrap(err)
+	}
+	return keyID.marshal(), decrypter, gcpOAEPHash, nil
+}
+
+func gcpAlgorithm(usage keyUsage, alg cryptosuites.Algorithm) (kmspb.CryptoKeyVersion_CryptoKeyVersionAlgorithm, error) {
 	switch alg {
 	case cryptosuites.RSA2048:
-		return kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_2048_SHA256, nil
+		switch usage {
+		case keyUsageSign:
+			return kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_2048_SHA256, nil
+		case keyUsageDecrypt:
+			return kmspb.CryptoKeyVersion_RSA_DECRYPT_OAEP_2048_SHA256, nil
+		}
+	case cryptosuites.RSA4096:
+		switch usage {
+		case keyUsageSign:
+			return kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_4096_SHA256, nil
+		case keyUsageDecrypt:
+			return kmspb.CryptoKeyVersion_RSA_DECRYPT_OAEP_4096_SHA256, nil
+		}
 	case cryptosuites.ECDSAP256:
-		return kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256, nil
+		switch usage {
+		case keyUsageSign:
+			return kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256, nil
+		case keyUsageDecrypt:
+			return kmspb.CryptoKeyVersion_CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED, trace.BadParameter("unsupported algorithm for decryption: %v", alg)
+		}
 	}
 	return kmspb.CryptoKeyVersion_CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED, trace.BadParameter("unsupported algorithm: %v", alg)
 }
 
-// getSigner returns a crypto.Signer for the given pem-encoded private key.
+// getSigner returns a crypto.Signer for the given raw private key.
 func (g *gcpKMSKeyStore) getSigner(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey) (crypto.Signer, error) {
 	keyID, err := parseGCPKMSKeyID(rawKey)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	signer, err := g.newKmsSignerWithPublicKey(ctx, keyID, publicKey)
+	signer, err := g.newKmsKeyWithPublicKey(ctx, keyID, publicKey)
 	return signer, trace.Wrap(err)
 }
 
+// getDecrypter returns a crypto.Decrypter for the given raw private key.
+func (g *gcpKMSKeyStore) getDecrypter(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey, hash crypto.Hash) (crypto.Decrypter, error) {
+	keyID, err := parseGCPKMSKeyID(rawKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	signer, err := g.newKmsKeyWithPublicKey(ctx, keyID, publicKey)
+	return signer, trace.Wrap(err)
+}
+
+func (g *gcpKMSKeyStore) findDecryptersByLabel(ctx context.Context, label *types.KeyLabel) ([]crypto.Decrypter, error) {
+	if label == nil || label.Type != storeGCP {
+		return nil, nil
+	}
+
+	keyMeta, err := g.kmsClient.GetCryptoKeyVersion(ctx, &kmspb.GetCryptoKeyVersionRequest{
+		Name: label.Label,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	switch keyMeta.GetAlgorithm() {
+	case kmspb.CryptoKeyVersion_RSA_DECRYPT_OAEP_4096_SHA256:
+	default:
+		return nil, trace.BadParameter("key spec must be RSA 4096 to be used as a decrypter")
+	}
+
+	key, err := g.newKmsKey(ctx, gcpKMSKeyID{keyMeta.GetName()})
+	return []crypto.Decrypter{key}, trace.Wrap(err)
+}
+
 // deleteKey deletes the given key from the KeyStore.
 func (g *gcpKMSKeyStore) deleteKey(ctx context.Context, rawKey []byte) error {
 	keyID, err := parseGCPKMSKeyID(rawKey)
@@ -186,13 +265,13 @@ func (g *gcpKMSKeyStore) deleteKey(ctx context.Context, rawKey []byte) error {
 	return trace.Wrap(err, "error while attempting to delete GCP KMS key")
 }
 
-// canSignWithKey returns true if given a GCP_KMS key in the same key ring
-// managed by this keystore. This means that it's possible (and expected) for
+// canUseKey returns true if given a GCP_KMS key in the same key ring managed
+// by this keystore. This means that it's possible (and expected) for
 // multiple auth servers in a cluster to sign with the same KMS keys if they are
 // configured with the same keyring. This is a divergence from the PKCS#11
 // keystore where different auth servers will always create their own keys even
 // if configured to use the same HSM
-func (g *gcpKMSKeyStore) canSignWithKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
+func (g *gcpKMSKeyStore) canUseKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
 	if keyType != types.PrivateKeyType_GCP_KMS {
 		return false, nil
 	}
@@ -203,6 +282,7 @@ func (g *gcpKMSKeyStore) canSignWithKey(ctx context.Context, raw []byte, keyType
 	if !strings.HasPrefix(keyID.keyVersionName, g.keyRing) {
 		return false, nil
 	}
+
 	return true, nil
 }
 
@@ -228,7 +308,7 @@ func (g *gcpKMSKeyStore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 	// check which keys in KMS are unused.
 	activeKmsKeyVersions := make(map[string]int)
 	for _, activeKey := range activeKeys {
-		keyIsRelevant, err := g.canSignWithKey(ctx, activeKey, keyType(activeKey))
+		keyIsRelevant, err := g.canUseKey(ctx, activeKey, keyType(activeKey))
 		if err != nil {
 			// Don't expect this error to ever hit, safer to return if it does.
 			return trace.Wrap(err)
@@ -240,7 +320,7 @@ func (g *gcpKMSKeyStore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 		}
 		keyID, err := parseGCPKMSKeyID(activeKey)
 		if err != nil {
-			// Realistically we should not hit this since canSignWithKey already
+			// Realistically we should not hit this since canUseKey already
 			// calls parseGCPKMSKeyID.
 			return trace.Wrap(err)
 		}
@@ -304,15 +384,15 @@ func (g *gcpKMSKeyStore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 	return nil
 }
 
-// kmsSigner implements the crypto.Signer interface
-type kmsSigner struct {
+// kmsKey implements the crypto.Signer and crypto.Decrypter interface
+type kmsKey struct {
 	ctx    context.Context
 	g      *gcpKMSKeyStore
 	keyID  gcpKMSKeyID
 	public crypto.PublicKey
 }
 
-func (g *gcpKMSKeyStore) newKmsSigner(ctx context.Context, keyID gcpKMSKeyID) (*kmsSigner, error) {
+func (g *gcpKMSKeyStore) newKmsKey(ctx context.Context, keyID gcpKMSKeyID) (*kmsKey, error) {
 	req := &kmspb.GetPublicKeyRequest{
 		Name: keyID.keyVersionName,
 	}
@@ -331,11 +411,11 @@ func (g *gcpKMSKeyStore) newKmsSigner(ctx context.Context, keyID gcpKMSKeyID) (*
 		return nil, trace.Wrap(err, "unexpected error parsing public key PEM")
 	}
 
-	return g.newKmsSignerWithPublicKey(ctx, keyID, pub)
+	return g.newKmsKeyWithPublicKey(ctx, keyID, pub)
 }
 
-func (g *gcpKMSKeyStore) newKmsSignerWithPublicKey(ctx context.Context, keyID gcpKMSKeyID, publicKey crypto.PublicKey) (*kmsSigner, error) {
-	return &kmsSigner{
+func (g *gcpKMSKeyStore) newKmsKeyWithPublicKey(ctx context.Context, keyID gcpKMSKeyID, publicKey crypto.PublicKey) (*kmsKey, error) {
+	return &kmsKey{
 		ctx:    ctx,
 		g:      g,
 		keyID:  keyID,
@@ -343,11 +423,11 @@ func (g *gcpKMSKeyStore) newKmsSignerWithPublicKey(ctx context.Context, keyID gc
 	}, nil
 }
 
-func (s *kmsSigner) Public() crypto.PublicKey {
+func (s *kmsKey) Public() crypto.PublicKey {
 	return s.public
 }
 
-func (s *kmsSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
+func (s *kmsKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
 	var (
 		requestDigest *kmspb.Digest
 		data          []byte
@@ -383,6 +463,26 @@ func (s *kmsSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts)
 	return resp.Signature, nil
 }
 
+func (s *kmsKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error) {
+	resp, err := doGCPRequest(s.ctx, s.g, s.g.kmsClient.AsymmetricDecrypt, &kmspb.AsymmetricDecryptRequest{
+		Name:       s.keyID.keyVersionName,
+		Ciphertext: ciphertext,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "error while attempting GCP KMS decryption operation")
+	}
+	return resp.Plaintext, nil
+}
+
+func (u keyUsage) toGCP() kmspb.CryptoKey_CryptoKeyPurpose {
+	switch u {
+	case keyUsageDecrypt:
+		return kmspb.CryptoKey_ASYMMETRIC_DECRYPT
+	default:
+		return kmspb.CryptoKey_ASYMMETRIC_SIGN
+	}
+}
+
 type gcpKMSKeyID struct {
 	keyVersionName string
 }
diff --git a/lib/auth/keystore/gcp_kms_test.go b/lib/auth/keystore/gcp_kms_test.go
index 922d8b4e3d051..4c05a58c6a37e 100644
--- a/lib/auth/keystore/gcp_kms_test.go
+++ b/lib/auth/keystore/gcp_kms_test.go
@@ -21,6 +21,7 @@ package keystore
 import (
 	"context"
 	"crypto"
+	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
@@ -111,6 +112,8 @@ func (f *fakeGCPKMSServer) CreateCryptoKey(ctx context.Context, req *kmspb.Creat
 	switch cryptoKey.VersionTemplate.Algorithm {
 	case kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_2048_SHA256, kmspb.CryptoKeyVersion_RSA_SIGN_PKCS1_4096_SHA512:
 		pem = testRSA2048PrivateKeyPEM
+	case kmspb.CryptoKeyVersion_RSA_DECRYPT_OAEP_4096_SHA256:
+		pem = testRSA4096PrivateKeyPEM
 	case kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256:
 		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
 		if err != nil {
@@ -219,6 +222,40 @@ func (f *fakeGCPKMSServer) AsymmetricSign(ctx context.Context, req *kmspb.Asymme
 	return resp, nil
 }
 
+func (f *fakeGCPKMSServer) AsymmetricDecrypt(ctx context.Context, req *kmspb.AsymmetricDecryptRequest) (*kmspb.AsymmetricDecryptResponse, error) {
+	f.mu.RLock()
+	defer f.mu.RUnlock()
+	keyState, ok := f.keyVersions[req.Name]
+	if !ok {
+		return nil, trace.NotFound("no such key")
+	}
+	if keyState.cryptoKeyVersion.State != kmspb.CryptoKeyVersion_ENABLED {
+		return nil, trace.BadParameter("cannot fetch key, state has value %s", keyState.cryptoKeyVersion.State)
+	}
+
+	signer, err := keys.ParsePrivateKey(keyState.pem)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	decrypter, ok := signer.Signer.(crypto.Decrypter)
+	if !ok {
+		return nil, trace.Errorf("private key is not a valid decrypter")
+	}
+
+	testRand := mathrandv1.New(mathrandv1.NewSource(0))
+	plaintext, err := decrypter.Decrypt(testRand, req.Ciphertext, &rsa.OAEPOptions{Hash: crypto.SHA256})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &kmspb.AsymmetricDecryptResponse{
+		Plaintext: plaintext,
+	}
+
+	return resp, nil
+}
+
 func (f *fakeGCPKMSServer) ListCryptoKeys(ctx context.Context, req *kmspb.ListCryptoKeysRequest) (*kmspb.ListCryptoKeysResponse, error) {
 	f.mu.RLock()
 	defer f.mu.RUnlock()
diff --git a/lib/auth/keystore/keystore_test.go b/lib/auth/keystore/keystore_test.go
index 7b7c1fac8991b..3c9bd5892592b 100644
--- a/lib/auth/keystore/keystore_test.go
+++ b/lib/auth/keystore/keystore_test.go
@@ -26,7 +26,13 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
+	"crypto/x509"
 	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -44,7 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const (
@@ -181,7 +187,7 @@ func TestBackends(t *testing.T) {
 			} {
 				t.Run(tc.alg.String(), func(t *testing.T) {
 					// create a key
-					key, signer, err := backend.generateKey(ctx, tc.alg)
+					key, signer, err := backend.generateSigner(ctx, tc.alg)
 					require.NoError(t, err, trace.DebugReport(err))
 					require.Equal(t, backendDesc.expectedKeyType, keyType(key))
 
@@ -212,18 +218,22 @@ func TestBackends(t *testing.T) {
 			for i := 0; i < numKeys; i++ {
 				var signer crypto.Signer
 				var err error
-				rawPrivateKeys[i], signer, err = backend.generateKey(ctx, cryptosuites.ECDSAP256)
+				rawPrivateKeys[i], signer, err = backend.generateSigner(ctx, cryptosuites.ECDSAP256)
 				require.NoError(t, err)
 				publicKeys[i] = signer.Public()
 			}
 
+			// generate an encryption key that should not be cleaned up
+			encryptionKey, decrypter, hash, err := backend.generateDecrypter(ctx, cryptosuites.RSA4096)
+			require.NoError(t, err)
+
 			// AWS KMS keystore will not delete any keys created in the past 5
 			// minutes.
 			pack.clock.Advance(6 * time.Minute)
 
 			// say that only the first key is in use, delete the rest
 			usedKeys := [][]byte{rawPrivateKeys[0]}
-			err := backend.deleteUnusedKeys(ctx, usedKeys)
+			err = backend.deleteUnusedKeys(ctx, usedKeys)
 			require.NoError(t, err, trace.DebugReport(err))
 
 			// make sure the first key is still good
@@ -232,6 +242,23 @@ func TestBackends(t *testing.T) {
 			_, err = signer.Sign(rand.Reader, messageHash[:], crypto.SHA256)
 			require.NoError(t, err)
 
+			// make sure the encryption key is still good
+			plaintext := "test message"
+			pubKey, ok := decrypter.Public().(*rsa.PublicKey)
+			require.True(t, ok, "expected *rsa.PublicKey, got %T", decrypter.Public())
+
+			cipher, err := rsa.EncryptOAEP(hash.New(), rand.Reader, pubKey, []byte(plaintext), nil)
+			require.NoError(t, err)
+
+			decrypter, err = backend.getDecrypter(ctx, encryptionKey, decrypter.Public(), hash)
+			require.NoError(t, err)
+
+			decrypted, err := decrypter.Decrypt(rand.Reader, cipher, &rsa.OAEPOptions{
+				Hash: hash,
+			})
+			require.NoError(t, err)
+			require.Equal(t, plaintext, string(decrypted))
+
 			// make sure all other keys are deleted
 			for i := 1; i < numKeys; i++ {
 				signer, err := backend.getSigner(ctx, rawPrivateKeys[i], publicKeys[0])
@@ -299,6 +326,10 @@ func TestManager(t *testing.T) {
 			require.NoError(t, err)
 			require.Equal(t, backendDesc.expectedKeyType, jwtKeyPair.PrivateKeyType)
 
+			encKeyPair, err := manager.NewEncryptionKeyPair(ctx, cryptosuites.RecordingKeyWrapping)
+			require.NoError(t, err)
+			require.Equal(t, backendDesc.expectedKeyType, encKeyPair.PrivateKeyType)
+
 			// Test a CA with multiple active keypairs. Each element of ActiveKeys
 			// includes a keypair generated above and a PKCS11 keypair with a
 			// different hostID that this manager should not be able to use.
@@ -323,7 +354,7 @@ func TestManager(t *testing.T) {
 			require.NoError(t, err)
 
 			// Test that the manager is able to select the correct key and get a
-			// signer.
+			// signer or decrypter.
 			sshSigner, err := manager.GetSSHSigner(ctx, ca)
 			require.NoError(t, err, trace.DebugReport(err))
 			require.Equal(t, sshKeyPair.PublicKey, ssh.MarshalAuthorizedKey(sshSigner.PublicKey()))
@@ -339,6 +370,25 @@ func TestManager(t *testing.T) {
 			require.NoError(t, err)
 			require.Equal(t, jwtKeyPair.PublicKey, pubkeyPem)
 
+			decrypter, err := manager.GetDecrypter(ctx, encKeyPair)
+			require.NoError(t, err)
+			require.NotNil(t, decrypter)
+
+			// Try encrypting and decrypting some data
+			msg := []byte("teleport")
+			require.NoError(t, err)
+			pubKey, err := x509.ParsePKIXPublicKey(encKeyPair.PublicKey)
+			require.NoError(t, err)
+			pubKeyRSA, ok := pubKey.(*rsa.PublicKey)
+			require.True(t, ok, "expected RSA public key")
+
+			ciphertext, err := rsa.EncryptOAEP(crypto.Hash(encKeyPair.Hash).New(), rand.Reader, pubKeyRSA, msg, nil)
+			require.NoError(t, err)
+
+			plaintext, err := decrypter.Decrypt(rand.Reader, ciphertext, nil)
+			require.NoError(t, err)
+			require.Equal(t, msg, plaintext)
+
 			// Try signing an SSH cert.
 			sshCert := ssh.Certificate{
 				Key:         sshSubjectPubKey,
@@ -526,7 +576,7 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 	var backends []*backendDesc
 
 	hostUUID := uuid.NewString()
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	unusedPKCS11Key, err := keyID{
 		HostID: hostUUID,
@@ -555,9 +605,21 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 		},
 		kmsClient:         testGCPKMSClient,
 		clockworkOverride: clock,
+		RSAKeyPairSource: func(alg cryptosuites.Algorithm) ([]byte, []byte, error) {
+			switch alg {
+			case cryptosuites.RSA2048:
+				return testRSA2048PrivateKeyPEM, nil, nil
+			case cryptosuites.RSA4096:
+				return testRSA4096PrivateKeyPEM, nil, nil
+			}
+
+			return nil, nil, trace.Errorf("unexpected algorithm: %v", alg)
+		},
 	}
 
-	softwareBackend := newSoftwareKeyStore(&softwareConfig{})
+	softwareBackend := newSoftwareKeyStore(&softwareConfig{
+		rsaKeyPairSource: baseOpts.RSAKeyPairSource,
+	})
 	backends = append(backends, &backendDesc{
 		name:                "software",
 		config:              servicecfg.KeystoreConfig{},
@@ -568,19 +630,22 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 	})
 
 	if config, ok := softHSMTestConfig(t); ok {
-		backend, err := newPKCS11KeyStore(&config.PKCS11, &baseOpts)
+		hsmOpts := baseOpts
+		// softhsm2 seems to only support OAEP with SHA1
+		hsmOpts.OAEPHash = crypto.SHA1
+		backend, err := newPKCS11KeyStore(&config.PKCS11, &hsmOpts)
 		require.NoError(t, err)
 		backends = append(backends, &backendDesc{
 			name:            "softhsm",
 			config:          config,
-			opts:            &baseOpts,
+			opts:            &hsmOpts,
 			backend:         backend,
 			expectedKeyType: types.PrivateKeyType_PKCS11,
 			unusedRawKey:    unusedPKCS11Key,
 		})
 	}
 
-	if config, ok := yubiHSMTestConfig(t); ok {
+	if config, ok := yubiHSMTestConfig(); ok {
 		backend, err := newPKCS11KeyStore(&config.PKCS11, &baseOpts)
 		require.NoError(t, err)
 		backends = append(backends, &backendDesc{
@@ -593,7 +658,7 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 		})
 	}
 
-	if config, ok := cloudHSMTestConfig(t); ok {
+	if config, ok := cloudHSMTestConfig(); ok {
 		backend, err := newPKCS11KeyStore(&config.PKCS11, &baseOpts)
 		require.NoError(t, err)
 		backends = append(backends, &backendDesc{
@@ -607,7 +672,7 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 	}
 
 	// Test with real GCP account if environment is enabled.
-	if config, ok := gcpKMSTestConfig(t); ok {
+	if config, ok := gcpKMSTestConfig(); ok {
 		opts := baseOpts
 		opts.kmsClient = nil
 
@@ -647,7 +712,7 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 	// Test AWS with and without multi-region keys
 	for _, multiRegion := range []bool{false, true} {
 		// Test with real AWS account if environment is enabled.
-		if config, ok := awsKMSTestConfig(t); ok {
+		if config, ok := awsKMSTestConfig(); ok {
 			config.AWSKMS.MultiRegion.Enabled = multiRegion
 			opts := baseOpts
 			// Unset the fake clients so this test can use the real AWS clients.
@@ -721,3 +786,157 @@ func newTestPack(ctx context.Context, t *testing.T) *testPack {
 		clock:    clock,
 	}
 }
+
+func HSMTestConfig(t *testing.T) servicecfg.KeystoreConfig {
+	if cfg, ok := yubiHSMTestConfig(); ok {
+		t.Log("Running test with YubiHSM")
+		return cfg
+	}
+	if cfg, ok := cloudHSMTestConfig(); ok {
+		t.Log("Running test with AWS CloudHSM")
+		return cfg
+	}
+	if cfg, ok := awsKMSTestConfig(); ok {
+		t.Log("Running test with AWS KMS")
+		return cfg
+	}
+	if cfg, ok := gcpKMSTestConfig(); ok {
+		t.Log("Running test with GCP KMS")
+		return cfg
+	}
+	if cfg, ok := softHSMTestConfig(t); ok {
+		t.Log("Running test with SoftHSM")
+		return cfg
+	}
+	t.Skip("No HSM available for test")
+	return servicecfg.KeystoreConfig{}
+}
+
+func yubiHSMTestConfig() (servicecfg.KeystoreConfig, bool) {
+	yubiHSMPath := os.Getenv("TELEPORT_TEST_YUBIHSM_PKCS11_PATH")
+	yubiHSMPin := os.Getenv("TELEPORT_TEST_YUBIHSM_PIN")
+	if yubiHSMPath == "" || yubiHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	slotNumber := 0
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       yubiHSMPath,
+			SlotNumber: &slotNumber,
+			PIN:        yubiHSMPin,
+		},
+	}, true
+}
+
+func cloudHSMTestConfig() (servicecfg.KeystoreConfig, bool) {
+	cloudHSMPin := os.Getenv("TELEPORT_TEST_CLOUDHSM_PIN")
+	if cloudHSMPin == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so",
+			TokenLabel: "cavium",
+			PIN:        cloudHSMPin,
+		},
+	}, true
+}
+
+func awsKMSTestConfig() (servicecfg.KeystoreConfig, bool) {
+	awsKMSAccount := os.Getenv("TELEPORT_TEST_AWS_KMS_ACCOUNT")
+	awsKMSRegion := os.Getenv("TELEPORT_TEST_AWS_KMS_REGION")
+	if awsKMSAccount == "" || awsKMSRegion == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		AWSKMS: &servicecfg.AWSKMSConfig{
+			AWSAccount: awsKMSAccount,
+			AWSRegion:  awsKMSRegion,
+		},
+	}, true
+}
+
+func gcpKMSTestConfig() (servicecfg.KeystoreConfig, bool) {
+	gcpKeyring := os.Getenv("TELEPORT_TEST_GCP_KMS_KEYRING")
+	if gcpKeyring == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+	return servicecfg.KeystoreConfig{
+		GCPKMS: servicecfg.GCPKMSConfig{
+			KeyRing:         gcpKeyring,
+			ProtectionLevel: "SOFTWARE",
+		},
+	}, true
+}
+
+var (
+	cachedSoftHSMConfig      *servicecfg.KeystoreConfig
+	cachedSoftHSMConfigMutex sync.Mutex
+)
+
+// softHSMTestConfig is for use in tests only and creates a test SOFTHSM2 token.
+// This should be used for all tests which need to use SoftHSM because the
+// library can only be initialized once and SOFTHSM2_PATH and SOFTHSM2_CONF
+// cannot be changed. New tokens added after the library has been initialized
+// will not be found by the library.
+//
+// A new token will be used for each `go test` invocation, but it's difficult
+// to create a separate token for each test because because new tokens
+// added after the library has been initialized will not be found by the
+// library. It's also difficult to clean up the token because tests for all
+// packages are run in parallel there is not a good time to safely
+// delete the token or the entire token directory. Each test should clean up
+// all keys that it creates because SoftHSM2 gets really slow when there are
+// many keys for a given token.
+func softHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
+	path := os.Getenv("SOFTHSM2_PATH")
+	if path == "" {
+		return servicecfg.KeystoreConfig{}, false
+	}
+
+	cachedSoftHSMConfigMutex.Lock()
+	defer cachedSoftHSMConfigMutex.Unlock()
+
+	if cachedSoftHSMConfig != nil {
+		return *cachedSoftHSMConfig, true
+	}
+
+	if os.Getenv("SOFTHSM2_CONF") == "" {
+		// create tokendir
+		tokenDir, err := os.MkdirTemp("", "tokens")
+		require.NoError(t, err)
+
+		// create config file
+		configFile, err := os.CreateTemp("", "softhsm2.conf")
+		require.NoError(t, err)
+
+		// write config file
+		_, err = fmt.Fprintf(configFile, "directories.tokendir = %s\nobjectstore.backend = file\nlog.level = DEBUG\n", tokenDir)
+		require.NoError(t, err)
+		require.NoError(t, configFile.Close())
+
+		// set env
+		os.Setenv("SOFTHSM2_CONF", configFile.Name())
+	}
+
+	// create test token (max length is 32 chars)
+	tokenLabel := strings.ReplaceAll(uuid.NewString(), "-", "")
+	cmd := exec.Command("softhsm2-util", "--init-token", "--free", "--label", tokenLabel, "--so-pin", "password", "--pin", "password")
+	t.Logf("Running command: %q", cmd)
+	if err := cmd.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			require.NoError(t, exitErr, "error creating test softhsm token: %s", string(exitErr.Stderr))
+		}
+		require.NoError(t, err, "error attempting to run softhsm2-util")
+	}
+
+	cachedSoftHSMConfig = &servicecfg.KeystoreConfig{
+		PKCS11: servicecfg.PKCS11Config{
+			Path:       path,
+			TokenLabel: tokenLabel,
+			PIN:        "password",
+		},
+	}
+	return *cachedSoftHSMConfig, true
+}
diff --git a/lib/auth/keystore/manager.go b/lib/auth/keystore/manager.go
index c0f7c55e69f3a..7ff0e73efb930 100644
--- a/lib/auth/keystore/manager.go
+++ b/lib/auth/keystore/manager.go
@@ -25,14 +25,18 @@ import (
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
+	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
+	"errors"
 	"io"
 	"log/slog"
 	"maps"
+	"math/big"
 	"slices"
+	"time"
 
 	kms "cloud.google.com/go/kms/apiv1"
 	"github.com/gravitational/trace"
@@ -54,10 +58,11 @@ import (
 const (
 	keystoreSubsystem = "keystore"
 
-	labelKeyType = "key_type"
-	keyTypeTLS   = "tls"
-	keyTypeSSH   = "ssh"
-	keyTypeJWT   = "jwt"
+	labelKeyType      = "key_type"
+	keyTypeTLS        = "tls"
+	keyTypeSSH        = "ssh"
+	keyTypeJWT        = "jwt"
+	keyTypeEncryption = "enc"
 
 	labelStoreType = "store_type"
 	storePKCS11    = "pkcs11"
@@ -68,6 +73,15 @@ const (
 	labelCryptoAlgorithm = "key_algorithm"
 )
 
+// keyUsage marks a given key to be used either with signing or decryption
+type keyUsage string
+
+const (
+	keyUsageNone    keyUsage = ""
+	keyUsageSign    keyUsage = "sign"
+	keyUsageDecrypt keyUsage = "decrypt"
+)
+
 var (
 	signCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
 		Namespace: teleport.MetricNamespace,
@@ -81,6 +95,18 @@ var (
 		Name:      "sign_requests_error",
 		Help:      "Total number of sign request errors",
 	}, []string{labelKeyType, labelStoreType})
+	decryptCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: teleport.MetricNamespace,
+		Subsystem: keystoreSubsystem,
+		Name:      "decrypt_requests_total",
+		Help:      "Total number of decrypt requests",
+	}, []string{labelKeyType, labelStoreType})
+	decryptErrorCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: teleport.MetricNamespace,
+		Subsystem: keystoreSubsystem,
+		Name:      "decrypt_requests_error",
+		Help:      "Total number of decrypt request errors",
+	}, []string{labelKeyType, labelStoreType})
 	createCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
 		Namespace: teleport.MetricNamespace,
 		Subsystem: keystoreSubsystem,
@@ -102,30 +128,39 @@ type Manager struct {
 	// use, all new keys will be generated in this backend.
 	backendForNewKeys backend
 
-	// usableSigningBackends is a list of all backends the manager can get
-	// signers from, in preference order. [backendForNewKeys] is expected to be
+	// usableBackends is a list of all backends the manager can get signers or
+	// decrypters from, in preference order. [backendForNewKeys] is expected to be
 	// the first element.
-	usableSigningBackends []backend
+	usableBackends []backend
 
 	currentSuiteGetter cryptosuites.GetSuiteFunc
 	logger             *slog.Logger
 }
 
-// backend is an interface that holds private keys and provides signing
+// backend is an interface that holds private keys and provides signing and decryption
 // operations.
 type backend interface {
-	// generateRSA creates a new key pair and returns its identifier and a crypto.Signer. The returned
+	// generateSigner creates a new key pair and returns its identifier and a crypto.Signer. The returned
 	// identifier can be passed to getSigner later to get an equivalent crypto.Signer.
-	generateKey(context.Context, cryptosuites.Algorithm) (keyID []byte, signer crypto.Signer, err error)
+	generateSigner(context.Context, cryptosuites.Algorithm) (keyID []byte, signer crypto.Signer, err error)
+
+	// generateDecrypter creates a new key pair and returns its identifier and a crypto.Decrypter. The returned
+	// identifier can be passed to getDecrypter later to get an equivalent crypto.Decrypter.
+	generateDecrypter(context.Context, cryptosuites.Algorithm) (keyID []byte, decrypter crypto.Decrypter, hash crypto.Hash, err error)
 
 	// getSigner returns a crypto.Signer for the given key identifier, if it is found.
 	// The public key is passed as well so that it does not need to be fetched
 	// from the underlying backend, and it is always stored in the CA anyway.
 	getSigner(ctx context.Context, keyID []byte, pub crypto.PublicKey) (crypto.Signer, error)
 
-	// canSignWithKey returns true if this backend is able to sign with the
+	// getDecrypter returns a crypto.Decrypter for the given key identifier, if it is found.
+	// The public key is passed as well so that it does not need to be fetched
+	// from the underlying backend.
+	getDecrypter(ctx context.Context, keyID []byte, pub crypto.PublicKey, hash crypto.Hash) (crypto.Decrypter, error)
+
+	// canUseKey returns true if this backend is able to sign or decrypt with the
 	// given key.
-	canSignWithKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error)
+	canUseKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error)
 
 	// deleteKey deletes the given key from the backend.
 	deleteKey(ctx context.Context, keyID []byte) error
@@ -141,6 +176,9 @@ type backend interface {
 	// keys this backend uses.
 	keyTypeDescription() string
 
+	// findDecryptersByLabel returns all known decrypters identified by the given label
+	findDecryptersByLabel(ctx context.Context, label *types.KeyLabel) ([]crypto.Decrypter, error)
+
 	// name returns the name of the backend.
 	name() string
 }
@@ -155,13 +193,19 @@ type Options struct {
 	Logger *slog.Logger
 	// AuthPreferenceGetter provides the current cluster auth preference.
 	AuthPreferenceGetter cryptosuites.AuthPreferenceGetter
-	// FIPS means FedRAMP/FIPS 140-2 compliant configuration was requested.
+	// FIPS means FedRAMP/FIPS compliant configuration was requested.
 	FIPS bool
+	// RSAKeyPairSource is an optional function used by the software keystore when
+	// generating RSA keys.
+	RSAKeyPairSource RSAKeyPairSource
+	// OAEPHash function to use with keystores that support OAEP with a configurable hash.
+	OAEPHash crypto.Hash
 
 	awsKMSClient kmsClient
 	mrkClient    mrkClient
 	awsSTSClient stsClient
 	kmsClient    *kms.KeyManagementClient
+	awsRGTClient rgtClient
 
 	clockworkOverride clockwork.Clock
 	// GCPKMS uses a special fake clock that seemed more testable at the time.
@@ -199,9 +243,9 @@ func NewManager(ctx context.Context, cfg *servicecfg.KeystoreConfig, opts *Optio
 		return nil, trace.Wrap(err)
 	}
 
-	softwareBackend := newSoftwareKeyStore(&softwareConfig{})
+	softwareBackend := newSoftwareKeyStore(&softwareConfig{rsaKeyPairSource: opts.RSAKeyPairSource})
 	var backendForNewKeys backend = softwareBackend
-	usableSigningBackends := []backend{softwareBackend}
+	usableBackends := []backend{softwareBackend}
 
 	switch {
 	case cfg.PKCS11 != (servicecfg.PKCS11Config{}):
@@ -210,28 +254,28 @@ func NewManager(ctx context.Context, cfg *servicecfg.KeystoreConfig, opts *Optio
 			return nil, trace.Wrap(err)
 		}
 		backendForNewKeys = pkcs11Backend
-		usableSigningBackends = []backend{pkcs11Backend, softwareBackend}
+		usableBackends = []backend{pkcs11Backend, softwareBackend}
 	case cfg.GCPKMS != (servicecfg.GCPKMSConfig{}):
 		gcpBackend, err := newGCPKMSKeyStore(ctx, &cfg.GCPKMS, opts)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		backendForNewKeys = gcpBackend
-		usableSigningBackends = []backend{gcpBackend, softwareBackend}
+		usableBackends = []backend{gcpBackend, softwareBackend}
 	case cfg.AWSKMS != nil:
 		awsBackend, err := newAWSKMSKeystore(ctx, cfg.AWSKMS, opts)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		backendForNewKeys = awsBackend
-		usableSigningBackends = []backend{awsBackend, softwareBackend}
+		usableBackends = []backend{awsBackend, softwareBackend}
 	}
 
 	return &Manager{
-		backendForNewKeys:     backendForNewKeys,
-		usableSigningBackends: usableSigningBackends,
-		currentSuiteGetter:    cryptosuites.GetCurrentSuiteFromAuthPreference(opts.AuthPreferenceGetter),
-		logger:                opts.Logger,
+		backendForNewKeys:  backendForNewKeys,
+		usableBackends:     usableBackends,
+		currentSuiteGetter: cryptosuites.GetCurrentSuiteFromAuthPreference(opts.AuthPreferenceGetter),
+		logger:             opts.Logger,
 	}, nil
 }
 
@@ -251,6 +295,23 @@ func (s *cryptoCountSigner) Sign(rand io.Reader, digest []byte, opts crypto.Sign
 	return sig, nil
 }
 
+type cryptoCountDecrypter struct {
+	crypto.Decrypter
+	keyType string
+	store   string
+}
+
+func (d *cryptoCountDecrypter) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) ([]byte, error) {
+	decryptCounter.WithLabelValues(d.keyType, d.store).Inc()
+	plaintext, err := d.Decrypter.Decrypt(rand, ciphertext, opts)
+	if err != nil {
+		decryptErrorCounter.WithLabelValues(d.keyType, d.store).Inc()
+		return nil, trace.Wrap(err)
+	}
+
+	return plaintext, nil
+}
+
 // GetSSHSigner selects a usable SSH keypair from the given CA ActiveKeys and
 // returns an [ssh.Signer].
 func (m *Manager) GetSSHSigner(ctx context.Context, ca types.CertAuthority) (ssh.Signer, error) {
@@ -268,13 +329,13 @@ func (m *Manager) GetAdditionalTrustedSSHSigner(ctx context.Context, ca types.Ce
 // GetSSHSignerFromKeySet selects a usable SSH keypair from the provided key
 // set.
 func (m *Manager) GetSSHSignerFromKeySet(ctx context.Context, keySet types.CAKeySet) (ssh.Signer, error) {
-	for _, backend := range m.usableSigningBackends {
+	for _, backend := range m.usableBackends {
 		for _, keyPair := range keySet.SSH {
-			canSign, err := backend.canSignWithKey(ctx, keyPair.PrivateKey, keyPair.PrivateKeyType)
+			canUse, err := backend.canUseKey(ctx, keyPair.PrivateKey, keyPair.PrivateKeyType)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			if !canSign {
+			if !canUse {
 				continue
 			}
 			pub, err := publicKeyFromSSHAuthorizedKey(keyPair.PublicKey)
@@ -375,6 +436,35 @@ func sshSignerFromCryptoSigner(cryptoSigner crypto.Signer) (ssh.Signer, error) {
 	}
 }
 
+var ErrUnusableKey = errors.New("unable to sign with requested key")
+
+// TLSSigner returns a crypto.Signer for the given TLSKeyPair.
+// It returns ErrUnusableKey if unable to create a signer from the given keypair,
+// e.g. if it is stored in an HSM or KMS this auth service is not configured to use.
+func (m *Manager) TLSSigner(ctx context.Context, keypair *types.TLSKeyPair) (crypto.Signer, error) {
+	for _, backend := range m.usableBackends {
+		canUse, err := backend.canUseKey(ctx, keypair.Key, keypair.KeyType)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if !canUse {
+			continue
+		}
+		pub, err := publicKeyFromTLSCertPem(keypair.Cert)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		signer, err := backend.getSigner(ctx, keypair.Key, pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &cryptoCountSigner{Signer: signer, keyType: keyTypeTLS, store: backend.name()}, nil
+	}
+
+	return nil, ErrUnusableKey
+}
+
 // GetTLSCertAndSigner selects a usable TLS keypair from the given CA
 // and returns the PEM-encoded TLS certificate and a [crypto.Signer].
 func (m *Manager) GetTLSCertAndSigner(ctx context.Context, ca types.CertAuthority) ([]byte, crypto.Signer, error) {
@@ -396,13 +486,13 @@ func (m *Manager) GetAdditionalTrustedTLSCertAndSigner(ctx context.Context, ca t
 }
 
 func (m *Manager) getTLSCertAndSigner(ctx context.Context, keySet types.CAKeySet) ([]byte, crypto.Signer, error) {
-	for _, backend := range m.usableSigningBackends {
+	for _, backend := range m.usableBackends {
 		for _, keyPair := range keySet.TLS {
-			canSign, err := backend.canSignWithKey(ctx, keyPair.Key, keyPair.KeyType)
+			canUse, err := backend.canUseKey(ctx, keyPair.Key, keyPair.KeyType)
 			if err != nil {
 				return nil, nil, trace.Wrap(err)
 			}
-			if !canSign {
+			if !canUse {
 				continue
 			}
 			pub, err := publicKeyFromTLSCertPem(keyPair.Cert)
@@ -435,13 +525,13 @@ func publicKeyFromTLSCertPem(certPem []byte) (crypto.PublicKey, error) {
 // GetJWTSigner selects a usable JWT keypair from the given keySet and returns
 // a [crypto.Signer].
 func (m *Manager) GetJWTSigner(ctx context.Context, ca types.CertAuthority) (crypto.Signer, error) {
-	for _, backend := range m.usableSigningBackends {
+	for _, backend := range m.usableBackends {
 		for _, keyPair := range ca.GetActiveKeys().JWT {
-			canSign, err := backend.canSignWithKey(ctx, keyPair.PrivateKey, keyPair.PrivateKeyType)
+			canUse, err := backend.canUseKey(ctx, keyPair.PrivateKey, keyPair.PrivateKeyType)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			if !canSign {
+			if !canUse {
 				continue
 			}
 			pub, err := keys.ParsePublicKey(keyPair.PublicKey)
@@ -458,6 +548,54 @@ func (m *Manager) GetJWTSigner(ctx context.Context, ca types.CertAuthority) (cry
 	return nil, trace.NotFound("no usable JWT key pairs found")
 }
 
+// GetDecrypter returns the [crypto.Decrypter] associated with a given EncryptionKeyPair if accessible.
+func (m *Manager) GetDecrypter(ctx context.Context, keyPair *types.EncryptionKeyPair) (crypto.Decrypter, error) {
+	for _, backend := range m.usableBackends {
+		canUse, err := backend.canUseKey(ctx, keyPair.PrivateKey, keyPair.PrivateKeyType)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if !canUse {
+			continue
+		}
+		pub, err := x509.ParsePKIXPublicKey(keyPair.PublicKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		decrypter, err := backend.getDecrypter(ctx, keyPair.PrivateKey, pub, crypto.Hash(keyPair.Hash))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &cryptoCountDecrypter{Decrypter: decrypter, keyType: keyTypeEncryption, store: backend.name()}, nil
+	}
+
+	return nil, trace.NotFound("no compatible backend found for keypair")
+}
+
+// FindDecryptersByLabels returns a slice of all [crypto.Decrypter] keys identified by the given labels across all
+// usable backends.
+func (m *Manager) FindDecryptersByLabels(ctx context.Context, labels ...*types.KeyLabel) ([]crypto.Decrypter, error) {
+	var decrypters []crypto.Decrypter
+	for _, backend := range m.usableBackends {
+		for _, label := range labels {
+			decs, err := backend.findDecryptersByLabel(ctx, label)
+			if err != nil {
+				if !trace.IsNotImplemented(err) {
+					m.logger.DebugContext(ctx, "could not find key for label", "backend", backend.name(), "label_type", label.Type, "label", label.Label, "error", err)
+				}
+				continue
+			}
+
+			decrypters = append(decrypters, decs...)
+		}
+	}
+
+	return decrypters, nil
+}
+
 // NewSSHKeyPair generates a new SSH keypair in the keystore backend and returns it.
 func (m *Manager) NewSSHKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.SSHKeyPair, error) {
 	alg, err := cryptosuites.AlgorithmForKey(ctx, m.currentSuiteGetter, purpose)
@@ -474,7 +612,7 @@ func (m *Manager) NewSSHKeyPair(ctx context.Context, purpose cryptosuites.KeyPur
 }
 
 func (m *Manager) newSSHKeyPair(ctx context.Context, alg cryptosuites.Algorithm) (*types.SSHKeyPair, error) {
-	sshKey, signer, err := m.backendForNewKeys.generateKey(ctx, alg)
+	sshKey, signer, err := m.backendForNewKeys.generateSigner(ctx, alg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -505,7 +643,7 @@ func (m *Manager) NewTLSKeyPair(ctx context.Context, clusterName string, purpose
 }
 
 func (m *Manager) newTLSKeyPair(ctx context.Context, clusterName string, alg cryptosuites.Algorithm) (*types.TLSKeyPair, error) {
-	tlsKey, signer, err := m.backendForNewKeys.generateKey(ctx, alg)
+	tlsKey, signer, err := m.backendForNewKeys.generateSigner(ctx, alg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -518,15 +656,41 @@ func (m *Manager) newTLSKeyPair(ctx context.Context, clusterName string, alg cry
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	certificate, err := tlsca.ParseCertificatePEM(tlsCert)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	crl, err := GenerateCRL(certificate, signer)
+	if err != nil {
+		return nil, err
+	}
 	return &types.TLSKeyPair{
 		Cert:    tlsCert,
 		Key:     tlsKey,
 		KeyType: keyType(tlsKey),
+		CRL:     crl,
 	}, nil
 }
 
-// New JWTKeyPair create a new JWT keypair in the keystore backend and returns
-// it.
+// GenerateCRL generates an empty x509 certificate revocation list.
+func GenerateCRL(caCert *x509.Certificate, signer crypto.Signer) ([]byte, error) {
+	revocationList := &x509.RevocationList{
+		Number:     big.NewInt(1),
+		ThisUpdate: time.Now().Add(-1 * time.Minute), // 1 min in the past to account for clock skew.
+
+		// Note the 10 year expiration date. CRLs are always empty, so they don't need to change frequently.
+		NextUpdate: time.Now().Add(10 * 365 * 24 * time.Hour),
+	}
+	crl, err := x509.CreateRevocationList(rand.Reader, revocationList, caCert, signer)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating CRL")
+	}
+	return crl, nil
+}
+
+// NewJWTKeyPair create a new JWT keypair in the keystore backend and returns it.
 func (m *Manager) NewJWTKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.JWTKeyPair, error) {
 	alg, err := cryptosuites.AlgorithmForKey(ctx, m.currentSuiteGetter, purpose)
 	if err != nil {
@@ -564,7 +728,7 @@ func (m *Manager) NewJWTKeyPair(ctx context.Context, purpose cryptosuites.KeyPur
 }
 
 func (m *Manager) newJWTKeyPair(ctx context.Context, alg cryptosuites.Algorithm) (*types.JWTKeyPair, error) {
-	jwtKey, signer, err := m.backendForNewKeys.generateKey(ctx, alg)
+	jwtKey, signer, err := m.backendForNewKeys.generateSigner(ctx, alg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -579,6 +743,40 @@ func (m *Manager) newJWTKeyPair(ctx context.Context, alg cryptosuites.Algorithm)
 	}, nil
 }
 
+// NewEncryptionKeyPair creates and returns a new encryption keypair.
+func (m *Manager) NewEncryptionKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.EncryptionKeyPair, error) {
+	alg, err := cryptosuites.AlgorithmForKey(ctx, m.currentSuiteGetter, purpose)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	createCounter.WithLabelValues(keyTypeEncryption, m.backendForNewKeys.name(), alg.String()).Inc()
+	key, err := m.newEncryptionKeyPair(ctx, alg)
+	if err != nil {
+		createErrorCounter.WithLabelValues(keyTypeEncryption, m.backendForNewKeys.name(), alg.String()).Inc()
+		return nil, trace.Wrap(err)
+	}
+	return key, nil
+}
+
+func (m *Manager) newEncryptionKeyPair(ctx context.Context, alg cryptosuites.Algorithm) (*types.EncryptionKeyPair, error) {
+	encKey, decrypter, hash, err := m.backendForNewKeys.generateDecrypter(ctx, alg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	publicKey, err := x509.MarshalPKIXPublicKey(decrypter.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &types.EncryptionKeyPair{
+		PublicKey:      publicKey,
+		PrivateKey:     encKey,
+		PrivateKeyType: keyType(encKey),
+		Hash:           uint32(hash),
+	}, nil
+}
+
 // UsableKeysResult holds the result of a call to HasUsableActiveKeys or
 // HasUsableAdditionalTrustedKeys.
 type UsableKeysResult struct {
@@ -614,10 +812,10 @@ func (m *Manager) hasUsableKeys(ctx context.Context, keySet types.CAKeySet) (*Us
 		PreferredKeyType: m.backendForNewKeys.keyTypeDescription(),
 	}
 	var allRawKeys [][]byte
-	for i, backend := range m.usableSigningBackends {
+	for i, backend := range m.usableBackends {
 		preferredBackend := i == 0
 		for _, sshKeyPair := range keySet.SSH {
-			usable, err := backend.canSignWithKey(ctx, sshKeyPair.PrivateKey, sshKeyPair.PrivateKeyType)
+			usable, err := backend.canUseKey(ctx, sshKeyPair.PrivateKey, sshKeyPair.PrivateKeyType)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -631,7 +829,7 @@ func (m *Manager) hasUsableKeys(ctx context.Context, keySet types.CAKeySet) (*Us
 			allRawKeys = append(allRawKeys, sshKeyPair.PrivateKey)
 		}
 		for _, tlsKeyPair := range keySet.TLS {
-			usable, err := backend.canSignWithKey(ctx, tlsKeyPair.Key, tlsKeyPair.KeyType)
+			usable, err := backend.canUseKey(ctx, tlsKeyPair.Key, tlsKeyPair.KeyType)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -645,7 +843,7 @@ func (m *Manager) hasUsableKeys(ctx context.Context, keySet types.CAKeySet) (*Us
 			allRawKeys = append(allRawKeys, tlsKeyPair.Key)
 		}
 		for _, jwtKeyPair := range keySet.JWT {
-			usable, err := backend.canSignWithKey(ctx, jwtKeyPair.PrivateKey, jwtKeyPair.PrivateKeyType)
+			usable, err := backend.canUseKey(ctx, jwtKeyPair.PrivateKey, jwtKeyPair.PrivateKeyType)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
diff --git a/lib/auth/keystore/pkcs11.go b/lib/auth/keystore/pkcs11.go
index 2184e4afce7a2..ba92f1bfc2fca 100644
--- a/lib/auth/keystore/pkcs11.go
+++ b/lib/auth/keystore/pkcs11.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/elliptic"
+	"encoding/binary"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -37,16 +38,22 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 var pkcs11Prefix = []byte("pkcs11:")
 
+const (
+	recordingEncryptionHostID = "teleport_recording_encryption"
+)
+
 type pkcs11KeyStore struct {
 	ctx       *crypto11.Context
 	hostUUID  string
 	log       *slog.Logger
 	isYubiHSM bool
 	semaphore chan struct{}
+	oaepHash  crypto.Hash
 }
 
 func newPKCS11KeyStore(config *servicecfg.PKCS11Config, opts *Options) (*pkcs11KeyStore, error) {
@@ -69,12 +76,18 @@ func newPKCS11KeyStore(config *servicecfg.PKCS11Config, opts *Options) (*pkcs11K
 		return nil, trace.Wrap(err, "getting PKCS#11 module info")
 	}
 
+	oaepHash := crypto.SHA256
+	if opts.OAEPHash != crypto.Hash(0) {
+		oaepHash = opts.OAEPHash
+	}
+
 	return &pkcs11KeyStore{
 		ctx:       ctx,
 		hostUUID:  opts.HostUUID,
 		log:       opts.Logger,
 		isYubiHSM: strings.HasPrefix(info.ManufacturerID, "Yubico"),
 		semaphore: make(chan struct{}, 1),
+		oaepHash:  oaepHash,
 	}, nil
 }
 
@@ -122,9 +135,9 @@ func (p *pkcs11KeyStore) findUnusedID(ctx context.Context) (keyID, error) {
 	return keyID{}, trace.AlreadyExists("failed to find unused CKA_ID for HSM")
 }
 
-// generateKey creates a new private key and returns its identifier and a crypto.Signer. The returned
+// generateSigner creates a new private key and returns its identifier and a crypto.Signer. The returned
 // identifier can be passed to getSigner later to get an equivalent crypto.Signer.
-func (p *pkcs11KeyStore) generateKey(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
+func (p *pkcs11KeyStore) generateSigner(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
 	// The key identifiers are not created in a thread safe
 	// manner so all calls are serialized to prevent races.
 	select {
@@ -151,13 +164,16 @@ func (p *pkcs11KeyStore) generateKey(ctx context.Context, alg cryptosuites.Algor
 		return nil, nil, trace.Wrap(err)
 	}
 
-	p.log.InfoContext(ctx, "Creating new HSM keypair.", "id", id, "algorithm", alg.String())
+	p.log.InfoContext(ctx, "Creating new HSM keypair.", "id", id, "algorithm", logutils.StringerAttr(alg))
 
 	label := []byte(p.hostUUID)
 	switch alg {
 	case cryptosuites.RSA2048:
 		signer, err := p.generateRSA2048(rawPKCS11ID, label)
 		return rawTeleportID, signer, trace.Wrap(err, "generating RSA2048 key")
+	case cryptosuites.RSA4096:
+		signer, err := p.generateRSA4096(rawPKCS11ID, label)
+		return rawTeleportID, signer, trace.Wrap(err, "generating RSA4096 key")
 	case cryptosuites.ECDSAP256:
 		signer, err := p.generateECDSAP256(rawPKCS11ID, label)
 		return rawTeleportID, signer, trace.Wrap(err, "generating ECDSAP256 key")
@@ -166,11 +182,58 @@ func (p *pkcs11KeyStore) generateKey(ctx context.Context, alg cryptosuites.Algor
 	}
 }
 
-func (p *pkcs11KeyStore) generateRSA2048(ckaID, label []byte) (crypto.Signer, error) {
+// generateDecrypter creates a new private key and returns its identifier and a crypto.Decrypter. The returned
+// identifier can be passed to getDecrypter later to get an equivalent crypto.Decrypter.
+func (p *pkcs11KeyStore) generateDecrypter(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Decrypter, crypto.Hash, error) {
+	// The key identifiers are not created in a thread safe
+	// manner so all calls are serialized to prevent races.
+	select {
+	case p.semaphore <- struct{}{}:
+	case <-ctx.Done():
+		return nil, nil, p.oaepHash, trace.Wrap(ctx.Err())
+	}
+	defer func() {
+		<-p.semaphore
+	}()
+
+	id, err := p.findUnusedID(ctx)
+	if err != nil {
+		return nil, nil, p.oaepHash, trace.Wrap(err)
+	}
+
+	id.HostID = recordingEncryptionHostID
+	rawTeleportID, err := id.marshal()
+	if err != nil {
+		return nil, nil, p.oaepHash, trace.Wrap(err)
+	}
+
+	rawPKCS11ID, err := id.pkcs11Key(p.isYubiHSM)
+	if err != nil {
+		return nil, nil, p.oaepHash, trace.Wrap(err)
+	}
+
+	p.log.InfoContext(ctx, "Creating new HSM keypair.", "id", id, "algorithm", logutils.StringerAttr(alg))
+
+	label := []byte(id.HostID)
+	switch alg {
+	case cryptosuites.RSA4096:
+		decrypter, err := p.generateRSA4096(rawPKCS11ID, label)
+		return rawTeleportID, newOAEPDecrypter(p.oaepHash, decrypter), p.oaepHash, trace.Wrap(err, "generating RSA4096 key")
+	default:
+		return nil, nil, p.oaepHash, trace.BadParameter("unsupported key algorithm for PKCS#11 HSM decryption: %v", alg)
+	}
+}
+
+func (p *pkcs11KeyStore) generateRSA2048(ckaID, label []byte) (crypto11.SignerDecrypter, error) {
 	signer, err := p.ctx.GenerateRSAKeyPairWithLabel(ckaID, label, constants.RSAKeySize)
 	return signer, trace.Wrap(err)
 }
 
+func (p *pkcs11KeyStore) generateRSA4096(ckaID, label []byte) (crypto11.SignerDecrypter, error) {
+	signer, err := p.ctx.GenerateRSAKeyPairWithLabel(ckaID, label, 4096)
+	return signer, trace.Wrap(err)
+}
+
 func (p *pkcs11KeyStore) generateECDSAP256(ckaID, label []byte) (crypto.Signer, error) {
 	signer, err := p.ctx.GenerateECDSAKeyPairWithLabel(ckaID, label, elliptic.P256())
 	return signer, trace.Wrap(err)
@@ -181,6 +244,86 @@ func (p *pkcs11KeyStore) getSigner(ctx context.Context, rawKey []byte, publicKey
 	return p.getSignerWithoutPublicKey(ctx, rawKey)
 }
 
+// getDecrypter returns a crypto.Decrypter for the given key identifier, if it is found.
+func (p *pkcs11KeyStore) getDecrypter(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey, hash crypto.Hash) (crypto.Decrypter, error) {
+	signer, err := p.getSignerWithoutPublicKey(ctx, rawKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if decrypter, ok := signer.(crypto.Decrypter); ok {
+		return newOAEPDecrypter(hash, decrypter), nil
+	}
+
+	return nil, trace.BadParameter("pkcs11 key does not support decryption")
+}
+
+func attrValToUint(value []byte) uint64 {
+	if len(value) == 4 {
+		return uint64(binary.BigEndian.Uint32(value))
+	}
+
+	if len(value) == 8 {
+		return binary.BigEndian.Uint64(value)
+	}
+
+	return 0
+}
+
+func (p *pkcs11KeyStore) validateKeyForDecryption(signer crypto.Signer) error {
+	keyTypeAttr, err := p.ctx.GetAttribute(signer, crypto11.CkaKeyType)
+	if err != nil {
+		return trace.Wrap(err, "looking up key type")
+	}
+
+	if attrValToUint(keyTypeAttr.Value) != pkcs11.CKK_RSA {
+		return trace.Errorf("invalid key algorithm, expected RSA")
+	}
+
+	modAttr, err := p.ctx.GetAttribute(signer, crypto11.CkaModulus)
+	if err != nil {
+		return trace.Wrap(err, "looking up modulus")
+	}
+
+	bitLen := len(modAttr.Value) * 8
+	if bitLen != 4096 {
+		return trace.Errorf("expected 4096-bit key, found %d-bit key", bitLen)
+	}
+
+	return nil
+}
+
+func (p *pkcs11KeyStore) findDecryptersByLabel(ctx context.Context, label *types.KeyLabel) ([]crypto.Decrypter, error) {
+	if label == nil || label.Type != storePKCS11 {
+		return nil, nil
+	}
+
+	signers, err := p.ctx.FindKeyPairs(nil, []byte(label.Label))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var decrypters []crypto.Decrypter
+	for _, signer := range signers {
+		if err := p.validateKeyForDecryption(signer); err != nil {
+			p.log.DebugContext(ctx, "key found but could not be used for decryption", "label_type", label.Type, "label", label.Label, "error", err)
+			continue
+		}
+
+		decrypter, ok := signer.(crypto.Decrypter)
+		if !ok {
+			continue
+		}
+		decrypters = append(decrypters, decrypter)
+	}
+
+	return decrypters, nil
+}
+
+func (p *pkcs11KeyStore) checkAccessibleHostID(hostID string) bool {
+	return hostID == recordingEncryptionHostID || hostID == p.hostUUID
+}
+
 func (p *pkcs11KeyStore) getSignerWithoutPublicKey(ctx context.Context, rawKey []byte) (crypto.Signer, error) {
 	if t := keyType(rawKey); t != types.PrivateKeyType_PKCS11 {
 		return nil, trace.BadParameter("pkcs11KeyStore cannot get signer for key type %s", t.String())
@@ -189,14 +332,14 @@ func (p *pkcs11KeyStore) getSignerWithoutPublicKey(ctx context.Context, rawKey [
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if keyID.HostID != p.hostUUID {
+	if !p.checkAccessibleHostID(keyID.HostID) {
 		return nil, trace.NotFound("given pkcs11 key is for host: %q, but this host is: %q", keyID.HostID, p.hostUUID)
 	}
 	pkcs11ID, err := keyID.pkcs11Key(p.isYubiHSM)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	signer, err := p.ctx.FindKeyPair(pkcs11ID, []byte(p.hostUUID))
+	signer, err := p.ctx.FindKeyPair(pkcs11ID, []byte(keyID.HostID))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -206,11 +349,11 @@ func (p *pkcs11KeyStore) getSignerWithoutPublicKey(ctx context.Context, rawKey [
 	return signer, nil
 }
 
-// canSignWithKey returns true if the given key is PKCS11 and was created by
+// canUseKey returns true if the given key is PKCS11 and was created by
 // this host. If the HSM is disconnected or the key material has been deleted
-// the error will not be detected here but when the first signature is
-// attempted.
-func (p *pkcs11KeyStore) canSignWithKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
+// the error will not be detected here but when the first signature or
+// decryption is attempted.
+func (p *pkcs11KeyStore) canUseKey(ctx context.Context, raw []byte, keyType types.PrivateKeyType) (bool, error) {
 	if keyType != types.PrivateKeyType_PKCS11 {
 		return false, nil
 	}
@@ -218,7 +361,8 @@ func (p *pkcs11KeyStore) canSignWithKey(ctx context.Context, raw []byte, keyType
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
-	return keyID.HostID == p.hostUUID, nil
+
+	return p.checkAccessibleHostID(keyID.HostID), nil
 }
 
 // deleteKey deletes the given key from the HSM
@@ -227,7 +371,7 @@ func (p *pkcs11KeyStore) deleteKey(_ context.Context, rawKey []byte) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if keyID.HostID != p.hostUUID {
+	if !p.checkAccessibleHostID(keyID.HostID) {
 		return trace.NotFound("pkcs11 key is for different host")
 	}
 	pkcs11ID, err := keyID.pkcs11Key(p.isYubiHSM)
@@ -264,7 +408,7 @@ func (p *pkcs11KeyStore) deleteUnusedKeys(ctx context.Context, activeKeys [][]by
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		if keyID.HostID != p.hostUUID {
+		if !p.checkAccessibleHostID(keyID.HostID) {
 			// This key was labeled with a foreign host UUID, it is likely not
 			// present on the attached HSM and definitely will not be returned
 			// by FindKeyPairs below which queries by host UUID.
@@ -368,5 +512,6 @@ func parsePKCS11KeyID(key []byte) (keyID, error) {
 	if err := json.Unmarshal(key, &keyID); err != nil {
 		return keyID, trace.Wrap(err)
 	}
+
 	return keyID, nil
 }
diff --git a/lib/auth/keystore/software.go b/lib/auth/keystore/software.go
index fff5e6dace9ac..55e8f62a7d898 100644
--- a/lib/auth/keystore/software.go
+++ b/lib/auth/keystore/software.go
@@ -21,6 +21,9 @@ package keystore
 import (
 	"context"
 	"crypto"
+	"crypto/rsa"
+	"crypto/x509"
+	"io"
 
 	"github.com/gravitational/trace"
 
@@ -29,12 +32,14 @@ import (
 	"github.com/gravitational/teleport/lib/cryptosuites"
 )
 
+const softwareHash = crypto.SHA256
+
 type softwareKeyStore struct {
 	rsaKeyPairSource RSAKeyPairSource
 }
 
 // RSAKeyPairSource is a function type which returns new RSA keypairs.
-type RSAKeyPairSource func() (priv []byte, pub []byte, err error)
+type RSAKeyPairSource func(alg cryptosuites.Algorithm) (priv []byte, pub []byte, err error)
 
 type softwareConfig struct {
 	rsaKeyPairSource RSAKeyPairSource
@@ -56,18 +61,19 @@ func (s *softwareKeyStore) keyTypeDescription() string {
 	return "raw software keys"
 }
 
-// generateRSA creates a new private key and returns its identifier and a crypto.Signer. The returned
+// generateSigner creates a new private key and returns its identifier and a crypto.Signer. The returned
 // identifier for softwareKeyStore is a pem-encoded private key, and can be passed to getSigner later to get
 // an equivalent crypto.Signer.
-func (s *softwareKeyStore) generateKey(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
+func (s *softwareKeyStore) generateSigner(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Signer, error) {
 	if alg == cryptosuites.RSA2048 && s.rsaKeyPairSource != nil {
-		privateKeyPEM, _, err := s.rsaKeyPairSource()
+		privateKeyPEM, _, err := s.rsaKeyPairSource(alg)
 		if err != nil {
 			return nil, nil, err
 		}
-		signer, err := keys.ParsePrivateKey(privateKeyPEM)
-		return privateKeyPEM, signer, trace.Wrap(err)
+		privateKey, err := keys.ParsePrivateKey(privateKeyPEM)
+		return privateKeyPEM, privateKey, trace.Wrap(err)
 	}
+
 	signer, err := cryptosuites.GenerateKeyWithAlgorithm(alg)
 	if err != nil {
 		return nil, nil, err
@@ -76,13 +82,98 @@ func (s *softwareKeyStore) generateKey(ctx context.Context, alg cryptosuites.Alg
 	return privateKeyPEM, signer, trace.Wrap(err)
 }
 
+// oaepDecrypter captures and supplies the default opts that should be provided
+// at decryption time for convenience
+type oaepDecrypter struct {
+	crypto.Decrypter
+	hash crypto.Hash
+}
+
+func newOAEPDecrypter(hash crypto.Hash, decrypter crypto.Decrypter) oaepDecrypter {
+	return oaepDecrypter{
+		Decrypter: decrypter,
+		hash:      hash,
+	}
+}
+
+func (d oaepDecrypter) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) ([]byte, error) {
+	if opts == nil {
+		opts = &rsa.OAEPOptions{
+			Hash: d.hash,
+		}
+	}
+
+	plaintext, err := d.Decrypter.Decrypt(rand, ciphertext, opts)
+	return plaintext, trace.Wrap(err)
+}
+
+// generateDecrypter creates a new private key and returns its identifier and a [crypto.Decrypter]. The returned
+// identifier for softwareKeyStore is a pem-encoded private key, and can be passed to getDecrypter later to get
+// an equivalent crypto.Decrypter.
+func (s *softwareKeyStore) generateDecrypter(ctx context.Context, alg cryptosuites.Algorithm) ([]byte, crypto.Decrypter, crypto.Hash, error) {
+	if alg == cryptosuites.RSA4096 && s.rsaKeyPairSource != nil {
+		privateKeyPEM, _, err := s.rsaKeyPairSource(alg)
+		if err != nil {
+			return nil, nil, softwareHash, trace.Wrap(err)
+		}
+
+		privateKey, err := keys.ParsePrivateKey(privateKeyPEM)
+		if err != nil {
+			return nil, nil, softwareHash, trace.Wrap(err)
+		}
+
+		decrypter, ok := privateKey.Signer.(crypto.Decrypter)
+		if !ok {
+			return nil, nil, softwareHash, trace.Errorf("could not type assert crypto.Decrypter")
+		}
+
+		privateKeyDER, err := x509.MarshalPKCS8PrivateKey(privateKey.Signer)
+		if err != nil {
+			return nil, nil, softwareHash, trace.Wrap(err)
+		}
+
+		return privateKeyDER, newOAEPDecrypter(softwareHash, decrypter), softwareHash, trace.Wrap(err)
+	}
+
+	key, err := cryptosuites.GenerateDecrypterWithAlgorithm(alg)
+	if err != nil {
+		return nil, nil, softwareHash, trace.Wrap(err)
+	}
+
+	privateKey, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return nil, nil, softwareHash, trace.Wrap(err)
+	}
+
+	return privateKey, newOAEPDecrypter(softwareHash, key), softwareHash, trace.Wrap(err)
+}
+
 // getSigner returns a crypto.Signer for the given pem-encoded private key.
 func (s *softwareKeyStore) getSigner(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey) (crypto.Signer, error) {
 	return keys.ParsePrivateKey(rawKey)
 }
 
-// canSignWithKey returns true if the given key is a raw key.
-func (s *softwareKeyStore) canSignWithKey(ctx context.Context, _ []byte, keyType types.PrivateKeyType) (bool, error) {
+// getDecrypter returns a crypto.Decrypter for the given pem-encoded private key.
+func (s *softwareKeyStore) getDecrypter(ctx context.Context, rawKey []byte, publicKey crypto.PublicKey, hash crypto.Hash) (crypto.Decrypter, error) {
+	privateKey, err := x509.ParsePKCS8PrivateKey(rawKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	decrypter, ok := privateKey.(crypto.Decrypter)
+	if !ok {
+		return nil, trace.Errorf("unsupported encryption key type %T", privateKey)
+	}
+
+	return newOAEPDecrypter(softwareHash, decrypter), nil
+}
+
+func (s *softwareKeyStore) findDecryptersByLabel(ctx context.Context, label *types.KeyLabel) ([]crypto.Decrypter, error) {
+	return nil, trace.NotImplemented("software decryption keys do not support lookup by label")
+}
+
+// canUseKey returns true if the given key is a raw key.
+func (s *softwareKeyStore) canUseKey(ctx context.Context, _ []byte, keyType types.PrivateKeyType) (bool, error) {
 	return keyType == types.PrivateKeyType_RAW, nil
 }
 
diff --git a/lib/auth/keystore/testhelpers.go b/lib/auth/keystore/testhelpers.go
deleted file mode 100644
index 1bb11eae9765d..0000000000000
--- a/lib/auth/keystore/testhelpers.go
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package keystore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
-)
-
-func HSMTestConfig(t *testing.T) servicecfg.KeystoreConfig {
-	if cfg, ok := yubiHSMTestConfig(t); ok {
-		t.Log("Running test with YubiHSM")
-		return cfg
-	}
-	if cfg, ok := cloudHSMTestConfig(t); ok {
-		t.Log("Running test with AWS CloudHSM")
-		return cfg
-	}
-	if cfg, ok := awsKMSTestConfig(t); ok {
-		t.Log("Running test with AWS KMS")
-		return cfg
-	}
-	if cfg, ok := gcpKMSTestConfig(t); ok {
-		t.Log("Running test with GCP KMS")
-		return cfg
-	}
-	if cfg, ok := softHSMTestConfig(t); ok {
-		t.Log("Running test with SoftHSM")
-		return cfg
-	}
-	t.Skip("No HSM available for test")
-	return servicecfg.KeystoreConfig{}
-}
-
-func yubiHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
-	yubiHSMPath := os.Getenv("TELEPORT_TEST_YUBIHSM_PKCS11_PATH")
-	yubiHSMPin := os.Getenv("TELEPORT_TEST_YUBIHSM_PIN")
-	if yubiHSMPath == "" || yubiHSMPin == "" {
-		return servicecfg.KeystoreConfig{}, false
-	}
-	slotNumber := 0
-	return servicecfg.KeystoreConfig{
-		PKCS11: servicecfg.PKCS11Config{
-			Path:       yubiHSMPath,
-			SlotNumber: &slotNumber,
-			PIN:        yubiHSMPin,
-		},
-	}, true
-}
-
-func cloudHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
-	cloudHSMPin := os.Getenv("TELEPORT_TEST_CLOUDHSM_PIN")
-	if cloudHSMPin == "" {
-		return servicecfg.KeystoreConfig{}, false
-	}
-	return servicecfg.KeystoreConfig{
-		PKCS11: servicecfg.PKCS11Config{
-			Path:       "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so",
-			TokenLabel: "cavium",
-			PIN:        cloudHSMPin,
-		},
-	}, true
-}
-
-func awsKMSTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
-	awsKMSAccount := os.Getenv("TELEPORT_TEST_AWS_KMS_ACCOUNT")
-	awsKMSRegion := os.Getenv("TELEPORT_TEST_AWS_KMS_REGION")
-	if awsKMSAccount == "" || awsKMSRegion == "" {
-		return servicecfg.KeystoreConfig{}, false
-	}
-	return servicecfg.KeystoreConfig{
-		AWSKMS: &servicecfg.AWSKMSConfig{
-			AWSAccount: awsKMSAccount,
-			AWSRegion:  awsKMSRegion,
-		},
-	}, true
-}
-
-func gcpKMSTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
-	gcpKeyring := os.Getenv("TELEPORT_TEST_GCP_KMS_KEYRING")
-	if gcpKeyring == "" {
-		return servicecfg.KeystoreConfig{}, false
-	}
-	return servicecfg.KeystoreConfig{
-		GCPKMS: servicecfg.GCPKMSConfig{
-			KeyRing:         gcpKeyring,
-			ProtectionLevel: "SOFTWARE",
-		},
-	}, true
-}
-
-var (
-	cachedSoftHSMConfig      *servicecfg.KeystoreConfig
-	cachedSoftHSMConfigMutex sync.Mutex
-)
-
-// softHSMTestConfig is for use in tests only and creates a test SOFTHSM2 token.
-// This should be used for all tests which need to use SoftHSM because the
-// library can only be initialized once and SOFTHSM2_PATH and SOFTHSM2_CONF
-// cannot be changed. New tokens added after the library has been initialized
-// will not be found by the library.
-//
-// A new token will be used for each `go test` invocation, but it's difficult
-// to create a separate token for each test because because new tokens
-// added after the library has been initialized will not be found by the
-// library. It's also difficult to clean up the token because tests for all
-// packages are run in parallel there is not a good time to safely
-// delete the token or the entire token directory. Each test should clean up
-// all keys that it creates because SoftHSM2 gets really slow when there are
-// many keys for a given token.
-func softHSMTestConfig(t *testing.T) (servicecfg.KeystoreConfig, bool) {
-	path := os.Getenv("SOFTHSM2_PATH")
-	if path == "" {
-		return servicecfg.KeystoreConfig{}, false
-	}
-
-	cachedSoftHSMConfigMutex.Lock()
-	defer cachedSoftHSMConfigMutex.Unlock()
-
-	if cachedSoftHSMConfig != nil {
-		return *cachedSoftHSMConfig, true
-	}
-
-	if os.Getenv("SOFTHSM2_CONF") == "" {
-		// create tokendir
-		tokenDir, err := os.MkdirTemp("", "tokens")
-		require.NoError(t, err)
-
-		// create config file
-		configFile, err := os.CreateTemp("", "softhsm2.conf")
-		require.NoError(t, err)
-
-		// write config file
-		_, err = fmt.Fprintf(configFile, "directories.tokendir = %s\nobjectstore.backend = file\nlog.level = DEBUG\n", tokenDir)
-		require.NoError(t, err)
-		require.NoError(t, configFile.Close())
-
-		// set env
-		os.Setenv("SOFTHSM2_CONF", configFile.Name())
-	}
-
-	// create test token (max length is 32 chars)
-	tokenLabel := strings.ReplaceAll(uuid.NewString(), "-", "")
-	cmd := exec.Command("softhsm2-util", "--init-token", "--free", "--label", tokenLabel, "--so-pin", "password", "--pin", "password")
-	t.Logf("Running command: %q", cmd)
-	if err := cmd.Run(); err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			require.NoError(t, exitErr, "error creating test softhsm token: %s", string(exitErr.Stderr))
-		}
-		require.NoError(t, err, "error attempting to run softhsm2-util")
-	}
-
-	cachedSoftHSMConfig = &servicecfg.KeystoreConfig{
-		PKCS11: servicecfg.PKCS11Config{
-			Path:       path,
-			TokenLabel: tokenLabel,
-			PIN:        "password",
-		},
-	}
-	return *cachedSoftHSMConfig, true
-}
-
-type testKeystoreOptions struct {
-	rsaKeyPairSource RSAKeyPairSource
-}
-
-type TestKeystoreOption func(*testKeystoreOptions)
-
-func WithRSAKeyPairSource(rsaKeyPairSource RSAKeyPairSource) TestKeystoreOption {
-	return func(opts *testKeystoreOptions) {
-		opts.rsaKeyPairSource = rsaKeyPairSource
-	}
-}
-
-// NewSoftwareKeystoreForTests returns a new *Manager that is valid for tests not specifically testing the
-// keystore functionality.
-func NewSoftwareKeystoreForTests(_ *testing.T, opts ...TestKeystoreOption) *Manager {
-	var options testKeystoreOptions
-	for _, opt := range opts {
-		opt(&options)
-	}
-	softwareBackend := newSoftwareKeyStore(&softwareConfig{rsaKeyPairSource: options.rsaKeyPairSource})
-	return &Manager{
-		backendForNewKeys:     softwareBackend,
-		usableSigningBackends: []backend{softwareBackend},
-		currentSuiteGetter: cryptosuites.GetSuiteFunc(func(context.Context) (types.SignatureAlgorithmSuite, error) {
-			return types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1, nil
-		}),
-	}
-}
-
-type fakeAuthPreferenceGetter struct {
-	suite types.SignatureAlgorithmSuite
-}
-
-func (f *fakeAuthPreferenceGetter) GetAuthPreference(context.Context) (types.AuthPreference, error) {
-	return &types.AuthPreferenceV2{
-		Spec: types.AuthPreferenceSpecV2{
-			SignatureAlgorithmSuite: f.suite,
-		},
-	}, nil
-}
diff --git a/lib/auth/machineid/machineidv1/auto_update_version_reporter.go b/lib/auth/machineid/machineidv1/auto_update_version_reporter.go
new file mode 100644
index 0000000000000..8c1e728fb5482
--- /dev/null
+++ b/lib/auth/machineid/machineidv1/auto_update_version_reporter.go
@@ -0,0 +1,357 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package machineidv1
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/prometheus/client_golang/prometheus"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	update "github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// AutoUpdateVersionReporter aggregates bot instance version numbers into an
+// `autoupdate_bot_instancenreport` resource periodically. We run a single
+// leader-elected instance of the reporter per cluster.
+type AutoUpdateVersionReporter struct {
+	clock      clockwork.Clock
+	logger     *slog.Logger
+	store      AutoUpdateReportStore
+	cache      BotInstancesCache
+	semaphores types.Semaphores
+	hostUUID   string
+
+	mu       sync.Mutex
+	leaderCh chan struct{}
+}
+
+// AutoUpdateReportStore is used to write the report.
+type AutoUpdateReportStore interface {
+	UpsertAutoUpdateBotInstanceReport(ctx context.Context, report *autoupdate.AutoUpdateBotInstanceReport) (*autoupdate.AutoUpdateBotInstanceReport, error)
+}
+
+// AutoUpdateVersionReporterConfig holds configuration for a version reporter.
+type AutoUpdateVersionReporterConfig struct {
+	// Clock used to mock time in tests.
+	Clock clockwork.Clock
+
+	// Logger to which errors and messages will be written.
+	Logger *slog.Logger
+
+	// Store is used to write the report.
+	Store AutoUpdateReportStore
+
+	// Cache will be used to list and count the bot instances.
+	Cache BotInstancesCache
+
+	// Semaphores interface used to implement leader-election.
+	Semaphores types.Semaphores
+
+	// HostUUID is the identity of the host running the reporter.
+	HostUUID string
+}
+
+// NewAutoUpdateVersionReporter creates an AutoUpdateVersionReporter with the
+// given configuration. You must call Run to start the leader-election process
+// and Trigger whenever you want to generate a new report.
+func NewAutoUpdateVersionReporter(cfg AutoUpdateVersionReporterConfig) (*AutoUpdateVersionReporter, error) {
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	if cfg.Semaphores == nil {
+		return nil, trace.BadParameter("Semaphores is required")
+	}
+	if cfg.HostUUID == "" {
+		return nil, trace.BadParameter("HostUUID is required")
+	}
+	if cfg.Store == nil {
+		return nil, trace.BadParameter("Store is required")
+	}
+	if cfg.Cache == nil {
+		return nil, trace.BadParameter("Cache is required")
+	}
+	return &AutoUpdateVersionReporter{
+		clock:      cfg.Clock,
+		logger:     cfg.Logger,
+		cache:      cfg.Cache,
+		store:      cfg.Store,
+		semaphores: cfg.Semaphores,
+		hostUUID:   cfg.HostUUID,
+		leaderCh:   make(chan struct{}),
+	}, nil
+}
+
+// Run begins the leader-election process until the given context is canceled or
+// reaches its deadline. It will spawn a new goroutine, you do not need to run it
+// with the go keyword.
+func (r *AutoUpdateVersionReporter) Run(ctx context.Context) error {
+	// The runLeader method will do its own retrying around acquiring the
+	// semaphore. This retries the whole operation (e.g. after the lease is
+	// lost).
+	retry, err := retryutils.NewRetryV2(retryutils.RetryV2Config{
+		First:  30 * time.Second,
+		Driver: retryutils.NewExponentialDriver(30 * time.Second),
+		Max:    10 * time.Minute,
+		Jitter: retryutils.HalfJitter,
+		Clock:  r.clock,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer r.logger.DebugContext(ctx, "Shutting down")
+
+	for {
+		started := r.clock.Now()
+		r.runLeader(ctx)
+		leaderFor := r.clock.Since(started)
+
+		// Context is done, exit immediately.
+		if ctx.Err() != nil {
+			return nil
+		}
+
+		// If we were leader for a decent amount of time, any previous
+		// backoff likely doesn't apply anymore.
+		if leaderFor > 5*time.Minute {
+			retry.Reset()
+		}
+
+		// Wait for the next retry interval.
+		retry.Inc()
+
+		select {
+		case <-retry.After():
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+func (r *AutoUpdateVersionReporter) runLeader(ctx context.Context) error {
+	lease, err := services.AcquireSemaphoreLockWithRetry(
+		ctx,
+		services.SemaphoreLockConfigWithRetry{
+			SemaphoreLockConfig: services.SemaphoreLockConfig{
+				Service: r.semaphores,
+				Params: types.AcquireSemaphoreRequest{
+					SemaphoreKind: types.KindAuthServer,
+					SemaphoreName: "auto_update_bot_version_reporter",
+					MaxLeases:     1,
+					Holder:        r.hostUUID,
+				},
+				Expiry: 1 * time.Minute,
+				Clock:  r.clock,
+			},
+			Retry: retryutils.LinearConfig{
+				Clock:  r.clock,
+				First:  time.Second,
+				Step:   30 * time.Second,
+				Max:    1 * time.Minute,
+				Jitter: retryutils.DefaultJitter,
+			},
+		},
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer func() {
+		r.mu.Lock()
+		r.leaderCh = make(chan struct{})
+		r.mu.Unlock()
+
+		r.logger.DebugContext(ctx, "No longer the leader")
+		lease.Stop()
+
+		if err := lease.Wait(); err != nil {
+			r.logger.WarnContext(ctx, "Error cleaning up semaphore", "error", err)
+		}
+	}()
+
+	r.mu.Lock()
+	close(r.leaderCh)
+	r.mu.Unlock()
+
+	r.logger.DebugContext(ctx, "Acquired semaphore and became the leader")
+
+	select {
+	case <-lease.Done():
+		return lease.Err()
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// Report triggers the generation of a new report, ignored if the reporter is
+// not the current elected leader. This method is typically called by the auth
+// server's runPeriodicOperations method.
+func (r *AutoUpdateVersionReporter) Report(ctx context.Context) error {
+	if !r.IsLeader() {
+		r.logger.DebugContext(ctx, "Not the leader, ignoring trigger to generate report")
+		return nil
+	}
+	if err := r.generateReport(ctx); err != nil {
+		r.logger.ErrorContext(ctx, "Failed to generate bot instance report", "error", err)
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (r *AutoUpdateVersionReporter) generateReport(ctx context.Context) error {
+	r.logger.DebugContext(ctx, "Generating report")
+
+	groups := make(map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup)
+
+	var nextToken string
+	for {
+		var (
+			instances []*machineidv1.BotInstance
+			err       error
+		)
+		instances, nextToken, err = r.cache.ListBotInstances(
+			ctx,
+			defaults.DefaultChunkSize,
+			nextToken,
+			nil,
+		)
+		if err != nil {
+			return trace.Wrap(err, "listing bot instances")
+		}
+
+		for _, inst := range instances {
+			// Defend against backends not removing expired items in a timely manner.
+			expiry := inst.GetMetadata().GetExpires().AsTime()
+			if expiry.Before(r.clock.Now()) && !expiry.IsZero() {
+				continue
+			}
+
+			// Take the version information from the latest heartbeat.
+			heartbeats := inst.GetStatus().GetLatestHeartbeats()
+			if len(heartbeats) == 0 {
+				continue
+			}
+			latest := heartbeats[len(heartbeats)-1]
+
+			// If the bot did not send an ExternalUpdater, it does not properly
+			// support managed updates - so we put it in the no-group ("") group.
+			var groupName string
+			if ui := latest.GetUpdaterInfo(); latest.ExternalUpdater != "" && ui != nil {
+				groupName = ui.UpdateGroup
+			}
+
+			group, ok := groups[groupName]
+			if !ok {
+				group = &autoupdate.AutoUpdateBotInstanceReportSpecGroup{
+					Versions: make(map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion),
+				}
+				groups[groupName] = group
+			}
+
+			version, ok := group.Versions[latest.GetVersion()]
+			if !ok {
+				version = &autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{}
+				group.Versions[latest.GetVersion()] = version
+			}
+			version.Count++
+		}
+
+		if nextToken == "" || len(instances) == 0 {
+			break
+		}
+	}
+
+	report, err := update.NewAutoUpdateBotInstanceReport(&autoupdate.AutoUpdateBotInstanceReportSpec{
+		Timestamp: timestamppb.New(r.clock.Now()),
+		Groups:    groups,
+	})
+	if err != nil {
+		return trace.Wrap(err, "creating report")
+	}
+	if _, err = r.store.UpsertAutoUpdateBotInstanceReport(ctx, report); err != nil {
+		return trace.Wrap(err, "storing report")
+	}
+
+	return nil
+}
+
+// LeaderCh returns a channel that will be closed when this instance of the
+// reporter becomes the leader. It is used to block in tests.
+func (r *AutoUpdateVersionReporter) LeaderCh() <-chan struct{} {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	return r.leaderCh
+}
+
+// IsLeader returns whether this instance of the reporter is the current leader.
+func (r *AutoUpdateVersionReporter) IsLeader() bool {
+	select {
+	case <-r.LeaderCh():
+		return true
+	default:
+		return false
+	}
+}
+
+// EmitInstancesMetric updates the given gauge metric based on the instance report.
+func EmitInstancesMetric(report *autoupdate.AutoUpdateBotInstanceReport, gauge *prometheus.GaugeVec) {
+	gauge.Reset()
+
+	byVersion := make(map[string]int32)
+
+	for group, groupMetrics := range report.GetSpec().GetGroups() {
+		// Empty group means the bot isn't using Managed Updates.
+		if group == "" {
+			for version, versionMetrics := range groupMetrics.GetVersions() {
+				gauge.With(prometheus.Labels{
+					teleport.TagVersion:          version,
+					teleport.TagAutomaticUpdates: "false",
+				}).Set(float64(versionMetrics.Count))
+			}
+			continue
+		}
+
+		for version, metrics := range groupMetrics.GetVersions() {
+			byVersion[version] += metrics.Count
+		}
+	}
+
+	for version, count := range byVersion {
+		gauge.With(prometheus.Labels{
+			teleport.TagVersion:          version,
+			teleport.TagAutomaticUpdates: "true",
+		}).Set(float64(count))
+	}
+}
diff --git a/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go b/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go
new file mode 100644
index 0000000000000..c87314315c46f
--- /dev/null
+++ b/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go
@@ -0,0 +1,223 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package machineidv1_test
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/slices"
+)
+
+func TestAutoUpdateVersionReporter(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	t.Cleanup(cancel)
+
+	clock := clockwork.NewFakeClockAt(time.Now().UTC())
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	autoUpdateService, err := local.NewAutoUpdateService(backend)
+	require.NoError(t, err)
+
+	botInstanceService, err := local.NewBotInstanceService(backend, clock)
+	require.NoError(t, err)
+
+	// Create a couple of bot instances with different versions.
+	createBotInstance := func(t *testing.T, group string, versions []string) {
+		t.Helper()
+
+		_, err = botInstanceService.CreateBotInstance(ctx, &machineidv1pb.BotInstance{
+			Metadata: &headerv1.Metadata{
+				Expires: timestamppb.New(clock.Now().Add(1 * time.Hour)),
+			},
+			Spec: &machineidv1pb.BotInstanceSpec{
+				InstanceId: uuid.NewString(),
+				BotName:    "bot-1234",
+			},
+			Status: &machineidv1pb.BotInstanceStatus{
+				LatestHeartbeats: slices.Map(versions, func(v string) *machineidv1pb.BotInstanceStatusHeartbeat {
+					heartbeat := &machineidv1pb.BotInstanceStatusHeartbeat{Version: v}
+					if group != "" {
+						heartbeat.ExternalUpdater = "kube"
+						heartbeat.UpdaterInfo = &types.UpdaterV2Info{UpdateGroup: group}
+					}
+					return heartbeat
+				}),
+			},
+		})
+		require.NoError(t, err)
+	}
+	createBotInstance(t, "", []string{"17.0.0", "18.0.0"})
+	createBotInstance(t, "", []string{"18.1.0"})
+	createBotInstance(t, "", []string{"18.1.0"})
+	createBotInstance(t, "prod", []string{"18.1.0"})
+	createBotInstance(t, "stage", []string{"19.0.0-dev"})
+
+	reporter, err := machineidv1.NewAutoUpdateVersionReporter(machineidv1.AutoUpdateVersionReporterConfig{
+		Clock:      clock,
+		Logger:     logtest.NewLogger(),
+		Store:      autoUpdateService,
+		Cache:      botInstanceService,
+		Semaphores: &testSemaphores{},
+		HostUUID:   uuid.NewString(),
+	})
+	require.NoError(t, err)
+
+	// Run the leader election process. Wait for the semaphore to be acquired.
+	errCh := make(chan error, 1)
+	go func() { errCh <- reporter.Run(ctx) }()
+
+	select {
+	case <-reporter.LeaderCh():
+	case <-time.After(1 * time.Second):
+		t.Fatal("timeout waiting for semaphore to be acquired")
+	}
+
+	// Trigger the report.
+	require.NoError(t, reporter.Report(ctx))
+
+	// Check the report records the bots.
+	report, err := autoUpdateService.GetAutoUpdateBotInstanceReport(ctx)
+	require.NoError(t, err)
+
+	diff := cmp.Diff(
+		&autoupdatev1pb.AutoUpdateBotInstanceReportSpec{
+			Timestamp: timestamppb.New(clock.Now()),
+			Groups: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup{
+				"prod": {
+					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+						"18.1.0": {Count: 1},
+					},
+				},
+				"stage": {
+					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+						"19.0.0-dev": {Count: 1},
+					},
+				},
+
+				// Unmanaged (no-group) group.
+				"": {
+					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+						"18.0.0": {Count: 1},
+						"18.1.0": {Count: 2},
+					},
+				},
+			},
+		},
+		report.GetSpec(),
+		protocmp.Transform(),
+	)
+	if diff != "" {
+		t.Fatal(diff)
+	}
+
+	cancel()
+	require.NoError(t, <-errCh)
+}
+
+func TestEmitInstancesMetric(t *testing.T) {
+	gauge := prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBotInstances,
+		},
+		[]string{
+			teleport.TagVersion,
+			teleport.TagAutomaticUpdates,
+		},
+	)
+
+	machineidv1.EmitInstancesMetric(
+		&autoupdatev1pb.AutoUpdateBotInstanceReport{
+			Spec: &autoupdatev1pb.AutoUpdateBotInstanceReportSpec{
+				Groups: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup{
+					"prod": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+							"18.0.0": {Count: 1},
+							"19.0.0": {Count: 1},
+						},
+					},
+					"stage": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+							"18.0.0": {Count: 1},
+							"19.0.0": {Count: 1},
+						},
+					},
+					"": {
+						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
+							"19.0.0": {Count: 123},
+							"20.0.0": {Count: 321},
+						},
+					},
+				},
+			},
+		},
+		gauge,
+	)
+
+	for _, tc := range []struct {
+		version          string
+		automaticUpdates bool
+		expectedValue    float64
+	}{
+		{version: "18.0.0", automaticUpdates: true, expectedValue: 2},
+		{version: "19.0.0", automaticUpdates: true, expectedValue: 2},
+		{version: "19.0.0", automaticUpdates: false, expectedValue: 123},
+		{version: "20.0.0", automaticUpdates: false, expectedValue: 321},
+	} {
+		t.Run(fmt.Sprintf("%s/%v", tc.version, tc.automaticUpdates), func(t *testing.T) {
+			metric := gauge.WithLabelValues(tc.version, strconv.FormatBool(tc.automaticUpdates))
+			require.InEpsilon(t, tc.expectedValue, testutil.ToFloat64(metric), 0)
+		})
+	}
+
+}
+
+type testSemaphores struct{ types.Semaphores }
+
+func (s *testSemaphores) AcquireSemaphore(ctx context.Context, params types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error) {
+	return &types.SemaphoreLease{}, nil
+}
diff --git a/lib/auth/machineid/machineidv1/bot_instance_service.go b/lib/auth/machineid/machineidv1/bot_instance_service.go
index db89348713956..3f0270545a4ff 100644
--- a/lib/auth/machineid/machineidv1/bot_instance_service.go
+++ b/lib/auth/machineid/machineidv1/bot_instance_service.go
@@ -21,6 +21,8 @@ package machineidv1
 import (
 	"context"
 	"log/slog"
+	"os"
+	"strconv"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -46,12 +48,28 @@ const (
 	// ensure the instance remains accessible until shortly after the last
 	// issued certificate expires.
 	ExpiryMargin = time.Minute * 5
+
+	// serviceNameLimit is the maximum length in bytes of a bot service name.
+	serviceNameLimit = 64
+
+	// statusReasonLimit is the maximum length in bytes of a service status reason.
+	statusReasonLimit = 256
 )
 
+// BotInstancesCache is the subset of the cached resources that the Service queries.
+type BotInstancesCache interface {
+	// GetBotInstance returns the specified BotInstance resource.
+	GetBotInstance(ctx context.Context, botName, instanceID string) (*pb.BotInstance, error)
+
+	// ListBotInstances returns a page of BotInstance resources.
+	ListBotInstances(ctx context.Context, pageSize int, lastToken string, options *services.ListBotInstancesRequestOptions) ([]*pb.BotInstance, string, error)
+}
+
 // BotInstanceServiceConfig holds configuration options for the BotInstance gRPC
 // service.
 type BotInstanceServiceConfig struct {
 	Authorizer authz.Authorizer
+	Cache      BotInstancesCache
 	Backend    services.BotInstance
 	Logger     *slog.Logger
 	Clock      clockwork.Clock
@@ -64,6 +82,8 @@ func NewBotInstanceService(cfg BotInstanceServiceConfig) (*BotInstanceService, e
 		return nil, trace.BadParameter("backend service is required")
 	case cfg.Authorizer == nil:
 		return nil, trace.BadParameter("authorizer is required")
+	case cfg.Cache == nil:
+		return nil, trace.BadParameter("cache service is required")
 	}
 
 	if cfg.Logger == nil {
@@ -76,6 +96,7 @@ func NewBotInstanceService(cfg BotInstanceServiceConfig) (*BotInstanceService, e
 	return &BotInstanceService{
 		logger:     cfg.Logger,
 		authorizer: cfg.Authorizer,
+		cache:      cfg.Cache,
 		backend:    cfg.Backend,
 		clock:      cfg.Clock,
 	}, nil
@@ -87,6 +108,7 @@ type BotInstanceService struct {
 
 	backend    services.BotInstance
 	authorizer authz.Authorizer
+	cache      BotInstancesCache
 	logger     *slog.Logger
 	clock      clockwork.Clock
 }
@@ -124,7 +146,7 @@ func (b *BotInstanceService) GetBotInstance(ctx context.Context, req *pb.GetBotI
 		return nil, trace.Wrap(err)
 	}
 
-	res, err := b.backend.GetBotInstance(ctx, req.BotName, req.InstanceId)
+	res, err := b.cache.GetBotInstance(ctx, req.BotName, req.InstanceId)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -134,6 +156,26 @@ func (b *BotInstanceService) GetBotInstance(ctx context.Context, req *pb.GetBotI
 
 // ListBotInstances returns a list of bot instances matching the criteria in the request
 func (b *BotInstanceService) ListBotInstances(ctx context.Context, req *pb.ListBotInstancesRequest) (*pb.ListBotInstancesResponse, error) {
+	var sortField string
+	var sortDesc bool
+	if req.GetSort() != nil {
+		sortField = req.GetSort().Field
+		sortDesc = req.GetSort().IsDesc
+	}
+	return b.ListBotInstancesV2(ctx, &pb.ListBotInstancesV2Request{
+		PageSize:  req.GetPageSize(),
+		PageToken: req.GetPageToken(),
+		SortField: sortField,
+		SortDesc:  sortDesc,
+		Filter: &pb.ListBotInstancesV2Request_Filters{
+			BotName:    req.GetFilterBotName(),
+			SearchTerm: req.GetFilterSearchTerm(),
+		},
+	})
+}
+
+// ListBotInstancesV2 returns a list of bot instances matching the criteria in the request
+func (b *BotInstanceService) ListBotInstancesV2(ctx context.Context, req *pb.ListBotInstancesV2Request) (*pb.ListBotInstancesResponse, error) {
 	authCtx, err := b.authorizer.Authorize(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -143,7 +185,13 @@ func (b *BotInstanceService) ListBotInstances(ctx context.Context, req *pb.ListB
 		return nil, trace.Wrap(err)
 	}
 
-	res, nextToken, err := b.backend.ListBotInstances(ctx, req.FilterBotName, int(req.PageSize), req.PageToken, req.FilterSearchTerm)
+	res, nextToken, err := b.cache.ListBotInstances(ctx, int(req.PageSize), req.PageToken, &services.ListBotInstancesRequestOptions{
+		SortField:        req.GetSortField(),
+		SortDesc:         req.GetSortDesc(),
+		FilterBotName:    req.GetFilter().GetBotName(),
+		FilterSearchTerm: req.GetFilter().GetSearchTerm(),
+		FilterQuery:      req.GetFilter().GetQuery(),
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -164,6 +212,17 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 		return nil, trace.BadParameter("heartbeat: must be non-nil")
 	}
 
+	for _, svcHealth := range req.GetServiceHealth() {
+		name := svcHealth.GetService().GetName()
+		if len(name) > serviceNameLimit {
+			return nil, trace.BadParameter("service name %q is longer than %d bytes", name, serviceNameLimit)
+		}
+		reason := svcHealth.GetReason()
+		if len(reason) > statusReasonLimit {
+			return nil, trace.BadParameter("service %q has a status reason longer than %d bytes", name, statusReasonLimit)
+		}
+	}
+
 	// Enforce that the connecting client is a bot and has a bot instance ID.
 	botName := authCtx.Identity.GetIdentity().BotName
 	botInstanceID := authCtx.Identity.GetIdentity().BotInstanceID
@@ -198,6 +257,11 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 		// Append the new heartbeat to the end.
 		instance.Status.LatestHeartbeats = append(instance.Status.LatestHeartbeats, req.Heartbeat)
 
+		if storeHeartbeatExtras() {
+			// Overwrite the service health.
+			instance.Status.ServiceHealth = req.ServiceHealth
+		}
+
 		return instance, nil
 	})
 	if err != nil {
@@ -206,3 +270,15 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 
 	return &pb.SubmitHeartbeatResponse{}, nil
 }
+
+// storeHeartbeatExtras returns whether we should store "extra" data submitted
+// with tbot heartbeats, such as the service health. Defaults to true unless the
+// TELEPORT_DISABLE_TBOT_HEARTBEAT_EXTRAS environment variable is set to true on
+// the auth server.
+func storeHeartbeatExtras() bool {
+	disabled, err := strconv.ParseBool(os.Getenv("TELEPORT_DISABLE_TBOT_HEARTBEAT_EXTRAS"))
+	if err != nil {
+		return true
+	}
+	return !disabled
+}
diff --git a/lib/auth/machineid/machineidv1/bot_instance_service_test.go b/lib/auth/machineid/machineidv1/bot_instance_service_test.go
index 5b79a70cd0e9c..5a2662740798b 100644
--- a/lib/auth/machineid/machineidv1/bot_instance_service_test.go
+++ b/lib/auth/machineid/machineidv1/bot_instance_service_test.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"slices"
 	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -69,6 +70,14 @@ func TestBotInstanceServiceAccess(t *testing.T) {
 			},
 			allowedVerbs: []string{types.VerbRead, types.VerbList},
 		},
+		{
+			name: "ListBotInstancesV2",
+			allowedStates: []authz.AdminActionAuthState{
+				authz.AdminActionAuthUnauthorized, authz.AdminActionAuthNotRequired,
+				authz.AdminActionAuthMFAVerified, authz.AdminActionAuthMFAVerifiedWithReuse,
+			},
+			allowedVerbs: []string{types.VerbRead, types.VerbList},
+		},
 		{
 			name: "DeleteBotInstance",
 			allowedStates: []authz.AdminActionAuthState{
@@ -257,6 +266,7 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		createBotInstance bool
 		assertErr         assert.ErrorAssertionFunc
 		wantHeartbeat     bool
+		wantServiceHealth []*machineidv1.BotInstanceServiceHealth
 	}{
 		{
 			name:              "success",
@@ -265,10 +275,30 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
 					Hostname: "llama",
 				},
+				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
+					{
+						Service: &machineidv1.BotInstanceServiceIdentifier{
+							Type: "application-tunnel",
+							Name: "my-application-tunnel",
+						},
+						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+						Reason: ptr("application is broken"),
+					},
+				},
 			},
 			identity:      goodIdentity,
 			assertErr:     assert.NoError,
 			wantHeartbeat: true,
+			wantServiceHealth: []*machineidv1.BotInstanceServiceHealth{
+				{
+					Service: &machineidv1.BotInstanceServiceIdentifier{
+						Type: "application-tunnel",
+						Name: "my-application-tunnel",
+					},
+					Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+					Reason: ptr("application is broken"),
+				},
+			},
 		},
 		{
 			name:              "missing bot name",
@@ -327,6 +357,54 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 			},
 			wantHeartbeat: false,
 		},
+		{
+			name:              "service name too long",
+			createBotInstance: true,
+			req: &machineidv1.SubmitHeartbeatRequest{
+				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+					Hostname: "llama",
+				},
+				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
+					{
+						Service: &machineidv1.BotInstanceServiceIdentifier{
+							Type: "application-tunnel",
+							Name: strings.Repeat("a", 100),
+						},
+						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+						Reason: ptr("application is broken"),
+					},
+				},
+			},
+			identity: goodIdentity,
+			assertErr: func(t assert.TestingT, err error, i ...any) bool {
+				return assert.True(t, trace.IsBadParameter(err)) && assert.Contains(t, err.Error(), "is longer than 64 bytes")
+			},
+			wantHeartbeat: false,
+		},
+		{
+			name:              "status reason too long",
+			createBotInstance: true,
+			req: &machineidv1.SubmitHeartbeatRequest{
+				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+					Hostname: "llama",
+				},
+				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
+					{
+						Service: &machineidv1.BotInstanceServiceIdentifier{
+							Type: "application-tunnel",
+							Name: "my-application-tunnel",
+						},
+						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+						Reason: ptr(strings.Repeat("a", 300)),
+					},
+				},
+			},
+			identity: goodIdentity,
+			assertErr: func(t assert.TestingT, err error, i ...any) bool {
+				return assert.True(t, trace.IsBadParameter(err)) && assert.Contains(t, err.Error(), "status reason longer than 256 bytes")
+			},
+			wantHeartbeat: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -334,6 +412,7 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 			backend := newBotInstanceBackend(t)
 			service, err := NewBotInstanceService(BotInstanceServiceConfig{
 				Backend: backend,
+				Cache:   backend,
 				Authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 					return &authz.Context{
 						Identity: identityGetterFn(func() tlsca.Identity {
@@ -376,6 +455,13 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 					assert.Nil(t, bi.Status.InitialHeartbeat)
 					assert.Empty(t, bi.Status.LatestHeartbeats)
 				}
+				assert.Empty(t,
+					cmp.Diff(
+						bi.Status.ServiceHealth,
+						tt.wantServiceHealth,
+						protocmp.Transform(),
+					),
+				)
 			}
 		})
 	}
@@ -391,6 +477,7 @@ func TestBotInstanceServiceSubmitHeartbeat_HeartbeatLimit(t *testing.T) {
 	backend := newBotInstanceBackend(t)
 	service, err := NewBotInstanceService(BotInstanceServiceConfig{
 		Backend: backend,
+		Cache:   backend,
 		Authorizer: authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 			return &authz.Context{
 				Identity: identityGetterFn(func() tlsca.Identity {
@@ -583,8 +670,11 @@ func newBotInstanceService(
 	service, err := NewBotInstanceService(BotInstanceServiceConfig{
 		Authorizer: authorizer,
 		Backend:    backendService,
+		Cache:      backendService,
 	})
 	require.NoError(t, err)
 
 	return service
 }
+
+func ptr[T any](v T) *T { return &v }
diff --git a/lib/auth/machineid/machineidv1/bot_service.go b/lib/auth/machineid/machineidv1/bot_service.go
index a2088135d8e8f..3e9933fe52abf 100644
--- a/lib/auth/machineid/machineidv1/bot_service.go
+++ b/lib/auth/machineid/machineidv1/bot_service.go
@@ -49,6 +49,7 @@ var SupportedJoinMethods = []types.JoinMethod{
 	types.JoinMethodAzure,
 	types.JoinMethodAzureDevops,
 	types.JoinMethodCircleCI,
+	types.JoinMethodEnv0,
 	types.JoinMethodGCP,
 	types.JoinMethodGitHub,
 	types.JoinMethodGitLab,
@@ -59,6 +60,7 @@ var SupportedJoinMethods = []types.JoinMethod{
 	types.JoinMethodTPM,
 	types.JoinMethodTerraformCloud,
 	types.JoinMethodBitbucket,
+	types.JoinMethodOracle,
 	types.JoinMethodBoundKeypair,
 }
 
@@ -525,6 +527,10 @@ func (bs *BotService) UpdateBot(
 			opts := role.GetOptions()
 			opts.MaxSessionTTL = types.Duration(req.Bot.Spec.MaxSessionTtl.AsDuration())
 			role.SetOptions(opts)
+		case "metadata.description":
+			meta := user.GetMetadata()
+			meta.Description = req.Bot.Metadata.Description
+			user.SetMetadata(meta)
 		default:
 			return nil, trace.BadParameter("update_mask: unsupported path %q", path)
 		}
@@ -725,8 +731,9 @@ func botFromUserAndRole(user types.User, role types.Role) (*pb.Bot, error) {
 		Kind:    types.KindBot,
 		Version: types.V1,
 		Metadata: &headerv1.Metadata{
-			Name:    botName,
-			Expires: expiry,
+			Name:        botName,
+			Expires:     expiry,
+			Description: user.GetMetadata().Description,
 		},
 		Status: &pb.BotStatus{
 			UserName: user.GetName(),
@@ -821,6 +828,9 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 	// previous user before writing if necessary
 	userMeta.Labels[types.BotGenerationLabel] = "0"
 	userMeta.Expires = userAndRoleExpiryFromBot(bot)
+	// We track the Bot description within the User description field because
+	// the Role description already has a message.
+	userMeta.Description = bot.Metadata.Description
 	user.SetMetadata(userMeta)
 
 	traits := map[string][]string{}
diff --git a/lib/auth/machineid/machineidv1/expression/environment.go b/lib/auth/machineid/machineidv1/expression/environment.go
new file mode 100644
index 0000000000000..f6a1baed0055b
--- /dev/null
+++ b/lib/auth/machineid/machineidv1/expression/environment.go
@@ -0,0 +1,58 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package expression
+
+import (
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+)
+
+// Environment in which expressions will be evaluated.
+type Environment struct {
+	Metadata             *headerv1.Metadata
+	Spec                 *machineidv1.BotInstanceSpec
+	LatestHeartbeat      *machineidv1.BotInstanceStatusHeartbeat
+	LatestAuthentication *machineidv1.BotInstanceStatusAuthentication
+}
+
+func (e *Environment) GetMetadata() *headerv1.Metadata {
+	if e == nil {
+		return nil
+	}
+	return e.Metadata
+}
+
+func (e *Environment) GetSpec() *machineidv1.BotInstanceSpec {
+	if e == nil {
+		return nil
+	}
+	return e.Spec
+}
+
+func (e *Environment) GetLatestHeartbeat() *machineidv1.BotInstanceStatusHeartbeat {
+	if e == nil {
+		return nil
+	}
+	return e.LatestHeartbeat
+}
+
+func (e *Environment) GetLatestAuthentication() *machineidv1.BotInstanceStatusAuthentication {
+	if e == nil {
+		return nil
+	}
+	return e.LatestAuthentication
+}
diff --git a/lib/auth/machineid/machineidv1/expression/expression.go b/lib/auth/machineid/machineidv1/expression/expression.go
new file mode 100644
index 0000000000000..1c6dae206950e
--- /dev/null
+++ b/lib/auth/machineid/machineidv1/expression/expression.go
@@ -0,0 +1,134 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package expression
+
+import (
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/expression"
+	"github.com/gravitational/teleport/lib/utils/typical"
+)
+
+func NewBotInstanceExpressionParser() (*typical.Parser[*Environment, bool], error) {
+	spec := expression.DefaultParserSpec[*Environment]()
+
+	spec.Variables = map[string]typical.Variable{
+		"name": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetMetadata().GetName(), nil
+		}),
+		"metadata.name": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetMetadata().GetName(), nil
+		}),
+		"spec.bot_name": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetSpec().GetBotName(), nil
+		}),
+		"spec.instance_id": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetSpec().GetInstanceId(), nil
+		}),
+		"status.latest_heartbeat.architecture": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetLatestHeartbeat().GetArchitecture(), nil
+		}),
+		"status.latest_heartbeat.os": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetLatestHeartbeat().GetOs(), nil
+		}),
+		"status.latest_heartbeat.hostname": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetLatestHeartbeat().GetHostname(), nil
+		}),
+		"status.latest_heartbeat.one_shot": typical.DynamicVariable(func(env *Environment) (bool, error) {
+			return env.GetLatestHeartbeat().GetOneShot(), nil
+		}),
+		"status.latest_heartbeat.version": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetLatestHeartbeat().GetVersion(), nil
+		}),
+		"status.latest_authentication.join_method": typical.DynamicVariable(func(env *Environment) (string, error) {
+			return env.GetLatestAuthentication().GetJoinMethod(), nil
+		}),
+	}
+
+	// e.g. `newer_than(status.latest_heartbeat.version, "19.0.0")`
+	spec.Functions["newer_than"] = typical.BinaryFunction[*Environment](semverGt)
+	// e.g. `older_than(status.latest_heartbeat.version, "19.0.2")`
+	spec.Functions["older_than"] = typical.BinaryFunction[*Environment](semverLt)
+	// e.g. `between(status.latest_heartbeat.version, "19.0.0", "19.0.2")`
+	spec.Functions["between"] = typical.TernaryFunction[*Environment](semverBetween)
+
+	return typical.NewParser[*Environment, bool](spec)
+}
+
+func semverGt(a, b any) (bool, error) {
+	va, err := toSemver(a)
+	if va == nil || err != nil {
+		return false, err
+	}
+	vb, err := toSemver(b)
+	if vb == nil || err != nil {
+		return false, err
+	}
+	return va.Compare(*vb) > 0, nil
+}
+
+func semverLt(a, b any) (bool, error) {
+	va, err := toSemver(a)
+	if va == nil || err != nil {
+		return false, err
+	}
+	vb, err := toSemver(b)
+	if vb == nil || err != nil {
+		return false, err
+	}
+	return va.Compare(*vb) < 0, nil
+}
+
+func semverEq(a, b any) (bool, error) {
+	va, err := toSemver(a)
+	if va == nil || err != nil {
+		return false, err
+	}
+	vb, err := toSemver(b)
+	if vb == nil || err != nil {
+		return false, err
+	}
+	return va.Compare(*vb) == 0, nil
+}
+
+func semverBetween(c, a, b any) (bool, error) {
+	gt, err := semverGt(c, a)
+	if err != nil {
+		return false, err
+	}
+	eq, err := semverEq(c, a)
+	if err != nil {
+		return false, err
+	}
+	lt, err := semverLt(c, b)
+	if err != nil {
+		return false, err
+	}
+	return (gt || eq) && lt, nil
+}
+
+func toSemver(anyV any) (*semver.Version, error) {
+	switch v := anyV.(type) {
+	case *semver.Version:
+		return v, nil
+	case string:
+		return semver.NewVersion(v)
+	default:
+		return nil, trace.BadParameter("type %T cannot be parsed as semver.Version", v)
+	}
+}
diff --git a/lib/auth/machineid/machineidv1/expression/expression_test.go b/lib/auth/machineid/machineidv1/expression/expression_test.go
new file mode 100644
index 0000000000000..44a64da40750e
--- /dev/null
+++ b/lib/auth/machineid/machineidv1/expression/expression_test.go
@@ -0,0 +1,162 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package expression
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+)
+
+func TestBotInstanceExpressionParser(t *testing.T) {
+	parser, err := NewBotInstanceExpressionParser()
+	require.NoError(t, err)
+
+	makeBaseEnv := func() Environment {
+		return Environment{
+			Metadata: &headerv1.Metadata{
+				Name: "test-bot-1/76efb07a-3077-471c-988a-54d0fa49fc71",
+			},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "test-bot-1",
+				InstanceId: "76efb07a-3077-471c-988a-54d0fa49fc71",
+			},
+			LatestAuthentication: &machineidv1.BotInstanceStatusAuthentication{
+				JoinMethod: "kubernetes",
+			},
+			LatestHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				IsStartup:    false,
+				Version:      "19.0.1",
+				OneShot:      false,
+				Architecture: "arm64",
+				Os:           "linux",
+				Hostname:     "test-hostname-1",
+			},
+		}
+	}
+
+	tcs := []struct {
+		name     string
+		expTrue  string
+		expFalse string
+		envFns   []func(*Environment)
+	}{
+		{
+			name:     "equals name",
+			expTrue:  `metadata.name == "test-bot-1/76efb07a-3077-471c-988a-54d0fa49fc71"`,
+			expFalse: `metadata.name == "test-bot-2/bf8ad485-9a8f-483d-8bcb-9d2f8f8c48d0"`,
+		},
+		{
+			name:     "equals name (short)",
+			expTrue:  `name == "test-bot-1/76efb07a-3077-471c-988a-54d0fa49fc71"`,
+			expFalse: `name == "test-bot-2/bf8ad485-9a8f-483d-8bcb-9d2f8f8c48d0"`,
+		},
+		{
+			name:     "equals bot name",
+			expTrue:  `spec.bot_name == "test-bot-1"`,
+			expFalse: `spec.bot_name == "test-bot-2"`,
+		},
+		{
+			name:     "equals instance id",
+			expTrue:  `spec.instance_id == "76efb07a-3077-471c-988a-54d0fa49fc71"`,
+			expFalse: `spec.instance_id == "80eefb93-e79c-47f1-8170-a025013da490"`,
+		},
+		{
+			name:     "equals architecture",
+			expTrue:  `status.latest_heartbeat.architecture == "arm64"`,
+			expFalse: `status.latest_heartbeat.architecture == "amd64"`,
+		},
+		{
+			name:     "equals os",
+			expTrue:  `status.latest_heartbeat.os == "linux"`,
+			expFalse: `status.latest_heartbeat.os == "windows"`,
+		},
+		{
+			name:     "equals hostname",
+			expTrue:  `status.latest_heartbeat.hostname == "test-hostname-1"`,
+			expFalse: `status.latest_heartbeat.hostname == "test-hostname-2"`,
+		},
+		{
+			name:     "equals one shot",
+			expTrue:  `status.latest_heartbeat.one_shot`,
+			expFalse: `!status.latest_heartbeat.one_shot`,
+			envFns: []func(*Environment){
+				func(e *Environment) {
+					e.LatestHeartbeat = &machineidv1.BotInstanceStatusHeartbeat{
+						OneShot: true,
+					}
+				},
+			},
+		},
+		{
+			name:     "exact version",
+			expTrue:  `status.latest_heartbeat.version == "19.0.1"`,
+			expFalse: `status.latest_heartbeat.version == "19.0.2-rc.1+56001"`,
+		},
+		{
+			name:     "between versions - lower",
+			expTrue:  `between(status.latest_heartbeat.version, "19.0.1", "19.0.2")`,
+			expFalse: `between(status.latest_heartbeat.version, "19.0.2", "19.0.3")`,
+		},
+		{
+			name:     "between versions - upper",
+			expTrue:  `between(status.latest_heartbeat.version, "19.0.0", "19.0.2")`,
+			expFalse: `between(status.latest_heartbeat.version, "19.0.0", "19.0.1")`,
+		},
+		{
+			name:     "newer than version",
+			expTrue:  `newer_than(status.latest_heartbeat.version, "19.0.0")`,
+			expFalse: `newer_than(status.latest_heartbeat.version, "19.0.1")`,
+		},
+		{
+			name:     "older than version",
+			expTrue:  `older_than(status.latest_heartbeat.version, "19.0.2")`,
+			expFalse: `older_than(status.latest_heartbeat.version, "19.0.1")`,
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			env := makeBaseEnv()
+			if tc.envFns != nil {
+				for _, fn := range tc.envFns {
+					fn(&env)
+				}
+			}
+
+			if tc.expTrue != "" {
+				exp, err := parser.Parse(tc.expTrue)
+				require.NoError(t, err)
+				result, err := exp.Evaluate(&env)
+				require.NoError(t, err)
+				assert.True(t, result)
+			}
+
+			if tc.expFalse != "" {
+				exp, err := parser.Parse(tc.expFalse)
+				require.NoError(t, err)
+				result, err := exp.Evaluate(&env)
+				require.NoError(t, err)
+				assert.False(t, result)
+			}
+		})
+	}
+}
diff --git a/lib/auth/machineid/machineidv1/machineidv1_test.go b/lib/auth/machineid/machineidv1/machineidv1_test.go
index bf0851e5a322c..e8a9b41a0be6e 100644
--- a/lib/auth/machineid/machineidv1/machineidv1_test.go
+++ b/lib/auth/machineid/machineidv1/machineidv1_test.go
@@ -41,7 +41,7 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	libdefaults "github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events/eventstest"
@@ -72,7 +72,7 @@ func TestCreateBot(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botCreator, _, err := auth.CreateUserAndRole(
+	botCreator, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-creator",
 		[]string{},
@@ -83,7 +83,7 @@ func TestCreateBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	botCreatorWhere, _, err := auth.CreateUserAndRole(
+	botCreatorWhere, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-creator-where",
 		[]string{},
@@ -95,16 +95,16 @@ func TestCreateBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	testRole, err := auth.CreateRole(
+	testRole, err := authtest.CreateRole(
 		ctx, srv.Auth(), "test-role", types.RoleSpecV6{},
 	)
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(
+	unprivilegedUser, err := authtest.CreateUser(
 		ctx, srv.Auth(), "no-perms", testRole,
 	)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
@@ -147,6 +147,7 @@ func TestCreateBot(t *testing.T) {
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
+						Description: "Property of US Robotics and Mechanical Men.",
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{testRole.GetName()},
@@ -176,6 +177,7 @@ func TestCreateBot(t *testing.T) {
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
+					Description: "Property of US Robotics and Mechanical Men.",
 				},
 				Spec: &machineidv1pb.BotSpec{
 					Roles: []string{testRole.GetName()},
@@ -204,6 +206,7 @@ func TestCreateBot(t *testing.T) {
 						"my-label":               "my-value",
 						"my-other-label":         "my-other-value",
 					},
+					Description: "Property of US Robotics and Mechanical Men.",
 				},
 				Spec: types.UserSpecV2{
 					CreatedBy: types.CreatedBy{
@@ -595,7 +598,7 @@ func TestCreateBot(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			bot, err := client.BotServiceClient().CreateBot(ctx, tt.req)
@@ -638,29 +641,30 @@ func TestUpdateBot(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botUpdaterUser, _, err := auth.CreateUserAndRole(srv.Auth(), "bot-updater", []string{}, []types.Rule{
+	botUpdaterUser, _, err := authtest.CreateUserAndRole(srv.Auth(), "bot-updater", []string{}, []types.Rule{
 		{
 			Resources: []string{types.KindBot},
 			Verbs:     []string{types.VerbUpdate},
 		},
 	})
 	require.NoError(t, err)
-	beforeRole, err := auth.CreateRole(ctx, srv.Auth(), "before-role", types.RoleSpecV6{})
+	beforeRole, err := authtest.CreateRole(ctx, srv.Auth(), "before-role", types.RoleSpecV6{})
 	require.NoError(t, err)
-	afterRole, err := auth.CreateRole(ctx, srv.Auth(), "after-role", types.RoleSpecV6{})
+	afterRole, err := authtest.CreateRole(ctx, srv.Auth(), "after-role", types.RoleSpecV6{})
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(ctx, srv.Auth(), "no-perms", beforeRole)
+	unprivilegedUser, err := authtest.CreateUser(ctx, srv.Auth(), "no-perms", beforeRole)
 	require.NoError(t, err)
 
 	// Create a pre-existing bot so we can check you can update an existing bot.
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
 			Kind:    types.KindBot,
 			Version: types.V1,
 			Metadata: &headerv1.Metadata{
-				Name: "pre-existing",
+				Name:        "pre-existing",
+				Description: "before",
 			},
 			Spec: &machineidv1pb.BotSpec{
 				Roles: []string{beforeRole.GetName()},
@@ -705,7 +709,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: preExistingBot.Metadata.Name,
+						Name:        preExistingBot.Metadata.Name,
+						Description: "after",
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{afterRole.GetName()},
@@ -725,7 +730,7 @@ func TestUpdateBot(t *testing.T) {
 					},
 				},
 				UpdateMask: &fieldmaskpb.FieldMask{
-					Paths: []string{"spec.roles", "spec.traits", "spec.max_session_ttl"},
+					Paths: []string{"spec.roles", "spec.traits", "spec.max_session_ttl", "metadata.description"},
 				},
 			},
 
@@ -734,7 +739,8 @@ func TestUpdateBot(t *testing.T) {
 				Kind:    types.KindBot,
 				Version: types.V1,
 				Metadata: &headerv1.Metadata{
-					Name: preExistingBot.Metadata.Name,
+					Name:        preExistingBot.Metadata.Name,
+					Description: "after",
 				},
 				Spec: &machineidv1pb.BotSpec{
 					Roles: []string{afterRole.GetName()},
@@ -761,8 +767,9 @@ func TestUpdateBot(t *testing.T) {
 				Kind:    types.KindUser,
 				Version: types.V2,
 				Metadata: types.Metadata{
-					Name:      preExistingBot.Status.UserName,
-					Namespace: defaults.Namespace,
+					Name:        preExistingBot.Status.UserName,
+					Description: "after",
+					Namespace:   defaults.Namespace,
 					Labels: map[string]string{
 						types.BotLabel:           preExistingBot.Metadata.Name,
 						types.BotGenerationLabel: "1337",
@@ -818,7 +825,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: "valid-bot",
+						Name:        "valid-bot",
+						Description: preExistingBot.Metadata.Description,
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{beforeRole.GetName()},
@@ -851,7 +859,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: "bernard-lowe",
+						Name:        "bernard-lowe",
+						Description: "before",
 					},
 					Spec: nil,
 				},
@@ -892,7 +901,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: "",
+						Name:        "",
+						Description: preExistingBot.Metadata.Description,
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{beforeRole.GetName()},
@@ -915,7 +925,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: "foo",
+						Name:        "foo",
+						Description: "before",
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{beforeRole.GetName()},
@@ -936,7 +947,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: "foo",
+						Name:        "foo",
+						Description: preExistingBot.Metadata.Description,
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles: []string{beforeRole.GetName()},
@@ -959,7 +971,8 @@ func TestUpdateBot(t *testing.T) {
 					Kind:    types.KindBot,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
-						Name: preExistingBot.Metadata.Name,
+						Name:        preExistingBot.Metadata.Name,
+						Description: preExistingBot.Metadata.Description,
 					},
 					Spec: &machineidv1pb.BotSpec{
 						Roles:  []string{"foo", "", "bar"},
@@ -978,7 +991,7 @@ func TestUpdateBot(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			bot, err := client.BotServiceClient().UpdateBot(ctx, tt.req)
@@ -1031,14 +1044,14 @@ func TestUpsertBot(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botCreator, _, err := auth.CreateUserAndRole(srv.Auth(), "bot-creator", []string{}, []types.Rule{
+	botCreator, _, err := authtest.CreateUserAndRole(srv.Auth(), "bot-creator", []string{}, []types.Rule{
 		{
 			Resources: []string{types.KindBot},
 			Verbs:     []string{types.VerbCreate, types.VerbUpdate},
 		},
 	})
 	require.NoError(t, err)
-	botWhereCreator, _, err := auth.CreateUserAndRole(srv.Auth(), "bot-where-creator", []string{}, []types.Rule{
+	botWhereCreator, _, err := authtest.CreateUserAndRole(srv.Auth(), "bot-where-creator", []string{}, []types.Rule{
 		{
 			Resources: []string{types.KindBot},
 			Verbs:     []string{types.VerbCreate, types.VerbUpdate},
@@ -1046,13 +1059,13 @@ func TestUpsertBot(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	testRole, err := auth.CreateRole(ctx, srv.Auth(), "test-role", types.RoleSpecV6{})
+	testRole, err := authtest.CreateRole(ctx, srv.Auth(), "test-role", types.RoleSpecV6{})
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(ctx, srv.Auth(), "no-perms", testRole)
+	unprivilegedUser, err := authtest.CreateUser(ctx, srv.Auth(), "no-perms", testRole)
 	require.NoError(t, err)
 
 	// Create a pre-existing bot so we can check you can upsert over an existing bot.
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
 		Bot: &machineidv1pb.Bot{
@@ -1576,7 +1589,7 @@ func TestUpsertBot(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			bot, err := client.BotServiceClient().UpsertBot(ctx, tt.req)
@@ -1618,7 +1631,7 @@ func TestGetBot(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botGetterUser, _, err := auth.CreateUserAndRole(
+	botGetterUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-getter",
 		[]string{},
@@ -1629,7 +1642,7 @@ func TestGetBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	botGetterWhereUser, _, err := auth.CreateUserAndRole(
+	botGetterWhereUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-getter-where",
 		[]string{},
@@ -1641,16 +1654,16 @@ func TestGetBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	testRole, err := auth.CreateRole(
+	testRole, err := authtest.CreateRole(
 		ctx, srv.Auth(), "test-role", types.RoleSpecV6{},
 	)
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(
+	unprivilegedUser, err := authtest.CreateUser(
 		ctx, srv.Auth(), "no-perms", testRole,
 	)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
@@ -1664,6 +1677,7 @@ func TestGetBot(t *testing.T) {
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
+					Description: "The maze wasn't meant for you",
 				},
 				Spec: &machineidv1pb.BotSpec{
 					Roles: []string{testRole.GetName()},
@@ -1760,7 +1774,7 @@ func TestGetBot(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			bot, err := client.BotServiceClient().GetBot(ctx, tt.req)
@@ -1779,7 +1793,7 @@ func TestListBots(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botListerUser, _, err := auth.CreateUserAndRole(
+	botListerUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-lister",
 		[]string{},
@@ -1790,7 +1804,7 @@ func TestListBots(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	botListWhereUser, _, err := auth.CreateUserAndRole(
+	botListWhereUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-lister-where",
 		[]string{},
@@ -1802,16 +1816,16 @@ func TestListBots(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	testRole, err := auth.CreateRole(
+	testRole, err := authtest.CreateRole(
 		ctx, srv.Auth(), "test-role", types.RoleSpecV6{},
 	)
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(
+	unprivilegedUser, err := authtest.CreateUser(
 		ctx, srv.Auth(), "no-perms", testRole,
 	)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
@@ -1908,7 +1922,7 @@ func TestListBots(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			res, err := client.BotServiceClient().ListBots(ctx, tt.req)
@@ -1934,7 +1948,7 @@ func TestDeleteBot(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	botDeleterUser, _, err := auth.CreateUserAndRole(
+	botDeleterUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-deleter",
 		[]string{},
@@ -1945,7 +1959,7 @@ func TestDeleteBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	botWhereDeleterUser, _, err := auth.CreateUserAndRole(
+	botWhereDeleterUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"bot-deleter-where",
 		[]string{},
@@ -1957,27 +1971,27 @@ func TestDeleteBot(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	testRole, err := auth.CreateRole(
+	testRole, err := authtest.CreateRole(
 		ctx, srv.Auth(), "test-role", types.RoleSpecV6{},
 	)
 	require.NoError(t, err)
-	unprivilegedUser, err := auth.CreateUser(
+	unprivilegedUser, err := authtest.CreateUser(
 		ctx, srv.Auth(), "no-perms", testRole,
 	)
 	require.NoError(t, err)
 
 	// Create a user/role with a bot-like name but that isn't a bot to ensure we
 	// don't delete it
-	_, err = auth.CreateUser(
+	_, err = authtest.CreateUser(
 		ctx, srv.Auth(), "bot-not-bot", testRole,
 	)
 	require.NoError(t, err)
-	_, err = auth.CreateRole(
+	_, err = authtest.CreateRole(
 		ctx, srv.Auth(), "bot-not-bot", types.RoleSpecV6{},
 	)
 	require.NoError(t, err)
 
-	client, err := srv.NewClient(auth.TestAdmin())
+	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
@@ -2123,7 +2137,7 @@ func TestDeleteBot(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			_, err = client.BotServiceClient().DeleteBot(ctx, tt.req)
@@ -2138,15 +2152,15 @@ func TestDeleteBot(t *testing.T) {
 	}
 }
 
-func newTestTLSServer(t testing.TB) (*auth.TestTLSServer, *eventstest.MockRecorderEmitter) {
-	as, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+func newTestTLSServer(t testing.TB) (*authtest.TLSServer, *eventstest.MockRecorderEmitter) {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	})
 	require.NoError(t, err)
 
 	emitter := &eventstest.MockRecorderEmitter{}
-	srv, err := as.NewTestTLSServer(func(config *auth.TestTLSServerConfig) {
+	srv, err := as.NewTestTLSServer(func(config *authtest.TLSServerConfig) {
 		config.APIConfig.Emitter = emitter
 	})
 	require.NoError(t, err)
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go b/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
index e69511523011b..434b9ed231e30 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
@@ -36,7 +36,7 @@ import (
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	libevents "github.com/gravitational/teleport/lib/events"
 )
 
@@ -49,7 +49,7 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 
 	nothingRole, err := types.NewRole("nothing", types.RoleSpecV6{})
 	require.NoError(t, err)
-	unauthorizedUser, err := auth.CreateUser(
+	unauthorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"unauthorized",
@@ -69,7 +69,7 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
@@ -118,8 +118,10 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 					Name: "example.com",
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: "localhost",
 				},
 			},
 		},
@@ -172,7 +174,7 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			mockEmitter.Reset()
@@ -230,7 +232,7 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 
 	nothingRole, err := types.NewRole("nothing", types.RoleSpecV6{})
 	require.NoError(t, err)
-	unauthorizedUser, err := auth.CreateUser(
+	unauthorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"unauthorized",
@@ -250,7 +252,7 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
@@ -284,8 +286,10 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 					Name: name,
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: "localhost",
 				},
 			},
 		},
@@ -311,7 +315,7 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			resource := &machineidv1pb.SPIFFEFederation{
@@ -382,7 +386,7 @@ func TestSPIFFEFederationService_GetSPIFFEFederation(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
@@ -437,7 +441,7 @@ func TestSPIFFEFederationService_GetSPIFFEFederation(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			got, err := client.SPIFFEFederationServiceClient().GetSPIFFEFederation(ctx, &machineidv1pb.GetSPIFFEFederationRequest{
@@ -476,7 +480,7 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
@@ -537,7 +541,7 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			fetched := []*machineidv1pb.SPIFFEFederation{}
@@ -563,9 +567,9 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 				require.Equal(t, tt.wantIterations, iterations)
 				require.Len(t, fetched, 49)
 				for _, created := range createdObjects {
-					slices.ContainsFunc(fetched, func(federation *machineidv1pb.SPIFFEFederation) bool {
+					require.True(t, slices.ContainsFunc(fetched, func(federation *machineidv1pb.SPIFFEFederation) bool {
 						return proto.Equal(created, federation)
-					})
+					}))
 				}
 			}
 		})
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go b/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
index 8ee0994810098..281f5c523539f 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
@@ -45,7 +45,7 @@ import (
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func makeTrustDomain(t *testing.T, name string) (spiffeid.TrustDomain, *spiffebundle.Bundle) {
@@ -65,7 +65,7 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	clock := clockwork.NewRealClock()
 	backend, err := memory.New(memory.Config{})
 	require.NoError(t, err)
@@ -89,6 +89,7 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 		}
 		h.ServeHTTP(w, r)
 	}))
+	t.Cleanup(testSrv1.Close)
 	testSrv2 := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		h, err := federation.NewHandler(td2, bundle2)
 		if !assert.NoError(t, err) {
@@ -96,6 +97,7 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 		}
 		h.ServeHTTP(w, r)
 	}))
+	t.Cleanup(testSrv2.Close)
 
 	caPool := x509.NewCertPool()
 	caPool.AddCert(testSrv1.Certificate())
@@ -138,7 +140,7 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 	}()
 
 	// Wait for the initially created SPIFFEFederation to be synced
-	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		got, err := store.GetSPIFFEFederation(ctx, created1.Metadata.Name)
 		if !assert.NoError(t, err) {
 			return
@@ -170,7 +172,7 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		got, err := store.GetSPIFFEFederation(ctx, created2.Metadata.Name)
 		if !assert.NoError(t, err) {
 			return
@@ -201,7 +203,7 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	clock := clockwork.NewFakeClock()
 	backend, err := memory.New(memory.Config{})
 	require.NoError(t, err)
@@ -222,6 +224,7 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 		}
 		h.ServeHTTP(w, r)
 	}))
+	t.Cleanup(testSrv.Close)
 	caPool := x509.NewCertPool()
 	caPool.AddCert(testSrv.Certificate())
 
diff --git a/lib/auth/machineid/machineidv1/workload_identity_service.go b/lib/auth/machineid/machineidv1/workload_identity_service.go
index d5fea526bc41b..a761f7553c366 100644
--- a/lib/auth/machineid/machineidv1/workload_identity_service.go
+++ b/lib/auth/machineid/machineidv1/workload_identity_service.go
@@ -73,7 +73,11 @@ type WorkloadIdentityServiceConfig struct {
 type WorkloadIdentityCacher interface {
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
 }
 
 // KeyStorer is an interface that provides methods to retrieve keys and
diff --git a/lib/auth/machineid/machineidv1/workload_identity_service_test.go b/lib/auth/machineid/machineidv1/workload_identity_service_test.go
index dfe099c483b15..94ee268bc18fb 100644
--- a/lib/auth/machineid/machineidv1/workload_identity_service_test.go
+++ b/lib/auth/machineid/machineidv1/workload_identity_service_test.go
@@ -31,7 +31,7 @@ import (
 
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	libjwt "github.com/gravitational/teleport/lib/jwt"
 )
@@ -77,14 +77,14 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
 		role,
 	)
 	require.NoError(t, err)
-	unauthorizedUser, err := auth.CreateUser(
+	unauthorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"unauthorized",
@@ -136,7 +136,7 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 				require.NoError(t, err)
 
 				// Check TTL
-				require.WithinDuration(t, time.Now().Add(30*time.Minute), cert.NotAfter, 5*time.Second)
+				require.WithinDuration(t, srv.Clock().Now().Add(30*time.Minute), cert.NotAfter, 5*time.Second)
 
 				// Check included public key matches
 				require.Equal(t, privateKey.Public(), cert.PublicKey)
@@ -219,7 +219,7 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			res, err := client.WorkloadIdentityServiceClient().
@@ -261,14 +261,14 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	authorizedUser, err := auth.CreateUser(
+	authorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"authorized",
 		role,
 	)
 	require.NoError(t, err)
-	unauthorizedUser, err := auth.CreateUser(
+	unauthorizedUser, err := authtest.CreateUser(
 		ctx,
 		srv.Auth(),
 		"unauthorized",
@@ -347,8 +347,8 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 				require.Equal(t, svid.Jti, claims.ID)
 				require.Equal(t, "example.com", claims.Audience[0])
 				require.Equal(t, wantIssuer, claims.Issuer)
-				require.WithinDuration(t, time.Now().Add(30*time.Minute), claims.Expiry.Time(), 5*time.Second)
-				require.WithinDuration(t, time.Now(), claims.IssuedAt.Time(), 5*time.Second)
+				require.WithinDuration(t, srv.Clock().Now().Add(30*time.Minute), claims.Expiry.Time(), 5*time.Second)
+				require.WithinDuration(t, srv.Clock().Now(), claims.IssuedAt.Time(), 5*time.Second)
 			},
 		},
 		{
@@ -390,7 +390,7 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			res, err := client.WorkloadIdentityServiceClient().
diff --git a/lib/auth/machineid/workloadidentityv1/expression/proto.go b/lib/auth/machineid/workloadidentityv1/expression/proto.go
index 67c5a9f007f61..cda29182f7188 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/proto.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/proto.go
@@ -146,9 +146,9 @@ func protoMessageVariables[TMessage proto.Message, TEnv messageEnv[TMessage]](ze
 					}
 				})
 			case protoreflect.Uint32Kind, protoreflect.Uint64Kind:
-				vars[name] = typical.DynamicVariable(func(env TEnv) (uint64, error) {
+				vars[name] = typical.DynamicVariable(func(env TEnv) (uint, error) {
 					if v, err := get(env); err == nil {
-						return v.Uint(), nil
+						return uint(v.Uint()), nil
 					} else {
 						return 0, err
 					}
diff --git a/lib/auth/machineid/workloadidentityv1/expression/template.go b/lib/auth/machineid/workloadidentityv1/expression/template.go
index c509d1b7e37d1..857cc46730c7a 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/template.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/template.go
@@ -135,8 +135,10 @@ func (t *Template) Render(env *Environment) (string, error) {
 				_, _ = b.WriteString(strconv.FormatBool(t))
 			case int:
 				_, _ = b.WriteString(strconv.Itoa(t))
+			case uint:
+				_, _ = b.WriteString(strconv.Itoa(int(t)))
 			default:
-				return "", trace.Errorf("expression did not evaluate to a string: %s", frag.text)
+				return "", trace.Errorf("expression did not evaluate to a string: %q, %T", frag.text, result)
 			}
 		}
 	}
diff --git a/lib/auth/machineid/workloadidentityv1/expression/template_test.go b/lib/auth/machineid/workloadidentityv1/expression/template_test.go
index 67cff3d8d3b13..74063c8ca01b8 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/template_test.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/template_test.go
@@ -98,6 +98,28 @@ func TestTemplate_Success(t *testing.T) {
 			attrs:  &workloadidentityv1.Attrs{},
 			output: "1234",
 		},
+		"int interpolation": {
+			tmpl: `{{ workload.unix.pid }}`,
+			attrs: &workloadidentityv1.Attrs{
+				Workload: &workloadidentityv1.WorkloadAttrs{
+					Unix: &workloadidentityv1.WorkloadAttrsUnix{
+						Pid: 1337,
+					},
+				},
+			},
+			output: "1337",
+		},
+		"uint interpolation": {
+			tmpl: `{{ workload.unix.uid }}`,
+			attrs: &workloadidentityv1.Attrs{
+				Workload: &workloadidentityv1.WorkloadAttrs{
+					Unix: &workloadidentityv1.WorkloadAttrsUnix{
+						Uid: 1337,
+					},
+				},
+			},
+			output: "1337",
+		},
 		"user traits": {
 			tmpl: `{{user.traits.skill}}`,
 			attrs: &workloadidentityv1.Attrs{
diff --git a/lib/auth/machineid/workloadidentityv1/issuer_service.go b/lib/auth/machineid/workloadidentityv1/issuer_service.go
index 236e7baffd83e..a8707dda9e082 100644
--- a/lib/auth/machineid/workloadidentityv1/issuer_service.go
+++ b/lib/auth/machineid/workloadidentityv1/issuer_service.go
@@ -82,7 +82,11 @@ func (OSSSigstorePolicyEvaluator) Evaluate(_ context.Context, policyNames []stri
 
 type issuerCache interface {
 	workloadIdentityReader
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+	ListProxyServers(context.Context, int, string) ([]types.Server, string, error)
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 }
 
@@ -249,6 +253,7 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 				requestedTTL:          req.RequestedTtl.AsDuration(),
 				attrs:                 attrs,
 				sigstorePolicyResults: decision.sigstorePolicyResults,
+				nameSelector:          req.GetName(),
 			},
 		)
 		if err != nil {
@@ -269,6 +274,7 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 				requestedTTL:          req.RequestedTtl.AsDuration(),
 				attrs:                 attrs,
 				sigstorePolicyResults: decision.sigstorePolicyResults,
+				nameSelector:          req.GetName(),
 			},
 		)
 		if err != nil {
@@ -357,6 +363,7 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 					x509Params:       v.X509SvidParams,
 					requestedTTL:     req.RequestedTtl.AsDuration(),
 					attrs:            attrs,
+					labelSelectors:   req.LabelSelectors,
 				},
 			)
 			if err != nil {
@@ -383,6 +390,7 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 					jwtParams:        v.JwtSvidParams,
 					requestedTTL:     req.RequestedTtl.AsDuration(),
 					attrs:            attrs,
+					labelSelectors:   req.LabelSelectors,
 				},
 			)
 			if err != nil {
@@ -516,6 +524,8 @@ func baseEvent(
 	spiffeID spiffeid.ID,
 	attrs *workloadidentityv1pb.Attrs,
 	sigstorePolicyResults map[string]error,
+	nameSelector string,
+	labelSelectors []*workloadidentityv1pb.LabelSelector,
 ) (*apievents.SPIFFESVIDIssued, error) {
 	structAttrs, err := rawAttrsToStruct(attrs)
 	if err != nil {
@@ -563,9 +573,27 @@ func baseEvent(
 		WorkloadIdentity:         wi.GetMetadata().GetName(),
 		WorkloadIdentityRevision: wi.GetMetadata().GetRevision(),
 		Attributes:               structAttrs,
+		NameSelector:             nameSelector,
+		LabelSelectors:           labelSelectorsToAudit(labelSelectors),
 	}, nil
 }
 
+func labelSelectorsToAudit(
+	in []*workloadidentityv1pb.LabelSelector,
+) []*apievents.LabelSelector {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]*apievents.LabelSelector, 0, len(in))
+	for _, ls := range in {
+		out = append(out, &apievents.LabelSelector{
+			Key:    ls.Key,
+			Values: ls.Values,
+		})
+	}
+	return out
+}
+
 func calculateTTL(
 	ctx context.Context,
 	log *slog.Logger,
@@ -599,6 +627,8 @@ type issueX509SVIDParams struct {
 	requestedTTL          time.Duration
 	attrs                 *workloadidentityv1pb.Attrs
 	sigstorePolicyResults map[string]error
+	nameSelector          string
+	labelSelectors        []*workloadidentityv1pb.LabelSelector
 }
 
 func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVIDParams) (_ *workloadidentityv1pb.Credential, err error) {
@@ -657,7 +687,15 @@ func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVI
 		return nil, trace.Wrap(err)
 	}
 
-	evt, err := baseEvent(ctx, params.workloadIdentity, spiffeID, params.attrs, params.sigstorePolicyResults)
+	evt, err := baseEvent(
+		ctx,
+		params.workloadIdentity,
+		spiffeID,
+		params.attrs,
+		params.sigstorePolicyResults,
+		params.nameSelector,
+		params.labelSelectors,
+	)
 	if err != nil {
 		return nil, trace.Wrap(err, "creating base event")
 	}
@@ -739,6 +777,8 @@ type issueJWTSVIDParams struct {
 	requestedTTL          time.Duration
 	attrs                 *workloadidentityv1pb.Attrs
 	sigstorePolicyResults map[string]error
+	nameSelector          string
+	labelSelectors        []*workloadidentityv1pb.LabelSelector
 }
 
 func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDParams) (_ *workloadidentityv1pb.Credential, err error) {
@@ -788,7 +828,15 @@ func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDP
 		return nil, trace.Wrap(err, "signing jwt")
 	}
 
-	evt, err := baseEvent(ctx, params.workloadIdentity, spiffeID, params.attrs, params.sigstorePolicyResults)
+	evt, err := baseEvent(
+		ctx,
+		params.workloadIdentity,
+		spiffeID,
+		params.attrs,
+		params.sigstorePolicyResults,
+		params.nameSelector,
+		params.labelSelectors,
+	)
 	if err != nil {
 		return nil, trace.Wrap(err, "creating base event")
 	}
@@ -828,7 +876,7 @@ func (s *IssuanceService) getAllWorkloadIdentities(
 	workloadIdentities := []*workloadidentityv1pb.WorkloadIdentity{}
 	page := ""
 	for {
-		pageItems, nextPage, err := s.cache.ListWorkloadIdentities(ctx, 0, page)
+		pageItems, nextPage, err := s.cache.ListWorkloadIdentities(ctx, 0, page, nil)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/machineid/workloadidentityv1/resource_service.go b/lib/auth/machineid/workloadidentityv1/resource_service.go
index 6ca893e1b1fa9..9d074256722eb 100644
--- a/lib/auth/machineid/workloadidentityv1/resource_service.go
+++ b/lib/auth/machineid/workloadidentityv1/resource_service.go
@@ -31,11 +31,12 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 type workloadIdentityReader interface {
 	GetWorkloadIdentity(ctx context.Context, name string) (*workloadidentityv1pb.WorkloadIdentity, error)
-	ListWorkloadIdentities(ctx context.Context, pageSize int, token string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error)
+	ListWorkloadIdentities(ctx context.Context, pageSize int, token string, options *services.ListWorkloadIdentitiesRequestOptions) ([]*workloadidentityv1pb.WorkloadIdentity, string, error)
 }
 
 type workloadIdentityReadWriter interface {
@@ -129,6 +130,19 @@ func (s *ResourceService) GetWorkloadIdentity(
 // Implements teleport.workloadidentity.v1.ResourceService/ListWorkloadIdentities
 func (s *ResourceService) ListWorkloadIdentities(
 	ctx context.Context, req *workloadidentityv1pb.ListWorkloadIdentitiesRequest,
+) (*workloadidentityv1pb.ListWorkloadIdentitiesResponse, error) {
+	return s.ListWorkloadIdentitiesV2(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesV2Request{
+		PageSize:  req.GetPageSize(),
+		PageToken: req.GetPageToken(),
+	})
+}
+
+// ListWorkloadIdentitiesV2 returns a list of WorkloadIdentity resources. It
+// follows the Google API design guidelines for list pagination. It supports
+// sorting and filtering.
+// Implements teleport.workloadidentity.v1.ResourceService/ListWorkloadIdentitiesV2
+func (s *ResourceService) ListWorkloadIdentitiesV2(
+	ctx context.Context, req *workloadidentityv1pb.ListWorkloadIdentitiesV2Request,
 ) (*workloadidentityv1pb.ListWorkloadIdentitiesResponse, error) {
 	authCtx, err := s.authorizer.Authorize(ctx)
 	if err != nil {
@@ -142,6 +156,11 @@ func (s *ResourceService) ListWorkloadIdentities(
 		ctx,
 		int(req.PageSize),
 		req.PageToken,
+		&services.ListWorkloadIdentitiesRequestOptions{
+			SortField:        req.GetSortField(),
+			SortDesc:         req.GetSortDesc(),
+			FilterSearchTerm: req.GetFilterSearchTerm(),
+		},
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go b/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
index 833f9b87322a0..80b19c2d8faff 100644
--- a/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
+++ b/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
@@ -22,19 +22,23 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"math/big"
 	"net"
 	"os"
+	"regexp"
 	"slices"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/mock"
@@ -54,20 +58,28 @@ import (
 	"github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/integrations/lib/testing/fakejoin"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/machineid/workloadidentityv1"
 	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	libjwt "github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/grpctest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 func TestMain(m *testing.M) {
@@ -75,15 +87,16 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }
 
-func newTestTLSServer(t testing.TB, opts ...auth.TestTLSServerOption) (*auth.TestTLSServer, *eventstest.MockRecorderEmitter) {
-	as, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+func newTestTLSServer(t testing.TB, opts ...authtest.TestTLSServerOption) (*authtest.TLSServer, *eventstest.MockRecorderEmitter) {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 	emitter := &eventstest.MockRecorderEmitter{}
-	opts = append(opts, func(config *auth.TestTLSServerConfig) {
+	opts = append(opts, func(config *authtest.TLSServerConfig) {
 		config.APIConfig.Emitter = emitter
 	})
 	srv, err := as.NewTestTLSServer(opts...)
@@ -101,7 +114,7 @@ func newTestTLSServer(t testing.TB, opts ...auth.TestTLSServerOption) (*auth.Tes
 }
 
 type issuanceTestPack struct {
-	srv                     *auth.TestTLSServer
+	srv                     *authtest.TLSServer
 	eventRecorder           *eventstest.MockRecorderEmitter
 	clock                   clockwork.Clock
 	sigstorePolicyEvaluator *mockSigstorePolicyEvaluator
@@ -252,7 +265,7 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 		},
 	}
 
-	k8s, err := fakejoin.NewKubernetesSigner(tp.clock)
+	k8s, err := fakeissuer.NewKubernetesSigner(tp.clock)
 	require.NoError(t, err)
 	jwks, err := k8s.GetMarshaledJWKS()
 	require.NoError(t, err)
@@ -286,7 +299,7 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	adminClient, err := tp.srv.NewClient(auth.TestAdmin())
+	adminClient, err := tp.srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	_, err = adminClient.CreateRole(ctx, role)
 	require.NoError(t, err)
@@ -298,7 +311,7 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	require.NoError(t, err)
 
 	// With the basic setup complete, we can now "fake" a join.
-	botCerts, err := join.Register(ctx, join.RegisterParams{
+	botCerts, err := joinclient.Join(ctx, joinclient.JoinParams{
 		Token:      token.GetName(),
 		JoinMethod: types.JoinMethodKubernetes,
 		ID: state.IdentityID{
@@ -321,7 +334,8 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	require.NoError(t, err)
 	tlsPub, err := keys.MarshalPublicKey(botCerts.PrivateKey.Public())
 	require.NoError(t, err)
-	botClient := tp.srv.NewClientWithCert(tlsCert)
+	botClient, err := tp.srv.NewClientWithCert(tlsCert)
+	require.NoError(t, err)
 	certs, err := botClient.GenerateUserCerts(ctx, apiproto.UserCertsRequest{
 		SSHPublicKey: ssh.MarshalAuthorizedKey(sshPub),
 		TLSPublicKey: tlsPub,
@@ -335,7 +349,8 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	require.NoError(t, err)
 	roleTLSCert, err := tls.X509KeyPair(certs.TLS, privateKeyPEM)
 	require.NoError(t, err)
-	roleClient := tp.srv.NewClientWithCert(roleTLSCert)
+	roleClient, err := tp.srv.NewClientWithCert(roleTLSCert)
+	require.NoError(t, err)
 
 	// Generate a keypair to generate x509 SVIDs for.
 	workloadKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
@@ -379,7 +394,7 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 	ctx := context.Background()
 	tp := newIssuanceTestPack(t, ctx)
 
-	wildcardAccess, _, err := auth.CreateUserAndRole(
+	wildcardAccess, _, err := authtest.CreateUserAndRole(
 		tp.srv.Auth(),
 		"dog",
 		[]string{},
@@ -389,17 +404,17 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 				[]string{types.VerbRead, types.VerbList},
 			),
 		},
-		auth.WithRoleMutator(func(role types.Role) {
+		authtest.WithRoleMutator(func(role types.Role) {
 			role.SetWorkloadIdentityLabels(types.Allow, types.Labels{
 				types.Wildcard: []string{types.Wildcard},
 			})
 		}),
 	)
 	require.NoError(t, err)
-	wilcardAccessClient, err := tp.srv.NewClient(auth.TestUser(wildcardAccess.GetName()))
+	wilcardAccessClient, err := tp.srv.NewClient(authtest.TestUser(wildcardAccess.GetName()))
 	require.NoError(t, err)
 
-	specificAccess, _, err := auth.CreateUserAndRole(
+	specificAccess, _, err := authtest.CreateUserAndRole(
 		tp.srv.Auth(),
 		"cat",
 		[]string{},
@@ -409,14 +424,42 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 				[]string{types.VerbRead, types.VerbList},
 			),
 		},
-		auth.WithRoleMutator(func(role types.Role) {
+		authtest.WithRoleMutator(func(role types.Role) {
 			role.SetWorkloadIdentityLabels(types.Allow, types.Labels{
 				"foo": []string{"bar"},
 			})
 		}),
 	)
 	require.NoError(t, err)
-	specificAccessClient, err := tp.srv.NewClient(auth.TestUser(specificAccess.GetName()))
+	specificAccessClient, err := tp.srv.NewClient(authtest.TestUser(specificAccess.GetName()))
+	require.NoError(t, err)
+
+	traitAccess, _, err := authtest.CreateUserAndRole(
+		tp.srv.Auth(),
+		"traity",
+		[]string{},
+		[]types.Rule{
+			types.NewRule(
+				types.KindWorkloadIdentity,
+				[]string{types.VerbRead, types.VerbList},
+			),
+		},
+		authtest.WithUserMutator(func(user types.User) {
+			tr := user.GetTraits()
+			if tr == nil {
+				tr = map[string][]string{}
+			}
+			tr["custom"] = []string{"trait-value-a", "trait-value-b"}
+			user.SetTraits(tr)
+		}),
+		authtest.WithRoleMutator(func(role types.Role) {
+			role.SetWorkloadIdentityLabels(types.Allow, types.Labels{
+				"trait-label": []string{"{{external.custom}}"},
+			})
+		}),
+	)
+	require.NoError(t, err)
+	traitAccessClient, err := tp.srv.NewClient(authtest.TestUser(traitAccess.GetName()))
 	require.NoError(t, err)
 
 	// Generate a keypair to generate x509 SVIDs for.
@@ -556,6 +599,23 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	traitsRequired, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "traits-required",
+			Labels: map[string]string{
+				"trait-label": "trait-value-b",
+			},
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id: "/foo",
+			},
+		},
+	})
+	require.NoError(t, err)
+
 	for policy, result := range map[string]error{
 		"foo": errors.New("missing artifact signature"),
 		"bar": nil,
@@ -659,14 +719,17 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 							Code: libevents.SPIFFESVIDIssuedSuccessCode,
 						},
 						UserMetadata: events.UserMetadata{
-							User:     wildcardAccess.GetName(),
-							UserKind: events.UserKind_USER_KIND_HUMAN,
+							User:            wildcardAccess.GetName(),
+							UserKind:        events.UserKind_USER_KIND_HUMAN,
+							UserRoles:       wildcardAccess.GetRoles(),
+							UserClusterName: tp.srv.ClusterName(),
 						},
 						SPIFFEID:                 "spiffe://localhost/example/dog/default/bar",
 						SVIDType:                 "jwt",
 						Hint:                     "Wow - what a lovely hint, dog!",
 						WorkloadIdentity:         full.GetMetadata().GetName(),
 						WorkloadIdentityRevision: full.GetMetadata().GetRevision(),
+						NameSelector:             full.GetMetadata().GetName(),
 					},
 					cmpopts.IgnoreFields(
 						events.SPIFFESVIDIssued{},
@@ -691,6 +754,33 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 			},
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
+				// Checks for a bug where unix epoch timestamps (e.g. the `exp`
+				// and `iat` claims) were represented in scientific notation
+				// rather than as plain integers due to a conversion bug.
+				payloadSection := strings.Split(
+					res.GetCredential().GetJwtSvid().GetJwt(),
+					".",
+				)[1]
+				payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(payloadSection, "="))
+				require.NoError(t, err)
+
+				var numericClaims struct {
+					Exp json.Number `json:"exp"`
+					Iat json.Number `json:"iat"`
+				}
+				require.NoError(t, json.Unmarshal(payload, &numericClaims))
+
+				integerExpr, err := regexp.Compile(`^\d+$`)
+				require.NoError(t, err)
+				require.Truef(t,
+					integerExpr.MatchString(numericClaims.Exp.String()),
+					"unexpected number format: %s", numericClaims.Exp.String(),
+				)
+				require.Truef(t,
+					integerExpr.MatchString(numericClaims.Iat.String()),
+					"unexpected number format: %s", numericClaims.Iat.String(),
+				)
+
 				parsed, err := jwt.ParseSigned(res.GetCredential().GetJwtSvid().GetJwt())
 				require.NoError(t, err)
 
@@ -801,8 +891,10 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 							Code: libevents.SPIFFESVIDIssuedSuccessCode,
 						},
 						UserMetadata: events.UserMetadata{
-							User:     wildcardAccess.GetName(),
-							UserKind: events.UserKind_USER_KIND_HUMAN,
+							User:            wildcardAccess.GetName(),
+							UserKind:        events.UserKind_USER_KIND_HUMAN,
+							UserRoles:       wildcardAccess.GetRoles(),
+							UserClusterName: tp.srv.ClusterName(),
 						},
 						SPIFFEID:                 "spiffe://localhost/example/dog/default/bar",
 						SVIDType:                 "x509",
@@ -813,6 +905,7 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 							"example.com",
 							"dog.example.com",
 						},
+						NameSelector: full.GetMetadata().GetName(),
 					},
 					cmpopts.IgnoreFields(
 						events.SPIFFESVIDIssued{},
@@ -920,13 +1013,16 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 							Code: libevents.SPIFFESVIDIssuedSuccessCode,
 						},
 						UserMetadata: events.UserMetadata{
-							User:     wildcardAccess.GetName(),
-							UserKind: events.UserKind_USER_KIND_HUMAN,
+							User:            wildcardAccess.GetName(),
+							UserKind:        events.UserKind_USER_KIND_HUMAN,
+							UserRoles:       wildcardAccess.GetRoles(),
+							UserClusterName: tp.srv.ClusterName(),
 						},
 						SPIFFEID:                 "spiffe://localhost/foo",
 						SVIDType:                 "x509",
 						WorkloadIdentity:         subjectTemplate.GetMetadata().GetName(),
 						WorkloadIdentityRevision: subjectTemplate.GetMetadata().GetRevision(),
+						NameSelector:             subjectTemplate.GetMetadata().GetName(),
 					},
 					cmpopts.IgnoreFields(
 						events.SPIFFESVIDIssued{},
@@ -968,6 +1064,23 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 				require.Equal(t, cert.NotAfter.Sub(cert.NotBefore), wantTTL+time.Minute)
 			},
 		},
+		{
+			name:   "x509 svid - access via traits in labels",
+			client: traitAccessClient,
+			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+				Name: traitsRequired.GetMetadata().GetName(),
+				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
+					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
+						PublicKey: workloadKeyPubBytes,
+					},
+				},
+				WorkloadAttrs: workloadAttrs(nil),
+			},
+			requireErr: require.NoError,
+			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
+				require.NotNil(t, res.Credential)
+			},
+		},
 		{
 			name:   "x509 svid - unspecified ttl",
 			client: wilcardAccessClient,
@@ -1235,7 +1348,7 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 	ctx := context.Background()
 	tp := newIssuanceTestPack(t, ctx)
 
-	user, _, err := auth.CreateUserAndRole(
+	user, _, err := authtest.CreateUserAndRole(
 		tp.srv.Auth(),
 		"cat",
 		[]string{},
@@ -1245,14 +1358,14 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 				[]string{types.VerbRead, types.VerbList},
 			),
 		},
-		auth.WithRoleMutator(func(role types.Role) {
+		authtest.WithRoleMutator(func(role types.Role) {
 			role.SetWorkloadIdentityLabels(types.Allow, types.Labels{
 				"access": []string{"yes"},
 			})
 		}),
 	)
 	require.NoError(t, err)
-	client, err := tp.srv.NewClient(auth.TestUser(user.GetName()))
+	client, err := tp.srv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// Generate a keypair to generate x509 SVIDs for.
@@ -1550,7 +1663,7 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -1561,16 +1674,16 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity
@@ -1626,8 +1739,10 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 					Name: "new",
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 			},
 		},
@@ -1751,7 +1866,7 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -1762,16 +1877,16 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity
@@ -1816,8 +1931,10 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 					Name: preExisting.GetMetadata().GetName(),
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 			},
 		},
@@ -1886,7 +2003,7 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -1897,16 +2014,16 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity
@@ -2002,7 +2119,7 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2013,16 +2130,16 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identities
@@ -2067,9 +2184,9 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 		require.Len(t, res.WorkloadIdentities, 29)
 		require.Empty(t, res.NextPageToken)
 		for _, created := range created {
-			slices.ContainsFunc(res.WorkloadIdentities, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
+			require.True(t, slices.ContainsFunc(res.WorkloadIdentities, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 
@@ -2098,9 +2215,9 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 		require.Len(t, fetched, 29)
 		require.Equal(t, 3, iterations)
 		for _, created := range created {
-			slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
+			require.True(t, slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 }
@@ -2110,7 +2227,7 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2121,16 +2238,16 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity
@@ -2190,8 +2307,10 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 					Name: preExisting.GetMetadata().GetName(),
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 			},
 		},
@@ -2296,7 +2415,7 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2307,16 +2426,16 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2355,8 +2474,10 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 					Name: "new",
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 			},
 		},
@@ -2459,7 +2580,7 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2470,16 +2591,16 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity revocation
@@ -2535,8 +2656,10 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 					Name: "aa",
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 				Reason: "compromised",
 			},
@@ -2650,7 +2773,7 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2661,16 +2784,16 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity revocation
@@ -2715,8 +2838,10 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 					Name: preExisting.GetMetadata().GetName(),
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
 				},
 			},
 		},
@@ -2785,7 +2910,7 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2796,16 +2921,16 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity revocation
@@ -2901,7 +3026,7 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 	srv, _ := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -2912,16 +3037,16 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identitie revocations
@@ -2969,9 +3094,9 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 		require.Len(t, res.WorkloadIdentityX509Revocations, 29)
 		require.Empty(t, res.NextPageToken)
 		for _, created := range created {
-			slices.ContainsFunc(res.WorkloadIdentityX509Revocations, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
+			require.True(t, slices.ContainsFunc(res.WorkloadIdentityX509Revocations, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 
@@ -3000,9 +3125,9 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 		require.Len(t, fetched, 29)
 		require.Equal(t, 3, iterations)
 		for _, created := range created {
-			slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
+			require.True(t, slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 }
@@ -3012,7 +3137,7 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -3023,16 +3148,16 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	// Create a pre-existing workload identity revocation
@@ -3093,8 +3218,10 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 					Name: preExisting.GetMetadata().GetName(),
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 				Reason: "compromised",
 			},
@@ -3200,7 +3327,7 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 	srv, eventRecorder := newTestTLSServer(t)
 	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
+	authorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"authorized",
 		[]string{},
@@ -3211,16 +3338,16 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
+	authorizedClient, err := srv.NewClient(authtest.TestUser(authorizedUser.GetName()))
 	require.NoError(t, err)
-	unauthorizedUser, _, err := auth.CreateUserAndRole(
+	unauthorizedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"unauthorized",
 		[]string{},
 		[]types.Rule{},
 	)
 	require.NoError(t, err)
-	unauthorizedClient, err := srv.NewClient(auth.TestUser(unauthorizedUser.GetName()))
+	unauthorizedClient, err := srv.NewClient(authtest.TestUser(unauthorizedUser.GetName()))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -3259,8 +3386,10 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 					Name: "aabbccdd",
 				},
 				UserMetadata: events.UserMetadata{
-					User:     authorizedUser.GetName(),
-					UserKind: events.UserKind_USER_KIND_HUMAN,
+					User:            authorizedUser.GetName(),
+					UserKind:        events.UserKind_USER_KIND_HUMAN,
+					UserRoles:       authorizedUser.GetRoles(),
+					UserClusterName: srv.ClusterName(),
 				},
 				Reason: "compromised",
 			},
@@ -3360,181 +3489,232 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 
 func TestRevocationService_CRL(t *testing.T) {
 	t.Parallel()
-	revocationsEventCh := make(chan struct{})
-	fakeClock := clockwork.NewFakeClock()
-	srv, _ := newTestTLSServer(t, func(config *auth.TestTLSServerConfig) {
-		config.APIConfig.MutateRevocationsServiceConfig = func(config *workloadidentityv1.RevocationServiceConfig) {
-			config.RevocationsEventProcessedCh = revocationsEventCh
-			config.Clock = fakeClock
-		}
-	})
-	ctx := context.Background()
 
-	authorizedUser, _, err := auth.CreateUserAndRole(
-		srv.Auth(),
-		"authorized",
-		[]string{},
-		[]types.Rule{
-			{
-				Resources: []string{types.KindWorkloadIdentityX509Revocation},
-				Verbs: []string{
-					types.VerbRead,
-					types.VerbList,
-					types.VerbCreate,
-					types.VerbUpdate,
-					types.VerbDelete,
-				},
-			},
+	synctest.Test(t, func(t *testing.T) {
+		// == Setup ==
+		//
+		// Because this test depends on the "testing/synctest" package we can't
+		// use the newTestTLSServer helper, as it binds real listeners which
+		// aren't covered by synctest's "bubble". Instead, we must call the
+		// endpoint method directly, so we have to set up all of the service's
+		// dependencies ourselves.
+		backend, err := memory.New(memory.Config{})
+		require.NoError(t, err)
+
+		store, err := local.NewWorkloadIdentityX509RevocationService(backend)
+		require.NoError(t, err)
+
+		clusterConfigService, err := local.NewClusterConfigurationService(backend)
+		require.NoError(t, err)
+
+		authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{})
+		require.NoError(t, err)
+
+		_, err = clusterConfigService.CreateAuthPreference(t.Context(), authPreference)
+		require.NoError(t, err)
+
+		clusterName, err := types.NewClusterName(types.ClusterNameSpecV2{
+			ClusterName: "test.teleport.sh",
+			ClusterID:   uuid.NewString(),
 		})
-	require.NoError(t, err)
-	authorizedClient, err := srv.NewClient(auth.TestUser(authorizedUser.GetName()))
-	require.NoError(t, err)
-	revocationsClient := authorizedClient.WorkloadIdentityRevocationServiceClient()
+		require.NoError(t, err)
 
-	// Fetch the SPIFFE CA so we can validate CRL signature.
-	ca, err := srv.Auth().GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.SPIFFECA,
-		DomainName: srv.ClusterName(),
-	}, false)
-	require.NoError(t, err)
-	caCert, err := tlsca.ParseCertificatePEM(ca.GetActiveKeys().TLS[0].Cert)
-	require.NoError(t, err)
+		keys, err := keystore.NewManager(
+			t.Context(),
+			&servicecfg.KeystoreConfig{},
+			&keystore.Options{
+				ClusterName:          clusterName,
+				AuthPreferenceGetter: clusterConfigService,
+			},
+		)
+		require.NoError(t, err)
 
-	checkCRL := func(
-		t *testing.T,
-		crlBytes []byte,
-		wantEntries []x509.RevocationListEntry,
-	) {
-		require.NotEmpty(t, crlBytes)
+		tlsKeyPair, err := keys.NewTLSKeyPair(t.Context(), clusterName.GetClusterName(), cryptosuites.SPIFFECATLS)
+		require.NoError(t, err)
 
-		// Expect a DER encoded CRL directly (e.g no PEM)
-		parsed, err := x509.ParseRevocationList(crlBytes)
+		tlsCACert, err := tlsca.ParseCertificatePEM(tlsKeyPair.Cert)
 		require.NoError(t, err)
 
-		// Check CRL has a valid signature
-		require.NoError(t, parsed.CheckSignatureFrom(caCert))
+		jwtKeyPair, err := keys.NewJWTKeyPair(t.Context(), cryptosuites.SPIFFECAJWT)
+		require.NoError(t, err)
 
-		diff := cmp.Diff(
-			wantEntries,
-			parsed.RevokedCertificateEntries,
-			cmp.Comparer(func(a, b *big.Int) bool {
-				return a.Cmp(b) == 0
-			}),
-			cmpopts.IgnoreFields(x509.RevocationListEntry{}, "Raw"),
-			cmpopts.SortSlices(func(a, b x509.RevocationListEntry) bool {
-				return a.SerialNumber.Cmp(b.SerialNumber) < 0
+		ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+			Type:        types.SPIFFECA,
+			ClusterName: clusterName.GetClusterName(),
+			ActiveKeys: types.CAKeySet{
+				TLS: []*types.TLSKeyPair{tlsKeyPair},
+				JWT: []*types.JWTKeyPair{jwtKeyPair},
+			},
+		})
+		require.NoError(t, err)
+
+		caService := local.NewCAService(backend)
+		err = caService.CreateCertAuthority(t.Context(), ca)
+		require.NoError(t, err)
+
+		service, err := workloadidentityv1.NewRevocationService(&workloadidentityv1.RevocationServiceConfig{
+			Store: store,
+			Authorizer: authz.AuthorizerFunc(func(context.Context) (*authz.Context, error) {
+				return &authz.Context{}, nil
 			}),
-		)
-		require.Empty(t, diff)
-	}
+			Emitter:             &eventstest.MockAuditLog{},
+			EventsWatcher:       local.NewEventsService(backend),
+			ClusterName:         clusterName.GetClusterName(),
+			KeyStore:            keys,
+			Logger:              logtest.NewLogger(),
+			CertAuthorityGetter: caService,
+		})
+		require.NoError(t, err)
 
-	revokedAt := srv.Clock().Now()
-	createRevocation := func(t *testing.T, name string) {
-		_, err = revocationsClient.CreateWorkloadIdentityX509Revocation(
-			ctx,
-			&workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		go service.RunCRLSigner(ctx)
+
+		// == Helper Methods ==
+		checkCRL := func(
+			t *testing.T,
+			crlBytes []byte,
+			wantEntries []x509.RevocationListEntry,
+		) {
+			t.Helper()
+			require.NotEmpty(t, crlBytes)
+
+			// Expect a DER encoded CRL directly (e.g no PEM)
+			parsed, err := x509.ParseRevocationList(crlBytes)
+			require.NoError(t, err)
+
+			// Check CRL has a valid signature
+			require.NoError(t, parsed.CheckSignatureFrom(tlsCACert))
+
+			diff := cmp.Diff(
+				wantEntries,
+				parsed.RevokedCertificateEntries,
+				cmp.Comparer(func(a, b *big.Int) bool {
+					return a.Cmp(b) == 0
+				}),
+				cmpopts.IgnoreFields(x509.RevocationListEntry{}, "Raw"),
+				cmpopts.SortSlices(func(a, b x509.RevocationListEntry) bool {
+					return a.SerialNumber.Cmp(b.SerialNumber) < 0
+				}),
+			)
+			require.Empty(t, diff)
+		}
+
+		revokedAt := time.Now()
+		createRevocation := func(t *testing.T, name string) {
+			t.Helper()
+
+			_, err := store.CreateWorkloadIdentityX509Revocation(
+				t.Context(),
+				&workloadidentityv1pb.WorkloadIdentityX509Revocation{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
 					Metadata: &headerv1.Metadata{
 						Name:    name,
-						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
+						Expires: timestamppb.New(time.Now().Add(time.Hour)),
 					},
 					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(revokedAt),
 					},
 				},
-			},
-		)
-		require.NoError(t, err)
-		// Wait for the revocation event to be processed.
-		select {
-		case <-time.After(5 * time.Second):
-			t.Fatalf("timed out waiting for revocation event to be processed")
-		case <-revocationsEventCh:
+			)
+			require.NoError(t, err)
+
+			// Wait for the revocation event to be processed.
+			synctest.Wait()
 		}
-	}
-	deleteRevocation := func(t *testing.T, name string) {
-		_, err = revocationsClient.DeleteWorkloadIdentityX509Revocation(
-			ctx,
-			&workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
-				Name: name,
+
+		deleteRevocation := func(t *testing.T, name string) {
+			t.Helper()
+
+			err := store.DeleteWorkloadIdentityX509Revocation(t.Context(), name)
+			require.NoError(t, err)
+
+			// Wait for the revocation event to be processed.
+			synctest.Wait()
+		}
+
+		// == Test Logic ==
+		stream := grpctest.NewServerStream[workloadidentityv1pb.StreamSignedCRLResponse](ctx)
+
+		rpcErrCh := make(chan error, 1)
+		go func() {
+			rpcErrCh <- service.StreamSignedCRL(
+				&workloadidentityv1pb.StreamSignedCRLRequest{},
+				stream,
+			)
+		}()
+
+		// Fetch the initial, empty, CRL
+		res, err := stream.Recv()
+		require.NoError(t, err)
+		checkCRL(t, res.Crl, nil)
+
+		// Create new revocations
+		createRevocation(t, "ff")
+		createRevocation(t, "aa")
+
+		t.Log("Advancing fake clock to pass debounce period")
+		time.Sleep(6 * time.Second)
+
+		// The client should now receive a new CRL
+		res, err = stream.Recv()
+		require.NoError(t, err)
+		checkCRL(t, res.Crl, []x509.RevocationListEntry{
+			{
+				SerialNumber:   big.NewInt(170),
+				RevocationTime: revokedAt,
 			},
-		)
+			{
+				SerialNumber:   big.NewInt(255),
+				RevocationTime: revokedAt,
+			},
+		})
+
+		// Add another revocation, delete one revocation
+		createRevocation(t, "bb")
+		deleteRevocation(t, "aa")
+
+		t.Log("Advancing fake clock to pass debounce period")
+		time.Sleep(6 * time.Second)
+
+		// The client should now receive a new CRL
+		res, err = stream.Recv()
 		require.NoError(t, err)
-		// Wait for the revocation event to be processed.
-		select {
-		case <-time.After(5 * time.Second):
-			t.Fatalf("timed out waiting for revocation event to be processed")
-		case <-revocationsEventCh:
-		}
-	}
+		checkCRL(t, res.Crl, []x509.RevocationListEntry{
+			{
+				SerialNumber:   big.NewInt(255),
+				RevocationTime: revokedAt,
+			},
+			{
+				SerialNumber:   big.NewInt(187),
+				RevocationTime: revokedAt,
+			},
+		})
 
-	// Fetch the initial, empty, CRL
-	stream, err := revocationsClient.StreamSignedCRL(
-		ctx, &workloadidentityv1pb.StreamSignedCRLRequest{},
-	)
-	require.NoError(t, err)
-	res, err := stream.Recv()
-	require.NoError(t, err)
-	checkCRL(t, res.Crl, nil)
+		// Delete all remaining CRL
+		deleteRevocation(t, "bb")
+		deleteRevocation(t, "ff")
 
-	// Create new revocations
-	createRevocation(t, "ff")
-	createRevocation(t, "aa")
-	require.NoError(t, fakeClock.BlockUntilContext(ctx, 2))
-	t.Log("Advancing fake clock to pass debounce period")
-	fakeClock.Advance(6 * time.Second)
-	// The client should now receive a new CRL
-	res, err = stream.Recv()
-	require.NoError(t, err)
-	checkCRL(t, res.Crl, []x509.RevocationListEntry{
-		{
-			SerialNumber:   big.NewInt(170),
-			RevocationTime: revokedAt,
-		},
-		{
-			SerialNumber:   big.NewInt(255),
-			RevocationTime: revokedAt,
-		},
-	})
+		t.Log("Advancing fake clock to pass debounce period")
+		time.Sleep(6 * time.Second)
 
-	// Add another revocation, delete one revocation
-	createRevocation(t, "bb")
-	deleteRevocation(t, "aa")
-	require.NoError(t, fakeClock.BlockUntilContext(ctx, 2))
-	t.Log("Advancing fake clock to pass debounce period")
-	fakeClock.Advance(6 * time.Second)
-	// The client should now receive a new CRL
-	res, err = stream.Recv()
-	require.NoError(t, err)
-	checkCRL(t, res.Crl, []x509.RevocationListEntry{
-		{
-			SerialNumber:   big.NewInt(255),
-			RevocationTime: revokedAt,
-		},
-		{
-			SerialNumber:   big.NewInt(187),
-			RevocationTime: revokedAt,
-		},
-	})
+		// The client should now receive a new CRL
+		res, err = stream.Recv()
+		require.NoError(t, err)
+		checkCRL(t, res.Crl, nil)
 
-	// Delete all remaining CRL
-	deleteRevocation(t, "bb")
-	deleteRevocation(t, "ff")
-	require.NoError(t, fakeClock.BlockUntilContext(ctx, 2))
-	t.Log("Advancing fake clock to pass debounce period")
-	fakeClock.Advance(6 * time.Second)
-	// The client should now receive a new CRL
-	res, err = stream.Recv()
-	require.NoError(t, err)
-	checkCRL(t, res.Crl, nil)
+		// Wait ten minutes to see if the periodic CRL is sent.
+		t.Log("Advancing fake clock to pass the periodic timer")
+		time.Sleep(11 * time.Minute)
 
-	// Wait ten minutes to see if the periodic CRL is sent.
-	t.Log("Advancing fake clock to pass the periodic timer")
-	fakeClock.Advance(11 * time.Minute)
-	res, err = stream.Recv()
-	require.NoError(t, err)
-	checkCRL(t, res.Crl, nil)
+		res, err = stream.Recv()
+		require.NoError(t, err)
+		checkCRL(t, res.Crl, nil)
+
+		// Cancel the RPC context and check it didn't return an error.
+		cancel()
+		require.NoError(t, <-rpcErrCh)
+	})
 }
diff --git a/lib/auth/methods.go b/lib/auth/methods.go
index 5a9975b0d76c8..d61ad8a773d29 100644
--- a/lib/auth/methods.go
+++ b/lib/auth/methods.go
@@ -23,13 +23,18 @@ import (
 	"context"
 	"errors"
 	"net"
+	"strings"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth/authclient"
@@ -37,6 +42,7 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -55,7 +61,7 @@ const (
 // authenticateUserLogin implements the bulk of user login authentication.
 // Used by the top-level local login methods, [Server.AuthenticateSSHUser] and
 // [Server.AuthenticateWebUser]
-func (a *Server) authenticateUserLogin(ctx context.Context, req authclient.AuthenticateUserRequest) (services.UserState, services.AccessChecker, error) {
+func (a *Server) authenticateUserLogin(ctx context.Context, req authclient.AuthenticateUserRequest) (services.UserState, *services.SplitAccessChecker, error) {
 	username := req.Username
 
 	requiredExt := mfav1.ChallengeExtensions{
@@ -107,10 +113,51 @@ func (a *Server) authenticateUserLogin(ctx context.Context, req authclient.Authe
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	accessInfo := services.AccessInfoFromUserState(userState)
-	checker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), a)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
+
+	var checker *services.SplitAccessChecker
+	// scoped and unscoped logins use different access checkers and different underlying role types. the scope
+	// parameter is untrusted user input, but we reject attempts to login to a scope for which a user has no
+	// assigned privileges.
+	if req.Scope != "" {
+		// req.Scope is untrusted user input, so perform strong validation before proceeding.
+		if err := scopes.StrongValidate(req.Scope); err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		// set up scope pin (invalid until populated)
+		scopePin := &scopesv1.Pin{
+			Scope: req.Scope,
+		}
+
+		// populate the scope pin with the user's assigned scoped roles
+		if err := a.ScopedAccessCache.PopulatePinnedAssignmentsForUser(ctx, user.GetName(), scopePin); err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		// build the user's access info based on the scope pin and userState
+		accessInfo := services.ScopePinnedAccessInfoFromUserState(userState, scopePin)
+
+		// create a scoped access checker "at" the requested scope. Note that this is not what is typically done for
+		// ordinary access checks. Ordinary access checks should always start with an access checker at the root scope
+		// and descend to the resource scope iteratively. In the case of login/cert-gen however, we want to bring all
+		// scoped roles into the access checker that apply to all possible resources the resulting identity may have
+		// access to.
+		scopedChecker, err := services.RiskyNewScopedAccessCheckerAtScope(ctx, req.Scope, accessInfo, clusterName.GetClusterName(), a.ScopedAccessCache)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		checker = services.NewScopedSplitAccessChecker(scopedChecker)
+	} else {
+		// this is an unscoped login attempt, so the user's capabilities are determined solely by their user state.
+		accessInfo := services.AccessInfoFromUserState(userState)
+
+		unscopedChecker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), a)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		checker = services.NewUnscopedSplitAccessChecker(unscopedChecker)
 	}
 
 	// Verify if the MFA device is locked.
@@ -148,11 +195,20 @@ type authAuditProps struct {
 	username       string
 	clientMetadata *authclient.ForwardedClientMetadata
 	mfaDevice      *types.MFADevice
-	checker        services.AccessChecker
+	checker        *services.SplitAccessChecker
 	authErr        error
 	userOrigin     apievents.UserOrigin
 }
 
+// trimUsername truncates the length of a username to the maximum allowed length, if needed.
+func trimUsername(username string) string {
+	if len(username) <= teleport.MaxUsernameLength {
+		return username
+	}
+
+	return username[:teleport.MaxUsernameLength] + "..."
+}
+
 func (a *Server) emitAuthAuditEvent(ctx context.Context, props authAuditProps) error {
 	event := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
@@ -163,7 +219,7 @@ func (a *Server) emitAuthAuditEvent(ctx context.Context, props authAuditProps) e
 			Success: true,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User:       props.username,
+			User:       trimUsername(props.username),
 			UserOrigin: props.userOrigin,
 		},
 		Method: events.LoginMethodLocal,
@@ -191,7 +247,7 @@ func (a *Server) emitAuthAuditEvent(ctx context.Context, props authAuditProps) e
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		privateKeyPolicy, err := props.checker.PrivateKeyPolicy(authPref.GetPrivateKeyPolicy())
+		privateKeyPolicy, err := props.checker.Common().PrivateKeyPolicy(authPref.GetPrivateKeyPolicy())
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -213,9 +269,10 @@ var (
 )
 
 type verifyMFADeviceLocksParams struct {
-	// Checker used to verify locks.
-	// Optional, created via a [UserState] fetch if nil.
-	Checker services.AccessChecker
+	// Checker is used to verify locks. Lock verification varies depending on whether the checker is
+	// scoped or unscoped, so we use a split checker. If no checker is provided, a default unscoped
+	// checker is created from the user backend state.
+	Checker *services.SplitAccessChecker
 
 	// ClusterLockingMode used to verify locks.
 	// Optional, acquired from [Server.GetAuthPreference] if nil.
@@ -262,11 +319,11 @@ func (a *Server) authenticateUser(
 			if err != nil {
 				return trace.Wrap(err)
 			}
-			checker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), a)
+			unscopedChecker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), a)
 			if err != nil {
 				return trace.Wrap(err)
 			}
-			p.Checker = checker
+			p.Checker = services.NewUnscopedSplitAccessChecker(unscopedChecker)
 		}
 
 		if p.ClusterLockingMode == "" {
@@ -641,19 +698,21 @@ func (a *Server) AuthenticateWebUser(ctx context.Context, req authclient.Authent
 		return nil, trace.Wrap(err)
 	}
 
-	var loginIP, userAgent string
+	var loginIP, userAgent, proxyGroupID string
 	if cm := req.ClientMetadata; cm != nil {
 		loginIP, _, err = net.SplitHostPort(cm.RemoteAddr)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		userAgent = cm.UserAgent
+		proxyGroupID = cm.ProxyGroupID
 	}
 
 	sess, err := a.CreateWebSessionFromReq(ctx, NewWebSessionRequest{
 		User:                 user.GetName(),
 		LoginIP:              loginIP,
 		LoginUserAgent:       userAgent,
+		ProxyGroupID:         proxyGroupID,
 		Roles:                user.GetRoles(),
 		Traits:               user.GetTraits(),
 		LoginTime:            a.clock.Now().UTC(),
@@ -718,7 +777,8 @@ func (a *Server) AuthenticateSSHUser(ctx context.Context, req authclient.Authent
 		}
 		clientIP = host
 	}
-	if checker.PinSourceIP() && clientIP == "" {
+
+	if checker.Common().PinSourceIP() && clientIP == "" {
 		return nil, trace.BadParameter("source IP pinning is enabled but client IP is unknown")
 	}
 
@@ -757,15 +817,48 @@ func (a *Server) AuthenticateSSHUser(ctx context.Context, req authclient.Authent
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	var userAgent, proxyGroupID string
+	if req.ClientMetadata != nil {
+		userAgent = req.ClientMetadata.UserAgent
+		proxyGroupID = req.ClientMetadata.ProxyGroupID
+	}
 	UserLoginCount.Inc()
+	userAgentType, userAgentVersion := splitClientUserAgent(userAgent)
+	userLoginCountPerClient.With(prometheus.Labels{
+		tagUserAgentType: userAgentType,
+		tagVersion:       userAgentVersion,
+		tagProxyGroupID:  proxyGroupID,
+	}).Inc()
+
+	var clientOptions authclient.ClientOptions
+	if o, err := a.ClientOptionsForLogin(user); err == nil {
+		clientOptions = o
+	} else {
+		a.logger.WarnContext(ctx, "Failed to calculate client options for local login", "username", user.GetName(), "error", err)
+	}
+
 	return &authclient.SSHLoginResponse{
-		Username:    user.GetName(),
-		Cert:        certs.SSH,
-		TLSCert:     certs.TLS,
-		HostSigners: authclient.AuthoritiesToTrustedCerts(hostCertAuthorities),
+		Username:      user.GetName(),
+		Cert:          certs.SSH,
+		TLSCert:       certs.TLS,
+		HostSigners:   authclient.AuthoritiesToTrustedCerts(hostCertAuthorities),
+		ClientOptions: clientOptions,
 	}, nil
 }
 
+// ClientOptionsForLogin returns the client options for a user that has just
+// logged in.
+func (a *Server) ClientOptionsForLogin(userState services.UserState) (authclient.ClientOptions, error) {
+	var opts authclient.ClientOptions
+
+	if t := userState.GetTraits()[constants.TraitDefaultRelayAddr]; len(t) > 0 {
+		opts.DefaultRelayAddr = t[0]
+	}
+
+	return opts, nil
+}
+
 // emitNoLocalAuthEvent creates and emits a local authentication is disabled message.
 func (a *Server) emitNoLocalAuthEvent(username string) {
 	if err := a.emitter.EmitAuditEvent(a.closeCtx, &apievents.AuthAttempt{
@@ -818,6 +911,21 @@ func trimUserAgent(userAgent string) string {
 	return userAgent
 }
 
+// splitClientUserAgent strictly splits the user agent into a type and a semantic version.
+// Any other formatting is not allowed and is treated as a third-party client (to be ignored).
+func splitClientUserAgent(userAgent string) (string, string) {
+	agent := strings.SplitN(userAgent, "/", 2)
+	if len(agent) != 2 {
+		return "", ""
+	}
+	ver, err := semver.NewVersion(agent[1])
+	if err != nil {
+		return "", ""
+	}
+
+	return agent[0], ver.String()
+}
+
 const noLocalAuth = "local auth disabled"
 
 func userOrigin(user types.User) apievents.UserOrigin {
diff --git a/lib/auth/methods_test.go b/lib/auth/methods_test.go
index e8525e3628d6f..c1434a749718e 100644
--- a/lib/auth/methods_test.go
+++ b/lib/auth/methods_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -26,6 +26,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 )
@@ -35,15 +36,17 @@ func TestServerAuthenticateUserUserAgentTrim(t *testing.T) {
 	emitter := &eventstest.MockRecorderEmitter{}
 	r := authclient.AuthenticateUserRequest{
 		ClientMetadata: &authclient.ForwardedClientMetadata{
-			UserAgent: strings.Repeat("A", maxUserAgentLen+1),
+			UserAgent: strings.Repeat("A", auth.MaxUserAgentLen+1),
 		},
 	}
 	// Ignoring the error here because we really just care that the event was logged.
-	(&Server{emitter: emitter}).authenticateUserLogin(ctx, r)
+	srv := &auth.Server{}
+	srv.SetEmitter(emitter)
+	srv.AuthenticateUserLogin(ctx, r)
 	event := emitter.LastEvent()
 	loginEvent, ok := event.(*apievents.UserLogin)
 	require.True(t, ok)
-	require.LessOrEqual(t, len(loginEvent.UserAgent), maxUserAgentLen)
+	require.LessOrEqual(t, len(loginEvent.UserAgent), auth.MaxUserAgentLen)
 }
 
 func Test_trimUserAgent(t *testing.T) {
@@ -66,7 +69,7 @@ func Test_trimUserAgent(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			require.Equal(t, test.wantUserAgent, trimUserAgent(test.inputUserAgent))
+			require.Equal(t, test.wantUserAgent, auth.TrimUserAgent(test.inputUserAgent))
 		})
 	}
 }
diff --git a/lib/auth/middleware.go b/lib/auth/middleware.go
index 6a2f4dc0ad271..70a16394d565c 100644
--- a/lib/auth/middleware.go
+++ b/lib/auth/middleware.go
@@ -55,6 +55,7 @@ import (
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/observability/metrics"
+	grpcmetrics "github.com/gravitational/teleport/lib/observability/metrics/grpc"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -162,7 +163,7 @@ func NewTLSServer(ctx context.Context, cfg TLSServerConfig) (*TLSServer, error)
 	}
 
 	// sets up gRPC metrics interceptor
-	grpcMetrics := metrics.CreateGRPCServerMetrics(cfg.Metrics.GRPCServerLatency, prometheus.Labels{teleport.TagServer: "teleport-auth"})
+	grpcMetrics := grpcmetrics.CreateGRPCServerMetrics(cfg.Metrics.GRPCServerLatency, prometheus.Labels{teleport.TagServer: "teleport-auth"})
 	err = metrics.RegisterPrometheusCollectors(grpcMetrics)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -274,12 +275,21 @@ func (t *TLSServer) Close() error {
 		t.grpcServer.server.Stop()
 		errC <- nil
 	}()
-	errors := []error{}
-	for i := 0; i < 2; i++ {
-		errors = append(errors, <-errC)
+
+	var errors []error
+	for range 2 {
+		if err := <-errC; err != nil {
+			errors = append(errors, err)
+		}
+	}
+
+	if err := t.mux.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+		errors = append(errors, err)
+	}
+
+	if err := t.clientTLSConfigGenerator.Close(); err != nil {
+		errors = append(errors, err)
 	}
-	errors = append(errors, t.mux.Close())
-	errors = append(errors, t.clientTLSConfigGenerator.Close())
 	return trace.NewAggregate(errors...)
 }
 
@@ -293,10 +303,22 @@ func (t *TLSServer) Shutdown(ctx context.Context) error {
 		t.grpcServer.server.GracefulStop()
 		errC <- nil
 	}()
-	errors := []error{}
-	for i := 0; i < 2; i++ {
-		errors = append(errors, <-errC)
+
+	var errors []error
+	for range 2 {
+		if err := <-errC; err != nil {
+			errors = append(errors, err)
+		}
+	}
+
+	if err := t.mux.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+		errors = append(errors, err)
 	}
+
+	if err := t.clientTLSConfigGenerator.Close(); err != nil {
+		errors = append(errors, err)
+	}
+
 	return trace.NewAggregate(errors...)
 }
 
@@ -580,12 +602,7 @@ func (a *Middleware) withAuthenticatedUserStreamInterceptor(srv interface{}, ser
 
 // UnaryInterceptors returns the gRPC unary interceptor chain.
 func (a *Middleware) UnaryInterceptors() []grpc.UnaryServerInterceptor {
-	is := []grpc.UnaryServerInterceptor{
-		//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-		// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-		otelgrpc.UnaryServerInterceptor(),
-	}
-
+	var is []grpc.UnaryServerInterceptor
 	if a.GRPCMetrics != nil {
 		is = append(is, a.GRPCMetrics.UnaryServerInterceptor())
 	}
@@ -669,6 +686,7 @@ func (a *Middleware) GetUser(connState tls.ConnectionState) (authz.IdentityGette
 			return nil, trace.AccessDenied("access denied: invalid client certificate")
 		}
 		identity.TeleportCluster = certClusterName
+		identity.OriginClusterName = certClusterName
 	}
 	// If there is any restriction on the certificate usage
 	// reject the API server request. This is done so some classes
@@ -909,79 +927,3 @@ func newLocalUserFromIdentity(identity tlsca.Identity) authz.LocalUser {
 		Identity: identity,
 	}
 }
-
-// ImpersonatorRoundTripper is a round tripper that impersonates a user with
-// the identity provided.
-type ImpersonatorRoundTripper struct {
-	http.RoundTripper
-}
-
-// NewImpersonatorRoundTripper returns a new impersonator round tripper.
-func NewImpersonatorRoundTripper(rt http.RoundTripper) *ImpersonatorRoundTripper {
-	return &ImpersonatorRoundTripper{
-		RoundTripper: rt,
-	}
-}
-
-// RoundTrip implements http.RoundTripper interface to include the identity
-// in the request header.
-func (r *ImpersonatorRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	req = req.Clone(req.Context())
-
-	identity, err := authz.UserFromContext(req.Context())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	b, err := json.Marshal(identity.GetIdentity())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	req.Header.Set(TeleportImpersonateUserHeader, string(b))
-
-	clientSrcAddr, err := authz.ClientSrcAddrFromContext(req.Context())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	req.Header.Set(TeleportImpersonateIPHeader, clientSrcAddr.String())
-
-	return r.RoundTripper.RoundTrip(req)
-}
-
-// CloseIdleConnections ensures that the returned [net.RoundTripper]
-// has a CloseIdleConnections method.
-func (r *ImpersonatorRoundTripper) CloseIdleConnections() {
-	type closeIdler interface {
-		CloseIdleConnections()
-	}
-	if c, ok := r.RoundTripper.(closeIdler); ok {
-		c.CloseIdleConnections()
-	}
-}
-
-// IdentityForwardingHeaders returns a copy of the provided headers with
-// the TeleportImpersonateUserHeader and TeleportImpersonateIPHeader headers
-// set to the identity provided.
-// The returned headers shouln't be used across requests as they contain
-// the client's IP address and the user's identity.
-func IdentityForwardingHeaders(ctx context.Context, originalHeaders http.Header) (http.Header, error) {
-	identity, err := authz.UserFromContext(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	b, err := json.Marshal(identity.GetIdentity())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	headers := originalHeaders.Clone()
-	headers.Set(TeleportImpersonateUserHeader, string(b))
-
-	clientSrcAddr, err := authz.ClientSrcAddrFromContext(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	headers.Set(TeleportImpersonateIPHeader, clientSrcAddr.String())
-	return headers, nil
-}
diff --git a/lib/auth/middleware_test.go b/lib/auth/middleware_test.go
index c2ae62b183f60..5d0cd9f87003c 100644
--- a/lib/auth/middleware_test.go
+++ b/lib/auth/middleware_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"bytes"
@@ -45,6 +45,8 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -69,10 +71,11 @@ func TestMiddlewareGetUser(t *testing.T) {
 
 	var (
 		localUserIdentity = tlsca.Identity{
-			Username:        "foo",
-			Groups:          []string{"devs"},
-			TeleportCluster: localClusterName,
-			Expires:         now,
+			Username:          "foo",
+			Groups:            []string{"devs"},
+			TeleportCluster:   localClusterName,
+			OriginClusterName: localClusterName,
+			Expires:           now,
 		}
 		localUserIdentityNoTeleportCluster = tlsca.Identity{
 			Username: "foo",
@@ -80,16 +83,18 @@ func TestMiddlewareGetUser(t *testing.T) {
 			Expires:  now,
 		}
 		localSystemRole = tlsca.Identity{
-			Username:        "node",
-			Groups:          []string{string(types.RoleNode)},
-			TeleportCluster: localClusterName,
-			Expires:         now,
+			Username:          "node",
+			Groups:            []string{string(types.RoleNode)},
+			TeleportCluster:   localClusterName,
+			OriginClusterName: localClusterName,
+			Expires:           now,
 		}
 		remoteUserIdentity = tlsca.Identity{
-			Username:        "foo",
-			Groups:          []string{"devs"},
-			TeleportCluster: remoteClusterName,
-			Expires:         now,
+			Username:          "foo",
+			Groups:            []string{"devs"},
+			TeleportCluster:   remoteClusterName,
+			OriginClusterName: remoteClusterName,
+			Expires:           now,
 		}
 		remoteUserIdentityNoTeleportCluster = tlsca.Identity{
 			Username: "foo",
@@ -97,10 +102,11 @@ func TestMiddlewareGetUser(t *testing.T) {
 			Expires:  now,
 		}
 		remoteSystemRole = tlsca.Identity{
-			Username:        "node",
-			Groups:          []string{string(types.RoleNode)},
-			TeleportCluster: remoteClusterName,
-			Expires:         now,
+			Username:          "node",
+			Groups:            []string{string(types.RoleNode)},
+			TeleportCluster:   remoteClusterName,
+			OriginClusterName: remoteClusterName,
+			Expires:           now,
 		}
 	)
 
@@ -209,7 +215,7 @@ func TestMiddlewareGetUser(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			m := &Middleware{
+			m := &auth.Middleware{
 				ClusterName: localClusterName,
 			}
 
@@ -251,10 +257,11 @@ func TestWrapContextWithUser(t *testing.T) {
 
 	now := time.Date(2020, time.November, 5, 0, 0, 0, 0, time.UTC)
 	localUserIdentity := tlsca.Identity{
-		Username:        "foo",
-		Groups:          []string{"devs"},
-		TeleportCluster: localClusterName,
-		Expires:         now,
+		Username:          "foo",
+		Groups:            []string{"devs"},
+		TeleportCluster:   localClusterName,
+		OriginClusterName: localClusterName,
+		Expires:           now,
 	}
 
 	tests := []struct {
@@ -295,7 +302,7 @@ func TestWrapContextWithUser(t *testing.T) {
 	require.NoError(t, err)
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			m := &Middleware{
+			m := &auth.Middleware{
 				ClusterName: clusterName.GetClusterName(),
 			}
 
@@ -347,48 +354,53 @@ func TestMiddleware_ServeHTTP(t *testing.T) {
 
 	now := time.Date(2020, time.November, 5, 0, 0, 0, 0, time.UTC)
 	localUserIdentity := tlsca.Identity{
-		Username:        "foo",
-		Groups:          []string{"devs"},
-		TeleportCluster: localClusterName,
-		Expires:         now,
-		Usage:           []string{},
-		Principals:      []string{},
+		Username:          "foo",
+		Groups:            []string{"devs"},
+		TeleportCluster:   localClusterName,
+		OriginClusterName: localClusterName,
+		Expires:           now,
+		Usage:             []string{},
+		Principals:        []string{},
 	}
 
 	remoteUserIdentity := tlsca.Identity{
-		Username:        "foo",
-		Groups:          []string{"devs"},
-		TeleportCluster: remoteClusterName,
-		Expires:         now,
-		Usage:           []string{},
-		Principals:      []string{},
+		Username:          "foo",
+		Groups:            []string{"devs"},
+		TeleportCluster:   remoteClusterName,
+		OriginClusterName: remoteClusterName,
+		Expires:           now,
+		Usage:             []string{},
+		Principals:        []string{},
 	}
 
 	proxyIdentity := tlsca.Identity{
-		Username:        "proxy...",
-		Groups:          []string{string(types.RoleProxy)},
-		TeleportCluster: localClusterName,
-		Expires:         now,
-		Usage:           []string{},
-		Principals:      []string{},
+		Username:          "proxy...",
+		Groups:            []string{string(types.RoleProxy)},
+		TeleportCluster:   localClusterName,
+		OriginClusterName: localClusterName,
+		Expires:           now,
+		Usage:             []string{},
+		Principals:        []string{},
 	}
 
 	remoteProxyIdentity := tlsca.Identity{
-		Username:        "proxy...",
-		Groups:          []string{string(types.RoleProxy)},
-		TeleportCluster: remoteClusterName,
-		Expires:         now,
-		Usage:           []string{},
-		Principals:      []string{},
+		Username:          "proxy...",
+		Groups:            []string{string(types.RoleProxy)},
+		TeleportCluster:   remoteClusterName,
+		OriginClusterName: remoteClusterName,
+		Expires:           now,
+		Usage:             []string{},
+		Principals:        []string{},
 	}
 
 	dbIdentity := tlsca.Identity{
-		Username:        "db...",
-		Groups:          []string{string(types.RoleDatabase)},
-		TeleportCluster: localClusterName,
-		Expires:         now,
-		Usage:           []string{},
-		Principals:      []string{},
+		Username:          "db...",
+		Groups:            []string{string(types.RoleDatabase)},
+		TeleportCluster:   localClusterName,
+		OriginClusterName: localClusterName,
+		Expires:           now,
+		Usage:             []string{},
+		Principals:        []string{},
 	}
 
 	type args struct {
@@ -589,7 +601,7 @@ func TestMiddleware_ServeHTTP(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			a := &Middleware{
+			a := &auth.Middleware{
 				ClusterName: localClusterName,
 				Handler: &fakeHTTPHandler{
 					t:                 t,
@@ -609,8 +621,8 @@ func TestMiddleware_ServeHTTP(t *testing.T) {
 			if tt.args.impersonateIdentity != nil {
 				data, err := json.Marshal(tt.args.impersonateIdentity)
 				require.NoError(t, err)
-				r.Header.Set(TeleportImpersonateUserHeader, string(data))
-				r.Header.Set(TeleportImpersonateIPHeader, tt.args.impersonatedIPAddr)
+				r.Header.Set(auth.TeleportImpersonateUserHeader, string(data))
+				r.Header.Set(auth.TeleportImpersonateIPHeader, tt.args.impersonatedIPAddr)
 			}
 			rsp := httptest.NewRecorder()
 			a.ServeHTTP(rsp, r)
@@ -662,8 +674,8 @@ func (h *fakeHTTPHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	require.Equal(h.t, h.userIP, r.RemoteAddr)
 	// Ensure that the Teleport-Impersonate-User header is not set on the request
 	// after the middleware has run.
-	require.Empty(h.t, r.Header.Get(TeleportImpersonateUserHeader))
-	require.Empty(h.t, r.Header.Get(TeleportImpersonateIPHeader))
+	require.Empty(h.t, r.Header.Get(auth.TeleportImpersonateUserHeader))
+	require.Empty(h.t, r.Header.Get(auth.TeleportImpersonateIPHeader))
 }
 
 type fakeConn struct {
@@ -686,27 +698,27 @@ func (f *fakeConn) RemoteAddr() net.Addr {
 func TestValidateClientVersion(t *testing.T) {
 	cases := []struct {
 		name          string
-		middleware    *Middleware
+		middleware    *auth.Middleware
 		clientVersion string
 		errAssertion  func(t *testing.T, err error)
 	}{
 		{
 			name:       "rejection disabled",
-			middleware: &Middleware{},
+			middleware: &auth.Middleware{},
 			errAssertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
 			},
 		},
 		{
 			name:       "rejection enabled and client version not specified",
-			middleware: &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware: &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			errAssertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
 			},
 		},
 		{
 			name:          "client rejected",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: semver.Version{Major: api.VersionMajor - 2}.String(),
 			errAssertion: func(t *testing.T, err error) {
 				require.True(t, trace.IsAccessDenied(err), "got %T, expected access denied error", err)
@@ -714,7 +726,7 @@ func TestValidateClientVersion(t *testing.T) {
 		},
 		{
 			name:          "valid client v-1",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: semver.Version{Major: api.VersionMajor - 1}.String(),
 			errAssertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
@@ -722,7 +734,7 @@ func TestValidateClientVersion(t *testing.T) {
 		},
 		{
 			name:          "valid client v-0",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: semver.Version{Major: api.VersionMajor}.String(),
 			errAssertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
@@ -730,7 +742,7 @@ func TestValidateClientVersion(t *testing.T) {
 		},
 		{
 			name:          "invalid client version",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: "abc123",
 			errAssertion: func(t *testing.T, err error) {
 				require.True(t, trace.IsAccessDenied(err), "got %T, expected access denied error", err)
@@ -738,7 +750,7 @@ func TestValidateClientVersion(t *testing.T) {
 		},
 		{
 			name:          "pre-release client allowed",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: semver.Version{Major: api.VersionMajor - 1, PreRelease: "dev.abcd.123"}.String(),
 			errAssertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
@@ -746,7 +758,7 @@ func TestValidateClientVersion(t *testing.T) {
 		},
 		{
 			name:          "pre-release client rejected",
-			middleware:    &Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
+			middleware:    &auth.Middleware{OldestSupportedVersion: teleport.MinClientSemVer()},
 			clientVersion: semver.Version{Major: api.VersionMajor - 2, PreRelease: "dev.abcd.123"}.String(),
 			errAssertion: func(t *testing.T, err error) {
 				require.True(t, trace.IsAccessDenied(err), "got %T, expected access denied error", err)
@@ -761,14 +773,14 @@ func TestValidateClientVersion(t *testing.T) {
 				ctx = metadata.NewIncomingContext(ctx, metadata.New(map[string]string{"version": tt.clientVersion}))
 			}
 
-			tt.errAssertion(t, tt.middleware.ValidateClientVersion(ctx, IdentityInfo{Conn: &fakeConn{}, IdentityGetter: TestBuiltin(types.RoleNode).I}))
+			tt.errAssertion(t, tt.middleware.ValidateClientVersion(ctx, auth.IdentityInfo{Conn: &fakeConn{}, IdentityGetter: authtest.TestBuiltin(types.RoleNode).I}))
 		})
 	}
 }
 
 func TestRejectedClientClusterAlertContents(t *testing.T) {
 	var alerts []types.ClusterAlert
-	mw := Middleware{
+	mw := auth.Middleware{
 		OldestSupportedVersion: teleport.MinClientSemVer(),
 		AlertCreator: func(ctx context.Context, a types.ClusterAlert) error {
 			alerts = append(alerts, a)
@@ -792,13 +804,13 @@ func TestRejectedClientClusterAlertContents(t *testing.T) {
 	}{
 		{
 			name:     "invalid node",
-			identity: TestServerID(types.RoleNode, "1-2-3-4").I,
+			identity: authtest.TestServerID(types.RoleNode, "1-2-3-4").I,
 			expected: fmt.Sprintf("Connection from Node 1-2-3-4 at 127.0.0.1:6514, running an unsupported version of v%s was rejected. Connections will be allowed after upgrading the agent to v%s or newer", version, alertVersion),
 		},
 		{
 			name:      "invalid tsh",
 			userAgent: "tsh/" + teleport.Version,
-			identity:  TestUser("llama").I,
+			identity:  authtest.TestUser("llama").I,
 			expected:  fmt.Sprintf("Connection from tsh v%s by llama was rejected. Connections will be allowed after upgrading tsh to v%s or newer", version, alertVersion),
 		},
 		{
@@ -816,7 +828,7 @@ func TestRejectedClientClusterAlertContents(t *testing.T) {
 
 		{
 			name:     "invalid tool",
-			identity: TestUser("llama").I,
+			identity: authtest.TestUser("llama").I,
 			expected: fmt.Sprintf("Connection from tsh, tctl, tbot, or a plugin running v%s by llama was rejected. Connections will be allowed after upgrading to v%s or newer", version, alertVersion),
 		},
 	}
@@ -830,7 +842,7 @@ func TestRejectedClientClusterAlertContents(t *testing.T) {
 				"user-agent": test.userAgent,
 			}))
 
-			err := mw.ValidateClientVersion(ctx, IdentityInfo{Conn: &fakeConn{}, IdentityGetter: test.identity})
+			err := mw.ValidateClientVersion(ctx, auth.IdentityInfo{Conn: &fakeConn{}, IdentityGetter: test.identity})
 			assert.Error(t, err)
 
 			// Assert that only an alert was created and the content matches expectations.
@@ -843,14 +855,14 @@ func TestRejectedClientClusterAlertContents(t *testing.T) {
 
 			// Reset the last alert time to a time beyond the rate limit, allowing the next
 			// rejection to trigger another alert.
-			mw.lastRejectedAlertTime.Store(time.Now().Add(-25 * time.Hour).UnixNano())
+			mw.SetLastRejectedTime(time.Now().Add(-25 * time.Hour))
 		})
 	}
 }
 
 func TestRejectedClientClusterAlert(t *testing.T) {
 	var alerts []types.ClusterAlert
-	mw := Middleware{
+	mw := auth.Middleware{
 		OldestSupportedVersion: teleport.MinClientSemVer(),
 		AlertCreator: func(ctx context.Context, a types.ClusterAlert) error {
 			alerts = append(alerts, a)
@@ -862,7 +874,7 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 	ctx := metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
 		"version": semver.Version{Major: api.VersionMajor - 20}.String(),
 	}))
-	err := mw.ValidateClientVersion(ctx, IdentityInfo{Conn: &fakeConn{}, IdentityGetter: TestBuiltin(types.RoleNode).I})
+	err := mw.ValidateClientVersion(ctx, auth.IdentityInfo{Conn: &fakeConn{}, IdentityGetter: authtest.TestBuiltin(types.RoleNode).I})
 	assert.Error(t, err)
 
 	// Validate a client with an unknown version, which should trigger an alert, however,
@@ -870,7 +882,7 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 	ctx = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
 		"version": "abcd",
 	}))
-	err = mw.ValidateClientVersion(ctx, IdentityInfo{Conn: &fakeConn{}, IdentityGetter: TestBuiltin(types.RoleNode).I})
+	err = mw.ValidateClientVersion(ctx, auth.IdentityInfo{Conn: &fakeConn{}, IdentityGetter: authtest.TestBuiltin(types.RoleNode).I})
 	assert.Error(t, err)
 
 	// Assert that only a single alert was created based on the above rejections.
@@ -886,7 +898,7 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 
 			// Reset the last alert time to a time beyond the rate limit, allowing the next
 			// rejection to trigger another alert.
-			mw.lastRejectedAlertTime.Store(time.Now().Add(-25 * time.Hour).UnixNano())
+			mw.SetLastRejectedTime(time.Now().Add(-25 * time.Hour))
 
 			// Create a new context with the user-agent set to a client tool. This should alter the
 			// text in the alert to indicate the connection was from a client tool and not an agent.
@@ -902,7 +914,7 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 				wg.Add(1)
 				go func() {
 					defer wg.Done()
-					err := mw.ValidateClientVersion(ctx, IdentityInfo{Conn: &fakeConn{}, IdentityGetter: TestBuiltin(types.RoleNode).I})
+					err := mw.ValidateClientVersion(ctx, auth.IdentityInfo{Conn: &fakeConn{}, IdentityGetter: authtest.TestBuiltin(types.RoleNode).I})
 					assert.Error(t, err)
 				}()
 			}
diff --git a/lib/auth/migration/migration_test.go b/lib/auth/migration/migration_test.go
index a87ffd3ff81b9..1ef508a8572b9 100644
--- a/lib/auth/migration/migration_test.go
+++ b/lib/auth/migration/migration_test.go
@@ -29,7 +29,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type testMigration struct {
@@ -63,7 +63,7 @@ func (t testMigration) Name() string {
 }
 
 func TestApply(t *testing.T) {
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	cases := []struct {
 		name           string
 		migrations     []migration
diff --git a/lib/auth/moderated_sessions_test.go b/lib/auth/moderated_sessions_test.go
index eb2640ea6ddc1..5c9c3139c426d 100644
--- a/lib/auth/moderated_sessions_test.go
+++ b/lib/auth/moderated_sessions_test.go
@@ -16,18 +16,19 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
 	"testing"
 
-	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services/local"
 )
 
@@ -35,11 +36,10 @@ import (
 // license does not support the moderated sessions feature.
 func TestUnmoderatedSessionsAllowed(t *testing.T) {
 	// Use OSS License (which doesn't support moderated sessions).
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildOSS})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildOSS})
 
-	srv := &Server{
-		clock:    clockwork.NewRealClock(),
-		Services: &Services{},
+	srv := &auth.Server{
+		Services: &auth.Services{},
 	}
 
 	bk, err := memory.New(memory.Config{})
@@ -63,11 +63,10 @@ func TestUnmoderatedSessionsAllowed(t *testing.T) {
 // Since moderated sessions require trackers, we mediate this in the tracker creation function.
 func TestModeratedSessionsDisabled(t *testing.T) {
 	// Use OSS License (which doesn't support moderated sessions).
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildOSS})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildOSS})
 
-	srv := &Server{
-		clock:    clockwork.NewRealClock(),
-		Services: &Services{},
+	srv := &auth.Server{
+		Services: &auth.Services{},
 	}
 
 	bk, err := memory.New(memory.Config{})
@@ -96,18 +95,17 @@ func TestModeratedSessionsDisabled(t *testing.T) {
 	tracker, err = srv.CreateSessionTracker(context.Background(), tracker)
 	require.Error(t, err)
 	require.Nil(t, tracker)
-	require.ErrorIs(t, err, ErrRequiresEnterprise)
+	require.ErrorIs(t, err, auth.ErrRequiresEnterprise)
 }
 
 // TestModeratedSessionsEnabled verifies that we can create session trackers with moderation
 // requirements when the license supports it.
 func TestModeratedSesssionsEnabled(t *testing.T) {
 	// Use Enterprise License (which supports moderated sessions).
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
-	srv := &Server{
-		clock:    clockwork.NewRealClock(),
-		Services: &Services{},
+	srv := &auth.Server{
+		Services: &auth.Services{},
 	}
 
 	bk, err := memory.New(memory.Config{})
diff --git a/lib/auth/session_access.go b/lib/auth/moderation/session_access.go
similarity index 98%
rename from lib/auth/session_access.go
rename to lib/auth/moderation/session_access.go
index 9b813b3c7d048..a1d59a5420b62 100644
--- a/lib/auth/session_access.go
+++ b/lib/auth/moderation/session_access.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package moderation
 
 import (
 	"fmt"
@@ -93,6 +93,10 @@ type SessionAccessContext struct {
 	Mode     types.SessionParticipantMode
 }
 
+func (ctx *SessionAccessContext) GetAccessChecker() (services.AccessChecker, error) {
+	return nil, trace.NotImplemented("access checker is not implemented for session access context")
+}
+
 // GetIdentifier is used by the `predicate` library to evaluate variable expressions when
 // evaluating policy filters. It deals with evaluating strings like `participant.name` to the appropriate value.
 func (ctx *SessionAccessContext) GetIdentifier(fields []string) (interface{}, error) {
diff --git a/lib/auth/session_access_test.go b/lib/auth/moderation/session_access_test.go
similarity index 99%
rename from lib/auth/session_access_test.go
rename to lib/auth/moderation/session_access_test.go
index 27429e6e36a39..cd3cc77878405 100644
--- a/lib/auth/session_access_test.go
+++ b/lib/auth/moderation/session_access_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package moderation
 
 import (
 	"testing"
diff --git a/lib/auth/notification_test.go b/lib/auth/notification_test.go
index c738f2d663dda..db302b85b4d50 100644
--- a/lib/auth/notification_test.go
+++ b/lib/auth/notification_test.go
@@ -16,48 +16,36 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
-	"context"
 	"fmt"
 	"testing"
 	"time"
 
 	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
-func TestNotifications(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
+func TestNotificationMatchers(t *testing.T) {
+	t.Parallel()
 
-	fakeClock := clockwork.NewFakeClock()
-
-	authServer, err := NewTestAuthServer(TestAuthServerConfig{
-		Dir:          t.TempDir(),
-		Clock:        fakeClock,
-		CacheEnabled: true,
-	})
-	require.NoError(t, err)
-
-	srv, err := authServer.NewTestTLSServer()
-
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, srv.Close()) })
+	srv := mockAuth(t)
 
 	roles := map[string]types.RoleSpecV6{
-		// auditors have access to nodes and databases, and the "auditor" and "user" logins
-		"auditors": {
+		// devs have access to nodes and databases, and the "root" and "ec2-user" logins
+		"devs": {
 			Allow: types.RoleConditions{
-				Logins: []string{"auditor", "user"},
+				Logins: []string{"root", "ec2-user"},
 				Rules: []types.Rule{
 					{
 						Resources: []string{types.KindNode, types.KindDatabase},
@@ -66,7 +54,7 @@ func TestNotifications(t *testing.T) {
 				},
 			},
 		},
-		// managers have access to review requests for the "intern" role
+		// managers can review requests for the "intern" role
 		"managers": {
 			Allow: types.RoleConditions{
 				Logins: []string{"user"},
@@ -75,90 +63,80 @@ func TestNotifications(t *testing.T) {
 				},
 			},
 		},
+		// tokenadmins can read and write tokens
+		"tokenadmins": {
+			Allow: types.RoleConditions{
+				Rules: []types.Rule{
+					{
+						Resources: []string{types.KindToken},
+						Verbs:     services.RW(),
+					},
+				},
+			},
+		},
 	}
-	for roleName, roleSpec := range roles {
-		role, err := types.NewRole(roleName, roleSpec)
+	for name, spec := range roles {
+		role, err := types.NewRole(name, spec)
 		require.NoError(t, err)
 
-		_, err = srv.Auth().UpsertRole(ctx, role)
+		_, err = srv.Auth().UpsertRole(t.Context(), role)
 		require.NoError(t, err)
 	}
 
-	auditorUsername := "auditor"
-	managerUsername := "manager"
-
-	userRolesMap := map[string][]string{
-		auditorUsername: {"auditors"},
-		managerUsername: {"managers"},
+	userRoles := map[string][]string{
+		"bob":   []string{"devs"},
+		"alice": []string{"managers"},
+		"carol": []string{"devs", "tokenadmins"},
 	}
-
-	// Create the users with their roles.
-	for username, roles := range userRolesMap {
+	for username, roles := range userRoles {
 		user, err := types.NewUser(username)
 		require.NoError(t, err)
 		user.SetRoles(roles)
-		_, err = srv.Auth().UpsertUser(ctx, user)
+
+		_, err = srv.Auth().UpsertUser(t.Context(), user)
 		require.NoError(t, err)
 	}
 
-	// Describes a set of mock notifications to be created.
-	// The number in each notification's description represents the creation order of the notifications.
-	// eg. "auditor-3" will be the third notification created for auditor, and the third from last in the list (since it's the third oldest),
+	// The number in each notification's description represents the order in which the
+	// notification was created. For example, bob-3 will be the third notification created
+	// for bob, and third from last in the list (since it's the third oldest).
 	testNotifications := []struct {
 		userNotification   *notificationsv1.Notification
 		globalNotification *notificationsv1.GlobalNotification
 	}{
+		// Some notifications targeted at single users
+		{userNotification: newUserNotification("bob", "bob-1")},
+		{userNotification: newUserNotification("alice", "alice-1")},
+
+		// A notification targeted at a specific role (managers)
 		{
-			userNotification: newUserNotification(t, auditorUsername, "auditor-1"),
-		},
-		{
-			userNotification: newUserNotification(t, auditorUsername, "auditor-2"),
-		},
-		{
-			// Matcher matches by the role "auditors"
-			globalNotification: newGlobalNotification(t, "auditor-3", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByRoles{
-					ByRoles: &notificationsv1.ByRoles{
-						Roles: []string{userRolesMap[auditorUsername][0]},
-					},
-				},
-			}),
-		},
-		{
-			// Matcher matches by the role "managers"
-			globalNotification: newGlobalNotification(t, "manager-1", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("alice-2", &notificationsv1.GlobalNotificationSpec{
 				Matcher: &notificationsv1.GlobalNotificationSpec_ByRoles{
 					ByRoles: &notificationsv1.ByRoles{
-						Roles: []string{userRolesMap[managerUsername][0]},
+						Roles: []string{"managers"},
 					},
 				},
 			}),
 		},
+
+		// A notification for everyone
 		{
-			userNotification: newUserNotification(t, auditorUsername, "auditor-4"),
-		},
-		{
-			// Matcher matches all, both users should see this.
-			globalNotification: newGlobalNotification(t, "auditor-5,manager-2", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_All{
-					All: true,
-				},
+			globalNotification: newGlobalNotification("bob-2,alice-3,carol-1", &notificationsv1.GlobalNotificationSpec{
+				Matcher: &notificationsv1.GlobalNotificationSpec_All{All: true},
 			}),
 		},
+
+		// A notification targeted to users with specific permissions (create tokens)
 		{
-			userNotification: newUserNotification(t, managerUsername, "manager-3"),
-		},
-		{
-			// Matcher matches by read & write permission on nodes.
-			globalNotification: newGlobalNotification(t, "auditor-6", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("carol-2", &notificationsv1.GlobalNotificationSpec{
 				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
 					ByPermissions: &notificationsv1.ByPermissions{
 						RoleConditions: []*types.RoleConditions{
 							{
 								Rules: []types.Rule{
 									{
-										Resources: []string{types.KindNode},
-										Verbs:     services.RW(),
+										Resources: []string{types.KindToken},
+										Verbs:     []string{types.VerbCreate},
 									},
 								},
 							},
@@ -167,220 +145,188 @@ func TestNotifications(t *testing.T) {
 				},
 			}),
 		},
+
+		// A notification targeted to users who can review certain access requests
 		{
-			// Matcher matches by the logins "auditor" and "user". Auditor has both of them, but manager only has "user", since we set MatchAllConditions to true, only auditor
-			// should get this notification.
-			globalNotification: newGlobalNotification(t, "auditor-7", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("alice-4", &notificationsv1.GlobalNotificationSpec{
 				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
 					ByPermissions: &notificationsv1.ByPermissions{
 						RoleConditions: []*types.RoleConditions{
 							{
-								Logins: []string{"auditor"},
-							},
-							{
-								Logins: []string{"user"},
+								ReviewRequests: &types.AccessReviewConditions{
+									Roles: []string{"intern"},
+								},
 							},
 						},
 					},
 				},
-				MatchAllConditions: true,
 			}),
 		},
+
+		// A notification for multiple users (by username)
+		{
+			globalNotification: newGlobalNotification("alice-5,bob-3", &notificationsv1.GlobalNotificationSpec{
+				Matcher: &notificationsv1.GlobalNotificationSpec_ByUsers{
+					ByUsers: &notificationsv1.ByUsers{
+						Users: []string{"alice", "bob"},
+					},
+				},
+			}),
+		},
+
+		// Multiple matchers - logical OR
 		{
-			// Matcher matches by permission to review access requests for "intern"
-			globalNotification: newGlobalNotification(t, "manager-4", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("alice-6,carol-3", &notificationsv1.GlobalNotificationSpec{
+				MatchAllConditions: false, // logical OR
 				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
 					ByPermissions: &notificationsv1.ByPermissions{
 						RoleConditions: []*types.RoleConditions{
 							{
-								ReviewRequests: &types.AccessReviewConditions{
-									Roles: []string{"intern"},
-								},
+								Logins: []string{"user"},
+							},
+							{
+								Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
 							},
 						},
 					},
 				},
 			}),
 		},
+
+		// Multiple matchers - logical AND
 		{
-			userNotification: newUserNotification(t, managerUsername, "manager-5"),
-		},
-		{
-			// Matcher matches by the logins "auditor" and "user". Both of them have "user" and MatchAllConditions is false, so both should get this notification.
-			globalNotification: newGlobalNotification(t, "auditor-8,manager-6", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("nomatches", &notificationsv1.GlobalNotificationSpec{
+				MatchAllConditions: true, // logical AND
 				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
 					ByPermissions: &notificationsv1.ByPermissions{
 						RoleConditions: []*types.RoleConditions{
 							{
-								Logins: []string{"auditor"},
+								Logins: []string{"user"},
 							},
 							{
-								Logins: []string{"user"},
+								Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
 							},
 						},
 					},
 				},
 			}),
 		},
+
+		// A notification for everyone but alice.
 		{
-			userNotification: &notificationsv1.Notification{
-				SubKind: "test-subkind",
-				Spec: &notificationsv1.NotificationSpec{
-					Username: managerUsername,
-				},
-				Metadata: &headerv1.Metadata{
-					Labels: map[string]string{
-						types.NotificationTitleLabel: "manager-7-expires",
-					},
-					// Expires in 15 minutes.
-					Expires: timestamppb.New(fakeClock.Now().Add(15 * time.Minute)),
-				},
-			},
+			globalNotification: newGlobalNotification("bob-4,carol-4", &notificationsv1.GlobalNotificationSpec{
+				Matcher:      &notificationsv1.GlobalNotificationSpec_All{All: true},
+				ExcludeUsers: []string{"alice"},
+			}),
 		},
+
+		// Multiple logins in a single rule. The notification goes to all users who
+		// have at least one of the logins mentioned here.
 		{
-			globalNotification: &notificationsv1.GlobalNotification{
-				Spec: &notificationsv1.GlobalNotificationSpec{
-					Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-						ByPermissions: &notificationsv1.ByPermissions{
-							RoleConditions: []*types.RoleConditions{
-								{
-									ReviewRequests: &types.AccessReviewConditions{
-										Roles: []string{"intern"},
-									},
-								},
-							},
-						},
-					},
-					Notification: &notificationsv1.Notification{
-						SubKind: "test-subkind",
-						Spec:    &notificationsv1.NotificationSpec{},
-						Metadata: &headerv1.Metadata{
-							Labels: map[string]string{
-								types.NotificationTitleLabel: "manager-8-expires",
+			globalNotification: newGlobalNotification("alice-7", &notificationsv1.GlobalNotificationSpec{
+				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
+					ByPermissions: &notificationsv1.ByPermissions{
+						RoleConditions: []*types.RoleConditions{
+							{
+								Logins: []string{"user", "fakeuser1", "fakeuser2"},
 							},
-							// Expires in 10 minutes.
-							Expires: timestamppb.New(fakeClock.Now().Add(10 * time.Minute)),
 						},
 					},
 				},
-			},
-		},
-		{
-			// Matcher matches by usernames.
-			globalNotification: newGlobalNotification(t, "auditor-9,manager-9", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByUsers{
-					ByUsers: &notificationsv1.ByUsers{
-						Users: []string{auditorUsername, managerUsername},
-					},
-				},
 			}),
 		},
 	}
 
-	notificationIdMap := map[string]string{}
-
-	// Create the notifications.
-	for _, n := range testNotifications {
-		// We add a small delay to ensure that the timestamps in the generated UUID's are all different and in the correct order.
-		// This is to prevent flakiness caused by the notifications being created in such quick succession that the timestamps are the same.
-		fakeClock.Advance(50 * time.Millisecond)
-		time.Sleep(50 * time.Millisecond)
-		// Create the notification in the backend.
-		if n.globalNotification != nil {
-			created, err := srv.Auth().CreateGlobalNotification(ctx, n.globalNotification)
-			notificationIdMap[created.GetSpec().GetNotification().GetMetadata().GetLabels()[types.NotificationTitleLabel]] = created.GetMetadata().GetName()
-			require.NoError(t, err)
-			continue
+	synctest.Test(t, func(t *testing.T) {
+		for _, n := range testNotifications {
+			if n.globalNotification != nil {
+				_, err := srv.Auth().CreateGlobalNotification(t.Context(), n.globalNotification)
+				require.NoError(t, err)
+			}
+			if n.userNotification != nil {
+				_, err := srv.Auth().CreateUserNotification(t.Context(), n.userNotification)
+				require.NoError(t, err)
+			}
+
+			// The "name" of the notification resource is a UUIDv7 based on the creation time.
+			// Sleep between each upsert so that the notifications all have different timestamps.
+			time.Sleep(1 * time.Minute)
 		}
-		created, err := srv.Auth().CreateUserNotification(ctx, n.userNotification)
-		notificationIdMap[created.GetMetadata().GetLabels()[types.NotificationTitleLabel]] = created.GetMetadata().GetName()
-		require.NoError(t, err)
-	}
+	})
 
-	// Test fetching notifications for auditor.
-	auditorClient, err := srv.NewClient(TestUser(auditorUsername))
-	require.NoError(t, err)
-	defer auditorClient.Close()
+	for _, test := range []struct {
+		username string
+		count    int
+	}{
+		{"bob", 4},
+		{"alice", 7},
+		{"carol", 4},
+	} {
+		t.Run(test.username, func(t *testing.T) {
+			client, err := srv.NewClient(authtest.TestUser(test.username))
+			require.NoError(t, err)
+			t.Cleanup(func() { client.Close() })
 
-	auditorExpectedNotifications := []string{"auditor-9,manager-9", "auditor-8,manager-6", "auditor-7", "auditor-6", "auditor-5,manager-2", "auditor-4", "auditor-3", "auditor-2", "auditor-1"}
+			resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 100})
+			require.NoError(t, err)
 
-	var finalOut []*notificationsv1.Notification
+			titles := notificationTitles(resp.Notifications)
+			assert.Len(t, titles, test.count)
 
-	// Upsert auditor's last seen timestamp.
-	lastSeenTimestamp := timestamppb.New(time.Date(2024, 1, 1, 12, 0, 0, 0, time.UTC))
-	_, err = auditorClient.UpsertUserLastSeenNotification(ctx, auditorUsername, &notificationsv1.UserLastSeenNotification{
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
-			LastSeenTime: lastSeenTimestamp,
-		},
-	})
-	require.NoError(t, err)
+			for _, title := range titles {
+				assert.Contains(t, title, test.username)
+			}
+		})
+	}
+}
 
-	// Fetch a page of 3 notifications.
-	resp, err := auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 3,
-	})
-	require.NoError(t, err)
-	require.Equal(t, auditorExpectedNotifications[:3], notificationsToTitlesList(t, resp.Notifications))
-	finalOut = append(finalOut, resp.Notifications...)
-
-	// Verify that the nextKeys are correct.
-	expectedUserNotifsNextKey := notificationIdMap["auditor-4"]
-	expectedGlobalNotifsNextKey := notificationIdMap["auditor-6"]
-	expectedNextKeys := fmt.Sprintf("%s,%s",
-		expectedUserNotifsNextKey,
-		expectedGlobalNotifsNextKey) // "<auditor-4 notification id>,<auditor-6 notification id>"
-
-	require.Equal(t, expectedNextKeys, resp.NextPageToken)
-	require.Equal(t, lastSeenTimestamp.GetSeconds(), resp.UserLastSeenNotificationTimestamp.GetSeconds())
-
-	// Fetch the next 4 notifications, starting from the previously received startKeys.
-	// After this fetch, there should be no more global notifications for auditor, so the next page token
-	// for global notifications should be "".
-	resp, err = auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize:  4,
-		PageToken: resp.NextPageToken,
-	})
+func TestNotificationStates(t *testing.T) {
+	t.Parallel()
+
+	srv := mockAuth(t)
+
+	bob, _, err := authtest.CreateUserAndRole(srv.Auth(), "bob", []string{"bob"}, nil /* allowRules */)
 	require.NoError(t, err)
-	expectedNextKeys = fmt.Sprintf("%s,", notificationIdMap["auditor-2"])
 
-	require.Equal(t, expectedNextKeys, resp.NextPageToken)
-	finalOut = append(finalOut, resp.Notifications...)
+	var created []*notificationsv1.Notification
+	synctest.Test(t, func(t *testing.T) {
+		for i := range 4 {
+			n, err := srv.Auth().CreateUserNotification(t.Context(), newUserNotification(bob.GetName(), fmt.Sprintf("notification-%d", i)))
+			require.NoError(t, err)
 
-	// Fetch a page of 1 notification, starting from the previously received startKeys.
-	resp, err = auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize:  1,
-		PageToken: resp.NextPageToken,
+			created = append(created, n)
+
+			// The "name" of the notification resource is a UUIDv7 based on the creation time.
+			// Sleep between each upsert so that the notifications all have different timestamps.
+			time.Sleep(10 * time.Minute)
+		}
 	})
+
+	client, err := srv.NewClient(authtest.TestUser(bob.GetName()))
 	require.NoError(t, err)
-	expectedNextKeys = fmt.Sprintf("%s,", notificationIdMap["auditor-1"])
-	require.Equal(t, expectedNextKeys, resp.NextPageToken)
-	finalOut = append(finalOut, resp.Notifications...)
-
-	// Fetch the rest of the notifications, starting from the previously received startKeys.
-	resp, err = auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize:  10,
-		PageToken: resp.NextPageToken,
+	t.Cleanup(func() { client.Close() })
+
+	// Update bob's last seen timestamp, which should make the bob-0 notification go away.
+	_, err = client.UpsertUserLastSeenNotification(t.Context(), "bob", &notificationsv1.UserLastSeenNotification{
+		Status: &notificationsv1.UserLastSeenNotificationStatus{
+			LastSeenTime: created[0].GetSpec().GetCreated(),
+		},
 	})
 	require.NoError(t, err)
-	finalOut = append(finalOut, resp.Notifications...)
-	// Verify that all the notifications are in the list and in correct order.
-	require.Equal(t, auditorExpectedNotifications, notificationsToTitlesList(t, finalOut))
-	// Verify that we've reached the end of both lists.
-	require.Empty(t, resp.NextPageToken)
-
-	// Mark "auditor-2" and "auditor-5,manager-2" as dismissed.
-	_, err = auditorClient.UpsertUserNotificationState(ctx, auditorUsername, &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
-			NotificationId: notificationIdMap["auditor-2"],
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
-			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED,
+
+	// RBAC check - bob should not be able to set last seen time for other users.
+	_, err = client.UpsertUserLastSeenNotification(t.Context(), "alice", &notificationsv1.UserLastSeenNotification{
+		Status: &notificationsv1.UserLastSeenNotificationStatus{
+			LastSeenTime: created[0].GetSpec().GetCreated(),
 		},
 	})
-	require.NoError(t, err)
-	_, err = auditorClient.UpsertUserNotificationState(ctx, auditorUsername, &notificationsv1.UserNotificationState{
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err))
+
+	// Mark notification-1 as dismissed, so it stops showing up.
+	_, err = client.UpsertUserNotificationState(t.Context(), "bob", &notificationsv1.UserNotificationState{
 		Spec: &notificationsv1.UserNotificationStateSpec{
-			NotificationId: notificationIdMap["auditor-5,manager-2"],
+			NotificationId: created[1].GetMetadata().GetName(),
 		},
 		Status: &notificationsv1.UserNotificationStateStatus{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED,
@@ -388,34 +334,10 @@ func TestNotifications(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	// Fetch notifications again and verify that the dismissed notifications are not returned.
-	resp, err = auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 10,
-	})
-	auditorExpectedNotifsAfterDismissal := []string{"auditor-9,manager-9", "auditor-8,manager-6", "auditor-7", "auditor-6", "auditor-4", "auditor-3", "auditor-1"}
-	require.NoError(t, err)
-	require.Equal(t, auditorExpectedNotifsAfterDismissal, notificationsToTitlesList(t, resp.Notifications))
-
-	// Test fetching notifications for manager.
-	managerClient, err := srv.NewClient(TestUser(managerUsername))
-	require.NoError(t, err)
-	defer managerClient.Close()
-
-	managerExpectedNotifications := []string{"auditor-9,manager-9", "manager-8-expires", "manager-7-expires", "auditor-8,manager-6", "manager-5", "manager-4", "manager-3", "auditor-5,manager-2", "manager-1"}
-
-	resp, err = managerClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 10,
-	})
-	require.NoError(t, err)
-
-	require.Equal(t, managerExpectedNotifications, notificationsToTitlesList(t, resp.Notifications))
-	// Verify that we've reached the end of both lists.
-	require.Empty(t, resp.NextPageToken)
-
-	// Mark "manager-8-expires" as clicked.
-	_, err = managerClient.UpsertUserNotificationState(ctx, managerUsername, &notificationsv1.UserNotificationState{
+	// Mark notification-2 as clicked. It will still show up.
+	_, err = client.UpsertUserNotificationState(t.Context(), "bob", &notificationsv1.UserNotificationState{
 		Spec: &notificationsv1.UserNotificationStateSpec{
-			NotificationId: notificationIdMap["manager-8-expires"],
+			NotificationId: created[2].GetMetadata().GetName(),
 		},
 		Status: &notificationsv1.UserNotificationStateStatus{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
@@ -423,84 +345,86 @@ func TestNotifications(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	// Fetch notifications again and expect it to have the clicked label.
-	resp, err = managerClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 10,
-	})
+	resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 10})
 	require.NoError(t, err)
 
-	clickedNotification := resp.Notifications[1] // "manager-8-expires" is the second item in the list
-	clickedLabelValue := clickedNotification.GetMetadata().GetLabels()[types.NotificationClickedLabel]
-	require.Equal(t, "true", clickedLabelValue)
+	require.Len(t, resp.Notifications, 3)
+	require.Equal(t, []string{"notification-3", "notification-2", "notification-0"}, notificationTitles(resp.Notifications))
 
-	// Advance 11 minutes.
-	fakeClock.Advance(11 * time.Minute)
+	require.Empty(t, resp.Notifications[0].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+	require.Equal(t, "true", resp.Notifications[1].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+	require.Empty(t, resp.Notifications[2].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+}
 
-	// Verify that notification "manager-8-expires" is now no longer returned.
-	resp, err = managerClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
-	require.NoError(t, err)
-	require.NotContains(t, notificationsToTitlesList(t, resp.Notifications), "manager-8-expires")
+func TestNotificationPagination(t *testing.T) {
+	t.Parallel()
 
-	// Advance 16 minutes.
-	fakeClock.Advance(16 * time.Minute)
+	srv := mockAuth(t)
 
-	// Verify that notification "manager-7-expires" is now no longer returned either.
-	resp, err = managerClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
+	bob, _, err := authtest.CreateUserAndRole(srv.Auth(), "bob", []string{"bob"}, nil /* allowRules */)
 	require.NoError(t, err)
-	require.NotContains(t, notificationsToTitlesList(t, resp.Notifications), "manager-7-expires")
 
-	// Verify that manager can't upsert a notification state for auditor
-	_, err = managerClient.UpsertUserNotificationState(ctx, auditorUsername, &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
-			NotificationId: notificationIdMap["auditor-7"],
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
-			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED,
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsAccessDenied(err), "got error %T, expected an access denied error due to manager trying to upsert a notification state for a different user", err)
+	synctest.Test(t, func(t *testing.T) {
+		for i := range 10 {
+			_, err = srv.Auth().CreateUserNotification(t.Context(), newUserNotification(bob.GetName(), fmt.Sprintf("notification-%d", i)))
+			require.NoError(t, err)
 
-	// Verify that manager can't uspert a user last seen notification for auditor.
-	_, err = managerClient.UpsertUserLastSeenNotification(ctx, auditorUsername, &notificationsv1.UserLastSeenNotification{
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
-			LastSeenTime: lastSeenTimestamp,
-		},
+			// The "name" of the notification resource is a UUIDv7 based on the creation time.
+			// Sleep between each upsert so that the notifications all have different timestamps.
+			time.Sleep(1 * time.Minute)
+		}
 	})
-	require.Error(t, err)
-	require.True(t, trace.IsAccessDenied(err), "got error %T, expected an access denied error due to manager trying to upsert a last seen notification timestamp for a different user", err)
 
-	// Verify that users can't list a global notification they are explicitly excluded from.
+	client, err := srv.NewClient(authtest.TestUser(bob.GetName()))
+	require.NoError(t, err)
+	t.Cleanup(func() { client.Close() })
 
-	// Create a global notification that matches all users with an exclusion for the manager.
-	_, err = srv.Auth().CreateGlobalNotification(ctx, newGlobalNotification(t, "all-except-manager", &notificationsv1.GlobalNotificationSpec{
-		Matcher: &notificationsv1.GlobalNotificationSpec_All{
-			All: true,
-		},
-		ExcludeUsers: []string{managerUsername},
-	}))
+	// List the notifications in a few batches with different page sizes.
+	var all []*notificationsv1.Notification
+	var token string
+
+	resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 3, PageToken: token})
 	require.NoError(t, err)
+	require.Len(t, resp.Notifications, 3)
+	all = append(all, resp.Notifications...)
+	token = resp.NextPageToken
 
-	// Verify that the manager doesn't see the new notification.
-	resp, err = managerClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 10,
-	})
+	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 4, PageToken: token})
 	require.NoError(t, err)
-	require.NotEqual(t, "all-except-manager", resp.Notifications[0].GetMetadata().GetLabels()[types.NotificationTitleLabel])
+	require.Len(t, resp.Notifications, 4)
+	all = append(all, resp.Notifications...)
+	token = resp.NextPageToken
 
-	// Verify that the auditor can see the new notification.
-	resp, err = auditorClient.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{
-		PageSize: 10,
-	})
+	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 1, PageToken: token})
 	require.NoError(t, err)
-	require.Equal(t, "all-except-manager", resp.Notifications[0].GetMetadata().GetLabels()[types.NotificationTitleLabel])
+	require.Len(t, resp.Notifications, 1)
+	all = append(all, resp.Notifications...)
+	token = resp.NextPageToken
 
-}
+	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 10, PageToken: token})
+	require.NoError(t, err)
+	require.Len(t, resp.Notifications, 2) // only 2 remaining
+	all = append(all, resp.Notifications...)
+
+	require.Len(t, all, 10)
+
+	var lastUUID string
+	for i, notification := range all {
+		// Listing returns the newest notifications first.
+		want := fmt.Sprintf("notification-%d", 10-1-i)
+		got := notification.GetMetadata().GetLabels()[types.NotificationTitleLabel]
+		require.Equal(t, want, got)
 
-func newUserNotification(t *testing.T, username string, title string) *notificationsv1.Notification {
-	t.Helper()
+		// We should be going "back in time" as we enumerate the list.
+		if lastUUID != "" {
+			require.Less(t, notification.GetMetadata().GetName(), lastUUID, notificationNames(all))
+		}
+		lastUUID = notification.GetMetadata().GetName()
+	}
+}
 
-	notification := notificationsv1.Notification{
+func newUserNotification(username string, title string) *notificationsv1.Notification {
+	return &notificationsv1.Notification{
 		SubKind: "test-subkind",
 		Spec: &notificationsv1.NotificationSpec{
 			Username: username,
@@ -511,13 +435,9 @@ func newUserNotification(t *testing.T, username string, title string) *notificat
 			},
 		},
 	}
-
-	return &notification
 }
 
-func newGlobalNotification(t *testing.T, title string, spec *notificationsv1.GlobalNotificationSpec) *notificationsv1.GlobalNotification {
-	t.Helper()
-
+func newGlobalNotification(title string, spec *notificationsv1.GlobalNotificationSpec) *notificationsv1.GlobalNotification {
 	spec.Notification = &notificationsv1.Notification{
 		SubKind: "test-subkind",
 		Spec:    &notificationsv1.NotificationSpec{},
@@ -528,23 +448,39 @@ func newGlobalNotification(t *testing.T, title string, spec *notificationsv1.Glo
 		},
 	}
 
-	notification := notificationsv1.GlobalNotification{
-		Spec: spec,
-	}
-
-	return &notification
+	return &notificationsv1.GlobalNotification{Spec: spec}
 }
 
-// notificationsToTitlesList accepts a list of notifications notifications and returns a slice of strings containing their titles in order, this is used to compare against
-// the expected outputs.
-func notificationsToTitlesList(t *testing.T, notifications []*notificationsv1.Notification) []string {
-	t.Helper()
-	var descriptions []string
+func mockAuth(t *testing.T) *authtest.TLSServer {
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		Dir:          t.TempDir(),
+		CacheEnabled: true,
+		AuditLog:     &eventstest.MockAuditLog{Emitter: new(eventstest.MockRecorderEmitter)},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
+
+	srv, err := authServer.NewTestTLSServer()
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srv.Close()) })
+
+	return srv
+}
 
-	for _, notif := range notifications {
-		description := notif.GetMetadata().GetLabels()[types.NotificationTitleLabel]
-		descriptions = append(descriptions, description)
+func notificationTitles(notifications []*notificationsv1.Notification) []string {
+	var titles []string
+	for _, n := range notifications {
+		title := n.GetMetadata().GetLabels()[types.NotificationTitleLabel]
+		titles = append(titles, title)
 	}
+	return titles
+}
 
-	return descriptions
+func notificationNames(notifications []*notificationsv1.Notification) []string {
+	var names []string
+	for _, n := range notifications {
+		name := n.GetMetadata().GetName()
+		names = append(names, name)
+	}
+	return names
 }
diff --git a/lib/auth/notifications/notificationsv1/service.go b/lib/auth/notifications/notificationsv1/service.go
index e890633f6bd6d..de0ddbcd7c425 100644
--- a/lib/auth/notifications/notificationsv1/service.go
+++ b/lib/auth/notifications/notificationsv1/service.go
@@ -170,7 +170,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 	if !found && req.PageToken != "" {
 		return nil, trace.BadParameter("invalid page token provided")
 	}
-	pageSize := int(req.PageSize)
+
 	userNotifsStream := stream.Slice[*notificationsv1.Notification](nil)
 	if userKey != "" || !found {
 		userNotifsStream = stream.FilterMap(
@@ -191,6 +191,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 				return n, true
 			})
 	}
+
 	globalNotifsStream := stream.Slice[*notificationsv1.GlobalNotification](nil)
 	if globalKey != "" || !found {
 		globalNotifsStream = stream.FilterMap(
@@ -211,6 +212,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 				return gn, true
 			})
 	}
+
 	notifStream := stream.MergeStreams(
 		userNotifsStream,
 		globalNotifsStream,
@@ -224,6 +226,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 			return notification
 		},
 	)
+
 	var notifications []*notificationsv1.Notification
 	var nextGlobalKey, nextUserKey string
 	for notifStream.Next() {
@@ -231,9 +234,10 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 		if item != nil {
 			notifications = append(notifications, item)
 		}
-		if len(notifications) == pageSize {
+		if len(notifications) == int(req.PageSize) {
 			// The nextKeys should represent the next unconsumed items in their respective lists.
-			// If the last item in this page (ie. the current item in the stream) was a user-specific notification, then the userNotificationsNextKey should be the next item in the userNotifsStream, and
+			// If the last item in this page (ie. the current item in the stream) was a user-specific notification,
+			// then the userNotificationsNextKey should be the next item in the userNotifsStream, and
 			// the globalNotificationsNextKey should be the current (and unconsumed) item in the globalNotifsStream. And vice-versa.
 			if item.GetMetadata().GetLabels()[types.NotificationScope] == "user" {
 				// If the provided globalKey was "", then return that as the nextGlobalKey again.
@@ -612,23 +616,23 @@ func (s *Service) DeleteUserNotification(ctx context.Context, req *notifications
 	return nil, trace.Wrap(err)
 }
 
-// listUserSpecificNotificationsForUser returns a paginated list of all user-specific notifications for a user. This should only be used by admins.
+// listUserSpecificNotificationsForUser returns a paginated list of all user-specific notifications for a user. This is a privileged operation requiring `list` access for `Notifications` and should only be used by cluster admins.
 func (s *Service) listUserSpecificNotificationsForUser(ctx context.Context, req *notificationsv1.ListNotificationsRequest) (*notificationsv1.ListNotificationsResponse, error) {
-	if req.GetFilters().GetUsername() == "" {
-		return nil, trace.BadParameter("missing username")
-	}
-
 	authCtx, err := s.authorizer.Authorize(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if !authz.HasBuiltinRole(*authCtx, string(types.RoleAdmin)) {
-		return nil, trace.AccessDenied("only RoleAdmin can list notifications for a specific user")
+	// If no username is provided, fetch notifications for the current user.
+	if req.GetFilters().GetUsername() == "" {
+		req.Filters.Username = authCtx.User.GetName()
 	}
 
-	if err := authCtx.CheckAccessToKind(types.KindNotification, types.VerbList); err != nil {
-		return nil, trace.Wrap(err)
+	// If the user is trying to fetch notifications for a different user, they need `list` permissions for `Notifications`.
+	if req.GetFilters().GetUsername() != authCtx.User.GetName() {
+		if err := authCtx.CheckAccessToKind(types.KindNotification, types.VerbList); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	stream := stream.FilterMap(
@@ -670,15 +674,15 @@ func (s *Service) listUserSpecificNotificationsForUser(ctx context.Context, req
 	}, nil
 }
 
-// listGlobalNotifications returns a paginated list of all global notifications. This should only be used by admins.
+// listGlobalNotifications returns a paginated list of all global notifications. This is a privileged operation requiring `list` access for `Notifications` and should only be used by cluster admins.
 func (s *Service) listGlobalNotifications(ctx context.Context, req *notificationsv1.ListNotificationsRequest) (*notificationsv1.ListNotificationsResponse, error) {
 	authCtx, err := s.authorizer.Authorize(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if !authz.HasBuiltinRole(*authCtx, string(types.RoleAdmin)) {
-		return nil, trace.AccessDenied("only RoleAdmin can list all global notifications")
+	if err := authCtx.CheckAccessToKind(types.KindNotification, types.VerbList); err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	stream := stream.FilterMap(
diff --git a/lib/auth/okta/auth.go b/lib/auth/okta/auth.go
index 558a992686662..c58a8f459d685 100644
--- a/lib/auth/okta/auth.go
+++ b/lib/auth/okta/auth.go
@@ -20,13 +20,14 @@ package okta
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/authz"
 	oktaplugin "github.com/gravitational/teleport/lib/okta/plugin"
-	"github.com/gravitational/teleport/lib/services"
 )
 
 // Okta-origin resources have some special access rules that are implemented in
@@ -99,7 +100,7 @@ func CheckAccess(authzCtx *authz.Context, existingResource types.ResourceWithLab
 
 // BidirectionalSyncEnabled checks if the bidirectional sync is enabled on the Okta plugin.  If the
 // Okta plugin does not exist the result is false.
-func BidirectionalSyncEnabled(ctx context.Context, plugins services.Plugins) (bool, error) {
+func BidirectionalSyncEnabled(ctx context.Context, plugins PluginGetter) (bool, error) {
 	plugin, err := oktaplugin.Get(ctx, plugins, false /* withSecrets */)
 	if trace.IsNotFound(err) {
 		return false, nil
@@ -109,12 +110,6 @@ func BidirectionalSyncEnabled(ctx context.Context, plugins services.Plugins) (bo
 	return plugin.Spec.GetOkta().GetSyncSettings().GetEnableBidirectionalSync(), nil
 }
 
-// AccessPoint provides services required by [CheckResourcesRequestable].
-type AccessPoint struct {
-	Plugins              services.Plugins
-	UnifiedResourceCache *services.UnifiedResourceCache
-}
-
 var (
 	// OktaResourceNotRequestableError means resources cannot be requested because Okta
 	// bidirectional sync is disabled.
@@ -130,8 +125,12 @@ var (
 //
 // If any resource is not requestable, [OktaResourceNotRequestableError] will be returned. Any
 // other error can be returned.
-func CheckResourcesRequestable(ctx context.Context, ids []types.ResourceID, ap AccessPoint) error {
-	bidirectionalSyncEnabled, err := BidirectionalSyncEnabled(ctx, ap.Plugins)
+func CheckResourcesRequestable(ctx context.Context, ids []types.ResourceID, auth AuthServer) error {
+	if len(ids) == 0 {
+		return nil
+	}
+
+	bidirectionalSyncEnabled, err := BidirectionalSyncEnabled(ctx, auth)
 	if err != nil {
 		return trace.Wrap(err, "getting bidirectional sync")
 	}
@@ -140,19 +139,30 @@ func CheckResourcesRequestable(ctx context.Context, ids []types.ResourceID, ap A
 	}
 
 	var denied []types.ResourceID
-	for app, err := range ap.UnifiedResourceCache.AppServers(ctx, services.UnifiedResourcesIterateParams{}) {
-		if err != nil {
-			return trace.Wrap(err, "iterating cached AppServers")
-		}
-		for _, id := range ids {
-			switch id.Kind {
-			case types.KindApp, types.KindAppServer:
+
+	for _, id := range ids {
+		switch id.Kind {
+		case types.KindAppServer, types.KindApp:
+			_, err := getOktaAppServer(ctx, auth, id.Name)
+			switch {
+			case trace.IsNotFound(err):
 				// ok
+			case err != nil:
+				return trace.Wrap(err, "getting app_server %q", id.Name)
 			default:
+				denied = append(denied, id)
 				continue
 			}
-			if app.GetName() == id.Name && app.Origin() == types.OriginOkta {
+		case types.KindUserGroup:
+			userGroup, err := auth.GetUserGroup(ctx, id.Name)
+			switch {
+			case trace.IsNotFound(err):
+				// ok
+			case err != nil:
+				return trace.Wrap(err, "getting user_group %q", id.Name)
+			case userGroup.Origin() == types.OriginOkta:
 				denied = append(denied, id)
+				continue
 			}
 		}
 	}
@@ -168,3 +178,29 @@ func CheckResourcesRequestable(ctx context.Context, ids []types.ResourceID, ap A
 
 	return trace.Wrap(OktaResourceNotRequestableError, "requested Okta resources: %s", resourcesStr)
 }
+
+func getOktaAppServer(ctx context.Context, auth AuthServer, name string) (types.AppServer, error) {
+	req := proto.ListResourcesRequest{
+		ResourceType: types.KindAppServer,
+		Limit:        1,
+		Labels: map[string]string{
+			types.OriginLabel: types.OriginOkta,
+		},
+		PredicateExpression: fmt.Sprintf(`name == %q`, name),
+	}
+
+	resp, err := auth.ListResources(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(resp.Resources) != 1 {
+		return nil, trace.NotFound("found %d resources when getting Okta-originated app_server %q", len(resp.Resources), name)
+	}
+
+	appServer, ok := resp.Resources[0].(types.AppServer)
+	if !ok {
+		return nil, trace.BadParameter("expected %T, found %T", appServer, resp.Resources[0])
+	}
+	return appServer, nil
+}
diff --git a/lib/auth/okta/interfaces.go b/lib/auth/okta/interfaces.go
new file mode 100644
index 0000000000000..421394253c39c
--- /dev/null
+++ b/lib/auth/okta/interfaces.go
@@ -0,0 +1,38 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package okta
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+)
+
+type PluginGetter interface {
+	GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error)
+}
+
+type AuthServer interface {
+	PluginGetter
+	// ListResources returns paginated resources depending on the resource type.
+	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
+	// GetUserGroup returns the specified user group resources.
+	GetUserGroup(ctx context.Context, name string) (types.UserGroup, error)
+}
diff --git a/lib/auth/password_test.go b/lib/auth/password_test.go
index 3306062fddff5..69982d3ec6970 100644
--- a/lib/auth/password_test.go
+++ b/lib/auth/password_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -26,6 +26,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/pquerna/otp/totp"
@@ -40,7 +41,9 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	wanpb "github.com/gravitational/teleport/api/types/webauthn"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
@@ -48,13 +51,12 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
 type passwordSuite struct {
 	bk          backend.Backend
-	a           *Server
+	a           *auth.Server
 	mockEmitter *eventstest.MockRecorderEmitter
 }
 
@@ -81,14 +83,15 @@ func setupPasswordSuite(t *testing.T) *passwordSuite {
 		s.bk.Close()
 	})
 
-	authConfig := &InitConfig{
+	authConfig := &auth.InitConfig{
 		ClusterName:            clusterName,
 		Backend:                s.bk,
-		VersionStorage:         NewFakeTeleportVersion(),
+		VersionStorage:         authtest.NewFakeTeleportVersion(),
 		Authority:              authority.New(),
 		SkipPeriodicOperations: true,
+		HostUUID:               uuid.NewString(),
 	}
-	s.a, err = NewServer(authConfig)
+	s.a, err = auth.NewServer(authConfig)
 	require.NoError(t, err)
 
 	err = s.a.SetClusterName(clusterName)
@@ -113,7 +116,7 @@ func setupPasswordSuite(t *testing.T) *passwordSuite {
 	require.NoError(t, err)
 
 	s.mockEmitter = &eventstest.MockRecorderEmitter{}
-	s.a.emitter = s.mockEmitter
+	s.a.SetEmitter(s.mockEmitter)
 	return &s
 }
 
@@ -125,7 +128,7 @@ func TestUserNotFound(t *testing.T) {
 	username := "unknown-user"
 	password := "feefiefoefum"
 
-	err := s.a.checkPasswordWOToken(ctx, username, []byte(password))
+	err := s.a.CheckPasswordWOToken(ctx, username, []byte(password))
 	require.Error(t, err)
 	// Make sure the error is not a NotFound. That would be a username oracle.
 	require.True(t, trace.IsBadParameter(err))
@@ -148,7 +151,7 @@ func TestPasswordLengthChange(t *testing.T) {
 
 	username := fmt.Sprintf("llama%v@goteleport.com", rand.Int())
 	password := []byte("a")
-	u, _, err := CreateUserAndRole(authServer, username, []string{username}, nil)
+	u, _, err := authtest.CreateUserAndRole(authServer, username, []string{username}, nil)
 	require.NoError(t, err)
 
 	hash, err := utils.BcryptFromPassword(password, bcrypt.DefaultCost)
@@ -160,7 +163,7 @@ func TestPasswordLengthChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Ensure that a shorter password still works for auth
-	err = authServer.checkPasswordWOToken(ctx, username, password)
+	err = authServer.CheckPasswordWOToken(ctx, username, password)
 	require.NoError(t, err)
 }
 
@@ -237,22 +240,22 @@ func TestServer_ChangePassword(t *testing.T) {
 	mfa := configureForMFA(t, srv)
 	username := mfa.User
 	password := mfa.Password
-	userClient, err := srv.NewClient(TestUser(username))
+	userClient, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	passwordlessDev, err := RegisterTestDevice(
+	passwordlessDev, err := authtest.RegisterTestDevice(
 		context.Background(),
 		userClient,
 		"passwordless-1",
 		proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
 		mfa.TOTPDev,
-		WithPasswordless())
+		authtest.WithPasswordless())
 	require.NoError(t, err)
 
 	tests := []struct {
 		name             string
 		oldPass          string
 		newPass          string
-		device           *TestDevice
+		device           *authtest.Device
 		challengeRequest *proto.CreateAuthenticateChallengeRequest
 	}{
 		{
@@ -358,7 +361,7 @@ func TestServer_ChangePassword(t *testing.T) {
 			require.NoError(t, userClient.ChangePassword(ctx, req), "changing password")
 
 			// Did the password change take effect?
-			require.NoError(t, authServer.checkPasswordWOToken(ctx, username, newPass), "password change didn't take effect")
+			require.NoError(t, authServer.CheckPasswordWOToken(ctx, username, newPass), "password change didn't take effect")
 		})
 	}
 }
@@ -381,7 +384,7 @@ func TestServer_ChangePassword_Fails(t *testing.T) {
 	tests := []struct {
 		name                     string
 		oldPass                  string
-		device                   *TestDevice
+		device                   *authtest.Device
 		challengeRequest         *proto.CreateAuthenticateChallengeRequest
 		createChallengeAssertion require.ErrorAssertionFunc
 	}{
@@ -455,7 +458,7 @@ func TestServer_ChangePassword_Fails(t *testing.T) {
 			newPass := []byte("capybarasarecool123")
 			oldPass := []byte(test.oldPass)
 
-			userClient, err := server.NewClient(TestUser(username))
+			userClient, err := server.NewClient(authtest.TestUser(username))
 			require.NoError(t, err)
 			defer userClient.Close()
 
@@ -487,7 +490,7 @@ func TestServer_ChangePassword_Fails(t *testing.T) {
 				err, trace.Unwrap(err))
 
 			// Did the password change take effect?
-			assert.Error(t, authServer.checkPasswordWOToken(ctx, username, newPass), "password was changed")
+			assert.Error(t, authServer.CheckPasswordWOToken(ctx, username, newPass), "password was changed")
 		})
 	}
 }
@@ -542,7 +545,7 @@ func TestChangeUserAuthentication(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal, WithTestDeviceClock(clock))
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal, authtest.WithTestDeviceClock(clock))
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.ChangeUserAuthenticationRequest{
@@ -586,7 +589,7 @@ func TestChangeUserAuthentication(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.ChangeUserAuthenticationRequest{
@@ -628,7 +631,7 @@ func TestChangeUserAuthentication(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal, WithPasswordless())
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal, authtest.WithPasswordless())
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.ChangeUserAuthenticationRequest{
@@ -668,7 +671,7 @@ func TestChangeUserAuthentication(t *testing.T) {
 				})
 				require.NoError(t, err, "CreateRegisterChallenge")
 
-				_, registerSolved, err := NewTestDeviceFromChallenge(registerChal)
+				_, registerSolved, err := authtest.NewTestDeviceFromChallenge(registerChal)
 				require.NoError(t, err, "NewTestDeviceFromChallenge")
 
 				return &proto.ChangeUserAuthenticationRequest{
@@ -711,7 +714,7 @@ func TestChangeUserAuthentication(t *testing.T) {
 	for _, c := range tests {
 		t.Run(c.name, func(t *testing.T) {
 			username := fmt.Sprintf("llama%v@goteleport.com", rand.Int())
-			_, _, err := CreateUserAndRole(authServer, username, []string{username}, nil)
+			_, _, err := authtest.CreateUserAndRole(authServer, username, []string{username}, nil)
 			require.NoError(t, err)
 
 			c.setAuthPreference(t)
@@ -724,17 +727,17 @@ func TestChangeUserAuthentication(t *testing.T) {
 
 			if c.getInvalidReq != nil {
 				invalidReq := c.getInvalidReq(t, token)
-				_, err := authServer.changeUserAuthentication(ctx, invalidReq)
+				_, err := auth.ChangeUserAuthentication(ctx, authServer, invalidReq)
 				require.True(t, trace.IsBadParameter(err))
 			}
 
 			validReq := c.getReq(t, token)
-			_, err = authServer.changeUserAuthentication(ctx, validReq)
+			_, err = auth.ChangeUserAuthentication(ctx, authServer, validReq)
 			require.NoError(t, err)
 
 			// Test password is updated.
 			if len(validReq.NewPassword) != 0 {
-				err := authServer.checkPasswordWOToken(ctx, username, validReq.NewPassword)
+				err := authServer.CheckPasswordWOToken(ctx, username, validReq.NewPassword)
 				require.NoError(t, err)
 			}
 
@@ -773,7 +776,7 @@ func TestChangeUserAuthenticationWithErrors(t *testing.T) {
 	require.NoError(t, err)
 
 	username := "joe@example.com"
-	_, _, err = CreateUserAndRole(s.a, username, []string{username}, nil)
+	_, _, err = authtest.CreateUserAndRole(s.a, username, []string{username}, nil)
 	require.NoError(t, err)
 
 	token, err := s.a.CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
@@ -834,7 +837,7 @@ func TestChangeUserAuthenticationWithErrors(t *testing.T) {
 		authPreference, err = s.a.UpsertAuthPreference(ctx, authPreference)
 		require.NoError(t, err)
 
-		_, err = s.a.changeUserAuthentication(ctx, tc.req)
+		_, err = auth.ChangeUserAuthentication(ctx, s.a, tc.req)
 		require.Error(t, err, "test case %q", tc.desc)
 	}
 
@@ -842,14 +845,14 @@ func TestChangeUserAuthenticationWithErrors(t *testing.T) {
 	_, err = s.a.UpsertAuthPreference(ctx, authPreference)
 	require.NoError(t, err)
 
-	_, err = s.a.changeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
+	_, err = auth.ChangeUserAuthentication(ctx, s.a, &proto.ChangeUserAuthenticationRequest{
 		TokenID:     validTokenID,
 		NewPassword: validPassword,
 	})
 	require.NoError(t, err)
 
 	// invite token cannot be reused
-	_, err = s.a.changeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
+	_, err = auth.ChangeUserAuthentication(ctx, s.a, &proto.ChangeUserAuthenticationRequest{
 		TokenID:     validTokenID,
 		NewPassword: validPassword,
 	})
@@ -860,7 +863,7 @@ func TestResetPassword(t *testing.T) {
 	t.Parallel()
 	s := setupPasswordSuite(t)
 
-	_, _, err := CreateUserAndRole(s.a, "dave", []string{"dave"}, nil)
+	_, _, err := authtest.CreateUserAndRole(s.a, "dave", []string{"dave"}, nil)
 	require.NoError(t, err)
 
 	// Using the Identity service makes it easier to set up the test case.
@@ -869,7 +872,7 @@ func TestResetPassword(t *testing.T) {
 
 	// Reset password.
 	ctx := context.Background()
-	err = s.a.resetPassword(ctx, "dave")
+	err = s.a.ResetPassword(ctx, "dave")
 	require.NoError(t, err)
 
 	// Make sure that the password has been reset.
@@ -880,7 +883,7 @@ func TestResetPassword(t *testing.T) {
 
 	// Make sure that we can reset once again (i.e. we don't complain if there's
 	// no password).
-	err = s.a.resetPassword(ctx, "dave")
+	err = s.a.ResetPassword(ctx, "dave")
 	require.NoError(t, err)
 }
 
@@ -906,12 +909,12 @@ func (s *passwordSuite) prepareForPasswordChange(user string, pass []byte, secon
 		OldPassword: pass,
 	}
 
-	err := s.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.UserCA, "me.localhost"))
+	err := s.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.UserCA, "me.localhost"))
 	if err != nil {
 		return req, err
 	}
 
-	err = s.a.UpsertCertAuthority(ctx, suite.NewTestCA(types.HostCA, "me.localhost"))
+	err = s.a.UpsertCertAuthority(ctx, authtest.NewTestCA(types.HostCA, "me.localhost"))
 	if err != nil {
 		return req, err
 	}
@@ -929,7 +932,7 @@ func (s *passwordSuite) prepareForPasswordChange(user string, pass []byte, secon
 		return req, err
 	}
 
-	_, _, err = CreateUserAndRole(s.a, user, []string{user}, nil)
+	_, _, err = authtest.CreateUserAndRole(s.a, user, []string{user}, nil)
 	if err != nil {
 		return req, err
 	}
diff --git a/lib/auth/periodic.go b/lib/auth/periodic.go
index 81549c26125c2..c96d4dc782fe3 100644
--- a/lib/auth/periodic.go
+++ b/lib/auth/periodic.go
@@ -111,6 +111,8 @@ type instanceMetricsPeriodic struct {
 
 // instanceMetadata contains instance metadata to be exported.
 type instanceMetadata struct {
+	// os is instance Operating System.
+	os string
 	// version specifies the version of the Teleport instance
 	version string
 	// installMethod specifies the Teleport agent installation method
@@ -119,6 +121,8 @@ type instanceMetadata struct {
 	upgraderType string
 	// upgraderVersion specifies the upgrader version
 	upgraderVersion string
+	// upgraderStatus is status from the upgrader.
+	upgraderStatus string
 }
 
 func newInstanceMetricsPeriodic() *instanceMetricsPeriodic {
@@ -136,16 +140,23 @@ func (i *instanceMetricsPeriodic) VisitInstance(instance *proto.UpstreamInventor
 		installMethod = strings.Join(installMethods, ",")
 	}
 
+	var upgraderStatus string
+	if instance.GetUpdaterInfo() != nil {
+		upgraderStatus = instance.GetUpdaterInfo().UpdaterStatus.String()
+	}
 	iMetadata := instanceMetadata{
+		os:              metadata.GetOS(),
 		version:         instance.GetVersion(),
 		installMethod:   installMethod,
 		upgraderType:    instance.GetExternalUpgrader(),
 		upgraderVersion: instance.GetExternalUpgraderVersion(),
+		upgraderStatus:  upgraderStatus,
 	}
 	i.metadata = append(i.metadata, iMetadata)
 }
 
 type registeredAgent struct {
+	os               string
 	version          string
 	automaticUpdates string
 }
@@ -160,6 +171,7 @@ func (i *instanceMetricsPeriodic) RegisteredAgentsCount() map[registeredAgent]in
 		}
 
 		agent := registeredAgent{
+			os:               metadata.os,
 			version:          metadata.version,
 			automaticUpdates: automaticUpdates,
 		}
@@ -180,6 +192,7 @@ func (i *instanceMetricsPeriodic) InstallMethodCounts() map[string]int {
 type upgrader struct {
 	upgraderType string
 	version      string
+	status       string
 }
 
 // UpgraderCounts returns the count for the different upgrader version and type combinations.
@@ -194,6 +207,7 @@ func (i *instanceMetricsPeriodic) UpgraderCounts() map[upgrader]int {
 		upgrader := upgrader{
 			upgraderType: metadata.upgraderType,
 			version:      metadata.upgraderVersion,
+			status:       metadata.upgraderStatus,
 		}
 		result[upgrader]++
 	}
diff --git a/lib/auth/periodic_test.go b/lib/auth/periodic_test.go
index 77e14ff2e7502..41dda14baef9a 100644
--- a/lib/auth/periodic_test.go
+++ b/lib/auth/periodic_test.go
@@ -20,6 +20,7 @@ package auth
 
 import (
 	"fmt"
+	"runtime"
 	"testing"
 
 	"github.com/google/uuid"
@@ -106,18 +107,26 @@ func TestUpgraderCounts(t *testing.T) {
 		{
 			desc: "mixed",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"},
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0"},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"},
+				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
+					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+				}},
+				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
+					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+				}},
+				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
+					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
+				}},
 				{},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0"},
+				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
+					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_PINNED,
+				}},
 				{},
 			},
 			expected: map[upgrader]int{
-				{"kube", "13.0.0"}: 1,
-				{"kube", "14.0.0"}: 1,
-				{"unit", "13.0.0"}: 1,
-				{"unit", "14.0.0"}: 1,
+				{"kube", "13.0.0", "UPDATER_STATUS_OK"}:     1,
+				{"kube", "14.0.0", "UPDATER_STATUS_OK"}:     1,
+				{"unit", "13.0.0", "UPDATER_STATUS_OK"}:     1,
+				{"unit", "14.0.0", "UPDATER_STATUS_PINNED"}: 1,
 			},
 		},
 		{
@@ -137,8 +146,8 @@ func TestUpgraderCounts(t *testing.T) {
 				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"},
 			},
 			expected: map[upgrader]int{
-				{"kube", "13.0.0"}: 2,
-				{"unit", "13.0.0"}: 2,
+				{"kube", "13.0.0", ""}: 2,
+				{"unit", "13.0.0", ""}: 2,
 			},
 		},
 		{
@@ -148,8 +157,8 @@ func TestUpgraderCounts(t *testing.T) {
 				{ExternalUpgrader: "unit"},
 			},
 			expected: map[upgrader]int{
-				{"kube", ""}: 1,
-				{"unit", ""}: 1,
+				{"kube", "", ""}: 1,
+				{"unit", "", ""}: 1,
 			},
 		},
 		{
@@ -246,9 +255,9 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 				{Version: "15.0.0"},
 			},
 			expected: map[registeredAgent]int{
-				{"13.0.0", "false"}: 1,
-				{"14.0.0", "false"}: 1,
-				{"15.0.0", "false"}: 1,
+				{runtime.GOOS, "13.0.0", "false"}: 1,
+				{runtime.GOOS, "14.0.0", "false"}: 1,
+				{runtime.GOOS, "15.0.0", "false"}: 1,
 			},
 		},
 		{
@@ -265,12 +274,12 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 				{Version: "15.0.0"},
 			},
 			expected: map[registeredAgent]int{
-				{"13.0.0", "true"}:  2,
-				{"13.0.0", "false"}: 1,
-				{"14.0.0", "true"}:  2,
-				{"14.0.0", "false"}: 1,
-				{"15.0.0", "true"}:  2,
-				{"15.0.0", "false"}: 1,
+				{runtime.GOOS, "13.0.0", "true"}:  2,
+				{runtime.GOOS, "13.0.0", "false"}: 1,
+				{runtime.GOOS, "14.0.0", "true"}:  2,
+				{runtime.GOOS, "14.0.0", "false"}: 1,
+				{runtime.GOOS, "15.0.0", "true"}:  2,
+				{runtime.GOOS, "15.0.0", "false"}: 1,
 			},
 		},
 	}
@@ -279,7 +288,9 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 			periodic := newInstanceMetricsPeriodic()
 
 			for _, instance := range tt.instance {
-				periodic.VisitInstance(instance, new(proto.UpstreamInventoryAgentMetadata))
+				periodic.VisitInstance(instance, &proto.UpstreamInventoryAgentMetadata{
+					OS: runtime.GOOS,
+				})
 			}
 			require.Equal(t, tt.expected, periodic.RegisteredAgentsCount(), "tt=%q", tt.desc)
 		})
diff --git a/lib/auth/presence/presencev1/service.go b/lib/auth/presence/presencev1/service.go
index f16b21913254b..68a56f19cb05a 100644
--- a/lib/auth/presence/presencev1/service.go
+++ b/lib/auth/presence/presencev1/service.go
@@ -46,10 +46,14 @@ type Backend interface {
 
 	UpsertReverseTunnel(ctx context.Context, tunnel types.ReverseTunnel) (types.ReverseTunnel, error)
 	DeleteReverseTunnel(ctx context.Context, tunnelName string) error
+
+	DeleteRelayServer(ctx context.Context, name string) error
 }
 
 type Cache interface {
 	ListReverseTunnels(ctx context.Context, pageSize int, nextToken string) ([]types.ReverseTunnel, string, error)
+	GetRelayServer(ctx context.Context, name string) (*presencepb.RelayServer, error)
+	ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencepb.RelayServer, nextPageToken string, _ error)
 }
 
 type AuthServer interface {
@@ -86,6 +90,8 @@ type Service struct {
 	clock      clockwork.Clock
 }
 
+var _ presencepb.PresenceServiceServer = (*Service)(nil)
+
 // NewService returns a new presence gRPC service.
 func NewService(cfg ServiceConfig) (*Service, error) {
 	switch {
@@ -413,3 +419,61 @@ func (s *Service) DeleteReverseTunnel(
 
 	return nil, trace.Wrap(s.backend.DeleteReverseTunnel(ctx, req.Name))
 }
+
+// GetRelayServer implements [presencepb.PresenceServiceServer].
+func (s *Service) GetRelayServer(ctx context.Context, req *presencepb.GetRelayServerRequest) (*presencepb.GetRelayServerResponse, error) {
+	actx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := actx.CheckAccessToKind(types.KindRelayServer, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	relayServer, err := s.cache.GetRelayServer(ctx, req.GetName())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &presencepb.GetRelayServerResponse{
+		RelayServer: relayServer,
+	}, nil
+}
+
+// ListRelayServers implements [presencepb.PresenceServiceServer].
+func (s *Service) ListRelayServers(ctx context.Context, req *presencepb.ListRelayServersRequest) (*presencepb.ListRelayServersResponse, error) {
+	actx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := actx.CheckAccessToKind(types.KindRelayServer, types.VerbList, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	relayServers, nextPageToken, err := s.cache.ListRelayServers(ctx, int(req.GetPageSize()), req.GetPageToken())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &presencepb.ListRelayServersResponse{
+		Relays:        relayServers,
+		NextPageToken: nextPageToken,
+	}, nil
+}
+
+// DeleteRelayServer implements [presencepb.PresenceServiceServer].
+func (s *Service) DeleteRelayServer(ctx context.Context, req *presencepb.DeleteRelayServerRequest) (*presencepb.DeleteRelayServerResponse, error) {
+	actx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := actx.CheckAccessToKind(types.KindRelayServer, types.VerbDelete); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.backend.DeleteRelayServer(ctx, req.GetName()); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &presencepb.DeleteRelayServerResponse{}, nil
+}
diff --git a/lib/auth/presence/presencev1/service_test.go b/lib/auth/presence/presencev1/service_test.go
index 13b61684efbc2..b50ee773ed136 100644
--- a/lib/auth/presence/presencev1/service_test.go
+++ b/lib/auth/presence/presencev1/service_test.go
@@ -40,16 +40,17 @@ import (
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/modules"
 )
 
-func newTestTLSServer(t testing.TB) *auth.TestTLSServer {
-	as, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+func newTestTLSServer(t testing.TB) *authtest.TLSServer {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 	srv, err := as.NewTestTLSServer()
 	require.NoError(t, err)
@@ -77,7 +78,7 @@ func TestGetRemoteCluster(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, role, err := auth.CreateUserAndRole(
+	user, role, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rc-getter",
 		[]string{},
@@ -97,7 +98,7 @@ func TestGetRemoteCluster(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	unprivilegedUser, unprivilegedRole, err := auth.CreateUserAndRole(
+	unprivilegedUser, unprivilegedRole, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -190,7 +191,7 @@ func TestGetRemoteCluster(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			rc, err := client.PresenceServiceClient().GetRemoteCluster(ctx, tt.req)
@@ -203,7 +204,7 @@ func TestGetRemoteCluster(t *testing.T) {
 	}
 
 	t.Run("doesnt exist and no permissions errors match", func(t *testing.T) {
-		client, err := srv.NewClient(auth.TestUser(user.GetName()))
+		client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 		require.NoError(t, err)
 
 		_, doesntExistError := client.PresenceServiceClient().GetRemoteCluster(ctx, &presencev1pb.GetRemoteClusterRequest{
@@ -229,7 +230,7 @@ func TestListRemoteClusters(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, role, err := auth.CreateUserAndRole(
+	user, role, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rc-getter",
 		[]string{},
@@ -249,7 +250,7 @@ func TestListRemoteClusters(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	unprivilegedUser, unprivilegedRole, err := auth.CreateUserAndRole(
+	unprivilegedUser, unprivilegedRole, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -319,7 +320,7 @@ func TestListRemoteClusters(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			res, err := client.PresenceServiceClient().ListRemoteClusters(ctx, tt.req)
@@ -345,7 +346,7 @@ func TestDeleteRemoteCluster(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, _, err := auth.CreateUserAndRole(
+	user, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rc-deleter",
 		[]string{},
@@ -357,7 +358,7 @@ func TestDeleteRemoteCluster(t *testing.T) {
 		})
 	require.NoError(t, err)
 
-	unprivilegedUser, _, err := auth.CreateUserAndRole(
+	unprivilegedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -409,7 +410,7 @@ func TestDeleteRemoteCluster(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			_, err = client.PresenceServiceClient().DeleteRemoteCluster(ctx, tt.req)
@@ -428,7 +429,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, _, err := auth.CreateUserAndRole(
+	user, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rc-updater",
 		[]string{},
@@ -440,7 +441,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		})
 	require.NoError(t, err)
 
-	unprivilegedUser, _, err := auth.CreateUserAndRole(
+	unprivilegedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -650,7 +651,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			got, err := client.PresenceServiceClient().UpdateRemoteCluster(ctx, tt.req)
@@ -677,7 +678,7 @@ func TestListReverseTunnels(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, role, err := auth.CreateUserAndRole(
+	user, role, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rc-getter",
 		[]string{},
@@ -691,7 +692,7 @@ func TestListReverseTunnels(t *testing.T) {
 	_, err = srv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	unprivilegedUser, unprivilegedRole, err := auth.CreateUserAndRole(
+	unprivilegedUser, unprivilegedRole, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -744,7 +745,7 @@ func TestListReverseTunnels(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			res, err := client.PresenceServiceClient().ListReverseTunnels(ctx, tt.req)
@@ -764,7 +765,7 @@ func TestListReverseTunnels(t *testing.T) {
 	}
 
 	t.Run("pagination", func(t *testing.T) {
-		client, err := srv.NewClient(auth.TestUser(user.GetName()))
+		client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 		require.NoError(t, err)
 
 		allGot := []*types.ReverseTunnelV2{}
@@ -801,7 +802,7 @@ func TestDeleteReverseTunnel(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, _, err := auth.CreateUserAndRole(
+	user, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rt-deleter",
 		[]string{},
@@ -812,7 +813,7 @@ func TestDeleteReverseTunnel(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	unprivilegedUser, _, err := auth.CreateUserAndRole(
+	unprivilegedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -864,7 +865,7 @@ func TestDeleteReverseTunnel(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			_, err = client.PresenceServiceClient().DeleteReverseTunnel(ctx, tt.req)
@@ -882,7 +883,7 @@ func TestUpsertReverseTunnel(t *testing.T) {
 	srv := newTestTLSServer(t)
 	ctx := context.Background()
 
-	user, _, err := auth.CreateUserAndRole(
+	user, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"rt-upserter",
 		[]string{},
@@ -893,7 +894,7 @@ func TestUpsertReverseTunnel(t *testing.T) {
 			},
 		})
 	require.NoError(t, err)
-	unprivilegedUser, _, err := auth.CreateUserAndRole(
+	unprivilegedUser, _, err := authtest.CreateUserAndRole(
 		srv.Auth(),
 		"no-perms",
 		[]string{},
@@ -956,7 +957,7 @@ func TestUpsertReverseTunnel(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			client, err := srv.NewClient(auth.TestUser(tt.user))
+			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
 			got, err := client.PresenceServiceClient().UpsertReverseTunnel(ctx, tt.req)
diff --git a/lib/auth/recording_authorizer.go b/lib/auth/recording_authorizer.go
new file mode 100644
index 0000000000000..fb457cbe8dcf7
--- /dev/null
+++ b/lib/auth/recording_authorizer.go
@@ -0,0 +1,60 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// NewSessionRecordingAuthorizer creates a new session recording authorizer.
+func NewSessionRecordingAuthorizer(authServer *Server, authorizer authz.Authorizer) *SessionRecordingAuthorizer {
+	return &SessionRecordingAuthorizer{
+		authServer: authServer,
+		authorizer: authorizer,
+	}
+}
+
+// SessionRecordingAuthorizer is a struct that implements the Authorizer interface
+// for session recordings. It uses the provided authServer and authorizer to
+// check if the user has permission to access a session recording.
+type SessionRecordingAuthorizer struct {
+	authServer *Server
+	authorizer authz.Authorizer
+}
+
+// Authorize checks if the user has permission to access the session recording.
+func (a *SessionRecordingAuthorizer) Authorize(ctx context.Context, sessionID string) error {
+	userCtx, err := a.authorizer.Authorize(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	serverWithRoles := &ServerWithRoles{
+		authServer: a.authServer,
+		alog:       a.authServer,
+		context:    *userCtx,
+	}
+
+	return trace.Wrap(serverWithRoles.actionForKindSession(ctx, session.ID(sessionID)))
+}
diff --git a/lib/auth/recording_authorizer_test.go b/lib/auth/recording_authorizer_test.go
new file mode 100644
index 0000000000000..d474df1242b1f
--- /dev/null
+++ b/lib/auth/recording_authorizer_test.go
@@ -0,0 +1,190 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth_test
+
+import (
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+func TestSessionRecordingAuthorized_RBAC(t *testing.T) {
+	t.Parallel()
+
+	srv := newTestTLSServerForRecording(t)
+	authServer := srv.AuthServer.AuthServer
+
+	session1 := createTestSession(t, authServer, "alice", []string{"alice", "bob"})
+	session2 := createTestSession(t, authServer, "bob", []string{"bob", "charlie"})
+
+	testCases := []struct {
+		name     string
+		username string
+		session1 bool // should have access to session1
+		session2 bool // should have access to session2
+	}{
+		{
+			name:     "alice has access to session1 only",
+			username: "alice",
+			session1: true,
+			session2: false,
+		},
+		{
+			name:     "bob has access to both sessions",
+			username: "bob",
+			session1: true,
+			session2: true,
+		},
+		{
+			name:     "charlie has access to session2 only",
+			username: "charlie",
+			session1: false,
+			session2: true,
+		},
+		{
+			name:     "dan has no access to any sessions",
+			username: "dan",
+			session1: false,
+			session2: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, role, err := authtest.CreateUserAndRole(
+				srv.Auth(),
+				tc.username,
+				[]string{},
+				[]types.Rule{
+					{
+						Resources: []string{types.KindSession},
+						Verbs:     []string{types.VerbRead},
+						Where:     "contains(session.participants, user.metadata.name)",
+					},
+				},
+			)
+			require.NoError(t, err)
+
+			localUser := authz.LocalUser{
+				Username: tc.username,
+				Identity: tlsca.Identity{
+					Username: tc.username,
+					Groups:   []string{role.GetName()},
+				},
+			}
+			authContext, err := authz.ContextForLocalUser(t.Context(), localUser, srv.Auth(), srv.ClusterName(), true /* disableDeviceAuthz */)
+			require.NoError(t, err)
+
+			authorizer := &mockAuthorizer{
+				ctx: authContext,
+			}
+			sessionAuth := auth.NewSessionRecordingAuthorizer(authServer, authorizer)
+
+			err = sessionAuth.Authorize(t.Context(), string(session1))
+			if tc.session1 {
+				require.NoError(t, err, "expected access to session1")
+			} else {
+				require.Error(t, err, "expected no access to session1")
+				assert.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
+			}
+
+			err = sessionAuth.Authorize(t.Context(), string(session2))
+			if tc.session2 {
+				require.NoError(t, err, "expected access to session2")
+			} else {
+				require.Error(t, err, "expected no access to session2")
+				assert.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
+			}
+		})
+	}
+}
+
+func newTestTLSServerForRecording(t testing.TB) *authtest.TLSServer {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		Dir: t.TempDir(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
+
+	srv, err := as.NewTestTLSServer()
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		err := srv.Close()
+		if errors.Is(err, net.ErrClosed) {
+			return
+		}
+		require.NoError(t, err)
+	})
+
+	return srv
+}
+
+func createTestSession(t *testing.T, authServer *auth.Server, user string, participants []string) session.ID {
+	id := session.NewID()
+
+	startTime := time.Date(2020, 3, 30, 15, 58, 54, 561*int(time.Millisecond), time.UTC)
+	endTime := startTime.Add(time.Minute)
+	endEvent := &apievents.SessionEnd{
+		Metadata: apievents.Metadata{
+			Index: 20,
+			Type:  events.SessionEndEvent,
+			ID:    string(id),
+			Code:  events.SessionEndCode,
+			Time:  endTime,
+		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerVersion:   teleport.Version,
+			ServerID:        "6a7c593d-345a-431f-9e21-4049be982fa5",
+			ServerNamespace: "default",
+			ServerLabels:    map[string]string{"env": "prod"},
+		},
+		SessionMetadata: apievents.SessionMetadata{
+			SessionID: string(id),
+		},
+		UserMetadata: apievents.UserMetadata{
+			User: user,
+		},
+		EnhancedRecording: true,
+		Interactive:       true,
+		Participants:      participants,
+		StartTime:         startTime,
+		EndTime:           endTime,
+	}
+
+	err := authServer.EmitAuditEvent(t.Context(), endEvent)
+	require.NoError(t, err)
+
+	return id
+}
diff --git a/lib/auth/recordingencryption/age.go b/lib/auth/recordingencryption/age.go
new file mode 100644
index 0000000000000..e8f71673f2e61
--- /dev/null
+++ b/lib/auth/recordingencryption/age.go
@@ -0,0 +1,146 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"io"
+
+	"filippo.io/age"
+	"github.com/gravitational/trace"
+)
+
+// RecordingStanza is the type used for the identifying stanza added by RecordingRecipient.
+const RecordingStanza = "teleport-recording-rsa4096"
+
+// UnwrapInput represents a request to decrypt a wrapped file key.
+type UnwrapInput struct {
+	// Fingerprint of the public key used to find the related private key.
+	Fingerprint string
+	// WrappedKey is the encrypted file key in an encrypted recording stanza.
+	WrappedKey []byte
+
+	// Rand reader to pass to use during decryption.
+	Rand io.Reader
+	// Opts that should be used during decryption.
+	Opts crypto.DecrypterOpts
+}
+
+// KeyUnwrapper returns an unwrapped file key given a wrapped key and a fingerprint of the encryption key.
+type KeyUnwrapper interface {
+	UnwrapKey(ctx context.Context, in UnwrapInput) ([]byte, error)
+}
+
+// RecordingIdentity unwraps file keys using the configured [KeyUnwrapper] and the recording stanzas
+// included in the age header.
+type RecordingIdentity struct {
+	ctx       context.Context
+	unwrapper KeyUnwrapper
+}
+
+// NewRecordingIdentity returns a new RecordingIdentity using the given [KeyUnwrapper]
+// file key unwrapping.
+func NewRecordingIdentity(ctx context.Context, unwrapper KeyUnwrapper) *RecordingIdentity {
+	return &RecordingIdentity{
+		ctx:       ctx,
+		unwrapper: unwrapper,
+	}
+}
+
+// Unwrap uses the additional stanzas added by [RecordingRecipient.Wrap] in order to find a matching RSA 4096
+// private key.
+func (i *RecordingIdentity) Unwrap(stanzas []*age.Stanza) ([]byte, error) {
+	var errs []error
+	for _, stanza := range stanzas {
+		if stanza.Type != RecordingStanza {
+			continue
+		}
+
+		if len(stanza.Args) != 1 {
+			continue
+		}
+
+		fileKey, err := i.unwrapper.UnwrapKey(i.ctx, UnwrapInput{
+			Rand:        rand.Reader,
+			WrappedKey:  stanza.Body,
+			Fingerprint: stanza.Args[0],
+			Opts: &rsa.OAEPOptions{
+				Hash: crypto.SHA256,
+			},
+		})
+		if err != nil {
+			if !trace.IsNotFound(err) {
+				errs = append(errs, err)
+			}
+			continue
+		}
+
+		return fileKey, nil
+	}
+
+	if len(errs) == 0 {
+		return nil, trace.Errorf("could not find an accessible decrypter for unwrapping")
+	}
+	return nil, trace.NewAggregate(errs...)
+}
+
+// RecordingRecipient wraps file keys using an RSA 40960public key.
+type RecordingRecipient struct {
+	*rsa.PublicKey
+}
+
+// ParseRecordingRecipient parses a PEM encoded RSA 4096 public key into a RecordingRecipient.
+func ParseRecordingRecipient(in []byte) (*RecordingRecipient, error) {
+	pubKey, err := x509.ParsePKIXPublicKey(in)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rsaKey, ok := pubKey.(*rsa.PublicKey)
+	if !ok {
+		return nil, trace.BadParameter("recording encryption key must be a public RSA 4096")
+	}
+
+	return &RecordingRecipient{PublicKey: rsaKey}, nil
+}
+
+// Wrap a fileKey using an RSA public key. The fingerprint of the key will be included in the stanza
+// to aid in fetching the correct private key during [Unwrap].
+func (r *RecordingRecipient) Wrap(fileKey []byte) ([]*age.Stanza, error) {
+	cipher, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, r.PublicKey, fileKey, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	fp, err := Fingerprint(r.PublicKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return []*age.Stanza{
+		{
+			Type: RecordingStanza,
+			Args: []string{fp},
+			Body: cipher,
+		},
+	}, nil
+}
diff --git a/lib/auth/recordingencryption/age_test.go b/lib/auth/recordingencryption/age_test.go
new file mode 100644
index 0000000000000..773e5c2324f96
--- /dev/null
+++ b/lib/auth/recordingencryption/age_test.go
@@ -0,0 +1,77 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption_test
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+)
+
+func TestRecordingAgePlugin(t *testing.T) {
+	ctx := t.Context()
+	keyStore := newFakeKeyStore(types.PrivateKeyType_RAW)
+	recordingIdentity := recordingencryption.NewRecordingIdentity(ctx, keyStore)
+
+	_, pubKey, err := keyStore.createKey()
+	require.NoError(t, err)
+
+	recipient, err := recordingencryption.ParseRecordingRecipient(pubKey)
+	require.NoError(t, err)
+
+	out := bytes.NewBuffer(nil)
+	writer, err := age.Encrypt(out, recipient)
+	require.NoError(t, err)
+
+	msg := []byte("testing age plugin for session recordings")
+	_, err = writer.Write(msg)
+	require.NoError(t, err)
+
+	// writer must be closed to ensure data is flushed
+	err = writer.Close()
+	require.NoError(t, err)
+
+	// decrypted text should match original msg
+	reader, err := age.Decrypt(out, recordingIdentity)
+	require.NoError(t, err)
+	plaintext, err := io.ReadAll(reader)
+	require.NoError(t, err)
+
+	require.Equal(t, msg, plaintext)
+
+	// running the same test with an unknown public key should fail
+	_, pubKey, err = keyStore.genKeys()
+	require.NoError(t, err)
+
+	recipient, err = recordingencryption.ParseRecordingRecipient(pubKey)
+	require.NoError(t, err)
+	out.Reset()
+	writer, err = age.Encrypt(out, recipient)
+	require.NoError(t, err)
+	_, err = writer.Write(msg)
+	require.NoError(t, err)
+	err = writer.Close()
+	require.NoError(t, err)
+	_, err = age.Decrypt(out, recordingIdentity)
+	require.Error(t, err)
+}
diff --git a/lib/auth/recordingencryption/buf_decrypter.go b/lib/auth/recordingencryption/buf_decrypter.go
new file mode 100644
index 0000000000000..7cbb6bf568501
--- /dev/null
+++ b/lib/auth/recordingencryption/buf_decrypter.go
@@ -0,0 +1,70 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption
+
+import (
+	"bytes"
+	"context"
+	"io"
+
+	"github.com/gravitational/trace"
+)
+
+// ageEncryptionPrefix is the prefix used to identify age-encrypted data.
+// age always uses "age-encryption.org/v1" as the prefix for its encrypted files.
+const ageEncryptionPrefix = "age-encryption.org"
+
+var ageEncryptionPrefixBytes = []byte(ageEncryptionPrefix)
+
+// Decrypter wraps an io.Reader with decryption if the data is age-encrypted.
+type Decrypter interface {
+	WithDecryption(ctx context.Context, reader io.Reader) (io.Reader, error)
+}
+
+// DecryptBufferIfEncrypted checks whether the provided buffer contains
+// age-encrypted data and decrypts it if necessary.
+//
+// The function looks for the standard age encryption header prefix to determine
+// whether the data is encrypted. If the buffer is not age-encrypted, it returns
+// the original data unchanged.
+//
+// If the buffer is encrypted, a Decrypter must be provided. The function uses
+// the Decrypter to read and decrypt the buffer, returning the plaintext bytes.
+// If no Decrypter is configured when encrypted data is detected, an error is
+// returned.
+func DecryptBufferIfEncrypted(ctx context.Context, buf []byte, decrypter Decrypter) ([]byte, error) {
+	if !bytes.HasPrefix(buf, ageEncryptionPrefixBytes) {
+		return buf, nil
+	}
+
+	if decrypter == nil {
+		return nil, trace.BadParameter("recording metadata decrypter is not configured")
+	}
+
+	decryptedReader, err := decrypter.WithDecryption(ctx, bytes.NewReader(buf))
+	if err != nil {
+		return nil, trace.Wrap(err, "decrypting recording metadata")
+	}
+
+	decryptedBuf := bytes.NewBuffer(make([]byte, 0, len(buf)))
+	_, err = io.Copy(decryptedBuf, decryptedReader)
+	if err != nil {
+		return nil, trace.Wrap(err, "reading decrypted recording metadata")
+	}
+
+	return decryptedBuf.Bytes(), nil
+}
diff --git a/lib/auth/recordingencryption/encryptedio.go b/lib/auth/recordingencryption/encryptedio.go
new file mode 100644
index 0000000000000..676e957246259
--- /dev/null
+++ b/lib/auth/recordingencryption/encryptedio.go
@@ -0,0 +1,147 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption
+
+import (
+	"context"
+	"io"
+
+	"filippo.io/age"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// SessionRecordingConfigGetter returns the types.SessionRecordingConfig used to determine if
+// encryption is enabled and retrieve the encryption keys to use
+type SessionRecordingConfigGetter interface {
+	GetSessionRecordingConfig(ctx context.Context) (types.SessionRecordingConfig, error)
+}
+
+// EncryptedIO wraps a SessionRecordingConfigGetter and a recordingencryption.DecryptionKeyFinder in order
+// to provide encryption and decryption wrapping backed by cluster resources
+type EncryptedIO struct {
+	srcGetter SessionRecordingConfigGetter
+	unwrapper KeyUnwrapper
+}
+
+// NewEncryptedIO returns an EncryptedIO configured with the given SessionRecordingConfigGetter and
+// recordingencryption.DecryptionKeyFinder
+func NewEncryptedIO(srcGetter SessionRecordingConfigGetter, unwrapper KeyUnwrapper) (*EncryptedIO, error) {
+	switch {
+	case srcGetter == nil:
+		return nil, trace.BadParameter("SessionRecordingConfigGetter is required for EncryptedIO")
+	case unwrapper == nil:
+		return nil, trace.BadParameter("DecryptionKeyFinder is required for EncryptedIO")
+	}
+	return &EncryptedIO{
+		srcGetter: srcGetter,
+		unwrapper: unwrapper,
+	}, nil
+}
+
+// WithEncryption wraps the given io.WriteCloser with encryption using the keys present in the
+// retrieved types.SessionRecordingConfig
+func (e *EncryptedIO) WithEncryption(ctx context.Context, writer io.WriteCloser) (io.WriteCloser, error) {
+	src, err := e.srcGetter.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	encrypter := NewEncryptionWrapper(src)
+	w, err := encrypter.WithEncryption(ctx, writer)
+	return w, trace.Wrap(err)
+}
+
+// WithDecryption wraps the given io.Reader with decryption using the recordingencryption.RecordingIdentity. This
+// will dynamically search for an accessible decryption key using the provided recordingencryption.DecryptionKeyFinder
+// in order to perform decryption
+func (e *EncryptedIO) WithDecryption(ctx context.Context, reader io.Reader) (io.Reader, error) {
+	ident := NewRecordingIdentity(ctx, e.unwrapper)
+	r, err := age.Decrypt(reader, ident)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return r, nil
+}
+
+// EncryptionWrapper provides a wrapper for recording data using the keys present in the given
+// types.SessionRecordingConfig
+type EncryptionWrapper struct {
+	config types.SessionRecordingConfig
+}
+
+// NewEncryptionWrapper returns a new EncryptionWrapper backed by the given types.SessionRecordingConfig
+func NewEncryptionWrapper(sessionRecordingConfig types.SessionRecordingConfig) *EncryptionWrapper {
+	return &EncryptionWrapper{
+		config: sessionRecordingConfig,
+	}
+}
+
+// ErrEncryptionDisabled signals that the [types.SessionRecordingConfig] does not enable encryption.
+var ErrEncryptionDisabled = &trace.BadParameterError{Message: "session_recording_config does not enable encryption"}
+
+// WithEncryption wraps the given io.WriteCloser with encryption using the keys present in the
+// configured types.SessionRecordingConfig
+func (s *EncryptionWrapper) WithEncryption(ctx context.Context, writer io.WriteCloser) (io.WriteCloser, error) {
+	if !s.config.GetEncrypted() {
+		return nil, trace.Wrap(ErrEncryptionDisabled)
+	}
+
+	var recipients []age.Recipient
+	for _, key := range s.config.GetEncryptionKeys() {
+		recipient, err := ParseRecordingRecipient(key.PublicKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		recipients = append(recipients, recipient)
+	}
+
+	return &ageWriter{
+		w:          writer,
+		recipients: recipients,
+	}, nil
+}
+
+// ageWriter defers initializing the age encrypter to the first write so we can
+// prevent age from immediately writing the header
+type ageWriter struct {
+	w           io.WriteCloser
+	recipients  []age.Recipient
+	initialized bool
+}
+
+// Write data using age encryption, initializing the encrypter if needed
+func (a *ageWriter) Write(data []byte) (int, error) {
+	if !a.initialized {
+		w, err := age.Encrypt(a.w, a.recipients...)
+		if err != nil {
+			return 0, trace.Wrap(err)
+		}
+		a.w = w
+		a.initialized = true
+	}
+
+	return a.w.Write(data)
+}
+
+// Close flushes any buffered encrypted data and closes the underlying io.WriteCloser
+func (a *ageWriter) Close() error {
+	return a.w.Close()
+}
diff --git a/lib/auth/recordingencryption/encryptedio_test.go b/lib/auth/recordingencryption/encryptedio_test.go
new file mode 100644
index 0000000000000..4498ef7f625b8
--- /dev/null
+++ b/lib/auth/recordingencryption/encryptedio_test.go
@@ -0,0 +1,130 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption_test
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+)
+
+func TestEncryptedIO(t *testing.T) {
+	ctx := t.Context()
+	keyStore := newFakeKeyStore(types.PrivateKeyType_RAW)
+	_, publicKey, err := keyStore.createKey()
+	require.NoError(t, err)
+
+	srcGetter, err := newFakeSRCGetter(true, []*types.AgeEncryptionKey{
+		{
+			PublicKey: publicKey,
+		},
+	})
+	require.NoError(t, err)
+
+	encryptedIO, err := recordingencryption.NewEncryptedIO(srcGetter, keyStore)
+	require.NoError(t, err)
+
+	out := bytes.NewBuffer(nil)
+	writer, err := encryptedIO.WithEncryption(ctx, &writeCloser{Writer: out})
+	require.NoError(t, err)
+
+	msg := []byte("testing encrypted IO")
+	_, err = writer.Write(msg)
+	require.NoError(t, err)
+
+	// writer must be closed to ensure data is flushed
+	err = writer.Close()
+	require.NoError(t, err)
+
+	encryptedBytes := out.Bytes()
+
+	reader, err := encryptedIO.WithDecryption(ctx, out)
+	require.NoError(t, err)
+
+	plaintext, err := io.ReadAll(reader)
+	require.NoError(t, err)
+
+	require.Equal(t, msg, plaintext)
+
+	// Test buffer decryption directly
+	decryptedBuf, err := recordingencryption.DecryptBufferIfEncrypted(ctx, encryptedBytes, encryptedIO)
+	require.NoError(t, err)
+	require.Equal(t, msg, decryptedBuf)
+
+	// creating an EncryptedIO without a SessionRecordingConfigGetter or keyfinder should be an error
+	_, err = recordingencryption.NewEncryptedIO(nil, nil)
+	require.Error(t, err)
+	_, err = recordingencryption.NewEncryptedIO(srcGetter, nil)
+	require.Error(t, err)
+
+	// wrapping encryption when encryption is disabled should return an ErrEncryptionDisabled
+	srcGetter, err = newFakeSRCGetter(false, nil)
+	require.NoError(t, err)
+	encryptedIO, err = recordingencryption.NewEncryptedIO(srcGetter, keyStore)
+	require.NoError(t, err)
+
+	_, err = encryptedIO.WithEncryption(ctx, &writeCloser{Writer: out})
+	require.ErrorIs(t, err, recordingencryption.ErrEncryptionDisabled)
+
+	// Decrypting an unencrypted buffer should return the original buffer
+	origBuf := []byte("this is not encrypted")
+	decryptedBuf, err = recordingencryption.DecryptBufferIfEncrypted(ctx, origBuf, encryptedIO)
+	require.NoError(t, err)
+	require.Equal(t, origBuf, decryptedBuf)
+}
+
+type fakeSRCGetter struct {
+	config types.SessionRecordingConfig
+}
+
+func newFakeSRCGetter(encrypted bool, keys []*types.AgeEncryptionKey) (*fakeSRCGetter, error) {
+	spec := types.SessionRecordingConfigSpecV2{
+		Encryption: &types.SessionRecordingEncryptionConfig{
+			Enabled: encrypted,
+		},
+	}
+
+	config, err := types.NewSessionRecordingConfigFromConfigFile(spec)
+	if err != nil {
+		return nil, err
+	}
+
+	config.SetEncryptionKeys(slices.Values(keys))
+
+	return &fakeSRCGetter{
+		config: config,
+	}, nil
+}
+
+func (f *fakeSRCGetter) GetSessionRecordingConfig(ctx context.Context) (types.SessionRecordingConfig, error) {
+	return f.config, nil
+}
+
+type writeCloser struct {
+	io.Writer
+}
+
+func (w *writeCloser) Close() error {
+	return nil
+}
diff --git a/lib/auth/recordingencryption/manager.go b/lib/auth/recordingencryption/manager.go
new file mode 100644
index 0000000000000..8121304868745
--- /dev/null
+++ b/lib/auth/recordingencryption/manager.go
@@ -0,0 +1,806 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption
+
+import (
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"iter"
+	"log/slog"
+	"slices"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// KeyStore provides methods for interacting with encryption keys.
+type KeyStore interface {
+	NewEncryptionKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.EncryptionKeyPair, error)
+	GetDecrypter(ctx context.Context, keyPair *types.EncryptionKeyPair) (crypto.Decrypter, error)
+	FindDecryptersByLabels(ctx context.Context, labels ...*types.KeyLabel) ([]crypto.Decrypter, error)
+}
+
+// A Cache fetches a cached [*recordingencryptionv1.RecordingEncryption].
+type Cache interface {
+	GetRecordingEncryption(context.Context) (*recordingencryptionv1.RecordingEncryption, error)
+}
+
+// ManagerConfig captures all of the dependencies required to instantiate a Manager.
+type ManagerConfig struct {
+	Backend                       services.RecordingEncryption
+	ClusterConfig                 services.ClusterConfigurationInternal
+	KeyStore                      KeyStore
+	Cache                         Cache
+	Logger                        *slog.Logger
+	LockConfig                    backend.RunWhileLockedConfig
+	ManualKeyManagementConfig     *types.ManualKeyManagementConfig
+	InitialSessionRecordingConfig types.SessionRecordingConfig
+}
+
+// NewManager returns a new Manager using the given [ManagerConfig].
+func NewManager(ctx context.Context, cfg ManagerConfig) (*Manager, error) {
+	switch {
+	case cfg.Backend == nil:
+		return nil, trace.BadParameter("backend is required")
+	case cfg.ClusterConfig == nil:
+		return nil, trace.BadParameter("cluster config is required")
+	case cfg.KeyStore == nil:
+		return nil, trace.BadParameter("key store is required")
+	case cfg.Cache == nil:
+		return nil, trace.BadParameter("cache is required")
+	}
+
+	if cfg.Logger == nil {
+		cfg.Logger = slog.With(teleport.ComponentKey, "recording-encryption-manager")
+	}
+
+	mgr := &Manager{
+		RecordingEncryption:          cfg.Backend,
+		ClusterConfigurationInternal: cfg.ClusterConfig,
+
+		ctx:             ctx,
+		cache:           cfg.Cache,
+		keyStore:        cfg.KeyStore,
+		lockConfig:      cfg.LockConfig,
+		logger:          cfg.Logger,
+		manualKeyConfig: cfg.ManualKeyManagementConfig,
+	}
+
+	if cfg.InitialSessionRecordingConfig != nil {
+		manualKeyCfg := getManualKeyManagement(cfg.InitialSessionRecordingConfig.GetEncryptionConfig())
+		if manualKeyCfg != nil {
+			if _, err := mgr.ensureManualEncryptionKeys(ctx, *manualKeyCfg); err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+	}
+
+	return mgr, nil
+}
+
+// A Manager wraps a services.RecordingEncryption and KeyStore in order to provide more complex operations
+// than the CRUD methods exposed by services.RecordingEncryption. It primarily handles resolving RecordingEncryption
+// state and searching for accessible decryption keys.
+type Manager struct {
+	services.RecordingEncryption
+	services.ClusterConfigurationInternal
+
+	ctx             context.Context
+	cache           Cache
+	keyStore        KeyStore
+	keyCache        utils.SyncMap[string, crypto.Decrypter]
+	lockConfig      backend.RunWhileLockedConfig
+	logger          *slog.Logger
+	manualKeyConfig *types.ManualKeyManagementConfig
+}
+
+// CreateSessionRecordingConfig creates a new session recording configuration. If encryption is enabled then an
+// accessible encryption key pair will be confirmed. Either creating one if none exists, doing nothing if one is
+// accessible, or returning an error if none are accessible.
+func (m *Manager) CreateSessionRecordingConfig(ctx context.Context, cfg types.SessionRecordingConfig) (types.SessionRecordingConfig, error) {
+	sessionRecordingConfig, err := m.modifySessionRecordingConfig(ctx, cfg, m.ClusterConfigurationInternal.CreateSessionRecordingConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return sessionRecordingConfig, trace.Wrap(err)
+}
+
+// UpdateSessionRecordingConfig updates an existing session recording configuration.  If encryption is enabled
+// then an accessible encryption key pair will be confirmed. Either creating one if none exists, doing nothing
+// if one is accessible, or returning an error if none are accessible.
+func (m *Manager) UpdateSessionRecordingConfig(ctx context.Context, cfg types.SessionRecordingConfig) (types.SessionRecordingConfig, error) {
+	sessionRecordingConfig, err := m.modifySessionRecordingConfig(ctx, cfg, m.ClusterConfigurationInternal.UpdateSessionRecordingConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return sessionRecordingConfig, trace.Wrap(err)
+}
+
+// UpsertSessionRecordingConfig creates a new session recording configuration or overwrites an existing one. If
+// encryption is enabled then an accessible encryption key pair will be confirmed. Either creating one if none
+// exists, doing nothing if one is accessible, or returning an error if none are accessible.
+func (m *Manager) UpsertSessionRecordingConfig(ctx context.Context, cfg types.SessionRecordingConfig) (types.SessionRecordingConfig, error) {
+	sessionRecordingConfig, err := m.modifySessionRecordingConfig(ctx, cfg, m.ClusterConfigurationInternal.UpsertSessionRecordingConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return sessionRecordingConfig, trace.Wrap(err)
+}
+
+// SetCache overwrites the configured Cache implementation. It should only be called if the `Manager` is not in use.
+func (m *Manager) SetCache(cache Cache) {
+	m.cache = cache
+}
+
+// fingerprintedDecrypter wraps a crypto.Decrypter with its public key fingerprint.
+type fingerprintedDecrypter struct {
+	fingerprint string
+	decrypter   crypto.Decrypter
+}
+
+// ensureManualEncryptionKeys searches for accessible encryption keys in the configured key store using the key labels
+// configured in the [ManualKeyManagementConfig]
+func (m *Manager) ensureManualEncryptionKeys(ctx context.Context, manualKeyCfg types.ManualKeyManagementConfig) (*recordingencryptionv1.RecordingEncryption, error) {
+	m.manualKeyConfig = &manualKeyCfg
+	activeLabels := manualKeyCfg.ActiveKeys
+	rotatedLabels := manualKeyCfg.RotatedKeys
+
+	// using the Manager's context here because we cache the resulting keys and want their lifetimes
+	// to be at least as long as the Manager
+	activeDecrypters, err := m.keyStore.FindDecryptersByLabels(ctx, activeLabels...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(activeDecrypters) == 0 {
+		return nil, trace.BadParameter("No accessible key found for manual_key_management.active_keys")
+	}
+
+	rotatedDecrypters, err := m.keyStore.FindDecryptersByLabels(ctx, rotatedLabels...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(rotatedDecrypters) == 0 && len(rotatedLabels) > 0 {
+		// Failure to retrieve rotated keys should only prevent replay of historical recordings
+		// related to those keys,  which isn't catastrophic in the way that missing active keys are.
+		// We should log the failure but otherwise press on.
+		m.logger.WarnContext(ctx, "No accessible rotated keys were found which may prevent replaying historical session recordings. Please ensure the Teleport Auth Service has access to the keystore and keys defined in manual_key_management.rotated_keys")
+	}
+
+	var fingerprinted []fingerprintedDecrypter
+	for _, decrypter := range slices.Concat(rotatedDecrypters, activeDecrypters) {
+		fp, err := Fingerprint(decrypter.Public())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		fingerprinted = append(fingerprinted, fingerprintedDecrypter{
+			fingerprint: fp,
+			decrypter:   decrypter,
+		})
+	}
+
+	m.keyCache.Write(func(cache map[string]crypto.Decrypter) {
+		for _, dec := range fingerprinted {
+			cache[dec.fingerprint] = dec.decrypter
+		}
+	})
+
+	var encryptionKeys []*recordingencryptionv1.KeyPair
+	for _, decrypter := range activeDecrypters {
+		pubKey, err := x509.MarshalPKIXPublicKey(decrypter.Public())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		encryptionKeys = append(encryptionKeys, &recordingencryptionv1.KeyPair{
+			KeyPair: &types.EncryptionKeyPair{
+				PublicKey: pubKey,
+			},
+		})
+	}
+	return &recordingencryptionv1.RecordingEncryption{
+		Spec: &recordingencryptionv1.RecordingEncryptionSpec{
+			ActiveKeyPairs: encryptionKeys,
+		},
+	}, nil
+}
+
+// ensureActiveKeyPair checks that there is at least one accessible key in the list of active pairs given.
+// If there are no active keys found, a new one will be provisioned and returned with the original set.
+// An active but inaccessible key results in an error.
+func (m *Manager) ensureActiveKeyPair(ctx context.Context, activePairs []*recordingencryptionv1.KeyPair) (newActivePairs []*recordingencryptionv1.KeyPair, keyGenerated bool, err error) {
+	var foundActiveKey bool
+	if len(activePairs) > 0 {
+		for _, pair := range activePairs {
+			if pair.State != recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+				continue
+			}
+
+			foundActiveKey = true
+			// fetch the decrypter to ensure we have access to it
+			if _, err := m.keyStore.GetDecrypter(ctx, pair.KeyPair); err != nil {
+				fp, _ := fingerprintPEM(pair.KeyPair.PublicKey)
+				m.logger.DebugContext(ctx, "key not accessible", "fingerprint", fp)
+				continue
+			}
+			return activePairs, false, nil
+		}
+
+		// during a key rotation there may be no active keys which would mean reaching
+		// this point isn't an error
+		if foundActiveKey {
+			return nil, false, trace.AccessDenied("active key not accessible")
+		}
+	}
+
+	// no active keys present, need to generate one
+	encryptionPair, err := m.keyStore.NewEncryptionKeyPair(ctx, cryptosuites.RecordingKeyWrapping)
+	if err != nil {
+		return nil, false, trace.Wrap(err, "generating wrapping key")
+	}
+
+	fp, _ := fingerprintPEM(encryptionPair.PublicKey)
+	m.logger.InfoContext(ctx, "no active encryption keys, generated new pair", "public_fingerprint", fp)
+
+	return append(activePairs, &recordingencryptionv1.KeyPair{
+		KeyPair: encryptionPair,
+		State:   recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE,
+	}), true, nil
+}
+
+// resolveRecordingEncryption returns the configured [RecordingEncryption] resource if it exists with an
+// accessible key. If no active keys can be found and manual key management is disabled, a new key pair
+// will be provisioned. An error is returned if an active key is found but is not accessible. It is also
+// possible for the returned [RecordingEncryption] to be nil if the [SessionRecordingConfig] disables
+// encryption altogether.
+func (m *Manager) resolveRecordingEncryption(ctx context.Context, sessionRecordingCfg types.SessionRecordingConfig, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
+	// If encryption is disabled then we can skip resolving the RecordingEncryption.
+	if !sessionRecordingCfg.GetEncrypted() {
+		return encryption, nil
+	}
+	encryptionCfg := sessionRecordingCfg.GetEncryptionConfig()
+	manualKeyCfg := getManualKeyManagement(encryptionCfg)
+	if manualKeyCfg != nil {
+		encryption, err := m.ensureManualEncryptionKeys(ctx, *manualKeyCfg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return encryption, nil
+	}
+
+	m.manualKeyConfig = nil
+	persistFn := m.RecordingEncryption.UpdateRecordingEncryption
+	forcePersist := encryption != nil
+	if encryption == nil {
+		var err error
+		encryption, err = m.RecordingEncryption.GetRecordingEncryption(ctx)
+		if err != nil {
+			if !trace.IsNotFound(err) {
+				return nil, trace.Wrap(err)
+			}
+			encryption = &recordingencryptionv1.RecordingEncryption{
+				Spec: &recordingencryptionv1.RecordingEncryptionSpec{},
+			}
+			persistFn = m.RecordingEncryption.CreateRecordingEncryption
+		}
+	}
+
+	activePairs, keyGenerated, err := m.ensureActiveKeyPair(ctx, encryption.GetSpec().GetActiveKeyPairs())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if !forcePersist && !keyGenerated {
+		return encryption, nil
+	}
+
+	encryption.Spec.ActiveKeyPairs = activePairs
+	encryption, err = persistFn(ctx, encryption)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return encryption, nil
+}
+
+func (m *Manager) unwrapKeyUsingCache(in UnwrapInput) ([]byte, error) {
+	if decrypter, ok := m.keyCache.Load(in.Fingerprint); ok {
+		fileKey, err := decrypter.Decrypt(in.Rand, in.WrappedKey, in.Opts)
+		return fileKey, trace.Wrap(err)
+	}
+
+	return nil, nil
+}
+
+func (m *Manager) findDecrypter(ctx context.Context, fingerprint string) (crypto.Decrypter, error) {
+	encryption, err := m.cache.GetRecordingEncryption(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	for _, key := range activePairs {
+		if key.GetKeyPair() == nil {
+			continue
+		}
+
+		activeFP, err := fingerprintPEM(key.KeyPair.PublicKey)
+		if err != nil {
+			m.logger.ErrorContext(ctx, "failed to fingerprint active public key", "error", err)
+			continue
+		}
+
+		if activeFP != fingerprint {
+			continue
+		}
+
+		decrypter, err := m.keyStore.GetDecrypter(ctx, key.KeyPair)
+		if err != nil {
+			continue
+		}
+
+		return decrypter, nil
+	}
+
+	// fallback to rotated keys if decrypter isn't found in active keys
+	rotatedKey, err := m.GetRotatedKey(ctx, fingerprint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	decrypter, err := m.keyStore.GetDecrypter(ctx, rotatedKey.GetSpec().GetEncryptionKeyPair())
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return nil, trace.NotFound("no accessible decrypter found for fingerprint %q", fingerprint)
+		}
+
+		return nil, trace.Wrap(err)
+	}
+
+	return decrypter, nil
+}
+
+// UnwrapKey searches for the private key compatible with the provided public key fingerprint and uses it to unwrap
+// a wrapped file key.
+func (m *Manager) UnwrapKey(ctx context.Context, in UnwrapInput) ([]byte, error) {
+	fileKey, err := m.unwrapKeyUsingCache(in)
+	if fileKey != nil && err == nil {
+		return fileKey, nil
+	}
+
+	// a cache miss or unwrap failure for manually managed keys needs to attempt a refresh and try again
+	if m.manualKeyConfig != nil && m.manualKeyConfig.Enabled {
+		if _, err := m.ensureManualEncryptionKeys(ctx, *m.manualKeyConfig); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		fileKey, err = m.unwrapKeyUsingCache(in)
+		return fileKey, trace.Wrap(err)
+	}
+
+	// a cache miss in for teleport managed keys just needs to fall back to the keystore
+	if err != nil {
+		m.logger.WarnContext(ctx, "failed to unwrap file key using cached decrypter, refetching from keystore")
+	}
+
+	decrypter, err := m.findDecrypter(ctx, in.Fingerprint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+
+	}
+
+	fileKey, err = decrypter.Decrypt(in.Rand, in.WrappedKey, in.Opts)
+	return fileKey, trace.Wrap(err)
+}
+
+// RotateKey marks the currently active key pair as 'rotating' and adds a new pair to the active set.
+func (m *Manager) RotateKey(ctx context.Context) error {
+	sessionRecordingConfig, err := m.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := shouldManageKeys(sessionRecordingConfig); err != nil {
+		return trace.Wrap(err)
+	}
+
+	encryption, err := m.GetRecordingEncryption(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	var activePair *recordingencryptionv1.KeyPair
+	for _, pair := range activePairs {
+		switch pair.GetState() {
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING:
+			return trace.AlreadyExists("Recording encryption key rotation already in progress, complete or rollback to start a new one")
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE:
+			return trace.BadParameter("Failed recording encryption key rotation in progress, at least one Teleport Auth Service does not have access to the new key pair. Please rollback the rotation, ensure that all Auth Services have access to provision and use keys within the configured keystore, and then try again.")
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE:
+			activePair = pair
+		}
+	}
+
+	if activePair == nil {
+		return trace.NotFound("no active key present to rotate")
+	}
+
+	activePair.State = recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING
+	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// CompleteRotation creates a new [RotatedKey] resource for rotating key pair and removes them from the active set.
+func (m *Manager) CompleteRotation(ctx context.Context) error {
+	sessionRecordingConfig, err := m.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := shouldManageKeys(sessionRecordingConfig); err != nil {
+		return trace.Wrap(err)
+	}
+
+	encryption, err := m.GetRecordingEncryption(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	var remainingPairs []*recordingencryptionv1.KeyPair
+	var rotatedPairs []*recordingencryptionv1.KeyPair
+	for _, pair := range activePairs {
+		switch pair.GetState() {
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING:
+			rotatedPairs = append(rotatedPairs, pair)
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE:
+			remainingPairs = append(remainingPairs, pair)
+		case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE:
+			return trace.BadParameter("Failed recording encryption key rotation in progress, at least one Teleport Auth Service does not have access to the new key pair. Please rollback the rotation, ensure that all Auth Services have access to provision and use keys within the configured keystore, and then try again.")
+		}
+	}
+
+	for _, pair := range rotatedPairs {
+		if _, err := m.CreateRotatedKey(ctx, pair.GetKeyPair()); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	encryption.Spec.ActiveKeyPairs = remainingPairs
+	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// RollbackRotation reverts an in progress rotation by setting 'rotating' keys back to 'active' and removing
+// all other keys from the active set.
+func (m *Manager) RollbackRotation(ctx context.Context) error {
+	sessionRecordingConfig, err := m.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := shouldManageKeys(sessionRecordingConfig); err != nil {
+		return trace.Wrap(err)
+	}
+
+	encryption, err := m.GetRecordingEncryption(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	var rollbackPairs []*recordingencryptionv1.KeyPair
+	for _, pair := range activePairs {
+		if pair.GetState() == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING {
+			pair.State = recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE
+			rollbackPairs = append(rollbackPairs, pair)
+		}
+	}
+
+	if len(rollbackPairs) == 0 {
+		return trace.BadParameter("skipping rollback that would remove all encryption keys")
+	}
+
+	encryption.Spec.ActiveKeyPairs = rollbackPairs
+	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// GetRotationState returns the state of each active key identified by a fingerprint.
+func (m *Manager) GetRotationState(ctx context.Context) ([]*recordingencryptionv1.FingerprintWithState, error) {
+	sessionRecordingConfig, err := m.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := shouldManageKeys(sessionRecordingConfig); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	encryption, err := m.GetRecordingEncryption(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	if len(activePairs) == 0 {
+		return nil, nil
+	}
+
+	states := make([]*recordingencryptionv1.FingerprintWithState, 0, len(activePairs))
+	for _, pair := range activePairs {
+		fingerprint, err := fingerprintPEM(pair.GetKeyPair().PublicKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		states = append(states, &recordingencryptionv1.FingerprintWithState{
+			Fingerprint: fingerprint,
+			State:       pair.GetState(),
+		})
+	}
+
+	return states, nil
+}
+
+// Watch for changes in the recording_encryption resource and respond by ensuring access to keys.
+func (m *Manager) Watch(ctx context.Context, events types.Events) (err error) {
+	// shouldRetryAfterJitterFn waits at most 5 seconds and returns a bool specifying whether or not
+	// execution should continue
+	shouldRetryAfterJitterFn := func() bool {
+		select {
+		case <-time.After(retryutils.SeventhJitter(time.Second * 5)):
+			return true
+		case <-ctx.Done():
+			return false
+		}
+	}
+
+	// getNextManualSync returns a timed channel meant to trigger encryption key syncing when keys are
+	// manually managed
+	getNextManualSync := func() <-chan time.Time {
+		return time.After(retryutils.SeventhJitter(time.Minute * 5))
+	}
+
+	defer func() {
+		m.logger.InfoContext(ctx, "stopping encryption watcher", "error", err)
+	}()
+
+	// on initial startup we should try to immediately resolve recording encryption
+	if err := m.resolveRecordingEncryptionState(ctx, shouldRetryAfterJitterFn); err != nil {
+		m.logger.ErrorContext(ctx, "initial attempt to resolve recording encryption failed", "error", err)
+	}
+
+	nextSync := getNextManualSync()
+	for {
+		watch, err := events.NewWatcher(ctx, types.Watch{
+			Name: "recording_encryption_watcher",
+			Kinds: []types.WatchKind{
+				{
+					Kind: types.KindRecordingEncryption,
+				},
+			},
+		})
+		if err != nil {
+			m.logger.ErrorContext(ctx, "failed to create watcher, retrying", "error", err)
+			if !shouldRetryAfterJitterFn() {
+				return nil
+			}
+			continue
+		}
+		defer watch.Close()
+
+	HandleEvents:
+		for {
+			select {
+			case ev := <-watch.Events():
+				if ev.Type != types.OpPut || ev.Resource.GetKind() != types.KindRecordingEncryption {
+					continue
+				}
+				if err := m.resolveRecordingEncryptionState(ctx, shouldRetryAfterJitterFn); err != nil {
+					m.logger.ErrorContext(ctx, "failure handling recording encryption event", "kind", ev.Resource.GetKind(), "error", err)
+					continue
+				}
+				// reset interval sync since we just resolved recording encryption state
+				nextSync = getNextManualSync()
+			case <-nextSync:
+				nextSync = getNextManualSync()
+				if m.manualKeyConfig == nil || !m.manualKeyConfig.Enabled {
+					// we only need to sync on an interval when keys are manually managed
+					continue
+				}
+
+				if err := m.resolveRecordingEncryptionState(ctx, shouldRetryAfterJitterFn); err != nil {
+					m.logger.ErrorContext(ctx, "failed interval sync of recording encryption keys", "error", err)
+				}
+			case <-watch.Done():
+				if err := watch.Error(); err == nil {
+					return nil
+				}
+
+				m.logger.ErrorContext(ctx, "watcher failed, retrying", "error", err)
+				if !shouldRetryAfterJitterFn() {
+					return nil
+				}
+				break HandleEvents
+			case <-ctx.Done():
+				return nil
+			}
+
+		}
+	}
+}
+
+// modifySessionRecordingConfig modifies the [SessionRecordingConfig] while maintaining the correct
+// [RecordingEncryption] state. Any changes to active encryption keys are also applied to the [SessionRecordingConfig]
+// before applying the change.
+func (m *Manager) modifySessionRecordingConfig(ctx context.Context, cfg types.SessionRecordingConfig, persistFn func(context.Context, types.SessionRecordingConfig) (types.SessionRecordingConfig, error)) (types.SessionRecordingConfig, error) {
+	var result types.SessionRecordingConfig
+	err := backend.RunWhileLocked(ctx, m.lockConfig, func(ctx context.Context) error {
+		encryption, err := m.resolveRecordingEncryption(ctx, cfg, nil)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		_ = cfg.SetEncryptionKeys(getAgeEncryptionKeys(encryption.GetSpec().GetActiveKeyPairs()))
+		result, err = persistFn(ctx, cfg)
+		return trace.Wrap(err)
+	})
+
+	return result, trace.Wrap(err)
+}
+
+// modifyRecordingEncryption modifies the [RecordingEncryption] if the fetched [SessionRecordingConfig] allows it.
+// Any changes to active encryption keys are also applied to the [SessionRecordingConfig] before releasing the lock.
+func (m *Manager) modifyRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
+	var result *recordingencryptionv1.RecordingEncryption
+	err := backend.RunWhileLocked(ctx, m.lockConfig, func(ctx context.Context) error {
+		sessionRecordingCfg, err := m.GetSessionRecordingConfig(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		result, err = m.resolveRecordingEncryption(ctx, sessionRecordingCfg, encryption)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if sessionRecordingCfg.SetEncryptionKeys(getAgeEncryptionKeys(result.GetSpec().GetActiveKeyPairs())) {
+			if _, err = m.ClusterConfigurationInternal.UpdateSessionRecordingConfig(ctx, sessionRecordingCfg); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+
+		return nil
+	})
+
+	return result, trace.Wrap(err)
+}
+
+// resolveRecordingEncryptionState fetches the latest [SessionRecordingConfig] and [RecordingEncryption] resources
+// from the backend and applies any updates the calling auth instance might require. This is meant to be run on an
+// interval or in response to watch events. The primary updates expected are key state changes for inaccessible
+// encryption keys and refreshing the manual key management cache. If the current state cannot be resolved after a
+// number of retries, a [trace.LimitExceededError] is returned.
+func (m *Manager) resolveRecordingEncryptionState(ctx context.Context, shouldRetryFn func() bool) error {
+	const retries = 3
+	for retry := range retries {
+		if _, err := m.modifyRecordingEncryption(ctx, nil); err != nil {
+			m.logger.ErrorContext(ctx, "failed to resolve recording encryption keys, retrying", "retry", retry, "retries_left", retries-retry, "error", err)
+			if shouldRetryFn() {
+				continue
+			}
+
+			return trace.Wrap(err)
+		}
+
+		return nil
+	}
+
+	return trace.LimitExceeded("resolving recording encryption exceeded max retries")
+}
+
+// getAgeEncryptionKeys returns an iterator of AgeEncryptionKeys from a list of WrappedKeys. This is for use in
+// populating the EncryptionKeys field of SessionRecordingConfigStatus.
+func getAgeEncryptionKeys(keys []*recordingencryptionv1.KeyPair) iter.Seq[*types.AgeEncryptionKey] {
+	return func(yield func(*types.AgeEncryptionKey) bool) {
+		for _, key := range keys {
+			if key.KeyPair == nil {
+				continue
+			}
+
+			if !yield(&types.AgeEncryptionKey{
+				PublicKey: key.KeyPair.PublicKey,
+			}) {
+				return
+			}
+		}
+	}
+}
+
+func getManualKeyManagement(encryptionCfg *types.SessionRecordingEncryptionConfig) *types.ManualKeyManagementConfig {
+	if encryptionCfg == nil {
+		return nil
+	}
+
+	if encryptionCfg.ManualKeyManagement == nil || !encryptionCfg.ManualKeyManagement.Enabled {
+		return nil
+	}
+
+	return encryptionCfg.ManualKeyManagement
+}
+
+func shouldManageKeys(sessionRecordingConfig types.SessionRecordingConfig) error {
+	encryptionCfg := sessionRecordingConfig.GetEncryptionConfig()
+	if encryptionCfg == nil || !encryptionCfg.Enabled {
+		return trace.NotFound("session recording encryption is not enabled")
+	}
+
+	if manual := getManualKeyManagement(encryptionCfg); manual != nil && manual.Enabled {
+		return trace.NotFound("session recording encryption is using manual key management")
+	}
+
+	return nil
+}
+
+// Fingerprint a public key for use in logging and as a cache key.
+func Fingerprint(pubKey crypto.PublicKey) (string, error) {
+	derPub, err := x509.MarshalPKIXPublicKey(pubKey)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	fp := sha256.Sum256(derPub)
+	return hex.EncodeToString(fp[:]), nil
+}
+
+// fingerprints a public RSA key encoded as PEM-wrapped PKIX.
+func fingerprintPEM(pubKeyPEM []byte) (string, error) {
+	pubKey, err := x509.ParsePKIXPublicKey(pubKeyPEM)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return Fingerprint(pubKey)
+}
diff --git a/lib/auth/recordingencryption/manager_test.go b/lib/auth/recordingencryption/manager_test.go
new file mode 100644
index 0000000000000..98f1a3ee8fc5e
--- /dev/null
+++ b/lib/auth/recordingencryption/manager_test.go
@@ -0,0 +1,655 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryption_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"io"
+	"os"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestMain(m *testing.M) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
+}
+
+type oaepDecrypter struct {
+	crypto.Decrypter
+	hash crypto.Hash
+}
+
+func (d oaepDecrypter) Decrypt(rand io.Reader, msg []byte, opts crypto.DecrypterOpts) ([]byte, error) {
+	return d.Decrypter.Decrypt(rand, msg, opts)
+}
+
+type fakeKeyStore struct {
+	keyType   types.PrivateKeyType // abusing this field as a way to simulate different auth servers
+	keys      map[string][]crypto.Decrypter
+	currLabel types.KeyLabel
+}
+
+func newFakeKeyStore(keyType types.PrivateKeyType) *fakeKeyStore {
+	return &fakeKeyStore{
+		keys:    make(map[string][]crypto.Decrypter),
+		keyType: keyType,
+		currLabel: types.KeyLabel{
+			Type:  "pkcs11",
+			Label: "test",
+		},
+	}
+}
+
+func (f *fakeKeyStore) genKeys() (crypto.Decrypter, []byte, error) {
+	signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA4096)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	private, ok := signer.(*rsa.PrivateKey)
+	if !ok {
+		return nil, nil, trace.Errorf("expected RSA key")
+	}
+
+	publicKey, err := x509.MarshalPKIXPublicKey(&private.PublicKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return private, publicKey, nil
+}
+
+func (f *fakeKeyStore) createKey() (crypto.Decrypter, []byte, error) {
+	decrypter, publicKey, err := f.genKeys()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	fp, err := recordingencryption.Fingerprint(decrypter.Public())
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if f.keys == nil {
+		f.keys = make(map[string][]crypto.Decrypter)
+	}
+
+	f.keys[fp] = []crypto.Decrypter{decrypter}
+
+	return decrypter, publicKey, nil
+}
+
+func (f *fakeKeyStore) NewEncryptionKeyPair(ctx context.Context, purpose cryptosuites.KeyPurpose) (*types.EncryptionKeyPair, error) {
+	decrypter, pubDER, err := f.createKey()
+	if err != nil {
+		return nil, err
+	}
+
+	private, ok := decrypter.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("expected RSA private key")
+	}
+
+	privateDER, err := x509.MarshalPKCS8PrivateKey(private)
+	if err != nil {
+		return nil, err
+	}
+
+	label := f.currLabel.Type + ":" + f.currLabel.Label
+	f.keys[label] = append(f.keys[label], private)
+
+	return &types.EncryptionKeyPair{
+		PrivateKey:     privateDER,
+		PublicKey:      pubDER,
+		PrivateKeyType: f.keyType,
+		Hash:           uint32(crypto.SHA256),
+	}, nil
+}
+
+func (f *fakeKeyStore) GetDecrypter(ctx context.Context, keyPair *types.EncryptionKeyPair) (crypto.Decrypter, error) {
+	if keyPair.PrivateKeyType != f.keyType {
+		return nil, errors.New("could not access decrypter")
+	}
+
+	private, err := x509.ParsePKCS8PrivateKey(keyPair.PrivateKey)
+	if err != nil {
+		return nil, err
+	}
+
+	decrypter, ok := private.(crypto.Decrypter)
+	if !ok {
+		return nil, errors.New("private key should have been a decrypter")
+	}
+	return oaepDecrypter{Decrypter: decrypter, hash: crypto.Hash(keyPair.Hash)}, nil
+}
+
+func (f *fakeKeyStore) UnwrapKey(ctx context.Context, in recordingencryption.UnwrapInput) ([]byte, error) {
+	decrypter, ok := f.keys[in.Fingerprint]
+	if !ok {
+		return nil, trace.NotFound("no accessible decryption key found")
+	}
+
+	fileKey, err := decrypter[0].Decrypt(in.Rand, in.WrappedKey, in.Opts)
+	if err != nil {
+		return nil, err
+	}
+
+	return fileKey, nil
+}
+
+func (f *fakeKeyStore) FindDecryptersByLabels(ctx context.Context, labels ...*types.KeyLabel) ([]crypto.Decrypter, error) {
+	var decrypters []crypto.Decrypter
+	for _, label := range labels {
+		lookup := label.Type + ":" + label.Label
+		decrypters = append(decrypters, f.keys[lookup]...)
+	}
+
+	return decrypters, nil
+}
+
+func newLocalBackend(
+	t *testing.T,
+) (context.Context, backend.Backend) {
+	t.Parallel()
+	ctx := t.Context()
+	clock := clockwork.NewRealClock()
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	bk := backend.NewSanitizer(mem)
+	return ctx, bk
+}
+
+func newManagerConfig(t *testing.T, bk backend.Backend, keyType types.PrivateKeyType) recordingencryption.ManagerConfig {
+	recordingEncryptionService, err := local.NewRecordingEncryptionService(bk)
+	require.NoError(t, err)
+
+	clusterConfigService, err := local.NewClusterConfigurationService(bk)
+	require.NoError(t, err)
+
+	src := &types.SessionRecordingConfigV2{}
+	require.NoError(t, src.CheckAndSetDefaults())
+	src.Spec.Encryption = &types.SessionRecordingEncryptionConfig{
+		Enabled: true,
+	}
+
+	return recordingencryption.ManagerConfig{
+		Backend:       recordingEncryptionService,
+		Cache:         recordingEncryptionService,
+		ClusterConfig: clusterConfigService,
+		KeyStore:      newFakeKeyStore(keyType),
+		Logger:        logtest.NewLogger(),
+		LockConfig: backend.RunWhileLockedConfig{
+			LockConfiguration: backend.LockConfiguration{
+				Backend:            bk,
+				LockNameComponents: []string{"recording_encryption"},
+				TTL:                10 * time.Second,
+				RetryInterval:      100 * time.Millisecond,
+			},
+		},
+	}
+}
+
+// resolve is a proxy to Manager.resolveRecordingEncryption through calling UpsertSessionRecordingConfig
+func resolve(ctx context.Context, service services.RecordingEncryption, manager *recordingencryption.Manager) (*recordingencryptionv1.RecordingEncryption, types.SessionRecordingConfig, error) {
+	req := types.SessionRecordingConfigV2{
+		Spec: types.SessionRecordingConfigSpecV2{
+			Encryption: &types.SessionRecordingEncryptionConfig{
+				Enabled: true,
+			},
+		},
+	}
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	src, err := manager.UpsertSessionRecordingConfig(ctx, &req)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	encryption, err := service.GetRecordingEncryption(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return encryption, src, nil
+}
+
+func TestCreateUpdateSessionRecordingConfig(t *testing.T) {
+	ctx, bk := newLocalBackend(t)
+
+	config := newManagerConfig(t, bk, types.PrivateKeyType_RAW)
+	manager, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	req := &types.SessionRecordingConfigV2{}
+	require.NoError(t, req.CheckAndSetDefaults())
+	req.Spec.Encryption = &types.SessionRecordingEncryptionConfig{
+		Enabled: true,
+	}
+
+	// create should provision initial keypair and write public key to SRC
+	src, err := manager.CreateSessionRecordingConfig(ctx, req)
+	require.NoError(t, err)
+	encryptionKeys := src.GetEncryptionKeys()
+	require.Len(t, encryptionKeys, 1)
+
+	encryption, err := config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 1)
+	require.NotNil(t, activePairs[0].KeyPair)
+	require.NotEmpty(t, activePairs[0].KeyPair.PrivateKey)
+	require.NotEmpty(t, activePairs[0].KeyPair.PublicKey)
+
+	// update should change nothing
+	src, err = manager.UpdateSessionRecordingConfig(ctx, src)
+	require.NoError(t, err)
+	newEncryptionKeys := src.GetEncryptionKeys()
+	require.ElementsMatch(t, newEncryptionKeys, encryptionKeys)
+
+	encryption, err = config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	newActiveKeyPairs := encryption.GetSpec().GetActiveKeyPairs()
+	require.ElementsMatch(t, newActiveKeyPairs, activePairs)
+}
+
+func TestResolveRecordingEncryption(t *testing.T) {
+	// SETUP
+	ctx, bk := newLocalBackend(t)
+
+	managerABType := types.PrivateKeyType_AWS_KMS
+	managerCType := types.PrivateKeyType_GCP_KMS
+
+	configA := newManagerConfig(t, bk, managerABType)
+	configB := configA
+	configC := configA
+	configC.KeyStore = newFakeKeyStore(managerCType)
+
+	managerA, err := recordingencryption.NewManager(ctx, configA)
+	require.NoError(t, err)
+
+	managerB, err := recordingencryption.NewManager(ctx, configB)
+	require.NoError(t, err)
+
+	managerC, err := recordingencryption.NewManager(ctx, configC)
+	require.NoError(t, err)
+
+	service := configA.Backend
+
+	// TEST
+	// CASE: service A first evaluation initializes recording encryption resource
+	encryption, src, err := resolve(ctx, service, managerA)
+	require.NoError(t, err)
+	initialKeys := encryption.GetSpec().GetActiveKeyPairs()
+
+	require.Len(t, initialKeys, 1)
+	require.Len(t, src.GetEncryptionKeys(), 1)
+	key := initialKeys[0]
+	require.Equal(t, key.KeyPair.PublicKey, src.GetEncryptionKeys()[0].PublicKey)
+	require.NotNil(t, key.KeyPair)
+
+	// CASE: service B should have access to the same key
+	encryption, src, err = resolve(ctx, service, managerB)
+	require.NoError(t, err)
+
+	activePairs := encryption.GetSpec().ActiveKeyPairs
+	require.Len(t, src.GetEncryptionKeys(), 1)
+	require.Equal(t, key.KeyPair.PublicKey, src.GetEncryptionKeys()[0].PublicKey)
+	require.ElementsMatch(t, initialKeys, activePairs)
+
+	// service C should error without access to the current key
+	_, _, err = resolve(ctx, service, managerC)
+	require.Error(t, err)
+}
+
+func TestResolveRecordingEncryptionConcurrent(t *testing.T) {
+	// SETUP
+	ctx, bk := newLocalBackend(t)
+
+	config := newManagerConfig(t, bk, types.PrivateKeyType_RAW)
+	managerA, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	managerB, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	serviceC, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	service := config.Backend
+	resolveFn := func(manager *recordingencryption.Manager, wg *sync.WaitGroup) {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			resolve(ctx, service, manager)
+			require.NoError(t, err)
+		}()
+	}
+
+	// it should be safe for multiple services to resolve encryption keys concurrently
+	wg := sync.WaitGroup{}
+	resolveFn(managerA, &wg)
+	resolveFn(managerB, &wg)
+	resolveFn(serviceC, &wg)
+	wg.Wait()
+
+	encryption, err := service.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+
+	activePairs := encryption.GetSpec().ActiveKeyPairs
+	// each service should share a single active key
+	require.Len(t, activePairs, 1)
+	require.NotNil(t, activePairs[0].KeyPair)
+	require.NotEmpty(t, activePairs[0].KeyPair.PrivateKey)
+	require.NotEmpty(t, activePairs[0].KeyPair.PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, activePairs[0].KeyPair.PrivateKeyType)
+}
+
+func TestUnwrapKey(t *testing.T) {
+	// SETUP
+	ctx, bk := newLocalBackend(t)
+	keyType := types.PrivateKeyType_RAW
+
+	config := newManagerConfig(t, bk, keyType)
+	manager, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	service := config.Backend
+	_, _, err = resolve(ctx, service, manager)
+	require.NoError(t, err)
+
+	src, err := manager.GetSessionRecordingConfig(ctx)
+	require.NoError(t, err)
+
+	encryptionKeys := src.GetEncryptionKeys()
+	require.Len(t, encryptionKeys, 1)
+	pubKeyDER := encryptionKeys[0].PublicKey
+
+	pubKey, err := x509.ParsePKIXPublicKey(pubKeyDER)
+	require.NoError(t, err)
+
+	rsaPubKey, ok := pubKey.(*rsa.PublicKey)
+	require.True(t, ok)
+
+	fileKey := []byte("test_file_key")
+	label := []byte("test_label")
+	wrappedKey, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, rsaPubKey, fileKey, label)
+	require.NoError(t, err)
+
+	fp, err := recordingencryption.Fingerprint(pubKey)
+	require.NoError(t, err)
+
+	unwrapInput := recordingencryption.UnwrapInput{
+		Fingerprint: fp,
+		WrappedKey:  wrappedKey,
+		Rand:        rand.Reader,
+		Opts: &rsa.OAEPOptions{
+			Hash:  crypto.SHA256,
+			Label: label,
+		},
+	}
+	unwrappedKey, err := manager.UnwrapKey(ctx, unwrapInput)
+	require.NoError(t, err)
+
+	require.Equal(t, fileKey, unwrappedKey)
+}
+
+func TestRotateKey(t *testing.T) {
+	ctx, bk := newLocalBackend(t)
+
+	config := newManagerConfig(t, bk, types.PrivateKeyType_RAW)
+	manager, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	req := &types.SessionRecordingConfigV2{}
+	require.NoError(t, req.CheckAndSetDefaults())
+	req.Spec.Encryption = &types.SessionRecordingEncryptionConfig{
+		Enabled: true,
+	}
+
+	// setup initial state
+	src, err := manager.CreateSessionRecordingConfig(ctx, req)
+	require.NoError(t, err)
+	encryptionKeys := src.GetEncryptionKeys()
+	require.Len(t, encryptionKeys, 1)
+
+	encryption, err := config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 1)
+	initialKey := activePairs[0]
+	require.NotNil(t, initialKey.KeyPair)
+	require.NotEmpty(t, initialKey.KeyPair.PrivateKey)
+	require.NotEmpty(t, initialKey.KeyPair.PublicKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.State)
+
+	// rotate key
+	err = manager.RotateKey(ctx)
+	require.NoError(t, err)
+
+	encryption, err = config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs = encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 2)
+
+	var foundInitialPair bool
+	var newPair *recordingencryptionv1.KeyPair
+	for _, pair := range activePairs {
+		if slices.Equal(initialKey.KeyPair.PublicKey, pair.KeyPair.PublicKey) {
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.State)
+			foundInitialPair = true
+		} else {
+			newPair = pair
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.State)
+		}
+	}
+
+	require.True(t, foundInitialPair && newPair != nil)
+
+	// complete rotation
+	err = manager.CompleteRotation(ctx)
+	require.NoError(t, err)
+
+	encryption, err = config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs = encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 1)
+
+	require.Equal(t, newPair.KeyPair.PublicKey, activePairs[0].KeyPair.PublicKey)
+	require.Equal(t, newPair.KeyPair.PrivateKey, activePairs[0].KeyPair.PrivateKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].State)
+
+	pubKey, err := x509.ParsePKIXPublicKey(initialKey.KeyPair.PublicKey)
+	require.NoError(t, err)
+
+	fingerprint, err := recordingencryption.Fingerprint(pubKey)
+	require.NoError(t, err)
+
+	rotatedKey, err := config.Backend.GetRotatedKey(ctx, fingerprint)
+	require.NoError(t, err)
+
+	require.Equal(t, initialKey.KeyPair.PublicKey, rotatedKey.Spec.EncryptionKeyPair.PublicKey)
+	require.Equal(t, initialKey.KeyPair.PrivateKey, rotatedKey.Spec.EncryptionKeyPair.PrivateKey)
+}
+
+func TestRotateRollback(t *testing.T) {
+	ctx, bk := newLocalBackend(t)
+
+	config := newManagerConfig(t, bk, types.PrivateKeyType_RAW)
+	manager, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	req := &types.SessionRecordingConfigV2{}
+	require.NoError(t, req.CheckAndSetDefaults())
+	req.Spec.Encryption = &types.SessionRecordingEncryptionConfig{
+		Enabled: true,
+	}
+
+	// setup initial state
+	src, err := manager.CreateSessionRecordingConfig(ctx, req)
+	require.NoError(t, err)
+	encryptionKeys := src.GetEncryptionKeys()
+	require.Len(t, encryptionKeys, 1)
+
+	encryption, err := config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 1)
+	initialKey := proto.CloneOf(activePairs[0])
+	require.NotNil(t, initialKey.KeyPair)
+	require.NotEmpty(t, initialKey.KeyPair.PrivateKey)
+	require.NotEmpty(t, initialKey.KeyPair.PublicKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.State)
+
+	// rotate key
+	err = manager.RotateKey(ctx)
+	require.NoError(t, err)
+
+	encryption, err = config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs = encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 2)
+
+	var foundInitialPair bool
+	var newPair *recordingencryptionv1.KeyPair
+	for _, pair := range activePairs {
+		if slices.Equal(initialKey.KeyPair.PublicKey, pair.KeyPair.PublicKey) {
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.State)
+			foundInitialPair = true
+		} else {
+			newPair = pair
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.State)
+		}
+	}
+
+	require.True(t, foundInitialPair && newPair != nil)
+
+	// rollback rotation
+	err = manager.RollbackRotation(ctx)
+	require.NoError(t, err)
+
+	encryption, err = config.Backend.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	activePairs = encryption.GetSpec().GetActiveKeyPairs()
+	require.Len(t, activePairs, 1)
+
+	require.Equal(t, initialKey.KeyPair.PublicKey, activePairs[0].KeyPair.PublicKey)
+	require.Equal(t, initialKey.KeyPair.PrivateKey, activePairs[0].KeyPair.PrivateKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].State)
+
+	pubKey, err := x509.ParsePKIXPublicKey(initialKey.KeyPair.PublicKey)
+	require.NoError(t, err)
+
+	fingerprint, err := recordingencryption.Fingerprint(pubKey)
+	require.NoError(t, err)
+
+	// no rotated key should be found after a rollback
+	_, err = config.Backend.GetRotatedKey(ctx, fingerprint)
+	require.Error(t, err)
+}
+
+func TestRotateKeyDisabled(t *testing.T) {
+	ctx, bk := newLocalBackend(t)
+
+	config := newManagerConfig(t, bk, types.PrivateKeyType_RAW)
+	manager, err := recordingencryption.NewManager(ctx, config)
+	require.NoError(t, err)
+
+	req := &types.SessionRecordingConfigV2{}
+	require.NoError(t, req.CheckAndSetDefaults())
+	req.Spec.Encryption = &types.SessionRecordingEncryptionConfig{
+		Enabled: false,
+	}
+
+	// setup initial state
+	src, err := manager.CreateSessionRecordingConfig(ctx, req)
+	require.NoError(t, err)
+
+	err = manager.RotateKey(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	_, err = manager.GetRotationState(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = manager.CompleteRotation(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = manager.RollbackRotation(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	_, err = config.KeyStore.NewEncryptionKeyPair(ctx, cryptosuites.RecordingKeyWrapping)
+	require.NoError(t, err)
+
+	cfg, ok := src.(*types.SessionRecordingConfigV2)
+	require.True(t, ok, "expected SessionRecordingConfigV2")
+
+	cfg.Spec.Encryption.Enabled = true
+	cfg.Spec.Encryption.ManualKeyManagement = &types.ManualKeyManagementConfig{
+		Enabled: true,
+		ActiveKeys: []*types.KeyLabel{{
+			Type:  "pkcs11",
+			Label: "test",
+		}},
+	}
+
+	_, err = manager.UpdateSessionRecordingConfig(ctx, req)
+	require.NoError(t, err)
+
+	err = manager.RotateKey(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	_, err = manager.GetRotationState(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = manager.CompleteRotation(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = manager.RollbackRotation(ctx)
+	require.True(t, trace.IsNotFound(err))
+}
diff --git a/lib/auth/recordingencryption/recordingencryptionv1/service.go b/lib/auth/recordingencryption/recordingencryptionv1/service.go
new file mode 100644
index 0000000000000..6a24d3d0a71b4
--- /dev/null
+++ b/lib/auth/recordingencryption/recordingencryptionv1/service.go
@@ -0,0 +1,317 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryptionv1
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/events"
+	sessionpostprocessing "github.com/gravitational/teleport/lib/events/sessionpostprocessing"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// A KeyRotater facilitates rotation of encryption keys.
+type KeyRotater interface {
+	RotateKey(context.Context) error
+	CompleteRotation(context.Context) error
+	RollbackRotation(context.Context) error
+	GetRotationState(context.Context) ([]*recordingencryptionv1.FingerprintWithState, error)
+}
+
+// ServiceConfig captures everything a [Service] requires to fulfill requests.
+type ServiceConfig struct {
+	Authorizer authz.Authorizer
+	Logger     *slog.Logger
+	Uploader   events.MultipartUploader
+	KeyRotater KeyRotater
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	RecordingMetadataProvider *recordingmetadata.Provider
+	// SessionStreamer is a streamer for session events.
+	SessionStreamer events.SessionStreamer
+}
+
+// NewService returns a new [Service] based on the given [ServiceConfig].
+func NewService(cfg ServiceConfig) (*Service, error) {
+	switch {
+	case cfg.Authorizer == nil:
+		return nil, trace.BadParameter("authorizer is required")
+	case cfg.Uploader == nil:
+		return nil, trace.BadParameter("uploader is required")
+	case cfg.KeyRotater == nil:
+		return nil, trace.BadParameter("key rotater is required")
+	case cfg.SessionStreamer == nil:
+		return nil, trace.BadParameter("session streamer is required")
+	case cfg.RecordingMetadataProvider == nil:
+		return nil, trace.BadParameter("recording metadata provider is required")
+	case cfg.SessionSummarizerProvider == nil:
+		return nil, trace.BadParameter("session summarizer provider is required")
+	}
+
+	if cfg.Logger == nil {
+		cfg.Logger = slog.With(teleport.ComponentKey, teleport.ComponentRecordingEncryption)
+	}
+
+	return &Service{
+		logger:                    cfg.Logger,
+		uploader:                  cfg.Uploader,
+		auth:                      cfg.Authorizer,
+		rotater:                   cfg.KeyRotater,
+		sessionSummarizerProvider: cfg.SessionSummarizerProvider,
+		recordingMetadataProvider: cfg.RecordingMetadataProvider,
+		streamer:                  cfg.SessionStreamer,
+	}, nil
+}
+
+// Service implements a gRPC server for interacting with encrypted recordings.
+type Service struct {
+	recordingencryptionv1.UnimplementedRecordingEncryptionServiceServer
+
+	auth     authz.Authorizer
+	logger   *slog.Logger
+	uploader events.MultipartUploader
+	rotater  KeyRotater
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	sessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	recordingMetadataProvider *recordingmetadata.Provider
+	streamer                  events.SessionStreamer
+}
+
+func streamUploadAsProto(upload events.StreamUpload) *recordingencryptionv1.Upload {
+	return &recordingencryptionv1.Upload{
+		UploadId:    upload.ID,
+		SessionId:   upload.SessionID.String(),
+		InitiatedAt: timestamppb.New(upload.Initiated),
+	}
+}
+
+func protoAsStreamUpload(upload *recordingencryptionv1.Upload) (events.StreamUpload, error) {
+	sessionID, err := session.ParseID(upload.SessionId)
+	if err != nil {
+		return events.StreamUpload{}, trace.Wrap(err)
+	}
+
+	return events.StreamUpload{
+		ID:        upload.UploadId,
+		SessionID: *sessionID,
+		Initiated: upload.InitiatedAt.AsTime(),
+	}, nil
+}
+
+func protoAsStreamPart(part *recordingencryptionv1.Part) events.StreamPart {
+	return events.StreamPart{
+		Number:       part.PartNumber,
+		ETag:         part.Etag,
+		LastModified: time.Now(),
+	}
+}
+
+// CreateUpload begins a multipart upload for an encrypted session recording.
+func (s *Service) CreateUpload(ctx context.Context, req *recordingencryptionv1.CreateUploadRequest) (*recordingencryptionv1.CreateUploadResponse, error) {
+	authCtx, err := s.auth.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if !authz.IsLocalOrRemoteService(*authCtx) {
+		return nil, trace.AccessDenied("this request can be only executed by a Teleport service")
+	}
+
+	s.logger.DebugContext(ctx, "creating encrypted session upload", "session_id", req.SessionId)
+	sessionID, err := session.ParseID(req.SessionId)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	upload, err := s.uploader.CreateUpload(ctx, *sessionID)
+	if err != nil {
+		return nil, trace.Wrap(err, "creating encrypted recording upload")
+	}
+
+	return &recordingencryptionv1.CreateUploadResponse{
+		Upload: streamUploadAsProto(*upload),
+	}, nil
+}
+
+// UploadPart uploads an encrypted session recording part to the given upload ID.
+func (s *Service) UploadPart(ctx context.Context, req *recordingencryptionv1.UploadPartRequest) (*recordingencryptionv1.UploadPartResponse, error) {
+	authCtx, err := s.auth.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if !authz.IsLocalOrRemoteService(*authCtx) {
+		return nil, trace.AccessDenied("this request can be only executed by a Teleport service")
+	}
+
+	s.logger.DebugContext(ctx, "uploading encrypted session part", "upload_id", req.Upload.UploadId, "session_id", req.Upload.SessionId, "part_number", req.PartNumber)
+	upload, err := protoAsStreamUpload(req.Upload)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.uploader.ReserveUploadPart(ctx, upload, req.PartNumber); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// If upload part is not at least the minimum upload part size, append an empty part
+	// to pad up to the minimum upload size.
+	part := req.Part
+	if !req.IsLast && len(part) < events.MinUploadPartSizeBytes {
+		part = events.PadUploadPart(part, events.MinUploadPartSizeBytes)
+	}
+
+	streamPart, err := s.uploader.UploadPart(ctx, upload, req.PartNumber, bytes.NewReader(part))
+	if err != nil {
+		return nil, trace.Wrap(err, "uploading encrypted recording part")
+	}
+
+	return &recordingencryptionv1.UploadPartResponse{
+		Part: &recordingencryptionv1.Part{
+			PartNumber: streamPart.Number,
+			Etag:       streamPart.ETag,
+		},
+	}, nil
+}
+
+// CompleteUpload marks a given encrypted session upload as complete.
+func (s *Service) CompleteUpload(ctx context.Context, req *recordingencryptionv1.CompleteUploadRequest) (*recordingencryptionv1.CompleteUploadResponse, error) {
+	authCtx, err := s.auth.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if !authz.IsLocalOrRemoteService(*authCtx) {
+		return nil, trace.AccessDenied("this request can be only executed by a Teleport service")
+	}
+
+	s.logger.DebugContext(ctx, "completing encrypted session upload", "upload_id", req.Upload.UploadId, "session_id", req.Upload.SessionId, "parts", len(req.Parts))
+	upload, err := protoAsStreamUpload(req.Upload)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	parts := make([]events.StreamPart, len(req.Parts))
+	for idx, part := range req.Parts {
+		parts[idx] = protoAsStreamPart(part)
+	}
+
+	if err := s.uploader.CompleteUpload(ctx, upload, parts); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sessionEnd, err := events.FindSessionEndEvent(ctx, s.streamer, upload.SessionID)
+	if err != nil || sessionEnd == nil {
+		return &recordingencryptionv1.CompleteUploadResponse{}, nil
+	}
+
+	if err := sessionpostprocessing.Process(
+		ctx,
+		sessionpostprocessing.Config{
+			SessionEnd:                sessionEnd,
+			SessionID:                 upload.SessionID,
+			SessionSummarizerProvider: s.sessionSummarizerProvider,
+			RecordingMetadataProvider: s.recordingMetadataProvider,
+		},
+	); err != nil {
+		s.logger.WarnContext(ctx, "session post-processing failed", "error", err)
+	}
+
+	return &recordingencryptionv1.CompleteUploadResponse{}, nil
+}
+
+func (s *Service) authorizeKeyRotation(ctx context.Context) error {
+	authCtx, err := s.auth.Authorize(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := authCtx.AuthorizeAdminAction(); err != nil {
+		return trace.AccessDenied("Key rotation can only be performed by admins")
+	}
+
+	return nil
+}
+
+// RotateKey starts the rotation process for the active key pair used while encrypting session recording data.
+func (s *Service) RotateKey(ctx context.Context, req *recordingencryptionv1.RotateKeyRequest) (*recordingencryptionv1.RotateKeyResponse, error) {
+	if err := s.authorizeKeyRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.rotater.RotateKey(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &recordingencryptionv1.RotateKeyResponse{}, nil
+}
+
+// CompleteRotation moves rotated keys out of the active set into new RotatedKey resources.
+func (s *Service) CompleteRotation(ctx context.Context, req *recordingencryptionv1.CompleteRotationRequest) (*recordingencryptionv1.CompleteRotationResponse, error) {
+	if err := s.authorizeKeyRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.rotater.CompleteRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &recordingencryptionv1.CompleteRotationResponse{}, nil
+}
+
+// RollbackRotation removes active keys and reverts rotating keys back to being active.
+func (s *Service) RollbackRotation(ctx context.Context, req *recordingencryptionv1.RollbackRotationRequest) (*recordingencryptionv1.RollbackRotationResponse, error) {
+	if err := s.authorizeKeyRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.rotater.RollbackRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &recordingencryptionv1.RollbackRotationResponse{}, nil
+}
+
+// GetRotationState the state and fingerprint of all currently active keys.
+func (s *Service) GetRotationState(ctx context.Context, req *recordingencryptionv1.GetRotationStateRequest) (*recordingencryptionv1.GetRotationStateResponse, error) {
+	if err := s.authorizeKeyRotation(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	states, err := s.rotater.GetRotationState(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &recordingencryptionv1.GetRotationStateResponse{
+		KeyPairStates: states,
+	}, nil
+}
diff --git a/lib/auth/recordingencryption/recordingencryptionv1/service_test.go b/lib/auth/recordingencryption/recordingencryptionv1/service_test.go
new file mode 100644
index 0000000000000..5f248913ff169
--- /dev/null
+++ b/lib/auth/recordingencryption/recordingencryptionv1/service_test.go
@@ -0,0 +1,423 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package recordingencryptionv1_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	recordingencryptionv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption/recordingencryptionv1"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+type authKey struct{}
+
+func withAuthCtx(ctx context.Context, authCtx authz.Context) context.Context {
+	return context.WithValue(ctx, authKey{}, authCtx)
+}
+
+func TestRotateKey(t *testing.T) {
+	cases := []struct {
+		name      string
+		ctx       authz.Context
+		expectErr bool
+	}{
+		{
+			name: "authorized RotateKey",
+			ctx:  newAuthCtx(authz.AdminActionAuthMFAVerified),
+		}, {
+			name:      "unauthorized RotateKey",
+			ctx:       newAuthCtx(authz.AdminActionAuthUnauthorized),
+			expectErr: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			ctx := withAuthCtx(t.Context(), c.ctx)
+			rotater := newFakeKeyRotater()
+			cfg := recordingencryptionv1.ServiceConfig{
+				Authorizer:                &fakeAuthorizer{},
+				Logger:                    logtest.NewLogger(),
+				Uploader:                  fakeUploader{},
+				KeyRotater:                rotater,
+				SessionStreamer:           &fakeSessionStreamer{},
+				RecordingMetadataProvider: recordingmetadata.NewProvider(),
+				SessionSummarizerProvider: summarizer.NewSessionSummarizerProvider(),
+			}
+
+			service, err := recordingencryptionv1.NewService(cfg)
+			require.NoError(t, err)
+			require.Len(t, rotater.keys, 1)
+
+			_, err = service.RotateKey(ctx, nil)
+			if c.expectErr {
+				require.True(t, trace.IsAccessDenied(err))
+				require.Len(t, rotater.keys, 1)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, rotater.keys, 2)
+			}
+		})
+	}
+}
+
+func TestCompleteRotation(t *testing.T) {
+	cases := []struct {
+		name      string
+		ctx       authz.Context
+		expectErr bool
+	}{
+		{
+			name: "authorized CompleteRotation",
+			ctx:  newAuthCtx(authz.AdminActionAuthMFAVerified),
+		}, {
+			name:      "unauthorized CompleteRotation",
+			ctx:       newAuthCtx(authz.AdminActionAuthUnauthorized),
+			expectErr: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			authCtx := withAuthCtx(t.Context(), newAuthCtx(authz.AdminActionAuthMFAVerified))
+			ctx := withAuthCtx(t.Context(), c.ctx)
+			rotater := newFakeKeyRotater()
+			cfg := recordingencryptionv1.ServiceConfig{
+				Authorizer:                &fakeAuthorizer{},
+				Logger:                    logtest.NewLogger(),
+				Uploader:                  fakeUploader{},
+				KeyRotater:                rotater,
+				SessionStreamer:           &fakeSessionStreamer{},
+				RecordingMetadataProvider: recordingmetadata.NewProvider(),
+				SessionSummarizerProvider: summarizer.NewSessionSummarizerProvider(),
+			}
+
+			service, err := recordingencryptionv1.NewService(cfg)
+			require.NoError(t, err)
+
+			_, err = service.RotateKey(authCtx, nil)
+			require.NoError(t, err)
+			require.Len(t, rotater.keys, 2)
+
+			_, err = service.CompleteRotation(ctx, nil)
+			if c.expectErr {
+				require.True(t, trace.IsAccessDenied(err))
+				require.Len(t, rotater.keys, 2)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, rotater.keys, 1)
+			}
+		})
+	}
+}
+
+func TestRollbackRotation(t *testing.T) {
+	cases := []struct {
+		name      string
+		ctx       authz.Context
+		expectErr bool
+	}{
+		{
+			name: "authorized Rollback",
+			ctx:  newAuthCtx(authz.AdminActionAuthMFAVerified),
+		}, {
+			name:      "unauthorized Rollback",
+			ctx:       newAuthCtx(authz.AdminActionAuthUnauthorized),
+			expectErr: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			authCtx := withAuthCtx(t.Context(), newAuthCtx(authz.AdminActionAuthMFAVerified))
+			ctx := withAuthCtx(t.Context(), c.ctx)
+			rotater := newFakeKeyRotater()
+			cfg := recordingencryptionv1.ServiceConfig{
+				Authorizer:                &fakeAuthorizer{},
+				Logger:                    logtest.NewLogger(),
+				Uploader:                  fakeUploader{},
+				KeyRotater:                rotater,
+				SessionStreamer:           &fakeSessionStreamer{},
+				RecordingMetadataProvider: recordingmetadata.NewProvider(),
+				SessionSummarizerProvider: summarizer.NewSessionSummarizerProvider(),
+			}
+
+			service, err := recordingencryptionv1.NewService(cfg)
+			require.NoError(t, err)
+
+			_, err = service.RotateKey(authCtx, nil)
+			require.NoError(t, err)
+			require.Len(t, rotater.keys, 2)
+
+			_, err = service.RollbackRotation(ctx, nil)
+			if c.expectErr {
+				require.True(t, trace.IsAccessDenied(err))
+				require.Len(t, rotater.keys, 2)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, rotater.keys, 1)
+			}
+		})
+	}
+}
+
+func TestGetRotationState(t *testing.T) {
+	cases := []struct {
+		name      string
+		ctx       authz.Context
+		expectErr bool
+	}{
+		{
+			name: "authorized",
+			ctx:  newAuthCtx(authz.AdminActionAuthMFAVerified),
+		}, {
+			name:      "unauthorized",
+			ctx:       newAuthCtx(authz.AdminActionAuthUnauthorized),
+			expectErr: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			ctx := withAuthCtx(t.Context(), c.ctx)
+			rotater := newFakeKeyRotater()
+			cfg := recordingencryptionv1.ServiceConfig{
+				Authorizer:                &fakeAuthorizer{},
+				Logger:                    logtest.NewLogger(),
+				Uploader:                  fakeUploader{},
+				KeyRotater:                rotater,
+				SessionStreamer:           &fakeSessionStreamer{},
+				RecordingMetadataProvider: recordingmetadata.NewProvider(),
+				SessionSummarizerProvider: summarizer.NewSessionSummarizerProvider(),
+			}
+
+			service, err := recordingencryptionv1.NewService(cfg)
+			require.NoError(t, err)
+
+			res, err := service.GetRotationState(ctx, nil)
+			if c.expectErr {
+				require.Error(t, err)
+				require.Nil(t, res)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, res.KeyPairStates, 1)
+			}
+		})
+	}
+}
+
+func newAuthCtx(action authz.AdminActionAuthState) authz.Context {
+	return authz.Context{
+		AdminActionAuthState: action,
+	}
+}
+
+type fakeUploader struct {
+	events.MultipartUploader
+}
+
+func (f fakeUploader) CompleteUpload(ctx context.Context, upload events.StreamUpload, parts []events.StreamPart) error {
+	return nil
+}
+
+type fakeAuthorizer struct{}
+
+func (f *fakeAuthorizer) Authorize(ctx context.Context) (*authz.Context, error) {
+	authCtx, ok := ctx.Value(authKey{}).(authz.Context)
+	if !ok {
+		return nil, errors.New("no auth")
+	}
+
+	return &authCtx, nil
+}
+
+type fakeKeyRotater struct {
+	keys []*recordingencryptionv1pb.FingerprintWithState
+}
+
+func newFakeKeyRotater() *fakeKeyRotater {
+	return &fakeKeyRotater{
+		keys: []*recordingencryptionv1pb.FingerprintWithState{
+			{
+				Fingerprint: uuid.New().String(),
+				State:       recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE,
+			},
+		},
+	}
+}
+
+func (f *fakeKeyRotater) RotateKey(ctx context.Context) error {
+	if len(f.keys) != 1 {
+		return errors.New("rotation in progress")
+	}
+
+	if f.keys[0].State != recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+		return fmt.Errorf("keys in unexpected state: %v", f.keys[0].State)
+	}
+
+	f.keys[0].State = recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING
+	f.keys = append(f.keys, &recordingencryptionv1pb.FingerprintWithState{
+		Fingerprint: uuid.New().String(),
+		State:       recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE,
+	})
+
+	return nil
+}
+
+func (f *fakeKeyRotater) CompleteRotation(ctx context.Context) error {
+	var keys []*recordingencryptionv1pb.FingerprintWithState
+	for _, key := range f.keys {
+		if key.State == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+			keys = append(keys, key)
+		}
+	}
+
+	f.keys = keys
+	return nil
+}
+
+func (f *fakeKeyRotater) RollbackRotation(ctx context.Context) error {
+	var keys []*recordingencryptionv1pb.FingerprintWithState
+	for _, key := range f.keys {
+		if key.State == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING {
+			keys = append(keys, key)
+		}
+	}
+
+	f.keys = keys
+	return nil
+}
+
+func (f *fakeKeyRotater) GetRotationState(ctx context.Context) ([]*recordingencryptionv1pb.FingerprintWithState, error) {
+	return f.keys, nil
+}
+
+type fakeSessionStreamer struct{}
+
+func (f *fakeSessionStreamer) StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
+	returnChan := make(chan apievents.AuditEvent, 1)
+	errChan := make(chan error, 1)
+	close(errChan)
+	events := eventstest.GenerateTestSession(eventstest.SessionParams{
+		UserName:  "alice",
+		SessionID: string(sessionID),
+		ServerID:  "testcluster",
+		PrintData: []string{"net", "stat"},
+	})
+	returnChan <- events[len(events)-1]
+	return returnChan, nil
+}
+
+func TestSessionCompleter(t *testing.T) {
+	sessionID := session.ID(uuid.NewString())
+
+	metadataProvider := recordingmetadata.NewProvider()
+	recorderMetadata := &fakeRecordingMetadata{}
+	recorderMetadata.On("ProcessSessionRecording", mock.Anything, sessionID, mock.Anything).
+		Return(nil).Once()
+	metadataProvider.SetService(recorderMetadata)
+
+	summarizerProvider := summarizer.NewSessionSummarizerProvider()
+	sessionSummarizer := &fakeSummarizer{}
+	sessionSummarizer.On("SummarizeSSH", mock.Anything, mock.Anything).
+		Return(nil).Once()
+
+	summarizerProvider.SetSummarizer(sessionSummarizer)
+	cfg := recordingencryptionv1.ServiceConfig{
+		Authorizer:                &fakeAuthorizer{},
+		Logger:                    logtest.NewLogger(),
+		Uploader:                  fakeUploader{},
+		KeyRotater:                newFakeKeyRotater(),
+		SessionStreamer:           &fakeSessionStreamer{},
+		RecordingMetadataProvider: metadataProvider,
+		SessionSummarizerProvider: summarizerProvider,
+	}
+
+	service, err := recordingencryptionv1.NewService(cfg)
+	require.NoError(t, err)
+
+	ctx := withAuthCtx(t.Context(), newServiceAuthCtx())
+	_, err = service.CompleteUpload(ctx, &recordingencryptionv1pb.CompleteUploadRequest{
+		Upload: &recordingencryptionv1pb.Upload{
+			SessionId:   string(sessionID),
+			InitiatedAt: timestamppb.Now(),
+			UploadId:    uuid.NewString(),
+		},
+	})
+	require.NoError(t, err)
+
+	recorderMetadata.AssertExpectations(t)
+	sessionSummarizer.AssertExpectations(t)
+}
+
+type fakeRecordingMetadata struct {
+	mock.Mock
+}
+
+func (f *fakeRecordingMetadata) ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error {
+	args := f.Called(ctx, sessionID, duration)
+	return args.Error(0)
+}
+
+type fakeSummarizer struct {
+	mock.Mock
+}
+
+func (f *fakeSummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *apievents.SessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *apievents.DatabaseSessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	args := f.Called(ctx, sessionID)
+	return args.Error(0)
+}
+
+func newServiceAuthCtx() authz.Context {
+	return authz.Context{
+		Identity: authz.BuiltinRole{
+			Role: types.RoleProxy,
+		},
+		UnmappedIdentity: authz.BuiltinRole{
+			Role: types.RoleProxy,
+		},
+	}
+}
diff --git a/lib/auth/recordingmetadata/provider.go b/lib/auth/recordingmetadata/provider.go
new file mode 100644
index 0000000000000..ed6e461156e1d
--- /dev/null
+++ b/lib/auth/recordingmetadata/provider.go
@@ -0,0 +1,81 @@
+/**
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more metadata.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadata
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// Provider provides a reference to a recording metadata Service
+// that can be used to process session recordings.
+//
+// The actual metadata service has to be created after the
+// lib/events.ProtoStreamer, as the metadata service depends on the streamer
+// for loading session recordings, however, the streamer depends on the metadata
+// service, as it needs to call it when the upload finishes.
+type Provider struct {
+	metadata Service
+	mu       sync.Mutex
+}
+
+// Service provides the configured [Service]. It is safe to
+// call this function from any thread. The returned [Service] is
+// guaranteed to never be nil.
+func (p *Provider) Service() Service {
+	if p == nil {
+		return noopRecordingMetadata{}
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.metadata == nil {
+		return noopRecordingMetadata{}
+	}
+
+	return p.metadata
+}
+
+// SetService sets the metadata service to be provided. It is safe to call
+// this function from any thread.
+func (p *Provider) SetService(s Service) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.metadata = s
+}
+
+// NewProvider creates a new [Provider] without the metadata service set.
+func NewProvider() *Provider {
+	sp := &Provider{}
+	sp.SetService(noopRecordingMetadata{})
+	return sp
+}
+
+// noopRecordingMetadata is a no-op implementation of the [Service]
+// interface.
+type noopRecordingMetadata struct{}
+
+// ProcessSessionRecording is a no-op implementation of the
+// [Service.ProcessSessionRecording] method.
+func (n noopRecordingMetadata) ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error {
+	return nil
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/membuffer.go b/lib/auth/recordingmetadata/recordingmetadatav1/membuffer.go
new file mode 100644
index 0000000000000..35aa6a9aa9c96
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/membuffer.go
@@ -0,0 +1,55 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"sync"
+
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+)
+
+// memBuffer is an in-memory byte buffer that implements both io.Writer and
+// io.WriterAt interfaces.
+type memBuffer struct {
+	buf manager.WriteAtBuffer
+	// mu is a mutex to protect concurrent writes to the buffer. Even though the
+	// underlying buffer is thread-safe, we need to prevent a race condition in
+	// [memBuffer.Write] between checking the length of the buffer and writing to
+	// it.
+	mu sync.Mutex
+}
+
+func (b *memBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.WriteAt(p, int64(len(b.buf.Bytes())))
+}
+
+func (b *memBuffer) WriteAt(p []byte, pos int64) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.WriteAt(p, pos)
+}
+
+// Bytes return the underlying byte slice.
+func (b *memBuffer) Bytes() []byte {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Bytes()
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/metrics.go b/lib/auth/recordingmetadata/recordingmetadatav1/metrics.go
new file mode 100644
index 0000000000000..0529c9f5da4da
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/metrics.go
@@ -0,0 +1,56 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+)
+
+const subsystem = "recording_metadata"
+
+var sessionsProcessedMetric = prometheus.NewCounterVec(prometheus.CounterOpts{
+	Namespace: teleport.MetricNamespace,
+	Subsystem: subsystem,
+	Name:      "sessions_processed_total",
+	Help:      "Total number of session recordings processed, with success or failure",
+}, []string{"success"})
+
+var sessionsProcessingMetric = prometheus.NewGauge(prometheus.GaugeOpts{
+	Namespace: teleport.MetricNamespace,
+	Subsystem: subsystem,
+	Name:      "sessions_processing_total",
+	Help:      "Number of session recordings being processed",
+})
+
+var sessionsPendingMetric = prometheus.NewGauge(prometheus.GaugeOpts{
+	Namespace: teleport.MetricNamespace,
+	Subsystem: subsystem,
+	Name:      "sessions_pending_total",
+	Help:      "Number of sessions waiting to be processed",
+})
+
+func init() {
+	metrics.RegisterPrometheusCollectors(
+		sessionsProcessedMetric,
+		sessionsProcessingMetric,
+	)
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata.go b/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata.go
new file mode 100644
index 0000000000000..cdf0d8715ba3b
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata.go
@@ -0,0 +1,538 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"math"
+	"math/rand/v2"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hinshun/vt10x"
+	"golang.org/x/sync/semaphore"
+	"google.golang.org/protobuf/encoding/protodelim"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/player"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/terminal"
+)
+
+// UploadHandler uploads session recording metadata and thumbnails.
+type UploadHandler interface {
+	// UploadMetadata uploads session metadata and returns a URL with the uploaded
+	// file in case of success. Session metadata is a file with a [recordingmetadatav1.SessionRecordingMetadata]
+	// protobuf message containing info about the session (duration, events, etc), as well as
+	// multiple [recordingmetadatav1.SessionRecordingThumbnail] messages (thumbnails).
+	UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error)
+	// UploadThumbnail uploads a session thumbnail and returns a URL with uploaded
+	// file in case of success. A thumbnail is [recordingmetadatav1.SessionRecordingThumbnail]
+	// protobuf message which contains the thumbnail as an SVG, and some basic details about the
+	// state of the terminal at the time of the thumbnail capture (terminal size, cursor position).
+	UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error)
+}
+
+// RecordingMetadataService processes session recordings to generate metadata and thumbnails.
+type RecordingMetadataService struct {
+	logger             *slog.Logger
+	streamer           player.Streamer
+	uploadHandler      UploadHandler
+	concurrencyLimiter *semaphore.Weighted
+	encrypter          events.EncryptionWrapper
+}
+
+// RecordingMetadataServiceConfig defines the configuration for the RecordingMetadataService.
+type RecordingMetadataServiceConfig struct {
+	// Streamer is used to stream session events.
+	Streamer player.Streamer
+	// UploadHandler is used to upload session metadata and thumbnails.
+	UploadHandler UploadHandler
+	// Encrypter is used to encrypt session metadata and thumbnails.
+	Encrypter events.EncryptionWrapper
+}
+
+const (
+	// inactivityThreshold is the duration after which an inactivity event is recorded.
+	inactivityThreshold = 10 * time.Second
+
+	// maxThumbnails is the maximum number of thumbnails to store in the session metadata.
+	maxThumbnails = 1000
+
+	// concurrencyLimit limits the number of concurrent processing operations (matches the session summarizer).
+	concurrencyLimit = 150
+)
+
+// NewRecordingMetadataService creates a new instance of RecordingMetadataService with the provided configuration.
+func NewRecordingMetadataService(cfg RecordingMetadataServiceConfig) (*RecordingMetadataService, error) {
+	if cfg.Streamer == nil {
+		return nil, trace.BadParameter("streamer is required")
+	}
+	if cfg.UploadHandler == nil {
+		return nil, trace.BadParameter("downloadHandler is required")
+	}
+
+	return &RecordingMetadataService{
+		streamer:           cfg.Streamer,
+		uploadHandler:      cfg.UploadHandler,
+		logger:             slog.With(teleport.ComponentKey, "recording_metadata"),
+		concurrencyLimiter: semaphore.NewWeighted(concurrencyLimit),
+		encrypter:          cfg.Encrypter,
+	}, nil
+}
+
+// ProcessSessionRecording processes the session recording associated with the provided session ID.
+// It streams session events, generates metadata, and uploads thumbnails and metadata.
+func (s *RecordingMetadataService) ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error {
+	sessionsPendingMetric.Inc()
+
+	if err := s.concurrencyLimiter.Acquire(ctx, 1); err != nil {
+		sessionsPendingMetric.Dec()
+		return trace.Wrap(err)
+	}
+	defer s.concurrencyLimiter.Release(1)
+
+	sessionsPendingMetric.Dec()
+
+	sessionsProcessingMetric.Inc()
+	defer sessionsProcessingMetric.Dec()
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	evts, errors := s.streamer.StreamSessionEvents(ctx, sessionID, 0)
+
+	var startTime time.Time
+	var lastEvent apievents.AuditEvent
+	var lastActivityTime time.Time
+	var lastThumbnailTime time.Time
+
+	activeUsers := make(map[string]time.Duration)
+
+	vt := vt10x.New()
+
+	metadata := &pb.SessionRecordingMetadata{}
+
+	addInactivityEvent := func(start, end time.Time) {
+		inactivityStart := durationpb.New(start.Sub(startTime))
+		inactivityEnd := durationpb.New(end.Sub(startTime))
+
+		metadata.Events = append(metadata.Events, &pb.SessionRecordingEvent{
+			StartOffset: inactivityStart,
+			EndOffset:   inactivityEnd,
+			Event: &pb.SessionRecordingEvent_Inactivity{
+				Inactivity: &pb.SessionRecordingInactivityEvent{},
+			},
+		})
+	}
+
+	// will either finish the upload or cancel it if exited early
+	var finish sync.Once
+
+	w, cancelUpload, uploadErrs := s.startUpload(ctx, sessionID)
+	select {
+	case err := <-uploadErrs:
+		return trace.Wrap(err)
+	default:
+	}
+	defer func() {
+		finish.Do(func() {
+			cancelUpload()
+			w.Close()
+		})
+	}()
+
+	interval := calculateThumbnailInterval(duration, maxThumbnails)
+	thumbnailTime := getRandomThumbnailTime(duration)
+
+	// the thumbnail to upload for the session
+	var recordingThumbnail *pb.SessionRecordingThumbnail
+
+	recordThumbnail := func(start time.Time) {
+		cols, rows := vt.Size()
+		cursor := vt.Cursor()
+
+		startOffset := start.Sub(startTime)
+		endOffset := start.Add(interval).Add(-1 * time.Millisecond).Sub(startTime)
+
+		thumbnail := &pb.SessionRecordingThumbnail{
+			Svg:           terminal.VtToSvg(vt),
+			Cols:          int32(cols),
+			Rows:          int32(rows),
+			CursorX:       int32(cursor.X),
+			CursorY:       int32(cursor.Y),
+			CursorVisible: vt.CursorVisible(),
+			StartOffset:   durationpb.New(startOffset),
+			EndOffset:     durationpb.New(endOffset),
+		}
+
+		if _, err := protodelim.MarshalTo(w, thumbnail); err != nil {
+			// log the error but continue processing other thumbnails and the session metadata (metadata is more important)
+			s.logger.WarnContext(ctx, "Failed to marshal thumbnail entry",
+				"session_id", sessionID, "error", err)
+		}
+
+		if recordingThumbnail == nil {
+			recordingThumbnail = thumbnail
+
+			return
+		}
+
+		previousDiff := math.Abs(float64(thumbnailTime - recordingThumbnail.StartOffset.AsDuration()))
+		diff := math.Abs(float64(thumbnailTime - startOffset))
+
+		if diff < previousDiff {
+			// this thumbnail is closer to the ideal thumbnail time, use it instead
+			recordingThumbnail = thumbnail
+		}
+	}
+
+	var hasSeenPrintEvent bool
+
+loop:
+	for {
+		select {
+		case evt, ok := <-evts:
+			if !ok {
+				break loop
+			}
+
+			lastEvent = evt
+
+			switch e := evt.(type) {
+			case *apievents.DatabaseSessionStart, *apievents.WindowsDesktopSessionStart:
+				// Unsupported session recording types
+				return nil
+
+			case *apievents.Resize:
+				size, err := session.UnmarshalTerminalParams(e.TerminalSize)
+				if err != nil {
+					return trace.Wrap(err, "parsing terminal size %q for session %v", e.TerminalSize, sessionID)
+				}
+
+				// if we haven't seen a print event yet, update the starting size to the latest resize
+				// this handles cases where the initial terminal size is not 80x24 and is resized immediately
+				// before any output is printed
+				if !hasSeenPrintEvent {
+					metadata.StartCols = int32(size.W)
+					metadata.StartRows = int32(size.H)
+				}
+
+				metadata.Events = append(metadata.Events, &pb.SessionRecordingEvent{
+					StartOffset: durationpb.New(e.Time.Sub(startTime)),
+					Event: &pb.SessionRecordingEvent_Resize{
+						Resize: &pb.SessionRecordingResizeEvent{
+							Cols: int32(size.W),
+							Rows: int32(size.H),
+						},
+					},
+				})
+
+				vt.Resize(size.W, size.H)
+
+			case *apievents.SessionEnd:
+				if !lastActivityTime.IsZero() && e.Time.Sub(lastActivityTime) > inactivityThreshold {
+					addInactivityEvent(lastActivityTime, e.Time)
+				}
+
+				if e.Time.Sub(lastThumbnailTime) >= interval {
+					lastThumbnailTime = e.Time
+					recordThumbnail(e.Time)
+				}
+
+			case *apievents.SessionJoin:
+				activeUsers[e.User] = e.Time.Sub(startTime)
+
+			case *apievents.SessionLeave:
+				if joinTime, ok := activeUsers[e.User]; ok {
+					metadata.Events = append(metadata.Events, &pb.SessionRecordingEvent{
+						StartOffset: durationpb.New(joinTime),
+						EndOffset:   durationpb.New(e.Time.Sub(startTime)),
+						Event: &pb.SessionRecordingEvent_Join{
+							Join: &pb.SessionRecordingJoinEvent{
+								User: e.User,
+							},
+						},
+					})
+
+					delete(activeUsers, e.User)
+				}
+
+			case *apievents.SessionPrint:
+				// mark that we've seen the first print event so we don't update the starting size anymore
+				if !hasSeenPrintEvent {
+					hasSeenPrintEvent = true
+				}
+
+				if !lastActivityTime.IsZero() && e.Time.Sub(lastActivityTime) > inactivityThreshold {
+					addInactivityEvent(lastActivityTime, e.Time)
+				}
+
+				if _, err := vt.Write(e.Data); err != nil {
+					return trace.Errorf("writing data to terminal: %w", err)
+				}
+
+				if e.Time.Sub(lastThumbnailTime) >= interval {
+					lastThumbnailTime = e.Time
+					recordThumbnail(e.Time)
+				}
+
+				lastActivityTime = e.Time
+
+			case *apievents.SessionStart:
+				lastActivityTime = e.Time
+				startTime = e.Time
+
+				size, err := session.UnmarshalTerminalParams(e.TerminalSize)
+				if err != nil {
+					return trace.Wrap(err, "parsing terminal size %q for session %v", e.TerminalSize, sessionID)
+				}
+
+				// store the initial terminal size, this is typically 80:24 and is resized immediately
+				metadata.StartCols = int32(size.W)
+				metadata.StartRows = int32(size.H)
+
+				metadata.ClusterName = e.ClusterName
+				metadata.User = e.User
+
+				switch e.Protocol {
+				case events.EventProtocolSSH:
+					metadata.ResourceName = e.ServerHostname
+					metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_SSH
+
+				case events.EventProtocolKube:
+					metadata.ResourceName = e.KubernetesCluster
+					metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_KUBERNETES
+				}
+
+				vt.Resize(size.W, size.H)
+			}
+
+		case err := <-uploadErrs:
+			return trace.Wrap(err)
+
+		case err := <-errors:
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+
+	if lastEvent == nil {
+		return trace.NotFound("no events found for session %v", sessionID)
+	}
+
+	if recordingThumbnail != nil {
+		if err := s.uploadThumbnail(ctx, sessionID, recordingThumbnail); err != nil {
+			s.logger.WarnContext(ctx, "Failed to upload thumbnail",
+				"session_id", sessionID, "error", err)
+		}
+	}
+
+	// Finish off any remaining activity events
+	for user, userStartOffset := range activeUsers {
+		metadata.Events = append(metadata.Events, &pb.SessionRecordingEvent{
+			StartOffset: durationpb.New(userStartOffset),
+			EndOffset:   durationpb.New(lastEvent.GetTime().Sub(startTime)),
+			Event: &pb.SessionRecordingEvent_Join{
+				Join: &pb.SessionRecordingJoinEvent{
+					User: user,
+				},
+			},
+		})
+	}
+
+	metadata.Duration = durationpb.New(lastEvent.GetTime().Sub(startTime))
+	metadata.StartTime = timestamppb.New(startTime)
+	metadata.EndTime = timestamppb.New(lastEvent.GetTime())
+
+	if _, err := protodelim.MarshalTo(w, metadata); err != nil {
+		return trace.Wrap(err)
+	}
+
+	var err error
+
+	finish.Do(func() {
+		err = w.Close()
+
+		if err == nil {
+			err = <-uploadErrs
+		}
+	})
+
+	if err != nil {
+		sessionsProcessedMetric.WithLabelValues( /* success */ "false").Inc()
+
+		return trace.Wrap(err)
+	}
+
+	sessionsProcessedMetric.WithLabelValues( /* success */ "true").Inc()
+
+	return nil
+}
+
+func (s *RecordingMetadataService) startUpload(ctx context.Context, sessionID session.ID) (io.WriteCloser, context.CancelFunc, <-chan error) {
+	uploadCtx, cancel := context.WithCancel(ctx)
+	r, w := io.Pipe()
+	errs := make(chan error, 1)
+	var writer io.WriteCloser = w
+	if s.encrypter != nil {
+		// wrap the pipe writer with encryption
+		// WithEncryption will never close the underlying writer when the returned
+		// WriteCloser is closed, so we need to create a multiCloser to close both
+		// the encrypted writer and the pipe writer.
+		encrypted, err := s.encrypter.WithEncryption(uploadCtx, w)
+		switch {
+		case err == nil:
+			writer = &multiCloser{
+				WriteCloser: encrypted,
+				pipeCloser:  w,
+			}
+		case errors.Is(err, recordingencryption.ErrEncryptionDisabled):
+			// if encryption isn't enabled, do nothing
+		default:
+			cancel()
+			errs <- trace.Wrap(err, "starting recording encrypter")
+			return nil, nil, errs
+		}
+	}
+	go func() {
+		defer r.Close()
+
+		path, err := s.uploadHandler.UploadMetadata(uploadCtx, sessionID, r)
+		if err != nil {
+			errs <- trace.Wrap(err)
+			return
+		}
+
+		s.logger.DebugContext(ctx, "Uploaded session recording metadata", "path", path)
+		errs <- nil
+	}()
+
+	return writer, cancel, errs
+}
+
+// multiCloser is an io.WriteCloser that closes the underlying
+// WriteCloser and an additional Closer.
+type multiCloser struct {
+	io.WriteCloser
+	pipeCloser io.Closer
+}
+
+func (m *multiCloser) Close() error {
+	// flush the encryption writer and close the pipe
+	errEncryption := m.WriteCloser.Close()
+	errPipe := m.pipeCloser.Close()
+	return trace.NewAggregate(errEncryption, errPipe)
+}
+
+func (s *RecordingMetadataService) uploadThumbnail(ctx context.Context, sessionID session.ID, thumbnail *pb.SessionRecordingThumbnail) error {
+	if thumbnail == nil {
+		return nil
+	}
+
+	b, err := proto.Marshal(thumbnail)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var buf io.Reader = bytes.NewReader(b)
+	if s.encrypter != nil {
+		writeBuffer := bytes.NewBuffer(nil)
+		encryptedWriter, err := s.encrypter.WithEncryption(ctx, &nopCloser{writeBuffer})
+		switch {
+		case err == nil:
+			if _, err := io.Copy(encryptedWriter, buf); err != nil {
+				encryptedWriter.Close()
+				return trace.Wrap(err)
+			}
+			if err := encryptedWriter.Close(); err != nil {
+				return trace.Wrap(err)
+			}
+			buf = writeBuffer
+		case errors.Is(err, recordingencryption.ErrEncryptionDisabled):
+			// if encryption isn't enabled, do nothing
+		default:
+			return trace.Wrap(err, "starting recording encrypter")
+		}
+	}
+
+	path, err := s.uploadHandler.UploadThumbnail(ctx, sessionID, buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s.logger.DebugContext(ctx, "Uploaded session recording thumbnail", "path", path)
+
+	return nil
+}
+
+type nopCloser struct {
+	io.Writer
+}
+
+func (n nopCloser) Close() error {
+	return nil
+}
+
+// getRandomThumbnailTime returns the ideal time offset for capturing a thumbnail
+// within the session duration based on the provided interval.
+// It avoids the first and last 20% of the session recording to increase the chances of
+// getting a thumbnail with meaningful content.
+func getRandomThumbnailTime(duration time.Duration) time.Duration {
+	minIndex := int(0.2 * float64(duration))
+	maxIndex := int(0.8 * float64(duration))
+
+	if maxIndex <= minIndex {
+		return duration / 2
+	}
+
+	return time.Duration(rand.IntN(maxIndex-minIndex) + minIndex)
+}
+
+func calculateThumbnailInterval(duration time.Duration, maxThumbnails int) time.Duration {
+	interval := time.Second
+
+	if duration > time.Duration(maxThumbnails)*time.Second {
+		interval = duration / time.Duration(maxThumbnails)
+	}
+
+	interval = interval.Round(time.Second)
+
+	if interval < time.Second {
+		interval = time.Second
+	}
+
+	return interval
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata_test.go b/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata_test.go
new file mode 100644
index 0000000000000..8947451b98bea
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/recordingmetadata_test.go
@@ -0,0 +1,897 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestProcessSessionRecording(t *testing.T) {
+	startTime := time.Now()
+
+	tests := []struct {
+		name               string
+		events             []apievents.AuditEvent
+		expectError        bool
+		expectedThumbnails func(t *testing.T, thumbnailData []byte)
+		expectedMetadata   func(t *testing.T, metadata *pb.SessionRecordingMetadata)
+		expectedFrames     func(t *testing.T, frames []*pb.SessionRecordingThumbnail)
+	}{
+		{
+			name:   "basic session with print events",
+			events: generateBasicSession(startTime),
+			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
+				require.NotNil(t, metadata)
+				require.NotNil(t, metadata.Duration)
+				require.Equal(t, int32(80), metadata.StartCols)
+				require.Equal(t, int32(24), metadata.StartRows)
+			},
+			expectedFrames: func(t *testing.T, frames []*pb.SessionRecordingThumbnail) {
+				require.NotEmpty(t, frames)
+			},
+			expectedThumbnails: func(t *testing.T, thumbnailData []byte) {
+				var thumbnail pb.SessionRecordingThumbnail
+				err := proto.Unmarshal(thumbnailData, &thumbnail)
+				require.NoError(t, err)
+				require.NotEmpty(t, thumbnail.Svg)
+			},
+		},
+		{
+			name:   "basic session with print events with immediate resize after start",
+			events: generateBasicSessionWithImmediateResize(startTime),
+			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
+				require.NotNil(t, metadata)
+				require.NotNil(t, metadata.Duration)
+				require.Equal(t, int32(100), metadata.StartCols)
+				require.Equal(t, int32(30), metadata.StartRows)
+			},
+			expectedFrames: func(t *testing.T, frames []*pb.SessionRecordingThumbnail) {
+				require.NotEmpty(t, frames)
+			},
+			expectedThumbnails: func(t *testing.T, thumbnailData []byte) {
+				var thumbnail pb.SessionRecordingThumbnail
+				err := proto.Unmarshal(thumbnailData, &thumbnail)
+				require.NoError(t, err)
+				require.NotEmpty(t, thumbnail.Svg)
+			},
+		},
+		{
+			name:   "session with resize events",
+			events: generateSessionWithResize(startTime),
+			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
+				require.NotNil(t, metadata)
+
+				var hasResize bool
+				for _, event := range metadata.Events {
+					if resize := event.GetResize(); resize != nil {
+						hasResize = true
+						require.Equal(t, int32(120), resize.Cols)
+						require.Equal(t, int32(40), resize.Rows)
+					}
+				}
+				require.True(t, hasResize, "expected resize event")
+			},
+		},
+		{
+			name:   "session with inactivity periods",
+			events: generateSessionWithInactivity(startTime),
+			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
+				require.NotNil(t, metadata)
+
+				var hasInactivity bool
+				for _, event := range metadata.Events {
+					if event.GetInactivity() != nil {
+						hasInactivity = true
+						require.NotNil(t, event.StartOffset)
+						require.NotNil(t, event.EndOffset)
+					}
+				}
+				require.True(t, hasInactivity, "expected inactivity event")
+			},
+		},
+		{
+			name:   "session with join and leave events",
+			events: generateSessionWithJoinLeave(startTime),
+			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
+				require.NotNil(t, metadata)
+
+				joinUsers := make(map[string]bool)
+				for _, event := range metadata.Events {
+					if join := event.GetJoin(); join != nil {
+						joinUsers[join.User] = true
+					}
+				}
+				require.True(t, joinUsers["alice"], "expected alice join event")
+				require.True(t, joinUsers["bob"], "expected bob join event")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sessionID := session.NewID()
+
+			streamer := &mockStreamer{
+				events:       tt.events,
+				errorOnEvent: -1,
+			}
+			uploadHandler := newMockUploadHandler()
+
+			service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+				Streamer:      streamer,
+				UploadHandler: uploadHandler,
+			})
+			require.NoError(t, err)
+
+			lastEventTime := tt.events[len(tt.events)-1].GetTime()
+
+			err = service.ProcessSessionRecording(t.Context(), sessionID, lastEventTime.Sub(startTime))
+
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				uploadHandler.mu.Lock()
+				metadataData, ok := uploadHandler.metadata[string(sessionID)]
+				uploadHandler.mu.Unlock()
+				require.True(t, ok, "metadata should be uploaded")
+
+				metadata, frames, err := unmarshalMetadata(metadataData)
+				require.NoError(t, err)
+
+				if tt.expectedMetadata != nil {
+					tt.expectedMetadata(t, metadata)
+				}
+
+				if tt.expectedFrames != nil {
+					tt.expectedFrames(t, frames)
+				}
+
+				uploadHandler.mu.Lock()
+				thumbnailData, ok := uploadHandler.thumbnails[string(sessionID)]
+				uploadHandler.mu.Unlock()
+				if ok && tt.expectedThumbnails != nil {
+					tt.expectedThumbnails(t, thumbnailData)
+				}
+			}
+		})
+	}
+}
+
+func TestProcessSessionRecording_StreamError(t *testing.T) {
+	sessionID := session.NewID()
+
+	streamer := &mockStreamerErrorOnly{
+		err: errors.New("stream error"),
+	}
+	uploadHandler := newMockUploadHandler()
+
+	service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+		Streamer:      streamer,
+		UploadHandler: uploadHandler,
+	})
+	require.NoError(t, err)
+
+	err = service.ProcessSessionRecording(t.Context(), sessionID, 10*time.Second)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "stream error")
+}
+
+func TestProcessSessionRecording_UploadError(t *testing.T) {
+	startTime := time.Now()
+	sessionID := session.NewID()
+
+	streamer := &mockStreamer{
+		events:       generateBasicSession(startTime),
+		errorOnEvent: -1,
+	}
+	uploadHandler := newMockUploadHandler()
+	uploadHandler.uploadError = errors.New("upload failed")
+
+	service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+		Streamer:      streamer,
+		UploadHandler: uploadHandler,
+	})
+	require.NoError(t, err)
+
+	err = service.ProcessSessionRecording(t.Context(), sessionID, 10*time.Second)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "upload failed")
+}
+
+func TestProcessSessionRecording_ContextCancellation(t *testing.T) {
+	sessionID := session.NewID()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	streamer := newMockStreamerNeverSends()
+
+	uploadHandler := newMockUploadHandler()
+
+	service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+		Streamer:      streamer,
+		UploadHandler: uploadHandler,
+	})
+	require.NoError(t, err)
+
+	processDone := make(chan error, 1)
+	go func() {
+		processDone <- service.ProcessSessionRecording(ctx, sessionID, 10*time.Second)
+	}()
+
+	streamer.WaitUntilBlocking()
+
+	cancel()
+
+	select {
+	case err := <-processDone:
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(5 * time.Second):
+		t.Fatal("test timed out - ProcessSessionRecording did not exit after context cancellation")
+	}
+}
+
+func TestProcessSessionRecording_UnsupportedSessionTypes(t *testing.T) {
+	startTime := time.Now()
+	sessionID := session.NewID()
+
+	tests := []struct {
+		name   string
+		events []apievents.AuditEvent
+	}{
+		{
+			name: "database session",
+			events: []apievents.AuditEvent{
+				&apievents.DatabaseSessionStart{
+					Metadata: apievents.Metadata{
+						Type: "db.session.start",
+						Time: startTime,
+					},
+				},
+			},
+		},
+		{
+			name: "windows desktop session",
+			events: []apievents.AuditEvent{
+				&apievents.WindowsDesktopSessionStart{
+					Metadata: apievents.Metadata{
+						Type: "windows.desktop.session.start",
+						Time: startTime,
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			streamer := &mockStreamer{
+				events:       tt.events,
+				errorOnEvent: -1,
+			}
+			uploadHandler := newMockUploadHandler()
+
+			service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+				Streamer:      streamer,
+				UploadHandler: uploadHandler,
+			})
+			require.NoError(t, err)
+
+			err = service.ProcessSessionRecording(t.Context(), sessionID, 10*time.Second)
+
+			require.NoError(t, err)
+
+			uploadHandler.mu.Lock()
+			metadataLen := len(uploadHandler.metadata)
+			thumbnailsLen := len(uploadHandler.thumbnails)
+			uploadHandler.mu.Unlock()
+
+			require.Equal(t, 0, metadataLen, "metadata should be empty")
+			require.Equal(t, 0, thumbnailsLen, "thumbnails should be empty")
+		})
+	}
+}
+
+func TestProcessSessionRecording_MalformedResizeEvent(t *testing.T) {
+	startTime := time.Now()
+	sessionID := session.NewID()
+
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(1 * time.Second),
+			},
+			Data: []byte("Hello\n"),
+		},
+		&apievents.Resize{
+			Metadata: apievents.Metadata{
+				Type: "resize",
+				Time: startTime.Add(2 * time.Second),
+			},
+			TerminalSize: "invalid:terminal:size",
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(10 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(10 * time.Second),
+		},
+	}
+
+	streamer := &mockStreamer{
+		events:       events,
+		errorOnEvent: -1,
+	}
+	uploadHandler := newMockUploadHandler()
+
+	service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+		Streamer:      streamer,
+		UploadHandler: uploadHandler,
+	})
+	require.NoError(t, err)
+
+	err = service.ProcessSessionRecording(t.Context(), sessionID, 10*time.Second)
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "parsing terminal size")
+
+	uploadHandler.mu.Lock()
+	defer uploadHandler.mu.Unlock()
+
+	require.Empty(t, uploadHandler.metadata, "no metadata should be uploaded after cancelUpload")
+}
+
+func TestProcessSessionRecording_UploadFailsDuringProcessing(t *testing.T) {
+	startTime := time.Now()
+	sessionID := session.NewID()
+
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(1 * time.Second),
+			},
+			Data: []byte("Hello\n"),
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(2 * time.Second),
+			},
+			Data: []byte("World\n"),
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(10 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(10 * time.Second),
+		},
+	}
+
+	streamer := &mockStreamer{
+		events:       events,
+		errorOnEvent: -1,
+	}
+
+	uploadHandler := &mockUploadHandlerFailAfterRead{
+		failAfterBytes: 10,
+	}
+
+	service, err := NewRecordingMetadataService(RecordingMetadataServiceConfig{
+		Streamer:      streamer,
+		UploadHandler: uploadHandler,
+	})
+	require.NoError(t, err)
+
+	err = service.ProcessSessionRecording(t.Context(), sessionID, 10*time.Second)
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "simulated upload failure")
+}
+
+// mockUploadHandlerFailAfterRead simulates an upload failure after reading some bytes
+type mockUploadHandlerFailAfterRead struct {
+	failAfterBytes int
+	bytesRead      int
+	mu             sync.Mutex
+}
+
+func (m *mockUploadHandlerFailAfterRead) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	buf := make([]byte, 1024)
+	for {
+		select {
+		case <-ctx.Done():
+			// Drain the reader and return the context error
+			_, _ = io.Copy(io.Discard, reader)
+			return "", ctx.Err()
+		default:
+		}
+
+		n, err := reader.Read(buf)
+		if n > 0 {
+			m.mu.Lock()
+			m.bytesRead += n
+			shouldFail := m.bytesRead >= m.failAfterBytes
+			m.mu.Unlock()
+
+			if shouldFail {
+				_, _ = io.Copy(io.Discard, reader)
+				return "", errors.New("simulated upload failure")
+			}
+		}
+
+		if errors.Is(err, io.EOF) {
+			return "metadata/success", nil
+		}
+
+		if err != nil {
+			return "", err
+		}
+	}
+}
+
+func (m *mockUploadHandlerFailAfterRead) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return "thumbnail/success", nil
+}
+
+func generateBasicSessionWithImmediateResize(startTime time.Time) []apievents.AuditEvent {
+	events := generateBasicSession(startTime)
+
+	// Insert a resize event immediately after session start
+	resizeEvent := &apievents.Resize{
+		Metadata: apievents.Metadata{
+			Type: "resize",
+			Time: startTime.Add(500 * time.Millisecond),
+		},
+		TerminalSize: "100:30",
+	}
+
+	events = append([]apievents.AuditEvent{events[0], resizeEvent}, events[1:]...)
+
+	return events
+}
+
+func generateBasicSession(startTime time.Time) []apievents.AuditEvent {
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(1 * time.Second),
+			},
+			Data: []byte("Hello World\n"),
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(2 * time.Second),
+			},
+			Data: []byte("$ ls -la\n"),
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(10 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(10 * time.Second),
+		},
+	}
+	return events
+}
+
+func generateSessionWithResize(startTime time.Time) []apievents.AuditEvent {
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(1 * time.Second),
+			},
+			Data: []byte("Initial output\n"),
+		},
+		&apievents.Resize{
+			Metadata: apievents.Metadata{
+				Type: "resize",
+				Time: startTime.Add(2 * time.Second),
+			},
+			TerminalSize: "120:40",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(3 * time.Second),
+			},
+			Data: []byte("After resize\n"),
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(10 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(10 * time.Second),
+		},
+	}
+	return events
+}
+
+func generateSessionWithInactivity(startTime time.Time) []apievents.AuditEvent {
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(1 * time.Second),
+			},
+			Data: []byte("Active\n"),
+		},
+		// 20 second gap
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(21 * time.Second),
+			},
+			Data: []byte("After inactivity\n"),
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(20 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(20 * time.Second),
+		},
+	}
+	return events
+}
+
+func generateSessionWithJoinLeave(startTime time.Time) []apievents.AuditEvent {
+	events := []apievents.AuditEvent{
+		&apievents.SessionStart{
+			Metadata: apievents.Metadata{
+				Type: "session.start",
+				Time: startTime,
+			},
+			TerminalSize: "80:24",
+		},
+		&apievents.SessionJoin{
+			Metadata: apievents.Metadata{
+				Type: "session.join",
+				Time: startTime.Add(2 * time.Second),
+			},
+			UserMetadata: apievents.UserMetadata{
+				User: "alice",
+			},
+		},
+		&apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Type: "print",
+				Time: startTime.Add(3 * time.Second),
+			},
+			Data: []byte("Alice joined\n"),
+		},
+		&apievents.SessionJoin{
+			Metadata: apievents.Metadata{
+				Type: "session.join",
+				Time: startTime.Add(4 * time.Second),
+			},
+			UserMetadata: apievents.UserMetadata{
+				User: "bob",
+			},
+		},
+		&apievents.SessionLeave{
+			Metadata: apievents.Metadata{
+				Type: "session.leave",
+				Time: startTime.Add(6 * time.Second),
+			},
+			UserMetadata: apievents.UserMetadata{
+				User: "alice",
+			},
+		},
+		&apievents.SessionEnd{
+			Metadata: apievents.Metadata{
+				Type: "session.end",
+				Time: startTime.Add(10 * time.Second),
+			},
+			StartTime: startTime,
+			EndTime:   startTime.Add(10 * time.Second),
+		},
+	}
+	return events
+}
+
+func unmarshalMetadata(data []byte) (*pb.SessionRecordingMetadata, []*pb.SessionRecordingThumbnail, error) {
+	reader := bufio.NewReader(bytes.NewReader(data))
+
+	var metadata *pb.SessionRecordingMetadata
+	var frames []*pb.SessionRecordingThumbnail
+
+	for {
+		msgBytes, err := readDelimitedMessage(reader)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+		}
+
+		var m pb.SessionRecordingMetadata
+		if err := proto.Unmarshal(msgBytes, &m); err == nil {
+			metadata = &m
+
+			continue
+		}
+
+		var f pb.SessionRecordingThumbnail
+		if err := proto.Unmarshal(msgBytes, &f); err == nil {
+			frames = append(frames, &f)
+			continue
+		}
+
+		return nil, nil, trace.BadParameter("failed to parse message as metadata or thumbnail")
+	}
+
+	return metadata, frames, nil
+}
+
+// mockStreamer implements player.Streamer for testing
+type mockStreamer struct {
+	events       []apievents.AuditEvent
+	errorOnEvent int
+	err          error
+}
+
+func (m *mockStreamer) StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
+	errors := make(chan error, 1)
+	events := make(chan apievents.AuditEvent)
+
+	go func() {
+		defer close(events)
+		defer close(errors)
+
+		for i, evt := range m.events {
+			if m.errorOnEvent == i {
+				errors <- m.err
+				return
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case events <- evt:
+			}
+		}
+	}()
+
+	return events, errors
+}
+
+// mockStreamerErrorOnly immediately sends an error without any events
+type mockStreamerErrorOnly struct {
+	err error
+}
+
+func (m *mockStreamerErrorOnly) StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
+	errors := make(chan error, 1)
+	events := make(chan apievents.AuditEvent)
+
+	go func() {
+		errors <- m.err
+	}()
+
+	return events, errors
+}
+
+// mockStreamerNeverSends never sends any events - just blocks immediately
+type mockStreamerNeverSends struct {
+	called chan struct{}
+}
+
+func newMockStreamerNeverSends() *mockStreamerNeverSends {
+	return &mockStreamerNeverSends{called: make(chan struct{})}
+}
+
+func (m *mockStreamerNeverSends) StreamSessionEvents(ctx context.Context, _ session.ID, _ int64) (chan apievents.AuditEvent, chan error) {
+	evts := make(chan apievents.AuditEvent)
+	errs := make(chan error, 1)
+
+	close(m.called)
+
+	go func() {
+		<-ctx.Done()
+
+		errs <- ctx.Err()
+
+		close(errs)
+	}()
+
+	return evts, errs
+}
+
+func (m *mockStreamerNeverSends) WaitUntilBlocking() {
+	<-m.called
+}
+
+// mockUploadHandler implements events.UploadHandler for testing
+type mockUploadHandler struct {
+	metadata       map[string][]byte
+	thumbnails     map[string][]byte
+	uploadError    error
+	metadataPaths  map[string]string
+	thumbnailPaths map[string]string
+	mu             sync.Mutex
+}
+
+func newMockUploadHandler() *mockUploadHandler {
+	return &mockUploadHandler{
+		metadata:       make(map[string][]byte),
+		thumbnails:     make(map[string][]byte),
+		metadataPaths:  make(map[string]string),
+		thumbnailPaths: make(map[string]string),
+	}
+}
+
+func (m *mockUploadHandler) Upload(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return "", nil
+}
+
+func (m *mockUploadHandler) UploadSummary(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error) {
+	return "", nil
+}
+
+func (m *mockUploadHandler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	data, err := io.ReadAll(reader)
+	if err != nil {
+		return "", err
+	}
+
+	if m.uploadError != nil {
+		return "", m.uploadError
+	}
+
+	select {
+	case <-ctx.Done():
+		return "", ctx.Err()
+	default:
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	path := "metadata/" + string(sessionID)
+	m.metadata[string(sessionID)] = data
+	m.metadataPaths[string(sessionID)] = path
+	return path, nil
+}
+
+func (m *mockUploadHandler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	if m.uploadError != nil {
+		return "", m.uploadError
+	}
+
+	data, err := io.ReadAll(reader)
+	if err != nil {
+		return "", err
+	}
+
+	select {
+	case <-ctx.Done():
+		return "", ctx.Err()
+	default:
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	path := "thumbnail/" + string(sessionID)
+	m.thumbnails[string(sessionID)] = data
+	m.thumbnailPaths[string(sessionID)] = path
+	return path, nil
+}
+
+func (m *mockUploadHandler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return nil
+}
+
+func (m *mockUploadHandler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return nil
+}
+
+func (m *mockUploadHandler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return nil
+}
+
+func (m *mockUploadHandler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return nil
+}
+
+func (m *mockUploadHandler) Complete(ctx context.Context, upload events.StreamUpload) error {
+	return nil
+}
+
+func (m *mockUploadHandler) Reserve(ctx context.Context, upload events.StreamUpload) error {
+	return nil
+}
+
+func (m *mockUploadHandler) ListUploads(ctx context.Context) ([]events.StreamUpload, error) {
+	return nil, nil
+}
+
+func (m *mockUploadHandler) ListParts(ctx context.Context, upload events.StreamUpload) ([]events.StreamPart, error) {
+	return nil, nil
+}
+
+func (m *mockUploadHandler) UploadPart(ctx context.Context, upload events.StreamUpload, partNumber int64, partBody io.ReadSeeker) (*events.StreamPart, error) {
+	return nil, nil
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/service.go b/lib/auth/recordingmetadata/recordingmetadatav1/service.go
new file mode 100644
index 0000000000000..5237da4c01610
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/service.go
@@ -0,0 +1,240 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/gravitational/teleport"
+	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/player"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// Service implements the RecordingMetadataServiceServer interface, providing methods to retrieve session recording
+// metadata and thumbnails.
+type Service struct {
+	pb.UnimplementedRecordingMetadataServiceServer
+
+	authorizer      Authorizer
+	streamer        player.Streamer
+	downloadHandler DownloadHandler
+	decrypter       events.DecryptionWrapper
+	logger          *slog.Logger
+}
+
+// Authorizer is an interface that defines the method for authorizing access to session recordings.
+type Authorizer interface {
+	// Authorize checks if the user has permission to access the session recording, called with the session ID.
+	Authorize(context.Context, string) error
+}
+
+// DownloadHandler downloads session recording metadata and thumbnails.
+type DownloadHandler interface {
+	// DownloadMetadata downloads session metadata and writes it to a writer.
+	DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error
+	// DownloadThumbnail downloads a session thumbnail and writes it to a writer.
+	DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error
+}
+
+// ServiceConfig holds the configuration for the recording metadata service.
+type ServiceConfig struct {
+	// Authorizer is used to check if the user has permission to access the session recording.
+	Authorizer Authorizer
+	// Streamer is used to stream session recordings.
+	Streamer player.Streamer
+	// DownloadHandler is used to handle uploads and downloads of session recording metadata and thumbnails.
+	DownloadHandler DownloadHandler
+	// Decrypter is used to decrypt session metadata and thumbnails.
+	Decrypter events.DecryptionWrapper
+}
+
+// NewService creates a new instance of the recording metadata service.
+func NewService(cfg ServiceConfig) (*Service, error) {
+	if cfg.Authorizer == nil {
+		return nil, trace.BadParameter("authorizer is required")
+	}
+	if cfg.DownloadHandler == nil {
+		return nil, trace.BadParameter("upload handler is required")
+	}
+
+	return &Service{
+		authorizer:      cfg.Authorizer,
+		streamer:        cfg.Streamer,
+		downloadHandler: cfg.DownloadHandler,
+		logger:          slog.With(teleport.ComponentKey, "recording_metadata"),
+		decrypter:       cfg.Decrypter,
+	}, nil
+}
+
+// GetThumbnail retrieves the thumbnail for a session recording.
+func (r *Service) GetThumbnail(ctx context.Context, req *pb.GetThumbnailRequest) (*pb.GetThumbnailResponse, error) {
+	// Authorize will have checked the session end event to ensure the user has access to the session recording.
+	if err := r.authorizer.Authorize(ctx, req.SessionId); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	buf := &memBuffer{}
+	err := r.downloadHandler.DownloadThumbnail(ctx, session.ID(req.SessionId), buf)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	payload, err := r.decryptIfNeeded(ctx, buf.Bytes())
+	if err != nil {
+		return nil, trace.Wrap(err, "decrypting session recording thumbnail")
+	}
+
+	thumbnail := &pb.SessionRecordingThumbnail{}
+	err = proto.Unmarshal(payload, thumbnail)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &pb.GetThumbnailResponse{Thumbnail: thumbnail}, nil
+}
+
+// GetMetadata retrieves the metadata for a session recording, streaming it back in chunks (one for metadata and one
+// for each frame).
+func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStreamingServer[pb.GetMetadataResponseChunk]) error {
+	// Authorize will have checked the session end event to ensure the user has access to the session recording.
+	if err := r.authorizer.Authorize(stream.Context(), req.SessionId); err != nil {
+		return trace.Wrap(err)
+	}
+
+	buf := &memBuffer{}
+	err := r.downloadHandler.DownloadMetadata(stream.Context(), session.ID(req.SessionId), buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	payload, err := r.decryptIfNeeded(stream.Context(), buf.Bytes())
+	if err != nil {
+		return trace.Wrap(err, "decrypting session recording thumbnail")
+	}
+	reader := bufio.NewReader(bytes.NewReader(payload))
+
+	for {
+		msgBytes, err := readDelimitedMessage(reader)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			r.logger.ErrorContext(stream.Context(), "Failed to read delimited message",
+				"session_id", req.SessionId, "error", err)
+			return trace.Wrap(err)
+		}
+
+		// Try to decode as metadata
+		metadata := &pb.SessionRecordingMetadata{}
+		if err := proto.Unmarshal(msgBytes, metadata); err == nil {
+			metadataChunk := &pb.GetMetadataResponseChunk{
+				Chunk: &pb.GetMetadataResponseChunk_Metadata{
+					Metadata: metadata,
+				},
+			}
+
+			if err := stream.Send(metadataChunk); err != nil {
+				if !errors.Is(err, io.EOF) {
+					r.logger.ErrorContext(stream.Context(), "Failed to send session recording metadata",
+						"session_id", req.SessionId, "error", err)
+				}
+				return trace.Wrap(err)
+			}
+
+			continue
+		}
+
+		// Try to decode as thumbnail
+		thumbnail := &pb.SessionRecordingThumbnail{}
+		if err := proto.Unmarshal(msgBytes, thumbnail); err == nil {
+			frameChunk := &pb.GetMetadataResponseChunk{
+				Chunk: &pb.GetMetadataResponseChunk_Frame{
+					Frame: thumbnail,
+				},
+			}
+
+			if err := stream.Send(frameChunk); err != nil {
+				if !errors.Is(err, io.EOF) {
+					r.logger.ErrorContext(stream.Context(), "Failed to send session recording thumbnail",
+						"session_id", req.SessionId, "error", err)
+				}
+				return trace.Wrap(err)
+			}
+
+			continue
+		}
+
+		r.logger.ErrorContext(stream.Context(), "Failed to parse message as metadata or thumbnail",
+			"session_id", req.SessionId)
+
+		return trace.Errorf("unable to parse message as metadata or thumbnail")
+	}
+
+	return nil
+}
+
+// readDelimitedMessage reads a varint-prefixed protobuf message from the reader
+// and returns the raw message bytes.
+func readDelimitedMessage(r *bufio.Reader) ([]byte, error) {
+	var length uint64
+
+	// Read varint length prefix
+	for shift := uint(0); ; shift += 7 {
+		if shift >= 64 {
+			return nil, trace.BadParameter("varint too long")
+		}
+
+		b, err := r.ReadByte()
+		if err != nil {
+			return nil, err
+		}
+
+		length |= uint64(b&0x7F) << shift // Append 7 bits to length
+
+		if b&0x80 == 0 {
+			// MSB not set, end of varint
+			break
+		}
+	}
+
+	msgBytes := make([]byte, length)
+	if _, err := io.ReadFull(r, msgBytes); err != nil {
+		return nil, err
+	}
+
+	return msgBytes, nil
+}
+
+// decryptIfNeeded decrypts the data if it is encrypted. If the data is not encrypted, it is returned as-is.
+func (r *Service) decryptIfNeeded(ctx context.Context, data []byte) ([]byte, error) {
+	unencrypted, err := recordingencryption.DecryptBufferIfEncrypted(ctx, data, r.decrypter)
+	return unencrypted, trace.Wrap(err)
+}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go b/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go
new file mode 100644
index 0000000000000..4f0051cbc99ba
--- /dev/null
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go
@@ -0,0 +1,473 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadatav1
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/encoding/protodelim"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	recordingmetadatav1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestService_GetThumbnail(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	uploader := eventstest.NewMemoryUploader()
+
+	thumbnail := newThumbnail()
+
+	thumbnail.Svg = []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"50\" height=\"50\"><rect width=\"100%\" height=\"100%\" fill=\"red\"/></svg>")
+
+	err := uploadThumbnail(ctx, uploader, session.ID("test-session"), thumbnail)
+	require.NoError(t, err, "failed to upload thumbnail")
+
+	service := &Service{
+		authorizer:      &fakeAuthorizer{authorizedSessions: map[string]bool{"test-session": true}},
+		downloadHandler: uploader,
+	}
+
+	resp, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+		SessionId: "test-session",
+	})
+	require.NoError(t, err, "failed to get thumbnail")
+	require.NotNil(t, resp, "expected non-nil response")
+
+	require.Equal(t, thumbnail.Svg, resp.Thumbnail.Svg, "thumbnail SVG does not match expected value")
+}
+
+func TestService_GetThumbnailNotFound(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	uploader := eventstest.NewMemoryUploader()
+
+	service := &Service{
+		authorizer:      &fakeAuthorizer{authorizedSessions: map[string]bool{"test-session": true}},
+		downloadHandler: uploader,
+	}
+
+	_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+		SessionId: "test-session",
+	})
+	require.Error(t, err, "expected error for test session")
+	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+}
+
+func TestService_GetThumbnailAuthorized(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	authorizer := &fakeAuthorizer{
+		authorizedSessions: map[string]bool{
+			"allowed-session": true,
+			"test-session":    true,
+		},
+	}
+
+	uploader := eventstest.NewMemoryUploader()
+
+	allowedSessionThumbnail := newThumbnail()
+
+	err := uploadThumbnail(ctx, uploader, session.ID("allowed-session"), allowedSessionThumbnail)
+	require.NoError(t, err, "failed to upload thumbnail for allowed session")
+
+	deniedSessionThumbnail := newThumbnail()
+	err = uploadThumbnail(ctx, uploader, session.ID("denied-session"), deniedSessionThumbnail)
+	require.NoError(t, err, "failed to upload thumbnail for denied session")
+
+	testSessionThumbnail := newThumbnail()
+	err = uploadThumbnail(ctx, uploader, session.ID("test-session"), testSessionThumbnail)
+	require.NoError(t, err, "failed to upload thumbnail for test session")
+
+	service := &Service{
+		authorizer:      authorizer,
+		downloadHandler: uploader,
+	}
+
+	testCases := []struct {
+		name      string
+		sessionID string
+		wantError bool
+		errorType func(error) bool
+	}{
+		{
+			name:      "authorized session",
+			sessionID: "allowed-session",
+			wantError: false,
+		},
+		{
+			name:      "unauthorized session",
+			sessionID: "denied-session",
+			wantError: true,
+			errorType: trace.IsAccessDenied,
+		},
+		{
+			name:      "empty session ID",
+			sessionID: "",
+			wantError: true,
+			errorType: trace.IsAccessDenied,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+				SessionId: tc.sessionID,
+			})
+
+			if tc.wantError {
+				require.Error(t, err)
+				if tc.errorType != nil {
+					require.True(t, tc.errorType(err), "expected error type check to pass, got %v", err)
+				}
+			} else {
+				require.NoError(t, err, "expected no error for session %s", tc.sessionID)
+			}
+		})
+	}
+}
+
+func TestService_GetMetadata(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	uploader := eventstest.NewMemoryUploader()
+
+	metadata := newMetadata()
+
+	frames := []*recordingmetadatav1pb.SessionRecordingThumbnail{
+		newThumbnail(),
+		newThumbnail(),
+	}
+
+	metadata.ClusterName = "test-cluster"
+
+	err := uploadMetadata(ctx, uploader, session.ID("test-session"), metadata, frames)
+	require.NoError(t, err, "failed to upload metadata")
+
+	service := &Service{
+		authorizer:      &fakeAuthorizer{authorizedSessions: map[string]bool{"test-session": true}},
+		downloadHandler: uploader,
+	}
+
+	stream := &fakeServerStream{ctx: ctx}
+	err = service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+		SessionId: "test-session",
+	}, stream)
+
+	require.NoError(t, err, "failed to get metadata")
+	require.NotNil(t, stream, "expected non-nil stream")
+
+	{
+		chunk := &recordingmetadatav1pb.GetMetadataResponseChunk{}
+		err = stream.RecvMsg(chunk)
+
+		require.NoError(t, err, "failed to receive metadata chunk")
+		require.NotNil(t, chunk, "expected non-nil chunk")
+
+		require.NotNil(t, chunk.GetMetadata(), "expected metadata in chunk")
+		require.Equal(t, metadata.ClusterName, chunk.GetMetadata().ClusterName, "metadata cluster name does not match expected value")
+	}
+
+	{
+		chunk := &recordingmetadatav1pb.GetMetadataResponseChunk{}
+		err = stream.RecvMsg(chunk)
+
+		require.NoError(t, err, "failed to receive first frame chunk")
+		require.NotNil(t, chunk, "expected non-nil chunk")
+
+		require.NotNil(t, chunk.GetFrame(), "expected frame in chunk")
+		require.Equal(t, frames[0].Svg, chunk.GetFrame().Svg,
+			"first frame SVG does not match expected value")
+	}
+
+	{
+		chunk := &recordingmetadatav1pb.GetMetadataResponseChunk{}
+		err = stream.RecvMsg(chunk)
+
+		require.NoError(t, err, "failed to receive second frame chunk")
+		require.NotNil(t, chunk, "expected non-nil chunk")
+
+		require.NotNil(t, chunk.GetFrame(), "expected frame in chunk")
+		require.Equal(t, frames[1].Svg, chunk.GetFrame().Svg,
+			"second frame SVG does not match expected value")
+	}
+}
+
+func TestService_GetMetadataNotFound(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	uploader := eventstest.NewMemoryUploader()
+
+	service := &Service{
+		authorizer:      &fakeAuthorizer{authorizedSessions: map[string]bool{"test-session": true}},
+		downloadHandler: uploader,
+	}
+
+	stream := &fakeServerStream{ctx: ctx}
+	err := service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+		SessionId: "test-session",
+	}, stream)
+
+	require.Error(t, err, "expected error for test session")
+	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+}
+
+func TestService_GetMetadataAuthorized(t *testing.T) {
+	t.Parallel()
+
+	authorizer := &fakeAuthorizer{
+		authorizedSessions: map[string]bool{
+			"allowed-session": true,
+			"test-session":    true,
+		},
+	}
+
+	uploader := eventstest.NewMemoryUploader()
+
+	allowedSessionMetadata := newMetadata()
+	err := uploadMetadata(context.Background(), uploader, session.ID("allowed-session"), allowedSessionMetadata, nil)
+	require.NoError(t, err, "failed to upload metadata for allowed session")
+
+	deniedSessionMetadata := newMetadata()
+	err = uploadMetadata(context.Background(), uploader, session.ID("denied-session"), deniedSessionMetadata, nil)
+	require.NoError(t, err, "failed to upload metadata for denied session")
+
+	testSessionMetadata := newMetadata()
+	err = uploadMetadata(context.Background(), uploader, session.ID("test-session"), testSessionMetadata, nil)
+	require.NoError(t, err, "failed to upload metadata for test session")
+
+	service := &Service{
+		authorizer:      authorizer,
+		downloadHandler: uploader,
+	}
+
+	testCases := []struct {
+		name      string
+		sessionID string
+		wantError bool
+		errorType func(error) bool
+	}{
+		{
+			name:      "authorized session",
+			sessionID: "allowed-session",
+			wantError: false,
+		},
+		{
+			name:      "unauthorized session",
+			sessionID: "denied-session",
+			wantError: true,
+			errorType: trace.IsAccessDenied,
+		},
+		{
+			name:      "empty session ID",
+			sessionID: "",
+			wantError: true,
+			errorType: trace.IsAccessDenied,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			stream := &fakeServerStream{ctx: context.Background()}
+
+			err := service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+				SessionId: tc.sessionID,
+			}, stream)
+
+			if tc.wantError {
+				require.Error(t, err)
+				if tc.errorType != nil {
+					require.True(t, tc.errorType(err), "expected error type check to pass, got %v", err)
+				}
+			} else {
+				require.NoError(t, err, "expected no error for session %s", tc.sessionID)
+			}
+		})
+	}
+}
+
+func TestService_AuthorizerError(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	authorizer := &fakeAuthorizer{
+		shouldError: true,
+	}
+
+	service := &Service{
+		authorizer: authorizer,
+	}
+
+	_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+		SessionId: "any-session",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err))
+
+	stream := &fakeServerStream{ctx: ctx}
+	err = service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+		SessionId: "any-session",
+	}, stream)
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err))
+}
+
+func newThumbnail() *recordingmetadatav1pb.SessionRecordingThumbnail {
+	return &recordingmetadatav1pb.SessionRecordingThumbnail{
+		Svg:         []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"100%\" height=\"100%\" fill=\"red\"/></svg>"),
+		Cols:        80,
+		Rows:        24,
+		CursorX:     0,
+		CursorY:     0,
+		StartOffset: durationpb.New(0),
+		EndOffset:   durationpb.New(60),
+	}
+}
+
+func newMetadata() *recordingmetadatav1pb.SessionRecordingMetadata {
+	return &recordingmetadatav1pb.SessionRecordingMetadata{
+		Duration:    durationpb.New(60),
+		StartCols:   80,
+		StartRows:   24,
+		StartTime:   timestamppb.New(time.Now().Add(-time.Minute)),
+		EndTime:     timestamppb.New(time.Now()),
+		ClusterName: "test-cluster",
+	}
+}
+
+func uploadThumbnail(ctx context.Context, uploader events.UploadHandler, sessionID session.ID, thumbnail *recordingmetadatav1pb.SessionRecordingThumbnail) error {
+	data, err := proto.Marshal(thumbnail)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := uploader.UploadThumbnail(ctx, sessionID, bytes.NewReader(data)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+func uploadMetadata(ctx context.Context, uploader events.UploadHandler, sessionID session.ID, metadata *recordingmetadatav1pb.SessionRecordingMetadata, frames []*recordingmetadatav1pb.SessionRecordingThumbnail) error {
+	buf := &bytes.Buffer{}
+	writer := bufio.NewWriter(buf)
+
+	if _, err := protodelim.MarshalTo(writer, metadata); err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, frame := range frames {
+		if _, err := protodelim.MarshalTo(writer, frame); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if err := writer.Flush(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := uploader.UploadMetadata(ctx, sessionID, buf); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// fakeAuthorizer is a test implementation of the Authorizer interface
+type fakeAuthorizer struct {
+	// authorizedSessions contains the session IDs that should be authorized
+	authorizedSessions map[string]bool
+	// shouldError indicates if the authorizer should return an error
+	shouldError bool
+}
+
+func (f *fakeAuthorizer) Authorize(ctx context.Context, sessionID string) error {
+	if f.shouldError {
+		return trace.AccessDenied("test error")
+	}
+	if f.authorizedSessions[sessionID] {
+		return nil
+	}
+	return trace.AccessDenied("access denied to session %s", sessionID)
+}
+
+// fakeServerStream is a test implementation of grpc.ServerStreamingServer
+type fakeServerStream struct {
+	grpc.ServerStream
+
+	ctx       context.Context
+	sent      []*recordingmetadatav1pb.GetMetadataResponseChunk
+	recvIndex int
+}
+
+func (f *fakeServerStream) Context() context.Context {
+	return f.ctx
+}
+
+func (f *fakeServerStream) Send(resp *recordingmetadatav1pb.GetMetadataResponseChunk) error {
+	f.sent = append(f.sent, resp)
+	return nil
+}
+
+func (f *fakeServerStream) SendHeader(m metadata.MD) error {
+	return nil
+}
+
+func (f *fakeServerStream) SetHeader(m metadata.MD) error {
+	return nil
+}
+
+func (f *fakeServerStream) SetTrailer(m metadata.MD) {
+}
+
+func (f *fakeServerStream) SendMsg(m interface{}) error {
+	return nil
+}
+
+func (f *fakeServerStream) RecvMsg(m interface{}) error {
+	if chunk, ok := m.(*recordingmetadatav1pb.GetMetadataResponseChunk); ok {
+		if f.recvIndex >= len(f.sent) {
+			return io.EOF
+		}
+		proto.Merge(chunk, f.sent[f.recvIndex])
+		f.recvIndex++
+		return nil
+	}
+	return fmt.Errorf("unexpected message type %T", m)
+}
diff --git a/lib/auth/recordingmetadata/service.go b/lib/auth/recordingmetadata/service.go
new file mode 100644
index 0000000000000..7f53a4fbfaed6
--- /dev/null
+++ b/lib/auth/recordingmetadata/service.go
@@ -0,0 +1,32 @@
+/**
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package recordingmetadata
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// Service defines an interface for processing session recordings.
+type Service interface {
+	// ProcessSessionRecording processes the session recording associated with the
+	// provided session ID.
+	ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error
+}
diff --git a/lib/auth/register.go b/lib/auth/register.go
index 43120e2c16428..fa4cd12d60489 100644
--- a/lib/auth/register.go
+++ b/lib/auth/register.go
@@ -70,7 +70,7 @@ func LocalRegister(id state.IdentityID, authServer *Server, additionalPrincipals
 			PublicSSHKey:         ssh.MarshalAuthorizedKey(sshPub),
 			PublicTLSKey:         tlsPub,
 			SystemRoles:          systemRoles,
-		})
+		}, "")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/requestable_roles_test.go b/lib/auth/requestable_roles_test.go
new file mode 100644
index 0000000000000..305d400b0d4d5
--- /dev/null
+++ b/lib/auth/requestable_roles_test.go
@@ -0,0 +1,242 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package auth_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	authpb "github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// TestListRequestableRoles tests listing requestable roles with pagination.
+func TestListRequestableRoles(t *testing.T) {
+	ctx := t.Context()
+	tlsServer := newTestTLSServer(t)
+	a := tlsServer.Auth()
+
+	username := "test-user"
+	userRole, err := types.NewRole("user-role", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				Roles: []string{"role-*"}, // Allow requesting all roles that start with "role-"
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	_, err = a.CreateRole(ctx, userRole)
+	require.NoError(t, err)
+
+	user, err := types.NewUser(username)
+	require.NoError(t, err)
+	user.SetRoles([]string{"user-role"})
+
+	_, err = a.CreateUser(ctx, user)
+	require.NoError(t, err)
+
+	client, err := tlsServer.NewClient(authtest.TestUser(username))
+	require.NoError(t, err)
+	defer client.Close()
+
+	// Create dummy requestable roles
+	roleNames := []string{
+		"role-1", "role-2", "role-3", "role-4",
+		"role-5", "role-6", "role-7", "role-8",
+		"role-9", "role-99",
+	}
+
+	var expectedRequestableRoles []string
+	for _, roleName := range roleNames {
+		role, err := types.NewRole(roleName, types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Logins: []string{"ubuntu"},
+			},
+		})
+		require.NoError(t, err)
+
+		_, err = a.CreateRole(ctx, role)
+		require.NoError(t, err)
+		expectedRequestableRoles = append(expectedRequestableRoles, roleName)
+	}
+
+	nonRequestableRole, err := types.NewRole("admin", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Logins: []string{"root"},
+		},
+	})
+	require.NoError(t, err)
+	_, err = a.CreateRole(ctx, nonRequestableRole)
+	require.NoError(t, err)
+
+	userIdentity := tlsca.Identity{
+		Username: username,
+		Groups:   []string{"user-role"},
+	}
+	userCtx := authz.ContextWithUser(ctx, authz.LocalUser{
+		Username: username,
+		Identity: userIdentity,
+	})
+
+	t.Run("list all requestable roles, no limit", func(t *testing.T) {
+		req := &authpb.ListRequestableRolesRequest{}
+
+		resp, err := client.ListRequestableRoles(userCtx, req)
+		require.NoError(t, err)
+
+		// Verify that all the requestable roles were returned.
+		var receivedRoles []string
+		for _, role := range resp.Roles {
+			receivedRoles = append(receivedRoles, role.Name)
+		}
+		require.Empty(t, cmp.Diff(expectedRequestableRoles, receivedRoles))
+
+		// Verify that the non-requestable roles aren't returned.
+		require.NotContains(t, receivedRoles, "admin")
+		require.NotContains(t, receivedRoles, "user-role")
+
+		// There shouldn't be a nextKey
+		require.Empty(t, resp.NextPageToken)
+	})
+
+	t.Run("list a page of requestable roles starting with a startKey", func(t *testing.T) {
+		// Get the first page of 3
+		firstPageReq := &authpb.ListRequestableRolesRequest{
+			PageSize: 3,
+		}
+		firstPageResp, err := client.ListRequestableRoles(userCtx, firstPageReq)
+		require.NoError(t, err)
+		require.NotEmpty(t, firstPageResp.NextPageToken)
+
+		secondPageReq := &authpb.ListRequestableRolesRequest{
+			PageSize:  3,
+			PageToken: firstPageResp.NextPageToken,
+		}
+		secondPageResp, err := client.ListRequestableRoles(userCtx, secondPageReq)
+		require.NoError(t, err)
+
+		// Verify that the second page has the correct roles.
+		var receivedRoles []string
+		for _, role := range secondPageResp.Roles {
+			receivedRoles = append(receivedRoles, role.Name)
+		}
+		require.Empty(t, cmp.Diff(expectedRequestableRoles[3:6], receivedRoles))
+
+		// Verify there is no overlap in roles between the pages.
+		firstPageRoleNames := make(map[string]bool)
+		for _, role := range firstPageResp.Roles {
+			firstPageRoleNames[role.Name] = true
+		}
+		for _, role := range secondPageResp.Roles {
+			require.False(t, firstPageRoleNames[role.Name])
+		}
+	})
+
+	t.Run("list all pages of requestable roles", func(t *testing.T) {
+		limit := 3
+
+		respRoles, err := stream.Collect(clientutils.ResourcesWithPageSize(userCtx, func(ctx context.Context, pageSize int, pageToken string) ([]*authpb.ListRequestableRolesResponse_RequestableRole, string, error) {
+			req := &authpb.ListRequestableRolesRequest{
+				PageSize:  int32(pageSize),
+				PageToken: pageToken,
+			}
+
+			resp, err := client.ListRequestableRoles(ctx, req)
+			if err != nil {
+				return nil, "", err
+			}
+
+			// Verify that we got the correct page size (except for the last page).
+			if resp.NextPageToken != "" {
+				require.Len(t, resp.Roles, pageSize)
+			}
+
+			return resp.Roles, resp.NextPageToken, nil
+		}, limit))
+		require.NoError(t, err)
+
+		// Verify that all the requestable roles were returned.
+		var receivedRoles []string
+		for _, role := range respRoles {
+			receivedRoles = append(receivedRoles, role.Name)
+		}
+		require.Empty(t, cmp.Diff(expectedRequestableRoles, receivedRoles))
+	})
+
+	t.Run("no requestable roles", func(t *testing.T) {
+		// Create a user with no requestable roles
+		noPermsUsername := "noperms-user"
+		noPermsRole, err := types.NewRole("noperms-role", types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Logins: []string{"ubuntu"},
+			},
+			// No request permissions.
+		})
+		require.NoError(t, err)
+
+		_, err = a.CreateRole(ctx, noPermsRole)
+		require.NoError(t, err)
+
+		noPermsUser, err := types.NewUser(noPermsUsername)
+		require.NoError(t, err)
+		noPermsUser.SetRoles([]string{"noperms-role"})
+
+		_, err = a.CreateUser(ctx, noPermsUser)
+		require.NoError(t, err)
+
+		noPermsClient, err := tlsServer.NewClient(authtest.TestUser(noPermsUsername))
+		require.NoError(t, err)
+		defer noPermsClient.Close()
+
+		req := &authpb.ListRequestableRolesRequest{}
+		resp, err := noPermsClient.ListRequestableRoles(ctx, req)
+		require.NoError(t, err)
+
+		// Verify that nothing is returned.
+		require.Empty(t, resp.Roles)
+		require.Empty(t, resp.NextPageToken)
+	})
+
+	t.Run("list requestable roles with a search filter", func(t *testing.T) {
+		req := &authpb.ListRequestableRolesRequest{
+			Filter: &authpb.ListRequestableRolesRequest_Filter{
+				SearchKeywords: []string{"role-99"},
+			},
+		}
+		resp, err := client.ListRequestableRoles(userCtx, req)
+		require.NoError(t, err)
+
+		// Verify that only "role-99" was returned
+		require.Len(t, resp.Roles, 1)
+		require.Equal(t, "role-99", resp.Roles[0].Name)
+
+		// There shouldn't be a nextKey
+		require.Empty(t, resp.NextPageToken)
+	})
+
+}
diff --git a/lib/auth/rotate.go b/lib/auth/rotate.go
index 2938f89397806..0567f72b35b01 100644
--- a/lib/auth/rotate.go
+++ b/lib/auth/rotate.go
@@ -593,9 +593,11 @@ func (a *Server) syncUsableKeysAlert(ctx context.Context, usableKeysResults map[
 		types.WithAlertLabel(types.AlertOnLogin, "yes"),
 		// This is called by a.runPeriodicOperations via
 		// a.AutoRotateCertAuthorities on a random period between 1-2x
-		// defaults.HighResPollingPeriod, the alert will be renewed before it
-		// expires if it's still relevant.
-		types.WithAlertExpires(a.clock.Now().Add(defaults.HighResPollingPeriod * 3)),
+		// defaults.HighResPollingPeriod, the alert should be renewed or
+		// deleted before this expiry.
+		// Use an expiry of at least a few minutes in case auth init takes that
+		// long before runPeriodicOperations starts (e.g. in tests in CI).
+		types.WithAlertExpires(a.clock.Now().Add(5 * time.Minute)),
 	}
 	msg := fmt.Sprintf(
 		"Auth Service %s is configured to use %s, but the following CAs do not contain any keys of that type: %v. ",
diff --git a/lib/auth/scopes/access/service.go b/lib/auth/scopes/access/service.go
new file mode 100644
index 0000000000000..3d1fde37f377b
--- /dev/null
+++ b/lib/auth/scopes/access/service.go
@@ -0,0 +1,529 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package accesscontrol
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// Config contains the parameters for [New].
+type Config struct {
+	ScopedAuthorizer authz.ScopedAuthorizer
+	Reader           services.CachedScopedAccessReader
+	Writer           services.ScopedAccessWriter
+	BackendReader    services.ScopedAccessReader
+	Logger           *slog.Logger
+}
+
+// CheckAndSetDefaults checks the config for missing parameters and sets default values.
+func (c *Config) CheckAndSetDefaults() error {
+	if c.ScopedAuthorizer == nil {
+		return trace.BadParameter("missing ScopedAuthorizer in scoped access grpc service config")
+	}
+
+	if c.Reader == nil {
+		return trace.BadParameter("missing Reader in scoped access grpc service config")
+	}
+
+	if c.Writer == nil {
+		return trace.BadParameter("missing Writer in scoped access grpc service config")
+	}
+
+	if c.BackendReader == nil {
+		return trace.BadParameter("missing BackendReader in scoped access grpc service config")
+	}
+
+	if c.Logger == nil {
+		c.Logger = slog.With(teleport.ComponentKey, "scopes")
+	}
+
+	return nil
+}
+
+// Server is the [scopedaccessv1.UnimplementedScopedAccessServiceServer] returned by [New].
+type Server struct {
+	scopedaccessv1.UnimplementedScopedAccessServiceServer
+	cfg Config
+}
+
+// New returns the auth server implementation for the scoped access control
+// service, including the gRPC interface, authz enforcement, and business logic.
+func New(cfg Config) (*Server, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &Server{
+		cfg: cfg,
+	}, nil
+}
+
+// CreateScopedRole implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) CreateScopedRole(ctx context.Context, req *scopedaccessv1.CreateScopedRoleRequest) (*scopedaccessv1.CreateScopedRoleResponse, error) {
+	if err := scopes.AssertFeatureEnabled(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	if err := authzContext.CheckerContext.Decision(ctx, req.GetRole().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbCreate)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to create scoped roles in the requested scope",
+			"user", authzContext.User.GetName(),
+			"scope", req.GetRole().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	return s.cfg.Writer.CreateScopedRole(ctx, req)
+}
+
+// CreateScopedRoleAssignment implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) CreateScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.CreateScopedRoleAssignmentRequest) (*scopedaccessv1.CreateScopedRoleAssignmentResponse, error) {
+	if err := scopes.AssertFeatureEnabled(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// do a pre-check to weed out requests that definitely won't be authorized.
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbCreate); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if req.GetAssignment() == nil {
+		return nil, trace.BadParameter("missing assignment in request")
+	}
+
+	if assignment := req.GetAssignment(); assignment.GetMetadata() == nil {
+		assignment.Metadata = &headerv1.Metadata{}
+	}
+
+	if req.GetAssignment().GetMetadata().GetName() == "" {
+		req.GetAssignment().GetMetadata().Name = uuid.New().String()
+	}
+
+	if err := scopedaccess.StrongValidateAssignment(req.GetAssignment()); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if req.GetRoleRevisions() == nil {
+		req.RoleRevisions = make(map[string]string)
+	}
+
+	if err := authzContext.CheckerContext.Decision(ctx, req.GetAssignment().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbCreate)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to create scoped role assignments in the requested scope",
+			"user", authzContext.User.GetName(),
+			"scope", req.GetAssignment().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	for _, subAssignment := range req.GetAssignment().GetSpec().GetAssignments() {
+		// NOTE: we use the backend reader here because it is a common pattern to create a scoped role
+		// and its associated assignments in a single sequential operation. While this does slightly increase
+		// the backend load associated with assignment creation, it ensures that users are not forced to
+		// take cache replication delays into account when doing setup.
+		rsp, err := s.cfg.BackendReader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+			Name: subAssignment.GetRole(),
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if revision, ok := req.GetRoleRevisions()[subAssignment.GetRole()]; ok {
+			if revision != rsp.GetRole().GetMetadata().GetRevision() {
+				return nil, trace.CompareFailed("role %q revision %q does not match expected revision %q",
+					subAssignment.GetRole(), rsp.GetRole().GetMetadata().GetRevision(), revision)
+			}
+		} else {
+			// If the revision is not specified, use the current revision of the role.
+			req.RoleRevisions[subAssignment.GetRole()] = rsp.GetRole().GetMetadata().GetRevision()
+		}
+
+		// XXX: we're kind of side-stepping the question of what, if any, per-role policies should be enforced
+		// by currently requiring that all assignments only assign roles from the same scope as part of the
+		// backend validation logic. if/when we lift that restriction, we'll need to revisit this logic and
+		// decide what, if any, additional access-control checks may be required when an assignment references
+		// a role from a different scope. the current thinking is that we will allow assignments to reference
+		// roles in parent scopes *but* said assignments will not be able to introduce conflicts in modification
+		// of said parent roles. this is consistent with the scopes security model but has the downside of requiring
+		// us to change/relax role modification restrictions and possibly introduce a means of automated cleanup of
+		// dangling/malformed assignments.
+	}
+
+	return s.cfg.Writer.CreateScopedRoleAssignment(ctx, req)
+}
+
+// DeleteScopedRole implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleRequest) (*scopedaccessv1.DeleteScopedRoleResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// perform an early check for root scope delete permission to allow us to short-circuit
+	// and perform an unconditional delete. this is not strictly necessary, but allows us to
+	// have an escape hatch for deleting roles that are so malformed that they cannot be read.
+	if err := authzContext.CheckerContext.Decision(ctx, scopes.Root, func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbDelete)
+	}); err == nil {
+		return s.cfg.Writer.DeleteScopedRole(ctx, req)
+	}
+
+	// load the role so we can determine the resource scope
+	grsp, err := s.cfg.Reader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: req.GetName(),
+	})
+	if err != nil {
+		if trace.IsNotFound(err) {
+			// this API deliberately does not distinguish between kinds of concurrent modification
+			// in its error kinds.
+			return nil, trace.CompareFailed("scoped role %q has been concurrently modified and/or deleted", req.GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	// if a revision has been asserted, it must match the revision of the resource we are going to use for
+	// access-control checks.
+	if rev := req.GetRevision(); rev != "" && rev != grsp.GetRole().GetMetadata().GetRevision() {
+		return nil, trace.CompareFailed("scoped role %q has been concurrently modified", req.GetName())
+	}
+
+	// evaluate the access to the role based on its scope
+	if err := authzContext.CheckerContext.Decision(ctx, grsp.GetRole().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbDelete)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to delete scoped roles in the requested scope",
+			"user", authzContext.User.GetName(),
+			"scope", grsp.GetRole().GetScope(),
+			"role", req.GetName(),
+			"error", err,
+		)
+		return nil, trace.Wrap(err)
+	}
+
+	// set the revision to the current revision to prevent deletion in the event of concurrent modification
+	// that might invalidate the access-control checks we just performed.
+	req.Revision = grsp.GetRole().GetMetadata().GetRevision()
+
+	return s.cfg.Writer.DeleteScopedRole(ctx, req)
+}
+
+// DeleteScopedRoleAssignment implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) DeleteScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleAssignmentRequest) (*scopedaccessv1.DeleteScopedRoleAssignmentResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// perform an early check for root scope delete permission to allow us to short-circuit
+	// and perform an unconditional delete. this is not strictly necessary, but allows us to
+	// have an escape hatch for deleting assignments that are so malformed that they cannot be read.
+	if err := authzContext.CheckerContext.Decision(ctx, scopes.Root, func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbDelete)
+	}); err == nil {
+		return s.cfg.Writer.DeleteScopedRoleAssignment(ctx, req)
+	}
+
+	// load the assignment so we can determine the resource scope
+	grsp, err := s.cfg.Reader.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: req.GetName(),
+	})
+	if err != nil {
+		if trace.IsNotFound(err) {
+			// this API deliberately does not distinguish between kinds of concurrent modification
+			// in its error kinds.
+			return nil, trace.CompareFailed("scoped role assignment %q has been concurrently modified and/or deleted", req.GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	// if a revision has been asserted, it must match the revision of the resource we are going to use for
+	// access-control checks.
+	if rev := req.GetRevision(); rev != "" && rev != grsp.GetAssignment().GetMetadata().GetRevision() {
+		return nil, trace.CompareFailed("scoped role assignment %q has been concurrently modified", req.GetName())
+	}
+
+	// evaluate the access to the assignment based on its scope
+	if err := authzContext.CheckerContext.Decision(ctx, grsp.GetAssignment().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbDelete)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to delete scoped role assignments in the requested scope",
+			"user", authzContext.User.GetName(),
+			"scope", grsp.GetAssignment().GetScope(),
+			"assignment", req.GetName(),
+			"error", err,
+		)
+		return nil, trace.Wrap(err)
+	}
+
+	// set the revision to the current revision to prevent deletion in the event of concurrent modification
+	// that might invalidate the access-control checks we just performed.
+	req.Revision = grsp.GetAssignment().GetMetadata().GetRevision()
+
+	return s.cfg.Writer.DeleteScopedRoleAssignment(ctx, req)
+}
+
+// GetScopedRole implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// do a pre-check to weed out requests that definitely won't be authorized.
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbReadNoSecrets); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// load the role so we can determine the resource scope
+	preAuthzRsp, err := s.cfg.Reader.GetScopedRole(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// evaluate the access to the role based on its scope
+	if err := authzContext.CheckerContext.Decision(ctx, preAuthzRsp.GetRole().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbReadNoSecrets)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to read scoped role",
+			"user", authzContext.User.GetName(),
+			"scope", preAuthzRsp.GetRole().GetScope(),
+			"role", req.GetName(),
+			"error", err,
+		)
+		return nil, trace.Wrap(err)
+	}
+
+	// TODO(fspmarshall/scopes): we likely want to add an exception here to allow users to view the roles that they
+	// are assigned. though we may want to have such an exception be an opt-in mode to avoid complicating local administration.
+
+	// return of the pre-authz response is safe because we have now confirmed the user has access to its contents.
+	return preAuthzRsp, nil
+}
+
+// GetScopedRoleAssignment implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) GetScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// do a pre-check to weed out requests that definitely won't be authorized.
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbReadNoSecrets); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// load the assignment so we can determine the resource scope
+	preAuthzRsp, err := s.cfg.Reader.GetScopedRoleAssignment(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// evaluate the access to the assignment based on its scope
+	if err := authzContext.CheckerContext.Decision(ctx, preAuthzRsp.GetAssignment().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbReadNoSecrets)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to read scoped role assignment",
+			"user", authzContext.User.GetName(),
+			"scope", preAuthzRsp.GetAssignment().GetScope(),
+			"assignment", req.GetName(),
+			"error", err,
+		)
+		return nil, trace.Wrap(err)
+	}
+
+	// TODO(fspmarshall/scopes): we must add an exception here to allow users to view the assignments that they
+	// are assigned. we also need to explicitly support "escaping" the scope pin while doing this in order for users
+	// to be able to discover privileges in their scopes. we will want to have such an exception be an opt-in mode.
+
+	// return of the pre-authz response is safe because we have now confirmed the user has access to its contents.
+	return preAuthzRsp, nil
+}
+
+// ListScopedRoleAssignments implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) ListScopedRoleAssignments(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once before iteration. a resource-dependent
+	// rule context would need to be built once for each invocation of the filter function used during
+	// iteration, but we don't currently support resource attributes in scoped role where clauses, so
+	// can be pre-built once at the beginning of the call.
+	ruleCtx := authzContext.RuleContext()
+
+	if req.AllCallerAssignments {
+		// the all_caller_assignments flag indicates that the caller is specifically trying to discover
+		// their own assignments. in this mode we do not require resource verb permissions, instead filtering
+		// the results to only those assignments that apply to the caller.
+		if req.GetUser() != "" && req.GetUser() != authzContext.User.GetName() {
+			return nil, trace.AccessDenied("caller %q cannot list assignments for user %q using the all_caller_assignments flag", authzContext.User.GetName(), req.GetUser())
+		}
+		req.User = authzContext.User.GetName()
+	} else {
+		// do a pre-check to weed out requests that definitely won't be authorized.
+		if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbReadNoSecrets, types.VerbList); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	// list scoped role assignments with a filter that only passes assignments the user has access to.
+	rsp, err := s.cfg.Reader.ListScopedRoleAssignmentsWithFilter(ctx, req, func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
+		if req.AllCallerAssignments {
+			// note that this short-circuit doesn't just bypass verb checks, it also bypasses scope pinning. this is
+			// intended behavior and an important part of what makes the all_caller_assignments mode useful, as it allows
+			// users to get an overview of their available privileges across all scopes.
+			return authzContext.User.GetName() == assignment.GetSpec().GetUser()
+		}
+		err := authzContext.CheckerContext.Decision(ctx, assignment.GetScope(), func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbReadNoSecrets, types.VerbList)
+		})
+		return err == nil
+	})
+	return rsp, trace.Wrap(err)
+}
+
+// ListScopedRoles implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) ListScopedRoles(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once before iteration. a resource-dependent
+	// rule context would need to be built once for each invocation of the filter function, but
+	// we don't currently support resource attributes in scoped role where clauses, so can be pre-built
+	// once at the beginning of the call.
+	ruleCtx := authzContext.RuleContext()
+
+	// do a pre-check to weed out requests that definitely won't be authorized.
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbReadNoSecrets, types.VerbList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// list scoped roles with a filter that only passes roles the user has access to.
+	rsp, err := s.cfg.Reader.ListScopedRolesWithFilter(ctx, req, func(role *scopedaccessv1.ScopedRole) bool {
+		err := authzContext.CheckerContext.Decision(ctx, role.GetScope(), func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbReadNoSecrets, types.VerbList)
+		})
+		return err == nil
+	})
+
+	return rsp, trace.Wrap(err)
+}
+
+// UpdateScopedRole implements [scopedaccessv1.ScopedRoleServiceServer].
+func (s *Server) UpdateScopedRole(ctx context.Context, req *scopedaccessv1.UpdateScopedRoleRequest) (*scopedaccessv1.UpdateScopedRoleResponse, error) {
+	if err := scopes.AssertFeatureEnabled(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authzContext, err := s.cfg.ScopedAuthorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authzContext.RuleContext()
+
+	// do a pre-check to weed out requests that definitely won't be authorized.
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbUpdate); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// load the existing role to determine its scope
+	extant, err := s.cfg.Reader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: req.GetRole().GetMetadata().GetName(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// ensure that if a revision has been asserted, it matches the current revision of the role
+	if rev := req.GetRole().GetMetadata().GetRevision(); rev != "" && rev != extant.GetRole().GetMetadata().GetRevision() {
+		return nil, trace.CompareFailed("scoped role %q has been concurrently modified", req.GetRole().GetMetadata().GetName())
+	}
+	req.Role.Metadata.Revision = extant.GetRole().GetMetadata().GetRevision()
+
+	// disallow change of resource scope via update. use of scopes.Compare directly is generally discouraged,
+	// but that is due to ease of misuse, which isn't really a concern for a simple equivalence check.
+	if scopes.Compare(req.GetRole().GetScope(), extant.GetRole().GetScope()) != scopes.Equivalent {
+		return nil, trace.BadParameter("cannot modify the resource scope of scoped role %q (%q -> %q)", req.GetRole().GetMetadata().GetName(), extant.GetRole().GetScope(), req.GetRole().GetScope())
+	}
+
+	// the sanity of this check is hard-dependent on the above requirement that updates not modify the resource scope.
+	// we do not currently have a model for what a scope update would look like, and likely this would require significant
+	// rework to be able to support such a thing.
+	if err := authzContext.CheckerContext.Decision(ctx, req.GetRole().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbUpdate)
+	}); err != nil {
+		s.cfg.Logger.WarnContext(ctx, "user does not have permission to update scoped roles in the requested scope",
+			"user", authzContext.User.GetName(),
+			"scope", req.GetRole().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	return s.cfg.Writer.UpdateScopedRole(ctx, req)
+}
diff --git a/lib/auth/scopes/access/service_test.go b/lib/auth/scopes/access/service_test.go
new file mode 100644
index 0000000000000..38660cf21463d
--- /dev/null
+++ b/lib/auth/scopes/access/service_test.go
@@ -0,0 +1,959 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package accesscontrol
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	scopedaccesscache "github.com/gravitational/teleport/lib/scopes/cache/access"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+const testClusterName = "test-cluster"
+
+// fakeSplitAuthorizer is a mock implementation of ScopedAuthorizer that provides a hard-coded context.
+type fakeSplitAuthorizer struct {
+	ctx *authz.ScopedContext
+}
+
+func (a *fakeSplitAuthorizer) AuthorizeScoped(ctx context.Context) (*authz.ScopedContext, error) {
+	return a.ctx, nil
+}
+
+// newFakeScopedAuthorizer builds a fake split authorizer with a hard-coded context based on the provided scoped access info and reader.
+// this means that while the identity/assignments can be fake, the underlying reader must contain the expected scoped
+// roles in order for the context to be built successfully.
+func newFakeScopedAuthorizer(t *testing.T, accessInfo *services.AccessInfo, reader services.ScopedRoleReader) *fakeSplitAuthorizer {
+	t.Helper()
+
+	scopedCtx, err := services.NewScopedAccessCheckerContext(t.Context(), accessInfo, testClusterName, reader)
+	require.NoError(t, err)
+
+	return &fakeSplitAuthorizer{
+		ctx: &authz.ScopedContext{
+			User: &types.UserV2{
+				Metadata: types.Metadata{
+					Name: accessInfo.Username,
+				},
+			},
+			CheckerContext: services.NewScopedSplitAccessCheckerContext(scopedCtx),
+		},
+	}
+}
+
+// newFakeUnscopedAuthorizer builds a fake split authorizer with a hard-coded context based on the provided unscoped access info and reader.
+// this means that while the identity can be fake, the underlying reader must contain the expected classic roles in order for the context to
+// be built successfully.
+func newFakeUnscopedAuthorizer(t *testing.T, accessInfo *services.AccessInfo, reader services.RoleGetter) *fakeSplitAuthorizer {
+	t.Helper()
+
+	checker, err := services.NewAccessChecker(accessInfo, testClusterName, reader)
+	require.NoError(t, err)
+
+	return &fakeSplitAuthorizer{
+		ctx: &authz.ScopedContext{
+			User: &types.UserV2{
+				Metadata: types.Metadata{
+					Name: accessInfo.Username,
+				},
+			},
+			CheckerContext: services.NewUnscopedSplitAccessCheckerContext(checker),
+		},
+	}
+}
+
+// newServerForIdentity builds a server with an access checker that is hard-coded to the provided access info. The backend pack
+// much be pre-seeded with the relevant scoped/unscoped roles, but assignments are drawn from the access info (as they would be
+// if the access info was being taken from a certificate).
+func newServerForIdentity(t *testing.T, bk *backendPack, accessInfo *services.AccessInfo) *Server {
+	t.Helper()
+
+	var authz authz.ScopedAuthorizer
+	if accessInfo.ScopePin != nil {
+		authz = newFakeScopedAuthorizer(t, accessInfo, bk.cache)
+	} else {
+		authz = newFakeUnscopedAuthorizer(t, accessInfo, bk.classicService)
+	}
+
+	srv, err := New(Config{
+		ScopedAuthorizer: authz,
+		Reader:           bk.cache,
+		Writer:           bk.service,
+		BackendReader:    bk.service,
+	})
+	require.NoError(t, err)
+
+	return srv
+}
+
+type backendPack struct {
+	backend        backend.Backend
+	service        *local.ScopedAccessService
+	classicService *local.AccessService
+	cache          *scopedaccesscache.Cache
+}
+
+func (p *backendPack) Close() {
+	p.cache.Close()
+	p.backend.Close()
+}
+
+// newBackendPack creates a scoped access service and populates it with the provided scoped roles.
+func newBackendPack(t *testing.T) *backendPack {
+	t.Helper()
+
+	backend, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	t.Cleanup(func() { backend.Close() })
+
+	service := local.NewScopedAccessService(backend)
+	classicService := local.NewAccessService(backend)
+	events := local.NewEventsService(backend)
+
+	cache, err := scopedaccesscache.NewCache(scopedaccesscache.CacheConfig{
+		Events: events,
+		Reader: service,
+	})
+	require.NoError(t, err)
+
+	select {
+	case <-cache.Init():
+	case <-time.After(30 * time.Second):
+		require.FailNow(t, "timed out waiting for scoped access cache to initialize")
+	}
+
+	return &backendPack{
+		backend:        backend,
+		service:        service,
+		classicService: classicService,
+		cache:          cache,
+	}
+}
+
+// TestRoleBasics verifies that basic CRUD operations on scoped roles work as expected, with a focus on ensuring that
+// pinned scopes and role permissions are being properly enforced.
+func TestRoleBasics(t *testing.T) {
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	bk := newBackendPack(t)
+	defer bk.Close()
+
+	initialRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-admin",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "prod-admin",
+			},
+			Scope: "/prod",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/prod"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	for _, role := range initialRoles {
+		// bootstrap in an initial role so that we can start using scoped permissions for our tests
+		_, err := bk.service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+	}
+
+	// wait for roles to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		return len(roles) == 2
+	})
+
+	// set up server pinned to a staging admin identity
+	srv := newServerForIdentity(t, bk, &services.AccessInfo{
+		ScopePin: &scopesv1.Pin{
+			Scope: "/staging",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/staging": {
+					Roles: []string{"staging-admin"},
+				},
+			},
+		},
+		Username: "alice",
+	})
+
+	// verify expected successful read
+	rrsp, err := srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "staging-admin",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "staging-admin", rrsp.GetRole().GetMetadata().GetName())
+	require.Equal(t, "/staging", rrsp.GetRole().GetScope())
+
+	// verify expected denied read
+	_, err = srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "prod-admin",
+	})
+	require.Error(t, err)
+	// within the scopes model, getting a disallowed resource by its name is always considered an access denied,
+	// this is a divergence from our traditional RBAC model where a not found might be returned instead. scopes don't
+	// "hide" primary keys in the same manner if the caller has scoped read permissions.
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify expected successful list request includes only allowed roles
+	lrsp, err := srv.ListScopedRoles(ctx, &scopedaccessv1.ListScopedRolesRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lrsp.GetNextPageToken())
+	require.Len(t, lrsp.GetRoles(), 1)
+	require.Equal(t, "staging-admin", lrsp.GetRoles()[0].GetMetadata().GetName())
+
+	// verify expected successful create
+	crsp, err := srv.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: &scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-user",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, "staging-user", crsp.GetRole().GetMetadata().GetName())
+
+	// wait for roles to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		return len(roles) == 3
+	})
+
+	// verify expected denied create (out of scope)
+	_, err = srv.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: &scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "prod-user",
+			},
+			Scope: "/prod",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/prod"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that denied create really didn't create the role (requires using backend service
+	// directly to avoid false positive due to cache replication)
+	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "prod-user",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err), "expected not found error, got: %v", err)
+	require.Nil(t, rrsp)
+
+	// verify expected successful update
+
+	// start by getting the existing role
+	rrsp, err = srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "staging-user",
+	})
+	require.NoError(t, err)
+
+	// modify the role
+	rrsp.Role.Metadata.Labels = map[string]string{
+		"key": "val",
+	}
+
+	// update the role
+	ursp, err := srv.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: rrsp.GetRole(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, "staging-user", ursp.GetRole().GetMetadata().GetName())
+	require.NotEqual(t, rrsp.GetRole().GetMetadata().GetRevision(), ursp.GetRole().GetMetadata().GetRevision())
+
+	// observe change in cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		for _, role := range roles {
+			if role.GetMetadata().GetName() == "staging-user" {
+				if val, ok := role.GetMetadata().GetLabels()["key"]; ok && val == "val" {
+					return true
+				}
+			}
+		}
+		return false
+	})
+
+	// verify expected denied update (out of scope)
+
+	// start by getting the existing role (requires using backend service
+	// directly since our server is using a scoped identity)
+	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "prod-admin",
+	})
+	require.NoError(t, err)
+
+	// modify the role
+	rrsp.Role.Metadata.Labels = map[string]string{
+		"key": "val",
+	}
+
+	// attempt to update the role
+	ursp, err = srv.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: rrsp.GetRole(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+	require.Nil(t, ursp)
+
+	// verify that denied update really didn't update the role (requires using backend service
+	// directly to avoid false positive due to cache replication)
+	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "prod-admin",
+	})
+	require.NoError(t, err)
+	require.Nil(t, rrsp.GetRole().GetMetadata().GetLabels())
+
+	// verify expected successful delete
+	_, err = srv.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: "staging-user",
+	})
+	require.NoError(t, err)
+
+	// wait for deletion to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		for _, role := range roles {
+			if role.GetMetadata().GetName() == "staging-user" {
+				return false
+			}
+		}
+		return true
+	})
+
+	// verify expected denied delete (out of scope)
+	_, err = srv.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: "prod-admin",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that denied delete really didn't delete the role (requires using backend service
+	// directly to avoid false positive due to cache replication)
+	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "prod-admin",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "prod-admin", rrsp.GetRole().GetMetadata().GetName())
+}
+
+// TestAssignmentBasics verifies that basic CRUD operations on scoped role assignments work as expected, with a focus on ensuring that
+// pinned scopes and role permissions are being properly enforced.
+func TestAssignmentBasics(t *testing.T) {
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	bk := newBackendPack(t)
+	defer bk.Close()
+
+	initialRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-admin",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "prod-admin",
+			},
+			Scope: "/prod",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/prod"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	roleRevisions := make(map[string]string)
+	for _, role := range initialRoles {
+		// bootstrap in an initial role so that we can start using scoped permissions for our tests
+		crsp, err := bk.service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+		roleRevisions[role.GetMetadata().GetName()] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// wait for roles to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		return len(roles) == 2
+	})
+
+	// set up some initial assignments
+	initialAssignments := []*scopedaccessv1.ScopedRoleAssignment{
+		newScopedRoleAssignmentAtScope("staging-admin", "/staging"),
+		newScopedRoleAssignmentAtScope("prod-admin", "/prod"),
+	}
+
+	for _, assignment := range initialAssignments {
+		_, err := bk.service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment:    assignment,
+			RoleRevisions: roleRevisions, // when bypassing rbac layer, revisions must be explicit
+		})
+		require.NoError(t, err)
+	}
+
+	// wait for assignments to be populated into cache
+	waitForAssignmentCondition(t, bk.cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		return len(assignments) == 2
+	})
+
+	// set up server pinned to a staging admin identity
+	srv := newServerForIdentity(t, bk, &services.AccessInfo{
+		ScopePin: &scopesv1.Pin{
+			Scope: "/staging",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/staging": {
+					Roles: []string{"staging-admin"},
+				},
+			},
+		},
+		Username: "alice",
+	})
+
+	// verify expected successful read
+	rasp, err := srv.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: initialAssignments[0].GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, initialAssignments[0].GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
+	require.Equal(t, "/staging", rasp.GetAssignment().GetScope())
+
+	// verify expected denied read
+	rasp, err = srv.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: initialAssignments[1].GetMetadata().GetName(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+	require.Nil(t, rasp)
+
+	// verify expected successful list request includes only allowed assignments
+	lasp, err := srv.ListScopedRoleAssignments(ctx, &scopedaccessv1.ListScopedRoleAssignmentsRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lasp.GetNextPageToken())
+	require.Len(t, lasp.GetAssignments(), 1)
+	require.Equal(t, initialAssignments[0].GetMetadata().GetName(), lasp.GetAssignments()[0].GetMetadata().GetName())
+
+	// verify expected successful create
+	a1 := newScopedRoleAssignmentAtScope("staging-admin", "/staging")
+	carsp, err := srv.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: a1,
+	})
+	require.NoError(t, err)
+	require.Equal(t, a1.GetMetadata().GetName(), carsp.GetAssignment().GetMetadata().GetName())
+
+	// wait for assignments to be populated into cache
+	waitForAssignmentCondition(t, bk.cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		return len(assignments) == 3
+	})
+
+	// verify expected denied create (out of scope)
+	a2 := newScopedRoleAssignmentAtScope("prod-admin", "/prod")
+	carsp, err = srv.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: a2,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+	require.Nil(t, carsp)
+
+	// verify that denied create really didn't create the assignment (requires using backend service
+	// directly to avoid false positive due to cache replication)
+	garsp, err := bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: a2.GetMetadata().GetName(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err), "expected not found error, got: %v", err)
+	require.Nil(t, garsp)
+
+	// verify expected successful delete
+	_, err = srv.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: a1.GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+
+	// wait for deletion to be populated into cache
+	waitForAssignmentCondition(t, bk.cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		for _, assignment := range assignments {
+			if assignment.GetMetadata().GetName() == a1.GetMetadata().GetName() {
+				return false
+			}
+		}
+		return true
+	})
+
+	// verify expected denied delete (out of scope)
+	_, err = srv.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: initialAssignments[1].GetMetadata().GetName(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that denied delete really didn't delete the assignment (requires using backend service
+	// directly to avoid false positive due to cache replication)
+	rasp, err = bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: initialAssignments[1].GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, initialAssignments[1].GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
+}
+
+func newScopedRoleAssignmentAtScope(roleName string, scope string) *scopedaccessv1.ScopedRoleAssignment {
+	return &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: scope,
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "bob",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  roleName,
+					Scope: scope,
+				},
+			},
+		},
+		Version: types.V1,
+	}
+}
+
+// TestUnscopedBasics verifies that unscoped access control works as expected.
+func TestUnscopedBasics(t *testing.T) {
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	bk := newBackendPack(t)
+	defer bk.Close()
+
+	classicRoles := []*types.RoleV6{
+		{
+			Metadata: types.Metadata{
+				Name: "unscoped-auditor",
+			},
+			Spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Rules: []types.Rule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
+						},
+					},
+				},
+			},
+			Version: types.V8,
+		},
+		{
+			Metadata: types.Metadata{
+				Name: "unscoped-admin",
+			},
+			Spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Rules: []types.Rule{
+						{
+							Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
+							Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V8,
+		},
+	}
+
+	for _, role := range classicRoles {
+		_, err := bk.classicService.CreateRole(ctx, role)
+		require.NoError(t, err)
+	}
+
+	// set up server pinned to unscoped admin identity
+	srvAlice := newServerForIdentity(t, bk, &services.AccessInfo{
+		Username: "alice",
+		Roles:    []string{"unscoped-admin"},
+	})
+
+	// set up server pinned to unscoped auditor identity
+	srvBob := newServerForIdentity(t, bk, &services.AccessInfo{
+		Username: "bob",
+		Roles:    []string{"unscoped-auditor"},
+	})
+
+	// verify that admin can create a role
+	crsp, err := srvAlice.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: &scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "some-role",
+			},
+			Scope: "/some-scope",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/some-scope"},
+			},
+			Version: types.V1,
+		},
+	})
+	require.NoError(t, err)
+
+	// wait for roles to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		return len(roles) == 1
+	})
+
+	// verify that admin can read the role
+	rrsp, err := srvAlice.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "some-role",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "some-role", rrsp.GetRole().GetMetadata().GetName())
+
+	// verify that admin can list the role
+	lrsp, err := srvAlice.ListScopedRoles(ctx, &scopedaccessv1.ListScopedRolesRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lrsp.GetNextPageToken())
+	require.Len(t, lrsp.GetRoles(), 1)
+	require.Equal(t, "some-role", lrsp.GetRoles()[0].GetMetadata().GetName())
+
+	// verify that auditor cannot create a role
+	_, err = srvBob.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: &scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "some-other-role",
+			},
+			Scope: "/some-scope",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/some-scope"},
+			},
+			Version: types.V1,
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that auditor can read the admin-created role
+	rrsp, err = srvBob.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "some-role",
+	})
+	require.NoError(t, err)
+	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), rrsp.GetRole().GetMetadata().GetName())
+
+	// verify that auditor can list the admin-created role
+	lrsp, err = srvBob.ListScopedRoles(ctx, &scopedaccessv1.ListScopedRolesRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lrsp.GetNextPageToken())
+	require.Len(t, lrsp.GetRoles(), 1)
+	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), lrsp.GetRoles()[0].GetMetadata().GetName())
+
+	// verify that admin can create an assignment
+	acrsp, err := srvAlice.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerv1.Metadata{
+				Name: uuid.New().String(),
+			},
+			Scope: "/some-scope",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "some-role",
+						Scope: "/some-scope",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, "/some-scope", acrsp.GetAssignment().GetScope())
+
+	// wait for assignments to be populated into cache
+	waitForAssignmentCondition(t, bk.cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		return len(assignments) == 1
+	})
+
+	// verify that admin can read the assignment
+	rasp, err := srvAlice.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: acrsp.GetAssignment().GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
+
+	// verify that admin can list the assignment
+	lasp, err := srvAlice.ListScopedRoleAssignments(ctx, &scopedaccessv1.ListScopedRoleAssignmentsRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lasp.GetNextPageToken())
+	require.Len(t, lasp.GetAssignments(), 1)
+	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), lasp.GetAssignments()[0].GetMetadata().GetName())
+
+	// verify that auditor cannot create an assignment
+	_, err = srvBob.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerv1.Metadata{
+				Name: uuid.New().String(),
+			},
+			Scope: "/some-scope",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "some-role",
+						Scope: "/some-scope",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that auditor can read the admin-created assignment
+	rasp, err = srvBob.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: acrsp.GetAssignment().GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
+
+	// verify that auditor can list the admin-created assignment
+	lasp, err = srvBob.ListScopedRoleAssignments(ctx, &scopedaccessv1.ListScopedRoleAssignmentsRequest{})
+	require.NoError(t, err)
+	require.Empty(t, lasp.GetNextPageToken())
+	require.Len(t, lasp.GetAssignments(), 1)
+	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), lasp.GetAssignments()[0].GetMetadata().GetName())
+
+	// verify that admin can update roles
+
+	// start by getting the existing role
+	rrsp, err = srvAlice.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: "some-role",
+	})
+	require.NoError(t, err)
+	rrsp.Role.Metadata.Labels = map[string]string{
+		"key": "val",
+	}
+
+	// update the role
+	ursp, err := srvAlice.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: rrsp.GetRole(),
+	})
+	require.NoError(t, err)
+	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), ursp.GetRole().GetMetadata().GetName())
+	require.NotEqual(t, rrsp.GetRole().GetMetadata().GetRevision(), ursp.GetRole().GetMetadata().GetRevision())
+
+	// verify that auditor cannot update roles
+	rrsp, err = srvBob.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: crsp.GetRole().GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+	rrsp.Role.Metadata.Labels = map[string]string{
+		"key": "val2",
+	}
+	ursp, err = srvBob.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: rrsp.GetRole(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+	require.Nil(t, ursp)
+
+	// verify that auditor cannot delete assignments
+	_, err = srvBob.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: acrsp.GetAssignment().GetMetadata().GetName(),
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that admin can delete assignments
+	_, err = srvAlice.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: acrsp.GetAssignment().GetMetadata().GetName(),
+	})
+	require.NoError(t, err)
+
+	// wait for deletion to be populated into cache
+	waitForAssignmentCondition(t, bk.cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		for _, assignment := range assignments {
+			if assignment.GetMetadata().GetName() == acrsp.GetAssignment().GetMetadata().GetName() {
+				return false
+			}
+		}
+		return true
+	})
+
+	// verify that auditor cannot delete roles
+	_, err = srvBob.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: "some-role",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
+
+	// verify that admin can delete roles
+	_, err = srvAlice.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: "some-role",
+	})
+	require.NoError(t, err)
+	// wait for deletion to be populated into cache
+	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		for _, role := range roles {
+			if role.GetMetadata().GetName() == "some-role" {
+				return false
+			}
+		}
+		return true
+	})
+}
+
+func waitForRoleCondition(t *testing.T, reader services.ScopedRoleReader, condition func([]*scopedaccessv1.ScopedRole) bool) {
+	t.Helper()
+	timeout := time.After(30 * time.Second)
+	for {
+		var roles []*scopedaccessv1.ScopedRole
+		for role, err := range scopedutils.RangeScopedRoles(t.Context(), reader, &scopedaccessv1.ListScopedRolesRequest{}) {
+			require.NoError(t, err)
+			roles = append(roles, role)
+		}
+
+		if condition(roles) {
+			return
+		}
+
+		select {
+		case <-time.After(time.Millisecond * 120):
+		case <-timeout:
+			require.FailNow(t, "timeout waiting for role condition")
+		}
+	}
+}
+
+func waitForAssignmentCondition(t *testing.T, reader services.ScopedRoleAssignmentReader, condition func([]*scopedaccessv1.ScopedRoleAssignment) bool) {
+	t.Helper()
+	timeout := time.After(30 * time.Second)
+	for {
+		var assignments []*scopedaccessv1.ScopedRoleAssignment
+		for assignment, err := range scopedutils.RangeScopedRoleAssignments(t.Context(), reader, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+			require.NoError(t, err)
+			assignments = append(assignments, assignment)
+		}
+
+		if condition(assignments) {
+			return
+		}
+
+		select {
+		case <-time.After(time.Millisecond * 120):
+		case <-timeout:
+			require.FailNow(t, "timeout waiting for assignment condition")
+		}
+	}
+}
diff --git a/lib/auth/scopes/joining/service.go b/lib/auth/scopes/joining/service.go
new file mode 100644
index 0000000000000..d138b3faa2fa2
--- /dev/null
+++ b/lib/auth/scopes/joining/service.go
@@ -0,0 +1,277 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joining
+
+import (
+	"cmp"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"iter"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/gravitational/teleport"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedjoiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const defaultTokenPageSize = 100
+
+// Config contains the parameters for [New].
+type Config struct {
+	ScopedAuthorizer authz.ScopedAuthorizer
+	Logger           *slog.Logger
+	Backend          services.ScopedTokenService
+	MaxPageSize      int
+}
+
+// Server is the [scopedjoiningv1.ScopedJoiningServiceServer] returned by [New].
+type Server struct {
+	scopedjoiningv1.UnsafeScopedJoiningServiceServer
+
+	authorizer  authz.ScopedAuthorizer
+	logger      *slog.Logger
+	backend     services.ScopedTokenService
+	maxPageSize uint32
+}
+
+// New returns the auth server implementation for the scoped provisioning
+// service, including the gRPC interface, authz enforcement, and business logic.
+func New(c Config) (*Server, error) {
+	if c.ScopedAuthorizer == nil {
+		return nil, trace.BadParameter("missing Authorizer")
+	}
+
+	if c.Backend == nil {
+		return nil, trace.BadParameter("missing Backend")
+	}
+
+	if c.Logger == nil {
+		c.Logger = slog.With(teleport.ComponentKey, "scopes")
+	}
+
+	return &Server{
+		authorizer:  c.ScopedAuthorizer,
+		logger:      c.Logger,
+		backend:     c.Backend,
+		maxPageSize: cmp.Or(uint32(c.MaxPageSize), defaultTokenPageSize),
+	}, nil
+}
+
+// CreateScopedToken implements [scopedjoiningv1.ScopedJoiningServiceServer].
+func (s *Server) CreateScopedToken(ctx context.Context, req *scopedjoiningv1.CreateScopedTokenRequest) (*scopedjoiningv1.CreateScopedTokenResponse, error) {
+	authzContext, err := s.authorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ruleCtx := authzContext.RuleContext()
+	if err := authzContext.CheckerContext.Decision(ctx, req.GetToken().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbCreate)
+	}); err != nil {
+		s.logger.WarnContext(ctx, "user does not have permission to create scoped tokens in the requested scope", "user", authzContext.User.GetName(), "scope", req.GetToken().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	token := req.GetToken()
+	if token.GetMetadata().GetName() == "" {
+		if token.Metadata == nil {
+			token.Metadata = &headerv1.Metadata{}
+		}
+		name, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+		if err != nil {
+			return nil, trace.Wrap(err, "generating token value")
+		}
+		token.Metadata.Name = name
+	}
+
+	if token.GetSpec() != nil && token.GetSpec().GetJoinMethod() == "" {
+		token.Spec.JoinMethod = string(types.JoinMethodToken)
+	}
+
+	res, err := s.backend.CreateScopedToken(ctx, req)
+	return res, trace.Wrap(err)
+}
+
+// DeleteScopedToken implements [scopedjoiningv1.ScopedJoiningServiceServer].
+func (s *Server) DeleteScopedToken(ctx context.Context, req *scopedjoiningv1.DeleteScopedTokenRequest) (*scopedjoiningv1.DeleteScopedTokenResponse, error) {
+	authzContext, err := s.authorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ruleCtx := authzContext.RuleContext()
+
+	// perform an early check for root scope delete permission to allow us to short-circuit
+	// and perform an unconditional delete. this is not strictly necessary, but allows us to
+	// have an escape hatch for deleting tokens that are so malformed that they cannot be read.
+	if err := authzContext.CheckerContext.Decision(ctx, scopes.Root, func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedRole, types.VerbDelete)
+	}); err == nil {
+		return s.backend.DeleteScopedToken(ctx, req)
+	}
+
+	// fetch the token so we can determine the resource scope
+	preAuthzRes, err := s.backend.GetScopedToken(ctx, &scopedjoiningv1.GetScopedTokenRequest{
+		Name: req.GetName(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := authzContext.CheckerContext.Decision(ctx, preAuthzRes.GetToken().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbDelete)
+	}); err != nil {
+		s.logger.WarnContext(ctx, "user does not have permission to delete scoped tokens in the requested scope", "user", authzContext.User.GetName(), "scope", preAuthzRes.GetToken().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	res, err := s.backend.DeleteScopedToken(ctx, req)
+	return res, trace.Wrap(err)
+}
+
+// GetScopedToken implements [scopedjoiningv1.ScopedJoiningServiceServer].
+func (s *Server) GetScopedToken(ctx context.Context, req *scopedjoiningv1.GetScopedTokenRequest) (*scopedjoiningv1.GetScopedTokenResponse, error) {
+	authzContext, err := s.authorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ruleCtx := authzContext.RuleContext()
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	preAuthzRes, err := s.backend.GetScopedToken(ctx, &scopedjoiningv1.GetScopedTokenRequest{
+		Name: req.GetName(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := authzContext.CheckerContext.Decision(ctx, preAuthzRes.GetToken().GetScope(), func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbRead)
+	}); err != nil {
+		s.logger.WarnContext(ctx, "user does not have permission to read scoped tokens in the requested scope", "user", authzContext.User.GetName(), "scope", preAuthzRes.GetToken().GetScope())
+		return nil, trace.Wrap(err)
+	}
+
+	res := preAuthzRes
+	return res, trace.Wrap(err)
+}
+
+func makeCursor(token *scopedjoiningv1.ScopedToken) string {
+	if token == nil {
+		return ""
+	}
+	hash := sha256.Sum256([]byte(token.GetMetadata().GetName()))
+	return base64.StdEncoding.EncodeToString(hash[:])
+}
+
+func (s *Server) scopedTokenIter(ctx context.Context, req *scopedjoiningv1.ListScopedTokensRequest) iter.Seq2[*scopedjoiningv1.ScopedToken, error] {
+	return func(yield func(token *scopedjoiningv1.ScopedToken, err error) bool) {
+		iterReq := proto.CloneOf(req)
+		iterReq.Limit = s.maxPageSize
+
+		var cursorFound bool
+		for {
+			res, err := s.backend.ListScopedTokens(ctx, iterReq)
+			if err != nil {
+				if !yield(nil, trace.Wrap(err)) {
+					return
+				}
+			}
+
+			for _, tok := range res.GetTokens() {
+				if !cursorFound && req.GetCursor() != "" && makeCursor(tok) != req.GetCursor() {
+					continue
+				}
+				cursorFound = true
+				if !yield(tok, nil) {
+					return
+				}
+			}
+
+			// make sure we stop when we reach the end
+			if res.GetCursor() == "" {
+				return
+			}
+			iterReq.Cursor = res.GetCursor()
+		}
+	}
+}
+
+// ListScopedTokens implements [scopedjoiningv1.ScopedJoiningServiceServer].
+func (s *Server) ListScopedTokens(ctx context.Context, req *scopedjoiningv1.ListScopedTokensRequest) (*scopedjoiningv1.ListScopedTokensResponse, error) {
+	authzContext, err := s.authorizer.AuthorizeScoped(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ruleCtx := authzContext.RuleContext()
+	if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbRead, types.VerbList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	limit := int(req.GetLimit())
+	if limit == 0 {
+		limit = defaultTokenPageSize
+	}
+
+	var authorizedTokens []*scopedjoiningv1.ScopedToken
+	for token, err := range s.scopedTokenIter(ctx, req) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if err := authzContext.CheckerContext.Decision(ctx, token.GetScope(), func(checker *services.SplitAccessChecker) error {
+			return checker.Common().CheckAccessToRules(&ruleCtx, scopedaccess.KindScopedToken, types.VerbRead, types.VerbList)
+		}); err != nil {
+			continue
+		}
+		authorizedTokens = append(authorizedTokens, token)
+
+		// stop once we've fulfilled the requested page size
+		if len(authorizedTokens) >= limit {
+			break
+		}
+	}
+
+	var lastToken *scopedjoiningv1.ScopedToken
+	if len(authorizedTokens) >= limit {
+		lastToken = authorizedTokens[len(authorizedTokens)-1]
+	}
+	return &scopedjoiningv1.ListScopedTokensResponse{
+		Tokens: authorizedTokens,
+		Cursor: makeCursor(lastToken),
+	}, nil
+}
+
+// UpdateScopedToken implements [scopedjoiningv1.ScopedJoiningServiceServer].
+func (s *Server) UpdateScopedToken(ctx context.Context, req *scopedjoiningv1.UpdateScopedTokenRequest) (*scopedjoiningv1.UpdateScopedTokenResponse, error) {
+	return nil, trace.NotImplemented("scoped tokens must be recreated, they cannot be updated")
+}
diff --git a/lib/auth/scopes/joining/service_test.go b/lib/auth/scopes/joining/service_test.go
new file mode 100644
index 0000000000000..9c7f51a1b8d83
--- /dev/null
+++ b/lib/auth/scopes/joining/service_test.go
@@ -0,0 +1,498 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joining_test
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"testing"
+
+	gocmp "github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/scopes/joining"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func createToken(ctx context.Context, server *joining.Server, token *joiningv1.ScopedToken) (*joiningv1.ScopedToken, error) {
+	res, err := server.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		Token: proto.CloneOf(token),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return res.GetToken(), nil
+}
+
+func TestScopedJoiningService(t *testing.T) {
+	ctx := t.Context()
+	pack := newBackendPack(t)
+
+	t.Run("basic", func(t *testing.T) {
+		service := newServerForIdentity(t, pack, &services.AccessInfo{
+			ScopePin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging": {
+						Roles: []string{"staging-admin"},
+					},
+				},
+			},
+		})
+
+		baseToken := &joiningv1.ScopedToken{
+			Kind:     types.KindScopedToken,
+			Version:  types.V1,
+			Scope:    "/staging",
+			Metadata: &headerv1.Metadata{},
+			Spec: &joiningv1.ScopedTokenSpec{
+				AssignedScope: "/staging/aa",
+				JoinMethod:    "token",
+				Roles:         []string{"Node"},
+			},
+		}
+
+		// create a token
+		token, err := createToken(ctx, service, baseToken)
+		require.NoError(t, err)
+
+		withoutNameOpts := []gocmp.Option{
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "name"),
+			protocmp.Transform(),
+		}
+		cmpOpts := []gocmp.Option{
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+			protocmp.Transform(),
+		}
+		assert.Empty(t, gocmp.Diff(baseToken, token, withoutNameOpts...))
+
+		// make sure update is no-op
+		_, err = service.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{})
+		require.True(t, trace.IsNotImplemented(err))
+
+		// fail to create a token with an assigned scope that is orthogonal to its own
+		tokenWithMismatchedScope := proto.CloneOf(baseToken)
+		tokenWithMismatchedScope.Metadata.Name = "invalid-token"
+		tokenWithMismatchedScope.Spec.AssignedScope = "/prod/aa"
+		_, err = createToken(ctx, service, tokenWithMismatchedScope)
+		assert.True(t, trace.IsBadParameter(err))
+
+		// create a token with an explicit name
+		namedToken := proto.CloneOf(baseToken)
+		namedToken.Metadata.Name = "named-token"
+		namedToken, err = createToken(ctx, service, namedToken)
+		require.NoError(t, err)
+		require.NotEmpty(t, namedToken.Metadata.Name)
+
+		// fetch a token
+		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+			Name: token.Metadata.Name,
+		})
+		require.NoError(t, err)
+		assert.Empty(t, gocmp.Diff(token, fetched.GetToken(), cmpOpts...))
+
+		// delete a token
+		_, err = service.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+			Name: namedToken.Metadata.Name,
+		})
+		require.NoError(t, err)
+
+		// create some tokens to list
+		tokenStagingBB := proto.CloneOf(baseToken)
+		tokenStagingBB.Scope = "/staging/bb"
+		tokenStagingBB.Spec.AssignedScope = "/staging/bb"
+		_, err = createToken(ctx, service, tokenStagingBB)
+		require.NoError(t, err)
+
+		tokenStagingCC1 := proto.CloneOf(baseToken)
+		tokenStagingCC1.Scope = "/staging/cc"
+		tokenStagingCC1.Spec.AssignedScope = "/staging/cc"
+		tokenStagingCC1, err = createToken(ctx, service, tokenStagingCC1)
+		require.NoError(t, err)
+
+		tokenStagingCC2 := proto.CloneOf(baseToken)
+		tokenStagingCC2.Scope = "/staging/cc"
+		tokenStagingCC2.Spec.AssignedScope = "/staging/cc"
+		tokenStagingCC2, err = createToken(ctx, service, tokenStagingCC2)
+		require.NoError(t, err)
+
+		// list tokens while filtering their resource scope
+		res, err := service.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{
+			ResourceScope: &scopesv1.Filter{
+				Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+				Scope: "/staging/cc",
+			},
+		})
+		require.NoError(t, err)
+		assert.Len(t, res.Tokens, 2)
+		sortFn := func(left *joiningv1.ScopedToken, right *joiningv1.ScopedToken) int {
+			return cmp.Compare(left.Metadata.Name, right.Metadata.Name)
+		}
+
+		expected := []*joiningv1.ScopedToken{tokenStagingCC1, tokenStagingCC2}
+		slices.SortStableFunc(res.Tokens, sortFn)
+		slices.SortStableFunc(expected, sortFn)
+		for idx, token := range res.Tokens {
+			assert.Empty(t, gocmp.Diff(expected[idx], token, cmpOpts...))
+		}
+	})
+
+	t.Run("auth", func(t *testing.T) {
+		admin := newServerForIdentity(t, pack, &services.AccessInfo{
+			ScopePin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging": {
+						Roles: []string{"staging-admin"},
+					},
+				},
+			},
+		})
+
+		writer := newServerForIdentity(t, pack, &services.AccessInfo{
+			ScopePin: &scopesv1.Pin{
+				Scope: "/staging/aa",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/aa": {
+						Roles: []string{"staging-create"},
+					},
+				},
+			},
+		})
+
+		reader := newServerForIdentity(t, pack, &services.AccessInfo{
+			ScopePin: &scopesv1.Pin{
+				Scope: "/staging/aa",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/aa": {
+						Roles: []string{"staging-read"},
+					},
+				},
+			},
+		})
+
+		deleter := newServerForIdentity(t, pack, &services.AccessInfo{
+			ScopePin: &scopesv1.Pin{
+				Scope: "/staging/aa",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/aa": {
+						Roles: []string{"staging-delete"},
+					},
+				},
+			},
+		})
+
+		baseToken := &joiningv1.ScopedToken{
+			Kind:     types.KindScopedToken,
+			Version:  types.V1,
+			Scope:    "/staging/aa",
+			Metadata: &headerv1.Metadata{},
+			Spec: &joiningv1.ScopedTokenSpec{
+				AssignedScope: "/staging/aa",
+				JoinMethod:    "token",
+				Roles:         []string{"Node"},
+			},
+		}
+
+		// ensure writer can create a token at an accessible scope
+		stageTokenAA, err := createToken(ctx, writer, baseToken)
+		require.NoError(t, err)
+
+		cmpOpts := []gocmp.Option{
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "name"),
+			protocmp.Transform(),
+		}
+		assert.Empty(t, gocmp.Diff(baseToken, stageTokenAA, cmpOpts...))
+
+		// ensure writer can't create a token at an orthogonal scope
+		stageTokenBB := proto.CloneOf(baseToken)
+		stageTokenBB.Scope = "/staging/bb"
+		stageTokenBB.Spec.AssignedScope = "/staging/bb"
+		_, err = createToken(ctx, writer, stageTokenBB)
+		require.True(t, trace.IsAccessDenied(err))
+
+		// ensure other identities can't create a token
+		nonWriterIdents := []*joining.Server{reader, deleter}
+		for _, ident := range nonWriterIdents {
+			_, err = createToken(ctx, ident, baseToken)
+			require.True(t, trace.IsAccessDenied(err))
+		}
+
+		// create an orthogonal token for negative testing read ops
+		stageTokenBB, err = createToken(ctx, admin, stageTokenBB)
+		require.NoError(t, err)
+
+		// ensure reader can get token at accessible scope
+		getRes, err := reader.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+			Name: stageTokenAA.Metadata.Name,
+		})
+		require.NoError(t, err)
+		require.Empty(t, gocmp.Diff(baseToken, getRes.GetToken(), cmpOpts...))
+
+		// ensure reader can't get token at orthogonal scope
+		_, err = reader.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+			Name: stageTokenBB.Metadata.Name,
+		})
+		require.True(t, trace.IsAccessDenied(err))
+
+		// ensure other identities can't read a token
+		nonReaderIdents := []*joining.Server{writer, deleter}
+		for _, ident := range nonReaderIdents {
+			_, err = ident.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+				Name: stageTokenAA.Metadata.Name,
+			})
+			require.True(t, trace.IsAccessDenied(err))
+		}
+
+		// ensure reader can list only accessible tokens
+		listRes, err := reader.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{})
+		require.NoError(t, err)
+		require.Len(t, listRes.GetTokens(), 1)
+
+		// ensure other identities can't list tokens
+		for _, ident := range nonReaderIdents {
+			listRes, err = ident.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{})
+			require.NoError(t, err)
+			require.Empty(t, listRes.GetTokens())
+		}
+
+		// reverse assertion order so we can confirm non-deleter identities fail before we actually
+		// delete the token
+
+		// ensure other identities can't delete a token
+		nonDeleterIdents := []*joining.Server{reader, writer}
+		for _, ident := range nonDeleterIdents {
+			_, err = ident.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+				Name: stageTokenAA.Metadata.Name,
+			})
+			require.True(t, trace.IsAccessDenied(err))
+		}
+
+		// ensure deleter can delete a token
+		_, err = deleter.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+			Name: stageTokenAA.Metadata.Name,
+		})
+		require.NoError(t, err)
+
+		// ensure deleter can't delete a token at an orthogonal scope
+		_, err = deleter.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+			Name: stageTokenBB.Metadata.Name,
+		})
+		require.True(t, trace.IsAccessDenied(err))
+	})
+}
+
+// fakeSplitAuthorizer is a mock implementation of ScopedAuthorizer that provides a hard-coded context.
+type fakeSplitAuthorizer struct {
+	ctx *authz.ScopedContext
+}
+
+func (a *fakeSplitAuthorizer) AuthorizeScoped(ctx context.Context) (*authz.ScopedContext, error) {
+	return a.ctx, nil
+}
+
+// newFakeScopedAuthorizer builds a fake split authorizer with a hard-coded context based on the provided scoped access info and reader.
+// this means that while the identity/assignments can be fake, the underlying reader must contain the expected scoped
+// roles in order for the context to be built successfully.
+func newFakeScopedAuthorizer(t *testing.T, accessInfo *services.AccessInfo, reader services.ScopedRoleReader) *fakeSplitAuthorizer {
+	t.Helper()
+
+	scopedCtx, err := services.NewScopedAccessCheckerContext(t.Context(), accessInfo, "test-cluster", reader)
+	require.NoError(t, err)
+
+	return &fakeSplitAuthorizer{
+		ctx: &authz.ScopedContext{
+			User: &types.UserV2{
+				Metadata: types.Metadata{
+					Name: accessInfo.Username,
+				},
+			},
+			CheckerContext: services.NewScopedSplitAccessCheckerContext(scopedCtx),
+		},
+	}
+}
+
+// newServerForIdentity builds a server with an access checker that is hard-coded to the provided access info. The backend pack
+// much be pre-seeded with the relevant scoped/unscoped roles, but assignments are drawn from the access info (as they would be
+// if the access info was being taken from a certificate).
+func newServerForIdentity(t *testing.T, bk *backendPack, accessInfo *services.AccessInfo) *joining.Server {
+	t.Helper()
+
+	authz := newFakeScopedAuthorizer(t, accessInfo, bk.service)
+	require.NotNil(t, accessInfo.ScopePin)
+
+	srv, err := joining.New(joining.Config{
+		ScopedAuthorizer: authz,
+		Backend:          bk.scopedTokenService,
+		Logger:           logtest.NewLogger(),
+	})
+	require.NoError(t, err)
+
+	return srv
+}
+
+type backendPack struct {
+	backend            backend.Backend
+	service            *local.ScopedAccessService
+	classicService     *local.AccessService
+	scopedTokenService *local.ScopedTokenService
+}
+
+func (p *backendPack) Close() {
+	p.backend.Close()
+}
+
+// newBackendPack creates a scoped access service and populates it with the provided scoped roles.
+func newBackendPack(t *testing.T) *backendPack {
+	t.Helper()
+
+	backend, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	t.Cleanup(func() { backend.Close() })
+
+	service := local.NewScopedAccessService(backend)
+	classicService := local.NewAccessService(backend)
+	scopedTokenService, err := local.NewScopedTokenService(backend)
+	require.NoError(t, err)
+
+	roles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-admin",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{types.KindScopedToken},
+							Verbs:     []string{types.VerbCreate, types.VerbRead, types.VerbList, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		}, {
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-create",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/aa"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{types.KindScopedToken},
+							Verbs:     []string{types.VerbCreate},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		}, {
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-read",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/aa"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{types.KindScopedToken},
+							Verbs:     []string{types.VerbRead, types.VerbList},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		}, {
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-delete",
+			},
+			Scope: "/staging",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/aa"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{types.KindScopedToken},
+							Verbs:     []string{types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		}, {
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "prod-admin",
+			},
+			Scope: "/prod",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/prod"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Rules: []*scopedaccessv1.ScopedRule{
+						{
+							Resources: []string{types.KindScopedToken},
+							Verbs:     []string{types.VerbRead, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	for _, role := range roles {
+		_, err := service.CreateScopedRole(t.Context(), &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+	}
+
+	return &backendPack{
+		backend:            backend,
+		service:            service,
+		classicService:     classicService,
+		scopedTokenService: scopedTokenService,
+	}
+}
diff --git a/lib/auth/server_info_test.go b/lib/auth/server_info_test.go
index d0558c03bc69f..ec8a9b39449df 100644
--- a/lib/auth/server_info_test.go
+++ b/lib/auth/server_info_test.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 type mockServerInfoAccessPoint struct {
@@ -115,7 +115,7 @@ func TestReconcileServerInfo(t *testing.T) {
 			regularServerInfo.GetName(): regularServerInfo,
 		}
 
-		utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+		testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 			Name: "ReconcileServerInfos",
 			Task: func(ctx context.Context) error {
 				return trace.Wrap(ReconcileServerInfos(ctx, ap))
@@ -145,7 +145,7 @@ func TestReconcileServerInfo(t *testing.T) {
 			regularServerInfo.GetName(): regularServerInfo,
 		}
 
-		utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+		testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 			Name: "ReconcileServerInfos",
 			Task: func(ctx context.Context) error {
 				return trace.Wrap(ReconcileServerInfos(ctx, ap))
diff --git a/lib/auth/sessions.go b/lib/auth/sessions.go
index 24b28d8062f0f..5faa170db41c6 100644
--- a/lib/auth/sessions.go
+++ b/lib/auth/sessions.go
@@ -25,6 +25,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
@@ -58,6 +59,8 @@ type NewWebSessionRequest struct {
 	// LoginUserAgent is the user agent of the client's browser, as captured by
 	// the Proxy.
 	LoginUserAgent string
+	// ProxyGroupID is the proxy group id where request is generated.
+	ProxyGroupID string
 	// Roles optionally lists additional user roles
 	Roles []string
 	// Traits optionally lists role traits
@@ -289,7 +292,7 @@ func (a *Server) newWebSession(
 		ttl:            sessionTTL,
 		sshPublicKey:   sshAuthorizedKey,
 		tlsPublicKey:   tlsPublicKeyPEM,
-		checker:        checker,
+		checker:        services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to newWebSession.
 		traits:         req.Traits,
 		activeRequests: req.AccessRequests,
 	}
@@ -313,6 +316,9 @@ func (a *Server) newWebSession(
 		return nil, nil, trace.Wrap(err)
 	}
 	bearerTokenTTL := min(sessionTTL, defaults.BearerTokenTTL)
+	if idleTimeout > 0 {
+		bearerTokenTTL = min(sessionTTL, idleTimeout)
+	}
 
 	startTime := a.clock.Now()
 	if !req.LoginTime.IsZero() {
@@ -341,7 +347,13 @@ func (a *Server) newWebSession(
 		IdleTimeout:         types.Duration(idleTimeout),
 		HasDeviceExtensions: hasDeviceExtensions,
 	}
+
 	UserLoginCount.Inc()
+	userLoginCountPerClient.With(prometheus.Labels{
+		tagUserAgentType: "web",
+		tagVersion:       teleport.Version,
+		tagProxyGroupID:  req.ProxyGroupID,
+	}).Inc()
 
 	sess, err := types.NewWebSession(token, types.KindWebSession, sessionSpec)
 	if err != nil {
@@ -385,7 +397,7 @@ func (a *Server) upsertWebSession(ctx context.Context, session types.WebSession)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err := a.WebTokens().Upsert(ctx, token); err != nil {
+	if err := a.UpsertWebToken(ctx, token); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -562,7 +574,7 @@ func (a *Server) CreateAppSessionFromReq(ctx context.Context, req NewAppSessionR
 		user:           user,
 		loginIP:        req.LoginIP,
 		tlsPublicKey:   tlsPublicKey,
-		checker:        checker,
+		checker:        services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to newAppSession.
 		ttl:            req.SessionTTL,
 		traits:         req.Traits,
 		activeRequests: req.AccessRequests,
@@ -606,7 +618,19 @@ func (a *Server) CreateAppSessionFromReq(ctx context.Context, req NewAppSessionR
 		return nil, trace.Wrap(err)
 	}
 	a.logger.DebugContext(ctx, "Generated application web session", "user", req.User, "ttl", req.SessionTTL)
+
 	UserLoginCount.Inc()
+	userLoginCountPerClient.With(prometheus.Labels{
+		tagUserAgentType: "web",
+		tagVersion:       teleport.Version,
+		tagProxyGroupID:  req.ProxyGroupID,
+	}).Inc()
+
+	// Do not send app session start for MCP. They have their own events on
+	// connections.
+	if types.IsAppMCP(req.AppURI) {
+		return session, nil
+	}
 
 	// Extract the identity of the user from the certificate, this will include metadata from any actively assumed access requests.
 	certificate, err := tlsca.ParseCertificatePEM(session.GetTLSCert())
@@ -746,7 +770,7 @@ func (a *Server) CreateSessionCerts(ctx context.Context, req *SessionCertsReques
 		sshPublicKeyAttestationStatement: req.SSHAttestationStatement,
 		tlsPublicKeyAttestationStatement: req.TLSAttestationStatement,
 		compatibility:                    req.Compatibility,
-		checker:                          checker,
+		checker:                          services.NewUnscopedSplitAccessChecker(checker), // TODO(fspmarshall/scopes): add scoping support to CreateSessionCerts.
 		traits:                           req.UserState.GetTraits(),
 		routeToCluster:                   req.RouteToCluster,
 		kubernetesCluster:                req.KubernetesCluster,
diff --git a/lib/auth/sessions_test.go b/lib/auth/sessions_test.go
index 4af78758d24f9..2572276068743 100644
--- a/lib/auth/sessions_test.go
+++ b/lib/auth/sessions_test.go
@@ -14,7 +14,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -22,20 +22,96 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/defaults"
 )
 
+func TestCreateWebSession(t *testing.T) {
+	t.Parallel()
+
+	const userLlama = "llama"
+	tenHours := time.Hour * 10
+	eightHours := time.Hour * 8
+
+	testCases := []struct {
+		name                   string
+		webIdleTimeout         *time.Duration
+		sessionTTL             time.Duration
+		expectedBearerTokenTTL time.Duration
+	}{
+		{
+			name:                   "bearerTokenExpiry equal webidletimeout",
+			webIdleTimeout:         &tenHours,
+			expectedBearerTokenTTL: tenHours,
+			sessionTTL:             time.Hour * 12,
+		},
+		{
+			name:                   "bearerTokenExpiry is sessionTTL when shorter than webidletimeout",
+			webIdleTimeout:         &tenHours,
+			sessionTTL:             eightHours,
+			expectedBearerTokenTTL: eightHours,
+		},
+		{
+			name:                   "bearerTokenExpiry defaults to 10 minutes when webidletimeout not configured",
+			webIdleTimeout:         nil,
+			sessionTTL:             time.Hour * 12,
+			expectedBearerTokenTTL: defaults.BearerTokenTTL,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			clusterNetworkConfig := types.DefaultClusterNetworkingConfig()
+			if tc.webIdleTimeout != nil {
+				clusterNetworkConfig.SetWebIdleTimeout(*tc.webIdleTimeout)
+			}
+
+			fakeclock := clockwork.NewFakeClock()
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+				Clock:                   fakeclock,
+				Dir:                     t.TempDir(),
+				ClusterNetworkingConfig: clusterNetworkConfig,
+			})
+			require.NoError(t, err, "NewAuthServer failed")
+			t.Cleanup(func() {
+				assert.NoError(t, testAuthServer.Close(), "testAuthServer.Close() errored")
+			})
+
+			authServer := testAuthServer.AuthServer
+			ctx := context.Background()
+
+			_, _, err = authtest.CreateUserAndRole(authServer, userLlama, []string{userLlama} /* logins */, nil /* allowRules */)
+			require.NoError(t, err, "CreateUserAndRole failed")
+
+			session, err := authServer.CreateWebSessionFromReq(ctx, auth.NewWebSessionRequest{
+				User:       userLlama,
+				SessionTTL: tc.sessionTTL,
+			})
+			require.NoError(t, err, "CreateWebSessionFromReq failed")
+
+			bearerTokenExpiry := session.GetBearerTokenExpiryTime()
+			actualTTL := fakeclock.Until(bearerTokenExpiry)
+			require.Equal(t, tc.expectedBearerTokenTTL, actualTTL)
+		})
+	}
+}
+
 func TestServer_CreateWebSessionFromReq_deviceWebToken(t *testing.T) {
 	t.Parallel()
 
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
-	require.NoError(t, err, "NewTestAuthServer failed")
+	require.NoError(t, err, "NewAuthServer failed")
 	t.Cleanup(func() {
 		assert.NoError(t, testAuthServer.Close(), "testAuthServer.Close() errored")
 	})
@@ -57,7 +133,7 @@ func TestServer_CreateWebSessionFromReq_deviceWebToken(t *testing.T) {
 	})
 
 	const userLlama = "llama"
-	user, _, err := CreateUserAndRole(authServer, userLlama, []string{userLlama} /* logins */, nil /* allowRules */)
+	user, _, err := authtest.CreateUserAndRole(authServer, userLlama, []string{userLlama} /* logins */, nil /* allowRules */)
 	require.NoError(t, err, "CreateUserAndRole failed")
 
 	// Arbitrary, real-looking values.
@@ -65,7 +141,7 @@ func TestServer_CreateWebSessionFromReq_deviceWebToken(t *testing.T) {
 	const loginUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
 
 	t.Run("ok", func(t *testing.T) {
-		session, err := authServer.CreateWebSessionFromReq(ctx, NewWebSessionRequest{
+		session, err := authServer.CreateWebSessionFromReq(ctx, auth.NewWebSessionRequest{
 			User:                 userLlama,
 			LoginIP:              loginIP,
 			LoginUserAgent:       loginUserAgent,
diff --git a/lib/auth/sso_mfa_test.go b/lib/auth/sso_mfa_test.go
index 2b597d347391d..6822b706ea5a8 100644
--- a/lib/auth/sso_mfa_test.go
+++ b/lib/auth/sso_mfa_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -33,7 +33,9 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/mfatypes"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -45,13 +47,16 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	ctx := context.Background()
 
 	fakeClock := clockwork.NewFakeClock()
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: fakeClock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
 	testServer, err := testAuthServer.NewTestTLSServer()
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testServer.Close()) })
 
 	a := testServer.Auth()
 	a.SetSAMLService(&fakeSSOService{a})
@@ -70,11 +75,11 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a standard user.
-	standardUser, _, err := CreateUserAndRole(a, "standard", []string{"role"}, nil)
+	standardUser, _, err := authtest.CreateUserAndRole(a, "standard", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	// Create a fake saml user with MFA disabled.
-	noMFASAMLUser, noMFASAMLRole, err := CreateUserAndRole(a, "saml-user-no-mfa", []string{"role"}, nil)
+	noMFASAMLUser, noMFASAMLRole, err := authtest.CreateUserAndRole(a, "saml-user-no-mfa", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	noMFASAMLConnector, err := types.NewSAMLConnector("saml-no-mfa", types.SAMLConnectorSpecV2{
@@ -91,7 +96,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	noMFASAMLUser.SetCreatedBy(types.CreatedBy{
-		Time: a.clock.Now(),
+		Time: a.GetClock().Now(),
 		Connector: &types.ConnectorRef{
 			ID:   noMFASAMLConnector.GetName(),
 			Type: noMFASAMLConnector.GetKind(),
@@ -101,7 +106,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake saml user with MFA enabled.
-	samlUser, samlRole, err := CreateUserAndRole(a, "saml-user", []string{"role"}, nil)
+	samlUser, samlRole, err := authtest.CreateUserAndRole(a, "saml-user", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	samlConnector, err := types.NewSAMLConnector("saml", types.SAMLConnectorSpecV2{
@@ -123,7 +128,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	samlUser.SetCreatedBy(types.CreatedBy{
-		Time: a.clock.Now(),
+		Time: a.GetClock().Now(),
 		Connector: &types.ConnectorRef{
 			ID:   samlConnector.GetName(),
 			Type: samlConnector.GetKind(),
@@ -133,7 +138,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake oidc user with MFA enabled.
-	oidcUser, oidcRole, err := CreateUserAndRole(a, "oidc-user", []string{"role"}, nil)
+	oidcUser, oidcRole, err := authtest.CreateUserAndRole(a, "oidc-user", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	oidcConnector, err := types.NewOIDCConnector("oidc", types.OIDCConnectorSpecV3{
@@ -158,7 +163,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 	require.NoError(t, err)
 
 	oidcUser.SetCreatedBy(types.CreatedBy{
-		Time: a.clock.Now(),
+		Time: a.GetClock().Now(),
 		Connector: &types.ConnectorRef{
 			ID:   oidcConnector.GetName(),
 			Type: oidcConnector.GetKind(),
@@ -343,7 +348,7 @@ func TestSSOMFAChallenge_Creation(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			userClient, err := testServer.NewClient(TestUser(tt.username))
+			userClient, err := testServer.NewClient(authtest.TestUser(tt.username))
 			require.NoError(t, err)
 
 			if tt.setup != nil {
@@ -361,22 +366,25 @@ func TestSSOMFAChallenge_Validation(t *testing.T) {
 	ctx := context.Background()
 
 	fakeClock := clockwork.NewFakeClock()
-	testAuthServer, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: fakeClock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
 	testServer, err := testAuthServer.NewTestTLSServer()
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testServer.Close()) })
 
 	a := testServer.Auth()
 
 	// Create a standard user.
-	standardUser, _, err := CreateUserAndRole(a, "standard", []string{"role"}, nil)
+	standardUser, _, err := authtest.CreateUserAndRole(a, "standard", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	// Create a fake saml user with MFA enabled.
-	samlUser, samlRole, err := CreateUserAndRole(a, "saml-user", []string{"role"}, nil)
+	samlUser, samlRole, err := authtest.CreateUserAndRole(a, "saml-user", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	samlConnector, err := types.NewSAMLConnector("saml", types.SAMLConnectorSpecV2{
@@ -397,7 +405,7 @@ func TestSSOMFAChallenge_Validation(t *testing.T) {
 	_, err = a.UpsertSAMLConnector(ctx, samlConnector)
 	require.NoError(t, err)
 
-	userCreatedAt := a.clock.Now().UTC()
+	userCreatedAt := a.GetClock().Now().UTC()
 	samlUser.SetCreatedBy(types.CreatedBy{
 		Time: userCreatedAt,
 		Connector: &types.ConnectorRef{
@@ -418,7 +426,7 @@ func TestSSOMFAChallenge_Validation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fake saml user with MFA disabled.
-	noMFASAMLUser, noMFASAMLRole, err := CreateUserAndRole(a, "saml-user-no-mfa", []string{"role"}, nil)
+	noMFASAMLUser, noMFASAMLRole, err := authtest.CreateUserAndRole(a, "saml-user-no-mfa", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	noMFASAMLConnector, err := types.NewSAMLConnector("saml-no-mfa", types.SAMLConnectorSpecV2{
@@ -435,7 +443,7 @@ func TestSSOMFAChallenge_Validation(t *testing.T) {
 	require.NoError(t, err)
 
 	noMFASAMLUser.SetCreatedBy(types.CreatedBy{
-		Time: a.clock.Now(),
+		Time: a.GetClock().Now(),
 		Connector: &types.ConnectorRef{
 			ID:   noMFASAMLConnector.GetName(),
 			Type: noMFASAMLConnector.GetKind(),
@@ -722,7 +730,7 @@ func TestSSOMFAChallenge_Validation(t *testing.T) {
 }
 
 type fakeSSOService struct {
-	a *Server
+	a *auth.Server
 }
 
 func (s *fakeSSOService) CreateSAMLAuthRequest(ctx context.Context, req types.SAMLAuthRequest) (*types.SAMLAuthRequest, error) {
diff --git a/lib/auth/stableunixusers/stableunixusers_test.go b/lib/auth/stableunixusers/stableunixusers_test.go
index b26e0cea3690d..d8a3f70622dc8 100644
--- a/lib/auth/stableunixusers/stableunixusers_test.go
+++ b/lib/auth/stableunixusers/stableunixusers_test.go
@@ -37,11 +37,11 @@ import (
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/services/readonly"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/auth/state/identity.go b/lib/auth/state/identity.go
index 362104f091e5e..7c418bdae9eed 100644
--- a/lib/auth/state/identity.go
+++ b/lib/auth/state/identity.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
@@ -61,7 +62,7 @@ func (id *IdentityID) String() string {
 
 // Identity is collection of certificates and signers that represent server identity
 type Identity struct {
-	// ID specifies server unique ID, name and role
+	// ID specifies server unique ID, name, role, and scope
 	ID IdentityID
 	// KeyBytes is a PEM encoded private key
 	KeyBytes []byte
@@ -84,6 +85,8 @@ type Identity struct {
 	ClusterName string
 	// SystemRoles is a list of additional system roles.
 	SystemRoles []string
+	// AgentScope is the scope an identity is constrained to.
+	AgentScope string
 }
 
 // HasSystemRole checks if this identity encompasses the supplied system role.
@@ -337,6 +340,7 @@ func ReadSSHIdentityFromKeyPair(keyBytes, certBytes []byte) (*Identity, error) {
 		return nil, trace.BadParameter("missing cert extension %v", utils.CertExtensionAuthority)
 	}
 
+	agentScope := cert.Permissions.Extensions[teleport.CertExtensionAgentScope]
 	return &Identity{
 		ID:          IdentityID{HostUUID: cert.ValidPrincipals[0], Role: role},
 		ClusterName: clusterName,
@@ -344,5 +348,6 @@ func ReadSSHIdentityFromKeyPair(keyBytes, certBytes []byte) (*Identity, error) {
 		CertBytes:   certBytes,
 		KeySigner:   certSigner,
 		Cert:        cert,
+		AgentScope:  agentScope,
 	}, nil
 }
diff --git a/lib/auth/storage/storage.go b/lib/auth/storage/storage.go
index 92dd92e084352..dc7c573ac52a7 100644
--- a/lib/auth/storage/storage.go
+++ b/lib/auth/storage/storage.go
@@ -27,18 +27,23 @@ package storage
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"io/fs"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
+	"k8s.io/client-go/util/retry"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/hostid"
 )
 
 const (
@@ -283,11 +288,169 @@ func (p *ProcessStorage) ReadRDPLicense(ctx context.Context, key *types.RDPLicen
 
 // ReadLocalIdentity reads, parses and returns the given pub/pri key + cert from the
 // key storage (dataDir).
+//
+// TODO(nklaassen): delete this after ref has been removed from teleport.e
 func ReadLocalIdentity(dataDir string, id state.IdentityID) (*state.Identity, error) {
+	return ReadLocalIdentityForRole(dataDir, id.Role)
+}
+
+// ReadLocalIdentityForRole reads, parses and returns the given pub/pri key +
+// cert from the key storage (dataDir).
+func ReadLocalIdentityForRole(dataDir string, role types.SystemRole) (*state.Identity, error) {
 	storage, err := NewProcessStorage(context.TODO(), dataDir)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer storage.Close()
-	return storage.ReadIdentity(state.IdentityCurrent, id.Role)
+	return storage.ReadIdentity(state.IdentityCurrent, role)
+}
+
+// ReadOrGenerateHostID tries to read the `host_uuid` from Kubernetes storage (if available) or local storage.
+// If the read operation returns no `host_uuid`, this function tries to pick it from the first static identity provided.
+// If no static identities were defined for the process, a new id is generated depending on the joining process:
+// - types.JoinMethodEC2: we will use the EC2 NodeID: {accountID}-{nodeID}
+// - Any other valid Joining method: a new UUID is generated.
+// Finally, if a new id is generated, this function writes it into local storage and Kubernetes storage (if available).
+// If kubeBackend is nil, the agent is not running in a Kubernetes Cluster.
+// When facing IsAlreadyExists error, this function will retry reading the host ID from the storage.
+func (p *ProcessStorage) ReadOrGenerateHostID(ctx context.Context, cfg *servicecfg.Config) (string, error) {
+	var hostID string
+
+	// Read or generate the host ID, which is used to identify the Teleport agent.
+	// If running in Kubernetes, it will read from the Kubernetes secret if available,
+	// otherwise it will read from the local storage.
+	if err := retry.OnError(retry.DefaultRetry, trace.IsAlreadyExists, func() error {
+		var err error
+		hostID, err = readOrGenerateHostID(ctx, cfg, p.stateStorage)
+		return err
+	}); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return hostID, nil
+}
+
+func readOrGenerateHostID(ctx context.Context, cfg *servicecfg.Config, kubeBackend stateBackend) (string, error) {
+	// Load `host_uuid` from different storages. If this process is running in a Kubernetes Cluster,
+	// readHostUUIDFromStorages will try to read the `host_uuid` from the Kubernetes Secret. If the
+	// key is empty or if not running in a Kubernetes Cluster, it will read the
+	// `host_uuid` from local data directory.
+	hostID, err := readHostIDFromStorages(ctx, cfg.DataDir, kubeBackend)
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			if errors.Is(err, fs.ErrPermission) {
+				cfg.Logger.ErrorContext(ctx, "Teleport does not have permission to write to the data directory. Ensure that you are running as a user with appropriate permissions.", "data_dir", cfg.DataDir)
+			}
+			return "", trace.Wrap(err)
+		}
+		// if there's no host uuid initialized yet, try to read one from the
+		// one of the identities
+		if len(cfg.Identities) != 0 {
+			hostID = cfg.Identities[0].ID.HostUUID
+			cfg.Logger.InfoContext(ctx, "Taking host UUID from first identity.", "host_uuid", hostID)
+		} else {
+			hostID, err = hostid.Generate(ctx, cfg.JoinMethod)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			cfg.Logger.InfoContext(ctx, "Generating new host UUID", "host_uuid", hostID)
+		}
+		// persistHostUUIDToStorages will persist the host_uuid to the local storage
+		// and to Kubernetes Secret if this process is running on a Kubernetes Cluster.
+		if err := persistHostIDToStorages(ctx, cfg, hostID, kubeBackend); err != nil {
+			return "", trace.Wrap(err)
+		}
+	}
+	return hostID, nil
+}
+
+// readHostIDFromStorages tries to read the `host_uuid` value from different storages,
+// depending on where the process is running.
+// If the process is running in a Kubernetes Cluster, this function will attempt
+// to read the `host_uuid` from the Kubernetes Secret. If it does not exist or
+// if it is not running on a Kubernetes cluster the read is done from the local
+// storage: `dataDir/host_uuid`.
+func readHostIDFromStorages(ctx context.Context, dataDir string, kubeBackend stateBackend) (string, error) {
+	if kubeBackend != nil {
+		if hostID, err := loadHostIDFromKubeSecret(ctx, kubeBackend); err == nil && len(hostID) > 0 {
+			return hostID, nil
+		}
+	}
+	// Even if running in Kubernetes fallback to local storage if `host_uuid` was
+	// not found in secret.
+	hostID, err := hostid.ReadFile(dataDir)
+	return hostID, trace.Wrap(err)
+}
+
+// PersistAssignedHostID writes an assigned host ID to state storage and the
+// host_uuid file. This should not be called in the same process as
+// ReadOrGenerateHostID, it is intended to persist a host UUID assigned by the
+// Auth service that was not generated locally. With the new auth-assigned host
+// persisted to storage to maintain compatibility with any other processes that
+// UUID flow the agent doesn't even need to read the host ID, it is only
+// may read it.
+func (p *ProcessStorage) PersistAssignedHostID(ctx context.Context, cfg *servicecfg.Config, hostID string) error {
+	if p.stateStorage != nil {
+		if _, err := p.stateStorage.Put(
+			ctx,
+			backend.Item{
+				Key:   backend.NewKey(hostid.FileName),
+				Value: []byte(hostID),
+			},
+		); err != nil {
+			return trace.Wrap(err, "persisting host ID to state storage")
+		}
+	}
+	if err := hostid.WriteFile(cfg.DataDir, hostID); err != nil {
+		return trace.Wrap(err, "persisting host ID to file")
+	}
+	return nil
+}
+
+// persistHostIDToStorages writes the host ID to local data and to
+// Kubernetes Secret if this process is running on a Kubernetes Cluster.
+func persistHostIDToStorages(ctx context.Context, cfg *servicecfg.Config, hostID string, kubeBackend stateBackend) error {
+	// Persists the `host_uuid` into Kubernetes Secret for later reusage.
+	// This is required because `host_uuid` is part of the client secret
+	// and Auth connection will fail if we present a different `host_uuid`.
+	if kubeBackend != nil {
+		if err := writeHostIDToKubeSecret(ctx, kubeBackend, hostID); err != nil {
+			// If the storage of the secret fails, don't attempt to write the host id to disk.
+			return trace.Wrap(err)
+		}
+		// Success, write the hostid to disk.
+	}
+
+	if err := hostid.WriteFile(cfg.DataDir, hostID); err != nil {
+		if errors.Is(err, fs.ErrPermission) {
+			cfg.Logger.ErrorContext(ctx, "Teleport does not have permission to write to the data directory. Ensure that you are running as a user with appropriate permissions.", "data_dir", cfg.DataDir)
+		}
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// loadHostIDFromKubeSecret reads the host_uuid from the Kubernetes secret with
+// the expected key: `/host_uuid`.
+func loadHostIDFromKubeSecret(ctx context.Context, kubeBackend stateBackend) (string, error) {
+	item, err := kubeBackend.Get(ctx, backend.NewKey(hostid.FileName))
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return string(item.Value), nil
+}
+
+// writeHostIDToKubeSecret writes the `host_uuid` into the Kubernetes secret under
+// the key `/host_uuid`.
+func writeHostIDToKubeSecret(ctx context.Context, kubeBackend stateBackend, id string) error {
+	// NOTE: The host uuid should never be updated. If we fail on conflict, we need to backtrack.
+	_, err := kubeBackend.Create(
+		ctx,
+		backend.Item{
+			Key:   backend.NewKey(hostid.FileName),
+			Value: []byte(id),
+		},
+	)
+	return trace.Wrap(err)
 }
diff --git a/lib/auth/storage/storage_test.go b/lib/auth/storage/storage_test.go
index 42302101c7036..ed561576c9999 100644
--- a/lib/auth/storage/storage_test.go
+++ b/lib/auth/storage/storage_test.go
@@ -18,13 +18,20 @@ package storage
 
 import (
 	"context"
+	"fmt"
+	"log/slog"
 	"testing"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils/hostid"
 )
 
 func TestRDPLicense(t *testing.T) {
@@ -70,3 +77,154 @@ func TestRDPLicense(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, licenseData, license)
 }
+
+func Test_readOrGenerateHostID(t *testing.T) {
+	id := uuid.New().String()
+	const hostUUIDKey = "/host_uuid"
+	type args struct {
+		kubeBackend   *fakeKubeBackend
+		hostIDContent string
+		identity      []*state.Identity
+	}
+	tests := []struct {
+		name             string
+		args             args
+		wantFunc         func(string) bool
+		wantKubeItemFunc func(*backend.Item) bool
+	}{
+		{
+			name: "load from storage without kube backend",
+			args: args{
+				kubeBackend:   nil,
+				hostIDContent: id,
+			},
+			wantFunc: func(receivedID string) bool {
+				return receivedID == id
+			},
+		},
+		{
+			name: "Kube Backend is available with key. Load from kube storage",
+			args: args{
+				kubeBackend: &fakeKubeBackend{
+					getData: &backend.Item{
+						Key:   backend.KeyFromString(hostUUIDKey),
+						Value: []byte(id),
+					},
+					getErr: nil,
+				},
+			},
+			wantFunc: func(receivedID string) bool {
+				return receivedID == id
+			},
+			wantKubeItemFunc: func(i *backend.Item) bool {
+				return i == nil
+			},
+		},
+		{
+			name: "No hostID available. Generate one and store it into Kube and Local Storage",
+			args: args{
+				kubeBackend: &fakeKubeBackend{
+					getData: nil,
+					getErr:  fmt.Errorf("key not found"),
+				},
+			},
+			wantFunc: func(receivedID string) bool {
+				_, err := uuid.Parse(receivedID)
+				return err == nil
+			},
+			wantKubeItemFunc: func(i *backend.Item) bool {
+				_, err := uuid.Parse(string(i.Value))
+				return err == nil && i.Key.String() == hostUUIDKey
+			},
+		},
+		{
+			name: "No hostID available. Generate one and store it into Local Storage",
+			args: args{
+				kubeBackend: nil,
+			},
+			wantFunc: func(receivedID string) bool {
+				_, err := uuid.Parse(receivedID)
+				return err == nil
+			},
+			wantKubeItemFunc: nil,
+		},
+		{
+			name: "No hostID available. Grab from provided static identity",
+			args: args{
+				kubeBackend: &fakeKubeBackend{
+					getData: nil,
+					getErr:  fmt.Errorf("key not found"),
+				},
+
+				identity: []*state.Identity{
+					{
+						ID: state.IdentityID{
+							HostUUID: id,
+						},
+					},
+				},
+			},
+			wantFunc: func(receivedID string) bool {
+				return receivedID == id
+			},
+			wantKubeItemFunc: func(i *backend.Item) bool {
+				_, err := uuid.Parse(string(i.Value))
+				return err == nil && i.Key.String() == hostUUIDKey
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dataDir := t.TempDir()
+			// write host_uuid file to temp dir.
+			if len(tt.args.hostIDContent) > 0 {
+				err := hostid.WriteFile(dataDir, tt.args.hostIDContent)
+				require.NoError(t, err)
+			}
+
+			cfg := &servicecfg.Config{
+				DataDir:    dataDir,
+				Logger:     slog.Default(),
+				JoinMethod: types.JoinMethodToken,
+				Identities: tt.args.identity,
+			}
+
+			var kubeBackend stateBackend
+			if tt.args.kubeBackend != nil {
+				kubeBackend = tt.args.kubeBackend
+			}
+
+			hostID, err := readOrGenerateHostID(context.Background(), cfg, kubeBackend)
+			require.NoError(t, err)
+
+			require.True(t, tt.wantFunc(hostID))
+
+			if tt.args.kubeBackend != nil {
+				require.True(t, tt.wantKubeItemFunc(tt.args.kubeBackend.putData))
+			}
+		})
+	}
+}
+
+type fakeKubeBackend struct {
+	putData *backend.Item
+	getData *backend.Item
+	getErr  error
+}
+
+func (f *fakeKubeBackend) Create(ctx context.Context, i backend.Item) (*backend.Lease, error) {
+	f.putData = &i
+	return &backend.Lease{}, nil
+}
+
+// Put puts value into backend (creates if it does not
+// exists, updates it otherwise)
+func (f *fakeKubeBackend) Put(ctx context.Context, i backend.Item) (*backend.Lease, error) {
+	f.putData = &i
+	return &backend.Lease{}, nil
+}
+
+// Get returns a single item or not found error
+func (f *fakeKubeBackend) Get(ctx context.Context, key backend.Key) (*backend.Item, error) {
+	return f.getData, f.getErr
+}
diff --git a/lib/auth/storage/storage_unix.go b/lib/auth/storage/storage_unix.go
index b33973a665ea9..058fe4e1811ba 100644
--- a/lib/auth/storage/storage_unix.go
+++ b/lib/auth/storage/storage_unix.go
@@ -52,7 +52,7 @@ func NewProcessStorage(ctx context.Context, path string) (*ProcessStorage, error
 	// the agent will automatically switch state storage from local
 	// sqlite into a Kubernetes Secret.
 	if kubernetes.InKubeCluster() {
-		kubeStorage, err := kubernetes.New()
+		kubeStorage, err := kubernetes.New(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/summarizer/provider.go b/lib/auth/summarizer/provider.go
new file mode 100644
index 0000000000000..35a1a124e3348
--- /dev/null
+++ b/lib/auth/summarizer/provider.go
@@ -0,0 +1,96 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package summarizer
+
+import (
+	"context"
+	"sync"
+
+	"github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// SessionSummarizerProvider provides a reference to a Summarizer service
+// implementation. Here is why it is needed:
+//
+// The actual summarizer service has to be created after the
+// lib/events.ProtoStreamer, as the summarizer lives in the enterprise plugin,
+// which is configured later in the initialization process. Another factor here
+// is that the summarizer depends on the streamer for loading session
+// recordings, however, the streamer depends on the summarizer, as it needs to
+// call it when the upload finishes.
+//
+// In an absence of a dependency injection container, one solution is to use a
+// provider that is passed to the streamer as a dependency. It allows for late
+// initialization of the summarizer service. This way the provided service can
+// be replaced without ever needing to change the streamer interface by adding
+// a setter method; doing so would pollute the interface and require some
+// unnecessary stub implementations.
+type SessionSummarizerProvider struct {
+	summarizer SessionSummarizer
+	mu         sync.Mutex
+}
+
+// SessionSummarizer provides the configured [SessionSummarizer]. It is safe to
+// call this function from any thread. The returned [SessionSummarizer] is
+// guaranteed to never be nil.
+func (p *SessionSummarizerProvider) SessionSummarizer() SessionSummarizer {
+	if p == nil {
+		return NoopSummarizer{}
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.summarizer == nil {
+		return NoopSummarizer{}
+	}
+
+	return p.summarizer
+}
+
+// SetSummarizer sets the summarizer service to be provided. It is safe to call
+// this function from any thread.
+func (p *SessionSummarizerProvider) SetSummarizer(s SessionSummarizer) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.summarizer = s
+}
+
+// NewSessionSummarizerProvider creates a new [SessionSummarizerProvider]
+// without a summarizer.
+func NewSessionSummarizerProvider() *SessionSummarizerProvider {
+	sp := &SessionSummarizerProvider{}
+	sp.SetSummarizer(NoopSummarizer{})
+	return sp
+}
+
+// NoopSummarizer is a no-op implementation of the [SessionSummarizer]
+// interface.
+type NoopSummarizer struct{}
+
+func (n NoopSummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *events.SessionEnd) error {
+	return nil
+}
+
+func (n NoopSummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *events.DatabaseSessionEnd) error {
+	return nil
+}
+
+func (NoopSummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	return nil
+}
diff --git a/lib/auth/summarizer/provider_test.go b/lib/auth/summarizer/provider_test.go
new file mode 100644
index 0000000000000..b0d2bd4ead733
--- /dev/null
+++ b/lib/auth/summarizer/provider_test.go
@@ -0,0 +1,59 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package summarizer
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestProvideSummarizer(t *testing.T) {
+	var provider *SessionSummarizerProvider
+	assert.IsType(t, NoopSummarizer{}, provider.SessionSummarizer(),
+		"nil provider should return a noop summarizer")
+
+	provider = NewSessionSummarizerProvider()
+	assert.IsType(t, NoopSummarizer{}, provider.SessionSummarizer(),
+		"new provider should return a noop summarizer")
+
+	s := dummySummarizer{}
+	provider.SetSummarizer(s)
+	assert.Equal(t, s, provider.SessionSummarizer(), "should return the set summarizer")
+
+	provider.SetSummarizer(nil)
+	assert.IsType(t, NoopSummarizer{}, provider.SessionSummarizer(),
+		"after setting a nil summarizer, the provider should return a noop one instead")
+}
+
+type dummySummarizer struct{}
+
+func (m dummySummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *events.SessionEnd) error {
+	return nil
+}
+
+func (m dummySummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *events.DatabaseSessionEnd) error {
+	return nil
+}
+
+func (m dummySummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	return nil
+}
diff --git a/lib/auth/summarizer/summarizer.go b/lib/auth/summarizer/summarizer.go
new file mode 100644
index 0000000000000..b22ce3ad58928
--- /dev/null
+++ b/lib/auth/summarizer/summarizer.go
@@ -0,0 +1,41 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package summarizer
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// SessionSummarizer summarizes session recordings using language model
+// inference.
+type SessionSummarizer interface {
+	// SummarizeSSH summarizes the SSH session recording associated with the
+	// provided [events.SessionEnd] event.
+	SummarizeSSH(ctx context.Context, sessionEndEvent *events.SessionEnd) error
+	// SummarizeDatabase summarizes the database session recording associated
+	// with the provided [events.DatabaseSessionEnd] event.
+	SummarizeDatabase(ctx context.Context, sessionEndEvent *events.DatabaseSessionEnd) error
+	// SummarizeWithoutEndEvent summarizes a session recording with a given ID.
+	// This is used for cases where the session ID is known, but there is no end
+	// event available. [SessionSummarizer.SummarizeSSH] and
+	// [SessionSummarizer.SummarizeDatabase] should be used instead of this
+	// method whenever possible, as they are more efficient.
+	SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error
+}
diff --git a/lib/auth/summarizer/summarizerv1/service.go b/lib/auth/summarizer/summarizerv1/service.go
new file mode 100644
index 0000000000000..62b6ce4438ac0
--- /dev/null
+++ b/lib/auth/summarizer/summarizerv1/service.go
@@ -0,0 +1,220 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package summarizerv1
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	summarizerv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+)
+
+// NewService creates a new OSS version of the SummarizerService. It
+// returns a licensing error from every RPC.
+func NewService() *UnimplementedService {
+	return &UnimplementedService{}
+}
+
+// UnimplementedService is an OSS version of the UnimplementedService. It
+// returns a licensing error from every RPC.
+type UnimplementedService struct {
+	summarizerv1pb.UnimplementedSummarizerServiceServer
+}
+
+// CRUD operations for models
+
+// CreateInferenceModel is supposed to create a new inference model, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) CreateInferenceModel(
+	ctx context.Context, req *summarizerv1pb.CreateInferenceModelRequest,
+) (*summarizerv1pb.CreateInferenceModelResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// GetInferenceModel is supposed to retrieve an inference model by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) GetInferenceModel(
+	ctx context.Context, req *summarizerv1pb.GetInferenceModelRequest,
+) (*summarizerv1pb.GetInferenceModelResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpdateInferenceModel is supposed to update an existing inference model, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpdateInferenceModel(
+	ctx context.Context, req *summarizerv1pb.UpdateInferenceModelRequest,
+) (*summarizerv1pb.UpdateInferenceModelResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpsertInferenceModel is supposed to create or update an inference model, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpsertInferenceModel(
+	ctx context.Context, req *summarizerv1pb.UpsertInferenceModelRequest,
+) (*summarizerv1pb.UpsertInferenceModelResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// DeleteInferenceModel is supposed to delete an inference model by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) DeleteInferenceModel(
+	ctx context.Context, req *summarizerv1pb.DeleteInferenceModelRequest,
+) (*summarizerv1pb.DeleteInferenceModelResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// ListInferenceModels is supposed to list inference models with pagination
+// support, but returns an error indicating that this feature is only available
+// in the enterprise version of Teleport.
+func (s *UnimplementedService) ListInferenceModels(
+	ctx context.Context, req *summarizerv1pb.ListInferenceModelsRequest,
+) (*summarizerv1pb.ListInferenceModelsResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// CRUD operations for secrets
+
+// CreateInferenceSecret is supposed to create a new inference secret, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) CreateInferenceSecret(
+	ctx context.Context, req *summarizerv1pb.CreateInferenceSecretRequest,
+) (*summarizerv1pb.CreateInferenceSecretResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// GetInferenceSecret is supposed to retrieve an inference secret by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) GetInferenceSecret(
+	ctx context.Context, req *summarizerv1pb.GetInferenceSecretRequest,
+) (*summarizerv1pb.GetInferenceSecretResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpdateInferenceSecret is supposed to update an existing inference secret,
+// but returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpdateInferenceSecret(
+	ctx context.Context, req *summarizerv1pb.UpdateInferenceSecretRequest,
+) (*summarizerv1pb.UpdateInferenceSecretResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpsertInferenceSecret is supposed to create or update an inference secret,
+// but returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpsertInferenceSecret(
+	ctx context.Context, req *summarizerv1pb.UpsertInferenceSecretRequest,
+) (*summarizerv1pb.UpsertInferenceSecretResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// DeleteInferenceSecret is supposed to delete an inference secret by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) DeleteInferenceSecret(
+	ctx context.Context, req *summarizerv1pb.DeleteInferenceSecretRequest,
+) (*summarizerv1pb.DeleteInferenceSecretResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// ListInferenceSecrets is supposed to list inference secrets with pagination
+// support, but returns an error indicating that this feature is only available
+// in the enterprise version of Teleport.
+func (s *UnimplementedService) ListInferenceSecrets(
+	ctx context.Context, req *summarizerv1pb.ListInferenceSecretsRequest,
+) (*summarizerv1pb.ListInferenceSecretsResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// CRUD operations for policies
+
+// CreateInferencePolicy is supposed to create a new inference policy, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) CreateInferencePolicy(
+	ctx context.Context, req *summarizerv1pb.CreateInferencePolicyRequest,
+) (*summarizerv1pb.CreateInferencePolicyResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// GetInferencePolicy is supposed to retrieve an inference policy by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) GetInferencePolicy(
+	ctx context.Context, req *summarizerv1pb.GetInferencePolicyRequest,
+) (*summarizerv1pb.GetInferencePolicyResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpdateInferencePolicy is supposed to update an existing inference policy,
+// but returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpdateInferencePolicy(
+	ctx context.Context, req *summarizerv1pb.UpdateInferencePolicyRequest,
+) (*summarizerv1pb.UpdateInferencePolicyResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// UpsertInferencePolicy is supposed to create or update an inference policy,
+// but returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) UpsertInferencePolicy(
+	ctx context.Context, req *summarizerv1pb.UpsertInferencePolicyRequest,
+) (*summarizerv1pb.UpsertInferencePolicyResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// DeleteInferencePolicy is supposed to delete an inference policy by name, but
+// returns an error indicating that this feature is only available in the
+// enterprise version of Teleport.
+func (s *UnimplementedService) DeleteInferencePolicy(
+	ctx context.Context, req *summarizerv1pb.DeleteInferencePolicyRequest,
+) (*summarizerv1pb.DeleteInferencePolicyResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// ListInferencePolicies is supposed to list inference policies with pagination
+// support, but returns an error indicating that this feature is only available
+// in the enterprise version of Teleport.
+func (s *UnimplementedService) ListInferencePolicies(
+	ctx context.Context, req *summarizerv1pb.ListInferencePoliciesRequest,
+) (*summarizerv1pb.ListInferencePoliciesResponse, error) {
+	return nil, requireEnterprise()
+}
+
+// IsEnabled is supposed to tell if the summarizer is enabled by the license
+// and configured, but it always returns false. In contrast to other methods
+// here, it doesn't return an error, since not having an enterprise license is
+// still a valid case from this method's perspective.
+func (s *UnimplementedService) IsEnabled(
+	ctx context.Context, req *summarizerv1pb.IsEnabledRequest,
+) (*summarizerv1pb.IsEnabledResponse, error) {
+	return &summarizerv1pb.IsEnabledResponse{Enabled: false}, nil
+}
+
+func requireEnterprise() error {
+	return trace.AccessDenied(
+		"session recording summarization is only available with an enterprise license that supports Teleport Identity Security")
+}
diff --git a/lib/auth/test/suite.go b/lib/auth/test/suite.go
deleted file mode 100644
index e30373c7a9c8a..0000000000000
--- a/lib/auth/test/suite.go
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-// package test contains CA authority acceptance test suite.
-package test
-
-import (
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/constants"
-	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/sshca"
-)
-
-type AuthSuite struct {
-	A      sshca.Authority
-	Keygen func() ([]byte, []byte, error)
-	Clock  clockwork.Clock
-}
-
-func (s *AuthSuite) GenerateKeypairEmptyPass(t *testing.T) {
-	priv, pub, err := s.Keygen()
-	require.NoError(t, err)
-
-	// make sure we can parse the private and public key
-	_, err = ssh.ParsePrivateKey(priv)
-	require.NoError(t, err)
-
-	_, _, _, _, err = ssh.ParseAuthorizedKey(pub)
-	require.NoError(t, err)
-}
-
-func (s *AuthSuite) GenerateHostCert(t *testing.T) {
-	priv, pub, err := s.Keygen()
-	require.NoError(t, err)
-
-	caSigner, err := ssh.ParsePrivateKey(priv)
-	require.NoError(t, err)
-
-	cert, err := s.A.GenerateHostCert(sshca.HostCertificateRequest{
-		CASigner:      caSigner,
-		PublicHostKey: pub,
-		HostID:        "00000000-0000-0000-0000-000000000000",
-		NodeName:      "auth.example.com",
-		TTL:           time.Hour,
-		Identity: sshca.Identity{
-			ClusterName: "example.com",
-			SystemRole:  types.RoleAdmin,
-		},
-	})
-	require.NoError(t, err)
-
-	certificate, err := sshutils.ParseCertificate(cert)
-	require.NoError(t, err)
-
-	// Check the valid time is not more than 1 minute before the current time.
-	validAfter := time.Unix(int64(certificate.ValidAfter), 0)
-	require.Equal(t, validAfter.Unix(), s.Clock.Now().UTC().Add(-1*time.Minute).Unix())
-
-	// Check the valid time is not more than 1 hour after the current time.
-	validBefore := time.Unix(int64(certificate.ValidBefore), 0)
-	require.Equal(t, validBefore.Unix(), s.Clock.Now().UTC().Add(1*time.Hour).Unix())
-}
-
-func (s *AuthSuite) GenerateUserCert(t *testing.T) {
-	priv, pub, err := s.Keygen()
-	require.NoError(t, err)
-
-	caSigner, err := ssh.ParsePrivateKey(priv)
-	require.NoError(t, err)
-
-	cert, err := s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               time.Hour,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:              "user",
-			Principals:            []string{"centos", "root"},
-			PermitAgentForwarding: true,
-			PermitPortForwarding:  true,
-		},
-	})
-	require.NoError(t, err)
-
-	// Check the valid time is not more than 1 minute before and 1 hour after
-	// the current time.
-	err = checkCertExpiry(cert, s.Clock.Now().Add(-1*time.Minute), s.Clock.Now().Add(1*time.Hour))
-	require.NoError(t, err)
-
-	cert, err = s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               -20,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:              "user",
-			Principals:            []string{"root"},
-			PermitAgentForwarding: true,
-			PermitPortForwarding:  true,
-		},
-	})
-	require.NoError(t, err)
-	err = checkCertExpiry(cert, s.Clock.Now().Add(-1*time.Minute), s.Clock.Now().Add(apidefaults.MinCertDuration))
-	require.NoError(t, err)
-
-	_, err = s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               0,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:              "user",
-			Principals:            []string{"root"},
-			PermitAgentForwarding: true,
-			PermitPortForwarding:  true,
-		},
-	})
-	require.NoError(t, err)
-	err = checkCertExpiry(cert, s.Clock.Now().Add(-1*time.Minute), s.Clock.Now().Add(apidefaults.MinCertDuration))
-	require.NoError(t, err)
-
-	_, err = s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               time.Hour,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:              "user",
-			Principals:            []string{"root"},
-			PermitAgentForwarding: true,
-			PermitPortForwarding:  true,
-		},
-	})
-	require.NoError(t, err)
-
-	inRoles := []string{"role-1", "role-2"}
-	impersonator := "alice"
-	cert, err = s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               time.Hour,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:              "user",
-			Impersonator:          impersonator,
-			Principals:            []string{"root"},
-			PermitAgentForwarding: true,
-			PermitPortForwarding:  true,
-			Roles:                 inRoles,
-		},
-	})
-	require.NoError(t, err)
-	parsedCert, err := sshutils.ParseCertificate(cert)
-	require.NoError(t, err)
-
-	parsedIdent, err := sshca.DecodeIdentity(parsedCert)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(parsedIdent.Roles, inRoles))
-
-	require.Empty(t, cmp.Diff(parsedIdent.Impersonator, impersonator))
-
-	// Check that MFAVerified and PreviousIdentityExpires are encoded into ssh cert
-	clock := clockwork.NewFakeClock()
-	cert, err = s.A.GenerateUserCert(sshca.UserCertificateRequest{
-		CASigner:          caSigner,
-		PublicUserKey:     pub,
-		TTL:               time.Minute,
-		CertificateFormat: constants.CertificateFormatStandard,
-		Identity: sshca.Identity{
-			Username:                "user",
-			Principals:              []string{"root"},
-			MFAVerified:             "mfa-device-id",
-			PreviousIdentityExpires: clock.Now().Add(time.Hour),
-		},
-	})
-	require.NoError(t, err)
-	parsedCert, err = sshutils.ParseCertificate(cert)
-	require.NoError(t, err)
-	require.Contains(t, parsedCert.Extensions, teleport.CertExtensionMFAVerified)
-	require.Equal(t, "mfa-device-id", parsedCert.Extensions[teleport.CertExtensionMFAVerified])
-	require.Contains(t, parsedCert.Extensions, teleport.CertExtensionPreviousIdentityExpires)
-	prevIDExpires, err := time.Parse(time.RFC3339, parsedCert.Extensions[teleport.CertExtensionPreviousIdentityExpires])
-	require.NoError(t, err)
-	require.WithinDuration(t, clock.Now().Add(time.Hour), prevIDExpires, time.Second)
-
-	t.Run("device extensions", func(t *testing.T) {
-		const devID = "deviceid1"
-		const devTag = "devicetag1"
-		const devCred = "devicecred1"
-		certRaw, err := s.A.GenerateUserCert(sshca.UserCertificateRequest{
-			CASigner:      caSigner, // Required.
-			PublicUserKey: pub,      // Required.
-			Identity: sshca.Identity{
-				Username:           "llama",           // Required.
-				Principals:         []string{"llama"}, // Required.
-				DeviceID:           devID,
-				DeviceAssetTag:     devTag,
-				DeviceCredentialID: devCred,
-			},
-		})
-		require.NoError(t, err, "GenerateUserCert failed")
-
-		sshCert, err := sshutils.ParseCertificate(certRaw)
-		require.NoError(t, err, "ParseCertificate failed")
-		assert.Equal(t, devID, sshCert.Extensions[teleport.CertExtensionDeviceID], "DeviceID mismatch")
-		assert.Equal(t, devTag, sshCert.Extensions[teleport.CertExtensionDeviceAssetTag], "AssetTag mismatch")
-		assert.Equal(t, devCred, sshCert.Extensions[teleport.CertExtensionDeviceCredentialID], "CredentialID mismatch")
-	})
-
-	t.Run("github identity", func(t *testing.T) {
-		githubUserID := "1234567"
-		githubUsername := "github-user"
-		certRaw, err := s.A.GenerateUserCert(sshca.UserCertificateRequest{
-			CASigner:      caSigner, // Required.
-			PublicUserKey: pub,      // Required.
-			Identity: sshca.Identity{
-				Username:       "llama",           // Required.
-				Principals:     []string{"llama"}, // Required.
-				GitHubUserID:   githubUserID,
-				GitHubUsername: githubUsername,
-			},
-		})
-		require.NoError(t, err, "GenerateUserCert failed")
-
-		sshCert, err := sshutils.ParseCertificate(certRaw)
-		require.NoError(t, err, "ParseCertificate failed")
-		assert.Equal(t, githubUserID, sshCert.Extensions[teleport.CertExtensionGitHubUserID])
-		assert.Equal(t, githubUsername, sshCert.Extensions[teleport.CertExtensionGitHubUsername])
-	})
-}
-
-func checkCertExpiry(cert []byte, after, before time.Time) error {
-	certificate, err := sshutils.ParseCertificate(cert)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	validAfter := time.Unix(int64(certificate.ValidAfter), 0)
-	if !validAfter.Equal(after) {
-		return trace.BadParameter("ValidAfter incorrect: got %v, want %v", validAfter, after)
-	}
-	validBefore := time.Unix(int64(certificate.ValidBefore), 0)
-	if !validBefore.Equal(before) {
-		return trace.BadParameter("ValidBefore incorrect: got %v, want %v", validBefore, before)
-	}
-	return nil
-}
diff --git a/lib/auth/tls_test.go b/lib/auth/tls_test.go
index 30f62606884ac..56a6102b3ba88 100644
--- a/lib/auth/tls_test.go
+++ b/lib/auth/tls_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -36,6 +36,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/pquerna/otp/totp"
@@ -57,10 +58,12 @@ import (
 	eventtypes "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
@@ -69,10 +72,12 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/sshca"
 	libsshutils "github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -82,21 +87,23 @@ import (
 func TestRejectedClients(t *testing.T) {
 	t.Setenv("TELEPORT_UNSTABLE_REJECT_OLD_CLIENTS", "yes")
 
-	server, err := NewTestAuthServer(TestAuthServerConfig{
+	server, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:         t.TempDir(),
 		ClusterName: "cluster",
 		Clock:       clockwork.NewFakeClock(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, server.Close()) })
 
-	user, _, err := CreateUserAndRole(server.AuthServer, "user", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(server.AuthServer, "user", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	tlsServer, err := server.NewTestTLSServer()
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 	defer tlsServer.Close()
 
-	tlsConfig, err := tlsServer.ClientTLSConfig(TestUser(user.GetName()))
+	tlsConfig, err := tlsServer.ClientTLSConfig(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	clt, err := authclient.NewClient(client.Config{
@@ -147,12 +154,13 @@ func TestRemoteBuiltinRole(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
+	remoteServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:         t.TempDir(),
 		ClusterName: "remote",
-		Clock:       testSrv.AuthServer.TestAuthServerConfig.Clock,
+		Clock:       testSrv.AuthServer.AuthServerConfig.Clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteServer.Close()) })
 
 	certPool, err := testSrv.CertPool()
 	require.NoError(t, err)
@@ -160,8 +168,9 @@ func TestRemoteBuiltinRole(t *testing.T) {
 	// without trust, proxy server will get rejected
 	// remote auth server will get rejected because it is not supported
 	remoteProxy, err := remoteServer.NewRemoteClient(
-		TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
+		authtest.TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteProxy.Close()) })
 
 	// certificate authority is not recognized, because
 	// the trust has not been established yet
@@ -179,10 +188,12 @@ func TestRemoteBuiltinRole(t *testing.T) {
 	// there's also no reason to retry if somehow we fail to build the client
 	for range 50 {
 		remoteProxy, err = remoteServer.NewRemoteClient(
-			TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
+			authtest.TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
 		require.NoError(t, err)
 
 		_, err = remoteProxy.GetNodes(ctx, apidefaults.Namespace)
+		remoteProxy.Close()
+
 		if err == nil {
 			break
 		}
@@ -192,8 +203,9 @@ func TestRemoteBuiltinRole(t *testing.T) {
 
 	// remote auth server will get rejected even with established trust
 	remoteAuth, err := remoteServer.NewRemoteClient(
-		TestBuiltin(types.RoleAuth), testSrv.Addr(), certPool)
+		authtest.TestBuiltin(types.RoleAuth), testSrv.Addr(), certPool)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteAuth.Close()) })
 
 	_, err = remoteAuth.GetDomainName(ctx)
 	require.True(t, trace.IsAccessDenied(err))
@@ -207,15 +219,16 @@ func TestAcceptedUsage(t *testing.T) {
 
 	ctx := context.Background()
 
-	server, err := NewTestAuthServer(TestAuthServerConfig{
+	server, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:           t.TempDir(),
 		ClusterName:   "remote",
 		AcceptedUsage: []string{"usage:k8s"},
 		Clock:         clockwork.NewFakeClock(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, server.Close()) })
 
-	user, _, err := CreateUserAndRole(server.AuthServer, "user", []string{"role"}, nil)
+	user, _, err := authtest.CreateUserAndRole(server.AuthServer, "user", []string{"role"}, nil)
 	require.NoError(t, err)
 
 	tlsServer, err := server.NewTestTLSServer()
@@ -223,7 +236,7 @@ func TestAcceptedUsage(t *testing.T) {
 	defer tlsServer.Close()
 
 	// Unrestricted clients can use restricted servers
-	client, err := tlsServer.NewClient(TestUser(user.GetName()))
+	client, err := tlsServer.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 
 	// certificate authority is not recognized, because
@@ -233,7 +246,7 @@ func TestAcceptedUsage(t *testing.T) {
 
 	// restricted clients can use restricted servers if restrictions
 	// exactly match
-	identity := TestUser(user.GetName())
+	identity := authtest.TestUser(user.GetName())
 	identity.AcceptedUsage = []string{"usage:k8s"}
 	client, err = tlsServer.NewClient(identity)
 	require.NoError(t, err)
@@ -242,7 +255,7 @@ func TestAcceptedUsage(t *testing.T) {
 	require.NoError(t, err)
 
 	// restricted clients can will be rejected if usage does not match
-	identity = TestUser(user.GetName())
+	identity = authtest.TestUser(user.GetName())
 	identity.AcceptedUsage = []string{"usage:extra"}
 	client, err = tlsServer.NewClient(identity)
 	require.NoError(t, err)
@@ -252,7 +265,7 @@ func TestAcceptedUsage(t *testing.T) {
 
 	// restricted clients can will be rejected, for now if there is any mismatch,
 	// including extra usage.
-	identity = TestUser(user.GetName())
+	identity = authtest.TestUser(user.GetName())
 	identity.AcceptedUsage = []string{"usage:k8s", "usage:unknown"}
 	client, err = tlsServer.NewClient(identity)
 	require.NoError(t, err)
@@ -271,12 +284,13 @@ func TestRemoteRotation(t *testing.T) {
 
 	var ok bool
 
-	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
+	remoteServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:         t.TempDir(),
 		ClusterName: "remote",
-		Clock:       testSrv.AuthServer.TestAuthServerConfig.Clock,
+		Clock:       testSrv.AuthServer.AuthServerConfig.Clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteServer.Close()) })
 
 	certPool, err := testSrv.CertPool()
 	require.NoError(t, err)
@@ -286,17 +300,21 @@ func TestRemoteRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	remoteProxy, err := remoteServer.NewRemoteClient(
-		TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
+		authtest.TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteProxy.Close()) })
 
 	remoteAuth, err := remoteServer.NewRemoteClient(
-		TestBuiltin(types.RoleAuth), testSrv.Addr(), certPool)
+		authtest.TestBuiltin(types.RoleAuth), testSrv.Addr(), certPool)
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteAuth.Close()) })
 
 	// remote cluster starts rotation
 	gracePeriod := time.Hour
-	remoteServer.AuthServer.privateKey, ok = fixtures.PEMBytes["rsa"]
+	privateKey, ok := fixtures.PEMBytes["rsa"]
 	require.True(t, ok)
+
+	testSrv.Auth().SetPrivateKey(privateKey)
 	err = remoteServer.AuthServer.RotateCertAuthority(ctx, types.RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -357,7 +375,7 @@ func TestRemoteRotation(t *testing.T) {
 
 	// newRemoteProxy should be trusted by the auth server
 	newRemoteProxy, err := remoteServer.NewRemoteClient(
-		TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
+		authtest.TestBuiltin(types.RoleProxy), testSrv.Addr(), certPool)
 	require.NoError(t, err)
 
 	_, err = newRemoteProxy.GetNodes(ctx, apidefaults.Namespace)
@@ -376,12 +394,13 @@ func TestLocalProxyPermissions(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
+	remoteServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:         t.TempDir(),
 		ClusterName: "remote",
-		Clock:       testSrv.AuthServer.TestAuthServerConfig.Clock,
+		Clock:       testSrv.AuthServer.AuthServerConfig.Clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteServer.Close()) })
 
 	// after trust is established, things are good
 	err = testSrv.AuthServer.Trust(ctx, remoteServer, nil)
@@ -393,8 +412,9 @@ func TestLocalProxyPermissions(t *testing.T) {
 	}, false)
 	require.NoError(t, err)
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, proxy.Close()) })
 
 	// local proxy can't update local cert authorities
 	err = proxy.UpsertCertAuthority(ctx, ca)
@@ -422,7 +442,7 @@ func TestAutoRotation(t *testing.T) {
 	var ok bool
 
 	// create proxy client
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// client works before rotation is initiated
@@ -430,8 +450,9 @@ func TestAutoRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	// starts rotation
-	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
+	privateKey, ok := fixtures.PEMBytes["rsa"]
 	require.True(t, ok)
+	testSrv.Auth().SetPrivateKey(privateKey)
 	gracePeriod := time.Hour
 	err = testSrv.Auth().RotateCertAuthority(ctx, types.RotateRequest{
 		Type:        types.HostCA,
@@ -457,7 +478,7 @@ func TestAutoRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	// new clients work as well
-	_, err = testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	_, err = testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// advance rotation by clock
@@ -477,7 +498,7 @@ func TestAutoRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	// new clients work as well
-	newProxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	newProxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	_, err = newProxy.GetNodes(ctx, apidefaults.Namespace)
@@ -524,7 +545,7 @@ func TestAutoFallback(t *testing.T) {
 	var ok bool
 
 	// create proxy client just for test purposes
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// client works before rotation is initiated
@@ -532,8 +553,10 @@ func TestAutoFallback(t *testing.T) {
 	require.NoError(t, err)
 
 	// starts rotation
-	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
+	privateKey, ok := fixtures.PEMBytes["rsa"]
 	require.True(t, ok)
+
+	testSrv.Auth().SetPrivateKey(privateKey)
 	gracePeriod := time.Hour
 	err = testSrv.Auth().RotateCertAuthority(ctx, types.RotateRequest{
 		Type:        types.HostCA,
@@ -584,7 +607,7 @@ func TestManualRotation(t *testing.T) {
 	var ok bool
 
 	// create proxy client just for test purposes
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// client works before rotation is initiated
@@ -593,8 +616,10 @@ func TestManualRotation(t *testing.T) {
 
 	// can't jump to mid-phase
 	gracePeriod := time.Hour
-	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
+	privateKey, ok := fixtures.PEMBytes["rsa"]
 	require.True(t, ok)
+
+	testSrv.Auth().SetPrivateKey(privateKey)
 	err = testSrv.Auth().RotateCertAuthority(ctx, types.RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -630,7 +655,7 @@ func TestManualRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	// new clients work as well
-	newProxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	newProxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	_, err = newProxy.GetNodes(ctx, apidefaults.Namespace)
@@ -695,7 +720,7 @@ func TestRollback(t *testing.T) {
 	var ok bool
 
 	// create proxy client just for test purposes
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	defer proxy.Close()
 
@@ -705,8 +730,9 @@ func TestRollback(t *testing.T) {
 
 	// starts rotation
 	gracePeriod := time.Hour
-	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
+	privateKey, ok := fixtures.PEMBytes["rsa"]
 	require.True(t, ok)
+	testSrv.Auth().SetPrivateKey(privateKey)
 	err = testSrv.Auth().RotateCertAuthority(ctx, types.RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -725,7 +751,7 @@ func TestRollback(t *testing.T) {
 	require.NoError(t, err)
 
 	// new clients work
-	newProxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	newProxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	defer newProxy.Close()
 
@@ -793,9 +819,9 @@ func TestAppTokenRotation(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	client, err := testSrv.NewClient(TestBuiltin(types.RoleApp))
+	client, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleApp))
 	require.NoError(t, err)
 
 	// Create a JWT using the current CA, this will become the "old" CA during
@@ -946,9 +972,9 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	publicAddress := "https://localhost:8080"
@@ -977,7 +1003,7 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 	_, err = clt.CreateIntegration(ctx, ig)
 	require.NoError(t, err)
 
-	client, err := testSrv.NewClient(TestBuiltin(types.RoleDiscovery))
+	client, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleDiscovery))
 	require.NoError(t, err)
 
 	// Create a JWT using the current CA, this will become the "old" CA during
@@ -1106,7 +1132,7 @@ func TestListUsers(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	// set up some users with distinct names/labels (the only to user attributes currently relevant to filtering)
@@ -1235,22 +1261,23 @@ func TestRemoteUser(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
+	remoteServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:         t.TempDir(),
 		ClusterName: "remote",
 		Clock:       clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, remoteServer.Close()) })
 
-	remoteUser, remoteRole, err := CreateUserAndRole(remoteServer.AuthServer, "remote-user", []string{"remote-role"}, nil)
+	remoteUser, remoteRole, err := authtest.CreateUserAndRole(remoteServer.AuthServer, "remote-user", []string{"remote-role"}, nil)
 	require.NoError(t, err)
 
 	certPool, err := testSrv.CertPool()
 	require.NoError(t, err)
 
-	remoteClient, err := remoteServer.NewRemoteClient(TestUser(remoteUser.GetName()), testSrv.Addr(), certPool)
+	remoteClient, err := remoteServer.NewRemoteClient(authtest.TestUser(remoteUser.GetName()), testSrv.Addr(), certPool)
 	require.NoError(t, err)
 
 	// User is not authorized to perform any actions
@@ -1264,7 +1291,8 @@ func TestRemoteUser(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a fresh client now that trust is established.
-	remoteClient, err = remoteServer.NewRemoteClient(TestUser(remoteUser.GetName()), testSrv.Addr(), certPool)
+	require.NoError(t, remoteClient.Close())
+	remoteClient, err = remoteServer.NewRemoteClient(authtest.TestUser(remoteUser.GetName()), testSrv.Addr(), certPool)
 	require.NoError(t, err)
 
 	// Validate that the client is not permitted to perform RPCs without a role map.
@@ -1280,7 +1308,7 @@ func TestRemoteUser(t *testing.T) {
 	}
 
 	// Establish trust and map the remote role to the local admin role.
-	_, localRole, err := CreateUserAndRole(testSrv.Auth(), "local-user", []string{"local-role"}, nil)
+	_, localRole, err := authtest.CreateUserAndRole(testSrv.Auth(), "local-user", []string{"local-role"}, nil)
 	require.NoError(t, err)
 
 	err = testSrv.AuthServer.Trust(ctx, remoteServer, types.RoleMap{{Remote: remoteRole.GetName(), Local: []string{localRole.GetName()}}})
@@ -1314,7 +1342,7 @@ func TestNopUser(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	client, err := testSrv.NewClient(TestNop())
+	client, err := testSrv.NewClient(authtest.TestNop())
 	require.NoError(t, err)
 
 	// Nop User can get cluster name
@@ -1336,24 +1364,24 @@ func TestReadOwnRole(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	user1, userRole, err := CreateUserAndRoleWithoutRoles(clt, "user1", []string{"user1"})
+	user1, userRole, err := authtest.CreateUserAndRoleWithoutRoles(clt, "user1", []string{"user1"})
 	require.NoError(t, err)
 
-	user2, _, err := CreateUserAndRoleWithoutRoles(clt, "user2", []string{"user2"})
+	user2, _, err := authtest.CreateUserAndRoleWithoutRoles(clt, "user2", []string{"user2"})
 	require.NoError(t, err)
 
 	// user should be able to read their own roles
-	userClient, err := testSrv.NewClient(TestUser(user1.GetName()))
+	userClient, err := testSrv.NewClient(authtest.TestUser(user1.GetName()))
 	require.NoError(t, err)
 
 	_, err = userClient.GetRole(ctx, userRole.GetName())
 	require.NoError(t, err)
 
 	// user2 can't read user1 role
-	userClient2, err := testSrv.NewClient(TestIdentity{I: authz.LocalUser{Username: user2.GetName()}})
+	userClient2, err := testSrv.NewClient(authtest.TestIdentity{I: authz.LocalUser{Username: user2.GetName()}})
 	require.NoError(t, err)
 
 	_, err = userClient2.GetRole(ctx, userRole.GetName())
@@ -1366,10 +1394,10 @@ func TestGetCurrentUser(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	user1, _, err := CreateUserAndRole(srv.Auth(), "user1", []string{"user1"}, nil)
+	user1, _, err := authtest.CreateUserAndRole(srv.Auth(), "user1", []string{"user1"}, nil)
 	require.NoError(t, err)
 
-	client1, err := srv.NewClient(TestIdentity{I: authz.LocalUser{Username: user1.GetName()}})
+	client1, err := srv.NewClient(authtest.TestIdentity{I: authz.LocalUser{Username: user1.GetName()}})
 	require.NoError(t, err)
 
 	currentUser, err := client1.GetCurrentUser(ctx)
@@ -1395,10 +1423,10 @@ func TestGetCurrentUserRoles(t *testing.T) {
 	ctx := context.Background()
 	srv := newTestTLSServer(t)
 
-	user1, user1Role, err := CreateUserAndRole(srv.Auth(), "user1", []string{"user-role"}, nil)
+	user1, user1Role, err := authtest.CreateUserAndRole(srv.Auth(), "user1", []string{"user-role"}, nil)
 	require.NoError(t, err)
 
-	client1, err := srv.NewClient(TestIdentity{I: authz.LocalUser{Username: user1.GetName()}})
+	client1, err := srv.NewClient(authtest.TestIdentity{I: authz.LocalUser{Username: user1.GetName()}})
 	require.NoError(t, err)
 
 	roles, err := client1.GetCurrentUserRoles(ctx)
@@ -1411,7 +1439,7 @@ func TestAuthPreferenceSettings(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	ctx := context.Background()
@@ -1439,14 +1467,71 @@ func TestTunnelConnectionsCRUD(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
-		TrustS: clt,
-		Clock:  clockwork.NewFakeClock(),
-	}
-	suite.TunnelConnectionsCRUD(t)
+	clusterName := "example.com"
+	out, err := clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	dt := clockwork.NewFakeClock().Now()
+	conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
+		ClusterName:   clusterName,
+		ProxyName:     "p1",
+		LastHeartbeat: dt,
+	})
+	require.NoError(t, err)
+
+	err = clt.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out, err = clt.GetAllTunnelConnections()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	dt = dt.Add(time.Hour)
+	conn.SetLastHeartbeat(dt)
+
+	err = clt.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = clt.DeleteAllTunnelConnections()
+	require.NoError(t, err)
+
+	out, err = clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	err = clt.DeleteAllTunnelConnections()
+	require.NoError(t, err)
+
+	// test delete individual connection
+	err = clt.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = clt.DeleteTunnelConnection(clusterName, conn.GetName())
+	require.NoError(t, err)
+
+	out, err = clt.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
 }
 
 func TestServersCRUD(t *testing.T) {
@@ -1454,13 +1539,90 @@ func TestServersCRUD(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
-		PresenceS: clt,
+	NewServer := func(kind, name, addr, namespace string) *types.ServerV2 {
+		return &types.ServerV2{
+			Kind:    kind,
+			Version: types.V2,
+			Metadata: types.Metadata{
+				Name:      name,
+				Namespace: namespace,
+			},
+			Spec: types.ServerSpecV2{
+				Addr: addr,
+			},
+		}
 	}
-	suite.ServerCRUD(t)
+
+	ctx := context.Background()
+
+	// SSH service.
+	out, err := clt.GetNodes(ctx, apidefaults.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	srv := NewServer(types.KindNode, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
+	srv.Spec.Hostname = "llama"
+	_, err = clt.UpsertNode(ctx, srv)
+	require.NoError(t, err)
+
+	node, err := clt.GetNode(ctx, srv.Metadata.Namespace, srv.GetName())
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(node, srv, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out, err = clt.GetNodes(ctx, srv.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{srv}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = clt.DeleteNode(ctx, srv.Metadata.Namespace, srv.GetName())
+	require.NoError(t, err)
+
+	out, err = clt.GetNodes(ctx, srv.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Proxy service.
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = clt.GetProxies()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	proxy := NewServer(types.KindProxy, "proxy1", "127.0.0.1:2023", apidefaults.Namespace)
+	proxy.Spec.Hostname = "proxy.llama"
+	require.NoError(t, clt.UpsertProxy(ctx, proxy))
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = clt.GetProxies()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{proxy}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = clt.DeleteProxy(ctx, proxy.GetName())
+	require.NoError(t, err)
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = clt.GetProxies()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Auth service.
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = clt.GetAuthServers()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	auth := NewServer(types.KindAuthServer, "auth1", "127.0.0.1:2025", apidefaults.Namespace)
+	auth.Spec.Hostname = "auth.llama"
+	require.NoError(t, clt.UpsertAuthServer(ctx, auth))
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = clt.GetAuthServers()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{auth}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 }
 
 // TestAppServerCRUD tests CRUD functionality for services.App using an auth client.
@@ -1469,13 +1631,48 @@ func TestAppServerCRUD(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestBuiltin(types.RoleApp))
+	clt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleApp))
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
-		PresenceS: clt,
-	}
-	suite.AppServerCRUD(t)
+	ctx := context.Background()
+
+	// Expect not to be returned any applications and trace.NotFound.
+	out, err := clt.GetApplicationServers(ctx, apidefaults.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Make an app and an app server.
+	app, err := types.NewAppV3(types.Metadata{Name: "foo"},
+		types.AppSpecV3{URI: "http://127.0.0.1:8080", PublicAddr: "foo.example.com"})
+	require.NoError(t, err)
+	server, err := types.NewAppServerV3(types.Metadata{
+		Name:      app.GetName(),
+		Namespace: apidefaults.Namespace,
+	}, types.AppServerSpecV3{
+		Hostname: "localhost",
+		HostID:   uuid.New().String(),
+		App:      app,
+	})
+	require.NoError(t, err)
+
+	// Upsert application.
+	_, err = clt.UpsertApplicationServer(ctx, server)
+	require.NoError(t, err)
+
+	// Check again, expect a single application to be found.
+	out, err = clt.GetApplicationServers(ctx, server.GetNamespace())
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff([]types.AppServer{server}, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// Remove the application.
+	err = clt.DeleteApplicationServer(ctx, server.Metadata.Namespace, server.GetHostID(), server.GetName())
+	require.NoError(t, err)
+
+	// Now expect no applications to be returned.
+	out, err = clt.GetApplicationServers(ctx, server.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
 }
 
 func TestUsersCRUD(t *testing.T) {
@@ -1484,7 +1681,7 @@ func TestUsersCRUD(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	usr, err := types.NewUser("user1")
@@ -1516,7 +1713,7 @@ func TestPasswordGarbage(t *testing.T) {
 		make([]byte, defaults.MinPasswordLength-1),
 	}
 	for _, g := range garbage {
-		_, err := testSrv.Auth().checkPassword(ctx, "user1", g, "123456")
+		err := testSrv.Auth().CheckPassword(ctx, "user1", g, "123456")
 		require.True(t, trace.IsBadParameter(err))
 	}
 }
@@ -1526,7 +1723,7 @@ func TestPasswordCRUD(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
 	// Create a user.
 	u, err := types.NewUser("user1")
@@ -1538,7 +1735,7 @@ func TestPasswordCRUD(t *testing.T) {
 	rawSecret := "def456"
 	otpSecret := base32.StdEncoding.EncodeToString([]byte(rawSecret))
 
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, "123456")
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, "123456")
 	require.Error(t, err)
 
 	err = testSrv.Auth().UpsertPassword("user1", pass)
@@ -1553,7 +1750,7 @@ func TestPasswordCRUD(t *testing.T) {
 	validToken, err := totp.GenerateCode(otpSecret, testSrv.Clock().Now())
 	require.NoError(t, err)
 
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, validToken)
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, validToken)
 	require.NoError(t, err)
 }
 
@@ -1562,7 +1759,7 @@ func TestOTPCRUD(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
 	user := "user1"
 	pass := []byte("abcdef123456")
@@ -1585,7 +1782,7 @@ func TestOTPCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	// a completely invalid token should return access denied
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, "123456")
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, "123456")
 	require.Error(t, err)
 
 	// an invalid token should return access denied
@@ -1597,18 +1794,18 @@ func TestOTPCRUD(t *testing.T) {
 	// invalidity starts at 61 seconds in the future.
 	invalidToken, err := totp.GenerateCode(otpSecret, testSrv.Clock().Now().Add(61*time.Second))
 	require.NoError(t, err)
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, invalidToken)
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, invalidToken)
 	require.Error(t, err)
 
 	// a valid token (created right now and from a valid key) should return success
 	validToken, err := totp.GenerateCode(otpSecret, testSrv.Clock().Now())
 	require.NoError(t, err)
 
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, validToken)
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, validToken)
 	require.NoError(t, err)
 
 	// try the same valid token now it should fail because we don't allow re-use of tokens
-	_, err = testSrv.Auth().checkPassword(ctx, "user1", pass, validToken)
+	err = testSrv.Auth().CheckPassword(ctx, "user1", pass, validToken)
 	require.Error(t, err)
 }
 
@@ -1621,16 +1818,16 @@ func TestWebSessionWithoutAccessRequest(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	user := "user1"
 	pass := []byte("abcdef123456")
 
-	_, _, err = CreateUserAndRole(clt, user, []string{user}, nil)
+	_, _, err = authtest.CreateUserAndRole(clt, user, []string{user}, nil)
 	require.NoError(t, err)
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	req := authclient.AuthenticateUserRequest{
@@ -1683,15 +1880,15 @@ func TestWebSessionWithoutAccessRequest(t *testing.T) {
 
 func TestWebSessionMultiAccessRequests(t *testing.T) {
 	// Can not use t.Parallel() when changing modules
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, clt.Close()) })
 
@@ -1718,7 +1915,7 @@ func TestWebSessionMultiAccessRequests(t *testing.T) {
 	password := []byte("hunter2hunter2")
 	baseRoleName := services.RoleNameForUser(username)
 	requestableRoleName := "requestable"
-	user, err := CreateUserRoleAndRequestable(clt, username, requestableRoleName)
+	user, err := authtest.CreateUserRoleAndRequestable(clt, username, requestableRoleName)
 	require.NoError(t, err)
 	err = testSrv.Auth().UpsertPassword(username, password)
 	require.NoError(t, err)
@@ -1758,7 +1955,7 @@ func TestWebSessionMultiAccessRequests(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a web session and client for the user.
-	proxyClient, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxyClient, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	baseWebSession, err := proxyClient.AuthenticateWebUser(ctx, authclient.AuthenticateUserRequest{
 		Username: username,
@@ -1902,20 +2099,20 @@ func TestWebSessionWithApprovedAccessRequestAndSwitchback(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	user := "user2"
 	pass := []byte("abcdef123456")
 
-	newUser, err := CreateUserRoleAndRequestable(clt, user, "test-request-role")
+	newUser, err := authtest.CreateUserRoleAndRequestable(clt, user, "test-request-role")
 	require.NoError(t, err)
 	require.Len(t, newUser.GetRoles(), 1)
 	require.Empty(t, cmp.Diff(newUser.GetRoles(), []string{"user:user2"}))
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// Create a user to create a web session for.
@@ -2017,17 +2214,17 @@ func TestExtendWebSessionWithReloadUser(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	user := "user2"
 	pass := []byte("abcdef123456")
 
-	newUser, _, err := CreateUserAndRole(clt, user, nil, nil)
+	newUser, _, err := authtest.CreateUserAndRole(clt, user, nil, nil)
 	require.NoError(t, err)
 	require.Empty(t, newUser.GetTraits())
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// Create user authn creds and web session.
@@ -2052,7 +2249,7 @@ func TestExtendWebSessionWithReloadUser(t *testing.T) {
 	newRoleName := "new-role"
 	newUser.SetLogins([]string{"apple", "banana"})
 	newUser.SetDatabaseUsers([]string{"llama", "alpaca"})
-	_, err = CreateRole(ctx, clt, newRoleName, types.RoleSpecV6{})
+	_, err = authtest.CreateRole(ctx, clt, newRoleName, types.RoleSpecV6{})
 	require.NoError(t, err)
 	newUser.AddRole(newRoleName)
 	_, err = clt.UpdateUser(ctx, newUser)
@@ -2082,23 +2279,23 @@ func TestExtendWebSessionWithMaxDuration(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	adminClient, err := testSrv.NewClient(TestAdmin())
+	adminClient, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	const user = "user2"
 	const testRequestRole = "test-request-role"
 	pass := []byte("abcdef123456")
 
-	newUser, err := CreateUserRoleAndRequestable(adminClient, user, testRequestRole)
+	newUser, err := authtest.CreateUserRoleAndRequestable(adminClient, user, testRequestRole)
 	require.NoError(t, err)
 	require.Len(t, newUser.GetRoles(), 1)
 
 	require.Len(t, newUser.GetRoles(), 1)
 	require.Empty(t, cmp.Diff(newUser.GetRoles(), []string{"user:user2"}))
 
-	proxyRoleClient, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxyRoleClient, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	// Create a user to create a web session for.
@@ -2186,7 +2383,7 @@ func TestGetCertAuthority(t *testing.T) {
 	testSrv := newTestTLSServer(t)
 
 	// generate server keys for node
-	nodeClt, err := testSrv.NewClient(TestIdentity{I: authz.BuiltinRole{Username: "00000000-0000-0000-0000-000000000000", Role: types.RoleNode}})
+	nodeClt, err := testSrv.NewClient(authtest.TestIdentity{I: authz.BuiltinRole{Username: "00000000-0000-0000-0000-000000000000", Role: types.RoleNode}})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, nodeClt.Close()) })
 
@@ -2210,7 +2407,7 @@ func TestGetCertAuthority(t *testing.T) {
 	require.True(t, trace.IsAccessDenied(err))
 
 	// generate server keys for proxy
-	proxyClt, err := testSrv.NewClient(TestIdentity{
+	proxyClt, err := testSrv.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Username: "00000000-0000-0000-0000-000000000001",
 			Role:     types.RoleProxy,
@@ -2261,7 +2458,7 @@ func TestGetCertAuthority(t *testing.T) {
 	user, err = testSrv.Auth().UpsertUser(ctx, user)
 	require.NoError(t, err)
 
-	userClt, err := testSrv.NewClient(TestUser(user.GetName()))
+	userClt, err := testSrv.NewClient(authtest.TestUser(user.GetName()))
 	require.NoError(t, err)
 	defer userClt.Close()
 
@@ -2304,19 +2501,19 @@ func TestPluginData(t *testing.T) {
 
 	user := "user1"
 	role := "some-role"
-	_, err = CreateUserRoleAndRequestable(testSrv.Auth(), user, role)
+	_, err = authtest.CreateUserRoleAndRequestable(testSrv.Auth(), user, role)
 	require.NoError(t, err)
 
-	testUser := TestUser(user)
+	testUser := authtest.TestUser(user)
 	testUser.TTL = time.Hour
 	userClient, err := testSrv.NewClient(testUser)
 	require.NoError(t, err)
 
 	plugin := "my-plugin"
-	_, err = CreateAccessPluginUser(ctx, testSrv.Auth(), plugin)
+	_, err = authtest.CreateAccessPluginUser(ctx, testSrv.Auth(), plugin)
 	require.NoError(t, err)
 
-	pluginUser := TestUser(plugin)
+	pluginUser := authtest.TestUser(plugin)
 	pluginUser.TTL = time.Hour
 	pluginClient, err := testSrv.NewClient(pluginUser)
 	require.NoError(t, err)
@@ -2417,7 +2614,7 @@ func TestGenerateCerts(t *testing.T) {
 
 	// generate server keys for node
 	hostID := "00000000-0000-0000-0000-000000000000"
-	hostClient, err := srv.NewClient(TestIdentity{I: authz.BuiltinRole{Username: hostID, Role: types.RoleNode}})
+	hostClient, err := srv.NewClient(authtest.TestIdentity{I: authz.BuiltinRole{Username: hostID, Role: types.RoleNode}})
 	require.NoError(t, err)
 
 	certs, err := hostClient.GenerateHostCerts(context.Background(),
@@ -2437,7 +2634,7 @@ func TestGenerateCerts(t *testing.T) {
 
 	// sign server public keys for node
 	hostID = "00000000-0000-0000-0000-000000000000"
-	hostClient, err = srv.NewClient(TestIdentity{I: authz.BuiltinRole{Username: hostID, Role: types.RoleNode}})
+	hostClient, err = srv.NewClient(authtest.TestIdentity{I: authz.BuiltinRole{Username: hostID, Role: types.RoleNode}})
 	require.NoError(t, err)
 
 	certs, err = hostClient.GenerateHostCerts(context.Background(),
@@ -2479,15 +2676,15 @@ func TestGenerateCerts(t *testing.T) {
 		require.True(t, trace.IsAccessDenied(err))
 	})
 
-	user1, userRole, err := CreateUserAndRole(srv.Auth(), "user1", []string{"user1"}, nil)
+	user1, userRole, err := authtest.CreateUserAndRole(srv.Auth(), "user1", []string{"user1"}, nil)
 	require.NoError(t, err)
 
-	user2, userRole2, err := CreateUserAndRole(srv.Auth(), "user2", []string{"user2"}, nil)
+	user2, userRole2, err := authtest.CreateUserAndRole(srv.Auth(), "user2", []string{"user2"}, nil)
 	require.NoError(t, err)
 
 	t.Run("Nop", func(t *testing.T) {
 		// unauthenticated client should NOT be able to generate a user cert without auth
-		nopClient, err := srv.NewClient(TestNop())
+		nopClient, err := srv.NewClient(authtest.TestNop())
 		require.NoError(t, err)
 
 		_, err = nopClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
@@ -2501,7 +2698,7 @@ func TestGenerateCerts(t *testing.T) {
 		require.True(t, trace.IsAccessDenied(err), err.Error())
 	})
 
-	testUser2 := TestUser(user2.GetName())
+	testUser2 := authtest.TestUser(user2.GetName())
 	testUser2.TTL = time.Hour
 	userClient2, err := srv.NewClient(testUser2)
 	require.NoError(t, err)
@@ -2548,7 +2745,7 @@ func TestGenerateCerts(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
-		superImpersonator, err := CreateUser(ctx, srv.Auth(), "superimpersonator", superImpersonatorRole)
+		superImpersonator, err := authtest.CreateUser(ctx, srv.Auth(), "superimpersonator", superImpersonatorRole)
 		require.NoError(t, err)
 
 		// Impersonator can generate certificates for super impersonator
@@ -2562,10 +2759,10 @@ func TestGenerateCerts(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
-		impersonator, err := CreateUser(ctx, srv.Auth(), "impersonator", role)
+		impersonator, err := authtest.CreateUser(ctx, srv.Auth(), "impersonator", role)
 		require.NoError(t, err)
 
-		iUser := TestUser(impersonator.GetName())
+		iUser := authtest.TestUser(impersonator.GetName())
 		iUser.TTL = time.Hour
 		iClient, err := srv.NewClient(iUser)
 		require.NoError(t, err)
@@ -2611,7 +2808,8 @@ func TestGenerateCerts(t *testing.T) {
 
 		// client that uses impersonated certificate can't impersonate other users
 		// although super impersonator's roles allow it
-		impersonatedClient := srv.NewClientWithCert(clientCert)
+		impersonatedClient, err := srv.NewClientWithCert(clientCert)
+		require.NoError(t, err)
 		_, err = impersonatedClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
 			SSHPublicKey: sshPubKey,
 			TLSPublicKey: tlsPubKey,
@@ -2649,7 +2847,7 @@ func TestGenerateCerts(t *testing.T) {
 	})
 
 	t.Run("Renew", func(t *testing.T) {
-		testUser2 := TestUser(user2.GetName())
+		testUser2 := authtest.TestUser(user2.GetName())
 		testUser2.TTL = time.Hour
 		userClient2, err := srv.NewClient(testUser2)
 		require.NoError(t, err)
@@ -2685,7 +2883,7 @@ func TestGenerateCerts(t *testing.T) {
 
 	t.Run("Admin", func(t *testing.T) {
 		// Admin should be allowed to generate certs with TTL longer than max.
-		adminClient, err := srv.NewClient(TestAdmin())
+		adminClient, err := srv.NewClient(authtest.TestAdmin())
 		require.NoError(t, err)
 
 		userCerts, err := adminClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
@@ -2799,7 +2997,7 @@ func TestGenerateCerts(t *testing.T) {
 	})
 
 	t.Run("SplitKeys", func(t *testing.T) {
-		testUser2 := TestUser(user2.GetName())
+		testUser2 := authtest.TestUser(user2.GetName())
 		testUser2.TTL = time.Hour
 		userClient2, err := srv.NewClient(testUser2)
 		require.NoError(t, err)
@@ -2885,9 +3083,9 @@ func TestGenerateCerts(t *testing.T) {
 func TestGenerateAppToken(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	authClient, err := testSrv.NewClient(TestBuiltin(types.RoleAdmin))
+	authClient, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err)
 
 	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{
@@ -2923,7 +3121,7 @@ func TestGenerateAppToken(t *testing.T) {
 		},
 	}
 	for _, ts := range tests {
-		client, err := testSrv.NewClient(TestBuiltin(ts.inMachineRole))
+		client, err := testSrv.NewClient(authtest.TestBuiltin(ts.inMachineRole))
 		require.NoError(t, err, ts.inComment)
 
 		token, err := client.GenerateAppToken(
@@ -2964,7 +3162,7 @@ func TestCertificateFormat(t *testing.T) {
 	testSrv := newTestTLSServer(t)
 
 	// use admin client to create user and role
-	user, userRole, err := CreateUserAndRole(testSrv.Auth(), "user", []string{"user"}, nil)
+	user, userRole, err := authtest.CreateUserAndRole(testSrv.Auth(), "user", []string{"user"}, nil)
 	require.NoError(t, err)
 
 	pass := []byte("very secure password")
@@ -2997,7 +3195,7 @@ func TestCertificateFormat(t *testing.T) {
 		userRole, err = testSrv.Auth().UpsertRole(ctx, userRole)
 		require.NoError(t, err)
 
-		proxyClient, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+		proxyClient, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 		require.NoError(t, err)
 
 		// authentication attempt fails with password auth only
@@ -3031,7 +3229,7 @@ func TestClusterConfigContext(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	_, pub, err := testauthority.New().GenerateKeyPair()
@@ -3079,9 +3277,9 @@ func TestAuthenticateWebUserOTP(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	user := "ws-test"
@@ -3089,7 +3287,7 @@ func TestAuthenticateWebUserOTP(t *testing.T) {
 	rawSecret := "def456"
 	otpSecret := base32.StdEncoding.EncodeToString([]byte(rawSecret))
 
-	_, _, err = CreateUserAndRole(clt, user, []string{user}, nil)
+	_, _, err = authtest.CreateUserAndRole(clt, user, []string{user}, nil)
 	require.NoError(t, err)
 
 	err = testSrv.Auth().UpsertPassword(user, pass)
@@ -3104,7 +3302,7 @@ func TestAuthenticateWebUserOTP(t *testing.T) {
 	validToken, err := totp.GenerateCode(otpSecret, clock.Now())
 	require.NoError(t, err)
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
@@ -3166,16 +3364,16 @@ func TestLoginAttempts(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	user := "user1"
 	pass := []byte("abcdef123456")
 
-	_, _, err = CreateUserAndRole(clt, user, []string{user}, nil)
+	_, _, err = authtest.CreateUserAndRole(clt, user, []string{user}, nil)
 	require.NoError(t, err)
 
-	proxy, err := testSrv.NewClient(TestBuiltin(types.RoleProxy))
+	proxy, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 
 	err = testSrv.Auth().UpsertPassword(user, pass)
@@ -3235,11 +3433,11 @@ func TestChangeUserAuthenticationSettings(t *testing.T) {
 
 	username := "user1"
 	// Create a local user.
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	t.Run("Reset works when user exists", func(t *testing.T) {
-		_, _, err = CreateUserAndRole(clt, username, []string{"role1"}, nil)
+		_, _, err = authtest.CreateUserAndRole(clt, username, []string{"role1"}, nil)
 		require.NoError(t, err)
 
 		token, err := testSrv.Auth().CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
@@ -3254,7 +3452,7 @@ func TestChangeUserAuthenticationSettings(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		_, registerSolved, err := NewTestDeviceFromChallenge(res)
+		_, registerSolved, err := authtest.NewTestDeviceFromChallenge(res)
 		require.NoError(t, err)
 
 		_, err = testSrv.Auth().ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
@@ -3281,7 +3479,7 @@ func TestChangeUserAuthenticationSettings(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			_, registerSolved, err := NewTestDeviceFromChallenge(res)
+			_, registerSolved, err := authtest.NewTestDeviceFromChallenge(res)
 			require.NoError(t, err)
 
 			tokenID = token.GetName()
@@ -3297,9 +3495,9 @@ func TestChangeUserAuthenticationSettings(t *testing.T) {
 		})
 		require.Error(t, err)
 
-		tokens, err := testSrv.Auth().GetUserTokens(ctx)
+		userTokens, err := stream.Collect(clientutils.Resources(ctx, testSrv.Auth().ListUserTokens))
 		require.NoError(t, err)
-		require.Empty(t, tokens)
+		require.Empty(t, userTokens)
 	})
 }
 
@@ -3315,9 +3513,9 @@ func TestLoginNoLocalAuth(t *testing.T) {
 	pass := []byte("feefiefoefum")
 
 	// Create a local user.
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	_, _, err = CreateUserAndRole(clt, user, []string{user}, nil)
+	_, _, err = authtest.CreateUserAndRole(clt, user, []string{user}, nil)
 	require.NoError(t, err)
 	err = testSrv.Auth().UpsertPassword(user, pass)
 	require.NoError(t, err)
@@ -3364,7 +3562,7 @@ func TestCipherSuites(t *testing.T) {
 	defer otherServer.Close()
 
 	// Create a client with ciphersuites that the server does not support.
-	tlsConfig, err := testSrv.ClientTLSConfig(TestNop())
+	tlsConfig, err := testSrv.ClientTLSConfig(authtest.TestNop())
 	require.NoError(t, err)
 	tlsConfig.CipherSuites = []uint16{
 		tls.TLS_RSA_WITH_AES_128_CBC_SHA,
@@ -3400,7 +3598,7 @@ func TestTLSFailover(t *testing.T) {
 	require.NoError(t, err)
 	defer otherServer.Close()
 
-	tlsConfig, err := testSrv.ClientTLSConfig(TestNop())
+	tlsConfig, err := testSrv.ClientTLSConfig(authtest.TestNop())
 	require.NoError(t, err)
 
 	addrs := []string{
@@ -3433,14 +3631,13 @@ func TestTLSFailover(t *testing.T) {
 	}
 }
 
-// TestRegisterCAPin makes sure that registration only works with a valid
-// CA pin.
-func TestRegisterCAPin(t *testing.T) {
+// TestJoinCAPin makes sure that joining only works with a valid CA pin.
+func TestJoinCAPin(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 
 	// Generate a token to use.
 	token := generateTestToken(
@@ -3459,14 +3656,13 @@ func TestRegisterCAPin(t *testing.T) {
 	require.Len(t, caPins, 1)
 	caPin := caPins[0]
 
-	// Attempt to register with valid CA pin, should work.
-	_, err = join.Register(ctx, join.RegisterParams{
+	// Attempt to join with valid CA pin, should work.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPins:               []string{caPin},
@@ -3474,15 +3670,14 @@ func TestRegisterCAPin(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	// Attempt to register with multiple CA pins where the auth server only
+	// Attempt to join with multiple CA pins where the auth server only
 	// matches one, should work.
-	_, err = join.Register(ctx, join.RegisterParams{
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPins:               []string{"sha256:123", caPin},
@@ -3490,14 +3685,13 @@ func TestRegisterCAPin(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	// Attempt to register with invalid CA pin, should fail.
-	_, err = join.Register(ctx, join.RegisterParams{
+	// Attempt to join with invalid CA pin, should fail.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPins:               []string{"sha256:123"},
@@ -3505,14 +3699,13 @@ func TestRegisterCAPin(t *testing.T) {
 	})
 	require.Error(t, err)
 
-	// Attempt to register with multiple invalid CA pins, should fail.
-	_, err = join.Register(ctx, join.RegisterParams{
+	// Attempt to join with multiple invalid CA pins, should fail.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPins:               []string{"sha256:123", "sha256:456"},
@@ -3539,14 +3732,13 @@ func TestRegisterCAPin(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, caPins, 2)
 
-	// Attempt to register with multiple CA pins, should work
-	_, err = join.Register(ctx, join.RegisterParams{
+	// Attempt to join with multiple CA pins, should work
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPins:               caPins,
@@ -3555,14 +3747,14 @@ func TestRegisterCAPin(t *testing.T) {
 	require.NoError(t, err)
 }
 
-// TestRegisterCAPath makes sure registration only works with a valid CA
+// TestJoinCAPath makes sure joining only works with a valid CA
 // file on disk.
-func TestRegisterCAPath(t *testing.T) {
+func TestJoinCAPath(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	clock := testSrv.AuthServer.TestAuthServerConfig.Clock
+	clock := testSrv.AuthServer.AuthServerConfig.Clock
 	dataDir := testSrv.AuthServer.Dir
 
 	// Generate a token to use.
@@ -3574,14 +3766,13 @@ func TestRegisterCAPath(t *testing.T) {
 		testSrv.Auth(),
 	)
 
-	// Attempt to register with nothing at the CA path, should work.
-	_, err := join.Register(ctx, join.RegisterParams{
+	// Attempt to join with nothing at the CA path, should work.
+	_, err := joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		Clock:                clock,
@@ -3601,14 +3792,13 @@ func TestRegisterCAPath(t *testing.T) {
 	err = os.WriteFile(caPath, certPem, teleport.FileMaskOwnerOnly)
 	require.NoError(t, err)
 
-	// Attempt to register with valid CA path, should work.
-	_, err = join.Register(ctx, join.RegisterParams{
+	// Attempt to join with valid CA path, should work.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
 		AuthServers: []utils.NetAddr{utils.FromAddr(testSrv.Addr())},
 		Token:       token,
 		ID: state.IdentityID{
-			HostUUID: "once",
 			NodeName: "node-name",
-			Role:     types.RoleProxy,
+			Role:     types.RoleInstance,
 		},
 		AdditionalPrincipals: []string{"example.com"},
 		CAPath:               caPath,
@@ -3628,7 +3818,7 @@ func TestClusterAlertAck(t *testing.T) {
 	alert1, err := types.NewClusterAlert("alert-1", "some msg")
 	require.NoError(t, err)
 
-	adminClt, err := testSrv.NewClient(TestBuiltin(types.RoleAdmin))
+	adminClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err)
 	defer adminClt.Close()
 
@@ -3676,7 +3866,7 @@ func TestClusterAlertClearAckWildcard(t *testing.T) {
 	alert2, err := types.NewClusterAlert("alert-2", "some msg")
 	require.NoError(t, err)
 
-	adminClt, err := testSrv.NewClient(TestBuiltin(types.RoleAdmin))
+	adminClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err)
 	defer adminClt.Close()
 
@@ -3751,7 +3941,7 @@ func TestClusterAlertAccessControls(t *testing.T) {
 		types.AlertPermitAll: "yes",
 	}
 
-	adminClt, err := testSrv.NewClient(TestBuiltin(types.RoleAdmin))
+	adminClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err)
 	defer adminClt.Close()
 
@@ -3781,7 +3971,7 @@ func TestClusterAlertAccessControls(t *testing.T) {
 	// verify that some other client with no alert-specific permissions can
 	// see the "permit-all" subset of alerts (using role node here, but any
 	// role with no special provisions for alerts should be equivalent)
-	otherClt, err := testSrv.NewClient(TestBuiltin(types.RoleNode))
+	otherClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleNode))
 	require.NoError(t, err)
 	defer otherClt.Close()
 
@@ -3797,7 +3987,7 @@ func TestClusterAlertAccessControls(t *testing.T) {
 	}
 
 	// verify that we still reject unauthenticated clients
-	nopClt, err := testSrv.NewClient(TestBuiltin(types.RoleNop))
+	nopClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleNop))
 	require.NoError(t, err)
 	defer nopClt.Close()
 
@@ -3868,7 +4058,7 @@ func TestEventsNodePresence(t *testing.T) {
 		},
 	}
 	node.SetExpiry(time.Now().Add(2 * time.Second))
-	clt, err := testSrv.NewClient(TestIdentity{
+	clt, err := testSrv.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: fmt.Sprintf("%v.%v", node.Metadata.Name, testSrv.ClusterName()),
@@ -3896,7 +4086,7 @@ func TestEventsNodePresence(t *testing.T) {
 	}
 
 	// upsert node and keep alives will fail for users with no privileges
-	nopClt, err := testSrv.NewClient(TestBuiltin(types.RoleNop))
+	nopClt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleNop))
 	require.NoError(t, err)
 	defer nopClt.Close()
 
@@ -3923,6 +4113,57 @@ func TestEventsNodePresence(t *testing.T) {
 	require.True(t, trace.IsAccessDenied(k2.Error()))
 }
 
+// ExpectResource expects a Put event of a certain resource
+func ExpectResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
+	timeoutC := time.After(timeout)
+waitLoop:
+	for {
+		select {
+		case <-timeoutC:
+			t.Fatalf("Timeout waiting for event")
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		case event := <-w.Events():
+			if event.Type != types.OpPut {
+				continue
+			}
+			if resource.GetName() != event.Resource.GetName() || resource.GetKind() != event.Resource.GetKind() || resource.GetSubKind() != event.Resource.GetSubKind() {
+				continue waitLoop
+			}
+			require.Empty(t, cmp.Diff(resource, event.Resource))
+			break waitLoop
+		}
+	}
+}
+
+// ExpectDeleteResource expects a delete event of a certain kind
+func ExpectDeleteResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
+	timeoutC := time.After(timeout)
+waitLoop:
+	for {
+		select {
+		case <-timeoutC:
+			t.Fatalf("Timeout waiting for delete resource %v", resource)
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		case event := <-w.Events():
+			if event.Type != types.OpDelete {
+				continue
+			}
+
+			// Server resources may have subkind set, but the backend
+			// generating this delete event doesn't know the subkind.
+			// Set it to prevent the check below from failing.
+			if event.Resource.GetKind() == types.KindNode {
+				event.Resource.SetSubKind(resource.GetSubKind())
+			}
+
+			require.Empty(t, cmp.Diff(resource, event.Resource))
+			break waitLoop
+		}
+	}
+}
+
 // TestEventsPermissions tests events with regards
 // to certificate authority rotation
 func TestEventsPermissions(t *testing.T) {
@@ -3931,7 +4172,7 @@ func TestEventsPermissions(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestBuiltin(types.RoleNode))
+	clt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleNode))
 	require.NoError(t, err)
 	defer clt.Close()
 
@@ -3962,33 +4203,33 @@ func TestEventsPermissions(t *testing.T) {
 	}, false)
 	require.NoError(t, err)
 
-	suite.ExpectResource(t, w, 3*time.Second, ca)
+	ExpectResource(t, w, 3*time.Second, ca)
 
 	type testCase struct {
 		name     string
-		identity TestIdentity
+		identity authtest.TestIdentity
 		watches  []types.WatchKind
 	}
 
 	testCases := []testCase{
 		{
 			name:     "node role is not authorized to get certificate authority with secret data loaded",
-			identity: TestBuiltin(types.RoleNode),
+			identity: authtest.TestBuiltin(types.RoleNode),
 			watches:  []types.WatchKind{{Kind: types.KindCertAuthority, LoadSecrets: true}},
 		},
 		{
 			name:     "node role is not authorized to watch static tokens",
-			identity: TestBuiltin(types.RoleNode),
+			identity: authtest.TestBuiltin(types.RoleNode),
 			watches:  []types.WatchKind{{Kind: types.KindStaticTokens}},
 		},
 		{
 			name:     "node role is not authorized to watch provisioning tokens",
-			identity: TestBuiltin(types.RoleNode),
+			identity: authtest.TestBuiltin(types.RoleNode),
 			watches:  []types.WatchKind{{Kind: types.KindToken}},
 		},
 		{
 			name:     "nop role is not authorized to watch users and roles",
-			identity: TestBuiltin(types.RoleNop),
+			identity: authtest.TestBuiltin(types.RoleNop),
 			watches: []types.WatchKind{
 				{Kind: types.KindUser},
 				{Kind: types.KindRole},
@@ -3996,12 +4237,12 @@ func TestEventsPermissions(t *testing.T) {
 		},
 		{
 			name:     "nop role is not authorized to watch cert authorities",
-			identity: TestBuiltin(types.RoleNop),
+			identity: authtest.TestBuiltin(types.RoleNop),
 			watches:  []types.WatchKind{{Kind: types.KindCertAuthority, LoadSecrets: false}},
 		},
 		{
 			name:     "nop role is not authorized to watch cluster config resources",
-			identity: TestBuiltin(types.RoleNop),
+			identity: authtest.TestBuiltin(types.RoleNop),
 			watches: []types.WatchKind{
 				{Kind: types.KindClusterAuthPreference},
 				{Kind: types.KindClusterNetworkingConfig},
@@ -4090,13 +4331,13 @@ func TestEventsPermissionsPartialSuccess(t *testing.T) {
 
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
-	testUser, testRole, err := CreateUserAndRole(testSrv.Auth(), "test", nil, []types.Rule{
+	testUser, testRole, err := authtest.CreateUserAndRole(testSrv.Auth(), "test", nil, []types.Rule{
 		types.NewRule(types.KindStaticTokens, services.RO()),
 	})
 	require.NoError(t, err)
 	_, err = testSrv.Auth().UpsertRole(ctx, testRole)
 	require.NoError(t, err)
-	testIdentity := TestUser(testUser.GetName())
+	testIdentity := authtest.TestUser(testUser.GetName())
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -4136,20 +4377,408 @@ func TestEvents(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
-		ConfigS:       clt,
-		LocalConfigS:  testSrv.Auth(),
-		EventsS:       clt,
-		PresenceS:     testSrv.Auth(),
-		TrustS:        testSrv.Auth(),
-		ProvisioningS: clt,
-		Access:        clt,
-		UsersS:        clt,
+	ctx := context.Background()
+	testCases := []eventTest{
+		{
+			name: "Cert authority with secrets",
+			kind: types.WatchKind{
+				Kind:        types.KindCertAuthority,
+				LoadSecrets: true,
+			},
+			crud: func(context.Context) types.Resource {
+				ca := authtest.NewTestCA(types.UserCA, "example.com")
+				require.NoError(t, testSrv.Auth().UpsertCertAuthority(ctx, ca))
+
+				out, err := testSrv.Auth().GetCertAuthority(ctx, *ca.ID(), true)
+				require.NoError(t, err)
+
+				require.NoError(t, testSrv.Auth().DeleteCertAuthority(ctx, *ca.ID()))
+				return out
+			},
+		},
 	}
-	suite.Events(t)
+	runEventsTests(t, testCases, clt, types.Watch{Kinds: eventsTestKinds(testCases)})
+
+	testCases = []eventTest{
+		{
+			name: "Cert authority without secrets",
+			kind: types.WatchKind{
+				Kind:        types.KindCertAuthority,
+				LoadSecrets: false,
+			},
+			crud: func(context.Context) types.Resource {
+				ca := authtest.NewTestCA(types.UserCA, "example.com")
+				require.NoError(t, testSrv.Auth().UpsertCertAuthority(ctx, ca))
+
+				out, err := testSrv.Auth().GetCertAuthority(ctx, *ca.ID(), false)
+				require.NoError(t, err)
+
+				require.NoError(t, testSrv.Auth().DeleteCertAuthority(ctx, *ca.ID()))
+				return out
+			},
+		},
+	}
+	runEventsTests(t, testCases, clt, types.Watch{Kinds: eventsTestKinds(testCases)})
+
+	testCases = []eventTest{
+		{
+			name: "Token",
+			kind: types.WatchKind{
+				Kind: types.KindToken,
+			},
+			crud: func(context.Context) types.Resource {
+				expires := time.Now().UTC().Add(time.Hour)
+				tok, err := types.NewProvisionToken("token",
+					types.SystemRoles{types.RoleAuth, types.RoleNode}, expires)
+				require.NoError(t, err)
+
+				require.NoError(t, clt.UpsertToken(ctx, tok))
+
+				token, err := clt.GetToken(ctx, "token")
+				require.NoError(t, err)
+
+				require.NoError(t, clt.DeleteToken(ctx, "token"))
+				return token
+			},
+		},
+		{
+			name: "Static tokens",
+			kind: types.WatchKind{
+				Kind: types.KindStaticTokens,
+			},
+			crud: func(context.Context) types.Resource {
+				staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+					StaticTokens: []types.ProvisionTokenV1{
+						{
+							Token:   "tok1",
+							Roles:   types.SystemRoles{types.RoleNode},
+							Expires: time.Now().UTC().Add(time.Hour),
+						},
+					},
+				})
+				require.NoError(t, err)
+
+				err = testSrv.Auth().SetStaticTokens(staticTokens)
+				require.NoError(t, err)
+
+				out, err := testSrv.Auth().GetStaticTokens(ctx)
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteStaticTokens()
+				require.NoError(t, err)
+
+				return out
+			},
+		},
+		{
+			name: "Role",
+			kind: types.WatchKind{
+				Kind: types.KindRole,
+			},
+			crud: func(context.Context) types.Resource {
+				role, err := types.NewRole("role1", types.RoleSpecV6{
+					Options: types.RoleOptions{
+						MaxSessionTTL: types.Duration(time.Hour),
+					},
+					Allow: types.RoleConditions{
+						Logins:     []string{"root", "bob"},
+						NodeLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+					},
+					Deny: types.RoleConditions{},
+				})
+				require.NoError(t, err)
+
+				_, err = clt.UpsertRole(ctx, role)
+				require.NoError(t, err)
+
+				out, err := clt.GetRole(ctx, role.GetName())
+				require.NoError(t, err)
+
+				err = clt.DeleteRole(ctx, role.GetName())
+				require.NoError(t, err)
+
+				return out
+			},
+		},
+		{
+			name: "User",
+			kind: types.WatchKind{
+				Kind: types.KindUser,
+			},
+			crud: func(context.Context) types.Resource {
+				var user types.User = &types.UserV2{
+					Kind:    types.KindUser,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      "user1",
+						Namespace: apidefaults.Namespace,
+					},
+					Spec: types.UserSpecV2{
+						Roles: []string{constants.DefaultImplicitRole},
+					},
+				}
+
+				user, err := clt.UpsertUser(ctx, user)
+				require.NoError(t, err)
+
+				out, err := clt.GetUser(ctx, user.GetName(), false)
+				require.NoError(t, err)
+
+				require.NoError(t, clt.DeleteUser(ctx, user.GetName()))
+				return out
+			},
+		},
+		{
+			name: "Node",
+			kind: types.WatchKind{
+				Kind: types.KindNode,
+			},
+			crud: func(context.Context) types.Resource {
+				srv := &types.ServerV2{
+					Kind:    types.KindNode,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      "srv1",
+						Namespace: apidefaults.Namespace,
+					},
+					Spec: types.ServerSpecV2{
+						Addr: "127.0.0.1:2022",
+					},
+				}
+
+				_, err := testSrv.Auth().UpsertNode(ctx, srv)
+				require.NoError(t, err)
+
+				out, err := testSrv.Auth().GetNodes(ctx, srv.Metadata.Namespace)
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteAllNodes(ctx, srv.Metadata.Namespace)
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Proxy",
+			kind: types.WatchKind{
+				Kind: types.KindProxy,
+			},
+			crud: func(context.Context) types.Resource {
+				srv := &types.ServerV2{
+					Kind:    types.KindProxy,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      "srv1",
+						Namespace: apidefaults.Namespace,
+					},
+					Spec: types.ServerSpecV2{
+						Addr: "127.0.0.1:2022",
+					},
+				}
+
+				err := testSrv.Auth().UpsertProxy(ctx, srv)
+				require.NoError(t, err)
+
+				//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+				out, err := testSrv.Auth().GetProxies()
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteAllProxies()
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Tunnel connection",
+			kind: types.WatchKind{
+				Kind: types.KindTunnelConnection,
+			},
+			crud: func(context.Context) types.Resource {
+				conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
+					ClusterName:   "example.com",
+					ProxyName:     "p1",
+					LastHeartbeat: time.Now().UTC(),
+				})
+				require.NoError(t, err)
+
+				err = testSrv.Auth().UpsertTunnelConnection(conn)
+				require.NoError(t, err)
+
+				out, err := testSrv.Auth().GetTunnelConnections("example.com")
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteAllTunnelConnections()
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Reverse tunnel",
+			kind: types.WatchKind{
+				Kind: types.KindReverseTunnel,
+			},
+			crud: func(context.Context) types.Resource {
+				tunnel := &types.ReverseTunnelV2{
+					Kind:    types.KindReverseTunnel,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      "example.com",
+						Namespace: apidefaults.Namespace,
+					},
+					Spec: types.ReverseTunnelSpecV2{
+						ClusterName: "example.com",
+						DialAddrs:   []string{"example.com:2023"},
+					},
+				}
+
+				_, err := testSrv.Auth().UpsertReverseTunnel(ctx, tunnel)
+				require.NoError(t, err)
+
+				out, _, err := testSrv.Auth().ListReverseTunnels(
+					ctx, 0, "",
+				)
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteReverseTunnel(ctx, tunnel.Spec.ClusterName)
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Remote cluster",
+			kind: types.WatchKind{
+				Kind: types.KindRemoteCluster,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				rc, err := types.NewRemoteCluster("example.com")
+				rc.SetConnectionStatus(teleport.RemoteClusterStatusOffline)
+				require.NoError(t, err)
+				_, err = testSrv.Auth().CreateRemoteCluster(ctx, rc)
+				require.NoError(t, err)
+
+				out, err := testSrv.Auth().GetRemoteClusters(ctx)
+				require.NoError(t, err)
+
+				err = testSrv.Auth().DeleteRemoteCluster(ctx, rc.GetName())
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+	}
+	// this also tests the partial success mode by requesting an unknown kind
+	runEventsTests(t, testCases, clt, types.Watch{
+		Kinds:               append(eventsTestKinds(testCases), types.WatchKind{Kind: "unknown"}),
+		AllowPartialSuccess: true,
+	})
+
+	// tests that a watch fails given an unknown kind when the partial success mode is not enabled
+	runUnknownEventsTest(t, clt, types.Watch{Kinds: []types.WatchKind{
+		{Kind: types.KindNamespace},
+		{Kind: "unknown"},
+	}})
+
+	// tests that a watch fails if all given kinds are unknown even if the success mode is enabled
+	runUnknownEventsTest(t, clt, types.Watch{
+		Kinds: []types.WatchKind{
+			{Kind: "unrecognized"},
+			{Kind: "unidentified"},
+		},
+		AllowPartialSuccess: true,
+	})
+}
+
+func runEventsTests(t *testing.T, testCases []eventTest, events types.Events, watch types.Watch) {
+	ctx := context.Background()
+	w, err := events.NewWatcher(ctx, watch)
+	require.NoError(t, err)
+	defer w.Close()
+
+	select {
+	case event := <-w.Events():
+		require.Equal(t, types.OpInit, event.Type)
+		watchStatus, ok := event.Resource.(types.WatchStatus)
+		require.True(t, ok)
+		expectedKinds := eventsTestKinds(testCases)
+		require.Equal(t, expectedKinds, watchStatus.GetKinds())
+	case <-w.Done():
+		t.Fatalf("Watcher exited with error %v", w.Error())
+	case <-time.After(2 * time.Second):
+		t.Fatalf("Timeout waiting for init event")
+	}
+
+	// filter out all events that could have been inserted
+	// by the initialization routines
+skiploop:
+	for {
+		select {
+		case <-w.Events():
+			continue skiploop
+		default:
+			break skiploop
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Logf("test case %q", tc.name)
+		resource := tc.crud(ctx)
+
+		ExpectResource(t, w, 3*time.Second, resource)
+
+		meta := resource.GetMetadata()
+		header := &types.ResourceHeader{
+			Kind:    resource.GetKind(),
+			SubKind: resource.GetSubKind(),
+			Version: resource.GetVersion(),
+			Metadata: types.Metadata{
+				Name:      meta.Name,
+				Namespace: meta.Namespace,
+			},
+		}
+		ExpectDeleteResource(t, w, 3*time.Second, header)
+	}
+}
+
+func runUnknownEventsTest(t *testing.T, events types.Events, watch types.Watch) {
+	ctx := context.Background()
+	w, err := events.NewWatcher(ctx, watch)
+	if err != nil {
+		// depending on the implementation of EventsS, it might fail here immediately
+		// or later before returning the first event from the watcher.
+		return
+	}
+	defer w.Close()
+
+	select {
+	case <-w.Events():
+		t.Fatal("unexpected event from watcher that is supposed to fail")
+	case <-w.Done():
+		require.Error(t, w.Error())
+	case <-time.After(2 * time.Second):
+		t.Fatal("Timeout waiting for error from watcher")
+	}
+}
+
+type eventTest struct {
+	name string
+	kind types.WatchKind
+	crud func(context.Context) types.Resource
+}
+
+func eventsTestKinds(tests []eventTest) []types.WatchKind {
+	out := make([]types.WatchKind, len(tests))
+	for i, tc := range tests {
+		out[i] = tc.kind
+	}
+	return out
 }
 
 // TestEventsClusterConfig test cluster configuration
@@ -4159,7 +4788,7 @@ func TestEventsClusterConfig(t *testing.T) {
 	ctx := context.Background()
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestBuiltin(types.RoleAdmin))
+	clt, err := testSrv.NewClient(authtest.TestBuiltin(types.RoleAdmin))
 	require.NoError(t, err)
 	defer clt.Close()
 
@@ -4196,7 +4825,7 @@ func TestEventsClusterConfig(t *testing.T) {
 	}, true)
 	require.NoError(t, err)
 
-	suite.ExpectResource(t, w, 3*time.Second, ca)
+	ExpectResource(t, w, 3*time.Second, ca)
 
 	// set static tokens
 	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
@@ -4213,9 +4842,9 @@ func TestEventsClusterConfig(t *testing.T) {
 	err = testSrv.Auth().SetStaticTokens(staticTokens)
 	require.NoError(t, err)
 
-	staticTokens, err = testSrv.Auth().GetStaticTokens()
+	staticTokens, err = testSrv.Auth().GetStaticTokens(ctx)
 	require.NoError(t, err)
-	suite.ExpectResource(t, w, 3*time.Second, staticTokens)
+	ExpectResource(t, w, 3*time.Second, staticTokens)
 
 	// create provision token and expect the update event
 	token, err := types.NewProvisionToken(
@@ -4228,12 +4857,12 @@ func TestEventsClusterConfig(t *testing.T) {
 	token, err = testSrv.Auth().GetToken(ctx, token.GetName())
 	require.NoError(t, err)
 
-	suite.ExpectResource(t, w, 3*time.Second, token)
+	ExpectResource(t, w, 3*time.Second, token)
 
 	// delete token and expect delete event
 	err = testSrv.Auth().DeleteToken(ctx, token.GetName())
 	require.NoError(t, err)
-	suite.ExpectDeleteResource(t, w, 3*time.Second, &types.ResourceHeader{
+	ExpectDeleteResource(t, w, 3*time.Second, &types.ResourceHeader{
 		Kind:    types.KindToken,
 		Version: types.V2,
 		Metadata: types.Metadata{
@@ -4252,7 +4881,7 @@ func TestEventsClusterConfig(t *testing.T) {
 
 	auditConfigResource, err := testSrv.Auth().GetClusterAuditConfig(ctx)
 	require.NoError(t, err)
-	suite.ExpectResource(t, w, 3*time.Second, auditConfigResource)
+	ExpectResource(t, w, 3*time.Second, auditConfigResource)
 
 	// update cluster name resource metadata
 	clusterNameResource, err := testSrv.Auth().GetClusterName(ctx)
@@ -4279,7 +4908,7 @@ func TestEventsClusterConfig(t *testing.T) {
 
 	clusterNameResource, err = testSrv.Auth().GetClusterName(ctx)
 	require.NoError(t, err)
-	suite.ExpectResource(t, w, 3*time.Second, clusterNameResource)
+	ExpectResource(t, w, 3*time.Second, clusterNameResource)
 }
 
 func TestNetworkRestrictions(t *testing.T) {
@@ -4287,13 +4916,47 @@ func TestNetworkRestrictions(t *testing.T) {
 
 	testSrv := newTestTLSServer(t)
 
-	clt, err := testSrv.NewClient(TestAdmin())
+	clt, err := testSrv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
-		RestrictionsS: clt,
+	ctx := context.Background()
+
+	// blank slate, should be get/delete should fail
+	_, err = clt.GetNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = clt.DeleteNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	allow := []types.AddressCondition{
+		{CIDR: "10.0.1.0/24"},
+		{CIDR: "10.0.2.2"},
+	}
+	deny := []types.AddressCondition{
+		{CIDR: "10.1.0.0/16"},
+		{CIDR: "8.8.8.8"},
 	}
-	suite.NetworkRestrictions(t)
+
+	expected := types.NewNetworkRestrictions()
+	expected.SetAllow(allow)
+	expected.SetDeny(deny)
+
+	// set and make sure we get it back
+	err = clt.SetNetworkRestrictions(ctx, expected)
+	require.NoError(t, err)
+
+	actual, err := clt.GetNetworkRestrictions(ctx)
+	require.NoError(t, err)
+
+	require.Empty(t, cmp.Diff(expected.GetAllow(), actual.GetAllow()))
+	require.Empty(t, cmp.Diff(expected.GetDeny(), actual.GetDeny()))
+
+	// now delete should work ok and get should fail again
+	err = clt.DeleteNetworkRestrictions(ctx)
+	require.NoError(t, err)
+
+	err = clt.DeleteNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
 }
 
 func mustNewToken(
@@ -4353,7 +5016,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 	testSrv.Auth().SetEmitter(mockEmitter)
 
 	// Create a user with the least privilege access to call this RPC.
-	privilegedUser, _, err := CreateUserAndRole(
+	privilegedUser, _, err := authtest.CreateUserAndRole(
 		testSrv.Auth(), "token-creator", nil, []types.Rule{
 			{
 				Resources: []string{types.KindToken},
@@ -4371,7 +5034,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		identity TestIdentity
+		identity authtest.TestIdentity
 		token    types.ProvisionToken
 
 		requireTokenCreated bool
@@ -4380,7 +5043,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 	}{
 		{
 			name:     "success",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token: mustNewTokenFromSpec(
 				t,
 				"success",
@@ -4403,8 +5066,10 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 						UpdatedBy: "token-creator",
 					},
 					UserMetadata: eventtypes.UserMetadata{
-						User:     "token-creator",
-						UserKind: eventtypes.UserKind_USER_KIND_HUMAN,
+						User:            "token-creator",
+						UserKind:        eventtypes.UserKind_USER_KIND_HUMAN,
+						UserRoles:       []string{"user:token-creator"},
+						UserClusterName: "localhost",
 					},
 					Roles:      types.SystemRoles{types.RoleNode, types.RoleKube},
 					JoinMethod: types.JoinMethodToken,
@@ -4413,7 +5078,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 		},
 		{
 			name:     "success (trusted cluster)",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token: mustNewTokenFromSpec(
 				t,
 				"success-trusted-cluster",
@@ -4436,8 +5101,10 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 						UpdatedBy: "token-creator",
 					},
 					UserMetadata: eventtypes.UserMetadata{
-						User:     "token-creator",
-						UserKind: eventtypes.UserKind_USER_KIND_HUMAN,
+						User:            "token-creator",
+						UserKind:        eventtypes.UserKind_USER_KIND_HUMAN,
+						UserRoles:       []string{"user:token-creator"},
+						UserClusterName: "localhost",
 					},
 					Roles:      types.SystemRoles{types.RoleTrustedCluster},
 					JoinMethod: types.JoinMethodToken,
@@ -4446,7 +5113,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 		},
 		{
 			name:     "access denied",
-			identity: TestNop(),
+			identity: authtest.TestNop(),
 			token: mustNewToken(
 				t, "access denied", types.SystemRoles{types.RoleNode}, time.Time{},
 			),
@@ -4454,7 +5121,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 		},
 		{
 			name:     "already exists",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token:    alreadyExistsToken,
 			requireError: func(t require.TestingT, err error, i ...interface{}) {
 				require.True(
@@ -4466,7 +5133,7 @@ func TestGRPCServer_CreateTokenV2(t *testing.T) {
 		},
 		{
 			name:         "invalid token",
-			identity:     TestUser(privilegedUser.GetName()),
+			identity:     authtest.TestUser(privilegedUser.GetName()),
 			token:        &types.ProvisionTokenV2{},
 			requireError: requireBadParameter,
 		},
@@ -4512,7 +5179,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 	testSrv.Auth().SetEmitter(mockEmitter)
 
 	// Create a user with the least privilege access to call this RPC.
-	privilegedUser, _, err := CreateUserAndRole(
+	privilegedUser, _, err := authtest.CreateUserAndRole(
 		testSrv.Auth(), "token-upserter", nil, []types.Rule{
 			{
 				Resources: []string{types.KindToken},
@@ -4530,7 +5197,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		identity TestIdentity
+		identity authtest.TestIdentity
 		token    types.ProvisionToken
 
 		requireTokenCreated bool
@@ -4539,7 +5206,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 	}{
 		{
 			name:     "success",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token: mustNewTokenFromSpec(
 				t,
 				"success",
@@ -4562,8 +5229,10 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 						UpdatedBy: "token-upserter",
 					},
 					UserMetadata: eventtypes.UserMetadata{
-						User:     "token-upserter",
-						UserKind: eventtypes.UserKind_USER_KIND_HUMAN,
+						User:            "token-upserter",
+						UserKind:        eventtypes.UserKind_USER_KIND_HUMAN,
+						UserRoles:       []string{"user:token-upserter"},
+						UserClusterName: "localhost",
 					},
 					Roles:      types.SystemRoles{types.RoleNode, types.RoleKube},
 					JoinMethod: types.JoinMethodToken,
@@ -4572,7 +5241,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 		},
 		{
 			name:     "success (trusted cluster)",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token: mustNewTokenFromSpec(
 				t,
 				"success-trusted-cluster",
@@ -4595,8 +5264,10 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 						UpdatedBy: "token-upserter",
 					},
 					UserMetadata: eventtypes.UserMetadata{
-						User:     "token-upserter",
-						UserKind: eventtypes.UserKind_USER_KIND_HUMAN,
+						User:            "token-upserter",
+						UserKind:        eventtypes.UserKind_USER_KIND_HUMAN,
+						UserRoles:       []string{"user:token-upserter"},
+						UserClusterName: "localhost",
 					},
 					Roles:      types.SystemRoles{types.RoleTrustedCluster},
 					JoinMethod: types.JoinMethodToken,
@@ -4605,7 +5276,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 		},
 		{
 			name:     "existing token replaced",
-			identity: TestUser(privilegedUser.GetName()),
+			identity: authtest.TestUser(privilegedUser.GetName()),
 			token: mustNewTokenFromSpec(
 				t,
 				alreadyExistsToken.GetName(),
@@ -4630,8 +5301,10 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 						UpdatedBy: "token-upserter",
 					},
 					UserMetadata: eventtypes.UserMetadata{
-						User:     "token-upserter",
-						UserKind: eventtypes.UserKind_USER_KIND_HUMAN,
+						User:            "token-upserter",
+						UserKind:        eventtypes.UserKind_USER_KIND_HUMAN,
+						UserRoles:       []string{"user:token-upserter"},
+						UserClusterName: "localhost",
 					},
 					Roles:      types.SystemRoles{types.RoleNode},
 					JoinMethod: types.JoinMethodToken,
@@ -4640,7 +5313,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 		},
 		{
 			name:     "access denied",
-			identity: TestNop(),
+			identity: authtest.TestNop(),
 			token: mustNewToken(
 				t, "access denied", types.SystemRoles{types.RoleNode}, time.Time{},
 			),
@@ -4648,7 +5321,7 @@ func TestGRPCServer_UpsertTokenV2(t *testing.T) {
 		},
 		{
 			name:         "invalid token",
-			identity:     TestUser(privilegedUser.GetName()),
+			identity:     authtest.TestUser(privilegedUser.GetName()),
 			token:        &types.ProvisionTokenV2{},
 			requireError: requireBadParameter,
 		},
@@ -4689,7 +5362,7 @@ func TestGRPCServer_GetTokens(t *testing.T) {
 	testSrv := newTestTLSServer(t)
 
 	// Create a user with the least privilege access to call this RPC.
-	privilegedUser, _, err := CreateUserAndRole(
+	privilegedUser, _, err := authtest.CreateUserAndRole(
 		testSrv.Auth(), "token-reader", nil, []types.Rule{
 			{
 				Resources: []string{types.KindToken},
@@ -4700,7 +5373,7 @@ func TestGRPCServer_GetTokens(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("no extra tokens", func(t *testing.T) {
-		client, err := testSrv.NewClient(TestUser(privilegedUser.GetName()))
+		client, err := testSrv.NewClient(authtest.TestUser(privilegedUser.GetName()))
 		require.NoError(t, err)
 		toks, err := client.GetTokens(ctx)
 		require.NoError(t, err)
@@ -4736,20 +5409,20 @@ func TestGRPCServer_GetTokens(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		identity TestIdentity
+		identity authtest.TestIdentity
 
 		requireResponse bool
 		requireError    require.ErrorAssertionFunc
 	}{
 		{
 			name:            "success",
-			identity:        TestUser(privilegedUser.GetName()),
+			identity:        authtest.TestUser(privilegedUser.GetName()),
 			requireError:    require.NoError,
 			requireResponse: true,
 		},
 		{
 			name:         "access denied",
-			identity:     TestNop(),
+			identity:     authtest.TestNop(),
 			requireError: requireAccessDenied,
 		},
 	}
@@ -4781,7 +5454,7 @@ func TestGRPCServer_GetToken(t *testing.T) {
 	testSrv := newTestTLSServer(t)
 
 	// Create a user with the least privilege access to call this RPC.
-	privilegedUser, _, err := CreateUserAndRole(
+	privilegedUser, _, err := authtest.CreateUserAndRole(
 		testSrv.Auth(), "token-reader", nil, []types.Rule{
 			{
 				Resources: []string{types.KindToken},
@@ -4798,7 +5471,7 @@ func TestGRPCServer_GetToken(t *testing.T) {
 	tests := []struct {
 		name      string
 		tokenName string
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 
 		requireResponse bool
 		requireError    require.ErrorAssertionFunc
@@ -4806,20 +5479,20 @@ func TestGRPCServer_GetToken(t *testing.T) {
 		{
 			name:            "success",
 			tokenName:       pt.GetName(),
-			identity:        TestUser(privilegedUser.GetName()),
+			identity:        authtest.TestUser(privilegedUser.GetName()),
 			requireError:    require.NoError,
 			requireResponse: true,
 		},
 		{
 			name:         "access denied",
-			identity:     TestNop(),
+			identity:     authtest.TestNop(),
 			tokenName:    pt.GetName(),
 			requireError: requireAccessDenied,
 		},
 		{
 			name:         "not found",
 			tokenName:    "does-not-exist",
-			identity:     TestUser(privilegedUser.GetName()),
+			identity:     authtest.TestUser(privilegedUser.GetName()),
 			requireError: requireNotFound,
 		},
 	}
@@ -4851,7 +5524,7 @@ func TestGRPCServer_DeleteToken(t *testing.T) {
 	testSrv := newTestTLSServer(t)
 
 	// Create a user with the least privilege access to call this RPC.
-	privilegedUser, _, err := CreateUserAndRole(
+	privilegedUser, _, err := authtest.CreateUserAndRole(
 		testSrv.Auth(), "token-deleter", nil, []types.Rule{
 			{
 				Resources: []string{types.KindToken},
@@ -4868,7 +5541,7 @@ func TestGRPCServer_DeleteToken(t *testing.T) {
 	tests := []struct {
 		name      string
 		tokenName string
-		identity  TestIdentity
+		identity  authtest.TestIdentity
 
 		requireTokenDeleted bool
 		requireError        require.ErrorAssertionFunc
@@ -4876,20 +5549,20 @@ func TestGRPCServer_DeleteToken(t *testing.T) {
 		{
 			name:                "success",
 			tokenName:           pt.GetName(),
-			identity:            TestUser(privilegedUser.GetName()),
+			identity:            authtest.TestUser(privilegedUser.GetName()),
 			requireError:        require.NoError,
 			requireTokenDeleted: true,
 		},
 		{
 			name:         "access denied",
-			identity:     TestNop(),
+			identity:     authtest.TestNop(),
 			tokenName:    pt.GetName(),
 			requireError: requireAccessDenied,
 		},
 		{
 			name:         "not found",
 			tokenName:    "does-not-exist",
-			identity:     TestUser(privilegedUser.GetName()),
+			identity:     authtest.TestUser(privilegedUser.GetName()),
 			requireError: requireNotFound,
 		},
 	}
@@ -4981,7 +5654,7 @@ func verifyJWTAWSOIDC(clock clockwork.Clock, clusterName string, pairs []*types.
 
 type testTLSServerOptions struct {
 	cacheEnabled bool
-	accessGraph  *AccessGraphConfig
+	accessGraph  *auth.AccessGraphConfig
 	clock        clockwork.Clock
 }
 
@@ -4993,7 +5666,7 @@ func withCacheEnabled(enabled bool) testTLSServerOption {
 	}
 }
 
-func withAccessGraphConfig(cfg AccessGraphConfig) testTLSServerOption {
+func withAccessGraphConfig(cfg auth.AccessGraphConfig) testTLSServerOption {
 	return func(options *testTLSServerOptions) {
 		options.accessGraph = &cfg
 	}
@@ -5005,12 +5678,12 @@ func withClock(clock clockwork.Clock) testTLSServerOption {
 	}
 }
 
-// newTestTLSServer is a helper that returns a *TestTLSServer with sensible
+// newTestTLSServer is a helper that returns a *authtest.TLSServer with sensible
 // defaults for most tests that are exercising Auth Service RPCs.
 //
 // For more advanced use-cases, call NewTestAuthServer and NewTestTLSServer
 // to provide a more detailed configuration.
-func newTestTLSServer(t testing.TB, opts ...testTLSServerOption) *TestTLSServer {
+func newTestTLSServer(t testing.TB, opts ...testTLSServerOption) *authtest.TLSServer {
 	var options testTLSServerOptions
 	for _, opt := range opts {
 		opt(&options)
@@ -5018,15 +5691,17 @@ func newTestTLSServer(t testing.TB, opts ...testTLSServerOption) *TestTLSServer
 	if options.clock == nil {
 		options.clock = clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
 	}
-	as, err := NewTestAuthServer(TestAuthServerConfig{
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:          t.TempDir(),
 		Clock:        options.clock,
 		CacheEnabled: options.cacheEnabled,
 	})
 	require.NoError(t, err)
-	var tlsServerOpts []TestTLSServerOption
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
+
+	var tlsServerOpts []authtest.TestTLSServerOption
 	if options.accessGraph != nil {
-		tlsServerOpts = append(tlsServerOpts, WithAccessGraphConfig(*options.accessGraph))
+		tlsServerOpts = append(tlsServerOpts, authtest.WithAccessGraphConfig(*options.accessGraph))
 	}
 	srv, err := as.NewTestTLSServer(tlsServerOpts...)
 	require.NoError(t, err)
@@ -5085,10 +5760,10 @@ func TestVerifyPeerCert(t *testing.T) {
 		}
 	)
 
-	localHostCA := suite.NewTestCA(types.HostCA, localClusterName)
-	remoteHostCA := suite.NewTestCA(types.HostCA, remoteClusterName)
-	localUserCA := suite.NewTestCA(types.UserCA, localClusterName)
-	remoteUserCA := suite.NewTestCA(types.UserCA, remoteClusterName)
+	localHostCA := authtest.NewTestCA(types.HostCA, localClusterName)
+	remoteHostCA := authtest.NewTestCA(types.HostCA, remoteClusterName)
+	localUserCA := authtest.NewTestCA(types.UserCA, localClusterName)
+	remoteUserCA := authtest.NewTestCA(types.UserCA, remoteClusterName)
 
 	caPool := buildPoolInfo(
 		t,
@@ -5204,7 +5879,7 @@ func TestVerifyPeerCert(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			verify := caPool.verifyPeerCert()
+			verify := caPool.VerifyPeerCert()
 			err := verify(nil, [][]*x509.Certificate{{tt.peer}})
 			if tt.wantErr {
 				require.ErrorContains(t, err, "access denied: invalid client certificate")
@@ -5215,8 +5890,8 @@ func TestVerifyPeerCert(t *testing.T) {
 	}
 }
 
-func buildPoolInfo(t *testing.T, ca ...types.CertAuthority) *HostAndUserCAPoolInfo {
-	poolInfo := HostAndUserCAPoolInfo{
+func buildPoolInfo(t *testing.T, ca ...types.CertAuthority) *auth.HostAndUserCAPoolInfo {
+	poolInfo := auth.HostAndUserCAPoolInfo{
 		Pool:    x509.NewCertPool(),
 		CATypes: make(authclient.HostAndUserCAInfo),
 	}
diff --git a/lib/auth/transport_credentials.go b/lib/auth/transport_credentials.go
index 9eb499a5368c4..401c4710e47b7 100644
--- a/lib/auth/transport_credentials.go
+++ b/lib/auth/transport_credentials.go
@@ -75,6 +75,13 @@ type TransportCredentialsConfig struct {
 	// authorized due to locks, private key policy, device trust, etc. If not set
 	// then no authorization is performed.
 	Authorizer authz.Authorizer
+
+	// ScopedAuthorizer is an additional optional authorizer that can be used to perform
+	// authorization of scoped identities.  Note that when present, this field is preferred
+	// over the above Authorizer, though scoped contexts can be undwrapped into unscoped
+	// contexts if not all methods of the underlying service are being ported over to be scope-aware.
+	ScopedAuthorizer authz.ScopedAuthorizer
+
 	// Enforcer prevents any connections from being established if the user would
 	// exceed their configured max connection limit. Any connections that are
 	// permitted may be terminated if there is an issue determining if the number
@@ -116,6 +123,7 @@ type TransportCredentials struct {
 
 	userGetter        UserGetter
 	authorizer        authz.Authorizer
+	scopedAuthorizer  authz.ScopedAuthorizer
 	enforcer          ConnectionEnforcer
 	getAuthPreference func(context.Context) (types.AuthPreference, error)
 	clock             clockwork.Clock
@@ -143,6 +151,7 @@ func NewTransportCredentials(cfg TransportCredentialsConfig) (*TransportCredenti
 		TransportCredentials: cfg.TransportCredentials,
 		userGetter:           cfg.UserGetter,
 		authorizer:           cfg.Authorizer,
+		scopedAuthorizer:     cfg.ScopedAuthorizer,
 		enforcer:             cfg.Enforcer,
 		getAuthPreference:    getAuthPreference,
 		clock:                clock,
@@ -164,10 +173,20 @@ type IdentityInfo struct {
 	// [TransportCredentialsConfig.Authorizer] provided to [NewTransportCredentials]
 	// was nil.
 	AuthContext *authz.Context
+
+	// ScopedContext contains scoped authorization context. This will be unset if
+	// the [TransportCredentialsConfig.ScopedAuthorizer] provided to [NewTransportCredentials]
+	// was nil.
+	ScopedAuthContext *authz.ScopedContext
+
 	// Conn is the underlying [net.Conn] of the gRPC connection.
 	Conn net.Conn
 }
 
+func (i IdentityInfo) ScopedAuthzContext() (ctx *authz.ScopedContext, ok bool) {
+	return i.ScopedAuthContext, i.ScopedAuthContext != nil
+}
+
 // timeoutConn wraps a connection that is to be closed when
 // the timer expires.
 type timeoutConn struct {
@@ -228,28 +247,43 @@ func (c *TransportCredentials) validateIdentity(conn net.Conn, tlsInfo *credenti
 	}
 
 	ctx := context.Background()
-	authCtx, err := c.authorize(ctx, conn.RemoteAddr(), identityGetter, &tlsInfo.State)
+	authCtx, scopedAuthCtx, err := c.authorize(ctx, conn.RemoteAddr(), identityGetter, &tlsInfo.State)
 	if err != nil {
 		return nil, IdentityInfo{}, trace.Wrap(err)
 	}
 
-	if err := c.enforceConnectionLimits(ctx, authCtx, conn); err != nil {
-		return nil, IdentityInfo{}, trace.Wrap(err)
-	}
-
-	if authPreference, err := c.getAuthPreference(ctx); err == nil {
-		expiry := authCtx.GetDisconnectCertExpiry(authPreference)
-		conn, err = newTimeoutConn(conn, c.clock, expiry)
-		if err != nil {
+	if authCtx != nil {
+		// TODO(fspmarshall/scopes): enforce connection limits for scoped identities, or rework this to have a cleaner
+		// abstraction if we decide that there is no sane concept of connection-limits for scopes (likely, there won't
+		// be unelss we special-case root role assignments or introduce some additional control mechanism outside of
+		// scoped roles).
+		if err := c.enforceConnectionLimits(ctx, authCtx, conn); err != nil {
 			return nil, IdentityInfo{}, trace.Wrap(err)
 		}
+
+		if authPreference, err := c.getAuthPreference(ctx); err == nil {
+			expiry := authCtx.GetDisconnectCertExpiry(authPreference)
+			conn, err = newTimeoutConn(conn, c.clock, expiry)
+			if err != nil {
+				return nil, IdentityInfo{}, trace.Wrap(err)
+			}
+		}
+	} else {
+		if authPreference, err := c.getAuthPreference(ctx); err == nil {
+			expiry := scopedAuthCtx.GetDisconnectCertExpiry(authPreference)
+			conn, err = newTimeoutConn(conn, c.clock, expiry)
+			if err != nil {
+				return nil, IdentityInfo{}, trace.Wrap(err)
+			}
+		}
 	}
 
 	return conn, IdentityInfo{
-		TLSInfo:        tlsInfo,
-		IdentityGetter: identityGetter,
-		AuthContext:    authCtx,
-		Conn:           conn,
+		TLSInfo:           tlsInfo,
+		IdentityGetter:    identityGetter,
+		AuthContext:       authCtx,
+		ScopedAuthContext: scopedAuthCtx,
+		Conn:              conn,
 	}, nil
 }
 
@@ -272,11 +306,11 @@ func (c *TransportCredentials) performTLSHandshake(rawConn net.Conn) (net.Conn,
 // authorize enforces that the identity is not restricted from connecting due
 // to things like locks, private key policy, device trust, etc. If the TransportCredentials
 // was not configured to do authorization then this is a noop and will return nil, nil.
-func (c *TransportCredentials) authorize(ctx context.Context, remoteAddr net.Addr, identityGetter authz.IdentityGetter, connState *tls.ConnectionState) (*authz.Context, error) {
-	if c.authorizer == nil {
+func (c *TransportCredentials) authorize(ctx context.Context, remoteAddr net.Addr, identityGetter authz.IdentityGetter, connState *tls.ConnectionState) (*authz.Context, *authz.ScopedContext, error) {
+	if c.authorizer == nil && c.scopedAuthorizer == nil {
 		return &authz.Context{
 			Identity: identityGetter,
-		}, nil
+		}, nil, nil
 	}
 
 	// construct a context with the keys expected by the Authorizer
@@ -284,8 +318,18 @@ func (c *TransportCredentials) authorize(ctx context.Context, remoteAddr net.Add
 	ctx = authz.ContextWithClientSrcAddr(ctx, remoteAddr)
 	ctx = authz.ContextWithUser(ctx, identityGetter)
 
+	if c.scopedAuthorizer != nil {
+		scopedCtx, err := c.scopedAuthorizer.AuthorizeScoped(ctx)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		authCtx, _ := scopedCtx.UnscopedContext()
+		return authCtx, scopedCtx, nil
+	}
+
 	authCtx, err := c.authorizer.Authorize(ctx)
-	return authCtx, trace.Wrap(err)
+	return authCtx, nil, trace.Wrap(err)
 }
 
 // enforceConnectionLimits prevents the identity from exceeding any configured
@@ -321,6 +365,7 @@ func (c *TransportCredentials) Clone() credentials.TransportCredentials {
 	return &TransportCredentials{
 		userGetter:           c.userGetter,
 		authorizer:           c.authorizer,
+		scopedAuthorizer:     c.scopedAuthorizer,
 		enforcer:             c.enforcer,
 		TransportCredentials: c.TransportCredentials.Clone(),
 		clock:                c.clock,
diff --git a/lib/auth/transport_credentials_test.go b/lib/auth/transport_credentials_test.go
index c0a4519d51dcb..6ce1107683552 100644
--- a/lib/auth/transport_credentials_test.go
+++ b/lib/auth/transport_credentials_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -36,6 +36,8 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -49,7 +51,7 @@ func TestTransportCredentials_Check(t *testing.T) {
 	cases := []struct {
 		name                string
 		tlsConf             *tls.Config
-		conf                TransportCredentialsConfig
+		conf                auth.TransportCredentialsConfig
 		errAssertion        require.ErrorAssertionFunc
 		credentialAssertion require.ValueAssertionFunc
 	}{
@@ -65,7 +67,7 @@ func TestTransportCredentials_Check(t *testing.T) {
 			errAssertion: func(t require.TestingT, err error, i ...interface{}) {
 				require.ErrorIs(t, err, trace.BadParameter("the TransportCredentials must be a tls security protocol, got insecure"))
 			},
-			conf:                TransportCredentialsConfig{TransportCredentials: insecure.NewCredentials()},
+			conf:                auth.TransportCredentialsConfig{TransportCredentials: insecure.NewCredentials()},
 			credentialAssertion: require.Nil,
 		},
 		{
@@ -73,7 +75,7 @@ func TestTransportCredentials_Check(t *testing.T) {
 			errAssertion: func(t require.TestingT, err error, i ...interface{}) {
 				require.ErrorIs(t, err, trace.BadParameter("parameter UserGetter required"))
 			},
-			conf:                TransportCredentialsConfig{TransportCredentials: credentials.NewTLS(tlsConf.Clone())},
+			conf:                auth.TransportCredentialsConfig{TransportCredentials: credentials.NewTLS(tlsConf.Clone())},
 			credentialAssertion: require.Nil,
 		},
 		{
@@ -81,9 +83,9 @@ func TestTransportCredentials_Check(t *testing.T) {
 			errAssertion: func(t require.TestingT, err error, i ...interface{}) {
 				require.ErrorIs(t, err, trace.BadParameter("both a UserGetter and an Authorizer are required to enforce connection limits with an Enforcer"))
 			},
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{},
+				UserGetter:           &auth.Middleware{},
 				Enforcer:             &fakeEnforcer{},
 			},
 			credentialAssertion: require.Nil,
@@ -91,18 +93,18 @@ func TestTransportCredentials_Check(t *testing.T) {
 		{
 			name:         "valid configuration: without connection limiter or authorizer",
 			errAssertion: require.NoError,
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{},
+				UserGetter:           &auth.Middleware{},
 			},
 			credentialAssertion: require.NotNil,
 		},
 		{
 			name:         "valid configuration: without connection limiter",
 			errAssertion: require.NoError,
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{},
+				UserGetter:           &auth.Middleware{},
 				Authorizer:           &fakeAuthorizer{},
 			},
 			credentialAssertion: require.NotNil,
@@ -110,9 +112,9 @@ func TestTransportCredentials_Check(t *testing.T) {
 		{
 			name:         "valid configuration",
 			errAssertion: require.NoError,
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{},
+				UserGetter:           &auth.Middleware{},
 				Authorizer:           &fakeAuthorizer{},
 			},
 			credentialAssertion: require.NotNil,
@@ -124,7 +126,7 @@ func TestTransportCredentials_Check(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
-			creds, err := NewTransportCredentials(test.conf)
+			creds, err := auth.NewTransportCredentials(test.conf)
 			test.errAssertion(t, err)
 			test.credentialAssertion(t, creds)
 		})
@@ -143,7 +145,7 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 
 	cases := []struct {
 		name               string
-		conf               TransportCredentialsConfig
+		conf               auth.TransportCredentialsConfig
 		clientTLSConf      *tls.Config
 		errAssertion       require.ErrorAssertionFunc
 		handshakeAssertion require.ErrorAssertionFunc
@@ -151,15 +153,15 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 	}{
 		{
 			name: "valid connection without session control",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 			},
 			clientTLSConf:      &tls.Config{InsecureSkipVerify: true},
 			errAssertion:       require.NoError,
 			handshakeAssertion: require.NoError,
 			infoAssertion: func(t *testing.T, info credentials.AuthInfo) {
-				identityInfo, ok := info.(IdentityInfo)
+				identityInfo, ok := info.(auth.IdentityInfo)
 				require.True(t, ok)
 				require.NotNil(t, identityInfo.TLSInfo)
 				require.NotNil(t, identityInfo.IdentityGetter)
@@ -170,16 +172,16 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 		},
 		{
 			name: "valid connection with authorization but no connection limiting",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 				Authorizer:           &fakeAuthorizer{},
 			},
 			clientTLSConf:      &tls.Config{InsecureSkipVerify: true},
 			errAssertion:       require.NoError,
 			handshakeAssertion: require.NoError,
 			infoAssertion: func(t *testing.T, info credentials.AuthInfo) {
-				identityInfo, ok := info.(IdentityInfo)
+				identityInfo, ok := info.(auth.IdentityInfo)
 				require.True(t, ok)
 				require.NotNil(t, identityInfo.IdentityGetter)
 				require.NotNil(t, identityInfo.AuthContext)
@@ -187,9 +189,9 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 		},
 		{
 			name: "valid connection with full session control",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 				Authorizer: &fakeAuthorizer{
 					checker: &fakeChecker{maxConnections: 1},
 				},
@@ -199,7 +201,7 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 			errAssertion:       require.NoError,
 			handshakeAssertion: require.NoError,
 			infoAssertion: func(t *testing.T, info credentials.AuthInfo) {
-				identityInfo, ok := info.(IdentityInfo)
+				identityInfo, ok := info.(auth.IdentityInfo)
 				require.True(t, ok)
 				require.NotNil(t, identityInfo.IdentityGetter)
 				require.NotNil(t, identityInfo.AuthContext)
@@ -207,9 +209,9 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 		},
 		{
 			name: "not authorized",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 				Authorizer:           &fakeAuthorizer{authorizeError: unauthorized},
 			},
 			clientTLSConf: &tls.Config{InsecureSkipVerify: true},
@@ -223,9 +225,9 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 		},
 		{
 			name: "connection limits exceeded",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 				Authorizer:           &fakeAuthorizer{checker: &fakeChecker{maxConnections: 1}},
 				Enforcer:             &fakeEnforcer{err: tooManyConnections},
 			},
@@ -240,9 +242,9 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 		},
 		{
 			name: "tls handshake failure",
-			conf: TransportCredentialsConfig{
+			conf: auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(tlsConf.Clone()),
-				UserGetter:           &Middleware{ClusterName: "test"},
+				UserGetter:           &auth.Middleware{ClusterName: "test"},
 			},
 			clientTLSConf:      &tls.Config{InsecureSkipVerify: false},
 			handshakeAssertion: require.Error,
@@ -260,7 +262,7 @@ func TestTransportCredentials_ServerHandshake(t *testing.T) {
 				require.NoError(t, ln.Close())
 			})
 
-			creds, err := NewTransportCredentials(test.conf)
+			creds, err := auth.NewTransportCredentials(test.conf)
 			require.NoError(t, err)
 
 			errC := make(chan error, 1)
@@ -369,14 +371,14 @@ func TestTransportCredentialsDisconnection(t *testing.T) {
 			if test.expiry != 0 {
 				expiry = clock.Now().Add(test.expiry)
 			}
-			identity := TestIdentity{
+			identity := authtest.TestIdentity{
 				I: authz.LocalUser{
 					Username: "llama",
 					Identity: tlsca.Identity{Username: "llama", Expires: expiry},
 				},
 			}
 
-			creds, err := NewTransportCredentials(TransportCredentialsConfig{
+			creds, err := auth.NewTransportCredentials(auth.TransportCredentialsConfig{
 				TransportCredentials: credentials.NewTLS(&tls.Config{}),
 				Authorizer:           &fakeAuthorizer{checker: &fakeChecker{}, identity: identity.I},
 				UserGetter: fakeUserGetter{
@@ -387,7 +389,7 @@ func TestTransportCredentialsDisconnection(t *testing.T) {
 			})
 			require.NoError(t, err, "creating transport credentials")
 
-			validatedConn, _, err := creds.validateIdentity(conn, &credentials.TLSInfo{State: tls.ConnectionState{}})
+			validatedConn, _, err := auth.ValidateIdentity(creds, conn, &credentials.TLSInfo{State: tls.ConnectionState{}})
 			switch {
 			case test.expiry == 0:
 				require.NoError(t, err)
@@ -449,7 +451,7 @@ func (a *fakeAuthorizer) Authorize(ctx context.Context) (*authz.Context, error)
 
 	identity := a.identity
 	if identity == nil {
-		identity = TestUser(user.GetName()).I
+		identity = authtest.TestUser(user.GetName()).I
 	}
 
 	return &authz.Context{
@@ -464,7 +466,7 @@ type fakeEnforcer struct {
 	err error
 }
 
-func (e *fakeEnforcer) EnforceConnectionLimits(ctx context.Context, identity ConnectionIdentity, closers ...io.Closer) (context.Context, error) {
+func (e *fakeEnforcer) EnforceConnectionLimits(ctx context.Context, identity auth.ConnectionIdentity, closers ...io.Closer) (context.Context, error) {
 	return e.ctx, e.err
 }
 
diff --git a/lib/auth/trust/trustv1/service.go b/lib/auth/trust/trustv1/service.go
index 87096f88b11ed..6260919f10210 100644
--- a/lib/auth/trust/trustv1/service.go
+++ b/lib/auth/trust/trustv1/service.go
@@ -28,6 +28,7 @@ import (
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -50,24 +51,28 @@ type authServer interface {
 	CreateTrustedCluster(ctx context.Context, tc types.TrustedCluster) (types.TrustedCluster, error)
 	// UpdateTrustedCluster updates a Trusted Cluster.
 	UpdateTrustedCluster(ctx context.Context, tc types.TrustedCluster) (types.TrustedCluster, error)
+	// ListTrustedClusters returns a page of Trusted Cluster resources.
+	ListTrustedClusters(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error)
 }
 
 // ServiceConfig holds configuration options for
 // the trust gRPC service.
 type ServiceConfig struct {
-	Authorizer authz.Authorizer
-	Cache      services.AuthorityGetter
-	Backend    services.TrustInternal
-	AuthServer authServer
+	Authorizer       authz.Authorizer
+	ScopedAuthorizer authz.ScopedAuthorizer
+	Cache            services.AuthorityGetter
+	Backend          services.TrustInternal
+	AuthServer       authServer
 }
 
 // Service implements the teleport.trust.v1.TrustService RPC service.
 type Service struct {
 	trustpb.UnimplementedTrustServiceServer
-	authorizer authz.Authorizer
-	cache      services.AuthorityGetter
-	backend    services.TrustInternal
-	authServer authServer
+	authorizer       authz.Authorizer
+	scopedAuthorizer authz.ScopedAuthorizer
+	cache            services.AuthorityGetter
+	backend          services.TrustInternal
+	authServer       authServer
 }
 
 // NewService returns a new trust gRPC service.
@@ -79,15 +84,18 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		return nil, trace.BadParameter("backend is required")
 	case cfg.Authorizer == nil:
 		return nil, trace.BadParameter("authorizer is required")
+	case cfg.ScopedAuthorizer == nil:
+		return nil, trace.BadParameter("scoped authorizer is required")
 	case cfg.AuthServer == nil:
 		return nil, trace.BadParameter("authServer is required")
 	}
 
 	return &Service{
-		authorizer: cfg.Authorizer,
-		cache:      cfg.Cache,
-		backend:    cfg.Backend,
-		authServer: cfg.AuthServer,
+		authorizer:       cfg.Authorizer,
+		scopedAuthorizer: cfg.ScopedAuthorizer,
+		cache:            cfg.Cache,
+		backend:          cfg.Backend,
+		authServer:       cfg.AuthServer,
 	}, nil
 }
 
@@ -147,23 +155,47 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 
 // GetCertAuthorities retrieves the cert authorities with the specified type.
 func (s *Service) GetCertAuthorities(ctx context.Context, req *trustpb.GetCertAuthoritiesRequest) (*trustpb.GetCertAuthoritiesResponse, error) {
-	authCtx, err := s.authorizer.Authorize(ctx)
+	authCtx, err := s.scopedAuthorizer.AuthorizeScoped(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	verbs := []string{types.VerbList, types.VerbReadNoSecrets}
+	// for standard reads we do not enforce scope pinning. this ensures that CAs are readable for
+	// all scoped identities regardless of their current scope pinning. this pattern should not
+	// be used for any checks save essential global configuration reads that are necessary for basic
+	// teleport functionality.
+	decisionFn := authCtx.CheckerContext.RiskyUnpinnedDecision
 
 	if req.IncludeKey {
 		verbs = append(verbs, types.VerbRead)
 
-		// Require admin MFA to read secrets.
-		if err := authCtx.AuthorizeAdminActionAllowReusedMFA(); err != nil {
-			return nil, trace.Wrap(err)
+		// for queries that include secrets we must enforce standard scope pinning rules.
+		// NOTE: technically we have no plans to introduce scoped CA secrets. as of the time of writing,
+		// attempts to read CA secrets by scoped identities are always denied by virtue of the scoped
+		// role verb limits enforced in scopes/access. this, however, would be the correct pattern should
+		// we choose to introduce scoped CA secrets in the future.
+		decisionFn = authCtx.CheckerContext.Decision
+
+		// Require admin MFA to read secrets (admin MFA is currently only supported for unscoped identities).
+		if unscopedCtx, ok := authCtx.UnscopedContext(); ok {
+			if err := unscopedCtx.AuthorizeAdminActionAllowReusedMFA(); err != nil {
+				return nil, trace.Wrap(err)
+			}
+		} else {
+			return nil, trace.AccessDenied("cannot perform admin action %s:%s as scoped identity", types.KindCertAuthority, types.VerbRead)
 		}
 	}
 
-	if err := authCtx.CheckAccessToKind(types.KindCertAuthority, verbs[0], verbs[1:]...); err != nil {
+	// build rule context for where-clause evaluation once to avoid re-creation
+	// on each decision invocation.
+	ruleCtx := authCtx.RuleContext()
+
+	// perform access-control decision. all cert authorities can be considered as being "root" resources from
+	// the perspective of scoped RBAC, so we just hard-code root as the resource scope for the decision.
+	if err := decisionFn(ctx, scopes.Root, func(checker *services.SplitAccessChecker) error {
+		return checker.Common().CheckAccessToRules(&ruleCtx, types.KindCertAuthority, verbs...)
+	}); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/auth/trust/trustv1/service_test.go b/lib/auth/trust/trustv1/service_test.go
index 639b464788b03..b555b373d24ca 100644
--- a/lib/auth/trust/trustv1/service_test.go
+++ b/lib/auth/trust/trustv1/service_test.go
@@ -32,12 +32,14 @@ import (
 
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils/slices"
 )
 
 type testPack struct {
@@ -78,6 +80,14 @@ func (f *fakeAuthorizer) Authorize(ctx context.Context) (*authz.Context, error)
 	}, nil
 }
 
+func (f *fakeAuthorizer) AuthorizeScoped(ctx context.Context) (*authz.ScopedContext, error) {
+	authzCtx, err := f.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return authz.ScopedContextFromUnscopedContext(authzCtx), nil
+}
+
 type fakeAuthServer struct {
 	clusterName          types.ClusterName
 	generateHostCertData map[string]struct {
@@ -112,6 +122,10 @@ func (f *fakeAuthServer) UpdateTrustedCluster(ctx context.Context, tc types.Trus
 	return tc, nil
 }
 
+func (f *fakeAuthServer) ListTrustedClusters(ctx context.Context, limit int, start string) ([]types.TrustedCluster, string, error) {
+	return nil, "", nil
+}
+
 type fakeChecker struct {
 	services.AccessChecker
 	allow  map[check]bool
@@ -259,6 +273,26 @@ func TestRBAC(t *testing.T) {
 					},
 				},
 			},
+			expectChecks: []check{
+				{types.KindCertAuthority, types.VerbList}, // scoped access-checker interface halts on first disallowed verb
+			},
+		},
+		{
+			desc: "get authorities no read access",
+			f: func(t *testing.T, service *Service) {
+				_, err := service.GetCertAuthorities(ctx, &trustpb.GetCertAuthoritiesRequest{
+					Type: string(ca.GetType()),
+				})
+
+				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
+			},
+			authorizer: fakeAuthorizer{
+				checker: &fakeChecker{
+					allow: map[check]bool{
+						{types.KindCertAuthority, types.VerbList}: true,
+					},
+				},
+			},
 			expectChecks: []check{
 				{types.KindCertAuthority, types.VerbList},
 				{types.KindCertAuthority, types.VerbReadNoSecrets},
@@ -423,10 +457,11 @@ func TestRBAC(t *testing.T) {
 
 			trust := local.NewCAService(p.mem)
 			cfg := &ServiceConfig{
-				Cache:      trust,
-				Backend:    trust,
-				Authorizer: &test.authorizer,
-				AuthServer: &fakeAuthServer{},
+				Cache:            trust,
+				Backend:          trust,
+				Authorizer:       &test.authorizer,
+				ScopedAuthorizer: &test.authorizer,
+				AuthServer:       &fakeAuthServer{},
 			}
 
 			service, err := NewService(cfg)
@@ -457,10 +492,11 @@ func TestGetCertAuthority(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: &fakeAuthServer{},
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       &fakeAuthServer{},
 	}
 
 	service, err := NewService(cfg)
@@ -494,12 +530,21 @@ func TestGetCertAuthority(t *testing.T) {
 			},
 			assertion: func(t *testing.T, authority types.CertAuthority, err error) {
 				require.NoError(t, err)
-				require.Empty(t, cmp.Diff(authority, ca,
+
+				// SSHKeyPair has an Equal() method, so we can't use cmpopts.IgnoreField
+				// to suppress checking the PrivateKey field. Instead, we craft a comparison
+				// target by copying the target CA and deleting the SSHKeyPair.PrivateKey
+				// field values
+				caWithoutSecrets := utils.CloneProtoMsg(ca.(*types.CertAuthorityV2))
+				for _, sshKeyPair := range caWithoutSecrets.Spec.ActiveKeys.SSH {
+					sshKeyPair.PrivateKey = nil
+				}
+				require.Empty(t, cmp.Diff(authority, caWithoutSecrets,
 					cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-					cmpopts.IgnoreFields(types.SSHKeyPair{}, "PrivateKey"),
 					cmpopts.IgnoreFields(types.TLSKeyPair{}, "Key"),
 					cmpopts.IgnoreFields(types.JWTKeyPair{}, "PrivateKey"),
 				))
+
 				keys := authority.GetActiveKeys()
 				require.Nil(t, keys.TLS[0].Key)
 				require.Nil(t, keys.SSH[0].PrivateKey)
@@ -546,10 +591,11 @@ func TestGetCertAuthorities(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: &fakeAuthServer{},
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       &fakeAuthServer{},
 	}
 
 	service, err := NewService(cfg)
@@ -587,9 +633,20 @@ func TestGetCertAuthorities(t *testing.T) {
 			},
 			assertion: func(t *testing.T, resp *trustpb.GetCertAuthoritiesResponse, err error) {
 				require.NoError(t, err)
-				require.Empty(t, cmp.Diff(expectedCAs, resp.CertAuthoritiesV2,
+
+				// SSHKeyPair has an Equal() method, so we can't use cmpopts.IgnoreField
+				// to suppress checking the PrivateKey field. Instead, we craft a comparison
+				// target by copying the target CAs and deleting the SSHKeyPair.PrivateKey
+				// field values
+				expectedWithoutSecrets := slices.Map(expectedCAs, utils.CloneProtoMsg)
+				for _, ca := range expectedWithoutSecrets {
+					for _, sshKeyPair := range ca.Spec.ActiveKeys.SSH {
+						sshKeyPair.PrivateKey = nil
+					}
+				}
+
+				require.Empty(t, cmp.Diff(expectedWithoutSecrets, resp.CertAuthoritiesV2,
 					cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-					cmpopts.IgnoreFields(types.SSHKeyPair{}, "PrivateKey"),
 					cmpopts.IgnoreFields(types.TLSKeyPair{}, "Key"),
 					cmpopts.IgnoreFields(types.JWTKeyPair{}, "PrivateKey"),
 				))
@@ -640,10 +697,11 @@ func TestDeleteCertAuthority(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: &fakeAuthServer{},
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       &fakeAuthServer{},
 	}
 
 	service, err := NewService(cfg)
@@ -714,10 +772,11 @@ func TestUpsertCertAuthority(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: &fakeAuthServer{},
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       &fakeAuthServer{},
 	}
 
 	service, err := NewService(cfg)
@@ -799,10 +858,11 @@ func TestRotateCertAuthority(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: authServer,
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       authServer,
 	}
 
 	tests := []struct {
@@ -956,6 +1016,9 @@ func TestRotateExternalCertAuthority(t *testing.T) {
 				Authorizer: &fakeAuthorizer{
 					authzCtx: test.authzCtx,
 				},
+				ScopedAuthorizer: &fakeAuthorizer{
+					authzCtx: test.authzCtx,
+				},
 				AuthServer: &fakeAuthServer{
 					clusterName: &types.ClusterNameV2{
 						Spec: types.ClusterNameSpecV2{
@@ -1006,10 +1069,11 @@ func TestGenerateHostCert(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: authorizer,
-		AuthServer: hostCertSigner,
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: authorizer,
+		AuthServer:       hostCertSigner,
 	}
 
 	tests := []struct {
diff --git a/lib/auth/trust/trustv1/trustedcluster.go b/lib/auth/trust/trustv1/trustedcluster.go
index 48f57a43ba0ec..9c59cdbee7ede 100644
--- a/lib/auth/trust/trustv1/trustedcluster.go
+++ b/lib/auth/trust/trustv1/trustedcluster.go
@@ -124,3 +124,34 @@ func (s *Service) UpdateTrustedCluster(ctx context.Context, req *trustpb.UpdateT
 	}
 	return trustedClusterV2, nil
 }
+
+// ListTrustedClusters returns a page of Trusted Cluster resources.
+func (s *Service) ListTrustedClusters(ctx context.Context, req *trustpb.ListTrustedClustersRequest) (*trustpb.ListTrustedClustersResponse, error) {
+	authCtx, err := s.authorizer.Authorize(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := authCtx.CheckAccessToKind(types.KindTrustedCluster, types.VerbList, types.VerbRead); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tcs, next, err := s.authServer.ListTrustedClusters(ctx, int(req.PageSize), req.PageToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp := &trustpb.ListTrustedClustersResponse{
+		TrustedClusters: make([]*types.TrustedClusterV2, 0, len(tcs)),
+		NextPageToken:   next,
+	}
+
+	for _, tc := range tcs {
+		trustedClusterV2, ok := tc.(*types.TrustedClusterV2)
+		if !ok {
+			return nil, trace.Errorf("encountered unexpected Trusted Cluster type: %T", tc)
+		}
+		resp.TrustedClusters = append(resp.TrustedClusters, trustedClusterV2)
+	}
+
+	return resp, nil
+}
diff --git a/lib/auth/trust/trustv1/trustedcluster_test.go b/lib/auth/trust/trustv1/trustedcluster_test.go
index d4aea850fedc4..f504ba01d81e9 100644
--- a/lib/auth/trust/trustv1/trustedcluster_test.go
+++ b/lib/auth/trust/trustv1/trustedcluster_test.go
@@ -29,6 +29,7 @@ import (
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services/local"
 )
 
@@ -41,16 +42,17 @@ func TestCloudProhibited(t *testing.T) {
 
 	trust := local.NewCAService(p.mem)
 	cfg := &ServiceConfig{
-		Cache:      trust,
-		Backend:    trust,
-		Authorizer: &fakeAuthorizer{},
-		AuthServer: &fakeAuthServer{},
+		Cache:            trust,
+		Backend:          trust,
+		Authorizer:       &fakeAuthorizer{},
+		ScopedAuthorizer: &fakeAuthorizer{},
+		AuthServer:       &fakeAuthServer{},
 	}
 
 	service, err := NewService(cfg)
 	require.NoError(t, err)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{Cloud: true},
 	})
 
@@ -260,16 +262,54 @@ func TestTrustedClusterRBAC(t *testing.T) {
 				{types.KindTrustedCluster, types.VerbUpdate},
 			},
 		},
+		{
+			desc: "list ok",
+			f: func(t *testing.T, service *Service) {
+				_, err := service.ListTrustedClusters(ctx, &trustpb.ListTrustedClustersRequest{})
+				require.NoError(t, err)
+			},
+			authorizer: fakeAuthorizer{
+				checker: &fakeChecker{
+					allow: map[check]bool{
+						{types.KindTrustedCluster, types.VerbRead}: true,
+						{types.KindTrustedCluster, types.VerbList}: true,
+					},
+				},
+			},
+			expectChecks: []check{
+				{types.KindTrustedCluster, types.VerbRead},
+				{types.KindTrustedCluster, types.VerbList},
+			},
+		},
+		{
+			desc: "list no access",
+			f: func(t *testing.T, service *Service) {
+				_, err := service.ListTrustedClusters(ctx, &trustpb.ListTrustedClustersRequest{})
+				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
+			},
+			authorizer: fakeAuthorizer{
+				checker: &fakeChecker{
+					allow: map[check]bool{
+						{types.KindTrustedCluster, types.VerbList}: true,
+					},
+				},
+			},
+			expectChecks: []check{
+				{types.KindTrustedCluster, types.VerbRead},
+				{types.KindTrustedCluster, types.VerbList},
+			},
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
 			trust := local.NewCAService(p.mem)
 			cfg := &ServiceConfig{
-				Cache:      trust,
-				Backend:    trust,
-				Authorizer: &test.authorizer,
-				AuthServer: &fakeAuthServer{},
+				Cache:            trust,
+				Backend:          trust,
+				Authorizer:       &test.authorizer,
+				ScopedAuthorizer: &test.authorizer,
+				AuthServer:       &fakeAuthServer{},
 			}
 
 			service, err := NewService(cfg)
diff --git a/lib/auth/trustedcluster.go b/lib/auth/trustedcluster.go
index 5026d33fbe45a..6d14f90dd9a74 100644
--- a/lib/auth/trustedcluster.go
+++ b/lib/auth/trustedcluster.go
@@ -159,7 +159,10 @@ func (a *Server) createTrustedCluster(ctx context.Context, tc types.TrustedClust
 	}
 
 	// Force name to the name of the trusted cluster.
-	tc.SetName(remoteCAs[0].GetClusterName())
+	if actualName := remoteCAs[0].GetClusterName(); actualName != tc.GetName() {
+		a.logger.WarnContext(ctx, "trusted cluster resource name did not match root cluster name. resource will be renamed. this will become an error in future versions, please update your configuration to match the root cluster name", "resource_name", tc.GetName(), "root_cluster_name", actualName)
+		tc.SetName(actualName)
+	}
 
 	// perform some configuration on the remote CAs
 	configureCAsForTrustedCluster(tc, remoteCAs)
@@ -617,7 +620,10 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *au
 	_, err = a.CreateRemoteClusterInternal(ctx, remoteCluster, []types.CertAuthority{remoteCA})
 	if err != nil {
 		if trace.IsAlreadyExists(err) {
-			return nil, trace.AlreadyExists("leaf cluster %q or a cert authority with the same name is already registered with this root cluster, if you are attempting to re-join try removing the existing "+types.KindRemoteCluster+" resource from the root cluster first", remoteClusterName)
+			// note that we deliberately suppress the AlreadyExists error here as this situation
+			// requires admin intervention and the direct caller is prevented by the trusted cluster
+			// security model from taking any corrective action.
+			return nil, trace.Errorf("leaf cluster name %q conflicts with an existing cluster or ca registered with root cluster %q, if re-joining remove the existing "+types.KindRemoteCluster+" resource from the root, if attempting to update check that the name of your resource matches the root cluster name", remoteClusterName, domainName)
 		}
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/trustedcluster_test.go b/lib/auth/trustedcluster_test.go
index 9f43193b561df..232d2e406c888 100644
--- a/lib/auth/trustedcluster_test.go
+++ b/lib/auth/trustedcluster_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -26,18 +26,23 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 func TestRemoteClusterStatus(t *testing.T) {
@@ -51,7 +56,7 @@ func TestRemoteClusterStatus(t *testing.T) {
 
 	// This scenario deals with only one remote cluster, so it never hits the limit on status updates.
 	// TestRefreshRemoteClusters focuses on verifying the update limit logic.
-	a.refreshRemoteClusters(ctx)
+	a.RefreshRemoteClusters(ctx)
 
 	wantRC := rc
 	// Initially, no tunnels exist and status should be "offline".
@@ -61,7 +66,7 @@ func TestRemoteClusterStatus(t *testing.T) {
 	require.Empty(t, cmp.Diff(wantRC, gotRC, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 
 	// Create several tunnel connections.
-	lastHeartbeat := a.clock.Now().UTC()
+	lastHeartbeat := a.GetClock().Now().UTC()
 	tc1, err := types.NewTunnelConnection("conn-1", types.TunnelConnectionSpecV2{
 		ClusterName:   rc.GetName(),
 		ProxyName:     "proxy-1",
@@ -81,7 +86,7 @@ func TestRemoteClusterStatus(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, a.UpsertTunnelConnection(tc2))
 
-	a.refreshRemoteClusters(ctx)
+	a.RefreshRemoteClusters(ctx)
 
 	// With active tunnels, the status is "online" and last_heartbeat is set to
 	// the latest tunnel heartbeat.
@@ -94,7 +99,7 @@ func TestRemoteClusterStatus(t *testing.T) {
 	// Delete the latest connection.
 	require.NoError(t, a.DeleteTunnelConnection(tc2.GetClusterName(), tc2.GetName()))
 
-	a.refreshRemoteClusters(ctx)
+	a.RefreshRemoteClusters(ctx)
 
 	// The status should remain the same, since tc1 still exists.
 	// The last_heartbeat should remain the same, since tc1 has an older
@@ -107,7 +112,7 @@ func TestRemoteClusterStatus(t *testing.T) {
 	// Delete the remaining connection
 	require.NoError(t, a.DeleteTunnelConnection(tc1.GetClusterName(), tc1.GetName()))
 
-	a.refreshRemoteClusters(ctx)
+	a.RefreshRemoteClusters(ctx)
 
 	// The status should switch to "offline".
 	// The last_heartbeat should remain the same.
@@ -120,9 +125,6 @@ func TestRemoteClusterStatus(t *testing.T) {
 func TestRefreshRemoteClusters(t *testing.T) {
 	ctx := context.Background()
 
-	remoteClusterRefreshLimit = 10
-	remoteClusterRefreshBuckets = 5
-
 	tests := []struct {
 		name               string
 		clustersTotal      int
@@ -160,6 +162,8 @@ func TestRefreshRemoteClusters(t *testing.T) {
 			require.LessOrEqual(t, tt.clustersNeedUpdate, tt.clustersTotal)
 
 			a := newTestAuthServer(ctx, t)
+			a.SetRemoteClusterRefreshLimit(10)
+			a.RemoteClusterRefreshBuckets(5)
 
 			allClusters := make(map[string]types.RemoteCluster)
 			for i := 0; i < tt.clustersTotal; i++ {
@@ -171,7 +175,7 @@ func TestRefreshRemoteClusters(t *testing.T) {
 				allClusters[rc.GetName()] = rc
 
 				if i < tt.clustersNeedUpdate {
-					lastHeartbeat := a.clock.Now().UTC()
+					lastHeartbeat := a.GetClock().Now().UTC()
 					tc, err := types.NewTunnelConnection(fmt.Sprintf("conn-%03d", i), types.TunnelConnectionSpecV2{
 						ClusterName:   rc.GetName(),
 						ProxyName:     fmt.Sprintf("proxy-%03d", i),
@@ -183,7 +187,7 @@ func TestRefreshRemoteClusters(t *testing.T) {
 				}
 			}
 
-			a.refreshRemoteClusters(ctx)
+			a.RefreshRemoteClusters(ctx)
 
 			clusters, err := a.GetRemoteClusters(ctx)
 			require.NoError(t, err)
@@ -206,11 +210,13 @@ func TestValidateTrustedCluster(t *testing.T) {
 	const validToken = "validtoken"
 	ctx := context.Background()
 
-	testAuth, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: localClusterName,
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
+
 	a := testAuth.AuthServer
 
 	tks, err := types.NewStaticTokens(types.StaticTokensSpecV2{
@@ -225,7 +231,7 @@ func TestValidateTrustedCluster(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("invalid cluster token", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: "invalidtoken",
 			CAs:   []types.CertAuthority{},
 		})
@@ -234,7 +240,7 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("missing CA", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs:   []types.CertAuthority{},
 		})
@@ -243,11 +249,11 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("more than one CA", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs: []types.CertAuthority{
-				suite.NewTestCA(types.HostCA, "rc1"),
-				suite.NewTestCA(types.HostCA, "rc2"),
+				authtest.NewTestCA(types.HostCA, "rc1"),
+				authtest.NewTestCA(types.HostCA, "rc2"),
 			},
 		})
 		require.Error(t, err)
@@ -255,10 +261,10 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("wrong CA type", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs: []types.CertAuthority{
-				suite.NewTestCA(types.UserCA, "rc3"),
+				authtest.NewTestCA(types.UserCA, "rc3"),
 			},
 		})
 		require.Error(t, err)
@@ -266,10 +272,10 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("wrong CA name", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs: []types.CertAuthority{
-				suite.NewTestCA(types.HostCA, localClusterName),
+				authtest.NewTestCA(types.HostCA, localClusterName),
 			},
 		})
 		require.Error(t, err)
@@ -285,10 +291,10 @@ func TestValidateTrustedCluster(t *testing.T) {
 		_, err = a.Services.UpsertTrustedCluster(ctx, trustedCluster)
 		require.NoError(t, err)
 
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs: []types.CertAuthority{
-				suite.NewTestCA(types.HostCA, trustedCluster.GetName()),
+				authtest.NewTestCA(types.HostCA, trustedCluster.GetName()),
 			},
 		})
 		require.Error(t, err)
@@ -296,8 +302,8 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("all CAs are returned when v10+", func(t *testing.T) {
-		leafClusterCA := types.CertAuthority(suite.NewTestCA(types.HostCA, "leafcluster-1"))
-		resp, err := a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		leafClusterCA := types.CertAuthority(authtest.NewTestCA(types.HostCA, "leafcluster-1"))
+		resp, err := a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token:           validToken,
 			CAs:             []types.CertAuthority{leafClusterCA},
 			TeleportVersion: teleport.Version,
@@ -362,17 +368,17 @@ func TestValidateTrustedCluster(t *testing.T) {
 		require.Equal(t, localClusterName, osshCAs[0].GetName())
 
 		// verify that we reject an attempt to re-register the leaf cluster
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs:   []types.CertAuthority{leafClusterCA},
 		})
 		require.Error(t, err)
-		require.Contains(t, err.Error(), "already registered")
+		require.Contains(t, err.Error(), "conflicts with an existing cluster or ca")
 	})
 
 	t.Run("Host User and Database CA are returned by default", func(t *testing.T) {
-		leafClusterCA := types.CertAuthority(suite.NewTestCA(types.HostCA, "leafcluster-2"))
-		resp, err := a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		leafClusterCA := types.CertAuthority(authtest.NewTestCA(types.HostCA, "leafcluster-2"))
+		resp, err := a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token:           validToken,
 			CAs:             []types.CertAuthority{leafClusterCA},
 			TeleportVersion: "",
@@ -387,7 +393,7 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 
 	t.Run("Cloud prohibits adding leaf clusters", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestFeatures: modules.Features{Cloud: true},
 		})
 
@@ -396,16 +402,16 @@ func TestValidateTrustedCluster(t *testing.T) {
 			CAs:   []types.CertAuthority{},
 		}
 
-		server := ServerWithRoles{authServer: a}
+		server := auth.NewServerWithRoles(a, events.NewDiscardAuditLog(), authz.Context{})
 		_, err := server.ValidateTrustedCluster(ctx, req)
 		require.True(t, trace.IsNotImplemented(err), "ValidateTrustedCluster returned an unexpected error, got = %v (%T), want trace.NotImplementedError", err, err)
 	})
 
 	t.Run("CA cluster name does not match subject organization", func(t *testing.T) {
-		_, err = a.validateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
+		_, err = a.ValidateTrustedCluster(ctx, &authclient.ValidateTrustedClusterRequest{
 			Token: validToken,
 			CAs: []types.CertAuthority{
-				suite.NewTestCAWithConfig(suite.TestCAConfig{
+				authtest.NewTestCAWithConfig(authtest.TestCAConfig{
 					Type:                types.HostCA,
 					ClusterName:         "remoteCluster",
 					SubjectOrganization: "commonName",
@@ -417,7 +423,7 @@ func TestValidateTrustedCluster(t *testing.T) {
 	})
 }
 
-func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *Server {
+func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *auth.Server {
 	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
 
@@ -430,14 +436,15 @@ func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *Serve
 		ClusterName: clusterName,
 	})
 	require.NoError(t, err)
-	authConfig := &InitConfig{
+	authConfig := &auth.InitConfig{
 		ClusterName:            clusterNameRes,
 		Backend:                bk,
-		VersionStorage:         NewFakeTeleportVersion(),
+		VersionStorage:         authtest.NewFakeTeleportVersion(),
 		Authority:              authority.New(),
 		SkipPeriodicOperations: true,
+		HostUUID:               uuid.NewString(),
 	}
-	a, err := NewServer(authConfig)
+	a, err := auth.NewServer(authConfig)
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
@@ -457,11 +464,13 @@ func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *Serve
 
 func TestUpsertTrustedCluster(t *testing.T) {
 	ctx := context.Background()
-	testAuth, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "localcluster",
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
+
 	a := testAuth.AuthServer
 
 	const validToken = "validtoken"
@@ -495,14 +504,14 @@ func TestUpsertTrustedCluster(t *testing.T) {
 	trustedCluster, err := types.NewTrustedCluster("trustedcluster", trustedClusterSpec)
 	require.NoError(t, err)
 
-	ca := suite.NewTestCA(types.UserCA, "trustedcluster")
+	ca := authtest.NewTestCA(types.UserCA, "trustedcluster")
 
-	configureCAsForTrustedCluster(trustedCluster, []types.CertAuthority{ca})
+	auth.ConfigureCAsForTrustedCluster(trustedCluster, []types.CertAuthority{ca})
 
 	_, err = a.Services.CreateTrustedCluster(ctx, trustedCluster, []types.CertAuthority{ca})
 	require.NoError(t, err)
 
-	err = a.createReverseTunnel(ctx, trustedCluster)
+	err = a.CreateReverseTunnel(ctx, trustedCluster)
 	require.NoError(t, err)
 
 	t.Run("Invalid role change", func(t *testing.T) {
@@ -595,11 +604,12 @@ func TestUpsertTrustedCluster(t *testing.T) {
 
 func TestUpdateTrustedCluster(t *testing.T) {
 	ctx := context.Background()
-	testAuth, err := NewTestAuthServer(TestAuthServerConfig{
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "localcluster",
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
 	a := testAuth.AuthServer
 
 	const validToken = "validtoken"
@@ -634,14 +644,14 @@ func TestUpdateTrustedCluster(t *testing.T) {
 	trustedCluster, err := types.NewTrustedCluster(testClusterName, trustedClusterSpec)
 	require.NoError(t, err)
 
-	ca := suite.NewTestCA(types.UserCA, testClusterName)
+	ca := authtest.NewTestCA(types.UserCA, testClusterName)
 
-	configureCAsForTrustedCluster(trustedCluster, []types.CertAuthority{ca})
+	auth.ConfigureCAsForTrustedCluster(trustedCluster, []types.CertAuthority{ca})
 
 	_, err = a.Services.CreateTrustedCluster(ctx, trustedCluster, []types.CertAuthority{ca})
 	require.NoError(t, err)
 
-	err = a.createReverseTunnel(ctx, trustedCluster)
+	err = a.CreateReverseTunnel(ctx, trustedCluster)
 	require.NoError(t, err)
 
 	t.Run("Invalid role change", func(t *testing.T) {
diff --git a/lib/auth/usage_test.go b/lib/auth/usage_test.go
index 04c07c49816eb..1740c268070bf 100644
--- a/lib/auth/usage_test.go
+++ b/lib/auth/usage_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	eventstest "github.com/gravitational/teleport/lib/events/test"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -75,7 +76,7 @@ func TestAccessRequest_WithAndWithoutLimit(t *testing.T) {
 
 	// Lift limit, expect no limit error.
 	s.features.Entitlements[entitlements.AccessRequests] = modules.EntitlementInfo{Enabled: true, Limit: 0}
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: s.features,
 	})
 	_, err = s.testpack.a.CreateAccessRequestV2(ctx, req, tlsca.Identity{})
@@ -83,7 +84,7 @@ func TestAccessRequest_WithAndWithoutLimit(t *testing.T) {
 
 	// Put back limit, expect limit error.
 	s.features.Entitlements[entitlements.AccessRequests] = modules.EntitlementInfo{Enabled: true, Limit: 1}
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: s.features,
 	})
 	_, err = s.testpack.a.CreateAccessRequestV2(ctx, req, tlsca.Identity{})
@@ -113,7 +114,7 @@ func setUpAccessRequestLimitForJulyAndAugust(t *testing.T, username string, role
 	features := modules.GetModules().Features()
 	features.IsUsageBasedBilling = true
 	features.Entitlements[entitlements.AccessRequests] = modules.EntitlementInfo{Limit: monthlyLimit, Enabled: true}
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: features,
 	})
 
diff --git a/lib/auth/userloginstate/generator.go b/lib/auth/userloginstate/generator.go
index fc7498fb16a66..87fcd4dbdfe7f 100644
--- a/lib/auth/userloginstate/generator.go
+++ b/lib/auth/userloginstate/generator.go
@@ -22,12 +22,15 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"maps"
+	"slices"
+	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport/api/client/proto"
-	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	"github.com/gravitational/teleport/api/constants"
 	usageeventsv1 "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
@@ -35,6 +38,7 @@ import (
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/accesslists"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/modules"
@@ -132,18 +136,13 @@ func NewGenerator(config GeneratorConfig) (*Generator, error) {
 	}, nil
 }
 
-// Generate will generate the user login state for the given user.
-func (g *Generator) Generate(ctx context.Context, user types.User, ulsService services.UserLoginStates) (*userloginstate.UserLoginState, error) {
-	return g.generate(ctx, user, ulsService, false)
-}
-
 // GeneratePureULS is a variant of user login state generation that emits no usage events and ignores any existing user login state
 // in the backend. Used for auditing/introspection purposes.
 func (g *Generator) GeneratePureULS(ctx context.Context, user types.User) (*userloginstate.UserLoginState, error) {
 	return g.generate(ctx, user, nil, true)
 }
 
-// generate is the underlying implementation for Generate and GeneratePure.
+// Generate will generate the user login state for the given user.
 func (g *Generator) generate(ctx context.Context, user types.User, ulsService services.UserLoginStates, pure bool) (*userloginstate.UserLoginState, error) {
 	var originalTraits map[string][]string
 	var traits map[string][]string
@@ -165,6 +164,22 @@ func (g *Generator) generate(ctx context.Context, user types.User, ulsService se
 		}
 	}
 
+	var samlIdentities []userloginstate.ExternalIdentity
+	if !pure {
+		connector := user.GetCreatedBy().Connector
+		if connector != nil && connector.Type == constants.SAML {
+			samlIdentities = []userloginstate.ExternalIdentity{
+				{
+					ConnectorID:   connector.ID,
+					UserID:        connector.Identity,
+					Username:      connector.Identity,
+					GrantedRoles:  slices.Clone(user.GetRoles()),
+					GrantedTraits: maps.Clone(traits),
+				},
+			}
+		}
+	}
+
 	// Create a new empty user login state.
 	uls, err := userloginstate.New(
 		header.Metadata{
@@ -177,6 +192,7 @@ func (g *Generator) generate(ctx context.Context, user types.User, ulsService se
 			Traits:         traits,
 			UserType:       user.GetUserType(),
 			GitHubIdentity: githubIdentity,
+			SAMLIdentities: samlIdentities,
 		})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -189,8 +205,7 @@ func (g *Generator) generate(ctx context.Context, user types.User, ulsService se
 	}
 
 	if !pure {
-		// Preserve states like GitHub identities across logins.
-		if err := UpdatePreservedAttributes(ctx, uls, ulsService); err != nil {
+		if err := updatePreservedAttributes(ctx, uls, ulsService); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -212,140 +227,129 @@ func (g *Generator) generate(ctx context.Context, user types.User, ulsService se
 
 // addAccessListsToState will add the user's applicable access lists to the user login state after validating them, returning any inherited roles and traits.
 func (g *Generator) addAccessListsToState(ctx context.Context, user types.User, state *userloginstate.UserLoginState) (inheritedRoles []string, inheritedTraits map[string][]string, err error) {
-	accessLists, err := g.accessLists.GetAccessLists(ctx)
+	locks, err := clientutils.CollectWithFallback(
+		ctx,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return g.accessLists.ListLocks(ctx, limit, start, &types.LockFilter{
+				InForceOnly: true,
+				Targets:     []*types.LockTarget{{User: user.GetName()}},
+			})
+		},
+		func(ctx context.Context) ([]types.Lock, error) {
+			// TODO(okraport): DELETE IN v21
+			const inForceOnlyTrue = true
+			return g.accessLists.GetLocks(ctx, inForceOnlyTrue, types.LockTarget{
+				User: user.GetName(),
+			})
+		},
+	)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
+	if len(locks) > 0 {
+		return inheritedRoles, inheritedTraits, nil
+	}
 
 	var allInheritedRoles []string
 	allInheritedTraits := make(map[string][]string)
-
-	for _, accessList := range accessLists {
-		// Grants are inherited if the user is a member of the access list, explicitly or via inheritance.
-		inheritedRoles, inheritedTraits, err := g.handleAccessListMembership(ctx, user, accessList, state)
+	applyHierarchy := func(hierarchy []*accesslist.AccessList, accessListName string, ownerHierarchy bool) error {
+		if len(hierarchy) == 0 {
+			return nil
+		}
+		inheritedRoles, inheritedTraits, err := g.applyGrantsAcrossACLs(ctx, hierarchy, accessListName, user, state, ownerHierarchy)
 		if err != nil {
-			return nil, nil, trace.Wrap(err)
+			return trace.Wrap(err)
 		}
 		allInheritedRoles = append(allInheritedRoles, inheritedRoles...)
 		for k, values := range inheritedTraits {
 			allInheritedTraits[k] = append(allInheritedTraits[k], values...)
 		}
+		return nil
+	}
 
-		// OwnerGrants are inherited if the user is an owner of the access list, explicitly or via inheritance.
-		inheritedRoles, inheritedTraits, err = g.handleAccessListOwnership(ctx, user, accessList, state)
+	h, err := accesslists.NewHierarchy(accesslists.HierarchyConfig{
+		AccessListsService: g.accessLists,
+		Clock:              g.clock,
+	})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	for acl, err := range clientutils.Resources(ctx, g.accessLists.ListAccessLists) {
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-		allInheritedRoles = append(allInheritedRoles, inheritedRoles...)
-		for k, values := range inheritedTraits {
-			allInheritedTraits[k] = append(allInheritedTraits[k], values...)
+		memberOf, ownerOf, err := h.GetHierarchyForUser(ctx, acl, user)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		// Grants are inherited if the user is a member of the access list, explicitly or via inheritance.
+		if err := applyHierarchy(memberOf, acl.GetName(), false); err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		// OwnerGrants are inherited if the user is an owner of the access list, explicitly or via inheritance.
+		if err := applyHierarchy(ownerOf, acl.GetName(), true); err != nil {
+			return nil, nil, trace.Wrap(err)
 		}
 	}
-
 	return allInheritedRoles, allInheritedTraits, nil
 }
 
-// handleAccessListMembership validates the access list and applies the grants and traits from the access list to the user if they are a member of the access list.
-// If the access list is invalid (because it references a non-existent role, for example,
-// then it will not be applied.
-func (g *Generator) handleAccessListMembership(ctx context.Context, user types.User, accessList *accesslist.AccessList, state *userloginstate.UserLoginState) ([]string, map[string][]string, error) {
-	var inheritedRoles []string
-	inheritedTraits := make(map[string][]string)
-
-	membershipKind, err := accesslists.IsAccessListMember(ctx, user, accessList, g.accessLists, g.accessLists, g.clock)
-	// Return early if there was an error or the user isn't a member of the access list.
-	if err != nil || membershipKind == accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED {
-		// Log any error besides user being locked.
-		if err != nil && !accesslists.IsUserLocked(err) {
-			g.log.WarnContext(ctx, "checking access list membership", "error", err)
+func (g *Generator) applyGrantsAcrossACLs(ctx context.Context, acls []*accesslist.AccessList, baseName string, user types.User, state *userloginstate.UserLoginState, owner bool) (inheritedRoles []string, inheritedTraits map[string][]string, err error) {
+	inheritedTraits = make(map[string][]string)
+	for _, acl := range acls {
+		grants := selectGrants(acl, owner)
+		missing, err := g.identifyMissingRoles(ctx, grants.Roles)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
 		}
-		return inheritedRoles, inheritedTraits, nil
-	}
-
-	// Validate that all the roles in the access list exist.
-	missingRoles, err := g.identifyMissingRoles(ctx, accessList.Spec.Grants.Roles)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	// If there are any missing roles, then we cannot apply the access list.
-	// Emit an audit event and return early.
-	// This flow is designed to skip the entire access list rather than processing individual roles within it.
-	// This approach ensures that access lists are treated as cohesive units of access control. Partial
-	// application of an access list could result in unintended permission configurations, potentially leading
-	// to security vulnerabilities or unpredictable behavior.
-	if missingRoles != nil {
-		g.emitSkippedAccessListEvent(ctx, accessList.Spec.Title, missingRoles, user.GetName())
-		return nil, nil, nil
-	}
-
-	g.grantRolesAndTraits(accessList.Spec.Grants, state)
-	if membershipKind == accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED {
-		inheritedRoles = append(inheritedRoles, accessList.Spec.Grants.Roles...)
-		for k, values := range accessList.Spec.Grants.Traits {
+		if len(missing) > 0 {
+			// If there are any missing roles, then we cannot apply the access list.
+			// Emit an audit event and skip the access list.
+			// This flow is designed to skip the entire access list rather than processing individual roles within it.
+			// This approach ensures that access lists are treated as cohesive units of access control. Partial
+			// application of an access list could result in unintended permission configurations, potentially leading
+			// to security vulnerabilities or unpredictable behavior.
+			g.emitSkippedAccessListEvent(ctx, acl.Spec.Title, missing, user.GetName())
+			continue
+		}
+		g.grantRolesAndTraits(grants, state)
+		if acl.GetName() == baseName {
+			continue
+		}
+		inheritedRoles = append(inheritedRoles, grants.Roles...)
+		for k, values := range grants.Traits {
 			inheritedTraits[k] = append(inheritedTraits[k], values...)
 		}
 	}
-
 	return inheritedRoles, inheritedTraits, nil
 }
 
-// handleAccessListOwnership validates the access list and applies the grants and traits from the access list to the user if they are an owner of the access list.
-// If the access list is invalid (because it references a non-existent role, for example,
-// then it will not be applied.
-func (g *Generator) handleAccessListOwnership(ctx context.Context, user types.User, accessList *accesslist.AccessList, state *userloginstate.UserLoginState) ([]string, map[string][]string, error) {
-	var inheritedRoles []string
-	inheritedTraits := make(map[string][]string)
-
-	ownershipType, err := accesslists.IsAccessListOwner(ctx, user, accessList, g.accessLists, g.accessLists, g.clock)
-	// Return early if there was an error or the user isn't an owner of the access list.
-	if err != nil || ownershipType == accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_UNSPECIFIED {
-		// Log any error besides user being locked.
-		if err != nil && !accesslists.IsUserLocked(err) {
-			g.log.WarnContext(ctx, "checking access list ownership", "error", err)
-		}
-		return inheritedRoles, inheritedTraits, nil
-	}
-
-	// Validate that all the roles in the access list exist.
-	missingRoles, err := g.identifyMissingRoles(ctx, accessList.Spec.OwnerGrants.Roles)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	// If there are any missing roles, then we cannot apply the access list.
-	// Emit an audit event and return early.
-	// This flow is designed to skip the entire access list rather than processing individual roles within it.
-	// This approach ensures that access lists are treated as cohesive units of access control. Partial
-	// application of an access list could result in unintended permission configurations, potentially leading
-	// to security vulnerabilities or unpredictable behavior.
-	if missingRoles != nil {
-		g.emitSkippedAccessListEvent(ctx, accessList.Spec.Title, missingRoles, user.GetName())
-		return nil, nil, nil
-	}
-
-	g.grantRolesAndTraits(accessList.Spec.OwnerGrants, state)
-	if ownershipType == accesslistv1.AccessListUserAssignmentType_ACCESS_LIST_USER_ASSIGNMENT_TYPE_INHERITED {
-		inheritedRoles = append(inheritedRoles, accessList.Spec.OwnerGrants.Roles...)
-		for k, values := range accessList.Spec.OwnerGrants.Traits {
-			inheritedTraits[k] = append(inheritedTraits[k], values...)
-		}
+func selectGrants(acl *accesslist.AccessList, owner bool) accesslist.Grants {
+	if owner {
+		return acl.Spec.OwnerGrants
 	}
-
-	return inheritedRoles, inheritedTraits, nil
+	return acl.Spec.Grants
 }
 
 // grantRolesAndTraits will append the roles and traits from the provided Grants to the UserLoginState,
 // returning inherited roles and traits if AccessListUserAssignmentType is inherited.
 func (g *Generator) grantRolesAndTraits(grants accesslist.Grants, state *userloginstate.UserLoginState) {
 	state.Spec.Roles = append(state.Spec.Roles, grants.Roles...)
+	state.Spec.AccessListRoles = append(state.Spec.AccessListRoles, grants.Roles...)
 
-	if state.Spec.Traits == nil && len(grants.Traits) > 0 {
-		state.Spec.Traits = map[string][]string{}
+	if len(grants.Traits) > 0 {
+		if state.Spec.Traits == nil {
+			state.Spec.Traits = map[string][]string{}
+		}
+		if state.Spec.AccessListTraits == nil {
+			state.Spec.AccessListTraits = map[string][]string{}
+		}
 	}
 
 	for k, values := range grants.Traits {
 		state.Spec.Traits[k] = append(state.Spec.Traits[k], values...)
+		state.Spec.AccessListTraits[k] = append(state.Spec.AccessListTraits[k], values...)
 	}
 }
 
@@ -356,6 +360,10 @@ func (g *Generator) postProcess(ctx context.Context, state *userloginstate.UserL
 	for k, v := range state.Spec.Traits {
 		state.Spec.Traits[k] = utils.Deduplicate(v)
 	}
+	state.Spec.AccessListRoles = utils.Deduplicate(state.Spec.AccessListRoles)
+	for k, v := range state.Spec.AccessListTraits {
+		state.Spec.AccessListTraits[k] = utils.Deduplicate(v)
+	}
 
 	// If there are no roles, don't bother filtering out non-existent roles
 	if len(state.Spec.Roles) == 0 {
@@ -430,38 +438,61 @@ func (g *Generator) emitUsageEvent(ctx context.Context, user types.User, state *
 	return nil
 }
 
-// UpdatePreservedAttributes retrieves attributes that can be preserved in user
-// login state cross logins.
-func UpdatePreservedAttributes(ctx context.Context, user services.UserState, ulsService services.UserLoginStates) error {
-	// Use the new/existing GitHubIdentities.
-	// TODO(greedy52) implement a way to remove the identity or find a way to
-	// avoid keeping the identity forever in user login state.
-	if len(user.GetGithubIdentities()) > 0 {
+// updatePreservedAttributes that should be preserved in user login state across logins.
+func updatePreservedAttributes(ctx context.Context, uls *userloginstate.UserLoginState, ulsService services.UserLoginStates) error {
+	existingULS, err := ulsService.GetUserLoginState(ctx, uls.GetName())
+	if trace.IsNotFound(err) {
 		return nil
+	} else if err != nil {
+		return trace.Wrap(err)
+	}
+	if len(uls.GetGithubIdentities()) == 0 {
+		uls.SetGithubIdentities(existingULS.GetGithubIdentities())
 	}
+	// We need to preserve SAML identity as user may log in using another auth connector and
+	// overwrite roles and traits mapped from the previous connector. The information about
+	// other connectors may be needed to calculate access to provider-specific resources like
+	// Okta. See https://github.com/gravitational/teleport.e/pull/7168.
+	preserveSAMLIdentities(uls, existingULS)
+	return nil
+}
 
-	// Find the old state if exists.
-	old, err := ulsService.GetUserLoginState(ctx, user.GetName())
-	if err != nil {
-		if trace.IsNotFound(err) {
-			return nil
+// preserveSAMLIdentities merges SAML identities from u2 to u1.
+func preserveSAMLIdentities(dst, src *userloginstate.UserLoginState) {
+	ids1 := dst.Spec.SAMLIdentities
+	ids2 := src.Spec.SAMLIdentities
+
+	for _, id2 := range ids2 {
+		ok := slices.ContainsFunc(ids1, func(id1 userloginstate.ExternalIdentity) bool {
+			return id1.ConnectorID == id2.ConnectorID
+		})
+		if !ok {
+			ids1 = append(ids1, id2)
 		}
-		return trace.Wrap(err)
 	}
+	slices.SortFunc(ids1, func(x, y userloginstate.ExternalIdentity) int {
+		return strings.Compare(x.ConnectorID, y.ConnectorID)
+	})
 
-	if githubIdentities := old.GetGithubIdentities(); len(githubIdentities) > 0 {
-		user.SetGithubIdentities(githubIdentities)
-	}
-	return nil
+	dst.Spec.SAMLIdentities = ids1
 }
 
 // Refresh will take the user and update the user login state in the backend.
 func (g *Generator) Refresh(ctx context.Context, user types.User, ulsService services.UserLoginStates) (*userloginstate.UserLoginState, error) {
-	uls, err := g.Generate(ctx, user, ulsService)
+	uls, err := g.generate(ctx, user, ulsService, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	// Set the full state directly on the user object.
+	// We cannot rely Upsert/Get User login state because the next webhook that calls GetUserLogin
+	// might receive stale data.
+	// Instead of using Upsert/Get calls to pass the object through the login hooks chain,
+	// the login hook updates the user object directly.
+	// TODO(smallinsky): Consider removing the user login state approach entirely, as it currently only mirrors the user state.
+	user.SetRoles(uls.GetRoles())
+	user.SetTraits(uls.GetTraits())
+
 	uls, err = ulsService.UpsertUserLoginState(ctx, uls)
 	return uls, trace.Wrap(err)
 }
diff --git a/lib/auth/userloginstate/generator_bench_test.go b/lib/auth/userloginstate/generator_bench_test.go
new file mode 100644
index 0000000000000..7df5635aa0f0f
--- /dev/null
+++ b/lib/auth/userloginstate/generator_bench_test.go
@@ -0,0 +1,110 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package userloginstate
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/accesslist"
+	"github.com/gravitational/teleport/api/types/header"
+)
+
+func BenchmarkGenerate(b *testing.B) {
+	user, err := types.NewUser("alice")
+	if err != nil {
+		b.Fatalf("NewUser: %v", err)
+	}
+
+	accessList, err := makeAccessList("acl")
+	if err != nil {
+		b.Fatalf("makeAccessList: %v", err)
+	}
+
+	sizes := []int{100, 1_000, 10_000}
+	for _, n := range sizes {
+		b.Run(fmt.Sprintf("members=%d", n), func(b *testing.B) {
+			svc, backendSvc, err := initGeneratorSvc()
+			if err != nil {
+				b.Fatalf("initGeneratorSvc: %v", err)
+			}
+			_, err = backendSvc.UpsertAccessList(b.Context(), accessList)
+			if err != nil {
+				b.Fatalf("UpsertAccessList: %v", err)
+			}
+
+			for i := 0; i < n; i++ {
+				member := makeUserMember(accessList.GetName(), fmt.Sprintf("u%d", i))
+				_, err = backendSvc.UpsertAccessListMember(b.Context(), member)
+				if err != nil {
+					b.Fatalf("UpsertAccessListMember: %v", err)
+				}
+			}
+
+			b.ReportAllocs()
+			b.ResetTimer()
+
+			for b.Loop() {
+				_, err := svc.generate(b.Context(), user, backendSvc, false /* pure */)
+				if err != nil {
+					b.Fatalf("Generate: %v", err)
+				}
+			}
+		})
+	}
+}
+
+func makeAccessList(name string) (*accesslist.AccessList, error) {
+	accessList, err := accesslist.NewAccessList(header.Metadata{
+		Name: name,
+	}, accesslist.Spec{
+		Title: "title",
+		Audit: accesslist.Audit{
+			NextAuditDate: clockwork.NewRealClock().Now().Add(time.Hour * 48),
+		},
+		Owners: []accesslist.Owner{{Name: ownerUser}},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return accessList, nil
+}
+
+func makeUserMember(acl, username string) *accesslist.AccessListMember {
+	m := &accesslist.AccessListMember{
+		ResourceHeader: header.ResourceHeader{
+			Metadata: header.Metadata{
+				Name: username,
+			},
+		},
+		Spec: accesslist.AccessListMemberSpec{
+			Name:           username,
+			AccessList:     acl,
+			MembershipKind: accesslist.MembershipKindUser,
+			Joined:         clockwork.NewRealClock().Now(),
+			AddedBy:        "system",
+		},
+	}
+	return m
+}
diff --git a/lib/auth/userloginstate/generator_test.go b/lib/auth/userloginstate/generator_test.go
index a263297c416c9..1db3f2c16a93d 100644
--- a/lib/auth/userloginstate/generator_test.go
+++ b/lib/auth/userloginstate/generator_test.go
@@ -20,11 +20,13 @@ package userloginstate
 
 import (
 	"context"
+	"slices"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
@@ -39,9 +41,10 @@ import (
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const ownerUser = "owner"
@@ -99,8 +102,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1"},
-				trait.Traits{"otrait1": {"value1", "value2"}},
+				nil,
+				nil,
 			),
 			expectedRoleCount:           0,
 			expectedTraitCount:          0,
@@ -130,8 +133,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "role1", "role2"},
-				trait.Traits{"otrait1": {"value1", "value2"}, "trait1": {"value1", "value2"}, "trait2": {"value3"}},
+				[]string{"role1", "role2"},
+				trait.Traits{"trait1": {"value1", "value2"}, "trait2": {"value3"}},
 			),
 			expectedRoleCount:           2,
 			expectedTraitCount:          3,
@@ -164,8 +167,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1"},
-				trait.Traits{"otrait1": []string{"value1", "value2"}},
+				nil,
+				nil,
 			),
 			expectedRoleCount:           0,
 			expectedTraitCount:          0,
@@ -195,8 +198,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "role1", "role2"},
-				trait.Traits{"otrait1": {"value1", "value2"}, "trait1": {"value1", "value2"}, "trait2": {"value3"}},
+				[]string{"role1", "role2"},
+				trait.Traits{"trait1": {"value1", "value2"}, "trait2": {"value3"}},
 			),
 			expectedRoleCount:           0,
 			expectedTraitCount:          0,
@@ -225,8 +228,8 @@ func TestAccessLists(t *testing.T) {
 				nil,
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "owner-role1", "owner-role2"},
-				trait.Traits{"otrait1": {"value1", "value2"}, "owner-trait1": {"owner-value1"}},
+				[]string{"owner-role1", "owner-role2"},
+				trait.Traits{"owner-trait1": {"owner-value1"}},
 			),
 			expectedRoleCount:           2,
 			expectedTraitCount:          1,
@@ -255,8 +258,8 @@ func TestAccessLists(t *testing.T) {
 				nil,
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "owner-role1", "owner-role2", "role1"},
-				trait.Traits{"otrait1": {"value1", "value2"}, "trait1": {"owner-value1", "value1"}},
+				[]string{"owner-role1", "owner-role2", "role1"},
+				trait.Traits{"trait1": {"owner-value1", "value1"}},
 			),
 			expectedRoleCount:           3,
 			expectedTraitCount:          2,
@@ -286,10 +289,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "role1"},
-				trait.Traits{
-					"otrait1": {"value1", "value2"}, "trait1": {"value1"},
-				},
+				[]string{"role1"},
+				trait.Traits{"trait1": {"value1"}},
 			),
 			expectedRoleCount:           1,
 			expectedTraitCount:          1,
@@ -314,8 +315,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1", "role1", "role2", "role3"},
-				trait.Traits{"otrait1": {"value1", "value2"}},
+				[]string{"role1", "role2", "role3"},
+				nil,
 			),
 			expectedRoleCount:           3,
 			expectedTraitCount:          0,
@@ -350,8 +351,8 @@ func TestAccessLists(t *testing.T) {
 				},
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
-				[]string{"orole1"},
-				trait.Traits{"otrait1": {"value1", "value2"}, "trait1": {"value1", "value2"}, "trait2": {"value3", "value4", "value1"}, "trait3": {"value5", "value6"}},
+				nil,
+				trait.Traits{"trait1": {"value1", "value2"}, "trait2": {"value3", "value4", "value1"}, "trait3": {"value5", "value6"}},
 			),
 			expectedRoleCount:           0,
 			expectedTraitCount:          7,
@@ -529,6 +530,34 @@ func TestAccessLists(t *testing.T) {
 			expectedInheritedRoleCount:  1,
 			expectedInheritedTraitCount: 1,
 		},
+		{
+			name:  "one level nested ownership inheritance chain",
+			cloud: true,
+			user:  userNoRolesOrTraits,
+			// user is member of acl child that is configured as owner of acl root
+			accessLists: []*accesslist.AccessList{
+				newAccessList(t, clock, "child", emptyGrants, accesslist.Grants{}),
+				newAccessListWithOwners(t, clock, "root", emptyGrants, grants([]string{"roleRoot"}, nil), []accesslist.Owner{{
+					Name:           "child",
+					MembershipKind: accesslist.MembershipKindList},
+				}),
+			},
+
+			members: newAccessListMembers(t, clock, "child", "user"),
+			roles:   []string{"roleRoot"},
+			wantErr: require.NoError,
+			expected: newUserLoginState(t, "user",
+				nil,
+				nil,
+				nil,
+				[]string{"roleRoot"},
+				nil,
+			),
+			expectedRoleCount:           1,
+			expectedTraitCount:          0,
+			expectedInheritedRoleCount:  1,
+			expectedInheritedTraitCount: 0,
+		},
 		{
 			name:  "an access list that references a non-existent role should be skipped entirely",
 			user:  user,
@@ -554,9 +583,9 @@ func TestAccessLists(t *testing.T) {
 				[]string{"orole1"},
 				trait.Traits{"otrait1": {"value1", "value2"}},
 				// only role1 will be granted by the access lists, since role2 comes from an invalid access list.
-				[]string{"orole1", "role1"},
+				[]string{"role1"},
 				// traits from the invalid access list won't be granted.
-				trait.Traits{"otrait1": {"value1", "value2"}, "trait1": {"value1"}},
+				trait.Traits{"trait1": {"value1"}},
 			),
 			expectedRoleCount:           1,
 			expectedTraitCount:          1,
@@ -567,7 +596,7 @@ func TestAccessLists(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: modules.BuildEnterprise,
 				TestFeatures: modules.Features{
 					Cloud: test.cloud,
@@ -578,7 +607,8 @@ func TestAccessLists(t *testing.T) {
 			})
 
 			ctx := context.Background()
-			svc, backendSvc := initGeneratorSvc(t)
+			svc, backendSvc, err := initGeneratorSvc()
+			require.NoError(t, err)
 
 			for _, accessList := range test.accessLists {
 				_, err = backendSvc.UpsertAccessList(ctx, accessList)
@@ -601,7 +631,7 @@ func TestAccessLists(t *testing.T) {
 				require.NoError(t, backendSvc.UpsertLock(ctx, lock))
 			}
 
-			state, err := svc.Generate(ctx, test.user, backendSvc)
+			state, err := svc.generate(ctx, test.user, backendSvc, false /* pure */)
 			test.wantErr(t, err)
 
 			if err != nil {
@@ -631,7 +661,8 @@ func TestAccessLists(t *testing.T) {
 
 func TestGitHubIdentity(t *testing.T) {
 	ctx := context.Background()
-	svc, backendSvc := initGeneratorSvc(t)
+	svc, backendSvc, err := initGeneratorSvc()
+	require.NoError(t, err)
 
 	noGitHubIdentity, err := types.NewUser("alice")
 	require.NoError(t, err)
@@ -690,7 +721,7 @@ func TestGitHubIdentity(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			uls, err := svc.Generate(ctx, test.user, backendSvc)
+			uls, err := svc.generate(ctx, test.user, backendSvc, false /* pure */)
 			require.NoError(t, err)
 			require.Equal(t, test.expectGitHubIdentity, uls.Spec.GitHubIdentity)
 
@@ -714,20 +745,24 @@ func (s *svc) SubmitUsageEvent(ctx context.Context, req *proto.SubmitUsageEventR
 	return nil
 }
 
-func initGeneratorSvc(t *testing.T) (*Generator, *svc) {
-	t.Helper()
-
+func initGeneratorSvc() (*Generator, *svc, error) {
 	clock := clockwork.NewFakeClock()
 	mem, err := memory.New(memory.Config{
 		Clock: clock,
 	})
-	require.NoError(t, err)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
 
 	accessListsSvc, err := local.NewAccessListService(mem, clock)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
 	accessSvc := local.NewAccessService(mem)
 	ulsService, err := local.NewUserLoginStateService(mem)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
 
 	svc := &svc{
 		AccessLists:     accessListsSvc,
@@ -738,15 +773,17 @@ func initGeneratorSvc(t *testing.T) (*Generator, *svc) {
 	emitter := &eventstest.MockRecorderEmitter{}
 
 	generator, err := NewGenerator(GeneratorConfig{
-		Log:         utils.NewSlogLoggerForTests(),
+		Log:         logtest.NewLogger(),
 		AccessLists: svc,
 		Access:      svc,
 		UsageEvents: svc,
 		Clock:       clock,
 		Emitter:     emitter,
 	})
-	require.NoError(t, err)
-	return generator, svc
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return generator, svc, nil
 }
 
 func grants(roles []string, traits trait.Traits) accesslist.Grants {
@@ -854,18 +891,37 @@ func newAccessListMemberWithKind(t *testing.T, clock clockwork.Clock, accessList
 	return res
 }
 
-func newUserLoginState(t *testing.T, name string, labels map[string]string, originalRoles []string, originalTraits map[string][]string,
-	roles []string, traits map[string][]string) *userloginstate.UserLoginState {
+func newUserLoginState(t *testing.T,
+	name string, labels map[string]string,
+	originalRoles []string, originalTraits map[string][]string,
+	accessListRoles []string, accessListTraits map[string][]string,
+) *userloginstate.UserLoginState {
 	t.Helper()
 
+	roles := append(originalRoles, accessListRoles...)
+	slices.Sort(roles)
+	roles = slices.Compact(roles)
+
+	var traits map[string][]string
+	if len(originalTraits) == 0 {
+		traits = accessListTraits
+	} else {
+		traits = trait.Traits(originalTraits).Clone()
+		trait.Merge(traits, accessListTraits)
+	}
+	trait.Merge(traits, originalTraits)
+	trait.Merge(traits, accessListTraits)
+
 	uls, err := userloginstate.New(header.Metadata{
 		Name:   name,
 		Labels: labels,
 	}, userloginstate.Spec{
-		OriginalRoles:  originalRoles,
-		OriginalTraits: originalTraits,
-		Roles:          roles,
-		Traits:         traits,
+		OriginalRoles:    originalRoles,
+		OriginalTraits:   originalTraits,
+		AccessListRoles:  accessListRoles,
+		AccessListTraits: accessListTraits,
+		Roles:            roles,
+		Traits:           traits,
 	})
 	require.NoError(t, err)
 
diff --git a/lib/auth/userprovisioning/userprovisioningv2/service_test.go b/lib/auth/userprovisioning/userprovisioningv2/service_test.go
index 1978c20cae14d..56f41575bb5c8 100644
--- a/lib/auth/userprovisioning/userprovisioningv2/service_test.go
+++ b/lib/auth/userprovisioning/userprovisioningv2/service_test.go
@@ -126,7 +126,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 			},
 		}
 
-		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User")))
+		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User", "UserRoles")))
 
 	case <-time.After(15 * time.Second):
 		t.Fatalf("timed out waiting for static host user create event")
@@ -156,7 +156,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 			},
 		}
 
-		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User")))
+		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User", "UserRoles")))
 	case <-time.After(15 * time.Second):
 		t.Fatalf("timed out waiting for static host user update event")
 	}
@@ -184,7 +184,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 			},
 		}
 
-		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User")))
+		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User", "UserRoles")))
 	case <-time.After(15 * time.Second):
 		t.Fatalf("timed out waiting for static host user upsert event")
 	}
@@ -212,7 +212,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 			},
 		}
 
-		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User")))
+		require.Empty(t, cmp.Diff(expectedEvent, evt, cmpopts.IgnoreFields(apievents.UserMetadata{}, "User", "UserRoles")))
 	case <-time.After(15 * time.Second):
 		t.Fatalf("timed out waiting for static host user delete event")
 	}
diff --git a/lib/auth/users/usersv1/service.go b/lib/auth/users/usersv1/service.go
index fa22a20c71446..0cba041b425ff 100644
--- a/lib/auth/users/usersv1/service.go
+++ b/lib/auth/users/usersv1/service.go
@@ -224,6 +224,10 @@ func (s *Service) CreateUser(ctx context.Context, req *userspb.CreateUserRequest
 		return nil, trace.Wrap(err)
 	}
 
+	if len(req.User.GetName()) > teleport.MaxUsernameLength {
+		return nil, trace.BadParameter("username exceeds maximum length of %d characters", teleport.MaxUsernameLength)
+	}
+
 	if err := authCtx.CheckAccessToKind(types.KindUser, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/users/usersv1/service_test.go b/lib/auth/users/usersv1/service_test.go
index c93a8e6b73174..55c1c1d3356ae 100644
--- a/lib/auth/users/usersv1/service_test.go
+++ b/lib/auth/users/usersv1/service_test.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"encoding/base32"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
 
@@ -249,6 +250,18 @@ func TestCreateUser(t *testing.T) {
 	assert.Equal(t, "alice", createEvent.UserMetadata.User)
 }
 
+func TestCreateUserMaxLength(t *testing.T) {
+	t.Parallel()
+	env, err := newTestEnv()
+	require.NoError(t, err, "creating test service")
+
+	user, err := types.NewUser(strings.Repeat("A", 1001))
+	require.NoError(t, err)
+	user.AddRole("access")
+	_, err = env.CreateUser(t.Context(), &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+	require.Error(t, err, "creating a user with a username too long should fail")
+}
+
 func TestDeleteUser(t *testing.T) {
 	t.Parallel()
 	env, err := newTestEnv()
diff --git a/lib/auth/usertoken.go b/lib/auth/usertoken.go
index ddd68b3e76bd3..5f11a72950981 100644
--- a/lib/auth/usertoken.go
+++ b/lib/auth/usertoken.go
@@ -33,10 +33,12 @@ import (
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -75,7 +77,7 @@ func (a *Server) CreateResetPasswordToken(ctx context.Context, req authclient.Cr
 		return nil, trace.Wrap(err)
 	}
 
-	token, err := a.newUserToken(req)
+	token, err := a.newUserToken(ctx, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -123,19 +125,23 @@ func (a *Server) resetMFA(ctx context.Context, user string) error {
 
 // proxyDomainGetter is a reduced subset of the Auth API for formatAccountName.
 type proxyDomainGetter interface {
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+	ListProxyServers(context.Context, int, string) ([]types.Server, string, error)
 	GetDomainName() (string, error)
 }
 
 // formatAccountName builds the account name to display in OTP applications.
 // Format for accountName is user@address. User is passed in, this function
 // tries to find the best available address.
-func formatAccountName(s proxyDomainGetter, username string, authHostname string) (string, error) {
+func formatAccountName(ctx context.Context, s proxyDomainGetter, username string, authHostname string) (string, error) {
 	var err error
 	var proxyHost string
 
 	// Get a list of proxies.
-	proxies, err := s.GetProxies()
+	proxies, err := stream.Collect(clientutils.Resources(ctx, s.ListProxyServers))
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -190,10 +196,9 @@ func (a *Server) createTOTPUserTokenSecrets(ctx context.Context, token types.Use
 	return secrets, nil
 }
 
-func (a *Server) newTOTPKey(user string) (*otp.Key, *totp.GenerateOpts, error) {
-	ctx := context.TODO()
+func (a *Server) newTOTPKey(ctx context.Context, user string) (*otp.Key, *totp.GenerateOpts, error) {
 	// Fetch account name to display in OTP apps.
-	accountName, err := formatAccountName(a, user, a.AuthServiceName)
+	accountName, err := formatAccountName(ctx, a, user, a.AuthServiceName)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -216,7 +221,7 @@ func (a *Server) newTOTPKey(user string) (*otp.Key, *totp.GenerateOpts, error) {
 	return key, &opts, nil
 }
 
-func (a *Server) newUserToken(req authclient.CreateUserTokenRequest) (types.UserToken, error) {
+func (a *Server) newUserToken(ctx context.Context, req authclient.CreateUserTokenRequest) (types.UserToken, error) {
 	var err error
 	var proxyHost string
 
@@ -232,7 +237,7 @@ func (a *Server) newUserToken(req authclient.CreateUserTokenRequest) (types.User
 
 	// Get the list of proxies and try and guess the address of the proxy. If
 	// failed to guess public address, use "<proxyhost>:3080" as a fallback.
-	proxies, err := a.GetProxies()
+	proxies, err := stream.Collect(clientutils.Resources(ctx, a.ListProxyServers))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -287,17 +292,17 @@ func formatUserTokenURL(proxyHost string, tokenID string, reqType string) (strin
 
 // deleteUserTokens deletes all user tokens for the specified user.
 func (a *Server) deleteUserTokens(ctx context.Context, username string) error {
-	tokens, err := a.GetUserTokens(ctx)
+	userTokens, err := stream.Collect(clientutils.Resources(ctx, a.ListUserTokens))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	for _, token := range tokens {
+	for _, token := range userTokens {
 		if token.GetUser() != username {
 			continue
 		}
 
-		err = a.DeleteUserToken(ctx, token.GetName())
+		err := a.DeleteUserToken(ctx, token.GetName())
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -340,7 +345,7 @@ func (a *Server) createRecoveryToken(ctx context.Context, username, tokenType st
 		return nil, trace.Wrap(err)
 	}
 
-	newToken, err := a.newUserToken(req)
+	newToken, err := a.newUserToken(ctx, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -421,7 +426,7 @@ func (a *Server) createPrivilegeToken(ctx context.Context, username, tokenKind s
 		return nil, trace.Wrap(err)
 	}
 
-	newToken, err := a.newUserToken(req)
+	newToken, err := a.newUserToken(ctx, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/usertoken_test.go b/lib/auth/usertoken_test.go
index ad3b622cc0f00..b1ae3216082cd 100644
--- a/lib/auth/usertoken_test.go
+++ b/lib/auth/usertoken_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package auth_test
 
 import (
 	"context"
@@ -37,10 +37,14 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	wanpb "github.com/gravitational/teleport/api/types/webauthn"
+	clientutils "github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -48,7 +52,7 @@ func TestCreateResetPasswordToken(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 
 	// Configure cluster and user for MFA, registering various devices.
 	mfa := configureForMFA(t, srv)
@@ -77,7 +81,7 @@ func TestCreateResetPasswordToken(t *testing.T) {
 	require.Empty(t, devs)
 
 	// verify that password was reset
-	err = srv.Auth().checkPasswordWOToken(ctx, username, []byte(pass))
+	err = srv.Auth().CheckPasswordWOToken(ctx, username, []byte(pass))
 	require.Error(t, err)
 
 	// create another reset token for the same user
@@ -85,10 +89,10 @@ func TestCreateResetPasswordToken(t *testing.T) {
 	require.NoError(t, err)
 
 	// previous token must be deleted
-	tokens, err := srv.Auth().GetUserTokens(ctx)
+	userTokens, err := stream.Collect(clientutils.Resources(ctx, srv.Auth().ListUserTokens))
 	require.NoError(t, err)
-	require.Len(t, tokens, 1)
-	require.Equal(t, tokens[0].GetName(), token.GetName())
+	require.Len(t, userTokens, 1)
+	require.Equal(t, userTokens[0].GetName(), token.GetName())
 }
 
 func TestCreateResetPasswordTokenErrors(t *testing.T) {
@@ -97,7 +101,7 @@ func TestCreateResetPasswordTokenErrors(t *testing.T) {
 	ctx := context.Background()
 
 	username := "joe@example.com"
-	_, _, err := CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
+	_, _, err := authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
 	type testCase struct {
@@ -217,7 +221,7 @@ func TestFormatAccountName(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			accountName, err := formatAccountName(tt.inDebugAuth, "foo", "00000000-0000-0000-0000-000000000000")
+			accountName, err := auth.FormatAccountName(tt.inDebugAuth, "foo", "00000000-0000-0000-0000-000000000000")
 			tt.outError(t, err)
 			require.Equal(t, accountName, tt.outAccountName)
 		})
@@ -229,7 +233,7 @@ func TestUserTokenSecretsCreationSettings(t *testing.T) {
 	srv := newTestTLSServer(t)
 
 	username := "joe@example.com"
-	_, _, err := CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
+	_, _, err := authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
 	ctx := context.Background()
@@ -261,9 +265,10 @@ func TestUserTokenSecretsCreationSettings(t *testing.T) {
 func TestUserTokenCreationSettings(t *testing.T) {
 	t.Parallel()
 	srv := newTestTLSServer(t)
+	ctx := t.Context()
 
 	username := "joe@example.com"
-	_, _, err := CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
+	_, _, err := authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
 	req := authclient.CreateUserTokenRequest{
@@ -272,7 +277,7 @@ func TestUserTokenCreationSettings(t *testing.T) {
 		Type: authclient.UserTokenTypeResetPasswordInvite,
 	}
 
-	token, err := srv.Auth().newUserToken(req)
+	token, err := srv.Auth().NewUserToken(ctx, req)
 	require.NoError(t, err)
 	require.Equal(t, req.Name, token.GetUser())
 	require.Equal(t, req.Type, token.GetSubKind())
@@ -286,14 +291,14 @@ func TestCreatePrivilegeToken(t *testing.T) {
 	srv := newTestTLSServer(t)
 	fakeClock := srv.Clock().(*clockwork.FakeClock)
 	mockEmitter := &eventstest.MockRecorderEmitter{}
-	srv.Auth().emitter = mockEmitter
+	srv.Auth().SetEmitter(mockEmitter)
 	ctx := context.Background()
 
 	// Create a user and client with identity.
 	username := "joe@example.com"
-	_, _, err := CreateUserAndRoleWithoutRoles(srv.Auth(), username, []string{username})
+	_, _, err := authtest.CreateUserAndRoleWithoutRoles(srv.Auth(), username, []string{username})
 	require.NoError(t, err)
-	clt, err := srv.NewClient(TestUser(username))
+	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
 	// Test a failure when second factor isn't enabled.
@@ -417,9 +422,9 @@ func TestCreatePrivilegeToken_WithLock(t *testing.T) {
 
 			// Create a user and client with identity.
 			username := fmt.Sprintf("llama%v@goteleport.com", rand.Int())
-			_, _, err := CreateUserAndRoleWithoutRoles(srv.Auth(), username, []string{username})
+			_, _, err := authtest.CreateUserAndRoleWithoutRoles(srv.Auth(), username, []string{username})
 			require.NoError(t, err)
-			clt, err := srv.NewClient(TestUser(username))
+			clt, err := srv.NewClient(authtest.TestUser(username))
 			require.NoError(t, err)
 
 			// Test lock from max failed auth attempts.
@@ -429,9 +434,9 @@ func TestCreatePrivilegeToken_WithLock(t *testing.T) {
 
 				// Test last attempt returns locked error.
 				if i == defaults.MaxLoginAttempts {
-					require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
+					require.Equal(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 				} else {
-					require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
+					require.NotEqual(t, auth.MaxFailedAttemptsErrMsg, err.Error())
 				}
 			}
 
@@ -457,6 +462,13 @@ func (s *debugAuth) GetProxies() ([]types.Server, error) {
 	return s.proxies, nil
 }
 
+func (s *debugAuth) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	if s.proxiesError {
+		return nil, "", trace.BadParameter("failed to fetch proxies")
+	}
+	return s.proxies, "", nil
+}
+
 func (s *debugAuth) GetDomainName() (string, error) {
 	if s.clusterName == "" {
 		return "", trace.NotFound("no cluster name set")
diff --git a/lib/auth/vnetconfig/vnetconfigv1/events.go b/lib/auth/vnetconfig/vnetconfigv1/events.go
new file mode 100644
index 0000000000000..352738d8bda89
--- /dev/null
+++ b/lib/auth/vnetconfig/vnetconfigv1/events.go
@@ -0,0 +1,90 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package vnetconfigv1
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/authz"
+	libevents "github.com/gravitational/teleport/lib/events"
+)
+
+func newCreateAuditEvent(ctx context.Context, status apievents.Status) apievents.AuditEvent {
+	return &apievents.VnetConfigCreate{
+		Metadata: apievents.Metadata{
+			Code: libevents.VnetConfigCreateCode,
+			Type: libevents.VnetConfigCreateEvent,
+		},
+		UserMetadata:       authz.ClientUserMetadata(ctx),
+		ConnectionMetadata: authz.ConnectionMetadata(ctx),
+		Status:             status,
+	}
+}
+
+func newUpdateAuditEvent(ctx context.Context, status apievents.Status) apievents.AuditEvent {
+	return &apievents.VnetConfigUpdate{
+		Metadata: apievents.Metadata{
+			Code: libevents.VnetConfigUpdateCode,
+			Type: libevents.VnetConfigUpdateEvent,
+		},
+		UserMetadata:       authz.ClientUserMetadata(ctx),
+		ConnectionMetadata: authz.ConnectionMetadata(ctx),
+		Status:             status,
+	}
+}
+
+func newDeleteAuditEvent(ctx context.Context, status apievents.Status) apievents.AuditEvent {
+	return &apievents.VnetConfigDelete{
+		Metadata: apievents.Metadata{
+			Code: libevents.VnetConfigDeleteCode,
+			Type: libevents.VnetConfigDeleteEvent,
+		},
+		UserMetadata:       authz.ClientUserMetadata(ctx),
+		ConnectionMetadata: authz.ConnectionMetadata(ctx),
+		Status:             status,
+	}
+}
+
+// emitAuditEvent wraps emitting audit events and logs failures.
+func (s *Service) emitAuditEvent(ctx context.Context, evt apievents.AuditEvent) {
+	if err := s.emitter.EmitAuditEvent(ctx, evt); err != nil {
+		s.logger.ErrorContext(ctx, "Failed to emit audit event",
+			"event_code", evt.GetCode(),
+			"event_type", evt.GetType(),
+			"error", err,
+		)
+	}
+}
+
+func eventStatus(err error) apievents.Status {
+	var errorMessage, userMessage string
+	if err != nil {
+		errorMessage = err.Error()
+		userMessage = trace.UserMessage(err)
+	}
+
+	return apievents.Status{
+		Success:     err == nil,
+		Error:       errorMessage,
+		UserMessage: userMessage,
+	}
+}
diff --git a/lib/auth/vnetconfig/vnetconfigv1/service.go b/lib/auth/vnetconfig/vnetconfigv1/service.go
index c64609e7470b1..5ab78b1ce46c6 100644
--- a/lib/auth/vnetconfig/vnetconfigv1/service.go
+++ b/lib/auth/vnetconfig/vnetconfigv1/service.go
@@ -19,17 +19,32 @@
 package vnetconfigv1
 
 import (
+	"cmp"
 	"context"
+	"log/slog"
 
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/services"
 )
 
+// ServiceConfig holds configuration options for VNet service.
+type ServiceConfig struct {
+	// Authorizer is the authorizer used to check access to resources.
+	Authorizer authz.Authorizer
+	// Emitter is used to send audit events in response to processing requests.
+	Emitter apievents.Emitter
+	// Storage is used to store VNet configs.
+	Storage services.VnetConfigService
+	// Logger is the slog logger.
+	Logger *slog.Logger
+}
+
 // Service implements the gRPC API layer for the singleton VnetConfig resource.
 type Service struct {
 	// Opting out of forward compatibility, this service must implement all service methods.
@@ -37,14 +52,27 @@ type Service struct {
 
 	storage    services.VnetConfigService
 	authorizer authz.Authorizer
+	emitter    apievents.Emitter
+	logger     *slog.Logger
 }
 
-// NewService returns a new VnetConfig API service using the given storage layer and authorizer.
-func NewService(storage services.VnetConfigService, authorizer authz.Authorizer) *Service {
-	return &Service{
-		storage:    storage,
-		authorizer: authorizer,
+// NewService returns a new VnetConfig API service.
+func NewService(cfg ServiceConfig) (*Service, error) {
+	if cfg.Authorizer == nil {
+		return nil, trace.BadParameter("authorizer is required for vnet config service")
+	}
+	if cfg.Storage == nil {
+		return nil, trace.BadParameter("storage is required for vnet config service")
+	}
+	if cfg.Emitter == nil {
+		return nil, trace.BadParameter("emitter is required for vnet config service")
 	}
+	return &Service{
+		authorizer: cfg.Authorizer,
+		storage:    cfg.Storage,
+		emitter:    cfg.Emitter,
+		logger:     cmp.Or(cfg.Logger, slog.Default()),
+	}, nil
 }
 
 // GetVnetConfig returns the singleton VnetConfig resource.
@@ -82,7 +110,12 @@ func (s *Service) CreateVnetConfig(ctx context.Context, req *vnet.CreateVnetConf
 	}
 
 	vnetConfig, err := s.storage.CreateVnetConfig(ctx, req.VnetConfig)
-	return vnetConfig, trace.Wrap(err)
+	status := eventStatus(err)
+	s.emitAuditEvent(ctx, newCreateAuditEvent(ctx, status))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return vnetConfig, nil
 }
 
 // UpdateVnetConfig updates a VnetConfig resource.
@@ -101,7 +134,12 @@ func (s *Service) UpdateVnetConfig(ctx context.Context, req *vnet.UpdateVnetConf
 	}
 
 	vnetConfig, err := s.storage.UpdateVnetConfig(ctx, req.VnetConfig)
-	return vnetConfig, trace.Wrap(err)
+	status := eventStatus(err)
+	s.emitAuditEvent(ctx, newUpdateAuditEvent(ctx, status))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return vnetConfig, nil
 }
 
 // UpsertVnetConfig does basic validation and upserts a VnetConfig resource.
@@ -121,7 +159,12 @@ func (s *Service) UpsertVnetConfig(ctx context.Context, req *vnet.UpsertVnetConf
 	}
 
 	vnetConfig, err := s.storage.UpsertVnetConfig(ctx, req.VnetConfig)
-	return vnetConfig, trace.Wrap(err)
+	status := eventStatus(err)
+	s.emitAuditEvent(ctx, newCreateAuditEvent(ctx, status))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return vnetConfig, nil
 }
 
 // DeleteVnetConfig deletes the singleton VnetConfig resource.
@@ -139,7 +182,10 @@ func (s *Service) DeleteVnetConfig(ctx context.Context, _ *vnet.DeleteVnetConfig
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.storage.DeleteVnetConfig(ctx); err != nil {
+	err = s.storage.DeleteVnetConfig(ctx)
+	status := eventStatus(err)
+	s.emitAuditEvent(ctx, newDeleteAuditEvent(ctx, status))
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &emptypb.Empty{}, nil
diff --git a/lib/auth/vnetconfig/vnetconfigv1/service_test.go b/lib/auth/vnetconfig/vnetconfigv1/service_test.go
index 7bffb42c0df1c..4fda5e0d7c76a 100644
--- a/lib/auth/vnetconfig/vnetconfigv1/service_test.go
+++ b/lib/auth/vnetconfig/vnetconfigv1/service_test.go
@@ -32,8 +32,10 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/utils"
@@ -57,6 +59,7 @@ func TestServiceAccess(t *testing.T) {
 		allowedVerbs  []string
 		allowedStates []authz.AdminActionAuthState
 		action        func(*Service) error
+		requireEvent  apievents.AuditEvent
 	}
 	testCases := []testCase{
 		{
@@ -71,6 +74,7 @@ func TestServiceAccess(t *testing.T) {
 				_, err := service.CreateVnetConfig(ctx, &vnet.CreateVnetConfigRequest{VnetConfig: vnetConfig})
 				return trace.Wrap(err)
 			},
+			requireEvent: &apievents.VnetConfigCreate{},
 		},
 		{
 			name: "UpdateVnetConfig",
@@ -87,6 +91,7 @@ func TestServiceAccess(t *testing.T) {
 				_, err := service.UpdateVnetConfig(ctx, &vnet.UpdateVnetConfigRequest{VnetConfig: vnetConfig})
 				return trace.Wrap(err)
 			},
+			requireEvent: &apievents.VnetConfigUpdate{},
 		},
 		{
 			name: "DeleteVnetConfig",
@@ -103,6 +108,7 @@ func TestServiceAccess(t *testing.T) {
 				_, err := service.DeleteVnetConfig(ctx, &vnet.DeleteVnetConfigRequest{})
 				return trace.Wrap(err)
 			},
+			requireEvent: &apievents.VnetConfigDelete{},
 		},
 		{
 			name: "UpsertVnetConfig",
@@ -116,6 +122,7 @@ func TestServiceAccess(t *testing.T) {
 				_, err := service.UpsertVnetConfig(ctx, &vnet.UpsertVnetConfigRequest{VnetConfig: vnetConfig})
 				return trace.Wrap(err)
 			},
+			requireEvent: &apievents.VnetConfigCreate{},
 		},
 		{
 			name: "UpsertVnetConfig with existing",
@@ -132,6 +139,7 @@ func TestServiceAccess(t *testing.T) {
 				_, err := service.UpsertVnetConfig(ctx, &vnet.UpsertVnetConfigRequest{VnetConfig: vnetConfig})
 				return trace.Wrap(err)
 			},
+			requireEvent: &apievents.VnetConfigCreate{},
 		},
 		{
 			name: "GetVnetConfig",
@@ -158,13 +166,20 @@ func TestServiceAccess(t *testing.T) {
 					t.Run(stateToString(state), func(t *testing.T) {
 						for _, verbs := range utils.Combinations(tc.allowedVerbs) {
 							t.Run(fmt.Sprintf("verbs=%v", verbs), func(t *testing.T) {
-								service := newService(t, state, fakeChecker{allowedVerbs: verbs})
+								service, emitter := newService(t, state, fakeChecker{allowedVerbs: verbs})
 								err := tc.action(service)
 								// expect access denied except with full set of verbs.
 								if len(verbs) == len(tc.allowedVerbs) {
 									require.NoError(t, err, trace.DebugReport(err))
+									if tc.requireEvent != nil {
+										got := emitter.LastEvent()
+										require.NotNil(t, got, "expected an audit event to be emitted")
+										require.IsType(t, tc.requireEvent, got)
+										require.True(t, eventStatusSuccess(t, got), "expected audit event status success to be true")
+									}
 								} else {
 									require.True(t, trace.IsAccessDenied(err), "expected access denied for verbs %v, got err=%v", verbs, err)
+									require.Empty(t, emitter.Events(), "expected no audit events on access denied")
 								}
 							})
 						}
@@ -179,16 +194,17 @@ func TestServiceAccess(t *testing.T) {
 					t.Run(stateToString(state), func(t *testing.T) {
 						// it is enough to test against tc.allowedVerbs,
 						// this is the only different data point compared to the test cases above.
-						service := newService(t, state, fakeChecker{allowedVerbs: tc.allowedVerbs})
+						service, emitter := newService(t, state, fakeChecker{allowedVerbs: tc.allowedVerbs})
 						err := tc.action(service)
 						require.True(t, trace.IsAccessDenied(err))
+						require.Empty(t, emitter.Events(), "expected no audit events on access denied")
 					})
 				}
 			})
 
 			// test the method with storage-layer errors
 			t.Run("storage error", func(t *testing.T) {
-				service := newServiceWithStorage(t, tc.allowedStates[0],
+				service, _ := newServiceWithStorage(t, tc.allowedStates[0],
 					fakeChecker{allowedVerbs: tc.allowedVerbs}, badStorage{})
 				err := tc.action(service)
 				// the returned error should wrap the unexpected storage-layer error.
@@ -210,6 +226,22 @@ func TestServiceAccess(t *testing.T) {
 	})
 }
 
+func eventStatusSuccess(t *testing.T, evt apievents.AuditEvent) bool {
+	t.Helper()
+
+	switch e := evt.(type) {
+	case *apievents.VnetConfigCreate:
+		return e.Status.Success
+	case *apievents.VnetConfigUpdate:
+		return e.Status.Success
+	case *apievents.VnetConfigDelete:
+		return e.Status.Success
+	default:
+		t.Fatalf("unexpected audit event type %T", evt)
+	}
+	return false
+}
+
 var allAdminStates = map[authz.AdminActionAuthState]string{
 	authz.AdminActionAuthUnauthorized:         "Unauthorized",
 	authz.AdminActionAuthNotRequired:          "NotRequired",
@@ -252,7 +284,7 @@ func (f fakeChecker) CheckAccessToRule(_ services.RuleContext, _ string, resourc
 	return trace.AccessDenied("access denied to rule=%v/verb=%v", resource, verb)
 }
 
-func newService(t *testing.T, authState authz.AdminActionAuthState, checker services.AccessChecker) *Service {
+func newService(t *testing.T, authState authz.AdminActionAuthState, checker services.AccessChecker) (*Service, *eventstest.MockRecorderEmitter) {
 	t.Helper()
 
 	bk, err := memory.New(memory.Config{})
@@ -264,9 +296,10 @@ func newService(t *testing.T, authState authz.AdminActionAuthState, checker serv
 	return newServiceWithStorage(t, authState, checker, storage)
 }
 
-func newServiceWithStorage(t *testing.T, authState authz.AdminActionAuthState, checker services.AccessChecker, storage services.VnetConfigService) *Service {
+func newServiceWithStorage(t *testing.T, authState authz.AdminActionAuthState, checker services.AccessChecker, storage services.VnetConfigService) (*Service, *eventstest.MockRecorderEmitter) {
 	t.Helper()
 
+	emitter := &eventstest.MockRecorderEmitter{}
 	authorizer := authz.AuthorizerFunc(func(ctx context.Context) (*authz.Context, error) {
 		user, err := types.NewUser("alice")
 		if err != nil {
@@ -279,7 +312,13 @@ func newServiceWithStorage(t *testing.T, authState authz.AdminActionAuthState, c
 		}, nil
 	})
 
-	return NewService(storage, authorizer)
+	service, err := NewService(ServiceConfig{
+		Authorizer: authorizer,
+		Storage:    storage,
+		Emitter:    emitter,
+	})
+	require.NoError(t, err)
+	return service, emitter
 }
 
 var errBadStorage = errors.New("bad storage")
diff --git a/lib/auth/webauthnwin/api.go b/lib/auth/webauthnwin/api.go
index 5d3cdcefe22e5..3ff51e2d97890 100644
--- a/lib/auth/webauthnwin/api.go
+++ b/lib/auth/webauthnwin/api.go
@@ -35,6 +35,7 @@ import (
 	"github.com/go-webauthn/webauthn/protocol/webauthncose"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 )
@@ -305,3 +306,8 @@ func Diag(ctx context.Context) (*DiagResult, error) {
 
 	return res, nil
 }
+
+// getPackageLogger returns a logger with component="WebAuthnWin".
+func getPackageLogger() *slog.Logger {
+	return slog.With(teleport.ComponentKey, "WebAuthnWin")
+}
diff --git a/lib/auth/webauthnwin/api_test.go b/lib/auth/webauthnwin/api_test.go
index 02158fd33159a..ef5c85f0e6897 100644
--- a/lib/auth/webauthnwin/api_test.go
+++ b/lib/auth/webauthnwin/api_test.go
@@ -178,6 +178,8 @@ func TestLogin(t *testing.T) {
 		},
 	}
 
+	const wantOptsVersion uint32 = 9
+
 	tests := []struct {
 		name        string
 		origin      string
@@ -191,10 +193,8 @@ func TestLogin(t *testing.T) {
 			origin:      origin,
 			assertionIn: func() *wantypes.CredentialAssertion { return okAssertion },
 			assertFn: func(t *testing.T, car *wanpb.CredentialAssertionResponse, req *getAssertionRequest) {
-				assert.Equal(t, uint32(6), req.opts.dwVersion)
-
+				assert.Equal(t, wantOptsVersion, req.opts.dwVersion)
 				assert.Equal(t, webauthnUserVerificationDiscouraged, req.opts.dwUserVerificationRequirement)
-
 				assert.Equal(t, webauthnAttachmentAny, req.opts.dwAuthenticatorAttachment)
 			},
 		},
@@ -208,10 +208,8 @@ func TestLogin(t *testing.T) {
 			},
 			opts: LoginOpts{AuthenticatorAttachment: AttachmentPlatform},
 			assertFn: func(t *testing.T, car *wanpb.CredentialAssertionResponse, req *getAssertionRequest) {
-				assert.Equal(t, uint32(6), req.opts.dwVersion)
-
+				assert.Equal(t, wantOptsVersion, req.opts.dwVersion)
 				assert.Equal(t, webauthnUserVerificationRequired, req.opts.dwUserVerificationRequirement)
-
 				assert.Equal(t, webauthnAttachmentPlatform, req.opts.dwAuthenticatorAttachment)
 			},
 		},
@@ -225,10 +223,8 @@ func TestLogin(t *testing.T) {
 			},
 			opts: LoginOpts{AuthenticatorAttachment: AttachmentCrossPlatform},
 			assertFn: func(t *testing.T, car *wanpb.CredentialAssertionResponse, req *getAssertionRequest) {
-				assert.Equal(t, uint32(6), req.opts.dwVersion)
-
+				assert.Equal(t, wantOptsVersion, req.opts.dwVersion)
 				assert.Equal(t, webauthnUserVerificationPreferred, req.opts.dwUserVerificationRequirement)
-
 				assert.Equal(t, webauthnAttachmentCrossPlatform, req.opts.dwAuthenticatorAttachment)
 			},
 		},
@@ -242,8 +238,7 @@ func TestLogin(t *testing.T) {
 			},
 			opts: LoginOpts{AuthenticatorAttachment: AttachmentCrossPlatform},
 			assertFn: func(t *testing.T, car *wanpb.CredentialAssertionResponse, req *getAssertionRequest) {
-				assert.Equal(t, uint32(6), req.opts.dwVersion)
-
+				assert.Equal(t, wantOptsVersion, req.opts.dwVersion)
 				assert.Equal(t, webauthnUserVerificationDiscouraged, req.opts.dwUserVerificationRequirement)
 			},
 		},
diff --git a/lib/auth/webauthnwin/conv.go b/lib/auth/webauthnwin/conv.go
index 0b7c27a437da1..95867a9928dd8 100644
--- a/lib/auth/webauthnwin/conv.go
+++ b/lib/auth/webauthnwin/conv.go
@@ -19,6 +19,7 @@
 package webauthnwin
 
 import (
+	"context"
 	"encoding/json"
 	"strings"
 	"syscall"
@@ -37,25 +38,52 @@ func assertOptionsToCType(in wantypes.PublicKeyCredentialRequestOptions, loginOp
 	}
 
 	var dwAuthenticatorAttachment uint32
+	var credentialHint string
 	if loginOpts != nil {
 		switch loginOpts.AuthenticatorAttachment {
 		case AttachmentPlatform:
-			dwAuthenticatorAttachment = 1
+			dwAuthenticatorAttachment = webauthnAttachmentPlatform
+			getPackageLogger().DebugContext(context.Background(),
+				"Using platform attachment",
+				"attachment", dwAuthenticatorAttachment,
+			)
 		case AttachmentCrossPlatform:
-			dwAuthenticatorAttachment = 2
+			dwAuthenticatorAttachment = webauthnAttachmentCrossPlatform
+			// If we are setting cross-platform we imply a physical security-key (not
+			// a phone).
+			// See https://github.com/gravitational/teleport/issues/62060.
+			credentialHint = webauthnCredentialHintSecurityKey
+			getPackageLogger().DebugContext(context.Background(),
+				"Using cross-platform attachment with security-key hint",
+				"attachment", dwAuthenticatorAttachment,
+				"credential_hint", credentialHint,
+			)
 		}
 	}
 
+	var cCredentialHints uint32  // number of hints
+	var pCredentialHints *uint16 // pointer to array of NULL-terminated UTF-16 strings
+	if credentialHint != "" {
+		var err error
+		pCredentialHints, err = utf16PtrFromString(credentialHint)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		cCredentialHints = 1
+	}
+
 	return &webauthnAuthenticatorGetAssertionOptions{
 		// https://github.com/microsoft/webauthn/blob/7ab979cc833bfab9a682ed51761309db57f56c8c/webauthn.h#L36-L97
 		// contains information about different versions.
 		// We can set newest version and it still works on older APIs.
-		dwVersion:                     6,
+		dwVersion:                     9,
 		dwTimeoutMilliseconds:         uint32(in.Timeout),
 		dwAuthenticatorAttachment:     dwAuthenticatorAttachment,
 		dwUserVerificationRequirement: userVerificationToCType(in.UserVerification),
 		// TODO(tobiaszheller): support U2fAppId.
 		pAllowCredentialList: allowCredList,
+		cCredentialHints:     cCredentialHints,
+		ppwszCredentialHints: pCredentialHints,
 	}, nil
 }
 
diff --git a/lib/auth/webauthnwin/ctypes.go b/lib/auth/webauthnwin/ctypes.go
index a987293e6bea6..2189f3bf5dd40 100644
--- a/lib/auth/webauthnwin/ctypes.go
+++ b/lib/auth/webauthnwin/ctypes.go
@@ -29,6 +29,10 @@ const (
 	webauthnUserVerificationRequired    = uint32(1)
 	webauthnUserVerificationPreferred   = uint32(2)
 	webauthnUserVerificationDiscouraged = uint32(3)
+
+	webauthnCredentialHintSecurityKey  = "security-key"
+	webauthnCredentialHintClientDevice = "client-device"
+	webauthnCredentialHintHybrid       = "hybrid"
 )
 
 type webauthnRPEntityInformation struct {
@@ -240,6 +244,7 @@ type webauthnClientData struct {
 	pwszHashAlgID *uint16
 }
 
+//nolint:unused // This type maps a C struct. We need to keep the layout consistent.
 type webauthnAuthenticatorGetAssertionOptions struct {
 	dwVersion uint32
 	// Time that the operation is expected to complete within.
@@ -289,13 +294,60 @@ type webauthnAuthenticatorGetAssertionOptions struct {
 	//
 	// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_5
 	//
-	// This field is kept just to keep size of struct valid.
-	_ uint32
-	// Size of pbCredLargeBlob
-	// This field is kept just to keep size of struct valid.
-	_ uint32
-	// This field is kept just to keep size of struct valid.
-	_ *byte
+
+	_               uint32 // dwCredLargeBlobOperation
+	cbCredLargeBlob uint32
+	pbCredLargeBlob *byte
+
+	//
+	// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6
+	//
+
+	// PRF values which will be converted into HMAC-SECRET values according to WebAuthn Spec.
+	_ uint32 // pHmacSecretSaltValues
+
+	// Optional. BrowserInPrivate Mode. Defaulting to FALSE.
+	bBrowserInPrivateMode bool
+
+	//
+	// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_7
+	//
+
+	// Deprecated
+	// Optional. Linked Device Connection Info.
+	_ uint32 // pLinkedDevice
+
+	// Optional. Allowlist MUST contain 1 credential applicable for Hybrid transport.
+	bAutoFill bool
+
+	// Size of pbJsonExt
+	cbJsonExt uint32
+	pbJsonExt *byte
+
+	//
+	// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_8
+	//
+
+	// PublicKeyCredentialHints (https://w3c.github.io/webauthn/#enum-hints)
+	cCredentialHints     uint32
+	ppwszCredentialHints *uint16
+
+	//
+	// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_9
+	//
+	// https://github.com/microsoft/webauthn/blob/c3ed95fd7603441a0253c55c14e79239cb556a9f/webauthn.h#L958.
+	//
+
+	// Web Origin. For Remote Web App scenario.
+	pwszRemoteWebOrigin *uint16
+
+	// UTF-8 encoded JSON serialization of the PublicKeyCredentialRequestOptions.
+	cbPublicKeyCredentialRequestOptionsJSON uint32
+	pbPublicKeyCredentialRequestOptionsJSON *byte
+
+	// Authenticator ID got from WebAuthNGetAuthenticatorList API.
+	cbAuthenticatorID uint32
+	pbAuthenticatorID *byte
 }
 
 //nolint:unused // TODO: remove when linter runs on windows build tag
diff --git a/lib/auth/webauthnwin/webauthn_windows.go b/lib/auth/webauthnwin/webauthn_windows.go
index 0f07071ba498e..8eb80fdc3c53a 100644
--- a/lib/auth/webauthnwin/webauthn_windows.go
+++ b/lib/auth/webauthnwin/webauthn_windows.go
@@ -54,6 +54,8 @@ func newNativeImpl() *nativeImpl {
 		hasCompileSupport: true,
 	}
 
+	// Do not hold onto this logger. It is created before tsh has a chance to
+	// initialize it properly.
 	logger := slog.With(teleport.ComponentKey, "WebAuthnWin")
 	ctx := context.Background()
 
@@ -115,6 +117,21 @@ func (n *nativeImpl) GetAssertion(origin string, in *getAssertionRequest) (*want
 		return nil, trace.Wrap(err)
 	}
 
+	logger := getPackageLogger()
+	logger.DebugContext(context.Background(), "WebAuthn.dll API version",
+		"version", n.webauthnAPIVersion,
+	)
+
+	if n.webauthnAPIVersion < int(in.opts.dwVersion) {
+		const legacyVersion = 5
+		in.opts.dwVersion = legacyVersion
+		logger.DebugContext(context.Background(),
+			"WebAuthn.dll too old, falling back to legacy version",
+			"api_version", n.webauthnAPIVersion,
+			"legacy_version", in.opts.dwVersion,
+		)
+	}
+
 	var out *webauthnAssertion
 	ret, err := webAuthNAuthenticatorGetAssertion(hwnd, in.rpID, in.clientData, in.opts, &out)
 	if ret != 0 {
diff --git a/lib/auth/webauthnwin/zsyscall_windows.go b/lib/auth/webauthnwin/zsyscall_windows.go
index c27df503f6ea5..81dbd4b3fad4e 100644
--- a/lib/auth/webauthnwin/zsyscall_windows.go
+++ b/lib/auth/webauthnwin/zsyscall_windows.go
@@ -52,7 +52,7 @@ var (
 )
 
 func webAuthNAuthenticatorGetAssertion(hwnd syscall.Handle, rpID *uint16, clientData *webauthnClientData, opts *webauthnAuthenticatorGetAssertionOptions, out **webauthnAssertion) (ret uintptr, err error) {
-	r0, _, e1 := syscall.Syscall6(procWebAuthNAuthenticatorGetAssertion.Addr(), 5, uintptr(hwnd), uintptr(unsafe.Pointer(rpID)), uintptr(unsafe.Pointer(clientData)), uintptr(unsafe.Pointer(opts)), uintptr(unsafe.Pointer(out)), 0)
+	r0, _, e1 := syscall.SyscallN(procWebAuthNAuthenticatorGetAssertion.Addr(), uintptr(hwnd), uintptr(unsafe.Pointer(rpID)), uintptr(unsafe.Pointer(clientData)), uintptr(unsafe.Pointer(opts)), uintptr(unsafe.Pointer(out)))
 	ret = uintptr(r0)
 	if ret != 0 {
 		err = errnoErr(e1)
@@ -61,7 +61,7 @@ func webAuthNAuthenticatorGetAssertion(hwnd syscall.Handle, rpID *uint16, client
 }
 
 func webAuthNAuthenticatorMakeCredential(hwnd syscall.Handle, rp *webauthnRPEntityInformation, user *webauthnUserEntityInformation, pubKeyCredParams *webauthnCoseCredentialParameters, clientData *webauthnClientData, opts *webauthnAuthenticatorMakeCredentialOptions, out **webauthnCredentialAttestation) (ret uintptr, err error) {
-	r0, _, e1 := syscall.Syscall9(procWebAuthNAuthenticatorMakeCredential.Addr(), 7, uintptr(hwnd), uintptr(unsafe.Pointer(rp)), uintptr(unsafe.Pointer(user)), uintptr(unsafe.Pointer(pubKeyCredParams)), uintptr(unsafe.Pointer(clientData)), uintptr(unsafe.Pointer(opts)), uintptr(unsafe.Pointer(out)), 0, 0)
+	r0, _, e1 := syscall.SyscallN(procWebAuthNAuthenticatorMakeCredential.Addr(), uintptr(hwnd), uintptr(unsafe.Pointer(rp)), uintptr(unsafe.Pointer(user)), uintptr(unsafe.Pointer(pubKeyCredParams)), uintptr(unsafe.Pointer(clientData)), uintptr(unsafe.Pointer(opts)), uintptr(unsafe.Pointer(out)))
 	ret = uintptr(r0)
 	if ret != 0 {
 		err = errnoErr(e1)
@@ -70,17 +70,17 @@ func webAuthNAuthenticatorMakeCredential(hwnd syscall.Handle, rp *webauthnRPEnti
 }
 
 func freeAssertion(in *webauthnAssertion) {
-	syscall.Syscall(procWebAuthNFreeAssertion.Addr(), 1, uintptr(unsafe.Pointer(in)), 0, 0)
+	syscall.SyscallN(procWebAuthNFreeAssertion.Addr(), uintptr(unsafe.Pointer(in)))
 	return
 }
 
 func freeCredentialAttestation(in *webauthnCredentialAttestation) {
-	syscall.Syscall(procWebAuthNFreeCredentialAttestation.Addr(), 1, uintptr(unsafe.Pointer(in)), 0, 0)
+	syscall.SyscallN(procWebAuthNFreeCredentialAttestation.Addr(), uintptr(unsafe.Pointer(in)))
 	return
 }
 
 func webAuthNGetApiVersionNumber() (ret int, err error) {
-	r0, _, e1 := syscall.Syscall(procWebAuthNGetApiVersionNumber.Addr(), 0, 0, 0, 0)
+	r0, _, e1 := syscall.SyscallN(procWebAuthNGetApiVersionNumber.Addr())
 	ret = int(r0)
 	if ret == 0 {
 		err = errnoErr(e1)
@@ -89,7 +89,7 @@ func webAuthNGetApiVersionNumber() (ret int, err error) {
 }
 
 func webAuthNGetErrorName(in uintptr) (ret uintptr) {
-	r0, _, _ := syscall.Syscall(procWebAuthNGetErrorName.Addr(), 1, uintptr(in), 0, 0)
+	r0, _, _ := syscall.SyscallN(procWebAuthNGetErrorName.Addr(), uintptr(in))
 	ret = uintptr(r0)
 	return
 }
@@ -99,7 +99,7 @@ func webAuthNIsUserVerifyingPlatformAuthenticatorAvailable(out *bool) (ret uintp
 	if *out {
 		_p0 = 1
 	}
-	r0, _, e1 := syscall.Syscall(procWebAuthNIsUserVerifyingPlatformAuthenticatorAvailable.Addr(), 1, uintptr(unsafe.Pointer(&_p0)), 0, 0)
+	r0, _, e1 := syscall.SyscallN(procWebAuthNIsUserVerifyingPlatformAuthenticatorAvailable.Addr(), uintptr(unsafe.Pointer(&_p0)))
 	*out = _p0 != 0
 	ret = uintptr(r0)
 	if ret != 0 {
@@ -109,7 +109,7 @@ func webAuthNIsUserVerifyingPlatformAuthenticatorAvailable(out *bool) (ret uintp
 }
 
 func getForegroundWindow() (hwnd syscall.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetForegroundWindow.Addr(), 0, 0, 0, 0)
+	r0, _, e1 := syscall.SyscallN(procGetForegroundWindow.Addr())
 	hwnd = syscall.Handle(r0)
 	if hwnd == 0 {
 		err = errnoErr(e1)
diff --git a/lib/authz/export_test.go b/lib/authz/export_test.go
new file mode 100644
index 0000000000000..eae3f89fc8b10
--- /dev/null
+++ b/lib/authz/export_test.go
@@ -0,0 +1,30 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package authz
+
+// The items exported here exist solely to prevent import cycles and facilitate
+// preexisting tests in lib/authz which relied on unexported items. All new
+// tests in lib/authz should exist in the authz_test package and not rely on
+// internal state.
+
+func DisableContextDeviceRoleMode(ctx *Context) {
+	ctx.disableDeviceRoleMode = true
+}
+
+func ContextDeviceRoleMode(ctx *Context) bool {
+	return ctx.disableDeviceRoleMode
+}
diff --git a/lib/authz/permissions.go b/lib/authz/permissions.go
index a8836c4009b47..3b975eef8b597 100644
--- a/lib/authz/permissions.go
+++ b/lib/authz/permissions.go
@@ -44,6 +44,7 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -79,6 +80,7 @@ type AuthorizerOpts struct {
 	ClusterName         string
 	AccessPoint         AuthorizerAccessPoint
 	ReadOnlyAccessPoint ReadOnlyAuthorizerAccessPoint
+	ScopedRoleReader    services.ScopedRoleReader
 	MFAAuthenticator    MFAAuthenticator
 	LockWatcher         *services.LockWatcher
 	Logger              *slog.Logger
@@ -96,6 +98,10 @@ type AuthorizerOpts struct {
 
 // NewAuthorizer returns new authorizer using backends
 func NewAuthorizer(opts AuthorizerOpts) (Authorizer, error) {
+	return newAuthorizer(opts)
+}
+
+func newAuthorizer(opts AuthorizerOpts) (*authorizer, error) {
 	if opts.ClusterName == "" {
 		return nil, trace.BadParameter("missing parameter clusterName")
 	}
@@ -126,6 +132,7 @@ func NewAuthorizer(opts AuthorizerOpts) (Authorizer, error) {
 		clusterName:             opts.ClusterName,
 		accessPoint:             opts.AccessPoint,
 		readOnlyAccessPoint:     opts.ReadOnlyAccessPoint,
+		scopedRoleReader:        opts.ScopedRoleReader,
 		mfaAuthenticator:        opts.MFAAuthenticator,
 		lockWatcher:             opts.LockWatcher,
 		logger:                  logger,
@@ -174,12 +181,6 @@ type AuthorizerAccessPoint interface {
 	// GetCertAuthority returns cert authority by id.
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 
-	// GetCertAuthorities returns a list of cert authorities.
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool) ([]types.CertAuthority, error)
-
-	// GetClusterAuditConfig returns cluster audit configuration.
-	GetClusterAuditConfig(ctx context.Context) (types.ClusterAuditConfig, error)
-
 	// GetClusterNetworkingConfig returns cluster networking configuration.
 	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
 
@@ -223,6 +224,7 @@ type authorizer struct {
 	clusterName         string
 	accessPoint         AuthorizerAccessPoint
 	readOnlyAccessPoint ReadOnlyAuthorizerAccessPoint
+	scopedRoleReader    services.ScopedRoleReader
 	mfaAuthenticator    MFAAuthenticator
 	lockWatcher         *services.LockWatcher
 	logger              *slog.Logger
@@ -365,6 +367,7 @@ func (c *Context) GetAccessState(authPref readonly.AuthPreference) services.Acce
 
 	state.EnableDeviceVerification = !c.disableDeviceRoleMode
 	state.DeviceVerified = isService || dtauthz.IsTLSDeviceVerified(&identity.DeviceExtensions)
+	state.IsBot = identity.IsBot()
 
 	return state
 }
@@ -416,6 +419,11 @@ func (a *authorizer) Authorize(ctx context.Context) (authCtx *Context, err error
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	if user, ok := userI.(LocalUser); ok && user.Identity.ScopePin != nil {
+		return nil, trace.Errorf("cannot perform standard authz: %w", services.ErrScopedIdentity)
+	}
+
 	authContext, err := a.fromUser(ctx, userI)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -613,6 +621,8 @@ func (a *authorizer) convertAuthorizerError(err error) error {
 	case errors.Is(err, ErrIPPinningMissing) || errors.Is(err, ErrIPPinningMismatch) || errors.Is(err, ErrIPPinningNotAllowed):
 		a.logger.WarnContext(context.Background(), "ip pinning requirements not satisfied", "error", err)
 		return trace.Wrap(err)
+	case errors.Is(err, services.ErrScopedIdentity):
+		return trace.Wrap(err)
 	case trace.IsAccessDenied(err):
 		a.logger.WarnContext(context.Background(), "access denied", "error", err)
 	case keys.IsPrivateKeyPolicyError(err):
@@ -758,6 +768,7 @@ func (a *authorizer) authorizeRemoteUser(ctx context.Context, u RemoteUser) (*Co
 		PinnedIP:          u.Identity.PinnedIP,
 		PrivateKeyPolicy:  u.Identity.PrivateKeyPolicy,
 		UserType:          u.Identity.UserType,
+		OriginClusterName: u.Identity.TeleportCluster,
 	}
 	if checker.PinSourceIP() && identity.PinnedIP == "" {
 		return nil, trace.Wrap(ErrIPPinningMissing)
@@ -928,6 +939,9 @@ func roleSpecForProxy(clusterName string) types.RoleSpecV6 {
 				types.NewRule(types.KindUserTask, services.RO()),
 				types.NewRule(types.KindGitServer, services.RO()),
 				types.NewRule(types.KindAccessGraphSettings, services.RO()),
+				types.NewRule(types.KindRelayServer, services.RO()),
+				types.NewRule(types.KindAccessList, services.RO()),
+				types.NewRule(types.KindHealthCheckConfig, services.RO()),
 				// this rule allows cloud proxies to read
 				// plugins of `openai` type, since Assist uses the OpenAI API and runs in Proxy.
 				{
@@ -1020,6 +1034,11 @@ func definitionForBuiltinRole(clusterName string, recConfig readonly.SessionReco
 						types.NewRule(types.KindConnectionDiagnostic, services.RW()),
 						types.NewRule(types.KindStaticHostUser, services.RO()),
 						types.NewRule(types.KindStableUNIXUser, []string{types.VerbCreate, types.VerbRead}),
+						// TODO(fspmarshall/scopes): we eventually want to remove blanket scoped role
+						// access in favor of nodes only being able to read scoped roles that may affect
+						// access decisions for the given node specifically. this verb grant will need to
+						// be revisited as part of that work.
+						types.NewRule(scopedaccess.KindScopedRole, services.RO()),
 					},
 				},
 			})
@@ -1093,6 +1112,48 @@ func definitionForBuiltinRole(clusterName string, recConfig readonly.SessionReco
 			role.String(),
 			roleSpecForProxyWithRecordAtProxy(clusterName),
 		)
+	case types.RoleRelay:
+		return services.RoleFromSpec(
+			role.String(),
+			types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Namespaces: []string{
+						types.Wildcard,
+					},
+					NodeLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					AppLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					DatabaseLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					KubernetesLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					WindowsDesktopLabels: types.Labels{
+						types.Wildcard: {types.Wildcard},
+					},
+					Rules: []types.Rule{
+						types.NewRule(types.KindAppServer, services.RO()),
+						types.NewRule(types.KindCertAuthority, services.ReadNoSecrets()),
+						types.NewRule(types.KindClusterAuthPreference, services.RO()),
+						types.NewRule(types.KindClusterNetworkingConfig, services.RO()),
+						types.NewRule(types.KindDatabaseServer, services.RO()),
+						types.NewRule(types.KindEvent, services.RW()),
+						types.NewRule(types.KindKubeServer, services.RO()),
+						types.NewRule(types.KindLock, services.RO()),
+						types.NewRule(types.KindNode, services.RO()),
+						types.NewRule(types.KindRelayServer, services.RO()),
+						types.NewRule(types.KindRole, services.RO()),
+						types.NewRule(types.KindSessionRecordingConfig, services.RO()),
+						types.NewRule(types.KindUser, services.RO()),
+						types.NewRule(types.KindWindowsDesktop, services.RO()),
+					},
+				},
+			},
+		)
 	case types.RoleSignup:
 		return services.RoleFromSpec(
 			role.String(),
@@ -1164,6 +1225,7 @@ func definitionForBuiltinRole(clusterName string, recConfig readonly.SessionReco
 						types.NewRule(types.KindLock, services.RO()),
 						types.NewRule(types.KindKubernetesCluster, services.RO()),
 						types.NewRule(types.KindSemaphore, services.RW()),
+						types.NewRule(types.KindHealthCheckConfig, services.RO()),
 					},
 				},
 			})
@@ -1340,19 +1402,37 @@ func ContextForBuiltinRole(r BuiltinRole, recConfig readonly.SessionRecordingCon
 
 // ContextForLocalUser returns a context with the local user info embedded.
 func ContextForLocalUser(ctx context.Context, u LocalUser, accessPoint AuthorizerAccessPoint, clusterName string, disableDeviceRoleMode bool) (*Context, error) {
-	// User has to be fetched to check if it's a blocked username
-	user, err := accessPoint.GetUser(ctx, u.Username, false)
+	user, accessInfo, err := resolveLocalUser(ctx, u, accessPoint)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(u.Identity, accessPoint)
+
+	accessChecker, err := services.NewAccessChecker(accessInfo, clusterName, accessPoint)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	accessChecker, err := services.NewAccessChecker(accessInfo, clusterName, accessPoint)
+
+	return &Context{
+		User:                  user,
+		Checker:               accessChecker,
+		Identity:              u,
+		UnmappedIdentity:      u,
+		disableDeviceRoleMode: disableDeviceRoleMode,
+	}, nil
+}
+
+func resolveLocalUser(ctx context.Context, u LocalUser, accessPoint AuthorizerAccessPoint) (types.User, *services.AccessInfo, error) {
+	// User has to be fetched to check if it's a blocked username
+	user, err := accessPoint.GetUser(ctx, u.Username, false)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
+
+	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(u.Identity)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
 	// Override roles and traits from the local user based on the identity roles
 	// and traits, this is done to prevent potential conflict. Imagine a scenario
 	// when SSO user has left the company, but local user entry remained with old
@@ -1363,13 +1443,7 @@ func ContextForLocalUser(ctx context.Context, u LocalUser, accessPoint Authorize
 	user.SetRoles(accessInfo.Roles)
 	user.SetTraits(accessInfo.Traits)
 
-	return &Context{
-		User:                  user,
-		Checker:               accessChecker,
-		Identity:              u,
-		UnmappedIdentity:      u,
-		disableDeviceRoleMode: disableDeviceRoleMode,
-	}, nil
+	return user, accessInfo, nil
 }
 
 type contextKey string
diff --git a/lib/authz/permissions_test.go b/lib/authz/permissions_test.go
index a31e03e5b65b6..63f80ec3e3bac 100644
--- a/lib/authz/permissions_test.go
+++ b/lib/authz/permissions_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package authz
+package authz_test
 
 import (
 	"context"
@@ -41,8 +41,11 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/services/readonly"
@@ -124,7 +127,7 @@ func TestGetDisconnectExpiredCertFromIdentity(t *testing.T) {
 			authPref := types.DefaultAuthPreference()
 			authPref.SetDisconnectExpiredCert(test.disconnectExpiredCert)
 
-			ctx := Context{Checker: test.checker, Identity: WrapIdentity(identity)}
+			ctx := authz.Context{Checker: test.checker, Identity: authz.WrapIdentity(identity)}
 
 			got := ctx.GetDisconnectCertExpiry(authPref)
 			require.Equal(t, test.expected, got)
@@ -202,8 +205,8 @@ func TestContextLockTargets(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.role.String(), func(t *testing.T) {
-			authContext := &Context{
-				Identity: BuiltinRole{
+			authContext := &authz.Context{
+				Identity: authz.BuiltinRole{
 					Role:        tt.role,
 					ClusterName: "cluster",
 					Identity: tlsca.Identity{
@@ -214,7 +217,7 @@ func TestContextLockTargets(t *testing.T) {
 						},
 					},
 				},
-				UnmappedIdentity: WrapIdentity(tlsca.Identity{
+				UnmappedIdentity: authz.WrapIdentity(tlsca.Identity{
 					Username: "node.cluster",
 					Groups:   []string{"mapped-role"},
 				}),
@@ -230,9 +233,9 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 
 	client, watcher, authorizer := newTestResources(t)
 
-	user, role, err := createUserAndRole(client, "test-user", []string{}, nil)
+	user, role, err := authtest.CreateUserAndRole(client, "test-user", []string{}, nil)
 	require.NoError(t, err)
-	localUser := LocalUser{
+	localUser := authz.LocalUser{
 		Username: user.GetName(),
 		Identity: tlsca.Identity{
 			Username:       user.GetName(),
@@ -249,13 +252,13 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 	require.NoError(t, err)
 	upsertLockWithPutEvent(ctx, t, client, watcher, mfaLock)
 
-	_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, localUser))
+	_, err = authorizer.Authorize(authz.ContextWithUser(ctx, localUser))
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Remove the MFA record from the user value being authorized.
 	localUser.Identity.MFAVerified = ""
-	_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, localUser))
+	_, err = authorizer.Authorize(authz.ContextWithUser(ctx, localUser))
 	require.NoError(t, err)
 
 	// Add an access request lock.
@@ -266,13 +269,13 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 	upsertLockWithPutEvent(ctx, t, client, watcher, requestLock)
 
 	// localUser's identity with a locked access request is locked out.
-	_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, localUser))
+	_, err = authorizer.Authorize(authz.ContextWithUser(ctx, localUser))
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Not locked out without the request.
 	localUser.Identity.ActiveRequests = nil
-	_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, localUser))
+	_, err = authorizer.Authorize(authz.ContextWithUser(ctx, localUser))
 	require.NoError(t, err)
 
 	// Create a lock targeting the role written in the user's identity.
@@ -282,7 +285,7 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 	require.NoError(t, err)
 	upsertLockWithPutEvent(ctx, t, client, watcher, roleLock)
 
-	_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, localUser))
+	_, err = authorizer.Authorize(authz.ContextWithUser(ctx, localUser))
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 }
@@ -294,7 +297,7 @@ func TestAuthorizeWithLocksForBuiltinRole(t *testing.T) {
 	client, watcher, authorizer := newTestResources(t)
 	for _, role := range types.LocalServiceMappings() {
 		t.Run(role.String(), func(t *testing.T) {
-			builtinRole := BuiltinRole{
+			builtinRole := authz.BuiltinRole{
 				Username: "node",
 				Role:     role,
 				Identity: tlsca.Identity{
@@ -309,12 +312,12 @@ func TestAuthorizeWithLocksForBuiltinRole(t *testing.T) {
 			require.NoError(t, err)
 			upsertLockWithPutEvent(ctx, t, client, watcher, nodeLock)
 
-			_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, builtinRole))
+			_, err = authorizer.Authorize(authz.ContextWithUser(ctx, builtinRole))
 			require.Error(t, err)
 			require.True(t, trace.IsAccessDenied(err))
 
 			builtinRole.Identity.Username = ""
-			_, err = authorizer.Authorize(context.WithValue(ctx, contextUser, builtinRole))
+			_, err = authorizer.Authorize(authz.ContextWithUser(ctx, builtinRole))
 			require.NoError(t, err)
 		})
 	}
@@ -343,7 +346,7 @@ func upsertLockWithPutEvent(ctx context.Context, t *testing.T, client *testClien
 func TestGetClientUserIsSSO(t *testing.T) {
 	ctx := context.Background()
 
-	u := LocalUser{
+	u := authz.LocalUser{
 		Username: "someuser",
 		Identity: tlsca.Identity{
 			Username: "someuser",
@@ -352,16 +355,16 @@ func TestGetClientUserIsSSO(t *testing.T) {
 	}
 
 	// Non SSO user must return false
-	nonSSOUserCtx := context.WithValue(ctx, contextUser, u)
+	nonSSOUserCtx := authz.ContextWithUser(ctx, u)
 
-	isSSO, err := GetClientUserIsSSO(nonSSOUserCtx)
+	isSSO, err := authz.GetClientUserIsSSO(nonSSOUserCtx)
 	require.NoError(t, err)
 	require.False(t, isSSO, "expected a non-SSO user")
 
 	// An SSO user must return true
 	u.Identity.UserType = types.UserTypeSSO
-	ssoUserCtx := context.WithValue(ctx, contextUser, u)
-	localUserIsSSO, err := GetClientUserIsSSO(ssoUserCtx)
+	ssoUserCtx := authz.ContextWithUser(ctx, u)
+	localUserIsSSO, err := authz.GetClientUserIsSSO(ssoUserCtx)
 	require.NoError(t, err)
 	require.True(t, localUserIsSSO, "expected an SSO user")
 }
@@ -371,10 +374,10 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 
 	ctx := context.Background()
 
-	user, role, err := createUserAndRole(client, "llama", []string{"llama"}, nil)
+	user, role, err := authtest.CreateUserAndRole(client, "llama", []string{"llama"}, nil)
 	require.NoError(t, err, "CreateUserAndRole")
 
-	userWithoutExtensions := LocalUser{
+	userWithoutExtensions := authz.LocalUser{
 		Username: user.GetName(),
 		Identity: tlsca.Identity{
 			Username:   user.GetName(),
@@ -388,17 +391,20 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 		AssetTag:     "assettag1",
 		CredentialID: "credentialid1",
 	}
+	botUser := userWithoutExtensions
+	botUser.Identity.BotName = "wall-e"
+	botUser.Identity.BotInstanceID = uuid.NewString()
 
 	// Enterprise is necessary for mode=optional and mode=required to work.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
 	tests := []struct {
 		name                 string
 		deviceMode           string
-		deviceAuthz          DeviceAuthorizationOpts // aka AuthorizerOpts.DeviceAuthorization
-		user                 IdentityGetter
+		deviceAuthz          authz.DeviceAuthorizationOpts // aka AuthorizerOpts.DeviceAuthorization
+		user                 authz.IdentityGetter
 		wantErr              string
 		wantCtxAuthnDisabled bool // defaults to deviceAuthz.disableDeviceRoleMode
 	}{
@@ -413,10 +419,21 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 			user:       userWithoutExtensions,
 			wantErr:    "access denied",
 		},
+		{
+			name:       "nok: bot user and mode=required",
+			deviceMode: constants.DeviceTrustModeRequired,
+			user:       botUser,
+			wantErr:    "access denied",
+		},
+		{
+			name:       "ok: bot user and mode=required-for-humans",
+			deviceMode: constants.DeviceTrustModeRequiredForHumans,
+			user:       botUser,
+		},
 		{
 			name:       "global mode disabled only",
 			deviceMode: constants.DeviceTrustModeRequired,
-			deviceAuthz: DeviceAuthorizationOpts{
+			deviceAuthz: authz.DeviceAuthorizationOpts{
 				DisableGlobalMode: true,
 			},
 			user: userWithoutExtensions,
@@ -424,7 +441,7 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 		{
 			name:       "global and role modes disabled",
 			deviceMode: constants.DeviceTrustModeRequired,
-			deviceAuthz: DeviceAuthorizationOpts{
+			deviceAuthz: authz.DeviceAuthorizationOpts{
 				DisableGlobalMode: true,
 				DisableRoleMode:   true,
 			},
@@ -437,7 +454,7 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 		},
 		{
 			name: "BuiltinRole: context always disabled",
-			user: BuiltinRole{
+			user: authz.BuiltinRole{
 				Role:        types.RoleProxy,
 				Username:    user.GetName(),
 				ClusterName: clusterName,
@@ -447,11 +464,11 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 		},
 		{
 			name: "BuiltinRole: device authorization disabled",
-			deviceAuthz: DeviceAuthorizationOpts{
+			deviceAuthz: authz.DeviceAuthorizationOpts{
 				DisableGlobalMode: true,
 				DisableRoleMode:   true,
 			},
-			user: BuiltinRole{
+			user: authz.BuiltinRole{
 				Role:        types.RoleProxy,
 				Username:    user.GetName(),
 				ClusterName: clusterName,
@@ -460,11 +477,11 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 		},
 		{
 			name: "RemoteBuiltinRole: device authorization disabled",
-			deviceAuthz: DeviceAuthorizationOpts{
+			deviceAuthz: authz.DeviceAuthorizationOpts{
 				DisableGlobalMode: true,
 				DisableRoleMode:   true,
 			},
-			user: RemoteBuiltinRole{
+			user: authz.RemoteBuiltinRole{
 				Role:        types.RoleProxy,
 				Username:    user.GetName(),
 				ClusterName: clusterName,
@@ -485,7 +502,7 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 			require.NoError(t, err, "UpsertAuthPreference failed")
 
 			// Create a new authorizer.
-			authorizer, err := NewAuthorizer(AuthorizerOpts{
+			authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
 				ClusterName:         clusterName,
 				AccessPoint:         client,
 				LockWatcher:         watcher,
@@ -494,7 +511,7 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 			require.NoError(t, err, "NewAuthorizer failed")
 
 			// Test!
-			userCtx := context.WithValue(ctx, contextUser, test.user)
+			userCtx := authz.ContextWithUser(ctx, test.user)
 			authCtx, gotErr := authorizer.Authorize(userCtx)
 			if test.wantErr == "" {
 				assert.NoError(t, gotErr, "Authorize returned unexpected error")
@@ -510,7 +527,7 @@ func TestAuthorizer_Authorize_deviceTrust(t *testing.T) {
 			// value, based on either the global toggle or role mode.
 			wantDisabled := test.deviceAuthz.DisableRoleMode || test.wantCtxAuthnDisabled
 			assert.Equal(
-				t, wantDisabled, authCtx.disableDeviceRoleMode,
+				t, wantDisabled, authz.ContextDeviceRoleMode(authCtx),
 				"auth.Context.disableDeviceAuthorization not inherited from Authorizer")
 		})
 	}
@@ -522,10 +539,10 @@ func hostFQDN(hostUUID, clusterName string) string {
 }
 
 type fakeMFAAuthenticator struct {
-	mfaData map[string]*MFAAuthData // keyed by totp token
+	mfaData map[string]*authz.MFAAuthData // keyed by totp token
 }
 
-func (a *fakeMFAAuthenticator) ValidateMFAAuthResponse(ctx context.Context, resp *proto.MFAAuthenticateResponse, user string, requiredExtensions *mfav1.ChallengeExtensions) (*MFAAuthData, error) {
+func (a *fakeMFAAuthenticator) ValidateMFAAuthResponse(ctx context.Context, resp *proto.MFAAuthenticateResponse, user string, requiredExtensions *mfav1.ChallengeExtensions) (*authz.MFAAuthData, error) {
 	mfaData, ok := a.mfaData[resp.GetTOTP().GetCode()]
 	if !ok {
 		return nil, trace.AccessDenied("invalid MFA")
@@ -550,15 +567,15 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a new local user.
-	localUser, _, err := createUserAndRole(client, "localuser", []string{"local"}, nil)
+	localUser, _, err := authtest.CreateUserAndRole(client, "localuser", []string{"local"}, nil)
 	require.NoError(t, err)
 
 	// Create new local user with a host-like username.
-	userWithHostName, _, err := createUserAndRole(client, hostFQDN(uuid.NewString(), clusterName), []string{"local"}, nil)
+	userWithHostName, _, err := authtest.CreateUserAndRole(client, hostFQDN(uuid.NewString(), clusterName), []string{"local"}, nil)
 	require.NoError(t, err)
 
 	// Create a new bot user.
-	bot, err := types.NewUser("robot")
+	bot, _, err := authtest.CreateUserAndRole(client, "robot", []string{"robot-role"}, nil)
 	require.NoError(t, err)
 	botMetadata := bot.GetMetadata()
 	botMetadata.Labels = map[string]string{
@@ -566,13 +583,13 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 		types.BotGenerationLabel: "0",
 	}
 	bot.SetMetadata(botMetadata)
-	_, err = client.CreateUser(ctx, bot)
+	_, err = client.UpsertUser(ctx, bot)
 	require.NoError(t, err)
 
 	validTOTPCode := "valid"
 	validReusableTOTPCode := "valid-reusable"
 	fakeMFAAuthentictor := &fakeMFAAuthenticator{
-		mfaData: map[string]*MFAAuthData{
+		mfaData: map[string]*authz.MFAAuthData{
 			validTOTPCode: {},
 			validReusableTOTPCode: {
 				AllowReuse: mfav1.ChallengeAllowReuse_CHALLENGE_ALLOW_REUSE_YES,
@@ -581,7 +598,7 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 	}
 
 	// Create a new authorizer.
-	authorizer, err := NewAuthorizer(AuthorizerOpts{
+	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
 		ClusterName:      clusterName,
 		AccessPoint:      client,
 		LockWatcher:      watcher,
@@ -615,7 +632,7 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 
 	for _, tt := range []struct {
 		name                      string
-		user                      IdentityGetter
+		user                      authz.IdentityGetter
 		withMFA                   *proto.MFAAuthenticateResponse
 		allowedReusedMFA          bool
 		contextGetter             func() context.Context
@@ -624,29 +641,32 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 	}{
 		{
 			name: "NOK local user no mfa",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username: localUser.GetName(),
+					Groups:   localUser.GetRoles(),
 				},
 			},
 			wantAdminActionAuthorized: false,
 		}, {
 			name: "NOK local user mfa verified cert",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username:    localUser.GetName(),
+					Groups:      localUser.GetRoles(),
 					MFAVerified: "mfa-verified-test",
 				},
 			},
 			wantAdminActionAuthorized: false,
 		}, {
 			name: "NOK local user mfa verified private key policy",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username:         localUser.GetName(),
+					Groups:           localUser.GetRoles(),
 					PrivateKeyPolicy: keys.PrivateKeyPolicyHardwareKeyTouch,
 				},
 			},
@@ -654,19 +674,21 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 		}, {
 			// edge case for the admin role check.
 			name: "NOK local user with host-like username",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: userWithHostName.GetName(),
 				Identity: tlsca.Identity{
 					Username: userWithHostName.GetName(),
+					Groups:   userWithHostName.GetRoles(),
 				},
 			},
 			wantAdminActionAuthorized: false,
 		}, {
 			name: "NOK local user invalid mfa",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username: localUser.GetName(),
+					Groups:   localUser.GetRoles(),
 				},
 			},
 			withMFA:                   invalidMFA,
@@ -674,30 +696,33 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "NOK local user reused mfa with reuse not allowed",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username: localUser.GetName(),
+					Groups:   localUser.GetRoles(),
 				},
 			},
 			withMFA:                   validMFAWithReuse,
 			wantAdminActionAuthorized: false,
 		}, {
 			name: "OK local user valid mfa",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username: localUser.GetName(),
+					Groups:   localUser.GetRoles(),
 				},
 			},
 			withMFA:                   validMFA,
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "OK local user reused mfa with reuse allowed",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username: localUser.GetName(),
+					Groups:   localUser.GetRoles(),
 				},
 			},
 			withMFA:                   validMFAWithReuse,
@@ -705,36 +730,39 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "OK admin",
-			user: BuiltinRole{
+			user: authz.BuiltinRole{
 				Role:     types.RoleAdmin,
 				Username: hostFQDN(uuid.NewString(), clusterName),
 			},
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "OK bot",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: bot.GetName(),
 				Identity: tlsca.Identity{
 					Username: bot.GetName(),
+					Groups:   bot.GetRoles(),
 				},
 			},
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "OK admin impersonating local user",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username:     localUser.GetName(),
+					Groups:       localUser.GetRoles(),
 					Impersonator: hostFQDN(uuid.NewString(), clusterName),
 				},
 			},
 			wantAdminActionAuthorized: true,
 		}, {
 			name: "OK bot impersonating local user",
-			user: LocalUser{
+			user: authz.LocalUser{
 				Username: localUser.GetName(),
 				Identity: tlsca.Identity{
 					Username:     localUser.GetName(),
+					Groups:       localUser.GetRoles(),
 					Impersonator: bot.GetName(),
 				},
 			},
@@ -751,7 +779,7 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 				})
 				ctx = metadata.NewIncomingContext(ctx, md)
 			}
-			userCtx := context.WithValue(ctx, contextUser, tt.user)
+			userCtx := authz.ContextWithUser(ctx, tt.user)
 			authCtx, err := authorizer.Authorize(userCtx)
 			if tt.wantErrContains != "" {
 				require.ErrorContains(t, err, tt.wantErrContains, "Expected matching Authorize error")
@@ -776,10 +804,10 @@ func TestAuthorizer_AuthorizeAdminAction(t *testing.T) {
 }
 
 func TestContext_GetAccessState(t *testing.T) {
-	localCtx := Context{
+	localCtx := authz.Context{
 		User:    &fakeCtxUser{}, // makes no difference in the outcomes.
 		Checker: &fakeCtxChecker{},
-		Identity: LocalUser{Identity: tlsca.Identity{
+		Identity: authz.LocalUser{Identity: tlsca.Identity{
 			Username:   "llama",
 			Groups:     []string{"access", "editor", "llamas"},
 			Principals: []string{"llamas"},
@@ -796,22 +824,22 @@ func TestContext_GetAccessState(t *testing.T) {
 
 	tests := []struct {
 		name          string
-		createAuthCtx func() *Context
+		createAuthCtx func() *authz.Context
 		authSpec      *types.AuthPreferenceSpecV2 // defaults to defaultSpec
 		want          services.AccessState
 	}{
 		{
 			name:          "local user",
-			createAuthCtx: func() *Context { return &localCtx },
+			createAuthCtx: func() *authz.Context { return &localCtx },
 			want: services.AccessState{
 				EnableDeviceVerification: true, // default when acquired from auth.Context
 			},
 		},
 		{
 			name: "builtin role",
-			createAuthCtx: func() *Context {
+			createAuthCtx: func() *authz.Context {
 				ctx := localCtx
-				ctx.Identity = BuiltinRole{}
+				ctx.Identity = authz.BuiltinRole{}
 				return &ctx
 			},
 			want: services.AccessState{
@@ -822,12 +850,12 @@ func TestContext_GetAccessState(t *testing.T) {
 		},
 		{
 			name: "mfa: local user",
-			createAuthCtx: func() *Context {
+			createAuthCtx: func() *authz.Context {
 				ctx := localCtx
 				ctx.Checker = &fakeCtxChecker{state: services.AccessState{
 					MFARequired: services.MFARequiredAlways,
 				}}
-				localUser := ctx.Identity.(LocalUser)
+				localUser := ctx.Identity.(authz.LocalUser)
 				localUser.Identity.MFAVerified = "my-device-UUID"
 				ctx.Identity = localUser
 				return &ctx
@@ -840,9 +868,9 @@ func TestContext_GetAccessState(t *testing.T) {
 		},
 		{
 			name: "device trust: local user",
-			createAuthCtx: func() *Context {
+			createAuthCtx: func() *authz.Context {
 				ctx := localCtx
-				localUser := ctx.Identity.(LocalUser)
+				localUser := ctx.Identity.(authz.LocalUser)
 				localUser.Identity.DeviceExtensions = deviceExt
 				ctx.Identity = localUser
 				return &ctx
@@ -854,12 +882,13 @@ func TestContext_GetAccessState(t *testing.T) {
 		},
 		{
 			name: "device authorization disabled",
-			createAuthCtx: func() *Context {
+			createAuthCtx: func() *authz.Context {
 				ctx := localCtx
-				localUser := ctx.Identity.(LocalUser)
+				localUser := ctx.Identity.(authz.LocalUser)
 				localUser.Identity.DeviceExtensions = deviceExt
 				ctx.Identity = localUser
-				ctx.disableDeviceRoleMode = true
+
+				authz.DisableContextDeviceRoleMode(&ctx)
 				return &ctx
 			},
 			want: services.AccessState{
@@ -867,6 +896,20 @@ func TestContext_GetAccessState(t *testing.T) {
 				DeviceVerified:           true,  // Identity extensions
 			},
 		},
+		{
+			name: "bot user",
+			createAuthCtx: func() *authz.Context {
+				ctx := localCtx
+				localUser := ctx.Identity.(authz.LocalUser)
+				localUser.Identity.BotName = "wall-e"
+				ctx.Identity = localUser
+				return &ctx
+			},
+			want: services.AccessState{
+				EnableDeviceVerification: true,
+				IsBot:                    true,
+			},
+		},
 	}
 	for _, test := range tests {
 		test := test
@@ -907,21 +950,21 @@ func TestCheckIPPinning(t *testing.T) {
 			clientAddr: "127.0.0.1:444",
 			pinnedIP:   "",
 			pinIP:      true,
-			wantErr:    ErrIPPinningMissing.Error(),
+			wantErr:    authz.ErrIPPinningMissing.Error(),
 		},
 		{
 			desc:       "Pinned IP doesn't match",
 			clientAddr: "127.0.0.1:444",
 			pinnedIP:   "127.0.0.2",
 			pinIP:      true,
-			wantErr:    ErrIPPinningMismatch.Error(),
+			wantErr:    authz.ErrIPPinningMismatch.Error(),
 		},
 		{
 			desc:       "Role doesn't require IP pinning now, but old certificate still pinned",
 			clientAddr: "127.0.0.1:444",
 			pinnedIP:   "127.0.0.2",
 			pinIP:      false,
-			wantErr:    ErrIPPinningMismatch.Error(),
+			wantErr:    authz.ErrIPPinningMismatch.Error(),
 		},
 		{
 			desc:     "IP pinning enabled, missing client IP",
@@ -934,7 +977,7 @@ func TestCheckIPPinning(t *testing.T) {
 			clientAddr: "127.0.0.1:0",
 			pinnedIP:   "127.0.0.1",
 			pinIP:      true,
-			wantErr:    ErrIPPinningNotAllowed.Error(),
+			wantErr:    authz.ErrIPPinningNotAllowed.Error(),
 		},
 		{
 			desc:       "correct IP pinning",
@@ -947,11 +990,11 @@ func TestCheckIPPinning(t *testing.T) {
 	for _, tt := range testCases {
 		ctx := context.Background()
 		if tt.clientAddr != "" {
-			ctx = ContextWithClientSrcAddr(ctx, utils.MustParseAddr(tt.clientAddr))
+			ctx = authz.ContextWithClientSrcAddr(ctx, utils.MustParseAddr(tt.clientAddr))
 		}
 		identity := tlsca.Identity{PinnedIP: tt.pinnedIP}
 
-		err := CheckIPPinning(ctx, identity, tt.pinIP, nil)
+		err := authz.CheckIPPinning(ctx, identity, tt.pinIP, nil)
 
 		if tt.wantErr != "" {
 			require.ErrorContains(t, err, tt.wantErr)
@@ -984,7 +1027,7 @@ func TestRoleSetForBuiltinRoles(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			rs, err := RoleSetForBuiltinRoles(test.clusterName, test.recConfig, test.roles...)
+			rs, err := authz.RoleSetForBuiltinRoles(test.clusterName, test.recConfig, test.roles...)
 			require.NoError(t, err, "RoleSetForBuiltinRoles failed")
 			assert.NotEmpty(t, rs, "RoleSetForBuiltinRoles returned a nil RoleSet")
 			test.assertRoleSet(t, rs)
@@ -993,82 +1036,82 @@ func TestRoleSetForBuiltinRoles(t *testing.T) {
 }
 
 func TestIsUserFunctions(t *testing.T) {
-	localIdentity := Context{
-		Identity:         LocalUser{},
-		UnmappedIdentity: LocalUser{},
+	localIdentity := authz.Context{
+		Identity:         authz.LocalUser{},
+		UnmappedIdentity: authz.LocalUser{},
 	}
-	remoteIdentity := Context{
-		Identity:         RemoteUser{},
-		UnmappedIdentity: RemoteUser{},
+	remoteIdentity := authz.Context{
+		Identity:         authz.RemoteUser{},
+		UnmappedIdentity: authz.RemoteUser{},
 	}
-	systemIdentity := Context{
-		Identity:         BuiltinRole{Role: types.RoleProxy},
-		UnmappedIdentity: BuiltinRole{Role: types.RoleProxy},
+	systemIdentity := authz.Context{
+		Identity:         authz.BuiltinRole{Role: types.RoleProxy},
+		UnmappedIdentity: authz.BuiltinRole{Role: types.RoleProxy},
 	}
 
 	tests := []struct {
 		funcName, scenario string
-		isUserFunc         func(Context) bool
-		authCtx            Context
+		isUserFunc         func(authz.Context) bool
+		authCtx            authz.Context
 		want               bool
 	}{
 		{
 			funcName:   "IsLocalUser",
 			scenario:   "local user",
-			isUserFunc: IsLocalUser,
+			isUserFunc: authz.IsLocalUser,
 			authCtx:    localIdentity,
 			want:       true,
 		},
 		{
 			funcName:   "IsLocalUser",
 			scenario:   "remote user",
-			isUserFunc: IsLocalUser,
+			isUserFunc: authz.IsLocalUser,
 			authCtx:    remoteIdentity,
 		},
 		{
 			funcName:   "IsLocalUser",
 			scenario:   "system user",
-			isUserFunc: IsLocalUser,
+			isUserFunc: authz.IsLocalUser,
 			authCtx:    systemIdentity,
 		},
 		{
 			funcName:   "IsRemoteUser",
 			scenario:   "local user",
-			isUserFunc: IsRemoteUser,
+			isUserFunc: authz.IsRemoteUser,
 			authCtx:    localIdentity,
 		},
 		{
 			funcName:   "IsRemoteUser",
 			scenario:   "remote user",
-			isUserFunc: IsRemoteUser,
+			isUserFunc: authz.IsRemoteUser,
 			authCtx:    remoteIdentity,
 			want:       true,
 		},
 		{
 			funcName:   "IsRemoteUser",
 			scenario:   "system user",
-			isUserFunc: IsRemoteUser,
+			isUserFunc: authz.IsRemoteUser,
 			authCtx:    systemIdentity,
 		},
 
 		{
 			funcName:   "IsLocalOrRemoteUser",
 			scenario:   "local user",
-			isUserFunc: IsLocalOrRemoteUser,
+			isUserFunc: authz.IsLocalOrRemoteUser,
 			authCtx:    localIdentity,
 			want:       true,
 		},
 		{
 			funcName:   "IsLocalOrRemoteUser",
 			scenario:   "remote user",
-			isUserFunc: IsLocalOrRemoteUser,
+			isUserFunc: authz.IsLocalOrRemoteUser,
 			authCtx:    remoteIdentity,
 			want:       true,
 		},
 		{
 			funcName:   "IsLocalOrRemoteUser",
 			scenario:   "system user",
-			isUserFunc: IsLocalOrRemoteUser,
+			isUserFunc: authz.IsLocalOrRemoteUser,
 			authCtx:    systemIdentity,
 		},
 	}
@@ -1086,7 +1129,7 @@ func TestConnectionMetadata(t *testing.T) {
 		expectedConnectionMetadata apievents.ConnectionMetadata
 	}{
 		"with client address": {
-			ctx:                        ContextWithClientSrcAddr(context.Background(), &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0), Port: 1234}),
+			ctx:                        authz.ContextWithClientSrcAddr(context.Background(), &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0), Port: 1234}),
 			expectedConnectionMetadata: apievents.ConnectionMetadata{RemoteAddr: "10.255.0.0:1234"},
 		},
 		"empty client address": {
@@ -1095,7 +1138,7 @@ func TestConnectionMetadata(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			require.Empty(t, cmp.Diff(test.expectedConnectionMetadata, ConnectionMetadata(test.ctx)))
+			require.Empty(t, cmp.Diff(test.expectedConnectionMetadata, authz.ConnectionMetadata(test.ctx)))
 		})
 	}
 }
@@ -1127,7 +1170,7 @@ type testClient struct {
 	types.Events
 }
 
-func newTestResources(t *testing.T) (*testClient, *services.LockWatcher, Authorizer) {
+func newTestResources(t *testing.T) (*testClient, *services.LockWatcher, authz.Authorizer) {
 	backend, err := memory.New(memory.Config{})
 	require.NoError(t, err)
 
@@ -1173,7 +1216,7 @@ func newTestResources(t *testing.T) (*testClient, *services.LockWatcher, Authori
 	})
 	require.NoError(t, err)
 
-	authorizer, err := NewAuthorizer(AuthorizerOpts{
+	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
 		ClusterName: clusterName,
 		AccessPoint: client,
 		LockWatcher: lockWatcher,
@@ -1183,32 +1226,6 @@ func newTestResources(t *testing.T) (*testClient, *services.LockWatcher, Authori
 	return client, lockWatcher, authorizer
 }
 
-func createUserAndRole(client *testClient, username string, allowedLogins []string, allowRules []types.Rule) (types.User, types.Role, error) {
-	ctx := context.Background()
-	user, err := types.NewUser(username)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	role := services.RoleForUser(user)
-	role.SetLogins(types.Allow, allowedLogins)
-	if allowRules != nil {
-		role.SetRules(types.Allow, allowRules)
-	}
-
-	role, err = client.UpsertRole(ctx, role)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	user.AddRole(role.GetName())
-	user, err = client.UpsertUser(ctx, user)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	return user, role, nil
-}
-
 func resourceDiff(res1, res2 types.Resource) string {
 	return cmp.Diff(res1, res2,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision", "Namespace"),
diff --git a/lib/authz/scoped.go b/lib/authz/scoped.go
new file mode 100644
index 0000000000000..92d6fbe82a9c3
--- /dev/null
+++ b/lib/authz/scoped.go
@@ -0,0 +1,201 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package authz
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/scopes"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/readonly"
+)
+
+// ScopedAuthorizer provides an equivalent to the Authorizer.Authorize method intended for use
+// with scoped identities.
+type ScopedAuthorizer interface {
+	// AuthorizeScoped authorizes a potentially scoped identity and returns a [ScopedContext]. Under the hood, this may
+	// be either a scoped or unscoped authorization depending on the identity provided in the context.
+	// NOTE: the scoped authorization pathway is a prototype and does not yet have feature parity with the
+	// unscoped authorization pathway. this method is intended to be safe to convert existing uses of
+	// Authorizer.Authorize without losing enforcement of controls for unscoped identities, but care must be
+	// taken to ensure that any required controls are implemented for scoped identities before switching
+	// to use of this method.
+	AuthorizeScoped(ctx context.Context) (*ScopedContext, error)
+}
+
+// NewScopedAuthorizer returns a new scoped authorizer
+func NewScopedAuthorizer(opts AuthorizerOpts) (ScopedAuthorizer, error) {
+	// TODO(fspmarshall/scopes): either fully bifurcate the authorizer and scoped authorizer, or
+	// refactor s.t. they share a common builder and implementation.
+	if opts.ScopedRoleReader == nil {
+		return nil, trace.BadParameter("scoped role reader is required to create a scoped authorizer")
+	}
+
+	return newAuthorizer(opts)
+}
+
+func (a *authorizer) AuthorizeScoped(ctx context.Context) (splitCtx *ScopedContext, err error) {
+	authCtx, err := a.Authorize(ctx)
+	if err != nil {
+		if errors.Is(err, services.ErrScopedIdentity) {
+			return a.authorizeScoped(ctx)
+		}
+		return nil, trace.Wrap(err)
+	}
+	return ScopedContextFromUnscopedContext(authCtx), nil
+}
+
+// ScopedContextFromUnscopedContext constructs a ScopedContext from an existing unscoped Context. Useful in places
+// where unscoped logic needs to invoke scoped logic.
+func ScopedContextFromUnscopedContext(authCtx *Context) *ScopedContext {
+	return &ScopedContext{
+		User:            authCtx.User,
+		Identity:        authCtx.Identity,
+		CheckerContext:  services.NewUnscopedSplitAccessCheckerContext(authCtx.Checker),
+		unscopedContext: authCtx,
+	}
+}
+
+// authorizeScoped authorizes a scoped identity. This function should generally only be called by methods that
+// implement scoping support, and only if [services.ErrScopedIdentity] is returned by [Authorize].
+// XXX: this is a protoype implementation and does not have feature parity with standard Authorize. Scopes are
+// a work in progress feature. This method does not function without the unstable scope flag being set, and must
+// remain behind the feature flag until core functionality is finalized.
+func (a *authorizer) authorizeScoped(ctx context.Context) (scopedCtx *ScopedContext, err error) {
+	defer func() {
+		if err != nil {
+			err = a.convertAuthorizerError(err)
+		}
+	}()
+
+	if !scopes.FeatureEnabled() {
+		return nil, trace.AccessDenied("cannot authorize scoped identity, scoping is not enabled for this cluster")
+	}
+
+	if ctx == nil {
+		return nil, trace.AccessDenied("missing authentication context")
+	}
+
+	userI, err := UserFromContext(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	user, ok := userI.(LocalUser)
+	if !ok {
+		return nil, trace.AccessDenied("scoped authorization is only supported for local users, got %T", userI)
+	}
+
+	if user.Identity.ScopePin == nil {
+		return nil, trace.AccessDenied("scoped authorization is not supported for unscoped identities")
+	}
+
+	if a.scopedRoleReader == nil {
+		return nil, trace.AccessDenied("authorizer not configured for scoped authorization")
+	}
+
+	scopedCtx, err = scopedContextForLocalUser(ctx, user, a.accessPoint, a.scopedRoleReader, a.clusterName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// TODO(fspmarshall/scopes): include controls like locks/device enforcement here or (better), refactor to
+	// have enforcement use a common implementation across scoped/unscoped authorize variants.
+
+	return scopedCtx, nil
+}
+
+func scopedContextForLocalUser(ctx context.Context, u LocalUser, accessPoint AuthorizerAccessPoint, reader services.ScopedRoleReader, clusterName string) (*ScopedContext, error) {
+	user, accessInfo, err := resolveLocalUser(ctx, u, accessPoint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	checkerContext, err := services.NewScopedAccessCheckerContext(ctx, accessInfo, clusterName, reader)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &ScopedContext{
+		User:           user,
+		Identity:       u,
+		CheckerContext: services.NewScopedSplitAccessCheckerContext(checkerContext),
+	}, nil
+}
+
+// ScopedContext is the scoped authorization context returned by [ScopedAuthorizer.AuthorizeScoped]. It provides
+// access-checking materials for use in making authorization decisions in contexts where the caller may be using
+// a scoped identity. This type does not yet have feature parity with the unscoped [Context] type, and should be
+// used with care until scopes as a feature is more mature.
+type ScopedContext struct {
+	// User describes the authenticated user.
+	User types.User
+	// Identity holds the caller identity
+	Identity IdentityGetter
+	// CheckerContext is the top-level access checker for the authenticated identity. This types serves a similar
+	// purpose to [services.AccessChecker] but requires different usage patterns to accommodate the more complex
+	// scoped decision model.
+	CheckerContext *services.SplitAccessCheckerContext
+	// unscopedContext is the context derived from unscoped authorization, if available. This will be nil
+	// if the calling identity was scoped.
+	unscopedContext *Context
+}
+
+// UnscopedContext returns the unscoped authorization context if available. In general, it is best to avoid
+// relying on this method as it breaks the abstraction of scoped authorization. However, this may be useful
+// for specific features/methods that have not yet been adapted to support scoped identities, but are implemented
+// in a context that has already begun being ported over to being scope-aware.
+func (s *ScopedContext) UnscopedContext() (*Context, bool) {
+	return s.unscopedContext, s.unscopedContext != nil
+}
+
+// RuleContext returns the standard services.Context used for resource-independent rule
+// evaluation.
+func (s *ScopedContext) RuleContext() services.Context {
+	return services.Context{
+		User: s.User,
+	}
+}
+
+// GetDisconnectCertExpiry is equivalent to [Context.GetDisconnectCertExpiry], but will
+// defer exclusively to cluster-level configuration if the underlying identity is scoped.
+func (s *ScopedContext) GetDisconnectCertExpiry(authPref readonly.AuthPreference) time.Time {
+	if s.unscopedContext != nil {
+		return s.unscopedContext.GetDisconnectCertExpiry(authPref)
+	}
+
+	if !authPref.GetDisconnectExpiredCert() {
+		return time.Time{}
+	}
+
+	identity := s.Identity.GetIdentity()
+	if !identity.PreviousIdentityExpires.IsZero() {
+		// If this is a short-lived mfa verified cert, return the certificate extension
+		// that holds its issuing certificates expiry value.
+		return identity.PreviousIdentityExpires
+	}
+
+	// Otherwise, return the current certificates expiration
+	return identity.Expires
+}
diff --git a/lib/automaticupgrades/basichttp/servermock.go b/lib/automaticupgrades/basichttp/servermock.go
deleted file mode 100644
index 95de8a644e478..0000000000000
--- a/lib/automaticupgrades/basichttp/servermock.go
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package basichttp
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// ServerMock is a HTTP server whose response can be controlled from the tests.
-// This is used to mock external dependencies like s3 buckets or a remote HTTP server.
-type ServerMock struct {
-	Srv *httptest.Server
-
-	t        *testing.T
-	code     int
-	response string
-	path     string
-}
-
-// SetResponse sets the ServerMock's response.
-func (m *ServerMock) SetResponse(t *testing.T, code int, response string) {
-	m.t = t
-	m.code = code
-	m.response = response
-}
-
-// ServeHTTP implements the http.Handler interface.
-func (m *ServerMock) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	require.Equal(m.t, m.path, r.URL.Path)
-	w.WriteHeader(m.code)
-	_, err := io.WriteString(w, m.response)
-	require.NoError(m.t, err)
-}
-
-// NewServerMock builds and returns a
-func NewServerMock(path string) *ServerMock {
-	mock := ServerMock{path: path}
-	mock.Srv = httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
-	return &mock
-}
diff --git a/lib/automaticupgrades/maintenance/basichttp_test.go b/lib/automaticupgrades/maintenance/basichttp_test.go
index 05281aa4dd7f4..cb2d9fdac9b89 100644
--- a/lib/automaticupgrades/maintenance/basichttp_test.go
+++ b/lib/automaticupgrades/maintenance/basichttp_test.go
@@ -20,7 +20,9 @@ package maintenance
 
 import (
 	"context"
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
 
@@ -31,10 +33,44 @@ import (
 	"github.com/gravitational/teleport/lib/automaticupgrades/constants"
 )
 
+// ServerMock is a HTTP server whose response can be controlled from the tests.
+// This is used to mock external dependencies like s3 buckets or a remote HTTP server.
+type ServerMock struct {
+	Srv *httptest.Server
+
+	t        *testing.T
+	code     int
+	response string
+	path     string
+}
+
+// SetResponse sets the ServerMock's response.
+func (m *ServerMock) SetResponse(t *testing.T, code int, response string) {
+	m.t = t
+	m.code = code
+	m.response = response
+}
+
+// ServeHTTP implements the http.Handler interface.
+func (m *ServerMock) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	require.Equal(m.t, m.path, r.URL.Path)
+	w.WriteHeader(m.code)
+	_, err := io.WriteString(w, m.response)
+	require.NoError(m.t, err)
+}
+
+// NewServerMock builds a [ServerMock] that only
+// responds to requests for the given path.
+func NewServerMock(path string) *ServerMock {
+	mock := ServerMock{path: path}
+	mock.Srv = httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
+	return &mock
+}
+
 const basicHTTPTestPath = "/v1/cloud-stable"
 
 func Test_basicHTTPMaintenanceClient_Get(t *testing.T) {
-	mock := basichttp2.NewServerMock(basicHTTPTestPath + "/" + constants.MaintenancePath)
+	mock := NewServerMock(basicHTTPTestPath + "/" + constants.MaintenancePath)
 	t.Cleanup(mock.Srv.Close)
 	serverURL, err := url.Parse(mock.Srv.URL)
 	serverURL.Path = basicHTTPTestPath
diff --git a/lib/automaticupgrades/version/basichttp_test.go b/lib/automaticupgrades/version/basichttp_test.go
index ac77624a95867..8a2cfacf96a9d 100644
--- a/lib/automaticupgrades/version/basichttp_test.go
+++ b/lib/automaticupgrades/version/basichttp_test.go
@@ -20,7 +20,9 @@ package version
 
 import (
 	"context"
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
 
@@ -32,10 +34,44 @@ import (
 	"github.com/gravitational/teleport/lib/automaticupgrades/constants"
 )
 
+// ServerMock is a HTTP server whose response can be controlled from the tests.
+// This is used to mock external dependencies like s3 buckets or a remote HTTP server.
+type ServerMock struct {
+	Srv *httptest.Server
+
+	t        *testing.T
+	code     int
+	response string
+	path     string
+}
+
+// SetResponse sets the ServerMock's response.
+func (m *ServerMock) SetResponse(t *testing.T, code int, response string) {
+	m.t = t
+	m.code = code
+	m.response = response
+}
+
+// ServeHTTP implements the http.Handler interface.
+func (m *ServerMock) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	require.Equal(m.t, m.path, r.URL.Path)
+	w.WriteHeader(m.code)
+	_, err := io.WriteString(w, m.response)
+	require.NoError(m.t, err)
+}
+
+// NewServerMock builds a [ServerMock] that only
+// responds to requests for the given path.
+func NewServerMock(path string) *ServerMock {
+	mock := ServerMock{path: path}
+	mock.Srv = httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
+	return &mock
+}
+
 const basicHTTPTestPath = "/v1/cloud-stable"
 
 func Test_basicHTTPVersionClient_Get(t *testing.T) {
-	mock := basichttp2.NewServerMock(basicHTTPTestPath + "/" + constants.VersionPath)
+	mock := NewServerMock(basicHTTPTestPath + "/" + constants.VersionPath)
 	t.Cleanup(mock.Srv.Close)
 	serverURL, err := url.Parse(mock.Srv.URL)
 	serverURL.Path = basicHTTPTestPath
diff --git a/lib/autoupdate/agent/config.go b/lib/autoupdate/agent/config.go
index 61f5a91734c72..23b70b44038e8 100644
--- a/lib/autoupdate/agent/config.go
+++ b/lib/autoupdate/agent/config.go
@@ -24,6 +24,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"runtime"
 	"strings"
 	"time"
 
@@ -39,15 +40,16 @@ const (
 )
 
 const (
-	// updateConfigName specifies the name of the file inside versionsDirName containing configuration for the teleport update.
-	updateConfigName = "update.yaml"
-
-	// UpdateConfig metadata
-	updateConfigVersion = "v1"
-	updateConfigKind    = "update_config"
+	// UpdateConfigName specifies the name of the file inside versionsDirName containing configuration for the teleport update.
+	UpdateConfigName = "update.yaml"
+	// UpdateConfigV1 specifies the version of the update.yaml file.
+	UpdateConfigV1 = "v1"
+	// UpdateConfigKind specifies the kind of the update.yaml file.
+	UpdateConfigKind = "update_config"
 )
 
 // UpdateConfig describes the update.yaml file schema.
+// Pointer values should be replaced and not mutated, see Copy.
 type UpdateConfig struct {
 	// Version of the configuration file
 	Version string `yaml:"version"`
@@ -59,7 +61,16 @@ type UpdateConfig struct {
 	Status UpdateStatus `yaml:"status"`
 }
 
+// Copy an UpdateConfig. Pointers are not copied.
+func (cfg *UpdateConfig) Copy() *UpdateConfig {
+	if cfg == nil {
+		return &UpdateConfig{}
+	}
+	return toPtr(*cfg)
+}
+
 // UpdateSpec describes the spec field in update.yaml.
+// Pointer values should be replaced and not mutated, see Copy.
 type UpdateSpec struct {
 	// Proxy address
 	Proxy string `yaml:"proxy"`
@@ -73,9 +84,13 @@ type UpdateSpec struct {
 	Enabled bool `yaml:"enabled"`
 	// Pinned controls whether the active_version is pinned.
 	Pinned bool `yaml:"pinned"`
+	// SELinuxSSH controls whether an SELinux module will be installed to
+	// constrain Teleport SSH.
+	SELinuxSSH bool `yaml:"selinux_ssh,omitempty"`
 }
 
 // UpdateStatus describes the status field in update.yaml.
+// Pointer values should be replaced and not mutated, see Copy.
 type UpdateStatus struct {
 	// IDFile is the path to a temporary file containing the updater ID.
 	IDFile string `yaml:"id_file,omitempty"`
@@ -153,6 +168,7 @@ func NewRevisionFromDir(dir string) (Revision, error) {
 }
 
 // Dir returns the directory path name of a Revision.
+// These are unambiguous for semver and may be parsed with NewRevisionFromDir.
 func (r Revision) Dir() string {
 	// Do not change the order of these statements.
 	// Otherwise, installed versions will no longer match update.yaml.
@@ -167,6 +183,7 @@ func (r Revision) Dir() string {
 }
 
 // String returns a human-readable description of a Teleport revision.
+// These are semver-ambiguous and should not be parsed.
 func (r Revision) String() string {
 	if flags := r.Flags.Strings(); len(flags) > 0 {
 		return fmt.Sprintf("%s+%s", r.Version, strings.Join(flags, "+"))
@@ -179,8 +196,8 @@ func readConfig(path string) (*UpdateConfig, error) {
 	f, err := os.Open(path)
 	if errors.Is(err, fs.ErrNotExist) {
 		return &UpdateConfig{
-			Version: updateConfigVersion,
-			Kind:    updateConfigKind,
+			Version: UpdateConfigV1,
+			Kind:    UpdateConfigKind,
 		}, nil
 	}
 	if err != nil {
@@ -191,10 +208,10 @@ func readConfig(path string) (*UpdateConfig, error) {
 	if err := yaml.NewDecoder(f).Decode(&cfg); err != nil {
 		return nil, trace.Wrap(err, "failed to parse")
 	}
-	if k := cfg.Kind; k != updateConfigKind {
+	if k := cfg.Kind; k != UpdateConfigKind {
 		return nil, trace.Errorf("invalid kind %s", k)
 	}
-	if v := cfg.Version; v != updateConfigVersion {
+	if v := cfg.Version; v != UpdateConfigV1 {
 		return nil, trace.Errorf("invalid version %s", v)
 	}
 	return &cfg, nil
@@ -207,7 +224,7 @@ func writeConfig(filename string, cfg *UpdateConfig) error {
 	}))
 }
 
-func validateConfigSpec(spec *UpdateSpec, override OverrideConfig) error {
+func updateConfigSpec(spec *UpdateSpec, override OverrideConfig) error {
 	if override.Proxy != "" {
 		spec.Proxy = override.Proxy
 	}
@@ -226,6 +243,12 @@ func validateConfigSpec(spec *UpdateSpec, override OverrideConfig) error {
 	if override.Pinned {
 		spec.Pinned = true
 	}
+	if override.SELinuxSSHChanged {
+		spec.SELinuxSSH = override.SELinuxSSH
+	}
+	if spec.SELinuxSSH && runtime.GOOS != "linux" {
+		return trace.BadParameter("SELinux is only supported on Linux")
+	}
 	return nil
 }
 
diff --git a/lib/autoupdate/agent/config_test.go b/lib/autoupdate/agent/config_test.go
index d301a16a0b1fa..0207a779c0e13 100644
--- a/lib/autoupdate/agent/config_test.go
+++ b/lib/autoupdate/agent/config_test.go
@@ -223,7 +223,7 @@ func TestValidateConfigSpec(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			err := validateConfigSpec(&tt.config, OverrideConfig{UpdateSpec: tt.override})
+			err := updateConfigSpec(&tt.config, OverrideConfig{UpdateSpec: tt.override})
 			if tt.errMatch != "" {
 				require.ErrorContains(t, err, tt.errMatch)
 				return
diff --git a/lib/autoupdate/agent/installer.go b/lib/autoupdate/agent/installer.go
index ae25003e7f639..97239d69f74d5 100644
--- a/lib/autoupdate/agent/installer.go
+++ b/lib/autoupdate/agent/installer.go
@@ -36,7 +36,6 @@ import (
 
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/autoupdate"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -57,10 +56,35 @@ const (
 const (
 	// serviceDir contains the relative path to the Teleport SystemD service dir.
 	serviceDir = "lib/systemd/system"
-	// serviceName contains the upstream name of the Teleport SystemD service file.
-	serviceName = "teleport.service"
+	// teleportServiceName contains the upstream name of the Teleport SystemD service file.
+	teleportServiceName = "teleport.service"
 )
 
+// ServiceFile represents a systemd service file for a Teleport binary.
+//
+// ExampleName and ExampleFunc are used to parse an example configuration
+// file and copy it into the service directory. This mechanism of service
+// file generation is only provided to support downgrading to older versions
+// of the updater that do not install the service during the setup phase using
+// logic from lib/config.
+type ServiceFile struct {
+	// Path is the full path to the linked service file.
+	Path string
+	// Binary is the corresponding linked binary name.
+	Binary string
+	// ExampleName is the name of the example service file.
+	// Deprecated.
+	ExampleName string
+	// ExampleFunc can be used to create the service during linking from
+	// an archived example, instead of creating it during the setup phase.
+	// Deprecated.
+	ExampleFunc ExampleFunc
+}
+
+// A ExampleFunc generates a systemd service by replacing an example file.
+// Deprecated.
+type ExampleFunc func(cfg []byte, path string, flags autoupdate.InstallFlags) []byte
+
 // LocalInstaller manages the creation and removal of installations
 // of Teleport.
 // SetRequiredUmask must be called before any methods are executed.
@@ -68,11 +92,11 @@ type LocalInstaller struct {
 	// InstallDir contains each installation, named by version.
 	InstallDir string
 	// TargetServiceFile contains a copy of the linked installation's systemd service.
-	TargetServiceFile string
+	TargetServices []ServiceFile
 	// SystemBinDir contains binaries for the system (packaged) install of Teleport.
 	SystemBinDir string
-	// SystemServiceFile contains the systemd service file for the system (packaged) install of Teleport.
-	SystemServiceFile string
+	// SystemServiceDir contains the systemd service directory for the system (packaged) install of Teleport.
+	SystemServiceDir string
 	// HTTP is an HTTP client for downloading Teleport.
 	HTTP *http.Client
 	// Log contains a logger.
@@ -81,8 +105,6 @@ type LocalInstaller struct {
 	ReservedFreeTmpDisk uint64
 	// ReservedFreeInstallDisk is the amount of disk that must remain free in the install directory.
 	ReservedFreeInstallDisk uint64
-	// TransformService transforms the systemd service during copying.
-	TransformService func(cfg []byte, pathDir string, flags autoupdate.InstallFlags) []byte
 	// ValidateBinary returns true if a file is a linkable binary, or
 	// false if a file should not be linked.
 	ValidateBinary func(ctx context.Context, path string) (bool, error)
@@ -358,9 +380,10 @@ func tgzExtractPaths(ent bool) []utils.ExtractPath {
 		prefix += "-ent"
 	}
 	return []utils.ExtractPath{
-		{Src: path.Join(prefix, "examples/systemd/teleport.service"), Dst: filepath.Join(serviceDir, serviceName), DirMode: systemDirMode},
+		{Src: path.Join(prefix, "examples/systemd/teleport.service"), Dst: filepath.Join(serviceDir, teleportServiceName), DirMode: systemDirMode},
 		{Src: path.Join(prefix, "examples"), Skip: true, DirMode: systemDirMode},
 		{Src: path.Join(prefix, "install"), Skip: true, DirMode: systemDirMode},
+		{Src: path.Join(prefix, "install-selinux.sh"), Skip: true, DirMode: systemDirMode},
 		{Src: path.Join(prefix, "README.md"), Dst: "share/README.md", DirMode: systemDirMode},
 		{Src: path.Join(prefix, "CHANGELOG.md"), Dst: "share/CHANGELOG.md", DirMode: systemDirMode},
 		{Src: path.Join(prefix, "VERSION"), Dst: "share/VERSION", DirMode: systemDirMode},
@@ -416,7 +439,7 @@ func (li *LocalInstaller) Link(ctx context.Context, rev Revision, pathDir string
 	}
 	revert, err = li.forceLinks(ctx,
 		filepath.Join(versionDir, "bin"),
-		filepath.Join(versionDir, serviceDir, serviceName),
+		filepath.Join(versionDir, serviceDir),
 		pathDir, force, rev.Flags,
 	)
 	if err != nil {
@@ -432,7 +455,7 @@ func (li *LocalInstaller) Link(ctx context.Context, rev Revision, pathDir string
 func (li *LocalInstaller) LinkSystem(ctx context.Context) (revert func(context.Context) bool, err error) {
 	// The system package service file is always removed without flags, so pass
 	// no flags here to match the behavior.
-	revert, err = li.forceLinks(ctx, li.SystemBinDir, li.SystemServiceFile, defaultPathDir, false, 0)
+	revert, err = li.forceLinks(ctx, li.SystemBinDir, li.SystemServiceDir, defaultPathDir, false, 0)
 	return revert, trace.Wrap(err)
 }
 
@@ -446,7 +469,7 @@ func (li *LocalInstaller) TryLink(ctx context.Context, revision Revision, pathDi
 	}
 	return trace.Wrap(li.tryLinks(ctx,
 		filepath.Join(versionDir, "bin"),
-		filepath.Join(versionDir, serviceDir, serviceName),
+		filepath.Join(versionDir, serviceDir),
 		pathDir, revision.Flags,
 	))
 }
@@ -457,7 +480,7 @@ func (li *LocalInstaller) TryLink(ctx context.Context, revision Revision, pathDi
 func (li *LocalInstaller) TryLinkSystem(ctx context.Context) error {
 	// The system package service file is always removed without flags, so pass
 	// no flags here to match the behavior.
-	return trace.Wrap(li.tryLinks(ctx, li.SystemBinDir, li.SystemServiceFile, defaultPathDir, 0))
+	return trace.Wrap(li.tryLinks(ctx, li.SystemBinDir, li.SystemServiceDir, defaultPathDir, 0))
 }
 
 // Unlink unlinks a version from pathDir and TargetServiceFile.
@@ -467,19 +490,13 @@ func (li *LocalInstaller) Unlink(ctx context.Context, rev Revision, pathDir stri
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	return trace.Wrap(li.removeLinks(ctx,
-		filepath.Join(versionDir, "bin"),
-		filepath.Join(versionDir, serviceDir, serviceName),
-		pathDir, rev.Flags,
-	))
+	return trace.Wrap(li.removeLinks(ctx, filepath.Join(versionDir, "bin"), pathDir))
 }
 
 // UnlinkSystem unlinks the system (package) version from defaultPathDir and TargetServiceFile.
 // See Installer interface for additional specs.
 func (li *LocalInstaller) UnlinkSystem(ctx context.Context) error {
-	// The system package service file is always linked without flags, so pass
-	// no flags here to match the behavior.
-	return trace.Wrap(li.removeLinks(ctx, li.SystemBinDir, li.SystemServiceFile, defaultPathDir, 0))
+	return trace.Wrap(li.removeLinks(ctx, li.SystemBinDir, defaultPathDir))
 }
 
 // symlink from oldname to newname
@@ -500,7 +517,7 @@ type smallFile struct {
 // If successful, forceLinks may also be reverted after it returns by calling revert.
 // The revert function returns true if reverting succeeds.
 // If force is true, non-link files will be overwritten.
-func (li *LocalInstaller) forceLinks(ctx context.Context, srcBinDir, srcSvcFile, dstBinDir string, force bool, flags autoupdate.InstallFlags) (revert func(context.Context) bool, err error) {
+func (li *LocalInstaller) forceLinks(ctx context.Context, srcBinDir, srcSvcDir, dstBinDir string, force bool, flags autoupdate.InstallFlags) (revert func(context.Context) bool, err error) {
 	// setup revert function
 	var (
 		revertLinks []symlink
@@ -552,9 +569,11 @@ func (li *LocalInstaller) forceLinks(ctx context.Context, srcBinDir, srcSvcFile,
 	if err != nil {
 		return revert, trace.Wrap(err)
 	}
-	err = os.MkdirAll(filepath.Dir(li.TargetServiceFile), systemDirMode)
-	if err != nil {
-		return revert, trace.Wrap(err)
+	for _, s := range li.TargetServices {
+		err = os.MkdirAll(filepath.Dir(s.Path), systemDirMode)
+		if err != nil {
+			return revert, trace.Wrap(err)
+		}
 	}
 
 	// create binary links
@@ -588,27 +607,40 @@ func (li *LocalInstaller) forceLinks(ctx context.Context, srcBinDir, srcSvcFile,
 		return revert, trace.Wrap(ErrNoBinaries)
 	}
 
-	// create systemd service file
+	// process systemd service files
 
-	orig, err := li.forceCopyService(li.TargetServiceFile, srcSvcFile, maxServiceFileSize, dstBinDir, flags)
-	if err != nil && !errors.Is(err, os.ErrExist) {
-		return revert, trace.Wrap(err, "failed to copy service")
-	}
-	if orig != nil {
-		revertFiles = append(revertFiles, *orig)
+	for _, s := range li.TargetServices {
+		orig, err := copyService(s, srcSvcDir, dstBinDir, flags)
+		if err != nil && !errors.Is(err, os.ErrExist) {
+			return revert, trace.Wrap(err, "failed to copy service %s", filepath.Base(s.Path))
+		}
+		if orig != nil {
+			revertFiles = append(revertFiles, *orig)
+		}
 	}
+
 	return revert, nil
 }
 
-// forceCopyService uses forceCopy to copy a systemd service file from src to dst.
+// copyService copies a systemd service file from src to dst.
 // The contents of both src and dst must be smaller than n.
-// See forceCopy for more details.
-func (li *LocalInstaller) forceCopyService(dst, src string, n int64, dstBinDir string, flags autoupdate.InstallFlags) (orig *smallFile, err error) {
-	srcData, err := readFileAtMost(src, n)
-	if err != nil {
-		return nil, trace.Wrap(err)
+//
+// Copied data is processed by s.ExampleFunc.
+// If s.ExampleFunc nil, no data is copied, but the original file contents are still returned.
+//
+// See prepCopy and forceCopy for more details.
+func copyService(s ServiceFile, exampleDir string, dstBinDir string, flags autoupdate.InstallFlags) (orig *smallFile, err error) {
+	const n = maxServiceFileSize
+	if s.ExampleFunc != nil {
+		srcData, err := readFileAtMost(filepath.Join(exampleDir, s.ExampleName), n)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		orig, err = forceCopy(s.Path, s.ExampleFunc(srcData, dstBinDir, flags), n)
+		return orig, trace.Wrap(err)
 	}
-	return forceCopy(dst, li.TransformService(srcData, dstBinDir, flags), n)
+	orig, err = prepCopy(s.Path, n)
+	return orig, trace.Wrap(err)
 }
 
 // forceLink attempts to create a symlink, atomically replacing an existing link if already present.
@@ -642,27 +674,38 @@ func forceLink(oldname, newname string, force bool) (orig string, err error) {
 // If an irregular file, too large file, or directory exists in dst already, forceCopy errors.
 // If the file is already present with the desired contents, forceCopy returns os.ErrExist.
 func forceCopy(dst string, srcData []byte, n int64) (orig *smallFile, err error) {
+	orig, err = prepCopy(dst, n)
+	if err != nil {
+		return orig, trace.Wrap(err)
+	}
+	if orig != nil && bytes.Equal(srcData, orig.data) {
+		return nil, trace.Wrap(os.ErrExist)
+	}
+	err = writeFileAtomicWithinDir(dst, srcData, configFileMode)
+	if err != nil {
+		return orig, trace.Wrap(err)
+	}
+	return orig, nil
+}
+
+// prepCopy validates and returns a preserved original copy of a file with
+// length <= n at the path specified by dst.
+func prepCopy(dst string, n int64) (orig *smallFile, err error) {
 	fi, err := os.Lstat(dst)
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
+	if errors.Is(err, os.ErrNotExist) {
+		return orig, nil
+	}
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err == nil {
-		orig = &smallFile{
-			name: dst,
-			mode: fi.Mode(),
-		}
-		if !orig.mode.IsRegular() {
-			return nil, trace.Errorf("refusing to replace irregular file at %s", dst)
-		}
-		orig.data, err = readFileAtMost(dst, n)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if bytes.Equal(srcData, orig.data) {
-			return nil, trace.Wrap(os.ErrExist)
-		}
+	orig = &smallFile{
+		name: dst,
+		mode: fi.Mode(),
 	}
-	err = writeFileAtomicWithinDir(dst, srcData, configFileMode)
+	if !orig.mode.IsRegular() {
+		return nil, trace.Errorf("refusing to replace irregular file at %s", dst)
+	}
+	orig.data, err = readFileAtMost(dst, n)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -680,8 +723,7 @@ func readFileAtMost(name string, n int64) ([]byte, error) {
 	return data, trace.Wrap(err)
 }
 
-func (li *LocalInstaller) removeLinks(ctx context.Context, srcBinDir, srcSvcFile, dstBinDir string, flags autoupdate.InstallFlags) error {
-	removeService := false
+func (li *LocalInstaller) removeLinks(ctx context.Context, srcBinDir, dstBinDir string) error {
 	entries, err := os.ReadDir(srcBinDir)
 	if err != nil {
 		return trace.Wrap(err, "failed to find Teleport binary directory")
@@ -710,34 +752,41 @@ func (li *LocalInstaller) removeLinks(ctx context.Context, srcBinDir, srcSvcFile
 			li.Log.ErrorContext(ctx, "Unable to remove link.", "oldname", oldname, "newname", newname, errorKey, err)
 			continue
 		}
-		if filepath.Base(newname) == teleport.ComponentTeleport {
-			removeService = true
+
+		for _, s := range li.TargetServices {
+			if filepath.Base(newname) != s.Binary {
+				continue
+			}
+			// binRev is either the version or "system"
+			binRev := filepath.Base(filepath.Dir(filepath.Dir(oldname)))
+			rev, err := NewRevisionFromDir(binRev)
+			if err != nil {
+				li.Log.DebugContext(ctx, "Service not present.", "path", s.Path)
+				continue
+			}
+			revMarker := genMarker(rev)
+			diskMarker, err := readFileLimit(s.Path, int64(len(revMarker)))
+			if errors.Is(err, os.ErrNotExist) {
+				li.Log.DebugContext(ctx, "Service not present.", "path", s.Path)
+				continue
+			}
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			// Note that old versions of teleport-update will install services without the marker.
+			// Certain version combinations (before and after this commit) may leave services behind
+			// if they are not replaced by the new version of teleport-update. This should only impact
+			// explicit system package unlinking, which is rarely used.
+			if string(diskMarker) != revMarker {
+				li.Log.WarnContext(ctx, "Removed binary link, but skipping removal of custom service that does not match the binary.",
+					"service", filepath.Base(s.Path), "binary", filepath.Base(newname))
+				continue
+			}
+			if err := os.Remove(s.Path); err != nil {
+				return trace.Wrap(err, "error removing copy of %s", filepath.Base(s.Path))
+			}
 		}
 	}
-	// only remove service if teleport was removed
-	if !removeService {
-		li.Log.DebugContext(ctx, "Teleport binary not unlinked. Skipping removal of teleport.service.")
-		return nil
-	}
-	srcBytes, err := readFileAtMost(srcSvcFile, maxServiceFileSize)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	dstBytes, err := readFileAtMost(li.TargetServiceFile, maxServiceFileSize)
-	if errors.Is(err, os.ErrNotExist) {
-		li.Log.DebugContext(ctx, "Service not present.", "path", li.TargetServiceFile)
-		return nil
-	}
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if !bytes.Equal(li.TransformService(srcBytes, dstBinDir, flags), dstBytes) {
-		li.Log.WarnContext(ctx, "Removed teleport binary link, but skipping removal of custom teleport.service: the service file does not match the reference file for this version. The file might have been manually edited.")
-		return nil
-	}
-	if err := os.Remove(li.TargetServiceFile); err != nil {
-		return trace.Wrap(err, "error removing copy of %s", filepath.Base(li.TargetServiceFile))
-	}
 	return nil
 }
 
@@ -745,7 +794,7 @@ func (li *LocalInstaller) removeLinks(ctx context.Context, srcBinDir, srcSvcFile
 // Existing links that point to files outside binDir or svcDir, as well as existing non-link files, will error.
 // tryLinks will not attempt to create any links if linking could result in an error.
 // However, concurrent changes to links may result in an error with partially-complete linking.
-func (li *LocalInstaller) tryLinks(ctx context.Context, srcBinDir, srcSvcFile, dstBinDir string, flags autoupdate.InstallFlags) error {
+func (li *LocalInstaller) tryLinks(ctx context.Context, srcBinDir, srcSvcDir, dstBinDir string, flags autoupdate.InstallFlags) error {
 	// ensure source directory exists
 	entries, err := os.ReadDir(srcBinDir)
 	if errors.Is(err, os.ErrNotExist) {
@@ -760,9 +809,11 @@ func (li *LocalInstaller) tryLinks(ctx context.Context, srcBinDir, srcSvcFile, d
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = os.MkdirAll(filepath.Dir(li.TargetServiceFile), systemDirMode)
-	if err != nil {
-		return trace.Wrap(err)
+	for _, s := range li.TargetServices {
+		err = os.MkdirAll(filepath.Dir(s.Path), systemDirMode)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	// validate that we can link all system binaries before attempting linking
@@ -802,10 +853,12 @@ func (li *LocalInstaller) tryLinks(ctx context.Context, srcBinDir, srcSvcFile, d
 		}
 	}
 
-	// if any binaries are linked from srcBinDir, always link the service from svcDir
-	_, err = li.forceCopyService(li.TargetServiceFile, srcSvcFile, maxServiceFileSize, dstBinDir, flags)
-	if err != nil && !errors.Is(err, os.ErrExist) {
-		return trace.Wrap(err, "failed to copy service")
+	// process systemd service files
+	for _, s := range li.TargetServices {
+		_, err := copyService(s, srcSvcDir, dstBinDir, flags)
+		if err != nil && !errors.Is(err, os.ErrExist) {
+			return trace.Wrap(err, "failed to copy service %s", filepath.Base(s.Path))
+		}
 	}
 
 	return nil
diff --git a/lib/autoupdate/agent/installer_test.go b/lib/autoupdate/agent/installer_test.go
index 80276d90e416d..2e91a19a3a9e7 100644
--- a/lib/autoupdate/agent/installer_test.go
+++ b/lib/autoupdate/agent/installer_test.go
@@ -214,7 +214,7 @@ func testTGZ(t *testing.T, version string) (tgz *bytes.Buffer, shasum string) {
 func TestLocalInstaller_Link(t *testing.T) {
 	t.Parallel()
 	const version = "new-version"
-	servicePath := filepath.Join(serviceDir, serviceName)
+	servicePath := filepath.Join(serviceDir, teleportServiceName)
 
 	tests := []struct {
 		name            string
@@ -456,12 +456,17 @@ func TestLocalInstaller_Link(t *testing.T) {
 
 			validator := Validator{Log: slog.Default()}
 			installer := &LocalInstaller{
-				InstallDir:        versionsDir,
-				TargetServiceFile: filepath.Join(linkDir, serviceDir, serviceName),
-				Log:               slog.Default(),
-				TransformService: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
-					return []byte(fmt.Sprintf("[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings()))
+				InstallDir: versionsDir,
+				TargetServices: []ServiceFile{
+					{
+						Path:        filepath.Join(linkDir, serviceDir, teleportServiceName),
+						ExampleName: teleportServiceName,
+						ExampleFunc: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
+							return fmt.Appendf(nil, "[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings())
+						},
+					},
 				},
+				Log:            slog.Default(),
 				ValidateBinary: validator.IsExecutable,
 				Template:       autoupdate.DefaultCDNURITemplate,
 			}
@@ -522,7 +527,7 @@ func TestLocalInstaller_Link(t *testing.T) {
 func TestLocalInstaller_TryLink(t *testing.T) {
 	t.Parallel()
 	const version = "new-version"
-	servicePath := filepath.Join(serviceDir, serviceName)
+	servicePath := filepath.Join(serviceDir, teleportServiceName)
 
 	tests := []struct {
 		name            string
@@ -711,12 +716,17 @@ func TestLocalInstaller_TryLink(t *testing.T) {
 
 			validator := Validator{Log: slog.Default()}
 			installer := &LocalInstaller{
-				InstallDir:        versionsDir,
-				TargetServiceFile: filepath.Join(linkDir, serviceDir, serviceName),
-				Log:               slog.Default(),
-				TransformService: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
-					return []byte(fmt.Sprintf("[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings()))
+				InstallDir: versionsDir,
+				TargetServices: []ServiceFile{
+					{
+						Path:        filepath.Join(linkDir, serviceDir, teleportServiceName),
+						ExampleName: teleportServiceName,
+						ExampleFunc: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
+							return fmt.Appendf(nil, "[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings())
+						},
+					},
 				},
+				Log:            slog.Default(),
 				ValidateBinary: validator.IsExecutable,
 			}
 			ctx := context.Background()
@@ -848,12 +858,17 @@ func TestLocalInstaller_Remove(t *testing.T) {
 
 			validator := Validator{Log: slog.Default()}
 			installer := &LocalInstaller{
-				InstallDir:        versionsDir,
-				TargetServiceFile: filepath.Join(linkDir, serviceDir, serviceName),
-				Log:               slog.Default(),
-				TransformService: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
-					return []byte(fmt.Sprintf("[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings()))
+				InstallDir: versionsDir,
+				TargetServices: []ServiceFile{
+					{
+						Path:        filepath.Join(linkDir, serviceDir, teleportServiceName),
+						ExampleName: teleportServiceName,
+						ExampleFunc: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
+							return fmt.Appendf(nil, "[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings())
+						},
+					},
 				},
+				Log:            slog.Default(),
 				ValidateBinary: validator.IsExecutable,
 			}
 			ctx := context.Background()
@@ -873,7 +888,7 @@ func TestLocalInstaller_Remove(t *testing.T) {
 func TestLocalInstaller_IsLinked(t *testing.T) {
 	t.Parallel()
 	const version = "existing-version"
-	servicePath := filepath.Join(serviceDir, serviceName)
+	servicePath := filepath.Join(serviceDir, teleportServiceName)
 
 	tests := []struct {
 		name          string
@@ -918,12 +933,18 @@ func TestLocalInstaller_IsLinked(t *testing.T) {
 
 			validator := Validator{Log: slog.Default()}
 			installer := &LocalInstaller{
-				InstallDir:        versionsDir,
-				TargetServiceFile: filepath.Join(linkDir, serviceDir, serviceName),
-				Log:               slog.Default(),
-				TransformService: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
-					return []byte(fmt.Sprintf("[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings()))
+				InstallDir: versionsDir,
+				TargetServices: []ServiceFile{
+					{
+						Path:        filepath.Join(linkDir, serviceDir, teleportServiceName),
+						ExampleName: teleportServiceName,
+						ExampleFunc: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
+							return fmt.Appendf(nil, "[service=%s][path=%s][flags=%s]", string(b), pathDir, flags.Strings())
+
+						},
+					},
 				},
+				Log:            slog.Default(),
 				ValidateBinary: validator.IsExecutable,
 			}
 			ctx := context.Background()
@@ -960,12 +981,11 @@ func TestLocalInstaller_IsLinked(t *testing.T) {
 func TestLocalInstaller_Unlink(t *testing.T) {
 	t.Parallel()
 	const version = "existing-version"
-	servicePath := filepath.Join(serviceDir, serviceName)
+	servicePath := filepath.Join(serviceDir, teleportServiceName)
 
 	tests := []struct {
-		name    string
-		bins    []string
-		svcOrig []byte
+		name string
+		bins []string
 
 		links   []symlink
 		svcCopy []byte
@@ -974,19 +994,17 @@ func TestLocalInstaller_Unlink(t *testing.T) {
 		errMatch  string
 	}{
 		{
-			name:    "normal",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "normal",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/teleport", newname: "bin/teleport"},
 				{oldname: "bin/tsh", newname: "bin/tsh"},
 			},
-			svcCopy: []byte("[service=orig][path=bin][flags=[]]"),
+			svcCopy: []byte("# teleport-update " + version + "\n"),
 		},
 		{
-			name:    "different services",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "different services",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/teleport", newname: "bin/teleport"},
 				{oldname: "bin/tsh", newname: "bin/tsh"},
@@ -995,64 +1013,48 @@ func TestLocalInstaller_Unlink(t *testing.T) {
 			remaining: []string{servicePath},
 		},
 		{
-			name:    "missing target service",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
-			links: []symlink{
-				{oldname: "bin/teleport", newname: "bin/teleport"},
-				{oldname: "bin/tsh", newname: "bin/tsh"},
-			},
-		},
-		{
-			name: "missing source service",
+			name: "missing target service",
 			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/teleport", newname: "bin/teleport"},
 				{oldname: "bin/tsh", newname: "bin/tsh"},
 			},
-			svcCopy:   []byte("custom"),
-			remaining: []string{servicePath},
-			errMatch:  "no such",
 		},
 		{
-			name:    "missing teleport link",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "missing teleport link",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/tsh", newname: "bin/tsh"},
 			},
-			svcCopy:   []byte("[service=orig][path=bin][flags=[]]"),
+			svcCopy:   []byte("# teleport-update " + version + "\n"),
 			remaining: []string{servicePath},
 		},
 		{
-			name:    "missing other link",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "missing other link",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/teleport", newname: "bin/teleport"},
 			},
-			svcCopy: []byte("[service=orig][path=bin][flags=[]]"),
+			svcCopy: []byte("# teleport-update " + version + "\n"),
 		},
 		{
-			name:    "wrong teleport link",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "wrong teleport link",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "other", newname: "bin/teleport"},
 				{oldname: "bin/tsh", newname: "bin/tsh"},
 			},
-			svcCopy:   []byte("[service=orig][path=bin][flags=[]]"),
+			svcCopy:   []byte("# teleport-update " + version + "\n"),
 			remaining: []string{servicePath, "bin/teleport"},
 		},
 		{
-			name:    "wrong other link",
-			bins:    []string{"teleport", "tsh"},
-			svcOrig: []byte("orig"),
+			name: "wrong other link",
+			bins: []string{"teleport", "tsh"},
 			links: []symlink{
 				{oldname: "bin/teleport", newname: "bin/teleport"},
 				{oldname: "wrong", newname: "bin/tsh"},
 			},
-			svcCopy:   []byte("[service=orig][path=bin][flags=[]]"),
+			svcCopy:   []byte("# teleport-update " + version + "\n"),
 			remaining: []string{"bin/tsh"},
 		},
 	}
@@ -1073,13 +1075,6 @@ func TestLocalInstaller_Unlink(t *testing.T) {
 					mode: os.ModePerm,
 				})
 			}
-			if tt.svcOrig != nil {
-				files = append(files, smallFile{
-					name: filepath.Join(versionDir, servicePath),
-					data: tt.svcOrig,
-					mode: os.ModePerm,
-				})
-			}
 			if tt.svcCopy != nil {
 				files = append(files, smallFile{
 					name: filepath.Join(linkDir, servicePath),
@@ -1104,12 +1099,14 @@ func TestLocalInstaller_Unlink(t *testing.T) {
 			}
 
 			installer := &LocalInstaller{
-				InstallDir:        versionsDir,
-				TargetServiceFile: filepath.Join(linkDir, serviceDir, serviceName),
-				Log:               slog.Default(),
-				TransformService: func(b []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
-					return []byte(fmt.Sprintf("[service=%s][path=%s][flags=%s]", string(b), filepath.Base(pathDir), flags.Strings()))
+				InstallDir: versionsDir,
+				TargetServices: []ServiceFile{
+					{
+						Path:   filepath.Join(linkDir, serviceDir, teleportServiceName),
+						Binary: "teleport",
+					},
 				},
+				Log: slog.Default(),
 			}
 			ctx := context.Background()
 			err = installer.Unlink(ctx, NewRevision(version, 0), filepath.Join(linkDir, "bin"))
diff --git a/lib/autoupdate/agent/integrations.go b/lib/autoupdate/agent/integrations.go
index 035a671cd3d20..daea1c2820108 100644
--- a/lib/autoupdate/agent/integrations.go
+++ b/lib/autoupdate/agent/integrations.go
@@ -25,7 +25,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
@@ -33,11 +32,16 @@ import (
 	"github.com/gravitational/teleport/api/types"
 )
 
-const (
-	installDirEnvVar       = "TELEPORT_UPDATE_INSTALL_DIR"
-	updateConfigFileEnvVar = "TELEPORT_UPDATE_CONFIG_FILE"
+var (
+	// ErrConfigNotFound is returned by HellorUpdaterInfo when the updater config file cannot be found.
+	ErrConfigNotFound = errors.New("updater config file not found")
+
+	// ErrUnstableExecutable is returned by StableExecutable when no stable path can be found.
+	ErrUnstableExecutable = errors.New("executable has unstable path")
 )
 
+const updateConfigFileEnvVar = "TELEPORT_UPDATE_CONFIG_FILE"
+
 // IsManagedByUpdater returns true if the local Teleport binary is managed by teleport-update.
 // Note that true may be returned even if auto-updates is disabled or the version is pinned.
 // The binary is considered managed if it lives under /opt/teleport, but not within the package
@@ -54,69 +58,22 @@ func IsManagedByUpdater() (bool, error) {
 	if err != nil {
 		return false, trace.Wrap(err, "cannot find Teleport binary")
 	}
-	installDir := os.Getenv(installDirEnvVar)
-	if installDir == "" {
-		installDir = defaultInstallDir
-	}
-	// Check if current binary is under the updater-managed path.
-	managed, err := hasParentDir(teleportPath, installDir)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	if !managed {
+	// Consider all installations that have an update.yaml file to be
+	// managed by teleport-update (the "binary" updater).
+	p := findParentMatching(teleportPath, versionsDirName, 4)
+	if p == "" {
 		return false, nil
 	}
-	// Return false if the binary is under the updater-managed path, but in the system prefix reserved for the package.
-	system, err := hasParentDir(teleportPath, packageSystemDir)
-	return !system, trace.Wrap(err)
-}
-
-// IsManagedAndDefault returns true if the local Teleport binary is both managed by teleport-update
-// and the default installation (with teleport.service as the unit file name).
-// The binary is considered managed and default if it lives within /opt/teleport/default.
-func IsManagedAndDefault() (bool, error) {
-	systemd, err := hasSystemD()
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	if !systemd {
+	_, err = os.Stat(filepath.Join(p, UpdateConfigName))
+	if errors.Is(err, os.ErrNotExist) {
 		return false, nil
 	}
-	teleportPath, err := os.Executable()
-	if err != nil {
-		return false, trace.Wrap(err, "cannot find Teleport binary")
-	}
-	installDir := os.Getenv(installDirEnvVar)
-	if installDir == "" {
-		installDir = defaultInstallDir
-	}
-	isDefault, err := hasParentDir(teleportPath, filepath.Join(installDir, defaultNamespace))
-	return isDefault, trace.Wrap(err)
-}
-
-// hasParentDir returns true if dir is any parent directory of parent.
-// hasParentDir does not resolve symlinks, and requires that files be represented the same way in dir and parent.
-func hasParentDir(dir, parent string) (bool, error) {
-	// Note that os.Stat + os.SameFile would be more reliable,
-	// but does not work well for arbitrarily nested subdirectories.
-	absDir, err := filepath.Abs(dir)
-	if err != nil {
-		return false, trace.Wrap(err, "cannot get absolute path for directory %s", dir)
-	}
-	absParent, err := filepath.Abs(parent)
 	if err != nil {
-		return false, trace.Wrap(err, "cannot get absolute path for parent directory %s", dir)
-	}
-	sep := string(filepath.Separator)
-	if !strings.HasSuffix(absParent, sep) {
-		absParent += sep
+		return false, trace.Wrap(err)
 	}
-	return strings.HasPrefix(absDir, absParent), nil
+	return true, nil
 }
 
-// ErrUnstableExecutable is returned by StableExecutable when no stable path can be found.
-var ErrUnstableExecutable = errors.New("executable has unstable path")
-
 // StableExecutable returns a stable path to Teleport binaries that may or may not be managed by Agent Managed Updates.
 // Note that StableExecutable is not guaranteed to return the same binary, as the binary may have been updated
 // since it started running. If a stable path cannot be found, an unstable path is returned with ErrUnstableExecutable.
@@ -150,7 +107,7 @@ func stablePathForBinary(origPath, defaultPath string) (string, error) {
 	// This is determined by looking for ../../../update.yaml, if we are in ../../../versions.
 	// update.yaml will always have the target path if Managed Updates are enabled.
 	if p := findParentMatching(origPath, versionsDirName, 4); p != "" {
-		cfgPath := filepath.Join(p, updateConfigName)
+		cfgPath := filepath.Join(p, UpdateConfigName)
 		cfg, err := readConfig(cfgPath)
 		if err == nil && cfg.Spec.Path != "" {
 			// If the path exists and resolves, it is always the best candidate path,
@@ -170,17 +127,39 @@ func stablePathForBinary(origPath, defaultPath string) (string, error) {
 
 // findParentMatching returns the directory above name, if name is at rpos.
 // Otherwise, it returns empty string.
-func findParentMatching(dir, name string, rpos int) string {
+func findParentMatching(path, parent string, rpos int) string {
+	if parent == "" {
+		return ""
+	}
 	var base string
 	for range rpos {
-		dir, base = filepath.Split(filepath.Clean(dir))
+		path, base = filepath.Split(filepath.Clean(path))
 	}
-	if base == name {
-		return dir
+	if base == parent {
+		return filepath.Clean(path)
 	}
 	return ""
 }
 
+// findConfigFile returns the path to the Teleport installation's update.yaml file.
+func findConfigFile() (string, error) {
+	// Note that if the install dir or install suffix changes before the installation
+	// is hard restarted, this path will be incorrect.
+	configPath := os.Getenv(updateConfigFileEnvVar)
+	if configPath != "" {
+		return configPath, nil
+	}
+	teleportPath, err := os.Executable()
+	if err != nil {
+		return "", trace.Wrap(err, "cannot find Teleport binary")
+	}
+	p := findParentMatching(teleportPath, versionsDirName, 4)
+	if p == "" {
+		return "", trace.Wrap(ErrConfigNotFound)
+	}
+	return filepath.Join(p, UpdateConfigName), nil
+}
+
 // ReadHelloUpdaterInfo reads the updater config and generates a proto.UpdaterV2Info
 // that can be reported in the inventory hello message.
 // This function performs io operations, its usage must be cached
@@ -188,16 +167,19 @@ func findParentMatching(dir, name string, rpos int) string {
 func ReadHelloUpdaterInfo(ctx context.Context, log *slog.Logger, hostUUID string) (*types.UpdaterV2Info, error) {
 	info := &types.UpdaterV2Info{}
 
-	configPath := os.Getenv(updateConfigFileEnvVar)
-	if configPath == "" {
-		return nil, trace.Errorf("config file not specified")
+	configPath, err := findConfigFile()
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
-
 	cfg, err := readConfig(configPath)
 	if err != nil {
 		return nil, trace.Wrap(err, "reading config file %s", configPath)
 	}
 
+	// Note that only IDFile may be read from Status on the initial HELLO.
+	// Any fields set after the agent starts (e.g., active version) will be
+	// outdated until the agent is confirmed healthy.
+
 	info.UpdateGroup = cfg.Spec.Group
 	if info.UpdateGroup == "" {
 		info.UpdateGroup = defaultSetting
diff --git a/lib/autoupdate/agent/integrations_test.go b/lib/autoupdate/agent/integrations_test.go
index 17ffd4d860cc7..fc1c18ad28d09 100644
--- a/lib/autoupdate/agent/integrations_test.go
+++ b/lib/autoupdate/agent/integrations_test.go
@@ -27,86 +27,72 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestHasParentDir(t *testing.T) {
+func TestFindParentMatching(t *testing.T) {
 	tests := []struct {
-		name       string
-		path       string
-		parent     string
-		wantResult bool
+		name   string
+		path   string
+		parent string
+		rpos   int
+		result string
 	}{
 		{
-			name:       "Has valid parent directory",
-			path:       "/opt/teleport/dir/test",
-			parent:     "/opt/teleport",
-			wantResult: true,
+			name:   "Has valid parent directory",
+			path:   "/opt/teleport/default/versions/v1.2.3/bin/teleport",
+			parent: "versions",
+			rpos:   4,
+			result: "/opt/teleport/default",
 		},
 		{
-			name:       "Has valid parent directory with slash",
-			path:       "/opt/teleport/dir/test",
-			parent:     "/opt/teleport/",
-			wantResult: true,
+			name:   "Parent too close",
+			path:   "/opt/teleport/default/versions/bin/teleport",
+			parent: "versions",
+			rpos:   4,
 		},
 		{
-			name:       "Parent directory is root",
-			path:       "/opt/teleport/dir",
-			parent:     "/",
-			wantResult: true,
+			name:   "Parent too far",
+			path:   "/opt/teleport/default/versions/v1.2.3/extra/bin/teleport",
+			parent: "versions",
+			rpos:   4,
 		},
 		{
-			name:       "Parent is the same as the path",
-			path:       "/opt/teleport/dir",
-			parent:     "/opt/teleport/dir",
-			wantResult: false,
+			name:   "Parent missing",
+			path:   "/opt/teleport/default/version/v1.2.3/bin/teleport",
+			parent: "versions",
+			rpos:   4,
 		},
 		{
-			name:       "Parent the same as the path but without slash",
-			path:       "/opt/teleport/dir/",
-			parent:     "/opt/teleport/dir",
-			wantResult: false,
+			name:   "Parent at root",
+			path:   "/versions/v1.2.3/bin/teleport",
+			parent: "versions",
+			rpos:   4,
+			result: "/",
 		},
 		{
-			name:       "Parent the same as the path but with slash",
-			path:       "/opt/teleport/dir",
-			parent:     "/opt/teleport/dir/",
-			wantResult: false,
+			name:   "Position past root",
+			path:   "/v1.2.3/bin/teleport",
+			parent: "versions",
+			rpos:   4,
 		},
 		{
-			name:       "Parent is substring of the path",
-			path:       "/opt/teleport/dir-place",
-			parent:     "/opt/teleport/dir",
-			wantResult: false,
+			name: "Empty",
 		},
 		{
-			name:       "Parent is in path",
-			path:       "/opt/teleport",
-			parent:     "/opt/teleport/dir",
-			wantResult: false,
+			name:   "Empty path",
+			parent: "versions",
+			rpos:   4,
 		},
 		{
-			name:       "Empty parent",
-			path:       "/opt/teleport/dir",
-			parent:     "",
-			wantResult: false,
-		},
-		{
-			name:       "Empty path",
-			path:       "",
-			parent:     "/opt/teleport",
-			wantResult: false,
-		},
-		{
-			name:       "Both empty",
-			path:       "",
-			parent:     "",
-			wantResult: false,
+			name:   "Empty parent",
+			path:   "/v1.2.3/bin/teleport",
+			parent: "",
+			rpos:   4,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result, err := hasParentDir(tt.path, tt.parent)
-			require.NoError(t, err)
-			require.Equal(t, tt.wantResult, result)
+			result := findParentMatching(tt.path, tt.parent, tt.rpos)
+			require.Equal(t, tt.result, result)
 		})
 	}
 }
@@ -196,10 +182,10 @@ func TestStablePath(t *testing.T) {
 			if tt.path != "" && !filepath.IsAbs(tt.path) {
 				tt.path = filepath.Join(nsDir, tt.path)
 				createPath = filepath.Join(nsDir, "bin")
-				cfgPath := filepath.Join(nsDir, updateConfigName)
+				cfgPath := filepath.Join(nsDir, UpdateConfigName)
 				err := writeConfig(cfgPath, &UpdateConfig{
-					Version: updateConfigVersion,
-					Kind:    updateConfigKind,
+					Version: UpdateConfigV1,
+					Kind:    UpdateConfigKind,
 					Spec: UpdateSpec{
 						Path: createPath,
 					},
diff --git a/lib/autoupdate/agent/internal/unversioned.go b/lib/autoupdate/agent/internal/unversioned.go
new file mode 100644
index 0000000000000..4cb002861acc8
--- /dev/null
+++ b/lib/autoupdate/agent/internal/unversioned.go
@@ -0,0 +1,33 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+// UnversionedTeleport is used to read all versions of teleport.yaml, including
+// versions that may now be unsupported.
+type UnversionedTeleport struct {
+	Teleport UnversionedConfig `yaml:"teleport"`
+}
+
+// UnversionedConfig is used to read unversioned configuration from teleport and tbot.
+type UnversionedConfig struct {
+	AuthServers []string `yaml:"auth_servers"`
+	AuthServer  string   `yaml:"auth_server"`
+	ProxyServer string   `yaml:"proxy_server"`
+	DataDir     string   `yaml:"data_dir"`
+}
diff --git a/lib/autoupdate/agent/internal/unversioned_test.go b/lib/autoupdate/agent/internal/unversioned_test.go
new file mode 100644
index 0000000000000..133398ec7ec58
--- /dev/null
+++ b/lib/autoupdate/agent/internal/unversioned_test.go
@@ -0,0 +1,188 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/autoupdate/agent/internal"
+	"github.com/gravitational/teleport/lib/config"
+	tbotconfig "github.com/gravitational/teleport/lib/tbot/config"
+)
+
+// In the future, the latest version of the updater may need to read a version of teleport.yaml that has
+// an unsupported version which is supported by the updater-managed version of Teleport.
+// This test will break if Teleport removes a field that the updater reads.
+func TestUnversionedTeleportConfig(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		version string
+		in      internal.UnversionedTeleport
+		err     bool
+	}{
+		{
+			name: "empty",
+			in: internal.UnversionedTeleport{
+				Teleport: internal.UnversionedConfig{
+					ProxyServer: "proxy.example.com",
+					AuthServer:  "auth.example.com",
+					AuthServers: []string{"auth1.example.com", "auth2.example.com"},
+					DataDir:     "example_dir",
+				},
+			},
+		},
+		{
+			name:    "v1",
+			version: string(tbotconfig.V1),
+			in: internal.UnversionedTeleport{
+				Teleport: internal.UnversionedConfig{
+					ProxyServer: "proxy.example.com",
+					AuthServer:  "auth.example.com",
+					AuthServers: []string{"auth1.example.com", "auth2.example.com"},
+					DataDir:     "example_dir",
+				},
+			},
+		},
+		{
+			name:    "v2",
+			version: string(tbotconfig.V2),
+			in: internal.UnversionedTeleport{
+				Teleport: internal.UnversionedConfig{
+					ProxyServer: "proxy.example.com",
+					AuthServer:  "auth.example.com",
+					AuthServers: []string{"auth1.example.com", "auth2.example.com"},
+					DataDir:     "example_dir",
+				},
+			},
+		},
+		{
+			name:    "v3", // if this fails, add any new fields to the unversioned config
+			version: "v3",
+			in: internal.UnversionedTeleport{
+				Teleport: internal.UnversionedConfig{
+					ProxyServer: "proxy.example.com",
+					AuthServer:  "auth.example.com",
+					AuthServers: []string{"auth1.example.com", "auth2.example.com"},
+					DataDir:     "example_dir",
+				},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			in := struct {
+				Version                      string `yaml:"version"`
+				internal.UnversionedTeleport `yaml:",inline"`
+			}{
+				Version:             tt.version,
+				UnversionedTeleport: tt.in,
+			}
+			var inB bytes.Buffer
+			err := yaml.NewEncoder(&inB).Encode(in)
+			require.NoError(t, err)
+			fc, err := config.ReadConfig(&inB)
+			if tt.err {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			var outB bytes.Buffer
+			err = yaml.NewEncoder(&outB).Encode(fc)
+			require.NoError(t, err)
+
+			var out internal.UnversionedTeleport
+			err = yaml.NewDecoder(&outB).Decode(&out)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, out)
+		})
+	}
+
+}
+
+// In the future, the latest version of the updater may need to read a version of tbot.yaml that has
+// an unsupported version which is supported by the updater-managed version of tbot.
+// This test will break if tbot removes a field that the updater reads.
+func TestUnversionedTbotConfig(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		version string
+		in      internal.UnversionedConfig
+		err     bool
+	}{
+		{
+			name: "empty",
+			in: internal.UnversionedConfig{
+				AuthServer: "auth.example.com",
+			},
+		},
+		{
+			name:    "v1",
+			version: string(tbotconfig.V1),
+			in: internal.UnversionedConfig{
+				AuthServer: "auth.example.com",
+			},
+		},
+		{
+			name:    "v2",
+			version: string(tbotconfig.V2),
+			in: internal.UnversionedConfig{
+				AuthServer:  "auth.example.com",
+				ProxyServer: "proxy.example.com",
+			},
+		},
+		{
+			name:    "v3", // when this fails, add any new fields to the unversioned config
+			version: "v3",
+			in:      internal.UnversionedConfig{},
+			err:     true,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			in := struct {
+				Version                    string `yaml:"version"`
+				internal.UnversionedConfig `yaml:",inline"`
+			}{
+				Version:           tt.version,
+				UnversionedConfig: tt.in,
+			}
+			var inB bytes.Buffer
+			err := yaml.NewEncoder(&inB).Encode(in)
+			require.NoError(t, err)
+			fc, err := tbotconfig.ReadConfig(bytes.NewReader(inB.Bytes()), false)
+			if tt.err {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			var outB bytes.Buffer
+			err = yaml.NewEncoder(&outB).Encode(fc)
+			require.NoError(t, err)
+
+			var out internal.UnversionedConfig
+			err = yaml.NewDecoder(&outB).Decode(&out)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, out)
+		})
+	}
+}
diff --git a/lib/autoupdate/agent/process.go b/lib/autoupdate/agent/process.go
index 6d6bc9dc40765..e537a4040b688 100644
--- a/lib/autoupdate/agent/process.go
+++ b/lib/autoupdate/agent/process.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"io"
 	"log/slog"
 	"net"
 	"os"
@@ -65,6 +66,8 @@ type SystemdService struct {
 	Ready ReadyChecker
 	// Log contains a logger.
 	Log *slog.Logger
+	// ForceRestart forces the process to always restart.
+	ForceRestart bool
 }
 
 // ReadyChecker returns the systemd service readiness status.
@@ -72,6 +75,11 @@ type ReadyChecker interface {
 	GetReadiness(ctx context.Context) (debug.Readiness, error)
 }
 
+// Name of the systemd service.
+func (s SystemdService) Name() string {
+	return s.ServiceName
+}
+
 // Reload the systemd service.
 // Attempts a graceful reload before a hard restart.
 // See Process interface for more details.
@@ -85,7 +93,7 @@ func (s SystemdService) Reload(ctx context.Context) error {
 	// Command error codes < 0 indicate that we are unable to run the command.
 	// Errors from s.systemctl are logged along with stderr and stdout (debug only).
 
-	// If the service is not running, return ErrNotNeeded.
+	// If the service is not running, return nil.
 	// Note systemctl reload returns an error if the unit is not active, and
 	// try-reload-or-restart is too recent of an addition for centos7.
 	code := s.systemctl(ctx, slog.LevelDebug, "is-active", "--quiet", s.ServiceName)
@@ -94,7 +102,7 @@ func (s SystemdService) Reload(ctx context.Context) error {
 		return trace.Errorf("unable to determine if systemd service is active")
 	case code > 0:
 		s.Log.WarnContext(ctx, "Systemd service not running.", unitKey, s.ServiceName)
-		return trace.Wrap(ErrNotNeeded)
+		return nil
 	}
 
 	// Get initial PID for crash monitoring.
@@ -107,20 +115,28 @@ func (s SystemdService) Reload(ctx context.Context) error {
 	}
 
 	// Attempt graceful reload of running service.
-	code = s.systemctl(ctx, slog.LevelError, "reload", s.ServiceName)
-	switch {
-	case code < 0:
-		return trace.Errorf("unable to reload systemd service")
-	case code > 0:
-		// Graceful reload fails, try hard restart.
+	if !s.ForceRestart {
+		code = s.systemctl(ctx, slog.LevelError, "reload", s.ServiceName)
+		switch {
+		case code < 0:
+			return trace.Errorf("unable to reload systemd service")
+		case code > 0:
+			// Graceful reload fails, try hard restart.
+			code = s.systemctl(ctx, slog.LevelError, "try-restart", s.ServiceName)
+			if code != 0 {
+				return trace.Errorf("hard restart of systemd service failed")
+			}
+			s.Log.WarnContext(ctx, "Service ungracefully restarted. Connections potentially dropped.", unitKey, s.ServiceName)
+		default:
+			s.Log.InfoContext(ctx, "Gracefully reloaded.", unitKey, s.ServiceName)
+		}
+	} else {
 		code = s.systemctl(ctx, slog.LevelError, "try-restart", s.ServiceName)
 		if code != 0 {
 			return trace.Errorf("hard restart of systemd service failed")
 		}
-		s.Log.WarnContext(ctx, "Service ungracefully restarted. Connections potentially dropped.", unitKey, s.ServiceName)
-	default:
-		s.Log.InfoContext(ctx, "Gracefully reloaded.", unitKey, s.ServiceName)
 	}
+
 	// monitor logs all relevant errors, so we filter for a few outcomes
 	err = s.monitor(ctx, initPID)
 	if errors.Is(err, context.DeadlineExceeded) ||
@@ -300,6 +316,9 @@ func tickFile(ctx context.Context, path string, ch chan<- int, tickC <-chan time
 // waitForReady polls the SocketPath unix domain socket with HTTP requests.
 // If one request returns 200 before the timeout, the service is considered ready.
 func (s SystemdService) waitForReady(ctx context.Context, pid int, tickC <-chan time.Time) error {
+	if s.Ready == nil {
+		return nil
+	}
 	var lastErr error
 	var readiness debug.Readiness
 	for {
@@ -530,8 +549,71 @@ func (s SystemdService) systemctl(ctx context.Context, errLevel slog.Level, args
 	return code
 }
 
+// ProcessGroup is a group of other Teleport processes.
+type ProcessGroup []Process
+
+func (p ProcessGroup) Name() string {
+	return "Teleport services"
+}
+
+// Reload reloads all processes in the process group.
+func (p ProcessGroup) Reload(ctx context.Context) error {
+	// TODO(sclevine): consider reloading in parallel if this is too slow for users
+	for _, process := range p {
+		if err := process.Reload(ctx); err != nil {
+			return trace.Wrap(err, "failed to reload %s", process.Name())
+		}
+	}
+	return nil
+}
+
+// Sync syncs only the first process in the group, and fails if no processes are present.
+// The systemctl daemon-reload command is global, so we only need to sync once.
+func (p ProcessGroup) Sync(ctx context.Context) error {
+	if len(p) == 0 {
+		return trace.Errorf("no services to sync")
+	}
+	return trace.Wrap(p[0].Sync(ctx))
+}
+
+// IsEnabled returns true if any processes in the group are enabled.
+func (p ProcessGroup) IsEnabled(ctx context.Context) (bool, error) {
+	return p.anyAreTrue(ctx, func(ctx context.Context, p Process) (bool, error) {
+		return p.IsEnabled(ctx)
+	})
+}
+
+// IsPresent returns true if any processes in the group are present.
+func (p ProcessGroup) IsPresent(ctx context.Context) (bool, error) {
+	return p.anyAreTrue(ctx, func(ctx context.Context, p Process) (bool, error) {
+		return p.IsPresent(ctx)
+	})
+}
+
+// IsActive returns true if any processes in the group are active.
+func (p ProcessGroup) IsActive(ctx context.Context) (bool, error) {
+	return p.anyAreTrue(ctx, func(ctx context.Context, p Process) (bool, error) {
+		return p.IsActive(ctx)
+	})
+}
+
+func (p ProcessGroup) anyAreTrue(ctx context.Context, f func(ctx context.Context, p Process) (bool, error)) (bool, error) {
+	for _, process := range p {
+		ok, err := f(ctx, process)
+		if err != nil {
+			return ok, trace.Wrap(err)
+		}
+		if ok {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 // localExec runs a command locally, logging any output.
 type localExec struct {
+	// Dir specifies the working directory of the local command.
+	Dir string
 	// Log contains a slog logger.
 	// Defaults to slog.Default() if nil.
 	Log *slog.Logger
@@ -545,6 +627,7 @@ type localExec struct {
 // Outputs the status code, or -1 if out-of-range or unstarted.
 func (c *localExec) Run(ctx context.Context, name string, args ...string) (int, error) {
 	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Dir = c.Dir
 	stderr := &lineLogger{ctx: ctx, log: c.Log, level: c.ErrLevel, prefix: "[stderr] "}
 	stdout := &lineLogger{ctx: ctx, log: c.Log, level: c.OutLevel, prefix: "[stdout] "}
 	cmd.Stderr = stderr
@@ -555,3 +638,22 @@ func (c *localExec) Run(ctx context.Context, name string, args ...string) (int,
 	code := cmd.ProcessState.ExitCode()
 	return code, trace.Wrap(err)
 }
+
+// Output runs the command and returns combined output from stdout and stderr.
+// Same arguments as exec.CommandContext.
+func (c *localExec) Output(ctx context.Context, name string, args ...string) ([]byte, error) {
+	var buf bytes.Buffer
+	stderrLogger := &lineLogger{ctx: ctx, log: c.Log, level: c.ErrLevel, prefix: "[stderr] "}
+	stdoutLogger := &lineLogger{ctx: ctx, log: c.Log, level: c.OutLevel, prefix: "[stdout] "}
+
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Dir = c.Dir
+	stderr := io.MultiWriter(&buf, stderrLogger)
+	stdout := io.MultiWriter(&buf, stdoutLogger)
+	cmd.Stderr = stderr
+	cmd.Stdout = stdout
+	err := cmd.Run()
+	stderrLogger.Flush()
+	stdoutLogger.Flush()
+	return buf.Bytes(), trace.Wrap(err)
+}
diff --git a/lib/autoupdate/agent/setup.go b/lib/autoupdate/agent/setup.go
index 732471aba9be1..69cee84b0886c 100644
--- a/lib/autoupdate/agent/setup.go
+++ b/lib/autoupdate/agent/setup.go
@@ -22,10 +22,12 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"io/fs"
 	"log/slog"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -34,9 +36,15 @@ import (
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/autoupdate"
+	"github.com/gravitational/teleport/lib/autoupdate/agent/internal"
+	"github.com/gravitational/teleport/lib/config/systemd"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/selinux"
+	tbotsystemd "github.com/gravitational/teleport/lib/tbot/config/systemd"
 	libutils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/versioncontrol"
 )
 
 // Base paths for constructing namespaced directories.
@@ -59,9 +67,24 @@ const (
 	deprecatedServiceName = "teleport-upgrade.service"
 )
 
+const markerPrefix = "# teleport-update "
+
+// genMarker generates a systemd config file marker that is the
+// first part of the header for systemd service files.
+// Each revision of Teleport has a unique marker.
+func genMarker(rev Revision) string {
+	return markerPrefix + rev.Dir() + "\n"
+}
+
+// genHeader generates a systemd config file header that starts
+// with the serviceMarker.
+func genHeader(rev Revision) string {
+	return genMarker(rev) +
+		"# DO NOT EDIT THIS FILE\n"
+}
+
 const (
-	updateServiceTemplate = `# teleport-update
-# DO NOT EDIT THIS FILE
+	updateServiceTemplate = `
 [Unit]
 Description=Teleport auto-update service
 
@@ -69,8 +92,7 @@ Description=Teleport auto-update service
 Type=oneshot
 ExecStart={{.UpdaterBinary}} --install-suffix={{.InstallSuffix}} "--install-dir={{escape .InstallDir}}" update
 `
-	updateTimerTemplate = `# teleport-update
-# DO NOT EDIT THIS FILE
+	updateTimerTemplate = `
 [Unit]
 Description=Teleport auto-update timer unit
 
@@ -82,31 +104,32 @@ RandomizedDelaySec=1m
 [Install]
 WantedBy={{.TeleportService}}
 `
-	teleportDropInTemplate = `# teleport-update
-# DO NOT EDIT THIS FILE
+	teleportDropInTemplate = `
 [Service]
 Environment="TELEPORT_UPDATE_CONFIG_FILE={{escape .UpdaterConfigFile}}"
 Environment="TELEPORT_UPDATE_INSTALL_DIR={{escape .InstallDir}}"
 `
 
-	deprecatedDropInTemplate = `# teleport-update
-# DO NOT EDIT THIS FILE
+	deprecatedDropInTemplate = `
 [Service]
 ExecStart=
 ExecStart=-/bin/echo "The teleport-upgrade script has been disabled by teleport-update. Please remove the teleport-ent-updater package."
 `
+
 	// This configuration sets the default value for needrestart-trigger automatic restarts for teleport.service to disabled.
 	// Users may still choose to enable needrestart for teleport.service when installing packaging interactively (or via dpkg config),
 	// but doing so will result in a hard restart that disconnects the agent whenever any dependent libraries are updated.
 	// Other network services, like openvpn, follow this pattern.
 	// It is possible to configure needrestart to trigger a soft restart (via restart.d script), but given that Teleport subprocesses
 	// can use a wide variety of installed binaries (when executed by the user), this could trigger many unexpected reloads.
-	needrestartConfTemplate = `$nrconf{override_rc}{qr(^{{replace .TeleportService "." "\\."}})} = 0;
-`
+	needrestartConfTemplate = `{{range .Services}}$nrconf{override_rc}{qr(^{{replace . "." "\\."}})} = 0;
+{{end}}`
 )
 
+// confParams parameterizes the above updater configuration templates.
 type confParams struct {
 	TeleportService   string
+	Services          []string
 	UpdaterBinary     string
 	InstallSuffix     string
 	InstallDir        string
@@ -114,6 +137,10 @@ type confParams struct {
 	UpdaterConfigFile string
 }
 
+// standard Makefile included in 'selinux-policy-devel' RPM package
+// used to build SELinux modules
+const selinuxMakefile = "/usr/share/selinux/devel/Makefile"
+
 // Namespace represents a namespace within various system paths for a isolated installation of Teleport.
 type Namespace struct {
 	log *slog.Logger
@@ -123,28 +150,34 @@ type Namespace struct {
 	installDir string
 	// defaultPathDir for Teleport binaries (ns: /opt/teleport/myns/bin)
 	defaultPathDir string
-	// dataDir parsed from teleport.yaml, if present
-	dataDir string
 	// defaultProxyAddr parsed from teleport.yaml, if present
 	defaultProxyAddr string
-	// serviceFile for the Teleport systemd service (ns: /etc/systemd/system/teleport_myns.service)
-	serviceFile string
-	// configFile for Teleport config (ns: /etc/teleport_myns.yaml)
-	configFile string
-	// pidFile for Teleport (ns: /run/teleport_myns.pid)
-	pidFile string
+	// dataDir parsed from teleport.yaml, if present
+	dataDir string
+	// teleportServiceFile for the Teleport systemd service (ns: /etc/systemd/system/teleport_myns.service)
+	teleportServiceFile string
+	// teleportConfigFile for Teleport config (ns: /etc/teleport_myns.yaml)
+	teleportConfigFile string
+	// teleportPIDFile for Teleport (ns: /run/teleport_myns.pid)
+	teleportPIDFile string
+	// teleportDropInFile is the Teleport systemd drop-in path extending Teleport
+	teleportDropInFile string
+	// tbotServiceFile is the systemd service path for tbot (ns: /etc/systemd/system/tbot_myns.service)
+	tbotServiceFile string
+	// tbotConfigFile for tbot config (ns: /etc/tbot_myns.yaml)
+	tbotConfigFile string
+	// tbotPIDFile for tbot (ns: /run/tbot_myns.pid)
+	tbotPIDFile string
 	// updaterIDFile contains the updater's temporary ID file
 	updaterIDFile string
 	// updaterServiceFile is the systemd service path for the updater
 	updaterServiceFile string
 	// updaterTimerFile is the systemd timer path for the updater
 	updaterTimerFile string
-	// teleportDropInFile is the Teleport systemd drop-in path extending Teleport
-	teleportDropInFile string
+	// needrestartConfigFile is the path to needrestart configuration for all services
+	needrestartConfigFile string
 	// deprecatedDropInFile is the deprecated upgrader's systemd drop-in path
 	deprecatedDropInFile string
-	// needrestartConfFile is the path to needrestart configuration for Teleport
-	needrestartConfFile string
 }
 
 var alphanum = regexp.MustCompile("^[a-zA-Z0-9-]*$")
@@ -168,39 +201,45 @@ func NewNamespace(ctx context.Context, log *slog.Logger, name, installDir string
 	if name == "" {
 		linkDir := defaultPathDir
 		return &Namespace{
-			log:                  log,
-			name:                 name,
-			installDir:           installDir,
-			defaultPathDir:       linkDir,
-			dataDir:              defaults.DataDir,
-			serviceFile:          filepath.Join("/", serviceDir, serviceName),
-			configFile:           defaults.ConfigFilePath,
-			pidFile:              filepath.Join(systemdPIDDir, "teleport.pid"),
-			updaterIDFile:        filepath.Join(os.TempDir(), BinaryName+".id"),
-			updaterServiceFile:   filepath.Join(systemdAdminDir, BinaryName+".service"),
-			updaterTimerFile:     filepath.Join(systemdAdminDir, BinaryName+".timer"),
-			teleportDropInFile:   filepath.Join(systemdAdminDir, "teleport.service.d", BinaryName+".conf"),
-			deprecatedDropInFile: filepath.Join(systemdAdminDir, deprecatedServiceName+".d", BinaryName+".conf"),
-			needrestartConfFile:  filepath.Join(needrestartConfDir, BinaryName+".conf"),
+			log:                   log,
+			name:                  name,
+			installDir:            installDir,
+			defaultPathDir:        linkDir,
+			dataDir:               defaults.DataDir,
+			teleportServiceFile:   filepath.Join("/", serviceDir, teleportServiceName), // /lib for backwards-compat
+			teleportConfigFile:    defaults.ConfigFilePath,
+			teleportPIDFile:       filepath.Join(systemdPIDDir, "teleport.pid"),
+			needrestartConfigFile: filepath.Join(needrestartConfDir, BinaryName+".conf"),
+			teleportDropInFile:    filepath.Join(systemdAdminDir, "teleport.service.d", BinaryName+".conf"),
+			updaterIDFile:         filepath.Join(os.TempDir(), BinaryName+".id"),
+			updaterServiceFile:    filepath.Join(systemdAdminDir, BinaryName+".service"),
+			updaterTimerFile:      filepath.Join(systemdAdminDir, BinaryName+".timer"),
+			deprecatedDropInFile:  filepath.Join(systemdAdminDir, deprecatedServiceName+".d", BinaryName+".conf"),
+			tbotServiceFile:       filepath.Join(systemdAdminDir, "tbot.service"),
+			tbotConfigFile:        filepath.Join("/etc", "tbot.yaml"),
+			tbotPIDFile:           filepath.Join(systemdPIDDir, "tbot.pid"),
 		}, nil
 	}
 
 	prefix := "teleport_" + name
 	linkDir := filepath.Join(installDir, name, "bin")
 	return &Namespace{
-		log:                 log,
-		name:                name,
-		installDir:          installDir,
-		defaultPathDir:      linkDir,
-		dataDir:             filepath.Join(filepath.Dir(defaults.DataDir), prefix),
-		serviceFile:         filepath.Join(systemdAdminDir, prefix+".service"),
-		configFile:          filepath.Join(filepath.Dir(defaults.ConfigFilePath), prefix+".yaml"),
-		pidFile:             filepath.Join(systemdPIDDir, prefix+".pid"),
-		updaterIDFile:       filepath.Join(os.TempDir(), BinaryName+"_"+name+".id"),
-		updaterServiceFile:  filepath.Join(systemdAdminDir, BinaryName+"_"+name+".service"),
-		updaterTimerFile:    filepath.Join(systemdAdminDir, BinaryName+"_"+name+".timer"),
-		teleportDropInFile:  filepath.Join(systemdAdminDir, prefix+".service.d", BinaryName+"_"+name+".conf"),
-		needrestartConfFile: filepath.Join(needrestartConfDir, BinaryName+"_"+name+".conf"),
+		log:                   log,
+		name:                  name,
+		installDir:            installDir,
+		defaultPathDir:        linkDir,
+		dataDir:               filepath.Join(filepath.Dir(defaults.DataDir), prefix),
+		teleportServiceFile:   filepath.Join(systemdAdminDir, prefix+".service"),
+		teleportConfigFile:    filepath.Join(filepath.Dir(defaults.ConfigFilePath), prefix+".yaml"),
+		teleportPIDFile:       filepath.Join(systemdPIDDir, prefix+".pid"),
+		needrestartConfigFile: filepath.Join(needrestartConfDir, BinaryName+"_"+name+".conf"),
+		teleportDropInFile:    filepath.Join(systemdAdminDir, prefix+".service.d", BinaryName+"_"+name+".conf"),
+		updaterIDFile:         filepath.Join(os.TempDir(), BinaryName+"_"+name+".id"),
+		updaterServiceFile:    filepath.Join(systemdAdminDir, BinaryName+"_"+name+".service"),
+		updaterTimerFile:      filepath.Join(systemdAdminDir, BinaryName+"_"+name+".timer"),
+		tbotServiceFile:       filepath.Join(systemdAdminDir, "tbot_"+name+".service"),
+		tbotConfigFile:        filepath.Join("/etc", "tbot_"+name+".yaml"),
+		tbotPIDFile:           filepath.Join(systemdPIDDir, "tbot_"+name+".pid"),
 		// no deprecatedDropInFile, as teleport-upgrade does not conflict with namespaced installs
 	}, nil
 }
@@ -224,13 +263,23 @@ func (ns *Namespace) Init() (lockFile string, err error) {
 
 // Setup installs service and timer files for the teleport-update binary.
 // Afterwords, Setup reloads systemd and enables the timer with --now.
-func (ns *Namespace) Setup(ctx context.Context, path string) error {
+func (ns *Namespace) Setup(ctx context.Context, path string, rev Revision, f SetupFeatures) error {
+	if f.SELinuxSSH {
+		if err := ns.installSELinux(ctx, rev); err != nil {
+			ns.log.WarnContext(ctx, "Failed to install SELinux module.", errorKey, err)
+		}
+	} else {
+		if err := ns.removeSELinux(ctx); err != nil {
+			ns.log.WarnContext(ctx, "Failed to remove SELinux module.", errorKey, err)
+		}
+	}
+
 	if ok, err := hasSystemD(); err == nil && !ok {
 		ns.log.WarnContext(ctx, "Systemd is not running, skipping updater installation.")
 		return nil
 	}
 
-	err := ns.writeConfigFiles(ctx, path)
+	err := ns.writeConfigFiles(ctx, path, rev, f)
 	if err != nil {
 		return trace.Wrap(err, "failed to write teleport-update systemd config files")
 	}
@@ -273,11 +322,186 @@ func (ns *Namespace) Setup(ctx context.Context, path string) error {
 			}
 		}
 	}
+
+	return nil
+}
+
+func (ns *Namespace) installSELinux(ctx context.Context, rev Revision) error {
+	ns.log.InfoContext(ctx, "Installing SELinux module.")
+
+	if err := ns.checkSELinux(ctx, true); err != nil {
+		return trace.Wrap(err)
+	}
+
+	binaryPath := filepath.Join(ns.Dir(), versionsDirName, rev.Dir(), "bin", "teleport")
+	fileCtxs, err := selinux.FileContexts(ns.dataDir, ns.teleportConfigFile, binaryPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	tempDir, err := os.MkdirTemp("", "selinux-*")
+	if err != nil {
+		return trace.Wrap(err, "failed to create temporary directory")
+	}
+	defer os.RemoveAll(tempDir)
+
+	err = os.WriteFile(filepath.Join(tempDir, "teleport_ssh.fc"), []byte(fileCtxs), 0440)
+	if err != nil {
+		return trace.Wrap(err, "failed to write module source file")
+	}
+
+	err = os.WriteFile(filepath.Join(tempDir, "teleport_ssh.te"), []byte(selinux.ModuleSource()), 0440)
+	if err != nil {
+		return trace.Wrap(err, "failed to write module source file")
+	}
+
+	cmd := localExec{
+		Dir:      tempDir,
+		Log:      ns.log,
+		ErrLevel: slog.LevelDebug,
+		OutLevel: slog.LevelDebug,
+	}
+
+	// Build and install the module, then ensure files are properly labeled.
+	_, err = cmd.Run(ctx, "make", "-f", selinuxMakefile, "teleport_ssh.pp")
+	if err != nil {
+		return trace.Wrap(err, "failed to build module")
+	}
+
+	_, err = cmd.Run(ctx, "semodule", "-i", "teleport_ssh.pp")
+	if err != nil {
+		return trace.Wrap(err, "failed to install module")
+	}
+
+	if err := ns.createAndLabelDirs(ctx, cmd); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+func (ns *Namespace) createAndLabelDirs(ctx context.Context, cmd localExec) error {
+	// Create the teleport-upgrade and data dirs ahead of time so we
+	// can ensure they exist when we label them.
+	if err := os.MkdirAll(versioncontrol.UnitConfigDir, defaults.DirectoryPermissions); err != nil {
+		ns.log.WarnContext(ctx, "Failed to create teleport-upgrade directory.", errorKey, err)
+	}
+	if err := os.MkdirAll(ns.dataDir, teleport.PrivateDirMode); err != nil {
+		ns.log.WarnContext(ctx, "Failed to create teleport data directory.", errorKey, err)
+	}
+
+	dirsToLabel := []string{
+		filepath.Clean(ns.installDir),
+		ns.dataDir,
+		versioncontrol.UnitConfigDir,
+	}
+	// Create an empty teleport.yaml config file if it doesn't exist, and
+	// only attempt to label it if it exists.
+	if libutils.FileExists(ns.teleportConfigFile) {
+		dirsToLabel = append(dirsToLabel, filepath.Dir(ns.teleportConfigFile))
+	} else {
+		confFile, err := os.OpenFile(ns.teleportConfigFile, os.O_RDONLY|os.O_CREATE|os.O_EXCL, 0o640)
+		if err != nil {
+			ns.log.WarnContext(ctx, "Failed to create teleport.yaml.", errorKey, err, "path", ns.teleportConfigFile)
+			ns.log.WarnContext(ctx, "You will likely need to create teleport.yaml and re-run 'sudo teleport-update enable' for Teleport SSH to work correctly with SELinux.")
+		} else {
+			confFile.Close()
+			dirsToLabel = append(dirsToLabel, filepath.Dir(ns.teleportConfigFile))
+			ns.log.WarnContext(ctx, "Created an empty teleport.yaml.", "path", ns.teleportConfigFile)
+			ns.log.WarnContext(ctx, "If you move or copy another file onto this file you will likely need to re-run 'sudo teleport-update enable' for Teleport SSH to work correctly with SELinux.")
+		}
+	}
+
+	labelArgs := append([]string{"-rv"}, dirsToLabel...)
+	_, err := cmd.Run(ctx, "restorecon", labelArgs...)
+	if err != nil {
+		return trace.Wrap(err, "failed to restore file contexts")
+	}
+
+	return nil
+}
+
+func (ns *Namespace) removeSELinux(ctx context.Context) error {
+	installed, err := selinux.ModuleInstalled()
+	if err != nil {
+		return trace.Wrap(err, "failed to check if SELinux module is installed")
+	}
+	if !installed {
+		ns.log.DebugContext(ctx, "SELinux module is not installed.")
+		return nil
+	}
+
+	ns.log.InfoContext(ctx, "Removing SELinux module.")
+
+	if err := ns.checkSELinux(ctx, false); err != nil {
+		return trace.Wrap(err)
+	}
+
+	cmd := localExec{
+		Log:      ns.log,
+		ErrLevel: slog.LevelDebug,
+		OutLevel: slog.LevelDebug,
+	}
+
+	removeOutput, err := cmd.Output(ctx, "semodule", "-r", "teleport_ssh")
+	if err != nil {
+		// If the module is not installed, return without an error.
+		if bytes.Contains(removeOutput, []byte("(No such file or directory).")) {
+			return nil
+		}
+		return trace.Wrap(err, "failed to remove module")
+	}
+
+	_, err = cmd.Run(ctx, "restorecon", "-rv", filepath.Clean(ns.installDir), ns.dataDir, filepath.Dir(ns.teleportConfigFile))
+	if err != nil {
+		return trace.Wrap(err, "failed to restore file contexts")
+	}
+
+	return nil
+}
+
+func (ns *Namespace) checkSELinux(ctx context.Context, installing bool) error {
+	// Ensure necessary files and binaries exist for building a module and
+	// inform the user what packages need to be installed if they can't be
+	// found.
+	if installing {
+		_, err := exec.LookPath("make")
+		if err != nil {
+			ns.log.ErrorContext(ctx, "Failed to find 'make', you may need to install the 'make' package.")
+			return trace.Wrap(err)
+		}
+		if !libutils.FileExists(selinuxMakefile) {
+			ns.log.ErrorContext(ctx, "Failed to find the SELinux Makefile, you may need to install the 'selinux-policy-devel' package.")
+			return trace.NotFound("failed to find %s", selinuxMakefile)
+		}
+	}
+	_, err := exec.LookPath("semodule")
+	if err != nil {
+		ns.log.ErrorContext(ctx, "Failed to find 'semodule', you may need to install the 'policycoreutils' package.")
+		return trace.Wrap(err)
+	}
+	_, err = exec.LookPath("restorecon")
+	if err != nil {
+		ns.log.ErrorContext(ctx, "Failed to find 'restorecon', you may need to install the 'policycoreutils' package.")
+		return trace.Wrap(err)
+	}
+
 	return nil
 }
 
 // Teardown removes all traces of the auto-updater, including its configuration.
+// Teardown does not verify that the removed files were created by teleport-update.
 func (ns *Namespace) Teardown(ctx context.Context) error {
+	modInstalled, err := selinux.ModuleInstalled()
+	if err != nil {
+		return trace.Wrap(err, "failed to check if SELinux module is installed")
+	}
+	if modInstalled {
+		if err := ns.removeSELinux(ctx); err != nil {
+			ns.log.WarnContext(ctx, "Failed to remove SELinux module.", errorKey, err)
+		}
+	}
+
 	if ok, err := hasSystemD(); err == nil && !ok {
 		ns.log.WarnContext(ctx, "Systemd is not running, skipping updater removal.")
 		if err := os.RemoveAll(ns.Dir()); err != nil {
@@ -299,7 +523,7 @@ func (ns *Namespace) Teardown(ctx context.Context) error {
 		ns.updaterTimerFile,
 		ns.teleportDropInFile,
 		ns.deprecatedDropInFile,
-		ns.needrestartConfFile,
+		ns.needrestartConfigFile,
 	} {
 		if p == "" {
 			continue
@@ -344,15 +568,16 @@ func (ns *Namespace) Teardown(ctx context.Context) error {
 	return nil
 }
 
-func (ns *Namespace) writeConfigFiles(ctx context.Context, path string) error {
-	teleportService := filepath.Base(ns.serviceFile)
+func (ns *Namespace) writeConfigFiles(ctx context.Context, path string, rev Revision, f SetupFeatures) error {
+	teleportService := filepath.Base(ns.teleportServiceFile)
+	tbotService := filepath.Base(ns.tbotServiceFile)
 	params := confParams{
 		TeleportService:   teleportService,
 		UpdaterBinary:     filepath.Join(path, BinaryName),
 		InstallSuffix:     ns.name,
 		InstallDir:        ns.installDir,
 		Path:              path,
-		UpdaterConfigFile: filepath.Join(ns.Dir(), updateConfigName),
+		UpdaterConfigFile: filepath.Join(ns.Dir(), UpdateConfigName),
 	}
 
 	for _, v := range []struct {
@@ -366,13 +591,20 @@ func (ns *Namespace) writeConfigFiles(ctx context.Context, path string) error {
 		if v.path == "" {
 			continue
 		}
-		err := writeSystemTemplate(v.path, v.tmpl, params)
+		err := writeSystemTemplate(v.path, genHeader(rev), v.tmpl, params)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 	}
+
 	// Needrestart config is non-critical for updater functionality.
-	_, err := os.Stat(filepath.Dir(ns.needrestartConfFile))
+
+	nrServices := []string{teleportService}
+	if f.Tbot {
+		nrServices = append(nrServices, tbotService)
+	}
+
+	_, err := os.Stat(filepath.Dir(ns.needrestartConfigFile))
 	if os.IsNotExist(err) {
 		return nil // needrestart is not present
 	}
@@ -380,8 +612,10 @@ func (ns *Namespace) writeConfigFiles(ctx context.Context, path string) error {
 		ns.log.ErrorContext(ctx, "Unable to disable needrestart.", errorKey, err)
 		return nil
 	}
-	ns.log.InfoContext(ctx, "Disabling needrestart.", unitKey, teleportService)
-	err = writeSystemTemplate(ns.needrestartConfFile, needrestartConfTemplate, params)
+	ns.log.InfoContext(ctx, "Disabling needrestart.")
+	err = writeSystemTemplate(ns.needrestartConfigFile, "", needrestartConfTemplate, confParams{
+		Services: nrServices,
+	})
 	if err != nil {
 		ns.log.ErrorContext(ctx, "Unable to disable needrestart.", errorKey, err)
 		return nil
@@ -391,13 +625,19 @@ func (ns *Namespace) writeConfigFiles(ctx context.Context, path string) error {
 
 // writeSystemTemplate atomically writes a template to a system file, creating any needed directories.
 // Temporarily files are stored in the target path to ensure the file has needed SELinux contexts.
-func writeSystemTemplate(path, t string, values any) error {
+func writeSystemTemplate(path, header, t string, values any) error {
 	dir, file := filepath.Split(path)
 	if err := os.MkdirAll(dir, systemDirMode); err != nil {
 		return trace.Wrap(err)
 	}
 
 	return trace.Wrap(writeAtomicWithinDir(path, configFileMode, func(w io.Writer) error {
+		if header != "" {
+			_, err := fmt.Fprint(w, header)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
 		tmpl, err := template.New(file).Funcs(template.FuncMap{
 			"replace": func(s, old, new string) string {
 				return strings.ReplaceAll(s, old, new)
@@ -421,11 +661,85 @@ func writeSystemTemplate(path, t string, values any) error {
 	}))
 }
 
-// ReplaceTeleportService replaces the default paths in the Teleport service config with namespaced paths.
-func (ns *Namespace) ReplaceTeleportService(cfg []byte, pathDir string, flags autoupdate.InstallFlags) []byte {
+// WriteTeleportService writes the Teleport systemd service for the version of Teleport
+// that matches the version of Teleport compiled into the executing code.
+func (ns *Namespace) WriteTeleportService(_ context.Context, pathDir string, rev Revision) error {
+	if pathDir == "" {
+		pathDir = ns.defaultPathDir
+	}
+	return trace.Wrap(writeAtomicWithinDir(ns.teleportServiceFile, configFileMode, func(w io.Writer) error {
+		_, err := fmt.Fprint(w, genHeader(rev)+"\n")
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		return trace.Wrap(systemd.WriteUnitFile(systemd.Flags{
+			EnvironmentFile:          systemd.DefaultEnvironmentFile,
+			PIDFile:                  ns.teleportPIDFile,
+			FileDescriptorLimit:      systemd.DefaultFileDescriptorLimit,
+			TeleportInstallationFile: filepath.Join(pathDir, "teleport"),
+			TeleportConfigPath:       ns.teleportConfigFile,
+			FIPS:                     rev.Flags&autoupdate.FlagFIPS != 0,
+		}, w))
+	}))
+}
+
+func (ns *Namespace) HasCustomTbot(ctx context.Context) (bool, error) {
+	diskMarkerPrefix, err := readFileLimit(ns.tbotServiceFile, int64(len(markerPrefix)))
+	if errors.Is(err, os.ErrNotExist) {
+		ns.log.DebugContext(ctx, "Service not present.", "path", ns.tbotServiceFile)
+		return false, nil
+	}
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	return string(diskMarkerPrefix) != markerPrefix, nil
+}
+
+// WriteTbotService writes the tbot systemd service for the version of tbot
+// that matches the version of tbot compiled into the executing code.
+func (ns *Namespace) WriteTbotService(ctx context.Context, pathDir string, rev Revision) error {
 	if pathDir == "" {
 		pathDir = ns.defaultPathDir
 	}
+	// This configuration preserves the original tbot systemd.tmpl params.
+	// In the future, the template could be updated to accept PIDFile directly.
+	unitName := "tbot"
+	if ns.name != "" {
+		unitName = "tbot_" + ns.name
+	}
+	if ns.tbotPIDFile != filepath.Join("/run", unitName+".pid") {
+		return trace.Errorf("invalid PID file: %q", ns.tbotPIDFile)
+	}
+	diagDir := filepath.Join(ns.dataDir, "bot")
+
+	if err := os.MkdirAll(diagDir, teleport.PrivateDirMode); err != nil {
+		ns.log.WarnContext(ctx, "Failed to create tbot data directory.", errorKey, err)
+	}
+
+	return trace.Wrap(writeAtomicWithinDir(ns.tbotServiceFile, configFileMode, func(w io.Writer) error {
+		_, err := fmt.Fprint(w, genHeader(rev)+"\n")
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		return trace.Wrap(tbotsystemd.Template.Execute(w, tbotsystemd.TemplateParams{
+			UnitName:             unitName,
+			User:                 "root",
+			Group:                "root",
+			AnonymousTelemetry:   true,
+			ConfigPath:           ns.tbotConfigFile,
+			TBotPath:             filepath.Join(pathDir, "tbot"),
+			DiagSocketForUpdater: filepath.Join(diagDir, teleport.DebugServiceSocketName),
+		}))
+	}))
+}
+
+// ReplaceTeleportService replaces the default paths in the Teleport service config with namespaced paths.
+// This function is still used for backwards-compatibility, but string-replaced systemd services
+// are always overridden in more recent versions of Teleport.
+func (ns *Namespace) ReplaceTeleportService(cfg []byte, path string, flags autoupdate.InstallFlags) []byte {
+	if path == "" {
+		path = ns.defaultPathDir
+	}
 	var startFlags []string
 	if flags&autoupdate.FlagFIPS != 0 {
 		startFlags = append(startFlags, "--fips")
@@ -435,15 +749,15 @@ func (ns *Namespace) ReplaceTeleportService(cfg []byte, pathDir string, flags au
 	}{
 		{
 			old: "/usr/local/bin/",
-			new: pathDir + "/",
+			new: path + "/",
 		},
 		{
 			old: "/etc/teleport.yaml",
-			new: ns.configFile,
+			new: ns.teleportConfigFile,
 		},
 		{
 			old: "/run/teleport.pid",
-			new: ns.pidFile,
+			new: ns.teleportPIDFile,
 		},
 		{
 			old: "/teleport start ",
@@ -470,50 +784,76 @@ func (ns *Namespace) LogWarnings(ctx context.Context, pathDir string) {
 	if pathDir == "" {
 		pathDir = ns.defaultPathDir
 	}
-	ns.log.WarnContext(ctx, "Custom install suffix specified. Teleport data_dir must be configured in the config file.",
+	ns.log.WarnContext(ctx, "Custom install suffix specified.", "suffix", ns.name, "path_dir", pathDir)
+	ns.log.WarnContext(ctx, "Teleport data_dir must be set in the config file, and paths will be different.",
 		"data_dir", ns.dataDir,
-		"path_dir", pathDir,
-		"config_file", ns.configFile,
-		"service", filepath.Base(ns.serviceFile),
-		"pid_file", ns.pidFile,
+		"config_file", ns.teleportConfigFile,
+		"service", filepath.Base(ns.teleportServiceFile),
+		"pid_file", ns.teleportPIDFile,
+	)
+	ns.log.WarnContext(ctx, "Tbot data storage must be set in the config file, and paths will be different.",
+		"data_dir", filepath.Join(ns.dataDir, "bot"),
+		"config_file", ns.tbotConfigFile,
+		"service", filepath.Base(ns.tbotServiceFile),
+		"pid_file", ns.tbotPIDFile,
 	)
 }
 
-// unversionedConfig is used to read all versions of teleport.yaml, including
-// versions that may now be unsupported.
-type unversionedConfig struct {
-	Teleport unversionedTeleport `yaml:"teleport"`
-}
-
-type unversionedTeleport struct {
-	AuthServers []string `yaml:"auth_servers"`
-	AuthServer  string   `yaml:"auth_server"`
-	ProxyServer string   `yaml:"proxy_server"`
-	DataDir     string   `yaml:"data_dir"`
-}
-
-// overrideFromConfig loads fields from teleport.yaml into the namespace, overriding any defaults.
+// overrideFromConfig loads fields from teleport configuration into the namespace, overriding any defaults.
 func (ns *Namespace) overrideFromConfig(ctx context.Context) {
-	if ns == nil || ns.configFile == "" {
-		return
-	}
-	path := ns.configFile
-	f, err := libutils.OpenFileAllowingUnsafeLinks(path)
-	if err != nil {
-		ns.log.DebugContext(ctx, "Unable to open Teleport config to read proxy or data dir", "config", path, errorKey, err)
+	if ns == nil {
 		return
 	}
-	defer f.Close()
-	var cfg unversionedConfig
-	if err := yaml.NewDecoder(f).Decode(&cfg); err != nil {
-		ns.log.DebugContext(ctx, "Unable to parse Teleport config to read proxy or data dir", "config", path, errorKey, err)
+	var (
+		configFile string
+		cfg        internal.UnversionedTeleport
+	)
+
+	switch {
+	case ns.teleportConfigFile != "":
+		// Use values from teleport.yaml if present.
+		configFile = ns.teleportConfigFile
+		f, err := libutils.OpenFileAllowingUnsafeLinks(configFile)
+		if err != nil {
+			ns.log.DebugContext(ctx, "Unable to open Teleport config to read proxy or data dir", "config_file", configFile, errorKey, err)
+			return
+		}
+		defer f.Close()
+		if err := yaml.NewDecoder(f).Decode(&cfg); err != nil {
+			ns.log.DebugContext(ctx, "Unable to parse Teleport config to read proxy or data dir", "config_file", configFile, errorKey, err)
+			return
+		}
+		if cfg.Teleport.DataDir != "" {
+			ns.dataDir = cfg.Teleport.DataDir
+		}
+	case ns.tbotConfigFile != "":
+		// Otherwise, use values from tbot.yaml (bot-only installation).
+		// Do not attempt to read tbot's storage dir as the data directory used to store the tbot socket.
+		// Ignore tbot configuration if the updater does not manage the tbot service.
+		configFile = ns.tbotConfigFile
+		customTbot, err := ns.HasCustomTbot(ctx)
+		if err != nil {
+			ns.log.DebugContext(ctx, "Unable to determine if tbot is managed by the updater", "config_file", configFile, errorKey, err)
+			return
+		}
+		if customTbot {
+			return
+		}
+		f, err := libutils.OpenFileAllowingUnsafeLinks(configFile)
+		if err != nil {
+			ns.log.DebugContext(ctx, "Unable to open tbot config to read proxy or data dir", "config_file", configFile, errorKey, err)
+			return
+		}
+		defer f.Close()
+		if err := yaml.NewDecoder(f).Decode(&cfg.Teleport); err != nil {
+			ns.log.DebugContext(ctx, "Unable to parse tbot config to read proxy or data dir", "config_file", configFile, errorKey, err)
+			return
+		}
+	default:
 		return
 	}
-	if cfg.Teleport.DataDir != "" {
-		ns.dataDir = cfg.Teleport.DataDir
-	}
 
-	// Any implicitly defaulted port in teleport.yaml is explicitly defaulted (to 3080).
+	// Any implicitly defaulted port in configuration is explicitly defaulted (to 3080).
 
 	var addr string
 	var port int
@@ -528,12 +868,12 @@ func (ns *Namespace) overrideFromConfig(ctx context.Context) {
 		addr = t.AuthServers[0]
 		port = defaults.AuthListenPort
 	default:
-		ns.log.DebugContext(ctx, "Unable to find proxy in Teleport config", "config", path, errorKey, err)
+		ns.log.DebugContext(ctx, "Unable to find proxy in config", "config_file", configFile)
 		return
 	}
 	netaddr, err := libutils.ParseHostPortAddr(addr, port)
 	if err != nil {
-		ns.log.DebugContext(ctx, "Unable to parse proxy in Teleport config", "config", path, "proxy_addr", addr, "proxy_port", port, errorKey, err)
+		ns.log.DebugContext(ctx, "Unable to parse proxy in config", "config_file", configFile, "proxy_addr", addr, "proxy_port", port, errorKey, err)
 		return
 	}
 	ns.defaultProxyAddr = netaddr.String()
diff --git a/lib/autoupdate/agent/setup_test.go b/lib/autoupdate/agent/setup_test.go
index e077d37dd91e7..0372ef6cc77c4 100644
--- a/lib/autoupdate/agent/setup_test.go
+++ b/lib/autoupdate/agent/setup_test.go
@@ -31,7 +31,7 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/lib/autoupdate"
-	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/autoupdate/agent/internal"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 )
 
@@ -46,54 +46,63 @@ func TestNewNamespace(t *testing.T) {
 		{
 			name: "no namespace",
 			ns: &Namespace{
-				dataDir:              "/var/lib/teleport",
-				installDir:           "/opt/teleport",
-				defaultPathDir:       "/usr/local/bin",
-				serviceFile:          "/lib/systemd/system/teleport.service",
-				configFile:           "/etc/teleport.yaml",
-				pidFile:              "/run/teleport.pid",
-				updaterIDFile:        "/TMP/teleport-update.id",
-				updaterServiceFile:   "/etc/systemd/system/teleport-update.service",
-				updaterTimerFile:     "/etc/systemd/system/teleport-update.timer",
-				teleportDropInFile:   "/etc/systemd/system/teleport.service.d/teleport-update.conf",
-				deprecatedDropInFile: "/etc/systemd/system/teleport-upgrade.service.d/teleport-update.conf",
-				needrestartConfFile:  "/etc/needrestart/conf.d/teleport-update.conf",
+				dataDir:               "/var/lib/teleport",
+				installDir:            "/opt/teleport",
+				defaultPathDir:        "/usr/local/bin",
+				teleportServiceFile:   "/lib/systemd/system/teleport.service",
+				teleportConfigFile:    "/etc/teleport.yaml",
+				teleportPIDFile:       "/run/teleport.pid",
+				needrestartConfigFile: "/etc/needrestart/conf.d/teleport-update.conf",
+				teleportDropInFile:    "/etc/systemd/system/teleport.service.d/teleport-update.conf",
+				updaterIDFile:         "/TMP/teleport-update.id",
+				updaterServiceFile:    "/etc/systemd/system/teleport-update.service",
+				updaterTimerFile:      "/etc/systemd/system/teleport-update.timer",
+				deprecatedDropInFile:  "/etc/systemd/system/teleport-upgrade.service.d/teleport-update.conf",
+				tbotServiceFile:       "/etc/systemd/system/tbot.service",
+				tbotConfigFile:        "/etc/tbot.yaml",
+				tbotPIDFile:           "/run/tbot.pid",
 			},
 		},
 		{
 			name:       "no namespace with dirs",
 			installDir: "/install",
 			ns: &Namespace{
-				dataDir:              "/var/lib/teleport",
-				installDir:           "/install",
-				defaultPathDir:       "/usr/local/bin",
-				serviceFile:          "/lib/systemd/system/teleport.service",
-				configFile:           "/etc/teleport.yaml",
-				pidFile:              "/run/teleport.pid",
-				updaterIDFile:        "/TMP/teleport-update.id",
-				updaterServiceFile:   "/etc/systemd/system/teleport-update.service",
-				updaterTimerFile:     "/etc/systemd/system/teleport-update.timer",
-				teleportDropInFile:   "/etc/systemd/system/teleport.service.d/teleport-update.conf",
-				deprecatedDropInFile: "/etc/systemd/system/teleport-upgrade.service.d/teleport-update.conf",
-				needrestartConfFile:  "/etc/needrestart/conf.d/teleport-update.conf",
+				dataDir:               "/var/lib/teleport",
+				installDir:            "/install",
+				defaultPathDir:        "/usr/local/bin",
+				teleportServiceFile:   "/lib/systemd/system/teleport.service",
+				teleportConfigFile:    "/etc/teleport.yaml",
+				teleportPIDFile:       "/run/teleport.pid",
+				updaterIDFile:         "/TMP/teleport-update.id",
+				updaterServiceFile:    "/etc/systemd/system/teleport-update.service",
+				updaterTimerFile:      "/etc/systemd/system/teleport-update.timer",
+				teleportDropInFile:    "/etc/systemd/system/teleport.service.d/teleport-update.conf",
+				deprecatedDropInFile:  "/etc/systemd/system/teleport-upgrade.service.d/teleport-update.conf",
+				tbotServiceFile:       "/etc/systemd/system/tbot.service",
+				tbotConfigFile:        "/etc/tbot.yaml",
+				tbotPIDFile:           "/run/tbot.pid",
+				needrestartConfigFile: "/etc/needrestart/conf.d/teleport-update.conf",
 			},
 		},
 		{
 			name:      "test namespace",
 			namespace: "test",
 			ns: &Namespace{
-				name:                "test",
-				dataDir:             "/var/lib/teleport_test",
-				installDir:          "/opt/teleport",
-				defaultPathDir:      "/opt/teleport/test/bin",
-				serviceFile:         "/etc/systemd/system/teleport_test.service",
-				configFile:          "/etc/teleport_test.yaml",
-				pidFile:             "/run/teleport_test.pid",
-				updaterIDFile:       "/TMP/teleport-update_test.id",
-				updaterServiceFile:  "/etc/systemd/system/teleport-update_test.service",
-				updaterTimerFile:    "/etc/systemd/system/teleport-update_test.timer",
-				teleportDropInFile:  "/etc/systemd/system/teleport_test.service.d/teleport-update_test.conf",
-				needrestartConfFile: "/etc/needrestart/conf.d/teleport-update_test.conf",
+				name:                  "test",
+				dataDir:               "/var/lib/teleport_test",
+				installDir:            "/opt/teleport",
+				defaultPathDir:        "/opt/teleport/test/bin",
+				teleportServiceFile:   "/etc/systemd/system/teleport_test.service",
+				teleportConfigFile:    "/etc/teleport_test.yaml",
+				teleportPIDFile:       "/run/teleport_test.pid",
+				updaterIDFile:         "/TMP/teleport-update_test.id",
+				updaterServiceFile:    "/etc/systemd/system/teleport-update_test.service",
+				updaterTimerFile:      "/etc/systemd/system/teleport-update_test.timer",
+				teleportDropInFile:    "/etc/systemd/system/teleport_test.service.d/teleport-update_test.conf",
+				tbotServiceFile:       "/etc/systemd/system/tbot_test.service",
+				tbotConfigFile:        "/etc/tbot_test.yaml",
+				tbotPIDFile:           "/run/tbot_test.pid",
+				needrestartConfigFile: "/etc/needrestart/conf.d/teleport-update_test.conf",
 			},
 		},
 		{
@@ -101,18 +110,21 @@ func TestNewNamespace(t *testing.T) {
 			namespace:  "test",
 			installDir: "/install",
 			ns: &Namespace{
-				name:                "test",
-				dataDir:             "/var/lib/teleport_test",
-				installDir:          "/install",
-				defaultPathDir:      "/install/test/bin",
-				configFile:          "/etc/teleport_test.yaml",
-				pidFile:             "/run/teleport_test.pid",
-				serviceFile:         "/etc/systemd/system/teleport_test.service",
-				updaterIDFile:       "/TMP/teleport-update_test.id",
-				updaterServiceFile:  "/etc/systemd/system/teleport-update_test.service",
-				updaterTimerFile:    "/etc/systemd/system/teleport-update_test.timer",
-				teleportDropInFile:  "/etc/systemd/system/teleport_test.service.d/teleport-update_test.conf",
-				needrestartConfFile: "/etc/needrestart/conf.d/teleport-update_test.conf",
+				name:                  "test",
+				dataDir:               "/var/lib/teleport_test",
+				installDir:            "/install",
+				defaultPathDir:        "/install/test/bin",
+				teleportConfigFile:    "/etc/teleport_test.yaml",
+				teleportPIDFile:       "/run/teleport_test.pid",
+				teleportServiceFile:   "/etc/systemd/system/teleport_test.service",
+				updaterIDFile:         "/TMP/teleport-update_test.id",
+				updaterServiceFile:    "/etc/systemd/system/teleport-update_test.service",
+				updaterTimerFile:      "/etc/systemd/system/teleport-update_test.timer",
+				teleportDropInFile:    "/etc/systemd/system/teleport_test.service.d/teleport-update_test.conf",
+				tbotServiceFile:       "/etc/systemd/system/tbot_test.service",
+				tbotConfigFile:        "/etc/tbot_test.yaml",
+				tbotPIDFile:           "/run/tbot_test.pid",
+				needrestartConfigFile: "/etc/needrestart/conf.d/teleport-update_test.conf",
 			},
 		},
 		{
@@ -149,6 +161,7 @@ func TestWriteConfigFiles(t *testing.T) {
 	for _, p := range []struct {
 		name      string
 		namespace string
+		noTbot    bool
 	}{
 		{
 			name: "no namespace",
@@ -157,6 +170,14 @@ func TestWriteConfigFiles(t *testing.T) {
 			name:      "test namespace",
 			namespace: "test",
 		},
+		{
+			name:   "test with custom tbot",
+			noTbot: true,
+		},
+		{
+			name:   "test namespace with custom tbot",
+			noTbot: true,
+		},
 	} {
 		t.Run(p.name, func(t *testing.T) {
 			log := slog.Default()
@@ -164,13 +185,12 @@ func TestWriteConfigFiles(t *testing.T) {
 			ctx := context.Background()
 			ns, err := NewNamespace(ctx, log, p.namespace, "")
 			require.NoError(t, err)
-			ns.updaterServiceFile = rebasePath(filepath.Join(linkDir, serviceDir), filepath.Base(ns.updaterServiceFile))
 			ns.updaterServiceFile = rebasePath(filepath.Join(linkDir, serviceDir), ns.updaterServiceFile)
 			ns.updaterTimerFile = rebasePath(filepath.Join(linkDir, serviceDir), ns.updaterTimerFile)
 			ns.teleportDropInFile = rebasePath(filepath.Join(linkDir, serviceDir, filepath.Base(filepath.Dir(ns.teleportDropInFile))), ns.teleportDropInFile)
 			ns.deprecatedDropInFile = rebasePath(filepath.Join(linkDir, serviceDir, filepath.Base(filepath.Dir(ns.deprecatedDropInFile))), ns.deprecatedDropInFile)
-			ns.needrestartConfFile = rebasePath(linkDir, filepath.Base(ns.needrestartConfFile))
-			err = ns.writeConfigFiles(ctx, linkDir)
+			ns.needrestartConfigFile = rebasePath(linkDir, filepath.Base(ns.needrestartConfigFile))
+			err = ns.writeConfigFiles(ctx, linkDir, NewRevision("version", 0), SetupFeatures{Tbot: !p.noTbot})
 			require.NoError(t, err)
 
 			for _, tt := range []struct {
@@ -181,7 +201,7 @@ func TestWriteConfigFiles(t *testing.T) {
 				{name: "timer", path: ns.updaterTimerFile},
 				{name: "dropin", path: ns.teleportDropInFile},
 				{name: "deprecated", path: ns.deprecatedDropInFile},
-				{name: "needrestart", path: ns.needrestartConfFile},
+				{name: "needrestart", path: ns.needrestartConfigFile},
 			} {
 				if tt.path == "" {
 					continue
@@ -202,6 +222,52 @@ func TestWriteConfigFiles(t *testing.T) {
 	}
 }
 
+func TestHasCustomTbot(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		present bool
+		header  bool
+
+		result bool
+	}{
+		{
+			name: "does not exist",
+		},
+		{
+			name:    "exists",
+			present: true,
+			result:  true,
+		},
+		{
+			name:    "exists with header",
+			present: true,
+			header:  true,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tempdir := t.TempDir()
+			ns := &Namespace{
+				log:             slog.Default(),
+				tbotServiceFile: filepath.Join(tempdir, "tbot.service"),
+			}
+			err := os.MkdirAll(filepath.Dir(ns.tbotServiceFile), os.ModePerm)
+			require.NoError(t, err)
+			header := "custom"
+			if tt.header {
+				header = markerPrefix
+			}
+			if tt.present {
+				err = os.WriteFile(ns.tbotServiceFile, []byte(header), os.ModePerm)
+				require.NoError(t, err)
+			}
+			ctx := context.Background()
+			res, err := ns.HasCustomTbot(ctx)
+			require.NoError(t, err)
+			require.Equal(t, tt.result, res)
+		})
+	}
+}
+
 func rebasePath(newBase, oldPath string) string {
 	if oldPath == "" {
 		return ""
@@ -220,13 +286,15 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name string
-		cfg  *unversionedTeleport
-		want Namespace
+		name           string
+		teleportConfig *internal.UnversionedConfig
+		tbotConfig     *internal.UnversionedConfig
+		customTbot     bool
+		want           Namespace
 	}{
 		{
 			name: "default",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "example.com",
 				DataDir:     "/data",
 			},
@@ -236,8 +304,8 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 			},
 		},
 		{
-			name: "empty",
-			cfg:  &unversionedTeleport{},
+			name:           "empty",
+			teleportConfig: &internal.UnversionedConfig{},
 			want: Namespace{
 				defaultProxyAddr: "default.example.com",
 				dataDir:          "/var/lib/teleport",
@@ -245,7 +313,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "full proxy",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "https://example.com:8080",
 			},
 			want: Namespace{
@@ -255,7 +323,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "protocol and host",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "https://example.com",
 			},
 			want: Namespace{
@@ -265,7 +333,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "host and port",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "example.com:443",
 			},
 			want: Namespace{
@@ -275,7 +343,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "host",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "example.com",
 			},
 			want: Namespace{
@@ -285,7 +353,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "auth server (v3)",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				AuthServer: "example.com",
 			},
 			want: Namespace{
@@ -295,7 +363,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "auth server (v1/2)",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				AuthServers: []string{
 					"one.example.com",
 					"two.example.com",
@@ -308,7 +376,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "proxy priority",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				ProxyServer: "one.example.com",
 				AuthServer:  "two.example.com",
 				AuthServers: []string{"three.example.com"},
@@ -320,7 +388,7 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 		},
 		{
 			name: "auth priority",
-			cfg: &unversionedTeleport{
+			teleportConfig: &internal.UnversionedConfig{
 				AuthServer:  "two.example.com",
 				AuthServers: []string{"three.example.com"},
 			},
@@ -336,56 +404,211 @@ func TestNamespace_overrideFromConfig(t *testing.T) {
 				dataDir:          "/var/lib/teleport",
 			},
 		},
+		{
+			name: "tbot managed proxy",
+			tbotConfig: &internal.UnversionedConfig{
+				ProxyServer: "example.com",
+			},
+			want: Namespace{
+				defaultProxyAddr: "example.com:3080",
+				dataDir:          "/var/lib/teleport",
+			},
+		},
+		{
+			name: "tbot managed auth",
+			tbotConfig: &internal.UnversionedConfig{
+				AuthServer: "example.com",
+			},
+			want: Namespace{
+				defaultProxyAddr: "example.com:3025",
+				dataDir:          "/var/lib/teleport",
+			},
+		},
+		{
+			name: "tbot unmanaged",
+			tbotConfig: &internal.UnversionedConfig{
+				ProxyServer: "example.com",
+			},
+			customTbot: true,
+			want: Namespace{
+				defaultProxyAddr: "default.example.com",
+				dataDir:          "/var/lib/teleport",
+			},
+		},
+		{
+			name: "teleport overrides tbot",
+			teleportConfig: &internal.UnversionedConfig{
+				ProxyServer: "example.com",
+				DataDir:     "/data",
+			},
+			tbotConfig: &internal.UnversionedConfig{
+				ProxyServer: "other.example.com",
+				DataDir:     "/other-data",
+			},
+			want: Namespace{
+				defaultProxyAddr: "example.com:3080",
+				dataDir:          "/data",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			ns := &Namespace{
 				log:              slog.Default(),
-				configFile:       filepath.Join(t.TempDir(), "teleport.yaml"),
 				defaultProxyAddr: "default.example.com",
 				dataDir:          "/var/lib/teleport",
 			}
-			if tt.cfg != nil {
-				out, err := yaml.Marshal(unversionedConfig{Teleport: *tt.cfg})
+			if tt.customTbot {
+				ns.tbotServiceFile = filepath.Join(t.TempDir(), "tbot.service")
+				err := os.WriteFile(ns.tbotServiceFile, []byte("custom"), os.ModePerm)
+				require.NoError(t, err)
+			}
+			if tt.teleportConfig != nil {
+				ns.teleportConfigFile = filepath.Join(t.TempDir(), "teleport.yaml")
+				out, err := yaml.Marshal(internal.UnversionedTeleport{Teleport: *tt.teleportConfig})
+				require.NoError(t, err)
+				err = os.WriteFile(ns.teleportConfigFile, out, os.ModePerm)
+				require.NoError(t, err)
+			}
+			if tt.tbotConfig != nil {
+				ns.tbotConfigFile = filepath.Join(t.TempDir(), "tbot.yaml")
+				out, err := yaml.Marshal(tt.tbotConfig)
 				require.NoError(t, err)
-				err = os.WriteFile(ns.configFile, out, os.ModePerm)
+				err = os.WriteFile(ns.tbotConfigFile, out, os.ModePerm)
 				require.NoError(t, err)
 			}
 			ctx := context.Background()
 			ns.overrideFromConfig(ctx)
-			ns.configFile = ""
+			ns.teleportConfigFile = ""
+			ns.tbotConfigFile = ""
+			ns.tbotServiceFile = ""
 			ns.log = nil
 			require.Equal(t, &tt.want, ns)
 		})
 	}
 }
 
-// In the future, the latest version of the updater may need to read a version of teleport.yaml that has
-// an unsupported version which is supported by the updater-managed version of Teleport.
-// This test will break if Teleport removes a field that the updater reads.
-func TestUnversionedTeleportConfig(t *testing.T) {
-	in := unversionedConfig{
-		Teleport: unversionedTeleport{
-			ProxyServer: "proxy.example.com",
-			AuthServer:  "auth.example.com",
-			AuthServers: []string{"auth1.example.com", "auth2.example.com"},
-			DataDir:     "example_dir",
+func TestWriteTeleportService(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+
+		pidFile    string
+		configFile string
+		pathDir    string
+		flags      autoupdate.InstallFlags
+	}{
+		{
+			name:       "default",
+			pidFile:    "/var/run/teleport.pid",
+			configFile: "/etc/teleport.yaml",
+			pathDir:    "/usr/local/bin",
+		},
+		{
+			name:       "custom",
+			pidFile:    "/some/path/teleport.pid",
+			configFile: "/some/path/teleport.yaml",
+			pathDir:    "/some/path/bin",
+		},
+		{
+			name:       "FIPS",
+			pidFile:    "/var/run/teleport.pid",
+			configFile: "/etc/teleport.yaml",
+			pathDir:    "/usr/local/bin",
+			flags:      autoupdate.FlagFIPS,
 		},
 	}
-	var inB bytes.Buffer
-	err := yaml.NewEncoder(&inB).Encode(in)
-	require.NoError(t, err)
-	fc, err := config.ReadConfig(&inB)
-	require.NoError(t, err)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			serviceFile := filepath.Join(t.TempDir(), "file")
+			ns := &Namespace{
+				log:                 slog.Default(),
+				teleportConfigFile:  tt.configFile,
+				teleportServiceFile: serviceFile,
+				teleportPIDFile:     tt.pidFile,
+			}
+			err := ns.WriteTeleportService(context.Background(), tt.pathDir, NewRevision("version", tt.flags))
+			require.NoError(t, err)
+			data, err := os.ReadFile(serviceFile)
+			require.NoError(t, err)
+			if golden.ShouldSet() {
+				golden.Set(t, data)
+			}
+			require.Equal(t, string(golden.Get(t)), string(data))
+		})
+	}
+}
+
+func TestWriteTbotService(t *testing.T) {
+	t.Parallel()
 
-	var outB bytes.Buffer
-	err = yaml.NewEncoder(&outB).Encode(fc)
-	require.NoError(t, err)
+	tests := []struct {
+		name string
 
-	var out unversionedConfig
-	err = yaml.NewDecoder(&outB).Decode(&out)
-	require.NoError(t, err)
-	require.Equal(t, in, out)
+		suffix     string
+		pidFile    string
+		configFile string
+		pathDir    string
+		dataDir    string
+		err        bool
+	}{
+		{
+			name:       "default",
+			pidFile:    "/run/tbot.pid",
+			configFile: "/etc/tbot.yaml",
+			pathDir:    "/usr/local/bin",
+			dataDir:    "/var/lib/teleport",
+		},
+		{
+			name:       "custom",
+			pidFile:    "/run/tbot.pid",
+			configFile: "/some/path/tbot.yaml",
+			pathDir:    "/some/path/bin",
+			dataDir:    "/some/path",
+		},
+		{
+			name:       "custom suffix",
+			suffix:     "suffix",
+			pidFile:    "/run/tbot_suffix.pid",
+			configFile: "/some/path/tbot.yaml",
+			pathDir:    "/some/path/bin",
+			dataDir:    "/some/path",
+		},
+		{
+			name:       "bad pid",
+			pidFile:    "/some/path/tbot.pid",
+			configFile: "/some/path/tbot.yaml",
+			pathDir:    "/some/path/bin",
+			dataDir:    "/some/path",
+			err:        true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			serviceFile := filepath.Join(t.TempDir(), "file")
+			ns := &Namespace{
+				log:             slog.Default(),
+				name:            tt.suffix,
+				tbotConfigFile:  tt.configFile,
+				tbotServiceFile: serviceFile,
+				tbotPIDFile:     tt.pidFile,
+				dataDir:         tt.dataDir,
+			}
+			err := ns.WriteTbotService(context.Background(), tt.pathDir, NewRevision("version", 0))
+			if tt.err {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			data, err := os.ReadFile(serviceFile)
+			require.NoError(t, err)
+			if golden.ShouldSet() {
+				golden.Set(t, data)
+			}
+			require.Equal(t, string(golden.Get(t)), string(data))
+		})
+	}
 }
 
 func TestReplaceTeleportService(t *testing.T) {
@@ -446,9 +669,9 @@ WantedBy=multi-user.target
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			ns := &Namespace{
-				log:        slog.Default(),
-				configFile: tt.configFile,
-				pidFile:    tt.pidFile,
+				log:                slog.Default(),
+				teleportConfigFile: tt.configFile,
+				teleportPIDFile:    tt.pidFile,
 			}
 			data := ns.ReplaceTeleportService([]byte(tt.in), tt.pathDir, tt.flags)
 			if golden.ShouldSet() {
diff --git a/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_file.golden b/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_file.golden
new file mode 100644
index 0000000000000..13cbb0b358e62
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_file.golden
@@ -0,0 +1,14 @@
+version: v1
+kind: update_config
+spec:
+    proxy: localhost
+    path: /usr/local/bin
+    enabled: false
+    pinned: false
+    selinux_ssh: true
+status:
+    id_file: updater-id-file
+    active:
+        version: 16.3.0
+    backup:
+        version: old-version
diff --git a/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_user.golden b/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_user.golden
new file mode 100644
index 0000000000000..13cbb0b358e62
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestUpdater_Install/install_selinux_from_user.golden
@@ -0,0 +1,14 @@
+version: v1
+kind: update_config
+spec:
+    proxy: localhost
+    path: /usr/local/bin
+    enabled: false
+    pinned: false
+    selinux_ssh: true
+status:
+    id_file: updater-id-file
+    active:
+        version: 16.3.0
+    backup:
+        version: old-version
diff --git a/lib/autoupdate/agent/testdata/TestUpdater_Install/setup_fails.golden b/lib/autoupdate/agent/testdata/TestUpdater_Install/setup_fails.golden
new file mode 100644
index 0000000000000..6e104086250e3
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestUpdater_Install/setup_fails.golden
@@ -0,0 +1,10 @@
+version: v1
+kind: update_config
+spec:
+    proxy: ""
+    path: ""
+    enabled: false
+    pinned: false
+status:
+    active:
+        version: ""
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/deprecated.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/deprecated.golden
index 3f18b9cdf3065..fcaaae54ce5d0 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/deprecated.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/deprecated.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Service]
 ExecStart=
 ExecStart=-/bin/echo "The teleport-upgrade script has been disabled by teleport-update. Please remove the teleport-ent-updater package."
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/dropin.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/dropin.golden
index cb09143fe9fdf..4ca6b61b76342 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/dropin.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/dropin.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Service]
 Environment="TELEPORT_UPDATE_CONFIG_FILE=/opt/teleport/default/update.yaml"
 Environment="TELEPORT_UPDATE_INSTALL_DIR=/opt/teleport"
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/needrestart.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/needrestart.golden
index b5d6a74435cb2..85b19ed507a35 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/needrestart.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/needrestart.golden
@@ -1 +1,2 @@
 $nrconf{override_rc}{qr(^teleport\.service)} = 0;
+$nrconf{override_rc}{qr(^tbot\.service)} = 0;
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/service.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/service.golden
index 45d778ec09f25..e3038b3255fc0 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/service.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/service.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Unit]
 Description=Teleport auto-update service
 
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/timer.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/timer.golden
index d14a43d679e53..df921a1e883f1 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/timer.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/no_namespace/timer.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Unit]
 Description=Teleport auto-update timer unit
 
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/dropin.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/dropin.golden
index dc6445dc6e7f9..14ce4fd431951 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/dropin.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/dropin.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Service]
 Environment="TELEPORT_UPDATE_CONFIG_FILE=/opt/teleport/test/update.yaml"
 Environment="TELEPORT_UPDATE_INSTALL_DIR=/opt/teleport"
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/needrestart.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/needrestart.golden
index ad6bd606a74cb..4994533b2e2cd 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/needrestart.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/needrestart.golden
@@ -1 +1,2 @@
 $nrconf{override_rc}{qr(^teleport_test\.service)} = 0;
+$nrconf{override_rc}{qr(^tbot_test\.service)} = 0;
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/service.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/service.golden
index f698deec24bb9..2f8b0f13d68a8 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/service.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/service.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Unit]
 Description=Teleport auto-update service
 
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/timer.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/timer.golden
index f57a3c08055bc..38f8e37a02c72 100644
--- a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/timer.golden
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace/timer.golden
@@ -1,5 +1,6 @@
-# teleport-update
+# teleport-update version
 # DO NOT EDIT THIS FILE
+
 [Unit]
 Description=Teleport auto-update timer unit
 
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/deprecated.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/deprecated.golden
new file mode 100644
index 0000000000000..fcaaae54ce5d0
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/deprecated.golden
@@ -0,0 +1,6 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Service]
+ExecStart=
+ExecStart=-/bin/echo "The teleport-upgrade script has been disabled by teleport-update. Please remove the teleport-ent-updater package."
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/dropin.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/dropin.golden
new file mode 100644
index 0000000000000..4ca6b61b76342
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/dropin.golden
@@ -0,0 +1,6 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Service]
+Environment="TELEPORT_UPDATE_CONFIG_FILE=/opt/teleport/default/update.yaml"
+Environment="TELEPORT_UPDATE_INSTALL_DIR=/opt/teleport"
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/needrestart.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/needrestart.golden
new file mode 100644
index 0000000000000..b5d6a74435cb2
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/needrestart.golden
@@ -0,0 +1 @@
+$nrconf{override_rc}{qr(^teleport\.service)} = 0;
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/service.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/service.golden
new file mode 100644
index 0000000000000..e3038b3255fc0
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/service.golden
@@ -0,0 +1,9 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport auto-update service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/teleport-update --install-suffix= "--install-dir=/opt/teleport" update
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/timer.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/timer.golden
new file mode 100644
index 0000000000000..df921a1e883f1
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_namespace_with_custom_tbot/timer.golden
@@ -0,0 +1,13 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport auto-update timer unit
+
+[Timer]
+OnActiveSec=1m
+OnUnitActiveSec=5m
+RandomizedDelaySec=1m
+
+[Install]
+WantedBy=teleport.service
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/deprecated.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/deprecated.golden
new file mode 100644
index 0000000000000..fcaaae54ce5d0
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/deprecated.golden
@@ -0,0 +1,6 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Service]
+ExecStart=
+ExecStart=-/bin/echo "The teleport-upgrade script has been disabled by teleport-update. Please remove the teleport-ent-updater package."
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/dropin.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/dropin.golden
new file mode 100644
index 0000000000000..4ca6b61b76342
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/dropin.golden
@@ -0,0 +1,6 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Service]
+Environment="TELEPORT_UPDATE_CONFIG_FILE=/opt/teleport/default/update.yaml"
+Environment="TELEPORT_UPDATE_INSTALL_DIR=/opt/teleport"
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/needrestart.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/needrestart.golden
new file mode 100644
index 0000000000000..b5d6a74435cb2
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/needrestart.golden
@@ -0,0 +1 @@
+$nrconf{override_rc}{qr(^teleport\.service)} = 0;
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/service.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/service.golden
new file mode 100644
index 0000000000000..e3038b3255fc0
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/service.golden
@@ -0,0 +1,9 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport auto-update service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/teleport-update --install-suffix= "--install-dir=/opt/teleport" update
diff --git a/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/timer.golden b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/timer.golden
new file mode 100644
index 0000000000000..df921a1e883f1
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteConfigFiles/test_with_custom_tbot/timer.golden
@@ -0,0 +1,13 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport auto-update timer unit
+
+[Timer]
+OnActiveSec=1m
+OnUnitActiveSec=5m
+RandomizedDelaySec=1m
+
+[Install]
+WantedBy=teleport.service
diff --git a/lib/autoupdate/agent/testdata/TestWriteTbotService/custom.golden b/lib/autoupdate/agent/testdata/TestWriteTbotService/custom.golden
new file mode 100644
index 0000000000000..3d50524658c8a
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTbotService/custom.golden
@@ -0,0 +1,22 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+# Generated by `tbot`
+[Unit]
+Description=tbot - Teleport Machine & Workload Identity Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+Restart=always
+RestartSec=5
+Environment="TELEPORT_ANONYMOUS_TELEMETRY=1"
+ExecStart=/some/path/bin/tbot start -c /some/path/tbot.yaml --diag-socket-for-updater=/some/path/bot/debug.sock --pid-file=/run/tbot.pid
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/run/tbot.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/testdata/TestWriteTbotService/custom_suffix.golden b/lib/autoupdate/agent/testdata/TestWriteTbotService/custom_suffix.golden
new file mode 100644
index 0000000000000..0f463a19bfdc9
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTbotService/custom_suffix.golden
@@ -0,0 +1,22 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+# Generated by `tbot`
+[Unit]
+Description=tbot_suffix - Teleport Machine & Workload Identity Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+Restart=always
+RestartSec=5
+Environment="TELEPORT_ANONYMOUS_TELEMETRY=1"
+ExecStart=/some/path/bin/tbot start -c /some/path/tbot.yaml --diag-socket-for-updater=/some/path/bot/debug.sock --pid-file=/run/tbot_suffix.pid
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/run/tbot_suffix.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/testdata/TestWriteTbotService/default.golden b/lib/autoupdate/agent/testdata/TestWriteTbotService/default.golden
new file mode 100644
index 0000000000000..2d3e7301860c3
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTbotService/default.golden
@@ -0,0 +1,22 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+# Generated by `tbot`
+[Unit]
+Description=tbot - Teleport Machine & Workload Identity Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+Restart=always
+RestartSec=5
+Environment="TELEPORT_ANONYMOUS_TELEMETRY=1"
+ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml --diag-socket-for-updater=/var/lib/teleport/bot/debug.sock --pid-file=/run/tbot.pid
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/run/tbot.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/testdata/TestWriteTeleportService/FIPS.golden b/lib/autoupdate/agent/testdata/TestWriteTeleportService/FIPS.golden
new file mode 100644
index 0000000000000..fead0e35cf34f
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTeleportService/FIPS.golden
@@ -0,0 +1,20 @@
+# teleport-update version_ent_fips
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+EnvironmentFile=-/etc/default/teleport
+ExecStart=/usr/local/bin/teleport start --fips --config /etc/teleport.yaml --pid-file=/var/run/teleport.pid
+# systemd before 239 needs an absolute path
+ExecReload=/bin/sh -c "exec pkill -HUP -L -F /var/run/teleport.pid"
+PIDFile=/var/run/teleport.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/testdata/TestWriteTeleportService/custom.golden b/lib/autoupdate/agent/testdata/TestWriteTeleportService/custom.golden
new file mode 100644
index 0000000000000..a7ee6334eb88a
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTeleportService/custom.golden
@@ -0,0 +1,20 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+EnvironmentFile=-/etc/default/teleport
+ExecStart=/some/path/bin/teleport start --config /some/path/teleport.yaml --pid-file=/some/path/teleport.pid
+# systemd before 239 needs an absolute path
+ExecReload=/bin/sh -c "exec pkill -HUP -L -F /some/path/teleport.pid"
+PIDFile=/some/path/teleport.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/testdata/TestWriteTeleportService/default.golden b/lib/autoupdate/agent/testdata/TestWriteTeleportService/default.golden
new file mode 100644
index 0000000000000..a1db5d008ddd6
--- /dev/null
+++ b/lib/autoupdate/agent/testdata/TestWriteTeleportService/default.golden
@@ -0,0 +1,20 @@
+# teleport-update version
+# DO NOT EDIT THIS FILE
+
+[Unit]
+Description=Teleport Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+EnvironmentFile=-/etc/default/teleport
+ExecStart=/usr/local/bin/teleport start --config /etc/teleport.yaml --pid-file=/var/run/teleport.pid
+# systemd before 239 needs an absolute path
+ExecReload=/bin/sh -c "exec pkill -HUP -L -F /var/run/teleport.pid"
+PIDFile=/var/run/teleport.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/autoupdate/agent/updater.go b/lib/autoupdate/agent/updater.go
index f655daf604768..e1f38ccd7b14a 100644
--- a/lib/autoupdate/agent/updater.go
+++ b/lib/autoupdate/agent/updater.go
@@ -35,6 +35,8 @@ import (
 	"path/filepath"
 	"runtime"
 	"slices"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -52,6 +54,15 @@ import (
 const (
 	// BinaryName specifies the name of the updater binary.
 	BinaryName = "teleport-update"
+
+	// SetupVersionEnvVar specifies the Teleport version.
+	SetupVersionEnvVar = "TELEPORT_UPDATE_SETUP_VERSION"
+	// SetupFlagsEnvVar specifies Teleport version flags.
+	SetupFlagsEnvVar = "TELEPORT_UPDATE_SETUP_FLAGS"
+	// SetupTbotEnvVar specifies that the updater should manage tbot.
+	SetupTbotEnvVar = "TELEPORT_UPDATE_SETUP_TBOT"
+	// SetupSELinuxSSHEnvVar is the environment variable that enables SELinux SSH support.
+	SetupSELinuxSSHEnvVar = "TELEPORT_UPDATE_SELINUX_SSH"
 )
 
 const (
@@ -60,9 +71,7 @@ const (
 	// reservedFreeDisk is the minimum required free space left on disk during downloads.
 	// TODO(sclevine): This value is arbitrary and could be replaced by, e.g., min(1%, 200mb) in the future
 	//   to account for a range of disk sizes.
-	reservedFreeDisk = 10_000_000
-	// debugSocketFileName is the name of Teleport's debug socket in the data dir.
-	debugSocketFileName = "debug.sock" // 10 MB
+	reservedFreeDisk = 10_000_000 // 10 MB
 	// requiredUmask must be set before this package can be used.
 	// Use syscall.Umask to set when no other goroutines are running.
 	requiredUmask = 0o022
@@ -119,43 +128,69 @@ func NewLocalUpdater(cfg LocalUpdaterConfig, ns *Namespace) (*Updater, error) {
 		cfg.SystemDir = packageSystemDir
 	}
 	validator := Validator{Log: cfg.Log}
-	debugClient := debug.NewClient(filepath.Join(ns.dataDir, debugSocketFileName))
+	teleportDebugClient := debug.NewClient(ns.dataDir)
+	// Teleport's debug client happens to work for tbot, but this may not
+	// be intentional. In the future, we might consider extracting a generic
+	// debug client that can be used in both contexts.
+	tbotDebugClient := debug.NewClient(filepath.Join(ns.dataDir, "bot"))
+
 	return &Updater{
-		Log:                 cfg.Log,
-		Pool:                certPool,
-		InsecureSkipVerify:  cfg.InsecureSkipVerify,
-		UpdateConfigFile:    filepath.Join(ns.Dir(), updateConfigName),
-		UpdateIDFile:        ns.updaterIDFile,
-		MachineIDFile:       systemdMachineIDFile,
-		TeleportIDFile:      filepath.Join(ns.dataDir, teleportHostIDFileName),
-		TeleportConfigFile:  ns.configFile,
-		TeleportServiceName: filepath.Base(ns.serviceFile),
-		DefaultProxyAddr:    ns.defaultProxyAddr,
-		DefaultPathDir:      ns.defaultPathDir,
+		Log:                cfg.Log,
+		Pool:               certPool,
+		InsecureSkipVerify: cfg.InsecureSkipVerify,
+		UpdateConfigFile:   filepath.Join(ns.Dir(), UpdateConfigName),
+		UpdateIDFile:       ns.updaterIDFile,
+		MachineIDFile:      systemdMachineIDFile,
+		TeleportIDFile:     filepath.Join(ns.dataDir, teleportHostIDFileName),
+		TeleportConfigFile: ns.teleportConfigFile,
+		DefaultProxyAddr:   ns.defaultProxyAddr,
+		DefaultPathDir:     ns.defaultPathDir,
 		Installer: &LocalInstaller{
-			InstallDir:              filepath.Join(ns.Dir(), versionsDirName),
-			TargetServiceFile:       ns.serviceFile,
+			InstallDir: filepath.Join(ns.Dir(), versionsDirName),
+			TargetServices: []ServiceFile{
+				{
+					Path:        ns.teleportServiceFile,
+					Binary:      "teleport",
+					ExampleName: teleportServiceName,
+					ExampleFunc: ns.ReplaceTeleportService, // required for TryLinkSystem
+				},
+				{
+					Path:   ns.tbotServiceFile,
+					Binary: "tbot",
+				},
+			},
 			SystemBinDir:            filepath.Join(cfg.SystemDir, "bin"),
-			SystemServiceFile:       filepath.Join(cfg.SystemDir, serviceDir, serviceName),
+			SystemServiceDir:        filepath.Join(cfg.SystemDir, serviceDir),
 			HTTP:                    client,
 			Log:                     cfg.Log,
 			ReservedFreeTmpDisk:     reservedFreeDisk,
 			ReservedFreeInstallDisk: reservedFreeDisk,
-			TransformService:        ns.ReplaceTeleportService,
 			ValidateBinary:          validator.IsBinary,
 			Template:                autoupdate.DefaultCDNURITemplate,
 		},
-		Process: &SystemdService{
-			ServiceName: filepath.Base(ns.serviceFile),
-			PIDFile:     ns.pidFile,
-			Ready:       debugClient,
+		TeleportProcess: &SystemdService{
+			ServiceName: filepath.Base(ns.teleportServiceFile),
+			PIDFile:     ns.teleportPIDFile,
+			Ready:       teleportDebugClient,
 			Log:         cfg.Log,
 		},
-		ReexecSetup: func(ctx context.Context, pathDir string, reload bool) error {
+		TbotProcess: &SystemdService{
+			ServiceName:  filepath.Base(ns.tbotServiceFile),
+			PIDFile:      ns.tbotPIDFile,
+			Ready:        tbotDebugClient,
+			Log:          cfg.Log,
+			ForceRestart: true,
+		},
+		WriteTeleportService: ns.WriteTeleportService,
+		WriteTbotService:     ns.WriteTbotService,
+		HasCustomTbot:        ns.HasCustomTbot,
+		ReexecSetup: func(ctx context.Context, pathDir string, rev Revision, f SetupFeatures, reload bool) error {
 			name := filepath.Join(pathDir, BinaryName)
 			if cfg.SelfSetup && runtime.GOOS == constants.LinuxOS {
 				name = "/proc/self/exe"
 			}
+			// New arguments must never be added here, as older versions of the
+			// updater may be invoked by this logic.
 			args := []string{
 				"--install-dir", ns.installDir,
 				"--install-suffix", ns.name,
@@ -171,6 +206,13 @@ func NewLocalUpdater(cfg LocalUpdaterConfig, ns *Namespace) (*Updater, error) {
 			cmd := exec.CommandContext(ctx, name, args...)
 			cmd.Stderr = os.Stderr
 			cmd.Stdout = os.Stdout
+			// Never set env vars conditionally, as they may be set in the parent environment.
+			cmd.Env = append(slices.Clone(os.Environ()),
+				SetupVersionEnvVar+"="+rev.Version,
+				SetupFlagsEnvVar+"="+strings.Join(rev.Flags.Strings(), "\n"),
+				SetupSELinuxSSHEnvVar+"="+strconv.FormatBool(f.SELinuxSSH),
+				SetupTbotEnvVar+"="+strconv.FormatBool(f.Tbot),
+			)
 			cfg.Log.InfoContext(ctx, "Executing new teleport-update binary to update configuration.")
 			defer cfg.Log.InfoContext(ctx, "Finished executing new teleport-update binary.")
 			return trace.Wrap(cmd.Run())
@@ -221,21 +263,31 @@ type Updater struct {
 	TeleportIDFile string
 	// TeleportConfigFile contains the path to Teleport's configuration.
 	TeleportConfigFile string
-	// TeleportServiceName contains the full name of the systemd service for Teleport
-	TeleportServiceName string
 	// DefaultProxyAddr contains Teleport's proxy address. This may differ from the updater's.
 	DefaultProxyAddr string
 	// DefaultPathDir contains the default path that Teleport binaries should be installed into.
 	DefaultPathDir string
 	// Installer manages installations of the Teleport agent.
 	Installer Installer
-	// Process manages a running instance of Teleport.
-	Process Process
+	// TeleportProcess manages a running instance of Teleport.
+	TeleportProcess Process
+	// TbotProcess manages a running instance of tbot.
+	TbotProcess Process
+	// WriteTeleportService writes the teleport systemd service for the version of Teleport
+	// matching the currently running updater.
+	WriteTeleportService func(ctx context.Context, path string, rev Revision) error
+	// WriteTbotService writes the tbot systemd service for the version of Teleport
+	// matching the currently running updater.
+	WriteTbotService func(ctx context.Context, path string, rev Revision) error
+	// HasCustomTbot returns true if a non-updater-managed tbot installation is present.
+	HasCustomTbot func(ctx context.Context) (bool, error)
 	// ReexecSetup re-execs teleport-update with the setup command.
-	// This configures the updater service, verifies the installation, and optionally reloads Teleport.
-	ReexecSetup func(ctx context.Context, path string, reload bool) error
-	// SetupNamespace configures the Teleport updater service for the current Namespace.
-	SetupNamespace func(ctx context.Context, path string) error
+	// This configures an SELinux module, configures the updater service,
+	// verifies the installation, and optionally reloads Teleport.
+	ReexecSetup func(ctx context.Context, path string, rev Revision, f SetupFeatures, reload bool) error
+	// SetupNamespace configures the Teleport updater service for the current Namespace
+	// and configures an SELinux module.
+	SetupNamespace func(ctx context.Context, path string, rev Revision, f SetupFeatures) error
 	// TeardownNamespace removes all traces of the updater service in the current Namespace, including Teleport.
 	TeardownNamespace func(ctx context.Context) error
 	// LogConfigWarnings logs warnings related to the configuration Namespace.
@@ -283,8 +335,6 @@ type Installer interface {
 var (
 	// ErrLinked is returned when a linked version cannot be operated on.
 	ErrLinked = errors.New("version is linked")
-	// ErrNotNeeded is returned when the operation is not needed.
-	ErrNotNeeded = errors.New("not needed")
 	// ErrNotSupported is returned when the operation is not supported on the platform.
 	ErrNotSupported = errors.New("not supported on this platform")
 	// ErrNotAvailable is returned when the operation is not available at the current version of the platform.
@@ -299,6 +349,8 @@ var (
 
 // Process provides an API for interacting with a running Teleport process.
 type Process interface {
+	// Name of the process.
+	Name() string
 	// Reload must reload the Teleport process as gracefully as possible.
 	// If the process is not healthy after reloading, Reload must return an error.
 	// If the process did not require reloading, Reload must return ErrNotNeeded.
@@ -342,6 +394,8 @@ type OverrideConfig struct {
 	AllowOverwrite bool
 	// AllowProxyConflict when proxies in teleport.yaml and update.yaml are mismatched.
 	AllowProxyConflict bool
+	// SELinuxSSHChanged specifies whether the user explicitly toggled SELinux behavior.
+	SELinuxSSHChanged bool
 }
 
 func deref[T any](ptr *T) T {
@@ -360,13 +414,15 @@ func toPtr[T any](t T) *T {
 // If the initial installation succeeds, the override configuration is persisted.
 // Otherwise, the configuration is not changed.
 // This function is idempotent.
-func (u *Updater) Install(ctx context.Context, override OverrideConfig) error {
+func (u *Updater) Install(ctx context.Context, override OverrideConfig) (err error) {
 	// Read configuration from update.yaml and override any new values passed as flags.
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
-	if err := validateConfigSpec(&cfg.Spec, override); err != nil {
+	origCfg := cfg.Copy()
+	// Set the desired state.
+	if err := updateConfigSpec(&cfg.Spec, override); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -409,6 +465,21 @@ func (u *Updater) Install(ctx context.Context, override OverrideConfig) error {
 		u.Log.InfoContext(ctx, "Initiating installation.", targetKey, target, activeKey, active)
 	}
 
+	// Write update.yaml before attempting to install.
+	// This ensures that update.yaml always exists when the agent is started and sends HELLO.
+	// The written file does not contain updated versions, only the desired configuration.
+	// It is reverted if the installation fails to start, so that configuration is not persisted.
+	if err := writeConfig(u.UpdateConfigFile, cfg); err != nil {
+		return trace.Wrap(err, "failed to write %s", UpdateConfigName)
+	}
+	defer func() {
+		if err != nil {
+			if err := writeConfig(u.UpdateConfigFile, origCfg); err != nil {
+				u.Log.ErrorContext(ctx, "Failed to revert invalid partial configuration.", "path", u.UpdateConfigFile, errorKey, err)
+			}
+		}
+	}()
+
 	if err := u.update(ctx, cfg, target, override.AllowOverwrite, resp.AGPL); err != nil {
 		if errors.Is(err, ErrFilePresent) && !override.AllowOverwrite {
 			u.Log.ErrorContext(ctx, "A non-packaged or outdated installation of Teleport was detected on this system.")
@@ -425,11 +496,12 @@ func (u *Updater) Install(ctx context.Context, override OverrideConfig) error {
 	// Note: skip_version is never set on failed enable, only failed update.
 
 	if err := writeConfig(u.UpdateConfigFile, cfg); err != nil {
-		return trace.Wrap(err, "failed to write %s", updateConfigName)
+		return trace.Wrap(err, "failed to write %s", UpdateConfigName)
 	}
 	u.Log.InfoContext(ctx, "Configuration updated.")
 	u.LogConfigWarnings(ctx, cfg.Spec.Path)
-	u.notices(ctx)
+	u.teleportNotices(ctx)
+	u.tbotNotices(ctx)
 	return nil
 }
 
@@ -458,9 +530,9 @@ func sameProxies(a, b string) bool {
 func (u *Updater) Remove(ctx context.Context, force bool) error {
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
-	if err := validateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
+	if err := updateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
 		return trace.Wrap(err)
 	}
 	active := cfg.Status.Active
@@ -478,7 +550,7 @@ func (u *Updater) Remove(ctx context.Context, force bool) error {
 	// it is clear we are not going to recover the package's systemd service if it
 	// was overwritten.
 	if filepath.Clean(cfg.Spec.Path) != filepath.Clean(defaultPathDir) {
-		if u.TeleportServiceName == serviceName {
+		if u.TeleportProcess.Name() == teleportServiceName {
 			if !force {
 				u.Log.ErrorContext(ctx, "Default Teleport systemd service would be removed, and --force was not passed.")
 				u.Log.ErrorContext(ctx, "Refusing to remove Teleport from this system.")
@@ -509,12 +581,27 @@ func (u *Updater) Remove(ctx context.Context, force bool) error {
 	u.Log.InfoContext(ctx, "Updater-managed installation of Teleport detected.")
 	u.Log.InfoContext(ctx, "Restoring packaged version of Teleport before removing.")
 
+	// Restart teleport and tbot.
+	// If a tbot service is present, and it was created by the updater,
+	// then we reuse the service for the package to avoid disruption.
+
+	customTbot, err := u.HasCustomTbot(ctx)
+	if err != nil {
+		customTbot = true
+		u.Log.ErrorContext(ctx, "Failed to determine if a custom tbot service is installed.", errorKey, err)
+		u.Log.ErrorContext(ctx, "Tbot will not be restarted by the updater after the package is restored.")
+	}
+	pg := ProcessGroup{u.TeleportProcess}
+	if !customTbot {
+		pg = append(pg, u.TbotProcess)
+	}
+
 	revertConfig := func(ctx context.Context) bool {
 		if ok := revert(ctx); !ok {
 			u.Log.ErrorContext(ctx, "Failed to revert Teleport symlinks. Installation likely broken.")
 			return false
 		}
-		if err := u.Process.Sync(ctx); err != nil {
+		if err := pg.Sync(ctx); err != nil {
 			u.Log.ErrorContext(ctx, "Failed to revert systemd configuration after failed restart.", errorKey, err)
 			return false
 		}
@@ -523,7 +610,7 @@ func (u *Updater) Remove(ctx context.Context, force bool) error {
 
 	// Sync systemd.
 
-	err = u.Process.Sync(ctx)
+	err = pg.Sync(ctx)
 	if errors.Is(err, context.Canceled) {
 		return trace.Errorf("sync canceled")
 	}
@@ -538,22 +625,19 @@ func (u *Updater) Remove(ctx context.Context, force bool) error {
 		return trace.Wrap(err, "failed to validate configuration for system package version of Teleport")
 	}
 
-	// Restart Teleport.
-
 	u.Log.InfoContext(ctx, "Teleport package successfully restored.")
-	err = u.Process.Reload(ctx)
+	err = pg.Reload(ctx)
 	if errors.Is(err, context.Canceled) {
 		return trace.Errorf("reload canceled")
 	}
 	if err != nil &&
-		!errors.Is(err, ErrNotNeeded) && // no output if restart not needed
 		!errors.Is(err, ErrNotSupported) { // already logged above for Sync
 
-		// If reloading Teleport at the new version fails, revert and reload.
+		// If reloading at the new version fails, revert and reload again.
 		u.Log.ErrorContext(ctx, "Reverting symlinks due to failed restart.")
 		if ok := revertConfig(ctx); ok {
-			if err := u.Process.Reload(ctx); err != nil && !errors.Is(err, ErrNotNeeded) {
-				u.Log.ErrorContext(ctx, "Failed to reload Teleport after reverting.", errorKey, err)
+			if err := pg.Reload(ctx); err != nil {
+				u.Log.ErrorContext(ctx, "Failed to reload after reverting.", errorKey, err, "service", pg.Name())
 				u.Log.ErrorContext(ctx, "Installation likely broken.")
 			} else {
 				u.Log.WarnContext(ctx, "Teleport updater detected an error with the new installation and successfully reverted it.")
@@ -572,12 +656,16 @@ func (u *Updater) Remove(ctx context.Context, force bool) error {
 func (u *Updater) removeWithoutSystem(ctx context.Context, cfg *UpdateConfig) error {
 	u.Log.InfoContext(ctx, "Updater-managed installation of Teleport detected.")
 	u.Log.InfoContext(ctx, "Attempting to unlink and remove.")
-	ok, err := u.Process.IsActive(ctx)
+
+	// Note: tbot.service could be from an unrelated installation, but we should still fail to be safe.
+	// This would only be an issue for primary installations on PATH, where removal will likely break tbot.
+	pg := ProcessGroup{u.TeleportProcess, u.TbotProcess}
+	ok, err := pg.IsActive(ctx)
 	if err != nil && !errors.Is(err, ErrNotSupported) {
 		return trace.Wrap(err)
 	}
 	if ok {
-		return trace.Errorf("refusing to remove active installation of Teleport, please stop and disable Teleport first")
+		return trace.Errorf("refusing to remove active installation, please stop and disable %s first", pg.Name())
 	}
 	if err := u.Installer.Unlink(ctx, cfg.Status.Active, cfg.Spec.Path); err != nil {
 		return trace.Wrap(err)
@@ -697,9 +785,9 @@ func (u *Updater) Status(ctx context.Context) (Status, error) {
 	// Read configuration from update.yaml.
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return out, trace.Wrap(err, "failed to read %s", updateConfigName)
+		return out, trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
-	if err := validateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
+	if err := updateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
 		return out, trace.Wrap(err)
 	}
 	if cfg.Spec.Proxy == "" {
@@ -724,7 +812,7 @@ func (u *Updater) Status(ctx context.Context) (Status, error) {
 func (u *Updater) Disable(ctx context.Context) error {
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
 	if !cfg.Spec.Enabled {
 		u.Log.InfoContext(ctx, "Automatic updates already disabled.")
@@ -732,7 +820,7 @@ func (u *Updater) Disable(ctx context.Context) error {
 	}
 	cfg.Spec.Enabled = false
 	if err := writeConfig(u.UpdateConfigFile, cfg); err != nil {
-		return trace.Wrap(err, "failed to write %s", updateConfigName)
+		return trace.Wrap(err, "failed to write %s", UpdateConfigName)
 	}
 	return nil
 }
@@ -742,7 +830,7 @@ func (u *Updater) Disable(ctx context.Context) error {
 func (u *Updater) Unpin(ctx context.Context) error {
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
 	if !cfg.Spec.Pinned {
 		u.Log.InfoContext(ctx, "Current version not pinned.", activeKey, cfg.Status.Active)
@@ -750,7 +838,7 @@ func (u *Updater) Unpin(ctx context.Context) error {
 	}
 	cfg.Spec.Pinned = false
 	if err := writeConfig(u.UpdateConfigFile, cfg); err != nil {
-		return trace.Wrap(err, "failed to write %s", updateConfigName)
+		return trace.Wrap(err, "failed to write %s", UpdateConfigName)
 	}
 	return nil
 }
@@ -764,9 +852,9 @@ func (u *Updater) Update(ctx context.Context, now bool) error {
 	// Read configuration from update.yaml and override any new values passed as flags.
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
-	if err := validateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
+	if err := updateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -784,7 +872,7 @@ func (u *Updater) Update(ctx context.Context, now bool) error {
 	}
 
 	if cfg.Spec.Path == "" {
-		return trace.Errorf("failed to read destination path for binary links from %s", updateConfigName)
+		return trace.Errorf("failed to read destination path for binary links from %s", UpdateConfigName)
 	}
 	cfg.Status.IDFile = u.UpdateIDFile
 
@@ -857,20 +945,21 @@ func (u *Updater) Update(ctx context.Context, now bool) error {
 	}
 	writeErr := writeConfig(u.UpdateConfigFile, cfg)
 	if writeErr != nil {
-		writeErr = trace.Wrap(writeErr, "failed to write %s", updateConfigName)
+		writeErr = trace.Wrap(writeErr, "failed to write %s", UpdateConfigName)
 	} else {
 		u.Log.InfoContext(ctx, "Configuration updated.")
 	}
-	// Show notices last
+	// Show teleportNotices last
 	if updateErr == nil && now {
-		u.notices(ctx)
+		u.teleportNotices(ctx)
+		u.tbotNotices(ctx)
 	}
 	return trace.NewAggregate(updateErr, writeErr)
 }
 
 func (u *Updater) find(ctx context.Context, cfg *UpdateConfig, id string) (FindResp, error) {
 	if cfg.Spec.Proxy == "" {
-		return FindResp{}, trace.Errorf("Teleport proxy URL must be specified with --proxy or present in %s", updateConfigName)
+		return FindResp{}, trace.Errorf("Teleport proxy URL must be specified with --proxy or present in %s", UpdateConfigName)
 	}
 	addr, err := libutils.ParseAddr(cfg.Spec.Proxy)
 	if err != nil {
@@ -927,7 +1016,7 @@ func (u *Updater) removeRevision(ctx context.Context, cfg *UpdateConfig, rev Rev
 	return trace.Wrap(u.Installer.Remove(ctx, rev))
 }
 
-func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision, force, agpl bool) error {
+func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision, overwrite, agpl bool) error {
 	baseURL := cfg.Spec.BaseURL
 	if baseURL == "" {
 		if agpl {
@@ -968,11 +1057,31 @@ func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision
 	// Cleanup logic at the end of this function will ensure that they are removed
 	// eventually.
 
-	revert, err := u.Installer.Link(ctx, target, cfg.Spec.Path, force)
+	revert, err := u.Installer.Link(ctx, target, cfg.Spec.Path, overwrite)
 	if err != nil {
 		return trace.Wrap(err, "failed to link")
 	}
 
+	ignoreTbot := false
+	if customTbot, err := u.HasCustomTbot(ctx); err != nil {
+		u.Log.ErrorContext(ctx, "Failed to determine if a custom tbot service is installed.", errorKey, err)
+		u.Log.ErrorContext(ctx, "Tbot will not be managed by the updater.")
+		ignoreTbot = true
+	} else if overwrite && customTbot {
+		u.Log.WarnContext(ctx, "Custom tbot service will be overwritten by the updater.")
+		ignoreTbot = false
+	} else if customTbot {
+		u.Log.WarnContext(ctx, "Unable to manage tbot process due to custom tbot.service file.")
+		u.Log.WarnContext(ctx, "Pass --overwrite to delete and replace tbot.service with an updater-managed copy.")
+		u.Log.WarnContext(ctx, "The updater-managed copy of tbot may still be modified using systemd drop-in files.")
+		ignoreTbot = true
+	}
+
+	pg := ProcessGroup{u.TeleportProcess}
+	if !ignoreTbot {
+		pg = append(pg, u.TbotProcess)
+	}
+
 	// If we fail to revert after this point, the next update/enable will
 	// fix the link to restore the active version.
 
@@ -980,7 +1089,7 @@ func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision
 		if target.Version != "" {
 			cfg.Status.Skip = toPtr(target)
 		}
-		if force {
+		if overwrite {
 			u.Log.ErrorContext(ctx, "Unable to revert Teleport symlinks in overwrite mode. Installation likely broken.")
 			return false
 		}
@@ -988,38 +1097,24 @@ func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision
 			u.Log.ErrorContext(ctx, "Failed to revert Teleport symlinks. Installation likely broken.")
 			return false
 		}
-		if err := u.SetupNamespace(ctx, cfg.Spec.Path); err != nil {
+		// Note: this version may be inaccurate if the active installation was modified
+		if err := u.SetupNamespace(ctx, cfg.Spec.Path, cfg.Status.Active, SetupFeatures{
+			SELinuxSSH: cfg.Spec.SELinuxSSH,
+			Tbot:       !ignoreTbot,
+		}); err != nil {
 			u.Log.ErrorContext(ctx, "Failed to revert configuration after failed restart.", errorKey, err)
 			return false
 		}
 		return true
 	}
 
-	if cfg.Status.Active != target {
-		err := u.ReexecSetup(ctx, cfg.Spec.Path, true)
-		if errors.Is(err, context.Canceled) {
-			return trace.Errorf("check canceled")
-		}
-		if err != nil {
-			// If reloading Teleport at the new version fails, revert and reload.
-			u.Log.ErrorContext(ctx, "Reverting symlinks due to failed restart.")
-			if ok := revertConfig(ctx); ok {
-				if err := u.Process.Reload(ctx); err != nil && !errors.Is(err, ErrNotNeeded) {
-					u.Log.ErrorContext(ctx, "Failed to reload Teleport after reverting. Installation likely broken.", errorKey, err)
-				} else {
-					u.Log.WarnContext(ctx, "Teleport updater detected an error with the new installation and successfully reverted it.")
-				}
-			}
-			return trace.Wrap(err, "failed to start new version %s of Teleport", target)
-		}
-		u.Log.InfoContext(ctx, "Target version successfully installed.", targetKey, target)
+	// If re-linking the same version, do not attempt to restart services.
 
-		if r := cfg.Status.Active; r.Version != "" {
-			cfg.Status.Backup = toPtr(r)
-		}
-		cfg.Status.Active = target
-	} else {
-		err := u.ReexecSetup(ctx, cfg.Spec.Path, false)
+	if cfg.Status.Active == target {
+		err := u.ReexecSetup(ctx, cfg.Spec.Path, target, SetupFeatures{
+			SELinuxSSH: cfg.Spec.SELinuxSSH,
+			Tbot:       !ignoreTbot,
+		}, false)
 		if errors.Is(err, context.Canceled) {
 			return trace.Errorf("check canceled")
 		}
@@ -1032,23 +1127,72 @@ func (u *Updater) update(ctx context.Context, cfg *UpdateConfig, target Revision
 			return trace.Wrap(err, "failed to validate new version %s of Teleport", target)
 		}
 		u.Log.InfoContext(ctx, "Target version successfully validated.", targetKey, target)
+		u.cleanup(ctx, cfg, []Revision{
+			target, active, backup,
+		})
+		return nil
 	}
-	if r := deref(cfg.Status.Backup); r.Version != "" {
-		u.Log.InfoContext(ctx, "Backup version set.", backupKey, r)
+
+	// If a new version was linked, restart services (including on revert).
+
+	err = u.ReexecSetup(ctx, cfg.Spec.Path, target, SetupFeatures{
+		SELinuxSSH: cfg.Spec.SELinuxSSH,
+		Tbot:       !ignoreTbot,
+	}, true)
+	if errors.Is(err, context.Canceled) {
+		return trace.Errorf("check canceled")
+	}
+	if err != nil {
+		// If reloading Teleport at the new version fails, revert and reload.
+		u.Log.ErrorContext(ctx, "Reverting symlinks due to failed restart.")
+		if ok := revertConfig(ctx); ok {
+			if err := pg.Reload(ctx); err != nil {
+				u.Log.ErrorContext(ctx, "Failed to reload services after reverting. Installation likely broken.", errorKey, err)
+			} else {
+				u.Log.WarnContext(ctx, "Teleport updater detected an error with the new installation and successfully reverted it.")
+			}
+		}
+		return trace.Wrap(err, "failed to start new version %s of Teleport", target)
 	}
+	u.Log.InfoContext(ctx, "Target version successfully installed.", targetKey, target)
+
+	if r := cfg.Status.Active; r.Version != "" {
+		cfg.Status.Backup = toPtr(r)
+	}
+	cfg.Status.Active = target
 	u.cleanup(ctx, cfg, []Revision{
 		target, active, backup,
 	})
 	return nil
 }
 
+// SetupFeatures describes options for commands that setup the host to run Teleport.
+type SetupFeatures struct {
+	// SELinuxSSH controls whether SELinux is enabled for SSH service.
+	SELinuxSSH bool
+	// Tbot controls whether tbot service is installed.
+	Tbot bool
+}
+
 // Setup writes updater configuration and verifies the Teleport installation.
 // If restart is true, Setup also restarts Teleport.
 // Setup is safe to run concurrently with other Updater commands.
-func (u *Updater) Setup(ctx context.Context, path string, restart bool) error {
-	// Setup teleport-updater configuration and sync systemd.
+func (u *Updater) Setup(ctx context.Context, path string, rev Revision, f SetupFeatures, restart bool) error {
 
-	err := u.SetupNamespace(ctx, path)
+	// Write teleport systemd service.
+	if err := u.WriteTeleportService(ctx, path, rev); err != nil {
+		return trace.Wrap(err, "failed to write teleport systemd service")
+	}
+
+	// Write tbot systemd service.
+	if f.Tbot {
+		if err := u.WriteTbotService(ctx, path, rev); err != nil {
+			return trace.Wrap(err, "failed to write teleport systemd service")
+		}
+	}
+
+	// Setup teleport-updater configuration and sync systemd.
+	err := u.SetupNamespace(ctx, path, rev, f)
 	if errors.Is(err, context.Canceled) {
 		return trace.Errorf("sync canceled")
 	}
@@ -1056,40 +1200,72 @@ func (u *Updater) Setup(ctx context.Context, path string, restart bool) error {
 		return trace.Wrap(err, "failed to setup updater")
 	}
 
-	present, err := u.Process.IsPresent(ctx)
-	if errors.Is(err, context.Canceled) {
-		return trace.Errorf("config check canceled")
+	// Validations
+	teleportPresent, err := u.validateProcess(ctx, u.TeleportProcess)
+	if err != nil {
+		return trace.Wrap(err)
 	}
-	if errors.Is(err, ErrNotSupported) {
-		u.Log.WarnContext(ctx, "Skipping all systemd setup because systemd is not running.")
+	var tbotPresent bool
+	if f.Tbot {
+		tbotPresent, err = u.validateProcess(ctx, u.TbotProcess)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	// Restart Teleport only if necessary.
+	if !restart {
 		return nil
 	}
-	if errors.Is(err, ErrNotAvailable) {
-		u.Log.DebugContext(ctx, "Systemd version is outdated. Skipping SELinux verification.")
-	} else if err != nil {
-		return trace.Wrap(err, "failed to determine if new version of Teleport has an installed systemd service")
-	} else if !present {
-		return trace.Errorf("cannot find systemd service for new version of Teleport, check SELinux settings")
+
+	if !teleportPresent || (f.Tbot && !tbotPresent) {
+		u.Log.ErrorContext(ctx, "Missing services will not be restarted.")
 	}
 
-	// Restart Teleport if necessary.
+	var pg ProcessGroup
+	if teleportPresent {
+		pg = append(pg, u.TeleportProcess)
+	}
+	if tbotPresent {
+		pg = append(pg, u.TbotProcess)
+	}
 
-	if restart {
-		err = u.Process.Reload(ctx)
-		if errors.Is(err, context.Canceled) {
-			return trace.Errorf("reload canceled")
-		}
-		if err != nil &&
-			!errors.Is(err, ErrNotNeeded) { // skip if not needed
-			return trace.Wrap(err, "failed to reload Teleport")
-		}
+	err = pg.Reload(ctx)
+	if errors.Is(err, context.Canceled) {
+		return trace.Errorf("reload canceled")
+	}
+	if err != nil {
+		return trace.Wrap(err)
 	}
 	return nil
 }
 
-// notices displays final notices after install or update.
-func (u *Updater) notices(ctx context.Context) {
-	enabled, err := u.Process.IsEnabled(ctx)
+func (u *Updater) validateProcess(ctx context.Context, p Process) (bool, error) {
+	present, err := p.IsPresent(ctx)
+	if errors.Is(err, context.Canceled) {
+		return false, trace.Errorf("config check canceled")
+	}
+	if errors.Is(err, ErrNotSupported) {
+		u.Log.WarnContext(ctx, "Skipping systemd setup because systemd is not running.", "service", p.Name())
+		return false, nil
+	}
+	if errors.Is(err, ErrNotAvailable) {
+		u.Log.DebugContext(ctx, "Systemd version is outdated. Skipping service verification.", "service", p.Name())
+		return true, nil
+	}
+	if err != nil {
+		return false, trace.Wrap(err, "failed to determine if the new version has an installed systemd service", "service", p.Name())
+	}
+	if !present {
+		u.Log.ErrorContext(ctx, "Cannot find systemd service for the new version, check SELinux settings.", "service", p.Name())
+		return false, nil
+	}
+	return true, nil
+}
+
+// teleportNotices displays final notices for teleport after install or update.
+func (u *Updater) teleportNotices(ctx context.Context) {
+	enabled, err := u.TeleportProcess.IsEnabled(ctx)
 	if errors.Is(err, ErrNotSupported) {
 		u.Log.WarnContext(ctx, "Teleport is installed, but systemd is not present to start it.")
 		u.Log.WarnContext(ctx, "After configuring teleport.yaml, your system must also be configured to start Teleport.")
@@ -1103,7 +1279,7 @@ func (u *Updater) notices(ctx context.Context) {
 		u.Log.ErrorContext(ctx, "Failed to determine if Teleport is enabled.", errorKey, err)
 		return
 	}
-	active, err := u.Process.IsActive(ctx)
+	active, err := u.TeleportProcess.IsActive(ctx)
 	if err != nil {
 		u.Log.ErrorContext(ctx, "Failed to determine if Teleport is active.", errorKey, err)
 		return
@@ -1111,22 +1287,67 @@ func (u *Updater) notices(ctx context.Context) {
 	if !enabled && active {
 		u.Log.WarnContext(ctx, "Teleport is installed and started, but not configured to start on boot.")
 		u.Log.WarnContext(ctx, "After configuring teleport.yaml, you must enable it.",
-			"command", "systemctl enable "+u.TeleportServiceName)
+			"command", "systemctl enable "+u.TeleportProcess.Name())
 	}
 	if !active && enabled {
 		u.Log.WarnContext(ctx, "Teleport is installed and enabled at boot, but not running.")
 		u.Log.WarnContext(ctx, "After configuring teleport.yaml, you must start it.",
-			"command", "systemctl start "+u.TeleportServiceName)
+			"command", "systemctl start "+u.TeleportProcess.Name())
 	}
 	if !active && !enabled {
 		u.Log.WarnContext(ctx, "Teleport is installed, but not running or enabled at boot.")
-		u.Log.WarnContext(ctx, "After configuring teleport.yaml, you must enable and start.",
-			"command", "systemctl enable --now "+u.TeleportServiceName)
+		u.Log.WarnContext(ctx, "To enable and start Teleport, configure teleport.yaml and run systemctl.",
+			"command", "systemctl enable --now "+u.TeleportProcess.Name())
+	}
+}
+
+// tbotNotices displays final notices for tbot after install or update.
+func (u *Updater) tbotNotices(ctx context.Context) {
+	if custom, err := u.HasCustomTbot(ctx); err != nil {
+		u.Log.ErrorContext(ctx, "Failed to determine if a custom tbot service is installed.", errorKey, err)
+		return
+	} else if custom {
+		// Skip tbot notices if a custom tbot service is installed.
+		return
+	}
+	enabled, err := u.TbotProcess.IsEnabled(ctx)
+	if errors.Is(err, ErrNotSupported) ||
+		errors.Is(err, ErrNotAvailable) {
+		// Ignore for tbot, as the corresponding teleport error will cover it.
+		return
+	}
+	if err != nil {
+		u.Log.ErrorContext(ctx, "Failed to determine if tbot is enabled.", errorKey, err)
+		return
+	}
+	active, err := u.TbotProcess.IsActive(ctx)
+	if err != nil {
+		u.Log.ErrorContext(ctx, "Failed to determine if tbot is active.", errorKey, err)
+		return
+	}
+	if !enabled && active {
+		u.Log.InfoContext(ctx, "tbot is installed and started, but not configured to start on boot.")
+		u.Log.WarnContext(ctx, "After configuring tbot.yaml, you must enable it.",
+			"command", "systemctl enable "+u.TbotProcess.Name())
+	}
+	if !active && enabled {
+		u.Log.WarnContext(ctx, "tbot is installed and enabled at boot, but not running.")
+		u.Log.WarnContext(ctx, "After configuring tbot.yaml, you must start it.",
+			"command", "systemctl start "+u.TbotProcess.Name())
+	}
+	if !active && !enabled {
+		// Info-level as many installations will be agent-only.
+		u.Log.InfoContext(ctx, "tbot is installed, but not running or enabled at boot.")
+		u.Log.InfoContext(ctx, "To enable and start tbot, configure tbot.yaml and run systemctl.",
+			"command", "systemctl enable --now "+u.TbotProcess.Name())
 	}
 }
 
 // cleanup orphan installations
 func (u *Updater) cleanup(ctx context.Context, cfg *UpdateConfig, keep []Revision) {
+	if r := deref(cfg.Status.Backup); r.Version != "" {
+		u.Log.InfoContext(ctx, "Backup version set.", backupKey, r)
+	}
 	revs, err := u.Installer.List(ctx)
 	if err != nil {
 		u.Log.ErrorContext(ctx, "Failed to read installed versions.", errorKey, err)
@@ -1160,9 +1381,9 @@ func (u *Updater) cleanup(ctx context.Context, cfg *UpdateConfig, keep []Revisio
 func (u *Updater) LinkPackage(ctx context.Context) error {
 	cfg, err := readConfig(u.UpdateConfigFile)
 	if err != nil {
-		return trace.Wrap(err, "failed to read %s", updateConfigName)
+		return trace.Wrap(err, "failed to read %s", UpdateConfigName)
 	}
-	if err := validateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
+	if err := updateConfigSpec(&cfg.Spec, OverrideConfig{}); err != nil {
 		return trace.Wrap(err)
 	}
 	active := cfg.Status.Active
@@ -1186,19 +1407,22 @@ func (u *Updater) LinkPackage(ctx context.Context) error {
 
 	// If syncing succeeds, ensure the installed systemd service can be found via systemctl.
 	// SELinux contexts can interfere with systemctl's ability to read service files.
-	if err := u.Process.Sync(ctx); errors.Is(err, ErrNotSupported) {
+	err = u.TeleportProcess.Sync(ctx)
+	if errors.Is(err, ErrNotSupported) {
 		u.Log.WarnContext(ctx, "Systemd is not installed. Skipping sync.")
-	} else if err != nil {
+		u.Log.InfoContext(ctx, "Successfully linked system package installation.")
+		return nil
+	}
+	if err != nil {
 		return trace.Wrap(err, "failed to sync systemd configuration")
-	} else {
-		present, err := u.Process.IsPresent(ctx)
-		if errors.Is(err, ErrNotAvailable) {
-			u.Log.DebugContext(ctx, "Systemd version is outdated. Skipping SELinux verification.")
-		} else if err != nil {
-			return trace.Wrap(err, "failed to determine if Teleport has an installed systemd service")
-		} else if !present {
-			return trace.Errorf("cannot find systemd service for Teleport, check SELinux settings")
-		}
+	}
+
+	present, err := u.validateProcess(ctx, u.TeleportProcess)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if !present {
+		return trace.Errorf("missing Teleport service")
 	}
 	u.Log.InfoContext(ctx, "Successfully linked system package installation.")
 	return nil
@@ -1210,7 +1434,7 @@ func (u *Updater) UnlinkPackage(ctx context.Context) error {
 	if err := u.Installer.UnlinkSystem(ctx); err != nil {
 		return trace.Wrap(err, "failed to unlink system package installation")
 	}
-	if err := u.Process.Sync(ctx); errors.Is(err, ErrNotSupported) {
+	if err := u.TeleportProcess.Sync(ctx); errors.Is(err, ErrNotSupported) {
 		u.Log.WarnContext(ctx, "Systemd is not installed. Skipping sync.")
 	} else if err != nil {
 		return trace.Wrap(err, "failed to sync systemd configuration")
diff --git a/lib/autoupdate/agent/updater_test.go b/lib/autoupdate/agent/updater_test.go
index 05e78f5464ed7..b210c7f401aa9 100644
--- a/lib/autoupdate/agent/updater_test.go
+++ b/lib/autoupdate/agent/updater_test.go
@@ -30,6 +30,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"slices"
 	"strings"
 	"testing"
@@ -94,8 +95,8 @@ func TestUpdater_Disable(t *testing.T) {
 		{
 			name: "enabled",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: true,
 				},
@@ -104,8 +105,8 @@ func TestUpdater_Disable(t *testing.T) {
 		{
 			name: "already disabled",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -131,7 +132,7 @@ func TestUpdater_Disable(t *testing.T) {
 			ns := &Namespace{installDir: dir}
 			_, err := ns.Init()
 			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
+			cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
 			updater, err := NewLocalUpdater(LocalUpdaterConfig{
 				InsecureSkipVerify: true,
 			}, ns)
@@ -181,8 +182,8 @@ func TestUpdater_Unpin(t *testing.T) {
 		{
 			name: "pinned",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Pinned: true,
 				},
@@ -191,8 +192,8 @@ func TestUpdater_Unpin(t *testing.T) {
 		{
 			name: "not pinned",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Pinned: false,
 				},
@@ -218,7 +219,7 @@ func TestUpdater_Unpin(t *testing.T) {
 			ns := &Namespace{installDir: dir}
 			_, err := ns.Init()
 			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
+			cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
 
 			updater, err := NewLocalUpdater(LocalUpdaterConfig{
 				InsecureSkipVerify: true,
@@ -289,8 +290,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates enabled during window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -314,8 +315,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates enabled now",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -339,8 +340,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates enabled now, not started or enabled",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -366,8 +367,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates disabled during window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -383,8 +384,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "missing path during window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Group:   "group",
 					BaseURL: "https://example.com",
@@ -400,8 +401,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates enabled outside of window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -417,8 +418,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "updates disabled outside of window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Group:   "group",
@@ -433,8 +434,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "insecure URL",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "http://example.com",
@@ -448,8 +449,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "install error",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Enabled: true,
@@ -466,8 +467,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "version already installed in window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -483,8 +484,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "version already installed outside of window",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -499,8 +500,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "version detects as linked",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -526,8 +527,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "backup version removed on install",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -554,8 +555,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "backup version is linked",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -582,8 +583,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "backup version kept when no change",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -603,8 +604,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "FIPS and Enterprise flags",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -637,8 +638,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "setup fails",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -668,8 +669,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "agpl requires base URL",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					Enabled: true,
@@ -691,8 +692,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "skip version",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -710,8 +711,8 @@ func TestUpdater_Update(t *testing.T) {
 		{
 			name: "pinned version",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path:    defaultPathDir,
 					BaseURL: "https://example.com",
@@ -730,160 +731,187 @@ func TestUpdater_Update(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			var requestedGroup string
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				requestedGroup = r.URL.Query().Get("group")
-				config := webclient.PingResponse{
-					AutoUpdate: webclient.AutoUpdateSettings{
-						AgentVersion:    "16.3.0",
-						AgentAutoUpdate: tt.inWindow,
-					},
-				}
-				config.Edition = "community"
-				if tt.flags&autoupdate.FlagEnterprise != 0 {
-					config.Edition = "ent"
-				}
-				if tt.agpl {
-					config.Edition = "oss"
+			for _, tbot := range []bool{false, true} {
+				var requestedGroup string
+				server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					requestedGroup = r.URL.Query().Get("group")
+					config := webclient.PingResponse{
+						AutoUpdate: webclient.AutoUpdateSettings{
+							AgentVersion:    "16.3.0",
+							AgentAutoUpdate: tt.inWindow,
+						},
+					}
+					config.Edition = "community"
+					if tt.flags&autoupdate.FlagEnterprise != 0 {
+						config.Edition = "ent"
+					}
+					if tt.agpl {
+						config.Edition = "oss"
+					}
+					config.FIPS = tt.flags&autoupdate.FlagFIPS != 0
+					err := json.NewEncoder(w).Encode(config)
+					require.NoError(t, err)
+				}))
+				t.Cleanup(server.Close)
+
+				dir := t.TempDir()
+				ns := &Namespace{
+					installDir:     dir,
+					defaultPathDir: "ignored",
+					updaterIDFile:  "updater-id-file",
 				}
-				config.FIPS = tt.flags&autoupdate.FlagFIPS != 0
-				err := json.NewEncoder(w).Encode(config)
+				_, err := ns.Init()
 				require.NoError(t, err)
-			}))
-			t.Cleanup(server.Close)
-
-			dir := t.TempDir()
-			ns := &Namespace{
-				installDir:     dir,
-				defaultPathDir: "ignored",
-				updaterIDFile:  "updater-id-file",
-			}
-			_, err := ns.Init()
-			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
-
-			updater, err := NewLocalUpdater(LocalUpdaterConfig{
-				InsecureSkipVerify: true,
-			}, ns)
-			require.NoError(t, err)
+				cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
 
-			// Create config file only if provided in test case
-			if tt.cfg != nil {
-				tt.cfg.Spec.Proxy = strings.TrimPrefix(server.URL, "https://")
-				b, err := yaml.Marshal(tt.cfg)
-				require.NoError(t, err)
-				err = os.WriteFile(cfgPath, b, 0600)
+				updater, err := NewLocalUpdater(LocalUpdaterConfig{
+					InsecureSkipVerify: true,
+				}, ns)
 				require.NoError(t, err)
-			}
 
-			var (
-				installedRevision Revision
-				installedBaseURL  string
-				linkedRevision    Revision
-				removedRevisions  []Revision
-				revertFuncCalls   int
-				setupCalls        int
-				revertSetupCalls  int
-				reloadCalls       int
-			)
-			updater.Installer = &testInstaller{
-				FuncInstall: func(_ context.Context, rev Revision, baseURL string, force bool) error {
-					for _, r := range tt.linkedRevisions {
-						if r == rev {
-							require.False(t, force)
+				// Create config file only if provided in test case
+				if tt.cfg != nil {
+					tt.cfg.Spec.Proxy = strings.TrimPrefix(server.URL, "https://")
+					b, err := yaml.Marshal(tt.cfg)
+					require.NoError(t, err)
+					err = os.WriteFile(cfgPath, b, 0600)
+					require.NoError(t, err)
+				}
+
+				var (
+					installedRevision   Revision
+					installedBaseURL    string
+					linkedRevision      Revision
+					removedRevisions    []Revision
+					revertFuncCalls     int
+					setupCalls          int
+					revertSetupCalls    int
+					teleportReloadCalls int
+					tbotReloadCalls     int
+				)
+				updater.Installer = &testInstaller{
+					FuncInstall: func(_ context.Context, rev Revision, baseURL string, force bool) error {
+						for _, r := range tt.linkedRevisions {
+							if r == rev {
+								require.False(t, force)
+							}
 						}
-					}
-					installedRevision = rev
-					installedBaseURL = baseURL
-					return tt.installErr
-				},
-				FuncLink: func(_ context.Context, rev Revision, path string, force bool) (revert func(context.Context) bool, err error) {
-					linkedRevision = rev
-					return func(_ context.Context) bool {
-						revertFuncCalls++
-						return true
-					}, nil
-				},
-				FuncList: func(_ context.Context) (revs []Revision, err error) {
-					return slices.Compact([]Revision{
-						installedRevision,
-						tt.cfg.Status.Active,
-						NewRevision("unknown-version", 0),
-					}), nil
-				},
-				FuncRemove: func(_ context.Context, rev Revision) error {
-					removedRevisions = append(removedRevisions, rev)
+						installedRevision = rev
+						installedBaseURL = baseURL
+						return tt.installErr
+					},
+					FuncLink: func(_ context.Context, rev Revision, path string, force bool) (revert func(context.Context) bool, err error) {
+						linkedRevision = rev
+						return func(_ context.Context) bool {
+							revertFuncCalls++
+							return true
+						}, nil
+					},
+					FuncList: func(_ context.Context) (revs []Revision, err error) {
+						return slices.Compact([]Revision{
+							installedRevision,
+							tt.cfg.Status.Active,
+							NewRevision("unknown-version", 0),
+						}), nil
+					},
+					FuncRemove: func(_ context.Context, rev Revision) error {
+						removedRevisions = append(removedRevisions, rev)
+						return nil
+					},
+					FuncIsLinked: func(ctx context.Context, rev Revision, path string) (bool, error) {
+						return slices.Contains(tt.linkedRevisions, rev), nil
+					},
+				}
+				updater.TeleportProcess = &testProcess{
+					FuncName: func() string {
+						return "teleport"
+					},
+					FuncReload: func(_ context.Context) error {
+						teleportReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsPresent: func(ctx context.Context) (bool, error) {
+						return true, nil
+					},
+					FuncIsEnabled: func(ctx context.Context) (bool, error) {
+						return !tt.notEnabled, nil
+					},
+					FuncIsActive: func(ctx context.Context) (bool, error) {
+						return !tt.notActive, nil
+					},
+				}
+				updater.TbotProcess = &testProcess{
+					FuncName: func() string {
+						return "tbot"
+					},
+					FuncReload: func(_ context.Context) error {
+						tbotReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsPresent: func(ctx context.Context) (bool, error) {
+						return true, nil
+					},
+					FuncIsEnabled: func(ctx context.Context) (bool, error) {
+						return !tt.notEnabled, nil
+					},
+					FuncIsActive: func(ctx context.Context) (bool, error) {
+						return !tt.notActive, nil
+					},
+				}
+				var restarted bool
+				updater.ReexecSetup = func(_ context.Context, path string, rev Revision, _ SetupFeatures, reload bool) error {
+					restarted = reload
+					setupCalls++
+					return tt.setupErr
+				}
+				updater.SetupNamespace = func(_ context.Context, path string, rev Revision, _ SetupFeatures) error {
+					revertSetupCalls++
 					return nil
-				},
-				FuncIsLinked: func(ctx context.Context, rev Revision, path string) (bool, error) {
-					for _, r := range tt.linkedRevisions {
-						if r == rev {
-							return true, nil
-						}
-					}
-					return false, nil
-				},
-			}
-			updater.Process = &testProcess{
-				FuncReload: func(_ context.Context) error {
-					reloadCalls++
-					return tt.reloadErr
-				},
-				FuncIsPresent: func(ctx context.Context) (bool, error) {
-					return true, nil
-				},
-				FuncIsEnabled: func(ctx context.Context) (bool, error) {
-					return !tt.notEnabled, nil
-				},
-				FuncIsActive: func(ctx context.Context) (bool, error) {
-					return !tt.notActive, nil
-				},
-			}
-			var restarted bool
-			updater.ReexecSetup = func(_ context.Context, path string, reload bool) error {
-				restarted = reload
-				setupCalls++
-				return tt.setupErr
-			}
-			updater.SetupNamespace = func(_ context.Context, path string) error {
-				revertSetupCalls++
-				return nil
-			}
-
-			ctx := context.Background()
-			err = updater.Update(ctx, tt.now)
-			if tt.errMatch != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tt.errMatch)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, tt.installedRevision, installedRevision)
-			require.Equal(t, tt.installedBaseURL, installedBaseURL)
-			require.Equal(t, tt.linkedRevision, linkedRevision)
-			require.Equal(t, tt.removedRevisions, removedRevisions)
-			require.Equal(t, tt.flags, installedRevision.Flags)
-			require.Equal(t, tt.requestGroup, requestedGroup)
-			require.Equal(t, tt.reloadCalls, reloadCalls)
-			require.Equal(t, tt.revertCalls, revertSetupCalls)
-			require.Equal(t, tt.revertCalls, revertFuncCalls)
-			require.Equal(t, tt.setupCalls, setupCalls)
-			require.Equal(t, tt.restarted, restarted)
+				}
+				updater.HasCustomTbot = func(ctx context.Context) (bool, error) {
+					return !tbot, nil
+				}
 
-			if tt.cfg == nil {
-				_, err := os.Stat(cfgPath)
-				require.Error(t, err)
-				return
-			}
+				ctx := context.Background()
+				err = updater.Update(ctx, tt.now)
+				if tt.errMatch != "" {
+					require.Error(t, err)
+					assert.Contains(t, err.Error(), tt.errMatch)
+				} else {
+					require.NoError(t, err)
+				}
+				require.Equal(t, tt.installedRevision, installedRevision)
+				require.Equal(t, tt.installedBaseURL, installedBaseURL)
+				require.Equal(t, tt.linkedRevision, linkedRevision)
+				require.Equal(t, tt.removedRevisions, removedRevisions)
+				require.Equal(t, tt.flags, installedRevision.Flags)
+				require.Equal(t, tt.requestGroup, requestedGroup)
+				require.Equal(t, tt.reloadCalls, teleportReloadCalls)
+				if tbot && tt.reloadErr == nil {
+					require.Equal(t, tt.reloadCalls, tbotReloadCalls)
+				} else {
+					require.Equal(t, 0, tbotReloadCalls)
+				}
+				require.Equal(t, tt.revertCalls, revertSetupCalls)
+				require.Equal(t, tt.revertCalls, revertFuncCalls)
+				require.Equal(t, tt.setupCalls, setupCalls)
+				require.Equal(t, tt.restarted, restarted)
+
+				if tt.cfg == nil {
+					_, err := os.Stat(cfgPath)
+					require.Error(t, err)
+					return
+				}
 
-			data, err := os.ReadFile(cfgPath)
-			require.NoError(t, err)
-			data = blankTestAddr(data)
+				data, err := os.ReadFile(cfgPath)
+				require.NoError(t, err)
+				data = blankTestAddr(data)
 
-			if golden.ShouldSet() {
-				golden.Set(t, data)
+				if golden.ShouldSet() {
+					golden.Set(t, data)
+				}
+				require.Equal(t, string(golden.Get(t)), string(data))
 			}
-			require.Equal(t, string(golden.Get(t)), string(data))
 		})
 	}
 }
@@ -905,8 +933,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "updates enabled",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: true,
 				},
@@ -918,8 +946,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "pinned",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Pinned: true,
 				},
@@ -931,8 +959,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "updates disabled",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -944,8 +972,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "already linked",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -958,8 +986,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "link error",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -984,8 +1012,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "systemd is not installed, already linked",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -997,8 +1025,8 @@ func TestUpdater_LinkPackage(t *testing.T) {
 		{
 			name: "SELinux blocks service from being read",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: false,
 				},
@@ -1006,7 +1034,7 @@ func TestUpdater_LinkPackage(t *testing.T) {
 			tryLinkSystemCalls: 1,
 			syncCalls:          1,
 			notPresent:         true,
-			errMatch:           "cannot find systemd service",
+			errMatch:           "missing Teleport service",
 		},
 	}
 
@@ -1016,7 +1044,7 @@ func TestUpdater_LinkPackage(t *testing.T) {
 			ns := &Namespace{installDir: dir}
 			_, err := ns.Init()
 			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
+			cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
 
 			updater, err := NewLocalUpdater(LocalUpdaterConfig{
 				InsecureSkipVerify: true,
@@ -1039,7 +1067,10 @@ func TestUpdater_LinkPackage(t *testing.T) {
 				},
 			}
 			var syncCalls int
-			updater.Process = &testProcess{
+			updater.TeleportProcess = &testProcess{
+				FuncName: func() string {
+					return "test"
+				},
 				FuncSync: func(_ context.Context) error {
 					syncCalls++
 					return tt.syncErr
@@ -1094,16 +1125,16 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no active version",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 			},
 			teardownCalls: 1,
 		},
 		{
 			name: "no conflicting system links, process disabled, force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision(version, 0),
 				},
@@ -1115,8 +1146,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process active, force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1133,8 +1164,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1151,8 +1182,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, no force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1167,8 +1198,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, no systemd, force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1186,8 +1217,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, custom path, force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: "custom",
 				},
@@ -1202,8 +1233,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, custom path, no force",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: "custom",
 				},
@@ -1216,8 +1247,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "no system links, process disabled, custom path, no force, custom service",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: "custom",
 				},
@@ -1233,8 +1264,25 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "active version",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					Path: defaultPathDir,
+				},
+				Status: UpdateStatus{
+					Active: NewRevision(version, 0),
+				},
+			},
+			linkSystemCalls: 1,
+			syncCalls:       1,
+			reloadCalls:     1,
+			teardownCalls:   1,
+		},
+		{
+			name: "active version with tbot",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1250,8 +1298,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "active version, no systemd",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1269,8 +1317,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "active version, no reload",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1282,13 +1330,12 @@ func TestUpdater_Remove(t *testing.T) {
 			syncCalls:       1,
 			reloadCalls:     1,
 			teardownCalls:   1,
-			reloadErr:       ErrNotNeeded,
 		},
 		{
 			name: "active version, sync error",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1305,8 +1352,8 @@ func TestUpdater_Remove(t *testing.T) {
 		{
 			name: "active version, reload error",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Path: defaultPathDir,
 				},
@@ -1325,82 +1372,111 @@ func TestUpdater_Remove(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			dir := t.TempDir()
-			ns := &Namespace{installDir: dir}
-			_, err := ns.Init()
-			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
-
-			updater, err := NewLocalUpdater(LocalUpdaterConfig{
-				InsecureSkipVerify: true,
-			}, ns)
-			require.NoError(t, err)
-			updater.TeleportServiceName = serviceName
-			if tt.serviceName != "" {
-				updater.TeleportServiceName = tt.serviceName
-			}
-
-			// Create config file only if provided in test case
-			if tt.cfg != nil {
-				b, err := yaml.Marshal(tt.cfg)
+			for _, tbot := range []bool{false, true} {
+				dir := t.TempDir()
+				ns := &Namespace{installDir: dir}
+				_, err := ns.Init()
 				require.NoError(t, err)
-				err = os.WriteFile(cfgPath, b, 0600)
+				cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
+
+				updater, err := NewLocalUpdater(LocalUpdaterConfig{
+					InsecureSkipVerify: true,
+				}, ns)
 				require.NoError(t, err)
-			}
 
-			var (
-				linkSystemCalls int
-				revertFuncCalls int
-				syncCalls       int
-				reloadCalls     int
-				teardownCalls   int
-				unlinkedVersion string
-			)
-			updater.Installer = &testInstaller{
-				FuncLinkSystem: func(_ context.Context) (revert func(context.Context) bool, err error) {
-					linkSystemCalls++
-					return func(_ context.Context) bool {
-						revertFuncCalls++
-						return true
-					}, tt.linkSystemErr
-				},
-				FuncUnlink: func(_ context.Context, rev Revision, path string) error {
-					unlinkedVersion = rev.Version
+				// Create config file only if provided in test case
+				if tt.cfg != nil {
+					b, err := yaml.Marshal(tt.cfg)
+					require.NoError(t, err)
+					err = os.WriteFile(cfgPath, b, 0600)
+					require.NoError(t, err)
+				}
+
+				var (
+					linkSystemCalls     int
+					revertFuncCalls     int
+					teleportSyncCalls   int
+					teleportReloadCalls int
+					tbotSyncCalls       int
+					tbotReloadCalls     int
+					teardownCalls       int
+					unlinkedVersion     string
+				)
+				updater.Installer = &testInstaller{
+					FuncLinkSystem: func(_ context.Context) (revert func(context.Context) bool, err error) {
+						linkSystemCalls++
+						return func(_ context.Context) bool {
+							revertFuncCalls++
+							return true
+						}, tt.linkSystemErr
+					},
+					FuncUnlink: func(_ context.Context, rev Revision, path string) error {
+						unlinkedVersion = rev.Version
+						return nil
+					},
+				}
+				updater.TeleportProcess = &testProcess{
+					FuncName: func() string {
+						if tt.serviceName != "" {
+							return tt.serviceName
+						}
+						return teleportServiceName
+					},
+					FuncSync: func(_ context.Context) error {
+						teleportSyncCalls++
+						return tt.syncErr
+					},
+					FuncReload: func(_ context.Context) error {
+						teleportReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsActive: func(_ context.Context) (bool, error) {
+						return tt.processActive, tt.isActiveErr
+					},
+				}
+				updater.TbotProcess = &testProcess{
+					FuncSync: func(_ context.Context) error {
+						tbotSyncCalls++
+						return tt.syncErr
+					},
+					FuncReload: func(_ context.Context) error {
+						tbotReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsActive: func(_ context.Context) (bool, error) {
+						return tt.processActive, tt.isActiveErr
+					},
+				}
+				updater.TeardownNamespace = func(_ context.Context) error {
+					teardownCalls++
 					return nil
-				},
-			}
-			updater.Process = &testProcess{
-				FuncSync: func(_ context.Context) error {
-					syncCalls++
-					return tt.syncErr
-				},
-				FuncReload: func(_ context.Context) error {
-					reloadCalls++
-					return tt.reloadErr
-				},
-				FuncIsActive: func(_ context.Context) (bool, error) {
-					return tt.processActive, tt.isActiveErr
-				},
-			}
-			updater.TeardownNamespace = func(_ context.Context) error {
-				teardownCalls++
-				return nil
-			}
+				}
+				updater.HasCustomTbot = func(ctx context.Context) (bool, error) {
+					return !tbot, nil
+				}
 
-			ctx := context.Background()
-			err = updater.Remove(ctx, tt.force)
-			if tt.errMatch != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tt.errMatch)
-			} else {
-				require.NoError(t, err)
+				ctx := context.Background()
+				err = updater.Remove(ctx, tt.force)
+				if tt.errMatch != "" {
+					require.Error(t, err)
+					assert.Contains(t, err.Error(), tt.errMatch)
+				} else {
+					require.NoError(t, err)
+				}
+				require.Equal(t, tt.syncCalls, teleportSyncCalls)
+				require.Equal(t, tt.reloadCalls, teleportReloadCalls)
+				require.Equal(t, 0, tbotSyncCalls)
+				if tbot && tt.reloadErr == nil {
+					require.Equal(t, tt.reloadCalls, tbotReloadCalls)
+				} else {
+					require.Equal(t, 0, tbotReloadCalls)
+				}
+
+				require.Equal(t, tt.linkSystemCalls, linkSystemCalls)
+				require.Equal(t, tt.revertFuncCalls, revertFuncCalls)
+				require.Equal(t, tt.unlinkedVersion, unlinkedVersion)
+				require.Equal(t, tt.teardownCalls, teardownCalls)
 			}
-			require.Equal(t, tt.syncCalls, syncCalls)
-			require.Equal(t, tt.reloadCalls, reloadCalls)
-			require.Equal(t, tt.linkSystemCalls, linkSystemCalls)
-			require.Equal(t, tt.revertFuncCalls, revertFuncCalls)
-			require.Equal(t, tt.unlinkedVersion, unlinkedVersion)
-			require.Equal(t, tt.teardownCalls, teardownCalls)
 		})
 	}
 }
@@ -1420,6 +1496,7 @@ func TestUpdater_Install(t *testing.T) {
 		notPresent bool
 		notEnabled bool
 		notActive  bool
+		restrictOS []string
 
 		removedRevision   Revision
 		installedRevision Revision
@@ -1429,14 +1506,16 @@ func TestUpdater_Install(t *testing.T) {
 		reloadCalls       int
 		revertCalls       int
 		setupCalls        int
+		selinuxInstalls   int
+		selinuxRemovals   int
 		restarted         bool
 		errMatch          string
 	}{
 		{
 			name: "config from file",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Enabled: true,
 					Group:   "group",
@@ -1458,8 +1537,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "config from user",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					Group:   "old-group",
 					BaseURL: "https://example.com/old",
@@ -1488,8 +1567,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "defaults",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("old-version", 0),
 				},
@@ -1505,8 +1584,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "override skip",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("old-version", 0),
 					Skip:   toPtr(NewRevision("16.3.0", 0)),
@@ -1523,8 +1602,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "insecure URL",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Spec: UpdateSpec{
 					BaseURL: "http://example.com",
 				},
@@ -1535,8 +1614,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "install error",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 			},
 			installErr: errors.New("install error"),
 
@@ -1548,8 +1627,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "agpl requires base URL",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 			},
 			agpl:         true,
 			requestGroup: "default",
@@ -1558,8 +1637,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "version already installed",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("16.3.0", 0),
 				},
@@ -1575,8 +1654,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "backup version removed on install",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("old-version", 0),
 					Backup: toPtr(NewRevision("backup-version", 0)),
@@ -1594,8 +1673,8 @@ func TestUpdater_Install(t *testing.T) {
 		{
 			name: "backup version kept for validation",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("16.3.0", 0),
 					Backup: toPtr(NewRevision("backup-version", 0)),
@@ -1644,14 +1723,15 @@ func TestUpdater_Install(t *testing.T) {
 			revertCalls:       1,
 			setupCalls:        1,
 			reloadCalls:       1,
+			selinuxRemovals:   1,
 			restarted:         true,
 			errMatch:          "setup error",
 		},
 		{
 			name: "setup fails already installed",
 			cfg: &UpdateConfig{
-				Version: updateConfigVersion,
-				Kind:    updateConfigKind,
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
 				Status: UpdateStatus{
 					Active: NewRevision("16.3.0", 0),
 				},
@@ -1664,12 +1744,11 @@ func TestUpdater_Install(t *testing.T) {
 			requestGroup:      "default",
 			revertCalls:       1,
 			setupCalls:        1,
+			selinuxRemovals:   1,
 			errMatch:          "setup error",
 		},
 		{
-			name:      "no need to reload",
-			reloadErr: ErrNotNeeded,
-
+			name:              "no need to reload",
 			installedRevision: NewRevision("16.3.0", 0),
 			installedBaseURL:  autoupdate.DefaultBaseURL,
 			linkedRevision:    NewRevision("16.3.0", 0),
@@ -1689,154 +1768,246 @@ func TestUpdater_Install(t *testing.T) {
 			setupCalls:        1,
 			restarted:         true,
 		},
+		{
+			name: "install selinux from file",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					SELinuxSSH: true,
+				},
+				Status: UpdateStatus{
+					Active: NewRevision("old-version", 0),
+				},
+			},
+
+			installedRevision: NewRevision("16.3.0", 0),
+			installedBaseURL:  autoupdate.DefaultBaseURL,
+			linkedRevision:    NewRevision("16.3.0", 0),
+			requestGroup:      "default",
+			setupCalls:        1,
+			selinuxInstalls:   1,
+			restarted:         true,
+			restrictOS:        []string{"linux"},
+		},
+		{
+			name: "install selinux from user",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					SELinuxSSH: false,
+				},
+				Status: UpdateStatus{
+					Active: NewRevision("old-version", 0),
+				},
+			},
+			userCfg: OverrideConfig{
+				UpdateSpec: UpdateSpec{
+					SELinuxSSH: true,
+				},
+				SELinuxSSHChanged: true,
+			},
+
+			installedRevision: NewRevision("16.3.0", 0),
+			installedBaseURL:  autoupdate.DefaultBaseURL,
+			linkedRevision:    NewRevision("16.3.0", 0),
+			requestGroup:      "default",
+			setupCalls:        1,
+			selinuxInstalls:   1,
+			restarted:         true,
+			restrictOS:        []string{"linux"},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			dir := t.TempDir()
-			ns := &Namespace{
-				installDir:       dir,
-				defaultPathDir:   defaultPathDir,
-				defaultProxyAddr: "default-proxy",
-				updaterIDFile:    "updater-id-file",
-			}
-			_, err := ns.Init()
-			require.NoError(t, err)
-			cfgPath := filepath.Join(ns.Dir(), updateConfigName)
-
-			updater, err := NewLocalUpdater(LocalUpdaterConfig{
-				InsecureSkipVerify: true,
-			}, ns)
-			require.NoError(t, err)
-
-			// Create config file only if provided in test case
-			if tt.cfg != nil {
-				b, err := yaml.Marshal(tt.cfg)
+			for _, tbot := range []bool{false, true} {
+				if len(tt.restrictOS) > 0 && !slices.Contains(tt.restrictOS, runtime.GOOS) {
+					t.Skip("skipping test because OS is not supported")
+				}
+				dir := t.TempDir()
+				ns := &Namespace{
+					installDir:       dir,
+					defaultPathDir:   defaultPathDir,
+					defaultProxyAddr: "default-proxy",
+					updaterIDFile:    "updater-id-file",
+				}
+				_, err := ns.Init()
 				require.NoError(t, err)
-				err = os.WriteFile(cfgPath, b, 0600)
+				cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
+
+				updater, err := NewLocalUpdater(LocalUpdaterConfig{
+					InsecureSkipVerify: true,
+				}, ns)
 				require.NoError(t, err)
-			}
 
-			var requestedGroup string
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				requestedGroup = r.URL.Query().Get("group")
-				config := webclient.PingResponse{
-					AutoUpdate: webclient.AutoUpdateSettings{
-						AgentVersion: "16.3.0",
+				// Create config file only if provided in test case
+				if tt.cfg != nil {
+					b, err := yaml.Marshal(tt.cfg)
+					require.NoError(t, err)
+					err = os.WriteFile(cfgPath, b, 0600)
+					require.NoError(t, err)
+				}
+
+				var requestedGroup string
+				server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					requestedGroup = r.URL.Query().Get("group")
+					config := webclient.PingResponse{
+						AutoUpdate: webclient.AutoUpdateSettings{
+							AgentVersion: "16.3.0",
+						},
+					}
+					config.Edition = "community"
+					if tt.flags&autoupdate.FlagEnterprise != 0 {
+						config.Edition = "ent"
+					}
+					if tt.agpl {
+						config.Edition = "oss"
+					}
+					config.FIPS = tt.flags&autoupdate.FlagFIPS != 0
+					err := json.NewEncoder(w).Encode(config)
+					require.NoError(t, err)
+				}))
+				t.Cleanup(server.Close)
+
+				userCfg := tt.userCfg
+				if userCfg.Proxy == "" {
+					userCfg.Proxy = strings.TrimPrefix(server.URL, "https://")
+				}
+				updater.DefaultProxyAddr = userCfg.Proxy
+
+				var (
+					installedRevision   Revision
+					installedBaseURL    string
+					linkedRevision      Revision
+					removedRevision     Revision
+					revertFuncCalls     int
+					teleportReloadCalls int
+					tbotReloadCalls     int
+					setupCalls          int
+					revertSetupCalls    int
+					selinuxInstalls     int
+					selinuxRemovals     int
+				)
+				updater.Installer = &testInstaller{
+					FuncInstall: func(_ context.Context, rev Revision, baseURL string, force bool) error {
+						installedRevision = rev
+						installedBaseURL = baseURL
+						return tt.installErr
+					},
+					FuncLink: func(_ context.Context, rev Revision, path string, force bool) (revert func(context.Context) bool, err error) {
+						linkedRevision = rev
+						return func(_ context.Context) bool {
+							revertFuncCalls++
+							return true
+						}, nil
+					},
+					FuncList: func(_ context.Context) (revs []Revision, err error) {
+						return []Revision{}, nil
+					},
+					FuncRemove: func(_ context.Context, rev Revision) error {
+						removedRevision = rev
+						return nil
+					},
+					FuncIsLinked: func(ctx context.Context, rev Revision, path string) (bool, error) {
+						return false, nil
+					},
+				}
+				updater.TeleportProcess = &testProcess{
+					FuncName: func() string {
+						return "teleport"
+					},
+					FuncReload: func(_ context.Context) error {
+						teleportReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsPresent: func(ctx context.Context) (bool, error) {
+						return !tt.notPresent, nil
+					},
+					FuncIsEnabled: func(ctx context.Context) (bool, error) {
+						return !tt.notEnabled, nil
+					},
+					FuncIsActive: func(ctx context.Context) (bool, error) {
+						return !tt.notActive, nil
 					},
 				}
-				config.Edition = "community"
-				if tt.flags&autoupdate.FlagEnterprise != 0 {
-					config.Edition = "ent"
+				updater.TbotProcess = &testProcess{
+					FuncName: func() string {
+						return "tbot"
+					},
+					FuncReload: func(_ context.Context) error {
+						tbotReloadCalls++
+						return tt.reloadErr
+					},
+					FuncIsPresent: func(ctx context.Context) (bool, error) {
+						return !tt.notPresent, nil
+					},
+					FuncIsEnabled: func(ctx context.Context) (bool, error) {
+						return !tt.notEnabled, nil
+					},
+					FuncIsActive: func(ctx context.Context) (bool, error) {
+						return !tt.notActive, nil
+					},
 				}
-				if tt.agpl {
-					config.Edition = "oss"
+				var restarted bool
+				updater.ReexecSetup = func(_ context.Context, path string, rev Revision, f SetupFeatures, reload bool) error {
+					setupCalls++
+					if f.SELinuxSSH {
+						selinuxInstalls++
+					}
+					restarted = reload
+					return tt.setupErr
 				}
-				config.FIPS = tt.flags&autoupdate.FlagFIPS != 0
-				err := json.NewEncoder(w).Encode(config)
-				require.NoError(t, err)
-			}))
-			t.Cleanup(server.Close)
-
-			if tt.userCfg.Proxy == "" {
-				tt.userCfg.Proxy = strings.TrimPrefix(server.URL, "https://")
-			}
-			updater.DefaultProxyAddr = tt.userCfg.Proxy
-
-			var (
-				installedRevision Revision
-				installedBaseURL  string
-				linkedRevision    Revision
-				removedRevision   Revision
-				revertFuncCalls   int
-				reloadCalls       int
-				setupCalls        int
-				revertSetupCalls  int
-			)
-			updater.Installer = &testInstaller{
-				FuncInstall: func(_ context.Context, rev Revision, baseURL string, force bool) error {
-					installedRevision = rev
-					installedBaseURL = baseURL
-					return tt.installErr
-				},
-				FuncLink: func(_ context.Context, rev Revision, path string, force bool) (revert func(context.Context) bool, err error) {
-					linkedRevision = rev
-					return func(_ context.Context) bool {
-						revertFuncCalls++
-						return true
-					}, nil
-				},
-				FuncList: func(_ context.Context) (revs []Revision, err error) {
-					return []Revision{}, nil
-				},
-				FuncRemove: func(_ context.Context, rev Revision) error {
-					removedRevision = rev
+				updater.SetupNamespace = func(_ context.Context, path string, rev Revision, f SetupFeatures) error {
+					revertSetupCalls++
+					if f.SELinuxSSH {
+						selinuxInstalls++
+					} else {
+						selinuxRemovals++
+					}
 					return nil
-				},
-				FuncIsLinked: func(ctx context.Context, rev Revision, path string) (bool, error) {
-					return false, nil
-				},
-			}
-			updater.Process = &testProcess{
-				FuncReload: func(_ context.Context) error {
-					reloadCalls++
-					return tt.reloadErr
-				},
-				FuncIsPresent: func(ctx context.Context) (bool, error) {
-					return !tt.notPresent, nil
-				},
-				FuncIsEnabled: func(ctx context.Context) (bool, error) {
-					return !tt.notEnabled, nil
-				},
-				FuncIsActive: func(ctx context.Context) (bool, error) {
-					return !tt.notActive, nil
-				},
-			}
-			var restarted bool
-			updater.ReexecSetup = func(_ context.Context, path string, reload bool) error {
-				setupCalls++
-				restarted = reload
-				return tt.setupErr
-			}
-			updater.SetupNamespace = func(_ context.Context, path string) error {
-				revertSetupCalls++
-				return nil
-			}
+				}
+				updater.HasCustomTbot = func(ctx context.Context) (bool, error) {
+					return !tbot, nil
+				}
 
-			ctx := context.Background()
-			err = updater.Install(ctx, tt.userCfg)
-			if tt.errMatch != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tt.errMatch)
-			} else {
+				ctx := context.Background()
+				err = updater.Install(ctx, userCfg)
+				if tt.errMatch != "" {
+					require.Error(t, err)
+					assert.Contains(t, err.Error(), tt.errMatch)
+				} else {
+					require.NoError(t, err)
+				}
+				require.Equal(t, tt.installedRevision, installedRevision)
+				require.Equal(t, tt.installedBaseURL, installedBaseURL)
+				require.Equal(t, tt.linkedRevision, linkedRevision)
+				require.Equal(t, tt.removedRevision, removedRevision)
+				require.Equal(t, tt.flags, installedRevision.Flags)
+				require.Equal(t, tt.requestGroup, requestedGroup)
+				require.Equal(t, tt.reloadCalls, teleportReloadCalls)
+				if tbot && tt.reloadErr == nil {
+					require.Equal(t, tt.reloadCalls, tbotReloadCalls)
+				} else {
+					require.Equal(t, 0, tbotReloadCalls)
+				}
+				require.Equal(t, tt.revertCalls, revertSetupCalls)
+				require.Equal(t, tt.revertCalls, revertFuncCalls)
+				require.Equal(t, tt.setupCalls, setupCalls)
+				require.Equal(t, tt.selinuxInstalls, selinuxInstalls)
+				require.Equal(t, tt.selinuxRemovals, selinuxRemovals)
+				require.Equal(t, tt.restarted, restarted)
+
+				data, err := os.ReadFile(cfgPath)
 				require.NoError(t, err)
-			}
-			require.Equal(t, tt.installedRevision, installedRevision)
-			require.Equal(t, tt.installedBaseURL, installedBaseURL)
-			require.Equal(t, tt.linkedRevision, linkedRevision)
-			require.Equal(t, tt.removedRevision, removedRevision)
-			require.Equal(t, tt.flags, installedRevision.Flags)
-			require.Equal(t, tt.requestGroup, requestedGroup)
-			require.Equal(t, tt.reloadCalls, reloadCalls)
-			require.Equal(t, tt.revertCalls, revertSetupCalls)
-			require.Equal(t, tt.revertCalls, revertFuncCalls)
-			require.Equal(t, tt.setupCalls, setupCalls)
-			require.Equal(t, tt.restarted, restarted)
-
-			if tt.cfg == nil && err != nil {
-				_, err := os.Stat(cfgPath)
-				require.Error(t, err)
-				return
-			}
+				data = blankTestAddr(data)
 
-			data, err := os.ReadFile(cfgPath)
-			require.NoError(t, err)
-			data = blankTestAddr(data)
-
-			if golden.ShouldSet() {
-				golden.Set(t, data)
+				if golden.ShouldSet() {
+					golden.Set(t, data)
+				}
+				require.Equal(t, string(golden.Get(t)), string(data))
 			}
-			require.Equal(t, string(golden.Get(t)), string(data))
 		})
 	}
 }
@@ -1898,12 +2069,15 @@ func TestUpdater_Setup(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name       string
-		restart    bool
-		present    bool
-		setupErr   error
-		presentErr error
-		reloadErr  error
+		name           string
+		cfg            *UpdateConfig // nil -> file not present
+		restart        bool
+		present        bool
+		installSELinux bool
+		removeSELinux  bool
+		setupErr       error
+		presentErr     error
+		reloadErr      error
 
 		errMatch string
 	}{
@@ -1918,16 +2092,9 @@ func TestUpdater_Setup(t *testing.T) {
 			present: true,
 		},
 		{
-			name:      "reload not needed",
-			restart:   true,
-			present:   true,
-			reloadErr: ErrNotNeeded,
-		},
-		{
-			name:     "not present",
-			restart:  true,
-			present:  false,
-			errMatch: "cannot find systemd",
+			name:    "not present",
+			restart: true,
+			present: false,
 		},
 		{
 			name:     "setup error",
@@ -1972,15 +2139,84 @@ func TestUpdater_Setup(t *testing.T) {
 			reloadErr: errors.New("some error"),
 			errMatch:  "some error",
 		},
+		{
+			name:           "install selinux",
+			installSELinux: true,
+			restart:        false,
+			present:        true,
+		},
+		{
+			name: "install selinux false in file",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					SELinuxSSH: false,
+				},
+			},
+			installSELinux: true,
+			restart:        false,
+			present:        true,
+		},
+		{
+			name: "remove selinux",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					SELinuxSSH: true,
+				},
+			},
+			installSELinux: false,
+			removeSELinux:  true,
+			restart:        false,
+			present:        true,
+		},
+		{
+			name: "selinux no-op",
+			cfg: &UpdateConfig{
+				Version: UpdateConfigV1,
+				Kind:    UpdateConfigKind,
+				Spec: UpdateSpec{
+					SELinuxSSH: false,
+				},
+			},
+			installSELinux: false,
+			removeSELinux:  false,
+			restart:        false,
+			present:        true,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ns := &Namespace{}
+			dir := t.TempDir()
+			ns := &Namespace{
+				installDir: dir,
+			}
+			_, err := ns.Init()
+			require.NoError(t, err)
+			cfgPath := filepath.Join(ns.Dir(), UpdateConfigName)
+
 			updater, err := NewLocalUpdater(LocalUpdaterConfig{}, ns)
 			require.NoError(t, err)
 
-			updater.Process = &testProcess{
+			updater.TeleportProcess = &testProcess{
+				FuncName: func() string {
+					return "teleport"
+				},
+				FuncReload: func(_ context.Context) error {
+					return tt.reloadErr
+				},
+				FuncIsPresent: func(_ context.Context) (bool, error) {
+					return tt.present, tt.presentErr
+				},
+			}
+
+			updater.TbotProcess = &testProcess{
+				FuncName: func() string {
+					return "tbot"
+				},
 				FuncReload: func(_ context.Context) error {
 					return tt.reloadErr
 				},
@@ -1988,13 +2224,35 @@ func TestUpdater_Setup(t *testing.T) {
 					return tt.present, tt.presentErr
 				},
 			}
-			updater.SetupNamespace = func(_ context.Context, path string) error {
+			updater.SetupNamespace = func(_ context.Context, path string, rev Revision, f SetupFeatures) error {
 				require.Equal(t, "test", path)
+				require.Equal(t, tt.installSELinux, f.SELinuxSSH)
 				return tt.setupErr
 			}
+			updater.WriteTeleportService = func(_ context.Context, path string, rev Revision) error {
+				require.Equal(t, "test", path)
+				require.Equal(t, "version", rev.Version)
+				return nil
+			}
+			updater.WriteTbotService = func(_ context.Context, path string, rev Revision) error {
+				require.Equal(t, "test", path)
+				require.Equal(t, "version", rev.Version)
+				return nil
+			}
+			updater.HasCustomTbot = func(ctx context.Context) (bool, error) {
+				return false, nil
+			}
+
+			// Create config file only if provided in test case
+			if tt.cfg != nil {
+				b, err := yaml.Marshal(tt.cfg)
+				require.NoError(t, err)
+				err = os.WriteFile(cfgPath, b, 0600)
+				require.NoError(t, err)
+			}
 
 			ctx := context.Background()
-			err = updater.Setup(ctx, "test", tt.restart)
+			err = updater.Setup(ctx, "test", Revision{Version: "version"}, SetupFeatures{SELinuxSSH: tt.installSELinux, Tbot: true}, tt.restart)
 			if tt.errMatch != "" {
 				require.Error(t, err)
 				assert.Contains(t, err.Error(), tt.errMatch)
@@ -2162,6 +2420,7 @@ func (ti *testInstaller) IsLinked(ctx context.Context, rev Revision, path string
 }
 
 type testProcess struct {
+	FuncName      func() string
 	FuncReload    func(ctx context.Context) error
 	FuncSync      func(ctx context.Context) error
 	FuncIsEnabled func(ctx context.Context) (bool, error)
@@ -2169,6 +2428,10 @@ type testProcess struct {
 	FuncIsPresent func(ctx context.Context) (bool, error)
 }
 
+func (tp *testProcess) Name() string {
+	return tp.FuncName()
+}
+
 func (tp *testProcess) Reload(ctx context.Context) error {
 	return tp.FuncReload(ctx)
 }
diff --git a/lib/autoupdate/agent/validate.go b/lib/autoupdate/agent/validate.go
index 8ce1732d3d5d1..e2dec446d8e50 100644
--- a/lib/autoupdate/agent/validate.go
+++ b/lib/autoupdate/agent/validate.go
@@ -117,7 +117,7 @@ func isTextScript(data []byte) bool {
 	return true
 }
 
-// readFileLimit the first n bytes of a file.
+// readFileLimit the first n bytes of a file, or less if shorter.
 func readFileLimit(name string, n int64) ([]byte, error) {
 	f, err := os.Open(name)
 	if err != nil {
diff --git a/lib/autoupdate/lookup/resolver.go b/lib/autoupdate/lookup/resolver.go
new file mode 100644
index 0000000000000..1d488c667282c
--- /dev/null
+++ b/lib/autoupdate/lookup/resolver.go
@@ -0,0 +1,147 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/automaticupgrades"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	// cmcCacheTTL is the cache TTL for the clusterMaintenanceConfig resource.
+	// This cache is here to protect against accidental or intentional DDoS, the TTL must be low to quickly reflect
+	// cluster configuration changes.
+	cmcCacheTTL = time.Minute
+)
+
+type AutoUpdateAgentRolloutGetter interface {
+	GetAutoUpdateAgentRollout(ctx context.Context) (*autoupdate.AutoUpdateAgentRollout, error)
+}
+
+type ClusterMaintenanceConfigGetter interface {
+	GetClusterMaintenanceConfig(ctx context.Context) (types.ClusterMaintenanceConfig, error)
+}
+
+// Config is the Resolver configuration. All fields must be set.
+type Config struct {
+	RolloutGetter AutoUpdateAgentRolloutGetter
+	CMCGetter     ClusterMaintenanceConfigGetter
+	Channels      automaticupgrades.Channels
+	Log           *slog.Logger
+	Clock         clockwork.Clock
+	Context       context.Context
+}
+
+// Resolver resolves which version should be ran, and if update should happen now.
+type Resolver struct {
+	cfg Config
+	// cmcCache is used to cache the cluster maintenance config from the AUth Service.
+	cmcCache *utils.FnCache
+}
+
+// NewResolver validates the Config and creates a Resolver.
+func NewResolver(cfg Config) (*Resolver, error) {
+	if cfg.RolloutGetter == nil {
+		return nil, trace.BadParameter("missing autoupdate autoupdate rollout getter")
+	}
+	if cfg.CMCGetter == nil {
+		return nil, trace.BadParameter("missing cluster maintenance config getter")
+	}
+	if cfg.Channels == nil {
+		return nil, trace.BadParameter("missing autoupdate Channels")
+	}
+	if err := cfg.Channels.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if cfg.Log == nil {
+		return nil, trace.BadParameter("missing logger")
+	}
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	// We create the cache after applying the options to make sure we use the fake clock if it was passed.
+	cmcCache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:         cmcCacheTTL,
+		Clock:       cfg.Clock,
+		Context:     cfg.Context,
+		ReloadOnErr: false,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "creating cluster maintenance config cache")
+	}
+
+	return &Resolver{
+		cfg:      cfg,
+		cmcCache: cmcCache,
+	}, nil
+}
+
+// GetVersion returns the version the agent should install/update to based on
+// its group and updater UUID.
+// If the cluster contains an autoupdate_agent_rollout resource from RFD184 it should take precedence.
+// If the resource is not there, we fall back to RFD109-style updates with channels
+// and maintenance window derived from the cluster_maintenance_config resource.
+func (h *Resolver) GetVersion(ctx context.Context, group, updaterUUID string) (*semver.Version, error) {
+	rollout, err := h.cfg.RolloutGetter.GetAutoUpdateAgentRollout(ctx)
+	if err != nil {
+		// Fallback to channels if there is no autoupdate_agent_rollout.
+		if trace.IsNotFound(err) || trace.IsNotImplemented(err) {
+			return getVersionFromChannel(ctx, h.cfg.Channels, group)
+		}
+		// Something is broken, we don't want to fallback to channels, this would be harmful.
+		return nil, trace.Wrap(err, "getting autoupdate_agent_rollout")
+	}
+
+	return getVersionFromRollout(rollout, group, updaterUUID)
+}
+
+// ShouldUpdate returns if the agent should update now to based on its group
+// and updater UUID.
+// If the cluster contains an autoupdate_agent_rollout resource from RFD184 it should take precedence.
+// If the resource is not there, we fall back to RFD109-style updates with channels
+// and maintenance window derived from the cluster_maintenance_config resource.
+func (h *Resolver) ShouldUpdate(ctx context.Context, group, updaterUUID string, windowLookup bool) (bool, error) {
+	rollout, err := h.cfg.RolloutGetter.GetAutoUpdateAgentRollout(ctx)
+	if err != nil {
+		// Fallback to channels if there is no autoupdate_agent_rollout.
+		if trace.IsNotFound(err) || trace.IsNotImplemented(err) {
+			// Updaters using the RFD184 API are not aware of maintenance windows
+			// like RFD109 updaters are. To have both updaters adopt the same behavior
+			// we must do the CMC window lookup for them.
+			if windowLookup {
+				return h.getTriggerFromWindowThenChannel(ctx, group)
+			}
+			return getTriggerFromChannel(ctx, h.cfg.Channels, group)
+		}
+		// Something is broken, we don't want to fallback to channels, this would be harmful.
+		return false, trace.Wrap(err, "failed to get auto-update rollout")
+	}
+
+	return getTriggerFromRollout(rollout, group, updaterUUID)
+}
diff --git a/lib/autoupdate/lookup/resolver_test.go b/lib/autoupdate/lookup/resolver_test.go
new file mode 100644
index 0000000000000..dd93391341696
--- /dev/null
+++ b/lib/autoupdate/lookup/resolver_test.go
@@ -0,0 +1,356 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/automaticupgrades"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+const (
+	testVersionHigh = "2.3.4"
+	testVersionLow  = "2.0.4"
+)
+
+// fakeRolloutAccessPoint allows us to mock the ProxyAccessPoint in autoupdate
+// tests.
+type fakeRolloutAccessPoint struct {
+	authclient.ProxyAccessPoint
+
+	rollout *autoupdatepb.AutoUpdateAgentRollout
+	err     error
+}
+
+func (ap *fakeRolloutAccessPoint) GetAutoUpdateAgentRollout(_ context.Context) (*autoupdatepb.AutoUpdateAgentRollout, error) {
+	return ap.rollout, ap.err
+}
+
+// fakeRolloutAccessPoint allows us to mock the proxy's auth client in autoupdate
+// tests.
+type fakeCMCAuthClient struct {
+	authclient.ClientI
+
+	cmc types.ClusterMaintenanceConfig
+	err error
+}
+
+func (c *fakeCMCAuthClient) GetClusterMaintenanceConfig(_ context.Context) (types.ClusterMaintenanceConfig, error) {
+	return c.cmc, c.err
+}
+
+func TestAutoUpdateAgentVersion(t *testing.T) {
+	t.Parallel()
+	groupName := "test-group"
+	ctx := context.Background()
+
+	// brokenChannelUpstream is a buggy upstream version server.
+	// This allows us to craft version channels returning errors.
+	brokenChannelUpstream := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusBadRequest)
+		}))
+	t.Cleanup(brokenChannelUpstream.Close)
+
+	tests := []struct {
+		name            string
+		rollout         *autoupdatepb.AutoUpdateAgentRollout
+		rolloutErr      error
+		channel         *automaticupgrades.Channel
+		expectedVersion *semver.Version
+		expectError     require.ErrorAssertionFunc
+	}{
+		{
+			name: "version is looked up from rollout if it is here",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					TargetVersion:  testVersionHigh,
+					Schedule:       autoupdate.AgentsScheduleImmediate,
+				},
+			},
+			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
+			expectError:     require.NoError,
+			expectedVersion: semver.Must(version.EnsureSemver(testVersionHigh)),
+		},
+		{
+			name:            "version is looked up from channel if rollout is not here",
+			rolloutErr:      trace.NotFound("rollout is not here"),
+			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
+			expectError:     require.NoError,
+			expectedVersion: semver.Must(version.EnsureSemver(testVersionLow)),
+		},
+		{
+			name:       "hard error getting rollout should not fallback to version channels",
+			rolloutErr: trace.AccessDenied("something is very broken"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+			},
+			expectError: require.Error,
+		},
+		{
+			name:        "no rollout, error checking channel",
+			rolloutErr:  trace.NotFound("rollout is not here"),
+			channel:     &automaticupgrades.Channel{ForwardURL: brokenChannelUpstream.URL},
+			expectError: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test setup: building the channel, mock client, and handler with test config.
+			require.NoError(t, tt.channel.CheckAndSetDefaults())
+			h, err := NewResolver(
+				Config{
+					RolloutGetter: &fakeRolloutAccessPoint{
+						rollout: tt.rollout,
+						err:     tt.rolloutErr,
+					},
+					CMCGetter: &fakeCMCAuthClient{
+						cmc: nil,
+						err: trace.NotImplemented("cmc should not be called in this test"),
+					},
+					Channels: map[string]*automaticupgrades.Channel{
+						groupName: tt.channel,
+					},
+					Log: logtest.NewLogger(),
+				})
+			require.NoError(t, err)
+
+			// Test execution
+			result, err := h.GetVersion(ctx, groupName, "")
+			tt.expectError(t, err)
+			require.Equal(t, tt.expectedVersion, result)
+		})
+	}
+}
+
+// TestAutoUpdateAgentShouldUpdate also accidentally tests getTriggerFromWindowThenChannel.
+func TestAutoUpdateAgentShouldUpdate(t *testing.T) {
+	t.Parallel()
+
+	groupName := "test-group"
+	ctx := context.Background()
+
+	// brokenChannelUpstream is a buggy upstream version server.
+	// This allows us to craft version channels returning errors.
+	brokenChannelUpstream := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusBadRequest)
+		}))
+	t.Cleanup(brokenChannelUpstream.Close)
+
+	cacheClock := clockwork.NewFakeClock()
+	cmcCache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:         cmcCacheTTL,
+		Clock:       cacheClock,
+		Context:     ctx,
+		ReloadOnErr: false,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		cmcCache.Shutdown(ctx)
+	})
+
+	// We don't use the cache clock because we are advancing it to invalidate the cmc cache and
+	// this would interfere with the test logic
+	clock := clockwork.NewFakeClock()
+	activeUpgradeWindow := types.AgentUpgradeWindow{UTCStartHour: uint32(clock.Now().Hour())}
+	inactiveUpgradeWindow := types.AgentUpgradeWindow{UTCStartHour: uint32(clock.Now().Add(2 * time.Hour).Hour())}
+	tests := []struct {
+		name            string
+		rollout         *autoupdatepb.AutoUpdateAgentRollout
+		rolloutErr      error
+		channel         *automaticupgrades.Channel
+		upgradeWindow   types.AgentUpgradeWindow
+		cmcErr          error
+		windowLookup    bool
+		expectedTrigger bool
+		expectError     require.ErrorAssertionFunc
+	}{
+		{
+			name: "trigger is looked up from rollout if it is here, trigger firing",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					TargetVersion:  testVersionHigh,
+					Schedule:       autoupdate.AgentsScheduleImmediate,
+				},
+			},
+			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
+			expectError:     require.NoError,
+			expectedTrigger: true,
+		},
+		{
+			name: "trigger is looked up from rollout if it is here, trigger not firing",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
+					TargetVersion:  testVersionHigh,
+					Schedule:       autoupdate.AgentsScheduleImmediate,
+				},
+			},
+			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
+			expectError:     require.NoError,
+			expectedTrigger: false,
+		},
+		{
+			name:       "trigger is looked up from channel if rollout is not here and window lookup is disabled, trigger not firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      false,
+			},
+			expectError:     require.NoError,
+			expectedTrigger: false,
+		},
+		{
+			name:       "trigger is looked up from channel if rollout is not here and window lookup is disabled, trigger firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      true,
+			},
+			expectError:     require.NoError,
+			expectedTrigger: true,
+		},
+		{
+			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      false,
+			},
+			upgradeWindow:   activeUpgradeWindow,
+			windowLookup:    true,
+			expectError:     require.NoError,
+			expectedTrigger: true,
+		},
+		{
+			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc not firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      false,
+			},
+			upgradeWindow:   inactiveUpgradeWindow,
+			windowLookup:    true,
+			expectError:     require.NoError,
+			expectedTrigger: false,
+		},
+		{
+			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc not firing but channel firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      true,
+			},
+			upgradeWindow:   inactiveUpgradeWindow,
+			windowLookup:    true,
+			expectError:     require.NoError,
+			expectedTrigger: true,
+		},
+		{
+			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, no cmc and channel not firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      false,
+			},
+			cmcErr:          trace.NotFound("no cmc for this cluster"),
+			windowLookup:    true,
+			expectError:     require.NoError,
+			expectedTrigger: false,
+		},
+		{
+			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, no cmc and channel firing",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+				Critical:      true,
+			},
+			cmcErr:          trace.NotFound("no cmc for this cluster"),
+			windowLookup:    true,
+			expectError:     require.NoError,
+			expectedTrigger: true,
+		},
+		{
+			name:       "hard error getting rollout should not fallback to RFD109 trigger",
+			rolloutErr: trace.AccessDenied("something is very broken"),
+			channel: &automaticupgrades.Channel{
+				StaticVersion: testVersionLow,
+			},
+			expectError: require.Error,
+		},
+		{
+			name:       "no rollout, error checking channel",
+			rolloutErr: trace.NotFound("rollout is not here"),
+			channel: &automaticupgrades.Channel{
+				ForwardURL: brokenChannelUpstream.URL,
+			},
+			expectError: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test setup: building the channel, mock clients, and handler with test config.
+			cmc := types.NewClusterMaintenanceConfig()
+			cmc.SetAgentUpgradeWindow(tt.upgradeWindow)
+			require.NoError(t, tt.channel.CheckAndSetDefaults())
+			// Advance cache clock to expire cached cmc
+			cacheClock.Advance(2 * cmcCacheTTL)
+			h, err := NewResolver(Config{
+				RolloutGetter: &fakeRolloutAccessPoint{
+					rollout: tt.rollout,
+					err:     tt.rolloutErr,
+				},
+				CMCGetter: &fakeCMCAuthClient{
+					cmc: cmc,
+					err: tt.cmcErr,
+				},
+				Channels: map[string]*automaticupgrades.Channel{
+					groupName: tt.channel,
+				},
+				Clock: clock,
+				Log:   logtest.NewLogger(),
+			})
+			require.NoError(t, err)
+
+			// Test execution
+			result, err := h.ShouldUpdate(ctx, groupName, "", tt.windowLookup)
+			tt.expectError(t, err)
+			require.Equal(t, tt.expectedTrigger, result)
+		})
+	}
+}
diff --git a/lib/autoupdate/lookup/rfd_109.go b/lib/autoupdate/lookup/rfd_109.go
new file mode 100644
index 0000000000000..f0d52112d42e7
--- /dev/null
+++ b/lib/autoupdate/lookup/rfd_109.go
@@ -0,0 +1,73 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"context"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/automaticupgrades"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// getVersionFromChannel gets the target version from the RFD109 channels.
+func getVersionFromChannel(ctx context.Context, channels automaticupgrades.Channels, groupName string) (version *semver.Version, err error) {
+	if channel, ok := channels[groupName]; ok {
+		return channel.GetVersion(ctx)
+	}
+	return channels.DefaultVersion(ctx)
+}
+
+// getTriggerFromWindowThenChannel gets the target version from the RFD109 maintenance window and channels.
+func (h *Resolver) getTriggerFromWindowThenChannel(ctx context.Context, groupName string) (bool, error) {
+	// Caching the CMC for 60 seconds because this resource is cached neither by the auth nor the proxy.
+	// And this function can be accessed via unauthenticated endpoints.
+	cmc, err := utils.FnCacheGet(ctx, h.cmcCache, "cmc", func(ctx context.Context) (types.ClusterMaintenanceConfig, error) {
+		return h.cfg.CMCGetter.GetClusterMaintenanceConfig(ctx)
+	})
+
+	// If there's no CMC or we failed to get it, we fallback directly to the channel
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			h.cfg.Log.WarnContext(ctx, "Failed to get cluster maintenance config", "error", err)
+		}
+		return getTriggerFromChannel(ctx, h.cfg.Channels, groupName)
+	}
+
+	// If we have a CMC, we check if the window is active, else we just check if the update is critical.
+	if cmc.WithinUpgradeWindow(h.cfg.Clock.Now()) {
+		return true, nil
+	}
+	return getTriggerFromChannel(ctx, h.cfg.Channels, groupName)
+}
+
+// getTriggerFromWindowThenChannel gets the target version from the RFD109 channels.
+func getTriggerFromChannel(ctx context.Context, channels automaticupgrades.Channels, groupName string) (bool, error) {
+	if channel, ok := channels[groupName]; ok {
+		return channel.GetCritical(ctx)
+	}
+	defaultChannel, err := channels.DefaultChannel()
+	if err != nil {
+		return false, trace.Wrap(err, "creating new default channel")
+	}
+	return defaultChannel.GetCritical(ctx)
+}
diff --git a/lib/autoupdate/lookup/rfd_109_test.go b/lib/autoupdate/lookup/rfd_109_test.go
new file mode 100644
index 0000000000000..0f488bc391528
--- /dev/null
+++ b/lib/autoupdate/lookup/rfd_109_test.go
@@ -0,0 +1,249 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/automaticupgrades"
+	"github.com/gravitational/teleport/lib/automaticupgrades/constants"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+)
+
+type mockRFD109VersionServer struct {
+	t        *testing.T
+	channels map[string]channelStub
+}
+
+type channelStub struct {
+	// with our without the leading "v"
+	version  string
+	critical bool
+	fail     bool
+}
+
+func (m *mockRFD109VersionServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	var path string
+	var writeResp func(w http.ResponseWriter, stub channelStub) error
+
+	switch {
+	case strings.HasSuffix(r.URL.Path, constants.VersionPath):
+		path = strings.Trim(strings.TrimSuffix(r.URL.Path, constants.VersionPath), "/")
+		writeResp = func(w http.ResponseWriter, stub channelStub) error {
+			_, err := w.Write([]byte(stub.version))
+			return err
+		}
+	case strings.HasSuffix(r.URL.Path, constants.MaintenancePath):
+		path = strings.Trim(strings.TrimSuffix(r.URL.Path, constants.MaintenancePath), "/")
+		writeResp = func(w http.ResponseWriter, stub channelStub) error {
+			response := "no"
+			if stub.critical {
+				response = "yes"
+			}
+			_, err := w.Write([]byte(response))
+			return err
+		}
+	default:
+		assert.Fail(m.t, "unsupported path %q", r.URL.Path)
+		w.WriteHeader(http.StatusNotFound)
+		return
+	}
+
+	channel, ok := m.channels[path]
+	if !ok {
+		w.WriteHeader(http.StatusNotFound)
+		assert.Fail(m.t, "channel %q not found", path)
+		return
+	}
+	if channel.fail {
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	assert.NoError(m.t, writeResp(w, channel), "failed to write response")
+}
+
+func TestGetVersionFromChannel(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	channelName := "test-channel"
+
+	mock := mockRFD109VersionServer{
+		t: t,
+		channels: map[string]channelStub{
+			"broken":            {fail: true},
+			"with-leading-v":    {version: "v" + testVersionHigh},
+			"without-leading-v": {version: testVersionHigh},
+			"low":               {version: testVersionLow},
+		},
+	}
+	srv := httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
+	t.Cleanup(srv.Close)
+
+	testVersion, err := version.EnsureSemver(testVersionHigh)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name           string
+		channels       automaticupgrades.Channels
+		expectedResult *semver.Version
+		expectError    require.ErrorAssertionFunc
+	}{
+		{
+			name: "channel with leading v",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/with-leading-v"},
+				"default":   {ForwardURL: srv.URL + "/low"},
+			},
+			expectedResult: testVersion,
+			expectError:    require.NoError,
+		},
+		{
+			name: "channel without leading v",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/without-leading-v"},
+				"default":   {ForwardURL: srv.URL + "/low"},
+			},
+			expectedResult: testVersion,
+			expectError:    require.NoError,
+		},
+		{
+			name: "fallback to default with leading v",
+			channels: automaticupgrades.Channels{
+				"default": {ForwardURL: srv.URL + "/with-leading-v"},
+			},
+			expectedResult: testVersion,
+			expectError:    require.NoError,
+		},
+		{
+			name: "fallback to default without leading v",
+			channels: automaticupgrades.Channels{
+				"default": {ForwardURL: srv.URL + "/without-leading-v"},
+			},
+			expectedResult: testVersion,
+			expectError:    require.NoError,
+		},
+		{
+			name: "broken channel",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/broken"},
+				"default":   {ForwardURL: srv.URL + "/without-leading-v"},
+			},
+			expectError: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test setup
+			require.NoError(t, tt.channels.CheckAndSetDefaults())
+
+			// Test execution
+			result, err := getVersionFromChannel(ctx, tt.channels, channelName)
+			tt.expectError(t, err)
+			require.Equal(t, tt.expectedResult, result)
+		})
+	}
+}
+
+func TestGetTriggerFromChannel(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	channelName := "test-channel"
+
+	mock := mockRFD109VersionServer{
+		t: t,
+		channels: map[string]channelStub{
+			"broken":       {fail: true},
+			"critical":     {critical: true},
+			"non-critical": {critical: false},
+		},
+	}
+	srv := httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
+	t.Cleanup(srv.Close)
+
+	tests := []struct {
+		name           string
+		channels       automaticupgrades.Channels
+		expectedResult bool
+		expectError    require.ErrorAssertionFunc
+	}{
+		{
+			name: "critical channel",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/critical"},
+				"default":   {ForwardURL: srv.URL + "/non-critical"},
+			},
+			expectedResult: true,
+			expectError:    require.NoError,
+		},
+		{
+			name: "non-critical channel",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/non-critical"},
+				"default":   {ForwardURL: srv.URL + "/critical"},
+			},
+			expectedResult: false,
+			expectError:    require.NoError,
+		},
+		{
+			name: "fallback to default which is critical",
+			channels: automaticupgrades.Channels{
+				"default": {ForwardURL: srv.URL + "/critical"},
+			},
+			expectedResult: true,
+			expectError:    require.NoError,
+		},
+		{
+			name: "fallback to default which is non-critical",
+			channels: automaticupgrades.Channels{
+				"default": {ForwardURL: srv.URL + "/non-critical"},
+			},
+			expectedResult: false,
+			expectError:    require.NoError,
+		},
+		{
+			name: "broken channel",
+			channels: automaticupgrades.Channels{
+				channelName: {ForwardURL: srv.URL + "/broken"},
+				"default":   {ForwardURL: srv.URL + "/critical"},
+			},
+			expectError: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test setup
+			require.NoError(t, tt.channels.CheckAndSetDefaults())
+
+			// Test execution
+			result, err := getTriggerFromChannel(ctx, tt.channels, channelName)
+			tt.expectError(t, err)
+			require.Equal(t, tt.expectedResult, result)
+		})
+	}
+}
diff --git a/lib/autoupdate/lookup/rfd_184.go b/lib/autoupdate/lookup/rfd_184.go
new file mode 100644
index 0000000000000..3b20292e28dc0
--- /dev/null
+++ b/lib/autoupdate/lookup/rfd_184.go
@@ -0,0 +1,154 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+
+	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+)
+
+// getVersionFromRollout returns the version we should serve to the agent based
+// on the RFD184 agent rollout, the agent group name, and its UUID.
+// This logic is pretty complex and described in RFD 184.
+// The spec is summed up in the following table:
+// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
+func getVersionFromRollout(
+	rollout *autoupdatepb.AutoUpdateAgentRollout,
+	groupName, updaterUUID string,
+) (*semver.Version, error) {
+	switch rollout.GetSpec().GetAutoupdateMode() {
+	case autoupdate.AgentsUpdateModeDisabled:
+		// If AUs are disabled, we always answer the target version
+		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
+	case autoupdate.AgentsUpdateModeSuspended, autoupdate.AgentsUpdateModeEnabled:
+		// If AUs are enabled or suspended, we modulate the response based on the schedule and agent group state
+	default:
+		return nil, trace.BadParameter("unsupported agent update mode %q", rollout.GetSpec().GetAutoupdateMode())
+	}
+
+	// If the schedule is immediate, agents always update to the latest version
+	if rollout.GetSpec().GetSchedule() == autoupdate.AgentsScheduleImmediate {
+		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
+	}
+
+	// Else we follow the regular schedule and answer based on the agent group state
+	group, err := getGroup(rollout, groupName)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting group %q", groupName)
+	}
+
+	switch group.GetState() {
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
+		return version.EnsureSemver(rollout.GetSpec().GetStartVersion())
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
+		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:
+		if updaterIsCanary(group, updaterUUID) {
+			return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
+		}
+		return version.EnsureSemver(rollout.GetSpec().GetStartVersion())
+	default:
+		return nil, trace.NotImplemented("unsupported group state %q", group.GetState())
+	}
+}
+
+func updaterIsCanary(group *autoupdatepb.AutoUpdateAgentRolloutStatusGroup, updaterUUID string) bool {
+	if updaterUUID == "" {
+		return false
+	}
+	for _, canary := range group.GetCanaries() {
+		if canary.UpdaterId == updaterUUID {
+			return true
+		}
+	}
+	return false
+}
+
+// getTriggerFromRollout returns the version we should serve to the agent based
+// on the RFD184 agent rollout, the agent group name, and its UUID.
+// This logic is pretty complex and described in RFD 184.
+// The spec is summed up in the following table:
+// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
+func getTriggerFromRollout(rollout *autoupdatepb.AutoUpdateAgentRollout, groupName, updaterUUID string) (bool, error) {
+	// If the mode is "paused" or "disabled", we never tell to update
+	switch rollout.GetSpec().GetAutoupdateMode() {
+	case autoupdate.AgentsUpdateModeDisabled, autoupdate.AgentsUpdateModeSuspended:
+		// If AUs are disabled or suspended, never tell to update
+		return false, nil
+	case autoupdate.AgentsUpdateModeEnabled:
+		// If AUs are enabled, we modulate the response based on the schedule and agent group state
+	default:
+		return false, trace.BadParameter("unsupported agent update mode %q", rollout.GetSpec().GetAutoupdateMode())
+	}
+
+	// If the schedule is immediate, agents always update to the latest version
+	if rollout.GetSpec().GetSchedule() == autoupdate.AgentsScheduleImmediate {
+		return true, nil
+	}
+
+	// Else we follow the regular schedule and answer based on the agent group state
+	group, err := getGroup(rollout, groupName)
+	if err != nil {
+		return false, trace.Wrap(err, "getting group %q", groupName)
+	}
+
+	switch group.GetState() {
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:
+		return false, nil
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
+		return true, nil
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
+		return rollout.GetSpec().GetStrategy() == autoupdate.AgentsStrategyHaltOnError, nil
+	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:
+		return updaterIsCanary(group, updaterUUID), nil
+	default:
+		return false, trace.NotImplemented("Unsupported group state %q", group.GetState())
+	}
+}
+
+// getGroup returns the agent rollout group the requesting agent belongs to.
+// If a group matches the agent-provided group name, this group is returned.
+// Else the default group is returned. The default group currently is the last
+// one. This might change in the future.
+func getGroup(
+	rollout *autoupdatepb.AutoUpdateAgentRollout,
+	groupName string,
+) (*autoupdatepb.AutoUpdateAgentRolloutStatusGroup, error) {
+	groups := rollout.GetStatus().GetGroups()
+	if len(groups) == 0 {
+		return nil, trace.BadParameter("no groups found")
+	}
+
+	// Try to find a group with our name
+	for _, group := range groups {
+		if group.Name == groupName {
+			return group, nil
+		}
+	}
+
+	// Fallback to the default group (currently the last one but this might change).
+	return groups[len(groups)-1], nil
+}
diff --git a/lib/autoupdate/lookup/rfd_184_test.go b/lib/autoupdate/lookup/rfd_184_test.go
new file mode 100644
index 0000000000000..c458401b6e501
--- /dev/null
+++ b/lib/autoupdate/lookup/rfd_184_test.go
@@ -0,0 +1,426 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package lookup
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	"github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+)
+
+func TestGetVersionFromRollout(t *testing.T) {
+	t.Parallel()
+	groupName := "test-group"
+
+	// This test matrix is written based on:
+	// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
+	latestAllTheTime := map[autoupdatepb.AutoUpdateAgentGroupState]string{
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     testVersionHigh,
+	}
+
+	activeDoneOnly := map[autoupdatepb.AutoUpdateAgentGroupState]string{
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  testVersionLow,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: testVersionLow,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     testVersionLow,
+	}
+
+	activeCanaryDone := map[autoupdatepb.AutoUpdateAgentGroupState]string{
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  testVersionLow,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     testVersionHigh,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: testVersionLow,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     testVersionHigh,
+	}
+
+	tests := map[string]map[string]map[autoupdatepb.AutoUpdateAgentGroupState]string{
+		autoupdate.AgentsUpdateModeDisabled: {
+			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
+			autoupdate.AgentsScheduleRegular:   latestAllTheTime,
+		},
+		autoupdate.AgentsUpdateModeSuspended: {
+			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
+			autoupdate.AgentsScheduleRegular:   activeDoneOnly,
+		},
+		autoupdate.AgentsUpdateModeEnabled: {
+			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
+			autoupdate.AgentsScheduleRegular:   activeDoneOnly,
+		},
+	}
+	for mode, scheduleCases := range tests {
+		for schedule, stateCases := range scheduleCases {
+			for state, expectedVersion := range stateCases {
+				t.Run(fmt.Sprintf("%s/%s/%s", mode, schedule, state), func(t *testing.T) {
+					expectedSemVersion, err := version.EnsureSemver(expectedVersion)
+					require.NoError(t, err)
+					rollout := &autoupdatepb.AutoUpdateAgentRollout{
+						Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+							StartVersion:   testVersionLow,
+							TargetVersion:  testVersionHigh,
+							Schedule:       schedule,
+							AutoupdateMode: mode,
+							// Strategy does not affect which version are served
+							Strategy: autoupdate.AgentsStrategyTimeBased,
+						},
+						Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+							Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+								{
+									Name:  groupName,
+									State: state,
+								},
+							},
+						},
+					}
+					version, err := getVersionFromRollout(rollout, groupName, "")
+					require.NoError(t, err)
+					require.Equal(t, expectedSemVersion, version)
+				})
+			}
+		}
+	}
+
+	canaryTestCases := map[bool]map[autoupdatepb.AutoUpdateAgentGroupState]string{
+		true:  activeCanaryDone,
+		false: activeDoneOnly,
+	}
+
+	for canaryMatching, statesCases := range canaryTestCases {
+		const (
+			schedule = autoupdate.AgentsScheduleRegular
+			mode     = autoupdate.AgentsUpdateModeEnabled
+		)
+
+		for state, expectedVersion := range statesCases {
+			t.Run(fmt.Sprintf("canary(%s)/%s", strconv.FormatBool(canaryMatching), state), func(t *testing.T) {
+				expectedSemVersion, err := version.EnsureSemver(expectedVersion)
+				require.NoError(t, err)
+
+				rollout := &autoupdatepb.AutoUpdateAgentRollout{
+					Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+						StartVersion:   testVersionLow,
+						TargetVersion:  testVersionHigh,
+						Schedule:       schedule,
+						AutoupdateMode: mode,
+						// Strategy does not affect which version are served
+						Strategy: autoupdate.AgentsStrategyTimeBased,
+					},
+					Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+						Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+							{
+								Name:  groupName,
+								State: state,
+								Canaries: []*autoupdatepb.Canary{
+									{
+										UpdaterId: uuid.NewString(),
+										HostId:    uuid.NewString(),
+										Hostname:  "test-host",
+										Success:   false,
+									},
+								},
+							},
+						},
+					},
+				}
+				var updaterID string
+				if canaryMatching {
+					updaterID = rollout.GetStatus().GetGroups()[0].GetCanaries()[0].GetUpdaterId()
+				} else {
+					updaterID = uuid.NewString()
+				}
+				version, err := getVersionFromRollout(rollout, groupName, updaterID)
+				require.NoError(t, err)
+				require.Equal(t, expectedSemVersion, version)
+			})
+
+		}
+
+	}
+}
+
+func TestGetTriggerFromRollout(t *testing.T) {
+	t.Parallel()
+	groupName := "test-group"
+
+	// This test matrix is written based on:
+	// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
+	neverUpdate := map[autoupdatepb.AutoUpdateAgentGroupState]bool{
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     false,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: false,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     false,
+	}
+	alwaysUpdate := map[autoupdatepb.AutoUpdateAgentGroupState]bool{
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  true,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     true,
+	}
+
+	tests := map[string]map[string]map[string]map[autoupdatepb.AutoUpdateAgentGroupState]bool{
+		autoupdate.AgentsUpdateModeDisabled: {
+			autoupdate.AgentsStrategyTimeBased: {
+				autoupdate.AgentsScheduleImmediate: neverUpdate,
+				autoupdate.AgentsScheduleRegular:   neverUpdate,
+			},
+			autoupdate.AgentsStrategyHaltOnError: {
+				autoupdate.AgentsScheduleImmediate: neverUpdate,
+				autoupdate.AgentsScheduleRegular:   neverUpdate,
+			},
+		},
+		autoupdate.AgentsUpdateModeSuspended: {
+			autoupdate.AgentsStrategyTimeBased: {
+				autoupdate.AgentsScheduleImmediate: neverUpdate,
+				autoupdate.AgentsScheduleRegular:   neverUpdate,
+			},
+			autoupdate.AgentsStrategyHaltOnError: {
+				autoupdate.AgentsScheduleImmediate: neverUpdate,
+				autoupdate.AgentsScheduleRegular:   neverUpdate,
+			},
+		},
+		autoupdate.AgentsUpdateModeEnabled: {
+			autoupdate.AgentsStrategyTimeBased: {
+				autoupdate.AgentsScheduleImmediate: alwaysUpdate,
+				autoupdate.AgentsScheduleRegular: {
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     false,
+				},
+			},
+			autoupdate.AgentsStrategyHaltOnError: {
+				autoupdate.AgentsScheduleImmediate: alwaysUpdate,
+				autoupdate.AgentsScheduleRegular: {
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     false,
+				},
+			},
+		},
+	}
+	for mode, strategyCases := range tests {
+		for strategy, scheduleCases := range strategyCases {
+			for schedule, stateCases := range scheduleCases {
+				for state, expectedTrigger := range stateCases {
+					t.Run(fmt.Sprintf("%s/%s/%s/%s", mode, strategy, schedule, state), func(t *testing.T) {
+						rollout := &autoupdatepb.AutoUpdateAgentRollout{
+							Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+								StartVersion:   testVersionLow,
+								TargetVersion:  testVersionHigh,
+								Schedule:       schedule,
+								AutoupdateMode: mode,
+								Strategy:       strategy,
+							},
+							Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+								Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+									{
+										Name:  groupName,
+										State: state,
+									},
+								},
+							},
+						}
+						shouldUpdate, err := getTriggerFromRollout(rollout, groupName, "")
+						require.NoError(t, err)
+						require.Equal(t, expectedTrigger, shouldUpdate)
+					})
+				}
+			}
+		}
+	}
+
+	canaryTestCases := map[bool]map[string]map[autoupdatepb.AutoUpdateAgentGroupState]bool{
+		true: {
+			autoupdate.AgentsStrategyTimeBased: {
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     true,
+			},
+			autoupdate.AgentsStrategyHaltOnError: {
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     true,
+			},
+		},
+		false: {
+			autoupdate.AgentsStrategyTimeBased: {
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     false,
+			},
+			autoupdate.AgentsStrategyHaltOnError: {
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
+				autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:     false,
+			},
+		},
+	}
+
+	for canaryMatching, strategyCases := range canaryTestCases {
+		const (
+			schedule = autoupdate.AgentsScheduleRegular
+			mode     = autoupdate.AgentsUpdateModeEnabled
+		)
+
+		for strategy, statesCases := range strategyCases {
+			for state, expectedTrigger := range statesCases {
+				t.Run(fmt.Sprintf("canary(%s)/%s/%s", strconv.FormatBool(canaryMatching), strategy, state), func(t *testing.T) {
+					rollout := &autoupdatepb.AutoUpdateAgentRollout{
+						Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+							StartVersion:   testVersionLow,
+							TargetVersion:  testVersionHigh,
+							Schedule:       schedule,
+							AutoupdateMode: mode,
+							Strategy:       strategy,
+						},
+						Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+							Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+								{
+									Name:  groupName,
+									State: state,
+									Canaries: []*autoupdatepb.Canary{
+										{
+											UpdaterId: uuid.NewString(),
+											HostId:    uuid.NewString(),
+											Hostname:  "test-host",
+											Success:   false,
+										},
+									},
+								},
+							},
+						},
+					}
+					var updaterID string
+					if canaryMatching {
+						updaterID = rollout.GetStatus().GetGroups()[0].GetCanaries()[0].GetUpdaterId()
+					} else {
+						updaterID = uuid.NewString()
+					}
+					trigger, err := getTriggerFromRollout(rollout, groupName, updaterID)
+					require.NoError(t, err)
+					require.Equal(t, expectedTrigger, trigger)
+				})
+
+			}
+
+		}
+
+	}
+}
+
+func TestGetGroup(t *testing.T) {
+	groupName := "test-group"
+	t.Parallel()
+	tests := []struct {
+		name           string
+		rollout        *autoupdatepb.AutoUpdateAgentRollout
+		expectedResult *autoupdatepb.AutoUpdateAgentRolloutStatusGroup
+		expectError    require.ErrorAssertionFunc
+	}{
+		{
+			name:        "nil",
+			expectError: require.Error,
+		},
+		{
+			name:        "nil status",
+			rollout:     &autoupdatepb.AutoUpdateAgentRollout{},
+			expectError: require.Error,
+		},
+		{
+			name:        "nil status groups",
+			rollout:     &autoupdatepb.AutoUpdateAgentRollout{Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{}},
+			expectError: require.Error,
+		},
+		{
+			name: "empty status groups",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{},
+				},
+			},
+			expectError: require.Error,
+		},
+		{
+			name: "group matching name",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+						{Name: "foo", State: 1},
+						{Name: "bar", State: 1},
+						{Name: groupName, State: 2},
+						{Name: "baz", State: 1},
+					},
+				},
+			},
+			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+				Name:  groupName,
+				State: 2,
+			},
+			expectError: require.NoError,
+		},
+		{
+			name: "no group matching name, should fallback to default",
+			rollout: &autoupdatepb.AutoUpdateAgentRollout{
+				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+						{Name: "foo", State: 1},
+						{Name: "bar", State: 1},
+						{Name: "baz", State: 1},
+					},
+				},
+			},
+			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+				Name:  "baz",
+				State: 1,
+			},
+			expectError: require.NoError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := getGroup(tt.rollout, groupName)
+			tt.expectError(t, err)
+			require.Equal(t, tt.expectedResult, result)
+		})
+	}
+}
diff --git a/lib/autoupdate/package_url.go b/lib/autoupdate/package_url.go
index b00eb59fea5c9..d0da9a4616033 100644
--- a/lib/autoupdate/package_url.go
+++ b/lib/autoupdate/package_url.go
@@ -43,6 +43,8 @@ const (
 	DefaultBaseURL = "https://cdn.teleport.dev"
 	// DefaultPackage is the name of Teleport package.
 	DefaultPackage = "teleport"
+	// DefaultToolsPackage is the name of separate Teleport package with client tools only (tsh, tctl).
+	DefaultToolsPackage = "teleport-tools"
 	// DefaultCDNURITemplate is the default template for the Teleport CDN download URL.
 	DefaultCDNURITemplate = `{{ .BaseURL }}/
 	{{- if eq .OS "darwin" }}
diff --git a/lib/autoupdate/rollout/client.go b/lib/autoupdate/rollout/client.go
index d0fbbfaeae427..b79c08e3c0db0 100644
--- a/lib/autoupdate/rollout/client.go
+++ b/lib/autoupdate/rollout/client.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -55,6 +56,13 @@ type Client interface {
 	// ListAutoUpdateAgentReports lists the autoupdate_agent_report resources
 	// so the controller can measure the rollout progress.
 	ListAutoUpdateAgentReports(ctx context.Context, pageSize int, nextKey string) ([]*autoupdatepb.AutoUpdateAgentReport, string, error)
+
+	// SampleAgentsFromAutoUpdateGroup samples agents belonging to a specific autoupdate group.
+	// This is used to pick canaries.
+	SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName string, sampleSize int, groups []string) ([]*autoupdatepb.Canary, error)
+
+	// LookupAgentInInventory looks up a specific HostID in the auth local inventory and returns its Hello message.
+	LookupAgentInInventory(ctx context.Context, hostID string) ([]*proto.UpstreamInventoryHello, error)
 }
 
 func getAllReports(ctx context.Context, clt Client) ([]*autoupdatepb.AutoUpdateAgentReport, error) {
diff --git a/lib/autoupdate/rollout/client_test.go b/lib/autoupdate/rollout/client_test.go
index 49a84d85555c1..76b4366c4607a 100644
--- a/lib/autoupdate/rollout/client_test.go
+++ b/lib/autoupdate/rollout/client_test.go
@@ -26,22 +26,28 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 
+	apiproto "github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 )
 
+// make sure our test client implements the Client interface.
+var _ Client = &testifyMockClient{}
+
 type mockClientStubs struct {
-	configAnswers        []callAnswer[*autoupdate.AutoUpdateConfig]
-	versionAnswers       []callAnswer[*autoupdate.AutoUpdateVersion]
-	rolloutAnswers       []callAnswer[*autoupdate.AutoUpdateAgentRollout]
-	createRolloutAnswers []callAnswer[*autoupdate.AutoUpdateAgentRollout]
-	createRolloutExpects []require.ValueAssertionFunc
-	updateRolloutAnswers []callAnswer[*autoupdate.AutoUpdateAgentRollout]
-	updateRolloutExpects []require.ValueAssertionFunc
-	deleteRolloutAnswers []error
-	cmcAnswers           []callAnswer[*types.ClusterMaintenanceConfigV1]
-	reportsAnswers       []callAnswer[[]*autoupdate.AutoUpdateAgentReport]
+	configAnswers         []callAnswer[*autoupdate.AutoUpdateConfig]
+	versionAnswers        []callAnswer[*autoupdate.AutoUpdateVersion]
+	rolloutAnswers        []callAnswer[*autoupdate.AutoUpdateAgentRollout]
+	createRolloutAnswers  []callAnswer[*autoupdate.AutoUpdateAgentRollout]
+	createRolloutExpects  []require.ValueAssertionFunc
+	updateRolloutAnswers  []callAnswer[*autoupdate.AutoUpdateAgentRollout]
+	updateRolloutExpects  []require.ValueAssertionFunc
+	deleteRolloutAnswers  []error
+	cmcAnswers            []callAnswer[*types.ClusterMaintenanceConfigV1]
+	reportsAnswers        []callAnswer[[]*autoupdate.AutoUpdateAgentReport]
+	agentSamples          []callAnswer[[]*autoupdate.Canary]
+	inventoryAgentLookups map[string][]callAnswer[[]*apiproto.UpstreamInventoryHello]
 }
 
 type callAnswer[T any] struct {
@@ -83,6 +89,14 @@ func newMockClient(t *testing.T, stubs mockClientStubs) *testifyMockClient {
 	for _, answer := range stubs.reportsAnswers {
 		clt.On("ListAutoUpdateAgentReports", mock.Anything, mock.Anything, mock.Anything).Return(answer.result, answer.err).Once()
 	}
+	for _, answer := range stubs.agentSamples {
+		clt.On("SampleAgentsFromAutoUpdateGroup", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(answer.result, answer.err).Once()
+	}
+	for host := range stubs.inventoryAgentLookups {
+		for _, answer := range stubs.inventoryAgentLookups[host] {
+			clt.On("LookupAgentInInventory", mock.Anything, host).Return(answer.result, answer.err).Once()
+		}
+	}
 
 	return clt
 }
@@ -93,6 +107,20 @@ type testifyMockClient struct {
 	stubs mockClientStubs
 }
 
+func (n *testifyMockClient) SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName string, sampleSize int, groups []string) ([]*autoupdate.Canary, error) {
+	args := n.Called(ctx, groupName, sampleSize, groups)
+	var canaries []*autoupdate.Canary
+	for _, canary := range args.Get(0).([]*autoupdate.Canary) {
+		canaries = append(canaries, proto.CloneOf(canary))
+	}
+	return canaries, args.Error(1)
+}
+
+func (n *testifyMockClient) LookupAgentInInventory(ctx context.Context, hostID string) ([]*apiproto.UpstreamInventoryHello, error) {
+	args := n.Called(ctx, hostID)
+	return args.Get(0).([]*apiproto.UpstreamInventoryHello), args.Error(1)
+}
+
 func (n *testifyMockClient) GetAutoUpdateConfig(ctx context.Context) (*autoupdate.AutoUpdateConfig, error) {
 	args := n.Called(ctx)
 	result := proto.Clone(args.Get(0).(*autoupdate.AutoUpdateConfig))
@@ -153,4 +181,10 @@ func (n *testifyMockClient) checkIfCallsWereDone(t *testing.T) {
 	n.AssertNumberOfCalls(t, "DeleteAutoUpdateAgentRollout", len(n.stubs.deleteRolloutAnswers))
 	n.AssertNumberOfCalls(t, "GetClusterMaintenanceConfig", len(n.stubs.cmcAnswers))
 	n.AssertNumberOfCalls(t, "ListAutoUpdateAgentReports", len(n.stubs.reportsAnswers))
+	n.AssertNumberOfCalls(t, "SampleAgentsFromAutoUpdateGroup", len(n.stubs.agentSamples))
+	var agentLookupCount int
+	for _, answers := range n.stubs.inventoryAgentLookups {
+		agentLookupCount += len(answers)
+	}
+	n.AssertNumberOfCalls(t, "LookupAgentInInventory", agentLookupCount)
 }
diff --git a/lib/autoupdate/rollout/controller.go b/lib/autoupdate/rollout/controller.go
index 4a460f391b44b..120854cce82c0 100644
--- a/lib/autoupdate/rollout/controller.go
+++ b/lib/autoupdate/rollout/controller.go
@@ -41,7 +41,6 @@ const (
 // We currently wake up every minute, in the future we might decide to also watch for events
 // (from autoupdate_config and autoupdate_version changefeed) to react faster.
 type Controller struct {
-	// TODO(hugoShaka) add prometheus metrics describing the reconciliation status
 	reconciler reconciler
 	clock      clockwork.Clock
 	log        *slog.Logger
diff --git a/lib/autoupdate/rollout/metrics.go b/lib/autoupdate/rollout/metrics.go
index 1fbd3e00f5cc1..59a68cf093e55 100644
--- a/lib/autoupdate/rollout/metrics.go
+++ b/lib/autoupdate/rollout/metrics.go
@@ -34,10 +34,12 @@ import (
 	"github.com/gravitational/teleport"
 	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	"github.com/gravitational/teleport/api/types/autoupdate"
+	utils "github.com/gravitational/teleport/lib/automaticupgrades/version"
 )
 
 const (
 	metricsSubsystem            = "agent_autoupdates"
+	clientMetricsSubsystem      = "client_autoupdates"
 	metricVersionLabelRetention = 24 * time.Hour
 )
 
@@ -63,14 +65,18 @@ type metrics struct {
 	versionTarget  *prometheus.GaugeVec
 	versionMode    prometheus.Gauge
 
+	clientVersionTargetMajor prometheus.Gauge
+
 	configPresent prometheus.Gauge
 	configMode    prometheus.Gauge
 
-	rolloutPresent  prometheus.Gauge
-	rolloutStart    *prometheus.GaugeVec
-	rolloutTarget   *prometheus.GaugeVec
-	rolloutMode     prometheus.Gauge
-	rolloutStrategy *prometheus.GaugeVec
+	rolloutPresent     prometheus.Gauge
+	rolloutStart       *prometheus.GaugeVec
+	rolloutTarget      *prometheus.GaugeVec
+	rolloutTargetMajor prometheus.Gauge
+	buildInfoMajor     prometheus.Gauge
+	rolloutMode        prometheus.Gauge
+	rolloutStrategy    *prometheus.GaugeVec
 
 	// rollout status metrics
 	rolloutTimeOverride prometheus.Gauge
@@ -144,6 +150,13 @@ func newMetrics(reg prometheus.Registerer) (*metrics, error) {
 			Help:      fmt.Sprintf("Metric describing the agent update mode from the autoupdate_version resource. %s", valuesHelpString(codeToAgentMode)),
 		}),
 
+		clientVersionTargetMajor: prometheus.NewGauge(prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: clientMetricsSubsystem,
+			Name:      "version_target_major",
+			Help:      "Metric describing the client tools target major version from the autoupdate_version resource.",
+		}),
+
 		configPresent: prometheus.NewGauge(prometheus.GaugeOpts{
 			Namespace: teleport.MetricNamespace,
 			Subsystem: metricsSubsystem,
@@ -169,6 +182,18 @@ func newMetrics(reg prometheus.Registerer) (*metrics, error) {
 			Name:      "rollout_target",
 			Help:      "Metric describing the agent target version from the autoupdate_gent_rollout resource.",
 		}, []string{metricsVersionLabelName}),
+		rolloutTargetMajor: prometheus.NewGauge(prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: metricsSubsystem,
+			Name:      "rollout_target_major",
+			Help:      "Metric describing the target major version from the autoupdate_agent_rollout resource.",
+		}),
+		buildInfoMajor: prometheus.NewGauge(prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: metricsSubsystem,
+			Name:      "build_info_major",
+			Help:      "Metric describing the auth major version.",
+		}),
 		rolloutStart: prometheus.NewGaugeVec(prometheus.GaugeOpts{
 			Namespace: teleport.MetricNamespace,
 			Subsystem: metricsSubsystem,
@@ -217,10 +242,13 @@ func newMetrics(reg prometheus.Registerer) (*metrics, error) {
 		reg.Register(m.versionTarget),
 		reg.Register(m.versionStart),
 		reg.Register(m.versionMode),
+		reg.Register(m.clientVersionTargetMajor),
 		reg.Register(m.configPresent),
 		reg.Register(m.configMode),
 		reg.Register(m.rolloutPresent),
 		reg.Register(m.rolloutTarget),
+		reg.Register(m.rolloutTargetMajor),
+		reg.Register(m.buildInfoMajor),
 		reg.Register(m.rolloutStart),
 		reg.Register(m.rolloutMode),
 		reg.Register(m.rolloutStrategy),
@@ -229,6 +257,7 @@ func newMetrics(reg prometheus.Registerer) (*metrics, error) {
 		reg.Register(m.rolloutState),
 		reg.Register(m.rolloutGroupState),
 	)
+	m.buildInfoMajor.Set(float64(teleport.SemVer().Major))
 
 	return &m, errs
 }
@@ -292,12 +321,18 @@ func (m *metrics) observeVersion(version *autoupdatepb.AutoUpdateVersion, now ti
 	if version.GetSpec().GetAgents() == nil {
 		m.versionPresent.Set(0)
 		m.versionMode.Set(float64(agentModeCode[defaultConfigMode]))
-		return
+	} else {
+		m.versionPresent.Set(1)
+		m.versionMode.Set(float64(agentModeCode[version.GetSpec().GetAgents().GetMode()]))
+		m.setVersionMetric(version.GetSpec().GetAgents().GetStartVersion(), m.versionStart, now)
+		m.setVersionMetric(version.GetSpec().GetAgents().GetTargetVersion(), m.versionTarget, now)
+	}
+
+	if tools := version.GetSpec().GetTools(); tools != nil {
+		if target, err := utils.EnsureSemver(tools.GetTargetVersion()); err == nil {
+			m.clientVersionTargetMajor.Set(float64(target.Major))
+		}
 	}
-	m.versionPresent.Set(1)
-	m.versionMode.Set(float64(agentModeCode[version.GetSpec().GetAgents().GetMode()]))
-	m.setVersionMetric(version.GetSpec().GetAgents().GetStartVersion(), m.versionStart, now)
-	m.setVersionMetric(version.GetSpec().GetAgents().GetTargetVersion(), m.versionTarget, now)
 }
 
 func (m *metrics) setGroupStates(groups []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup) {
@@ -333,6 +368,10 @@ func (m *metrics) observeRollout(rollout *autoupdatepb.AutoUpdateAgentRollout, n
 		m.rolloutMode.Set(float64(agentModeCode[rollout.GetSpec().GetAutoupdateMode()]))
 		m.setVersionMetric(rollout.GetSpec().GetStartVersion(), m.rolloutStart, now)
 		m.setVersionMetric(rollout.GetSpec().GetTargetVersion(), m.rolloutTarget, now)
+
+		if target, err := utils.EnsureSemver(rollout.GetSpec().GetTargetVersion()); err == nil {
+			m.rolloutTargetMajor.Set(float64(target.Major))
+		}
 	}
 
 	m.setStrategyMetric(rollout.GetSpec().GetStrategy(), m.rolloutStrategy)
diff --git a/lib/autoupdate/rollout/reconciler.go b/lib/autoupdate/rollout/reconciler.go
index cddd023f4e9b2..0185893035acb 100644
--- a/lib/autoupdate/rollout/reconciler.go
+++ b/lib/autoupdate/rollout/reconciler.go
@@ -388,6 +388,7 @@ func (r *reconciler) makeGroupsStatus(ctx context.Context, schedules *autoupdate
 			ConfigDays:       group.Days,
 			ConfigStartHour:  group.StartHour,
 			ConfigWaitHours:  group.WaitHours,
+			CanaryCount:      uint64(group.CanaryCount),
 		}
 	}
 	return groups, nil
diff --git a/lib/autoupdate/rollout/reconciler_test.go b/lib/autoupdate/rollout/reconciler_test.go
index 4ded24fec281d..72631d1aaef24 100644
--- a/lib/autoupdate/rollout/reconciler_test.go
+++ b/lib/autoupdate/rollout/reconciler_test.go
@@ -36,7 +36,7 @@ import (
 	update "github.com/gravitational/teleport/api/types/autoupdate"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // rolloutEquals returns a require.ValueAssertionFunc that checks the rollout is identical.
@@ -136,7 +136,7 @@ func TestGetMode(t *testing.T) {
 
 func TestTryReconcile(t *testing.T) {
 	t.Parallel()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 
@@ -331,7 +331,7 @@ func TestTryReconcile(t *testing.T) {
 }
 
 func TestReconciler_Reconcile(t *testing.T) {
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 	// Test setup: creating fixtures
@@ -728,7 +728,7 @@ func (f *fakeRolloutStrategy) progressRollout(ctx context.Context, spec *autoupd
 }
 
 func Test_reconciler_computeStatus(t *testing.T) {
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	clock := clockwork.NewFakeClock()
 	ctx := context.Background()
 
diff --git a/lib/autoupdate/rollout/strategy.go b/lib/autoupdate/rollout/strategy.go
index d5b8236ce8f90..1bcfe90d4a5a6 100644
--- a/lib/autoupdate/rollout/strategy.go
+++ b/lib/autoupdate/rollout/strategy.go
@@ -97,8 +97,11 @@ func setGroupState(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, newState
 	if previousState != newState {
 		group.State = newState
 		changed = true
-		// If we just started the group, also update the start time
-		if newState == autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE {
+		// If we just started the group, also update the start time.
+		// If we are doing a canary -> active transition, we don't override the start date.
+		if (newState == autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE &&
+			previousState != autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY) ||
+			newState == autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY {
 			group.StartTime = timestamppb.New(now)
 		}
 	}
diff --git a/lib/autoupdate/rollout/strategy_haltonerror.go b/lib/autoupdate/rollout/strategy_haltonerror.go
index b05b79827c234..5741bdfe46136 100644
--- a/lib/autoupdate/rollout/strategy_haltonerror.go
+++ b/lib/autoupdate/rollout/strategy_haltonerror.go
@@ -24,10 +24,13 @@ import (
 	"slices"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	update "github.com/gravitational/teleport/api/types/autoupdate"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
 )
 
 const (
@@ -36,6 +39,8 @@ const (
 	updateReasonPreviousGroupsNotDone = "previous_groups_not_done"
 	updateReasonUpdateComplete        = "update_complete"
 	updateReasonUpdateInProgress      = "update_in_progress"
+	updateReasonCanariesAlive         = "canaries_are_alive"
+	updateReasonWaitingForCanaries    = "waiting_for_canaries"
 	haltOnErrorWindowDuration         = time.Hour
 )
 
@@ -128,8 +133,35 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 			default:
 				// All previous groups are DONE and time-related criteria are met.
 				// We can start.
-				setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonCanStart, now)
-				group.InitialCount = uint64(agentCount)
+
+				// We pass the list of groups to the sampler because it must compute the catch-call group
+				groups := make([]string, len(status.Groups))
+				for j, g := range status.Groups {
+					groups[j] = g.GetName()
+				}
+				h.startGroup(ctx, group, now, agentCount, status)
+			}
+			previousGroupsAreDone = false
+		case autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:
+			// Sample the canaries if they were not sampled yet.
+			if err := h.sampleCanaries(ctx, group, status); err != nil {
+				return trace.Wrap(err, "failed to sample canaries")
+			}
+			// Check if the canaries are back online and running the right version
+			targetVersion, err := version.EnsureSemver(spec.GetTargetVersion())
+			if err != nil {
+				return trace.Wrap(err, "failed to parse target version, rollout is malformed")
+			}
+			successfulCanaries := h.updateCanariesStatus(ctx, group, *targetVersion)
+
+			// If all canaries are OK, we can transition to the active state
+			if successfulCanaries == int(group.CanaryCount) {
+				h.log.DebugContext(ctx, "All canaries came back alive, transitioning to the active state", "group", group, "got", successfulCanaries, "want", int(group.CanaryCount))
+				setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonCanariesAlive, now)
+			} else {
+				h.log.DebugContext(ctx, "Not all canaries came back yet, staying into canary state", "group", group, "got", successfulCanaries, "want", int(group.CanaryCount))
+				setGroupState(group, group.State, updateReasonWaitingForCanaries, now)
+
 			}
 			previousGroupsAreDone = false
 		case autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
@@ -157,6 +189,131 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 	return nil
 }
 
+func shouldUseCanaries(group *autoupdate.AutoUpdateAgentRolloutStatusGroup) bool {
+	// in the future we might change this logic to be a multiple of the required canary count
+	// and make the canary count dynamic
+	return group.CanaryCount > 0
+}
+
+func (h *haltOnErrorStrategy) startGroup(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time, agentCount int, status *autoupdate.AutoUpdateAgentRolloutStatus) {
+	group.InitialCount = uint64(agentCount)
+
+	if !shouldUseCanaries(group) {
+		h.log.DebugContext(ctx, "Skipping canary rollout, transitioning directly to the active state", "group", group.Name)
+		setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonCanStart, now)
+		return
+	}
+
+	setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY, updateReasonCanStart, now)
+	// This is a small optimization, as we just transitioned into the canary state we can sample canaries.
+	// This will allow us to start updating without having to wait for the next reconciliation cycle.
+	if err := h.sampleCanaries(ctx, group, status); err != nil {
+		h.log.WarnContext(ctx, "Failed to sample canaries", "group", group.Name)
+	}
+}
+
+func (h *haltOnErrorStrategy) sampleCanaries(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, status *autoupdate.AutoUpdateAgentRolloutStatus) error {
+	// Check if we need to pick more canaries
+	if len(group.Canaries) < int(group.CanaryCount) {
+		previousLength := len(group.Canaries)
+		h.log.DebugContext(ctx, "Group is missing canaries, sampling some more", "group", group, "got", previousLength, "want", int(group.CanaryCount))
+
+		// We pass the list of groups to the sampler because it must compute the catch-all group.
+		groups := make([]string, len(status.Groups))
+		for j, g := range status.Groups {
+			groups[j] = g.GetName()
+		}
+		// We sample as many canaries as possible instead of just the missing ones
+		// Because we might sample an already sampled canary.
+		additionalCanaries, err := h.clt.SampleAgentsFromAutoUpdateGroup(ctx, group.Name, int(group.CanaryCount), groups)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		injectCanaries(group, additionalCanaries)
+		h.log.DebugContext(ctx, "Additional canaries sampled", "group", group, "before", previousLength, "after", len(group.Canaries))
+	} else {
+		h.log.DebugContext(ctx, "Canaries already sampled", "group", group.Name, "got", len(group.Canaries))
+	}
+	return nil
+}
+
+func injectCanaries(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, additionalCanaries []*autoupdate.Canary) {
+	for _, canary := range additionalCanaries {
+		// We first check if the canary has already been sampled
+		alreadySampled := false
+		for _, existingCanary := range group.Canaries {
+			if existingCanary.UpdaterId == canary.UpdaterId {
+				alreadySampled = true
+				break
+			}
+		}
+
+		// If it was not, great, we have a new canary.
+		if !alreadySampled {
+			group.Canaries = append(group.Canaries, canary)
+		}
+
+		// Stop adding canaries once we have the right amount
+		if len(group.Canaries) == int(group.CanaryCount) {
+			return
+		}
+	}
+}
+
+func (h *haltOnErrorStrategy) updateCanariesStatus(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, targetVersion semver.Version) int {
+	h.log.DebugContext(ctx, "Checking canaries", "group", group.Name)
+	var successfulCanaries int
+	for _, canary := range group.Canaries {
+		// If the canary already came back healthy, nothing to do
+		if canary.Success {
+			successfulCanaries++
+			continue
+		}
+
+		canaryLogInfo := slog.Group("canary", "host_id", canary.HostId, "updater_id", canary.UpdaterId, "hostname", canary.Hostname)
+		log := h.log.With(canaryLogInfo).With("group", group.Name)
+
+		// Check if the canary is connected to our auth
+		hellos, err := h.clt.LookupAgentInInventory(ctx, canary.HostId)
+		if err != nil {
+			if trace.IsNotFound(err) {
+				// Canary is not registered to our Auth Service.
+				// Note: One old canary instance might still be connected to the auth,
+				// be we are ignoring terminating instances.
+				log.DebugContext(ctx, "Node not connected")
+			} else {
+				h.log.WarnContext(ctx, "Failed to lookup agent")
+			}
+			continue
+		}
+
+		if canaryIsRunningTargetVersion(ctx, hellos, targetVersion, log) {
+			canary.Success = true
+			successfulCanaries++
+		}
+	}
+	return successfulCanaries
+}
+
+// canaryIsRunningTargetVersion returns true if at least one of the Hellos indicates
+// the canary is running the target version.
+func canaryIsRunningTargetVersion(ctx context.Context, hellos []*proto.UpstreamInventoryHello, targetVersion semver.Version, log *slog.Logger) bool {
+	for _, hello := range hellos {
+		canaryVersion, err := version.EnsureSemver(hello.Version)
+		if err != nil {
+			log.WarnContext(ctx, "Failed to parse canary version", "err", err, "current_version", hello.Version)
+			continue
+		}
+		if !targetVersion.Equal(*canaryVersion) {
+			log.DebugContext(ctx, "Canary is not running the target version", "current_version", canaryVersion, "expected_version", targetVersion)
+			continue
+		}
+		log.DebugContext(ctx, "Canary is running the target version, marking it healthy", "current_version", canaryVersion, "expected_version", targetVersion)
+		return true
+	}
+	return false
+}
+
 func canStartHaltOnError(group, previousGroup *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time) (bool, error) {
 	// check wait hours
 	if group.ConfigWaitHours != 0 {
diff --git a/lib/autoupdate/rollout/strategy_haltonerror_test.go b/lib/autoupdate/rollout/strategy_haltonerror_test.go
index b5de3279a4847..8b7e9ecf284e4 100644
--- a/lib/autoupdate/rollout/strategy_haltonerror_test.go
+++ b/lib/autoupdate/rollout/strategy_haltonerror_test.go
@@ -20,17 +20,23 @@ package rollout
 
 import (
 	"context"
+	"fmt"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func Test_canStartHaltOnError(t *testing.T) {
@@ -135,7 +141,7 @@ func Test_canStartHaltOnError(t *testing.T) {
 
 func Test_progressGroupsHaltOnError(t *testing.T) {
 	clock := clockwork.NewFakeClockAt(testSunday)
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	fewSecondsAgo := clock.Now().Add(-3 * time.Second)
 	fewMinutesAgo := clock.Now().Add(-5 * time.Minute)
@@ -167,7 +173,7 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					},
 					group2Name: {
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 5},
+							startVersion:  {Count: 3},
 							targetVersion: {Count: 5},
 						},
 					},
@@ -198,12 +204,121 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 		},
 	}
 
+	// canaryTestReports contain more agents, so it triggers the canary logic
+	canaryTestReports := []*autoupdate.AutoUpdateAgentReport{
+		{
+			Metadata: &headerv1.Metadata{Name: "auth1"},
+			Spec: &autoupdate.AutoUpdateAgentReportSpec{
+				Timestamp: timestamppb.New(fewSecondsAgo),
+				Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
+					group1Name: {
+						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
+							startVersion:  {Count: 20},
+							targetVersion: {Count: 5},
+							otherVersion:  {Count: 1},
+						},
+					},
+					group2Name: {
+						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
+							startVersion:  {Count: 3},
+							targetVersion: {Count: 5},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	var (
+		testCanaries        []*autoupdate.Canary
+		healthyTestCanaries []*autoupdate.Canary
+	)
+	for i := range 10 {
+		updaterId := uuid.NewString()
+		hostID := uuid.NewString()
+		hostName := fmt.Sprintf("canary-%d", i)
+		testCanaries = append(testCanaries, &autoupdate.Canary{
+			UpdaterId: updaterId,
+			HostId:    hostID,
+			Hostname:  hostName,
+			Success:   false,
+		})
+		healthyTestCanaries = append(healthyTestCanaries, &autoupdate.Canary{
+			UpdaterId: updaterId,
+			HostId:    hostID,
+			Hostname:  hostName,
+			Success:   true,
+		})
+	}
+
+	testCanariesLookupNotFound := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
+	testCanariesLookupStartVersion := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
+	testCanariesLookupTargetVersion := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
+	testCanariesLookupTargetVersionDualHandles := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
+
+	for _, canary := range testCanaries {
+		testCanariesLookupNotFound[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+			{err: trace.NotFound("handle not found")},
+		}
+		testCanariesLookupStartVersion[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+			{
+				result: []*proto.UpstreamInventoryHello{
+					{
+						Version:                 startVersion,
+						ServerID:                canary.HostId,
+						Hostname:                canary.Hostname,
+						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
+						ExternalUpgraderVersion: startVersion,
+					},
+				},
+				err: nil,
+			},
+		}
+		testCanariesLookupTargetVersion[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+			{
+				result: []*proto.UpstreamInventoryHello{
+					{
+						Version:                 targetVersion,
+						ServerID:                canary.HostId,
+						Hostname:                canary.Hostname,
+						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
+						ExternalUpgraderVersion: targetVersion,
+					},
+				},
+				err: nil,
+			},
+		}
+		testCanariesLookupTargetVersionDualHandles[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+			{
+				result: []*proto.UpstreamInventoryHello{
+					{
+						Version:                 startVersion,
+						ServerID:                canary.HostId,
+						Hostname:                canary.Hostname,
+						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
+						ExternalUpgraderVersion: startVersion,
+					},
+					{
+						Version:                 targetVersion,
+						ServerID:                canary.HostId,
+						Hostname:                canary.Hostname,
+						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
+						ExternalUpgraderVersion: targetVersion,
+					},
+				},
+				err: nil,
+			},
+		}
+	}
+
 	tests := []struct {
 		name             string
 		initialState     []*autoupdate.AutoUpdateAgentRolloutStatusGroup
 		reports          []*autoupdate.AutoUpdateAgentReport
 		rolloutStartTime *timestamppb.Timestamp
 		expectedState    []*autoupdate.AutoUpdateAgentRolloutStatusGroup
+		canarySamples    []callAnswer[[]*autoupdate.Canary]
+		agentLookups     map[string][]callAnswer[[]*proto.UpstreamInventoryHello]
 	}{
 		{
 			name: "single group unstarted -> unstarted",
@@ -566,7 +681,7 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
 					// Group1 is the catch-all group, so it should count group2 agents
-					PresentCount:  20,
+					PresentCount:  18,
 					UpToDateCount: 10,
 				},
 			},
@@ -598,7 +713,7 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					// Group1 is the catch-all group, so it should count group2 agents
-					PresentCount:  20,
+					PresentCount:  18,
 					UpToDateCount: 10,
 					// InitialCount must not be changed during active -> active transitions
 					InitialCount: 25,
@@ -606,7 +721,7 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 			},
 		},
 		{
-			name: "single group unstarted -> active",
+			name: "single group unstarted -> active with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
 				{
 					Name:             group1Name,
@@ -630,8 +745,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					// InitialCount must be set during unstarted -> active transition
-					InitialCount:  20,
-					PresentCount:  20,
+					InitialCount:  18,
+					PresentCount:  18,
 					UpToDateCount: 10,
 				},
 			},
@@ -695,8 +810,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  24,
-					InitialCount:     10,
-					PresentCount:     10,
+					InitialCount:     8,
+					PresentCount:     8,
 					UpToDateCount:    5,
 				},
 				{
@@ -710,6 +825,273 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "single group unstarted -> canary, no canaries sampled",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+					LastUpdateTime:   timestamppb.New(yesterday),
+					LastUpdateReason: updateReasonCreated,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					PresentCount:     12,
+					UpToDateCount:    3,
+					CanaryCount:      5,
+				},
+			},
+			reports:       canaryTestReports,
+			canarySamples: []callAnswer[[]*autoupdate.Canary]{{}},
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+				},
+			},
+		},
+		{
+			name: "single group canary -> canary, sampling agents, agents not found",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+				},
+			},
+			reports:       canaryTestReports,
+			canarySamples: mockResponseForCanaries(testCanaries[:5]),
+			agentLookups:  testCanariesLookupNotFound,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonWaitingForCanaries,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      testCanaries[:5],
+				},
+			},
+		},
+		{
+			name: "single group canary -> canary, sampling agents, agents running old version",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+				},
+			},
+			reports:       canaryTestReports,
+			canarySamples: mockResponseForCanaries(testCanaries[:5]),
+			agentLookups:  testCanariesLookupStartVersion,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonWaitingForCanaries,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      testCanaries[:5],
+				},
+			},
+		},
+		{
+			name: "single group canary -> active, sampling agents, agents running target version",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+				},
+			},
+			reports:       canaryTestReports,
+			canarySamples: mockResponseForCanaries(testCanaries[:5]),
+			agentLookups:  testCanariesLookupTargetVersion,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanariesAlive,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      healthyTestCanaries[:5],
+				},
+			},
+		},
+		{
+			name: "single group canary -> active, already sampled agents, agents running target version",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      testCanaries[:5],
+				},
+			},
+			reports: canaryTestReports,
+			// no canarySamples set, we don't expect a sampling call
+			agentLookups: testCanariesLookupTargetVersion,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanariesAlive,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      healthyTestCanaries[:5],
+				},
+			},
+		},
+		{
+			name: "single group canary -> canary, incomplete sampled agents, agents running start version",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					// Only 2 canaries
+					Canaries: testCanaries[8:10],
+				},
+			},
+			reports:       canaryTestReports,
+			canarySamples: mockResponseForCanaries(testCanaries[:5]),
+			agentLookups:  testCanariesLookupStartVersion,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonWaitingForCanaries,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					// We expect the 2 initial agents to stay here, and 3 additional agents
+					Canaries: append(testCanaries[8:10], testCanaries[0:3]...),
+				},
+			},
+		},
+		{
+			name: "single group canary -> active, already sampled agents, agents running target version, several handles",
+			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanStart,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      testCanaries[:5],
+				},
+			},
+			reports: canaryTestReports,
+			// no canarySamples set, we don't expect a sampling call
+			agentLookups: testCanariesLookupTargetVersionDualHandles,
+			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+				{
+					Name:             group1Name,
+					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+					LastUpdateTime:   timestamppb.New(clock.Now()),
+					StartTime:        timestamppb.New(clock.Now()),
+					LastUpdateReason: updateReasonCanariesAlive,
+					ConfigDays:       canStartToday,
+					ConfigStartHour:  matchingStartHour,
+					// InitialCount must be set during unstarted -> active transition
+					InitialCount:  34,
+					PresentCount:  34,
+					UpToDateCount: 10,
+					CanaryCount:   5,
+					Canaries:      healthyTestCanaries[:5],
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -723,7 +1105,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 				TargetVersion: targetVersion,
 			}
 
-			stubs := mockClientStubs{}
+			stubs := mockClientStubs{
+				agentSamples:          tt.canarySamples,
+				inventoryAgentLookups: tt.agentLookups,
+			}
 			if tt.reports == nil {
 				stubs.reportsAnswers = []callAnswer[[]*autoupdate.AutoUpdateAgentReport]{
 					{
@@ -739,16 +1124,96 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					},
 				}
 			}
+
 			clt := newMockClient(t, stubs)
 			strategy, err := newHaltOnErrorStrategy(log, clt)
 			require.NoError(t, err)
 			err = strategy.progressRollout(ctx, spec, status, clock.Now())
 			require.NoError(t, err)
-			// We use require.Equal instead of Elements match because group order matters.
+			// Group order matters.
 			// It's not super important for time-based, but is crucial for halt-on-error.
 			// So it's better to be more conservative and validate order never changes for
 			// both strategies.
-			require.Equal(t, tt.expectedState, tt.initialState)
+			require.Empty(t, cmp.Diff(tt.expectedState, tt.initialState, protocmp.Transform()))
 		})
 	}
 }
+
+func TestCountCatchAll(t *testing.T) {
+	countByGroup := map[string]int{
+		"dev":   10,
+		"stage": 25,
+		"prod":  33,
+	}
+	upToDateByGroup := map[string]int{
+		"dev":   5,
+		"stage": 12,
+		"prod":  1,
+	}
+
+	tests := []struct {
+		name             string
+		rolloutStatus    *autoupdate.AutoUpdateAgentRolloutStatus
+		expectedCount    int
+		expectedUpToDate int
+	}{
+		{
+			name: "all group hit",
+			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+					{Name: "dev"},
+					{Name: "stage"},
+					{Name: "prod"},
+				},
+			},
+			expectedCount:    countByGroup["prod"],
+			expectedUpToDate: upToDateByGroup["prod"],
+		},
+		{
+			name: "one group miss",
+			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+					{Name: "dev"},
+					{Name: "prod"},
+				},
+			},
+			expectedCount:    countByGroup["stage"] + countByGroup["prod"],
+			expectedUpToDate: upToDateByGroup["stage"] + upToDateByGroup["prod"],
+		},
+		{
+			name: "only catch-all group hit",
+			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+					{Name: "prod"},
+				},
+			},
+			expectedCount:    countByGroup["dev"] + countByGroup["stage"] + countByGroup["prod"],
+			expectedUpToDate: upToDateByGroup["dev"] + upToDateByGroup["stage"] + upToDateByGroup["prod"],
+		},
+		{
+			name: "no common group",
+			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
+					{Name: "foobar"},
+				},
+			},
+			expectedCount:    countByGroup["dev"] + countByGroup["stage"] + countByGroup["prod"],
+			expectedUpToDate: upToDateByGroup["dev"] + upToDateByGroup["stage"] + upToDateByGroup["prod"],
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			count, upToDate := countCatchAll(tt.rolloutStatus, countByGroup, upToDateByGroup)
+			require.Equal(t, tt.expectedCount, count)
+			require.Equal(t, tt.expectedUpToDate, upToDate)
+		})
+	}
+}
+
+func mockResponseForCanaries(canaries []*autoupdate.Canary) []callAnswer[[]*autoupdate.Canary] {
+	return []callAnswer[[]*autoupdate.Canary]{
+		{
+			result: canaries,
+		},
+	}
+}
diff --git a/lib/autoupdate/rollout/strategy_timebased_test.go b/lib/autoupdate/rollout/strategy_timebased_test.go
index 938860af9b766..8370f975ac8d5 100644
--- a/lib/autoupdate/rollout/strategy_timebased_test.go
+++ b/lib/autoupdate/rollout/strategy_timebased_test.go
@@ -31,12 +31,12 @@ import (
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func Test_progressGroupsTimeBased(t *testing.T) {
 	clock := clockwork.NewFakeClockAt(testSunday)
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	groupName := "test-group"
 	canStartToday := everyWeekday
diff --git a/lib/autoupdate/rollout/transitions.go b/lib/autoupdate/rollout/transitions.go
index 9bbdbde19cb99..22a15ac37aabc 100644
--- a/lib/autoupdate/rollout/transitions.go
+++ b/lib/autoupdate/rollout/transitions.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/constants"
 	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	"github.com/gravitational/teleport/api/types/autoupdate"
 )
@@ -63,20 +64,10 @@ func TriggerGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout, reports []*au
 		return trace.Wrap(err)
 	}
 
-	switch desiredState {
-	case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED:
-		// When unspecified, we default to active
-		desiredState = autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE
-	case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:
-	default:
-		return trace.BadParameter("unsupported desired state: %s, supported states are 'unspecified' and 'active'", desiredState)
-	}
-
 	// filter out expired reports
 	validReports := make([]*autoupdatev1pb.AutoUpdateAgentReport, len(reports))
 	for _, report := range reports {
-		// TODO replace time.minute by the auth periodic operation constant
-		if now.Sub(report.GetSpec().GetTimestamp().AsTime()) <= time.Minute {
+		if now.Sub(report.GetSpec().GetTimestamp().AsTime()) <= constants.AutoUpdateAgentReportPeriod {
 			validReports = append(validReports, report)
 		}
 	}
@@ -87,6 +78,15 @@ func TriggerGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout, reports []*au
 	if len(groups) == 0 {
 		return trace.BadParameter("rollout has no groups")
 	}
+	var initialCount, upToDateCount int
+
+	switch desiredState {
+	case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
+		autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+		autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:
+	default:
+		return trace.BadParameter("unsupported desired state: %s, supported states are 'unspecified', 'canary' and 'active'", desiredState)
+	}
 
 	// Part where we do the real work, doing a state transition for every requested group.
 	for groupName := range groupsToTrigger {
@@ -95,10 +95,18 @@ func TriggerGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout, reports []*au
 			return trace.Wrap(err)
 		}
 
+		if groupName == groups[len(groups)-1].GetName() {
+			initialCount, upToDateCount = countCatchAll(rollout.GetStatus(), countByGroup, upToDateByGroup)
+		} else {
+			initialCount = countByGroup[groupName]
+			upToDateCount = upToDateByGroup[groupName]
+		}
+
 		// We check if the group state transition is legal.
 		switch group.GetState() {
 		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
 			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
 		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:
 			return trace.AlreadyExists("group %q is already active", groupName)
@@ -108,14 +116,22 @@ func TriggerGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout, reports []*au
 			return trace.BadParameter("group %q in unexpected state %s", groupName, group.GetState())
 		}
 
-		var initialCount, upToDateCount int
-		setGroupState(group, desiredState, updateReasonManualTrigger, now)
-		if groupName == groups[len(groups)-1].GetName() {
-			initialCount, upToDateCount = countCatchAll(rollout.GetStatus(), countByGroup, upToDateByGroup)
-		} else {
-			initialCount = countByGroup[groupName]
-			upToDateCount = upToDateByGroup[groupName]
+		switch desiredState {
+		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED:
+			if shouldUseCanaries(group) {
+				// We switch to the canary state but we don't sample canaries now.
+				// Canary sampling will happen during the next reconciliation.
+				desiredState = autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY
+			} else {
+				desiredState = autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE
+			}
+		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:
+		default:
+			return trace.BadParameter("unsupported desired state: %s, supported states are 'unspecified' and 'active'", desiredState)
 		}
+
+		setGroupState(group, desiredState, updateReasonManualTrigger, now)
 		group.UpToDateCount = uint64(upToDateCount)
 		group.InitialCount = uint64(initialCount)
 		group.PresentCount = uint64(initialCount)
@@ -158,7 +174,8 @@ func ForceGroupsDone(rollout *autoupdatev1pb.AutoUpdateAgentRollout, groupsToFor
 		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
 			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:
+			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY:
 		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
 			return trace.AlreadyExists("group %q is already done", groupName)
 		default:
@@ -179,6 +196,7 @@ func GetStartedGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout) GroupSet {
 	for _, group := range groups {
 		switch group.GetState() {
 		case autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 			autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
 			startedGroups[group.GetName()] = struct{}{}
 		}
diff --git a/lib/autoupdate/suffix.go b/lib/autoupdate/suffix.go
new file mode 100644
index 0000000000000..268b227119bcb
--- /dev/null
+++ b/lib/autoupdate/suffix.go
@@ -0,0 +1,22 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package autoupdate
+
+// InstallSuffixEnvVar specifies the Teleport install suffix.
+const InstallSuffixEnvVar = "TELEPORT_INSTALL_SUFFIX"
diff --git a/lib/autoupdate/tools/config.go b/lib/autoupdate/tools/config.go
new file mode 100644
index 0000000000000..ea55e82b3af24
--- /dev/null
+++ b/lib/autoupdate/tools/config.go
@@ -0,0 +1,252 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tools
+
+import (
+	"context"
+	"debug/buildinfo"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"maps"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	// configFileVersion identifies the version of the configuration file
+	// might be used for future migrations.
+	configFileVersion = "v1"
+	// lockFileName is file used for locking update process in parallel.
+	lockFileName = ".lock"
+	// configFileName is the configuration file used to store versions for known hosts
+	// and the installed versions of client tools.
+	configFileName  = ".config.json"
+	configFilePerms = 0o644
+	// defaultSizeStoredVersion defines how many versions will be stored in the tools
+	// directory. Older versions will be cleaned up based on least recently used.
+	defaultSizeStoredVersion = 3
+)
+
+// ClientToolsConfig is configuration structure for client tools managed updates.
+type ClientToolsConfig struct {
+	// Version determines version of configuration file (to support future extensions).
+	Version string `json:"version"`
+	// Configs stores information about profile and cluster version and mode:
+	// `{"profile-name":{"version": "1.2.3", "disabled":false}}`.
+	Configs map[string]*ClusterConfig `json:"configs"`
+	// Tools stores information about tools directories per versions:
+	// `[{"tool_name": "tsh", "path": "tool-path", "version": "tool-version"}]`.
+	Tools []Tool `json:"tools"`
+	// MaxTools defines the maximum number of tools allowed in the tools directory.
+	// Any tools exceeding this limit will be removed during the next installation.
+	MaxTools int `json:"max_tools"`
+}
+
+// AddTool adds a tool to the collection in the configuration, always placing it at the top.
+// The collection size is limited by the `defaultSizeStoredVersion` constant.
+func (ctc *ClientToolsConfig) AddTool(toolsDir string, tool Tool) {
+	for _, t := range ctc.Tools {
+		if t.IsEqual(toolsDir, tool.Version, tool.OS, tool.Arch) {
+			maps.Copy(t.PathMap, tool.PathMap)
+			return
+		}
+	}
+	if ctc.MaxTools <= 0 {
+		ctc.MaxTools = defaultSizeStoredVersion
+	}
+	if len(ctc.Tools) >= ctc.MaxTools {
+		ctc.Tools = append([]Tool{tool}, ctc.Tools[:ctc.MaxTools-1]...)
+	} else {
+		ctc.Tools = append([]Tool{tool}, ctc.Tools...)
+	}
+}
+
+// SetConfig sets the version and mode flag for a specific host.
+func (ctc *ClientToolsConfig) SetConfig(proxy string, version string, disabled bool) {
+	if config, ok := ctc.Configs[proxy]; ok {
+		config.Disabled = disabled
+		config.Version = version
+	} else {
+		ctc.Configs[proxy] = &ClusterConfig{Version: version, Disabled: disabled}
+	}
+}
+
+// SelectVersion lookups the version and re-order by last recently used.
+func (ctc *ClientToolsConfig) SelectVersion(toolsDir, version, os, arch string) *Tool {
+	for i, tool := range ctc.Tools {
+		if tool.IsEqual(toolsDir, version, os, arch) {
+			ctc.Tools = append([]Tool{tool}, append(ctc.Tools[:i], ctc.Tools[i+1:]...)...)
+			return &tool
+		}
+	}
+	return nil
+}
+
+// HasVersion check that specific version present in collection.
+func (ctc *ClientToolsConfig) HasVersion(toolsDir, version, os, arch string) bool {
+	return slices.ContainsFunc(ctc.Tools, func(tool Tool) bool {
+		return tool.IsEqual(toolsDir, version, os, arch)
+	})
+}
+
+// ClusterConfig stores required version and mode for specific cluster.
+type ClusterConfig struct {
+	Version  string `json:"version"`
+	Disabled bool   `json:"disabled"`
+}
+
+// Tool stores tools path per version, each tool might be stored in different path.
+type Tool struct {
+	// Version is the version of the tools (tsh, tctl) as defined in the PathMap.
+	Version string `json:"version"`
+	// OS is the operating system of the installed package.
+	OS string `json:"os"`
+	// Arch is architecture of the installed package.
+	Arch string `json:"arch"`
+	// PathMap stores the relative path (within the tools directory) for each tool binary.
+	// For example: {"tctl": "package-id/tctl"}.
+	PathMap map[string]string `json:"path"`
+}
+
+// PackageNames returns the package names extracted from the tool path map.
+func (t *Tool) PackageNames() []string {
+	var packageNames []string
+	for _, path := range t.PathMap {
+		dir := strings.SplitN(path, string(filepath.Separator), 2)
+		if len(dir) > 0 {
+			packageNames = append(packageNames, dir[0])
+		}
+	}
+	return packageNames
+}
+
+// IsEqual verifies that specific tool matches version, operating system and architecture.
+func (t *Tool) IsEqual(toolsDir, version, os, arch string) bool {
+	// If OS version is not defined in configuration we should check it by binary headers.
+	// TODO(vapopov): DELETE IN v21.0.0 - OS and Arch must be supported for all version.
+	if t.OS == "" {
+		path, ok := t.PathMap[DefaultClientTools()[0]]
+		if !ok {
+			return version == t.Version
+		}
+		info, err := buildinfo.ReadFile(filepath.Join(toolsDir, path))
+		if err != nil {
+			slog.WarnContext(context.Background(), "Failed to read build info.", "error", err)
+			return version == t.Version
+		}
+		var binOS, binArch string
+		for _, s := range info.Settings {
+			switch s.Key {
+			case "GOOS":
+				binOS = s.Value
+			case "GOARCH":
+				binArch = s.Value
+			}
+		}
+		if binOS == "" || binArch == "" {
+			return version == t.Version
+		}
+		// macOS binaries are always built with universal architecture support (arm64, amd64).
+		if runtime.GOOS == constants.DarwinOS {
+			return version == t.Version && os == binOS
+		}
+		return version == t.Version && os == binOS && arch == binArch
+	}
+
+	return version == t.Version && os == t.OS && arch == t.Arch
+}
+
+// GetToolsConfig reads the configuration file for client tools managed updates,
+// and acquires a filesystem lock until the configuration is read and deserialized.
+func GetToolsConfig(toolsDir string) (ctc *ClientToolsConfig, err error) {
+	unlock, err := utils.FSWriteLock(filepath.Join(toolsDir, lockFileName))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer func() {
+		err = trace.NewAggregate(err, unlock())
+	}()
+
+	ctc = &ClientToolsConfig{
+		Configs: make(map[string]*ClusterConfig),
+	}
+	data, err := os.ReadFile(filepath.Join(toolsDir, configFileName))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return nil, trace.Wrap(err)
+	}
+	if data != nil {
+		if err := json.Unmarshal(data, ctc); err != nil {
+			// If the configuration file content is corrupted, tools execution should not fail.
+			// Instead, we should proceed and re-install the required version.
+			slog.WarnContext(context.Background(), "failed to unmarshal config file", "error", err)
+		}
+	}
+
+	return ctc, nil
+}
+
+// UpdateToolsConfig creates or opens the configuration file for client tools managed updates,
+// and acquires a filesystem lock until the configuration is written and closed.
+func UpdateToolsConfig(toolsDir string, update func(ctc *ClientToolsConfig) error) (err error) {
+	unlock, err := utils.FSWriteLock(filepath.Join(toolsDir, lockFileName))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer func() {
+		err = trace.NewAggregate(err, unlock())
+	}()
+
+	ctc := &ClientToolsConfig{
+		Version: configFileVersion,
+		Configs: make(map[string]*ClusterConfig),
+	}
+	data, err := os.ReadFile(filepath.Join(toolsDir, configFileName))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return trace.Wrap(err)
+	}
+	if data != nil {
+		if err := json.Unmarshal(data, ctc); err != nil {
+			// If the configuration file content is corrupted, tools execution should not fail.
+			// Instead, we should proceed and re-install the required version.
+			slog.WarnContext(context.Background(), "failed to unmarshal config file", "error", err)
+		}
+	}
+
+	// Perform update values before configuration file is going to be written.
+	if err := update(ctc); err != nil {
+		return trace.Wrap(err)
+	}
+
+	jsonData, err := json.Marshal(ctc)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(
+		os.WriteFile(filepath.Join(toolsDir, configFileName), jsonData, configFilePerms),
+	)
+}
diff --git a/lib/autoupdate/tools/helper.go b/lib/autoupdate/tools/helper.go
index 499a7c5d377c5..3348927deb2d8 100644
--- a/lib/autoupdate/tools/helper.go
+++ b/lib/autoupdate/tools/helper.go
@@ -23,82 +23,170 @@ import (
 	"errors"
 	"log/slog"
 	"os"
+	"path/filepath"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/autoupdate"
 	stacksignal "github.com/gravitational/teleport/lib/utils/signal"
 )
 
 // Variables might to be overridden during compilation time for integration tests.
 var (
-	// version is the current version of the Teleport.
-	version = teleport.Version
-	// baseURL is CDN URL for downloading official Teleport packages.
-	baseURL = autoupdate.DefaultBaseURL
+	// Version is the current version of the Teleport.
+	// The variable is overloaded during integration tests to emulate different
+	// Teleport versions. See `integration/autoupdate/tools/updater/modules.go`.
+	Version = teleport.Version
 )
 
+// newUpdater inits the updater with default base URL and creates directory
+// if it doesn't exist.
+func newUpdater(toolsDir string) (*Updater, error) {
+	baseURL := autoupdate.DefaultBaseURL
+	// Overrides default base URL for custom CDN for downloading updates.
+	if envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar); envBaseURL != "" {
+		baseURL = envBaseURL
+	}
+
+	// Create tools directory if it does not exist.
+	if err := os.MkdirAll(toolsDir, 0o755); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return NewUpdater(toolsDir, Version, WithBaseURL(baseURL)), nil
+}
+
 // CheckAndUpdateLocal verifies if the TELEPORT_TOOLS_VERSION environment variable
-// is set and a version is defined (or disabled by setting it to "off"). The requested
-// version is compared with the current client tools version. If they differ, the version
-// package is downloaded, extracted to the client tools directory, and re-executed
-// with the updated version.
-// If $TELEPORT_HOME/bin contains downloaded client tools, it always re-executes
-// using the version from the home directory.
-func CheckAndUpdateLocal(ctx context.Context, reExecArgs []string) error {
+// is set and whether a version is defined (or explicitly disabled by setting it to "off").
+// The environment variable always takes precedence over other version settings.
+//
+// If `currentProfileName` is specified, the function attempts to find the tools version
+// required for the specified cluster in configuration file and re-execute it.
+//
+// The requested version is compared to the currently running client tools version.
+// If they differ, the requested version is downloaded and extracted into the client tools directory,
+// the installation is recorded in the configuration file, and the tool is re-executed with the updated version.
+func CheckAndUpdateLocal(ctx context.Context, currentProfileName string, reExecArgs []string) error {
+	// If client tools updates are explicitly disabled, we want to catch this as soon as possible
+	// so we don't try to read te user home directory, fail, and log warnings.
+	if os.Getenv(teleportToolsVersionEnv) == teleportToolsVersionEnvDisabled {
+		return nil
+	}
+
+	var err error
+	if currentProfileName == "" {
+		home := os.Getenv(types.HomeEnvVar)
+		if home != "" {
+			home = filepath.Clean(home)
+		}
+		profilePath := profile.FullProfilePath(home)
+		currentProfileName, err = profile.GetCurrentProfileName(profilePath)
+		if err != nil && !trace.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+	}
+
 	toolsDir, err := Dir()
 	if err != nil {
-		slog.WarnContext(ctx, "Client tools update is disabled", "error", err)
+		slog.WarnContext(ctx, "Failed to detect the teleport home directory, client tools updates are disabled", "error", err)
 		return nil
 	}
-
-	// Overrides default base URL for custom CDN for downloading updates.
-	if envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar); envBaseURL != "" {
-		baseURL = envBaseURL
+	updater, err := newUpdater(toolsDir)
+	if err != nil {
+		slog.WarnContext(ctx, "Failed to create the updater, client tools updates are disabled", "error", err)
+		return nil
 	}
 
-	updater := NewUpdater(toolsDir, version, WithBaseURL(baseURL))
-	// At process startup, check if a version has already been downloaded to
-	// $TELEPORT_HOME/bin or if the user has set the TELEPORT_TOOLS_VERSION
-	// environment variable. If so, re-exec that version of client tools.
-	toolsVersion, reExec, err := updater.CheckLocal()
+	slog.DebugContext(ctx, "Attempting to local update", "current_profile_name", currentProfileName)
+	resp, err := updater.CheckLocal(ctx, currentProfileName)
 	if err != nil {
-		return trace.Wrap(err)
+		slog.WarnContext(ctx, "Failed to check local teleport versions, client tools updates are disabled", "error", err)
+		return nil
 	}
-	if reExec {
-		return trace.Wrap(updateAndReExec(ctx, updater, toolsVersion, reExecArgs))
+
+	if resp.ReExec {
+		return trace.Wrap(updateAndReExec(ctx, updater, resp.Version, reExecArgs))
 	}
 
 	return nil
 }
 
-// CheckAndUpdateRemote verifies client tools version is set for update in cluster
-// configuration by making the http request to `webapi/find` endpoint. The requested
-// version is compared with the current client tools version. If they differ, the version
-// package is downloaded, extracted to the client tools directory, and re-executed
+// CheckAndUpdateRemote verifies the client tools version configured for updates in the cluster
+// by making an HTTP request to the `webapi/find` endpoint.
+//
+// If the TELEPORT_TOOLS_VERSION environment variable is set during the remote check,
+// the version specified in the environment variable takes precedence over the version
+// provided by the cluster. This version will also be recorded in the configuration for the cluster.
+//
+// The requested version is compared with the current client tools version.
+// If they differ, the requested version is downloaded, extracted into the client tools directory,
+// the installed version is recorded in the configuration, and the tool is re-executed
 // with the updated version.
-// If $TELEPORT_HOME/bin contains downloaded client tools, it always re-executes
-// using the version from the home directory.
-func CheckAndUpdateRemote(ctx context.Context, proxy string, insecure bool, reExecArgs []string) error {
+func CheckAndUpdateRemote(ctx context.Context, currentProfileName string, insecure bool, reExecArgs []string) error {
+	// If client tools updates are explicitly disabled, we want to catch this as soon as possible
+	// so we don't try to read te user home directory, fail, and log warnings.
+	// If we are re-executed, we ignore the "off" version because some previous Teleport versions
+	// are disabling execution too aggressively and this causes stuck updates.
+	// If "off" was set by the user, we would not be re-executed.
+	if os.Getenv(teleportToolsVersionEnv) == teleportToolsVersionEnvDisabled && os.Getenv(teleportToolsVersionReExecEnv) == "" {
+		return nil
+	}
+
 	toolsDir, err := Dir()
 	if err != nil {
-		slog.WarnContext(ctx, "Client tools update is disabled", "error", err)
+		slog.WarnContext(ctx, "Failed to detect the teleport home directory, client tools updates are disabled", "error", err)
+		return nil
+	}
+	updater, err := newUpdater(toolsDir)
+	if err != nil {
+		slog.WarnContext(ctx, "Failed to create the updater, client tools updates are disabled", "error", err)
 		return nil
 	}
 
-	// Overrides default base URL for custom CDN for downloading updates.
-	if envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar); envBaseURL != "" {
-		baseURL = envBaseURL
+	slog.DebugContext(ctx, "Attempting to remote update", "current_profile_name", currentProfileName, "insecure", insecure)
+	resp, err := updater.CheckRemote(ctx, currentProfileName, insecure)
+	if err != nil {
+		slog.WarnContext(ctx, "Failed to check remote teleport versions, client tools updates are disabled", "error", err)
+		return nil
 	}
 
-	updater := NewUpdater(toolsDir, version, WithBaseURL(baseURL))
-	toolsVersion, reExec, err := updater.CheckRemote(ctx, proxy, insecure)
+	if !resp.Disabled && resp.ReExec {
+		return trace.Wrap(updateAndReExec(ctx, updater, resp.Version, reExecArgs))
+	}
+
+	return nil
+}
+
+// DownloadUpdate checks if a client tools version is set for update in the cluster
+// configuration by making an HTTP request to the `webapi/find` endpoint.
+// Downloads the new version if it is not already installed without re-execution.
+func DownloadUpdate(ctx context.Context, name string, insecure bool) error {
+	toolsDir, err := Dir()
+	if err != nil {
+		slog.WarnContext(ctx, "Client tools update is disabled", "error", err)
+		return nil
+	}
+	updater, err := newUpdater(toolsDir)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if reExec {
-		return trace.Wrap(updateAndReExec(ctx, updater, toolsVersion, reExecArgs))
+
+	slog.DebugContext(ctx, "Attempting to remote update", "name", name, "insecure", insecure)
+	resp, err := updater.CheckRemote(ctx, name, insecure)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if !resp.Disabled && resp.ReExec {
+		ctxUpdate, cancel := stacksignal.GetSignalHandler().NotifyContext(ctx)
+		defer cancel()
+		err := updater.Update(ctxUpdate, resp.Version)
+		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, ErrNoBaseURL) {
+			return trace.Wrap(err)
+		}
 	}
 
 	return nil
@@ -110,15 +198,18 @@ func updateAndReExec(ctx context.Context, updater *Updater, toolsVersion string,
 	// Download the version of client tools required by the cluster. This
 	// is required if the user passed in the TELEPORT_TOOLS_VERSION
 	// explicitly.
-	err := updater.UpdateWithLock(ctxUpdate, toolsVersion)
-	if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, errNoBaseURL) {
-		return trace.Wrap(err)
+	err := updater.Update(ctxUpdate, toolsVersion)
+	if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, ErrNoBaseURL) {
+		slog.ErrorContext(ctx, "Failed to update tools version", "error", err, "version", toolsVersion)
+		// Continue executing the current version of the client tools (tsh, tctl)
+		// to avoid potential issues with update process (timeout, missing version).
+		return nil
 	}
 
 	// Re-execute client tools with the correct version of client tools.
-	code, err := updater.Exec(args)
+	code, err := updater.Exec(ctx, toolsVersion, args)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		slog.DebugContext(ctx, "Failed to re-exec client tool", "error", err)
+		slog.DebugContext(ctx, "Failed to re-exec client tool", "error", err, "code", code)
 		os.Exit(code)
 	} else if err == nil {
 		os.Exit(code)
diff --git a/lib/autoupdate/tools/migration.go b/lib/autoupdate/tools/migration.go
new file mode 100644
index 0000000000000..9cce05f75d152
--- /dev/null
+++ b/lib/autoupdate/tools/migration.go
@@ -0,0 +1,157 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tools
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	// migrationFilePerms defines the permissions for files created during the migration process.
+	migrationFilePerms = 0o755
+)
+
+// migrateV1AndUpdateConfig launches migration process and add migrated
+// tools to configuration file.
+func migrateV1AndUpdateConfig(toolsDir string, tools []string) error {
+	if err := UpdateToolsConfig(toolsDir, func(ctc *ClientToolsConfig) error {
+		migratedTools, err := migrateV1(toolsDir, tools)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if len(migratedTools) == 0 {
+			return nil
+		}
+
+		for _, tool := range migratedTools {
+			ctc.AddTool(toolsDir, tool)
+		}
+		return nil
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// migrateV1 verifies the tool binary located in the tool's directory.
+// If it is a symlink, it reads the target location and generates a tool object
+// to be saved in the configuration for backward compatibility.
+// If it is a regular binary, a new package folder should be created,
+// and the binary should be copied to the new location.
+// TODO(vapopov): DELETE in v21.0.0 - the version without caching will no longer be supported.
+func migrateV1(toolsDir string, tools []string) (map[string]Tool, error) {
+	newPkg := fmt.Sprint(uuid.New().String(), updatePackageSuffixV2)
+	migratedTools := make(map[string]Tool)
+	for _, tool := range tools {
+		path := filepath.Join(toolsDir, tool)
+		info, err := os.Lstat(path)
+		if os.IsNotExist(err) {
+			continue
+		}
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to retrieve information for tool %q", tool)
+		}
+
+		toolVersion, err := CheckToolVersion(path)
+		if trace.IsBadParameter(err) {
+			// If we can't identify toolVersion, it is blocked by EDR software or binary
+			// is damaged we should continue migration process.
+			slog.ErrorContext(context.Background(), "failed to check the toolVersion", "error", err)
+			continue
+		} else if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if info.Mode().Type()&os.ModeSymlink != 0 {
+			fullPath, err := os.Readlink(path)
+			if err != nil {
+				return nil, trace.Wrap(err, "failed to read symlink %q", path)
+			}
+			pkg, relPath, err := extractPackageName(toolsDir, fullPath)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if err := utils.RecursiveCopy(filepath.Join(toolsDir, pkg), filepath.Join(toolsDir, newPkg), nil); err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if t, ok := migratedTools[toolVersion]; ok {
+				t.PathMap[tool] = filepath.Join(newPkg, relPath)
+			} else {
+				migratedTools[toolVersion] = Tool{
+					Version: toolVersion,
+					OS:      runtime.GOOS,
+					Arch:    runtime.GOARCH,
+					PathMap: map[string]string{tool: filepath.Join(newPkg, relPath)},
+				}
+			}
+			continue
+		}
+
+		// Create new toolVersion of the package and move tools to new destination.
+		if t, ok := migratedTools[toolVersion]; ok {
+			newPath := filepath.Join(toolsDir, newPkg, tool)
+			if err := utils.CopyFile(path, newPath, migrationFilePerms); err != nil {
+				return nil, trace.Wrap(err)
+			}
+			t.PathMap[tool] = filepath.Join(newPkg, tool)
+		} else {
+			if err := os.Mkdir(filepath.Join(toolsDir, newPkg), migrationFilePerms); err != nil {
+				return nil, trace.Wrap(err)
+			}
+			newPath := filepath.Join(toolsDir, newPkg, tool)
+			if err := utils.CopyFile(path, newPath, migrationFilePerms); err != nil {
+				return nil, trace.Wrap(err)
+			}
+			migratedTools[toolVersion] = Tool{
+				Version: toolVersion,
+				OS:      runtime.GOOS,
+				Arch:    runtime.GOARCH,
+				PathMap: map[string]string{tool: filepath.Join(newPkg, tool)},
+			}
+		}
+
+	}
+
+	return migratedTools, nil
+}
+
+func extractPackageName(toolsDir string, fullPath string) (string, string, error) {
+	rel, err := filepath.Rel(toolsDir, fullPath)
+	if err != nil {
+		return "", "", trace.Wrap(err)
+	}
+	dir := strings.SplitN(rel, string(filepath.Separator), 2)
+	if len(dir) == 2 && strings.HasSuffix(dir[0], updatePackageSuffix) {
+		return dir[0], dir[1], nil
+	}
+
+	return "", fullPath, nil
+}
diff --git a/lib/autoupdate/tools/updater.go b/lib/autoupdate/tools/updater.go
index b236324c81d88..8dd271397c9b7 100644
--- a/lib/autoupdate/tools/updater.go
+++ b/lib/autoupdate/tools/updater.go
@@ -24,6 +24,7 @@ import (
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -50,16 +51,24 @@ import (
 const (
 	// teleportToolsVersionEnv is environment name for requesting specific version for update.
 	teleportToolsVersionEnv = "TELEPORT_TOOLS_VERSION"
+	// teleportToolsVersionEnvDisabled is a special value that disables teleport tools updates
+	// when assigned to the teleportToolsVersionEnv environment variable.
+	teleportToolsVersionEnvDisabled = "off"
 	// teleportToolsVersionReExecEnv is internal environment name for transferring original
 	// version to re-executed ones.
 	teleportToolsVersionReExecEnv = "TELEPORT_TOOLS_VERSION_REEXEC"
+	// teleportToolsDirsEnv overrides Teleport tools directory for saving updated
+	// versions.
+	teleportToolsDirsEnv = "TELEPORT_TOOLS_DIR"
+	// teleportToolsPathReExecEnv is env used for passing original execution path to re-executed version.
+	teleportToolsPathReExecEnv = "TELEPORT_TOOLS_PATH_REEXEC"
 	// reservedFreeDisk is the predefined amount of free disk space (in bytes) required
 	// to remain available after downloading archives.
 	reservedFreeDisk = 10 * 1024 * 1024 // 10 Mb
-	// lockFileName is file used for locking update process in parallel.
-	lockFileName = ".lock"
-	// updatePackageSuffix is directory suffix used for package extraction in tools directory.
+	// updatePackageSuffix is directory suffix used for package extraction in tools directory for v1.
 	updatePackageSuffix = "-update-pkg"
+	// updatePackageSuffix is directory suffix used for package extraction in tools directory for v2.
+	updatePackageSuffixV2 = "-update-pkg-v2"
 )
 
 var (
@@ -67,6 +76,13 @@ var (
 	pattern = regexp.MustCompile(`(?m)Teleport v(.*) git`)
 )
 
+// UpdateResponse contains information about after update process.
+type UpdateResponse struct {
+	Version  string `json:"version,omitempty"`
+	ReExec   bool   `json:"reExec,omitempty"`
+	Disabled bool   `json:"disabled,omitempty"`
+}
+
 // Option applies an option value for the Updater.
 type Option func(u *Updater)
 
@@ -133,37 +149,61 @@ func NewUpdater(toolsDir, localVersion string, options ...Option) *Updater {
 // CheckLocal is run at client tool startup and will only perform local checks.
 // Returns the version needs to be updated and re-executed, by re-execution flag we
 // understand that update and re-execute is required.
-func (u *Updater) CheckLocal() (version string, reExec bool, err error) {
+func (u *Updater) CheckLocal(ctx context.Context, profileName string) (resp *UpdateResponse, err error) {
 	// Check if the user has requested a specific version of client tools.
 	requestedVersion := os.Getenv(teleportToolsVersionEnv)
 	switch requestedVersion {
 	// The user has turned off any form of automatic updates.
-	case "off":
-		return "", false, nil
+	case teleportToolsVersionEnvDisabled:
+		return &UpdateResponse{Version: "", ReExec: false}, nil
 	// Requested version already the same as client version.
 	case u.localVersion:
-		return u.localVersion, false, nil
+		return &UpdateResponse{Version: u.localVersion, ReExec: false}, nil
 	// No requested version, we continue.
 	case "":
 	// Requested version that is not the local one.
 	default:
 		if _, err := semver.NewVersion(requestedVersion); err != nil {
-			return "", false, trace.Wrap(err, "checking that request version is semantic")
+			return nil, trace.Wrap(err, "checking that request version is semantic")
 		}
-		return requestedVersion, true, nil
+		return &UpdateResponse{Version: requestedVersion, ReExec: true}, nil
 	}
 
-	// If a version of client tools has already been downloaded to
-	// tools directory, return that.
-	toolsVersion, err := CheckToolVersion(u.toolsDir)
-	if trace.IsNotFound(err) || toolsVersion == u.localVersion {
-		return u.localVersion, false, nil
+	// We should acquire and release the lock before checking the version
+	// by executing the binary, as it might block tool execution until the version
+	// check is completed, which can take several seconds.
+	ctc, err := GetToolsConfig(u.toolsDir)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if config, ok := ctc.Configs[profileName]; ok {
+		if config.Disabled || config.Version == u.localVersion {
+			return &UpdateResponse{Version: config.Version, ReExec: false}, nil
+		} else {
+			return &UpdateResponse{Version: config.Version, ReExec: true}, nil
+		}
+	}
+
+	// Backward compatibility check. If a version of the client tools has already been downloaded
+	// to the tools directory, return it. Version check failures should be ignored, as EDR software
+	// might block execution or a broken version may already exist in the tools' directory.
+	toolsVersion, err := CheckExecutedToolVersion(u.toolsDir)
+	if trace.IsNotFound(err) || errors.Is(err, ErrVersionCheck) || toolsVersion == u.localVersion {
+		return &UpdateResponse{Version: u.localVersion, ReExec: false}, nil
 	}
 	if err != nil {
-		return "", false, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
-	return toolsVersion, true, nil
+	if !ctc.HasVersion(u.toolsDir, toolsVersion, runtime.GOOS, runtime.GOARCH) {
+		if err := migrateV1AndUpdateConfig(u.toolsDir, u.tools); err != nil {
+			// Execution should not be interrupted if migration fails. Instead, it's better to
+			// re-download the version that was supposed to be migrated but failed for some reason.
+			slog.WarnContext(ctx, "Failed to migrate client tools", "error", err)
+		}
+	}
+
+	return &UpdateResponse{Version: toolsVersion, ReExec: false}, nil
 }
 
 // CheckRemote first checks the version set by the environment variable. If not set or disabled,
@@ -171,29 +211,51 @@ func (u *Updater) CheckLocal() (version string, reExec bool, err error) {
 // the `webapi/find` handler, which stores information about the required client tools version to
 // operate with this cluster. It returns the semantic version that needs updating and whether
 // re-execution is necessary, by re-execution flag we understand that update and re-execute is required.
-func (u *Updater) CheckRemote(ctx context.Context, proxyAddr string, insecure bool) (version string, reExec bool, err error) {
+func (u *Updater) CheckRemote(ctx context.Context, proxyAddr string, insecure bool) (response *UpdateResponse, err error) {
+	proxyHost := utils.TryHost(proxyAddr)
 	// Check if the user has requested a specific version of client tools.
 	requestedVersion := os.Getenv(teleportToolsVersionEnv)
+	// If we are re-executed, we ignore the "off" version because some previous Teleport versions
+	// are disabling execution too aggressively and this causes stuck updates.
+	// If "off" was set by the user, we would not be re-executed.
+	if requestedVersion == teleportToolsVersionEnvDisabled && os.Getenv(teleportToolsVersionReExecEnv) != "" {
+		requestedVersion = ""
+	}
 	switch requestedVersion {
 	// The user has turned off any form of automatic updates.
-	case "off":
-		return "", false, nil
+	case teleportToolsVersionEnvDisabled:
+		return &UpdateResponse{Version: "", ReExec: false}, nil
 	// Requested version already the same as client version.
 	case u.localVersion:
-		return u.localVersion, false, nil
+		if err := UpdateToolsConfig(u.toolsDir, func(ctc *ClientToolsConfig) error {
+			ctc.SetConfig(proxyHost, requestedVersion, false)
+			return nil
+		}); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &UpdateResponse{Version: u.localVersion, ReExec: false}, nil
 	// No requested version, we continue.
 	case "":
 	// Requested version that is not the local one.
 	default:
 		if _, err := semver.NewVersion(requestedVersion); err != nil {
-			return "", false, trace.Wrap(err, "checking that request version is semantic")
+			return nil, trace.Wrap(err, "checking that request version is semantic")
+		}
+		// If the environment variable is set during a remote check,
+		// prioritize this version for the current host and use it as the default
+		// for all commands under the current profile.
+		if err := UpdateToolsConfig(u.toolsDir, func(ctc *ClientToolsConfig) error {
+			ctc.SetConfig(proxyHost, requestedVersion, false)
+			return nil
+		}); err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return requestedVersion, true, nil
+		return &UpdateResponse{Version: requestedVersion, ReExec: true}, nil
 	}
 
 	certPool, err := x509.SystemCertPool()
 	if err != nil {
-		return "", false, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	resp, err := webclient.Find(&webclient.Config{
 		Context:   ctx,
@@ -203,94 +265,77 @@ func (u *Updater) CheckRemote(ctx context.Context, proxyAddr string, insecure bo
 		Insecure:  insecure,
 	})
 	if err != nil {
-		return "", false, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
-	// If a version of client tools has already been downloaded to
-	// tools directory, return that.
-	toolsVersion, err := CheckToolVersion(u.toolsDir)
-	if err != nil && !trace.IsNotFound(err) {
-		return "", false, trace.Wrap(err)
-	}
+	updateResp := &UpdateResponse{Version: u.localVersion, ReExec: false}
 
 	switch {
 	case !resp.AutoUpdate.ToolsAutoUpdate || resp.AutoUpdate.ToolsVersion == "":
-		if toolsVersion == "" {
-			return u.localVersion, false, nil
-		}
+		updateResp = &UpdateResponse{Version: u.localVersion, ReExec: false, Disabled: true}
 	case u.localVersion == resp.AutoUpdate.ToolsVersion:
-		return u.localVersion, false, nil
-	case resp.AutoUpdate.ToolsVersion != toolsVersion:
-		return resp.AutoUpdate.ToolsVersion, true, nil
-	}
-
-	return toolsVersion, true, nil
-}
-
-// UpdateWithLock acquires filesystem lock, downloads requested version package,
-// unarchive and replace existing one.
-func (u *Updater) UpdateWithLock(ctx context.Context, updateToolsVersion string) (err error) {
-	// Create tools directory if it does not exist.
-	if err := os.MkdirAll(u.toolsDir, 0o755); err != nil {
-		return trace.Wrap(err)
-	}
-	// Lock concurrent client tools execution util requested version is updated.
-	unlock, err := utils.FSWriteLock(filepath.Join(u.toolsDir, lockFileName))
-	if err != nil {
-		return trace.Wrap(err)
+		updateResp = &UpdateResponse{Version: u.localVersion, ReExec: false}
+	default:
+		updateResp = &UpdateResponse{Version: resp.AutoUpdate.ToolsVersion, ReExec: true}
 	}
-	defer func() {
-		err = trace.NewAggregate(err, unlock())
-	}()
 
-	// If the version of the running binary or the version downloaded to
-	// tools directory is the same as the requested version of client tools,
-	// nothing to be done, exit early.
-	toolsVersion, err := CheckToolVersion(u.toolsDir)
-	if err != nil && !trace.IsNotFound(err) {
-		return trace.Wrap(err)
-	}
-	if updateToolsVersion == toolsVersion {
+	if err := UpdateToolsConfig(u.toolsDir, func(ctc *ClientToolsConfig) error {
+		ctc.SetConfig(proxyHost, updateResp.Version, updateResp.Disabled)
 		return nil
+	}); err != nil {
+		return nil, trace.Wrap(err)
 	}
 
-	// Download and update client tools in tools directory.
-	if err := u.Update(ctx, updateToolsVersion); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
+	return updateResp, nil
 }
 
-// Update downloads requested version and replace it with existing one and cleanups the previous downloads
-// with defined updater directory suffix.
+// Update acquires filesystem lock, downloads requested version package, unarchive, replace
+// existing one and cleanups the previous downloads with defined updater directory suffix.
 func (u *Updater) Update(ctx context.Context, toolsVersion string) error {
-	// Get platform specific download URLs.
-	packages, err := teleportPackageURLs(ctx, u.uriTemplate, u.baseURL, toolsVersion)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	err := UpdateToolsConfig(u.toolsDir, func(ctc *ClientToolsConfig) error {
+		// ignoreTools is the list of tools installed and tracked by the config.
+		// They should be preserved during cleanup. If we have more than [defaultSizeStoredVersion]
+		// versions, the updater will forget about the least used version.
+		var ignoreTools []string
+		for _, tool := range ctc.Tools {
+			// If the version of the running binary or the version downloaded to
+			// tools directory is the same as the requested version of client tools,
+			// nothing to be done, exit early.
+			if tool.IsEqual(u.toolsDir, toolsVersion, runtime.GOOS, runtime.GOARCH) {
+				return nil
+			}
+			ignoreTools = append(ignoreTools, tool.PackageNames()...)
+		}
 
-	var pkgNames []string
-	for _, pkg := range packages {
-		pkgName := fmt.Sprint(uuid.New().String(), updatePackageSuffix)
-		if err := u.update(ctx, pkg, pkgName); err != nil {
+		// Get platform specific download URLs.
+		packages, err := teleportPackageURLs(ctx, u.uriTemplate, u.baseURL, toolsVersion)
+		if err != nil {
 			return trace.Wrap(err)
 		}
-		pkgNames = append(pkgNames, pkgName)
-	}
 
-	// Cleanup the tools directory with previously downloaded and un-archived versions.
-	if err := packaging.RemoveWithSuffix(u.toolsDir, updatePackageSuffix, pkgNames); err != nil {
-		slog.WarnContext(ctx, "failed to clean up tools directory", "error", err)
-	}
+		var pkgNames []string
+		for _, pkg := range packages {
+			pkgName := fmt.Sprint(uuid.New().String(), updatePackageSuffixV2)
+			if err := u.update(ctx, ctc, pkg, pkgName); err != nil {
+				return trace.Wrap(err)
+			}
+			pkgNames = append(pkgNames, pkgName)
+		}
+		// Cleanup all tools in directory with the specific prefix by ignoring tools
+		// that are currently recorded in the configuration.
+		if err := packaging.RemoveWithSuffix(u.toolsDir, updatePackageSuffixV2, append(ignoreTools, pkgNames...)); err != nil {
+			slog.WarnContext(ctx, "failed to clean up tools directory", "error", err)
+		}
 
-	return nil
+		return nil
+	})
+
+	return trace.Wrap(err)
 }
 
 // update downloads the archive and validate against the hash. Download to a
 // temporary path within tools directory.
-func (u *Updater) update(ctx context.Context, pkg packageURL, pkgName string) error {
+func (u *Updater) update(ctx context.Context, ctc *ClientToolsConfig, pkg packageURL, pkgName string) error {
 	f, err := os.CreateTemp("", "teleport-")
 	if err != nil {
 		return trace.Wrap(err)
@@ -330,38 +375,76 @@ func (u *Updater) update(ctx context.Context, pkg packageURL, pkgName string) er
 	}
 
 	// Perform atomic replace so concurrent exec do not fail.
-	if err := packaging.ReplaceToolsBinaries(u.toolsDir, f.Name(), extractDir, u.tools); err != nil {
+	toolsMap, err := packaging.ReplaceToolsBinaries(f.Name(), extractDir, u.tools)
+	if err != nil {
 		return trace.Wrap(err)
 	}
 
+	for key, val := range toolsMap {
+		toolsMap[key] = filepath.Join(pkgName, val)
+	}
+	ctc.AddTool(u.toolsDir, Tool{Version: pkg.Version, OS: runtime.GOOS, Arch: runtime.GOARCH, PathMap: toolsMap})
+
 	return nil
 }
 
-// Exec re-executes tool command with same arguments and environ variables.
-func (u *Updater) Exec(args []string) (int, error) {
-	path, err := toolName(u.toolsDir)
-	if err != nil {
-		return 0, trace.Wrap(err)
+// ToolPath loads full path from config file to specific tool and version.
+func (u *Updater) ToolPath(toolName, toolVersion string) (path string, err error) {
+	var tool *Tool
+	if err := UpdateToolsConfig(u.toolsDir, func(ctc *ClientToolsConfig) error {
+		tool = ctc.SelectVersion(u.toolsDir, toolVersion, runtime.GOOS, runtime.GOARCH)
+		return nil
+	}); err != nil {
+		return "", trace.Wrap(err)
 	}
-	// To prevent re-execution loop we have to disable update logic for re-execution,
-	// by unsetting current tools version env variable and setting it to "off".
-	if err := os.Unsetenv(teleportToolsVersionEnv); err != nil {
-		return 0, trace.Wrap(err)
+	if tool == nil {
+		return "", trace.NotFound("tool version %q not found", toolVersion)
 	}
-	if err := os.Unsetenv(teleportToolsVersionReExecEnv); err != nil {
-		return 0, trace.Wrap(err)
+	relPath, ok := tool.PathMap[toolName]
+	if !ok {
+		return "", trace.NotFound("tool %q not found", toolName)
 	}
 
-	env := os.Environ()
+	return filepath.Join(u.toolsDir, relPath), nil
+}
+
+// Exec re-executes tool command with same arguments and environ variables.
+func (u *Updater) Exec(ctx context.Context, toolsVersion string, args []string) (int, error) {
 	executablePath, err := os.Executable()
 	if err != nil {
 		return 0, trace.Wrap(err)
 	}
-	if path == executablePath {
-		env = append(env, teleportToolsVersionEnv+"=off")
+	path, err := u.ToolPath(filepath.Base(executablePath), toolsVersion)
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	env := filterEnvs(os.Environ(), []string{
+		teleportToolsVersionReExecEnv,
+		teleportToolsDirsEnv,
+		teleportToolsPathReExecEnv,
+	})
+	env = append(env, teleportToolsVersionReExecEnv+"="+u.localVersion)
+	env = append(env, teleportToolsDirsEnv+"="+u.toolsDir)
+	// If tsh or tctl has already been re-executed with the original path,
+	// we need to pass that path to the next re-execution.
+	if reExecPath := GetReExecPath(); reExecPath != "" {
+		env = append(env, teleportToolsPathReExecEnv+"="+reExecPath)
+	} else {
+		env = append(env, teleportToolsPathReExecEnv+"="+executablePath)
+	}
+	// To prevent re-execution loop we have to disable update logic for re-execution,
+	// by unsetting current tools version env variable and setting it to "off"
+	// if same version is requested to be re-executed.
+	// We should also prevent further re-execution if the current version is run from
+	// the deprecated `~/.tsh/bin/tsh` path; otherwise, a downgrade could result in a loop.
+	if path == executablePath || executablePath == filepath.Join(u.toolsDir, filepath.Base(executablePath)) {
+		env = filterEnvs(env, []string{teleportToolsVersionEnv})
+		env = append(env, teleportToolsVersionEnv+"="+teleportToolsVersionEnvDisabled)
+		slog.DebugContext(ctx, "Disable re-execution")
 	}
-	env = append(env, fmt.Sprintf("%s=%s", teleportToolsVersionReExecEnv, u.localVersion))
 
+	slog.DebugContext(ctx, "Re-execute updated version", "execute", path, "from", executablePath)
 	if runtime.GOOS == constants.WindowsOS {
 		cmd := exec.Command(path, args...)
 		cmd.Env = env
diff --git a/lib/autoupdate/tools/utils.go b/lib/autoupdate/tools/utils.go
index e158ef534169a..9f596188d3e41 100644
--- a/lib/autoupdate/tools/utils.go
+++ b/lib/autoupdate/tools/utils.go
@@ -28,6 +28,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -36,25 +37,45 @@ import (
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
 	"github.com/gravitational/teleport/lib/autoupdate"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/packaging"
 )
 
-var errNoBaseURL = errors.New("baseURL is not defined")
+var (
+	// ErrNoBaseURL is returned when `TELEPORT_CDN_BASE_URL` must be set
+	// in order to proceed with managed updates.
+	ErrNoBaseURL = errors.New("baseURL is not defined")
+	// ErrVersionCheck is returned when the downloaded version fails
+	// to execute for version identification.
+	ErrVersionCheck = errors.New("version check failed")
+)
 
-// Dir returns the path to client tools in $TELEPORT_HOME/bin.
+// Dir returns the client tools installation directory path, using the following fallback order:
+// $TELEPORT_TOOLS_DIR, $TELEPORT_HOME/bin, and $HOME/.tsh/bin.
 func Dir() (string, error) {
-	home := os.Getenv(types.HomeEnvVar)
-	if home == "" {
-		var err error
-		home, err = os.UserHomeDir()
-		if err != nil {
-			return "", trace.Wrap(err)
+	toolsDir := os.Getenv(teleportToolsDirsEnv)
+	if toolsDir == "" {
+		toolsDir = os.Getenv(types.HomeEnvVar)
+		if toolsDir == "" {
+			var err error
+			toolsDir, err = os.UserHomeDir()
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			toolsDir = filepath.Join(toolsDir, ".tsh", "bin")
+		} else {
+			toolsDir = filepath.Join(toolsDir, "bin")
 		}
 	}
 
-	return filepath.Join(home, ".tsh", "bin"), nil
+	toolsDir, err := filepath.Abs(toolsDir)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return toolsDir, nil
 }
 
 // DefaultClientTools list of the client tools needs to be updated by default.
@@ -67,16 +88,20 @@ func DefaultClientTools() []string {
 	}
 }
 
-// CheckToolVersion returns current installed client tools version, must return NotFoundError if
-// the client tools is not found in tools directory.
-func CheckToolVersion(toolsDir string) (string, error) {
-	// Find the path to the current executable.
+// CheckExecutedToolVersion invokes the exact executable from the tools directory to retrieve its version.
+func CheckExecutedToolVersion(toolsDir string) (string, error) {
 	path, err := toolName(toolsDir)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	if _, err := os.Stat(path); errors.Is(err, os.ErrNotExist) {
-		return "", trace.NotFound("autoupdate tool not found in %q", toolsDir)
+	return CheckToolVersion(path)
+}
+
+// CheckToolVersion returns client tools version, must return NotFoundError if
+// the client tools is not found in specified path.
+func CheckToolVersion(toolPath string) (string, error) {
+	if _, err := os.Stat(toolPath); errors.Is(err, os.ErrNotExist) {
+		return "", trace.NotFound("autoupdate tool not found in %q", toolPath)
 	} else if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -89,11 +114,13 @@ func CheckToolVersion(toolsDir string) (string, error) {
 
 	// Execute "{tsh, tctl} version" and pass in TELEPORT_TOOLS_VERSION=off to
 	// turn off all automatic updates code paths to prevent any recursion.
-	command := exec.CommandContext(ctx, path, "version")
-	command.Env = []string{teleportToolsVersionEnv + "=off"}
+	command := exec.CommandContext(ctx, toolPath, "version")
+	command.Env = []string{teleportToolsVersionEnv + "=" + teleportToolsVersionEnvDisabled}
 	output, err := command.Output()
 	if err != nil {
-		return "", trace.WrapWithMessage(err, "failed to determine version of %q tool", path)
+		slog.DebugContext(context.Background(), "failed to determine version",
+			"tool", toolPath, "error", err, "output", string(output))
+		return "", ErrVersionCheck
 	}
 
 	// The output for "{tsh, tctl} version" can be multiple lines. Find the
@@ -133,22 +160,58 @@ func GetReExecFromVersion(ctx context.Context) string {
 	return reExecFromVersion
 }
 
+// GetReExecPath returns the execution path if current execution binary is re-executed from
+// another version.
+func GetReExecPath() string {
+	return os.Getenv(teleportToolsPathReExecEnv)
+}
+
+// CleanUp cleans the tools directory with downloaded versions.
+func CleanUp(toolsDir string, tools []string) error {
+	var aggErr []error
+	for _, tool := range tools {
+		if err := os.Remove(filepath.Join(toolsDir, tool)); err != nil && !os.IsNotExist(err) {
+			aggErr = append(aggErr, err)
+		}
+	}
+	if err := os.Remove(filepath.Join(toolsDir, lockFileName)); err != nil && !os.IsNotExist(err) {
+		aggErr = append(aggErr, err)
+	}
+	if err := os.Remove(filepath.Join(toolsDir, configFileName)); err != nil && !os.IsNotExist(err) {
+		aggErr = append(aggErr, err)
+	}
+	if err := packaging.RemoveWithSuffix(toolsDir, updatePackageSuffix, nil); err != nil {
+		aggErr = append(aggErr, err)
+	}
+	if err := packaging.RemoveWithSuffix(toolsDir, updatePackageSuffixV2, nil); err != nil {
+		aggErr = append(aggErr, err)
+	}
+
+	return trace.NewAggregate(aggErr...)
+}
+
 // packageURL defines URLs to the archive and their archive sha256 hash file, and marks
 // if this package is optional, for such case download needs to be ignored if package
 // not found in CDN.
 type packageURL struct {
+	Version  string
 	Archive  string
 	Hash     string
 	Optional bool
 }
 
 // teleportPackageURLs returns URLs for the Teleport archives to download.
-func teleportPackageURLs(ctx context.Context, uriTmpl string, baseURL, version string) ([]packageURL, error) {
+func teleportPackageURLs(ctx context.Context, uriTmpl string, baseURL, requestedVersion string) ([]packageURL, error) {
+	semVersion, err := version.EnsureSemver(requestedVersion)
+	if err != nil {
+		return nil, trace.BadParameter("version %q is not following semver", requestedVersion)
+	}
+
 	m := modules.GetModules()
 	envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar)
 	if m.BuildType() == modules.BuildOSS && envBaseURL == "" {
 		slog.WarnContext(ctx, "Client tools updates are disabled as they are licensed under AGPL. To use Community Edition builds or custom binaries, set the 'TELEPORT_CDN_BASE_URL' environment variable.")
-		return nil, errNoBaseURL
+		return nil, ErrNoBaseURL
 	}
 
 	var flags autoupdate.InstallFlags
@@ -159,24 +222,35 @@ func teleportPackageURLs(ctx context.Context, uriTmpl string, baseURL, version s
 		flags |= autoupdate.FlagEnterprise
 	}
 
-	teleportURL, err := autoupdate.MakeURL(uriTmpl, baseURL, autoupdate.DefaultPackage, version, flags)
+	// TODO(vapopov): DELETE in v22.0.0 version check - the separate `teleport-tools` package
+	// will be included in all supported versions.
+	pkg := autoupdate.DefaultPackage
+	if runtime.GOOS == constants.DarwinOS &&
+		(semVersion.Major > 18 ||
+			semVersion.Major == 18 && semVersion.Compare(semver.Version{Major: 18, Minor: 1, Patch: 5}) >= 0 ||
+			semVersion.Major == 17 && semVersion.Compare(semver.Version{Major: 17, Minor: 7, Patch: 2}) >= 0) {
+		pkg = autoupdate.DefaultToolsPackage
+	}
+
+	teleportURL, err := autoupdate.MakeURL(uriTmpl, baseURL, pkg, requestedVersion, flags)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if runtime.GOOS == constants.DarwinOS {
-		tshURL, err := autoupdate.MakeURL(uriTmpl, baseURL, "tsh", version, flags)
+	// TODO(vapopov): DELETE in v20.0.0 - the separate `tsh` package will no longer be supported.
+	if runtime.GOOS == constants.DarwinOS && semVersion.Major < 17 {
+		tshURL, err := autoupdate.MakeURL(uriTmpl, baseURL, "tsh", requestedVersion, flags)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
 		return []packageURL{
-			{Archive: teleportURL, Hash: teleportURL + ".sha256"},
-			{Archive: tshURL, Hash: tshURL + ".sha256", Optional: true},
+			{Version: requestedVersion, Archive: teleportURL, Hash: teleportURL + ".sha256"},
+			{Version: requestedVersion, Archive: tshURL, Hash: tshURL + ".sha256", Optional: true},
 		}, nil
 	}
 
 	return []packageURL{
-		{Archive: teleportURL, Hash: teleportURL + ".sha256"},
+		{Version: requestedVersion, Archive: teleportURL, Hash: teleportURL + ".sha256"},
 	}, nil
 }
 
@@ -204,3 +278,11 @@ func checkFreeSpace(path string, requested uint64) error {
 
 	return nil
 }
+
+// filterEnvs excludes environment variables by the list of the keys.
+func filterEnvs(envs []string, excludeKeys []string) []string {
+	return slices.DeleteFunc(envs, func(e string) bool {
+		parts := strings.SplitN(e, "=", 2)
+		return slices.Contains(excludeKeys, parts[0])
+	})
+}
diff --git a/lib/autoupdate/tools/utils_test.go b/lib/autoupdate/tools/utils_test.go
new file mode 100644
index 0000000000000..3a95ceb0d580b
--- /dev/null
+++ b/lib/autoupdate/tools/utils_test.go
@@ -0,0 +1,151 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tools
+
+import (
+	"context"
+	"fmt"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/lib/autoupdate"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+)
+
+func TestTeleportPackageURLs(t *testing.T) {
+	currentModules := modules.GetModules()
+	t.Cleanup(func() { modules.SetModules(currentModules) })
+	modules.SetModules(&modulestest.Modules{TestBuildType: modules.BuildCommunity})
+
+	ctx := context.Background()
+
+	type expected struct {
+		archivePrefix string
+		optional      bool
+	}
+
+	for _, tt := range []struct {
+		name     string
+		version  string
+		expected func() []expected
+	}{
+		{
+			name:    "v17",
+			version: "17.0.0",
+			expected: func() []expected {
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+		{
+			name:    "v17-latest",
+			version: "17.7.2",
+			expected: func() []expected {
+				if runtime.GOOS == constants.DarwinOS {
+					return []expected{{archivePrefix: "/teleport-tools-", optional: false}}
+				}
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+		{
+			name:    "v18",
+			version: "18.0.0",
+			expected: func() []expected {
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+		{
+			name:    "v18-latest",
+			version: "18.1.5",
+			expected: func() []expected {
+				if runtime.GOOS == constants.DarwinOS {
+					return []expected{{archivePrefix: "/teleport-tools-", optional: false}}
+				}
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+		{
+			name:    "v19",
+			version: "19.0.0",
+			expected: func() []expected {
+				if runtime.GOOS == constants.DarwinOS {
+					return []expected{{archivePrefix: "/teleport-tools-", optional: false}}
+				}
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+		{
+			name:    "v16",
+			version: "16.0.0",
+			expected: func() []expected {
+				if runtime.GOOS == constants.DarwinOS {
+					return []expected{
+						{archivePrefix: "/teleport-", optional: false},
+						{archivePrefix: "/tsh-", optional: true},
+					}
+				}
+				return []expected{{archivePrefix: "/teleport-", optional: false}}
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			pkgURLs, err := teleportPackageURLs(ctx, autoupdate.DefaultCDNURITemplate, "", tt.version)
+			require.NoError(t, err)
+
+			exp := tt.expected()
+			require.Len(t, pkgURLs, len(exp))
+			for i := range pkgURLs {
+				assert.True(t, strings.HasPrefix(pkgURLs[i].Archive, exp[i].archivePrefix))
+				assert.Equal(t, exp[i].optional, pkgURLs[i].Optional)
+				assert.Equal(t, tt.version, pkgURLs[i].Version)
+			}
+		})
+	}
+}
+
+// TestFilterEnv verifies excluding environment variables by the list of the keys.
+func TestFilterEnv(t *testing.T) {
+	env := "TEST_ENV_WITHOUT_FILTER"
+	env1 := "TEST_ENV_WITHOUT_FILTER1"
+	env2 := "TEST_ENV_WITHOUT_FILTER2"
+	env3 := "TEST_ENV_WITHOUT_FILTER3"
+
+	source := []string{
+		env3,
+		env,
+		fmt.Sprint(env1, "=", "test"),
+		fmt.Sprint(teleportToolsVersionEnv, "=", teleportToolsVersionEnvDisabled),
+		fmt.Sprint(env2, "=", "test"),
+		env3,
+		env,
+		env3,
+	}
+
+	assert.Equal(t, []string{
+		env,
+		fmt.Sprint(env1, "=", "test"),
+		fmt.Sprint(env2, "=", "test"),
+		env,
+	}, filterEnvs(source, []string{teleportToolsVersionEnv, env3}))
+}
diff --git a/lib/aws/awsconfigfile/awsconfigfile.go b/lib/aws/awsconfigfile/awsconfigfile.go
index e1114be612ff2..1ee5637641bfe 100644
--- a/lib/aws/awsconfigfile/awsconfigfile.go
+++ b/lib/aws/awsconfigfile/awsconfigfile.go
@@ -17,7 +17,6 @@
 package awsconfigfile
 
 import (
-	"cmp"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,6 +25,10 @@ import (
 	ini "gopkg.in/ini.v1"
 )
 
+const (
+	ownershipComment = "Do not edit. Section managed by Teleport."
+)
+
 // AWSConfigFilePath returns the path to the AWS configuration file.
 func AWSConfigFilePath() (string, error) {
 	// See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
@@ -43,19 +46,19 @@ func AWSConfigFilePath() (string, error) {
 
 // SetDefaultProfileCredentialProcess sets the credential_process for the default profile.
 // File is created if it does not exist.
-func SetDefaultProfileCredentialProcess(configFilePath, sectionComment, credentialProcess string) error {
+func SetDefaultProfileCredentialProcess(configFilePath, credentialProcess string) error {
 	const sectionName = "default"
-	return trace.Wrap(addCredentialProcessToSection(configFilePath, sectionName, sectionComment, credentialProcess))
+	return trace.Wrap(addCredentialProcessToSection(configFilePath, sectionName, credentialProcess))
 }
 
 // UpsertProfileCredentialProcess sets the credential_process for the profile with name profileName.
 // File is created if it does not exist.
-func UpsertProfileCredentialProcess(configFilePath, profileName, sectionComment, credentialProcess string) error {
+func UpsertProfileCredentialProcess(configFilePath, profileName, credentialProcess string) error {
 	sectionName := "profile " + profileName
-	return trace.Wrap(addCredentialProcessToSection(configFilePath, sectionName, sectionComment, credentialProcess))
+	return trace.Wrap(addCredentialProcessToSection(configFilePath, sectionName, credentialProcess))
 }
 
-func addCredentialProcessToSection(configFilePath, sectionName, sectionComment, credentialProcessCommand string) error {
+func addCredentialProcessToSection(configFilePath, sectionName, credentialProcessCommand string) error {
 	iniFile, err := ini.LoadSources(ini.LoadOptions{
 		AllowNestedValues: true, // Allow AWS-like nested values. Docs: http://docs.aws.amazon.com/cli/latest/topic/config-vars.html#nested-values
 		Loose:             true, // Allow non-existing files. ini.SaveTo will create the file if it does not exist.
@@ -64,16 +67,24 @@ func addCredentialProcessToSection(configFilePath, sectionName, sectionComment,
 		return trace.Wrap(err)
 	}
 
-	if !iniFile.HasSection(sectionName) {
-		iniFile.NewSection(sectionName)
-	}
+	var section *ini.Section
+
+	switch {
+	case iniFile.HasSection(sectionName):
+		section = iniFile.Section(sectionName)
 
-	section := iniFile.Section(sectionName)
-	if cmp.Or(section.Comment, sectionComment) != sectionComment {
-		return trace.BadParameter("%s: section %q is not managed by teleport, remove the section and try again", configFilePath, sectionName)
+		if !strings.Contains(section.Comment, ownershipComment) {
+			return trace.BadParameter("%s: section %q is not managed by Teleport, remove the section and try again", configFilePath, sectionName)
+		}
+
+	default:
+		section, err = iniFile.NewSection(sectionName)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
-	section.Comment = sectionComment
+	section.Comment = ownershipComment
 	_, err = section.NewKey("credential_process", credentialProcessCommand)
 	if err != nil {
 		return trace.Wrap(err)
@@ -91,8 +102,10 @@ func addCredentialProcessToSection(configFilePath, sectionName, sectionComment,
 	return trace.Wrap(iniFile.SaveTo(configFilePath))
 }
 
-// RemoveCredentialProcessByComment removes the credential_process key on sections that have a specific section comment.
-func RemoveCredentialProcessByComment(configFilePath, sectionComment string) error {
+// RemoveTeleportManagedProfile removes the credential_process key on sections that have a specific section comment.
+func RemoveTeleportManagedProfile(configFilePath, profile string) error {
+	sectionName := "profile " + profile
+
 	iniFile, err := ini.LoadSources(ini.LoadOptions{
 		AllowNestedValues: true,  // Allow AWS-like nested values. Docs: http://docs.aws.amazon.com/cli/latest/topic/config-vars.html#nested-values
 		Loose:             false, // If file does not exist, then there's nothing to be removed.
@@ -106,27 +119,48 @@ func RemoveCredentialProcessByComment(configFilePath, sectionComment string) err
 		return trace.Wrap(err)
 	}
 
-	if !strings.HasPrefix(sectionComment, "; ") {
-		sectionComment = "; " + sectionComment
-	}
+	configFileChanged := false
+	if iniFile.HasSection(sectionName) {
+		section := iniFile.Section(sectionName)
 
-	sectionChanged := false
-	for _, section := range iniFile.Sections() {
-		if section.Comment != sectionComment {
-			continue
+		if !strings.Contains(section.Comment, ownershipComment) {
+			return trace.BadParameter("%s: section %q is not managed by Teleport, remove the section manually and try again", configFilePath, sectionName)
 		}
 
-		if !section.HasKey("credential_process") {
-			continue
+		if strings.Contains(section.Comment, ownershipComment) {
+			iniFile.DeleteSection(section.Name())
+			configFileChanged = true
 		}
+	}
+	// No need to save the file if no sections were changed.
+	if !configFileChanged {
+		return nil
+	}
+
+	return trace.Wrap(iniFile.SaveTo(configFilePath))
+}
 
-		section.DeleteKey("credential_process")
-		if len(section.Keys()) > 0 {
-			return trace.BadParameter("%s: section %q contains other keys, remove the section and try again", configFilePath, section.Name())
+// RemoveAllTeleportManagedProfiles removes all the profiles managed by Teleport.
+func RemoveAllTeleportManagedProfiles(configFilePath string) error {
+	iniFile, err := ini.LoadSources(ini.LoadOptions{
+		AllowNestedValues: true,  // Allow AWS-like nested values. Docs: http://docs.aws.amazon.com/cli/latest/topic/config-vars.html#nested-values
+		Loose:             false, // If file does not exist, then there's nothing to be removed.
+	}, configFilePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Ignore non-existing file.
+			return nil
 		}
-		iniFile.DeleteSection(section.Name())
 
-		sectionChanged = true
+		return trace.Wrap(err)
+	}
+
+	sectionChanged := false
+	for _, section := range iniFile.Sections() {
+		if strings.Contains(section.Comment, ownershipComment) {
+			iniFile.DeleteSection(section.Name())
+			sectionChanged = true
+		}
 	}
 
 	// No need to save the file if no sections were changed.
diff --git a/lib/aws/awsconfigfile/awsconfigfile_test.go b/lib/aws/awsconfigfile/awsconfigfile_test.go
index 07dfc1bf41706..3a2150a579f84 100644
--- a/lib/aws/awsconfigfile/awsconfigfile_test.go
+++ b/lib/aws/awsconfigfile/awsconfigfile_test.go
@@ -52,7 +52,6 @@ func TestAddCredentialProcessToSection(t *testing.T) {
 	for _, tc := range []struct {
 		name             string
 		sectionName      string
-		sectionComment   string
 		existingContents *string
 		errCheck         require.ErrorAssertionFunc
 		expected         string
@@ -60,10 +59,9 @@ func TestAddCredentialProcessToSection(t *testing.T) {
 		{
 			name:             "adds section",
 			sectionName:      "profile my-aws-iam-ra-profile",
-			sectionComment:   "This section is managed by Teleport. Do not edit.",
 			existingContents: nil, // no config file
 			errCheck:         require.NoError,
-			expected: `; This section is managed by Teleport. Do not edit.
+			expected: `; Do not edit. Section managed by Teleport.
 [profile my-aws-iam-ra-profile]
 credential_process = credential_process
 `,
@@ -71,10 +69,9 @@ credential_process = credential_process
 		{
 			name:             "no config file",
 			sectionName:      "default",
-			sectionComment:   "This section is managed by Teleport. Do not edit.",
 			existingContents: nil, // no config file
 			errCheck:         require.NoError,
-			expected: `; This section is managed by Teleport. Do not edit.
+			expected: `; Do not edit. Section managed by Teleport.
 [default]
 credential_process = credential_process
 `,
@@ -82,10 +79,9 @@ credential_process = credential_process
 		{
 			name:             "empty config file",
 			sectionName:      "default",
-			sectionComment:   "This section is managed by Teleport. Do not edit.",
 			existingContents: strPtr(""),
 			errCheck:         require.NoError,
-			expected: `; This section is managed by Teleport. Do not edit.
+			expected: `; Do not edit. Section managed by Teleport.
 [default]
 credential_process = credential_process
 `,
@@ -93,38 +89,37 @@ credential_process = credential_process
 		{
 			name:             "no default profile",
 			sectionName:      "default",
-			sectionComment:   "This section is managed by Teleport. Do not edit.",
 			existingContents: strPtr("[profile foo]"),
 			errCheck:         require.NoError,
 			expected: `[profile foo]
 
-; This section is managed by Teleport. Do not edit.
+; Do not edit. Section managed by Teleport.
 [default]
 credential_process = credential_process
 `,
 		},
 		{
-			name:           "replaces default credential process",
-			sectionName:    "default",
-			sectionComment: "This section is managed by Teleport. Do not edit.",
-			existingContents: strPtr(`[default]
+			name:        "replaces default credential process",
+			sectionName: "default",
+			existingContents: strPtr(`; Do not edit. Section managed by Teleport.
+[default]
 credential_process = another process`),
 			errCheck: require.NoError,
-			expected: `; This section is managed by Teleport. Do not edit.
+			expected: `; Do not edit. Section managed by Teleport.
 [default]
 credential_process = credential_process
 `,
 		},
 		{
-			name:           "comments are kept",
-			sectionName:    "default",
-			sectionComment: "This section is managed by Teleport. Do not edit.",
-			existingContents: strPtr(`[default]
+			name:        "comments are kept",
+			sectionName: "default",
+			existingContents: strPtr(`; Do not edit. Section managed by Teleport.
+[default]
 ; this is a comment
 # yet another comment
 credential_process = another process`),
 			errCheck: require.NoError,
-			expected: `; This section is managed by Teleport. Do not edit.
+			expected: `; Do not edit. Section managed by Teleport.
 [default]
 ; this is a comment
 # yet another comment
@@ -132,9 +127,8 @@ credential_process = credential_process
 `,
 		},
 		{
-			name:           "error when default profile exists and has other fields",
-			sectionName:    "default",
-			sectionComment: "This section is managed by Teleport. Do not edit.",
+			name:        "error when default profile exists and has other fields",
+			sectionName: "default",
 			existingContents: strPtr(`[default]
 credential_process = another process
 another_field = another_value`),
@@ -147,15 +141,84 @@ another_field = another_value`),
 			errCheck:         require.Error,
 		},
 		{
-			name:           "error when profile does not have the expected comment",
-			sectionName:    "default",
-			sectionComment: "This section is managed by Teleport. Do not edit.",
+			name:        "error when profile does not have the expected comment",
+			sectionName: "default",
 			existingContents: strPtr(`; Another Comment
 [default]
 credential_process = another process
 another_field = another_value`),
 			errCheck: require.Error,
 		},
+		{
+			name:        "re-apply the login, should not add another section",
+			sectionName: "profile Upper-and-lower-CASE",
+			existingContents: strPtr(`[sectionA]
+some_setting = value
+
+; Do not edit. Section managed by Teleport.
+[profile Upper-and-lower-CASE]
+credential_process=credential_process
+`),
+			errCheck: require.NoError,
+			expected: `[sectionA]
+some_setting = value
+
+; Do not edit. Section managed by Teleport.
+[profile Upper-and-lower-CASE]
+credential_process = credential_process
+`,
+		},
+		{
+			name:        "refuses to change the profile when a profile with the same name already exists but has no comment",
+			sectionName: "profile My-Profile",
+			existingContents: strPtr(`[sectionA]
+some_setting = value
+
+[profile My-Profile]
+credential_process=credential_process
+`),
+			errCheck: require.Error,
+		},
+		{
+			// This is not exactly a test but serves documentation purposes on the limitation of the library we use.
+			// It's not possible to keep the exact formatting of the existing file because it doesn't support it.
+			// Instead, it will reformat the file before saving it.
+			// The library supports turning off pretty printing but that would just reformat the entire file using no spaces, and no alignment,
+			// even if the original file had it.
+			name:        "document reformatting behavior",
+			sectionName: "profile Upper-and-lower-CASE",
+			existingContents: strPtr(`[sectionA]
+with_spaces = value
+without_spaces=value`),
+			errCheck: require.NoError,
+			expected: `[sectionA]
+with_spaces    = value
+without_spaces = value
+
+; Do not edit. Section managed by Teleport.
+[profile Upper-and-lower-CASE]
+credential_process = credential_process
+`,
+		},
+		{
+			name:        "upserting an existing profile which used the previous version of the comment",
+			sectionName: "profile Upper-and-lower-CASE",
+			existingContents: strPtr(`[sectionA]
+some_setting = value
+
+; Do not edit. Section managed by Teleport. Generated for accessing Upper-and-lower-CASE
+[profile Upper-and-lower-CASE]
+credential_process=credential_process
+`),
+			errCheck: require.NoError,
+			expected: `[sectionA]
+some_setting = value
+
+; Do not edit. Section managed by Teleport.
+[profile Upper-and-lower-CASE]
+credential_process = credential_process
+`,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			configFilePath := filepath.Join(t.TempDir(), "config")
@@ -164,7 +227,7 @@ another_field = another_value`),
 				require.NoError(t, err)
 			}
 
-			err := addCredentialProcessToSection(configFilePath, tc.sectionName, tc.sectionComment, "credential_process")
+			err := addCredentialProcessToSection(configFilePath, tc.sectionName, "credential_process")
 			tc.errCheck(t, err)
 
 			if tc.expected != "" {
@@ -178,14 +241,13 @@ another_field = another_value`),
 	t.Run("creates directory if it does not exist", func(t *testing.T) {
 		tmpDir := t.TempDir()
 		configFilePath := filepath.Join(tmpDir, "dir", "config")
-		sectionComment := "This section is managed by Teleport. Do not edit. Profile for app: my-app"
-		err := SetDefaultProfileCredentialProcess(configFilePath, sectionComment, "credential_process")
+		err := SetDefaultProfileCredentialProcess(configFilePath, "credential_process")
 		require.NoError(t, err)
 
 		require.DirExists(t, filepath.Join(tmpDir, "dir"))
 		bs, err := os.ReadFile(configFilePath)
 		require.NoError(t, err)
-		require.Equal(t, `; This section is managed by Teleport. Do not edit. Profile for app: my-app
+		require.Equal(t, `; Do not edit. Section managed by Teleport.
 [default]
 credential_process = credential_process
 `, string(bs))
@@ -194,69 +256,166 @@ credential_process = credential_process
 	t.Run("sets a named profile", func(t *testing.T) {
 		tmpDir := t.TempDir()
 		configFilePath := filepath.Join(tmpDir, "dir", "config")
-		sectionComment := "This section is managed by Teleport. Do not edit. Profile for app: my-app"
-		err := UpsertProfileCredentialProcess(configFilePath, "my-profile", sectionComment, "credential_process")
+		err := UpsertProfileCredentialProcess(configFilePath, "my-profile", "credential_process")
 		require.NoError(t, err)
 
 		require.DirExists(t, filepath.Join(tmpDir, "dir"))
 		bs, err := os.ReadFile(configFilePath)
 		require.NoError(t, err)
-		require.Equal(t, `; This section is managed by Teleport. Do not edit. Profile for app: my-app
+		require.Equal(t, `; Do not edit. Section managed by Teleport.
 [profile my-profile]
 credential_process = credential_process
 `, string(bs))
 	})
 }
 
-func TestRemoveCredentialProcessByComment(t *testing.T) {
+func TestRemoveTeleportManagedProfile(t *testing.T) {
 	for _, tc := range []struct {
 		name             string
-		commentSection   string
 		existingContents *string
+		profile          string
 		errCheck         require.ErrorAssertionFunc
 		expected         string
 	}{
 		{
 			name:             "no config file",
-			commentSection:   "a comment",
 			existingContents: nil, // no config file
 			errCheck:         require.NoError,
 			expected:         "",
 		},
 		{
 			name:             "empty config file",
-			commentSection:   "a comment",
 			existingContents: strPtr(""),
 			errCheck:         require.NoError,
 			expected:         "",
 		},
 		{
 			name:             "no section with expected comment",
-			commentSection:   "a comment",
 			existingContents: strPtr("; another comment\n[profile foo]\ncredential_process = process"),
 			errCheck:         require.NoError,
 			expected:         "; another comment\n[profile foo]\ncredential_process = process",
 		},
 		{
 			name:             "matching comment but no profile using credential_process",
-			commentSection:   "; a comment",
 			existingContents: strPtr("; a comment\n[profile foo]\nanother_key = value"),
 			errCheck:         require.NoError,
 			expected:         "; a comment\n[profile foo]\nanother_key = value",
 		},
 		{
 			name:             "removes the entire profile when the only key is the credential process",
-			commentSection:   "a comment",
 			existingContents: strPtr("; a comment\n[profile foo]\ncredential_process = process"),
 			errCheck:         require.NoError,
 			expected:         "",
 		},
 		{
-			name:             "an error is returned if more keys exist",
-			commentSection:   "a comment",
-			existingContents: strPtr("; a comment\n[profile foo]\ncredential_process = process\nanother_key = value"),
-			errCheck:         require.Error,
-			expected:         "; a comment\n[profile foo]\ncredential_process = process\nanother_key = value",
+			name:    "an error is returned if comment doesn't match",
+			profile: "foo",
+			existingContents: strPtr(`; a comment
+[profile foo]
+credential_process = process
+`),
+			errCheck: require.Error,
+			expected: `; a comment
+[profile foo]
+credential_process = process
+`,
+		},
+		{
+			name:    "no error even if it has more keys",
+			profile: "foo",
+			existingContents: strPtr(`; Do not edit. Section managed by Teleport.
+[profile foo]
+credential_process = process
+another_key = value
+`),
+			errCheck: require.NoError,
+			expected: ``,
+		},
+		{
+			name:    "no error even if it is using the previous comment version",
+			profile: "foo",
+			existingContents: strPtr(`; Do not edit. Section managed by Teleport. Generated for accessing MyApp
+[profile foo]
+credential_process = process
+another_key = value
+`),
+			errCheck: require.NoError,
+			expected: ``,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			configFilePath := filepath.Join(t.TempDir(), "config")
+			if tc.existingContents != nil {
+				err := os.WriteFile(configFilePath, []byte(*tc.existingContents), 0600)
+				require.NoError(t, err)
+			}
+			err := RemoveTeleportManagedProfile(configFilePath, tc.profile)
+			tc.errCheck(t, err)
+
+			if tc.expected != "" {
+				bs, err := os.ReadFile(configFilePath)
+				require.NoError(t, err)
+				require.Equal(t, tc.expected, string(bs))
+			}
+		})
+	}
+}
+
+func TestRemoveAllTeleportManagedProfiles(t *testing.T) {
+	for _, tc := range []struct {
+		name             string
+		profile          string
+		existingContents *string
+		errCheck         require.ErrorAssertionFunc
+		expected         string
+	}{
+		{
+			name: "multiple sections are removed",
+			existingContents: strPtr(`; Do not remove. Generated by ACME Tool
+[profile foo1]
+credential_process = process
+
+[default]
+aws_region = us-east-1
+
+; Do not edit. Section managed by Teleport.
+[profile foo2]
+credential_process = process
+
+; Do not edit. Section managed by Teleport.
+[profile foo3]
+credential_process = process
+`),
+			errCheck: require.NoError,
+			expected: `; Do not remove. Generated by ACME Tool
+[profile foo1]
+credential_process = process
+
+[default]
+aws_region = us-east-1
+`,
+		},
+		{
+			name: "does not remove any section when comments are missing",
+			existingContents: strPtr(`[profile foo1]
+credential_process = process
+
+[default]
+aws_region = us-east-1
+
+[profile foo2]
+credential_process = process
+`),
+			errCheck: require.NoError,
+			expected: `[profile foo1]
+credential_process = process
+
+[default]
+aws_region = us-east-1
+
+[profile foo2]
+credential_process = process
+`,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -265,7 +424,7 @@ func TestRemoveCredentialProcessByComment(t *testing.T) {
 				err := os.WriteFile(configFilePath, []byte(*tc.existingContents), 0600)
 				require.NoError(t, err)
 			}
-			err := RemoveCredentialProcessByComment(configFilePath, tc.commentSection)
+			err := RemoveAllTeleportManagedProfiles(configFilePath)
 			tc.errCheck(t, err)
 
 			if tc.expected != "" {
@@ -283,12 +442,19 @@ func TestUpdateRemoveCycle(t *testing.T) {
 	err := os.WriteFile(configFilePath, []byte(initialContents), 0600)
 	require.NoError(t, err)
 
-	sectionComment := "This section is managed by Teleport. Do not edit."
+	err = UpsertProfileCredentialProcess(configFilePath, "my-profile", "my-process")
+	require.NoError(t, err)
+
+	err = UpsertProfileCredentialProcess(configFilePath, "my-profile2", "my-process")
+	require.NoError(t, err)
+
+	err = UpsertProfileCredentialProcess(configFilePath, "my-profile3", "my-process")
+	require.NoError(t, err)
 
-	err = UpsertProfileCredentialProcess(configFilePath, "my-profile", sectionComment, "my-process")
+	err = RemoveTeleportManagedProfile(configFilePath, "my-profile")
 	require.NoError(t, err)
 
-	err = RemoveCredentialProcessByComment(configFilePath, sectionComment)
+	err = RemoveAllTeleportManagedProfiles(configFilePath)
 	require.NoError(t, err)
 
 	bs, err := os.ReadFile(configFilePath)
diff --git a/lib/azuredevops/azuredevops.go b/lib/azuredevops/azuredevops.go
deleted file mode 100644
index 2bf0344e2474b..0000000000000
--- a/lib/azuredevops/azuredevops.go
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package azuredevops
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// IDTokenClaims for the pipeline OIDC ID Token issued by Azure Devops
-type IDTokenClaims struct {
-	oidc.TokenClaims
-	// Sub provides some information about the Azure Devops pipeline run.
-	// Example:
-	// p://noahstride0304/testing-azure-devops-join/strideynet.azure-devops-testing
-	Sub string `json:"sub"`
-	// OrganizationName is the name of the Azure Devops organization the project
-	// and pipeline belongs to. This name is extracted from the Sub.
-	OrganizationName string `json:"-"`
-	// ProjectName is the name of the Azure Devops project the pipeline belongs
-	// to. This name is extracted from the Sub.
-	ProjectName string `json:"-"`
-	// PipelineName is the name of the Azure Devops pipeline that the token
-	// belongs to. This name is extracted from the Sub.
-	PipelineName string `json:"-"`
-
-	// OrganizationID is the ID of the organization the pipeline belongs to.
-	OrganizationID string `json:"org_id"`
-	// ProjectID is the ID of the project the pipeline belongs to.
-	ProjectID string `json:"prj_id"`
-	// DefinitionID is the ID of the pipeline definition.
-	DefinitionID string `json:"def_id"`
-	// RepositoryID is the ID of the repository. This is not a UUID as the other
-	// ID fields. Example:
-	// strideynet/azure-devops-testing
-	RepositoryID string `json:"rpo_id"`
-	// RepositoryURI is the URI of the repository.
-	RepositoryURI string `json:"rpo_uri"`
-	// RepositoryVersion is the "version" of the repository the pipeline is
-	// running against. For a git repo, this is the commit sha.
-	RepositoryVersion string `json:"rpo_ver"`
-	// RepositoryRef is the reference that the pipeline is running
-	// against. Example:
-	// refs/heads/main
-	RepositoryRef string `json:"rpo_ref"`
-	// RunID is the ID of the pipeline run that the token belongs to.
-	RunID string `json:"run_id"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// ForAudit returns a map of the claims with the names adjusted to match the
-// definition in the JoinToken allow rules. This allows us to provide a better
-// UX by using the same names in the allow rules as are presented in the audit
-// logs.
-func (c *IDTokenClaims) ForAudit() map[string]any {
-	return map[string]any{
-		"sub":               c.Sub,
-		"organization_name": c.OrganizationName,
-		"project_name":      c.ProjectName,
-		"pipeline_name":     c.PipelineName,
-		"organization_id":   c.OrganizationID,
-		"project_id":        c.ProjectID,
-		"definition_id":     c.DefinitionID,
-		"repository_id":     c.RepositoryID,
-		"repository_uri":    c.RepositoryURI,
-		"repository_ver":    c.RepositoryVersion,
-		"repository_ref":    c.RepositoryRef,
-		"raw":               c,
-	}
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsAzureDevops {
-	return &workloadidentityv1pb.JoinAttrsAzureDevops{
-		Pipeline: &workloadidentityv1pb.JoinAttrsAzureDevopsPipeline{
-			Sub:               c.Sub,
-			OrganizationName:  c.OrganizationName,
-			ProjectName:       c.ProjectName,
-			PipelineName:      c.PipelineName,
-			OrganizationId:    c.OrganizationID,
-			ProjectId:         c.ProjectID,
-			DefinitionId:      c.DefinitionID,
-			RepositoryId:      c.RepositoryID,
-			RepositoryVersion: c.RepositoryVersion,
-			RepositoryRef:     c.RepositoryRef,
-			RunId:             c.RunID,
-		},
-	}
-}
diff --git a/lib/azuredevops/token_validator.go b/lib/azuredevops/token_validator.go
deleted file mode 100644
index ace6e694587ae..0000000000000
--- a/lib/azuredevops/token_validator.go
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package azuredevops
-
-import (
-	"context"
-	"fmt"
-	"net/url"
-	"strings"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/oidc"
-)
-
-// audience is the static value that Azure DevOps uses for the `aud` claim in
-// issued ID Tokens. Unfortunately, this cannot be changed.
-const audience = "api://AzureADTokenExchange"
-
-func issuerURL(
-	organizationID string,
-	overrideHost string,
-	insecure bool,
-) string {
-	scheme := "https"
-	if insecure {
-		scheme = "http"
-	}
-	host := "vstoken.dev.azure.com"
-	if overrideHost != "" {
-		host = overrideHost
-	}
-	issuerURL := url.URL{
-		Scheme: scheme,
-		Host:   host,
-		Path:   fmt.Sprintf("/%s", organizationID),
-	}
-	return issuerURL.String()
-}
-
-// IDTokenValidator validates an Azure Devops issued ID Token.
-type IDTokenValidator struct {
-	insecureDiscovery     bool
-	overrideDiscoveryHost string
-}
-
-// NewIDTokenValidator returns an initialized IDTokenValidator
-func NewIDTokenValidator() *IDTokenValidator {
-	return &IDTokenValidator{}
-}
-
-// Validate validates an Azure Devops issued ID token.
-func (id *IDTokenValidator) Validate(
-	ctx context.Context, organizationID, token string,
-) (*IDTokenClaims, error) {
-	issuer := issuerURL(
-		organizationID, id.overrideDiscoveryHost, id.insecureDiscovery,
-	)
-
-	claims, err := oidc.ValidateToken[*IDTokenClaims](ctx, issuer, audience, token)
-	if err != nil {
-		return nil, trace.Wrap(err, "validating token")
-	}
-
-	parsed, err := parseSubClaim(claims.Sub)
-	if err != nil {
-		return nil, trace.Wrap(err, "parsing sub claim")
-	}
-	claims.OrganizationName = parsed.organizationName
-	claims.ProjectName = parsed.projectName
-	claims.PipelineName = parsed.pipelineName
-
-	if claims.OrganizationID != organizationID {
-		return nil, trace.BadParameter(
-			"organization ID in token (%s) does not match configured (%s)",
-			claims.OrganizationID, organizationID,
-		)
-	}
-
-	return claims, nil
-}
-
-type parsedSubClaim struct {
-	organizationName string
-	projectName      string
-	pipelineName     string
-}
-
-func parseSubClaim(sub string) (parsedSubClaim, error) {
-	parsed, err := url.Parse(sub)
-	if err != nil {
-		return parsedSubClaim{}, trace.Wrap(err, "parsing as url")
-	}
-
-	// Special p:// scheme indicates this is a Pipeline ID token rather than
-	// a service connection ID token (which starts sc://).
-	if parsed.Scheme != "p" {
-		return parsedSubClaim{}, trace.BadParameter(
-			"id token is not of pipeline kind (sub: %q)", sub,
-		)
-	}
-
-	out := parsedSubClaim{organizationName: parsed.Host}
-	// Now we need to handle the path, which is something like
-	// /project-name/pipeline-name
-	path, _ := strings.CutPrefix(parsed.Path, "/")
-	split := strings.Split(path, "/")
-	if len(split) != 2 {
-		return parsedSubClaim{}, trace.BadParameter(
-			"subject malformed, expected 2 path elements (sub: %q)", sub,
-		)
-	}
-	out.projectName = split[0]
-	out.pipelineName = split[1]
-
-	return out, nil
-}
diff --git a/lib/backend/atomicwrite.go b/lib/backend/atomicwrite.go
index a59cf84f70cb7..b3eaf37fedd8d 100644
--- a/lib/backend/atomicwrite.go
+++ b/lib/backend/atomicwrite.go
@@ -218,6 +218,8 @@ const (
 	// MaxAtomicWriteSize is the maximum number of conditional actions that may
 	// be applied via a single atomic write. The exact number is subject to change
 	// but must always be less than the minimum value supported across all backends.
+	//
+	// NOTE:The buckets for backendmetrics.AtomicWriteSize must stay in sync with this constant.
 	MaxAtomicWriteSize = 64
 )
 
diff --git a/lib/backend/backend.go b/lib/backend/backend.go
index 7506a605fd401..57b00c7ef721b 100644
--- a/lib/backend/backend.go
+++ b/lib/backend/backend.go
@@ -22,7 +22,6 @@ package backend
 import (
 	"context"
 	"fmt"
-	"io"
 	"iter"
 	"sort"
 	"time"
@@ -31,7 +30,6 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 
-	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -150,62 +148,6 @@ func New(ctx context.Context, backend string, params Params) (Backend, error) {
 	return bk, nil
 }
 
-// IterateRange is a helper for stepping over a range
-func IterateRange(ctx context.Context, bk Backend, startKey, endKey Key, limit int, fn func([]Item) (stop bool, err error)) error {
-	if limit == 0 || limit > 10_000 {
-		limit = 10_000
-	}
-	for {
-		// we load an extra item here so that we can be certain we have a correct
-		// start key for the next range.
-		rslt, err := bk.GetRange(ctx, startKey, endKey, limit+1)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		end := limit
-		if len(rslt.Items) < end {
-			end = len(rslt.Items)
-		}
-		stop, err := fn(rslt.Items[0:end])
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if stop || len(rslt.Items) <= limit {
-			return nil
-		}
-		startKey = rslt.Items[limit].Key
-	}
-}
-
-// StreamRange constructs a Stream for the given key range. This helper just
-// uses standard pagination under the hood, lazily loading pages as needed. Streams
-// are currently only used for periodic operations, but if they become more widely
-// used in the future, it may become worthwhile to optimize the streaming of backend
-// items further. Two potential improvements of note:
-//
-// 1. update this helper to concurrently load the next page in the background while
-// items from the current page are being yielded.
-//
-// 2. allow individual backends to expose custom streaming methods s.t. the most performant
-// impl for a given backend may be used.
-func StreamRange(ctx context.Context, bk Backend, startKey, endKey Key, pageSize int) stream.Stream[Item] {
-	return stream.PageFunc[Item](func() ([]Item, error) {
-		if startKey.components == nil {
-			return nil, io.EOF
-		}
-		rslt, err := bk.GetRange(ctx, startKey, endKey, pageSize)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if len(rslt.Items) < pageSize {
-			startKey = Key{}
-		} else {
-			startKey = nextKey(rslt.Items[pageSize-1].Key)
-		}
-		return rslt.Items, nil
-	})
-}
-
 // Lease represents a lease on the item that can be used
 // to extend item's TTL without updating its contents.
 //
@@ -320,10 +262,10 @@ func (p Params) GetString(key string) string {
 // NoLimit specifies no limits
 const NoLimit = 0
 
-// nextKey returns the next possible key.
-// If used with a key prefix, this will return
-// the end of the range for that key prefix.
-func nextKey(key Key) Key {
+const noEnd = "\x00"
+
+// RangeEnd returns end of the range for given key.
+func RangeEnd(key Key) Key {
 	end := make([]byte, len(key.s))
 	copy(end, key.s)
 	for i := len(end) - 1; i >= 0; i-- {
@@ -337,13 +279,6 @@ func nextKey(key Key) Key {
 	return Key{noEnd: true}
 }
 
-var noEnd = []byte{0}
-
-// RangeEnd returns end of the range for given key.
-func RangeEnd(key Key) Key {
-	return nextKey(key)
-}
-
 // HostID is a derivation of a KeyedItem that allows the host id
 // to be included in the key.
 type HostID interface {
@@ -361,7 +296,7 @@ type KeyedItem interface {
 // have the HostID part.
 func GetPaginationKey(ki KeyedItem) string {
 	if h, ok := ki.(HostID); ok {
-		return internalKey(h.GetHostID(), h.GetName()).String()
+		return h.GetHostID() + SeparatorString + h.GetName()
 	}
 
 	return ki.GetName()
@@ -465,3 +400,57 @@ func NewLease(item Item) *Lease {
 		Revision: item.Revision,
 	}
 }
+
+// BatchPutter is an optional interface that backends can implement
+// to support batched PutBatch operations for improved performance when writing
+// multiple items at once.
+type BatchPutter interface {
+	// PutBatch upserts multiple items into the backend in a single call, in a way
+	// that is equivalent to a loop around multiple invocations of [backend.Put],
+	// but with the potential to be more efficient or faster, depending on the
+	// implementation. Returns a revision item for each item in the same order.
+	// Revisions are not guaranteed to be different nor they are guaranteed to be
+	// the same between items of the same batch. If an error is returned, it's
+	// possible for some of the items to have been persisted to the storage. The
+	// order in which items are internally persisted is an implementation detail.
+	PutBatch(context.Context, []Item) ([]string, error)
+}
+
+// PutBatch is an implementation of PutBatch that by default calls Put for each item.
+// Backends can overwrite this behavior providing optimized PutBatch implementation.
+//
+// WARNING: Make sure that items have unique keys when calling PutBatch.
+func PutBatch(ctx context.Context, bk Backend, items []Item) ([]string, error) {
+	if v, hasDuplicate := hasDuplicateKeys(items); hasDuplicate {
+		return nil, trace.BadParameter("duplicate key detected in PutBatch: %q", v)
+	}
+	// Many Backend implementations rely on unique keys for correct operation.
+	// Where it is up to the caller to ensure this to remove duplication keys
+	// Just in case we will fallback to single Put calls if duplicates are detected.
+	if v, ok := bk.(BatchPutter); ok {
+		revs, err := v.PutBatch(ctx, items)
+		return revs, trace.Wrap(err)
+	}
+
+	revisions := make([]string, 0, len(items))
+	for _, item := range items {
+		rev, err := bk.Put(ctx, item)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		revisions = append(revisions, rev.Revision)
+	}
+	return revisions, nil
+}
+
+func hasDuplicateKeys(items Items) (string, bool) {
+	seen := make(map[string]struct{})
+	for _, ca := range items {
+		keyStr := ca.Key.String()
+		if _, ok := seen[keyStr]; ok {
+			return keyStr, true
+		}
+		seen[keyStr] = struct{}{}
+	}
+	return "", false
+}
diff --git a/lib/backend/backendmetrics/metrics.go b/lib/backend/backendmetrics/metrics.go
new file mode 100644
index 0000000000000..40881c020b604
--- /dev/null
+++ b/lib/backend/backendmetrics/metrics.go
@@ -0,0 +1,255 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package backendmetrics
+
+import (
+	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+)
+
+var (
+	Requests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendRequests,
+			Help: "Number of requests to the backend (reads, writes, and keepalives)",
+		},
+		[]string{teleport.ComponentLabel, teleport.TagReq, teleport.TagRange},
+	)
+	Watchers = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: teleport.MetricBackendWatchers,
+			Help: "Number of active backend watchers",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	WatcherQueues = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: teleport.MetricBackendWatcherQueues,
+			Help: "Watcher queue sizes",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	WriteRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendWriteRequests,
+			Help: "Number of write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	Writes = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendWrites,
+			Help:      "Number of individual items written to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	WriteRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendWriteFailedRequests,
+			Help: "Number of failed write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	WriteRequestsFailedPrecondition = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendWriteFailedPreconditionRequests,
+			Help:      "Number of write requests that failed due to a precondition (existence, revision, value, etc)",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteRequests,
+			Help:      "Number of atomic write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteFailedRequests,
+			Help:      "Number of failed atomic write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteConditionFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteConditionFailed,
+			Help:      "Number of times an atomic write request results in condition failure",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteLatencies = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteHistogram,
+			Help:      "Latency for backend atomic write operations",
+			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
+			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
+			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteSize = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteSize,
+			Help:      "Atomic write batch size",
+			// buckets of the form 1, 2, 4, 8, 16, etc...
+			Buckets: prometheus.ExponentialBuckets(1, 2, 8),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	AtomicWriteContention = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendAtomicWriteContention,
+			Help:      "Number of times atomic write requests experience contention",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchWriteRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendBatchWriteRequests,
+			Help: "Number of batch write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchWriteRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendBatchFailedWriteRequests,
+			Help: "Number of failed write requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	ReadRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendReadRequests,
+			Help: "Number of read requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	Reads = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      teleport.MetricBackendReads,
+			Help:      "Number of individual items read from the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	ReadRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendFailedReadRequests,
+			Help: "Number of failed read requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	StreamingRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: "backend",
+			Name:      "stream_requests",
+			Help:      "Number of inflight stream requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	StreamingRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: "backend",
+			Name:      "stream_requests_failed",
+			Help:      "Number of failed stream requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchReadRequests = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendBatchReadRequests,
+			Help: "Number of read requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchReadRequestsFailed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: teleport.MetricBackendBatchFailedReadRequests,
+			Help: "Number of failed read requests to the backend",
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	WriteLatencies = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name: teleport.MetricBackendWriteHistogram,
+			Help: "Latency for backend write operations",
+			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
+			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
+			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchWriteLatencies = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name: teleport.MetricBackendBatchWriteHistogram,
+			Help: "Latency for backend batch write operations",
+			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
+			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
+			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	BatchReadLatencies = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name: teleport.MetricBackendBatchReadHistogram,
+			Help: "Latency for batch read operations",
+			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
+			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
+			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+	ReadLatencies = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name: teleport.MetricBackendReadHistogram,
+			Help: "Latency for read operations",
+			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
+			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
+			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
+		},
+		[]string{teleport.ComponentLabel},
+	)
+)
+
+// RegisterCollectors ensures all backend metrics are registered
+// with the provided [prometheus.Registerer].
+func RegisterCollectors(reg prometheus.Registerer) error {
+	return trace.Wrap(metrics.RegisterCollectors(reg,
+		Watchers, WatcherQueues, Requests, WriteRequests,
+		WriteRequestsFailed, BatchWriteRequests, BatchWriteRequestsFailed, ReadRequests,
+		ReadRequestsFailed, BatchReadRequests, BatchReadRequestsFailed, WriteLatencies,
+		WriteRequestsFailedPrecondition,
+		AtomicWriteRequests, AtomicWriteRequestsFailed, AtomicWriteConditionFailed, AtomicWriteLatencies,
+		AtomicWriteContention, AtomicWriteSize, Reads, Writes,
+		BatchWriteLatencies, BatchReadLatencies, ReadLatencies,
+		StreamingRequests, StreamingRequestsFailed,
+	))
+}
diff --git a/lib/backend/backendtest/randomly_erroring_backend.go b/lib/backend/backendtest/randomly_erroring_backend.go
new file mode 100644
index 0000000000000..a84acc8d3c939
--- /dev/null
+++ b/lib/backend/backendtest/randomly_erroring_backend.go
@@ -0,0 +1,69 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package backendtest
+
+import (
+	"context"
+	"errors"
+	"iter"
+	"math/rand/v2"
+
+	"github.com/gravitational/teleport/lib/backend"
+)
+
+var ErrRandomBackend = errors.New("RandomlyErroringBackend error")
+
+// RandomlyErroringBackend wraps Backend reading methods making them fail 50% of the time with
+// [ErrRandomBackend].
+type RandomlyErroringBackend struct {
+	backend.Backend
+}
+
+// NewRandomlyErroringBackend creates new instance of RandomlyErroringBackend for a given backend.
+func NewRandomlyErroringBackend(b backend.Backend) *RandomlyErroringBackend {
+	return &RandomlyErroringBackend{
+		Backend: b,
+	}
+}
+
+func (b *RandomlyErroringBackend) Get(ctx context.Context, key backend.Key) (*backend.Item, error) {
+	if rand.IntN(2) == 0 {
+		return nil, ErrRandomBackend
+	}
+	return b.Backend.Get(ctx, key)
+}
+
+func (b *RandomlyErroringBackend) Items(ctx context.Context, params backend.ItemsParams) iter.Seq2[backend.Item, error] {
+	return func(yield func(backend.Item, error) bool) {
+		for item, err := range b.Backend.Items(ctx, params) {
+			var ok bool
+			if rand.IntN(2) == 0 {
+				ok = yield(backend.Item{}, ErrRandomBackend)
+			} else {
+				ok = yield(item, err)
+			}
+			if !ok {
+				return
+			}
+		}
+	}
+}
+
+func (b *RandomlyErroringBackend) GetRange(ctx context.Context, startKey, endKey backend.Key, limit int) (*backend.GetResult, error) {
+	if rand.IntN(2) == 0 {
+		return nil, ErrRandomBackend
+	}
+	return b.Backend.GetRange(ctx, startKey, endKey, limit)
+}
diff --git a/lib/backend/backendtest/randomly_erroring_backend_test.go b/lib/backend/backendtest/randomly_erroring_backend_test.go
new file mode 100644
index 0000000000000..02acf566af502
--- /dev/null
+++ b/lib/backend/backendtest/randomly_erroring_backend_test.go
@@ -0,0 +1,88 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package backendtest
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+)
+
+func TestRandomlyErroringBackend(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	mem, err := memory.New(memory.Config{Context: ctx})
+	require.NoError(t, err)
+
+	var key, value = backend.NewKey("test_key_1"), []byte("test_value_1")
+
+	randomlyErroringBackend := NewRandomlyErroringBackend(mem)
+	_, err = randomlyErroringBackend.Put(ctx, backend.Item{Key: key, Value: value})
+	require.NoError(t, err)
+
+	const iterations, minBoundary, maxBoundary = 200, 50, 150
+
+	// Get
+	randomErrCnt := 0
+	for range iterations {
+		item, err := randomlyErroringBackend.Get(ctx, key)
+		if err != nil {
+			require.ErrorIs(t, err, ErrRandomBackend)
+			randomErrCnt++
+		} else {
+			require.Equal(t, key, item.Key)
+			require.Equal(t, value, item.Value)
+		}
+	}
+	require.GreaterOrEqual(t, randomErrCnt, minBoundary)
+	require.LessOrEqual(t, randomErrCnt, maxBoundary)
+
+	// GetRange
+	randomErrCnt = 0
+	for range iterations {
+		res, err := randomlyErroringBackend.GetRange(ctx, key, key, 100)
+		if err != nil {
+			require.ErrorIs(t, err, ErrRandomBackend)
+			randomErrCnt++
+		} else {
+			require.Len(t, res.Items, 1)
+			item := res.Items[0]
+			require.Equal(t, key, item.Key)
+			require.Equal(t, value, item.Value)
+		}
+	}
+	require.GreaterOrEqual(t, randomErrCnt, minBoundary)
+	require.LessOrEqual(t, randomErrCnt, maxBoundary)
+
+	// Items
+	randomErrCnt = 0
+	for range iterations {
+		for item, err := range randomlyErroringBackend.Items(ctx, backend.ItemsParams{StartKey: key, EndKey: key, Limit: 100}) {
+			if err != nil {
+				require.ErrorIs(t, err, ErrRandomBackend)
+				randomErrCnt++
+			} else {
+				require.Equal(t, key, item.Key)
+				require.Equal(t, value, item.Value)
+			}
+		}
+	}
+	require.GreaterOrEqual(t, randomErrCnt, minBoundary)
+	require.LessOrEqual(t, randomErrCnt, maxBoundary)
+}
diff --git a/lib/backend/buffer.go b/lib/backend/buffer.go
index 5af31c114d52e..2cbc892e60fc7 100644
--- a/lib/backend/buffer.go
+++ b/lib/backend/buffer.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
@@ -203,7 +204,7 @@ func (c *CircularBuffer) fanOutEvent(r Event) {
 	var watchersToDelete []*BufferWatcher
 	c.watchers.walkPath(r.Item.Key.String(), func(watcher *BufferWatcher) {
 		if watcher.MetricComponent != "" {
-			watcherQueues.WithLabelValues(watcher.MetricComponent).Set(float64(len(watcher.eventsC)))
+			backendmetrics.WatcherQueues.WithLabelValues(watcher.MetricComponent).Set(float64(len(watcher.eventsC)))
 		}
 		if !watcher.emit(r) {
 			watchersToDelete = append(watchersToDelete, watcher)
diff --git a/lib/backend/dynamo/atomicwrite.go b/lib/backend/dynamo/atomicwrite.go
index 4de200e5b97b1..749b55c0aded9 100644
--- a/lib/backend/dynamo/atomicwrite.go
+++ b/lib/backend/dynamo/atomicwrite.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 )
 
 const (
@@ -169,7 +170,7 @@ TxnLoop:
 		if i != 0 {
 			if retry == nil {
 				// ideally we want one of the concurrently canceled transactions to retry immediately, with the rest holding back. since we
-				// can't control wether that happens, the next best thing is to configure our backoff to use exponential scaling + full jitter,
+				// can't control whether that happens, the next best thing is to configure our backoff to use exponential scaling + full jitter,
 				// which strikes a nice balance between retrying quickly when under low contention, and rapidly spreading out retries when under
 				// high contention.
 				retry, err = retryutils.NewRetryV2(retryutils.RetryV2Config{
@@ -250,7 +251,7 @@ TxnLoop:
 		}
 
 		if i > 0 {
-			backend.AtomicWriteContention.WithLabelValues(teleport.ComponentDynamoDB).Add(float64(i))
+			backendmetrics.AtomicWriteContention.WithLabelValues(teleport.ComponentDynamoDB).Add(float64(i))
 		}
 
 		if n := i + 1; n > 2 {
diff --git a/lib/backend/dynamo/dynamodbbk_test.go b/lib/backend/dynamo/dynamodbbk_test.go
index 803310c86fd55..3c74ca7f26543 100644
--- a/lib/backend/dynamo/dynamodbbk_test.go
+++ b/lib/backend/dynamo/dynamodbbk_test.go
@@ -20,6 +20,7 @@ package dynamo
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -40,14 +41,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/integrations/lib/backoff"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -241,8 +243,7 @@ func TestCreateTable(t *testing.T) {
 func TestContinuousBackups(t *testing.T) {
 	ensureTestsEnabled(t)
 
-	// Create new backend with continuous backups enabled.
-	b, err := New(context.Background(), map[string]interface{}{
+	b, err := New(t.Context(), map[string]interface{}{
 		"table_name":         uuid.NewString() + "-test",
 		"continuous_backups": true,
 	})
@@ -250,7 +251,19 @@ func TestContinuousBackups(t *testing.T) {
 
 	// Remove table after tests are done.
 	t.Cleanup(func() {
-		require.NoError(t, deleteTable(context.Background(), b.svc, b.Config.TableName))
+		back := backoff.NewDecorr(500*time.Millisecond, 20*time.Second, clockwork.NewRealClock())
+		for {
+			err := deleteTable(context.Background(), b.svc, b.Config.TableName)
+			if err == nil {
+				return
+			}
+			inUse := &types.ResourceInUseException{}
+			if errors.As(err, &inUse) {
+				back.Do(context.Background())
+			} else {
+				assert.FailNow(t, "error deleting table", err)
+			}
+		}
 	})
 
 	// Check status of continuous backups.
@@ -295,6 +308,7 @@ func TestAutoScaling(t *testing.T) {
 		WriteMaxCapacity: 20,
 		WriteTargetValue: 50.0,
 	}
+
 	// Check auto scaling values match.
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		resp, err := getAutoScaling(context.Background(), applicationautoscaling.NewFromConfig(awsConfig), b.Config.TableName)
@@ -341,10 +355,12 @@ type AutoScalingParams struct {
 // getAutoScaling gets the state of auto scaling.
 func getAutoScaling(ctx context.Context, svc *applicationautoscaling.Client, tableName string) (*AutoScalingParams, error) {
 	var resp AutoScalingParams
+	tableResourceID := "table/" + tableName
 
 	// Get scaling targets.
 	targetResponse, err := svc.DescribeScalableTargets(ctx, &applicationautoscaling.DescribeScalableTargetsInput{
 		ServiceNamespace: autoscalingtypes.ServiceNamespaceDynamodb,
+		ResourceIds:      []string{tableResourceID},
 	})
 	if err != nil {
 		return nil, convertError(err)
@@ -363,6 +379,7 @@ func getAutoScaling(ctx context.Context, svc *applicationautoscaling.Client, tab
 	// Get scaling policies.
 	policyResponse, err := svc.DescribeScalingPolicies(ctx, &applicationautoscaling.DescribeScalingPoliciesInput{
 		ServiceNamespace: autoscalingtypes.ServiceNamespaceDynamodb,
+		ResourceId:       aws.String(tableResourceID),
 	})
 	if err != nil {
 		return nil, convertError(err)
diff --git a/lib/backend/dynamo/shards.go b/lib/backend/dynamo/shards.go
index 0f1a309e98eb4..d5bee990daa61 100644
--- a/lib/backend/dynamo/shards.go
+++ b/lib/backend/dynamo/shards.go
@@ -308,7 +308,7 @@ func toOpType(rec streamtypes.Record) (types.OpType, error) {
 	case streamtypes.OperationTypeRemove:
 		return types.OpDelete, nil
 	default:
-		return -1, trace.BadParameter("unsupported DynamodDB operation: %v", rec.EventName)
+		return -1, trace.BadParameter("unsupported DynamoDB operation: %v", rec.EventName)
 	}
 }
 
diff --git a/lib/backend/etcdbk/etcd_test.go b/lib/backend/etcdbk/etcd_test.go
index ac6780ed1ef9d..9bd66e08c8271 100644
--- a/lib/backend/etcdbk/etcd_test.go
+++ b/lib/backend/etcdbk/etcd_test.go
@@ -33,8 +33,8 @@ import (
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const (
@@ -43,7 +43,7 @@ const (
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/backend/firestore/atomicwrite.go b/lib/backend/firestore/atomicwrite.go
index 3dee9de1b8770..6f4877dd04848 100644
--- a/lib/backend/firestore/atomicwrite.go
+++ b/lib/backend/firestore/atomicwrite.go
@@ -29,6 +29,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 )
 
 func (b *Backend) AtomicWrite(ctx context.Context, condacts []backend.ConditionalAction) (revision string, err error) {
@@ -146,7 +147,7 @@ func (b *Backend) AtomicWrite(ctx context.Context, condacts []backend.Conditiona
 	}
 
 	if n > 1 {
-		backend.AtomicWriteContention.WithLabelValues(teleport.ComponentFirestore).Add(float64(n - 1))
+		backendmetrics.AtomicWriteContention.WithLabelValues(teleport.ComponentFirestore).Add(float64(n - 1))
 	}
 
 	if n > 2 {
diff --git a/lib/backend/firestore/firestorebk.go b/lib/backend/firestore/firestorebk.go
index 24edbb0f27e01..3060c783ed3e4 100644
--- a/lib/backend/firestore/firestorebk.go
+++ b/lib/backend/firestore/firestorebk.go
@@ -206,7 +206,7 @@ func newRecord(from backend.Item, clock clockwork.Clock) record {
 func newRecordFromDoc(doc *firestore.DocumentSnapshot) (*record, error) {
 	k, err := doc.DataAt(keyDocProperty)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, ConvertGRPCError(err)
 	}
 
 	var r record
@@ -215,7 +215,7 @@ func newRecordFromDoc(doc *firestore.DocumentSnapshot) (*record, error) {
 		// If the key is a slice of any, then the key was mistakenly persisted
 		// as a backend.Key directly.
 		var br brokenRecord
-		if doc.DataTo(&br) != nil {
+		if err := doc.DataTo(&br); err != nil {
 			return nil, ConvertGRPCError(err)
 		}
 
@@ -225,7 +225,6 @@ func newRecordFromDoc(doc *firestore.DocumentSnapshot) (*record, error) {
 			Timestamp:  br.Timestamp,
 			Expires:    br.Expires,
 			RevisionV2: br.RevisionV2,
-			snapShot:   doc,
 		}
 	default:
 		if err := doc.DataTo(&r); err != nil {
@@ -233,19 +232,20 @@ func newRecordFromDoc(doc *firestore.DocumentSnapshot) (*record, error) {
 			// Value was a string. This document could've been written by an older
 			// version of our code.
 			var rl legacyRecord
-			if doc.DataTo(&rl) != nil {
-				return nil, ConvertGRPCError(err)
+			if legacyErr := doc.DataTo(&rl); legacyErr != nil {
+				return nil, trace.NewAggregate(ConvertGRPCError(err), ConvertGRPCError(legacyErr))
 			}
 			r = record{
 				Key:       []byte(rl.Key),
 				Value:     []byte(rl.Value),
 				Timestamp: rl.Timestamp,
 				Expires:   rl.Expires,
-				snapShot:  doc,
 			}
 		}
 	}
 
+	r.snapShot = doc
+
 	if r.RevisionV2 == "" {
 		r.RevisionV1 = toRevisionV1(doc.UpdateTime)
 	}
diff --git a/lib/backend/firestore/firestorebk_test.go b/lib/backend/firestore/firestorebk_test.go
index 26bd799f8a5de..ac0042aad47e3 100644
--- a/lib/backend/firestore/firestorebk_test.go
+++ b/lib/backend/firestore/firestorebk_test.go
@@ -52,12 +52,12 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -469,6 +469,11 @@ func TestFirestoreMigration(t *testing.T) {
 	uut, err := New(context.Background(), cfg, Options{Clock: clock})
 	require.NoError(t, err)
 
+	// Empty the collection to make sure previous tests don't interfere
+	snapshot, err := uut.svc.Collection(uut.CollectionName).Documents(context.Background()).GetAll()
+	require.NoError(t, err)
+	require.NoError(t, uut.deleteDocuments(snapshot))
+
 	type byteAlias []byte
 	type badRecord struct {
 		Key        byteAlias `firestore:"key,omitempty"`
diff --git a/lib/backend/key.go b/lib/backend/key.go
index 881704be2a254..e2289e3a30cca 100644
--- a/lib/backend/key.go
+++ b/lib/backend/key.go
@@ -41,8 +41,14 @@ const (
 // NewKey joins parts into path separated by [Separator],
 // makes sure path always starts with [Separator].
 func NewKey(components ...string) Key {
-	k := internalKey("", components...)
-	k.exactKey = k.s != "" && k.s[len(k.s)-1] == Separator
+	if len(components) < 1 {
+		return Key{}
+	}
+	k := Key{
+		components: slices.Clone(components),
+	}
+	k.s = SeparatorString + strings.Join(k.components, SeparatorString)
+	k.exactKey = k.s[len(k.s)-1] == Separator
 	return k
 }
 
@@ -51,7 +57,10 @@ func NewKey(components ...string) Key {
 // math child paths and not other paths that have the resulting path
 // as a prefix.
 func ExactKey(components ...string) Key {
-	k := NewKey(append(components, "")...)
+	k := Key{
+		components: slices.Concat(components, []string{""}),
+	}
+	k.s = SeparatorString + strings.Join(k.components, SeparatorString)
 	k.exactKey = true
 	return k
 }
@@ -69,7 +78,7 @@ func KeyFromString(s string) Key {
 		components: components,
 		s:          s,
 		exactKey:   s == SeparatorString || (s != "" && s[len(s)-1] == Separator),
-		noEnd:      s == string(noEnd),
+		noEnd:      s == noEnd,
 	}
 }
 
@@ -77,13 +86,6 @@ func (k Key) IsZero() bool {
 	return len(k.components) == 0 && k.s == ""
 }
 
-func internalKey(internalPrefix string, components ...string) Key {
-	return Key{
-		components: components,
-		s:          strings.Join(append([]string{internalPrefix}, components...), SeparatorString),
-	}
-}
-
 // ExactKey appends a [Separator] to the key, if one does not already
 // exist. This is to ensure range matching of a path will only
 // math child paths and not other paths that have the resulting path
@@ -100,7 +102,7 @@ func (k Key) ExactKey() Key {
 // each component concatenated together via the [Separator].
 func (k Key) String() string {
 	if k.noEnd {
-		return string(noEnd)
+		return noEnd
 	}
 
 	return k.s
@@ -130,10 +132,10 @@ func (k Key) PrependKey(p Key) Key {
 	}
 
 	newKey := Key{
-		components: append(slices.Clone(p.components), k.components...),
+		components: slices.Concat(p.components, k.components),
 	}
 	if strings.HasPrefix(p.s, SeparatorString) {
-		newKey.s = strings.Join(append([]string{""}, newKey.components...), SeparatorString)
+		newKey.s = SeparatorString + strings.Join(newKey.components, SeparatorString)
 	} else {
 		newKey.s = strings.Join(newKey.components, SeparatorString)
 	}
@@ -149,10 +151,10 @@ func (k Key) AppendKey(p Key) Key {
 	}
 
 	newKey := Key{
-		components: append(k.components, slices.Clone(p.components)...),
+		components: slices.Concat(k.components, p.components),
 	}
 	if strings.HasPrefix(k.s, SeparatorString) {
-		newKey.s = strings.Join(append([]string{""}, newKey.components...), SeparatorString)
+		newKey.s = SeparatorString + strings.Join(newKey.components, SeparatorString)
 	} else {
 		newKey.s = strings.Join(newKey.components, SeparatorString)
 	}
diff --git a/lib/backend/key_test.go b/lib/backend/key_test.go
index fe764902db042..9ac5fb63e3d09 100644
--- a/lib/backend/key_test.go
+++ b/lib/backend/key_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/backend"
 )
@@ -491,6 +492,29 @@ func TestKeyAppendKey(t *testing.T) {
 	}
 }
 
+// TestKeyAppendKeyNoOverwrite checks that the mutable storage of [backend.Key]
+// is not shared between objects after using [backend.Key.AppendKey].
+func TestKeyAppendKeyNoOverwrite(t *testing.T) {
+	var components []string
+	for range 3 {
+		components = append(components, "a")
+	}
+	k := backend.NewKey(components...)
+
+	k1 := k.AppendKey(backend.NewKey("b"))
+	require.Equal(t, "/a/a/a/b", k1.String())
+
+	// a previous implementation had a bug where AppendKey could modify the
+	// underlying array of the slice of components of k which would be then
+	// shared between future invocations of AppendKey...
+	_ = k.AppendKey(backend.NewKey("c"))
+
+	// ...so that further AppendKey might end up using the modified components
+	// slice - in this case, a "c" would appear in the components
+	k2 := k1.AppendKey(backend.NewKey("b"))
+	require.Equal(t, "/a/a/a/b/b", k2.String())
+}
+
 func TestKeyCompare(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/lib/backend/kubernetes/kubernetes.go b/lib/backend/kubernetes/kubernetes.go
index e2b2b40d59e4c..c801ed57a96b0 100644
--- a/lib/backend/kubernetes/kubernetes.go
+++ b/lib/backend/kubernetes/kubernetes.go
@@ -30,8 +30,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	applyconfigv1 "k8s.io/client-go/applyconfigurations/core/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/util/retry"
 
 	"github.com/gravitational/teleport/lib/backend"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
@@ -117,17 +117,17 @@ type Backend struct {
 }
 
 // New returns a new instance of Kubernetes Secret identity backend storage.
-func New() (*Backend, error) {
+func New(ctx context.Context) (*Backend, error) {
 	restClient, _, err := kubeutils.GetKubeClient("")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return NewWithClient(restClient)
+	return NewWithClient(ctx, restClient)
 }
 
 // NewWithClient returns a new instance of Kubernetes Secret identity backend storage with the provided client.
-func NewWithClient(restClient kubernetes.Interface) (*Backend, error) {
+func NewWithClient(ctx context.Context, restClient kubernetes.Interface) (*Backend, error) {
 	for _, env := range []string{teleportReplicaNameEnv, NamespaceEnv} {
 		if len(os.Getenv(env)) == 0 {
 			return nil, trace.BadParameter("environment variable %q not set or empty", env)
@@ -135,6 +135,7 @@ func NewWithClient(restClient kubernetes.Interface) (*Backend, error) {
 	}
 
 	return NewWithConfig(
+		ctx,
 		Config{
 			Namespace: os.Getenv(NamespaceEnv),
 			SecretName: fmt.Sprintf(
@@ -152,19 +153,19 @@ func NewWithClient(restClient kubernetes.Interface) (*Backend, error) {
 // NewShared returns a new instance of the kuberentes shared secret store (equivalent to New() except that
 // this backend can be written to by any teleport agent within the helm release. used for propagating relevant state
 // to controllers).
-func NewShared() (*Backend, error) {
+func NewShared(ctx context.Context) (*Backend, error) {
 	restClient, _, err := kubeutils.GetKubeClient("")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return NewSharedWithClient(restClient)
+	return NewSharedWithClient(ctx, restClient)
 }
 
 // NewSharedWithClient returns a new instance of the shared kubernetes secret store with the provided client (equivalent
 // to NewWithClient() except that this backend can be written to by any teleport agent within the helm release. used for propagating
 // relevant state to controllers).
-func NewSharedWithClient(restClient kubernetes.Interface) (*Backend, error) {
+func NewSharedWithClient(ctx context.Context, restClient kubernetes.Interface) (*Backend, error) {
 	if os.Getenv(NamespaceEnv) == "" {
 		return nil, trace.BadParameter("environment variable %q not set or empty", NamespaceEnv)
 	}
@@ -172,10 +173,11 @@ func NewSharedWithClient(restClient kubernetes.Interface) (*Backend, error) {
 	ident := os.Getenv(ReleaseNameEnv)
 	if ident == "" {
 		ident = "teleport"
-		slog.WarnContext(context.Background(), "Var RELEASE_NAME is not set, falling back to default identifier teleport for shared store.")
+		slog.WarnContext(ctx, "Var RELEASE_NAME is not set, falling back to default identifier teleport for shared store.")
 	}
 
 	return NewWithConfig(
+		ctx,
 		Config{
 			Namespace: os.Getenv(NamespaceEnv),
 			SecretName: fmt.Sprintf(
@@ -191,15 +193,23 @@ func NewSharedWithClient(restClient kubernetes.Interface) (*Backend, error) {
 }
 
 // NewWithConfig returns a new instance of Kubernetes Secret identity backend storage with the provided config.
-func NewWithConfig(conf Config) (*Backend, error) {
+// Ensures that the secret exists.
+func NewWithConfig(ctx context.Context, conf Config) (*Backend, error) {
 	if err := conf.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	return &Backend{
+	b := &Backend{
 		Config: conf,
-		mu:     sync.Mutex{},
-	}, nil
+	}
+	if b.Exists(ctx) {
+		return b, nil
+	}
+	// NOTE: This will trigger an actual Create() since we don't have a resource version set.
+	// If we have an AlreadyExists error, discard it and move on as it can happen with rapid restarts/rollouts/agent name collisions.
+	if err := b.createSecret(ctx); err != nil && !kubeerrors.IsAlreadyExists(trace.Unwrap(err)) {
+		return nil, trace.Wrap(err)
+	}
+	return b, nil
 }
 
 func (b *Backend) GetName() string {
@@ -233,7 +243,7 @@ func (b *Backend) Create(ctx context.Context, i backend.Item) (*backend.Lease, e
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
-	return b.updateSecretContent(ctx, i)
+	return b.updateSecretContent(ctx, true, i)
 }
 
 // Put puts value into backend (creates if it does not exist, updates it otherwise)
@@ -241,7 +251,7 @@ func (b *Backend) Put(ctx context.Context, i backend.Item) (*backend.Lease, erro
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
-	return b.updateSecretContent(ctx, i)
+	return b.updateSecretContent(ctx, false, i)
 }
 
 // getSecret reads the secret from K8S API.
@@ -277,51 +287,58 @@ func (b *Backend) readSecretData(ctx context.Context, key backend.Key) (*backend
 	}, nil
 }
 
-func (b *Backend) updateSecretContent(ctx context.Context, items ...backend.Item) (*backend.Lease, error) {
+func isConflict(err error) bool { return kubeerrors.IsConflict(trace.Unwrap(err)) }
+
+// updateSecretContent updates individual key in the secret data map.
+func (b *Backend) updateSecretContent(ctx context.Context, isCreate bool, item backend.Item) (*backend.Lease, error) {
 	// FIXME(tigrato):
 	// for now, the agent is the owner of the secret so it's safe to replace changes
 
-	secret, err := b.getSecret(ctx)
-	if trace.IsNotFound(err) {
-		secret = b.genSecretObject()
-	} else if err != nil {
-		return nil, trace.Wrap(err)
-	}
+	if err := retry.OnError(retry.DefaultRetry, isConflict, func() error {
+		// NOTE: We create the secret in the constructor, so we know it exists at this point.
+		secret, err := b.getSecret(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	if secret.Data == nil {
-		secret.Data = map[string][]byte{}
-	}
+		if secret.Data == nil {
+			secret.Data = map[string][]byte{}
+		}
+
+		k := backendKeyToSecret(item.Key)
+		// If the isCreate flag is set, fail if the key already exists.
+		if _, exists := secret.Data[k]; isCreate && exists {
+			// NOTE: This will not trigger a retry.
+			return trace.AlreadyExists("key %q already exists in secret %s", item.Key, b.SecretName)
+		}
+		secret.Data[k] = item.Value
 
-	updateDataMap(secret.Data, items...)
+		if err := b.updateSecret(ctx, secret); err != nil {
+			return trace.Wrap(err)
+		}
 
-	if err := b.upsertSecret(ctx, secret); err != nil {
+		return nil
+	}); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return &backend.Lease{}, nil
 }
 
-func (b *Backend) upsertSecret(ctx context.Context, secret *corev1.Secret) error {
-	secretApply := applyconfigv1.Secret(b.SecretName, b.Namespace).
-		WithData(secret.Data).
-		WithLabels(secret.GetLabels()).
-		WithAnnotations(secret.GetAnnotations())
-
-	// apply resource lock if it's not a creation
-	if len(secret.ResourceVersion) > 0 {
-		secretApply = secretApply.WithResourceVersion(secret.ResourceVersion)
+// updateSecret updates the secret resource in Kubernetes.
+func (b *Backend) updateSecret(ctx context.Context, secret *corev1.Secret) error {
+	if secret.ResourceVersion == "" {
+		return trace.BadParameter("missing resource version")
 	}
-
-	_, err := b.KubeClient.
-		CoreV1().
-		Secrets(b.Namespace).
-		Apply(ctx, secretApply, metav1.ApplyOptions{FieldManager: b.FieldManager})
-
-	return trace.Wrap(err)
+	if _, err := b.KubeClient.CoreV1().Secrets(b.Namespace).Update(ctx, secret, metav1.UpdateOptions{FieldManager: b.FieldManager}); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
 }
 
-func (b *Backend) genSecretObject() *corev1.Secret {
-	return &corev1.Secret{
+// createSecret creates the secret resource in Kubernetes.
+func (b *Backend) createSecret(ctx context.Context) error {
+	secret := &corev1.Secret{
 		Type: corev1.SecretTypeOpaque,
 		ObjectMeta: metav1.ObjectMeta{
 			Name:        b.SecretName,
@@ -330,6 +347,10 @@ func (b *Backend) genSecretObject() *corev1.Secret {
 		},
 		Data: map[string][]byte{},
 	}
+	if _, err := b.KubeClient.CoreV1().Secrets(b.Namespace).Create(ctx, secret, metav1.CreateOptions{FieldManager: b.FieldManager}); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
 }
 
 func generateSecretAnnotations(namespace, releaseNameEnv string) map[string]string {
@@ -355,9 +376,3 @@ func generateSecretAnnotations(namespace, releaseNameEnv string) map[string]stri
 func backendKeyToSecret(k backend.Key) string {
 	return strings.ReplaceAll(k.String(), string(backend.Separator), ".")
 }
-
-func updateDataMap(data map[string][]byte, items ...backend.Item) {
-	for _, item := range items {
-		data[backendKeyToSecret(item.Key)] = item.Value
-	}
-}
diff --git a/lib/backend/kubernetes/kubernetes_test.go b/lib/backend/kubernetes/kubernetes_test.go
index b25f7f2f103a5..24ce359e90797 100644
--- a/lib/backend/kubernetes/kubernetes_test.go
+++ b/lib/backend/kubernetes/kubernetes_test.go
@@ -19,7 +19,6 @@
 package kubernetes
 
 import (
-	"context"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -47,16 +46,6 @@ func TestBackend_Exists(t *testing.T) {
 		want    bool
 		wantErr bool
 	}{
-		{
-			name: "secret does not exist",
-			fields: fields{
-				objects:     nil,
-				namespace:   "test",
-				replicaName: "agent-0",
-			},
-			want:    false,
-			wantErr: false,
-		},
 		{
 			name: "secret exists",
 			fields: fields{
@@ -94,6 +83,8 @@ func TestBackend_Exists(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+
 			// set namespace env variable
 			if len(tt.fields.namespace) > 0 {
 				t.Setenv(NamespaceEnv, tt.fields.namespace)
@@ -105,14 +96,14 @@ func TestBackend_Exists(t *testing.T) {
 			}
 
 			k8sClient := fake.NewSimpleClientset(tt.fields.objects...)
-			b, err := NewWithClient(k8sClient)
+			b, err := NewWithClient(ctx, k8sClient)
 			if err != nil && !tt.wantErr {
 				require.NoError(t, err)
 			} else if err != nil && tt.wantErr {
 				return
 			}
 
-			require.Equal(t, tt.want, b.Exists(context.TODO()))
+			require.Equal(t, tt.want, b.Exists(ctx))
 		})
 	}
 }
@@ -231,6 +222,8 @@ func TestBackend_Get(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+
 			if len(tt.fields.namespace) > 0 {
 				t.Setenv(NamespaceEnv, tt.fields.namespace)
 			}
@@ -240,10 +233,10 @@ func TestBackend_Get(t *testing.T) {
 			}
 
 			k8sClient := fake.NewSimpleClientset(tt.fields.objects...)
-			b, err := NewWithClient(k8sClient)
+			b, err := NewWithClient(ctx, k8sClient)
 			require.NoError(t, err)
 
-			got, err := b.Get(context.TODO(), tt.args.key)
+			got, err := b.Get(ctx, tt.args.key)
 			if (err != nil) && (!trace.IsNotFound(err) || !tt.wantNotFound) {
 				require.NoError(t, err)
 				return
@@ -274,27 +267,6 @@ func TestBackend_Put(t *testing.T) {
 		args   args
 		want   *corev1.Secret
 	}{
-		{
-			name: "secret does not exist and should be created",
-			fields: fields{
-				objects:     nil,
-				namespace:   "test",
-				replicaName: "agent-0",
-			},
-			args: args{
-				item: backend.Item{
-					Key:   backend.NewKey("ids", "kube", "current"),
-					Value: payloadTestData,
-				},
-			},
-			want: newSecret(
-				"agent-0-state",
-				"test",
-				map[string][]byte{
-					backendKeyToSecret(backend.NewKey("ids", "kube", "current")): payloadTestData,
-				},
-			),
-		},
 		{
 			name: "secret exists and has keys",
 			args: args{
@@ -328,6 +300,8 @@ func TestBackend_Put(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+
 			// set namespace env var
 			if len(tt.fields.namespace) > 0 {
 				t.Setenv(NamespaceEnv, tt.fields.namespace)
@@ -338,9 +312,12 @@ func TestBackend_Put(t *testing.T) {
 				t.Setenv(teleportReplicaNameEnv, tt.fields.replicaName)
 			}
 
+			for _, o := range tt.fields.objects {
+				o.(*corev1.Secret).ResourceVersion = "1"
+			}
 			k8sClient := fake.NewSimpleClientset(tt.fields.objects...)
 
-			b, err := NewWithClient(k8sClient)
+			b, err := NewWithClient(ctx, k8sClient)
 			require.NoError(t, err)
 
 			// k8s fake client does not support apply operations,
@@ -386,12 +363,13 @@ func TestBackend_Put(t *testing.T) {
 				},
 			)
 			// Put upserts the content in the secret
-			_, err = b.Put(context.TODO(), tt.args.item)
+			_, err = b.Put(ctx, tt.args.item)
 			require.NoError(t, err)
 
 			// get secret loads the kubernetes secret to compare.
-			got, err := b.getSecret(context.TODO())
+			got, err := b.getSecret(ctx)
 			require.NoError(t, err)
+			got.ResourceVersion = tt.want.ResourceVersion // ignore resource version
 			require.Equal(t, tt.want, got)
 		})
 	}
diff --git a/lib/backend/lite/lite_test.go b/lib/backend/lite/lite_test.go
index e3383b3082802..76ab1a6c6998d 100644
--- a/lib/backend/lite/lite_test.go
+++ b/lib/backend/lite/lite_test.go
@@ -30,12 +30,12 @@ import (
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/backend/lock.go b/lib/backend/lock.go
index ce36ec36e97e1..42254c143c8c0 100644
--- a/lib/backend/lock.go
+++ b/lib/backend/lock.go
@@ -40,6 +40,7 @@ func lockKey(parts ...string) Key {
 		components: append([]string{locksPrefix}, parts...),
 	}
 	key.s = strings.Join(key.components, SeparatorString)
+	key.exactKey = key.s[len(key.s)-1] == Separator
 
 	return key
 }
diff --git a/lib/backend/memory/memory_test.go b/lib/backend/memory/memory_test.go
index 442b97343a0ee..31a2c9faae2dc 100644
--- a/lib/backend/memory/memory_test.go
+++ b/lib/backend/memory/memory_test.go
@@ -19,24 +19,20 @@
 package memory
 
 import (
-	"context"
 	"os"
-	"strconv"
-	"strings"
 	"testing"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -68,63 +64,3 @@ func TestMemory(t *testing.T) {
 
 	test.RunBackendComplianceSuite(t, newBackend)
 }
-
-func TestIterateRange(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	bk, err := New(Config{})
-	require.NoError(t, err)
-
-	// set up a generic bulk range to iterate
-	expectedKeys := make(map[string]struct{})
-	for i := 0; i < 500; i++ {
-		key := backend.NewKey("bulk", strconv.Itoa(i))
-		expectedKeys[key.String()] = struct{}{}
-
-		_, err = bk.Put(ctx, backend.Item{
-			Key:   key,
-			Value: []byte("v"),
-		})
-		require.NoError(t, err)
-	}
-
-	// check that observed range members match expectations
-	observedKeys := make(map[string]struct{})
-	err = backend.IterateRange(ctx, bk, backend.ExactKey("bulk"), backend.RangeEnd(backend.ExactKey("bulk")), 3, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			key := item.Key.String()
-
-			_, dup := observedKeys[key]
-			require.False(t, dup, "duplicate of %q", key)
-
-			_, exp := expectedKeys[key]
-			require.True(t, exp, "unexpected key %q", key)
-
-			observedKeys[key] = struct{}{}
-		}
-
-		return false, nil
-	})
-	require.NoError(t, err)
-	require.Equal(t, expectedKeys, observedKeys)
-
-	// set up a collection of keys that are suffixes of one another (ensures we aren't suffering from the classic 'pagination bug', where
-	// page breaks landing on some key K skip subsequent keys with prefix K).
-	for i := 0; i < 20; i++ {
-		_, err = bk.Put(ctx, backend.Item{
-			Key:   backend.NewKey("suff", strings.Repeat("s", i+1)),
-			Value: []byte("s"),
-		})
-
-		require.NoError(t, err)
-	}
-
-	var scount int
-	err = backend.IterateRange(ctx, bk, backend.ExactKey("suff"), backend.RangeEnd(backend.ExactKey("suff")), 2, func(items []backend.Item) (stop bool, err error) {
-		scount += len(items)
-		return false, nil
-	})
-	require.NoError(t, err)
-	require.Equal(t, 20, scount)
-}
diff --git a/lib/backend/pgbk/atomicwrite.go b/lib/backend/pgbk/atomicwrite.go
index aaaada25d68a9..20e60d050919c 100644
--- a/lib/backend/pgbk/atomicwrite.go
+++ b/lib/backend/pgbk/atomicwrite.go
@@ -26,6 +26,7 @@ import (
 	"github.com/jackc/pgx/v5/pgtype/zeronull"
 
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 	pgcommon "github.com/gravitational/teleport/lib/backend/pgbk/common"
 )
 
@@ -131,7 +132,7 @@ func (b *Backend) AtomicWrite(ctx context.Context, condacts []backend.Conditiona
 	})
 
 	if attempts > 1 {
-		backend.AtomicWriteContention.WithLabelValues(b.GetName()).Add(float64(attempts - 1))
+		backendmetrics.AtomicWriteContention.WithLabelValues(b.GetName()).Add(float64(attempts - 1))
 	}
 
 	if attempts > 2 {
diff --git a/lib/backend/pgbk/common/auth_test.go b/lib/backend/pgbk/common/auth_test.go
index c67eb68e87fdd..b72447d800840 100644
--- a/lib/backend/pgbk/common/auth_test.go
+++ b/lib/backend/pgbk/common/auth_test.go
@@ -27,11 +27,11 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/backend/pgbk/common/reload.go b/lib/backend/pgbk/common/reload.go
new file mode 100644
index 0000000000000..90beaa8059b0e
--- /dev/null
+++ b/lib/backend/pgbk/common/reload.go
@@ -0,0 +1,88 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package pgcommon
+
+import (
+	"context"
+	"crypto/x509"
+	"log/slog"
+	"net/url"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jackc/pgx/v5"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils/certreloader"
+)
+
+// CreateClientCertReloader creates a client reloader for postgres compatible connections. The
+// connString is expected to be in a url format. This updates the connConfig to use the created reloader
+func CreateClientCertReloader(ctx context.Context, name, connString string, connConfig *pgx.ConnConfig, reloadInterval time.Duration, expiry prometheus.Gauge) error {
+	u, err := url.Parse(connString)
+	if err != nil {
+		return trace.Wrap(err, "the connection string must be in url format when a reload interval is set")
+	}
+	vals := u.Query()
+
+	var callback func(string, *x509.Certificate)
+	if expiry != nil {
+		callback = func(path string, cert *x509.Certificate) {
+			expiry.Set(float64(cert.NotAfter.Unix()))
+		}
+	}
+
+	privateKey := vals.Get("sslkey")
+	certificate := vals.Get("sslcert")
+	if privateKey == "" || certificate == "" {
+		return trace.Errorf("certificate reloading enabled but sslcert or sslkey not present in connection string")
+	}
+	reloader := certreloader.New(certreloader.Config{
+		KeyPairs: []servicecfg.KeyPairPath{
+			{
+				PrivateKey:  privateKey,
+				Certificate: certificate,
+			},
+		},
+		KeyPairsReloadInterval: reloadInterval,
+	},
+		slog.With(teleport.ComponentKey, teleport.Component(teleport.Component(teleport.ComponentAuth, "certreloader"), "name", name)), callback)
+	if err := reloader.Run(ctx); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// When reload is enabled we need to check all the fallbacks as well as the main config because
+	// of how sslmode is handled where the main config could be plaintext and falls back to a TLS
+	// connection
+	if connConfig.TLSConfig != nil {
+		connConfig.TLSConfig.Certificates = nil
+		connConfig.TLSConfig.GetClientCertificate = reloader.GetClientCertificate
+	}
+
+	for i, fallback := range connConfig.Fallbacks {
+		if fallback.TLSConfig != nil {
+			connConfig.Fallbacks[i].TLSConfig.Certificates = nil
+			connConfig.Fallbacks[i].TLSConfig.GetClientCertificate = reloader.GetClientCertificate
+		}
+	}
+
+	return nil
+}
diff --git a/lib/backend/pgbk/pgbk_test.go b/lib/backend/pgbk/pgbk_test.go
index fe4e66d439144..dbe988859fe85 100644
--- a/lib/backend/pgbk/pgbk_test.go
+++ b/lib/backend/pgbk/pgbk_test.go
@@ -30,12 +30,12 @@ import (
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/backend/report.go b/lib/backend/report.go
index f061a2c8822de..feccc8a57814d 100644
--- a/lib/backend/report.go
+++ b/lib/backend/report.go
@@ -23,7 +23,6 @@ import (
 	"errors"
 	"iter"
 	"log/slog"
-	"math"
 	"slices"
 	"strings"
 	"time"
@@ -38,7 +37,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/observability/metrics"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -57,6 +56,8 @@ type ReporterConfig struct {
 	TopRequestsCount int
 	// Tracer is used to create spans
 	Tracer oteltrace.Tracer
+	// Registerer is used to register prometheus metrics.
+	Registerer prometheus.Registerer
 }
 
 // CheckAndSetDefaults checks and sets
@@ -73,6 +74,9 @@ func (r *ReporterConfig) CheckAndSetDefaults() error {
 	if r.Tracer == nil {
 		r.Tracer = tracing.NoopTracer(teleport.ComponentBackend)
 	}
+	if r.Registerer == nil {
+		r.Registerer = prometheus.DefaultRegisterer
+	}
 	return nil
 }
 
@@ -97,18 +101,17 @@ type Reporter struct {
 
 // NewReporter returns a new Reporter.
 func NewReporter(cfg ReporterConfig) (*Reporter, error) {
-	err := metrics.RegisterPrometheusCollectors(prometheusCollectors...)
-	if err != nil {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := cfg.CheckAndSetDefaults(); err != nil {
+	if err := backendmetrics.RegisterCollectors(cfg.Registerer); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	cache, err := lru.NewWithEvict(cfg.TopRequestsCount, func(labels topRequestsCacheKey, value struct{}) {
 		// Evict the key from requests metric.
-		requests.DeleteLabelValues(labels.component, labels.key, labels.isRange)
+		backendmetrics.Requests.DeleteLabelValues(labels.component, labels.key, labels.isRange)
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -140,12 +143,12 @@ func (s *Reporter) GetRange(ctx context.Context, startKey, endKey Key, limit int
 
 	start := s.Clock().Now()
 	res, err := s.Backend.GetRange(ctx, startKey, endKey, limit)
-	batchReadLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	batchReadRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.BatchReadLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.BatchReadRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		batchReadRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.BatchReadRequestsFailed.WithLabelValues(s.Component).Inc()
 	} else {
-		reads.WithLabelValues(s.Component).Add(float64(len(res.Items)))
+		backendmetrics.Reads.WithLabelValues(s.Component).Add(float64(len(res.Items)))
 	}
 	s.trackRequest(ctx, types.OpGet, startKey, endKey)
 	end := s.Clock().Now()
@@ -173,13 +176,13 @@ func (s *Reporter) Items(ctx context.Context, params ItemsParams) iter.Seq2[Item
 		var count int
 		defer func() {
 			s.trackRequest(ctx, types.OpGet, params.StartKey, params.EndKey)
-			streamingRequests.WithLabelValues(s.Component).Inc()
-			reads.WithLabelValues(s.Component).Add(float64(count))
+			backendmetrics.StreamingRequests.WithLabelValues(s.Component).Inc()
+			backendmetrics.Reads.WithLabelValues(s.Component).Add(float64(count))
 
 		}()
 		for item, err := range s.Backend.Items(ctx, params) {
 			if err != nil {
-				streamingRequestsFailed.WithLabelValues(s.Component).Inc()
+				backendmetrics.StreamingRequestsFailed.WithLabelValues(s.Component).Inc()
 			}
 
 			count++
@@ -204,15 +207,15 @@ func (s *Reporter) Create(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Create(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsAlreadyExists(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, i.Key, Key{})
 	return lease, err
@@ -233,17 +236,43 @@ func (s *Reporter) Put(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Put(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, i.Key, Key{})
 	return lease, err
 }
 
+// PutBatch puts multiple values into backend.
+func (s *Reporter) PutBatch(ctx context.Context, items []Item) ([]string, error) {
+	ctx, span := s.Tracer.Start(
+		ctx,
+		"backend/PutBatch",
+		oteltrace.WithAttributes(
+			attribute.Int("batch_size", len(items)),
+		),
+	)
+	defer span.End()
+
+	start := s.Clock().Now()
+	revisions, err := PutBatch(ctx, s.Backend, items)
+	backendmetrics.BatchWriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.BatchWriteRequests.WithLabelValues(s.Component).Inc()
+	if err != nil {
+		backendmetrics.BatchWriteRequestsFailed.WithLabelValues(s.Component).Inc()
+	} else {
+		backendmetrics.Writes.WithLabelValues(s.Component).Add(float64(len(items)))
+	}
+	for _, item := range items {
+		s.trackRequest(ctx, types.OpPut, item.Key, Key{})
+	}
+	return revisions, err
+}
+
 // Update updates value in the backend
 func (s *Reporter) Update(ctx context.Context, i Item) (*Lease, error) {
 	ctx, span := s.Tracer.Start(
@@ -258,15 +287,15 @@ func (s *Reporter) Update(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Update(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsNotFound(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, i.Key, Key{})
 	return lease, err
@@ -286,15 +315,15 @@ func (s *Reporter) ConditionalUpdate(ctx context.Context, i Item) (*Lease, error
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.ConditionalUpdate(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if errors.Is(err, ErrIncorrectRevision) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, i.Key, Key{})
 	return lease, err
@@ -313,11 +342,11 @@ func (s *Reporter) Get(ctx context.Context, key Key) (*Item, error) {
 
 	start := s.Clock().Now()
 	item, err := s.Backend.Get(ctx, key)
-	readLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	readRequests.WithLabelValues(s.Component).Inc()
-	reads.WithLabelValues(s.Component).Inc()
+	backendmetrics.ReadLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.ReadRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.Reads.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
-		readRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.ReadRequestsFailed.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpGet, key, Key{})
 	return item, err
@@ -337,15 +366,15 @@ func (s *Reporter) CompareAndSwap(ctx context.Context, expected Item, replaceWit
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.CompareAndSwap(ctx, expected, replaceWith)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsNotFound(err) || trace.IsCompareFailed(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, expected.Key, Key{})
 	return lease, err
@@ -364,15 +393,15 @@ func (s *Reporter) Delete(ctx context.Context, key Key) error {
 
 	start := s.Clock().Now()
 	err := s.Backend.Delete(ctx, key)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsNotFound(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpDelete, key, Key{})
 	return err
@@ -392,15 +421,15 @@ func (s *Reporter) ConditionalDelete(ctx context.Context, key Key, revision stri
 
 	start := s.Clock().Now()
 	err := s.Backend.ConditionalDelete(ctx, key, revision)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsNotFound(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpDelete, key, Key{})
 	return err
@@ -424,18 +453,18 @@ func (s *Reporter) AtomicWrite(ctx context.Context, condacts []ConditionalAction
 	revision, err = s.Backend.AtomicWrite(ctx, condacts)
 
 	elapsed := s.Clock().Since(start).Seconds()
-	writeLatencies.WithLabelValues(s.Component).Observe(elapsed)
-	atomicWriteLatencies.WithLabelValues(s.Component).Observe(elapsed)
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(elapsed)
+	backendmetrics.AtomicWriteLatencies.WithLabelValues(s.Component).Observe(elapsed)
 
-	writeRequests.WithLabelValues(s.Component).Inc()
-	atomicWriteRequests.WithLabelValues(s.Component).Inc()
-	atomicWriteSize.WithLabelValues(s.Component).Observe(float64(len(condacts)))
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.AtomicWriteRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.AtomicWriteSize.WithLabelValues(s.Component).Observe(float64(len(condacts)))
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
-		atomicWriteRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.AtomicWriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if errors.Is(err, ErrConditionFailed) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
-			atomicWriteConditionFailed.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.AtomicWriteConditionFailed.WithLabelValues(s.Component).Inc()
 		}
 	}
 
@@ -454,7 +483,7 @@ func (s *Reporter) AtomicWrite(ctx context.Context, condacts []ConditionalAction
 	}
 
 	if err == nil {
-		writes.WithLabelValues(s.Component).Add(float64(writeTotal))
+		backendmetrics.Writes.WithLabelValues(s.Component).Add(float64(writeTotal))
 	}
 	return
 }
@@ -473,10 +502,10 @@ func (s *Reporter) DeleteRange(ctx context.Context, startKey, endKey Key) error
 
 	start := s.Clock().Now()
 	err := s.Backend.DeleteRange(ctx, startKey, endKey)
-	batchWriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	batchWriteRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.BatchWriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.BatchWriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
-		batchWriteRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.BatchWriteRequestsFailed.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpDelete, startKey, endKey)
 	return err
@@ -499,15 +528,15 @@ func (s *Reporter) KeepAlive(ctx context.Context, lease Lease, expires time.Time
 
 	start := s.Clock().Now()
 	err := s.Backend.KeepAlive(ctx, lease, expires)
-	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
-	writeRequests.WithLabelValues(s.Component).Inc()
+	backendmetrics.WriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
-		writeRequestsFailed.WithLabelValues(s.Component).Inc()
+		backendmetrics.WriteRequestsFailed.WithLabelValues(s.Component).Inc()
 		if trace.IsNotFound(err) {
-			writeRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
+			backendmetrics.WriteRequestsFailedPrecondition.WithLabelValues(s.Component).Inc()
 		}
 	} else {
-		writes.WithLabelValues(s.Component).Inc()
+		backendmetrics.Writes.WithLabelValues(s.Component).Inc()
 	}
 	s.trackRequest(ctx, types.OpPut, lease.Key, Key{})
 	return err
@@ -582,7 +611,7 @@ func (s *Reporter) trackRequest(ctx context.Context, opType types.OpType, key Ke
 		s.topRequestsCache.Get(cacheKey)
 	}
 
-	counter, err := requests.GetMetricWithLabelValues(s.Component, keyLabel, rangeSuffix)
+	counter, err := backendmetrics.Requests.GetMetricWithLabelValues(s.Component, keyLabel, rangeSuffix)
 	if err != nil {
 		slog.WarnContext(ctx, "Failed to get prometheus counter", "error", err)
 		return
@@ -665,8 +694,8 @@ func NewReporterWatcher(ctx context.Context, component string, w Watcher) *Repor
 }
 
 func (r *ReporterWatcher) watch(ctx context.Context) {
-	watchers.WithLabelValues(r.Component).Inc()
-	defer watchers.WithLabelValues(r.Component).Dec()
+	backendmetrics.Watchers.WithLabelValues(r.Component).Inc()
+	defer backendmetrics.Watchers.WithLabelValues(r.Component).Dec()
 	select {
 	case <-r.Done():
 		return
@@ -674,228 +703,3 @@ func (r *ReporterWatcher) watch(ctx context.Context) {
 		return
 	}
 }
-
-var (
-	requests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendRequests,
-			Help: "Number of requests to the backend (reads, writes, and keepalives)",
-		},
-		[]string{teleport.ComponentLabel, teleport.TagReq, teleport.TagRange},
-	)
-	watchers = prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: teleport.MetricBackendWatchers,
-			Help: "Number of active backend watchers",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	watcherQueues = prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: teleport.MetricBackendWatcherQueues,
-			Help: "Watcher queue sizes",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	writeRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendWriteRequests,
-			Help: "Number of write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	writes = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendWrites,
-			Help:      "Number of individual items written to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	writeRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendWriteFailedRequests,
-			Help: "Number of failed write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	writeRequestsFailedPrecondition = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendWriteFailedPreconditionRequests,
-			Help:      "Number of write requests that failed due to a precondition (existence, revision, value, etc)",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	atomicWriteRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteRequests,
-			Help:      "Number of atomic write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	atomicWriteRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteFailedRequests,
-			Help:      "Number of failed atomic write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	atomicWriteConditionFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteConditionFailed,
-			Help:      "Number of times an atomic write request results in condition failure",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	atomicWriteLatencies = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteHistogram,
-			Help:      "Latency for backend atomic write operations",
-			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
-			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
-			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	atomicWriteSize = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteSize,
-			Help:      "Atomic write batch size",
-			// buckets of the form 1, 2, 4, 8, 16, etc...
-			Buckets: prometheus.ExponentialBuckets(1, 2, int(math.Sqrt(MaxAtomicWriteSize))),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	AtomicWriteContention = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendAtomicWriteContention,
-			Help:      "Number of times atomic write requests experience contention",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchWriteRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendBatchWriteRequests,
-			Help: "Number of batch write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchWriteRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendBatchFailedWriteRequests,
-			Help: "Number of failed write requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	readRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendReadRequests,
-			Help: "Number of read requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	reads = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Name:      teleport.MetricBackendReads,
-			Help:      "Number of individual items read from the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	readRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendFailedReadRequests,
-			Help: "Number of failed read requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	streamingRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Subsystem: "backend",
-			Name:      "stream_requests",
-			Help:      "Number of inflight stream requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	streamingRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Namespace: teleport.MetricNamespace,
-			Subsystem: "backend",
-			Name:      "stream_requests_failed",
-			Help:      "Number of failed stream requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchReadRequests = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendBatchReadRequests,
-			Help: "Number of read requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchReadRequestsFailed = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: teleport.MetricBackendBatchFailedReadRequests,
-			Help: "Number of failed read requests to the backend",
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	writeLatencies = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name: teleport.MetricBackendWriteHistogram,
-			Help: "Latency for backend write operations",
-			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
-			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
-			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchWriteLatencies = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name: teleport.MetricBackendBatchWriteHistogram,
-			Help: "Latency for backend batch write operations",
-			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
-			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
-			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	batchReadLatencies = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name: teleport.MetricBackendBatchReadHistogram,
-			Help: "Latency for batch read operations",
-			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
-			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
-			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-	readLatencies = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name: teleport.MetricBackendReadHistogram,
-			Help: "Latency for read operations",
-			// lowest bucket start of upper bound 0.001 sec (1 ms) with factor 2
-			// highest bucket start of 0.001 sec * 2^15 == 32.768 sec
-			Buckets: prometheus.ExponentialBuckets(0.001, 2, 16),
-		},
-		[]string{teleport.ComponentLabel},
-	)
-
-	prometheusCollectors = []prometheus.Collector{
-		watchers, watcherQueues, requests, writeRequests,
-		writeRequestsFailed, batchWriteRequests, batchWriteRequestsFailed, readRequests,
-		readRequestsFailed, batchReadRequests, batchReadRequestsFailed, writeLatencies,
-		writeRequestsFailedPrecondition,
-		atomicWriteRequests, atomicWriteRequestsFailed, atomicWriteConditionFailed, atomicWriteLatencies,
-		AtomicWriteContention, atomicWriteSize, reads, writes,
-		batchWriteLatencies, batchReadLatencies, readLatencies,
-	}
-)
diff --git a/lib/backend/report_test.go b/lib/backend/report_test.go
index 41217fcf27213..42b79ba8a6825 100644
--- a/lib/backend/report_test.go
+++ b/lib/backend/report_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 )
 
 func TestReporterTopRequestsLimit(t *testing.T) {
@@ -44,7 +45,7 @@ func TestReporterTopRequestsLimit(t *testing.T) {
 	countTopRequests := func() int {
 		ch := make(chan prometheus.Metric)
 		go func() {
-			requests.Collect(ch)
+			backendmetrics.Requests.Collect(ch)
 			close(ch)
 		}()
 
@@ -54,7 +55,7 @@ func TestReporterTopRequestsLimit(t *testing.T) {
 		}
 		return int(count)
 	}
-	t.Cleanup(requests.Reset)
+	t.Cleanup(backendmetrics.Requests.Reset)
 
 	// At first, the metric should have no values.
 	require.Equal(t, 0, countTopRequests())
diff --git a/lib/backend/sanitize.go b/lib/backend/sanitize.go
index f5c31d1ea6c09..a0f0081ec8392 100644
--- a/lib/backend/sanitize.go
+++ b/lib/backend/sanitize.go
@@ -55,15 +55,14 @@ func isValidKeyByte(b byte) bool {
 
 // IsKeySafe checks if the passed in key conforms to whitelist
 func IsKeySafe(key Key) bool {
-	components := key.Components()
-	for i, k := range components {
+	for i, k := range key.components {
 		switch k {
-		case string(noEnd):
+		case noEnd:
 			continue
 		case ".", "..":
 			return false
 		case "":
-			return key.exactKey && i == len(components)-1
+			return key.exactKey && i == len(key.components)-1
 		}
 
 		for _, b := range []byte(k) {
@@ -121,6 +120,17 @@ func (s *Sanitizer) Put(ctx context.Context, i Item) (*Lease, error) {
 	return s.backend.Put(ctx, i)
 }
 
+// PutBatch puts multiple values into backend.
+func (s *Sanitizer) PutBatch(ctx context.Context, items []Item) ([]string, error) {
+	for _, item := range items {
+		if !IsKeySafe(item.Key) {
+			return nil, trace.BadParameter(errorMessage, item.Key)
+		}
+	}
+	out, err := PutBatch(ctx, s.backend, items)
+	return out, trace.Wrap(err)
+}
+
 // Update updates value in the backend
 func (s *Sanitizer) Update(ctx context.Context, i Item) (*Lease, error) {
 	if !IsKeySafe(i.Key) {
diff --git a/lib/backend/test/atomicwrite_shim.go b/lib/backend/test/atomicwrite_shim.go
index 9e93cbb07ad3f..0c1b9f479f4b1 100644
--- a/lib/backend/test/atomicwrite_shim.go
+++ b/lib/backend/test/atomicwrite_shim.go
@@ -139,7 +139,7 @@ func (a AtomicWriteShim) CompareAndSwap(ctx context.Context, expected backend.It
 		if err != nil {
 			if errors.Is(err, backend.ErrConditionFailed) {
 				// concurrent modification does not guarantee that the value was changed (may have been a redundant
-				// update or a keepalive), so we need to retry in order to determine wether or not the cas should
+				// update or a keepalive), so we need to retry in order to determine whether or not the cas should
 				// succeed.
 				continue
 			}
diff --git a/lib/backend/test/put_batch.go b/lib/backend/test/put_batch.go
new file mode 100644
index 0000000000000..a75779a32c8e3
--- /dev/null
+++ b/lib/backend/test/put_batch.go
@@ -0,0 +1,192 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package test
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
+)
+
+const (
+	watchInitTimeout  = 10 * time.Second
+	watchEventTimeout = 3 * time.Second
+)
+
+func runPutBatch(t *testing.T, newBackend Constructor) {
+	t.Helper()
+
+	bk, _, err := newBackend()
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = bk.Close() })
+
+	batcher, ok := bk.(backend.BatchPutter)
+	if !ok {
+		t.Skip("backend does not implement PutBatch; skipping PutBatch suite")
+	}
+
+	prefix := MakePrefix()
+	rangeStart := prefix("")
+	rangeEnd := backend.RangeEnd(prefix(""))
+
+	itemEqual := func(a, b backend.Item) bool {
+		return a.Key.Compare(b.Key) == 0 &&
+			a.Revision == b.Revision &&
+			bytes.Equal(a.Value, b.Value) &&
+			a.Expires.Equal(b.Expires)
+	}
+
+	assertItemsEqual := func(t *testing.T, want, got []backend.Item) {
+		t.Helper()
+		require.Len(t, want, len(got))
+		for i := range want {
+			require.True(t, itemEqual(want[i], got[i]))
+		}
+	}
+
+	buildWant := func(items []backend.Item, rev []string) []backend.Item {
+		out := make([]backend.Item, 0, len(items))
+		for i, it := range items {
+			out = append(out, backend.Item{
+				Key:      it.Key,
+				Value:    it.Value,
+				Revision: rev[i],
+				Expires:  it.Expires,
+			})
+		}
+		return out
+	}
+
+	newTestItems := func() []backend.Item {
+		return []backend.Item{
+			{Key: prefix("a"), Value: []byte("A"), Expires: time.Now().Add(1 * time.Hour)},
+			{Key: prefix("b"), Value: []byte("B")},
+			{Key: prefix("c"), Value: []byte("C"), Expires: time.Now().Add(2 * time.Hour)},
+		}
+	}
+	t.Run("put batch items should be propagated in event stream", func(t *testing.T) {
+		w, err := bk.NewWatcher(t.Context(), backend.Watch{})
+		require.NoError(t, err)
+		t.Cleanup(func() { w.Close() })
+
+		select {
+		case <-w.Done():
+			t.Fatal("watcher closed immediately")
+		case ev := <-w.Events():
+			require.Equal(t, types.OpInit, ev.Type)
+		}
+
+		items := newTestItems()
+		rev, err := batcher.PutBatch(t.Context(), items)
+		require.NoError(t, err)
+		require.NotEmpty(t, rev)
+
+		got := waitForEvents(t, w, len(items), watchEventTimeout)
+		want := buildWant(items, rev)
+		assertItemsEqual(t, want, got)
+		require.NoError(t, bk.DeleteRange(t.Context(), rangeStart, rangeEnd))
+	})
+
+	t.Run("put-create-update", func(t *testing.T) {
+		items := newTestItems()
+		rev1, err := batcher.PutBatch(t.Context(), items)
+		require.NoError(t, err)
+		require.NotEmpty(t, rev1)
+
+		res, err := bk.GetRange(t.Context(), rangeStart, rangeEnd, backend.NoLimit)
+		require.NoError(t, err)
+
+		want := buildWant(items, rev1)
+		got := res.Items
+		assertItemsEqual(t, want, got)
+
+		items[0].Value = []byte("A2")
+		items[1].Value = []byte("B2")
+		items[2].Value = []byte("C2")
+
+		rev2, err := batcher.PutBatch(t.Context(), items)
+		require.NoError(t, err)
+		require.NotEmpty(t, rev2)
+		require.NotEqual(t, rev1, rev2)
+
+		res, err = bk.GetRange(t.Context(), rangeStart, rangeEnd, backend.NoLimit)
+		require.NoError(t, err)
+
+		want = buildWant(items, rev2)
+		got = res.Items
+		assertItemsEqual(t, want, got)
+
+		require.NoError(t, bk.DeleteRange(t.Context(), rangeStart, rangeEnd))
+	})
+
+	t.Run("over-chunk-size", func(t *testing.T) {
+		const itemCount = 1000
+		const payloadSize = 300 * 1024 // 300 KiB
+		items := make([]backend.Item, 0, itemCount)
+		for i := 0; i < itemCount; i++ {
+			items = append(items, backend.Item{
+				Key:     prefix(fmt.Sprintf("item/%04d", i)),
+				Value:   bytes.Repeat([]byte("A"), payloadSize),
+				Expires: time.Now().Add(5 * time.Minute),
+			})
+		}
+
+		rev, err := batcher.PutBatch(t.Context(), items)
+		require.NoError(t, err)
+		require.NotEmpty(t, rev)
+
+		res, err := bk.GetRange(t.Context(), rangeStart, rangeEnd, backend.NoLimit)
+		require.NoError(t, err)
+
+		want := buildWant(items, rev)
+		got := res.Items
+		assertItemsEqual(t, want, got)
+
+		require.NoError(t, bk.DeleteRange(t.Context(), rangeStart, rangeEnd))
+	})
+}
+
+func waitForEvents(t *testing.T, w backend.Watcher, wantCount int, timeout time.Duration) []backend.Item {
+	t.Helper()
+
+	var out []backend.Item
+	deadline := time.NewTimer(timeout)
+	defer deadline.Stop()
+
+	for len(out) < wantCount {
+		select {
+		case ev, ok := <-w.Events():
+			if !ok {
+				t.Fatalf("watcher closed before receiving all events: got=%d want=%d", len(out), wantCount)
+			}
+			if ev.Type == types.OpPut {
+				out = append(out, ev.Item)
+			}
+		case <-w.Done():
+			t.Fatalf("watcher done before receiving all events: got=%d want=%d", len(out), wantCount)
+		}
+	}
+	return out
+}
diff --git a/lib/backend/test/suite.go b/lib/backend/test/suite.go
index d5a37ee726aa4..1be3ec3595c8e 100644
--- a/lib/backend/test/suite.go
+++ b/lib/backend/test/suite.go
@@ -198,6 +198,10 @@ func RunBackendComplianceSuite(t *testing.T, newBackend Constructor) {
 	t.Run("ConditionalDelete", func(t *testing.T) {
 		testConditionalDelete(t, newBackend)
 	})
+
+	t.Run("PutBatch", func(t *testing.T) {
+		runPutBatch(t, newBackend)
+	})
 }
 
 // RequireItems asserts that the supplied `actual` items collection matches
diff --git a/lib/backend/wrap.go b/lib/backend/wrap.go
index c89f33c12b37f..127c8002a431c 100644
--- a/lib/backend/wrap.go
+++ b/lib/backend/wrap.go
@@ -113,6 +113,11 @@ func (s *Wrapper) CompareAndSwap(ctx context.Context, expected Item, replaceWith
 	return s.backend.CompareAndSwap(ctx, expected, replaceWith)
 }
 
+// PutBatch puts multiple values into backend.
+func (s *Wrapper) PutBatch(ctx context.Context, items []Item) ([]string, error) {
+	return PutBatch(ctx, s.backend, items)
+}
+
 // Delete deletes item by key
 func (s *Wrapper) Delete(ctx context.Context, key Key) error {
 	return s.backend.Delete(ctx, key)
diff --git a/lib/bitbucket/bitbucket.go b/lib/bitbucket/bitbucket.go
deleted file mode 100644
index 1c4f3e16281dd..0000000000000
--- a/lib/bitbucket/bitbucket.go
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package bitbucket
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// IDTokenClaims
-// See the following for the structure:
-// https://support.atlassian.com/bitbucket-cloud/docs/integrate-pipelines-with-resource-servers-using-oidc/
-type IDTokenClaims struct {
-	oidc.TokenClaims
-
-	// Sub provides some information about the Bitbucket Pipelines run that
-	// generated this token. Format: {RepositoryUUID}:{StepUUID}
-	Sub string `json:"sub"`
-
-	// StepUUID is the UUID of the pipeline step for which this token was
-	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'
-	StepUUID string `json:"stepUuid"`
-
-	// RepositoryUUID is the UUID of the repository for which this token was
-	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'.
-	// This value may be found in the Pipelines -> OpenID Connect section of the
-	// repository settings.
-	RepositoryUUID string `json:"repositoryUuid"`
-
-	// PipelineUUID is the UUID of the pipeline for which this token was issued.
-	// Bitbucket UUIDs must begin and end with braces, e.g. '{...}'
-	PipelineUUID string `json:"pipelineUuid"`
-
-	// WorkspaceUUID is the UUID of the workspace for which this token was
-	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'.
-	// This value may be found in the Pipelines -> OpenID Connect section of the
-	// repository settings.
-	WorkspaceUUID string `json:"workspaceUuid"`
-
-	// DeploymentEnvironmentUUID is the name of the deployment environment for
-	// which this pipeline was executed. Bitbucket UUIDs must begin and end with
-	// braces, e.g. '{...}'.
-	DeploymentEnvironmentUUID string `json:"deploymentEnvironmentUuid"`
-
-	// BranchName is the name of the branch on which this pipeline executed.
-	BranchName string `json:"branchName"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsBitbucket {
-	return &workloadidentityv1pb.JoinAttrsBitbucket{
-		Sub:                       c.Sub,
-		StepUuid:                  c.StepUUID,
-		RepositoryUuid:            c.RepositoryUUID,
-		PipelineUuid:              c.PipelineUUID,
-		WorkspaceUuid:             c.WorkspaceUUID,
-		DeploymentEnvironmentUuid: c.DeploymentEnvironmentUUID,
-		BranchName:                c.BranchName,
-	}
-}
diff --git a/lib/boundkeypair/boundkeypairexperiment/experiment.go b/lib/boundkeypair/boundkeypairexperiment/experiment.go
deleted file mode 100644
index 09c014cfeb140..0000000000000
--- a/lib/boundkeypair/boundkeypairexperiment/experiment.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package boundkeypairexperiment
-
-import (
-	"os"
-	"strconv"
-	"sync"
-)
-
-var mu sync.Mutex
-
-var experimentEnabled, _ = strconv.ParseBool(os.Getenv("TELEPORT_UNSTABLE_BOUND_KEYPAIR_JOINING_EXPERIMENT"))
-
-// Enabled returns true if the bound keypair joining experiment is enabled.
-func Enabled() bool {
-	mu.Lock()
-	defer mu.Unlock()
-
-	return experimentEnabled
-}
-
-// SetEnabled sets the experiment enabled flag.
-func SetEnabled(enabled bool) {
-	mu.Lock()
-	defer mu.Unlock()
-
-	experimentEnabled = enabled
-}
diff --git a/lib/boundkeypair/claims.go b/lib/boundkeypair/claims.go
new file mode 100644
index 0000000000000..788776dc1e357
--- /dev/null
+++ b/lib/boundkeypair/claims.go
@@ -0,0 +1,32 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package boundkeypair
+
+// Claims contains extended claims resulting from bound keypair joining
+type Claims struct {
+	// PublicKey is the verified public key trusted at the end of the joining
+	// process.
+	PublicKey string `json:"public_key"`
+	// RecoveryCount is the recovery counter value at the end of the joining
+	// process.
+	RecoveryCount uint32 `json:"recovery_count"`
+	// RecoveryMode is the recovery mode as configured at the time of the join
+	// attempt.
+	RecoveryMode RecoveryMode `json:"recovery_mode"`
+}
diff --git a/lib/bpf/bpf.go b/lib/bpf/bpf.go
index 44c578ee690c9..b8eed16561176 100644
--- a/lib/bpf/bpf.go
+++ b/lib/bpf/bpf.go
@@ -28,6 +28,7 @@ import (
 	"embed"
 	"encoding/binary"
 	"net"
+	"slices"
 	"strconv"
 	"sync"
 	"time"
@@ -410,8 +411,11 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
 				SessionID: ctx.SessionID,
 			},
 			UserMetadata: apievents.UserMetadata{
-				User:  ctx.User,
-				Login: ctx.Login,
+				User:            ctx.User,
+				Login:           ctx.Login,
+				UserClusterName: ctx.UserOriginClusterName,
+				UserRoles:       slices.Clone(ctx.UserRoles),
+				UserTraits:      ctx.UserTraits.Clone(),
 			},
 			BPFMetadata: apievents.BPFMetadata{
 				CgroupID: event.CgroupID,
@@ -469,8 +473,11 @@ func (s *Service) emitDiskEvent(eventBytes []byte) {
 			SessionID: ctx.SessionID,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User:  ctx.User,
-			Login: ctx.Login,
+			User:            ctx.User,
+			Login:           ctx.Login,
+			UserClusterName: ctx.UserOriginClusterName,
+			UserRoles:       slices.Clone(ctx.UserRoles),
+			UserTraits:      ctx.UserTraits.Clone(),
 		},
 		BPFMetadata: apievents.BPFMetadata{
 			CgroupID: event.CgroupID,
@@ -524,8 +531,11 @@ func (s *Service) emit4NetworkEvent(eventBytes []byte) {
 			SessionID: ctx.SessionID,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User:  ctx.User,
-			Login: ctx.Login,
+			User:            ctx.User,
+			Login:           ctx.Login,
+			UserClusterName: ctx.UserOriginClusterName,
+			UserRoles:       slices.Clone(ctx.UserRoles),
+			UserTraits:      ctx.UserTraits.Clone(),
 		},
 		BPFMetadata: apievents.BPFMetadata{
 			CgroupID: event.CgroupID,
@@ -581,8 +591,11 @@ func (s *Service) emit6NetworkEvent(eventBytes []byte) {
 			SessionID: ctx.SessionID,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User:  ctx.User,
-			Login: ctx.Login,
+			User:            ctx.User,
+			Login:           ctx.Login,
+			UserClusterName: ctx.UserOriginClusterName,
+			UserRoles:       slices.Clone(ctx.UserRoles),
+			UserTraits:      ctx.UserTraits.Clone(),
 		},
 		BPFMetadata: apievents.BPFMetadata{
 			CgroupID: event.CgroupID,
diff --git a/lib/bpf/bpf_test.go b/lib/bpf/bpf_test.go
index 20ba88352f3ec..718fa02143693 100644
--- a/lib/bpf/bpf_test.go
+++ b/lib/bpf/bpf_test.go
@@ -50,7 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/cgroup"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const (
@@ -61,7 +61,7 @@ const (
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	// Check if the re-exec was requested.
 	if len(os.Args) == 3 {
diff --git a/lib/bpf/common.go b/lib/bpf/common.go
index 5730f8bb0f37f..485f48c641916 100644
--- a/lib/bpf/common.go
+++ b/lib/bpf/common.go
@@ -18,8 +18,6 @@
 
 package bpf
 
-import "C"
-
 import (
 	"context"
 
@@ -27,6 +25,7 @@ import (
 	"github.com/gravitational/trace"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -72,6 +71,10 @@ type SessionContext struct {
 	// User is the Teleport user.
 	User string
 
+	// UserOriginClusterName is the name of the cluster where the user is
+	// originally from.
+	UserOriginClusterName string
+
 	// PID is the process ID of Teleport when it re-executes itself. This is
 	// used by Teleport to find itself by cgroup.
 	PID int
@@ -82,6 +85,11 @@ type SessionContext struct {
 	// Events is the set of events (command, disk, or network) to record for
 	// this session.
 	Events map[string]bool
+
+	// UserRoles are the roles assigned to the user.
+	UserRoles []string
+	// UserTraits are the traits assigned to the user.
+	UserTraits wrappers.Traits
 }
 
 // NOP is used on either non-Linux systems or when BPF support is not enabled.
diff --git a/lib/cache/access_list.go b/lib/cache/access_list.go
index 68eb193ee21f6..7451b7e0ed215 100644
--- a/lib/cache/access_list.go
+++ b/lib/cache/access_list.go
@@ -22,16 +22,23 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/defaults"
+	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils/sortcache"
 )
 
 type accessListIndex string
 
-const accessListNameIndex accessListIndex = "name"
+const (
+	accessListNameIndex          accessListIndex = "name"
+	accessListTitleIndex         accessListIndex = "title"
+	accessListAuditNextDateIndex accessListIndex = "auditNextDate"
+)
 
 func newAccessListCollection(upstream services.AccessLists, w types.WatchKind) (*collection[*accesslist.AccessList, accessListIndex], error) {
 	if upstream == nil {
@@ -40,30 +47,19 @@ func newAccessListCollection(upstream services.AccessLists, w types.WatchKind) (
 
 	return &collection[*accesslist.AccessList, accessListIndex]{
 		store: newStore(
+			types.KindAccessList,
 			(*accesslist.AccessList).Clone,
 			map[accessListIndex]func(*accesslist.AccessList) string{
-				accessListNameIndex: func(al *accesslist.AccessList) string {
-					return al.GetMetadata().Name
-				},
+				// sorted by name
+				accessListNameIndex: services.AccessListNameIndexKey,
+				// sorted by title, sanitized.
+				accessListTitleIndex: services.AccessListTitleIndexKey,
+				// sorted by upcoming audit date. lists with no audit dates sorted to the back
+				accessListAuditNextDateIndex: services.AccessListAuditDateIndexKey,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*accesslist.AccessList, error) {
-			var resources []*accesslist.AccessList
-			var nextToken string
-			for {
-				var page []*accesslist.AccessList
-				var err error
-				page, nextToken, err = upstream.ListAccessLists(ctx, 0 /* page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListAccessLists))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *accesslist.AccessList {
 			return &accesslist.AccessList{
@@ -103,6 +99,52 @@ func (c *Cache) GetAccessLists(ctx context.Context) ([]*accesslist.AccessList, e
 	return out, nil
 }
 
+// ListAccessListsV2 returns a filtered and sorted paginated list of access lists.
+func (c *Cache) ListAccessListsV2(ctx context.Context, req *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListAccessListsV2")
+	defer span.End()
+
+	index := accessListNameIndex
+
+	var isDesc bool
+	sortBy := req.GetSortBy()
+	if sortBy != nil {
+		isDesc = req.GetSortBy().IsDesc
+
+		switch sortBy.Field {
+		case "name", "":
+			index = accessListNameIndex
+		case "auditNextDate":
+			index = accessListAuditNextDateIndex
+		case "title":
+			index = accessListTitleIndex
+		default:
+			return nil, "", trace.BadParameter("unsupported sort %q but expected name, title or auditNextDate", sortBy.Field)
+		}
+	}
+	lister := genericLister[*accesslist.AccessList, accessListIndex]{
+		cache:           c,
+		collection:      c.collections.accessLists,
+		isDesc:          isDesc,
+		index:           index,
+		defaultPageSize: 100,
+		upstreamList: func(ctx context.Context, limit int, start string) ([]*accesslist.AccessList, string, error) {
+			return c.Config.AccessLists.ListAccessListsV2(ctx, req)
+		},
+		filter: func(al *accesslist.AccessList) bool {
+			return services.MatchAccessList(al, req.GetFilter())
+		},
+		nextToken: func(al *accesslist.AccessList) string {
+			// ignore error because CreateAccessListNextKey only errors
+			// if the index is invalid, which we already check above
+			nextKey, _ := services.CreateAccessListNextKey(al, string(index))
+			return nextKey
+		},
+	}
+	out, next, err := lister.list(ctx, int(req.GetPageSize()), req.GetPageToken())
+	return out, next, trace.Wrap(err)
+}
+
 // ListAccessLists returns a paginated list of access lists.
 func (c *Cache) ListAccessLists(ctx context.Context, pageSize int, pageToken string) ([]*accesslist.AccessList, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListAccessLists")
@@ -155,6 +197,10 @@ const (
 	accessListMemberKindIndex accessListMemberIndex = "kind"
 )
 
+func accessListMemberNameIndexKey(r *accesslist.AccessListMember) string {
+	return r.Spec.AccessList + "/" + r.GetName()
+}
+
 func newAccessListMemberCollection(upstream services.AccessLists, w types.WatchKind) (*collection[*accesslist.AccessListMember, accessListMemberIndex], error) {
 	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter AccessLists")
@@ -162,33 +208,19 @@ func newAccessListMemberCollection(upstream services.AccessLists, w types.WatchK
 
 	return &collection[*accesslist.AccessListMember, accessListMemberIndex]{
 		store: newStore(
+			types.KindAccessListMember,
 			(*accesslist.AccessListMember).Clone,
 			map[accessListMemberIndex]func(*accesslist.AccessListMember) string{
 				accessListMemberNameIndex: func(r *accesslist.AccessListMember) string {
-					return r.Spec.AccessList + "/" + r.GetName()
+					return accessListMemberNameIndexKey(r)
 				},
 				accessListMemberKindIndex: func(r *accesslist.AccessListMember) string {
 					return r.Spec.AccessList + "/" + r.Spec.MembershipKind + "/" + r.GetName()
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*accesslist.AccessListMember, error) {
-			var resources []*accesslist.AccessListMember
-			var nextToken string
-			for {
-				var page []*accesslist.AccessListMember
-				var err error
-				page, nextToken, err = upstream.ListAllAccessListMembers(ctx, 0 /* page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListAllAccessListMembers))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *accesslist.AccessListMember {
 			return &accesslist.AccessListMember{
@@ -224,17 +256,18 @@ func (c *Cache) CountAccessListMembers(ctx context.Context, accessListName strin
 		return count, listCount, trace.Wrap(err)
 	}
 
-	startKey := accessListName + "/" + accesslist.MembershipKindList + "/"
-	endKey := sortcache.NextKey(startKey)
-	listCount := uint32(rg.store.count(accessListMemberKindIndex, startKey, endKey))
+	startUserKey := accessListName + "/" + accesslist.MembershipKindUser + "/"
+	endUserKey := sortcache.NextKey(startUserKey)
+	userCount := uint32(rg.store.count(accessListMemberKindIndex, startUserKey, endUserKey))
 
-	return uint32(rg.store.len()) - listCount, listCount, trace.Wrap(err)
+	startListKey := accessListName + "/" + accesslist.MembershipKindList + "/"
+	endListKey := sortcache.NextKey(startListKey)
+	listCount := uint32(rg.store.count(accessListMemberKindIndex, startListKey, endListKey))
+
+	return userCount, listCount, nil
 }
 
 // ListAccessListMembers returns a paginated list of all access list members.
-// May return a DynamicAccessListError if the requested access list has an
-// implicit member list and the underlying implementation does not have
-// enough information to compute the dynamic member list.
 func (c *Cache) ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListAccessListMembers")
 	defer span.End()
@@ -250,20 +283,21 @@ func (c *Cache) ListAccessListMembers(ctx context.Context, accessListName string
 		return out, next, trace.Wrap(err)
 	}
 
-	start := accessListName
-	end := sortcache.NextKey(accessListName + "/")
-	if pageToken != "" {
-		start += "/" + pageToken
-	}
+	// The ending "/" is very important here, otherwise we can start listing members of access
+	// lists which names are prefixed with this access list name. E.g. we'd list members of
+	// "dev-suffix" for list "dev".
+	start := accessListName + "/"
+	current := start + pageToken
+	end := sortcache.NextKey(start)
 
 	if pageSize <= 0 {
 		pageSize = defaults.DefaultChunkSize
 	}
 
 	var out []*accesslist.AccessListMember
-	for member := range rg.store.resources(accessListMemberNameIndex, start, end) {
+	for member := range rg.store.resources(accessListMemberNameIndex, current, end) {
 		if len(out) == pageSize {
-			return out, accessListName + "/" + member.GetName(), nil
+			return out, member.GetName(), nil
 		}
 
 		out = append(out, member.Clone())
@@ -273,7 +307,7 @@ func (c *Cache) ListAccessListMembers(ctx context.Context, accessListName string
 }
 
 // ListAllAccessListMembers returns a paginated list of all access list members for all access lists.
-func (c *Cache) ListAllAccessListMembers(ctx context.Context, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error) {
+func (c *Cache) ListAllAccessListMembers(ctx context.Context, pageSize int, pageToken string) ([]*accesslist.AccessListMember, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListAllAccessListMembers")
 	defer span.End()
 
@@ -284,17 +318,14 @@ func (c *Cache) ListAllAccessListMembers(ctx context.Context, pageSize int, page
 		defaultPageSize: 200,
 		upstreamList:    c.Config.AccessLists.ListAllAccessListMembers,
 		nextToken: func(t *accesslist.AccessListMember) string {
-			return t.GetMetadata().Name
+			return accessListMemberNameIndexKey(t)
 		},
 	}
-	out, next, err := lister.list(ctx, pageSize, nextToken)
+	out, next, err := lister.list(ctx, pageSize, pageToken)
 	return out, next, trace.Wrap(err)
 }
 
 // GetAccessListMember returns the specified access list member resource.
-// May return a DynamicAccessListError if the requested access list has an
-// implicit member list and the underlying implementation does not have
-// enough information to compute the dynamic member record.
 func (c *Cache) GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/GetAccessListMember")
 	defer span.End()
@@ -328,6 +359,7 @@ func newAccessListReviewCollection(upstream services.AccessLists, w types.WatchK
 
 	return &collection[*accesslist.Review, accessListReviewIndex]{
 		store: newStore(
+			types.KindAccessListReview,
 			(*accesslist.Review).Clone,
 			map[accessListReviewIndex]func(*accesslist.Review) string{
 				accessListReviewNameIndex: func(r *accesslist.Review) string {
@@ -335,23 +367,8 @@ func newAccessListReviewCollection(upstream services.AccessLists, w types.WatchK
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*accesslist.Review, error) {
-			var resources []*accesslist.Review
-			var nextToken string
-			for {
-				var page []*accesslist.Review
-				var err error
-				page, nextToken, err = upstream.ListAllAccessListReviews(ctx, 0 /* page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListAllAccessListReviews))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *accesslist.Review {
 			return &accesslist.Review{
@@ -391,10 +408,11 @@ func (c *Cache) ListAccessListReviews(ctx context.Context, accessList string, pa
 	}
 
 	start := accessList
+	end := sortcache.NextKey(accessList + "/")
 	if pageToken != "" {
 		start += "/" + pageToken
 	}
 
-	out, next, err := lister.list(ctx, pageSize, start)
+	out, next, err := lister.listRange(ctx, pageSize, start, end)
 	return out, next, trace.Wrap(err)
 }
diff --git a/lib/cache/access_list_test.go b/lib/cache/access_list_test.go
index d287da49da021..6c7cdd1dc096a 100644
--- a/lib/cache/access_list_test.go
+++ b/lib/cache/access_list_test.go
@@ -18,16 +18,25 @@ package cache
 
 import (
 	"context"
+	"fmt"
 	"strconv"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 
+	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
+	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 // TestAccessList tests that CRUD operations on access list resources are
@@ -48,15 +57,9 @@ func TestAccessList(t *testing.T) {
 			_, err := p.accessLists.UpsertAccessList(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*accesslist.AccessList, error) {
-			items, _, err := p.accessLists.ListAccessLists(ctx, 0 /* page size */, "")
-			return items, trace.Wrap(err)
-		},
-		cacheGet: p.cache.GetAccessList,
-		cacheList: func(ctx context.Context) ([]*accesslist.AccessList, error) {
-			items, _, err := p.cache.ListAccessLists(ctx, 0 /* page size */, "")
-			return items, trace.Wrap(err)
-		},
+		list:      p.accessLists.ListAccessLists,
+		cacheGet:  p.cache.GetAccessList,
+		cacheList: p.cache.ListAccessLists,
 		update: func(ctx context.Context, item *accesslist.AccessList) error {
 			_, err := p.accessLists.UpsertAccessList(ctx, item)
 			return trace.Wrap(err)
@@ -70,6 +73,8 @@ func TestAccessList(t *testing.T) {
 func TestAccessListMembers(t *testing.T) {
 	t.Parallel()
 
+	const numMembers = 32
+
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
@@ -86,16 +91,13 @@ func TestAccessListMembers(t *testing.T) {
 			_, err := p.accessLists.UpsertAccessListMember(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*accesslist.AccessListMember, error) {
-			items, _, err := p.accessLists.ListAllAccessListMembers(ctx, 0 /* page size */, "")
-			return items, trace.Wrap(err)
-		},
+		list: p.accessLists.ListAllAccessListMembers,
 		cacheGet: func(ctx context.Context, name string) (*accesslist.AccessListMember, error) {
 			return p.cache.GetAccessListMember(ctx, al.GetName(), name)
 		},
-		cacheList: func(ctx context.Context) ([]*accesslist.AccessListMember, error) {
-			items, _, err := p.cache.ListAccessListMembers(ctx, al.GetName(), 0 /* page size */, "")
-			return items, trace.Wrap(err)
+		cacheList: func(ctx context.Context, pageSize int, startKey string) ([]*accesslist.AccessListMember, string, error) {
+			return p.cache.ListAccessListMembers(ctx, al.GetName(), pageSize, startKey)
+
 		},
 		update: func(ctx context.Context, item *accesslist.AccessListMember) error {
 			_, err := p.accessLists.UpsertAccessListMember(ctx, item)
@@ -106,23 +108,110 @@ func TestAccessListMembers(t *testing.T) {
 
 	// Verify counting.
 	ctx := context.Background()
-	for i := 0; i < 40; i++ {
+	for i := 0; i < numMembers; i++ {
 		_, err = p.accessLists.UpsertAccessListMember(ctx, newAccessListMember(t, al.GetName(), strconv.Itoa(i)))
 		require.NoError(t, err)
 	}
 
 	count, listCount, err := p.accessLists.CountAccessListMembers(ctx, al.GetName())
 	require.NoError(t, err)
-	require.Equal(t, uint32(40), count)
+	require.Equal(t, uint32(numMembers), count)
 	require.Equal(t, uint32(0), listCount)
 
 	// Eventually, this should be reflected in the cache.
-	require.Eventually(t, func() bool {
-		// Make sure the cache has a single resource in it.
+	timeout := time.After(5 * time.Second)
+	for {
 		count, listCount, err := p.cache.CountAccessListMembers(ctx, al.GetName())
-		assert.NoError(t, err)
-		return count == uint32(40) && listCount == uint32(0)
+		require.NoError(t, err)
+		if count == numMembers && listCount == 0 {
+			break
+		}
+		select {
+		case <-timeout:
+			require.Fail(t, "timed out waiting for correct member counts")
+		case <-p.eventsC:
+		}
+	}
+}
+
+func TestAccessListMembers_suffixed_lists_members_bug(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	clock := clockwork.NewFakeClock()
+
+	al1, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, "test-1", clock))
+	require.NoError(t, err)
+	al1Suffix, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, al1.GetName()+"-suffix", clock))
+	require.NoError(t, err)
+
+	al1SuffixM1, err := p.accessLists.UpsertAccessListMember(ctx, newAccessListMember(t, al1Suffix.GetName(), "member-1"))
+	require.NoError(t, err)
+
+	// Eventually, this should be reflected in the cache.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		al1SuffixMembers, _, err := p.cache.ListAccessListMembers(ctx, al1Suffix.GetName(), 0, "")
+		require.NoError(t, err)
+		require.NotEmpty(t, al1SuffixMembers)
 	}, time.Second*2, time.Millisecond*250)
+
+	al1Members, _, err := p.cache.ListAccessListMembers(ctx, al1.GetName(), 0, "")
+	require.NoError(t, err)
+	al1SuffixMembers, _, err := p.cache.ListAccessListMembers(ctx, al1Suffix.GetName(), 0, "")
+	require.NoError(t, err)
+
+	require.Empty(t, al1Members)
+	require.Len(t, al1SuffixMembers, 1)
+	require.Equal(t, al1SuffixMembers[0].GetName(), al1SuffixM1.GetName())
+}
+
+func TestAccessListMembers_pageToken_compatibility(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	clock := clockwork.NewFakeClock()
+
+	al1, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, "test-1", clock))
+	require.NoError(t, err)
+
+	const membersCnt = 50
+
+	for i := range membersCnt {
+		_, err := p.accessLists.UpsertAccessListMember(ctx, newAccessListMember(t, al1.GetName(), "member-"+strconv.Itoa(i)))
+		require.NoError(t, err)
+	}
+
+	// Eventually, this should be reflected in the cache.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		al1Members, _, err := p.cache.ListAccessListMembers(ctx, al1.GetName(), 0, "")
+		require.NoError(t, err)
+		require.Len(t, al1Members, membersCnt)
+	}, time.Second*2, time.Millisecond*250)
+
+	const pageSize = 2
+	calls := 0
+	var localNextToken, cacheNextToken string
+	for range membersCnt * 2 {
+		calls++
+
+		_, localNextToken, err = p.accessLists.ListAccessListMembers(ctx, al1.GetName(), pageSize, localNextToken)
+		require.NoError(t, err)
+		_, cacheNextToken, err = p.cache.ListAccessListMembers(ctx, al1.GetName(), pageSize, cacheNextToken)
+		require.NoError(t, err)
+
+		require.Equal(t, localNextToken, cacheNextToken)
+
+		if localNextToken == "" {
+			break
+		}
+	}
+	require.Equal(t, membersCnt/pageSize, calls)
 }
 
 // TestAccessListReviews tests that CRUD operations on access list review resources are
@@ -159,19 +248,310 @@ func TestAccessListReviews(t *testing.T) {
 		},
 		create: func(ctx context.Context, item *accesslist.Review) error {
 			review, _, err := p.accessLists.CreateAccessListReview(ctx, item)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 			// Use the old name from the description.
 			oldName := review.Metadata.Description
 			reviews[oldName].SetName(review.GetName())
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*accesslist.Review, error) {
-			items, _, err := p.accessLists.ListAllAccessListReviews(ctx, 0 /* page size */, "")
-			return items, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*accesslist.Review, error) {
-			items, _, err := p.cache.ListAccessListReviews(ctx, al.GetName(), 0 /* page size */, "")
-			return items, trace.Wrap(err)
+		list: p.accessLists.ListAllAccessListReviews,
+		cacheList: func(ctx context.Context, pageSize int, startKey string) ([]*accesslist.Review, string, error) {
+			return p.cache.ListAccessListReviews(ctx, al.GetName(), pageSize, startKey)
 		},
 		deleteAll: p.accessLists.DeleteAllAccessListReviews,
-	})
+	}, withSkipPaginationTest()) // access list reviews resources have customer pagination test.
+
+	_, _, err = p.accessLists.UpsertAccessListWithMembers(t.Context(), newAccessList(t, "fake-al-1", clock),
+		[]*accesslist.AccessListMember{
+			newAccessListMember(t, "fake-al-1", "member1"),
+			newAccessListMember(t, "fake-al-1", "member2"),
+		})
+	require.NoError(t, err)
+
+	_, _, err = p.accessLists.UpsertAccessListWithMembers(t.Context(), newAccessList(t, "fake-al-2", clock),
+		[]*accesslist.AccessListMember{
+			newAccessListMember(t, "fake-al-2", "member1"),
+			newAccessListMember(t, "fake-al-2", "member2"),
+		})
+	require.NoError(t, err)
+
+	review1 := newAccessListReview(t, "fake-al-1", "initial-review-1")
+	review1, _, err = p.accessLists.CreateAccessListReview(t.Context(), review1)
+	require.NoError(t, err)
+	review2 := newAccessListReview(t, "fake-al-2", "initial-review-2")
+	review2, _, err = p.accessLists.CreateAccessListReview(t.Context(), review2)
+	require.NoError(t, err)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		out, next, err := p.cache.ListAccessListReviews(context.Background(), "fake-al-1", 100, "")
+		require.NoError(t, err)
+		assert.Empty(t, next)
+
+		assert.Len(t, out, 1)
+		assert.Empty(t, cmp.Diff([]*accesslist.Review{review1}, out,
+			cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+			protocmp.Transform()),
+		)
+	}, 15*time.Second, 100*time.Millisecond)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		out, next, err := p.cache.ListAccessListReviews(context.Background(), "fake-al-2", 100, "")
+		require.NoError(t, err)
+		assert.Empty(t, next)
+
+		assert.Len(t, out, 1)
+		assert.Empty(t, cmp.Diff([]*accesslist.Review{review2}, out,
+			cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+			protocmp.Transform()),
+		)
+	}, 15*time.Second, 100*time.Millisecond)
+
+	_, _, err = p.accessLists.UpsertAccessListWithMembers(t.Context(), newAccessList(t, "access-list-test", clock),
+		[]*accesslist.AccessListMember{
+			newAccessListMember(t, "access-list-test", "member1"),
+			newAccessListMember(t, "access-list-test", "member2"),
+		})
+	require.NoError(t, err)
+
+	for i := 0; i < 10; i++ {
+		review := newAccessListReview(t, "access-list-test", "fake-review-"+strconv.Itoa(i))
+		review.Spec.Changes = accesslist.ReviewChanges{}
+		_, _, err = p.accessLists.CreateAccessListReview(t.Context(), review)
+		require.NoError(t, err)
+	}
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		count := p.cache.collections.accessListReviews.store.len()
+		_ = count
+
+		var start string
+		var out []*accesslist.Review
+		for i := 0; i < 10; i++ {
+			page, next, err := p.cache.ListAccessListReviews(context.Background(), "access-list-test", 3, start)
+			require.NoError(t, err)
+
+			out = append(out, page...)
+			if next == "" {
+				break
+			}
+			start = next
+		}
+		assert.Len(t, out, 10)
+	}, 15*time.Second, 100*time.Millisecond)
+
+}
+
+func TestListAccessListsV2(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	ctx := context.Background()
+	baseTime := time.Date(1984, 4, 4, 0, 0, 0, 0, time.UTC)
+	clock := clockwork.NewFakeClockAt(baseTime)
+
+	names := []string{"apple-list", "banana-access", "cherry-management", "apple-admin", "zebra-test"}
+
+	for i, name := range names {
+		al := newAccessList(t, name, clock)
+		auditDate := clock.Now().Add(time.Duration(i) * (time.Hour) * 24)
+		// add arbitrary date so we can make sure its not just sorted by name
+		if name == "banana-access" {
+			auditDate = clock.Now().Add(100 * (time.Hour) * 24)
+			al.Spec.Title = "bananatitle"
+		}
+		al.Spec.Audit.NextAuditDate = auditDate
+
+		_, err := p.accessLists.UpsertAccessList(ctx, al)
+		require.NoError(t, err)
+	}
+
+	testCases := []struct {
+		name            string
+		search          string
+		sortBy          *types.SortBy
+		expectedNames   []string
+		pageSize        int
+		expectedNextKey string
+		startKey        string
+	}{
+		{
+			name:          "no filter - all lists",
+			expectedNames: []string{"apple-admin", "apple-list", "banana-access", "cherry-management", "zebra-test"},
+		},
+		{
+			name:          "sort by name reverse",
+			sortBy:        &types.SortBy{Field: "name", IsDesc: true},
+			expectedNames: []string{"zebra-test", "cherry-management", "banana-access", "apple-list", "apple-admin"},
+		},
+		{
+			name:          "sort by audit date",
+			sortBy:        &types.SortBy{Field: "auditNextDate", IsDesc: false},
+			expectedNames: []string{"apple-list", "cherry-management", "apple-admin", "zebra-test", "banana-access"},
+		},
+		{
+			name:          "sort by title",
+			sortBy:        &types.SortBy{Field: "title", IsDesc: false},
+			expectedNames: []string{"banana-access", "apple-admin", "apple-list", "cherry-management", "zebra-test"},
+		},
+		{
+			name:          "sort by title reverse",
+			sortBy:        &types.SortBy{Field: "title", IsDesc: true},
+			expectedNames: []string{"zebra-test", "cherry-management", "apple-list", "apple-admin", "banana-access"},
+		},
+		{
+			name:          "sort by audit date reverse",
+			sortBy:        &types.SortBy{Field: "auditNextDate", IsDesc: true},
+			expectedNames: []string{"banana-access", "zebra-test", "apple-admin", "cherry-management", "apple-list"},
+		},
+		{
+			name:            "paginated results",
+			expectedNames:   []string{"apple-admin", "apple-list"},
+			pageSize:        2,
+			expectedNextKey: "banana-access",
+		},
+		{
+			name:            "paginated results reverse",
+			expectedNames:   []string{"zebra-test", "cherry-management", "banana-access"},
+			sortBy:          &types.SortBy{Field: "name", IsDesc: true},
+			pageSize:        3,
+			expectedNextKey: "apple-list",
+		},
+		{
+			name:          "with search",
+			search:        "apple",
+			expectedNames: []string{"apple-admin", "apple-list"},
+		},
+		{
+			name:          "with startKey",
+			startKey:      "banana-access",
+			expectedNames: []string{"banana-access", "cherry-management", "zebra-test"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			require.EventuallyWithT(t, func(t *assert.CollectT) {
+				results, nextToken, err := p.cache.ListAccessListsV2(ctx, &accesslistv1.ListAccessListsV2Request{
+					PageSize:  int32(tc.pageSize),
+					PageToken: tc.startKey,
+					Filter: &accesslistv1.AccessListsFilter{
+						Search: tc.search,
+					},
+					SortBy: tc.sortBy,
+				})
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expectedNextKey, nextToken)
+
+				assert.Len(t, results, len(tc.expectedNames))
+				actualNames := make([]string, len(results))
+				for i, al := range results {
+					actualNames[i] = al.GetName()
+				}
+
+				assert.Equal(t, tc.expectedNames, actualNames)
+			}, 5*time.Second, 100*time.Millisecond)
+		})
+	}
+}
+
+func TestCountAccessListMembersScoping(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	listA, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, "list-a", clock))
+	require.NoError(t, err)
+	listB, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, "list-b", clock))
+	require.NoError(t, err)
+
+	const (
+		listAUsers = 4
+		listBUsers = 3
+		listALists = 2
+		listBLists = 1
+	)
+
+	for i := range listAUsers {
+		member := newAccessListMember(t, listA.GetName(), fmt.Sprintf("user-%d", i))
+		member.Spec.MembershipKind = accesslist.MembershipKindUser
+		_, err := p.accessLists.UpsertAccessListMember(ctx, member)
+		require.NoError(t, err)
+	}
+	for i := range listBUsers {
+		member := newAccessListMember(t, listB.GetName(), fmt.Sprintf("b-user-%d", i))
+		member.Spec.MembershipKind = accesslist.MembershipKindUser
+		_, err := p.accessLists.UpsertAccessListMember(ctx, member)
+		require.NoError(t, err)
+	}
+
+	for i := range listALists {
+		nestedList, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, fmt.Sprintf("nested-list-a-%d", i), clock))
+		require.NoError(t, err)
+		member := newAccessListMember(t, listA.GetName(), nestedList.GetName())
+		member.Spec.MembershipKind = accesslist.MembershipKindList
+		_, err = p.accessLists.UpsertAccessListMember(ctx, member)
+		require.NoError(t, err)
+	}
+	for i := range listBLists {
+		nestedList, err := p.accessLists.UpsertAccessList(ctx, newAccessList(t, fmt.Sprintf("nested-list-b-%d", i), clock))
+		require.NoError(t, err)
+		member := newAccessListMember(t, listB.GetName(), nestedList.GetName())
+		member.Spec.MembershipKind = accesslist.MembershipKindList
+		_, err = p.accessLists.UpsertAccessListMember(ctx, member)
+		require.NoError(t, err)
+	}
+
+	// wait for cache to reflect updates
+	timeout := time.After(5 * time.Second)
+	for {
+		aUsers, aLists, err := p.cache.CountAccessListMembers(ctx, listA.GetName())
+		require.NoError(t, err)
+		bUsers, bLists, err := p.cache.CountAccessListMembers(ctx, listB.GetName())
+		require.NoError(t, err)
+		if aUsers == listAUsers && aLists == listALists && bUsers == listBUsers && bLists == listBLists {
+			break
+		}
+		select {
+		case <-timeout:
+			require.Fail(t, "timed out waiting for correct member counts")
+		case <-p.eventsC:
+		}
+	}
+}
+
+func TestGetAllAccessListMembers(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	clock := clockwork.NewFakeClock()
+
+	_, members, err := p.accessLists.UpsertAccessListWithMembers(context.Background(), newAccessList(t, "access-list", clock),
+		makeMembers(t, "access-list", 10),
+	)
+	require.NoError(t, err)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		result, err := stream.Collect(clientutils.ResourcesWithPageSize(ctx, p.cache.ListAllAccessListMembers, 1))
+		require.NoError(t, err)
+		require.Len(t, result, len(members))
+	}, time.Second*10, time.Millisecond*30)
+}
+
+func makeMembers(t *testing.T, alName string, count int) []*accesslist.AccessListMember {
+	members := make([]*accesslist.AccessListMember, 0, count)
+	for i := 0; i < count; i++ {
+		members = append(members, newAccessListMember(t, alName, fmt.Sprintf("member-%d", i)))
+	}
+	return members
 }
diff --git a/lib/cache/access_monitoring_rule.go b/lib/cache/access_monitoring_rule.go
index 84ff672e55c77..b77cc6d974be5 100644
--- a/lib/cache/access_monitoring_rule.go
+++ b/lib/cache/access_monitoring_rule.go
@@ -25,6 +25,8 @@ import (
 	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -39,6 +41,7 @@ func newAccessMonitoringRuleCollection(upstream services.AccessMonitoringRules,
 
 	return &collection[*accessmonitoringrulesv1.AccessMonitoringRule, accessMonitoringRuleIndex]{
 		store: newStore(
+			types.KindAccessMonitoringRule,
 			proto.CloneOf[*accessmonitoringrulesv1.AccessMonitoringRule],
 			map[accessMonitoringRuleIndex]func(*accessmonitoringrulesv1.AccessMonitoringRule) string{
 				accessMonitoringRuleNameIndex: func(r *accessmonitoringrulesv1.AccessMonitoringRule) string {
@@ -46,22 +49,8 @@ func newAccessMonitoringRuleCollection(upstream services.AccessMonitoringRules,
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*accessmonitoringrulesv1.AccessMonitoringRule, error) {
-			var resources []*accessmonitoringrulesv1.AccessMonitoringRule
-			var nextToken string
-			for {
-				var page []*accessmonitoringrulesv1.AccessMonitoringRule
-				var err error
-				page, nextToken, err = upstream.ListAccessMonitoringRules(ctx, 0 /* page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				resources = append(resources, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListAccessMonitoringRules))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *accessmonitoringrulesv1.AccessMonitoringRule {
 			return &accessmonitoringrulesv1.AccessMonitoringRule{
diff --git a/lib/cache/access_monitoring_rule_test.go b/lib/cache/access_monitoring_rule_test.go
index a6fe37a8b5d5f..e018a79978fba 100644
--- a/lib/cache/access_monitoring_rule_test.go
+++ b/lib/cache/access_monitoring_rule_test.go
@@ -37,7 +37,7 @@ func TestAccessMonitoringRules(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*accessmonitoringrulesv1.AccessMonitoringRule]{
+	testResources153(t, p, testFuncs[*accessmonitoringrulesv1.AccessMonitoringRule]{
 		newResource: func(name string) (*accessmonitoringrulesv1.AccessMonitoringRule, error) {
 			return newAccessMonitoringRule(t), nil
 		},
@@ -45,21 +45,15 @@ func TestAccessMonitoringRules(t *testing.T) {
 			_, err := p.accessMonitoringRules.CreateAccessMonitoringRule(ctx, i)
 			return err
 		},
-		list: func(ctx context.Context) ([]*accessmonitoringrulesv1.AccessMonitoringRule, error) {
-			results, _, err := p.accessMonitoringRules.ListAccessMonitoringRules(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetAccessMonitoringRule,
-		cacheList: func(ctx context.Context) ([]*accessmonitoringrulesv1.AccessMonitoringRule, error) {
-			results, _, err := p.cache.ListAccessMonitoringRules(ctx, 0, "")
-			return results, err
-		},
+		list:      p.accessMonitoringRules.ListAccessMonitoringRules,
+		cacheGet:  p.cache.GetAccessMonitoringRule,
+		cacheList: p.cache.ListAccessMonitoringRules,
 		update: func(ctx context.Context, i *accessmonitoringrulesv1.AccessMonitoringRule) error {
 			_, err := p.accessMonitoringRules.UpdateAccessMonitoringRule(ctx, i)
 			return err
 		},
 		deleteAll: p.accessMonitoringRules.DeleteAllAccessMonitoringRules,
-	})
+	}, withSkipPaginationTest())
 }
 
 func TestListAccessMonitoringRulesWithFilter(t *testing.T) {
diff --git a/lib/cache/app.go b/lib/cache/app.go
index 6785406bfa904..3b29585e26aea 100644
--- a/lib/cache/app.go
+++ b/lib/cache/app.go
@@ -18,11 +18,13 @@ package cache
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -30,13 +32,14 @@ type appIndex string
 
 const appNameIndex appIndex = "name"
 
-func newAppCollection(p services.Apps, w types.WatchKind) (*collection[types.Application, appIndex], error) {
-	if p == nil {
-		return nil, trace.BadParameter("missing parameter Apps")
+func newAppCollection(upstream services.Applications, w types.WatchKind) (*collection[types.Application, appIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter Applications")
 	}
 
 	return &collection[types.Application, appIndex]{
 		store: newStore(
+			types.KindApp,
 			func(a types.Application) types.Application {
 				return a.Copy()
 			},
@@ -44,8 +47,9 @@ func newAppCollection(p services.Apps, w types.WatchKind) (*collection[types.App
 				appNameIndex: types.Application.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Application, error) {
-			apps, err := p.GetApps(ctx)
-			return apps, trace.Wrap(err)
+			// TODO(tross): DELETE IN v21.0.0 replace by regular clientutils.Resources
+			out, err := clientutils.CollectWithFallback(ctx, upstream.ListApps, upstream.GetApps)
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Application {
 			return &types.AppV3{
@@ -60,6 +64,52 @@ func newAppCollection(p services.Apps, w types.WatchKind) (*collection[types.App
 	}, nil
 }
 
+// Apps returns application resources within the range [start, end).
+func (c *Cache) Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error] {
+	lister := genericLister[types.Application, appIndex]{
+		cache:        c,
+		collection:   c.collections.apps,
+		index:        appNameIndex,
+		upstreamList: c.Config.Apps.ListApps,
+		nextToken:    types.Application.GetName,
+		// TODO(tross): DELETE IN v21.0.0
+		fallbackGetter: c.Config.Apps.GetApps,
+	}
+
+	return func(yield func(types.Application, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/Apps")
+		defer span.End()
+
+		for app, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(app, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
+// ListApps returns a page of application resources.
+func (c *Cache) ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListApps")
+	defer span.End()
+
+	lister := genericLister[types.Application, appIndex]{
+		cache:        c,
+		collection:   c.collections.apps,
+		index:        appNameIndex,
+		upstreamList: c.Config.Apps.ListApps,
+		nextToken: func(a types.Application) string {
+			return a.GetMetadata().Name
+		},
+	}
+	out, next, err := lister.list(ctx, limit, startKey)
+	return out, next, trace.Wrap(err)
+}
+
 // GetApps returns all application resources.
 func (c *Cache) GetApps(ctx context.Context) ([]types.Application, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/GetApps")
@@ -110,6 +160,7 @@ func newAppServerCollection(p services.Presence, w types.WatchKind) (*collection
 
 	return &collection[types.AppServer, appServerIndex]{
 		store: newStore(
+			types.KindAppServer,
 			types.AppServer.Copy,
 			map[appServerIndex]func(types.AppServer) string{
 				appServerNameIndex: func(u types.AppServer) string {
diff --git a/lib/cache/app_test.go b/lib/cache/app_test.go
index 499d01aa797eb..bae149e96ffac 100644
--- a/lib/cache/app_test.go
+++ b/lib/cache/app_test.go
@@ -34,24 +34,26 @@ import (
 func TestApps(t *testing.T) {
 	t.Parallel()
 
-	p, err := newPack(t.TempDir(), ForProxy)
+	p, err := newPack(t, ForProxy)
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
 	testResources(t, p, testFuncs[types.Application]{
 		newResource: func(name string) (types.Application, error) {
 			return types.NewAppV3(types.Metadata{
-				Name: "foo",
+				Name: name,
 			}, types.AppSpecV3{
 				URI: "localhost",
 			})
 		},
-		create:    p.apps.CreateApp,
-		list:      p.apps.GetApps,
-		cacheGet:  p.cache.GetApp,
-		cacheList: p.cache.GetApps,
-		update:    p.apps.UpdateApp,
-		deleteAll: p.apps.DeleteAllApps,
+		create:     p.apps.CreateApp,
+		list:       p.apps.ListApps,
+		Range:      p.apps.Apps,
+		cacheGet:   p.cache.GetApp,
+		cacheList:  p.cache.ListApps,
+		cacheRange: p.cache.Apps,
+		update:     p.apps.UpdateApp,
+		deleteAll:  p.apps.DeleteAllApps,
 	})
 }
 
@@ -71,17 +73,17 @@ func TestApplicationServers(t *testing.T) {
 				return types.NewAppServerV3FromApp(app, "host", uuid.New().String())
 			},
 			create: withKeepalive(p.presenceS.UpsertApplicationServer),
-			list: func(ctx context.Context) ([]types.AppServer, error) {
+			list: getAllAdapter(func(ctx context.Context) ([]types.AppServer, error) {
 				return p.presenceS.GetApplicationServers(ctx, apidefaults.Namespace)
-			},
-			cacheList: func(ctx context.Context) ([]types.AppServer, error) {
+			}),
+			cacheList: getAllAdapter(func(ctx context.Context) ([]types.AppServer, error) {
 				return p.cache.GetApplicationServers(ctx, apidefaults.Namespace)
-			},
+			}),
 			update: withKeepalive(p.presenceS.UpsertApplicationServer),
 			deleteAll: func(ctx context.Context) error {
 				return p.presenceS.DeleteAllApplicationServers(ctx, apidefaults.Namespace)
 			},
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListResources", func(t *testing.T) {
@@ -92,55 +94,43 @@ func TestApplicationServers(t *testing.T) {
 				return types.NewAppServerV3FromApp(app, "host", uuid.New().String())
 			},
 			create: withKeepalive(p.presenceS.UpsertApplicationServer),
-			list: func(ctx context.Context) ([]types.AppServer, error) {
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.AppServer, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindAppServer,
+					StartKey:     pageToken,
+					Limit:        int32(pageSize),
 				}
 
 				var out []types.AppServer
-				for {
-					resp, err := p.presenceS.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.AppServer))
-					}
-
-					req.StartKey = resp.NextKey
+				resp, err := p.presenceS.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					if req.StartKey == "" {
-						break
-					}
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.AppServer))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
-			cacheList: func(ctx context.Context) ([]types.AppServer, error) {
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.AppServer, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindAppServer,
+					Limit:        int32(pageSize),
+					StartKey:     pageToken,
 				}
 
 				var out []types.AppServer
-				for {
-					resp, err := p.cache.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.AppServer))
-					}
-
-					req.StartKey = resp.NextKey
+				resp, err := p.cache.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					if req.StartKey == "" {
-						break
-					}
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.AppServer))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 
 			},
 			update: withKeepalive(p.presenceS.UpsertApplicationServer),
diff --git a/lib/cache/auth_server.go b/lib/cache/auth_server.go
index cf9a5bcf736a0..6957cff90ed0a 100644
--- a/lib/cache/auth_server.go
+++ b/lib/cache/auth_server.go
@@ -21,6 +21,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -35,13 +36,17 @@ func newAuthServerCollection(p services.Presence, w types.WatchKind) (*collectio
 
 	return &collection[types.Server, authServerIndex]{
 		store: newStore(
+			types.KindAuthServer,
 			types.Server.DeepCopy,
 			map[authServerIndex]func(types.Server) string{
 				authServerNameIndex: types.Server.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Server, error) {
-			servers, err := p.GetAuthServers()
-			return servers, trace.Wrap(err)
+			out, err := clientutils.CollectWithFallback(ctx, p.ListAuthServers, func(context.Context) ([]types.Server, error) {
+				//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+				return p.GetAuthServers()
+			})
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Server {
 			return &types.ServerV2{
@@ -57,6 +62,10 @@ func newAuthServerCollection(p services.Presence, w types.WatchKind) (*collectio
 }
 
 // GetAuthServers returns a list of registered servers
+//
+// Deprecated: Prefer paginated gRPC variant [ListAuthServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
 func (c *Cache) GetAuthServers() ([]types.Server, error) {
 	_, span := c.Tracer.Start(context.TODO(), "cache/GetAuthServers")
 	defer span.End()
@@ -68,6 +77,7 @@ func (c *Cache) GetAuthServers() ([]types.Server, error) {
 	defer rg.Release()
 
 	if !rg.ReadCache() {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 		servers, err := c.Config.Presence.GetAuthServers()
 		return servers, trace.Wrap(err)
 	}
@@ -79,3 +89,19 @@ func (c *Cache) GetAuthServers() ([]types.Server, error) {
 
 	return servers, nil
 }
+
+// ListAuthServers returns a paginated list of registered auth servers.
+func (c *Cache) ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListAuthServers")
+	defer span.End()
+
+	lister := genericLister[types.Server, authServerIndex]{
+		cache:        c,
+		collection:   c.collections.authServers,
+		index:        authServerNameIndex,
+		upstreamList: c.Config.Presence.ListAuthServers,
+		nextToken:    types.Server.GetName,
+	}
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/auth_server_test.go b/lib/cache/auth_server_test.go
index 02e37bb917ffc..52822e11916e7 100644
--- a/lib/cache/auth_server_test.go
+++ b/lib/cache/auth_server_test.go
@@ -42,14 +42,10 @@ func TestAuthServers(t *testing.T) {
 				},
 			}, nil
 		},
-		create: p.presenceS.UpsertAuthServer,
-		list: func(_ context.Context) ([]types.Server, error) {
-			return p.presenceS.GetAuthServers()
-		},
-		cacheList: func(_ context.Context) ([]types.Server, error) {
-			return p.cache.GetAuthServers()
-		},
-		update: p.presenceS.UpsertAuthServer,
+		create:    p.presenceS.UpsertAuthServer,
+		list:      p.presenceS.ListAuthServers,
+		cacheList: p.cache.ListAuthServers,
+		update:    p.presenceS.UpsertAuthServer,
 		deleteAll: func(_ context.Context) error {
 			return p.presenceS.DeleteAllAuthServers()
 		},
diff --git a/lib/cache/auto_update.go b/lib/cache/auto_update.go
index 196793e142518..58e5d2b9eb793 100644
--- a/lib/cache/auto_update.go
+++ b/lib/cache/auto_update.go
@@ -26,6 +26,8 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -41,6 +43,7 @@ func newAutoUpdateConfigCollection(upstream services.AutoUpdateServiceGetter, w
 
 	return &collection[*autoupdatev1.AutoUpdateConfig, autoUpdateConfigIndex]{
 		store: newStore(
+			types.KindAutoUpdateConfig,
 			proto.CloneOf[*autoupdatev1.AutoUpdateConfig],
 			map[autoUpdateConfigIndex]func(*autoupdatev1.AutoUpdateConfig) string{
 				autoUpdateConfigNameIndex: func(r *autoupdatev1.AutoUpdateConfig) string {
@@ -107,6 +110,7 @@ func newAutoUpdateVersionCollection(upstream services.AutoUpdateServiceGetter, w
 
 	return &collection[*autoupdatev1.AutoUpdateVersion, autoUpdateVersionIndex]{
 		store: newStore(
+			types.KindAutoUpdateVersion,
 			proto.CloneOf[*autoupdatev1.AutoUpdateVersion],
 			map[autoUpdateVersionIndex]func(*autoupdatev1.AutoUpdateVersion) string{
 				autoUpdateVersionNameIndex: func(r *autoupdatev1.AutoUpdateVersion) string {
@@ -169,6 +173,7 @@ func newAutoUpdateRolloutCollection(upstream services.AutoUpdateServiceGetter, w
 
 	return &collection[*autoupdatev1.AutoUpdateAgentRollout, autoUpdateAgentRolloutIndex]{
 		store: newStore(
+			types.KindAutoUpdateAgentRollout,
 			proto.CloneOf[*autoupdatev1.AutoUpdateAgentRollout],
 			map[autoUpdateAgentRolloutIndex]func(*autoupdatev1.AutoUpdateAgentRollout) string{
 				autoUpdateAgentRolloutNameIndex: func(r *autoupdatev1.AutoUpdateAgentRollout) string {
@@ -231,6 +236,7 @@ func newAutoUpdateAgentReportCollection(upstream services.AutoUpdateServiceGette
 
 	return &collection[*autoupdatev1.AutoUpdateAgentReport, autoUpdateAgentReportIndex]{
 		store: newStore(
+			types.KindSecurityReport,
 			proto.CloneOf[*autoupdatev1.AutoUpdateAgentReport],
 			map[autoUpdateAgentReportIndex]func(*autoupdatev1.AutoUpdateAgentReport) string{
 				autoUpdateAgentReportNameIndex: func(r *autoupdatev1.AutoUpdateAgentReport) string {
@@ -238,24 +244,8 @@ func newAutoUpdateAgentReportCollection(upstream services.AutoUpdateServiceGette
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*autoupdatev1.AutoUpdateAgentReport, error) {
-			var discoveryConfigs []*autoupdatev1.AutoUpdateAgentReport
-			var nextToken string
-			for {
-				var page []*autoupdatev1.AutoUpdateAgentReport
-				var err error
-
-				page, nextToken, err = upstream.ListAutoUpdateAgentReports(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				discoveryConfigs = append(discoveryConfigs, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return discoveryConfigs, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListAutoUpdateAgentReports))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateAgentReport {
 			return &autoupdatev1.AutoUpdateAgentReport{
@@ -277,7 +267,7 @@ func (c *Cache) GetAutoUpdateAgentReport(ctx context.Context, name string) (*aut
 
 	getter := genericGetter[*autoupdatev1.AutoUpdateAgentReport, autoUpdateAgentReportIndex]{
 		cache:       c,
-		collection:  c.collections.autoUpdateReports,
+		collection:  c.collections.autoUpdateAgentReports,
 		index:       autoUpdateAgentReportNameIndex,
 		upstreamGet: c.Config.AutoUpdateService.GetAutoUpdateAgentReport,
 	}
@@ -292,7 +282,7 @@ func (c *Cache) ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pa
 
 	lister := genericLister[*autoupdatev1.AutoUpdateAgentReport, autoUpdateAgentReportIndex]{
 		cache:        c,
-		collection:   c.collections.autoUpdateReports,
+		collection:   c.collections.autoUpdateAgentReports,
 		index:        autoUpdateAgentReportNameIndex,
 		upstreamList: c.Config.AutoUpdateService.ListAutoUpdateAgentReports,
 		nextToken: func(t *autoupdatev1.AutoUpdateAgentReport) string {
@@ -302,3 +292,57 @@ func (c *Cache) ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pa
 	out, next, err := lister.list(ctx, pageSize, pageToken)
 	return out, next, trace.Wrap(err)
 }
+
+type autoUpdateBotInstanceReportIndex string
+
+const autoUpdateBotInstanceReportNameIndex autoUpdateBotInstanceReportIndex = "name"
+
+func newAutoUpdateBotInstanceReportCollection(upstream services.AutoUpdateServiceGetter, w types.WatchKind) (*collection[*autoupdatev1.AutoUpdateBotInstanceReport, autoUpdateBotInstanceReportIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter AutoUpdateServiceGetter")
+	}
+
+	return &collection[*autoupdatev1.AutoUpdateBotInstanceReport, autoUpdateBotInstanceReportIndex]{
+		store: newStore(
+			types.KindAutoUpdateBotInstanceReport,
+			proto.CloneOf[*autoupdatev1.AutoUpdateBotInstanceReport],
+			map[autoUpdateBotInstanceReportIndex]func(*autoupdatev1.AutoUpdateBotInstanceReport) string{
+				autoUpdateBotInstanceReportNameIndex: func(r *autoupdatev1.AutoUpdateBotInstanceReport) string {
+					return r.GetMetadata().Name
+				},
+			}),
+		fetcher: func(ctx context.Context, loadSecrets bool) ([]*autoupdatev1.AutoUpdateBotInstanceReport, error) {
+			report, err := upstream.GetAutoUpdateBotInstanceReport(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return []*autoupdatev1.AutoUpdateBotInstanceReport{report}, nil
+		},
+		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateBotInstanceReport {
+			return &autoupdatev1.AutoUpdateBotInstanceReport{
+				Kind:    hdr.Kind,
+				Version: hdr.Version,
+				Metadata: &headerv1.Metadata{
+					Name: hdr.Metadata.Name,
+				},
+			}
+		},
+		watch: w,
+	}, nil
+}
+
+func (c *Cache) GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdatev1.AutoUpdateBotInstanceReport, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetAutoUpdateBotInstanceReport")
+	defer span.End()
+
+	getter := genericGetter[*autoupdatev1.AutoUpdateBotInstanceReport, autoUpdateBotInstanceReportIndex]{
+		cache:      c,
+		collection: c.collections.autoUpdateBotInstanceReports,
+		index:      autoUpdateBotInstanceReportNameIndex,
+		upstreamGet: func(ctx context.Context, _ string) (*autoupdatev1.AutoUpdateBotInstanceReport, error) {
+			return c.Config.AutoUpdateService.GetAutoUpdateBotInstanceReport(ctx)
+		},
+	}
+	out, err := getter.get(ctx, types.MetaNameAutoUpdateBotInstanceReport)
+	return out, trace.Wrap(err)
+}
diff --git a/lib/cache/auto_update_test.go b/lib/cache/auto_update_test.go
index ae0f82d4cb2ae..33ac82b2fbddf 100644
--- a/lib/cache/auto_update_test.go
+++ b/lib/cache/auto_update_test.go
@@ -33,7 +33,7 @@ func TestAutoUpdateConfig(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*autoupdatev1.AutoUpdateConfig]{
+	testResources153(t, p, testFuncs[*autoupdatev1.AutoUpdateConfig]{
 		newResource: func(name string) (*autoupdatev1.AutoUpdateConfig, error) {
 			return newAutoUpdateConfig(t), nil
 		},
@@ -41,24 +41,24 @@ func TestAutoUpdateConfig(t *testing.T) {
 			_, err := p.autoUpdateService.UpsertAutoUpdateConfig(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateConfig, error) {
+		list: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateConfig, error) {
 			item, err := p.autoUpdateService.GetAutoUpdateConfig(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateConfig{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateConfig{item}, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateConfig, error) {
+		}),
+		cacheList: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateConfig, error) {
 			item, err := p.cache.GetAutoUpdateConfig(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateConfig{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateConfig{item}, trace.Wrap(err)
-		},
+		}),
 		deleteAll: func(ctx context.Context) error {
 			return trace.Wrap(p.autoUpdateService.DeleteAutoUpdateConfig(ctx))
 		},
-	})
+	}, withSkipPaginationTest())
 }
 
 // TestAutoUpdateVersion tests that CRUD operations on AutoUpdateVersion resource are
@@ -69,7 +69,7 @@ func TestAutoUpdateVersion(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*autoupdatev1.AutoUpdateVersion]{
+	testResources153(t, p, testFuncs[*autoupdatev1.AutoUpdateVersion]{
 		newResource: func(name string) (*autoupdatev1.AutoUpdateVersion, error) {
 			return newAutoUpdateVersion(t), nil
 		},
@@ -77,24 +77,22 @@ func TestAutoUpdateVersion(t *testing.T) {
 			_, err := p.autoUpdateService.UpsertAutoUpdateVersion(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateVersion, error) {
+		list: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateVersion, error) {
 			item, err := p.autoUpdateService.GetAutoUpdateVersion(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateVersion{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateVersion{item}, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateVersion, error) {
+		}),
+		cacheList: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateVersion, error) {
 			item, err := p.cache.GetAutoUpdateVersion(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateVersion{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateVersion{item}, trace.Wrap(err)
-		},
-		deleteAll: func(ctx context.Context) error {
-			return trace.Wrap(p.autoUpdateService.DeleteAutoUpdateVersion(ctx))
-		},
-	})
+		}),
+		deleteAll: p.autoUpdateService.DeleteAutoUpdateVersion,
+	}, withSkipPaginationTest())
 }
 
 // TestAutoUpdateAgentRollout tests that CRUD operations on AutoUpdateAgentRollout resource are
@@ -105,7 +103,7 @@ func TestAutoUpdateAgentRollout(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*autoupdatev1.AutoUpdateAgentRollout]{
+	testResources153(t, p, testFuncs[*autoupdatev1.AutoUpdateAgentRollout]{
 		newResource: func(name string) (*autoupdatev1.AutoUpdateAgentRollout, error) {
 			return newAutoUpdateAgentRollout(t), nil
 		},
@@ -113,22 +111,20 @@ func TestAutoUpdateAgentRollout(t *testing.T) {
 			_, err := p.autoUpdateService.UpsertAutoUpdateAgentRollout(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateAgentRollout, error) {
+		list: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateAgentRollout, error) {
 			item, err := p.autoUpdateService.GetAutoUpdateAgentRollout(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateAgentRollout{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateAgentRollout{item}, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*autoupdatev1.AutoUpdateAgentRollout, error) {
+		}),
+		cacheList: getAllAdapter(func(ctx context.Context) ([]*autoupdatev1.AutoUpdateAgentRollout, error) {
 			item, err := p.cache.GetAutoUpdateAgentRollout(ctx)
 			if trace.IsNotFound(err) {
 				return []*autoupdatev1.AutoUpdateAgentRollout{}, nil
 			}
 			return []*autoupdatev1.AutoUpdateAgentRollout{item}, trace.Wrap(err)
-		},
-		deleteAll: func(ctx context.Context) error {
-			return trace.Wrap(p.autoUpdateService.DeleteAutoUpdateAgentRollout(ctx))
-		},
-	})
+		}),
+		deleteAll: p.autoUpdateService.DeleteAutoUpdateAgentRollout,
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/bot_instance.go b/lib/cache/bot_instance.go
new file mode 100644
index 0000000000000..daca25763d73e
--- /dev/null
+++ b/lib/cache/bot_instance.go
@@ -0,0 +1,209 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+	"encoding/base32"
+	"fmt"
+	"time"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/gravitational/teleport/api/defaults"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1/expression"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils/typical"
+)
+
+type botInstanceIndex string
+
+const (
+	botInstanceNameIndex     botInstanceIndex = "name"
+	botInstanceActiveAtIndex botInstanceIndex = "active_at_latest"
+	botInstanceVersionIndex  botInstanceIndex = "version_latest"
+	botInstanceHostnameIndex botInstanceIndex = "host_name_latest"
+)
+
+func newBotInstanceCollection(upstream services.BotInstance, w types.WatchKind) (*collection[*machineidv1.BotInstance, botInstanceIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter upstream (BotInstance)")
+	}
+
+	return &collection[*machineidv1.BotInstance, botInstanceIndex]{
+		store: newStore(
+			types.KindBotInstance,
+			proto.CloneOf[*machineidv1.BotInstance],
+			map[botInstanceIndex]func(*machineidv1.BotInstance) string{
+				// Index on a combination of bot name and instance name
+				botInstanceNameIndex: keyForBotInstanceNameIndex,
+				// Index on a combination of most recent heartbeat time and instance name
+				botInstanceActiveAtIndex: keyForBotInstanceActiveAtIndex,
+				// Index on a combination of most recent heartbeat version and instance name
+				botInstanceVersionIndex: keyForBotInstanceVersionIndex,
+				// Index on a combination of most recent heartbeat hostname and instance name
+				botInstanceHostnameIndex: keyForBotInstanceHostnameIndex,
+			}),
+		fetcher: func(ctx context.Context, loadSecrets bool) ([]*machineidv1.BotInstance, error) {
+			out, err := stream.Collect(clientutils.Resources(ctx,
+				func(ctx context.Context, limit int, start string) ([]*machineidv1.BotInstance, string, error) {
+					return upstream.ListBotInstances(ctx, limit, start, nil)
+				},
+			))
+			return out, trace.Wrap(err)
+		},
+		watch: w,
+	}, nil
+}
+
+// GetBotInstance returns the specified BotInstance resource.
+func (c *Cache) GetBotInstance(ctx context.Context, botName, instanceID string) (*machineidv1.BotInstance, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetBotInstance")
+	defer span.End()
+
+	getter := genericGetter[*machineidv1.BotInstance, botInstanceIndex]{
+		cache:      c,
+		collection: c.collections.botInstances,
+		index:      botInstanceNameIndex,
+		upstreamGet: func(ctx context.Context, _ string) (*machineidv1.BotInstance, error) {
+			return c.Config.BotInstanceService.GetBotInstance(ctx, botName, instanceID)
+		},
+	}
+
+	out, err := getter.get(ctx, makeBotInstanceNameIndexKey(botName, instanceID))
+	return out, trace.Wrap(err)
+}
+
+// ListBotInstances returns a page of BotInstance resources.
+// request *services.ListBotInstancesRequestOptions
+func (c *Cache) ListBotInstances(ctx context.Context, pageSize int, lastToken string, options *services.ListBotInstancesRequestOptions) ([]*machineidv1.BotInstance, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListBotInstances")
+	defer span.End()
+
+	index := botInstanceNameIndex
+	keyFn := keyForBotInstanceNameIndex
+	isDesc := options.GetSortDesc()
+	switch options.GetSortField() {
+	case "bot_name":
+		index = botInstanceNameIndex
+		keyFn = keyForBotInstanceNameIndex
+	case "active_at_latest":
+		index = botInstanceActiveAtIndex
+		keyFn = keyForBotInstanceActiveAtIndex
+	case "version_latest":
+		index = botInstanceVersionIndex
+		keyFn = keyForBotInstanceVersionIndex
+	case "host_name_latest":
+		index = botInstanceHostnameIndex
+		keyFn = keyForBotInstanceHostnameIndex
+	case "":
+		// default ordering as defined above
+	default:
+		return nil, "", trace.BadParameter("unsupported sort %q but expected bot_name, active_at_latest, version_latest or host_name_latest", options.GetSortField())
+	}
+
+	var exp typical.Expression[*expression.Environment, bool]
+	if options.GetFilterQuery() != "" {
+		parser, err := expression.NewBotInstanceExpressionParser()
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		exp, err = parser.Parse(options.GetFilterQuery())
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+	}
+
+	lister := genericLister[*machineidv1.BotInstance, botInstanceIndex]{
+		cache:           c,
+		collection:      c.collections.botInstances,
+		index:           index,
+		isDesc:          isDesc,
+		defaultPageSize: defaults.DefaultChunkSize,
+		upstreamList: func(ctx context.Context, limit int, start string) ([]*machineidv1.BotInstance, string, error) {
+			return c.Config.BotInstanceService.ListBotInstances(ctx, limit, start, options)
+		},
+		filter: func(b *machineidv1.BotInstance) bool {
+			return services.MatchBotInstance(b, options.GetFilterBotName(), options.GetFilterSearchTerm(), exp)
+		},
+		nextToken: func(b *machineidv1.BotInstance) string {
+			return keyFn(b)
+		},
+	}
+	out, next, err := lister.list(ctx,
+		pageSize,
+		lastToken,
+	)
+	return out, next, trace.Wrap(err)
+}
+
+func keyForBotInstanceNameIndex(botInstance *machineidv1.BotInstance) string {
+	return makeBotInstanceNameIndexKey(
+		botInstance.GetSpec().GetBotName(),
+		botInstance.GetMetadata().GetName(),
+	)
+}
+
+func makeBotInstanceNameIndexKey(botName string, instanceID string) string {
+	return botName + "/" + instanceID
+}
+
+func keyForBotInstanceActiveAtIndex(botInstance *machineidv1.BotInstance) string {
+	heartbeat := services.GetBotInstanceLatestHeartbeat(botInstance)
+	recordedAt := heartbeat.GetRecordedAt().AsTime()
+	return recordedAt.Format(time.RFC3339) + "/" + botInstance.GetMetadata().GetName()
+}
+
+// keyForBotInstanceVersionIndex produces a zero-padded version string for sorting. Pre-
+// releases are sorted naively - 1.0.0-rc is correctly less than 1.0.0, but
+// 1.0.0-rc.2 is more than 1.0.0-rc.11
+func keyForBotInstanceVersionIndex(botInstance *machineidv1.BotInstance) string {
+	version := "000000.000000.000000"
+	heartbeat := services.GetBotInstanceLatestHeartbeat(botInstance)
+	if heartbeat == nil {
+		return version + "-~/" + botInstance.GetMetadata().GetName()
+	}
+
+	sv, err := semver.NewVersion(heartbeat.GetVersion())
+	if err != nil {
+		return version + "-~/" + botInstance.GetMetadata().GetName()
+	}
+
+	version = fmt.Sprintf("%06d.%06d.%06d", sv.Major, sv.Minor, sv.Patch)
+	if sv.PreRelease != "" {
+		version = version + "-" + string(sv.PreRelease)
+	} else {
+		version = version + "-~"
+	}
+	return version + "/" + botInstance.GetMetadata().GetName()
+}
+
+func keyForBotInstanceHostnameIndex(botInstance *machineidv1.BotInstance) string {
+	hostname := "~"
+	heartbeat := services.GetBotInstanceLatestHeartbeat(botInstance)
+	if heartbeat != nil {
+		hostname = heartbeat.GetHostname()
+	}
+	hostname = hostname + "/" + botInstance.GetMetadata().GetName()
+	return base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString([]byte(hostname))
+}
diff --git a/lib/cache/bot_instance_test.go b/lib/cache/bot_instance_test.go
new file mode 100644
index 0000000000000..bca74ccc0521d
--- /dev/null
+++ b/lib/cache/bot_instance_test.go
@@ -0,0 +1,608 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// TestBotInstanceCache tests that CRUD operations on bot instances resources are
+// replicated from the backend to the cache.
+func TestBotInstanceCache(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	testResources153(t, p, testFuncs[*machineidv1.BotInstance]{
+		newResource: func(key string) (*machineidv1.BotInstance, error) {
+			return &machineidv1.BotInstance{
+				Kind:     types.KindBotInstance,
+				Version:  types.V1,
+				Metadata: &headerv1.Metadata{},
+				Spec: &machineidv1.BotInstanceSpec{
+					BotName:    "bot-1",
+					InstanceId: key,
+				},
+				Status: &machineidv1.BotInstanceStatus{},
+			}, nil
+		},
+		cacheGet: func(ctx context.Context, key string) (*machineidv1.BotInstance, error) {
+			return p.cache.GetBotInstance(ctx, "bot-1", key)
+		},
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1.BotInstance, string, error) {
+			return p.cache.ListBotInstances(ctx, pageSize, pageToken, nil)
+		},
+		create: func(ctx context.Context, resource *machineidv1.BotInstance) error {
+			_, err := p.botInstanceService.CreateBotInstance(ctx, resource)
+			return err
+		},
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1.BotInstance, string, error) {
+			return p.botInstanceService.ListBotInstances(ctx, pageSize, pageToken, nil)
+		},
+		update: func(ctx context.Context, bi *machineidv1.BotInstance) error {
+			_, err := p.botInstanceService.PatchBotInstance(ctx, "bot-1", bi.Metadata.GetName(), func(_ *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
+				return bi, nil
+			})
+			return err
+		},
+		delete: func(ctx context.Context, key string) error {
+			return p.botInstanceService.DeleteBotInstance(ctx, "bot-1", key)
+		},
+		deleteAll: func(ctx context.Context) error {
+			return p.botInstanceService.DeleteAllBotInstances(ctx)
+		},
+	}, withSkipPaginationTest())
+}
+
+// TestBotInstanceCachePaging tests that items from the cache are paginated.
+func TestBotInstanceCachePaging(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	for _, n := range []int{5, 1, 3, 4, 2} {
+		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-1",
+				InstanceId: "instance-" + strconv.Itoa(n),
+			},
+			Status: &machineidv1.BotInstanceStatus{},
+		})
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 5)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	// page size equal to total items
+	results, nextPageToken, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+	require.NoError(t, err)
+	require.Empty(t, nextPageToken)
+	require.Len(t, results, 5)
+	require.Equal(t, "instance-1", results[0].GetMetadata().GetName())
+	require.Equal(t, "instance-2", results[1].GetMetadata().GetName())
+	require.Equal(t, "instance-3", results[2].GetMetadata().GetName())
+	require.Equal(t, "instance-4", results[3].GetMetadata().GetName())
+	require.Equal(t, "instance-5", results[4].GetMetadata().GetName())
+
+	// page size smaller than total items
+	results, nextPageToken, err = p.cache.ListBotInstances(ctx, 3, "", nil)
+	require.NoError(t, err)
+	require.Equal(t, "bot-1/instance-4", nextPageToken)
+	require.Len(t, results, 3)
+	require.Equal(t, "instance-1", results[0].GetMetadata().GetName())
+	require.Equal(t, "instance-2", results[1].GetMetadata().GetName())
+	require.Equal(t, "instance-3", results[2].GetMetadata().GetName())
+
+	// next page
+	results, nextPageToken, err = p.cache.ListBotInstances(ctx, 3, nextPageToken, nil)
+	require.NoError(t, err)
+	require.Empty(t, nextPageToken)
+	require.Len(t, results, 2)
+	require.Equal(t, "instance-4", results[0].GetMetadata().GetName())
+	require.Equal(t, "instance-5", results[1].GetMetadata().GetName())
+}
+
+// TestBotInstanceCacheBotFilter tests that cache items are filtered by bot name.
+func TestBotInstanceCacheBotFilter(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	for n := range 10 {
+		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-" + strconv.Itoa(n%2),
+				InstanceId: "instance-" + strconv.Itoa(n),
+			},
+			Status: &machineidv1.BotInstanceStatus{},
+		})
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 10)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		FilterBotName: "bot-1",
+	})
+	require.NoError(t, err)
+	require.Len(t, results, 5)
+
+	for _, b := range results {
+		require.Equal(t, "bot-1", b.GetSpec().GetBotName())
+	}
+}
+
+// TestBotInstanceCacheSearchFilter tests that cache items are filtered by
+// search term.
+func TestBotInstanceCacheSearchFilter(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	for n := range 10 {
+		instance := &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-1",
+				InstanceId: "instance-" + strconv.Itoa(n+1),
+			},
+			Status: &machineidv1.BotInstanceStatus{
+				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
+					{
+						Hostname: "host-" + strconv.Itoa(n%2),
+					},
+				},
+			},
+		}
+
+		_, err := p.botInstanceService.CreateBotInstance(ctx, instance)
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 10)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		FilterSearchTerm: "host-1",
+	})
+	require.NoError(t, err)
+	require.Len(t, results, 5)
+}
+
+// TestBotInstanceCacheQueryFilter tests that cache items are filtered by query.
+func TestBotInstanceCacheQueryFilter(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-1",
+				InstanceId: "00000000-0000-0000-0000-000000000000",
+			},
+			Status: &machineidv1.BotInstanceStatus{
+				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
+					{
+						Hostname: "host-1",
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-1",
+				InstanceId: uuid.New().String(),
+			},
+			Status: &machineidv1.BotInstanceStatus{
+				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
+					{
+						Hostname: "host-2",
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 2)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		FilterQuery: `status.latest_heartbeat.hostname == "host-1"`,
+	})
+	require.NoError(t, err)
+	require.Len(t, results, 1)
+	require.Equal(t, "00000000-0000-0000-0000-000000000000", results[0].Spec.InstanceId)
+}
+
+// TestBotInstanceCacheSorting tests that cache items are sorted.
+func TestBotInstanceCacheSorting(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	items := []struct {
+		botName           string
+		instanceId        string
+		recordedAtSeconds int64
+		version           string
+		hostname          string
+	}{
+		{"bot-1", "instance-1", 2, "2.0.0", "hostname-2"},
+		{"bot-1", "instance-3", 1, "2.0.0-rc1", "hostname-3"},
+		{"bot-2", "instance-2", 3, "1.0.0", "hostname-1"},
+	}
+
+	for _, b := range items {
+		instance := &machineidv1.BotInstance{
+			Kind:     types.KindBotInstance,
+			Version:  types.V1,
+			Metadata: &headerv1.Metadata{},
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    b.botName,
+				InstanceId: b.instanceId,
+			},
+			Status: &machineidv1.BotInstanceStatus{
+				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
+					{
+						RecordedAt: &timestamppb.Timestamp{
+							Seconds: b.recordedAtSeconds,
+						},
+						Version:  b.version,
+						Hostname: b.hostname,
+					},
+				},
+			},
+		}
+
+		_, err := p.botInstanceService.CreateBotInstance(ctx, instance)
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	t.Run("sort ascending by active_at_latest", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "active_at_latest",
+			SortDesc:  false,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-3", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-1", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-2", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort descending by active_at_latest", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "active_at_latest",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-2", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-1", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-3", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort ascending by bot_name", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil) // empty sort should default to `bot_name:asc`
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-1", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-3", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-2", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort descending by bot_name", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "bot_name",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-2", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-3", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-1", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort ascending by version", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "version_latest",
+			SortDesc:  false,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-2", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-3", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-1", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort descending by version", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "version_latest",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		assert.Equal(t, "instance-1", results[0].GetMetadata().GetName())
+		assert.Equal(t, "instance-3", results[1].GetMetadata().GetName())
+		assert.Equal(t, "instance-2", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort ascending by hostname", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "host_name_latest",
+			SortDesc:  false,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		require.Equal(t, "instance-2", results[0].GetMetadata().GetName())
+		require.Equal(t, "instance-1", results[1].GetMetadata().GetName())
+		require.Equal(t, "instance-3", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort descending by hostname", func(t *testing.T) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "host_name_latest",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 3)
+		require.Equal(t, "instance-3", results[0].GetMetadata().GetName())
+		require.Equal(t, "instance-1", results[1].GetMetadata().GetName())
+		require.Equal(t, "instance-2", results[2].GetMetadata().GetName())
+	})
+
+	t.Run("sort invalid field", func(t *testing.T) {
+		_, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+			SortField: "blah",
+		})
+		require.Error(t, err)
+		assert.ErrorContains(t, err, `unsupported sort "blah" but expected bot_name, active_at_latest, version_latest or host_name_latest`)
+	})
+}
+
+// TestBotInstanceCacheFallback tests that requests fallback to the upstream when the cache is unhealthy.
+func TestBotInstanceCacheFallback(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+
+	p := newTestPack(t, func(cfg Config) Config {
+		cfg.neverOK = true // Force the cache into an unhealthy state
+		return ForAuth(cfg)
+	})
+	t.Cleanup(p.Close)
+
+	_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		Kind:     types.KindBotInstance,
+		Version:  types.V1,
+		Metadata: &headerv1.Metadata{},
+		Spec: &machineidv1.BotInstanceSpec{
+			BotName:    "bot-1",
+			InstanceId: "instance-1",
+		},
+		Status: &machineidv1.BotInstanceStatus{},
+	})
+	require.NoError(t, err)
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 1)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	// sort ascending by bot_name
+	results, _, err := p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		SortField: "bot_name",
+		SortDesc:  false,
+	})
+	require.NoError(t, err) // asc by bot_name is the only sort supported by the upstream
+	require.Len(t, results, 1)
+
+	// sort descending by bot_name
+	_, _, err = p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		SortField: "bot_name",
+		SortDesc:  true,
+	})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "unsupported sort, only ascending order is supported")
+
+	// sort ascending by active_at_latest
+	_, _, err = p.cache.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		SortField: "active_at_latest",
+		SortDesc:  false,
+	})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "unsupported sort, only bot_name field is supported, but got \"active_at_latest\"")
+}
+
+func TestKeyForVersionIndex(t *testing.T) {
+	t.Parallel()
+
+	tcs := []struct {
+		name      string
+		mutatorFn func(*machineidv1.BotInstance)
+		key       string
+	}{
+		{
+			name:      "zero heartbeats",
+			mutatorFn: func(b *machineidv1.BotInstance) {},
+			key:       "000000.000000.000000-~/bot-instance-1",
+		},
+		{
+			name: "invalid version",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						Version: "a.b.c",
+					},
+				}
+			},
+			key: "000000.000000.000000-~/bot-instance-1",
+		},
+		{
+			name: "initial heartbeat",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						Version: "1.0.0",
+					},
+				}
+			},
+			key: "000001.000000.000000-~/bot-instance-1",
+		},
+		{
+			name: "latest heartbeat",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
+						{
+							Version: "1.0.0",
+						},
+					},
+				}
+			},
+			key: "000001.000000.000000-~/bot-instance-1",
+		},
+		{
+			name: "with release",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						Version: "1.0.0-dev",
+					},
+				}
+			},
+			key: "000001.000000.000000-dev/bot-instance-1",
+		},
+		{
+			name: "with build",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						Version: "1.0.0+build1",
+					},
+				}
+			},
+			key: "000001.000000.000000-~/bot-instance-1",
+		},
+		{
+			name: "with release and build",
+			mutatorFn: func(b *machineidv1.BotInstance) {
+				b.Status = &machineidv1.BotInstanceStatus{
+					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						Version: "1.0.0-dev+build1",
+					},
+				}
+			},
+			key: "000001.000000.000000-dev/bot-instance-1",
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			instance := &machineidv1.BotInstance{
+				Kind:    types.KindBotInstance,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "bot-instance-1",
+				},
+				Spec:   &machineidv1.BotInstanceSpec{},
+				Status: &machineidv1.BotInstanceStatus{},
+			}
+			tc.mutatorFn(instance)
+
+			versionKey := keyForBotInstanceVersionIndex(instance)
+
+			assert.Equal(t, tc.key, versionKey)
+		})
+	}
+}
diff --git a/lib/cache/cache.go b/lib/cache/cache.go
index 70f15c6f4ae37..d3ee487f6cf87 100644
--- a/lib/cache/cache.go
+++ b/lib/cache/cache.go
@@ -33,20 +33,23 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/sync/errgroup"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/client/proto"
+	authproto "github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	apitracing "github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/observability/tracing"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/utils"
@@ -145,6 +148,8 @@ func ForAuth(cfg Config) Config {
 		{Kind: types.KindToken},
 		{Kind: types.KindUser},
 		{Kind: types.KindRole},
+		{Kind: scopedaccess.KindScopedRole},
+		{Kind: scopedaccess.KindScopedRoleAssignment},
 		{Kind: types.KindNode},
 		{Kind: types.KindProxy},
 		{Kind: types.KindAuthServer},
@@ -196,15 +201,20 @@ func ForAuth(cfg Config) Config {
 		{Kind: types.KindAutoUpdateConfig},
 		{Kind: types.KindAutoUpdateAgentRollout},
 		{Kind: types.KindAutoUpdateAgentReport},
+		{Kind: types.KindAutoUpdateBotInstanceReport},
 		{Kind: types.KindUserTask},
 		{Kind: types.KindProvisioningPrincipalState},
 		{Kind: types.KindIdentityCenterAccount},
 		{Kind: types.KindIdentityCenterPrincipalAssignment},
 		{Kind: types.KindIdentityCenterAccountAssignment},
+		{Kind: types.KindPlugin, LoadSecrets: true},
 		{Kind: types.KindPluginStaticCredentials},
 		{Kind: types.KindGitServer},
 		{Kind: types.KindWorkloadIdentity},
 		{Kind: types.KindHealthCheckConfig},
+		{Kind: types.KindRelayServer},
+		{Kind: types.KindBotInstance},
+		{Kind: types.KindRecordingEncryption},
 	}
 	cfg.QueueSize = defaults.AuthQueueSize
 	// We don't want to enable partial health for auth cache because auth uses an event stream
@@ -247,7 +257,6 @@ func ForProxy(cfg Config) Config {
 		{Kind: types.KindWindowsDesktop},
 		{Kind: types.KindDynamicWindowsDesktop},
 		{Kind: types.KindKubeServer},
-		{Kind: types.KindInstaller},
 		{Kind: types.KindKubernetesCluster},
 		{Kind: types.KindSAMLIdPServiceProvider},
 		{Kind: types.KindUserGroup},
@@ -261,11 +270,31 @@ func ForProxy(cfg Config) Config {
 		{Kind: types.KindAutoUpdateAgentRollout},
 		{Kind: types.KindUserTask},
 		{Kind: types.KindGitServer},
+		{Kind: types.KindHealthCheckConfig},
+		{Kind: types.KindRelayServer},
 	}
 	cfg.QueueSize = defaults.ProxyQueueSize
 	return cfg
 }
 
+// ForRelay sets up the given cache [Config] for use by the Relay cache.
+func ForRelay(cfg Config) Config {
+	cfg.target = "relay"
+	cfg.Watches = []types.WatchKind{
+		{Kind: types.KindCertAuthority, Filter: makeAllKnownCAsFilter().IntoMap()},
+		{Kind: types.KindClusterAuthPreference},
+		{Kind: types.KindClusterNetworkingConfig},
+		{Kind: types.KindKubeServer},
+		{Kind: types.KindNode},
+		{Kind: types.KindRelayServer},
+		{Kind: types.KindRole},
+		{Kind: types.KindSessionRecordingConfig},
+		{Kind: types.KindUser},
+	}
+	cfg.QueueSize = defaults.RelayQueueSize
+	return cfg
+}
+
 // ForRemoteProxy sets up watch configuration for remote proxies.
 func ForRemoteProxy(cfg Config) Config {
 	cfg.target = "remote-proxy"
@@ -340,6 +369,7 @@ func ForKubernetes(cfg Config) Config {
 		{Kind: types.KindKubeServer},
 		{Kind: types.KindKubernetesCluster},
 		{Kind: types.KindKubeWaitingContainer},
+		{Kind: types.KindHealthCheckConfig},
 	}
 	cfg.QueueSize = defaults.KubernetesQueueSize
 	return cfg
@@ -512,6 +542,8 @@ type Cache struct {
 	closed atomic.Bool
 }
 
+var _ authclient.Cache = (*Cache)(nil)
+
 func (c *Cache) setInitError(err error) {
 	c.initOnce.Do(func() {
 		c.initErr = err
@@ -624,7 +656,7 @@ type Config struct {
 	// Restrictions is a restrictions service
 	Restrictions services.Restrictions
 	// Apps is an apps service.
-	Apps services.Apps
+	Apps services.Applications
 	// Kubernetes is an kubernetes service.
 	Kubernetes services.Kubernetes
 	// CrownJewels is a CrownJewels service.
@@ -642,7 +674,7 @@ type Config struct {
 	// WebSession holds regular web sessions.
 	WebSession types.WebSessionInterface
 	// WebToken holds web tokens.
-	WebToken types.WebTokenInterface
+	WebToken services.WebToken
 	// WindowsDesktops is a windows desktop service.
 	WindowsDesktops services.WindowsDesktops
 	// DynamicWindowsDesktops is a dynamic Windows desktop service.
@@ -678,8 +710,6 @@ type Config struct {
 	// WorkloadIdentity is the upstream Workload Identities service that we're
 	// caching
 	WorkloadIdentity services.WorkloadIdentities
-	// Backend is a backend for local cache
-	Backend backend.Backend
 	// MaxRetryPeriod is the maximum period between cache retries on failures
 	MaxRetryPeriod time.Duration
 	// WatcherInitTimeout is the maximum acceptable delay for an
@@ -713,6 +743,8 @@ type Config struct {
 	neverOK bool
 	// Tracer is used to create spans
 	Tracer oteltrace.Tracer
+	// Registerer is used to register prometheus metrics.
+	Registerer prometheus.Registerer
 	// Unstarted indicates that the cache should not be started during New. The
 	// cache is usable before it's started, but it will always hit the backend.
 	Unstarted bool
@@ -736,6 +768,11 @@ type Config struct {
 	GitServers services.GitServerGetter
 	// HealthCheckConfig is a health check config service.
 	HealthCheckConfig services.HealthCheckConfigReader
+	// BotInstanceService is the upstream service that we're caching
+	BotInstanceService services.BotInstance
+	Plugin             services.Plugins
+	// RecordingEncryption manages state surrounding session recording encryption
+	RecordingEncryption services.RecordingEncryption
 }
 
 // CheckAndSetDefaults checks parameters and sets default values
@@ -743,9 +780,6 @@ func (c *Config) CheckAndSetDefaults() error {
 	if c.Events == nil {
 		return trace.BadParameter("missing Events parameter")
 	}
-	if c.Backend == nil {
-		return trace.BadParameter("missing Backend parameter")
-	}
 	if c.Context == nil {
 		c.Context = context.Background()
 	}
@@ -786,6 +820,9 @@ func (c *Config) CheckAndSetDefaults() error {
 	if c.Tracer == nil {
 		c.Tracer = tracing.NoopTracer(c.Component)
 	}
+	if c.Registerer == nil {
+		c.Registerer = prometheus.DefaultRegisterer
+	}
 	if c.FanoutShards == 0 {
 		c.FanoutShards = 1
 	}
@@ -818,7 +855,15 @@ const (
 
 // New creates a new instance of Cache
 func New(config Config) (*Cache, error) {
-	if err := metrics.RegisterPrometheusCollectors(
+	if err := config.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := backendmetrics.RegisterCollectors(config.Registerer); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := metrics.RegisterCollectors(config.Registerer,
 		cacheEventsReceived,
 		cacheStaleEventsReceived,
 		cacheHealth,
@@ -827,10 +872,6 @@ func New(config Config) (*Cache, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := config.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	ctx, cancel := context.WithCancel(config.Context)
 	fnCache, err := utils.NewFnCache(utils.FnCacheConfig{
 		TTL:     time.Second,
@@ -1563,7 +1604,7 @@ func (c *Cache) processEvent(ctx context.Context, event types.Event) error {
 }
 
 // ListResources is a part of auth.Cache implementation
-func (c *Cache) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+func (c *Cache) ListResources(ctx context.Context, req authproto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListResources")
 	defer span.End()
 
@@ -1588,7 +1629,7 @@ func (c *Cache) ListResources(ctx context.Context, req proto.ListResourcesReques
 	return resp, trace.Wrap(err)
 }
 
-func (c *Cache) listResourcesFallback(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+func (c *Cache) listResourcesFallback(ctx context.Context, req authproto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/listResourcesFallback")
 	defer span.End()
 
@@ -1629,22 +1670,13 @@ func (c *Cache) listResourcesFallback(ctx context.Context, req proto.ListResourc
 	return resp, trace.Wrap(err)
 }
 
-func (c *Cache) listResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+func (c *Cache) listResources(ctx context.Context, req authproto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	_, span := c.Tracer.Start(ctx, "cache/listResources")
 	defer span.End()
 
-	filter := services.MatchResourceFilter{
-		ResourceKind:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
-	}
-
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		filter.PredicateExpression = expression
+	filter, err := services.MatchResourceFilterFromListResourceRequest(&req)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	// Adjust page size, so it can't be empty.
@@ -1730,7 +1762,7 @@ func (c *Cache) listResources(ctx context.Context, req proto.ListResourcesReques
 			func(r types.ResourceWithLabels) types.ResourceWithLabels {
 				unwrapper := r.(types.Resource153UnwrapperT[*identitycenterv1.Account])
 				return types.Resource153ToResourceWithLabels(services.IdentityCenterAccount{
-					Account: apiutils.CloneProtoMsg(unwrapper.UnwrapT()),
+					Account: proto.CloneOf(unwrapper.UnwrapT()),
 				})
 			},
 		)
@@ -1749,11 +1781,19 @@ func (c *Cache) listResources(ctx context.Context, req proto.ListResourcesReques
 			func(r types.ResourceWithLabels) types.ResourceWithLabels {
 				unwrapper := r.(types.Resource153UnwrapperT[*identitycenterv1.AccountAssignment])
 				return types.Resource153ToResourceWithLabels(services.IdentityCenterAccountAssignment{
-					AccountAssignment: apiutils.CloneProtoMsg(unwrapper.UnwrapT()),
+					AccountAssignment: proto.CloneOf(unwrapper.UnwrapT()),
 				})
 			},
 		)
 		return resp, trace.Wrap(err)
+	case types.KindSAMLIdPServiceProvider:
+		resp, err := buildListResourcesResponse(
+			c.collections.samlIdPServiceProviders.store.resources(samlIdPServiceProviderNameIndex, req.StartKey, ""),
+			limit,
+			filter,
+			types.SAMLIdPServiceProvider.CloneResource,
+		)
+		return resp, trace.Wrap(err)
 	default:
 		return nil, trace.NotImplemented("%s not implemented at ListResources", req.ResourceType)
 	}
diff --git a/lib/cache/cache_test.go b/lib/cache/cache_test.go
index c4abc1efcad4a..f481fe9ae1ed7 100644
--- a/lib/cache/cache_test.go
+++ b/lib/cache/cache_test.go
@@ -20,7 +20,9 @@ package cache
 
 import (
 	"context"
+	"crypto/x509/pkix"
 	"fmt"
+	"iter"
 	"log/slog"
 	"os"
 	"slices"
@@ -53,7 +55,10 @@ import (
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
@@ -69,27 +74,48 @@ import (
 	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/api/types/userprovisioning"
 	"github.com/gravitational/teleport/api/types/usertasks"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/srv/db/common/databaseobject"
+	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const eventBufferSize = 1024
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
+	modules.SetModules(&modulestest.Modules{
+		TestFeatures: modules.Features{
+			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
+				entitlements.Identity: {Enabled: true},
+				entitlements.AccessLists: {
+					Enabled: true,
+					Limit:   2000,
+				},
+			},
+		},
+	})
 	os.Exit(m.Run())
 }
 
 // TestNodesDontCacheHighVolumeResources verifies that resources classified as "high volume" aren't
 // cached by nodes.
 func TestNodesDontCacheHighVolumeResources(t *testing.T) {
+	t.Parallel()
 	for _, kind := range ForNode(Config{}).Watches {
 		require.False(t, isHighVolumeResource(kind.Kind), "resource=%q", kind.Kind)
 	}
@@ -98,12 +124,10 @@ func TestNodesDontCacheHighVolumeResources(t *testing.T) {
 // testPack contains pack of
 // services used for test run
 type testPack struct {
-	dataDir      string
-	backend      *backend.Wrapper
-	eventsC      chan Event
-	cache        *Cache
-	cacheBackend backend.Backend
-
+	dataDir                 string
+	backend                 *backend.Wrapper
+	eventsC                 chan Event
+	cache                   *Cache
 	eventsS                 *proxyEvents
 	trustS                  *local.CA
 	provisionerS            *local.ProvisioningService
@@ -120,7 +144,7 @@ type testPack struct {
 	databases               *local.DatabaseService
 	databaseServices        *local.DatabaseServicesService
 	webSessionS             types.WebSessionInterface
-	webTokenS               types.WebTokenInterface
+	webTokenS               *local.IdentityService
 	windowsDesktops         *local.WindowsDesktopService
 	dynamicWindowsDesktops  *local.DynamicWindowsDesktopService
 	samlIDPServiceProviders *local.SAMLIdPServiceProviderService
@@ -146,30 +170,121 @@ type testPack struct {
 	gitServers              *local.GitServerService
 	workloadIdentity        *local.WorkloadIdentityService
 	healthCheckConfig       *local.HealthCheckConfigService
+	botInstanceService      *local.BotInstanceService
+	plugin                  *local.PluginsService
+	recordingEncryption     *local.RecordingEncryptionService
+}
+
+// resourceOps contains helpers to modify the state of either types.Resource or types.Resource153  which
+// have a slightly different interface.
+type resourceOps[T any] struct {
+	Name    func(T) string
+	Setup   func(T)
+	Modify  func(T)
+	cmpOpts []cmp.Option
+}
+
+func defaultResourceOps[T types.Resource]() *resourceOps[T] {
+	return &resourceOps[T]{
+		Modify: func(t T) {
+			// types.Resource metadata is immutable, modify expiry only.
+			if t.Expiry().IsZero() {
+				t.SetExpiry(time.Now().Add(30 * time.Minute))
+			} else {
+				t.SetExpiry(t.Expiry().Add(30 * time.Minute))
+			}
+		},
+		Name: func(t T) string { return t.GetName() },
+		Setup: func(t T) {
+			// types.Resource metadata is immutable, modify expiry only.
+			if t.Expiry().IsZero() {
+				t.SetExpiry(time.Now().Add(30 * time.Minute))
+			} else {
+				t.SetExpiry(t.Expiry().Add(30 * time.Minute))
+			}
+		},
+		cmpOpts: []cmp.Option{
+			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+			cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		},
+	}
+}
+
+func defaultResource153Ops[T types.Resource153]() *resourceOps[T] {
+	return &resourceOps[T]{
+		Setup: func(t T) {
+			metadata := t.GetMetadata()
+			if metadata.Expires == nil {
+				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			} else {
+				expiry := metadata.Expires.AsTime()
+				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+			}
+			metadata.Labels = map[string]string{"label": "value1"}
+		},
+		Modify: func(t T) {
+			metadata := t.GetMetadata()
+			if metadata.Expires == nil {
+				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			} else {
+				expiry := metadata.Expires.AsTime()
+				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+			}
+			metadata.Labels["label"] = "value2"
+		},
+		Name: func(t T) string { return t.GetMetadata().GetName() },
+		cmpOpts: []cmp.Option{
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+			protocmp.Transform(),
+			cmpopts.EquateEmpty(),
+		},
+	}
+}
+
+// getAllAdapter adapts collection getters that do not support pagination to conform to [testFuncs] interface
+// TODO(okraport): delete this once all APIs are paginated.
+func getAllAdapter[T any](fn func(context.Context) ([]T, error)) func(context.Context, int, string) ([]T, string, error) {
+	return func(ctx context.Context, _ int, _ string) ([]T, string, error) {
+		out, err := fn(ctx)
+		return out, "", trace.Wrap(err)
+	}
+}
+
+// singletonListAdapter adapts a singleton getter to conform to [testFuncs] interface
+func singletonListAdapter[T any](fn func(context.Context) (T, error)) func(context.Context, int, string) ([]T, string, error) {
+	return func(ctx context.Context, _ int, _ string) ([]T, string, error) {
+		out, err := fn(ctx)
+		if err != nil {
+			if trace.IsNotFound(err) {
+				return nil, "", nil
+			}
+			return nil, "", trace.Wrap(err)
+		}
+		return []T{out}, "", nil
+	}
 }
 
 // testFuncs are functions to support testing an object in a cache.
-type testFuncs[T types.Resource] struct {
-	newResource    func(string) (T, error)
-	create         func(context.Context, T) error
-	list           func(context.Context) ([]T, error)
-	cacheGet       func(context.Context, string) (T, error)
-	cacheList      func(context.Context) ([]T, error)
-	update         func(context.Context, T) error
-	deleteAll      func(context.Context) error
-	changeResource func(T)
-}
-
-// testFuncs153 are functions to support testing an RFD153-style resource in a cache.
-type testFuncs153[T types.Resource153] struct {
+type testFuncs[T any] struct {
 	newResource func(string) (T, error)
 	create      func(context.Context, T) error
-	list        func(context.Context) ([]T, error)
+	list        func(context.Context, int, string) ([]T, string, error)
+	Range       func(context.Context, string, string) iter.Seq2[T, error]
 	cacheGet    func(context.Context, string) (T, error)
-	cacheList   func(context.Context) ([]T, error)
+	cacheList   func(context.Context, int, string) ([]T, string, error)
+	cacheRange  func(context.Context, string, string) iter.Seq2[T, error]
 	update      func(context.Context, T) error
 	delete      func(context.Context, string) error
 	deleteAll   func(context.Context) error
+	resource    *resourceOps[T]
+}
+
+func (f *testFuncs[T]) listAll(ctx context.Context) ([]T, error) {
+	return stream.Collect(clientutils.Resources(ctx, f.list))
+}
+
+func (f *testFuncs[T]) cacheListAll(ctx context.Context) ([]T, error) {
+	return stream.Collect(clientutils.Resources(ctx, f.cacheList))
 }
 
 func (t *testPack) Close() {
@@ -189,8 +304,8 @@ func newPackForAuth(t *testing.T) *testPack {
 	return newTestPack(t, ForAuth)
 }
 
-func newTestPack(t *testing.T, setupConfig SetupConfigFn) *testPack {
-	pack, err := newPack(t.TempDir(), setupConfig)
+func newTestPack(t *testing.T, setupConfig SetupConfigFn, opts ...packOption) *testPack {
+	pack, err := newPack(t, setupConfig, opts...)
 	require.NoError(t, err)
 	return pack
 }
@@ -202,18 +317,11 @@ func newTestPackWithoutCache(t *testing.T) *testPack {
 }
 
 type packCfg struct {
-	memoryBackend bool
-	ignoreKinds   []types.WatchKind
+	ignoreKinds []types.WatchKind
 }
 
 type packOption func(cfg *packCfg)
 
-func memoryBackend(bool) packOption {
-	return func(cfg *packCfg) {
-		cfg.memoryBackend = true
-	}
-}
-
 // ignoreKinds specifies the list of kinds that should be removed from the watch request by eventsProxy
 // to simulate cache resource type rejection due to version incompatibility.
 func ignoreKinds(kinds []types.WatchKind) packOption {
@@ -233,33 +341,15 @@ func newPackWithoutCache(dir string, opts ...packOption) (*testPack, error) {
 	p := &testPack{
 		dataDir: dir,
 	}
-	var bk backend.Backend
-	var err error
-	if cfg.memoryBackend {
-		bk, err = memory.New(memory.Config{
-			Context: ctx,
-			Mirror:  true,
-		})
-	} else {
-		bk, err = lite.NewWithConfig(ctx, lite.Config{
-			Path:             p.dataDir,
-			PollStreamPeriod: 200 * time.Millisecond,
-		})
-	}
+	bk, err := memory.New(memory.Config{
+		Context: ctx,
+		Mirror:  true,
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	p.backend = backend.NewWrapper(bk)
 
-	p.cacheBackend, err = memory.New(
-		memory.Config{
-			Context: ctx,
-			Mirror:  true,
-		})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	p.eventsC = make(chan Event, eventBufferSize)
 
 	clusterConfig, err := local.NewClusterConfigurationService(p.backend)
@@ -288,7 +378,7 @@ func newPackWithoutCache(dir string, opts ...packOption) (*testPack, error) {
 	p.appSessionS = idService
 	p.webSessionS = idService.WebSessions()
 	p.snowflakeSessionS = idService
-	p.webTokenS = idService.WebTokens()
+	p.webTokenS = idService
 	p.restrictions = local.NewRestrictionsService(p.backend)
 	p.apps = local.NewAppService(p.backend)
 	p.kubernetes = local.NewKubernetesService(p.backend)
@@ -423,21 +513,33 @@ func newPackWithoutCache(dir string, opts ...packOption) (*testPack, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	p.plugin = local.NewPluginsService(p.backend)
+
+	p.botInstanceService, err = local.NewBotInstanceService(p.backend, p.backend.Clock())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	p.recordingEncryption, err = local.NewRecordingEncryptionService(p.backend)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 
 	return p, nil
 }
 
 // newPack returns a new test pack or fails the test on error
-func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption) (*testPack, error) {
-	ctx := context.Background()
-	p, err := newPackWithoutCache(dir, opts...)
+func newPack(t testing.TB, setupConfig func(c Config) Config, opts ...packOption) (*testPack, error) {
+	t.Helper()
+
+	ctx := t.Context()
+	p, err := newPackWithoutCache(t.TempDir(), opts...)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	p.cache, err = New(setupConfig(Config{
 		Context:                 ctx,
-		Backend:                 p.cacheBackend,
 		Events:                  p.eventsS,
 		ClusterConfig:           p.clusterConfigS,
 		Provisioner:             p.provisionerS,
@@ -480,6 +582,9 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
 		GitServers:              p.gitServers,
 		HealthCheckConfig:       p.healthCheckConfig,
 		WorkloadIdentity:        p.workloadIdentity,
+		BotInstanceService:      p.botInstanceService,
+		Plugin:                  p.plugin,
+		RecordingEncryption:     p.recordingEncryption,
 		MaxRetryPeriod:          200 * time.Millisecond,
 		EventsC:                 p.eventsC,
 	}))
@@ -487,15 +592,14 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
 		return nil, trace.Wrap(err)
 	}
 
-	select {
-	case event := <-p.eventsC:
-
-		if event.Type != WatcherStarted {
-			return nil, trace.CompareFailed("%q != %q %s", event.Type, WatcherStarted, event)
-		}
-	case <-time.After(time.Second):
-		return nil, trace.ConnectionProblem(nil, "wait for the watcher to start")
+	// Wait for the watcher to start. Note that we do not enforce a timeout on this, as depending on the machine
+	// the calling test runs on and CPU/scheduler contention the expected time may vary. If the watcher fails to start we will
+	// timeout due to the top level harness timeout setting instead.
+	event := <-p.eventsC
+	if event.Type != WatcherStarted {
+		return nil, trace.CompareFailed("%q != %q %s", event.Type, WatcherStarted, event)
 	}
+
 	return p, nil
 }
 
@@ -536,7 +640,7 @@ func TestWatchers(t *testing.T) {
 		t.Fatalf("Timeout waiting for event.")
 	}
 
-	ca := suite.NewTestCA(types.UserCA, "example.com")
+	ca := NewTestCA(types.UserCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
 
 	select {
@@ -595,7 +699,7 @@ func TestWatchers(t *testing.T) {
 
 	// this ca will not be matched by our filter, so the same reasoning applies
 	// as we upsert it and delete it
-	filteredCa := suite.NewTestCA(types.HostCA, "example.net")
+	filteredCa := NewTestCA(types.HostCA, "example.net")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, filteredCa))
 	require.NoError(t, p.trustS.DeleteCertAuthority(ctx, filteredCa.GetID()))
 
@@ -690,27 +794,18 @@ func TestCompletenessInit(t *testing.T) {
 
 	// put lots of CAs in the backend
 	for i := 0; i < caCount; i++ {
-		ca := suite.NewTestCA(types.UserCA, fmt.Sprintf("%d.example.com", i))
+		ca := NewTestCA(types.UserCA, fmt.Sprintf("%d.example.com", i))
 		require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
 	}
 
-	for i := 0; i < inits; i++ {
-		var err error
-
-		p.cacheBackend, err = memory.New(
-			memory.Config{
-				Context: ctx,
-				Mirror:  true,
-			})
-		require.NoError(t, err)
-
+	for range inits {
 		// simulate bad connection to auth server
 		p.backend.SetReadError(trace.ConnectionProblem(nil, "backend is unavailable"))
 		p.eventsS.closeWatchers()
 
+		var err error
 		p.cache, err = New(ForAuth(Config{
 			Context:                 ctx,
-			Backend:                 p.cacheBackend,
 			Events:                  p.eventsS,
 			ClusterConfig:           p.clusterConfigS,
 			Provisioner:             p.provisionerS,
@@ -749,12 +844,15 @@ func TestCompletenessInit(t *testing.T) {
 			AutoUpdateService:       p.autoUpdateService,
 			ProvisioningStates:      p.provisioningStates,
 			WorkloadIdentity:        p.workloadIdentity,
+			RecordingEncryption:     p.recordingEncryption,
 			MaxRetryPeriod:          200 * time.Millisecond,
 			IdentityCenter:          p.identityCenter,
 			PluginStaticCredentials: p.pluginStaticCredentials,
 			EventsC:                 p.eventsC,
 			GitServers:              p.gitServers,
 			HealthCheckConfig:       p.healthCheckConfig,
+			BotInstanceService:      p.botInstanceService,
+			Plugin:                  p.plugin,
 		}))
 		require.NoError(t, err)
 
@@ -772,8 +870,6 @@ func TestCompletenessInit(t *testing.T) {
 
 		require.NoError(t, p.cache.Close())
 		p.cache = nil
-		require.NoError(t, p.cacheBackend.Close())
-		p.cacheBackend = nil
 	}
 }
 
@@ -790,14 +886,13 @@ func TestCompletenessReset(t *testing.T) {
 
 	// put lots of CAs in the backend
 	for i := 0; i < caCount; i++ {
-		ca := suite.NewTestCA(types.UserCA, fmt.Sprintf("%d.example.com", i))
+		ca := NewTestCA(types.UserCA, fmt.Sprintf("%d.example.com", i))
 		require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
 	}
 
 	var err error
 	p.cache, err = New(ForAuth(Config{
 		Context:                 ctx,
-		Backend:                 p.cacheBackend,
 		Events:                  p.eventsS,
 		ClusterConfig:           p.clusterConfigS,
 		Provisioner:             p.provisionerS,
@@ -838,10 +933,13 @@ func TestCompletenessReset(t *testing.T) {
 		IdentityCenter:          p.identityCenter,
 		PluginStaticCredentials: p.pluginStaticCredentials,
 		WorkloadIdentity:        p.workloadIdentity,
+		RecordingEncryption:     p.recordingEncryption,
 		MaxRetryPeriod:          200 * time.Millisecond,
 		EventsC:                 p.eventsC,
 		GitServers:              p.gitServers,
 		HealthCheckConfig:       p.healthCheckConfig,
+		BotInstanceService:      p.botInstanceService,
+		Plugin:                  p.plugin,
 	}))
 	require.NoError(t, err)
 
@@ -887,7 +985,7 @@ cpu: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
 BenchmarkListResourcesWithSort-8               1        2351035036 ns/op
 */
 func BenchmarkListResourcesWithSort(b *testing.B) {
-	p, err := newPack(b.TempDir(), ForAuth, memoryBackend(true))
+	p, err := newPack(b, ForAuth)
 	require.NoError(b, err)
 	defer p.Close()
 
@@ -895,7 +993,7 @@ func BenchmarkListResourcesWithSort(b *testing.B) {
 
 	count := 100000
 	for i := 0; i < count; i++ {
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
 		// Set some static and dynamic labels.
 		server.Metadata.Labels = map[string]string{"os": "mac", "env": "prod", "country": "us", "tier": "frontend"}
 		server.Spec.CmdLabels = map[string]types.CommandLabelV2{
@@ -954,7 +1052,6 @@ func TestListResources_NodesTTLVariant(t *testing.T) {
 
 	p.cache, err = New(ForAuth(Config{
 		Context:                 ctx,
-		Backend:                 p.cacheBackend,
 		Events:                  p.eventsS,
 		ClusterConfig:           p.clusterConfigS,
 		Provisioner:             p.provisionerS,
@@ -995,16 +1092,19 @@ func TestListResources_NodesTTLVariant(t *testing.T) {
 		IdentityCenter:          p.identityCenter,
 		PluginStaticCredentials: p.pluginStaticCredentials,
 		WorkloadIdentity:        p.workloadIdentity,
+		RecordingEncryption:     p.recordingEncryption,
 		MaxRetryPeriod:          200 * time.Millisecond,
 		EventsC:                 p.eventsC,
 		neverOK:                 true, // ensure reads are never healthy
 		GitServers:              p.gitServers,
 		HealthCheckConfig:       p.healthCheckConfig,
+		BotInstanceService:      p.botInstanceService,
+		Plugin:                  p.plugin,
 	}))
 	require.NoError(t, err)
 
 	for i := 0; i < nodeCount; i++ {
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
 		_, err := p.presenceS.UpsertNode(ctx, server)
 		require.NoError(t, err)
 	}
@@ -1052,7 +1152,6 @@ func initStrategy(t *testing.T) {
 	var err error
 	p.cache, err = New(ForAuth(Config{
 		Context:                 ctx,
-		Backend:                 p.cacheBackend,
 		Events:                  p.eventsS,
 		ClusterConfig:           p.clusterConfigS,
 		Provisioner:             p.provisionerS,
@@ -1093,17 +1192,20 @@ func initStrategy(t *testing.T) {
 		IdentityCenter:          p.identityCenter,
 		PluginStaticCredentials: p.pluginStaticCredentials,
 		WorkloadIdentity:        p.workloadIdentity,
+		RecordingEncryption:     p.recordingEncryption,
 		MaxRetryPeriod:          200 * time.Millisecond,
 		EventsC:                 p.eventsC,
 		GitServers:              p.gitServers,
 		HealthCheckConfig:       p.healthCheckConfig,
+		BotInstanceService:      p.botInstanceService,
+		Plugin:                  p.plugin,
 	}))
 	require.NoError(t, err)
 
 	_, err = p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 	require.True(t, trace.IsConnectionProblem(err))
 
-	ca := suite.NewTestCA(types.UserCA, "example.com")
+	ca := NewTestCA(types.UserCA, "example.com")
 	// NOTE 1: this could produce event processed
 	// below, based on whether watcher restarts to get the event
 	// or not, which is normal, but has to be accounted below
@@ -1165,7 +1267,7 @@ func TestRecovery(t *testing.T) {
 	p := newPackForAuth(t)
 	t.Cleanup(p.Close)
 
-	ca := suite.NewTestCA(types.UserCA, "example.com")
+	ca := NewTestCA(types.UserCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
 
 	select {
@@ -1184,7 +1286,7 @@ func TestRecovery(t *testing.T) {
 	waitForRestart(t, p.eventsC)
 
 	// add modification and expect the resource to recover
-	ca2 := suite.NewTestCA(types.UserCA, "example2.com")
+	ca2 := NewTestCA(types.UserCA, "example2.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca2))
 
 	// wait for watcher to receive an event
@@ -1241,112 +1343,72 @@ func newUserTasks(t *testing.T) *usertasksv1.UserTask {
 	return ut
 }
 
-// testResources is a generic tester for resources.
-func testResources[T types.Resource](t *testing.T, p *testPack, funcs testFuncs[T]) {
-	ctx := context.Background()
-
-	if funcs.changeResource == nil {
-		funcs.changeResource = func(t T) {
-			if t.Expiry().IsZero() {
-				t.SetExpiry(time.Now().Add(30 * time.Minute))
-			} else {
-				t.SetExpiry(t.Expiry().Add(30 * time.Minute))
-			}
-		}
-	}
-
-	// Create a resource.
-	r, err := funcs.newResource("test-sp")
-	require.NoError(t, err)
-	funcs.changeResource(r)
+type testOptions struct {
+	skipPaginationTest bool
+}
 
-	err = funcs.create(ctx, r)
-	require.NoError(t, err)
+type optionsFunc func(*testOptions)
 
-	cmpOpts := []cmp.Option{
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+// TODO(okraport): remove this when all getters support pagination.
+func withSkipPaginationTest() optionsFunc {
+	return func(opts *testOptions) {
+		opts.skipPaginationTest = true
 	}
+}
 
-	// Check that the resource is now in the backend.
-	out, err := funcs.list(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
-
-	// Wait until the information has been replicated to the cache.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		// Make sure the cache has a single resource in it.
-		out, err = funcs.cacheList(ctx)
-		assert.NoError(t, err)
-		assert.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
-	}, time.Second*2, time.Millisecond*250)
+// testResources is a wrapper for testing resources conforming to types.Resource
+func testResources[T types.Resource](t *testing.T, p *testPack, funcs testFuncs[T], opts ...optionsFunc) {
+	funcs.resource = defaultResourceOps[T]()
+	testResourcesInternal(t, p, funcs, opts...)
+}
 
-	// cacheGet is optional as not every resource implements it
-	if funcs.cacheGet != nil {
-		// Make sure a single cache get works.
-		getR, err := funcs.cacheGet(ctx, r.GetName())
-		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(r, getR, cmpOpts...))
-	}
+// testResources153 is a wrapper for testing resources conforming to types.Resource153
+func testResources153[T types.Resource153](t *testing.T, p *testPack, funcs testFuncs[T], opts ...optionsFunc) {
+	// TODO(rana): Add broader support for virtual resources in list operations.
+	// Virtual resources change the total count returned by list operations,
+	// and is unexpected for the current test. When updated, we can remove virtual
+	// resource filtering and paging from lib/cache/health_check_config_test.go.
+	opts = append(opts, withSkipPaginationTest())
+	funcs.resource = defaultResource153Ops[T]()
+	testResourcesInternal(t, p, funcs, opts...)
+}
 
-	// update is optional as not every resource implements it
+// testResourcesInternal is a generic tester for resources.
+func testResourcesInternal[T any](t *testing.T, p *testPack, funcs testFuncs[T], opts ...optionsFunc) {
+	t.Helper()
+	require.NotNil(t, funcs.resource)
+	require.NotNil(t, funcs.resource.Name)
 	if funcs.update != nil {
-		// Update the resource and upsert it into the backend again.
-		funcs.changeResource(r)
-		err = funcs.update(ctx, r)
-		require.NoError(t, err)
+		require.NotNil(t, funcs.resource.Modify)
+		require.NotNil(t, funcs.resource.Setup)
 	}
 
-	// Check that the resource is in the backend and only one exists (so an
-	// update occurred).
-	out, err = funcs.list(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
-
-	// Check that information has been replicated to the cache.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		// Make sure the cache has a single resource in it.
-		out, err = funcs.cacheList(ctx)
-		assert.NoError(t, err)
-		assert.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
-	}, time.Second*2, time.Millisecond*250)
-
-	// Remove all service providers from the backend.
-	err = funcs.deleteAll(ctx)
-	require.NoError(t, err)
-	// Check that information has been replicated to the cache.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		// Check that the cache is now empty.
-		out, err = funcs.cacheList(ctx)
-		assert.NoError(t, err)
-		assert.Empty(t, out)
-	}, time.Second*2, time.Millisecond*250)
-}
+	var options testOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+	ctx := t.Context()
 
-// testResources153 is a generic tester for RFD153-style resources.
-func testResources153[T types.Resource153](t *testing.T, p *testPack, funcs testFuncs153[T]) {
-	ctx := context.Background()
+	if !options.skipPaginationTest {
+		testResourcePagination(t, p, funcs)
+	}
 
 	// Create a resource.
-	r, err := funcs.newResource("test-resource")
+	r, err := funcs.newResource("test-resource-1")
 	require.NoError(t, err)
 	// update is optional as not every resource implements it
 	if funcs.update != nil {
-		r.GetMetadata().Labels = map[string]string{"label": "value1"}
+		funcs.resource.Setup(r)
 	}
 
 	err = funcs.create(ctx, r)
 	require.NoError(t, err)
 
-	cmpOpts := []cmp.Option{
-		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
-		protocmp.Transform(),
-		cmpopts.EquateEmpty(),
-	}
+	cmpOpts := funcs.resource.cmpOpts
 
 	assertCacheContents := func(expected []T) {
 		require.EventuallyWithT(t, func(t *assert.CollectT) {
-			out, err := funcs.cacheList(ctx)
+			out, err := funcs.cacheListAll(ctx)
 			assert.NoError(t, err)
 
 			// If the cache is expected to be empty, then test explicitly for
@@ -1363,8 +1425,9 @@ func testResources153[T types.Resource153](t *testing.T, p *testPack, funcs test
 	}
 
 	// Check that the resource is now in the backend.
-	out, err := funcs.list(ctx)
+	out, err := funcs.listAll(ctx)
 	require.NoError(t, err)
+	require.Len(t, out, 1)
 	require.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
 
 	// Wait until the information has been replicated to the cache.
@@ -1373,22 +1436,36 @@ func testResources153[T types.Resource153](t *testing.T, p *testPack, funcs test
 	// cacheGet is optional as not every resource implements it
 	if funcs.cacheGet != nil {
 		// Make sure a single cache get works.
-		getR, err := funcs.cacheGet(ctx, r.GetMetadata().GetName())
+		getR, err := funcs.cacheGet(ctx, funcs.resource.Name(r))
 		require.NoError(t, err)
 		require.Empty(t, cmp.Diff(r, getR, cmpOpts...))
+
+		// Make sure we get a NotFoundError (and not a panic) when the resource
+		// is not found.
+		_, err = funcs.cacheGet(ctx, "no-such-resource")
+		require.ErrorAs(t, err, new(*trace.NotFoundError))
 	}
 
 	// update is optional as not every resource implements it
 	if funcs.update != nil {
+		// Not all create functions will result in resource being updated
+		// with the latest revision. To avoid any conditional update
+		// failures caused by mismatched revisions, an updated
+		// copy of the resource is loaded prior to updating.
+		if funcs.cacheGet != nil {
+			var err error
+			r, err = funcs.cacheGet(ctx, funcs.resource.Name(r))
+			require.NoError(t, err)
+		}
 		// Update the resource and upsert it into the backend again.
-		r.GetMetadata().Labels["label"] = "value2"
+		funcs.resource.Modify(r)
 		err = funcs.update(ctx, r)
 		require.NoError(t, err)
 	}
 
 	// Check that the resource is in the backend and only one exists (so an
 	// update occurred).
-	out, err = funcs.list(ctx)
+	out, err = funcs.listAll(ctx)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff([]T{r}, out, cmpOpts...))
 
@@ -1402,7 +1479,7 @@ func testResources153[T types.Resource153](t *testing.T, p *testPack, funcs test
 		require.NoError(t, funcs.create(ctx, r2))
 		assertCacheContents([]T{r, r2})
 		// Check that only one resource is deleted.
-		require.NoError(t, funcs.delete(ctx, r2.GetMetadata().Name))
+		require.NoError(t, funcs.delete(ctx, funcs.resource.Name(r2)))
 		assertCacheContents([]T{r})
 	}
 
@@ -1438,7 +1515,7 @@ func TestRelativeExpiry(t *testing.T) {
 	now := clock.Now()
 	for i := int64(0); i < nodeCount; i++ {
 		exp := now.Add(time.Minute * time.Duration(i))
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
 		server.SetExpiry(exp)
 		_, err := p.presenceS.UpsertNode(ctx, server)
 		require.NoError(t, err)
@@ -1516,7 +1593,7 @@ func TestRelativeExpiryLimit(t *testing.T) {
 	now := clock.Now()
 	for i := 0; i < nodeCount; i++ {
 		exp := now.Add(time.Minute * time.Duration(i))
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
 		server.SetExpiry(exp)
 		_, err := p.presenceS.UpsertNode(ctx, server)
 		require.NoError(t, err)
@@ -1664,6 +1741,7 @@ func TestSetupConfigFns(t *testing.T) {
 
 	setupFuncs := map[string]SetupConfigFn{
 		"ForProxy":          ForProxy,
+		"ForRelay":          ForRelay,
 		"ForRemoteProxy":    ForRemoteProxy,
 		"ForNode":           ForNode,
 		"ForKubernetes":     ForKubernetes,
@@ -1773,6 +1851,7 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 	cases := map[string]Config{
 		"ForAuth":        ForAuth(Config{}),
 		"ForProxy":       ForProxy(Config{}),
+		"ForRelay":       ForRelay(Config{}),
 		"ForRemoteProxy": ForRemoteProxy(Config{}),
 		"ForNode":        ForNode(Config{}),
 		"ForKubernetes":  ForKubernetes(Config{}),
@@ -1845,15 +1924,22 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 		types.KindAutoUpdateVersion:                 types.Resource153ToLegacy(newAutoUpdateVersion(t)),
 		types.KindAutoUpdateAgentRollout:            types.Resource153ToLegacy(newAutoUpdateAgentRollout(t)),
 		types.KindAutoUpdateAgentReport:             types.Resource153ToLegacy(newAutoUpdateAgentReport(t, "test")),
+		types.KindAutoUpdateBotInstanceReport:       types.Resource153ToLegacy(newAutoUpdateBotInstanceReport(t)),
 		types.KindUserTask:                          types.Resource153ToLegacy(newUserTasks(t)),
 		types.KindProvisioningPrincipalState:        types.Resource153ToLegacy(newProvisioningPrincipalState("u-alice@example.com")),
 		types.KindIdentityCenterAccount:             types.Resource153ToLegacy(newIdentityCenterAccount("some_account")),
 		types.KindIdentityCenterAccountAssignment:   types.Resource153ToLegacy(newIdentityCenterAccountAssignment("some_account_assignment")),
 		types.KindIdentityCenterPrincipalAssignment: types.Resource153ToLegacy(newIdentityCenterPrincipalAssignment("some_principal_assignment")),
+		types.KindPlugin:                            &types.PluginV1{},
 		types.KindPluginStaticCredentials:           &types.PluginStaticCredentialsV1{},
 		types.KindGitServer:                         &types.ServerV2{},
 		types.KindWorkloadIdentity:                  types.Resource153ToLegacy(newWorkloadIdentity("some_identifier")),
+		types.KindRecordingEncryption:               types.Resource153ToLegacy(newRecordingEncryption()),
 		types.KindHealthCheckConfig:                 types.Resource153ToLegacy(newHealthCheckConfig(t, "some-name")),
+		types.KindBotInstance:                       types.ProtoResource153ToLegacy(new(machineidv1.BotInstance)),
+		scopedaccess.KindScopedRole:                 types.Resource153ToLegacy(&scopedaccessv1.ScopedRole{}),
+		scopedaccess.KindScopedRoleAssignment:       types.Resource153ToLegacy(&scopedaccessv1.ScopedRoleAssignment{}),
+		types.KindRelayServer:                       types.ProtoResource153ToLegacy(new(presencev1.RelayServer)),
 	}
 
 	for name, cfg := range cases {
@@ -1893,6 +1979,10 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*autoupdate.AutoUpdateVersion]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
 				case types.Resource153UnwrapperT[*autoupdate.AutoUpdateConfig]:
 					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*autoupdate.AutoUpdateConfig]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*autoupdate.AutoUpdateBotInstanceReport]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*autoupdate.AutoUpdateBotInstanceReport]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
 				case types.Resource153UnwrapperT[*userprovisioningpb.StaticHostUser]:
 					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*userprovisioningpb.StaticHostUser]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
 				case types.Resource153UnwrapperT[*machineidv1.SPIFFEFederation]:
@@ -1913,6 +2003,14 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*kubewaitingcontainerpb.KubernetesWaitingContainer]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
 				case types.Resource153UnwrapperT[*healthcheckconfigv1.HealthCheckConfig]:
 					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*healthcheckconfigv1.HealthCheckConfig]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*machineidv1.BotInstance]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*machineidv1.BotInstance]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
+				case types.Resource153UnwrapperT[*presencev1.RelayServer]:
+					require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*presencev1.RelayServer]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
 				default:
 					require.Empty(t, cmp.Diff(resource, event.Resource))
 				}
@@ -1925,10 +2023,11 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 // Cache operates in partially healthy mode in which it serves reads of the confirmed kinds from the cache and
 // lets everything else pass through.
 func TestPartialHealth(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	// setup cache such that role resources wouldn't be recognized by the event source and wouldn't be cached.
-	p, err := newPack(t.TempDir(), ForApps, ignoreKinds([]types.WatchKind{{Kind: types.KindRole}}))
+	p, err := newPack(t, ForApps, ignoreKinds([]types.WatchKind{{Kind: types.KindRole}}))
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
@@ -2200,7 +2299,7 @@ func newAccessList(t *testing.T, name string, clock clockwork.Clock) *accesslist
 			Name: name,
 		},
 		accesslist.Spec{
-			Title:       "title",
+			Title:       "Title" + name,
 			Description: "test access list",
 			Owners: []accesslist.Owner{
 				{
@@ -2495,6 +2594,35 @@ func newAutoUpdateAgentReport(t *testing.T, name string) *autoupdate.AutoUpdateA
 	return r
 }
 
+func newAutoUpdateBotInstanceReport(t *testing.T) *autoupdate.AutoUpdateBotInstanceReport {
+	t.Helper()
+
+	return &autoupdate.AutoUpdateBotInstanceReport{
+		Kind:    types.KindAutoUpdateBotInstanceReport,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameAutoUpdateBotInstanceReport,
+		},
+		Spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+			Timestamp: timestamppb.Now(),
+			Groups: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup{
+				"foo": {
+					Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
+						"1.2.3": {Count: 1},
+						"1.2.4": {Count: 2},
+					},
+				},
+				"bar": {
+					Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
+						"2.3.4": {Count: 3},
+						"2.3.5": {Count: 4},
+					},
+				},
+			},
+		},
+	}
+}
+
 func withKeepalive[T any](fn func(context.Context, T) (*types.KeepAlive, error)) func(context.Context, T) error {
 	return func(ctx context.Context, resource T) error {
 		_, err := fn(ctx, resource)
@@ -2509,8 +2637,8 @@ func modifyNoContext[T any](fn func(T) error) func(context.Context, T) error {
 }
 
 // A test entity descriptor from https://sptest.iamshowcase.com/testsp_metadata.xml.
-const testEntityDescriptor = `<?xml version="1.0" encoding="UTF-8"?>
-<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="IAMShowcase" validUntil="2025-12-09T09:13:31.006Z">
+const testEntityDescriptorFmt = `<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="%s" validUntil="2025-12-09T09:13:31.006Z">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
       <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
       <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
@@ -2532,3 +2660,280 @@ func fetchEvent(t *testing.T, w types.Watcher, timeout time.Duration) types.Even
 	}
 	return ev
 }
+
+func testResourcePagination[T any](t *testing.T, p *testPack, funcs testFuncs[T]) {
+	t.Helper()
+
+	const defaultTestPageSize = 2
+	const numberOfFullPages = 2
+	const totalItemCount = (numberOfFullPages * defaultTestPageSize) + 1
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-p.eventsC:
+				// Discard events to avoid blocking the test.
+			}
+		}
+	}()
+
+	// Generate resources
+	for i := range totalItemCount {
+		name := fmt.Sprintf("resources-%d", i)
+		r, err := funcs.newResource(name)
+		require.NoError(t, err)
+		require.NoError(t, funcs.create(ctx, r))
+	}
+
+	// Fetch all of the created items from the upstream:
+	expected, err := funcs.listAll(ctx)
+	require.NoError(t, err)
+	require.Len(t, expected, totalItemCount)
+
+	cmpOpts := funcs.resource.cmpOpts
+
+	// Wait for all the resources to be replicated to the cache.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		items, _ := funcs.cacheListAll(ctx)
+		assert.Len(t, items, len(expected))
+	}, 15*time.Second, 100*time.Millisecond)
+
+	page1, page2Start, err := funcs.cacheList(ctx, defaultTestPageSize, "")
+	require.NoError(t, err)
+	assert.Len(t, page1, defaultTestPageSize)
+	assert.NotEmpty(t, page2Start)
+
+	page2, page3Start, err := funcs.cacheList(ctx, defaultTestPageSize, page2Start)
+	require.NoError(t, err)
+	assert.Len(t, page2, defaultTestPageSize)
+	assert.NotEmpty(t, page3Start)
+
+	page3, end, err := funcs.cacheList(ctx, defaultTestPageSize, page3Start)
+	require.NoError(t, err)
+	assert.Len(t, page3, 1)
+	assert.Empty(t, end)
+
+	var listed []T
+	listed = append(listed, page1...)
+	listed = append(listed, page2...)
+	listed = append(listed, page3...)
+
+	// All items have been returned as expected
+	assert.Empty(t, cmp.Diff(expected, listed, cmpOpts...))
+
+	// Small pages
+	pageSmall, pageSmallNext, err := funcs.cacheList(ctx, 1, "")
+	require.NoError(t, err)
+	assert.Len(t, pageSmall, 1)
+	assert.NotEmpty(t, pageSmallNext)
+
+	if funcs.Range != nil && funcs.cacheRange != nil {
+		out, err := stream.Collect(funcs.cacheRange(ctx, "", page2Start))
+		require.NoError(t, err)
+		assert.Len(t, out, len(page1))
+		assert.Empty(t, cmp.Diff(page1, out, cmpOpts...))
+
+		out, err = stream.Collect(funcs.cacheRange(ctx, "", ""))
+		require.NoError(t, err)
+		assert.Len(t, out, len(expected))
+		assert.Empty(t, cmp.Diff(expected, out, cmpOpts...))
+
+		out, err = stream.Collect(funcs.cacheRange(ctx, page2Start, ""))
+		require.NoError(t, err)
+		assert.Len(t, out, len(expected)-defaultTestPageSize)
+		assert.Empty(t, cmp.Diff(expected, append(page1, out...), cmpOpts...))
+
+		// invalidate the cache, cover upstream fallback
+		p.cache.ok = false
+		out, err = stream.Collect(funcs.cacheRange(ctx, "", ""))
+		require.NoError(t, err)
+		assert.Len(t, out, len(expected))
+		assert.Empty(t, cmp.Diff(expected, out, cmpOpts...))
+	}
+
+	// invalidate the cache, cover upstream fallback
+	p.cache.ok = false
+	out, err := funcs.cacheListAll(ctx)
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected))
+	assert.Empty(t, cmp.Diff(expected, out, cmpOpts...))
+
+	require.NoError(t, funcs.deleteAll(ctx))
+
+	// Wait for the cache to be empty.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		items, err := funcs.cacheListAll(ctx)
+		assert.NoError(t, err)
+		assert.Empty(t, items)
+	}, 3*time.Second, 100*time.Millisecond)
+}
+
+type resourcesLister interface {
+	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
+}
+
+func listResource(ctx context.Context, lister resourcesLister, kind string, pageSize int, pageToken string) ([]types.ResourceWithLabels, string, error) {
+	resp, err := lister.ListResources(ctx, proto.ListResourcesRequest{
+		ResourceType: kind,
+		Limit:        int32(pageSize),
+		StartKey:     pageToken,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	return resp.Resources, resp.NextKey, nil
+}
+
+// NewTestCA returns new test authority with a test key as a public and
+// signing key
+func NewTestCA(caType types.CertAuthType, clusterName string, privateKeys ...[]byte) *types.CertAuthorityV2 {
+	return NewTestCAWithConfig(TestCAConfig{
+		Type:        caType,
+		ClusterName: clusterName,
+		PrivateKeys: privateKeys,
+		Clock:       clockwork.NewRealClock(),
+	})
+}
+
+// TestCAConfig defines the configuration for generating
+// a test certificate authority
+type TestCAConfig struct {
+	Type        types.CertAuthType
+	PrivateKeys [][]byte
+	Clock       clockwork.Clock
+	ClusterName string
+	// the below string fields default to ClusterName if left empty
+	ResourceName        string
+	SubjectOrganization string
+}
+
+// NewTestCAWithConfig generates a new certificate authority with the specified
+// configuration
+// Keep this function in-sync with lib/auth/auth.go:newKeySet().
+// TODO(jakule): reuse keystore.KeyStore interface to match newKeySet().
+func NewTestCAWithConfig(config TestCAConfig) *types.CertAuthorityV2 {
+	var keyPEM []byte
+	var key *keys.PrivateKey
+
+	if config.ResourceName == "" {
+		config.ResourceName = config.ClusterName
+	}
+	if config.SubjectOrganization == "" {
+		config.SubjectOrganization = config.ClusterName
+	}
+
+	switch config.Type {
+	case types.DatabaseCA, types.SAMLIDPCA, types.OIDCIdPCA:
+		// These CAs only support RSA.
+		keyPEM = fixtures.PEMBytes["rsa"]
+	case types.DatabaseClientCA:
+		// The db client CA also only supports RSA, but some tests rely on it
+		// being different than the DB CA.
+		keyPEM = fixtures.PEMBytes["rsa-db-client"]
+	}
+	if len(config.PrivateKeys) > 0 {
+		// Allow test to override the private key.
+		keyPEM = config.PrivateKeys[0]
+	}
+
+	if keyPEM != nil {
+		var err error
+		key, err = keys.ParsePrivateKey(keyPEM)
+		if err != nil {
+			panic(err)
+		}
+	} else {
+		// If config.PrivateKeys was not set and this CA does not exclusively
+		// support RSA, generate an ECDSA key. Signatures are ~10x faster than
+		// RSA and generating a new key is actually faster than parsing a PEM
+		// fixture.
+		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+		if err != nil {
+			panic(err)
+		}
+		key, err = keys.NewPrivateKey(signer)
+		if err != nil {
+			panic(err)
+		}
+		keyPEM = key.PrivateKeyPEM()
+	}
+
+	ca := &types.CertAuthorityV2{
+		Kind:    types.KindCertAuthority,
+		SubKind: string(config.Type),
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      config.ResourceName,
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.CertAuthoritySpecV2{
+			Type:        config.Type,
+			ClusterName: config.ClusterName,
+		},
+	}
+
+	// Add SSH keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.OpenSSHCA:
+		ca.Spec.ActiveKeys.SSH = []*types.SSHKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  key.MarshalSSHPublicKey(),
+		}}
+	}
+
+	// Add TLS keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.DatabaseCA, types.DatabaseClientCA, types.SAMLIDPCA, types.SPIFFECA, types.AWSRACA:
+		cert, err := tlsca.GenerateSelfSignedCAWithConfig(tlsca.GenerateCAConfig{
+			Signer: key.Signer,
+			Entity: pkix.Name{
+				CommonName:   config.ClusterName,
+				Organization: []string{config.SubjectOrganization},
+			},
+			TTL:   defaults.CATTL,
+			Clock: config.Clock,
+		})
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.TLS = []*types.TLSKeyPair{{
+			Key:  keyPEM,
+			Cert: cert,
+		}}
+	}
+
+	// Add JWT keys if necessary.
+	switch config.Type {
+	case types.JWTSigner, types.OIDCIdPCA, types.SPIFFECA, types.OktaCA, types.BoundKeypairCA:
+		pubKeyPEM, err := keys.MarshalPublicKey(key.Public())
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.JWT = []*types.JWTKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  pubKeyPEM,
+		}}
+	}
+
+	return ca
+}
+
+// NewServer creates a new server resource
+func NewServer(kind, name, addr, namespace string) *types.ServerV2 {
+	return &types.ServerV2{
+		Kind:    kind,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Spec: types.ServerSpecV2{
+			Addr: addr,
+		},
+	}
+}
diff --git a/lib/cache/cert_authority.go b/lib/cache/cert_authority.go
index 1c081e1a083a5..4d0a28e6cb977 100644
--- a/lib/cache/cert_authority.go
+++ b/lib/cache/cert_authority.go
@@ -41,6 +41,7 @@ func newCertAuthorityCollection(t services.Trust, w types.WatchKind) (*collectio
 
 	return &collection[types.CertAuthority, certAuthorityIndex]{
 		store: newStore(
+			types.KindCertAuthority,
 			types.CertAuthority.Clone,
 			map[certAuthorityIndex]func(types.CertAuthority) string{
 				certAuthorityIDIndex: func(ca types.CertAuthority) string {
@@ -169,7 +170,13 @@ func (c *Cache) GetCertAuthorities(ctx context.Context, caType types.CertAuthTyp
 
 	if rg.ReadCache() {
 		cas := make([]types.CertAuthority, 0, rg.store.len())
-		for ca := range rg.store.resources(certAuthorityIDIndex, string(caType), sortcache.NextKey(string(caType))) {
+		// CA keys are suffixed with the cluster name, e.g. db/teleport.example.com
+		// Use the exact key with the trailing slash to avoid matching CA types
+		// with a common prefix, i.e. to avoid matching db_client CAs when
+		// querying for db CAs.
+		startKey := string(caType) + "/"
+		endKey := sortcache.NextKey(startKey)
+		for ca := range rg.store.resources(certAuthorityIDIndex, startKey, endKey) {
 			if loadSigningKeys {
 				cas = append(cas, ca.Clone())
 			} else {
diff --git a/lib/cache/cert_authority_test.go b/lib/cache/cert_authority_test.go
index 07a5732271778..b6c564ac340bd 100644
--- a/lib/cache/cert_authority_test.go
+++ b/lib/cache/cert_authority_test.go
@@ -27,9 +27,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 // TestCA tests certificate authorities
@@ -40,20 +38,27 @@ func TestCA(t *testing.T) {
 	t.Cleanup(p.Close)
 	ctx := context.Background()
 
-	ca := suite.NewTestCA(types.UserCA, "example.com")
-	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
+	userCA := NewTestCA(types.UserCA, "example.com")
+	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, userCA))
+	dbCA := NewTestCA(types.DatabaseCA, "example.com")
+	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, dbCA))
+	dbClientCA := NewTestCA(types.DatabaseClientCA, "example.com")
+	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, dbClientCA))
+	const totalCAs = 3
 
-	select {
-	case <-p.eventsC:
-	case <-time.After(time.Second):
-		t.Fatalf("timeout waiting for event")
+	for range totalCAs {
+		select {
+		case <-p.eventsC:
+		case <-time.After(time.Second):
+			t.Fatalf("timeout waiting for cert authority create event")
+		}
 	}
 
-	out, err := p.cache.GetCertAuthority(ctx, ca.GetID(), true)
+	userCAOut, err := p.cache.GetCertAuthority(ctx, userCA.GetID(), true)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ca, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.Empty(t, cmp.Diff(userCA, userCAOut, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 
-	err = p.trustS.DeleteCertAuthority(ctx, ca.GetID())
+	err = p.trustS.DeleteCertAuthority(ctx, userCA.GetID())
 	require.NoError(t, err)
 
 	select {
@@ -62,8 +67,14 @@ func TestCA(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	_, err = p.cache.GetCertAuthority(ctx, ca.GetID(), false)
+	_, err = p.cache.GetCertAuthority(ctx, userCA.GetID(), false)
 	require.True(t, trace.IsNotFound(err))
+
+	// Make sure the db_client CA isn't returned when listing `db` CAs due to the common prefix.
+	dbCAs, err := p.cache.GetCertAuthorities(ctx, types.DatabaseCA, false)
+	require.NoError(t, err)
+	require.Len(t, dbCAs, 1, "GetCertAuthorities returned an extra CA")
+	require.Equal(t, types.DatabaseCA, dbCAs[0].GetType())
 }
 
 func TestNodeCAFiltering(t *testing.T) {
@@ -81,10 +92,6 @@ func TestNodeCAFiltering(t *testing.T) {
 	err = p.clusterConfigS.UpsertClusterName(clusterName)
 	require.NoError(t, err)
 
-	nodeCacheBackend, err := memory.New(memory.Config{})
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, nodeCacheBackend.Close()) })
-
 	// this mimics a cache for a node pulling events from the auth server via WatchEvents
 	nodeCache, err := New(ForNode(Config{
 		Events:                  p.cache,
@@ -97,7 +104,6 @@ func TestNodeCAFiltering(t *testing.T) {
 		SAMLIdPServiceProviders: p.cache.SAMLIdPServiceProviders,
 		UserGroups:              p.cache.UserGroups,
 		StaticHostUsers:         p.cache.StaticHostUsers,
-		Backend:                 nodeCacheBackend,
 	}))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, nodeCache.Close()) })
@@ -123,7 +129,7 @@ func TestNodeCAFiltering(t *testing.T) {
 	require.Equal(t, types.OpInit, fetchEvent().Type)
 
 	// upsert and delete a local host CA, we expect to see a Put and a Delete event
-	localCA := suite.NewTestCA(types.HostCA, "example.com")
+	localCA := NewTestCA(types.HostCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, localCA))
 	require.NoError(t, p.trustS.DeleteCertAuthority(ctx, localCA.GetID()))
 
@@ -138,7 +144,7 @@ func TestNodeCAFiltering(t *testing.T) {
 	require.Equal(t, "example.com", ev.Resource.GetName())
 
 	// upsert and delete a nonlocal host CA, we expect to only see the Delete event
-	nonlocalCA := suite.NewTestCA(types.HostCA, "example.net")
+	nonlocalCA := NewTestCA(types.HostCA, "example.net")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, nonlocalCA))
 	require.NoError(t, p.trustS.DeleteCertAuthority(ctx, nonlocalCA.GetID()))
 
@@ -148,7 +154,7 @@ func TestNodeCAFiltering(t *testing.T) {
 	require.Equal(t, "example.net", ev.Resource.GetName())
 
 	// whereas we expect to see the Put and Delete for a trusted *user* CA
-	trustedUserCA := suite.NewTestCA(types.UserCA, "example.net")
+	trustedUserCA := NewTestCA(types.UserCA, "example.net")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, trustedUserCA))
 	require.NoError(t, p.trustS.DeleteCertAuthority(ctx, trustedUserCA.GetID()))
 
@@ -211,7 +217,7 @@ func TestCAWatcherFilters(t *testing.T) {
 	}
 
 	// generate an OpPut event.
-	ca := suite.NewTestCA(types.UserCA, "example.com")
+	ca := NewTestCA(types.UserCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ctx, ca))
 
 	const fetchTimeout = time.Second
diff --git a/lib/cache/cluster_config.go b/lib/cache/cluster_config.go
index 4e763376a879f..530bba598a0ce 100644
--- a/lib/cache/cluster_config.go
+++ b/lib/cache/cluster_config.go
@@ -41,6 +41,7 @@ func newClusterNameCollection(c services.ClusterConfiguration, w types.WatchKind
 
 	return &collection[types.ClusterName, clusterNameIndex]{
 		store: newStore(
+			types.KindClusterName,
 			types.ClusterName.Clone,
 			map[clusterNameIndex]func(types.ClusterName) string{
 				clusterNameDefaultIndex: types.ClusterName.GetName,
@@ -79,7 +80,10 @@ func (c *Cache) GetClusterName(ctx context.Context) (types.ClusterName, error) {
 
 	if rg.ReadCache() {
 		name, err := rg.store.get(clusterNameDefaultIndex, types.MetaNameClusterName)
-		return name.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return name.Clone(), nil
 	}
 
 	cachedName, err := utils.FnCacheGet(ctx, c.fnCache, clusterConfigCacheKey{"name"}, func(ctx context.Context) (types.ClusterName, error) {
@@ -103,6 +107,7 @@ func newClusterAuditConfigCollection(c services.ClusterConfiguration, w types.Wa
 
 	return &collection[types.ClusterAuditConfig, clusterAuditConfigIndex]{
 		store: newStore(
+			types.KindClusterAuditConfig,
 			types.ClusterAuditConfig.Clone,
 			map[clusterAuditConfigIndex]func(types.ClusterAuditConfig) string{
 				clusterAuditConfigNameIndex: types.ClusterAuditConfig.GetName,
@@ -145,7 +150,10 @@ func (c *Cache) GetClusterAuditConfig(ctx context.Context) (types.ClusterAuditCo
 
 	if rg.ReadCache() {
 		cfg, err := rg.store.get(clusterAuditConfigNameIndex, types.MetaNameClusterAuditConfig)
-		return cfg.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return cfg.Clone(), nil
 	}
 
 	cachedCfg, err := utils.FnCacheGet(ctx, c.fnCache, clusterConfigCacheKey{"audit"}, func(ctx context.Context) (types.ClusterAuditConfig, error) {
@@ -169,6 +177,7 @@ func newClusterNetworkingConfigCollection(c services.ClusterConfiguration, w typ
 
 	return &collection[types.ClusterNetworkingConfig, clusterNetworkingConfigIndex]{
 		store: newStore(
+			types.KindClusterNetworkingConfig,
 			types.ClusterNetworkingConfig.Clone,
 			map[clusterNetworkingConfigIndex]func(types.ClusterNetworkingConfig) string{
 				clusterNetworkingConfigNameIndex: types.ClusterNetworkingConfig.GetName,
@@ -207,7 +216,10 @@ func (c *Cache) GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNe
 
 	if rg.ReadCache() {
 		cfg, err := rg.store.get(clusterNetworkingConfigNameIndex, types.MetaNameClusterNetworkingConfig)
-		return cfg.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return cfg.Clone(), nil
 	}
 
 	cachedCfg, err := utils.FnCacheGet(ctx, c.fnCache, clusterConfigCacheKey{"networking"}, func(ctx context.Context) (types.ClusterNetworkingConfig, error) {
@@ -231,6 +243,7 @@ func newAuthPreferenceCollection(c services.ClusterConfiguration, w types.WatchK
 
 	return &collection[types.AuthPreference, authPreferenceIndex]{
 		store: newStore(
+			types.KindClusterAuthPreference,
 			types.AuthPreference.Clone,
 			map[authPreferenceIndex]func(types.AuthPreference) string{
 				authPreferenceNameIndex: types.AuthPreference.GetName,
@@ -269,7 +282,10 @@ func (c *Cache) GetAuthPreference(ctx context.Context) (types.AuthPreference, er
 
 	if rg.ReadCache() {
 		cfg, err := rg.store.get(authPreferenceNameIndex, types.MetaNameClusterAuthPreference)
-		return cfg.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return cfg.Clone(), nil
 	}
 
 	cfg, err := c.Config.ClusterConfig.GetAuthPreference(ctx)
@@ -287,6 +303,7 @@ func newSessionRecordingConfigCollection(c services.ClusterConfiguration, w type
 
 	return &collection[types.SessionRecordingConfig, sessionRecordingConfigIndex]{
 		store: newStore(
+			types.KindSessionRecordingConfig,
 			types.SessionRecordingConfig.Clone,
 			map[sessionRecordingConfigIndex]func(types.SessionRecordingConfig) string{
 				sessionRecordingConfigNameIndex: types.SessionRecordingConfig.GetName,
@@ -325,7 +342,10 @@ func (c *Cache) GetSessionRecordingConfig(ctx context.Context) (types.SessionRec
 
 	if rg.ReadCache() {
 		cfg, err := rg.store.get(sessionRecordingConfigNameIndex, types.MetaNameSessionRecordingConfig)
-		return cfg.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return cfg.Clone(), nil
 	}
 
 	cfg, err := c.Config.ClusterConfig.GetSessionRecordingConfig(ctx)
@@ -343,6 +363,7 @@ func newAccessGraphSettingsCollection(upstream services.ClusterConfiguration, w
 
 	return &collection[*clusterconfigv1.AccessGraphSettings, accessGraphSettingsIndex]{
 		store: newStore(
+			types.KindAccessGraphSettings,
 			proto.CloneOf[*clusterconfigv1.AccessGraphSettings],
 			map[accessGraphSettingsIndex]func(*clusterconfigv1.AccessGraphSettings) string{
 				accessGraphSettingsNameIndex: func(r *clusterconfigv1.AccessGraphSettings) string {
diff --git a/lib/cache/cluster_config_test.go b/lib/cache/cluster_config_test.go
index 9fe09474ea36f..5312bcbb09701 100644
--- a/lib/cache/cluster_config_test.go
+++ b/lib/cache/cluster_config_test.go
@@ -180,7 +180,7 @@ func TestAccessGraphSettings(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*clusterconfigv1.AccessGraphSettings]{
+	testResources153(t, p, testFuncs[*clusterconfigv1.AccessGraphSettings]{
 		newResource: func(name string) (*clusterconfigv1.AccessGraphSettings, error) {
 			return newAccessGraphSettings(t), nil
 		},
@@ -188,22 +188,8 @@ func TestAccessGraphSettings(t *testing.T) {
 			_, err := p.clusterConfigS.UpsertAccessGraphSettings(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*clusterconfigv1.AccessGraphSettings, error) {
-			item, err := p.clusterConfigS.GetAccessGraphSettings(ctx)
-			if trace.IsNotFound(err) {
-				return []*clusterconfigv1.AccessGraphSettings{}, nil
-			}
-			return []*clusterconfigv1.AccessGraphSettings{item}, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*clusterconfigv1.AccessGraphSettings, error) {
-			item, err := p.cache.GetAccessGraphSettings(ctx)
-			if trace.IsNotFound(err) {
-				return []*clusterconfigv1.AccessGraphSettings{}, nil
-			}
-			return []*clusterconfigv1.AccessGraphSettings{item}, trace.Wrap(err)
-		},
-		deleteAll: func(ctx context.Context) error {
-			return trace.Wrap(p.clusterConfigS.DeleteAccessGraphSettings(ctx))
-		},
-	})
+		list:      singletonListAdapter(p.clusterConfigS.GetAccessGraphSettings),
+		cacheList: singletonListAdapter(p.cache.GetAccessGraphSettings),
+		deleteAll: p.clusterConfigS.DeleteAccessGraphSettings,
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/collections.go b/lib/cache/collections.go
index 41ff3c46731da..25a3d0051664d 100644
--- a/lib/cache/collections.go
+++ b/lib/cache/collections.go
@@ -32,7 +32,9 @@ import (
 	kubewaitingcontainerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
 	userprovisioningv2 "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
@@ -41,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	"github.com/gravitational/teleport/api/types/secreports"
 	"github.com/gravitational/teleport/api/types/userloginstate"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 )
 
 // collectionHandler is used by the [Cache] to seed the initial
@@ -103,7 +106,8 @@ type collections struct {
 	autoUpdateConfig                   *collection[*autoupdatev1.AutoUpdateConfig, autoUpdateConfigIndex]
 	autoUpdateVerion                   *collection[*autoupdatev1.AutoUpdateVersion, autoUpdateVersionIndex]
 	autoUpdateRollout                  *collection[*autoupdatev1.AutoUpdateAgentRollout, autoUpdateAgentRolloutIndex]
-	autoUpdateReports                  *collection[*autoupdatev1.AutoUpdateAgentReport, autoUpdateAgentReportIndex]
+	autoUpdateAgentReports             *collection[*autoupdatev1.AutoUpdateAgentReport, autoUpdateAgentReportIndex]
+	autoUpdateBotInstanceReports       *collection[*autoupdatev1.AutoUpdateBotInstanceReport, autoUpdateBotInstanceReportIndex]
 	oktaImportRules                    *collection[types.OktaImportRule, oktaImportRuleIndex]
 	oktaAssignments                    *collection[types.OktaAssignment, oktaAssignmentIndex]
 	samlIdPServiceProviders            *collection[types.SAMLIdPServiceProvider, samlIdPServiceProviderIndex]
@@ -136,6 +140,10 @@ type collections struct {
 	auditQueries                       *collection[*secreports.AuditQuery, auditQueryIndex]
 	secReports                         *collection[*secreports.Report, securityReportIndex]
 	secReportsStates                   *collection[*secreports.ReportState, securityReportStateIndex]
+	relayServers                       *collection[*presencev1.RelayServer, relayServerIndex]
+	botInstances                       *collection[*machineidv1.BotInstance, botInstanceIndex]
+	plugins                            *collection[types.Plugin, pluginIndex]
+	recordingEncryption                *collection[*recordingencryptionv1.RecordingEncryption, recordingEncryptionIndex]
 }
 
 // isKnownUncollectedKind is true if a resource kind is not stored in
@@ -143,7 +151,7 @@ type collections struct {
 // resources events can be processed by downstream watchers.
 func isKnownUncollectedKind(kind string) bool {
 	switch kind {
-	case types.KindAccessRequest, types.KindHeadlessAuthentication:
+	case types.KindAccessRequest, types.KindHeadlessAuthentication, scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment:
 		return true
 	default:
 		return false
@@ -467,8 +475,16 @@ func setupCollections(c Config) (*collections, error) {
 				return nil, trace.Wrap(err)
 			}
 
-			out.autoUpdateReports = collect
-			out.byKind[resourceKind] = out.autoUpdateReports
+			out.autoUpdateAgentReports = collect
+			out.byKind[resourceKind] = out.autoUpdateAgentReports
+		case types.KindAutoUpdateBotInstanceReport:
+			collect, err := newAutoUpdateBotInstanceReportCollection(c.AutoUpdateService, watch)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			out.autoUpdateBotInstanceReports = collect
+			out.byKind[resourceKind] = out.autoUpdateBotInstanceReports
 		case types.KindOktaImportRule:
 			collect, err := newOktaImportRuleCollection(c.Okta, watch)
 			if err != nil {
@@ -721,10 +737,41 @@ func setupCollections(c Config) (*collections, error) {
 
 			out.secReportsStates = collect
 			out.byKind[resourceKind] = out.secReportsStates
+		case types.KindRelayServer:
+			collect, err := newRelayServerCollection(c.Presence, watch)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			out.relayServers = collect
+			out.byKind[resourceKind] = out.relayServers
+		case types.KindBotInstance:
+			collect, err := newBotInstanceCollection(c.BotInstanceService, watch)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			out.botInstances = collect
+			out.byKind[resourceKind] = out.botInstances
+		case types.KindPlugin:
+			collect, err := newPluginsCollection(c.Plugin, watch)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			out.plugins = collect
+			out.byKind[resourceKind] = out.plugins
+		case types.KindRecordingEncryption:
+			collect, err := newRecordingEncryptionCollection(c.RecordingEncryption, watch)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			out.recordingEncryption = collect
+			out.byKind[resourceKind] = out.recordingEncryption
 		default:
 			if _, ok := out.byKind[resourceKind]; !ok {
 				return nil, trace.BadParameter("resource %q is not supported", watch.Kind)
 			}
+
 		}
 	}
 
diff --git a/lib/cache/crown_jewel.go b/lib/cache/crown_jewel.go
index a1a5e6ebd92d3..77f69196c62c9 100644
--- a/lib/cache/crown_jewel.go
+++ b/lib/cache/crown_jewel.go
@@ -25,6 +25,8 @@ import (
 	crownjewelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/crownjewel/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -39,6 +41,7 @@ func newCrownJewelCollection(upstream services.CrownJewels, w types.WatchKind) (
 
 	return &collection[*crownjewelv1.CrownJewel, crownJewelIndex]{
 		store: newStore(
+			types.KindCrownJewel,
 			proto.CloneOf[*crownjewelv1.CrownJewel],
 			map[crownJewelIndex]func(*crownjewelv1.CrownJewel) string{
 				crownJewelNameIndex: func(r *crownjewelv1.CrownJewel) string {
@@ -46,23 +49,10 @@ func newCrownJewelCollection(upstream services.CrownJewels, w types.WatchKind) (
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*crownjewelv1.CrownJewel, error) {
-			var out []*crownjewelv1.CrownJewel
-			var nextToken string
-			for {
-				var page []*crownjewelv1.CrownJewel
-				var err error
-
-				const defaultPageSize = 0
-				page, nextToken, err = upstream.ListCrownJewels(ctx, defaultPageSize, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, i int, nextToken string) ([]*crownjewelv1.CrownJewel, string, error) {
+				return upstream.ListCrownJewels(ctx, int64(i), nextToken)
+			}))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *crownjewelv1.CrownJewel {
 			return &crownjewelv1.CrownJewel{
diff --git a/lib/cache/crown_jewel_test.go b/lib/cache/crown_jewel_test.go
index ff4c59bb650fa..07b3cb0b7471e 100644
--- a/lib/cache/crown_jewel_test.go
+++ b/lib/cache/crown_jewel_test.go
@@ -33,7 +33,7 @@ func TestCrownJewel(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*crownjewelv1.CrownJewel]{
+	testResources153(t, p, testFuncs[*crownjewelv1.CrownJewel]{
 		newResource: func(name string) (*crownjewelv1.CrownJewel, error) {
 			return newCrownJewel(t, name), nil
 		},
@@ -41,14 +41,12 @@ func TestCrownJewel(t *testing.T) {
 			_, err := p.crownJewels.CreateCrownJewel(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*crownjewelv1.CrownJewel, error) {
-			items, _, err := p.crownJewels.ListCrownJewels(ctx, 0, "")
-			return items, trace.Wrap(err)
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]*crownjewelv1.CrownJewel, string, error) {
+			return p.crownJewels.ListCrownJewels(ctx, int64(pageSize), pageToken)
 		},
-		cacheList: func(ctx context.Context) ([]*crownjewelv1.CrownJewel, error) {
-			items, _, err := p.crownJewels.ListCrownJewels(ctx, 0, "")
-			return items, trace.Wrap(err)
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]*crownjewelv1.CrownJewel, string, error) {
+			return p.crownJewels.ListCrownJewels(ctx, int64(pageSize), pageToken)
 		},
 		deleteAll: p.crownJewels.DeleteAllCrownJewels,
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/database.go b/lib/cache/database.go
index 5bea3d8e351e4..ffb2898f8dcfd 100644
--- a/lib/cache/database.go
+++ b/lib/cache/database.go
@@ -18,6 +18,7 @@ package cache
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/proto"
@@ -28,6 +29,8 @@ import (
 	dbobjectv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -35,13 +38,14 @@ type databaseIndex string
 
 const databaseNameIndex = "name"
 
-func newDatabaseCollection(p services.Databases, w types.WatchKind) (*collection[types.Database, databaseIndex], error) {
-	if p == nil {
+func newDatabaseCollection(upstream services.Databases, w types.WatchKind) (*collection[types.Database, databaseIndex], error) {
+	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter Databases")
 	}
 
 	return &collection[types.Database, databaseIndex]{
 		store: newStore(
+			types.KindDatabase,
 			func(d types.Database) types.Database {
 				return d.Copy()
 			},
@@ -49,7 +53,9 @@ func newDatabaseCollection(p services.Databases, w types.WatchKind) (*collection
 				databaseNameIndex: types.Database.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Database, error) {
-			return p.GetDatabases(ctx)
+			// TODO(lokraszewski): DELETE IN v21.0.0 replace by regular clientutils.Resources
+			out, err := clientutils.CollectWithFallback(ctx, upstream.ListDatabases, upstream.GetDatabases)
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Database {
 			return &types.DatabaseV3{
@@ -112,6 +118,50 @@ func (c *Cache) GetDatabases(ctx context.Context) ([]types.Database, error) {
 	return out, nil
 }
 
+// ListDatabases returns a page of database resources.
+func (c *Cache) ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListDatabases")
+	defer span.End()
+
+	lister := genericLister[types.Database, databaseIndex]{
+		cache:        c,
+		collection:   c.collections.dbs,
+		index:        databaseNameIndex,
+		upstreamList: c.Config.Databases.ListDatabases,
+		nextToken:    types.Database.GetName,
+	}
+	out, next, err := lister.list(ctx, limit, startKey)
+	return out, next, trace.Wrap(err)
+}
+
+// RangeDatabases returns database resources within the range [start, end).
+func (c *Cache) RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error] {
+	lister := genericLister[types.Database, databaseIndex]{
+		cache:        c,
+		collection:   c.collections.dbs,
+		index:        databaseNameIndex,
+		upstreamList: c.Config.Databases.ListDatabases,
+		nextToken:    types.Database.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: c.Config.Databases.GetDatabases,
+	}
+
+	return func(yield func(types.Database, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeDatabases")
+		defer span.End()
+
+		for db, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(db, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
 type databaseServerIndex string
 
 const databaseServerNameIndex databaseServerIndex = "name"
@@ -123,6 +173,7 @@ func newDatabaseServerCollection(p services.Presence, w types.WatchKind) (*colle
 
 	return &collection[types.DatabaseServer, databaseServerIndex]{
 		store: newStore(
+			types.KindDatabaseServer,
 			types.DatabaseServer.Copy,
 			map[databaseServerIndex]func(types.DatabaseServer) string{
 				databaseServerNameIndex: func(u types.DatabaseServer) string {
@@ -183,6 +234,7 @@ func newDatabaseServiceCollection(p services.Presence, w types.WatchKind) (*coll
 
 	return &collection[types.DatabaseService, databaseServiceIndex]{
 		store: newStore(
+			types.KindDatabaseService,
 			types.DatabaseService.Clone,
 			map[databaseServiceIndex]func(types.DatabaseService) string{
 				databaseServiceNameIndex: types.DatabaseService.GetName,
@@ -230,6 +282,7 @@ func newDatabaseObjectCollection(upstream services.DatabaseObjects, w types.Watc
 
 	return &collection[*dbobjectv1.DatabaseObject, databaseObjectIndex]{
 		store: newStore(
+			types.KindDatabaseObject,
 			proto.CloneOf[*dbobjectv1.DatabaseObject],
 			map[databaseObjectIndex]func(*dbobjectv1.DatabaseObject) string{
 				databaseObjectNameIndex: func(r *dbobjectv1.DatabaseObject) string {
@@ -237,22 +290,8 @@ func newDatabaseObjectCollection(upstream services.DatabaseObjects, w types.Watc
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*dbobjectv1.DatabaseObject, error) {
-			var out []*dbobjectv1.DatabaseObject
-			var nextToken string
-			for {
-				var page []*dbobjectv1.DatabaseObject
-				var err error
-
-				page, nextToken, err = upstream.ListDatabaseObjects(ctx, 0, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListDatabaseObjects))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *dbobjectv1.DatabaseObject {
 			return &dbobjectv1.DatabaseObject{
diff --git a/lib/cache/database_test.go b/lib/cache/database_test.go
index 7b4d28ab1eff4..0b5410ea0e879 100644
--- a/lib/cache/database_test.go
+++ b/lib/cache/database_test.go
@@ -22,9 +22,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	dbobjectv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -42,7 +40,7 @@ func TestDatabaseServices(t *testing.T) {
 	testResources(t, p, testFuncs[types.DatabaseService]{
 		newResource: func(name string) (types.DatabaseService, error) {
 			return types.NewDatabaseServiceV1(types.Metadata{
-				Name: uuid.NewString(),
+				Name: name,
 			}, types.DatabaseServiceSpecV1{
 				ResourceMatchers: []*types.DatabaseResourceMatcher{
 					{Labels: &types.Labels{"env": []string{"prod"}}},
@@ -50,21 +48,27 @@ func TestDatabaseServices(t *testing.T) {
 			})
 		},
 		create: withKeepalive(p.databaseServices.UpsertDatabaseService),
-		list: func(ctx context.Context) ([]types.DatabaseService, error) {
-			listServicesResp, err := p.presenceS.ListResources(ctx, proto.ListResourcesRequest{
-				ResourceType: types.KindDatabaseService,
-				Limit:        apidefaults.DefaultChunkSize,
-			})
-			require.NoError(t, err)
-			return types.ResourcesWithLabels(listServicesResp.Resources).AsDatabaseServices()
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]types.DatabaseService, string, error) {
+			resources, next, err := listResource(ctx, p.presenceS, types.KindDatabaseService, pageSize, pageToken)
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+			dbs, err := types.ResourcesWithLabels(resources).AsDatabaseServices()
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+			return dbs, next, nil
 		},
-		cacheList: func(ctx context.Context) ([]types.DatabaseService, error) {
-			listServicesResp, err := p.cache.ListResources(ctx, proto.ListResourcesRequest{
-				ResourceType: types.KindDatabaseService,
-				Limit:        apidefaults.DefaultChunkSize,
-			})
-			require.NoError(t, err)
-			return types.ResourcesWithLabels(listServicesResp.Resources).AsDatabaseServices()
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.DatabaseService, string, error) {
+			resources, next, err := listResource(ctx, p.cache, types.KindDatabaseService, pageSize, pageToken)
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+			dbs, err := types.ResourcesWithLabels(resources).AsDatabaseServices()
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+			return dbs, next, nil
 		},
 		update:    withKeepalive(p.databaseServices.UpsertDatabaseService),
 		deleteAll: p.databaseServices.DeleteAllDatabaseServices,
@@ -88,12 +92,14 @@ func TestDatabases(t *testing.T) {
 				URI:      "localhost:5432",
 			})
 		},
-		create:    p.databases.CreateDatabase,
-		list:      p.databases.GetDatabases,
-		cacheGet:  p.cache.GetDatabase,
-		cacheList: p.cache.GetDatabases,
-		update:    p.databases.UpdateDatabase,
-		deleteAll: p.databases.DeleteAllDatabases,
+		create:     p.databases.CreateDatabase,
+		list:       p.databases.ListDatabases,
+		Range:      p.databases.RangeDatabases,
+		cacheGet:   p.cache.GetDatabase,
+		cacheList:  p.cache.ListDatabases,
+		cacheRange: p.cache.RangeDatabases,
+		update:     p.databases.UpdateDatabase,
+		deleteAll:  p.databases.DeleteAllDatabases,
 	})
 }
 
@@ -117,17 +123,17 @@ func TestDatabaseServers(t *testing.T) {
 				})
 			},
 			create: withKeepalive(p.presenceS.UpsertDatabaseServer),
-			list: func(ctx context.Context) ([]types.DatabaseServer, error) {
+			list: getAllAdapter(func(ctx context.Context) ([]types.DatabaseServer, error) {
 				return p.presenceS.GetDatabaseServers(ctx, apidefaults.Namespace)
-			},
-			cacheList: func(ctx context.Context) ([]types.DatabaseServer, error) {
+			}),
+			cacheList: getAllAdapter(func(ctx context.Context) ([]types.DatabaseServer, error) {
 				return p.cache.GetDatabaseServers(ctx, apidefaults.Namespace)
-			},
+			}),
 			update: withKeepalive(p.presenceS.UpsertDatabaseServer),
 			deleteAll: func(ctx context.Context) error {
 				return p.presenceS.DeleteAllDatabaseServers(ctx, apidefaults.Namespace)
 			},
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListResources", func(t *testing.T) {
@@ -142,55 +148,27 @@ func TestDatabaseServers(t *testing.T) {
 				})
 			},
 			create: withKeepalive(p.presenceS.UpsertDatabaseServer),
-			list: func(ctx context.Context) ([]types.DatabaseServer, error) {
-				req := proto.ListResourcesRequest{
-					ResourceType: types.KindDatabaseServer,
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.DatabaseServer, string, error) {
+				resources, next, err := listResource(ctx, p.presenceS, types.KindDatabaseServer, pageSize, pageToken)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				var out []types.DatabaseServer
-				for {
-					resp, err := p.presenceS.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.DatabaseServer))
-					}
-
-					req.StartKey = resp.NextKey
-
-					if req.StartKey == "" {
-						break
-					}
+				dbs, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				return out, nil
+				return dbs, next, nil
 			},
-			cacheList: func(ctx context.Context) ([]types.DatabaseServer, error) {
-				req := proto.ListResourcesRequest{
-					ResourceType: types.KindDatabaseServer,
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.DatabaseServer, string, error) {
+				resources, next, err := listResource(ctx, p.cache, types.KindDatabaseServer, pageSize, pageToken)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				var out []types.DatabaseServer
-				for {
-					resp, err := p.cache.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.DatabaseServer))
-					}
-
-					req.StartKey = resp.NextKey
-
-					if req.StartKey == "" {
-						break
-					}
+				dbs, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				return out, nil
+				return dbs, next, nil
 			},
 			update: withKeepalive(p.presenceS.UpsertDatabaseServer),
 			deleteAll: func(ctx context.Context) error {
@@ -198,7 +176,6 @@ func TestDatabaseServers(t *testing.T) {
 			},
 		})
 	})
-
 }
 
 func TestDatabaseObjects(t *testing.T) {
@@ -207,7 +184,7 @@ func TestDatabaseObjects(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*dbobjectv1.DatabaseObject]{
+	testResources153(t, p, testFuncs[*dbobjectv1.DatabaseObject]{
 		newResource: func(name string) (*dbobjectv1.DatabaseObject, error) {
 			return newDatabaseObject(t, name), nil
 		},
@@ -215,14 +192,8 @@ func TestDatabaseObjects(t *testing.T) {
 			_, err := p.databaseObjects.CreateDatabaseObject(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*dbobjectv1.DatabaseObject, error) {
-			items, _, err := p.databaseObjects.ListDatabaseObjects(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*dbobjectv1.DatabaseObject, error) {
-			items, _, err := p.databaseObjects.ListDatabaseObjects(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list:      p.databaseObjects.ListDatabaseObjects,
+		cacheList: p.databaseObjects.ListDatabaseObjects,
 		deleteAll: func(ctx context.Context) error {
 			token := ""
 			var objects []*dbobjectv1.DatabaseObject
@@ -249,5 +220,5 @@ func TestDatabaseObjects(t *testing.T) {
 			}
 			return nil
 		},
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/discovery_config.go b/lib/cache/discovery_config.go
index c5b0a7ec60cab..f1194a6557534 100644
--- a/lib/cache/discovery_config.go
+++ b/lib/cache/discovery_config.go
@@ -24,6 +24,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -38,6 +40,7 @@ func newDiscoveryConfigCollection(upstream services.DiscoveryConfigs, w types.Wa
 
 	return &collection[*discoveryconfig.DiscoveryConfig, discoveryConfigIndex]{
 		store: newStore(
+			types.KindDiscoveryConfig,
 			(*discoveryconfig.DiscoveryConfig).Clone,
 			map[discoveryConfigIndex]func(*discoveryconfig.DiscoveryConfig) string{
 				discoveryConfigNameIndex: func(r *discoveryconfig.DiscoveryConfig) string {
@@ -45,24 +48,8 @@ func newDiscoveryConfigCollection(upstream services.DiscoveryConfigs, w types.Wa
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*discoveryconfig.DiscoveryConfig, error) {
-			var discoveryConfigs []*discoveryconfig.DiscoveryConfig
-			var nextToken string
-			for {
-				var page []*discoveryconfig.DiscoveryConfig
-				var err error
-
-				page, nextToken, err = upstream.ListDiscoveryConfigs(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				discoveryConfigs = append(discoveryConfigs, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return discoveryConfigs, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListDiscoveryConfigs))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *discoveryconfig.DiscoveryConfig {
 			return &discoveryconfig.DiscoveryConfig{
diff --git a/lib/cache/discovery_config_test.go b/lib/cache/discovery_config_test.go
index 3cbab538ad8f2..63fa530045c28 100644
--- a/lib/cache/discovery_config_test.go
+++ b/lib/cache/discovery_config_test.go
@@ -38,7 +38,7 @@ func TestDiscoveryConfig(t *testing.T) {
 	testResources(t, p, testFuncs[*discoveryconfig.DiscoveryConfig]{
 		newResource: func(name string) (*discoveryconfig.DiscoveryConfig, error) {
 			dc, err := discoveryconfig.NewDiscoveryConfig(
-				header.Metadata{Name: "mydc"},
+				header.Metadata{Name: name},
 				discoveryconfig.Spec{
 					DiscoveryGroup: "group001",
 				})
@@ -49,15 +49,9 @@ func TestDiscoveryConfig(t *testing.T) {
 			_, err := p.discoveryConfigs.CreateDiscoveryConfig(ctx, discoveryConfig)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*discoveryconfig.DiscoveryConfig, error) {
-			results, _, err := p.discoveryConfigs.ListDiscoveryConfigs(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetDiscoveryConfig,
-		cacheList: func(ctx context.Context) ([]*discoveryconfig.DiscoveryConfig, error) {
-			results, _, err := p.cache.ListDiscoveryConfigs(ctx, 0, "")
-			return results, err
-		},
+		list:      p.discoveryConfigs.ListDiscoveryConfigs,
+		cacheGet:  p.cache.GetDiscoveryConfig,
+		cacheList: p.cache.ListDiscoveryConfigs,
 		update: func(ctx context.Context, discoveryConfig *discoveryconfig.DiscoveryConfig) error {
 			_, err := p.discoveryConfigs.UpdateDiscoveryConfig(ctx, discoveryConfig)
 			return trace.Wrap(err)
diff --git a/lib/cache/generic_operations.go b/lib/cache/generic_operations.go
index 75f001ddeec05..bf5fd37331753 100644
--- a/lib/cache/generic_operations.go
+++ b/lib/cache/generic_operations.go
@@ -18,6 +18,8 @@ package cache
 
 import (
 	"context"
+	"iter"
+	"slices"
 
 	"github.com/gravitational/trace"
 
@@ -70,6 +72,8 @@ type genericLister[T any, I comparable] struct {
 	collection *collection[T, I]
 	// index of the collection to read with.
 	index I
+	// isDesc indicates whether the lister should retrieve items in descending order.
+	isDesc bool
 	// defaultPageSize optionally defines a page size to use if
 	// one is not specified by the caller. If not set then
 	// [defaults.DefaultChunkSize] is used.
@@ -83,12 +87,43 @@ type genericLister[T any, I comparable] struct {
 	// filter is an optional function used to exclude items from
 	// cache reads.
 	filter func(T) bool
+	// fallbackGetter is an optional fallback if upstream does not implment ranging getters.
+	// TODO(okraport): Remove when all deprecated non-paginated endpoints have been removed.
+	fallbackGetter func(context.Context) ([]T, error)
 }
 
-// list retrieves a page of items from the configured cache collection.
+// clipEnd takes a page of items and checks if it already contains the end token.
+// If so it returns a slice up to end and modifes the next token to be empty.
+func (g genericLister[T, I]) clipEnd(page []T, next, end string) ([]T, string) {
+	if end == "" || len(page) == 0 {
+		return page, next
+	}
+
+	// Check if the last item is within bounds to shortcircuit.
+	if g.nextToken(page[len(page)-1]) < end {
+		return page, next
+	}
+
+	// Consider a binary search in the future, perhaps `sort.Search`, we do not expect the memory to be
+	// contiguous.
+	index := slices.IndexFunc(page, func(item T) bool {
+		return g.nextToken(item) >= end
+	})
+
+	if index >= 0 {
+		clear(page[index:])
+		return page[:index], ""
+	}
+
+	// This case should not happen, if the end is not found (index < 0) then we already should
+	// have shortcircuited this logic prior.
+	return page, next
+}
+
+// listRange retrieves a page of items from the configured cache collection between the start and end tokens.
 // If the cache is not healthy, then the items are retrieved from the upstream backend.
 // The items returend are cloned and ownership is retained by the caller.
-func (l genericLister[T, I]) list(ctx context.Context, pageSize int, startToken string) ([]T, string, error) {
+func (l genericLister[T, I]) listRange(ctx context.Context, pageSize int, startToken, endToken string) ([]T, string, error) {
 	rg, err := acquireReadGuard(l.cache, l.collection)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
@@ -97,7 +132,12 @@ func (l genericLister[T, I]) list(ctx context.Context, pageSize int, startToken
 
 	if !rg.ReadCache() {
 		out, next, err := l.upstreamList(ctx, pageSize, startToken)
-		return out, next, trace.Wrap(err)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		out, next = l.clipEnd(out, next, endToken)
+		return out, next, nil
 	}
 
 	defaultPageSize := defaults.DefaultChunkSize
@@ -109,8 +149,13 @@ func (l genericLister[T, I]) list(ctx context.Context, pageSize int, startToken
 		pageSize = defaultPageSize
 	}
 
+	fetchFn := rg.store.cache.Ascend
+	if l.isDesc {
+		fetchFn = rg.store.cache.Descend
+	}
+
 	var out []T
-	for sf := range rg.store.resources(l.index, startToken, "") {
+	for sf := range fetchFn(l.index, startToken, endToken) {
 		if len(out) == pageSize {
 			return out, l.nextToken(sf), nil
 		}
@@ -123,3 +168,79 @@ func (l genericLister[T, I]) list(ctx context.Context, pageSize int, startToken
 
 	return out, "", nil
 }
+
+// list retrieves a page of items from the configured cache collection.
+// If the cache is not healthy, then the items are retrieved from the upstream backend.
+// The items returend are cloned and ownership is retained by the caller.
+func (l genericLister[T, I]) list(ctx context.Context, pageSize int, startToken string) ([]T, string, error) {
+	out, next, err := l.listRange(ctx, pageSize, startToken, "")
+	return out, next, trace.Wrap(err)
+}
+
+// Range retrieves a stream of items from the configured cache collection within the range [start, end).
+// If the cache is not healthy, then the items are retrieved from the upstream backend.
+func (l genericLister[T, I]) Range(ctx context.Context, start, end string) iter.Seq2[T, error] {
+	return func(yield func(T, error) bool) {
+		token := start
+		for {
+			items, next, err := l.listRange(ctx, l.defaultPageSize, token, end)
+			if err != nil {
+				yield(*new(T), err)
+				return
+			}
+
+			for _, item := range items {
+				if !yield(item, nil) {
+					return
+				}
+			}
+
+			if next == "" {
+				return
+			}
+
+			token = next
+		}
+	}
+}
+
+// RangeWithFallback retrieves a stream of items from the configured cache collection within the range [start, end).
+// If the cache is not healthy, then the items are retrieved from the upstream backend. In addition, a fallback getter
+// is supported if the upstream does not implement a list operation, this is only checked on the first page.
+func (l genericLister[T, I]) RangeWithFallback(ctx context.Context, start, end string) iter.Seq2[T, error] {
+	return func(yield func(T, error) bool) {
+		// Fallback is only allowed when configured and the entire range is requested.
+		fallbackAllowed := l.fallbackGetter != nil && start == "" && end == ""
+
+		for item, err := range l.Range(ctx, start, end) {
+			if err != nil {
+				if fallbackAllowed && trace.IsNotImplemented(err) {
+					items, err := l.fallbackGetter(ctx)
+					if err != nil {
+						yield(*new(T), err)
+						return
+					}
+
+					for _, item := range items {
+						if !yield(item, nil) {
+							return
+						}
+					}
+
+					return
+				}
+
+				yield(*new(T), err)
+				return
+			}
+
+			if !yield(item, nil) {
+				return
+			}
+
+			// Disable the fallback once the first item is successfully yielded.
+			fallbackAllowed = false
+		}
+
+	}
+}
diff --git a/lib/cache/generic_operations_test.go b/lib/cache/generic_operations_test.go
new file mode 100644
index 0000000000000..bc99cc5674635
--- /dev/null
+++ b/lib/cache/generic_operations_test.go
@@ -0,0 +1,313 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+)
+
+func TestGenericListerPageClipEnd(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		page     []string
+		next     string
+		end      string
+		want     []string
+		wantNext string
+	}{
+		{
+			name:     "end unspecified, return as is",
+			page:     []string{"a", "b"},
+			next:     "c",
+			want:     []string{"a", "b"},
+			wantNext: "c",
+		},
+		{
+			name:     "end token found in page",
+			page:     []string{"a", "b", "c"},
+			end:      "b",
+			next:     "d",
+			want:     []string{"a"},
+			wantNext: "",
+		},
+		{
+			name:     "next token unaffected when no end found",
+			page:     []string{"a", "b"},
+			end:      "c",
+			next:     "c",
+			want:     []string{"a", "b"},
+			wantNext: "c",
+		},
+		{
+			name:     "end was before page",
+			page:     []string{"b", "c", "d"},
+			end:      "a",
+			next:     "e",
+			want:     []string{},
+			wantNext: "",
+		},
+	}
+	for _, tt := range tests {
+		g := genericLister[string, string]{
+			nextToken: func(s string) string { return s },
+		}
+
+		t.Run(tt.name, func(t *testing.T) {
+			page, next := g.clipEnd(tt.page, tt.next, tt.end)
+			assert.Empty(t, cmp.Diff(tt.want, page))
+			assert.Equal(t, tt.wantNext, next)
+		})
+	}
+}
+
+func TestGenericListerRangeWithFallback(t *testing.T) {
+	t.Parallel()
+
+	p, err := newPack(t, ForProxy)
+	require.NoError(t, err)
+	t.Cleanup(p.Close)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-p.eventsC:
+				// Discard events to avoid blocking the test.
+			}
+		}
+	}()
+
+	newResource := func(name string) (types.Application, error) {
+		return types.NewAppV3(types.Metadata{
+			Name: name,
+		}, types.AppSpecV3{
+			URI: "localhost",
+		})
+	}
+
+	var expected []types.Application
+	for i := range 9 {
+		name := fmt.Sprintf("app-%d", i)
+		r, err := newResource(name)
+		require.NoError(t, err)
+		require.NoError(t, p.apps.CreateApp(t.Context(), r))
+		expected = append(expected, r)
+	}
+
+	// Wait for cache
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		items, _ := p.cache.GetApps(ctx)
+		assert.Len(t, items, len(expected))
+	}, 15*time.Second, 100*time.Millisecond)
+
+	tests := []struct {
+		name            string
+		start           string
+		end             string
+		cacheOk         bool
+		upstreamList    func(context.Context, int, string) ([]types.Application, string, error)
+		defaultPageSize int
+		fallbackGetter  func(context.Context) ([]types.Application, error)
+		want            []types.Application
+		wantErr         string
+	}{
+		{
+			name:            "base case with small pages to force depagination",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 2,
+			cacheOk:         true,
+			want:            expected,
+		},
+		{
+			name:            "upstream lister",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 2,
+			cacheOk:         false,
+			want:            expected,
+		},
+		{
+			name:            "upstream large page respects ends with large page",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			end:             "app-9",
+			defaultPageSize: 100,
+			cacheOk:         false,
+			want:            expected[:9],
+		},
+		{
+			name:            "upstream lister with bounds",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 5,
+			start:           "app-1",
+			end:             "app-9",
+			cacheOk:         false,
+			want:            expected[1:9],
+		},
+		{
+			name:            "upstream lister with start",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 5,
+			start:           "app-1",
+			cacheOk:         false,
+			want:            expected[1:],
+		},
+		{
+			name:            "upstream lister with end",
+			upstreamList:    p.apps.ListApps,
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 5,
+			end:             "app-9",
+			cacheOk:         false,
+			want:            expected[:9],
+		},
+		{
+			name: "upstream fallback",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("")
+			},
+			fallbackGetter:  p.apps.GetApps,
+			defaultPageSize: 2,
+			cacheOk:         false,
+			want:            expected,
+		},
+		{
+			name: "upstream fallback not supported when start and end given",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("not implemented")
+			},
+			fallbackGetter: p.apps.GetApps,
+			start:          "app-1",
+			end:            "app-9",
+			cacheOk:        false,
+			wantErr:        "not implemented",
+		},
+		{
+			name: "upstream fallback not supported when start given",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("not implemented")
+			},
+			fallbackGetter: p.apps.GetApps,
+			start:          "app-1",
+			cacheOk:        false,
+			wantErr:        "not implemented",
+		},
+		{
+			name: "upstream fallback not supported when end given",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("not implemented")
+			},
+			fallbackGetter: p.apps.GetApps,
+			end:            "app-9",
+			cacheOk:        false,
+			wantErr:        "not implemented",
+		},
+		{
+			name: "fallback fail",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("")
+			},
+			fallbackGetter:  func(ctx context.Context) ([]types.Application, error) { return nil, trace.BadParameter("oops") },
+			defaultPageSize: 2,
+			cacheOk:         false,
+			wantErr:         "oops",
+		},
+		{
+			name: "upstream list other fail",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.BadParameter("upstream failed")
+			},
+			fallbackGetter: p.apps.GetApps,
+			cacheOk:        false,
+			wantErr:        "upstream failed",
+		},
+		{
+			name: "no fallback set, forward error",
+			upstreamList: func(ctx context.Context, i int, s string) ([]types.Application, string, error) {
+				return nil, "", trace.NotImplemented("not implemented")
+			},
+			cacheOk: false,
+			wantErr: "not implemented",
+		},
+		{
+			name: "fallback disabled after first item yields",
+			upstreamList: func(ctx context.Context, i int, token string) ([]types.Application, string, error) {
+				switch token {
+				case "":
+					return p.apps.ListApps(ctx, i, token)
+				default:
+					return nil, "", trace.NotImplemented("not implemented")
+				}
+			},
+			defaultPageSize: 2,
+			fallbackGetter:  p.apps.GetApps,
+			cacheOk:         false,
+			want:            expected[:2], // Collect yields first 2 items
+			wantErr:         "not implemented",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			l := genericLister[types.Application, appIndex]{
+				cache:      p.cache,
+				collection: p.cache.collections.apps,
+				index:      appNameIndex,
+				nextToken:  types.Application.GetName,
+
+				defaultPageSize: tt.defaultPageSize,
+				upstreamList:    tt.upstreamList,
+				fallbackGetter:  tt.fallbackGetter,
+			}
+
+			p.cache.ok = tt.cacheOk
+			got, err := stream.Collect(l.RangeWithFallback(context.Background(), tt.start, tt.end))
+
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+
+			require.Empty(t, cmp.Diff(tt.want, got,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+				cmpopts.IgnoreFields(header.Metadata{}, "Revision")))
+		})
+	}
+}
diff --git a/lib/cache/git_server.go b/lib/cache/git_server.go
index ce909aa8df858..0268ff17c4174 100644
--- a/lib/cache/git_server.go
+++ b/lib/cache/git_server.go
@@ -24,8 +24,9 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/client/gitserver"
-	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -40,26 +41,14 @@ func newGitServerCollection(upstream services.GitServerGetter, w types.WatchKind
 
 	return &collection[types.Server, gitServerIndex]{
 		store: newStore(
+			types.KindGitServer,
 			types.Server.DeepCopy,
 			map[gitServerIndex]func(types.Server) string{
 				gitServerNameIndex: types.Server.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Server, error) {
-			var all []types.Server
-			var nextToken string
-			for {
-				var page []types.Server
-				var err error
-				page, nextToken, err = upstream.ListGitServers(ctx, apidefaults.DefaultChunkSize, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				all = append(all, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return all, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListGitServers))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Server {
 			return &types.ServerV2{
diff --git a/lib/cache/git_server_test.go b/lib/cache/git_server_test.go
index 35ce40941a53b..74963f620107c 100644
--- a/lib/cache/git_server_test.go
+++ b/lib/cache/git_server_test.go
@@ -31,13 +31,13 @@ import (
 func TestGitServers(t *testing.T) {
 	t.Parallel()
 
-	p, err := newPack(t.TempDir(), ForAuth)
+	p, err := newPack(t, ForAuth)
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
 	testResources(t, p, testFuncs[types.Server]{
 		newResource: func(name string) (types.Server, error) {
-			return types.NewGitHubServer(
+			return types.NewGitHubServerWithName(name,
 				types.GitHubServerMetadata{
 					Integration:  name,
 					Organization: name,
@@ -47,19 +47,13 @@ func TestGitServers(t *testing.T) {
 			_, err := p.gitServers.CreateGitServer(ctx, server)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]types.Server, error) {
-			servers, _, err := p.gitServers.ListGitServers(ctx, 0, "")
-			return servers, trace.Wrap(err)
-		},
+		list: p.gitServers.ListGitServers,
 		update: func(ctx context.Context, server types.Server) error {
 			_, err := p.gitServers.UpdateGitServer(ctx, server)
 			return trace.Wrap(err)
 		},
 		deleteAll: p.gitServers.DeleteAllGitServers,
-		cacheList: func(ctx context.Context) ([]types.Server, error) {
-			servers, _, err := p.cache.ListGitServers(ctx, 0, "")
-			return servers, trace.Wrap(err)
-		},
-		cacheGet: p.cache.GetGitServer,
+		cacheList: p.cache.ListGitServers,
+		cacheGet:  p.cache.GetGitServer,
 	})
 }
diff --git a/lib/cache/health_check_config.go b/lib/cache/health_check_config.go
index eaba2b0669763..90dce6536e3e8 100644
--- a/lib/cache/health_check_config.go
+++ b/lib/cache/health_check_config.go
@@ -28,6 +28,7 @@ import (
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -42,6 +43,7 @@ func newHealthCheckConfigCollection(upstream services.HealthCheckConfigReader, w
 
 	return &collection[*healthcheckconfigv1.HealthCheckConfig, healthCheckConfigIndex]{
 		store: newStore(
+			types.KindHealthCheckConfig,
 			proto.CloneOf[*healthcheckconfigv1.HealthCheckConfig],
 			map[healthCheckConfigIndex]func(*healthcheckconfigv1.HealthCheckConfig) string{
 				healthCheckConfigNameIndex: func(r *healthcheckconfigv1.HealthCheckConfig) string {
@@ -49,15 +51,8 @@ func newHealthCheckConfigCollection(upstream services.HealthCheckConfigReader, w
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*healthcheckconfigv1.HealthCheckConfig, error) {
-			var out []*healthcheckconfigv1.HealthCheckConfig
-			clientutils.IterateResources(ctx,
-				upstream.ListHealthCheckConfigs,
-				func(hcc *healthcheckconfigv1.HealthCheckConfig) error {
-					out = append(out, hcc)
-					return nil
-				},
-			)
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListHealthCheckConfigs))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *healthcheckconfigv1.HealthCheckConfig {
 			return &healthcheckconfigv1.HealthCheckConfig{
diff --git a/lib/cache/health_check_config_test.go b/lib/cache/health_check_config_test.go
index d730ce778c638..efd17a650ecc0 100644
--- a/lib/cache/health_check_config_test.go
+++ b/lib/cache/health_check_config_test.go
@@ -25,6 +25,8 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/defaults"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	"github.com/gravitational/teleport/api/types/healthcheckconfig"
 )
@@ -45,11 +47,11 @@ func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.Health
 func TestHealthCheckConfig(t *testing.T) {
 	t.Parallel()
 
-	p, err := newPack(t.TempDir(), ForAuth)
+	p, err := newPack(t, ForAuth)
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*healthcheckconfigv1.HealthCheckConfig]{
+	testResources153(t, p, testFuncs[*healthcheckconfigv1.HealthCheckConfig]{
 		newResource: func(name string) (*healthcheckconfigv1.HealthCheckConfig, error) {
 			return newHealthCheckConfig(t, name), nil
 		},
@@ -57,19 +59,84 @@ func TestHealthCheckConfig(t *testing.T) {
 			_, err := p.healthCheckConfig.CreateHealthCheckConfig(ctx, cfg)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*healthcheckconfigv1.HealthCheckConfig, error) {
-			items, _, err := p.healthCheckConfig.ListHealthCheckConfigs(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list: filterHealthCfgNonVirtual(p.healthCheckConfig.ListHealthCheckConfigs),
 		update: func(ctx context.Context, cfg *healthcheckconfigv1.HealthCheckConfig) error {
 			_, err := p.healthCheckConfig.UpdateHealthCheckConfig(ctx, cfg)
 			return trace.Wrap(err)
 		},
 		deleteAll: p.healthCheckConfig.DeleteAllHealthCheckConfigs,
-		cacheList: func(ctx context.Context) ([]*healthcheckconfigv1.HealthCheckConfig, error) {
-			items, _, err := p.cache.ListHealthCheckConfigs(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheGet: p.cache.GetHealthCheckConfig,
-	})
+		cacheList: filterHealthCfgNonVirtual(p.cache.ListHealthCheckConfigs),
+		cacheGet:  p.cache.GetHealthCheckConfig,
+	}, withSkipPaginationTest())
+}
+
+type listHealthCfgFunc func(ctx context.Context, pageSize int, pageToken string) ([]*healthcheckconfigv1.HealthCheckConfig, string, error)
+
+// filterHealthCfgNonVirtual excludes virtual defaults while maintaining pagination.
+func filterHealthCfgNonVirtual(listFn listHealthCfgFunc) listHealthCfgFunc {
+	return func(ctx context.Context, pageSize int, pageToken string) ([]*healthcheckconfigv1.HealthCheckConfig, string, error) {
+		var allNonVirtual []*healthcheckconfigv1.HealthCheckConfig
+		var token string
+		for {
+			items, nextPageToken, err := listFn(ctx, defaults.DefaultChunkSize, token)
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+			for _, item := range items {
+				if !isVirtualDefaultHealthCheckConfig(item.GetMetadata().GetName()) {
+					allNonVirtual = append(allNonVirtual, item)
+				}
+			}
+			if nextPageToken == "" {
+				break
+			}
+			token = nextPageToken
+		}
+		page, nextPageToken := pageHealthCfg(allNonVirtual, pageSize, pageToken)
+		return page, nextPageToken, nil
+	}
+}
+
+// pageHealthCfg creates a page from a slice.
+func pageHealthCfg(
+	items []*healthcheckconfigv1.HealthCheckConfig,
+	pageSize int,
+	pageToken string,
+) ([]*healthcheckconfigv1.HealthCheckConfig, string) {
+	if len(items) == 0 {
+		return nil, ""
+	}
+	// look for the start index
+	var idxStart int
+	if pageToken != "" {
+		for n, item := range items {
+			if item.GetMetadata().GetName() == pageToken {
+				idxStart = n + 1
+				break
+			}
+		}
+	}
+	if idxStart >= len(items) {
+		return nil, ""
+	}
+	// look for the end index
+	idxEnd := len(items)
+	if pageSize > 0 && idxStart+pageSize < len(items) {
+		idxEnd = idxStart + pageSize
+	}
+	page := items[idxStart:idxEnd]
+	var nextPageToken string
+	if idxEnd < len(items) {
+		nextPageToken = page[len(page)-1].GetMetadata().GetName()
+	}
+	return page, nextPageToken
+}
+
+func isVirtualDefaultHealthCheckConfig(name string) bool {
+	switch name {
+	case teleport.VirtualDefaultHealthCheckConfigDBName,
+		teleport.VirtualDefaultHealthCheckConfigKubeName:
+		return true
+	}
+	return false
 }
diff --git a/lib/cache/identitycenter.go b/lib/cache/identitycenter.go
index 77a5e017cb95e..3ec3ffa34393d 100644
--- a/lib/cache/identitycenter.go
+++ b/lib/cache/identitycenter.go
@@ -26,8 +26,9 @@ import (
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 type identityCenterAccountIndex string
@@ -41,6 +42,7 @@ func newIdentityCenterAccountCollection(ic services.IdentityCenter, w types.Watc
 
 	return &collection[*identitycenterv1.Account, identityCenterAccountIndex]{
 		store: newStore(
+			types.KindIdentityCenterAccount,
 			proto.CloneOf[*identitycenterv1.Account],
 			map[identityCenterAccountIndex]func(*identitycenterv1.Account) string{
 				identityCenterAccountNameIndex: func(r *identitycenterv1.Account) string {
@@ -48,23 +50,8 @@ func newIdentityCenterAccountCollection(ic services.IdentityCenter, w types.Watc
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*identitycenterv1.Account, error) {
-			var pageToken pagination.PageRequestToken
-			var accounts []*identitycenterv1.Account
-			for {
-				resp, nextToken, err := ic.ListIdentityCenterAccounts(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				for _, item := range resp {
-					accounts = append(accounts, item.Account)
-				}
-				if nextToken == "" {
-					break
-				}
-				pageToken.Update(nextToken)
-			}
-			return accounts, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, ic.ListIdentityCenterAccounts))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.Account {
 			return &identitycenterv1.Account{
@@ -80,13 +67,13 @@ func newIdentityCenterAccountCollection(ic services.IdentityCenter, w types.Watc
 	}, nil
 }
 
-func (c *Cache) GetIdentityCenterAccount(ctx context.Context, name services.IdentityCenterAccountID) (services.IdentityCenterAccount, error) {
+func (c *Cache) GetIdentityCenterAccount(ctx context.Context, name string) (*identitycenterv1.Account, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/GetIdentityCenterAccount")
 	defer span.End()
 
 	rg, err := acquireReadGuard(c, c.collections.identityCenterAccounts)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	defer rg.Release()
 
@@ -95,18 +82,30 @@ func (c *Cache) GetIdentityCenterAccount(ctx context.Context, name services.Iden
 		return account, trace.Wrap(err)
 	}
 
-	account, err := rg.store.get(identityCenterAccountNameIndex, string(name))
+	account, err := rg.store.get(identityCenterAccountNameIndex, name)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
-	return services.IdentityCenterAccount{Account: utils.CloneProtoMsg(account)}, nil
+	return utils.CloneProtoMsg(account), nil
 }
 
-func (c *Cache) ListIdentityCenterAccounts(ctx context.Context, pageSize int, token *pagination.PageRequestToken) ([]services.IdentityCenterAccount, pagination.NextPageToken, error) {
+func (c *Cache) ListIdentityCenterAccounts(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.Account, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListIdentityCenterAccounts")
 	defer span.End()
 
+	accounts, next, err := c.ListIdentityCenterAccounts2(ctx, pageSize, pageToken)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return accounts, next, nil
+}
+
+func (c *Cache) ListIdentityCenterAccounts2(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.Account, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListIdentityCenterAccounts2")
+	defer span.End()
+
 	rg, err := acquireReadGuard(c, c.collections.identityCenterAccounts)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
@@ -114,7 +113,7 @@ func (c *Cache) ListIdentityCenterAccounts(ctx context.Context, pageSize int, to
 	defer rg.Release()
 
 	if !rg.ReadCache() {
-		accounts, next, err := c.Config.IdentityCenter.ListIdentityCenterAccounts(ctx, pageSize, token)
+		accounts, next, err := c.Config.IdentityCenter.ListIdentityCenterAccounts2(ctx, pageSize, pageToken)
 		return accounts, next, trace.Wrap(err)
 	}
 
@@ -122,18 +121,13 @@ func (c *Cache) ListIdentityCenterAccounts(ctx context.Context, pageSize int, to
 		pageSize = 100
 	}
 
-	var accounts []services.IdentityCenterAccount
-	startKey, err := token.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-
-	for account := range rg.store.resources(identityCenterAccountNameIndex, startKey, "") {
+	var accounts []*identitycenterv1.Account
+	for account := range rg.store.resources(identityCenterAccountNameIndex, pageToken, "") {
 		if len(accounts) == pageSize {
-			return accounts, pagination.NextPageToken(account.Metadata.GetName()), nil
+			return accounts, account.Metadata.GetName(), nil
 		}
 
-		accounts = append(accounts, services.IdentityCenterAccount{Account: utils.CloneProtoMsg(account)})
+		accounts = append(accounts, utils.CloneProtoMsg(account))
 
 	}
 	return accounts, "", nil
@@ -150,6 +144,7 @@ func newIdentityCenterAccountAssignmentCollection(ic services.IdentityCenter, w
 
 	return &collection[*identitycenterv1.AccountAssignment, identityCenterAccountAssignmentIndex]{
 		store: newStore(
+			types.KindIdentityCenterAccountAssignment,
 			proto.CloneOf[*identitycenterv1.AccountAssignment],
 			map[identityCenterAccountAssignmentIndex]func(*identitycenterv1.AccountAssignment) string{
 				identityCenterAccountAssignmentNameIndex: func(r *identitycenterv1.AccountAssignment) string {
@@ -157,23 +152,8 @@ func newIdentityCenterAccountAssignmentCollection(ic services.IdentityCenter, w
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*identitycenterv1.AccountAssignment, error) {
-			var pageToken pagination.PageRequestToken
-			var accounts []*identitycenterv1.AccountAssignment
-			for {
-				resp, nextToken, err := ic.ListAccountAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				for _, item := range resp {
-					accounts = append(accounts, item.AccountAssignment)
-				}
-				if nextToken == "" {
-					break
-				}
-				pageToken.Update(nextToken)
-			}
-			return accounts, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, ic.ListIdentityCenterAccountAssignments))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.AccountAssignment {
 			return &identitycenterv1.AccountAssignment{
@@ -193,28 +173,40 @@ func (c *Cache) GetAccountAssignment(ctx context.Context, id services.IdentityCe
 	ctx, span := c.Tracer.Start(ctx, "cache/GetAccountAssignment")
 	defer span.End()
 
-	rg, err := acquireReadGuard(c, c.collections.identityCenterAccountAssignments)
+	assignment, err := c.GetIdentityCenterAccountAssignment(ctx, string(id))
 	if err != nil {
 		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err)
 	}
+
+	return services.IdentityCenterAccountAssignment{AccountAssignment: assignment}, nil
+}
+
+func (c *Cache) GetIdentityCenterAccountAssignment(ctx context.Context, id string) (*identitycenterv1.AccountAssignment, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetIdentityCenterAccountAssignment")
+	defer span.End()
+
+	rg, err := acquireReadGuard(c, c.collections.identityCenterAccountAssignments)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	defer rg.Release()
 
 	if !rg.ReadCache() {
-		assignment, err := c.Config.IdentityCenter.GetAccountAssignment(ctx, id)
+		assignment, err := c.Config.IdentityCenter.GetIdentityCenterAccountAssignment(ctx, id)
 		return assignment, trace.Wrap(err)
 	}
 
-	assignment, err := rg.store.get(identityCenterAccountAssignmentNameIndex, string(id))
+	assignment, err := rg.store.get(identityCenterAccountAssignmentNameIndex, id)
 	if err != nil {
-		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
-	return services.IdentityCenterAccountAssignment{AccountAssignment: assignment}, nil
+	return proto.CloneOf(assignment), nil
 }
 
-// ListAccountAssignments fetches a paginated list of IdentityCenter Account Assignments
-func (c *Cache) ListAccountAssignments(ctx context.Context, pageSize int, pageToken *pagination.PageRequestToken) ([]services.IdentityCenterAccountAssignment, pagination.NextPageToken, error) {
-	ctx, span := c.Tracer.Start(ctx, "cache/ListAccountAssignments")
+// ListIdentityCenterAccountAssignments fetches a paginated list of IdentityCenter Account Assignments
+func (c *Cache) ListIdentityCenterAccountAssignments(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.AccountAssignment, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListIdentityCenterAccountAssignments")
 	defer span.End()
 
 	rg, err := acquireReadGuard(c, c.collections.identityCenterAccountAssignments)
@@ -224,7 +216,7 @@ func (c *Cache) ListAccountAssignments(ctx context.Context, pageSize int, pageTo
 	defer rg.Release()
 
 	if !rg.ReadCache() {
-		assignment, next, err := c.Config.IdentityCenter.ListAccountAssignments(ctx, pageSize, pageToken)
+		assignment, next, err := c.Config.IdentityCenter.ListIdentityCenterAccountAssignments(ctx, pageSize, pageToken)
 		return assignment, next, trace.Wrap(err)
 	}
 
@@ -232,21 +224,13 @@ func (c *Cache) ListAccountAssignments(ctx context.Context, pageSize int, pageTo
 		pageSize = 100
 	}
 
-	token, err := pageToken.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err, "extracting page token")
-	}
-
-	var assignments []services.IdentityCenterAccountAssignment
-	for assignment := range rg.store.resources(identityCenterAccountAssignmentNameIndex, token, "") {
+	var assignments []*identitycenterv1.AccountAssignment
+	for assignment := range rg.store.resources(identityCenterAccountAssignmentNameIndex, pageToken, "") {
 		if len(assignments) == pageSize {
-			return assignments, pagination.NextPageToken(assignment.GetMetadata().Name), nil
+			return assignments, assignment.GetMetadata().Name, nil
 		}
 
-		assignments = append(assignments, services.IdentityCenterAccountAssignment{
-			AccountAssignment: utils.CloneProtoMsg(assignment),
-		})
-
+		assignments = append(assignments, proto.CloneOf(assignment))
 	}
 	return assignments, "", nil
 }
@@ -262,6 +246,7 @@ func newIdentityCenterPrincipalAssignmentCollection(upstream services.IdentityCe
 
 	return &collection[*identitycenterv1.PrincipalAssignment, identityCenterPrincipalAssignmentIndex]{
 		store: newStore(
+			types.KindIdentityCenterPrincipalAssignment,
 			proto.CloneOf[*identitycenterv1.PrincipalAssignment],
 			map[identityCenterPrincipalAssignmentIndex]func(*identitycenterv1.PrincipalAssignment) string{
 				identityCenterPrincipalAssignmentNameIndex: func(r *identitycenterv1.PrincipalAssignment) string {
@@ -269,22 +254,8 @@ func newIdentityCenterPrincipalAssignmentCollection(upstream services.IdentityCe
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*identitycenterv1.PrincipalAssignment, error) {
-			var pageToken pagination.PageRequestToken
-			var resources []*identitycenterv1.PrincipalAssignment
-			for {
-				resourcesPage, nextPage, err := upstream.ListPrincipalAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, resourcesPage...)
-
-				if nextPage == "" {
-					break
-				}
-				pageToken.Update(nextPage)
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListPrincipalAssignments))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.PrincipalAssignment {
 			return &identitycenterv1.PrincipalAssignment{
@@ -316,28 +287,28 @@ func (c *Cache) GetPrincipalAssignment(ctx context.Context, id services.Principa
 	return out, trace.Wrap(err)
 }
 
-func (c *Cache) ListPrincipalAssignments(ctx context.Context, pageSize int, req *pagination.PageRequestToken) ([]*identitycenterv1.PrincipalAssignment, pagination.NextPageToken, error) {
+func (c *Cache) ListPrincipalAssignments(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PrincipalAssignment, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListPrincipalAssignments")
+	defer span.End()
+
+	out, next, err := c.ListPrincipalAssignments2(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
+
+func (c *Cache) ListPrincipalAssignments2(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PrincipalAssignment, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListPrincipalAssignments")
 	defer span.End()
 
 	lister := genericLister[*identitycenterv1.PrincipalAssignment, identityCenterPrincipalAssignmentIndex]{
-		cache:      c,
-		collection: c.collections.identityCenterPrincipalAssignments,
-		index:      identityCenterPrincipalAssignmentNameIndex,
-		upstreamList: func(ctx context.Context, pageSize int, s string) ([]*identitycenterv1.PrincipalAssignment, string, error) {
-			out, next, err := c.Config.IdentityCenter.ListPrincipalAssignments(ctx, pageSize, req)
-			return out, string(next), trace.Wrap(err)
-		},
+		cache:        c,
+		collection:   c.collections.identityCenterPrincipalAssignments,
+		index:        identityCenterPrincipalAssignmentNameIndex,
+		upstreamList: c.Config.IdentityCenter.ListPrincipalAssignments2,
 		nextToken: func(t *identitycenterv1.PrincipalAssignment) string {
 			return t.GetMetadata().GetName()
 		},
 	}
 
-	nextToken, err := req.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-
-	out, next, err := lister.list(ctx, pageSize, nextToken)
-	return out, pagination.NextPageToken(next), trace.Wrap(err)
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
 }
diff --git a/lib/cache/identitycenter_test.go b/lib/cache/identitycenter_test.go
index 26c2544372541..93c2d38828b79 100644
--- a/lib/cache/identitycenter_test.go
+++ b/lib/cache/identitycenter_test.go
@@ -18,8 +18,6 @@ package cache
 
 import (
 	"context"
-	"log/slog"
-	"os"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -28,8 +26,6 @@ import (
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 func newIdentityCenterAccount(id string) *identitycenterv1.Account {
@@ -48,78 +44,34 @@ func newIdentityCenterAccount(id string) *identitycenterv1.Account {
 	}
 }
 
-// TestIdentityCenterAccount asserts that an Identoty Ceneter Account can be cached
+// TestIdentityCenterAccount asserts that an Identity Center Account can be cached
 func TestIdentityCenterAccount(t *testing.T) {
-	slog.SetDefault(
-		slog.New(logutils.NewSlogTextHandler(
-			os.Stderr, logutils.SlogTextHandlerConfig{Level: slog.LevelDebug})))
-
 	t.Parallel()
 
 	fixturePack := newTestPack(t, ForAuth)
 	t.Cleanup(fixturePack.Close)
 
-	testResources153(t, fixturePack, testFuncs153[services.IdentityCenterAccount]{
-		newResource: func(s string) (services.IdentityCenterAccount, error) {
-			return services.IdentityCenterAccount{Account: newIdentityCenterAccount(s)}, nil
+	testResources153(t, fixturePack, testFuncs[*identitycenterv1.Account]{
+		newResource: func(s string) (*identitycenterv1.Account, error) {
+			return newIdentityCenterAccount(s), nil
 		},
-		create: func(ctx context.Context, item services.IdentityCenterAccount) error {
-			_, err := fixturePack.identityCenter.CreateIdentityCenterAccount(ctx, item)
+		create: func(ctx context.Context, item *identitycenterv1.Account) error {
+			_, err := fixturePack.identityCenter.CreateIdentityCenterAccount2(ctx, item)
 			return trace.Wrap(err)
 		},
-		update: func(ctx context.Context, item services.IdentityCenterAccount) error {
-			_, err := fixturePack.identityCenter.UpdateIdentityCenterAccount(ctx, item)
+		update: func(ctx context.Context, item *identitycenterv1.Account) error {
+			_, err := fixturePack.identityCenter.UpdateIdentityCenterAccount2(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]services.IdentityCenterAccount, error) {
-			var result []services.IdentityCenterAccount
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.identityCenter.ListIdentityCenterAccounts(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				pageToken.Update(nextPage)
-				if nextPage == "" {
-					break
-				}
-			}
-
-			return result, nil
-		},
+		list: fixturePack.identityCenter.ListIdentityCenterAccounts2,
 		delete: func(ctx context.Context, id string) error {
 			return trace.Wrap(fixturePack.identityCenter.DeleteIdentityCenterAccount(
 				ctx, services.IdentityCenterAccountID(id)))
 		},
-		deleteAll: func(ctx context.Context) error {
-			_, err := fixturePack.identityCenter.DeleteAllIdentityCenterAccounts(ctx, &identitycenterv1.DeleteAllIdentityCenterAccountsRequest{})
-			return trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]services.IdentityCenterAccount, error) {
-			var result []services.IdentityCenterAccount
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.cache.ListIdentityCenterAccounts(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				pageToken.Update(nextPage)
-				if nextPage == "" {
-					break
-				}
-			}
-
-			return result, nil
-		},
-		cacheGet: func(ctx context.Context, id string) (services.IdentityCenterAccount, error) {
-			r, err := fixturePack.cache.GetIdentityCenterAccount(ctx, services.IdentityCenterAccountID(id))
-			return r, trace.Wrap(err)
-		},
-	})
+		deleteAll: fixturePack.identityCenter.DeleteAllIdentityCenterAccounts,
+		cacheList: fixturePack.cache.ListIdentityCenterAccounts2,
+		cacheGet:  fixturePack.cache.GetIdentityCenterAccount,
+	}, withSkipPaginationTest())
 }
 
 func newIdentityCenterPrincipalAssignment(id string) *identitycenterv1.PrincipalAssignment {
@@ -143,10 +95,11 @@ func newIdentityCenterPrincipalAssignment(id string) *identitycenterv1.Principal
 
 // TestIdentityCenterPrincipalAssignment asserts that an Identity Center PrincipalAssignment can be cached
 func TestIdentityCenterPrincipalAssignment(t *testing.T) {
+	t.Parallel()
 	fixturePack := newTestPack(t, ForAuth)
 	t.Cleanup(fixturePack.Close)
 
-	testResources153(t, fixturePack, testFuncs153[*identitycenterv1.PrincipalAssignment]{
+	testResources153(t, fixturePack, testFuncs[*identitycenterv1.PrincipalAssignment]{
 		newResource: func(s string) (*identitycenterv1.PrincipalAssignment, error) {
 			return newIdentityCenterPrincipalAssignment(s), nil
 		},
@@ -158,54 +111,19 @@ func TestIdentityCenterPrincipalAssignment(t *testing.T) {
 			_, err := fixturePack.identityCenter.UpdatePrincipalAssignment(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*identitycenterv1.PrincipalAssignment, error) {
-			var result []*identitycenterv1.PrincipalAssignment
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.identityCenter.ListPrincipalAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				if nextPage == pagination.EndOfList {
-					break
-				}
-
-				pageToken.Update(nextPage)
-			}
-			return result, nil
-		},
+		list: fixturePack.identityCenter.ListPrincipalAssignments2,
 		delete: func(ctx context.Context, id string) error {
 			return trace.Wrap(fixturePack.identityCenter.DeletePrincipalAssignment(ctx, services.PrincipalAssignmentID(id)))
 		},
 		deleteAll: func(ctx context.Context) error {
-			_, err := fixturePack.identityCenter.DeleteAllPrincipalAssignments(ctx, &identitycenterv1.DeleteAllPrincipalAssignmentsRequest{})
-			return trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*identitycenterv1.PrincipalAssignment, error) {
-			var result []*identitycenterv1.PrincipalAssignment
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.cache.ListPrincipalAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				if nextPage == pagination.EndOfList {
-					break
-				}
-
-				pageToken.Update(nextPage)
-			}
-			return result, nil
+			return trace.Wrap(fixturePack.identityCenter.DeleteAllPrincipalAssignments(ctx))
 		},
+		cacheList: fixturePack.cache.ListPrincipalAssignments2,
 		cacheGet: func(ctx context.Context, id string) (*identitycenterv1.PrincipalAssignment, error) {
 			r, err := fixturePack.cache.GetPrincipalAssignment(ctx, services.PrincipalAssignmentID(id))
 			return r, trace.Wrap(err)
 		},
-	})
+	}, withSkipPaginationTest())
 }
 
 func newIdentityCenterAccountAssignment(id string) *identitycenterv1.AccountAssignment {
@@ -228,67 +146,33 @@ func newIdentityCenterAccountAssignment(id string) *identitycenterv1.AccountAssi
 // TestIdentityCenterAccountAssignment asserts that an Identity Center
 // AccountAssignment can be cached
 func TestIdentityCenterAccountAssignment(t *testing.T) {
+	t.Parallel()
 	fixturePack := newTestPack(t, ForAuth)
 	t.Cleanup(fixturePack.Close)
 
-	testResources153(t, fixturePack, testFuncs153[services.IdentityCenterAccountAssignment]{
-		newResource: func(s string) (services.IdentityCenterAccountAssignment, error) {
-			return services.IdentityCenterAccountAssignment{
-				AccountAssignment: newIdentityCenterAccountAssignment(s),
-			}, nil
+	testResources153(t, fixturePack, testFuncs[*identitycenterv1.AccountAssignment]{
+		newResource: func(s string) (*identitycenterv1.AccountAssignment, error) {
+			return newIdentityCenterAccountAssignment(s), nil
 		},
-		create: func(ctx context.Context, item services.IdentityCenterAccountAssignment) error {
-			_, err := fixturePack.identityCenter.CreateAccountAssignment(ctx, item)
+		create: func(ctx context.Context, item *identitycenterv1.AccountAssignment) error {
+			_, err := fixturePack.identityCenter.CreateIdentityCenterAccountAssignment(ctx, item)
 			return trace.Wrap(err)
 		},
-		update: func(ctx context.Context, item services.IdentityCenterAccountAssignment) error {
-			_, err := fixturePack.identityCenter.UpdateAccountAssignment(ctx, item)
+		update: func(ctx context.Context, item *identitycenterv1.AccountAssignment) error {
+			_, err := fixturePack.identityCenter.UpdateIdentityCenterAccountAssignment(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]services.IdentityCenterAccountAssignment, error) {
-			var result []services.IdentityCenterAccountAssignment
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.identityCenter.ListAccountAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				pageToken.Update(nextPage)
-				if nextPage == "" {
-					break
-				}
-			}
-			return result, nil
-		},
+		list: fixturePack.identityCenter.ListIdentityCenterAccountAssignments,
 		delete: func(ctx context.Context, id string) error {
 			return trace.Wrap(fixturePack.identityCenter.DeleteAccountAssignment(ctx, services.IdentityCenterAccountAssignmentID(id)))
 		},
 		deleteAll: func(ctx context.Context) error {
-			_, err := fixturePack.identityCenter.DeleteAllAccountAssignments(ctx, &identitycenterv1.DeleteAllAccountAssignmentsRequest{})
-			return trace.Wrap(err)
+			return trace.Wrap(fixturePack.identityCenter.DeleteAllAccountAssignments(ctx))
 		},
-		cacheList: func(ctx context.Context) ([]services.IdentityCenterAccountAssignment, error) {
-			var result []services.IdentityCenterAccountAssignment
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.cache.ListAccountAssignments(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				pageToken.Update(nextPage)
-				if nextPage == "" {
-					break
-				}
-			}
-			return result, nil
-		},
-		cacheGet: func(ctx context.Context, id string) (services.IdentityCenterAccountAssignment, error) {
+		cacheList: fixturePack.cache.ListIdentityCenterAccountAssignments,
+		cacheGet: func(ctx context.Context, id string) (*identitycenterv1.AccountAssignment, error) {
 			r, err := fixturePack.cache.GetAccountAssignment(ctx, services.IdentityCenterAccountAssignmentID(id))
-			return r, trace.Wrap(err)
+			return r.AccountAssignment, trace.Wrap(err)
 		},
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/installer.go b/lib/cache/installer.go
index cb7e7ac2c7326..f8db594adb07c 100644
--- a/lib/cache/installer.go
+++ b/lib/cache/installer.go
@@ -18,10 +18,12 @@ package cache
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -36,13 +38,15 @@ func newInstallerCollection(upstream services.ClusterConfiguration, w types.Watc
 
 	return &collection[types.Installer, installerIndex]{
 		store: newStore(
+			types.KindInstaller,
 			types.Installer.Clone,
 			map[installerIndex]func(types.Installer) string{
 				installerNameIndex: types.Installer.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Installer, error) {
-			installers, err := upstream.GetInstallers(ctx)
-			return installers, trace.Wrap(err)
+			// TODO(lokraszewski): DELETE IN v21.0.0 replace by regular clientutils.Resources
+			out, err := clientutils.CollectWithFallback(ctx, upstream.ListInstallers, upstream.GetInstallers)
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Installer {
 			return &types.InstallerV1{
@@ -95,3 +99,47 @@ func (c *Cache) GetInstallers(ctx context.Context) ([]types.Installer, error) {
 
 	return installers, nil
 }
+
+// ListInstallers returns a page of installer script resources.
+func (c *Cache) ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListInstallers")
+	defer span.End()
+
+	lister := genericLister[types.Installer, installerIndex]{
+		cache:        c,
+		collection:   c.collections.installers,
+		index:        installerNameIndex,
+		upstreamList: c.Config.ClusterConfig.ListInstallers,
+		nextToken:    types.Installer.GetName,
+	}
+	out, next, err := lister.list(ctx, limit, start)
+	return out, next, trace.Wrap(err)
+}
+
+// RangeInstallers returns installer script resources within the range [start, end).
+func (c *Cache) RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error] {
+	lister := genericLister[types.Installer, installerIndex]{
+		cache:        c,
+		collection:   c.collections.installers,
+		index:        installerNameIndex,
+		upstreamList: c.Config.ClusterConfig.ListInstallers,
+		nextToken:    types.Installer.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: c.Config.ClusterConfig.GetInstallers,
+	}
+
+	return func(yield func(types.Installer, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeInstallers")
+		defer span.End()
+
+		for inst, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(inst, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
diff --git a/lib/cache/installer_test.go b/lib/cache/installer_test.go
index e138c4d65c126..83e91601a2700 100644
--- a/lib/cache/installer_test.go
+++ b/lib/cache/installer_test.go
@@ -26,22 +26,35 @@ import (
 func TestInstallers(t *testing.T) {
 	t.Parallel()
 
-	p := newTestPack(t, ForProxy)
+	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
+	t.Run("GetInstallers", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Installer]{
+			newResource: func(name string) (types.Installer, error) {
+				return types.NewInstallerV1(name, "test.sh")
+			},
+			create:    p.clusterConfigS.SetInstaller,
+			list:      getAllAdapter(p.clusterConfigS.GetInstallers),
+			cacheList: getAllAdapter(p.cache.GetInstallers),
+			deleteAll: func(ctx context.Context) error {
+				return p.clusterConfigS.DeleteAllInstallers(ctx)
+			},
+		}, withSkipPaginationTest())
+	})
 
-	testResources(t, p, testFuncs[types.Installer]{
-		newResource: func(name string) (types.Installer, error) {
-			return types.NewInstallerV1("test", "test.sh")
-		},
-		create: p.clusterConfigS.SetInstaller,
-		list: func(ctx context.Context) ([]types.Installer, error) {
-			return p.clusterConfigS.GetInstallers(ctx)
-		},
-		cacheList: func(ctx context.Context) ([]types.Installer, error) {
-			return p.cache.GetInstallers(ctx)
-		},
-		deleteAll: func(ctx context.Context) error {
-			return p.clusterConfigS.DeleteAllInstallers(ctx)
-		},
+	t.Run("ListInstallers", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Installer]{
+			newResource: func(name string) (types.Installer, error) {
+				return types.NewInstallerV1(name, "test.sh")
+			},
+			create:     p.clusterConfigS.SetInstaller,
+			list:       p.clusterConfigS.ListInstallers,
+			Range:      p.clusterConfigS.RangeInstallers,
+			cacheList:  p.cache.ListInstallers,
+			cacheRange: p.cache.RangeInstallers,
+			deleteAll: func(ctx context.Context) error {
+				return p.clusterConfigS.DeleteAllInstallers(ctx)
+			},
+		})
 	})
 }
diff --git a/lib/cache/integrations.go b/lib/cache/integrations.go
index 0bc5fed705250..2e703baa92e73 100644
--- a/lib/cache/integrations.go
+++ b/lib/cache/integrations.go
@@ -22,6 +22,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -36,29 +38,14 @@ func newIntegrationCollection(upstream services.Integrations, w types.WatchKind)
 
 	return &collection[types.Integration, integrationIndex]{
 		store: newStore(
+			types.KindIntegration,
 			types.Integration.Clone,
 			map[integrationIndex]func(types.Integration) string{
 				integrationNameIndex: types.Integration.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Integration, error) {
-			var startKey string
-			var resources []types.Integration
-			for {
-				var igs []types.Integration
-				var err error
-				igs, startKey, err = upstream.ListIntegrations(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, igs...)
-
-				if startKey == "" {
-					break
-				}
-			}
-
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListIntegrations))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Integration {
 			return &types.IntegrationV1{
diff --git a/lib/cache/integrations_test.go b/lib/cache/integrations_test.go
index 0503c55218837..35ef91d07ff37 100644
--- a/lib/cache/integrations_test.go
+++ b/lib/cache/integrations_test.go
@@ -44,15 +44,9 @@ func TestIntegrations(t *testing.T) {
 			_, err := p.integrations.CreateIntegration(ctx, i)
 			return err
 		},
-		list: func(ctx context.Context) ([]types.Integration, error) {
-			results, _, err := p.integrations.ListIntegrations(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetIntegration,
-		cacheList: func(ctx context.Context) ([]types.Integration, error) {
-			results, _, err := p.cache.ListIntegrations(ctx, 0, "")
-			return results, err
-		},
+		list:      p.integrations.ListIntegrations,
+		cacheGet:  p.cache.GetIntegration,
+		cacheList: p.cache.ListIntegrations,
 		update: func(ctx context.Context, i types.Integration) error {
 			_, err := p.integrations.UpdateIntegration(ctx, i)
 			return err
diff --git a/lib/cache/kube.go b/lib/cache/kube.go
index eda9fe0bfd983..6effda9819655 100644
--- a/lib/cache/kube.go
+++ b/lib/cache/kube.go
@@ -18,13 +18,15 @@ package cache
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/proto"
 
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	kubewaitingcontainerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -39,6 +41,7 @@ func newKubernetesServerCollection(p services.Presence, w types.WatchKind) (*col
 
 	return &collection[types.KubeServer, kubeServerIndex]{
 		store: newStore(
+			types.KindKubeServer,
 			types.KubeServer.Copy,
 			map[kubeServerIndex]func(types.KubeServer) string{
 				kubeServerNameIndex: func(u types.KubeServer) string {
@@ -99,6 +102,7 @@ func newKubernetesClusterCollection(k services.Kubernetes, w types.WatchKind) (*
 
 	return &collection[types.KubeCluster, kubeClusterIndex]{
 		store: newStore(
+			types.KindKubernetesCluster,
 			types.KubeCluster.Copy,
 			map[kubeClusterIndex]func(types.KubeCluster) string{
 				kubeClusterNameIndex: types.KubeCluster.GetName,
@@ -143,6 +147,54 @@ func (c *Cache) GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster,
 	return out, nil
 }
 
+// ListKubernetesClusters returns a page of registered kubernetes clusters.
+func (c *Cache) ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListKubernetesClusters")
+	defer span.End()
+
+	lister := genericLister[types.KubeCluster, kubeClusterIndex]{
+		cache:        c,
+		collection:   c.collections.kubeClusters,
+		index:        kubeClusterNameIndex,
+		upstreamList: c.Config.Kubernetes.ListKubernetesClusters,
+		nextToken:    types.KubeCluster.GetName,
+	}
+	out, next, err := lister.list(ctx, limit, start)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return out, next, nil
+}
+
+// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+func (c *Cache) RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error] {
+	lister := genericLister[types.KubeCluster, kubeClusterIndex]{
+		cache:        c,
+		collection:   c.collections.kubeClusters,
+		index:        kubeClusterNameIndex,
+		upstreamList: c.Config.Kubernetes.ListKubernetesClusters,
+		nextToken:    types.KubeCluster.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: c.Config.Kubernetes.GetKubernetesClusters,
+	}
+
+	return func(yield func(types.KubeCluster, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeKubernetesClusters")
+		defer span.End()
+
+		for cluster, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(cluster, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
 // GetKubernetesCluster returns the specified kubernetes cluster resource.
 func (c *Cache) GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/GetKubernetesCluster")
@@ -178,38 +230,17 @@ func newKubernetesWaitingContainerCollection(upstream services.KubeWaitingContai
 
 	return &collection[*kubewaitingcontainerv1.KubernetesWaitingContainer, kubeWaitingContainerIndex]{
 		store: newStore(
+			types.KindKubeWaitingContainer,
 			proto.CloneOf[*kubewaitingcontainerv1.KubernetesWaitingContainer],
 			map[kubeWaitingContainerIndex]func(*kubewaitingcontainerv1.KubernetesWaitingContainer) string{
 				kubeWaitingContainerNameIndex: func(u *kubewaitingcontainerv1.KubernetesWaitingContainer) string {
-					return u.GetMetadata().GetName()
+					spec := u.GetSpec()
+					return kubernetesWaitingContainerCacheKey(spec)
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*kubewaitingcontainerv1.KubernetesWaitingContainer, error) {
-			var startKey string
-			var allConts []*kubewaitingcontainerv1.KubernetesWaitingContainer
-			for {
-				conts, nextKey, err := upstream.ListKubernetesWaitingContainers(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				allConts = append(allConts, conts...)
-
-				if nextKey == "" {
-					break
-				}
-				startKey = nextKey
-			}
-			return allConts, nil
-		},
-		headerTransform: func(hdr *types.ResourceHeader) *kubewaitingcontainerv1.KubernetesWaitingContainer {
-			return &kubewaitingcontainerv1.KubernetesWaitingContainer{
-				Kind:    hdr.Kind,
-				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
-					Name: hdr.Metadata.Name,
-				},
-			}
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListKubernetesWaitingContainers))
+			return out, trace.Wrap(err)
 		},
 		watch: w,
 	}, nil
@@ -229,7 +260,7 @@ func (c *Cache) ListKubernetesWaitingContainers(ctx context.Context, pageSize in
 		upstreamList: c.Config.KubeWaitingContainers.ListKubernetesWaitingContainers,
 		nextToken: func(t *kubewaitingcontainerv1.KubernetesWaitingContainer) string {
 			spec := t.GetSpec()
-			return spec.GetUsername() + "/" + spec.GetCluster() + "/" + spec.GetNamespace() + "/" + spec.GetPodName() + "/" + t.GetMetadata().GetName()
+			return kubernetesWaitingContainerCacheKey(spec)
 		},
 	}
 	out, next, err := lister.list(ctx, pageSize, pageToken)
@@ -253,7 +284,19 @@ func (c *Cache) GetKubernetesWaitingContainer(ctx context.Context, req *kubewait
 		},
 	}
 
-	name := req.GetUsername() + "/" + req.GetCluster() + "/" + req.GetNamespace() + "/" + req.GetPodName() + "/" + req.GetContainerName()
+	name := kubernetesWaitingContainerCacheKey(req)
 	out, err := getter.get(ctx, name)
 	return out, trace.Wrap(err)
 }
+
+type kubernetesWaitingContainerCacheKeyFieldGetter interface {
+	GetUsername() string
+	GetCluster() string
+	GetNamespace() string
+	GetPodName() string
+	GetContainerName() string
+}
+
+func kubernetesWaitingContainerCacheKey(c kubernetesWaitingContainerCacheKeyFieldGetter) string {
+	return c.GetUsername() + "/" + c.GetCluster() + "/" + c.GetNamespace() + "/" + c.GetPodName() + "/" + c.GetContainerName()
+}
diff --git a/lib/cache/kube_test.go b/lib/cache/kube_test.go
index 01288fb92f9f4..8ce802eb2d2ef 100644
--- a/lib/cache/kube_test.go
+++ b/lib/cache/kube_test.go
@@ -24,8 +24,9 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/api/client/proto"
+	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/kubewaitingcontainer"
 )
 
 // TestKubernetes tests that CRUD operations on kubernetes clusters resources are
@@ -36,18 +37,38 @@ func TestKubernetes(t *testing.T) {
 	p := newTestPack(t, ForProxy)
 	t.Cleanup(p.Close)
 
-	testResources(t, p, testFuncs[types.KubeCluster]{
-		newResource: func(name string) (types.KubeCluster, error) {
-			return types.NewKubernetesClusterV3(types.Metadata{
-				Name: name,
-			}, types.KubernetesClusterSpecV3{})
-		},
-		create:    p.kubernetes.CreateKubernetesCluster,
-		list:      p.kubernetes.GetKubernetesClusters,
-		cacheGet:  p.cache.GetKubernetesCluster,
-		cacheList: p.cache.GetKubernetesClusters,
-		update:    p.kubernetes.UpdateKubernetesCluster,
-		deleteAll: p.kubernetes.DeleteAllKubernetesClusters,
+	t.Run("GetKubernetesClusters", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.KubeCluster]{
+			newResource: func(name string) (types.KubeCluster, error) {
+				return types.NewKubernetesClusterV3(types.Metadata{
+					Name: name,
+				}, types.KubernetesClusterSpecV3{})
+			},
+			create:    p.kubernetes.CreateKubernetesCluster,
+			list:      getAllAdapter(p.kubernetes.GetKubernetesClusters),
+			cacheGet:  p.cache.GetKubernetesCluster,
+			cacheList: getAllAdapter(p.cache.GetKubernetesClusters),
+			update:    p.kubernetes.UpdateKubernetesCluster,
+			deleteAll: p.kubernetes.DeleteAllKubernetesClusters,
+		}, withSkipPaginationTest())
+	})
+
+	t.Run("ListKubernetesClusters", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.KubeCluster]{
+			newResource: func(name string) (types.KubeCluster, error) {
+				return types.NewKubernetesClusterV3(types.Metadata{
+					Name: name,
+				}, types.KubernetesClusterSpecV3{})
+			},
+			create:     p.kubernetes.CreateKubernetesCluster,
+			list:       p.kubernetes.ListKubernetesClusters,
+			cacheGet:   p.cache.GetKubernetesCluster,
+			cacheList:  p.cache.ListKubernetesClusters,
+			update:     p.kubernetes.UpdateKubernetesCluster,
+			deleteAll:  p.kubernetes.DeleteAllKubernetesClusters,
+			Range:      p.kubernetes.RangeKubernetesClusters,
+			cacheRange: p.cache.RangeKubernetesClusters,
+		})
 	})
 }
 
@@ -66,18 +87,14 @@ func TestKubernetesServers(t *testing.T) {
 				require.NoError(t, err)
 				return types.NewKubernetesServerV3FromCluster(app, "host", uuid.New().String())
 			},
-			create: withKeepalive(p.presenceS.UpsertKubernetesServer),
-			list: func(ctx context.Context) ([]types.KubeServer, error) {
-				return p.presenceS.GetKubernetesServers(ctx)
-			},
-			cacheList: func(ctx context.Context) ([]types.KubeServer, error) {
-				return p.cache.GetKubernetesServers(ctx)
-			},
-			update: withKeepalive(p.presenceS.UpsertKubernetesServer),
+			create:    withKeepalive(p.presenceS.UpsertKubernetesServer),
+			list:      getAllAdapter(p.presenceS.GetKubernetesServers),
+			cacheList: getAllAdapter(p.cache.GetKubernetesServers),
+			update:    withKeepalive(p.presenceS.UpsertKubernetesServer),
 			deleteAll: func(ctx context.Context) error {
 				return p.presenceS.DeleteAllKubernetesServers(ctx)
 			},
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListResources", func(t *testing.T) {
@@ -88,55 +105,27 @@ func TestKubernetesServers(t *testing.T) {
 				return types.NewKubernetesServerV3FromCluster(app, "host", uuid.New().String())
 			},
 			create: withKeepalive(p.presenceS.UpsertKubernetesServer),
-			list: func(ctx context.Context) ([]types.KubeServer, error) {
-				req := proto.ListResourcesRequest{
-					ResourceType: types.KindKubeServer,
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.KubeServer, string, error) {
+				resources, next, err := listResource(ctx, p.presenceS, types.KindKubeServer, pageSize, pageToken)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				var out []types.KubeServer
-				for {
-					resp, err := p.presenceS.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.KubeServer))
-					}
-
-					req.StartKey = resp.NextKey
-
-					if req.StartKey == "" {
-						break
-					}
+				out, err := types.ResourcesWithLabels(resources).AsKubeServers()
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				return out, nil
+				return out, next, nil
 			},
-			cacheList: func(ctx context.Context) ([]types.KubeServer, error) {
-				req := proto.ListResourcesRequest{
-					ResourceType: types.KindKubeServer,
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.KubeServer, string, error) {
+				resources, next, err := listResource(ctx, p.cache, types.KindKubeServer, pageSize, pageToken)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				var out []types.KubeServer
-				for {
-					resp, err := p.cache.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.KubeServer))
-					}
-
-					req.StartKey = resp.NextKey
-
-					if req.StartKey == "" {
-						break
-					}
+				out, err := types.ResourcesWithLabels(resources).AsKubeServers()
+				if err != nil {
+					return nil, "", trace.Wrap(err)
 				}
-
-				return out, nil
+				return out, next, nil
 			},
 			update: withKeepalive(p.presenceS.UpsertKubernetesServer),
 			deleteAll: func(ctx context.Context) error {
@@ -146,3 +135,60 @@ func TestKubernetesServers(t *testing.T) {
 	})
 
 }
+
+func TestKubernetesWaitingContainers(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForProxy)
+	t.Cleanup(p.Close)
+
+	testResources153(t, p, testFuncs[*kubewaitingcontainerpb.KubernetesWaitingContainer]{
+		newResource: func(name string) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
+			waitingCont, err := kubewaitingcontainer.NewKubeWaitingContainer(
+				name,
+				&kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+					Username:      "user",
+					Cluster:       "cluster",
+					Namespace:     "namespace",
+					PodName:       "pod",
+					ContainerName: name,
+					Patch:         []byte("{}"),
+					PatchType:     "application/json-patch+json",
+				})
+
+			return waitingCont, trace.Wrap(err)
+		},
+		create: func(ctx context.Context, kwc *kubewaitingcontainerpb.KubernetesWaitingContainer) error {
+			_, err := p.kubeWaitingContainers.CreateKubernetesWaitingContainer(ctx, kwc)
+			return trace.Wrap(err)
+		},
+		cacheGet: func(ctx context.Context, name string) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
+			return p.cache.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+				Username:      "user",
+				Cluster:       "cluster",
+				Namespace:     "namespace",
+				PodName:       "pod",
+				ContainerName: name,
+			})
+		},
+		list: func(ctx context.Context, i int, s string) ([]*kubewaitingcontainerpb.KubernetesWaitingContainer, string, error) {
+			return p.kubeWaitingContainers.ListKubernetesWaitingContainers(ctx, i, s)
+		},
+		cacheList: func(ctx context.Context, i int, s string) ([]*kubewaitingcontainerpb.KubernetesWaitingContainer, string, error) {
+			return p.cache.ListKubernetesWaitingContainers(ctx, i, s)
+		},
+		delete: func(ctx context.Context, s string) error {
+			return p.kubeWaitingContainers.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+				Username:      "user",
+				Cluster:       "cluster",
+				Namespace:     "namespace",
+				PodName:       "pod",
+				ContainerName: s,
+			})
+		},
+		deleteAll: func(ctx context.Context) error {
+			return p.kubeWaitingContainers.DeleteAllKubernetesWaitingContainers(ctx)
+		},
+	})
+
+}
diff --git a/lib/cache/lock.go b/lib/cache/lock.go
index ee069af768f79..7ac86752bb829 100644
--- a/lib/cache/lock.go
+++ b/lib/cache/lock.go
@@ -18,11 +18,13 @@ package cache
 
 import (
 	"context"
+	"iter"
 	"time"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -37,12 +39,24 @@ func newLockCollection(upstream services.Access, w types.WatchKind) (*collection
 
 	return &collection[types.Lock, lockIndex]{
 		store: newStore(
+			types.KindLock,
 			types.Lock.Clone,
 			map[lockIndex]func(types.Lock) string{
 				lockNameIndex: types.Lock.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Lock, error) {
-			locks, err := upstream.GetLocks(ctx, false)
+			locks, err := clientutils.CollectWithFallback(
+				ctx,
+				func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+					var noFilter *types.LockFilter
+					return upstream.ListLocks(ctx, limit, start, noFilter)
+				},
+				func(ctx context.Context) ([]types.Lock, error) {
+					const inForceOnlyFalse = false
+					return upstream.GetLocks(ctx, inForceOnlyFalse)
+				},
+			)
+
 			return locks, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Lock {
@@ -123,3 +137,92 @@ func (c *Cache) GetLocks(ctx context.Context, inForceOnly bool, targets ...types
 
 	return locks, nil
 }
+
+func matchLock(lock types.Lock, filter *types.LockFilter, now time.Time) bool {
+	if filter == nil {
+		return true
+	}
+
+	if filter.InForceOnly && !lock.IsInForce(now) {
+		return false
+	}
+
+	// If no targets specified, return all of the found/in-force locks.
+	if len(filter.Targets) == 0 {
+		return true
+	}
+
+	// Otherwise, use the targets as filters.
+	for _, target := range filter.Targets {
+		if target.Match(lock) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// RangeLocks returns locks within the range [start, end) matching a given filter.
+func (c *Cache) RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error] {
+	lister := genericLister[types.Lock, lockIndex]{
+		cache:      c,
+		collection: c.collections.locks,
+		index:      lockNameIndex,
+		upstreamList: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return c.Config.Access.ListLocks(ctx, limit, start, filter)
+		},
+		filter: func(l types.Lock) bool {
+			return matchLock(l, filter, c.Clock.Now())
+		},
+		nextToken: types.Lock.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: func(ctx context.Context) ([]types.Lock, error) {
+			if filter != nil {
+				targets := make([]types.LockTarget, 0, len(filter.Targets))
+				for _, tgt := range filter.Targets {
+					targets = append(targets, *tgt)
+				}
+				return c.Config.Access.GetLocks(ctx, filter.InForceOnly, targets...)
+			} else {
+				const inForceOnlyFalse = false
+				return c.Config.Access.GetLocks(ctx, inForceOnlyFalse)
+			}
+		},
+	}
+
+	return func(yield func(types.Lock, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeLocks")
+		defer span.End()
+
+		for db, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(db, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
+// ListLocks returns a page of locks matching a filter
+func (c *Cache) ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListLocks")
+	defer span.End()
+
+	lister := genericLister[types.Lock, lockIndex]{
+		cache:      c,
+		collection: c.collections.locks,
+		index:      lockNameIndex,
+		upstreamList: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return c.Config.Access.ListLocks(ctx, limit, start, filter)
+		},
+		nextToken: types.Lock.GetName,
+		filter: func(l types.Lock) bool {
+			return matchLock(l, filter, c.Clock.Now())
+		},
+	}
+	out, next, err := lister.list(ctx, limit, startKey)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/lock_test.go b/lib/cache/lock_test.go
index e262fc87bd4f4..82d749a926ae8 100644
--- a/lib/cache/lock_test.go
+++ b/lib/cache/lock_test.go
@@ -18,7 +18,12 @@ package cache
 
 import (
 	"context"
+	"iter"
 	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 )
@@ -31,28 +36,227 @@ func TestLocks(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources(t, p, testFuncs[types.Lock]{
-		newResource: func(name string) (types.Lock, error) {
-			return types.NewLock(
-				name,
-				types.LockSpecV2{
+	t.Run("GetLocks", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Lock]{
+			newResource: func(name string) (types.Lock, error) {
+				return types.NewLock(
+					name,
+					types.LockSpecV2{
+						Target: types.LockTarget{
+							Role: "target-role",
+						},
+					},
+				)
+			},
+			create:    p.accessS.UpsertLock,
+			list:      getAllAdapter(func(ctx context.Context) ([]types.Lock, error) { return p.accessS.GetLocks(ctx, false) }),
+			cacheList: getAllAdapter(func(ctx context.Context) ([]types.Lock, error) { return p.cache.GetLocks(ctx, false) }),
+			cacheGet:  p.cache.GetLock,
+			update:    p.accessS.UpsertLock,
+			deleteAll: p.accessS.DeleteAllLocks,
+		}, withSkipPaginationTest())
+	})
+
+	t.Run("ListLocks", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Lock]{
+			newResource: func(name string) (types.Lock, error) {
+				return types.NewLock(
+					name,
+					types.LockSpecV2{
+						Target: types.LockTarget{
+							Role: "target-role",
+						},
+					},
+				)
+			},
+			create: p.accessS.UpsertLock,
+			list: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return p.accessS.ListLocks(ctx, limit, start, nil)
+			},
+			cacheList: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return p.cache.ListLocks(ctx, limit, start, nil)
+			},
+			cacheGet:  p.cache.GetLock,
+			update:    p.accessS.UpsertLock,
+			deleteAll: p.accessS.DeleteAllLocks,
+			Range: func(ctx context.Context, start, end string) iter.Seq2[types.Lock, error] {
+				return p.accessS.RangeLocks(ctx, start, end, nil)
+			},
+			cacheRange: func(ctx context.Context, start, end string) iter.Seq2[types.Lock, error] {
+				return p.cache.RangeLocks(ctx, start, end, nil)
+			},
+		})
+	})
+
+	t.Run("ListLocksWithFilter", func(t *testing.T) {
+		filter := &types.LockFilter{
+			InForceOnly: false,
+			Targets:     []*types.LockTarget{{Role: "target-role"}},
+		}
+
+		testResources(t, p, testFuncs[types.Lock]{
+			newResource: func(name string) (types.Lock, error) {
+				return types.NewLock(
+					name,
+					types.LockSpecV2{
+						Target: types.LockTarget{
+							Role: "target-role",
+						},
+					},
+				)
+			},
+			create: p.accessS.UpsertLock,
+			list: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return p.accessS.ListLocks(ctx, limit, start, filter)
+			},
+			cacheList: func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+				return p.cache.ListLocks(ctx, limit, start, filter)
+			},
+			cacheGet:  p.cache.GetLock,
+			update:    p.accessS.UpsertLock,
+			deleteAll: p.accessS.DeleteAllLocks,
+			Range: func(ctx context.Context, start, end string) iter.Seq2[types.Lock, error] {
+				return p.accessS.RangeLocks(ctx, start, end, filter)
+			},
+			cacheRange: func(ctx context.Context, start, end string) iter.Seq2[types.Lock, error] {
+				return p.cache.RangeLocks(ctx, start, end, filter)
+			},
+		})
+	})
+}
+
+func Test_matchLock(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+	expiredTime := clock.Now().Add(-2 * time.Hour)
+	futureTime := clock.Now().Add(time.Hour)
+	nowTime := clock.Now()
+
+	tests := []struct {
+		name   string
+		lock   types.Lock
+		filter *types.LockFilter
+		want   bool
+	}{
+		{
+			name: "nil filter matches",
+			want: true,
+		},
+		{
+			name: "inactive lock is not matched when InForceOnly is set",
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &expiredTime,
+				},
+			},
+			filter: &types.LockFilter{
+				InForceOnly: true,
+			},
+			want: false,
+		},
+		{
+			name: "active lock is matched when InForceOnly is set",
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
+				},
+			},
+			filter: &types.LockFilter{
+				InForceOnly: true,
+			},
+			want: true,
+		},
+		{
+			name: "no targets is a match when InForceOnly is false regardless of lock",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+			},
+			want: true,
+		},
+		{
+			name: "targets given do not match",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
 					Target: types.LockTarget{
-						Role: "target-role",
+						User: "charlie",
 					},
 				},
-			)
+			},
+
+			want: false,
 		},
-		create: p.accessS.UpsertLock,
-		list: func(ctx context.Context) ([]types.Lock, error) {
-			results, err := p.accessS.GetLocks(ctx, false)
-			return results, err
+		{
+			name: "targets given match",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+					{
+						User: "charlie",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
+					Target: types.LockTarget{
+						User: "charlie",
+					},
+				},
+			},
+
+			want: true,
 		},
-		cacheGet: p.cache.GetLock,
-		cacheList: func(ctx context.Context) ([]types.Lock, error) {
-			results, err := p.cache.GetLocks(ctx, false)
-			return results, err
+		{
+			name: "targets given match but lock is expired with InForceOnly set",
+			filter: &types.LockFilter{
+				InForceOnly: true,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+					{
+						User: "charlie",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &expiredTime,
+					Target: types.LockTarget{
+						User: "charlie",
+					},
+				},
+			},
+
+			want: false,
 		},
-		update:    p.accessS.UpsertLock,
-		deleteAll: p.accessS.DeleteAllLocks,
-	})
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := matchLock(tt.lock, tt.filter, nowTime)
+			require.Equal(t, tt.want, got)
+		})
+	}
 }
diff --git a/lib/cache/network_restrictions.go b/lib/cache/network_restrictions.go
index e37cf1d54dc6b..a61c5ffdcdee1 100644
--- a/lib/cache/network_restrictions.go
+++ b/lib/cache/network_restrictions.go
@@ -36,6 +36,7 @@ func newNetworkingRestrictionCollection(upstream services.Restrictions, w types.
 
 	return &collection[types.NetworkRestrictions, networkingRestrictionIndex]{
 		store: newStore(
+			types.KindNetworkRestrictions,
 			types.NetworkRestrictions.Clone,
 			map[networkingRestrictionIndex]func(types.NetworkRestrictions) string{
 				networkingRestrictionNameIndex: types.NetworkRestrictions.GetName,
diff --git a/lib/cache/networking_restrictions_test.go b/lib/cache/networking_restrictions_test.go
index 7c2eab170f283..7589992f3b9a7 100644
--- a/lib/cache/networking_restrictions_test.go
+++ b/lib/cache/networking_restrictions_test.go
@@ -36,17 +36,17 @@ func TestNetworkRestrictions(t *testing.T) {
 			return types.NewNetworkRestrictions(), nil
 		},
 		create: p.restrictions.SetNetworkRestrictions,
-		list: func(ctx context.Context) ([]types.NetworkRestrictions, error) {
+		list: func(ctx context.Context, _ int, _ string) ([]types.NetworkRestrictions, string, error) {
 			restrictions, err := p.restrictions.GetNetworkRestrictions(ctx)
-			return []types.NetworkRestrictions{restrictions}, trace.Wrap(err)
+			return []types.NetworkRestrictions{restrictions}, "", trace.Wrap(err)
 		},
-		cacheList: func(ctx context.Context) ([]types.NetworkRestrictions, error) {
+		cacheList: func(ctx context.Context, _ int, _ string) ([]types.NetworkRestrictions, string, error) {
 			restrictions, err := p.cache.GetNetworkRestrictions(ctx)
 			if trace.IsNotFound(err) {
-				return nil, nil
+				return nil, "", nil
 			}
-			return []types.NetworkRestrictions{restrictions}, trace.Wrap(err)
+			return []types.NetworkRestrictions{restrictions}, "", trace.Wrap(err)
 		},
 		deleteAll: p.restrictions.DeleteNetworkRestrictions,
-	})
+	}, withSkipPaginationTest()) // skip pagination test because NetworkRestrictions is a singleton resource
 }
diff --git a/lib/cache/node.go b/lib/cache/node.go
index 197451df475c5..9b30819004eab 100644
--- a/lib/cache/node.go
+++ b/lib/cache/node.go
@@ -38,6 +38,7 @@ func newNodeCollection(p services.Presence, w types.WatchKind) (*collection[type
 
 	return &collection[types.Server, nodeIndex]{
 		store: newStore(
+			types.KindNode,
 			types.Server.DeepCopy,
 			map[nodeIndex]func(types.Server) string{
 				nodeNameIndex: types.Server.GetName,
diff --git a/lib/cache/node_test.go b/lib/cache/node_test.go
index 29e340da2f3bc..a3877c39ae9c5 100644
--- a/lib/cache/node_test.go
+++ b/lib/cache/node_test.go
@@ -28,7 +28,6 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 // TestNodes tests nodes cache
@@ -43,23 +42,21 @@ func TestNodes(t *testing.T) {
 
 		testResources(t, p, testFuncs[types.Server]{
 			newResource: func(name string) (types.Server, error) {
-				return suite.NewServer(types.KindNode, name, "127.0.0.1:2022", apidefaults.Namespace), nil
+				return NewServer(types.KindNode, name, "127.0.0.1:2022", apidefaults.Namespace), nil
 			},
 			create: withKeepalive(p.presenceS.UpsertNode),
-			list: func(ctx context.Context) ([]types.Server, error) {
+			list: getAllAdapter(func(ctx context.Context) ([]types.Server, error) {
 				return p.presenceS.GetNodes(ctx, apidefaults.Namespace)
-			},
+			}),
 			cacheGet: func(ctx context.Context, name string) (types.Server, error) {
 				return p.cache.GetNode(ctx, apidefaults.Namespace, name)
 			},
-			cacheList: func(ctx context.Context) ([]types.Server, error) {
-				return p.cache.GetNodes(ctx, apidefaults.Namespace)
-			},
-			update: withKeepalive(p.presenceS.UpsertNode),
+			cacheList: getAllAdapter(func(ctx context.Context) ([]types.Server, error) { return p.cache.GetNodes(ctx, apidefaults.Namespace) }),
+			update:    withKeepalive(p.presenceS.UpsertNode),
 			deleteAll: func(ctx context.Context) error {
 				return p.presenceS.DeleteAllNodes(ctx, apidefaults.Namespace)
 			},
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListResources", func(t *testing.T) {
@@ -70,61 +67,49 @@ func TestNodes(t *testing.T) {
 
 		testResources(t, p, testFuncs[types.Server]{
 			newResource: func(name string) (types.Server, error) {
-				return suite.NewServer(types.KindNode, name, "127.0.0.1:2022", apidefaults.Namespace), nil
+				return NewServer(types.KindNode, name, "127.0.0.1:2022", apidefaults.Namespace), nil
 			},
 			create: withKeepalive(p.presenceS.UpsertNode),
-			list: func(ctx context.Context) ([]types.Server, error) {
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindNode,
+					Limit:        int32(pageSize),
+					StartKey:     pageToken,
 				}
 
 				var out []types.Server
-				for {
-					resp, err := p.presenceS.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.Server))
-					}
-
-					req.StartKey = resp.NextKey
+				resp, err := p.presenceS.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					if req.StartKey == "" {
-						break
-					}
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.Server))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			cacheGet: func(ctx context.Context, name string) (types.Server, error) {
 				return p.cache.GetNode(ctx, apidefaults.Namespace, name)
 			},
-			cacheList: func(ctx context.Context) ([]types.Server, error) {
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindNode,
+					Limit:        int32(pageSize),
+					StartKey:     pageToken,
 				}
 
 				var out []types.Server
-				for {
-					resp, err := p.cache.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.Server))
-					}
-
-					req.StartKey = resp.NextKey
+				resp, err := p.cache.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					if req.StartKey == "" {
-						break
-					}
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.Server))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			update: withKeepalive(p.presenceS.UpsertNode),
 			deleteAll: func(ctx context.Context) error {
@@ -139,7 +124,7 @@ func BenchmarkGetMaxNodes(b *testing.B) {
 }
 
 func benchGetNodes(b *testing.B, nodeCount int) {
-	p, err := newPack(b.TempDir(), ForAuth, memoryBackend(true))
+	p, err := newPack(b, ForAuth)
 	require.NoError(b, err)
 	defer p.Close()
 
@@ -150,7 +135,7 @@ func benchGetNodes(b *testing.B, nodeCount int) {
 
 	go func() {
 		for i := 0; i < nodeCount; i++ {
-			server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
+			server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", apidefaults.Namespace)
 			_, err := p.presenceS.UpsertNode(ctx, server)
 			if err != nil {
 				createErr <- err
diff --git a/lib/cache/notification.go b/lib/cache/notification.go
index 310dbf9c34f5b..49b0cf1fe8c49 100644
--- a/lib/cache/notification.go
+++ b/lib/cache/notification.go
@@ -24,6 +24,8 @@ import (
 
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -38,6 +40,7 @@ func newUserNotificationCollection(upstream services.NotificationGetter, w types
 
 	return &collection[*notificationsv1.Notification, userNotificationIndex]{
 		store: newStore(
+			types.KindNotification,
 			proto.CloneOf[*notificationsv1.Notification],
 			map[userNotificationIndex]func(*notificationsv1.Notification) string{
 				userNotificationNameIndex: func(r *notificationsv1.Notification) string {
@@ -45,22 +48,8 @@ func newUserNotificationCollection(upstream services.NotificationGetter, w types
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*notificationsv1.Notification, error) {
-			var notifications []*notificationsv1.Notification
-			var startKey string
-			for {
-				notifs, nextKey, err := upstream.ListUserNotifications(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				notifications = append(notifications, notifs...)
-
-				if nextKey == "" {
-					break
-				}
-				startKey = nextKey
-			}
-
-			return notifications, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListUserNotifications))
+			return out, trace.Wrap(err)
 		},
 		watch: w,
 	}, nil
@@ -95,6 +84,7 @@ func newGlobalNotificationCollection(upstream services.NotificationGetter, w typ
 
 	return &collection[*notificationsv1.GlobalNotification, globalNotificationIndex]{
 		store: newStore(
+			types.KindGlobalNotification,
 			proto.CloneOf[*notificationsv1.GlobalNotification],
 			map[globalNotificationIndex]func(*notificationsv1.GlobalNotification) string{
 				globalNotificationNameIndex: func(r *notificationsv1.GlobalNotification) string {
@@ -102,22 +92,8 @@ func newGlobalNotificationCollection(upstream services.NotificationGetter, w typ
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*notificationsv1.GlobalNotification, error) {
-			var notifications []*notificationsv1.GlobalNotification
-			var startKey string
-			for {
-				notifs, nextKey, err := upstream.ListGlobalNotifications(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				notifications = append(notifications, notifs...)
-
-				if nextKey == "" {
-					break
-				}
-				startKey = nextKey
-			}
-
-			return notifications, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListGlobalNotifications))
+			return out, trace.Wrap(err)
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/notification_test.go b/lib/cache/notification_test.go
index 7107b3f6e989b..5bb0c55f97545 100644
--- a/lib/cache/notification_test.go
+++ b/lib/cache/notification_test.go
@@ -33,7 +33,7 @@ func TestUserNotifications(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*notificationsv1.Notification]{
+	testResources153(t, p, testFuncs[*notificationsv1.Notification]{
 		newResource: func(name string) (*notificationsv1.Notification, error) {
 			return newUserNotification(t, name), nil
 		},
@@ -41,16 +41,10 @@ func TestUserNotifications(t *testing.T) {
 			_, err := p.notifications.CreateUserNotification(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*notificationsv1.Notification, error) {
-			items, _, err := p.notifications.ListUserNotifications(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*notificationsv1.Notification, error) {
-			items, _, err := p.cache.ListUserNotifications(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list:      p.notifications.ListUserNotifications,
+		cacheList: p.cache.ListUserNotifications,
 		deleteAll: p.notifications.DeleteAllUserNotifications,
-	})
+	}, withSkipPaginationTest())
 }
 
 // TestGlobalNotifications tests that CRUD operations on global notification resources are
@@ -61,7 +55,7 @@ func TestGlobalNotifications(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*notificationsv1.GlobalNotification]{
+	testResources153(t, p, testFuncs[*notificationsv1.GlobalNotification]{
 		newResource: func(name string) (*notificationsv1.GlobalNotification, error) {
 			return newGlobalNotification(t, name), nil
 		},
@@ -69,14 +63,8 @@ func TestGlobalNotifications(t *testing.T) {
 			_, err := p.notifications.CreateGlobalNotification(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*notificationsv1.GlobalNotification, error) {
-			items, _, err := p.notifications.ListGlobalNotifications(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*notificationsv1.GlobalNotification, error) {
-			items, _, err := p.cache.ListGlobalNotifications(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list:      p.notifications.ListGlobalNotifications,
+		cacheList: p.cache.ListGlobalNotifications,
 		deleteAll: p.notifications.DeleteAllGlobalNotifications,
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/okta.go b/lib/cache/okta.go
index 259d9746ff95c..1b84971d9db91 100644
--- a/lib/cache/okta.go
+++ b/lib/cache/okta.go
@@ -22,6 +22,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -36,29 +38,14 @@ func newOktaImportRuleCollection(upstream services.Okta, w types.WatchKind) (*co
 
 	return &collection[types.OktaImportRule, oktaImportRuleIndex]{
 		store: newStore(
+			types.KindOktaImportRule,
 			types.OktaImportRule.Clone,
 			map[oktaImportRuleIndex]func(types.OktaImportRule) string{
 				oktaImportRuleNameIndex: types.OktaImportRule.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.OktaImportRule, error) {
-			var startKey string
-			var resources []types.OktaImportRule
-			for {
-				var importRules []types.OktaImportRule
-				var err error
-				importRules, startKey, err = upstream.ListOktaImportRules(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, importRules...)
-
-				if startKey == "" {
-					break
-				}
-			}
-
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListOktaImportRules))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.OktaImportRule {
 			return &types.OktaImportRuleV1{
@@ -119,29 +106,14 @@ func newOktaImportAssignmentCollection(upstream services.Okta, w types.WatchKind
 
 	return &collection[types.OktaAssignment, oktaAssignmentIndex]{
 		store: newStore(
+			types.KindOktaAssignment,
 			types.OktaAssignment.Copy,
 			map[oktaAssignmentIndex]func(types.OktaAssignment) string{
 				oktaAssignmentNameIndex: types.OktaAssignment.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.OktaAssignment, error) {
-			var startKey string
-			var resources []types.OktaAssignment
-			for {
-				var importRules []types.OktaAssignment
-				var err error
-				importRules, startKey, err = upstream.ListOktaAssignments(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, importRules...)
-
-				if startKey == "" {
-					break
-				}
-			}
-
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListOktaAssignments))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.OktaAssignment {
 			return &types.OktaAssignmentV1{
diff --git a/lib/cache/okta_test.go b/lib/cache/okta_test.go
index 5fe891fc1bf11..5978c94936d9f 100644
--- a/lib/cache/okta_test.go
+++ b/lib/cache/okta_test.go
@@ -69,15 +69,9 @@ func TestOktaImportRules(t *testing.T) {
 			_, err := p.okta.CreateOktaImportRule(ctx, resource)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]types.OktaImportRule, error) {
-			results, _, err := p.okta.ListOktaImportRules(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetOktaImportRule,
-		cacheList: func(ctx context.Context) ([]types.OktaImportRule, error) {
-			results, _, err := p.cache.ListOktaImportRules(ctx, 0, "")
-			return results, err
-		},
+		list:      p.okta.ListOktaImportRules,
+		cacheGet:  p.cache.GetOktaImportRule,
+		cacheList: p.cache.ListOktaImportRules,
 		update: func(ctx context.Context, resource types.OktaImportRule) error {
 			_, err := p.okta.UpdateOktaImportRule(ctx, resource)
 			return trace.Wrap(err)
@@ -119,15 +113,9 @@ func TestOktaAssignments(t *testing.T) {
 			_, err := p.okta.CreateOktaAssignment(ctx, resource)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]types.OktaAssignment, error) {
-			results, _, err := p.okta.ListOktaAssignments(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetOktaAssignment,
-		cacheList: func(ctx context.Context) ([]types.OktaAssignment, error) {
-			results, _, err := p.cache.ListOktaAssignments(ctx, 0, "")
-			return results, err
-		},
+		list:      p.okta.ListOktaAssignments,
+		cacheGet:  p.cache.GetOktaAssignment,
+		cacheList: p.cache.ListOktaAssignments,
 		update: func(ctx context.Context, resource types.OktaAssignment) error {
 			_, err := p.okta.UpdateOktaAssignment(ctx, resource)
 			return trace.Wrap(err)
diff --git a/lib/cache/plugin_static_credentials.go b/lib/cache/plugin_static_credentials.go
index 3ce8d34c960eb..b979ade3f6bc1 100644
--- a/lib/cache/plugin_static_credentials.go
+++ b/lib/cache/plugin_static_credentials.go
@@ -36,6 +36,7 @@ func newPluginStaticCredentialsCollection(upstream services.PluginStaticCredenti
 
 	return &collection[types.PluginStaticCredentials, pluginStaticCredentialsIndex]{
 		store: newStore(
+			types.KindPluginStaticCredentials,
 			types.PluginStaticCredentials.Clone,
 			map[pluginStaticCredentialsIndex]func(types.PluginStaticCredentials) string{
 				pluginStaticCredentialsNameIndex: types.PluginStaticCredentials.GetName,
diff --git a/lib/cache/plugin_static_credentials_test.go b/lib/cache/plugin_static_credentials_test.go
index 4291fc1d4c334..16979b7187609 100644
--- a/lib/cache/plugin_static_credentials_test.go
+++ b/lib/cache/plugin_static_credentials_test.go
@@ -19,7 +19,6 @@ package cache
 import (
 	"context"
 	"testing"
-	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
@@ -30,7 +29,7 @@ import (
 func TestPluginStaticCredentials(t *testing.T) {
 	t.Parallel()
 
-	p, err := newPack(t.TempDir(), ForAuth)
+	p, err := newPack(t, ForAuth)
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
@@ -55,6 +54,10 @@ func TestPluginStaticCredentials(t *testing.T) {
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
+				if len(creds) == 0 {
+					// testResources expects the getter to return a NotFound error for unknown names.
+					return nil, trace.NotFound("no plugin static credentials found")
+				}
 				if len(creds) != 1 {
 					return nil, trace.CompareFailed("expecting one creds for this test but got %v", len(creds))
 				}
@@ -83,28 +86,21 @@ func TestPluginStaticCredentials(t *testing.T) {
 						})
 				},
 				create: p.pluginStaticCredentials.CreatePluginStaticCredentials,
-				list:   p.pluginStaticCredentials.GetAllPluginStaticCredentials,
+				list:   getAllAdapter(p.pluginStaticCredentials.GetAllPluginStaticCredentials),
 				update: func(ctx context.Context, cred types.PluginStaticCredentials) error {
 					_, err := p.pluginStaticCredentials.UpdatePluginStaticCredentials(ctx, cred)
 					return err
 				},
 				deleteAll: p.pluginStaticCredentials.DeleteAllPluginStaticCredentials,
-				cacheList: func(ctx context.Context) ([]types.PluginStaticCredentials, error) {
+				cacheList: func(ctx context.Context, _ int, _ string) ([]types.PluginStaticCredentials, string, error) {
 					var out []types.PluginStaticCredentials
 					for cred := range p.cache.collections.pluginStaticCredentials.store.resources(pluginStaticCredentialsNameIndex, "", "") {
 						out = append(out, cred.Clone())
 					}
-					return out, nil
+					return out, "", nil
 				},
 				cacheGet: cacheGet.fn,
-				changeResource: func(cred types.PluginStaticCredentials) {
-					// types.PluginStaticCredentials does not support Expires. Let's
-					// use labels.
-					labels := cred.GetStaticLabels()
-					labels["now"] = time.Now().String()
-					cred.SetStaticLabels(labels)
-				},
-			})
+			}, withSkipPaginationTest())
 		})
 	}
 }
diff --git a/lib/cache/plugins.go b/lib/cache/plugins.go
new file mode 100644
index 0000000000000..4a1bc2b99f5c0
--- /dev/null
+++ b/lib/cache/plugins.go
@@ -0,0 +1,175 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+type pluginIndex string
+
+const pluginNameIndex pluginIndex = "name"
+
+func newPluginsCollection(service services.Plugins, watch types.WatchKind) (*collection[types.Plugin, pluginIndex], error) {
+	if service == nil {
+		return nil, trace.BadParameter("missing parameter Plugin Service")
+	}
+
+	return &collection[types.Plugin, pluginIndex]{
+		store: newStore(
+			types.KindPlugin,
+			types.Plugin.Clone,
+			map[pluginIndex]func(types.Plugin) string{
+				pluginNameIndex: types.Plugin.GetName,
+			},
+		),
+		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Plugin, error) {
+			fn := func(ctx context.Context, pageSize int, token string) ([]types.Plugin, string, error) {
+				return service.ListPlugins(ctx, pageSize, token, loadSecrets)
+			}
+			out, err := stream.Collect(clientutils.Resources(ctx, fn))
+			return out, trace.Wrap(err)
+		},
+		headerTransform: func(hdr *types.ResourceHeader) types.Plugin {
+			return &types.PluginV1{
+				Kind:    hdr.Kind,
+				Version: hdr.Version,
+				Metadata: types.Metadata{
+					Name: hdr.Metadata.Name,
+				},
+			}
+		},
+		watch: watch,
+	}, nil
+}
+
+// GetPlugin retrieves a plugin by name from the cache.
+// If the cache is not healthy, it falls back to fetching the plugin from the upstream.
+// The `withSecrets` flag controls whether secrets should be included in the result.
+func (c *Cache) GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error) {
+	_, span := c.Tracer.Start(ctx, "cache/GetPlugin")
+	defer span.End()
+
+	rg, err := acquireReadGuard(c, c.collections.plugins)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer rg.Release()
+
+	if !rg.ReadCache() {
+		// Secrets will be included or excluded based on the withSecrets flag.
+		item, err := c.Config.Plugin.GetPlugin(ctx, name, withSecrets)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return item, nil
+	}
+
+	// Depending on the watcher configuration, the cached plugin may or may not contain secrets.
+	// The returned plugin will be stripped of secrets if requested.
+	plugin, err := rg.store.get(pluginNameIndex, name)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return stripAndClonePluginSecrets(plugin, withSecrets), nil
+}
+
+// GetPlugins returns a full list of plugins from the cache.
+// If the cache is not healthy, it falls back to fetching the plugin from the upstream.
+// The `withSecrets` flag controls whether secrets are included in the response.
+func (c *Cache) GetPlugins(ctx context.Context, withSecrets bool) ([]types.Plugin, error) {
+	_, span := c.Tracer.Start(ctx, "cache/GetPlugins")
+	defer span.End()
+
+	rg, err := acquireReadGuard(c, c.collections.plugins)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer rg.Release()
+
+	if !rg.ReadCache() {
+		// Cache is currently not available; fetch all plugins from the upstream.
+		// The backend will honor the withSecrets flag.
+		plugins, err := c.Config.Plugin.GetPlugins(ctx, withSecrets)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return plugins, nil
+	}
+
+	// Strip secrets if requested.
+	plugins := make([]types.Plugin, 0, rg.store.len())
+	for item := range rg.store.resources(pluginNameIndex, "", "") {
+		plugins = append(plugins, stripAndClonePluginSecrets(item, withSecrets))
+	}
+	return plugins, nil
+}
+
+// ListPlugins returns a paginated list of plugins from the cache or backend.
+// If the cache is not healthy, it fetches directly from the backend.
+// The `withSecrets` flag controls inclusion of secrets in the result.
+func (c *Cache) ListPlugins(ctx context.Context, limit int, startKey string, withSecrets bool) ([]types.Plugin, string, error) {
+	_, span := c.Tracer.Start(ctx, "cache/ListPlugins")
+	defer span.End()
+
+	rg, err := acquireReadGuard(c, c.collections.plugins)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	defer rg.Release()
+
+	if !rg.ReadCache() {
+		// The backend honors withSecrets when populating the results.
+		items, nextKey, err := c.Config.Plugin.ListPlugins(ctx, limit, startKey, withSecrets)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		return items, nextKey, nil
+	}
+
+	// Limit the number of items returned to the page size.
+	if limit <= 0 || limit > apidefaults.DefaultChunkSize {
+		limit = apidefaults.DefaultChunkSize
+	}
+
+	var plugins []types.Plugin
+	var nextKey string
+	for item := range rg.store.resources(pluginNameIndex, startKey, "") {
+		if len(plugins) == limit {
+			return plugins, item.GetName(), nil
+		}
+		plugins = append(plugins, stripAndClonePluginSecrets(item, withSecrets))
+	}
+	return plugins, nextKey, nil
+}
+
+// stripPluginSecrets returns a cloned plugin, optionally removing secrets.
+// This allows conditional filtering based on the `withSecrets` flag.
+func stripAndClonePluginSecrets(in types.Plugin, withSecrets bool) types.Plugin {
+	if withSecrets {
+		return in.Clone()
+	}
+	return in.CloneWithoutSecrets()
+}
diff --git a/lib/cache/plugins_test.go b/lib/cache/plugins_test.go
new file mode 100644
index 0000000000000..272f123e9386f
--- /dev/null
+++ b/lib/cache/plugins_test.go
@@ -0,0 +1,144 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func newPlugin(name string) types.Plugin {
+	return &types.PluginV1{
+		Metadata: types.Metadata{Name: name},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_Scim{
+				Scim: &types.PluginSCIMSettings{
+					SamlConnectorName: "example-saml-connector",
+				},
+			},
+		},
+	}
+}
+
+func newPluginWithCreds(name string) types.Plugin {
+	item := newPlugin(name)
+	creds := types.PluginCredentialsV1{
+		Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
+			StaticCredentialsRef: &types.PluginStaticCredentialsRef{
+				Labels: map[string]string{
+					"env": "prod",
+				},
+			},
+		},
+	}
+	item.SetCredentials(&creds)
+	return item
+}
+
+// TestPlugin tests caching of plugins
+func TestPlugin(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	t.Run("GetPlugins", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Plugin]{
+			newResource: func(name string) (types.Plugin, error) {
+				return newPlugin(name), nil
+			},
+			create: func(ctx context.Context, item types.Plugin) error {
+				err := p.plugin.CreatePlugin(ctx, item)
+				return err
+			},
+			cacheGet: func(ctx context.Context, name string) (types.Plugin, error) {
+				return p.cache.GetPlugin(ctx, name, false)
+			},
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.Plugin, string, error) {
+				return p.plugin.ListPlugins(ctx, pageSize, pageToken, false)
+			},
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.Plugin, string, error) {
+				return p.cache.ListPlugins(ctx, pageSize, pageToken, false)
+			},
+			update: func(ctx context.Context, item types.Plugin) error {
+				_, err := p.plugin.UpdatePlugin(ctx, item)
+				return err
+			},
+			deleteAll: func(ctx context.Context) error {
+				return p.plugin.DeleteAllPlugins(ctx)
+			},
+		})
+	})
+
+	t.Run("ListPlugins", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Plugin]{
+			newResource: func(name string) (types.Plugin, error) {
+				return newPlugin(name), nil
+			},
+			create: func(ctx context.Context, item types.Plugin) error {
+				return trace.Wrap(p.plugin.CreatePlugin(ctx, item))
+			},
+			list: func(ctx context.Context, pageSize int, token string) ([]types.Plugin, string, error) {
+				return p.plugin.ListPlugins(ctx, pageSize, token, false)
+			},
+			cacheGet: func(ctx context.Context, name string) (types.Plugin, error) {
+				return p.cache.GetPlugin(ctx, name, false)
+			},
+			cacheList: func(ctx context.Context, pageSize int, token string) ([]types.Plugin, string, error) {
+				return p.cache.ListPlugins(ctx, pageSize, token, false)
+			},
+			update: func(ctx context.Context, item types.Plugin) error {
+				_, err := p.plugin.UpdatePlugin(ctx, item)
+				return err
+			},
+			deleteAll: func(ctx context.Context) error {
+				return p.plugin.DeleteAllPlugins(ctx)
+			},
+		})
+	})
+	t.Run("GetPluginsWithSecrets", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.Plugin]{
+			newResource: func(name string) (types.Plugin, error) {
+				return newPluginWithCreds(name), nil
+			},
+			create: func(ctx context.Context, item types.Plugin) error {
+				err := p.plugin.CreatePlugin(ctx, item)
+				return err
+			},
+			cacheGet: func(ctx context.Context, name string) (types.Plugin, error) {
+				return p.cache.GetPlugin(ctx, name, true)
+			},
+			list: func(ctx context.Context, pageSize int, token string) ([]types.Plugin, string, error) {
+				return p.plugin.ListPlugins(ctx, pageSize, token, true)
+			},
+			cacheList: func(ctx context.Context, pageSize int, token string) ([]types.Plugin, string, error) {
+				return p.cache.ListPlugins(ctx, pageSize, token, true)
+			},
+			update: func(ctx context.Context, item types.Plugin) error {
+				_, err := p.plugin.UpdatePlugin(ctx, item)
+				return err
+			},
+			deleteAll: func(ctx context.Context) error {
+				return p.plugin.DeleteAllPlugins(ctx)
+			},
+		})
+	})
+}
diff --git a/lib/cache/provisioning.go b/lib/cache/provisioning.go
index 6b53e38ce490f..6448c63bfe641 100644
--- a/lib/cache/provisioning.go
+++ b/lib/cache/provisioning.go
@@ -25,8 +25,9 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 type principalStateIndex string
@@ -40,6 +41,7 @@ func newPrincipalStateCollection(upstream services.ProvisioningStates, w types.W
 
 	return &collection[*provisioningv1.PrincipalState, principalStateIndex]{
 		store: newStore(
+			types.KindProvisioningPrincipalState,
 			proto.CloneOf[*provisioningv1.PrincipalState],
 			map[principalStateIndex]func(*provisioningv1.PrincipalState) string{
 				principalStateNameIndex: func(r *provisioningv1.PrincipalState) string {
@@ -47,26 +49,8 @@ func newPrincipalStateCollection(upstream services.ProvisioningStates, w types.W
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*provisioningv1.PrincipalState, error) {
-			var page pagination.PageRequestToken
-			var resources []*provisioningv1.PrincipalState
-			for {
-				var resourcesPage []*provisioningv1.PrincipalState
-				var err error
-
-				resourcesPage, nextPage, err := upstream.ListProvisioningStatesForAllDownstreams(ctx, 0, &page)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				resources = append(resources, resourcesPage...)
-
-				if nextPage == "" {
-					break
-				}
-				page.Update(nextPage)
-			}
-
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListProvisioningStatesForAllDownstreams))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *provisioningv1.PrincipalState {
 			return &provisioningv1.PrincipalState{
@@ -98,28 +82,28 @@ func (c *Cache) GetProvisioningState(ctx context.Context, downstream services.Do
 	return out, trace.Wrap(err)
 }
 
-func (c *Cache) ListProvisioningStatesForAllDownstreams(ctx context.Context, pageSize int, req *pagination.PageRequestToken) ([]*provisioningv1.PrincipalState, pagination.NextPageToken, error) {
+func (c *Cache) ListProvisioningStatesForAllDownstreams(ctx context.Context, pageSize int, pageToken string) ([]*provisioningv1.PrincipalState, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListProvisioningStatesForAllDownstreams")
 	defer span.End()
 
+	out, next, err := c.ListProvisioningStatesForAllDownstreams2(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
+
+func (c *Cache) ListProvisioningStatesForAllDownstreams2(ctx context.Context, pageSize int, pageToken string) ([]*provisioningv1.PrincipalState, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListProvisioningStatesForAllDownstreams2")
+	defer span.End()
+
 	lister := genericLister[*provisioningv1.PrincipalState, principalStateIndex]{
-		cache:      c,
-		collection: c.collections.provisioningStates,
-		index:      principalStateNameIndex,
-		upstreamList: func(ctx context.Context, pageSize int, s string) ([]*provisioningv1.PrincipalState, string, error) {
-			out, next, err := c.Config.ProvisioningStates.ListProvisioningStatesForAllDownstreams(ctx, pageSize, req)
-			return out, string(next), trace.Wrap(err)
-		},
+		cache:        c,
+		collection:   c.collections.provisioningStates,
+		index:        principalStateNameIndex,
+		upstreamList: c.Config.ProvisioningStates.ListProvisioningStatesForAllDownstreams2,
 		nextToken: func(t *provisioningv1.PrincipalState) string {
 			return t.GetMetadata().GetName()
 		},
 	}
 
-	nextToken, err := req.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-
-	out, next, err := lister.list(ctx, pageSize, nextToken)
-	return out, pagination.NextPageToken(next), trace.Wrap(err)
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
 }
diff --git a/lib/cache/provisioning_test.go b/lib/cache/provisioning_test.go
index 365140069bb44..70854abe04791 100644
--- a/lib/cache/provisioning_test.go
+++ b/lib/cache/provisioning_test.go
@@ -26,7 +26,6 @@ import (
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 const testDownstreamID = services.DownstreamID("weyland-yutani")
@@ -57,7 +56,7 @@ func TestProvisioningPrincipalState(t *testing.T) {
 	fixturePack := newTestPack(t, ForAuth)
 	t.Cleanup(fixturePack.Close)
 
-	testResources153(t, fixturePack, testFuncs153[*provisioningv1.PrincipalState]{
+	testResources153(t, fixturePack, testFuncs[*provisioningv1.PrincipalState]{
 		newResource: func(s string) (*provisioningv1.PrincipalState, error) {
 			return newProvisioningPrincipalState(s), nil
 		},
@@ -69,24 +68,7 @@ func TestProvisioningPrincipalState(t *testing.T) {
 			_, err := fixturePack.provisioningStates.UpdateProvisioningState(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*provisioningv1.PrincipalState, error) {
-			var result []*provisioningv1.PrincipalState
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.provisioningStates.ListProvisioningStatesForAllDownstreams(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				if nextPage == pagination.EndOfList {
-					break
-				}
-
-				pageToken.Update(nextPage)
-			}
-			return result, nil
-		},
+		list: fixturePack.provisioningStates.ListProvisioningStatesForAllDownstreams2,
 		delete: func(ctx context.Context, id string) error {
 			return trace.Wrap(fixturePack.provisioningStates.DeleteProvisioningState(
 				ctx, testDownstreamID, services.ProvisioningStateID(id)))
@@ -94,24 +76,7 @@ func TestProvisioningPrincipalState(t *testing.T) {
 		deleteAll: func(ctx context.Context) error {
 			return trace.Wrap(fixturePack.provisioningStates.DeleteAllProvisioningStates(ctx))
 		},
-		cacheList: func(ctx context.Context) ([]*provisioningv1.PrincipalState, error) {
-			var result []*provisioningv1.PrincipalState
-			var pageToken pagination.PageRequestToken
-			for {
-				page, nextPage, err := fixturePack.cache.ListProvisioningStatesForAllDownstreams(ctx, 0, &pageToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				result = append(result, page...)
-
-				if nextPage == pagination.EndOfList {
-					break
-				}
-
-				pageToken.Update(nextPage)
-			}
-			return result, nil
-		},
+		cacheList: fixturePack.cache.ListProvisioningStatesForAllDownstreams2,
 		cacheGet: func(ctx context.Context, id string) (*provisioningv1.PrincipalState, error) {
 			r, err := fixturePack.provisioningStates.GetProvisioningState(
 				ctx, testDownstreamID, services.ProvisioningStateID(id))
diff --git a/lib/cache/proxy_server.go b/lib/cache/proxy_server.go
index ae8a0a766ac52..068772e655ab1 100644
--- a/lib/cache/proxy_server.go
+++ b/lib/cache/proxy_server.go
@@ -22,6 +22,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -36,13 +37,17 @@ func newProxyServerCollection(p services.Presence, w types.WatchKind) (*collecti
 
 	return &collection[types.Server, proxyServerIndex]{
 		store: newStore(
+			types.KindProxy,
 			types.Server.DeepCopy,
 			map[proxyServerIndex]func(types.Server) string{
 				proxyServerNameIndex: types.Server.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.Server, error) {
-			servers, err := p.GetProxies()
-			return servers, trace.Wrap(err)
+			out, err := clientutils.CollectWithFallback(ctx, p.ListProxyServers, func(context.Context) ([]types.Server, error) {
+				//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+				return p.GetProxies()
+			})
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.Server {
 			return &types.ServerV2{
@@ -58,6 +63,10 @@ func newProxyServerCollection(p services.Presence, w types.WatchKind) (*collecti
 }
 
 // GetProxies is a part of auth.Cache implementation
+//
+// Deprecated: Prefer paginated gRPC variant [ListProxyServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
 func (c *Cache) GetProxies() ([]types.Server, error) {
 	_, span := c.Tracer.Start(context.TODO(), "cache/GetProxies")
 	defer span.End()
@@ -69,6 +78,7 @@ func (c *Cache) GetProxies() ([]types.Server, error) {
 	defer rg.Release()
 
 	if !rg.ReadCache() {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 		servers, err := c.Config.Presence.GetAuthServers()
 		return servers, trace.Wrap(err)
 	}
@@ -80,3 +90,19 @@ func (c *Cache) GetProxies() ([]types.Server, error) {
 
 	return servers, nil
 }
+
+// ListProxyServers returns a paginated list of registered proxy servers.
+func (c *Cache) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListProxyServers")
+	defer span.End()
+
+	lister := genericLister[types.Server, proxyServerIndex]{
+		cache:        c,
+		collection:   c.collections.proxyServers,
+		index:        proxyServerNameIndex,
+		upstreamList: c.Config.Presence.ListProxyServers,
+		nextToken:    types.Server.GetName,
+	}
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/proxy_server_test.go b/lib/cache/proxy_server_test.go
index 7fc4526e87fb2..13b8598b5d637 100644
--- a/lib/cache/proxy_server_test.go
+++ b/lib/cache/proxy_server_test.go
@@ -43,14 +43,10 @@ func TestProxies(t *testing.T) {
 				},
 			}, nil
 		},
-		create: p.presenceS.UpsertProxy,
-		list: func(_ context.Context) ([]types.Server, error) {
-			return p.presenceS.GetProxies()
-		},
-		cacheList: func(_ context.Context) ([]types.Server, error) {
-			return p.cache.GetProxies()
-		},
-		update: p.presenceS.UpsertProxy,
+		create:    p.presenceS.UpsertProxy,
+		list:      p.presenceS.ListProxyServers,
+		cacheList: p.cache.ListProxyServers,
+		update:    p.presenceS.UpsertProxy,
 		deleteAll: func(_ context.Context) error {
 			return p.presenceS.DeleteAllProxies()
 		},
diff --git a/lib/cache/recording_encryption.go b/lib/cache/recording_encryption.go
new file mode 100644
index 0000000000000..4bff49fd1c673
--- /dev/null
+++ b/lib/cache/recording_encryption.go
@@ -0,0 +1,84 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+type recordingEncryptionIndex string
+
+const recordingEncryptionNameIndex recordingEncryptionIndex = "name"
+
+func newRecordingEncryptionCollection(upstream services.RecordingEncryption, w types.WatchKind) (*collection[*recordingencryptionv1.RecordingEncryption, recordingEncryptionIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter RecordingEncryption")
+	}
+
+	return &collection[*recordingencryptionv1.RecordingEncryption, recordingEncryptionIndex]{
+		store: newStore(types.KindRecordingEncryption, proto.CloneOf[*recordingencryptionv1.RecordingEncryption], map[recordingEncryptionIndex]func(*recordingencryptionv1.RecordingEncryption) string{
+			recordingEncryptionNameIndex: func(r *recordingencryptionv1.RecordingEncryption) string {
+				return r.GetMetadata().GetName()
+			},
+		}),
+		fetcher: func(ctx context.Context, loadSecrets bool) ([]*recordingencryptionv1.RecordingEncryption, error) {
+			recordingEncryption, err := upstream.GetRecordingEncryption(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return []*recordingencryptionv1.RecordingEncryption{recordingEncryption}, nil
+		},
+		headerTransform: func(hdr *types.ResourceHeader) *recordingencryptionv1.RecordingEncryption {
+			return &recordingencryptionv1.RecordingEncryption{
+				Kind:    hdr.Kind,
+				Version: hdr.Version,
+				Metadata: &headerv1.Metadata{
+					Name: hdr.Metadata.Name,
+				},
+			}
+		},
+		watch: w,
+	}, nil
+}
+
+// GetRecordingEncryption returns the cached RecordingEncryption for the cluster
+func (c *Cache) GetRecordingEncryption(ctx context.Context) (*recordingencryptionv1.RecordingEncryption, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetRecordingEncryption")
+	defer span.End()
+
+	getter := genericGetter[*recordingencryptionv1.RecordingEncryption, recordingEncryptionIndex]{
+		cache:      c,
+		collection: c.collections.recordingEncryption,
+		index:      recordingEncryptionNameIndex,
+		upstreamGet: func(ctx context.Context, ident string) (*recordingencryptionv1.RecordingEncryption, error) {
+			encryption, err := c.Config.RecordingEncryption.GetRecordingEncryption(ctx)
+			return encryption, trace.Wrap(err)
+		},
+	}
+
+	out, err := getter.get(ctx, types.MetaNameRecordingEncryption)
+	return out, trace.Wrap(err)
+}
diff --git a/lib/cache/recording_encryption_test.go b/lib/cache/recording_encryption_test.go
new file mode 100644
index 0000000000000..09cddd81f95e0
--- /dev/null
+++ b/lib/cache/recording_encryption_test.go
@@ -0,0 +1,67 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gravitational/trace"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+func newRecordingEncryption() *recordingencryptionv1.RecordingEncryption {
+	return &recordingencryptionv1.RecordingEncryption{
+		Kind:    types.KindRecordingEncryption,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameRecordingEncryption,
+		},
+		Spec: &recordingencryptionv1.RecordingEncryptionSpec{
+			ActiveKeyPairs: nil,
+		},
+	}
+}
+
+// TestRecordingEncryption tests that CRUD operations on the RecordingEncryption resource are
+// replicated from the backend to the cache.
+func TestRecordingEncryption(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	testResources153(t, p, testFuncs[*recordingencryptionv1.RecordingEncryption]{
+		newResource: func(name string) (*recordingencryptionv1.RecordingEncryption, error) {
+			return newRecordingEncryption(), nil
+		},
+		create: func(ctx context.Context, item *recordingencryptionv1.RecordingEncryption) error {
+			_, err := p.recordingEncryption.CreateRecordingEncryption(ctx, item)
+			return trace.Wrap(err)
+		},
+		update: func(ctx context.Context, item *recordingencryptionv1.RecordingEncryption) error {
+			_, err := p.recordingEncryption.UpdateRecordingEncryption(ctx, item)
+			return trace.Wrap(err)
+		},
+		list:      singletonListAdapter(p.recordingEncryption.GetRecordingEncryption),
+		cacheList: singletonListAdapter(p.cache.GetRecordingEncryption),
+		deleteAll: p.recordingEncryption.DeleteRecordingEncryption,
+	}, withSkipPaginationTest())
+}
diff --git a/lib/cache/relay_server.go b/lib/cache/relay_server.go
new file mode 100644
index 0000000000000..26bbe00b822ca
--- /dev/null
+++ b/lib/cache/relay_server.go
@@ -0,0 +1,89 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cache
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+type relayServerIndex struct{}
+
+var relayServerNameIndex = relayServerIndex{}
+
+func newRelayServerCollection(upstream services.Presence, w types.WatchKind) (*collection[*presencev1.RelayServer, relayServerIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter Presence")
+	}
+
+	return &collection[*presencev1.RelayServer, relayServerIndex]{
+		store: newStore(
+			types.KindRelayServer,
+			proto.CloneOf[*presencev1.RelayServer],
+			map[relayServerIndex]func(*presencev1.RelayServer) string{
+				relayServerNameIndex: func(r *presencev1.RelayServer) string {
+					return r.GetMetadata().GetName()
+				},
+			}),
+		fetcher: func(ctx context.Context, loadSecrets bool) ([]*presencev1.RelayServer, error) {
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListRelayServers))
+			return out, trace.Wrap(err)
+		},
+		watch: w,
+	}, nil
+}
+
+// GetRelayServer implements [authclient.Cache].
+func (c *Cache) GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetRelayServer")
+	defer span.End()
+
+	getter := genericGetter[*presencev1.RelayServer, relayServerIndex]{
+		cache:       c,
+		collection:  c.collections.relayServers,
+		index:       relayServerNameIndex,
+		upstreamGet: c.Config.Presence.GetRelayServer,
+	}
+	out, err := getter.get(ctx, name)
+	return out, trace.Wrap(err)
+}
+
+// ListRelayServers implements [authclient.Cache].
+func (c *Cache) ListRelayServers(ctx context.Context, pageSize int, pageToken string) ([]*presencev1.RelayServer, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListRelayServers")
+	defer span.End()
+
+	lister := genericLister[*presencev1.RelayServer, relayServerIndex]{
+		cache:        c,
+		collection:   c.collections.relayServers,
+		index:        relayServerNameIndex,
+		upstreamList: c.Config.Presence.ListRelayServers,
+		nextToken: func(t *presencev1.RelayServer) string {
+			return t.GetMetadata().GetName()
+		},
+	}
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/remote_cluster.go b/lib/cache/remote_cluster.go
index b2995bc3969c1..4415b5e2837eb 100644
--- a/lib/cache/remote_cluster.go
+++ b/lib/cache/remote_cluster.go
@@ -22,6 +22,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/sortcache"
@@ -38,6 +40,7 @@ func newTunnelConnectionCollection(upstream services.Trust, w types.WatchKind) (
 
 	return &collection[types.TunnelConnection, tunnelConnectionIndex]{
 		store: newStore(
+			types.KindTunnelConnection,
 			types.TunnelConnection.Clone,
 			map[tunnelConnectionIndex]func(types.TunnelConnection) string{
 				tunnelConnectionNameIndex: func(tc types.TunnelConnection) string {
@@ -125,28 +128,14 @@ func newRemoteClusterCollection(upstream services.Trust, w types.WatchKind) (*co
 
 	return &collection[types.RemoteCluster, remoteClusterIndex]{
 		store: newStore(
+			types.KindRemoteCluster,
 			types.RemoteCluster.Clone,
 			map[remoteClusterIndex]func(types.RemoteCluster) string{
 				remoteClusterNameIndex: types.RemoteCluster.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.RemoteCluster, error) {
-			var out []types.RemoteCluster
-			var startKey string
-
-			for {
-				clusters, next, err := upstream.ListRemoteClusters(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				out = append(out, clusters...)
-				startKey = next
-				if next == "" {
-					break
-				}
-			}
-
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListRemoteClusters))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.RemoteCluster {
 			return &types.RemoteClusterV3{
diff --git a/lib/cache/remote_cluster_test.go b/lib/cache/remote_cluster_test.go
index 5c43ffc0dcdb0..992f2cbf988ca 100644
--- a/lib/cache/remote_cluster_test.go
+++ b/lib/cache/remote_cluster_test.go
@@ -46,23 +46,15 @@ func TestRemoteClusters(t *testing.T) {
 				_, err := p.trustS.CreateRemoteCluster(ctx, rc)
 				return err
 			},
-			list: func(ctx context.Context) ([]types.RemoteCluster, error) {
-				return p.trustS.GetRemoteClusters(ctx)
-			},
-			cacheGet: func(ctx context.Context, name string) (types.RemoteCluster, error) {
-				return p.cache.GetRemoteCluster(ctx, name)
-			},
-			cacheList: func(ctx context.Context) ([]types.RemoteCluster, error) {
-				return p.cache.GetRemoteClusters(ctx)
-			},
+			list:      getAllAdapter(p.trustS.GetRemoteClusters),
+			cacheGet:  p.cache.GetRemoteCluster,
+			cacheList: getAllAdapter(p.cache.GetRemoteClusters),
 			update: func(ctx context.Context, rc types.RemoteCluster) error {
 				_, err := p.trustS.UpdateRemoteCluster(ctx, rc)
 				return err
 			},
-			deleteAll: func(ctx context.Context) error {
-				return p.trustS.DeleteAllRemoteClusters(ctx)
-			},
-		})
+			deleteAll: p.trustS.DeleteAllRemoteClusters,
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListRemoteClusters", func(t *testing.T) {
@@ -79,24 +71,15 @@ func TestRemoteClusters(t *testing.T) {
 				_, err := p.trustS.CreateRemoteCluster(ctx, rc)
 				return err
 			},
-			list: func(ctx context.Context) ([]types.RemoteCluster, error) {
-				return p.trustS.GetRemoteClusters(ctx)
-			},
-			cacheGet: func(ctx context.Context, name string) (types.RemoteCluster, error) {
-				return p.cache.GetRemoteCluster(ctx, name)
-			},
-			cacheList: func(ctx context.Context) ([]types.RemoteCluster, error) {
-				clusters, _, err := p.cache.ListRemoteClusters(ctx, 0, "")
-				return clusters, err
-			},
+			list:      getAllAdapter(p.trustS.GetRemoteClusters),
+			cacheGet:  p.cache.GetRemoteCluster,
+			cacheList: getAllAdapter(p.cache.GetRemoteClusters),
 			update: func(ctx context.Context, rc types.RemoteCluster) error {
 				_, err := p.trustS.UpdateRemoteCluster(ctx, rc)
 				return err
 			},
-			deleteAll: func(ctx context.Context) error {
-				return p.trustS.DeleteAllRemoteClusters(ctx)
-			},
-		})
+			deleteAll: p.trustS.DeleteAllRemoteClusters,
+		}, withSkipPaginationTest())
 	})
 }
 
@@ -116,18 +99,14 @@ func TestTunnelConnections(t *testing.T) {
 				LastHeartbeat: time.Now().UTC(),
 			})
 		},
-		create: modifyNoContext(p.trustS.UpsertTunnelConnection),
-		list: func(ctx context.Context) ([]types.TunnelConnection, error) {
-			return p.trustS.GetAllTunnelConnections()
-		},
-		cacheList: func(ctx context.Context) ([]types.TunnelConnection, error) {
-			return p.cache.GetAllTunnelConnections()
-		},
-		update: modifyNoContext(p.trustS.UpsertTunnelConnection),
+		create:    modifyNoContext(p.trustS.UpsertTunnelConnection),
+		list:      getAllAdapter(func(ctx context.Context) ([]types.TunnelConnection, error) { return p.trustS.GetAllTunnelConnections() }),
+		cacheList: getAllAdapter(func(ctx context.Context) ([]types.TunnelConnection, error) { return p.cache.GetAllTunnelConnections() }),
+		update:    modifyNoContext(p.trustS.UpsertTunnelConnection),
 		deleteAll: func(ctx context.Context) error {
 			return p.trustS.DeleteAllTunnelConnections()
 		},
-	})
+	}, withSkipPaginationTest())
 
 	for i := 0; i < 17; i++ {
 		tunnel, err := types.NewTunnelConnection("conn"+strconv.Itoa(i+1), types.TunnelConnectionSpecV2{
diff --git a/lib/cache/reverse_tunnel.go b/lib/cache/reverse_tunnel.go
index 5a99578876380..ae391107e30e6 100644
--- a/lib/cache/reverse_tunnel.go
+++ b/lib/cache/reverse_tunnel.go
@@ -23,6 +23,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -37,28 +39,14 @@ func newReverseTunnelCollection(upstream services.Presence, w types.WatchKind) (
 
 	return &collection[types.ReverseTunnel, reverseTunnelIndex]{
 		store: newStore(
+			types.KindReverseTunnel,
 			types.ReverseTunnel.Clone,
 			map[reverseTunnelIndex]func(types.ReverseTunnel) string{
 				reverseTunnelNameIndex: types.ReverseTunnel.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.ReverseTunnel, error) {
-			var out []types.ReverseTunnel
-			var nextToken string
-			for {
-				var page []types.ReverseTunnel
-				var err error
-
-				const defaultPageSize = 0
-				page, nextToken, err = upstream.ListReverseTunnels(ctx, defaultPageSize, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListReverseTunnels))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.ReverseTunnel {
 			return &types.ReverseTunnelV2{
diff --git a/lib/cache/reverse_tunnel_test.go b/lib/cache/reverse_tunnel_test.go
index ba75c2ad79738..a8f80375ba970 100644
--- a/lib/cache/reverse_tunnel_test.go
+++ b/lib/cache/reverse_tunnel_test.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"testing"
 
-	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -30,7 +29,7 @@ import (
 func TestReverseTunnels(t *testing.T) {
 	t.Parallel()
 
-	p, err := newPack(t.TempDir(), ForProxy)
+	p, err := newPack(t, ForProxy)
 	require.NoError(t, err)
 	t.Cleanup(p.Close)
 
@@ -42,19 +41,12 @@ func TestReverseTunnels(t *testing.T) {
 			_, err := p.presenceS.UpsertReverseTunnel(ctx, tunnel)
 			return err
 		},
-		list: func(ctx context.Context) ([]types.ReverseTunnel, error) {
-			items, _, err := p.presenceS.ListReverseTunnels(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list: p.presenceS.ListReverseTunnels,
 		update: func(ctx context.Context, tunnel types.ReverseTunnel) error {
 			_, err := p.presenceS.UpsertReverseTunnel(ctx, tunnel)
 			return err
 		},
 		deleteAll: p.presenceS.DeleteAllReverseTunnels,
-
-		cacheList: func(ctx context.Context) ([]types.ReverseTunnel, error) {
-			items, _, err := p.cache.ListReverseTunnels(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		cacheList: p.cache.ListReverseTunnels,
 	})
 }
diff --git a/lib/cache/role.go b/lib/cache/role.go
index 16c99a1485298..0000884a5ea67 100644
--- a/lib/cache/role.go
+++ b/lib/cache/role.go
@@ -36,6 +36,7 @@ func newRoleCollection(a services.Access, w types.WatchKind) (*collection[types.
 
 	return &collection[types.Role, roleIndex]{
 		store: newStore(
+			types.KindRole,
 			types.Role.Clone,
 			map[roleIndex]func(types.Role) string{
 				roleNameIndex: types.Role.GetName,
@@ -156,6 +157,9 @@ func (c *Cache) GetRole(ctx context.Context, name string) (types.Role, error) {
 			if role, err := c.Config.Access.GetRole(ctx, name); err == nil {
 				return role, nil
 			}
+
+			// This error message format should be kept in sync with web/packages/teleport/src/services/api/api.isRoleNotFoundError
+			return nil, trace.NotFound("role %v is not found", name)
 		}
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/cache/role_test.go b/lib/cache/role_test.go
index 67ab05613e7e2..a1c67b9944ab8 100644
--- a/lib/cache/role_test.go
+++ b/lib/cache/role_test.go
@@ -21,11 +21,24 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 )
 
+func TestRoleNotFound(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForNode)
+	t.Cleanup(p.Close)
+
+	_, err := p.cache.GetRole(t.Context(), "test-role")
+	assert.Error(t, err)
+	assert.True(t, trace.IsNotFound(err))
+	assert.Equal(t, "role test-role is not found", err.Error())
+}
+
 // TestRoles tests caching of roles
 func TestRoles(t *testing.T) {
 	t.Parallel()
@@ -36,7 +49,7 @@ func TestRoles(t *testing.T) {
 	t.Run("GetRoles", func(t *testing.T) {
 		testResources(t, p, testFuncs[types.Role]{
 			newResource: func(name string) (types.Role, error) {
-				return types.NewRole("role1", types.RoleSpecV6{
+				return types.NewRole(name, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						MaxSessionTTL: types.Duration(time.Hour),
 					},
@@ -51,23 +64,21 @@ func TestRoles(t *testing.T) {
 				_, err := p.accessS.UpsertRole(ctx, role)
 				return err
 			},
-			list:      p.accessS.GetRoles,
+			list:      getAllAdapter(p.accessS.GetRoles),
 			cacheGet:  p.cache.GetRole,
-			cacheList: p.cache.GetRoles,
+			cacheList: getAllAdapter(p.cache.GetRoles),
 			update: func(ctx context.Context, role types.Role) error {
 				_, err := p.accessS.UpsertRole(ctx, role)
 				return err
 			},
-			deleteAll: func(ctx context.Context) error {
-				return p.accessS.DeleteAllRoles(ctx)
-			},
-		})
+			deleteAll: p.accessS.DeleteAllRoles,
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListRoles", func(t *testing.T) {
 		testResources(t, p, testFuncs[types.Role]{
 			newResource: func(name string) (types.Role, error) {
-				return types.NewRole("role1", types.RoleSpecV6{
+				return types.NewRole(name, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						MaxSessionTTL: types.Duration(time.Hour),
 					},
@@ -82,56 +93,46 @@ func TestRoles(t *testing.T) {
 				_, err := p.accessS.UpsertRole(ctx, role)
 				return err
 			},
-			list: func(ctx context.Context) ([]types.Role, error) {
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.Role, string, error) {
 				var out []types.Role
-				req := &proto.ListRolesRequest{}
-				for {
-					resp, err := p.accessS.ListRoles(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, r := range resp.Roles {
-						out = append(out, r)
-					}
+				req := &proto.ListRolesRequest{
+					Limit:    int32(pageSize),
+					StartKey: pageToken,
+				}
+				resp, err := p.accessS.ListRoles(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					req.StartKey = resp.NextKey
-					if resp.NextKey == "" {
-						break
-					}
+				for _, r := range resp.Roles {
+					out = append(out, r)
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			cacheGet: p.cache.GetRole,
-			cacheList: func(ctx context.Context) ([]types.Role, error) {
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.Role, string, error) {
 				var out []types.Role
-				req := &proto.ListRolesRequest{}
-				for {
-					resp, err := p.cache.ListRoles(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, r := range resp.Roles {
-						out = append(out, r)
-					}
+				req := &proto.ListRolesRequest{
+					Limit:    int32(pageSize),
+					StartKey: pageToken,
+				}
+				resp, err := p.cache.ListRoles(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
 
-					req.StartKey = resp.NextKey
-					if resp.NextKey == "" {
-						break
-					}
+				for _, r := range resp.Roles {
+					out = append(out, r)
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			update: func(ctx context.Context, role types.Role) error {
 				_, err := p.accessS.UpsertRole(ctx, role)
 				return err
 			},
-			deleteAll: func(ctx context.Context) error {
-				return p.accessS.DeleteAllRoles(ctx)
-			},
+			deleteAll: p.accessS.DeleteAllRoles,
 		})
 	})
 
diff --git a/lib/cache/saml_idp.go b/lib/cache/saml_idp.go
index 952e1caa8564b..98f0ba55f8149 100644
--- a/lib/cache/saml_idp.go
+++ b/lib/cache/saml_idp.go
@@ -22,6 +22,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -36,29 +38,14 @@ func newSAMLIdPServiceProviderCollection(upstream services.SAMLIdPServiceProvide
 
 	return &collection[types.SAMLIdPServiceProvider, samlIdPServiceProviderIndex]{
 		store: newStore(
+			types.KindSAMLIdPServiceProvider,
 			types.SAMLIdPServiceProvider.Copy,
 			map[samlIdPServiceProviderIndex]func(types.SAMLIdPServiceProvider) string{
 				samlIdPServiceProviderNameIndex: types.SAMLIdPServiceProvider.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.SAMLIdPServiceProvider, error) {
-			var startKey string
-			var sps []types.SAMLIdPServiceProvider
-			for {
-				var samlProviders []types.SAMLIdPServiceProvider
-				var err error
-				samlProviders, startKey, err = upstream.ListSAMLIdPServiceProviders(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				sps = append(sps, samlProviders...)
-
-				if startKey == "" {
-					break
-				}
-			}
-
-			return sps, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListSAMLIdPServiceProviders))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.SAMLIdPServiceProvider {
 			return &types.SAMLIdPServiceProviderV1{
diff --git a/lib/cache/saml_idp_test.go b/lib/cache/saml_idp_test.go
index aa2ec488c0f73..57bbc4563723d 100644
--- a/lib/cache/saml_idp_test.go
+++ b/lib/cache/saml_idp_test.go
@@ -17,7 +17,7 @@
 package cache
 
 import (
-	"context"
+	"fmt"
 	"testing"
 
 	"github.com/gravitational/teleport/api/types"
@@ -38,20 +38,14 @@ func TestSAMLIdPServiceProviders(t *testing.T) {
 					Name: name,
 				},
 				types.SAMLIdPServiceProviderSpecV1{
-					EntityDescriptor: testEntityDescriptor,
-					EntityID:         "IAMShowcase",
+					EntityDescriptor: fmt.Sprintf(testEntityDescriptorFmt, "IAMShowcase"+name),
+					EntityID:         "IAMShowcase" + name,
 				})
 		},
-		create: p.samlIDPServiceProviders.CreateSAMLIdPServiceProvider,
-		list: func(ctx context.Context) ([]types.SAMLIdPServiceProvider, error) {
-			results, _, err := p.samlIDPServiceProviders.ListSAMLIdPServiceProviders(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetSAMLIdPServiceProvider,
-		cacheList: func(ctx context.Context) ([]types.SAMLIdPServiceProvider, error) {
-			results, _, err := p.cache.ListSAMLIdPServiceProviders(ctx, 0, "")
-			return results, err
-		},
+		create:    p.samlIDPServiceProviders.CreateSAMLIdPServiceProvider,
+		list:      p.samlIDPServiceProviders.ListSAMLIdPServiceProviders,
+		cacheGet:  p.cache.GetSAMLIdPServiceProvider,
+		cacheList: p.cache.ListSAMLIdPServiceProviders,
 		update:    p.samlIDPServiceProviders.UpdateSAMLIdPServiceProvider,
 		deleteAll: p.samlIDPServiceProviders.DeleteAllSAMLIdPServiceProviders,
 	})
diff --git a/lib/cache/security_report.go b/lib/cache/security_report.go
index abfcba742384e..433c6202e4c2d 100644
--- a/lib/cache/security_report.go
+++ b/lib/cache/security_report.go
@@ -24,6 +24,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/secreports"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -38,6 +40,7 @@ func newAuditQueryCollection(upstream services.SecReports, w types.WatchKind) (*
 
 	return &collection[*secreports.AuditQuery, auditQueryIndex]{
 		store: newStore(
+			types.KindAuditQuery,
 			(*secreports.AuditQuery).Clone,
 			map[auditQueryIndex]func(*secreports.AuditQuery) string{
 				auditQueryNameIndex: func(r *secreports.AuditQuery) string {
@@ -45,26 +48,13 @@ func newAuditQueryCollection(upstream services.SecReports, w types.WatchKind) (*
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*secreports.AuditQuery, error) {
-			var out []*secreports.AuditQuery
-			var nextToken string
-			for {
-				var page []*secreports.AuditQuery
-				var err error
-
-				page, nextToken, err = upstream.ListSecurityAuditQueries(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					// AccessDenied is returned if the cluster is not licensed for access monitoring.
-					if trace.IsAccessDenied(err) {
-						return nil, nil
-					}
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListSecurityAuditQueries))
+			// AccessDenied is returned if the cluster is not licensed for access monitoring.
+			if trace.IsAccessDenied(err) {
+				return nil, nil
 			}
-			return out, nil
+
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *secreports.AuditQuery {
 			return &secreports.AuditQuery{
@@ -149,6 +139,7 @@ func newSecurityReportCollection(upstream services.SecReports, w types.WatchKind
 
 	return &collection[*secreports.Report, securityReportIndex]{
 		store: newStore(
+			types.KindSecurityReport,
 			(*secreports.Report).Clone,
 			map[securityReportIndex]func(*secreports.Report) string{
 				securityReportNameIndex: func(r *secreports.Report) string {
@@ -156,27 +147,13 @@ func newSecurityReportCollection(upstream services.SecReports, w types.WatchKind
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*secreports.Report, error) {
-			var out []*secreports.Report
-			var nextToken string
-			for {
-				var page []*secreports.Report
-				var err error
-
-				page, nextToken, err = upstream.ListSecurityReports(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					// AccessDenied is returned if the cluster is not licensed for access monitoring.
-					if trace.IsAccessDenied(err) {
-						return nil, nil
-					}
-
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListSecurityReports))
+			// AccessDenied is returned if the cluster is not licensed for access monitoring.
+			if trace.IsAccessDenied(err) {
+				return nil, nil
 			}
-			return out, nil
+
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *secreports.Report {
 			return &secreports.Report{
@@ -261,6 +238,7 @@ func newSecurityReportStateCollection(upstream services.SecReports, w types.Watc
 
 	return &collection[*secreports.ReportState, securityReportStateIndex]{
 		store: newStore(
+			types.KindSecurityReportState,
 			(*secreports.ReportState).Clone,
 			map[securityReportStateIndex]func(*secreports.ReportState) string{
 				securityReportStateNameIndex: func(r *secreports.ReportState) string {
@@ -268,27 +246,12 @@ func newSecurityReportStateCollection(upstream services.SecReports, w types.Watc
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*secreports.ReportState, error) {
-			var out []*secreports.ReportState
-			var nextToken string
-			for {
-				var page []*secreports.ReportState
-				var err error
-
-				page, nextToken, err = upstream.ListSecurityReportsStates(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					// AccessDenied is returned if the cluster is not licensed for access monitoring.
-					if trace.IsAccessDenied(err) {
-						return nil, nil
-					}
-
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListSecurityReportsStates))
+			// AccessDenied is returned if the cluster is not licensed for access monitoring.
+			if trace.IsAccessDenied(err) {
+				return nil, nil
 			}
-			return out, nil
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *secreports.ReportState {
 			return &secreports.ReportState{
diff --git a/lib/cache/sercurity_report_test.go b/lib/cache/sercurity_report_test.go
index d7d78f15f42bd..d3b12afe9b614 100644
--- a/lib/cache/sercurity_report_test.go
+++ b/lib/cache/sercurity_report_test.go
@@ -42,15 +42,15 @@ func TestAuditQuery(t *testing.T) {
 				err := p.secReports.UpsertSecurityAuditQuery(ctx, item)
 				return trace.Wrap(err)
 			},
-			list:      p.secReports.GetSecurityAuditQueries,
+			list:      getAllAdapter(p.secReports.GetSecurityAuditQueries),
 			cacheGet:  p.cache.GetSecurityAuditQuery,
-			cacheList: p.cache.GetSecurityAuditQueries,
+			cacheList: getAllAdapter(p.cache.GetSecurityAuditQueries),
 			update: func(ctx context.Context, item *secreports.AuditQuery) error {
 				err := p.secReports.UpsertSecurityAuditQuery(ctx, item)
 				return trace.Wrap(err)
 			},
 			deleteAll: p.secReports.DeleteAllSecurityAuditQueries,
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListSecurityAuditQueries", func(t *testing.T) {
@@ -62,33 +62,15 @@ func TestAuditQuery(t *testing.T) {
 				err := p.secReports.UpsertSecurityAuditQuery(ctx, item)
 				return trace.Wrap(err)
 			},
-			list:     p.secReports.GetSecurityAuditQueries,
-			cacheGet: p.cache.GetSecurityAuditQuery,
-			cacheList: func(ctx context.Context) ([]*secreports.AuditQuery, error) {
-				var out []*secreports.AuditQuery
-				var startKey string
-
-				for {
-					resp, next, err := p.cache.ListSecurityAuditQueries(ctx, 0, startKey)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					out = append(out, resp...)
-					startKey = next
-					if next == "" {
-						break
-					}
-				}
-
-				return out, nil
-			},
+			list:      getAllAdapter(p.secReports.GetSecurityAuditQueries),
+			cacheGet:  p.cache.GetSecurityAuditQuery,
+			cacheList: p.cache.ListSecurityAuditQueries,
 			update: func(ctx context.Context, item *secreports.AuditQuery) error {
 				err := p.secReports.UpsertSecurityAuditQuery(ctx, item)
 				return trace.Wrap(err)
 			},
 			deleteAll: p.secReports.DeleteAllSecurityAuditQueries,
-		})
+		}, withSkipPaginationTest())
 	})
 
 }
@@ -110,15 +92,15 @@ func TestSecurityReports(t *testing.T) {
 				err := p.secReports.UpsertSecurityReport(ctx, item)
 				return trace.Wrap(err)
 			},
-			list:      p.secReports.GetSecurityReports,
+			list:      getAllAdapter(p.secReports.GetSecurityReports),
 			cacheGet:  p.cache.GetSecurityReport,
-			cacheList: p.cache.GetSecurityReports,
+			cacheList: getAllAdapter(p.cache.GetSecurityReports),
 			update: func(ctx context.Context, item *secreports.Report) error {
 				err := p.secReports.UpsertSecurityReport(ctx, item)
 				return trace.Wrap(err)
 			},
 			deleteAll: p.secReports.DeleteAllSecurityReports,
-		})
+		}, withSkipPaginationTest())
 	})
 	t.Run("ListSecurityReports", func(t *testing.T) {
 		testResources(t, p, testFuncs[*secreports.Report]{
@@ -129,28 +111,9 @@ func TestSecurityReports(t *testing.T) {
 				err := p.secReports.UpsertSecurityReport(ctx, item)
 				return trace.Wrap(err)
 			},
-			list:     p.secReports.GetSecurityReports,
-			cacheGet: p.cache.GetSecurityReport,
-			cacheList: func(ctx context.Context) ([]*secreports.Report, error) {
-				var out []*secreports.Report
-				var startKey string
-
-				for {
-					resp, next, err := p.cache.ListSecurityReports(ctx, 0, startKey)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					out = append(out, resp...)
-					startKey = next
-					if next == "" {
-						break
-					}
-				}
-
-				return out, nil
-
-			},
+			list:      p.secReports.ListSecurityReports,
+			cacheGet:  p.cache.GetSecurityReport,
+			cacheList: p.cache.ListSecurityReports,
 			update: func(ctx context.Context, item *secreports.Report) error {
 				err := p.secReports.UpsertSecurityReport(ctx, item)
 				return trace.Wrap(err)
@@ -177,50 +140,13 @@ func TestSecurityReportState(t *testing.T) {
 			err := p.secReports.UpsertSecurityReportsState(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*secreports.ReportState, error) {
-			var out []*secreports.ReportState
-			var startKey string
-			for {
-				resp, next, err := p.secReports.ListSecurityReportsStates(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				out = append(out, resp...)
-
-				if next == "" {
-					break
-				}
-				startKey = next
-			}
-
-			return out, nil
-		},
-		cacheGet: p.cache.GetSecurityReportState,
-		cacheList: func(ctx context.Context) ([]*secreports.ReportState, error) {
-			var out []*secreports.ReportState
-			var startKey string
-			for {
-				resp, next, err := p.cache.ListSecurityReportsStates(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				out = append(out, resp...)
-
-				if next == "" {
-					break
-				}
-				startKey = next
-			}
-
-			return out, nil
-		},
+		list:      p.secReports.ListSecurityReportsStates,
+		cacheGet:  p.cache.GetSecurityReportState,
+		cacheList: p.cache.ListSecurityReportsStates,
 		update: func(ctx context.Context, item *secreports.ReportState) error {
 			err := p.secReports.UpsertSecurityReportsState(ctx, item)
 			return trace.Wrap(err)
 		},
 		deleteAll: p.secReports.DeleteAllSecurityReportsStates,
 	})
-
 }
diff --git a/lib/cache/spiffe_federation.go b/lib/cache/spiffe_federation.go
index 6f08a9727e7fe..ec676bee1966a 100644
--- a/lib/cache/spiffe_federation.go
+++ b/lib/cache/spiffe_federation.go
@@ -26,6 +26,8 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -40,6 +42,7 @@ func newSPIFFEFederationCollection(upstream services.SPIFFEFederations, w types.
 
 	return &collection[*machineidv1.SPIFFEFederation, spiffeFederationIndex]{
 		store: newStore(
+			types.KindSPIFFEFederation,
 			proto.CloneOf[*machineidv1.SPIFFEFederation],
 			map[spiffeFederationIndex]func(*machineidv1.SPIFFEFederation) string{
 				spiffeFederationNameIndex: func(r *machineidv1.SPIFFEFederation) string {
@@ -47,22 +50,8 @@ func newSPIFFEFederationCollection(upstream services.SPIFFEFederations, w types.
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*machineidv1.SPIFFEFederation, error) {
-			var out []*machineidv1.SPIFFEFederation
-			var nextToken string
-			for {
-				var page []*machineidv1.SPIFFEFederation
-				var err error
-
-				page, nextToken, err = upstream.ListSPIFFEFederations(ctx, 0 /* default page size */, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListSPIFFEFederations))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *machineidv1.SPIFFEFederation {
 			return &machineidv1.SPIFFEFederation{
diff --git a/lib/cache/spiffe_federation_test.go b/lib/cache/spiffe_federation_test.go
index a31530f7389eb..3586c55fa014a 100644
--- a/lib/cache/spiffe_federation_test.go
+++ b/lib/cache/spiffe_federation_test.go
@@ -50,27 +50,17 @@ func TestSPIFFEFederations(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*machineidv1.SPIFFEFederation]{
+	testResources153(t, p, testFuncs[*machineidv1.SPIFFEFederation]{
 		newResource: func(s string) (*machineidv1.SPIFFEFederation, error) {
 			return newSPIFFEFederation(s), nil
 		},
-
 		create: func(ctx context.Context, item *machineidv1.SPIFFEFederation) error {
 			_, err := p.spiffeFederations.CreateSPIFFEFederation(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*machineidv1.SPIFFEFederation, error) {
-			items, _, err := p.spiffeFederations.ListSPIFFEFederations(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		deleteAll: func(ctx context.Context) error {
-			return p.spiffeFederations.DeleteAllSPIFFEFederations(ctx)
-		},
-
-		cacheList: func(ctx context.Context) ([]*machineidv1.SPIFFEFederation, error) {
-			items, _, err := p.cache.ListSPIFFEFederations(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheGet: p.cache.GetSPIFFEFederation,
-	})
+		list:      p.spiffeFederations.ListSPIFFEFederations,
+		deleteAll: p.spiffeFederations.DeleteAllSPIFFEFederations,
+		cacheList: p.cache.ListSPIFFEFederations,
+		cacheGet:  p.cache.GetSPIFFEFederation,
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/static_host_user.go b/lib/cache/static_host_user.go
index 0a56181e2d30a..582b8a2bb5f67 100644
--- a/lib/cache/static_host_user.go
+++ b/lib/cache/static_host_user.go
@@ -25,6 +25,8 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	userprovisioningv2 "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -39,6 +41,7 @@ func newStaticHostUserCollection(upstream services.StaticHostUser, w types.Watch
 
 	return &collection[*userprovisioningv2.StaticHostUser, staticHostUserIndex]{
 		store: newStore(
+			types.KindStaticHostUser,
 			proto.CloneOf[*userprovisioningv2.StaticHostUser],
 			map[staticHostUserIndex]func(*userprovisioningv2.StaticHostUser) string{
 				staticHostUserNameIndex: func(shu *userprovisioningv2.StaticHostUser) string {
@@ -46,23 +49,8 @@ func newStaticHostUserCollection(upstream services.StaticHostUser, w types.Watch
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*userprovisioningv2.StaticHostUser, error) {
-			var startKey string
-			var allUsers []*userprovisioningv2.StaticHostUser
-
-			for {
-				users, nextKey, err := upstream.ListStaticHostUsers(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				allUsers = append(allUsers, users...)
-
-				if nextKey == "" {
-					break
-				}
-				startKey = nextKey
-			}
-			return allUsers, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListStaticHostUsers))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *userprovisioningv2.StaticHostUser {
 			return &userprovisioningv2.StaticHostUser{
diff --git a/lib/cache/static_host_user_test.go b/lib/cache/static_host_user_test.go
index 51ed08650a27a..cbaa4f6cff363 100644
--- a/lib/cache/static_host_user_test.go
+++ b/lib/cache/static_host_user_test.go
@@ -33,7 +33,7 @@ func TestStaticHostUsers(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*userprovisioningv2.StaticHostUser]{
+	testResources153(t, p, testFuncs[*userprovisioningv2.StaticHostUser]{
 		newResource: func(name string) (*userprovisioningv2.StaticHostUser, error) {
 			return newStaticHostUser(t, name), nil
 		},
@@ -41,15 +41,9 @@ func TestStaticHostUsers(t *testing.T) {
 			_, err := p.staticHostUsers.CreateStaticHostUser(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*userprovisioningv2.StaticHostUser, error) {
-			items, _, err := p.staticHostUsers.ListStaticHostUsers(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
-		cacheList: func(ctx context.Context) ([]*userprovisioningv2.StaticHostUser, error) {
-			items, _, err := p.cache.ListStaticHostUsers(ctx, 0, "")
-			return items, trace.Wrap(err)
-		},
+		list:      p.staticHostUsers.ListStaticHostUsers,
+		cacheList: p.cache.ListStaticHostUsers,
 		cacheGet:  p.cache.GetStaticHostUser,
 		deleteAll: p.staticHostUsers.DeleteAllStaticHostUsers,
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/store.go b/lib/cache/store.go
index a605ab75c21d5..ccb4b99bb6b0e 100644
--- a/lib/cache/store.go
+++ b/lib/cache/store.go
@@ -18,14 +18,17 @@ package cache
 
 import (
 	"iter"
+	"time"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/lib/backend/backendmetrics"
 	"github.com/gravitational/teleport/lib/utils/sortcache"
 )
 
 // store persists cached resources directly in memory.
 type store[T any, I comparable] struct {
+	kind    string
 	cache   *sortcache.SortCache[T, I]
 	clone   func(T) T
 	indexes map[I]func(T) string
@@ -33,8 +36,9 @@ type store[T any, I comparable] struct {
 
 // newStore creates a store that will index the resource
 // based on the provided indexes.
-func newStore[T any, I comparable](clone func(T) T, indexes map[I]func(T) string) *store[T, I] {
+func newStore[T any, I comparable](kind string, clone func(T) T, indexes map[I]func(T) string) *store[T, I] {
 	return &store[T, I]{
+		kind:    kind,
 		clone:   clone,
 		indexes: indexes,
 		cache: sortcache.New(sortcache.Config[T, I]{
@@ -45,21 +49,33 @@ func newStore[T any, I comparable](clone func(T) T, indexes map[I]func(T) string
 
 // clear removes all items from the store.
 func (s *store[T, I]) clear() error {
+	start := time.Now()
 	s.cache.Clear()
+	backendmetrics.BatchWriteLatencies.WithLabelValues("cache").Observe(time.Since(start).Seconds())
+	backendmetrics.BatchWriteRequests.WithLabelValues("cache").Inc()
+	backendmetrics.Requests.WithLabelValues("cache", s.kind, "true").Inc()
 	return nil
 }
 
 // put adds a new item, or updates an existing item.
 func (s *store[T, I]) put(t T) error {
+	start := time.Now()
 	s.cache.Put(s.clone(t))
+	backendmetrics.WriteLatencies.WithLabelValues("cache").Observe(time.Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues("cache").Inc()
+	backendmetrics.Requests.WithLabelValues("cache", s.kind, "false").Inc()
 	return nil
 }
 
 // delete removes the provided item if any of the indexes match.
 func (s *store[T, I]) delete(t T) error {
+	start := time.Now()
 	for idx, transform := range s.indexes {
 		s.cache.Delete(idx, transform(t))
 	}
+	backendmetrics.WriteLatencies.WithLabelValues("cache").Observe(time.Since(start).Seconds())
+	backendmetrics.WriteRequests.WithLabelValues("cache").Inc()
+	backendmetrics.Requests.WithLabelValues("cache", s.kind, "false").Inc()
 
 	return nil
 }
@@ -75,9 +91,14 @@ func (s *store[T, I]) len() int {
 // It is the responsibility of the caller to clone the resource
 // before propagating it further.
 func (s *store[T, I]) get(index I, key string) (T, error) {
+	start := time.Now()
 	t, ok := s.cache.Get(index, key)
+	backendmetrics.ReadLatencies.WithLabelValues("cache").Observe(time.Since(start).Seconds())
+	backendmetrics.ReadRequests.WithLabelValues("cache").Inc()
+	backendmetrics.Requests.WithLabelValues("cache", s.kind, "false").Inc()
 	if !ok {
-		return t, trace.NotFound("no value for key %q in index %v", key, index)
+		backendmetrics.ReadRequestsFailed.WithLabelValues("cache").Inc()
+		return t, trace.NotFound("%q %q does not exist", s.kind, key)
 	}
 
 	return t, nil
@@ -89,7 +110,19 @@ func (s *store[T, I]) get(index I, key string) (T, error) {
 // It is the responsibility of the caller to clone the resource
 // before propagating it further.
 func (s *store[T, I]) resources(index I, start, stop string) iter.Seq[T] {
-	return s.cache.Ascend(index, start, stop)
+	return func(yield func(T) bool) {
+		defer func() {
+			backendmetrics.StreamingRequests.WithLabelValues("cache").Inc()
+			backendmetrics.Requests.WithLabelValues("cache", s.kind, "false").Inc()
+		}()
+
+		for t := range s.cache.Ascend(index, start, stop) {
+			backendmetrics.ReadRequests.WithLabelValues("cache").Inc()
+			if !yield(t) {
+				return
+			}
+		}
+	}
 }
 
 // count returns the number of items that exist in the provided range.
diff --git a/lib/cache/store_test.go b/lib/cache/store_test.go
index 79bfa5ccad893..dfc70dfbb84f0 100644
--- a/lib/cache/store_test.go
+++ b/lib/cache/store_test.go
@@ -26,7 +26,9 @@ import (
 )
 
 func TestResourceStore(t *testing.T) {
+	t.Parallel()
 	store := newStore(
+		"int",
 		func(i int) int { return i },
 		map[string]func(i int) string{
 			"numbers":    strconv.Itoa,
@@ -43,7 +45,7 @@ func TestResourceStore(t *testing.T) {
 	require.Equal(t, 0, zero)
 
 	n, err := store.get("numbers", "1000")
-	require.ErrorIs(t, err, &trace.NotFoundError{Message: `no value for key "1000" in index numbers`})
+	require.ErrorIs(t, err, &trace.NotFoundError{Message: `"int" "1000" does not exist`})
 	require.Equal(t, 0, n)
 
 	v, err := store.get("characters", "1c")
@@ -58,12 +60,12 @@ func TestResourceStore(t *testing.T) {
 
 	require.NoError(t, store.delete(0))
 	_, err = store.get("numbers", "0")
-	require.ErrorIs(t, err, &trace.NotFoundError{Message: `no value for key "0" in index numbers`})
+	require.ErrorIs(t, err, &trace.NotFoundError{Message: `"int" "0" does not exist`})
 
 	require.NoError(t, store.clear())
 
 	_, err = store.get("numbers", "0")
-	require.ErrorIs(t, err, &trace.NotFoundError{Message: `no value for key "0" in index numbers`})
+	require.ErrorIs(t, err, &trace.NotFoundError{Message: `"int" "0" does not exist`})
 
 	require.Zero(t, store.len())
 }
diff --git a/lib/cache/tokens.go b/lib/cache/tokens.go
index 4c23521eac4ec..67852384d7608 100644
--- a/lib/cache/tokens.go
+++ b/lib/cache/tokens.go
@@ -21,8 +21,12 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
 )
 
 type staticTokensIndex string
@@ -36,12 +40,13 @@ func newStaticTokensCollection(c services.ClusterConfiguration, w types.WatchKin
 
 	return &collection[types.StaticTokens, staticTokensIndex]{
 		store: newStore(
+			types.KindStaticTokens,
 			types.StaticTokens.Clone,
 			map[staticTokensIndex]func(types.StaticTokens) string{
 				staticTokensNameIndex: types.StaticTokens.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.StaticTokens, error) {
-			token, err := c.GetStaticTokens()
+			token, err := c.GetStaticTokens(ctx)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -61,8 +66,8 @@ func newStaticTokensCollection(c services.ClusterConfiguration, w types.WatchKin
 }
 
 // GetStaticTokens gets the list of static tokens used to provision nodes.
-func (c *Cache) GetStaticTokens() (types.StaticTokens, error) {
-	_, span := c.Tracer.Start(context.TODO(), "cache/GetStaticTokens")
+func (c *Cache) GetStaticTokens(ctx context.Context) (types.StaticTokens, error) {
+	_, span := c.Tracer.Start(ctx, "cache/GetStaticTokens")
 	defer span.End()
 
 	rg, err := acquireReadGuard(c, c.collections.staticTokens)
@@ -73,10 +78,13 @@ func (c *Cache) GetStaticTokens() (types.StaticTokens, error) {
 
 	if rg.ReadCache() {
 		st, err := rg.store.get(staticTokensNameIndex, types.MetaNameStaticTokens)
-		return st.Clone(), trace.Wrap(err)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return st.Clone(), nil
 	}
 
-	st, err := c.Config.ClusterConfig.GetStaticTokens()
+	st, err := c.Config.ClusterConfig.GetStaticTokens(ctx)
 	return st, trace.Wrap(err)
 }
 
@@ -91,12 +99,22 @@ func newProvisionTokensCollection(p services.Provisioner, w types.WatchKind) (*c
 
 	return &collection[types.ProvisionToken, provisionTokenIndex]{
 		store: newStore(
+			types.KindToken,
 			types.ProvisionToken.Clone,
 			map[provisionTokenIndex]func(types.ProvisionToken) string{
 				provisionTokenStoreNameIndex: types.ProvisionToken.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.ProvisionToken, error) {
-			tokens, err := p.GetTokens(ctx)
+			tokens, err := stream.Collect(
+				clientutils.Resources(
+					ctx,
+					// ListProvisionTokens take too many arguments for [clientutils.Resources]
+					// so we wrap it to get the usual paginated signature.
+					func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+						return p.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+					},
+				),
+			)
 			return tokens, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.ProvisionToken {
@@ -113,6 +131,8 @@ func newProvisionTokensCollection(p services.Provisioner, w types.WatchKind) (*c
 }
 
 // GetTokens returns all active (non-expired) provisioning tokens
+// Deprecated: use [ListProvisionTokens] istead.
+// TODO(hugoShaka): DELETE IN 19.0.0
 func (c *Cache) GetTokens(ctx context.Context) ([]types.ProvisionToken, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/GetTokens")
 	defer span.End()
@@ -169,3 +189,34 @@ func (c *Cache) GetToken(ctx context.Context, name string) (types.ProvisionToken
 
 	return t.Clone(), nil
 }
+
+// ListProvisionTokens returns a paginated list of provision tokens. Items can
+// be filtered by role and bot name. Tokens with ANY of the provided roles are
+// returned. If a bot name is provided, only tokens having a role of Bot are
+// returned.
+func (c *Cache) ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListProvisionTokens")
+	defer span.End()
+
+	lister := genericLister[types.ProvisionToken, provisionTokenIndex]{
+		cache:           c,
+		collection:      c.collections.provisionTokens,
+		index:           provisionTokenStoreNameIndex,
+		isDesc:          false,
+		defaultPageSize: defaults.DefaultChunkSize,
+		upstreamList: func(ctx context.Context, pageSize int, pageToken string) ([]types.ProvisionToken, string, error) {
+			return c.Config.Provisioner.ListProvisionTokens(ctx, pageSize, pageToken, anyRoles, botName)
+		},
+		filter: func(t types.ProvisionToken) bool {
+			return local.MatchToken(t, anyRoles, botName)
+		},
+		nextToken: func(t types.ProvisionToken) string {
+			return t.GetName()
+		},
+	}
+	out, next, err := lister.list(ctx,
+		pageSize,
+		pageToken,
+	)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/tokens_test.go b/lib/cache/tokens_test.go
index 25b72460f8746..11e15c1e0ec19 100644
--- a/lib/cache/tokens_test.go
+++ b/lib/cache/tokens_test.go
@@ -18,24 +18,33 @@ package cache
 
 import (
 	"context"
+	"strconv"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
 )
 
 // TestTokens tests static tokens
 func TestStaticTokens(t *testing.T) {
 	t.Parallel()
+	ctx := t.Context()
 
 	p := newPackForAuth(t)
 	t.Cleanup(p.Close)
 
+	// Make sure we get a NotFoundError (and not a panic) when there are no
+	// static tokens.
+	_, err := p.cache.GetStaticTokens(ctx)
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+
 	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
 		StaticTokens: []types.ProvisionTokenV1{
 			{
@@ -57,7 +66,7 @@ func TestStaticTokens(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	out, err := p.cache.GetStaticTokens()
+	out, err := p.cache.GetStaticTokens(ctx)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(staticTokens, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 }
@@ -101,3 +110,132 @@ func TestDynamicTokens(t *testing.T) {
 	_, err = p.cache.GetToken(ctx, token.GetName())
 	require.True(t, trace.IsNotFound(err))
 }
+
+// TestTokensCache tests that CRUD operations on tokens resources are
+// replicated from the backend to the cache.
+func TestTokensCache(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	testResources(t, p, testFuncs[types.ProvisionToken]{
+		newResource: func(key string) (types.ProvisionToken, error) {
+			return &types.ProvisionTokenV2{
+				Metadata: types.Metadata{
+					Name: key,
+				},
+				Spec: types.ProvisionTokenSpecV2{
+					Roles: []types.SystemRole{
+						types.RoleAdmin,
+					},
+				},
+			}, nil
+		},
+		cacheGet: func(ctx context.Context, key string) (types.ProvisionToken, error) {
+			return p.cache.GetToken(ctx, key)
+		},
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.ProvisionToken, string, error) {
+			return p.cache.ListProvisionTokens(ctx, pageSize, pageToken, nil, "")
+		},
+		create: func(ctx context.Context, resource types.ProvisionToken) error {
+			err := p.provisionerS.CreateToken(ctx, resource)
+			return err
+		},
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]types.ProvisionToken, string, error) {
+			return p.provisionerS.ListProvisionTokens(ctx, pageSize, pageToken, nil, "")
+		},
+		update: func(ctx context.Context, t types.ProvisionToken) error {
+			err := p.provisionerS.UpsertToken(ctx, t)
+			return err
+		},
+		deleteAll: func(ctx context.Context) error {
+			return p.provisionerS.DeleteAllTokens()
+		},
+	})
+}
+
+// TestTokensCacheFilters tests that cache items are filtered.
+func TestTokensCacheFilters(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	tokens := []struct {
+		roles   types.SystemRoles
+		botName string
+	}{
+		{
+			roles:   types.SystemRoles{types.RoleAdmin},
+			botName: "",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleAdmin, types.RoleNode, types.RoleBot},
+			botName: "bot-1",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleBot},
+			botName: "bot-2",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleBot},
+			botName: "bot-1",
+		},
+	}
+
+	for i, token := range tokens {
+		err := p.provisionerS.CreateToken(ctx, &types.ProvisionTokenV2{
+			Metadata: types.Metadata{
+				Name: "test-token-" + strconv.Itoa(i+1),
+			},
+			Spec: types.ProvisionTokenSpecV2{
+				Roles:   token.roles,
+				BotName: token.botName,
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		result, _, err := p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "")
+		require.NoError(t, err)
+		assert.Len(t, result, len(tokens))
+	}, 10*time.Second, 100*time.Millisecond)
+
+	t.Run("roles filter", func(t *testing.T) {
+		result, _, err := p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin, types.RoleNode, types.RoleBot}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 4)
+
+		result, _, err = p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin, types.RoleNode}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 2)
+
+		result, _, err = p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleBot}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 3)
+	})
+
+	t.Run("bot name filter", func(t *testing.T) {
+		result, _, err := p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "bot-1")
+		require.NoError(t, err)
+		require.Len(t, result, 2)
+		assert.Equal(t, "test-token-2", result[0].GetName())
+
+		result, _, err = p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "bot-2")
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "test-token-3", result[0].GetName())
+	})
+
+	t.Run("combined roles and bot name filters", func(t *testing.T) {
+		result, _, err := p.cache.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin}, "bot-1")
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "test-token-2", result[0].GetName())
+	})
+}
diff --git a/lib/cache/user_group.go b/lib/cache/user_group.go
index c6c1919054be4..226dcd91c0bed 100644
--- a/lib/cache/user_group.go
+++ b/lib/cache/user_group.go
@@ -23,6 +23,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 )
@@ -31,33 +33,21 @@ type userGroupIndex string
 
 const userGroupNameIndex userGroupIndex = "name"
 
-func newUserGroupCollection(u services.UserGroups, w types.WatchKind) (*collection[types.UserGroup, userGroupIndex], error) {
-	if u == nil {
+func newUserGroupCollection(upstream services.UserGroups, w types.WatchKind) (*collection[types.UserGroup, userGroupIndex], error) {
+	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter UserGroups")
 	}
 
 	return &collection[types.UserGroup, userGroupIndex]{
 		store: newStore(
+			types.KindUserGroup,
 			types.UserGroup.Clone,
 			map[userGroupIndex]func(types.UserGroup) string{
 				userGroupNameIndex: types.UserGroup.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.UserGroup, error) {
-			var startKey string
-			var groups []types.UserGroup
-			for {
-				resp, next, err := u.ListUserGroups(ctx, 0, startKey)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				groups = append(groups, resp...)
-				if next == "" {
-					break
-				}
-				startKey = next
-			}
-			return groups, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListUserGroups))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.UserGroup {
 			return &types.UserGroupV1{
@@ -127,5 +117,8 @@ func (c *Cache) GetUserGroup(ctx context.Context, name string) (types.UserGroup,
 	}
 
 	group, err := rg.store.get(userGroupNameIndex, name)
-	return group.Clone(), trace.Wrap(err)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return group.Clone(), nil
 }
diff --git a/lib/cache/user_group_test.go b/lib/cache/user_group_test.go
index 8c333b249da04..6ec7c47c2f987 100644
--- a/lib/cache/user_group_test.go
+++ b/lib/cache/user_group_test.go
@@ -17,7 +17,6 @@
 package cache
 
 import (
-	"context"
 	"strconv"
 	"testing"
 	"time"
@@ -46,16 +45,10 @@ func TestUserGroups(t *testing.T) {
 				}, types.UserGroupSpecV1{},
 			)
 		},
-		create: p.userGroups.CreateUserGroup,
-		list: func(ctx context.Context) ([]types.UserGroup, error) {
-			results, _, err := p.userGroups.ListUserGroups(ctx, 0, "")
-			return results, err
-		},
-		cacheGet: p.cache.GetUserGroup,
-		cacheList: func(ctx context.Context) ([]types.UserGroup, error) {
-			results, _, err := p.cache.ListUserGroups(ctx, 0, "")
-			return results, err
-		},
+		create:    p.userGroups.CreateUserGroup,
+		list:      p.userGroups.ListUserGroups,
+		cacheGet:  p.cache.GetUserGroup,
+		cacheList: p.cache.ListUserGroups,
 		update:    p.userGroups.UpdateUserGroup,
 		deleteAll: p.userGroups.DeleteAllUserGroups,
 	})
diff --git a/lib/cache/user_login_state.go b/lib/cache/user_login_state.go
index 1e5c28f40a4ed..1d5298cf453f7 100644
--- a/lib/cache/user_login_state.go
+++ b/lib/cache/user_login_state.go
@@ -33,11 +33,12 @@ const userLoginStateNameIndex userLoginStateIndex = "name"
 
 func newUserLoginStateCollection(upstream services.UserLoginStates, w types.WatchKind) (*collection[*userloginstate.UserLoginState, userLoginStateIndex], error) {
 	if upstream == nil {
-		return nil, trace.BadParameter("missing parameter UserTasks")
+		return nil, trace.BadParameter("missing parameter UserLoginStates")
 	}
 
 	return &collection[*userloginstate.UserLoginState, userLoginStateIndex]{
 		store: newStore(
+			types.KindUserLoginState,
 			(*userloginstate.UserLoginState).Clone,
 			map[userLoginStateIndex]func(*userloginstate.UserLoginState) string{
 				userLoginStateNameIndex: func(r *userloginstate.UserLoginState) string {
@@ -113,3 +114,22 @@ func (c *Cache) GetUserLoginState(ctx context.Context, name string) (*userlogins
 	}
 	return out, trace.Wrap(err)
 }
+
+// ListUserLoginStates returns the all user login state resources.
+func (c *Cache) ListUserLoginStates(ctx context.Context, pageSize int, pageToken string) ([]*userloginstate.UserLoginState, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListUserLoginStates")
+	defer span.End()
+
+	lister := genericLister[*userloginstate.UserLoginState, userLoginStateIndex]{
+		cache:           c,
+		collection:      c.collections.userLoginStates,
+		index:           userLoginStateNameIndex,
+		upstreamList:    c.Config.UserLoginStates.ListUserLoginStates,
+		defaultPageSize: pageSize,
+		nextToken: func(state *userloginstate.UserLoginState) string {
+			return state.GetName()
+		},
+	}
+	out, next, err := lister.list(ctx, pageSize, pageToken)
+	return out, next, trace.Wrap(err)
+}
diff --git a/lib/cache/user_login_state_test.go b/lib/cache/user_login_state_test.go
index 1dda017ff5da8..167fb89a94af8 100644
--- a/lib/cache/user_login_state_test.go
+++ b/lib/cache/user_login_state_test.go
@@ -41,13 +41,13 @@ func TestUserLoginStates(t *testing.T) {
 			_, err := p.userLoginStates.UpsertUserLoginState(ctx, uls)
 			return trace.Wrap(err)
 		},
-		list:      p.userLoginStates.GetUserLoginStates,
+		list:      getAllAdapter(p.userLoginStates.GetUserLoginStates),
 		cacheGet:  p.cache.GetUserLoginState,
-		cacheList: p.cache.GetUserLoginStates,
+		cacheList: getAllAdapter(p.cache.GetUserLoginStates),
 		update: func(ctx context.Context, uls *userloginstate.UserLoginState) error {
 			_, err := p.userLoginStates.UpsertUserLoginState(ctx, uls)
 			return trace.Wrap(err)
 		},
 		deleteAll: p.userLoginStates.DeleteAllUserLoginStates,
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/user_task.go b/lib/cache/user_task.go
index b491a78340b27..db18c7a57006c 100644
--- a/lib/cache/user_task.go
+++ b/lib/cache/user_task.go
@@ -25,6 +25,8 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -39,6 +41,7 @@ func newUserTaskCollection(upstream services.UserTasks, w types.WatchKind) (*col
 
 	return &collection[*usertasksv1.UserTask, userTaskIndex]{
 		store: newStore(
+			types.KindUserTask,
 			proto.CloneOf[*usertasksv1.UserTask],
 			map[userTaskIndex]func(*usertasksv1.UserTask) string{
 				userTaskNameIndex: func(r *usertasksv1.UserTask) string {
@@ -46,22 +49,10 @@ func newUserTaskCollection(upstream services.UserTasks, w types.WatchKind) (*col
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*usertasksv1.UserTask, error) {
-			var resources []*usertasksv1.UserTask
-			var nextToken string
-			for {
-				var page []*usertasksv1.UserTask
-				var err error
-				page, nextToken, err = upstream.ListUserTasks(ctx, 0 /* page size */, nextToken, &usertasksv1.ListUserTasksFilters{})
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				resources = append(resources, page...)
-
-				if nextToken == "" {
-					break
-				}
-			}
-			return resources, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, size int, nextToken string) ([]*usertasksv1.UserTask, string, error) {
+				return upstream.ListUserTasks(ctx, int64(size), nextToken, &usertasksv1.ListUserTasksFilters{})
+			}))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *usertasksv1.UserTask {
 			return &usertasksv1.UserTask{
diff --git a/lib/cache/user_task_test.go b/lib/cache/user_task_test.go
index 4b2b6d33cbd08..2e8d25fca8603 100644
--- a/lib/cache/user_task_test.go
+++ b/lib/cache/user_task_test.go
@@ -33,7 +33,7 @@ func TestUserTasks(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*usertasksv1.UserTask]{
+	testResources153(t, p, testFuncs[*usertasksv1.UserTask]{
 		newResource: func(name string) (*usertasksv1.UserTask, error) {
 			return newUserTasks(t), nil
 		},
@@ -41,14 +41,12 @@ func TestUserTasks(t *testing.T) {
 			_, err := p.userTasks.CreateUserTask(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*usertasksv1.UserTask, error) {
-			items, _, err := p.userTasks.ListUserTasks(ctx, 0, "", &usertasksv1.ListUserTasksFilters{})
-			return items, trace.Wrap(err)
+		list: func(ctx context.Context, pageLimit int, pageToken string) ([]*usertasksv1.UserTask, string, error) {
+			return p.userTasks.ListUserTasks(ctx, int64(pageLimit), pageToken, &usertasksv1.ListUserTasksFilters{})
 		},
-		cacheList: func(ctx context.Context) ([]*usertasksv1.UserTask, error) {
-			items, _, err := p.cache.ListUserTasks(ctx, 0, "", &usertasksv1.ListUserTasksFilters{})
-			return items, trace.Wrap(err)
+		cacheList: func(ctx context.Context, pageLimit int, pageToken string) ([]*usertasksv1.UserTask, string, error) {
+			return p.cache.ListUserTasks(ctx, int64(pageLimit), pageToken, &usertasksv1.ListUserTasksFilters{})
 		},
 		deleteAll: p.userTasks.DeleteAllUserTasks,
-	})
+	}, withSkipPaginationTest())
 }
diff --git a/lib/cache/users.go b/lib/cache/users.go
index ccf1e5e9bbf7e..96eed4e011045 100644
--- a/lib/cache/users.go
+++ b/lib/cache/users.go
@@ -18,14 +18,14 @@ package cache
 
 import (
 	"context"
-	"strings"
 
 	"github.com/gravitational/trace"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -33,19 +33,40 @@ type userIndex string
 
 const userNameIndex userIndex = "name"
 
-func newUserCollection(u services.UsersService, w types.WatchKind) (*collection[types.User, userIndex], error) {
-	if u == nil {
+func newUserCollection(upstream services.UsersService, w types.WatchKind) (*collection[types.User, userIndex], error) {
+	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter UsersService")
 	}
 
 	return &collection[types.User, userIndex]{
 		store: newStore(
+			types.KindUser,
 			types.User.Clone,
 			map[userIndex]func(types.User) string{
 				userNameIndex: types.User.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.User, error) {
-			return u.GetUsers(ctx, loadSecrets)
+			fn := func(ctx context.Context, pageSize int, token string) ([]types.User, string, error) {
+				rsp, err := upstream.ListUsers(ctx, &userspb.ListUsersRequest{
+					WithSecrets: loadSecrets,
+					PageSize:    int32(pageSize),
+					PageToken:   token,
+				})
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+
+				out := make([]types.User, 0, len(rsp.Users))
+				for _, user := range rsp.Users {
+					out = append(out, user)
+				}
+
+				return out, rsp.NextPageToken, nil
+			}
+
+			// Use clientutils for auto pagesize backoff.
+			out, err := stream.Collect(clientutils.Resources(ctx, fn))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.User {
 			return &types.UserV2{
@@ -173,8 +194,7 @@ func (c *Cache) ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*
 		}
 
 		if len(resp.Users) == pageSize {
-			key := backend.RangeEnd(backend.ExactKey(u.GetName())).String()
-			resp.NextPageToken = strings.Trim(key, string(backend.Separator))
+			resp.NextPageToken = u.GetName()
 			break
 		}
 
diff --git a/lib/cache/users_test.go b/lib/cache/users_test.go
index 51d25c4599999..242880abe978b 100644
--- a/lib/cache/users_test.go
+++ b/lib/cache/users_test.go
@@ -19,8 +19,11 @@ package cache
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -36,78 +39,64 @@ func TestUsers(t *testing.T) {
 	t.Run("GetUsers", func(t *testing.T) {
 		testResources(t, p, testFuncs[types.User]{
 			newResource: func(name string) (types.User, error) {
-				return types.NewUser("bob")
+				return types.NewUser(name)
 			},
 			create: func(ctx context.Context, user types.User) error {
 				_, err := p.usersS.UpsertUser(ctx, user)
 				return err
 			},
-			list: func(ctx context.Context) ([]types.User, error) {
-				return p.usersS.GetUsers(ctx, false)
-			},
-			cacheList: func(ctx context.Context) ([]types.User, error) {
-				return p.cache.GetUsers(ctx, false)
-			},
+			list:      getAllAdapter(func(ctx context.Context) ([]types.User, error) { return p.usersS.GetUsers(ctx, false) }),
+			cacheList: getAllAdapter(func(ctx context.Context) ([]types.User, error) { return p.cache.GetUsers(ctx, false) }),
 			update: func(ctx context.Context, user types.User) error {
 				_, err := p.usersS.UpdateUser(ctx, user)
 				return err
 			},
-			deleteAll: func(ctx context.Context) error {
-				return p.usersS.DeleteAllUsers(ctx)
-			},
-		})
+			deleteAll: p.usersS.DeleteAllUsers,
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListUsers", func(t *testing.T) {
 		testResources(t, p, testFuncs[types.User]{
 			newResource: func(name string) (types.User, error) {
-				return types.NewUser("bob")
+				return types.NewUser(name)
 			},
 			create: func(ctx context.Context, user types.User) error {
 				_, err := p.usersS.UpsertUser(ctx, user)
 				return err
 			},
-			list: func(ctx context.Context) ([]types.User, error) {
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.User, string, error) {
 				var out []types.User
-				req := &userspb.ListUsersRequest{}
-				for {
-					resp, err := p.usersS.ListUsers(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, u := range resp.Users {
-						out = append(out, u)
-					}
-
-					req.PageToken = resp.NextPageToken
-					if resp.NextPageToken == "" {
-						break
-					}
+				req := &userspb.ListUsersRequest{
+					PageSize:  int32(pageSize),
+					PageToken: pageToken,
+				}
+				resp, err := p.usersS.ListUsers(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+
+				for _, u := range resp.Users {
+					out = append(out, u)
 				}
 
-				return out, nil
+				return out, resp.NextPageToken, nil
 			},
-			cacheList: func(ctx context.Context) ([]types.User, error) {
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.User, string, error) {
 				var out []types.User
-				req := &userspb.ListUsersRequest{}
-				for {
-					resp, err := p.cache.ListUsers(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, u := range resp.Users {
-						out = append(out, u)
-					}
-
-					req.PageToken = resp.NextPageToken
-					if resp.NextPageToken == "" {
-						break
-					}
+				req := &userspb.ListUsersRequest{
+					PageSize:  int32(pageSize),
+					PageToken: pageToken,
+				}
+				resp, err := p.cache.ListUsers(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+
+				for _, u := range resp.Users {
+					out = append(out, u)
 				}
 
-				return out, nil
+				return out, resp.NextPageToken, nil
 			},
 			update: func(ctx context.Context, user types.User) error {
 				_, err := p.usersS.UpdateUser(ctx, user)
@@ -119,4 +108,44 @@ func TestUsers(t *testing.T) {
 		})
 	})
 
+	t.Run("ListUsers pagination", func(t *testing.T) {
+		err := p.usersS.DeleteAllUsers(t.Context())
+		require.NoError(t, err)
+
+		waitForUsersCacheLen := func(expected int) {
+			require.EventuallyWithT(t, func(c *assert.CollectT) {
+				got, err := p.cache.GetUsers(t.Context(), false)
+				require.NoError(c, err)
+				require.Len(c, got, expected)
+			}, 3*time.Second, time.Millisecond*100)
+		}
+		waitForUsersCacheLen(0)
+
+		usersToCreate := []string{"bob", "alice"}
+		for _, userName := range usersToCreate {
+			user, err := types.NewUser(userName)
+			require.NoError(t, err)
+			_, err = p.usersS.UpsertUser(t.Context(), user)
+			require.NoError(t, err)
+		}
+
+		waitForUsersCacheLen(len(usersToCreate))
+
+		var allUsers []*types.UserV2
+		req := &userspb.ListUsersRequest{
+			PageSize: 1,
+		}
+		for {
+			resp, err := p.cache.ListUsers(t.Context(), req)
+			require.NoError(t, err)
+			require.Len(t, resp.Users, 1)
+
+			allUsers = append(allUsers, resp.Users...)
+			if resp.NextPageToken == "" {
+				break
+			}
+			req.PageToken = resp.NextPageToken
+		}
+		require.Len(t, allUsers, len(usersToCreate))
+	})
 }
diff --git a/lib/cache/web_session.go b/lib/cache/web_session.go
index 49859441dd006..f5f1be68e0960 100644
--- a/lib/cache/web_session.go
+++ b/lib/cache/web_session.go
@@ -23,6 +23,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils/sortcache"
 )
@@ -38,6 +40,7 @@ func newWebSessionCollection(upstream types.WebSessionInterface, w types.WatchKi
 
 	return &collection[types.WebSession, webSessionIndex]{
 		store: newStore(
+			types.KindWebSession,
 			types.WebSession.Copy,
 			map[webSessionIndex]func(types.WebSession) string{
 				webSessionNameIndex: types.WebSession.GetName,
@@ -116,6 +119,7 @@ func newAppSessionCollection(upstream services.AppSession, w types.WatchKind) (*
 
 	return &collection[types.WebSession, appSessionIndex]{
 		store: newStore(
+			types.KindAppSession,
 			types.WebSession.Copy,
 			map[appSessionIndex]func(types.WebSession) string{
 				appSessionNameIndex: types.WebSession.GetName,
@@ -124,29 +128,21 @@ func newAppSessionCollection(upstream services.AppSession, w types.WatchKind) (*
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.WebSession, error) {
-			var startKey string
-			var sessions []types.WebSession
-
-			for {
-				webSessions, nextKey, err := upstream.ListAppSessions(ctx, 0, startKey, "")
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				if !loadSecrets {
-					for i := 0; i < len(webSessions); i++ {
-						webSessions[i] = webSessions[i].WithoutSecrets()
-					}
-				}
-
-				sessions = append(sessions, webSessions...)
-
-				if nextKey == "" {
-					break
-				}
-				startKey = nextKey
-			}
-			return sessions, nil
+			out, err := stream.Collect(
+				stream.FilterMap(
+					clientutils.Resources(ctx,
+						func(ctx context.Context, size int, startKey string) ([]types.WebSession, string, error) {
+							return upstream.ListAppSessions(ctx, size, startKey, "")
+						}),
+					func(ws types.WebSession) (types.WebSession, bool) {
+						if !loadSecrets {
+							return ws.WithoutSecrets(), true
+						}
+
+						return ws, true
+					}),
+			)
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.WebSession {
 			return &types.WebSessionV2{
@@ -247,17 +243,19 @@ const snowflakeSessionNameIndex snowflakeSessionIndex = "name"
 
 func newSnowflakeSessionCollection(upstream services.SnowflakeSession, w types.WatchKind) (*collection[types.WebSession, snowflakeSessionIndex], error) {
 	if upstream == nil {
-		return nil, trace.BadParameter("missing parameter AppSession")
+		return nil, trace.BadParameter("missing parameter upstream")
 	}
 
 	return &collection[types.WebSession, snowflakeSessionIndex]{
 		store: newStore(
+			types.KindSnowflakeSession,
 			types.WebSession.Copy,
 			map[snowflakeSessionIndex]func(types.WebSession) string{
 				snowflakeSessionNameIndex: types.WebSession.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.WebSession, error) {
-			webSessions, err := upstream.GetSnowflakeSessions(ctx)
+			// TODO(okraport): DELETE IN v21.0.0, replace with regular collect
+			webSessions, err := clientutils.CollectWithFallback(ctx, upstream.ListSnowflakeSessions, upstream.GetSnowflakeSessions)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -315,3 +313,73 @@ func (c *Cache) GetSnowflakeSession(ctx context.Context, req types.GetSnowflakeS
 	}
 	return out, trace.Wrap(err)
 }
+
+// RangeSnowflakeSessions returns Snowflake session resources within the range [start, end).
+func (c *Cache) RangeSnowflakeSessions(ctx context.Context, start, end string) iter.Seq2[types.WebSession, error] {
+	lister := genericLister[types.WebSession, snowflakeSessionIndex]{
+		cache:        c,
+		collection:   c.collections.snowflakeSessions,
+		index:        snowflakeSessionNameIndex,
+		upstreamList: c.Config.SnowflakeSession.ListSnowflakeSessions,
+		nextToken:    types.WebSession.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: c.Config.SnowflakeSession.GetSnowflakeSessions,
+	}
+
+	return func(yield func(types.WebSession, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeSnowflakeSessions")
+		defer span.End()
+
+		for db, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(db, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
+
+// ListSnowflakeSessions returns a page of Snowflake session resources.
+func (c *Cache) ListSnowflakeSessions(ctx context.Context, limit int, startKey string) ([]types.WebSession, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListSnowflakeSessions")
+	defer span.End()
+
+	lister := genericLister[types.WebSession, snowflakeSessionIndex]{
+		cache:        c,
+		collection:   c.collections.snowflakeSessions,
+		index:        snowflakeSessionNameIndex,
+		upstreamList: c.Config.SnowflakeSession.ListSnowflakeSessions,
+		nextToken: func(a types.WebSession) string {
+			return a.GetMetadata().Name
+		},
+	}
+	out, next, err := lister.list(ctx, limit, startKey)
+	return out, next, trace.Wrap(err)
+}
+
+// GetSnowflakeSessions returns all Snowflake session resources.
+func (c *Cache) GetSnowflakeSessions(ctx context.Context) ([]types.WebSession, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/GetSnowflakeSessions")
+	defer span.End()
+
+	rg, err := acquireReadGuard(c, c.collections.snowflakeSessions)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer rg.Release()
+
+	if !rg.ReadCache() {
+		sessions, err := c.Config.SnowflakeSession.GetSnowflakeSessions(ctx)
+		return sessions, trace.Wrap(err)
+	}
+
+	out := make([]types.WebSession, 0, rg.store.len())
+	for a := range rg.store.resources(snowflakeSessionNameIndex, "", "") {
+		out = append(out, a.Copy())
+	}
+
+	return out, nil
+}
diff --git a/lib/cache/web_session_test.go b/lib/cache/web_session_test.go
index 0939fb810acdc..0db725a989a39 100644
--- a/lib/cache/web_session_test.go
+++ b/lib/cache/web_session_test.go
@@ -17,6 +17,7 @@
 package cache
 
 import (
+	"context"
 	"strconv"
 	"testing"
 	"time"
@@ -176,45 +177,33 @@ func TestWebSessions(t *testing.T) {
 
 func TestSnowflakeSessions(t *testing.T) {
 	t.Parallel()
-	ctx := t.Context()
-
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	for i := 0; i < 31; i++ {
-		err := p.snowflakeSessionS.UpsertSnowflakeSession(t.Context(), &types.WebSessionV2{
-			Kind:    types.KindWebSession,
-			SubKind: types.KindSnowflakeSession,
-			Version: types.V2,
-			Metadata: types.Metadata{
-				Name: "snow-session" + strconv.Itoa(i+1),
-			},
-			Spec: types.WebSessionSpecV2{
-				User: "fish",
-			},
-		})
-		require.NoError(t, err)
-	}
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		expected, err := p.snowflakeSessionS.GetSnowflakeSessions(ctx)
-		assert.NoError(t, err)
-		assert.Len(t, expected, 31)
-
-		for _, session := range expected {
-			cached, err := p.cache.GetSnowflakeSession(ctx, types.GetSnowflakeSessionRequest{SessionID: session.GetName()})
-			assert.NoError(t, err)
-			assert.Empty(t, cmp.Diff(session, cached))
-		}
-	}, 15*time.Second, 100*time.Millisecond)
-
-	require.NoError(t, p.snowflakeSessionS.DeleteAllSnowflakeSessions(ctx))
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		for i := 0; i < 31; i++ {
-			session, err := p.cache.GetSnowflakeSession(ctx, types.GetSnowflakeSessionRequest{SessionID: "snow-session" + strconv.Itoa(i+1)})
-			assert.Error(t, err)
-			assert.Nil(t, session)
-		}
-	}, 15*time.Second, 100*time.Millisecond)
+	testResources(t, p, testFuncs[types.WebSession]{
+		newResource: func(name string) (types.WebSession, error) {
+			return &types.WebSessionV2{
+				Kind:    types.KindWebSession,
+				SubKind: types.KindSnowflakeSession,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name:      name,
+					Namespace: "default",
+				},
+				Spec: types.WebSessionSpecV2{
+					User: "fish",
+				},
+			}, nil
+		},
+		create: p.snowflakeSessionS.UpsertSnowflakeSession,
+		list:   p.snowflakeSessionS.ListSnowflakeSessions,
+		Range:  p.snowflakeSessionS.RangeSnowflakeSessions,
+		cacheGet: func(ctx context.Context, name string) (types.WebSession, error) {
+			return p.cache.GetSnowflakeSession(ctx, types.GetSnowflakeSessionRequest{SessionID: name})
+		},
+		cacheList:  p.cache.ListSnowflakeSessions,
+		cacheRange: p.cache.RangeSnowflakeSessions,
+		update:     p.snowflakeSessionS.UpsertSnowflakeSession,
+		deleteAll:  p.snowflakeSessionS.DeleteAllSnowflakeSessions,
+	})
 }
diff --git a/lib/cache/web_tokens.go b/lib/cache/web_tokens.go
index 7ac90fc92ef5f..49c2035c7781b 100644
--- a/lib/cache/web_tokens.go
+++ b/lib/cache/web_tokens.go
@@ -18,30 +18,38 @@ package cache
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 type webTokenIndex string
 
 const webTokenNameIndex webTokenIndex = "name"
 
-func newWebTokenCollection(upstream types.WebTokenInterface, w types.WatchKind) (*collection[types.WebToken, webTokenIndex], error) {
+func newWebTokenCollection(upstream services.WebToken, w types.WatchKind) (*collection[types.WebToken, webTokenIndex], error) {
 	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter WebTokenInterface")
 	}
 
 	return &collection[types.WebToken, webTokenIndex]{
 		store: newStore(
+			types.KindWebToken,
 			types.WebToken.Clone,
 			map[webTokenIndex]func(types.WebToken) string{
 				webTokenNameIndex: types.WebToken.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.WebToken, error) {
-			installers, err := upstream.List(ctx)
-			return installers, trace.Wrap(err)
+			// TODO(lokraszewski): DELETE IN v21.0.0, replace with regular collect.
+			tokens, err := clientutils.CollectWithFallback(ctx, upstream.ListWebTokens, upstream.GetWebTokens)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return tokens, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.WebToken {
 			return &types.WebTokenV3{
@@ -66,7 +74,7 @@ func (c *Cache) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (
 		collection: c.collections.webTokens,
 		index:      webTokenNameIndex,
 		upstreamGet: func(ctx context.Context, s string) (types.WebToken, error) {
-			token, err := c.Config.WebToken.Get(ctx, req)
+			token, err := c.Config.WebToken.GetWebToken(ctx, req)
 			return token, trace.Wrap(err)
 		},
 	}
@@ -75,7 +83,7 @@ func (c *Cache) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (
 }
 
 func (c *Cache) GetWebTokens(ctx context.Context) ([]types.WebToken, error) {
-	ctx, span := c.Tracer.Start(ctx, "cache/GetInstallers")
+	ctx, span := c.Tracer.Start(ctx, "cache/GetWebTokens")
 	defer span.End()
 
 	rg, err := acquireReadGuard(c, c.collections.webTokens)
@@ -85,7 +93,7 @@ func (c *Cache) GetWebTokens(ctx context.Context) ([]types.WebToken, error) {
 	defer rg.Release()
 
 	if !rg.ReadCache() {
-		users, err := c.Config.WebToken.List(ctx)
+		users, err := c.Config.WebToken.GetWebTokens(ctx)
 		return users, trace.Wrap(err)
 	}
 
@@ -96,3 +104,51 @@ func (c *Cache) GetWebTokens(ctx context.Context) ([]types.WebToken, error) {
 
 	return tokens, nil
 }
+
+// ListWebTokens returns a page of web tokens
+func (c *Cache) ListWebTokens(ctx context.Context, limit int, start string) ([]types.WebToken, string, error) {
+	ctx, span := c.Tracer.Start(ctx, "cache/ListWebTokens")
+	defer span.End()
+
+	lister := genericLister[types.WebToken, webTokenIndex]{
+		cache:        c,
+		collection:   c.collections.webTokens,
+		index:        webTokenNameIndex,
+		upstreamList: c.Config.WebToken.ListWebTokens,
+		nextToken:    types.WebToken.GetName,
+	}
+	out, next, err := lister.list(ctx, limit, start)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return out, next, nil
+}
+
+// RangeWebTokens returns web tokens within the range [start, end).
+func (c *Cache) RangeWebTokens(ctx context.Context, start, end string) iter.Seq2[types.WebToken, error] {
+	lister := genericLister[types.WebToken, webTokenIndex]{
+		cache:        c,
+		collection:   c.collections.webTokens,
+		index:        webTokenNameIndex,
+		upstreamList: c.Config.WebToken.ListWebTokens,
+		nextToken:    types.WebToken.GetName,
+		// TODO(lokraszewski): DELETE IN v21.0.0
+		fallbackGetter: c.Config.WebToken.GetWebTokens,
+	}
+
+	return func(yield func(types.WebToken, error) bool) {
+		ctx, span := c.Tracer.Start(ctx, "cache/RangeWebTokens")
+		defer span.End()
+
+		for token, err := range lister.RangeWithFallback(ctx, start, end) {
+			if !yield(token, err) {
+				return
+			}
+
+			if err != nil {
+				return
+			}
+		}
+	}
+}
diff --git a/lib/cache/web_tokens_test.go b/lib/cache/web_tokens_test.go
index fa9a6a94a0a21..1f07fab9fda37 100644
--- a/lib/cache/web_tokens_test.go
+++ b/lib/cache/web_tokens_test.go
@@ -17,6 +17,7 @@
 package cache
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -29,16 +30,58 @@ func TestWebTokens(t *testing.T) {
 	p := newTestPack(t, ForProxy)
 	t.Cleanup(p.Close)
 
-	testResources(t, p, testFuncs[types.WebToken]{
-		newResource: func(name string) (types.WebToken, error) {
-			return types.NewWebToken(time.Now().Add(time.Hour), types.WebTokenSpecV3{
-				Token: "test",
-				User:  "llama",
-			})
-		},
-		create:    p.webTokenS.Upsert,
-		list:      p.webTokenS.List,
-		cacheList: p.cache.GetWebTokens,
-		deleteAll: p.webTokenS.DeleteAll,
+	t.Run("GetWebTokens", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.WebToken]{
+			newResource: func(name string) (types.WebToken, error) {
+				return types.NewWebToken(time.Now().Add(time.Hour), types.WebTokenSpecV3{
+					Token: name,
+					User:  "llama",
+				})
+			},
+			create: p.webTokenS.UpsertWebToken,
+			update: p.webTokenS.UpsertWebToken,
+			cacheGet: func(ctx context.Context, token string) (types.WebToken, error) {
+				return p.cache.GetWebToken(ctx, types.GetWebTokenRequest{
+					Token: token,
+					User:  "llama",
+				})
+			},
+			list:      getAllAdapter(p.webTokenS.GetWebTokens),
+			cacheList: getAllAdapter(p.cache.GetWebTokens),
+			deleteAll: p.webTokenS.DeleteAllWebTokens,
+			delete: func(ctx context.Context, token string) error {
+				return p.webTokenS.DeleteWebToken(ctx, types.DeleteWebTokenRequest{
+					Token: token,
+					User:  "llama",
+				})
+			},
+		}, withSkipPaginationTest())
+	})
+	t.Run("ListWebTokens", func(t *testing.T) {
+		testResources(t, p, testFuncs[types.WebToken]{
+			newResource: func(name string) (types.WebToken, error) {
+				return types.NewWebToken(time.Now().Add(time.Hour), types.WebTokenSpecV3{
+					Token: name,
+					User:  "llama",
+				})
+			},
+			create: p.webTokenS.UpsertWebToken,
+			update: p.webTokenS.UpsertWebToken,
+			cacheGet: func(ctx context.Context, token string) (types.WebToken, error) {
+				return p.cache.GetWebToken(ctx, types.GetWebTokenRequest{
+					Token: token,
+					User:  "llama",
+				})
+			},
+			list:      p.webTokenS.ListWebTokens,
+			cacheList: p.cache.ListWebTokens,
+			deleteAll: p.webTokenS.DeleteAllWebTokens,
+			delete: func(ctx context.Context, token string) error {
+				return p.webTokenS.DeleteWebToken(ctx, types.DeleteWebTokenRequest{
+					Token: token,
+					User:  "llama",
+				})
+			},
+		})
 	})
 }
diff --git a/lib/cache/web_ui_config.go b/lib/cache/web_ui_config.go
index b542fc65ac07b..493701c731bd0 100644
--- a/lib/cache/web_ui_config.go
+++ b/lib/cache/web_ui_config.go
@@ -36,6 +36,7 @@ func newWebUIConfigCollection(upstream services.ClusterConfiguration, w types.Wa
 
 	return &collection[types.UIConfig, webUIConfigIndex]{
 		store: newStore(
+			types.KindUIConfig,
 			types.UIConfig.Clone,
 			map[webUIConfigIndex]func(types.UIConfig) string{
 				webUIConfigNameIndex: types.UIConfig.GetName,
diff --git a/lib/cache/web_ui_config_test.go b/lib/cache/web_ui_config_test.go
index 3671e172c0a58..9d819d2af6f6a 100644
--- a/lib/cache/web_ui_config_test.go
+++ b/lib/cache/web_ui_config_test.go
@@ -17,11 +17,8 @@
 package cache
 
 import (
-	"context"
 	"testing"
 
-	"github.com/gravitational/trace"
-
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -35,32 +32,16 @@ func TestWebUIConfig(t *testing.T) {
 		newResource: func(name string) (types.UIConfig, error) {
 			return &types.UIConfigV1{
 				ResourceHeader: types.ResourceHeader{
+					Kind: types.KindUIConfig,
 					Metadata: types.Metadata{
 						Name: types.MetaNameUIConfig,
 					},
 				},
 			}, nil
 		},
-		create: p.clusterConfigS.SetUIConfig,
-		list: func(ctx context.Context) ([]types.UIConfig, error) {
-			cfg, err := p.clusterConfigS.GetUIConfig(ctx)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			return []types.UIConfig{cfg}, nil
-		},
-		cacheList: func(ctx context.Context) ([]types.UIConfig, error) {
-			cfg, err := p.cache.GetUIConfig(ctx)
-			if err != nil {
-				if trace.IsNotFound(err) {
-					return nil, nil
-				}
-				return nil, trace.Wrap(err)
-			}
-
-			return []types.UIConfig{cfg}, nil
-		},
+		create:    p.clusterConfigS.SetUIConfig,
+		list:      singletonListAdapter(p.clusterConfigS.GetUIConfig),
+		cacheList: singletonListAdapter(p.cache.GetUIConfig),
 		deleteAll: p.clusterConfigS.DeleteUIConfig,
-	})
+	}, withSkipPaginationTest()) // UIConfig is a singleton resource, so pagination is not applicable.
 }
diff --git a/lib/cache/windows_desktop.go b/lib/cache/windows_desktop.go
index e602f03f868f9..27df838c2705b 100644
--- a/lib/cache/windows_desktop.go
+++ b/lib/cache/windows_desktop.go
@@ -21,9 +21,13 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -31,19 +35,34 @@ type windowsDesktopServiceIndex string
 
 const windowsDesktopServiceNameIndex windowsDesktopServiceIndex = "name"
 
-func newWindowsDesktopServiceCollection(p services.Presence, w types.WatchKind) (*collection[types.WindowsDesktopService, windowsDesktopServiceIndex], error) {
-	if p == nil {
+func newWindowsDesktopServiceCollection(upstream services.Presence, w types.WatchKind) (*collection[types.WindowsDesktopService, windowsDesktopServiceIndex], error) {
+	if upstream == nil {
 		return nil, trace.BadParameter("missing parameter Presence")
 	}
 
 	return &collection[types.WindowsDesktopService, windowsDesktopServiceIndex]{
 		store: newStore(
+			types.KindWindowsDesktopService,
 			types.WindowsDesktopService.Clone,
 			map[windowsDesktopServiceIndex]func(types.WindowsDesktopService) string{
 				windowsDesktopServiceNameIndex: types.WindowsDesktopService.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.WindowsDesktopService, error) {
-			return p.GetWindowsDesktopServices(ctx)
+			resources, err := client.GetResourcesWithFilters(ctx, upstream, proto.ListResourcesRequest{ResourceType: types.KindWindowsDesktopService})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			desktopSvcs := make([]types.WindowsDesktopService, 0, len(resources))
+			for _, resource := range resources {
+				desktopSvc, ok := resource.(types.WindowsDesktopService)
+				if !ok {
+					return nil, trace.BadParameter("unexpected resource %T", resource)
+				}
+				desktopSvcs = append(desktopSvcs, desktopSvc)
+			}
+
+			return desktopSvcs, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.WindowsDesktopService {
 			return &types.WindowsDesktopServiceV3{
@@ -151,7 +170,12 @@ func (c *Cache) ListWindowsDesktopServices(ctx context.Context, req types.ListWi
 			break
 		}
 
-		resp.DesktopServices = append(resp.DesktopServices, svc.Clone())
+		switch match, err := services.MatchResourceByFilters(svc, filter, nil /* ignore dup matches */); {
+		case err != nil:
+			return nil, trace.Wrap(err)
+		case match:
+			resp.DesktopServices = append(resp.DesktopServices, svc.Clone())
+		}
 	}
 
 	return &resp, nil
@@ -161,13 +185,14 @@ type windowsDesktopIndex string
 
 const windowsDesktopNameIndex windowsDesktopIndex = "name"
 
-func newWindowsDesktopCollection(d services.WindowsDesktops, w types.WatchKind) (*collection[types.WindowsDesktop, windowsDesktopIndex], error) {
-	if d == nil {
-		return nil, trace.BadParameter("missing parameter Apps")
+func newWindowsDesktopCollection(upstream services.WindowsDesktops, w types.WatchKind) (*collection[types.WindowsDesktop, windowsDesktopIndex], error) {
+	if upstream == nil {
+		return nil, trace.BadParameter("missing parameter WindowsDesktops")
 	}
 
 	return &collection[types.WindowsDesktop, windowsDesktopIndex]{
 		store: newStore(
+			types.KindWindowsDesktop,
 			types.WindowsDesktop.Copy,
 			map[windowsDesktopIndex]func(types.WindowsDesktop) string{
 				windowsDesktopNameIndex: func(u types.WindowsDesktop) string {
@@ -175,7 +200,25 @@ func newWindowsDesktopCollection(d services.WindowsDesktops, w types.WatchKind)
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.WindowsDesktop, error) {
-			return d.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+			// TODO(tross): DELETE in V21.0.0  replace by regular clientutils.Resources
+			out, err := clientutils.CollectWithFallback(
+				ctx,
+				func(ctx context.Context, limit int, start string) ([]types.WindowsDesktop, string, error) {
+					resp, err := upstream.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+						Limit:    limit,
+						StartKey: start,
+					})
+					if err != nil {
+						return nil, "", trace.Wrap(err)
+					}
+					return resp.Desktops, resp.NextKey, nil
+				},
+				func(ctx context.Context) ([]types.WindowsDesktop, error) {
+					return upstream.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+				},
+			)
+
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.WindowsDesktop {
 			return &types.WindowsDesktopV3{
@@ -207,11 +250,19 @@ func (c *Cache) GetWindowsDesktops(ctx context.Context, filter types.WindowsDesk
 	defer rg.Release()
 
 	if !rg.ReadCache() {
-
 		desktops, err := c.Config.WindowsDesktops.GetWindowsDesktops(ctx, filter)
 		return desktops, trace.Wrap(err)
 	}
 
+	if filter.HostID != "" && filter.Name != "" {
+		match, err := rg.store.get(windowsDesktopNameIndex, filter.HostID+"/"+filter.Name)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return []types.WindowsDesktop{match}, nil
+	}
+
 	out := make([]types.WindowsDesktop, 0, rg.store.len())
 	for wd := range rg.store.resources(windowsDesktopNameIndex, "", "") {
 		if !filter.Match(wd) {
@@ -261,6 +312,7 @@ func (c *Cache) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDe
 	}
 
 	var resp types.ListWindowsDesktopsResponse
+
 	for wd := range rg.store.resources(windowsDesktopNameIndex, req.StartKey, "") {
 		if !req.WindowsDesktopFilter.Match(wd) {
 			continue
@@ -272,9 +324,8 @@ func (c *Cache) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDe
 		case match:
 			if len(resp.Desktops) == pageSize {
 				resp.NextKey = backend.GetPaginationKey(wd)
-				break
+				return &resp, nil
 			}
-
 			resp.Desktops = append(resp.Desktops, wd.Copy())
 		}
 	}
@@ -293,25 +344,14 @@ func newDynamicWindowsDesktopCollection(upstream services.DynamicWindowsDesktops
 
 	return &collection[types.DynamicWindowsDesktop, dynamicWindowsDesktopIndex]{
 		store: newStore(
+			types.KindDynamicWindowsDesktop,
 			types.DynamicWindowsDesktop.Copy,
 			map[dynamicWindowsDesktopIndex]func(types.DynamicWindowsDesktop) string{
 				dynamicWindowsDesktopNameIndex: types.DynamicWindowsDesktop.GetName,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.DynamicWindowsDesktop, error) {
-			var desktops []types.DynamicWindowsDesktop
-			var next string
-			for {
-				d, token, err := upstream.ListDynamicWindowsDesktops(ctx, 0, next)
-				if err != nil {
-					return nil, err
-				}
-				desktops = append(desktops, d...)
-				if token == "" {
-					break
-				}
-				next = token
-			}
-			return desktops, nil
+			out, err := stream.Collect(clientutils.Resources(ctx, upstream.ListDynamicWindowsDesktops))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) types.DynamicWindowsDesktop {
 			return &types.DynamicWindowsDesktopV1{
diff --git a/lib/cache/windows_desktop_test.go b/lib/cache/windows_desktop_test.go
index 697137e5fd987..588da36f48d80 100644
--- a/lib/cache/windows_desktop_test.go
+++ b/lib/cache/windows_desktop_test.go
@@ -19,13 +19,146 @@ package cache
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 )
 
+// TestWindowsDesktops tests that CRUD operations on
+// windows desktop resources are replicated from the backend to the cache.
+func TestWindowsDesktop(t *testing.T) {
+	t.Parallel()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	testResources(t, p, testFuncs[types.WindowsDesktop]{
+		newResource: func(name string) (types.WindowsDesktop, error) {
+			return types.NewWindowsDesktopV3(
+				name,
+				nil,
+				types.WindowsDesktopSpecV3{
+					Addr:   "localhost:123",
+					HostID: "123e",
+				},
+			)
+		},
+		create: p.windowsDesktops.CreateWindowsDesktop,
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktop, string, error) {
+			var desktops []types.WindowsDesktop
+			req := types.ListWindowsDesktopsRequest{
+				StartKey: pageToken,
+				Limit:    pageSize,
+			}
+
+			resp, err := p.windowsDesktops.ListWindowsDesktops(ctx, req)
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			desktops = append(desktops, resp.Desktops...)
+
+			return desktops, resp.NextKey, nil
+		},
+		cacheGet: func(ctx context.Context, s string) (types.WindowsDesktop, error) {
+			desktops, err := p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{Name: s})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			if len(desktops) == 0 {
+				return nil, trace.NotFound("desktop %q not found", s)
+			}
+
+			return desktops[0], nil
+
+		},
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktop, string, error) {
+			var desktops []types.WindowsDesktop
+			req := types.ListWindowsDesktopsRequest{
+				StartKey: pageToken,
+				Limit:    pageSize,
+			}
+
+			resp, err := p.cache.ListWindowsDesktops(ctx, req)
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			desktops = append(desktops, resp.Desktops...)
+			return desktops, resp.NextKey, nil
+		},
+		update:    p.windowsDesktops.UpdateWindowsDesktop,
+		deleteAll: p.windowsDesktops.DeleteAllWindowsDesktops,
+	})
+
+	wd1, err := types.NewWindowsDesktopV3(
+		"test",
+		nil,
+		types.WindowsDesktopSpecV3{
+			Addr:   "localhost:123",
+			HostID: "b",
+		},
+	)
+	require.NoError(t, err)
+
+	wd2, err := types.NewWindowsDesktopV3(
+		"test",
+		nil,
+		types.WindowsDesktopSpecV3{
+			Addr:   "localhost:123",
+			HostID: "a",
+		},
+	)
+	require.NoError(t, err)
+
+	wd3, err := types.NewWindowsDesktopV3(
+		"fox",
+		nil,
+		types.WindowsDesktopSpecV3{
+			Addr:   "localhost:123",
+			HostID: "a",
+		},
+	)
+	require.NoError(t, err)
+
+	require.NoError(t, p.windowsDesktops.CreateWindowsDesktop(t.Context(), wd1))
+	require.NoError(t, p.windowsDesktops.CreateWindowsDesktop(t.Context(), wd2))
+	require.NoError(t, p.windowsDesktops.CreateWindowsDesktop(t.Context(), wd3))
+
+	ctx := t.Context()
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		resp, err := p.cache.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{})
+		require.NoError(t, err)
+		require.Len(t, resp.Desktops, 3)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	out, err := p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.Len(t, out, 3)
+
+	out, err = p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{HostID: "a", Name: "test"})
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+
+	out, err = p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{HostID: "a"})
+	require.NoError(t, err)
+	require.Len(t, out, 2)
+
+	out, err = p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{HostID: "b"})
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+
+	out, err = p.cache.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{Name: "test"})
+	require.NoError(t, err)
+	require.Len(t, out, 2)
+}
+
 // TestWindowsDesktopService tests that CRUD operations on
 // windows desktop service resources are replicated from the backend to the cache.
 func TestWindowsDesktopService(t *testing.T) {
@@ -48,12 +181,12 @@ func TestWindowsDesktopService(t *testing.T) {
 				)
 			},
 			create:    withKeepalive(p.presenceS.UpsertWindowsDesktopService),
-			list:      p.presenceS.GetWindowsDesktopServices,
+			list:      getAllAdapter(p.presenceS.GetWindowsDesktopServices),
 			cacheGet:  p.cache.GetWindowsDesktopService,
-			cacheList: p.cache.GetWindowsDesktopServices,
+			cacheList: getAllAdapter(p.cache.GetWindowsDesktopServices),
 			update:    withKeepalive(p.presenceS.UpsertWindowsDesktopService),
 			deleteAll: p.presenceS.DeleteAllWindowsDesktopServices,
-		})
+		}, withSkipPaginationTest())
 	})
 
 	t.Run("ListResources", func(t *testing.T) {
@@ -70,54 +203,44 @@ func TestWindowsDesktopService(t *testing.T) {
 				)
 			},
 			create: withKeepalive(p.presenceS.UpsertWindowsDesktopService),
-			list: func(ctx context.Context) ([]types.WindowsDesktopService, error) {
+			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktopService, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindWindowsDesktopService,
+					StartKey:     pageToken,
+					Limit:        int32(pageSize),
 				}
 
 				var out []types.WindowsDesktopService
-				for {
-					resp, err := p.presenceS.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.WindowsDesktopService))
-					}
-
-					req.StartKey = resp.NextKey
-					if req.StartKey == "" {
-						break
-					}
+				resp, err := p.presenceS.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.WindowsDesktopService))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			cacheGet: p.cache.GetWindowsDesktopService,
-			cacheList: func(ctx context.Context) ([]types.WindowsDesktopService, error) {
+			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktopService, string, error) {
 				req := proto.ListResourcesRequest{
 					ResourceType: types.KindWindowsDesktopService,
+					Limit:        int32(pageSize),
+					StartKey:     pageToken,
 				}
 
 				var out []types.WindowsDesktopService
-				for {
-					resp, err := p.cache.ListResources(ctx, req)
-					if err != nil {
-						return nil, trace.Wrap(err)
-					}
-
-					for _, s := range resp.Resources {
-						out = append(out, s.(types.WindowsDesktopService))
-					}
-
-					req.StartKey = resp.NextKey
-					if req.StartKey == "" {
-						break
-					}
+				resp, err := p.cache.ListResources(ctx, req)
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+
+				for _, s := range resp.Resources {
+					out = append(out, s.(types.WindowsDesktopService))
 				}
 
-				return out, nil
+				return out, resp.NextKey, nil
 			},
 			update:    withKeepalive(p.presenceS.UpsertWindowsDesktopService),
 			deleteAll: p.presenceS.DeleteAllWindowsDesktopServices,
@@ -144,15 +267,9 @@ func TestDynamicWindowsDesktop(t *testing.T) {
 			_, err := p.dynamicWindowsDesktops.CreateDynamicWindowsDesktop(ctx, dwd)
 			return err
 		},
-		list: func(ctx context.Context) ([]types.DynamicWindowsDesktop, error) {
-			desktops, _, err := p.dynamicWindowsDesktops.ListDynamicWindowsDesktops(ctx, 0, "")
-			return desktops, err
-		},
-		cacheGet: p.cache.GetDynamicWindowsDesktop,
-		cacheList: func(ctx context.Context) ([]types.DynamicWindowsDesktop, error) {
-			desktops, _, err := p.cache.ListDynamicWindowsDesktops(ctx, 0, "")
-			return desktops, err
-		},
+		list:      p.dynamicWindowsDesktops.ListDynamicWindowsDesktops,
+		cacheGet:  p.cache.GetDynamicWindowsDesktop,
+		cacheList: p.cache.ListDynamicWindowsDesktops,
 		update: func(ctx context.Context, dwd types.DynamicWindowsDesktop) error {
 			_, err := p.dynamicWindowsDesktops.UpdateDynamicWindowsDesktop(ctx, dwd)
 			return err
diff --git a/lib/cache/workload_identity.go b/lib/cache/workload_identity.go
index ac8a258b47946..daa6fe9066c8d 100644
--- a/lib/cache/workload_identity.go
+++ b/lib/cache/workload_identity.go
@@ -19,19 +19,26 @@ package cache
 
 import (
 	"context"
+	"encoding/base32"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/text/cases"
 	"google.golang.org/protobuf/proto"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
 type workloadIdentityIndex string
 
-const workloadIdentityNameIndex workloadIdentityIndex = "name"
+const (
+	workloadIdentityNameIndex     workloadIdentityIndex = "name"
+	workloadIdentitySpiffeIDIndex workloadIdentityIndex = "spiffe_id"
+)
 
 func newWorkloadIdentityCollection(upstream services.WorkloadIdentities, w types.WatchKind) (*collection[*workloadidentityv1pb.WorkloadIdentity, workloadIdentityIndex], error) {
 	if upstream == nil {
@@ -40,30 +47,18 @@ func newWorkloadIdentityCollection(upstream services.WorkloadIdentities, w types
 
 	return &collection[*workloadidentityv1pb.WorkloadIdentity, workloadIdentityIndex]{
 		store: newStore(
+			types.KindWorkloadIdentity,
 			proto.CloneOf[*workloadidentityv1pb.WorkloadIdentity],
 			map[workloadIdentityIndex]func(*workloadidentityv1pb.WorkloadIdentity) string{
-				workloadIdentityNameIndex: func(r *workloadidentityv1pb.WorkloadIdentity) string {
-					return r.GetMetadata().GetName()
-				},
+				workloadIdentityNameIndex:     keyForWorkloadIdentityNameIndex,
+				workloadIdentitySpiffeIDIndex: keyForWorkloadIdentitySpiffeIDIndex,
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*workloadidentityv1pb.WorkloadIdentity, error) {
-			var out []*workloadidentityv1pb.WorkloadIdentity
-			var nextToken string
-			for {
-				var page []*workloadidentityv1pb.WorkloadIdentity
-				var err error
-
-				const defaultPageSize = 0
-				page, nextToken, err = upstream.ListWorkloadIdentities(ctx, defaultPageSize, nextToken)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				out = append(out, page...)
-				if nextToken == "" {
-					break
-				}
-			}
-			return out, nil
+			out, err := stream.Collect(clientutils.Resources(ctx,
+				func(ctx context.Context, pageSize int, currentToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
+					return upstream.ListWorkloadIdentities(ctx, pageSize, currentToken, nil)
+				}))
+			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *workloadidentityv1pb.WorkloadIdentity {
 			return &workloadidentityv1pb.WorkloadIdentity{
@@ -79,18 +74,43 @@ func newWorkloadIdentityCollection(upstream services.WorkloadIdentities, w types
 }
 
 // ListWorkloadIdentities returns a paginated list of WorkloadIdentity resources.
-func (c *Cache) ListWorkloadIdentities(ctx context.Context, pageSize int, nextToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
+func (c *Cache) ListWorkloadIdentities(
+	ctx context.Context,
+	pageSize int,
+	nextToken string,
+	options *services.ListWorkloadIdentitiesRequestOptions,
+) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
 	ctx, span := c.Tracer.Start(ctx, "cache/ListWorkloadIdentities")
 	defer span.End()
 
+	index := workloadIdentityNameIndex
+	keyFn := keyForWorkloadIdentityNameIndex
+	isDesc := options.GetSortDesc()
+	switch options.GetSortField() {
+	case "name":
+		index = workloadIdentityNameIndex
+		keyFn = keyForWorkloadIdentityNameIndex
+	case "spiffe_id":
+		index = workloadIdentitySpiffeIDIndex
+		keyFn = keyForWorkloadIdentitySpiffeIDIndex
+	case "":
+		// default ordering as defined above
+	default:
+		return nil, "", trace.BadParameter("unsupported sort %q but expected name or spiffe_id", options.GetSortField())
+	}
+
 	lister := genericLister[*workloadidentityv1pb.WorkloadIdentity, workloadIdentityIndex]{
-		cache:        c,
-		collection:   c.collections.workloadIdentity,
-		index:        workloadIdentityNameIndex,
-		upstreamList: c.Config.WorkloadIdentity.ListWorkloadIdentities,
-		nextToken: func(t *workloadidentityv1pb.WorkloadIdentity) string {
-			return t.GetMetadata().GetName()
+		cache:      c,
+		collection: c.collections.workloadIdentity,
+		index:      index,
+		isDesc:     isDesc,
+		upstreamList: func(ctx context.Context, pageSize int, nextToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
+			return c.Config.WorkloadIdentity.ListWorkloadIdentities(ctx, pageSize, nextToken, options)
 		},
+		filter: func(b *workloadidentityv1pb.WorkloadIdentity) bool {
+			return services.MatchWorkloadIdentity(b, options.GetFilterSearchTerm())
+		},
+		nextToken: keyFn,
 	}
 	out, next, err := lister.list(ctx, pageSize, nextToken)
 	return out, next, trace.Wrap(err)
@@ -110,3 +130,18 @@ func (c *Cache) GetWorkloadIdentity(ctx context.Context, name string) (*workload
 	out, err := getter.get(ctx, name)
 	return out, trace.Wrap(err)
 }
+
+func keyForWorkloadIdentityNameIndex(r *workloadidentityv1pb.WorkloadIdentity) string {
+	return r.GetMetadata().GetName()
+}
+
+func keyForWorkloadIdentitySpiffeIDIndex(r *workloadidentityv1pb.WorkloadIdentity) string {
+	name := keyForWorkloadIdentityNameIndex(r)
+	// Sort case-insensitively to keep /spiffe-1 and /Spiffe-1 together
+	spiffeID := cases.Fold().String(r.GetSpec().GetSpiffe().GetId())
+	// Encode the id avoid; "a/b" + "/" + "c" vs. "a" + "/" + "b/c". Base32 hex
+	// maintains original ordering.
+	spiffeID = base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString([]byte(spiffeID))
+	// SPIFFE IDs may not be unique, so append the resource name
+	return spiffeID + "/" + name
+}
diff --git a/lib/cache/workload_identity_test.go b/lib/cache/workload_identity_test.go
index da82d64fec27c..dd8d5648341c9 100644
--- a/lib/cache/workload_identity_test.go
+++ b/lib/cache/workload_identity_test.go
@@ -18,13 +18,18 @@ package cache
 
 import (
 	"context"
+	"strconv"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 func newWorkloadIdentity(name string) *workloadidentityv1pb.WorkloadIdentity {
@@ -48,27 +53,282 @@ func TestWorkloadIdentity(t *testing.T) {
 	p := newTestPack(t, ForAuth)
 	t.Cleanup(p.Close)
 
-	testResources153(t, p, testFuncs153[*workloadidentityv1pb.WorkloadIdentity]{
+	testResources153(t, p, testFuncs[*workloadidentityv1pb.WorkloadIdentity]{
 		newResource: func(s string) (*workloadidentityv1pb.WorkloadIdentity, error) {
 			return newWorkloadIdentity(s), nil
 		},
-
 		create: func(ctx context.Context, item *workloadidentityv1pb.WorkloadIdentity) error {
 			_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, item)
 			return trace.Wrap(err)
 		},
-		list: func(ctx context.Context) ([]*workloadidentityv1pb.WorkloadIdentity, error) {
-			items, _, err := p.workloadIdentity.ListWorkloadIdentities(ctx, 0, "")
-			return items, trace.Wrap(err)
+		list: func(ctx context.Context, pageSize int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
+			return p.workloadIdentity.ListWorkloadIdentities(ctx, pageSize, pageToken, nil)
 		},
 		deleteAll: func(ctx context.Context) error {
 			return p.workloadIdentity.DeleteAllWorkloadIdentities(ctx)
 		},
 
-		cacheList: func(ctx context.Context) ([]*workloadidentityv1pb.WorkloadIdentity, error) {
-			items, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "")
-			return items, trace.Wrap(err)
+		cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
+			return p.cache.ListWorkloadIdentities(ctx, 0, "", nil)
 		},
 		cacheGet: p.cache.GetWorkloadIdentity,
+	}, withSkipPaginationTest())
+}
+
+// TestWorkloadIdentityCacheSorting tests that cache items are sorted.
+func TestWorkloadIdentityCacheSorting(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	rs := []struct {
+		name     string
+		spiffeID string
+	}{
+		{"test-workload-identity-1", "/test/spiffe/2"},
+		{"test-workload-identity-3", "/test/spiffe/1"},
+		{"test-workload-identity-2", "/test/spiffe/3"},
+		{"Test-workload-identity-4", "/Test/spiffe/2"},
+		{"Test-workload-identity-5", "/Test/spiffe/1"},
+		{"Test-workload-identity-6", "/Test/spiffe/3"},
+	}
+
+	for _, r := range rs {
+		id := &workloadidentityv1pb.WorkloadIdentity{
+			Kind:    types.KindWorkloadIdentity,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: r.name,
+			},
+			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: r.spiffeID,
+				},
+			},
+		}
+
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, id)
+		require.NoError(t, err, "failed to create WorkloadIdentity %q", r.name)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 6)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	t.Run("sort ascending by spiffe_id", func(t *testing.T) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "spiffe_id",
+			SortDesc:  false,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 6)
+		assert.Equal(t, "/Test/spiffe/1", results[0].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/test/spiffe/1", results[1].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/Test/spiffe/2", results[2].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/test/spiffe/2", results[3].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/Test/spiffe/3", results[4].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/test/spiffe/3", results[5].GetSpec().GetSpiffe().GetId())
+	})
+
+	t.Run("sort descending by spiffe_id", func(t *testing.T) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "spiffe_id",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 6)
+		assert.Equal(t, "/test/spiffe/3", results[0].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/Test/spiffe/3", results[1].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/test/spiffe/2", results[2].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/Test/spiffe/2", results[3].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/test/spiffe/1", results[4].GetSpec().GetSpiffe().GetId())
+		assert.Equal(t, "/Test/spiffe/1", results[5].GetSpec().GetSpiffe().GetId())
+	})
+
+	t.Run("sort ascending by name", func(t *testing.T) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", nil) // empty sort should default to `name:asc`
+		require.NoError(t, err)
+		require.Len(t, results, 6)
+		assert.Equal(t, "Test-workload-identity-4", results[0].GetMetadata().GetName())
+		assert.Equal(t, "Test-workload-identity-5", results[1].GetMetadata().GetName())
+		assert.Equal(t, "Test-workload-identity-6", results[2].GetMetadata().GetName())
+		assert.Equal(t, "test-workload-identity-1", results[3].GetMetadata().GetName())
+		assert.Equal(t, "test-workload-identity-2", results[4].GetMetadata().GetName())
+		assert.Equal(t, "test-workload-identity-3", results[5].GetMetadata().GetName())
+	})
+
+	t.Run("sort descending by name", func(t *testing.T) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "name",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 6)
+		assert.Equal(t, "test-workload-identity-3", results[0].GetMetadata().GetName())
+		assert.Equal(t, "test-workload-identity-2", results[1].GetMetadata().GetName())
+		assert.Equal(t, "test-workload-identity-1", results[2].GetMetadata().GetName())
+		assert.Equal(t, "Test-workload-identity-6", results[3].GetMetadata().GetName())
+		assert.Equal(t, "Test-workload-identity-5", results[4].GetMetadata().GetName())
+		assert.Equal(t, "Test-workload-identity-4", results[5].GetMetadata().GetName())
+	})
+}
+
+// TestWorkloadIdentityCacheFallback tests that requests fallback to the upstream when the cache is unhealthy.
+func TestWorkloadIdentityCacheFallback(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, func(cfg Config) Config {
+		cfg.neverOK = true // Force the cache into an unhealthy state
+		return ForAuth(cfg)
+	})
+	t.Cleanup(p.Close)
+
+	_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "test-workload-identity-1",
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id: "/test/spiffe/1",
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 1)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	t.Run("supported sort", func(t *testing.T) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "name",
+			SortDesc:  false,
+		})
+		require.NoError(t, err) // asc by name is the only sort supported by the upstream
+		require.Len(t, results, 1)
+	})
+
+	t.Run("unsupported sort field", func(t *testing.T) {
+		_, _, err = p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "spiffe_id",
+		})
+		require.ErrorContains(t, err, `unsupported sort, only name field is supported, but got "spiffe_id"`)
+	})
+
+	t.Run("unsupported sort dir", func(t *testing.T) {
+		_, _, err = p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortDesc: true,
+		})
+		require.ErrorContains(t, err, "unsupported sort, only ascending order is supported")
 	})
 }
+
+// TestWorkloadIdentityCacheSearchFilter tests that cache items are filtered by search query.
+func TestWorkloadIdentityCacheSearchFilter(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, ForAuth)
+	t.Cleanup(p.Close)
+
+	for n := range 10 {
+		name := "test-workload-identity-" + strconv.Itoa(n)
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			Kind:    types.KindWorkloadIdentity,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/test/" + strconv.Itoa(n%2) + "/id" + strconv.Itoa(n),
+				},
+			},
+		})
+		require.NoError(t, err, "failed to create WorkloadIdentity %q", name)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, results, 10)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+		FilterSearchTerm: "test/1",
+	})
+	require.NoError(t, err)
+	require.Len(t, results, 5)
+}
+
+// TestWorkloadIdentityCaseSensitiveName tests that workload identity name index keys remain case sensitive.
+func TestWorkloadIdentityCaseSensitiveName(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	p := newTestPack(t, func(cfg Config) Config {
+		return ForAuth(cfg)
+	})
+	t.Cleanup(p.Close)
+
+	{
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			Kind:    types.KindWorkloadIdentity,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "TEST-WORKLOAD-IDENTITY-1",
+			},
+			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/test/spiffe/1",
+				},
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	{
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			Kind:    types.KindWorkloadIdentity,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test-workload-identity-1",
+			},
+			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/test/spiffe/1",
+				},
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	// Let the cache catch up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		results, _, err := p.cache.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "name",
+			SortDesc:  true,
+		})
+		require.NoError(t, err)
+		require.Len(t, results, 2)
+
+		require.Equal(t, "test-workload-identity-1", results[0].Metadata.Name)
+		require.Equal(t, "TEST-WORKLOAD-IDENTITY-1", results[1].Metadata.Name)
+	}, 10*time.Second, 100*time.Millisecond)
+}
diff --git a/lib/cgroup/cgroup_test.go b/lib/cgroup/cgroup_test.go
index fdd341ff6f25a..8280932e98b58 100644
--- a/lib/cgroup/cgroup_test.go
+++ b/lib/cgroup/cgroup_test.go
@@ -29,11 +29,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/circleci/circleci.go b/lib/circleci/circleci.go
deleted file mode 100644
index ab0e78b1e063b..0000000000000
--- a/lib/circleci/circleci.go
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-// CircleCI workload identity
-//
-// Key values:
-// Issuer of tokens: `https://oidc.circleci.com/org/ORGANIZATION_ID`
-// Audience: `ORGANIZATION_ID`
-//
-// `iat` and `exp` will be included and should be respected.
-//
-// Useful references:
-// - https://circleci.com/docs/openid-connect-tokens/
-
-package circleci
-
-import (
-	"fmt"
-
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-const IssuerURLTemplate = "https://oidc.circleci.com/org/%s"
-
-func issuerURL(template, organizationID string) string {
-	return fmt.Sprintf(template, organizationID)
-}
-
-// IDTokenClaims is the structure of claims contained with a CircleCI issued
-// ID token.
-// See https://circleci.com/docs/openid-connect-tokens/
-type IDTokenClaims struct {
-	oidc.TokenClaims
-
-	// Sub identifies who is running the CircleCI job and where.
-	// In the format of: `org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID`
-	Sub string `json:"sub"`
-	// ContextIDs is a list of UUIDs for the contexts used in the job.
-	ContextIDs []string `json:"oidc.circleci.com/context-ids"`
-	// ProjectID is the ID of the project in which the job is running.
-	ProjectID string `json:"oidc.circleci.com/project-id"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsCircleCI {
-	return &workloadidentityv1pb.JoinAttrsCircleCI{
-		Sub:        c.Sub,
-		ContextIds: c.ContextIDs,
-		ProjectId:  c.ProjectID,
-	}
-}
diff --git a/lib/circleci/token_validator.go b/lib/circleci/token_validator.go
deleted file mode 100644
index d9242d42d6ca4..0000000000000
--- a/lib/circleci/token_validator.go
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package circleci
-
-import (
-	"context"
-
-	"github.com/gravitational/teleport/lib/oidc"
-)
-
-func ValidateToken(
-	ctx context.Context,
-	issuerURLTemplate string,
-	organizationID string,
-	token string,
-) (*IDTokenClaims, error) {
-	issuer := issuerURL(issuerURLTemplate, organizationID)
-	return oidc.ValidateToken[*IDTokenClaims](ctx, issuer, organizationID, token)
-}
diff --git a/lib/circleci/token_validator_test.go b/lib/circleci/token_validator_test.go
deleted file mode 100644
index 882ded4d2f42b..0000000000000
--- a/lib/circleci/token_validator_test.go
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package circleci
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/go-jose/go-jose/v3"
-	"github.com/go-jose/go-jose/v3/jwt"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/stretchr/testify/require"
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	"github.com/gravitational/teleport/lib/cryptosuites"
-)
-
-// fakeIDP pretends to be a circle CI org OIDC provider, e.g:
-// https://oidc.circleci.com/org/00f45056-5918-4171-9222-b538c76ed3f8/.well-known/openid-configuration
-type fakeIDP struct {
-	signer jose.Signer
-	server *httptest.Server
-}
-
-func (f *fakeIDP) issueToken(
-	t *testing.T,
-	organizationID string,
-	projectID string,
-	contextIDs []string,
-	issuedAt time.Time,
-	expiry time.Time,
-) string {
-	stdClaims := jwt.Claims{
-		Issuer:   fmt.Sprintf(f.issuerURLTemplate(), organizationID),
-		Subject:  fmt.Sprintf("org/%s/project/%s/user/USER_ID", organizationID, projectID),
-		Audience: jwt.Audience{organizationID},
-		IssuedAt: jwt.NewNumericDate(issuedAt),
-		Expiry:   jwt.NewNumericDate(expiry),
-	}
-	customClaims := map[string]interface{}{
-		"oidc.circleci.com/project-id":  projectID,
-		"oidc.circleci.com/context-ids": contextIDs,
-	}
-	token, err := jwt.Signed(f.signer).
-		Claims(stdClaims).
-		Claims(customClaims).
-		CompactSerialize()
-	require.NoError(t, err)
-
-	return token
-}
-
-func (f *fakeIDP) issuerURLTemplate() string {
-	return f.server.URL + "/org/%s"
-}
-
-func newFakeIDP(t *testing.T, organizationID string) *fakeIDP {
-	// Generate keypair for IDP
-	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA2048)
-	require.NoError(t, err)
-
-	signer, err := jose.NewSigner(
-		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
-		(&jose.SignerOptions{}).WithType("JWT"),
-	)
-	require.NoError(t, err)
-
-	providerMux := http.NewServeMux()
-	srv := httptest.NewServer(providerMux)
-	t.Cleanup(srv.Close)
-	orgURL := "/org/" + organizationID
-	providerMux.HandleFunc(orgURL+"/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
-		response := map[string]interface{}{
-			"claims_supported": []string{
-				"sub",
-				"aud",
-				"exp",
-				"iat",
-				"iss",
-				"jti",
-				"oidc.circleci.com/project-id",
-				"oidc.circleci.com/context-ids",
-			},
-			"id_token_signing_alg_values_supported": []string{"RS256"},
-			"issuer":                                srv.URL + orgURL,
-			"jwks_uri": fmt.Sprintf(
-				"%s/.well-known/jwks-pub.json",
-				srv.URL+orgURL,
-			),
-			"response_types_supported": []string{"id_token"},
-			"scopes_supported":         []string{"openid"},
-			"subject_types_supported":  []string{"public", "pairwise"},
-		}
-		responseBytes, err := json.Marshal(response)
-		require.NoError(t, err)
-		_, err = w.Write(responseBytes)
-		require.NoError(t, err)
-	})
-	providerMux.HandleFunc(orgURL+"/.well-known/jwks-pub.json", func(w http.ResponseWriter, r *http.Request) {
-		// mimic jwks endpoint with our own key
-		jwks := jose.JSONWebKeySet{
-			Keys: []jose.JSONWebKey{
-				{
-					Key: privateKey.Public(),
-				},
-			},
-		}
-		responseBytes, err := json.Marshal(jwks)
-		require.NoError(t, err)
-		_, err = w.Write(responseBytes)
-		require.NoError(t, err)
-	})
-
-	return &fakeIDP{
-		signer: signer,
-		server: srv,
-	}
-}
-
-func TestValidateToken(t *testing.T) {
-	t.Parallel()
-	realOrgID := "xyz-foo-bar-123"
-	fake := newFakeIDP(t, realOrgID)
-
-	tests := []struct {
-		name        string
-		assertError require.ErrorAssertionFunc
-		want        *IDTokenClaims
-		token       string
-	}{
-		{
-			name:        "success",
-			assertError: require.NoError,
-			token: fake.issueToken(
-				t,
-				realOrgID,
-				"a-project",
-				[]string{"a-context"},
-				time.Now().Add(-5*time.Minute),
-				time.Now().Add(5*time.Minute),
-			),
-			want: &IDTokenClaims{
-				ContextIDs: []string{"a-context"},
-				ProjectID:  "a-project",
-				Sub:        "org/xyz-foo-bar-123/project/a-project/user/USER_ID",
-			},
-		},
-		{
-			name:        "expired",
-			assertError: require.Error,
-			token: fake.issueToken(
-				t,
-				realOrgID,
-				"a-project",
-				[]string{"a-context"},
-				time.Now().Add(-10*time.Minute),
-				time.Now().Add(-5*time.Minute),
-			),
-		},
-		{
-			name:        "another org",
-			assertError: require.Error,
-			token: fake.issueToken(
-				t,
-				"not-the-configured-org",
-				"a-project",
-				[]string{"a-context"},
-				time.Now().Add(-5*time.Minute),
-				time.Now().Add(5*time.Minute),
-			),
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			claims, err := ValidateToken(
-				ctx, fake.issuerURLTemplate(), realOrgID, tt.token,
-			)
-			tt.assertError(t, err)
-			require.Empty(t,
-				cmp.Diff(claims, tt.want, cmpopts.IgnoreTypes(oidc.TokenClaims{})),
-			)
-		})
-	}
-}
diff --git a/lib/client/api.go b/lib/client/api.go
index 07e04f8b41ef6..b4aa1480d6980 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -28,6 +28,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net"
 	"net/url"
 	"os"
@@ -72,6 +73,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
+	"github.com/gravitational/teleport/api/utils/pingconn"
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/touchid"
@@ -92,11 +94,9 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/agentconn"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
@@ -195,6 +195,10 @@ type Config struct {
 	// (for example, using command-line flags).
 	ExplicitUsername bool
 
+	// Scope is the target scope, used during authentication/login to request certificates
+	// that are limited (pinned) to a given target scope.
+	Scope string
+
 	// Remote host to connect
 	Host string
 
@@ -240,6 +244,18 @@ type Config struct {
 	// MySQLProxyAddr is the host:port the MySQL proxy can be accessed at.
 	MySQLProxyAddr string
 
+	// RelayAddr is the user-specified address of the relay in use.
+	RelayAddr string
+
+	// ProfileRelayAddr is the relay address specified at login time, or "none"
+	// if use of a relay is explicitly disabled.
+	ProfileRelayAddr string
+
+	// ProfileDefaultRelayAddr is the cluster-specified address of the relay, to
+	// be used if no explicit override is specified by the user. Set at login
+	// time.
+	ProfileDefaultRelayAddr string
+
 	// KeyTTL is a time to live for the temporary SSH keypair to remain valid:
 	KeyTTL time.Duration
 
@@ -511,6 +527,9 @@ type Config struct {
 
 	// SSOHost is the host of the SSO provider used to log in.
 	SSOHost string
+
+	// ProxyTemplates describe rules for parsing out proxy out of full hostnames.
+	ProxyTemplates ProxyTemplates
 }
 
 // CachePolicy defines cache policy for local clients
@@ -521,24 +540,6 @@ type CachePolicy struct {
 	NeverExpires bool
 }
 
-// MakeDefaultConfig returns default client config.
-// If store is not provided, it will default to in-memory storage without
-// hardware key support. This should only be used with static auth methods
-// (TLS and AuthMethods fields).
-func MakeDefaultConfig(store *Store) *Config {
-	if store == nil {
-		store = NewMemClientStore()
-	}
-	return &Config{
-		Stdout:         os.Stdout,
-		Stderr:         os.Stderr,
-		Stdin:          os.Stdin,
-		AddKeysToAgent: AddKeysToAgentAuto,
-		Tracer:         tracing.NoopProvider().Tracer("TeleportClient"),
-		ClientStore:    store,
-	}
-}
-
 func (c *Config) CheckAndSetDefaults() error {
 	if c.ClientStore == nil {
 		if c.TLS == nil && c.AuthMethods == nil {
@@ -746,7 +747,7 @@ func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error,
 		return trace.Wrap(err)
 	}
 
-	// Save profile to record proxy credentials
+	// Save profile to record proxy credentials.
 	if err := tc.SaveProfile(opt.makeCurrentProfile); err != nil {
 		log.WarnContext(ctx, "Failed to save profile", "error", err)
 		return trace.Wrap(err)
@@ -929,6 +930,8 @@ func (c *Config) LoadProfile(proxyAddr string) error {
 	c.PostgresProxyAddr = profile.PostgresProxyAddr
 	c.MySQLProxyAddr = profile.MySQLProxyAddr
 	c.MongoProxyAddr = profile.MongoProxyAddr
+	c.ProfileRelayAddr = profile.RelayAddr
+	c.ProfileDefaultRelayAddr = profile.DefaultRelayAddr
 	c.TLSRoutingEnabled = profile.TLSRoutingEnabled
 	c.TLSRoutingConnUpgradeRequired = profile.TLSRoutingConnUpgradeRequired
 	c.AuthConnector = profile.AuthConnector
@@ -957,6 +960,16 @@ func (c *Config) LoadProfile(proxyAddr string) error {
 		"web_proxy_addr", c.WebProxyAddr,
 		"upgrade_required", c.TLSRoutingConnUpgradeRequired,
 	)
+
+	switch profile.RelayAddr {
+	case "":
+		c.RelayAddr = profile.DefaultRelayAddr
+	case "none":
+		c.RelayAddr = ""
+	default:
+		c.RelayAddr = profile.RelayAddr
+	}
+
 	return nil
 }
 
@@ -983,6 +996,8 @@ func (c *Config) Profile() *profile.Profile {
 		PostgresProxyAddr:             c.PostgresProxyAddr,
 		MySQLProxyAddr:                c.MySQLProxyAddr,
 		MongoProxyAddr:                c.MongoProxyAddr,
+		RelayAddr:                     c.ProfileRelayAddr,
+		DefaultRelayAddr:              c.ProfileDefaultRelayAddr,
 		SiteName:                      c.SiteName,
 		TLSRoutingEnabled:             c.TLSRoutingEnabled,
 		TLSRoutingConnUpgradeRequired: c.TLSRoutingConnUpgradeRequired,
@@ -1260,10 +1275,6 @@ type TeleportClient struct {
 
 	localAgent *LocalKeyAgent
 
-	// OnChannelRequest gets called when SSH channel requests are
-	// received. It's safe to keep it nil.
-	OnChannelRequest tracessh.ChannelRequestCallback
-
 	// OnShellCreated gets called when the shell is created. It's
 	// safe to keep it nil.
 	OnShellCreated ShellCreatedCallback
@@ -1386,38 +1397,12 @@ func (tc *TeleportClient) LoadKeyForCluster(ctx context.Context, clusterName str
 	return nil
 }
 
-// LoadKeyForClusterWithReissue fetches a cluster-specific SSH key and loads it into the
-// SSH agent.  If the key is not found, it is requested to be reissued.
-func (tc *TeleportClient) LoadKeyForClusterWithReissue(ctx context.Context, clusterName string) error {
-	ctx, span := tc.Tracer.Start(
-		ctx,
-		"teleportClient/LoadKeyForClusterWithReissue",
-		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
-		oteltrace.WithAttributes(attribute.String("cluster", clusterName)),
-	)
-	defer span.End()
-
-	err := tc.LoadKeyForCluster(ctx, clusterName)
-	if err == nil {
-		return nil
-	}
-	if !trace.IsNotFound(err) {
-		return trace.Wrap(err)
-	}
-	// Reissuing also loads the new key.
-	err = tc.ReissueUserCerts(ctx, CertCacheKeep, ReissueParams{RouteToCluster: clusterName})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
 // SignersForClusterWithReissue fetches cluster-specific signers from stored certificates.
 // If the cluster certificates are not found, it is requested to be reissued.
 func (tc *TeleportClient) SignersForClusterWithReissue(ctx context.Context, clusterName string) ([]ssh.Signer, error) {
 	ctx, span := tc.Tracer.Start(
 		ctx,
-		"teleportClient/LoadKeyForClusterWithReissue",
+		"teleportClient/SignersForClusterWithReissue",
 		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
 		oteltrace.WithAttributes(attribute.String("cluster", clusterName)),
 	)
@@ -1591,32 +1576,64 @@ func (tc *TeleportClient) GetTargetNode(ctx context.Context, clt authclient.Clie
 		}, nil
 	}
 
-	if len(tc.Labels) == 0 && len(tc.SearchKeywords) == 0 && tc.PredicateExpression == "" {
-		log.DebugContext(ctx, "Using provided host", "host", tc.Host)
+	host := tc.Host
+	port := strconv.Itoa(tc.HostPort)
+	predExpr := tc.PredicateExpression
+	search := tc.SearchKeywords
+
+	// Apply proxy templates.
+	expanded, matched := tc.ProxyTemplates.Apply(net.JoinHostPort(host, port))
+	if matched {
+		log.DebugContext(ctx, "Matched proxy template for host",
+			slog.String("matched_host", host),
+			slog.Group("expanded",
+				"host", expanded.Host,
+				"query", expanded.Query,
+				"search", expanded.Search,
+			),
+		)
+		// Expanded template should override all previous search criteria.
+		host = ""
+		predExpr = ""
+		search = nil
+		if expanded.Host != "" {
+			host = expanded.Host
+			if expandedHost, expandedPort, err := net.SplitHostPort(expanded.Host); err == nil {
+				host = expandedHost
+				port = expandedPort
+			}
+		} else if expanded.Query != "" {
+			predExpr = expanded.Query
+		} else if expanded.Search != "" {
+			search = ParseSearchKeywords(expanded.Search, ',')
+		}
+	}
+
+	if len(tc.Labels) == 0 && len(search) == 0 && predExpr == "" {
+		log.DebugContext(ctx, "Using provided host", "host", host)
 
 		// detect the common error when users use host:port address format
-		_, port, err := net.SplitHostPort(tc.Host)
+		_, badPort, err := net.SplitHostPort(host)
 		// client has used host:port notation
 		if err == nil {
-			return nil, trace.BadParameter("please use ssh subcommand with '--port=%v' flag instead of semicolon", port)
+			return nil, trace.BadParameter("please use ssh subcommand with '--port=%v' flag instead of semicolon", badPort)
 		}
 
-		addr := net.JoinHostPort(tc.Host, strconv.Itoa(tc.HostPort))
 		return &TargetNode{
-			Hostname: tc.Host,
-			Addr:     addr,
+			Hostname: host,
+			Addr:     net.JoinHostPort(host, port),
 		}, nil
 	}
 
 	// Query for nodes if labels, fuzzy search, or predicate expressions were provided.
 	log.DebugContext(ctx, "Attempting to resolve matching host",
 		"labels", tc.Labels,
-		"search", tc.SearchKeywords,
-		"predicate", tc.PredicateExpression,
+		"search", search,
+		"predicate", predExpr,
 	)
 	resp, err := clt.ResolveSSHTarget(ctx, &proto.ResolveSSHTargetRequest{
-		PredicateExpression: tc.PredicateExpression,
-		SearchKeywords:      tc.SearchKeywords,
+		PredicateExpression: predExpr,
+		SearchKeywords:      search,
 		Labels:              tc.Labels,
 	})
 	switch {
@@ -1626,8 +1643,8 @@ func (tc *TeleportClient) GetTargetNode(ctx context.Context, clt authclient.Clie
 			Kinds:               []string{types.KindNode},
 			SortBy:              types.SortBy{Field: types.ResourceMetadataName},
 			Labels:              tc.Labels,
-			SearchKeywords:      tc.SearchKeywords,
-			PredicateExpression: tc.PredicateExpression,
+			SearchKeywords:      search,
+			PredicateExpression: predExpr,
 		})
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -1900,6 +1917,14 @@ type SSHOptions struct {
 	// machine. If provided, it will be used instead of establishing a connection
 	// to the target host and executing the command remotely.
 	LocalCommandExecutor func(string, []string) error
+	// OnChildAuthenticate is a function to run in the child process during
+	// --fork-after authentications. It runs after authentication completes
+	// but before the session begins.
+	OnChildAuthenticate func() error
+}
+
+func (opts SSHOptions) forkAfterAuthentication() bool {
+	return opts.OnChildAuthenticate != nil
 }
 
 // WithHostAddress returns a SSHOptions which overrides the
@@ -1918,6 +1943,15 @@ func WithLocalCommandExecutor(executor func(string, []string) error) func(*SSHOp
 	}
 }
 
+// WithForkAfterAuthentication indicates that tsh is currently reexec-ing
+// for --fork-after-authentication. The given function is called after
+// authentication is complete but before the session starts.
+func WithForkAfterAuthentication(onAuthenticate func() error) func(*SSHOptions) {
+	return func(opt *SSHOptions) {
+		opt.OnChildAuthenticate = onAuthenticate
+	}
+}
+
 // SSH connects to a node and, if 'command' is specified, executes the command on it,
 // otherwise runs interactive shell
 //
@@ -1960,9 +1994,14 @@ func (tc *TeleportClient) SSH(ctx context.Context, command []string, opts ...fun
 	}
 
 	if len(nodeAddrs) > 1 {
+		if options.forkAfterAuthentication() {
+			return &NonRetryableError{
+				Err: trace.BadParameter("fork after authentication not supported for commands on multiple nodes"),
+			}
+		}
 		return tc.runShellOrCommandOnMultipleNodes(ctx, clt, nodeAddrs, command)
 	}
-	return tc.runShellOrCommandOnSingleNode(ctx, clt, nodeAddrs[0].Addr, command, options.LocalCommandExecutor)
+	return tc.runShellOrCommandOnSingleNode(ctx, clt, nodeAddrs[0].Addr, command, options)
 }
 
 // ConnectToNode attempts to establish a connection to the node resolved to by the provided
@@ -2165,7 +2204,7 @@ func (tc *TeleportClient) connectToNodeWithMFA(ctx context.Context, clt *Cluster
 	return nodeClient, trace.Wrap(err)
 }
 
-func (tc *TeleportClient) runShellOrCommandOnSingleNode(ctx context.Context, clt *ClusterClient, nodeAddr string, command []string, commandExecutor func(string, []string) error) error {
+func (tc *TeleportClient) runShellOrCommandOnSingleNode(ctx context.Context, clt *ClusterClient, nodeAddr string, command []string, options SSHOptions) error {
 	cluster := clt.ClusterName()
 	ctx, span := tc.Tracer.Start(
 		ctx,
@@ -2189,6 +2228,12 @@ func (tc *TeleportClient) runShellOrCommandOnSingleNode(ctx context.Context, clt
 		return trace.Wrap(err)
 	}
 	defer nodeClient.Close()
+
+	if options.OnChildAuthenticate != nil {
+		if err := options.OnChildAuthenticate(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
 	// If forwarding ports were specified, start port forwarding.
 	if err := tc.startPortForwarding(ctx, nodeClient); err != nil {
 		return trace.Wrap(err)
@@ -2220,18 +2265,18 @@ func (tc *TeleportClient) runShellOrCommandOnSingleNode(ctx context.Context, clt
 
 	// After port forwarding, run a local command that uses the connection, and
 	// then disconnect.
-	if commandExecutor != nil {
+	if options.LocalCommandExecutor != nil {
 		if len(tc.Config.LocalForwardPorts) == 0 {
 			fmt.Println("Executing command locally without connecting to any servers. This makes no sense.")
 		}
-		return commandExecutor(tc.Config.HostLogin, command)
+		return options.LocalCommandExecutor(tc.Config.HostLogin, command)
 	}
 
 	if len(command) > 0 {
 		// Reuse the existing nodeClient we connected above.
 		return nodeClient.RunCommand(ctx, command)
 	}
-	return trace.Wrap(nodeClient.RunInteractiveShell(ctx, types.SessionPeerMode, nil, tc.OnChannelRequest, nil))
+	return trace.Wrap(nodeClient.RunInteractiveShell(ctx, "", "", nil))
 }
 
 func (tc *TeleportClient) runShellOrCommandOnMultipleNodes(ctx context.Context, clt *ClusterClient, nodes []TargetNode, command []string) error {
@@ -2259,7 +2304,7 @@ func (tc *TeleportClient) runShellOrCommandOnMultipleNodes(ctx context.Context,
 
 	// Issue "shell" request to the first matching node.
 	fmt.Printf("\x1b[1mWARNING\x1b[0m: Multiple nodes match the label selector, picking first: %q\n", nodeAddrs[0])
-	return tc.runShellOrCommandOnSingleNode(ctx, clt, nodeAddrs[0], nil, nil)
+	return tc.runShellOrCommandOnSingleNode(ctx, clt, nodeAddrs[0], nil, SSHOptions{})
 }
 
 func (tc *TeleportClient) startPortForwarding(ctx context.Context, nodeClient *NodeClient) error {
@@ -2333,7 +2378,7 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 			return trace.Wrap(err)
 		}
 	} else if services.IsRecordAtProxy(recConfig.GetMode()) {
-		return trace.BadParameter("session joining is not supported in proxy recording mode")
+		return trace.BadParameter("session joining is not supported in proxy recording mode. If you are a Teleport administrator, you can learn more about recording modes at: https://goteleport.com/docs/reference/architecture/session-recording")
 	}
 
 	session, err := clt.AuthClient.GetSessionTracker(ctx, string(sessionID))
@@ -2385,7 +2430,7 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	}
 
 	// running shell with a given session means "join" it:
-	err = nc.RunInteractiveShell(ctx, mode, session, tc.OnChannelRequest, beforeStart)
+	err = nc.RunInteractiveShell(ctx, sessionID.String(), mode, beforeStart)
 	return trace.Wrap(err)
 }
 
@@ -2525,6 +2570,10 @@ func playSession(ctx context.Context, sessionID string, speed float64, streamer
 		}
 	}
 
+	if err := player.Err(); err != nil {
+		return trace.Wrap(err)
+	}
+
 	return nil
 }
 
@@ -2544,8 +2593,23 @@ func PlayFile(ctx context.Context, filename, sid string, speed float64, skipIdle
 	return playSession(ctx, sid, speed, streamer, skipIdleTime)
 }
 
-// SFTP securely copies files between Nodes or SSH servers using SFTP
-func (tc *TeleportClient) SFTP(ctx context.Context, source []string, destination string, opts sftp.Options) (err error) {
+// SFTPRequest controls aspects of a file transfer.
+type SFTPRequest struct {
+	// Sources are the source paths to transfer from, with optional user and host.
+	Sources []string
+	// Destination is the destination path to transfer to, with optional user and host.
+	Destination string
+	// Recursive indicates recursive file transfer.
+	Recursive bool
+	// PreserveAttrs preserves access and modification times
+	// from the original file.
+	PreserveAttrs bool
+	// ProgressWriter is used to write the progress output.
+	ProgressWriter io.Writer
+}
+
+// SFTP securely copies files between Nodes or SSH servers using SFTP.
+func (tc *TeleportClient) SFTP(ctx context.Context, req SFTPRequest) error {
 	ctx, span := tc.Tracer.Start(
 		ctx,
 		"teleportClient/SFTP",
@@ -2553,53 +2617,71 @@ func (tc *TeleportClient) SFTP(ctx context.Context, source []string, destination
 	)
 	defer span.End()
 
-	isDownload := strings.ContainsRune(source[0], ':')
-	isUpload := strings.ContainsRune(destination, ':')
-
-	if !isUpload && !isDownload {
-		return trace.BadParameter("no remote destination specified")
-	}
-
 	clt, err := tc.ConnectToCluster(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	defer clt.Close()
 
-	// Respect any proxy templates and attempt host resolution.
-	target, err := tc.GetTargetNode(ctx, clt.AuthClient, nil)
+	// Parse sources and destination.
+	origHost := tc.Host
+	sources, err := sftp.ParseSources(req.Sources, tc.HostPort)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	var cfg *sftp.Config
-	switch {
-	case isDownload:
-		dest, err := sftp.ParseDestination(source[0])
+	if sources.Addr != nil {
+		// Respect any proxy templates and attempt host resolution.
+		tc.Host = sources.Addr.Host()
+		target, err := tc.GetTargetNode(ctx, clt.AuthClient, nil)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		cfg, err = sftp.CreateDownloadConfig(dest.Path, destination, opts)
-		if err != nil {
+		if err := sources.Addr.Set(target.Addr); err != nil {
 			return trace.Wrap(err)
 		}
-	case isUpload:
-		dest, err := sftp.ParseDestination(destination)
+	}
+	sources.Login = cmp.Or(sources.Login, tc.HostLogin)
+	dest, err := sftp.ParseTarget(req.Destination, tc.HostPort)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if dest.Addr != nil {
+		// Respect any proxy templates and attempt host resolution.
+		tc.Host = dest.Addr.Host()
+		target, err := tc.GetTargetNode(ctx, clt.AuthClient, nil)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		cfg, err = sftp.CreateUploadConfig(source, dest.Path, opts)
-		if err != nil {
+		if err := dest.Addr.Set(target.Addr); err != nil {
 			return trace.Wrap(err)
 		}
 	}
-
-	return trace.Wrap(tc.TransferFiles(ctx, clt, tc.HostLogin, target.Addr, cfg))
+	tc.Host = origHost
+	dest.Login = cmp.Or(dest.Login, tc.HostLogin)
+
+	sftpReq := &sftp.FileTransferRequest{
+		Sources:     sources,
+		Destination: dest,
+		DialHost: func(ctx context.Context, login, addr string) (*tracessh.Client, error) {
+			nodeClient, err := tc.ConnectToNode(ctx, clt, NodeDetails{
+				Addr:    addr,
+				Cluster: clt.ClusterName(),
+			}, login)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return nodeClient.Client, nil
+		},
+		Recursive:      req.Recursive,
+		PreserveAttrs:  req.PreserveAttrs,
+		ProgressWriter: req.ProgressWriter,
+	}
+	return trace.Wrap(tc.TransferFiles(ctx, sftpReq))
 }
 
 // TransferFiles copies files between the current machine and the
 // specified Node using the supplied config
-func (tc *TeleportClient) TransferFiles(ctx context.Context, clt *ClusterClient, hostLogin, nodeAddr string, cfg *sftp.Config) error {
+func (tc *TeleportClient) TransferFiles(ctx context.Context, req *sftp.FileTransferRequest) error {
 	ctx, span := tc.Tracer.Start(
 		ctx,
 		"teleportClient/TransferFiles",
@@ -2607,27 +2689,17 @@ func (tc *TeleportClient) TransferFiles(ctx context.Context, clt *ClusterClient,
 	)
 	defer span.End()
 
-	if hostLogin == "" {
-		return trace.BadParameter("host login is not specified")
-	}
-	if nodeAddr == "" {
-		return trace.BadParameter("node address is not specified")
-	}
+	if err := sftp.TransferFiles(ctx, req); err != nil {
+		// TODO(tross): DELETE IN 19.0.0 - Older versions of Teleport would return
+		// a trace.BadParameter error when ~user path expansion was rejected, and
+		// reauthentication logic is attempted on BadParameter errors.
+		if trace.IsBadParameter(err) && strings.Contains(err.Error(), "expanding remote ~user paths is not supported") {
+			return trace.Wrap(&NonRetryableError{Err: err})
+		}
 
-	nodeClient, err := tc.ConnectToNode(
-		ctx,
-		clt,
-		NodeDetails{
-			Addr:    nodeAddr,
-			Cluster: clt.ClusterName(),
-		},
-		hostLogin,
-	)
-	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	return trace.Wrap(nodeClient.TransferFiles(ctx, cfg))
+	return nil
 }
 
 // ListNodesWithFilters returns all nodes that match the filters in the current cluster
@@ -3056,20 +3128,6 @@ func (tc *TeleportClient) writeCommandResults(nodes []execResult) error {
 	return nil
 }
 
-func (tc *TeleportClient) newSessionEnv() map[string]string {
-	env := map[string]string{
-		teleport.SSHSessionWebProxyAddr: tc.WebProxyAddr,
-	}
-	if tc.SessionID != "" {
-		env[sshutils.SessionEnvVar] = tc.SessionID
-	}
-
-	for key, val := range tc.ExtraEnvs {
-		env[key] = val
-	}
-	return env
-}
-
 // getProxyLogin determines which SSH principal to use when connecting to proxy.
 func (tc *TeleportClient) getProxySSHPrincipal() string {
 	if tc.ProxySSHPrincipal != "" {
@@ -3147,6 +3205,7 @@ func (tc *TeleportClient) ConnectToCluster(ctx context.Context) (_ *ClusterClien
 
 	pclt, err := proxyclient.NewClient(ctx, proxyclient.ClientConfig{
 		ProxyAddress:      cfg.proxyAddress,
+		RelayAddress:      tc.RelayAddr,
 		TLSRoutingEnabled: tc.TLSRoutingEnabled,
 		TLSConfigFunc: func(cluster string) (*tls.Config, error) {
 			if cluster == "" {
@@ -3855,7 +3914,7 @@ func (tc *TeleportClient) directLoginWeb(ctx context.Context, secondFactorType c
 	}
 
 	// authenticate via the web api
-	clt, session, err := SSHAgentLoginWeb(ctx, SSHLoginDirect{
+	clt, session, err := sshAgentLoginWeb(ctx, SSHLoginDirect{
 		SSHLogin: sshLogin,
 		User:     tc.Username,
 		Password: password,
@@ -3876,7 +3935,7 @@ func (tc *TeleportClient) mfaLocalLoginWeb(ctx context.Context, keyRing *KeyRing
 		return nil, nil, trace.Wrap(err)
 	}
 
-	clt, session, err := SSHAgentMFAWebSessionLogin(ctx, SSHLoginMFA{
+	clt, session, err := sshAgentMFAWebSessionLogin(ctx, SSHLoginMFA{
 		SSHLogin:             sshLogin,
 		User:                 tc.Username,
 		Password:             password,
@@ -3967,6 +4026,24 @@ func (tc *TeleportClient) SSHLogin(ctx context.Context, sshLoginFunc SSHLoginFun
 		tc.SiteName = rootClusterName
 	}
 
+	// update the default relay addr from the latest response, which will later
+	// be persisted in the profile
+	tc.ProfileDefaultRelayAddr = response.ClientOptions.DefaultRelayAddr
+
+	tlsCert, err := tlsca.ParseCertificatePEM(response.TLSCert)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	ident, err := tlsca.FromSubject(tlsCert.Subject, time.Time{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if ident.ScopePin != nil {
+		log.DebugContext(ctx, "got scoped certificate identity", "scope", ident.ScopePin.Scope, "assignments", ident.ScopePin.Assignments)
+	}
+
 	return keyRing, nil
 }
 
@@ -4090,6 +4167,7 @@ func (tc *TeleportClient) NewSSHLogin(keyRing *KeyRing) (SSHLogin, error) {
 		TTL:                     tc.KeyTTL,
 		Insecure:                tc.InsecureSkipVerify,
 		Pool:                    loopbackPool(tc.WebProxyAddr),
+		Scope:                   tc.Scope,
 		Compatibility:           tc.CertificateFormat,
 		RouteToCluster:          tc.SiteName,
 		KubernetesCluster:       tc.KubernetesCluster,
@@ -4886,25 +4964,6 @@ func loopbackPool(proxyAddr string) *x509.CertPool {
 	return certPool
 }
 
-// connectToSSHAgent connects to the system SSH agent and returns an agent.Agent.
-func connectToSSHAgent() agent.ExtendedAgent {
-	ctx := context.Background()
-	logger := log.With(teleport.ComponentKey, teleport.ComponentKeyAgent)
-
-	socketPath := os.Getenv(teleport.SSHAuthSock)
-	conn, err := agentconn.Dial(socketPath)
-	if err != nil {
-		logger.WarnContext(ctx, "Unable to connect to SSH agent on socket",
-			"socket_path", socketPath,
-			"error", err,
-		)
-		return nil
-	}
-
-	logger.InfoContext(ctx, "Connected to the system agent", "socket_path", socketPath)
-	return agent.NewClient(conn)
-}
-
 // Username returns the current user's username
 func Username() (string, error) {
 	u, err := user.Current()
@@ -5223,8 +5282,8 @@ func InsecureSkipHostKeyChecking(host string, remote net.Addr, key ssh.PublicKey
 	return nil
 }
 
-// isFIPS returns if the binary was build with BoringCrypto, which implies
-// FedRAMP/FIPS 140-2 mode for tsh.
+// isFIPS returns if the binary was built with a FIPS validated
+// module, which implies FedRAMP/FIPS mode for tsh.
 func isFIPS() bool {
 	return modules.GetModules().IsBoringBinary()
 }
@@ -5462,3 +5521,102 @@ func (tc *TeleportClient) HeadlessApprove(ctx context.Context, headlessAuthentic
 	err = rootClient.UpdateHeadlessAuthenticationState(ctx, headlessAuthenticationID, types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED, mfaResp)
 	return trace.Wrap(err)
 }
+
+// DialALPN dials the Proxy with provided client certificate and ALPN protocol.
+func (tc *TeleportClient) DialALPN(ctx context.Context, clientCert tls.Certificate, protocol alpncommon.Protocol) (net.Conn, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/DialALPN",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+		oteltrace.WithAttributes(
+			attribute.String("protocol", string(protocol)),
+		),
+	)
+	defer span.End()
+
+	dialConfig := client.ALPNDialerConfig{
+		ALPNConnUpgradeRequired: tc.TLSRoutingConnUpgradeRequired,
+		TLSConfig: &tls.Config{
+			NextProtos:         alpncommon.ProtocolToStringsWithPing(protocol),
+			InsecureSkipVerify: tc.InsecureSkipVerify,
+			Certificates:       []tls.Certificate{clientCert},
+		},
+		GetClusterCAs: tc.RootClusterCACertPool,
+	}
+
+	tlsConn, err := client.DialALPN(ctx, tc.WebProxyAddr, dialConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if alpncommon.IsPingProtocol(alpncommon.Protocol(tlsConn.ConnectionState().NegotiatedProtocol)) {
+		return pingconn.NewTLS(tlsConn), nil
+	}
+	return tlsConn, nil
+}
+
+// DialDatabase makes a remote connection to the database.
+//
+// TODO(gabrielcorado): support acccess requests connections.
+func (tc *TeleportClient) DialDatabase(ctx context.Context, route proto.RouteToDatabase) (net.Conn, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/DialDatabase",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+		oteltrace.WithAttributes(
+			attribute.String("db", route.GetServiceName()),
+			attribute.String("protocol", route.GetProtocol()),
+		),
+	)
+	defer span.End()
+
+	dbCertParams := ReissueParams{
+		RouteToCluster:  tc.SiteName,
+		RouteToDatabase: route,
+		TTL:             tc.KeyTTL,
+	}
+
+	alpnProtocol, err := alpncommon.ToALPNProtocol(route.GetProtocol())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	keyRing, err := tc.IssueUserCertsWithMFA(ctx, dbCertParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cert, err := keyRing.DBTLSCert(route.GetServiceName())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return tc.DialALPN(ctx, cert, alpnProtocol)
+}
+
+// GetSiteName returns the cluster name this client instance is targeting.
+func (tc *TeleportClient) GetSiteName() string {
+	return tc.SiteName
+}
+
+// CalculateSSHLogins returns the subset of the allowedLogins that exist in
+// the principals of the identity. This is required because SSH authorization
+// only allows using a login that exists in the certificates valid principals.
+// When connecting to servers in a leaf cluster, the root certificate is used,
+// so we need to ensure that we only present the allowed logins that would
+// result in a successful connection, if any exists.
+func CalculateSSHLogins(identityPrincipals []string, allowedLogins []string) ([]string, error) {
+	allowed := make(map[string]struct{})
+	for _, login := range allowedLogins {
+		allowed[login] = struct{}{}
+	}
+
+	var logins []string
+	for _, local := range identityPrincipals {
+		if _, ok := allowed[local]; ok {
+			logins = append(logins, local)
+		}
+	}
+
+	slices.Sort(logins)
+	return logins, nil
+}
diff --git a/lib/client/api_login_test.go b/lib/client/api_login_test.go
index 1ee05cab92dae..fa3e958ebe1f6 100644
--- a/lib/client/api_login_test.go
+++ b/lib/client/api_login_test.go
@@ -33,18 +33,24 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 
 	"github.com/gravitational/teleport/api/breaker"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/prompt"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
@@ -54,14 +60,17 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/imds"
 	"github.com/gravitational/teleport/lib/defaults"
 	dtauthntypes "github.com/gravitational/teleport/lib/devicetrust/authn/types"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestTeleportClient_Login_local(t *testing.T) {
-	t.Parallel()
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
 
 	type webauthnFunc func(ctx context.Context, origin string, assertion *wantypes.CredentialAssertion, prompt wancli.LoginPrompt) (*proto.MFAAuthenticateResponse, error)
 
@@ -143,6 +152,7 @@ func TestTeleportClient_Login_local(t *testing.T) {
 		preferOTP               bool
 		hasTouchIDCredentials   bool
 		authenticatorAttachment wancli.AuthenticatorAttachment
+		scope                   string
 	}{
 		{
 			name: "OTP device login with hijack",
@@ -258,6 +268,18 @@ func TestTeleportClient_Login_local(t *testing.T) {
 			preferOTP:             true,
 			hasTouchIDCredentials: true,
 		},
+		{
+			name: "scoped login",
+			makeInputReader: func(pass, _ string, _ clockwork.Clock) *prompt.FakeReader {
+				return prompt.NewFakeReader().
+					AddString(pass).
+					AddReply(func(ctx context.Context) (string, error) {
+						panic("this should not be called")
+					})
+			},
+			makeSolveWebauthn: solveWebauthn,
+			scope:             "/aa",
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -280,6 +302,7 @@ func TestTeleportClient_Login_local(t *testing.T) {
 			cfg.Stdin = &bytes.Buffer{}
 			cfg.Username = username
 			cfg.HostLogin = username
+			cfg.Scope = test.scope
 			cfg.AddKeysToAgent = client.AddKeysToAgentNo
 			// Replace "127.0.0.1" with "localhost". The proxy address becomes the origin
 			// for Webauthn requests, and Webauthn doesn't take IP addresses.
@@ -314,8 +337,28 @@ func TestTeleportClient_Login_local(t *testing.T) {
 
 			// Test.
 			clock.Advance(30 * time.Second)
-			_, err = tc.Login(ctx)
+			keyRing, err := tc.Login(ctx)
 			require.NoError(t, err)
+
+			if test.scope != "" {
+				// if this was a scoped test case, verify that the scope pin was applied
+				sshCert, err := keyRing.SSHCert()
+				require.NoError(t, err)
+
+				sshIdent, err := sshca.DecodeIdentity(sshCert)
+				require.NoError(t, err)
+
+				require.NotNil(t, sshIdent.ScopePin)
+				require.Empty(t, cmp.Diff(&scopesv1.Pin{
+					Scope: "/aa",
+					Assignments: map[string]*scopesv1.PinnedAssignments{
+						"/aa": {
+							Roles: []string{"role-a"},
+						},
+					},
+				}, sshIdent.ScopePin, protocmp.Transform()))
+				require.Empty(t, sshIdent.Roles)
+			}
 		})
 	}
 }
@@ -547,7 +590,7 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 	cfg.DataDir = makeDataDir()
 	cfg.Hostname = "localhost"
 	cfg.Clock = clock
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	cfg.SetAuthServerAddress(randomAddr) // must be present
 	cfg.Auth.Preference, err = types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
 		Type:         constants.Local,
@@ -624,13 +667,16 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 	require.NoError(t, err)
 	require.NoError(t, authServer.UpsertMFADevice(ctx, username, otpDevice))
 
+	// Assign some basic scoped roles to the user.
+	createAndAssignScopedRoles(t, ctx, authServer, username)
+
 	// Proxy setup.
 	cfg = servicecfg.MakeDefaultConfig()
 	cfg.DataDir = makeDataDir()
 	cfg.Hostname = "localhost"
 	cfg.SetToken(staticToken)
 	cfg.Clock = clock
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	cfg.SetAuthServerAddress(*authAddr)
 	cfg.Auth.Enabled = false
 	cfg.Proxy.Enabled = true
@@ -659,6 +705,99 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 	}
 }
 
+// createAndAssignScopedRoles creates two scoped roles and assigns them to the given user, one at /aa and one at /bb. this provides
+// a rudimentary mechanism for testing scoped login functionality.
+func createAndAssignScopedRoles(t *testing.T, ctx context.Context, authServer *auth.Server, username string) {
+	watcher, err := authServer.NewWatcher(ctx, types.Watch{
+		Kinds: []types.WatchKind{
+			{Kind: scopedaccess.KindScopedRole},
+			{Kind: scopedaccess.KindScopedRoleAssignment},
+		},
+	})
+	require.NoError(t, err)
+	defer watcher.Close()
+
+	// wait for watcher init before performing writes
+	select {
+	case event := <-watcher.Events():
+		require.Equal(t, types.OpInit, event.Type)
+	case <-watcher.Done():
+		require.FailNow(t, "watcher closed unexpected", "err: %v", watcher.Error())
+	}
+
+	scopedRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-a",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/aa"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-b",
+			},
+			Scope: "/bb",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/bb"},
+			},
+			Version: types.V1,
+		},
+	}
+
+	roleRevisions := make(map[string]string)
+	for _, role := range scopedRoles {
+		rsp, err := authServer.ScopedAccess().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+
+		roleRevisions[role.GetMetadata().GetName()] = rsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// assign both roles to user
+	for _, role := range scopedRoles {
+		_, err = authServer.ScopedAccess().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: scopedaccess.KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.NewString(),
+				},
+				Scope: role.GetScope(),
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: username,
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  role.GetMetadata().GetName(),
+							Scope: role.GetScope(),
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			RoleRevisions: map[string]string{
+				role.GetMetadata().GetName(): roleRevisions[role.GetMetadata().GetName()],
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	for i := 0; i < 4; i++ {
+		// consume events generated by the above writes
+		select {
+		case event := <-watcher.Events():
+			t.Logf("watcher event: %+v", event)
+		case <-watcher.Done():
+			require.FailNow(t, "watcher closed unexpected", "err: %v", watcher.Error())
+		}
+	}
+}
+
 func startAndWait(t *testing.T, cfg *servicecfg.Config, eventName string) *service.TeleportProcess {
 	instance, err := service.NewTeleport(cfg)
 	require.NoError(t, err)
diff --git a/lib/client/api_test.go b/lib/client/api_test.go
index 88091f4085fcb..9984cf601be7a 100644
--- a/lib/client/api_test.go
+++ b/lib/client/api_test.go
@@ -26,11 +26,13 @@ import (
 	"io"
 	"math"
 	"os"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/coreos/go-semver/semver"
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -44,18 +46,23 @@ import (
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
-	cryptosuites.PrecomputeRSATestKeys(m)
-	os.Exit(m.Run())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 var parseProxyHostTestCases = []struct {
@@ -1642,3 +1649,48 @@ func TestParsePortMapping(t *testing.T) {
 		})
 	}
 }
+
+func TestCalculateSSHLogins(t *testing.T) {
+	cases := []struct {
+		name              string
+		allowedLogins     []string
+		grantedPrincipals []string
+		expectedLogins    []string
+	}{
+		{
+			name:              "no matching logins",
+			allowedLogins:     []string{"llama"},
+			grantedPrincipals: []string{"fish"},
+		},
+		{
+			name:              "identical logins",
+			allowedLogins:     []string{"llama", "shark", "goose"},
+			grantedPrincipals: []string{"shark", "goose", "llama"},
+			expectedLogins:    []string{"goose", "shark", "llama"},
+		},
+		{
+			name:              "subset of logins",
+			allowedLogins:     []string{"llama"},
+			grantedPrincipals: []string{"shark", "goose", "llama"},
+			expectedLogins:    []string{"llama"},
+		},
+		{
+			name:              "no allowed logins",
+			grantedPrincipals: []string{"shark", "goose", "llama"},
+		},
+		{
+			name:          "no granted logins",
+			allowedLogins: []string{"shark", "goose", "llama"},
+		},
+	}
+
+	for _, test := range cases {
+		t.Run(test.name, func(t *testing.T) {
+			logins, err := CalculateSSHLogins(test.grantedPrincipals, test.allowedLogins)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(logins, test.expectedLogins, cmpopts.SortSlices(func(a, b string) bool {
+				return strings.Compare(a, b) < 0
+			})))
+		})
+	}
+}
diff --git a/lib/client/ca_export_test.go b/lib/client/ca_export_test.go
index e5b86b7c496d5..0482073415ae0 100644
--- a/lib/client/ca_export_test.go
+++ b/lib/client/ca_export_test.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -88,11 +89,12 @@ func TestExportAuthorities(t *testing.T) {
 	ctx := context.Background()
 	const localClusterName = "localcluster"
 
-	testAuth, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: localClusterName,
 		Dir:         t.TempDir(),
 	})
-	require.NoError(t, err, "failed to create auth.NewTestAuthServer")
+	require.NoError(t, err, "failed to create authtest.NewAuthServer")
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
 
 	validateTLSCertificateDERFunc := func(t *testing.T, s string) {
 		cert, err := x509.ParseCertificate([]byte(s))
@@ -515,11 +517,12 @@ func TestExportIntegrationAuthorities(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
-	testAuth, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuth, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "localcluster",
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuth.Close()) })
 
 	fingerprint, err := sshutils.AuthorizedKeyFingerprint([]byte(fixtures.SSHCAPublicKey))
 	require.NoError(t, err)
diff --git a/lib/client/client.go b/lib/client/client.go
index 21dffe27825b1..4dfed45e5e074 100644
--- a/lib/client/client.go
+++ b/lib/client/client.go
@@ -28,7 +28,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -52,7 +51,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -357,7 +355,11 @@ func NewNodeClient(ctx context.Context, sshConfig *ssh.ClientConfig, conn net.Co
 				"target_host", nodeName,
 				"error", err,
 			)
-			return nil, trace.AccessDenied("access denied to %v connecting to %v", sshConfig.User, nodeName)
+			host := nodeName
+			if h, _, err := net.SplitHostPort(nodeName); err == nil {
+				host = h
+			}
+			return nil, trace.AccessDenied("access denied to %v connecting to %v", sshConfig.User, host)
 		}
 		return nil, trace.Wrap(err)
 	}
@@ -388,10 +390,10 @@ func NewNodeClient(ctx context.Context, sshConfig *ssh.ClientConfig, conn net.Co
 	return nc, nil
 }
 
-// RunInteractiveShell creates an interactive shell on the node and copies stdin/stdout/stderr
+// RunInteractiveShell creates or joins an interactive shell on the node and copies stdin/stdout/stderr
 // to and from the node and local shell. This will block until the interactive shell on the node
 // is terminated.
-func (c *NodeClient) RunInteractiveShell(ctx context.Context, mode types.SessionParticipantMode, sessToJoin types.SessionTracker, chanReqCallback tracessh.ChannelRequestCallback, beforeStart func(io.Writer)) error {
+func (c *NodeClient) RunInteractiveShell(ctx context.Context, joinSessionID string, joinMode types.SessionParticipantMode, beforeStart func(io.Writer)) error {
 	ctx, span := c.Tracer.Start(
 		ctx,
 		"nodeClient/RunInteractiveShell",
@@ -399,28 +401,21 @@ func (c *NodeClient) RunInteractiveShell(ctx context.Context, mode types.Session
 	)
 	defer span.End()
 
-	env := c.TC.newSessionEnv()
-	env[teleport.EnvSSHJoinMode] = string(mode)
-	env[teleport.EnvSSHSessionReason] = c.TC.Config.Reason
-	env[teleport.EnvSSHSessionDisplayParticipantRequirements] = strconv.FormatBool(c.TC.Config.DisplayParticipantRequirements)
-	encoded, err := json.Marshal(&c.TC.Config.Invited)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	env[teleport.EnvSSHSessionInvited] = string(encoded)
-
-	// Overwrite "SSH_SESSION_WEBPROXY_ADDR" with the public addr reported by the proxy. Otherwise,
-	// this would be set to the localhost addr (tc.WebProxyAddr) used for Web UI client connections.
-	if c.ProxyPublicAddr != "" && c.TC.WebProxyAddr != c.ProxyPublicAddr {
-		env[teleport.SSHSessionWebProxyAddr] = c.ProxyPublicAddr
+	sessionParams := &tracessh.SessionParams{
+		WebProxyAddr:                   c.WebProxyAddr(),
+		Reason:                         c.TC.Config.Reason,
+		Invited:                        c.TC.Config.Invited,
+		DisplayParticipantRequirements: c.TC.Config.DisplayParticipantRequirements,
+		JoinSessionID:                  joinSessionID,
+		JoinMode:                       joinMode,
 	}
 
-	nodeSession, err := newSession(ctx, c, sessToJoin, env, c.TC.Stdin, c.TC.Stdout, c.TC.Stderr, !c.TC.DisableEscapeSequences)
+	nodeSession, err := newSession(ctx, c, sessionParams, c.TC.Stdin, c.TC.Stdout, c.TC.Stderr, !c.TC.DisableEscapeSequences)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err = nodeSession.runShell(ctx, mode, c.TC.OnChannelRequest, beforeStart, c.TC.OnShellCreated); err != nil {
+	if err = nodeSession.runShell(ctx, sessionParams, beforeStart, c.TC.OnShellCreated); err != nil {
 		var exitErr *ssh.ExitError
 		var exitMissingErr *ssh.ExitMissingError
 		switch err := trace.Unwrap(err); {
@@ -616,12 +611,19 @@ func (c *NodeClient) RunCommand(ctx context.Context, command []string, opts ...R
 		}
 	}
 
-	nodeSession, err := newSession(ctx, c, nil, c.TC.newSessionEnv(), c.TC.Stdin, stdout, stderr, !c.TC.DisableEscapeSequences)
+	sessionParams := &tracessh.SessionParams{
+		WebProxyAddr:                   c.WebProxyAddr(),
+		Reason:                         c.TC.Config.Reason,
+		Invited:                        c.TC.Config.Invited,
+		DisplayParticipantRequirements: c.TC.Config.DisplayParticipantRequirements,
+	}
+
+	nodeSession, err := newSession(ctx, c, sessionParams, c.TC.Stdin, stdout, stderr, !c.TC.DisableEscapeSequences)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	defer nodeSession.Close()
-	err = nodeSession.runCommand(ctx, types.SessionPeerMode, command, c.TC.OnChannelRequest, c.TC.OnShellCreated, c.TC.Config.InteractiveCommand)
+	err = nodeSession.runCommand(ctx, sessionParams, command, c.TC.OnShellCreated, c.TC.Config.InteractiveCommand)
 	if err != nil {
 		c.TC.SetExitStatus(getExitStatus(err))
 	}
@@ -722,7 +724,7 @@ func newClientConn(
 		// Use a noop text map propagator so that the tracing context isn't included in
 		// the connection handshake. Since the provided conn will already include the tracing
 		// context we don't want to send it again.
-		conn, chans, reqs, err := tracessh.NewClientConn(ctx, conn, nodeAddress, config, tracing.WithTextMapPropagator(propagation.NewCompositeTextMapPropagator()))
+		conn, chans, reqs, err := tracessh.NewClientConnWithTimeout(ctx, conn, nodeAddress, config, tracing.WithTextMapPropagator(propagation.NewCompositeTextMapPropagator()))
 		respCh <- response{conn, chans, reqs, err}
 	}()
 
@@ -743,29 +745,6 @@ func newClientConn(
 	}
 }
 
-// TransferFiles transfers files over SFTP.
-func (c *NodeClient) TransferFiles(ctx context.Context, cfg *sftp.Config) error {
-	ctx, span := c.Tracer.Start(
-		ctx,
-		"nodeClient/TransferFiles",
-		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
-	)
-	defer span.End()
-
-	if err := cfg.TransferFiles(ctx, c.Client.Client); err != nil {
-		// TODO(tross): DELETE IN 19.0.0 - Older versions of Teleport would return
-		// a trace.BadParameter error when ~user path expansion was rejected, and
-		// reauthentication logic is attempted on BadParameter errors.
-		if trace.IsBadParameter(err) && strings.Contains(err.Error(), "expanding remote ~user paths is not supported") {
-			return trace.Wrap(&NonRetryableError{Err: err})
-		}
-
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
 type netDialer interface {
 	DialContext(context.Context, string, string) (net.Conn, error)
 }
@@ -1028,3 +1007,13 @@ func GetPaginatedSessions(ctx context.Context, fromUTC, toUTC time.Time, pageSiz
 	}
 	return sessions, nil
 }
+
+// WebProxyAddr is the address of the proxy forwarding the SSH connection to the target server.
+func (c *NodeClient) WebProxyAddr() string {
+	// Prioritize the public addr reported by the proxy. Otherwise, this would
+	// return the localhost addr used for Web UI client connections.
+	if c.ProxyPublicAddr != "" {
+		return c.ProxyPublicAddr
+	}
+	return c.TC.WebProxyAddr
+}
diff --git a/lib/client/client_store.go b/lib/client/client_store.go
index 6899f855f9be5..00fb18c45f832 100644
--- a/lib/client/client_store.go
+++ b/lib/client/client_store.go
@@ -238,16 +238,17 @@ func (s *Store) AddTrustedHostKeys(proxyHost string, clusterName string, hostKey
 
 // ReadProfileStatus returns the profile status for the given profile name.
 // If no profile name is provided, return the current profile.
-func (s *Store) ReadProfileStatus(profileName string) (*ProfileStatus, error) {
+func (s *Store) ReadProfileStatus(proxyAddressOrProfile string) (*ProfileStatus, error) {
 	var err error
-	if profileName == "" {
+	var profileName string
+	if proxyAddressOrProfile == "" {
 		profileName, err = s.CurrentProfile()
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	} else {
 		// remove ports from proxy host, because profile name is stored by host name
-		profileName, err = utils.Host(profileName)
+		profileName, err = utils.Host(proxyAddressOrProfile)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -265,38 +266,43 @@ func (s *Store) ReadProfileStatus(profileName string) (*ProfileStatus, error) {
 		ClusterName: profile.SiteName,
 		Username:    profile.Username,
 	}
+
+	// If we can't find a keyRing to match the profile, connect to the keyRing (hardware key),
+	// or read the full profile status, return a partial status.
+	// This is used for some superficial functions `tsh logout` and `tsh status`.
+	partialStatus := &ProfileStatus{
+		Name: profileName,
+		Dir:  profile.Dir,
+		ProxyURL: url.URL{
+			Scheme: "https",
+			Host:   profile.WebProxyAddr,
+		},
+		Username:    profile.Username,
+		Cluster:     profile.SiteName,
+		KubeEnabled: profile.KubeProxyAddr != "",
+		// Set ValidUntil to now and GetKeyRingError to show that the keys are not available.
+		ValidUntil:              time.Now(),
+		SAMLSingleLogoutEnabled: profile.SAMLSingleLogoutEnabled,
+		SSOHost:                 profile.SSOHost,
+	}
+
 	keyRing, err := s.GetKeyRing(idx, WithAllCerts...)
 	if err != nil {
 		if trace.IsNotFound(err) || trace.IsConnectionProblem(err) {
-			// If we can't find a keyRing to match the profile, or can't connect to
-			// the keyRing (hardware key), return a partial status. This is used for
-			// some superficial functions `tsh logout` and `tsh status`.
-			return &ProfileStatus{
-				Name: profileName,
-				Dir:  profile.Dir,
-				ProxyURL: url.URL{
-					Scheme: "https",
-					Host:   profile.WebProxyAddr,
-				},
-				Username:    profile.Username,
-				Cluster:     profile.SiteName,
-				KubeEnabled: profile.KubeProxyAddr != "",
-				// Set ValidUntil to now and GetKeyRingError to show that the keys are not available.
-				ValidUntil:              time.Now(),
-				GetKeyRingError:         err,
-				SAMLSingleLogoutEnabled: profile.SAMLSingleLogoutEnabled,
-				SSOHost:                 profile.SSOHost,
-			}, nil
+			partialStatus.GetKeyRingError = err
+			return partialStatus, nil
 		}
 		return nil, trace.Wrap(err)
 	}
 
 	_, onDisk := s.KeyStore.(*FSKeyStore)
 
-	return profileStatusFromKeyRing(keyRing, profileOptions{
+	profileStatus, err := profileStatusFromKeyRing(keyRing, profileOptions{
 		ProfileName:             profileName,
 		ProfileDir:              profile.Dir,
 		WebProxyAddr:            profile.WebProxyAddr,
+		RelayAddr:               profile.RelayAddr,
+		DefaultRelayAddr:        profile.DefaultRelayAddr,
 		Username:                profile.Username,
 		SiteName:                profile.SiteName,
 		KubeProxyAddr:           profile.KubeProxyAddr,
@@ -305,19 +311,45 @@ func (s *Store) ReadProfileStatus(profileName string) (*ProfileStatus, error) {
 		IsVirtual:               !onDisk,
 		TLSRoutingEnabled:       profile.TLSRoutingEnabled,
 	})
+	if trace.IsNotFound(err) {
+		return partialStatus, nil
+	} else if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return profileStatus, nil
 }
 
-// FullProfileStatus returns the name of the current profile with a
-// a list of all profile statuses.
-func (s *Store) FullProfileStatus() (*ProfileStatus, []*ProfileStatus, error) {
-	currentProfileName, err := s.CurrentProfile()
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
+// FullProfileStatus returns the status of the active profile along with the
+// statuses of all profiles.
+//
+// The active profile status is determined from the provided profile if given;
+// otherwise, it is read from the current profile.
+//
+// The active profile status is nil if there is no active profile.
+func (s *Store) FullProfileStatus(proxyAddressOrProfile string) (*ProfileStatus, []*ProfileStatus, error) {
+	var currentProfileName string
+	if proxyAddressOrProfile == "" {
+		profileName, err := s.CurrentProfile()
+		if err != nil && !trace.IsNotFound(err) {
+			return nil, nil, trace.Wrap(err)
+		}
+		currentProfileName = profileName
+	} else {
+		// Remove ports from proxy host, profile name is stored by host name.
+		profileName, err := utils.Host(proxyAddressOrProfile)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		currentProfileName = profileName
 	}
 
-	currentProfile, err := s.ReadProfileStatus(currentProfileName)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
+	var currentProfile *ProfileStatus
+	if currentProfileName != "" {
+		profileStatus, err := s.ReadProfileStatus(currentProfileName)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		currentProfile = profileStatus
 	}
 
 	profileNames, err := s.ListProfiles()
diff --git a/lib/client/client_store_test.go b/lib/client/client_store_test.go
index c996e2a04189f..e4c44284e571c 100644
--- a/lib/client/client_store_test.go
+++ b/lib/client/client_store_test.go
@@ -304,11 +304,18 @@ func TestClientStore(t *testing.T) {
 				})
 				require.NoError(t, err)
 
-				currentStatus, otherStatuses, err := clientStore.FullProfileStatus()
+				currentStatus, otherStatuses, err := clientStore.FullProfileStatus("")
 				require.NoError(t, err)
 				require.Equal(t, expectStatus, currentStatus)
 				require.Len(t, otherStatuses, 1)
 				require.Equal(t, expectOtherStatus, otherStatuses[0])
+
+				// Test passing the active profile in the parameter.
+				currentStatus, otherStatuses, err = clientStore.FullProfileStatus("other.example.com")
+				require.NoError(t, err)
+				require.Equal(t, expectOtherStatus, currentStatus)
+				require.Len(t, otherStatuses, 1)
+				require.Equal(t, expectStatus, otherStatuses[0])
 			})
 		})
 	}
diff --git a/lib/client/client_test.go b/lib/client/client_test.go
index fa103056e12e9..5ee7659c4233a 100644
--- a/lib/client/client_test.go
+++ b/lib/client/client_test.go
@@ -28,7 +28,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -37,7 +36,6 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/lib/observability/tracing"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -49,12 +47,13 @@ func TestHelperFunctions(t *testing.T) {
 
 func TestNewSession(t *testing.T) {
 	nc := &NodeClient{
+		TC:     &TeleportClient{},
 		Tracer: tracing.NoopProvider().Tracer("test"),
 	}
 
 	ctx := context.Background()
 	// defaults:
-	ses, err := newSession(ctx, nc, nil, nil, nil, nil, nil, true)
+	ses, err := newSession(ctx, nc, nil, nil, nil, nil, true)
 	require.NoError(t, err)
 	require.NotNil(t, ses)
 	require.Equal(t, nc, ses.NodeClient())
@@ -62,17 +61,6 @@ func TestNewSession(t *testing.T) {
 	require.Equal(t, os.Stderr, ses.terminal.Stderr())
 	require.Equal(t, os.Stdout, ses.terminal.Stdout())
 	require.Equal(t, os.Stdin, ses.terminal.Stdin())
-
-	// pass environ map
-	env := map[string]string{
-		sshutils.SessionEnvVar: "session-id",
-	}
-	ses, err = newSession(ctx, nc, nil, env, nil, nil, nil, true)
-	require.NoError(t, err)
-	require.NotNil(t, ses)
-	require.Empty(t, cmp.Diff(ses.env, env))
-	// the session ID must be taken from tne environ map, if passed:
-	require.Equal(t, "session-id", string(ses.id))
 }
 
 // TestProxyConnection verifies that client or server-side disconnect
diff --git a/lib/client/clientcache/clientcache.go b/lib/client/clientcache/clientcache.go
index f5e8f44aafdf9..c8f92b9718050 100644
--- a/lib/client/clientcache/clientcache.go
+++ b/lib/client/clientcache/clientcache.go
@@ -17,6 +17,7 @@
 package clientcache
 
 import (
+	"bytes"
 	"context"
 	"log/slog"
 	"slices"
@@ -35,12 +36,47 @@ import (
 type Cache struct {
 	cfg Config
 	mu  sync.RWMutex
-	// clients keeps a mapping from key (profile name and leaf cluster name) to cluster client.
-	clients map[key]*client.ClusterClient
+	// clients keeps a mapping from key (profile name and leaf cluster name) to client.
+	clients map[key]*clientWithMetadata
 	// group prevents duplicate requests to create clients for a given cluster.
 	group singleflight.Group
 }
 
+type clientWithMetadata struct {
+	client *client.ClusterClient
+	// tlsCert is the certificate that was loaded when the client was created.
+	tlsCert []byte
+	// getProfile reads the fresh profile for the client from disk.
+	getProfile func() (profile, error)
+}
+
+type profile interface {
+	// TLSCert returns the current TLS cert, stored in the agent.
+	TLSCert() ([]byte, error)
+}
+
+// isTLSCertStale checks if the cached client uses the current TLS cert
+// (read from the agent). If not, the TLS cert is considered stale.
+func (c *clientWithMetadata) isTLSCertStale() (bool, error) {
+	pr, err := c.getProfile()
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return true, nil
+		}
+		return false, trace.Wrap(err)
+	}
+
+	tlsCert, err := pr.TLSCert()
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return true, nil
+		}
+		return false, trace.Wrap(err)
+	}
+
+	return !bytes.Equal(c.tlsCert, tlsCert), nil
+}
+
 // NewClientFunc is a function that will return a new [*client.TeleportClient] for a given profile and leaf
 // cluster. [leafClusterName] may be empty, in which case implementations should return a client for the root cluster.
 type NewClientFunc func(ctx context.Context, profileName, leafClusterName string) (*client.TeleportClient, error)
@@ -89,7 +125,7 @@ func New(c Config) (*Cache, error) {
 
 	return &Cache{
 		cfg:     c,
-		clients: make(map[key]*client.ClusterClient),
+		clients: make(map[key]*clientWithMetadata),
 	}, nil
 }
 
@@ -100,7 +136,7 @@ func (c *Cache) Get(ctx context.Context, profileName, leafClusterName string) (*
 	groupClt, err, _ := c.group.Do(k.String(), func() (any, error) {
 		if fromCache := c.getFromCache(k); fromCache != nil {
 			c.cfg.Logger.DebugContext(ctx, "Retrieved client from cache", "cluster", k)
-			return fromCache, nil
+			return fromCache.client, nil
 		}
 
 		tc, err := c.cfg.NewClientFunc(ctx, profileName, leafClusterName)
@@ -120,8 +156,19 @@ func (c *Cache) Get(ctx context.Context, profileName, leafClusterName string) (*
 			return nil, trace.Wrap(err)
 		}
 
+		keyRing, err := tc.LocalAgent().GetCoreKeyRing()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
 		// Save the client in the cache, so we don't have to build a new connection next time.
-		c.addToCache(k, newClient)
+		c.addToCache(k, &clientWithMetadata{
+			client:  newClient,
+			tlsCert: keyRing.TLSCert,
+			getProfile: func() (profile, error) {
+				return tc.GetProfile(tc.WebProxyAddr)
+			},
+		})
 
 		c.cfg.Logger.InfoContext(ctx, "Added client to cache", "cluster", k)
 
@@ -139,8 +186,25 @@ func (c *Cache) Get(ctx context.Context, profileName, leafClusterName string) (*
 	return clt, nil
 }
 
+// ClearOption configures ClearForRoot behavior.
+type ClearOption func(*clearConfig)
+
+type clearConfig struct {
+	onlyClearClientsWithStaleCert bool
+}
+
+// WithClearingOnlyClientsWithStaleCert closes only clients that use outdated certs.
+func WithClearingOnlyClientsWithStaleCert() ClearOption {
+	return func(c *clearConfig) { c.onlyClearClientsWithStaleCert = true }
+}
+
 // ClearForRoot closes and removes clients from the cache for the root cluster and its leaf clusters.
-func (c *Cache) ClearForRoot(profileName string) error {
+func (c *Cache) ClearForRoot(profileName string, opts ...ClearOption) error {
+	cfg := &clearConfig{}
+	for _, o := range opts {
+		o(cfg)
+	}
+
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
@@ -150,13 +214,23 @@ func (c *Cache) ClearForRoot(profileName string) error {
 	)
 
 	for k, clt := range c.clients {
-		if k.profile == profileName {
-			if err := clt.Close(); err != nil {
+		if k.profile != profileName {
+			continue
+		}
+		if cfg.onlyClearClientsWithStaleCert {
+			stale, err := clt.isTLSCertStale()
+			// If an error occurs, close the client as well.
+			if err != nil {
 				errors = append(errors, err)
+			} else if !stale {
+				continue
 			}
-			deleted = append(deleted, k.String())
-			delete(c.clients, k)
 		}
+		if err := clt.client.Close(); err != nil {
+			errors = append(errors, err)
+		}
+		deleted = append(deleted, k.String())
+		delete(c.clients, k)
 	}
 
 	c.cfg.Logger.InfoContext(context.Background(), "Invalidated cached clients for root cluster",
@@ -165,7 +239,6 @@ func (c *Cache) ClearForRoot(profileName string) error {
 	)
 
 	return trace.NewAggregate(errors...)
-
 }
 
 // Clear closes and removes all clients.
@@ -175,7 +248,7 @@ func (c *Cache) Clear() error {
 
 	var errors []error
 	for _, clt := range c.clients {
-		if err := clt.Close(); err != nil {
+		if err := clt.client.Close(); err != nil {
 			errors = append(errors, err)
 		}
 	}
@@ -184,14 +257,14 @@ func (c *Cache) Clear() error {
 	return trace.NewAggregate(errors...)
 }
 
-func (c *Cache) addToCache(k key, clusterClient *client.ClusterClient) {
+func (c *Cache) addToCache(k key, clt *clientWithMetadata) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	c.clients[k] = clusterClient
+	c.clients[k] = clt
 }
 
-func (c *Cache) getFromCache(k key) *client.ClusterClient {
+func (c *Cache) getFromCache(k key) *clientWithMetadata {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 
@@ -241,7 +314,7 @@ func (c *NoCache) Get(ctx context.Context, profileName, leafClusterName string)
 	return newClient, nil
 }
 
-func (c *NoCache) ClearForRoot(profileName string) error {
+func (c *NoCache) ClearForRoot(profileName string, _ ...ClearOption) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
diff --git a/lib/client/clientcache/clientcache_test.go b/lib/client/clientcache/clientcache_test.go
new file mode 100644
index 0000000000000..4e1aa962bb364
--- /dev/null
+++ b/lib/client/clientcache/clientcache_test.go
@@ -0,0 +1,180 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package clientcache
+
+import (
+	"context"
+	"crypto/x509/pkix"
+	"log/slog"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+
+	apiprofile "github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/observability/tracing"
+	"github.com/gravitational/teleport/lib/sshca"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+func TestClearingClientsWithStaleCert(t *testing.T) {
+	privateKey, err := keys.ParsePrivateKey(fixtures.PEMBytes["rsa"])
+	require.NoError(t, err)
+	tlsCert, sshCert, err := makeCerts(privateKey)
+	require.NoError(t, err)
+
+	keyRing := client.NewKeyRing(privateKey, privateKey)
+	keyRing.KeyRingIndex = client.KeyRingIndex{
+		ProxyHost:   "localhost",
+		Username:    "testuser",
+		ClusterName: "root",
+	}
+	keyRing.Cert = sshCert
+	keyRing.TLSCert = tlsCert
+
+	profile := &apiprofile.Profile{
+		WebProxyAddr: keyRing.ProxyHost,
+		Username:     keyRing.Username,
+		SiteName:     keyRing.ClusterName,
+	}
+	clientStore := client.NewFSClientStore(t.TempDir())
+	err = clientStore.SaveProfile(profile, true)
+	require.NoError(t, err)
+	err = clientStore.AddKeyRing(keyRing)
+	require.NoError(t, err)
+
+	cache, err := New(Config{
+		NewClientFunc: func(ctx context.Context, profileName, leafClusterName string) (*client.TeleportClient, error) {
+			config := &client.Config{
+				ClientStore:  clientStore,
+				SSHProxyAddr: "localhost:3080",
+				WebProxyAddr: "localhost:3080",
+				Username:     "testuser",
+				Tracer:       tracing.NoopProvider().Tracer("test"),
+				SiteName:     "root",
+			}
+			if leafClusterName != "" {
+				config.SiteName = leafClusterName
+			}
+			tc, err := client.NewClient(config)
+
+			return tc, err
+		},
+		RetryWithReloginFunc: func(ctx context.Context, tc *client.TeleportClient, fn func() error, opts ...client.RetryWithReloginOption) error {
+			return fn()
+		},
+		Logger: slog.New(slog.DiscardHandler),
+	})
+	require.NoError(t, err)
+
+	// Get clients.
+	rootClient, err := cache.Get(t.Context(), "root", "")
+	require.NoError(t, err)
+	leaf1Client, err := cache.Get(t.Context(), "root", "leaf1")
+	require.NoError(t, err)
+
+	// Update the TLS cert.
+	tlsCert, _, err = makeCerts(privateKey)
+	require.NoError(t, err)
+	keyRing.TLSCert = tlsCert
+	err = clientStore.AddKeyRing(keyRing)
+	require.NoError(t, err)
+
+	// Get the client for a new leaf after the cert has been updated.
+	leaf2Client, err := cache.Get(t.Context(), "root", "leaf2")
+	require.NoError(t, err)
+
+	// Clear stale clients.
+	err = cache.ClearForRoot("root", WithClearingOnlyClientsWithStaleCert())
+	require.NoError(t, err)
+
+	newRootClient, err := cache.Get(t.Context(), "root", "")
+	require.NoError(t, err)
+	newLeaf1Client, err := cache.Get(t.Context(), "root", "leaf1")
+	require.NoError(t, err)
+	newLeaf2Client, err := cache.Get(t.Context(), "root", "leaf2")
+	require.NoError(t, err)
+	// Clients opened before updating the cert should be reopened.
+	require.NotEqual(t, newRootClient, rootClient)
+	require.NotEqual(t, newLeaf1Client, leaf1Client)
+	// The client opened after updating the cert should be untouched.
+	require.Equal(t, newLeaf2Client, leaf2Client)
+}
+
+// makeCerts makes TSL and SSH certs.
+func makeCerts(privateKey *keys.PrivateKey) ([]byte, []byte, error) {
+	cert, err := tlsca.GenerateSelfSignedCAWithSigner(privateKey, pkix.Name{
+		CommonName:   "root",
+		Organization: []string{"localhost"},
+	}, nil, defaults.CATTL)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	ca, err := tlsca.FromCertAndSigner(cert, privateKey)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	keygen := testauthority.New()
+
+	clock := clockwork.NewRealClock()
+	identity := tlsca.Identity{
+		Username: "testuser",
+	}
+
+	subject, err := identity.Subject()
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	tlsCert, err := ca.GenerateCertificate(tlsca.CertificateRequest{
+		Clock:     clock,
+		PublicKey: privateKey.Public(),
+		Subject:   subject,
+		NotAfter:  clock.Now().UTC().Add(defaults.CATTL),
+	})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	signer, err := keys.ParsePrivateKey([]byte(fixtures.SSHCAPrivateKey))
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	caSigner, err := ssh.NewSignerFromKey(signer)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	sshCert, err := keygen.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:      caSigner,
+		PublicUserKey: ssh.MarshalAuthorizedKey(privateKey.SSHPublicKey()),
+		Identity: sshca.Identity{
+			Username:   "testuser",
+			Principals: []string{"testuser"},
+		},
+	})
+
+	return tlsCert, sshCert, trace.Wrap(err)
+}
diff --git a/lib/client/cluster_client.go b/lib/client/cluster_client.go
index f636c5d19d32b..ecf82be99005e 100644
--- a/lib/client/cluster_client.go
+++ b/lib/client/cluster_client.go
@@ -282,28 +282,66 @@ func (c *ClusterClient) SessionSSHConfig(ctx context.Context, user string, targe
 		return sshConfig, nil
 	}
 
-	keyRing, err := c.tc.localAgent.GetKeyRing(target.Cluster, WithAllCerts...)
+	newKeyRing, completedMFA, err := c.SessionSSHKeyRing(ctx, user, target)
 	if err != nil {
-		return nil, trace.Wrap(MFARequiredUnknown(err))
+		return nil, trace.Wrap(err)
+	}
+	if !completedMFA {
+		// The caller relies on this function returning an error if
+		// target.MFACheck is nil and session MFA was not actually required.
+		return nil, trace.Wrap(services.ErrSessionMFANotRequired)
+	}
+
+	am, err := newKeyRing.AsAuthMethod()
+	if err != nil {
+		return nil, trace.Wrap(ceremonyFailedErr{err})
+	}
+
+	sshConfig.Auth = []ssh.AuthMethod{am}
+	return sshConfig, nil
+}
+
+// SessionSSHKeyRing returns a KeyRing valid for an SSH session to the target.
+// If per session MFA is required to establish the connection, then the MFA
+// ceremony will be performed. If per session MFA is not required, the user's
+// base KeyRing for the cluster will be returned.
+func (c *ClusterClient) SessionSSHKeyRing(ctx context.Context, user string, target NodeDetails) (keyRing *KeyRing, completedMFA bool, err error) {
+	ctx, span := c.Tracer.Start(
+		ctx,
+		"clusterClient/SessionSSHKeyRing",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+		oteltrace.WithAttributes(
+			attribute.String("cluster", c.tc.SiteName),
+		),
+	)
+	defer span.End()
+
+	baseKeyRing, err := c.tc.localAgent.GetKeyRing(target.Cluster, WithSSHCerts{})
+	if err != nil {
+		return nil, false, trace.Wrap(MFARequiredUnknown(err))
+	}
+
+	if target.MFACheck != nil && !target.MFACheck.Required {
+		return baseKeyRing, false, nil
 	}
 
 	// Always connect to root for getting new credentials, but attempt to reuse
 	// the existing client if possible.
-	rootClusterName, err := keyRing.RootClusterName()
+	rootClusterName, err := baseKeyRing.RootClusterName()
 	if err != nil {
-		return nil, trace.Wrap(MFARequiredUnknown(err))
+		return nil, false, trace.Wrap(MFARequiredUnknown(err))
 	}
 
 	mfaClt := c
 	if target.Cluster != rootClusterName {
 		cfg, err := c.ProxyClient.ClientConfig(ctx, rootClusterName)
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return nil, false, trace.Wrap(err)
 		}
 
 		authClient, err := authclient.NewClient(cfg)
 		if err != nil {
-			return nil, trace.Wrap(MFARequiredUnknown(err))
+			return nil, false, trace.Wrap(MFARequiredUnknown(err))
 		}
 
 		mfaClt = &ClusterClient{
@@ -326,20 +364,19 @@ func (c *ClusterClient) SessionSSHConfig(ctx context.Context, user string, targe
 			RouteToCluster: target.Cluster,
 			MFACheck:       target.MFACheck,
 		},
-		keyRing,
+		baseKeyRing.Copy(),
 	)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		if errors.Is(err, services.ErrSessionMFANotRequired) {
+			log.DebugContext(ctx, "Session MFA was not required, returning original KeyRing")
+			return baseKeyRing, false, nil
+		}
+		log.DebugContext(ctx, "Error performing session MFA ceremony", "error", err)
+		return nil, false, trace.Wrap(err)
 	}
 
 	log.DebugContext(ctx, "Issued single-use user certificate after an MFA check")
-	am, err := result.KeyRing.AsAuthMethod()
-	if err != nil {
-		return nil, trace.Wrap(ceremonyFailedErr{err})
-	}
-
-	sshConfig.Auth = []ssh.AuthMethod{am}
-	return sshConfig, nil
+	return result.KeyRing, true, nil
 }
 
 // prepareUserCertsRequest creates a [proto.UserCertsRequest] with the fields
@@ -764,11 +801,11 @@ func PerformSessionMFACeremony(ctx context.Context, params PerformSessionMFACere
 		return nil, trace.Wrap(err)
 	}
 
-	// If mfaResp is nil, the ceremony was a no-op (no devices registered).
-	// TODO(Joerger): CreateAuthenticateChallenge, should return
-	// this error directly instead of an empty challenge, without
-	// regressing https://github.com/gravitational/teleport/issues/36482.
-	if mfaResp == nil {
+	// If mfaResp.GetResponse() is nil, the ceremony was a no-op (no devices
+	// registered). TODO(Joerger): CreateAuthenticateChallenge, should return
+	// this error directly instead of an empty challenge, without regressing
+	// https://github.com/gravitational/teleport/issues/36482.
+	if mfaResp.GetResponse() == nil {
 		return nil, trace.Wrap(authclient.ErrNoMFADevices)
 	}
 
diff --git a/lib/client/db/dbcmd/dbcmd.go b/lib/client/db/dbcmd/dbcmd.go
index fbd139ecfba44..14b38874276ed 100644
--- a/lib/client/db/dbcmd/dbcmd.go
+++ b/lib/client/db/dbcmd/dbcmd.go
@@ -120,17 +120,23 @@ type CLICommandBuilder struct {
 	// --cluster flag. Therefore profile.Cluster is not suitable for
 	// determining the target cluster or the root cluster. Use tc.SiteName for
 	// the target cluster and rootCluster for root cluster.
-	profile *client.ProfileStatus
-	db      *tlsca.RouteToDatabase
-	host    string
-	port    int
-	options connectionCommandOpts
-	uid     utils.UID
+	profile         *client.ProfileStatus
+	db              *tlsca.RouteToDatabase
+	host            string
+	port            int
+	options         connectionCommandOpts
+	uid             utils.UID
+	getDatabaseFunc GetDatabaseFunc
 }
 
-func NewCmdBuilder(tc *client.TeleportClient, profile *client.ProfileStatus,
-	db tlsca.RouteToDatabase, rootClusterName string, opts ...ConnectCommandFunc,
-) *CLICommandBuilder {
+func NewCmdBuilder(
+	tc *client.TeleportClient,
+	profile *client.ProfileStatus,
+	db tlsca.RouteToDatabase,
+	rootClusterName string,
+	getDatabaseFunc GetDatabaseFunc,
+	opts ...ConnectCommandFunc,
+) (*CLICommandBuilder, error) {
 	var options connectionCommandOpts
 	for _, opt := range opts {
 		opt(&options)
@@ -151,16 +157,21 @@ func NewCmdBuilder(tc *client.TeleportClient, profile *client.ProfileStatus,
 		options.exe = &SystemExecer{}
 	}
 
-	return &CLICommandBuilder{
-		tc:          tc,
-		profile:     profile,
-		db:          &db,
-		host:        host,
-		port:        port,
-		options:     options,
-		rootCluster: rootClusterName,
-		uid:         utils.NewRealUID(),
+	if getDatabaseFunc == nil {
+		return nil, trace.BadParameter("GetDatabaseFunc is required and cannot be nil")
 	}
+
+	return &CLICommandBuilder{
+		tc:              tc,
+		profile:         profile,
+		db:              &db,
+		host:            host,
+		port:            port,
+		options:         options,
+		rootCluster:     rootClusterName,
+		getDatabaseFunc: getDatabaseFunc,
+		uid:             utils.NewRealUID(),
+	}, nil
 }
 
 // GetConnectCommand returns a command that can connect the user directly to the given database
@@ -219,7 +230,7 @@ func (c *CLICommandBuilder) GetConnectCommand(ctx context.Context) (*exec.Cmd, e
 		return c.getClickhouseNativeCommand()
 
 	case defaults.ProtocolSpanner:
-		return c.getSpannerCommand()
+		return c.getSpannerCommand(ctx)
 	}
 
 	return nil, trace.BadParameter("unsupported database protocol: %v", c.db)
@@ -281,7 +292,7 @@ func (c *CLICommandBuilder) getPostgresConnString() string {
 // getMySQLCommonCmdOpts returns common command line arguments for mysql and mariadb.
 // Currently, the common options are: user, database, host, port and protocol.
 func (c *CLICommandBuilder) getMySQLCommonCmdOpts() []string {
-	args := make([]string, 0)
+	args := []string{"--skip-password"}
 	if c.db.Username != "" {
 		args = append(args, "--user", c.db.Username)
 	}
@@ -549,12 +560,7 @@ func (c *CLICommandBuilder) getMongoCommand(ctx context.Context) (*exec.Cmd, err
 }
 
 func (c *CLICommandBuilder) getDatabase(ctx context.Context) (types.Database, error) {
-	// Technically, we can just use tc to get the database. But caller may have
-	// extra logic so rely on the callback for now.
-	if c.options.getDatabase == nil {
-		return nil, trace.NotFound("missing GetDatabaseFunc")
-	}
-	db, err := c.options.getDatabase(ctx, c.tc, c.db.ServiceName)
+	db, err := c.getDatabaseFunc(ctx, c.tc, c.db.ServiceName)
 	return db, trace.Wrap(err)
 }
 
@@ -755,25 +761,34 @@ func (c *CLICommandBuilder) getDynamoDBCommand() (*exec.Cmd, error) {
 	return exec.Command(awsBin, args...), nil
 }
 
-func (c *CLICommandBuilder) getSpannerCommand() (*exec.Cmd, error) {
+func (c *CLICommandBuilder) getSpannerCommand(ctx context.Context) (*exec.Cmd, error) {
 	if err := c.checkLocalProxyTunnelOnly(false); err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	var (
+		gcp types.GCPCloudSQL
 		project,
 		instance,
 		database string
 	)
-	if c.options.printFormat {
-		// default placeholders for a print command if not all info is available
+
+	db, err := c.getDatabase(ctx)
+	switch {
+	case err != nil && c.options.printFormat:
+		// OK to continue in this case, we'll print the placeholders instead.
 		project, instance, database = "<project>", "<instance>", "<database>"
+	case err != nil:
+		return nil, trace.Wrap(err)
+	default:
+		gcp = db.GetGCP()
 	}
 
-	if c.options.gcp.ProjectID != "" {
-		project = c.options.gcp.ProjectID
+	if gcp.ProjectID != "" {
+		project = gcp.ProjectID
 	}
-	if c.options.gcp.InstanceID != "" {
-		instance = c.options.gcp.InstanceID
+	if gcp.InstanceID != "" {
+		instance = gcp.InstanceID
 	}
 	if c.db.Database != "" {
 		database = c.db.Database
@@ -955,9 +970,7 @@ type connectionCommandOpts struct {
 	logger                   *slog.Logger
 	exe                      Execer
 	password                 string
-	gcp                      types.GCPCloudSQL
 	oracle                   oracleOpts
-	getDatabase              GetDatabaseFunc
 }
 
 // ConnectCommandFunc is a type for functions returned by the "With*" functions in this package.
@@ -1060,24 +1073,9 @@ func WithOracleOpts(canUseTCP bool, hasTCPServers bool) ConnectCommandFunc {
 	}
 }
 
-// WithGCP adds GCP metadata for the database command to access.
-// TODO(greedy52) use GetDatabaseFunc instead.
-func WithGCP(gcp types.GCPCloudSQL) ConnectCommandFunc {
-	return func(opts *connectionCommandOpts) {
-		opts.gcp = gcp
-	}
-}
-
 // GetDatabaseFunc is a callback to retrieve types.Database.
 type GetDatabaseFunc func(context.Context, *client.TeleportClient, string) (types.Database, error)
 
-// WithGetDatabaseFunc provides a callback to retrieve types.Database.
-func WithGetDatabaseFunc(f GetDatabaseFunc) ConnectCommandFunc {
-	return func(opts *connectionCommandOpts) {
-		opts.getDatabase = f
-	}
-}
-
 const (
 	// envVarMongoServerSelectionTimeoutMS is the environment variable that
 	// controls the server selection timeout used for MongoDB clients.
diff --git a/lib/client/db/dbcmd/dbcmd_test.go b/lib/client/db/dbcmd/dbcmd_test.go
index ccb3039e60cec..dc3bf109b073d 100644
--- a/lib/client/db/dbcmd/dbcmd_test.go
+++ b/lib/client/db/dbcmd/dbcmd_test.go
@@ -79,13 +79,14 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 	}
 
 	tests := []struct {
-		name         string
-		opts         []ConnectCommandFunc
-		dbProtocol   string
-		databaseName string
-		execer       *fakeExec
-		cmd          []string
-		wantErr      bool
+		name            string
+		opts            []ConnectCommandFunc
+		dbProtocol      string
+		databaseName    string
+		execer          *fakeExec
+		cmd             []string
+		wantErr         bool
+		getDatabaseFunc GetDatabaseFunc
 	}{
 		{
 			name:         "postgres",
@@ -186,6 +187,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				},
 			},
 			cmd: []string{"mariadb",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -208,6 +210,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				},
 			},
 			cmd: []string{"mariadb",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -225,6 +228,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				},
 			},
 			cmd: []string{"mysql",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -247,6 +251,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			},
 			cmd: []string{"mysql",
 				"--defaults-group-suffix=_db.example.com-mysql",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -265,6 +270,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				},
 			},
 			cmd: []string{"mysql",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -291,6 +297,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				execOutput: map[string][]byte{},
 			},
 			cmd: []string{"mysql",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "12345",
@@ -309,6 +316,7 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				},
 			},
 			cmd: []string{"mariadb",
+				"--skip-password",
 				"--user", "myUser",
 				"--database", "mydb",
 				"--port", "3036",
@@ -320,10 +328,10 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:         "mongodb (legacy)",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
-			opts:         []ConnectCommandFunc{withMongoDBAtlasDatabase()},
+			name:            "mongodb (legacy)",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					"mongo": []byte("legacy"),
@@ -337,10 +345,11 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:         "mongodb no TLS (legacy)",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
-			opts:         []ConnectCommandFunc{WithNoTLS(), withMongoDBAtlasDatabase()},
+			name:            "mongodb no TLS (legacy)",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
+			opts:            []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					"mongo": []byte("legacy"),
@@ -352,10 +361,10 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:         "mongosh no CA",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
-			opts:         []ConnectCommandFunc{withMongoDBAtlasDatabase()},
+			name:            "mongosh no CA",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					"mongosh": []byte("1.1.6"),
@@ -369,12 +378,12 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			},
 		},
 		{
-			name:         "mongosh",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
+			name:            "mongosh",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("localhost", 12345, "/tmp/keys/example.com/cas/example.com.pem"),
-				withMongoDBAtlasDatabase(),
 			},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
@@ -389,10 +398,11 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			},
 		},
 		{
-			name:         "mongosh no TLS",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
-			opts:         []ConnectCommandFunc{WithNoTLS(), withMongoDBAtlasDatabase()},
+			name:            "mongosh no TLS",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
+			opts:            []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					"mongosh": []byte("1.1.6"),
@@ -403,10 +413,11 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			},
 		},
 		{
-			name:         "mongosh preferred",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "mydb",
-			opts:         []ConnectCommandFunc{WithNoTLS(), withMongoDBAtlasDatabase()},
+			name:            "mongosh preferred",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "mydb",
+			getDatabaseFunc: withMongoDBAtlasDatabase(),
+			opts:            []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{}, // Cannot find either bin.
 			},
@@ -415,10 +426,11 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			},
 		},
 		{
-			name:         "DocumentDB",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "docdb",
-			opts:         []ConnectCommandFunc{WithNoTLS(), withDocumentDBDatabase()},
+			name:            "DocumentDB",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "docdb",
+			getDatabaseFunc: withDocumentDBDatabase(),
+			opts:            []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					// When both are available, legacy mongo is preferred.
@@ -432,10 +444,11 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:         "DocumentDB mongosh",
-			dbProtocol:   defaults.ProtocolMongoDB,
-			databaseName: "docdb",
-			opts:         []ConnectCommandFunc{WithNoTLS(), withDocumentDBDatabase()},
+			name:            "DocumentDB mongosh",
+			dbProtocol:      defaults.ProtocolMongoDB,
+			databaseName:    "docdb",
+			getDatabaseFunc: withDocumentDBDatabase(),
+			opts:            []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
 				execOutput: map[string][]byte{
 					"mongosh": []byte("1.1.6"),
@@ -671,12 +684,12 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr:      false,
 		},
 		{
-			name:       "Spanner for exec is ok",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner for exec is ok",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
@@ -684,13 +697,13 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr:      false,
 		},
 		{
-			name:       "Spanner with print format is ok",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner with print format is ok",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			opts: []ConnectCommandFunc{
 				WithPrintFormat(),
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
@@ -698,13 +711,13 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr:      false,
 		},
 		{
-			name:       "Spanner with print format and placeholders is ok",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner with print format and placeholders is ok",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: getDatabaseFuncWithError, // When format is set the command can accept error when fetching the database.
 			opts: []ConnectCommandFunc{
 				WithPrintFormat(),
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "",
@@ -712,48 +725,48 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr:      false,
 		},
 		{
-			name:       "Spanner for exec without GCP project is an error",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner for exec without GCP project is an error",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{InstanceID: "bar-instance"}),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{InstanceID: "bar-instance"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
 			wantErr:      true,
 		},
 		{
-			name:       "Spanner for exec without GCP instance is an error",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner for exec without GCP instance is an error",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{ProjectID: "foo-proj"}),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{ProjectID: "foo-proj"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
 			wantErr:      true,
 		},
 		{
-			name:       "Spanner for exec without database name is an error",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner for exec without database name is an error",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{ProjectID: "foo-proj"}),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("localhost", 12345, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{ProjectID: "foo-proj"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
 			wantErr:      true,
 		},
 		{
-			name:       "Spanner without a local proxy is an error",
-			dbProtocol: defaults.ProtocolSpanner,
+			name:            "Spanner without a local proxy is an error",
+			dbProtocol:      defaults.ProtocolSpanner,
+			getDatabaseFunc: withSpannerDatabase(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			opts: []ConnectCommandFunc{
 				WithLocalProxy("", 0, ""),
 				WithNoTLS(),
-				WithGCP(types.GCPCloudSQL{ProjectID: "foo-proj", InstanceID: "bar-instance"}),
 			},
 			execer:       &fakeExec{},
 			databaseName: "googlesql-db",
@@ -785,7 +798,13 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				WithExecer(tt.execer),
 			}, tt.opts...)
 
-			c := NewCmdBuilder(tc, profile, database, "root", opts...)
+			getDatabaseFunc := tt.getDatabaseFunc
+			if getDatabaseFunc == nil {
+				getDatabaseFunc = getDatabaseFuncWithError
+			}
+
+			c, err := NewCmdBuilder(tc, profile, database, "root", getDatabaseFunc, opts...)
+			require.NoError(t, err)
 			c.uid = utils.NewFakeUID()
 			got, err := c.GetConnectCommand(context.Background())
 			if tt.wantErr {
@@ -818,13 +837,14 @@ func TestCLICommandBuilderGetConnectCommandAlternatives(t *testing.T) {
 	}
 
 	tests := []struct {
-		name         string
-		opts         []ConnectCommandFunc
-		dbProtocol   string
-		databaseName string
-		execer       *fakeExec
-		cmd          map[string][]string
-		wantErr      bool
+		name            string
+		opts            []ConnectCommandFunc
+		dbProtocol      string
+		databaseName    string
+		execer          *fakeExec
+		cmd             map[string][]string
+		wantErr         bool
+		getDatabaseFunc GetDatabaseFunc
 	}{
 		{
 			name:         "postgres no TLS",
@@ -948,7 +968,13 @@ func TestCLICommandBuilderGetConnectCommandAlternatives(t *testing.T) {
 				WithExecer(tt.execer),
 			}, tt.opts...)
 
-			c := NewCmdBuilder(tc, profile, database, "root", opts...)
+			getDatabaseFunc := tt.getDatabaseFunc
+			if getDatabaseFunc == nil {
+				getDatabaseFunc = getDatabaseFuncWithError
+			}
+
+			c, err := NewCmdBuilder(tc, profile, database, "root", getDatabaseFunc, opts...)
+			require.NoError(t, err)
 			c.uid = utils.NewFakeUID()
 
 			commandOptions, err := c.GetConnectCommandAlternatives(context.Background())
@@ -988,12 +1014,13 @@ func TestConvertCommandError(t *testing.T) {
 	}
 
 	tests := []struct {
-		desc       string
-		dbProtocol string
-		execer     *fakeExec
-		stderr     []byte
-		wantBin    string
-		wantStdErr string
+		desc            string
+		dbProtocol      string
+		execer          *fakeExec
+		stderr          []byte
+		wantBin         string
+		wantStdErr      string
+		getDatabaseFunc GetDatabaseFunc
 	}{
 		{
 			desc:       "converts access denied to helpful message",
@@ -1034,7 +1061,14 @@ func TestConvertCommandError(t *testing.T) {
 				WithNoTLS(),
 				WithExecer(tt.execer),
 			}
-			c := NewCmdBuilder(tc, profile, database, "root", opts...)
+
+			getDatabaseFunc := tt.getDatabaseFunc
+			if getDatabaseFunc == nil {
+				getDatabaseFunc = getDatabaseFuncWithError
+			}
+
+			c, err := NewCmdBuilder(tc, profile, database, "root", getDatabaseFunc, opts...)
+			require.NoError(t, err)
 			c.uid = utils.NewFakeUID()
 
 			cmd, err := c.GetConnectCommand(context.Background())
@@ -1053,8 +1087,8 @@ func TestConvertCommandError(t *testing.T) {
 	}
 }
 
-func withMongoDBAtlasDatabase() ConnectCommandFunc {
-	return WithGetDatabaseFunc(func(context.Context, *client.TeleportClient, string) (types.Database, error) {
+func withMongoDBAtlasDatabase() GetDatabaseFunc {
+	return func(context.Context, *client.TeleportClient, string) (types.Database, error) {
 		db, err := types.NewDatabaseV3(
 			types.Metadata{
 				Name: "mongodb-atlas",
@@ -1065,11 +1099,11 @@ func withMongoDBAtlasDatabase() ConnectCommandFunc {
 			},
 		)
 		return db, trace.Wrap(err)
-	})
+	}
 }
 
-func withDocumentDBDatabase() ConnectCommandFunc {
-	return WithGetDatabaseFunc(func(context.Context, *client.TeleportClient, string) (types.Database, error) {
+func withDocumentDBDatabase() GetDatabaseFunc {
+	return func(context.Context, *client.TeleportClient, string) (types.Database, error) {
 		db, err := types.NewDatabaseV3(
 			types.Metadata{
 				Name: "docdb",
@@ -1080,5 +1114,28 @@ func withDocumentDBDatabase() ConnectCommandFunc {
 			},
 		)
 		return db, trace.Wrap(err)
-	})
+	}
+}
+
+func withSpannerDatabase(gcp types.GCPCloudSQL) GetDatabaseFunc {
+	return func(context.Context, *client.TeleportClient, string) (types.Database, error) {
+		db, err := types.NewDatabaseV3(
+			types.Metadata{
+				Name: "docdb",
+			},
+			types.DatabaseSpecV3{
+				Protocol: types.DatabaseTypeSpanner,
+				URI:      "spanner.googleapis.com:443",
+				GCP:      gcp,
+			},
+		)
+		return db, trace.Wrap(err)
+	}
+}
+
+// getDatabaseFuncWithError provides a non-nil function that returns error when
+// retrieving the database. This can be used in tests that don't retrieve
+// databases.
+func getDatabaseFuncWithError(ctx context.Context, tc *client.TeleportClient, s string) (types.Database, error) {
+	return nil, trace.NotImplemented("unexpected call to getDatabase function")
 }
diff --git a/lib/client/db/dbcmd/exec_test.go b/lib/client/db/dbcmd/exec_test.go
index 7cc4a2f5e511b..f144a41b489da 100644
--- a/lib/client/db/dbcmd/exec_test.go
+++ b/lib/client/db/dbcmd/exec_test.go
@@ -58,11 +58,12 @@ func TestCLICommandBuilderGetExecCommand(t *testing.T) {
 	}
 
 	tests := []struct {
-		name     string
-		opts     []ConnectCommandFunc
-		protocol string
-		cmd      []string
-		wantErr  bool
+		name            string
+		opts            []ConnectCommandFunc
+		protocol        string
+		cmd             []string
+		wantErr         bool
+		getDatabaseFunc GetDatabaseFunc
 	}{
 		{
 			name:     "not authenticated tunnel",
@@ -86,7 +87,7 @@ func TestCLICommandBuilderGetExecCommand(t *testing.T) {
 			name:     "mysql",
 			protocol: defaults.ProtocolMySQL,
 			opts:     []ConnectCommandFunc{WithNoTLS()},
-			cmd:      []string{"mysql", "--user", "db-user", "--database", "db-name", "--port", "12345", "--host", "localhost", "--protocol", "TCP", "-e", "select 1"},
+			cmd:      []string{"mysql", "--skip-password", "--user", "db-user", "--database", "db-name", "--port", "12345", "--host", "localhost", "--protocol", "TCP", "-e", "select 1"},
 			wantErr:  false,
 		},
 	}
@@ -105,7 +106,13 @@ func TestCLICommandBuilderGetExecCommand(t *testing.T) {
 				WithExecer(fakeExec),
 			}, tt.opts...)
 
-			c := NewCmdBuilder(tc, profile, database, "root", opts...)
+			getDatabaseFunc := tt.getDatabaseFunc
+			if getDatabaseFunc == nil {
+				getDatabaseFunc = getDatabaseFuncWithError
+			}
+
+			c, err := NewCmdBuilder(tc, profile, database, "root", getDatabaseFunc, opts...)
+			require.NoError(t, err)
 			c.uid = utils.NewFakeUID()
 			got, err := c.GetExecCommand(context.Background(), "select 1")
 			if tt.wantErr {
diff --git a/lib/client/db/mcp/errors.go b/lib/client/db/mcp/errors.go
new file mode 100644
index 0000000000000..04a00c0043850
--- /dev/null
+++ b/lib/client/db/mcp/errors.go
@@ -0,0 +1,68 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"errors"
+	"io"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/client/mcp"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// FormatErrorMessage formats the database MCP error messages.
+// format.
+func FormatErrorMessage(err error) error {
+	switch {
+	case errors.Is(err, apiclient.ErrClientCredentialsHaveExpired) || utils.IsCertExpiredError(err):
+		return trace.BadParameter(mcp.ReloginRequiredErrorMessage)
+	case strings.Contains(err.Error(), "connection reset by peer") || errors.Is(err, io.ErrClosedPipe):
+		return trace.BadParameter(LocalProxyConnectionErrorMessage)
+	}
+
+	return err
+}
+
+const (
+	// LocalProxyConnectionErrorMessage is the message returned to the MCP client when
+	// the database client cannot connect to the local proxy.
+	LocalProxyConnectionErrorMessage = `Teleport MCP server is having issue while
+establishing the database connection. You can verify the MCP logs for more
+details on what is causing this issue. After identifying and fixing the issue
+a restart on the MCP client might be necessary.`
+	// EmptyDatabasesListErrorMessage is the message returned to the MCP client when
+	// the started database server is serving no databases.
+	EmptyDatabasesListErrorMessage = `There are no active Teleport databases available
+for use on the MCP server. You can check the MCP server logs to see if any
+database was not included due to an error. You can also verify that the list
+of databases on the MCP command is correct.`
+)
+
+var (
+	// WrongDatabaseURIFormatError is the message returned to the MCP client
+	// when it sends a malformed database resource URI.
+	WrongDatabaseURIFormatError = trace.BadParameter("Malformed database resource URI. Database resources must follow the format: %q", mcp.SampleDatabaseResource)
+	// DatabaseNotFoundError is the message returned to the MCP client when the
+	// requested database is not available as MCP resource.
+	DatabaseNotFoundError = trace.NotFound(`Database not found. Only registered databases
+can be used. Ask the user to attach the database resource or list the available
+resources with %q tool`, listDatabasesToolName)
+)
diff --git a/lib/client/db/mcp/mcp.go b/lib/client/db/mcp/mcp.go
new file mode 100644
index 0000000000000..fdb514860bf5a
--- /dev/null
+++ b/lib/client/db/mcp/mcp.go
@@ -0,0 +1,101 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"context"
+	"log/slog"
+	"net"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client/mcp"
+)
+
+// NewServerConfig configuration passed to the server constructors.
+type NewServerConfig struct {
+	Logger     *slog.Logger
+	RootServer *RootServer
+	Databases  []*Database
+}
+
+// NewServerFunc the MCP server constructor function definition.
+type NewServerFunc func(context.Context, *NewServerConfig) (Server, error)
+
+// Server represents a MCP server.
+type Server interface {
+	// Close closes the server.
+	Close(context.Context) error
+}
+
+// Registry represents the available databases MCP servers per protocol and
+// their constructors.
+type Registry map[string]NewServerFunc
+
+// IsSupported returns if the database protocol is supported by any MCP server
+// available.
+func (m Registry) IsSupported(protocol string) bool {
+	_, ok := m[protocol]
+	return ok
+}
+
+// LookupFunc is the function used to resolve database address. Follows the
+// net.Resolver.LookupAddr format.
+type LookupFunc func(ctx context.Context, host string) (addrs []string, err error)
+
+// DialContextFunc is a function used to dial the database. Follows the
+// net.Dialer.DialContext format.
+type DialContextFunc func(ctx context.Context, network string, addr string) (net.Conn, error)
+
+// Database the database served by an MCP server.
+type Database struct {
+	// DB contains all information from the database.
+	DB types.Database
+	// ClusterName is the cluster name where the database is located.
+	ClusterName string
+	// DatabaseUser is the database username used on the connections.
+	DatabaseUser string
+	// DatabaseName is the database name used on the connections.
+	DatabaseName string
+	// LookupFunc is the lookup function to resolve database address.
+	LookupFunc LookupFunc
+	// DialContextFunc is the dial function used to connect to the database.
+	DialContextFunc DialContextFunc
+}
+
+// ResourceURI returns the database MCP resource URI.
+func (d Database) ResourceURI() mcp.ResourceURI {
+	return mcp.NewDatabaseResourceURI(d.ClusterName, d.DB.GetName())
+}
+
+// DatabaseResource MCP resource representation of a Teleport database.
+type DatabaseResource struct {
+	types.Metadata
+	// URI is the MCP URI resource.
+	URI string `json:"uri"`
+	// Protocol is the database protocol.
+	Protocol string `json:"protocol"`
+	// ClusterName is the cluster the database is.
+	ClusterName string `json:"cluster_name"`
+}
+
+// ToolName generates a database access tool name.
+func ToolName(protocol, name string) string {
+	return ToolPrefix + protocol + "_" + name
+}
+
+// ToolPrefix is the default tool prefix for every MCP tool.
+const ToolPrefix = "teleport_"
diff --git a/lib/client/db/mcp/server.go b/lib/client/db/mcp/server.go
new file mode 100644
index 0000000000000..eb693032e78e6
--- /dev/null
+++ b/lib/client/db/mcp/server.go
@@ -0,0 +1,158 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"sync"
+
+	"github.com/ghodss/yaml"
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+
+	"github.com/gravitational/teleport"
+)
+
+// listDatabasesTool is the MCP tool that list all databases being served
+// (from all protocols).
+var listDatabasesTool = mcp.NewTool(listDatabasesToolName,
+	mcp.WithDescription("List database resources available to be used with Teleport tools."),
+)
+
+// RootServer database access root MCP server. It includes common MCP tools and
+// resources across different databases and serves as a root server where
+// database-specific MCP servers register their tools.
+type RootServer struct {
+	*mcpserver.MCPServer
+
+	mu                 sync.RWMutex
+	logger             *slog.Logger
+	availableDatabases map[string]*Database
+}
+
+// NewRootServer initializes a new root MCP server.
+func NewRootServer(logger *slog.Logger) *RootServer {
+	server := &RootServer{
+		MCPServer:          mcpserver.NewMCPServer(serverName, teleport.Version),
+		logger:             logger,
+		availableDatabases: make(map[string]*Database),
+	}
+	server.AddTool(listDatabasesTool, server.ListDatabases)
+
+	return server
+}
+
+// ListDatabases tool function used to list all available/served databases.
+//
+// Note: Given some MCP clients not fully support resources of any kind (including
+// embedded and references), we must return the databases as plain text result so
+// the tool keeps working on those clients.
+func (s *RootServer) ListDatabases(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if len(s.availableDatabases) == 0 {
+		return mcp.NewToolResultError(EmptyDatabasesListErrorMessage), nil
+	}
+
+	var res []mcp.Content
+	for _, db := range s.availableDatabases {
+		contents, err := encodeDatabaseResource(db)
+		if err != nil {
+			s.logger.ErrorContext(ctx, "error while list databases", "error", err)
+			return mcp.NewToolResultError(FormatErrorMessage(err).Error()), nil
+		}
+		res = append(res, mcp.NewTextContent(contents))
+	}
+
+	return &mcp.CallToolResult{
+		Content: res,
+	}, nil
+}
+
+// GetDatabaseResource resource handler for databases.
+func (s *RootServer) GetDatabaseResource(ctx context.Context, request mcp.ReadResourceRequest) ([]mcp.ResourceContents, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	db, ok := s.availableDatabases[request.Params.URI]
+	if !ok {
+		return nil, trace.NotFound("Database is %q not available as MCP resource", request.Params.URI)
+	}
+
+	encodedDb, err := encodeDatabaseResource(db)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return []mcp.ResourceContents{mcp.TextResourceContents{
+		URI:      request.Params.URI,
+		MIMEType: databaseResourceMIMEType,
+		Text:     encodedDb,
+	}}, nil
+}
+
+// RegisterDatabase register a database on the root server. This make it
+// available as a MCP resource.
+//
+// TODO(gabrielcorado): support dynamically registering/deregistering databases
+// after the server starts.
+func (s *RootServer) RegisterDatabase(db *Database) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	uri := db.ResourceURI().WithoutParams().String()
+	s.availableDatabases[uri] = db
+	s.AddResource(mcp.NewResource(uri, fmt.Sprintf("%s Datatabase", db.DB.GetName()), mcp.WithMIMEType(databaseResourceMIMEType)), s.GetDatabaseResource)
+}
+
+// ServeStdio starts serving the root MCP using STDIO transport.
+func (s *RootServer) ServeStdio(ctx context.Context, in io.Reader, out io.Writer) error {
+	return trace.Wrap(mcpserver.NewStdioServer(s.MCPServer).Listen(ctx, in, out))
+}
+
+func buildDatabaseResource(db *Database) DatabaseResource {
+	return DatabaseResource{
+		Metadata:    db.DB.GetMetadata(),
+		URI:         db.ResourceURI().WithoutParams().String(),
+		Protocol:    db.DB.GetProtocol(),
+		ClusterName: db.ClusterName,
+	}
+}
+
+func encodeDatabaseResource(db *Database) (string, error) {
+	resource := buildDatabaseResource(db)
+	out, err := yaml.Marshal(resource)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return string(out), nil
+}
+
+const (
+	// serverName is the database MCP server name.
+	serverName = "teleport_databases"
+	// listDatabasesTool is the list databases tool name.
+	listDatabasesToolName = ToolPrefix + "list_databases"
+	// databaseResourceMIMEType is the MIME type of the database resources.
+	databaseResourceMIMEType = "application/yaml"
+)
diff --git a/lib/client/db/mcp/server_test.go b/lib/client/db/mcp/server_test.go
new file mode 100644
index 0000000000000..997c90c7d9e8c
--- /dev/null
+++ b/lib/client/db/mcp/server_test.go
@@ -0,0 +1,176 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"log/slog"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/ghodss/yaml"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+func TestRegisterDatabase(t *testing.T) {
+	server := NewRootServer(slog.New(slog.DiscardHandler))
+	databases := []*Database{
+		buildDatabase(t, "first"),
+		buildDatabase(t, "second"),
+		buildDatabase(t, "third"),
+	}
+	// sort databases by name to ensure the same order every test.
+	slices.SortFunc(databases, func(a, b *Database) int {
+		return strings.Compare(a.ResourceURI().WithoutParams().String(), b.ResourceURI().WithoutParams().String())
+	})
+
+	for _, db := range databases {
+		server.RegisterDatabase(db)
+	}
+
+	clt := buildClient(t, server)
+	t.Run("Resources", func(t *testing.T) {
+		listResult, err := clt.ListResources(t.Context(), mcp.ListResourcesRequest{})
+		require.NoError(t, err)
+		require.Len(t, listResult.Resources, len(databases))
+
+		// sort the result using the same field as databases to avoid flaky
+		// test.
+		slices.SortFunc(listResult.Resources, func(a, b mcp.Resource) int {
+			return strings.Compare(a.URI, b.URI)
+		})
+
+		for i, r := range listResult.Resources {
+			req := mcp.ReadResourceRequest{}
+			req.Params.URI = r.URI
+			readResult, err := clt.ReadResource(t.Context(), req)
+			require.NoError(t, err)
+			require.Len(t, readResult.Contents, 1)
+			assertDatabaseResource(t, databases[i], readResult.Contents[0])
+		}
+	})
+
+	t.Run("Tool", func(t *testing.T) {
+		req := mcp.CallToolRequest{}
+		req.Params.Name = listDatabasesToolName
+		res, err := clt.CallTool(t.Context(), req)
+		require.NoError(t, err)
+		require.False(t, res.IsError)
+		require.Len(t, res.Content, len(databases))
+
+		for _, c := range res.Content {
+			require.IsType(t, mcp.TextContent{}, c)
+		}
+
+		// Although we're not sorting by the URI directly, the only field that
+		// is different across the databases is their name and URI (which would
+		// cause them to have the same order). So here we sort by the YAML
+		// contents to avoid having to decode.
+		slices.SortFunc(res.Content, func(a, b mcp.Content) int {
+			resourceA := a.(mcp.TextContent).Text
+			resourceB := b.(mcp.TextContent).Text
+			return strings.Compare(resourceA, resourceB)
+		})
+
+		for i, c := range res.Content {
+			var database DatabaseResource
+			content := c.(mcp.TextContent)
+			require.NoError(t, yaml.Unmarshal([]byte(content.Text), &database))
+			require.Empty(t, cmp.Diff(buildDatabaseResource(databases[i]), database, cmpopts.IgnoreFields(types.Metadata{}, "Namespace")))
+		}
+	})
+}
+
+func TestEmptyDatabasesServer(t *testing.T) {
+	server := NewRootServer(slog.New(slog.DiscardHandler))
+
+	clt := buildClient(t, server)
+	t.Run("Resources", func(t *testing.T) {
+		_, err := clt.ListResources(t.Context(), mcp.ListResourcesRequest{})
+		require.Error(t, err)
+	})
+
+	t.Run("Tool", func(t *testing.T) {
+		req := mcp.CallToolRequest{}
+		req.Params.Name = listDatabasesToolName
+		res, err := clt.CallTool(t.Context(), req)
+		require.NoError(t, err)
+		require.True(t, res.IsError)
+
+		require.Len(t, res.Content, 1)
+		content := res.Content[0]
+		require.IsType(t, mcp.TextContent{}, content)
+		textError := content.(mcp.TextContent).Text
+		require.Contains(t, textError, EmptyDatabasesListErrorMessage, "expected empty databases error but got: %s", textError)
+	})
+}
+
+func assertDatabaseResource(t *testing.T, db *Database, resource mcp.ResourceContents) {
+	t.Helper()
+	require.IsType(t, mcp.TextResourceContents{}, resource)
+	contents := resource.(mcp.TextResourceContents)
+	var database DatabaseResource
+	require.Equal(t, databaseResourceMIMEType, contents.MIMEType)
+	require.NoError(t, yaml.Unmarshal([]byte(contents.Text), &database))
+	require.Empty(t, cmp.Diff(buildDatabaseResource(db), database, cmpopts.IgnoreFields(types.Metadata{}, "Namespace")))
+}
+
+func buildDatabase(t *testing.T, name string) *Database {
+	t.Helper()
+
+	db, err := types.NewDatabaseV3(types.Metadata{
+		Name:   name,
+		Labels: map[string]string{"env": "test"},
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      "localhost:5432",
+	})
+	require.NoError(t, err)
+
+	return &Database{
+		DB:          db,
+		ClusterName: "root",
+	}
+}
+
+func buildClient(t *testing.T, server *RootServer) *mcpclient.Client {
+	t.Helper()
+
+	clt, err := mcpclient.NewInProcessClient(server.MCPServer)
+	require.NoError(t, err)
+	t.Cleanup(func() { clt.Close() })
+	require.NoError(t, clt.Start(t.Context()))
+
+	initRequest := mcp.InitializeRequest{}
+	initRequest.Params.ProtocolVersion = mcp.LATEST_PROTOCOL_VERSION
+	initRequest.Params.ClientInfo = mcp.Implementation{
+		Name:    "test-client",
+		Version: "1.0.0",
+	}
+
+	_, err = clt.Initialize(t.Context(), initRequest)
+	require.NoError(t, err)
+	require.NoError(t, clt.Ping(t.Context()))
+	return clt
+}
diff --git a/lib/client/db/mysql/optionfile.go b/lib/client/db/mysql/optionfile.go
index 4efa27a300fb9..02716ffa2f231 100644
--- a/lib/client/db/mysql/optionfile.go
+++ b/lib/client/db/mysql/optionfile.go
@@ -97,6 +97,7 @@ func (o *OptionFile) Upsert(profile profile.ConnectProfile) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	section.NewBooleanKey("skip-password")
 	section.NewKey("host", profile.Host)
 	section.NewKey("port", strconv.Itoa(profile.Port))
 	if profile.User != "" {
diff --git a/lib/client/db/mysql/optionfile_test.go b/lib/client/db/mysql/optionfile_test.go
index 7621ad718b4e5..b52e83e2edc91 100644
--- a/lib/client/db/mysql/optionfile_test.go
+++ b/lib/client/db/mysql/optionfile_test.go
@@ -65,14 +65,15 @@ func TestOptionFile(t *testing.T) {
 
 	require.Equal(t,
 		map[string]string{
-			"host":     "localhost",
-			"port":     "3036",
-			"user":     "root",
-			"database": "mysql",
-			"ssl-mode": "VERIFY_IDENTITY",
-			"ssl-ca":   `c:\\users\\user\\.tsh\\foo\\ca.pem`,
-			"ssl-cert": `c:\\users\\user\\.tsh\\foo\\cert.pem`,
-			"ssl-key":  `c:\\users\\user\\.tsh\\foo\\key.pem`,
+			"host":          "localhost",
+			"port":          "3036",
+			"user":          "root",
+			"database":      "mysql",
+			"ssl-mode":      "VERIFY_IDENTITY",
+			"ssl-ca":        `c:\\users\\user\\.tsh\\foo\\ca.pem`,
+			"ssl-cert":      `c:\\users\\user\\.tsh\\foo\\cert.pem`,
+			"ssl-key":       `c:\\users\\user\\.tsh\\foo\\key.pem`,
+			"skip-password": "true",
 		},
 		clientTest.KeysHash())
 
diff --git a/lib/client/db/mysql/repl/commands.go b/lib/client/db/mysql/repl/commands.go
new file mode 100644
index 0000000000000..aa517f0665c91
--- /dev/null
+++ b/lib/client/db/mysql/repl/commands.go
@@ -0,0 +1,280 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"cmp"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/asciitable"
+)
+
+type commandManager struct {
+	byName     map[string]*command
+	byShortcut map[rune]*command
+	// shortcutPrefix is the prefix for command shortcuts, e.g. \h for help.
+	shortcutPrefix string
+}
+
+// command represents a command that can be executed in the REPL.
+type command struct {
+	// name is the command's full name.
+	name string
+	// shortcut is the command's escaped single char name: \x.
+	shortcut rune
+	// description provides a user-friendly explanation of what the command
+	// does.
+	description string
+	// execFunc is the function to execute the command. The commands can either
+	// return a reply (that will be sent back to the client) as a string. It can
+	// terminate the REPL by returning bool on the second argument.
+	execFunc func(r *REPL, args string) (reply string, exit bool)
+}
+
+func (c *command) checkAndSetDefaults() error {
+	if len(c.name) == 0 {
+		return trace.BadParameter("missing command name")
+	}
+	if c.shortcut == 0 {
+		return trace.BadParameter("missing command short name")
+	}
+	if len(c.description) == 0 {
+		return trace.BadParameter("missing command description")
+	}
+	if c.execFunc == nil {
+		return trace.BadParameter("missing command exec func")
+	}
+	c.name = normalizeCommandName(c.name)
+	return nil
+}
+
+func normalizeCommandName(name string) string {
+	return strings.ToLower(name)
+}
+
+func newCommands() (*commandManager, error) {
+	c := &commandManager{
+		byName:         make(map[string]*command),
+		byShortcut:     make(map[rune]*command),
+		shortcutPrefix: `\`,
+	}
+	for _, cmd := range []*command{
+		{
+			name:        "delimiter",
+			shortcut:    'd',
+			description: "Set statement delimiter. With no argument the delimiter resets to the default.",
+			execFunc: func(r *REPL, args string) (reply string, exit bool) {
+				delim := getArg(args)
+				if err := r.parser.lex.setDelimiter(delim); err != nil {
+					return err.Error(), false
+				}
+				return "", false
+			},
+		},
+		{
+			name:        "help",
+			shortcut:    'h',
+			description: "Show the list of supported commands.",
+			execFunc: func(_ *REPL, _ string) (string, bool) {
+				return c.help(), false
+			},
+		},
+		{
+			name:        "quit",
+			shortcut:    'q',
+			description: "Terminates the session.",
+			execFunc:    func(_ *REPL, _ string) (string, bool) { return "", true },
+		},
+		{
+			name:        "status",
+			shortcut:    's',
+			description: "Get status information.",
+			execFunc: func(r *REPL, _ string) (string, bool) {
+				table := asciitable.MakeHeadlessTable(2)
+				table.AddRow([]string{"Teleport database:", r.route.ServiceName})
+				table.AddRow([]string{"Current database:", formatDatabaseName(r.route.Database)})
+				table.AddRow([]string{"Current user:", r.route.Username})
+				table.AddRow([]string{"Server version:", r.myConn.GetServerVersion()})
+				table.AddRow([]string{"Using delimiter:", r.parser.lex.delimiter()})
+				return table.String(), false
+			},
+		},
+		{
+			name:        "teleport",
+			shortcut:    't',
+			description: "Show Teleport interactive shell information, such as execution limitations.",
+			execFunc: func(r *REPL, _ string) (string, bool) {
+				var sb strings.Builder
+				for _, l := range descriptiveLimitations {
+					sb.WriteString("- " + strings.ReplaceAll(l, "\n", "\n  ") + lineBreak)
+				}
+				return fmt.Sprintf(
+					"Teleport MySQL interactive shell (v%s)\n\nLimitations: \n%s",
+					cmp.Or(r.teleportVersion, teleport.Version),
+					sb.String(),
+				), false
+			},
+		},
+		{
+			name:        "use",
+			shortcut:    'u',
+			description: "Use another database.",
+			execFunc: func(r *REPL, args string) (string, bool) {
+				args = strings.TrimSpace(args)
+				if len(args) == 0 {
+					return "USE must be followed by a database name", false
+				}
+				dbName, err := getDatabaseName(r.myConn, args)
+				if err != nil {
+					return err.Error(), false
+				}
+				if err := r.myConn.UseDB(dbName); err != nil {
+					return err.Error(), false
+				}
+				r.route.Database = dbName
+				return fmt.Sprintf(`Default database changed to %q`, dbName), false
+			},
+		},
+	} {
+		if err := cmd.checkAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if err := c.add(cmd); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return c, nil
+}
+
+func (c *commandManager) add(cmd *command) error {
+	if _, ok := c.byName[cmd.name]; ok {
+		return trace.BadParameter("overlapping command name: %s", cmd.name)
+	}
+	c.byName[cmd.name] = cmd
+	if _, ok := c.byShortcut[cmd.shortcut]; ok {
+		return trace.BadParameter("overlapping command shortcut: %c", cmd.shortcut)
+	}
+	c.byShortcut[cmd.shortcut] = cmd
+	return nil
+}
+
+// findCommand tries to find a command at the start of a line. If a command name
+// or short name matches, then it returns the command and the rest of the line.
+// If no command is found and the line does not start with the short name prefix
+// then the command and error returned will both be nil.
+func (c *commandManager) findCommand(line string) (*command, string, error) {
+	line = strings.TrimSpace(line)
+	if before, after, found := strings.Cut(line, c.shortcutPrefix); found && len(before) == 0 {
+		shortcut, width := utf8.DecodeRuneInString(after)
+		if width > 0 && shortcut != utf8.RuneError {
+			if cmd, ok := c.byShortcut[shortcut]; ok {
+				return cmd, after[1:], nil
+			}
+		}
+		return nil, "", trace.Errorf("Unknown command.\n%v", c.help())
+	}
+
+	name, after, _ := strings.Cut(line, " ")
+	if cmd, ok := c.byName[normalizeCommandName(name)]; ok {
+		return cmd, after, nil
+	}
+	return nil, "", nil
+}
+
+func (c *commandManager) help() string {
+	var res strings.Builder
+	cmds := slices.Collect(maps.Values(c.byName))
+	slices.SortStableFunc(cmds, func(a, b *command) int {
+		return strings.Compare(a.name, b.name)
+	})
+	table := asciitable.MakeHeadlessTable(3)
+	for _, cmd := range cmds {
+		short := fmt.Sprintf("%s%c", c.shortcutPrefix, cmd.shortcut)
+		row := []string{cmd.name, short, cmd.description}
+		table.AddRow(row)
+	}
+	table.WriteTo(&res)
+	res.WriteString(lineBreak)
+	return res.String()
+}
+
+// getArg trims spaces from the line and returns the first space separated arg.
+func getArg(line string) string {
+	line = strings.TrimSpace(line)
+	before, _, _ := strings.Cut(line, " ")
+	return before
+}
+
+// getDatabaseName extracts a database name from args.
+// Since USE is both a command (COM_INIT_DB) and a statement, as a client
+// we have to parse the database argument for COM_INIT_DB.
+// To handle quotation, we send the args to the server as a statement and then
+// ask the server what the current database is.
+func getDatabaseName(conn mysql.Executer, args string) (string, error) {
+	result, err := conn.Execute("USE " + args)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	result.Close()
+	return getCurrentDatabase(conn)
+}
+
+func getCurrentDatabase(conn mysql.Executer) (string, error) {
+	result, err := conn.Execute("SELECT DATABASE() LIMIT 1")
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	defer result.Close()
+	if result.Resultset == nil || len(result.Resultset.Values) == 0 || len(result.Resultset.Values[0]) == 0 {
+		return "", trace.NotFound("missing result")
+	}
+	val := result.Resultset.Values[0][0]
+	if val.Type == mysql.FieldValueTypeString {
+		return string(val.AsString()), nil
+	}
+	return "", nil
+}
+
+func formatDatabaseName(name string) string {
+	return cmp.Or(name, "(none)")
+}
+
+// descriptiveLimitations defines a user-friendly text containing the REPL
+// limitations.
+var descriptiveLimitations = []string{
+	`Query cancellation is not supported. Once a query is sent, its execution
+can only be canceled by killing it from another session.
+You can identify the query process ID with "SHOW PROCESSLIST" and then kill the
+query with "KILL QUERY <pid>".
+`,
+	// This limitation is due to our terminal emulator not fully supporting this
+	// shortcut's custom handler. Instead, it will close the terminal, leading
+	// to terminating the session. To avoid having users accidentally
+	// terminating their sessions, we're turning this off until we have a better
+	// solution and propose the behavior for it.
+	//
+	// This shortcut filtered out by the WebUI key handler.
+	"Pressing CTRL-C will have no effect in this shell.",
+}
diff --git a/lib/client/db/mysql/repl/commands_test.go b/lib/client/db/mysql/repl/commands_test.go
new file mode 100644
index 0000000000000..0671945cc4796
--- /dev/null
+++ b/lib/client/db/mysql/repl/commands_test.go
@@ -0,0 +1,187 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"maps"
+	"slices"
+	"testing"
+
+	"github.com/go-mysql-org/go-mysql/client"
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	clientproto "github.com/gravitational/teleport/api/client/proto"
+)
+
+func TestCommands(t *testing.T) {
+	t.Parallel()
+	parser, err := newParser()
+	require.NoError(t, err)
+	commands := parser.commands
+	require.NotEmpty(t, commands.byName)
+	require.ElementsMatch(t,
+		slices.Collect(maps.Values(commands.byName)),
+		slices.Collect(maps.Values(commands.byShortcut)),
+	)
+
+	for name, cmd := range commands.byName {
+		require.NotNil(t, cmd)
+		require.NotEmpty(t, cmd.name)
+		require.NotZero(t, cmd.shortcut)
+		require.NotEmpty(t, cmd.description)
+		require.NotNil(t, cmd.execFunc)
+
+		require.Equal(t, cmd.name, name, "expected command to be registered by name")
+		byShortcut, ok := commands.byShortcut[cmd.shortcut]
+		require.True(t, ok)
+		require.Equal(t, cmd, byShortcut, "expected commands from name and shortcut indices to match")
+	}
+
+	repl := &REPL{
+		parser: parser,
+		myConn: &fakeMySQLConn{
+			exec: func(command string, args ...any) (*mysql.Result, error) {
+				resultSet, err := mysql.BuildSimpleTextResultset([]string{"current_database"}, [][]any{{"example"}})
+				if err != nil {
+					return nil, err
+				}
+				resultSet.Values = make([][]mysql.FieldValue, 1)
+				resultSet.Values[0], err = resultSet.RowDatas[0].Parse(resultSet.Fields, false, nil)
+				return &mysql.Result{
+					Resultset: resultSet,
+				}, err
+			},
+		},
+		route: clientproto.RouteToDatabase{
+			ServiceName: "test-service",
+			Username:    "test-user",
+			Database:    "test-database",
+		},
+		teleportVersion: "19.0.0-dev",
+	}
+	tests := []struct {
+		desc               string
+		cmdName            string
+		args               string
+		expectExit         bool
+		assertCommandReply require.ValueAssertionFunc
+	}{
+		{
+			desc:    "delimiter command has an empty reply",
+			cmdName: "delimiter",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Empty(t, val)
+			},
+		},
+		{
+			desc:    "delimiter fails regex",
+			cmdName: "delimiter",
+			args:    "abc",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Equal(t, `DELIMITER "abc" does not match regex used for validation "^(;|[/]{2}|[$]{2})$"`, val)
+			},
+		},
+		{
+			desc:    "help",
+			cmdName: "help",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				for name := range commands.byName {
+					require.Contains(t, val, name, `expected help command to include information about the %q command`, name)
+				}
+			},
+		},
+		{
+			desc:       "quit",
+			cmdName:    "quit",
+			expectExit: true,
+		},
+		{
+			desc:    "status",
+			cmdName: "status",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Contains(t, val, "test-service", "expected session command to contain service name")
+				require.Contains(t, val, "test-user", "expected session command to contain username")
+				require.Contains(t, val, "test-database", "expected session command to contain database name")
+			},
+		},
+		{
+			desc:    "teleport",
+			cmdName: "teleport",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Contains(t, val, "19.0.0-dev", "expected teleport command to include current Teleport version")
+			},
+		},
+		{
+			desc:    "use requires an arg",
+			cmdName: "use",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Equal(t, "USE must be followed by a database name", val)
+			},
+		},
+		{
+			desc:    "use with an unquoted argument",
+			cmdName: "use",
+			args:    "example",
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Equal(t, `Default database changed to "example"`, val)
+			},
+		},
+		{
+			desc:    "use with a quoted argument",
+			cmdName: "use",
+			args:    `"example"`,
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
+				require.Equal(t, `Default database changed to "example"`, val)
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			cmd, ok := commands.byName[test.cmdName]
+			require.True(t, ok, "expected command to be registered")
+			reply, exit := cmd.execFunc(repl, test.args)
+			if test.expectExit {
+				require.True(t, exit, "expected command to exit the REPL")
+				return
+			}
+			test.assertCommandReply(t, reply)
+		})
+	}
+}
+
+type fakeMySQLConn struct {
+	exec func(command string, args ...any) (*mysql.Result, error)
+}
+
+func (c *fakeMySQLConn) Execute(command string, args ...any) (*mysql.Result, error) {
+	return c.exec(command, args...)
+}
+
+func (c *fakeMySQLConn) ExecuteSelectStreaming(command string, result *mysql.Result, perRowCallback client.SelectPerRowCallback, perResultCallback client.SelectPerResultCallback) error {
+	return trace.NotImplemented("ExecuteSelectStreaming not implemented")
+}
+
+func (c *fakeMySQLConn) UseDB(dbName string) error {
+	return nil
+}
+
+func (c *fakeMySQLConn) GetServerVersion() string {
+	return "1.2.3 Fake MySQL Server"
+}
diff --git a/lib/client/db/mysql/repl/fixtures/all-data-types.sql b/lib/client/db/mysql/repl/fixtures/all-data-types.sql
new file mode 100644
index 0000000000000..f95614aa9c059
--- /dev/null
+++ b/lib/client/db/mysql/repl/fixtures/all-data-types.sql
@@ -0,0 +1,113 @@
+-- temporarily disable note warnings for test consistency
+set session sql_notes = 0;
+CREATE DATABASE IF NOT EXISTS all_data_types;
+set session sql_notes = 1;
+USE all_data_types;
+
+-- without ANSI_QUOTES double quotes are literals
+SET SESSION sql_mode='';
+SELECT "thing";
+-- with ANSI_QUOTES double quotes are identifiers, which is what we want when
+-- selecting from the table below
+SET SESSION sql_mode='ANSI_QUOTES';
+SELECT "thing";
+
+CREATE TABLE all_types_demo (
+    "c tinyint"         TINYINT,
+    c_smallint        SMALLINT,
+    c_mediumint       MEDIUMINT,
+    c_int             INT,
+    c_bigint          BIGINT,
+    c_decimal         DECIMAL(10,2),
+    c_float           FLOAT,
+    c_double          DOUBLE,
+    c_bit             BIT(8),
+    c_bool            BOOL,
+    c_date            DATE,
+    c_time            TIME,
+    c_datetime        DATETIME,
+    c_timestamp       TIMESTAMP NULL DEFAULT NULL,
+    c_year            YEAR,
+    c_char            CHAR(5),
+    c_varchar         VARCHAR(10),
+    c_binary          BINARY(3),
+    c_varbinary       VARBINARY(4),
+    c_tinyblob        TINYBLOB,
+    c_blob            BLOB,
+    c_mediumblob      MEDIUMBLOB,
+    c_longblob        LONGBLOB,
+    c_tinytext        TINYTEXT,
+    c_text            TEXT,
+    c_mediumtext      MEDIUMTEXT,
+    c_longtext        LONGTEXT,
+    c_enum            ENUM('foo','bar','baz'),
+    c_set             SET('a','b','c'),
+    c_geometry        GEOMETRY,
+    c_point           POINT,
+    c_linestring      LINESTRING,
+    c_polygon         POLYGON,
+    c_multipoint      MULTIPOINT,
+    c_multilinestring MULTILINESTRING,
+    c_multipolygon    MULTIPOLYGON,
+    c_geometrycoll    GEOMETRYCOLLECTION,
+    c_json            JSON
+);
+
+INSERT INTO all_types_demo VALUES (
+    127,
+    32767,
+    8388607,
+    2147483647,
+    9223372036854775807,
+    12345.67,
+    3.14,
+    2.7182818284,
+    b'10101010',
+    1,
+    '2024-07-09',
+    '12:34:56',
+    '2024-07-09 12:34:56',
+    '2024-07-09 12:34:56',
+    2025,
+    'abcde',
+    'abcdefghij',
+    'abc',
+    'defg',
+    'a',
+    'blob',
+    'medblob',
+    'longblob',
+    'tiny',
+    'text',
+    'mediumtext',
+    'longtext',
+    'foo',
+    'a,b',
+    ST_GeomFromText('POINT(1 1)'),
+    ST_GeomFromText('POINT(2 2)'),
+    ST_GeomFromText('LINESTRING(0 0,1 1,2 2)'),
+    ST_GeomFromText('POLYGON((0 0,1 0,1 1,0 1,0 0))'),
+    ST_GeomFromText('MULTIPOINT((0 0),(1 1))'),
+    ST_GeomFromText('MULTILINESTRING((0 0,1 1),(2 2,3 3))'),
+    ST_GeomFromText('MULTIPOLYGON(((0 0,1 0,1 1,0 1,0 0)))'),
+    ST_GeomFromText('GEOMETRYCOLLECTION(POINT(1 2),LINESTRING(0 0,1 1))'),
+    JSON_OBJECT('x', 1, 'y', 2)
+);
+
+SELECT "c tinyint", `c_smallint`, "c_mediumint" FROM `all_types_demo`;
+SELECT c_int, c_bigint, c_decimal FROM all_types_demo;
+SELECT c_float, c_double, c_bit FROM all_types_demo;
+SELECT c_bool, c_date, c_time FROM all_types_demo;
+SELECT c_datetime, c_timestamp, c_year FROM all_types_demo;
+SELECT c_char, c_varchar, c_binary FROM all_types_demo;
+SELECT c_varbinary, c_tinyblob, c_blob FROM all_types_demo;
+SELECT "c_mediumblob",
+       `c_longblob`,
+       c_tinytext
+FROM all_types_demo;
+SELECT c_text, c_mediumtext, c_longtext FROM all_types_demo;
+SELECT c_enum, c_set, ST_AsText(c_geometry) AS c_geometry FROM all_types_demo;
+SELECT ST_AsText(c_point) AS c_point, ST_AsText(c_linestring) AS c_linestring, ST_AsText(c_polygon) AS c_polygon FROM all_types_demo;
+SELECT ST_AsText(c_multipoint) AS c_multipoint, ST_AsText(c_multilinestring) AS c_multilinestring, ST_AsText(c_multipolygon) AS c_multipolygon FROM all_types_demo;
+SELECT ST_AsText(c_geometrycoll) AS c_geometrycoll, c_json FROM all_types_demo;
+DROP DATABASE all_data_types;
diff --git a/lib/client/db/mysql/repl/fixtures/commands.sql b/lib/client/db/mysql/repl/fixtures/commands.sql
new file mode 100644
index 0000000000000..1bb2e6ff8c351
--- /dev/null
+++ b/lib/client/db/mysql/repl/fixtures/commands.sql
@@ -0,0 +1,85 @@
+-- temporarily disable note warnings for test consistency
+set session sql_notes = 0;
+create database if not exists test_commands;
+create database if not exists foo;
+create database if not exists bar;
+set session sql_notes = 1;
+use test_commands;
+
+-- leading spaces/comments before commands
+/* just a comment */
+use foo;
+use foo
+     /*
+llama
+ */
+use foo;
+     /*
+llama
+ */
+use foo
+-- llama
+use foo;
+-- llama
+use foo
+  -- llama
+    use foo;
+  -- llama
+    use foo
+/* llama */use foo;
+/* llama */use foo
+/* llama */  use foo;
+/* llama */  use foo
+/* llama */
+  use foo;
+/* llama */
+  use foo
+/* llama
+*/use foo;
+/* llama
+*/use foo
+/* llama
+*/  use foo;
+/* llama
+*/  use foo
+/* llama
+-- llama
+*/use foo;
+/* llama
+-- llama
+*/use foo
+/* llama
+-- llama
+*/  use foo;
+/* llama
+-- llama
+*/  use foo
+/* llama
+-- */use foo;
+/* llama
+-- */use foo
+/* llama
+-- */  use foo;
+/* llama
+-- */  use foo
+/* llama */
+
+use foo;use bar; use foo
+-- this isn't a command, but that should just print an error message and help info.
+\xyz select 1
+\xyz;select 1;
+delimiter $$
+help$$
+\d //
+\h
+help
+status
+\s
+teleport
+\t
+use foo
+\u mysql//
+-- reset the delimiter to default ;
+\d
+teleport;\s;\h
+use `bar`;drop database foo;drop database bar;drop database test_commands;quit
diff --git a/lib/client/db/mysql/repl/fixtures/ddl.sql b/lib/client/db/mysql/repl/fixtures/ddl.sql
new file mode 100644
index 0000000000000..3a2dc786926b2
--- /dev/null
+++ b/lib/client/db/mysql/repl/fixtures/ddl.sql
@@ -0,0 +1,104 @@
+-- temporarily disable note warnings for test consistency
+set session sql_notes = 0;
+DROP DATABASE IF EXISTS test_ddl_db;
+CREATE DATABASE test_ddl_db;
+set session sql_notes = 1;
+-- this should produce a note level warning because it does exist
+CREATE DATABASE if not exists test_ddl_db;
+-- we clear the warning by selecting the warning count
+select @@warning_count;
+USE test_ddl_db;
+
+CREATE TABLE test_table (
+  id INT PRIMARY KEY AUTO_INCREMENT,
+  value VARCHAR(50) NOT NULL,
+  note VARCHAR(100) DEFAULT NULL
+) ENGINE=InnoDB;
+
+CREATE VIEW test_view AS (
+    SELECT id, value
+    FROM test_table
+);
+
+DELIMITER $$
+CREATE FUNCTION test_func(x INT) RETURNS INT DETERMINISTIC
+BEGIN
+  RETURN x * 2;
+END $$
+DELIMITER ;
+
+DELIMITER $$
+CREATE PROCEDURE test_proc()
+BEGIN
+  INSERT INTO test_table(value) VALUES ('from proc');
+END $$
+DELIMITER ;
+
+CALL test_proc();
+
+DELIMITER $$
+CREATE TRIGGER test_trigger_before_insert
+BEFORE INSERT ON test_table
+FOR EACH ROW
+BEGIN
+  SET NEW.value = UPPER(NEW.value);
+END $$
+DELIMITER ;
+
+CALL test_proc();
+
+CREATE EVENT test_event
+  ON SCHEDULE AT CURRENT_TIMESTAMP + INTERVAL 1 HOUR
+  DO INSERT INTO test_table(value) VALUES ('from event');
+
+set session sql_notes = 0;
+-- roles are not database scoped, let's disable note warnings in case some other
+-- test has already created the role or user.
+CREATE ROLE IF NOT EXISTS test_role;
+DROP ROLE test_role;
+
+CREATE USER IF NOT EXISTS test_user@'localhost'
+  IDENTIFIED BY 'some password'
+  ACCOUNT LOCK;
+ALTER USER test_user@'localhost' PASSWORD EXPIRE;
+DROP USER test_user@'localhost';
+set session sql_notes = 1;
+
+ALTER DATABASE test_ddl_db CHARACTER SET utf8mb4;
+ALTER TABLE test_table ADD COLUMN note2 VARCHAR(100) DEFAULT NULL;
+ALTER EVENT test_event DISABLE;
+ALTER FUNCTION test_func COMMENT 'Test function';
+ALTER PROCEDURE test_proc COMMENT 'Test procedure';
+
+RENAME TABLE test_table
+       TO test_table_renamed;
+SELECT * from test_table_renamed;
+
+RENAME
+  TABLE test_table_renamed
+  TO test_table;
+
+SELECT * from test_table;
+
+INSERT INTO test_table (value)
+WITH RECURSIVE numbers(n) AS (
+  SELECT 4
+  UNION ALL
+  SELECT n + 1 FROM numbers WHERE n < 120
+)
+SELECT 'especially wide column' AS value
+UNION ALL
+SELECT CONCAT('value_', n) FROM numbers;
+
+SELECT * from test_table;
+
+-- there is no "test_server", this should make an error.
+ALTER SERVER test_server OPTIONS (HOST '127.0.0.1');
+
+DROP TRIGGER test_trigger_before_insert;
+
+TRUNCATE TABLE test_table    ;
+DROP TABLE test_table;
+
+DROP DATABASE test_ddl_db
+;
diff --git a/lib/client/db/mysql/repl/fixtures/literals.sql b/lib/client/db/mysql/repl/fixtures/literals.sql
new file mode 100644
index 0000000000000..9633e6c2fcb6c
--- /dev/null
+++ b/lib/client/db/mysql/repl/fixtures/literals.sql
@@ -0,0 +1,50 @@
+-- with ANSI_QUOTES double quotes are identifiers
+SET SESSION sql_mode='ANSI_QUOTES';
+SELECT "thing";
+-- without ANSI_QUOTES double quotes are literals
+SET SESSION sql_mode='';
+SELECT "thing";
+select 1,  -1,1.24, -1.24, 'foo', null, 'null';
+select
+    1 as 'unsigned int',
+    -1 as 'negative int',
+    1.24 as "float",
+    -1.24 as 'negative float',
+    'foo' as 'string',
+    null as 'actual NULL',
+    "null" as 'string null';
+
+select 1 as 'multiple rows of literals'
+union
+    select -1
+union
+    select 1.24
+union
+    select -1.24
+union
+    select 'foo'
+union
+    select null
+union
+    select 'null';
+
+select 'a
+b
+c' as 'multiline-string';
+
+select 'a
+    ;
+    b
+    ;
+c' as 'multiline with delimiters';
+
+/* foo bar */
+select 1;
+/* foo bar */select /*
+baz */ 42;
+
+delimiter $$
+select '$$1$$'$$
+select '$$;$$';$$
+delimiter ;
+select 1;
diff --git a/lib/client/db/mysql/repl/lexer.go b/lib/client/db/mysql/repl/lexer.go
new file mode 100644
index 0000000000000..609ec62e48bb7
--- /dev/null
+++ b/lib/client/db/mysql/repl/lexer.go
@@ -0,0 +1,314 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"cmp"
+	"io"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"github.com/gravitational/trace"
+)
+
+// lexer scans REPL input lines distinguishing between comments, strings,
+// whitespace, delimiter, and normal query text.
+type lexer struct {
+	delim         string
+	inComment     bool
+	inStringToken token
+	queryBuf      strings.Builder
+
+	lineReader strings.Reader
+	line       string
+}
+
+// clientDefaultStatementDelimiter is the default client-side delimiter between
+// statements. This is the only delimiter that is recognized server-side, but it
+// is sometimes necessary for the client to switch delimiters while typing at a
+// REPL.
+const clientDefaultStatementDelimiter = ";"
+
+// delimiter returns the current client-side delimiter.
+func (l *lexer) delimiter() string {
+	return cmp.Or(l.delim, clientDefaultStatementDelimiter)
+}
+
+// validDelimiterRegex only allows somewhat sane choices for delimiters.
+var validDelimiterRegex = regexp.MustCompile(`^(;|[/]{2}|[$]{2})$`)
+
+// setDelimiter sets the client-side statement delimiter.
+func (l *lexer) setDelimiter(delimiter string) error {
+	delimiter = strings.TrimSpace(delimiter)
+	if delimiter == "" {
+		l.delim = ""
+		return nil
+	}
+	if validDelimiterRegex.MatchString(delimiter) {
+		l.delim = delimiter
+		return nil
+	}
+	return trace.BadParameter("DELIMITER %q does not match regex used for validation %q",
+		delimiter, validDelimiterRegex.String(),
+	)
+}
+
+// writeString writes a string to the query buffer.
+func (l *lexer) writeString(s string) {
+	l.queryBuf.WriteString(s)
+}
+
+// writeRune writes a single rune to the query buffer.
+func (l *lexer) writeRune(r rune) {
+	l.queryBuf.WriteRune(r)
+}
+
+// getQuery builds the buffered query string and empties the query buffer.
+func (l *lexer) getQuery() string {
+	out := l.queryBuf.String()
+	l.queryBuf.Reset()
+	return out
+}
+
+// isInQuery returns true if the lexer is reading inside of a MySQL query.
+func (l *lexer) isInQuery() bool {
+	return l.queryBuf.Len() > 0
+}
+
+// isInComment returns true if the lexer is reading inside of a MySQL comment.
+func (l *lexer) isInComment() bool {
+	return l.inComment
+}
+
+// isInString returns true if the lexer is reading inside of a MySQL string.
+func (l *lexer) isInString() bool {
+	return len(l.inStringToken.text) > 0
+}
+
+// inStringKind returns the kind of MySQL string the lexer is currently reading
+// inside of, i.e., the opening/closing rune: "'`.
+func (l *lexer) inStringKind() string {
+	return l.inStringToken.text
+}
+
+// isMultilineQuery returns true if the lexer is reading a multline query.
+func (l *lexer) isMultilineQuery() bool {
+	return l.isInQuery() && strings.Contains(l.queryBuf.String(), lineBreak)
+}
+
+// setCloseComment marks the start of a comment.
+func (l *lexer) setOpenComment() {
+	l.inComment = true
+}
+
+// setCloseComment marks the end of a comment.
+func (l *lexer) setCloseComment() {
+	l.inComment = false
+}
+
+// setCloseString marks the start of a MySQL string.
+func (l *lexer) setOpenString(tok token) {
+	l.inStringToken = tok
+}
+
+// setCloseString closes the currently open string state.
+func (l *lexer) setCloseString() {
+	l.inStringToken = token{}
+}
+
+// setLine sets the input line to read from.
+func (l *lexer) setLine(line string) {
+	l.lineReader.Reset(line)
+	l.line = line
+}
+
+// isEmpty returns whether the line has been completely read.
+func (l *lexer) isEmpty() bool {
+	return l.lineReader.Len() == 0
+}
+
+// readRune reads a single rune and returns true if there was no error.
+func (l *lexer) readRune() (rune, bool) {
+	r, _, err := l.lineReader.ReadRune()
+	ok := err == nil
+	return r, ok
+}
+
+// unreadRune unreads the last rune that was read.
+func (l *lexer) unreadRune() {
+	l.lineReader.UnreadRune()
+}
+
+// peekString returns the remainder of the line without advancing the reader.
+func (l *lexer) peekString() string {
+	offset := len(l.line) - l.lineReader.Len()
+	return l.line[offset:]
+}
+
+// advanceByRune advances the line reader by the given rune if and only if it
+// matches.
+func (l *lexer) advanceByRune(want rune) bool {
+	if r, ok := l.readRune(); ok {
+		if r == want {
+			return true
+		}
+		l.unreadRune()
+	}
+	return false
+}
+
+// advanceByString advances the line reader by the given string if and only if
+// it is a prefix of the remaining string.
+func (l *lexer) advanceByDelimiter() bool {
+	return l.advanceByString(l.delimiter())
+}
+
+// advanceByString advances the line reader by the given string if and only if
+// it is a prefix of the remaining string.
+func (l *lexer) advanceByString(s string) bool {
+	if strings.HasPrefix(l.peekString(), s) {
+		l.lineReader.Seek(int64(len(s)), io.SeekCurrent)
+		return true
+	}
+	return false
+}
+
+// scan scans a token from the line reader.
+func (l *lexer) scan() token {
+	r, ok := l.readRune()
+	if !ok {
+		return token{kind: tokenEOF}
+	}
+
+	if unicode.IsSpace(r) {
+		l.unreadRune()
+		return token{kind: tokenSpace, text: l.readMatching(unicode.IsSpace)}
+	}
+
+	switch r {
+	case '\\':
+		return token{kind: tokenBackslash, text: `\`}
+	case '\'':
+		return token{kind: tokenSingleQuote, text: "'"}
+	case '"':
+		return token{kind: tokenDoubleQuote, text: `"`}
+	case '`':
+		return token{kind: tokenBacktick, text: "`"}
+	case '-':
+		if l.advanceByRune('-') {
+			return token{kind: tokenSingleComment, text: "--"}
+		}
+	case '#':
+		return token{kind: tokenSingleComment, text: "#"}
+	case '/':
+		if l.advanceByRune('*') {
+			return token{kind: tokenOpenComment, text: "/*"}
+		}
+	case '*':
+		if l.advanceByRune('/') {
+			return token{kind: tokenCloseComment, text: "*/"}
+		}
+	}
+	return token{kind: tokenText, text: string(r)}
+}
+
+// readMatching reads runes matching matchFn into the query buffer.
+func (l *lexer) readMatching(matchFn func(rune) bool) string {
+	var runes []rune
+	for {
+		r, ok := l.readRune()
+		if !ok {
+			break
+		}
+		if !matchFn(r) {
+			l.unreadRune()
+			break
+		}
+		runes = append(runes, r)
+	}
+	return string(runes)
+}
+
+// acceptEscapedRune reads the next character following an escape backslash and
+// saves it to the query buffer.
+func (l *lexer) acceptEscapedRune() {
+	if r, ok := l.readRune(); ok {
+		l.writeRune(r)
+	}
+}
+
+// acceptString reads a MySQL string bounded by single-quotes, double-quotes, or
+// backticks and saves it to the query buffer.
+func (l *lexer) acceptString() {
+	for !l.isEmpty() {
+		tok := l.scan()
+		l.writeString(tok.text)
+		switch tok.kind {
+		case tokenBackslash:
+			l.acceptEscapedRune()
+		case l.inStringToken.kind:
+			// this must be a closing quote
+			l.setCloseString()
+			return
+		}
+	}
+}
+
+// discardRemaining discards the remainder of the line.
+func (l *lexer) discardRemaining() {
+	l.lineReader.Reset("")
+}
+
+// discardMatching discards runes matching matchFn.
+func (l *lexer) discardMatching(matchFn func(rune) bool) {
+	for {
+		r, ok := l.readRune()
+		if !ok {
+			break
+		}
+		if !matchFn(r) {
+			l.unreadRune()
+			break
+		}
+	}
+}
+
+// discardWhitespace discards leading whitespace.
+func (l *lexer) discardWhitespace() {
+	l.discardMatching(unicode.IsSpace)
+}
+
+// discardSingleLineComment discards the rest of the line following a comment.
+func (l *lexer) discardSingleLineComment() {
+	l.discardRemaining()
+}
+
+// discardMultiLineComment discards everything inside of a multiline comment.
+func (l *lexer) discardMultiLineComment() {
+	for !l.isEmpty() {
+		l.discardMatching(func(r rune) bool {
+			// shortcut: scan until we get a potential end of comment token
+			// note that escapes don't work in comments, so we don't check for them
+			return r != '*'
+		})
+		if tok := l.scan(); tok.kind == tokenCloseComment {
+			l.setCloseComment()
+			return
+		}
+	}
+}
diff --git a/lib/client/db/mysql/repl/lexer_test.go b/lib/client/db/mysql/repl/lexer_test.go
new file mode 100644
index 0000000000000..9e556e98b1858
--- /dev/null
+++ b/lib/client/db/mysql/repl/lexer_test.go
@@ -0,0 +1,298 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"testing"
+	"unicode"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDelimiter(t *testing.T) {
+	t.Parallel()
+	var lex lexer
+	require.Equal(t, clientDefaultStatementDelimiter, lex.delimiter())
+
+	tests := []struct {
+		desc            string
+		args            string
+		wantDelimiter   string
+		wantErrContains string
+	}{
+		{
+			desc:          "passing no arg is ok",
+			wantDelimiter: ";",
+		},
+		{
+			desc:          "passing the default delimiter is ok",
+			args:          ";",
+			wantDelimiter: ";",
+		},
+		{
+			desc:          "passing two dollars is ok",
+			args:          "$$",
+			wantDelimiter: "$$",
+		},
+		{
+			desc:          "passing two slashes is ok",
+			args:          "//",
+			wantDelimiter: "//",
+		},
+		{
+			desc:            "passing too many delimiter runes is invalid",
+			args:            ";;;;;;",
+			wantErrContains: `DELIMITER ";;;;;;" does not match regex used for validation "^(;|[/]{2}|[$]{2})$"`,
+		},
+		{
+			desc:            "passing rejected runes is invalid",
+			args:            "x",
+			wantErrContains: `DELIMITER "x" does not match regex used for validation "^(;|[/]{2}|[$]{2})$"`,
+		},
+		{
+			desc:            "passing rejected runes is invalid",
+			args:            "\\",
+			wantErrContains: `DELIMITER "\\" does not match regex used for validation "^(;|[/]{2}|[$]{2})$"`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			var lex lexer
+			err := lex.setDelimiter(test.args)
+			if test.wantErrContains != "" {
+				require.ErrorContains(t, err, test.wantErrContains)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.wantDelimiter, lex.delimiter())
+		})
+	}
+}
+
+func TestLexer_setLine(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("SELECT * FROM t;")
+	require.Equal(t, "SELECT * FROM t;", l.peekString())
+	require.False(t, l.isEmpty())
+}
+
+func TestLexer_advanceByRune(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("abc")
+	require.True(t, l.advanceByRune('a'), "should advance on matching rune")
+	require.Equal(t, "bc", l.peekString())
+	require.False(t, l.advanceByRune('z'), "should not advance on non-matching rune")
+	require.Equal(t, "bc", l.peekString())
+}
+
+func TestLexer_advanceByString(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("foobar")
+	require.True(t, l.advanceByString("foo"), "should advance by matching prefix")
+	require.Equal(t, "bar", l.peekString())
+	require.False(t, l.advanceByString("baz"), "should not advance if prefix doesn't match")
+	require.Equal(t, "bar", l.peekString())
+}
+
+func TestLexer_advanceByDelimiter(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setDelimiter(";")
+	l.setLine("; SELECT")
+	require.True(t, l.advanceByDelimiter())
+	require.Equal(t, " SELECT", l.peekString())
+	require.False(t, l.advanceByDelimiter())
+	require.Equal(t, " SELECT", l.peekString())
+	l.setLine("//")
+	l.setDelimiter("//")
+	require.True(t, l.advanceByDelimiter())
+	require.Empty(t, l.peekString())
+	require.False(t, l.advanceByDelimiter())
+}
+
+func TestLexer_getQuery(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.writeString("hello")
+	l.writeRune(' ')
+	l.writeString("world!")
+	require.Equal(t, "hello world!", l.getQuery())
+	require.Empty(t, l.getQuery(), "getQuery should reset buffer")
+}
+
+func TestLexer_unread(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("xy")
+	r, ok := l.readRune()
+	require.True(t, ok)
+	require.Equal(t, 'x', r)
+	l.unreadRune()
+
+	r, ok = l.readRune()
+	require.True(t, ok)
+	require.Equal(t, 'x', r)
+
+	r, ok = l.readRune()
+	require.True(t, ok)
+	require.Equal(t, 'y', r)
+
+	_, ok = l.readRune()
+	require.False(t, ok, "should be false at end of input")
+	l.unreadRune()
+	_, ok = l.readRune()
+	require.False(t, ok, "cant unread eof")
+}
+
+func TestLexer_readMatching(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("123abcXYZ")
+	require.Equal(t, "123", l.readMatching(unicode.IsDigit))
+	require.Equal(t, "abc", l.readMatching(unicode.IsLower))
+	require.Equal(t, "XYZ", l.readMatching(unicode.IsUpper))
+	require.Empty(t, l.readMatching(unicode.IsDigit))
+}
+
+func TestLexer_acceptEscapedRune(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine(`\xyz`)
+	tok := l.scan()
+	require.Equal(t, tokenBackslash, tok.kind)
+	l.writeString(tok.text)
+	l.acceptEscapedRune()
+	require.Equal(t, "yz", l.peekString())
+	require.Equal(t, `\x`, l.getQuery())
+}
+
+func TestLexer_acceptString(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine(`"inside string "; SELECT`)
+	tok := l.scan()
+	require.Equal(t, tokenDoubleQuote, tok.kind)
+	l.writeString(tok.text)
+	l.setOpenString(tok)
+	l.acceptString()
+	require.Equal(t, "; SELECT", l.peekString())
+	require.Equal(t, `"inside string "`, l.getQuery())
+}
+
+func TestLexer_discardRemaining(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("DROP TABLE test;")
+	l.discardRemaining()
+	require.True(t, l.isEmpty())
+	require.Empty(t, l.peekString())
+}
+
+func TestLexer_discardMatching(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		input    string
+		matchFn  func(rune) bool
+		expected string
+	}{
+		{
+			name:     "discard digits",
+			input:    "123abc",
+			matchFn:  unicode.IsDigit,
+			expected: "abc",
+		},
+		{
+			name:     "discard lowercase",
+			input:    "abcDEF",
+			matchFn:  unicode.IsLower,
+			expected: "DEF",
+		},
+		{
+			name:     "nothing to discard",
+			input:    "ABC123",
+			matchFn:  unicode.IsLower,
+			expected: "ABC123",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var l lexer
+			l.setLine(tc.input)
+			l.discardMatching(tc.matchFn)
+			require.Equal(t, tc.expected, l.peekString())
+		})
+	}
+}
+
+func TestLexer_discardWhitespace(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "leading whitespace only",
+			input:    "   SELECT",
+			expected: "SELECT",
+		},
+		{
+			name:     "no whitespace",
+			input:    "SELECT",
+			expected: "SELECT",
+		},
+		{
+			name:     "whitespace and tabs",
+			input:    "\t \n  abc",
+			expected: "abc",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var l lexer
+			l.setLine(tc.input)
+			l.discardWhitespace()
+			require.Equal(t, tc.expected, l.peekString())
+		})
+	}
+}
+
+func TestLexer_discardSingleLineComment(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("-- This is a comment")
+	l.discardSingleLineComment()
+	require.True(t, l.isEmpty())
+	require.Empty(t, l.peekString())
+}
+
+func TestLexer_discardMultiLineComment(t *testing.T) {
+	t.Parallel()
+	var l lexer
+	l.setLine("inside comment */ SELECT 1;")
+	l.setOpenComment()
+	l.discardMultiLineComment()
+	require.False(t, l.isInComment(), "should have exited comment mode")
+	remaining := l.peekString()
+	require.Equal(t, " SELECT 1;", remaining)
+}
diff --git a/lib/client/db/mysql/repl/parser.go b/lib/client/db/mysql/repl/parser.go
new file mode 100644
index 0000000000000..f396552d912c8
--- /dev/null
+++ b/lib/client/db/mysql/repl/parser.go
@@ -0,0 +1,237 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"iter"
+	"strings"
+	"text/tabwriter"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/gravitational/trace"
+)
+
+func newParser() (*parser, error) {
+	commands, err := newCommands()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &parser{commands: commands}, nil
+}
+
+// parser parses commands and queries given one or more lines of input.
+type parser struct {
+	commands *commandManager
+	lex      lexer
+}
+
+// parse returns an iterator over the input line yielding evaluators for each
+// command or query found.
+func (p *parser) parse(line string) iter.Seq[evaluator] {
+	p.lex.setLine(line)
+	return func(yield func(evaluator) bool) {
+		defer func() {
+			if p.lex.isEmpty() && p.lex.isInQuery() {
+				// must be a multiline query, so insert a linebreak in the query buf
+				p.lex.writeString(lineBreak)
+			}
+		}()
+
+		for !p.lex.isEmpty() {
+			if p.lex.isInComment() {
+				// dont preserve comments
+				p.lex.discardMultiLineComment()
+				continue
+			}
+
+			if !p.lex.isInQuery() {
+				// not in a comment or query: is the rest of the line a command?
+				if cmd := p.tryParseCommand(); cmd != nil {
+					if !yield(cmd) {
+						return
+					}
+					continue
+				}
+			}
+
+			if p.lex.isInString() {
+				p.lex.acceptString()
+				continue
+			}
+
+			// not in comment nor string: do we have a command/query delimiter?
+			if cmdOrQuery := p.tryParseQuery(); cmdOrQuery != nil {
+				if !yield(cmdOrQuery) {
+					return
+				}
+				continue
+			}
+
+			// not in comment nor string and no delimiter found: scan text
+			tok := p.lex.scan()
+			switch tok.kind {
+			case tokenSingleComment:
+				// dont preserve comments
+				p.lex.discardSingleLineComment()
+			case tokenOpenComment:
+				p.lex.setOpenComment()
+				p.lex.discardMultiLineComment()
+			case tokenBackslash:
+				p.lex.writeString(tok.text)
+				p.lex.acceptEscapedRune()
+			case tokenSingleQuote, tokenDoubleQuote, tokenBacktick:
+				p.lex.writeString(tok.text)
+				p.lex.setOpenString(tok)
+				p.lex.acceptString()
+			default:
+				p.lex.writeString(tok.text)
+			}
+		}
+	}
+}
+
+// tryParseCommand tries to parse a command and its args on the current line.
+// If the line contains the current delimiter and the command is not the special
+// DELIMITER command, then give up and let the query parser handle it.
+func (p *parser) tryParseCommand() evaluator {
+	p.lex.discardWhitespace()
+	line := p.lex.peekString()
+	cmd, args, err := p.commands.findCommand(line)
+	switch {
+	case err != nil:
+		if strings.Contains(line, p.lex.delimiter()) {
+			return nil
+		}
+		p.lex.discardRemaining()
+		return errorEvaluator{err: err}
+	case cmd != nil:
+		if cmd.name != "delimiter" && strings.Contains(line, p.lex.delimiter()) {
+			return nil
+		}
+		p.lex.discardRemaining()
+		return commandEvaluator{cmd: cmd, args: args}
+	default:
+		return nil
+	}
+}
+
+// tryParseQuery looks for a delimiter in the input. If it finds one and the
+// query buffer is all from one line, then it first looks for a command in the
+// query buffer. If there is no command or the query buffer is multiline, then
+// it returns a query evaluator.
+func (p *parser) tryParseQuery() evaluator {
+	if p.lex.advanceByDelimiter() {
+		query := p.lex.getQuery()
+		if !p.lex.isMultilineQuery() || strings.HasPrefix(query, p.commands.shortcutPrefix) {
+			cmd, args, err := p.commands.findCommand(query)
+			switch {
+			case err != nil:
+				// don't discard the rest of the line, since we found the
+				// command in the query buffer, unlike the command parser which
+				// looks ahead in the current line for a command
+				return errorEvaluator{err: err}
+			case cmd != nil:
+				return commandEvaluator{cmd: cmd, args: args}
+			}
+		}
+		return queryEvaluator(query)
+	}
+	return nil
+}
+
+type evaluator interface {
+	eval(r *REPL) (reply string, exit bool)
+}
+
+// queryEvaluator executes a single query and formats the response as a reply
+// to the REPL client.
+type queryEvaluator string
+
+func (query queryEvaluator) eval(r *REPL) (string, bool) {
+	const maxBufferedRows = 100
+	start := time.Now()
+	var (
+		res      mysql.Result
+		rowCount int
+	)
+	defer res.Close()
+	writer := tabwriter.NewWriter(r.Terminal, 5, 0, 1, ' ', 0)
+	err := r.myConn.ExecuteSelectStreaming(string(query), &res,
+		func(row []mysql.FieldValue) error {
+			for _, item := range row {
+				if _, err := writer.Write([]byte(item.String() + "\t")); err != nil {
+					return trace.Wrap(err)
+				}
+			}
+			if _, err := writer.Write([]byte(lineBreak)); err != nil {
+				return trace.Wrap(err)
+			}
+			rowCount++
+			if rowCount%maxBufferedRows == 0 {
+				return trace.Wrap(writer.Flush())
+			}
+			return nil
+		},
+		func(result *mysql.Result) error {
+			headers := make([]string, 0, len(result.Resultset.Fields))
+			dashes := make([]string, 0, cap(headers))
+			for _, f := range result.Resultset.Fields {
+				headers = append(headers, string(f.Name))
+				dashes = append(dashes, strings.Repeat("-", len(f.Name)))
+			}
+			headerLine := lineBreak + strings.Join(headers, "\t")
+			sepLine := lineBreak + strings.Join(dashes, "\t")
+			if _, err := writer.Write([]byte(headerLine + sepLine + lineBreak)); err != nil {
+				return trace.Wrap(err)
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return errorReplyPrefix + err.Error(), false
+	}
+	if err := writer.Flush(); err != nil {
+		return errorReplyPrefix + err.Error(), false
+	}
+
+	if r.disableQueryTimings {
+		return summarizeResult(&res, rowCount, nil), false
+	}
+
+	elapsed := time.Since(start)
+	return summarizeResult(&res, rowCount, &elapsed), false
+}
+
+// commandEvaluator executes a command.
+type commandEvaluator struct {
+	cmd  *command
+	args string
+}
+
+func (e commandEvaluator) eval(r *REPL) (string, bool) {
+	return e.cmd.execFunc(r, e.args)
+}
+
+type errorEvaluator struct {
+	err error
+}
+
+// errorEvaluator formats an error as a reply to the REPL client.
+func (e errorEvaluator) eval(_ *REPL) (string, bool) {
+	return e.err.Error(), false
+}
diff --git a/lib/client/db/mysql/repl/repl.go b/lib/client/db/mysql/repl/repl.go
new file mode 100644
index 0000000000000..db662a4c562f0
--- /dev/null
+++ b/lib/client/db/mysql/repl/repl.go
@@ -0,0 +1,264 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"iter"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/client"
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/gravitational/trace"
+	"golang.org/x/term"
+
+	"github.com/gravitational/teleport"
+	clientproto "github.com/gravitational/teleport/api/client/proto"
+	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
+)
+
+// REPL implements [dbrepl.REPLInstance] for MySQL.
+type REPL struct {
+	*term.Terminal
+
+	client     io.ReadWriteCloser
+	serverConn net.Conn
+	route      clientproto.RouteToDatabase
+	parser     *parser
+	myConn     mysqlConn
+
+	// teleportVersion is used in golden tests to fake the current Teleport
+	// version and prevent test failures when the real version is incremented.
+	teleportVersion string
+
+	// testPassword is normally blank, only used in tests where the REPL connects
+	// directly to a MySQL instance without Teleport proxying.
+	testPassword string
+	// disableQueryTimings is used in golden tests to disable query timings for
+	// test consistency.
+	disableQueryTimings bool
+}
+
+type mysqlConn interface {
+	Execute(command string, args ...any) (*mysql.Result, error)
+	ExecuteSelectStreaming(command string, result *mysql.Result, perRowCallback client.SelectPerRowCallback, perResultCallback client.SelectPerResultCallback) error
+	UseDB(dbName string) error
+	GetServerVersion() string
+}
+
+// New implements [dbrepl.REPLNewFunc].
+func New(_ context.Context, cfg *dbrepl.NewREPLConfig) (dbrepl.REPLInstance, error) {
+	parser, err := newParser()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &REPL{
+		Terminal:   term.NewTerminal(cfg.Client, ""),
+		client:     cfg.Client,
+		serverConn: cfg.ServerConn,
+		route:      cfg.Route,
+		parser:     parser,
+	}, nil
+}
+
+// Run starts and run the PostgreSQL REPL session. The provided context is used
+// to interrupt the execution and clean up resources.
+func (r *REPL) Run(ctx context.Context) error {
+	dialer := func(context.Context, string, string) (net.Conn, error) {
+		return r.serverConn, nil
+	}
+	const hostnamePlaceholder = "repl"
+	myConn, err := client.ConnectWithDialer(ctx, "tcp", hostnamePlaceholder,
+		r.route.GetUsername(),
+		r.testPassword,
+		r.route.GetDatabase(),
+		dialer,
+		withClientCapabilities(
+			mysql.CLIENT_MULTI_RESULTS,
+			mysql.CLIENT_MULTI_STATEMENTS,
+		),
+		func(c *client.Conn) error {
+			c.SetAttributes(map[string]string{clientNameParamName: clientNameParamValue})
+			return nil
+		},
+	)
+	if err != nil {
+		return trace.ConnectionProblem(err, "Unable to connect to database: %v", err)
+	}
+	r.myConn = myConn
+	defer func() {
+		_ = myConn.Close()
+	}()
+
+	// term.Terminal blocks reads/writes without respecting the context. The
+	// only thing that unblocks it is closing the underlaying connection (in
+	// our case r.client). On this goroutine we only watch for context
+	// cancelation and close the connection. This will unblocks all terminal
+	// reads/writes.
+	stop := context.AfterFunc(ctx, func() {
+		_ = r.client.Close()
+	})
+	defer stop()
+
+	if err := r.presentBanner(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	for {
+		line, err := r.readLine()
+		if err != nil {
+			return trace.Wrap(rewriteTermError(ctx, err))
+		}
+		for reply, exit := range r.eval(line) {
+			if exit {
+				return nil
+			}
+			if err := r.print(reply); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+}
+
+func withClientCapabilities(caps ...uint32) client.Option {
+	return func(conn *client.Conn) error {
+		for _, cap := range caps {
+			conn.SetCapability(cap)
+		}
+		return nil
+	}
+}
+
+func (r *REPL) presentBanner() error {
+	_, err := fmt.Fprintf(
+		r.Terminal,
+		`Teleport MySQL interactive shell (v%s)
+Connected to instance %q as user %q.
+Type 'help' or '\h' for help.
+
+`,
+		cmp.Or(r.teleportVersion, teleport.Version),
+		r.route.GetServiceName(),
+		r.route.GetUsername())
+	return trace.Wrap(err)
+}
+
+func (r *REPL) readLine() (string, error) {
+	r.Terminal.SetPrompt(r.getPrompt())
+	return r.Terminal.ReadLine()
+}
+
+func (r *REPL) getPrompt() string {
+	dbName := formatDatabaseName(r.route.Database)
+	var suffix string
+	switch {
+	case r.parser.lex.isInComment():
+		suffix = "/*"
+	case r.parser.lex.isInString():
+		suffix = r.parser.lex.inStringKind()
+	case r.parser.lex.isInQuery():
+		suffix = "-"
+	default:
+		suffix = dbName
+	}
+	padding := len(dbName)
+	// pad the suffix with leading spaces until it is len(dbName), for example:
+	// default: "mysql>"
+	// comment: "   */>"
+	// string:  "    '>"
+	// query:   "    ->"
+	return fmt.Sprintf("%*s> ", padding, suffix)
+}
+
+func (r *REPL) eval(line string) iter.Seq2[string, bool] {
+	return func(yield func(string, bool) bool) {
+		for evaluator := range r.parser.parse(line) {
+			if !yield(evaluator.eval(r)) {
+				return
+			}
+		}
+	}
+}
+
+// print writes a reply to the REPL client.
+func (r *REPL) print(reply string) error {
+	reply = strings.TrimSpace(reply)
+	if reply == "" {
+		return nil
+	}
+	_, err := r.Terminal.Write([]byte(lineBreak + reply + lineBreak + lineBreak))
+	return trace.Wrap(err)
+}
+
+// rewriteTermError changes the term.Terminal error to match caller expectations.
+func rewriteTermError(ctx context.Context, err error) error {
+	// When context is canceled it will immediately lead read/write errors due
+	// to the closed connection. For this cases we return the context error.
+	if ctx.Err() != nil && (errors.Is(err, io.ErrClosedPipe) || errors.Is(err, net.ErrClosed)) {
+		return ctx.Err()
+	}
+	if errors.Is(err, io.EOF) {
+		return nil
+	}
+
+	return err
+}
+
+// summarizeResult summarizes a query result.
+func summarizeResult(result *mysql.Result, numRows int, elapsed *time.Duration) string {
+	var out string
+	if result.Resultset != nil && len(result.Resultset.Fields) > 0 {
+		out = summarizeResultset(numRows)
+	} else {
+		out = fmt.Sprintf("%v warnings, %v rows affected", result.Warnings, result.AffectedRows)
+	}
+	if elapsed != nil {
+		return fmt.Sprintf("%s (%.2f sec)", out, elapsed.Seconds())
+	}
+	return out
+}
+
+// summarizeResultset summarizes a query result that contains rows.
+func summarizeResultset(numRows int) string {
+	switch numRows {
+	case 0:
+		return "Empty set"
+	case 1:
+		return "1 row in set"
+	default:
+		return fmt.Sprintf("%d rows in set", numRows)
+	}
+}
+
+const (
+	// lineBreak represents a line break on the REPL.
+	lineBreak = "\n"
+	// errorReplyPrefix is the prefix presented when there is a execution error.
+	errorReplyPrefix = "ERR "
+	// clientNameParamName defines the application name parameter name.
+	//
+	// https://dev.mysql.com/doc/refman/8.0/en/performance-schema-connection-attribute-tables.html
+	clientNameParamName = "_client_name"
+	// clientNameParamValue defines the application name parameter value.
+	clientNameParamValue = "teleport-repl"
+)
diff --git a/lib/client/db/mysql/repl/repl_test.go b/lib/client/db/mysql/repl/repl_test.go
new file mode 100644
index 0000000000000..09e99421d47d4
--- /dev/null
+++ b/lib/client/db/mysql/repl/repl_test.go
@@ -0,0 +1,467 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"crypto/rand"
+	_ "embed"
+	"io"
+	"net"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/stretchr/testify/require"
+	"github.com/testcontainers/testcontainers-go"
+	mysqlcontainer "github.com/testcontainers/testcontainers-go/modules/mysql"
+	"golang.org/x/term"
+
+	clientproto "github.com/gravitational/teleport/api/client/proto"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+var testSrv *testServer
+var testSrvMu sync.Mutex
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+
+	// The "Ryuk" container will cleanup everything anyhow, but only after 10s
+	// without any client connections.
+	// We can speed up container cleanup after a -count=N run, e.g., a flaky
+	// test detector run, by terminating them immediately after tests have run.
+	// https://github.com/testcontainers/moby-ryuk
+	testSrvMu.Lock()
+	defer testSrvMu.Unlock()
+	// if we don't clean up after 10 seconds, RYUK will get them anyway.
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// ignore errors, Ryuk or worst case VM termination in CI will deal with it
+	if testSrv != nil {
+		_ = testSrv.container.Terminate(ctx)
+	}
+	os.Exit(code)
+}
+
+func TestREPL(t *testing.T) {
+	if run, _ := apiutils.ParseBool(os.Getenv("ENABLE_TESTCONTAINERS")); !run {
+		// Docker Hub rate limits cause failures in CI, this test is disabled until we can set up an alternative to Docker Hub
+		t.Skip("Test disabled in CI. Enable it by setting env variable ENABLE_TESTCONTAINERS")
+	}
+	testSrv := newTestServer(t)
+	route := clientproto.RouteToDatabase{
+		ServiceName: "mysql-test-container",
+		Protocol:    defaults.ProtocolMySQL,
+		Username:    testSrv.username,
+		// Pass a blank database name, as if a user who didn't specify one.
+		// The REPL should handle this case gracefully.
+		Database: "",
+	}
+	for _, test := range []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "ddl",
+			input: testDDL,
+		},
+		{
+			name:  "all data types",
+			input: testDataTypes,
+		},
+		{
+			name:  "literals",
+			input: testLiterals,
+		},
+		{
+			name:  "commands",
+			input: testCommands,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			// the term only recognizes line breaks with a carriage-return
+			const crlf = "\r\n"
+			input := strings.ReplaceAll(test.input, "\n", crlf) + crlf
+			recorder := newRecordingClient(t, io.NopCloser(strings.NewReader(input)))
+			testREPL, err := New(t.Context(), &dbrepl.NewREPLConfig{
+				Client:     recorder,
+				ServerConn: testSrv.connectTCP(t, 10*time.Second),
+				Route:      route,
+			})
+			require.NoError(t, err)
+			testREPL.(*REPL).testPassword = testSrv.password
+			testREPL.(*REPL).disableQueryTimings = true
+			testREPL.(*REPL).teleportVersion = "19.0.0-dev"
+			err = testREPL.Run(t.Context())
+			require.NoError(t, err)
+			goldenName := strings.ReplaceAll(test.name, " ", "-")
+			if golden.ShouldSet() {
+				golden.SetNamed(t, goldenName, recorder.buf.Bytes())
+			}
+			require.Equal(t, string(golden.GetNamed(t, goldenName)), recorder.buf.String())
+		})
+	}
+}
+
+var (
+	//go:embed fixtures/ddl.sql
+	testDDL string
+	//go:embed fixtures/all-data-types.sql
+	testDataTypes string
+	//go:embed fixtures/literals.sql
+	testLiterals string
+	//go:embed fixtures/commands.sql
+	testCommands string
+)
+
+func TestGetPrompt(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		desc         string
+		inQuery      bool
+		inComment    bool
+		inStringKind string
+		database     string
+		want         string
+	}{
+		{
+			desc: "no default database",
+			want: "(none)> ",
+		},
+		{
+			desc:     "default",
+			database: "llama",
+			want:     "llama> ",
+		},
+		{
+			desc:     "in a query",
+			inQuery:  true,
+			database: "llama",
+			want:     "    -> ",
+		},
+		{
+			desc:      "in a comment",
+			inComment: true,
+			database:  "llama",
+			want:      "   /*> ",
+		},
+		{
+			desc:         "in a quote string",
+			inStringKind: "'",
+			database:     "llama",
+			want:         "    '> ",
+		},
+		{
+			desc:         "in a double quote string",
+			inStringKind: `"`,
+			database:     "llama",
+			want:         `    "> `,
+		},
+		{
+			desc:         "in a backtick string",
+			inStringKind: "`",
+			database:     "llama",
+			want:         "    `> ",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			r := &REPL{
+				route: clientproto.RouteToDatabase{
+					Database: test.database,
+				},
+				parser: &parser{
+					lex: lexer{
+						inComment:     test.inComment,
+						inStringToken: token{text: test.inStringKind},
+					},
+				},
+				teleportVersion: "v19.0.0-dev",
+			}
+			if test.inQuery {
+				r.parser.lex.queryBuf.WriteString("select")
+			}
+			require.Equal(t, test.want, r.getPrompt())
+		})
+	}
+}
+
+func FuzzEval(f *testing.F) {
+	parser, err := newParser()
+	require.NoError(f, err)
+
+	for _, cmd := range parser.commands.byName {
+		f.Add(cmd.name)
+		f.Add(parser.commands.shortcutPrefix + string(cmd.shortcut))
+	}
+
+	f.Add("")  // eof
+	f.Add(" ") // space
+
+	// MySQL string literal quotes
+	f.Add("'")
+	f.Add(`"`)
+	f.Add("`")
+
+	// single line comments
+	f.Add("--")
+	f.Add("#")
+
+	// multiline comments
+	f.Add("/*")
+	f.Add("*/")
+	f.Add("*")
+
+	// valid delimiters
+	f.Add(";")
+	f.Add("$")
+	f.Add("/")
+
+	// some statement syntax
+	f.Add("select")
+	f.Add("create")
+	f.Add("drop")
+	f.Add("replace")
+	f.Add("alter")
+	f.Add("(")
+	f.Add(")")
+
+	// multiline
+	f.Add("\n")
+
+	f.Fuzz(func(t *testing.T, line string) {
+		repl := &REPL{
+			myConn: &fakeMySQLConn{
+				exec: func(command string, args ...any) (*mysql.Result, error) {
+					return nil, io.EOF
+				},
+			},
+			parser: parser,
+		}
+		require.NotPanics(t, func() {
+			for line := range strings.SplitSeq(line, "\n") {
+				for _, exit := range repl.eval(line) {
+					if exit {
+						return
+					}
+				}
+			}
+		})
+	})
+}
+
+func TestInteractively(t *testing.T) {
+	// You can get an interactive REPL to experiment with like this:
+	// $ export MYSQL_TEST_REPL_INTERACTIVELY=1
+	// $ go test -c -o ./test ./lib/client/db/mysql/repl
+	// $ ./test -test.v -test.count=1 -test.run TestInteractively
+	if os.Getenv("MYSQL_TEST_REPL_INTERACTIVELY") == "" {
+		t.Skip()
+	}
+	testSrv := newTestServer(t)
+	route := clientproto.RouteToDatabase{
+		ServiceName: "mysql-test-container",
+		Protocol:    defaults.ProtocolMySQL,
+		Username:    testSrv.username,
+		Database:    testSrv.database,
+		Roles:       []string{},
+	}
+	oldState, err := term.MakeRaw(int(os.Stdin.Fd()))
+	require.NoError(t, err)
+	defer term.Restore(int(os.Stdin.Fd()), oldState)
+	recorder := newRecordingClient(t, os.Stdin, os.Stdout)
+	repl, err := New(t.Context(), &dbrepl.NewREPLConfig{
+		Client:     recorder,
+		ServerConn: testSrv.connectTCP(t, 10*time.Second),
+		Route:      route,
+	})
+	require.NoError(t, err)
+	repl.(*REPL).testPassword = testSrv.password
+	require.NoError(t, repl.Run(t.Context()))
+}
+
+func Test_summarizeResult(t *testing.T) {
+	resultRows, err := mysql.BuildSimpleTextResultset(
+		[]string{"one", "two", "three"},
+		[][]any{{1, 2.2, "3"}, {4, 5.5, "6"}, {7, 8.8, "8"}},
+	)
+	require.NoError(t, err)
+
+	noRows, err := mysql.BuildSimpleTextResultset(
+		[]string{"one", "two", "three"},
+		nil,
+	)
+	require.NoError(t, err)
+
+	tests := []struct {
+		desc    string
+		input   *mysql.Result
+		elapsed time.Duration
+	}{
+		{
+			desc:    "result rows",
+			input:   &mysql.Result{Resultset: resultRows},
+			elapsed: time.Millisecond * 1234,
+		},
+		{
+			desc:    "long elapsed time",
+			input:   &mysql.Result{Resultset: resultRows},
+			elapsed: time.Millisecond * 123456,
+		},
+		{
+			desc:    "empty set",
+			input:   &mysql.Result{Resultset: noRows},
+			elapsed: time.Millisecond * 42,
+		},
+		{
+			desc:    "nil set",
+			input:   &mysql.Result{Warnings: 2, AffectedRows: 42},
+			elapsed: 0,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			mustParseResult(t, test.input)
+			var numRows int
+			if test.input.Resultset != nil {
+				numRows = len(test.input.Resultset.Values)
+			}
+			got := summarizeResult(test.input, numRows, &test.elapsed)
+			goldenName := strings.ReplaceAll(test.desc, " ", "-")
+			if golden.ShouldSet() {
+				golden.SetNamed(t, goldenName, []byte(got))
+			}
+			require.Equal(t, string(golden.GetNamed(t, goldenName)), got)
+		})
+	}
+}
+
+func mustParseResult(t *testing.T, result *mysql.Result) {
+	t.Helper()
+	if result.Resultset == nil {
+		return
+	}
+	result.Values = make([][]mysql.FieldValue, len(result.RowDatas))
+	for i := range result.RowDatas {
+		const isBinary = false
+		v, err := result.RowDatas[i].Parse(result.Fields, isBinary, result.Values[i])
+		result.Values[i] = v
+		require.NoError(t, err)
+	}
+}
+
+func newTestServer(t *testing.T) *testServer {
+	t.Helper()
+	ctx := t.Context()
+
+	reuseName := cmp.Or(os.Getenv("MYSQL_TEST_SERVER_REUSE_CONTAINER_BY_NAME"), "default-mysql-test-server")
+	testSrvMu.Lock()
+	// hold the lock for the entire func to avoid parallel container requests
+	defer testSrvMu.Unlock()
+	if testSrv != nil {
+		return testSrv
+	}
+
+	user := cmp.Or(os.Getenv("MYSQL_TEST_SERVER_USER"), "root")
+	db := cmp.Or(os.Getenv("MYSQL_TEST_SERVER_DB"), "mysql")
+	pass := cmp.Or(os.Getenv("MYSQL_TEST_SERVER_PASS"), rand.Text())
+	opts := []testcontainers.ContainerCustomizer{
+		mysqlcontainer.WithDatabase(db),
+		mysqlcontainer.WithUsername(user),
+		mysqlcontainer.WithPassword(pass),
+		testcontainers.WithReuseByName(reuseName),
+	}
+
+	// MySQL 8.4.6 index digest
+	// https://docs.docker.com/dhi/core-concepts/digests/#multi-platform-images-and-manifests
+	// https://hub.docker.com/layers/library/mysql/8.4.6/images/sha256-9b9413211d004062e6d5be1118e1051773fe66d832ec9ebcae1c2fcce5af5f5b
+	const img = "mysql@sha256:d2c60b1b225c6d7845f0abdb596fc35c2d4122bcad6ec219588035a118f75d93"
+	container, err := mysqlcontainer.Run(ctx, img, opts...)
+	require.NoError(t, err)
+
+	host, err := container.Host(ctx)
+	require.NoError(t, err)
+
+	mappedPort, err := container.MappedPort(ctx, "3306/tcp")
+	require.NoError(t, err)
+
+	srv := &testServer{
+		container: container,
+		host:      host,
+		port:      mappedPort.Port(),
+		username:  user,
+		password:  pass,
+		database:  db,
+	}
+	testSrv = srv
+	return srv
+}
+
+// testServer is a MySQL server for tests.
+type testServer struct {
+	// container is the container hosting the server.
+	container testcontainers.Container
+	// host is the MySQL connection endpoint host.
+	host string
+	// port is the MySQL connection endpoint port.
+	port string
+	// username is the database superuser.
+	username string
+	// password is the database superuser password.
+	password string
+	// database is a database schema provisioned in the database.
+	database string
+}
+
+// hostPort returns the server host:port.
+func (s *testServer) hostPort() string {
+	return net.JoinHostPort(s.host, s.port)
+}
+
+func (s *testServer) connectTCP(t *testing.T, timeout time.Duration) net.Conn {
+	t.Helper()
+	conn, err := net.DialTimeout("tcp", s.hostPort(), timeout)
+	require.NoError(t, err)
+	return conn
+}
+
+func newRecordingClient(t *testing.T, reader io.ReadCloser, writers ...io.Writer) *recordingClient {
+	t.Helper()
+	var buf bytes.Buffer
+	writers = append(writers, &buf)
+	return &recordingClient{
+		ReadCloser: reader,
+		Writer:     io.MultiWriter(writers...),
+		buf:        &buf,
+	}
+}
+
+type recordingClient struct {
+	io.ReadCloser
+	io.Writer
+	buf *bytes.Buffer
+}
diff --git a/lib/client/db/mysql/repl/testdata/TestREPL/all_data_types/all-data-types.golden b/lib/client/db/mysql/repl/testdata/TestREPL/all_data_types/all-data-types.golden
new file mode 100644
index 0000000000000..5b21322d85073
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/TestREPL/all_data_types/all-data-types.golden
@@ -0,0 +1,255 @@
+Teleport MySQL interactive shell (v19.0.0-dev)
+Connected to instance "mysql-test-container" as user "root".
+Type 'help' or '\h' for help.
+
+(none)> -- temporarily disable note warnings for test consistency
+(none)> set session sql_notes = 0;
+
+0 warnings, 0 rows affected
+
+(none)> CREATE DATABASE IF NOT EXISTS all_data_types;
+
+0 warnings, 1 rows affected
+
+(none)> set session sql_notes = 1;
+
+0 warnings, 0 rows affected
+
+(none)> USE all_data_types;
+
+Default database changed to "all_data_types"
+
+all_data_types> 
+all_data_types> -- without ANSI_QUOTES double quotes are literals
+all_data_types> SET SESSION sql_mode='';
+
+0 warnings, 0 rows affected
+
+all_data_types> SELECT "thing";
+
+thing
+-----
+'thing' 
+
+1 row in set
+
+all_data_types> -- with ANSI_QUOTES double quotes are identifiers, which is what
+ we want when
+all_data_types> -- selecting from the table below
+all_data_types> SET SESSION sql_mode='ANSI_QUOTES';
+
+0 warnings, 0 rows affected
+
+all_data_types> SELECT "thing";
+
+ERR ERROR 1054 (42S22): Unknown column 'thing' in 'field list'
+
+all_data_types> 
+all_data_types> CREATE TABLE all_types_demo (
+             ->     "c tinyint"         TINYINT,
+             ->     c_smallint        SMALLINT,
+             ->     c_mediumint       MEDIUMINT,
+             ->     c_int             INT,
+             ->     c_bigint          BIGINT,
+             ->     c_decimal         DECIMAL(10,2),
+             ->     c_float           FLOAT,
+             ->     c_double          DOUBLE,
+             ->     c_bit             BIT(8),
+             ->     c_bool            BOOL,
+             ->     c_date            DATE,
+             ->     c_time            TIME,
+             ->     c_datetime        DATETIME,
+             ->     c_timestamp       TIMESTAMP NULL DEFAULT NULL,
+             ->     c_year            YEAR,
+             ->     c_char            CHAR(5),
+             ->     c_varchar         VARCHAR(10),
+             ->     c_binary          BINARY(3),
+             ->     c_varbinary       VARBINARY(4),
+             ->     c_tinyblob        TINYBLOB,
+             ->     c_blob            BLOB,
+             ->     c_mediumblob      MEDIUMBLOB,
+             ->     c_longblob        LONGBLOB,
+             ->     c_tinytext        TINYTEXT,
+             ->     c_text            TEXT,
+             ->     c_mediumtext      MEDIUMTEXT,
+             ->     c_longtext        LONGTEXT,
+             ->     c_enum            ENUM('foo','bar','baz'),
+             ->     c_set             SET('a','b','c'),
+             ->     c_geometry        GEOMETRY,
+             ->     c_point           POINT,
+             ->     c_linestring      LINESTRING,
+             ->     c_polygon         POLYGON,
+             ->     c_multipoint      MULTIPOINT,
+             ->     c_multilinestring MULTILINESTRING,
+             ->     c_multipolygon    MULTIPOLYGON,
+             ->     c_geometrycoll    GEOMETRYCOLLECTION,
+             ->     c_json            JSON
+             -> );
+
+0 warnings, 0 rows affected
+
+all_data_types> 
+all_data_types> INSERT INTO all_types_demo VALUES (
+             ->     127,
+             ->     32767,
+             ->     8388607,
+             ->     2147483647,
+             ->     9223372036854775807,
+             ->     12345.67,
+             ->     3.14,
+             ->     2.7182818284,
+             ->     b'10101010',
+             ->     1,
+             ->     '2024-07-09',
+             ->     '12:34:56',
+             ->     '2024-07-09 12:34:56',
+             ->     '2024-07-09 12:34:56',
+             ->     2025,
+             ->     'abcde',
+             ->     'abcdefghij',
+             ->     'abc',
+             ->     'defg',
+             ->     'a',
+             ->     'blob',
+             ->     'medblob',
+             ->     'longblob',
+             ->     'tiny',
+             ->     'text',
+             ->     'mediumtext',
+             ->     'longtext',
+             ->     'foo',
+             ->     'a,b',
+             ->     ST_GeomFromText('POINT(1 1)'),
+             ->     ST_GeomFromText('POINT(2 2)'),
+             ->     ST_GeomFromText('LINESTRING(0 0,1 1,2 2)'),
+             ->     ST_GeomFromText('POLYGON((0 0,1 0,1 1,0 1,0 0))'),
+             ->     ST_GeomFromText('MULTIPOINT((0 0),(1 1))'),
+             ->     ST_GeomFromText('MULTILINESTRING((0 0,1 1),(2 2,3 3))'),
+             ->     ST_GeomFromText('MULTIPOLYGON(((0 0,1 0,1 1,0 1,0 0)))'),
+             ->     ST_GeomFromText('GEOMETRYCOLLECTION(POINT(1 2),LINESTRING(0 
+0,1 1))'),
+             ->     JSON_OBJECT('x', 1, 'y', 2)
+             -> );
+
+0 warnings, 1 rows affected
+
+all_data_types> 
+all_data_types> SELECT "c tinyint", `c_smallint`, "c_mediumint" FROM `all_types_
+demo`;
+
+c tinyint c_smallint c_mediumint
+--------- ---------- -----------
+127       32767      8388607 
+
+1 row in set
+
+all_data_types> SELECT c_int, c_bigint, c_decimal FROM all_types_demo;
+
+c_int      c_bigint            c_decimal
+-----      --------            ---------
+2147483647 9223372036854775807 '12345.67' 
+
+1 row in set
+
+all_data_types> SELECT c_float, c_double, c_bit FROM all_types_demo;
+
+c_float c_double     c_bit
+------- --------     -----
+3.14    2.7182818284 '�'  
+
+1 row in set
+
+all_data_types> SELECT c_bool, c_date, c_time FROM all_types_demo;
+
+c_bool c_date       c_time
+------ ------       ------
+1      '2024-07-09' '12:34:56' 
+
+1 row in set
+
+all_data_types> SELECT c_datetime, c_timestamp, c_year FROM all_types_demo;
+
+c_datetime            c_timestamp           c_year
+----------            -----------           ------
+'2024-07-09 12:34:56' '2024-07-09 12:34:56' 2025 
+
+1 row in set
+
+all_data_types> SELECT c_char, c_varchar, c_binary FROM all_types_demo;
+
+c_char  c_varchar    c_binary
+------  ---------    --------
+'abcde' 'abcdefghij' 'abc' 
+
+1 row in set
+
+all_data_types> SELECT c_varbinary, c_tinyblob, c_blob FROM all_types_demo;
+
+c_varbinary c_tinyblob c_blob
+----------- ---------- ------
+'defg'      'a'        'blob' 
+
+1 row in set
+
+all_data_types> SELECT "c_mediumblob",
+             ->        `c_longblob`,
+             ->        c_tinytext
+             -> FROM all_types_demo;
+
+c_mediumblob c_longblob c_tinytext
+------------ ---------- ----------
+'medblob'    'longblob' 'tiny' 
+
+1 row in set
+
+all_data_types> SELECT c_text, c_mediumtext, c_longtext FROM all_types_demo;
+
+c_text c_mediumtext c_longtext
+------ ------------ ----------
+'text' 'mediumtext' 'longtext' 
+
+1 row in set
+
+all_data_types> SELECT c_enum, c_set, ST_AsText(c_geometry) AS c_geometry FROM a
+ll_types_demo;
+
+c_enum c_set c_geometry
+------ ----- ----------
+'foo'  'a,b' 'POINT(1 1)' 
+
+1 row in set
+
+all_data_types> SELECT ST_AsText(c_point) AS c_point, ST_AsText(c_linestring) AS
+ c_linestring, ST_AsText(c_polygon) AS c_polygon FROM all_types_demo;
+
+c_point      c_linestring              c_polygon
+-------      ------------              ---------
+'POINT(2 2)' 'LINESTRING(0 0,1 1,2 2)' 'POLYGON((0 0,1 0,1 1,0 1,0 0))' 
+
+1 row in set
+
+all_data_types> SELECT ST_AsText(c_multipoint) AS c_multipoint, ST_AsText(c_mult
+ilinestring) AS c_multilinestring, ST_AsText(c_multipolygon) AS c_multipolygon F
+ROM all_types_demo;
+
+c_multipoint              c_multilinestring                      c_multipolygon
+------------              -----------------                      --------------
+'MULTIPOINT((0 0),(1 1))' 'MULTILINESTRING((0 0,1 1),(2 2,3 3))' 'MULTIPOLYGON(((0 0,1 0,1 1,0 1,0 0)))' 
+
+1 row in set
+
+all_data_types> SELECT ST_AsText(c_geometrycoll) AS c_geometrycoll, c_json FROM 
+all_types_demo;
+
+c_geometrycoll                                       c_json
+--------------                                       ------
+'GEOMETRYCOLLECTION(POINT(1 2),LINESTRING(0 0,1 1))' '{"x": 1, "y": 2}' 
+
+1 row in set
+
+all_data_types> DROP DATABASE all_data_types;
+
+0 warnings, 1 rows affected
+
+all_data_types> 
+all_data_types> 
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/TestREPL/commands/commands.golden b/lib/client/db/mysql/repl/testdata/TestREPL/commands/commands.golden
new file mode 100644
index 0000000000000..e36da38837241
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/TestREPL/commands/commands.golden
@@ -0,0 +1,325 @@
+Teleport MySQL interactive shell (v19.0.0-dev)
+Connected to instance "mysql-test-container" as user "root".
+Type 'help' or '\h' for help.
+
+(none)> -- temporarily disable note warnings for test consistency
+(none)> set session sql_notes = 0;
+
+0 warnings, 0 rows affected
+
+(none)> create database if not exists test_commands;
+
+0 warnings, 1 rows affected
+
+(none)> create database if not exists foo;
+
+0 warnings, 1 rows affected
+
+(none)> create database if not exists bar;
+
+0 warnings, 1 rows affected
+
+(none)> set session sql_notes = 1;
+
+0 warnings, 0 rows affected
+
+(none)> use test_commands;
+
+Default database changed to "test_commands"
+
+test_commands> 
+test_commands> -- leading spaces/comments before commands
+test_commands> /* just a comment */
+test_commands> use foo;
+
+Default database changed to "foo"
+
+foo> use foo
+
+Default database changed to "foo"
+
+foo>      /*
+ /*> llama
+ /*>  */
+foo> use foo;
+
+Default database changed to "foo"
+
+foo>      /*
+ /*> llama
+ /*>  */
+foo> use foo
+
+Default database changed to "foo"
+
+foo> -- llama
+foo> use foo;
+
+Default database changed to "foo"
+
+foo> -- llama
+foo> use foo
+
+Default database changed to "foo"
+
+foo>   -- llama
+foo>     use foo;
+
+Default database changed to "foo"
+
+foo>   -- llama
+foo>     use foo
+
+Default database changed to "foo"
+
+foo> /* llama */use foo;
+
+Default database changed to "foo"
+
+foo> /* llama */use foo
+
+Default database changed to "foo"
+
+foo> /* llama */  use foo;
+
+Default database changed to "foo"
+
+foo> /* llama */  use foo
+
+Default database changed to "foo"
+
+foo> /* llama */
+foo>   use foo;
+
+Default database changed to "foo"
+
+foo> /* llama */
+foo>   use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> */use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> */use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> */  use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> */  use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- llama
+ /*> */use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- llama
+ /*> */use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- llama
+ /*> */  use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- llama
+ /*> */  use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- */use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- */use foo
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- */  use foo;
+
+Default database changed to "foo"
+
+foo> /* llama
+ /*> -- */  use foo
+
+Default database changed to "foo"
+
+foo> /* llama */
+foo> 
+foo> use foo;use bar; use foo
+
+Default database changed to "foo"
+
+
+Default database changed to "bar"
+
+
+Default database changed to "foo"
+
+foo> -- this isn't a command, but that should just print an error message and he
+lp info.
+foo> \xyz select 1
+
+Unknown command.
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+foo> \xyz;select 1;
+
+Unknown command.
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+
+1
+-
+1    
+
+1 row in set
+
+foo> delimiter $$
+foo> help$$
+
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+foo> \d //
+foo> \h
+
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+foo> help
+
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+foo> status
+
+Teleport database: mysql-test-container 
+Current database:  foo                  
+Current user:      root                 
+Server version:    8.4.6                
+Using delimiter:   //
+
+foo> \s
+
+Teleport database: mysql-test-container 
+Current database:  foo                  
+Current user:      root                 
+Server version:    8.4.6                
+Using delimiter:   //
+
+foo> teleport
+
+Teleport MySQL interactive shell (v19.0.0-dev)
+
+Limitations: 
+- Query cancellation is not supported. Once a query is sent, its execution
+  can only be canceled by killing it from another session.
+  You can identify the query process ID with "SHOW PROCESSLIST" and then kill the
+  query with "KILL QUERY <pid>".
+  
+- Pressing CTRL-C will have no effect in this shell.
+
+foo> \t
+
+Teleport MySQL interactive shell (v19.0.0-dev)
+
+Limitations: 
+- Query cancellation is not supported. Once a query is sent, its execution
+  can only be canceled by killing it from another session.
+  You can identify the query process ID with "SHOW PROCESSLIST" and then kill the
+  query with "KILL QUERY <pid>".
+  
+- Pressing CTRL-C will have no effect in this shell.
+
+foo> use foo
+
+Default database changed to "foo"
+
+foo> \u mysql//
+
+Default database changed to "mysql"
+
+mysql> -- reset the delimiter to default ;
+mysql> \d
+mysql> teleport;\s;\h
+
+Teleport MySQL interactive shell (v19.0.0-dev)
+
+Limitations: 
+- Query cancellation is not supported. Once a query is sent, its execution
+  can only be canceled by killing it from another session.
+  You can identify the query process ID with "SHOW PROCESSLIST" and then kill the
+  query with "KILL QUERY <pid>".
+  
+- Pressing CTRL-C will have no effect in this shell.
+
+
+Teleport database: mysql-test-container 
+Current database:  mysql                
+Current user:      root                 
+Server version:    8.4.6                
+Using delimiter:   ;
+
+
+delimiter \d   Set statement delimiter. With no argument the delimiter resets to the default. 
+help      \h   Show the list of supported commands.                                           
+quit      \q   Terminates the session.                                                        
+status    \s   Get status information.                                                        
+teleport  \t   Show Teleport interactive shell information, such as execution limitations.    
+use       \u   Use another database.
+
+mysql> use `bar`;drop database foo;drop database bar;drop database test_commands
+;quit
+
+Default database changed to "bar"
+
+
+0 warnings, 0 rows affected
+
+
+0 warnings, 0 rows affected
+
+
+0 warnings, 0 rows affected
+
diff --git a/lib/client/db/mysql/repl/testdata/TestREPL/ddl/ddl.golden b/lib/client/db/mysql/repl/testdata/TestREPL/ddl/ddl.golden
new file mode 100644
index 0000000000000..1e241a7dc3d73
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/TestREPL/ddl/ddl.golden
@@ -0,0 +1,362 @@
+Teleport MySQL interactive shell (v19.0.0-dev)
+Connected to instance "mysql-test-container" as user "root".
+Type 'help' or '\h' for help.
+
+(none)> -- temporarily disable note warnings for test consistency
+(none)> set session sql_notes = 0;
+
+0 warnings, 0 rows affected
+
+(none)> DROP DATABASE IF EXISTS test_ddl_db;
+
+0 warnings, 0 rows affected
+
+(none)> CREATE DATABASE test_ddl_db;
+
+0 warnings, 1 rows affected
+
+(none)> set session sql_notes = 1;
+
+0 warnings, 0 rows affected
+
+(none)> -- this should produce a note level warning because it does exist
+(none)> CREATE DATABASE if not exists test_ddl_db;
+
+1 warnings, 1 rows affected
+
+(none)> -- we clear the warning by selecting the warning count
+(none)> select @@warning_count;
+
+@@warning_count
+---------------
+1    
+
+1 row in set
+
+(none)> USE test_ddl_db;
+
+Default database changed to "test_ddl_db"
+
+test_ddl_db> 
+test_ddl_db> CREATE TABLE test_table (
+          ->   id INT PRIMARY KEY AUTO_INCREMENT,
+          ->   value VARCHAR(50) NOT NULL,
+          ->   note VARCHAR(100) DEFAULT NULL
+          -> ) ENGINE=InnoDB;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> CREATE VIEW test_view AS (
+          ->     SELECT id, value
+          ->     FROM test_table
+          -> );
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> DELIMITER $$
+test_ddl_db> CREATE FUNCTION test_func(x INT) RETURNS INT DETERMINISTIC
+          -> BEGIN
+          ->   RETURN x * 2;
+          -> END $$
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DELIMITER ;
+test_ddl_db> 
+test_ddl_db> DELIMITER $$
+test_ddl_db> CREATE PROCEDURE test_proc()
+          -> BEGIN
+          ->   INSERT INTO test_table(value) VALUES ('from proc');
+          -> END $$
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DELIMITER ;
+test_ddl_db> 
+test_ddl_db> CALL test_proc();
+
+0 warnings, 1 rows affected
+
+test_ddl_db> 
+test_ddl_db> DELIMITER $$
+test_ddl_db> CREATE TRIGGER test_trigger_before_insert
+          -> BEFORE INSERT ON test_table
+          -> FOR EACH ROW
+          -> BEGIN
+          ->   SET NEW.value = UPPER(NEW.value);
+          -> END $$
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DELIMITER ;
+test_ddl_db> 
+test_ddl_db> CALL test_proc();
+
+0 warnings, 1 rows affected
+
+test_ddl_db> 
+test_ddl_db> CREATE EVENT test_event
+          ->   ON SCHEDULE AT CURRENT_TIMESTAMP + INTERVAL 1 HOUR
+          ->   DO INSERT INTO test_table(value) VALUES ('from event');
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> set session sql_notes = 0;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> -- roles are not database scoped, let's disable note warnings in ca
+se some other
+test_ddl_db> -- test has already created the role or user.
+test_ddl_db> CREATE ROLE IF NOT EXISTS test_role;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DROP ROLE test_role;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> CREATE USER IF NOT EXISTS test_user@'localhost'
+          ->   IDENTIFIED BY 'some password'
+          ->   ACCOUNT LOCK;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> ALTER USER test_user@'localhost' PASSWORD EXPIRE;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DROP USER test_user@'localhost';
+
+0 warnings, 0 rows affected
+
+test_ddl_db> set session sql_notes = 1;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> ALTER DATABASE test_ddl_db CHARACTER SET utf8mb4;
+
+0 warnings, 1 rows affected
+
+test_ddl_db> ALTER TABLE test_table ADD COLUMN note2 VARCHAR(100) DEFAULT NULL;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> ALTER EVENT test_event DISABLE;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> ALTER FUNCTION test_func COMMENT 'Test function';
+
+0 warnings, 0 rows affected
+
+test_ddl_db> ALTER PROCEDURE test_proc COMMENT 'Test procedure';
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> RENAME TABLE test_table
+          ->        TO test_table_renamed;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> SELECT * from test_table_renamed;
+
+id   value       note note2
+--   -----       ---- -----
+1    'from proc' NULL NULL 
+2    'FROM PROC' NULL NULL 
+
+2 rows in set
+
+test_ddl_db> 
+test_ddl_db> RENAME
+          ->   TABLE test_table_renamed
+          ->   TO test_table;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> SELECT * from test_table;
+
+id   value       note note2
+--   -----       ---- -----
+1    'from proc' NULL NULL 
+2    'FROM PROC' NULL NULL 
+
+2 rows in set
+
+test_ddl_db> 
+test_ddl_db> INSERT INTO test_table (value)
+          -> WITH RECURSIVE numbers(n) AS (
+          ->   SELECT 4
+          ->   UNION ALL
+          ->   SELECT n + 1 FROM numbers WHERE n < 120
+          -> )
+          -> SELECT 'especially wide column' AS value
+          -> UNION ALL
+          -> SELECT CONCAT('value_', n) FROM numbers;
+
+0 warnings, 118 rows affected
+
+test_ddl_db> 
+test_ddl_db> SELECT * from test_table;
+
+id   value                    note note2
+--   -----                    ---- -----
+1    'from proc'              NULL NULL 
+2    'FROM PROC'              NULL NULL 
+3    'ESPECIALLY WIDE COLUMN' NULL NULL 
+4    'VALUE_4'                NULL NULL 
+5    'VALUE_5'                NULL NULL 
+6    'VALUE_6'                NULL NULL 
+7    'VALUE_7'                NULL NULL 
+8    'VALUE_8'                NULL NULL 
+9    'VALUE_9'                NULL NULL 
+10   'VALUE_10'               NULL NULL 
+11   'VALUE_11'               NULL NULL 
+12   'VALUE_12'               NULL NULL 
+13   'VALUE_13'               NULL NULL 
+14   'VALUE_14'               NULL NULL 
+15   'VALUE_15'               NULL NULL 
+16   'VALUE_16'               NULL NULL 
+17   'VALUE_17'               NULL NULL 
+18   'VALUE_18'               NULL NULL 
+19   'VALUE_19'               NULL NULL 
+20   'VALUE_20'               NULL NULL 
+21   'VALUE_21'               NULL NULL 
+22   'VALUE_22'               NULL NULL 
+23   'VALUE_23'               NULL NULL 
+24   'VALUE_24'               NULL NULL 
+25   'VALUE_25'               NULL NULL 
+26   'VALUE_26'               NULL NULL 
+27   'VALUE_27'               NULL NULL 
+28   'VALUE_28'               NULL NULL 
+29   'VALUE_29'               NULL NULL 
+30   'VALUE_30'               NULL NULL 
+31   'VALUE_31'               NULL NULL 
+32   'VALUE_32'               NULL NULL 
+33   'VALUE_33'               NULL NULL 
+34   'VALUE_34'               NULL NULL 
+35   'VALUE_35'               NULL NULL 
+36   'VALUE_36'               NULL NULL 
+37   'VALUE_37'               NULL NULL 
+38   'VALUE_38'               NULL NULL 
+39   'VALUE_39'               NULL NULL 
+40   'VALUE_40'               NULL NULL 
+41   'VALUE_41'               NULL NULL 
+42   'VALUE_42'               NULL NULL 
+43   'VALUE_43'               NULL NULL 
+44   'VALUE_44'               NULL NULL 
+45   'VALUE_45'               NULL NULL 
+46   'VALUE_46'               NULL NULL 
+47   'VALUE_47'               NULL NULL 
+48   'VALUE_48'               NULL NULL 
+49   'VALUE_49'               NULL NULL 
+50   'VALUE_50'               NULL NULL 
+51   'VALUE_51'               NULL NULL 
+52   'VALUE_52'               NULL NULL 
+53   'VALUE_53'               NULL NULL 
+54   'VALUE_54'               NULL NULL 
+55   'VALUE_55'               NULL NULL 
+56   'VALUE_56'               NULL NULL 
+57   'VALUE_57'               NULL NULL 
+58   'VALUE_58'               NULL NULL 
+59   'VALUE_59'               NULL NULL 
+60   'VALUE_60'               NULL NULL 
+61   'VALUE_61'               NULL NULL 
+62   'VALUE_62'               NULL NULL 
+63   'VALUE_63'               NULL NULL 
+64   'VALUE_64'               NULL NULL 
+65   'VALUE_65'               NULL NULL 
+66   'VALUE_66'               NULL NULL 
+67   'VALUE_67'               NULL NULL 
+68   'VALUE_68'               NULL NULL 
+69   'VALUE_69'               NULL NULL 
+70   'VALUE_70'               NULL NULL 
+71   'VALUE_71'               NULL NULL 
+72   'VALUE_72'               NULL NULL 
+73   'VALUE_73'               NULL NULL 
+74   'VALUE_74'               NULL NULL 
+75   'VALUE_75'               NULL NULL 
+76   'VALUE_76'               NULL NULL 
+77   'VALUE_77'               NULL NULL 
+78   'VALUE_78'               NULL NULL 
+79   'VALUE_79'               NULL NULL 
+80   'VALUE_80'               NULL NULL 
+81   'VALUE_81'               NULL NULL 
+82   'VALUE_82'               NULL NULL 
+83   'VALUE_83'               NULL NULL 
+84   'VALUE_84'               NULL NULL 
+85   'VALUE_85'               NULL NULL 
+86   'VALUE_86'               NULL NULL 
+87   'VALUE_87'               NULL NULL 
+88   'VALUE_88'               NULL NULL 
+89   'VALUE_89'               NULL NULL 
+90   'VALUE_90'               NULL NULL 
+91   'VALUE_91'               NULL NULL 
+92   'VALUE_92'               NULL NULL 
+93   'VALUE_93'               NULL NULL 
+94   'VALUE_94'               NULL NULL 
+95   'VALUE_95'               NULL NULL 
+96   'VALUE_96'               NULL NULL 
+97   'VALUE_97'               NULL NULL 
+98   'VALUE_98'               NULL NULL 
+99   'VALUE_99'               NULL NULL 
+100  'VALUE_100'              NULL NULL 
+101  'VALUE_101' NULL NULL 
+102  'VALUE_102' NULL NULL 
+103  'VALUE_103' NULL NULL 
+104  'VALUE_104' NULL NULL 
+105  'VALUE_105' NULL NULL 
+106  'VALUE_106' NULL NULL 
+107  'VALUE_107' NULL NULL 
+108  'VALUE_108' NULL NULL 
+109  'VALUE_109' NULL NULL 
+110  'VALUE_110' NULL NULL 
+111  'VALUE_111' NULL NULL 
+112  'VALUE_112' NULL NULL 
+113  'VALUE_113' NULL NULL 
+114  'VALUE_114' NULL NULL 
+115  'VALUE_115' NULL NULL 
+116  'VALUE_116' NULL NULL 
+117  'VALUE_117' NULL NULL 
+118  'VALUE_118' NULL NULL 
+119  'VALUE_119' NULL NULL 
+120  'VALUE_120' NULL NULL 
+
+120 rows in set
+
+test_ddl_db> 
+test_ddl_db> -- there is no "test_server", this should make an error.
+test_ddl_db> ALTER SERVER test_server OPTIONS (HOST '127.0.0.1');
+
+ERR ERROR 1477 (HY000): The foreign server name you are trying to reference does not exist. Data source error:  test_server
+
+test_ddl_db> 
+test_ddl_db> DROP TRIGGER test_trigger_before_insert;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> TRUNCATE TABLE test_table    ;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> DROP TABLE test_table;
+
+0 warnings, 0 rows affected
+
+test_ddl_db> 
+test_ddl_db> DROP DATABASE test_ddl_db
+          -> ;
+
+0 warnings, 1 rows affected
+
+test_ddl_db> 
+test_ddl_db> 
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/TestREPL/literals/literals.golden b/lib/client/db/mysql/repl/testdata/TestREPL/literals/literals.golden
new file mode 100644
index 0000000000000..747a1088c9b83
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/TestREPL/literals/literals.golden
@@ -0,0 +1,154 @@
+Teleport MySQL interactive shell (v19.0.0-dev)
+Connected to instance "mysql-test-container" as user "root".
+Type 'help' or '\h' for help.
+
+(none)> -- with ANSI_QUOTES double quotes are identifiers
+(none)> SET SESSION sql_mode='ANSI_QUOTES';
+
+0 warnings, 0 rows affected
+
+(none)> SELECT "thing";
+
+ERR ERROR 1054 (42S22): Unknown column 'thing' in 'field list'
+
+(none)> -- without ANSI_QUOTES double quotes are literals
+(none)> SET SESSION sql_mode='';
+
+0 warnings, 0 rows affected
+
+(none)> SELECT "thing";
+
+thing
+-----
+'thing' 
+
+1 row in set
+
+(none)> select 1,  -1,1.24, -1.24, 'foo', null, 'null';
+
+1    -1   1.24   -1.24   foo   NULL null
+-    --   ----   -----   ---   ---- ----
+1    -1   '1.24' '-1.24' 'foo' NULL 'null' 
+
+1 row in set
+
+(none)> select
+     ->     1 as 'unsigned int',
+     ->     -1 as 'negative int',
+     ->     1.24 as "float",
+     ->     -1.24 as 'negative float',
+     ->     'foo' as 'string',
+     ->     null as 'actual NULL',
+     ->     "null" as 'string null';
+
+unsigned int negative int float  negative float string actual NULL string null
+------------ ------------ -----  -------------- ------ ----------- -----------
+1            -1           '1.24' '-1.24'        'foo'  NULL        'null' 
+
+1 row in set
+
+(none)> 
+(none)> select 1 as 'multiple rows of literals'
+     -> union
+     ->     select -1
+     -> union
+     ->     select 1.24
+     -> union
+     ->     select -1.24
+     -> union
+     ->     select 'foo'
+     -> union
+     ->     select null
+     -> union
+     ->     select 'null';
+
+multiple rows of literals
+-------------------------
+'1'     
+'-1'    
+'1.24'  
+'-1.24' 
+'foo'   
+NULL    
+'null'  
+
+7 rows in set
+
+(none)> 
+(none)> select 'a
+     '> b
+     '> c' as 'multiline-string';
+
+multiline-string
+----------------
+'a
+b
+c'   
+
+1 row in set
+
+(none)> 
+(none)> select 'a
+     '>     ;
+     '>     b
+     '>     ;
+     '> c' as 'multiline with delimiters';
+
+multiline with delimiters
+-------------------------
+'a
+    ;
+    b
+    ;
+c'   
+
+1 row in set
+
+(none)> 
+(none)> /* foo bar */
+(none)> select 1;
+
+1
+-
+1    
+
+1 row in set
+
+(none)> /* foo bar */select /*
+    /*> baz */ 42;
+
+42
+--
+42   
+
+1 row in set
+
+(none)> 
+(none)> delimiter $$
+(none)> select '$$1$$'$$
+
+$$1$$
+-----
+'$$1$$' 
+
+1 row in set
+
+(none)> select '$$;$$';$$
+
+$$;$$
+-----
+'$$;$$' 
+
+1 row in set
+
+(none)> delimiter ;
+(none)> select 1;
+
+1
+-
+1    
+
+1 row in set
+
+(none)> 
+(none)> 
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/Test_summarizeResult/empty_set/empty-set.golden b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/empty_set/empty-set.golden
new file mode 100644
index 0000000000000..4883fe4c84b99
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/empty_set/empty-set.golden
@@ -0,0 +1 @@
+Empty set (0.04 sec)
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/Test_summarizeResult/long_elapsed_time/long-elapsed-time.golden b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/long_elapsed_time/long-elapsed-time.golden
new file mode 100644
index 0000000000000..c85ccb7b4d58a
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/long_elapsed_time/long-elapsed-time.golden
@@ -0,0 +1 @@
+3 rows in set (123.46 sec)
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/Test_summarizeResult/nil_set/nil-set.golden b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/nil_set/nil-set.golden
new file mode 100644
index 0000000000000..3861e046317f2
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/nil_set/nil-set.golden
@@ -0,0 +1 @@
+2 warnings, 42 rows affected (0.00 sec)
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/testdata/Test_summarizeResult/result_rows/result-rows.golden b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/result_rows/result-rows.golden
new file mode 100644
index 0000000000000..4fedfddf2c997
--- /dev/null
+++ b/lib/client/db/mysql/repl/testdata/Test_summarizeResult/result_rows/result-rows.golden
@@ -0,0 +1 @@
+3 rows in set (1.23 sec)
\ No newline at end of file
diff --git a/lib/client/db/mysql/repl/token.go b/lib/client/db/mysql/repl/token.go
new file mode 100644
index 0000000000000..46722ec9fd322
--- /dev/null
+++ b/lib/client/db/mysql/repl/token.go
@@ -0,0 +1,53 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package repl
+
+// token is a lexical token.
+type token struct {
+	// kind is a token kind enum.
+	kind tokenKind
+	// text is the text that makes up the token.
+	text string
+}
+
+type tokenKind int
+
+const (
+	// EOF indicates end of token stream
+	tokenEOF tokenKind = iota
+
+	// whitespace
+	tokenSpace
+
+	// escape
+	tokenBackslash // \
+
+	// quotation syntax
+	tokenSingleQuote // '
+	tokenDoubleQuote // "
+	tokenBacktick    // `
+
+	// single-line comments
+	tokenSingleComment // -- or #
+
+	// multi-line comment open/close
+	tokenOpenComment  // /*
+	tokenCloseComment // */
+
+	// misc text that isn't special to us
+	tokenText
+)
diff --git a/lib/client/db/postgres/mcp/mcp.go b/lib/client/db/postgres/mcp/mcp.go
new file mode 100644
index 0000000000000..8c8ae9bc20c3d
--- /dev/null
+++ b/lib/client/db/postgres/mcp/mcp.go
@@ -0,0 +1,289 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	dbmcp "github.com/gravitational/teleport/lib/client/db/mcp"
+	clientmcp "github.com/gravitational/teleport/lib/client/mcp"
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+// queryTool is the run query MCP tool definition.
+var queryTool = mcp.NewTool(dbmcp.ToolName(defaults.ProtocolPostgres, "query"),
+	mcp.WithDescription("Execute SQL query against PostgreSQL database connected using Teleport"),
+	mcp.WithString(queryToolDatabaseParam,
+		mcp.Required(),
+		mcp.Description("Teleport database resource URI where the query will be executed"),
+	),
+	mcp.WithString(queryToolQueryParam,
+		mcp.Required(),
+		mcp.Description("PostgresSQL SQL query to execute"),
+	),
+)
+
+// queryToolForCockroachDB is same as queryTool but promotes CockroachDB instead
+// of PostgreSQL.
+var queryToolForCockroachDB = mcp.NewTool(dbmcp.ToolName(defaults.ProtocolCockroachDB, "query"),
+	mcp.WithDescription("Execute SQL query against CockroachDB database connected using Teleport"),
+	mcp.WithString(queryToolDatabaseParam,
+		mcp.Required(),
+		mcp.Description("Teleport database resource URI where the query will be executed"),
+	),
+	mcp.WithString(queryToolQueryParam,
+		mcp.Required(),
+		mcp.Description("CockroachDB SQL query to execute"),
+	),
+)
+
+type database struct {
+	*dbmcp.Database
+	pool *pgxpool.Pool
+}
+
+// Server handles PostgreSQL-specific MCP tools requests.
+type Server struct {
+	logger    *slog.Logger
+	databases map[string]*database
+}
+
+// NewServer initializes a PostgreSQL MCP server, creating the database
+// configurations and registering Server tools into the root server.
+func NewServer(ctx context.Context, cfg *dbmcp.NewServerConfig) (dbmcp.Server, error) {
+	return newServer(ctx, queryTool, cfg)
+}
+
+// NewServerForCockroachDB initializes a CockroachDB MCP server, creating the
+// database configurations and registering Server tools into the root server.
+//
+// Teleport differentiates CockroachDB and PostgreSQL as different protocols but
+// uses the same db engine under the hood. Here we use the same PostgreSQL
+// MCP server implementation as well, except for a slightly different tool
+// name and description.
+func NewServerForCockroachDB(ctx context.Context, cfg *dbmcp.NewServerConfig) (dbmcp.Server, error) {
+	return newServer(ctx, queryToolForCockroachDB, cfg)
+}
+
+func newServer(ctx context.Context, queryTool mcp.Tool, cfg *dbmcp.NewServerConfig) (*Server, error) {
+	s := &Server{logger: cfg.Logger, databases: make(map[string]*database)}
+	for _, db := range cfg.Databases {
+		if db.DatabaseUser == "" || db.DatabaseName == "" {
+			return nil, trace.BadParameter("database %q is missing the username and database name", db.DB.GetName())
+		}
+
+		connCfg, err := buildConnConfig(db)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		pool, err := pgxpool.NewWithConfig(ctx, connCfg)
+		if err != nil {
+			return nil, trace.BadParameter("failed to parse database %q connection config: %s", db.DB.GetName(), err)
+		}
+
+		s.databases[db.ResourceURI().WithoutParams().String()] = &database{
+			Database: db,
+			pool:     pool,
+		}
+	}
+
+	cfg.RootServer.AddTool(queryTool, s.RunQuery)
+	return s, nil
+}
+
+// Close implements dbmcp.Server.
+func (s *Server) Close(context.Context) error {
+	for _, db := range s.databases {
+		db.pool.Close()
+	}
+
+	return nil
+}
+
+// RunQueryResult is the run query tool result.
+type RunQueryResult struct {
+	// Data contains the data returned from the query. It can be empty in case
+	// the query doesn't return any data.
+	Data []map[string]any `json:"data"`
+	// RowsCount number of rows affected by the query or returned as data.
+	RowsCount int `json:"rowsCount"`
+	// ErrorMessage if the query wasn't successful, this field contains the
+	// error message.
+	ErrorMessage string `json:"error,omitempty"`
+}
+
+// RunQuery tool function used to execute queries on databases.
+func (s *Server) RunQuery(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	uri, err := request.RequireString(queryToolDatabaseParam)
+	if err != nil {
+		return s.wrapErrorResult(ctx, trace.Wrap(err))
+	}
+
+	sql, err := request.RequireString(queryToolQueryParam)
+	if err != nil {
+		return s.wrapErrorResult(ctx, trace.Wrap(err))
+	}
+
+	db, err := s.getDatabase(uri)
+	if err != nil {
+		return s.wrapErrorResult(ctx, err)
+	}
+
+	// TODO(gabrielcorado): ensure the connection used is consistent for the
+	// session, making most of its queries to be present in a single audit
+	// session/recording.
+	rows, err := db.pool.Query(ctx, sql)
+	if err != nil {
+		return s.wrapErrorResult(ctx, err)
+	}
+
+	// Returned rows are being closed by this function.
+	result, err := buildQueryResult(rows)
+	if err != nil {
+		return s.wrapErrorResult(ctx, err)
+	}
+
+	return mcp.NewToolResultText(result), nil
+}
+
+func (s *Server) wrapErrorResult(ctx context.Context, toolErr error) (*mcp.CallToolResult, error) {
+	s.logger.ErrorContext(ctx, "error while querying database", "error", toolErr)
+	out, err := json.Marshal(RunQueryResult{ErrorMessage: dbmcp.FormatErrorMessage(toolErr).Error()})
+	return mcp.NewToolResultError(string(out)), trace.Wrap(err)
+}
+
+// buildQueryResult takes a the response from pgx and converts into a JSON
+// format (which will be returned to LLMs).
+func buildQueryResult(rows pgx.Rows) (string, error) {
+	// Just ensure the rows is always closed. It is safe if this is called
+	// multiple times.
+	defer rows.Close()
+
+	var data []map[string]any
+	columns := rows.FieldDescriptions()
+
+	for rows.Next() {
+		values, err := rows.Values()
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+
+		item := make(map[string]any, len(values))
+		for i, v := range values {
+			item[columns[i].Name] = v
+		}
+
+		data = append(data, item)
+	}
+
+	// Close the rows to finish consuming it. Depending on the its type
+	// we can only collect the command tag after rows is closed.
+	rows.Close()
+	commandTag := rows.CommandTag()
+
+	// Initialize the slice so the resulting JSON will have an empty array
+	// instead of null.
+	if len(data) == 0 && commandTag.Select() {
+		data = []map[string]any{}
+	}
+
+	out, err := json.Marshal(RunQueryResult{
+		Data:      data,
+		RowsCount: int(commandTag.RowsAffected()),
+	})
+	return string(out), trace.Wrap(err)
+}
+
+func (s *Server) getDatabase(uri string) (*database, error) {
+	if !clientmcp.IsDatabaseResourceURI(uri) {
+		return nil, dbmcp.WrongDatabaseURIFormatError
+	}
+
+	db, ok := s.databases[uri]
+	if !ok {
+		return nil, dbmcp.DatabaseNotFoundError
+	}
+
+	return db, nil
+}
+
+func buildConnConfig(db *dbmcp.Database) (*pgxpool.Config, error) {
+	// No need to provide a valid address here as the Lookup and DialContext
+	// will handle the connection.
+	config, err := pgxpool.ParseConfig("postgres://")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config.MaxConnIdleTime = connectionIdleTime
+	config.MaxConns = int32(maxConnections)
+
+	config.ConnConfig.LookupFunc = func(ctx context.Context, host string) ([]string, error) {
+		return db.LookupFunc(ctx, host)
+	}
+	config.ConnConfig.DialFunc = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		return db.DialContextFunc(ctx, network, addr)
+	}
+
+	config.ConnConfig.User = db.DatabaseUser
+	config.ConnConfig.Database = db.DatabaseName
+	config.ConnConfig.ConnectTimeout = defaults.DatabaseConnectTimeout
+	config.ConnConfig.RuntimeParams = map[string]string{
+		applicationNameParamName: applicationNameParamValue,
+	}
+	config.ConnConfig.TLSConfig = nil
+	// Use simple protocol to have a closer behavior to DB REPL and psql.
+	//
+	// This also avoids each query being prepared, binded and executed, reducing
+	// the amount of audit events per query executed.
+	config.ConnConfig.DefaultQueryExecMode = pgx.QueryExecModeSimpleProtocol
+	return config, nil
+}
+
+const (
+	// queryToolDatabaseParam is the name of the database URI param name from
+	// query tool.
+	queryToolDatabaseParam = "database"
+	// queryToolQueryParam is the name of the query param name from query tool.
+	queryToolQueryParam = "query"
+
+	// applicationNameParamName defines the application name parameter name.
+	//
+	// https://www.postgresql.org/docs/17/libpq-connect.html#LIBPQ-CONNECT-APPLICATION-NAME
+	applicationNameParamName = "application_name"
+	// applicationNameParamValue defines the application name parameter value.
+	applicationNameParamValue = "teleport-mcp"
+	// connectionIdleTime is the max connection idle time before it gets closed
+	// automatically.
+	connectionIdleTime = 1 * time.Minute
+	// maxConnections defines the max number of concurrent connections the pool
+	// can have.
+	//
+	// Given the current MCP usage, the clients will most likely do one query at
+	// time, even on multiple sessions.
+	maxConnections = 1
+)
diff --git a/lib/client/db/postgres/mcp/mcp_test.go b/lib/client/db/postgres/mcp/mcp_test.go
new file mode 100644
index 0000000000000..de15092a7a15a
--- /dev/null
+++ b/lib/client/db/postgres/mcp/mcp_test.go
@@ -0,0 +1,225 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	dbmcp "github.com/gravitational/teleport/lib/client/db/mcp"
+	clientmcp "github.com/gravitational/teleport/lib/client/mcp"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils/listener"
+)
+
+func TestFormatResult(t *testing.T) {
+	for name, tc := range map[string]struct {
+		rows           pgx.Rows
+		expectedResult string
+	}{
+		"query results": {
+			rows:           newMockRows("SELECT 2", []string{"name", "age"}, [][]any{{"Alice", 30}, {"Bob", 31}}),
+			expectedResult: `{"data":[{"age":30,"name":"Alice"},{"age":31,"name":"Bob"}],"rowsCount":2}`,
+		},
+		"empty query results": {
+			rows:           newMockRows("SELECT 0", []string{}, [][]any{}),
+			expectedResult: `{"data":[],"rowsCount":0}`,
+		},
+		"non-data results": {
+			rows:           newMockRows("INSERT 1", []string{}, [][]any{}),
+			expectedResult: `{"data":null,"rowsCount":1}`,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			res, err := buildQueryResult(tc.rows)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedResult, res)
+		})
+	}
+}
+
+func TestFormatErrors(t *testing.T) {
+	// Dummy listener that always drop connections.
+	listener := listener.NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			_ = conn.Close()
+		}
+	}()
+
+	dbName := "local"
+	db, err := types.NewDatabaseV3(types.Metadata{
+		Name:   dbName,
+		Labels: map[string]string{"env": "test"},
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      "localhost:5432",
+	})
+	require.NoError(t, err)
+	dbURI := clientmcp.NewDatabaseResourceURI("root", dbName).WithoutParams().String()
+
+	for name, tc := range map[string]struct {
+		databaseURI        string
+		databases          []*dbmcp.Database
+		expectErrorMessage require.ValueAssertionFunc
+	}{
+		"database not found": {
+			databaseURI: "teleport://clusters/root/databases/not-found",
+			expectErrorMessage: func(tt require.TestingT, i1 interface{}, i2 ...interface{}) {
+				require.Equal(t, dbmcp.DatabaseNotFoundError.Error(), i1)
+			},
+		},
+		"malformed database uri": {
+			databaseURI: "not-found",
+			expectErrorMessage: func(tt require.TestingT, i1 interface{}, i2 ...interface{}) {
+				require.Equal(t, dbmcp.WrongDatabaseURIFormatError.Error(), i1)
+			},
+		},
+		"local proxy rejects connection": {
+			databaseURI: dbURI,
+			databases: []*dbmcp.Database{
+				&dbmcp.Database{
+					DB:           db,
+					ClusterName:  "root",
+					DatabaseUser: "postgres",
+					DatabaseName: "postgres",
+					LookupFunc: func(_ context.Context, _ string) (addrs []string, err error) {
+						return []string{"memory"}, nil
+					},
+					DialContextFunc: listener.DialContext,
+				},
+			},
+			expectErrorMessage: func(tt require.TestingT, i1 interface{}, i2 ...interface{}) {
+				require.Equal(t, dbmcp.LocalProxyConnectionErrorMessage, i1)
+			},
+		},
+		"relogin error": {
+			databaseURI: dbURI,
+			databases: []*dbmcp.Database{
+				&dbmcp.Database{
+					DB:           db,
+					ClusterName:  "root",
+					DatabaseUser: "postgres",
+					DatabaseName: "postgres",
+					LookupFunc: func(_ context.Context, _ string) (addrs []string, err error) {
+						return []string{"memory"}, nil
+					},
+					DialContextFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+						return nil, client.ErrClientCredentialsHaveExpired
+					},
+				},
+			},
+			expectErrorMessage: func(tt require.TestingT, i1 any, i2 ...any) {
+				require.Equal(t, clientmcp.ReloginRequiredErrorMessage, i1)
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			logger := slog.New(slog.DiscardHandler)
+			rootServer := dbmcp.NewRootServer(logger)
+			srv, err := NewServer(t.Context(), &dbmcp.NewServerConfig{
+				Logger:     logger,
+				RootServer: rootServer,
+				Databases:  tc.databases,
+			})
+			require.NoError(t, err)
+			t.Cleanup(func() { srv.Close(t.Context()) })
+
+			pgSrv := srv.(*Server)
+			req := mcp.CallToolRequest{}
+			req.Params.Arguments = map[string]any{
+				queryToolDatabaseParam: tc.databaseURI,
+				queryToolQueryParam:    "SELECT 1",
+			}
+			runResult, err := pgSrv.RunQuery(t.Context(), req)
+			require.NoError(t, err)
+
+			require.True(t, runResult.IsError)
+			require.Len(t, runResult.Content, 1)
+			require.IsType(t, mcp.TextContent{}, runResult.Content[0])
+
+			content := runResult.Content[0].(mcp.TextContent)
+			var res RunQueryResult
+			require.NoError(t, json.Unmarshal([]byte(content.Text), &res), "expected result to be in JSON format")
+			require.Empty(t, res.Data)
+			tc.expectErrorMessage(t, res.ErrorMessage)
+		})
+	}
+}
+
+func newMockRows(commandTag string, fields []string, rows [][]any) pgx.Rows {
+	var fds []pgconn.FieldDescription
+	for _, fieldName := range fields {
+		fds = append(fds, pgconn.FieldDescription{Name: fieldName})
+	}
+	return &mockRows{
+		commandTag:   commandTag,
+		descriptions: fds,
+		rows:         rows,
+	}
+}
+
+type mockRows struct {
+	pgx.Rows
+
+	started bool
+	cursor  int
+
+	commandTag   string
+	descriptions []pgconn.FieldDescription
+	rows         [][]any
+}
+
+func (mr *mockRows) FieldDescriptions() []pgconn.FieldDescription {
+	return mr.descriptions
+}
+
+func (mr *mockRows) Next() bool {
+	if !mr.started {
+		mr.started = true
+		return len(mr.rows) > 0
+	}
+
+	mr.cursor += 1
+	return len(mr.rows) > mr.cursor
+}
+
+func (mr *mockRows) Values() ([]any, error) {
+	return mr.rows[mr.cursor], nil
+}
+
+func (mr *mockRows) CommandTag() pgconn.CommandTag {
+	return pgconn.NewCommandTag(mr.commandTag)
+}
+
+func (mr *mockRows) Close() {}
diff --git a/lib/client/db/postgres/repl/commands.go b/lib/client/db/postgres/repl/commands.go
index 07d2faf7a02aa..6613b37e35149 100644
--- a/lib/client/db/postgres/repl/commands.go
+++ b/lib/client/db/postgres/repl/commands.go
@@ -18,19 +18,20 @@ package repl
 
 import (
 	"fmt"
+	"maps"
+	"slices"
 	"strings"
 
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/asciitable"
 )
 
 // processCommand receives a command call and return the reply and if the
 // command terminates the session.
 func (r *REPL) processCommand(line string) (string, bool) {
-	cmdStr, args, _ := strings.Cut(strings.TrimPrefix(line, commandPrefix), " ")
+	cmdStr, args, _ := strings.Cut(strings.TrimPrefix(strings.TrimSpace(line), commandPrefix), " ")
 	cmd, ok := r.commands[cmdStr]
 	if !ok {
-		return "Unknown command. Try \\? to show the list of supported commands." + lineBreak, false
+		return fmt.Sprintf("Unknown command %q. Try \\? to show the list of supported commands.", cmdStr) + lineBreak, false
 	}
 
 	return cmd.ExecFunc(r, args)
@@ -71,19 +72,19 @@ func initCommands() map[string]*command {
 		"teleport": {
 			Type:        commandTypeGeneral,
 			Description: "Show Teleport interactive shell information, such as execution limitations.",
-			ExecFunc: func(_ *REPL, _ string) (string, bool) {
+			ExecFunc: func(r *REPL, _ string) (string, bool) {
 				// Formats limitiations in a dash list. Example:
 				// - hello
 				//   multi line
 				// - another item
 				var limitations strings.Builder
 				for _, l := range descriptiveLimitations {
-					limitations.WriteString("- " + strings.Join(strings.Split(l, "\n"), "\n  ") + lineBreak)
+					limitations.WriteString(fmt.Sprintf("- %s\n", strings.ReplaceAll(l, lineBreak, lineBreak+"  ")))
 				}
 
 				return fmt.Sprintf(
 					"Teleport PostgreSQL interactive shell (v%s)\n\nLimitations: \n%s",
-					teleport.Version,
+					r.teleportVersion,
 					limitations.String(),
 				), false
 			},
@@ -93,20 +94,23 @@ func initCommands() map[string]*command {
 			Description: "Show the list of supported commands.",
 			ExecFunc: func(r *REPL, _ string) (string, bool) {
 				typesTable := make(map[commandType]*asciitable.Table)
-				for cmdStr, cmd := range r.commands {
+				for _, cmdName := range slices.Sorted(maps.Keys(r.commands)) {
+					cmd := r.commands[cmdName]
 					if _, ok := typesTable[cmd.Type]; !ok {
 						table := asciitable.MakeHeadlessTable(2)
 						typesTable[cmd.Type] = &table
 					}
 
-					typesTable[cmd.Type].AddRow([]string{"\\" + cmdStr, cmd.Description})
+					typesTable[cmd.Type].AddRow([]string{"\\" + cmdName, cmd.Description})
 				}
 
 				var res strings.Builder
-				for cmdType, output := range typesTable {
+				for i, cmdType := range slices.Sorted(maps.Keys(typesTable)) {
 					res.WriteString(string(cmdType) + lineBreak)
-					output.AsBuffer().WriteTo(&res)
-					res.WriteString(lineBreak)
+					typesTable[cmdType].AsBuffer().WriteTo(&res)
+					if i < len(typesTable)-1 {
+						res.WriteString(lineBreak)
+					}
 				}
 
 				return res.String(), false
@@ -116,7 +120,7 @@ func initCommands() map[string]*command {
 			Type:        commandTypeConnection,
 			Description: "Display information about the current session, like user, and database instance.",
 			ExecFunc: func(r *REPL, _ string) (string, bool) {
-				return fmt.Sprintf("Connected to %q instance at %q database as %q user.", r.route.ServiceName, r.route.Database, r.route.Username), false
+				return fmt.Sprintf("Connected to %q instance at %q database as %q user.\n", r.route.ServiceName, r.route.Database, r.route.Username), false
 			},
 		},
 	}
diff --git a/lib/client/db/postgres/repl/commands_test.go b/lib/client/db/postgres/repl/commands_test.go
index 2a974d470601f..6c4e1ef98f8bb 100644
--- a/lib/client/db/postgres/repl/commands_test.go
+++ b/lib/client/db/postgres/repl/commands_test.go
@@ -17,21 +17,20 @@
 package repl
 
 import (
-	"context"
-	"io"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
 	clientproto "github.com/gravitational/teleport/api/client/proto"
+	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 )
 
 func TestCommandExecution(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+	ctx := t.Context()
 
 	for name, tt := range map[string]struct {
 		line          string
@@ -50,79 +49,33 @@ func TestCommandExecution(t *testing.T) {
 		"empty command":                                {line: "\\", expectUnknown: true},
 	} {
 		t.Run(name, func(t *testing.T) {
-			commandArgsChan := make(chan string, 1)
-			instance, tc := StartWithServer(t, ctx, WithSkipREPLRun())
-			ctx, cancel := context.WithCancel(ctx)
-			defer cancel()
-
-			runErrChan := make(chan error)
-			go func() {
-				runErrChan <- instance.Run(ctx)
-			}()
-
-			// Consume the REPL banner.
-			_ = readUntilNextLead(t, tc)
-
+			repl, err := New(ctx, &dbrepl.NewREPLConfig{Client: nil, ServerConn: nil, Route: clientproto.RouteToDatabase{}})
+			require.NoError(t, err)
+			instance := repl.(*REPL)
 			// Reset available commands and add a test command so we can assert
 			// the command execution flow without relying in commands
 			// implementation or test server capabilities.
 			instance.commands = map[string]*command{
 				"test": {
-					ExecFunc: func(r *REPL, args string) (string, bool) {
-						commandArgsChan <- args
+					ExecFunc: func(_ *REPL, args string) (string, bool) {
+						assert.Equal(t, tt.expectedArgs, args)
 						return tt.commandResult, tt.commandExit
 					},
 				},
 			}
-
-			writeLine(t, tc, tt.line)
+			reply, shouldExit := instance.processCommand(tt.line)
 			if tt.expectUnknown {
-				reply := readUntilNextLead(t, tc)
-				require.True(t, strings.HasPrefix(strings.ToLower(reply), "unknown command"))
-				return
-			}
-
-			select {
-			case args := <-commandArgsChan:
-				require.Equal(t, tt.expectedArgs, args)
-			case <-time.After(time.Second):
-				require.Fail(t, "expected to command args from test server but got nothing")
-			}
-
-			// When the command exits, the REPL and the connections will be
-			// closed.
-			if tt.commandExit {
-				require.EventuallyWithT(t, func(t *assert.CollectT) {
-					var buf []byte
-					_, err := tc.conn.Read(buf[0:])
-					assert.ErrorIs(t, err, io.EOF)
-				}, 5*time.Second, time.Millisecond)
-
-				select {
-				case err := <-runErrChan:
-					require.NoError(t, err, "expected the REPL instance exit gracefully")
-				case <-time.After(5 * time.Second):
-					require.Fail(t, "expected REPL run to terminate but got nothing")
-				}
-				return
-			}
-
-			reply := readUntilNextLead(t, tc)
-			require.Equal(t, tt.commandResult, reply)
-
-			// Terminate the REPL run session and wait for the Run results.
-			cancel()
-			select {
-			case err := <-runErrChan:
-				require.ErrorIs(t, err, context.Canceled, "expected the REPL instance to finish running with error due to cancelation")
-			case <-time.After(5 * time.Second):
-				require.Fail(t, "expected REPL run to terminate but got nothing")
+				require.True(t, strings.HasPrefix(reply, "Unknown command"))
+			} else {
+				require.Equal(t, tt.commandResult, reply)
 			}
+			require.Equal(t, tt.commandExit, shouldExit)
 		})
 	}
 }
 
 func TestCommands(t *testing.T) {
+	t.Parallel()
 	availableCmds := initCommands()
 	for cmdName, tc := range map[string]struct {
 		repl               *REPL
@@ -132,7 +85,8 @@ func TestCommands(t *testing.T) {
 	}{
 		"q": {expectExit: true},
 		"teleport": {
-			assertCommandReply: func(t require.TestingT, val interface{}, _ ...interface{}) {
+			repl: &REPL{teleportVersion: teleport.Version},
+			assertCommandReply: func(t require.TestingT, val any, _ ...any) {
 				require.Contains(t, val, teleport.Version, "expected \\teleport command to include current Teleport version")
 			},
 		},
diff --git a/lib/client/db/postgres/repl/fixtures/all-data-types.sql b/lib/client/db/postgres/repl/fixtures/all-data-types.sql
new file mode 100644
index 0000000000000..fbd22a70f74be
--- /dev/null
+++ b/lib/client/db/postgres/repl/fixtures/all-data-types.sql
@@ -0,0 +1,200 @@
+-- Reset schema and set search path
+DROP SCHEMA IF EXISTS all_pg_types CASCADE;
+CREATE SCHEMA all_pg_types;
+SET search_path = all_pg_types, public;
+
+-- user-defined examples to cover ENUM, DOMAIN, COMPOSITE
+CREATE TYPE my_enum AS ENUM ('foo','bar');
+CREATE DOMAIN zip5 AS text CHECK (char_length(VALUE) = 5);
+CREATE TYPE coord AS (x int, y int);
+
+-- table with one column per type
+CREATE TABLE all_types_demo (
+  -- numeric
+  t_smallint           smallint,
+  t_integer            integer,
+  t_bigint             bigint,
+  t_decimal            decimal(10,2),
+  t_numeric            numeric(8,3),
+  t_real               real,
+  t_double             double precision,
+  t_money              money,
+
+  -- boolean
+  t_boolean            boolean,
+
+  -- character
+  t_char               char(3),
+  t_varchar            varchar(10),
+  t_text               text,
+
+  -- binary
+  t_bytea              bytea,
+
+  -- date/time
+  t_date               date,
+  t_time               time,                      -- without time zone
+  t_timetz             time with time zone,
+  t_timestamp          timestamp,                 -- without time zone
+  t_timestamptz        timestamp with time zone,
+  t_interval           interval,
+
+  -- UUID/XML/JSON
+  t_uuid               uuid,
+  t_xml                xml,
+  t_json               json,
+  t_jsonb              jsonb,
+
+  -- bit strings
+  t_bit                bit(8),
+  t_varbit             bit varying(10),
+
+  -- network
+  t_cidr               cidr,
+  t_inet               inet,
+  t_macaddr            macaddr,
+  t_macaddr8           macaddr8,
+
+  -- geometric
+  t_point              point,
+  t_line               line,
+  t_lseg               lseg,
+  t_box                box,
+  t_path_open          path,
+  t_polygon            polygon,
+  t_circle             circle,
+
+  -- text search
+  t_tsvector           tsvector,
+  t_tsquery            tsquery,
+
+  -- arrays
+  t_int_array          integer[],
+  t_text_array         text[],
+
+  -- ranges
+  t_int4range          int4range,
+  t_int8range          int8range,
+  t_numrange           numrange,
+  t_tsrange            tsrange,
+  t_tstzrange          tstzrange,
+  t_daterange          daterange,
+
+  -- system/OID-family
+  t_oid                oid,
+  t_regclass           regclass,
+  t_regtype            regtype,
+  t_pg_lsn             pg_lsn,
+  t_txid_snapshot      txid_snapshot,
+
+  -- user-defined
+  t_enum               my_enum,
+  t_domain             zip5,
+  t_composite          coord
+);
+
+INSERT INTO all_types_demo VALUES (
+  -- numeric
+  32767,
+  2147483647,
+  9223372036854775807,
+  12345.67,
+  123.456,
+  3.14,
+  2.7182818284,
+  12.34::money,
+
+  -- boolean
+  TRUE,
+
+  -- character
+  'abc',
+  'abcdefghij',
+  'hello',
+
+  -- binary (hex bytea)
+  '\xDEADBEEF',
+
+  -- date/time
+  DATE '2024-07-09',
+  TIME '12:34:56',
+  TIME '12:34:56+02',
+  TIMESTAMP '2024-07-09 12:34:56',
+  TIMESTAMPTZ '2024-07-09 12:34:56+00',
+  INTERVAL '1 year 2 mons 3 days 4 hours 5 mins 6 secs',
+
+  -- UUID/XML/JSON
+  'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+  '<root attr="1">text</root>'::xml,
+  '{"x":1,"y":2}',
+  '{"a":true,"b":[1,2,3]}'::jsonb,
+
+  -- bit strings
+  B'10101010',
+  B'10101'::varbit,
+
+  -- Network
+  CIDR '10.0.0.0/8',
+  INET '192.168.1.5/24',
+  MACADDR '08:00:2b:01:02:03',
+  MACADDR8 '08:00:2b:01:02:03:04:05',
+
+  -- geometric
+  POINT '(1,2)',
+  LINE  '{1,2,3}',
+  LSEG  '[(0,0),(1,1)]',
+  BOX   '((0,0),(1,1))',
+  PATH  '[(0,0),(1,1),(1,0)]',    -- open path
+  POLYGON '((0,0),(1,0),(1,1),(0,1))',
+  CIRCLE '<(1,2),3>',
+
+  -- text search
+  to_tsvector('simple','a b c'),
+  to_tsquery('simple','a & b'),
+
+  -- arrays
+  ARRAY[1,2,3],
+  ARRAY['a','b','c'],
+
+  -- ranges
+  INT4RANGE(1, 10, '[]'),
+  INT8RANGE(100, 1000, '[]'),
+  NUMRANGE(1.5, 2.5, '[)'),
+  TSRANGE(TIMESTAMP '2024-07-09 12:00:00', TIMESTAMP '2024-07-09 13:00:00', '[)'),
+  TSTZRANGE(TIMESTAMPTZ '2024-07-09 12:00:00+00', TIMESTAMPTZ '2024-07-09 13:00:00+00', '[)'),
+  DATERANGE(DATE '2024-07-01', DATE '2024-07-31', '[]'),
+
+  -- system/OID-family
+  12345::oid,
+  'pg_type'::regclass,
+  'int4'::regtype,
+  '0/16B6C50'::pg_lsn,
+  '100:200:150'::txid_snapshot,
+
+  -- user-defined
+  'foo',
+  '12345',
+  ROW(1,2)::coord
+);
+
+SELECT t_smallint, t_integer, t_bigint FROM all_types_demo;
+SELECT t_decimal, t_numeric, t_real FROM all_types_demo;
+SELECT t_double, t_money, t_boolean FROM all_types_demo;
+SELECT t_char, t_varchar, t_text FROM all_types_demo;
+SELECT t_bytea, t_date, t_time FROM all_types_demo;
+SELECT t_timetz, t_timestamp, t_timestamptz FROM all_types_demo;
+SELECT t_interval, t_uuid, t_xml FROM all_types_demo;
+SELECT t_json, t_jsonb, t_bit FROM all_types_demo;
+SELECT t_varbit, t_cidr, t_inet FROM all_types_demo;
+SELECT t_macaddr, t_macaddr8, t_point FROM all_types_demo;
+SELECT t_line, t_lseg, t_box FROM all_types_demo;
+SELECT t_path_open, t_polygon, t_circle FROM all_types_demo;
+SELECT t_tsvector, t_tsquery, t_int_array FROM all_types_demo;
+SELECT t_text_array, t_int4range, t_int8range FROM all_types_demo;
+SELECT t_numrange, t_tsrange, t_tstzrange FROM all_types_demo;
+SELECT t_daterange, t_oid, t_regclass FROM all_types_demo;
+SELECT t_regtype, t_pg_lsn, t_txid_snapshot FROM all_types_demo;
+SELECT t_enum, t_domain, t_composite FROM all_types_demo;
+
+SET search_path = public;
+DROP SCHEMA all_pg_types CASCADE;
diff --git a/lib/client/db/postgres/repl/fixtures/commands.sql b/lib/client/db/postgres/repl/fixtures/commands.sql
new file mode 100644
index 0000000000000..7518de8707343
--- /dev/null
+++ b/lib/client/db/postgres/repl/fixtures/commands.sql
@@ -0,0 +1,3 @@
+\?
+\teleport
+\session
diff --git a/lib/client/db/postgres/repl/fixtures/ddl.sql b/lib/client/db/postgres/repl/fixtures/ddl.sql
new file mode 100644
index 0000000000000..dc8a0b75810fd
--- /dev/null
+++ b/lib/client/db/postgres/repl/fixtures/ddl.sql
@@ -0,0 +1,120 @@
+-- suppress notices for test output consistency
+SET client_min_messages = warning;
+
+-- reset the playground schema
+DROP SCHEMA IF EXISTS test_ddl_db CASCADE;
+CREATE SCHEMA test_ddl_db;
+SET search_path = test_ddl_db, public;
+DROP SCHEMA IF EXISTS test_ddl CASCADE;
+CREATE SCHEMA test_ddl;
+SET search_path = test_ddl, public;
+
+-- tables
+CREATE TABLE test_table (
+  id INT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  value TEXT NOT NULL,
+  note  VARCHAR(100) DEFAULT NULL
+);
+
+-- views
+CREATE VIEW test_view AS
+SELECT id, value
+FROM test_table;
+
+-- functions
+CREATE OR REPLACE FUNCTION test_func(x INT)
+RETURNS INT
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT x * 2
+$$;
+
+-- procedures
+CREATE OR REPLACE PROCEDURE test_proc()
+LANGUAGE sql
+AS $$
+  INSERT INTO test_table(value) VALUES ('from proc')
+$$;
+
+CALL test_proc();
+
+-- triggers (which use a function)
+-- this fails to parse because delimiters are in the dollar quoted string
+-- TODO(gavin): fix the parser to handle delimiter quotation properly
+CREATE OR REPLACE FUNCTION test_trigger_before_insert_fn()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  NEW.value := UPPER(NEW.value);
+  RETURN NEW;
+END; $$;
+
+-- for now, create the func with all delimiters on one line
+CREATE OR REPLACE FUNCTION test_trigger_before_insert_fn()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN NEW.value := UPPER(NEW.value); RETURN NEW; END; $$;
+
+CREATE TRIGGER test_trigger_before_insert
+BEFORE INSERT ON test_table
+FOR EACH ROW
+EXECUTE FUNCTION test_trigger_before_insert_fn();
+
+CALL test_proc();
+
+-- manage roles
+DROP ROLE IF EXISTS test_role;
+CREATE ROLE test_role;
+DROP ROLE test_role;
+
+DROP ROLE IF EXISTS test_user;
+CREATE ROLE test_user NOLOGIN PASSWORD 'some password';
+ALTER ROLE test_user VALID UNTIL '1970-01-01';
+DROP ROLE test_user;
+
+-- table alteration
+ALTER TABLE test_table ADD COLUMN note2 VARCHAR(100) DEFAULT 'LLAMA';
+
+-- comments on objects
+COMMENT ON FUNCTION test_func(INT) IS 'Test function';
+COMMENT ON PROCEDURE test_proc() IS 'Test procedure';
+
+-- rename a table and query it
+ALTER TABLE test_table RENAME TO test_table_renamed;
+SELECT * FROM test_table_renamed;
+
+-- rename it back
+ALTER TABLE test_table_renamed RENAME TO test_table;
+SELECT * FROM test_table;
+
+-- insert a bunch of dummy values with a wide column in the middle
+-- (checking column alignment formatting)
+INSERT INTO test_table (value)
+WITH RECURSIVE numbers(n) AS (
+  SELECT 4
+  UNION ALL
+  SELECT n + 1 FROM numbers WHERE n < 120
+)
+SELECT 'especially wide column' AS value
+UNION ALL
+SELECT 'value_' || n FROM numbers;
+SELECT * FROM test_table;
+
+-- intentionally cause an error: no such foreign server
+ALTER SERVER test_server OPTIONS (SET host '127.0.0.1');
+
+-- test dropping some other kinds of objects
+DROP TRIGGER IF EXISTS test_trigger_before_insert ON test_table;
+DROP FUNCTION IF EXISTS test_trigger_before_insert_fn();
+DROP PROCEDURE test_proc;
+DROP VIEW test_view;
+
+TRUNCATE TABLE test_table;
+DROP TABLE test_table;
+
+-- clean up: reset the search path and drop the schema
+SET search_path = public;
+DROP SCHEMA test_ddl_db CASCADE;
diff --git a/lib/client/db/postgres/repl/fixtures/literals.sql b/lib/client/db/postgres/repl/fixtures/literals.sql
new file mode 100644
index 0000000000000..b33149d14eae1
--- /dev/null
+++ b/lib/client/db/postgres/repl/fixtures/literals.sql
@@ -0,0 +1,91 @@
+-- simple literals
+SELECT 'thing';
+SELECT 'thing'; ;;
+
+-- multiline query
+SELECT
+1
+;
+
+-- query with special characters
+SELECT 'special_chars_!@#$%^&*()';
+
+-- leading and trailing whitespace
+   SELECT 1;
+
+-- multiline with excessive whitespace
+   SELECT
+   1
+   ;
+
+-- with command in the middle treats the command as a literal
+SELECT \? 1;
+
+-- multiline with command in the middle treats the command as a literal
+SELECT
+\?
+1;
+
+-- multiline with command in the last line is not supported
+SELECT
+1
+\?;
+
+SELECT 1, -1, 1.24, -1.24, 'foo', NULL, 'null' ORDER BY 1;
+
+-- aliases
+SELECT
+    1     AS "unsigned int",
+    -1    AS "negative int",
+    1.24  AS "float",
+    -1.24 AS "negative float",
+    'foo' AS "string",
+    NULL  AS "actual NULL",
+    'null' AS "string null"
+    ORDER BY 1;
+
+SELECT '1'::text AS "multiple rows of literals"
+UNION
+SELECT '-1'
+UNION
+SELECT '1.24'
+UNION
+SELECT '-1.24'
+UNION
+SELECT 'foo'
+UNION
+SELECT NULL
+UNION
+SELECT 'null' ORDER BY 1;
+
+-- multiline strings
+SELECT 'a
+b
+c' AS "multiline-string";
+
+/* foo bar */
+SELECT 1;
+/* foo bar */ SELECT /* baz */ 42;
+
+SELECT '$$1$$';
+SELECT '$$;$$';
+
+SHOW search_path;
+EXPLAIN select 1;
+
+-- TODO(gavin): fix the parser to handle trailing comments
+SELECT 'thing'; ;;  -- a trailing space and comment
+
+;
+
+-- this fails to parse because delimiters are in the string literal
+-- TODO(gavin): fix the parser to handle delimiter quotation properly
+SELECT 'a
+    ;
+    b
+    ;
+c' AS "multiline with delimiters";
+
+-- TODO(gavin): fix the parser to handle command/query mixed usage (delimited by semicolons)
+-- with command following a statement
+SELECT 1;\?
diff --git a/lib/client/db/postgres/repl/repl.go b/lib/client/db/postgres/repl/repl.go
index 66c8cb0f046f2..57d34492ec6b2 100644
--- a/lib/client/db/postgres/repl/repl.go
+++ b/lib/client/db/postgres/repl/repl.go
@@ -17,12 +17,14 @@
 package repl
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"io"
 	"net"
 	"strings"
+	"text/tabwriter"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -31,18 +33,21 @@ import (
 
 	"github.com/gravitational/teleport"
 	clientproto "github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/asciitable"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 	"github.com/gravitational/teleport/lib/defaults"
 )
 
 type REPL struct {
+	*term.Terminal
+
 	connConfig *pgconn.Config
 	client     io.ReadWriteCloser
-	serverConn net.Conn
 	route      clientproto.RouteToDatabase
-	term       *term.Terminal
 	commands   map[string]*command
+
+	// teleportVersion is used in golden tests to fake the current Teleport
+	// version and prevent test failures when the real version is incremented.
+	teleportVersion string
 }
 
 func New(_ context.Context, cfg *dbrepl.NewREPLConfig) (dbrepl.REPLInstance, error) {
@@ -57,6 +62,11 @@ func New(_ context.Context, cfg *dbrepl.NewREPLConfig) (dbrepl.REPLInstance, err
 		applicationNameParamName: applicationNameParamValue,
 	}
 	config.TLSConfig = nil
+	// disable fallbacks because our fake dialer returns the same connection
+	// each time and pgconn closes a conn on error before using a fallback,
+	// which obscures the actual error and instead shows:
+	// "failed to write startup message (use of closed network connection)"
+	config.Fallbacks = nil
 
 	// Provide a lookup function to avoid having the hostname placeholder to
 	// resolve into something else. Note that the returned value won't be used.
@@ -68,12 +78,12 @@ func New(_ context.Context, cfg *dbrepl.NewREPLConfig) (dbrepl.REPLInstance, err
 	}
 
 	return &REPL{
-		connConfig: config,
-		client:     cfg.Client,
-		serverConn: cfg.ServerConn,
-		route:      cfg.Route,
-		term:       term.NewTerminal(cfg.Client, ""),
-		commands:   initCommands(),
+		Terminal:        term.NewTerminal(cfg.Client, ""),
+		connConfig:      config,
+		client:          cfg.Client,
+		route:           cfg.Route,
+		commands:        initCommands(),
+		teleportVersion: teleport.Version,
 	}, nil
 }
 
@@ -95,15 +105,9 @@ func (r *REPL) Run(ctx context.Context) error {
 	// our case r.client). On this goroutine we only watch for context
 	// cancelation and close the connection. This will unblocks all terminal
 	// reads/writes.
-	ctxCancelCh := make(chan struct{})
-	defer close(ctxCancelCh)
-	go func() {
-		select {
-		case <-ctx.Done():
-			_ = r.client.Close()
-		case <-ctxCancelCh:
-		}
-	}()
+	defer context.AfterFunc(ctx, func() {
+		_ = r.client.Close()
+	})()
 
 	if err := r.presentBanner(); err != nil {
 		return trace.Wrap(err)
@@ -116,26 +120,37 @@ func (r *REPL) Run(ctx context.Context) error {
 
 	lead := lineLeading(r.route)
 	leadSpacing := strings.Repeat(" ", len(lead))
-	r.term.SetPrompt(lineBreak + lead)
 
 	for {
-		line, err := r.term.ReadLine()
+		if readingMultiline {
+			r.Terminal.SetPrompt(leadSpacing)
+		} else {
+			r.Terminal.SetPrompt(lead)
+		}
+		line, err := r.Terminal.ReadLine()
 		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
 			return trace.Wrap(formatTermError(ctx, err))
 		}
 
 		// ReadLine should always return the line without trailing line breaks,
 		// but we still require to remove trailing and leading spaces.
 		line = strings.TrimSpace(line)
+		if !readingMultiline && (len(line) == 0 || strings.HasPrefix(line, commentPrefix)) {
+			continue
+		}
 
-		var reply string
 		switch {
 		case strings.HasPrefix(line, commandPrefix) && !readingMultiline:
-			var exit bool
-			reply, exit = r.processCommand(line)
+			reply, exit := r.processCommand(line)
 			if exit {
 				return nil
 			}
+			if _, err := r.Terminal.Write([]byte(reply + lineBreak)); err != nil {
+				return trace.Wrap(formatTermError(ctx, err))
+			}
 		case strings.HasSuffix(line, executionRequestSuffix):
 			var query string
 			if readingMultiline {
@@ -148,9 +163,14 @@ func (r *REPL) Run(ctx context.Context) error {
 			// Reset multiline state.
 			multilineAcc.Reset()
 			readingMultiline = false
-			r.term.SetPrompt(lineBreak + lead)
 
-			reply = formatResult(pgConn.Exec(ctx, query).ReadAll()) + lineBreak
+			resReader := pgConn.Exec(ctx, query)
+			if err := streamResults(resReader, newTabWriter(r.Terminal)); err != nil {
+				return trace.Wrap(formatTermError(ctx, err))
+			}
+			if _, err := r.Terminal.Write([]byte(lineBreak + lineBreak)); err != nil {
+				return trace.Wrap(formatTermError(ctx, err))
+			}
 		default:
 			// If there wasn't a specific execution, we assume the input is
 			// multi-line. In this case, we need to accumulate the contents.
@@ -163,15 +183,6 @@ func (r *REPL) Run(ctx context.Context) error {
 
 			readingMultiline = true
 			multilineAcc.WriteString(line)
-			r.term.SetPrompt(leadSpacing)
-		}
-
-		if reply == "" {
-			continue
-		}
-
-		if _, err := r.term.Write([]byte(reply)); err != nil {
-			return trace.Wrap(formatTermError(ctx, err))
 		}
 	}
 }
@@ -189,60 +200,108 @@ func formatTermError(ctx context.Context, err error) error {
 
 func (r *REPL) presentBanner() error {
 	_, err := fmt.Fprintf(
-		r.term,
+		r.Terminal,
 		`Teleport PostgreSQL interactive shell (v%s)
 Connected to %q instance as %q user.
-Type \? for help.`,
-		teleport.Version,
+Type \? for help.
+
+`,
+		r.teleportVersion,
 		r.route.GetServiceName(),
 		r.route.GetUsername())
 	return trace.Wrap(err)
 }
 
-// formatResult formats a pgconn.Exec result.
-func formatResult(results []*pgconn.Result, err error) string {
-	if err != nil {
-		return errorReplyPrefix + err.Error()
+func newTabWriter(w io.Writer) *tabwriter.Writer {
+	return tabwriter.NewWriter(w, 1, 0, 1, ' ', 0)
+}
+
+// bufferedWriter buffers all Write calls until Flush is called.
+// Clients must call Flush when done writing.
+type bufferedWriter interface {
+	io.Writer
+	Flush() error
+}
+
+func streamResults(mrr *pgconn.MultiResultReader, writer bufferedWriter) error {
+	defer mrr.Close()
+	defer writer.Flush()
+
+	var resultCount int
+	for mrr.NextResult() {
+		resultCount++
+		if resultCount > 1 {
+			// add an extra line break to separate multiple results
+			if _, err := writer.Write([]byte(lineBreak + lineBreak)); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		if err := streamResult(mrr.ResultReader(), writer); err != nil {
+			return trace.Wrap(err)
+		}
 	}
+	if err := mrr.Close(); err != nil {
+		errReply := errorReplyPrefix + err.Error()
+		if _, err := writer.Write([]byte(errReply)); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
 
-	var (
-		sb         strings.Builder
-		resultsLen = len(results)
+func streamResult(rr *pgconn.ResultReader, writer bufferedWriter) error {
+	const (
+		columnSep       = "\t|\t"
+		maxBufferedRows = 100
 	)
-	for i, res := range results {
-		if !res.CommandTag.Select() {
-			return res.CommandTag.String()
+	defer rr.Close()
+	defer writer.Flush()
+
+	if len(rr.FieldDescriptions()) == 0 {
+		// ignore the error, it will bubble up to the multi result reader Close
+		cmdTag, _ := rr.Close()
+		if _, err := writer.Write([]byte(cmdTag.String())); err != nil {
+			return trace.Wrap(err)
 		}
+		// zero field descriptions implies zero rows will be returned
+		// https://www.postgresql.org/docs/current/protocol-flow.html
+		return nil
+	}
 
-		// build columns
-		var columns []string
-		for _, fd := range res.FieldDescriptions {
-			columns = append(columns, string(fd.Name))
-		}
+	columns := make([]string, 0, len(rr.FieldDescriptions()))
+	dashes := make([]string, 0, cap(columns))
+	for _, fd := range rr.FieldDescriptions() {
+		columns = append(columns, string(fd.Name))
+		dashes = append(dashes, strings.Repeat("-", max(len(fd.Name))))
+	}
 
-		table := asciitable.MakeTable(columns)
-		for _, row := range res.Rows {
-			rowData := make([]string, len(columns))
-			for i, data := range row {
-				// The PostgreSQL package is responsible for transforming the
-				// row data into a readable format.
-				rowData[i] = string(data)
-			}
+	headerLine := strings.Join(columns, columnSep) + lineBreak
+	sepLine := strings.Join(dashes, columnSep) + lineBreak
+	if _, err := writer.Write([]byte(headerLine + sepLine)); err != nil {
+		return trace.Wrap(err)
+	}
 
-			table.AddRow(rowData)
+	var rowCount int
+	for rr.NextRow() {
+		rowCount++
+		row := bytes.Join(rr.Values(), []byte(columnSep))
+		if _, err := writer.Write(row); err != nil {
+			return trace.Wrap(err)
 		}
-
-		table.AsBuffer().WriteTo(&sb)
-		sb.WriteString(rowsText(len(res.Rows)))
-
-		// Add line breaks to separate results. Except the last result, which
-		// will have line breaks added later in the reply.
-		if i != resultsLen-1 {
-			sb.WriteString(lineBreak + lineBreak)
+		if rowCount%maxBufferedRows == 0 {
+			if err := writer.Flush(); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		if _, err := writer.Write([]byte(lineBreak)); err != nil {
+			return trace.Wrap(err)
 		}
 	}
 
-	return sb.String()
+	if _, err := writer.Write([]byte(rowsText(rowCount))); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
 }
 
 func lineLeading(route clientproto.RouteToDatabase) string {
@@ -265,7 +324,7 @@ const (
 	// requirement.
 	hostnamePlaceholder = "repl"
 	// lineBreak represents a line break on the REPL.
-	lineBreak = "\r\n"
+	lineBreak = "\n"
 	// commandPrefix is the prefix that identifies a REPL command.
 	commandPrefix = "\\"
 	// executionRequestSuffix is the suffix that indicates the input must be
@@ -273,6 +332,8 @@ const (
 	executionRequestSuffix = ";"
 	// errorReplyPrefix is the prefix presented when there is a execution error.
 	errorReplyPrefix = "ERR "
+	// commentPrefix is the prefix for a single line comment
+	commentPrefix = "--"
 )
 
 const (
@@ -300,4 +361,6 @@ See https://www.postgresql.org/docs/17/protocol-flow.html#PROTOCOL-FLOW-TERMINAT
 	//
 	// This shortcut filtered out by the WebUI key handler.
 	"Pressing CTRL-C will have no effect in this shell.",
+	"All escaped delimiters (semicolons) must appear on the same line as the unescaped query delimiter.",
+	"Commands cannot be used in the middle of a query.",
 }
diff --git a/lib/client/db/postgres/repl/repl_test.go b/lib/client/db/postgres/repl/repl_test.go
index 58edeb7947443..c6d379c24640e 100644
--- a/lib/client/db/postgres/repl/repl_test.go
+++ b/lib/client/db/postgres/repl/repl_test.go
@@ -17,115 +17,63 @@
 package repl
 
 import (
+	"bytes"
+	"cmp"
 	"context"
+	"crypto/rand"
+	_ "embed"
 	"errors"
 	"io"
 	"net"
+	"os"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/gravitational/trace"
-	"github.com/jackc/pgconn"
+	"github.com/jackc/pgerrcode"
 	"github.com/jackc/pgproto3/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/modules/postgres"
 
 	clientproto "github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/client/db/postgres/repl/testdata"
+	apiutils "github.com/gravitational/teleport/api/utils"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 )
 
-func TestStart(t *testing.T) {
-	ctx := context.Background()
-	_, tc := StartWithServer(t, ctx)
+const crlf = "\r\n"
 
-	// Consume the REPL banner.
-	_ = readUntilNextLead(t, tc)
+var testSrv *testServer
+var testSrvMu sync.Mutex
 
-	writeLine(t, tc, singleRowQuery)
-	singleRowQueryResult := readUntilNextLead(t, tc)
-	if golden.ShouldSet() {
-		golden.SetNamed(t, "single", []byte(singleRowQueryResult))
-	}
-	require.Equal(t, string(golden.GetNamed(t, "single")), singleRowQueryResult)
-
-	writeLine(t, tc, multiRowQuery)
-	multiRowQueryResult := readUntilNextLead(t, tc)
-	if golden.ShouldSet() {
-		golden.SetNamed(t, "multi", []byte(multiRowQueryResult))
-	}
-	require.Equal(t, string(golden.GetNamed(t, "multi")), multiRowQueryResult)
-
-	writeLine(t, tc, errorQuery)
-	errorQueryResult := readUntilNextLead(t, tc)
-	if golden.ShouldSet() {
-		golden.SetNamed(t, "err", []byte(errorQueryResult))
-	}
-	require.Equal(t, string(golden.GetNamed(t, "err")), errorQueryResult)
-
-	writeLine(t, tc, dataTypesQuery)
-	dataTypeQueryResult := readUntilNextLead(t, tc)
-	if golden.ShouldSet() {
-		golden.SetNamed(t, "data_type", []byte(dataTypeQueryResult))
-	}
-	require.Equal(t, string(golden.GetNamed(t, "data_type")), dataTypeQueryResult)
+func TestMain(m *testing.M) {
+	code := m.Run()
 
-	writeLine(t, tc, multiQuery)
-	multiQueryResult := readUntilNextLead(t, tc)
-	if golden.ShouldSet() {
-		golden.SetNamed(t, "multiquery", []byte(multiQueryResult))
-	}
-	require.Equal(t, string(golden.GetNamed(t, "multiquery")), multiQueryResult)
-}
-
-// TestQuery given some input lines, the REPL should execute the expected
-// query on the PostgreSQL test server.
-func TestQuery(t *testing.T) {
-	ctx := context.Background()
-	_, tc := StartWithServer(t, ctx, WithCustomQueries())
-
-	// Consume the REPL banner.
-	_ = readUntilNextLead(t, tc)
-
-	for name, tt := range map[string]struct {
-		lines         []string
-		expectedQuery string
-	}{
-		"query":                     {lines: []string{"SELECT 1;"}, expectedQuery: "SELECT 1;"},
-		"query multiple semicolons": {lines: []string{"SELECT 1; ;;"}, expectedQuery: "SELECT 1; ;;"},
-		"query multiple semicolons with trailing space": {lines: []string{"SELECT 1; ;;  "}, expectedQuery: "SELECT 1; ;;"},
-		"multiline query":                     {lines: []string{"SELECT", "1", ";"}, expectedQuery: "SELECT\r\n1\r\n;"},
-		"malformatted":                        {lines: []string{"SELECT err;"}, expectedQuery: "SELECT err;"},
-		"query with special characters":       {lines: []string{"SELECT 'special_chars_!@#$%^&*()';"}, expectedQuery: "SELECT 'special_chars_!@#$%^&*()';"},
-		"leading and trailing whitespace":     {lines: []string{"   SELECT 1;   "}, expectedQuery: "SELECT 1;"},
-		"multiline with excessive whitespace": {lines: []string{"   SELECT", "    1", "     ;"}, expectedQuery: "SELECT\r\n1\r\n;"},
-		// Commands should only be executed if they are at the beginning of the
-		// first line.
-		"with command in the middle":              {lines: []string{"SELECT \\d 1;"}, expectedQuery: "SELECT \\d 1;"},
-		"multiline with command in the middle":    {lines: []string{"SELECT", "\\d", ";"}, expectedQuery: "SELECT\r\n\\d\r\n;"},
-		"multiline with command in the last line": {lines: []string{"SELECT", "1", "\\d;"}, expectedQuery: "SELECT\r\n1\r\n\\d;"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			for _, line := range tt.lines {
-				writeLine(t, tc, line)
-			}
-
-			select {
-			case query := <-tc.QueryChan():
-				require.Equal(t, tt.expectedQuery, query)
-			case <-time.After(5 * time.Second):
-				require.Fail(t, "expected to receive query but got nothing")
-			}
+	// The "Ryuk" container will cleanup everything anyhow, but only after 10s
+	// without any client connections.
+	// We can speed up container cleanup after a -count=N run, e.g., a flaky
+	// test detector run, by terminating them immediately after tests have run.
+	// https://github.com/testcontainers/moby-ryuk
+	testSrvMu.Lock()
+	defer testSrvMu.Unlock()
+	// if we don't clean up after 10 seconds, RYUK will get them anyway.
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
 
-			// Always expect a query reply from the server.
-			_ = readUntilNextLead(t, tc)
-		})
+	// ignore errors, Ryuk or worst case VM termination in CI will deal with it
+	if testSrv != nil {
+		_ = testSrv.container.Terminate(ctx)
 	}
+	os.Exit(code)
 }
 
 func TestClose(t *testing.T) {
+	t.Parallel()
 	for name, tt := range map[string]struct {
 		closeFunc              func(tc *testCtx, cancelCtx context.CancelFunc)
 		expectTerminateMessage bool
@@ -144,7 +92,7 @@ func TestClose(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			ctx, cancelFunc := context.WithCancel(context.Background())
+			ctx, cancelFunc := context.WithCancel(t.Context())
 			defer cancelFunc()
 
 			_, tc := StartWithServer(t, ctx)
@@ -176,49 +124,36 @@ func TestClose(t *testing.T) {
 }
 
 func TestConnectionError(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	instance, tc := StartWithServer(t, ctx, WithSkipREPLRun())
-
-	// Force the server to be closed
-	tc.CloseServer()
-
-	err := instance.Run(ctx)
-	require.Error(t, err)
-	require.True(t, trace.IsConnectionProblem(err), "expected run to be a connection error but got %T", err)
-}
-
-func writeLine(t *testing.T, c *testCtx, line string) {
-	t.Helper()
-	data := []byte(line + lineBreak)
-
-	// When writing to the connection, the terminal emulator always writes back.
-	// If we don't consume those bytes, it will block the ReadLine call (as
-	// we're net.Pipe).
-	go func(conn net.Conn) {
-		buf := make([]byte, len(data))
-		// We need to consume any additional replies made by the terminal
-		// emulator until we consume the line contents.
-		for {
-			n, err := conn.Read(buf[0:])
-			if err != nil {
-				t.Logf("Error while terminal reply on write: %s", err)
-				break
-			}
-
-			if string(buf[:n]) == line+lineBreak {
-				break
-			}
-		}
-	}(c.conn)
-
-	// Given that the test connections are piped a problem with the reader side
-	// would lead into blocking writing. To avoid this scenario we're using
-	// the Eventually just to ensure a timeout on writing into the connections.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := c.conn.Write(data)
-		assert.NoError(t, err)
-	}, 5*time.Second, time.Millisecond, "expected to write into the connection successfully")
+	t.Parallel()
+	tests := []struct {
+		desc            string
+		modifyTestCtx   func(tc *testCtx)
+		wantErrContains string
+	}{
+		{
+			desc: "closed server",
+			// Force the server to be closed
+			modifyTestCtx:   func(tc *testCtx) { tc.CloseServer() },
+			wantErrContains: "failed to write startup message",
+		},
+		{
+			desc:            "access denied",
+			modifyTestCtx:   func(tc *testCtx) { tc.denyAccess = true },
+			wantErrContains: "server error (ERROR: access to db denied (SQLSTATE 28000))",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			ctx := t.Context()
+			instance, tc := StartWithServer(t, ctx, WithSkipREPLRun())
+
+			test.modifyTestCtx(tc)
+			err := instance.Run(ctx)
+			require.Error(t, err)
+			require.True(t, trace.IsConnectionProblem(err), "expected run to be a connection error but got %T", err)
+			require.ErrorContains(t, err, test.wantErrContains)
+		})
+	}
 }
 
 // readUntilNextLead reads the contents from the client connection until we
@@ -229,7 +164,7 @@ func readUntilNextLead(t *testing.T, c *testCtx) string {
 	var acc strings.Builder
 	for {
 		line := readLine(t, c)
-		if strings.HasPrefix(line, lineBreak+lineLeading(c.route)) {
+		if strings.HasPrefix(line, lineLeading(c.route)) {
 			break
 		}
 
@@ -249,16 +184,21 @@ func readLine(t *testing.T, c *testCtx) string {
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		var err error
 		n, err = c.conn.Read(buf[0:])
-		assert.NoError(t, err)
-		assert.Greater(t, n, 0)
+		require.NoError(t, err)
+		require.Greater(t, n, 0)
 	}, 5*time.Second, time.Millisecond)
 	return string(buf[:n])
 }
 
+// testCtx implements a minimal stub Postgres backend that can only PostgreSQL
+// messages for startup and termination. Tests that require support for other
+// message types should use a real Postgres server running in a test container.
 type testCtx struct {
 	cfg        *testCtxConfig
 	ctx        context.Context
 	cancelFunc context.CancelFunc
+	// denyAccess controls whether access is denied during authentication
+	denyAccess bool
 
 	// conn is the connection used by tests to read/write from/to the REPL.
 	conn net.Conn
@@ -274,31 +214,16 @@ type testCtx struct {
 	pgClient      *pgproto3.Backend
 	errChan       chan error
 	terminateChan chan struct{}
-	// queryChan handling custom queries is enabled the queries received by the
-	// test server will be sent to this channel.
-	queryChan chan string
 }
 
 type testCtxConfig struct {
 	// skipREPLRun when set to true the REPL instance won't be executed.
 	skipREPLRun bool
-	// handleCustomQueries when set to true the PostgreSQL test server will
-	// accept any query sent and reply with success.
-	handleCustomQueries bool
 }
 
 // testCtxOption represents a testCtx option.
 type testCtxOption func(*testCtxConfig)
 
-// WithCustomQueries enables sending custom queries to the PostgreSQL test
-// server. Note that when it is enabled, callers must consume the queries on the
-// query channel.
-func WithCustomQueries() testCtxOption {
-	return func(cfg *testCtxConfig) {
-		cfg.handleCustomQueries = true
-	}
-}
-
 // WithSkipREPLRun disables automatically running the REPL instance.
 func WithSkipREPLRun() testCtxOption {
 	return func(cfg *testCtxConfig) {
@@ -331,7 +256,6 @@ func StartWithServer(t *testing.T, ctx context.Context, opts ...testCtxOption) (
 		pgClient:      client,
 		errChan:       make(chan error, 1),
 		terminateChan: make(chan struct{}),
-		queryChan:     make(chan string),
 	}
 
 	t.Cleanup(func() {
@@ -377,12 +301,7 @@ func StartWithServer(t *testing.T, ctx context.Context, opts ...testCtxOption) (
 		})
 	}
 
-	r, _ := instance.(*REPL)
-	return r, tc
-}
-
-func (tc *testCtx) QueryChan() chan string {
-	return tc.queryChan
+	return instance.(*REPL), tc
 }
 
 func (tc *testCtx) CloseServer() {
@@ -399,11 +318,24 @@ func (tc *testCtx) processMessages() error {
 
 	startupMessage, err := tc.pgClient.ReceiveStartupMessage()
 	if err != nil {
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
 		return trace.Wrap(err)
 	}
 
 	switch msg := startupMessage.(type) {
 	case *pgproto3.StartupMessage:
+		if tc.denyAccess {
+			if err := tc.pgClient.Send(&pgproto3.ErrorResponse{
+				Severity: "ERROR",
+				Code:     pgerrcode.InvalidAuthorizationSpecification,
+				Message:  "access to db denied",
+			}); err != nil {
+				return trace.Wrap(err)
+			}
+			return nil
+		}
 		// Accept auth and send ready for query.
 		if err := tc.pgClient.Send(&pgproto3.AuthenticationOk{}); err != nil {
 			return trace.Wrap(err)
@@ -436,81 +368,172 @@ func (tc *testCtx) processMessages() error {
 			return trace.Wrap(err)
 		}
 
-		var messages []pgproto3.BackendMessage
 		switch msg := message.(type) {
 		case *pgproto3.Query:
-			if tc.cfg.handleCustomQueries {
-				select {
-				case tc.queryChan <- msg.String:
-					messages = []pgproto3.BackendMessage{
-						&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("INSERT 0 1")},
-						&pgproto3.ReadyForQuery{},
-					}
-				case <-tc.ctx.Done():
-					return trace.Wrap(tc.ctx.Err())
-				}
-
-				break // breaks the message switch case.
-			}
-
-			switch msg.String {
-			case singleRowQuery:
-				messages = []pgproto3.BackendMessage{
-					&pgproto3.RowDescription{Fields: []pgproto3.FieldDescription{{Name: []byte("id")}, {Name: []byte("email")}}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("1"), []byte("alice@example.com")}},
-					&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("SELECT")},
-					&pgproto3.ReadyForQuery{},
-				}
-			case multiRowQuery:
-				messages = []pgproto3.BackendMessage{
-					&pgproto3.RowDescription{Fields: []pgproto3.FieldDescription{{Name: []byte("id")}, {Name: []byte("email")}}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("1"), []byte("alice@example.com")}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("2"), []byte("bob@example.com")}},
-					&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("SELECT")},
-					&pgproto3.ReadyForQuery{},
-				}
-			case dataTypesQuery:
-				messages = testdata.TestDataQueryResult
-			case multiQuery:
-				messages = []pgproto3.BackendMessage{
-					&pgproto3.RowDescription{Fields: []pgproto3.FieldDescription{{Name: []byte("?column?")}}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("1")}},
-					&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("SELECT")},
-					&pgproto3.RowDescription{Fields: []pgproto3.FieldDescription{{Name: []byte("id")}, {Name: []byte("email")}}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("1"), []byte("alice@example.com")}},
-					&pgproto3.DataRow{Values: [][]byte{[]byte("2"), []byte("bob@example.com")}},
-					&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("SELECT")},
-					&pgproto3.ReadyForQuery{},
-				}
-			case errorQuery:
-				messages = []pgproto3.BackendMessage{
-					&pgproto3.ErrorResponse{Severity: "ERROR", Code: "42703", Message: "error"},
-					&pgproto3.ReadyForQuery{},
-				}
-			default:
-				return trace.BadParameter("unsupported query %q", msg.String)
-
-			}
+			return trace.BadParameter("stub postgres server does not support queries, use a testcontainer to test query %q", msg.String)
 		case *pgproto3.Terminate:
 			close(tc.terminateChan)
 			return nil
 		default:
 			return trace.BadParameter("unsupported message %#v", message)
 		}
+	}
+}
 
-		for _, message := range messages {
-			err := tc.pgClient.Send(message)
-			if err != nil {
-				return trace.Wrap(err)
+func TestREPL(t *testing.T) {
+	if run, _ := apiutils.ParseBool(os.Getenv("ENABLE_TESTCONTAINERS")); !run {
+		// Docker Hub rate limits cause failures in CI, this test is disabled until we can set up an alternative to Docker Hub
+		t.Skip("Test disabled in CI. Enable it by setting env variable ENABLE_TESTCONTAINERS")
+	}
+	testSrv := newTestServer(t)
+	route := clientproto.RouteToDatabase{
+		ServiceName: "postgres-test-container",
+		Protocol:    defaults.ProtocolPostgres,
+		Username:    testSrv.username,
+		Database:    testSrv.database,
+	}
+	for _, test := range []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "ddl",
+			input: testDDL,
+		},
+		{
+			name:  "all data types",
+			input: testDataTypes,
+		},
+		{
+			name:  "literals",
+			input: testLiterals,
+		},
+		{
+			name:  "commands",
+			input: testCommands,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := t.Context()
+			input := strings.ReplaceAll(test.input, "\n", crlf) + crlf
+			recorder := newRecordingClient(io.NopCloser(strings.NewReader(input)))
+
+			t.Logf("test server: %v", testSrv.hostPort())
+			testREPL, err := New(ctx, &dbrepl.NewREPLConfig{
+				Client:     recorder,
+				ServerConn: testSrv.connectTCP(t, 5*time.Second),
+				Route:      route,
+			})
+			require.NoError(t, err)
+			testREPL.(*REPL).connConfig.Password = testSrv.password
+			testREPL.(*REPL).teleportVersion = "19.0.0-dev"
+			err = testREPL.Run(t.Context())
+			require.NoError(t, err)
+			if golden.ShouldSet() {
+				golden.SetNamed(t, "", recorder.buf.Bytes())
 			}
-		}
+			require.Equal(t, string(golden.GetNamed(t, "")), recorder.buf.String())
+		})
 	}
 }
 
-const (
-	singleRowQuery = "SELECT * FROM users LIMIT 1;"
-	multiRowQuery  = "SELECT * FROM users;"
-	multiQuery     = "SELECT 1; SELECT * FROM users;"
-	dataTypesQuery = "SELECT * FROM test_data_types;"
-	errorQuery     = "SELECT err;"
+var (
+	//go:embed fixtures/ddl.sql
+	testDDL string
+	//go:embed fixtures/all-data-types.sql
+	testDataTypes string
+	//go:embed fixtures/literals.sql
+	testLiterals string
+	//go:embed fixtures/commands.sql
+	testCommands string
 )
+
+func newTestServer(t *testing.T) *testServer {
+	t.Helper()
+	ctx := t.Context()
+
+	reuseName := cmp.Or(os.Getenv("POSTGRES_TEST_SERVER_REUSE_CONTAINER_BY_NAME"), "default-postgres-test-server")
+	testSrvMu.Lock()
+	// hold the lock for the entire func to avoid parallel container requests
+	defer testSrvMu.Unlock()
+	if testSrv != nil {
+		return testSrv
+	}
+
+	user := cmp.Or(os.Getenv("POSTGRES_TEST_SERVER_USER"), "postgres")
+	db := cmp.Or(os.Getenv("POSTGRES_TEST_SERVER_DB"), "postgres")
+	pass := cmp.Or(os.Getenv("POSTGRES_TEST_SERVER_PASS"), rand.Text())
+	opts := []testcontainers.ContainerCustomizer{
+		postgres.WithDatabase(db),
+		postgres.WithUsername(user),
+		postgres.WithPassword(pass),
+		testcontainers.WithReuseByName(reuseName),
+		postgres.BasicWaitStrategies(),
+		postgres.WithSQLDriver("pgx"),
+	}
+
+	// postgres 17
+	const img = "postgres@sha256:feff5b24fedd610975a1f5e743c51a4b360437f4dc3a11acf740dcd708f413f6"
+	container, err := postgres.Run(ctx, img, opts...)
+	require.NoError(t, err)
+
+	host, err := container.Host(ctx)
+	require.NoError(t, err)
+
+	mappedPort, err := container.MappedPort(ctx, "5432/tcp")
+	require.NoError(t, err)
+
+	srv := &testServer{
+		container: container,
+		host:      host,
+		port:      mappedPort.Port(),
+		username:  user,
+		password:  pass,
+		database:  db,
+	}
+	testSrv = srv
+	return srv
+}
+
+// testServer is a PostgreSQL server for tests.
+type testServer struct {
+	// container is the container hosting the server.
+	container testcontainers.Container
+	// host is the PostgreSQL connection endpoint host.
+	host string
+	// port is the PostgreSQL connection endpoint port.
+	port string
+	// username is the database superuser.
+	username string
+	// password is the database superuser password.
+	password string
+	// database is a database schema provisioned in the database.
+	database string
+}
+
+// hostPort returns the server host:port.
+func (s *testServer) hostPort() string {
+	return net.JoinHostPort(s.host, s.port)
+}
+
+func (s *testServer) connectTCP(t *testing.T, timeout time.Duration) net.Conn {
+	t.Helper()
+	conn, err := net.DialTimeout("tcp", s.hostPort(), timeout)
+	require.NoError(t, err)
+	return conn
+}
+
+func newRecordingClient(reader io.ReadCloser) *recordingClient {
+	var buf bytes.Buffer
+	return &recordingClient{
+		ReadCloser: reader,
+		Writer:     &buf,
+		buf:        &buf,
+	}
+}
+
+type recordingClient struct {
+	io.ReadCloser
+	io.Writer
+	buf *bytes.Buffer
+}
diff --git a/lib/client/db/postgres/repl/testdata/TestREPL/all_data_types.golden b/lib/client/db/postgres/repl/testdata/TestREPL/all_data_types.golden
new file mode 100644
index 0000000000000..30f621ade701f
--- /dev/null
+++ b/lib/client/db/postgres/repl/testdata/TestREPL/all_data_types.golden
@@ -0,0 +1,322 @@
+Teleport PostgreSQL interactive shell (v19.0.0-dev)
+Connected to "postgres-test-container" instance as "postgres" user.
+Type \? for help.
+
+postgres=> -- Reset schema and set search path
+postgres=> DROP SCHEMA IF EXISTS all_pg_types CASCADE;
+DROP SCHEMA
+
+postgres=> CREATE SCHEMA all_pg_types;
+CREATE SCHEMA
+
+postgres=> SET search_path = all_pg_types, public;
+SET
+
+postgres=> 
+postgres=> -- user-defined examples to cover ENUM, DOMAIN, COMPOSITE
+postgres=> CREATE TYPE my_enum AS ENUM ('foo','bar');
+CREATE TYPE
+
+postgres=> 
+postgres=> CREATE DOMAIN zip5 AS text CHECK (char_length(VALUE) = 5);
+CREATE DOMAIN
+
+postgres=> CREATE TYPE coord AS (x int, y int);
+CREATE TYPE
+
+postgres=> 
+postgres=> -- table with one column per type
+postgres=> CREATE TABLE all_types_demo (
+             -- numeric
+             t_smallint           smallint,
+             t_integer            integer,
+             t_bigint             bigint,
+             t_decimal            decimal(10,2),
+             t_numeric            numeric(8,3),
+             t_real               real,
+             t_double             double precision,
+             t_money              money,
+           
+             -- boolean
+             t_boolean            boolean,
+           
+             -- character
+             t_char               char(3),
+             t_varchar            varchar(10),
+             t_text               text,
+           
+             -- binary
+             t_bytea              bytea,
+           
+             -- date/time
+             t_date               date,
+             t_time               time,                      -- without time zon
+e
+             t_timetz             time with time zone,
+             t_timestamp          timestamp,                 -- without time zon
+e
+             t_timestamptz        timestamp with time zone,
+             t_interval           interval,
+           
+             -- UUID/XML/JSON
+             t_uuid               uuid,
+             t_xml                xml,
+             t_json               json,
+             t_jsonb              jsonb,
+           
+             -- bit strings
+             t_bit                bit(8),
+             t_varbit             bit varying(10),
+           
+             -- network
+             t_cidr               cidr,
+             t_inet               inet,
+             t_macaddr            macaddr,
+             t_macaddr8           macaddr8,
+           
+             -- geometric
+             t_point              point,
+             t_line               line,
+             t_lseg               lseg,
+             t_box                box,
+             t_path_open          path,
+             t_polygon            polygon,
+             t_circle             circle,
+           
+             -- text search
+             t_tsvector           tsvector,
+             t_tsquery            tsquery,
+           
+             -- arrays
+             t_int_array          integer[],
+             t_text_array         text[],
+           
+             -- ranges
+             t_int4range          int4range,
+             t_int8range          int8range,
+             t_numrange           numrange,
+             t_tsrange            tsrange,
+             t_tstzrange          tstzrange,
+             t_daterange          daterange,
+           
+             -- system/OID-family
+             t_oid                oid,
+             t_regclass           regclass,
+             t_regtype            regtype,
+             t_pg_lsn             pg_lsn,
+             t_txid_snapshot      txid_snapshot,
+           
+             -- user-defined
+             t_enum               my_enum,
+             t_domain             zip5,
+             t_composite          coord
+           );
+CREATE TABLE
+
+postgres=> 
+postgres=> INSERT INTO all_types_demo VALUES (
+             -- numeric
+             32767,
+             2147483647,
+             9223372036854775807,
+             12345.67,
+             123.456,
+             3.14,
+             2.7182818284,
+             12.34::money,
+           
+             -- boolean
+             TRUE,
+           
+             -- character
+             'abc',
+             'abcdefghij',
+             'hello',
+           
+           
+             -- binary (hex bytea)
+             '\xDEADBEEF',
+           
+             -- date/time
+             DATE '2024-07-09',
+             TIME '12:34:56',
+             TIME '12:34:56+02',
+             TIMESTAMP '2024-07-09 12:34:56',
+             TIMESTAMPTZ '2024-07-09 12:34:56+00',
+             INTERVAL '1 year 2 mons 3 days 4 hours 5 mins 6 secs',
+           
+             -- UUID/XML/JSON
+             'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+             '<root attr="1">text</root>'::xml,
+             '{"x":1,"y":2}',
+             '{"a":true,"b":[1,2,3]}'::jsonb,
+           
+             -- bit strings
+             B'10101010',
+             B'10101'::varbit,
+           
+             -- Network
+             CIDR '10.0.0.0/8',
+             INET '192.168.1.5/24',
+             MACADDR '08:00:2b:01:02:03',
+             MACADDR8 '08:00:2b:01:02:03:04:05',
+           
+             -- geometric
+             POINT '(1,2)',
+             LINE  '{1,2,3}',
+             LSEG  '[(0,0),(1,1)]',
+             BOX   '((0,0),(1,1))',
+             PATH  '[(0,0),(1,1),(1,0)]',    -- open path
+             POLYGON '((0,0),(1,0),(1,1),(0,1))',
+             CIRCLE '<(1,2),3>',
+           
+             -- text search
+             to_tsvector('simple','a b c'),
+             to_tsquery('simple','a & b'),
+           
+             -- arrays
+             ARRAY[1,2,3],
+             ARRAY['a','b','c'],
+           
+             -- ranges
+             INT4RANGE(1, 10, '[]'),
+             INT8RANGE(100, 1000, '[]'),
+             NUMRANGE(1.5, 2.5, '[)'),
+             TSRANGE(TIMESTAMP '2024-07-09 12:00:00', TIMESTAMP '2024-07-09 13:0
+0:00', '[)'),
+             TSTZRANGE(TIMESTAMPTZ '2024-07-09 12:00:00+00', TIMESTAMPTZ '2024-0
+7-09 13:00:00+00', '[)'),
+             DATERANGE(DATE '2024-07-01', DATE '2024-07-31', '[]'),
+           
+             -- system/OID-family
+             12345::oid,
+             'pg_type'::regclass,
+             'int4'::regtype,
+             '0/16B6C50'::pg_lsn,
+             '100:200:150'::txid_snapshot,
+           
+             -- user-defined
+             'foo',
+             '12345',
+             ROW(1,2)::coord
+           );
+INSERT 0 1
+
+postgres=> 
+postgres=> SELECT t_smallint, t_integer, t_bigint FROM all_types_demo;
+t_smallint | t_integer  | t_bigint
+---------- | ---------  | --------
+32767      | 2147483647 | 9223372036854775807
+(1 row)
+
+postgres=> SELECT t_decimal, t_numeric, t_real FROM all_types_demo;
+t_decimal | t_numeric | t_real
+--------- | --------- | ------
+12345.67  | 123.456   | 3.14
+(1 row)
+
+postgres=> SELECT t_double, t_money, t_boolean FROM all_types_demo;
+t_double     | t_money | t_boolean
+--------     | ------- | ---------
+2.7182818284 | $12.34  | t
+(1 row)
+
+postgres=> SELECT t_char, t_varchar, t_text FROM all_types_demo;
+t_char | t_varchar  | t_text
+------ | ---------  | ------
+abc    | abcdefghij | hello
+(1 row)
+
+postgres=> SELECT t_bytea, t_date, t_time FROM all_types_demo;
+t_bytea    | t_date     | t_time
+-------    | ------     | ------
+\xdeadbeef | 2024-07-09 | 12:34:56
+(1 row)
+
+postgres=> SELECT t_timetz, t_timestamp, t_timestamptz FROM all_types_demo;
+t_timetz    | t_timestamp         | t_timestamptz
+--------    | -----------         | -------------
+12:34:56+00 | 2024-07-09 12:34:56 | 2024-07-09 12:34:56+00
+(1 row)
+
+postgres=> SELECT t_interval, t_uuid, t_xml FROM all_types_demo;
+t_interval                    | t_uuid                               | t_xml
+----------                    | ------                               | -----
+1 year 2 mons 3 days 04:05:06 | a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11 | <root attr="1">text</root>
+(1 row)
+
+postgres=> SELECT t_json, t_jsonb, t_bit FROM all_types_demo;
+t_json        | t_jsonb                     | t_bit
+------        | -------                     | -----
+{"x":1,"y":2} | {"a": true, "b": [1, 2, 3]} | 10101010
+(1 row)
+
+postgres=> SELECT t_varbit, t_cidr, t_inet FROM all_types_demo;
+t_varbit | t_cidr     | t_inet
+-------- | ------     | ------
+10101    | 10.0.0.0/8 | 192.168.1.5/24
+(1 row)
+
+postgres=> SELECT t_macaddr, t_macaddr8, t_point FROM all_types_demo;
+t_macaddr         | t_macaddr8              | t_point
+---------         | ----------              | -------
+08:00:2b:01:02:03 | 08:00:2b:01:02:03:04:05 | (1,2)
+(1 row)
+
+postgres=> SELECT t_line, t_lseg, t_box FROM all_types_demo;
+t_line  | t_lseg        | t_box
+------  | ------        | -----
+{1,2,3} | [(0,0),(1,1)] | (1,1),(0,0)
+(1 row)
+
+postgres=> SELECT t_path_open, t_polygon, t_circle FROM all_types_demo;
+t_path_open         | t_polygon                 | t_circle
+-----------         | ---------                 | --------
+[(0,0),(1,1),(1,0)] | ((0,0),(1,0),(1,1),(0,1)) | <(1,2),3>
+(1 row)
+
+postgres=> SELECT t_tsvector, t_tsquery, t_int_array FROM all_types_demo;
+t_tsvector        | t_tsquery | t_int_array
+----------        | --------- | -----------
+'a':1 'b':2 'c':3 | 'a' & 'b' | {1,2,3}
+(1 row)
+
+postgres=> SELECT t_text_array, t_int4range, t_int8range FROM all_types_demo;
+t_text_array | t_int4range | t_int8range
+------------ | ----------- | -----------
+{a,b,c}      | [1,11)      | [100,1001)
+(1 row)
+
+postgres=> SELECT t_numrange, t_tsrange, t_tstzrange FROM all_types_demo;
+t_numrange | t_tsrange                                     | t_tstzrange
+---------- | ---------                                     | -----------
+[1.5,2.5)  | ["2024-07-09 12:00:00","2024-07-09 13:00:00") | ["2024-07-09 12:00:00+00","2024-07-09 13:00:00+00")
+(1 row)
+
+postgres=> SELECT t_daterange, t_oid, t_regclass FROM all_types_demo;
+t_daterange             | t_oid | t_regclass
+-----------             | ----- | ----------
+[2024-07-01,2024-08-01) | 12345 | pg_type
+(1 row)
+
+postgres=> SELECT t_regtype, t_pg_lsn, t_txid_snapshot FROM all_types_demo;
+t_regtype | t_pg_lsn  | t_txid_snapshot
+--------- | --------  | ---------------
+integer   | 0/16B6C50 | 100:200:150
+(1 row)
+
+postgres=> SELECT t_enum, t_domain, t_composite FROM all_types_demo;
+t_enum | t_domain | t_composite
+------ | -------- | -----------
+foo    | 12345    | (1,2)
+(1 row)
+
+postgres=> 
+postgres=> SET search_path = public;
+SET
+
+postgres=> DROP SCHEMA all_pg_types CASCADE;
+DROP SCHEMA
+
+postgres=> 
+postgres=> 
\ No newline at end of file
diff --git a/lib/client/db/postgres/repl/testdata/TestREPL/commands.golden b/lib/client/db/postgres/repl/testdata/TestREPL/commands.golden
new file mode 100644
index 0000000000000..9e4b048c031c1
--- /dev/null
+++ b/lib/client/db/postgres/repl/testdata/TestREPL/commands.golden
@@ -0,0 +1,31 @@
+Teleport PostgreSQL interactive shell (v19.0.0-dev)
+Connected to "postgres-test-container" instance as "postgres" user.
+Type \? for help.
+
+postgres=> \?
+Connection
+\session Display information about the current session, like user, and database instance. 
+
+General
+\?        Show the list of supported commands.                                        
+\q        Terminates the session.                                                     
+\teleport Show Teleport interactive shell information, such as execution limitations. 
+
+postgres=> \teleport
+Teleport PostgreSQL interactive shell (v19.0.0-dev)
+
+Limitations: 
+- Query cancellation is not supported. Once a query is sent, its execution
+  cannot be canceled. Note that Teleport sends a terminate message to the database
+  when the database session terminates. This flow doesn't guarantee that any
+  running queries will be canceled.
+  See https://www.postgresql.org/docs/17/protocol-flow.html#PROTOCOL-FLOW-TERMINATION for more details on the termination flow.
+- Pressing CTRL-C will have no effect in this shell.
+- All escaped delimiters (semicolons) must appear on the same line as the unescaped query delimiter.
+- Commands cannot be used in the middle of a query.
+
+postgres=> \session
+Connected to "postgres-test-container" instance at "postgres" database as "postgres" user.
+
+postgres=> 
+postgres=> 
\ No newline at end of file
diff --git a/lib/client/db/postgres/repl/testdata/TestREPL/ddl.golden b/lib/client/db/postgres/repl/testdata/TestREPL/ddl.golden
new file mode 100644
index 0000000000000..b10da343f93c8
--- /dev/null
+++ b/lib/client/db/postgres/repl/testdata/TestREPL/ddl.golden
@@ -0,0 +1,348 @@
+Teleport PostgreSQL interactive shell (v19.0.0-dev)
+Connected to "postgres-test-container" instance as "postgres" user.
+Type \? for help.
+
+postgres=> -- suppress notices for test output consistency
+postgres=> SET client_min_messages = warning;
+SET
+
+postgres=> 
+postgres=> -- reset the playground schema
+postgres=> DROP SCHEMA IF EXISTS test_ddl_db CASCADE;
+DROP SCHEMA
+
+postgres=> CREATE SCHEMA test_ddl_db;
+CREATE SCHEMA
+
+postgres=> SET search_path = test_ddl_db, public;
+SET
+
+postgres=> DROP SCHEMA IF EXISTS test_ddl CASCADE;
+DROP SCHEMA
+
+postgres=> CREATE SCHEMA test_ddl;
+CREATE SCHEMA
+
+postgres=> SET search_path = test_ddl, public;
+SET
+
+postgres=> 
+postgres=> -- tables
+postgres=> CREATE TABLE test_table (
+             id INT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+             value TEXT NOT NULL,
+             note  VARCHAR(100) DEFAULT NULL
+           );
+CREATE TABLE
+
+postgres=> 
+postgres=> -- views
+postgres=> CREATE VIEW test_view AS
+           SELECT id, value
+           FROM test_table;
+CREATE VIEW
+
+postgres=> 
+postgres=> -- functions
+postgres=> CREATE OR REPLACE FUNCTION test_func(x INT)
+           RETURNS INT
+           LANGUAGE sql
+           IMMUTABLE
+           AS $$
+             SELECT x * 2
+           $$;
+CREATE FUNCTION
+
+postgres=> 
+postgres=> -- procedures
+postgres=> CREATE OR REPLACE PROCEDURE test_proc()
+           LANGUAGE sql
+           AS $$
+             INSERT INTO test_table(value) VALUES ('from proc')
+           $$;
+CREATE PROCEDURE
+
+postgres=> 
+postgres=> CALL test_proc();
+CALL
+
+postgres=> 
+postgres=> -- triggers (which use a function)
+postgres=> -- this fails to parse because delimiters are in the dollar quoted st
+ring
+postgres=> -- TODO(gavin): fix the parser to handle delimiter quotation properly
+
+postgres=> CREATE OR REPLACE FUNCTION test_trigger_before_insert_fn()
+           RETURNS trigger
+           LANGUAGE plpgsql
+           AS $$
+           BEGIN
+             NEW.value := UPPER(NEW.value);
+ERR ERROR: unterminated dollar-quoted string at or near "$$
+BEGIN
+NEW.value := UPPER(NEW.value);" (SQLSTATE 42601)
+
+postgres=>   RETURN NEW;
+ERR ERROR: syntax error at or near "RETURN" (SQLSTATE 42601)
+
+postgres=> END; $$;
+ERR ERROR: unterminated dollar-quoted string at or near "$$;" (SQLSTATE 42601)
+
+postgres=> 
+postgres=> -- for now, create the func with all delimiters on one line
+postgres=> CREATE OR REPLACE FUNCTION test_trigger_before_insert_fn()
+           RETURNS trigger
+           LANGUAGE plpgsql
+           AS $$
+           BEGIN NEW.value := UPPER(NEW.value); RETURN NEW; END; $$;
+CREATE FUNCTION
+
+postgres=> 
+postgres=> CREATE TRIGGER test_trigger_before_insert
+           BEFORE INSERT ON test_table
+           FOR EACH ROW
+           EXECUTE FUNCTION test_trigger_before_insert_fn();
+CREATE TRIGGER
+
+postgres=> 
+postgres=> CALL test_proc();
+CALL
+
+postgres=> 
+postgres=> -- manage roles
+postgres=> DROP ROLE IF EXISTS test_role;
+DROP ROLE
+
+postgres=> CREATE ROLE test_role;
+CREATE ROLE
+
+postgres=> DROP ROLE test_role;
+DROP ROLE
+
+postgres=> 
+postgres=> DROP ROLE IF EXISTS test_user;
+DROP ROLE
+
+postgres=> CREATE ROLE test_user NOLOGIN PASSWORD 'some password';
+CREATE ROLE
+
+postgres=> ALTER ROLE test_user VALID UNTIL '1970-01-01';
+ALTER ROLE
+
+postgres=> DROP ROLE test_user;
+DROP ROLE
+
+postgres=> 
+postgres=> -- table alteration
+postgres=> ALTER TABLE test_table ADD COLUMN note2 VARCHAR(100) DEFAULT 'LLAMA';
+
+ALTER TABLE
+
+postgres=> 
+postgres=> -- comments on objects
+postgres=> COMMENT ON FUNCTION test_func(INT) IS 'Test function';
+COMMENT
+
+postgres=> COMMENT ON PROCEDURE test_proc() IS 'Test procedure';
+COMMENT
+
+postgres=> 
+postgres=> -- rename a table and query it
+postgres=> ALTER TABLE test_table RENAME TO test_table_renamed;
+ALTER TABLE
+
+postgres=> SELECT * FROM test_table_renamed;
+id | value     | note | note2
+-- | -----     | ---- | -----
+1  | from proc |      | LLAMA
+2  | FROM PROC |      | LLAMA
+(2 rows)
+
+postgres=> 
+postgres=> -- rename it back
+postgres=> ALTER TABLE test_table_renamed RENAME TO test_table;
+ALTER TABLE
+
+postgres=> SELECT * FROM test_table;
+id | value     | note | note2
+-- | -----     | ---- | -----
+1  | from proc |      | LLAMA
+2  | FROM PROC |      | LLAMA
+(2 rows)
+
+postgres=> 
+postgres=> 
+postgres=> -- insert a bunch of dummy values with a wide column in the middle
+postgres=> -- (checking column alignment formatting)
+postgres=> INSERT INTO test_table (value)
+           WITH RECURSIVE numbers(n) AS (
+             SELECT 4
+             UNION ALL
+             SELECT n + 1 FROM numbers WHERE n < 120
+           )
+           SELECT 'especially wide column' AS value
+           UNION ALL
+           SELECT 'value_' || n FROM numbers;
+INSERT 0 118
+
+postgres=> SELECT * FROM test_table;
+id  | value                  | note | note2
+--  | -----                  | ---- | -----
+1   | from proc              |      | LLAMA
+2   | FROM PROC              |      | LLAMA
+3   | ESPECIALLY WIDE COLUMN |      | LLAMA
+4   | VALUE_4                |      | LLAMA
+5   | VALUE_5                |      | LLAMA
+6   | VALUE_6                |      | LLAMA
+7   | VALUE_7                |      | LLAMA
+8   | VALUE_8                |      | LLAMA
+9   | VALUE_9                |      | LLAMA
+10  | VALUE_10               |      | LLAMA
+11  | VALUE_11               |      | LLAMA
+12  | VALUE_12               |      | LLAMA
+13  | VALUE_13               |      | LLAMA
+14  | VALUE_14               |      | LLAMA
+15  | VALUE_15               |      | LLAMA
+16  | VALUE_16               |      | LLAMA
+17  | VALUE_17               |      | LLAMA
+18  | VALUE_18               |      | LLAMA
+19  | VALUE_19               |      | LLAMA
+20  | VALUE_20               |      | LLAMA
+21  | VALUE_21               |      | LLAMA
+22  | VALUE_22               |      | LLAMA
+23  | VALUE_23               |      | LLAMA
+24  | VALUE_24               |      | LLAMA
+25  | VALUE_25               |      | LLAMA
+26  | VALUE_26               |      | LLAMA
+27  | VALUE_27               |      | LLAMA
+28  | VALUE_28               |      | LLAMA
+29  | VALUE_29               |      | LLAMA
+30  | VALUE_30               |      | LLAMA
+31  | VALUE_31               |      | LLAMA
+32  | VALUE_32               |      | LLAMA
+33  | VALUE_33               |      | LLAMA
+34  | VALUE_34               |      | LLAMA
+35  | VALUE_35               |      | LLAMA
+36  | VALUE_36               |      | LLAMA
+37  | VALUE_37               |      | LLAMA
+38  | VALUE_38               |      | LLAMA
+39  | VALUE_39               |      | LLAMA
+40  | VALUE_40               |      | LLAMA
+41  | VALUE_41               |      | LLAMA
+42  | VALUE_42               |      | LLAMA
+43  | VALUE_43               |      | LLAMA
+44  | VALUE_44               |      | LLAMA
+45  | VALUE_45               |      | LLAMA
+46  | VALUE_46               |      | LLAMA
+47  | VALUE_47               |      | LLAMA
+48  | VALUE_48               |      | LLAMA
+49  | VALUE_49               |      | LLAMA
+50  | VALUE_50               |      | LLAMA
+51  | VALUE_51               |      | LLAMA
+52  | VALUE_52               |      | LLAMA
+53  | VALUE_53               |      | LLAMA
+54  | VALUE_54               |      | LLAMA
+55  | VALUE_55               |      | LLAMA
+56  | VALUE_56               |      | LLAMA
+57  | VALUE_57               |      | LLAMA
+58  | VALUE_58               |      | LLAMA
+59  | VALUE_59               |      | LLAMA
+60  | VALUE_60               |      | LLAMA
+61  | VALUE_61               |      | LLAMA
+62  | VALUE_62               |      | LLAMA
+63  | VALUE_63               |      | LLAMA
+64  | VALUE_64               |      | LLAMA
+65  | VALUE_65               |      | LLAMA
+66  | VALUE_66               |      | LLAMA
+67  | VALUE_67               |      | LLAMA
+68  | VALUE_68               |      | LLAMA
+69  | VALUE_69               |      | LLAMA
+70  | VALUE_70               |      | LLAMA
+71  | VALUE_71               |      | LLAMA
+72  | VALUE_72               |      | LLAMA
+73  | VALUE_73               |      | LLAMA
+74  | VALUE_74               |      | LLAMA
+75  | VALUE_75               |      | LLAMA
+76  | VALUE_76               |      | LLAMA
+77  | VALUE_77               |      | LLAMA
+78  | VALUE_78               |      | LLAMA
+79  | VALUE_79               |      | LLAMA
+80  | VALUE_80               |      | LLAMA
+81  | VALUE_81               |      | LLAMA
+82  | VALUE_82               |      | LLAMA
+83  | VALUE_83               |      | LLAMA
+84  | VALUE_84               |      | LLAMA
+85  | VALUE_85               |      | LLAMA
+86  | VALUE_86               |      | LLAMA
+87  | VALUE_87               |      | LLAMA
+88  | VALUE_88               |      | LLAMA
+89  | VALUE_89               |      | LLAMA
+90  | VALUE_90               |      | LLAMA
+91  | VALUE_91               |      | LLAMA
+92  | VALUE_92               |      | LLAMA
+93  | VALUE_93               |      | LLAMA
+94  | VALUE_94               |      | LLAMA
+95  | VALUE_95               |      | LLAMA
+96  | VALUE_96               |      | LLAMA
+97  | VALUE_97               |      | LLAMA
+98  | VALUE_98               |      | LLAMA
+99  | VALUE_99               |      | LLAMA
+100 | VALUE_100              |      | LLAMA
+101 | VALUE_101 |  | LLAMA
+102 | VALUE_102 |  | LLAMA
+103 | VALUE_103 |  | LLAMA
+104 | VALUE_104 |  | LLAMA
+105 | VALUE_105 |  | LLAMA
+106 | VALUE_106 |  | LLAMA
+107 | VALUE_107 |  | LLAMA
+108 | VALUE_108 |  | LLAMA
+109 | VALUE_109 |  | LLAMA
+110 | VALUE_110 |  | LLAMA
+111 | VALUE_111 |  | LLAMA
+112 | VALUE_112 |  | LLAMA
+113 | VALUE_113 |  | LLAMA
+114 | VALUE_114 |  | LLAMA
+115 | VALUE_115 |  | LLAMA
+116 | VALUE_116 |  | LLAMA
+117 | VALUE_117 |  | LLAMA
+118 | VALUE_118 |  | LLAMA
+119 | VALUE_119 |  | LLAMA
+120 | VALUE_120 |  | LLAMA
+(120 rows)
+
+postgres=> 
+postgres=> -- intentionally cause an error: no such foreign server
+postgres=> ALTER SERVER test_server OPTIONS (SET host '127.0.0.1');
+ERR ERROR: server "test_server" does not exist (SQLSTATE 42704)
+
+postgres=> 
+postgres=> -- test dropping some other kinds of objects
+postgres=> DROP TRIGGER IF EXISTS test_trigger_before_insert ON test_table;
+DROP TRIGGER
+
+postgres=> DROP FUNCTION IF EXISTS test_trigger_before_insert_fn();
+DROP FUNCTION
+
+postgres=> DROP PROCEDURE test_proc;
+DROP PROCEDURE
+
+postgres=> DROP VIEW test_view;
+DROP VIEW
+
+postgres=> 
+postgres=> TRUNCATE TABLE test_table;
+TRUNCATE TABLE
+
+postgres=> DROP TABLE test_table;
+DROP TABLE
+
+postgres=> 
+postgres=> -- clean up: reset the search path and drop the schema
+postgres=> SET search_path = public;
+SET
+
+postgres=> DROP SCHEMA test_ddl_db CASCADE;
+DROP SCHEMA
+
+postgres=> 
+postgres=> 
\ No newline at end of file
diff --git a/lib/client/db/postgres/repl/testdata/TestREPL/literals.golden b/lib/client/db/postgres/repl/testdata/TestREPL/literals.golden
new file mode 100644
index 0000000000000..3124fd551f4d2
--- /dev/null
+++ b/lib/client/db/postgres/repl/testdata/TestREPL/literals.golden
@@ -0,0 +1,206 @@
+Teleport PostgreSQL interactive shell (v19.0.0-dev)
+Connected to "postgres-test-container" instance as "postgres" user.
+Type \? for help.
+
+postgres=> -- simple literals
+postgres=> SELECT 'thing';
+?column?
+--------
+thing
+(1 row)
+
+postgres=> SELECT 'thing'; ;;
+?column?
+--------
+thing
+(1 row)
+
+postgres=> 
+postgres=> -- multiline query
+postgres=> SELECT
+           1
+           ;
+?column?
+--------
+1
+(1 row)
+
+postgres=> 
+postgres=> -- query with special characters
+postgres=> SELECT 'special_chars_!@#$%^&*()';
+?column?
+--------
+special_chars_!@#$%^&*()
+(1 row)
+
+postgres=> 
+postgres=> -- leading and trailing whitespace
+postgres=>    SELECT 1;
+?column?
+--------
+1
+(1 row)
+
+postgres=> 
+postgres=> -- multiline with excessive whitespace
+postgres=>    SELECT
+              1
+              ;
+?column?
+--------
+1
+(1 row)
+
+postgres=> 
+postgres=> -- with command in the middle treats the command as a literal
+postgres=> SELECT \? 1;
+ERR ERROR: syntax error at or near "\" (SQLSTATE 42601)
+
+postgres=> 
+postgres=> -- multiline with command in the middle treats the command as a liter
+al
+postgres=> SELECT
+           \?
+           1;
+ERR ERROR: syntax error at or near "\" (SQLSTATE 42601)
+
+postgres=> 
+postgres=> -- multiline with command in the last line is not supported
+postgres=> SELECT
+           1
+           \?;
+ERR ERROR: syntax error at or near "\" (SQLSTATE 42601)
+
+postgres=> 
+postgres=> SELECT 1, -1, 1.24, -1.24, 'foo', NULL, 'null' ORDER BY 1;
+?column? | ?column? | ?column? | ?column? | ?column? | ?column? | ?column?
+-------- | -------- | -------- | -------- | -------- | -------- | --------
+1        | -1       | 1.24     | -1.24    | foo      |          | null
+(1 row)
+
+postgres=> 
+postgres=> -- aliases
+postgres=> SELECT
+               1     AS "unsigned int",
+               -1    AS "negative int",
+               1.24  AS "float",
+               -1.24 AS "negative float",
+               'foo' AS "string",
+               NULL  AS "actual NULL",
+               'null' AS "string null"
+               ORDER BY 1;
+unsigned int | negative int | float | negative float | string | actual NULL | string null
+------------ | ------------ | ----- | -------------- | ------ | ----------- | -----------
+1            | -1           | 1.24  | -1.24          | foo    |             | null
+(1 row)
+
+postgres=> 
+postgres=> SELECT '1'::text AS "multiple rows of literals"
+           UNION
+           SELECT '-1'
+           UNION
+           SELECT '1.24'
+           UNION
+           SELECT '-1.24'
+           UNION
+           SELECT 'foo'
+           UNION
+           SELECT NULL
+           UNION
+           SELECT 'null' ORDER BY 1;
+multiple rows of literals
+-------------------------
+-1
+1
+-1.24
+1.24
+foo
+null
+
+(7 rows)
+
+postgres=> 
+postgres=> -- multiline strings
+postgres=> SELECT 'a
+           b
+           c' AS "multiline-string";
+multiline-string
+----------------
+a
+b
+c
+(1 row)
+
+postgres=> 
+postgres=> /* foo bar */
+           SELECT 1;
+?column?
+--------
+1
+(1 row)
+
+postgres=> /* foo bar */ SELECT /* baz */ 42;
+?column?
+--------
+42
+(1 row)
+
+postgres=> 
+postgres=> SELECT '$$1$$';
+?column?
+--------
+$$1$$
+(1 row)
+
+postgres=> SELECT '$$;$$';
+?column?
+--------
+$$;$$
+(1 row)
+
+postgres=> 
+postgres=> SHOW search_path;
+search_path
+-----------
+"$user", public
+(1 row)
+
+postgres=> EXPLAIN select 1;
+QUERY PLAN
+----------
+Result  (cost=0.00..0.01 rows=1 width=4)
+(1 row)
+
+postgres=> 
+postgres=> -- TODO(gavin): fix the parser to handle trailing comments
+postgres=> SELECT 'thing'; ;;  -- a trailing space and comment
+           
+           ;
+?column?
+--------
+thing
+(1 row)
+
+postgres=> 
+postgres=> -- this fails to parse because delimiters are in the string literal
+postgres=> -- TODO(gavin): fix the parser to handle delimiter quotation properly
+
+postgres=> SELECT 'a
+               ;
+ERR ERROR: unterminated quoted string at or near "'a
+;" (SQLSTATE 42601)
+
+postgres=>     b
+               ;
+ERR ERROR: syntax error at or near "b" (SQLSTATE 42601)
+
+postgres=> c' AS "multiline with delimiters";
+ERR ERROR: syntax error at or near "c" (SQLSTATE 42601)
+
+postgres=> 
+postgres=> -- TODO(gavin): fix the parser to handle command/query mixed usage (d
+elimited by semicolons)
+postgres=> -- with command following a statement
+postgres=> SELECT 1;\?
+           
+           
\ No newline at end of file
diff --git a/lib/client/db/postgres/repl/testdata/TestStart/data_type.golden b/lib/client/db/postgres/repl/testdata/TestStart/data_type.golden
deleted file mode 100644
index 725af38776034..0000000000000
--- a/lib/client/db/postgres/repl/testdata/TestStart/data_type.golden
+++ /dev/null
@@ -1,4 +0,0 @@
-serial_col int_col smallint_col bigint_col          decimal_col numeric_col real_col double_col        smallserial_col bigserial_col char_col   varchar_col         text_col         boolean_col date_col   time_col timetz_col  timestamp_col       timestamptz_col        interval_col                  uuid_col                             json_col         jsonb_col        xml_col                                 bytea_col                inet_col    cidr_col       macaddr_col       point_col line_col lseg_col      box_col     path_col            polygon_col         circle_col tsquery_col   tsvector_col                                       
----------- ------- ------------ ------------------- ----------- ----------- -------- ----------------- --------------- ------------- ---------- ------------------- ---------------- ----------- ---------- -------- ----------- ------------------- ---------------------- ----------------------------- ------------------------------------ ---------------- ---------------- --------------------------------------- ------------------------ ----------- -------------- ----------------- --------- -------- ------------- ----------- ------------------- ------------------- ---------- ------------- -------------------------------------------------- 
-1          42      32767        9223372036854775807 12345.67    98765.43210 3.14     2.718281828459045 1               1             A          Sample varchar text Sample text data t           2024-11-29 12:34:56 12:34:56+03 2024-11-29 12:34:56 2024-11-29 09:34:56+00 1 year 2 mons 3 days 04:05:06 550e8400-e29b-41d4-a716-446655440000 {"key": "value"} {"key": "value"} <root><child>XML content</child></root> \x48656c6c6f20576f726c64 192.168.1.1 192.168.1.0/24 08:00:2b:01:02:03 (1,2)     {1,-1,0} [(0,0),(1,1)] (1,1),(0,0) ((0,0),(1,1),(2,2)) ((0,0),(1,1),(1,0)) <(0,0),1>  'fat' & 'rat' 'a' 'and' 'ate' 'cat' 'fat' 'mat' 'on' 'rat' 'sat' 
-(1 row)

diff --git a/lib/client/db/postgres/repl/testdata/TestStart/err.golden b/lib/client/db/postgres/repl/testdata/TestStart/err.golden
deleted file mode 100644
index 1dd89d57178c7..0000000000000
--- a/lib/client/db/postgres/repl/testdata/TestStart/err.golden
+++ /dev/null
@@ -1 +0,0 @@
-ERR ERROR: error (SQLSTATE 42703)

diff --git a/lib/client/db/postgres/repl/testdata/TestStart/multi.golden b/lib/client/db/postgres/repl/testdata/TestStart/multi.golden
deleted file mode 100644
index 43b92f3157fbb..0000000000000
--- a/lib/client/db/postgres/repl/testdata/TestStart/multi.golden
+++ /dev/null
@@ -1,5 +0,0 @@
-id   email             
---   ----------------- 
-1    alice@example.com 
-2    bob@example.com   
-(2 rows)

diff --git a/lib/client/db/postgres/repl/testdata/TestStart/multiquery.golden b/lib/client/db/postgres/repl/testdata/TestStart/multiquery.golden
deleted file mode 100644
index 3d3724d7186be..0000000000000
--- a/lib/client/db/postgres/repl/testdata/TestStart/multiquery.golden
+++ /dev/null
@@ -1,10 +0,0 @@
-?column? 
--------- 
-1        
-(1 row)

-

-id   email             
---   ----------------- 
-1    alice@example.com 
-2    bob@example.com   
-(2 rows)

diff --git a/lib/client/db/postgres/repl/testdata/TestStart/single.golden b/lib/client/db/postgres/repl/testdata/TestStart/single.golden
deleted file mode 100644
index c6ac2ed5ce793..0000000000000
--- a/lib/client/db/postgres/repl/testdata/TestStart/single.golden
+++ /dev/null
@@ -1,4 +0,0 @@
-id   email             
---   ----------------- 
-1    alice@example.com 
-(1 row)

diff --git a/lib/client/db/postgres/repl/testdata/query.go b/lib/client/db/postgres/repl/testdata/query.go
deleted file mode 100644
index 6789b128c1f37..0000000000000
--- a/lib/client/db/postgres/repl/testdata/query.go
+++ /dev/null
@@ -1,111 +0,0 @@
-// Teleport
-// Copyright (C) 2024 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package testdata
-
-import (
-	"github.com/jackc/pgconn"
-	"github.com/jackc/pgproto3/v2"
-)
-
-// Contains a query result with the most common fields in PostgreSQL.
-// This can be used to understand how the REPL deals with different data types.
-//
-// Sampled from https://github.com/postgres/postgres/blob/b6612aedc53a6bf069eba5e356a8421ad6426486/src/include/catalog/pg_type.dat
-// PostgreSQL version 17.2
-var TestDataQueryResult = []pgproto3.BackendMessage{
-	&pgproto3.RowDescription{Fields: []pgproto3.FieldDescription{
-		// TableOID and TableAttributeNumber values omitted.
-		{Name: []byte("serial_col"), DataTypeOID: 23, DataTypeSize: 4, TypeModifier: -1, Format: 0},
-		{Name: []byte("int_col"), DataTypeOID: 23, DataTypeSize: 4, TypeModifier: -1, Format: 0},
-		{Name: []byte("smallint_col"), DataTypeOID: 21, DataTypeSize: 2, TypeModifier: -1, Format: 0},
-		{Name: []byte("bigint_col"), DataTypeOID: 20, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("decimal_col"), DataTypeOID: 1700, DataTypeSize: -1, TypeModifier: 655366, Format: 0},
-		{Name: []byte("numeric_col"), DataTypeOID: 1700, DataTypeSize: -1, TypeModifier: 983049, Format: 0},
-		{Name: []byte("real_col"), DataTypeOID: 700, DataTypeSize: 4, TypeModifier: -1, Format: 0},
-		{Name: []byte("double_col"), DataTypeOID: 701, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("smallserial_col"), DataTypeOID: 21, DataTypeSize: 2, TypeModifier: -1, Format: 0},
-		{Name: []byte("bigserial_col"), DataTypeOID: 20, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("char_col"), DataTypeOID: 1042, DataTypeSize: -1, TypeModifier: 14, Format: 0},
-		{Name: []byte("varchar_col"), DataTypeOID: 1043, DataTypeSize: -1, TypeModifier: 54, Format: 0},
-		{Name: []byte("text_col"), DataTypeOID: 25, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("boolean_col"), DataTypeOID: 16, DataTypeSize: 1, TypeModifier: -1, Format: 0},
-		{Name: []byte("date_col"), DataTypeOID: 1082, DataTypeSize: 4, TypeModifier: -1, Format: 0},
-		{Name: []byte("time_col"), DataTypeOID: 1083, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("timetz_col"), DataTypeOID: 1266, DataTypeSize: 12, TypeModifier: -1, Format: 0},
-		{Name: []byte("timestamp_col"), DataTypeOID: 1114, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("timestamptz_col"), DataTypeOID: 1184, DataTypeSize: 8, TypeModifier: -1, Format: 0},
-		{Name: []byte("interval_col"), DataTypeOID: 1186, DataTypeSize: 16, TypeModifier: -1, Format: 0},
-		{Name: []byte("uuid_col"), DataTypeOID: 2950, DataTypeSize: 16, TypeModifier: -1, Format: 0},
-		{Name: []byte("json_col"), DataTypeOID: 114, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("jsonb_col"), DataTypeOID: 3802, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("xml_col"), DataTypeOID: 142, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("bytea_col"), DataTypeOID: 17, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("inet_col"), DataTypeOID: 869, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("cidr_col"), DataTypeOID: 650, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("macaddr_col"), DataTypeOID: 829, DataTypeSize: 6, TypeModifier: -1, Format: 0},
-		{Name: []byte("point_col"), DataTypeOID: 600, DataTypeSize: 16, TypeModifier: -1, Format: 0},
-		{Name: []byte("line_col"), DataTypeOID: 628, DataTypeSize: 24, TypeModifier: -1, Format: 0},
-		{Name: []byte("lseg_col"), DataTypeOID: 601, DataTypeSize: 32, TypeModifier: -1, Format: 0},
-		{Name: []byte("box_col"), DataTypeOID: 603, DataTypeSize: 32, TypeModifier: -1, Format: 0},
-		{Name: []byte("path_col"), DataTypeOID: 602, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("polygon_col"), DataTypeOID: 604, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("circle_col"), DataTypeOID: 718, DataTypeSize: 24, TypeModifier: -1, Format: 0},
-		{Name: []byte("tsquery_col"), DataTypeOID: 3615, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-		{Name: []byte("tsvector_col"), DataTypeOID: 3614, DataTypeSize: -1, TypeModifier: -1, Format: 0},
-	}},
-	&pgproto3.DataRow{Values: [][]byte{
-		[]byte("1"),
-		[]byte("42"),
-		[]byte("32767"),
-		[]byte("9223372036854775807"),
-		[]byte("12345.67"),
-		[]byte("98765.43210"),
-		[]byte("3.14"),
-		[]byte("2.718281828459045"),
-		[]byte("1"),
-		[]byte("1"),
-		[]byte("A         "),
-		[]byte("Sample varchar text"),
-		[]byte("Sample text data"),
-		[]byte("t"),
-		[]byte("2024-11-29"),
-		[]byte("12:34:56"),
-		[]byte("12:34:56+03"),
-		[]byte("2024-11-29 12:34:56"),
-		[]byte("2024-11-29 09:34:56+00"),
-		[]byte("1 year 2 mons 3 days 04:05:06"),
-		[]byte("550e8400-e29b-41d4-a716-446655440000"),
-		[]byte("{\"key\": \"value\"}"),
-		[]byte("{\"key\": \"value\"}"),
-		[]byte("<root><child>XML content</child></root>"),
-		[]byte("\\x48656c6c6f20576f726c64"),
-		[]byte("192.168.1.1"),
-		[]byte("192.168.1.0/24"),
-		[]byte("08:00:2b:01:02:03"),
-		[]byte("(1,2)"),
-		[]byte("{1,-1,0}"),
-		[]byte("[(0,0),(1,1)]"),
-		[]byte("(1,1),(0,0)"),
-		[]byte("((0,0),(1,1),(2,2))"),
-		[]byte("((0,0),(1,1),(1,0))"),
-		[]byte("<(0,0),1>"),
-		[]byte("'fat' & 'rat'"),
-		[]byte("'a' 'and' 'ate' 'cat' 'fat' 'mat' 'on' 'rat' 'sat'"),
-	}},
-	&pgproto3.CommandComplete{CommandTag: pgconn.CommandTag("SELECT")},
-	&pgproto3.ReadyForQuery{},
-}
diff --git a/lib/client/db/repl/repl.go b/lib/client/db/repl/repl.go
index abfed3dd5b8b6..03c4dc432a2ba 100644
--- a/lib/client/db/repl/repl.go
+++ b/lib/client/db/repl/repl.go
@@ -44,6 +44,8 @@ type REPLNewFunc func(context.Context, *NewREPLConfig) (REPLInstance, error)
 type REPLInstance interface {
 	// Run executes the REPL. This is a blocking operation.
 	Run(context.Context) error
+	// SetSize sets the REPL terminal window dimensions.
+	SetSize(width, height int) error
 }
 
 // REPLRegistry is an interface for initializing REPL instances and checking
diff --git a/lib/client/debug/debug.go b/lib/client/debug/debug.go
index 368a4eadc3ab1..8beaf99a71d8b 100644
--- a/lib/client/debug/debug.go
+++ b/lib/client/debug/debug.go
@@ -24,10 +24,14 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path/filepath"
 	"strconv"
 
 	"github.com/gravitational/trace"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/expfmt"
 
+	"github.com/gravitational/teleport"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 )
 
@@ -47,11 +51,13 @@ var SupportedProfiles = map[string]struct{}{
 
 // Client represents the debug service client.
 type Client struct {
-	clt *http.Client
+	clt        *http.Client
+	socketPath string
 }
 
 // NewClient generates a new debug service client.
-func NewClient(socketPath string) *Client {
+func NewClient(dataDir string) *Client {
+	socketPath := filepath.Join(dataDir, teleport.DebugServiceSocketName)
 	return &Client{
 		clt: &http.Client{
 			Timeout: apidefaults.DefaultIOTimeout,
@@ -66,9 +72,15 @@ func NewClient(socketPath string) *Client {
 				return trace.Errorf("redirect via socket not allowed")
 			},
 		},
+		socketPath: socketPath,
 	}
 }
 
+// SocketPath returns the absolute path to the UNIX socket that the debug service is exposed on.
+func (c *Client) SocketPath() string {
+	return c.socketPath
+}
+
 // SetLogLevel changes the application's log level and a change status message.
 func (c *Client) SetLogLevel(ctx context.Context, level string) (string, error) {
 	resp, err := c.do(ctx, http.MethodPut, url.URL{Path: "/log-level"}, []byte(level))
@@ -173,6 +185,31 @@ func (c *Client) GetReadiness(ctx context.Context) (Readiness, error) {
 	return ready, nil
 }
 
+// GetMetrics returns prometheus metrics as a map keyed by metric name.
+func (c *Client) GetMetrics(ctx context.Context) (map[string]*dto.MetricFamily, error) {
+	resp, err := c.do(ctx, http.MethodGet, url.URL{Path: "/metrics"}, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+	var parser expfmt.TextParser
+	metrics, err := parser.TextToMetricFamilies(resp.Body)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return metrics, nil
+}
+
+// GetRawMetrics returns unprocessed prometheus metrics from the /metrics endpoint.
+func (c *Client) GetRawMetrics(ctx context.Context) (io.ReadCloser, error) {
+	resp, err := c.do(ctx, http.MethodGet, url.URL{Path: "/metrics"}, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Body, nil
+}
+
 func (c *Client) do(ctx context.Context, method string, u url.URL, body []byte) (*http.Response, error) {
 	u.Scheme = "http"
 	u.Host = "debug"
diff --git a/lib/client/debug/debug_test.go b/lib/client/debug/debug_test.go
index 52ced041ca0d6..c82b945a57fe9 100644
--- a/lib/client/debug/debug_test.go
+++ b/lib/client/debug/debug_test.go
@@ -206,7 +206,7 @@ func newSocketMockService(t *testing.T, status int, contents []byte) (string, fu
 	}()
 
 	t.Cleanup(func() { srv.Shutdown(context.Background()) })
-	return socketPath, func() []string {
+	return socketDir, func() []string {
 		srv.Shutdown(context.Background())
 		return requests
 	}
diff --git a/lib/client/identityfile/identity.go b/lib/client/identityfile/identity.go
index 8614ced48bbde..71bb7cc5dd5ee 100644
--- a/lib/client/identityfile/identity.go
+++ b/lib/client/identityfile/identity.go
@@ -474,7 +474,7 @@ func Write(ctx context.Context, cfg WriteConfig) (filesWritten []string, err err
 			TeleportClusterName: cfg.KeyRing.ClusterName,
 			ClusterAddr:         cfg.KubeProxyAddr,
 			Credentials:         cfg.KeyRing,
-			TLSServerName:       cfg.KubeTLSServerName,
+			TLSServerNameFunc:   func(teleportClusterName, kubeClusterName string) string { return cfg.KubeTLSServerName },
 			KubeClusters:        kubeCluster,
 		}, cfg.KubeStoreAllCAs, writer); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/client/keyagent.go b/lib/client/keyagent.go
index 568b658121fad..e901f61822fc3 100644
--- a/lib/client/keyagent.go
+++ b/lib/client/keyagent.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/tlsca"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -133,7 +134,13 @@ func NewLocalAgent(conf LocalAgentConfig) (a *LocalKeyAgent, err error) {
 	}
 
 	if shouldAddKeysToAgent(conf.KeysOption) {
-		a.systemAgent = connectToSSHAgent()
+		a.log.DebugContext(context.Background(), "Connecting to the system agent")
+		systemAgent, err := sshagent.NewSystemAgentClient()
+		if err != nil {
+			a.log.WarnContext(context.Background(), "Unable to connect to system agent", "error", err)
+		} else {
+			a.systemAgent = systemAgent
+		}
 	} else {
 		log.DebugContext(context.Background(), "Skipping connection to the local ssh-agent.")
 
@@ -358,7 +365,7 @@ func (a *LocalKeyAgent) HostKeyCallback(addr string, remote net.Addr, hostKey ss
 
 	certChecker := sshutils.CertChecker{
 		CertChecker: ssh.CertChecker{
-			IsHostAuthority: a.checkHostCertificateForClusters(clusters...),
+			IsHostAuthority: a.isHostAuthorityForClusters(clusters...),
 			HostKeyFallback: a.checkHostKey,
 		},
 		FIPS: isFIPS(),
@@ -375,11 +382,11 @@ func (a *LocalKeyAgent) HostKeyCallback(addr string, remote net.Addr, hostKey ss
 	return nil
 }
 
-// checkHostCertificateForClusters validates a host certificate and check if remote key matches the know
-// trusted cluster key based on  ~/.tsh/known_hosts. If server key is not known, the users is prompted to accept or
-// reject the server key.
-func (a *LocalKeyAgent) checkHostCertificateForClusters(clusters ...string) func(key ssh.PublicKey, addr string) bool {
-	return func(key ssh.PublicKey, addr string) bool {
+// isHostAuthorityForClusters validates a host certificate's issuer to see if it
+// matches the known trusted cluster CA keys in ~/.tsh/known_hosts. If the CA is
+// not known, the users is prompted to accept or reject it.
+func (a *LocalKeyAgent) isHostAuthorityForClusters(clusters ...string) func(authority ssh.PublicKey, addr string) bool {
+	return func(authority ssh.PublicKey, addr string) bool {
 		ctx := context.Background()
 
 		// Check the local cache (where all Teleport CAs are placed upon login) to
@@ -407,14 +414,14 @@ func (a *LocalKeyAgent) checkHostCertificateForClusters(clusters ...string) func
 		}
 
 		for i := range keys {
-			if sshutils.KeysEqual(key, keys[i]) {
+			if sshutils.KeysEqual(authority, keys[i]) {
 				return true
 			}
 		}
 
-		// If this certificate was not seen before, prompt the user essentially
-		// treating it like a key.
-		err = a.checkHostKey(addr, nil, key)
+		// If this CA was not seen before, prompt the user essentially treating
+		// it like a key.
+		err = a.checkHostKey(addr, nil, authority)
 		return err == nil
 	}
 }
@@ -657,7 +664,7 @@ func (a *LocalKeyAgent) Signers() ([]ssh.Signer, error) {
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		agentSigners = append(signers, sshAgentSigners...)
+		agentSigners = append(agentSigners, sshAgentSigners...)
 	}
 
 	// Filter out non-certificates (like regular public SSH keys stored in the SSH agent).
diff --git a/lib/client/keyagent_test.go b/lib/client/keyagent_test.go
index 8eb22b1c94128..c832de9cd01ec 100644
--- a/lib/client/keyagent_test.go
+++ b/lib/client/keyagent_test.go
@@ -278,6 +278,28 @@ func TestLoadKey(t *testing.T) {
 	}
 }
 
+func TestSigners(t *testing.T) {
+	s := makeSuite(t)
+	keyAgent := s.newKeyAgent(t)
+
+	// add the key to the local and system agent.
+	err := keyAgent.AddKeyRing(s.keyRing)
+	require.NoError(t, err)
+
+	// Check that the ssh cert (signer) appears three times:
+	// - from the client store
+	// - from the local agent
+	// - from the system agent
+	signers, err := keyAgent.Signers()
+	require.NoError(t, err)
+	require.Len(t, signers, 3)
+
+	// non ssh certs should be filtered out
+	for i, signer := range signers {
+		require.True(t, sshutils.IsSSHCertType(signer.PublicKey().Type()), "signer %d has unexpected type %s", i, signer.PublicKey().Type())
+	}
+}
+
 type caType struct {
 	signer       ssh.Signer
 	trustedCerts authclient.TrustedCerts
diff --git a/lib/client/keystore.go b/lib/client/keystore.go
index d7823b330ee75..8733fac4ce86a 100644
--- a/lib/client/keystore.go
+++ b/lib/client/keystore.go
@@ -25,9 +25,11 @@ import (
 	"fmt"
 	iofs "io/fs"
 	"log/slog"
+	"maps"
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -53,9 +55,9 @@ const (
 	// under ~/.tsh
 	keyFilePerms os.FileMode = 0600
 
-	// tshConfigFileName is the name of the directory containing the
+	// tshConfigDirName is the name of the directory containing the
 	// tsh config file.
-	tshConfigFileName = "config"
+	tshConfigDirName = "config"
 
 	// tshAzureDirName is the name of the directory containing the
 	// az cli app-specific profiles.
@@ -89,6 +91,10 @@ type KeyStore interface {
 	// GetSSHCertificates gets all certificates signed for the given user and proxy,
 	// including certificates for trusted clusters.
 	GetSSHCertificates(proxyHost, username string) ([]*ssh.Certificate, error)
+
+	// GetIdentities returns the usernames associated to signed user certificates
+	// for the given proxy in the keystore.
+	GetIdentities(proxyHost string) ([]string, error)
 }
 
 // FSKeyStore is an on-disk implementation of the KeyStore interface.
@@ -113,6 +119,11 @@ func NewFSKeyStore(dirPath string) *FSKeyStore {
 	}
 }
 
+// proxyKeyDir returns the path to the given proxy's keys directory.
+func (fs *FSKeyStore) proxyKeyDir(proxy string) string {
+	return keypaths.ProxyKeyDir(fs.KeyDir, proxy)
+}
+
 // userSSHKeyPath returns the SSH private key path for the given KeyRingIndex.
 func (fs *FSKeyStore) userSSHKeyPath(idx KeyRingIndex) string {
 	return keypaths.UserSSHKeyPath(fs.KeyDir, idx.ProxyHost, idx.Username)
@@ -426,10 +437,9 @@ func (fs *FSKeyStore) DeleteKeyRing(idx KeyRingIndex) error {
 		fs.publicKeyPath(idx),
 		fs.tlsCertPath(idx),
 	}
+	var deleteErrs []error
 	for _, fn := range files {
-		if err := utils.RemoveSecure(fn); err != nil {
-			return trace.ConvertSystemError(err)
-		}
+		deleteErrs = append(deleteErrs, trace.ConvertSystemError(utils.RemoveSecure(fn)))
 	}
 	// we also need to delete the extra PuTTY-formatted .ppk file when running on Windows,
 	// but it may not exist when upgrading from v9 -> v10 and logging into an existing cluster.
@@ -446,7 +456,8 @@ func (fs *FSKeyStore) DeleteKeyRing(idx KeyRingIndex) error {
 
 	// Clear ClusterName to delete the user certs stored for all clusters.
 	idx.ClusterName = ""
-	return fs.DeleteUserCerts(idx, WithAllCerts...)
+	deleteErrs = append(deleteErrs, fs.DeleteUserCerts(idx, WithAllCerts...))
+	return trace.NewAggregate(deleteErrs...)
 }
 
 // DeleteUserCerts deletes only the specified parts of the user's keyring,
@@ -474,19 +485,21 @@ func (fs *FSKeyStore) DeleteKeys() error {
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
-	ignoreDirs := map[string]struct{}{tshConfigFileName: {}, tshAzureDirName: {}, tshBin: {}}
 	for _, file := range files {
-		// Don't delete 'config', 'azure' and 'bin' directories.
-		// TODO: this is hackish and really shouldn't be needed, but fs.KeyDir is `~/.tsh` while it probably should be `~/.tsh/keys` instead.
-		if _, ok := ignoreDirs[file.Name()]; ok && file.IsDir() {
-			continue
-		}
 		if file.IsDir() {
-			err := utils.RemoveAllSecure(filepath.Join(fs.KeyDir, file.Name()))
-			if err != nil {
-				return trace.ConvertSystemError(err)
+			switch file.Name() {
+			case tshConfigDirName, tshAzureDirName, tshBin:
+				// Don't delete 'config', 'azure' and 'bin' directories.
+				// TODO: this is hackish and really shouldn't be needed, but fs.KeyDir is `~/.tsh` while it probably should be `~/.tsh/keys` instead.
+				continue
+			}
+		} else {
+			switch file.Name() {
+			case keypaths.VNetClientSSHKey, keypaths.VNetClientSSHKeyPub:
+				// Don't delete VNet client SSH keys on logout in case a user wants to
+				// set these to their own key compatible with their third-party SSH client.
+				continue
 			}
-			continue
 		}
 		err := utils.RemoveAllSecure(filepath.Join(fs.KeyDir, file.Name()))
 		if err != nil {
@@ -601,6 +614,27 @@ func (fs *FSKeyStore) GetSSHCertificates(proxyHost, username string) ([]*ssh.Cer
 	return sshCerts, nil
 }
 
+// GetIdentities returns the usernames associated to signed user certificates
+// for the given proxy in the keystore.
+func (fs *FSKeyStore) GetIdentities(proxyHost string) ([]string, error) {
+	proxyDir := fs.proxyKeyDir(proxyHost)
+	files, err := os.ReadDir(proxyDir)
+	if err != nil {
+		return nil, trace.ConvertSystemError(err)
+	}
+
+	var identities []string
+	for _, file := range files {
+		// we seek the files corresponding to user SSH certificates, which are
+		// stored in [user]-ssh subdirectory. These are generated on successful logins.
+		if file.IsDir() && strings.HasSuffix(file.Name(), keypaths.SSHDirSuffix) {
+			username := strings.TrimSuffix(file.Name(), keypaths.SSHDirSuffix)
+			identities = append(identities, username)
+		}
+	}
+	return identities, nil
+}
+
 func getCredentialsByName(credentialDir string, opts ...keys.ParsePrivateKeyOpt) (map[string]TLSCredential, error) {
 	files, err := os.ReadDir(credentialDir)
 	if err != nil {
@@ -947,3 +981,9 @@ func (ms *MemKeyStore) GetSSHCertificates(proxyHost, username string) ([]*ssh.Ce
 
 	return sshCerts, nil
 }
+
+// GetIdentities returns the usernames associated to signed user certificates
+// for the given proxy in the keystore.
+func (ms *MemKeyStore) GetIdentities(proxyHost string) ([]string, error) {
+	return slices.Collect(maps.Keys(ms.keyRings[proxyHost])), nil
+}
diff --git a/lib/client/keystore_test.go b/lib/client/keystore_test.go
index b891fa9859041..11d1242ff115f 100644
--- a/lib/client/keystore_test.go
+++ b/lib/client/keystore_test.go
@@ -338,6 +338,27 @@ func TestProtectedDirsNotDeleted(t *testing.T) {
 	require.NoDirExists(t, filepath.Join(keyStore.KeyDir, "keys"))
 }
 
+// TestDeleteKeyRingContinueOnError verifies that an issue deleting one file
+// does not prevent deleting the others.
+func TestDeleteKeyRingContinueOnError(t *testing.T) {
+	t.Parallel()
+	auth := newTestAuthority(t)
+	keyStore := newTestFSKeyStore(t)
+	idx := KeyRingIndex{"host.a", "bob", "root"}
+	require.NoError(t, keyStore.AddKeyRing(auth.makeSignedKeyRing(t, idx, false)))
+
+	require.NoError(t, os.Remove(keyStore.userSSHKeyPath(idx)))
+	require.Error(t, keyStore.DeleteKeyRing(idx))
+	for _, file := range []string{
+		keyStore.userSSHKeyPath(idx),
+		keyStore.userTLSKeyPath(idx),
+		keyStore.publicKeyPath(idx),
+		keyStore.tlsCertPath(idx),
+	} {
+		require.NoFileExists(t, file)
+	}
+}
+
 func assertEqualKeyRings(t *testing.T, expected, actual *KeyRing) {
 	t.Helper()
 	// Ignore differences in unexported private key fields, for example keyPEM
diff --git a/lib/client/local_proxy_middleware.go b/lib/client/local_proxy_middleware.go
index 1f6f7bf9622c1..82341b50cf49c 100644
--- a/lib/client/local_proxy_middleware.go
+++ b/lib/client/local_proxy_middleware.go
@@ -142,7 +142,7 @@ func (c *CertChecker) SetCert(cert tls.Certificate) {
 
 // GetOrIssueCert gets the CertChecker's certificate, or issues a new
 // certificate if the it is invalid (e.g. expired) or missing.
-func (c *CertChecker) GetOrIssueCert(ctx context.Context) (tls.Certificate, error) {
+func (c *CertChecker) GetOrIssueCert(ctx context.Context) (cert tls.Certificate, err error) {
 	c.certMu.Lock()
 	defer c.certMu.Unlock()
 
@@ -150,7 +150,7 @@ func (c *CertChecker) GetOrIssueCert(ctx context.Context) (tls.Certificate, erro
 		return c.cert, nil
 	}
 
-	cert, err := c.certIssuer.IssueCert(ctx)
+	cert, err = c.certIssuer.IssueCert(ctx)
 	if err != nil {
 		return tls.Certificate{}, trace.Wrap(err)
 	}
diff --git a/lib/client/local_proxy_middleware_test.go b/lib/client/local_proxy_middleware_test.go
index cfb79e335601e..2a629609f7040 100644
--- a/lib/client/local_proxy_middleware_test.go
+++ b/lib/client/local_proxy_middleware_test.go
@@ -70,6 +70,11 @@ func TestCertChecker(t *testing.T) {
 	certIssuer.issueErr = trace.BadParameter("failed to issue cert")
 	_, err = certChecker.GetOrIssueCert(ctx)
 	require.ErrorIs(t, err, certIssuer.issueErr, "expected error %v but got %v", certIssuer.issueErr, err)
+
+	// If the problem is solved, the error is clean up.
+	certIssuer.issueErr = nil
+	_, err = certChecker.GetOrIssueCert(ctx)
+	require.NoError(t, err)
 }
 
 func TestLocalCertGenerator(t *testing.T) {
diff --git a/lib/client/mcp.go b/lib/client/mcp.go
new file mode 100644
index 0000000000000..f7ca3cfa0c0ad
--- /dev/null
+++ b/lib/client/mcp.go
@@ -0,0 +1,178 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package client
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"log/slog"
+	"net"
+	"strings"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// MCPServerDialerClient defines a subset of TeleportClient functions that are
+// used by MCPServerDialer.
+type MCPServerDialerClient interface {
+	DialALPN(context.Context, tls.Certificate, alpncommon.Protocol) (net.Conn, error)
+	ListApps(context.Context, *proto.ListResourcesRequest) ([]types.Application, error)
+	IssueUserCertsWithMFA(context.Context, ReissueParams) (*KeyRing, error)
+	ProfileStatus() (*ProfileStatus, error)
+	GetSiteName() string
+}
+
+// MCPServerDialer is a wrapper of TeleportClient for handling MCP connections
+// to proxy.
+type MCPServerDialer struct {
+	client  MCPServerDialerClient
+	appName string
+
+	mu     sync.Mutex
+	app    types.Application
+	cert   tls.Certificate
+	clock  clockwork.Clock
+	logger *slog.Logger
+}
+
+// NewMCPServerDialer creates a new MCPServerDialer.
+func NewMCPServerDialer(client MCPServerDialerClient, appName string) *MCPServerDialer {
+	return &MCPServerDialer{
+		client:  client,
+		appName: appName,
+		clock:   clockwork.NewRealClock(),
+		logger: slog.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentMCP, "dialer"),
+		),
+	}
+}
+
+// GetApp returns the types.Application for the associated MCP server.
+func (d *MCPServerDialer) GetApp(ctx context.Context) (types.Application, error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.getAppLocked(ctx)
+}
+
+// DialALPN dials Teleport Proxy to establish a TLS routing connection for the
+// MCP server.
+func (d *MCPServerDialer) DialALPN(ctx context.Context) (net.Conn, error) {
+	app, err := d.getAppLocked(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cert, err := d.getCertLocked(ctx, app)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	switch types.GetMCPServerTransportType(app.GetURI()) {
+	case types.MCPTransportHTTP:
+		return d.client.DialALPN(ctx, cert, alpncommon.ProtocolHTTP)
+	default:
+		return d.client.DialALPN(ctx, cert, alpncommon.ProtocolMCP)
+	}
+}
+
+// DialContext is a simple wrapper of DialALPN. This function is defined to be
+// compatible with common context dialer interfaces.
+func (d *MCPServerDialer) DialContext(ctx context.Context, _, _ string) (net.Conn, error) {
+	return d.DialALPN(ctx)
+}
+
+func (d *MCPServerDialer) getAppLocked(ctx context.Context) (types.Application, error) {
+	if d.app != nil {
+		return d.app, nil
+	}
+
+	apps, err := d.client.ListApps(ctx, &proto.ListResourcesRequest{
+		ResourceType:        types.KindAppServer,
+		Namespace:           apidefaults.Namespace,
+		PredicateExpression: fmt.Sprintf("name == %q", strings.TrimSpace(d.appName)),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	switch len(apps) {
+	case 0:
+		return nil, trace.NotFound("no MCP servers found")
+	case 1:
+	default:
+		d.logger.WarnContext(ctx, "multiple appServers found, using the first one")
+	}
+	if !apps[0].IsMCP() {
+		return nil, trace.BadParameter("app %q is not a MCP server", d.appName)
+	}
+
+	d.app = apps[0]
+	d.logger.InfoContext(ctx, "Successfully fetched app",
+		"name", d.app.GetName(),
+		"transport", types.GetMCPServerTransportType(d.app.GetURI()),
+	)
+	return d.app, nil
+}
+
+func (d *MCPServerDialer) getCertLocked(ctx context.Context, mcpServer types.Application) (tls.Certificate, error) {
+	if err := utils.VerifyTLSCertLeafExpiry(d.cert, d.clock); err == nil {
+		return d.cert, nil
+	}
+
+	d.logger.InfoContext(ctx, "Reissuing certificate", "name", mcpServer.GetName())
+	profile, err := d.client.ProfileStatus()
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err)
+	}
+
+	appCertParams := ReissueParams{
+		RouteToCluster: d.client.GetSiteName(),
+		RouteToApp: proto.RouteToApp{
+			Name:        mcpServer.GetName(),
+			PublicAddr:  mcpServer.GetPublicAddr(),
+			ClusterName: d.client.GetSiteName(),
+			URI:         mcpServer.GetURI(),
+		},
+		AccessRequests: profile.ActiveRequests,
+	}
+
+	// Do NOT write the keyring to avoid race condition when AI clients run
+	// multiple tsh at the same time.
+	keyRing, err := d.client.IssueUserCertsWithMFA(ctx, appCertParams)
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err)
+	}
+
+	cert, err := keyRing.AppTLSCert(mcpServer.GetName())
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err)
+	}
+
+	d.logger.InfoContext(ctx, "Successfully issued certificate", "name", mcpServer.GetName())
+	d.cert = cert
+	return d.cert, nil
+}
diff --git a/lib/client/mcp/config/claude.go b/lib/client/mcp/config/claude.go
new file mode 100644
index 0000000000000..5fde90473d8d5
--- /dev/null
+++ b/lib/client/mcp/config/claude.go
@@ -0,0 +1,65 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/gravitational/trace"
+)
+
+// claudeServersKey defines the JSON key used by Claude to store MCP servers
+// config.
+const claudeServersKey = "mcpServers"
+
+// DefaultClaudeConfigPath returns the default path for the Claude Desktop config.
+//
+// https://modelcontextprotocol.io/quickstart/user
+//
+// macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
+// Windows: %APPDATA%\Claude\claude_desktop_config.json
+func DefaultClaudeConfigPath() (string, error) {
+	switch runtime.GOOS {
+	case "darwin", "windows":
+		// os.UserConfigDir:
+		// On Darwin, it returns $HOME/Library/Application Support.
+		// On Windows, it returns %AppData%.
+		configDir, err := os.UserConfigDir()
+		if err != nil {
+			return "", trace.ConvertSystemError(err)
+		}
+		return filepath.Join(configDir, "Claude", "claude_desktop_config.json"), nil
+
+	default:
+		// TODO(greedy52) there is no official Claude Desktop for linux yet. The
+		// unofficial one uses the same path as above.
+		return "", trace.NotImplemented("Claude Desktop is not supported on OS %s", runtime.GOOS)
+	}
+}
+
+// LoadClaudeConfigFromDefaultPath loads the Claude Desktop's config from the
+// default path.
+func LoadClaudeConfigFromDefaultPath() (*FileConfig, error) {
+	configPath, err := DefaultClaudeConfigPath()
+	if err != nil {
+		return nil, trace.Wrap(err, "finding Claude Desktop config path")
+	}
+	config, err := LoadConfigFromFile(configPath, ConfigFormatClaude)
+	return config, trace.Wrap(err)
+}
diff --git a/lib/client/mcp/config/config.go b/lib/client/mcp/config/config.go
new file mode 100644
index 0000000000000..ebe0ea67504db
--- /dev/null
+++ b/lib/client/mcp/config/config.go
@@ -0,0 +1,351 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/tidwall/pretty"
+	"github.com/tidwall/sjson"
+)
+
+// MCPServer contains details to launch an MCP server.
+//
+// https://modelcontextprotocol.io/quickstart/user
+type MCPServer struct {
+	// Command specifies the command to execute.
+	Command string `json:"command"`
+	// Args specifies the arguments for the command.
+	Args []string `json:"args,omitempty"`
+	// Envs specifies extra environment variable.
+	Envs map[string]string `json:"env,omitempty"`
+}
+
+// AddEnv adds an environment variable.
+func (s *MCPServer) AddEnv(name, value string) {
+	if s.Envs == nil {
+		s.Envs = map[string]string{}
+	}
+	s.Envs[name] = value
+}
+
+// GetEnv gets the value of an environment variable.
+func (s *MCPServer) GetEnv(key string) (string, bool) {
+	if s.Envs == nil {
+		return "", false
+	}
+	value, ok := s.Envs[key]
+	return value, ok
+}
+
+// Config represents a MCP servers config.
+//
+// Config preserves unknown fields and ordering from the original JSON when
+// saving, by using the sjson lib.
+//
+// Config functions are not thread-safe.
+type Config struct {
+	mcpServers            map[string]MCPServer
+	configData            []byte
+	isOriginalJSONCompact bool
+	format                ConfigFormat
+}
+
+// NewConfig creates an empty config.
+func NewConfig(format ConfigFormat) *Config {
+	return &Config{
+		mcpServers:            make(map[string]MCPServer),
+		configData:            []byte("{}"),
+		isOriginalJSONCompact: false,
+		format:                format,
+	}
+}
+
+// NewConfigFromJSON creates a config from JSON.
+func NewConfigFromJSON(format ConfigFormat, data []byte) (*Config, error) {
+	var config map[string]json.RawMessage
+	if err := json.Unmarshal(data, &config); err != nil {
+		return nil, trace.Wrap(err, "parsing config")
+	}
+
+	servers := make(map[string]MCPServer)
+	if rawServers, ok := config[format.serversKey()]; ok {
+		if err := json.Unmarshal(rawServers, &servers); err != nil {
+			return nil, trace.Wrap(err, "parsing mcp servers config")
+		}
+	}
+
+	isOriginalJSONCompact, err := isJSONCompact(data)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing mcp servers config")
+	}
+
+	return &Config{
+		mcpServers:            servers,
+		configData:            data,
+		isOriginalJSONCompact: isOriginalJSONCompact,
+		format:                format,
+	}, nil
+}
+
+// GetMCPServers returns a shallow copy of the MCP servers.
+func (c *Config) GetMCPServers() map[string]MCPServer {
+	return maps.Clone(c.mcpServers)
+}
+
+// PutMCPServer adds a new MCP server or replaces an existing one.
+func (c *Config) PutMCPServer(serverName string, server MCPServer) (err error) {
+	c.mcpServers[serverName] = server
+
+	// We require a custom marshal to improve MCP Resources URI readability when
+	// it includes query params. By default the encoding/json escapes some
+	// characters like `&` causing the final URI to be harder to read.
+	var b bytes.Buffer
+	enc := json.NewEncoder(&b)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(server); err != nil {
+		return trace.Wrap(err)
+	}
+	c.configData, err = sjson.SetRawBytes(c.configData, c.mcpServerJSONPath(serverName), b.Bytes())
+	return trace.Wrap(err)
+}
+
+// RemoveMCPServer removes an MCP server by name.
+func (c *Config) RemoveMCPServer(serverName string) (err error) {
+	if _, ok := c.mcpServers[serverName]; !ok {
+		return trace.NotFound("mcp server %v not found", serverName)
+	}
+
+	delete(c.mcpServers, serverName)
+	c.configData, err = sjson.DeleteBytes(c.configData, c.mcpServerJSONPath(serverName))
+	return trace.Wrap(err)
+}
+
+// FormatJSONOption specifies the option on how to format the JSON output.
+type FormatJSONOption string
+
+const (
+	// FormatJSONPretty prettifies the JSON output.
+	FormatJSONPretty FormatJSONOption = "pretty"
+	// FormatJSONCompact minifies the JSON output.
+	FormatJSONCompact FormatJSONOption = "compact"
+	// FormatJSONNone skips formatting.
+	FormatJSONNone FormatJSONOption = "none"
+	// FormatJSONAuto minifies the JSON output if the original JSON is already
+	// minified. Otherwise, the JSON output is prettified. If the original JSON
+	// is "{}", the JSON output is also prettified.
+	FormatJSONAuto FormatJSONOption = "auto"
+)
+
+// ConfigFormat specifies what is the MCP servers configuration format.
+type ConfigFormat string
+
+const (
+	// ConfigFormatUnspecified represents an unspecified format.
+	ConfigFormatUnspecified ConfigFormat = ""
+	// ConfigFormatClaude represents the Claude desktop and Claude Code formats.
+	ConfigFormatClaude ConfigFormat = "claude"
+	// ConfigFormatVSCode represents the VSCode format.
+	ConfigFormatVSCode ConfigFormat = "vscode"
+)
+
+// DefaultConfigFormat determines the dafault config format. This can be used
+// in cases where the format wasn't specified.
+const DefaultConfigFormat = ConfigFormatClaude
+
+// ParseConfigFormat parses configuration format from string.
+func ParseConfigFormat(s string) (ConfigFormat, error) {
+	switch ConfigFormat(s) {
+	case ConfigFormatClaude:
+		return ConfigFormatClaude, nil
+	case ConfigFormatVSCode:
+		return ConfigFormatVSCode, nil
+	case ConfigFormatUnspecified:
+		return ConfigFormatUnspecified, nil
+	}
+
+	return ConfigFormatUnspecified, trace.BadParameter("unsupported %q config format", s)
+}
+
+// IsSpecified returns whether the config format was specified or not.
+func (cf ConfigFormat) IsSpecified() bool {
+	return cf != ConfigFormatUnspecified
+}
+
+// serversKey returns the MCP servers JSON key for the format.
+func (cf ConfigFormat) serversKey() string {
+	switch cf {
+	case ConfigFormatClaude:
+		return claudeServersKey
+	case ConfigFormatVSCode:
+		return vsCodeServersKey
+	default:
+		return ""
+	}
+}
+
+// String returns human readable config format name.
+func (cf ConfigFormat) String() string {
+	switch cf {
+	case ConfigFormatClaude:
+		return "Claude/Cursor"
+	case ConfigFormatVSCode:
+		return "VSCode"
+	default:
+		return "Unspecified"
+	}
+}
+
+// ConfigFormatFromPath tries to determine the config format based on its path.
+func ConfigFormatFromPath(configPath string) ConfigFormat {
+	switch {
+	case pathContains(configPath, vsCodeProjectDir):
+		return ConfigFormatVSCode
+	case pathContains(configPath, cursorProjectDir), pathContains(configPath, claudeCodeFileName):
+		// Works for both, global and projects settings.
+		return ConfigFormatClaude // Cursor uses the same format as Claude.
+	default:
+		return ConfigFormatUnspecified
+	}
+}
+
+func pathContains(path, dir string) bool {
+	return slices.Contains(strings.Split(filepath.Clean(path), string(filepath.Separator)), dir)
+}
+
+// Write writes the config to provided writer.
+func (c *Config) Write(w io.Writer, format FormatJSONOption) error {
+	data, err := c.formatConfigData(format)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = w.Write(data)
+	return trace.Wrap(err)
+}
+
+// FileConfig represents a Config read from a file.
+//
+// Note that outside changes to the config file after LoadConfigFromFile will be
+// ignored when saving.
+type FileConfig struct {
+	*Config
+	configPath   string
+	configExists bool
+}
+
+// LoadConfigFromFile loads the MCP config from the provided path.
+func LoadConfigFromFile(configPath string, format ConfigFormat) (*FileConfig, error) {
+	data, err := os.ReadFile(configPath)
+	switch {
+	case os.IsNotExist(err):
+		return &FileConfig{
+			Config:       NewConfig(format),
+			configPath:   configPath,
+			configExists: false,
+		}, nil
+
+	case err != nil:
+		return nil, trace.Wrap(trace.ConvertSystemError(err), "reading mcp servers config")
+
+	default:
+		config, err := NewConfigFromJSON(format, data)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &FileConfig{
+			Config:       config,
+			configPath:   configPath,
+			configExists: true,
+		}, nil
+	}
+}
+
+// Exists returns true if config file exists.
+func (c *FileConfig) Exists() bool {
+	return c.configExists
+}
+
+// Path returns the config file path.
+func (c *FileConfig) Path() string {
+	return c.configPath
+}
+
+// Save saves the updated config to the config path. Format defaults to "auto"
+// if empty.
+func (c *FileConfig) Save(format FormatJSONOption) error {
+	// Creates the config with 0644.
+	file, err := os.OpenFile(c.configPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	defer file.Close()
+	return trace.Wrap(c.Write(file, format))
+}
+
+func (c *Config) mcpServerJSONPath(serverName string) string {
+	return c.format.serversKey() + "." + serverName
+}
+
+func (c *Config) formatConfigData(format FormatJSONOption) ([]byte, error) {
+	return formatJSON(c.configData, format, c.isOriginalJSONCompact)
+}
+
+func formatJSON(data []byte, format FormatJSONOption, isOriginalCompact bool) ([]byte, error) {
+	switch format {
+	case FormatJSONPretty:
+		// pretty.Pretty is more human-readable than json.Indent.
+		return pretty.Pretty(data), nil
+	case FormatJSONCompact:
+		return pretty.Ugly(data), nil
+	case FormatJSONNone:
+		return data, nil
+	case FormatJSONAuto, "":
+		if isOriginalCompact {
+			return pretty.Ugly(data), nil
+		}
+		return pretty.Pretty(data), nil
+	default:
+		return nil, trace.BadParameter("invalid JSON format option %q", format)
+	}
+}
+
+func isJSONCompact(data []byte) (bool, error) {
+	data = bytes.TrimSpace(data)
+
+	// Do not treat empty object as compact.
+	if bytes.Equal(data, []byte("{}")) {
+		return false, nil
+	}
+
+	var buf bytes.Buffer
+	err := json.Compact(&buf, data)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	return bytes.Equal(buf.Bytes(), data), nil
+}
diff --git a/lib/client/mcp/config/config_test.go b/lib/client/mcp/config/config_test.go
new file mode 100644
index 0000000000000..1cf702376d71e
--- /dev/null
+++ b/lib/client/mcp/config/config_test.go
@@ -0,0 +1,362 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFileConfig_fileNotExists(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.json")
+
+	config, err := LoadConfigFromFile(configPath, ConfigFormatClaude)
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.False(t, config.Exists())
+
+	require.NoError(t, config.PutMCPServer("test", MCPServer{
+		Command: "command",
+	}))
+	require.NoError(t, config.Save(FormatJSONCompact))
+	requireFileWithData(t, configPath, `{"mcpServers":{"test":{"command":"command"}}}`)
+}
+
+func TestFileConfig_sampleFile(t *testing.T) {
+	const sampleConfigJSON = `{
+  "someUnknownField": "someUnknownValue",
+  "mcpServers": {
+    "Puppeteer": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-puppeteer"],
+      "someUnknownField": "someUnknownValue"
+    },
+    "teleport-my-mcp": {
+      "command": "tsh",
+      "args": ["mcp", "connect", "my-mcp"],
+      "env": {
+        "TELEPORT_HOME": "/tsh-home/"
+      }
+    }
+  }
+}
+`
+	var sampleMCPServers = map[string]MCPServer{
+		"Puppeteer": {
+			Command: "npx",
+			Args:    []string{"-y", "@modelcontextprotocol/server-puppeteer"},
+		},
+		"teleport-my-mcp": {
+			Command: "tsh",
+			Args:    []string{"mcp", "connect", "my-mcp"},
+			Envs: map[string]string{
+				"TELEPORT_HOME": "/tsh-home/",
+			},
+		},
+	}
+
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(configPath, []byte(sampleConfigJSON), 0600))
+
+	// load
+	config, err := LoadConfigFromFile(configPath, ConfigFormatClaude)
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.True(t, config.Exists())
+	require.Equal(t, configPath, config.Path())
+	require.Equal(t, sampleMCPServers, config.GetMCPServers())
+
+	// remove
+	require.True(t, trace.IsNotFound(config.RemoveMCPServer("not-found")))
+	require.NoError(t, config.RemoveMCPServer("teleport-my-mcp"))
+	require.NoError(t, config.Save(FormatJSONPretty))
+	requireFileWithData(t, configPath, `{
+  "someUnknownField": "someUnknownValue",
+  "mcpServers": {
+    "Puppeteer": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-puppeteer"],
+      "someUnknownField": "someUnknownValue"
+    }
+  }
+}
+`)
+
+	// add it back
+	require.NoError(t, config.PutMCPServer("teleport-my-mcp", sampleMCPServers["teleport-my-mcp"]))
+	require.NoError(t, config.Save(FormatJSONAuto))
+	requireFileWithData(t, configPath, sampleConfigJSON)
+
+	// replace
+	require.NoError(t, config.PutMCPServer("Puppeteer", MCPServer{
+		Command: "custom-script",
+	}))
+	require.NoError(t, config.Save(""))
+	requireFileWithData(t, configPath, `{
+  "someUnknownField": "someUnknownValue",
+  "mcpServers": {
+    "Puppeteer": {
+      "command": "custom-script"
+    },
+    "teleport-my-mcp": {
+      "command": "tsh",
+      "args": ["mcp", "connect", "my-mcp"],
+      "env": {
+        "TELEPORT_HOME": "/tsh-home/"
+      }
+    }
+  }
+}
+`)
+}
+
+func TestConfig_Write(t *testing.T) {
+	for _, format := range []ConfigFormat{ConfigFormatClaude, ConfigFormatVSCode} {
+		t.Run(format.serversKey(), func(t *testing.T) {
+			config := NewConfig(format)
+
+			mcpServer := MCPServer{
+				Command: "command",
+			}
+			mcpServer.AddEnv("foo", "bar")
+			require.NoError(t, config.PutMCPServer("test", mcpServer))
+			var buf bytes.Buffer
+
+			require.NoError(t, config.Write(&buf, FormatJSONCompact))
+			require.Equal(t, `{"`+format.serversKey()+`":{"test":{"command":"command","env":{"foo":"bar"}}}}`, buf.String())
+		})
+	}
+}
+
+func Test_isJSONCompact(t *testing.T) {
+	tests := []struct {
+		name           string
+		in             string
+		checkError     require.ErrorAssertionFunc
+		checkIsCompact require.BoolAssertionFunc
+	}{
+		{
+			name:           "bad JSON",
+			in:             "{",
+			checkError:     require.Error,
+			checkIsCompact: require.False,
+		},
+		{
+			name:           "empty object",
+			in:             "{}",
+			checkError:     require.NoError,
+			checkIsCompact: require.False,
+		},
+		{
+			name:           "compact",
+			in:             `{"a":"b"}`,
+			checkError:     require.NoError,
+			checkIsCompact: require.True,
+		},
+		{
+			name: "not compact",
+			in: `{
+  "a": "b"
+}`,
+			checkError:     require.NoError,
+			checkIsCompact: require.False,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			isCompact, err := isJSONCompact([]byte(tt.in))
+			tt.checkError(t, err)
+			tt.checkIsCompact(t, isCompact)
+		})
+	}
+}
+
+func Test_formatJSON(t *testing.T) {
+	notFormatted := `{"a":       "b"}`
+	compact := `{"a":"b"}`
+	pretty := `{
+  "a": "b"
+}
+`
+	tests := []struct {
+		name              string
+		in                string
+		format            FormatJSONOption
+		isOriginalCompact bool
+		out               string
+	}{
+		{
+			name:   "to compact",
+			in:     notFormatted,
+			format: FormatJSONCompact,
+			out:    compact,
+		},
+		{
+			name:   "to pretty",
+			in:     notFormatted,
+			format: FormatJSONPretty,
+			out:    pretty,
+		},
+		{
+			name:   "none",
+			in:     notFormatted,
+			format: FormatJSONNone,
+			out:    notFormatted,
+		},
+		{
+			name:              "auto compact",
+			in:                notFormatted,
+			format:            FormatJSONAuto,
+			isOriginalCompact: true,
+			out:               compact,
+		},
+		{
+			name:              "auto pretty",
+			in:                notFormatted,
+			format:            FormatJSONAuto,
+			isOriginalCompact: false,
+			out:               pretty,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			formatted, err := formatJSON([]byte(tt.in), tt.format, tt.isOriginalCompact)
+			require.NoError(t, err)
+			require.Equal(t, tt.out, string(formatted))
+		})
+	}
+}
+
+// TestPrettyResourceURIs given a MCP server that includes a Resource URI as
+// arguments it must encode and output those URIs in a readable format.
+func TestReadableResourceURIs(t *testing.T) {
+	for name, uri := range map[string]string{
+		"uri with query params":    "teleport://clusters/root/databases/pg",
+		"uri without query params": "teleport://clusters/root/databases/pg?dbName=postgres&dbUser=readonly",
+		"random uri with params":   "teleport://random?hello=world&random=resource",
+	} {
+		t.Run(name, func(t *testing.T) {
+			config := NewConfig(claudeServersKey)
+			mcpServer := MCPServer{
+				Command: "command",
+				Args:    []string{uri},
+			}
+			require.NoError(t, config.PutMCPServer("test", mcpServer))
+
+			var buf bytes.Buffer
+			require.NoError(t, config.Write(&buf, FormatJSONCompact))
+			require.Contains(t, buf.String(), uri)
+		})
+	}
+}
+
+func TestReadDifferentConfigFormats(t *testing.T) {
+	fileNamePathWithDir := func(dir, fileName string) func(*testing.T, string) string {
+		return func(t *testing.T, basePath string) string {
+			path := filepath.Join(basePath, dir)
+			require.NoError(t, os.Mkdir(path, 0700))
+			return filepath.Join(path, fileName)
+		}
+	}
+
+	fileNamePath := func(fileName string) func(*testing.T, string) string {
+		return func(t *testing.T, basePath string) string {
+			return filepath.Join(basePath, fileName)
+		}
+	}
+
+	for name, tc := range map[string]struct {
+		filePath     func(*testing.T, string) string
+		contents     string
+		expectErr    require.ErrorAssertionFunc
+		expectConfig require.ValueAssertionFunc
+	}{
+		"vscode": {
+			filePath:  fileNamePathWithDir(vsCodeProjectDir, "mcp.json"),
+			contents:  `{"servers":{"everything": {"command": "npx", "args": []}}}`,
+			expectErr: require.NoError,
+			expectConfig: func(tt require.TestingT, i1 any, i2 ...any) {
+				config := i1.(*FileConfig)
+				servers := config.GetMCPServers()
+
+				srv, ok := servers["everything"]
+				require.True(tt, ok, `expected config to have "everything" mcp server configured`)
+				require.Equal(tt, "npx", srv.Command)
+			},
+		},
+		"cursor": {
+			filePath:  fileNamePathWithDir(cursorProjectDir, "mcp.json"),
+			contents:  `{"mcpServers":{"everything": {"command": "npx", "args": []}}}`,
+			expectErr: require.NoError,
+			expectConfig: func(tt require.TestingT, i1 any, i2 ...any) {
+				config := i1.(*FileConfig)
+				servers := config.GetMCPServers()
+
+				srv, ok := servers["everything"]
+				require.True(tt, ok, `expected config to have "everything" mcp server configured`)
+				require.Equal(tt, "npx", srv.Command)
+			},
+		},
+		"claude-code": {
+			filePath:  fileNamePath(".mcp.json"),
+			contents:  `{"mcpServers":{"everything": {"command": "npx", "args": []}}}`,
+			expectErr: require.NoError,
+			expectConfig: func(tt require.TestingT, i1 any, i2 ...any) {
+				config := i1.(*FileConfig)
+				servers := config.GetMCPServers()
+
+				srv, ok := servers["everything"]
+				require.True(tt, ok, `expected config to have "everything" mcp server configured`)
+				require.Equal(tt, "npx", srv.Command)
+			},
+		},
+		"empty config": {
+			filePath:     fileNamePath("file.json"),
+			contents:     ``,
+			expectErr:    require.Error,
+			expectConfig: require.Nil,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			configPath := tc.filePath(t, t.TempDir())
+			require.NoError(t, os.WriteFile(configPath, []byte(tc.contents), 0600))
+
+			format := ConfigFormatFromPath(configPath)
+			config, err := LoadConfigFromFile(configPath, format)
+			tc.expectErr(t, err)
+			tc.expectConfig(t, config)
+		})
+	}
+}
+
+func requireFileWithData(t *testing.T, path string, want string) {
+	t.Helper()
+	read, err := os.ReadFile(path)
+	require.NoError(t, err)
+	require.Equal(t, want, string(read))
+}
diff --git a/lib/client/mcp/config/cursor.go b/lib/client/mcp/config/cursor.go
new file mode 100644
index 0000000000000..30fdaa6240afc
--- /dev/null
+++ b/lib/client/mcp/config/cursor.go
@@ -0,0 +1,55 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package config
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/gravitational/trace"
+)
+
+const (
+	// cursorProjectDir defines the Cursor project directory, where the MCP
+	// configuration is located.
+	//
+	// https://docs.cursor.com/en/context/mcp#configuration-locations
+	cursorProjectDir = ".cursor"
+)
+
+// GlobalCursorPath returns the default path for Cursor global MCP configuration.
+//
+// https://docs.cursor.com/context/mcp#configuration-locations
+func GlobalCursorPath() (string, error) {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return filepath.Join(homeDir, ".cursor", "mcp.json"), nil
+}
+
+// LoadConfigFromGlobalCursor loads the Cursor global MCP server configuration.
+func LoadConfigFromGlobalCursor() (*FileConfig, error) {
+	configPath, err := GlobalCursorPath()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config, err := LoadConfigFromFile(configPath, ConfigFormatClaude)
+	return config, trace.Wrap(err)
+}
diff --git a/lib/client/mcp/config/vscode.go b/lib/client/mcp/config/vscode.go
new file mode 100644
index 0000000000000..6e08d4379e060
--- /dev/null
+++ b/lib/client/mcp/config/vscode.go
@@ -0,0 +1,34 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package config
+
+const (
+	// vsCodeServersKey defines the JSON key used by VSCode to store MCP servers
+	// config.
+	//
+	// https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_manage-mcp-servers
+	vsCodeServersKey = "servers"
+	// vsCodeProjectDir defines the VSCode project directory, where the MCP
+	// configuration is located.
+	//
+	// https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_manage-mcp-servers
+	vsCodeProjectDir = ".vscode"
+	// claudeCodeFileName defines the Claude Code MCP servers file.
+	//
+	// https://docs.claude.com/en/docs/claude-code/mcp#project-scope
+	claudeCodeFileName = ".mcp.json"
+)
diff --git a/lib/client/mcp/errors.go b/lib/client/mcp/errors.go
new file mode 100644
index 0000000000000..969a4297e23be
--- /dev/null
+++ b/lib/client/mcp/errors.go
@@ -0,0 +1,84 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"syscall"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+const (
+	// ReloginRequiredErrorMessage is the message returned to the MCP client
+	// when the tsh session expired.
+	ReloginRequiredErrorMessage = `It looks like your Teleport session expired,
+you must relogin (using "tsh login" on a terminal) before continue using this
+tool. After that, there is no need to update or relaunch the MCP client - just
+try using it again.`
+)
+
+// IsLikelyTemporaryNetworkError returns true if the error is likely a temporary
+// network error.
+func IsLikelyTemporaryNetworkError(err error) bool {
+	if trace.IsConnectionProblem(err) ||
+		isTemporarySyscallNetError(err) {
+		return true
+	}
+
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		return dnsErr.Temporary()
+	}
+
+	var netErr net.Error
+	if errors.As(err, &netErr) {
+		return netErr.Timeout()
+	}
+
+	return false
+}
+
+func isTemporarySyscallNetError(err error) bool {
+	return errors.Is(err, syscall.EHOSTUNREACH) ||
+		errors.Is(err, syscall.ENETUNREACH) ||
+		errors.Is(err, syscall.ETIMEDOUT) ||
+		errors.Is(err, syscall.ECONNREFUSED)
+}
+
+// IsServerInfoChangedError returns true if the error indicates the remote MCP
+// server's info has changed from previous connections. Auto-reconnection
+// reports this scenario as an error case to be on the safe side in case things
+// like tools have changed.
+func IsServerInfoChangedError(err error) bool {
+	var serverInfoChangedError *serverInfoChangedError
+	return errors.As(err, &serverInfoChangedError)
+}
+
+type serverInfoChangedError struct {
+	expectedInfo mcp.Implementation
+	currentInfo  mcp.Implementation
+}
+
+func (e *serverInfoChangedError) Error() string {
+	return fmt.Sprintf("server info has changed, expected %v, got %v", e.expectedInfo, e.currentInfo)
+}
diff --git a/lib/client/mcp/errors_test.go b/lib/client/mcp/errors_test.go
new file mode 100644
index 0000000000000..86e11d1cf8a29
--- /dev/null
+++ b/lib/client/mcp/errors_test.go
@@ -0,0 +1,40 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsServerInfoChangedError(t *testing.T) {
+	err := &serverInfoChangedError{
+		expectedInfo: mcp.Implementation{
+			Name:    "i-am-mcp",
+			Version: "1.0.0",
+		},
+		currentInfo: mcp.Implementation{
+			Name:    "i-am-mcp",
+			Version: "1.1.0",
+		},
+	}
+	require.True(t, IsServerInfoChangedError(err))
+}
diff --git a/lib/client/mcp/reconnect.go b/lib/client/mcp/reconnect.go
new file mode 100644
index 0000000000000..e2bc800c38fc4
--- /dev/null
+++ b/lib/client/mcp/reconnect.go
@@ -0,0 +1,428 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"sync"
+
+	"github.com/gravitational/trace"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+// ProxyStdioConnConfig is the config for ProxyStdioConn.
+type ProxyStdioConnConfig struct {
+	// ClientStdio is the client stdin and stdout.
+	ClientStdio io.ReadWriteCloser
+	// MakeReconnectUserMessage generates a user-friendly message based on the
+	// error.
+	MakeReconnectUserMessage func(error) string
+	// DialServer makes a new connection to the remote MCP server.
+	DialServer func(context.Context) (net.Conn, error)
+	// GetApp returns the MCP application.
+	GetApp func(context.Context) (types.Application, error)
+	// AutoReconnect attempts to re-establish new MCP sessions with the remote
+	// server when encounter connection issues.
+	AutoReconnect bool
+	// HTTPHeaders defines extra custom headers for HTTP transports.
+	HTTPHeaders map[string]string
+
+	// Logger is the slog logger.
+	Logger *slog.Logger
+
+	// clientResponseWriter replies to ClientStdio.
+	clientResponseWriter mcputils.MessageWriter
+	// onServerConnClosed is a callback when remote server connection is dead.
+	onServerConnClosed func()
+}
+
+// CheckAndSetDefaults validates the config and sets default values.
+func (cfg *ProxyStdioConnConfig) CheckAndSetDefaults() error {
+	if cfg.ClientStdio == nil {
+		return trace.BadParameter("missing ClientStdio")
+	}
+	if cfg.GetApp == nil {
+		return trace.BadParameter("missing GetApp")
+	}
+	if cfg.DialServer == nil {
+		return trace.BadParameter("missing DialServer")
+	}
+	if cfg.MakeReconnectUserMessage == nil {
+		cfg.MakeReconnectUserMessage = func(err error) string {
+			return err.Error()
+		}
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentMCP, "autoreconnect"),
+		)
+	}
+	if cfg.clientResponseWriter == nil {
+		cfg.clientResponseWriter = mcputils.NewSyncStdioMessageWriter(cfg.ClientStdio)
+	}
+	return nil
+}
+
+// ProxyStdioConn serves a stdio client and handles transport conversion to
+// the remote MCP servers. When AutoConnect is set, it also reconnects to the
+// remote server with new MCP sessions upon connection issues.
+func ProxyStdioConn(ctx context.Context, cfg ProxyStdioConnConfig) error {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	serverConn, err := newServerConnWithAutoReconnect(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer serverConn.Close()
+
+	clientRequestReader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport:    mcputils.NewStdioReader(cfg.ClientStdio),
+		Logger:       cfg.Logger.With("client", "stdin"),
+		OnParseError: mcputils.ReplyParseError(cfg.clientResponseWriter),
+		OnNotification: func(ctx context.Context, notification *mcputils.JSONRPCNotification) error {
+			// By spec, we should not reply to notifications. Try our best to
+			// send a notification with the error message. In practice, only the
+			// initialize notification is sent from client after receiving the
+			// initialize response so it's unlikely to hit here.
+			if writeError := serverConn.WriteMessage(ctx, notification); writeError != nil {
+				if serverConn.shouldExitOnWriteError() {
+					return trace.Wrap(writeError)
+				}
+				cfg.Logger.WarnContext(ctx, "failed to write notification to server. Notification is dropped.", "error", writeError)
+				userMessage := cfg.MakeReconnectUserMessage(writeError)
+				errNotification := mcp.Notification{
+					Method: "notifications/tsherr",
+					Params: mcp.NotificationParams{
+						AdditionalFields: map[string]any{
+							"error": fmt.Sprintf("Notification %q was dropped. %s", notification.Method, userMessage),
+						},
+					},
+				}
+				return trace.Wrap(cfg.clientResponseWriter.WriteMessage(ctx, errNotification))
+			}
+			return nil
+		},
+		OnRequest: func(ctx context.Context, request *mcputils.JSONRPCRequest) error {
+			if writeError := serverConn.WriteMessage(ctx, request); writeError != nil {
+				if serverConn.shouldExitOnWriteError() {
+					return trace.Wrap(writeError)
+				}
+				cfg.Logger.WarnContext(ctx, "failed to write request to server", "error", writeError)
+				userMessage := cfg.MakeReconnectUserMessage(writeError)
+				errResp := mcp.NewJSONRPCError(request.ID, mcp.INTERNAL_ERROR, userMessage, writeError)
+				return trace.Wrap(cfg.clientResponseWriter.WriteMessage(ctx, errResp))
+			}
+			return nil
+		},
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	clientRequestReader.Run(ctx)
+	return nil
+
+}
+
+type serverConnWithAutoReconnect struct {
+	ProxyStdioConnConfig
+	closeCtx       context.Context
+	closeCtxCancel context.CancelFunc
+
+	mu                  sync.Mutex
+	serverMessageWriter mcputils.MessageWriter
+	serverMessageReader *mcputils.MessageReader
+	firstConnectionDone bool
+	initRequest         *mcputils.JSONRPCRequest
+	initResponse        *mcp.InitializeResult
+	initNotification    *mcputils.JSONRPCNotification
+}
+
+func newServerConnWithAutoReconnect(parentCtx context.Context, cfg ProxyStdioConnConfig) (*serverConnWithAutoReconnect, error) {
+	closeCtx, closeCtxCancel := context.WithCancel(parentCtx)
+	return &serverConnWithAutoReconnect{
+		ProxyStdioConnConfig: cfg,
+		closeCtx:             closeCtx,
+		closeCtxCancel:       closeCtxCancel,
+	}, nil
+}
+
+func (r *serverConnWithAutoReconnect) Close() error {
+	r.Logger.InfoContext(r.closeCtx, "Closing server connection")
+
+	r.mu.Lock()
+	r.closeCtxCancel()
+	if r.serverMessageReader == nil {
+		r.mu.Unlock()
+		return nil
+	}
+
+	// Wait without lock.
+	wait := r.serverMessageReader.Done()
+	r.mu.Unlock()
+	<-wait
+	return nil
+}
+
+func (r *serverConnWithAutoReconnect) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	writer, err := r.getServerRequestWriterLocked(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(writer.WriteMessage(ctx, msg))
+}
+
+func (r *serverConnWithAutoReconnect) makeServerTransport(ctx context.Context) (mcputils.TransportReader, mcputils.MessageWriter, error) {
+	r.Logger.InfoContext(ctx, "Making new transport to server")
+	app, err := r.GetApp(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	switch types.GetMCPServerTransportType(app.GetURI()) {
+	case types.MCPTransportHTTP:
+		transport, err := defaults.Transport()
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		transport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return r.DialServer(ctx)
+		}
+		httpReaderWriter, err := mcputils.NewHTTPReaderWriter(
+			r.closeCtx,
+			"http://localhost", // does not matter with the custom transport.
+			mcpclienttransport.WithHTTPBasicClient(&http.Client{
+				Transport: transport,
+			}),
+			mcpclienttransport.WithContinuousListening(),
+			mcpclienttransport.WithHTTPHeaders(r.HTTPHeaders),
+		)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		return httpReaderWriter, httpReaderWriter, nil
+
+	default:
+		serverConn, err := r.DialServer(ctx)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		return mcputils.NewStdioReader(serverConn),
+			mcputils.NewStdioMessageWriter(serverConn),
+			nil
+	}
+}
+
+func (r *serverConnWithAutoReconnect) canRetryLocked() bool {
+	// We are closed, no retry.
+	if r.closeCtx.Err() != nil {
+		return false
+	}
+
+	// When auto-reconnect is on, always retry without exiting.
+	// When auto-reconnect is off, see if we have made the first connection yet.
+	// If not, we could retry until the first connection is established.
+	return r.AutoReconnect || !r.firstConnectionDone
+}
+
+func (r *serverConnWithAutoReconnect) shouldExitOnWriteError() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	// just exit if we cannot retry.
+	return !r.canRetryLocked()
+}
+
+func (r *serverConnWithAutoReconnect) getServerRequestWriterLocked(ctx context.Context) (mcputils.MessageWriter, error) {
+	if r.serverMessageWriter != nil {
+		return r.serverMessageWriter, nil
+	}
+
+	if !r.canRetryLocked() {
+		// We shouldn't hit here as the proxy should have been ended.
+		// Double-check just in case.
+		return nil, trace.Errorf("mcp session finished")
+	}
+
+	serverTransportReader, serverWriter, err := r.makeServerTransport(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if r.firstConnectionDone {
+		// Replay initialize sequence. Any error here is likely permanent.
+		if err := r.replayInitializeLocked(ctx, serverTransportReader, serverWriter); err != nil {
+			serverTransportReader.Close()
+			return nil, trace.Wrap(err)
+		}
+		r.serverMessageWriter = serverWriter
+	} else {
+		r.serverMessageWriter = mcputils.NewMultiMessageWriter(
+			mcputils.MessageWriterFunc(func(ctx context.Context, msg mcp.JSONRPCMessage) error {
+				r.cacheMessageLocked(ctx, msg)
+				return nil
+			}),
+			serverWriter,
+		)
+		r.firstConnectionDone = true
+	}
+
+	// This should never fail as long the correct config is passed in.
+	r.serverMessageReader, err = mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport: serverTransportReader,
+		// OnClose is called when server connection is dead or if any handler
+		// fails. Teleport Proxy automatically closes the connection when tsh
+		// session is expired.
+		OnClose: func() {
+			r.mu.Lock()
+			if r.canRetryLocked() {
+				r.Logger.InfoContext(ctx, "Lost server session, resetting...")
+			} else {
+				r.Logger.InfoContext(ctx, "Lost server session, closing...")
+				r.ClientStdio.Close()
+			}
+			r.serverMessageWriter = nil
+			if r.onServerConnClosed != nil {
+				r.onServerConnClosed()
+			}
+			r.mu.Unlock()
+		},
+		Logger:       r.Logger.With("server", "stdout"),
+		OnParseError: mcputils.LogAndIgnoreParseError(r.Logger),
+		OnNotification: func(ctx context.Context, notification *mcputils.JSONRPCNotification) error {
+			return trace.Wrap(r.clientResponseWriter.WriteMessage(ctx, notification))
+		},
+		OnResponse: func(ctx context.Context, response *mcputils.JSONRPCResponse) error {
+			r.cacheMessageLocked(ctx, response)
+			return trace.Wrap(r.clientResponseWriter.WriteMessage(ctx, response))
+		},
+	})
+	if err != nil {
+		serverTransportReader.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	go r.serverMessageReader.Run(r.closeCtx)
+
+	r.Logger.InfoContext(ctx, "Started a new MCP server connection")
+	return r.serverMessageWriter, nil
+}
+
+func (r *serverConnWithAutoReconnect) initializedLocked() bool {
+	return r.initRequest != nil && r.initResponse != nil && r.initNotification != nil
+}
+
+func (r *serverConnWithAutoReconnect) replayInitializeLocked(ctx context.Context, serverReader mcputils.TransportReader, serverWriter mcputils.MessageWriter) error {
+	if !r.initializedLocked() {
+		return trace.Errorf("client has not initialized yet")
+	}
+
+	r.Logger.DebugContext(ctx, "Replaying initialize request")
+	if err := serverWriter.WriteMessage(ctx, r.initRequest); err != nil {
+		return trace.Wrap(err)
+	}
+
+	r.Logger.DebugContext(ctx, "Reading and comparing initialize response")
+	msg, err := mcputils.ReadOneResponse(ctx, serverReader)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := r.checkReplyResponseLocked(msg); err != nil {
+		return trace.Wrap(err)
+	}
+
+	r.Logger.DebugContext(ctx, "Replaying initialized notification")
+	if err := serverWriter.WriteMessage(ctx, r.initNotification); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (r *serverConnWithAutoReconnect) checkReplyResponseLocked(msg mcp.JSONRPCMessage) error {
+	resp, ok := msg.(*mcputils.JSONRPCResponse)
+	if !ok {
+		return trace.Errorf("expected initialize response, got %T", resp)
+	}
+	if resp.Error != nil {
+		return trace.Errorf("expected initialize result but got error")
+	}
+	if resp.ID.String() != r.initRequest.ID.String() {
+		return trace.CompareFailed("expected initialize response with ID %s, got %s", r.initRequest.ID, resp.ID.String())
+	}
+
+	newResult, err := resp.GetInitializeResult()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if newResult.ServerInfo != r.initResponse.ServerInfo {
+		return trace.Wrap(&serverInfoChangedError{
+			expectedInfo: r.initResponse.ServerInfo,
+			currentInfo:  newResult.ServerInfo,
+		})
+	}
+	return nil
+}
+
+// cacheMessageLocked caches client init request and notification.
+func (r *serverConnWithAutoReconnect) cacheMessageLocked(ctx context.Context, msg mcp.JSONRPCMessage) {
+	if r.initializedLocked() {
+		return
+	}
+
+	switch m := msg.(type) {
+	case *mcputils.JSONRPCRequest:
+		if r.initRequest == nil && m.Method == mcputils.MethodInitialize {
+			r.initRequest = m
+			r.Logger.DebugContext(ctx, "Cached initialize", "request", m)
+		}
+	case *mcputils.JSONRPCNotification:
+		if r.initNotification == nil && m.Method == mcputils.MethodNotificationInitialized {
+			r.initNotification = m
+			r.Logger.DebugContext(ctx, "Cached notification", "notification", m)
+		}
+	case *mcputils.JSONRPCResponse:
+		if r.initResponse == nil && r.initRequest != nil && r.initRequest.ID.String() == m.ID.String() {
+			initResponse, err := m.GetInitializeResult()
+			if err != nil {
+				r.Logger.DebugContext(ctx, "Error parsing init response", "error", err)
+			} else {
+				r.initResponse = initResponse
+				r.Logger.DebugContext(ctx, "Cached response", "response", m)
+			}
+		}
+	}
+}
diff --git a/lib/client/mcp/reconnect_test.go b/lib/client/mcp/reconnect_test.go
new file mode 100644
index 0000000000000..ab6702a968691
--- /dev/null
+++ b/lib/client/mcp/reconnect_test.go
@@ -0,0 +1,261 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	listenerutils "github.com/gravitational/teleport/lib/utils/listener"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+func TestProxyStdioConn_autoReconnect(t *testing.T) {
+	ctx := t.Context()
+	app := newAppFromURI(t, "some-mcp", "mcp+stdio://")
+
+	var serverStdioSource atomic.Value
+	prepServerWithVersion := func(version string) {
+		testServerV1 := mcptest.NewServerWithVersion(version)
+		testServerSource, testServerDest := mustMakeConnPair(t)
+		serverStdioSource.Store(testServerSource)
+		go func() {
+			mcpserver.NewStdioServer(testServerV1).Listen(t.Context(), testServerDest, testServerDest)
+		}()
+	}
+	prepServerWithVersion("1.0.0")
+
+	clientStdioSource, clientStdioDest := mustMakeConnPair(t)
+	stdioClient := mcptest.NewStdioClientFromConn(t, clientStdioSource)
+	proxyError := make(chan error, 1)
+	serverConnClosed := make(chan struct{}, 1)
+
+	// Start proxy.
+	go func() {
+		proxyError <- ProxyStdioConn(ctx, ProxyStdioConnConfig{
+			ClientStdio: clientStdioDest,
+			GetApp: func(ctx context.Context) (types.Application, error) {
+				return app, nil
+			},
+			DialServer: func(ctx context.Context) (net.Conn, error) {
+				return serverStdioSource.Load().(net.Conn), nil
+			},
+			AutoReconnect: true,
+			onServerConnClosed: func() {
+				serverConnClosed <- struct{}{}
+			},
+		})
+	}()
+
+	// Initialize.
+	mcptest.MustInitializeClient(t, stdioClient)
+
+	// Call tool success.
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Let's kill the server, CallTool should fail.
+	serverStdioSource.Load().(io.ReadWriteCloser).Close()
+	select {
+	case <-serverConnClosed:
+	case <-time.After(time.Second * 5):
+		t.Fatal("timed out waiting for server connection to close")
+	}
+	_, err := mcptest.CallServerTool(ctx, stdioClient)
+	require.ErrorContains(t, err, "on closed pipe")
+
+	// Let it try again with a successful reconnect.
+	prepServerWithVersion("1.0.0")
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Let's kill the server again, and prepare a different version.
+	serverStdioSource.Load().(io.ReadWriteCloser).Close()
+	select {
+	case <-serverConnClosed:
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for server connection to close")
+	}
+	prepServerWithVersion("2.0.0")
+	_, err = mcptest.CallServerTool(ctx, stdioClient)
+	require.ErrorContains(t, err, "server info has changed")
+
+	// Cleanup.
+	clientStdioSource.Close()
+	select {
+	case proxyErr := <-proxyError:
+		require.NoError(t, proxyErr)
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for proxy to complete")
+	}
+}
+
+func TestProxyStdioConn_http(t *testing.T) {
+	ctx := t.Context()
+	app := newAppFromURI(t, "some-mcp", "mcp+http://127.0.0.1:8888/mcp")
+
+	// Remote MCP server.
+	mcpServer := mcpserver.NewStreamableHTTPServer(mcptest.NewServer())
+	listener := listenerutils.NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+	var receivedSessionEnd atomic.Bool
+	go http.Serve(listener, http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		if req.Method == http.MethodDelete {
+			receivedSessionEnd.Store(true)
+		}
+		mcpServer.ServeHTTP(rw, req)
+	}))
+
+	// Start proxy.
+	clientStdioSource, clientStdioDest := mustMakeConnPair(t)
+	proxyError := make(chan error, 1)
+	go func() {
+		proxyError <- ProxyStdioConn(ctx, ProxyStdioConnConfig{
+			ClientStdio: clientStdioDest,
+			GetApp: func(ctx context.Context) (types.Application, error) {
+				return app, nil
+			},
+			DialServer: func(ctx context.Context) (net.Conn, error) {
+				return listener.DialContext(ctx, "tcp", "")
+			},
+			AutoReconnect: true,
+		})
+	}()
+
+	// Local stdio client.
+	stdioClient := mcptest.NewStdioClientFromConn(t, clientStdioSource)
+	mcptest.MustInitializeClient(t, stdioClient)
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Shut down.
+	stdioClient.Close()
+	select {
+	case proxyErr := <-proxyError:
+		require.NoError(t, proxyErr)
+
+		// Make sure the transport has sent out "session end" message before
+		// ProxyStdioConn returns.
+		assert.True(t, receivedSessionEnd.Load())
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for proxy to complete")
+	}
+}
+
+func TestProxyStdioConn_autoReconnectDisabled(t *testing.T) {
+	ctx := t.Context()
+	app := newAppFromURI(t, "some-mcp", "mcp+stdio://")
+
+	var mcpServerConnCount atomic.Uint32
+	var mcpServerConn atomic.Value
+	listener := listenerutils.NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			mcpServerConnCount.Add(1)
+			mcpServerConn.Store(conn)
+			go mcpserver.NewStdioServer(mcptest.NewServer()).Listen(t.Context(), conn, conn)
+		}
+	}()
+
+	// Start proxy.
+	clientStdioSource, clientStdioDest := mustMakeConnPair(t)
+	serverConnClosed := make(chan struct{}, 1)
+	proxyError := make(chan error, 1)
+	go func() {
+		proxyError <- ProxyStdioConn(ctx, ProxyStdioConnConfig{
+			ClientStdio: clientStdioDest,
+			GetApp: func(ctx context.Context) (types.Application, error) {
+				return app, nil
+			},
+			DialServer: func(ctx context.Context) (net.Conn, error) {
+				return listener.DialContext(ctx, "tcp", "")
+			},
+			AutoReconnect: false,
+			onServerConnClosed: func() {
+				serverConnClosed <- struct{}{}
+			},
+		})
+	}()
+
+	// Local stdio client.
+	stdioClient := mcptest.NewStdioClientFromConn(t, clientStdioSource)
+	mcptest.MustInitializeClient(t, stdioClient)
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Let's kill the server conn.
+	connCloser, ok := mcpServerConn.Load().(io.Closer)
+	require.True(t, ok)
+	require.NoError(t, connCloser.Close())
+	select {
+	case <-serverConnClosed:
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for server connection to close")
+	}
+
+	// Check proxy has ended.
+	select {
+	case proxyErr := <-proxyError:
+		require.NoError(t, proxyErr)
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for proxy to complete")
+	}
+
+	// New request should fail and no retry is performed.
+	_, err := mcptest.CallServerTool(t.Context(), stdioClient)
+	require.ErrorContains(t, err, "on closed pipe")
+	require.Equal(t, uint32(1), mcpServerConnCount.Load())
+}
+
+func mustMakeConnPair(t *testing.T) (net.Conn, net.Conn) {
+	t.Helper()
+	source, dest := net.Pipe()
+	t.Cleanup(func() {
+		source.Close()
+		dest.Close()
+	})
+	return source, dest
+}
+
+func newAppFromURI(t *testing.T, name, uri string) types.Application {
+	t.Helper()
+	spec := types.AppSpecV3{
+		URI: uri,
+	}
+	if types.GetMCPServerTransportType(uri) == types.MCPTransportStdio {
+		spec.MCP = &types.MCP{
+			Command:       "test",
+			RunAsHostUser: "test",
+		}
+	}
+	app, err := types.NewAppV3(types.Metadata{Name: name}, spec)
+	require.NoError(t, err)
+	return app
+}
diff --git a/lib/client/mcp/uri.go b/lib/client/mcp/uri.go
new file mode 100644
index 0000000000000..c9337096d73a2
--- /dev/null
+++ b/lib/client/mcp/uri.go
@@ -0,0 +1,202 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/ucarion/urlpath"
+)
+
+var (
+	// clusterURITemplate is the base cluster template.
+	clusterURITemplate = urlpath.New("/clusters/:cluster/*")
+	// databaseURITemplate template used to parse database resource URIs.
+	databaseURITemplate = urlpath.New("/clusters/:cluster/databases/:dbName")
+)
+
+const (
+	// resourceScheme scheme used by Teleport MCP resources.
+	resourceScheme = "teleport"
+
+	// databaseNameQueryParamName is the query param name used for database
+	// name.
+	databaseNameQueryParamName = "dbName"
+	// databaseUserQueryParamName is the query param name used for database
+	// user.
+	databaseUserQueryParamName = "dbUser"
+)
+
+// ResourceURI is a Teleport MCP resource URI.
+//
+// Query parameters are not covered on the MCP spec but we use them to provide
+// additional information about the resource connection. For example, if the
+// resource requires a "username" value, this value is provided using the query
+// params.
+//
+// https://modelcontextprotocol.io/docs/concepts/resources#resource-uris
+type ResourceURI struct {
+	url url.URL
+}
+
+// ParseResourceURI parses a raw resource URI into a Teleport URI.
+func ParseResourceURI(uri string) (*ResourceURI, error) {
+	parsedURL, err := url.Parse(uri)
+	if err != nil {
+		return nil, trace.BadParameter("invalid resource URI format: %s", err)
+	}
+
+	if parsedURL.Scheme != resourceScheme {
+		return nil, trace.BadParameter("invalid URI scheme, must be %q", resourceScheme)
+	}
+
+	return &ResourceURI{url: *parsedURL}, nil
+}
+
+// databaseParams represents the connect params for the database resource.
+type databaseParams struct {
+	// user is the user to log in as.
+	user string
+	// name is the name to log in to.
+	name string
+}
+
+// databaseParam is a param function used for setting database connect params.
+type databaseParam func(*databaseParams)
+
+// WithDatabaseUser configures database params with database user.
+func WithDatabaseUser(user string) databaseParam {
+	return func(dp *databaseParams) {
+		dp.user = user
+	}
+}
+
+// WithDatabaseUser configures database params with database name.
+func WithDatabaseName(name string) databaseParam {
+	return func(dp *databaseParams) {
+		dp.name = name
+	}
+}
+
+// NewDatabaseResourceURI creates a new database resource URI with connect
+// params.
+func NewDatabaseResourceURI(cluster string, databaseName string, opts ...databaseParam) ResourceURI {
+	params := &databaseParams{}
+	for _, opt := range opts {
+		opt(params)
+	}
+
+	pathWithHost, _ := databaseURITemplate.Build(urlpath.Match{
+		Params: map[string]string{
+			"cluster": cluster,
+			"dbName":  databaseName,
+		},
+	})
+
+	values := url.Values{}
+	if params.user != "" {
+		values.Add(databaseUserQueryParamName, params.user)
+	}
+	if params.name != "" {
+		values.Add(databaseNameQueryParamName, params.name)
+	}
+
+	return ResourceURI{
+		url: url.URL{
+			Scheme:   resourceScheme,
+			Path:     strings.TrimPrefix(pathWithHost, "/"),
+			RawQuery: values.Encode(),
+		},
+	}
+}
+
+// GetDatabaseServiceName returns the Teleport cluster name.
+func (u ResourceURI) GetClusterName() string {
+	if match, ok := clusterURITemplate.Match(u.path()); ok {
+		return match.Params["cluster"]
+	}
+
+	return ""
+}
+
+// GetDatabaseServiceName returns the database service name of the resource.
+// Returns empty if the resource is not a database.
+func (u ResourceURI) GetDatabaseServiceName() string {
+	if match, ok := databaseURITemplate.Match(u.path()); ok {
+		return match.Params["dbName"]
+	}
+
+	return ""
+}
+
+// GetDatabaseUser returns the database username param of the resource.
+// Returns empty if the resource is not a database.
+func (u ResourceURI) GetDatabaseUser() string {
+	return u.url.Query().Get(databaseUserQueryParamName)
+}
+
+// GetDatabaseName returns the database name param of the resource.
+// Returns empty if the resource is not a database.
+func (u ResourceURI) GetDatabaseName() string {
+	return u.url.Query().Get(databaseNameQueryParamName)
+}
+
+// IsDatabase returns true if the resource is a database.
+func (u ResourceURI) IsDatabase() bool {
+	return u.GetDatabaseServiceName() != ""
+}
+
+// String returns the string representation of the resource URI.
+func (u ResourceURI) String() string {
+	return u.url.String()
+}
+
+// WithoutParams returns a copy of the resource without additional parameters.
+func (u ResourceURI) WithoutParams() ResourceURI {
+	copyURL := u.url
+	copyURL.RawQuery = ""
+	return ResourceURI{url: copyURL}
+}
+
+// Equal returns true if both resources represent the same Teleport resource.
+func (u ResourceURI) Equal(b ResourceURI) bool {
+	return u.String() == b.String()
+}
+
+// path returns the resource URI full path. We must include the hostname as the
+// templates will also include them on the matching.
+func (u ResourceURI) path() string {
+	return "/" + u.url.Hostname() + u.url.Path
+}
+
+// IsDatabase returns true if the URI is a database resource.
+func IsDatabaseResourceURI(uri string) bool {
+	parsed, err := ParseResourceURI(uri)
+	if err != nil {
+		return false
+	}
+
+	return parsed.IsDatabase()
+}
+
+var (
+	// SampleDatabaseResource contains a sample full resource URI. This can be
+	// used on descriptions to show how a database resource URI looks like.
+	SampleDatabaseResource = NewDatabaseResourceURI("example-cluster", "myDatabase")
+)
diff --git a/lib/client/mcp/uri_test.go b/lib/client/mcp/uri_test.go
new file mode 100644
index 0000000000000..cf8c3df4f5d72
--- /dev/null
+++ b/lib/client/mcp/uri_test.go
@@ -0,0 +1,144 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package mcp
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDatabaseResourceURI(t *testing.T) {
+	for name, tc := range map[string]struct {
+		uri                  string
+		expectError          bool
+		expectedDatabase     bool
+		expectedServiceName  string
+		expectedDatabaseName string
+		expectedDatabaseUser string
+		expectedClusterName  string
+	}{
+		"valid database": {
+			uri:                  "teleport://clusters/default/databases/pg?dbName=database&dbUser=user",
+			expectedDatabase:     true,
+			expectedServiceName:  "pg",
+			expectedDatabaseName: "database",
+			expectedDatabaseUser: "user",
+			expectedClusterName:  "default",
+		},
+		"valid database without params": {
+			uri:                  "teleport://clusters/default/databases/pg",
+			expectedDatabase:     true,
+			expectedServiceName:  "pg",
+			expectedDatabaseName: "",
+			expectedDatabaseUser: "",
+			expectedClusterName:  "default",
+		},
+		"random resource": {
+			uri:                  "teleport://clusters/default/random/random-resource",
+			expectedDatabase:     false,
+			expectedServiceName:  "",
+			expectedDatabaseName: "",
+			expectedDatabaseUser: "",
+			expectedClusterName:  "default",
+		},
+		"generated uri with params": {
+			uri:                  NewDatabaseResourceURI("default", "db", WithDatabaseUser("user"), WithDatabaseName("name")).String(),
+			expectedDatabase:     true,
+			expectedServiceName:  "db",
+			expectedDatabaseName: "name",
+			expectedDatabaseUser: "user",
+			expectedClusterName:  "default",
+		},
+		"generated uri without params": {
+			uri:                  NewDatabaseResourceURI("default", "db", WithDatabaseUser("user"), WithDatabaseName("name")).WithoutParams().String(),
+			expectedDatabase:     true,
+			expectedServiceName:  "db",
+			expectedDatabaseName: "",
+			expectedDatabaseUser: "",
+			expectedClusterName:  "default",
+		},
+		"invalid schema": {
+			uri:         "http://databases/database",
+			expectError: true,
+		},
+		"invalid uri": {
+			uri:         "random-value",
+			expectError: true,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			uri, err := ParseResourceURI(tc.uri)
+			if tc.expectError {
+				require.Error(t, err)
+				return
+			}
+
+			require.NotNil(t, uri)
+			fmt.Println(tc.uri)
+			require.Equal(t, tc.expectedDatabase, IsDatabaseResourceURI(tc.uri))
+			require.Equal(t, tc.expectedDatabase, uri.IsDatabase())
+			require.Equal(t, tc.expectedServiceName, uri.GetDatabaseServiceName())
+			require.Equal(t, tc.expectedDatabaseName, uri.GetDatabaseName())
+			require.Equal(t, tc.expectedDatabaseUser, uri.GetDatabaseUser())
+			require.Equal(t, tc.expectedClusterName, uri.GetClusterName())
+		})
+	}
+}
+
+func TestEqualResourceURI(t *testing.T) {
+	randomType, err := ParseResourceURI("teleport://random/name")
+	require.NoError(t, err)
+
+	for name, tc := range map[string]struct {
+		a              ResourceURI
+		b              ResourceURI
+		expectedResult bool
+	}{
+		"same resources": {
+			a:              NewDatabaseResourceURI("cluster", "pg"),
+			b:              NewDatabaseResourceURI("cluster", "pg"),
+			expectedResult: true,
+		},
+		"same resources, different params": {
+			a:              NewDatabaseResourceURI("cluster", "pg", WithDatabaseUser("readonly"), WithDatabaseName("postgres")).WithoutParams(),
+			b:              NewDatabaseResourceURI("cluster", "pg", WithDatabaseUser("rw"), WithDatabaseName("random")).WithoutParams(),
+			expectedResult: true,
+		},
+		"same resource type, different resources": {
+			a:              NewDatabaseResourceURI("cluster", "pg"),
+			b:              NewDatabaseResourceURI("cluster", "random"),
+			expectedResult: false,
+		},
+		"different resource type, same name": {
+			a:              *randomType,
+			b:              NewDatabaseResourceURI("cluster", "pg"),
+			expectedResult: false,
+		},
+		"same resources compare params": {
+			a:              NewDatabaseResourceURI("cluster", "pg", WithDatabaseUser("rw"), WithDatabaseName("postgres")),
+			b:              NewDatabaseResourceURI("cluster", "pg", WithDatabaseUser("rw"), WithDatabaseName("postgres")),
+			expectedResult: true,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tc.expectedResult, tc.a.Equal(tc.b))
+			require.Equal(t, tc.expectedResult, tc.b.Equal(tc.a))
+		})
+	}
+}
diff --git a/lib/client/mcp_test.go b/lib/client/mcp_test.go
new file mode 100644
index 0000000000000..0a6f82fa5e9c1
--- /dev/null
+++ b/lib/client/mcp_test.go
@@ -0,0 +1,240 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package client
+
+import (
+	"cmp"
+	"context"
+	"crypto/tls"
+	"net"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/services"
+	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+type mockALPNConn struct {
+	net.Conn
+	cert     tls.Certificate
+	protocol alpncommon.Protocol
+}
+
+func newFakeALPNConn(protocol alpncommon.Protocol, cert tls.Certificate) *mockALPNConn {
+	return &mockALPNConn{
+		Conn:     nil, // currently not using the net.conn
+		cert:     cert,
+		protocol: protocol,
+	}
+}
+
+func (c *mockALPNConn) getCertSerialNumber() string {
+	leaf, err := utils.TLSCertLeaf(c.cert)
+	if err != nil {
+		return ""
+	}
+	return leaf.SerialNumber.String()
+}
+
+type mockMCPServerDialerClient struct {
+	appServers types.AppServers
+	tlsCA      *tlsca.CertAuthority
+	clock      *clockwork.FakeClock
+	identity   tlsca.Identity
+}
+
+func (m *mockMCPServerDialerClient) DialALPN(_ context.Context, cert tls.Certificate, protocol alpncommon.Protocol) (net.Conn, error) {
+	if err := utils.VerifyTLSCertLeafExpiry(cert, m.clock); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return newFakeALPNConn(protocol, cert), nil
+}
+
+func (m *mockMCPServerDialerClient) ListApps(_ context.Context, req *proto.ListResourcesRequest) ([]types.Application, error) {
+	filter, err := services.MatchResourceFilterFromListResourceRequest(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	appServers, err := services.MatchResourcesByFilters(m.appServers, filter)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return slices.Collect(appServers.Applications()), nil
+}
+
+func (m *mockMCPServerDialerClient) IssueUserCertsWithMFA(_ context.Context, params ReissueParams) (*KeyRing, error) {
+	if params.RouteToApp.Name == "" {
+		return nil, trace.BadParameter("missing app name")
+	}
+	if params.RouteToCluster != m.GetSiteName() {
+		return nil, trace.BadParameter("wrong cluster")
+	}
+	subject, err := m.identity.Subject()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.Ed25519)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsCert, err := m.tlsCA.GenerateCertificate(tlsca.CertificateRequest{
+		Clock:     m.clock,
+		PublicKey: tlsKey.Public(),
+		Subject:   subject,
+		NotAfter:  m.clock.Now().Add(cmp.Or(params.TTL, time.Minute)),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &KeyRing{
+		AppTLSCredentials: map[string]TLSCredential{
+			params.RouteToApp.Name: {
+				PrivateKey: tlsKey,
+				Cert:       tlsCert,
+			},
+		},
+	}, nil
+}
+
+func (m *mockMCPServerDialerClient) ProfileStatus() (*ProfileStatus, error) {
+	return &ProfileStatus{}, nil
+}
+
+func (m *mockMCPServerDialerClient) GetSiteName() string {
+	return "teleport.example.com"
+}
+
+func TestMCPServerDialer(t *testing.T) {
+	tlsCA, _, err := newSelfSignedCA(CAPriv, "localhost")
+	require.NoError(t, err)
+
+	mockClient := &mockMCPServerDialerClient{
+		appServers: types.AppServers{
+			mustMakeAppServer(t, "http-app", "http://localhost:1234"),
+			mustMakeAppServer(t, "http-mcp", "mcp+http://localhost:1234"),
+			mustMakeAppServer(t, "sse-mcp", "mcp+sse+http://localhost:1234"),
+		},
+		clock: clockwork.NewFakeClock(),
+		tlsCA: tlsCA,
+		identity: tlsca.Identity{
+			Username: "test",
+		},
+	}
+
+	t.Run("GetApp", func(t *testing.T) {
+		tests := []struct {
+			name        string
+			checkResult require.ErrorAssertionFunc
+		}{
+			{
+				name:        "http-app",
+				checkResult: require.Error,
+			},
+			{
+				name:        "http-mcp",
+				checkResult: require.NoError,
+			},
+			{
+				name:        "sse-mcp",
+				checkResult: require.NoError,
+			},
+			{
+				name:        "not-found",
+				checkResult: require.Error,
+			},
+		}
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				dialer := NewMCPServerDialer(mockClient, test.name)
+				_, err := dialer.GetApp(t.Context())
+				test.checkResult(t, err)
+			})
+		}
+	})
+
+	t.Run("DialALPN", func(t *testing.T) {
+		tests := []struct {
+			name     string
+			wantALPN alpncommon.Protocol
+		}{
+			{
+				name:     "http-mcp",
+				wantALPN: alpncommon.ProtocolHTTP,
+			},
+			{
+				name:     "sse-mcp",
+				wantALPN: alpncommon.ProtocolMCP,
+			},
+		}
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				dialer := NewMCPServerDialer(mockClient, test.name)
+				dialer.clock = mockClient.clock
+
+				// Verify ALPN used.
+				firstConn, err := dialer.DialALPN(t.Context())
+				require.NoError(t, err)
+				firstALPNConn, ok := firstConn.(*mockALPNConn)
+				require.True(t, ok)
+				require.Equal(t, test.wantALPN, firstALPNConn.protocol)
+
+				// Advance time to trigger issue cert again.
+				mockClient.clock.Advance(time.Hour)
+				secondConn, err := dialer.DialALPN(t.Context())
+				require.NoError(t, err)
+				secondALPNConn, ok := secondConn.(*mockALPNConn)
+				require.True(t, ok)
+
+				// Double-check a new cert is issued.
+				firstSerial := firstALPNConn.getCertSerialNumber()
+				secondSerial := secondALPNConn.getCertSerialNumber()
+				require.NotEmpty(t, firstSerial)
+				require.NotEqual(t, firstSerial, secondSerial)
+			})
+		}
+	})
+}
+
+func mustMakeAppServer(t *testing.T, name, uri string) types.AppServer {
+	t.Helper()
+	app := mustMakeApp(t, name, uri)
+	appServer, err := types.NewAppServerV3FromApp(app, "test", "test")
+	require.NoError(t, err)
+	return appServer
+}
+
+func mustMakeApp(t *testing.T, name, uri string) *types.AppV3 {
+	t.Helper()
+	app, err := types.NewAppV3(
+		types.Metadata{Name: name},
+		types.AppSpecV3{URI: uri},
+	)
+	require.NoError(t, err)
+	return app
+}
diff --git a/lib/client/mfa/cli.go b/lib/client/mfa/cli.go
index 0c716fc2268ea..c01bf192f984d 100644
--- a/lib/client/mfa/cli.go
+++ b/lib/client/mfa/cli.go
@@ -185,11 +185,11 @@ func (c *CLIPrompt) Run(ctx context.Context, chal *proto.MFAAuthenticateChalleng
 	// If there are multiple options and we chose one without it being specifically
 	// requested by the user, notify the user about it and how to request a specific method.
 	if len(availableMethods) > len(chosenMethods) && len(chosenMethods) > 0 && !userSpecifiedMethod {
+		availableMethodsString := strings.ToLower(strings.Join(availableMethods, ","))
 		const msg = "" +
 			"Available MFA methods [%v]. Continuing with %v.\n" +
-			"If you wish to perform MFA with another method, specify with flag --mfa-mode=<%v>.\n\n"
-
-		fmt.Fprintf(c.writer(), msg, strings.Join(availableMethods, ", "), strings.Join(chosenMethods, " and "), strings.ToLower(strings.Join(availableMethods, ",")))
+			"If you wish to perform MFA with another method, specify with flag --mfa-mode=<%v> or environment variable TELEPORT_MFA_MODE=<%v>.\n\n"
+		fmt.Fprintf(c.writer(), msg, strings.Join(availableMethods, ", "), strings.Join(chosenMethods, " and "), availableMethodsString, availableMethodsString)
 	}
 
 	// We should never prompt for OTP when per-session MFA is enabled. As long as other MFA methods are available,
diff --git a/lib/client/mfa/cli_test.go b/lib/client/mfa/cli_test.go
index 7372720de6371..7756aac331a09 100644
--- a/lib/client/mfa/cli_test.go
+++ b/lib/client/mfa/cli_test.go
@@ -159,7 +159,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK prefer webauthn over sso",
 			expectStdOut: "" +
 				"Available MFA methods [WEBAUTHN, SSO]. Continuing with WEBAUTHN.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso>.\n\n" +
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso> or environment variable TELEPORT_MFA_MODE=<webauthn,sso>.\n\n" +
 				"Tap any security key\n",
 			challenge: &proto.MFAAuthenticateChallenge{
 				WebauthnChallenge: &webauthnpb.CredentialAssertion{},
@@ -175,7 +175,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK prefer webauthn+otp over sso",
 			expectStdOut: "" +
 				"Available MFA methods [WEBAUTHN, SSO, OTP]. Continuing with WEBAUTHN and OTP.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp>.\n\n" +
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp> or environment variable TELEPORT_MFA_MODE=<webauthn,sso,otp>.\n\n" +
 				"Tap any security key or enter a code from a OTP device\n",
 			challenge: &proto.MFAAuthenticateChallenge{
 				WebauthnChallenge: &webauthnpb.CredentialAssertion{},
@@ -195,7 +195,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK prefer sso over otp",
 			expectStdOut: "" +
 				"Available MFA methods [SSO, OTP]. Continuing with SSO.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<sso,otp>.\n\n",
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<sso,otp> or environment variable TELEPORT_MFA_MODE=<sso,otp>.\n\n",
 			challenge: &proto.MFAAuthenticateChallenge{
 				TOTP:         &proto.TOTPChallenge{},
 				SSOChallenge: &proto.SSOChallenge{},
@@ -213,7 +213,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK prefer webauthn over otp when stdin hijack disallowed",
 			expectStdOut: "" +
 				"Available MFA methods [WEBAUTHN, OTP]. Continuing with WEBAUTHN.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,otp>.\n\n" +
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,otp> or environment variable TELEPORT_MFA_MODE=<webauthn,otp>.\n\n" +
 				"Tap any security key\n",
 			challenge: &proto.MFAAuthenticateChallenge{
 				WebauthnChallenge: &webauthnpb.CredentialAssertion{},
@@ -229,7 +229,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK webauthn or otp with stdin hijack allowed, choose webauthn",
 			expectStdOut: "" +
 				"Available MFA methods [WEBAUTHN, SSO, OTP]. Continuing with WEBAUTHN and OTP.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp>.\n\n" +
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp> or environment variable TELEPORT_MFA_MODE=<webauthn,sso,otp>.\n\n" +
 				"Tap any security key or enter a code from a OTP device\n",
 			challenge: &proto.MFAAuthenticateChallenge{
 				WebauthnChallenge: &webauthnpb.CredentialAssertion{},
@@ -249,7 +249,7 @@ func TestCLIPrompt(t *testing.T) {
 			name: "OK webauthn or otp with stdin hijack allowed, choose otp",
 			expectStdOut: "" +
 				"Available MFA methods [WEBAUTHN, SSO, OTP]. Continuing with WEBAUTHN and OTP.\n" +
-				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp>.\n\n" +
+				"If you wish to perform MFA with another method, specify with flag --mfa-mode=<webauthn,sso,otp> or environment variable TELEPORT_MFA_MODE=<webauthn,sso,otp>.\n\n" +
 				"Tap any security key or enter a code from a OTP device\n",
 			stdin: "123456",
 			challenge: &proto.MFAAuthenticateChallenge{
diff --git a/lib/client/player.go b/lib/client/player.go
index 4a87d352a35e6..652ec3649ac73 100644
--- a/lib/client/player.go
+++ b/lib/client/player.go
@@ -51,7 +51,8 @@ func (p *playFromFileStreamer) StreamSessionEvents(
 		}
 		defer f.Close()
 
-		pr := events.NewProtoReader(f)
+		pr := events.NewProtoReader(f, nil)
+
 		for i := int64(0); ; i++ {
 			evt, err := pr.Read(ctx)
 			if err != nil {
diff --git a/lib/client/profile.go b/lib/client/profile.go
index 74de48e48687a..627625708229d 100644
--- a/lib/client/profile.go
+++ b/lib/client/profile.go
@@ -226,12 +226,25 @@ type ProfileStatus struct {
 	// ProxyURL is the URL the web client is accessible at.
 	ProxyURL url.URL
 
+	// RelayAddr is the address of the relay to use, if any.
+	RelayAddr string
+
+	// DefaultRelayAddr is the address of the relay to use specified by the
+	// cluster at login time, if any.
+	DefaultRelayAddr string
+
 	// Username is the Teleport username.
 	Username string
 
 	// Roles is a list of Teleport Roles this user has been assigned.
 	Roles []string
 
+	// Scope is the scope that this profile is pinned to.
+	Scope string
+
+	// ScopedRoles is a map of scopes to scoped role assignments.
+	ScopedRoles map[string][]string
+
 	// Logins are the Linux accounts, also known as principals in OpenSSH terminology.
 	Logins []string
 
@@ -322,6 +335,8 @@ type profileOptions struct {
 	ProfileName             string
 	ProfileDir              string
 	WebProxyAddr            string
+	RelayAddr               string
+	DefaultRelayAddr        string
 	Username                string
 	SiteName                string
 	KubeProxyAddr           string
@@ -351,6 +366,20 @@ func profileStatusFromKeyRing(keyRing *KeyRing, opts profileOptions) (*ProfileSt
 	roles := slices.Clone(sshIdent.Roles)
 	sort.Strings(roles)
 
+	var scope string
+	var scopedRoles map[string][]string
+	if pin := sshIdent.ScopePin; pin != nil {
+		scope = pin.GetScope()
+		scopedRoles = make(map[string][]string)
+		for scope, assigned := range pin.GetAssignments() {
+			if len(assigned.GetRoles()) == 0 {
+				continue
+			}
+
+			scopedRoles[scope] = assigned.GetRoles()
+		}
+	}
+
 	// Extract extensions from certificate. This lists the abilities of the
 	// certificate (like can the user request a PTY, port forwarding, etc.)
 	var extensions []string
@@ -411,12 +440,16 @@ func profileStatusFromKeyRing(keyRing *KeyRing, opts profileOptions) (*ProfileSt
 			Scheme: "https",
 			Host:   opts.WebProxyAddr,
 		},
+		RelayAddr:               opts.RelayAddr,
+		DefaultRelayAddr:        opts.DefaultRelayAddr,
 		Username:                opts.Username,
 		Logins:                  sshCert.ValidPrincipals,
 		ValidUntil:              validUntil,
 		Extensions:              extensions,
 		CriticalOptions:         sshCert.CriticalOptions,
 		Roles:                   roles,
+		Scope:                   scope,
+		ScopedRoles:             scopedRoles,
 		Cluster:                 opts.SiteName,
 		Traits:                  sshIdent.Traits,
 		ActiveRequests:          sshIdent.ActiveRequests,
diff --git a/lib/client/proxy/insecure/insecure.go b/lib/client/proxy/insecure/insecure.go
index 7818cf773c06b..766be08177e7e 100644
--- a/lib/client/proxy/insecure/insecure.go
+++ b/lib/client/proxy/insecure/insecure.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -35,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -85,9 +87,10 @@ func NewConnection(
 	conn, err := grpc.Dial(
 		params.ProxyServer,
 		grpc.WithContextDialer(client.GRPCContextDialer(dialer)),
-		grpc.WithUnaryInterceptor(metadata.UnaryClientInterceptor),
-		grpc.WithStreamInterceptor(metadata.StreamClientInterceptor),
+		grpc.WithChainUnaryInterceptor(metadata.UnaryClientInterceptor, interceptors.GRPCClientUnaryErrorInterceptor),
+		grpc.WithChainStreamInterceptor(metadata.StreamClientInterceptor, interceptors.GRPCClientStreamErrorInterceptor),
 		grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)),
+		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 	)
 	return conn, trace.Wrap(err)
 }
diff --git a/lib/client/proxy/insecure/insecure_test.go b/lib/client/proxy/insecure/insecure_test.go
index 98ca4a817d121..b28efd083796d 100644
--- a/lib/client/proxy/insecure/insecure_test.go
+++ b/lib/client/proxy/insecure/insecure_test.go
@@ -35,7 +35,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/fixtures"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
@@ -51,7 +51,7 @@ func TestVerifyALPNUpgradedConn(t *testing.T) {
 	t.Parallel()
 
 	srv := newTestTLSServer(t)
-	proxy, err := auth.NewServerIdentity(srv.Auth(), "test-proxy", types.RoleProxy)
+	proxy, err := authtest.NewServerIdentity(srv.Auth(), "test-proxy", types.RoleProxy)
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -92,12 +92,13 @@ func TestVerifyALPNUpgradedConn(t *testing.T) {
 	}
 }
 
-func newTestTLSServer(t testing.TB) *auth.TestTLSServer {
-	as, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+func newTestTLSServer(t testing.TB) *authtest.TLSServer {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC()),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
 
 	srv, err := as.NewTestTLSServer()
 	require.NoError(t, err)
diff --git a/lib/client/reexec/reexec.go b/lib/client/reexec/reexec.go
new file mode 100644
index 0000000000000..62703fbe3606d
--- /dev/null
+++ b/lib/client/reexec/reexec.go
@@ -0,0 +1,151 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package reexec
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
+// NotifyFileSignal signals on the returned channel when the provided file
+// receives a signal (a one-byte read).
+func NotifyFileSignal(f *os.File) <-chan error {
+	errorCh := make(chan error, 1)
+	go func() {
+		n, err := f.Read(make([]byte, 1))
+		if n > 0 {
+			errorCh <- nil
+		} else if err == nil {
+			// this should be impossible according to the io.Reader contract
+			errorCh <- io.ErrUnexpectedEOF
+		} else {
+			errorCh <- err
+		}
+	}()
+	return errorCh
+}
+
+// SignalAndClose writes a byte to the provided file (to signal a caller of
+// NotifyFileSignal) and closes it.
+func SignalAndClose(f *os.File) error {
+	_, err := f.Write([]byte{0x00})
+	return trace.NewAggregate(err, f.Close())
+}
+
+// ForkAuthenticateParams are the parameters to RunForkAuthenticate.
+type ForkAuthenticateParams struct {
+	// GetArgs gets the arguments to re-exec with, excluding the executable
+	// (equivalent to os.Args[1:]).
+	GetArgs func(signalFd, killFd uint64) []string
+	// executable is the executable to run while re-execing. Overridden in tests.
+	executable string
+	// Stdin is the child process' stdin.
+	Stdin io.Reader
+	// Stdout is the child process' stdout.
+	Stdout io.Writer
+	// Stderr is the child process' stderr.
+	Stderr io.Writer
+}
+
+// RunForkAuthenticate re-execs the current executable and waits for any of
+// the following:
+//   - The child process exits (usually in error).
+//   - The child process signals the parent that it is ready to be disowned.
+//   - The context is canceled.
+func RunForkAuthenticate(ctx context.Context, params ForkAuthenticateParams) error {
+	if params.executable == "" {
+		executable, err := getExecutable()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		params.executable = executable
+	}
+	cmd := exec.Command(params.executable)
+	// Set up signal pipes.
+	disownR, disownW, err := os.Pipe()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	killR, killW, err := os.Pipe()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer func() {
+		// If the child is still listening, kill it. If the child successfully
+		// disowned, this will do nothing.
+		SignalAndClose(killW)
+		killR.Close()
+		disownW.Close()
+		disownR.Close()
+	}()
+
+	// disownW and killR are going to stay alive until the defer or until the
+	// close after a successful start, so we can pass them to
+	// configureReexecForOS here
+	signalFd, killFd := configureReexecForOS(cmd, disownW, killR)
+	cmd.Args = append(cmd.Args, params.GetArgs(signalFd, killFd)...)
+	cmd.Args[0] = os.Args[0]
+	cmd.Stdin = params.Stdin
+	cmd.Stdout = params.Stdout
+	cmd.Stderr = params.Stderr
+
+	if err := cmd.Start(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Clean up parent end of pipes.
+	if err := disownW.Close(); err != nil {
+		return trace.NewAggregate(err, killAndWaitProcess(cmd))
+	}
+	if err := killR.Close(); err != nil {
+		return trace.NewAggregate(err, killAndWaitProcess(cmd))
+	}
+
+	select {
+	case err := <-NotifyFileSignal(disownR):
+		if err == nil {
+			return trace.Wrap(cmd.Process.Release())
+		} else if errors.Is(err, io.EOF) {
+			// EOF means the child process exited, no need to report it on top of kill/wait.
+			return trace.Wrap(killAndWaitProcess(cmd))
+		}
+		return trace.NewAggregate(err, killAndWaitProcess(cmd))
+	case <-ctx.Done():
+		return trace.NewAggregate(ctx.Err(), killAndWaitProcess(cmd))
+	}
+}
+
+func killAndWaitProcess(cmd *exec.Cmd) error {
+	if err := cmd.Process.Kill(); err != nil {
+		return trace.Wrap(err)
+	}
+	err := cmd.Wait()
+	var execErr *exec.ExitError
+	if errors.As(err, &execErr) && execErr.ExitCode() != 0 {
+		return trace.Wrap(err)
+	} else if err != nil && strings.Contains(err.Error(), "signal: killed") {
+		// If the process was successfully killed, there is no issue.
+		return nil
+	}
+	return trace.Wrap(err)
+}
diff --git a/lib/client/reexec/reexec_darwin.go b/lib/client/reexec/reexec_darwin.go
new file mode 100644
index 0000000000000..cc00506118e81
--- /dev/null
+++ b/lib/client/reexec/reexec_darwin.go
@@ -0,0 +1,44 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build darwin
+
+package reexec
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+
+	"github.com/gravitational/trace"
+)
+
+// getExecutable gets the path to the executable that should be used for re-exec.
+func getExecutable() (string, error) {
+	executable, err := os.Executable()
+	return executable, trace.Wrap(err)
+}
+
+// configureReexecForOS configures the command with files to inherit and
+// os-specific tweaks. The signaling files should be kept alive until the
+// command is started, then the caller should close them.
+func configureReexecForOS(cmd *exec.Cmd, signal, kill *os.File) (signalFd, killFd uint64) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+	}
+	cmd.ExtraFiles = []*os.File{signal, kill}
+	return 3, 4
+}
diff --git a/lib/client/reexec/reexec_linux.go b/lib/client/reexec/reexec_linux.go
new file mode 100644
index 0000000000000..8a3704e289dd9
--- /dev/null
+++ b/lib/client/reexec/reexec_linux.go
@@ -0,0 +1,41 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build linux
+
+package reexec
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+// getExecutable gets the path to the executable that should be used for re-exec.
+func getExecutable() (string, error) {
+	return "/proc/self/exe", nil
+}
+
+// configureReexecForOS configures the command with files to inherit and
+// os-specific tweaks. The signaling files should be kept alive until the
+// command is started, then the caller should close them.
+func configureReexecForOS(cmd *exec.Cmd, signal, kill *os.File) (signalFd, killFd uint64) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+	}
+	cmd.ExtraFiles = []*os.File{signal, kill}
+	return 3, 4
+}
diff --git a/lib/client/reexec/reexec_test.go b/lib/client/reexec/reexec_test.go
new file mode 100644
index 0000000000000..bfdb10a0041bb
--- /dev/null
+++ b/lib/client/reexec/reexec_test.go
@@ -0,0 +1,185 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package reexec
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/testutils"
+)
+
+type syncBuffer struct {
+	buf *bytes.Buffer
+	mu  sync.Mutex
+}
+
+func newSyncBuffer() *syncBuffer {
+	return &syncBuffer{
+		buf: &bytes.Buffer{},
+	}
+}
+
+func (rw *syncBuffer) Read(b []byte) (int, error) {
+	rw.mu.Lock()
+	defer rw.mu.Unlock()
+	return rw.buf.Read(b)
+}
+
+func (rw *syncBuffer) Write(b []byte) (int, error) {
+	rw.mu.Lock()
+	defer rw.mu.Unlock()
+	return rw.buf.Write(b)
+}
+
+func (rw *syncBuffer) String() string {
+	rw.mu.Lock()
+	defer rw.mu.Unlock()
+	return rw.buf.String()
+}
+
+func TestRunForkAuthenticate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("child disowns successfully", func(t *testing.T) {
+		t.Parallel()
+		const script = `
+		read
+		# Close signal fd.
+		echo x >&%d
+		exec %d>&-
+		# stdout/err should still work.
+		echo "stdout: $REPLY"
+		echo "stderr: $REPLY" >&2
+		# Wait to ensure the fd closure is caught before the process ends.
+		sleep 1
+		`
+		getArgs := func(signalFd, killFd uint64) []string {
+			return []string{"-c", fmt.Sprintf(script, signalFd, signalFd)}
+		}
+		stdout := newSyncBuffer()
+		stderr := newSyncBuffer()
+		params := ForkAuthenticateParams{
+			GetArgs:    getArgs,
+			executable: "bash",
+			Stdin:      bytes.NewBufferString("hello\n"),
+			Stdout:     stdout,
+			Stderr:     stderr,
+		}
+
+		err := RunForkAuthenticate(t.Context(), params)
+		assert.NoError(t, err)
+		assert.EventuallyWithT(t, func(t *assert.CollectT) {
+			assert.Equal(t, "stdout: hello\n", stdout.String())
+			assert.Equal(t, "stderr: hello\n", stderr.String())
+		}, 10*time.Second, 100*time.Millisecond)
+	})
+
+	t.Run("child exits with error", func(t *testing.T) {
+		t.Parallel()
+		const script = `
+		# Make sure stdin/out/err work.
+		read
+		echo "stdout: $REPLY"
+		echo "stderr: $REPLY" >&2
+		# Exit with error.
+		exit 42
+		`
+		getArgs := func(signalFd, killFd uint64) []string {
+			return []string{"-c", script}
+		}
+		stdout := newSyncBuffer()
+		stderr := newSyncBuffer()
+		params := ForkAuthenticateParams{
+			GetArgs:    getArgs,
+			executable: "bash",
+			Stdin:      bytes.NewBufferString("hello\n"),
+			Stdout:     stdout,
+			Stderr:     stderr,
+		}
+
+		err := RunForkAuthenticate(t.Context(), params)
+		var execErr *exec.ExitError
+		if assert.ErrorAs(t, err, &execErr) {
+			assert.Equal(t, 42, execErr.ExitCode())
+		}
+		assert.Equal(t, "stdout: hello\n", stdout.String())
+		assert.Equal(t, "stderr: hello\n", stderr.String())
+	})
+
+	t.Run("context canceled", func(t *testing.T) {
+		t.Parallel()
+		getArgs := func(_, _ uint64) []string {
+			return []string{"-c", `
+			# Make sure stdin/out/err work.
+			read
+			echo "stdout: $REPLY"
+			echo "stderr: $REPLY" >&2
+			# wait for cancellation
+			sleep 2
+			# should not be executed
+			echo "extra output"
+			`}
+		}
+		stdout := newSyncBuffer()
+		stderr := newSyncBuffer()
+		params := ForkAuthenticateParams{
+			GetArgs:    getArgs,
+			executable: "bash",
+			Stdin:      bytes.NewBufferString("hello\n"),
+			Stdout:     stdout,
+			Stderr:     stderr,
+		}
+		ctx, cancel := context.WithCancel(t.Context())
+		t.Cleanup(cancel)
+
+		errorCh := make(chan error, 1)
+		testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
+			Name: "RunForkAuthenticate",
+			Task: func(ctx context.Context) error {
+				errorCh <- RunForkAuthenticate(ctx, params)
+				return nil
+			},
+		})
+
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			assert.Equal(t, "stdout: hello\n", stdout.String())
+			assert.Equal(t, "stderr: hello\n", stderr.String())
+		}, 10*time.Second, 100*time.Millisecond)
+
+		cancel()
+		select {
+		case err := <-errorCh:
+			require.ErrorIs(t, err, context.Canceled)
+		case <-time.After(5 * time.Second):
+			require.Fail(t, "timed out waiting for child to finish")
+		}
+
+		require.Never(t, func() bool {
+			return strings.Contains(stdout.String(), "extra output")
+		}, 3*time.Second, time.Second)
+	})
+}
diff --git a/lib/client/reexec/reexec_windows.go b/lib/client/reexec/reexec_windows.go
new file mode 100644
index 0000000000000..d048d24e57530
--- /dev/null
+++ b/lib/client/reexec/reexec_windows.go
@@ -0,0 +1,46 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build windows
+
+package reexec
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+
+	"github.com/gravitational/trace"
+)
+
+// getExecutable gets the path to the executable that should be used for re-exec.
+func getExecutable() (string, error) {
+	executable, err := os.Executable()
+	return executable, trace.Wrap(err)
+}
+
+// configureReexecForOS configures the command with files to inherit and
+// os-specific tweaks. The signaling files should be kept alive until the
+// command is started, then the caller should close them.
+func configureReexecForOS(cmd *exec.Cmd, signal, kill *os.File) (signalFd, killFd uint64) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		AdditionalInheritedHandles: []syscall.Handle{
+			syscall.Handle(signal.Fd()),
+			syscall.Handle(kill.Fd()),
+		},
+	}
+	return uint64(signal.Fd()), uint64(kill.Fd())
+}
diff --git a/lib/client/session.go b/lib/client/session.go
index b35921cbd575c..65556e9f8a029 100644
--- a/lib/client/session.go
+++ b/lib/client/session.go
@@ -20,12 +20,15 @@ package client
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net"
 	"os"
 	"os/signal"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -35,7 +38,6 @@ import (
 	"github.com/gravitational/trace"
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/agent"
 
 	"github.com/gravitational/teleport"
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
@@ -45,6 +47,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/utils"
@@ -56,9 +59,6 @@ const (
 )
 
 type NodeSession struct {
-	// id is the Teleport session ID
-	id session.ID
-
 	// env is the environment variables that need to be created
 	// on the server for this session
 	env map[string]string
@@ -104,8 +104,7 @@ type NodeSession struct {
 // of another user
 func newSession(ctx context.Context,
 	client *NodeClient,
-	joinSession types.SessionTracker,
-	env map[string]string,
+	sessionParams *tracessh.SessionParams,
 	stdin io.Reader,
 	stdout io.Writer,
 	stderr io.Writer,
@@ -119,8 +118,21 @@ func newSession(ctx context.Context,
 		return nil, trace.Wrap(err)
 	}
 
-	if env == nil {
-		env = make(map[string]string)
+	env := make(map[string]string)
+	maps.Copy(env, client.TC.ExtraEnvs)
+
+	// TODO(Joerger): DELETE IN v20.0.0 - session params are provided in the session
+	// request as extra data rather than env vars.
+	if sessionParams != nil {
+		env[teleport.SSHSessionWebProxyAddr] = sessionParams.WebProxyAddr
+		env[teleport.EnvSSHJoinMode] = string(sessionParams.JoinMode)
+		env[teleport.EnvSSHSessionReason] = sessionParams.Reason
+		env[teleport.EnvSSHSessionDisplayParticipantRequirements] = strconv.FormatBool(sessionParams.DisplayParticipantRequirements)
+		encoded, err := json.Marshal(&sessionParams.Invited)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		env[teleport.EnvSSHSessionInvited] = string(encoded)
 	}
 
 	ns := &NodeSession{
@@ -132,38 +144,25 @@ func newSession(ctx context.Context,
 		terminal:              term,
 		shouldClearOnExit:     client.FIPSEnabled || isFIPS(),
 	}
-	// if we're joining an existing session, we need to assume that session's
-	// existing/current terminal size:
-	if joinSession != nil {
-		sessionID := joinSession.GetSessionID()
-		terminalSize, err := client.GetRemoteTerminalSize(ctx, sessionID)
+
+	if sessionParams != nil && sessionParams.JoinSessionID != "" {
+		// if we're joining an existing session, we need to assume that session's
+		// existing/current terminal size:
+		terminalSize, err := client.GetRemoteTerminalSize(ctx, sessionParams.JoinSessionID)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		ns.id = session.ID(sessionID)
-
 		if ns.terminal.IsAttached() {
 			err = ns.terminal.Resize(int16(terminalSize.Width), int16(terminalSize.Height))
 			if err != nil {
 				log.ErrorContext(ctx, "Failed to resize terminal", "error", err)
 			}
-
-		}
-		// new session!
-	} else {
-		// TODO(capnspacehook): DELETE IN 17.0.0
-		// clients shouldn't set TELEPORT_SESSION when they aren't joining
-		// a session, and won't need to once all supported Proxy/Node
-		// versions set the session ID for new sessions
-		sid, ok := ns.env[sshutils.SessionEnvVar]
-		if !ok {
-			sid = string(session.NewID())
 		}
-		ns.id = session.ID(sid)
-	}
 
-	ns.env[sshutils.SessionEnvVar] = string(ns.id)
+		// TODO(Joerger): DELETE IN v20.0.0 - session env var is no longer used for session joining.
+		ns.env[sshutils.SessionEnvVar] = sessionParams.JoinSessionID
+	}
 
 	// Close the Terminal when finished.
 	ns.closeWait.Add(1)
@@ -187,7 +186,7 @@ func (ns *NodeSession) NodeClient() *NodeClient {
 	return ns.nodeClient
 }
 
-func (ns *NodeSession) regularSession(ctx context.Context, chanReqCallback tracessh.ChannelRequestCallback, sessionCallback func(s *tracessh.Session) error) error {
+func (ns *NodeSession) regularSession(ctx context.Context, sessionParams *tracessh.SessionParams, sessionCallback func(s *tracessh.Session) error) error {
 	ctx, span := ns.nodeClient.Tracer.Start(
 		ctx,
 		"nodeClient/regularSession",
@@ -195,7 +194,7 @@ func (ns *NodeSession) regularSession(ctx context.Context, chanReqCallback trace
 	)
 	defer span.End()
 
-	session, err := ns.createServerSession(ctx, chanReqCallback)
+	session, err := ns.createServerSession(ctx, nil)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -207,7 +206,7 @@ func (ns *NodeSession) regularSession(ctx context.Context, chanReqCallback trace
 
 type interactiveCallback func(serverSession *tracessh.Session, shell io.ReadWriteCloser) error
 
-func (ns *NodeSession) createServerSession(ctx context.Context, chanReqCallback tracessh.ChannelRequestCallback) (*tracessh.Session, error) {
+func (ns *NodeSession) createServerSession(ctx context.Context, sessionParams *tracessh.SessionParams) (*tracessh.Session, error) {
 	ctx, span := ns.nodeClient.Tracer.Start(
 		ctx,
 		"nodeClient/createServerSession",
@@ -215,7 +214,7 @@ func (ns *NodeSession) createServerSession(ctx context.Context, chanReqCallback
 	)
 	defer span.End()
 
-	sess, err := ns.nodeClient.Client.NewSessionWithRequestCallback(ctx, chanReqCallback)
+	sess, err := ns.nodeClient.Client.NewSessionWithParams(ctx, sessionParams)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -248,15 +247,15 @@ func (ns *NodeSession) createServerSession(ctx context.Context, chanReqCallback
 	// if agent forwarding was requested (and we have a agent to forward),
 	// forward the agent to endpoint.
 	tc := ns.nodeClient.TC
-	targetAgent := selectKeyAgent(tc)
+	targetAgent := selectKeyAgent(ctx, tc)
 
 	if targetAgent != nil {
 		log.DebugContext(ctx, "Forwarding Selected Key Agent")
-		err = agent.ForwardToAgent(ns.nodeClient.Client.Client, targetAgent)
+		err = sshagent.ServeChannelRequests(ctx, ns.nodeClient.Client.Client, targetAgent)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		err = agent.RequestAgentForwarding(sess.Session)
+		err = sshagent.RequestAgentForwarding(ctx, sess)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -267,23 +266,23 @@ func (ns *NodeSession) createServerSession(ctx context.Context, chanReqCallback
 
 // selectKeyAgent picks the appropriate key agent for forwarding to the
 // server, if any.
-func selectKeyAgent(tc *TeleportClient) agent.ExtendedAgent {
+func selectKeyAgent(ctx context.Context, tc *TeleportClient) sshagent.ClientGetter {
 	switch tc.ForwardAgent {
 	case ForwardAgentYes:
-		log.DebugContext(context.Background(), "Selecting system key agent")
-		return connectToSSHAgent()
+		log.DebugContext(ctx, "Selecting system key agent")
+		return sshagent.NewSystemAgentClient
 	case ForwardAgentLocal:
-		log.DebugContext(context.Background(), "Selecting local Teleport key agent")
-		return tc.localAgent.ExtendedAgent
+		log.DebugContext(ctx, "Selecting local Teleport key agent")
+		return sshagent.NewStaticClientGetter(tc.localAgent.ExtendedAgent)
 	default:
-		log.DebugContext(context.Background(), "No Key Agent selected")
+		log.DebugContext(ctx, "No Key Agent selected")
 		return nil
 	}
 }
 
 // interactiveSession creates an interactive session on the remote node, executes
 // the given callback on it, and waits for the session to end
-func (ns *NodeSession) interactiveSession(ctx context.Context, mode types.SessionParticipantMode, chanReqCallback tracessh.ChannelRequestCallback, sessionCallback interactiveCallback) error {
+func (ns *NodeSession) interactiveSession(ctx context.Context, sessionParams *tracessh.SessionParams, sessionCallback interactiveCallback) error {
 	ctx, span := ns.nodeClient.Tracer.Start(
 		ctx,
 		"nodeClient/interactiveSession",
@@ -297,7 +296,7 @@ func (ns *NodeSession) interactiveSession(ctx context.Context, mode types.Sessio
 		termType = teleport.SafeTerminalType
 	}
 	// create the server-side session:
-	sess, err := ns.createServerSession(ctx, chanReqCallback)
+	sess, err := ns.createServerSession(ctx, sessionParams)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -323,6 +322,11 @@ func (ns *NodeSession) interactiveSession(ctx context.Context, mode types.Sessio
 		ns.watchSignals(remoteTerm)
 	}
 
+	mode := types.SessionPeerMode
+	if sessionParams != nil && sessionParams.JoinMode != "" {
+		mode = sessionParams.JoinMode
+	}
+
 	// start piping input into the remote shell and pipe the output from
 	// the remote shell into stdout:
 	ns.pipeInOut(ctx, remoteTerm, mode, sess)
@@ -527,8 +531,8 @@ func (s *sessionWriter) Write(p []byte) (int, error) {
 }
 
 // runShell executes user's shell on the remote node under an interactive session
-func (ns *NodeSession) runShell(ctx context.Context, mode types.SessionParticipantMode, chanReqCallback tracessh.ChannelRequestCallback, beforeStart func(io.Writer), shellCallback ShellCreatedCallback) error {
-	return ns.interactiveSession(ctx, mode, chanReqCallback, func(s *tracessh.Session, shell io.ReadWriteCloser) error {
+func (ns *NodeSession) runShell(ctx context.Context, sessionParams *tracessh.SessionParams, beforeStart func(io.Writer), shellCallback ShellCreatedCallback) error {
+	return ns.interactiveSession(ctx, sessionParams, func(s *tracessh.Session, shell io.ReadWriteCloser) error {
 		w := &sessionWriter{
 			tshOut:  ns.nodeClient.TC.Stdout,
 			session: s,
@@ -556,7 +560,7 @@ func (ns *NodeSession) runShell(ctx context.Context, mode types.SessionParticipa
 
 // runCommand executes a "exec" request either in interactive mode (with a
 // TTY attached) or non-intractive mode (no TTY).
-func (ns *NodeSession) runCommand(ctx context.Context, mode types.SessionParticipantMode, cmd []string, chanReqCallback tracessh.ChannelRequestCallback, shellCallback ShellCreatedCallback, interactive bool) error {
+func (ns *NodeSession) runCommand(ctx context.Context, sessionParams *tracessh.SessionParams, cmd []string, shellCallback ShellCreatedCallback, interactive bool) error {
 	ctx, span := ns.nodeClient.Tracer.Start(
 		ctx,
 		"nodeClient/runCommand",
@@ -570,7 +574,7 @@ func (ns *NodeSession) runCommand(ctx context.Context, mode types.SessionPartici
 	// keyboard based signals will be propogated to the TTY on the server which is
 	// where all signal handling will occur.
 	if interactive {
-		return ns.interactiveSession(ctx, mode, chanReqCallback, func(s *tracessh.Session, term io.ReadWriteCloser) error {
+		return ns.interactiveSession(ctx, sessionParams, func(s *tracessh.Session, term io.ReadWriteCloser) error {
 			err := s.Start(ctx, strings.Join(cmd, " "))
 			if err != nil {
 				return trace.Wrap(err)
@@ -597,7 +601,7 @@ func (ns *NodeSession) runCommand(ctx context.Context, mode types.SessionPartici
 	// Unfortunately at the moment the Go SSH library Teleport uses does not
 	// support sending SSH_MSG_DISCONNECT. Instead we close the SSH channel and
 	// SSH client, and try and exit as gracefully as possible.
-	return ns.regularSession(ctx, chanReqCallback, func(s *tracessh.Session) error {
+	return ns.regularSession(ctx, sessionParams, func(s *tracessh.Session) error {
 		errCh := make(chan error, 1)
 		go func() {
 			errCh <- s.Run(ctx, strings.Join(cmd, " "))
diff --git a/lib/client/sso/redirector.go b/lib/client/sso/redirector.go
index 24310ee97169d..94f54e050987e 100644
--- a/lib/client/sso/redirector.go
+++ b/lib/client/sso/redirector.go
@@ -28,10 +28,12 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/netip"
 	"net/url"
 	"os"
 	"os/exec"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -41,6 +43,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/authclient"
@@ -502,3 +505,153 @@ func (rd *Redirector) wrapCallback(fn func(http.ResponseWriter, *http.Request) (
 		}
 	})
 }
+
+// CeremonyType is the type of SSO ceremony.
+type CeremonyType int
+
+const (
+	// CeremonyTypeLogin ceremonies are performed during standard SSO login flows.
+	CeremonyTypeLogin CeremonyType = iota
+	// CeremonyTypeMFA ceremonies are performed during MFA flows for SSO users if SSO MFA
+	// is enabled for their origin SSO connector.
+	CeremonyTypeMFA
+	// CeremonyTypeTest ceremonies are performed by administrators with "tctl sso test".
+	CeremonyTypeTest
+)
+
+// ValidateClientRedirect validates a redirect URL provided by the client to
+// consume the SSO response at the end of the SSO Ceremony. This validation
+// differs depending on the ceremony type. Some checks are auth connector
+// specific and others depend on the ceremony type (MFA, Login, or Test).
+//
+// For Web MFA ceremonies, the redirect URL should be [WebMFARedirect] as a relative
+// path with no custom values outside of query parameters.
+//
+// For Login, Test, and non-web MFA ceremonies, the redirect URL should have:
+// - a path of "/callback"
+// - "http" scheme
+// - a hostname of "localhost", "127.0.0.1", or "::1"
+// - any port
+//
+// For non test ceremonies, If "allowed_https_hostnames" list is non-empty,
+// the redirect URL can instead have:
+// - a path of "/callback"
+// - "https" scheme
+// - a hostname that matches one in the "allowed_https_hostnames" list
+// - either empty or 443 port
+//
+// For non test ceremonies, If the "insecure_allowed_cidr_ranges" list is non-empty, URLs in both the
+// "http" and "https" schema are allowed if the hostname is an IP address that is contained in a
+// specified CIDR range on any port.
+func ValidateClientRedirect(clientRedirect string, ceremonyType CeremonyType, settings *types.SSOClientRedirectSettings) error {
+	// Warning to developers and reviewers: this validation function is critical to SSO security
+	// and any changes to it should be carefully considered from a vulnerability point of view.
+
+	if clientRedirect == "" {
+		// empty redirects are non-functional and harmless, so we allow them as
+		// they're used a lot in test code
+		return nil
+	}
+
+	u, err := url.Parse(clientRedirect)
+	if err != nil {
+		return trace.Wrap(err, "parsing client redirect URL")
+	}
+
+	if u.Opaque != "" {
+		return trace.BadParameter("unexpected opaque client redirect URL")
+	}
+	if u.User != nil {
+		return trace.BadParameter("unexpected userinfo in client redirect URL")
+	}
+	if u.Fragment != "" || u.RawFragment != "" {
+		return trace.BadParameter("unexpected fragment in client redirect URL")
+	}
+
+	// For Web MFA redirect, we expect a relative path. The proxy handling the SSO callback
+	// will redirect to itself with this relative path.
+	if u.Path == WebMFARedirect {
+		if ceremonyType != CeremonyTypeMFA {
+			return trace.BadParameter("the web mfa redirect path, \"/web/sso_confirm\", cannot be used for non-MFA flows")
+		}
+		if u.IsAbs() {
+			return trace.BadParameter("invalid client redirect URL for SSO MFA")
+		}
+		if u.Hostname() != "" {
+			return trace.BadParameter("invalid client redirect URL for SSO MFA")
+		}
+		if q, err := url.ParseQuery(u.RawQuery); err != nil {
+			return trace.Wrap(err, "parsing query in client redirect URL")
+		} else if len(q) != 1 || len(q["channel_id"]) != 1 {
+			return trace.BadParameter("malformed query parameters in client redirect URL")
+		}
+		return nil
+	}
+
+	if u.EscapedPath() != "/callback" {
+		return trace.BadParameter("invalid path in client redirect URL")
+	}
+	if q, err := url.ParseQuery(u.RawQuery); err != nil {
+		return trace.Wrap(err, "parsing query in client redirect URL")
+	} else if len(q) != 1 || len(q["secret_key"]) != 1 {
+		return trace.BadParameter("malformed query parameters in client redirect URL")
+	}
+
+	// we checked everything but u.Scheme and u.Host now
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return trace.BadParameter("invalid scheme in client redirect URL")
+	}
+
+	// allow HTTP redirects to local addresses
+	allowedHTTPLocalAddrs := []string{"localhost", "127.0.0.1", "::1"}
+	if u.Scheme == "http" && slices.Contains(allowedHTTPLocalAddrs, u.Hostname()) {
+		return nil
+	}
+
+	if ceremonyType == CeremonyTypeTest {
+		return trace.AccessDenied("custom client redirect URLs are not allowed in SSO test")
+	}
+
+	const unknownRedirectHostnameErrMsg = "unknown custom client redirect URL hostname"
+	if settings == nil {
+		return trace.AccessDenied("%s", unknownRedirectHostnameErrMsg)
+	}
+
+	// allow HTTP or HTTPS redirects from IPs in specified CIDR ranges
+	hostIP, err := netip.ParseAddr(u.Hostname())
+	if err == nil {
+		hostIP = hostIP.Unmap()
+
+		for _, cidrStr := range settings.InsecureAllowedCidrRanges {
+			cidr, err := netip.ParsePrefix(cidrStr)
+			if err != nil {
+				slog.WarnContext(context.Background(), "error parsing OIDC connector CIDR prefix", "cidr", cidrStr, "err", err)
+				continue
+			}
+			if cidr.Contains(hostIP) {
+				return nil
+			}
+		}
+	}
+
+	if u.Scheme == "https" {
+		switch u.Port() {
+		default:
+			return trace.BadParameter("invalid port in client redirect URL")
+		case "", "443":
+		}
+
+		for _, expression := range settings.AllowedHttpsHostnames {
+			ok, err := utils.MatchString(u.Hostname(), expression)
+			if err != nil {
+				slog.WarnContext(context.Background(), "error compiling OIDC connector allowed HTTPS hostname regex", "regex", expression, "err", err)
+				continue
+			}
+			if ok {
+				return nil
+			}
+		}
+	}
+
+	return trace.AccessDenied("%s", unknownRedirectHostnameErrMsg)
+}
diff --git a/lib/client/sso/redirector_test.go b/lib/client/sso/redirector_test.go
index e684caf2e98ff..f3226356eee7f 100644
--- a/lib/client/sso/redirector_test.go
+++ b/lib/client/sso/redirector_test.go
@@ -21,6 +21,7 @@ package sso_test
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -30,6 +31,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/client/sso"
 	"github.com/gravitational/teleport/lib/web"
@@ -244,6 +246,259 @@ func TestRedirector(t *testing.T) {
 	}
 }
 
+func TestValidateClientRedirect(t *testing.T) {
+	t.Run("StandardLocalhost", func(t *testing.T) {
+		for _, goodURL := range []string{
+			"http://127.0.0.1/callback",
+			"http://127.0.0.1:1234/callback",
+			"http://[::1]/callback",
+			"http://[::1]:1234/callback",
+			"http://localhost/callback",
+			"http://localhost:1234/callback",
+		} {
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+				"Test":  sso.CeremonyTypeTest,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					var defaultSettings *types.SSOClientRedirectSettings
+					require.NoError(t, sso.ValidateClientRedirect(goodURL+"?secret_key=", ceremonyType, defaultSettings))
+				})
+			}
+		}
+	})
+
+	t.Run("InvalidLocalhostLike", func(t *testing.T) {
+		for _, badURL := range []string{
+			"http://127.0.0.1:12345/notcallback",
+			"http://127a0.0.1/callback",
+			"http://127a0.0.1:1234/callback",
+			"http://::1/callback",
+			"http://notlocalhost/callback",
+			"http://sub.localhost/callback",
+			"http://localhost.com/callback",
+			"http://127.0.0.1.example.com/callback",
+			"http://[::1].example.com/callback",
+			"http://username@127.0.0.1:12345/callback",
+			"http://@localhost:12345/callback",
+			"http://localhost@example.com/callback",
+			"http://127.0.0.1:12345@example.com/callback",
+			"https://127.0.0.1:12345/callback",
+			"https://localhost:12345/callback",
+			"https://localhost/callback",
+			"ftp://localhost/callback",
+			"ftp://127.0.0.1/callback",
+			"ftp://[::1]/callback",
+		} {
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+				"Test":  sso.CeremonyTypeTest,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					var defaultSettings *types.SSOClientRedirectSettings
+					require.Error(t, sso.ValidateClientRedirect(badURL+"?secret_key=", ceremonyType, defaultSettings))
+				})
+			}
+		}
+	})
+
+	t.Run("BadQuery", func(t *testing.T) {
+		for _, badURL := range []string{
+			"http://127.0.0.1:12345/callback",
+			"http://127.0.0.1:12345/callback?secret=a",
+			"http://127.0.0.1:12345/callback?secret_key=a&foo=b",
+		} {
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+				"Test":  sso.CeremonyTypeTest,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					var defaultSettings *types.SSOClientRedirectSettings
+					require.Error(t, sso.ValidateClientRedirect(badURL, ceremonyType, defaultSettings))
+				})
+			}
+		}
+	})
+
+	t.Run("AllowedHttpsHostnames", func(t *testing.T) {
+		for _, goodURL := range []string{
+			"https://allowed.domain.invalid/callback",
+			"https://foo.allowed.with.subdomain.invalid/callback",
+			"https://but.no.subsubdomain.invalid/callback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				AllowedHttpsHostnames: []string{
+					"allowed.domain.invalid",
+					"*.allowed.with.subdomain.invalid",
+					"^[-a-zA-Z0-9]+.no.subsubdomain.invalid$",
+				},
+			}
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					require.NoError(t, sso.ValidateClientRedirect(goodURL+"?secret_key=", ceremonyType, settings))
+				})
+			}
+		}
+
+		for _, badURL := range []string{
+			"https://allowed.domain.invalid/notcallback",
+			"https://allowed.domain.invalid:12345/callback",
+			"http://allowed.domain.invalid/callback",
+			"https://not.allowed.domain.invalid/callback",
+			"https://allowed.with.subdomain.invalid/callback",
+			"https://i.said.no.subsubdomain.invalid/callback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				AllowedHttpsHostnames: []string{
+					"allowed.domain.invalid",
+					"*.allowed.with.subdomain.invalid",
+					"^[-a-zA-Z0-9]+.no.subsubdomain.invalid",
+				},
+			}
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					require.Error(t, sso.ValidateClientRedirect(badURL+"?secret_key=", ceremonyType, settings))
+				})
+			}
+		}
+	})
+
+	t.Run("InsecureAllowedCidrRanges", func(t *testing.T) {
+		for _, goodURL := range []string{
+			"http://192.168.0.27/callback",
+			"https://192.168.0.27/callback",
+			"http://192.168.0.27:1337/callback",
+			"https://192.168.0.27:1337/callback",
+			"http://[2001:db8::aaaa:bbbb]/callback",
+			"https://[2001:db8::aaaa:bbbb]/callback",
+			"http://[2001:db8::aaaa:bbbb]:1337/callback",
+			"https://[2001:db8::aaaa:bbbb]:1337/callback",
+			"http://[2001:db8::1]/callback",
+			"https://[2001:db8::1]/callback",
+			"http://[2001:db8::1]:1337/callback",
+			"https://[2001:db8::1]:1337/callback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				InsecureAllowedCidrRanges: []string{
+					"192.168.0.0/24",
+					"2001:db8::/96",
+				},
+			}
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					require.NoError(t, sso.ValidateClientRedirect(goodURL+"?secret_key=", ceremonyType, settings))
+				})
+			}
+		}
+
+		for _, badURL := range []string{
+			"http://192.168.1.1/callback",
+			"https://192.168.1.1/callback",
+			"http://192.168.1.1:80/callback",
+			"https://192.168.1.1:443/callback",
+			"http://[2001:db8::1:aaaa:bbbb]/callback",
+			"https://[2001:db8::1:aaaa:bbbb]/callback",
+			"http://[2001:db8::1:aaaa:bbbb]:80/callback",
+			"https://[2001:db8::1:aaaa:bbbb]:443/callback",
+			"http://[2001:db9::]/callback",
+			"https://[2001:db9::]/callback",
+			"http://not.an.ip/callback",
+			"https://not.an.ip/callback",
+			"http://192.168.0.27/nocallback",
+			"https://192.168.0.27/nocallback",
+			"http://[2001:db8::1]/notacallback",
+			"https://[2001:db8::1]/notacallback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				InsecureAllowedCidrRanges: []string{
+					"192.168.0.0/24",
+					"2001:db8::/96",
+				},
+			}
+			for name, ceremonyType := range map[string]sso.CeremonyType{
+				"Login": sso.CeremonyTypeLogin,
+				"MFA":   sso.CeremonyTypeMFA,
+			} {
+				t.Run(fmt.Sprintf("Ceremony%v", name), func(t *testing.T) {
+					require.Error(t, sso.ValidateClientRedirect(badURL+"?secret_key=", ceremonyType, settings))
+				})
+			}
+		}
+	})
+
+	t.Run("SSOTestFlow", func(t *testing.T) {
+		for _, goodURL := range []string{
+			"http://127.0.0.1:12345/callback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				AllowedHttpsHostnames: []string{
+					"allowed.domain.invalid",
+				},
+			}
+			require.NoError(t, sso.ValidateClientRedirect(goodURL+"?secret_key=", sso.CeremonyTypeTest, settings))
+		}
+
+		for _, badURL := range []string{
+			"https://allowed.domain.invalid/callback",
+			"http://allowed.domain.invalid/callback",
+		} {
+			settings := &types.SSOClientRedirectSettings{
+				AllowedHttpsHostnames: []string{
+					"allowed.domain.invalid",
+				},
+			}
+			require.Error(t, sso.ValidateClientRedirect(badURL+"?secret_key=", sso.CeremonyTypeTest, settings))
+		}
+	})
+
+	t.Run("SSOMFAWeb", func(t *testing.T) {
+		settings := &types.SSOClientRedirectSettings{
+			AllowedHttpsHostnames: []string{
+				"allowed.domain.invalid",
+			},
+		}
+
+		// Only allow web mfa redirect as a relative path.
+		require.NoError(t, sso.ValidateClientRedirect(sso.WebMFARedirect+"?channel_id=", sso.CeremonyTypeMFA, settings))
+
+		for _, badURL := range []string{
+			"localhost:12345" + sso.WebMFARedirect,
+			"http://localhost:12345" + sso.WebMFARedirect,
+			"https://localhost:12345" + sso.WebMFARedirect,
+			"127.0.0.1:12345" + sso.WebMFARedirect,
+			"http://127.0.0.1:12345" + sso.WebMFARedirect,
+			"https://127.0.0.1:12345" + sso.WebMFARedirect,
+			"allowed.domain.invalid" + sso.WebMFARedirect,
+			"http://allowed.domain.invalid" + sso.WebMFARedirect,
+			"https://allowed.domain.invalid" + sso.WebMFARedirect,
+			"not.allowed.domain.invalid" + sso.WebMFARedirect,
+			"http://not.allowed.domain.invalid" + sso.WebMFARedirect,
+			"https://not.allowed.domain.invalid" + sso.WebMFARedirect,
+		} {
+			require.Error(t, sso.ValidateClientRedirect(badURL+"?channel_id=", sso.CeremonyTypeMFA, settings))
+		}
+
+		// channel_id query parameter must be set.
+		require.Error(t, sso.ValidateClientRedirect(sso.WebMFARedirect, sso.CeremonyTypeMFA, settings))
+
+		// Don't allow web mfa redirect for non-mfa ceremonies.
+		require.Error(t, sso.ValidateClientRedirect(sso.WebMFARedirect+"?channel_id=", sso.CeremonyTypeLogin, settings))
+		require.Error(t, sso.ValidateClientRedirect(sso.WebMFARedirect+"?channel_id=", sso.CeremonyTypeTest, settings))
+	})
+}
+
 // create a mock proxy server which echos the final proxy redirect destination page. e.g. sso success page.
 func newMockProxy(t *testing.T) *httptest.Server {
 	mux := http.NewServeMux()
diff --git a/lib/client/terminal/terminal_noop.go b/lib/client/terminal/terminal_noop.go
new file mode 100644
index 0000000000000..802bb907422e7
--- /dev/null
+++ b/lib/client/terminal/terminal_noop.go
@@ -0,0 +1,71 @@
+//go:build terraformprovider
+
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terminal
+
+import (
+	"io"
+
+	"github.com/gravitational/trace"
+)
+
+type Terminal struct {
+	signalEmitter
+
+	stdin  io.Reader
+	stdout io.Writer
+	stderr io.Writer
+}
+
+func New(stdin io.Reader, stdout, stderr io.Writer) (*Terminal, error) {
+	return nil, trace.NotImplemented("not implemented")
+}
+
+func (t *Terminal) Stdin() io.Reader {
+	return t.stdin
+}
+
+func (t *Terminal) Stdout() io.Writer {
+	return t.stdout
+}
+
+func (t *Terminal) Stderr() io.Writer {
+	return t.stderr
+}
+
+func (t *Terminal) InitRaw(input bool) error {
+	return trace.NotImplemented("not implemented")
+}
+
+func (t *Terminal) IsAttached() bool {
+	return false
+}
+
+func (t *Terminal) Size() (width int16, height int16, err error) {
+	return 0, 0, trace.NotImplemented("not implemented")
+}
+
+func (t *Terminal) Resize(width, height int16) error {
+	return trace.NotImplemented("not implemented")
+}
+
+func (t *Terminal) Close() error {
+	return trace.NotImplemented("not implemented")
+}
diff --git a/lib/client/terminal/terminal_unix.go b/lib/client/terminal/terminal_unix.go
index 6029d5e687be6..9cf4711548b3a 100644
--- a/lib/client/terminal/terminal_unix.go
+++ b/lib/client/terminal/terminal_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !terraformprovider
 
 /*
  * Teleport
diff --git a/lib/client/terminal/terminal_windows.go b/lib/client/terminal/terminal_windows.go
index 3c9e51ab9e229..6dace6981cc2e 100644
--- a/lib/client/terminal/terminal_windows.go
+++ b/lib/client/terminal/terminal_windows.go
@@ -1,3 +1,5 @@
+//go:build !terraformprovider
+
 /*
  * Teleport
  * Copyright (C) 2023  Gravitational, Inc.
diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index 9cf141ecb0d5f..d586da9c79476 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -66,6 +66,8 @@ type SSOLoginConsoleReq struct {
 	CertTTL       time.Duration `json:"cert_ttl"`
 	ConnectorID   string        `json:"connector_id"`
 	Compatibility string        `json:"compatibility,omitempty"`
+	// Scope specifies a target scope for the resulting credentials to be pinned to.
+	Scope string `json:"scope,omitempty"`
 	// RouteToCluster is an optional cluster name to route the response
 	// credentials to.
 	RouteToCluster string
@@ -184,37 +186,6 @@ func ParseMFAChallengeResponse(mfaResponseJSON []byte) (*proto.MFAAuthenticateRe
 	return protoResp, trace.Wrap(err)
 }
 
-// CreateSSHCertReq is passed by tsh to authenticate a local user without MFA
-// and receive short-lived certificates.
-type CreateSSHCertReq struct {
-	// User is a teleport username
-	User string `json:"user"`
-	// Password is user's pass
-	Password string `json:"password"`
-	// OTPToken is second factor token
-	OTPToken string `json:"otp_token"`
-	// HeadlessAuthenticationID is a headless authentication resource id.
-	HeadlessAuthenticationID string `json:"headless_id"`
-	// UserPublicKeys is embedded and holds user SSH and TLS public keys that
-	// should be used as the subject of issued certificates, and optional
-	// hardware key attestation statements for each key.
-	UserPublicKeys
-	TTL time.Duration `json:"ttl"`
-	// Compatibility specifies OpenSSH compatibility flags.
-	Compatibility string `json:"compatibility,omitempty"`
-	// RouteToCluster is an optional cluster name to route the response
-	// credentials to.
-	RouteToCluster string
-	// KubernetesCluster is an optional k8s cluster name to route the response
-	// credentials to.
-	KubernetesCluster string
-}
-
-// CheckAndSetDefaults checks and sets default values.
-func (r *CreateSSHCertReq) CheckAndSetDefaults() error {
-	return trace.Wrap(r.UserPublicKeys.CheckAndSetDefaults())
-}
-
 // HeadlessLoginReq is a headless login request for /webapi/headless/login.
 type HeadlessLoginReq struct {
 	// User is a teleport username
@@ -289,6 +260,8 @@ type AuthenticateSSHUserRequest struct {
 	// TTL is a desired TTL for the cert (max is still capped by server,
 	// however user can shorten the time)
 	TTL time.Duration `json:"ttl"`
+	// Scope specifies a target scope for the resulting credentials to be pinned to.
+	Scope string `json:"scope,omitempty"`
 	// Compatibility specifies OpenSSH compatibility flags.
 	Compatibility string `json:"compatibility,omitempty"`
 	// RouteToCluster is an optional cluster name to route the response
@@ -334,6 +307,8 @@ type SSHLogin struct {
 	Insecure bool
 	// Pool is x509 cert pool to use for server certificate verification
 	Pool *x509.CertPool
+	// Scope specifies a target scope for the resulting credentials to be pinned to.
+	Scope string
 	// Compatibility sets compatibility mode for SSH certificates
 	Compatibility string
 	// RouteToCluster is an optional cluster name to route the response
@@ -473,6 +448,12 @@ type TOTPRegisterChallenge struct {
 // initClient creates a new client to the HTTPS web proxy.
 func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeaders map[string]string, opts ...roundtrip.ClientParam) (*WebClient, *url.URL, error) {
 	log := slog.With(teleport.ComponentKey, teleport.ComponentClient)
+	if _, ok := extraHeaders["User-Agent"]; !ok {
+		if extraHeaders == nil {
+			extraHeaders = make(map[string]string)
+		}
+		extraHeaders["User-Agent"] = "api/" + teleport.Version
+	}
 	log.DebugContext(context.Background(), "Initializing proxy HTTPS client",
 		"proxy_addr", proxyAddr,
 		"insecure", insecure,
@@ -503,9 +484,14 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeade
 		return nil, nil, trace.Wrap(err)
 	}
 
+	header := make(http.Header)
+	for k, v := range extraHeaders {
+		header.Set(k, v)
+	}
 	opts = append(opts,
 		roundtrip.HTTPClient(newClient(insecure, pool, extraHeaders)),
 		roundtrip.CookieJar(jar),
+		roundtrip.WithHeader(header),
 	)
 	clt, err := NewWebClient(proxyAddr, opts...)
 	if err != nil {
@@ -515,41 +501,6 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeade
 	return clt, u, nil
 }
 
-// SSHAgentLogin is used by tsh to fetch local user credentials.
-func SSHAgentLogin(ctx context.Context, login SSHLoginDirect) (*authclient.SSHLoginResponse, error) {
-	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	re, err := clt.PostJSON(ctx, clt.Endpoint("webapi", "ssh", "certs"), CreateSSHCertReq{
-		User:     login.User,
-		Password: login.Password,
-		OTPToken: login.OTPToken,
-		UserPublicKeys: UserPublicKeys{
-			SSHPubKey:               login.SSHPubKey,
-			TLSPubKey:               login.TLSPubKey,
-			SSHAttestationStatement: login.SSHAttestationStatement,
-			TLSAttestationStatement: login.TLSAttestationStatement,
-		},
-		TTL:               login.TTL,
-		Compatibility:     login.Compatibility,
-		RouteToCluster:    login.RouteToCluster,
-		KubernetesCluster: login.KubernetesCluster,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var out authclient.SSHLoginResponse
-	err = json.Unmarshal(re.Bytes(), &out)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &out, nil
-}
-
 // SSHAgentHeadlessLogin begins the headless login ceremony, returning new user certificates if successful.
 func SSHAgentHeadlessLogin(ctx context.Context, login SSHLoginHeadless) (*authclient.SSHLoginResponse, error) {
 	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
@@ -569,7 +520,8 @@ func SSHAgentHeadlessLogin(ctx context.Context, login SSHLoginHeadless) (*authcl
 			SSHAttestationStatement: login.SSHAttestationStatement,
 			TLSAttestationStatement: login.TLSAttestationStatement,
 		},
-		TTL:               login.TTL,
+		TTL: login.TTL,
+		// TODO(fspmarshall/scopes): add scope support to headless login
 		Compatibility:     login.Compatibility,
 		RouteToCluster:    login.RouteToCluster,
 		KubernetesCluster: login.KubernetesCluster,
@@ -656,6 +608,7 @@ func SSHAgentPasswordlessLogin(ctx context.Context, login SSHLoginPasswordless)
 			},
 			TTL:               login.TTL,
 			Compatibility:     login.Compatibility,
+			Scope:             login.Scope,
 			RouteToCluster:    login.RouteToCluster,
 			KubernetesCluster: login.KubernetesCluster,
 		})
@@ -696,6 +649,7 @@ func SSHAgentMFALogin(ctx context.Context, login SSHLoginMFA) (*authclient.SSHLo
 		},
 		TTL:               login.TTL,
 		Compatibility:     login.Compatibility,
+		Scope:             login.Scope,
 		RouteToCluster:    login.RouteToCluster,
 		KubernetesCluster: login.KubernetesCluster,
 	}
@@ -826,13 +780,8 @@ type CreateWebSessionResponse struct {
 	SessionInactiveTimeoutMS int `json:"sessionInactiveTimeout"`
 }
 
-// SSHAgentLoginWeb is used by tsh to fetch local user credentials via the web api.
-func SSHAgentLoginWeb(ctx context.Context, login SSHLoginDirect) (*WebClient, types.WebSession, error) {
-	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
+// sshAgentLoginWebCreateSession takes an existing client and login details and attempts to create a web session using OTP token
+func sshAgentLoginWebCreateSession(ctx context.Context, clt *WebClient, login SSHLoginDirect) (types.WebSession, error) {
 	resp, err := httplib.ConvertResponse(clt.RoundTrip(func() (*http.Response, error) {
 		var buf bytes.Buffer
 		if err := json.NewEncoder(&buf).Encode(&CreateWebSessionReq{
@@ -852,10 +801,25 @@ func SSHAgentLoginWeb(ctx context.Context, login SSHLoginDirect) (*WebClient, ty
 		return clt.HTTPClient().Do(req)
 	}))
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	session, err := GetSessionFromResponse(resp)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return session, nil
+}
+
+// sshAgentLoginWeb is used by tsh to fetch local user credentials via the web api.
+func sshAgentLoginWeb(ctx context.Context, login SSHLoginDirect) (*WebClient, types.WebSession, error) {
+	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	session, err := sshAgentLoginWebCreateSession(ctx, clt, login)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -863,10 +827,10 @@ func SSHAgentLoginWeb(ctx context.Context, login SSHLoginDirect) (*WebClient, ty
 	return clt, session, nil
 }
 
-// SSHAgentMFAWebSessionLogin requests a MFA challenge via the proxy web api.
+// sshAgentMFAWebSessionLogin requests a MFA challenge via the proxy web api.
 // If the credentials are valid, the proxy will return a challenge. We then
 // prompt the user to provide 2nd factor and pass the response to the proxy.
-func SSHAgentMFAWebSessionLogin(ctx context.Context, login SSHLoginMFA) (*WebClient, types.WebSession, error) {
+func sshAgentMFAWebSessionLogin(ctx context.Context, login SSHLoginMFA) (*WebClient, types.WebSession, error) {
 	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -880,23 +844,35 @@ func SSHAgentMFAWebSessionLogin(ctx context.Context, login SSHLoginMFA) (*WebCli
 	challengeResp := AuthenticateWebUserRequest{
 		User: login.User,
 	}
+
+	var session types.WebSession
 	// Convert back from auth gRPC proto response.
 	switch r := mfaResp.Response.(type) {
+	case *proto.MFAAuthenticateResponse_TOTP:
+		// If TOTP is configured we have to fallback on direct login
+		session, err = sshAgentLoginWebCreateSession(ctx, clt, SSHLoginDirect{
+			User:     login.User,
+			Password: login.Password,
+			OTPToken: r.TOTP.Code,
+		})
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
 	case *proto.MFAAuthenticateResponse_Webauthn:
 		challengeResp.WebauthnAssertionResponse = wantypes.CredentialAssertionResponseFromProto(r.Webauthn)
-	default:
-		// No challenge was sent, so we send back just username/password.
-	}
+		loginRespJSON, err := clt.PostJSON(ctx, clt.Endpoint("webapi", "mfa", "login", "finishsession"), challengeResp)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
 
-	loginRespJSON, err := clt.PostJSON(ctx, clt.Endpoint("webapi", "mfa", "login", "finishsession"), challengeResp)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		session, err = GetSessionFromResponse(loginRespJSON)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+	default:
+		return nil, nil, trace.NotImplemented("unsupported MFA challenge for web session login (%T)", r)
 	}
 
-	session, err := GetSessionFromResponse(loginRespJSON)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
 	return clt, session, nil
 }
 
diff --git a/lib/client/x11_session.go b/lib/client/x11_session.go
index 7d83d867ab255..e6c23c3ac7738 100644
--- a/lib/client/x11_session.go
+++ b/lib/client/x11_session.go
@@ -62,7 +62,7 @@ func (ns *NodeSession) handleX11Forwarding(ctx context.Context, sess *tracessh.S
 		return trace.Wrap(err)
 	}
 
-	if err := x11.RequestForwarding(sess.Session, ns.spoofedXAuthEntry); err != nil {
+	if err := x11.RequestForwarding(ctx, sess, ns.spoofedXAuthEntry); err != nil {
 		// Notify the user that x11 forwarding request failed regardless of debug level
 		fmt.Fprintln(os.Stderr, "X11 forwarding request failed")
 		slog.DebugContext(ctx, "X11 forwarding request error", "err", err)
diff --git a/lib/cloud/aws/aws.go b/lib/cloud/aws/aws.go
index 9e8f7931b21a0..c67d188464fde 100644
--- a/lib/cloud/aws/aws.go
+++ b/lib/cloud/aws/aws.go
@@ -63,6 +63,12 @@ func IsElastiCacheClusterAvailable(cluster *ectypes.ReplicationGroup) bool {
 	return IsResourceAvailable(cluster, cluster.Status)
 }
 
+// IsElastiCacheServerlessCacheAvailable checks if the ElastiCache Serverless
+// cache is available.
+func IsElastiCacheServerlessCacheAvailable(cache *ectypes.ServerlessCache) bool {
+	return IsResourceAvailable(cache, cache.Status)
+}
+
 // IsMemoryDBClusterAvailable checks if the MemoryDB cluster is available.
 func IsMemoryDBClusterAvailable(cluster *memorydbtypes.Cluster) bool {
 	return IsResourceAvailable(cluster, cluster.Status)
@@ -202,6 +208,17 @@ func IsElastiCacheClusterSupported(cluster *ectypes.ReplicationGroup) bool {
 	return aws.ToBool(cluster.TransitEncryptionEnabled)
 }
 
+// IsElastiCacheServerlessCacheSupported checks whether the ElastiCache
+// Serverless cache is supported.
+func IsElastiCacheServerlessCacheSupported(cache *ectypes.ServerlessCache) bool {
+	switch strings.ToLower(aws.ToString(cache.Engine)) {
+	case "redis", "valkey":
+		return true
+	default:
+		return false
+	}
+}
+
 // IsMemoryDBClusterSupported checks whether the MemoryDB cluster is supported.
 func IsMemoryDBClusterSupported(cluster *memorydbtypes.Cluster) bool {
 	return aws.ToBool(cluster.TLSEnabled)
diff --git a/lib/cloud/aws/identity_test.go b/lib/cloud/aws/identity_test.go
index 747ef265b5daf..3e787689dd81c 100644
--- a/lib/cloud/aws/identity_test.go
+++ b/lib/cloud/aws/identity_test.go
@@ -22,9 +22,9 @@ import (
 	"context"
 	"testing"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/cloud/mocks"
 )
 
 // TestGetIdentity verifies parsing of AWS identity received from STS API.
@@ -77,7 +77,7 @@ func TestGetIdentity(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
-			identity, err := GetIdentityWithClient(context.Background(), &mocks.STSClient{ARN: test.inARN})
+			identity, err := GetIdentityWithClient(context.Background(), &STSClient{ARN: test.inARN})
 			require.NoError(t, err)
 			require.IsType(t, test.outIdentity, identity)
 			require.Equal(t, test.outName, identity.GetName())
@@ -87,3 +87,13 @@ func TestGetIdentity(t *testing.T) {
 		})
 	}
 }
+
+type STSClient struct {
+	ARN string
+}
+
+func (m *STSClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return &sts.GetCallerIdentityOutput{
+		Arn: aws.String(m.ARN),
+	}, nil
+}
diff --git a/lib/cloud/aws/policy_statements.go b/lib/cloud/aws/policy_statements.go
index 4289774a70a26..3f6f469e3d7b1 100644
--- a/lib/cloud/aws/policy_statements.go
+++ b/lib/cloud/aws/policy_statements.go
@@ -141,6 +141,7 @@ func StatementForEC2SSMAutoDiscover() *Statement {
 	return &Statement{
 		Effect: EffectAllow,
 		Actions: []string{
+			"account:ListRegions",
 			"ec2:DescribeInstances",
 			"ssm:DescribeInstanceInformation",
 			"ssm:GetCommandInvocation",
@@ -256,7 +257,7 @@ type ExternalAuditStoragePolicyConfig struct {
 	AthenaWorkgroupName string
 	// GlueDatabaseName is the name of the AWS Glue database.
 	GlueDatabaseName string
-	// GlueTabelName is the name of the AWS Glue table.
+	// GlueTableName is the name of the AWS Glue table.
 	GlueTableName string
 }
 
@@ -432,11 +433,93 @@ func StatementAccessGraphAWSSync() *Statement {
 			"iam:GetSAMLProvider",
 			"iam:ListOpenIDConnectProviders",
 			"iam:GetOpenIDConnectProvider",
+
+			// KMS IAM
+			// If keys disallow IAM policy delegations, these fields need to be
+			// added to the Key policy.
+			"kms:ListKeys",
+			"kms:DescribeKey",
+			"kms:GetKeyPolicy",
+			"kms:ListAliases",
+			"kms:ListResourceTags",
 		},
 		Resources: allResources,
 	}
 }
 
+// StatementAccessGraphAWSSyncSQS returns the statement that allows
+// receiving, deleting, and sending messages to the specified SQS queue.
+// This is used for receiving and processing AWS cloud trail logs notifications
+// from SQS.
+func StatementAccessGraphAWSSyncSQS(sqsQueueARN string) *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: []string{
+			"sqs:ReceiveMessage",
+			"sqs:DeleteMessage",
+		},
+		Resources: []string{sqsQueueARN},
+	}
+}
+
+// StatementsAccessGraphAWSSyncS3BucketDownload returns the statements that allows downloading
+// objects from the specified S3 bucket. This is used for downloading AWS cloud trail logs.
+func StatementsAccessGraphAWSSyncS3BucketDownload(s3BucketARN string) []*Statement {
+	return []*Statement{
+		{
+			Effect: EffectAllow,
+			Actions: []string{
+				"s3:GetObject",
+				"s3:GetObjectVersion",
+			},
+			Resources: []string{s3BucketARN + "/*"},
+		},
+		{
+			Effect: EffectAllow,
+			Actions: []string{
+				"s3:ListBucket",
+				"s3:ListBucketVersions",
+				"s3:GetBucketLocation",
+				"s3:GetBucketVersioning",
+			},
+			Resources: []string{s3BucketARN},
+		},
+	}
+}
+
+// StatementAccessGraphAWSSyncKMSDecrypt returns the statement that allows decrypting
+// KMS encrypted data. This is used for decrypting AWS cloud trail logs from S3
+// and decrypting SQS messages that are encrypted with KMS.
+// It allows the following actions:
+// - `kms:Decrypt` to decrypt data.
+// - `kms:DescribeKey` to get information about the KMS key.
+// - `kms:GenerateDataKey` to generate a data key for encryption.
+// - `kms:GenerateDataKeyWithoutPlaintext` to generate a data key without plaintext.
+func StatementKMSDecrypt(kmsKeysARNs []string) *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: []string{
+			"kms:Decrypt",
+			"kms:DescribeKey",
+			"kms:GenerateDataKey",
+			"kms:GenerateDataKeyWithoutPlaintext",
+		},
+		Resources: kmsKeysARNs,
+	}
+}
+
+// StatementEnableEKSAuditLogs returns the statement that allows fetching EKS
+// API server audit logs from CloudWatch Logs.
+func StatementAccessGraphAWSSyncEKSAuditLogs() *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: []string{
+			"logs:FilterLogEvents",
+		},
+		Resources: []string{"arn:aws:logs:*:*:log-group:/aws/eks/*"},
+	}
+}
+
 // StatementForAWSIdentityCenterAccess returns AWS IAM policy statement that grants
 // permissions required for Teleport identity center client.
 // TODO(sshah): make the roles more granular by restricting resources scoped to
@@ -482,3 +565,40 @@ func StatementForAWSIdentityCenterAccess() *Statement {
 		Resources: allResources,
 	}
 }
+
+// StatementForAWSRolesAnywhereSyncRoleTrustRelationship returns the Trust Relationship which allows its usage from the given Trust Anchor ARN.
+// See https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html#getting-started-step2
+func StatementForAWSRolesAnywhereSyncRoleTrustRelationship(region, accountID, trustAnchorID string) *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: SliceOrString{
+			"sts:AssumeRole",
+			"sts:SetSourceIdentity",
+			"sts:TagSession",
+		},
+		Principals: map[string]SliceOrString{
+			"Service": []string{"rolesanywhere.amazonaws.com"},
+		},
+		Conditions: map[string]StringOrMap{
+			"ArnEquals": {
+				"aws:SourceArn": []string{
+					fmt.Sprintf("arn:aws:rolesanywhere:%s:%s:trust-anchor/%s", region, accountID, trustAnchorID),
+				},
+			},
+		},
+	}
+}
+
+// StatementForAWSRolesAnywhereSyncRolePolicy returns the policy required to perform the sync operation, which imports Roles Anywhere Profiles into Teleport AWS Apps.
+func StatementForAWSRolesAnywhereSyncRolePolicy() *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: SliceOrString{
+			"rolesanywhere:ListProfiles",
+			"rolesanywhere:ListTagsForResource",
+			"rolesanywhere:ImportCrl",
+			"iam:GetRole",
+		},
+		Resources: allResources,
+	}
+}
diff --git a/lib/cloud/aws/ssm_documents.go b/lib/cloud/aws/ssm_documents.go
index 4ed458c2c40a5..5dcb574647cd6 100644
--- a/lib/cloud/aws/ssm_documents.go
+++ b/lib/cloud/aws/ssm_documents.go
@@ -63,6 +63,10 @@ parameters:
   scriptName:
     type: String
     description: "(Required) The Teleport installer script to use when joining the cluster."
+  env:
+    type: String
+    description: "Environment variables exported to the script. Format 'ENV=var FOO=bar'"
+    default: "X=$X"
 mainSteps:
 - action: aws:downloadContent
   name: downloadContent
@@ -76,7 +80,7 @@ mainSteps:
   inputs:
     timeoutSeconds: '300'
     runCommand:
-      - /bin/sh %s "{{ token }}"
+      - export {{ env }}; /bin/sh %s "{{ token }}"
 `, installTeleportPath, proxy, installTeleportPath)
 }
 
diff --git a/lib/cloud/awsconfig/awsconfig.go b/lib/cloud/awsconfig/awsconfig.go
index 89b366a39f043..682c83e746044 100644
--- a/lib/cloud/awsconfig/awsconfig.go
+++ b/lib/cloud/awsconfig/awsconfig.go
@@ -32,8 +32,11 @@ import (
 	"github.com/aws/smithy-go/tracing/smithyoteltracing"
 	"github.com/gravitational/trace"
 	"go.opentelemetry.io/otel"
+	"google.golang.org/protobuf/types/known/durationpb"
 
+	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
 )
@@ -50,17 +53,31 @@ const (
 	credentialsSourceIntegration
 )
 
-// OIDCIntegrationClient is an interface that indicates which APIs are
-// required to generate an AWS OIDC integration token.
-type OIDCIntegrationClient interface {
+// IntegrationGetter is an interface that indicates which APIs are
+// required to get an integration.
+// Required when using integration credentials.
+type IntegrationGetter interface {
 	// GetIntegration returns the specified integration resource.
 	GetIntegration(ctx context.Context, name string) (types.Integration, error)
+}
 
+// OIDCIntegrationClient is an interface that indicates which APIs are
+// required to generate an AWS OIDC integration token.
+type OIDCIntegrationClient interface {
+	IntegrationGetter
 	// GenerateAWSOIDCToken generates a token to be used to execute an AWS OIDC
 	// Integration action.
 	GenerateAWSOIDCToken(ctx context.Context, integrationName string) (string, error)
 }
 
+// RolesAnywhereIntegrationClient is an interface that indicates which APIs are
+// required to generate a set of AWS credentials using the AWS IAM Roles Anywhere integration.
+type RolesAnywhereIntegrationClient interface {
+	IntegrationGetter
+	// GenerateAWSRACredentials generates a token to be used to execute an AWS IAM Roles Anywhere integration.
+	GenerateAWSRACredentials(ctx context.Context, req *integrationpb.GenerateAWSRACredentialsRequest) (*integrationpb.GenerateAWSRACredentialsResponse, error)
+}
+
 // STSClient is a subset of the AWS STS API.
 type STSClient interface {
 	stscreds.AssumeRoleAPIClient
@@ -96,10 +113,21 @@ type options struct {
 	credentialsSource credentialsSource
 	// integration is the name of the integration to be used to fetch the credentials.
 	integration string
+	// integrationGetter provides APIs to get the AWS integration.
+	// Required if integration credentials are requested.
+	integrationGetter IntegrationGetter
+
 	// oidcIntegrationClient provides APIs to generate AWS OIDC tokens, which
 	// can then be exchanged for IAM credentials.
-	// Required if integration credentials are requested.
+	// Required when integration uses IAM OIDC IdP to obtain credentials.
 	oidcIntegrationClient OIDCIntegrationClient
+
+	// rolesAnywhereIntegrationClient provides APIs to generate AWS credentials.
+	// Required when integration uses IAM Roles Anywhere service to obtain credentials.
+	rolesAnywhereIntegrationClient RolesAnywhereIntegrationClient
+	// rolesAnywhereIntegrationMetadata contains the Roles Anywhere Profile and IAM Role to use.
+	rolesAnywhereIntegrationMetadata RolesAnywhereMetadata
+
 	// customRetryer is a custom retryer to use for the config.
 	customRetryer func() aws.Retryer
 	// maxRetries is the maximum number of retries to use for the config.
@@ -108,6 +136,10 @@ type options struct {
 	stsClientProvider STSClientProviderFunc
 	// baseCredentials is the base config used to assume the roles.
 	baseCredentials aws.CredentialsProvider
+	// withFallbackRegionResolver is a fallback region resolver func that is
+	// called if a config does not resolve a region. If the resolver returns an
+	// error, then the default region (us-east-1) will be used.
+	withFallbackRegionResolver func(ctx context.Context) (string, error)
 }
 
 func buildOptions(optFns ...OptionsFn) (*options, error) {
@@ -129,11 +161,8 @@ func (o *options) checkAndSetDefaults() error {
 				return trace.BadParameter("integration and ambient credentials cannot be used at the same time")
 			}
 		case credentialsSourceIntegration:
-			if o.integration == "" {
-				return trace.BadParameter("missing integration name")
-			}
-			if o.oidcIntegrationClient == nil {
-				return trace.BadParameter("missing AWS OIDC integration client")
+			if err := o.checkIntegrationCredentials(); err != nil {
+				return trace.Wrap(err)
 			}
 		default:
 			return trace.BadParameter("missing credentials source (ambient or integration)")
@@ -154,10 +183,37 @@ func (o *options) checkAndSetDefaults() error {
 	return nil
 }
 
+func (o *options) checkIntegrationCredentials() error {
+	if o.integration == "" {
+		return trace.BadParameter("missing integration name")
+	}
+
+	if o.integrationGetter == nil {
+		return trace.BadParameter("missing integration getter")
+	}
+
+	if o.oidcIntegrationClient == nil && o.rolesAnywhereIntegrationClient == nil {
+		return trace.BadParameter("missing AWS integration client")
+	}
+
+	return nil
+}
+
 // OptionsFn is an option function for setting additional options
 // when getting an AWS config.
 type OptionsFn func(*options)
 
+// AssumedRoles extracts the assumed roles from the provided options.
+// Only used in testing.
+func AssumedRoles(opts ...OptionsFn) []AssumeRole {
+	var options options
+	for _, optFn := range opts {
+		optFn(&options)
+	}
+
+	return options.assumeRoles
+}
+
 // WithAssumeRole configures options needed for assuming an AWS role.
 func WithAssumeRole(roleARN, externalID string) OptionsFn {
 	return func(options *options) {
@@ -198,23 +254,58 @@ func WithMaxRetries(maxRetries int) OptionsFn {
 	}
 }
 
+// IntegrationMetadata contains the metadata about the Integration to use
+// when using the integration credentials source.
+type IntegrationMetadata struct {
+	// Name of the integration.
+	// Will be empty when using ambient credentials.
+	Name string
+
+	// RolesAnywhereMetadata contains the metadata about the Roles Anywhere.
+	// Only set when the Integration is of AWS IAM Roles Anywhere subkind.
+	RolesAnywhereMetadata RolesAnywhereMetadata
+}
+
+// RolesAnywhereMetadata contains the metadata required to use AWS IAM Roles Anywhere
+// to generate credentials.
+type RolesAnywhereMetadata struct {
+	// ProfileARN is the ARN of the Roles Anywhere profile.
+	ProfileARN string
+	// ProfileAcceptsRoleSessionName indicates whether the profile accepts a role session name.
+	ProfileAcceptsRoleSessionName bool
+	// RoleARN is the ARN of the role to assume.
+	RoleARN string
+	// IdentityUsername is the username to use when generating the AWS credentials.
+	// This will be used as the Subject Common Name (CN) in the certificate, and logged in CloudTrail if ProfileAcceptsRoleSessionName is true.
+	// Should be set to the teleport's username.
+	IdentityUsername string
+	// SessionDuration is used to calculate the expiration time for the AWS session.
+	// Must be lower or equal to the maximum session duration of the role.
+	// The actual session duration will be the minimum between this value (if not zero) and the Profile's max session duration.
+	SessionDuration time.Duration
+}
+
 // WithCredentialsMaybeIntegration sets the credential source to be
 // - ambient if the integration is an empty string
 // - integration, otherwise
-func WithCredentialsMaybeIntegration(integration string) OptionsFn {
-	if integration != "" {
-		return withIntegrationCredentials(integration)
+// When using integration, relevant integration metadata must be provided.
+func WithCredentialsMaybeIntegration(integrationMetadata IntegrationMetadata) OptionsFn {
+	if integrationMetadata.Name == "" {
+		return WithAmbientCredentials()
 	}
 
-	return WithAmbientCredentials()
+	return func(options *options) {
+		options.credentialsSource = credentialsSourceIntegration
+		options.integration = integrationMetadata.Name
+		options.rolesAnywhereIntegrationMetadata = integrationMetadata.RolesAnywhereMetadata
+	}
 }
 
-// withIntegrationCredentials configures options with an Integration that must be used to fetch Credentials to assume a role.
-// This prevents the usage of AWS environment credentials.
-func withIntegrationCredentials(integration string) OptionsFn {
+// WithRolesAnywhereIntegrationClient sets the Roles Anywhere integration client.
+func WithRolesAnywhereIntegrationClient(c RolesAnywhereIntegrationClient) OptionsFn {
 	return func(options *options) {
-		options.credentialsSource = credentialsSourceIntegration
-		options.integration = integration
+		options.rolesAnywhereIntegrationClient = c
+		options.integrationGetter = c
 	}
 }
 
@@ -236,6 +327,7 @@ func WithSTSClientProvider(fn STSClientProviderFunc) OptionsFn {
 func WithOIDCIntegrationClient(c OIDCIntegrationClient) OptionsFn {
 	return func(options *options) {
 		options.oidcIntegrationClient = c
+		options.integrationGetter = c
 	}
 }
 
@@ -247,6 +339,15 @@ func WithBaseCredentialsProvider(baseCredentialsProvider aws.CredentialsProvider
 	}
 }
 
+// WithFallbackRegionResolver sets a fallback region resolver func that is
+// called if a config does not resolve a region. If the resolver returns an
+// error, then the default region (us-east-1) will be used.
+func WithFallbackRegionResolver(fn func(ctx context.Context) (string, error)) OptionsFn {
+	return func(o *options) {
+		o.withFallbackRegionResolver = fn
+	}
+}
+
 // GetConfig returns an AWS config for the specified region, optionally
 // assuming AWS IAM Roles.
 func GetConfig(ctx context.Context, region string, optFns ...OptionsFn) (aws.Config, error) {
@@ -266,12 +367,26 @@ func GetConfig(ctx context.Context, region string, optFns ...OptionsFn) (aws.Con
 func loadDefaultConfig(ctx context.Context, region string, cred aws.CredentialsProvider, opts *options) (aws.Config, error) {
 	configOpts := buildConfigOptions(region, cred, opts)
 	cfg, err := config.LoadDefaultConfig(ctx, configOpts...)
-	return cfg, trace.Wrap(err)
+	if err != nil {
+		return aws.Config{}, trace.Wrap(err)
+	}
+	if len(cfg.Region) == 0 && opts.withFallbackRegionResolver != nil {
+		region, err := opts.withFallbackRegionResolver(ctx)
+		if err == nil {
+			cfg.Region = region
+		} else {
+			slog.DebugContext(ctx, "fallback region resolver failed, using the default region",
+				"default_region", defaultRegion,
+				"error", err,
+			)
+			cfg.Region = defaultRegion
+		}
+	}
+	return cfg, nil
 }
 
 func buildConfigOptions(region string, cred aws.CredentialsProvider, opts *options) []func(*config.LoadOptions) error {
 	configOpts := []func(*config.LoadOptions) error{
-		config.WithDefaultRegion(defaultRegion),
 		config.WithRegion(region),
 		config.WithCredentialsProvider(cred),
 		config.WithCredentialsCacheOptions(awsCredentialsCacheOptions),
@@ -285,6 +400,12 @@ func buildConfigOptions(region string, cred aws.CredentialsProvider, opts *optio
 	if opts.maxRetries != nil {
 		configOpts = append(configOpts, config.WithRetryMaxAttempts(*opts.maxRetries))
 	}
+	if opts.withFallbackRegionResolver == nil {
+		// if we pass WithDefaultRegion, then we will never get back an empty
+		// region, so we have to skip passing it here if we want to make use of
+		// a custom fallback resolver.
+		configOpts = append(configOpts, config.WithDefaultRegion(defaultRegion))
+	}
 	return configOpts
 }
 
@@ -294,23 +415,27 @@ func getBaseConfig(ctx context.Context, region string, opts *options) (aws.Confi
 		return loadDefaultConfig(ctx, region, opts.baseCredentials, opts)
 	}
 
-	slog.DebugContext(ctx, "Initializing AWS config from default credential chain",
-		"region", region,
-	)
+	slog.DebugContext(ctx, "Initializing AWS config from default credential chain")
 	cfg, err := loadDefaultConfig(ctx, region, nil, opts)
 	if err != nil {
 		return aws.Config{}, trace.Wrap(err)
 	}
+	slog.DebugContext(ctx, "Loaded AWS config from default credential chain",
+		"region", cfg.Region,
+	)
 
 	if opts.credentialsSource == credentialsSourceIntegration {
-		slog.DebugContext(ctx, "Initializing AWS config with OIDC integration credentials",
+		slog.DebugContext(ctx, "Initializing AWS config with integration credentials",
 			"region", region,
 			"integration", opts.integration,
 		)
 		provider := &integrationCredentialsProvider{
-			OIDCIntegrationClient: opts.oidcIntegrationClient,
-			stsClt:                opts.stsClientProvider(cfg),
-			integrationName:       opts.integration,
+			stsClt:                         opts.stsClientProvider(cfg),
+			integrationName:                opts.integration,
+			integrationGetter:              opts.integrationGetter,
+			oidcIntegrationClient:          opts.oidcIntegrationClient,
+			rolesAnywhereIntegrationClient: opts.rolesAnywhereIntegrationClient,
+			rolesAnywhereProfileMetadata:   opts.rolesAnywhereIntegrationMetadata,
 		}
 		cc := aws.NewCredentialsCache(provider, awsCredentialsCacheOptions)
 		_, err := cc.Retrieve(ctx)
@@ -365,33 +490,75 @@ func (t staticIdentityToken) GetIdentityToken() ([]byte, error) {
 	return []byte(t), nil
 }
 
-// integrationCredentialsProvider provides AWS OIDC integration credentials.
+// integrationCredentialsProvider provides AWS integration credentials.
 type integrationCredentialsProvider struct {
-	OIDCIntegrationClient
 	stsClt          STSClient
 	integrationName string
+
+	integrationGetter IntegrationGetter
+
+	oidcIntegrationClient OIDCIntegrationClient
+
+	rolesAnywhereIntegrationClient RolesAnywhereIntegrationClient
+	rolesAnywhereProfileMetadata   RolesAnywhereMetadata
 }
 
-// Retrieve provides [aws.Credentials] for an AWS OIDC integration.
+// Retrieve provides [aws.Credentials] for an AWS integration.
 func (p *integrationCredentialsProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
-	integration, err := p.GetIntegration(ctx, p.integrationName)
+	integration, err := p.integrationGetter.GetIntegration(ctx, p.integrationName)
 	if err != nil {
 		return aws.Credentials{}, trace.Wrap(err)
 	}
-	spec := integration.GetAWSOIDCIntegrationSpec()
-	if spec == nil {
-		return aws.Credentials{}, trace.BadParameter("invalid integration subkind, expected awsoidc, got %s", integration.GetSubKind())
-	}
-	token, err := p.GenerateAWSOIDCToken(ctx, p.integrationName)
-	if err != nil {
-		return aws.Credentials{}, trace.Wrap(err)
+
+	switch integration.GetSubKind() {
+	case types.IntegrationSubKindAWSOIDC:
+		if p.oidcIntegrationClient == nil {
+			return aws.Credentials{}, trace.BadParameter("missing OIDC integration client")
+		}
+
+		spec := integration.GetAWSOIDCIntegrationSpec()
+		if spec == nil {
+			return aws.Credentials{}, trace.BadParameter("invalid integration subkind, expected awsoidc, got %s", integration.GetSubKind())
+		}
+		token, err := p.oidcIntegrationClient.GenerateAWSOIDCToken(ctx, p.integrationName)
+		if err != nil {
+			return aws.Credentials{}, trace.Wrap(err)
+		}
+		cred, err := stscreds.NewWebIdentityRoleProvider(
+			p.stsClt,
+			spec.RoleARN,
+			staticIdentityToken(token),
+		).Retrieve(ctx)
+		return cred, trace.Wrap(err)
+
+	case types.IntegrationSubKindAWSRolesAnywhere:
+		if p.rolesAnywhereIntegrationClient == nil {
+			return aws.Credentials{}, trace.BadParameter("missing roles anywhere integration client")
+		}
+
+		resp, err := p.rolesAnywhereIntegrationClient.GenerateAWSRACredentials(ctx, &integrationpb.GenerateAWSRACredentialsRequest{
+			Integration:                   p.integrationName,
+			ProfileArn:                    p.rolesAnywhereProfileMetadata.ProfileARN,
+			ProfileAcceptsRoleSessionName: p.rolesAnywhereProfileMetadata.ProfileAcceptsRoleSessionName,
+			RoleArn:                       p.rolesAnywhereProfileMetadata.RoleARN,
+			SubjectName:                   p.rolesAnywhereProfileMetadata.IdentityUsername,
+			SessionMaxDuration:            durationpb.New(p.rolesAnywhereProfileMetadata.SessionDuration),
+		})
+		if err != nil {
+			return aws.Credentials{}, trace.Wrap(err)
+		}
+
+		return aws.Credentials{
+			AccessKeyID:     resp.AccessKeyId,
+			SecretAccessKey: resp.SecretAccessKey,
+			SessionToken:    resp.SessionToken,
+			Expires:         resp.Expiration.AsTime(),
+			Source:          awsra.AWSCredentialsSourceRolesAnywhere,
+		}, nil
+
+	default:
+		return aws.Credentials{}, trace.BadParameter("invalid integration subkind, expected AWS OIDC or AWS Roles Anywhere, got %s", integration.GetSubKind())
 	}
-	cred, err := stscreds.NewWebIdentityRoleProvider(
-		p.stsClt,
-		spec.RoleARN,
-		staticIdentityToken(token),
-	).Retrieve(ctx)
-	return cred, trace.Wrap(err)
 }
 
 // maybeHashRoleSessionName truncates the role session name and adds a hash
diff --git a/lib/cloud/awsconfig/awsconfig_test.go b/lib/cloud/awsconfig/awsconfig_test.go
index 71d6ae6eb4c7e..1331763d171a9 100644
--- a/lib/cloud/awsconfig/awsconfig_test.go
+++ b/lib/cloud/awsconfig/awsconfig_test.go
@@ -28,7 +28,9 @@ import (
 	ststypes "github.com/aws/aws-sdk-go-v2/service/sts/types"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
+	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -111,11 +113,11 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		return &mockAssumeRoleAPIClient{}
 	}
 
-	t.Run("without an integration client, must return missing credential provider error", func(t *testing.T) {
+	t.Run("without an integration client, must return missing integration getter error", func(t *testing.T) {
 		ctx := context.Background()
-		_, err := provider.GetConfig(ctx, dummyRegion, WithCredentialsMaybeIntegration(dummyIntegration))
+		_, err := provider.GetConfig(ctx, dummyRegion, WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}))
 		require.True(t, trace.IsBadParameter(err), "unexpected error: %v", err)
-		require.ErrorContains(t, err, "missing AWS OIDC integration client")
+		require.ErrorContains(t, err, "missing integration getter")
 	})
 
 	t.Run("with an integration client, must return integration fetch error", func(t *testing.T) {
@@ -126,7 +128,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 			return nil, trace.NotFound("integration not found")
 		}
 		_, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithSTSClientProvider(stsClt),
 		)
@@ -150,7 +152,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 			return azureIntegration, nil
 		}
 		_, err = provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithSTSClientProvider(stsClt),
 		)
@@ -165,7 +167,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 			return "", trace.BadParameter("failed to generate OIDC token")
 		}
 		_, err = provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithSTSClientProvider(stsClt),
 		)
@@ -177,7 +179,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		ctx := context.Background()
 
 		cfg, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithSTSClientProvider(stsClt),
 		)
@@ -191,7 +193,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		ctx := context.Background()
 
 		cfg, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithAssumeRole("roleA", "abc123"),
 			WithSTSClientProvider(stsClt),
@@ -206,7 +208,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 	t.Run("with an integration credential provider assuming a role, must limit role chain length", func(t *testing.T) {
 		ctx := context.Background()
 		_, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(dummyIntegration),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{Name: dummyIntegration}),
 			WithOIDCIntegrationClient(&fakeIntegrationClt),
 			WithAssumeRole("roleA", "abc123"),
 			WithAssumeRole("roleB", "abc123"),
@@ -221,7 +223,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		ctx := context.Background()
 
 		_, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(""),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{}),
 			WithOIDCIntegrationClient(&fakeOIDCIntegrationClient{unauth: true}),
 		)
 		require.NoError(t, err)
@@ -251,7 +253,7 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		ctx := context.Background()
 
 		baseCfg, err := provider.GetConfig(ctx, dummyRegion,
-			WithCredentialsMaybeIntegration(""),
+			WithCredentialsMaybeIntegration(IntegrationMetadata{}),
 			WithOIDCIntegrationClient(&fakeOIDCIntegrationClient{unauth: true}),
 		)
 		require.NoError(t, err)
@@ -268,6 +270,61 @@ func testGetConfigIntegration(t *testing.T, provider Provider) {
 		require.Equal(t, "role: roleA, externalID: abc123", creds.AccessKeyID)
 		require.Equal(t, "fake-session-token", creds.SessionToken)
 	})
+
+	t.Run("with a Roles Anywhere integration", func(t *testing.T) {
+		ctx := context.Background()
+
+		integrationClient := &mockRolesAnywhereClient{
+			getIntegrationFn: func(context.Context, string) (types.Integration, error) {
+				awsRAIntegration, err := types.NewIntegrationAWSRA(
+					types.Metadata{Name: "integration-test"},
+					&types.AWSRAIntegrationSpecV1{
+						TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+					},
+				)
+				require.NoError(t, err)
+				return awsRAIntegration, nil
+			},
+		}
+
+		integrationMetadata := IntegrationMetadata{
+			Name: dummyIntegration,
+			RolesAnywhereMetadata: RolesAnywhereMetadata{
+				ProfileARN:                    "my-profile-arn",
+				ProfileAcceptsRoleSessionName: true,
+				RoleARN:                       "arn:aws:iam::123456789012:role/role",
+				IdentityUsername:              "alice",
+			},
+		}
+		cfg, err := provider.GetConfig(ctx, dummyRegion,
+			WithCredentialsMaybeIntegration(integrationMetadata),
+			WithRolesAnywhereIntegrationClient(integrationClient),
+			WithSTSClientProvider(stsClt),
+		)
+		require.NoError(t, err)
+		creds, err := cfg.Credentials.Retrieve(ctx)
+		require.NoError(t, err)
+		require.Equal(t, "mock-access-key-id", creds.AccessKeyID)
+		require.Equal(t, "mock-secret-access-key", creds.SecretAccessKey)
+		require.Equal(t, "mock-session-token", creds.SessionToken)
+	})
+}
+
+type mockRolesAnywhereClient struct {
+	getIntegrationFn func(context.Context, string) (types.Integration, error)
+}
+
+func (f *mockRolesAnywhereClient) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+	return f.getIntegrationFn(ctx, name)
+}
+
+func (m *mockRolesAnywhereClient) GenerateAWSRACredentials(ctx context.Context, req *integrationpb.GenerateAWSRACredentialsRequest) (*integrationpb.GenerateAWSRACredentialsResponse, error) {
+	return &integrationpb.GenerateAWSRACredentialsResponse{
+		Expiration:      timestamppb.New(time.Now().Add(1 * time.Hour)),
+		AccessKeyId:     "mock-access-key-id",
+		SecretAccessKey: "mock-secret-access-key",
+		SessionToken:    "mock-session-token",
+	}, nil
 }
 
 func TestNewCacheKey(t *testing.T) {
@@ -275,12 +332,35 @@ func TestNewCacheKey(t *testing.T) {
 		{RoleARN: "roleA"},
 		{RoleARN: "roleB", ExternalID: "abc123", SessionName: "alice", Tags: map[string]string{"AKey": "AValue"}},
 	}
-	got, err := newCacheKey("integration-name", roleChain...)
-	require.NoError(t, err)
-	want := strings.TrimSpace(`
-{"integration":"integration-name","role_chain":[{"role_arn":"roleA"},{"role_arn":"roleB","external_id":"abc123","session_name":"alice","tags":{"AKey":"AValue"}}]}
+
+	t.Run("aws oidc integration", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := newCacheKey("integration-name", RolesAnywhereMetadata{}, roleChain...)
+		require.NoError(t, err)
+		want := strings.TrimSpace(`
+{"integration":"integration-name","role_chain":[{"role_arn":"roleA"},{"role_arn":"roleB","external_id":"abc123","session_name":"alice","tags":{"AKey":"AValue"}}],"roles_anywhere_integration_metadata":{"ProfileARN":"","ProfileAcceptsRoleSessionName":false,"RoleARN":"","IdentityUsername":"","SessionDuration":0}}
+`)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("aws roles anywhere integration", func(t *testing.T) {
+		t.Parallel()
+		rolesAnywhereMetadata := RolesAnywhereMetadata{
+			ProfileARN:                    "my-profile-arn",
+			ProfileAcceptsRoleSessionName: true,
+			RoleARN:                       "arn:aws:iam::123456789012:role/role",
+			IdentityUsername:              "alice",
+			SessionDuration:               time.Hour,
+		}
+
+		got, err := newCacheKey("integration-name", rolesAnywhereMetadata, roleChain...)
+		require.NoError(t, err)
+		want := strings.TrimSpace(`
+{"integration":"integration-name","role_chain":[{"role_arn":"roleA"},{"role_arn":"roleB","external_id":"abc123","session_name":"alice","tags":{"AKey":"AValue"}}],"roles_anywhere_integration_metadata":{"ProfileARN":"my-profile-arn","ProfileAcceptsRoleSessionName":true,"RoleARN":"arn:aws:iam::123456789012:role/role","IdentityUsername":"alice","SessionDuration":3600000000000}}
 `)
-	require.Equal(t, want, got)
+		require.Equal(t, want, got)
+	})
 }
 
 type fakeOIDCIntegrationClient struct {
diff --git a/lib/cloud/awsconfig/cache.go b/lib/cloud/awsconfig/cache.go
index effd446055cab..4bee01c453870 100644
--- a/lib/cloud/awsconfig/cache.go
+++ b/lib/cloud/awsconfig/cache.go
@@ -105,7 +105,7 @@ func (c *Cache) getBaseConfig(ctx context.Context, region string, opts *options)
 	// loading.
 	// We cache the entire config by integration name, which is empty for
 	// non-integration config, but only use credentials from it on cache hit.
-	cacheKey, err := newCacheKey(opts.integration)
+	cacheKey, err := newCacheKey(opts.integration, opts.rolesAnywhereIntegrationMetadata)
 	if err != nil {
 		return aws.Config{}, trace.Wrap(err)
 	}
@@ -136,7 +136,7 @@ func (c *Cache) getBaseConfig(ctx context.Context, region string, opts *options)
 func (c *Cache) getConfigForRoleChain(ctx context.Context, cfg aws.Config, opts *options) (aws.Config, error) {
 	for i, r := range opts.assumeRoles {
 		// cache credentials by integration and assumed-role chain.
-		cacheKey, err := newCacheKey(opts.integration, opts.assumeRoles[:i+1]...)
+		cacheKey, err := newCacheKey(opts.integration, opts.rolesAnywhereIntegrationMetadata, opts.assumeRoles[:i+1]...)
 		if err != nil {
 			return aws.Config{}, trace.Wrap(err)
 		}
@@ -164,14 +164,16 @@ func (c *Cache) getConfigForRoleChain(ctx context.Context, cfg aws.Config, opts
 // The cache key can be used to get role credentials without calling AWS STS.
 // Therefore, we marshal the key as JSON to be sure the input cannot be
 // manipulated to retrieve other credentials.
-func newCacheKey(integrationName string, roleChain ...AssumeRole) (string, error) {
+func newCacheKey(integrationName string, rolesAnywhereIntegrationMetadata RolesAnywhereMetadata, roleChain ...AssumeRole) (string, error) {
 	type configCacheKey struct {
-		Integration string       `json:"integration"`
-		RoleChain   []AssumeRole `json:"role_chain"`
+		Integration                      string                `json:"integration"`
+		RoleChain                        []AssumeRole          `json:"role_chain"`
+		RolesAnywhereIntegrationMetadata RolesAnywhereMetadata `json:"roles_anywhere_integration_metadata"`
 	}
 	out, err := json.Marshal(configCacheKey{
-		Integration: integrationName,
-		RoleChain:   roleChain,
+		Integration:                      integrationName,
+		RoleChain:                        roleChain,
+		RolesAnywhereIntegrationMetadata: rolesAnywhereIntegrationMetadata,
 	})
 	return string(out), trace.Wrap(err)
 }
diff --git a/lib/cloud/azure/azuretest/azure.go b/lib/cloud/azure/azuretest/azure.go
new file mode 100644
index 0000000000000..7eb85214eb096
--- /dev/null
+++ b/lib/cloud/azure/azuretest/azure.go
@@ -0,0 +1,122 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package azuretest
+
+import (
+	"context"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+
+	"github.com/gravitational/teleport/lib/cloud/azure"
+)
+
+type Clients struct {
+	AzureMySQL              azure.DBServersClient
+	AzureMySQLPerSub        map[string]azure.DBServersClient
+	AzurePostgres           azure.DBServersClient
+	AzurePostgresPerSub     map[string]azure.DBServersClient
+	AzureSubscriptionClient *azure.SubscriptionClient
+	AzureRedis              azure.RedisClient
+	AzureRedisEnterprise    azure.RedisEnterpriseClient
+	AzureAKSClientPerSub    map[string]azure.AKSClient
+	AzureAKSClient          azure.AKSClient
+	AzureVirtualMachines    azure.VirtualMachinesClient
+	AzureSQLServer          azure.SQLServerClient
+	AzureManagedSQLServer   azure.ManagedSQLServerClient
+	AzureMySQLFlex          azure.MySQLFlexServersClient
+	AzurePostgresFlex       azure.PostgresFlexServersClient
+	AzureRunCommand         azure.RunCommandClient
+}
+
+var _ azure.Clients = (*Clients)(nil)
+
+// GetCredential returns default Azure token credential chain.
+func (c *Clients) GetCredential(ctx context.Context) (azcore.TokenCredential, error) {
+	return &azidentity.ChainedTokenCredential{}, nil
+}
+
+// GetMySQLClient returns an AzureMySQLClient for the specified subscription
+func (c *Clients) GetMySQLClient(ctx context.Context, subscription string) (azure.DBServersClient, error) {
+	if len(c.AzureMySQLPerSub) != 0 {
+		return c.AzureMySQLPerSub[subscription], nil
+	}
+	return c.AzureMySQL, nil
+}
+
+// GetPostgresClient returns an AzurePostgresClient for the specified subscription
+func (c *Clients) GetPostgresClient(ctx context.Context, subscription string) (azure.DBServersClient, error) {
+	if len(c.AzurePostgresPerSub) != 0 {
+		return c.AzurePostgresPerSub[subscription], nil
+	}
+	return c.AzurePostgres, nil
+}
+
+// GetKubernetesClient returns an AKS client for the specified subscription
+func (c *Clients) GetKubernetesClient(ctx context.Context, subscription string) (azure.AKSClient, error) {
+	if len(c.AzureAKSClientPerSub) != 0 {
+		return c.AzureAKSClientPerSub[subscription], nil
+	}
+	return c.AzureAKSClient, nil
+}
+
+// GetSubscriptionClient returns an Azure SubscriptionClient
+func (c *Clients) GetSubscriptionClient(ctx context.Context) (*azure.SubscriptionClient, error) {
+	return c.AzureSubscriptionClient, nil
+}
+
+// GetRedisClient returns an Azure Redis client for the given subscription.
+func (c *Clients) GetRedisClient(ctx context.Context, subscription string) (azure.RedisClient, error) {
+	return c.AzureRedis, nil
+}
+
+// GetRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
+func (c *Clients) GetRedisEnterpriseClient(ctx context.Context, subscription string) (azure.RedisEnterpriseClient, error) {
+	return c.AzureRedisEnterprise, nil
+}
+
+// GetVirtualMachinesClient returns an Azure Virtual Machines client for
+// the given subscription.
+func (c *Clients) GetVirtualMachinesClient(ctx context.Context, subscription string) (azure.VirtualMachinesClient, error) {
+	return c.AzureVirtualMachines, nil
+}
+
+// GetSQLServerClient returns an Azure client for listing SQL servers.
+func (c *Clients) GetSQLServerClient(ctx context.Context, subscription string) (azure.SQLServerClient, error) {
+	return c.AzureSQLServer, nil
+}
+
+// GetManagedSQLServerClient returns an Azure client for listing managed
+// SQL servers.
+func (c *Clients) GetManagedSQLServerClient(ctx context.Context, subscription string) (azure.ManagedSQLServerClient, error) {
+	return c.AzureManagedSQLServer, nil
+}
+
+// GetMySQLFlexServersClient returns an Azure MySQL Flexible server client for listing MySQL Flexible servers.
+func (c *Clients) GetMySQLFlexServersClient(ctx context.Context, subscription string) (azure.MySQLFlexServersClient, error) {
+	return c.AzureMySQLFlex, nil
+}
+
+// GetPostgresFlexServersClient returns an Azure PostgreSQL Flexible server client for listing PostgreSQL Flexible servers.
+func (c *Clients) GetPostgresFlexServersClient(ctx context.Context, subscription string) (azure.PostgresFlexServersClient, error) {
+	return c.AzurePostgresFlex, nil
+}
+
+// GetRunCommandClient returns an Azure Run Command client for the given subscription.
+func (c *Clients) GetRunCommandClient(ctx context.Context, subscription string) (azure.RunCommandClient, error) {
+	return c.AzureRunCommand, nil
+}
diff --git a/lib/cloud/azure/client_map.go b/lib/cloud/azure/client_map.go
index c12ab08f0c818..ae894a0491cd1 100644
--- a/lib/cloud/azure/client_map.go
+++ b/lib/cloud/azure/client_map.go
@@ -78,9 +78,9 @@ func NewClientMap[ClientType any](
 
 // Get returns an Azure client by subscription. A new client is created if the
 // subscription is not found in the map.
-func (m *ClientMap[ClientType]) Get(subscription string, getCredentials func() (azcore.TokenCredential, error)) (ClientType, error) {
-	client, err := utils.FnCacheGet(context.Background(), m.clients, subscription, func(ctx context.Context) (client ClientType, err error) {
-		cred, err := getCredentials()
+func (m *ClientMap[ClientType]) Get(ctx context.Context, subscription string, getCredentials func(ctx context.Context) (azcore.TokenCredential, error)) (ClientType, error) {
+	client, err := utils.FnCacheGet(ctx, m.clients, subscription, func(ctx context.Context) (client ClientType, err error) {
+		cred, err := getCredentials(ctx)
 		if err != nil {
 			return client, trace.Wrap(err)
 		}
diff --git a/lib/cloud/azure/client_map_test.go b/lib/cloud/azure/client_map_test.go
index 3d2f868ec722c..2f81914a86712 100644
--- a/lib/cloud/azure/client_map_test.go
+++ b/lib/cloud/azure/client_map_test.go
@@ -19,6 +19,7 @@
 package azure
 
 import (
+	"context"
 	"testing"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
@@ -44,7 +45,7 @@ func TestClientMap(t *testing.T) {
 	// Note that some test cases (e.g. "get from cache") depend on previous
 	// test cases. Thus running in sequence.
 	t.Run("get credentials failed", func(t *testing.T) {
-		client, err := clientMap.Get("some-sub", func() (azcore.TokenCredential, error) {
+		client, err := clientMap.Get(t.Context(), "some-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, trace.AccessDenied("failed to get credentials")
 		})
 		require.ErrorIs(t, err, trace.AccessDenied("failed to get credentials"))
@@ -52,7 +53,7 @@ func TestClientMap(t *testing.T) {
 	})
 
 	t.Run("create client failed", func(t *testing.T) {
-		client, err := clientMap.Get("bad-sub", func() (azcore.TokenCredential, error) {
+		client, err := clientMap.Get(t.Context(), "bad-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, nil
 		})
 		require.ErrorIs(t, err, trace.BadParameter("failed to create"))
@@ -60,7 +61,7 @@ func TestClientMap(t *testing.T) {
 	})
 
 	t.Run("create client succeed", func(t *testing.T) {
-		client, err := clientMap.Get("good-sub", func() (azcore.TokenCredential, error) {
+		client, err := clientMap.Get(t.Context(), "good-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, nil
 		})
 		require.NoError(t, err)
@@ -71,7 +72,7 @@ func TestClientMap(t *testing.T) {
 	t.Run("get from cache", func(t *testing.T) {
 		// Return an error for getCredentials but it shouldn't even be called
 		// as the client is returned from existing cache.
-		client, err := clientMap.Get("good-sub", func() (azcore.TokenCredential, error) {
+		client, err := clientMap.Get(t.Context(), "good-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, trace.AccessDenied("failed to get credentials")
 		})
 		require.NoError(t, err)
@@ -80,14 +81,14 @@ func TestClientMap(t *testing.T) {
 	})
 
 	t.Run("expire from cache", func(t *testing.T) {
-		oldClient, err := clientMap.Get("good-sub", func() (azcore.TokenCredential, error) {
+		oldClient, err := clientMap.Get(t.Context(), "good-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, nil
 		})
 		require.NoError(t, err)
 		require.NotNil(t, oldClient)
 
 		clock.Advance(2 * clientExpireTime)
-		newClient, err := clientMap.Get("good-sub", func() (azcore.TokenCredential, error) {
+		newClient, err := clientMap.Get(t.Context(), "good-sub", func(ctx context.Context) (azcore.TokenCredential, error) {
 			return nil, nil
 		})
 		require.NoError(t, err)
diff --git a/lib/cloud/azure/clients.go b/lib/cloud/azure/clients.go
new file mode 100644
index 0000000000000..f1475062f8ff7
--- /dev/null
+++ b/lib/cloud/azure/clients.go
@@ -0,0 +1,384 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package azure
+
+import (
+	"context"
+	"sync"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Clients is an interface for Azure-specific API clients
+type Clients interface {
+	// GetCredential returns Azure token credential. Uses default ambient credentials unless configured otherwise.
+	GetCredential(ctx context.Context) (azcore.TokenCredential, error)
+	// GetMySQLClient returns Azure MySQL client for the specified subscription.
+	GetMySQLClient(ctx context.Context, subscription string) (DBServersClient, error)
+	// GetPostgresClient returns Azure Postgres client for the specified subscription.
+	GetPostgresClient(ctx context.Context, subscription string) (DBServersClient, error)
+	// GetSubscriptionClient returns an Azure Subscriptions client
+	GetSubscriptionClient(ctx context.Context) (*SubscriptionClient, error)
+	// GetRedisClient returns an Azure Redis client for the given subscription.
+	GetRedisClient(ctx context.Context, subscription string) (RedisClient, error)
+	// GetRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
+	GetRedisEnterpriseClient(ctx context.Context, subscription string) (RedisEnterpriseClient, error)
+	// GetKubernetesClient returns an Azure AKS client for the specified subscription.
+	GetKubernetesClient(ctx context.Context, subscription string) (AKSClient, error)
+	// GetVirtualMachinesClient returns an Azure Virtual Machines client for the given subscription.
+	GetVirtualMachinesClient(ctx context.Context, subscription string) (VirtualMachinesClient, error)
+	// GetSQLServerClient returns an Azure SQL Server client for the
+	// specified subscription.
+	GetSQLServerClient(ctx context.Context, subscription string) (SQLServerClient, error)
+	// GetManagedSQLServerClient returns an Azure ManagedSQL Server client
+	// for the specified subscription.
+	GetManagedSQLServerClient(ctx context.Context, subscription string) (ManagedSQLServerClient, error)
+	// GetMySQLFlexServersClient returns an Azure MySQL Flexible Server client for the
+	// specified subscription.
+	GetMySQLFlexServersClient(ctx context.Context, subscription string) (MySQLFlexServersClient, error)
+	// GetPostgresFlexServersClient returns an Azure PostgreSQL Flexible Server client for the
+	// specified subscription.
+	GetPostgresFlexServersClient(ctx context.Context, subscription string) (PostgresFlexServersClient, error)
+	// GetRunCommandClient returns an Azure Run Command client for the given subscription.
+	GetRunCommandClient(ctx context.Context, subscription string) (RunCommandClient, error)
+}
+
+// ClientsOption is an option to pass to NewAzureClients
+type ClientsOption func(clients *clients)
+
+type azureOIDCCredentials interface {
+	GenerateAzureOIDCToken(ctx context.Context, integration string) (string, error)
+	GetIntegration(ctx context.Context, name string) (types.Integration, error)
+}
+
+// WithIntegrationCredentials configures Azure cloud clients to use integration credentials.
+func WithIntegrationCredentials(integrationName string, auth azureOIDCCredentials) ClientsOption {
+	return func(clt *clients) {
+		clt.credentialFunc = func(ctx context.Context) (azcore.TokenCredential, error) {
+			integration, err := auth.GetIntegration(ctx, integrationName)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			spec := integration.GetAzureOIDCIntegrationSpec()
+			if spec == nil {
+				return nil, trace.BadParameter("expected %q to be an %q integration, was %q instead", integration.GetName(), types.IntegrationSubKindAzureOIDC, integration.GetSubKind())
+			}
+			cred, err := azidentity.NewClientAssertionCredential(spec.TenantID, spec.ClientID, func(ctx context.Context) (string, error) {
+				return auth.GenerateAzureOIDCToken(ctx, integrationName)
+				// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
+			}, nil)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return cred, nil
+		}
+	}
+}
+
+// NewClients returns a new instance of Azure SDK clients.
+func NewClients(opts ...ClientsOption) (Clients, error) {
+	azClients := &clients{
+		mySQLClients:     make(map[string]DBServersClient),
+		postgresClients:  make(map[string]DBServersClient),
+		kubernetesClient: make(map[string]AKSClient),
+	}
+	var err error
+	azClients.redisClients, err = NewClientMap(NewRedisClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.redisEnterpriseClients, err = NewClientMap(NewRedisEnterpriseClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.virtualMachinesClients, err = NewClientMap(NewVirtualMachinesClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.sqlServerClients, err = NewClientMap(NewSQLClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.managedSQLServerClients, err = NewClientMap(NewManagedSQLClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.mySQLFlexServersClients, err = NewClientMap(NewMySQLFlexServersClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.postgresFlexServersClients, err = NewClientMap(NewPostgresFlexServersClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	azClients.runCommandClients, err = NewClientMap(NewRunCommandClient)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	azClients.credentialFunc = func(ctx context.Context) (azcore.TokenCredential, error) {
+		// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
+		return azidentity.NewDefaultAzureCredential(nil)
+	}
+
+	for _, opt := range opts {
+		opt(azClients)
+	}
+
+	return azClients, nil
+}
+
+// clients contains Azure-specific clients.
+type clients struct {
+	// mtx is used for locking.
+	mtx sync.RWMutex
+
+	// credentialFunc creates new Azure credential.
+	credentialFunc func(ctx context.Context) (azcore.TokenCredential, error)
+	credential     azcore.TokenCredential
+
+	mySQLClients               map[string]DBServersClient
+	postgresClients            map[string]DBServersClient
+	subscriptionsClient        *SubscriptionClient
+	redisClients               ClientMap[RedisClient]
+	redisEnterpriseClients     ClientMap[RedisEnterpriseClient]
+	kubernetesClient           map[string]AKSClient
+	virtualMachinesClients     ClientMap[VirtualMachinesClient]
+	sqlServerClients           ClientMap[SQLServerClient]
+	managedSQLServerClients    ClientMap[ManagedSQLServerClient]
+	mySQLFlexServersClients    ClientMap[MySQLFlexServersClient]
+	postgresFlexServersClients ClientMap[PostgresFlexServersClient]
+	runCommandClients          ClientMap[RunCommandClient]
+}
+
+// GetCredential returns default Azure token credential chain.
+func (c *clients) GetCredential(ctx context.Context) (azcore.TokenCredential, error) {
+	c.mtx.RLock()
+	if c.credential != nil {
+		defer c.mtx.RUnlock()
+		return c.credential, nil
+	}
+	c.mtx.RUnlock()
+	return c.initCredential(ctx)
+}
+
+// GetMySQLClient returns an AzureClient for MySQL for the given subscription.
+func (c *clients) GetMySQLClient(ctx context.Context, subscription string) (DBServersClient, error) {
+	c.mtx.RLock()
+	if client, ok := c.mySQLClients[subscription]; ok {
+		c.mtx.RUnlock()
+		return client, nil
+	}
+	c.mtx.RUnlock()
+	return c.initMySQLClient(ctx, subscription)
+}
+
+// GetPostgresClient returns an AzureClient for Postgres for the given subscription.
+func (c *clients) GetPostgresClient(ctx context.Context, subscription string) (DBServersClient, error) {
+	c.mtx.RLock()
+	if client, ok := c.postgresClients[subscription]; ok {
+		c.mtx.RUnlock()
+		return client, nil
+	}
+	c.mtx.RUnlock()
+	return c.initPostgresClient(ctx, subscription)
+}
+
+// GetSubscriptionClient returns an Azure client for listing subscriptions.
+func (c *clients) GetSubscriptionClient(ctx context.Context) (*SubscriptionClient, error) {
+	c.mtx.RLock()
+	if c.subscriptionsClient != nil {
+		defer c.mtx.RUnlock()
+		return c.subscriptionsClient, nil
+	}
+	c.mtx.RUnlock()
+	return c.initSubscriptionsClient(ctx)
+}
+
+// GetRedisClient returns an Azure Redis client for the given subscription.
+func (c *clients) GetRedisClient(ctx context.Context, subscription string) (RedisClient, error) {
+	return c.redisClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
+func (c *clients) GetRedisEnterpriseClient(ctx context.Context, subscription string) (RedisEnterpriseClient, error) {
+	return c.redisEnterpriseClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetKubernetesClient returns an Azure client for listing AKS clusters.
+func (c *clients) GetKubernetesClient(ctx context.Context, subscription string) (AKSClient, error) {
+	c.mtx.RLock()
+	if client, ok := c.kubernetesClient[subscription]; ok {
+		c.mtx.RUnlock()
+		return client, nil
+	}
+	c.mtx.RUnlock()
+	return c.initKubernetesClient(ctx, subscription)
+}
+
+// GetVirtualMachinesClient returns an Azure Virtual Machines client for
+// the given subscription.
+func (c *clients) GetVirtualMachinesClient(ctx context.Context, subscription string) (VirtualMachinesClient, error) {
+	return c.virtualMachinesClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetSQLServerClient returns an Azure client for listing SQL servers.
+func (c *clients) GetSQLServerClient(ctx context.Context, subscription string) (SQLServerClient, error) {
+	return c.sqlServerClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetManagedSQLServerClient returns an Azure client for listing managed
+// SQL servers.
+func (c *clients) GetManagedSQLServerClient(ctx context.Context, subscription string) (ManagedSQLServerClient, error) {
+	return c.managedSQLServerClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetMySQLFlexServersClient returns an Azure MySQL Flexible server client for listing MySQL Flexible servers.
+func (c *clients) GetMySQLFlexServersClient(ctx context.Context, subscription string) (MySQLFlexServersClient, error) {
+	return c.mySQLFlexServersClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetPostgresFlexServersClient returns an Azure PostgreSQL Flexible server client for listing PostgreSQL Flexible servers.
+func (c *clients) GetPostgresFlexServersClient(ctx context.Context, subscription string) (PostgresFlexServersClient, error) {
+	return c.postgresFlexServersClients.Get(ctx, subscription, c.GetCredential)
+}
+
+// GetRunCommandClient returns an Azure Run Command client for the given
+// subscription.
+func (c *clients) GetRunCommandClient(ctx context.Context, subscription string) (RunCommandClient, error) {
+	return c.runCommandClients.Get(ctx, subscription, c.GetCredential)
+}
+
+func (c *clients) initCredential(ctx context.Context) (azcore.TokenCredential, error) {
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if c.credential != nil { // If some other thread already got here first.
+		return c.credential, nil
+	}
+
+	cred, err := c.credentialFunc(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	c.credential = cred
+	return cred, nil
+}
+
+func (c *clients) initMySQLClient(ctx context.Context, subscription string) (DBServersClient, error) {
+	cred, err := c.GetCredential(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if client, ok := c.mySQLClients[subscription]; ok { // If some other thread already got here first.
+		return client, nil
+	}
+
+	// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
+	options := &arm.ClientOptions{}
+	api, err := armmysql.NewServersClient(subscription, cred, options)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	client := NewMySQLServersClient(api)
+	c.mySQLClients[subscription] = client
+	return client, nil
+}
+
+func (c *clients) initPostgresClient(ctx context.Context, subscription string) (DBServersClient, error) {
+	cred, err := c.GetCredential(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if client, ok := c.postgresClients[subscription]; ok { // If some other thread already got here first.
+		return client, nil
+	}
+	// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
+	options := &arm.ClientOptions{}
+	api, err := armpostgresql.NewServersClient(subscription, cred, options)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	client := NewPostgresServerClient(api)
+	c.postgresClients[subscription] = client
+	return client, nil
+}
+
+func (c *clients) initSubscriptionsClient(ctx context.Context) (*SubscriptionClient, error) {
+	cred, err := c.GetCredential(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if c.subscriptionsClient != nil { // If some other thread already got here first.
+		return c.subscriptionsClient, nil
+	}
+	// TODO(gavin): if/when we support AzureChina/AzureGovernment,
+	// we will need to specify the cloud in these options
+	opts := &arm.ClientOptions{}
+	armClient, err := armsubscription.NewSubscriptionsClient(cred, opts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	client := NewSubscriptionClient(armClient)
+	c.subscriptionsClient = client
+	return client, nil
+}
+
+func (c *clients) initKubernetesClient(ctx context.Context, subscription string) (AKSClient, error) {
+	cred, err := c.GetCredential(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if client, ok := c.kubernetesClient[subscription]; ok { // If some other thread already got here first.
+		return client, nil
+	}
+	// TODO(tigrato): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
+	options := &arm.ClientOptions{}
+	api, err := armcontainerservice.NewManagedClustersClient(subscription, cred, options)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	client := NewAKSClustersClient(
+		api, func(options *azidentity.DefaultAzureCredentialOptions) (GetToken, error) {
+			cc, err := azidentity.NewDefaultAzureCredential(options)
+			return cc, err
+		})
+	c.kubernetesClient[subscription] = client
+	return client, nil
+}
diff --git a/lib/cloud/azure/clients_test.go b/lib/cloud/azure/clients_test.go
new file mode 100644
index 0000000000000..7babfd77ffcb5
--- /dev/null
+++ b/lib/cloud/azure/clients_test.go
@@ -0,0 +1,123 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package azure
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+)
+
+type testAzureOIDCCredentials struct {
+	integration types.Integration
+}
+
+func (m *testAzureOIDCCredentials) GenerateAzureOIDCToken(ctx context.Context, integration string) (string, error) {
+	return "dummy-oidc-token", nil
+}
+
+func (m *testAzureOIDCCredentials) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+	if m.integration == nil || m.integration.GetName() != name {
+		return nil, trace.NotFound("integration %q not found", name)
+	}
+	return m.integration, nil
+}
+
+func TestWithAzureIntegrationCredentials(t *testing.T) {
+	const integrationName = "azure"
+
+	tests := []struct {
+		name        string
+		integration types.Integration
+		wantErr     string
+	}{
+		{
+			name: "valid azure integration",
+			integration: &types.IntegrationV1{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindIntegration,
+					SubKind: types.IntegrationSubKindAzureOIDC,
+					Version: types.V1,
+					Metadata: types.Metadata{
+						Name:      integrationName,
+						Namespace: defaults.Namespace,
+					},
+				},
+				Spec: types.IntegrationSpecV1{
+					SubKindSpec: &types.IntegrationSpecV1_AzureOIDC{
+						AzureOIDC: &types.AzureOIDCIntegrationSpecV1{
+							ClientID: "baz-quux",
+							TenantID: "foo-bar",
+						},
+					},
+				},
+			},
+		},
+		{
+			name:        "integration not found",
+			integration: nil,
+			wantErr:     `integration "azure" not found`,
+		},
+		{
+			name: "invalid integration type",
+			integration: &types.IntegrationV1{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindIntegration,
+					SubKind: types.IntegrationSubKindAWSOIDC,
+					Version: types.V1,
+					Metadata: types.Metadata{
+						Name:      "azure",
+						Namespace: defaults.Namespace,
+					},
+				},
+				Spec: types.IntegrationSpecV1{
+					SubKindSpec: &types.IntegrationSpecV1_AWSOIDC{
+						AWSOIDC: &types.AWSOIDCIntegrationSpecV1{
+							RoleARN: "arn:aws:iam::123456789012:role/teleport",
+						},
+					},
+				},
+			},
+			wantErr: `expected "azure" to be an "azure-oidc" integration, was "aws-oidc" instead`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opt := WithIntegrationCredentials(integrationName, &testAzureOIDCCredentials{
+				integration: tt.integration,
+			})
+			clients, err := NewClients(opt)
+			require.NoError(t, err)
+
+			credential, err := clients.GetCredential(t.Context())
+
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				require.NotNil(t, credential)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+				require.Nil(t, credential)
+			}
+		})
+	}
+}
diff --git a/lib/cloud/azure/vm.go b/lib/cloud/azure/vm.go
index 83318ce23bad8..0308b993f27a8 100644
--- a/lib/cloud/azure/vm.go
+++ b/lib/cloud/azure/vm.go
@@ -287,10 +287,8 @@ type RunCommandRequest struct {
 	ResourceGroup string
 	// VMName is the name of the VM.
 	VMName string
-	// Script is the URI of the script for the virtual machine to execute.
+	// Script is the shell script to be executed in the virtual machine.
 	Script string
-	// Parameters is a list of parameters for the script.
-	Parameters []string
 }
 
 // RunCommandClient is a client for Azure Run Commands.
@@ -316,17 +314,10 @@ func NewRunCommandClient(subscription string, cred azcore.TokenCredential, optio
 
 // Run runs a command on a virtual machine.
 func (c *runCommandClient) Run(ctx context.Context, req RunCommandRequest) error {
-	var params []*armcompute.RunCommandInputParameter
-	for _, value := range req.Parameters {
-		params = append(params, &armcompute.RunCommandInputParameter{
-			Value: to.Ptr(value),
-		})
-	}
 	poller, err := c.api.BeginCreateOrUpdate(ctx, req.ResourceGroup, req.VMName, "RunShellScript", armcompute.VirtualMachineRunCommand{
 		Location: to.Ptr(req.Region),
 		Properties: &armcompute.VirtualMachineRunCommandProperties{
 			AsyncExecution: to.Ptr(false),
-			Parameters:     params,
 			Source: &armcompute.VirtualMachineRunCommandScriptSource{
 				Script: to.Ptr(req.Script),
 			},
@@ -335,6 +326,7 @@ func (c *runCommandClient) Run(ctx context.Context, req RunCommandRequest) error
 	if err != nil {
 		return trace.Wrap(err)
 	}
+
 	_, err = poller.PollUntilDone(ctx, nil /* options */)
 	return trace.Wrap(err)
 }
diff --git a/lib/cloud/clients.go b/lib/cloud/clients.go
deleted file mode 100644
index 1993f70ab1f7a..0000000000000
--- a/lib/cloud/clients.go
+++ /dev/null
@@ -1,741 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package cloud
-
-import (
-	"context"
-	"io"
-	"sync"
-
-	gcpcredentials "cloud.google.com/go/iam/credentials/apiv1"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysql"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
-	"github.com/gravitational/trace"
-	"google.golang.org/api/option"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/gravitational/teleport/lib/cloud/azure"
-	"github.com/gravitational/teleport/lib/cloud/gcp"
-	"github.com/gravitational/teleport/lib/cloud/imds"
-	awsimds "github.com/gravitational/teleport/lib/cloud/imds/aws"
-	azureimds "github.com/gravitational/teleport/lib/cloud/imds/azure"
-	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
-	oracleimds "github.com/gravitational/teleport/lib/cloud/imds/oracle"
-)
-
-// Clients provides interface for obtaining cloud provider clients.
-type Clients interface {
-	// GetInstanceMetadataClient returns instance metadata client based on which
-	// cloud provider Teleport is running on, if any.
-	GetInstanceMetadataClient(ctx context.Context) (imds.Client, error)
-	// GCPClients is an interface for providing GCP API clients.
-	GCPClients
-	// AzureClients is an interface for Azure-specific API clients
-	AzureClients
-	// Closer closes all initialized clients.
-	io.Closer
-}
-
-// GCPClients is an interface for providing GCP API clients.
-type GCPClients interface {
-	// GetGCPIAMClient returns GCP IAM client.
-	GetGCPIAMClient(context.Context) (*gcpcredentials.IamCredentialsClient, error)
-	// GetGCPSQLAdminClient returns GCP Cloud SQL Admin client.
-	GetGCPSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
-	// GetGCPGKEClient returns GKE client.
-	GetGCPGKEClient(context.Context) (gcp.GKEClient, error)
-	// GetGCPProjectsClient returns Projects client.
-	GetGCPProjectsClient(context.Context) (gcp.ProjectsClient, error)
-	// GetGCPInstancesClient returns instances client.
-	GetGCPInstancesClient(context.Context) (gcp.InstancesClient, error)
-}
-
-// AzureClients is an interface for Azure-specific API clients
-type AzureClients interface {
-	// GetAzureCredential returns Azure default token credential chain.
-	GetAzureCredential() (azcore.TokenCredential, error)
-	// GetAzureMySQLClient returns Azure MySQL client for the specified subscription.
-	GetAzureMySQLClient(subscription string) (azure.DBServersClient, error)
-	// GetAzurePostgresClient returns Azure Postgres client for the specified subscription.
-	GetAzurePostgresClient(subscription string) (azure.DBServersClient, error)
-	// GetAzureSubscriptionClient returns an Azure Subscriptions client
-	GetAzureSubscriptionClient() (*azure.SubscriptionClient, error)
-	// GetAzureRedisClient returns an Azure Redis client for the given subscription.
-	GetAzureRedisClient(subscription string) (azure.RedisClient, error)
-	// GetAzureRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
-	GetAzureRedisEnterpriseClient(subscription string) (azure.RedisEnterpriseClient, error)
-	// GetAzureKubernetesClient returns an Azure AKS client for the specified subscription.
-	GetAzureKubernetesClient(subscription string) (azure.AKSClient, error)
-	// GetAzureVirtualMachinesClient returns an Azure Virtual Machines client for the given subscription.
-	GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error)
-	// GetAzureSQLServerClient returns an Azure SQL Server client for the
-	// specified subscription.
-	GetAzureSQLServerClient(subscription string) (azure.SQLServerClient, error)
-	// GetAzureManagedSQLServerClient returns an Azure ManagedSQL Server client
-	// for the specified subscription.
-	GetAzureManagedSQLServerClient(subscription string) (azure.ManagedSQLServerClient, error)
-	// GetAzureMySQLFlexServersClient returns an Azure MySQL Flexible Server client for the
-	// specified subscription.
-	GetAzureMySQLFlexServersClient(subscription string) (azure.MySQLFlexServersClient, error)
-	// GetAzurePostgresFlexServersClient returns an Azure PostgreSQL Flexible Server client for the
-	// specified subscription.
-	GetAzurePostgresFlexServersClient(subscription string) (azure.PostgresFlexServersClient, error)
-	// GetAzureRunCommandClient returns an Azure Run Command client for the given subscription.
-	GetAzureRunCommandClient(subscription string) (azure.RunCommandClient, error)
-}
-
-type clientConstructor[T any] func(context.Context) (T, error)
-
-// clientCache is a struct that holds a cloud client that will only be
-// initialized once.
-type clientCache[T any] struct {
-	makeClient clientConstructor[T]
-	client     T
-	err        error
-	once       sync.Once
-}
-
-// newClientCache creates a new client cache.
-func newClientCache[T any](makeClient clientConstructor[T]) *clientCache[T] {
-	return &clientCache[T]{makeClient: makeClient}
-}
-
-// GetClient gets the client, initializing it if necessary.
-func (c *clientCache[T]) GetClient(ctx context.Context) (T, error) {
-	c.once.Do(func() {
-		c.client, c.err = c.makeClient(ctx)
-	})
-	return c.client, trace.Wrap(c.err)
-}
-
-func newAzureClients() (*azureClients, error) {
-	azClients := &azureClients{
-		azureMySQLClients:     make(map[string]azure.DBServersClient),
-		azurePostgresClients:  make(map[string]azure.DBServersClient),
-		azureKubernetesClient: make(map[string]azure.AKSClient),
-	}
-	var err error
-	azClients.azureRedisClients, err = azure.NewClientMap(azure.NewRedisClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureRedisEnterpriseClients, err = azure.NewClientMap(azure.NewRedisEnterpriseClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureVirtualMachinesClients, err = azure.NewClientMap(azure.NewVirtualMachinesClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureSQLServerClients, err = azure.NewClientMap(azure.NewSQLClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureManagedSQLServerClients, err = azure.NewClientMap(azure.NewManagedSQLClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureMySQLFlexServersClients, err = azure.NewClientMap(azure.NewMySQLFlexServersClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azurePostgresFlexServersClients, err = azure.NewClientMap(azure.NewPostgresFlexServersClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	azClients.azureRunCommandClients, err = azure.NewClientMap(azure.NewRunCommandClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return azClients, nil
-}
-
-// ClientsOption allows setting options as functional arguments to cloudClients.
-type ClientsOption func(cfg *cloudClients)
-
-// NewClients returns a new instance of cloud clients retriever.
-func NewClients(opts ...ClientsOption) (Clients, error) {
-	azClients, err := newAzureClients()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	cloudClients := &cloudClients{
-		gcpClients: gcpClients{
-			gcpSQLAdmin:  newClientCache(gcp.NewSQLAdminClient),
-			gcpGKE:       newClientCache(gcp.NewGKEClient),
-			gcpProjects:  newClientCache(gcp.NewProjectsClient),
-			gcpInstances: newClientCache(gcp.NewInstancesClient),
-		},
-		azureClients: azClients,
-	}
-
-	for _, opt := range opts {
-		opt(cloudClients)
-	}
-
-	return cloudClients, nil
-}
-
-// cloudClients implements Clients
-var _ Clients = (*cloudClients)(nil)
-
-type cloudClients struct {
-	// instanceMetadata is the cached instance metadata client.
-	instanceMetadata imds.Client
-	// gcpClients contains GCP-specific clients.
-	gcpClients
-	// azureClients contains Azure-specific clients.
-	*azureClients
-	// mtx is used for locking.
-	mtx sync.RWMutex
-}
-
-// gcpClients contains GCP-specific clients.
-type gcpClients struct {
-	// gcpIAM is the cached GCP IAM client.
-	gcpIAM *gcpcredentials.IamCredentialsClient
-	// gcpSQLAdmin is the cached GCP Cloud SQL Admin client.
-	gcpSQLAdmin *clientCache[gcp.SQLAdminClient]
-	// gcpGKE is the cached GCP Cloud GKE client.
-	gcpGKE *clientCache[gcp.GKEClient]
-	// gcpProjects is the cached GCP Cloud Projects client.
-	gcpProjects *clientCache[gcp.ProjectsClient]
-	// gcpInstances is the cached GCP instances client.
-	gcpInstances *clientCache[gcp.InstancesClient]
-}
-
-// azureClients contains Azure-specific clients.
-type azureClients struct {
-	// azureCredential is the cached Azure credential.
-	azureCredential azcore.TokenCredential
-	// azureMySQLClients is the cached Azure MySQL Server clients.
-	azureMySQLClients map[string]azure.DBServersClient
-	// azurePostgresClients is the cached Azure Postgres Server clients.
-	azurePostgresClients map[string]azure.DBServersClient
-	// azureSubscriptionsClient is the cached Azure Subscriptions client.
-	azureSubscriptionsClient *azure.SubscriptionClient
-	// azureRedisClients contains the cached Azure Redis clients.
-	azureRedisClients azure.ClientMap[azure.RedisClient]
-	// azureRedisEnterpriseClients contains the cached Azure Redis Enterprise clients.
-	azureRedisEnterpriseClients azure.ClientMap[azure.RedisEnterpriseClient]
-	// azureKubernetesClient is the cached Azure Kubernetes client.
-	azureKubernetesClient map[string]azure.AKSClient
-	// azureVirtualMachinesClients contains the cached Azure Virtual Machines clients.
-	azureVirtualMachinesClients azure.ClientMap[azure.VirtualMachinesClient]
-	// azureSQLServerClient is the cached Azure SQL Server client.
-	azureSQLServerClients azure.ClientMap[azure.SQLServerClient]
-	// azureManagedSQLServerClient is the cached Azure Managed SQL Server
-	// client.
-	azureManagedSQLServerClients azure.ClientMap[azure.ManagedSQLServerClient]
-	// azureMySQLFlexServersClients is the cached Azure MySQL Flexible Server
-	// client.
-	azureMySQLFlexServersClients azure.ClientMap[azure.MySQLFlexServersClient]
-	// azurePostgresFlexServersClients is the cached Azure PostgreSQL Flexible Server
-	// client.
-	azurePostgresFlexServersClients azure.ClientMap[azure.PostgresFlexServersClient]
-	// azureRunCommandClients contains the cached Azure Run Command clients.
-	azureRunCommandClients azure.ClientMap[azure.RunCommandClient]
-	// azureRoleDefinitionsClients contains the cached Azure Role Definitions clients.
-	azureRoleDefinitionsClients azure.ClientMap[azure.RoleDefinitionsClient]
-	// azureRoleAssignmentsClients contains the cached Azure Role Assignments clients.
-	azureRoleAssignmentsClients azure.ClientMap[azure.RoleAssignmentsClient]
-}
-
-// GetGCPIAMClient returns GCP IAM client.
-func (c *cloudClients) GetGCPIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
-	c.mtx.RLock()
-	if c.gcpIAM != nil {
-		defer c.mtx.RUnlock()
-		return c.gcpIAM, nil
-	}
-	c.mtx.RUnlock()
-	return c.initGCPIAMClient(ctx)
-}
-
-// GetGCPSQLAdminClient returns GCP Cloud SQL Admin client.
-func (c *cloudClients) GetGCPSQLAdminClient(ctx context.Context) (gcp.SQLAdminClient, error) {
-	return c.gcpSQLAdmin.GetClient(ctx)
-}
-
-// GetInstanceMetadataClient returns the instance metadata.
-func (c *cloudClients) GetInstanceMetadataClient(ctx context.Context) (imds.Client, error) {
-	c.mtx.RLock()
-	if c.instanceMetadata != nil {
-		defer c.mtx.RUnlock()
-		return c.instanceMetadata, nil
-	}
-	c.mtx.RUnlock()
-	return c.initInstanceMetadata(ctx)
-}
-
-// GetGCPGKEClient returns GKE client.
-func (c *cloudClients) GetGCPGKEClient(ctx context.Context) (gcp.GKEClient, error) {
-	return c.gcpGKE.GetClient(ctx)
-}
-
-// GetGCPProjectsClient returns Project client.
-func (c *cloudClients) GetGCPProjectsClient(ctx context.Context) (gcp.ProjectsClient, error) {
-	return c.gcpProjects.GetClient(ctx)
-}
-
-// GetGCPInstancesClient returns instances client.
-func (c *cloudClients) GetGCPInstancesClient(ctx context.Context) (gcp.InstancesClient, error) {
-	return c.gcpInstances.GetClient(ctx)
-}
-
-// GetAzureCredential returns default Azure token credential chain.
-func (c *cloudClients) GetAzureCredential() (azcore.TokenCredential, error) {
-	c.mtx.RLock()
-	if c.azureCredential != nil {
-		defer c.mtx.RUnlock()
-		return c.azureCredential, nil
-	}
-	c.mtx.RUnlock()
-	return c.initAzureCredential()
-}
-
-// GetAzureMySQLClient returns an AzureClient for MySQL for the given subscription.
-func (c *cloudClients) GetAzureMySQLClient(subscription string) (azure.DBServersClient, error) {
-	c.mtx.RLock()
-	if client, ok := c.azureMySQLClients[subscription]; ok {
-		c.mtx.RUnlock()
-		return client, nil
-	}
-	c.mtx.RUnlock()
-	return c.initAzureMySQLClient(subscription)
-}
-
-// GetAzurePostgresClient returns an AzureClient for Postgres for the given subscription.
-func (c *cloudClients) GetAzurePostgresClient(subscription string) (azure.DBServersClient, error) {
-	c.mtx.RLock()
-	if client, ok := c.azurePostgresClients[subscription]; ok {
-		c.mtx.RUnlock()
-		return client, nil
-	}
-	c.mtx.RUnlock()
-	return c.initAzurePostgresClient(subscription)
-}
-
-// GetAzureSubscriptionClient returns an Azure client for listing subscriptions.
-func (c *cloudClients) GetAzureSubscriptionClient() (*azure.SubscriptionClient, error) {
-	c.mtx.RLock()
-	if c.azureSubscriptionsClient != nil {
-		defer c.mtx.RUnlock()
-		return c.azureSubscriptionsClient, nil
-	}
-	c.mtx.RUnlock()
-	return c.initAzureSubscriptionsClient()
-}
-
-// GetAzureRedisClient returns an Azure Redis client for the given subscription.
-func (c *cloudClients) GetAzureRedisClient(subscription string) (azure.RedisClient, error) {
-	return c.azureRedisClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
-func (c *cloudClients) GetAzureRedisEnterpriseClient(subscription string) (azure.RedisEnterpriseClient, error) {
-	return c.azureRedisEnterpriseClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureKubernetesClient returns an Azure client for listing AKS clusters.
-func (c *cloudClients) GetAzureKubernetesClient(subscription string) (azure.AKSClient, error) {
-	c.mtx.RLock()
-	if client, ok := c.azureKubernetesClient[subscription]; ok {
-		c.mtx.RUnlock()
-		return client, nil
-	}
-	c.mtx.RUnlock()
-	return c.initAzureKubernetesClient(subscription)
-}
-
-// GetAzureVirtualMachinesClient returns an Azure Virtual Machines client for
-// the given subscription.
-func (c *cloudClients) GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error) {
-	return c.azureVirtualMachinesClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureSQLServerClient returns an Azure client for listing SQL servers.
-func (c *cloudClients) GetAzureSQLServerClient(subscription string) (azure.SQLServerClient, error) {
-	return c.azureSQLServerClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureManagedSQLServerClient returns an Azure client for listing managed
-// SQL servers.
-func (c *cloudClients) GetAzureManagedSQLServerClient(subscription string) (azure.ManagedSQLServerClient, error) {
-	return c.azureManagedSQLServerClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureMySQLFlexServersClient returns an Azure MySQL Flexible server client for listing MySQL Flexible servers.
-func (c *cloudClients) GetAzureMySQLFlexServersClient(subscription string) (azure.MySQLFlexServersClient, error) {
-	return c.azureMySQLFlexServersClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzurePostgresFlexServersClient returns an Azure PostgreSQL Flexible server client for listing PostgreSQL Flexible servers.
-func (c *cloudClients) GetAzurePostgresFlexServersClient(subscription string) (azure.PostgresFlexServersClient, error) {
-	return c.azurePostgresFlexServersClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureRunCommandClient returns an Azure Run Command client for the given
-// subscription.
-func (c *cloudClients) GetAzureRunCommandClient(subscription string) (azure.RunCommandClient, error) {
-	return c.azureRunCommandClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureRoleDefinitionsClient returns an Azure Role Definitions client
-func (c *cloudClients) GetAzureRoleDefinitionsClient(subscription string) (azure.RoleDefinitionsClient, error) {
-	return c.azureRoleDefinitionsClients.Get(subscription, c.GetAzureCredential)
-}
-
-// GetAzureRoleAssignmentsClient returns an Azure Role Assignments client
-func (c *cloudClients) GetAzureRoleAssignmentsClient(subscription string) (azure.RoleAssignmentsClient, error) {
-	return c.azureRoleAssignmentsClients.Get(subscription, c.GetAzureCredential)
-}
-
-// Close closes all initialized clients.
-func (c *cloudClients) Close() (err error) {
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if c.gcpIAM != nil {
-		err = c.gcpIAM.Close()
-		c.gcpIAM = nil
-	}
-	return trace.Wrap(err)
-}
-
-func (c *cloudClients) initGCPIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if c.gcpIAM != nil { // If some other thread already got here first.
-		return c.gcpIAM, nil
-	}
-	gcpIAM, err := gcpcredentials.NewIamCredentialsClient(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	c.gcpIAM = gcpIAM
-	return gcpIAM, nil
-}
-
-func (c *cloudClients) initAzureCredential() (azcore.TokenCredential, error) {
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if c.azureCredential != nil { // If some other thread already got here first.
-		return c.azureCredential, nil
-	}
-	// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
-	options := &azidentity.DefaultAzureCredentialOptions{}
-	cred, err := azidentity.NewDefaultAzureCredential(options)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	c.azureCredential = cred
-	return cred, nil
-}
-
-func (c *cloudClients) initAzureMySQLClient(subscription string) (azure.DBServersClient, error) {
-	cred, err := c.GetAzureCredential()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if client, ok := c.azureMySQLClients[subscription]; ok { // If some other thread already got here first.
-		return client, nil
-	}
-
-	// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
-	options := &arm.ClientOptions{}
-	api, err := armmysql.NewServersClient(subscription, cred, options)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	client := azure.NewMySQLServersClient(api)
-	c.azureMySQLClients[subscription] = client
-	return client, nil
-}
-
-func (c *cloudClients) initAzurePostgresClient(subscription string) (azure.DBServersClient, error) {
-	cred, err := c.GetAzureCredential()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if client, ok := c.azurePostgresClients[subscription]; ok { // If some other thread already got here first.
-		return client, nil
-	}
-	// TODO(gavin): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
-	options := &arm.ClientOptions{}
-	api, err := armpostgresql.NewServersClient(subscription, cred, options)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	client := azure.NewPostgresServerClient(api)
-	c.azurePostgresClients[subscription] = client
-	return client, nil
-}
-
-func (c *cloudClients) initAzureSubscriptionsClient() (*azure.SubscriptionClient, error) {
-	cred, err := c.GetAzureCredential()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if c.azureSubscriptionsClient != nil { // If some other thread already got here first.
-		return c.azureSubscriptionsClient, nil
-	}
-	// TODO(gavin): if/when we support AzureChina/AzureGovernment,
-	// we will need to specify the cloud in these options
-	opts := &arm.ClientOptions{}
-	armClient, err := armsubscription.NewSubscriptionsClient(cred, opts)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	client := azure.NewSubscriptionClient(armClient)
-	c.azureSubscriptionsClient = client
-	return client, nil
-}
-
-// initInstanceMetadata initializes the instance metadata client.
-func (c *cloudClients) initInstanceMetadata(ctx context.Context) (imds.Client, error) {
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if c.instanceMetadata != nil { // If some other thread already got here first.
-		return c.instanceMetadata, nil
-	}
-
-	providers := []func(ctx context.Context) (imds.Client, error){
-		func(ctx context.Context) (imds.Client, error) {
-			clt, err := awsimds.NewInstanceMetadataClient(ctx)
-			return clt, trace.Wrap(err)
-		},
-		func(ctx context.Context) (imds.Client, error) {
-			return azureimds.NewInstanceMetadataClient(), nil
-		},
-		func(ctx context.Context) (imds.Client, error) {
-			instancesClient, err := gcp.NewInstancesClient(ctx)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			clt, err := gcpimds.NewInstanceMetadataClient(instancesClient)
-			return clt, trace.Wrap(err)
-		},
-		func(ctx context.Context) (imds.Client, error) {
-			return oracleimds.NewInstanceMetadataClient(), nil
-		},
-	}
-
-	client, err := DiscoverInstanceMetadata(ctx, providers)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c.instanceMetadata = client
-	return client, nil
-}
-
-func (c *cloudClients) initAzureKubernetesClient(subscription string) (azure.AKSClient, error) {
-	cred, err := c.GetAzureCredential()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	c.mtx.Lock()
-	defer c.mtx.Unlock()
-	if client, ok := c.azureKubernetesClient[subscription]; ok { // If some other thread already got here first.
-		return client, nil
-	}
-	// TODO(tigrato): if/when we support AzureChina/AzureGovernment, we will need to specify the cloud in these options
-	options := &arm.ClientOptions{}
-	api, err := armcontainerservice.NewManagedClustersClient(subscription, cred, options)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	client := azure.NewAKSClustersClient(
-		api, func(options *azidentity.DefaultAzureCredentialOptions) (azure.GetToken, error) {
-			cc, err := azidentity.NewDefaultAzureCredential(options)
-			return cc, err
-		})
-	c.azureKubernetesClient[subscription] = client
-	return client, nil
-}
-
-// TestCloudClients implements Clients
-var _ Clients = (*TestCloudClients)(nil)
-
-// TestCloudClients are used in tests.
-type TestCloudClients struct {
-	GCPSQL                  gcp.SQLAdminClient
-	GCPGKE                  gcp.GKEClient
-	GCPProjects             gcp.ProjectsClient
-	GCPInstances            gcp.InstancesClient
-	InstanceMetadata        imds.Client
-	AzureMySQL              azure.DBServersClient
-	AzureMySQLPerSub        map[string]azure.DBServersClient
-	AzurePostgres           azure.DBServersClient
-	AzurePostgresPerSub     map[string]azure.DBServersClient
-	AzureSubscriptionClient *azure.SubscriptionClient
-	AzureRedis              azure.RedisClient
-	AzureRedisEnterprise    azure.RedisEnterpriseClient
-	AzureAKSClientPerSub    map[string]azure.AKSClient
-	AzureAKSClient          azure.AKSClient
-	AzureVirtualMachines    azure.VirtualMachinesClient
-	AzureSQLServer          azure.SQLServerClient
-	AzureManagedSQLServer   azure.ManagedSQLServerClient
-	AzureMySQLFlex          azure.MySQLFlexServersClient
-	AzurePostgresFlex       azure.PostgresFlexServersClient
-	AzureRunCommand         azure.RunCommandClient
-	AzureRoleDefinitions    azure.RoleDefinitionsClient
-	AzureRoleAssignments    azure.RoleAssignmentsClient
-}
-
-// GetGCPIAMClient returns GCP IAM client.
-func (c *TestCloudClients) GetGCPIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
-	return gcpcredentials.NewIamCredentialsClient(ctx,
-		option.WithGRPCDialOption(grpc.WithTransportCredentials(insecure.NewCredentials())), // Insecure must be set for unauth client.
-		option.WithoutAuthentication())
-}
-
-// GetGCPSQLAdminClient returns GCP Cloud SQL Admin client.
-func (c *TestCloudClients) GetGCPSQLAdminClient(ctx context.Context) (gcp.SQLAdminClient, error) {
-	return c.GCPSQL, nil
-}
-
-// GetInstanceMetadataClient returns the instance metadata.
-func (c *TestCloudClients) GetInstanceMetadataClient(ctx context.Context) (imds.Client, error) {
-	return c.InstanceMetadata, nil
-}
-
-// GetGCPGKEClient returns GKE client.
-func (c *TestCloudClients) GetGCPGKEClient(ctx context.Context) (gcp.GKEClient, error) {
-	return c.GCPGKE, nil
-}
-
-// GetGCPGKEClient returns GKE client.
-func (c *TestCloudClients) GetGCPProjectsClient(ctx context.Context) (gcp.ProjectsClient, error) {
-	return c.GCPProjects, nil
-}
-
-// GetGCPInstancesClient returns instances client.
-func (c *TestCloudClients) GetGCPInstancesClient(ctx context.Context) (gcp.InstancesClient, error) {
-	return c.GCPInstances, nil
-}
-
-// GetAzureCredential returns default Azure token credential chain.
-func (c *TestCloudClients) GetAzureCredential() (azcore.TokenCredential, error) {
-	return &azidentity.ChainedTokenCredential{}, nil
-}
-
-// GetAzureMySQLClient returns an AzureMySQLClient for the specified subscription
-func (c *TestCloudClients) GetAzureMySQLClient(subscription string) (azure.DBServersClient, error) {
-	if len(c.AzureMySQLPerSub) != 0 {
-		return c.AzureMySQLPerSub[subscription], nil
-	}
-	return c.AzureMySQL, nil
-}
-
-// GetAzurePostgresClient returns an AzurePostgresClient for the specified subscription
-func (c *TestCloudClients) GetAzurePostgresClient(subscription string) (azure.DBServersClient, error) {
-	if len(c.AzurePostgresPerSub) != 0 {
-		return c.AzurePostgresPerSub[subscription], nil
-	}
-	return c.AzurePostgres, nil
-}
-
-// GetAzureKubernetesClient returns an AKS client for the specified subscription
-func (c *TestCloudClients) GetAzureKubernetesClient(subscription string) (azure.AKSClient, error) {
-	if len(c.AzureAKSClientPerSub) != 0 {
-		return c.AzureAKSClientPerSub[subscription], nil
-	}
-	return c.AzureAKSClient, nil
-}
-
-// GetAzureSubscriptionClient returns an Azure SubscriptionClient
-func (c *TestCloudClients) GetAzureSubscriptionClient() (*azure.SubscriptionClient, error) {
-	return c.AzureSubscriptionClient, nil
-}
-
-// GetAzureRedisClient returns an Azure Redis client for the given subscription.
-func (c *TestCloudClients) GetAzureRedisClient(subscription string) (azure.RedisClient, error) {
-	return c.AzureRedis, nil
-}
-
-// GetAzureRedisEnterpriseClient returns an Azure Redis Enterprise client for the given subscription.
-func (c *TestCloudClients) GetAzureRedisEnterpriseClient(subscription string) (azure.RedisEnterpriseClient, error) {
-	return c.AzureRedisEnterprise, nil
-}
-
-// GetAzureVirtualMachinesClient returns an Azure Virtual Machines client for
-// the given subscription.
-func (c *TestCloudClients) GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error) {
-	return c.AzureVirtualMachines, nil
-}
-
-// GetAzureSQLServerClient returns an Azure client for listing SQL servers.
-func (c *TestCloudClients) GetAzureSQLServerClient(subscription string) (azure.SQLServerClient, error) {
-	return c.AzureSQLServer, nil
-}
-
-// GetAzureManagedSQLServerClient returns an Azure client for listing managed
-// SQL servers.
-func (c *TestCloudClients) GetAzureManagedSQLServerClient(subscription string) (azure.ManagedSQLServerClient, error) {
-	return c.AzureManagedSQLServer, nil
-}
-
-// GetAzureMySQLFlexServersClient returns an Azure MySQL Flexible server client for listing MySQL Flexible servers.
-func (c *TestCloudClients) GetAzureMySQLFlexServersClient(subscription string) (azure.MySQLFlexServersClient, error) {
-	return c.AzureMySQLFlex, nil
-}
-
-// GetAzurePostgresFlexServersClient returns an Azure PostgreSQL Flexible server client for listing PostgreSQL Flexible servers.
-func (c *TestCloudClients) GetAzurePostgresFlexServersClient(subscription string) (azure.PostgresFlexServersClient, error) {
-	return c.AzurePostgresFlex, nil
-}
-
-// GetAzureRunCommandClient returns an Azure Run Command client for the given subscription.
-func (c *TestCloudClients) GetAzureRunCommandClient(subscription string) (azure.RunCommandClient, error) {
-	return c.AzureRunCommand, nil
-}
-
-// GetAzureRoleDefinitionsClient returns an Azure Role Definitions client for the given subscription.
-func (c *TestCloudClients) GetAzureRoleDefinitionsClient(subscription string) (azure.RoleDefinitionsClient, error) {
-	return c.AzureRoleDefinitions, nil
-}
-
-// GetAzureRoleAssignmentsClient returns an Azure Role Assignments client for the given subscription.
-func (c *TestCloudClients) GetAzureRoleAssignmentsClient(subscription string) (azure.RoleAssignmentsClient, error) {
-	return c.AzureRoleAssignments, nil
-}
-
-// Close closes all initialized clients.
-func (c *TestCloudClients) Close() error {
-	return nil
-}
diff --git a/lib/cloud/gcp/alloydb.go b/lib/cloud/gcp/alloydb.go
new file mode 100644
index 0000000000000..84ce2221737bc
--- /dev/null
+++ b/lib/cloud/gcp/alloydb.go
@@ -0,0 +1,143 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcp
+
+import (
+	"context"
+	"crypto/tls"
+	"strings"
+	"time"
+
+	alloydbadmin "cloud.google.com/go/alloydb/apiv1beta"
+	"cloud.google.com/go/alloydb/apiv1beta/alloydbpb"
+	"github.com/googleapis/gax-go/v2"
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	gcputils "github.com/gravitational/teleport/api/utils/gcp"
+	"github.com/gravitational/teleport/api/utils/keys"
+)
+
+// AlloyDBAdminClient encapsulates alloydb.AlloyDBAdminClient
+type AlloyDBAdminClient interface {
+	// GenerateClientCertificate returns a new PEM-encoded client certificate and Root CA suitable for connecting to particular AlloyDB instance.
+	GenerateClientCertificate(ctx context.Context, info gcputils.AlloyDBFullInstanceName, certExpiry time.Time, pkey *keys.PrivateKey) (*tls.Certificate, string, error)
+	// GetEndpointAddress returns endpoint address for given AlloyDB instance and chosen endpoint type.
+	GetEndpointAddress(ctx context.Context, info gcputils.AlloyDBFullInstanceName, endpointType string) (string, error)
+}
+
+// NewAlloyDBAdminClient returns a AlloyDBAdminClient interface.
+func NewAlloyDBAdminClient(ctx context.Context) (AlloyDBAdminClient, error) {
+	client, err := alloydbadmin.NewAlloyDBAdminClient(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &gcpAlloyDBAdminClient{apiClient: client}, nil
+}
+
+// alloyDBAdminAPIClient interface lists methods used in *alloydbadmin.AlloyDBAdminClient; used for mocking.
+type alloyDBAdminAPIClient interface {
+	GenerateClientCertificate(context.Context, *alloydbpb.GenerateClientCertificateRequest, ...gax.CallOption) (*alloydbpb.GenerateClientCertificateResponse, error)
+	GetConnectionInfo(context.Context, *alloydbpb.GetConnectionInfoRequest, ...gax.CallOption) (*alloydbpb.ConnectionInfo, error)
+}
+
+type gcpAlloyDBAdminClient struct {
+	apiClient alloyDBAdminAPIClient
+}
+
+// GenerateClientCertificate returns a new PEM-encoded client certificate and Root CA suitable for connecting to particular AlloyDB instance.
+//
+// See: https://cloud.google.com/go/docs/reference/cloud.google.com/go/alloydb/latest/apiv1beta#cloud_google_com_go_alloydb_apiv1beta_AlloyDBAdminClient_GenerateClientCertificate
+func (g *gcpAlloyDBAdminClient) GenerateClientCertificate(ctx context.Context, info gcputils.AlloyDBFullInstanceName, certExpiry time.Time, pkey *keys.PrivateKey) (*tls.Certificate, string, error) {
+	keyPEM, err := keys.MarshalPublicKey(pkey.Public())
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	req := &alloydbpb.GenerateClientCertificateRequest{
+		Parent:              info.ParentClusterName(),
+		CertDuration:        durationpb.New(time.Until(certExpiry)),
+		PublicKey:           string(keyPEM),
+		UseMetadataExchange: true,
+	}
+
+	resp, err := g.apiClient.GenerateClientCertificate(ctx, req)
+	if err != nil {
+		// See: https://cloud.google.com/alloydb/docs/reference/iam-roles-permissions
+		// Cloud AlloyDB Client is the least-privileged role with alloydb.clusters.generateClientCertificate permission.
+		if strings.Contains(err.Error(), "Permission 'alloydb.clusters.generateClientCertificate' denied") {
+			return nil, "", trace.AccessDenied(`Could not generate client certificate:
+
+  %v
+
+Make sure Teleport database agent's IAM user has the 'alloydb.clusters.generateClientCertificate' permission.
+Create a custom role with this permission or use the predefined 'Cloud AlloyDB Database User' role.  
+
+Note that IAM changes may take a few minutes to propagate.`, err)
+		}
+		return nil, "", trace.Wrap(err)
+	}
+
+	certPEMBlock := []byte(strings.Join(resp.PemCertificateChain, "\n"))
+	clientCert, err := pkey.TLSCertificate(certPEMBlock)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return &clientCert, resp.CaCert, nil
+}
+
+// GetEndpointAddress returns endpoint address for given AlloyDB instance and chosen endpoint type. Returns an error if chosen endpoint type is not available.
+func (g *gcpAlloyDBAdminClient) GetEndpointAddress(ctx context.Context, info gcputils.AlloyDBFullInstanceName, endpointType string) (string, error) {
+	req := &alloydbpb.GetConnectionInfoRequest{Parent: info.InstanceName()}
+
+	resp, err := g.apiClient.GetConnectionInfo(ctx, req)
+	if err != nil {
+		// See: https://cloud.google.com/alloydb/docs/reference/iam-roles-permissions
+		// Cloud AlloyDB Client is the least-privileged role with alloydb.clusters.generateClientCertificate permission.
+		if strings.Contains(err.Error(), "Permission 'alloydb.instances.connect' denied") {
+			return "", trace.AccessDenied(`Could not generate client certificate:
+		
+  %v
+
+Make sure Teleport database agent's IAM user has the 'alloydb.instances.connect' permission.
+Create a custom role with this permission or use the predefined 'Cloud AlloyDB Database User' role.  
+
+Note that IAM changes may take a few minutes to propagate.`, err)
+		}
+		return "", trace.Wrap(err)
+	}
+
+	var addr string
+
+	switch gcputils.AlloyDBEndpointType(endpointType) {
+	case gcputils.AlloyDBEndpointTypePrivate:
+		addr = resp.GetIpAddress()
+	case gcputils.AlloyDBEndpointTypePublic:
+		addr = resp.GetPublicIpAddress()
+	case gcputils.AlloyDBEndpointTypePSC:
+		addr = resp.GetPscDnsName()
+	default:
+		return "", trace.BadParameter("unknown endpoint type: %v", endpointType)
+	}
+
+	if addr == "" {
+		return "", trace.NotFound("endpoint type %v is not available", endpointType)
+	}
+
+	return addr, nil
+}
diff --git a/lib/cloud/gcp/alloydb_test.go b/lib/cloud/gcp/alloydb_test.go
new file mode 100644
index 0000000000000..01f29f001a6ac
--- /dev/null
+++ b/lib/cloud/gcp/alloydb_test.go
@@ -0,0 +1,78 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcp
+
+import (
+	"context"
+	"testing"
+
+	"cloud.google.com/go/alloydb/apiv1beta/alloydbpb"
+	"github.com/googleapis/gax-go/v2"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	gcputils "github.com/gravitational/teleport/api/utils/gcp"
+)
+
+type fakeAlloyDBAdminAPIClient struct {
+	alloyDBAdminAPIClient
+	getConnectionInfoResponse *alloydbpb.ConnectionInfo
+	getConnectionInfoRequest  *alloydbpb.GetConnectionInfoRequest
+}
+
+func (f *fakeAlloyDBAdminAPIClient) GetConnectionInfo(ctx context.Context, request *alloydbpb.GetConnectionInfoRequest, option ...gax.CallOption) (*alloydbpb.ConnectionInfo, error) {
+	if request.String() != f.getConnectionInfoRequest.String() {
+		return nil, trace.BadParameter("mismatched GetConnectionInfoRequest %v and %v", request, f.getConnectionInfoRequest)
+	}
+	return f.getConnectionInfoResponse, nil
+}
+
+func TestAlloyDBGetEndpointAddress(t *testing.T) {
+	instance := gcputils.AlloyDBFullInstanceName{
+		ProjectID:  "my-project-123456",
+		Location:   "europe-west1",
+		ClusterID:  "my-cluster",
+		InstanceID: "my-instance",
+	}
+
+	client := &gcpAlloyDBAdminClient{
+		apiClient: &fakeAlloyDBAdminAPIClient{
+			getConnectionInfoRequest: &alloydbpb.GetConnectionInfoRequest{
+				Parent: "projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			getConnectionInfoResponse: &alloydbpb.ConnectionInfo{
+				IpAddress:       "11.22.33.44",
+				PublicIpAddress: "22.33.44.44",
+				PscDnsName:      "dsc.internal.example.com",
+			},
+		},
+	}
+
+	addrInfo := map[gcputils.AlloyDBEndpointType]string{
+		gcputils.AlloyDBEndpointTypePrivate: "11.22.33.44",
+		gcputils.AlloyDBEndpointTypePublic:  "22.33.44.44",
+		gcputils.AlloyDBEndpointTypePSC:     "dsc.internal.example.com",
+	}
+
+	for endpointType, wantAddr := range addrInfo {
+		t.Run(string(endpointType), func(t *testing.T) {
+			resp, err := client.GetEndpointAddress(context.Background(), instance, string(endpointType))
+			require.NoError(t, err)
+			require.Equal(t, wantAddr, resp)
+		})
+	}
+}
diff --git a/lib/cloud/gcp/cache.go b/lib/cloud/gcp/cache.go
new file mode 100644
index 0000000000000..37b0e5717ce3e
--- /dev/null
+++ b/lib/cloud/gcp/cache.go
@@ -0,0 +1,48 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcp
+
+import (
+	"context"
+	"sync"
+
+	"github.com/gravitational/trace"
+)
+
+type clientConstructor[T any] func(context.Context) (T, error)
+
+// clientCache is a struct that holds a cloud client that will only be
+// initialized once.
+type clientCache[T any] struct {
+	makeClient clientConstructor[T]
+	client     T
+	err        error
+	once       sync.Once
+}
+
+// newClientCache creates a new client cache.
+func newClientCache[T any](makeClient clientConstructor[T]) *clientCache[T] {
+	return &clientCache[T]{makeClient: makeClient}
+}
+
+// GetClient gets the client, initializing it if necessary.
+func (c *clientCache[T]) GetClient(ctx context.Context) (T, error) {
+	c.once.Do(func() {
+		c.client, c.err = c.makeClient(ctx)
+	})
+	return c.client, trace.Wrap(c.err)
+}
diff --git a/lib/cloud/gcp/clients.go b/lib/cloud/gcp/clients.go
new file mode 100644
index 0000000000000..db76ec9c69f6c
--- /dev/null
+++ b/lib/cloud/gcp/clients.go
@@ -0,0 +1,137 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gcp
+
+import (
+	"context"
+	"io"
+	"sync"
+
+	gcpcredentials "cloud.google.com/go/iam/credentials/apiv1"
+	"github.com/gravitational/trace"
+)
+
+// Clients is an interface for providing GCP API clients.
+type Clients interface {
+	// GetIAMClient returns GCP IAM client.
+	GetIAMClient(context.Context) (*gcpcredentials.IamCredentialsClient, error)
+	// GetSQLAdminClient returns GCP Cloud SQL Admin client.
+	GetSQLAdminClient(context.Context) (SQLAdminClient, error)
+	// GetAlloyDBClient returns GCP AlloyDB Admin client.
+	GetAlloyDBClient(context.Context) (AlloyDBAdminClient, error)
+	// GetGKEClient returns GKE client.
+	GetGKEClient(context.Context) (GKEClient, error)
+	// GetProjectsClient returns Projects client.
+	GetProjectsClient(context.Context) (ProjectsClient, error)
+	// GetInstancesClient returns instances client.
+	GetInstancesClient(context.Context) (InstancesClient, error)
+
+	io.Closer
+}
+
+// NewClients returns a new instance of GCP SDK clients.
+func NewClients() Clients {
+	return &clients{
+		sqlAdmin:     newClientCache(NewSQLAdminClient),
+		alloyDBAdmin: newClientCache(NewAlloyDBAdminClient),
+		gke:          newClientCache(NewGKEClient),
+		projects:     newClientCache(NewProjectsClient),
+		instances:    newClientCache(NewInstancesClient),
+	}
+}
+
+// clients contains GCP-specific clients.
+type clients struct {
+	// mtx is used for locking.
+	mtx sync.RWMutex
+
+	// iam is the cached GCP IAM client.
+	iam *gcpcredentials.IamCredentialsClient
+	// sqlAdmin is the cached GCP Cloud SQL Admin client.
+	sqlAdmin *clientCache[SQLAdminClient]
+	// alloyDBAdmin is the cached GCP AlloyDB Admin client.
+	alloyDBAdmin *clientCache[AlloyDBAdminClient]
+	// gke is the cached GCP Cloud GKE client.
+	gke *clientCache[GKEClient]
+	// projects is the cached GCP Cloud Projects client.
+	projects *clientCache[ProjectsClient]
+	// instances is the cached GCP instances client.
+	instances *clientCache[InstancesClient]
+}
+
+// GetIAMClient returns GCP IAM client.
+func (c *clients) GetIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
+	c.mtx.RLock()
+	if c.iam != nil {
+		defer c.mtx.RUnlock()
+		return c.iam, nil
+	}
+	c.mtx.RUnlock()
+	return c.initIAMClient(ctx)
+}
+
+// GetSQLAdminClient returns GCP Cloud SQL Admin client.
+func (c *clients) GetSQLAdminClient(ctx context.Context) (SQLAdminClient, error) {
+	return c.sqlAdmin.GetClient(ctx)
+}
+
+// GetAlloyDBClient returns GCP AlloyDB Admin client.
+func (c *clients) GetAlloyDBClient(ctx context.Context) (AlloyDBAdminClient, error) {
+	return c.alloyDBAdmin.GetClient(ctx)
+}
+
+// GetGKEClient returns GKE client.
+func (c *clients) GetGKEClient(ctx context.Context) (GKEClient, error) {
+	return c.gke.GetClient(ctx)
+}
+
+// GetProjectsClient returns Project client.
+func (c *clients) GetProjectsClient(ctx context.Context) (ProjectsClient, error) {
+	return c.projects.GetClient(ctx)
+}
+
+// GetInstancesClient returns instances client.
+func (c *clients) GetInstancesClient(ctx context.Context) (InstancesClient, error) {
+	return c.instances.GetClient(ctx)
+}
+
+// Close closes all initialized clients.
+func (c *clients) Close() (err error) {
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if c.iam != nil {
+		err = c.iam.Close()
+		c.iam = nil
+	}
+	return trace.Wrap(err)
+}
+
+func (c *clients) initIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if c.iam != nil { // If some other thread already got here first.
+		return c.iam, nil
+	}
+	gcpIAM, err := gcpcredentials.NewIamCredentialsClient(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	c.iam = gcpIAM
+	return gcpIAM, nil
+}
diff --git a/lib/cloud/gcp/gcptest/gcp.go b/lib/cloud/gcp/gcptest/gcp.go
new file mode 100644
index 0000000000000..ded4261ed6a37
--- /dev/null
+++ b/lib/cloud/gcp/gcptest/gcp.go
@@ -0,0 +1,73 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcptest
+
+import (
+	"context"
+
+	gcpcredentials "cloud.google.com/go/iam/credentials/apiv1"
+	"google.golang.org/api/option"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+)
+
+type Clients struct {
+	GCPSQL       gcp.SQLAdminClient
+	GCPAlloyDB   gcp.AlloyDBAdminClient
+	GCPGKE       gcp.GKEClient
+	GCPProjects  gcp.ProjectsClient
+	GCPInstances gcp.InstancesClient
+}
+
+var _ gcp.Clients = (*Clients)(nil)
+
+func (c *Clients) Close() error {
+	return nil
+}
+
+// GetIAMClient returns GCP IAM client.
+func (c *Clients) GetIAMClient(ctx context.Context) (*gcpcredentials.IamCredentialsClient, error) {
+	return gcpcredentials.NewIamCredentialsClient(ctx,
+		option.WithGRPCDialOption(grpc.WithTransportCredentials(insecure.NewCredentials())), // Insecure must be set for unauth client.
+		option.WithoutAuthentication())
+}
+
+// GetSQLAdminClient returns GCP Cloud SQL Admin client.
+func (c *Clients) GetSQLAdminClient(ctx context.Context) (gcp.SQLAdminClient, error) {
+	return c.GCPSQL, nil
+}
+
+func (c *Clients) GetAlloyDBClient(ctx context.Context) (gcp.AlloyDBAdminClient, error) {
+	return c.GCPAlloyDB, nil
+}
+
+// GetGKEClient returns GKE client.
+func (c *Clients) GetGKEClient(ctx context.Context) (gcp.GKEClient, error) {
+	return c.GCPGKE, nil
+}
+
+// GetProjectsClient returns GCP projects client.
+func (c *Clients) GetProjectsClient(ctx context.Context) (gcp.ProjectsClient, error) {
+	return c.GCPProjects, nil
+}
+
+// GetInstancesClient returns instances client.
+func (c *Clients) GetInstancesClient(ctx context.Context) (gcp.InstancesClient, error) {
+	return c.GCPInstances, nil
+}
diff --git a/lib/cloud/imds/azure/imds.go b/lib/cloud/imds/azure/imds.go
index fc43e42656dc9..315766edc1cd1 100644
--- a/lib/cloud/imds/azure/imds.go
+++ b/lib/cloud/imds/azure/imds.go
@@ -163,7 +163,9 @@ func (client *InstanceMetadataClient) getVersions(ctx context.Context) ([]string
 	return versions.APIVersions, nil
 }
 
-// IsAvailable checks if instance metadata is available.
+// IsAvailable reports whether the Azure Instance Metadata Service is reachable.
+// On first use it discovers and caches a supported IMDS API version (via /versions).
+// Other methods call this internally to ensure the client is initialized.
 func (client *InstanceMetadataClient) IsAvailable(ctx context.Context) bool {
 	if client.GetAPIVersion() != "" {
 		return true
@@ -225,6 +227,10 @@ type InstanceInfo struct {
 
 // GetInstanceInfo gets the Azure Instance information.
 func (client *InstanceMetadataClient) GetInstanceInfo(ctx context.Context) (*InstanceInfo, error) {
+	if !client.IsAvailable(ctx) {
+		return nil, trace.NotFound("Instance metadata is not available")
+	}
+
 	body, err := client.getRawMetadata(ctx, "/instance/compute", url.Values{"format": []string{"json"}})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -253,12 +259,20 @@ func (client *InstanceMetadataClient) GetID(ctx context.Context) (string, error)
 
 // GetAttestedData gets attested data from the instance.
 func (client *InstanceMetadataClient) GetAttestedData(ctx context.Context, nonce string) ([]byte, error) {
+	if !client.IsAvailable(ctx) {
+		return nil, trace.NotFound("Instance metadata is not available")
+	}
+
 	body, err := client.getRawMetadata(ctx, "/attested/document", url.Values{"nonce": []string{nonce}, "format": []string{"json"}})
 	return body, trace.Wrap(err)
 }
 
 // GetAccessToken gets an oauth2 access token from the instance.
 func (client *InstanceMetadataClient) GetAccessToken(ctx context.Context, clientID string) (string, error) {
+	if !client.IsAvailable(ctx) {
+		return "", trace.NotFound("Instance metadata is not available")
+	}
+
 	params := url.Values{"resource": []string{"https://management.azure.com/"}}
 	if clientID != "" {
 		params["client_id"] = []string{clientID}
diff --git a/lib/cloud/imds/azure/imds_test.go b/lib/cloud/imds/azure/imds_test.go
index 8472d544ee6f7..720081155708d 100644
--- a/lib/cloud/imds/azure/imds_test.go
+++ b/lib/cloud/imds/azure/imds_test.go
@@ -23,6 +23,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"sync"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -80,10 +81,9 @@ func TestAzureIsInstanceMetadataAvailable(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			ctx := context.Background()
 			server := httptest.NewServer(tc.handler)
 			clt := tc.client(t, server)
-			tc.assertion(t, clt.IsAvailable(ctx))
+			tc.assertion(t, clt.IsAvailable(t.Context()))
 		})
 	}
 }
@@ -172,6 +172,69 @@ func TestParseMetadataClientError(t *testing.T) {
 	}
 }
 
+type mockIMDS struct {
+	t              *testing.T
+	versionsCalled bool
+	lastAPIVersion string
+
+	mu sync.Mutex
+}
+
+func (m *mockIMDS) status() (versionsCalled bool, lastAPIVersion string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.versionsCalled, m.lastAPIVersion
+}
+
+func newMockIMDS(t *testing.T, overrides map[string]http.Handler) (*mockIMDS, *httptest.Server) {
+	t.Helper()
+
+	m := &mockIMDS{t: t}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+
+		m.lastAPIVersion = r.URL.Query().Get("api-version")
+
+		if r.URL.Path == "/versions" {
+			m.versionsCalled = true
+		}
+
+		// /versions doesn't require api-version; all other endpoints do
+		if r.URL.Path != "/versions" && m.lastAPIVersion == "" {
+			w.WriteHeader(http.StatusBadRequest)
+			w.Write([]byte(`{"error":"Bad request. api-version is invalid or was not specified in the request.","newest-versions":["2023-07-01","2021-02-01"]}`))
+			return
+		}
+
+		if overrides != nil {
+			handler, ok := overrides[r.URL.Path]
+			if ok {
+				handler.ServeHTTP(w, r)
+				return
+			}
+		}
+
+		responses := map[string]string{
+			"/versions":                  `{"apiVersions":["2021-02-01","2023-07-01"]}`,
+			"/instance/compute":          `{"resourceId":"/subscriptions/test","location":"eastus"}`,
+			"/instance/compute/tagsList": `[{"name":"foo","value":"bar"}]`,
+			"/attested/document":         `{"signature":"test"}`,
+			"/identity/oauth2/token":     `{"access_token":"test-token"}`,
+		}
+
+		if body, ok := responses[r.URL.Path]; ok {
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		http.NotFound(w, r)
+	}))
+
+	t.Cleanup(srv.Close)
+
+	return m, srv
+}
+
 func TestGetInstanceInfo(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
@@ -179,7 +242,7 @@ func TestGetInstanceInfo(t *testing.T) {
 		statusCode           int
 		body                 []byte
 		expectedInstanceInfo *InstanceInfo
-		errAssertion         require.ErrorAssertionFunc
+		wantErr              string
 	}{
 		{
 			name:       "with resource ID",
@@ -188,7 +251,7 @@ func TestGetInstanceInfo(t *testing.T) {
 			expectedInstanceInfo: &InstanceInfo{
 				ResourceID: "test-id",
 			},
-			errAssertion: require.NoError,
+			wantErr: "",
 		},
 		{
 			name:       "all fields",
@@ -202,36 +265,38 @@ func TestGetInstanceInfo(t *testing.T) {
 				SubscriptionID:    "5187AF11-3581-4AB6-A654-59405CD40C44",
 				VMID:              "ED7DAC09-6E73-447F-BD18-AF4D1196C1E4",
 			},
-			errAssertion: require.NoError,
+			wantErr: "",
 		},
 		{
 			name:       "request error",
 			statusCode: http.StatusNotFound,
-			errAssertion: func(tt require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(t, err, "not found")
-			},
+			wantErr:    "not found",
 		},
 		{
 			name:       "empty body returns an error",
 			statusCode: http.StatusOK,
-			errAssertion: func(tt require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(t, err, "error found in #0 byte")
-			},
+			wantErr:    "error found in #0 byte",
 		},
 	} {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(tc.statusCode)
-				w.Write(tc.body)
-			}))
+
+			_, server := newMockIMDS(t, map[string]http.Handler{
+				"/instance/compute": http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					w.WriteHeader(tc.statusCode)
+					w.Write(tc.body)
+				}),
+			})
 
 			client := NewInstanceMetadataClient(WithBaseURL(server.URL))
-			instanceInfo, err := client.GetInstanceInfo(context.Background())
-			tc.errAssertion(t, err)
-			if tc.expectedInstanceInfo != nil {
+			instanceInfo, err := client.GetInstanceInfo(t.Context())
+			if tc.wantErr == "" {
+				require.NoError(t, err)
 				require.Equal(t, tc.expectedInstanceInfo, instanceInfo)
+			} else {
+				require.Nil(t, instanceInfo)
+				require.ErrorContains(t, err, tc.wantErr)
 			}
 		})
 	}
@@ -270,15 +335,66 @@ func TestGetInstanceID(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(tc.statusCode)
-				w.Write(tc.body)
-			}))
+
+			_, server := newMockIMDS(t, map[string]http.Handler{
+				"/instance/compute": http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					w.WriteHeader(tc.statusCode)
+					w.Write(tc.body)
+				}),
+			})
 
 			client := NewInstanceMetadataClient(WithBaseURL(server.URL))
-			resourceID, err := client.GetID(context.Background())
+			resourceID, err := client.GetID(t.Context())
 			tc.errAssertion(t, err)
 			require.Equal(t, tc.expectedResourceID, resourceID)
 		})
 	}
 }
+
+func TestMethodsEnsureInitialization(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		call func(ctx context.Context, c *InstanceMetadataClient) error
+	}{
+		{"GetInstanceInfo", func(ctx context.Context, c *InstanceMetadataClient) error {
+			_, err := c.GetInstanceInfo(ctx)
+			return err
+		}},
+		{"GetID", func(ctx context.Context, c *InstanceMetadataClient) error {
+			_, err := c.GetID(ctx)
+			return err
+		}},
+		{"GetTags", func(ctx context.Context, c *InstanceMetadataClient) error {
+			_, err := c.GetTags(ctx)
+			return err
+		}},
+		{"GetAttestedData", func(ctx context.Context, c *InstanceMetadataClient) error {
+			_, err := c.GetAttestedData(ctx, "")
+			return err
+		}},
+		{"GetAccessToken", func(ctx context.Context, c *InstanceMetadataClient) error {
+			_, err := c.GetAccessToken(ctx, "")
+			return err
+		}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			mock, srv := newMockIMDS(t, nil)
+			defer srv.Close()
+
+			client := NewInstanceMetadataClient(WithBaseURL(srv.URL))
+			require.Empty(t, client.GetAPIVersion(), "client should start uninitialized")
+
+			err := tc.call(t.Context(), client)
+			require.NoError(t, err)
+			versionsCalled, lastAPIVersion := mock.status()
+			require.True(t, versionsCalled, "should call /versions to initialize")
+			require.Equal(t, "2023-07-01", lastAPIVersion, "should use negotiated api-version")
+			require.Equal(t, "2023-07-01", client.GetAPIVersion(), "client should be initialized")
+		})
+	}
+}
diff --git a/lib/cloud/mocks/aws_elasticache.go b/lib/cloud/mocks/aws_elasticache.go
index 0f80e91468f44..0518308eccf8f 100644
--- a/lib/cloud/mocks/aws_elasticache.go
+++ b/lib/cloud/mocks/aws_elasticache.go
@@ -33,6 +33,9 @@ type ElastiCacheClient struct {
 	// Unauth set to true will make API calls return unauthorized errors.
 	Unauth bool
 
+	// PaginateCaches will return each serverless cache in a page by itself, to fake a multi-page response.
+	PaginateCaches    bool
+	Caches            []ectypes.ServerlessCache
 	ReplicationGroups []ectypes.ReplicationGroup
 	Users             []ectypes.User
 	TagsByARN         map[string][]ectypes.Tag
@@ -136,6 +139,41 @@ func (m *ElastiCacheClient) ModifyUser(_ context.Context, input *elasticache.Mod
 	return nil, trace.NotFound("ElastiCache UserId %q not found", aws.ToString(input.UserId))
 }
 
+func (m *ElastiCacheClient) DescribeServerlessCaches(_ context.Context, input *elasticache.DescribeServerlessCachesInput, _ ...func(*elasticache.Options)) (*elasticache.DescribeServerlessCachesOutput, error) {
+	if m.Unauth {
+		return nil, trace.AccessDenied("unauthorized")
+	}
+	if input.ServerlessCacheName == nil {
+		if !m.PaginateCaches {
+			return &elasticache.DescribeServerlessCachesOutput{
+				ServerlessCaches: m.Caches,
+			}, nil
+		}
+		token := aws.ToString(input.NextToken)
+		for i, cache := range m.Caches {
+			if token != "" && aws.ToString(cache.ServerlessCacheName) != token {
+				continue
+			}
+			out := &elasticache.DescribeServerlessCachesOutput{
+				ServerlessCaches: []ectypes.ServerlessCache{cache},
+			}
+			if i+1 < len(m.Caches) {
+				out.NextToken = m.Caches[i+1].ServerlessCacheName
+			}
+			return out, nil
+		}
+		return &elasticache.DescribeServerlessCachesOutput{}, nil
+	}
+	for _, cache := range m.Caches {
+		if aws.ToString(cache.ServerlessCacheName) == aws.ToString(input.ServerlessCacheName) {
+			return &elasticache.DescribeServerlessCachesOutput{
+				ServerlessCaches: []ectypes.ServerlessCache{cache},
+			}, nil
+		}
+	}
+	return nil, trace.NotFound("ElastiCache Serverless Cache %q not found", aws.ToString(input.ServerlessCacheName))
+}
+
 // ElastiCacheCluster returns a sample ectypes.ReplicationGroup.
 func ElastiCacheCluster(name, region string, opts ...func(*ectypes.ReplicationGroup)) *ectypes.ReplicationGroup {
 	cluster := &ectypes.ReplicationGroup{
@@ -180,3 +218,82 @@ func WithElastiCacheConfigurationEndpoint(cluster *ectypes.ReplicationGroup) {
 		Port:    aws.Int32(6379),
 	}
 }
+
+// ElastiCacheServerless returns a sample ectypes.ServerlessCache.
+func ElastiCacheServerless(name, region string, opts ...func(*ectypes.ServerlessCache)) *ectypes.ServerlessCache {
+	addr := fmt.Sprintf("%s-abc123.serverless.%s.cache.amazonaws.com", name, regionToShortRegion(region))
+	arn := fmt.Sprintf("arn:aws:elasticache:%s:123456789012:serverlesscache:%s", region, name)
+	cache := &ectypes.ServerlessCache{
+		ARN:                 aws.String(arn),
+		Engine:              aws.String("redis"),
+		ServerlessCacheName: aws.String(name),
+		Status:              aws.String("available"),
+		Endpoint: &ectypes.Endpoint{
+			Address: aws.String(addr),
+			Port:    aws.Int32(6379),
+		},
+		ReaderEndpoint: &ectypes.Endpoint{
+			Address: aws.String(addr),
+			Port:    aws.Int32(6380),
+		},
+		SubnetIds: []string{"subnet-a", "subnet-b"},
+	}
+
+	for _, opt := range opts {
+		opt(cache)
+	}
+	return cache
+}
+
+func regionToShortRegion(region string) string {
+	switch region {
+	case "us-east-1":
+		return "use1"
+	case "us-east-2":
+		return "use2"
+	case "us-west-1":
+		return "usw1"
+	case "us-west-2":
+		return "usw2"
+	case "ca-central-1":
+		return "cac1"
+	case "eu-west-1":
+		return "euw1"
+	case "eu-west-2":
+		return "euw2"
+	case "eu-west-3":
+		return "euw3"
+	case "eu-central-1":
+		return "euc1"
+	case "eu-south-1":
+		return "eus1"
+	case "eu-north-1":
+		return "eun1"
+	case "ap-southeast-1":
+		return "apse1"
+	case "ap-southeast-2":
+		return "apse2"
+	case "ap-south-1":
+		return "aps1"
+	case "ap-northeast-1":
+		return "apne1"
+	case "ap-northeast-2":
+		return "apne2"
+	case "ap-east-1":
+		return "ape1"
+	case "sa-east-1":
+		return "sae1"
+	case "af-south-1":
+		return "afs1"
+	case "us-gov-west-1":
+		return "usgw1"
+	case "us-gov-east-1":
+		return "usge1"
+	case "cn-north-1":
+		return "cnn1"
+	case "cn-northwest-1":
+		return "cnnw1"
+	default:
+		panic(fmt.Sprintf("unknown region %s", region))
+	}
+}
diff --git a/lib/cloud/mocks/aws_kms.go b/lib/cloud/mocks/aws_kms.go
new file mode 100644
index 0000000000000..358dcb66ace9d
--- /dev/null
+++ b/lib/cloud/mocks/aws_kms.go
@@ -0,0 +1,138 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mocks
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/kms"
+	"github.com/aws/aws-sdk-go-v2/service/kms/types"
+)
+
+type KMSClient struct {
+	Keys        map[string]KMSOutput
+	ListKeysErr error
+}
+
+type KMSOutput struct {
+	ARN          string
+	Aliases      []string
+	CreationDate time.Time
+	HSMClusterID string
+	MultiType    types.MultiRegionKeyType
+	Tags         map[string]string
+	Policy       string
+
+	DescribeKeyErr error
+	TagsErr        error
+	AliasesErr     error
+	PolicyErr      error
+}
+
+func (c *KMSClient) ListKeys(_ context.Context, input *kms.ListKeysInput, _ ...func(*kms.Options)) (*kms.ListKeysOutput, error) {
+	if c.ListKeysErr != nil {
+		return nil, c.ListKeysErr
+	}
+	keyIDs := slices.Collect(maps.Keys(c.Keys))
+	slices.Sort(keyIDs)
+	keys := make([]types.KeyListEntry, len(keyIDs))
+	for i, keyID := range keyIDs {
+		keys[i] = types.KeyListEntry{KeyId: &keyID}
+	}
+	return &kms.ListKeysOutput{Keys: keys}, nil
+}
+
+func (c *KMSClient) ListResourceTags(ctx context.Context, input *kms.ListResourceTagsInput, optFns ...func(*kms.Options)) (*kms.ListResourceTagsOutput, error) {
+	key, ok := c.Keys[*input.KeyId]
+	if !ok {
+		return nil, fmt.Errorf("key %q not found to list tags", *input.KeyId)
+	}
+	if key.TagsErr != nil {
+		return nil, key.TagsErr
+	}
+	tags := make([]types.Tag, 0, len(key.Tags))
+	for key, val := range key.Tags {
+		tag := types.Tag{
+			TagKey:   &key,
+			TagValue: &val,
+		}
+		tags = append(tags, tag)
+	}
+	return &kms.ListResourceTagsOutput{Tags: tags}, nil
+}
+
+func (c *KMSClient) ListAliases(ctx context.Context, input *kms.ListAliasesInput, optFns ...func(*kms.Options)) (*kms.ListAliasesOutput, error) {
+	key, ok := c.Keys[*input.KeyId]
+	if !ok {
+		return nil, fmt.Errorf("key %q not found to list aliases", *input.KeyId)
+	}
+	if key.AliasesErr != nil {
+		return nil, key.AliasesErr
+	}
+	aliases := make([]types.AliasListEntry, len(key.Aliases))
+	for i, alias := range key.Aliases {
+		aliases[i] = types.AliasListEntry{AliasName: &alias}
+	}
+	return &kms.ListAliasesOutput{Aliases: aliases}, nil
+}
+
+func (c *KMSClient) DescribeKey(ctx context.Context, input *kms.DescribeKeyInput, optFns ...func(*kms.Options)) (*kms.DescribeKeyOutput, error) {
+	key, ok := c.Keys[*input.KeyId]
+	if !ok {
+		return nil, fmt.Errorf("key %q not found to describe", *input.KeyId)
+	}
+	if key.DescribeKeyErr != nil {
+		return nil, key.DescribeKeyErr
+	}
+	var multiRegionConfig *types.MultiRegionConfiguration
+	var hsmClusterID *string
+	if key.HSMClusterID != "" {
+		hsmClusterID = &key.HSMClusterID
+	}
+	if key.MultiType != "" {
+		multiRegionConfig = &types.MultiRegionConfiguration{
+			MultiRegionKeyType: key.MultiType,
+		}
+	}
+	output := &kms.DescribeKeyOutput{
+		KeyMetadata: &types.KeyMetadata{
+			Arn:                      &key.ARN,
+			KeyId:                    input.KeyId,
+			CreationDate:             &key.CreationDate,
+			CloudHsmClusterId:        hsmClusterID,
+			MultiRegionConfiguration: multiRegionConfig,
+		},
+	}
+	return output, nil
+}
+
+func (c *KMSClient) GetKeyPolicy(ctx context.Context, input *kms.GetKeyPolicyInput, optFns ...func(*kms.Options)) (*kms.GetKeyPolicyOutput, error) {
+	key, ok := c.Keys[*input.KeyId]
+	if !ok {
+		return nil, fmt.Errorf("key %q not found to get policy", *input.KeyId)
+	}
+	if key.PolicyErr != nil {
+		return nil, key.PolicyErr
+	}
+	return &kms.GetKeyPolicyOutput{Policy: &key.Policy}, nil
+}
diff --git a/lib/cloud/provisioning/awsactions/create_role_for_trustanchor.go b/lib/cloud/provisioning/awsactions/create_role_for_trustanchor.go
new file mode 100644
index 0000000000000..4673ee0e7fc2f
--- /dev/null
+++ b/lib/cloud/provisioning/awsactions/create_role_for_trustanchor.go
@@ -0,0 +1,177 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/gravitational/trace"
+
+	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+)
+
+// CreateRoleForTrustAnchorRequest are the request parameters for creating a Role which can be used by the Trust Anchor.
+type CreateRoleForTrustAnchorRequest struct {
+	// AccountID is the AWS account ID
+	AccountID string
+	// RoleName is the name of the IAM role to create.
+	RoleName string
+	// RoleDescription is the description of the IAM role to create.
+	RoleDescription string
+	// TrustAnchorName is the name of the Trust Anchor to associate with the role.
+	TrustAnchorName string
+	// Tags are the tags to apply to the IAM role.
+	Tags tags.AWSTags
+}
+
+type createRoleInput struct {
+	// AssumeRolePolicyDocument shadows the input's field of the same name
+	// to marshal the trust policy doc as unescaped JSON.
+	AssumeRolePolicyDocument *awslib.PolicyDocument
+	*iam.CreateRoleInput
+}
+
+func createRoleInputForTrustAnchorWithPlaceholders(req CreateRoleForTrustAnchorRequest) (*iam.CreateRoleInput, *awslib.PolicyDocument, error) {
+	return createRoleInputForTrustAnchor(req, "_Region_", "_TrustAnchorID_")
+}
+
+func createRoleInputForTrustAnchor(req CreateRoleForTrustAnchorRequest, region, trustAnhcorID string) (*iam.CreateRoleInput, *awslib.PolicyDocument, error) {
+	trustPolicy := awslib.NewPolicyDocument(
+		awslib.StatementForAWSRolesAnywhereSyncRoleTrustRelationship(region, req.AccountID, trustAnhcorID),
+	)
+	trustPolicyJSON, err := trustPolicy.Marshal()
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	input := &iam.CreateRoleInput{
+		RoleName:                 &req.RoleName,
+		Description:              &req.RoleDescription,
+		AssumeRolePolicyDocument: &trustPolicyJSON,
+		Tags:                     req.Tags.ToIAMTags(),
+	}
+
+	return input, trustPolicy, nil
+}
+
+// CreateRoleForTrustAnchor returns a [provisioning.Action] that creates or updates an IAM
+// role when invoked.
+func CreateRoleForTrustAnchor(
+	clt interface {
+		AssumeRolePolicyUpdater
+		RoleCreator
+		RoleGetter
+		RoleTagger
+		RolesAnywhereTrustAnchorLister
+	},
+	req CreateRoleForTrustAnchorRequest,
+) (*provisioning.Action, error) {
+
+	// At this point, we don't know the TrustAnchorID or region.
+	// We will use placeholders in the action description to indicate that they will be replaced when the action runs.
+	createRoleInputWithPlaceholders, trustPolicyWithPlaceholders, err := createRoleInputForTrustAnchorWithPlaceholders(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	details, err := formatDetails(createRoleInput{
+		AssumeRolePolicyDocument: trustPolicyWithPlaceholders,
+		CreateRoleInput:          createRoleInputWithPlaceholders,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name:    "CreateRole",
+		Summary: fmt.Sprintf("Create IAM role %q which can be used by IAM Roles Anywhere", req.RoleName),
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			slog.InfoContext(ctx, "Getting the Trust Anchor ID",
+				"trust_anchor", req.TrustAnchorName,
+			)
+
+			trustAnchorDetails, err := trustAnchorDetails(ctx, req.TrustAnchorName, clt)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			trustAnchorID := aws.ToString(trustAnchorDetails.TrustAnchorId)
+
+			trustAnchorParsedARN, err := arn.Parse(aws.ToString(trustAnchorDetails.TrustAnchorArn))
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			region := trustAnchorParsedARN.Region
+
+			createRoleInput, trustPolicy, err := createRoleInputForTrustAnchor(req, region, trustAnchorID)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			getRoleOut, err := clt.GetRole(ctx, &iam.GetRoleInput{
+				RoleName: aws.String(req.RoleName),
+			})
+			if err != nil {
+				convertedErr := awslib.ConvertIAMError(err)
+				if !trace.IsNotFound(convertedErr) {
+					return trace.Wrap(convertedErr)
+				}
+				slog.InfoContext(ctx, "Creating IAM role", "role", req.RoleName)
+				_, err = clt.CreateRole(ctx, createRoleInput)
+				if err != nil {
+					return trace.Wrap(awslib.ConvertIAMError(err))
+				}
+				return nil
+			}
+
+			slog.InfoContext(ctx, "IAM role already exists",
+				"role", req.RoleName,
+			)
+			existingTrustPolicy, err := awslib.ParsePolicyDocument(aws.ToString(getRoleOut.Role.AssumeRolePolicyDocument))
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			err = ensureTrustPolicy(ctx, clt, req.RoleName, trustPolicy, existingTrustPolicy)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			err = ensureTags(ctx, clt, req.RoleName, req.Tags, getRoleOut.Role.Tags)
+			if err != nil {
+				// Tagging an existing role after we update it is a
+				// nice-to-have, but not a need-to-have.
+				slog.WarnContext(ctx, "Failed to update IAM role tags",
+					"role", req.RoleName,
+					"error", err,
+					"tags", req.Tags.ToMap(),
+				)
+			}
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}
diff --git a/lib/cloud/provisioning/awsactions/create_rolesanywhere_profile.go b/lib/cloud/provisioning/awsactions/create_rolesanywhere_profile.go
new file mode 100644
index 0000000000000..839d1cbde5f1d
--- /dev/null
+++ b/lib/cloud/provisioning/awsactions/create_rolesanywhere_profile.go
@@ -0,0 +1,170 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"context"
+	"log/slog"
+	"slices"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+)
+
+// RolesAnywhereProfileLister can list IAM Roles Anywhere Profiles.
+type RolesAnywhereProfileLister interface {
+	// ListProfiles lists IAM Roles Anywhere Profiles.
+	ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error)
+}
+
+// RolesAnywhereProfileCreator can create an IAM Roles Anywhere Profiles.
+type RolesAnywhereProfileCreator interface {
+	// CreateProfile creates an IAM Roles Anywhere Profile in AWS IAM.
+	CreateProfile(ctx context.Context, params *rolesanywhere.CreateProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.CreateProfileOutput, error)
+}
+
+// RolesAnywhereProfileUpdater can update an IAM Roles Anywhere Profiles.
+type RolesAnywhereProfileUpdater interface {
+	// UpdateProfile updates an IAM Roles Anywhere Profile in AWS IAM.
+	UpdateProfile(ctx context.Context, params *rolesanywhere.UpdateProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.UpdateProfileOutput, error)
+	// Enables temporary credential requests for a profile.
+	EnableProfile(ctx context.Context, params *rolesanywhere.EnableProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.EnableProfileOutput, error)
+}
+
+// CreateRolesAnywhereProfileProvider wraps a [RolesAnywhereProfileCreator] in a
+// [provisioning.Action] that creates an IAM Roles Anywhere Profile in AWS IAM when invoked.
+func CreateRolesAnywhereProfileProvider(
+	clt interface {
+		RolesAnywhereProfileLister
+		RolesAnywhereProfileCreator
+		RolesAnywhereProfileUpdater
+		RolesAnywhereResourceTagsGetter
+	},
+	name string,
+	roleARN string,
+	tags tags.AWSTags,
+) (*provisioning.Action, error) {
+	input := &rolesanywhere.CreateProfileInput{
+		Name:                  aws.String(name),
+		Enabled:               aws.Bool(true),
+		RoleArns:              []string{roleARN},
+		AcceptRoleSessionName: aws.Bool(true),
+		Tags:                  tags.ToRolesAnywhereTags(),
+	}
+	details, err := formatDetails(input)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name:    "CreateRolesAnywhereProfileProvider",
+		Summary: "Create a Roles Anywhere Profile in AWS IAM for your Teleport cluster",
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			profileDetails, err := profileDetails(ctx, name, clt)
+			switch {
+			case trace.IsNotFound(err):
+				slog.InfoContext(ctx, "Creating a new Roles Anywhere Profile")
+				_, err = clt.CreateProfile(ctx, input)
+				return trace.Wrap(err)
+
+			case err != nil:
+				return trace.Wrap(err)
+
+			}
+
+			resourceTags, err := clt.ListTagsForResource(ctx, &rolesanywhere.ListTagsForResourceInput{
+				ResourceArn: profileDetails.ProfileArn,
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if !tags.MatchesRolesAnywhereTags(resourceTags.Tags) {
+				return trace.AccessDenied("Roles Anywhere Profile %q is not owned by this integration", name)
+			}
+
+			requiresUpdate := false
+			if !aws.ToBool(profileDetails.AcceptRoleSessionName) {
+				profileDetails.AcceptRoleSessionName = aws.Bool(true)
+				requiresUpdate = true
+			}
+
+			if !slices.Contains(profileDetails.RoleArns, roleARN) {
+				requiresUpdate = true
+				profileDetails.RoleArns = append(profileDetails.RoleArns, roleARN)
+			}
+
+			if requiresUpdate {
+				slog.InfoContext(ctx, "Updating the existing Roles Anywhere Profile")
+				_, err = clt.UpdateProfile(ctx, &rolesanywhere.UpdateProfileInput{
+					Name:                  profileDetails.Name,
+					ProfileId:             profileDetails.ProfileId,
+					AcceptRoleSessionName: profileDetails.AcceptRoleSessionName,
+					RoleArns:              profileDetails.RoleArns,
+				})
+				if err != nil {
+					return trace.Wrap(err)
+				}
+			}
+
+			if !aws.ToBool(profileDetails.Enabled) {
+				_, err := clt.EnableProfile(ctx, &rolesanywhere.EnableProfileInput{
+					ProfileId: profileDetails.ProfileId,
+				})
+				if err != nil {
+					return trace.Wrap(err)
+				}
+			}
+
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}
+
+func profileDetails(ctx context.Context, profileName string, clt RolesAnywhereProfileLister) (*ratypes.ProfileDetail, error) {
+	var nextToken *string
+	for {
+		profilesResp, err := clt.ListProfiles(ctx, &rolesanywhere.ListProfilesInput{
+			NextToken: nextToken,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, profile := range profilesResp.Profiles {
+			if aws.ToString(profile.Name) == profileName {
+				return &profile, nil
+			}
+		}
+
+		if aws.ToString(profilesResp.NextToken) == "" {
+			return nil, trace.NotFound("Roles Anywhere Profile %q not found", profileName)
+		}
+
+		nextToken = profilesResp.NextToken
+	}
+}
diff --git a/lib/cloud/provisioning/awsactions/create_rolesanywhere_trustanchor.go b/lib/cloud/provisioning/awsactions/create_rolesanywhere_trustanchor.go
new file mode 100644
index 0000000000000..0ac6138ea4506
--- /dev/null
+++ b/lib/cloud/provisioning/awsactions/create_rolesanywhere_trustanchor.go
@@ -0,0 +1,180 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"cmp"
+	"context"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+)
+
+// RolesAnywhereTrustAnchorLister is an interface that defines methods for listing IAM Roles Anywhere Trust Anchors.
+type RolesAnywhereTrustAnchorLister interface {
+	// ListTrustAnchors lists IAM Roles Anywhere Trust Anchors.
+	ListTrustAnchors(ctx context.Context, params *rolesanywhere.ListTrustAnchorsInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTrustAnchorsOutput, error)
+}
+
+// RolesAnywhereResourceTagsGetter is an interface that defines methods for getting IAM Roles Anywhere resource tags.
+type RolesAnywhereResourceTagsGetter interface {
+	// ListTagsForResource lists IAM Roles Anywhere resource tags.
+	ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error)
+}
+
+// RolesAnywhereTrustAnchorCreator is an interface that defines methods for creating IAM Roles Anywhere Trust Anchors.
+type RolesAnywhereTrustAnchorCreator interface {
+	// CreateTrustAnchor creates an IAM Roles Anywhere Trust Anchor in AWS IAM.
+	CreateTrustAnchor(ctx context.Context, params *rolesanywhere.CreateTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.CreateTrustAnchorOutput, error)
+}
+
+// RolesAnywhereTrustAnchorUpdater is an interface that defines methods for updating IAM Roles Anywhere Trust Anchors.
+type RolesAnywhereTrustAnchorUpdater interface {
+	// UpdateTrustAnchor updates an IAM Roles Anywhere Trust Anchor in AWS IAM.
+	UpdateTrustAnchor(ctx context.Context, params *rolesanywhere.UpdateTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.UpdateTrustAnchorOutput, error)
+	// EnableTrustAnchor enables temporary credential requests for a trust anchor.
+	EnableTrustAnchor(ctx context.Context, params *rolesanywhere.EnableTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.EnableTrustAnchorOutput, error)
+}
+
+// CreateRolesAnywhereTrustAnchorProvider wraps a [RolesAnywhereTrustAnchorCreator] in a
+// [provisioning.Action] that creates an IAM Roles Anywhere Trust Anchor in AWS IAM when invoked.
+func CreateRolesAnywhereTrustAnchorProvider(
+	clt interface {
+		RolesAnywhereTrustAnchorLister
+		RolesAnywhereTrustAnchorCreator
+		RolesAnywhereTrustAnchorUpdater
+		RolesAnywhereResourceTagsGetter
+	},
+	name string,
+	trustAnchorCertificate string,
+	tags tags.AWSTags,
+) (*provisioning.Action, error) {
+	input := &rolesanywhere.CreateTrustAnchorInput{
+		Name: aws.String(name),
+		Source: &ratypes.Source{
+			SourceType: ratypes.TrustAnchorTypeCertificateBundle,
+			SourceData: &ratypes.SourceDataMemberX509CertificateData{
+				Value: trustAnchorCertificate,
+			},
+		},
+		Enabled: aws.Bool(true),
+		Tags:    tags.ToRolesAnywhereTags(),
+	}
+	details, err := formatDetails(input)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name:    "CreateRolesAnywhereTrustAnchorProvider",
+		Summary: "Create a Roles Anywhere Trust Anchor in AWS IAM for your Teleport cluster",
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			trustAnchorDetails, err := trustAnchorDetails(ctx, name, clt)
+			switch {
+			case trace.IsNotFound(err):
+				slog.InfoContext(ctx, "Creating a new Roles Anywhere Trust Anchor")
+				_, err = clt.CreateTrustAnchor(ctx, input)
+				return trace.Wrap(err)
+
+			case err != nil:
+				return trace.Wrap(err)
+			}
+
+			resourceTags, err := clt.ListTagsForResource(ctx, &rolesanywhere.ListTagsForResourceInput{
+				ResourceArn: trustAnchorDetails.TrustAnchorArn,
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if !tags.MatchesRolesAnywhereTags(resourceTags.Tags) {
+				return trace.AccessDenied("Roles Anywhere Trust Anchor %q is not owned by this integration", name)
+			}
+
+			requiresUpdate := false
+
+			trustAnchorSource := cmp.Or(trustAnchorDetails.Source, &ratypes.Source{})
+			if trustAnchorSource.SourceType != input.Source.SourceType {
+				trustAnchorDetails.Source.SourceType = input.Source.SourceType
+				requiresUpdate = true
+			}
+
+			if trustAnchorSource.SourceData != input.Source.SourceData {
+				trustAnchorDetails.Source.SourceData = input.Source.SourceData
+				requiresUpdate = true
+			}
+
+			if requiresUpdate {
+				slog.InfoContext(ctx, "Updating the existing Roles Anywhere Profile")
+				_, err = clt.UpdateTrustAnchor(ctx, &rolesanywhere.UpdateTrustAnchorInput{
+					Name:          trustAnchorDetails.Name,
+					TrustAnchorId: trustAnchorDetails.TrustAnchorId,
+					Source:        input.Source,
+				})
+				if err != nil {
+					return trace.Wrap(err)
+				}
+			}
+
+			if !aws.ToBool(trustAnchorDetails.Enabled) {
+				_, err := clt.EnableTrustAnchor(ctx, &rolesanywhere.EnableTrustAnchorInput{
+					TrustAnchorId: trustAnchorDetails.TrustAnchorId,
+				})
+				if err != nil {
+					return trace.Wrap(err)
+				}
+			}
+
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}
+
+func trustAnchorDetails(ctx context.Context, trustAnchorName string, clt RolesAnywhereTrustAnchorLister) (*ratypes.TrustAnchorDetail, error) {
+	var nextToken *string
+	for {
+		trustAnchorResp, err := clt.ListTrustAnchors(ctx, &rolesanywhere.ListTrustAnchorsInput{
+			NextToken: nextToken,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, trustAnchor := range trustAnchorResp.TrustAnchors {
+			if aws.ToString(trustAnchor.Name) == trustAnchorName {
+				return &trustAnchor, nil
+			}
+		}
+
+		if aws.ToString(trustAnchorResp.NextToken) == "" {
+			return nil, trace.NotFound("Roles Anywhere Trust Anchor %q not found", trustAnchorName)
+		}
+
+		nextToken = trustAnchorResp.NextToken
+	}
+}
diff --git a/lib/cloud/provisioning/awsactions/trustanchor_setup_arns.go b/lib/cloud/provisioning/awsactions/trustanchor_setup_arns.go
new file mode 100644
index 0000000000000..fa2d584613bbe
--- /dev/null
+++ b/lib/cloud/provisioning/awsactions/trustanchor_setup_arns.go
@@ -0,0 +1,100 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsactions
+
+import (
+	"context"
+	"io"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+)
+
+// TrustAnchorSetUpARNs prints the IAM Roles Anywhere set up ARNs to output.
+func TrustAnchorSetUpARNs(
+	clt interface {
+		RolesAnywhereTrustAnchorLister
+		RolesAnywhereProfileLister
+		RoleGetter
+	},
+	trustAnchorName string,
+	profileName string,
+	roleName string,
+	output io.Writer,
+) (*provisioning.Action, error) {
+
+	type trustAnchorARNs struct {
+		TrustAnchorName string
+		ProfileName     string
+		RoleName        string
+	}
+	details, err := formatDetails(trustAnchorARNs{
+		TrustAnchorName: trustAnchorName,
+		ProfileName:     profileName,
+		RoleName:        roleName,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	config := provisioning.ActionConfig{
+		Name:    "TrustAnchorSetUpARNs",
+		Summary: "Prints the ARNs for the Trust Anchor, Profile, and Role",
+		Details: details,
+		RunnerFn: func(ctx context.Context) error {
+			trustAnchorDetails, err := trustAnchorDetails(ctx, trustAnchorName, clt)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			profileDetails, err := profileDetails(ctx, profileName, clt)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			roleDetails, err := clt.GetRole(ctx, &iam.GetRoleInput{
+				RoleName: aws.String(roleName),
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			summaryBuilder := strings.Builder{}
+			summaryBuilder.WriteString("\nCopy and paste the following values to Teleport UI\n\n")
+			summaryBuilder.WriteString("=================================================\n")
+			summaryBuilder.WriteString(aws.ToString(trustAnchorDetails.TrustAnchorArn) + "\n")
+			summaryBuilder.WriteString(aws.ToString(profileDetails.ProfileArn) + "\n")
+			summaryBuilder.WriteString(aws.ToString(roleDetails.Role.Arn) + "\n")
+			summaryBuilder.WriteString("=================================================\n\n")
+
+			_, err = io.WriteString(output, summaryBuilder.String())
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			return nil
+		},
+	}
+	action, err := provisioning.NewAction(config)
+	return action, trace.Wrap(err)
+}
diff --git a/lib/componentfeatures/advertisement.go b/lib/componentfeatures/advertisement.go
new file mode 100644
index 0000000000000..906ccd702ad26
--- /dev/null
+++ b/lib/componentfeatures/advertisement.go
@@ -0,0 +1,57 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package componentfeatures
+
+import (
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// ForAuthServer returns features that an Auth server can support/participate in.
+func ForAuthServer() *componentfeaturesv1.ComponentFeatures {
+	return New(FeatureResourceConstraintsV1)
+}
+
+type sshServerInfoGetter interface {
+	GetProxyMode() bool
+}
+
+// ForSSHServer returns features that an SSH/Proxy server can support/participate in.
+func ForSSHServer(g sshServerInfoGetter) *componentfeaturesv1.ComponentFeatures {
+	// Resource Constraints are only supported for Proxy servers.
+	if !g.GetProxyMode() {
+		return New()
+	}
+
+	return New(FeatureResourceConstraintsV1)
+}
+
+type appServerInfoGetter interface {
+	GetApp() types.Application
+}
+
+// ForAppServer returns features that an App server can support/participate in.
+func ForAppServer(g appServerInfoGetter) *componentfeaturesv1.ComponentFeatures {
+	// Resource Constraints are only supported for AWS Console apps.
+	if app := g.GetApp(); !app.IsAWSConsole() {
+		return New()
+	}
+
+	return New(FeatureResourceConstraintsV1)
+}
diff --git a/lib/componentfeatures/features.go b/lib/componentfeatures/features.go
new file mode 100644
index 0000000000000..21c68952d0146
--- /dev/null
+++ b/lib/componentfeatures/features.go
@@ -0,0 +1,56 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package componentfeatures
+
+import (
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
+)
+
+// FeatureID is used to wrap [componentfeaturesv1.ComponentFeatureID] for convenience methods.
+type FeatureID int32
+
+const (
+	// FeatureUnspecified is the unspecified feature ID.
+	FeatureUnspecified FeatureID = iota
+	// FeatureResourceConstraintsV1 indicates support for Resource Constraints in Access Requests,
+	// identity certificates, and AWS Console App resources.
+	FeatureResourceConstraintsV1
+)
+
+var featureIDToName = map[FeatureID]string{
+	FeatureUnspecified:           "UNSPECIFIED",
+	FeatureResourceConstraintsV1: "RESOURCE_CONSTRAINTS_V1",
+}
+
+// String returns a short name for the FeatureID, falling back to the
+// [componentfeaturesv1.ComponentFeatureID] enum name if not specified.
+func (f FeatureID) String() string {
+	if s, ok := featureIDToName[f]; ok {
+		return s
+	}
+	if s, ok := componentfeaturesv1.ComponentFeatureID_name[int32(f)]; ok {
+		return s
+	}
+	return "UNKNOWN"
+}
+
+// ToProto converts the FeatureID to its corresponding [componentfeaturesv1.ComponentFeatureID].
+func (f FeatureID) ToProto() componentfeaturesv1.ComponentFeatureID {
+	return componentfeaturesv1.ComponentFeatureID(f)
+}
diff --git a/lib/componentfeatures/utils.go b/lib/componentfeatures/utils.go
new file mode 100644
index 0000000000000..7a0c67272d95c
--- /dev/null
+++ b/lib/componentfeatures/utils.go
@@ -0,0 +1,139 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package componentfeatures
+
+import componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
+
+// New creates a new [componentfeaturesv1.ComponentFeatures] struct containing the provided FeatureIDs.
+func New(features ...FeatureID) *componentfeaturesv1.ComponentFeatures {
+	out := &componentfeaturesv1.ComponentFeatures{}
+	seen := make(map[FeatureID]struct{})
+	for _, f := range features {
+		if _, exists := seen[f]; exists {
+			continue
+		}
+		seen[f] = struct{}{}
+		out.Features = append(out.Features, f.ToProto())
+	}
+	return out
+}
+
+// Join copies, deduplicates, and combines [componentfeaturesv1.ComponentFeatures] sets into a single set
+// containing all unique features.
+func Join(sets ...*componentfeaturesv1.ComponentFeatures) *componentfeaturesv1.ComponentFeatures {
+	out := &componentfeaturesv1.ComponentFeatures{}
+	seen := make(map[componentfeaturesv1.ComponentFeatureID]struct{})
+
+	for _, fs := range sets {
+		if fs == nil || len(fs.GetFeatures()) == 0 {
+			continue
+		}
+		for _, f := range fs.GetFeatures() {
+			if _, exists := seen[f]; !exists {
+				seen[f] = struct{}{}
+				out.Features = append(out.Features, f)
+			}
+		}
+	}
+
+	return out
+}
+
+// InAllSets reports whether a given [componentfeaturesv1.ComponentFeatureID] is
+// present in *every* [componentfeaturesv1.ComponentFeatures] set.
+//
+// If no sets are provided, or any set is nil, it returns false.
+func InAllSets(feature FeatureID, sets ...*componentfeaturesv1.ComponentFeatures) bool {
+	if len(sets) == 0 {
+		return false
+	}
+	proto := feature.ToProto()
+
+	for _, fs := range sets {
+		if fs == nil || len(fs.GetFeatures()) == 0 {
+			return false
+		}
+
+		found := false
+		for _, f := range fs.GetFeatures() {
+			if f == proto {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Intersect returns a new [componentfeaturesv1.ComponentFeatures] containing only features present in all input
+// [componentfeaturesv1.ComponentFeatures].
+//
+// If no sets are provided, or any set is nil or empty, it returns an empty [componentfeaturesv1.ComponentFeatures].
+func Intersect(sets ...*componentfeaturesv1.ComponentFeatures) *componentfeaturesv1.ComponentFeatures {
+	out := &componentfeaturesv1.ComponentFeatures{}
+
+	if len(sets) == 0 {
+		return out
+	}
+
+	counts := make(map[componentfeaturesv1.ComponentFeatureID]int)
+
+	for _, fs := range sets {
+		if fs == nil || len(fs.GetFeatures()) == 0 {
+			return out
+		}
+
+		seenInThisSet := make(map[componentfeaturesv1.ComponentFeatureID]struct{})
+		for _, f := range fs.GetFeatures() {
+			if _, seen := seenInThisSet[f]; seen {
+				continue
+			}
+			seenInThisSet[f] = struct{}{}
+			counts[f]++
+		}
+	}
+
+	for f, c := range counts {
+		if c == len(sets) {
+			out.Features = append(out.Features, f)
+		}
+	}
+
+	return out
+}
+
+// ToIntegers deduplicates and converts [componentfeaturesv1.ComponentFeatures] into a list of integers.
+func ToIntegers(features *componentfeaturesv1.ComponentFeatures) []int {
+	out := make([]int, 0)
+	seen := make(map[componentfeaturesv1.ComponentFeatureID]struct{})
+
+	for _, f := range features.GetFeatures() {
+		if _, seen := seen[f]; seen {
+			continue
+		}
+		seen[f] = struct{}{}
+		out = append(out, int(f))
+	}
+
+	return out
+}
diff --git a/lib/componentfeatures/utils_test.go b/lib/componentfeatures/utils_test.go
new file mode 100644
index 0000000000000..3c0694bb93023
--- /dev/null
+++ b/lib/componentfeatures/utils_test.go
@@ -0,0 +1,254 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package componentfeatures
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
+)
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	const (
+		featA = FeatureResourceConstraintsV1
+		featB = FeatureID(200)
+	)
+
+	tests := []struct {
+		name     string
+		features []FeatureID
+		want     []componentfeaturesv1.ComponentFeatureID
+	}{
+		{
+			name:     "no features yields empty set",
+			features: []FeatureID{},
+			want:     []componentfeaturesv1.ComponentFeatureID{},
+		},
+		{
+			name:     "duplicates are ignored",
+			features: []FeatureID{featA, featB, featA, featB},
+			want:     []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto()},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := New(tt.features...)
+			require.NotNil(t, got, "New(%v) returned nil", tt.features)
+			require.ElementsMatch(t, tt.want, got.Features, "New(%v) = %v; want %v", tt.features, got.Features, tt.want)
+		})
+	}
+}
+
+func TestJoin(t *testing.T) {
+	t.Parallel()
+
+	const (
+		featA = FeatureResourceConstraintsV1
+		featB = FeatureID(200)
+		featC = FeatureID(201)
+	)
+
+	tests := []struct {
+		name string
+		sets []*componentfeaturesv1.ComponentFeatures
+		want []componentfeaturesv1.ComponentFeatureID
+	}{
+		{
+			name: "no sets returns empty set",
+			sets: nil,
+			want: []componentfeaturesv1.ComponentFeatureID{},
+		},
+		{
+			name: "single set returns same set",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto()},
+		},
+		{
+			name: "multiple sets combined",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA), New(featB), New(featA, featC)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto(), featC.ToProto()},
+		},
+		{
+			name: "nil and empty sets ignored",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA), nil, New(), New(featB)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto()},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := Join(tt.sets...)
+			require.NotNil(t, got, "Join(%v) returned nil", tt.sets)
+			require.ElementsMatch(t, tt.want, got.Features, "Join(%v) = %v; want %v", tt.sets, got.Features, tt.want)
+		})
+	}
+}
+
+func TestInAllSets(t *testing.T) {
+	t.Parallel()
+
+	const (
+		featA = FeatureResourceConstraintsV1
+		featB = FeatureID(200)
+		featC = FeatureID(201)
+	)
+
+	tests := []struct {
+		name    string
+		sets    []*componentfeaturesv1.ComponentFeatures
+		feature FeatureID
+		want    bool
+	}{
+		{
+			name:    "no sets",
+			sets:    nil,
+			feature: featA,
+			want:    false,
+		},
+		{
+			name:    "single set contains feature",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featA)},
+			feature: featA,
+			want:    true,
+		},
+		{
+			name:    "single set missing feature",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featB)},
+			feature: featA,
+			want:    false,
+		},
+		{
+			name:    "multiple sets all contain feature",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featA, featB), New(featA), New(featA, featB, featC)},
+			feature: featA,
+			want:    true,
+		},
+		{
+			name:    "one set missing feature",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featA), New(featA, featB), New(featB, featC)},
+			feature: featA,
+			want:    false,
+		},
+		{
+			name:    "nil set treated as unsupported",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featB, featC), nil, New(featA, featB)},
+			feature: featB,
+			want:    false,
+		},
+		{
+			name:    "empty set treated as unsupported",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featA), New(), New(featA, featB)},
+			feature: featA,
+			want:    false,
+		},
+		{
+			name:    "duplicate feature in set",
+			sets:    []*componentfeaturesv1.ComponentFeatures{New(featA, featA, featB), New(featA, featC, featC)},
+			feature: featA,
+			want:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := InAllSets(tt.feature, tt.sets...)
+			require.Equal(t, tt.want, got, "FeatureInAllSets(%v, %v) = %v; want %v", tt.feature, tt.sets, got, tt.want)
+		})
+	}
+}
+
+func TestIntersect(t *testing.T) {
+	t.Parallel()
+
+	const (
+		featA = FeatureResourceConstraintsV1
+		featB = FeatureID(200)
+		featC = FeatureID(201)
+		featD = FeatureID(202)
+	)
+
+	tests := []struct {
+		name string
+		sets []*componentfeaturesv1.ComponentFeatures
+		want []componentfeaturesv1.ComponentFeatureID
+	}{
+		{
+			name: "no sets returns empty set",
+			sets: nil,
+			want: []componentfeaturesv1.ComponentFeatureID{},
+		},
+		{
+			name: "nil set returns empty set",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB), nil, New(featA, featC)},
+			want: []componentfeaturesv1.ComponentFeatureID{},
+		},
+		{
+			name: "disjoint sets return empty set",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB), New(featC, featD)},
+			want: []componentfeaturesv1.ComponentFeatureID{},
+		},
+		{
+			name: "single set returns same set",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto()},
+		},
+		{
+			name: "sets with full intersection",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB, featD), New(featD, featA, featB), New(featB, featD, featA)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto(), featB.ToProto(), featD.ToProto()},
+		},
+		{
+			name: "sets with partial intersection",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB, featC), New(featB, featC, featD), New(featB, featD)},
+			want: []componentfeaturesv1.ComponentFeatureID{featB.ToProto()},
+		},
+		{
+			name: "duplicate features do not affect intersection",
+			sets: []*componentfeaturesv1.ComponentFeatures{New(featA, featB, featB), New(featA, featA, featB, featC), New(featA, featD)},
+			want: []componentfeaturesv1.ComponentFeatureID{featA.ToProto()},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := Intersect(tt.sets...)
+			require.NotNil(t, got, "Intersect should not return nil")
+
+			// Order not guaranteed, so compare as sets.
+			require.ElementsMatch(t, tt.want, got.Features, "Intersect(%v) = %v; want %v", tt.sets, got.Features, tt.want)
+		})
+	}
+}
diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 796133b1401f3..b50398752d465 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -30,7 +30,9 @@ import (
 	"io"
 	"log/slog"
 	"maps"
+	"math"
 	"net"
+	"net/netip"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -51,6 +53,7 @@ import (
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
+	gcputils "github.com/gravitational/teleport/api/utils/gcp"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
 	"github.com/gravitational/teleport/lib/backend"
@@ -63,7 +66,6 @@ import (
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/pam"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -124,7 +126,7 @@ type CommandLineFlags struct {
 	// It's useful for learning Teleport (following quick starts, etc).
 	InsecureMode bool
 
-	// FIPS mode means Teleport starts in a FedRAMP/FIPS 140-2 compliant
+	// FIPS mode means Teleport starts in a FedRAMP/FIPS 140 compliant
 	// configuration.
 	FIPS bool
 
@@ -144,6 +146,9 @@ type CommandLineFlags struct {
 	// AppPublicAddr is the public address of the application to proxy.
 	AppPublicAddr string
 
+	// MCPDemoServer enables the "Teleport Demo" MCP server.
+	MCPDemoServer bool
+
 	// DatabaseName is the name of the database to proxy.
 	DatabaseName string
 	// DatabaseDescription is a free-form database description.
@@ -170,6 +175,8 @@ type CommandLineFlags struct {
 	DatabaseAWSRDSClusterID string
 	// DatabaseAWSElastiCacheGroupID is the ElastiCache replication group identifier.
 	DatabaseAWSElastiCacheGroupID string
+	// DatabaseAWSElastiCacheServerlessCacheName is the ElastiCache Serverless cache name.
+	DatabaseAWSElastiCacheServerlessCacheName string
 	// DatabaseAWSMemoryDBClusterName is the MemoryDB cluster name.
 	DatabaseAWSMemoryDBClusterName string
 	// DatabaseAWSSessionTags is the AWS STS session tags.
@@ -178,6 +185,8 @@ type CommandLineFlags struct {
 	DatabaseGCPProjectID string
 	// DatabaseGCPInstanceID is GCP Cloud SQL instance identifier.
 	DatabaseGCPInstanceID string
+	// DatabaseGCPAlloyDBEndpointType is the AlloyDB database endpoint type to use.
+	DatabaseGCPAlloyDBEndpointType string
 	// DatabaseADKeytabFile is the path to Kerberos keytab file.
 	DatabaseADKeytabFile string
 	// DatabaseADKrb5File is the path to krb5.conf file.
@@ -251,6 +260,10 @@ type CommandLineFlags struct {
 	// `teleport integration configure samlidp gcp-workforce` command
 	IntegrationConfSAMLIdPGCPWorkforceArguments samlidpconfig.GCPWorkforceAPIParams
 
+	// IntegrationConfAWSRATrustAnchorArguments contains the arguments of
+	// `teleport integration configure awsra-trust-anchor` command
+	IntegrationConfAWSRATrustAnchorArguments IntegrationConfAWSRATrustAnchor
+
 	// LogLevel is the new application's log level.
 	LogLevel string
 
@@ -270,6 +283,13 @@ type CommandLineFlags struct {
 	// is not set to enforcing mode or the global SELinux mode is not set to
 	// enforcing.
 	EnsureSELinuxEnforcing bool
+
+	// BackendKey is the backend key to use for various `teleport backend` commands.
+	BackendKey string
+	// BackendPrefix limits `teleport backend ls` to only output keys matching the prefix.
+	BackendPrefix string
+	// Format is used to change the format of output.
+	Format string
 }
 
 // IntegrationConfAccessGraphAWSSync contains the arguments of
@@ -281,6 +301,14 @@ type IntegrationConfAccessGraphAWSSync struct {
 	AccountID string
 	// AutoConfirm skips user confirmation of the operation plan if true.
 	AutoConfirm bool
+	// SQSQueueURL is the URL of the SQS queue to use for the Identity Security Activity Center.
+	SQSQueueURL string
+	// CloudTrailBucketARN is the name of the S3 bucket to use for the Identity Security Activity Center.
+	CloudTrailBucketARN string
+	// KMSKeyARNs is the ARN of the KMS key to use for decrypting the Identity Security Activity Center data.
+	KMSKeyARNs []string
+	// EnableEKSAuditLogs enables collection of EKS audit logs from CloudWatch logs.
+	EnableEKSAuditLogs bool
 }
 
 // IntegrationConfAccessGraphAzureSync contains the arguments of
@@ -403,6 +431,25 @@ type IntegrationConfAWSOIDCIdP struct {
 	PolicyPreset string
 }
 
+// IntegrationConfAWSRATrustAnchor contains the arguments of
+// `teleport integration configure awsra-trust-anchor` command
+type IntegrationConfAWSRATrustAnchor struct {
+	// Cluster is the teleport cluster name.
+	Cluster string
+	// Name is the integration name.
+	Name string
+	// TrustAnchor is the AWS IAM Roles Anywhere Trust Anchor name to create.
+	TrustAnchor string
+	// TrustAnchorCertBase64 is trust anchor certificate, encoded in base64.
+	TrustAnchorCertBase64 string
+	// SyncProfile is the AWS IAM Roles Anywhere Profile name to create, that will be used to sync profiles as entry points for AWS Access.
+	SyncProfile string
+	// SyncRole is the AWS IAM Role name to create, that will be used to sync profiles as entry points for AWS Access.
+	SyncRole string
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
+}
+
 // IntegrationConfListDatabasesIAM contains the arguments of
 // `teleport integration configure listdatabases-iam` command
 type IntegrationConfListDatabasesIAM struct {
@@ -534,6 +581,15 @@ func ApplyFileConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		return trace.Wrap(err)
 	}
 
+	if fc.RelayServer != "" {
+		addr, err := utils.ParseHostPortAddr(fc.RelayServer, -1)
+		if err != nil {
+			return trace.Wrap(err, "parsing teleport.relay_server")
+		}
+
+		cfg.RelayServer = addr.Addr
+	}
+
 	if err := applyTokenConfig(fc, cfg); err != nil {
 		return trace.Wrap(err)
 	}
@@ -587,6 +643,14 @@ func ApplyFileConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 	cfg.CachePolicy = *cachePolicy
 
+	authConnectionConfig, err := fc.AuthConnectionConfig.Parse()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	cfg.AuthConnectionConfig = *authConnectionConfig
+
+	cfg.ShutdownDelay = time.Duration(fc.ShutdownDelay)
+
 	// Apply (TLS) cipher suites and (SSH) ciphers, KEX algorithms, and MAC
 	// algorithms.
 	if len(fc.CipherSuites) > 0 {
@@ -717,6 +781,12 @@ func ApplyFileConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 	}
 
+	if fc.Relay.Enabled {
+		if err := applyRelayConfig(fc, cfg); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
 	return nil
 }
 
@@ -791,20 +861,17 @@ func applyAuthOrProxyAddress(fc *FileConfig, cfg *servicecfg.Config) error {
 }
 
 func applyLogConfig(loggerConfig Log, cfg *servicecfg.Config) error {
-	logger, level, err := logutils.Initialize(logutils.Config{
+	cfg.LogConfig = logutils.Config{
 		Output:       loggerConfig.Output,
 		Severity:     loggerConfig.Severity,
 		Format:       loggerConfig.Format.Output,
 		ExtraFields:  loggerConfig.Format.ExtraFields,
 		EnableColors: utils.IsTerminal(os.Stderr),
-	})
-	if err != nil {
-		return trace.Wrap(err)
 	}
 
-	cfg.Logger = logger
-	cfg.LoggerLevel = level
-	return nil
+	var err error
+	cfg.Logger, cfg.LoggerLevel, cfg.LogWriter, err = logutils.Initialize(cfg.LogConfig)
+	return trace.Wrap(err)
 }
 
 // applyAuthConfig applies file configuration for the "auth_service" section.
@@ -916,10 +983,24 @@ func applyAuthConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	// Only override session recording configuration if either field is
 	// specified in file configuration.
 	if fc.Auth.hasCustomSessionRecording() {
-		cfg.Auth.SessionRecordingConfig, err = types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		src := types.SessionRecordingConfigSpecV2{
 			Mode:                fc.Auth.SessionRecording,
 			ProxyChecksHostKeys: fc.Auth.ProxyChecksHostKeys,
-		})
+		}
+
+		if fc.Auth.SessionRecordingConfig != nil {
+			if src.Mode != "" {
+				return trace.BadParameter("cannot set both session_recording and session_recording_config at the same time, prefer session_recording_config.mode")
+			}
+
+			if src.ProxyChecksHostKeys != nil {
+				return trace.BadParameter("cannot set both proxy_checks_host_keys and session_recording_config at the same time, prefer session_recording_config.proxy_checks_host_keys")
+			}
+
+			src = fc.Auth.SessionRecordingConfig.toSpec()
+		}
+
+		cfg.Auth.SessionRecordingConfig, err = types.NewSessionRecordingConfigFromConfigFile(src)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1423,24 +1504,6 @@ func applySSHConfig(fc *FileConfig, cfg *servicecfg.Config) (err error) {
 	}
 	if fc.SSH.PAM != nil {
 		cfg.SSH.PAM = fc.SSH.PAM.Parse()
-
-		// If PAM is enabled, make sure that Teleport was built with PAM support
-		// and the PAM library was found at runtime.
-		if cfg.SSH.PAM.Enabled {
-			if !pam.BuildHasPAM() {
-				const errorMessage = "Unable to start Teleport: PAM was enabled in file configuration but this \n" +
-					"Teleport binary was built without PAM support. To continue either download a \n" +
-					"Teleport binary build with PAM support from https://goteleport.com/teleport \n" +
-					"or disable PAM in file configuration."
-				return trace.BadParameter("%s", errorMessage)
-			}
-			if !pam.SystemHasPAM() {
-				const errorMessage = "Unable to start Teleport: PAM was enabled in file configuration but this \n" +
-					"system does not have the needed PAM library installed. To continue either \n" +
-					"install libpam or disable PAM in file configuration."
-				return trace.BadParameter("%s", errorMessage)
-			}
-		}
 	}
 	if len(fc.SSH.PublicAddr) != 0 {
 		addrs, err := utils.AddrsFromStrings(fc.SSH.PublicAddr, defaults.SSHServerListenPort)
@@ -1472,11 +1535,7 @@ func applySSHConfig(fc *FileConfig, cfg *servicecfg.Config) (err error) {
 
 // getInstallerProxyAddr determines the address of the proxy for discovered
 // nodes to connect to.
-func getInstallerProxyAddr(installParams *InstallParams, fc *FileConfig) string {
-	// Explicit proxy address.
-	if installParams != nil && installParams.PublicProxyAddr != "" {
-		return installParams.PublicProxyAddr
-	}
+func getInstallerProxyAddr(fc *FileConfig) string {
 	// Proxy address from config.
 	if fc.ProxyServer != "" {
 		return fc.ProxyServer
@@ -1496,11 +1555,14 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	cfg.Discovery.Enabled = fc.Discovery.Enabled()
 	cfg.Discovery.DiscoveryGroup = fc.Discovery.DiscoveryGroup
 	cfg.Discovery.PollInterval = fc.Discovery.PollInterval
+
+	defaultProxyAddr := getInstallerProxyAddr(fc)
+
 	for _, matcher := range fc.Discovery.AWSMatchers {
 		var err error
 		var installParams *types.InstallerParams
 		if matcher.InstallParams != nil {
-			installParams, err = matcher.InstallParams.parse()
+			installParams, err = matcher.InstallParams.parse(defaultProxyAddr)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -1515,6 +1577,10 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 
 		for _, region := range matcher.Regions {
+			if region == types.Wildcard {
+				continue
+			}
+
 			if !awsregion.IsKnownRegion(region) {
 				const message = "AWS matcher uses unknown region" +
 					"This is either a typo or a new AWS region that is unknown to the AWS SDK used to compile this binary. "
@@ -1544,21 +1610,27 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 
 	for _, matcher := range fc.Discovery.AzureMatchers {
-		var installerParams *types.InstallerParams
+		var installParams *types.InstallerParams
+		var err error
 		if slices.Contains(matcher.Types, types.AzureMatcherVM) {
-			installerParams = &types.InstallerParams{
-				PublicProxyAddr: getInstallerProxyAddr(matcher.InstallParams, fc),
+			// Backwards compatibility for Azure VM matcher:
+			// If install_teleport param is not set, default to false.
+			if matcher.InstallParams == nil {
+				installParams = &types.InstallerParams{
+					PublicProxyAddr: defaultProxyAddr,
+				}
 			}
+
 			if matcher.InstallParams != nil {
-				installerParams.JoinMethod = matcher.InstallParams.JoinParams.Method
-				installerParams.JoinToken = matcher.InstallParams.JoinParams.TokenName
-				installerParams.ScriptName = matcher.InstallParams.ScriptName
-				if matcher.InstallParams.Azure != nil {
-					installerParams.Azure = &types.AzureInstallerParams{
-						ClientID: matcher.InstallParams.Azure.ClientID,
-					}
+				installParams, err = matcher.InstallParams.parse(defaultProxyAddr)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				if matcher.InstallParams.InstallTeleport == "" {
+					installParams.InstallTeleport = false
 				}
 			}
+
 		}
 
 		serviceMatcher := types.AzureMatcher{
@@ -1567,7 +1639,8 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			Types:          matcher.Types,
 			Regions:        matcher.Regions,
 			ResourceTags:   matcher.ResourceTags,
-			Params:         installerParams,
+			Integration:    matcher.Integration,
+			Params:         installParams,
 		}
 		if err := serviceMatcher.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
@@ -1577,15 +1650,24 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 
 	for _, matcher := range fc.Discovery.GCPMatchers {
-		var installerParams *types.InstallerParams
-		if slices.Contains(matcher.Types, types.GCPMatcherCompute) {
-			installerParams = &types.InstallerParams{
-				PublicProxyAddr: getInstallerProxyAddr(matcher.InstallParams, fc),
+		var installParams *types.InstallerParams
+		var err error
+		if slices.Contains(matcher.Types, types.GCPMatcherCompute) { // Backwards compatibility for GCP VM matcher:
+			// If install_teleport param is not set, default to false.
+			if matcher.InstallParams == nil {
+				installParams = &types.InstallerParams{
+					PublicProxyAddr: defaultProxyAddr,
+				}
 			}
+
 			if matcher.InstallParams != nil {
-				installerParams.JoinMethod = matcher.InstallParams.JoinParams.Method
-				installerParams.JoinToken = matcher.InstallParams.JoinParams.TokenName
-				installerParams.ScriptName = matcher.InstallParams.ScriptName
+				installParams, err = matcher.InstallParams.parse(defaultProxyAddr)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				if matcher.InstallParams.InstallTeleport == "" {
+					installParams.InstallTeleport = false
+				}
 			}
 		}
 
@@ -1596,7 +1678,7 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			Tags:            matcher.Tags,
 			ProjectIDs:      matcher.ProjectIDs,
 			ServiceAccounts: matcher.ServiceAccounts,
-			Params:          installerParams,
+			Params:          installParams,
 		}
 		if err := serviceMatcher.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
@@ -1646,11 +1728,18 @@ kubernetes matchers are present`)
 					Region:   awsMatcher.CloudTrailLogs.QueueRegion,
 				}
 			}
+			var eksAuditLogs *types.AccessGraphAWSSyncEKSAuditLogs
+			if awsMatcher.EKSAuditLogs != nil {
+				eksAuditLogs = &types.AccessGraphAWSSyncEKSAuditLogs{
+					Tags: awsMatcher.EKSAuditLogs.Tags,
+				}
+			}
 
 			tMatcher.AWS = append(tMatcher.AWS, &types.AccessGraphAWSSync{
 				Regions:        regions,
 				AssumeRole:     assumeRole,
 				CloudTrailLogs: cloudTrailLogs,
+				EksAuditLogs:   eksAuditLogs,
 			})
 		}
 		for _, azureMatcher := range fc.Discovery.AccessGraph.Azure {
@@ -1753,6 +1842,7 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 				Types:          matcher.Types,
 				Regions:        matcher.Regions,
 				ResourceTags:   matcher.ResourceTags,
+				Integration:    matcher.Integration,
 			})
 	}
 	for _, database := range fc.Databases.Databases {
@@ -1776,6 +1866,10 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			return trace.Wrap(err)
 		}
 
+		if err = gcputils.ValidateAlloyDBEndpointType(database.GCP.AlloyDB.EndpointType); err != nil {
+			return trace.Wrap(err)
+		}
+
 		db := servicecfg.Database{
 			Name:          database.Name,
 			Description:   database.Description,
@@ -1817,6 +1911,9 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 				ElastiCache: servicecfg.DatabaseAWSElastiCache{
 					ReplicationGroupID: database.AWS.ElastiCache.ReplicationGroupID,
 				},
+				ElastiCacheServerless: servicecfg.DatabaseAWSElastiCacheServerless{
+					CacheName: database.AWS.ElastiCacheServerless.CacheName,
+				},
 				MemoryDB: servicecfg.DatabaseAWSMemoryDB{
 					ClusterName: database.AWS.MemoryDB.ClusterName,
 				},
@@ -1828,6 +1925,10 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			GCP: servicecfg.DatabaseGCP{
 				ProjectID:  database.GCP.ProjectID,
 				InstanceID: database.GCP.InstanceID,
+				AlloyDB: servicecfg.DatabaseGCPAlloyDB{
+					EndpointType:     database.GCP.AlloyDB.EndpointType,
+					EndpointOverride: database.GCP.AlloyDB.EndpointOverride,
+				},
 			},
 			AD: servicecfg.DatabaseAD{
 				KeytabFile:             database.AD.KeytabFile,
@@ -1854,7 +1955,9 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 
 func convOracleOptions(o DatabaseOracle) servicecfg.OracleOptions {
 	return servicecfg.OracleOptions{
-		AuditUser: o.AuditUser,
+		AuditUser:        o.AuditUser,
+		RetryCount:       o.RetryCount,
+		ShuffleHostnames: o.ShuffleHostnames,
 	}
 }
 
@@ -1901,6 +2004,9 @@ func applyAppsConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	// Enable debugging application if requested.
 	cfg.Apps.DebugApp = fc.Apps.DebugApp
 
+	// Enable the "Teleport Demo" MCP server if requested.
+	cfg.Apps.MCPDemoServer = fc.Apps.MCPDemoServer
+
 	// Configure resource watcher selectors if present.
 	for _, matcher := range fc.Apps.ResourceMatchers {
 		if matcher.AWS.AssumeRoleARN != "" {
@@ -1985,6 +2091,14 @@ func applyAppsConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			}
 		}
 
+		if application.MCP != nil {
+			app.MCP = &types.MCP{
+				Command:       application.MCP.Command,
+				Args:          application.MCP.Args,
+				RunAsHostUser: application.MCP.RunAsHostUser,
+			}
+		}
+
 		if err := app.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
 		}
@@ -2111,7 +2225,7 @@ func applyWindowsDesktopConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	cfg.WindowsDesktop.Discovery = make([]servicecfg.LDAPDiscoveryConfig, 0, len(fc.WindowsDesktop.DiscoveryConfigs))
 	for _, dc := range fc.WindowsDesktop.DiscoveryConfigs {
 		if dc.BaseDN == "" {
-			return trace.BadParameter("WindowsDesktopService discovey_config is missing required base_dn")
+			return trace.BadParameter("WindowsDesktopService discovery_config is missing required base_dn")
 		}
 		cfg.WindowsDesktop.Discovery = append(cfg.WindowsDesktop.Discovery,
 			servicecfg.LDAPDiscoveryConfig{
@@ -2128,6 +2242,11 @@ func applyWindowsDesktopConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		return trace.BadParameter("desktop discovery interval must not be negative (%v)", fc.WindowsDesktop.DiscoveryInterval.String())
 	}
 
+	cfg.WindowsDesktop.PublishCRLInterval = fc.WindowsDesktop.PublishCRLInterval
+	if cfg.WindowsDesktop.PublishCRLInterval < 0 {
+		return trace.BadParameter("publish CRL interval must not be negative (%v)", fc.WindowsDesktop.PublishCRLInterval.String())
+	}
+
 	var err error
 	cfg.WindowsDesktop.PublicAddrs, err = utils.AddrsFromStrings(fc.WindowsDesktop.PublicAddr, defaults.WindowsDesktopListenPort)
 	if err != nil {
@@ -2168,6 +2287,11 @@ func applyWindowsDesktopConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 	}
 
+	locateServer := servicecfg.LocateServer{
+		Enabled: fc.WindowsDesktop.LDAP.LocateServer.Enabled,
+		Site:    fc.WindowsDesktop.LDAP.LocateServer.Site,
+	}
+
 	cfg.WindowsDesktop.LDAP = servicecfg.LDAPConfig{
 		Addr:               fc.WindowsDesktop.LDAP.Addr,
 		Username:           fc.WindowsDesktop.LDAP.Username,
@@ -2176,6 +2300,7 @@ func applyWindowsDesktopConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		InsecureSkipVerify: fc.WindowsDesktop.LDAP.InsecureSkipVerify,
 		ServerName:         fc.WindowsDesktop.LDAP.ServerName,
 		CA:                 cert,
+		LocateServer:       locateServer,
 	}
 
 	cfg.WindowsDesktop.PKIDomain = fc.WindowsDesktop.PKIDomain
@@ -2369,7 +2494,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 	// If this process is trying to join a cluster as an application service,
 	// make sure application name and URI are provided.
 	if slices.Contains(splitRoles(clf.Roles), defaults.RoleApp) {
-		if (clf.AppName == "") && (clf.AppURI == "" && clf.AppCloud == "") {
+		if (clf.AppName == "") && (clf.AppURI == "" && clf.AppCloud == "" && !clf.MCPDemoServer) {
 			// TODO: remove legacyAppFlags once `teleport start --app-name` is removed.
 			if legacyAppFlags {
 				return trace.BadParameter("application name (--app-name) and URI (--app-uri) flags are both required to join application proxy to the cluster")
@@ -2377,14 +2502,14 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 			return trace.BadParameter("to join application proxy to the cluster provide application name (--name) and either URI (--uri) or Cloud type (--cloud)")
 		}
 
-		if clf.AppName == "" {
+		if clf.AppName == "" && !clf.MCPDemoServer {
 			if legacyAppFlags {
 				return trace.BadParameter("application name (--app-name) is required to join application proxy to the cluster")
 			}
 			return trace.BadParameter("to join application proxy to the cluster provide application name (--name)")
 		}
 
-		if clf.AppURI == "" && clf.AppCloud == "" {
+		if clf.AppName != "" && clf.AppURI == "" && clf.AppCloud == "" {
 			if legacyAppFlags {
 				return trace.BadParameter("URI (--app-uri) flag is required to join application proxy to the cluster")
 			}
@@ -2392,6 +2517,13 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 		}
 	}
 
+	// Enable the "Teleport Demo" MCP server if requested. Make sure application
+	// service is enabled for proxying MCP servers.
+	if clf.MCPDemoServer {
+		cfg.Apps.MCPDemoServer = true
+		cfg.Apps.Enabled = true
+	}
+
 	// If application name was specified on command line, add to file
 	// configuration where it will be validated.
 	if clf.AppName != "" {
@@ -2440,6 +2572,11 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 				return trace.Wrap(err)
 			}
 		}
+
+		if err = gcputils.ValidateAlloyDBEndpointType(clf.DatabaseGCPAlloyDBEndpointType); err != nil {
+			return trace.Wrap(err)
+		}
+
 		db := servicecfg.Database{
 			Name:         clf.DatabaseName,
 			Description:  clf.DatabaseDescription,
@@ -2469,6 +2606,9 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 				ElastiCache: servicecfg.DatabaseAWSElastiCache{
 					ReplicationGroupID: clf.DatabaseAWSElastiCacheGroupID,
 				},
+				ElastiCacheServerless: servicecfg.DatabaseAWSElastiCacheServerless{
+					CacheName: clf.DatabaseAWSElastiCacheServerlessCacheName,
+				},
 				MemoryDB: servicecfg.DatabaseAWSMemoryDB{
 					ClusterName: clf.DatabaseAWSMemoryDBClusterName,
 				},
@@ -2476,6 +2616,9 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 			GCP: servicecfg.DatabaseGCP{
 				ProjectID:  clf.DatabaseGCPProjectID,
 				InstanceID: clf.DatabaseGCPInstanceID,
+				AlloyDB: servicecfg.DatabaseGCPAlloyDB{
+					EndpointType: clf.DatabaseGCPAlloyDBEndpointType,
+				},
 			},
 			AD: servicecfg.DatabaseAD{
 				KeytabFile: clf.DatabaseADKeytabFile,
@@ -2494,8 +2637,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 		return trace.Wrap(err)
 	}
 
-	// If FIPS mode is specified, validate Teleport configuration is FedRAMP/FIPS
-	// 140-2 compliant.
+	// If FIPS mode is specified, validate Teleport uses a FIPS-validated module
 	if clf.FIPS {
 		// Make sure all cryptographic primitives are FIPS compliant.
 		err = utils.UintSliceSubset(defaults.FIPSCipherSuites, cfg.CipherSuites)
@@ -2515,10 +2657,10 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 			return trace.BadParameter("non-FIPS compliant SSH mac algorithm selected: %v", err)
 		}
 
-		// Make sure cluster settings are also FedRAMP/FIPS 140-2 compliant.
+		// Make sure cluster settings are also FedRAMP/FIPS compliant.
 		if cfg.Auth.Enabled {
 			// Only SSO based authentication is supported. The SSO provider is where
-			// any FedRAMP/FIPS 140-2 compliance (like password complexity) should be
+			// any FedRAMP/FIPS compliance (like password complexity) should be
 			// enforced.
 			if cfg.Auth.Preference.GetAllowLocalAuth() {
 				return trace.BadParameter("non-FIPS compliant authentication setting: \"local_auth\" must be false")
@@ -2531,6 +2673,10 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 				!cfg.Auth.SessionRecordingConfig.GetProxyChecksHostKeys() {
 				return trace.BadParameter("non-FIPS compliant proxy settings: \"proxy_checks_host_keys\" must be true")
 			}
+
+			if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, modules.GetModules().Features().Cloud); err != nil {
+				return trace.Wrap(err)
+			}
 		}
 	}
 
@@ -2997,3 +3143,68 @@ func applyJamfConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 	return nil
 }
+
+func applyRelayConfig(fc *FileConfig, cfg *servicecfg.Config) error {
+	// TODO(espadolini): potential compatibility checks here like requiring
+	// config v3+ and proxy_server
+
+	// we're here because fc.Relay.Enabled is true
+	cfg.Relay.Enabled = true
+
+	if fc.Relay.RelayGroup == "" {
+		return trace.BadParameter("missing relay_service.relay_group")
+	}
+	cfg.Relay.RelayGroup = fc.Relay.RelayGroup
+
+	if fc.Relay.TargetConnectionCount < 1 || fc.Relay.TargetConnectionCount > math.MaxInt32 {
+		return trace.BadParameter("missing or invalid relay_service.target_connection_count")
+	}
+	cfg.Relay.TargetConnectionCount = int32(fc.Relay.TargetConnectionCount)
+
+	if len(fc.Relay.PublicHostnames) < 1 {
+		return trace.BadParameter("missing relay_service.public_hostnames")
+	}
+	if slices.Contains(fc.Relay.PublicHostnames, "") {
+		return trace.BadParameter("empty string in relay_service.public_hostnames")
+	}
+	cfg.Relay.PublicHostnames = slices.Clone(fc.Relay.PublicHostnames)
+
+	if fc.Relay.TransportListenAddr == "" {
+		return trace.BadParameter("missing relay_service.transport_listen_addr")
+	}
+	transportListenAddr, err := netip.ParseAddrPort(fc.Relay.TransportListenAddr)
+	if err != nil {
+		return trace.Wrap(err, "parsing relay_service.transport_listen_addr")
+	}
+	cfg.Relay.TransportListenAddr = transportListenAddr
+	cfg.Relay.TransportPROXYProtocol = fc.Relay.TransportPROXYProtocol
+
+	if fc.Relay.PeerListenAddr == "" {
+		return trace.BadParameter("missing relay_service.peer_listen_addr")
+	}
+	peerListenAddr, err := netip.ParseAddrPort(fc.Relay.PeerListenAddr)
+	if err != nil {
+		return trace.Wrap(err, "parsing relay_service.peer_listen_addr")
+	}
+	cfg.Relay.PeerListenAddr = peerListenAddr
+
+	if fc.Relay.PeerPublicAddr != "" {
+		_, _, err := net.SplitHostPort(fc.Relay.PeerPublicAddr)
+		if err != nil {
+			return trace.Wrap(err, "parsing relay_service.peer_public_addr")
+		}
+		cfg.Relay.PeerPublicAddr = fc.Relay.PeerPublicAddr
+	}
+
+	if fc.Relay.TunnelListenAddr == "" {
+		return trace.BadParameter("missing relay_service.tunnel_listen_addr")
+	}
+	tunnelListenAddr, err := netip.ParseAddrPort(fc.Relay.TunnelListenAddr)
+	if err != nil {
+		return trace.Wrap(err, "parsing relay_service.tunnel_listen_addr")
+	}
+	cfg.Relay.TunnelListenAddr = tunnelListenAddr
+	cfg.Relay.TunnelPROXYProtocol = fc.Relay.TunnelPROXYProtocol
+
+	return nil
+}
diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go
index 8fe75d02d0e7e..267f9b6b5dd84 100644
--- a/lib/config/configuration_test.go
+++ b/lib/config/configuration_test.go
@@ -52,10 +52,12 @@ import (
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type testConfigFiles struct {
@@ -102,7 +104,7 @@ func (tc testConfigFiles) cleanup() {
 }
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	if err := writeTestConfigs(); err != nil {
 		testConfigs.cleanup()
@@ -385,6 +387,7 @@ func TestConfigReading(t *testing.T) {
 					},
 					ResourceGroups: []string{"group1"},
 					Subscriptions:  []string{"sub1"},
+					Integration:    "integration1",
 				},
 			},
 			GCPMatchers: []GCPMatcher{
@@ -446,6 +449,15 @@ func TestConfigReading(t *testing.T) {
 					StaticLabels:  Labels,
 					DynamicLabels: CommandLabels,
 				},
+				{
+					Name:         "mcp-everything",
+					StaticLabels: Labels,
+					MCP: &MCP{
+						Command:       "docker",
+						RunAsHostUser: "docker",
+						Args:          []string{"run", "-i", "--rm", "mcp/everything"},
+					},
+				},
 			},
 			ResourceMatchers: []ResourceMatcher{
 				{
@@ -509,6 +521,7 @@ func TestConfigReading(t *testing.T) {
 					ResourceGroups: []string{"rg1", "rg2"},
 					Types:          []string{"mysql"},
 					Regions:        []string{"eastus", "westus"},
+					Integration:    "integration1",
 					ResourceTags: map[string]apiutils.Strings{
 						"a": {"b"},
 					},
@@ -784,6 +797,8 @@ func TestApplyConfig(t *testing.T) {
 
 	require.Equal(t, "tcp://127.0.0.1:3000", cfg.DiagnosticAddr.FullAddress())
 
+	require.Equal(t, 7*time.Minute+35*time.Second, cfg.ShutdownDelay)
+
 	u2fCAFromFile, err := os.ReadFile("testdata/u2f_attestation_ca.pem")
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(cfg.Auth.Preference, &types.AuthPreferenceV2{
@@ -865,6 +880,7 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 				ResourceGroups: []string{"group1", "group2"},
 				Types:          []string{"postgres", "mysql"},
 				Regions:        []string{"eastus", "centralus"},
+				Integration:    "integration123",
 				ResourceTags: map[string]apiutils.Strings{
 					"a": {"b"},
 				},
@@ -1408,6 +1424,8 @@ func checkStaticConfig(t *testing.T, conf *FileConfig) {
 	require.Equal(t, "10.10.10.1:3022", conf.AdvertiseIP)
 	require.Equal(t, "/var/run/teleport.pid", conf.PIDFile)
 
+	require.Zero(t, conf.ShutdownDelay)
+
 	require.Empty(t, cmp.Diff(conf.Limits, ConnectionLimits{
 		MaxConnections: 90,
 		MaxUsers:       91,
@@ -1587,6 +1605,7 @@ func makeConfigFixture() string {
 			},
 			ResourceGroups: []string{"group1"},
 			Subscriptions:  []string{"sub1"},
+			Integration:    "integration1",
 		},
 	}
 
@@ -1643,6 +1662,15 @@ func makeConfigFixture() string {
 			StaticLabels:  Labels,
 			DynamicLabels: CommandLabels,
 		},
+		{
+			Name:         "mcp-everything",
+			StaticLabels: Labels,
+			MCP: &MCP{
+				Command:       "docker",
+				Args:          []string{"run", "-i", "--rm", "mcp/everything"},
+				RunAsHostUser: "docker",
+			},
+		},
 	}
 	conf.Apps.ResourceMatchers = []ResourceMatcher{
 		{
@@ -1697,6 +1725,7 @@ func makeConfigFixture() string {
 			ResourceTags: map[string]apiutils.Strings{
 				"a": {"b"},
 			},
+			Integration: "integration1",
 		},
 		{
 			Subscriptions:  []string{"sub3", "sub4"},
@@ -1996,7 +2025,7 @@ func TestLicenseFileNoConfig(t *testing.T) {
 }
 
 // TestFIPS makes sure configuration is correctly updated/enforced when in
-// FedRAMP/FIPS 140-2 mode.
+// FedRAMP/FIPS mode.
 func TestFIPS(t *testing.T) {
 	tests := []struct {
 		inConfigString string
@@ -2285,7 +2314,8 @@ func TestWindowsDesktopService(t *testing.T) {
 			mutate: func(fc *FileConfig) {
 				fc.WindowsDesktop.ADHosts = []string{"127.0.0.1:3389"}
 				fc.WindowsDesktop.LDAP = LDAPConfig{
-					Addr: "something",
+					Addr:   "something",
+					Domain: "example.com",
 				}
 			},
 		},
@@ -2329,7 +2359,8 @@ func TestWindowsDesktopService(t *testing.T) {
 					BaseDN: "something",
 				}
 				fc.WindowsDesktop.LDAP = LDAPConfig{
-					Addr: "something",
+					Addr:   "something",
+					Domain: "example.com",
 				}
 			},
 		},
@@ -2381,7 +2412,8 @@ func TestWindowsDesktopService(t *testing.T) {
 				fc.WindowsDesktop.ListenAddress = "0.0.0.0:3028"
 				fc.WindowsDesktop.ADHosts = []string{"127.0.0.1:3389"}
 				fc.WindowsDesktop.LDAP = LDAPConfig{
-					Addr: "something",
+					Addr:   "something",
+					Domain: "example.com",
 				}
 				fc.WindowsDesktop.HostLabels = []WindowsHostLabelRule{
 					{Match: ".*", Labels: map[string]string{"key": "value"}},
@@ -2554,7 +2586,10 @@ func TestAppsCLF(t *testing.T) {
 		inAppURI         string
 		inAppCloud       string
 		inLegacyAppFlags bool
+		inMCPDemoServer  bool
+
 		outApps          []servicecfg.App
+		outMCPDemoServer bool
 		requireError     require.ErrorAssertionFunc
 	}{
 		{
@@ -2689,20 +2724,32 @@ func TestAppsCLF(t *testing.T) {
 				require.ErrorContains(t, err, "missing application \"foo\" URI")
 			},
 		},
+		{
+			desc:             "mcp demo server",
+			inRoles:          defaults.RoleApp,
+			inAppName:        "",
+			inAppURI:         "",
+			inMCPDemoServer:  true,
+			outApps:          nil,
+			outMCPDemoServer: true,
+			requireError:     require.NoError,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			clf := CommandLineFlags{
-				Roles:    tt.inRoles,
-				AppName:  tt.inAppName,
-				AppURI:   tt.inAppURI,
-				AppCloud: tt.inAppCloud,
+				Roles:         tt.inRoles,
+				AppName:       tt.inAppName,
+				AppURI:        tt.inAppURI,
+				AppCloud:      tt.inAppCloud,
+				MCPDemoServer: tt.inMCPDemoServer,
 			}
 			cfg := servicecfg.MakeDefaultConfig()
 			err := Configure(&clf, cfg, tt.inLegacyAppFlags)
 			tt.requireError(t, err)
 			require.Equal(t, tt.outApps, cfg.Apps.Apps)
+			require.Equal(t, tt.outMCPDemoServer, cfg.Apps.MCPDemoServer)
 		})
 	}
 }
@@ -2918,6 +2965,46 @@ func TestDatabaseCLIFlags(t *testing.T) {
 				DynamicLabels: services.CommandLabels{},
 			},
 		},
+		{
+			desc: "AlloyDB database",
+			inFlags: CommandLineFlags{
+				DatabaseName:     "alloydb",
+				DatabaseProtocol: defaults.ProtocolPostgres,
+				DatabaseURI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			outDatabase: servicecfg.Database{
+				Name:     "alloydb",
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				StaticLabels: map[string]string{
+					types.OriginLabel: types.OriginConfigFile,
+				},
+				DynamicLabels: services.CommandLabels{},
+			},
+		},
+		{
+			desc: "AlloyDB database with public endpoint type",
+			inFlags: CommandLineFlags{
+				DatabaseName:                   "alloydb",
+				DatabaseProtocol:               defaults.ProtocolPostgres,
+				DatabaseURI:                    "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				DatabaseGCPAlloyDBEndpointType: "public",
+			},
+			outDatabase: servicecfg.Database{
+				Name:     "alloydb",
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+				StaticLabels: map[string]string{
+					types.OriginLabel: types.OriginConfigFile,
+				},
+				DynamicLabels: services.CommandLabels{},
+				GCP: servicecfg.DatabaseGCP{
+					AlloyDB: servicecfg.DatabaseGCPAlloyDB{
+						EndpointType: "public",
+					},
+				},
+			},
+		},
 		{
 			desc: "SQL Server",
 			inFlags: CommandLineFlags{
@@ -3817,7 +3904,9 @@ func TestApplyDiscoveryConfig(t *testing.T) {
 							Azure: &AzureInstallParams{
 								ClientID: "abcd1234",
 							},
+							Suffix: "blue",
 						},
+						Integration: "integration123",
 					},
 				},
 			},
@@ -3835,9 +3924,11 @@ func TestApplyDiscoveryConfig(t *testing.T) {
 							Azure: &types.AzureInstallerParams{
 								ClientID: "abcd1234",
 							},
+							Suffix: "blue",
 						},
 						Regions:        []string{"*"},
 						ResourceTags:   types.Labels{"*": []string{"*"}},
+						Integration:    "integration123",
 						ResourceGroups: []string{"*"},
 					},
 				},
@@ -4285,7 +4376,6 @@ func TestGetInstallerProxyAddr(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name              string
-		installParams     *InstallParams
 		fc                *FileConfig
 		expectedProxyAddr string
 	}{
@@ -4294,18 +4384,6 @@ func TestGetInstallerProxyAddr(t *testing.T) {
 			fc:                &FileConfig{},
 			expectedProxyAddr: "",
 		},
-		{
-			name: "explicit proxy addr",
-			installParams: &InstallParams{
-				PublicProxyAddr: "explicit.example.com",
-			},
-			fc: &FileConfig{
-				Global: Global{
-					ProxyServer: "proxy.example.com",
-				},
-			},
-			expectedProxyAddr: "explicit.example.com",
-		},
 		{
 			name: "proxy server",
 			fc: &FileConfig{
@@ -4352,7 +4430,7 @@ func TestGetInstallerProxyAddr(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.expectedProxyAddr, getInstallerProxyAddr(tc.installParams, tc.fc))
+			assert.Equal(t, tc.expectedProxyAddr, getInstallerProxyAddr(tc.fc))
 		})
 	}
 }
@@ -4558,8 +4636,9 @@ func TestDiscoveryConfig(t *testing.T) {
 				cfg["discovery_service"].(cfgMap)["enabled"] = "yes"
 				cfg["discovery_service"].(cfgMap)["azure"] = []cfgMap{
 					{
-						"types":   []string{"aks"},
-						"regions": []string{"eucentral1"},
+						"types":       []string{"aks"},
+						"regions":     []string{"eucentral1"},
+						"integration": "integration1",
 						"tags": cfgMap{
 							"discover_teleport": "yes",
 						},
@@ -4569,8 +4648,9 @@ func TestDiscoveryConfig(t *testing.T) {
 				}
 			},
 			expectedAzureMatchers: []types.AzureMatcher{{
-				Types:   []string{"aks"},
-				Regions: []string{"eucentral1"},
+				Types:       []string{"aks"},
+				Regions:     []string{"eucentral1"},
+				Integration: "integration1",
 				ResourceTags: map[string]apiutils.Strings{
 					"discover_teleport": []string{"yes"},
 				},
@@ -4669,6 +4749,7 @@ func TestDiscoveryConfig(t *testing.T) {
 								"method":     "iam",
 							},
 							"script_name": "installer-custom",
+							"suffix":      "blue",
 						},
 						"ssm": cfgMap{
 							"document_name": "hello_document",
@@ -4691,6 +4772,7 @@ func TestDiscoveryConfig(t *testing.T) {
 					ScriptName:      "installer-custom",
 					InstallTeleport: true,
 					EnrollMode:      types.InstallParamEnrollMode_INSTALL_PARAM_ENROLL_MODE_SCRIPT,
+					Suffix:          "blue",
 				},
 				SSM: &types.AWSSSM{DocumentName: "hello_document"},
 				AssumeRole: &types.AssumeRole{
@@ -4785,6 +4867,23 @@ func TestDiscoveryConfig(t *testing.T) {
 			desc:          "AWS section is filled with invalid region",
 			expectError:   require.Error,
 			expectEnabled: require.True,
+			mutate: func(cfg cfgMap) {
+				cfg["discovery_service"].(cfgMap)["enabled"] = "yes"
+				cfg["discovery_service"].(cfgMap)["aws"] = []cfgMap{
+					{
+						"types":   []string{"ec2"},
+						"regions": []string{"invalid-region"},
+						"tags": cfgMap{
+							"discover_teleport": "yes",
+						},
+					},
+				}
+			},
+		},
+		{
+			desc:          "for EC2 discovery, region can be set to wildcard",
+			expectError:   require.NoError,
+			expectEnabled: require.True,
 			mutate: func(cfg cfgMap) {
 				cfg["discovery_service"].(cfgMap)["enabled"] = "yes"
 				cfg["discovery_service"].(cfgMap)["aws"] = []cfgMap{
@@ -4797,6 +4896,22 @@ func TestDiscoveryConfig(t *testing.T) {
 					},
 				}
 			},
+			expectedAWSMatchers: []types.AWSMatcher{{
+				Types:   []string{"ec2"},
+				Regions: []string{"*"},
+				Tags: map[string]apiutils.Strings{
+					"discover_teleport": []string{"yes"},
+				},
+				Params: &types.InstallerParams{
+					JoinMethod:      types.JoinMethodIAM,
+					JoinToken:       "aws-discovery-iam-token",
+					SSHDConfig:      "/etc/ssh/sshd_config",
+					ScriptName:      "default-installer",
+					InstallTeleport: true,
+					EnrollMode:      types.InstallParamEnrollMode_INSTALL_PARAM_ENROLL_MODE_SCRIPT,
+				},
+				SSM: &types.AWSSSM{DocumentName: "TeleportDiscoveryInstaller"},
+			}},
 		},
 		{
 			desc:          "AWS section is filled with invalid join method",
@@ -4945,6 +5060,51 @@ func TestDiscoveryConfig(t *testing.T) {
 				},
 			}},
 		},
+		{
+			desc:          "AWS section is filled custom HTTP Proxy Settings",
+			expectError:   require.NoError,
+			expectEnabled: require.True,
+			mutate: func(cfg cfgMap) {
+				cfg["discovery_service"].(cfgMap)["enabled"] = "yes"
+				cfg["discovery_service"].(cfgMap)["aws"] = []cfgMap{
+					{
+						"types":   []string{"ec2"},
+						"regions": []string{"eu-west-1"},
+						"install": cfgMap{
+							"join_params": cfgMap{
+								"method": "iam",
+							},
+							"http_proxy_settings": cfgMap{
+								"http_proxy":  "http://squid-local:8080",
+								"https_proxy": "http://squid-local:8081",
+								"no_proxy":    "intranet.local,localhost",
+							},
+						},
+					},
+				}
+			},
+			expectedAWSMatchers: []types.AWSMatcher{{
+				Types: []string{"ec2"},
+				SSM: &types.AWSSSM{
+					DocumentName: types.AWSInstallerDocument,
+				},
+				Regions: []string{"eu-west-1"},
+				Tags:    map[string]apiutils.Strings{"*": {"*"}},
+				Params: &types.InstallerParams{
+					JoinMethod:      types.JoinMethodIAM,
+					JoinToken:       types.IAMInviteTokenName,
+					ScriptName:      installers.InstallerScriptName,
+					SSHDConfig:      "/etc/ssh/sshd_config",
+					InstallTeleport: true,
+					EnrollMode:      types.InstallParamEnrollMode_INSTALL_PARAM_ENROLL_MODE_SCRIPT,
+					HTTPProxySettings: &types.HTTPProxySettings{
+						HTTPProxy:  "http://squid-local:8080",
+						HTTPSProxy: "http://squid-local:8081",
+						NoProxy:    "intranet.local,localhost",
+					},
+				},
+			}},
+		},
 		{
 			desc:          "Azure section is filled with defaults (vm)",
 			expectError:   require.NoError,
@@ -5240,7 +5400,7 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
 		},
 	} {
 		t.Run(desc, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: tc.cloud,
 				},
diff --git a/lib/config/database.go b/lib/config/database.go
index 201a9b4d0ddb0..07502b62343c7 100644
--- a/lib/config/database.go
+++ b/lib/config/database.go
@@ -93,7 +93,7 @@ db_service:
   {{- end }}
 
   # Matchers for registering AWS-hosted databases.
-  {{- if or .RDSDiscoveryRegions .RDSProxyDiscoveryRegions .RedshiftDiscoveryRegions .RedshiftServerlessDiscoveryRegions .ElastiCacheDiscoveryRegions .MemoryDBDiscoveryRegions .OpenSearchDiscoveryRegions}}
+  {{- if or .RDSDiscoveryRegions .RDSProxyDiscoveryRegions .RedshiftDiscoveryRegions .RedshiftServerlessDiscoveryRegions .ElastiCacheDiscoveryRegions .ElastiCacheServerlessDiscoveryRegions .MemoryDBDiscoveryRegions .OpenSearchDiscoveryRegions}}
   aws:
   {{- else }}
   # For more information about AWS auto-discovery:
@@ -106,9 +106,10 @@ db_service:
   #   # 'redshift' - discovers and registers AWS Redshift databases.
   #   # 'redshift-serverless' - discovers and registers AWS Redshift Serverless databases.
   #   # 'elasticache' - discovers and registers AWS ElastiCache Redis databases.
+  #   # 'elasticache-serverless' - Amazon ElastiCache Serverless Redis or Valkey databases.
   #   # 'memorydb' - discovers and registers AWS MemoryDB Redis databases.
   #   # 'opensearch' - discovers and registers AWS OpenSearch domains.
-  # - types: ["rds", "rdsproxy", "redshift", "redshift-serverless", "elasticache", "memorydb", "opensearch"]
+  # - types: ["rds", "rdsproxy", "redshift", "redshift-serverless", "elasticache", "elasticache-serverless", "memorydb", "opensearch"]
   #   # AWS regions to register databases from.
   #   regions: ["us-west-1", "us-east-2"]
   #   # AWS resource tags to match when registering databases.
@@ -190,6 +191,21 @@ db_service:
       "{{ $name }}": "{{ $value }}"
     {{- end }}
   {{- end }}
+  {{- if .ElastiCacheServerlessDiscoveryRegions }}
+  # ElastiCacheServerless databases auto-discovery.
+  # For more information about ElastiCacheServerless auto-discovery: https://goteleport.com/docs/enroll-resources/auto-discovery/databases/aws/
+  - types: ["elasticache-serverless"]
+    # AWS regions to register databases from.
+    regions:
+    {{- range .ElastiCacheServerlessDiscoveryRegions }}
+    - "{{ . }}"
+    {{- end }}
+    # AWS resource tags to match when registering databases.
+    tags:
+    {{- range $name, $value := .AWSTags }}
+      "{{ $name }}": "{{ $value }}"
+    {{- end }}
+  {{- end }}
   {{- if .MemoryDBDiscoveryRegions }}
   # MemoryDB databases auto-discovery.
   # For more information about MemoryDB auto-discovery: https://goteleport.com/docs/enroll-resources/auto-discovery/databases/aws/
@@ -368,7 +384,7 @@ db_service:
       trust_system_cert_pool: {{ .DatabaseTrustSystemCertPool }}
       {{- end }}
     {{- end }}
-    {{- if or .DatabaseAWSRegion .DatabaseAWSAccountID .DatabaseAWSAssumeRoleARN .DatabaseAWSExternalID .DatabaseAWSRedshiftClusterID .DatabaseAWSRDSInstanceID .DatabaseAWSRDSClusterID .DatabaseAWSElastiCacheGroupID .DatabaseAWSMemoryDBClusterName }}
+    {{- if or .DatabaseAWSRegion .DatabaseAWSAccountID .DatabaseAWSAssumeRoleARN .DatabaseAWSExternalID .DatabaseAWSRedshiftClusterID .DatabaseAWSRDSInstanceID .DatabaseAWSRDSClusterID .DatabaseAWSElastiCacheGroupID .DatabaseAWSElastiCacheServerlessCacheName .DatabaseAWSMemoryDBClusterName }}
     aws:
       {{- if .DatabaseAWSRegion }}
       region: "{{ .DatabaseAWSRegion }}"
@@ -399,6 +415,10 @@ db_service:
       elasticache:
         replication_group_id: "{{ .DatabaseAWSElastiCacheGroupID }}"
       {{- end }}
+      {{- if .DatabaseAWSElastiCacheServerlessCacheName }}
+      elasticache_serverless:
+        cache_name: "{{ .DatabaseAWSElastiCacheServerlessCacheName }}"
+      {{- end }}
       {{- if .DatabaseAWSMemoryDBClusterName }}
       memorydb:
         cluster_name: "{{ .DatabaseAWSMemoryDBClusterName }}"
@@ -616,6 +636,9 @@ type DatabaseSampleFlags struct {
 	// ElastiCacheDiscoveryRegions is a list of regions the ElastiCache
 	// auto-discovery is configured.
 	ElastiCacheDiscoveryRegions []string
+	// ElastiCacheServerlessDiscoveryRegions is a list of regions the ElastiCache
+	// Serverless auto-discovery is configured.
+	ElastiCacheServerlessDiscoveryRegions []string
 	// MemoryDBDiscoveryRegions is a list of regions the MemoryDB
 	// auto-discovery is configured.
 	MemoryDBDiscoveryRegions []string
@@ -644,6 +667,8 @@ type DatabaseSampleFlags struct {
 	DatabaseAWSRDSInstanceID string
 	// DatabaseAWSElastiCacheGroupID is the ElastiCache replication group identifier.
 	DatabaseAWSElastiCacheGroupID string
+	// DatabaseAWSElastiCacheServerlessCacheName is the ElastiCache Serverless cache name.
+	DatabaseAWSElastiCacheServerlessCacheName string
 	// DatabaseAWSMemoryDBClusterName is the MemoryDB cluster name.
 	DatabaseAWSMemoryDBClusterName string
 	// DatabaseADDomain is the Active Directory domain for authentication.
diff --git a/lib/config/database_test.go b/lib/config/database_test.go
index fe5902ed99914..84605998efd86 100644
--- a/lib/config/database_test.go
+++ b/lib/config/database_test.go
@@ -115,6 +115,18 @@ func TestMakeDatabaseConfig(t *testing.T) {
 		require.ElementsMatch(t, flags.ElastiCacheDiscoveryRegions, databases.AWSMatchers[0].Regions)
 	})
 
+	t.Run("ElastiCacheServerlessAutoDiscovery", func(t *testing.T) {
+		t.Parallel()
+		flags := DatabaseSampleFlags{
+			ElastiCacheServerlessDiscoveryRegions: []string{"us-west-1", "us-west-2"},
+		}
+
+		databases := generateAndParseConfig(t, flags)
+		require.Len(t, databases.AWSMatchers, 1)
+		require.ElementsMatch(t, []string{"elasticache-serverless"}, databases.AWSMatchers[0].Types)
+		require.ElementsMatch(t, flags.ElastiCacheServerlessDiscoveryRegions, databases.AWSMatchers[0].Regions)
+	})
+
 	t.Run("MemoryDBAutoDiscovery", func(t *testing.T) {
 		t.Parallel()
 		flags := DatabaseSampleFlags{
@@ -312,7 +324,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 					DatabaseAWSExternalID:          "externalID123",
 				},
 			},
-			"AWSElastieCache": {
+			"AWSElastiCache": {
 				flags: DatabaseSampleFlags{
 					StaticDatabaseName:            "sample",
 					StaticDatabaseProtocol:        "redis",
@@ -323,6 +335,17 @@ func TestMakeDatabaseConfig(t *testing.T) {
 					DatabaseAWSExternalID:         "externalID123",
 				},
 			},
+			"AWSElastiCacheServerless": {
+				flags: DatabaseSampleFlags{
+					StaticDatabaseName:                        "sample",
+					StaticDatabaseProtocol:                    "redis",
+					StaticDatabaseURI:                         "example-cache-abc123.serverless.cac1.cache.amazonaws.com:6379",
+					DatabaseAWSRegion:                         "us-west-1",
+					DatabaseAWSElastiCacheServerlessCacheName: "example-cache",
+					DatabaseAWSAssumeRoleARN:                  "arn:aws:iam::123456789012:role/DBDiscoverer",
+					DatabaseAWSExternalID:                     "externalID123",
+				},
+			},
 			"AD": {
 				flags: DatabaseSampleFlags{
 					StaticDatabaseName:     "sample",
@@ -384,6 +407,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 				require.Equal(t, tt.flags.DatabaseAWSRDSClusterID, got.AWS.RDS.ClusterID)
 				require.Equal(t, tt.flags.DatabaseAWSRDSInstanceID, got.AWS.RDS.InstanceID)
 				require.Equal(t, tt.flags.DatabaseAWSElastiCacheGroupID, got.AWS.ElastiCache.ReplicationGroupID)
+				require.Equal(t, tt.flags.DatabaseAWSElastiCacheServerlessCacheName, got.AWS.ElastiCacheServerless.CacheName)
 				require.Equal(t, tt.flags.DatabaseAWSMemoryDBClusterName, got.AWS.MemoryDB.ClusterName)
 				require.Equal(t, tt.flags.DatabaseADDomain, got.AD.Domain)
 				require.Equal(t, tt.flags.DatabaseADSPN, got.AD.SPN)
@@ -452,6 +476,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 // generateAndParse generetes config using provided flags, parse them using
 // `ReadConfig`, checks if the Database service is enable and return it.
 func generateAndParseConfig(t *testing.T, flags DatabaseSampleFlags) Databases {
+	t.Helper()
 	configString, err := MakeDatabaseAgentConfigString(flags)
 	require.NoError(t, err)
 
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index a3af570d7b200..6f5e8912ff19e 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -20,6 +20,7 @@ package config
 
 import (
 	"bytes"
+	"cmp"
 	"context"
 	"crypto/tls"
 	"encoding/base64"
@@ -66,6 +67,7 @@ type FileConfig struct {
 	Auth    Auth  `yaml:"auth_service,omitempty"`
 	SSH     SSH   `yaml:"ssh_service,omitempty"`
 	Proxy   Proxy `yaml:"proxy_service,omitempty"`
+	Relay   Relay `yaml:"relay_service,omitempty"`
 	Kube    Kube  `yaml:"kubernetes_service,omitempty"`
 
 	// Apps is the "app_service" section in Teleport file configuration which
@@ -183,6 +185,8 @@ type SampleFlags struct {
 	AppName string
 	// AppURI is the internal address of the application to proxy
 	AppURI string
+	// MCPDemoServer enables the "Teleport Demo" MCP server.
+	MCPDemoServer bool
 	// NodeLabels is list of labels in the format `foo=bar,baz=bax` to add to newly created nodes.
 	NodeLabels string
 	// CAPin is the SKPI hash of the CA used to verify the Auth Server. Can be
@@ -409,17 +413,24 @@ func makeSampleProxyConfig(conf *servicecfg.Config, flags SampleFlags, enabled b
 func makeSampleAppsConfig(conf *servicecfg.Config, flags SampleFlags, enabled bool) (Apps, error) {
 	var apps Apps
 	// assume users want app role if they added app name and/or uri but didn't add app role
-	if enabled || flags.AppURI != "" || flags.AppName != "" {
-		if flags.AppURI == "" || flags.AppName == "" {
-			return Apps{}, trace.BadParameter("please provide both --app-name and --app-uri")
-		}
-
+	if enabled || flags.AppURI != "" || flags.AppName != "" || flags.MCPDemoServer {
 		apps.EnabledFlag = "yes"
-		apps.Apps = []*App{
-			{
-				Name: flags.AppName,
-				URI:  flags.AppURI,
-			},
+		apps.MCPDemoServer = flags.MCPDemoServer
+
+		switch {
+		case flags.AppURI != "" && flags.AppName != "":
+			apps.Apps = []*App{
+				{
+					Name: flags.AppName,
+					URI:  flags.AppURI,
+				},
+			}
+
+		case flags.MCPDemoServer && flags.AppURI == "" && flags.AppName == "":
+			// This is ok if only MCPDemoServer is set.
+
+		default:
+			return Apps{}, trace.BadParameter("please provide both --app-name and --app-uri")
 		}
 	}
 
@@ -596,6 +607,7 @@ type Global struct {
 	// v3
 	AuthServer  string `yaml:"auth_server,omitempty"`
 	ProxyServer string `yaml:"proxy_server,omitempty"`
+	RelayServer string `yaml:"relay_server,omitempty"`
 
 	Limits      ConnectionLimits `yaml:"connection_limits,omitempty"`
 	Logger      Log              `yaml:"log,omitempty"`
@@ -603,6 +615,10 @@ type Global struct {
 	AdvertiseIP string           `yaml:"advertise_ip,omitempty"`
 	CachePolicy CachePolicy      `yaml:"cache,omitempty"`
 
+	// ShutdownDelay is a fixed delay between receiving a termination signal and
+	// the beginning of the shutdown procedures.
+	ShutdownDelay types.Duration `yaml:"shutdown_delay,omitempty"`
+
 	// CipherSuites is a list of TLS ciphersuites that Teleport supports. If
 	// omitted, a Teleport selected list of defaults will be used.
 	CipherSuites []string `yaml:"ciphersuites,omitempty"`
@@ -628,6 +644,9 @@ type Global struct {
 
 	// DiagAddr is the address to expose a diagnostics HTTP endpoint.
 	DiagAddr string `yaml:"diag_addr"`
+
+	// AuthConnectionConfig defines the parameters used to connect to the Auth Service.
+	AuthConnectionConfig AuthConnectionConfig `yaml:"auth_connection_config,omitempty"`
 }
 
 // CachePolicy is used to control  local cache
@@ -663,6 +682,30 @@ func (c *CachePolicy) Parse() (*servicecfg.CachePolicy, error) {
 	return &out, nil
 }
 
+// AuthConnectionConfig defines the parameters used to connect to the Auth Service.
+type AuthConnectionConfig struct {
+	// UpperLimitBetweenRetries is the upper limit for how long to wait between retries.
+	UpperLimitBetweenRetries time.Duration `yaml:"upper_limit_between_retries,omitempty"`
+	// InitialConnectionDelay is the initial delay before the first retry attempt.
+	// The retry logic will apply jitter to this duration.
+	InitialConnectionDelay time.Duration `yaml:"initial_connection_delay,omitempty"`
+	// BackoffStepDuration is the amount of time added to the retry delay.
+	BackoffStepDuration time.Duration `yaml:"backoff_step_duration,omitempty"`
+}
+
+// Parse parses [servicecfg.AuthConnectionConfig] from Teleport config
+func (c *AuthConnectionConfig) Parse() (*servicecfg.AuthConnectionConfig, error) {
+	out := &servicecfg.AuthConnectionConfig{
+		UpperLimitBetweenRetries: c.UpperLimitBetweenRetries,
+		InitialConnectionDelay:   c.InitialConnectionDelay,
+		BackoffStepDuration:      c.BackoffStepDuration,
+	}
+	if err := out.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err, "failed to parse auth_connection_config")
+	}
+	return out, nil
+}
+
 // Service is a common configuration of a teleport service
 type Service struct {
 	defaultEnabled bool
@@ -731,6 +774,10 @@ type Auth struct {
 	// determines if the proxy will check the host key of the client or not.
 	ProxyChecksHostKeys *types.BoolOption `yaml:"proxy_checks_host_keys,omitempty"`
 
+	// SessionRecordingConfig configures how session recording should be handled including things like
+	// encryption and key management.
+	SessionRecordingConfig *SessionRecordingConfig `yaml:"session_recording_config,omitempty"`
+
 	// LicenseFile is a path to the license file. The path can be either absolute or
 	// relative to the global data dir
 	LicenseFile string `yaml:"license_file,omitempty"`
@@ -872,7 +919,8 @@ func (a *Auth) hasCustomNetworkingConfig() bool {
 func (a *Auth) hasCustomSessionRecording() bool {
 	empty := Auth{}
 	return a.SessionRecording != empty.SessionRecording ||
-		a.ProxyChecksHostKeys != empty.ProxyChecksHostKeys
+		a.ProxyChecksHostKeys != empty.ProxyChecksHostKeys ||
+		a.SessionRecordingConfig != empty.SessionRecordingConfig
 }
 
 // CAKeyParams configures how CA private keys will be created and stored.
@@ -999,6 +1047,12 @@ func (t StaticToken) Parse() ([]types.ProvisionTokenV1, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if roles.Include(types.RoleBot) {
+		slog.WarnContext(
+			context.Background(),
+			"Role 'Bot' is not supported in static token configurations and will not function as expected. In Teleport V19.0.0, this will become an error.",
+		)
+	}
 
 	tokenPart, err := utils.TryReadValueAsFile(parts[1])
 	if err != nil {
@@ -1621,6 +1675,17 @@ type AccessGraphAWSSync struct {
 	// CloudTrailLogs is the configuration for the SQS queue to poll for
 	// CloudTrail logs.
 	CloudTrailLogs *AccessGraphAWSSyncCloudTrailLogs `yaml:"cloud_trail_logs,omitempty"`
+	// EKSAuditLogs is the configuration for fetching audit logs for EKS
+	// clusters discovered.
+	EKSAuditLogs *AccessGraphEKSAuditLogs `yaml:"eks_audit_logs,omitempty"`
+}
+
+// AccessGraphEKSAuditLogs is the configuration for fetching audit logs from
+// clusters discovered for access graph.
+type AccessGraphEKSAuditLogs struct {
+	// Tags are AWS EKS tags to match. Clusters that have tags that match these
+	// will have their audit logs fetched and sent to Access Graph.
+	Tags map[string]apiutils.Strings `yaml:"tags,omitempty"`
 }
 
 // AccessGraphAzureSync represents the configuration for the Azure AccessGraph Sync service.
@@ -1810,6 +1875,28 @@ type InstallParams struct {
 	// Valid values: script, eice.
 	// Optional.
 	EnrollMode string `yaml:"enroll_mode"`
+	// Suffix indicates the installation suffix for the teleport installation.
+	// Set this value if you want multiple installations of Teleport.
+	// See --install-suffix flag in teleport-update program.
+	Suffix string `yaml:"suffix,omitempty"`
+	// UpdateGroup indicates the update group for the teleport installation.
+	// This value is used to group installations in order to update them in batches.
+	// See --group flag in teleport-update program.
+	UpdateGroup string `yaml:"update_group,omitempty"`
+	// HTTPProxySettings configures HTTP proxy settings for the installation.
+	HTTPProxySettings *HTTPProxySettings `yaml:"http_proxy_settings,omitempty"`
+}
+
+// HTTPProxySettings configures HTTP proxy settings for the installation.
+// When set, the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables will be set when executing the installation script.
+type HTTPProxySettings struct {
+	// HTTPProxy is the HTTP proxy URL.
+	HTTPProxy string `yaml:"http_proxy,omitempty"`
+	// HTTPSProxy is the HTTPS proxy URL.
+	HTTPSProxy string `yaml:"https_proxy,omitempty"`
+	// NoProxy is a comma-separated list of hosts that should be excluded
+	// from proxying.
+	NoProxy string `yaml:"no_proxy,omitempty"`
 }
 
 const (
@@ -1819,7 +1906,7 @@ const (
 
 var validInstallEnrollModes = []string{installEnrollModeEICE, installEnrollModeScript}
 
-func (ip *InstallParams) parse() (*types.InstallerParams, error) {
+func (ip *InstallParams) parse(defaultProxyAddr string) (*types.InstallerParams, error) {
 	install := &types.InstallerParams{
 		JoinMethod:      ip.JoinParams.Method,
 		JoinToken:       ip.JoinParams.TokenName,
@@ -1827,6 +1914,21 @@ func (ip *InstallParams) parse() (*types.InstallerParams, error) {
 		InstallTeleport: true,
 		SSHDConfig:      ip.SSHDConfig,
 		EnrollMode:      types.InstallParamEnrollMode_INSTALL_PARAM_ENROLL_MODE_UNSPECIFIED,
+		Suffix:          ip.Suffix,
+		UpdateGroup:     ip.UpdateGroup,
+		PublicProxyAddr: cmp.Or(ip.PublicProxyAddr, defaultProxyAddr),
+	}
+
+	if ip.HTTPProxySettings != nil {
+		install.HTTPProxySettings = &types.HTTPProxySettings{
+			HTTPProxy:  ip.HTTPProxySettings.HTTPProxy,
+			HTTPSProxy: ip.HTTPProxySettings.HTTPSProxy,
+			NoProxy:    ip.HTTPProxySettings.NoProxy,
+		}
+
+		if err := install.HTTPProxySettings.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	switch ip.EnrollMode {
@@ -1840,6 +1942,12 @@ func (ip *InstallParams) parse() (*types.InstallerParams, error) {
 		return nil, trace.BadParameter("enroll mode %q is invalid, valid values: %v", ip.EnrollMode, validInstallEnrollModes)
 	}
 
+	if ip.Azure != nil {
+		install.Azure = &types.AzureInstallerParams{
+			ClientID: ip.Azure.ClientID,
+		}
+	}
+
 	if ip.InstallTeleport == "" {
 		return install, nil
 	}
@@ -1878,6 +1986,8 @@ type AzureMatcher struct {
 	Regions []string `yaml:"regions,omitempty"`
 	// ResourceTags are Azure tags on resources to match.
 	ResourceTags map[string]apiutils.Strings `yaml:"tags,omitempty"`
+	// Integration is the Azure Integration name.
+	Integration string `yaml:"integration,omitempty"`
 	// InstallParams sets the join method when installing on
 	// discovered Azure nodes.
 	InstallParams *InstallParams `yaml:"install,omitempty"`
@@ -1983,8 +2093,15 @@ type DatabaseMySQL struct {
 
 // DatabaseOracle are an additional Oracle database options.
 type DatabaseOracle struct {
-	// AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
+	// AuditUser is the name of the Oracle database user that should be used to access
+	// the internal audit trail.
 	AuditUser string `yaml:"audit_user,omitempty"`
+	// RetryCount is the maximum number of times to retry connecting to a
+	// host upon failure.
+	RetryCount int32 `yaml:"retry_count,omitempty"`
+	// ShuffleHostnames, when true, randomizes the order of hosts to connect to from
+	// the provided list.
+	ShuffleHostnames bool `yaml:"shuffle_hostnames,omitempty"`
 }
 
 // SecretStore contains settings for managing secrets.
@@ -2005,6 +2122,8 @@ type DatabaseAWS struct {
 	RDS DatabaseAWSRDS `yaml:"rds"`
 	// ElastiCache contains ElastiCache specific settings.
 	ElastiCache DatabaseAWSElastiCache `yaml:"elasticache"`
+	// ElastiCacheServerless contains ElastiCache Serverless specific settings.
+	ElastiCacheServerless DatabaseAWSElastiCacheServerless `yaml:"elasticache_serverless"`
 	// SecretStore contains settings for managing secrets.
 	SecretStore SecretStore `yaml:"secret_store"`
 	// MemoryDB contains MemoryDB specific settings.
@@ -2041,6 +2160,13 @@ type DatabaseAWSElastiCache struct {
 	ReplicationGroupID string `yaml:"replication_group_id,omitempty"`
 }
 
+// DatabaseAWSElastiCacheServerless contains settings for ElastiCache Serverless
+// databases.
+type DatabaseAWSElastiCacheServerless struct {
+	// CacheName is the ElastiCache Serverless cache name.
+	CacheName string `yaml:"cache_name,omitempty"`
+}
+
 // DatabaseAWSMemoryDB contains settings for MemoryDB databases.
 type DatabaseAWSMemoryDB struct {
 	// ClusterName is the MemoryDB cluster name.
@@ -2061,6 +2187,17 @@ type DatabaseGCP struct {
 	ProjectID string `yaml:"project_id,omitempty"`
 	// InstanceID is the Cloud SQL database instance ID.
 	InstanceID string `yaml:"instance_id,omitempty"`
+	// AlloyDB contains AlloyDB specific settings.
+	AlloyDB DatabaseGCPAlloyDB `yaml:"alloydb,omitempty"`
+}
+
+// DatabaseGCPAlloyDB contains GCP specific settings for AlloyDB databases.
+type DatabaseGCPAlloyDB struct {
+	// EndpointType is the database endpoint type to use. Available types are 'private', 'public' and 'psc'.
+	// 'private' is the default type.
+	EndpointType string `yaml:"endpoint_type,omitempty"`
+	// EndpointOverride is an override of endpoint address to use.
+	EndpointOverride string `yaml:"endpoint_override,omitempty"`
 }
 
 // DatabaseAzure contains Azure database configuration.
@@ -2082,6 +2219,9 @@ type Apps struct {
 	// DebugApp turns on a header debugging application.
 	DebugApp bool `yaml:"debug_app"`
 
+	// MCPDemoServer enables the "Teleport Demo" MCP server.
+	MCPDemoServer bool `yaml:"mcp_demo_server"`
+
 	// Apps is a list of applications that will be run by this service.
 	Apps []*App `yaml:"apps"`
 
@@ -2143,6 +2283,9 @@ type App struct {
 	// If this field is not empty, URI is expected to contain no port number and start with the tcp
 	// protocol.
 	TCPPorts []PortRange `yaml:"tcp_ports,omitempty"`
+
+	// MCP contains MCP server-related configurations.
+	MCP *MCP `yaml:"mcp,omitempty"`
 }
 
 // CORS represents the configuration for Cross-Origin Resource Sharing (CORS)
@@ -2201,6 +2344,17 @@ type PortRange struct {
 	EndPort int `yaml:"end_port,omitempty"`
 }
 
+// MCP contains MCP server-related configurations.
+type MCP struct {
+	// Command to launch stdio-based MCP servers.
+	Command string `yaml:"command,omitempty"`
+	// Args to execute with the command.
+	Args []string `yaml:"args,omitempty"`
+	// RunAsHostUser is the host user account under which the command will be
+	// executed. Required for stdio-based MCP servers.
+	RunAsHostUser string `yaml:"run_as_host_user,omitempty"`
+}
+
 // Proxy is a `proxy_service` section of the config file:
 type Proxy struct {
 	// Service is a generic service configuration section
@@ -2519,6 +2673,8 @@ type WindowsDesktopService struct {
 	DiscoveryConfigs []LDAPDiscoveryConfig `yaml:"discovery_configs,omitempty"`
 	// DiscoveryInterval controls how frequently the discovery process runs.
 	DiscoveryInterval time.Duration `yaml:"discovery_interval"`
+	// PublishCRLInterval determines how frequently CRLs should be published.
+	PublishCRLInterval time.Duration `yaml:"publish_crl_interval"`
 	// ADHosts is a list of static, AD-connected Windows hosts. This gives users
 	// a way to specify AD-connected hosts that won't be found by the filters
 	// specified in `discovery` (or if `discovery` is omitted).
@@ -2547,12 +2703,14 @@ func (wds *WindowsDesktopService) Check() error {
 		return host.AD
 	})
 
-	if hasAD && wds.LDAP.Addr == "" {
+	ldapConfigOK := wds.LDAP.Domain != "" && (wds.LDAP.Addr != "" || wds.LDAP.LocateServer.Enabled)
+
+	if hasAD && !ldapConfigOK {
 		return trace.BadParameter("if Active Directory hosts are specified in the windows_desktop_service, " +
 			"the ldap configuration must also be specified")
 	}
 
-	if wds.Discovery.BaseDN != "" && wds.LDAP.Addr == "" {
+	if (wds.Discovery.BaseDN != "" || len(wds.DiscoveryConfigs) > 0) && !ldapConfigOK {
 		return trace.BadParameter("if discovery is specified in the windows_desktop_service, " +
 			"ldap configuration must also be specified")
 	}
@@ -2583,10 +2741,22 @@ type WindowsHost struct {
 	AD bool `yaml:"ad"`
 }
 
+// LocateServer contains parameters for locating LDAP servers
+// from the AD Domain
+type LocateServer struct {
+	// Enabled will automatically locate the LDAP server using DNS SRV records.
+	// When enabled, Domain must be set, Addr will be ignored
+	// https://ldap.com/dns-srv-records-for-ldap/
+	Enabled bool `yaml:"enabled,omitempty"`
+	// Site is an LDAP site to locate servers from a specific logical site.
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/b645c125-a7da-4097-84a1-2fa7cea07714#gt_8abdc986-5679-42d9-ad76-b11eb5a0daba
+	Site string `yaml:"site,omitempty"`
+}
+
 // LDAPConfig is the LDAP connection parameters.
 type LDAPConfig struct {
 	// Addr is the host:port of the LDAP server (typically port 389).
-	Addr string `yaml:"addr"`
+	Addr string `yaml:"addr,omitempty"`
 	// Domain is the ActiveDirectory domain name.
 	Domain string `yaml:"domain"`
 	// Username for LDAP authentication.
@@ -2601,6 +2771,8 @@ type LDAPConfig struct {
 	DEREncodedCAFile string `yaml:"der_ca_file,omitempty"`
 	// PEMEncodedCACert is an optional PEM encoded CA cert to be used for verification (if InsecureSkipVerify is set to false).
 	PEMEncodedCACert string `yaml:"ldap_ca_cert,omitempty"`
+	// LocateServer is the config that enables LDAP server location using DNS SRV records.
+	LocateServer `yaml:"locate_server"`
 }
 
 // LDAPDiscoveryConfig is LDAP discovery configuration for windows desktop discovery service.
@@ -2856,3 +3028,92 @@ func readJamfPasswordFile(path, key string) (string, error) {
 
 	return pwd, nil
 }
+
+// Relay is the relay_service section of the Teleport config file.
+type Relay struct {
+	// Enabled is set if the relay service is enabled, defaults to false.
+	Enabled bool `yaml:"enabled"`
+
+	// RelayGroup is the Relay group name, required if the relay service is
+	// enabled.
+	RelayGroup string `yaml:"relay_group"`
+
+	// TargetConnectionCount is the connection count that agents are supposed to
+	// maintain when connecting to the Relay group of this instance.
+	TargetConnectionCount int `yaml:"target_connection_count"`
+
+	// PublicHostnames is the list of DNS names and IP addresses that the
+	// Relay service credentials should be authoritative for.
+	PublicHostnames []string `yaml:"public_hostnames"`
+
+	// TransportListenAddr is the listen address for the transport listener, in
+	// addr:port format.
+	TransportListenAddr string `yaml:"transport_listen_addr"`
+
+	// TransportPROXYProtocol is set if the transport listener should expect a
+	// PROXY protocol header in incoming connections.
+	TransportPROXYProtocol bool `yaml:"transport_proxy_protocol"`
+
+	// PeerListenAddr is the listen address for the peer listener, in addr:port
+	// format.
+	PeerListenAddr string `yaml:"peer_listen_addr"`
+
+	// PeerPublicAddr, if set, is the public address for the peer listener, in
+	// host:port format.
+	PeerPublicAddr string `yaml:"peer_public_addr"`
+
+	// TunnelListenAddr is the listen address for the tunnel listener, in
+	// addr:port format.
+	TunnelListenAddr string `yaml:"tunnel_listen_addr"`
+
+	// TunnelPROXYProtocol is set if the tunnel listener should expect a PROXY
+	// protocol header in incoming connections.
+	TunnelPROXYProtocol bool `yaml:"tunnel_proxy_protocol"`
+}
+
+// SessionRecordingEncryptionConfig is the session_recording_config.encryption
+// section of the Teleport config file. It maps directly to [types.SessionRecordingEncryptionConfig]
+type SessionRecordingEncryptionConfig struct {
+	Enabled             bool `yaml:"enabled,omitempty"`
+	ManualKeyManagement *struct {
+		Enabled     bool              `yaml:"enabled,omitempty"`
+		ActiveKeys  []*types.KeyLabel `yaml:"active_keys,omitempty"`
+		RotatedKeys []*types.KeyLabel `yaml:"rotated_keys,omitempty"`
+	} `yaml:"manual_key_management,omitempty"`
+}
+
+// SessionRecordingConfig is the session_recording_config section of the Teleport config file.
+// It maps directly to [types.SessionRecordingConfigSpecV2]
+type SessionRecordingConfig struct {
+	Mode                string                            `yaml:"mode"`
+	ProxyChecksHostKeys *types.BoolOption                 `yaml:"proxy_checks_host_keys,omitempty"`
+	Encryption          *SessionRecordingEncryptionConfig `yaml:"encryption,omitempty"`
+}
+
+// toSpec converts SessionRecordingConfig into a types.SessionRecordingConfigSpecV2 so it can
+// be used to initialize session recording.
+func (src *SessionRecordingConfig) toSpec() types.SessionRecordingConfigSpecV2 {
+	if src == nil {
+		return types.SessionRecordingConfigSpecV2{}
+	}
+
+	var encryption *types.SessionRecordingEncryptionConfig
+	if src.Encryption != nil {
+		encryption = &types.SessionRecordingEncryptionConfig{
+			Enabled: src.Encryption.Enabled,
+		}
+		if src.Encryption.ManualKeyManagement != nil {
+			encryption.ManualKeyManagement = &types.ManualKeyManagementConfig{
+				Enabled:     src.Encryption.ManualKeyManagement.Enabled,
+				ActiveKeys:  src.Encryption.ManualKeyManagement.ActiveKeys,
+				RotatedKeys: src.Encryption.ManualKeyManagement.RotatedKeys,
+			}
+		}
+	}
+
+	return types.SessionRecordingConfigSpecV2{
+		Mode:                src.Mode,
+		ProxyChecksHostKeys: src.ProxyChecksHostKeys,
+		Encryption:          encryption,
+	}
+}
diff --git a/lib/config/fileconf_test.go b/lib/config/fileconf_test.go
index b6cc274be0aa4..396d8b86510e4 100644
--- a/lib/config/fileconf_test.go
+++ b/lib/config/fileconf_test.go
@@ -38,6 +38,8 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 )
 
@@ -574,26 +576,45 @@ func TestAuthenticationConfig_Parse_StaticToken(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		desc  string
-		token string
+		desc      string
+		input     string
+		wantRoles []types.SystemRole
+		wantToken string
+		wantError string
 	}{
-		{desc: "file path on windows", token: `C:\path\to\some\file`},
-		{desc: "literal string", token: "some-literal-token"},
+		{
+			desc:      "file path on windows",
+			input:     `Auth,Node,Proxy:C:\path\to\some\file`,
+			wantToken: `C:\path\to\some\file`,
+			wantRoles: []types.SystemRole{
+				types.RoleAuth, types.RoleNode, types.RoleProxy,
+			},
+		},
+		{
+			desc:      "literal string",
+			input:     "Auth,Node,Proxy:some-literal-token",
+			wantToken: "some-literal-token",
+			wantRoles: []types.SystemRole{
+				types.RoleAuth, types.RoleNode, types.RoleProxy,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			staticToken := StaticToken("Auth,Node,Proxy:" + tt.token)
+			staticToken := StaticToken(tt.input)
 			provisionTokens, err := staticToken.Parse()
+			if tt.wantError != "" {
+				require.ErrorContains(t, err, tt.wantError)
+				return
+			}
 			require.NoError(t, err)
 
 			require.Len(t, provisionTokens, 1)
 			provisionToken := provisionTokens[0]
 
 			want := types.ProvisionTokenV1{
-				Roles: []types.SystemRole{
-					types.RoleAuth, types.RoleNode, types.RoleProxy,
-				},
-				Token:   tt.token,
+				Roles:   tt.wantRoles,
+				Token:   tt.wantToken,
 				Expires: provisionToken.Expires,
 			}
 			require.Equal(t, want, provisionToken)
@@ -735,7 +756,7 @@ func TestAuthenticationConfig_RequireSessionMFA(t *testing.T) {
 
 func TestAuthenticationConfig_Parse_deviceTrustPB(t *testing.T) {
 	// Device trust mode=required is an Enterprise feature.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
@@ -1226,6 +1247,125 @@ func TestX11Config(t *testing.T) {
 	}
 }
 
+func TestBackoffConfig(t *testing.T) {
+	testCases := []struct {
+		desc                   string
+		mutate                 func(cfgMap)
+		expectSvcBackoffConfig *servicecfg.AuthConnectionConfig
+		errorFn                func(t require.TestingT, err error, msgAndArgs ...interface{})
+	}{
+		{
+			desc:   "default",
+			mutate: func(cfg cfgMap) {},
+			expectSvcBackoffConfig: &servicecfg.AuthConnectionConfig{
+				UpperLimitBetweenRetries: 90 * time.Second,
+				InitialConnectionDelay:   9 * time.Second,
+				BackoffStepDuration:      18 * time.Second,
+			},
+			errorFn: require.NoError,
+		},
+		{
+			desc: "negative values use defaults",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"initial_connection_delay":    "-1m",
+					"upper_limit_between_retries": "-5m",
+					"backoff_step_duration":       "-3s",
+				}
+			},
+			expectSvcBackoffConfig: &servicecfg.AuthConnectionConfig{
+				UpperLimitBetweenRetries: 90 * time.Second,
+				InitialConnectionDelay:   9 * time.Second,
+				BackoffStepDuration:      18 * time.Second,
+			},
+			errorFn: require.NoError,
+		},
+		{
+			desc: "use default ratio when only max is given",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"upper_limit_between_retries": "3m",
+				}
+			},
+			expectSvcBackoffConfig: &servicecfg.AuthConnectionConfig{
+				UpperLimitBetweenRetries: 3 * time.Minute,
+				InitialConnectionDelay:   18 * time.Second,
+				BackoffStepDuration:      36 * time.Second,
+			},
+			errorFn: require.NoError,
+		},
+		{
+			desc: "user specified",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"initial_connection_delay":    "1m",
+					"upper_limit_between_retries": "5m",
+					"backoff_step_duration":       "3s",
+				}
+			},
+			expectSvcBackoffConfig: &servicecfg.AuthConnectionConfig{
+				UpperLimitBetweenRetries: 5 * time.Minute,
+				InitialConnectionDelay:   time.Minute,
+				BackoffStepDuration:      3 * time.Second,
+			},
+			errorFn: require.NoError,
+		},
+		{
+			desc: "minimum upper range enforced",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"upper_limit_between_retries": "2ms",
+				}
+			},
+			expectSvcBackoffConfig: nil,
+			errorFn: func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+				require.ErrorContains(t, err, "cannot be set below")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		},
+		{
+			desc: "cannot set initial delay above upper limit",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"initial_connection_delay": "2h",
+				}
+			},
+			expectSvcBackoffConfig: nil,
+			errorFn: func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+				require.ErrorContains(t, err, "cannot be larger than upper_limit_between_retries")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		},
+		{
+			desc: "cannot set step above upper limit",
+			mutate: func(cfg cfgMap) {
+				cfg["teleport"].(cfgMap)["auth_connection_config"] = cfgMap{
+					"backoff_step_duration": "2h",
+				}
+			},
+			expectSvcBackoffConfig: nil,
+			errorFn: func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+				require.ErrorContains(t, err, "cannot be larger than upper_limit_between_retries")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			text := bytes.NewBuffer(editConfig(t, tc.mutate))
+
+			cfg, err := ReadConfig(text)
+			require.NoError(t, err)
+
+			svccfg, err := cfg.AuthConnectionConfig.Parse()
+			tc.errorFn(t, err)
+
+			require.Equal(t, tc.expectSvcBackoffConfig, svccfg)
+		})
+	}
+}
+
 func TestMakeSampleFileConfig(t *testing.T) {
 	t.Run("Default roles", func(t *testing.T) {
 		fc, err := MakeSampleFileConfig(SampleFlags{
@@ -1286,6 +1426,49 @@ func TestMakeSampleFileConfig(t *testing.T) {
 		require.Equal(t, "yes", fc.Apps.EnabledFlag)
 	})
 
+	t.Run("App role with MCP Demo server", func(t *testing.T) {
+		fc, err := MakeSampleFileConfig(SampleFlags{
+			Roles:         "app",
+			MCPDemoServer: true,
+		})
+		require.NoError(t, err)
+		require.Equal(t, "no", fc.SSH.EnabledFlag)
+		require.Equal(t, "no", fc.Proxy.EnabledFlag)
+		require.Equal(t, "no", fc.Auth.EnabledFlag)
+		require.Equal(t, "yes", fc.Apps.EnabledFlag)
+		require.True(t, fc.Apps.MCPDemoServer)
+	})
+
+	t.Run("App name and MCP Demo Server", func(t *testing.T) {
+		_, err := MakeSampleFileConfig(SampleFlags{
+			Roles:         "app",
+			AppURI:        "localhost:8080",
+			MCPDemoServer: true,
+		})
+		require.Error(t, err)
+
+		_, err = MakeSampleFileConfig(SampleFlags{
+			Roles:         "app",
+			AppName:       "nginx",
+			MCPDemoServer: true,
+		})
+		require.Error(t, err)
+
+		fc, err := MakeSampleFileConfig(SampleFlags{
+			Roles:         "app",
+			AppURI:        "localhost:8080",
+			AppName:       "nginx",
+			MCPDemoServer: true,
+		})
+		require.NoError(t, err)
+
+		require.Equal(t, "no", fc.SSH.EnabledFlag)
+		require.Equal(t, "no", fc.Proxy.EnabledFlag)
+		require.Equal(t, "no", fc.Auth.EnabledFlag)
+		require.Equal(t, "yes", fc.Apps.EnabledFlag)
+		require.True(t, fc.Apps.MCPDemoServer)
+	})
+
 	t.Run("Proxy role", func(t *testing.T) {
 		fc, err := MakeSampleFileConfig(SampleFlags{
 			Roles: "proxy",
diff --git a/lib/config/systemd.go b/lib/config/systemd.go
deleted file mode 100644
index 1418e73272227..0000000000000
--- a/lib/config/systemd.go
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"io"
-	"os"
-	"text/template"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/defaults"
-)
-
-const (
-	// SystemdDefaultEnvironmentFile is the default path to the env file for the systemd unit file config
-	SystemdDefaultEnvironmentFile = "/etc/default/teleport"
-	// SystemdDefaultPIDFile is the default path to the PID file for the systemd unit file config
-	SystemdDefaultPIDFile = "/run/teleport.pid"
-	// SystemdDefaultFileDescriptorLimit is the default max number of open file descriptors for the systemd unit file config
-	SystemdDefaultFileDescriptorLimit = 524288
-)
-
-// systemdUnitFileTemplate is the systemd unit file configuration template.
-var systemdUnitFileTemplate = template.Must(template.New("").Parse(`[Unit]
-Description=Teleport Service
-After=network.target
-
-[Service]
-Type=simple
-Restart=always
-RestartSec=5
-EnvironmentFile=-{{ .EnvironmentFile }}
-ExecStart={{ .TeleportInstallationFile }} start --config {{ .TeleportConfigPath }} --pid-file={{ .PIDFile }}
-# systemd before 239 needs an absolute path
-ExecReload=/bin/sh -c "exec pkill -HUP -L -F {{ .PIDFile }}"
-PIDFile={{ .PIDFile }}
-LimitNOFILE={{ .FileDescriptorLimit }}
-
-[Install]
-WantedBy=multi-user.target
-`))
-
-// SystemdFlags specifies configuration parameters for a systemd unit file.
-type SystemdFlags struct {
-	// EnvironmentFile is the environment file path provided by the user.
-	EnvironmentFile string
-	// PIDFile is the process ID (PID) file path provided by the user.
-	PIDFile string
-	// FileDescriptorLimit is the maximum number of open file descriptors provided by the user.
-	FileDescriptorLimit int
-	// TeleportInstallationFile is the teleport installation path provided by the user.
-	TeleportInstallationFile string
-	// TeleportConfigPath is the path to the teleport config file (as set by Teleport defaults)
-	TeleportConfigPath string
-}
-
-// CheckAndSetDefaults checks and sets default values for the flags.
-func (f *SystemdFlags) CheckAndSetDefaults() error {
-	if f.TeleportInstallationFile == "" {
-		teleportPath, err := os.Readlink("/proc/self/exe")
-		if err != nil {
-			return trace.Wrap(err, "Can't find Teleport binary. Please specify the path.")
-		}
-		f.TeleportInstallationFile = teleportPath
-	}
-	// set Teleport config path to the default
-	f.TeleportConfigPath = defaults.ConfigFilePath
-
-	return nil
-}
-
-// WriteSystemdUnitFile accepts flags and an io.Writer
-// and writes the systemd unit file configuration to it
-func WriteSystemdUnitFile(flags SystemdFlags, dest io.Writer) error {
-	err := flags.CheckAndSetDefaults()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	return trace.Wrap(systemdUnitFileTemplate.Execute(dest, flags))
-}
diff --git a/lib/config/systemd/systemd.go b/lib/config/systemd/systemd.go
new file mode 100644
index 0000000000000..010318d0ce5f6
--- /dev/null
+++ b/lib/config/systemd/systemd.go
@@ -0,0 +1,101 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package systemd
+
+import (
+	"io"
+	"os"
+	"text/template"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+const (
+	// DefaultEnvironmentFile is the default path to the env file for the systemd unit file config
+	DefaultEnvironmentFile = "/etc/default/teleport"
+	// DefaultPIDFile is the default path to the PID file for the systemd unit file config
+	DefaultPIDFile = "/run/teleport.pid"
+	// DefaultFileDescriptorLimit is the default max number of open file descriptors for the systemd unit file config
+	DefaultFileDescriptorLimit = 524288
+)
+
+// unitFileTemplate is the systemd unit file configuration template.
+var unitFileTemplate = template.Must(template.New("").Parse(`[Unit]
+Description=Teleport Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+EnvironmentFile=-{{ .EnvironmentFile }}
+ExecStart={{ .TeleportInstallationFile }} start {{ if .FIPS }}--fips {{ end }}--config {{ .TeleportConfigPath }} --pid-file={{ .PIDFile }}
+# systemd before 239 needs an absolute path
+ExecReload=/bin/sh -c "exec pkill -HUP -L -F {{ .PIDFile }}"
+PIDFile={{ .PIDFile }}
+LimitNOFILE={{ .FileDescriptorLimit }}
+
+[Install]
+WantedBy=multi-user.target
+`))
+
+// Flags specifies configuration parameters for a systemd unit file.
+type Flags struct {
+	// EnvironmentFile is the environment file path provided by the user.
+	EnvironmentFile string
+	// PIDFile is the process ID (PID) file path provided by the user.
+	PIDFile string
+	// FileDescriptorLimit is the maximum number of open file descriptors provided by the user.
+	FileDescriptorLimit int
+	// TeleportInstallationFile is the teleport installation path provided by the user.
+	TeleportInstallationFile string
+	// TeleportConfigPath is the path to the teleport config file (as set by Teleport defaults)
+	TeleportConfigPath string
+	// FIPS configures teleport to run in a FIPS compliant mode.
+	FIPS bool
+}
+
+// CheckAndSetDefaults checks and sets default values for the flags.
+func (f *Flags) CheckAndSetDefaults() error {
+	if f.TeleportInstallationFile == "" {
+		teleportPath, err := os.Readlink("/proc/self/exe")
+		if err != nil {
+			return trace.Wrap(err, "Can't find Teleport binary. Please specify the path.")
+		}
+		f.TeleportInstallationFile = teleportPath
+	}
+	// set Teleport config path to the default
+	if f.TeleportConfigPath == "" {
+		f.TeleportConfigPath = defaults.ConfigFilePath
+	}
+	return nil
+}
+
+// WriteUnitFile accepts flags and an io.Writer
+// and writes the systemd unit file configuration to it
+func WriteUnitFile(flags Flags, dest io.Writer) error {
+	err := flags.CheckAndSetDefaults()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(unitFileTemplate.Execute(dest, flags))
+}
diff --git a/lib/config/systemd_test.go b/lib/config/systemd/systemd_test.go
similarity index 89%
rename from lib/config/systemd_test.go
rename to lib/config/systemd/systemd_test.go
index 8283a861147f1..19b38aacb57bb 100644
--- a/lib/config/systemd_test.go
+++ b/lib/config/systemd/systemd_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package config
+package systemd
 
 import (
 	"bytes"
@@ -27,16 +27,17 @@ import (
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 )
 
-func TestWriteSystemdUnitFile(t *testing.T) {
-	flags := SystemdFlags{
+func TestWriteUnitFile(t *testing.T) {
+	flags := Flags{
 		EnvironmentFile:          "/custom/env/dir/teleport",
 		PIDFile:                  "/custom/pid/dir/teleport.pid",
 		FileDescriptorLimit:      16384,
 		TeleportInstallationFile: "/custom/install/dir/teleport",
+		FIPS:                     true,
 	}
 
 	stdout := new(bytes.Buffer)
-	err := WriteSystemdUnitFile(flags, stdout)
+	err := WriteUnitFile(flags, stdout)
 	require.NoError(t, err)
 	data := stdout.Bytes()
 	if golden.ShouldSet() {
diff --git a/lib/config/systemd/testdata/TestWriteUnitFile.golden b/lib/config/systemd/testdata/TestWriteUnitFile.golden
new file mode 100644
index 0000000000000..743fa77d0628b
--- /dev/null
+++ b/lib/config/systemd/testdata/TestWriteUnitFile.golden
@@ -0,0 +1,17 @@
+[Unit]
+Description=Teleport Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+EnvironmentFile=-/custom/env/dir/teleport
+ExecStart=/custom/install/dir/teleport start --fips --config /etc/teleport.yaml --pid-file=/custom/pid/dir/teleport.pid
+# systemd before 239 needs an absolute path
+ExecReload=/bin/sh -c "exec pkill -HUP -L -F /custom/pid/dir/teleport.pid"
+PIDFile=/custom/pid/dir/teleport.pid
+LimitNOFILE=16384
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/config/testdata/TestWriteSystemdUnitFile.golden b/lib/config/testdata/TestWriteSystemdUnitFile.golden
deleted file mode 100644
index 1d3283771b57d..0000000000000
--- a/lib/config/testdata/TestWriteSystemdUnitFile.golden
+++ /dev/null
@@ -1,17 +0,0 @@
-[Unit]
-Description=Teleport Service
-After=network.target
-
-[Service]
-Type=simple
-Restart=always
-RestartSec=5
-EnvironmentFile=-/custom/env/dir/teleport
-ExecStart=/custom/install/dir/teleport start --config /etc/teleport.yaml --pid-file=/custom/pid/dir/teleport.pid
-# systemd before 239 needs an absolute path
-ExecReload=/bin/sh -c "exec pkill -HUP -L -F /custom/pid/dir/teleport.pid"
-PIDFile=/custom/pid/dir/teleport.pid
-LimitNOFILE=16384
-
-[Install]
-WantedBy=multi-user.target
diff --git a/lib/config/testdata_test.go b/lib/config/testdata_test.go
index ba2d2d1bfdd62..5571fa08268c1 100644
--- a/lib/config/testdata_test.go
+++ b/lib/config/testdata_test.go
@@ -96,6 +96,7 @@ teleport:
   log:
     output: stderr
     severity: INFO
+  shutdown_delay: "7m35s"
   connection_limits:
     max_connections: 90
     max_users: 91
@@ -180,6 +181,7 @@ db_service:
       resource_groups: ["group1", "group2"]
       types: ["postgres", "mysql"]
       regions: ["eastus", "centralus"]
+      integration: integration123
       tags:
         "a": "b"
     - types: ["postgres", "mysql"]
diff --git a/lib/configurators/aws/aws.go b/lib/configurators/aws/aws.go
index 1902940426be9..4164c514f62ce 100644
--- a/lib/configurators/aws/aws.go
+++ b/lib/configurators/aws/aws.go
@@ -29,11 +29,11 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
-	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	ssmtypes "github.com/aws/aws-sdk-go-v2/service/ssm/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go"
 	"github.com/aws/smithy-go/tracing/smithyoteltracing"
 	"github.com/gravitational/trace"
 	"go.opentelemetry.io/otel"
@@ -42,10 +42,10 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	apiawsutils "github.com/gravitational/teleport/api/utils/aws"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	awsimds "github.com/gravitational/teleport/lib/cloud/imds/aws"
 	"github.com/gravitational/teleport/lib/configurators"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/secrets"
@@ -237,6 +237,20 @@ var (
 		},
 		requireSecretsManager: true,
 	}
+	elastiCacheServerlessActions = databaseActions{
+		discovery: []string{
+			"ec2:DescribeSubnets",
+			"elasticache:DescribeServerlessCaches",
+			"elasticache:ListTagsForResource",
+		},
+		metadata: []string{
+			"elasticache:DescribeServerlessCaches",
+		},
+		iamAuth: []string{
+			"elasticache:Connect",
+			"elasticache:DescribeUsers",
+		},
+	}
 	// memoryDBActions contains IAM actions for types.AWSMatcherMemoryDB.
 	memoryDBActions = databaseActions{
 		discovery: []string{
@@ -289,6 +303,9 @@ type awsConfigurator struct {
 	// actions list of the configurator actions, those are populated on the
 	// `build` function.
 	actions []configurators.ConfiguratorAction
+	// targetAccounts is a list of AWS account IDs that will be affected by
+	// configuration.
+	targetAccounts []string
 }
 
 type ConfiguratorConfig struct {
@@ -296,23 +313,73 @@ type ConfiguratorConfig struct {
 	Flags configurators.BootstrapFlags
 	// ServiceConfig Teleport database service config.
 	ServiceConfig *servicecfg.Config
-	// Policies instance of the `Policies` that the actions use.
-	Policies awslib.Policies
-	// Identity is the current AWS credentials chain identity.
-	Identity awslib.Identity
-
-	// awsCfg is the configuration used for AWS service clients.
-	awsCfg *aws.Config
-	// stsClient is an AWS STS client.
-	stsClient stsClient
-	// iamClient is an AWS IAM client.
-	iamClient iamClient
-	// ssmClients is a mapping of region -> AWS SSM client
-	ssmClients map[string]ssmClient
+	// awsConfigs is a cache of AWS configs.
+	awsConfigs *awsconfig.Cache
+	// identity is a cached AWS identity.
+	identity awslib.Identity
+	// getPolicies gets the AWS policy client for the specified assume role ARN
+	// and external ID. assumeRoleARN and externalID may be empty.
+	// Overridden in tests.
+	getPolicies func(ctx context.Context, assumeRoleARN, externalID string) (awslib.Policies, error)
+	// getIAMClient gets the AWS IAM client for the specified assume role ARN
+	// and external ID. assumeRoleARN and externalID may be empty.
+	// Overridden in tests.
+	getIAMClient func(ctx context.Context, assumeRoleARN, externalID string) (iamClient, error)
+	// getSSMClient gets the AWS SSM client for the specified assume role ARN,
+	// external ID, and region. assumeRoleARN and externalID may be empty.
+	// Overridden in tests.
+	getSSMClient func(ctx context.Context, region, assumeRoleARN, externalID string) (ssmClient, error)
+}
+
+// getAWSConfig gets the cached AWS config for the specified assume role ARN
+// and external ID. assumeRoleARN and externalID may be empty.
+func (c *ConfiguratorConfig) getAWSConfig(ctx context.Context, assumeRoleARN, externalID string) (aws.Config, error) {
+	if c.Flags.Manual {
+		return aws.Config{}, trace.BadParameter("GetAWSConfig not allowed in manual mode")
+	}
+	cfg, err := c.awsConfigs.GetConfig(
+		ctx,
+		"", /* get region from env > profile > fallback func */
+		awsconfig.WithFallbackRegionResolver(func(ctx context.Context) (string, error) {
+			return getFallbackRegion(ctx, os.Stdout, nil), nil
+		}),
+		awsconfig.WithAmbientCredentials(),
+		awsconfig.WithAssumeRole(assumeRoleARN, externalID),
+	)
+	if err != nil {
+		return aws.Config{}, trace.Wrap(err)
+	}
+	return cfg, nil
 }
 
-type stsClient interface {
-	GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error)
+// getIdentity gets the cached AWS identity for the specified assume role ARN
+// and external ID. assumeRoleARN and externalID may be empty.
+func (c *ConfiguratorConfig) getIdentity(ctx context.Context, assumeRoleARN, externalID string) (awslib.Identity, error) {
+	// Assumed roles can be determined from the ARN.
+	if assumeRoleARN != "" {
+		identity, err := awslib.IdentityFromArn(assumeRoleARN)
+		return identity, trace.Wrap(err)
+	}
+	// Return a placeholder in manual mode.
+	if c.Flags.Manual {
+		identity, err := awslib.IdentityFromArn(buildIAMARN(targetIdentityARNSectionPlaceholder, targetIdentityARNSectionPlaceholder, "user", defaultAttachUser))
+		return identity, trace.Wrap(err)
+	}
+	// Check cache.
+	if c.identity != nil {
+		return c.identity, nil
+	}
+	// Fetch identity.
+	awsCfg, err := c.getAWSConfig(ctx, assumeRoleARN, externalID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	identity, err := awslib.GetIdentityWithClient(ctx, getSTSClient(awsCfg))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	c.identity = identity
+	return identity, nil
 }
 
 type iamClient interface {
@@ -323,6 +390,12 @@ type ssmClient interface {
 	CreateDocument(ctx context.Context, params *ssm.CreateDocumentInput, optFns ...func(*ssm.Options)) (*ssm.CreateDocumentOutput, error)
 }
 
+func getSTSClient(cfg aws.Config) *sts.Client {
+	return stsutils.NewFromConfig(cfg, func(o *sts.Options) {
+		o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
+	})
+}
+
 type localRegionGetter interface {
 	GetRegion(context.Context) (string, error)
 }
@@ -360,103 +433,114 @@ To avoid seeing this warning, please provide a region in your AWS config or thro
 
 // CheckAndSetDefaults checks and set configuration default values.
 func (c *ConfiguratorConfig) CheckAndSetDefaults() error {
-	ctx := context.Background()
 	if c.ServiceConfig == nil {
 		return trace.BadParameter("config file is required")
 	}
-
-	useFIPSEndpoint := aws.FIPSEndpointStateUnset
-	if modules.GetModules().IsBoringBinary() {
-		useFIPSEndpoint = aws.FIPSEndpointStateEnabled
+	if c.awsConfigs == nil {
+		cache, err := awsconfig.NewCache()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		c.awsConfigs = cache
 	}
-
-	// When running the command in manual mode, we want to have zero dependency
-	// with AWS configurations (like awscli or environment variables), so that
-	// the user can run this command and generate the instructions without any
-	// pre-requisite.
-	if !c.Flags.Manual {
-		var err error
-
-		if c.awsCfg == nil {
-			cfg, err := config.LoadDefaultConfig(ctx,
-				config.WithUseFIPSEndpoint(useFIPSEndpoint),
-			)
+	if c.getPolicies == nil {
+		c.getPolicies = func(ctx context.Context, assumeRoleARN, externalID string) (awslib.Policies, error) {
+			awsCfg, err := c.getAWSConfig(ctx, assumeRoleARN, externalID)
 			if err != nil {
-				return trace.Wrap(err)
+				return nil, trace.Wrap(err)
 			}
-
-			if cfg.Region == "" {
-				cfg.Region = getFallbackRegion(ctx, os.Stdout, nil)
+			identity, err := c.getIdentity(ctx, assumeRoleARN, externalID)
+			if err != nil {
+				return nil, trace.Wrap(err)
 			}
-			c.awsCfg = &cfg
-		}
-
-		if c.stsClient == nil {
-			c.stsClient = stsutils.NewFromConfig(*c.awsCfg, func(o *sts.Options) {
+			iamClient := iamutils.NewFromConfig(awsCfg, func(o *iam.Options) {
 				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
 			})
-
+			partition := identity.GetPartition()
+			accountID := identity.GetAccountID()
+			return awslib.NewPolicies(partition, accountID, iamClient), nil
 		}
-		if c.iamClient == nil {
-			c.iamClient = iamutils.NewFromConfig(*c.awsCfg, func(o *iam.Options) {
+	}
+	if c.getIAMClient == nil {
+		c.getIAMClient = func(ctx context.Context, assumeRoleARN, externalID string) (iamClient, error) {
+			awsCfg, err := c.getAWSConfig(ctx, assumeRoleARN, externalID)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return iamutils.NewFromConfig(awsCfg, func(o *iam.Options) {
 				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
-			})
+			}), nil
 		}
-		if c.Identity == nil {
-			c.Identity, err = awslib.GetIdentityWithClient(context.Background(), c.stsClient)
+	}
+	if c.getSSMClient == nil {
+		c.getSSMClient = func(ctx context.Context, region, assumeRoleARN, externalID string) (ssmClient, error) {
+			awsCfg, err := c.getAWSConfig(ctx, assumeRoleARN, externalID)
 			if err != nil {
-				return trace.Wrap(err)
+				return nil, trace.Wrap(err)
 			}
+			return ssm.NewFromConfig(awsCfg, func(o *ssm.Options) {
+				o.Region = region
+				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
+			}), nil
 		}
+	}
+	return nil
+}
 
-		if c.ssmClients == nil {
-			c.ssmClients = make(map[string]ssmClient)
-			for _, matcher := range c.ServiceConfig.Discovery.AWSMatchers {
-				if !slices.Contains(matcher.Types, types.AWSMatcherEC2) {
-					continue
-				}
-				for _, region := range matcher.Regions {
-					if _, ok := c.ssmClients[region]; ok {
-						continue
-					}
-					withRegion := func(o *ssm.Options) {
-						o.Region = region
-					}
-					c.ssmClients[region] = ssm.NewFromConfig(*c.awsCfg, withRegion, func(o *ssm.Options) {
-						o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
-					})
-				}
-			}
-
-		}
+// getDistinctAssumedRoles gets a list of the distinct roles that can be assumed
+// from the AWS matchers. If there are no AWS matchers, one AssumeRole
+// is returned for the current identity.
+func (c *ConfiguratorConfig) getDistinctAssumedRoles() []types.AssumeRole {
+	defaultAssumeRole := types.AssumeRole{
+		RoleARN:    c.Flags.AssumeRoleARN,
+		ExternalID: c.Flags.ExternalID,
+	}
+	matchers := awsMatchersFromConfig(c.Flags, c.ServiceConfig)
+	if len(matchers) == 0 {
+		return []types.AssumeRole{defaultAssumeRole}
+	}
 
-		if c.Policies == nil {
-			partition := c.Identity.GetPartition()
-			accountID := c.Identity.GetAccountID()
-			iamClient := iamutils.NewFromConfig(*c.awsCfg, func(o *iam.Options) {
-				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
-			})
-			c.Policies = awslib.NewPolicies(partition, accountID, iamClient)
+	assumedRoles := make([]types.AssumeRole, 0, len(matchers))
+	for _, matcher := range matchers {
+		if ar := matcher.AssumeRole; ar == nil {
+			assumedRoles = append(assumedRoles, defaultAssumeRole)
+		} else {
+			assumedRoles = append(assumedRoles, *ar)
 		}
 	}
-
-	return nil
+	return apiutils.DeduplicateAny(assumedRoles, func(ar1, ar2 types.AssumeRole) bool {
+		return ar1.RoleARN == ar2.RoleARN && ar1.ExternalID == ar2.ExternalID
+	})
 }
 
 // NewAWSConfigurator creates an instance of awsConfigurator and builds its
 // actions.
-func NewAWSConfigurator(config ConfiguratorConfig) (configurators.Configurator, error) {
+func NewAWSConfigurator(ctx context.Context, config ConfiguratorConfig) (configurators.Configurator, error) {
 	err := config.CheckAndSetDefaults()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	actions, err := buildActions(config)
+	actions, err := buildActions(ctx, config)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &awsConfigurator{config, actions}, nil
+	assumedRoles := config.getDistinctAssumedRoles()
+	targetAccounts := make([]string, 0, len(assumedRoles))
+	for _, ar := range assumedRoles {
+		identity, err := config.getIdentity(ctx, ar.RoleARN, ar.ExternalID)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		targetAccounts = append(targetAccounts, identity.GetAccountID())
+	}
+
+	return &awsConfigurator{
+		config:         config,
+		actions:        actions,
+		targetAccounts: apiutils.Deduplicate(targetAccounts),
+	}, nil
 }
 
 // IsEmpty checks if the configurator has no actions.
@@ -471,7 +555,7 @@ func (a *awsConfigurator) Name() string {
 
 // Description returns a brief description of the configurator.
 func (a *awsConfigurator) Description() string {
-	return "Configure AWS for " + a.config.Flags.Service.Name()
+	return fmt.Sprintf("Configure AWS for %s for accounts: [%s]", a.config.Flags.Service.Name(), strings.Join(a.targetAccounts, ", "))
 }
 
 // Actions list of configurator actions.
@@ -488,11 +572,13 @@ type awsPolicyCreator struct {
 	policy *awslib.Policy
 	// formattedPolicy human-readable representation of the policy document.
 	formattedPolicy string
+	// accountID is the account that the policy will be created in.
+	accountID string
 }
 
 // Description returns what the action will perform.
 func (a *awsPolicyCreator) Description() string {
-	return fmt.Sprintf("Create IAM Policy %q", a.policy.Name)
+	return fmt.Sprintf("[%s] Create IAM Policy %q", a.accountID, a.policy.Name)
 }
 
 // Details returns the policy document that will be created.
@@ -525,7 +611,7 @@ type awsPoliciesAttacher struct {
 
 // Description returns what the action will perform.
 func (a *awsPoliciesAttacher) Description() string {
-	return fmt.Sprintf("Attach IAM policies to %q", a.target.GetName())
+	return fmt.Sprintf("[%s] Attach IAM policies to %q", a.target.GetAccountID(), a.target.GetName())
 }
 
 // Details attacher doesn't have any extra detail, this function returns an
@@ -553,8 +639,8 @@ func (a *awsPoliciesAttacher) Execute(ctx context.Context, actionCtx *configurat
 	return nil
 }
 
-func buildDiscoveryActions(config ConfiguratorConfig, targetCfg targetConfig) ([]configurators.ConfiguratorAction, error) {
-	actions, err := buildCommonActions(config, targetCfg)
+func buildDiscoveryActions(ctx context.Context, config ConfiguratorConfig, targetCfg targetConfig) ([]configurators.ConfiguratorAction, error) {
+	actions, err := buildCommonActions(ctx, config, targetCfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -564,11 +650,16 @@ func buildDiscoveryActions(config ConfiguratorConfig, targetCfg targetConfig) ([
 		return nil, err
 	}
 
-	actions = append(actions, buildSSMDocumentCreators(config.ssmClients, targetCfg, proxyAddr)...)
+	ssmActions, err := buildSSMDocumentCreators(ctx, config, targetCfg, proxyAddr)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	actions = append(actions, ssmActions...)
 	return actions, nil
 }
 
-func buildCommonActions(config ConfiguratorConfig, targetCfg targetConfig) ([]configurators.ConfiguratorAction, error) {
+func buildCommonActions(ctx context.Context, config ConfiguratorConfig, targetCfg targetConfig) ([]configurators.ConfiguratorAction, error) {
 	// Generate policies.
 	policy, err := buildPolicyDocument(config.Flags, targetCfg)
 	if err != nil {
@@ -587,81 +678,132 @@ func buildCommonActions(config ConfiguratorConfig, targetCfg targetConfig) ([]co
 		return nil, trace.Wrap(err)
 	}
 	var actions []configurators.ConfiguratorAction
+	var policies awslib.Policies
+	if !config.Flags.Manual {
+		policies, err = config.getPolicies(ctx, targetCfg.assumeRole.RoleARN, targetCfg.assumeRole.ExternalID)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
 
 	// Create IAM Policy.
 	actions = append(actions, &awsPolicyCreator{
-		policies:        config.Policies,
+		policies:        policies,
 		policy:          policy,
 		formattedPolicy: formattedPolicy,
+		accountID:       targetCfg.identity.GetAccountID(),
 	})
 
 	// Attach the policy to the target.
-	actions = append(actions, &awsPoliciesAttacher{policies: config.Policies, target: targetCfg.identity})
+	actions = append(actions, &awsPoliciesAttacher{policies: policies, target: targetCfg.identity})
 	return actions, nil
 }
 
 // buildActions generates the policy documents and configurator actions.
-func buildActions(config ConfiguratorConfig) ([]configurators.ConfiguratorAction, error) {
-	// Identity is going to be empty (`nil`) when running the command on
-	// `Manual` mode, place a wildcard to keep the generated policies valid.
-	accountID := targetIdentityARNSectionPlaceholder
-	partitionID := targetIdentityARNSectionPlaceholder
-	if config.Identity != nil {
-		accountID = config.Identity.GetAccountID()
-		partitionID = config.Identity.GetPartition()
-	}
-
-	// Define the target and target type.
-	target, err := policiesTarget(config.Flags, accountID, partitionID, config.Identity, config.iamClient)
-	if err != nil {
-		return nil, trace.Wrap(err)
+func buildActions(ctx context.Context, config ConfiguratorConfig) ([]configurators.ConfiguratorAction, error) {
+	var allActions []configurators.ConfiguratorAction
+	for _, assumeRole := range config.getDistinctAssumedRoles() {
+		target, err := policiesTarget(ctx, config, assumeRole)
+		if err != nil {
+			var unreachableErr unreachablePolicyTargetError
+			if errors.As(err, &unreachableErr) {
+				fmt.Printf("⚠️ Skipping matchers with identity %q: %s\n", unreachableErr.from.GetName(), unreachableErr.Error())
+				continue
+			}
+			return nil, trace.Wrap(err)
+		}
+		targetCfg, err := getTargetConfig(config.Flags, config.ServiceConfig, target, assumeRole)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		var actions []configurators.ConfiguratorAction
+		if config.Flags.Service.IsDiscovery() {
+			actions, err = buildDiscoveryActions(ctx, config, targetCfg)
+		} else {
+			actions, err = buildCommonActions(ctx, config, targetCfg)
+		}
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		allActions = append(allActions, actions...)
 	}
 
-	targetCfg, err := getTargetConfig(config.Flags, config.ServiceConfig, target)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+	return allActions, nil
+}
 
-	if config.Flags.Service.IsDiscovery() {
-		return buildDiscoveryActions(config, targetCfg)
-	}
-	return buildCommonActions(config, targetCfg)
+// unreachablePolicyTargetError indicates that a target identity could not be
+// accessed from another identity (typically due to them being in different
+// accounts).
+type unreachablePolicyTargetError struct {
+	target awslib.Identity
+	from   awslib.Identity
+}
+
+func (e unreachablePolicyTargetError) Error() string {
+	return fmt.Sprintf(
+		"policy target %q is unreachable from assumed role %q",
+		e.target, e.from,
+	)
 }
 
 // policiesTarget defines which target and its type the policies will be
 // attached to.
-func policiesTarget(flags configurators.BootstrapFlags, accountID string, partitionID string, identity awslib.Identity, iamClient iamClient) (awslib.Identity, error) {
-	if flags.AttachToUser != "" {
-		userArn := flags.AttachToUser
-		if !arn.IsARN(flags.AttachToUser) {
-			userArn = buildIAMARN(partitionID, accountID, "user", flags.AttachToUser)
-		}
-
-		return awslib.IdentityFromArn(userArn)
+func policiesTarget(ctx context.Context, config ConfiguratorConfig, targetAssumeRole types.AssumeRole) (awslib.Identity, error) {
+	baseIdentity, err := config.getIdentity(ctx, targetAssumeRole.RoleARN, targetAssumeRole.ExternalID)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
+	defaultPartitionID := baseIdentity.GetPartition()
+	defaultAccountID := baseIdentity.GetAccountID()
 
-	if flags.AttachToRole != "" {
-		roleArn := flags.AttachToRole
-		if !arn.IsARN(flags.AttachToRole) {
-			roleArn = buildIAMARN(partitionID, accountID, "role", flags.AttachToRole)
+	// Attach to user if provided.
+	attachToUser := config.Flags.AttachToUser
+	if attachToUser != "" {
+		userArn := attachToUser
+		if !arn.IsARN(attachToUser) {
+			userArn = buildIAMARN(defaultPartitionID, defaultAccountID, "user", attachToUser)
 		}
-
-		return awslib.IdentityFromArn(roleArn)
+		userIdentity, err := awslib.IdentityFromArn(userArn)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if defaultAccountID != userIdentity.GetAccountID() {
+			return nil, unreachablePolicyTargetError{target: userIdentity, from: baseIdentity}
+		}
+		return userIdentity, nil
 	}
 
-	if identity == nil {
-		return awslib.IdentityFromArn(buildIAMARN(partitionID, accountID, "user", defaultAttachUser))
+	// Attach to role if provided.
+	attachToRole := config.Flags.AttachToRole
+	if attachToRole != "" {
+		roleArn := attachToRole
+		if !arn.IsARN(attachToRole) {
+			roleArn = buildIAMARN(defaultPartitionID, defaultAccountID, "role", attachToRole)
+		}
+		roleIdentity, err := awslib.IdentityFromArn(roleArn)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if defaultAccountID != roleIdentity.GetAccountID() {
+			return nil, unreachablePolicyTargetError{target: roleIdentity, from: baseIdentity}
+		}
+		return roleIdentity, nil
 	}
 
-	if identity.GetType() == awslib.ResourceTypeAssumedRole {
-		roleIdentity, err := getRoleARNForAssumedRole(iamClient, identity)
+	// Attach to current identity.
+	if baseIdentity.GetType() == awslib.ResourceTypeAssumedRole {
+		baseIAMClient, err := config.getIAMClient(ctx, targetAssumeRole.RoleARN, targetAssumeRole.ExternalID)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		roleIdentity, err := getRoleARNForAssumedRole(baseIAMClient, baseIdentity)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		return roleIdentity, nil
 	}
 
-	return identity, nil
+	return baseIdentity, nil
 }
 
 // buildIAMARN constructs an AWS IAM ARN string from the given partition,
@@ -684,11 +826,18 @@ func buildIAMARN(partitionID, accountID, resourceType, resource string) string {
 // which is necessary to attach policies to the identity.
 // Rather than returning errors about why it failed, this message suggests a
 // simple fix for the user to specify a role or user to attach policies to.
-func failedToResolveAssumeRoleARN(roleIdentity string) string {
-	return fmt.Sprintf("running with assumed-role credentials for %s, but "+
-		"policies cannot be attached to an assumed-role; "+
-		"provide the name or ARN of an IAM role (--attach-to-role) or user (--attach-to-user) to attach policies to",
-		roleIdentity)
+func failedToResolveAssumeRoleARN(roleIdentity string, missingPermissions bool) string {
+	solutions := []string{
+		"- provide the name or ARN of an IAM role (--attach-to-role) or user (--attach-to-user) to attach policies to",
+	}
+	if missingPermissions {
+		solutions = append(solutions, fmt.Sprintf("- ensure %s has the iam:GetRole permission", roleIdentity))
+	}
+	return fmt.Sprintf(
+		"could not resolve assumed-role %s to a full role ARN. To resolve, do one of the following:\n%s",
+		roleIdentity, strings.Join(solutions, "\n"),
+	)
+
 }
 
 // getRoleARNForAssumedRole attempts to resolve assumed-role credentials to
@@ -696,18 +845,24 @@ func failedToResolveAssumeRoleARN(roleIdentity string) string {
 // This is necessary since the assumed-role ARN does not include the role path,
 // so we cannot reliably reconstruct the role ARN from the assumed-role ARN.
 func getRoleARNForAssumedRole(iamClient iamClient, identity awslib.Identity) (awslib.Identity, error) {
-	failedToResolveAssumeRoleARN := failedToResolveAssumeRoleARN(identity.GetName())
-
+	if iamClient == nil {
+		return nil, trace.BadParameter("missing iamClient")
+	}
 	out, err := iamClient.GetRole(context.Background(), &iam.GetRoleInput{
 		RoleName: aws.String(identity.GetName()),
 	})
 	if err != nil || out == nil || out.Role == nil || out.Role.Arn == nil {
-		return nil, trace.BadParameter("%s", failedToResolveAssumeRoleARN)
+		var apiErr smithy.APIError
+		var missingPermissions bool
+		if errors.As(err, &apiErr) {
+			missingPermissions = apiErr.ErrorCode() == "AccessDenied"
+		}
+		return nil, trace.BadParameter("%s", failedToResolveAssumeRoleARN(identity.GetName(), missingPermissions))
 	}
 
 	roleIdentity, err := awslib.IdentityFromArn(*out.Role.Arn)
 	if err != nil {
-		return nil, trace.BadParameter("%s", failedToResolveAssumeRoleARN)
+		return nil, trace.BadParameter("%s", failedToResolveAssumeRoleARN(identity.GetName(), false))
 	}
 	return roleIdentity, nil
 }
@@ -745,6 +900,9 @@ func buildPolicyDocument(flags configurators.BootstrapFlags, targetCfg targetCon
 	if hasElastiCacheDatabases(flags, targetCfg) {
 		allActions = append(allActions, elastiCacheActions)
 	}
+	if hasElastiCacheServerlessDatabases(flags, targetCfg) {
+		allActions = append(allActions, elastiCacheServerlessActions)
+	}
 	if hasMemoryDBDatabases(flags, targetCfg) {
 		allActions = append(allActions, memoryDBActions)
 	}
@@ -820,22 +978,35 @@ func getProxyAddrFromConfig(cfg *servicecfg.Config, flags configurators.Bootstra
 	return "", trace.NotFound("proxy address not found, please provide --proxy, or set either teleport.proxy_server or proxy_service.public_addr in the teleport config")
 }
 
-func buildSSMDocumentCreators(ssm map[string]ssmClient, targetCfg targetConfig, proxyAddr string) []configurators.ConfiguratorAction {
+func buildSSMDocumentCreators(ctx context.Context, config ConfiguratorConfig, targetCfg targetConfig, proxyAddr string) ([]configurators.ConfiguratorAction, error) {
 	var creators []configurators.ConfiguratorAction
 	for _, matcher := range targetCfg.awsMatchers {
 		if !slices.Contains(matcher.Types, types.AWSMatcherEC2) {
 			continue
 		}
+		// If using the pre-defined AWS-RunShellScript document, skip SSM document creation.
+		if matcher.SSM.DocumentName == types.AWSSSMDocumentRunShellScript {
+			continue
+		}
 		for _, region := range matcher.Regions {
+			var ssmClient ssmClient
+			if !config.Flags.Manual {
+				var err error
+				ssmClient, err = config.getSSMClient(ctx, region, targetCfg.assumeRole.RoleARN, targetCfg.assumeRole.ExternalID)
+				if err != nil {
+					return nil, trace.Wrap(err)
+				}
+			}
 			ssmCreator := awsSSMDocumentCreator{
-				ssm:      ssm[region],
-				Name:     matcher.SSM.DocumentName,
-				Contents: awslib.EC2DiscoverySSMDocument(proxyAddr),
+				ssm:       ssmClient,
+				Name:      matcher.SSM.DocumentName,
+				Contents:  awslib.EC2DiscoverySSMDocument(proxyAddr),
+				accountID: targetCfg.identity.GetAccountID(),
 			}
 			creators = append(creators, &ssmCreator)
 		}
 	}
-	return creators
+	return creators, nil
 }
 
 func isEC2AutoDiscoveryEnabled(flags configurators.BootstrapFlags, matchers []types.AWSMatcher) bool {
@@ -895,6 +1066,16 @@ func hasElastiCacheDatabases(flags configurators.BootstrapFlags, targetCfg targe
 		findEndpointIs(targetCfg.databases, apiawsutils.IsElastiCacheEndpoint)
 }
 
+// hasElastiCacheServerlessDatabases checks if the agent needs permission for
+// ElastiCache serverless databases.
+func hasElastiCacheServerlessDatabases(flags configurators.BootstrapFlags, targetCfg targetConfig) bool {
+	if flags.ForceElastiCacheServerlessPermissions {
+		return true
+	}
+	return isAutoDiscoveryEnabledForMatcher(types.AWSMatcherElastiCacheServerless, targetCfg.awsMatchers) ||
+		findEndpointIs(targetCfg.databases, apiawsutils.IsElastiCacheServerlessEndpoint)
+}
+
 // hasMemoryDBDatabases checks if the agent needs permission for
 // ElastiCache databases.
 func hasMemoryDBDatabases(flags configurators.BootstrapFlags, targetCfg targetConfig) bool {
@@ -1124,14 +1305,15 @@ func buildARN(target awslib.Identity, service, resource string) string {
 }
 
 type awsSSMDocumentCreator struct {
-	Contents string
-	ssm      ssmClient
-	Name     string
+	Contents  string
+	ssm       ssmClient
+	Name      string
+	accountID string
 }
 
 // Description returns what the action will perform.
 func (a *awsSSMDocumentCreator) Description() string {
-	return fmt.Sprintf("Create SSM Document %q", a.Name)
+	return fmt.Sprintf("[%s] Create SSM Document %q", a.accountID, a.Name)
 }
 
 // Details returns the policy document that will be created.
@@ -1141,6 +1323,9 @@ func (a *awsSSMDocumentCreator) Details() string {
 
 // Execute upserts the policy and store its ARN in the action context.
 func (a *awsSSMDocumentCreator) Execute(ctx context.Context, actionCtx *configurators.ConfiguratorActionContext) error {
+	if a.ssm == nil {
+		return trace.BadParameter("ssm client not initialized")
+	}
 	_, err := a.ssm.CreateDocument(ctx, &ssm.CreateDocumentInput{
 		Content:        aws.String(a.Contents),
 		Name:           aws.String(a.Name),
@@ -1166,6 +1351,8 @@ func (a *awsSSMDocumentCreator) Execute(ctx context.Context, actionCtx *configur
 type targetConfig struct {
 	// identity is the target identity.
 	identity awslib.Identity
+	// assumeRole is the role that should be assumed while configuring the target, if any.
+	assumeRole types.AssumeRole
 	// awsMatchers are the AWS matchers associated with the target identity.
 	awsMatchers []types.AWSMatcher
 	// databases are the databases associated with the target identity.
@@ -1177,7 +1364,7 @@ type targetConfig struct {
 
 // getTargetConfig gets the resources that are relevant to the target identity
 // from cli flags and file configuration.
-func getTargetConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config, target awslib.Identity) (targetConfig, error) {
+func getTargetConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config, target awslib.Identity, assumeRole types.AssumeRole) (targetConfig, error) {
 	forcedRoles, err := parseForcedAWSRoles(flags, target)
 	if err != nil {
 		return targetConfig{}, trace.Wrap(err)
@@ -1193,6 +1380,7 @@ func getTargetConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config,
 	}
 	return targetConfig{
 		identity:        target,
+		assumeRole:      assumeRole,
 		awsMatchers:     matchersForTarget(awsMatchers, target, targetIsAssumeRole),
 		databases:       databasesForTarget(databases, target, targetIsAssumeRole),
 		assumesAWSRoles: targetAssumesRoles,
diff --git a/lib/configurators/aws/aws_test.go b/lib/configurators/aws/aws_test.go
index c0b34dffaad2e..8cad8cee55a48 100644
--- a/lib/configurators/aws/aws_test.go
+++ b/lib/configurators/aws/aws_test.go
@@ -31,10 +31,11 @@ import (
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	ssmtypes "github.com/aws/aws-sdk-go-v2/service/ssm/types"
-	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -53,7 +54,67 @@ var sortStringsTrans = cmp.Transformer("SortStrings", func(in []string) []string
 	return out
 })
 
+func TestGetIdentity(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		config         ConfiguratorConfig
+		roleARN        string
+		externalID     string
+		assert         assert.ErrorAssertionFunc
+		expectIdentity awslib.Identity
+	}{
+		{
+			name: "identity from assume role",
+			config: ConfiguratorConfig{
+				Flags: configurators.BootstrapFlags{
+					Manual: true,
+				},
+				identity: identityFromArn(t, "arn:aws:iam::123456789012:role/not-this-one"),
+			},
+			roleARN:        "arn:aws:iam::123456789012:role/example-role",
+			externalID:     "foobar",
+			assert:         assert.NoError,
+			expectIdentity: identityFromArn(t, "arn:aws:iam::123456789012:role/example-role"),
+		},
+		{
+			name: "placeholder identity in manual mode",
+			config: ConfiguratorConfig{
+				Flags: configurators.BootstrapFlags{
+					Manual: true,
+				},
+				identity: identityFromArn(t, "arn:aws:iam::123456789012:role/not-this-one"),
+			},
+			assert:         assert.NoError,
+			expectIdentity: identityFromArn(t, buildIAMARN(targetIdentityARNSectionPlaceholder, targetIdentityARNSectionPlaceholder, "user", defaultAttachUser)),
+		},
+		{
+			name: "cached identity",
+			config: ConfiguratorConfig{
+				identity: identityFromArn(t, "arn:aws:iam::123456789012:role/example-role"),
+			},
+			assert:         assert.NoError,
+			expectIdentity: identityFromArn(t, "arn:aws:iam::123456789012:role/example-role"),
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			identity, err := tc.config.getIdentity(t.Context(), tc.roleARN, tc.externalID)
+			tc.assert(t, err)
+			if tc.expectIdentity == nil {
+				assert.Nil(t, identity)
+				return
+			}
+			if assert.NotNil(t, identity) {
+				assert.Equal(t, tc.expectIdentity.String(), identity.String())
+				assert.Equal(t, tc.expectIdentity.GetType(), identity.GetType())
+			}
+		})
+	}
+}
+
 func TestAWSIAMDocuments(t *testing.T) {
+	t.Parallel()
 	userTarget, err := awslib.IdentityFromArn("arn:aws:iam::123456789012:user/example-user")
 	require.NoError(t, err)
 
@@ -218,6 +279,28 @@ func TestAWSIAMDocuments(t *testing.T) {
 				},
 			},
 		},
+		"ElastiCache Serverless auto discovery": {
+			target: roleTarget,
+			fileConfig: &config.FileConfig{
+				Databases: config.Databases{
+					Service: config.Service{EnabledFlag: "true"},
+					AWSMatchers: []config.AWSMatcher{
+						{Types: []string{types.AWSMatcherElastiCacheServerless}, Regions: []string{"us-west-1"}},
+					},
+				},
+			},
+			statements: []*awslib.Statement{
+				{
+					Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
+						"ec2:DescribeSubnets",
+						"elasticache:Connect",
+						"elasticache:DescribeServerlessCaches",
+						"elasticache:DescribeUsers",
+						"elasticache:ListTagsForResource",
+					},
+				},
+			},
+		},
 		"ElastiCache static database": {
 			target: roleTarget,
 			fileConfig: &config.FileConfig{
@@ -275,6 +358,32 @@ func TestAWSIAMDocuments(t *testing.T) {
 				},
 			},
 		},
+		"ElastiCache Serverless static database": {
+			target: roleTarget,
+			fileConfig: &config.FileConfig{
+				Databases: config.Databases{
+					Service: config.Service{EnabledFlag: "true"},
+					Databases: []*config.Database{
+						{
+							Name:     "serverless-redis",
+							Protocol: "redis",
+							URI:      "example-abc123.serverless.cac1.cache.amazonaws.com:6379",
+						},
+					},
+				},
+			},
+			statements: []*awslib.Statement{
+				{
+					Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
+						"ec2:DescribeSubnets",
+						"elasticache:Connect",
+						"elasticache:DescribeServerlessCaches",
+						"elasticache:DescribeUsers",
+						"elasticache:ListTagsForResource",
+					},
+				},
+			},
+		},
 		"MemoryDB auto discovery": {
 			target: roleTarget,
 			fileConfig: &config.FileConfig{
@@ -387,6 +496,7 @@ func TestAWSIAMDocuments(t *testing.T) {
 				{
 					Effect: "Allow",
 					Actions: []string{
+						"account:ListRegions",
 						"ec2:DescribeInstances",
 						"ssm:DescribeInstanceInformation",
 						"ssm:GetCommandInvocation",
@@ -768,6 +878,27 @@ func TestAWSIAMDocuments(t *testing.T) {
 					},
 				},
 			},
+			"ElastiCache Serverless": {
+				fileConfig: &config.FileConfig{
+					Discovery: config.Discovery{
+						Service: config.Service{EnabledFlag: "true"},
+						AWSMatchers: []config.AWSMatcher{
+							{Types: []string{types.AWSMatcherElastiCacheServerless}, Regions: []string{"us-west-2"}},
+						},
+					},
+				},
+				statements: []*awslib.Statement{
+					{
+						Effect:    awslib.EffectAllow,
+						Resources: awslib.SliceOrString{"*"},
+						Actions: awslib.SliceOrString{
+							"ec2:DescribeSubnets",
+							"elasticache:ListTagsForResource",
+							"elasticache:DescribeServerlessCaches",
+						},
+					},
+				},
+			},
 			"MemoryDB": {
 				fileConfig: &config.FileConfig{
 					Discovery: config.Discovery{
@@ -971,6 +1102,27 @@ func TestAWSIAMDocuments(t *testing.T) {
 					},
 				},
 			},
+			"ElastiCache Serverless": {
+				fileConfig: &config.FileConfig{
+					Discovery: config.Discovery{
+						Service: config.Service{EnabledFlag: "true"},
+						AWSMatchers: []config.AWSMatcher{
+							{Types: []string{types.AWSMatcherElastiCacheServerless}, Regions: []string{"us-east-2"}},
+						},
+					},
+				},
+				statements: []*awslib.Statement{
+					{
+						Effect:    awslib.EffectAllow,
+						Resources: []string{"*"},
+						Actions: []string{
+							"elasticache:Connect",
+							"elasticache:DescribeServerlessCaches",
+							"elasticache:DescribeUsers",
+						},
+					},
+				},
+			},
 			"MemoryDB": {
 				fileConfig: &config.FileConfig{
 					Discovery: config.Discovery{
@@ -1086,7 +1238,7 @@ func mustGetTargetConfig(t *testing.T, flags configurators.BootstrapFlags, roleT
 	require.NoError(t, fileConfig.CheckAndSetDefaults())
 	serviceCfg := servicecfg.MakeDefaultConfig()
 	require.NoError(t, config.ApplyFileConfig(fileConfig, serviceCfg))
-	targetCfg, err := getTargetConfig(flags, serviceCfg, roleTarget)
+	targetCfg, err := getTargetConfig(flags, serviceCfg, roleTarget, types.AssumeRole{})
 	require.NoError(t, err)
 	return targetCfg
 }
@@ -1100,7 +1252,8 @@ func mustBuildPolicyDocument(t *testing.T, flags configurators.BootstrapFlags, t
 }
 
 func TestAWSPolicyCreator(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+	ctx := t.Context()
 
 	tests := map[string]struct {
 		returnError bool
@@ -1138,7 +1291,8 @@ func TestAWSPolicyCreator(t *testing.T) {
 }
 
 func TestAWSPoliciesAttacher(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+	ctx := t.Context()
 	userTarget, err := awslib.IdentityFromArn("arn:aws:iam::1234567:user/example-user")
 	require.NoError(t, err)
 
@@ -1197,33 +1351,56 @@ func TestAWSPoliciesAttacher(t *testing.T) {
 	}
 }
 
-func TestAWSPoliciesTarget(t *testing.T) {
-	userIdentity, err := awslib.IdentityFromArn("arn:aws:iam::123456789012:user/example-user")
-	require.NoError(t, err)
+func makeIAMClientGetter(expectedRoleARN, expectedExternalID string, clt iamClient) func(ctx context.Context, assumeRoleARN, externalID string) (iamClient, error) {
+	return func(ctx context.Context, assumeRoleARN, externalID string) (iamClient, error) {
+		if assumeRoleARN != expectedRoleARN || externalID != expectedExternalID {
+			return nil, trace.NotFound("no IAM client for assume role %q with external ID %q", expectedRoleARN, expectedExternalID)
+		}
+		return clt, nil
+	}
+}
 
-	roleIdentity, err := awslib.IdentityFromArn("arn:aws:iam::123456789012:role/example-role")
-	require.NoError(t, err)
+func makePoliciesGetter(expectedRoleARN, expectedExternalID string, policies awslib.Policies) func(ctx context.Context, assumeRoleARN, externalID string) (awslib.Policies, error) {
+	return func(ctx context.Context, assumeRoleARN, externalID string) (awslib.Policies, error) {
+		if assumeRoleARN != expectedRoleARN || externalID != expectedExternalID {
+			return nil, trace.NotFound("no policies client for assume role %q with external ID %q", expectedRoleARN, expectedExternalID)
+		}
+		return policies, nil
+	}
+}
 
-	assumedRoleIdentity, err := awslib.IdentityFromArn("arn:aws:sts::123456789012:assumed-role/example-role/i-12345")
-	require.NoError(t, err)
+func makeSSMClientGetter(expectedRegion, expectedRoleARN, expectedExternalID string, ssm ssmClient) func(ctx context.Context, region, assumeRoleARN, externalID string) (ssmClient, error) {
+	return func(ctx context.Context, region, assumeRoleARN, externalID string) (ssmClient, error) {
+		if region != expectedRegion || assumeRoleARN != expectedRoleARN || externalID != expectedExternalID {
+			return nil, trace.NotFound("no IAM client for assume role %q with external ID %q", expectedRoleARN, expectedExternalID)
+		}
+		return ssm, nil
+	}
+}
+
+func TestAWSPoliciesTarget(t *testing.T) {
+	t.Parallel()
+	userIdentity := identityFromArn(t, "arn:aws:iam::123456789012:user/example-user")
+	roleIdentity := identityFromArn(t, "arn:aws:iam::123456789012:role/example-role")
+	assumedRoleIdentity := identityFromArn(t, "arn:aws:sts::123456789012:assumed-role/example-role/i-12345")
+	altAssumedRoleIdentity := identityFromArn(t, "arn:aws:sts::123456789012:assumed-role/alternate-role/i-12345")
 
+	defaultIdentity := identityFromArn(t, "arn:aws:iam::123456789012:user/me")
 	tests := map[string]struct {
-		flags             configurators.BootstrapFlags
-		identity          awslib.Identity
-		accountID         string
-		partitionID       string
+		config            ConfiguratorConfig
+		assumeRole        types.AssumeRole
 		targetType        awslib.Identity
 		targetName        string
 		targetAccountID   string
 		targetPartitionID string
 		targetString      string
-		iamClient         iamClient
 		wantErrContains   string
 	}{
 		"UserNameFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToUser: "example-user"},
-			accountID:         "123456",
-			partitionID:       "aws",
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "example-user"},
+				identity: identityFromArn(t, buildIAMARN("aws", "123456", "user", defaultAttachUser)),
+			},
 			targetType:        awslib.User{},
 			targetName:        "example-user",
 			targetAccountID:   "123456",
@@ -1231,9 +1408,10 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456:user/example-user",
 		},
 		"UserNameWithPathFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToUser: "/some/path/example-user"},
-			accountID:         "123456",
-			partitionID:       "aws",
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "/some/path/example-user"},
+				identity: identityFromArn(t, buildIAMARN("aws", "123456", "user", defaultAttachUser)),
+			},
 			targetType:        awslib.User{},
 			targetName:        "example-user",
 			targetAccountID:   "123456",
@@ -1241,17 +1419,31 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456:user/some/path/example-user",
 		},
 		"UserARNFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToUser: "arn:aws:iam::123456789012:user/example-user"},
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "arn:aws:iam::123456789012:user/example-user"},
+				identity: defaultIdentity,
+			},
 			targetType:        awslib.User{},
 			targetName:        "example-user",
 			targetAccountID:   "123456789012",
 			targetPartitionID: "aws",
 			targetString:      "arn:aws:iam::123456789012:user/example-user",
 		},
+		"UserARNFromFlagsWrongAccount": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "arn:aws:iam::987654321098:user/alt-user"},
+				identity: defaultIdentity,
+			},
+			wantErrContains: unreachablePolicyTargetError{
+				target: identityFromArn(t, "arn:aws:iam::987654321098:user/alt-user"),
+				from:   defaultIdentity,
+			}.Error(),
+		},
 		"RoleNameFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToRole: "example-role"},
-			accountID:         "123456789012",
-			partitionID:       "aws",
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "example-role"},
+				identity: identityFromArn(t, buildIAMARN("aws", "123456789012", "user", defaultAttachUser)),
+			},
 			targetType:        awslib.Role{},
 			targetName:        "example-role",
 			targetAccountID:   "123456789012",
@@ -1259,9 +1451,10 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456789012:role/example-role",
 		},
 		"RoleNameWithPathFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToRole: "/some/path/example-role"},
-			accountID:         "123456789012",
-			partitionID:       "aws",
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "/some/path/example-role"},
+				identity: identityFromArn(t, buildIAMARN("aws", "123456789012", "user", defaultAttachUser)),
+			},
 			targetType:        awslib.Role{},
 			targetName:        "example-role",
 			targetAccountID:   "123456789012",
@@ -1269,16 +1462,31 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456789012:role/some/path/example-role",
 		},
 		"RoleARNFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::123456789012:role/example-role"},
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::123456789012:role/example-role"},
+				identity: defaultIdentity,
+			},
 			targetType:        awslib.Role{},
 			targetName:        "example-role",
 			targetAccountID:   "123456789012",
 			targetPartitionID: "aws",
 			targetString:      "arn:aws:iam::123456789012:role/example-role",
 		},
+		"RoleARNFromFlagsWrongAccount": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::987654321098:role/alt-role"},
+				identity: defaultIdentity,
+			},
+			wantErrContains: unreachablePolicyTargetError{
+				target: identityFromArn(t, "arn:aws:iam::987654321098:role/alt-role"),
+				from:   defaultIdentity,
+			}.Error(),
+		},
 		"UserFromIdentity": {
-			flags:             configurators.BootstrapFlags{},
-			identity:          userIdentity,
+			config: ConfiguratorConfig{
+
+				identity: userIdentity,
+			},
 			targetType:        awslib.User{},
 			targetName:        userIdentity.GetName(),
 			targetAccountID:   userIdentity.GetAccountID(),
@@ -1286,8 +1494,9 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456789012:user/example-user",
 		},
 		"RoleFromIdentity": {
-			flags:             configurators.BootstrapFlags{},
-			identity:          roleIdentity,
+			config: ConfiguratorConfig{
+				identity: roleIdentity,
+			},
 			targetType:        awslib.Role{},
 			targetName:        roleIdentity.GetName(),
 			targetAccountID:   roleIdentity.GetAccountID(),
@@ -1295,9 +1504,6 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:aws:iam::123456789012:role/example-role",
 		},
 		"DefaultTarget": {
-			flags:             configurators.BootstrapFlags{},
-			accountID:         "*",
-			partitionID:       "*",
 			targetType:        awslib.User{},
 			targetName:        defaultAttachUser,
 			targetAccountID:   "*",
@@ -1305,51 +1511,157 @@ func TestAWSPoliciesTarget(t *testing.T) {
 			targetString:      "arn:*:iam::*:user/username",
 		},
 		"AssumedRoleIdentity": {
-			flags:             configurators.BootstrapFlags{},
-			identity:          assumedRoleIdentity,
+			config: ConfiguratorConfig{
+				identity: assumedRoleIdentity,
+				getIAMClient: makeIAMClientGetter("", "", &iamMock{
+					partition: "aws",
+					account:   "123456789012",
+				}),
+			},
 			targetType:        awslib.Role{},
 			targetName:        assumedRoleIdentity.GetName(),
 			targetAccountID:   assumedRoleIdentity.GetAccountID(),
 			targetPartitionID: assumedRoleIdentity.GetPartition(),
 			targetString:      "arn:aws:iam::123456789012:role/example-role",
-			iamClient:         &iamMock{partition: "aws", account: "123456789012"},
 		},
 		"AssumedRoleIdentityForRoleWithPath": {
-			flags:             configurators.BootstrapFlags{},
-			identity:          assumedRoleIdentity,
+			config: ConfiguratorConfig{
+				identity: assumedRoleIdentity,
+				getIAMClient: makeIAMClientGetter("", "", &iamMock{
+					partition: "aws",
+					account:   "123456789012",
+					addPath:   "/some/path/",
+				}),
+			},
 			targetType:        awslib.Role{},
 			targetName:        assumedRoleIdentity.GetName(),
 			targetAccountID:   assumedRoleIdentity.GetAccountID(),
 			targetPartitionID: assumedRoleIdentity.GetPartition(),
 			targetString:      "arn:aws:iam::123456789012:role/some/path/example-role",
-			iamClient:         &iamMock{partition: "aws", account: "123456789012", addPath: "/some/path/"},
 		},
 		"AssumedRoleIdentityWithoutIAMPermissions": {
-			flags:             configurators.BootstrapFlags{},
-			identity:          assumedRoleIdentity,
-			targetType:        awslib.Role{},
-			targetName:        assumedRoleIdentity.GetName(),
-			targetAccountID:   assumedRoleIdentity.GetAccountID(),
-			targetPartitionID: assumedRoleIdentity.GetPartition(),
-			targetString:      "arn:aws:iam::123456789012:role/example-role",
-			iamClient:         &iamMock{unauthorized: true},
-			wantErrContains:   "policies cannot be attached to an assumed-role",
+			config: ConfiguratorConfig{
+				identity:     assumedRoleIdentity,
+				getIAMClient: makeIAMClientGetter("", "", &iamMock{unauthorized: true}),
+			},
+			wantErrContains: failedToResolveAssumeRoleARN(assumedRoleIdentity.GetName(), true),
 		},
 		"AssumedRoleIdentityWithRoleFromFlags": {
-			flags:             configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::123456789012:role/some/path/example-role"},
-			identity:          assumedRoleIdentity,
+			config: ConfiguratorConfig{
+				Flags:        configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::123456789012:role/some/path/example-role"},
+				identity:     assumedRoleIdentity,
+				getIAMClient: makeIAMClientGetter("", "", &iamMock{unauthorized: true}),
+			},
 			targetType:        awslib.Role{},
 			targetName:        "example-role",
 			targetAccountID:   "123456789012",
 			targetPartitionID: "aws",
 			targetString:      "arn:aws:iam::123456789012:role/some/path/example-role",
-			iamClient:         &iamMock{unauthorized: true},
+		},
+		"MatcherAssumeRole": {
+			config: ConfiguratorConfig{
+				getIAMClient: makeIAMClientGetter(assumedRoleIdentity.String(), "", &iamMock{
+					account:   assumedRoleIdentity.GetAccountID(),
+					partition: assumedRoleIdentity.GetPartition(),
+					addPath:   "/some/path/",
+				}),
+				identity: defaultIdentity,
+			},
+			assumeRole:        types.AssumeRole{RoleARN: assumedRoleIdentity.String()},
+			targetType:        awslib.Role{},
+			targetName:        roleIdentity.GetName(),
+			targetAccountID:   roleIdentity.GetAccountID(),
+			targetPartitionID: roleIdentity.GetPartition(),
+			targetString:      "arn:aws:iam::123456789012:role/some/path/example-role",
+		},
+		"MatcherAssumeRoleWithUserFlag": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: userIdentity.String()},
+				identity: defaultIdentity,
+			},
+			assumeRole:        types.AssumeRole{RoleARN: assumedRoleIdentity.String()},
+			targetType:        awslib.User{},
+			targetName:        userIdentity.GetName(),
+			targetAccountID:   userIdentity.GetAccountID(),
+			targetPartitionID: userIdentity.GetPartition(),
+			targetString:      userIdentity.String(),
+		},
+		"MatcherAssumeRoleWithUserFlagPath": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "/some/path/example-user"},
+				identity: defaultIdentity,
+			},
+			assumeRole:        types.AssumeRole{RoleARN: assumedRoleIdentity.String()},
+			targetType:        awslib.User{},
+			targetName:        userIdentity.GetName(),
+			targetAccountID:   userIdentity.GetAccountID(),
+			targetPartitionID: userIdentity.GetPartition(),
+			targetString:      "arn:aws:iam::123456789012:user/some/path/example-user",
+		},
+		"MatcherAssumeRoleWithUserFlagWrongAccount": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToUser: "arn:aws:iam::5678567856782:user/example-user"},
+				identity: defaultIdentity,
+			},
+			assumeRole: types.AssumeRole{RoleARN: assumedRoleIdentity.String()},
+			wantErrContains: unreachablePolicyTargetError{
+				target: identityFromArn(t, "arn:aws:iam::5678567856782:user/example-user"),
+				from:   assumedRoleIdentity,
+			}.Error(),
+		},
+		"MatcherAssumeRoleWithRoleFlag": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: roleIdentity.String()},
+				identity: defaultIdentity,
+			},
+			assumeRole:        types.AssumeRole{RoleARN: altAssumedRoleIdentity.String()},
+			targetType:        awslib.Role{},
+			targetName:        roleIdentity.GetName(),
+			targetAccountID:   roleIdentity.GetAccountID(),
+			targetPartitionID: roleIdentity.GetPartition(),
+			targetString:      roleIdentity.String(),
+		},
+		"MatcherAssumeRoleWithRoleFlagPath": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "/some/path/example-role"},
+				identity: defaultIdentity,
+			},
+			assumeRole:        types.AssumeRole{RoleARN: altAssumedRoleIdentity.String()},
+			targetType:        awslib.Role{},
+			targetName:        roleIdentity.GetName(),
+			targetAccountID:   roleIdentity.GetAccountID(),
+			targetPartitionID: roleIdentity.GetPartition(),
+			targetString:      "arn:aws:iam::123456789012:role/some/path/example-role",
+		},
+		"MatcherAssumeRoleWithRoleFlagWrongAccount": {
+			config: ConfiguratorConfig{
+				Flags:    configurators.BootstrapFlags{AttachToRole: "arn:aws:iam::567856785678:role/example-role"},
+				identity: defaultIdentity,
+			},
+			assumeRole: types.AssumeRole{RoleARN: altAssumedRoleIdentity.String()},
+			wantErrContains: unreachablePolicyTargetError{
+				target: identityFromArn(t, "arn:aws:iam::567856785678:role/example-role"),
+				from:   altAssumedRoleIdentity,
+			}.Error(),
+		},
+		"MatcherAssumeRoleWithoutIAMPermission": {
+			config: ConfiguratorConfig{
+				getIAMClient: makeIAMClientGetter(assumedRoleIdentity.String(), "", &iamMock{unauthorized: true}),
+				identity:     defaultIdentity,
+			},
+			assumeRole:      types.AssumeRole{RoleARN: assumedRoleIdentity.String()},
+			wantErrContains: failedToResolveAssumeRoleARN(assumedRoleIdentity.GetName(), true),
 		},
 	}
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			target, err := policiesTarget(test.flags, test.accountID, test.partitionID, test.identity, test.iamClient)
+			test.config.ServiceConfig = &servicecfg.Config{}
+			require.NoError(t, test.config.CheckAndSetDefaults())
+			if test.config.identity == nil {
+				test.config.identity = identityFromArn(t, buildIAMARN(targetIdentityARNSectionPlaceholder, targetIdentityARNSectionPlaceholder, "user", defaultAttachUser))
+			}
+			target, err := policiesTarget(t.Context(), test.config, test.assumeRole)
 			if test.wantErrContains != "" {
 				require.ErrorContains(t, err, test.wantErrContains)
 				return
@@ -1364,14 +1676,25 @@ func TestAWSPoliciesTarget(t *testing.T) {
 	}
 }
 
+func identityFromArn(t *testing.T, arn string) awslib.Identity {
+	t.Helper()
+	identity, err := awslib.IdentityFromArn(arn)
+	require.NoError(t, err)
+	return identity
+}
+
 func TestAWSDocumentConfigurator(t *testing.T) {
+	t.Parallel()
 	var err error
-	ctx := context.Background()
+	ctx := t.Context()
 	fileConfig := &config.FileConfig{
 		Proxy: config.Proxy{
 			PublicAddr: []string{"proxy.example.org:443"},
 		},
 		Discovery: config.Discovery{
+			Service: config.Service{
+				EnabledFlag: "yes",
+			},
 			AWSMatchers: []config.AWSMatcher{
 				{
 					Types:   []string{"ec2"},
@@ -1386,29 +1709,26 @@ func TestAWSDocumentConfigurator(t *testing.T) {
 	require.NoError(t, config.ApplyFileConfig(fileConfig, serviceConfig))
 
 	config := ConfiguratorConfig{
-		awsCfg:    &aws.Config{},
-		iamClient: &iamMock{},
-		stsClient: &stsMock{ARN: "arn:aws:iam::1234567:role/example-role"},
-		ssmClients: map[string]ssmClient{
-			"eu-central-1": &ssmMock{
-				t: t,
-				expectedInput: &ssm.CreateDocumentInput{
-					Content:        aws.String(awslib.EC2DiscoverySSMDocument("https://proxy.example.org:443")),
-					DocumentType:   ssmtypes.DocumentTypeCommand,
-					DocumentFormat: ssmtypes.DocumentFormatYaml,
-					Name:           aws.String("document"),
-				}},
-		},
+		getIAMClient: makeIAMClientGetter("", "", &iamMock{}),
+		identity:     identityFromArn(t, "arn:aws:iam::1234567:role/example-role"),
+		getSSMClient: makeSSMClientGetter("eu-central-1", "", "", &ssmMock{
+			t: t,
+			expectedInput: &ssm.CreateDocumentInput{
+				Content:        aws.String(awslib.EC2DiscoverySSMDocument("https://proxy.example.org:443")),
+				DocumentType:   ssmtypes.DocumentTypeCommand,
+				DocumentFormat: ssmtypes.DocumentFormatYaml,
+				Name:           aws.String("document"),
+			}}),
 		ServiceConfig: serviceConfig,
 		Flags: configurators.BootstrapFlags{
 			Service:             configurators.DiscoveryService,
 			ForceEC2Permissions: true,
 		},
-		Policies: &policiesMock{
+		getPolicies: makePoliciesGetter("", "", &policiesMock{
 			upsertArn: "policies-arn",
-		},
+		}),
 	}
-	configurator, err := NewAWSConfigurator(config)
+	configurator, err := NewAWSConfigurator(t.Context(), config)
 	require.NoError(t, err)
 	require.False(t, configurator.IsEmpty())
 
@@ -1423,25 +1743,25 @@ func TestAWSDocumentConfigurator(t *testing.T) {
 
 // TestAWSConfigurator tests all actions together.
 func TestAWSConfigurator(t *testing.T) {
+	t.Parallel()
 	var err error
-	ctx := context.Background()
+	ctx := t.Context()
 
 	config := ConfiguratorConfig{
-		awsCfg:        &aws.Config{},
-		iamClient:     &iamMock{},
-		stsClient:     &stsMock{ARN: "arn:aws:iam::1234567:role/example-role"},
-		ssmClients:    map[string]ssmClient{"eu-central-1": &ssmMock{}},
+		getIAMClient:  makeIAMClientGetter("", "", &iamMock{}),
+		identity:      identityFromArn(t, "arn:aws:iam::1234567:role/example-role"),
+		getSSMClient:  makeSSMClientGetter("eu-central-1", "", "", &ssmMock{}),
 		ServiceConfig: &servicecfg.Config{},
 		Flags: configurators.BootstrapFlags{
 			AttachToUser:        "some-user",
 			ForceRDSPermissions: true,
 		},
-		Policies: &policiesMock{
+		getPolicies: makePoliciesGetter("", "", &policiesMock{
 			upsertArn: "policies-arn",
-		},
+		}),
 	}
 
-	configurator, err := NewAWSConfigurator(config)
+	configurator, err := NewAWSConfigurator(t.Context(), config)
 	require.NoError(t, err)
 	require.False(t, configurator.IsEmpty())
 
@@ -1456,7 +1776,7 @@ func TestAWSConfigurator(t *testing.T) {
 	config.Flags.ForceEC2Permissions = true
 	config.Flags.Proxy = "proxy.xyz"
 
-	configurator, err = NewAWSConfigurator(config)
+	configurator, err = NewAWSConfigurator(t.Context(), config)
 	require.NoError(t, err)
 	require.False(t, configurator.IsEmpty())
 
@@ -1745,7 +2065,7 @@ func TestExtractTargetConfig(t *testing.T) {
 	}
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
-			got, err := getTargetConfig(tt.flags, tt.cfg, tt.target)
+			got, err := getTargetConfig(tt.flags, tt.cfg, tt.target, types.AssumeRole{})
 			if tt.wantErr != "" {
 				require.ErrorContains(t, err, tt.wantErr)
 				return
@@ -1863,17 +2183,6 @@ func (p *policiesMock) Attach(context.Context, string, awslib.Identity) error {
 	return p.attachError
 }
 
-type stsMock struct {
-	ARN               string
-	callerIdentityErr error
-}
-
-func (m *stsMock) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
-	return &sts.GetCallerIdentityOutput{
-		Arn: aws.String(m.ARN),
-	}, m.callerIdentityErr
-}
-
 type ssmMock struct {
 	t             *testing.T
 	expectedInput *ssm.CreateDocumentInput
@@ -1893,7 +2202,7 @@ func (m *ssmMock) CreateDocument(ctx context.Context, input *ssm.CreateDocumentI
 		cmp.Diff(m.expectedInput.Content, input.Content),
 		"Document content diff (-want +got)")
 	require.Empty(m.t,
-		cmp.Diff(m.expectedInput, input, cmpopts.IgnoreFields(ssm.CreateDocumentInput{}, "Content")),
+		cmp.Diff(m.expectedInput, input, cmpopts.IgnoreUnexported(ssm.CreateDocumentInput{})),
 		"Document diff (-want +got)")
 
 	return nil, nil
@@ -1909,7 +2218,7 @@ type iamMock struct {
 func (m *iamMock) GetRole(ctx context.Context, input *iam.GetRoleInput, optFns ...func(*iam.Options)) (*iam.GetRoleOutput, error) {
 
 	if m.unauthorized {
-		return nil, trace.AccessDenied("unauthorized")
+		return nil, &smithy.GenericAPIError{Code: "AccessDenied"}
 	}
 	roleName := aws.ToString(input.RoleName)
 	path := m.addPath
@@ -1930,6 +2239,7 @@ func (m mockLocalRegionGetter) GetRegion(context.Context) (string, error) {
 }
 
 func Test_getFallbackRegion(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name              string
 		localRegionGetter localRegionGetter
@@ -1953,8 +2263,83 @@ func Test_getFallbackRegion(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			region := getFallbackRegion(context.Background(), io.Discard, test.localRegionGetter)
+			region := getFallbackRegion(t.Context(), io.Discard, test.localRegionGetter)
 			require.Equal(t, test.wantRegion, region)
 		})
 	}
 }
+
+func TestGetDistinctAssumedRoles(t *testing.T) {
+	t.Parallel()
+	defaultAssumeRole := types.AssumeRole{
+		RoleARN:    "arn:aws:iam::123456789012:role/example-role",
+		ExternalID: "foobar",
+	}
+	tests := []struct {
+		name                string
+		matchers            []types.AWSMatcher
+		expectedAssumeRoles []types.AssumeRole
+	}{
+		{
+			name:                "empty",
+			expectedAssumeRoles: []types.AssumeRole{defaultAssumeRole},
+		},
+		{
+			name: "multiple",
+			matchers: []types.AWSMatcher{
+				{},
+				{AssumeRole: &types.AssumeRole{RoleARN: "12345678", ExternalID: "foo"}},
+				{AssumeRole: &types.AssumeRole{RoleARN: "87654321"}},
+			},
+			expectedAssumeRoles: []types.AssumeRole{
+				defaultAssumeRole,
+				{RoleARN: "12345678", ExternalID: "foo"},
+				{RoleARN: "87654321"},
+			},
+		},
+		{
+			name: "filter out duplicates",
+			matchers: []types.AWSMatcher{
+				{},
+				{AssumeRole: &types.AssumeRole{RoleARN: "12345678"}},
+				{AssumeRole: &types.AssumeRole{RoleARN: "87654321", ExternalID: "foo"}},
+				{AssumeRole: &types.AssumeRole{RoleARN: "12345678"}},
+				{AssumeRole: &types.AssumeRole{RoleARN: "87654321", ExternalID: "foo"}},
+				{},
+			},
+			expectedAssumeRoles: []types.AssumeRole{
+				defaultAssumeRole,
+				{RoleARN: "12345678"},
+				{RoleARN: "87654321", ExternalID: "foo"},
+			},
+		},
+		{
+			name: "preserve duplicate arn when external id differs",
+			matchers: []types.AWSMatcher{
+				{AssumeRole: &types.AssumeRole{RoleARN: "12345678", ExternalID: "foo"}},
+				{AssumeRole: &types.AssumeRole{RoleARN: "12345678", ExternalID: "bar"}},
+			},
+			expectedAssumeRoles: []types.AssumeRole{
+				{RoleARN: "12345678", ExternalID: "foo"},
+				{RoleARN: "12345678", ExternalID: "bar"},
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			config := ConfiguratorConfig{
+				Flags: configurators.BootstrapFlags{
+					Service:       configurators.DiscoveryService,
+					AssumeRoleARN: defaultAssumeRole.RoleARN,
+					ExternalID:    defaultAssumeRole.ExternalID,
+				},
+				ServiceConfig: &servicecfg.Config{
+					Discovery: servicecfg.DiscoveryConfig{
+						AWSMatchers: tc.matchers,
+					},
+				},
+			}
+			require.ElementsMatch(t, tc.expectedAssumeRoles, config.getDistinctAssumedRoles())
+		})
+	}
+}
diff --git a/lib/configurators/common.go b/lib/configurators/common.go
index 9dca4cc74988a..513b849f70624 100644
--- a/lib/configurators/common.go
+++ b/lib/configurators/common.go
@@ -91,6 +91,8 @@ type BootstrapFlags struct {
 	ForceRedshiftServerlessPermissions bool
 	// ForceElastiCachePermissions forces the presence of ElastiCache permissions.
 	ForceElastiCachePermissions bool
+	// ForceElastiCacheServerlessPermissions forces the presence of ElastiCacheServerless permissions.
+	ForceElastiCacheServerlessPermissions bool
 	// ForceMemoryDBPermissions forces the presence of MemoryDB permissions.
 	ForceMemoryDBPermissions bool
 	// ForceEC2Permissions forces the presence of EC2 permissions.
@@ -107,6 +109,10 @@ type BootstrapFlags struct {
 	Proxy string
 	// ForceAssumesRoles forces the presence of additional external AWS IAM roles to assume.
 	ForceAssumesRoles string
+	// AssumeRoleARN is the ARN of the role to assume while bootstrapping.
+	AssumeRoleARN string
+	// ExternalID is the external ID to use when assuming a role.
+	ExternalID string
 }
 
 // ConfiguratorActionContext context passed across configurator actions. It is
diff --git a/lib/configurators/configuratorbuilder/builder.go b/lib/configurators/configuratorbuilder/builder.go
index e3cdd4f412ef0..254d4e0b05c9e 100644
--- a/lib/configurators/configuratorbuilder/builder.go
+++ b/lib/configurators/configuratorbuilder/builder.go
@@ -19,6 +19,8 @@
 package configuratorbuilder
 
 import (
+	"context"
+
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/config"
@@ -29,7 +31,7 @@ import (
 
 // BuildConfigurators reads the configuration and returns a list of
 // configurators. Configurators that are "empty" are not returned.
-func BuildConfigurators(flags configurators.BootstrapFlags) ([]configurators.Configurator, error) {
+func BuildConfigurators(ctx context.Context, flags configurators.BootstrapFlags) ([]configurators.Configurator, error) {
 	fileConfig, err := config.ReadFromFile(flags.ConfigPath)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -39,7 +41,7 @@ func BuildConfigurators(flags configurators.BootstrapFlags) ([]configurators.Con
 		return nil, trace.Wrap(err)
 	}
 
-	awsConfigurator, err := aws.NewAWSConfigurator(aws.ConfiguratorConfig{
+	awsConfigurator, err := aws.NewAWSConfigurator(ctx, aws.ConfiguratorConfig{
 		Flags:         flags,
 		ServiceConfig: serviceCfg,
 	})
diff --git a/lib/cryptosuites/cryptosuitestest/precompute.go b/lib/cryptosuites/cryptosuitestest/precompute.go
new file mode 100644
index 0000000000000..564c859605004
--- /dev/null
+++ b/lib/cryptosuites/cryptosuitestest/precompute.go
@@ -0,0 +1,104 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cryptosuitestest
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+
+	"github.com/gravitational/teleport/api/constants"
+	internalrsa "github.com/gravitational/teleport/lib/cryptosuites/internal/rsa"
+)
+
+// PrecomputeRSAKeys may be called from TestMain to set this package into a
+// mode where it will precompute a fixed number of RSA keys and reuse them to
+// save on CPU usage.
+func PrecomputeRSAKeys(ctx context.Context) {
+	internalrsa.StartPrecomputeOnce.Do(func() {
+		go precomputeTestKeys(ctx, constants.RSAKeySize)
+		go precomputeTestKeys(ctx, 4096)
+	})
+}
+
+func precomputeTestKeys(ctx context.Context, bitSize int) {
+	source := internalrsa.PrecomputedKeys
+	count := testKeysNumber
+	if bitSize == 4096 {
+		source = internalrsa.PrecomputedKeys4096
+		count = testKeysNumber4096
+	}
+	generatedTestKeys := generateTestKeys(ctx, bitSize)
+	keysToReuse := make([]*rsa.PrivateKey, 0, count)
+	for range count {
+		select {
+		case k := <-generatedTestKeys:
+			source <- k
+			keysToReuse = append(keysToReuse, k)
+		case <-ctx.Done():
+			return
+		}
+	}
+
+	for {
+		for _, k := range keysToReuse {
+			select {
+			case source <- k:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}
+}
+
+// testKeysNumber is the number of RSA keys generated in tests.
+const testKeysNumber = 25
+
+// testKeysNumber is the number of RSA 4096 keys generated in tests.
+const testKeysNumber4096 = 10
+
+func generateTestKeys(ctx context.Context, bitSize int) <-chan *rsa.PrivateKey {
+	count := testKeysNumber
+	if bitSize == 4096 {
+		count = testKeysNumber4096
+	}
+	generatedTestKeys := make(chan *rsa.PrivateKey, count)
+	for range count {
+		// Generate each key in a separate goroutine to take advantage of
+		// multiple cores if possible.
+		go func() {
+			private, err := generateRSAPrivateKey(bitSize)
+			if err != nil {
+				// Use only in tests. Safe to panic.
+				panic(err)
+			}
+
+			select {
+			case generatedTestKeys <- private:
+			case <-ctx.Done():
+				return
+			}
+
+		}()
+	}
+	return generatedTestKeys
+}
+
+func generateRSAPrivateKey(bitSize int) (*rsa.PrivateKey, error) {
+	//nolint:forbidigo // This is the one function allowed to generate RSA keys.
+	return rsa.GenerateKey(rand.Reader, bitSize)
+}
diff --git a/lib/cryptosuites/internal/rsa/rsa.go b/lib/cryptosuites/internal/rsa/rsa.go
index 2203bd22bf05e..38b6f6bf73068 100644
--- a/lib/cryptosuites/internal/rsa/rsa.go
+++ b/lib/cryptosuites/internal/rsa/rsa.go
@@ -22,32 +22,48 @@ import (
 	"crypto/rsa"
 	"log/slog"
 	"sync"
-	"testing"
 	"time"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
-var log = slog.With(teleport.ComponentKey, teleport.ComponentKeyGen)
+var (
+	log = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentKeyGen)
 
-// precomputedKeys is a queue of cached keys ready for usage.
-var precomputedKeys = make(chan *rsa.PrivateKey, 25)
+	// PrecomputedKeys is a queue of cached keys ready for usage.
+	PrecomputedKeys = make(chan *rsa.PrivateKey, 25)
 
-// startPrecomputeOnce is used to start the background task that precomputes key pairs.
-var startPrecomputeOnce sync.Once
+	// PrecomputedKeys4096 is a queue of cached 4096-bit keys ready for usage.
+	PrecomputedKeys4096 = make(chan *rsa.PrivateKey, 10)
+
+	// StartPrecomputeOnce is used to start the background task that precomputes key pairs.
+	StartPrecomputeOnce sync.Once
+)
 
 // GenerateKey returns a newly generated RSA private key.
 func GenerateKey() (*rsa.PrivateKey, error) {
-	return getOrGenerateRSAPrivateKey()
+	return getOrGenerateRSAPrivateKey(constants.RSAKeySize)
 }
 
-func getOrGenerateRSAPrivateKey() (*rsa.PrivateKey, error) {
+// GenerateKey4096 generates a 4096-bit RSA private key meant for use in asymmetric encryption use cases such as
+// encrypted session recordings.
+func GenerateKey4096() (*rsa.PrivateKey, error) {
+	return getOrGenerateRSAPrivateKey(4096)
+}
+
+func getOrGenerateRSAPrivateKey(bitSize int) (*rsa.PrivateKey, error) {
+	source := PrecomputedKeys
+	if bitSize == 4096 {
+		source = PrecomputedKeys4096
+	}
+
 	select {
-	case k := <-precomputedKeys:
+	case k := <-source:
 		return k, nil
 	default:
-		rsaKeyPair, err := generateRSAPrivateKey()
+		rsaKeyPair, err := generateRSAPrivateKey(bitSize)
 		if err != nil {
 			return nil, err
 		}
@@ -55,75 +71,30 @@ func getOrGenerateRSAPrivateKey() (*rsa.PrivateKey, error) {
 	}
 }
 
-func generateRSAPrivateKey() (*rsa.PrivateKey, error) {
+func generateRSAPrivateKey(bits int) (*rsa.PrivateKey, error) {
 	//nolint:forbidigo // This is the one function allowed to generate RSA keys.
-	return rsa.GenerateKey(rand.Reader, constants.RSAKeySize)
+	return rsa.GenerateKey(rand.Reader, bits)
 }
 
 func precomputeKeys() {
 	const backoff = time.Second * 30
 	for {
-		rsaPrivateKey, err := generateRSAPrivateKey()
+		rsaPrivateKey, err := generateRSAPrivateKey(constants.RSAKeySize)
 		if err != nil {
 			log.ErrorContext(context.Background(), "Failed to precompute key pair, retrying (this might be a bug).",
 				slog.Any("error", err), slog.Duration("backoff", backoff))
 			time.Sleep(backoff)
 		}
 
-		precomputedKeys <- rsaPrivateKey
+		PrecomputedKeys <- rsaPrivateKey
 	}
 }
 
-func precomputeTestKeys() {
-	generatedTestKeys := generateTestKeys()
-	keysToReuse := make([]*rsa.PrivateKey, 0, testKeysNumber)
-	for range testKeysNumber {
-		k := <-generatedTestKeys
-		precomputedKeys <- k
-		keysToReuse = append(keysToReuse, k)
-	}
-	for {
-		for _, k := range keysToReuse {
-			precomputedKeys <- k
-		}
-	}
-}
-
-// testKeysNumber is the number of RSA keys generated in tests.
-const testKeysNumber = 25
-
-func generateTestKeys() <-chan *rsa.PrivateKey {
-	generatedTestKeys := make(chan *rsa.PrivateKey, testKeysNumber)
-	for range testKeysNumber {
-		// Generate each key in a separate goroutine to take advantage of
-		// multiple cores if possible.
-		go func() {
-			private, err := generateRSAPrivateKey()
-			if err != nil {
-				// Use only in tests. Safe to panic.
-				panic(err)
-			}
-			generatedTestKeys <- private
-		}()
-	}
-	return generatedTestKeys
-}
-
 // PrecomputeKeys sets this package into a mode where a small backlog of keys are
 // computed in advance. This should only be enabled if large spikes in key computation
 // are expected (e.g. in auth/proxy services). Safe to double-call.
 func PrecomputeKeys() {
-	startPrecomputeOnce.Do(func() {
+	StartPrecomputeOnce.Do(func() {
 		go precomputeKeys()
 	})
 }
-
-// PrecomputeTestKeys generates a fixed number of RSA keys and reuses them to
-// reduce CPU usage. This method should only be in tests. Safe to call multiple
-// times. This function takes *testing.M so it can only be used from TestMain in
-// tests.
-func PrecomputeTestKeys(_ *testing.M) {
-	startPrecomputeOnce.Do(func() {
-		go precomputeTestKeys()
-	})
-}
diff --git a/lib/cryptosuites/internal/rsa/rsa_test.go b/lib/cryptosuites/internal/rsa/rsa_test.go
index 15bbf508f37d4..fb84cd5fb17e3 100644
--- a/lib/cryptosuites/internal/rsa/rsa_test.go
+++ b/lib/cryptosuites/internal/rsa/rsa_test.go
@@ -29,7 +29,7 @@ func TestPrecomputeMode(t *testing.T) {
 	PrecomputeKeys()
 
 	select {
-	case <-precomputedKeys:
+	case <-PrecomputedKeys:
 	case <-time.After(time.Second * 10):
 		t.Fatal("Key precompute routine failed to start.")
 	}
diff --git a/lib/cryptosuites/precompute.go b/lib/cryptosuites/precompute.go
index 6e25378f9eaf6..b29f848fa6169 100644
--- a/lib/cryptosuites/precompute.go
+++ b/lib/cryptosuites/precompute.go
@@ -17,8 +17,6 @@
 package cryptosuites
 
 import (
-	"testing"
-
 	"github.com/gravitational/teleport/lib/cryptosuites/internal/rsa"
 )
 
@@ -29,10 +27,3 @@ import (
 func PrecomputeRSAKeys() {
 	rsa.PrecomputeKeys()
 }
-
-// PrecomputeRSATestKeys may be called from TestMain to set this package into a
-// mode where it will precompute a fixed number of RSA keys and reuse them to
-// save on CPU usage.
-func PrecomputeRSATestKeys(m *testing.M) {
-	rsa.PrecomputeTestKeys(m)
-}
diff --git a/lib/cryptosuites/suites.go b/lib/cryptosuites/suites.go
index bbcf13ef61802..ae8b6bf638560 100644
--- a/lib/cryptosuites/suites.go
+++ b/lib/cryptosuites/suites.go
@@ -128,6 +128,9 @@ const (
 	// BoundKeypairCAJWT represents the JWT key for the bound_keypair CA.
 	BoundKeypairCAJWT
 
+	// RecordingKeyWrapping is a key used for wrapping session recording decryption keys.
+	RecordingKeyWrapping
+
 	// keyPurposeMax is 1 greater than the last valid key purpose, used to test that all values less than this
 	// are valid for each suite.
 	keyPurposeMax
@@ -141,6 +144,8 @@ const (
 
 	// RSA2048 represents RSA 2048-bit keys.
 	RSA2048
+	// RSA4096 represents RSA 4096-bit keys.
+	RSA4096
 	// ECDSAP256 represents ECDSA keys using NIST curve P-256.
 	ECDSAP256
 	// Ed25519 represents Ed25519 keys.
@@ -156,6 +161,8 @@ func (a Algorithm) String() string {
 		return "algorithm unspecified"
 	case RSA2048:
 		return "RSA2048"
+	case RSA4096:
+		return "RSA4096"
 	case ECDSAP256:
 		return "ECDSAP256"
 	case Ed25519:
@@ -204,11 +211,12 @@ var (
 		ProxyToDatabaseAgent: RSA2048,
 		ProxyKubeClient:      RSA2048,
 		// EC2InstanceConnect has always used Ed25519 by default.
-		EC2InstanceConnect:  Ed25519,
-		GitClient:           Ed25519,
-		AWSRACATLS:          ECDSAP256,
-		BoundKeypairJoining: Ed25519,
-		BoundKeypairCAJWT:   ECDSAP256,
+		EC2InstanceConnect:   Ed25519,
+		GitClient:            Ed25519,
+		AWSRACATLS:           ECDSAP256,
+		BoundKeypairJoining:  Ed25519,
+		BoundKeypairCAJWT:    ECDSAP256,
+		RecordingKeyWrapping: RSA4096,
 	}
 
 	// balancedV1 strikes a balance between security, compatibility, and
@@ -243,6 +251,7 @@ var (
 		AWSRACATLS:              ECDSAP256,
 		BoundKeypairJoining:     Ed25519,
 		BoundKeypairCAJWT:       Ed25519,
+		RecordingKeyWrapping:    RSA4096,
 	}
 
 	// fipsv1 is an algorithm suite tailored for FIPS compliance. It is based on
@@ -278,6 +287,7 @@ var (
 		AWSRACATLS:              ECDSAP256,
 		BoundKeypairJoining:     ECDSAP256,
 		BoundKeypairCAJWT:       ECDSAP256,
+		RecordingKeyWrapping:    RSA4096,
 	}
 
 	// hsmv1 in an algorithm suite tailored for clusters using an HSM or KMS
@@ -315,6 +325,7 @@ var (
 		AWSRACATLS:              ECDSAP256,
 		BoundKeypairJoining:     Ed25519,
 		BoundKeypairCAJWT:       ECDSAP256,
+		RecordingKeyWrapping:    RSA4096,
 	}
 
 	allSuites = map[types.SignatureAlgorithmSuite]suite{
@@ -463,6 +474,8 @@ func GenerateKeyWithAlgorithm(alg Algorithm) (crypto.Signer, error) {
 	switch alg {
 	case RSA2048:
 		return generateRSA2048()
+	case RSA4096:
+		return generateRSA4096()
 	case ECDSAP256:
 		return generateECDSAP256()
 	case Ed25519:
@@ -472,6 +485,16 @@ func GenerateKeyWithAlgorithm(alg Algorithm) (crypto.Signer, error) {
 	}
 }
 
+// GenerateDecrypterWithAlgorithm generates a new cryptographic keypair with the given algorithm meant for decryption.
+func GenerateDecrypterWithAlgorithm(alg Algorithm) (crypto.Decrypter, error) {
+	switch alg {
+	case RSA4096:
+		return generateRSA4096()
+	default:
+		return nil, trace.BadParameter("unsupported decryption key algorithm %v", alg)
+	}
+}
+
 // GeneratePrivateKeyWithAlgorithm is exactly like [GenerateKeyWithAlgorithm]
 // but wraps the returned key in a [*keys.PrivateKey] for convenience.
 func GeneratePrivateKeyWithAlgorithm(alg Algorithm) (*keys.PrivateKey, error) {
@@ -488,6 +511,11 @@ func generateRSA2048() (*rsa.PrivateKey, error) {
 	return key, trace.Wrap(err)
 }
 
+func generateRSA4096() (*rsa.PrivateKey, error) {
+	key, err := internalrsa.GenerateKey4096()
+	return key, trace.Wrap(err)
+}
+
 func generateECDSAP256() (*ecdsa.PrivateKey, error) {
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	return key, trace.Wrap(err)
diff --git a/lib/decision/decisionv1/decision_service_test.go b/lib/decision/decisionv1/decision_service_test.go
index d76ab460f0919..6615869eafe31 100644
--- a/lib/decision/decisionv1/decision_service_test.go
+++ b/lib/decision/decisionv1/decision_service_test.go
@@ -25,7 +25,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 )
 
 func TestDecisionServiceRequiresLocalAdmin(t *testing.T) {
@@ -34,10 +34,10 @@ func TestDecisionServiceRequiresLocalAdmin(t *testing.T) {
 	env := NewTestenv(t)
 	ctx := context.Background()
 
-	_, _, err := auth.CreateUserAndRoleWithoutRoles(env.AuthAdminClient, "alice", []string{"alice"})
+	_, _, err := authtest.CreateUserAndRoleWithoutRoles(env.AuthAdminClient, "alice", []string{"alice"})
 	require.NoError(t, err, "Creating use alice failed")
 
-	aliceClient, err := env.TestServer.NewClient(auth.TestUser("alice"))
+	aliceClient, err := env.TestServer.NewClient(authtest.TestUser("alice"))
 	require.NoError(t, err, "NewClient failed")
 	t.Cleanup(func() {
 		assert.NoError(t, aliceClient.Close(), "aliceClient.Close() failed")
diff --git a/lib/decision/decisionv1/env_test.go b/lib/decision/decisionv1/env_test.go
index 6211cdb0d94ca..778a8b0d9db8b 100644
--- a/lib/decision/decisionv1/env_test.go
+++ b/lib/decision/decisionv1/env_test.go
@@ -26,13 +26,13 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 )
 
 // Testenv is a test environment for decisionv1.Service.
 type Testenv struct {
-	TestServer *auth.TestServer
+	TestServer *authtest.Server
 
 	// AuthAdminClient is an admin Auth client.
 	AuthAdminClient *authclient.Client
@@ -45,8 +45,8 @@ type Testenv struct {
 func NewTestenv(t *testing.T) *Testenv {
 	t.Helper()
 
-	testServer, err := auth.NewTestServer(auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+	testServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			Dir: t.TempDir(),
 			AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
 				SecondFactor: constants.SecondFactorOTP, // Required.
@@ -60,7 +60,7 @@ func NewTestenv(t *testing.T) *Testenv {
 			"testServer.Shutdown failed")
 	})
 
-	adminClient, err := testServer.NewClient(auth.TestAdmin())
+	adminClient, err := testServer.NewClient(authtest.TestAdmin())
 	require.NoError(t, err, "NewClient failed")
 	t.Cleanup(func() {
 		assert.NoError(t, adminClient.Close(), "adminClient.Close() failed")
diff --git a/lib/decision/service.go b/lib/decision/service.go
index 6236d8240c840..458b9f933618d 100644
--- a/lib/decision/service.go
+++ b/lib/decision/service.go
@@ -393,6 +393,8 @@ func lockTargetToProto(target types.LockTarget) *decisionpb.LockTarget {
 		AccessRequest:  target.AccessRequest,
 		Device:         target.Device,
 		ServerId:       target.ServerID,
+		BotInstanceId:  target.BotInstanceID,
+		JoinToken:      target.JoinToken,
 	}
 }
 
@@ -415,6 +417,8 @@ func lockTargetFromProto(target *decisionpb.LockTarget) types.LockTarget {
 		AccessRequest:  target.AccessRequest,
 		Device:         target.Device,
 		ServerID:       target.ServerId,
+		BotInstanceID:  target.BotInstanceId,
+		JoinToken:      target.JoinToken,
 	}
 }
 
diff --git a/lib/decision/service_test.go b/lib/decision/service_test.go
index 99e0f3556dccd..f3c089c5abf5e 100644
--- a/lib/decision/service_test.go
+++ b/lib/decision/service_test.go
@@ -36,6 +36,8 @@ func TestLockTargetConversion(t *testing.T) {
 		AccessRequest:  "request",
 		Device:         "device",
 		ServerID:       "server",
+		JoinToken:      "jointoken",
+		BotInstanceID:  "botinstance",
 	}
 
 	ignores := []string{
diff --git a/lib/decision/ssh_identity.go b/lib/decision/ssh_identity.go
index 0bf120d5307a2..a6a4cf3bb4f51 100644
--- a/lib/decision/ssh_identity.go
+++ b/lib/decision/ssh_identity.go
@@ -38,6 +38,7 @@ func SSHIdentityToSSHCA(id *decisionpb.SSHIdentity) *sshca.Identity {
 		ClusterName:             id.ClusterName,
 		SystemRole:              types.SystemRole(id.SystemRole),
 		Username:                id.Username,
+		ScopePin:                id.ScopePin,
 		Impersonator:            id.Impersonator,
 		Principals:              id.Principals,
 		PermitX11Forwarding:     id.PermitX11Forwarding,
@@ -57,6 +58,7 @@ func SSHIdentityToSSHCA(id *decisionpb.SSHIdentity) *sshca.Identity {
 		Generation:              id.Generation,
 		BotName:                 id.BotName,
 		BotInstanceID:           id.BotInstanceId,
+		JoinToken:               id.JoinToken,
 		AllowedResourceIDs:      resourceIDsToTypes(id.AllowedResourceIds),
 		ConnectionDiagnosticID:  id.ConnectionDiagnosticId,
 		PrivateKeyPolicy:        keys.PrivateKeyPolicy(id.PrivateKeyPolicy),
@@ -65,6 +67,7 @@ func SSHIdentityToSSHCA(id *decisionpb.SSHIdentity) *sshca.Identity {
 		DeviceCredentialID:      id.DeviceCredentialId,
 		GitHubUserID:            id.GithubUserId,
 		GitHubUsername:          id.GithubUsername,
+		AgentScope:              id.AgentScope,
 	}
 }
 
@@ -80,6 +83,7 @@ func SSHIdentityFromSSHCA(id *sshca.Identity) *decisionpb.SSHIdentity {
 		ClusterName:             id.ClusterName,
 		SystemRole:              string(id.SystemRole),
 		Username:                id.Username,
+		ScopePin:                id.ScopePin,
 		Impersonator:            id.Impersonator,
 		Principals:              id.Principals,
 		PermitX11Forwarding:     id.PermitX11Forwarding,
@@ -107,6 +111,8 @@ func SSHIdentityFromSSHCA(id *sshca.Identity) *decisionpb.SSHIdentity {
 		DeviceCredentialId:      id.DeviceCredentialID,
 		GithubUserId:            id.GitHubUserID,
 		GithubUsername:          id.GitHubUsername,
+		JoinToken:               id.JoinToken,
+		AgentScope:              id.AgentScope,
 	}
 }
 
diff --git a/lib/decision/ssh_identity_test.go b/lib/decision/ssh_identity_test.go
index 9bd1412143010..c16e0141be2f3 100644
--- a/lib/decision/ssh_identity_test.go
+++ b/lib/decision/ssh_identity_test.go
@@ -24,7 +24,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
+	"google.golang.org/protobuf/testing/protocmp"
 
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/api/utils/keys"
@@ -34,12 +36,20 @@ import (
 
 func TestSSHIdentityConversion(t *testing.T) {
 	ident := &sshca.Identity{
-		ValidAfter:              1,
-		ValidBefore:             2,
-		CertType:                ssh.UserCert,
-		ClusterName:             "some-cluster",
-		SystemRole:              types.RoleNode,
-		Username:                "user",
+		ValidAfter:  1,
+		ValidBefore: 2,
+		CertType:    ssh.UserCert,
+		ClusterName: "some-cluster",
+		SystemRole:  types.RoleNode,
+		Username:    "user",
+		ScopePin: &scopesv1.Pin{
+			Scope: "/foo",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/": {
+					Roles: []string{"role1", "role2"},
+				},
+			},
+		},
 		Impersonator:            "impersonator",
 		Principals:              []string{"login1", "login2"},
 		PermitX11Forwarding:     true,
@@ -64,6 +74,7 @@ func TestSSHIdentityConversion(t *testing.T) {
 		Generation:    3,
 		BotName:       "bot",
 		BotInstanceID: "instance",
+		JoinToken:     "join-token",
 		AllowedResourceIDs: []types.ResourceID{{
 			ClusterName:     "cluster",
 			Kind:            types.KindKubePod, // must use a kube resource kind for parsing of sub-resource to work correctly
@@ -77,6 +88,7 @@ func TestSSHIdentityConversion(t *testing.T) {
 		DeviceCredentialID:     "cred",
 		GitHubUserID:           "github",
 		GitHubUsername:         "ghuser",
+		AgentScope:             "/foo",
 	}
 
 	ignores := []string{
@@ -97,5 +109,5 @@ func TestSSHIdentityConversion(t *testing.T) {
 
 	ident2 := SSHIdentityToSSHCA(proto)
 
-	require.Empty(t, cmp.Diff(ident, ident2))
+	require.Empty(t, cmp.Diff(ident, ident2, protocmp.Transform()))
 }
diff --git a/lib/decision/tls_identity.go b/lib/decision/tls_identity.go
index 686deb67522a7..df77d217b1c1c 100644
--- a/lib/decision/tls_identity.go
+++ b/lib/decision/tls_identity.go
@@ -41,6 +41,7 @@ func TLSIdentityToTLSCA(id *decisionpb.TLSIdentity) *tlsca.Identity {
 
 	return &tlsca.Identity{
 		Username:                id.Username,
+		ScopePin:                id.ScopePin,
 		Impersonator:            id.Impersonator,
 		Groups:                  id.Groups,
 		SystemRoles:             id.SystemRoles,
@@ -54,6 +55,7 @@ func TLSIdentityToTLSCA(id *decisionpb.TLSIdentity) *tlsca.Identity {
 		Traits:                  traitToWrappers(id.Traits),
 		RouteToApp:              routeToAppFromProto(id.RouteToApp),
 		TeleportCluster:         id.TeleportCluster,
+		OriginClusterName:       id.TeleportCluster,
 		RouteToDatabase:         routeToDatabaseFromProto(id.RouteToDatabase),
 		DatabaseNames:           id.DatabaseNames,
 		DatabaseUsers:           id.DatabaseUsers,
@@ -70,6 +72,7 @@ func TLSIdentityToTLSCA(id *decisionpb.TLSIdentity) *tlsca.Identity {
 		Generation:              id.Generation,
 		BotName:                 id.BotName,
 		BotInstanceID:           id.BotInstanceId,
+		JoinToken:               id.JoinToken,
 		AllowedResourceIDs:      resourceIDsToTypes(id.AllowedResourceIds),
 		PrivateKeyPolicy:        keys.PrivateKeyPolicy(id.PrivateKeyPolicy),
 		ConnectionDiagnosticID:  id.ConnectionDiagnosticId,
@@ -88,6 +91,7 @@ func TLSIdentityFromTLSCA(id *tlsca.Identity) *decisionpb.TLSIdentity {
 
 	return &decisionpb.TLSIdentity{
 		Username:                id.Username,
+		ScopePin:                id.ScopePin,
 		Impersonator:            id.Impersonator,
 		Groups:                  id.Groups,
 		SystemRoles:             id.SystemRoles,
@@ -117,6 +121,7 @@ func TLSIdentityFromTLSCA(id *tlsca.Identity) *decisionpb.TLSIdentity {
 		Generation:              id.Generation,
 		BotName:                 id.BotName,
 		BotInstanceId:           id.BotInstanceID,
+		JoinToken:               id.JoinToken,
 		AllowedResourceIds:      resourceIDsFromTypes(id.AllowedResourceIDs),
 		PrivateKeyPolicy:        string(id.PrivateKeyPolicy),
 		ConnectionDiagnosticId:  id.ConnectionDiagnosticID,
diff --git a/lib/decision/tls_identity_test.go b/lib/decision/tls_identity_test.go
index 85c0309e8c663..c17021a70b0be 100644
--- a/lib/decision/tls_identity_test.go
+++ b/lib/decision/tls_identity_test.go
@@ -25,6 +25,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	traitpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trait/v1"
 	"github.com/gravitational/teleport/lib/decision"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -42,7 +43,15 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 	}
 
 	fullIdentity := &decisionpb.TLSIdentity{
-		Username:          "user",
+		Username: "user",
+		ScopePin: &scopesv1.Pin{
+			Scope: "/foo",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/": {
+					Roles: []string{"role1", "role2"},
+				},
+			},
+		},
 		Impersonator:      "impersonator",
 		Groups:            []string{"role1", "role2"},
 		SystemRoles:       []string{"system1", "system2"},
diff --git a/lib/defaults/defaults.go b/lib/defaults/defaults.go
index 581a42d956010..2364f5e6f602d 100644
--- a/lib/defaults/defaults.go
+++ b/lib/defaults/defaults.go
@@ -90,6 +90,13 @@ const (
 	// RDPListenPort is the standard port for RDP servers.
 	RDPListenPort = 3389
 
+	// CloudProxyListenPort is the Proxy Service port when running in Teleport Cloud.
+	CloudProxyListenPort = 443
+
+	// CloudDomainSuffix can be used to identify when an address is a Teleport Cloud domain
+	// and provide helpful Cloud-specific instructions.
+	CloudDomainSuffix = "teleport.sh"
+
 	// BackendDir is a default backend subdirectory
 	BackendDir = "backend"
 
@@ -339,6 +346,9 @@ const (
 	// ProxyQueueSize is proxy service queue size
 	ProxyQueueSize = 8192
 
+	// RelayQueueSize is the watcher queue size for the relay cache.
+	RelayQueueSize = 8192
+
 	// UnifiedResourcesQueueSize is the unified resource watcher queue size
 	UnifiedResourcesQueueSize = 8192
 
@@ -813,12 +823,38 @@ var (
 	}
 )
 
+// HTTPClientOption is an option for configuring the HTTP client.
+type HTTPClientOption func(*httpClientOptions) *httpClientOptions
+
+type httpClientOptions struct {
+	useProxyFromEnvironment bool
+}
+
+// UseProxyFromEnvironment configures the HTTP client to use proxy
+// settings from the environment variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.
+func UseProxyFromEnvironment() HTTPClientOption {
+	return func(opts *httpClientOptions) *httpClientOptions {
+		opts.useProxyFromEnvironment = true
+		return opts
+	}
+}
+
 // HTTPClient returns a new http.Client with sensible defaults.
-func HTTPClient() (*http.Client, error) {
+func HTTPClient(opts ...HTTPClientOption) (*http.Client, error) {
 	transport, err := Transport()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	httpOpts := &httpClientOptions{}
+	for _, o := range opts {
+		httpOpts = o(httpOpts)
+	}
+
+	if httpOpts.useProxyFromEnvironment {
+		transport.Proxy = http.ProxyFromEnvironment
+	}
+
 	return &http.Client{
 		Transport: transport,
 	}, nil
diff --git a/lib/desktop/conn.go b/lib/desktop/conn.go
index 014e63520ff40..b201897641712 100644
--- a/lib/desktop/conn.go
+++ b/lib/desktop/conn.go
@@ -34,9 +34,8 @@ type ConnectionConfig struct {
 	Log *slog.Logger
 	// DesktopsGetter is responsible for getting desktops and desktop services.
 	DesktopsGetter DesktopsGetter
-	// Site represents a remote teleport site that can be accessed via
-	// a teleport tunnel or directly by proxy.
-	Site reversetunnelclient.RemoteSite
+	// Cluster represents a Teleport cluster that the desktop is connected to.
+	Cluster reversetunnelclient.Cluster
 	// ClientSrcAddr is the original observed client address.
 	ClientSrcAddr net.Addr
 	// ClientDstAddr is the original client's destination address.
@@ -104,7 +103,7 @@ func tryConnect(ctx context.Context, desktopServiceID string, config *Connection
 		return nil, "", trace.NotFound("could not find windows desktop service %s: %v", desktopServiceID, err)
 	}
 
-	conn, err = config.Site.DialTCP(reversetunnelclient.DialParams{
+	conn, err = config.Cluster.DialTCP(reversetunnelclient.DialParams{
 		From:                  config.ClientSrcAddr,
 		To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: service.GetAddr()},
 		ConnType:              types.WindowsDesktopTunnel,
diff --git a/lib/devicetrust/authz/authz.go b/lib/devicetrust/authz/authz.go
index 27a357f643339..77fa24da13d4a 100644
--- a/lib/devicetrust/authz/authz.go
+++ b/lib/devicetrust/authz/authz.go
@@ -48,7 +48,7 @@ func IsTLSDeviceVerified(ext *tlsca.DeviceExtensions) bool {
 // VerifyTLSUser verifies if the TLS identity has the required extensions to
 // fulfill the device trust configuration.
 func VerifyTLSUser(ctx context.Context, dt *types.DeviceTrust, identity tlsca.Identity) error {
-	return verifyDeviceExtensions(ctx, dt, identity.Username, IsTLSDeviceVerified(&identity.DeviceExtensions))
+	return verifyDeviceExtensions(ctx, dt, identity.Username, identity.IsBot(), IsTLSDeviceVerified(&identity.DeviceExtensions))
 }
 
 // IsSSHDeviceVerified returns true if cert contains all required device
@@ -89,19 +89,29 @@ func VerifySSHUser(ctx context.Context, dt *types.DeviceTrust, ident *sshca.Iden
 	if ident == nil {
 		return trace.BadParameter("ssh identity required")
 	}
-
-	return verifyDeviceExtensions(ctx, dt, ident.Username, IsSSHDeviceVerified(ident))
+	return verifyDeviceExtensions(ctx, dt, ident.Username, ident.IsBot(), IsSSHDeviceVerified(ident))
 }
 
-func verifyDeviceExtensions(ctx context.Context, dt *types.DeviceTrust, username string, verified bool) error {
+func verifyDeviceExtensions(ctx context.Context, dt *types.DeviceTrust, username string, isBot bool, verified bool) error {
 	mode := dtconfig.GetEnforcementMode(dt)
-	switch {
-	case mode != constants.DeviceTrustModeRequired:
-		return nil // OK, extensions not enforced.
-	case !verified:
+
+	var pass bool
+	switch mode {
+	case constants.DeviceTrustModeOff, constants.DeviceTrustModeOptional:
+		// OK, extensions not enforced.
+		pass = true
+	case constants.DeviceTrustModeRequiredForHumans:
+		// Humans must use trusted devices, bots can use untrusted devices.
+		pass = verified || isBot
+	case constants.DeviceTrustModeRequired:
+		// Only trusted devices allowed for bot human and bot users.
+		pass = verified
+	}
+
+	if !pass {
 		slog.DebugContext(ctx, "Device Trust: denied access for unidentified device", "user", username)
 		return trace.Wrap(ErrTrustedDeviceRequired)
-	default:
-		return nil
 	}
+
+	return nil
 }
diff --git a/lib/devicetrust/authz/authz_test.go b/lib/devicetrust/authz/authz_test.go
index 71360acfe7c65..1dfa624161d74 100644
--- a/lib/devicetrust/authz/authz_test.go
+++ b/lib/devicetrust/authz/authz_test.go
@@ -30,6 +30,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/devicetrust/authz"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -127,25 +128,27 @@ func testIsDeviceVerified(t *testing.T, name string, fn func(ext *tlsca.DeviceEx
 }
 
 func TestVerifyTLSUser(t *testing.T) {
-	runVerifyUserTest(t, "VerifyTLSUser", func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions) error {
+	runVerifyUserTest(t, "VerifyTLSUser", func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions, botName string) error {
 		return authz.VerifyTLSUser(context.Background(), dt, tlsca.Identity{
 			Username:         "llama",
 			DeviceExtensions: *ext,
+			BotName:          botName,
 		})
 	})
 }
 
 func TestVerifySSHUser(t *testing.T) {
-	runVerifyUserTest(t, "VerifySSHUser", func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions) error {
+	runVerifyUserTest(t, "VerifySSHUser", func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions, botName string) error {
 		return authz.VerifySSHUser(context.Background(), dt, &sshca.Identity{
 			DeviceID:           ext.DeviceID,
 			DeviceAssetTag:     ext.AssetTag,
 			DeviceCredentialID: ext.CredentialID,
+			BotName:            botName,
 		})
 	})
 }
 
-func runVerifyUserTest(t *testing.T, method string, verify func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions) error) {
+func runVerifyUserTest(t *testing.T, method string, verify func(dt *types.DeviceTrust, ext *tlsca.DeviceExtensions, botName string) error) {
 	assertNoErr := func(t *testing.T, err error) {
 		assert.NoError(t, err, "%v mismatch", method)
 	}
@@ -166,6 +169,7 @@ func runVerifyUserTest(t *testing.T, method string, verify func(dt *types.Device
 		buildType string
 		dt        *types.DeviceTrust
 		ext       *tlsca.DeviceExtensions
+		isBot     bool
 		assertErr func(t *testing.T, err error)
 	}{
 		{
@@ -229,6 +233,16 @@ func runVerifyUserTest(t *testing.T, method string, verify func(dt *types.Device
 			ext:       userWithoutExtensions,
 			assertErr: assertDeniedErr,
 		},
+		{
+			name:      "nok: Enterprise mode=required with bot",
+			buildType: modules.BuildEnterprise,
+			dt: &types.DeviceTrust{
+				Mode: constants.DeviceTrustModeRequired,
+			},
+			ext:       userWithoutExtensions,
+			isBot:     true,
+			assertErr: assertDeniedErr,
+		},
 		{
 			name:      "Enterprise mode=required with extensions",
 			buildType: modules.BuildEnterprise,
@@ -238,14 +252,29 @@ func runVerifyUserTest(t *testing.T, method string, verify func(dt *types.Device
 			ext:       userWithExtensions,
 			assertErr: assertNoErr,
 		},
+		{
+			name:      "ok: Enterprise mode=required-for-humans with bot",
+			buildType: modules.BuildEnterprise,
+			dt: &types.DeviceTrust{
+				Mode: constants.DeviceTrustModeRequiredForHumans,
+			},
+			ext:       userWithoutExtensions,
+			isBot:     true,
+			assertErr: assertNoErr,
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: test.buildType,
 			})
 
-			test.assertErr(t, verify(test.dt, test.ext))
+			var botName string
+			if test.isBot {
+				botName = "wall-e"
+			}
+
+			test.assertErr(t, verify(test.dt, test.ext, botName))
 		})
 	}
 }
diff --git a/lib/devicetrust/authz/trusted_device_requirement.go b/lib/devicetrust/authz/trusted_device_requirement.go
index 2c008cf4d20c9..4bce8d1d19bc5 100644
--- a/lib/devicetrust/authz/trusted_device_requirement.go
+++ b/lib/devicetrust/authz/trusted_device_requirement.go
@@ -33,7 +33,8 @@ func CalculateTrustedDeviceRequirement(
 	getRoles func() ([]types.Role, error),
 ) (types.TrustedDeviceRequirement, error) {
 	// Required by cluster mode?
-	if dtconfig.GetEnforcementMode(dt) == constants.DeviceTrustModeRequired {
+	switch dtconfig.GetEnforcementMode(dt) {
+	case constants.DeviceTrustModeRequired, constants.DeviceTrustModeRequiredForHumans:
 		return types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_REQUIRED, nil
 	}
 
@@ -43,7 +44,8 @@ func CalculateTrustedDeviceRequirement(
 		return types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_UNSPECIFIED, trace.Wrap(err)
 	}
 	for _, role := range roles {
-		if role.GetOptions().DeviceTrustMode == constants.DeviceTrustModeRequired {
+		switch role.GetOptions().DeviceTrustMode {
+		case constants.DeviceTrustModeRequired, constants.DeviceTrustModeRequiredForHumans:
 			return types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_REQUIRED, nil
 		}
 	}
diff --git a/lib/devicetrust/authz/trusted_device_requirement_test.go b/lib/devicetrust/authz/trusted_device_requirement_test.go
index 031ea457eb318..127029c35ed7b 100644
--- a/lib/devicetrust/authz/trusted_device_requirement_test.go
+++ b/lib/devicetrust/authz/trusted_device_requirement_test.go
@@ -31,6 +31,8 @@ func TestCalculateTrustedDeviceRequirement(t *testing.T) {
 	assert.NoError(t, err)
 	deviceTrustRequiredRole, err := types.NewRole("device-trust-required", types.RoleSpecV6{Options: types.RoleOptions{DeviceTrustMode: constants.DeviceTrustModeRequired}})
 	assert.NoError(t, err)
+	deviceTrustRequiredHumanRole, err := types.NewRole("device-trust-required-for-humans", types.RoleSpecV6{Options: types.RoleOptions{DeviceTrustMode: constants.DeviceTrustModeRequiredForHumans}})
+	assert.NoError(t, err)
 
 	tests := []struct {
 		name              string
@@ -62,6 +64,22 @@ func TestCalculateTrustedDeviceRequirement(t *testing.T) {
 			roles:             []types.Role{deviceTrustRequiredRole, deviceTrustOptionalRole},
 			expectRequirement: types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_REQUIRED,
 		},
+		{
+			name: "required for humans by cluster but not by roles",
+			dt: &types.DeviceTrust{
+				Mode: constants.DeviceTrustModeRequiredForHumans,
+			},
+			roles:             []types.Role{deviceTrustOptionalRole},
+			expectRequirement: types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_REQUIRED,
+		},
+		{
+			name: "required for humans by role but not by cluster",
+			dt: &types.DeviceTrust{
+				Mode: constants.DeviceTrustModeOptional,
+			},
+			roles:             []types.Role{deviceTrustRequiredHumanRole},
+			expectRequirement: types.TrustedDeviceRequirement_TRUSTED_DEVICE_REQUIREMENT_REQUIRED,
+		},
 	}
 
 	for _, test := range tests {
diff --git a/lib/devicetrust/config/config_test.go b/lib/devicetrust/config/config_test.go
index 14a31af2fafb8..d361e21d81c68 100644
--- a/lib/devicetrust/config/config_test.go
+++ b/lib/devicetrust/config/config_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	dtconfig "github.com/gravitational/teleport/lib/devicetrust/config"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestValidateConfigAgainstModules(t *testing.T) {
@@ -98,7 +99,7 @@ func TestValidateConfigAgainstModules(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: test.buildType,
 			})
 
@@ -159,7 +160,7 @@ func TestGetEnforcementMode(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: test.buildType,
 			})
 
diff --git a/lib/devicetrust/testenv/testenv.go b/lib/devicetrust/testenv/testenv.go
index a1ee369e628c6..f342736340d06 100644
--- a/lib/devicetrust/testenv/testenv.go
+++ b/lib/devicetrust/testenv/testenv.go
@@ -223,7 +223,7 @@ func NewSelfSignedSSHCert() ([]byte, crypto.Signer, error) {
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	sshCert := &ssh.Certificate{Key: sshSigner.PublicKey(), SignatureKey: sshSigner.PublicKey(), Serial: 1, CertType: ssh.UserCert}
+	sshCert := &ssh.Certificate{Key: sshSigner.PublicKey(), Serial: 1, CertType: ssh.UserCert}
 	if err := sshCert.SignCert(rand.Reader, sshSigner); err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
diff --git a/lib/events/api.go b/lib/events/api.go
index 6910af01d87ae..b585fb9361c5f 100644
--- a/lib/events/api.go
+++ b/lib/events/api.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"iter"
 	"math"
 	"time"
 
@@ -51,12 +52,14 @@ const (
 	// EventProtocol specifies protocol that was captured
 	EventProtocol = "proto"
 	// EventProtocolsSSH specifies SSH as a type of captured protocol
-	EventProtocolSSH = "ssh"
+	EventProtocolSSH = apievents.EventProtocolSSH
 	// EventProtocolKube specifies kubernetes as a type of captured protocol
-	EventProtocolKube = "kube"
+	EventProtocolKube = apievents.EventProtocolKube
 	// EventProtocolTDP specifies Teleport Desktop Protocol (TDP)
 	// as a type of captured protocol
-	EventProtocolTDP = "tdp"
+	EventProtocolTDP = apievents.EventProtocolTDP
+	// EventProtocolDB specifies database as a type of captured protocol
+	EventProtocolDB = apievents.EventProtocolDB
 	// LocalAddr is a target address on the host
 	LocalAddr = "addr.local"
 	// RemoteAddr is a client (user's) address
@@ -913,6 +916,62 @@ const (
 	// HealthCheckConfigDeleteEvent is emitted when a health check config
 	// resource is deleted.
 	HealthCheckConfigDeleteEvent = "health_check_config.delete"
+
+	// MCPSessionStartEvent is emitted when a user starts a MCP session.
+	MCPSessionStartEvent = "mcp.session.start"
+	// MCPSessionEndEvent is emitted when an MCP session ends.
+	MCPSessionEndEvent = "mcp.session.end"
+	// MCPSessionRequestEvent is emitted when a request is sent by client during
+	// a MCP session.
+	MCPSessionRequestEvent = "mcp.session.request"
+	// MCPSessionNotificationEvent is emitted when a notification is sent by
+	// client during a MCP session.
+	MCPSessionNotificationEvent = "mcp.session.notification"
+	// MCPSessionListenSSEStream is emitted when the client sends a GET request for
+	// listening server notifications via an SSE stream.
+	MCPSessionListenSSEStream = "mcp.session.listen_sse_stream"
+	// MCPSessionInvalidHTTPRequest is a blanket event for all requests that we
+	// do not understand (usually out of MCP spec).
+	MCPSessionInvalidHTTPRequest = "mcp.session.invalid_http_request"
+
+	// BoundKeypairRecovery is emitted when a bound keypair token is used to
+	// perform a recovery.
+	BoundKeypairRecovery = "join_token.bound_keypair.recovery"
+	// BoundKeypairRotation is emitted when a keypair rotation is attempted.
+	BoundKeypairRotation = "join_token.bound_keypair.rotation"
+	// BoundKeypairJoinStateVerificationFailed is emitted when join state
+	// document verification fails.
+	BoundKeypairJoinStateVerificationFailed = "join_token.bound_keypair.join_state_verification_failed"
+
+	// SCIMListingEvent is emitted when a SCIM client lists resources managed by
+	// the SCIM service.
+	SCIMListingEvent = "scim.list"
+
+	// SCIMCreateEvent is emitted when a client attempts to fetch a specific SCIM
+	// resource.
+	SCIMGetEvent = "scim.get"
+
+	// SCIMCreateEvent is emitted when a new resource is created by the
+	// SCIM service in response to a request. This includes taking ownership of
+	// existing users.
+	SCIMCreateEvent = "scim.create"
+
+	// SCIMUpdateEvent is emitted when a resource is updated via the SCIM
+	// service. Includes "deactivating" resources (per Okta).
+	SCIMUpdateEvent = "scim.update"
+
+	// SCIMDeleteEvent is emitted when a resource is deleted via SCIM.
+	SCIMDeleteEvent = "scim.delete"
+
+	// ClientIPRestrictionsUpdateEvent is emitted when a Client IP Restriction list is updated.
+	ClientIPRestrictionsUpdateEvent = "cir.update"
+
+	// VnetConfigCreateEvent is emitted when a Vnet config resource is created.
+	VnetConfigCreateEvent = "vnet.config.create"
+	// VnetConfigUpdateEvent is emitted when a Vnet config resource is updated.
+	VnetConfigUpdateEvent = "vnet.config.update"
+	// VnetConfigDeleteEvent is emitted when a Vnet config resource is deleted.
+	VnetConfigDeleteEvent = "vnet.config.delete"
 )
 
 // Add an entry to eventsMap in lib/events/events_test.go when you add
@@ -932,11 +991,18 @@ const (
 )
 
 // SessionRecordingEvents is a list of events that are related to session
-// recorings.
+// recordings.
 var SessionRecordingEvents = []string{
 	SessionEndEvent,
 	WindowsDesktopSessionEndEvent,
 	DatabaseSessionEndEvent,
+
+	// HTTP/HTTPS application sessions do not emit AppSessionEndEvent.
+	// Their recordings IDs are in AppSessionChunkEvent, so it is included.
+	//
+	// TCP application sessions emit AppSessionEndEvent but produce no
+	// recordings, so it is excluded.
+	AppSessionChunkEvent,
 }
 
 // ServerMetadataGetter represents interface
@@ -1038,7 +1104,11 @@ type MultipartUploader interface {
 	// ReserveUploadPart reserves an upload part. Reserve is used to identify
 	// upload errors beforehand.
 	ReserveUploadPart(ctx context.Context, upload StreamUpload, partNumber int64) error
-	// UploadPart uploads part and returns the part
+	// UploadPart uploads part and returns the part.
+	//
+	// The part must be greater than [MinUploadPartSizeBytes]. It is the responsibility
+	// of the caller to add padding if needed, or else the upload may fail depending on
+	// storage provider.
 	UploadPart(ctx context.Context, upload StreamUpload, partNumber int64, partBody io.ReadSeeker) (*StreamPart, error)
 	// ListParts returns all uploaded parts for the completed upload in sorted order
 	ListParts(ctx context.Context, upload StreamUpload) ([]StreamPart, error)
@@ -1096,6 +1166,7 @@ type StreamEmitter interface {
 type AuditLogSessionStreamer interface {
 	AuditLogger
 	SessionStreamer
+	EncryptedRecordingUploader
 }
 
 // SessionStreamer supports streaming session chunks or events.
@@ -1110,6 +1181,12 @@ type SessionStreamer interface {
 	StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error)
 }
 
+// EncryptedRecordingUploader takes a session ID and a sequence of encrypted
+// recording parts and uploads an encrypted session recording.
+type EncryptedRecordingUploader interface {
+	UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error
+}
+
 type SearchEventsRequest struct {
 	// From is oldest date of returned events, can be zero.
 	From time.Time
@@ -1141,7 +1218,7 @@ type SearchSessionEventsRequest struct {
 	// set to its value. Otherwise leave empty.
 	StartKey string
 	// Cond can be used to pass additional expression to query, can be empty.
-	Cond *types.WhereExpr
+	Cond *utils.ToFieldsConditionConfig
 	// SessionID is optional parameter to return session events only to given session.
 	SessionID string
 }
diff --git a/lib/events/athena/athena.go b/lib/events/athena/athena.go
index 48705f0bf5828..174ac358c5cb1 100644
--- a/lib/events/athena/athena.go
+++ b/lib/events/athena/athena.go
@@ -442,6 +442,7 @@ func (cfg *Config) UpdateForExternalAuditStorage(ctx context.Context, externalAu
 	cfg.QueryResultsS3 = spec.AthenaResultsURI
 	cfg.Database = spec.GlueDatabase
 	cfg.TableName = spec.GlueTable
+	cfg.Region = spec.Region
 
 	awsCfg, err := awsconfig.LoadDefaultConfig(ctx,
 		awsconfig.WithRegion(cfg.Region),
diff --git a/lib/events/athena/athena_test.go b/lib/events/athena/athena_test.go
index 14b1014b38493..e6f36881c7624 100644
--- a/lib/events/athena/athena_test.go
+++ b/lib/events/athena/athena_test.go
@@ -42,11 +42,11 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/events/athena/integration_test.go b/lib/events/athena/integration_test.go
index a25b3272ea0b2..910c284f1e943 100644
--- a/lib/events/athena/integration_test.go
+++ b/lib/events/athena/integration_test.go
@@ -20,20 +20,43 @@ package athena
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
+	"fmt"
+	"os"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/athena"
+	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
+	glueTypes "github.com/aws/aws-sdk-go-v2/service/glue/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3Types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	sqsTypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
+	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
+	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/test"
+	"github.com/gravitational/teleport/lib/observability/tracing"
 )
 
 func TestIntegrationAthenaSearchSessionEventsBySessionID(t *testing.T) {
@@ -201,3 +224,431 @@ func testIntegrationAthenaLargeEvents(t *testing.T, bypassSNS bool) {
 	require.Len(t, history, 1)
 	require.Empty(t, cmp.Diff(in, history[0]))
 }
+
+// createTableQuery is query used to create athena table using parquet on s3.
+// Right now only hardcoded in integration tests, in future it may be moved
+// to athena main file if we decide to create table on demand from teleport.
+var createTableQuery = `
+CREATE EXTERNAL TABLE %s (
+	uid string,
+	session_id string,
+	event_type string,
+	event_time timestamp,
+	user string,
+	event_data string
+  )
+  PARTITIONED BY (
+   event_date DATE
+  )
+  ROW FORMAT SERDE 'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe'
+  STORED AS INPUTFORMAT 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat'
+  OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat'
+  LOCATION "%s/"
+  TBLPROPERTIES (
+   "projection.enabled" = "true",
+   "projection.event_date.type" = "date",
+   "projection.event_date.format" = "yyyy-MM-dd",
+   "projection.event_date.range" = "NOW-4YEARS,NOW",
+   "projection.event_date.interval" = "1",
+   "projection.event_date.interval.unit" = "DAYS",
+   "storage.location.template" = "%s/${event_date}/",
+   "classification" = "parquet",
+   "parquet.compression" = "SNAPPY"
+  )
+`
+
+type AthenaContext struct {
+	log                *Log
+	clock              clockwork.Clock
+	testID             string
+	Database           string
+	bucketForEvents    string
+	bucketForTempFiles string
+	TableName          string
+	s3eventsLocation   string
+	S3ResultsLocation  string
+	s3largePayloads    string
+	batcherInterval    time.Duration
+}
+
+func (a *AthenaContext) GetLog() *Log {
+	return a.log
+}
+
+// AthenaContextConfig is optional config to override defaults in athena context.
+type AthenaContextConfig struct {
+	MaxBatchSize int
+	BypassSNS    bool
+}
+
+type InfraOutputs struct {
+	TopicARN string
+	QueueURL string
+	Region   string
+}
+
+func (ac *AthenaContext) Close(t *testing.T) {
+	assert.NoError(t, ac.log.Close())
+}
+
+// EventuallyConsistentAuditLogger is used to add delay before searching for events
+// for eventually consistent audit loggers.
+type EventuallyConsistentAuditLogger struct {
+	Inner events.AuditLogger
+
+	// QueryDelay specifies how long query should wait after last emit event.
+	QueryDelay time.Duration
+
+	// mu protects field below.
+	mu                    sync.Mutex
+	emitWasAfterLastDelay bool
+}
+
+func (e *EventuallyConsistentAuditLogger) EmitAuditEvent(ctx context.Context, in apievents.AuditEvent) error {
+	e.mu.Lock()
+	e.emitWasAfterLastDelay = true
+	e.mu.Unlock()
+	return e.Inner.EmitAuditEvent(ctx, in)
+}
+
+func (e *EventuallyConsistentAuditLogger) SearchEvents(ctx context.Context, req events.SearchEventsRequest) ([]apievents.AuditEvent, string, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if e.emitWasAfterLastDelay {
+		time.Sleep(e.QueryDelay)
+		// clear emit delay
+		e.emitWasAfterLastDelay = false
+	}
+	return e.Inner.SearchEvents(ctx, req)
+}
+
+func (e *EventuallyConsistentAuditLogger) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if e.emitWasAfterLastDelay {
+		time.Sleep(e.QueryDelay)
+		// clear emit delay
+		e.emitWasAfterLastDelay = false
+	}
+	return e.Inner.ExportUnstructuredEvents(ctx, req)
+}
+
+func (e *EventuallyConsistentAuditLogger) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if e.emitWasAfterLastDelay {
+		time.Sleep(e.QueryDelay)
+		// clear emit delay
+		e.emitWasAfterLastDelay = false
+	}
+	return e.Inner.GetEventExportChunks(ctx, req)
+}
+
+func (e *EventuallyConsistentAuditLogger) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if e.emitWasAfterLastDelay {
+		time.Sleep(e.QueryDelay)
+		// clear emit delay
+		e.emitWasAfterLastDelay = false
+	}
+	return e.Inner.SearchSessionEvents(ctx, req)
+}
+
+func (e *EventuallyConsistentAuditLogger) Close() error {
+	return e.Inner.Close()
+}
+
+func SetupAthenaContext(t *testing.T, ctx context.Context, cfg AthenaContextConfig) *AthenaContext {
+	testEnabled := os.Getenv(teleport.AWSRunTests)
+	if ok, _ := strconv.ParseBool(testEnabled); !ok {
+		t.Skip("Skipping AWS-dependent test suite.")
+	}
+
+	testID := fmt.Sprintf("auditlogs-integrationtests-%v", uuid.New().String())
+
+	clock := clockwork.NewRealClock()
+
+	backend, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, backend.Close())
+	})
+	bucketWithLocking := "auditlogs-integrationtests-locking"
+	bucketForTemporaryFiles := "auditlogs-integrationtests"
+	ac := &AthenaContext{
+		clock:              clock,
+		testID:             testID,
+		Database:           "auditlogs_integrationtests",
+		bucketForEvents:    bucketWithLocking,
+		bucketForTempFiles: bucketForTemporaryFiles,
+		s3eventsLocation:   fmt.Sprintf("s3://%s/%s/events", bucketWithLocking, testID),
+		S3ResultsLocation:  fmt.Sprintf("s3://%s/%s/results", bucketForTemporaryFiles, testID),
+		s3largePayloads:    fmt.Sprintf("s3://%s/%s/large_payloads", bucketForTemporaryFiles, testID),
+		TableName:          strings.ReplaceAll(testID, "-", "_"),
+		batcherInterval:    10 * time.Second,
+	}
+	infraOut := ac.setupInfraWithCleanup(t, ctx)
+
+	region := infraOut.Region
+	if region == "" {
+		region = "eu-central-1"
+	}
+
+	topicARN := infraOut.TopicARN
+	if cfg.BypassSNS {
+		topicARN = topicARNBypass
+	}
+	log, err := New(ctx, Config{
+		Region:           region,
+		Clock:            clock,
+		Database:         ac.Database,
+		TableName:        ac.TableName,
+		TopicARN:         topicARN,
+		QueueURL:         infraOut.QueueURL,
+		LocationS3:       ac.s3eventsLocation,
+		QueryResultsS3:   ac.S3ResultsLocation,
+		LargeEventsS3:    ac.s3largePayloads,
+		BatchMaxInterval: ac.batcherInterval,
+		BatchMaxItems:    cfg.MaxBatchSize,
+		Backend:          backend,
+		Workgroup:        "primary",
+	})
+	require.NoError(t, err)
+
+	ac.log = log
+	t.Cleanup(func() {
+		ac.Close(t)
+	})
+
+	t.Logf("Initialized Athena test suite %q\n", testID)
+
+	return ac
+}
+
+func (ac *AthenaContext) setupInfraWithCleanup(t *testing.T, ctx context.Context) *InfraOutputs {
+	const timeoutDurationOnCleanup = 1 * time.Minute
+
+	awsCfg, err := awsconfig.LoadDefaultConfig(ctx)
+	require.NoError(t, err)
+
+	// Create SNS topic and set cleanup fn.
+	snsClient := sns.NewFromConfig(awsCfg)
+	topicCreated, err := snsClient.CreateTopic(ctx, &sns.CreateTopicInput{
+		Name: aws.String(ac.testID),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
+		defer cancel()
+		_, err = snsClient.DeleteTopic(cleanupCtx, &sns.DeleteTopicInput{
+			TopicArn: topicCreated.TopicArn,
+		})
+		assert.NoError(t, err)
+	})
+
+	// Create SQS queue and set cleanup fn.
+	sqsClient := sqs.NewFromConfig(awsCfg)
+	queueCreated, err := sqsClient.CreateQueue(ctx, &sqs.CreateQueueInput{
+		QueueName: aws.String(ac.testID),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
+		defer cancel()
+		_, err := sqsClient.DeleteQueue(cleanupCtx, &sqs.DeleteQueueInput{
+			QueueUrl: queueCreated.QueueUrl,
+		})
+		assert.NoError(t, err)
+	})
+
+	// Set created queue as subscriber to topic and use valid permissions.
+	queueAttr, err := sqsClient.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
+		QueueUrl:       queueCreated.QueueUrl,
+		AttributeNames: []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNameQueueArn},
+	})
+	require.NoError(t, err)
+	queueArn := queueAttr.Attributes["QueueArn"]
+	type StatementEntry struct {
+		Effect    string
+		Action    []string
+		Resource  string
+		Principal map[string]string
+		Condition map[string]map[string]string
+	}
+	type PolicyDocument struct {
+		Version   string
+		Statement []StatementEntry
+	}
+	sqsAccessPolicy := PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []StatementEntry{
+			{
+				Effect:   "Allow",
+				Action:   []string{"SQS:SendMessage"},
+				Resource: queueArn,
+				Principal: map[string]string{
+					"AWS": "*",
+				},
+				Condition: map[string]map[string]string{
+					"ArnLike": {
+						"aws:SourceArn": *topicCreated.TopicArn,
+					},
+				},
+			},
+		},
+	}
+	marshaledPolicy, err := json.Marshal(sqsAccessPolicy)
+	require.NoError(t, err)
+	_, err = sqsClient.SetQueueAttributes(ctx, &sqs.SetQueueAttributesInput{
+		Attributes: map[string]string{
+			"Policy": string(marshaledPolicy),
+		},
+		QueueUrl: queueCreated.QueueUrl,
+	})
+	require.NoError(t, err)
+	_, err = snsClient.Subscribe(ctx, &sns.SubscribeInput{
+		TopicArn: topicCreated.TopicArn,
+		Protocol: aws.String("sqs"),
+		Attributes: map[string]string{
+			"RawMessageDelivery": "true",
+		},
+		Endpoint: aws.String(queueArn),
+	})
+	require.NoError(t, err)
+
+	// Create bucket for long term storage if not exists. Bucket will have object locking which
+	// prevents from deleting objects, that's why it can exists before.
+	// Retention period will take care of cleanup of files.
+	s3Client := s3.NewFromConfig(awsCfg)
+	_, err = s3Client.HeadBucket(ctx, &s3.HeadBucketInput{
+		Bucket: aws.String(ac.bucketForEvents),
+	})
+	if err != nil {
+		var notFound *s3Types.NotFound
+		if errors.As(err, &notFound) {
+			_, err = s3Client.CreateBucket(ctx, &s3.CreateBucketInput{
+				Bucket:                     aws.String(ac.bucketForEvents),
+				ObjectLockEnabledForBucket: aws.Bool(true),
+				CreateBucketConfiguration: &s3Types.CreateBucketConfiguration{
+					LocationConstraint: s3Types.BucketLocationConstraint(awsCfg.Region),
+				},
+			})
+			require.NoError(t, err)
+			_, err = s3Client.PutObjectLockConfiguration(ctx, &s3.PutObjectLockConfigurationInput{
+				Bucket: aws.String(ac.bucketForEvents),
+				ObjectLockConfiguration: &s3Types.ObjectLockConfiguration{
+					ObjectLockEnabled: s3Types.ObjectLockEnabledEnabled,
+					Rule: &s3Types.ObjectLockRule{
+						DefaultRetention: &s3Types.DefaultRetention{
+							Days: aws.Int32(1),
+							Mode: s3Types.ObjectLockRetentionModeGovernance,
+						},
+					},
+				},
+			})
+			require.NoError(t, err)
+		} else {
+			assert.Fail(t, "unexpected err", err)
+		}
+	}
+
+	// Create bucket if not exists for temporary files (large payloads and query results).
+	// Retention period will take care of cleanup of files.
+	_, err = s3Client.HeadBucket(ctx, &s3.HeadBucketInput{
+		Bucket: aws.String(ac.bucketForTempFiles),
+	})
+	if err != nil {
+		var notFound *s3Types.NotFound
+		if errors.As(err, &notFound) {
+			_, createErr := s3Client.CreateBucket(ctx, &s3.CreateBucketInput{
+				Bucket: aws.String(ac.bucketForTempFiles),
+				CreateBucketConfiguration: &s3Types.CreateBucketConfiguration{
+					LocationConstraint: s3Types.BucketLocationConstraint(awsCfg.Region),
+				},
+			})
+			require.NoError(t, createErr)
+		} else {
+			assert.Fail(t, "unexpected err", err)
+		}
+	}
+	_, err = s3Client.PutBucketLifecycleConfiguration(ctx, &s3.PutBucketLifecycleConfigurationInput{
+		Bucket: aws.String(ac.bucketForTempFiles),
+		LifecycleConfiguration: &s3Types.BucketLifecycleConfiguration{
+			Rules: []s3Types.LifecycleRule{
+				{
+					Status: s3Types.ExpirationStatusEnabled,
+					Expiration: &s3Types.LifecycleExpiration{
+						Days: aws.Int32(1),
+					},
+					// Prefix is required field, empty means set to whole bucket.
+					Prefix: aws.String(""),
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Create glue db if not exists
+	glueClient := glue.NewFromConfig(awsCfg)
+	_, err = glueClient.GetDatabase(ctx, &glue.GetDatabaseInput{
+		Name: aws.String(ac.Database),
+	})
+	if err != nil {
+		var notFound *glueTypes.EntityNotFoundException
+		if errors.As(err, &notFound) {
+			_, createErr := glueClient.CreateDatabase(ctx, &glue.CreateDatabaseInput{
+				DatabaseInput: &glueTypes.DatabaseInput{
+					Name: aws.String(ac.Database),
+				},
+			})
+			require.NoError(t, createErr)
+		} else {
+			assert.Fail(t, "unexpected err: %v", err)
+		}
+	}
+
+	// Create athena table
+	athenaClient := athena.NewFromConfig(awsCfg)
+	startQueryExecResp, err := athenaClient.StartQueryExecution(ctx, &athena.StartQueryExecutionInput{
+		QueryString: aws.String(fmt.Sprintf(createTableQuery, ac.TableName, ac.s3eventsLocation, ac.s3eventsLocation)),
+		ResultConfiguration: &athenaTypes.ResultConfiguration{
+			OutputLocation: aws.String(ac.S3ResultsLocation),
+		},
+		QueryExecutionContext: &athenaTypes.QueryExecutionContext{
+			Database: aws.String(ac.Database),
+		},
+	})
+	require.NoError(t, err)
+	// querier is just used here to get helper fn waitForSuccess.
+	q := querier{
+		athenaClient: athenaClient,
+		querierConfig: querierConfig{
+			getQueryResultsInterval: 100 * time.Millisecond,
+			clock:                   ac.clock,
+			tracer:                  tracing.NoopTracer(teleport.ComponentAthena),
+		},
+	}
+	err = q.waitForSuccess(ctx, aws.ToString(startQueryExecResp.QueryExecutionId))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
+		defer cancel()
+		_, err = athenaClient.StartQueryExecution(cleanupCtx, &athena.StartQueryExecutionInput{
+			QueryString: aws.String(fmt.Sprintf("drop table %s;", ac.TableName)),
+			ResultConfiguration: &athenaTypes.ResultConfiguration{
+				OutputLocation: aws.String(ac.S3ResultsLocation),
+			},
+			QueryExecutionContext: &athenaTypes.QueryExecutionContext{
+				Database: aws.String(ac.Database),
+			},
+		})
+		assert.NoError(t, err)
+	})
+
+	return &InfraOutputs{
+		TopicARN: aws.ToString(topicCreated.TopicArn),
+		QueueURL: aws.ToString(queueCreated.QueueUrl),
+		Region:   awsCfg.Region,
+	}
+}
diff --git a/lib/events/athena/querier.go b/lib/events/athena/querier.go
index b2d36040d0014..1991050ef61e4 100644
--- a/lib/events/athena/querier.go
+++ b/lib/events/athena/querier.go
@@ -131,7 +131,6 @@ func (cfg *querierConfig) CheckAndSetDefaults() error {
 
 	if cfg.logger == nil {
 		cfg.logger = slog.With(teleport.ComponentKey, teleport.ComponentAthena)
-
 	}
 	if cfg.clock == nil {
 		cfg.clock = clockwork.NewRealClock()
@@ -402,18 +401,24 @@ func (q *querier) streamEventsFromChunk(ctx context.Context, date, chunk string)
 		reader.Close()
 	}
 
+	var prevErr error
+
 	return stream.Func(func() (eventParquet, error) {
+		if prevErr != nil {
+			return eventParquet{}, prevErr
+		}
 		// conventional wisdom says that we should use a larger persistent buffer here
 		// but in loadtesting this API was abserved having almost twice the throughput
 		// with a single element local buf variable instead.
 		var buf [1]eventParquet
-		_, err := reader.Read(buf[:])
-		if err != nil {
+		n, err := reader.Read(buf[:])
+		if n == 0 && err != nil {
 			if errors.Is(err, io.EOF) {
 				return eventParquet{}, io.EOF
 			}
 			return eventParquet{}, trace.Wrap(err)
 		}
+		prevErr = err
 		return buf[0], nil
 	}, closer)
 }
@@ -556,7 +561,7 @@ func (q *querier) SearchSessionEvents(ctx context.Context, req events.SearchSess
 	// for sessionID != "". This kind of call is done on RBAC to check if user can access that session.
 	filter := searchEventsFilter{eventTypes: events.SessionRecordingEvents}
 	if req.Cond != nil {
-		condFn, err := utils.ToFieldsCondition(req.Cond)
+		condFn, err := utils.ToFieldsCondition(*req.Cond)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
diff --git a/lib/events/athena/querier_test.go b/lib/events/athena/querier_test.go
index 0f790b90e9b88..9e761065510fc 100644
--- a/lib/events/athena/querier_test.go
+++ b/lib/events/athena/querier_test.go
@@ -19,25 +19,33 @@
 package athena
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"log/slog"
+	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/athena"
 	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3Types "github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/dustin/go-humanize"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
+	"github.com/parquet-go/parquet-go"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
@@ -192,8 +200,8 @@ func TestSearchEvents(t *testing.T) {
 			check: func(t *testing.T, mock *mockAthenaExecutor, paginationKey string) {
 				wantSingleCallToAthena(t, mock)
 				wantQuery(t, mock, selectFromPrefix+whereTimeRange+
-					` AND session_id = ? AND event_type IN (?,?,?) ORDER BY event_time ASC, uid ASC LIMIT 100;`)
-				wantQueryParams(t, mock, append(timeRangeParams, "'9762a4fe-ac4b-47b5-ba4f-5f70d065849a'", "'session.end'", "'windows.desktop.session.end'", "'db.session.end'")...)
+					` AND session_id = ? AND event_type IN (?,?,?,?) ORDER BY event_time ASC, uid ASC LIMIT 100;`)
+				wantQueryParams(t, mock, append(timeRangeParams, "'9762a4fe-ac4b-47b5-ba4f-5f70d065849a'", "'session.end'", "'windows.desktop.session.end'", "'db.session.end'", "'app.session.chunk'")...)
 			},
 		},
 		{
@@ -945,3 +953,121 @@ func (f *fakeAthenaResultsGetter) GetQueryResults(ctx context.Context, params *a
 		},
 	}, nil
 }
+
+func Test_querier_streamEventsFromChunk(t *testing.T) {
+	const (
+		tableName  = "test_table"
+		bucketName = "test_bucket"
+		prefix     = "test_prefix"
+		date       = "2025-12-01"
+		chunkID    = "test_chunk"
+	)
+
+	event1 := &apievents.AppCreate{
+		Metadata: apievents.Metadata{
+			ID:   uuid.NewString(),
+			Time: time.Now().UTC(),
+			Type: events.AppCreateEvent,
+		},
+		AppMetadata: apievents.AppMetadata{
+			AppName: "app-1",
+		},
+	}
+	event2 := &apievents.AppCreate{
+		Metadata: apievents.Metadata{
+			ID:   uuid.NewString(),
+			Time: time.Now().UTC(),
+			Type: events.AppCreateEvent,
+		},
+		AppMetadata: apievents.AppMetadata{
+			AppName: "app-2",
+		},
+	}
+
+	tests := []struct {
+		name   string
+		events []apievents.AuditEvent
+	}{
+		{
+			name:   "single-event chunk",
+			events: []apievents.AuditEvent{event1},
+		},
+		{
+			name:   "multi-event chunk",
+			events: []apievents.AuditEvent{event1, event2},
+		},
+	}
+	for _, tt := range tests {
+		// add event parquets (in one .parquet file) to mock S3 getter
+		payloads, err := auditEventsToParquet(tt.events)
+		require.NoError(t, err)
+
+		buf := new(bytes.Buffer)
+		writer := parquet.NewGenericWriter[eventParquet](buf)
+		_, err = writer.Write(payloads)
+		require.NoError(t, err)
+		require.NoError(t, writer.Close())
+
+		key := fmt.Sprintf("%s/%s/%s.parquet", prefix, date, chunkID)
+		file := filepath.Join(bucketName, key)
+		mockS3 := &mockS3Getter{
+			files: map[string][]byte{
+				file: buf.Bytes(),
+			},
+		}
+
+		q := &querier{
+			querierConfig: querierConfig{
+				tablename:        tableName,
+				locationS3Bucket: bucketName,
+				locationS3Prefix: prefix,
+				logger:           slog.Default(),
+				tracer:           tracing.NoopTracer(teleport.ComponentAthena),
+			},
+			s3Getter: mockS3,
+		}
+
+		eventStream := q.streamEventsFromChunk(t.Context(), date, chunkID)
+		eventParquets, err := stream.Collect(eventStream)
+		require.NoError(t, err)
+		require.Len(t, eventParquets, len(payloads))
+		for i, e := range eventParquets {
+			require.Equal(t, payloads[i].UID, e.UID)
+		}
+	}
+}
+
+func auditEventsToParquet(in []apievents.AuditEvent) ([]eventParquet, error) {
+	out := make([]eventParquet, 0, len(in))
+
+	for _, e := range in {
+		p, err := auditEventToParquet(e)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *p)
+	}
+	return out, nil
+}
+
+type mockS3Getter struct {
+	mu    sync.Mutex
+	files map[string][]byte
+}
+
+func (m *mockS3Getter) GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	file := filepath.Join(*params.Bucket, *params.Key)
+	if obj, ok := m.files[file]; ok {
+		return &s3.GetObjectOutput{
+			Body: io.NopCloser(bytes.NewReader(obj)),
+		}, nil
+	}
+	return nil, &s3Types.NoSuchKey{Message: aws.String("key does not exist")}
+}
+
+func (m *mockS3Getter) ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error) {
+	return &s3.ListObjectsV2Output{}, nil
+}
diff --git a/lib/events/athena/test.go b/lib/events/athena/test.go
deleted file mode 100644
index 25122e0c3cce1..0000000000000
--- a/lib/events/athena/test.go
+++ /dev/null
@@ -1,484 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package athena
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	awsconfig "github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/service/athena"
-	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
-	"github.com/aws/aws-sdk-go-v2/service/glue"
-	glueTypes "github.com/aws/aws-sdk-go-v2/service/glue/types"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	s3Types "github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/aws/aws-sdk-go-v2/service/sns"
-	"github.com/aws/aws-sdk-go-v2/service/sqs"
-	sqsTypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
-	"github.com/google/uuid"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport"
-	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
-	"github.com/gravitational/teleport/api/internalutils/stream"
-	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/observability/tracing"
-)
-
-// createTableQuery is query used to create athena table using parquet on s3.
-// Right now only hardcoded in integration tests, in future it may be moved
-// to athena main file if we decide to create table on demand from teleport.
-var createTableQuery = `
-CREATE EXTERNAL TABLE %s (
-	uid string,
-	session_id string,
-	event_type string,
-	event_time timestamp,
-	user string,
-	event_data string
-  )
-  PARTITIONED BY (
-   event_date DATE
-  )
-  ROW FORMAT SERDE 'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe'
-  STORED AS INPUTFORMAT 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat'
-  OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat'
-  LOCATION "%s/"
-  TBLPROPERTIES (
-   "projection.enabled" = "true",
-   "projection.event_date.type" = "date",
-   "projection.event_date.format" = "yyyy-MM-dd",
-   "projection.event_date.range" = "NOW-4YEARS,NOW",
-   "projection.event_date.interval" = "1",
-   "projection.event_date.interval.unit" = "DAYS",
-   "storage.location.template" = "%s/${event_date}/",
-   "classification" = "parquet",
-   "parquet.compression" = "SNAPPY"
-  )
-`
-
-type AthenaContext struct {
-	log                *Log
-	clock              clockwork.Clock
-	testID             string
-	Database           string
-	bucketForEvents    string
-	bucketForTempFiles string
-	TableName          string
-	s3eventsLocation   string
-	S3ResultsLocation  string
-	s3largePayloads    string
-	batcherInterval    time.Duration
-}
-
-func (a *AthenaContext) GetLog() *Log {
-	return a.log
-}
-
-// AthenaContextConfig is optional config to override defaults in athena context.
-type AthenaContextConfig struct {
-	MaxBatchSize int
-	BypassSNS    bool
-}
-
-type InfraOutputs struct {
-	TopicARN string
-	QueueURL string
-	Region   string
-}
-
-func (ac *AthenaContext) Close(t *testing.T) {
-	assert.NoError(t, ac.log.Close())
-}
-
-// EventuallyConsistentAuditLogger is used to add delay before searching for events
-// for eventually consistent audit loggers.
-type EventuallyConsistentAuditLogger struct {
-	Inner events.AuditLogger
-
-	// QueryDelay specifies how long query should wait after last emit event.
-	QueryDelay time.Duration
-
-	// mu protects field below.
-	mu                    sync.Mutex
-	emitWasAfterLastDelay bool
-}
-
-func (e *EventuallyConsistentAuditLogger) EmitAuditEvent(ctx context.Context, in apievents.AuditEvent) error {
-	e.mu.Lock()
-	e.emitWasAfterLastDelay = true
-	e.mu.Unlock()
-	return e.Inner.EmitAuditEvent(ctx, in)
-}
-
-func (e *EventuallyConsistentAuditLogger) SearchEvents(ctx context.Context, req events.SearchEventsRequest) ([]apievents.AuditEvent, string, error) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.emitWasAfterLastDelay {
-		time.Sleep(e.QueryDelay)
-		// clear emit delay
-		e.emitWasAfterLastDelay = false
-	}
-	return e.Inner.SearchEvents(ctx, req)
-}
-
-func (e *EventuallyConsistentAuditLogger) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.emitWasAfterLastDelay {
-		time.Sleep(e.QueryDelay)
-		// clear emit delay
-		e.emitWasAfterLastDelay = false
-	}
-	return e.Inner.ExportUnstructuredEvents(ctx, req)
-}
-
-func (e *EventuallyConsistentAuditLogger) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.emitWasAfterLastDelay {
-		time.Sleep(e.QueryDelay)
-		// clear emit delay
-		e.emitWasAfterLastDelay = false
-	}
-	return e.Inner.GetEventExportChunks(ctx, req)
-}
-
-func (e *EventuallyConsistentAuditLogger) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.emitWasAfterLastDelay {
-		time.Sleep(e.QueryDelay)
-		// clear emit delay
-		e.emitWasAfterLastDelay = false
-	}
-	return e.Inner.SearchSessionEvents(ctx, req)
-}
-
-func (e *EventuallyConsistentAuditLogger) Close() error {
-	return e.Inner.Close()
-}
-
-func SetupAthenaContext(t *testing.T, ctx context.Context, cfg AthenaContextConfig) *AthenaContext {
-	testEnabled := os.Getenv(teleport.AWSRunTests)
-	if ok, _ := strconv.ParseBool(testEnabled); !ok {
-		t.Skip("Skipping AWS-dependent test suite.")
-	}
-
-	testID := fmt.Sprintf("auditlogs-integrationtests-%v", uuid.New().String())
-
-	clock := clockwork.NewRealClock()
-
-	backend, err := memory.New(memory.Config{})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		assert.NoError(t, backend.Close())
-	})
-	bucketWithLocking := "auditlogs-integrationtests-locking"
-	bucketForTemporaryFiles := "auditlogs-integrationtests"
-	ac := &AthenaContext{
-		clock:              clock,
-		testID:             testID,
-		Database:           "auditlogs_integrationtests",
-		bucketForEvents:    bucketWithLocking,
-		bucketForTempFiles: bucketForTemporaryFiles,
-		s3eventsLocation:   fmt.Sprintf("s3://%s/%s/events", bucketWithLocking, testID),
-		S3ResultsLocation:  fmt.Sprintf("s3://%s/%s/results", bucketForTemporaryFiles, testID),
-		s3largePayloads:    fmt.Sprintf("s3://%s/%s/large_payloads", bucketForTemporaryFiles, testID),
-		TableName:          strings.ReplaceAll(testID, "-", "_"),
-		batcherInterval:    10 * time.Second,
-	}
-	infraOut := ac.setupInfraWithCleanup(t, ctx)
-
-	region := infraOut.Region
-	if region == "" {
-		region = "eu-central-1"
-	}
-
-	topicARN := infraOut.TopicARN
-	if cfg.BypassSNS {
-		topicARN = topicARNBypass
-	}
-	log, err := New(ctx, Config{
-		Region:           region,
-		Clock:            clock,
-		Database:         ac.Database,
-		TableName:        ac.TableName,
-		TopicARN:         topicARN,
-		QueueURL:         infraOut.QueueURL,
-		LocationS3:       ac.s3eventsLocation,
-		QueryResultsS3:   ac.S3ResultsLocation,
-		LargeEventsS3:    ac.s3largePayloads,
-		BatchMaxInterval: ac.batcherInterval,
-		BatchMaxItems:    cfg.MaxBatchSize,
-		Backend:          backend,
-		Workgroup:        "primary",
-	})
-	require.NoError(t, err)
-
-	ac.log = log
-	t.Cleanup(func() {
-		ac.Close(t)
-	})
-
-	t.Logf("Initialized Athena test suite %q\n", testID)
-
-	return ac
-}
-
-func (ac *AthenaContext) setupInfraWithCleanup(t *testing.T, ctx context.Context) *InfraOutputs {
-	const timeoutDurationOnCleanup = 1 * time.Minute
-
-	awsCfg, err := awsconfig.LoadDefaultConfig(ctx)
-	require.NoError(t, err)
-
-	// Create SNS topic and set cleanup fn.
-	snsClient := sns.NewFromConfig(awsCfg)
-	topicCreated, err := snsClient.CreateTopic(ctx, &sns.CreateTopicInput{
-		Name: aws.String(ac.testID),
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
-		defer cancel()
-		_, err = snsClient.DeleteTopic(cleanupCtx, &sns.DeleteTopicInput{
-			TopicArn: topicCreated.TopicArn,
-		})
-		assert.NoError(t, err)
-	})
-
-	// Create SQS queue and set cleanup fn.
-	sqsClient := sqs.NewFromConfig(awsCfg)
-	queueCreated, err := sqsClient.CreateQueue(ctx, &sqs.CreateQueueInput{
-		QueueName: aws.String(ac.testID),
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
-		defer cancel()
-		_, err := sqsClient.DeleteQueue(cleanupCtx, &sqs.DeleteQueueInput{
-			QueueUrl: queueCreated.QueueUrl,
-		})
-		assert.NoError(t, err)
-	})
-
-	// Set created queue as subscriber to topic and use valid permissions.
-	queueAttr, err := sqsClient.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
-		QueueUrl:       queueCreated.QueueUrl,
-		AttributeNames: []sqsTypes.QueueAttributeName{sqsTypes.QueueAttributeNameQueueArn},
-	})
-	require.NoError(t, err)
-	queueArn := queueAttr.Attributes["QueueArn"]
-	type StatementEntry struct {
-		Effect    string
-		Action    []string
-		Resource  string
-		Principal map[string]string
-		Condition map[string]map[string]string
-	}
-	type PolicyDocument struct {
-		Version   string
-		Statement []StatementEntry
-	}
-	sqsAccessPolicy := PolicyDocument{
-		Version: "2012-10-17",
-		Statement: []StatementEntry{
-			{
-				Effect:   "Allow",
-				Action:   []string{"SQS:SendMessage"},
-				Resource: queueArn,
-				Principal: map[string]string{
-					"AWS": "*",
-				},
-				Condition: map[string]map[string]string{
-					"ArnLike": {
-						"aws:SourceArn": *topicCreated.TopicArn,
-					},
-				},
-			},
-		},
-	}
-	marshaledPolicy, err := json.Marshal(sqsAccessPolicy)
-	require.NoError(t, err)
-	_, err = sqsClient.SetQueueAttributes(ctx, &sqs.SetQueueAttributesInput{
-		Attributes: map[string]string{
-			"Policy": string(marshaledPolicy),
-		},
-		QueueUrl: queueCreated.QueueUrl,
-	})
-	require.NoError(t, err)
-	_, err = snsClient.Subscribe(ctx, &sns.SubscribeInput{
-		TopicArn: topicCreated.TopicArn,
-		Protocol: aws.String("sqs"),
-		Attributes: map[string]string{
-			"RawMessageDelivery": "true",
-		},
-		Endpoint: aws.String(queueArn),
-	})
-	require.NoError(t, err)
-
-	// Create bucket for long term storage if not exists. Bucket will have object locking which
-	// prevents from deleting objects, that's why it can exists before.
-	// Retention period will take care of cleanup of files.
-	s3Client := s3.NewFromConfig(awsCfg)
-	_, err = s3Client.HeadBucket(ctx, &s3.HeadBucketInput{
-		Bucket: aws.String(ac.bucketForEvents),
-	})
-	if err != nil {
-		var notFound *s3Types.NotFound
-		if errors.As(err, &notFound) {
-			_, err = s3Client.CreateBucket(ctx, &s3.CreateBucketInput{
-				Bucket:                     aws.String(ac.bucketForEvents),
-				ObjectLockEnabledForBucket: aws.Bool(true),
-				CreateBucketConfiguration: &s3Types.CreateBucketConfiguration{
-					LocationConstraint: s3Types.BucketLocationConstraint(awsCfg.Region),
-				},
-			})
-			require.NoError(t, err)
-			_, err = s3Client.PutObjectLockConfiguration(ctx, &s3.PutObjectLockConfigurationInput{
-				Bucket: aws.String(ac.bucketForEvents),
-				ObjectLockConfiguration: &s3Types.ObjectLockConfiguration{
-					ObjectLockEnabled: s3Types.ObjectLockEnabledEnabled,
-					Rule: &s3Types.ObjectLockRule{
-						DefaultRetention: &s3Types.DefaultRetention{
-							Days: aws.Int32(1),
-							Mode: s3Types.ObjectLockRetentionModeGovernance,
-						},
-					},
-				},
-			})
-			require.NoError(t, err)
-		} else {
-			assert.Fail(t, "unexpected err", err)
-		}
-	}
-
-	// Create bucket if not exists for temporary files (large payloads and query results).
-	// Retention period will take care of cleanup of files.
-	_, err = s3Client.HeadBucket(ctx, &s3.HeadBucketInput{
-		Bucket: aws.String(ac.bucketForTempFiles),
-	})
-	if err != nil {
-		var notFound *s3Types.NotFound
-		if errors.As(err, &notFound) {
-			_, createErr := s3Client.CreateBucket(ctx, &s3.CreateBucketInput{
-				Bucket: aws.String(ac.bucketForTempFiles),
-				CreateBucketConfiguration: &s3Types.CreateBucketConfiguration{
-					LocationConstraint: s3Types.BucketLocationConstraint(awsCfg.Region),
-				},
-			})
-			require.NoError(t, createErr)
-		} else {
-			assert.Fail(t, "unexpected err", err)
-		}
-	}
-	_, err = s3Client.PutBucketLifecycleConfiguration(ctx, &s3.PutBucketLifecycleConfigurationInput{
-		Bucket: aws.String(ac.bucketForTempFiles),
-		LifecycleConfiguration: &s3Types.BucketLifecycleConfiguration{
-			Rules: []s3Types.LifecycleRule{
-				{
-					Status: s3Types.ExpirationStatusEnabled,
-					Expiration: &s3Types.LifecycleExpiration{
-						Days: aws.Int32(1),
-					},
-					// Prefix is required field, empty means set to whole bucket.
-					Prefix: aws.String(""),
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	// Create glue db if not exists
-	glueClient := glue.NewFromConfig(awsCfg)
-	_, err = glueClient.GetDatabase(ctx, &glue.GetDatabaseInput{
-		Name: aws.String(ac.Database),
-	})
-	if err != nil {
-		var notFound *glueTypes.EntityNotFoundException
-		if errors.As(err, &notFound) {
-			_, createErr := glueClient.CreateDatabase(ctx, &glue.CreateDatabaseInput{
-				DatabaseInput: &glueTypes.DatabaseInput{
-					Name: aws.String(ac.Database),
-				},
-			})
-			require.NoError(t, createErr)
-		} else {
-			assert.Fail(t, "unexpected err: %v", err)
-		}
-	}
-
-	// Create athena table
-	athenaClient := athena.NewFromConfig(awsCfg)
-	startQueryExecResp, err := athenaClient.StartQueryExecution(ctx, &athena.StartQueryExecutionInput{
-		QueryString: aws.String(fmt.Sprintf(createTableQuery, ac.TableName, ac.s3eventsLocation, ac.s3eventsLocation)),
-		ResultConfiguration: &athenaTypes.ResultConfiguration{
-			OutputLocation: aws.String(ac.S3ResultsLocation),
-		},
-		QueryExecutionContext: &athenaTypes.QueryExecutionContext{
-			Database: aws.String(ac.Database),
-		},
-	})
-	require.NoError(t, err)
-	// querier is just used here to get helper fn waitForSuccess.
-	q := querier{
-		athenaClient: athenaClient,
-		querierConfig: querierConfig{
-			getQueryResultsInterval: 100 * time.Millisecond,
-			clock:                   ac.clock,
-			tracer:                  tracing.NoopTracer(teleport.ComponentAthena),
-		},
-	}
-	err = q.waitForSuccess(ctx, aws.ToString(startQueryExecResp.QueryExecutionId))
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		cleanupCtx, cancel := context.WithTimeout(context.Background(), timeoutDurationOnCleanup)
-		defer cancel()
-		_, err = athenaClient.StartQueryExecution(cleanupCtx, &athena.StartQueryExecutionInput{
-			QueryString: aws.String(fmt.Sprintf("drop table %s;", ac.TableName)),
-			ResultConfiguration: &athenaTypes.ResultConfiguration{
-				OutputLocation: aws.String(ac.S3ResultsLocation),
-			},
-			QueryExecutionContext: &athenaTypes.QueryExecutionContext{
-				Database: aws.String(ac.Database),
-			},
-		})
-		assert.NoError(t, err)
-	})
-
-	return &InfraOutputs{
-		TopicARN: aws.ToString(topicCreated.TopicArn),
-		QueueURL: aws.ToString(queueCreated.QueueUrl),
-		Region:   awsCfg.Region,
-	}
-}
diff --git a/lib/events/auditlog.go b/lib/events/auditlog.go
index 274c3c65c56a6..c04a82eccce1d 100644
--- a/lib/events/auditlog.go
+++ b/lib/events/auditlog.go
@@ -19,10 +19,12 @@
 package events
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"io"
 	"io/fs"
+	"iter"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -38,7 +40,10 @@ import (
 	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/defaults"
+	sessionpostprocessing "github.com/gravitational/teleport/lib/events/sessionpostprocessing"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
@@ -203,6 +208,9 @@ type AuditLog struct {
 	// localLog is a local events log used
 	// to emit audit events if no external log has been specified
 	localLog *FileLog
+
+	// decrypter wraps session replay with decryption
+	decrypter DecryptionWrapper
 }
 
 // AuditLogConfig specifies configuration for AuditLog server
@@ -247,6 +255,14 @@ type AuditLogConfig struct {
 
 	// Context is audit log context
 	Context context.Context
+
+	// Decrypter wraps session replay with decryption
+	Decrypter DecryptionWrapper
+
+	// SessionSummarizerProvider provides session summarizers
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider provides recording metadata service
+	RecordingMetadataProvider *recordingmetadata.Provider
 }
 
 // CheckAndSetDefaults checks and sets defaults
@@ -258,7 +274,7 @@ func (a *AuditLogConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing parameter ServerID")
 	}
 	if a.UploadHandler == nil {
-		return trace.BadParameter("missing parameter UploadHandler")
+		return trace.BadParameter("missing parameter DownloadHandler")
 	}
 	if a.Clock == nil {
 		a.Clock = clockwork.NewRealClock()
@@ -273,6 +289,12 @@ func (a *AuditLogConfig) CheckAndSetDefaults() error {
 		mask := os.FileMode(teleport.DirMaskSharedGroup)
 		a.DirMask = &mask
 	}
+	if a.SessionSummarizerProvider == nil {
+		a.SessionSummarizerProvider = summarizer.NewSessionSummarizerProvider()
+	}
+	if a.RecordingMetadataProvider == nil {
+		a.RecordingMetadataProvider = recordingmetadata.NewProvider()
+	}
 	if (a.GID != nil && a.UID == nil) || (a.UID != nil && a.GID == nil) {
 		return trace.BadParameter("if UID or GID is set, both should be specified")
 	}
@@ -304,6 +326,7 @@ func NewAuditLog(cfg AuditLogConfig) (*AuditLog, error) {
 		activeDownloads: make(map[string]context.Context),
 		ctx:             ctx,
 		cancel:          cancel,
+		decrypter:       cfg.Decrypter,
 	}
 	// create a directory for audit logs, audit log does not create
 	// session logs before migrations are run in case if the directory
@@ -572,7 +595,7 @@ func (l *AuditLog) StreamSessionEvents(ctx context.Context, sessionID session.ID
 			return
 		}
 
-		protoReader := NewProtoReader(rawSession)
+		protoReader := NewProtoReader(rawSession, l.decrypter)
 		defer protoReader.Close()
 
 		firstEvent := true
@@ -611,6 +634,83 @@ func (l *AuditLog) StreamSessionEvents(ctx context.Context, sessionID session.ID
 	return c, e
 }
 
+// UploadEncryptedRecording uploads encrypted recordings using the AuditLog's configured UploadHandler.
+func (l *AuditLog) UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+	sessID, err := session.ParseID(sessionID)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	upload, err := l.UploadHandler.CreateUpload(ctx, *sessID)
+	if err != nil {
+		return trace.Wrap(err, "creating upload")
+	}
+
+	next, stop := iter.Pull2(parts)
+	defer stop()
+
+	part, err, ok := next()
+	if err != nil {
+		return trace.Wrap(err)
+	} else if !ok {
+		return trace.BadParameter("unexpected empty upload")
+	}
+
+	var streamParts []StreamPart
+	// S3 requires that part numbers start at 1, so we do that by default regardless of which uploader is
+	// configured for the auth service
+	var partNumber int64 = 1
+	for {
+		if err := l.UploadHandler.ReserveUploadPart(ctx, *upload, partNumber); err != nil {
+			return trace.Wrap(err, "reserving upload part")
+		}
+
+		nextPart, err, hasNext := next()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		// If the upload part is not at least the minimum upload part size, and this isn't
+		// the last part, add padding to meet the minimum upload size.
+		if hasNext && len(part) < MinUploadPartSizeBytes {
+			part = PadUploadPart(part, MinUploadPartSizeBytes)
+		}
+
+		streamPart, err := l.UploadHandler.UploadPart(ctx, *upload, partNumber, bytes.NewReader(part))
+		if err != nil {
+			return trace.Wrap(err, "uploading part")
+		}
+		streamParts = append(streamParts, *streamPart)
+
+		if !hasNext {
+			break
+		}
+
+		part = nextPart
+		partNumber++
+	}
+	err = l.UploadHandler.CompleteUpload(ctx, *upload, streamParts)
+	if err != nil {
+		return trace.Wrap(err, "completing upload")
+	}
+
+	sessionEnd, err := FindSessionEndEvent(ctx, l, session.ID(sessionID))
+	if err != nil || sessionEnd == nil {
+		return nil
+	}
+	if err := sessionpostprocessing.Process(
+		ctx,
+		sessionpostprocessing.Config{
+			SessionEnd:                sessionEnd,
+			SessionID:                 upload.SessionID,
+			SessionSummarizerProvider: l.SessionSummarizerProvider,
+			RecordingMetadataProvider: l.RecordingMetadataProvider,
+		},
+	); err != nil {
+		l.log.WarnContext(ctx, "session post-processing failed", "error", err)
+	}
+	return nil
+}
+
 // getLocalLog returns the local (file based) AuditLogger.
 func (l *AuditLog) getLocalLog() AuditLogger {
 	l.RLock()
@@ -727,3 +827,20 @@ func sessionStartCallbackFromContext(ctx context.Context) (SessionStartCallback,
 
 	return cb, nil
 }
+
+// PadUploadPart adds padding to the given upload part to reach the minimum size.
+func PadUploadPart(uploadPart []byte, minSize int) []byte {
+	// Create padding to reach the target size. Note that the padding cannot
+	// be shorter than the header size.
+	paddingBytes := max(minSize-len(uploadPart), ProtoStreamV2PartHeaderSize)
+	paddedPart := make([]byte, paddingBytes)
+
+	paddedPartHeader := PartHeader{
+		ProtoVersion: ProtoStreamV2,
+		PaddingSize:  uint64(paddingBytes - ProtoStreamV2PartHeaderSize),
+		PartSize:     0,
+	}
+	copy(paddedPart, paddedPartHeader.Bytes())
+
+	return append(uploadPart, paddedPart...)
+}
diff --git a/lib/events/auditlog_test.go b/lib/events/auditlog_test.go
index 416373e3e6951..d5a97c73dbb23 100644
--- a/lib/events/auditlog_test.go
+++ b/lib/events/auditlog_test.go
@@ -19,8 +19,10 @@
 package events_test
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -28,19 +30,24 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -308,6 +315,55 @@ func TestExternalLog(t *testing.T) {
 	require.Equal(t, m.Emitter.Events()[0], evt)
 }
 
+func TestUploadEncryptedRecording(t *testing.T) {
+	ctx := context.Background()
+	uploader := eventstest.NewMemoryUploader()
+	alog, err := events.NewAuditLog(events.AuditLogConfig{
+		DataDir:       t.TempDir(),
+		ServerID:      "server1",
+		UploadHandler: uploader,
+	})
+	require.NoError(t, err)
+	defer alog.Close()
+
+	parts := [][]byte{
+		[]byte("123"),
+		[]byte("456"),
+		[]byte("789"),
+	}
+	partIter := func(yield func([]byte, error) bool) {
+		for _, part := range parts {
+			if part == nil {
+				if !yield(nil, errors.New("invalid part")) {
+					return
+				}
+			} else {
+				if !yield(part, nil) {
+					return
+				}
+			}
+		}
+	}
+	sessionID, err := uuid.NewV7()
+	require.NoError(t, err)
+
+	err = alog.UploadEncryptedRecording(ctx, sessionID.String(), partIter)
+	require.NoError(t, err)
+
+	uploads, err := uploader.ListUploads(ctx)
+	require.NoError(t, err)
+	require.Len(t, uploads, 1)
+
+	uploaded, err := uploader.ListParts(ctx, uploads[0])
+	require.NoError(t, err)
+
+	require.Len(t, uploaded, len(parts))
+	for idx, part := range uploaded {
+		// uploaded part numbers should increment starting with 1
+		require.Equal(t, int64(idx+1), part.Number)
+	}
+}
+
 func makeLog(t *testing.T, clock clockwork.Clock) *events.AuditLog {
 	alog, err := events.NewAuditLog(events.AuditLogConfig{
 		DataDir:       t.TempDir(),
@@ -320,3 +376,161 @@ func makeLog(t *testing.T, clock clockwork.Clock) *events.AuditLog {
 
 	return alog
 }
+
+func TestPadUploadPart(t *testing.T) {
+	partData := bytes.Repeat([]byte{1, 2, 3}, 10)
+	partHeader := events.PartHeader{
+		ProtoVersion: events.V2,
+		PartSize:     uint64(len(partData)),
+		PaddingSize:  0,
+	}
+	headerBytes := partHeader.Bytes()
+	part := append(headerBytes, partData...)
+
+	// Pad the upload part to double the size.
+	minSize := len(part) * 2
+	paddedPart := events.PadUploadPart(part, minSize)
+	require.Len(t, paddedPart, minSize)
+
+	// Padding the upload part again with the same minimum should add a single header in size.
+	paddedPart = events.PadUploadPart(paddedPart, minSize)
+	require.Len(t, paddedPart, minSize+events.ProtoStreamV2PartHeaderSize)
+
+	// Ensure we can read out each part.
+	r := bytes.NewReader(paddedPart)
+	h1, err := events.ParsePartHeader(r)
+	require.NoError(t, err)
+	require.Equal(t, partHeader, h1)
+	gotData, err := io.ReadAll(io.LimitReader(r, int64(h1.PartSize)))
+	require.NoError(t, err)
+	require.Equal(t, partData, gotData)
+	io.Copy(io.Discard, io.LimitReader(r, int64(h1.PaddingSize)))
+
+	h2, err := events.ParsePartHeader(r)
+	require.NoError(t, err)
+	require.Equal(t, events.PartHeader{
+		ProtoVersion: events.V2,
+		PaddingSize:  uint64(len(part) - events.ProtoStreamV2PartHeaderSize),
+	}, h2)
+	io.Copy(io.Discard, io.LimitReader(r, int64(h2.PaddingSize)))
+
+	h3, err := events.ParsePartHeader(r)
+	require.NoError(t, err)
+	require.Equal(t, events.PartHeader{
+		ProtoVersion: events.V2,
+		PaddingSize:  0,
+	}, h3)
+
+	_, err = r.Read(nil)
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestCallingSummarizerMetadata(t *testing.T) {
+	ctx := t.Context()
+
+	parts := generateParts(t)
+	sessionID, err := uuid.NewV7()
+	require.NoError(t, err)
+	metadataProvider := recordingmetadata.NewProvider()
+	recorderMetadata := &fakeRecordingMetadata{}
+	recorderMetadata.On("ProcessSessionRecording", mock.Anything, session.ID(sessionID.String()), mock.Anything).
+		Return(nil).Once()
+	metadataProvider.SetService(recorderMetadata)
+
+	summarizerProvider := summarizer.NewSessionSummarizerProvider()
+	sessionSummarizer := &fakeSummarizer{}
+	sessionSummarizer.On("SummarizeSSH", mock.Anything, mock.Anything).
+		Return(nil).Once()
+	summarizerProvider.SetSummarizer(sessionSummarizer)
+
+	uploader := eventstest.NewMemoryUploader()
+	alog, err := events.NewAuditLog(events.AuditLogConfig{
+		DataDir:                   t.TempDir(),
+		ServerID:                  "server1",
+		UploadHandler:             uploader,
+		SessionSummarizerProvider: summarizerProvider,
+		RecordingMetadataProvider: metadataProvider,
+	})
+	require.NoError(t, err)
+	defer alog.Close()
+
+	partIter := func(yield func([]byte, error) bool) {
+		for _, part := range parts {
+			if part == nil {
+				if !yield(nil, errors.New("invalid part")) {
+					return
+				}
+			} else {
+				if !yield(part, nil) {
+					return
+				}
+			}
+		}
+	}
+
+	err = alog.UploadEncryptedRecording(ctx, sessionID.String(), partIter)
+	require.NoError(t, err)
+
+	recorderMetadata.AssertExpectations(t)
+	sessionSummarizer.AssertExpectations(t)
+}
+
+type fakeRecordingMetadata struct {
+	mock.Mock
+}
+
+func (f *fakeRecordingMetadata) ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error {
+	args := f.Called(ctx, sessionID, duration)
+	return args.Error(0)
+}
+
+type fakeSummarizer struct {
+	mock.Mock
+}
+
+func (f *fakeSummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *apievents.SessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *apievents.DatabaseSessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	args := f.Called(ctx, sessionID)
+	return args.Error(0)
+}
+
+func generateParts(t *testing.T) [][]byte {
+	uploader := eventstest.NewMemoryUploader()
+
+	ctx := t.Context()
+	sid := session.NewID()
+	sessionEvents := eventstest.GenerateTestSession(eventstest.SessionParams{
+		PrintEvents: 1000,
+		UserName:    "alice",
+		SessionID:   string(sid),
+		ServerID:    "testcluster",
+		PrintData:   []string{"net", "stat"},
+	})
+
+	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+		Uploader: uploader,
+	})
+	require.NoError(t, err)
+	stream, err := streamer.CreateAuditStream(ctx, sid)
+	require.NoError(t, err)
+	for _, event := range sessionEvents {
+		require.NoError(t, stream.RecordEvent(ctx, eventstest.PrepareEvent(event)))
+	}
+	require.NoError(t, stream.Complete(ctx))
+
+	uploads, err := uploader.ListUploads(ctx)
+	require.NoError(t, err)
+	require.Len(t, uploads, 1)
+	parts, err := uploader.GetParts(uploads[0].ID)
+	require.NoError(t, err)
+	return parts
+}
diff --git a/lib/events/azsessions/azsessions.go b/lib/events/azsessions/azsessions.go
index 1e8e3cffaae96..d8d65a5975245 100644
--- a/lib/events/azsessions/azsessions.go
+++ b/lib/events/azsessions/azsessions.go
@@ -69,6 +69,24 @@ func sessionName(sid session.ID) string {
 	return sid.String()
 }
 
+// summaryName returns the name of the blob that contains the summary for a
+// given session.
+func summaryName(sid session.ID) string {
+	return sid.String() + ".summary.json"
+}
+
+// metadataName returns the name of the blob that contains the metadata for a
+// given session.
+func metadataName(sid session.ID) string {
+	return sid.String() + ".metadata"
+}
+
+// thumbnailName returns the name of the blob that contains the thumbnail for a
+// given session.
+func thumbnailName(sid session.ID) string {
+	return sid.String() + ".thumbnail"
+}
+
 // uploadMarkerPrefix is the prefix of the names of the upload marker blobs.
 // Listing blobs with this prefix will return an empty blob for each upload.
 const uploadMarkerPrefix = "upload/"
@@ -251,6 +269,21 @@ func (h *Handler) sessionBlob(sessionID session.ID) *blockblob.Client {
 	return h.session.NewBlockBlobClient(sessionName(sessionID))
 }
 
+// summaryBlob returns a BlockBlobClient for the blob of the session summary.
+func (h *Handler) summaryBlob(sessionID session.ID) *blockblob.Client {
+	return h.session.NewBlockBlobClient(summaryName(sessionID))
+}
+
+// metadataBlob returns a BlockBlobClient for the blob of the session metadata.
+func (h *Handler) metadataBlob(sessionID session.ID) *blockblob.Client {
+	return h.session.NewBlockBlobClient(metadataName(sessionID))
+}
+
+// thumbnailBlob returns a BlockBlobClient for the blob of the session thumbnail.
+func (h *Handler) thumbnailBlob(sessionID session.ID) *blockblob.Client {
+	return h.session.NewBlockBlobClient(thumbnailName(sessionID))
+}
+
 // uploadMarkerBlob returns a BlockBlobClient for the marker blob of the stream
 // upload.
 func (h *Handler) uploadMarkerBlob(upload events.StreamUpload) *blockblob.Client {
@@ -263,43 +296,77 @@ func (h *Handler) partBlob(upload events.StreamUpload, partNumber int64) *blockb
 	return h.inprogress.NewBlockBlobClient(partName(upload, partNumber))
 }
 
-// Upload implements [events.UploadHandler].
+// Upload implements [events.UploadHandler] and uploads a session recording.
 func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
-	sessionBlob := h.sessionBlob(sessionID)
+	return h.uploadBlob(ctx, sessionID, h.sessionBlob(sessionID), reader)
+}
 
-	if _, err := cErr(sessionBlob.UploadStream(ctx, reader, &blockblob.UploadStreamOptions{
+// UploadSummary implements [events.UploadHandler] and uploads a session
+// summary.
+func (h *Handler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadBlob(ctx, sessionID, h.summaryBlob(sessionID), reader)
+}
+
+// UploadMetadata implements [events.UploadHandler] and uploads the session
+// metadata.
+func (h *Handler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadBlob(ctx, sessionID, h.metadataBlob(sessionID), reader)
+}
+
+// UploadThumbnail implements [events.UploadHandler] and uploads the session
+// thumbnail.
+func (h *Handler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadBlob(ctx, sessionID, h.thumbnailBlob(sessionID), reader)
+}
+
+func (h *Handler) uploadBlob(ctx context.Context, sessionID session.ID, blob *blockblob.Client, reader io.Reader) (string, error) {
+	if _, err := cErr(blob.UploadStream(ctx, reader, &blockblob.UploadStreamOptions{
 		AccessConditions: &blobDoesNotExist,
 	})); err != nil {
 		return "", trace.Wrap(err)
 	}
-	h.log.DebugContext(ctx, "Uploaded session.", fieldSessionID, sessionID)
+	h.log.DebugContext(ctx, "Blob uploaded.", fieldSessionID, sessionID)
+
+	return blob.URL(), nil
+}
 
-	return sessionBlob.URL(), nil
+// Download implements [events.UploadHandler] and downloads a session recording.
+func (h *Handler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadBlob(ctx, sessionID, h.sessionBlob(sessionID), writer)
 }
 
-// Download implements [events.UploadHandler].
-func (h *Handler) Download(ctx context.Context, sessionID session.ID, writerAt io.WriterAt) error {
-	resp, err := cErr(h.sessionBlob(sessionID).DownloadStream(ctx, nil))
+// DownloadSummary implements [events.UploadHandler] and downloads a session summary.
+func (h *Handler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadBlob(ctx, sessionID, h.summaryBlob(sessionID), writer)
+}
+
+// DownloadMetadata implements [events.UploadHandler] and downloads a session's metadata.
+func (h *Handler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadBlob(ctx, sessionID, h.metadataBlob(sessionID), writer)
+}
+
+// DownloadThumbnail implements [events.UploadHandler] and downloads a session's thumbnail.
+func (h *Handler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadBlob(ctx, sessionID, h.thumbnailBlob(sessionID), writer)
+}
+
+func (h *Handler) downloadBlob(ctx context.Context, sessionID session.ID, blob *blockblob.Client, writer events.RandomAccessWriter) error {
+	resp, err := cErr(blob.DownloadStream(ctx, nil))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
-			h.log.WarnContext(ctx, "Error closing downloaded session blob.", "error", err, fieldSessionID, sessionID)
+			h.log.WarnContext(ctx, "Error closing downloaded blob.", "error", err, fieldSessionID, sessionID)
 		}
 	}()
 
-	writer, ok := writerAt.(io.Writer)
-	if !ok {
-		writer = io.NewOffsetWriter(writerAt, 0)
-	}
-
 	if _, err := io.Copy(writer, resp.Body); err != nil {
 		return trace.ConvertSystemError(cErr0(err))
 	}
 
-	h.log.DebugContext(ctx, "Downloaded session.", fieldSessionID, sessionID)
+	h.log.DebugContext(ctx, "Blob downloaded.", fieldSessionID, sessionID)
 	return nil
 }
 
@@ -456,7 +523,7 @@ func (*Handler) ReserveUploadPart(ctx context.Context, upload events.StreamUploa
 func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, partNumber int64, partBody io.ReadSeeker) (*events.StreamPart, error) {
 	partBlob := h.partBlob(upload, partNumber)
 
-	// our parts are just over 5 MiB (events.MinUploadPartSizeBytes) so we can
+	// our parts are just over 5 MiB [events.MinUploadPartSizeBytes] so we can
 	// upload them in one shot
 	response, err := cErr(partBlob.Upload(ctx, streaming.NopCloser(partBody), nil))
 	if err != nil {
diff --git a/lib/events/azsessions/azsessions_test.go b/lib/events/azsessions/azsessions_test.go
index 6a0e65c452370..01ace27c33d9a 100644
--- a/lib/events/azsessions/azsessions_test.go
+++ b/lib/events/azsessions/azsessions_test.go
@@ -28,11 +28,11 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -62,6 +62,9 @@ func TestStreams(t *testing.T) {
 	t.Run("UploadDownload", func(t *testing.T) {
 		test.UploadDownload(t, handler)
 	})
+	t.Run("UploadDownloadSummary", func(t *testing.T) {
+		test.UploadDownloadSummary(t, handler)
+	})
 	t.Run("DownloadNotFound", func(t *testing.T) {
 		test.DownloadNotFound(t, handler)
 	})
diff --git a/lib/events/codes.go b/lib/events/codes.go
index c4478c437de43..d6ca14089d2e9 100644
--- a/lib/events/codes.go
+++ b/lib/events/codes.go
@@ -739,6 +739,86 @@ const (
 	// sync attempt failure code.
 	AWSICResourceSyncFailureCode = "TAIC001E"
 
+	// MCPSessionStartCode is the event code for mcp.session.start.
+	MCPSessionStartCode = "TMCP001I"
+	// MCPSessionEndCode is the event code for mcp.session.end.
+	MCPSessionEndCode = "TMCP002I"
+	// MCPSessionEndFailureCode is the event code for mcp.session.end when the
+	// end request is denied by the MCP server.
+	MCPSessionEndFailureCode = "TMCP002E"
+	// MCPSessionRequestCode is the event code for mcp.session.request.
+	MCPSessionRequestCode = "TMCP003I"
+	// MCPSessionRequestFailureCode is the event code for mcp.session.request
+	// when the request is denied by Teleport or the MCP server.
+	MCPSessionRequestFailureCode = "TMCP003E"
+	// MCPSessionNotificationCode is the event code for
+	// mcp.session.notification.
+	MCPSessionNotificationCode = "TMCP004I"
+	// MCPSessionNotificationFailureCode is the event code for
+	// mcp.session.notification when the notification is denied by the MCP
+	// server.
+	MCPSessionNotificationFailureCode = "TMCP004E"
+	// MCPSessionListenSSEStreamCode is the event code for
+	// mcp.session.listen_sse_stream.
+	MCPSessionListenSSEStreamCode = "TMCP005I"
+	// MCPSessionListenSSEStreamFailureCode is the event code for
+	// mcp.session.listen_sse_stream when the request is denied by the MCP
+	// server.
+	MCPSessionListenSSEStreamFailureCode = "TMCP005E"
+	// MCPSessionInvalidHTTPRequestCode is the event code for
+	// mcp.session.invalid_http_request.
+	MCPSessionInvalidHTTPRequestCode = "TMCP006E"
+
+	// BoundKeypairRecoveryCode is the event code for
+	// join_token.bound_keypair.recovery.
+	BoundKeypairRecoveryCode = "TBK001I"
+	// BoundKeypairRotationCode is the event code for
+	// join_token.bound_keypair.rotation.
+	BoundKeypairRotationCode = "TBK002I"
+	// BoundKeypairJoinStateVerificationFailedCode is the event code for
+	// join_token.bound_keypair.join_state_verification_failed.
+	BoundKeypairJoinStateVerificationFailedCode = "TBK003W"
+
+	// SCIMResourceCreateSuccessCode indicates a resource was successfully
+	// provisioned via SCIM
+	SCIMResourceCreateSuccessCode = "TSCIM001I"
+	// SCIMResourceCreateFailureCode indicates a failed attempt to provision
+	// a resource via SCIM
+	SCIMResourceCreateFailureCode = "TSCIM001E"
+	// SCIMResourceUpdateSuccessCode indicates a resource was successfully
+	// updated via SCIM
+	SCIMResourceUpdateSuccessCode = "TSCIM002I"
+	// SCIMResourceUpdateFailureCode indicates a failed attempt to update
+	// a resource via SCIM
+	SCIMResourceUpdateFailureCode = "TSCIM002E"
+	// SCIMResourceDeleteSuccessCode indicates a resource was successfully
+	// deleted via SCIM
+	SCIMResourceDeleteSuccessCode = "TSCIM003I"
+	// SCIMResourceDeleteFailureCode indicates a indicates a failed attempt to
+	// update a resource via SCIM
+	SCIMResourceDeleteFailureCode = "TSCIM003E"
+	// SCIMGetResourceSuccessCode indicates a resource was successfully fetched
+	// fron Teleport via SCIM
+	SCIMGetResourceSuccessCode = "TSCIM004I"
+	// SCIMGetResourceFailureCode indicates a failed attempt to fetch a
+	// resource via SCIM
+	SCIMGetResourceFailureCode = "TSCIM004E"
+	// SCIMListResourcesSuccessCode indicates a resource listing was successfully fetched
+	// from Teleport via SCIM
+	SCIMListResourcesSuccessCode = "TSCIM005I"
+	// SCIMListResourcesFailureCode indicates a failed attempt to list resources
+	// via SCIM
+	SCIMListResourcesFailureCode = "TSCIM005E"
+	// ClientIPRestrictionsUpdateCode is the Client IP Restriction update event code.
+	ClientIPRestrictionsUpdateCode = "CIR001I"
+
+	// VnetConfigCreateCode is the Vnet config create event code.
+	VnetConfigCreateCode = "TVNET001I"
+	// VnetConfigUpdateCode is the Vnet config update event code.
+	VnetConfigUpdateCode = "TVNET002I"
+	// VnetConfigDeleteCode is the Vnet config delete event code.
+	VnetConfigDeleteCode = "TVNET003I"
+
 	// UnknownCode is used when an event of unknown type is encountered.
 	UnknownCode = apievents.UnknownCode
 )
diff --git a/lib/events/complete.go b/lib/events/complete.go
index 881e02e80ce62..a33cf6d27526d 100644
--- a/lib/events/complete.go
+++ b/lib/events/complete.go
@@ -36,6 +36,8 @@ import (
 	"github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
@@ -69,6 +71,12 @@ type UploadCompleterConfig struct {
 	Clock clockwork.Clock
 	// ClusterName identifies the originating teleport cluster
 	ClusterName string
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	RecordingMetadataProvider *recordingmetadata.Provider
 }
 
 // CheckAndSetDefaults checks and sets default values
@@ -94,6 +102,12 @@ func (cfg *UploadCompleterConfig) CheckAndSetDefaults() error {
 	if cfg.Clock == nil {
 		cfg.Clock = clockwork.NewRealClock()
 	}
+	if cfg.RecordingMetadataProvider == nil {
+		cfg.RecordingMetadataProvider = &recordingmetadata.Provider{}
+	}
+	if cfg.SessionSummarizerProvider == nil {
+		cfg.SessionSummarizerProvider = &summarizer.SessionSummarizerProvider{}
+	}
 	return nil
 }
 
@@ -348,6 +362,8 @@ func (u *UploadCompleter) ensureSessionEndEvent(ctx context.Context, uploadData
 	// We use the streaming events API to search through the session events, because it works
 	// for both Desktop and SSH sessions
 	var lastEvent events.AuditEvent
+	var startTime time.Time
+	var isPTYSession bool
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	evts, errors := u.cfg.AuditLog.StreamSessionEvents(ctx, uploadData.SessionID, 0)
@@ -368,11 +384,12 @@ loop:
 				return nil
 
 			case *events.WindowsDesktopSessionStart:
+				startTime = e.Time
 				desktopSessionEnd.Type = WindowsDesktopSessionEndEvent
 				desktopSessionEnd.Code = DesktopSessionEndCode
 				desktopSessionEnd.ClusterName = e.ClusterName
 				desktopSessionEnd.StartTime = e.Time
-				desktopSessionEnd.Participants = append(desktopSessionEnd.Participants, e.User)
+				desktopSessionEnd.Participants = append(desktopSessionEnd.Participants, transformedUsername(e.UserMetadata, u.cfg.ClusterName))
 				desktopSessionEnd.Recorded = true
 				desktopSessionEnd.UserMetadata = e.UserMetadata
 				desktopSessionEnd.SessionMetadata = e.SessionMetadata
@@ -383,6 +400,8 @@ loop:
 				desktopSessionEnd.DesktopName = fmt.Sprintf("%v (recovered)", e.DesktopName)
 
 			case *events.SessionStart:
+				isPTYSession = true
+				startTime = e.Time
 				sshSessionEnd.Type = SessionEndEvent
 				sshSessionEnd.Code = SessionEndCode
 				sshSessionEnd.ClusterName = e.ClusterName
@@ -396,10 +415,10 @@ loop:
 				sshSessionEnd.InitialCommand = e.InitialCommand
 				sshSessionEnd.SessionRecording = e.SessionRecording
 				sshSessionEnd.Interactive = e.TerminalSize != ""
-				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
+				sshSessionEnd.Participants = append(sshSessionEnd.Participants, transformedUsername(e.UserMetadata, u.cfg.ClusterName))
 
 			case *events.SessionJoin:
-				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
+				sshSessionEnd.Participants = append(sshSessionEnd.Participants, transformedUsername(e.UserMetadata, u.cfg.ClusterName))
 			}
 
 		case err := <-errors:
@@ -442,5 +461,37 @@ loop:
 	if err := u.cfg.AuditLog.EmitAuditEvent(ctx, sessionEndEvent); err != nil {
 		return trace.Wrap(err)
 	}
+
+	if !isPTYSession {
+		return nil
+	}
+
+	// For PTY sessions, process recording metadata and summarization.
+	recordingMetadata := u.cfg.RecordingMetadataProvider.Service()
+	if !startTime.IsZero() && !sessionEndEvent.GetTime().IsZero() {
+		duration := sessionEndEvent.GetTime().Sub(startTime)
+		if err := recordingMetadata.ProcessSessionRecording(ctx, uploadData.SessionID, duration); err != nil {
+			slog.WarnContext(ctx, "Failed to process session recording metadata", "error", err)
+		}
+	} else {
+		slog.WarnContext(ctx, "Session start or end time is not set, skipping recording metadata processing")
+	}
+
+	summarizer := u.cfg.SessionSummarizerProvider.SessionSummarizer()
+	if err := summarizer.SummarizeSSH(ctx, &sshSessionEnd); err != nil {
+		slog.WarnContext(ctx, "Failed to summarize upload", "error", err)
+		return trace.Wrap(err)
+	}
+
 	return nil
 }
+
+func transformedUsername(u events.UserMetadata, localCluster string) string {
+	return services.UsernameForCluster(
+		services.UsernameForClusterConfig{
+			User:              u.User,
+			OriginClusterName: u.UserClusterName,
+			LocalClusterName:  localCluster,
+		},
+	)
+}
diff --git a/lib/events/complete_test.go b/lib/events/complete_test.go
index a810f690682f2..ff76a34f11793 100644
--- a/lib/events/complete_test.go
+++ b/lib/events/complete_test.go
@@ -409,7 +409,7 @@ func (m *mockSessionTrackerService) RemoveSessionTracker(ctx context.Context, se
 	return trace.NotImplemented("RemoveSessionTracker is not implemented")
 }
 
-func (m *mockSessionTrackerService) UpdatePresence(ctx context.Context, sessionID, user string) error {
+func (m *mockSessionTrackerService) UpdatePresence(_ context.Context, _, _, _ string) error {
 	return trace.NotImplemented("UpdatePresence is not implemented")
 }
 
diff --git a/lib/events/discard.go b/lib/events/discard.go
index ad091008bb4a7..da16ffbfff106 100644
--- a/lib/events/discard.go
+++ b/lib/events/discard.go
@@ -20,6 +20,7 @@ package events
 
 import (
 	"context"
+	"iter"
 	"log/slog"
 	"sync/atomic"
 
@@ -71,6 +72,14 @@ func (d *DiscardAuditLog) StreamSessionEvents(ctx context.Context, sessionID ses
 	return c, e
 }
 
+func (d *DiscardAuditLog) UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+	return nil
+}
+
+func (d *DiscardAuditLog) GetMultipartUploader() MultipartUploader {
+	return nil
+}
+
 // NewDiscardRecorder returns a [SessionRecorderChecker] that discards events.
 func NewDiscardRecorder() *DiscardRecorder {
 	return &DiscardRecorder{
diff --git a/lib/events/dynamic.go b/lib/events/dynamic.go
index cbf0f1382d977..f4fdf07536228 100644
--- a/lib/events/dynamic.go
+++ b/lib/events/dynamic.go
@@ -117,6 +117,24 @@ func FromEventFields(fields EventFields) (events.AuditEvent, error) {
 		e = &events.AuthAttempt{}
 	case SCPEvent:
 		e = &events.SCP{}
+		if err := utils.FastUnmarshal(data, e); err == nil {
+			return e, nil
+		}
+		// Some SFTP events may have been incorrectly marshaled as SCP events;
+		// check for them and fix.
+		// https://github.com/gravitational/teleport/issues/59469
+		if code := getFieldEmpty(EventCode); code == SCPDisallowedCode {
+			sftpEvent := &events.SFTP{}
+			if err := utils.FastUnmarshal(data, sftpEvent); err != nil {
+				// If that didn't work, leave type/code as-is and return UnknownEvent
+				// down below.
+				e = nil
+				break
+			}
+			sftpEvent.Type = SFTPEvent
+			sftpEvent.Code = SFTPDisallowedCode
+			return sftpEvent, nil
+		}
 	case ResizeEvent:
 		e = &events.Resize{}
 	case SessionCommandEvent:
@@ -475,6 +493,13 @@ func FromEventFields(fields EventFields) (events.AuditEvent, error) {
 	case AutoUpdateVersionDeleteEvent:
 		e = &events.AutoUpdateVersionDelete{}
 
+	case AutoUpdateAgentRolloutTriggerEvent:
+		e = &events.AutoUpdateAgentRolloutTrigger{}
+	case AutoUpdateAgentRolloutForceDoneEvent:
+		e = &events.AutoUpdateAgentRolloutForceDone{}
+	case AutoUpdateAgentRolloutRollbackEvent:
+		e = &events.AutoUpdateAgentRolloutRollback{}
+
 	case ContactCreateEvent:
 		e = &events.ContactCreate{}
 	case ContactDeleteEvent:
@@ -520,26 +545,64 @@ func FromEventFields(fields EventFields) (events.AuditEvent, error) {
 	case SigstorePolicyDeleteEvent:
 		e = &events.SigstorePolicyDelete{}
 
+	case MCPSessionStartEvent:
+		e = &events.MCPSessionStart{}
+	case MCPSessionEndEvent:
+		e = &events.MCPSessionEnd{}
+	case MCPSessionRequestEvent:
+		e = &events.MCPSessionRequest{}
+	case MCPSessionNotificationEvent:
+		e = &events.MCPSessionNotification{}
+	case MCPSessionListenSSEStream:
+		e = &events.MCPSessionListenSSEStream{}
+	case MCPSessionInvalidHTTPRequest:
+		e = &events.MCPSessionInvalidHTTPRequest{}
+
+	case BoundKeypairRecovery:
+		e = &events.BoundKeypairRecovery{}
+	case BoundKeypairRotation:
+		e = &events.BoundKeypairRotation{}
+	case BoundKeypairJoinStateVerificationFailed:
+		e = &events.BoundKeypairJoinStateVerificationFailed{}
+
+	case SCIMListingEvent:
+		e = &events.SCIMListingEvent{}
+	case SCIMGetEvent, SCIMCreateEvent, SCIMUpdateEvent, SCIMDeleteEvent:
+		e = &events.SCIMResourceEvent{}
+
+	case ClientIPRestrictionsUpdateEvent:
+		e = &events.ClientIPRestrictionsUpdate{}
+
+	case VnetConfigCreateEvent:
+		e = &events.VnetConfigCreate{}
+	case VnetConfigUpdateEvent:
+		e = &events.VnetConfigUpdate{}
+	case VnetConfigDeleteEvent:
+		e = &events.VnetConfigDelete{}
+
 	default:
 		slog.ErrorContext(context.Background(), "Attempted to convert dynamic event of unknown type into protobuf event.", "event_type", eventType)
-		unknown := &events.Unknown{}
-		if err := utils.FastUnmarshal(data, unknown); err != nil {
-			return nil, trace.Wrap(err)
-		}
+	}
 
-		unknown.Type = UnknownEvent
-		unknown.Code = UnknownCode
-		unknown.UnknownType = eventType
-		unknown.UnknownCode = getFieldEmpty(EventCode)
-		unknown.Data = string(data)
-		return unknown, nil
+	if e != nil {
+		if err := utils.FastUnmarshal(data, e); err == nil {
+			return e, nil
+		} else {
+			slog.ErrorContext(context.Background(), "failed to unmarshal event", "event_type", eventType, "error", err)
+		}
 	}
 
-	if err := utils.FastUnmarshal(data, e); err != nil {
+	unknown := &events.Unknown{}
+	if err := utils.FastUnmarshal(data, unknown); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return e, nil
+	unknown.Type = UnknownEvent
+	unknown.Code = UnknownCode
+	unknown.UnknownType = eventType
+	unknown.UnknownCode = getFieldEmpty(EventCode)
+	unknown.Data = string(data)
+	return unknown, nil
 }
 
 // GetSessionID pulls the session ID from the events that have a
diff --git a/lib/events/dynamic_test.go b/lib/events/dynamic_test.go
index 6ed6b99bcf7e4..bac3e5cd0e189 100644
--- a/lib/events/dynamic_test.go
+++ b/lib/events/dynamic_test.go
@@ -71,6 +71,36 @@ func TestDynamicKnownType(t *testing.T) {
 	require.Equal(t, SessionPrintEvent, printEvent.GetType())
 }
 
+func TestDynamicSCPWorkaround(t *testing.T) {
+	fields := EventFields{
+		EventType: SCPEvent,
+		EventCode: SCPDisallowedCode,
+		SCPAction: 1, // scp event expects a string here
+	}
+
+	event, err := FromEventFields(fields)
+	require.NoError(t, err)
+
+	require.Equal(t, SFTPEvent, event.GetType())
+	require.Equal(t, SFTPDisallowedCode, event.GetCode())
+	sftpEvent := event.(*events.SFTP)
+	require.Equal(t, 1, int(sftpEvent.Action))
+}
+
+func TestDynamicFailedUnmarshal(t *testing.T) {
+	fields := EventFields{
+		EventType:              SessionPrintEvent,
+		SessionPrintEventBytes: "foo", // wrong type
+	}
+
+	event, err := FromEventFields(fields)
+	require.NoError(t, err)
+	require.Equal(t, UnknownEvent, event.GetType())
+	require.Equal(t, UnknownCode, event.GetCode())
+	unknownEvent := event.(*events.Unknown)
+	require.Equal(t, SessionPrintEvent, unknownEvent.UnknownType)
+}
+
 func TestGetTeleportUser(t *testing.T) {
 	tests := []struct {
 		name  string
diff --git a/lib/events/dynamoevents/dynamoevents.go b/lib/events/dynamoevents/dynamoevents.go
index 631233fae79b2..dc22cec61573a 100644
--- a/lib/events/dynamoevents/dynamoevents.go
+++ b/lib/events/dynamoevents/dynamoevents.go
@@ -137,7 +137,7 @@ type Config struct {
 	// WriteTargetValue is the ratio of consumed write to provisioned capacity.
 	WriteTargetValue float64
 
-	// UseFIPSEndpoint uses AWS FedRAMP/FIPS 140-2 mode endpoints.
+	// UseFIPSEndpoint uses AWS FedRAMP/FIPS mode endpoints.
 	// to determine its behavior:
 	// Unset - allows environment variables or AWS config to set the value
 	// Enabled - explicitly enabled
@@ -225,15 +225,45 @@ type Log struct {
 	svc *dynamodb.Client
 }
 
+// EventKey contains the subset of event fields used as a dynamo primary key,
+// or used by a secondary index.
+// This is used in checkpointKey to track the last processed event of a query
+// and resume the query from there.
+type EventKey struct {
+	// SessionID and EventIndex must always be set.
+	// If the event is not linked to a session, we generate a random UUID.
+	SessionID string
+	// EventIndex represent the relative order of an event in the sesssion.
+	// Its value can be 0 if the event does not belong to a session or if it is
+	// the first event of a session.
+	// Next session events increase this counter. In case of conflict
+	// (two events with the same SessionID and EventIndex), EventIndex is set to
+	// the Unix nanosecond timestamp. This seems to break the "EventIndex
+	// monotonically increases" property and might cause events to be
+	// backfilled/skipped by ongoing queries.
+	// This behavior was introduced in https://github.com/gravitational/teleport/pull/40854.
+	// Since then, EventIndex is a large int64 and might not survive a round-trip
+	// through float64. When its JSON representation is unmarshalled into
+	// `map[string]any`, the event will lose EventIndex precision this will
+	// cause data-loss. For critical usage, like DynamoDB ExclusiveStartKey,
+	// one must always marshall/unmarshall using the typed event struct.
+	// event.FieldsMap["ei"] suffers from this data loss, so its value and
+	// EventIndex might be different.
+	EventIndex int64
+	// CreatedAt is used to know if the event is outside of the requested time
+	// range (so we can discard the cursor completely in this case).
+	// This is also used as a secondary DynamodDB index.
+	CreatedAt int64 `json:",omitempty" dynamodbav:",omitempty"`
+	// CreatedAtDate is used to identify the event partition.
+	CreatedAtDate string `json:",omitempty" dynamodbav:",omitempty"`
+}
+
 type event struct {
-	SessionID      string
-	EventIndex     int64
+	EventKey
 	EventType      string
-	CreatedAt      int64
 	Expires        *int64 `json:"Expires,omitempty" dynamodbav:",omitempty"`
 	FieldsMap      events.EventFields
 	EventNamespace string
-	CreatedAtDate  string
 }
 
 const (
@@ -647,13 +677,15 @@ func (l *Log) createPutItem(sessionID string, in apievents.AuditEvent) (*dynamod
 		return nil, trace.Wrap(err)
 	}
 	e := event{
-		SessionID:      sessionID,
-		EventIndex:     in.GetIndex(),
+		EventKey: EventKey{
+			SessionID:     sessionID,
+			EventIndex:    in.GetIndex(),
+			CreatedAt:     in.GetTime().Unix(),
+			CreatedAtDate: in.GetTime().Format(iso8601DateFormat),
+		},
 		EventType:      in.GetType(),
 		EventNamespace: apidefaults.Namespace,
-		CreatedAt:      in.GetTime().Unix(),
 		FieldsMap:      fieldsMap,
-		CreatedAtDate:  in.GetTime().Format(iso8601DateFormat),
 	}
 	l.setExpiry(&e)
 	av, err := attributevalue.MarshalMap(e)
@@ -710,6 +742,7 @@ type checkpointKey struct {
 
 	// EventKey is a derived identifier for an event used for resuming
 	// sub-page breaks due to size constraints.
+	// TODO(hugoShaka): Deprecate and remove this field.
 	EventKey string `json:"event_key,omitempty"`
 }
 
@@ -840,7 +873,7 @@ func (l *Log) searchEventsRaw(ctx context.Context, fromUTC, toUTC time.Time, nam
 	l.logger.DebugContext(ctx, "search events", "from", fromUTC, "to", toUTC, "filter", filter, "limit", limit, "start_key", startKey, "order", order, "checkpoint", checkpoint)
 
 	if startKey != "" {
-		createdAt, err := GetCreatedAtFromStartKey(startKey)
+		createdAt, err := getCreatedAtFromCheckpoint(checkpoint)
 		if err == nil {
 			// we compare the cursor unix time to the from unix in order to drop the nanoseconds
 			// that are not present in the cursor.
@@ -962,10 +995,14 @@ func GetCreatedAtFromStartKey(startKey string) (time.Time, error) {
 	if err != nil {
 		return time.Time{}, trace.Wrap(err)
 	}
+	return getCreatedAtFromCheckpoint(checkpoint)
+}
+
+func getCreatedAtFromCheckpoint(checkpoint checkpointKey) (time.Time, error) {
 	if checkpoint.Iterator == "" {
 		return time.Time{}, errors.New("missing iterator")
 	}
-	var e event
+	var e EventKey
 	if err := json.Unmarshal([]byte(checkpoint.Iterator), &e); err != nil {
 		return time.Time{}, trace.Wrap(err)
 	}
@@ -1015,13 +1052,13 @@ func getCheckpointFromLegacyStartKey(startKey string) (checkpointKey, error) {
 	}
 
 	// decode the dynamo attrs into the go map repr common to the old and new formats.
-	m := make(map[string]any)
-	if err := attributevalue.UnmarshalMap(convertedAttrMap, &m); err != nil {
+	var e event
+	if err := attributevalue.UnmarshalMap(convertedAttrMap, &e); err != nil {
 		return checkpointKey{}, trace.Wrap(err)
 	}
 
 	// encode the map into json, making it equivalent to the new format.
-	iterator, err := json.Marshal(m)
+	iterator, err := json.Marshal(e)
 	if err != nil {
 		return checkpointKey{}, trace.Wrap(err)
 	}
@@ -1063,14 +1100,18 @@ func getSubPageCheckpoint(e *event) (string, error) {
 // find completed session.
 func (l *Log) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) {
 	filter := searchEventsFilter{eventTypes: events.SessionRecordingEvents}
-	if req.Cond != nil {
-		params := condFilterParams{attrValues: make(map[string]interface{}), attrNames: make(map[string]string)}
-		expr, err := fromWhereExpr(req.Cond, &params)
+	if req.Cond != nil && req.Cond.Expr != nil {
+		params := condFilterParams{attrValues: make(map[string]any), attrNames: make(map[string]string)}
+		expr, err := fromWhereExpr(req.Cond.Expr, &params)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
 		filter.condExpr = expr
 		filter.condParams = params
+		filter.filterFunc, err = utils.ToFieldsCondition(*req.Cond)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
 	}
 	return l.searchEventsWithFilter(ctx, req.From, req.To, apidefaults.Namespace, req.Limit, req.Order, req.StartKey, filter, req.SessionID)
 }
@@ -1079,6 +1120,7 @@ type searchEventsFilter struct {
 	eventTypes []string
 	condExpr   string
 	condParams condFilterParams
+	filterFunc utils.FieldsCondition
 }
 
 type condFilterParams struct {
@@ -1086,9 +1128,34 @@ type condFilterParams struct {
 	attrNames  map[string]string
 }
 
+// fromWhereExpr converts a types.WhereExpr into a DynamoDB condition expression.
+// It fills in the provided condFilterParams with attribute names and values
+// that need to be supplied when executing the query.
+// For example, a condition like
+//
+// !(equals(login, "root") || equals(login, "admin")) && contains(participants, "test-user")
+// would be converted into a condition expression like
+//
+// "NOT ((#condName0 = :condValue0) OR (#condName1 = :condValue1)) AND (contains(#condName2, :condValue2))"
+// with condFilterParams containing:
+//
+//	attrNames: {"#condName0": "FieldsMap.login", "#condName1": "FieldsMap.login", "#condName2": "FieldsMap.participants"}
+//	attrValues: {":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user"}
+//
+// This function supports a subset of the types.WhereExpr AST. Supported operations are:
+//   - Binary predicates: equals, notEquals
+//   - Logical operators: and, or, not
+//   - Map references: map_name["key"]
+//   - Literals: string
+//   - Functions: contains, contains_all, contains_any, can_view
+//
+// `can_view` is a special function that checks if the current user can view the underlying resource
+// based on their roles. This is a runtime check, so it cannot be converted into a static condition expression.
+// For this reason, `can_view` is handled by returning an always-true condition expression and setting a filter function
+// in condFilterParams that can be applied to the results after the query is executed.
 func fromWhereExpr(cond *types.WhereExpr, params *condFilterParams) (string, error) {
 	if cond == nil {
-		return "", trace.BadParameter("cond is nil")
+		return "", trace.BadParameter("missing condition")
 	}
 
 	binOp := func(e types.WhereExpr2, format func(a, b string) string) (string, error) {
@@ -1132,9 +1199,58 @@ func fromWhereExpr(cond *types.WhereExpr, params *condFilterParams) (string, err
 		params.attrNames[k] = n
 		return fmt.Sprintf("FieldsMap.%s", k)
 	}
+
+	addMultiAttrNames := func(vals ...string) string {
+		var names []string
+		for _, n := range vals {
+			for k, v := range params.attrNames {
+				if n == v {
+					names = append(names, k)
+					continue
+				}
+			}
+			k := fmt.Sprintf("#condName%d", len(params.attrNames))
+			params.attrNames[k] = n
+			names = append(names, k)
+		}
+		return fmt.Sprintf("FieldsMap.%s", strings.Join(names, "."))
+	}
+
+	formatMap := func(m *types.WhereExpr2) (string, error) {
+		key, ok := m.R.Literal.(string)
+		if !ok {
+			return "", trace.BadParameter("map key must be a string, got %T", m.R.Literal)
+		}
+		return addMultiAttrNames(m.L.Field, key), nil
+	}
+
 	binPred := func(e types.WhereExpr2, format func(a, b string) string) (string, error) {
 		left, right := e.L, e.R
 		switch {
+		case left.MapRef != nil:
+			s, err := formatMap(left.MapRef)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			if right.Literal != nil {
+				return format(s, addAttrValue(right.Literal)), nil
+			}
+			if right.Field != "" {
+				return format(s, addAttrName(right.Field)), nil
+			}
+			return "", trace.BadParameter("right side of binary predicate must be a literal or field when left side is a map reference")
+		case right.MapRef != nil:
+			s, err := formatMap(right.MapRef)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			if right.Literal != nil {
+				return format(s, addAttrValue(left.Literal)), nil
+			}
+			if right.Field != "" {
+				return format(s, addAttrName(left.Field)), nil
+			}
+			return "", trace.BadParameter("left side of binary predicate must be a literal or field when right side is a map reference")
 		case left.Field != "" && right.Field != "":
 			return format(addAttrName(left.Field), addAttrName(right.Field)), nil
 		case left.Literal != nil && right.Field != "":
@@ -1144,6 +1260,74 @@ func fromWhereExpr(cond *types.WhereExpr, params *condFilterParams) (string, err
 		}
 		return "", trace.BadParameter("failed to handle binary predicate with arguments %q and %q", left, right)
 	}
+	binPredSlice := func(e types.WhereExpr2, format func(a, b string) string) ([]string, error) {
+		left, right := e.L, e.R
+		switch {
+		case left.MapRef != nil:
+			s, err := formatMap(left.MapRef)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if right.Literal != nil {
+				sl, ok := right.Literal.([]string)
+				if !ok {
+					return nil, trace.BadParameter("expected slice literal, got %T", right.Literal)
+				}
+				var res []string
+				for _, v := range sl {
+					res = append(res, format(s, addAttrValue(v)))
+				}
+				return res, nil
+			}
+			if right.Field != "" {
+				return []string{format(s, addAttrName(right.Field))}, nil
+			}
+			return nil, trace.BadParameter("right side of binary predicate must be a literal or field when left side is a map reference")
+		case right.MapRef != nil:
+			s, err := formatMap(right.MapRef)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if left.Literal != nil {
+				sl, ok := left.Literal.([]string)
+				if !ok {
+					return nil, trace.BadParameter("expected slice literal, got %T", left.Literal)
+				}
+				var res []string
+				for _, v := range sl {
+					res = append(res, format(s, addAttrValue(v)))
+				}
+				return res, nil
+			}
+			if left.Field != "" {
+				return []string{format(s, addAttrName(left.Field))}, nil
+			}
+			return nil, trace.BadParameter("left side of binary predicate must be a literal or field when right side is a map reference")
+		case left.Field != "" && right.Field != "":
+			return []string{format(addAttrName(left.Field), addAttrName(right.Field))}, nil
+		case left.Literal != nil && right.Field != "":
+			sl, ok := left.Literal.([]string)
+			if !ok {
+				return nil, trace.BadParameter("expected slice literal, got %T", left.Literal)
+			}
+			var res []string
+			for _, v := range sl {
+				res = append(res, format(addAttrValue(v), addAttrName(right.Field)))
+			}
+			return res, nil
+		case left.Field != "" && right.Literal != nil:
+			sl, ok := right.Literal.([]string)
+			if !ok {
+				return nil, trace.BadParameter("expected slice literal, got %T", left.Literal)
+			}
+			var res []string
+			for _, v := range sl {
+				res = append(res, format(addAttrName(left.Field), addAttrValue(v)))
+			}
+			return res, nil
+		}
+		return nil, trace.BadParameter("failed to handle binary predicate with arguments %q and %q", left, right)
+	}
 	if cond.Equals.L != nil && cond.Equals.R != nil {
 		if expr, err := binPred(cond.Equals, func(a, b string) string { return fmt.Sprintf("%s = %s", a, b) }); err == nil {
 			return expr, nil
@@ -1154,6 +1338,35 @@ func fromWhereExpr(cond *types.WhereExpr, params *condFilterParams) (string, err
 			return expr, nil
 		}
 	}
+
+	if cond.ContainsAny.L != nil && cond.ContainsAny.R != nil {
+		if expr, err := binPredSlice(cond.ContainsAny, func(a, b string) string { return fmt.Sprintf("contains(%s, %s)", a, b) }); err == nil {
+			return "(" + strings.Join(expr, " OR ") + ")", nil
+		}
+	}
+
+	if cond.ContainsAll.L != nil && cond.ContainsAll.R != nil {
+		if expr, err := binPredSlice(cond.ContainsAll, func(a, b string) string { return fmt.Sprintf("contains(%s, %s)", a, b) }); err == nil {
+			return "(" + strings.Join(expr, " AND ") + ")", nil
+		}
+	}
+
+	if cond.MapRef != nil && cond.MapRef.L != nil && cond.MapRef.R != nil {
+		key, ok := cond.MapRef.R.Literal.(string)
+		if !ok {
+			return "", trace.BadParameter("map key must be a string, got %T", cond.MapRef.R.Literal)
+		}
+		return addMultiAttrNames(cond.MapRef.L.Field, key), nil
+	}
+
+	if cond.CanView != nil {
+		// CanView is a special predicate that checks if the event can be viewed
+		// by a user with a given set of roles. This is implemented by checking
+		// access after fetching the events, so here we just return a no-op
+		// expression that is always true.
+		return "attribute_exists(SessionID)", nil
+	}
+
 	return "", trace.BadParameter("failed to convert WhereExpr %q to DynamoDB filter expression", cond)
 }
 
@@ -1390,12 +1603,12 @@ func (l *eventsFetcher) processQueryOutput(output *dynamodb.QueryOutput, hasLeft
 	l.checkpoint.Iterator = ""
 
 	if output.LastEvaluatedKey != nil {
-		m := make(map[string]any)
-		if err := attributevalue.UnmarshalMap(output.LastEvaluatedKey, &m); err != nil {
+		var e EventKey
+		if err := attributevalue.UnmarshalMap(output.LastEvaluatedKey, &e); err != nil {
 			return nil, false, trace.Wrap(err)
 		}
 
-		iter, err := json.Marshal(&m)
+		iter, err := json.Marshal(&e)
 		if err != nil {
 			return nil, false, err
 		}
@@ -1409,10 +1622,16 @@ func (l *eventsFetcher) processQueryOutput(output *dynamodb.QueryOutput, hasLeft
 		if err := attributevalue.UnmarshalMap(item, &e); err != nil {
 			return nil, false, trace.WrapWithMessage(err, "failed to unmarshal event")
 		}
+		if l.filter.filterFunc != nil && !l.filter.filterFunc(utils.Fields(e.FieldsMap)) {
+			continue
+		}
 		data, err := json.Marshal(e.FieldsMap)
 		if err != nil {
 			return nil, false, trace.Wrap(err)
 		}
+
+		// TODO(hugoShaka): Fix this. This code path has terrible performance
+		// and should be replaced by proper pagination.
 		if !l.foundStart {
 			key, err := getSubPageCheckpoint(&e)
 			if err != nil {
@@ -1494,13 +1713,13 @@ dateLoop:
 			}
 
 			if l.checkpoint.Iterator != "" {
-				m := make(map[string]any)
-				err = json.Unmarshal([]byte(l.checkpoint.Iterator), &m)
+				var e EventKey
+				err = json.Unmarshal([]byte(l.checkpoint.Iterator), &e)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
 
-				input.ExclusiveStartKey, err = attributevalue.MarshalMap(&m)
+				input.ExclusiveStartKey, err = attributevalue.MarshalMap(&e)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
@@ -1577,12 +1796,12 @@ func (l *eventsFetcher) QueryBySessionIDIndex(ctx context.Context, sessionID str
 	}
 
 	if l.checkpoint.Iterator != "" {
-		m := make(map[string]string)
-		if err = json.Unmarshal([]byte(l.checkpoint.Iterator), &m); err != nil {
+		var e EventKey
+		if err = json.Unmarshal([]byte(l.checkpoint.Iterator), &e); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		input.ExclusiveStartKey, err = attributevalue.MarshalMap(&m)
+		input.ExclusiveStartKey, err = attributevalue.MarshalMap(&e)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/events/dynamoevents/dynamoevents_test.go b/lib/events/dynamoevents/dynamoevents_test.go
index a176cff26a354..c70460e09094b 100644
--- a/lib/events/dynamoevents/dynamoevents_test.go
+++ b/lib/events/dynamoevents/dynamoevents_test.go
@@ -34,7 +34,6 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -46,15 +45,16 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const dynamoDBLargeQueryRetries int = 10
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -273,24 +273,154 @@ func TestLargeTableRetrieve(t *testing.T) {
 func TestFromWhereExpr(t *testing.T) {
 	t.Parallel()
 
-	// !(equals(login, "root") || equals(login, "admin")) && contains(participants, "test-user")
-	cond := &types.WhereExpr{And: types.WhereExpr2{
-		L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
-			L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
-			R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
-		}}},
-		R: &types.WhereExpr{Contains: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: "test-user"}}},
-	}}
-
-	params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]interface{}{}}
-	expr, err := fromWhereExpr(cond, &params)
-	require.NoError(t, err)
+	t.Run("sid", func(t *testing.T) {
+		cond := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{Field: events.SessionEventID},
+			R: &types.WhereExpr{Literal: "test-session-id"},
+		}}
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+
+		require.Equal(t, "FieldsMap.#condName0 = :condValue0", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "sid"},
+			attrValues: map[string]any{":condValue0": "test-session-id"},
+		}, params)
+	})
+
+	t.Run("contains", func(t *testing.T) {
+		// !(equals(login, "root") || equals(login, "admin")) && contains(participants, "test-user")
+		cond := &types.WhereExpr{And: types.WhereExpr2{
+			L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
+				L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
+				R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
+			}}},
+			R: &types.WhereExpr{Contains: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: "test-user"}}},
+		}}
+
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+
+		require.Equal(t, "(NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND (contains(FieldsMap.#condName1, :condValue2))", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
+			attrValues: map[string]any{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user"},
+		}, params)
+	})
+
+	t.Run("contains_any", func(t *testing.T) {
+		// !(equals(login, "root") || equals(login, "admin")) && contains_any(participants, set("test-user","other-user"))
+		cond := &types.WhereExpr{And: types.WhereExpr2{
+			L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
+				L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
+				R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
+			}}},
+			R: &types.WhereExpr{ContainsAny: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: []string{"test-user", "other-user"}}}},
+		}}
+
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+
+		require.Equal(t, "(NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND ((contains(FieldsMap.#condName1, :condValue2) OR contains(FieldsMap.#condName1, :condValue3)))", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
+			attrValues: map[string]any{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user", ":condValue3": "other-user"},
+		}, params)
+	})
+
+	t.Run("contains_all", func(t *testing.T) {
+		// !(equals(login, "root") || equals(login, "admin")) && contains_all(participants, set("test-user","other-user"))
+		cond := &types.WhereExpr{And: types.WhereExpr2{
+			L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
+				L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
+				R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
+			}}},
+			R: &types.WhereExpr{ContainsAll: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: []string{"test-user", "other-user"}}}},
+		}}
+
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
 
-	require.Equal(t, "(NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND (contains(FieldsMap.#condName1, :condValue2))", expr)
-	require.Equal(t, condFilterParams{
-		attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
-		attrValues: map[string]interface{}{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user"},
-	}, params)
+		require.Equal(t, "(NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND ((contains(FieldsMap.#condName1, :condValue2) AND contains(FieldsMap.#condName1, :condValue3)))", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
+			attrValues: map[string]any{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user", ":condValue3": "other-user"},
+		}, params)
+	})
+
+	t.Run("can_view AND", func(t *testing.T) {
+		// !(equals(login, "root") || equals(login, "admin")) && contains_all(participants, set("test-user","other-user")) && can_view()
+		cond := &types.WhereExpr{
+			And: types.WhereExpr2{
+				L: &types.WhereExpr{And: types.WhereExpr2{
+					L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
+						L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
+						R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
+					}}},
+					R: &types.WhereExpr{ContainsAll: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: []string{"test-user", "other-user"}}}},
+				}},
+				R: &types.WhereExpr{CanView: &types.WhereNoExpr{}},
+			},
+		}
+
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+
+		require.Equal(t, "((NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND ((contains(FieldsMap.#condName1, :condValue2) AND contains(FieldsMap.#condName1, :condValue3)))) AND (attribute_exists(SessionID))", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
+			attrValues: map[string]any{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user", ":condValue3": "other-user"},
+		}, params)
+	})
+	t.Run("can_view OR ", func(t *testing.T) {
+		// !(equals(login, "root") || equals(login, "admin")) && contains_all(participants, set("test-user","other-user")) || can_view()
+		cond := &types.WhereExpr{
+			Or: types.WhereExpr2{
+				L: &types.WhereExpr{And: types.WhereExpr2{
+					L: &types.WhereExpr{Not: &types.WhereExpr{Or: types.WhereExpr2{
+						L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "root"}}},
+						R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "login"}, R: &types.WhereExpr{Literal: "admin"}}},
+					}}},
+					R: &types.WhereExpr{ContainsAll: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: []string{"test-user", "other-user"}}}},
+				}},
+				R: &types.WhereExpr{CanView: &types.WhereNoExpr{}},
+			},
+		}
+
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+
+		require.Equal(t, "((NOT ((FieldsMap.#condName0 = :condValue0) OR (FieldsMap.#condName0 = :condValue1))) AND ((contains(FieldsMap.#condName1, :condValue2) AND contains(FieldsMap.#condName1, :condValue3)))) OR (attribute_exists(SessionID))", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "login", "#condName1": "participants"},
+			attrValues: map[string]any{":condValue0": "root", ":condValue1": "admin", ":condValue2": "test-user", ":condValue3": "other-user"},
+		}, params)
+	})
+
+	t.Run("map_ref", func(t *testing.T) {
+		// session.server_labels["env"] = "prod"
+		cond := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "server_labels"},
+				R: &types.WhereExpr{Literal: "env"},
+			}},
+			R: &types.WhereExpr{Literal: "prod"},
+		}}
+		params := condFilterParams{attrNames: map[string]string{}, attrValues: map[string]any{}}
+		expr, err := fromWhereExpr(cond, &params)
+		require.NoError(t, err)
+		require.Equal(t, "FieldsMap.#condName0.#condName1 = :condValue0", expr)
+		require.Equal(t, condFilterParams{
+			attrNames:  map[string]string{"#condName0": "server_labels", "#condName1": "env"},
+			attrValues: map[string]any{":condValue0": "prod"},
+		}, params)
+	})
 }
 
 // TestEmitAuditEventForLargeEvents tries to emit large audit events to
@@ -642,7 +772,7 @@ func TestEndpoints(t *testing.T) {
 			fips := types.ClusterAuditConfigSpecV2_FIPS_DISABLED
 			if tt.fips {
 				fips = types.ClusterAuditConfigSpecV2_FIPS_ENABLED
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					FIPS: true,
 				})
 			}
@@ -694,5 +824,91 @@ func TestStartKeyBackCompat(t *testing.T) {
 	newCP, err := getCheckpointFromStartKey(newStartKey)
 	require.NoError(t, err)
 
-	require.Empty(t, cmp.Diff(oldCP, newCP))
+	// we must check the iterator field equality separately because it's a string
+	// containing a JSON-encoded event and field ordering might not be consistent.
+	require.Equal(t, oldCP.EventKey, newCP.EventKey)
+	require.Equal(t, oldCP.Date, newCP.Date)
+
+	var oldIterator, newIterator event
+	require.NoError(t, json.Unmarshal([]byte(oldCP.Iterator), &oldIterator))
+	require.NoError(t, json.Unmarshal([]byte(newCP.Iterator), &newIterator))
+	require.Equal(t, oldIterator, newIterator)
+}
+
+// TestCursorIteratorPrecision exists because cursors are sensitive to data-loss
+// and we had a bug where we would unmarshall a cursor into `map[string]any`,
+// causing all int64 to do a round-trip through float64 and losing precision.
+// The precision loss would cause the cursor hash to be in te past.
+// If the cursor shifts by more events than the page size, this creates a
+// livelock and the query cannot proceed.
+// This test creates events with very close EventIndex (1 nanosecond diff),
+// reads the events 1 by one, and makes sure the reader is not stuck reading the
+// same event over and over.
+func TestCursorIteratorPrecision(t *testing.T) {
+	tt := setupDynamoContext(t)
+	clock, ok := tt.log.Clock.(*clockwork.FakeClock)
+	require.True(t, ok, "this test requires a FakeClock")
+	baseTime := clock.Now().UTC()
+
+	// Test Setup: creating fixtures really close in the dynamo index.
+
+	// For this test to work, we need the same session ID for all events
+	sessionId := uuid.NewString()
+	numEvents := 5
+	testEvents := make(map[string]struct{}, numEvents)
+
+	for range numEvents {
+		id := uuid.NewString()
+		// For the first event, EventIndex will be zero, for the next ones it
+		// will be the unix nanosecond timestamp.
+		clock.Advance(time.Nanosecond)
+		err := tt.log.EmitAuditEvent(context.Background(), &apievents.Exec{
+			UserMetadata: apievents.UserMetadata{User: "test-user"},
+			Metadata: apievents.Metadata{
+				ID:   id,
+				Type: events.UserLoginEvent,
+				Time: clock.Now().UTC(),
+			},
+			SessionMetadata: apievents.SessionMetadata{
+				SessionID: sessionId,
+			},
+		})
+		testEvents[id] = struct{}{}
+		require.NoError(t, err)
+	}
+
+	// Test execution: do paginated queries to read all the fixtures.
+	eventsSeen := make(map[string]apievents.AuditEvent, numEvents)
+	toTime := baseTime.Add(time.Hour)
+	var arr []apievents.AuditEvent
+	var err error
+	var checkpoint string
+
+	for range testEvents {
+		arr, checkpoint, err = tt.log.SearchEvents(t.Context(), events.SearchEventsRequest{
+			From:     baseTime,
+			To:       toTime,
+			Limit:    1,
+			Order:    types.EventOrderAscending,
+			StartKey: checkpoint,
+		})
+		require.NoError(t, err)
+		require.Len(t, arr, 1)
+
+		id := arr[0].GetID()
+		var c checkpointKey
+		require.NoError(t, json.Unmarshal([]byte(checkpoint), &c), "event %s", id)
+		require.NotEmpty(t, c.Iterator, "event %s", id)
+
+		var e EventKey
+		require.NoError(t, json.Unmarshal([]byte(c.Iterator), &e), "event %s", id)
+		eventsSeen[id] = arr[0]
+	}
+
+	// Test validation: make sure that all fixtures were read (as opposed to
+	// some event being returned several times because of a cursor issue).
+	for id := range testEvents {
+		require.Contains(t, eventsSeen, id, "eventsSeen should contain %q", id)
+	}
+
 }
diff --git a/lib/events/emitter_test.go b/lib/events/emitter_test.go
index c7b4cc2076d77..99fbb69fb4183 100644
--- a/lib/events/emitter_test.go
+++ b/lib/events/emitter_test.go
@@ -108,7 +108,7 @@ func TestProtoStreamer(t *testing.T) {
 			require.NoError(t, err)
 
 			for _, part := range parts {
-				reader := events.NewProtoReader(bytes.NewReader(part))
+				reader := events.NewProtoReader(bytes.NewReader(part), nil)
 				out, err := reader.ReadAll(ctx)
 				require.NoError(t, err, "part crash %#v", part)
 				outEvents = append(outEvents, out...)
@@ -256,7 +256,7 @@ func TestExport(t *testing.T) {
 		_, err := f.Write(part)
 		require.NoError(t, err)
 	}
-	reader := events.NewProtoReader(io.MultiReader(readers...))
+	reader := events.NewProtoReader(io.MultiReader(readers...), nil)
 	outEvents, err := reader.ReadAll(ctx)
 	require.NoError(t, err)
 
diff --git a/lib/events/events_test.go b/lib/events/events_test.go
index 23fefc643ae4b..c633efcd2547e 100644
--- a/lib/events/events_test.go
+++ b/lib/events/events_test.go
@@ -21,6 +21,7 @@ package events
 import (
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"reflect"
 	"strings"
 	"testing"
@@ -37,6 +38,21 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
+func scimCommon() apievents.SCIMCommonData {
+	return apievents.SCIMCommonData{
+		Request: &apievents.SCIMRequest{
+			Body: apievents.MustEncodeMap(map[string]any{
+				"zero": nil,
+				"one":  3.14159,
+				"two":  eventString + eventString,
+				"three": map[string]any{
+					"nested": eventString,
+				},
+			}),
+		},
+	}
+}
+
 // eventsMap maps event names to event types for testing. Be sure to update
 // this map if you add a new event type.
 var eventsMap = map[string]apievents.AuditEvent{
@@ -263,6 +279,26 @@ var eventsMap = map[string]apievents.AuditEvent{
 	HealthCheckConfigCreateEvent:                  &apievents.HealthCheckConfigCreate{},
 	HealthCheckConfigUpdateEvent:                  &apievents.HealthCheckConfigUpdate{},
 	HealthCheckConfigDeleteEvent:                  &apievents.HealthCheckConfigDelete{},
+	BoundKeypairRecovery:                          &apievents.BoundKeypairRecovery{},
+	BoundKeypairRotation:                          &apievents.BoundKeypairRotation{},
+	BoundKeypairJoinStateVerificationFailed:       &apievents.BoundKeypairJoinStateVerificationFailed{},
+	VnetConfigCreateEvent:                         &apievents.VnetConfigCreate{},
+	VnetConfigUpdateEvent:                         &apievents.VnetConfigUpdate{},
+	VnetConfigDeleteEvent:                         &apievents.VnetConfigDelete{},
+
+	// SCIM events contain a protobuf struct, which will cause the default data
+	// generator to infinitely recurse while trying to populate an infinitely
+	// nested map of maps. Providing a pre-built value bypasses the data generator.
+	// SCIMListingEvent: &apievents.SCIMListingEvent{SCIMCommonData: scimCommon()},
+	// SCIMGetEvent:     &apievents.SCIMResourceEvent{SCIMCommonData: scimCommon()},
+	// SCIMCreateEvent:  &apievents.SCIMResourceEvent{SCIMCommonData: scimCommon()},
+	// SCIMUpdateEvent:  &apievents.SCIMResourceEvent{SCIMCommonData: scimCommon()},
+	// SCIMDeleteEvent:  &apievents.SCIMResourceEvent{SCIMCommonData: scimCommon()},
+	SCIMListingEvent: &apievents.SCIMListingEvent{SCIMCommonData: scimCommon()},
+	SCIMGetEvent:     &apievents.SCIMResourceEvent{},
+	SCIMCreateEvent:  &apievents.SCIMResourceEvent{},
+	SCIMUpdateEvent:  &apievents.SCIMResourceEvent{},
+	SCIMDeleteEvent:  &apievents.SCIMResourceEvent{},
 }
 
 // TestJSON tests JSON marshal events
@@ -682,7 +718,7 @@ func TestJSON(t *testing.T) {
 		},
 		{
 			name: "failed auth attempt",
-			json: `{"ei": 0, "code":"T3007W","error":"ssh: principal \"bob\" not in the set of valid principals for given certificate: [\"root\" \"alice\"]","event":"auth","success":false,"time":"2020-04-22T20:53:50Z","uid":"ebac95ca-8673-44af-b2cf-65f517acf35a","user":"alice@example.com","cluster_name":"testcluster"}`,
+			json: `{"ei": 0, "code":"T3007W","error":"ssh: principal \"bob\" not in the set of valid principals for given certificate: [\"root\" \"alice\"]","event":"auth","server_id":"","success":false,"time":"2020-04-22T20:53:50Z","uid":"ebac95ca-8673-44af-b2cf-65f517acf35a","user":"alice@example.com","cluster_name":"testcluster"}`,
 			event: apievents.AuthAttempt{
 				Metadata: apievents.Metadata{
 					ID:          "ebac95ca-8673-44af-b2cf-65f517acf35a",
@@ -731,7 +767,8 @@ func TestJSON(t *testing.T) {
 		},
 		{
 			name: "desktop session start",
-			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_name":"test-desktop","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","allow_user_creation":false,"nla":true,"desktop_labels":{"env":"production"}}`,
+			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_name":"test-desktop","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","allow_user_creation":false,"nla":true,"desktop_labels":{"env":"production"},
+			"certificate": { "crl_distribution_points": [ "ldap:///CN=ABC123_exampple,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint" ], "enhanced_key_usage": [ "1.3.6.1.5.5.7.3.2", "1.3.6.1.4.1.311.20.2.2" ], "extended_key_usage": [ 2 ], "key_usage": 1, "serial_number": "325419247945947193356212349496095884841", "subject": "CN=Administrator", "upn": "Administrator@example.com" } }`,
 			event: apievents.WindowsDesktopSessionStart{
 				Metadata: apievents.Metadata{
 					Index:       4,
@@ -755,6 +792,15 @@ func TestJSON(t *testing.T) {
 					RemoteAddr: "[::1]:34902",
 					Protocol:   EventProtocolTDP,
 				},
+				CertMetadata: &apievents.WindowsCertificateMetadata{
+					Subject:               "CN=Administrator",
+					UPN:                   "Administrator@example.com",
+					CRLDistributionPoints: []string{"ldap:///CN=ABC123_exampple,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint"},
+					KeyUsage:              1,
+					EnhancedKeyUsage:      []string{"1.3.6.1.5.5.7.3.2", "1.3.6.1.4.1.311.20.2.2"},
+					ExtendedKeyUsage:      []int32{2},
+					SerialNumber:          "325419247945947193356212349496095884841",
+				},
 				Status: apievents.Status{
 					Success: true,
 				},
@@ -998,6 +1044,144 @@ func TestJSON(t *testing.T) {
 				StatementID: 222,
 			},
 		},
+		{
+			name: "SCIM List Resources",
+			json: `{"ei":22,"event":"scim.list","uid":"test-id","code":"TSCIM005I","time":"2022-02-22T22:22:22.222Z","cluster_name":"test-cluster","success":true,"request":{"id":"ff5cea87-db00-4fa8-a30f-99f220f61075","source_address":"127.0.0.1","user_agent":"magnetized-needle","method":"GET","path":"/scim/v2/Users"},"integration":"okta","resource_type":"Users","filter":"userName eq \"root@localhost\"","count":1,"resource_count":1}`,
+			event: apievents.SCIMListingEvent{
+				Metadata: apievents.Metadata{
+					Index:       22,
+					ID:          "test-id",
+					Type:        SCIMListingEvent,
+					Code:        SCIMListResourcesSuccessCode,
+					Time:        time.Date(2022, 0o2, 22, 22, 22, 22, 222*int(time.Millisecond), time.UTC),
+					ClusterName: "test-cluster",
+				},
+				Status: apievents.Status{
+					Success: true,
+				},
+				SCIMCommonData: apievents.SCIMCommonData{
+					Request: &apievents.SCIMRequest{
+						ID:            "ff5cea87-db00-4fa8-a30f-99f220f61075",
+						SourceAddress: "127.0.0.1",
+						UserAgent:     "magnetized-needle",
+						Method:        http.MethodGet,
+						Path:          "/scim/v2/Users",
+					},
+					Integration:  "okta",
+					ResourceType: "Users",
+				},
+				Filter:        `userName eq "root@localhost"`,
+				Count:         1,
+				ResourceCount: 1,
+			},
+		},
+		{
+			name: "SCIM Update Resources",
+			json: `{"ei":22,"event":"scim.update","uid":"test-id","code":"TSCIM002I","time":"2022-02-22T22:22:22.222Z","cluster_name":"test-cluster","success":true,"request":{"id":"ff5cea87-db00-4fa8-a30f-99f220f61075","source_address":"127.0.0.1","user_agent":"carrier pigeon","method":"PUT","path":"/scim/v2/Users/1234","body":{"active":true,"id":"1234","nickName":"bofh","schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"userName":"root@localhost"}},"integration":"okta","resource_type":"Users","teleport_id":"root@localhost","external_id":"1234","display":"root user"}`,
+			event: apievents.SCIMResourceEvent{
+				Metadata: apievents.Metadata{
+					Index:       22,
+					ID:          "test-id",
+					Type:        SCIMUpdateEvent,
+					Code:        SCIMResourceUpdateSuccessCode,
+					Time:        time.Date(2022, 0o2, 22, 22, 22, 22, 222*int(time.Millisecond), time.UTC),
+					ClusterName: "test-cluster",
+				},
+				Status: apievents.Status{
+					Success: true,
+				},
+				SCIMCommonData: apievents.SCIMCommonData{
+					Request: &apievents.SCIMRequest{
+						ID:            "ff5cea87-db00-4fa8-a30f-99f220f61075",
+						SourceAddress: "127.0.0.1",
+						UserAgent:     "carrier pigeon",
+						Method:        http.MethodPut,
+						Path:          "/scim/v2/Users/1234",
+						Body: apievents.MustEncodeMap(map[string]any{
+							"schemas":  []string{"urn:ietf:params:scim:schemas:core:2.0:User"},
+							"id":       "1234",
+							"userName": "root@localhost",
+							"nickName": "bofh",
+							"active":   true,
+						}),
+					},
+					Integration:  "okta",
+					ResourceType: "Users",
+				},
+				TeleportID: "root@localhost",
+				ExternalID: "1234",
+				Display:    "root user",
+			},
+		},
+		{
+			name: "VNetConfig Create",
+			json: `{"ei":0,"event":"vnet.config.create","uid":"vnet-create-id","success":true,"code":"TVNET001I","time":"2022-02-22T22:22:22.222Z","cluster_name":"test-cluster","user":"alice@example.com","addr.local":"127.0.0.1:3022","addr.remote":"[::1]:34902"}`,
+			event: apievents.VnetConfigCreate{
+				Metadata: apievents.Metadata{
+					ID:          "vnet-create-id",
+					Type:        VnetConfigCreateEvent,
+					Code:        VnetConfigCreateCode,
+					Time:        time.Date(2022, 0o2, 22, 22, 22, 22, 222*int(time.Millisecond), time.UTC),
+					ClusterName: "test-cluster",
+				},
+				Status: apievents.Status{
+					Success: true,
+				},
+				UserMetadata: apievents.UserMetadata{
+					User: "alice@example.com",
+				},
+				ConnectionMetadata: apievents.ConnectionMetadata{
+					LocalAddr:  "127.0.0.1:3022",
+					RemoteAddr: "[::1]:34902",
+				},
+			},
+		},
+		{
+			name: "VNetConfig Update",
+			json: `{"ei":0,"event":"vnet.config.update","uid":"vnet-update-id","success":true,"code":"TVNET002I","time":"2022-02-22T22:22:22.222Z","cluster_name":"root","user":"alice@example.com","addr.local":"127.0.0.1:3022","addr.remote":"[::1]:34902"}`,
+			event: apievents.VnetConfigUpdate{
+				Metadata: apievents.Metadata{
+					ID:          "vnet-update-id",
+					Type:        VnetConfigUpdateEvent,
+					Code:        VnetConfigUpdateCode,
+					Time:        time.Date(2022, 0o2, 22, 22, 22, 22, 222*int(time.Millisecond), time.UTC),
+					ClusterName: "root",
+				},
+				Status: apievents.Status{
+					Success: true,
+				},
+				UserMetadata: apievents.UserMetadata{
+					User: "alice@example.com",
+				},
+				ConnectionMetadata: apievents.ConnectionMetadata{
+					LocalAddr:  "127.0.0.1:3022",
+					RemoteAddr: "[::1]:34902",
+				},
+			},
+		},
+		{
+			name: "VNetConfig Delete",
+			json: `{"ei":0,"event":"vnet.config.delete","uid":"vnet-delete-id","success":true,"code":"TVNET003I","time":"2022-02-22T22:22:22.222Z","cluster_name":"leaf","user":"alice@example.com","addr.local":"127.0.0.1:3022","addr.remote":"[::1]:34902"}`,
+			event: apievents.VnetConfigDelete{
+				Metadata: apievents.Metadata{
+					ID:          "vnet-delete-id",
+					Type:        VnetConfigDeleteEvent,
+					Code:        VnetConfigDeleteCode,
+					Time:        time.Date(2022, 0o2, 22, 22, 22, 22, 222*int(time.Millisecond), time.UTC),
+					ClusterName: "leaf",
+				},
+				Status: apievents.Status{
+					Success: true,
+				},
+				UserMetadata: apievents.UserMetadata{
+					User: "alice@example.com",
+				},
+				ConnectionMetadata: apievents.ConnectionMetadata{
+					LocalAddr:  "127.0.0.1:3022",
+					RemoteAddr: "[::1]:34902",
+				},
+			},
+		},
 	}
 	for _, tc := range testCases {
 		tc := tc
@@ -1006,6 +1190,7 @@ func TestJSON(t *testing.T) {
 
 			outJSON, err := utils.FastMarshal(tc.event)
 			require.NoError(t, err)
+			t.Log(string(outJSON))
 			require.JSONEq(t, tc.json, string(outJSON))
 
 			// unmarshal back into the type and compare the values
@@ -1079,6 +1264,7 @@ type testingVal interface {
 
 func setProtoFields(msg proto.Message) {
 	m := msg.ProtoReflect()
+
 	fields := m.Descriptor().Fields()
 
 	for i := 0; i < fields.Len(); i++ {
diff --git a/lib/events/eventstest/generate.go b/lib/events/eventstest/generate.go
index 25d2e2070d9ef..e83274ca2d877 100644
--- a/lib/events/eventstest/generate.go
+++ b/lib/events/eventstest/generate.go
@@ -19,22 +19,35 @@
 package eventstest
 
 import (
-	"bytes"
+	"cmp"
+	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/events"
 )
 
 // SessionParams specifies optional parameters
 // for generated session
 type SessionParams struct {
-	// PrintEvents sets up print events count
+	// PrintEvents sets up print events count. Ignored if PrintData is set.
+	// The size of the resulting event stream varies due to compression, but with
+	// a sufficiently large number of events results in approximately 64 bytes per event.
 	PrintEvents int64
+	// PrintData is optional data to use for print events. Each element of the
+	// slice represents data for one print event.
+	PrintData []string
+	// PrintUntilBytes works similarly to PrintEvents, but instead of generating
+	// a fixed number of events, it generates events until the total size of the
+	// the generated events exceeds PrintUntilBytes.
+	PrintUntilBytes int64
 	// Clock is an optional clock setting start
 	// and offset time of the event
 	Clock clockwork.Clock
@@ -44,6 +57,34 @@ type SessionParams struct {
 	SessionID string
 	// ClusterName is an optional originating cluster name
 	ClusterName string
+	// UserName is name of the user interacting with the session
+	UserName string
+}
+
+// genPrintData generates print events based on the given SessionParams. It
+// prioritizes generating events by count if specified. Otherwise it will
+// attempt to generate enough event to reach a total byte size.
+func (p *SessionParams) genPrintData() {
+	var i int64
+	var bytesEmitted int64
+	shouldContinue := func() bool {
+		if p.PrintEvents > 0 {
+			return i < p.PrintEvents
+		}
+
+		if p.PrintUntilBytes > 0 {
+			return bytesEmitted < p.PrintUntilBytes
+		}
+
+		return false
+	}
+
+	p.PrintData = make([]string, 0, int(cmp.Or(p.PrintEvents, 500)))
+	for shouldContinue() {
+		p.PrintData = append(p.PrintData, strings.Repeat("hello", int(i%177+1)))
+		bytesEmitted += int64(len(p.PrintData[i]))
+		i++
+	}
 }
 
 // SetDefaults sets parameters defaults
@@ -58,12 +99,23 @@ func (p *SessionParams) SetDefaults() {
 	if p.SessionID == "" {
 		p.SessionID = uuid.New().String()
 	}
+	if p.PrintData == nil {
+		p.genPrintData()
+	}
+	if p.UserName == "" {
+		p.UserName = "alice@example.com"
+	}
 }
 
 // GenerateTestSession generates test session events starting with session start
 // event, adds printEvents events and returns the result.
 func GenerateTestSession(params SessionParams) []apievents.AuditEvent {
 	params.SetDefaults()
+	connectionMetadata := apievents.ConnectionMetadata{
+		LocalAddr:  "127.0.0.1:3022",
+		RemoteAddr: "[::1]:37718",
+		Protocol:   events.EventProtocolSSH,
+	}
 	sessionStart := apievents.SessionStart{
 		Metadata: apievents.Metadata{
 			Index:       0,
@@ -88,23 +140,129 @@ func GenerateTestSession(params SessionParams) []apievents.AuditEvent {
 			SessionID: params.SessionID,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User:  "bob@example.com",
+			User:  params.UserName,
 			Login: "bob",
 		},
-		ConnectionMetadata: apievents.ConnectionMetadata{
-			LocalAddr:  "127.0.0.1:3022",
-			RemoteAddr: "[::1]:37718",
+		ConnectionMetadata: connectionMetadata,
+		TerminalSize:       "80:25",
+	}
+
+	sessionEnd := apievents.SessionEnd{
+		Metadata: apievents.Metadata{
+			Index:       20,
+			Type:        events.SessionEndEvent,
+			ID:          "da455e0f-c27d-459f-a218-4e83b3db9426",
+			Code:        events.SessionEndCode,
+			Time:        params.Clock.Now().UTC().Add(time.Hour + time.Second + 7*time.Millisecond),
+			ClusterName: params.ClusterName,
+		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerVersion:   teleport.Version,
+			ServerID:        params.ServerID,
+			ServerNamespace: "default",
+		},
+		SessionMetadata: apievents.SessionMetadata{
+			SessionID: params.SessionID,
+		},
+		UserMetadata: apievents.UserMetadata{
+			User: params.UserName,
+		},
+		ConnectionMetadata: connectionMetadata,
+		EnhancedRecording:  true,
+		Interactive:        true,
+		Participants:       []string{params.UserName},
+		StartTime:          params.Clock.Now().UTC(),
+		EndTime:            params.Clock.Now().UTC().Add(3*time.Hour + time.Second + 7*time.Millisecond),
+	}
+
+	genEvents := []apievents.AuditEvent{&sessionStart}
+	for i, data := range params.PrintData {
+		event := &apievents.SessionPrint{
+			Metadata: apievents.Metadata{
+				Index: int64(i) + 1,
+				Type:  events.SessionPrintEvent,
+				Time:  params.Clock.Now().UTC().Add(time.Minute + time.Duration(i)*time.Millisecond),
+			},
+			ChunkIndex:        int64(i),
+			DelayMilliseconds: int64(i),
+			Offset:            int64(i),
+			Data:              []byte(data),
+		}
+		event.Bytes = int64(len(event.Data))
+		event.Time = event.Time.Add(time.Duration(i) * time.Millisecond)
+
+		genEvents = append(genEvents, event)
+	}
+
+	sessionEnd.Metadata.Index = int64(len(genEvents))
+	genEvents = append(genEvents, &sessionEnd)
+
+	return genEvents
+}
+
+// GenerateTestKubeSession generates Kubernetes test session events starting
+// with session start event, adds printEvents events and returns the result.
+func GenerateTestKubeSession(params SessionParams) []apievents.AuditEvent {
+	params.SetDefaults()
+	connectionMetadata := apievents.ConnectionMetadata{
+		LocalAddr:  "127.0.0.1:3022",
+		RemoteAddr: "[::1]:37718",
+		Protocol:   events.EventProtocolKube,
+	}
+	kubernetesClusterMetadata := apievents.KubernetesClusterMetadata{
+		KubernetesCluster: "my-kube-cluster",
+		KubernetesUsers:   []string{"admin"},
+		KubernetesGroups:  []string{"viewers"},
+		KubernetesLabels: map[string]string{
+			"teleport.internal/resource-id": "ed910b7b-fe3b-4959-bf2e-ac45f4648f2a",
+		},
+	}
+	kubernetesPodMetadata := apievents.KubernetesPodMetadata{
+		KubernetesPodName:        "simple-shell-pod",
+		KubernetesPodNamespace:   "default",
+		KubernetesContainerName:  "shell-container",
+		KubernetesContainerImage: "busybox",
+		KubernetesNodeName:       "docker-desktop",
+	}
+	sessionStart := apievents.SessionStart{
+		Metadata: apievents.Metadata{
+			Index:       0,
+			Type:        events.SessionStartEvent,
+			ID:          "36cee9e9-9a80-4c32-9163-3d9241cdac7a",
+			Code:        events.SessionStartCode,
+			Time:        params.Clock.Now().UTC(),
+			ClusterName: params.ClusterName,
+		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerVersion: teleport.Version,
+			ServerID:      params.ServerID,
+			ServerLabels: map[string]string{
+				"teleport.internal/resource-id": "ed910b7b-fe3b-4959-bf2e-ac45f4648f2a",
+			},
+			ServerHostname:  "planet",
+			ServerNamespace: "default",
+		},
+		SessionMetadata: apievents.SessionMetadata{
+			SessionID: params.SessionID,
+		},
+		UserMetadata: apievents.UserMetadata{
+			User:  params.UserName,
+			Login: "bob",
 		},
-		TerminalSize: "80:25",
+		ConnectionMetadata:        connectionMetadata,
+		TerminalSize:              "80:25",
+		KubernetesClusterMetadata: kubernetesClusterMetadata,
+		KubernetesPodMetadata:     kubernetesPodMetadata,
 	}
 
 	sessionEnd := apievents.SessionEnd{
 		Metadata: apievents.Metadata{
-			Index: 20,
-			Type:  events.SessionEndEvent,
-			ID:    "da455e0f-c27d-459f-a218-4e83b3db9426",
-			Code:  events.SessionEndCode,
-			Time:  params.Clock.Now().UTC().Add(time.Hour + time.Second + 7*time.Millisecond),
+			Index:       20,
+			Type:        events.SessionEndEvent,
+			ID:          "da455e0f-c27d-459f-a218-4e83b3db9426",
+			Code:        events.SessionEndCode,
+			Time:        params.Clock.Now().UTC().Add(time.Hour + time.Second + 7*time.Millisecond),
+			ClusterName: params.ClusterName,
 		},
 		ServerMetadata: apievents.ServerMetadata{
 			ServerVersion:   teleport.Version,
@@ -115,28 +273,30 @@ func GenerateTestSession(params SessionParams) []apievents.AuditEvent {
 			SessionID: params.SessionID,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User: "alice@example.com",
+			User: params.UserName,
 		},
-		EnhancedRecording: true,
-		Interactive:       true,
-		Participants:      []string{"alice@example.com"},
-		StartTime:         params.Clock.Now().UTC(),
-		EndTime:           params.Clock.Now().UTC().Add(3*time.Hour + time.Second + 7*time.Millisecond),
+		ConnectionMetadata:        connectionMetadata,
+		EnhancedRecording:         true,
+		Interactive:               true,
+		Participants:              []string{params.UserName},
+		StartTime:                 params.Clock.Now().UTC(),
+		EndTime:                   params.Clock.Now().UTC().Add(3*time.Hour + time.Second + 7*time.Millisecond),
+		KubernetesClusterMetadata: kubernetesClusterMetadata,
+		KubernetesPodMetadata:     kubernetesPodMetadata,
 	}
 
 	genEvents := []apievents.AuditEvent{&sessionStart}
-	i := int64(0)
-	for i = 0; i < params.PrintEvents; i++ {
+	for i, data := range params.PrintData {
 		event := &apievents.SessionPrint{
 			Metadata: apievents.Metadata{
-				Index: i + 1,
+				Index: int64(i) + 1,
 				Type:  events.SessionPrintEvent,
 				Time:  params.Clock.Now().UTC().Add(time.Minute + time.Duration(i)*time.Millisecond),
 			},
-			ChunkIndex:        i,
-			DelayMilliseconds: i,
-			Offset:            i,
-			Data:              bytes.Repeat([]byte("hello"), int(i%177+1)),
+			ChunkIndex:        int64(i),
+			DelayMilliseconds: int64(i),
+			Offset:            int64(i),
+			Data:              []byte(data),
 		}
 		event.Bytes = int64(len(event.Data))
 		event.Time = event.Time.Add(time.Duration(i) * time.Millisecond)
@@ -144,8 +304,164 @@ func GenerateTestSession(params SessionParams) []apievents.AuditEvent {
 		genEvents = append(genEvents, event)
 	}
 
-	i++
-	sessionEnd.Metadata.Index = i
+	sessionEnd.Metadata.Index = int64(len(genEvents))
+	genEvents = append(genEvents, &sessionEnd)
+
+	return genEvents
+}
+
+// DBSessionParams specifies optional parameters
+// for a generated database session.
+type DBSessionParams struct {
+	// Queries is the number of queries to generate.
+	Queries int64
+	// Clock is an optional clock setting start
+	// and offset time of the event
+	Clock clockwork.Clock
+	// ServerID is an optional server ID
+	ServerID string
+	// DatabaseService is an optional database service name. (Caveat: this is
+	// actually the database resource name, not a database service, but that's
+	// how the event field is named.)
+	DatabaseService string
+	// SessionID is an optional session ID to set
+	SessionID string
+	// ClusterName is an optional originating cluster name
+	ClusterName string
+	// UserName is name of the user interacting with the session
+	UserName string
+}
+
+// SetDefaults sets parameters defaults
+func (p *DBSessionParams) SetDefaults() {
+	if p.Clock == nil {
+		p.Clock = clockwork.NewFakeClockAt(
+			time.Date(2020, 0o3, 30, 15, 58, 54, 561*int(time.Millisecond), time.UTC))
+	}
+	if p.ServerID == "" {
+		p.ServerID = uuid.New().String()
+	}
+	if p.DatabaseService == "" {
+		p.DatabaseService = "testdb"
+	}
+	if p.SessionID == "" {
+		p.SessionID = uuid.New().String()
+	}
+	if p.UserName == "" {
+		p.UserName = "bob@example.com"
+	}
+}
+
+// GenerateTestDBSession generates test database session events starting with
+// session start event, adds params.Queries events and returns the result.
+func GenerateTestDBSession(params DBSessionParams) []apievents.AuditEvent {
+	params.SetDefaults()
+
+	startTime := params.Clock.Now().UTC()
+	endTime := startTime.Add(time.Minute)
+	userMetadata := apievents.UserMetadata{
+		User:     params.UserName,
+		UserKind: apievents.UserKind_USER_KIND_HUMAN,
+	}
+	sessionMetadata := apievents.SessionMetadata{
+		SessionID:        params.SessionID,
+		PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
+	}
+	databaseMetadata := apievents.DatabaseMetadata{
+		DatabaseService:  params.DatabaseService,
+		DatabaseProtocol: types.DatabaseProtocolPostgreSQL,
+		DatabaseURI:      "localhost:5432",
+		DatabaseName:     "Northwind",
+		DatabaseUser:     "postgres",
+		DatabaseType:     types.DatabaseTypeSelfHosted,
+		DatabaseOrigin:   types.OriginConfigFile,
+	}
+
+	sessionStart := apievents.DatabaseSessionStart{
+		Metadata: apievents.Metadata{
+			Index:       0,
+			Type:        events.DatabaseSessionStartEvent,
+			ID:          "3f2876b7-6467-4741-8dc4-43c133bdd748",
+			Code:        events.DatabaseSessionStartCode,
+			Time:        startTime,
+			ClusterName: params.ClusterName,
+		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerVersion:   teleport.Version,
+			ServerID:        params.ServerID,
+			ServerNamespace: "default",
+		},
+		UserMetadata:     userMetadata,
+		SessionMetadata:  sessionMetadata,
+		DatabaseMetadata: databaseMetadata,
+		Status: apievents.Status{
+			Success: true,
+		},
+		PostgresPID: 12345,
+		ClientMetadata: apievents.ClientMetadata{
+			UserAgent: "psql",
+		},
+	}
+
+	sessionEnd := apievents.DatabaseSessionEnd{
+		Metadata: apievents.Metadata{
+			Index:       20,
+			Type:        events.DatabaseSessionEndEvent,
+			ID:          "9ee71c9-e509-47ed-bbac-16b7a38b660d",
+			Code:        events.DatabaseSessionEndCode,
+			Time:        endTime,
+			ClusterName: params.ClusterName,
+		},
+		UserMetadata:     userMetadata,
+		SessionMetadata:  sessionMetadata,
+		DatabaseMetadata: databaseMetadata,
+		StartTime:        startTime,
+		EndTime:          endTime,
+		Participants:     []string{userMetadata.User},
+	}
+
+	genEvents := []apievents.AuditEvent{&sessionStart}
+	for i := range params.Queries {
+		query := &apievents.DatabaseSessionQuery{
+			Metadata: apievents.Metadata{
+				Index:       i*2 + 1,
+				Type:        events.DatabaseSessionQueryEvent,
+				ID:          uuid.New().String(),
+				Code:        events.DatabaseSessionQueryCode,
+				Time:        startTime.Add(time.Minute + time.Duration(i*2)*time.Millisecond),
+				ClusterName: params.ClusterName,
+			},
+			UserMetadata:     userMetadata,
+			SessionMetadata:  sessionMetadata,
+			DatabaseMetadata: databaseMetadata,
+			DatabaseQuery:    fmt.Sprintf("SELECT order_id FROM order where customer_id=%d", i),
+			Status: apievents.Status{
+				Success: true,
+			},
+		}
+
+		result := &apievents.DatabaseSessionCommandResult{
+			Metadata: apievents.Metadata{
+				Index:       i*2 + 2,
+				Type:        events.DatabaseSessionCommandResultEvent,
+				ID:          uuid.New().String(),
+				Code:        events.DatabaseSessionCommandResultCode,
+				Time:        startTime.Add(time.Minute + time.Duration(i*2+1)*time.Millisecond),
+				ClusterName: params.ClusterName,
+			},
+			UserMetadata:     userMetadata,
+			SessionMetadata:  sessionMetadata,
+			DatabaseMetadata: databaseMetadata,
+			Status: apievents.Status{
+				Success: true,
+			},
+			AffectedRecords: 10,
+		}
+
+		genEvents = append(genEvents, query, result)
+	}
+
+	sessionEnd.Metadata.Index = int64(len(genEvents))
 	genEvents = append(genEvents, &sessionEnd)
 
 	return genEvents
diff --git a/lib/events/eventstest/uploader.go b/lib/events/eventstest/uploader.go
index 99cee3b1e3f94..ead8d42087b0b 100644
--- a/lib/events/eventstest/uploader.go
+++ b/lib/events/eventstest/uploader.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"context"
 	"io"
+	"iter"
 	"sort"
 	"sync"
 	"time"
@@ -34,26 +35,42 @@ import (
 	"github.com/gravitational/teleport/lib/session"
 )
 
+// MemoryUploaderConfig optional configuration for MemoryUploader.
+type MemoryUploaderConfig struct {
+	// EventsC is used by some tests to receive signal for completed uploads.
+	EventsC chan events.UploadEvent
+	// MinimumUploadBytes sets the minimum upload part size. The uploader will
+	// add padding to smaller uploads to reach this minimum size.
+	MinimumUploadBytes int
+}
+
 // NewMemoryUploader returns a new memory uploader implementing multipart
 // upload
-func NewMemoryUploader(eventsC ...chan events.UploadEvent) *MemoryUploader {
+func NewMemoryUploader(cfg ...MemoryUploaderConfig) *MemoryUploader {
 	up := &MemoryUploader{
-		mtx:     &sync.RWMutex{},
-		uploads: make(map[string]*MemoryUpload),
-		objects: make(map[session.ID][]byte),
+		mtx:        &sync.RWMutex{},
+		uploads:    make(map[string]*MemoryUpload),
+		sessions:   make(map[session.ID][]byte),
+		summaries:  make(map[session.ID][]byte),
+		metadata:   make(map[session.ID][]byte),
+		thumbnails: make(map[session.ID][]byte),
 	}
-	if len(eventsC) != 0 {
-		up.eventsC = eventsC[0]
+	if len(cfg) != 0 {
+		up.cfg = cfg[0]
 	}
 	return up
 }
 
 // MemoryUploader uploads all bytes to memory, used in tests
 type MemoryUploader struct {
-	mtx     *sync.RWMutex
-	uploads map[string]*MemoryUpload
-	objects map[session.ID][]byte
-	eventsC chan events.UploadEvent
+	cfg MemoryUploaderConfig
+
+	mtx        *sync.RWMutex
+	uploads    map[string]*MemoryUpload
+	sessions   map[session.ID][]byte
+	summaries  map[session.ID][]byte
+	metadata   map[session.ID][]byte
+	thumbnails map[session.ID][]byte
 
 	// Clock is an optional [clockwork.Clock] to determine the time to associate
 	// with uploads and parts.
@@ -81,11 +98,11 @@ type part struct {
 }
 
 func (m *MemoryUploader) trySendEvent(event events.UploadEvent) {
-	if m.eventsC == nil {
+	if m.cfg.EventsC == nil {
 		return
 	}
 	select {
-	case m.eventsC <- event:
+	case m.cfg.EventsC <- event:
 	default:
 	}
 }
@@ -95,7 +112,10 @@ func (m *MemoryUploader) Reset() {
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
 	m.uploads = make(map[string]*MemoryUpload)
-	m.objects = make(map[session.ID][]byte)
+	m.sessions = make(map[session.ID][]byte)
+	m.summaries = make(map[session.ID][]byte)
+	m.metadata = make(map[session.ID][]byte)
+	m.thumbnails = make(map[session.ID][]byte)
 }
 
 // CreateUpload creates a multipart upload
@@ -147,7 +167,7 @@ func (m *MemoryUploader) CompleteUpload(ctx context.Context, upload events.Strea
 			delete(up.parts, number)
 		}
 	}
-	m.objects[upload.SessionID] = result
+	m.sessions[upload.SessionID] = result
 	up.completed = true
 	m.trySendEvent(events.UploadEvent{SessionID: string(upload.SessionID), UploadID: upload.ID})
 	return nil
@@ -256,7 +276,7 @@ func (m *MemoryUploader) ListParts(ctx context.Context, upload events.StreamUplo
 func (m *MemoryUploader) Upload(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error) {
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
-	_, ok := m.objects[sessionID]
+	_, ok := m.sessions[sessionID]
 	if ok {
 		return "", trace.AlreadyExists("session %q already exists", sessionID)
 	}
@@ -264,20 +284,118 @@ func (m *MemoryUploader) Upload(ctx context.Context, sessionID session.ID, readC
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
 	}
-	m.objects[sessionID] = data
+	m.sessions[sessionID] = data
+	return string(sessionID), nil
+}
+
+// UploadSummary uploads session summary and returns URL with uploaded file in
+// case of success.
+func (m *MemoryUploader) UploadSummary(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error) {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	_, ok := m.summaries[sessionID]
+	if ok {
+		return "", trace.AlreadyExists("summary %q already exists", sessionID)
+	}
+	data, err := io.ReadAll(readCloser)
+	if err != nil {
+		return "", trace.ConvertSystemError(err)
+	}
+	m.summaries[sessionID] = data
+	return string(sessionID), nil
+}
+
+// UploadMetadata uploads session metadata and returns URL with uploaded file in
+// case of success.
+func (m *MemoryUploader) UploadMetadata(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error) {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	_, ok := m.metadata[sessionID]
+	if ok {
+		return "", trace.AlreadyExists("metadata %q already exists", sessionID)
+	}
+	data, err := io.ReadAll(readCloser)
+	if err != nil {
+		return "", trace.ConvertSystemError(err)
+	}
+	m.metadata[sessionID] = data
+	return string(sessionID), nil
+}
+
+// UploadThumbnail uploads session thumbnail and returns URL with uploaded file in
+// case of success.
+func (m *MemoryUploader) UploadThumbnail(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error) {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	_, ok := m.thumbnails[sessionID]
+	if ok {
+		return "", trace.AlreadyExists("thumbnail %q already exists", sessionID)
+	}
+	data, err := io.ReadAll(readCloser)
+	if err != nil {
+		return "", trace.ConvertSystemError(err)
+	}
+	m.thumbnails[sessionID] = data
 	return string(sessionID), nil
 }
 
 // Download downloads session tarball and writes it to writer
-func (m *MemoryUploader) Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error {
+func (m *MemoryUploader) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
 	m.mtx.RLock()
 	defer m.mtx.RUnlock()
 
-	data, ok := m.objects[sessionID]
+	data, ok := m.sessions[sessionID]
 	if !ok {
 		return trace.NotFound("session %q is not found", sessionID)
 	}
-	_, err := io.Copy(writer.(io.Writer), bytes.NewReader(data))
+	_, err := io.Copy(writer, bytes.NewReader(data))
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	return nil
+}
+
+func (m *MemoryUploader) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	m.mtx.RLock()
+	defer m.mtx.RUnlock()
+
+	data, ok := m.summaries[sessionID]
+	if !ok {
+		return trace.NotFound("summary %q is not found", sessionID)
+	}
+	_, err := io.Copy(writer, bytes.NewReader(data))
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	return nil
+}
+
+// DownloadMetadata downloads session metadata and writes it to writer
+func (m *MemoryUploader) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	m.mtx.RLock()
+	defer m.mtx.RUnlock()
+
+	data, ok := m.metadata[sessionID]
+	if !ok {
+		return trace.NotFound("metadata %q is not found", sessionID)
+	}
+	_, err := io.Copy(writer, bytes.NewReader(data))
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	return nil
+}
+
+// DownloadThumbnail downloads session thumbnail and writes it to writer
+func (m *MemoryUploader) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	m.mtx.RLock()
+	defer m.mtx.RUnlock()
+
+	data, ok := m.thumbnails[sessionID]
+	if !ok {
+		return trace.NotFound("thumbnail %q is not found", sessionID)
+	}
+	_, err := io.Copy(writer, bytes.NewReader(data))
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
@@ -297,6 +415,64 @@ func (m *MemoryUploader) ReserveUploadPart(ctx context.Context, upload events.St
 	return nil
 }
 
+// UploadEncryptedRecording uploads encrypted recordings.
+func (m *MemoryUploader) UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+	sessID, err := session.ParseID(sessionID)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	upload, err := m.CreateUpload(ctx, *sessID)
+	if err != nil {
+		return trace.Wrap(err, "creating upload")
+	}
+
+	next, stop := iter.Pull2(parts)
+	defer stop()
+
+	part, err, ok := next()
+	if err != nil {
+		return trace.Wrap(err)
+	} else if !ok {
+		return trace.BadParameter("unexpected empty upload")
+	}
+
+	var streamParts []events.StreamPart
+	// S3 requires that part numbers start at 1, so we do that by default regardless of which uploader is
+	// configured for the auth service
+	var partNumber int64 = 1
+	for {
+		if err := m.ReserveUploadPart(ctx, *upload, partNumber); err != nil {
+			return trace.Wrap(err, "reserving upload part")
+		}
+
+		nextPart, err, hasNext := next()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		// If the upload part is not at least the minimum upload part size, and this isn't
+		// the last part, append an empty part to pad up to the minimum upload size.
+		if hasNext && len(part) < m.cfg.MinimumUploadBytes {
+			part = events.PadUploadPart(part, m.cfg.MinimumUploadBytes)
+		}
+
+		streamPart, err := m.UploadPart(ctx, *upload, partNumber, bytes.NewReader(part))
+		if err != nil {
+			return trace.Wrap(err, "uploading part")
+		}
+		streamParts = append(streamParts, *streamPart)
+
+		if !hasNext {
+			break
+		}
+
+		part = nextPart
+		partNumber++
+	}
+
+	return trace.Wrap(m.CompleteUpload(ctx, *upload, streamParts), "completing upload")
+}
+
 // MockUploader is a limited implementation of [events.MultipartUploader] that
 // allows injecting errors for testing purposes. [MemoryUploader] is a more
 // complete implementation and should be preferred for testing the happy path.
diff --git a/lib/events/filelog.go b/lib/events/filelog.go
index d6c39bce40b93..38dc4066bdd86 100644
--- a/lib/events/filelog.go
+++ b/lib/events/filelog.go
@@ -347,12 +347,12 @@ func getCheckpointFromEvent(event apievents.AuditEvent) (string, error) {
 func (l *FileLog) SearchSessionEvents(ctx context.Context, req SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) {
 	var whereExp types.WhereExpr
 	if req.Cond != nil {
-		whereExp = *req.Cond
+		whereExp = *req.Cond.Expr
 	}
 	l.logger.DebugContext(ctx, "SearchSessionEvents", "from", req.From, "to", req.To, "order", req.Order, "limit", req.Limit, "cond", logutils.StringerAttr(whereExp))
 	filter := searchEventsFilter{eventTypes: SessionRecordingEvents}
 	if req.Cond != nil {
-		condFn, err := utils.ToFieldsCondition(req.Cond)
+		condFn, err := utils.ToFieldsCondition(*req.Cond)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
diff --git a/lib/events/filesessions/fileasync.go b/lib/events/filesessions/fileasync.go
index cf2cdf9e87af7..36c006f8dbed8 100644
--- a/lib/events/filesessions/fileasync.go
+++ b/lib/events/filesessions/fileasync.go
@@ -19,10 +19,12 @@
 package filesessions
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"io"
+	"iter"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -63,6 +65,16 @@ type UploaderConfig struct {
 	EventsC chan events.UploadEvent
 	// Component is used for logging purposes
 	Component string
+	// EncryptedRecordingUploader uploads encrypted session recordings
+	EncryptedRecordingUploader events.EncryptedRecordingUploader
+	// EncryptedRecordingUploadTargetSize is the target size used when aggregating
+	// encrypted recording parts before sending them to EncryptedRecordingUploader.
+	// Encrypted uploads should slightly exceed this target size unless limited by the maximum.
+	EncryptedRecordingUploadTargetSize int
+	// EncryptedRecordingUploadTargetSize is the maximum size used when aggregating
+	// encrypted recording parts before sending them to EncryptedRecordingUploader.
+	// If set to 0, then no maximum is enforced.
+	EncryptedRecordingUploadMaxSize int
 }
 
 // CheckAndSetDefaults checks and sets default values of UploaderConfig
@@ -88,6 +100,9 @@ func (cfg *UploaderConfig) CheckAndSetDefaults() error {
 	if cfg.Component == "" {
 		cfg.Component = teleport.ComponentUpload
 	}
+	if cfg.EncryptedRecordingUploadTargetSize == 0 {
+		cfg.EncryptedRecordingUploadTargetSize = events.MinUploadPartSizeBytes
+	}
 	return nil
 }
 
@@ -281,6 +296,10 @@ func (u *Uploader) Scan(ctx context.Context) (*ScanStats, error) {
 				u.log.DebugContext(ctx, "Recording was uploaded by another process.", "recording", fi.Name())
 				continue
 			}
+			if errors.Is(err, errNoEncryptedUploader) {
+				u.log.ErrorContext(ctx, "Skipped encrypted session recording due to missing uploader", "recording", fi.Name())
+				continue
+			}
 			if isSessionError(err) || trace.IsBadParameter(err) {
 				u.log.WarnContext(ctx, "Skipped session recording.", "recording", fi.Name(), "error", err)
 				stats.Corrupted++
@@ -351,8 +370,7 @@ func (u *upload) writeStatus(status apievents.StreamStatus) error {
 	return nil
 }
 
-// releaseFile releases file and associated resources
-// in a correct order
+// Close an upload's proto stream, files, and release it's file lock in the correct order.
 func (u *upload) Close() error {
 	return trace.NewAggregate(
 		u.reader.Close(),
@@ -375,6 +393,123 @@ func (u *upload) removeFiles() error {
 	return trace.NewAggregate(errs...)
 }
 
+var errSkipEncryptedUpload = errors.New("skip encrypted upload")
+
+// encryptedUploadAggregateIter returns an iterator that aggregates upload parts from the given reader
+// into larger upload with size greater than targetSize, or as near targetSize as possible without exceeding
+// the maxSize.
+func encryptedUploadAggregateIter(in io.Reader, targetSize int, maxSize int) iter.Seq2[[]byte, error] {
+	// buf holds aggregated upload parts that will be uploaded as a single upload part.
+	var buf bytes.Buffer
+
+	readNextPartHeader := func() (events.PartHeader, error) {
+		header, err := events.ParsePartHeader(in)
+		if err != nil {
+			return events.PartHeader{}, trace.Wrap(err)
+		}
+
+		if header.Flags&events.ProtoStreamFlagEncrypted == 0 {
+			return events.PartHeader{}, trace.Wrap(errSkipEncryptedUpload, "recording part not encrypted")
+		}
+
+		// Ensure that the individual file upload parts are not larger than the max size allowed here (e.g. 4MB gRPC max message size).
+		// This error case should never be hit outside of tests, but we want to ensure we fail fast in case a bug ever arises here.
+		totalPartSize := len(header.Bytes()) + int(header.PartSize)
+		if maxSize != 0 && totalPartSize > maxSize {
+			return events.PartHeader{}, trace.BadParameter("encrypted upload part is larger than the maximum size, so it cannot be uploaded. This is a bug.")
+		}
+
+		return header, nil
+	}
+
+	writePartToBuffer := func(header events.PartHeader) error {
+		// We are going to discard any padding as it isn't necessary within the individual parts.
+		originalPaddingSize := header.PaddingSize
+		header.PaddingSize = 0
+
+		if _, err := buf.Write(header.Bytes()); err != nil {
+			return trace.Wrap(err)
+		}
+
+		// Copy the part into the buffer.
+		reader := io.LimitReader(in, int64(header.PartSize))
+		copied, err := io.Copy(&buf, reader)
+		if err != nil && !errors.Is(err, io.EOF) {
+			return trace.Wrap(err)
+		}
+
+		if copied != int64(header.PartSize) {
+			return trace.Errorf("copied %d bytes from recording part instead of expected %d", copied, int64(header.PartSize))
+		}
+
+		// Discard the padding.
+		discarded, err := io.Copy(io.Discard, io.LimitReader(in, int64(originalPaddingSize)))
+		if err != nil && !errors.Is(err, io.EOF) {
+			return trace.Wrap(err)
+		}
+
+		if discarded != int64(originalPaddingSize) {
+			return trace.Errorf("discarded %d padding bytes from recording part instead of expected %d", copied, int64(originalPaddingSize))
+		}
+
+		return nil
+	}
+
+	return func(yieldFn func([]byte, error) bool) {
+		// wrap any yielded errors with sessionError since any failure to
+		// read the file itself should be treated as a corrupted recording
+		yield := func(b []byte, err error) bool {
+			if err != nil {
+				return yieldFn(b, sessionError{err})
+			}
+			return yieldFn(b, nil)
+		}
+
+		// yield the current aggregated upload part and reset the buffer.
+		yieldCurrent := func() bool {
+			// Copy the buffer to a new []byte so that the next
+			// iteration doesn't wipe the previous yielded bytes.
+			bytes := make([]byte, buf.Len())
+			copy(bytes, buf.Bytes())
+			buf.Reset()
+			return yield(bytes, nil)
+		}
+
+		for {
+			partHeader, err := readNextPartHeader()
+			if err != nil {
+				if errors.Is(err, io.EOF) {
+					// No parts remaining, yield the current part and return.
+					yieldCurrent()
+					return
+				}
+
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			// If a max size is configured and the aggregate buffer is not empty, check if there is
+			// room to add this upload part. If not, yield the current aggregate before continuing.
+			totalPartSize := len(partHeader.Bytes()) + int(partHeader.PartSize)
+			if maxSize != 0 && buf.Len() > 0 && buf.Len()+totalPartSize > maxSize {
+				if !yieldCurrent() {
+					return
+				}
+			}
+
+			writePartToBuffer(partHeader)
+
+			// If we've reached the target upload size, yield the current
+			// aggregated upload part before continuing.
+			if buf.Len() > targetSize {
+				if !yieldCurrent() {
+					return
+				}
+			}
+		}
+	}
+}
+
 func (u *Uploader) startUpload(ctx context.Context, fileName string) (err error) {
 	sessionID, err := sessionIDFromPath(fileName)
 	if err != nil {
@@ -441,10 +576,32 @@ func (u *Uploader) startUpload(ctx context.Context, fileName string) (err error)
 
 	upload := &upload{
 		sessionID:    sessionID,
-		reader:       events.NewProtoReader(sessionFile),
 		file:         sessionFile,
 		fileUnlockFn: unlock,
+		reader:       nil,
 	}
+
+	if err := u.uploadEncrypted(ctx, upload); err != nil {
+		if !errors.Is(err, errSkipEncryptedUpload) {
+			u.emitEvent(events.UploadEvent{
+				SessionID: sessionID.String(),
+				Error:     err,
+				Created:   u.cfg.Clock.Now().UTC(),
+			})
+			return trace.Wrap(err)
+		}
+	} else {
+		return nil
+	}
+
+	u.log.DebugContext(ctx, "upload not encrypted, proceeding with plaintext uploader")
+	// ensure sessionFile starts at 0 after attempted encrypted upload
+	if _, err := sessionFile.Seek(0, io.SeekStart); err != nil {
+		return trace.Wrap(err)
+	}
+
+	upload.reader = events.NewProtoReader(sessionFile, nil)
+
 	upload.checkpointFile, err = os.OpenFile(u.checkpointFilePath(sessionID), os.O_RDWR|os.O_CREATE, 0o600)
 	if err != nil {
 		if err := upload.Close(); err != nil {
@@ -474,6 +631,64 @@ func (u *Uploader) startUpload(ctx context.Context, fileName string) (err error)
 	return nil
 }
 
+var errNoEncryptedUploader = &trace.BadParameterError{Message: "no encrypted uploader configured while uploading encrypted recording"}
+
+func (u *Uploader) uploadEncrypted(ctx context.Context, up *upload) error {
+	log := u.log.With(fieldSessionID, up.sessionID)
+	header, err := events.ParsePartHeader(up.file)
+	if err != nil {
+		return trace.Wrap(sessionError{err})
+	}
+
+	if header.Flags&events.ProtoStreamFlagEncrypted == 0 {
+		return trace.Wrap(errSkipEncryptedUpload, "recording not encrypted")
+	}
+
+	if u.cfg.EncryptedRecordingUploader == nil {
+		return trace.Wrap(errNoEncryptedUploader)
+	}
+
+	if _, err := up.file.Seek(0, io.SeekStart); err != nil {
+		return trace.Wrap(err, "resetting recording for plaintext upload")
+	}
+
+	// The upload parts in the given reader are each ~128KB. Usually these parts are consumed and reconstructed
+	// by Auth in 5MB chunks to meet the minimum upload size of upload providers like S3. Since these uploads
+	// are proxied directly to the uploader from the agent here (see link below), this agent needs to combine
+	// these upload parts into larger, aggregated upload parts.
+	//
+	// https://github.com/gravitational/teleport/blob/master/rfd/0127-encrypted-session-recordings.md#session-recording-modes
+	partIter := encryptedUploadAggregateIter(up.file, u.cfg.EncryptedRecordingUploadTargetSize, u.cfg.EncryptedRecordingUploadMaxSize)
+
+	u.wg.Add(1)
+	go func() {
+		defer u.wg.Done()
+		defer u.releaseSemaphore(ctx)
+		defer up.Close()
+		log.DebugContext(ctx, "uploading encrypted recording")
+		if err := u.cfg.EncryptedRecordingUploader.UploadEncryptedRecording(ctx, up.sessionID.String(), partIter); err != nil {
+			log.ErrorContext(ctx, "Encrypted upload failed", "error", err)
+			u.emitEvent(events.UploadEvent{
+				SessionID: up.sessionID.String(),
+				Error:     err,
+				Created:   u.cfg.Clock.Now().UTC(),
+			})
+			return
+		}
+
+		u.emitEvent(events.UploadEvent{
+			SessionID: up.sessionID.String(),
+			Created:   u.cfg.Clock.Now().UTC(),
+		})
+
+		if err := os.Remove(up.file.Name()); err != nil {
+			log.ErrorContext(ctx, "failed to remove session file after successful upload", "error", err)
+		}
+	}()
+
+	return nil
+}
+
 func (u *Uploader) upload(ctx context.Context, up *upload) error {
 	log := u.log.With(fieldSessionID, up.sessionID)
 
diff --git a/lib/events/filesessions/fileasync_chaos_test.go b/lib/events/filesessions/fileasync_chaos_test.go
index 26e7a2b522911..a9a7ef18890b8 100644
--- a/lib/events/filesessions/fileasync_chaos_test.go
+++ b/lib/events/filesessions/fileasync_chaos_test.go
@@ -54,7 +54,9 @@ func TestChaosUpload(t *testing.T) {
 	defer cancel()
 
 	eventsC := make(chan events.UploadEvent, 100)
-	memUploader := eventstest.NewMemoryUploader(eventsC)
+	memUploader := eventstest.NewMemoryUploader(eventstest.MemoryUploaderConfig{
+		EventsC: eventsC,
+	})
 	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
 		Uploader:       memUploader,
 		MinUploadBytes: 1024,
@@ -122,7 +124,9 @@ func TestChaosUpload(t *testing.T) {
 	go uploader.Serve(ctx)
 	defer uploader.Close()
 
-	fileStreamer, err := NewStreamer(scanDir)
+	fileStreamer, err := NewStreamer(StreamerConfig{
+		Dir: scanDir,
+	})
 	require.NoError(t, err)
 
 	parallelStreams := 20
diff --git a/lib/events/filesessions/fileasync_test.go b/lib/events/filesessions/fileasync_test.go
index a015bde8ec15c..0860affbe665f 100644
--- a/lib/events/filesessions/fileasync_test.go
+++ b/lib/events/filesessions/fileasync_test.go
@@ -22,82 +22,101 @@ import (
 	"bytes"
 	"context"
 	"crypto/rand"
+	"encoding/hex"
 	"errors"
+	"io"
+	"io/fs"
+	"iter"
+	mathrand "math/rand/v2"
 	"os"
 	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 // TestUploadOK tests async file uploads scenarios
 func TestUploadOK(t *testing.T) {
-	p := newUploaderPack(t, nil)
-	defer p.Close(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
 
-	// wait until uploader blocks on the clock
-	p.clock.BlockUntil(1)
+	p := newUploaderPack(ctx, t, uploaderPackConfig{})
 
-	fileStreamer, err := NewStreamer(p.scanDir)
-	require.NoError(t, err)
+	clock, ok := p.clock.(*clockwork.FakeClock)
+	require.True(t, ok, "fake clock expected")
+	// wait until uploader blocks on the clock
+	clock.BlockUntilContext(ctx, 1)
 
 	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
 	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
 
-	emitStream(p.ctx, t, fileStreamer, inEvents)
+	p.emitEvents(ctx, t, inEvents)
 
 	// initiate the scan by advancing clock past
 	// block period
-	p.clock.Advance(p.scanPeriod + time.Second)
+	clock.Advance(p.scanPeriod + time.Second)
 
 	var event events.UploadEvent
 	select {
 	case event = <-p.memEventsC:
 		require.Equal(t, event.SessionID, sid)
 		require.NoError(t, event.Error)
-	case <-p.ctx.Done():
+	case <-ctx.Done():
 		t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 	}
 
 	// read the upload and make sure the data is equal
-	outEvents := readStream(p.ctx, t, event.UploadID, p.memUploader)
+	outEvents := p.readEvents(ctx, t, event.UploadID)
 	require.Equal(t, inEvents, outEvents)
+
+	// regression: ensure there is a single upload for the captured session
+	uploads, err := p.memUploader.ListUploads(ctx)
+	require.NoError(t, err)
+	require.Len(t, uploads, 1)
 }
 
 // TestUploadParallel verifies several parallel uploads that have to wait
 // for semaphore
 func TestUploadParallel(t *testing.T) {
-	p := newUploaderPack(t, nil)
-	defer p.Close(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+
+	p := newUploaderPack(ctx, t, uploaderPackConfig{})
+
+	clock, ok := p.clock.(*clockwork.FakeClock)
+	require.True(t, ok, "fake clock expected")
 
 	// wait until uploader blocks on the clock
-	p.clock.BlockUntil(1)
+	clock.BlockUntilContext(ctx, 1)
 
 	sessions := make(map[string][]apievents.AuditEvent)
 
-	for i := 0; i < 5; i++ {
-		fileStreamer, err := NewStreamer(p.scanDir)
-		require.NoError(t, err)
-
+	const sessionCount = 5
+	for range sessionCount {
 		sessionEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
 		sid := sessionEvents[0].(events.SessionMetadataGetter).GetSessionID()
 
-		emitStream(p.ctx, t, fileStreamer, sessionEvents)
+		p.emitEvents(ctx, t, sessionEvents)
 		sessions[sid] = sessionEvents
 	}
 
 	// initiate the scan by advancing the clock past
 	// block period
-	p.clock.Advance(p.scanPeriod + time.Second)
+	clock.Advance(p.scanPeriod + time.Second)
 
 	for range sessions {
 		var event events.UploadEvent
@@ -108,17 +127,22 @@ func TestUploadParallel(t *testing.T) {
 			require.NoError(t, event.Error)
 			sessionEvents, found = sessions[event.SessionID]
 			require.True(t, found, "session %q is not expected, possible duplicate event", event.SessionID)
-		case <-p.ctx.Done():
+		case <-ctx.Done():
 			t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 		}
 
 		// read the upload and make sure the data is equal
-		outEvents := readStream(p.ctx, t, event.UploadID, p.memUploader)
+		outEvents := p.readEvents(ctx, t, event.UploadID)
 
 		require.Equal(t, sessionEvents, outEvents)
 
 		delete(sessions, event.SessionID)
 	}
+
+	// regression: ensure there is a single upload for each captured session
+	uploads, err := p.memUploader.ListUploads(ctx)
+	require.NoError(t, err)
+	require.Len(t, uploads, sessionCount)
 }
 
 // TestMovesCorruptedUploads verifies that the uploader moves corrupted uploads
@@ -150,7 +174,7 @@ func TestMovesCorruptedUploads(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, badFile.Close())
 
-	stats, err := uploader.Scan(context.Background())
+	stats, err := uploader.Scan(t.Context())
 	require.NoError(t, err)
 	require.Equal(t, 2, stats.Scanned)
 	require.Equal(t, 2, stats.Corrupted)
@@ -165,7 +189,7 @@ func TestMovesCorruptedUploads(t *testing.T) {
 	// run a second scan to verify that:
 	// 1. the corrupted file is no longer processed
 	// 2. the file with the bad name was still flagged as corrupted
-	stats, err = uploader.Scan(context.Background())
+	stats, err = uploader.Scan(t.Context())
 	require.NoError(t, err)
 	require.Equal(t, 1, stats.Scanned)
 	require.Equal(t, 1, stats.Corrupted)
@@ -361,49 +385,43 @@ func TestUploadResume(t *testing.T) {
 // and makes sure that the uploader starts backing off.
 func TestUploadBackoff(t *testing.T) {
 	var terminateConnectionAt atomic.Int64
-	terminateConnectionAt.Store(700)
-
-	p := newUploaderPack(t, func(streamer events.Streamer) (events.Streamer, error) {
-		return events.NewCallbackStreamer(events.CallbackStreamerConfig{
-			Inner: streamer,
-			OnRecordEvent: func(ctx context.Context, sid session.ID, pe apievents.PreparedSessionEvent) error {
-				event := pe.GetAuditEvent()
-				terminateAt := terminateConnectionAt.Load()
-				if terminateAt > 0 && event.GetIndex() >= terminateAt {
-					t.Logf("Terminating connection at event %v", event.GetIndex())
-					return trace.ConnectionProblem(nil, "connection terminated at event index %v", terminateAt)
-				}
-				return nil
-			},
-		})
-	})
-	defer p.Close(t)
+	terminateConnectionAt.Store(256)
 
-	// wait until uploader blocks on the clock before creating the stream
-	p.clock.BlockUntil(1)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
 
-	fileStreamer, err := NewStreamer(p.scanDir)
-	require.NoError(t, err)
+	p := newUploaderPack(ctx, t, uploaderPackConfig{
+		wrapProtoStreamer: func(streamer events.Streamer) (events.Streamer, error) {
+			return events.NewCallbackStreamer(events.CallbackStreamerConfig{
+				Inner: streamer,
+				OnRecordEvent: func(ctx context.Context, sid session.ID, pe apievents.PreparedSessionEvent) error {
+					event := pe.GetAuditEvent()
+					terminateAt := terminateConnectionAt.Load()
+					if terminateAt > 0 && event.GetIndex() >= terminateAt {
+						t.Logf("Terminating connection at event %v", event.GetIndex())
+						return trace.ConnectionProblem(nil, "connection terminated at event index %v", terminateAt)
+					}
+					return nil
+				},
+			})
+		},
+	})
 
-	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 4096})
-	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
+	clock, ok := p.clock.(*clockwork.FakeClock)
+	require.True(t, ok, "fake clock expected")
 
-	stream, err := fileStreamer.CreateAuditStream(p.ctx, session.ID(sid))
-	require.NoError(t, err)
+	// wait until uploader blocks on the clock before creating the stream
+	clock.BlockUntilContext(ctx, 1)
 
-	for _, event := range inEvents {
-		err := stream.RecordEvent(p.ctx, eventstest.PrepareEvent(event))
-		require.NoError(t, err)
-	}
-	err = stream.Complete(p.ctx)
-	require.NoError(t, err)
+	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 512})
+	p.emitEvents(ctx, t, inEvents)
 
 	// initiate the scan by advancing clock past
 	// block period
-	p.clock.Advance(p.scanPeriod + time.Second)
+	clock.Advance(p.scanPeriod + time.Second)
 
 	// initiate several scan attempts and increase the scan period
-	attempts := 10
+	attempts := 5
 	var prev time.Time
 	var diffs []time.Duration
 	for i := 0; i < attempts; i++ {
@@ -418,15 +436,15 @@ func TestUploadBackoff(t *testing.T) {
 				diffs = append(diffs, event.Created.Sub(prev))
 				prev = event.Created
 			}
-		case <-p.ctx.Done():
+		case <-ctx.Done():
 			t.Fatalf("Timeout waiting for async upload %v, try `go test -v` to get more logs for details", i)
 		}
 
 		// Block until Scan has been called two times,
 		// first time after doing the scan, and second
 		// on receiving the event to <- eventsCh
-		p.clock.BlockUntil(2)
-		p.clock.Advance(p.scanPeriod*time.Duration(i+2) + time.Second)
+		clock.BlockUntilContext(ctx, 2)
+		clock.Advance(p.scanPeriod*time.Duration(i+2) + time.Second)
 	}
 
 	// Make sure that durations between retries are increasing
@@ -438,53 +456,469 @@ func TestUploadBackoff(t *testing.T) {
 
 	// Fix the streamer, make sure the upload succeeds
 	terminateConnectionAt.Store(0)
-	p.clock.BlockUntil(2)
-	p.clock.Advance(time.Hour)
+	clock.BlockUntilContext(ctx, 2)
+	clock.Advance(time.Hour)
 	select {
 	case event := <-p.eventsC:
 		require.NoError(t, event.Error)
-	case <-p.ctx.Done():
+	case <-ctx.Done():
 		t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 	}
 }
 
-// TestUploadBadSession creates a corrupted session file
-// and makes sure the uploader marks it as faulty
-func TestUploadBadSession(t *testing.T) {
-	ctx := context.Background()
+// TestUploadCorruptSession creates a corrupted session file
+// and makes sure the uploader marks it as faulty and moves it
+// to the corrupted directory
+func TestUploadCorruptSession(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+		p := newUploaderPack(ctx, t, uploaderPackConfig{
+			clock: clockwork.NewRealClock(),
+		})
+		sessionID := session.NewID()
+		fileName := filepath.Join(p.scanDir, string(sessionID)+tarExt)
+
+		err := os.WriteFile(fileName, []byte("this session is corrupted"), 0o600)
+		require.NoError(t, err)
+
+		// wait for the upload event, make sure
+		// the error is the problem error
+		event := <-p.eventsC
+		require.Error(t, event.Error)
+		require.True(t, isSessionError(event.Error))
+
+		stats, err := p.uploader.Scan(ctx)
+		require.NoError(t, err)
+		// Bad records have been scanned, but uploads have not started
+		require.Equal(t, 1, stats.Scanned)
+		require.Equal(t, 1, stats.Corrupted)
+		require.Equal(t, 0, stats.Started)
+
+		// wait for the upload to picked up again and moved to the corrupted
+		// directory
+		synctest.Wait()
+
+		// make sure the file has been moved from the scan dir to the corrupted dir
+		require.NoFileExists(t, fileName)
+		require.FileExists(t, filepath.Join(p.uploader.cfg.CorruptedDir, string(sessionID)+tarExt))
+
+	})
+}
+
+// TestMinimumUpload tests that the minimum upload values for files and final uploads are respected.
+func TestMinimumUpload(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
 
-	p := newUploaderPack(t, nil)
-	defer p.Close(t)
+	// The gzip writer ensures that upload parts exceed the minimum upload size, and imprecisely
+	// constrains the maximum size to 133% of the minimum. At small values, this is especially
+	// imprecise, so we give a full 200% of the minimum as overhead.
+	//
+	// Usually, we use 128KB for file parts and 5KB for final upload parts.
+	minFileBytes := 8192
+	maxFileBytes := 2 * minFileBytes
+	minUploadBytes := 33768
+	maxUploadBytes := 2 * minUploadBytes
+
+	p := newUploaderPack(ctx, t, uploaderPackConfig{
+		minimumFileUploadBytes: int64(minFileBytes),
+		minimumUploadBytes:     int64(minUploadBytes),
+	})
 
+	clock, ok := p.clock.(*clockwork.FakeClock)
+	require.True(t, ok, "fake clock expected")
 	// wait until uploader blocks on the clock
-	p.clock.BlockUntil(1)
+	clock.BlockUntilContext(ctx, 1)
 
-	sessionID := session.NewID()
-	fileName := filepath.Join(p.scanDir, string(sessionID)+tarExt)
+	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintUntilBytes: int64(maxUploadBytes + 512 + mathrand.IntN(512))})
+	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
+	stream, err := p.fileStreamer.CreateAuditStream(ctx, session.ID(sid))
+	require.NoError(t, err)
+	for _, event := range inEvents {
+		err := stream.RecordEvent(ctx, eventstest.PrepareEvent(event))
+		require.NoError(t, err)
+	}
+
+	// Before completing the file stream, which writes upload part files into a .tar, check that
+	// each file part was within specific size expectations.
+	var partFiles []fs.FileInfo
+	filepath.WalkDir(p.scanDir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return trace.Wrap(err, "walking directory tree")
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+
+		info, err := d.Info()
+		if err != nil {
+			return trace.Wrap(err, "retrieving file info")
+		}
+
+		// skip non-part files.
+		if ext := filepath.Ext(info.Name()); ext == ".part" {
+			partFiles = append(partFiles, info)
+		}
 
-	err := os.WriteFile(fileName, []byte("this session is corrupted"), 0o600)
+		return nil
+	})
 	require.NoError(t, err)
 
-	// initiate the scan by advancing clock past
-	// block period
-	p.clock.Advance(p.scanPeriod + time.Second)
+	slices.SortFunc(partFiles, func(a fs.FileInfo, b fs.FileInfo) int {
+		aPartNumberStr, _ := strings.CutSuffix(a.Name(), ".part")
+		aPartNumber, err := strconv.Atoi(aPartNumberStr)
+		require.NoError(t, err)
+		bPartNumberStr, _ := strings.CutSuffix(b.Name(), ".part")
+		bPartNumber, err := strconv.Atoi(bPartNumberStr)
+		require.NoError(t, err)
+		return aPartNumber - bPartNumber
+	})
+
+	for i, partFile := range partFiles {
+		partSize := int(partFile.Size())
+		require.GreaterOrEqual(t, partSize, minFileBytes, "expected upload part %v to be between %v and %v bytes, but was %v bytes", i, minFileBytes, maxFileBytes, partSize)
+		require.LessOrEqual(t, partSize, maxFileBytes, "expected upload part %v to be between %v and %v bytes, but was %v bytes", i, minFileBytes, maxFileBytes, partSize)
+	}
+
+	// Complete the file stream and advance the clock to unblock the uploader scanner.
+	err = stream.Complete(ctx)
+	require.NoError(t, err)
+
+	clock.Advance(p.scanPeriod + time.Second)
 
-	// wait for the upload event, make sure
-	// the error is the problem error
 	var event events.UploadEvent
 	select {
-	case event = <-p.eventsC:
-		require.Error(t, event.Error)
-		require.True(t, isSessionError(event.Error))
-	case <-p.ctx.Done():
+	case event = <-p.memEventsC:
+		require.Equal(t, event.SessionID, sid)
+		require.NoError(t, event.Error)
+	case <-ctx.Done():
 		t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 	}
 
-	stats, err := p.uploader.Scan(ctx)
+	// read the upload and make sure the data is equal
+	outEvents := p.readEvents(ctx, t, event.UploadID)
+	require.Equal(t, inEvents, outEvents)
+
+	uploadParts, err := p.memUploader.GetParts(event.UploadID)
 	require.NoError(t, err)
-	// Bad records have been scanned, but uploads have not started
-	require.Equal(t, 1, stats.Scanned)
-	require.Equal(t, 0, stats.Started)
+
+	// minimumProtoUploadBytes should ensure each upload part is within specific size expectations.
+	for i, part := range uploadParts {
+		if i == len(uploadParts)-1 {
+			// The last part is not required to meet the minimum size.
+			require.LessOrEqual(t, len(part), maxUploadBytes, "expected last upload part to be smaller than %v bytes, but was %v bytes", maxUploadBytes, len(part))
+		} else {
+			require.GreaterOrEqual(t, len(part), minUploadBytes, "expected upload part %v to be between %v and %v bytes, but was %v bytes", i, minUploadBytes, maxUploadBytes, len(part))
+			require.LessOrEqual(t, len(part), maxUploadBytes, "expected upload part %v to be between %v and %v bytes, but was %v bytes", i, minUploadBytes, maxUploadBytes, len(part))
+		}
+	}
+
+	// There should be at least 1 final upload part for every 4 file upload parts.
+	minFactor := minUploadBytes / minFileBytes
+	require.LessOrEqual(t, len(partFiles)/minFactor, len(uploadParts), "expected there to be 1 final upload part for every 4 transient file parts, but got %v and %v respectively", len(uploadParts), len(partFiles))
+}
+
+func TestUploadEncryptedRecording(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		minFileSize int
+		// encrypted upload files should be aggregated by the encrypted uploader to reach the target size.
+		encryptedTargetSize      int
+		encryptedMaxSize         int
+		expectEncryptedUploadErr bool
+		// uploads from the encrypted uploader should be padded further by the final uploader to
+		// reach the minimum upload size. e.g. pad encrypted uploads of 4MB (max from GRPC) to reach
+		// S3 minimum upload of 5MB.
+		minUploadBytes int
+	}{
+		{
+			name:                "target size larger than max encrypted upload size",
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4 * 2,
+			encryptedMaxSize:    8192 * 4,
+		}, {
+			name:                "target size equals max encrypted upload size",
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4,
+			encryptedMaxSize:    8192 * 4,
+		}, {
+			name:                "target size smaller than max encrypted upload size",
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4,
+			encryptedMaxSize:    8192 * 4 * 2,
+		}, {
+			name:                "target size larger than min upload size",
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4 * 2,
+			minUploadBytes:      8192 * 4,
+		}, {
+			name: "target size equals min upload size",
+			// this test becomes flaky at lower sizes
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4,
+			minUploadBytes:      8192 * 4,
+		}, {
+			name: "target size smaller than min upload size",
+			// this test becomes flaky at lower sizes
+			minFileSize:         8192,
+			encryptedTargetSize: 8192 * 4,
+			minUploadBytes:      8192 * 4 * 2,
+		}, {
+			name:                     "min file size larger than max encrypted size",
+			minFileSize:              8192 * 4,
+			encryptedMaxSize:         8192,
+			expectEncryptedUploadErr: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+			defer cancel()
+
+			// First we calculate some expected size values for different steps in the event stream.
+			// It is easier to calculate them here rather than in the test case's parameters.
+
+			// the gzip writer is imprecise and may exceed the min file size. With a min of 8192,
+			// an extra 8192 bytes should be plenty of overhead. If this test becomes flaky, consider
+			// raising the minimum in the test cases above.
+			maxFileSize := tc.minFileSize * 2
+
+			// We expect encrypted uploads to exceed the target size, unless the maximum prevents it,
+			// in which case we will be short one file part.
+			expectEncryptedSizeFloor := tc.encryptedTargetSize
+			if tc.encryptedMaxSize != 0 && tc.encryptedTargetSize+maxFileSize > tc.encryptedMaxSize {
+				expectEncryptedSizeFloor = tc.encryptedMaxSize - maxFileSize
+			}
+
+			// We expect encrypted uploads to be below the max size if set. Otherwise, we expect it to
+			// be the target size + one additional file part.
+			expectEncryptedSizeCeil := tc.encryptedMaxSize
+			if tc.encryptedMaxSize == 0 {
+				expectEncryptedSizeCeil = tc.encryptedTargetSize + maxFileSize
+			}
+
+			// the final upload is never smaller than the encrypted size, but always above the minimum.
+			expectFinalSizeFloor := max(tc.minUploadBytes, expectEncryptedSizeFloor)
+
+			// the final upload is only larger than the minimum (+header_size) if the encrypted size is larger.
+			expectFinalSizeCeil := max(expectEncryptedSizeCeil, tc.minUploadBytes+events.ProtoStreamV2PartHeaderSize)
+
+			// Create a wrapper around the encrypted uploader to ensure the caller is yielding
+			// correctly sized uploads.
+			var recollectParts [][]byte
+			encryptedUploadWrapper := wrapEncryptedUploaderFn(func(u events.EncryptedRecordingUploader) events.EncryptedRecordingUploader {
+				return encryptedUploaderFn(func(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+					next, stop := iter.Pull2(parts)
+					defer stop()
+
+					part, err, ok := next()
+					if err != nil {
+						return trace.Wrap(err)
+					} else if !ok {
+						return trace.BadParameter("unexpected empty upload")
+					}
+
+					for {
+						recollectParts = append(recollectParts, part)
+
+						nextPart, err, hasNext := next()
+						if err != nil {
+							return trace.Wrap(err)
+						}
+
+						if !hasNext {
+							break
+						}
+
+						if hasNext {
+							require.GreaterOrEqual(t, len(part), expectEncryptedSizeFloor, "expected encrypted upload to be between %v and %v bytes, but was %v bytes", expectEncryptedSizeFloor, expectEncryptedSizeCeil, len(part))
+							require.LessOrEqual(t, len(part), expectEncryptedSizeCeil, "expected encrypted upload to be between %v and %v bytes, but was %v bytes", expectEncryptedSizeFloor, expectEncryptedSizeCeil, len(part))
+						} else {
+							// The last part is not expected to meet the target size.
+							require.LessOrEqual(t, len(part), expectEncryptedSizeCeil, "expected last encrypted upload to be smaller than %v bytes, but was %v bytes", expectEncryptedSizeCeil, len(part))
+						}
+
+						part = nextPart
+					}
+
+					partReIter := func(yield func([]byte, error) bool) {
+						for _, part := range recollectParts {
+							if !yield(part, nil) {
+								return
+							}
+						}
+					}
+
+					return u.UploadEncryptedRecording(ctx, sessionID, partReIter)
+				})
+			})
+
+			p := newUploaderPack(ctx, t, uploaderPackConfig{
+				minimumFileUploadBytes:             int64(tc.minFileSize),
+				minimumUploadBytes:                 int64(tc.minUploadBytes),
+				encrypter:                          &fakeEncryptedIO{},
+				wrapEncryptedUploader:              encryptedUploadWrapper,
+				encryptedRecordingUploadTargetSize: tc.encryptedTargetSize,
+				encryptedRecordingUploadMaxSize:    tc.encryptedMaxSize,
+			})
+
+			clock, ok := p.clock.(*clockwork.FakeClock)
+			require.True(t, ok, "fake clock expected")
+
+			// wait until uploader blocks on the clock
+			err := clock.BlockUntilContext(ctx, 1)
+			require.NoError(t, err)
+
+			// Here we ensure at least 5 final upload parts so that we amply test the test case values, + some variance.
+			inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintUntilBytes: int64(expectFinalSizeCeil*5 + mathrand.IntN(512))})
+			sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
+			p.emitEvents(ctx, t, inEvents)
+
+			// initiate the scan by advancing clock past
+			// block period
+			clock.Advance(p.scanPeriod + time.Second)
+
+			var event events.UploadEvent
+			select {
+			case event = <-p.memEventsC:
+				if tc.expectEncryptedUploadErr {
+					t.Fatalf("Unexpected upload event")
+				}
+				require.Equal(t, event.SessionID, sid)
+				require.NoError(t, event.Error)
+			case event = <-p.eventsC:
+				if !tc.expectEncryptedUploadErr {
+					t.Fatalf("Unexpected upload event")
+				}
+				require.Error(t, event.Error)
+				require.True(t, isSessionError(event.Error))
+				return
+			case <-ctx.Done():
+				t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
+			}
+
+			// read the upload and make sure the data is equal
+			outEvents := p.readEvents(ctx, t, event.UploadID)
+			require.Equal(t, inEvents, outEvents)
+
+			uploadParts, err := p.memUploader.GetParts(event.UploadID)
+			require.NoError(t, err)
+
+			// final uploads should be above the minimum upload size.
+			for i, part := range uploadParts {
+				if i == len(uploadParts)-1 {
+					// The last part is not required to meet the minimum size, so it shouldn't exceed the original encrypted recording size.
+					require.LessOrEqual(t, len(part), expectEncryptedSizeCeil, "expected last upload to be smaller than %v bytes, but was %v bytes", expectEncryptedSizeCeil, len(part))
+				} else {
+					require.GreaterOrEqual(t, len(part), expectFinalSizeFloor, "expected upload to be between %v and %v bytes, but was %v bytes", expectFinalSizeFloor, expectFinalSizeCeil, len(part))
+					require.LessOrEqual(t, len(part), expectFinalSizeCeil, "expected upload to be between %v and %v bytes, but was %v bytes", expectFinalSizeFloor, expectFinalSizeCeil, len(part))
+				}
+			}
+
+			// There should be one final upload for each upload part from the encrypted uploader.
+			require.Len(t, recollectParts, len(uploadParts), "expected there to be an equal amount of final upload parts and transient upload parts, but got %v and %v respectively", len(uploadParts), len(recollectParts))
+		})
+	}
+}
+
+// TestUploadCorruptEncryptedRecording ensures that a single failed upload does not cause failures to upload
+// other well-formed recordings. It also ensures that the affected file is moved into the corrupted directory.
+func TestUploadCorruptEncryptedRecording(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+
+		var corruptSessionID string
+		var failedSessionID string
+		wrapUploaderFn := func(uploader events.EncryptedRecordingUploader) events.EncryptedRecordingUploader {
+			return encryptedUploaderFn(func(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+				if sessionID == corruptSessionID {
+					return sessionError{errors.New("corrupted session")}
+				}
+
+				if sessionID == failedSessionID {
+					return errors.New("upload failure")
+				}
+
+				return uploader.UploadEncryptedRecording(ctx, sessionID, parts)
+			})
+		}
+
+		concurrentUploads := 3
+		// we need to generate enough sessions to saturate the concurrent uploads and
+		// ensure we're releasing the semaphore properly
+		sessionCount := concurrentUploads * 3
+
+		p := newUploaderPack(ctx, t, uploaderPackConfig{
+			minimumFileUploadBytes:             64,
+			encrypter:                          &fakeEncryptedIO{},
+			encryptedRecordingUploadTargetSize: 128,
+			wrapEncryptedUploader:              wrapUploaderFn,
+			concurrentUploads:                  concurrentUploads,
+		})
+
+		// clean up the scan dir because the tests are flaky otherwise
+		t.Cleanup(func() { os.RemoveAll(p.scanDir) })
+
+		// generate a few recordings
+		eventsCount := 100
+		sessionIDs := make([]string, sessionCount)
+		failedIdx := mathrand.IntN(len(sessionIDs))
+		corruptIdx := mathrand.IntN(len(sessionIDs))
+		for corruptIdx == failedIdx {
+			corruptIdx = mathrand.IntN(len(sessionIDs))
+		}
+		for i := range sessionCount {
+			inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: int64(eventsCount)})
+			sessionIDs[i] = inEvents[0].(events.SessionMetadataGetter).GetSessionID()
+			if i == failedIdx {
+				failedSessionID = sessionIDs[i]
+			}
+			if i == corruptIdx {
+				corruptSessionID = sessionIDs[i]
+			}
+			p.emitEvents(ctx, t, inEvents)
+		}
+
+		// Due to issues with determinism in running the uploader, we opt to scan/wait
+		// in a loop to ensure all uploads are fully processed and then assert on the
+		// final state of recording files on disk.
+		for range 10 {
+			_, err := p.uploader.Scan(ctx)
+			require.NoError(t, err)
+			synctest.Wait()
+		}
+
+		// assert corrupt file is moved to the corrupted dir
+		assert.NoFileExists(t, filepath.Join(p.scanDir, corruptSessionID+tarExt))
+		assert.FileExists(t, filepath.Join(p.uploader.cfg.CorruptedDir, corruptSessionID+tarExt))
+		assert.FileExists(t, filepath.Join(p.uploader.cfg.CorruptedDir, corruptSessionID+errorExt))
+
+		// assert file that failed to upload still exists in the scan dir to be retried
+		assert.FileExists(t, filepath.Join(p.scanDir, failedSessionID+tarExt))
+		assert.NoFileExists(t, filepath.Join(p.uploader.cfg.CorruptedDir, failedSessionID+tarExt))
+
+		// assert that successfully uploaded files are removed
+		for _, sid := range sessionIDs {
+			switch sid {
+			case failedSessionID, corruptSessionID:
+				continue
+			}
+			assert.NoFileExists(t, filepath.Join(p.scanDir, sid+tarExt))
+			assert.NoFileExists(t, filepath.Join(p.uploader.cfg.CorruptedDir, sid+tarExt))
+		}
+	})
+}
+
+type uploaderPackConfig struct {
+	minimumFileUploadBytes             int64
+	minimumUploadBytes                 int64
+	wrapProtoStreamer                  wrapStreamerFn
+	encrypter                          events.EncryptionWrapper
+	wrapEncryptedUploader              wrapEncryptedUploaderFn
+	encryptedRecordingUploadTargetSize int
+	encryptedRecordingUploadMaxSize    int
+	clock                              clockwork.Clock
+	concurrentUploads                  int
 }
 
 // uploaderPack reduces boilerplate required
@@ -492,75 +926,112 @@ func TestUploadBadSession(t *testing.T) {
 type uploaderPack struct {
 	scanPeriod       time.Duration
 	initialScanDelay time.Duration
-	clock            *clockwork.FakeClock
-	eventsC          chan events.UploadEvent
-	memEventsC       chan events.UploadEvent
-	memUploader      *eventstest.MemoryUploader
-	streamer         events.Streamer
-	scanDir          string
-	uploader         *Uploader
-	ctx              context.Context
-	cancel           context.CancelFunc
-}
-
-func (u *uploaderPack) Close(t *testing.T) {
-	u.cancel()
+	clock            clockwork.Clock
+	// fileStreamer streams events to upload parts on disk.
+	scanDir      string
+	fileStreamer events.Streamer
+	// uploader scans upload parts from disk and streams them through the protoStreamer.
+	eventsC  chan events.UploadEvent
+	uploader *Uploader
+	// protoStreamer streams events to upload parts in-memory (represents final audit log storage).
+	protoStreamer events.Streamer
+	memEventsC    chan events.UploadEvent
+	memUploader   *eventstest.MemoryUploader
 }
 
-func newUploaderPack(t *testing.T, wrapStreamer wrapStreamerFn) uploaderPack {
+func newUploaderPack(ctx context.Context, t *testing.T, cfg uploaderPackConfig) uploaderPack {
 	scanDir := t.TempDir()
 	corruptedDir := t.TempDir()
 
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithCancel(ctx)
+	t.Cleanup(cancel)
+
+	clock := cfg.clock
+	if clock == nil {
+		clock = clockwork.NewFakeClock()
+	}
 	pack := uploaderPack{
-		clock:            clockwork.NewFakeClock(),
+		clock:            clock,
 		eventsC:          make(chan events.UploadEvent, 100),
 		memEventsC:       make(chan events.UploadEvent, 100),
-		ctx:              ctx,
-		cancel:           cancel,
 		scanDir:          scanDir,
 		scanPeriod:       10 * time.Second,
 		initialScanDelay: 10 * time.Millisecond,
 	}
-	pack.memUploader = eventstest.NewMemoryUploader(pack.memEventsC)
 
-	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+	pack.memUploader = eventstest.NewMemoryUploader(eventstest.MemoryUploaderConfig{
+		EventsC:            pack.memEventsC,
+		MinimumUploadBytes: int(cfg.minimumUploadBytes),
+	})
+
+	var err error
+	pack.fileStreamer, err = NewStreamer(StreamerConfig{
+		Dir:            scanDir,
+		MinUploadBytes: cfg.minimumFileUploadBytes,
+		Encrypter:      cfg.encrypter,
+	})
+	require.NoError(t, err)
+
+	pack.protoStreamer, err = events.NewProtoStreamer(events.ProtoStreamerConfig{
 		Uploader:       pack.memUploader,
-		MinUploadBytes: 1024,
+		MinUploadBytes: cfg.minimumUploadBytes,
+		// Skip encrypter in proto streamer, encryption skips the proto stream flow.
 	})
 	require.NoError(t, err)
-	pack.streamer = streamer
-	if wrapStreamer != nil {
-		pack.streamer, err = wrapStreamer(pack.streamer)
+
+	if cfg.wrapProtoStreamer != nil {
+		pack.protoStreamer, err = cfg.wrapProtoStreamer(pack.protoStreamer)
 		require.NoError(t, err)
 	}
 
-	uploader, err := NewUploader(UploaderConfig{
-		ScanDir:          pack.scanDir,
-		CorruptedDir:     corruptedDir,
-		InitialScanDelay: pack.initialScanDelay,
-		ScanPeriod:       pack.scanPeriod,
-		Streamer:         pack.streamer,
-		Clock:            pack.clock,
-		EventsC:          pack.eventsC,
-	})
+	uploaderCfg := UploaderConfig{
+		ScanDir:                            pack.scanDir,
+		CorruptedDir:                       corruptedDir,
+		InitialScanDelay:                   pack.initialScanDelay,
+		ScanPeriod:                         pack.scanPeriod,
+		Streamer:                           pack.protoStreamer,
+		Clock:                              clock,
+		EventsC:                            pack.eventsC,
+		EncryptedRecordingUploader:         pack.memUploader,
+		EncryptedRecordingUploadTargetSize: cfg.encryptedRecordingUploadTargetSize,
+		EncryptedRecordingUploadMaxSize:    cfg.encryptedRecordingUploadMaxSize,
+		ConcurrentUploads:                  cfg.concurrentUploads,
+	}
+	if cfg.wrapEncryptedUploader != nil {
+		uploaderCfg.EncryptedRecordingUploader = cfg.wrapEncryptedUploader(pack.memUploader)
+	}
+
+	pack.uploader, err = NewUploader(uploaderCfg)
 	require.NoError(t, err)
-	pack.uploader = uploader
-	go pack.uploader.Serve(pack.ctx)
+
+	go pack.uploader.Serve(ctx)
+
 	return pack
 }
 
+func (p *uploaderPack) emitEvents(ctx context.Context, t *testing.T, inEvents []apievents.AuditEvent) {
+	emitStream(ctx, t, p.fileStreamer, inEvents)
+}
+
+func (p *uploaderPack) readEvents(ctx context.Context, t *testing.T, uploadID string) []apievents.AuditEvent {
+	return readStream(ctx, t, uploadID, p.memUploader)
+}
+
 type wrapStreamerFn func(streamer events.Streamer) (events.Streamer, error)
 
+type wrapEncryptedUploaderFn func(u events.EncryptedRecordingUploader) events.EncryptedRecordingUploader
+
 // runResume runs resume scenario based on the test case specification
 func runResume(t *testing.T, testCase resumeTestCase) {
 	t.Logf("Running test %q.", testCase.name)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
 
 	clock := clockwork.NewFakeClock()
 	eventsC := make(chan events.UploadEvent, 100)
-	memUploader := eventstest.NewMemoryUploader(eventsC)
+	memUploader := eventstest.NewMemoryUploader(eventstest.MemoryUploaderConfig{
+		EventsC: eventsC,
+	})
 	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
 		Uploader:       memUploader,
 		MinUploadBytes: 1024,
@@ -585,11 +1056,13 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 	require.NoError(t, err)
 	go uploader.Serve(ctx)
 	// wait until uploader blocks on the clock
-	clock.BlockUntil(1)
+	clock.BlockUntilContext(ctx, 1)
 
 	defer uploader.Close()
 
-	fileStreamer, err := NewStreamer(scanDir)
+	fileStreamer, err := NewStreamer(StreamerConfig{
+		Dir: scanDir,
+	})
 	require.NoError(t, err)
 
 	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
@@ -618,7 +1091,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 		// Block until Scan has been called two times,
 		// first time after doing the scan, and second
 		// on receiving the event to <- eventsCh
-		clock.BlockUntil(2)
+		clock.BlockUntilContext(ctx, 2)
 		clock.Advance(scanPeriod*time.Duration(i+2) + time.Second)
 
 		// wait for upload success
@@ -646,6 +1119,8 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 
 // emitStream creates and sends the session stream
 func emitStream(ctx context.Context, t *testing.T, streamer events.Streamer, inEvents []apievents.AuditEvent) {
+	t.Helper()
+
 	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
 
 	stream, err := streamer.CreateAuditStream(ctx, session.ID(sid))
@@ -658,6 +1133,12 @@ func emitStream(ctx context.Context, t *testing.T, streamer events.Streamer, inE
 	require.NoError(t, err)
 }
 
+type encryptedUploaderFn func(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error
+
+func (e encryptedUploaderFn) UploadEncryptedRecording(ctx context.Context, sessionID string, parts iter.Seq2[[]byte, error]) error {
+	return e(ctx, sessionID, parts)
+}
+
 // readStream reads and decodes the audit stream from uploadID
 func readStream(ctx context.Context, t *testing.T, uploadID string, uploader *eventstest.MemoryUploader) []apievents.AuditEvent {
 	t.Helper()
@@ -669,7 +1150,7 @@ func readStream(ctx context.Context, t *testing.T, uploadID string, uploader *ev
 	var reader *events.ProtoReader
 	for i, part := range parts {
 		if i == 0 {
-			reader = events.NewProtoReader(bytes.NewReader(part))
+			reader = events.NewProtoReader(bytes.NewReader(part), &fakeEncryptedIO{})
 		} else {
 			err := reader.Reset(bytes.NewReader(part))
 			require.NoError(t, err)
@@ -681,3 +1162,35 @@ func readStream(ctx context.Context, t *testing.T, uploadID string, uploader *ev
 	}
 	return outEvents
 }
+
+// encryptedIO is really just a reversible transform, so we fake encryption by encoding/decoding as hex
+type fakeEncryptedIO struct {
+	err error
+}
+
+type fakeEncrypter struct {
+	inner  io.WriteCloser
+	writer io.Writer
+}
+
+func (f *fakeEncrypter) Write(out []byte) (int, error) {
+	return f.writer.Write(out)
+}
+
+func (f *fakeEncrypter) Close() error {
+	return f.inner.Close()
+}
+
+func (f *fakeEncryptedIO) WithEncryption(ctx context.Context, writer io.WriteCloser) (io.WriteCloser, error) {
+	hexWriter := hex.NewEncoder(writer)
+	encrypter := &fakeEncrypter{
+		inner:  writer,
+		writer: hexWriter,
+	}
+
+	return encrypter, f.err
+}
+
+func (f *fakeEncryptedIO) WithDecryption(ctx context.Context, reader io.Reader) (io.Reader, error) {
+	return hex.NewDecoder(reader), f.err
+}
diff --git a/lib/events/filesessions/filesessionrecorder_test.go b/lib/events/filesessions/filesessionrecorder_test.go
index d3056313f71c7..3034f895c10b9 100644
--- a/lib/events/filesessions/filesessionrecorder_test.go
+++ b/lib/events/filesessions/filesessionrecorder_test.go
@@ -29,12 +29,12 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestPlainFileOpsReservations(t *testing.T) {
 	ctx := context.Background()
-	rec := NewPlainFileRecorder(utils.NewSlogLoggerForTests(), os.OpenFile)
+	rec := NewPlainFileRecorder(logtest.NewLogger(), os.OpenFile)
 	base := t.TempDir()
 	reservation := filepath.Join(base, "reservation")
 	var fileSize int64 = 512
@@ -58,7 +58,7 @@ func TestPlainFileOpsReservations(t *testing.T) {
 
 func TestPlainFileOpsCombineParts(t *testing.T) {
 	ctx := context.Background()
-	rec := NewPlainFileRecorder(utils.NewSlogLoggerForTests(), os.OpenFile)
+	rec := NewPlainFileRecorder(logtest.NewLogger(), os.OpenFile)
 	base := t.TempDir()
 	parts := []string{"part1", "part2", "part3"}
 	partPaths := make([]string, len(parts))
diff --git a/lib/events/filesessions/filestream.go b/lib/events/filesessions/filestream.go
index d58d60e054d26..3fa2514c799d4 100644
--- a/lib/events/filesessions/filestream.go
+++ b/lib/events/filesessions/filestream.go
@@ -77,15 +77,43 @@ const (
 	reservationSize = minUploadBytes + events.MaxProtoMessageSizeBytes
 )
 
+type StreamerConfig struct {
+	// Dir is the dir to stream session events to.
+	Dir string
+	// MinUploadBytes is the minimum size at which upload parts are submitted.
+	// Due to the nature of the gzip writer, each upload part maybe be marginally
+	// larger, but not smaller, than the minimum size. Defaults to 128KB.
+	MinUploadBytes int64
+	// Encrypter wraps the final gzip writer with encryption.
+	Encrypter events.EncryptionWrapper
+}
+
+// CheckAndSetDefaults checks and sets streamer defaults
+func (cfg *StreamerConfig) CheckAndSetDefaults() error {
+	if cfg.Dir == "" {
+		return trace.BadParameter("missing parameter Dir")
+	}
+	if cfg.MinUploadBytes == 0 {
+		cfg.MinUploadBytes = minUploadBytes
+	}
+	return nil
+}
+
 // NewStreamer creates a streamer sending uploads to disk
-func NewStreamer(dir string) (*events.ProtoStreamer, error) {
-	handler, err := NewHandler(Config{Directory: dir, OpenFile: GetOpenFileFunc()})
+func NewStreamer(cfg StreamerConfig) (*events.ProtoStreamer, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	handler, err := NewHandler(Config{Directory: cfg.Dir, OpenFile: GetOpenFileFunc()})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	return events.NewProtoStreamer(events.ProtoStreamerConfig{
 		Uploader:       handler,
-		MinUploadBytes: minUploadBytes,
+		MinUploadBytes: cfg.MinUploadBytes,
+		Encrypter:      cfg.Encrypter,
 	})
 }
 
@@ -142,7 +170,12 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 		return trace.Wrap(err)
 	}
 
-	uploadPath := h.path(upload.SessionID)
+	// If there are no parts to complete, move to cleanup
+	if len(parts) == 0 {
+		return h.cleanupUpload(ctx, upload)
+	}
+
+	uploadPath := h.recordingPath(upload.SessionID)
 
 	// Prevent other processes from accessing this file until the write is completed
 	f, err := GetOpenFileFunc()(uploadPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
@@ -223,6 +256,22 @@ Loop:
 	return nil
 }
 
+func (h *Handler) cleanupUpload(ctx context.Context, upload events.StreamUpload) error {
+	uploadKey := h.recordingPath(upload.SessionID)
+	log := h.logger.With(
+		"upload", upload.ID,
+		"session", upload.SessionID,
+		"key", uploadKey,
+	)
+	log.DebugContext(ctx, "Aborting upload")
+	if err := os.RemoveAll(h.uploadRootPath(upload)); err != nil {
+		h.logger.ErrorContext(ctx, "Failed to remove upload", "upload_id", upload.ID)
+	}
+
+	log.InfoContext(ctx, "Aborted upload")
+	return nil
+}
+
 // ListParts lists upload parts
 func (h *Handler) ListParts(ctx context.Context, upload events.StreamUpload) ([]events.StreamPart, error) {
 	var parts []events.StreamPart
@@ -413,6 +462,12 @@ const (
 	partExt = ".part"
 	// tarExt is a suffix for file uploads
 	tarExt = ".tar"
+	// summaryExt is a suffix for summary files
+	summaryExt = ".summary.json"
+	// metadataExt is a suffix for session metadata files
+	metadataExt = ".metadata"
+	// thumbnailExt is a suffix for session thumbnails
+	thumbnailExt = ".thumbnail"
 	// checkpointExt is a suffix for checkpoint extensions
 	checkpointExt = ".checkpoint"
 	// errorExt is a suffix for files storing session errors
diff --git a/lib/events/filesessions/filestream_test.go b/lib/events/filesessions/filestream_test.go
index fb719843d6c48..3bf7c6e6e8e86 100644
--- a/lib/events/filesessions/filestream_test.go
+++ b/lib/events/filesessions/filestream_test.go
@@ -128,14 +128,6 @@ func TestCompleteUpload(t *testing.T) {
 				createPart(t, handler, upload, int64(5), []byte("withreservation"))
 			},
 		},
-		{
-			desc:            "OnlyReservation",
-			expectedContent: []byte{},
-			partsFunc: func(t *testing.T, handler *Handler, upload *events.StreamUpload) {
-				createPart(t, handler, upload, int64(1), []byte{})
-				createPart(t, handler, upload, int64(2), []byte{})
-			},
-		},
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			handler, err := NewHandler(Config{
@@ -157,7 +149,7 @@ func TestCompleteUpload(t *testing.T) {
 			require.NoError(t, err)
 
 			// Check upload contents
-			uploadPath := handler.path(upload.SessionID)
+			uploadPath := handler.recordingPath(upload.SessionID)
 			f, err := os.Open(uploadPath)
 			require.NoError(t, err)
 
@@ -172,3 +164,48 @@ func TestCompleteUpload(t *testing.T) {
 		})
 	}
 }
+
+func TestCleanupEmptyUpload(t *testing.T) {
+	ctx := t.Context()
+
+	handler, err := NewHandler(Config{
+		Directory: t.TempDir(),
+		OpenFile:  os.OpenFile,
+	})
+	require.NoError(t, err)
+
+	sessionID := session.NewID()
+
+	// Create a completed upload.
+	upload, err := handler.CreateUpload(ctx, sessionID)
+	require.NoError(t, err)
+
+	err = handler.ReserveUploadPart(ctx, *upload, 1)
+	require.NoError(t, err)
+
+	content := []byte("hello world")
+	part, err := handler.UploadPart(ctx, *upload, 1, bytes.NewReader(content))
+	require.NoError(t, err)
+
+	err = handler.CompleteUpload(ctx, *upload, []events.StreamPart{*part})
+	require.NoError(t, err)
+
+	// Create an empty upload with the same session ID and try to complete it.
+	emptyUpload, err := handler.CreateUpload(ctx, sessionID)
+	require.NoError(t, err)
+
+	err = handler.CompleteUpload(ctx, *emptyUpload, []events.StreamPart{})
+	require.NoError(t, err)
+
+	// The empty upload should be cleaned up without impacting the original completed upload.
+	uploadPath := handler.recordingPath(upload.SessionID)
+	f, err := os.Open(uploadPath)
+	require.NoError(t, err)
+
+	gotContent, err := io.ReadAll(f)
+	require.NoError(t, err)
+	require.Equal(t, content, gotContent)
+
+	require.NoDirExists(t, handler.uploadRootPath(*upload))
+	require.NoDirExists(t, handler.uploadRootPath(*emptyUpload))
+}
diff --git a/lib/events/filesessions/fileuploader.go b/lib/events/filesessions/fileuploader.go
index 6c5c7c680a178..77cbe44a49cde 100644
--- a/lib/events/filesessions/fileuploader.go
+++ b/lib/events/filesessions/fileuploader.go
@@ -110,26 +110,60 @@ func (l *Handler) Close() error {
 	return nil
 }
 
-// Download downloads session recording from storage, in case of file handler reads the
-// file from local directory
-func (l *Handler) Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error {
-	path := l.path(sessionID)
+// Download reads a session recording from a local directory.
+func (l *Handler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return downloadFile(l.recordingPath(sessionID), writer)
+}
+
+// DownloadSummary reads a session summary from a local directory.
+func (l *Handler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return downloadFile(l.summaryPath(sessionID), writer)
+}
+
+// DownloadMetadata reads session metadata from a local directory.
+func (l *Handler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return downloadFile(l.metadataPath(sessionID), writer)
+}
+
+// DownloadThumbnail reads a session thumbnail from a local directory.
+func (l *Handler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return downloadFile(l.thumbnailPath(sessionID), writer)
+}
+
+func downloadFile(path string, writer events.RandomAccessWriter) error {
 	f, err := os.Open(path)
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
 	defer f.Close()
-	_, err = io.Copy(writer.(io.Writer), f)
+	_, err = io.Copy(writer, f)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
-// Upload uploads session recording to file storage, in case of file handler,
-// writes the file to local directory
+// Upload writes a session recording to a local directory.
 func (l *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
-	path := l.path(sessionID)
+	return uploadFile(l.recordingPath(sessionID), reader)
+}
+
+// UploadSummary writes a session summary to a local directory.
+func (l *Handler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return uploadFile(l.summaryPath(sessionID), reader)
+}
+
+// UploadMetadata writes session metadata to a local directory.
+func (l *Handler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return uploadFile(l.metadataPath(sessionID), reader)
+}
+
+// UploadThumbnail writes a session thumbnail to a local directory.
+func (l *Handler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return uploadFile(l.thumbnailPath(sessionID), reader)
+}
+
+func uploadFile(path string, reader io.Reader) (string, error) {
 	f, err := os.Create(path)
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
@@ -141,10 +175,22 @@ func (l *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Re
 	return fmt.Sprintf("%v://%v", teleport.SchemeFile, path), nil
 }
 
-func (l *Handler) path(sessionID session.ID) string {
+func (l *Handler) recordingPath(sessionID session.ID) string {
 	return filepath.Join(l.Directory, string(sessionID)+tarExt)
 }
 
+func (l *Handler) summaryPath(sessionID session.ID) string {
+	return filepath.Join(l.Directory, string(sessionID)+summaryExt)
+}
+
+func (l *Handler) metadataPath(sessionID session.ID) string {
+	return filepath.Join(l.Directory, string(sessionID)+metadataExt)
+}
+
+func (l *Handler) thumbnailPath(sessionID session.ID) string {
+	return filepath.Join(l.Directory, string(sessionID)+thumbnailExt)
+}
+
 // sessionIDFromPath extracts session ID from the filename
 func sessionIDFromPath(path string) (session.ID, error) {
 	base := filepath.Base(path)
diff --git a/lib/events/filesessions/fileuploader_test.go b/lib/events/filesessions/fileuploader_test.go
index 9f02058a9bf16..6941f6f39dbb5 100644
--- a/lib/events/filesessions/fileuploader_test.go
+++ b/lib/events/filesessions/fileuploader_test.go
@@ -29,11 +29,11 @@ import (
 
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -71,6 +71,9 @@ func TestStreams(t *testing.T) {
 	t.Run("UploadDownload", func(t *testing.T) {
 		test.UploadDownload(t, handler)
 	})
+	t.Run("UploadDownloadSummary", func(t *testing.T) {
+		test.UploadDownloadSummary(t, handler)
+	})
 	t.Run("DownloadNotFound", func(t *testing.T) {
 		test.DownloadNotFound(t, handler)
 	})
diff --git a/lib/events/firestoreevents/firestoreevents.go b/lib/events/firestoreevents/firestoreevents.go
index ed77e6b2c84fc..c3eae22ef354f 100644
--- a/lib/events/firestoreevents/firestoreevents.go
+++ b/lib/events/firestoreevents/firestoreevents.go
@@ -549,7 +549,7 @@ func (l *Log) query(
 func (l *Log) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) {
 	filter := searchEventsFilter{eventTypes: events.SessionRecordingEvents}
 	if req.Cond != nil {
-		condFn, err := utils.ToFieldsCondition(req.Cond)
+		condFn, err := utils.ToFieldsCondition(*req.Cond)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
@@ -590,6 +590,8 @@ func (l *Log) getIndexParent() string {
 
 func (l *Log) ensureIndexes(adminSvc *apiv1.FirestoreAdminClient) error {
 	tuples := firestorebk.IndexList{}
+	// each pair of indexes below are identical except for the sort direction
+	// of createdAt
 	tuples.Index(
 		firestorebk.Field(eventNamespaceDocProperty, adminpb.Index_IndexField_ASCENDING),
 		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_ASCENDING),
@@ -600,12 +602,20 @@ func (l *Log) ensureIndexes(adminSvc *apiv1.FirestoreAdminClient) error {
 		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_DESCENDING),
 		firestorebk.Field(firestore.DocumentID, adminpb.Index_IndexField_ASCENDING),
 	)
+
+	tuples.Index(
+		firestorebk.Field(eventNamespaceDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(eventTypeDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(firestore.DocumentID, adminpb.Index_IndexField_ASCENDING),
+	)
 	tuples.Index(
 		firestorebk.Field(eventNamespaceDocProperty, adminpb.Index_IndexField_ASCENDING),
 		firestorebk.Field(eventTypeDocProperty, adminpb.Index_IndexField_ASCENDING),
 		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_DESCENDING),
 		firestorebk.Field(firestore.DocumentID, adminpb.Index_IndexField_ASCENDING),
 	)
+
 	tuples.Index(
 		firestorebk.Field(eventNamespaceDocProperty, adminpb.Index_IndexField_ASCENDING),
 		firestorebk.Field(eventTypeDocProperty, adminpb.Index_IndexField_ASCENDING),
@@ -613,6 +623,14 @@ func (l *Log) ensureIndexes(adminSvc *apiv1.FirestoreAdminClient) error {
 		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_ASCENDING),
 		firestorebk.Field(firestore.DocumentID, adminpb.Index_IndexField_ASCENDING),
 	)
+	tuples.Index(
+		firestorebk.Field(eventNamespaceDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(eventTypeDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(sessionIDDocProperty, adminpb.Index_IndexField_ASCENDING),
+		firestorebk.Field(createdAtDocProperty, adminpb.Index_IndexField_DESCENDING),
+		firestorebk.Field(firestore.DocumentID, adminpb.Index_IndexField_ASCENDING),
+	)
+
 	err := firestorebk.EnsureIndexes(l.svcContext, adminSvc, l.logger, tuples, l.getIndexParent())
 	return trace.Wrap(err)
 }
diff --git a/lib/events/firestoreevents/firestoreevents_test.go b/lib/events/firestoreevents/firestoreevents_test.go
index 6b34a5cdfc0f3..ec97d79e75de0 100644
--- a/lib/events/firestoreevents/firestoreevents_test.go
+++ b/lib/events/firestoreevents/firestoreevents_test.go
@@ -31,10 +31,11 @@ import (
 
 	"github.com/gravitational/teleport/lib/events/test"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/events/gcssessions/gcshandler.go b/lib/events/gcssessions/gcshandler.go
index fb98af4e3fcb0..694ce5076938c 100644
--- a/lib/events/gcssessions/gcshandler.go
+++ b/lib/events/gcssessions/gcshandler.go
@@ -37,6 +37,7 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/session"
 )
@@ -234,10 +235,32 @@ func (h *Handler) Close() error {
 	return h.gcsClient.Close()
 }
 
-// Upload uploads object to GCS bucket, reads the contents of the object from reader
-// and returns the target GCS bucket path in case of successful upload.
+// Upload reads the content of a session recording from a reader and uploads it
+// to a GCS bucket. If successful, it returns URL of the uploaded object.
 func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
-	path := h.path(sessionID)
+	return h.uploadFile(ctx, h.recordingPath(sessionID), reader)
+}
+
+// UploadSummary reads the content of a session summary from a reader and
+// uploads it to a GCS bucket. If successful, it returns URL of the uploaded
+// object.
+func (h *Handler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.summaryPath(sessionID), reader)
+}
+
+// UploadMetadata reads the session metadata from a reader and uploads it to a GCS
+// bucket. If successful, it returns URL of the uploaded object.
+func (h *Handler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.metadataPath(sessionID), reader)
+}
+
+// UploadThumbnail reads the session thumbnail from a reader and uploads it to a GCS
+// bucket. If successful, it returns URL of the uploaded object.
+func (h *Handler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.thumbnailPath(sessionID), reader)
+}
+
+func (h *Handler) uploadFile(ctx context.Context, path string, reader io.Reader) (string, error) {
 	h.logger.DebugContext(ctx, "Uploading object to GCS", "path", path)
 
 	// Make sure we don't overwrite an existing recording.
@@ -246,7 +269,7 @@ func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Re
 		if err != nil {
 			return "", convertGCSError(err)
 		}
-		return "", trace.AlreadyExists("recording for session %q already exists in GCS", sessionID)
+		return "", trace.AlreadyExists("file %q already exists in GCS", path)
 	}
 
 	writer := h.gcsClient.Bucket(h.Config.Bucket).Object(path).NewWriter(ctx)
@@ -265,15 +288,36 @@ func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Re
 	return fmt.Sprintf("%v://%v/%v", teleport.SchemeGCS, h.Bucket, path), nil
 }
 
-// Download downloads recorded session from GCS bucket and writes the results into writer
-// return trace.NotFound error is object is not found
-func (h *Handler) Download(ctx context.Context, sessionID session.ID, writerAt io.WriterAt) error {
-	path := h.path(sessionID)
+// Download downloads a session recording from a GCS bucket and writes the
+// result into a writer. Returns trace.NotFound error if the recording is not
+// found.
+func (h *Handler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.recordingPath(sessionID), writer)
+}
+
+// DownloadSummary downloads a session summary from a GCS bucket and writes the
+// result into a writer. Returns trace.NotFound error if the recording is not
+// found.
+func (h *Handler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.summaryPath(sessionID), writer)
+}
+
+// DownloadMetadata downloads a session's metadata from a GCS bucket and writes the
+// result into a writer. Returns trace.NotFound error if the recording is not
+// found.
+func (h *Handler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.metadataPath(sessionID), writer)
+}
+
+// DownloadThumbnail downloads a session's thumbnail from a GCS bucket and writes the
+// result into a writer. Returns trace.NotFound error if the recording is not
+// found.
+func (h *Handler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.thumbnailPath(sessionID), writer)
+}
+
+func (h *Handler) downloadFile(ctx context.Context, path string, writer events.RandomAccessWriter) error {
 	h.logger.DebugContext(ctx, "Downloading object from GCS.", "path", path)
-	writer, ok := writerAt.(io.Writer)
-	if !ok {
-		return trace.BadParameter("the provided writerAt is %T which does not implement io.Writer", writerAt)
-	}
 	reader, err := h.gcsClient.Bucket(h.Config.Bucket).Object(path).NewReader(ctx)
 	if err != nil {
 		return convertGCSError(err)
@@ -287,18 +331,39 @@ func (h *Handler) Download(ctx context.Context, sessionID session.ID, writerAt i
 	downloadLatencies.Observe(time.Since(start).Seconds())
 	downloadRequests.Inc()
 	if written == 0 {
-		return trace.NotFound("recording for %v is empty", sessionID)
+		return trace.NotFound("file at path %v is empty", path)
 	}
 	return nil
 }
 
-func (h *Handler) path(sessionID session.ID) string {
+func (h *Handler) recordingPath(sessionID session.ID) string {
 	if h.Path == "" {
 		return string(sessionID) + ".tar"
 	}
 	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".tar"), slash)
 }
 
+func (h *Handler) summaryPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".summary.json"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".summary.json"), slash)
+}
+
+func (h *Handler) metadataPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".metadata"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".metadata"), slash)
+}
+
+func (h *Handler) thumbnailPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".thumbnail"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".thumbnail"), slash)
+}
+
 // ensureBucket makes sure bucket exists, and if it does not, creates it
 // this app should not have the authority to create/destroy resources
 func (h *Handler) ensureBucket() error {
diff --git a/lib/events/gcssessions/gcshandler_test.go b/lib/events/gcssessions/gcshandler_test.go
index f732ec77c48b5..47cbe702cbb71 100644
--- a/lib/events/gcssessions/gcshandler_test.go
+++ b/lib/events/gcssessions/gcshandler_test.go
@@ -29,11 +29,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -56,6 +56,9 @@ func TestFakeStreams(t *testing.T) {
 	t.Run("UploadDownload", func(t *testing.T) {
 		test.UploadDownload(t, handler)
 	})
+	t.Run("UploadDownloadSummary", func(t *testing.T) {
+		test.UploadDownloadSummary(t, handler)
+	})
 	t.Run("DownloadNotFound", func(t *testing.T) {
 		test.DownloadNotFound(t, handler)
 	})
diff --git a/lib/events/gcssessions/gcsstream.go b/lib/events/gcssessions/gcsstream.go
index 8e1d47bbbeb5f..feb459eb6518a 100644
--- a/lib/events/gcssessions/gcsstream.go
+++ b/lib/events/gcssessions/gcsstream.go
@@ -109,7 +109,7 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 	}
 
 	// If the session has been already created, move to cleanup
-	sessionPath := h.path(upload.SessionID)
+	sessionPath := h.recordingPath(upload.SessionID)
 	_, err := h.gcsClient.Bucket(h.Config.Bucket).Object(sessionPath).Attrs(ctx)
 	if !errors.Is(err, storage.ErrObjectNotExist) {
 		if err != nil {
@@ -285,7 +285,7 @@ func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error
 // GetUploadMetadata gets the metadata for session upload
 func (h *Handler) GetUploadMetadata(s session.ID) events.UploadMetadata {
 	return events.UploadMetadata{
-		URL:       fmt.Sprintf("%v://%v/%v", teleport.SchemeGCS, h.path(s), string(s)),
+		URL:       fmt.Sprintf("%v://%v/%v", teleport.SchemeGCS, h.recordingPath(s), string(s)),
 		SessionID: s,
 	}
 }
diff --git a/lib/events/memsessions/memstream_test.go b/lib/events/memsessions/memstream_test.go
index 15215021a6190..32d45b57bdf25 100644
--- a/lib/events/memsessions/memstream_test.go
+++ b/lib/events/memsessions/memstream_test.go
@@ -24,11 +24,11 @@ import (
 
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/events/pgevents/pgevents.go b/lib/events/pgevents/pgevents.go
index 0d30995927154..5aa6fbbd154fc 100644
--- a/lib/events/pgevents/pgevents.go
+++ b/lib/events/pgevents/pgevents.go
@@ -410,7 +410,7 @@ func (l *Log) EmitAuditEvent(ctx context.Context, event apievents.AuditEvent) er
 func (l *Log) searchEvents(
 	ctx context.Context,
 	fromTime, toTime time.Time,
-	eventTypes []string, cond *types.WhereExpr, sessionID string,
+	eventTypes []string, cond *utils.ToFieldsConditionConfig, sessionID string,
 	limit int, order types.EventOrder, startKey string,
 ) ([]apievents.AuditEvent, string, error) {
 	if limit <= 0 {
@@ -433,7 +433,7 @@ func (l *Log) searchEvents(
 	var condFn utils.FieldsCondition
 	if cond != nil {
 		var err error
-		condFn, err = utils.ToFieldsCondition(cond)
+		condFn, err = utils.ToFieldsCondition(*cond)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
@@ -572,7 +572,7 @@ func (l *Log) searchEvents(
 
 // SearchEvents implements [events.AuditLogger].
 func (l *Log) SearchEvents(ctx context.Context, req events.SearchEventsRequest) ([]apievents.AuditEvent, string, error) {
-	var emptyCond *types.WhereExpr
+	var emptyCond *utils.ToFieldsConditionConfig
 	const emptySessionID = ""
 	return l.searchEvents(ctx, req.From, req.To, req.EventTypes, emptyCond, emptySessionID, req.Limit, req.Order, req.StartKey)
 }
diff --git a/lib/events/pgevents/pgevents_test.go b/lib/events/pgevents/pgevents_test.go
index 8aeb66ee5ca7e..a9efab843c530 100644
--- a/lib/events/pgevents/pgevents_test.go
+++ b/lib/events/pgevents/pgevents_test.go
@@ -37,11 +37,11 @@ import (
 	pgcommon "github.com/gravitational/teleport/lib/backend/pgbk/common"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/test"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -226,7 +226,7 @@ func TestConfig(t *testing.T) {
 }
 
 func TestBuildSchema(t *testing.T) {
-	testLog := utils.NewSlogLoggerForTests()
+	testLog := logtest.NewLogger()
 
 	testConfig := &Config{
 		Log: testLog,
diff --git a/lib/events/playback.go b/lib/events/playback.go
index ef7bea65d93f4..ed785cc4732db 100644
--- a/lib/events/playback.go
+++ b/lib/events/playback.go
@@ -53,7 +53,7 @@ func DetectFormat(r io.ReadSeeker) (*Header, error) {
 		return nil, trace.ConvertSystemError(err)
 	}
 	protocolVersion := binary.BigEndian.Uint64(version)
-	if protocolVersion == ProtoStreamV1 {
+	if protocolVersion >= ProtoStreamV1 && protocolVersion <= ProtoStreamV2 {
 		return &Header{
 			Proto:        true,
 			ProtoVersion: int64(protocolVersion),
@@ -83,7 +83,7 @@ func Export(ctx context.Context, rs io.ReadSeeker, w io.Writer, exportFormat str
 	}
 	switch {
 	case format.Proto:
-		protoReader := NewProtoReader(rs)
+		protoReader := NewProtoReader(rs, nil)
 		for {
 			event, err := protoReader.Read(ctx)
 			if err != nil {
diff --git a/lib/events/recorder/recorder.go b/lib/events/recorder/recorder.go
index 3559df2175b20..4d8a221958c21 100644
--- a/lib/events/recorder/recorder.go
+++ b/lib/events/recorder/recorder.go
@@ -29,6 +29,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/filesessions"
 	"github.com/gravitational/teleport/lib/services"
@@ -91,6 +92,9 @@ type Config struct {
 	// StartTime represents the time the recorder started. If not zero, this
 	// value is used to generate the events index.
 	StartTime time.Time
+
+	// Encrypter wraps the final gzip writer with encryption.
+	Encrypter events.EncryptionWrapper
 }
 
 // New returns a [events.SessionPreparerRecorder]. If session recording is disabled,
@@ -132,7 +136,13 @@ func New(cfg Config) (events.SessionPreparerRecorder, error) {
 			cfg.DataDir, teleport.LogsDir, teleport.ComponentUpload,
 			events.StreamingSessionsDir, cfg.Namespace,
 		)
-		fileStreamer, err := filesessions.NewStreamer(uploadDir)
+		if cfg.Encrypter == nil {
+			cfg.Encrypter = recordingencryption.NewEncryptionWrapper(cfg.RecordingCfg)
+		}
+		fileStreamer, err := filesessions.NewStreamer(filesessions.StreamerConfig{
+			Dir:       uploadDir,
+			Encrypter: cfg.Encrypter,
+		})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/events/s3sessions/s3client.go b/lib/events/s3sessions/s3client.go
new file mode 100644
index 0000000000000..b9edcd204d660
--- /dev/null
+++ b/lib/events/s3sessions/s3client.go
@@ -0,0 +1,41 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package s3sessions
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+)
+
+type s3Client interface {
+	DeleteBucket(ctx context.Context, params *s3.DeleteBucketInput, optFns ...func(*s3.Options)) (*s3.DeleteBucketOutput, error)
+	HeadBucket(ctx context.Context, params *s3.HeadBucketInput, optFns ...func(*s3.Options)) (*s3.HeadBucketOutput, error)
+	DeleteObject(ctx context.Context, params *s3.DeleteObjectInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectOutput, error)
+	PutBucketEncryption(ctx context.Context, params *s3.PutBucketEncryptionInput, optFns ...func(*s3.Options)) (*s3.PutBucketEncryptionOutput, error)
+	CreateBucket(ctx context.Context, params *s3.CreateBucketInput, optFns ...func(*s3.Options)) (*s3.CreateBucketOutput, error)
+	PutBucketVersioning(ctx context.Context, params *s3.PutBucketVersioningInput, optFns ...func(*s3.Options)) (*s3.PutBucketVersioningOutput, error)
+	ListObjectVersions(ctx context.Context, params *s3.ListObjectVersionsInput, optFns ...func(*s3.Options)) (*s3.ListObjectVersionsOutput, error)
+	CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error)
+	AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error)
+	CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error)
+	ListParts(ctx context.Context, params *s3.ListPartsInput, optFns ...func(*s3.Options)) (*s3.ListPartsOutput, error)
+	ListMultipartUploads(ctx context.Context, params *s3.ListMultipartUploadsInput, optFns ...func(*s3.Options)) (*s3.ListMultipartUploadsOutput, error)
+	UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error)
+}
diff --git a/lib/events/s3sessions/s3handler.go b/lib/events/s3sessions/s3handler.go
index 8feb746ea33d9..6f9a00a1ac1f1 100644
--- a/lib/events/s3sessions/s3handler.go
+++ b/lib/events/s3sessions/s3handler.go
@@ -88,7 +88,7 @@ type Config struct {
 	// SSEKMSKey specifies the optional custom CMK used for KMS SSE.
 	SSEKMSKey string
 
-	// UseFIPSEndpoint uses AWS FedRAMP/FIPS 140-2 mode endpoints.
+	// UseFIPSEndpoint uses AWS FedRAMP/FIPS mode endpoints.
 	// to determine its behavior:
 	// Unset - allows environment variables or AWS config to set the value
 	// Enabled - explicitly enabled
@@ -311,7 +311,7 @@ type Handler struct {
 	logger     *slog.Logger
 	uploader   *manager.Uploader
 	downloader *manager.Downloader
-	client     *s3.Client
+	client     s3Client
 }
 
 // Close releases connection and resources associated with log if any
@@ -319,11 +319,34 @@ func (h *Handler) Close() error {
 	return nil
 }
 
-// Upload uploads object to S3 bucket, reads the contents of the object from reader
-// and returns the target S3 bucket path in case of successful upload.
+// Upload reads the content of a session recording from a reader and uploads it
+// to an S3 bucket. If successful, it returns URL of the uploaded object.
 func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
-	path := h.path(sessionID)
+	return h.uploadFile(ctx, h.recordingPath(sessionID), reader)
+}
+
+// UploadSummary reads the content of a session summary from a reader and
+// uploads it to an S3 bucket. If successful, it returns URL of the uploaded
+// object.
+func (h *Handler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.summaryPath(sessionID), reader)
+}
+
+// UploadMetadata reads the content of a session's metadata from a reader and
+// uploads it to an S3 bucket. If successful, it returns URL of the uploaded
+// object.
+func (h *Handler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.metadataPath(sessionID), reader)
+}
+
+// UploadThumbnail reads the content of a session's thumbnail from a reader and
+// uploads it to an S3 bucket. If successful, it returns URL of the uploaded
+// object.
+func (h *Handler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return h.uploadFile(ctx, h.thumbnailPath(sessionID), reader)
+}
 
+func (h *Handler) uploadFile(ctx context.Context, path string, reader io.Reader) (string, error) {
 	uploadInput := &s3.PutObjectInput{
 		Bucket: aws.String(h.Bucket),
 		Key:    aws.String(path),
@@ -345,22 +368,48 @@ func (h *Handler) Upload(ctx context.Context, sessionID session.ID, reader io.Re
 	return fmt.Sprintf("%v://%v/%v", teleport.SchemeS3, h.Bucket, path), nil
 }
 
-// Download downloads recorded session from S3 bucket and writes the results
-// into writer return trace.NotFound error is object is not found.
-func (h *Handler) Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error {
+// Download downloads a session recording from an S3 bucket and writes the
+// result into a writer. Returns trace.NotFound error if the recording is not
+// found.
+func (h *Handler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.recordingPath(sessionID), writer)
+}
+
+// DownloadSummary downloads a session summary from an S3 bucket and writes the
+// results into a writer. Returns trace.NotFound error if the summary is not
+// found.
+func (h *Handler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.summaryPath(sessionID), writer)
+}
+
+// DownloadMetadata downloads a session's metadata from an S3 bucket and writes the
+// results into a writer. Returns trace.NotFound error if the metadata is not
+// found.
+func (h *Handler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.metadataPath(sessionID), writer)
+}
+
+// DownloadThumbnail downloads a session's thumbnail from an S3 bucket and writes the
+// results into a writer. Returns trace.NotFound error if the thumbnail is not
+// found.
+func (h *Handler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.downloadFile(ctx, h.thumbnailPath(sessionID), writer)
+}
+
+func (h *Handler) downloadFile(ctx context.Context, path string, writer events.RandomAccessWriter) error {
 	// Get the oldest version of this object. This has to be done because S3
 	// allows overwriting objects in a bucket. To prevent corruption of recording
 	// data, get all versions and always return the first.
-	versionID, err := h.getOldestVersion(ctx, h.Bucket, h.path(sessionID))
+	versionID, err := h.getOldestVersion(ctx, h.Bucket, path)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	h.logger.DebugContext(ctx, "Downloading recording from S3", "bucket", h.Bucket, "path", h.path(sessionID), "version_id", versionID)
+	h.logger.DebugContext(ctx, "Downloading file from S3", "bucket", h.Bucket, "path", path, "version_id", versionID)
 
 	_, err = h.downloader.Download(ctx, writer, &s3.GetObjectInput{
 		Bucket:    aws.String(h.Bucket),
-		Key:       aws.String(h.path(sessionID)),
+		Key:       aws.String(path),
 		VersionId: aws.String(versionID),
 	})
 	if err != nil {
@@ -441,13 +490,34 @@ func (h *Handler) deleteBucket(ctx context.Context) error {
 	return awsutils.ConvertS3Error(err)
 }
 
-func (h *Handler) path(sessionID session.ID) string {
+func (h *Handler) recordingPath(sessionID session.ID) string {
 	if h.Path == "" {
 		return string(sessionID) + ".tar"
 	}
 	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".tar"), "/")
 }
 
+func (h *Handler) summaryPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".summary.json"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".summary.json"), "/")
+}
+
+func (h *Handler) metadataPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".metadata"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".metadata"), "/")
+}
+
+func (h *Handler) thumbnailPath(sessionID session.ID) string {
+	if h.Path == "" {
+		return string(sessionID) + ".thumbnail"
+	}
+	return strings.TrimPrefix(path.Join(h.Path, string(sessionID)+".thumbnail"), "/")
+}
+
 func (h *Handler) fromPath(p string) session.ID {
 	return session.ID(strings.TrimSuffix(path.Base(p), ".tar"))
 }
@@ -474,8 +544,9 @@ func (h *Handler) ensureBucket(ctx context.Context) error {
 	}
 
 	input := &s3.CreateBucketInput{
-		Bucket: aws.String(h.Bucket),
-		ACL:    awstypes.BucketCannedACLPrivate,
+		Bucket:                    aws.String(h.Bucket),
+		ACL:                       awstypes.BucketCannedACLPrivate,
+		CreateBucketConfiguration: awsutils.CreateBucketConfiguration(h.Region),
 	}
 	_, err = h.client.CreateBucket(ctx, input)
 	if err := awsutils.ConvertS3Error(err); err != nil {
diff --git a/lib/events/s3sessions/s3handler_config_test.go b/lib/events/s3sessions/s3handler_config_test.go
index 05aa791ff5fb7..f11c3c2a4d379 100644
--- a/lib/events/s3sessions/s3handler_config_test.go
+++ b/lib/events/s3sessions/s3handler_config_test.go
@@ -33,12 +33,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -205,7 +205,7 @@ func TestEndpoints(t *testing.T) {
 			fips := types.ClusterAuditConfigSpecV2_FIPS_DISABLED
 			if tt.fips {
 				fips = types.ClusterAuditConfigSpecV2_FIPS_ENABLED
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					FIPS: true,
 				})
 			}
diff --git a/lib/events/s3sessions/s3handler_test.go b/lib/events/s3sessions/s3handler_test.go
index 49f98f9cf3835..b8333a73ead50 100644
--- a/lib/events/s3sessions/s3handler_test.go
+++ b/lib/events/s3sessions/s3handler_test.go
@@ -26,6 +26,9 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/events/test"
@@ -49,6 +52,9 @@ func TestStreams(t *testing.T) {
 	t.Run("UploadDownload", func(t *testing.T) {
 		test.UploadDownload(t, handler)
 	})
+	t.Run("UploadDownloadSummary", func(t *testing.T) {
+		test.UploadDownloadSummary(t, handler)
+	})
 	t.Run("DownloadNotFound", func(t *testing.T) {
 		test.DownloadNotFound(t, handler)
 	})
@@ -79,3 +85,53 @@ func TestACL(t *testing.T) {
 		})
 	}
 }
+
+type mockS3Client struct {
+	mock.Mock
+	s3Client
+}
+
+func (m *mockS3Client) HeadBucket(ctx context.Context, params *s3.HeadBucketInput, optFns ...func(*s3.Options)) (*s3.HeadBucketOutput, error) {
+	args := m.Called(ctx, params, optFns)
+	return args.Get(0).(*s3.HeadBucketOutput), args.Error(1)
+}
+
+func (m *mockS3Client) CreateBucket(ctx context.Context, params *s3.CreateBucketInput, optFns ...func(*s3.Options)) (*s3.CreateBucketOutput, error) {
+	args := m.Called(ctx, params, optFns)
+	return args.Get(0).(*s3.CreateBucketOutput), args.Error(1)
+}
+
+func (m *mockS3Client) PutBucketVersioning(ctx context.Context, params *s3.PutBucketVersioningInput, optFns ...func(*s3.Options)) (*s3.PutBucketVersioningOutput, error) {
+	args := m.Called(ctx, params, optFns)
+	return args.Get(0).(*s3.PutBucketVersioningOutput), args.Error(1)
+}
+func (m *mockS3Client) PutBucketEncryption(ctx context.Context, params *s3.PutBucketEncryptionInput, optFns ...func(*s3.Options)) (*s3.PutBucketEncryptionOutput, error) {
+	args := m.Called(ctx, params, optFns)
+	return args.Get(0).(*s3.PutBucketEncryptionOutput), args.Error(1)
+}
+func TestEnsureBucket(t *testing.T) {
+	mockClient := &mockS3Client{}
+	var gotRegion s3types.BucketLocationConstraint
+	mockClient.On("HeadBucket", mock.Anything, mock.Anything, mock.Anything).
+		Return((*s3.HeadBucketOutput)(nil), (error)(&s3types.NoSuchBucket{}))
+	mockClient.On("CreateBucket", mock.Anything, mock.Anything, mock.Anything).
+		Return((*s3.CreateBucketOutput)(nil), (error)(nil)).Run(func(args mock.Arguments) {
+		createBucket := args.Get(1).(*s3.CreateBucketInput)
+		gotRegion = createBucket.CreateBucketConfiguration.LocationConstraint
+	})
+	mockClient.On("PutBucketVersioning", mock.Anything, mock.Anything, mock.Anything).
+		Return((*s3.PutBucketVersioningOutput)(nil), (error)(nil))
+	mockClient.On("PutBucketEncryption", mock.Anything, mock.Anything, mock.Anything).
+		Return((*s3.PutBucketEncryptionOutput)(nil), (error)(nil))
+
+	handler := &Handler{
+		Config: Config{
+			Region: "us-east-2",
+		},
+		client: mockClient,
+	}
+	err := handler.ensureBucket(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, s3types.BucketLocationConstraintUsEast2, gotRegion)
+
+}
diff --git a/lib/events/s3sessions/s3stream.go b/lib/events/s3sessions/s3stream.go
index 4085c41d16677..0b3bcd59cfa1a 100644
--- a/lib/events/s3sessions/s3stream.go
+++ b/lib/events/s3sessions/s3stream.go
@@ -48,7 +48,7 @@ func (h *Handler) CreateUpload(ctx context.Context, sessionID session.ID) (*even
 
 	input := &s3.CreateMultipartUploadInput{
 		Bucket: aws.String(h.Bucket),
-		Key:    aws.String(h.path(sessionID)),
+		Key:    aws.String(h.recordingPath(sessionID)),
 	}
 	if !h.Config.DisableServerSideEncryption {
 		input.ServerSideEncryption = types.ServerSideEncryptionAwsKms
@@ -85,7 +85,7 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 	}
 
 	start := time.Now()
-	uploadKey := h.path(upload.SessionID)
+	uploadKey := h.recordingPath(upload.SessionID)
 	log := h.logger.With(
 		"upload", upload.ID,
 		"session", upload.SessionID,
@@ -135,7 +135,7 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 }
 
 func (h *Handler) abortUpload(ctx context.Context, upload events.StreamUpload) error {
-	uploadKey := h.path(upload.SessionID)
+	uploadKey := h.recordingPath(upload.SessionID)
 	log := h.logger.With(
 		"upload", upload.ID,
 		"session", upload.SessionID,
@@ -171,7 +171,7 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 	}
 
 	start := time.Now()
-	uploadKey := h.path(upload.SessionID)
+	uploadKey := h.recordingPath(upload.SessionID)
 	log := h.logger.With(
 		"upload", upload.ID,
 		"session", upload.SessionID,
@@ -210,7 +210,7 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 
 // ListParts lists upload parts
 func (h *Handler) ListParts(ctx context.Context, upload events.StreamUpload) ([]events.StreamPart, error) {
-	uploadKey := h.path(upload.SessionID)
+	uploadKey := h.recordingPath(upload.SessionID)
 	log := h.logger.With(
 		"upload", upload.ID,
 		"session", upload.SessionID,
diff --git a/lib/events/session_writer_test.go b/lib/events/session_writer_test.go
index c8345731352b8..bf06dad808206 100644
--- a/lib/events/session_writer_test.go
+++ b/lib/events/session_writer_test.go
@@ -74,7 +74,7 @@ func TestSessionWriter(t *testing.T) {
 		require.NoError(t, err)
 
 		for _, part := range parts {
-			reader := events.NewProtoReader(bytes.NewReader(part))
+			reader := events.NewProtoReader(bytes.NewReader(part), nil)
 			out, err := reader.ReadAll(test.ctx)
 			require.NoError(t, err, "part crash %#v", part)
 			outEvents = append(outEvents, out...)
@@ -352,7 +352,9 @@ func withBackoff(timeout, dur time.Duration) sessionWriterOption {
 
 func newSessionWriterTest(t *testing.T, newStreamer newStreamerFn, opts ...sessionWriterOption) *sessionWriterTest {
 	eventsCh := make(chan events.UploadEvent, 1)
-	uploader := eventstest.NewMemoryUploader(eventsCh)
+	uploader := eventstest.NewMemoryUploader(eventstest.MemoryUploaderConfig{
+		EventsC: eventsCh,
+	})
 	protoStreamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
 		Uploader: uploader,
 	})
@@ -420,7 +422,7 @@ func (a *sessionWriterTest) collectEvents(t *testing.T) []apievents.AuditEvent {
 	for _, part := range parts {
 		readers = append(readers, bytes.NewReader(part))
 	}
-	reader := events.NewProtoReader(io.MultiReader(readers...))
+	reader := events.NewProtoReader(io.MultiReader(readers...), nil)
 	outEvents, err := reader.ReadAll(a.ctx)
 	require.NoError(t, err, "failed to read")
 	t.Logf("Reader stats :%v", reader.GetStats().ToFields())
diff --git a/lib/events/sessionend.go b/lib/events/sessionend.go
new file mode 100644
index 0000000000000..f8533dd6798e6
--- /dev/null
+++ b/lib/events/sessionend.go
@@ -0,0 +1,75 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package events
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// FindSessionEndEvent streams session events to find the session end event for the given session ID.
+// It returns:
+// - SessionEnd
+// - DatabaseSessionEnd
+// - WindowsDesktopSessionEnd
+// - AppSessionEnd
+// - MCPSessionEnd,
+// or nil if none is found.
+// TODO(tigrato): Revisit this approach for large sessions, as it's highly inefficient.
+// Instead, consider downloading the last few parts of the recording to find the session end event
+// instead of streaming all events.
+func FindSessionEndEvent(ctx context.Context, streamer SessionStreamer, sessionID session.ID) (apievents.AuditEvent, error) {
+	switch {
+	case streamer == nil:
+		return nil, trace.BadParameter("session streamer is required")
+	case sessionID == "":
+		return nil, trace.BadParameter("session ID is required")
+	}
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	eventsCh, errCh := streamer.StreamSessionEvents(ctx, sessionID, 0)
+	for {
+		select {
+		case event, ok := <-eventsCh:
+			if !ok {
+				return nil, trace.NotFound("session end event not found")
+			}
+			switch e := event.(type) {
+			case *apievents.WindowsDesktopSessionEnd:
+				return e, nil
+			case *apievents.SessionEnd:
+				return e, nil
+			case *apievents.DatabaseSessionEnd:
+				return e, nil
+			case *apievents.AppSessionEnd:
+				return e, nil
+			case *apievents.MCPSessionEnd:
+				return e, nil
+			}
+		case err := <-errCh:
+			return nil, trace.Wrap(err)
+		case <-ctx.Done():
+			return nil, trace.Wrap(ctx.Err())
+		}
+	}
+}
diff --git a/lib/events/sessionend_test.go b/lib/events/sessionend_test.go
new file mode 100644
index 0000000000000..f83de86f2e04f
--- /dev/null
+++ b/lib/events/sessionend_test.go
@@ -0,0 +1,131 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package events_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestFindSessionEndEvent(t *testing.T) {
+	uploader := eventstest.NewMemoryUploader()
+	alog, err := events.NewAuditLog(events.AuditLogConfig{
+		DataDir:       t.TempDir(),
+		ServerID:      "server1",
+		UploadHandler: uploader,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { alog.Close() })
+
+	sshSessionID := session.NewID()
+	sshSessionEvents := eventstest.GenerateTestSession(eventstest.SessionParams{
+		PrintEvents: 1000,
+		UserName:    "bob",
+		SessionID:   string(sshSessionID),
+		ServerID:    "testcluster",
+		PrintData:   []string{"ls", "whoami"},
+	})
+
+	kubernetesSessionID := session.NewID()
+	kubernetesSessionEvents := eventstest.GenerateTestKubeSession(eventstest.SessionParams{
+		UserName:    "carol",
+		SessionID:   string(kubernetesSessionID),
+		ServerID:    "testcluster",
+		PrintData:   []string{"get pods", "describe pod"},
+		PrintEvents: 1000,
+	})
+
+	databaseSessionID := session.NewID()
+	databaseSessionEvents := eventstest.GenerateTestDBSession(eventstest.DBSessionParams{
+		UserName:  "dave",
+		SessionID: string(databaseSessionID),
+		ServerID:  "testcluster",
+		Queries:   1000,
+	})
+
+	tests := []struct {
+		name        string // description of this test case
+		sessionID   session.ID
+		auditEvents []apievents.AuditEvent
+		want        apievents.AuditEvent
+		assertErr   require.ErrorAssertionFunc
+	}{
+		{
+			name:        "SSH session with SessionEnd event",
+			sessionID:   sshSessionID,
+			auditEvents: sshSessionEvents,
+			want:        sshSessionEvents[len(sshSessionEvents)-1],
+			assertErr:   require.NoError,
+		},
+		{
+			name:        "Kubernetes session with KubeSessionEnd event",
+			sessionID:   kubernetesSessionID,
+			auditEvents: kubernetesSessionEvents,
+			want:        kubernetesSessionEvents[len(kubernetesSessionEvents)-1],
+			assertErr:   require.NoError,
+		},
+		{
+			name:        "Database session with DBSessionEnd event",
+			sessionID:   databaseSessionID,
+			auditEvents: databaseSessionEvents,
+			want:        databaseSessionEvents[len(databaseSessionEvents)-1],
+			assertErr:   require.NoError,
+		},
+		{
+			name:        "No session end event",
+			sessionID:   session.NewID(),
+			auditEvents: eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 10})[:9],
+			assertErr:   require.Error,
+		},
+		{
+			name:      "missing session ID",
+			sessionID: session.NewID(),
+			want:      nil,
+			assertErr: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if len(tt.auditEvents) > 0 {
+				streamer, err := events.NewProtoStreamer(
+					events.ProtoStreamerConfig{
+						Uploader: uploader,
+					},
+				)
+				require.NoError(t, err)
+
+				stream, err := streamer.CreateAuditStream(t.Context(), tt.sessionID)
+				require.NoError(t, err)
+				for _, event := range tt.auditEvents {
+					require.NoError(t, stream.RecordEvent(t.Context(), eventstest.PrepareEvent(event)))
+				}
+				require.NoError(t, stream.Complete(t.Context()))
+			}
+			got, gotErr := events.FindSessionEndEvent(t.Context(), alog, tt.sessionID)
+			tt.assertErr(t, gotErr)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/lib/events/sessionpostprocessing/postprocessing.go b/lib/events/sessionpostprocessing/postprocessing.go
new file mode 100644
index 0000000000000..e7f2e3cd0d1d5
--- /dev/null
+++ b/lib/events/sessionpostprocessing/postprocessing.go
@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package sessionpostprocessing
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+// Config is the configuration for the session post-processor.
+type Config struct {
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	RecordingMetadataProvider *recordingmetadata.Provider
+	// SessionEnd is the session end event to process.
+	SessionEnd apievents.AuditEvent
+	// SessionID is the ID of the session being processed.
+	SessionID session.ID
+}
+
+// Process processes session end events after the session recording upload is complete.
+// It summarizes the session recording and processes the recording metadata.
+func Process(ctx context.Context, cfg Config) error {
+	switch {
+	case cfg.SessionSummarizerProvider == nil:
+		return trace.BadParameter("session summarizer provider is not set")
+	case cfg.RecordingMetadataProvider == nil:
+		return trace.BadParameter("recording metadata provider is not set")
+	case cfg.SessionEnd == nil:
+		return trace.BadParameter("session end event is not set")
+	case cfg.SessionID == "":
+		return trace.BadParameter("session ID is not set")
+	}
+
+	var summarizerErr error
+	var metadataErr error
+	summarizer := cfg.SessionSummarizerProvider.SessionSummarizer()
+	switch o := cfg.SessionEnd.(type) {
+	case *apievents.SessionEnd:
+		if err := summarizer.SummarizeSSH(ctx, o); err != nil {
+			summarizerErr = trace.Wrap(err, "failed to summarize upload")
+		}
+		metadataSvc := cfg.RecordingMetadataProvider.Service()
+		if !o.EndTime.IsZero() && !o.StartTime.IsZero() {
+			duration := o.EndTime.Sub(o.StartTime)
+			if err := metadataSvc.ProcessSessionRecording(ctx, cfg.SessionID, duration); err != nil {
+				metadataErr = trace.Wrap(err, "failed to process session recording metadata")
+			}
+		}
+	case *apievents.DatabaseSessionEnd:
+		if err := summarizer.SummarizeDatabase(ctx, o); err != nil {
+			summarizerErr = trace.Wrap(err, "failed to summarize upload")
+		}
+	}
+	return trace.NewAggregate(summarizerErr, metadataErr)
+}
diff --git a/lib/events/sessionpostprocessing/postprocessing_test.go b/lib/events/sessionpostprocessing/postprocessing_test.go
new file mode 100644
index 0000000000000..16dcfa5de5385
--- /dev/null
+++ b/lib/events/sessionpostprocessing/postprocessing_test.go
@@ -0,0 +1,107 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package sessionpostprocessing_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/events/sessionpostprocessing"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestSessionPostProcessor(t *testing.T) {
+	sessionID := session.ID(uuid.NewString())
+
+	metadataProvider := recordingmetadata.NewProvider()
+	recorderMetadata := &fakeRecordingMetadata{}
+	recorderMetadata.On(
+		"ProcessSessionRecording",
+		mock.Anything,
+		sessionID,
+		mock.Anything,
+	).
+		Return(nil).Once()
+	metadataProvider.SetService(recorderMetadata)
+
+	summarizerProvider := summarizer.NewSessionSummarizerProvider()
+	sessionSummarizer := &fakeSummarizer{}
+	sessionSummarizer.On(
+		"SummarizeSSH",
+		mock.Anything,
+		mock.Anything,
+	).Return(nil).Once()
+	summarizerProvider.SetSummarizer(sessionSummarizer)
+
+	events := eventstest.GenerateTestSession(eventstest.SessionParams{
+		UserName:  "alice",
+		SessionID: string(sessionID),
+		ServerID:  "testcluster",
+		PrintData: []string{"net", "stat"},
+	})
+
+	cfg := sessionpostprocessing.Config{
+		SessionEnd:                events[len(events)-1],
+		RecordingMetadataProvider: metadataProvider,
+		SessionSummarizerProvider: summarizerProvider,
+		SessionID:                 sessionID,
+	}
+
+	err := sessionpostprocessing.Process(t.Context(), cfg)
+	require.NoError(t, err)
+
+	recorderMetadata.AssertExpectations(t)
+	sessionSummarizer.AssertExpectations(t)
+}
+
+type fakeRecordingMetadata struct {
+	mock.Mock
+}
+
+func (f *fakeRecordingMetadata) ProcessSessionRecording(ctx context.Context, sessionID session.ID, duration time.Duration) error {
+	args := f.Called(ctx, sessionID, duration)
+	return args.Error(0)
+}
+
+type fakeSummarizer struct {
+	mock.Mock
+}
+
+func (f *fakeSummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *apievents.SessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *apievents.DatabaseSessionEnd) error {
+	args := f.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (f *fakeSummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	args := f.Called(ctx, sessionID)
+	return args.Error(0)
+}
diff --git a/lib/events/stream.go b/lib/events/stream.go
index 5792bc5ad9f37..6333a5f0ad3a2 100644
--- a/lib/events/stream.go
+++ b/lib/events/stream.go
@@ -36,11 +36,24 @@ import (
 
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
+// ProtoStreamFlag is a bit flag containing options that were used to record the stream, such as whether or not the
+// stream was encrypted. It appears in the header of v2+ proto streams and should be used to construct the correct
+// ProtoReader configuration.
+type ProtoStreamFlag = uint8
+
+const (
+	// ProtoStreamFlagEncrypted flags whether or not a stream was encrypted during recording.
+	ProtoStreamFlagEncrypted = 1 << iota
+)
+
 const (
 	// Int32Size is a constant for 32 bit integer byte size
 	Int32Size = 4
@@ -55,13 +68,22 @@ const (
 	// MaxProtoMessageSizeBytes is maximum protobuf marshaled message size
 	MaxProtoMessageSizeBytes = 64 * 1024
 
-	// MinUploadPartSizeBytes is the minimum allowed part size when uploading a part to
-	// Amazon S3.
+	// MinUploadPartSizeBytes is the minimum upload part size when uploading session recordings
+	// through a [MultipartUploader]. All uploaded parts are expected to meet this minimum size.
+	// The actual minimum enforced by th external audit storage depends on the provider:
+	// - S3 (AWS):    5MiB
+	// - GCloud:      5MiB
+	// - Azure:       None
+	// - File:        None
+	// - Mem (tests): Configurable
 	MinUploadPartSizeBytes = 1024 * 1024 * 5
 
 	// ProtoStreamV1 is a version of the binary protocol
 	ProtoStreamV1 = 1
 
+	// ProtoStreamV2 is a version of the binary protocol
+	ProtoStreamV2 = 2
+
 	// ProtoStreamV1PartHeaderSize is the size of the part of the protocol stream
 	// on disk format, it consists of
 	// * 8 bytes for the format version
@@ -69,6 +91,14 @@ const (
 	// * 8 bytes for optional padding size at the end of the slice
 	ProtoStreamV1PartHeaderSize = Int64Size * 3
 
+	// ProtoStreamV2PartHeaderSize is the size of the part of the protocol stream
+	// on disk format, it consists of
+	// * 8 bytes for the format version
+	// * 8 bytes for meaningful size of the part
+	// * 8 bytes for optional padding size at the end of the slice
+	// * 8 bytes for 1 byte flags and 7 bytes of zero padding reserved for future
+	ProtoStreamV2PartHeaderSize = Int64Size * 4
+
 	// ProtoStreamV1RecordHeaderSize is the size of the header
 	// of the record header, it consists of the record length
 	ProtoStreamV1RecordHeaderSize = Int32Size
@@ -78,6 +108,16 @@ const (
 	uploaderReservePartErrorMessage = "uploader failed to reserve upload part"
 )
 
+// An EncryptionWrapper wraps a given io.WriteCloser with encryption.
+type EncryptionWrapper interface {
+	WithEncryption(context.Context, io.WriteCloser) (io.WriteCloser, error)
+}
+
+// A DecryptionWrapper wraps a given io.Reader with decryption.
+type DecryptionWrapper interface {
+	WithDecryption(context.Context, io.Reader) (io.Reader, error)
+}
+
 // ProtoStreamerConfig specifies configuration for the part
 type ProtoStreamerConfig struct {
 	Uploader MultipartUploader
@@ -92,6 +132,14 @@ type ProtoStreamerConfig struct {
 	ForceFlush chan struct{}
 	// RetryConfig defines how to retry on a failed upload
 	RetryConfig *retryutils.LinearConfig
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	RecordingMetadataProvider *recordingmetadata.Provider
+	// Encrypter wraps the final gzip writer with encryption.
+	Encrypter EncryptionWrapper
 }
 
 // CheckAndSetDefaults checks and sets streamer defaults
@@ -134,14 +182,17 @@ type ProtoStreamer struct {
 // this function is useful in tests
 func (s *ProtoStreamer) CreateAuditStreamForUpload(ctx context.Context, sid session.ID, upload StreamUpload) (apievents.Stream, error) {
 	return NewProtoStream(ProtoStreamConfig{
-		Upload:            upload,
-		BufferPool:        s.bufferPool,
-		SlicePool:         s.slicePool,
-		Uploader:          s.cfg.Uploader,
-		MinUploadBytes:    s.cfg.MinUploadBytes,
-		ConcurrentUploads: s.cfg.ConcurrentUploads,
-		ForceFlush:        s.cfg.ForceFlush,
-		RetryConfig:       s.cfg.RetryConfig,
+		Upload:                    upload,
+		BufferPool:                s.bufferPool,
+		SlicePool:                 s.slicePool,
+		Uploader:                  s.cfg.Uploader,
+		MinUploadBytes:            s.cfg.MinUploadBytes,
+		ConcurrentUploads:         s.cfg.ConcurrentUploads,
+		ForceFlush:                s.cfg.ForceFlush,
+		RetryConfig:               s.cfg.RetryConfig,
+		SessionSummarizerProvider: s.cfg.SessionSummarizerProvider,
+		RecordingMetadataProvider: s.cfg.RecordingMetadataProvider,
+		Encrypter:                 s.cfg.Encrypter,
 	})
 }
 
@@ -164,13 +215,16 @@ func (s *ProtoStreamer) ResumeAuditStream(ctx context.Context, sid session.ID, u
 		return nil, trace.Wrap(err)
 	}
 	return NewProtoStream(ProtoStreamConfig{
-		Upload:         upload,
-		BufferPool:     s.bufferPool,
-		SlicePool:      s.slicePool,
-		Uploader:       s.cfg.Uploader,
-		MinUploadBytes: s.cfg.MinUploadBytes,
-		CompletedParts: parts,
-		RetryConfig:    s.cfg.RetryConfig,
+		Upload:                    upload,
+		BufferPool:                s.bufferPool,
+		SlicePool:                 s.slicePool,
+		Uploader:                  s.cfg.Uploader,
+		MinUploadBytes:            s.cfg.MinUploadBytes,
+		CompletedParts:            parts,
+		RetryConfig:               s.cfg.RetryConfig,
+		SessionSummarizerProvider: s.cfg.SessionSummarizerProvider,
+		RecordingMetadataProvider: s.cfg.RecordingMetadataProvider,
+		Encrypter:                 s.cfg.Encrypter,
 	})
 }
 
@@ -203,6 +257,14 @@ type ProtoStreamConfig struct {
 	ConcurrentUploads int
 	// RetryConfig defines how to retry on a failed upload
 	RetryConfig *retryutils.LinearConfig
+	// SessionSummarizerProvider is a provider of the session summarizer service.
+	// It can be nil or provide a nil summarizer if summarization is not needed.
+	// The summarizer itself summarizes session recordings.
+	SessionSummarizerProvider *summarizer.SessionSummarizerProvider
+	// RecordingMetadataProvider is a provider of the recording metadata service.
+	RecordingMetadataProvider *recordingmetadata.Provider
+	// Encrypter wraps the final gzip writer with encryption.
+	Encrypter EncryptionWrapper
 }
 
 // CheckAndSetDefaults checks and sets default values
@@ -297,6 +359,7 @@ func NewProtoStream(cfg ProtoStreamConfig) (*ProtoStream, error) {
 		semUploads:        make(chan struct{}, cfg.ConcurrentUploads),
 		lastPartNumber:    0,
 		retryConfig:       *cfg.RetryConfig,
+		encrypter:         cfg.Encrypter,
 	}
 	if len(cfg.CompletedParts) > 0 {
 		// skip 2 extra parts as a protection from accidental overwrites.
@@ -501,9 +564,31 @@ type sliceWriter struct {
 	completedParts []StreamPart
 	// emptyHeader is used to write empty header
 	// to preserve some bytes
-	emptyHeader [ProtoStreamV1PartHeaderSize]byte
+	emptyHeader [ProtoStreamV2PartHeaderSize]byte
 	// retryConfig  defines how to retry on a failed upload
 	retryConfig retryutils.LinearConfig
+	// sessionStartTime is the time of the first event in the session
+	sessionStartTime time.Time
+	// sessionEndTime is the time of the last event in the session
+	sessionEndTime time.Time
+	// shouldProcessSession is set to true if the session should be processed
+	// by the recording metadata service (currently, this is true if the session
+	// is a SSH session).
+	shouldProcessSession bool
+	// sshSessionEndEvent is an event that marked the end of this session if it was
+	// an SSH one. It may be nil if the stream hasn't ended yet, and it may also
+	// be nil if the stream picked up after an auth server start from a point
+	// where the session end event has already been uploaded. If captured, it
+	// will be passed to the summarizer.
+	sshSessionEndEvent *apievents.SessionEnd
+	// dbSessionEndEvent is an event that marked the end of this session if it was
+	// a database one. It may be nil if the stream hasn't ended yet, and it may
+	// also be nil if the stream picked up after an auth server start from a
+	// point where the session end event has already been uploaded. If captured,
+	// it will be passed to the summarizer.
+	dbSessionEndEvent *apievents.DatabaseSessionEnd
+	// encrypter wraps writes with encryption
+	encrypter EncryptionWrapper
 }
 
 func (w *sliceWriter) updateCompletedParts(part StreamPart, lastEventIndex int64) {
@@ -610,6 +695,25 @@ func (w *sliceWriter) receiveAndUpload() error {
 
 				continue
 			}
+			// Capture the session start time and the last relevant end event time, and the actual end event.
+			switch e := event.oneof.GetEvent().(type) {
+			case *apievents.OneOf_SessionStart:
+				w.sessionStartTime = e.SessionStart.Time
+				w.shouldProcessSession = true
+
+			case *apievents.OneOf_SessionPrint:
+				w.sessionEndTime = e.SessionPrint.Time
+
+			case *apievents.OneOf_Resize:
+				w.sessionEndTime = e.Resize.Time
+
+			case *apievents.OneOf_SessionEnd:
+				w.sshSessionEndEvent = e.SessionEnd
+				w.sessionEndTime = e.SessionEnd.Time
+
+			case *apievents.OneOf_DatabaseSessionEnd:
+				w.dbSessionEndEvent = e.DatabaseSessionEnd
+			}
 			if w.shouldUploadCurrentSlice() {
 				// this logic blocks the EmitAuditEvent in case if the
 				// upload has not completed and the current slice is out of capacity
@@ -653,20 +757,43 @@ func (w *sliceWriter) newSlice() (*slice, error) {
 	// This buffer will be returned to the pool by slice.Close
 	buffer := w.proto.cfg.BufferPool.Get()
 	buffer.Reset()
+
+	var encrypted bool
+	var writer io.WriteCloser = &bufferCloser{Buffer: buffer}
+	if w.encrypter != nil {
+		// we want to encrypt after compression, so gzip needs to be the outermost layer
+		encryptedWriter, err := w.encrypter.WithEncryption(w.proto.completeCtx, writer)
+		switch {
+		case err == nil:
+			encrypted = true
+			writer = encryptedWriter
+		case errors.Is(err, recordingencryption.ErrEncryptionDisabled):
+			// if encryption isn't enabled, do nothing
+		default:
+			return nil, trace.Wrap(err, "fetching recording encrypter")
+		}
+	}
+
 	// reserve bytes for version header
-	buffer.Write(w.emptyHeader[:])
+	headerSize := ProtoStreamV1PartHeaderSize
+	if encrypted {
+		headerSize = ProtoStreamV2PartHeaderSize
+	}
+	buffer.Write(w.emptyHeader[:headerSize])
 
 	err := w.proto.cfg.Uploader.ReserveUploadPart(w.proto.cancelCtx, w.proto.cfg.Upload, w.lastPartNumber)
 	if err != nil {
 		// Return the unused buffer to the pool.
 		w.proto.cfg.BufferPool.Put(buffer)
+		writer.Close()
 		return nil, trace.ConnectionProblem(err, uploaderReservePartErrorMessage)
 	}
 
 	return &slice{
-		proto:  w.proto,
-		buffer: buffer,
-		writer: newGzipWriter(&bufferCloser{Buffer: buffer}),
+		proto:     w.proto,
+		buffer:    buffer,
+		writer:    newGzipWriter(writer),
+		encrypted: encrypted,
 	}, nil
 }
 
@@ -685,16 +812,16 @@ func (w *sliceWriter) submitEvent(event protoEvent) error {
 // completeStream waits for in-flight uploads to finish
 // and completes the stream
 func (w *sliceWriter) completeStream() {
+	log := slog.With(
+		"upload", w.proto.cfg.Upload.ID,
+		"session", w.proto.cfg.Upload.SessionID,
+	)
 	for range w.activeUploads {
 		select {
 		case upload := <-w.completedUploadsC:
 			part, err := upload.getPart()
 			if err != nil {
-				slog.WarnContext(w.proto.cancelCtx, "Failed to upload part",
-					"error", err,
-					"upload", w.proto.cfg.Upload.ID,
-					"session", w.proto.cfg.Upload.SessionID,
-				)
+				log.WarnContext(w.proto.cancelCtx, "Failed to upload part", "error", err)
 				continue
 			}
 			w.updateCompletedParts(*part, upload.lastEventIndex)
@@ -710,11 +837,38 @@ func (w *sliceWriter) completeStream() {
 		err := w.proto.cfg.Uploader.CompleteUpload(w.proto.cancelCtx, w.proto.cfg.Upload, w.completedParts)
 		w.proto.setCompleteResult(err)
 		if err != nil {
-			slog.WarnContext(w.proto.cancelCtx, "Failed to complete upload",
-				"error", err,
-				"upload", w.proto.cfg.Upload.ID,
-				"session", w.proto.cfg.Upload.SessionID,
-			)
+			slog.WarnContext(w.proto.cancelCtx, "Failed to complete upload", "error", err)
+			return
+		}
+
+		if w.proto.cfg.RecordingMetadataProvider != nil {
+			recordingMetadata := w.proto.cfg.RecordingMetadataProvider.Service()
+
+			if w.shouldProcessSession {
+				if !w.sessionStartTime.IsZero() && !w.sessionEndTime.IsZero() {
+					duration := w.sessionEndTime.Sub(w.sessionStartTime)
+
+					if err := recordingMetadata.ProcessSessionRecording(w.proto.cancelCtx, w.proto.cfg.Upload.SessionID, duration); err != nil {
+						slog.WarnContext(w.proto.cancelCtx, "Failed to process session recording metadata", "error", err)
+					}
+				} else {
+					slog.WarnContext(w.proto.cancelCtx, "Session start or end time is not set, skipping recording metadata processing")
+				}
+			}
+		}
+
+		summarizer := w.proto.cfg.SessionSummarizerProvider.SessionSummarizer()
+		switch {
+		case w.sshSessionEndEvent != nil:
+			err = summarizer.SummarizeSSH(w.proto.cancelCtx, w.sshSessionEndEvent)
+		case w.dbSessionEndEvent != nil:
+			err = summarizer.SummarizeDatabase(w.proto.cancelCtx, w.dbSessionEndEvent)
+		default:
+			err = summarizer.SummarizeWithoutEndEvent(w.proto.cancelCtx, w.proto.cfg.Upload.SessionID)
+		}
+		if err != nil {
+			slog.WarnContext(w.proto.cancelCtx, "Failed to summarize upload", "error", err)
+			return
 		}
 	}
 }
@@ -856,11 +1010,12 @@ func (a *activeUpload) getPart() (*StreamPart, error) {
 // slice contains serialized protobuf messages
 type slice struct {
 	proto          *ProtoStream
-	writer         *gzipWriter
+	writer         io.WriteCloser
 	buffer         *bytes.Buffer
 	isLast         bool
 	lastEventIndex int64
 	eventCount     uint64
+	encrypted      bool
 }
 
 // reader returns a reader for the bytes written, no writes should be done after this
@@ -881,11 +1036,23 @@ func (s *slice) reader() (io.ReadSeeker, error) {
 		s.buffer.Write(padding)
 	}
 	data := s.buffer.Bytes()
+
+	// TODO (eriktate): stop writing new recordings with ProtoStreamV1 in v19
+	partHeader := PartHeader{
+		ProtoVersion: ProtoStreamV1,
+		PartSize:     uint64(wroteBytes - ProtoStreamV1PartHeaderSize),
+		PaddingSize:  uint64(paddingBytes),
+	}
+
+	if s.encrypted {
+		partHeader.ProtoVersion = ProtoStreamV2
+		partHeader.PartSize = uint64(wroteBytes - ProtoStreamV2PartHeaderSize)
+		partHeader.Flags = ProtoStreamFlagEncrypted
+	}
+
 	// when the slice was created, the first bytes were reserved
 	// for the protocol version number and size of the slice in bytes
-	binary.BigEndian.PutUint64(data[0:], ProtoStreamV1)
-	binary.BigEndian.PutUint64(data[Int64Size:], uint64(wroteBytes-ProtoStreamV1PartHeaderSize))
-	binary.BigEndian.PutUint64(data[Int64Size*2:], uint64(paddingBytes))
+	copy(data, partHeader.Bytes())
 	return bytes.NewReader(data), nil
 }
 
@@ -943,10 +1110,11 @@ func (s *slice) recordEvent(event protoEvent) error {
 }
 
 // NewProtoReader returns a new proto reader with slice pool
-func NewProtoReader(r io.Reader) *ProtoReader {
+func NewProtoReader(r io.Reader, decrypter DecryptionWrapper) *ProtoReader {
 	return &ProtoReader{
 		reader:    r,
 		lastIndex: -1,
+		decrypter: decrypter,
 	}
 }
 
@@ -981,6 +1149,7 @@ type ProtoReader struct {
 	error        error
 	lastIndex    int64
 	stats        ProtoReaderStats
+	decrypter    DecryptionWrapper
 }
 
 // ProtoReaderStats contains some reader statistics
@@ -1008,7 +1177,7 @@ func (p ProtoReaderStats) ToFields() map[string]any {
 
 // Close releases reader resources
 func (r *ProtoReader) Close() error {
-	if r.gzipReader != nil {
+	if r != nil && r.gzipReader != nil {
 		return r.gzipReader.Close()
 	}
 	return nil
@@ -1043,6 +1212,65 @@ func (r *ProtoReader) GetStats() ProtoReaderStats {
 	return r.stats
 }
 
+// PartHeader is the structured representation of the binary header prepending each part of a ProtoStream output
+type PartHeader struct {
+	ProtoVersion uint64
+	PartSize     uint64
+	PaddingSize  uint64
+	Flags        ProtoStreamFlag
+}
+
+// Bytes returns the binary representation of a PartHeader formatted to be included in a ProtoStream
+func (h PartHeader) Bytes() []byte {
+	var buf [ProtoStreamV2PartHeaderSize]byte
+	binary.BigEndian.PutUint64(buf[:], h.ProtoVersion)
+	binary.BigEndian.PutUint64(buf[Int64Size:], h.PartSize)
+	binary.BigEndian.PutUint64(buf[Int64Size*2:], h.PaddingSize)
+	if h.ProtoVersion == 1 {
+		return buf[:ProtoStreamV1PartHeaderSize]
+	}
+	binary.BigEndian.PutUint64(buf[Int64Size*3:], 0)
+	buf[Int64Size*3] = h.Flags
+	return buf[:]
+}
+
+// ParsePartHeader parses a PartHeader from the given io.Reader
+func ParsePartHeader(r io.Reader) (PartHeader, error) {
+	var header PartHeader
+	var buf [Int64Size]byte
+	if _, err := io.ReadFull(r, buf[:]); err != nil {
+		if errors.Is(err, io.EOF) {
+			return header, trace.Wrap(err)
+		}
+		return header, trace.ConvertSystemError(err)
+	}
+
+	header.ProtoVersion = binary.BigEndian.Uint64(buf[:])
+	if header.ProtoVersion > ProtoStreamV2 {
+		return PartHeader{}, trace.BadParameter("unsupported protocol version %v", header.ProtoVersion)
+	}
+
+	// read size of this gzipped part as encoded by V1 protocol version
+	if _, err := io.ReadFull(r, buf[:]); err != nil {
+		return header, trace.ConvertSystemError(err)
+	}
+	header.PartSize = binary.BigEndian.Uint64(buf[:])
+	// read padding size (could be 0)
+	if _, err := io.ReadFull(r, buf[:]); err != nil {
+		return header, trace.ConvertSystemError(err)
+	}
+	header.PaddingSize = binary.BigEndian.Uint64(buf[:])
+	if header.ProtoVersion == 1 {
+		return header, nil
+	}
+
+	if _, err := io.ReadFull(r, buf[:]); err != nil {
+		return header, trace.ConvertSystemError(err)
+	}
+	header.Flags = buf[0]
+	return header, nil
+}
+
 // Read returns next event or io.EOF in case of the end of the parts
 func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 	// periodic checks of context after fixed amount of iterations
@@ -1070,7 +1298,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 		case protoReaderStateInit:
 			// read the part header that consists of the protocol version
 			// and the part size (for the V1 version of the protocol)
-			_, err := io.ReadFull(r.reader, r.sizeBytes[:Int64Size])
+			header, err := ParsePartHeader(r.reader)
 			if err != nil {
 				// reached the end of the stream
 				if errors.Is(err, io.EOF) {
@@ -1079,26 +1307,40 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 				}
 				return nil, r.setError(trace.ConvertSystemError(err))
 			}
-			protocolVersion := binary.BigEndian.Uint64(r.sizeBytes[:Int64Size])
-			if protocolVersion != ProtoStreamV1 {
-				return nil, trace.BadParameter("unsupported protocol version %v", protocolVersion)
-			}
-			// read size of this gzipped part as encoded by V1 protocol version
-			_, err = io.ReadFull(r.reader, r.sizeBytes[:Int64Size])
-			if err != nil {
-				return nil, r.setError(trace.ConvertSystemError(err))
+
+			// Empty parts may be created for padding. Just skip them and discard any padding.
+			if header.PartSize == 0 {
+				if header.PaddingSize != 0 {
+					skipped, err := io.CopyBuffer(io.Discard, io.LimitReader(r.reader, int64(header.PaddingSize)), r.messageBytes[:])
+					if err != nil {
+						return nil, r.setError(trace.ConvertSystemError(err))
+					}
+					if skipped != int64(header.PaddingSize) {
+						return nil, r.setError(trace.BadParameter(
+							"data truncated, expected to read %v bytes, but got %v", r.padding, skipped))
+					}
+				}
+				continue
 			}
-			partSize := binary.BigEndian.Uint64(r.sizeBytes[:Int64Size])
-			// read padding size (could be 0)
-			_, err = io.ReadFull(r.reader, r.sizeBytes[:Int64Size])
-			if err != nil {
-				return nil, r.setError(trace.ConvertSystemError(err))
+
+			r.padding = int64(header.PaddingSize)
+			reader := io.LimitReader(r.reader, int64(header.PartSize))
+			if header.Flags&ProtoStreamFlagEncrypted != 0 {
+				if r.decrypter == nil {
+					return nil, r.setError(trace.Errorf("reading encrypted protos without decrypter"))
+				}
+
+				reader, err = r.decrypter.WithDecryption(ctx, reader)
+				if err != nil {
+					return nil, r.setError(trace.Wrap(err))
+				}
 			}
-			r.padding = int64(binary.BigEndian.Uint64(r.sizeBytes[:Int64Size]))
-			gzipReader, err := newGzipReader(io.NopCloser(io.LimitReader(r.reader, int64(partSize))))
+
+			gzipReader, err := newGzipReader(io.NopCloser(reader))
 			if err != nil {
 				return nil, r.setError(trace.Wrap(err))
 			}
+
 			r.gzipReader = gzipReader
 			r.state = protoReaderStateCurrent
 			continue
@@ -1106,8 +1348,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 		case protoReaderStateCurrent:
 			// the record consists of length of the protobuf encoded
 			// message and the message itself
-			_, err := io.ReadFull(r.gzipReader, r.sizeBytes[:Int32Size])
-			if err != nil {
+			if _, err := io.ReadFull(r.gzipReader, r.sizeBytes[:Int32Size]); err != nil {
 				if !errors.Is(err, io.EOF) {
 					return nil, r.setError(trace.ConvertSystemError(err))
 				}
@@ -1153,13 +1394,11 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 			if messageSize == 0 {
 				return nil, r.setError(trace.BadParameter("unexpected message size 0"))
 			}
-			_, err = io.ReadFull(r.gzipReader, r.messageBytes[:messageSize])
-			if err != nil {
+			if _, err := io.ReadFull(r.gzipReader, r.messageBytes[:messageSize]); err != nil {
 				return nil, r.setError(trace.ConvertSystemError(err))
 			}
 			oneof := apievents.OneOf{}
-			err = oneof.Unmarshal(r.messageBytes[:messageSize])
-			if err != nil {
+			if err := oneof.Unmarshal(r.messageBytes[:messageSize]); err != nil {
 				return nil, trace.Wrap(err)
 			}
 			event, err := apievents.FromOneOf(oneof)
diff --git a/lib/events/stream_test.go b/lib/events/stream_test.go
index a9d0ee1c94f60..06c1d7c8e60dd 100644
--- a/lib/events/stream_test.go
+++ b/lib/events/stream_test.go
@@ -19,17 +19,26 @@
 package events_test
 
 import (
+	"bytes"
 	"context"
+	"encoding/hex"
 	"errors"
+	"io"
 	"os"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/session"
@@ -188,7 +197,7 @@ func TestProtoStreamLargeEvent(t *testing.T) {
 	ctx := context.Background()
 
 	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
-		Uploader: eventstest.NewMemoryUploader(nil),
+		Uploader: eventstest.NewMemoryUploader(),
 	})
 	require.NoError(t, err)
 
@@ -213,7 +222,7 @@ func TestReadCorruptedRecording(t *testing.T) {
 	require.NoError(t, err)
 	defer f.Close()
 
-	reader := events.NewProtoReader(f)
+	reader := events.NewProtoReader(f, nil)
 	defer reader.Close()
 
 	events, err := reader.ReadAll(ctx)
@@ -223,6 +232,392 @@ func TestReadCorruptedRecording(t *testing.T) {
 	require.Len(t, events, 12)
 }
 
+func TestSummarization_SSH(t *testing.T) {
+	cases := []struct {
+		name               string
+		useSummarizer      bool
+		summarizationError error
+	}{
+		{
+			name:          "noop summarizer",
+			useSummarizer: false,
+		},
+		{
+			name:          "successful summarization",
+			useSummarizer: true,
+		},
+		{
+			// Since the behavior differs only in logging, this test is here just to
+			// make sure an error doesn't cause a panic.
+			name:               "summarization error",
+			useSummarizer:      true,
+			summarizationError: errors.New("summarization error"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			summarizerProvider := &summarizer.SessionSummarizerProvider{}
+			uploader := eventstest.NewMemoryUploader()
+			streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+				Uploader:                  uploader,
+				SessionSummarizerProvider: summarizerProvider,
+			})
+			require.NoError(t, err)
+
+			evts := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1})
+			sid := session.ID(evts[0].(events.SessionMetadataGetter).GetSessionID())
+
+			mockSummarizer := &MockSummarizer{}
+			if tc.useSummarizer {
+				summarizerProvider.SetSummarizer(mockSummarizer)
+				matchesSID := mock.MatchedBy(func(e *apievents.SessionEnd) bool {
+					return e.GetSessionID() == string(sid)
+				})
+				mockSummarizer.
+					On("SummarizeSSH", mock.Anything, matchesSID).
+					Return(tc.summarizationError).
+					Once()
+			}
+
+			stream, err := streamer.CreateAuditStream(t.Context(), sid)
+			require.NoError(t, err)
+
+			preparer, err := events.NewPreparer(events.PreparerConfig{
+				SessionID:   sid,
+				Namespace:   apidefaults.Namespace,
+				ClusterName: "cluster",
+			})
+			require.NoError(t, err)
+
+			for _, evt := range evts {
+				preparedEvent, err := preparer.PrepareSessionEvent(evt)
+				require.NoError(t, err)
+
+				err = stream.RecordEvent(t.Context(), preparedEvent)
+				require.NoError(t, err)
+			}
+
+			err = stream.Complete(t.Context())
+			require.NoError(t, err)
+
+			mockSummarizer.AssertExpectations(t)
+		})
+	}
+}
+
+func TestSummarization_Database(t *testing.T) {
+	cases := []struct {
+		name               string
+		useSummarizer      bool
+		summarizationError error
+	}{
+		{
+			name:          "noop summarizer",
+			useSummarizer: false,
+		},
+		{
+			name:          "successful summarization",
+			useSummarizer: true,
+		},
+		{
+			// Since the behavior differs only in logging, this test is here just to
+			// make sure an error doesn't cause a panic.
+			name:               "summarization error",
+			useSummarizer:      true,
+			summarizationError: errors.New("summarization error"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			summarizerProvider := &summarizer.SessionSummarizerProvider{}
+			uploader := eventstest.NewMemoryUploader()
+			streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+				Uploader:                  uploader,
+				SessionSummarizerProvider: summarizerProvider,
+			})
+			require.NoError(t, err)
+
+			evts := eventstest.GenerateTestDBSession(eventstest.DBSessionParams{Queries: 1})
+			sid := session.ID(evts[0].(events.SessionMetadataGetter).GetSessionID())
+
+			mockSummarizer := &MockSummarizer{}
+			if tc.useSummarizer {
+				summarizerProvider.SetSummarizer(mockSummarizer)
+				matchesSID := mock.MatchedBy(func(e *apievents.DatabaseSessionEnd) bool {
+					return e.GetSessionID() == string(sid)
+				})
+				mockSummarizer.
+					On("SummarizeDatabase", mock.Anything, matchesSID).
+					Return(tc.summarizationError).
+					Once()
+			}
+
+			stream, err := streamer.CreateAuditStream(t.Context(), sid)
+			require.NoError(t, err)
+
+			preparer, err := events.NewPreparer(events.PreparerConfig{
+				SessionID:   sid,
+				Namespace:   apidefaults.Namespace,
+				ClusterName: "cluster",
+			})
+			require.NoError(t, err)
+
+			for _, evt := range evts {
+				preparedEvent, err := preparer.PrepareSessionEvent(evt)
+				require.NoError(t, err)
+
+				err = stream.RecordEvent(t.Context(), preparedEvent)
+				require.NoError(t, err)
+			}
+
+			err = stream.Complete(t.Context())
+			require.NoError(t, err)
+
+			mockSummarizer.AssertExpectations(t)
+		})
+	}
+}
+
+// TestSummarization_Unknown tests summarizing unknown session types by
+// simulating a situation where the stream picked up after the session end
+// event.
+func TestSummarization_Unknown(t *testing.T) {
+	cases := []struct {
+		name               string
+		useSummarizer      bool
+		summarizationError error
+	}{
+		{
+			name:          "noop summarizer",
+			useSummarizer: false,
+		},
+		{
+			name:          "successful summarization",
+			useSummarizer: true,
+		},
+		{
+			// Since the behavior differs only in logging, this test is here just to
+			// make sure an error doesn't cause a panic.
+			name:               "summarization error",
+			useSummarizer:      true,
+			summarizationError: errors.New("summarization error"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			summarizerProvider := &summarizer.SessionSummarizerProvider{}
+			uploader := eventstest.NewMemoryUploader()
+			streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+				Uploader:                  uploader,
+				SessionSummarizerProvider: summarizerProvider,
+			})
+			require.NoError(t, err)
+
+			// The only event in the stream is a SessionLeave event, which occurs
+			// after the session end.
+			sid := session.ID("a9db3c23-ba28-4155-8d28-9a7cc8aeb22c")
+			event := &apievents.SessionLeave{
+				Metadata: apievents.Metadata{
+					Index:       123,
+					Type:        events.SessionLeaveEvent,
+					ID:          "b2ac5c41-280c-4b8c-9a5d-f6dcc4e9d6ef",
+					Code:        events.SessionLeaveCode,
+					Time:        time.Now().UTC(),
+					ClusterName: "foo",
+				},
+				UserMetadata: apievents.UserMetadata{
+					User: "admin", Login: "alice", UserKind: apievents.UserKind_USER_KIND_HUMAN,
+				},
+				SessionMetadata: apievents.SessionMetadata{
+					SessionID:        sid.String(),
+					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
+				},
+				ServerMetadata: apievents.ServerMetadata{
+					ServerNamespace: "default",
+					ServerID:        "e021b146-a383-4391-91c3-e5e31d6964d3", ServerHostname: "node-1",
+					ServerVersion: teleport.Version,
+				},
+			}
+
+			mockSummarizer := &MockSummarizer{}
+			if tc.useSummarizer {
+				summarizerProvider.SetSummarizer(mockSummarizer)
+				mockSummarizer.
+					On("SummarizeWithoutEndEvent", mock.Anything, sid).
+					Return(tc.summarizationError).
+					Once()
+			}
+
+			stream, err := streamer.CreateAuditStream(t.Context(), sid)
+			require.NoError(t, err)
+
+			preparer, err := events.NewPreparer(events.PreparerConfig{
+				SessionID:   sid,
+				Namespace:   apidefaults.Namespace,
+				ClusterName: "cluster",
+			})
+			require.NoError(t, err)
+
+			preparedEvent, err := preparer.PrepareSessionEvent(event)
+			require.NoError(t, err)
+
+			err = stream.RecordEvent(t.Context(), preparedEvent)
+			require.NoError(t, err)
+
+			err = stream.Complete(t.Context())
+			require.NoError(t, err)
+
+			mockSummarizer.AssertExpectations(t)
+		})
+	}
+}
+
+func TestPartHeader(t *testing.T) {
+	cases := []struct {
+		name               string
+		partHeader         events.PartHeader
+		expectedErr        error
+		expectedPartHeader *events.PartHeader // if different than starting part
+	}{
+		{
+			name: "v1 part header",
+			partHeader: events.PartHeader{
+				ProtoVersion: events.ProtoStreamV1,
+				PartSize:     1234,
+				PaddingSize:  4321,
+				Flags:        events.ProtoStreamFlagEncrypted,
+			},
+			expectedErr: nil,
+			expectedPartHeader: &events.PartHeader{
+				ProtoVersion: events.ProtoStreamV1,
+				PartSize:     1234,
+				PaddingSize:  4321,
+				// no flags
+			},
+		},
+		{
+			name: "v2 part header encrypted",
+			partHeader: events.PartHeader{
+				ProtoVersion: events.ProtoStreamV2,
+				PartSize:     1234,
+				PaddingSize:  4321,
+				Flags:        events.ProtoStreamFlagEncrypted,
+			},
+			expectedErr:        nil,
+			expectedPartHeader: nil,
+		},
+		{
+			name: "v2 part header unencrypted",
+			partHeader: events.PartHeader{
+				ProtoVersion: events.ProtoStreamV2,
+				PartSize:     1234,
+				PaddingSize:  4321,
+			},
+			expectedErr:        nil,
+			expectedPartHeader: nil,
+		},
+		{
+			name: "invalid version",
+			partHeader: events.PartHeader{
+				ProtoVersion: 3,
+				PartSize:     1234,
+				PaddingSize:  4321,
+				Flags:        events.ProtoStreamFlagEncrypted,
+			},
+			expectedErr:        trace.BadParameter("unsupported protocol version %v", 3),
+			expectedPartHeader: nil,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			buf := bytes.NewBuffer(c.partHeader.Bytes())
+			switch c.partHeader.ProtoVersion {
+			case events.ProtoStreamV1:
+				require.Equal(t, events.ProtoStreamV1PartHeaderSize, buf.Len())
+			case events.ProtoStreamV2:
+				require.Equal(t, events.ProtoStreamV2PartHeaderSize, buf.Len())
+			}
+
+			header, err := events.ParsePartHeader(buf)
+			if c.expectedErr != nil {
+				require.ErrorIs(t, err, c.expectedErr)
+				return
+			}
+			expected := c.partHeader
+			if c.expectedPartHeader != nil {
+				expected = *c.expectedPartHeader
+			}
+			require.Equal(t, expected, header)
+		})
+	}
+}
+
+func TestEncryptedRecordingIO(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+
+	uploader := eventstest.NewMemoryUploader()
+	encryptedIO := &fakeEncryptedIO{}
+	streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
+		Uploader:  uploader,
+		Encrypter: encryptedIO,
+	})
+	require.NoError(t, err)
+
+	const eventCount = 10
+	evts := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: eventCount})
+	sid := session.ID(evts[0].(events.SessionMetadataGetter).GetSessionID())
+	stream, err := streamer.CreateAuditStream(ctx, sid)
+	require.NoError(t, err)
+
+	preparer, err := events.NewPreparer(events.PreparerConfig{
+		SessionID:   sid,
+		Namespace:   apidefaults.Namespace,
+		ClusterName: "cluster",
+	})
+	require.NoError(t, err)
+
+	for _, evt := range evts {
+		preparedEvent, err := preparer.PrepareSessionEvent(evt)
+		require.NoError(t, err)
+
+		err = stream.RecordEvent(ctx, preparedEvent)
+		require.NoError(t, err)
+	}
+
+	err = stream.Complete(ctx)
+	require.NoError(t, err)
+
+	doneC := make(chan struct{})
+	go func() {
+		defer close(doneC)
+		stream.Complete(ctx)
+		stream.Close(ctx)
+	}()
+
+	select {
+	case <-ctx.Done():
+		t.Fatal("Timeout waiting for emitter to complete")
+	case <-doneC:
+	}
+
+	out := fakeWriterAt{
+		buf: &bytes.Buffer{},
+	}
+	err = uploader.Download(ctx, sid, out)
+	require.NoError(t, err)
+
+	reader := events.NewProtoReader(out.buf, encryptedIO)
+
+	decryptedEvents, err := reader.ReadAll(ctx)
+	require.NoError(t, err)
+	require.Len(t, decryptedEvents, eventCount+2)
+}
+
 func makeQueryEvent(id string, query string) *apievents.DatabaseSessionQuery {
 	return &apievents.DatabaseSessionQuery{
 		Metadata: apievents.Metadata{
@@ -242,3 +637,66 @@ func makeAccessRequestEvent(id string, in string) *apievents.AccessRequestDelete
 		RequestID: in,
 	}
 }
+
+type MockSummarizer struct {
+	mock.Mock
+}
+
+func (m *MockSummarizer) SummarizeSSH(ctx context.Context, sessionEndEvent *apievents.SessionEnd) error {
+	args := m.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (m *MockSummarizer) SummarizeDatabase(ctx context.Context, sessionEndEvent *apievents.DatabaseSessionEnd) error {
+	args := m.Called(ctx, sessionEndEvent)
+	return args.Error(0)
+}
+
+func (m *MockSummarizer) SummarizeWithoutEndEvent(ctx context.Context, sessionID session.ID) error {
+	args := m.Called(ctx, sessionID)
+	return args.Error(0)
+}
+
+// encryptedIO is really just a reversible transform, so we fake encryption by encoding/decoding as hex
+type fakeEncryptedIO struct {
+	err error
+}
+
+type fakeEncrypter struct {
+	inner  io.WriteCloser
+	writer io.Writer
+}
+
+func (f *fakeEncrypter) Write(out []byte) (int, error) {
+	return f.writer.Write(out)
+}
+
+func (f *fakeEncrypter) Close() error {
+	return f.inner.Close()
+}
+
+func (f *fakeEncryptedIO) WithEncryption(ctx context.Context, writer io.WriteCloser) (io.WriteCloser, error) {
+	hexWriter := hex.NewEncoder(writer)
+	encrypter := &fakeEncrypter{
+		inner:  writer,
+		writer: hexWriter,
+	}
+
+	return encrypter, f.err
+}
+
+func (f *fakeEncryptedIO) WithDecryption(ctx context.Context, reader io.Reader) (io.Reader, error) {
+	return hex.NewDecoder(reader), f.err
+}
+
+type fakeWriterAt struct {
+	buf *bytes.Buffer
+}
+
+func (f fakeWriterAt) Write(p []byte) (int, error) {
+	return f.buf.Write(p)
+}
+
+func (f fakeWriterAt) WriteAt(p []byte, offset int64) (int, error) {
+	return f.Write(p)
+}
diff --git a/lib/events/test/streamsuite.go b/lib/events/test/streamsuite.go
index 57c0d4c736c47..83d746b861821 100644
--- a/lib/events/test/streamsuite.go
+++ b/lib/events/test/streamsuite.go
@@ -33,7 +33,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
-	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/session"
 )
 
@@ -187,7 +186,7 @@ func StreamEmpty(t *testing.T, handler events.MultipartHandler) {
 	require.NoError(t, err)
 	defer os.Remove(f.Name())
 
-	fixtures.AssertNotFound(t, handler.Download(ctx, sid, f))
+	require.True(t, trace.IsNotFound(handler.Download(ctx, sid, f)))
 }
 
 // StreamWithParameters tests stream upload and subsequent download and reads the results
@@ -256,7 +255,8 @@ func StreamWithParameters(t *testing.T, handler events.MultipartHandler, params
 	_, err = f.Seek(0, 0)
 	require.NoError(t, err)
 
-	reader := events.NewProtoReader(f)
+	reader := events.NewProtoReader(f, nil)
+
 	out, err := reader.ReadAll(ctx)
 	require.NoError(t, err)
 
@@ -327,7 +327,8 @@ func StreamResumeWithParameters(t *testing.T, handler events.MultipartHandler, p
 	_, err = f.Seek(0, 0)
 	require.NoError(t, err)
 
-	reader := events.NewProtoReader(f)
+	reader := events.NewProtoReader(f, nil)
+
 	out, err := reader.ReadAll(ctx)
 	require.NoError(t, err)
 
diff --git a/lib/events/test/suite.go b/lib/events/test/suite.go
index 11b4cb2c1d26b..274092adca028 100644
--- a/lib/events/test/suite.go
+++ b/lib/events/test/suite.go
@@ -29,6 +29,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -39,8 +40,8 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/export"
-	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // UploadDownload tests uploads and downloads
@@ -66,6 +67,75 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 	require.Equal(t, string(data), val)
 }
 
+// UploadDownloadSummary tests summary uploads and downloads
+func UploadDownloadSummary(t *testing.T, handler events.MultipartHandler) {
+	val := "this is the summary file"
+	id := session.NewID()
+	_, err := handler.UploadSummary(t.Context(), id, bytes.NewBuffer([]byte(val)))
+	require.NoError(t, err)
+
+	f, err := os.CreateTemp("", string(id))
+	require.NoError(t, err)
+	defer os.Remove(f.Name())
+	defer f.Close()
+
+	err = handler.DownloadSummary(context.TODO(), id, f)
+	require.NoError(t, err)
+
+	_, err = f.Seek(0, 0)
+	require.NoError(t, err)
+
+	data, err := io.ReadAll(f)
+	require.NoError(t, err)
+	require.Equal(t, string(data), val)
+}
+
+// UploadDownloadMetadata tests metadata uploads and downloads
+func UploadDownloadMetadata(t *testing.T, handler events.MultipartHandler) {
+	val := "this is the metadata file"
+	id := session.NewID()
+	_, err := handler.UploadMetadata(t.Context(), id, bytes.NewBuffer([]byte(val)))
+	require.NoError(t, err)
+
+	f, err := os.CreateTemp("", string(id))
+	require.NoError(t, err)
+	defer os.Remove(f.Name())
+	defer f.Close()
+
+	err = handler.DownloadMetadata(context.TODO(), id, f)
+	require.NoError(t, err)
+
+	_, err = f.Seek(0, 0)
+	require.NoError(t, err)
+
+	data, err := io.ReadAll(f)
+	require.NoError(t, err)
+	require.Equal(t, string(data), val)
+}
+
+// UploadDownloadThumbnail tests thumbnail uploads and downloads
+func UploadDownloadThumbnail(t *testing.T, handler events.MultipartHandler) {
+	val := "thumbnail"
+	id := session.NewID()
+	_, err := handler.UploadThumbnail(t.Context(), id, bytes.NewBuffer([]byte(val)))
+	require.NoError(t, err)
+
+	f, err := os.CreateTemp("", string(id))
+	require.NoError(t, err)
+	defer os.Remove(f.Name())
+	defer f.Close()
+
+	err = handler.DownloadThumbnail(context.TODO(), id, f)
+	require.NoError(t, err)
+
+	_, err = f.Seek(0, 0)
+	require.NoError(t, err)
+
+	data, err := io.ReadAll(f)
+	require.NoError(t, err)
+	require.Equal(t, string(data), val)
+}
+
 // DownloadNotFound tests handling of the scenario when download is not found
 func DownloadNotFound(t *testing.T, handler events.MultipartHandler) {
 	id := session.NewID()
@@ -76,7 +146,7 @@ func DownloadNotFound(t *testing.T, handler events.MultipartHandler) {
 	defer f.Close()
 
 	err = handler.Download(context.TODO(), id, f)
-	fixtures.AssertNotFound(t, err)
+	require.True(t, trace.IsNotFound(err))
 }
 
 // EventsSuite is a conformance test suite to verify external event backends
@@ -199,8 +269,7 @@ func (s *EventsSuite) EventExport(t *testing.T) {
 	})
 
 	require.False(t, events.Next())
-
-	fixtures.AssertNotFound(t, events.Done())
+	require.True(t, trace.IsNotFound(events.Done()))
 
 	// try a different day and verify that no chunks are found
 	chunks = s.Log.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
@@ -483,6 +552,10 @@ func (s *EventsSuite) SessionEventsCRUD(t *testing.T) {
 		UserMetadata: apievents.UserMetadata{
 			Login: "bob",
 		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerNamespace: "telport",
+			ServerLabels:    map[string]string{"env": "prod"},
+		},
 		SessionMetadata: apievents.SessionMetadata{
 			SessionID: string(sessionID),
 		},
@@ -522,12 +595,59 @@ func (s *EventsSuite) SessionEventsCRUD(t *testing.T) {
 		}}
 	}
 
+	withServerLabelsExpr := func(key, value string) *types.WhereExpr {
+		return &types.WhereExpr{
+			And: types.WhereExpr2{
+				L: &types.WhereExpr{
+					CanView: &types.WhereNoExpr{},
+				},
+				R: &types.WhereExpr{
+					Equals: types.WhereExpr2{
+						L: &types.WhereExpr{
+							MapRef: &types.WhereExpr2{
+								L: &types.WhereExpr{Field: "server_labels"},
+								R: &types.WhereExpr{Literal: key},
+							}},
+						R: &types.WhereExpr{Literal: value},
+					},
+				},
+			},
+		}
+	}
+
+	history, _, err = s.Log.SearchSessionEvents(ctx, events.SearchSessionEventsRequest{
+		From:  s.Clock.Now().UTC().Add(-1 * time.Hour),
+		To:    s.Clock.Now().UTC().Add(2 * time.Hour),
+		Limit: 100,
+		Order: types.EventOrderAscending,
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr: withParticipant("alice"),
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, history, 1)
+
+	history, _, err = s.Log.SearchSessionEvents(ctx, events.SearchSessionEventsRequest{
+		From:  s.Clock.Now().UTC().Add(-1 * time.Hour),
+		To:    s.Clock.Now().UTC().Add(2 * time.Hour),
+		Limit: 100,
+		Order: types.EventOrderAscending,
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr: withParticipant("cecile"),
+		},
+	})
+	require.NoError(t, err)
+	require.Empty(t, history)
+
 	history, _, err = s.Log.SearchSessionEvents(ctx, events.SearchSessionEventsRequest{
 		From:  s.Clock.Now().UTC().Add(-1 * time.Hour),
 		To:    s.Clock.Now().UTC().Add(2 * time.Hour),
 		Limit: 100,
 		Order: types.EventOrderAscending,
-		Cond:  withParticipant("alice"),
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr:    withServerLabelsExpr("env", "prod"),
+			CanView: func(f utils.Fields) bool { return true },
+		},
 	})
 	require.NoError(t, err)
 	require.Len(t, history, 1)
@@ -537,7 +657,23 @@ func (s *EventsSuite) SessionEventsCRUD(t *testing.T) {
 		To:    s.Clock.Now().UTC().Add(2 * time.Hour),
 		Limit: 100,
 		Order: types.EventOrderAscending,
-		Cond:  withParticipant("cecile"),
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr:    withServerLabelsExpr("env", "prod"),
+			CanView: func(f utils.Fields) bool { return false },
+		},
+	})
+	require.NoError(t, err)
+	require.Empty(t, history)
+
+	history, _, err = s.Log.SearchSessionEvents(ctx, events.SearchSessionEventsRequest{
+		From:  s.Clock.Now().UTC().Add(-1 * time.Hour),
+		To:    s.Clock.Now().UTC().Add(2 * time.Hour),
+		Limit: 100,
+		Order: types.EventOrderAscending,
+		Cond: &utils.ToFieldsConditionConfig{
+			Expr:    withServerLabelsExpr("env", "dev"),
+			CanView: func(f utils.Fields) bool { return true },
+		},
 	})
 	require.NoError(t, err)
 	require.Empty(t, history)
diff --git a/lib/events/uploader.go b/lib/events/uploader.go
index a993e1bb9db11..954538f6f6084 100644
--- a/lib/events/uploader.go
+++ b/lib/events/uploader.go
@@ -26,17 +26,41 @@ import (
 	"github.com/gravitational/teleport/lib/session"
 )
 
-// UploadHandler is a function supplied by the user, it will upload
-// the file
+// UploadHandler uploads and downloads session-related files.
 type UploadHandler interface {
-	// Upload uploads session tarball and returns URL with uploaded file
-	// in case of success.
+	// Upload uploads a session recording and returns a URL with uploaded file in
+	// case of success.
 	Upload(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error)
-	// Download downloads session tarball and writes it to writer
-	Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error
+	// Download downloads a session recording and writes it to a writer.
+	Download(ctx context.Context, sessionID session.ID, writer RandomAccessWriter) error
+	// UploadSummary uploads a session summary and returns a URL with uploaded
+	// file in case of success.
+	UploadSummary(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error)
+	// DownloadSummary downloads a session summary and writes it to a writer.
+	DownloadSummary(ctx context.Context, sessionID session.ID, writer RandomAccessWriter) error
+	// UploadMetadata uploads session metadata and returns a URL with the uploaded
+	// file in case of success. Session metadata is a file with a [recordingmetadatav1.SessionRecordingMetadata]
+	// protobuf message containing info about the session (duration, events, etc), as well as
+	// multiple [recordingmetadatav1.SessionRecordingThumbnail] messages (thumbnails).
+	UploadMetadata(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error)
+	// DownloadMetadata downloads session metadata and writes it to a writer.
+	DownloadMetadata(ctx context.Context, sessionID session.ID, writer RandomAccessWriter) error
+	// UploadThumbnail uploads a session thumbnail and returns a URL with uploaded
+	// file in case of success. A thumbnail is [recordingmetadatav1.SessionRecordingThumbnail]
+	// protobuf message which contains the thumbnail as an SVG, and some basic details about the
+	// state of the terminal at the time of the thumbnail capture (terminal size, cursor position).
+	UploadThumbnail(ctx context.Context, sessionID session.ID, readCloser io.Reader) (string, error)
+	// DownloadThumbnail downloads a session thumbnail and writes it to a writer.
+	DownloadThumbnail(ctx context.Context, sessionID session.ID, writer RandomAccessWriter) error
 }
 
-// MultipartHandler handles both multipart uploads and downloads
+type RandomAccessWriter interface {
+	io.Writer
+	io.WriterAt
+}
+
+// MultipartHandler handles both multipart and standalone uploads and
+// downloads.
 type MultipartHandler interface {
 	UploadHandler
 	MultipartUploader
diff --git a/lib/expression/parser.go b/lib/expression/parser.go
index 539e170b120f0..7a6505220c7b2 100644
--- a/lib/expression/parser.go
+++ b/lib/expression/parser.go
@@ -90,6 +90,14 @@ func DefaultParserSpec[evaluationEnv any]() typical.ParserSpec[evaluationEnv] {
 					}
 					return NewSet(locals...), nil
 				}),
+			"regexp.match": typical.BinaryFunction[evaluationEnv](
+				func(inputs Set, expression string) (bool, error) {
+					match, err := utils.RegexMatchesAny(inputs.items(), expression)
+					if err != nil {
+						return false, trace.Wrap(err, "invalid regular expression %q", expression)
+					}
+					return match, nil
+				}),
 			"regexp.replace": typical.TernaryFunction[evaluationEnv](
 				func(inputs Set, match string, replacement string) (Set, error) {
 					replaced, err := parse.RegexpReplace(inputs.items(), match, replacement)
diff --git a/lib/fixtures/fixtures.go b/lib/fixtures/fixtures.go
index fdca787901c0e..e978dab68b984 100644
--- a/lib/fixtures/fixtures.go
+++ b/lib/fixtures/fixtures.go
@@ -19,56 +19,9 @@
 package fixtures
 
 import (
-	"runtime/debug"
-	"testing"
-
-	"github.com/gravitational/trace"
-
 	apifixtures "github.com/gravitational/teleport/api/fixtures"
 )
 
-// AssertNotFound expects not found error
-func AssertNotFound(t *testing.T, err error) {
-	if !trace.IsNotFound(err) {
-		t.Fatalf("Expected NotFound, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
-// AssertBadParameter expects bad parameter error
-func AssertBadParameter(t *testing.T, err error) {
-	if !trace.IsBadParameter(err) {
-		t.Fatalf("Expected BadParameter, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
-// AssertCompareFailed expects compare failed error
-func AssertCompareFailed(t *testing.T, err error) {
-	if !trace.IsCompareFailed(err) {
-		t.Fatalf("Expected CompareFailed, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
-// AssertAccessDenied expects error to be access denied
-func AssertAccessDenied(t *testing.T, err error) {
-	if !trace.IsAccessDenied(err) {
-		t.Fatalf("Expected AccessDenied, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
-// AssertAlreadyExists expects already exists error
-func AssertAlreadyExists(t *testing.T, err error) {
-	if !trace.IsAlreadyExists(err) {
-		t.Fatalf("Expected AlreadyExists, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
-// AssertConnectionProblem expects connection problem error
-func AssertConnectionProblem(t *testing.T, err error) {
-	if !trace.IsConnectionProblem(err) {
-		t.Fatalf("Expected ConnectionProblem, got %T %v at %v.", trace.Unwrap(err), err, string(debug.Stack()))
-	}
-}
-
 const SAMLOktaAuthRequestID = `_4d84cad1-1c61-4e4f-8ab6-1358b8d0da77`
 const SAMLOktaAuthnResponseXML = `<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://localhost:3080/v1/webapi/saml/acs" ID="id23076376064475199270314772" InResponseTo="_4d84cad1-1c61-4e4f-8ab6-1358b8d0da77" IssueInstant="2017-05-10T18:52:44.797Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://www.okta.com/exkafftca6RqPVgyZ0h7</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#id23076376064475199270314772"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>wvBbayjxY78ouyo1DYjGrAOfLYymapbZeylWWnbA+lQ=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>QSKPoRIEwjNw/QT3GO3huhdE0seUqSrWvZWIFwkAZv3D04Q5SgsiKHJbP22VsaMUVWojnYbzLfk62nnCSPvdnJmCEH7N3SV+3TkTfeJrCOqi34NLwHadBNTSURnFA+Y+p+HNYE4x4vtg8Vn5KF/teM9hMwAEqKimobYRIS3fPW8jVRcMBdkki5HaM3OCXy9JL1krTkFMGmHobeoaV4taIv7lDpfPw9fRuys1oX0VKfGXmVMpG24n1KB8jLOuC9GYL4HdB9LhIHfznzW3xiKVXm4rJiVIg9PMSQ6SV698yFXEjh5DOdLZPIz5qcizkiL7jujPUSwZQSTArp4m6ft3Pw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAVvvlUB6MA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG
 A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
diff --git a/lib/fixtures/plugins.go b/lib/fixtures/plugins.go
deleted file mode 100644
index 1d3a0f5b8f662..0000000000000
--- a/lib/fixtures/plugins.go
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package fixtures
-
-import (
-	"testing"
-
-	"github.com/gravitational/teleport/api/types"
-)
-
-// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_AwsIc settings.
-func NewIdentityCenterPlugin(t *testing.T, serviceProviderName, integrationName string) *types.PluginV1 {
-	t.Helper()
-	return &types.PluginV1{
-		Metadata: types.Metadata{
-			Name: types.PluginTypeAWSIdentityCenter,
-			Labels: map[string]string{
-				types.HostedPluginLabel: "true",
-			},
-		},
-		Spec: types.PluginSpecV1{
-			Settings: &types.PluginSpecV1_AwsIc{
-				AwsIc: &types.PluginAWSICSettings{
-					IntegrationName:         integrationName,
-					Region:                  "test-region",
-					Arn:                     "test-arn",
-					AccessListDefaultOwners: []string{"user1", "user2"},
-					ProvisioningSpec: &types.AWSICProvisioningSpec{
-						BaseUrl: "https://example.com",
-					},
-					SamlIdpServiceProviderName: serviceProviderName,
-				},
-			},
-		},
-	}
-}
-
-// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_Mattermost settings.
-func NewMattermostPlugin(t *testing.T) *types.PluginV1 {
-	t.Helper()
-	return &types.PluginV1{
-		SubKind: types.PluginSubkindAccess,
-		Metadata: types.Metadata{
-			Labels: map[string]string{
-				"teleport.dev/hosted-plugin": "true",
-			},
-			Name: types.PluginTypeMattermost,
-		},
-		Spec: types.PluginSpecV1{
-			Settings: &types.PluginSpecV1_Mattermost{
-				Mattermost: &types.PluginMattermostSettings{
-					ServerUrl:     "https://example.com",
-					Channel:       "test_channel",
-					Team:          "test_team",
-					ReportToEmail: "test@example.com",
-				},
-			},
-		},
-		Credentials: &types.PluginCredentialsV1{
-			Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
-				StaticCredentialsRef: &types.PluginStaticCredentialsRef{
-					Labels: map[string]string{
-						"plugin": "mattermost",
-					},
-				},
-			},
-		},
-	}
-}
diff --git a/lib/gcp/dbusers.go b/lib/gcp/dbusers.go
new file mode 100644
index 0000000000000..32fa164b95c78
--- /dev/null
+++ b/lib/gcp/dbusers.go
@@ -0,0 +1,67 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcp
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+// AdjustDatabaseUsername appends the GCP IAM suffix (`@<project-id>.iam`) to a
+// username if it's for a GCP-hosted Postgres database and the username lacks
+// a domain. It returns whether the username was adjusted and the new username.
+func AdjustDatabaseUsername(username string, db types.Database) (bool, string) {
+	// As a convenience, we will append the `@<project-id>.iam` suffix to a username
+	// when connecting to Postgres GCP databases and the domain is missing.
+	//
+	// Commonly, the service account and the database share the same project ID,
+	// which means we can try to guess the intended suffix.
+	//
+	// This is only applied for Postgres (CloudSQL Postgres or AlloyDB) because:
+	// - CloudSQL MySQL still supports "classical" (one-time password) users;
+	//   otherwise it would have used the `@<project>.iam.gserviceaccount.com` suffix.
+	// - Spanner applies the `@<project>.iam.gserviceaccount.com` suffix directly in the engine.
+
+	if !db.IsGCPHosted() {
+		return false, ""
+	}
+
+	if db.GetProtocol() != defaults.ProtocolPostgres {
+		return false, ""
+	}
+
+	// already has domain part, nothing to fix.
+	if strings.Contains(username, "@") {
+		return false, ""
+	}
+
+	// keep empty username unchanged: we don't want to have "@project-123.iam" as username.
+	if username == "" {
+		return false, ""
+	}
+
+	// the error is very unlikely; quietly treat it as missing data.
+	projectID, _ := db.GetGCPProjectID()
+	if projectID == "" {
+		return false, ""
+	}
+
+	return true, fmt.Sprintf("%s@%s.iam", strings.TrimSpace(username), projectID)
+}
diff --git a/lib/gcp/dbusers_test.go b/lib/gcp/dbusers_test.go
new file mode 100644
index 0000000000000..bebf8a1c7d7a2
--- /dev/null
+++ b/lib/gcp/dbusers_test.go
@@ -0,0 +1,121 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package gcp
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+func TestAdjustDatabaseUsername(t *testing.T) {
+	t.Parallel()
+
+	gcpPostgresDB, err := types.NewDatabaseV3(types.Metadata{
+		Name: "gcp-postgres",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      "localhost:5432",
+		GCP: types.GCPCloudSQL{
+			ProjectID:  "teleport-project-123",
+			InstanceID: "pg-instance",
+		},
+	})
+	require.NoError(t, err)
+
+	gcpMySQLDB, err := types.NewDatabaseV3(types.Metadata{
+		Name: "gcp-mysql",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolMySQL,
+		URI:      "localhost:3306",
+		GCP: types.GCPCloudSQL{
+			ProjectID:  "teleport-project-123",
+			InstanceID: "mysql-instance",
+		},
+	})
+	require.NoError(t, err)
+
+	nonGCPDB, err := types.NewDatabaseV3(types.Metadata{
+		Name: "non-gcp-postgres",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      "localhost:5432",
+	})
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name             string
+		username         string
+		db               types.Database
+		expectAdjusted   bool
+		expectedUsername string
+	}{
+		{
+			name:             "add suffix to short name",
+			username:         "iam-user",
+			db:               gcpPostgresDB,
+			expectAdjusted:   true,
+			expectedUsername: "iam-user@teleport-project-123.iam",
+		},
+		{
+			name:             "add suffix to short name with whitespace",
+			username:         "  iam-user  ",
+			db:               gcpPostgresDB,
+			expectAdjusted:   true,
+			expectedUsername: "iam-user@teleport-project-123.iam",
+		},
+		{
+			name:             "do not change long name",
+			username:         "iam-user@other-project.iam",
+			db:               gcpPostgresDB,
+			expectAdjusted:   false,
+			expectedUsername: "",
+		},
+		{
+			name:             "ignore empty username",
+			username:         "",
+			db:               gcpPostgresDB,
+			expectAdjusted:   false,
+			expectedUsername: "",
+		},
+		{
+			name:             "ignore non-GCP database",
+			username:         "alice",
+			db:               nonGCPDB,
+			expectAdjusted:   false,
+			expectedUsername: "",
+		},
+		{
+			name:             "ignore non-Postgres database",
+			username:         "iam-user",
+			db:               gcpMySQLDB,
+			expectAdjusted:   false,
+			expectedUsername: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			adjusted, newUsername := AdjustDatabaseUsername(tc.username, tc.db)
+			require.Equal(t, tc.expectedUsername, newUsername)
+			require.Equal(t, tc.expectAdjusted, adjusted)
+		})
+	}
+}
diff --git a/lib/gcp/gcp.go b/lib/gcp/gcp.go
deleted file mode 100644
index 7a5ce919fb360..0000000000000
--- a/lib/gcp/gcp.go
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package gcp
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// defaultIssuerHost is the issuer for GCP ID tokens.
-const defaultIssuerHost = "accounts.google.com"
-
-// ComputeEngine contains VM-specific token claims.
-type ComputeEngine struct {
-	// The ID of the instance's project.
-	ProjectID string `json:"project_id"`
-	// The instance's zone.
-	Zone string `json:"zone"`
-	// The instance's ID.
-	InstanceID string `json:"instance_id"`
-	// The instance's name.
-	InstanceName string `json:"instance_name"`
-}
-
-// Google contains Google-specific token claims.
-type Google struct {
-	ComputeEngine ComputeEngine `json:"compute_engine"`
-}
-
-// IDTokenClaims is the set of claims in a GCP ID token. GCP documentation for
-// claims can be found at
-// https://cloud.google.com/compute/docs/instances/verifying-instance-identity#payload
-type IDTokenClaims struct {
-	oidc.TokenClaims
-	// The email of the service account that this token was issued for.
-	Email  string `json:"email"`
-	Google Google `json:"google"`
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGCP {
-	attrs := &workloadidentityv1pb.JoinAttrsGCP{
-		ServiceAccount: c.Email,
-	}
-	if c.Google.ComputeEngine.InstanceName != "" {
-		attrs.Gce = &workloadidentityv1pb.JoinAttrsGCPGCE{
-			Project: c.Google.ComputeEngine.ProjectID,
-			Zone:    c.Google.ComputeEngine.Zone,
-			Id:      c.Google.ComputeEngine.InstanceID,
-			Name:    c.Google.ComputeEngine.InstanceName,
-		}
-	}
-
-	return attrs
-}
diff --git a/lib/gcp/token_validator.go b/lib/gcp/token_validator.go
deleted file mode 100644
index ed03ca894685b..0000000000000
--- a/lib/gcp/token_validator.go
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package gcp
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/oidc"
-)
-
-const audience = "teleport.cluster.local"
-
-// IDTokenValidatorConfig is the config for IDTokenValidator.
-type IDTokenValidatorConfig struct {
-	// issuerHost is the host of the Issuer for tokens issued by Google, to be
-	// overridden in tests. Defaults to "accounts.google.com".
-	issuerHost string
-	// insecure configures the validator to use HTTP rather than HTTPS, to be
-	// overridden in tests.
-	insecure bool
-}
-
-// IDTokenValidator validates ID tokens from GCP.
-type IDTokenValidator struct {
-	IDTokenValidatorConfig
-}
-
-func NewIDTokenValidator(cfg IDTokenValidatorConfig) *IDTokenValidator {
-	if cfg.issuerHost == "" {
-		cfg.issuerHost = defaultIssuerHost
-	}
-	return &IDTokenValidator{
-		IDTokenValidatorConfig: cfg,
-	}
-}
-
-func (id *IDTokenValidator) issuerURL() string {
-	scheme := "https"
-	if id.insecure {
-		scheme = "http"
-	}
-	return fmt.Sprintf("%s://%s", scheme, id.issuerHost)
-}
-
-// Validate validates an ID token.
-func (id *IDTokenValidator) Validate(ctx context.Context, token string) (*IDTokenClaims, error) {
-	issuer := id.issuerURL()
-	claims, err := oidc.ValidateToken[*IDTokenClaims](ctx, issuer, audience, token)
-	if err != nil {
-		return nil, trace.Wrap(err, "validating token")
-	}
-
-	if claims.Google.ComputeEngine != (ComputeEngine{}) {
-		return claims, nil
-	}
-
-	if gcpDefaultServiceAccountEmailRegex.MatchString(claims.Email) {
-		return nil, trace.BadParameter("default compute engine service account %q is not supported", claims.Email)
-	}
-
-	// GKE Workload Identity tokens do not have the `google.compute_engine` claim
-	// and so to support Teleport services running on GKE, we need to extract the
-	// project ID from the email claim.
-	// Managed Service accounts running on GKE are not guaranteed to have domain emails
-	// with the following format: <sa_name>@<project_id>.iam.gserviceaccount.com
-	// See https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to_other_services
-	// See https://cloud.google.com/iam/docs/service-accounts#service_account_email_addresses
-	// See https://cloud.google.com/iam/docs/service-account-types#user-managed
-	matches := gcpUserManagedServiceAccountEmailRegex.FindStringSubmatch(claims.Email)
-	if len(matches) != 2 {
-		return nil, trace.BadParameter("invalid email claim: %q", claims.Email)
-	}
-
-	// Assign the project ID exatracted from the email to the Google claims.
-	claims.Google.ComputeEngine.ProjectID = matches[1]
-
-	return claims, nil
-}
-
-var (
-	// gcpUserManagedServiceAccountEmailRegex is the regex used to extract the project ID from
-	// the email claim of a GCP service account.
-	// See https://cloud.google.com/iam/docs/service-accounts#service_account_email_addresses
-	// See https://cloud.google.com/iam/docs/service-account-types#user-managed
-	gcpUserManagedServiceAccountEmailRegex = regexp.MustCompile(`(?s)^[^@]+@([^\.]+)\.iam\.gserviceaccount\.com$`)
-
-	// gcpDefaultServiceAccountEmailRegex is the regex used to identify when the default
-	// compute engine service account is being used. When this is the case, we return an
-	// error because the default compute engine service account is not supported.
-	gcpDefaultServiceAccountEmailRegex = regexp.MustCompile(`(?s)^[^@]+@developer\.gserviceaccount\.com$`)
-)
diff --git a/lib/gcp/token_validator_test.go b/lib/gcp/token_validator_test.go
deleted file mode 100644
index b9e79f2aaf217..0000000000000
--- a/lib/gcp/token_validator_test.go
+++ /dev/null
@@ -1,370 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package gcp
-
-import (
-	"context"
-	"crypto"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/go-jose/go-jose/v3"
-	"github.com/go-jose/go-jose/v3/jwt"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	"github.com/gravitational/teleport/lib/cryptosuites"
-)
-
-type fakeIDP struct {
-	t         *testing.T
-	signer    jose.Signer
-	publicKey crypto.PublicKey
-	server    *httptest.Server
-}
-
-func newFakeIDP(t *testing.T) *fakeIDP {
-	// GCP uses RSA, prefer to test with it.
-	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA2048)
-	require.NoError(t, err)
-
-	signer, err := jose.NewSigner(
-		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
-		(&jose.SignerOptions{}).WithType("JWT"),
-	)
-	require.NoError(t, err)
-
-	f := &fakeIDP{
-		signer:    signer,
-		publicKey: privateKey.Public(),
-		t:         t,
-	}
-
-	providerMux := http.NewServeMux()
-	providerMux.HandleFunc(
-		"/.well-known/openid-configuration",
-		f.handleOpenIDConfig,
-	)
-	providerMux.HandleFunc(
-		"/.well-known/jwks",
-		f.handleJWKSEndpoint,
-	)
-
-	srv := httptest.NewServer(providerMux)
-	t.Cleanup(srv.Close)
-	f.server = srv
-	return f
-}
-
-func (f *fakeIDP) issuer() string {
-	return f.server.URL
-}
-
-func (f *fakeIDP) handleOpenIDConfig(w http.ResponseWriter, r *http.Request) {
-	response := map[string]interface{}{
-		"claims_supported": []string{
-			"sub",
-			"aud",
-			"exp",
-			"iat",
-			"iss",
-			"azp",
-			"email",
-			"google",
-		},
-		"id_token_signing_alg_values_supported": []string{"RS256"},
-		"issuer":                                f.issuer(),
-		"jwks_uri":                              f.issuer() + "/.well-known/jwks",
-		"response_types_supported":              []string{"id_token"},
-		"scopes_supported":                      []string{"openid"},
-		"subject_types_supported":               []string{"public", "pairwise"},
-	}
-	responseBytes, err := json.Marshal(response)
-	require.NoError(f.t, err)
-	_, err = w.Write(responseBytes)
-	require.NoError(f.t, err)
-}
-
-func (f *fakeIDP) handleJWKSEndpoint(w http.ResponseWriter, r *http.Request) {
-	jwks := jose.JSONWebKeySet{
-		Keys: []jose.JSONWebKey{
-			{
-				Key: f.publicKey,
-			},
-		},
-	}
-	responseBytes, err := json.Marshal(jwks)
-	require.NoError(f.t, err)
-	_, err = w.Write(responseBytes)
-	require.NoError(f.t, err)
-}
-
-func (f *fakeIDP) issueToken(
-	t *testing.T,
-	issuer,
-	audience,
-	sub string,
-	claims IDTokenClaims,
-	issuedAt time.Time,
-	expiry time.Time,
-) string {
-	stdClaims := jwt.Claims{
-		Issuer:    issuer,
-		Subject:   sub,
-		Audience:  jwt.Audience{audience},
-		IssuedAt:  jwt.NewNumericDate(issuedAt),
-		NotBefore: jwt.NewNumericDate(issuedAt),
-		Expiry:    jwt.NewNumericDate(expiry),
-	}
-	token, err := jwt.Signed(f.signer).
-		Claims(stdClaims).
-		Claims(claims).
-		CompactSerialize()
-	require.NoError(t, err)
-
-	return token
-}
-
-func TestIDTokenValidator_Validate(t *testing.T) {
-	t.Parallel()
-	idp := newFakeIDP(t)
-	clock := clockwork.NewFakeClock()
-
-	sampleCE := IDTokenClaims{
-		Google: Google{
-			ComputeEngine: ComputeEngine{
-				ProjectID:    "12345678",
-				Zone:         "z",
-				InstanceID:   "87654321",
-				InstanceName: "test-instance",
-			},
-		},
-	}
-	tests := []struct {
-		name        string
-		assertError require.ErrorAssertionFunc
-		want        IDTokenClaims
-		token       string
-	}{
-		{
-			name:        "success",
-			assertError: require.NoError,
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				sampleCE,
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-			want: sampleCE,
-		},
-		{
-			name:        "success but without compute engine claims",
-			assertError: require.NoError,
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.com",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-			want: IDTokenClaims{
-				Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.com",
-				Google: Google{
-					ComputeEngine: ComputeEngine{
-						ProjectID: "project-id",
-					},
-				},
-			},
-		},
-		{
-			name: "default service account: @developer.gserviceaccount.com domain",
-			assertError: func(tt require.TestingT, err error, i ...any) {
-				require.Error(tt, err, i...)
-				require.Contains(tt, err.Error(), "default compute engine service account")
-			},
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "tiago-1-sa-test2@developer.gserviceaccount.com",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name: "invalid service account email: gserviceaccount.com domain",
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.Error(tt, err, i...)
-				require.Contains(tt, err.Error(), "invalid email claim")
-			},
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "tiago-1-sa-test2@project-id.gserviceaccount.coma",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name: "invalid service account email: gserviceaccount.coma domain",
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.Error(tt, err, i...)
-				require.Contains(tt, err.Error(), "invalid email claim")
-			},
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.coma",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name: "invalid service account email: google domain",
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.Error(tt, err, i...)
-				require.Contains(tt, err.Error(), "invalid email claim")
-			},
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "tiago-1-sa-test2@project-id.iam.google.com",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name: "empty service account email",
-			assertError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.Error(tt, err, i...)
-				require.Contains(tt, err.Error(), "invalid email claim")
-			},
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				IDTokenClaims{
-					Email: "",
-				},
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name:        "expired",
-			assertError: require.Error,
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				sampleCE,
-				clock.Now().Add(-15*time.Minute),
-				clock.Now().Add(-5*time.Minute),
-			),
-		},
-		{
-			name:        "future",
-			assertError: require.Error,
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"teleport.cluster.local",
-				"abcd1234",
-				sampleCE,
-				clock.Now().Add(10*time.Minute),
-				clock.Now().Add(20*time.Minute),
-			),
-		},
-		{
-			name:        "invalid audience",
-			assertError: require.Error,
-			token: idp.issueToken(
-				t,
-				idp.issuer(),
-				"incorrect.audience",
-				"abcd1234",
-				sampleCE,
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-		{
-			name:        "invalid issuer",
-			assertError: require.Error,
-			token: idp.issueToken(
-				t,
-				"http://the.wrong.issuer",
-				"teleport.cluster.local",
-				"abcd1234",
-				sampleCE,
-				clock.Now().Add(-5*time.Minute),
-				clock.Now().Add(5*time.Minute),
-			),
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
-			v := NewIDTokenValidator(IDTokenValidatorConfig{
-				issuerHost: idp.server.Listener.Addr().String(),
-				insecure:   true,
-			})
-			claims, err := v.Validate(ctx, tc.token)
-			tc.assertError(t, err)
-			if err != nil {
-				return
-			}
-			require.NotNil(t, claims)
-			require.Empty(t,
-				cmp.Diff(*claims, tc.want, cmpopts.IgnoreTypes(oidc.TokenClaims{})),
-			)
-		})
-	}
-}
diff --git a/lib/githubactions/githubactions.go b/lib/githubactions/githubactions.go
deleted file mode 100644
index e4172312804d8..0000000000000
--- a/lib/githubactions/githubactions.go
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package githubactions
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// GitHub Workload Identity
-//
-// GH provides workloads with two environment variables to facilitate fetching
-// a ID token for that workload.
-//
-// ACTIONS_ID_TOKEN_REQUEST_TOKEN: A token that can be redeemed against the
-// identity service for an ID token.
-// ACTIONS_ID_TOKEN_REQUEST_URL: Indicates the URL of the identity service.
-//
-// To redeem the request token for an ID token, a GET request shall be made
-// to the specified URL with the specified token provided as a Bearer token
-// using the Authorization header.
-//
-// The `audience` query parameter can be used to customize the audience claim
-// within the resulting ID token.
-//
-// Valuable reference:
-// - https://github.com/actions/toolkit/blob/main/packages/core/src/oidc-utils.ts
-// - https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers
-//
-// The GitHub Issuer's well-known OIDC document is at
-// https://token.actions.githubusercontent.com/.well-known/openid-configuration
-// For GitHub Enterprise Servers, this will be at
-// https://$HOSTNAME/_services/token/.well-known/openid-configuration
-
-const DefaultIssuerHost = "token.actions.githubusercontent.com"
-
-// IDTokenClaims is the structure of claims contained within a Github issued
-// ID token.
-//
-// See the following for the structure:
-// https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token
-type IDTokenClaims struct {
-	oidc.TokenClaims
-	// Sub also known as Subject is a string that roughly uniquely indentifies
-	// the workload. The format of this varies depending on the type of
-	// github action run.
-	Sub string `json:"sub"`
-	// The personal account that initiated the workflow run.
-	Actor string `json:"actor"`
-	// The ID of personal account that initiated the workflow run.
-	ActorID string `json:"actor_id"`
-	// The target branch of the pull request in a workflow run.
-	BaseRef string `json:"base_ref"`
-	// The name of the environment used by the job.
-	Environment string `json:"environment"`
-	// The name of the event that triggered the workflow run.
-	EventName string `json:"event_name"`
-	// The source branch of the pull request in a workflow run.
-	HeadRef string `json:"head_ref"`
-	// This is the ref path to the reusable workflow used by this job.
-	JobWorkflowRef string `json:"job_workflow_ref"`
-	// The git ref that triggered the workflow run.
-	Ref string `json:"ref"`
-	// The type of ref, for example: "branch".
-	RefType string `json:"ref_type"`
-	// The visibility of the repository where the workflow is running. Accepts the following values: internal, private, or public.
-	RepositoryVisibility string `json:"repository_visibility"`
-	// The repository from where the workflow is running.
-	// This includes the name of the owner e.g `gravitational/teleport`
-	Repository string `json:"repository"`
-	// The ID of the repository from where the workflow is running.
-	RepositoryID string `json:"repository_id"`
-	// The name of the organization in which the repository is stored.
-	RepositoryOwner string `json:"repository_owner"`
-	// The ID of the organization in which the repository is stored.
-	RepositoryOwnerID string `json:"repository_owner_id"`
-	// The ID of the workflow run that triggered the workflow.
-	RunID string `json:"run_id"`
-	// The number of times this workflow has been run.
-	RunNumber string `json:"run_number"`
-	// The number of times this workflow run has been retried.
-	RunAttempt string `json:"run_attempt"`
-	// SHA is the commit SHA that triggered the workflow run.
-	SHA string `json:"sha"`
-	// The name of the workflow.
-	Workflow string `json:"workflow"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitHub {
-	attrs := &workloadidentityv1pb.JoinAttrsGitHub{
-		Sub:             c.Sub,
-		Actor:           c.Actor,
-		Environment:     c.Environment,
-		Ref:             c.Ref,
-		RefType:         c.RefType,
-		Repository:      c.Repository,
-		RepositoryOwner: c.RepositoryOwner,
-		Workflow:        c.Workflow,
-		EventName:       c.EventName,
-		Sha:             c.SHA,
-		RunId:           c.RunID,
-	}
-
-	return attrs
-}
diff --git a/lib/gitlab/gitlab.go b/lib/gitlab/gitlab.go
deleted file mode 100644
index 4825292d01c65..0000000000000
--- a/lib/gitlab/gitlab.go
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package gitlab
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// GitLab Workload Identity
-//
-// GL provides workloads with the ID token in an environment variable included
-// in the workflow config, with the specified audience:
-//
-// ```yaml
-// job-name:
-//  id_tokens:
-//    TBOT_GITLAB_JWT:
-//      aud: https://teleport.example.com
-// ```
-//
-// We will require the user to configure this to be `TBOT_GITLAB_JWT` and to
-// set this value to the name of their Teleport cluster.
-//
-// Valuable reference:
-// - https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html
-// - https://docs.gitlab.com/ee/ci/cloud_services/
-// - https://docs.gitlab.com/ee/ci/yaml/index.html#id_tokens
-//
-// The GitLab issuer's well-known OIDC document is at
-// https://gitlab.com/.well-known/openid-configuration
-// For GitLab self-hosted servers, this will be at
-// https://$HOSTNAME/.well-known/openid-configuration
-//
-// The minimum supported GitLab version is 15.7, as this is when ID token
-// support was introduced.
-
-// IDTokenClaims is the structure of claims contained within a GitLab issued
-// ID token.
-//
-// See the following for the structure:
-// https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html#id-tokens
-type IDTokenClaims struct {
-	oidc.TokenClaims
-	// Sub roughly uniquely identifies the workload. Example:
-	// `project_path:mygroup/my-project:ref_type:branch:ref:main`
-	// project_path:{group}/{project}:ref_type:{type}:ref:{branch_name}
-	Sub string `json:"sub"`
-	// Git ref for this job
-	Ref string `json:"ref"`
-	// Git ref type. Example:
-	// `branch` or `tag`
-	RefType string `json:"ref_type"`
-	// 	true if the Git ref is protected, false otherwise.
-	RefProtected string `json:"ref_protected"`
-	// Use this to scope to group or user level namespace by path. Example:
-	// `mygroup`
-	NamespacePath string `json:"namespace_path"`
-	// Use this to scope to group or user level namespace by ID.
-	NamespaceID string `json:"namespace_id"`
-	// Use this to scope to project by path. Example:
-	// `mygroup/myproject`
-	ProjectPath string `json:"project_path"`
-	// Use this to scope to project by ID.
-	ProjectID string `json:"project_id"`
-	// ID of the user executing the job
-	UserID string `json:"user_id"`
-	// Username of the user executing the job
-	UserLogin string `json:"user_login"`
-	// Email of the user executing the job
-	UserEmail string `json:"user_email"`
-	// Pipeline source.
-	// https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules
-	// Example: `web`
-	PipelineSource string `json:"pipeline_source"`
-	// ID of the pipeline.
-	PipelineID string `json:"pipeline_id"`
-	// Environment this job deploys to (if one is associated)
-	Environment string `json:"environment"`
-	// 	true if deployed environment is protected, false otherwise
-	EnvironmentProtected string `json:"environment_protected"`
-	// 	Environment action (environment:action) specified in the job.
-	EnvironmentAction string `json:"environment_action"`
-	// The ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
-	CIConfigRefURI string `json:"ci_config_ref_uri"`
-	// Git commit SHA for the ci_config_ref_uri.
-	CIConfigSHA string `json:"ci_config_sha"`
-	// 	The commit SHA for the job.
-	SHA string `json:"sha"`
-	// ID of the runner executing the job.
-	RunnerID int `json:"runner_id"`
-	// The type of runner used by the job. Can be either gitlab-hosted or self-hosted
-	RunnerEnvironment string `json:"runner_environment"`
-	// Deployment tier of the environment the job specifies
-	DeploymentTier string `json:"deployment_tier"`
-	// The visibility of the project where the pipeline is running. Can be internal, private, or public.
-	ProjectVisibility string `json:"project_visibility"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitLab {
-	attrs := &workloadidentityv1pb.JoinAttrsGitLab{
-		Sub:                  c.Sub,
-		Ref:                  c.Ref,
-		RefType:              c.RefType,
-		RefProtected:         c.RefProtected == "true",
-		NamespacePath:        c.NamespacePath,
-		ProjectPath:          c.ProjectPath,
-		UserLogin:            c.UserLogin,
-		UserEmail:            c.UserEmail,
-		PipelineId:           c.PipelineID,
-		Environment:          c.Environment,
-		EnvironmentProtected: c.EnvironmentProtected == "true",
-		RunnerId:             int64(c.RunnerID),
-		RunnerEnvironment:    c.RunnerEnvironment,
-		Sha:                  c.SHA,
-		CiConfigRefUri:       c.CIConfigRefURI,
-		CiConfigSha:          c.CIConfigSHA,
-	}
-
-	return attrs
-}
diff --git a/lib/healthcheck/config.go b/lib/healthcheck/config.go
index 6f47966631eee..25953794ed102 100644
--- a/lib/healthcheck/config.go
+++ b/lib/healthcheck/config.go
@@ -33,13 +33,14 @@ import (
 // healthCheckConfig is an internal health check config type converted from a
 // [*healthcheckconfigv1.HealthCheckConfig] with defaults set.
 type healthCheckConfig struct {
-	name                  string
-	protocol              types.TargetHealthProtocol
-	interval              time.Duration
-	timeout               time.Duration
-	healthyThreshold      uint32
-	unhealthyThreshold    uint32
-	databaseLabelMatchers types.LabelMatchers
+	name                    string
+	interval                time.Duration
+	timeout                 time.Duration
+	healthyThreshold        uint32
+	unhealthyThreshold      uint32
+	disabled                bool
+	databaseLabelMatchers   types.LabelMatchers
+	kubernetesLabelMatchers types.LabelMatchers
 }
 
 // newHealthCheckConfig converts a health check config protobuf message into a
@@ -48,15 +49,14 @@ func newHealthCheckConfig(cfg *healthcheckconfigv1.HealthCheckConfig) *healthChe
 	spec := cfg.GetSpec()
 	match := spec.GetMatch()
 	return &healthCheckConfig{
-		name:               cfg.GetMetadata().GetName(),
-		timeout:            cmp.Or(spec.GetTimeout().AsDuration(), defaults.HealthCheckTimeout),
-		interval:           cmp.Or(spec.GetInterval().AsDuration(), defaults.HealthCheckInterval),
-		healthyThreshold:   cmp.Or(spec.GetHealthyThreshold(), defaults.HealthCheckHealthyThreshold),
-		unhealthyThreshold: cmp.Or(spec.GetUnhealthyThreshold(), defaults.HealthCheckUnhealthyThreshold),
-		// we only support plain TCP health checks currently, but eventually we
-		// may add support for other protocols such as TLS or HTTP
-		protocol:              types.TargetHealthProtocolTCP,
-		databaseLabelMatchers: newLabelMatchers(match.GetDbLabelsExpression(), match.GetDbLabels()),
+		name:                    cfg.GetMetadata().GetName(),
+		timeout:                 cmp.Or(spec.GetTimeout().AsDuration(), defaults.HealthCheckTimeout),
+		interval:                cmp.Or(spec.GetInterval().AsDuration(), defaults.HealthCheckInterval),
+		healthyThreshold:        cmp.Or(spec.GetHealthyThreshold(), defaults.HealthCheckHealthyThreshold),
+		unhealthyThreshold:      cmp.Or(spec.GetUnhealthyThreshold(), defaults.HealthCheckUnhealthyThreshold),
+		disabled:                match.Disabled,
+		databaseLabelMatchers:   newLabelMatchers(match.GetDbLabelsExpression(), match.GetDbLabels()),
+		kubernetesLabelMatchers: newLabelMatchers(match.GetKubernetesLabelsExpression(), match.GetKubernetesLabels()),
 	}
 }
 
@@ -66,21 +66,26 @@ func (h *healthCheckConfig) equivalent(other *healthCheckConfig) bool {
 	return (h == nil && other == nil) ||
 		h != nil && other != nil &&
 			h.name == other.name &&
-			h.protocol == other.protocol &&
 			h.interval == other.interval &&
+			h.timeout == other.timeout &&
 			h.healthyThreshold == other.healthyThreshold &&
-			h.unhealthyThreshold == other.unhealthyThreshold
+			h.unhealthyThreshold == other.unhealthyThreshold &&
+			h.disabled == other.disabled
 }
 
 // getLabelMatchers returns the label matchers to use for the given resource
 // kind.
 func (h *healthCheckConfig) getLabelMatchers(kind string) types.LabelMatchers {
-	switch kind {
-	case types.KindDatabase:
-		return h.databaseLabelMatchers
+	if !h.disabled {
+		switch kind {
+		case types.KindDatabase:
+			return h.databaseLabelMatchers
+		case types.KindKubernetesCluster:
+			return h.kubernetesLabelMatchers
+		}
 	}
-	// unreachable since we enforce a list of supported target resource kinds,
-	// but empty matchers do the right thing anyway: don't match anything.
+
+	// empty matchers don't match anything.
 	return types.LabelMatchers{}
 }
 
diff --git a/lib/healthcheck/config_test.go b/lib/healthcheck/config_test.go
index 8a1357ee061d9..2c08354567572 100644
--- a/lib/healthcheck/config_test.go
+++ b/lib/healthcheck/config_test.go
@@ -39,11 +39,17 @@ func Test_newHealthCheckConfig(t *testing.T) {
 		"full",
 		&healthcheckconfigv1.HealthCheckConfigSpec{
 			Match: &healthcheckconfigv1.Matcher{
+				Disabled: true,
 				DbLabels: []*labelv1.Label{{
 					Name:   "foo",
 					Values: []string{"bar", "baz"},
 				}},
 				DbLabelsExpression: `labels["qux"] == "*"`,
+				KubernetesLabels: []*labelv1.Label{{
+					Name:   "app",
+					Values: []string{"web", "api"},
+				}},
+				KubernetesLabelsExpression: `labels["lux"] == "*"`,
 			},
 			Timeout:            durationpb.New(time.Second * 42),
 			Interval:           durationpb.New(time.Second * 43),
@@ -57,7 +63,8 @@ func Test_newHealthCheckConfig(t *testing.T) {
 		"minimal",
 		&healthcheckconfigv1.HealthCheckConfigSpec{
 			Match: &healthcheckconfigv1.Matcher{
-				DbLabelsExpression: `labels["*"] == "*"`,
+				DbLabelsExpression:         `labels["*"] == "*"`,
+				KubernetesLabelsExpression: `labels["*"] == "*"`,
 			},
 		},
 	)
@@ -77,13 +84,19 @@ func Test_newHealthCheckConfig(t *testing.T) {
 				interval:           time.Second * 43,
 				healthyThreshold:   7,
 				unhealthyThreshold: 8,
-				protocol:           types.TargetHealthProtocolTCP,
+				disabled:           true,
 				databaseLabelMatchers: types.LabelMatchers{
 					Labels: types.Labels{
 						"foo": utils.Strings{"bar", "baz"},
 					},
 					Expression: `labels["qux"] == "*"`,
 				},
+				kubernetesLabelMatchers: types.LabelMatchers{
+					Labels: types.Labels{
+						"app": utils.Strings{"web", "api"},
+					},
+					Expression: `labels["lux"] == "*"`,
+				},
 			},
 		},
 		{
@@ -95,11 +108,14 @@ func Test_newHealthCheckConfig(t *testing.T) {
 				interval:           defaults.HealthCheckInterval,
 				healthyThreshold:   defaults.HealthCheckHealthyThreshold,
 				unhealthyThreshold: defaults.HealthCheckUnhealthyThreshold,
-				protocol:           types.TargetHealthProtocolTCP,
 				databaseLabelMatchers: types.LabelMatchers{
 					Labels:     types.Labels{},
 					Expression: `labels["*"] == "*"`,
 				},
+				kubernetesLabelMatchers: types.LabelMatchers{
+					Labels:     types.Labels{},
+					Expression: `labels["*"] == "*"`,
+				},
 			},
 		},
 	}
@@ -123,6 +139,12 @@ func TestHealthCheckConfig_equivalent(t *testing.T) {
 			b:    nil,
 			want: true,
 		},
+		{
+			desc: "both empty",
+			a:    &healthCheckConfig{},
+			b:    &healthCheckConfig{},
+			want: true,
+		},
 		{
 			desc: "one nil, one non-nil",
 			a:    &healthCheckConfig{},
@@ -133,37 +155,43 @@ func TestHealthCheckConfig_equivalent(t *testing.T) {
 			desc: "all fields equal",
 			a: &healthCheckConfig{
 				name:               "test",
-				protocol:           "http",
 				interval:           time.Second,
+				timeout:            500 * time.Millisecond,
 				healthyThreshold:   3,
 				unhealthyThreshold: 5,
+				disabled:           true,
 			},
 			b: &healthCheckConfig{
 				name:               "test",
-				protocol:           "http",
 				interval:           time.Second,
+				timeout:            500 * time.Millisecond,
 				healthyThreshold:   3,
 				unhealthyThreshold: 5,
+				disabled:           true,
 			},
 			want: true,
 		},
 		{
 			desc: "all fields equal ignoring labels",
 			a: &healthCheckConfig{
-				name:                  "test",
-				protocol:              "http",
-				interval:              time.Second,
-				healthyThreshold:      3,
-				unhealthyThreshold:    5,
-				databaseLabelMatchers: types.LabelMatchers{Expression: "a", Labels: types.Labels{"a": {"a"}}},
+				name:                    "test",
+				interval:                time.Second,
+				timeout:                 500 * time.Millisecond,
+				healthyThreshold:        3,
+				unhealthyThreshold:      5,
+				disabled:                true,
+				databaseLabelMatchers:   types.LabelMatchers{Expression: "a", Labels: types.Labels{"a": {"a"}}},
+				kubernetesLabelMatchers: types.LabelMatchers{Expression: "a", Labels: types.Labels{"a": {"a"}}},
 			},
 			b: &healthCheckConfig{
-				name:                  "test",
-				protocol:              "http",
-				interval:              time.Second,
-				healthyThreshold:      3,
-				unhealthyThreshold:    5,
-				databaseLabelMatchers: types.LabelMatchers{Expression: "b", Labels: types.Labels{"b": {"b"}}},
+				name:                    "test",
+				interval:                time.Second,
+				timeout:                 500 * time.Millisecond,
+				healthyThreshold:        3,
+				unhealthyThreshold:      5,
+				disabled:                true,
+				databaseLabelMatchers:   types.LabelMatchers{Expression: "b", Labels: types.Labels{"b": {"b"}}},
+				kubernetesLabelMatchers: types.LabelMatchers{Expression: "b", Labels: types.Labels{"b": {"b"}}},
 			},
 			want: true,
 		},
@@ -178,22 +206,22 @@ func TestHealthCheckConfig_equivalent(t *testing.T) {
 			want: false,
 		},
 		{
-			desc: "different protocol",
+			desc: "different interval",
 			a: &healthCheckConfig{
-				protocol: "http",
+				interval: time.Second,
 			},
 			b: &healthCheckConfig{
-				protocol: "tcp",
+				interval: 2 * time.Second,
 			},
 			want: false,
 		},
 		{
-			desc: "different interval",
+			desc: "different timeout",
 			a: &healthCheckConfig{
-				interval: time.Second,
+				timeout: time.Second,
 			},
 			b: &healthCheckConfig{
-				interval: 2 * time.Second,
+				timeout: 2 * time.Second,
 			},
 			want: false,
 		},
@@ -217,6 +245,16 @@ func TestHealthCheckConfig_equivalent(t *testing.T) {
 			},
 			want: false,
 		},
+		{
+			desc: "different disabled",
+			a: &healthCheckConfig{
+				disabled: true,
+			},
+			b: &healthCheckConfig{
+				disabled: false,
+			},
+			want: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
diff --git a/lib/healthcheck/manager.go b/lib/healthcheck/manager.go
index d4056fff851f3..6e66542bfe2b5 100644
--- a/lib/healthcheck/manager.go
+++ b/lib/healthcheck/manager.go
@@ -141,24 +141,25 @@ func (m *manager) Start(ctx context.Context) error {
 	return nil
 }
 
-// supportedTargetKinds is a list of resource kinds that support health checks.
-var supportedTargetKinds = []string{
-	types.KindDatabase,
-}
-
 // AddTarget adds a new target health checker and starts the health checker.
 func (m *manager) AddTarget(target Target) error {
 	if err := target.checkAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
 	resource := target.GetResource()
-	if !slices.Contains(supportedTargetKinds, resource.GetKind()) {
+	var metricType string
+	switch resource.GetKind() {
+	case types.KindDatabase:
+		metricType = teleport.MetricResourceDB
+	case types.KindKubernetesCluster:
+		metricType = teleport.MetricResourceKubernetes
+	default:
 		return trace.BadParameter("health check target resource kind %q is not supported", resource.GetKind())
 	}
 
+	key := newResourceKey(resource)
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	key := newResourceKey(resource)
 	if _, ok := m.workers[key]; ok {
 		return trace.AlreadyExists("target health checker %q already exists", key)
 	}
@@ -170,7 +171,8 @@ func (m *manager) AddTarget(target Target) error {
 			"target_kind", resource.GetKind(),
 			"target_origin", resource.Origin(),
 		),
-		Target: target,
+		Target:     target,
+		metricType: metricType,
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -202,9 +204,9 @@ func (m *manager) RemoveTarget(r types.ResourceWithLabels) error {
 // GetTargetHealth returns the health of a given resource.
 func (m *manager) GetTargetHealth(r types.ResourceWithLabels) (*types.TargetHealth, error) {
 	m.mu.RLock()
-	defer m.mu.RUnlock()
 	key := newResourceKey(r)
 	worker, ok := m.workers[key]
+	m.mu.RUnlock()
 	if !ok {
 		return nil, trace.NotFound("health checker %q not found", key)
 	}
@@ -326,6 +328,10 @@ func (m *manager) updateWorkersLocked(ctx context.Context) {
 // getConfigLocked gets a matching config for the the given resource or returns
 // nil if no config matches.
 func (m *manager) getConfigLocked(ctx context.Context, r types.ResourceWithLabels) *healthCheckConfig {
+	if m.configs == nil {
+		m.logger.DebugContext(ctx, "Health check config unavailable")
+		return nil
+	}
 	for _, cfg := range m.configs {
 		matched, _, err := services.CheckLabelsMatch(
 			types.Allow,
diff --git a/lib/healthcheck/manager_test.go b/lib/healthcheck/manager_test.go
index 8f43f2201380d..66ab3853acf53 100644
--- a/lib/healthcheck/manager_test.go
+++ b/lib/healthcheck/manager_test.go
@@ -33,6 +33,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	"github.com/gravitational/teleport"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
@@ -42,11 +43,11 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -125,6 +126,9 @@ func TestManager(t *testing.T) {
 	healthConfigSvc, err := local.NewHealthCheckConfigService(bk)
 	require.NoError(t, err)
 
+	// disable virtual defaults to allow testing explicit config matching behavior
+	disableVirtualHealthCheckDefaults(t, ctx, healthConfigSvc)
+
 	// create a health check config that only matches prod databases
 	prodHCC := healthCheckConfigFixture(t, "prod")
 	prodHCC.Spec.Match.DbLabelsExpression = `labels.env == "prod"`
@@ -134,7 +138,7 @@ func TestManager(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	eventsCh := make(chan testEvent, 1024)
 	mgr, err := NewManager(ctx, ManagerConfig{
-		Component:               "test",
+		Component:               teleport.ComponentDatabase,
 		Events:                  local.NewEventsService(bk),
 		HealthCheckConfigReader: healthConfigSvc,
 		Clock:                   clock,
@@ -150,7 +154,8 @@ func TestManager(t *testing.T) {
 		mgr.mu.RLock()
 		configs := mgr.configs[:]
 		mgr.mu.RUnlock()
-		require.Len(t, configs, 1, "starting the manager should have blocked until configs were initialized")
+		require.Len(t, configs, 1+teleport.VirtualDefaultHealthCheckConfigCount,
+			"starting the manager should have blocked until configs were initialized")
 	}
 
 	listener, err := net.Listen("tcp", "localhost:0")
@@ -180,17 +185,19 @@ func TestManager(t *testing.T) {
 	var endpointMu sync.Mutex
 	prodDialer := fakeDialer{}
 	err = mgr.AddTarget(Target{
+		HealthChecker: &TargetDialer{
+			Resolver: func(ctx context.Context) ([]string, error) {
+				endpointMu.Lock()
+				defer endpointMu.Unlock()
+				return []string{prodDB.GetURI()}, nil
+			},
+			dial: prodDialer.DialContext,
+		},
 		GetResource: func() types.ResourceWithLabels {
 			endpointMu.Lock()
 			defer endpointMu.Unlock()
 			return prodDB
 		},
-		ResolverFn: func(ctx context.Context) ([]string, error) {
-			endpointMu.Lock()
-			defer endpointMu.Unlock()
-			return []string{prodDB.GetURI()}, nil
-		},
-		dialFn: prodDialer.DialContext,
 		onHealthCheck: func(lastResultErr error) {
 			eventsCh <- lastResultTestEvent(prodDB.GetName(), lastResultErr)
 		},
@@ -204,18 +211,20 @@ func TestManager(t *testing.T) {
 	require.NoError(t, err)
 
 	devDialer := fakeDialer{}
-	err = mgr.AddTarget(Target{
+	devTarget := Target{
+		HealthChecker: &TargetDialer{
+			Resolver: func(ctx context.Context) ([]string, error) {
+				endpointMu.Lock()
+				defer endpointMu.Unlock()
+				return []string{devDB.GetURI()}, nil
+			},
+			dial: devDialer.DialContext,
+		},
 		GetResource: func() types.ResourceWithLabels {
 			endpointMu.Lock()
 			defer endpointMu.Unlock()
 			return devDB
 		},
-		ResolverFn: func(ctx context.Context) ([]string, error) {
-			endpointMu.Lock()
-			defer endpointMu.Unlock()
-			return []string{devDB.GetURI()}, nil
-		},
-		dialFn: devDialer.DialContext,
 		onHealthCheck: func(lastResultErr error) {
 			eventsCh <- lastResultTestEvent(devDB.GetName(), lastResultErr)
 		},
@@ -225,34 +234,32 @@ func TestManager(t *testing.T) {
 		onClose: func() {
 			eventsCh <- closedTestEvent(devDB.GetName())
 		},
-	})
+	}
+	err = mgr.AddTarget(devTarget)
 	require.NoError(t, err)
 
 	t.Run("duplicate target is an error", func(t *testing.T) {
-		err = mgr.AddTarget(Target{
-			GetResource: func() types.ResourceWithLabels { return devDB },
-			ResolverFn:  func(ctx context.Context) ([]string, error) { return nil, nil },
-		})
+		err = mgr.AddTarget(devTarget)
 		require.Error(t, err)
-		require.IsType(t, trace.AlreadyExists(""), err)
+		require.ErrorIs(t, trace.AlreadyExists("target health checker \"name=devDB, kind=db\" already exists"), err)
 	})
 	t.Run("unsupported target resource is an error", func(t *testing.T) {
 		err = mgr.AddTarget(Target{
-			GetResource: func() types.ResourceWithLabels { return &fakeResource{kind: "node"} },
-			ResolverFn:  func(ctx context.Context) ([]string, error) { return nil, nil },
+			HealthChecker: &TargetDialer{
+				Resolver: func(ctx context.Context) ([]string, error) {
+					endpointMu.Lock()
+					defer endpointMu.Unlock()
+					return nil, nil
+				},
+			},
+			GetResource: func() types.ResourceWithLabels {
+				return &fakeResource{kind: "node"}
+			},
 		})
 		require.Error(t, err)
-		require.IsType(t, trace.BadParameter(""), err)
+		require.ErrorIs(t, trace.BadParameter("health check target resource kind \"node\" is not supported"), err)
 	})
 
-	requireTargetHealth := func(t *testing.T, r types.ResourceWithLabels, status types.TargetHealthStatus, reason types.TargetHealthTransitionReason) {
-		t.Helper()
-		health, err := mgr.GetTargetHealth(r)
-		require.NoError(t, err)
-		require.Equal(t, string(status), health.Status)
-		require.Equal(t, string(reason), health.TransitionReason)
-	}
-
 	prodPass := lastResultPassTestEvent(prodDB.GetName())
 	prodFail := lastResultFailTestEvent(prodDB.GetName())
 	// initially checks should be disabled for dev but enabled for prod
@@ -261,8 +268,8 @@ func TestManager(t *testing.T) {
 		deny(prodFail),
 		denyAll(devDB.GetName()),
 	)
-	requireTargetHealth(t, devDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// another check should reach the prodHCC configured threshold.
 	awaitTestEvents(t, eventsCh, clock,
@@ -271,7 +278,7 @@ func TestManager(t *testing.T) {
 		deny(prodFail),
 		denyAll(devDB.GetName()),
 	)
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// now reject health check connections to simulate an unhealthy endpoint
 	prodDialer.deny()
@@ -281,7 +288,7 @@ func TestManager(t *testing.T) {
 		expect(prodFail, prodFail),
 		deny(prodPass),
 		denyAll(devDB.GetName()))
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// enable dev health checks for dev db and simulate an unhealthy endpoint on init
 	devDialer.deny()
@@ -303,7 +310,7 @@ func TestManager(t *testing.T) {
 		expect(devFail, prodFail),
 		deny(prodPass, devPass),
 	)
-	requireTargetHealth(t, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// the next dev check should update health status because the unhealthy threshold was met
 	awaitTestEvents(t, eventsCh, clock,
@@ -311,7 +318,7 @@ func TestManager(t *testing.T) {
 		expect(devFail, prodFail),
 		deny(prodPass, devPass),
 	)
-	requireTargetHealth(t, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// set the unhealthy threshold high for dev, so we can simulate several
 	// failing checks after dev becomes healthy without making it become unhealthy
@@ -336,8 +343,8 @@ func TestManager(t *testing.T) {
 		expect(devPass, prodPass),
 		deny(devFail, prodFail),
 	)
-	requireTargetHealth(t, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// now disable the prod health checks
 	err = healthConfigSvc.DeleteHealthCheckConfig(ctx, "prod")
@@ -354,9 +361,9 @@ func TestManager(t *testing.T) {
 		deny(devFail, prodFail),
 	)
 	// prod db should be disabled eventually
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
 	// but dev db should still be healthy
-	requireTargetHealth(t, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// fail some checks, then update config to lower the unhealthy threshold
 	devDialer.deny()
@@ -366,7 +373,7 @@ func TestManager(t *testing.T) {
 		expect(devFail, devFail, devFail),
 		denyAll(prodDB.GetName()),
 	)
-	requireTargetHealth(t, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
 	devHCC.Spec.UnhealthyThreshold = 1
 	devHCC.Spec.Interval = durationpb.New(time.Second * 100)
 	_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, devHCC)
@@ -378,7 +385,7 @@ func TestManager(t *testing.T) {
 		deny(devPass, devFail),
 	)
 	// config update should set unhealthy status since the new threshold is already met
-	requireTargetHealth(t, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
+	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusUnhealthy, types.TargetHealthTransitionReasonThreshold)
 
 	// remove a target
 	err = mgr.RemoveTarget(devDB)
@@ -386,14 +393,14 @@ func TestManager(t *testing.T) {
 	// shouldn't be any target health after the target is removed
 	_, err = mgr.GetTargetHealth(devDB)
 	require.Error(t, err)
-	require.IsType(t, trace.NotFound(""), err)
+	require.ErrorIs(t, trace.NotFound("health checker \"name=devDB, kind=db\" not found"), err)
 
 	err = mgr.RemoveTarget(devDB)
 	require.Error(t, err)
-	require.IsType(t, trace.NotFound(""), err)
+	require.ErrorIs(t, trace.NotFound("health checker \"name=devDB, kind=db\" not found"), err)
 
 	// prodDB should still be disabled
-	requireTargetHealth(t, prodDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
+	requireTargetHealth(t, mgr, prodDB, types.TargetHealthStatusUnknown, types.TargetHealthTransitionReasonDisabled)
 	err = mgr.RemoveTarget(prodDB)
 	require.NoError(t, err)
 
@@ -404,6 +411,198 @@ func TestManager(t *testing.T) {
 	)
 }
 
+func TestManager_VirtualDefaults(t *testing.T) {
+	t.Parallel()
+	// Verify that health check Manager correctly loads and uses virtual defaults.
+	// Exercises Manager + HealthCheckConfigService + Worker coordination with virtual defaults.
+	tests := []struct {
+		name               string
+		component          string
+		virtualDefaultName string
+		createResource     func() (types.ResourceWithLabels, error)
+		setupHealthChecker func(t *testing.T) (HealthChecker, func())
+	}{
+		{
+			name:               "database",
+			component:          teleport.ComponentDatabase,
+			virtualDefaultName: teleport.VirtualDefaultHealthCheckConfigDBName,
+			createResource: func() (types.ResourceWithLabels, error) {
+				return types.NewDatabaseV3(types.Metadata{
+					Name: "test-db",
+				}, types.DatabaseSpecV3{
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "unused",
+				})
+			},
+			setupHealthChecker: func(t *testing.T) (HealthChecker, func()) {
+				listener, err := net.Listen("tcp", "localhost:0")
+				require.NoError(t, err)
+				dialer := &fakeDialer{}
+				checker := &TargetDialer{
+					Resolver: func(ctx context.Context) ([]string, error) {
+						return []string{listener.Addr().String()}, nil
+					},
+					dial: dialer.DialContext,
+				}
+				cleanup := func() { _ = listener.Close() }
+				return checker, cleanup
+			},
+		},
+		{
+			name:               "kube",
+			component:          teleport.ComponentKube,
+			virtualDefaultName: teleport.VirtualDefaultHealthCheckConfigKubeName,
+			createResource: func() (types.ResourceWithLabels, error) {
+				return types.NewKubernetesClusterV3(types.Metadata{
+					Name: "test-kube",
+				}, types.KubernetesClusterSpecV3{})
+			},
+			setupHealthChecker: func(t *testing.T) (HealthChecker, func()) {
+				checker := &fakeKubeHealthChecker{}
+				cleanup := func() {}
+				return checker, cleanup
+			},
+		},
+	}
+
+	ctx := t.Context()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			// setup backend and health check config service
+			bk, err := memory.New(memory.Config{Context: ctx})
+			require.NoError(t, err)
+			healthConfigSvc, err := local.NewHealthCheckConfigService(bk)
+			require.NoError(t, err)
+
+			clock := clockwork.NewFakeClock()
+			eventsCh := make(chan testEvent, 1024)
+			mgr, err := NewManager(ctx, ManagerConfig{
+				Component:               tt.component,
+				Events:                  local.NewEventsService(bk),
+				HealthCheckConfigReader: healthConfigSvc,
+				Clock:                   clock,
+			})
+			require.NoError(t, err)
+			require.NoError(t, mgr.Start(ctx))
+			t.Cleanup(func() {
+				require.NoError(t, mgr.Close())
+			})
+
+			resource, err := tt.createResource()
+			require.NoError(t, err)
+
+			healthChecker, cleanup := tt.setupHealthChecker(t)
+			t.Cleanup(cleanup)
+
+			err = mgr.AddTarget(Target{
+				HealthChecker: healthChecker,
+				GetResource: func() types.ResourceWithLabels {
+					return resource
+				},
+				onHealthCheck: func(lastResultErr error) {
+					eventsCh <- lastResultTestEvent(resource.GetName(), lastResultErr)
+				},
+				onConfigUpdate: func() {
+					eventsCh <- configUpdateTestEvent(resource.GetName())
+				},
+			})
+			require.NoError(t, err)
+
+			// virtual defaults start with health checks enabled and matching all resources
+			passEvent := lastResultPassTestEvent(resource.GetName())
+			awaitTestEvents(t, eventsCh, clock,
+				advanceCount(int(apidefaults.HealthCheckHealthyThreshold)),
+				expect(passEvent, passEvent),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusHealthy,
+				types.TargetHealthTransitionReasonThreshold)
+
+			// get the virtual default
+			// modify default to detect change after deletion
+			virtualDefault, err := healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
+			require.NoError(t, err)
+			modifiedUnhealthyThreshold := uint32(3)
+			virtualDefault.Spec.UnhealthyThreshold = modifiedUnhealthyThreshold
+			virtualDefault.Spec.Match.Disabled = true
+
+			// save modified virtual default to the backend
+			_, err = healthConfigSvc.CreateHealthCheckConfig(ctx, virtualDefault)
+			require.NoError(t, err)
+			awaitTestEvents(t, eventsCh, nil,
+				expect(configUpdateTestEvent(resource.GetName())),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusUnknown,
+				types.TargetHealthTransitionReasonDisabled)
+
+			// delete persisted virtual default
+			err = healthConfigSvc.DeleteHealthCheckConfig(ctx, tt.virtualDefaultName)
+			require.NoError(t, err)
+			awaitTestEvents(t, eventsCh, nil,
+				expect(configUpdateTestEvent(resource.GetName())),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusUnknown,
+				types.TargetHealthTransitionReasonInit) // init because worker restarted with new config
+
+			// get the new virtual default which has not been persisted
+			// expect original default values
+			afterDelete, err := healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
+			require.NoError(t, err)
+			require.False(t, afterDelete.Spec.Match.Disabled,
+				"expecting virtual default to revert enabled state")
+			require.NotEqual(t, modifiedUnhealthyThreshold, afterDelete.Spec.UnhealthyThreshold,
+				"expecting virtual default should revert to original unhealthy threshold")
+			awaitTestEvents(t, eventsCh, clock,
+				advanceCount(int(apidefaults.HealthCheckHealthyThreshold)),
+				expect(passEvent, passEvent),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusHealthy,
+				types.TargetHealthTransitionReasonThreshold)
+
+			// disable to stop checking health
+			virtualDefault, err = healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
+			require.NoError(t, err)
+			virtualDefault.Spec.Match.Disabled = true
+			_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, virtualDefault)
+			require.NoError(t, err)
+			awaitTestEvents(t, eventsCh, nil,
+				expect(configUpdateTestEvent(resource.GetName())),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusUnknown,
+				types.TargetHealthTransitionReasonDisabled)
+
+			// re-enabling config matcher starts health checks
+			virtualDefault.Spec.Match.Disabled = false
+			_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, virtualDefault)
+			require.NoError(t, err)
+
+			awaitTestEvents(t, eventsCh, clock,
+				expect(configUpdateTestEvent(resource.GetName())),
+				advanceCount(int(apidefaults.HealthCheckHealthyThreshold)),
+				expect(passEvent),
+			)
+			requireTargetHealth(t, mgr, resource,
+				types.TargetHealthStatusHealthy,
+				types.TargetHealthTransitionReasonThreshold)
+
+		})
+	}
+}
+
+func requireTargetHealth(t *testing.T, mgr Manager, r types.ResourceWithLabels, status types.TargetHealthStatus, reason types.TargetHealthTransitionReason) {
+	t.Helper()
+	health, err := mgr.GetTargetHealth(r)
+	require.NoError(t, err)
+	require.Equal(t, string(status), health.Status)
+	require.Equal(t, string(reason), health.TransitionReason)
+}
+
 func healthCheckConfigFixture(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	out, err := healthcheckconfig.NewHealthCheckConfig(name,
@@ -558,6 +757,17 @@ func (f *fakeDialer) DialContext(ctx context.Context, network, addr string) (net
 	return f.Dialer.DialContext(ctx, network, addr)
 }
 
+type fakeKubeHealthChecker struct {
+}
+
+func (m *fakeKubeHealthChecker) CheckHealth(ctx context.Context) ([]string, error) {
+	return []string{"https://localhost:6443"}, nil
+}
+
+func (m *fakeKubeHealthChecker) GetProtocol() types.TargetHealthProtocol {
+	return types.TargetHealthProtocolHTTP
+}
+
 type testEvent struct {
 	name   testEventName
 	target string
@@ -606,3 +816,18 @@ func lastResultFailTestEvent(targetName string) testEvent {
 		target: targetName,
 	}
 }
+
+func disableVirtualHealthCheckDefaults(t *testing.T, ctx context.Context, svc *local.HealthCheckConfigService) {
+	t.Helper()
+	virtualDefaults := []string{
+		teleport.VirtualDefaultHealthCheckConfigDBName,
+		teleport.VirtualDefaultHealthCheckConfigKubeName,
+	}
+	for _, name := range virtualDefaults {
+		cfg, err := svc.GetHealthCheckConfig(ctx, name)
+		require.NoError(t, err)
+		cfg.Spec.Match.Disabled = true
+		_, err = svc.UpdateHealthCheckConfig(ctx, cfg)
+		require.NoError(t, err)
+	}
+}
diff --git a/lib/healthcheck/net.go b/lib/healthcheck/net.go
new file mode 100644
index 0000000000000..13b37dde93c0a
--- /dev/null
+++ b/lib/healthcheck/net.go
@@ -0,0 +1,108 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthcheck
+
+import (
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Resolver resolves database endpoints.
+type Resolver interface {
+	// Resolve resolves database endpoints.
+	Resolve(ctx context.Context) ([]string, error)
+}
+
+// EndpointsResolverFunc is callback func that returns endpoints for a target.
+type EndpointsResolverFunc func(ctx context.Context) ([]string, error)
+
+// Resolve resolves database endpoints.
+func (f EndpointsResolverFunc) Resolve(ctx context.Context) ([]string, error) {
+	return f(ctx)
+}
+
+// dialFunc dials an address on the given network.
+type dialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
+
+// TargetDialer is a health check target which uses a net.Dialer.
+type TargetDialer struct {
+	// Resolver resolves the target endpoint(s).
+	Resolver EndpointsResolverFunc
+	// dial is used to dial network connections.
+	dial dialFunc
+}
+
+// NewTargetDialer returns a new TargetDialer ready for use.
+func NewTargetDialer(resolver EndpointsResolverFunc) *TargetDialer {
+	return &TargetDialer{
+		Resolver: resolver,
+		dial:     defaultDialer().DialContext,
+	}
+}
+
+// GetProtocol returns the network protocol used for checking health.
+func (t *TargetDialer) GetProtocol() types.TargetHealthProtocol {
+	return types.TargetHealthProtocolTCP
+}
+
+// CheckHealth checks the health of the target resource.
+func (t *TargetDialer) CheckHealth(ctx context.Context) ([]string, error) {
+	return t.dialEndpoints(ctx)
+}
+
+func (t *TargetDialer) dialEndpoints(ctx context.Context) ([]string, error) {
+	endpoints, err := t.Resolver(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to resolve target endpoints")
+	}
+	switch len(endpoints) {
+	case 0:
+		return nil, trace.NotFound("resolved zero target endpoints")
+	case 1:
+		return endpoints, t.dialEndpoint(ctx, endpoints[0])
+	default:
+		group, ctx := errgroup.WithContext(ctx)
+		group.SetLimit(10)
+		for _, ep := range endpoints {
+			group.Go(func() error {
+				return trace.Wrap(t.dialEndpoint(ctx, ep))
+			})
+		}
+		return endpoints, group.Wait()
+	}
+}
+
+func (t *TargetDialer) dialEndpoint(ctx context.Context, endpoint string) error {
+	conn, err := t.dial(ctx, "tcp", endpoint)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// an error while closing the connection could indicate an RST packet from
+	// the endpoint - that's a health check failure.
+	return trace.Wrap(conn.Close())
+}
+
+func defaultDialer() *net.Dialer {
+	return &net.Dialer{}
+}
diff --git a/lib/healthcheck/net_test.go b/lib/healthcheck/net_test.go
new file mode 100644
index 0000000000000..b5880f5dc2c6c
--- /dev/null
+++ b/lib/healthcheck/net_test.go
@@ -0,0 +1,117 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthcheck
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestTargetDialer_dialEndpoints(t *testing.T) {
+	t.Parallel()
+
+	const healthyAddr = "healthy.com:123"
+	const unhealthyAddr = "unhealthy.com:123"
+	tests := []struct {
+		desc            string
+		resolver        EndpointsResolverFunc
+		wantErrContains string
+	}{
+		{
+			desc: "resolver error",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return nil, trace.Errorf("resolver error")
+			},
+			wantErrContains: "resolver error",
+		},
+		{
+			desc: "resolved zero addrs",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return nil, nil
+			},
+			wantErrContains: "resolved zero target endpoints",
+		},
+		{
+			desc: "resolved one healthy addr",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return []string{healthyAddr}, nil
+			},
+		},
+		{
+			desc: "resolved one unhealthy addr",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return []string{unhealthyAddr}, nil
+			},
+			wantErrContains: "unhealthy addr",
+		},
+		{
+			desc: "resolved multiple healthy addrs",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return []string{healthyAddr, healthyAddr, healthyAddr}, nil
+			},
+		},
+		{
+			desc: "resolved a mix of healthy and unhealthy addrs",
+			resolver: func(ctx context.Context) ([]string, error) {
+				return []string{healthyAddr, unhealthyAddr, healthyAddr}, nil
+			},
+			wantErrContains: "unhealthy addr",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			d := &TargetDialer{
+				Resolver: test.resolver,
+				dial: func(ctx context.Context, network, addr string) (net.Conn, error) {
+					if addr == healthyAddr {
+						return fakeConn{}, nil
+					}
+					return nil, trace.Errorf("unhealthy addr")
+				},
+			}
+			_, err := d.dialEndpoints(t.Context())
+			if test.wantErrContains != "" {
+				require.ErrorContains(t, err, test.wantErrContains)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
+
+type fakeConn struct {
+	net.Conn
+}
+
+func (fakeConn) Close() error { return nil }
+
+type fakeResource struct {
+	kind string
+	types.ResourceWithLabels
+}
+
+func (r *fakeResource) GetKind() string {
+	return r.kind
+}
diff --git a/lib/healthcheck/order_by.go b/lib/healthcheck/order_by.go
new file mode 100644
index 0000000000000..1996e2c2bf2fe
--- /dev/null
+++ b/lib/healthcheck/order_by.go
@@ -0,0 +1,45 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthcheck
+
+import (
+	"iter"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// OrderByTargetHealthStatus returns an iterator over resources ordered by
+// health status: healthy, unknown, and unhealthy. Each group is shuffled
+// to distributing load on resources.
+func OrderByTargetHealthStatus[T types.TargetHealthStatusGetter](resources []T) iter.Seq[T] {
+	return func(yield func(T) bool) {
+		groups := types.GroupByTargetHealthStatus(resources)
+		for _, group := range [][]T{groups.Healthy, groups.Unknown, groups.Unhealthy} {
+			// ShuffleVisit is used for its efficient early return and partial shuffle.
+			// The whole healthy group is likely not shuffled or visited.
+			// And the unknown and unhealthy groups are likely not shuffled or visited.
+			for _, resource := range utils.ShuffleVisit(group) {
+				if !yield(resource) {
+					return
+				}
+			}
+		}
+	}
+}
diff --git a/lib/healthcheck/order_by_test.go b/lib/healthcheck/order_by_test.go
new file mode 100644
index 0000000000000..ee5c13412aab6
--- /dev/null
+++ b/lib/healthcheck/order_by_test.go
@@ -0,0 +1,122 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthcheck
+
+import (
+	"math"
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestOrderByHealthEmpty(t *testing.T) {
+	t.Parallel()
+	var servers []types.KubeServer
+	var visited []string
+	for server := range OrderByTargetHealthStatus(servers) {
+		visited = append(visited, server.GetHostID())
+	}
+	require.Empty(t, visited)
+}
+
+func TestOrderByHealthOne(t *testing.T) {
+	t.Parallel()
+	servers := []types.KubeServer{
+		newKubeServer(t, "one", types.TargetHealthStatusHealthy),
+	}
+	var visited []string
+	for server := range OrderByTargetHealthStatus(servers) {
+		visited = append(visited, server.GetHostID())
+	}
+	require.Equal(t, []string{"one"}, visited)
+}
+
+func TestOrderByHealthUnsorted(t *testing.T) {
+	t.Parallel()
+	servers := []types.KubeServer{
+		newKubeServer(t, "unknown-2", types.TargetHealthStatusUnknown),
+		newKubeServer(t, "unknown-1", types.TargetHealthStatusUnknown),
+		newKubeServer(t, "unhealthy-1", types.TargetHealthStatusUnhealthy),
+		newKubeServer(t, "healthy-2", types.TargetHealthStatusHealthy),
+		newKubeServer(t, "unhealthy-2", types.TargetHealthStatusUnhealthy),
+		newKubeServer(t, "healthy-1", types.TargetHealthStatusHealthy),
+	}
+	var visited []types.KubeServer
+	for server := range OrderByTargetHealthStatus(servers) {
+		visited = append(visited, server)
+	}
+	require.Len(t, visited, len(servers))
+	require.True(t, slices.IsSortedFunc(visited, byHealthOrder))
+}
+
+func TestOrderByHealthEarlyExit(t *testing.T) {
+	t.Parallel()
+	servers := []types.KubeServer{
+		newKubeServer(t, "unknown-1", types.TargetHealthStatusUnknown),
+		newKubeServer(t, "unhealthy-1", types.TargetHealthStatusUnhealthy),
+		newKubeServer(t, "healthy-2", types.TargetHealthStatusHealthy),
+		newKubeServer(t, "healthy-1", types.TargetHealthStatusHealthy),
+	}
+	var visited []string
+	for server := range OrderByTargetHealthStatus(servers) {
+		visited = append(visited, server.GetHostID())
+		if len(visited) >= 2 {
+			break
+		}
+	}
+	require.Len(t, visited, 2)
+	require.NotContains(t, visited, "unknown-1")
+	require.NotContains(t, visited, "unhealthy-1")
+}
+
+func newKubeServer(t *testing.T, hostID string, health types.TargetHealthStatus) types.KubeServer {
+	t.Helper()
+	cluster, err := types.NewKubernetesClusterV3(
+		types.Metadata{Name: "test-cluster"},
+		types.KubernetesClusterSpecV3{},
+	)
+	require.NoError(t, err)
+	server, err := types.NewKubernetesServerV3FromCluster(cluster, "localhost:8080", hostID)
+	require.NoError(t, err)
+	server.Status = &types.KubernetesServerStatusV3{
+		TargetHealth: &types.TargetHealth{
+			Status: string(health),
+		},
+	}
+	return server
+}
+
+func healthOrder(s types.KubeServer) int {
+	switch s.GetTargetHealthStatus() {
+	case types.TargetHealthStatusHealthy:
+		return 0
+	case types.TargetHealthStatusUnknown:
+		return 1
+	case types.TargetHealthStatusUnhealthy:
+		return 2
+	}
+	return math.MaxInt
+}
+
+func byHealthOrder(a, b types.KubeServer) int {
+	return healthOrder(a) - healthOrder(b)
+}
diff --git a/lib/healthcheck/target.go b/lib/healthcheck/target.go
index b9c9ca0851c73..f785848566e65 100644
--- a/lib/healthcheck/target.go
+++ b/lib/healthcheck/target.go
@@ -20,30 +20,29 @@ package healthcheck
 
 import (
 	"context"
-	"net"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
 )
 
-// EndpointsResolverFunc is callback func that returns endpoints for a target.
-type EndpointsResolverFunc func(ctx context.Context) ([]string, error)
-
-// OnHealthChangeFunc is a func called on each health change.
-type OnHealthChangeFunc func(oldHealth, newHealth types.TargetHealth)
+// HealthChecker is a resource which provides health checks.
+type HealthChecker interface {
+	// CheckHealth checks the health of a target resource.
+	CheckHealth(ctx context.Context) ([]string, error)
+	// GetProtocol returns the network protocol used for checking health.
+	GetProtocol() types.TargetHealthProtocol
+}
 
 // Target is a health check target.
 type Target struct {
+	// HealthChecker checks the resource's health.
+	HealthChecker
 	// GetResource gets a copy of the target resource with updated labels.
 	GetResource func() types.ResourceWithLabels
-	// ResolverFn resolves the target endpoint(s).
-	ResolverFn EndpointsResolverFunc
 
 	// -- test fields below --
 
-	// dialFn used to mock dialing in tests
-	dialFn dialFunc
 	// onHealthCheck is called after each health check.
 	onHealthCheck func(lastResultErr error)
 	// onConfigUpdate is called after each config update.
@@ -56,15 +55,8 @@ func (t *Target) checkAndSetDefaults() error {
 	if t.GetResource == nil {
 		return trace.BadParameter("missing target resource getter")
 	}
-	if t.ResolverFn == nil {
-		return trace.BadParameter("missing target endpoint resolver")
-	}
-	if t.dialFn == nil {
-		t.dialFn = defaultDialer().DialContext
+	if t.HealthChecker == nil {
+		return trace.BadParameter("missing health checker")
 	}
 	return nil
 }
-
-func defaultDialer() *net.Dialer {
-	return &net.Dialer{}
-}
diff --git a/lib/healthcheck/target_test.go b/lib/healthcheck/target_test.go
index 0d4c3c5ec4ba0..f5bcedc2ae9cf 100644
--- a/lib/healthcheck/target_test.go
+++ b/lib/healthcheck/target_test.go
@@ -28,15 +28,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 )
 
-type fakeResource struct {
-	kind string
-	types.ResourceWithLabels
-}
-
-func (r *fakeResource) GetKind() string {
-	return r.kind
-}
-
 func TestTarget_checkAndSetDefaults(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -46,23 +37,27 @@ func TestTarget_checkAndSetDefaults(t *testing.T) {
 		{
 			name: "valid target",
 			target: &Target{
+				HealthChecker: NewTargetDialer(
+					func(ctx context.Context) ([]string, error) { return []string{"127.0.0.1"}, nil },
+				),
 				GetResource: func() types.ResourceWithLabels { return &fakeResource{kind: types.KindDatabase} },
-				ResolverFn:  func(ctx context.Context) ([]string, error) { return []string{"127.0.0.1"}, nil },
 			},
 		},
 		{
 			name: "missing resource getter",
 			target: &Target{
-				ResolverFn: func(ctx context.Context) ([]string, error) { return nil, nil },
+				HealthChecker: NewTargetDialer(
+					func(ctx context.Context) ([]string, error) { return nil, nil },
+				),
 			},
 			wantErr: "missing target resource getter",
 		},
 		{
-			name: "missing resolver",
+			name: "missing health checker",
 			target: &Target{
 				GetResource: func() types.ResourceWithLabels { return nil },
 			},
-			wantErr: "missing target endpoint resolver",
+			wantErr: "missing health checker",
 		},
 	}
 
diff --git a/lib/healthcheck/worker.go b/lib/healthcheck/worker.go
index 24fbb20cda230..73597a5fd5c21 100644
--- a/lib/healthcheck/worker.go
+++ b/lib/healthcheck/worker.go
@@ -22,18 +22,19 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
-	"net"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
-	"golang.org/x/sync/errgroup"
+	"github.com/prometheus/client_golang/prometheus"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/utils/interval"
 	"github.com/gravitational/teleport/lib/utils/log"
 )
@@ -50,6 +51,11 @@ type workerConfig struct {
 	Log *slog.Logger
 	// Target is the health check target.
 	Target Target
+	// getTargetHealthTimeout is the timeout to wait for an initial health
+	// check before returning the target health to callers of GetTargetHealth.
+	getTargetHealthTimeout time.Duration
+	// metricType is the resource type (db, k8s, etc) use in Prometheus metrics.
+	metricType string
 }
 
 // checkAndSetDefaults checks the worker config and sets defaults.
@@ -60,6 +66,9 @@ func (cfg *workerConfig) checkAndSetDefaults() error {
 	if cfg.Log == nil {
 		cfg.Log = slog.Default()
 	}
+	if cfg.getTargetHealthTimeout == 0 {
+		cfg.getTargetHealthTimeout = 4 * time.Second
+	}
 	if err := cfg.Target.checkAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
@@ -90,6 +99,8 @@ func newUnstartedWorker(ctx context.Context, cfg workerConfig) (*worker, error)
 		healthCheckConfigUpdateCh: make(chan *healthCheckConfig, 1),
 		log:                       cfg.Log,
 		target:                    cfg.Target,
+		getTargetHealthTimeout:    cfg.getTargetHealthTimeout,
+		metricType:                cfg.metricType,
 	}
 	if w.healthCheckCfg != nil {
 		w.setTargetInit(ctx)
@@ -135,15 +146,23 @@ type worker struct {
 	// targetHealth is the latest target health. Initialized to "unknown" status
 	// before the worker starts.
 	targetHealth types.TargetHealth
+	// initCheckPendingCh is non-nil when the target health is unknown because
+	// the worker is still running an initial health check. When the worker
+	// transitions to any other status, the channel is closed and this field is
+	// set to nil.
+	initCheckPendingCh chan struct{}
+	// getTargetHealthTimeout is the timeout to wait for an initial health
+	// check before returning the target health to callers of GetTargetHealth.
+	getTargetHealthTimeout time.Duration
+	// metricType is the resource type (db, k8s, etc) use in Prometheus metrics.
+	metricType string
 }
 
-// dialFunc dials an address on the given network.
-type dialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
-
 // GetTargetHealth returns the worker's target health.
 func (w *worker) GetTargetHealth() *types.TargetHealth {
 	w.mu.RLock()
 	defer w.mu.RUnlock()
+	w.waitForInitCheckLocked(w.getTargetHealthTimeout)
 	return utils.CloneProtoMsg(&w.targetHealth)
 }
 
@@ -174,6 +193,9 @@ func (w *worker) run() {
 		if w.healthCheckInterval != nil {
 			w.healthCheckInterval.Stop()
 		}
+		if w.initCheckPendingCh != nil {
+			close(w.initCheckPendingCh)
+		}
 		if w.target.onClose != nil {
 			w.target.onClose()
 		}
@@ -198,6 +220,10 @@ func (w *worker) run() {
 		case newCfg := <-w.healthCheckConfigUpdateCh:
 			w.updateHealthCheckConfig(w.closeContext, newCfg)
 		case <-w.closeContext.Done():
+			w.mu.RLock()
+			targetHealthStatus := w.targetHealth.Status
+			w.mu.RUnlock()
+			w.decrementPreviousMetric(targetHealthStatus)
 			return
 		}
 	}
@@ -207,7 +233,6 @@ func (w *worker) run() {
 func (w *worker) startHealthCheckInterval(ctx context.Context) {
 	w.log.InfoContext(ctx, "Health checker started",
 		"health_check_config", w.healthCheckCfg.name,
-		"protocol", w.healthCheckCfg.protocol,
 		"interval", log.StringerAttr(w.healthCheckCfg.interval),
 		"timeout", log.StringerAttr(w.healthCheckCfg.timeout),
 		"healthy_threshold", w.healthCheckCfg.healthyThreshold,
@@ -245,25 +270,31 @@ func (w *worker) nextHealthCheck() <-chan time.Time {
 // updates the worker's health check result history, and possibly updates the
 // target health.
 func (w *worker) checkHealth(ctx context.Context) {
-	initializing := w.lastResultCount == 0
-	dialErr := w.dialEndpoints(ctx)
+	ctx, cancel := context.WithTimeout(ctx, w.healthCheckCfg.timeout)
+	defer cancel()
+
+	// check target health
+	var curErr error
+	w.lastResolvedEndpoints, curErr = w.target.CheckHealth(ctx)
+
 	if ctx.Err() == context.Canceled {
 		return
 	}
-	if (dialErr == nil) == (w.lastResultErr == nil) {
+	initializing := w.lastResultCount == 0
+	if (curErr == nil) == (w.lastResultErr == nil) {
 		w.lastResultCount++
 	} else {
 		// the passing/failing result streak has ended, so reset the count
 		w.lastResultCount = 1
 	}
-	w.lastResultErr = dialErr
+	w.lastResultErr = curErr
 
 	if w.lastResultErr != nil {
 		w.log.DebugContext(ctx, "Failed health check",
 			"error", w.lastResultErr,
 		)
 	}
-	// update target health when we exactly reach the threshold or initialize
+	// update target health when we initialize or exactly reach the threshold
 	if initializing || w.getThreshold(w.healthCheckCfg) == w.lastResultCount {
 		w.setThresholdReached(ctx)
 	}
@@ -281,16 +312,16 @@ func (w *worker) updateHealthCheckConfig(ctx context.Context, newCfg *healthChec
 	}
 	switch {
 	case newCfg == nil:
-		w.setTargetDisabled(ctx)
 		w.stopHealthCheckInterval(ctx)
+		w.setTargetDisabled(ctx)
 		return
 	case oldCfg == nil:
 		w.startHealthCheckInterval(ctx)
+		w.setTargetInit(ctx)
 		return
 	}
 	w.log.DebugContext(ctx, "Updated health check config",
 		"health_check_config", w.healthCheckCfg.name,
-		"protocol", w.healthCheckCfg.protocol,
 		"interval", log.StringerAttr(w.healthCheckCfg.interval),
 		"timeout", log.StringerAttr(w.healthCheckCfg.timeout),
 		"healthy_threshold", w.healthCheckCfg.healthyThreshold,
@@ -315,41 +346,6 @@ func (w *worker) updateHealthCheckConfig(ctx context.Context, newCfg *healthChec
 	}
 }
 
-func (w *worker) dialEndpoints(ctx context.Context) error {
-	ctx, cancel := context.WithTimeout(ctx, w.healthCheckCfg.timeout)
-	defer cancel()
-	endpoints, err := w.target.ResolverFn(ctx)
-	if err != nil {
-		return trace.Wrap(err, "failed to resolve target endpoints")
-	}
-	w.lastResolvedEndpoints = endpoints
-	switch len(endpoints) {
-	case 0:
-		return trace.NotFound("resolved zero target endpoints")
-	case 1:
-		return w.dialEndpoint(ctx, endpoints[0])
-	default:
-		group, ctx := errgroup.WithContext(ctx)
-		group.SetLimit(10)
-		for _, ep := range endpoints {
-			group.Go(func() error {
-				return trace.Wrap(w.dialEndpoint(ctx, ep))
-			})
-		}
-		return group.Wait()
-	}
-}
-
-func (w *worker) dialEndpoint(ctx context.Context, endpoint string) error {
-	conn, err := w.target.dialFn(ctx, "tcp", endpoint)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// an error while closing the connection could indicate an RST packet from
-	// the endpoint - that's a health check failure.
-	return trace.Wrap(conn.Close())
-}
-
 // getThreshold returns the appropriate threshold to compare against the last
 // result.
 func (w *worker) getThreshold(cfg *healthCheckConfig) uint32 {
@@ -361,15 +357,23 @@ func (w *worker) getThreshold(cfg *healthCheckConfig) uint32 {
 
 func (w *worker) setThresholdReached(ctx context.Context) {
 	const transitionReason = types.TargetHealthTransitionReasonThreshold
+	checkWord := pluralize(w.lastResultCount, "check")
 	if w.lastResultErr == nil {
-		msg := fmt.Sprintf("%d health checks passed", w.lastResultCount)
+		msg := fmt.Sprintf("%d health %v passed", w.lastResultCount, checkWord)
 		w.setTargetHealthy(ctx, transitionReason, msg)
 	} else {
-		msg := fmt.Sprintf("%d health checks failed", w.lastResultCount)
+		msg := fmt.Sprintf("%d health %v failed", w.lastResultCount, checkWord)
 		w.setTargetUnhealthy(ctx, transitionReason, msg)
 	}
 }
 
+func pluralize(count uint32, word string) string {
+	if count != 1 {
+		return word + "s"
+	}
+	return word
+}
+
 func (w *worker) setTargetInit(ctx context.Context) {
 	const reason = types.TargetHealthTransitionReasonInit
 	const message = "Health checker initialized"
@@ -393,6 +397,11 @@ func (w *worker) setTargetDisabled(ctx context.Context) {
 func (w *worker) setTargetHealthStatus(ctx context.Context, newStatus types.TargetHealthStatus, reason types.TargetHealthTransitionReason, message string) {
 	w.mu.Lock()
 	defer w.mu.Unlock()
+	if reason != types.TargetHealthTransitionReasonInit {
+		w.notifyInitStatusAvailableLocked()
+	} else if w.initCheckPendingCh == nil {
+		w.initCheckPendingCh = make(chan struct{})
+	}
 	oldHealth := w.targetHealth
 	if oldHealth.Status == string(newStatus) && oldHealth.TransitionReason == string(reason) {
 		return
@@ -403,20 +412,25 @@ func (w *worker) setTargetHealthStatus(ctx context.Context, newStatus types.Targ
 			"reason", reason,
 			"message", message,
 		)
+		resourceHealthyGauge.WithLabelValues(w.metricType).Inc()
 	case types.TargetHealthStatusUnhealthy:
 		w.log.WarnContext(ctx, "Target became unhealthy",
 			"reason", reason,
 			"message", message,
 		)
+		resourceUnhealthyGauge.WithLabelValues(w.metricType).Inc()
 	case types.TargetHealthStatusUnknown:
 		w.log.DebugContext(ctx, "Target health status is unknown",
 			"reason", reason,
 			"message", message,
 		)
+		resourceUnknownGauge.WithLabelValues(w.metricType).Inc()
 	}
+	w.decrementPreviousMetric(oldHealth.Status)
 	now := w.clock.Now()
 	w.targetHealth = types.TargetHealth{
 		Address:             strings.Join(w.lastResolvedEndpoints, ","),
+		Protocol:            string(w.target.GetProtocol()),
 		Status:              string(newStatus),
 		TransitionTimestamp: &now,
 		TransitionReason:    string(reason),
@@ -425,7 +439,92 @@ func (w *worker) setTargetHealthStatus(ctx context.Context, newStatus types.Targ
 	if w.lastResultErr != nil {
 		w.targetHealth.TransitionError = w.lastResultErr.Error()
 	}
-	if w.healthCheckCfg != nil {
-		w.targetHealth.Protocol = string(w.healthCheckCfg.protocol)
+}
+
+// notifyInitStatusAvailableLocked closes the pending init status channel, if
+// one exists, to notify any waiters that the init health check status is
+// available. It is assumed that the caller of this func is holding the lock.
+func (w *worker) notifyInitStatusAvailableLocked() {
+	if w.initCheckPendingCh != nil {
+		close(w.initCheckPendingCh)
+		w.initCheckPendingCh = nil
+	}
+}
+
+// waitForInitCheckLocked waits for the pending init status channel to be nil
+// or for a timeout to expire. It is assumed that the caller of this func is
+// holding the read lock.
+func (w *worker) waitForInitCheckLocked(timeout time.Duration) {
+	if w.initCheckPendingCh == nil {
+		return
+	}
+	timeoutCh := time.After(retryutils.HalfJitter(timeout))
+	for w.initCheckPendingCh != nil {
+		ch := w.initCheckPendingCh
+		w.mu.RUnlock()
+		select {
+		case <-ch:
+			w.mu.RLock()
+		case <-timeoutCh:
+			w.mu.RLock()
+			return
+		}
 	}
 }
+
+// decrementPreviousMetric decrements the previous health metric.
+func (w *worker) decrementPreviousMetric(previousHealthStatus string) {
+	// Decrement previous state when not the initial state.
+	// Avoids decrementing the "unknown" gauge below zero.
+	if previousHealthStatus != "" {
+		switch types.TargetHealthStatus(previousHealthStatus) {
+		case types.TargetHealthStatusHealthy:
+			resourceHealthyGauge.WithLabelValues(w.metricType).Dec()
+		case types.TargetHealthStatusUnhealthy:
+			resourceUnhealthyGauge.WithLabelValues(w.metricType).Dec()
+		case types.TargetHealthStatusUnknown:
+			resourceUnknownGauge.WithLabelValues(w.metricType).Dec()
+		}
+	}
+}
+
+func init() {
+	metrics.RegisterPrometheusCollectors(
+		resourceHealthyGauge,
+		resourceUnhealthyGauge,
+		resourceUnknownGauge,
+	)
+}
+
+var (
+	// teleport_resources_health_status_healthy
+	resourceHealthyGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: teleport.MetricResourcesHealthStatus,
+			Name:      teleport.MetricHealthy,
+			Help:      "Number of healthy resources",
+		},
+		[]string{teleport.TagType}, // db|k8s|etc
+	)
+	// teleport_resources_health_status_unhealthy
+	resourceUnhealthyGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: teleport.MetricResourcesHealthStatus,
+			Name:      teleport.MetricUnhealthy,
+			Help:      "Number of unhealthy resources",
+		},
+		[]string{teleport.TagType}, // db|k8s|etc
+	)
+	// teleport_resources_health_status_unknown
+	resourceUnknownGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Subsystem: teleport.MetricResourcesHealthStatus,
+			Name:      teleport.MetricUnknown,
+			Help:      "Number of resources in an unknown health state",
+		},
+		[]string{teleport.TagType}, // db|k8s|etc
+	)
+)
diff --git a/lib/healthcheck/worker_experimental_test.go b/lib/healthcheck/worker_experimental_test.go
new file mode 100644
index 0000000000000..82c0bb3e436fd
--- /dev/null
+++ b/lib/healthcheck/worker_experimental_test.go
@@ -0,0 +1,101 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthcheck
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func TestGetTargetHealth(t *testing.T) {
+	t.Parallel()
+	enabledHCC := healthCheckConfig{
+		interval:           time.Minute,
+		timeout:            time.Minute,
+		healthyThreshold:   10,
+		unhealthyThreshold: 10,
+	}
+	tests := []struct {
+		desc              string
+		healthCheckConfig *healthCheckConfig
+		dialErr           error
+		wantStatus        types.TargetHealthStatus
+		wantReason        types.TargetHealthTransitionReason
+	}{
+		{
+			desc:              "healthy",
+			healthCheckConfig: &enabledHCC,
+			wantStatus:        "healthy",
+			wantReason:        types.TargetHealthTransitionReasonThreshold,
+		},
+		{
+			desc:       "disabled",
+			wantStatus: "unknown",
+			wantReason: types.TargetHealthTransitionReasonDisabled,
+		},
+		{
+			desc:              "unhealthy",
+			healthCheckConfig: &enabledHCC,
+			dialErr:           trace.Errorf("error dialing"),
+			wantStatus:        "unhealthy",
+			wantReason:        types.TargetHealthTransitionReasonThreshold,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				worker, err := newWorker(t.Context(), workerConfig{
+					HealthCheckCfg: test.healthCheckConfig,
+					Target: Target{
+						HealthChecker: &TargetDialer{
+							Resolver: func(ctx context.Context) ([]string, error) {
+								return []string{"localhost:1234"}, nil
+							},
+							dial: func(ctx context.Context, network, addr string) (net.Conn, error) {
+								time.Sleep(5*time.Second - time.Nanosecond)
+								synctest.Wait()
+								return fakeConn{}, test.dialErr
+							},
+						},
+						GetResource: func() types.ResourceWithLabels { return nil },
+					},
+				})
+				assert.NoError(t, err)
+				defer worker.Close()
+				require.Eventually(t, func() bool {
+					health := worker.GetTargetHealth()
+					return health.TransitionReason != string(types.TargetHealthTransitionReasonInit)
+				}, 10*time.Second, 100*time.Millisecond, "health check did not complete")
+				health := worker.GetTargetHealth()
+				assert.Equal(t, test.wantStatus, types.TargetHealthStatus(health.Status))
+				assert.Equal(t, test.wantReason, types.TargetHealthTransitionReason(health.TransitionReason))
+			})
+		})
+	}
+}
diff --git a/lib/healthcheck/worker_test.go b/lib/healthcheck/worker_test.go
index ec6a810df729f..b495894c017e3 100644
--- a/lib/healthcheck/worker_test.go
+++ b/lib/healthcheck/worker_test.go
@@ -20,14 +20,12 @@ package healthcheck
 
 import (
 	"context"
-	"log/slog"
 	"net"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -37,7 +35,8 @@ import (
 func Test_newUnstartedWorker(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	listener, err := net.Listen("tcp", "localhost:0")
+	protocol := string(types.TargetHealthProtocolTCP)
+	listener, err := net.Listen(protocol, "localhost:0")
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = listener.Close() })
 
@@ -63,15 +62,15 @@ func Test_newUnstartedWorker(t *testing.T) {
 			cfg: workerConfig{
 				HealthCheckCfg: nil,
 				Target: Target{
+					HealthChecker: NewTargetDialer(
+						func(ctx context.Context) ([]string, error) { return nil, nil },
+					),
 					GetResource: func() types.ResourceWithLabels { return db },
-					ResolverFn: func(ctx context.Context) ([]string, error) {
-						return []string{db.GetURI()}, nil
-					},
 				},
 			},
 			wantHealth: types.TargetHealth{
 				Address:          "",
-				Protocol:         "",
+				Protocol:         protocol,
 				Status:           string(types.TargetHealthStatusUnknown),
 				TransitionReason: string(types.TargetHealthTransitionReasonDisabled),
 				Message:          "No health check config matches this resource",
@@ -87,15 +86,16 @@ func Test_newUnstartedWorker(t *testing.T) {
 					unhealthyThreshold: 10,
 				},
 				Target: Target{
+					HealthChecker: NewTargetDialer(
+						func(ctx context.Context) ([]string, error) { return nil, nil },
+					),
 					GetResource: func() types.ResourceWithLabels { return db },
-					ResolverFn: func(ctx context.Context) ([]string, error) {
-						return []string{db.GetURI()}, nil
-					},
 				},
+				getTargetHealthTimeout: time.Millisecond,
 			},
 			wantHealth: types.TargetHealth{
 				Address:          "",
-				Protocol:         "",
+				Protocol:         protocol,
 				Status:           string(types.TargetHealthStatusUnknown),
 				TransitionReason: string(types.TargetHealthTransitionReasonInit),
 				Message:          "Health checker initialized",
@@ -111,9 +111,9 @@ func Test_newUnstartedWorker(t *testing.T) {
 					unhealthyThreshold: 10,
 				},
 				Target: Target{
-					ResolverFn: func(ctx context.Context) ([]string, error) {
-						return []string{db.GetURI()}, nil
-					},
+					HealthChecker: NewTargetDialer(
+						func(ctx context.Context) ([]string, error) { return nil, nil },
+					),
 				},
 			},
 			wantErr: "missing target resource getter",
@@ -134,87 +134,3 @@ func Test_newUnstartedWorker(t *testing.T) {
 		})
 	}
 }
-
-func Test_dialEndpoints(t *testing.T) {
-	t.Parallel()
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	const healthyAddr = "healthy.com:123"
-	const unhealthyAddr = "unhealthy.com:123"
-	tests := []struct {
-		desc            string
-		resolverFn      EndpointsResolverFunc
-		wantErrContains string
-	}{
-		{
-			desc: "resolver error",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return nil, trace.Errorf("resolver error")
-			},
-			wantErrContains: "resolver error",
-		},
-		{
-			desc: "resolved zero addrs",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return nil, nil
-			},
-			wantErrContains: "resolved zero target endpoints",
-		},
-		{
-			desc: "resolved one healthy addr",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return []string{healthyAddr}, nil
-			},
-		},
-		{
-			desc: "resolved one unhealthy addr",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return []string{unhealthyAddr}, nil
-			},
-			wantErrContains: "unhealthy addr",
-		},
-		{
-			desc: "resolved multiple healthy addrs",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return []string{healthyAddr, healthyAddr, healthyAddr}, nil
-			},
-		},
-		{
-			desc: "resolved a mix of healthy and unhealthy addrs",
-			resolverFn: func(ctx context.Context) ([]string, error) {
-				return []string{healthyAddr, unhealthyAddr, healthyAddr}, nil
-			},
-			wantErrContains: "unhealthy addr",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			w := &worker{
-				healthCheckCfg: &healthCheckConfig{},
-				log:            slog.Default(),
-				target: Target{
-					ResolverFn: test.resolverFn,
-					dialFn: func(ctx context.Context, network, addr string) (net.Conn, error) {
-						if addr == healthyAddr {
-							return fakeConn{}, nil
-						}
-						return nil, trace.Errorf("unhealthy addr")
-					},
-				},
-			}
-			err := w.dialEndpoints(ctx)
-			if test.wantErrContains != "" {
-				require.ErrorContains(t, err, test.wantErrContains)
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}
-
-type fakeConn struct {
-	net.Conn
-}
-
-func (fakeConn) Close() error { return nil }
diff --git a/lib/httplib/httplib.go b/lib/httplib/httplib.go
index a969fd93c2d43..d4ba2504460a8 100644
--- a/lib/httplib/httplib.go
+++ b/lib/httplib/httplib.go
@@ -305,11 +305,14 @@ func OriginLocalRedirectURI(redirectURL string) (string, error) {
 		return "", trace.BadParameter("Invalid scheme: %s", parsedURL.Scheme)
 	}
 
+	// Make sure User field does not exist to prevent basic auth
+	if parsedURL.User != nil {
+		return "", trace.BadParameter("Basic Auth not allowed in redirect URL")
+	}
+
 	resultURI := parsedURL.RequestURI()
 	if strings.HasPrefix(resultURI, "//") {
 		return "", trace.BadParameter("Invalid double slash redirect")
-	} else if strings.Contains(resultURI, "@") {
-		return "", trace.BadParameter("Basic Auth not allowed in redirect")
 	}
 	return resultURI, nil
 }
diff --git a/lib/httplib/httplib_test.go b/lib/httplib/httplib_test.go
index 33fce42ecb976..b8d7c4c551f57 100644
--- a/lib/httplib/httplib_test.go
+++ b/lib/httplib/httplib_test.go
@@ -432,6 +432,12 @@ func TestOriginLocalRedirectURI(t *testing.T) {
 			expected: "/bar",
 			errCheck: require.NoError,
 		},
+		{
+			name:     "host and query parameter",
+			input:    "https://localhost?login_hint=user@goteleport.com",
+			expected: "/?login_hint=user@goteleport.com",
+			errCheck: require.NoError,
+		},
 		{
 			name:     "double slash redirect with host",
 			input:    "https://localhost//goteleport.com/",
@@ -439,8 +445,14 @@ func TestOriginLocalRedirectURI(t *testing.T) {
 			errCheck: require.Error,
 		},
 		{
-			name:     "basic auth redirect with host",
-			input:    "https://localhost/@goteleport.com/",
+			name:     "basic auth redirect with host username and password",
+			input:    "https://username:pw@localhost/",
+			expected: "",
+			errCheck: require.Error,
+		},
+		{
+			name:     "basic auth redirect with host username",
+			input:    "https://username:@localhost/",
 			expected: "",
 			errCheck: require.Error,
 		},
diff --git a/lib/httplib/reverseproxy/reverse_proxy.go b/lib/httplib/reverseproxy/reverse_proxy.go
index 57633d3e1e8d5..ccc108707d37e 100644
--- a/lib/httplib/reverseproxy/reverse_proxy.go
+++ b/lib/httplib/reverseproxy/reverse_proxy.go
@@ -19,6 +19,7 @@
 package reverseproxy
 
 import (
+	"context"
 	"log"
 	"log/slog"
 	"net/http"
@@ -109,6 +110,32 @@ func New(opts ...Option) (*Forwarder, error) {
 	return fwd, nil
 }
 
+// ServeHTTP implements the http.Handler interface for the Forwarder.
+// It sets the ServerContextKey to nil to prevent the reverse proxy to panic
+// when the request is served. The panic happens when the request is
+// canceled by the client instead of the server, which is a common case
+// when the reverse proxy is used to forward requests to long-running
+// operations (e.g. kubernetes watch streams).
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.4:src/net/http/httputil/reverseproxy.go;l=556-574;drc=e64f7ef03fdfa1c0d847c21b16c9302cc824e79b
+// When the ServerContextKey is set to nil, the reverse proxy will not
+// attempt to panic when the request is canceled, and will instead
+// return. This allows any upstream logic to continue and clean up
+// resources instead of having to handle the panic recovery. This
+// is particularly important for Kubernetes Watch streams, where
+// a substantial number of goroutines are spawned to handle
+// the watch stream, and we want to clean them up gracefully
+// instead leaving them hanging around because of a panic.
+func (f *Forwarder) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	r = r.WithContext(
+		context.WithValue(
+			r.Context(),
+			http.ServerContextKey,
+			nil,
+		),
+	)
+	f.ReverseProxy.ServeHTTP(w, r)
+}
+
 // Option is a functional option for the forwarder.
 type Option func(*Forwarder)
 
diff --git a/lib/httplib/reverseproxy/reverse_proxy_test.go b/lib/httplib/reverseproxy/reverse_proxy_test.go
new file mode 100644
index 0000000000000..7bf218e8f1646
--- /dev/null
+++ b/lib/httplib/reverseproxy/reverse_proxy_test.go
@@ -0,0 +1,125 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package reverseproxy
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestRequestCancelWithoutPanic tests that canceling a request does not
+// cause a panic in the reverse proxy handler. This is important to ensure
+// that the reverse proxy can handle client disconnects gracefully without
+// crashing the server.
+// It simulates a long-running request and then cancels it, ensuring that
+// frontend doesn't panic, the backend handler receives the cancelation,
+// and all resources are cleaned up properly.
+func TestRequestCancelWithoutPanic(t *testing.T) {
+	var numberOfActiveRequests atomic.Int64
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+
+	backend := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			defer wg.Done()
+
+			numberOfActiveRequests.Add(1)
+			defer numberOfActiveRequests.Add(-1)
+
+			w.WriteHeader(http.StatusOK)
+			w.Write([]byte("Hello, world!"))
+			// Ensure the response is flushed to the client immediately.
+			w.(http.Flusher).Flush()
+
+			// Simulate a long-running request.
+			select {
+			case <-r.Context().Done():
+				// Request was canceled, do nothing.
+				return
+			case <-t.Context().Done():
+				// Test context was canceled. At this point, the test failed
+				panic("test context canceled before request completed")
+			}
+		},
+		))
+
+	t.Cleanup(backend.Close)
+
+	backendURL, err := url.Parse(backend.URL)
+	require.NoError(t, err)
+	proxyHandler := newSingleHostReverseProxy(backendURL)
+
+	wg.Add(1)
+	frontend := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			numberOfActiveRequests.Add(1)
+			proxyHandler.ServeHTTP(w, r)
+			// Place the wg.Done() call here to ensure that
+			// if the panic occurs, it will never be called.
+			numberOfActiveRequests.Add(-1)
+			wg.Done()
+		}),
+	)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	getReq, _ := http.NewRequestWithContext(ctx, http.MethodGet, frontend.URL, nil)
+
+	frontendClient := frontend.Client()
+	res, err := frontendClient.Do(getReq)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		io.Copy(io.Discard, res.Body) // Drain the body to avoid resource leaks.
+		_ = res.Body.Close()          // Ensure we close the response body to avoid resource leaks.
+	})
+
+	require.Equal(t, http.StatusOK, res.StatusCode)
+
+	data := make([]byte, 20)
+	n, err := res.Body.Read(data)
+	require.NoError(t, err)
+	// Ensure we read the expected response.
+	require.Equal(t, "Hello, world!", string(data[:n]))
+
+	require.Equal(t, int64(2), numberOfActiveRequests.Load(), "There should two active handlers at this point.")
+
+	cancel()  // Cancel the request to simulate client disconnect.
+	wg.Wait() // Wait for the backend handler to finish.
+
+	require.Equal(t, int64(0), numberOfActiveRequests.Load(), "There should be no active handlers after the request is canceled.")
+
+}
+
+func newSingleHostReverseProxy(target *url.URL) *Forwarder {
+	return &Forwarder{
+		ReverseProxy: httputil.NewSingleHostReverseProxy(target),
+		logger:       slog.Default(),
+	}
+
+}
diff --git a/lib/integrations/awscommon/validations.go b/lib/integrations/awscommon/validations.go
new file mode 100644
index 0000000000000..d35218ef8ed1c
--- /dev/null
+++ b/lib/integrations/awscommon/validations.go
@@ -0,0 +1,37 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awscommon
+
+import (
+	"github.com/gravitational/trace"
+	"k8s.io/apimachinery/pkg/util/validation"
+)
+
+// ValidIntegrationName validates the integration name.
+func ValidIntegrationName(name string) error {
+	// AWS OIDC and Roles Anywhere Integrations can be used as source of credentials to access AWS Web/CLI.
+	// For OIDC, this creates a new AppServer whose endpoint is <integrationName>.<proxyURL>, which can fail if integrationName is not a valid DNS Label.
+	// For Roles Anywhere, this creates a AppServers for each Roles Anywhere Profile whose endpoint is <profileName>-<integrationName>.<proxyURL>, which can fail if integrationName is not a valid DNS Label.
+	// Instead of failing when the integration is already created, it fails at creation time.
+	if errs := validation.IsDNS1035Label(name); len(errs) > 0 {
+		return trace.BadParameter("integration name %q must be a lower case valid DNS subdomain so that it can be used to allow Web/CLI access", name)
+	}
+
+	return nil
+}
diff --git a/lib/integrations/awsoidc/accessgraph_sync.go b/lib/integrations/awsoidc/accessgraph_sync.go
index ba272e0eeae07..25a251c5a0e7c 100644
--- a/lib/integrations/awsoidc/accessgraph_sync.go
+++ b/lib/integrations/awsoidc/accessgraph_sync.go
@@ -21,11 +21,14 @@ package awsoidc
 import (
 	"context"
 	"io"
+	"regexp"
 
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/gravitational/trace"
 
+	awsutils "github.com/gravitational/teleport/api/utils/aws"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/cloud/provisioning"
 	"github.com/gravitational/teleport/lib/cloud/provisioning/awsactions"
@@ -53,10 +56,30 @@ type AccessGraphAWSIAMConfigureRequest struct {
 	// AutoConfirm skips user confirmation of the operation plan if true.
 	AutoConfirm bool
 
+	// SQSQueueURL is the URL of the SQS queue to use for the Identity Security Activity Center.
+	SQSQueueURL string
+	// CloudTrailBucketARN is the name of the S3 bucket to use for the Identity Security Activity Center.
+	CloudTrailBucketARN string
+	// KMSKeyARNs is the ARN of the KMS key to use for decrypting the Identity Security Activity Center data.
+	KMSKeyARNs []string
+
+	// EnableEKSAuditLogs enables collection of EKS audit logs from CloudWatch logs.
+	EnableEKSAuditLogs bool
+
 	// stdout is used to override stdout output in tests.
 	stdout io.Writer
 }
 
+var (
+	sqsQueueRegex = regexp.MustCompile(`^https://sqs\.([a-z0-9-]+)\.amazonaws\.com\/[0-9]{12}\/([a-zA-Z0-9_-]+)$`)
+)
+
+// IsValidSQSURL checks if the provided URL is a valid SQS queue URL.
+// The URL must be in the format: https://sqs.<region>.amazonaws.com/<account-id>/<queue-name>
+func IsValidSQSURL(url string) bool {
+	return sqsQueueRegex.MatchString(url)
+}
+
 // CheckAndSetDefaults ensures the required fields are present.
 func (r *AccessGraphAWSIAMConfigureRequest) CheckAndSetDefaults() error {
 	if r.IntegrationRole == "" {
@@ -67,6 +90,25 @@ func (r *AccessGraphAWSIAMConfigureRequest) CheckAndSetDefaults() error {
 		r.IntegrationRoleTAGPolicy = defaultPolicyNameForTAGSync
 	}
 
+	if r.SQSQueueURL != "" || r.CloudTrailBucketARN != "" {
+		if r.SQSQueueURL == "" || r.CloudTrailBucketARN == "" {
+			return trace.BadParameter("Both CloudTrailBucketARN and SQSQueueURL must be set")
+		}
+		if !IsValidSQSURL(r.SQSQueueURL) {
+			return trace.BadParameter("SQSQueueURL must be a valid SQS URL in the format https://sqs.<region>.amazonaws.com/<account-id>/<queue-name>")
+		}
+
+		if a, err := arn.Parse(r.CloudTrailBucketARN); err != nil || a.Service != "s3" || a.Resource == "" {
+			return trace.BadParameter("CloudTrailBucketARN must be a valid S3 bucket ARN")
+		}
+
+		for _, kmsKeyARN := range r.KMSKeyARNs {
+			if a, err := arn.Parse(kmsKeyARN); err != nil || a.Service != "kms" || a.Resource == "" {
+				return trace.BadParameter("%q must be valid KMS key ARN", kmsKeyARN)
+			}
+		}
+	}
+
 	return nil
 }
 
@@ -109,8 +151,44 @@ func ConfigureAccessGraphSyncIAM(ctx context.Context, clt AccessGraphIAMConfigur
 		return trace.Wrap(err)
 	}
 
+	statements := []*awslib.Statement{awslib.StatementAccessGraphAWSSync()}
+
+	if req.SQSQueueURL != "" {
+		// Extract the region and queue name from the SQS URL.
+		matches := sqsQueueRegex.FindStringSubmatch(req.SQSQueueURL)
+		if len(matches) != 3 {
+			return trace.BadParameter("invalid SQSQueueURL format")
+		}
+		region := matches[1]
+		queueName := matches[2]
+
+		if awsutils.IsValidRegion(region) != nil {
+			return trace.BadParameter("SQSQueueURL must contain a valid AWS region")
+		}
+
+		arnString := arn.ARN{
+			Partition: awsutils.GetPartitionFromRegion(region),
+			Service:   "sqs",
+			Region:    region,
+			AccountID: req.AccountID,
+			Resource:  queueName,
+		}.String()
+
+		statements = append(statements, awslib.StatementAccessGraphAWSSyncSQS(arnString))
+	}
+	if req.CloudTrailBucketARN != "" {
+		statements = append(statements, awslib.StatementsAccessGraphAWSSyncS3BucketDownload(req.CloudTrailBucketARN)...)
+	}
+
+	if len(req.KMSKeyARNs) > 0 {
+		statements = append(statements, awslib.StatementKMSDecrypt(req.KMSKeyARNs))
+	}
+
+	if req.EnableEKSAuditLogs {
+		statements = append(statements, awslib.StatementAccessGraphAWSSyncEKSAuditLogs())
+	}
 	policy := awslib.NewPolicyDocument(
-		awslib.StatementAccessGraphAWSSync(),
+		statements...,
 	)
 	putRolePolicy, err := awsactions.PutRolePolicy(clt, req.IntegrationRoleTAGPolicy, req.IntegrationRole, policy)
 	if err != nil {
diff --git a/lib/integrations/awsoidc/accessgraph_sync_test.go b/lib/integrations/awsoidc/accessgraph_sync_test.go
index 080d1c0475f3d..884039410e782 100644
--- a/lib/integrations/awsoidc/accessgraph_sync_test.go
+++ b/lib/integrations/awsoidc/accessgraph_sync_test.go
@@ -99,15 +99,21 @@ func TestAccessGraphAWSIAMConfig(t *testing.T) {
 	ctx := context.Background()
 	baseReq := func() AccessGraphAWSIAMConfigureRequest {
 		return AccessGraphAWSIAMConfigureRequest{
-			IntegrationRole: "integrationrole",
-			AccountID:       "123456789012",
-			AutoConfirm:     true,
+			IntegrationRole:     "integrationrole",
+			AccountID:           "123456789012",
+			AutoConfirm:         true,
+			SQSQueueURL:         "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue",
+			CloudTrailBucketARN: "arn:aws:s3:::my-cloudtrail-bucket",
+			KMSKeyARNs:          []string{"arn:aws:kms:us-west-2:123456789012:key/my-kms-key"},
 		}
 	}
 
 	for _, tt := range []struct {
 		name              string
 		mockAccountID     string
+		sqsQueueURL       string
+		s3BucketARN       string
+		kmsKeyARNs        []string
 		mockExistingRoles []string
 		req               func() AccessGraphAWSIAMConfigureRequest
 		errCheck          require.ErrorAssertionFunc
@@ -133,6 +139,108 @@ func TestAccessGraphAWSIAMConfig(t *testing.T) {
 			mockExistingRoles: []string{"integrationrole"},
 			errCheck:          badParameterCheck,
 		},
+		{
+			name: "invalid sqs queue url",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole:     "integrationrole",
+					AccountID:           "123456789012",
+					AutoConfirm:         true,
+					SQSQueueURL:         "https://us-west-2.amazonaws.com/123456789012/my-queue-invalid",
+					CloudTrailBucketARN: "arn:aws:s3:::my-cloudtrail-bucket",
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
+		{
+			name: "invalid s3 arn",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole:     "integrationrole",
+					AccountID:           "123456789012",
+					AutoConfirm:         true,
+					SQSQueueURL:         "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue-invalid",
+					CloudTrailBucketARN: "aws:s3:::my-cloudtrail-bucket",
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
+		{
+			name: "wrong arn set in s3 bucket",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole:     "integrationrole",
+					AccountID:           "123456789012",
+					AutoConfirm:         true,
+					SQSQueueURL:         "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue-invalid",
+					CloudTrailBucketARN: "arn:aws:kms:::my-cloudtrail-bucket",
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
+		{
+			name: "wrong arn set in kms key",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole:     "integrationrole",
+					AccountID:           "123456789012",
+					AutoConfirm:         true,
+					SQSQueueURL:         "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue-invalid",
+					CloudTrailBucketARN: "arn:aws:s3:::my-cloudtrail-bucket",
+					KMSKeyARNs:          []string{"arn:aws:s3:::my-kms-key"},
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
+		{
+			name: "allows default config without activity center",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole: "integrationrole",
+					AccountID:       "123456789012",
+					AutoConfirm:     true,
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.NoError,
+		},
+		{
+			name: "sqs queue url is set but not cloudtrail bucket",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole: "integrationrole",
+					AccountID:       "123456789012",
+					AutoConfirm:     true,
+					SQSQueueURL:     "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue-invalid",
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
+		{
+			name: "s3 bucket is set but not sqs queue url",
+			req: func() AccessGraphAWSIAMConfigureRequest {
+				return AccessGraphAWSIAMConfigureRequest{
+					IntegrationRole:     "integrationrole",
+					AccountID:           "123456789012",
+					AutoConfirm:         true,
+					CloudTrailBucketARN: "arn:aws:s3:::my-cloudtrail-bucket",
+				}
+			},
+			mockAccountID:     "123456789012",
+			mockExistingRoles: []string{"integrationrole"},
+			errCheck:          require.Error,
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			clt := mockAccessGraphAWSAMConfigClient{
@@ -167,6 +275,31 @@ func TestAccessGraphAWSIAMConfigOuput(t *testing.T) {
 	require.Equal(t, string(golden.Get(t)), buf.String())
 }
 
+func TestAccessGraphAWSIAMConfigWithActivityCenterOuput(t *testing.T) {
+	ctx := t.Context()
+	var buf bytes.Buffer
+	req := AccessGraphAWSIAMConfigureRequest{
+		IntegrationRole:     "integrationrole",
+		AccountID:           "123456789012",
+		AutoConfirm:         true,
+		stdout:              &buf,
+		SQSQueueURL:         "https://sqs.us-west-2.amazonaws.com/123456789012/my-queue",
+		CloudTrailBucketARN: "arn:aws:s3:::my-cloudtrail-bucket",
+		KMSKeyARNs:          []string{"arn:aws:kms:us-west-2:123456789012:key/my-kms-key"},
+		EnableEKSAuditLogs:  true,
+	}
+	clt := mockAccessGraphAWSAMConfigClient{
+		CallerIdentityGetter: mockSTSClient{accountID: req.AccountID},
+		existingRoles:        []string{req.IntegrationRole},
+	}
+
+	require.NoError(t, ConfigureAccessGraphSyncIAM(ctx, &clt, req))
+	if golden.ShouldSet() {
+		golden.Set(t, buf.Bytes())
+	}
+	require.Equal(t, string(golden.Get(t)), buf.String())
+}
+
 type mockAccessGraphAWSAMConfigClient struct {
 	CallerIdentityGetter
 	existingRoles []string
diff --git a/lib/integrations/awsoidc/credprovider/credentialscache_test.go b/lib/integrations/awsoidc/credprovider/credentialscache_test.go
index e0a70a3bb973d..51c8875376761 100644
--- a/lib/integrations/awsoidc/credprovider/credentialscache_test.go
+++ b/lib/integrations/awsoidc/credprovider/credentialscache_test.go
@@ -33,7 +33,8 @@ import (
 
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 type fakeSTSClient struct {
@@ -75,7 +76,7 @@ func TestCredentialsCache(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -236,7 +237,7 @@ func TestCredentialsCacheRetrieveBeforeInit(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "cache.Run",
 		Task: func(ctx context.Context) error {
 			cache.Run(ctx)
diff --git a/lib/integrations/awsoidc/credprovider/integration_config_provider_test.go b/lib/integrations/awsoidc/credprovider/integration_config_provider_test.go
index 7c66c5371fd28..d3293c93e4067 100644
--- a/lib/integrations/awsoidc/credprovider/integration_config_provider_test.go
+++ b/lib/integrations/awsoidc/credprovider/integration_config_provider_test.go
@@ -92,6 +92,10 @@ func (d *depsMock) GetProxies() ([]types.Server, error) {
 	return d.proxies, nil
 }
 
+func (d *depsMock) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	return d.proxies, "", nil
+}
+
 func (d *depsMock) GetClusterName(_ context.Context) (types.ClusterName, error) {
 	return types.NewClusterName(types.ClusterNameSpecV2{ClusterName: "teleport.example.com", ClusterID: "cluster-id"})
 }
diff --git a/lib/integrations/awsoidc/deployservice.go b/lib/integrations/awsoidc/deployservice.go
index f2a2ab0af4e0b..a6c5fd0e9fff7 100644
--- a/lib/integrations/awsoidc/deployservice.go
+++ b/lib/integrations/awsoidc/deployservice.go
@@ -325,21 +325,22 @@ type DeployServiceClient interface {
 type defaultDeployServiceClient struct {
 	CallerIdentityGetter
 	*ecs.Client
-	tokenServiceClient TokenService
+	tokenGetter  TokenGetter
+	tokenCreator TokenCreator
 }
 
 // GetToken returns a provision token by name.
 func (d *defaultDeployServiceClient) GetToken(ctx context.Context, name string) (types.ProvisionToken, error) {
-	return d.tokenServiceClient.GetToken(ctx, name)
+	return d.tokenGetter.GetToken(ctx, name)
 }
 
 // UpsertToken creates or updates a provision token.
 func (d *defaultDeployServiceClient) UpsertToken(ctx context.Context, token types.ProvisionToken) error {
-	return d.tokenServiceClient.UpsertToken(ctx, token)
+	return d.tokenCreator.UpsertToken(ctx, token)
 }
 
 // NewDeployServiceClient creates a new DeployServiceClient using a AWSClientRequest.
-func NewDeployServiceClient(ctx context.Context, clientReq *AWSClientRequest, tokenServiceClient TokenService) (DeployServiceClient, error) {
+func NewDeployServiceClient(ctx context.Context, clientReq *AWSClientRequest, tokenGetter TokenGetter, tokenCreator TokenCreator) (DeployServiceClient, error) {
 	ecsClient, err := newECSClient(ctx, clientReq)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -353,7 +354,8 @@ func NewDeployServiceClient(ctx context.Context, clientReq *AWSClientRequest, to
 	return &defaultDeployServiceClient{
 		Client:               ecsClient,
 		CallerIdentityGetter: stsClient,
-		tokenServiceClient:   tokenServiceClient,
+		tokenGetter:          tokenGetter,
+		tokenCreator:         tokenCreator,
 	}, nil
 }
 
diff --git a/lib/integrations/awsoidc/deployservice_iam_jointoken.go b/lib/integrations/awsoidc/deployservice_iam_jointoken.go
index 7733a676ef08b..176f85e90275b 100644
--- a/lib/integrations/awsoidc/deployservice_iam_jointoken.go
+++ b/lib/integrations/awsoidc/deployservice_iam_jointoken.go
@@ -39,9 +39,18 @@ const (
 
 // TokenService defines the required methods to upsert the Provision Token used by the Deploy Service.
 type TokenService interface {
+	TokenGetter
+	TokenCreator
+}
+
+// TokenGetter defines the required method to get a Provision Token.
+type TokenGetter interface {
 	// GetToken returns a provision token by name.
 	GetToken(ctx context.Context, name string) (types.ProvisionToken, error)
+}
 
+// TokenCreator defines the required method to create or update a Provision Token.
+type TokenCreator interface {
 	// UpsertToken creates or updates a provision token.
 	UpsertToken(ctx context.Context, token types.ProvisionToken) error
 }
diff --git a/lib/integrations/awsoidc/deployservice_update_test.go b/lib/integrations/awsoidc/deployservice_update_test.go
index 5cf66b7e9324d..d94817d858a81 100644
--- a/lib/integrations/awsoidc/deployservice_update_test.go
+++ b/lib/integrations/awsoidc/deployservice_update_test.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestGenerateServiceWithTaskDefinition(t *testing.T) {
@@ -164,7 +164,7 @@ func TestUpdateDeployServices(t *testing.T) {
 	semVer := teleport.SemVer()
 	semVer.PreRelease = ""
 	teleportVersion := semVer.String()
-	log := utils.NewSlogLoggerForTests().With("test", t.Name())
+	log := logtest.With("test", t.Name())
 
 	t.Run("only legacy service present", func(t *testing.T) {
 		m := &mockDeployServiceClient{
diff --git a/lib/integrations/awsoidc/deployservice_vcr_test.go b/lib/integrations/awsoidc/deployservice_vcr_test.go
index 48c49a835ff69..bc73a40404c45 100644
--- a/lib/integrations/awsoidc/deployservice_vcr_test.go
+++ b/lib/integrations/awsoidc/deployservice_vcr_test.go
@@ -134,7 +134,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		resp, err := DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -151,7 +151,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		resp, err := DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -168,7 +168,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		_, err = DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -180,7 +180,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		resp, err := DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -197,7 +197,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		resp, err := DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -214,7 +214,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		_, err = DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -226,7 +226,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		_, err = DeployService(ctx, clt, deployServiceReqFunc("cluster1002"))
@@ -238,7 +238,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		resp, err := DeployService(ctx, clt, deployServiceReqFunc("tenant-a.teleport.sh"))
@@ -255,7 +255,7 @@ func TestDeployDBService(t *testing.T) {
 		defer r.Stop()
 
 		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
-		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore)
+		clt, err := NewDeployServiceClient(ctx, awsClientRecorder, &tokenStore, &tokenStore)
 		require.NoError(t, err)
 
 		deployReq := deployServiceReqFunc("marco-test.teleport.sh")
diff --git a/lib/integrations/awsoidc/ec2_ssm_iam_config.go b/lib/integrations/awsoidc/ec2_ssm_iam_config.go
index 719d2d319d252..4825f8bea3736 100644
--- a/lib/integrations/awsoidc/ec2_ssm_iam_config.go
+++ b/lib/integrations/awsoidc/ec2_ssm_iam_config.go
@@ -28,6 +28,7 @@ import (
 	ssmtypes "github.com/aws/aws-sdk-go-v2/service/ssm/types"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/types"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/cloud/provisioning"
 	"github.com/gravitational/teleport/lib/cloud/provisioning/awsactions"
@@ -55,6 +56,7 @@ type EC2SSMIAMConfigureRequest struct {
 
 	// SSMDocumentName is the SSM Document to be created.
 	// This document calls the installer scripts in the target host.
+	// Empty if using a pre-existing document.
 	SSMDocumentName string
 
 	// ProxyPublicURL is Proxy's Public URL.
@@ -94,10 +96,6 @@ func (r *EC2SSMIAMConfigureRequest) CheckAndSetDefaults() error {
 		r.IntegrationRoleEC2SSMPolicy = defaultPolicyNameForEC2SSM
 	}
 
-	if r.SSMDocumentName == "" {
-		return trace.BadParameter("ssm document name is required")
-	}
-
 	if r.ProxyPublicURL == "" {
 		return trace.BadParameter("proxy public url is required")
 	}
@@ -152,6 +150,9 @@ func NewEC2SSMConfigureClient(ctx context.Context, region string) (EC2SSMConfigu
 // ConfigureEC2SSM creates the required resources in AWS to enable EC2 Auto Discover using script mode..
 // It creates an inline policy with the following permissions:
 //
+// Action: List AWS Regions.
+//   - account:ListRegions
+//
 // Action: List EC2 instances where teleport is going to be installed.
 //   - ec2:DescribeInstances
 //
@@ -182,21 +183,26 @@ func ConfigureEC2SSM(ctx context.Context, clt EC2SSMConfigureClient, req EC2SSMI
 		return trace.Wrap(err)
 	}
 
-	content := awslib.EC2DiscoverySSMDocument(req.ProxyPublicURL,
-		awslib.WithInsecureSkipInstallPathRandomization(req.insecureSkipInstallPathRandomization),
-	)
-	tags := defaultResourceCreationTags(req.ClusterName, req.IntegrationName)
-	createDoc, err := awsactions.CreateDocument(clt, req.SSMDocumentName, content, ssmtypes.DocumentTypeCommand, ssmtypes.DocumentFormatYaml, tags)
-	if err != nil {
-		return trace.Wrap(err)
+	actions := []provisioning.Action{*putRolePolicy}
+
+	// SSM Document creation only happens when the user specifies a custom name.
+	// The AWSSSMDocumentRunShellScript SSM Document (AWS-RunShellScript) already exists in all accounts.
+	mustCreateDoc := req.SSMDocumentName != "" && req.SSMDocumentName != types.AWSSSMDocumentRunShellScript
+	if mustCreateDoc {
+		content := awslib.EC2DiscoverySSMDocument(req.ProxyPublicURL,
+			awslib.WithInsecureSkipInstallPathRandomization(req.insecureSkipInstallPathRandomization),
+		)
+		tags := defaultResourceCreationTags(req.ClusterName, req.IntegrationName)
+		createDoc, err := awsactions.CreateDocument(clt, req.SSMDocumentName, content, ssmtypes.DocumentTypeCommand, ssmtypes.DocumentFormatYaml, tags)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		actions = append(actions, *createDoc)
 	}
 
 	return trace.Wrap(provisioning.Run(ctx, provisioning.OperationConfig{
-		Name: "ec2-ssm-iam",
-		Actions: []provisioning.Action{
-			*putRolePolicy,
-			*createDoc,
-		},
+		Name:        "ec2-ssm-iam",
+		Actions:     actions,
 		AutoConfirm: req.AutoConfirm,
 		Output:      req.stdout,
 	}))
diff --git a/lib/integrations/awsoidc/ec2_ssm_iam_config_test.go b/lib/integrations/awsoidc/ec2_ssm_iam_config_test.go
index 2dd1612992a48..1b17cee51fb61 100644
--- a/lib/integrations/awsoidc/ec2_ssm_iam_config_test.go
+++ b/lib/integrations/awsoidc/ec2_ssm_iam_config_test.go
@@ -108,13 +108,24 @@ func TestEC2SSMIAMConfigReqDefaults(t *testing.T) {
 			errCheck: badParameterCheck,
 		},
 		{
-			name: "missing ssm document",
+			name: "missing ssm document is not an issue because users might want to use a pre-defined one",
 			req: func() EC2SSMIAMConfigureRequest {
 				req := baseReq()
 				req.SSMDocumentName = ""
 				return req
 			},
-			errCheck: badParameterCheck,
+			errCheck: require.NoError,
+			expected: EC2SSMIAMConfigureRequest{
+				Region:                      "us-east-1",
+				IntegrationRole:             "integrationrole",
+				IntegrationRoleEC2SSMPolicy: "EC2DiscoverWithSSM",
+				SSMDocumentName:             "",
+				ProxyPublicURL:              "https://proxy.example.com",
+				ClusterName:                 "my-cluster",
+				IntegrationName:             "my-integration",
+				AccountID:                   "123456789012",
+				AutoConfirm:                 true,
+			},
 		},
 		{
 			name: "missing proxy url",
@@ -180,6 +191,7 @@ func TestEC2SSMIAMConfig(t *testing.T) {
 		mockExistingSSMDocs []string
 		req                 func() EC2SSMIAMConfigureRequest
 		errCheck            require.ErrorAssertionFunc
+		validateDocs        func(t *testing.T, docs map[string][]ssmtypes.Tag)
 	}{
 		{
 			name:                "valid",
@@ -188,6 +200,14 @@ func TestEC2SSMIAMConfig(t *testing.T) {
 			mockExistingRoles:   []string{"integrationrole"},
 			mockExistingSSMDocs: []string{},
 			errCheck:            require.NoError,
+			validateDocs: func(t *testing.T, docs map[string][]ssmtypes.Tag) {
+				require.Contains(t, docs, "MyDoc")
+				require.ElementsMatch(t, []ssmtypes.Tag{
+					{Key: aws.String("teleport.dev/cluster"), Value: aws.String("my-cluster")},
+					{Key: aws.String("teleport.dev/integration"), Value: aws.String("my-integration")},
+					{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+				}, docs["MyDoc"])
+			},
 		},
 		{
 			name:                "integration role does not exist",
@@ -213,6 +233,36 @@ func TestEC2SSMIAMConfig(t *testing.T) {
 			mockExistingSSMDocs: []string{},
 			errCheck:            badParameterCheck,
 		},
+		{
+			name: "skips doc creation when document is not set",
+			req: func() EC2SSMIAMConfigureRequest {
+				baseReq := baseReq()
+				baseReq.SSMDocumentName = ""
+				return baseReq
+			},
+			mockAccountID:       "123456789012",
+			mockExistingRoles:   []string{"integrationrole"},
+			mockExistingSSMDocs: []string{},
+			errCheck:            require.NoError,
+			validateDocs: func(t *testing.T, docs map[string][]ssmtypes.Tag) {
+				require.Empty(t, docs)
+			},
+		},
+		{
+			name: "skips doc creation when document is well known pre-defined document (it exists already in the account)",
+			req: func() EC2SSMIAMConfigureRequest {
+				baseReq := baseReq()
+				baseReq.SSMDocumentName = "AWS-RunShellScript"
+				return baseReq
+			},
+			mockAccountID:       "123456789012",
+			mockExistingRoles:   []string{"integrationrole"},
+			mockExistingSSMDocs: []string{},
+			errCheck:            require.NoError,
+			validateDocs: func(t *testing.T, docs map[string][]ssmtypes.Tag) {
+				require.Empty(t, docs)
+			},
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			clt := mockEC2SSMIAMConfigClient{
@@ -222,13 +272,8 @@ func TestEC2SSMIAMConfig(t *testing.T) {
 
 			err := ConfigureEC2SSM(ctx, &clt, tt.req())
 			tt.errCheck(t, err)
-			if err == nil {
-				require.Contains(t, clt.existingDocs, tt.req().SSMDocumentName)
-				require.ElementsMatch(t, []ssmtypes.Tag{
-					{Key: aws.String("teleport.dev/cluster"), Value: aws.String("my-cluster")},
-					{Key: aws.String("teleport.dev/integration"), Value: aws.String("my-integration")},
-					{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
-				}, clt.existingDocs[tt.req().SSMDocumentName])
+			if tt.validateDocs != nil {
+				tt.validateDocs(t, clt.existingDocs)
 			}
 		})
 	}
@@ -284,6 +329,9 @@ func (m *mockEC2SSMIAMConfigClient) CreateDocument(ctx context.Context, params *
 	if m.existingDocs == nil {
 		m.existingDocs = make(map[string][]ssmtypes.Tag)
 	}
+	if aws.ToString(params.Name) == "AWS-RunShellScript" {
+		return nil, &ssmtypes.ValidationException{}
+	}
 	if _, ok := m.existingDocs[aws.ToString(params.Name)]; ok {
 		return nil, &ssmtypes.DocumentAlreadyExists{}
 	}
diff --git a/lib/integrations/awsoidc/eks_enroll_clusters.go b/lib/integrations/awsoidc/eks_enroll_clusters.go
index 328658b5cf602..9429bd02b63a3 100644
--- a/lib/integrations/awsoidc/eks_enroll_clusters.go
+++ b/lib/integrations/awsoidc/eks_enroll_clusters.go
@@ -59,6 +59,7 @@ import (
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/teleportassets"
 )
 
 const (
@@ -75,8 +76,8 @@ const (
 )
 
 var (
-	agentRepoURL        = url.URL{Scheme: "https", Host: "charts.releases.teleport.dev"}
-	agentStagingRepoURL = url.URL{Scheme: "https", Host: "charts.releases.development.teleport.dev"}
+	agentRepoURL        = teleportassets.HelmRepoURL()
+	agentStagingRepoURL = teleportassets.HelmStagingRepoURL()
 )
 
 // EnrollEKSClusterResult contains result for a single EKS cluster enrollment, if it was successful 'Error' will be nil
@@ -134,7 +135,7 @@ type EnrollEKSClusterClient interface {
 type defaultEnrollEKSClustersClient struct {
 	*eks.Client
 	stsClient    *sts.Client
-	tokenCreator TokenCreator
+	tokenCreator TokenCreatorFn
 }
 
 // GetCallerIdentity returns details about the IAM user or role whose credentials are used to call the operation.
@@ -157,7 +158,7 @@ func (d *defaultEnrollEKSClustersClient) CheckAgentAlreadyInstalled(ctx context.
 	return checkAgentAlreadyInstalled(ctx, actionConfig)
 }
 
-func getToken(ctx context.Context, clock clockwork.Clock, tokenCreator TokenCreator) (string, string, error) {
+func getToken(ctx context.Context, clock clockwork.Clock, tokenCreator TokenCreatorFn) (string, string, error) {
 	const eksJoinTokenTTL = 30 * time.Minute
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -210,11 +211,11 @@ func (d *defaultEnrollEKSClustersClient) CreateToken(ctx context.Context, token
 	return d.tokenCreator(ctx, token)
 }
 
-// TokenCreator creates join token on the auth server.
-type TokenCreator func(ctx context.Context, token types.ProvisionToken) error
+// TokenCreatorFn creates join token on the auth server.
+type TokenCreatorFn func(ctx context.Context, token types.ProvisionToken) error
 
 // NewEnrollEKSClustersClient returns new client that can be used to enroll EKS clusters into Teleport.
-func NewEnrollEKSClustersClient(ctx context.Context, req *AWSClientRequest, tokenCreator TokenCreator) (EnrollEKSClusterClient, error) {
+func NewEnrollEKSClustersClient(ctx context.Context, req *AWSClientRequest, tokenCreator TokenCreatorFn) (EnrollEKSClusterClient, error) {
 	eksClient, err := newEKSClient(ctx, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -741,10 +742,19 @@ func installKubeAgent(ctx context.Context, cfg installKubeAgentParams) error {
 	return nil
 }
 
-func kubeAgentLabels(kubeCluster types.KubeCluster, resourceID string, extraLabels map[string]string) map[string]string {
-	labels := make(map[string]string)
-	maps.Copy(labels, extraLabels)
-	maps.Copy(labels, kubeCluster.GetStaticLabels())
+func kubeAgentLabels(kubeCluster types.KubeCluster, resourceID string, extraLabels map[string]string) map[string]any {
+	// Labels property in the `teleport-kube-agent` chart is defined as object.
+	// Object values are of map[string]any type, so we need to use `any`.
+	labels := make(map[string]any)
+
+	for k, v := range extraLabels {
+		labels[k] = v
+	}
+
+	for k, v := range kubeCluster.GetStaticLabels() {
+		labels[k] = v
+	}
+
 	labels[types.InternalResourceIDLabel] = resourceID
 
 	return labels
diff --git a/lib/integrations/awsoidc/eks_enroll_clusters_test.go b/lib/integrations/awsoidc/eks_enroll_clusters_test.go
index a84103238b8e4..baa18e1bfe445 100644
--- a/lib/integrations/awsoidc/eks_enroll_clusters_test.go
+++ b/lib/integrations/awsoidc/eks_enroll_clusters_test.go
@@ -40,7 +40,7 @@ import (
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestGetChartUrl(t *testing.T) {
@@ -396,7 +396,7 @@ func TestEnrollEKSClusters(t *testing.T) {
 			}
 
 			response, err := EnrollEKSClusters(
-				ctx, utils.NewSlogLoggerForTests().With("test", t.Name()), clock, proxyAddr, tc.enrollClient(t, tc.eksClusters), req)
+				ctx, logtest.With("test", t.Name()), clock, proxyAddr, tc.enrollClient(t, tc.eksClusters), req)
 			require.NoError(t, err)
 
 			tc.responseCheck(t, response)
@@ -422,7 +422,7 @@ func TestEnrollEKSClusters(t *testing.T) {
 		}
 
 		response, err := EnrollEKSClusters(
-			ctx, utils.NewSlogLoggerForTests().With("test", t.Name()), clock, proxyAddr, mockClt, req)
+			ctx, logtest.With("test", t.Name()), clock, proxyAddr, mockClt, req)
 		require.NoError(t, err)
 		require.Len(t, response.Results, 1)
 		require.Equal(t, "EKS1", response.Results[0].ClusterName)
@@ -647,8 +647,7 @@ func TestKubeAgentLabels(t *testing.T) {
 		resourceID,
 		extraLabels,
 	)
-
-	expectedLabels := map[string]string{
+	expectedLabels := map[string]any{
 		"priority":                      "yes",
 		"region":                        "us-east-1",
 		"custom":                        "yes",
diff --git a/lib/integrations/awsoidc/idp_iam_config_test.go b/lib/integrations/awsoidc/idp_iam_config_test.go
index 321ea3f157f9b..774f2927b989e 100644
--- a/lib/integrations/awsoidc/idp_iam_config_test.go
+++ b/lib/integrations/awsoidc/idp_iam_config_test.go
@@ -558,6 +558,11 @@ func (m *mockIdPIAMConfigClient) TagRole(ctx context.Context, params *iam.TagRol
 
 func TestNewIdPIAMConfigureClient(t *testing.T) {
 	t.Run("no aws_region env var, returns an error", func(t *testing.T) {
+		// Prevent the AWS SDK from loading user configuration files which may set the region.
+		t.Setenv("AWS_SHARED_CREDENTIALS_FILE", "/dev/null/does-not-exist")
+		t.Setenv("AWS_CONFIG_FILE", "/dev/null/does-not-exist")
+		t.Setenv("AWS_REGION", "")
+		t.Setenv("AWS_DEFAULT_REGION", "")
 		_, err := NewIdPIAMConfigureClient(context.Background())
 		require.ErrorContains(t, err, "please set the AWS_REGION environment variable")
 	})
diff --git a/lib/integrations/awsoidc/listdatabases_test.go b/lib/integrations/awsoidc/listdatabases_test.go
index 6f831668e4f85..762ce0ff22861 100644
--- a/lib/integrations/awsoidc/listdatabases_test.go
+++ b/lib/integrations/awsoidc/listdatabases_test.go
@@ -32,7 +32,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func stringPointer(s string) *string {
@@ -141,7 +141,7 @@ func TestListDatabases(t *testing.T) {
 
 		t.Run("without vpc filter", func(t *testing.T) {
 			t.Parallel()
-			logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+			logger := logtest.With("test", t.Name())
 			// First page must return pageSize number of DBs
 			req := ListDatabasesRequest{
 				Region:    "us-east-1",
@@ -166,7 +166,7 @@ func TestListDatabases(t *testing.T) {
 
 		t.Run("with vpc filter", func(t *testing.T) {
 			t.Parallel()
-			logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+			logger := logtest.With("test", t.Name())
 			// First page must return at least pageSize number of DBs
 			var gotDatabases []types.Database
 			wantVPC := "vpc-2"
@@ -694,7 +694,7 @@ func TestListDatabases(t *testing.T) {
 				dbInstances: tt.mockInstances,
 				dbClusters:  tt.mockClusters,
 			}
-			logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+			logger := logtest.With("test", t.Name())
 			resp, err := ListDatabases(ctx, mockListClient, logger, tt.req)
 			require.True(t, tt.errCheck(err), "unexpected err: %v", err)
 			if err != nil {
diff --git a/lib/integrations/awsoidc/listdeployeddatabaseservice.go b/lib/integrations/awsoidc/listdeployeddatabaseservice.go
index dbe686fc98dad..1992cb272f32b 100644
--- a/lib/integrations/awsoidc/listdeployeddatabaseservice.go
+++ b/lib/integrations/awsoidc/listdeployeddatabaseservice.go
@@ -147,6 +147,10 @@ func ListDeployedDatabaseServices(ctx context.Context, clt ListDeployedDatabaseS
 		return nil, trace.Wrap(convertedError)
 	}
 
+	if len(listServicesOutput.ServiceArns) == 0 {
+		return &ListDeployedDatabaseServicesResponse{}, nil
+	}
+
 	describeServicesOutput, err := clt.DescribeServices(ctx, &ecs.DescribeServicesInput{
 		Services: listServicesOutput.ServiceArns,
 		Include:  []ecstypes.ServiceField{ecstypes.ServiceFieldTags},
diff --git a/lib/integrations/awsoidc/listdeployeddatabaseservice_test.go b/lib/integrations/awsoidc/listdeployeddatabaseservice_test.go
index 84b163d519465..573328acba3e7 100644
--- a/lib/integrations/awsoidc/listdeployeddatabaseservice_test.go
+++ b/lib/integrations/awsoidc/listdeployeddatabaseservice_test.go
@@ -110,10 +110,14 @@ type mockListECSClient struct {
 }
 
 func (m *mockListECSClient) ListServices(ctx context.Context, params *ecs.ListServicesInput, optFns ...func(*ecs.Options)) (*ecs.ListServicesOutput, error) {
-	if aws.ToString(params.Cluster) != m.clusterName || len(m.services) == 0 {
+	if aws.ToString(params.Cluster) != m.clusterName {
 		return nil, trace.NotFound("ECS Cluster not found")
 	}
 
+	if len(m.services) == 0 {
+		return &ecs.ListServicesOutput{}, nil
+	}
+
 	ret := &ecs.ListServicesOutput{}
 	requestedPage := 1
 
@@ -151,6 +155,10 @@ func (m *mockListECSClient) DescribeServices(ctx context.Context, params *ecs.De
 		return ret, nil
 	}
 
+	if len(params.Services) == 0 {
+		return ret, trace.BadParameter("describe services requires at least one service ARN")
+	}
+
 	for _, serviceARN := range params.Services {
 		ret.Services = append(ret.Services, m.mapServices[serviceARN])
 	}
@@ -367,6 +375,26 @@ func TestListDeployedDatabaseServices(t *testing.T) {
 			},
 			errCheck: require.NoError,
 		},
+		{
+			name: "returns empty list when the ECS Cluster exists but has no services",
+			req: ListDeployedDatabaseServicesRequest{
+				Integration:         "my-integration",
+				TeleportClusterName: "my-cluster",
+				Region:              "us-east-1",
+			},
+			mockClient: func() *mockListECSClient {
+				ret := &mockListECSClient{
+					pageSize:    10,
+					clusterName: "my-cluster-teleport",
+				}
+				return ret
+			},
+			respCheck: func(t *testing.T, resp *ListDeployedDatabaseServicesResponse) {
+				require.Empty(t, resp.DeployedDatabaseServices, "expected 0 services")
+				require.Empty(t, resp.NextToken, "expected an empty NextToken")
+			},
+			errCheck: require.NoError,
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			resp, err := ListDeployedDatabaseServices(ctx, tt.mockClient(), tt.req)
diff --git a/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigOuput.golden b/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigOuput.golden
index 82e937184fe78..63cc65304ff3d 100644
--- a/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigOuput.golden
+++ b/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigOuput.golden
@@ -55,7 +55,12 @@ PutRolePolicy: {
                     "iam:ListSAMLProviders",
                     "iam:GetSAMLProvider",
                     "iam:ListOpenIDConnectProviders",
-                    "iam:GetOpenIDConnectProvider"
+                    "iam:GetOpenIDConnectProvider",
+                    "kms:ListKeys",
+                    "kms:DescribeKey",
+                    "kms:GetKeyPolicy",
+                    "kms:ListAliases",
+                    "kms:ListResourceTags"
                 ],
                 "Resource": "*"
             }
diff --git a/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigWithActivityCenterOuput.golden b/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigWithActivityCenterOuput.golden
new file mode 100644
index 0000000000000..18a7f43810eb4
--- /dev/null
+++ b/lib/integrations/awsoidc/testdata/TestAccessGraphAWSIAMConfigWithActivityCenterOuput.golden
@@ -0,0 +1,113 @@
+"access-graph-aws-iam" will perform the following action:
+
+Attach an inline IAM policy named "AccessGraphSyncAccess" to IAM role "integrationrole".
+PutRolePolicy: {
+    "PolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "ec2:DescribeInstances",
+                    "ec2:DescribeImages",
+                    "ec2:DescribeTags",
+                    "ec2:DescribeSnapshots",
+                    "ec2:DescribeKeyPairs",
+                    "eks:ListClusters",
+                    "eks:DescribeCluster",
+                    "eks:ListAccessEntries",
+                    "eks:ListAccessPolicies",
+                    "eks:ListAssociatedAccessPolicies",
+                    "eks:DescribeAccessEntry",
+                    "rds:DescribeDBInstances",
+                    "rds:DescribeDBClusters",
+                    "rds:ListTagsForResource",
+                    "rds:DescribeDBProxies",
+                    "dynamodb:ListTables",
+                    "dynamodb:DescribeTable",
+                    "redshift:DescribeClusters",
+                    "redshift:Describe*",
+                    "s3:ListAllMyBuckets",
+                    "s3:GetBucketPolicy",
+                    "s3:ListBucket",
+                    "s3:GetBucketLocation",
+                    "s3:GetBucketTagging",
+                    "s3:GetBucketPolicyStatus",
+                    "s3:GetBucketAcl",
+                    "iam:ListUsers",
+                    "iam:GetUser",
+                    "iam:ListRoles",
+                    "iam:ListGroups",
+                    "iam:ListPolicies",
+                    "iam:ListGroupsForUser",
+                    "iam:ListInstanceProfiles",
+                    "iam:ListUserPolicies",
+                    "iam:GetUserPolicy",
+                    "iam:ListAttachedUserPolicies",
+                    "iam:ListGroupPolicies",
+                    "iam:GetGroupPolicy",
+                    "iam:ListAttachedGroupPolicies",
+                    "iam:GetPolicy",
+                    "iam:GetPolicyVersion",
+                    "iam:ListRolePolicies",
+                    "iam:ListAttachedRolePolicies",
+                    "iam:GetRolePolicy",
+                    "iam:ListSAMLProviders",
+                    "iam:GetSAMLProvider",
+                    "iam:ListOpenIDConnectProviders",
+                    "iam:GetOpenIDConnectProvider",
+                    "kms:ListKeys",
+                    "kms:DescribeKey",
+                    "kms:GetKeyPolicy",
+                    "kms:ListAliases",
+                    "kms:ListResourceTags"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "sqs:ReceiveMessage",
+                    "sqs:DeleteMessage"
+                ],
+                "Resource": "arn:aws:sqs:us-west-2:123456789012:my-queue"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetObject",
+                    "s3:GetObjectVersion"
+                ],
+                "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:ListBucket",
+                    "s3:ListBucketVersions",
+                    "s3:GetBucketLocation",
+                    "s3:GetBucketVersioning"
+                ],
+                "Resource": "arn:aws:s3:::my-cloudtrail-bucket"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "kms:Decrypt",
+                    "kms:DescribeKey",
+                    "kms:GenerateDataKey",
+                    "kms:GenerateDataKeyWithoutPlaintext"
+                ],
+                "Resource": "arn:aws:kms:us-west-2:123456789012:key/my-kms-key"
+            },
+            {
+                "Effect": "Allow",
+                "Action": "logs:FilterLogEvents",
+                "Resource": "arn:aws:logs:*:*:log-group:/aws/eks/*"
+            }
+        ]
+    },
+    "PolicyName": "AccessGraphSyncAccess",
+    "RoleName": "integrationrole"
+}
+
diff --git a/lib/integrations/awsoidc/testdata/TestEC2SSMIAMConfigOutput.golden b/lib/integrations/awsoidc/testdata/TestEC2SSMIAMConfigOutput.golden
index 26ffd08d347c8..2f1b7d0fb15d8 100644
--- a/lib/integrations/awsoidc/testdata/TestEC2SSMIAMConfigOutput.golden
+++ b/lib/integrations/awsoidc/testdata/TestEC2SSMIAMConfigOutput.golden
@@ -8,6 +8,7 @@ PutRolePolicy: {
             {
                 "Effect": "Allow",
                 "Action": [
+                    "account:ListRegions",
                     "ec2:DescribeInstances",
                     "ssm:DescribeInstanceInformation",
                     "ssm:GetCommandInvocation",
@@ -42,7 +43,7 @@ CreateDocument: {
                 "action": "aws:runShellScript",
                 "inputs": {
                     "runCommand": [
-                        "/bin/sh /tmp/installTeleport.sh \"{{ token }}\""
+                        "export {{ env }}; /bin/sh /tmp/installTeleport.sh \"{{ token }}\""
                     ],
                     "timeoutSeconds": "300"
                 },
@@ -50,6 +51,11 @@ CreateDocument: {
             }
         ],
         "parameters": {
+            "env": {
+                "default": "X=$X",
+                "description": "Environment variables exported to the script. Format 'ENV=var FOO=bar'",
+                "type": "String"
+            },
             "scriptName": {
                 "description": "(Required) The Teleport installer script to use when joining the cluster.",
                 "type": "String"
diff --git a/lib/integrations/awsoidc/token_generator.go b/lib/integrations/awsoidc/token_generator.go
index 61406cfbd09d3..14e67ee88bbf3 100644
--- a/lib/integrations/awsoidc/token_generator.go
+++ b/lib/integrations/awsoidc/token_generator.go
@@ -47,7 +47,14 @@ type Cache interface {
 	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+
+	// ListProxyServers returns a paginated list of registered proxies.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
 }
 
 // KeyStoreManager defines methods to get signers using the server's keystore.
diff --git a/lib/integrations/awsra/client.go b/lib/integrations/awsra/client.go
new file mode 100644
index 0000000000000..fdaa334c13c6f
--- /dev/null
+++ b/lib/integrations/awsra/client.go
@@ -0,0 +1,81 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/gravitational/trace"
+
+	awsutils "github.com/gravitational/teleport/api/utils/aws"
+)
+
+// AWSClientConfig contains the required fields to set up an AWS SDK Clients.
+type AWSClientConfig struct {
+	// Credentials contains the AWS credentials to use.
+	Credentials Credentials
+
+	// Region where the API call should be made.
+	Region string
+}
+
+// CheckAndSetDefaults checks if the required fields are present.
+func (req *AWSClientConfig) checkAndSetDefaults() error {
+	if req.Credentials.AccessKeyID == "" ||
+		req.Credentials.SecretAccessKey == "" ||
+		req.Credentials.SessionToken == "" {
+
+		return trace.BadParameter("credentials are missing")
+	}
+
+	if req.Region != "" {
+		if err := awsutils.IsValidRegion(req.Region); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+// newAWSConfig creates a new [aws.Config] using the [AWSClientConfig] fields.
+func newAWSConfig(ctx context.Context, req *AWSClientConfig) (aws.Config, error) {
+	if err := req.checkAndSetDefaults(); err != nil {
+		return aws.Config{}, trace.Wrap(err)
+	}
+
+	awsConfig, err := config.LoadDefaultConfig(
+		ctx,
+		config.WithRegion(req.Region),
+		config.WithCredentialsProvider(
+			credentials.NewStaticCredentialsProvider(
+				req.Credentials.AccessKeyID,
+				req.Credentials.SecretAccessKey,
+				req.Credentials.SessionToken,
+			),
+		),
+	)
+	if err != nil {
+		return aws.Config{}, trace.Wrap(err)
+	}
+
+	return awsConfig, nil
+}
diff --git a/lib/integrations/awsra/createsession/createsession.go b/lib/integrations/awsra/createsession/createsession.go
index 19135a53923f0..b1d2f44562248 100644
--- a/lib/integrations/awsra/createsession/createsession.go
+++ b/lib/integrations/awsra/createsession/createsession.go
@@ -22,8 +22,10 @@ import (
 	"bytes"
 	"cmp"
 	"context"
+	"crypto"
 	"crypto/ecdsa"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
@@ -32,6 +34,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
@@ -63,15 +66,21 @@ type CreateSessionRequest struct {
 
 	// Certificate is the certificate that will be exchanged to obtain the credentials.
 	Certificate *x509.Certificate
+	// IntermediateCertificates are the intermediate certificates needed to
+	// chain Certificate to a trusted root.
+	IntermediateCertificates []*x509.Certificate
 	// PrivateKey is the private key that will be used to sign the request.
-	PrivateKey *ecdsa.PrivateKey
+	PrivateKey crypto.Signer
+	// RegionOverride is an optional AWS region override.
+	// If not provided, this is inferred from the TrustAnchorARN.
+	RegionOverride string
 
 	awsRegion string
 
-	// httpClient is the HTTP client used to make the request.
+	// HTTPClient is the HTTP client used to make the request.
 	// If not set, a default HTTP client will be used.
 	// Used for testing purposes.
-	httpClient utils.HTTPDoClient
+	HTTPClient utils.HTTPDoClient
 
 	// clock is the clock used to get the current time.
 	// If not set, a real clock will be used.
@@ -111,15 +120,15 @@ func (req *CreateSessionRequest) checkAndSetDefaults() error {
 		return trace.BadParameter("private key is required")
 	}
 
-	if req.httpClient == nil {
+	if req.HTTPClient == nil {
 		httpClient, err := defaults.HTTPClient()
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		req.httpClient = httpClient
+		req.HTTPClient = httpClient
 	}
 
-	req.awsRegion = raTrustAnchor.Region
+	req.awsRegion = cmp.Or(req.RegionOverride, raTrustAnchor.Region)
 	if err := aws.IsValidRegion(req.awsRegion); err != nil {
 		return trace.BadParameter("invalid region: %v", err)
 	}
@@ -129,6 +138,47 @@ func (req *CreateSessionRequest) checkAndSetDefaults() error {
 	return nil
 }
 
+// From https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-sign-process.html
+// > Algorithm. As described above, instead of AWS4-HMAC-SHA256, the algorithm
+// > field will have the values of the form AWS4-X509-RSA-SHA256 or
+// > AWS4-X509-ECDSA-SHA256, depending on whether an RSA or Elliptic Curve
+// > algorithm is used. This, in turn, is determined by the key bound to the
+// > signing certificate.
+const (
+	algoRSA   = "AWS4-X509-RSA-SHA256"
+	algoECDSA = "AWS4-X509-ECDSA-SHA256"
+)
+
+func algoForKey(key crypto.Signer) (string, error) {
+	switch key.(type) {
+	case *rsa.PrivateKey:
+		return algoRSA, nil
+	case *ecdsa.PrivateKey:
+		return algoECDSA, nil
+	default:
+		return "", trace.BadParameter("unsupported key type: %T", key)
+	}
+}
+
+func signWithKey(key crypto.Signer, hash []byte) ([]byte, error) {
+	switch key := key.(type) {
+	case *ecdsa.PrivateKey:
+		signature, err := ecdsa.SignASN1(rand.Reader, key, hash)
+		if err != nil {
+			return nil, trace.Wrap(err, "signing with ECDSA")
+		}
+		return signature, nil
+	case *rsa.PrivateKey:
+		signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, hash)
+		if err != nil {
+			return nil, fmt.Errorf("signing with RSA: %w", err)
+		}
+		return signature, nil
+	default:
+		return nil, trace.BadParameter("unsupported key type: %T", key)
+	}
+}
+
 // CreateSession exchanges a certificate for AWS credentials using the AWS IAM Roles Anywhere service.
 // This method is based on the following guide:
 // https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-sign-process.html
@@ -176,43 +226,59 @@ func CreateSession(ctx context.Context, req CreateSessionRequest) (*CreateSessio
 
 	// Task 1-4,5
 	formatedDate := req.clock.Now().UTC().Round(time.Second).Format("20060102T150405Z")
-	const signedHeaders = "content-type;host;x-amz-date;x-amz-x509"
+	signedHeaders := "content-type;host;x-amz-date;x-amz-x509"
 	canonicalRequest.Header.Set("Content-Type", "application/json")
 	canonicalRequest.Header.Set("Host", canonicalRequest.Host)
 	canonicalRequest.Header.Set("X-Amz-Date", formatedDate)
 	canonicalRequest.Header.Set("X-Amz-X509", base64.StdEncoding.EncodeToString(req.Certificate.Raw))
+	if len(req.IntermediateCertificates) > 0 {
+		encodedDelimitedIntermediates := strings.Builder{}
+		for i, cert := range req.IntermediateCertificates {
+			encodedDelimitedIntermediates.WriteString(base64.StdEncoding.EncodeToString(cert.Raw))
+			if i < len(req.IntermediateCertificates)-1 {
+				encodedDelimitedIntermediates.WriteString(",")
+			}
+		}
+		canonicalRequest.Header.Set("X-Amz-X509-Chain", encodedDelimitedIntermediates.String())
+		signedHeaders += ";x-amz-x509-chain"
+	}
 
 	// Task 1-6
 	canonicalRequestBodyHash := sha256.Sum256(canonicalRequestBody)
 
 	// Task 1-7
-	canonicalRequestString := fmt.Sprintf(`POST
-/sessions
-
-content-type:application/json
-host:%s
-x-amz-date:%s
-x-amz-x509:%s
-
-%s
-%x`,
-		canonicalRequest.Header.Get("Host"),
-		canonicalRequest.Header.Get("X-Amz-Date"),
-		canonicalRequest.Header.Get("X-Amz-X509"),
-		signedHeaders,
-		canonicalRequestBodyHash,
-	)
+	canonicalReqStrBuilder := strings.Builder{}
+	canonicalReqStrBuilder.WriteString("POST\n")
+	canonicalReqStrBuilder.WriteString("/sessions\n")
+	// Blank line after method + path
+	canonicalReqStrBuilder.WriteString("\n")
+	// Headers
+	canonicalReqStrBuilder.WriteString("content-type:application/json\n")
+	canonicalReqStrBuilder.WriteString("host:" + canonicalRequest.Header.Get("Host") + "\n")
+	canonicalReqStrBuilder.WriteString("x-amz-date:" + canonicalRequest.Header.Get("X-Amz-Date") + "\n")
+	canonicalReqStrBuilder.WriteString("x-amz-x509:" + canonicalRequest.Header.Get("X-Amz-X509") + "\n")
+	if chain := canonicalRequest.Header.Get("X-Amz-X509-Chain"); chain != "" {
+		canonicalReqStrBuilder.WriteString("x-amz-x509-chain:" + chain + "\n")
+	}
+	// Blank line after headers
+	canonicalReqStrBuilder.WriteString("\n")
+	// List of signed headers
+	canonicalReqStrBuilder.WriteString(signedHeaders + "\n")
+	// Body hash encoded as hex
+	canonicalReqStrBuilder.WriteString(fmt.Sprintf("%x", canonicalRequestBodyHash))
 
 	// Task 1-8
+	canonicalRequestStr := canonicalReqStrBuilder.String()
 	canonicalRequestHashBytes := sha256.New()
-	canonicalRequestHashBytes.Write([]byte(canonicalRequestString))
+	canonicalRequestHashBytes.Write([]byte(canonicalRequestStr))
 	canonicalRequestHash := hex.EncodeToString(canonicalRequestHashBytes.Sum(nil))
 
 	// Task 2: Create a string to sign
 	// https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-sign-process.html#authentication-task2
-
-	// Teleport only uses ECDSA keys in Roles Anywhere integration.
-	const algorithm = "AWS4-X509-ECDSA-SHA256"
+	algorithm, err := algoForKey(req.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	credentialScope := formatedDate[:8] + "/" + req.awsRegion + "/rolesanywhere/aws4_request"
 
 	stringToSign := algorithm + "\n" +
@@ -223,7 +289,7 @@ x-amz-x509:%s
 	// Task 3: Calculate the signature
 	// https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-sign-process.html#authentication-task3
 	signatureHash := sha256.Sum256([]byte(stringToSign))
-	signature, err := ecdsa.SignASN1(rand.Reader, req.PrivateKey, signatureHash[:])
+	signature, err := signWithKey(req.PrivateKey, signatureHash[:])
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -238,7 +304,7 @@ x-amz-x509:%s
 			"Signature="+hex.EncodeToString(signature),
 	)
 
-	resp, err := req.httpClient.Do(canonicalRequest)
+	resp, err := req.HTTPClient.Do(canonicalRequest)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/integrations/awsra/createsession/createsession_test.go b/lib/integrations/awsra/createsession/createsession_test.go
index d4cffdf23af22..b0185ae7815a1 100644
--- a/lib/integrations/awsra/createsession/createsession_test.go
+++ b/lib/integrations/awsra/createsession/createsession_test.go
@@ -186,7 +186,7 @@ func TestCreateSession(t *testing.T) {
 		}
 
 		req := baseReq()
-		req.httpClient = httpClient
+		req.HTTPClient = httpClient
 		req.clock = clock
 		req.Certificate = x509Cert
 		req.PrivateKey = privateKey
diff --git a/lib/integrations/awsra/generate_credentials.go b/lib/integrations/awsra/generate_credentials.go
index 444968cd81e19..c3edf8dc16cc1 100644
--- a/lib/integrations/awsra/generate_credentials.go
+++ b/lib/integrations/awsra/generate_credentials.go
@@ -24,6 +24,10 @@ import (
 	"crypto/ecdsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/json"
+	"log/slog"
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -136,8 +140,8 @@ type Credentials struct {
 	SecretAccessKey string `json:"SecretAccessKey"`
 	// SessionToken is the the AWS session token for temporary credentials.
 	SessionToken string `json:"SessionToken"`
-	// Expiration is ISO8601 timestamp string when the credentials expire.
-	Expiration string `json:"Expiration"`
+	// Expiration is the timestamp when the credentials expire.
+	Expiration time.Time `json:"Expiration"`
 	// SerialNumber is the serial number of the certificate which was created and exchanged to obtain AWS Credentials.
 	// When using these credentials, CloudTrail will log the certificate's Subject Common Name, if the profile accepts it.
 	// Otherwise, the serial number is logged.
@@ -145,6 +149,17 @@ type Credentials struct {
 	SerialNumber string `json:"-"`
 }
 
+// EncodeCredentialProcessFormat encodes the credentials in the format expected by the AWS CLI credential_process.
+// See https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html#feature-process-credentials-output
+func (c *Credentials) EncodeCredentialProcessFormat() (string, error) {
+	bs, err := json.Marshal(c)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return string(bs), nil
+}
+
 // GenerateCredentials generates AWS IAM Roles Anywhere credentials for the Application (IAM Roles Anywhere Profile) and Role ARN.
 func GenerateCredentials(ctx context.Context, req GenerateCredentialsRequest) (*Credentials, error) {
 	if err := req.checkAndSetDefaults(); err != nil {
@@ -215,7 +230,7 @@ func GenerateCredentials(ctx context.Context, req GenerateCredentialsRequest) (*
 	// Providing a custom role session name to the CreateSessionAPI for a Profile that doesn't accept it, results in an Access Denied error.
 	// https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html#create-session-and-assume-role
 	if req.AcceptRoleSessionName {
-		createSessionReq.RoleSessionName = req.SubjectCommonName
+		createSessionReq.RoleSessionName = roleSessionNameFromSubject(ctx, req.SubjectCommonName)
 	}
 
 	createSessionResp, err := req.CreateSession(ctx, createSessionReq)
@@ -223,12 +238,44 @@ func GenerateCredentials(ctx context.Context, req GenerateCredentialsRequest) (*
 		return nil, trace.BadParameter("failed to create session %v", err)
 	}
 
+	parsedExpiration, err := time.Parse(time.RFC3339, createSessionResp.Expiration)
+	if err != nil {
+		return nil, trace.BadParameter("failed to parse expiration time %q: %v", createSessionResp.Expiration, err)
+	}
+
 	return &Credentials{
 		Version:         createSessionResp.Version,
 		AccessKeyID:     createSessionResp.AccessKeyID,
 		SecretAccessKey: createSessionResp.SecretAccessKey,
 		SessionToken:    createSessionResp.SessionToken,
-		Expiration:      createSessionResp.Expiration,
+		Expiration:      parsedExpiration,
 		SerialNumber:    x509Cert.SerialNumber.String(),
 	}, nil
 }
+
+// RolesAnywhere CreateSessionAPI does not mention any validation of the RoleSessionName field:
+// https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html
+// However, the API returns the following error, if it doesn't match the expected format:
+// > Value '<xyz>' at 'roleSessionName' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-zA-Z0-9_=,.@-]*"
+func roleSessionNameFromSubject(ctx context.Context, subject string) string {
+	roleSessionName := strings.Builder{}
+	changed := false
+	for _, r := range subject {
+		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || slices.Contains([]rune{'_', '=', ',', '.', '@', '-'}, r) {
+			roleSessionName.WriteRune(r)
+		} else {
+			roleSessionName.WriteRune('_')
+			changed = true
+		}
+	}
+
+	if changed {
+		slog.InfoContext(ctx,
+			"AWS role session name does not comply with Roles Anywhere CreateSession API, replaced invalid chars with _.",
+			"original", subject,
+			"role_session_name", roleSessionName.String(),
+		)
+	}
+
+	return roleSessionName.String()
+}
diff --git a/lib/integrations/awsra/generate_credentials_test.go b/lib/integrations/awsra/generate_credentials_test.go
index c82ded4908f67..a4789e08aa92e 100644
--- a/lib/integrations/awsra/generate_credentials_test.go
+++ b/lib/integrations/awsra/generate_credentials_test.go
@@ -21,15 +21,20 @@ package awsra
 import (
 	"context"
 	"crypto/x509/pkix"
+	"maps"
+	"net/url"
+	"slices"
 	"testing"
 	"time"
 
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -49,6 +54,17 @@ func TestGenerateCredentials(t *testing.T) {
 
 	ca := newCertAuthority(t, types.AWSRACA, "cluster-name")
 
+	cache := &mockCache{
+		domainName: "cluster-name",
+		ca:         ca,
+	}
+
+	keyStoreManager, err := keystore.NewManager(t.Context(), &servicecfg.KeystoreConfig{}, &keystore.Options{
+		ClusterName:          &types.ClusterNameV2{Metadata: types.Metadata{Name: "cluster-name"}},
+		AuthPreferenceGetter: cache,
+	})
+	require.NoError(t, err)
+
 	req := GenerateCredentialsRequest{
 		Clock:                 clock,
 		TrustAnchorARN:        "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
@@ -57,12 +73,9 @@ func TestGenerateCredentials(t *testing.T) {
 		SubjectCommonName:     "test-common-name",
 		DurationSeconds:       nil,
 		AcceptRoleSessionName: true,
-		KeyStoreManager:       keystore.NewSoftwareKeystoreForTests(t),
-		Cache: &mockCache{
-			domainName: "cluster-name",
-			ca:         ca,
-		},
-		CreateSession: mockCreateSessionAPI,
+		KeyStoreManager:       keyStoreManager,
+		Cache:                 cache,
+		CreateSession:         mockCreateSessionAPI,
 	}
 
 	credentials, err := GenerateCredentials(ctx, req)
@@ -77,8 +90,14 @@ func TestGenerateCredentials(t *testing.T) {
 }
 
 type mockCache struct {
-	domainName string
-	ca         types.CertAuthority
+	domainName   string
+	ca           types.CertAuthority
+	appServers   []types.AppServer
+	integrations map[string]types.Integration
+}
+
+func (m *mockCache) GetAuthPreference(context.Context) (types.AuthPreference, error) {
+	return types.DefaultAuthPreference(), nil
 }
 
 // GetClusterName returns local auth domain of the current auth server
@@ -96,6 +115,56 @@ func (m *mockCache) GetCertAuthority(ctx context.Context, id types.CertAuthID, l
 	return m.ca, nil
 }
 
+func (m *mockCache) UpsertApplicationServer(ctx context.Context, server types.AppServer) (*types.KeepAlive, error) {
+	if m.appServers == nil {
+		m.appServers = []types.AppServer{}
+	}
+
+	// Ensure the public address is a valid URL.
+	appURL := "https://" + server.GetApp().GetPublicAddr()
+	if _, err := url.Parse(appURL); err != nil {
+		return nil, trace.BadParameter("invalid public address %q for app server %q: %v", server.GetApp().GetPublicAddr(), server.GetName(), err)
+	}
+
+	m.appServers = append(m.appServers, server)
+	return nil, nil
+}
+
+func (m *mockCache) GetProxies() ([]types.Server, error) {
+	return []types.Server{&types.ServerV2{
+		Spec: types.ServerSpecV2{
+			PublicAddrs: []string{"proxy.example.com"},
+		},
+	}}, nil
+}
+
+func (m *mockCache) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	return []types.Server{&types.ServerV2{
+		Spec: types.ServerSpecV2{
+			PublicAddrs: []string{"proxy.example.com"},
+		},
+	}}, "", nil
+}
+
+func (m *mockCache) ListIntegrations(ctx context.Context, pageSize int, nextKey string) ([]types.Integration, string, error) {
+	if m.integrations == nil {
+		m.integrations = map[string]types.Integration{}
+	}
+	return slices.Collect(maps.Values(m.integrations)), "", nil
+}
+
+func (m *mockCache) UpdateIntegration(ctx context.Context, integration types.Integration) (types.Integration, error) {
+	if m.integrations == nil {
+		m.integrations = map[string]types.Integration{}
+	}
+	if _, exists := m.integrations[integration.GetName()]; !exists {
+		return nil, trace.NotFound("integration %q not found", integration.GetName())
+	}
+
+	m.integrations[integration.GetName()] = integration
+	return integration, nil
+}
+
 func newCertAuthority(t *testing.T, caType types.CertAuthType, domain string) types.CertAuthority {
 	t.Helper()
 
@@ -116,3 +185,47 @@ func newCertAuthority(t *testing.T, caType types.CertAuthType, domain string) ty
 
 	return ca
 }
+
+func TestEncodeCredentialProcessFormat(t *testing.T) {
+	credentials := Credentials{
+		Version:         1,
+		AccessKeyID:     "mock-access-key-id",
+		SecretAccessKey: "mock-secret-access-key",
+		SessionToken:    "mock-session-token",
+		Expiration:      time.Date(2030, 6, 24, 0, 0, 0, 0, time.UTC),
+	}
+	encoded, err := credentials.EncodeCredentialProcessFormat()
+	require.NoError(t, err)
+
+	expected := `{"Version":1,"AccessKeyId":"mock-access-key-id","SecretAccessKey":"mock-secret-access-key","SessionToken":"mock-session-token","Expiration":"2030-06-24T00:00:00Z"}`
+	require.JSONEq(t, expected, encoded)
+}
+
+func TestRoleSessionNameFromSubject(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		subject  string
+		expected string
+	}{
+		{
+			name:     "valid subject",
+			subject:  "my-service-name",
+			expected: "my-service-name",
+		},
+		{
+			name:     "using email",
+			subject:  "user@example.com",
+			expected: "user@example.com",
+		},
+		{
+			name:     "using email with plus sign",
+			subject:  "user+tag@example.com",
+			expected: "user_tag@example.com",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			result := roleSessionNameFromSubject(t.Context(), tt.subject)
+			require.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/lib/integrations/awsra/list_rolesanywhere_profiles.go b/lib/integrations/awsra/list_rolesanywhere_profiles.go
new file mode 100644
index 0000000000000..9da6d1150662e
--- /dev/null
+++ b/lib/integrations/awsra/list_rolesanywhere_profiles.go
@@ -0,0 +1,218 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"slices"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	"github.com/gravitational/trace"
+
+	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// ListRolesAnywhereProfilesRequest contains the required fields to list the Roles Anywhere Profiles in Amazon IAM.
+type ListRolesAnywhereProfilesRequest struct {
+	// NextToken is the token to be used to fetch the next page.
+	// If empty, the first page is fetched.
+	NextToken string
+	// PageSize is the maximum number of records to retrieve.
+	PageSize int
+	// ProfileNameFilters is a list of filters applied to the profile name.
+	// Only matching profiles will be synchronized as application servers.
+	// If empty, no filtering is applied.
+	//
+	// Filters can be globs, for example:
+	//
+	//	profile*
+	//	*name*
+	//
+	// Or regexes if they're prefixed and suffixed with ^ and $, for example:
+	//
+	//	^profile.*$
+	//	^.*name.*$
+	ProfileNameFilters []string
+	// IgnoredProfileARNs is a list of profile ARNs that should be ignored.
+	IgnoredProfileARNs []string
+}
+
+// ListRolesAnywhereProfilesResponse contains a page of Roles Anywhere Profiles.
+type ListRolesAnywhereProfilesResponse struct {
+	// Profiles contains the page of Roles Anywhere Profiles.
+	Profiles []*integrationv1.RolesAnywhereProfile `json:"profiles"`
+
+	// NextToken is used for pagination.
+	// If non-empty, it can be used to request the next page.
+	NextToken string `json:"nextToken"`
+}
+
+// RolesAnywhereProfilesLister is an interface that defines methods to interact with the AWS IAM Roles Anywhere service.
+type RolesAnywhereProfilesLister interface {
+	// Lists all profiles in the authenticated account and Amazon Web Services Region.
+	ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error)
+
+	// Lists the tags attached to the resource.
+	ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error)
+}
+
+type defaultListRolesAnywhereProfilesClient struct {
+	RolesAnywhereProfilesLister
+}
+
+// NewListRolesAnywhereProfilesClient creates a new ListRolesAnywhereProfilesClient using an AWSClientRequest.
+func NewListRolesAnywhereProfilesClient(ctx context.Context, req *AWSClientConfig) (RolesAnywhereProfilesLister, error) {
+	awsConfig, err := newAWSConfig(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &defaultListRolesAnywhereProfilesClient{
+		RolesAnywhereProfilesLister: rolesanywhere.NewFromConfig(awsConfig),
+	}, nil
+}
+
+// ListRolesAnywhereProfiles calls the following AWS API:
+// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html
+// It returns a list of Roles Anywhere Profiles and an optional NextToken that can be used to fetch the next page.
+func ListRolesAnywhereProfiles(ctx context.Context, clt RolesAnywhereProfilesLister, req ListRolesAnywhereProfilesRequest) (*ListRolesAnywhereProfilesResponse, error) {
+	var nextToken *string
+	if req.NextToken != "" {
+		nextToken = aws.String(req.NextToken)
+	}
+	listReq := listRolesAnywhereProfilesRequest{
+		nextPage:           nextToken,
+		pageSize:           req.PageSize,
+		filters:            req.ProfileNameFilters,
+		ignoredProfileARNs: req.IgnoredProfileARNs,
+	}
+	profiles, nextPageToken, err := listRolesAnywhereProfilesPage(ctx, clt, listReq)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &ListRolesAnywhereProfilesResponse{
+		Profiles:  profiles,
+		NextToken: aws.ToString(nextPageToken),
+	}, nil
+}
+
+type listRolesAnywhereProfilesRequest struct {
+	nextPage           *string
+	pageSize           int
+	filters            []string
+	ignoredProfileARNs []string
+}
+
+func listRolesAnywhereProfilesPage(ctx context.Context, raClient RolesAnywhereProfilesLister, req listRolesAnywhereProfilesRequest) (ret []*integrationv1.RolesAnywhereProfile, nextToken *string, err error) {
+	var pageSizeRequest *int32
+	if req.pageSize > 0 {
+		pageSizeRequest = aws.Int32(int32(req.pageSize))
+	}
+
+	nextPage := req.nextPage
+
+	for {
+		profilesListResp, err := raClient.ListProfiles(ctx, &rolesanywhere.ListProfilesInput{
+			NextToken: nextPage,
+			PageSize:  pageSizeRequest,
+		})
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		profilesAsProto, err := convertRolesAnywhereProfilePageToProto(ctx, profilesListResp, raClient, req)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		ret = append(ret, profilesAsProto...)
+
+		// If no profile was added (because of filters), and there's more resources, fetch the next page.
+		// This ensures that the client doesn't receive an empty page when there are more resources to fetch.
+		nextPage = profilesListResp.NextToken
+		if len(ret) == 0 && aws.ToString(nextPage) != "" {
+			continue
+		}
+		break
+	}
+
+	return ret, nextPage, nil
+}
+
+func convertRolesAnywhereProfilePageToProto(ctx context.Context, profilesListResp *rolesanywhere.ListProfilesOutput, raClient RolesAnywhereProfilesLister, req listRolesAnywhereProfilesRequest) ([]*integrationv1.RolesAnywhereProfile, error) {
+	var ret []*integrationv1.RolesAnywhereProfile
+
+	for _, profile := range profilesListResp.Profiles {
+		if slices.Contains(req.ignoredProfileARNs, aws.ToString(profile.ProfileArn)) {
+			continue
+		}
+
+		matches, err := profileNameMatchesFilters(aws.ToString(profile.Name), req.filters)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if !matches {
+			continue
+		}
+
+		profileTags, err := raClient.ListTagsForResource(ctx, &rolesanywhere.ListTagsForResourceInput{
+			ResourceArn: profile.ProfileArn,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		labels := make(map[string]string, len(profileTags.Tags))
+		for _, tag := range profileTags.Tags {
+			labels[aws.ToString(tag.Key)] = aws.ToString(tag.Value)
+		}
+
+		ret = append(ret, &integrationv1.RolesAnywhereProfile{
+			Arn:                   aws.ToString(profile.ProfileArn),
+			Name:                  aws.ToString(profile.Name),
+			Enabled:               aws.ToBool(profile.Enabled),
+			AcceptRoleSessionName: aws.ToBool(profile.AcceptRoleSessionName),
+			Roles:                 profile.RoleArns,
+			Tags:                  labels,
+		})
+	}
+
+	return ret, nil
+}
+
+func profileNameMatchesFilters(profileName string, filters []string) (bool, error) {
+	// If no filters are provided, all profiles match.
+	if len(filters) == 0 {
+		return true, nil
+	}
+
+	for _, filter := range filters {
+		matches, err := utils.MatchString(profileName, filter)
+		if err != nil {
+			return false, trace.Wrap(err, "error parsing filter: %s", filter)
+		}
+		if matches {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/lib/integrations/awsra/list_rolesanywhere_profiles_test.go b/lib/integrations/awsra/list_rolesanywhere_profiles_test.go
new file mode 100644
index 0000000000000..534686e961ed9
--- /dev/null
+++ b/lib/integrations/awsra/list_rolesanywhere_profiles_test.go
@@ -0,0 +1,224 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+)
+
+func TestListRolesAnywhereProfiles(t *testing.T) {
+	exampleProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("ExampleProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	syncProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	disabledProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid3"),
+		Enabled:               aws.Bool(false),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	client := &mockListRolesAnywhereProfiles{
+		profiles: []ratypes.ProfileDetail{
+			exampleProfile,
+			syncProfile,
+			disabledProfile,
+		},
+	}
+	resp, err := ListRolesAnywhereProfiles(t.Context(), client, ListRolesAnywhereProfilesRequest{})
+	require.NoError(t, err)
+
+	require.Len(t, resp.Profiles, 3)
+}
+
+func TestListRolesAnywhereProfilesPage(t *testing.T) {
+	rolesAnywhereProfileWithNameAndARN := func(name string, profileARN string) ratypes.ProfileDetail {
+		return ratypes.ProfileDetail{
+			Name:       aws.String(name),
+			ProfileArn: aws.String(profileARN),
+		}
+	}
+	rolesAnywhereProfileWithName := func(name string) ratypes.ProfileDetail {
+		return rolesAnywhereProfileWithNameAndARN(name, uuid.NewString())
+	}
+
+	for _, tt := range []struct {
+		name             string
+		req              listRolesAnywhereProfilesRequest
+		clientMock       RolesAnywhereProfilesLister
+		expectedResp     func(t *testing.T, page []*integrationv1.RolesAnywhereProfile)
+		expectedErrCheck require.ErrorAssertionFunc
+	}{
+		{
+			name:       "no resources",
+			req:        listRolesAnywhereProfilesRequest{},
+			clientMock: &mockIAMRolesAnywhere{},
+			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
+				require.Empty(t, page)
+			},
+			expectedErrCheck: require.NoError,
+		},
+		{
+			name: "some resources",
+			req:  listRolesAnywhereProfilesRequest{},
+			clientMock: &mockIAMRolesAnywhere{
+				profilesByID: map[string]ratypes.ProfileDetail{
+					"id1": rolesAnywhereProfileWithName("ExampleProfile"),
+				},
+			},
+			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
+				require.Len(t, page, 1)
+				require.Equal(t, "ExampleProfile", page[0].Name)
+			},
+			expectedErrCheck: require.NoError,
+		},
+		{
+			name: "with filters using glob",
+			req: listRolesAnywhereProfilesRequest{
+				filters: []string{"TeamB-*"},
+			},
+			clientMock: &mockIAMRolesAnywhere{
+				profilesByID: map[string]ratypes.ProfileDetail{
+					"id1": rolesAnywhereProfileWithName("TeamA-subteam1"),
+					"id2": rolesAnywhereProfileWithName("TeamA-subteam2"),
+					"id3": rolesAnywhereProfileWithName("TeamA-subteam3"),
+
+					"id4": rolesAnywhereProfileWithName("TeamB-subteam1"),
+					"id5": rolesAnywhereProfileWithName("TeamB-subteam2"),
+					"id6": rolesAnywhereProfileWithName("TeamB-subteam3"),
+				},
+			},
+			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
+				require.Len(t, page, 3)
+				profile := page[0]
+				require.NotEmpty(t, profile.Arn)
+				require.Contains(t, profile.Name, "TeamB-subteam")
+			},
+			expectedErrCheck: require.NoError,
+		},
+		{
+			name: "with filters using regex",
+			req: listRolesAnywhereProfilesRequest{
+				filters: []string{`^Team[A,B]{1}\-subteam\d$`},
+			},
+			clientMock: &mockIAMRolesAnywhere{
+				profilesByID: map[string]ratypes.ProfileDetail{
+					"id1": rolesAnywhereProfileWithName("TeamA-subteam1"),
+					"id2": rolesAnywhereProfileWithName("TeamA-subteam2"),
+					"id3": rolesAnywhereProfileWithName("TeamA-subteam3"),
+
+					"id4": rolesAnywhereProfileWithName("TeamB-subteam1"),
+					"id5": rolesAnywhereProfileWithName("TeamB-subteam2"),
+					"id6": rolesAnywhereProfileWithName("TeamB-subteam3"),
+
+					"id7": rolesAnywhereProfileWithName("TeamC-subteam1"),
+					"id8": rolesAnywhereProfileWithName("TeamC-subteam2"),
+					"id9": rolesAnywhereProfileWithName("TeamC-subteam3"),
+
+					"id10": rolesAnywhereProfileWithName("AnotherTeam"),
+				},
+			},
+			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
+				require.Len(t, page, 6)
+				profileNames := make([]string, 0, len(page))
+				for _, profile := range page {
+					profileNames = append(profileNames, profile.Name)
+				}
+				require.Contains(t, profileNames, "TeamA-subteam1")
+			},
+			expectedErrCheck: require.NoError,
+		},
+		{
+			name: "ignoring the sync profile",
+			req: listRolesAnywhereProfilesRequest{
+				ignoredProfileARNs: []string{"arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id1"},
+			},
+			clientMock: &mockIAMRolesAnywhere{
+				profilesByID: map[string]ratypes.ProfileDetail{
+					"id1": rolesAnywhereProfileWithNameAndARN("TeamA-subteam1", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id1"),
+					"id2": rolesAnywhereProfileWithNameAndARN("TeamA-subteam2", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id2"),
+					"id3": rolesAnywhereProfileWithNameAndARN("TeamA-subteam3", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id3"),
+					"id4": rolesAnywhereProfileWithNameAndARN("TeamB-subteam1", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id4"),
+					"id5": rolesAnywhereProfileWithNameAndARN("TeamB-subteam2", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id5"),
+					"id6": rolesAnywhereProfileWithNameAndARN("TeamB-subteam3", "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id6"),
+				},
+			},
+			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
+				require.Len(t, page, 5)
+				cmpOpts := []cmp.Option{
+					cmpopts.IgnoreUnexported(integrationv1.RolesAnywhereProfile{}),
+				}
+				require.Empty(t, cmp.Diff(page, []*integrationv1.RolesAnywhereProfile{
+					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id2", Name: "TeamA-subteam2", Tags: make(map[string]string)},
+					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id3", Name: "TeamA-subteam3", Tags: make(map[string]string)},
+					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id4", Name: "TeamB-subteam1", Tags: make(map[string]string)},
+					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id5", Name: "TeamB-subteam2", Tags: make(map[string]string)},
+					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id6", Name: "TeamB-subteam3", Tags: make(map[string]string)},
+				}, cmpOpts...))
+			},
+			expectedErrCheck: require.NoError,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			resp, _, err := listRolesAnywhereProfilesPage(t.Context(), tt.clientMock, tt.req)
+			tt.expectedErrCheck(t, err)
+			tt.expectedResp(t, resp)
+		})
+	}
+}
+
+type mockListRolesAnywhereProfiles struct {
+	profiles []ratypes.ProfileDetail
+}
+
+func (m *mockListRolesAnywhereProfiles) ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error) {
+	return &rolesanywhere.ListProfilesOutput{
+		Profiles:  m.profiles,
+		NextToken: nil,
+	}, nil
+}
+
+func (m *mockListRolesAnywhereProfiles) ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error) {
+	return &rolesanywhere.ListTagsForResourceOutput{
+		Tags: []ratypes.Tag{
+			{Key: aws.String("MyTagKey"), Value: aws.String("my-tag-value")},
+		},
+	}, nil
+}
diff --git a/lib/integrations/awsra/ping.go b/lib/integrations/awsra/ping.go
new file mode 100644
index 0000000000000..148e6a6cd0083
--- /dev/null
+++ b/lib/integrations/awsra/ping.go
@@ -0,0 +1,122 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+)
+
+// PingResponse contains the identity information and how many Roles Anywhere Profiles are active and have at least one Role.
+type PingResponse struct {
+	// AccountID is the AWS account ID of the caller.
+	AccountID string
+	// ARN is the ARN of the caller.
+	ARN string
+	// UserID is the user ID of the caller.
+	UserID string
+	// EnabledProfileCounter is the number of Roles Anywhere Profiles.
+	// Disabled profiles, profiles without assigned roles and the ProfileSync profile are not counted.
+	EnabledProfileCounter int
+}
+
+// PingClient describes the required methods to list AWS VPCs.
+type PingClient interface {
+	RolesAnywhereProfilesLister
+	CallerIdentityGetter
+}
+
+type defaultPingClient struct {
+	RolesAnywhereProfilesLister
+	stsClient CallerIdentityGetter
+}
+
+// GetCallerIdentity returns information about the caller identity.
+func (c *defaultPingClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return c.stsClient.GetCallerIdentity(ctx, params, optFns...)
+}
+
+// NewPingClient creates a new PingClient using an AWSClientCredentials.
+func NewPingClient(ctx context.Context, req *AWSClientConfig) (PingClient, error) {
+	awsConfig, err := newAWSConfig(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &defaultPingClient{
+		RolesAnywhereProfilesLister: rolesanywhere.NewFromConfig(awsConfig),
+		stsClient:                   stsutils.NewFromConfig(awsConfig),
+	}, nil
+}
+
+// Ping calls the following AWS API:
+// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html
+// https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html
+// It returns a list of Roles Anywhere Profiles that are enabled.
+//
+// It will ignore any profile matching ignoredProfileARN.
+func Ping(ctx context.Context, clt PingClient, ignoredProfileARNs []string) (*PingResponse, error) {
+	var errs []error
+
+	profileCounter := 0
+	var nextToken *string
+	for {
+		listReq := listRolesAnywhereProfilesRequest{
+			nextPage:           nextToken,
+			ignoredProfileARNs: ignoredProfileARNs,
+		}
+		profiles, nextPageToken, err := listRolesAnywhereProfilesPage(ctx, clt, listReq)
+		if err != nil {
+			errs = append(errs, err)
+			break
+		}
+		for _, profile := range profiles {
+			// Ignore disabled profiles and profiles without assigned roles.
+			if profile.Enabled && len(profile.Roles) > 0 {
+				profileCounter++
+			}
+		}
+		if aws.ToString(nextPageToken) == "" {
+			break
+		}
+		nextToken = nextPageToken
+	}
+
+	callerIdentity, err := clt.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
+	if err != nil {
+		errs = append(errs, err)
+	}
+
+	if len(errs) > 0 {
+		return nil, trace.NewAggregate(errs...)
+	}
+
+	return &PingResponse{
+		EnabledProfileCounter: profileCounter,
+		AccountID:             aws.ToString(callerIdentity.Account),
+		ARN:                   aws.ToString(callerIdentity.Arn),
+		UserID:                aws.ToString(callerIdentity.UserId),
+	}, nil
+}
diff --git a/lib/integrations/awsra/ping_test.go b/lib/integrations/awsra/ping_test.go
new file mode 100644
index 0000000000000..8525173a974c8
--- /dev/null
+++ b/lib/integrations/awsra/ping_test.go
@@ -0,0 +1,113 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPing(t *testing.T) {
+	exampleProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("ExampleProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+		RoleArns: []string{
+			"arn:aws:iam::123456789012:role/ExampleRole",
+			"arn:aws:iam::123456789012:role/SyncRole",
+		},
+	}
+
+	syncProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+		RoleArns: []string{
+			"arn:aws:iam::123456789012:role/ExampleRole",
+			"arn:aws:iam::123456789012:role/SyncRole",
+		},
+	}
+
+	disabledProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid3"),
+		Enabled:               aws.Bool(false),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	profileWithoutRoles := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid4"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	t.Run("ping returns the caller identity and 2 enabled profiles", func(t *testing.T) {
+		resp, err := Ping(t.Context(), &mockPingClient{
+			accountID: "123456789012",
+			profiles: []ratypes.ProfileDetail{
+				exampleProfile,
+				syncProfile,
+				disabledProfile,
+				profileWithoutRoles,
+			},
+		}, []string{*syncProfile.ProfileArn})
+		require.NoError(t, err)
+
+		require.Equal(t, "123456789012", resp.AccountID)
+		require.Equal(t, 1, resp.EnabledProfileCounter)
+	})
+
+}
+
+type mockPingClient struct {
+	accountID string
+	profiles  []ratypes.ProfileDetail
+}
+
+func (m *mockPingClient) ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error) {
+	return &rolesanywhere.ListProfilesOutput{
+		Profiles:  m.profiles,
+		NextToken: nil,
+	}, nil
+}
+
+func (m *mockPingClient) ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error) {
+	return &rolesanywhere.ListTagsForResourceOutput{
+		Tags: []ratypes.Tag{
+			{Key: aws.String("MyTagKey"), Value: aws.String("my-tag-value")},
+		},
+	}, nil
+}
+
+func (m *mockPingClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return &sts.GetCallerIdentityOutput{
+		Account: aws.String(m.accountID),
+		Arn:     aws.String("arn:aws:iam::123456789012:user/test-user"),
+		UserId:  aws.String("USERID1234567890"),
+	}, nil
+}
diff --git a/lib/integrations/awsra/profile_syncer.go b/lib/integrations/awsra/profile_syncer.go
new file mode 100644
index 0000000000000..6908b96f0fbb9
--- /dev/null
+++ b/lib/integrations/awsra/profile_syncer.go
@@ -0,0 +1,580 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/defaults"
+	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// AWSRolesAnywhereProfileSyncerParams contains the parameters for the AWS Roles Anywhere Profile Syncer.
+type AWSRolesAnywhereProfileSyncerParams struct {
+	// Clock is used to calculate the expiration time of the AppServers.
+	Clock clockwork.Clock
+
+	// Logger is used to log messages.
+	Logger *slog.Logger
+
+	// KeyStoreManager grants access to the AWS Roles Anywhere signer.
+	KeyStoreManager KeyStoreManager
+
+	// Cache is used to get the current cluster name and cert authority keys.
+	Cache SyncerCache
+
+	// Backend is used access the lock primitives to ensure only one Syncer is running at any given time.
+	Backend backend.Backend
+
+	// StatusReporter is used to report the status of the syncer.
+	StatusReporter StatusReporter
+
+	// AppServerUpserter is used to upsert AppServers.
+	AppServerUpserter AppServerUpserter
+
+	// HostUUID is the Host UUID to assign to the AppServers.
+	HostUUID string
+
+	// SyncPollInterval is the interval at which to poll for new profiles.
+	// Default is 5 minutes.
+	SyncPollInterval time.Duration
+
+	// subjectName is the name of the subject to use when generating AWS credentials.
+	subjectName string
+
+	// rolesAnywhereClient is the AWS Roles Anywhere client used to interact with the AWS IAM Roles Anywhere service.
+	// Should only be set for testing purposes.
+	rolesAnywhereClient RolesAnywhereClient
+
+	// createSession is the API used to create a session with AWS IAM Roles Anywhere.
+	// This is used to mock the CreateSession API in tests.
+	createSession func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error)
+}
+
+// StatusReporter is an interface that defines methods for reporting the status of the syncer.
+type StatusReporter interface {
+	// UpdateIntegration updates the current integration status.
+	UpdateIntegration(ctx context.Context, req types.Integration) (types.Integration, error)
+}
+
+// SyncerCache is the subset of the cached resources that the syncer service queries.
+type SyncerCache interface {
+	// GetCertAuthority returns cert authority by id
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
+	// GetClusterName returns the current cluster name.
+	GetClusterName(ctx context.Context) (types.ClusterName, error)
+	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
+	GetProxies() ([]types.Server, error)
+	// ListProxyServers returns a paginated list of registered proxy servers.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+	// ListIntegrations returns a paginated list of all integration resources.
+	ListIntegrations(ctx context.Context, pageSize int, nextKey string) ([]types.Integration, string, error)
+}
+
+// RolesAnywhereClient is an interface that defines methods to interact with the AWS IAM Roles Anywhere service.
+type RolesAnywhereClient interface {
+	// Lists all profiles in the authenticated account and Amazon Web Services Region.
+	ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error)
+
+	// Lists the tags attached to the resource.
+	ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error)
+}
+
+func (p *AWSRolesAnywhereProfileSyncerParams) checkAndSetDefaults() error {
+	if p.KeyStoreManager == nil {
+		return trace.BadParameter("key store manager is required")
+	}
+
+	if p.Cache == nil {
+		return trace.BadParameter("cache client is required")
+	}
+
+	if p.StatusReporter == nil {
+		return trace.BadParameter("status reporter is required")
+	}
+
+	if p.AppServerUpserter == nil {
+		return trace.BadParameter("app server upserter is required")
+	}
+
+	if p.Backend == nil {
+		return trace.BadParameter("backend is required")
+	}
+
+	if p.SyncPollInterval == 0 {
+		p.SyncPollInterval = 5 * time.Minute
+	}
+
+	if p.Logger == nil {
+		p.Logger = slog.Default()
+	}
+
+	if p.Clock == nil {
+		p.Clock = clockwork.NewRealClock()
+	}
+
+	if p.HostUUID == "" {
+		p.HostUUID = uuid.NewString()
+	}
+
+	p.subjectName = "teleport-roles-anywhere-profile-sync"
+
+	return nil
+}
+
+// AppServerUpserter is an interface that defines methods for upserting application servers.
+type AppServerUpserter interface {
+	// UpsertApplicationServer registers an application server.
+	UpsertApplicationServer(ctx context.Context, server types.AppServer) (*types.KeepAlive, error)
+}
+
+// RunAWSRolesAnywhereProfileSyncerWhileLocked runs the AWS Roles Anywhere Profile Syncer.
+// It will iterate over all AWS IAM Roles Anywhere integrations, and for each one:
+// 1. Check if the Profile Sync is enabled.
+// 2. Generate AWS credentials using the integration.
+// 3. List all profiles in the AWS IAM Roles Anywhere service.
+// 4. For each profile, check if it is enabled and has associated roles.
+// 5. Create an AppServer for each profile, using the profile name as the AppServer name.
+// AppServer name can be overridden by the `TeleportApplicationName` tag on the Profile.
+//
+// This function will run the AWS Roles Anywhere Profile Syncer while holding a lock to ensure it doesn't race on multiple auth instances.
+func RunAWSRolesAnywhereProfileSyncerWhileLocked(ctx context.Context, params AWSRolesAnywhereProfileSyncerParams) error {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	runWhileLockedConfig := backend.RunWhileLockedConfig{
+		LockConfiguration: backend.LockConfiguration{
+			Backend:            params.Backend,
+			LockNameComponents: []string{"aws-roles-anywhere.profile-sync"},
+			TTL:                time.Minute,
+			RetryInterval:      params.SyncPollInterval,
+		},
+		RefreshLockInterval: 20 * time.Second,
+	}
+
+	waitWithJitter := retryutils.SeventhJitter(time.Second * 10)
+	for {
+		err := backend.RunWhileLocked(ctx, runWhileLockedConfig, runProfileSyncer(params))
+		if err != nil && ctx.Err() == nil {
+			params.Logger.ErrorContext(
+				ctx,
+				"AWS Roles Anywhere profile syncer encountered a fatal error, it will restart after backoff",
+				"error", err,
+				"restart_after", waitWithJitter,
+			)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(waitWithJitter):
+		}
+	}
+}
+
+func runProfileSyncer(params AWSRolesAnywhereProfileSyncerParams) func(context.Context) error {
+	return func(ctx context.Context) error {
+		for {
+			if err := profileSyncIteration(ctx, params); err != nil {
+				return trace.Wrap(err)
+			}
+
+			select {
+			case <-ctx.Done():
+				return nil
+
+			case <-params.Clock.After(params.SyncPollInterval):
+			}
+		}
+	}
+}
+
+func profileSyncIteration(ctx context.Context, params AWSRolesAnywhereProfileSyncerParams) error {
+	integrations, err := integrationsWithProfileSyncEnabled(ctx, params.Cache)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if len(integrations) == 0 {
+		return nil
+	}
+
+	proxyPublicAddr, err := fetchProxyPublicAddr(params.Cache)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			params.Logger.WarnContext(ctx, "AWS IAM Roles Anywhere Profile Syncer requires a Proxy which isn't available yet. It will retry again later.")
+			return nil
+		}
+
+		return trace.Wrap(err)
+	}
+
+	for _, integration := range integrations {
+		syncSummary := syncProfileForIntegration(ctx, params, integration, proxyPublicAddr)
+		if syncSummary.setupError != nil {
+			// Only log the error if there was a set up error (eg, invalid sync configuration, missing permissions, ...).
+			// Profile specific errors (eg, invalid application url) were already logged.
+			params.Logger.WarnContext(ctx, "failed to sync AWS Roles Anywhere Profiles for integration", "error", syncSummary.setupError)
+		}
+
+		integration = updateIntegrationStatus(integration, syncSummary)
+
+		if _, err := params.StatusReporter.UpdateIntegration(ctx, integration); err != nil {
+			params.Logger.ErrorContext(ctx, "failed to update integration status", "integration", integration.GetName(), "error", err)
+		}
+	}
+
+	return nil
+}
+
+func updateIntegrationStatus(integration types.Integration, syncSummary *syncSummary) types.Integration {
+	syncError := syncSummary.setupError
+	if syncError == nil {
+		syncError = trace.NewAggregate(syncSummary.profileErrors...)
+	}
+
+	status := types.IntegrationAWSRolesAnywhereProfileSyncStatusSuccess
+	if syncError != nil {
+		status = types.IntegrationAWSRolesAnywhereProfileSyncStatusError
+	}
+
+	integration.SetStatus(types.IntegrationStatusV1{
+		AWSRolesAnywhere: &types.AWSRAIntegrationStatusV1{
+			LastProfileSync: &types.AWSRolesAnywhereProfileSyncIterationSummary{
+				StartTime:      syncSummary.startTime,
+				EndTime:        syncSummary.endTime,
+				Status:         status,
+				SyncedProfiles: int32(syncSummary.syncedProfiles),
+				ErrorMessage:   truncateErrorMessage(syncError),
+			},
+		},
+	})
+
+	return integration
+}
+
+func truncateErrorMessage(err error) string {
+	if err == nil {
+		return ""
+	}
+	errorMessage := err.Error()
+
+	if len(errorMessage) <= defaults.DefaultMaxErrorMessageSize {
+		return errorMessage
+	}
+
+	return errorMessage[:defaults.DefaultMaxErrorMessageSize]
+}
+
+func fetchProxyPublicAddr(cache SyncerCache) (string, error) {
+	proxies, err := clientutils.CollectWithFallback(context.TODO(), cache.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return cache.GetProxies()
+	})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	if len(proxies) == 0 {
+		return "", trace.NotFound("no proxies found")
+	}
+
+	proxy := proxies[0]
+	if proxy.GetPublicAddr() == "" {
+		return "", trace.NotFound("proxy %q does not have a public address", proxy.GetName())
+	}
+	return proxy.GetPublicAddr(), nil
+}
+
+func integrationsWithProfileSyncEnabled(ctx context.Context, cache SyncerCache) ([]types.Integration, error) {
+	var integrations []types.Integration
+	var nextKey string
+
+	for {
+		resp, respNextKey, err := cache.ListIntegrations(ctx, 0, nextKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, integration := range resp {
+			if integration.GetSubKind() != types.IntegrationSubKindAWSRolesAnywhere ||
+				integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig == nil ||
+				!integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.Enabled {
+
+				continue
+			}
+
+			integrations = append(integrations, integration)
+		}
+
+		if respNextKey == "" {
+			break
+		}
+		nextKey = respNextKey
+	}
+
+	return integrations, nil
+}
+
+func buildAWSRolesAnywhereClientForIntegration(ctx context.Context, params AWSRolesAnywhereProfileSyncerParams, integration types.Integration) (RolesAnywhereClient, error) {
+	trustAnchorARN := integration.GetAWSRolesAnywhereIntegrationSpec().TrustAnchorARN
+	profileSyncProfileARN := integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.ProfileARN
+	profileSyncRoleARN := integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.RoleARN
+	profileAcceptsRoleSessionName := integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.ProfileAcceptsRoleSessionName
+
+	parsedProfileSyncProfile, err := arn.Parse(profileSyncProfileARN)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	region := parsedProfileSyncProfile.Region
+
+	resp, err := GenerateCredentials(ctx, GenerateCredentialsRequest{
+		Clock:                 params.Clock,
+		TrustAnchorARN:        trustAnchorARN,
+		ProfileARN:            profileSyncProfileARN,
+		RoleARN:               profileSyncRoleARN,
+		SubjectCommonName:     params.subjectName,
+		AcceptRoleSessionName: profileAcceptsRoleSessionName,
+		KeyStoreManager:       params.KeyStoreManager,
+		Cache:                 params.Cache,
+		CreateSession:         params.createSession,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	awsConfig, err := config.LoadDefaultConfig(
+		ctx,
+		config.WithRegion(region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(resp.AccessKeyID, resp.SecretAccessKey, resp.SessionToken)),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// If a custom client is provided, use it instead.
+	// This must only be used for testing purposes.
+	if params.rolesAnywhereClient != nil {
+		return params.rolesAnywhereClient, nil
+	}
+
+	return rolesanywhere.NewFromConfig(awsConfig), nil
+}
+
+type syncSummary struct {
+	startTime time.Time
+	endTime   time.Time
+
+	// set up error is the error that occurred while setting up the syncer
+	// Examples:
+	// - invalid Integration configuration which prevents creating the AWS SDK client (ie, invalid trust anchor ARN, profile ARN, or role ARN)
+	// - failure to generate credentials to obtain the AWS SDK client
+	// - failure to list IAM Roles Anywhere Profiles (eg, IAM Role has an invalid policy)
+	setupError error
+
+	// syncedProfiles is the number of profiles that were successfully synced.
+	syncedProfiles int
+
+	// Profile errors are errors that occurred while processing individual profiles.
+	// Examples:
+	// - failure in converting a Profile to an AppServer (eg, invalid URL)
+	// - failure creating an AppServer from a Profile
+	//
+	// Always empty if setupError is not nil.
+	profileErrors []error
+}
+
+func syncProfileForIntegration(ctx context.Context, params AWSRolesAnywhereProfileSyncerParams, integration types.Integration, proxyPublicAddr string) *syncSummary {
+	logger := params.Logger.With("integration", integration.GetName())
+
+	ret := &syncSummary{
+		startTime: params.Clock.Now(),
+	}
+
+	defer func() {
+		ret.endTime = params.Clock.Now()
+	}()
+
+	raClient, err := buildAWSRolesAnywhereClientForIntegration(ctx, params, integration)
+	if err != nil {
+		ret.setupError = trace.Wrap(err)
+		return ret
+	}
+
+	profileNameFilters := integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.ProfileNameFilters
+	profileUsedForProfileSync := integration.GetAWSRolesAnywhereIntegrationSpec().ProfileSyncConfig.ProfileARN
+
+	var nextPage *string
+	for {
+		listReq := listRolesAnywhereProfilesRequest{
+			nextPage:           nextPage,
+			filters:            profileNameFilters,
+			ignoredProfileARNs: []string{profileUsedForProfileSync},
+		}
+		profilesListResp, respNextToken, err := listRolesAnywhereProfilesPage(ctx, raClient, listReq)
+		if err != nil {
+			ret.setupError = trace.Wrap(err)
+			return ret
+		}
+
+		for _, profile := range profilesListResp {
+			err := processProfile(ctx, processProfileRequest{
+				Params:          params,
+				Profile:         profile,
+				RAClient:        raClient,
+				Integration:     integration,
+				ProxyPublicAddr: proxyPublicAddr,
+			})
+			if err != nil {
+				if errors.Is(err, errDisabledProfile) {
+					logger.DebugContext(ctx, "Skipping profile", "profile_name", profile.Name, "error", err.Error())
+					continue
+				}
+
+				logger.WarnContext(ctx, "Failed to process profile", "profile_name", profile.Name, "error", err)
+				ret.profileErrors = append(ret.profileErrors, err)
+				continue
+			}
+
+			ret.syncedProfiles++
+		}
+
+		if aws.ToString(respNextToken) == "" {
+			break
+		}
+		nextPage = respNextToken
+	}
+
+	return ret
+}
+
+var (
+	errDisabledProfile = errors.New("profile is disabled")
+)
+
+type processProfileRequest struct {
+	Params          AWSRolesAnywhereProfileSyncerParams
+	Profile         *integrationv1.RolesAnywhereProfile
+	RAClient        RolesAnywhereClient
+	Integration     types.Integration
+	ProxyPublicAddr string
+}
+
+func processProfile(ctx context.Context, req processProfileRequest) error {
+	if !req.Profile.Enabled {
+		return errDisabledProfile
+	}
+
+	appServer, err := convertProfile(req.Params, req.Profile, req.Integration.GetName(), req.ProxyPublicAddr)
+	if err != nil {
+		return trace.BadParameter("failed to convert Profile to AppServer: %v", err)
+	}
+
+	if _, err := req.Params.AppServerUpserter.UpsertApplicationServer(ctx, appServer); err != nil {
+		return trace.BadParameter("failed to upsert application server from Profile: %v", err)
+	}
+
+	return nil
+}
+
+func convertProfile(params AWSRolesAnywhereProfileSyncerParams, profile *integrationv1.RolesAnywhereProfile, integrationName string, proxyPublicAddr string) (types.AppServer, error) {
+	parsedProfileARN, err := arn.Parse(profile.Arn)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	applicationName := profile.Name + "-" + integrationName
+
+	labels := make(map[string]string, len(profile.Tags))
+	for tagKey, tagValue := range profile.Tags {
+		labels["aws/"+tagKey] = tagValue
+
+		if tagKey == types.AWSRolesAnywhereProfileNameOverrideLabel {
+			applicationName = tagValue
+		}
+	}
+
+	appURL := utils.DefaultAppPublicAddr(strings.ToLower(applicationName), proxyPublicAddr)
+
+	labels[types.AWSAccountIDLabel] = parsedProfileARN.AccountID
+	labels[constants.AWSAccountIDLabel] = parsedProfileARN.AccountID
+	labels[types.IntegrationLabel] = integrationName
+	labels[types.AWSRolesAnywhereProfileARNLabel] = profile.Arn
+
+	// TODO(marco): add origin label in v19: teleport.dev/origin: integration_awsrolesanywhere
+	// types.Metadata.CheckAndSetDefaults in v17 returns an error if the origin label is set to AWS Roles Anywhere.
+	// Only V18 application services support the origin label, so we can only add it in V19.
+
+	expiration := params.Clock.Now().Add(params.SyncPollInterval * 2)
+
+	appServer, err := types.NewAppServerV3(types.Metadata{
+		Name:    applicationName,
+		Labels:  labels,
+		Expires: &expiration,
+	}, types.AppServerSpecV3{
+		HostID: params.HostUUID,
+		App: &types.AppV3{
+			Metadata: types.Metadata{
+				Name:   applicationName,
+				Labels: labels,
+			},
+			Spec: types.AppSpecV3{
+				URI:         constants.AWSConsoleURL,
+				Integration: integrationName,
+				PublicAddr:  appURL,
+				AWS: &types.AppAWS{
+					RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
+						ProfileARN:            profile.Arn,
+						AcceptRoleSessionName: profile.AcceptRoleSessionName,
+					},
+				},
+			},
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return appServer, nil
+}
diff --git a/lib/integrations/awsra/profile_syncer_test.go b/lib/integrations/awsra/profile_syncer_test.go
new file mode 100644
index 0000000000000..0c9327b296180
--- /dev/null
+++ b/lib/integrations/awsra/profile_syncer_test.go
@@ -0,0 +1,388 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func TestProfileSyncerTestAndSetDefaults(t *testing.T) {
+	keyStoreManager, err := keystore.NewManager(t.Context(), &servicecfg.KeystoreConfig{}, &keystore.Options{
+		ClusterName:          &types.ClusterNameV2{Metadata: types.Metadata{Name: "cluster-name"}},
+		AuthPreferenceGetter: &mockCache{},
+	})
+	require.NoError(t, err)
+
+	backend, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+
+	baseParams := func() *AWSRolesAnywhereProfileSyncerParams {
+		return &AWSRolesAnywhereProfileSyncerParams{
+			KeyStoreManager:   keyStoreManager,
+			Backend:           backend,
+			Cache:             &mockCache{},
+			StatusReporter:    &mockCache{},
+			AppServerUpserter: &mockCache{},
+		}
+	}
+
+	for _, tt := range []struct {
+		name       string
+		params     *AWSRolesAnywhereProfileSyncerParams
+		errCheck   require.ErrorAssertionFunc
+		valueCheck func(*testing.T, *AWSRolesAnywhereProfileSyncerParams)
+	}{
+		{
+			name:     "default values",
+			params:   baseParams(),
+			errCheck: require.NoError,
+			valueCheck: func(t *testing.T, p *AWSRolesAnywhereProfileSyncerParams) {
+				require.Equal(t, 5*time.Minute, p.SyncPollInterval)
+				require.NotNil(t, p.Logger)
+				require.NotNil(t, p.Clock)
+				require.NotEmpty(t, p.HostUUID)
+			},
+		},
+		{
+			name: "missing key store manager",
+			params: func() *AWSRolesAnywhereProfileSyncerParams {
+				p := baseParams()
+				p.KeyStoreManager = nil
+				return p
+			}(),
+			errCheck: require.Error,
+		},
+		{
+			name: "missing backend",
+			params: func() *AWSRolesAnywhereProfileSyncerParams {
+				p := baseParams()
+				p.Backend = nil
+				return p
+			}(),
+			errCheck: require.Error,
+		},
+		{
+			name: "missing cache client",
+			params: func() *AWSRolesAnywhereProfileSyncerParams {
+				p := baseParams()
+				p.Cache = nil
+				return p
+			}(),
+			errCheck: require.Error,
+		},
+		{
+			name: "missing AppServerUpserter",
+			params: func() *AWSRolesAnywhereProfileSyncerParams {
+				p := baseParams()
+				p.AppServerUpserter = nil
+				return p
+			}(),
+			errCheck: require.Error,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.params.checkAndSetDefaults()
+			if tt.errCheck != nil {
+				tt.errCheck(t, err)
+			}
+			if tt.valueCheck != nil {
+				tt.valueCheck(t, tt.params)
+			}
+		})
+	}
+}
+
+func TestRunAWSRolesAnywherProfileSyncer(t *testing.T) {
+	awsRolesAnywhereIntegration := func(t *testing.T, name string, syncEnabled bool) types.Integration {
+		t.Helper()
+
+		ig, err := types.NewIntegrationAWSRA(types.Metadata{Name: name}, &types.AWSRAIntegrationSpecV1{
+			TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/ExampleTrustAnchor",
+			ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+				Enabled:                       syncEnabled,
+				ProfileARN:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+				ProfileAcceptsRoleSessionName: true,
+				RoleARN:                       "arn:aws:iam::123456789012:role/SyncRole",
+			},
+		})
+		require.NoError(t, err)
+		return ig
+	}
+
+	mockCreateSession := func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+		return &createsession.CreateSessionResponse{
+			Version:         1,
+			AccessKeyID:     "access-key-id",
+			SecretAccessKey: "secret-access-key",
+			SessionToken:    "session-token",
+			Expiration:      time.Now().Add(1 * time.Hour).UTC().Format(time.RFC3339),
+		}, nil
+	}
+
+	exampleProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("ExampleProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	syncProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2"),
+		Enabled:               aws.Bool(true),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	disabledProfile := ratypes.ProfileDetail{
+		Name:                  aws.String("SyncProfile"),
+		ProfileArn:            aws.String("arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid3"),
+		Enabled:               aws.Bool(false),
+		AcceptRoleSessionName: aws.Bool(true),
+	}
+
+	exampleProfileTags := map[string][]ratypes.Tag{
+		aws.ToString(exampleProfile.ProfileArn): {
+			{Key: aws.String("MyTagKey"), Value: aws.String("my-tag-value")},
+		},
+	}
+
+	syncEnabled := true
+	integrationWithProfileSync := awsRolesAnywhereIntegration(t, "test-integration", syncEnabled)
+
+	syncDisabled := false
+	integrationWithoutProfileSync := awsRolesAnywhereIntegration(t, "test-integration-no-profile-sync", syncDisabled)
+
+	baseServerClient := func(t *testing.T) *mockCache {
+		t.Helper()
+		return &mockCache{
+			integrations: map[string]types.Integration{
+				integrationWithProfileSync.GetName():    integrationWithProfileSync,
+				integrationWithoutProfileSync.GetName(): integrationWithoutProfileSync,
+			},
+			ca: newCertAuthority(t, types.AWSRACA, "cluster-name"),
+		}
+	}
+
+	keyStoreManager, err := keystore.NewManager(t.Context(), &servicecfg.KeystoreConfig{}, &keystore.Options{
+		ClusterName:          &types.ClusterNameV2{Metadata: types.Metadata{Name: "cluster-name"}},
+		AuthPreferenceGetter: &mockCache{},
+	})
+	require.NoError(t, err)
+
+	backend, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+
+	baseParams := func(serverClient *mockCache) AWSRolesAnywhereProfileSyncerParams {
+		return AWSRolesAnywhereProfileSyncerParams{
+			KeyStoreManager:   keyStoreManager,
+			Cache:             serverClient,
+			StatusReporter:    serverClient,
+			Backend:           backend,
+			AppServerUpserter: serverClient,
+			Logger:            logtest.NewLogger(),
+			createSession:     mockCreateSession,
+		}
+	}
+
+	t.Run("sync profile and disabled profiles are skipped", func(t *testing.T) {
+		serverClient := baseServerClient(t)
+
+		params := baseParams(serverClient)
+		params.rolesAnywhereClient = &mockRolesAnywhereClient{
+			profiles: []ratypes.ProfileDetail{
+				syncProfile,
+				disabledProfile,
+			},
+			tags: exampleProfileTags,
+		}
+
+		synctest.Test(t, func(t *testing.T) {
+			go func() {
+				err := RunAWSRolesAnywhereProfileSyncerWhileLocked(t.Context(), params)
+				assert.NoError(t, err)
+			}()
+
+			// Wait for the 1st profile sync iteration.
+			synctest.Wait()
+
+			require.Empty(t, serverClient.appServers)
+		})
+	})
+
+	t.Run("app server is created", func(t *testing.T) {
+		serverClient := baseServerClient(t)
+
+		params := baseParams(serverClient)
+		params.rolesAnywhereClient = &mockRolesAnywhereClient{
+			profiles: []ratypes.ProfileDetail{
+				syncProfile,
+				disabledProfile,
+				exampleProfile,
+			},
+			tags: exampleProfileTags,
+		}
+
+		synctest.Test(t, func(t *testing.T) {
+			go func() {
+				err := RunAWSRolesAnywhereProfileSyncerWhileLocked(t.Context(), params)
+				assert.NoError(t, err)
+			}()
+
+			// Wait for the 1st profile sync iteration.
+			synctest.Wait()
+
+			require.Len(t, serverClient.appServers, 1)
+			appServer := serverClient.appServers[0]
+			require.Equal(t, "ExampleProfile-test-integration", appServer.GetName())
+			require.Equal(t, "123456789012", appServer.GetApp().GetAWSAccountID())
+			require.True(t, appServer.GetApp().GetAWSRolesAnywhereAcceptRoleSessionName())
+			require.Equal(t, "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1", appServer.GetApp().GetAWSRolesAnywhereProfileARN())
+			require.Equal(t, map[string]string{
+				"aws/MyTagKey":            "my-tag-value",
+				"aws_account_id":          "123456789012",
+				"teleport.dev/account-id": "123456789012",
+				"teleport.dev/aws-roles-anywhere-profile-arn": "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1",
+				"teleport.dev/integration":                    "test-integration",
+			}, appServer.GetAllLabels())
+
+			t.Run("integration status is updated", func(t *testing.T) {
+				status := serverClient.integrations[integrationWithProfileSync.GetName()].GetStatus()
+				require.NotNil(t, status)
+				lastSyncSummary := status.AWSRolesAnywhere.LastProfileSync
+				require.Equal(t, types.IntegrationAWSRolesAnywhereProfileSyncStatusSuccess, lastSyncSummary.Status)
+				require.NotEmpty(t, lastSyncSummary.StartTime)
+				require.NotEmpty(t, lastSyncSummary.EndTime)
+				require.Equal(t, int32(1), lastSyncSummary.SyncedProfiles)
+				require.Empty(t, lastSyncSummary.ErrorMessage)
+			})
+		})
+	})
+
+	t.Run("app server name is sourced from TeleportApplicationName Profile Tag, if set", func(t *testing.T) {
+		serverClient := baseServerClient(t)
+
+		params := baseParams(serverClient)
+		tags := map[string][]ratypes.Tag{
+			aws.ToString(exampleProfile.ProfileArn): {
+				{Key: aws.String("TeleportApplicationName"), Value: aws.String("ProfileCustomName")},
+			},
+		}
+		params.rolesAnywhereClient = &mockRolesAnywhereClient{
+			profiles: []ratypes.ProfileDetail{
+				exampleProfile,
+			},
+			tags: tags,
+		}
+
+		synctest.Test(t, func(t *testing.T) {
+			go func() {
+				err := RunAWSRolesAnywhereProfileSyncerWhileLocked(t.Context(), params)
+				assert.NoError(t, err)
+			}()
+
+			// Wait for the 1st profile sync iteration.
+			synctest.Wait()
+
+			require.Len(t, serverClient.appServers, 1)
+			appServer := serverClient.appServers[0]
+			require.Equal(t, "ProfileCustomName", appServer.GetName())
+			require.Equal(t, "123456789012", appServer.GetApp().GetAWSAccountID())
+			require.True(t, appServer.GetApp().GetAWSRolesAnywhereAcceptRoleSessionName())
+			require.Equal(t, "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1", appServer.GetApp().GetAWSRolesAnywhereProfileARN())
+			require.Equal(t, map[string]string{
+				"aws/TeleportApplicationName":                 "ProfileCustomName",
+				"aws_account_id":                              "123456789012",
+				"teleport.dev/account-id":                     "123456789012",
+				"teleport.dev/aws-roles-anywhere-profile-arn": "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1",
+				"teleport.dev/integration":                    "test-integration",
+			}, appServer.GetAllLabels())
+		})
+	})
+
+	t.Run("errors are reported in the integration status", func(t *testing.T) {
+		serverClient := baseServerClient(t)
+
+		params := baseParams(serverClient)
+		tags := map[string][]ratypes.Tag{
+			aws.ToString(exampleProfile.ProfileArn): {
+				{Key: aws.String("TeleportApplicationName"), Value: aws.String("``invalid host $ name")},
+			},
+		}
+		params.rolesAnywhereClient = &mockRolesAnywhereClient{
+			profiles: []ratypes.ProfileDetail{
+				exampleProfile,
+			},
+			tags: tags,
+		}
+
+		synctest.Test(t, func(t *testing.T) {
+			go func() {
+				err := RunAWSRolesAnywhereProfileSyncerWhileLocked(t.Context(), params)
+				assert.NoError(t, err)
+			}()
+
+			// Wait for the 1st profile sync iteration.
+			synctest.Wait()
+			status := serverClient.integrations[integrationWithProfileSync.GetName()].GetStatus()
+			require.NotNil(t, status)
+			lastSyncSummary := status.AWSRolesAnywhere.LastProfileSync
+			require.Equal(t, types.IntegrationAWSRolesAnywhereProfileSyncStatusError, lastSyncSummary.Status)
+			require.NotEmpty(t, lastSyncSummary.StartTime)
+			require.NotEmpty(t, lastSyncSummary.EndTime)
+			require.Equal(t, int32(0), lastSyncSummary.SyncedProfiles)
+			require.NotEmpty(t, lastSyncSummary.ErrorMessage)
+		})
+	})
+}
+
+type mockRolesAnywhereClient struct {
+	profiles []ratypes.ProfileDetail
+	tags     map[string][]ratypes.Tag
+}
+
+// Lists all profiles in the authenticated account and Amazon Web Services Region.
+func (m *mockRolesAnywhereClient) ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error) {
+	return &rolesanywhere.ListProfilesOutput{
+		Profiles: m.profiles,
+	}, nil
+}
+
+// Lists the tags attached to the resource.
+func (m *mockRolesAnywhereClient) ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error) {
+	tags := m.tags[aws.ToString(params.ResourceArn)]
+	return &rolesanywhere.ListTagsForResourceOutput{
+		Tags: tags,
+	}, nil
+}
diff --git a/lib/integrations/awsra/resource_tags.go b/lib/integrations/awsra/resource_tags.go
new file mode 100644
index 0000000000000..227ff5b3893f3
--- /dev/null
+++ b/lib/integrations/awsra/resource_tags.go
@@ -0,0 +1,32 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"github.com/gravitational/teleport/api/types/common"
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+)
+
+// defaultResourceCreationTags returns the AWS Tags which are set on resources created by this integration.
+// It will serve two purposes:
+// - to identify resources created by this integration
+// - when updating AWS resources, only those containing this label will be updated
+func defaultResourceCreationTags(clusterName, integrationName string) tags.AWSTags {
+	return tags.DefaultResourceCreationTags(clusterName, integrationName, common.OriginIntegrationAWSRolesAnywhere)
+}
diff --git a/lib/integrations/awsra/trustanchor_config.go b/lib/integrations/awsra/trustanchor_config.go
new file mode 100644
index 0000000000000..6e19df7896918
--- /dev/null
+++ b/lib/integrations/awsra/trustanchor_config.go
@@ -0,0 +1,284 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/gravitational/trace"
+
+	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+	"github.com/gravitational/teleport/lib/cloud/provisioning"
+	"github.com/gravitational/teleport/lib/cloud/provisioning/awsactions"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils/aws/iamutils"
+	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+)
+
+// TrustAnchorConfigureRequest represents a request to configure AWS IAM Roles Anywhere integration.
+type TrustAnchorConfigureRequest struct {
+	// Cluster is the Teleport Cluster.
+	// Used for tagging the created RolesAnywhere Trust Anchor/Profile and IAM Role.
+	Cluster string
+
+	// AccountID is the AWS Account ID.
+	// Optional. sts.GetCallerIdentity is used if not provided.
+	AccountID string
+
+	// IntegrationName is the Integration Name.
+	// Used for tagging the created RolesAnywhere Trust Anchor/Profile and IAM Role.
+	IntegrationName string
+
+	// TrustAnchorName is the name of the trust anchor.
+	TrustAnchorName string
+
+	// TrustAnchorCertBase64 is the base64 encoded PEM certificate of the trust anchor.
+	TrustAnchorCertBase64 string
+
+	// SyncProfileName is the name of the AWS IAM Roles Anywhere Profile to create, used to sync profiles.
+	SyncProfileName string
+
+	// SyncRoleName is the name of the AWS IAM Role to create, used to sync profiles.
+	SyncRoleName string
+
+	// AutoConfirm skips user confirmation of the operation plan if true.
+	AutoConfirm bool
+
+	ownershipTags tags.AWSTags
+
+	// stdout is used to override stdout output in tests.
+	stdout io.Writer
+}
+
+// CheckAndSetDefaults ensures the required fields are present.
+func (r *TrustAnchorConfigureRequest) CheckAndSetDefaults() error {
+	if r.Cluster == "" {
+		return trace.BadParameter("cluster is required")
+	}
+
+	if r.IntegrationName == "" {
+		return trace.BadParameter("integration name is required")
+	}
+
+	if r.TrustAnchorName == "" {
+		return trace.BadParameter("trust anchor name is required")
+	}
+
+	if r.TrustAnchorCertBase64 == "" {
+		return trace.BadParameter("trust anchor's certificate is required")
+	}
+
+	if r.SyncProfileName == "" {
+		return trace.BadParameter("roles anywhere profile name used for the sync process is required")
+	}
+
+	if r.SyncRoleName == "" {
+		return trace.BadParameter("role name used for the sync process is required")
+	}
+
+	r.ownershipTags = defaultResourceCreationTags(r.Cluster, r.IntegrationName)
+
+	if r.stdout == nil {
+		r.stdout = os.Stdout
+	}
+
+	return nil
+}
+
+// CallerIdentityGetter is an interface that defines the method to get the caller identity from AWS STS.
+type CallerIdentityGetter interface {
+	// GetCallerIdentity retrieves the AWS caller identity.
+	GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error)
+}
+
+// RolesAnywhereIAMConfigurationClient describes the required methods to create the AWS IAM Roles Anywhere Trust Anchor, Profile and the IAM Role.
+// There is no guarantee that the client is thread safe.
+type RolesAnywhereIAMConfigurationClient interface {
+	CallerIdentityGetter
+
+	awsactions.RolesAnywhereTrustAnchorLister
+	awsactions.RolesAnywhereTrustAnchorCreator
+	awsactions.RolesAnywhereTrustAnchorUpdater
+
+	awsactions.RolesAnywhereProfileLister
+	awsactions.RolesAnywhereProfileCreator
+	awsactions.RolesAnywhereProfileUpdater
+
+	awsactions.RolesAnywhereResourceTagsGetter
+
+	awsactions.AssumeRolePolicyUpdater
+	awsactions.RoleCreator
+	awsactions.RoleGetter
+	awsactions.RoleTagger
+	awsactions.PolicyAssigner
+}
+
+type defaultRolesAnywhereIAMConfigurationClient struct {
+	CallerIdentityGetter
+	*rolesanywhere.Client
+	iamClient *iam.Client
+
+	httpClient *http.Client
+}
+
+func (c *defaultRolesAnywhereIAMConfigurationClient) CreateRole(ctx context.Context, params *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error) {
+	return c.iamClient.CreateRole(ctx, params, optFns...)
+}
+func (c *defaultRolesAnywhereIAMConfigurationClient) GetRole(ctx context.Context, params *iam.GetRoleInput, optFns ...func(*iam.Options)) (*iam.GetRoleOutput, error) {
+	return c.iamClient.GetRole(ctx, params, optFns...)
+}
+func (c *defaultRolesAnywhereIAMConfigurationClient) PutRolePolicy(ctx context.Context, params *iam.PutRolePolicyInput, optFns ...func(*iam.Options)) (*iam.PutRolePolicyOutput, error) {
+	return c.iamClient.PutRolePolicy(ctx, params, optFns...)
+}
+func (c *defaultRolesAnywhereIAMConfigurationClient) TagRole(ctx context.Context, params *iam.TagRoleInput, optFns ...func(*iam.Options)) (*iam.TagRoleOutput, error) {
+	return c.iamClient.TagRole(ctx, params, optFns...)
+}
+func (c *defaultRolesAnywhereIAMConfigurationClient) UpdateAssumeRolePolicy(ctx context.Context, params *iam.UpdateAssumeRolePolicyInput, optFns ...func(*iam.Options)) (*iam.UpdateAssumeRolePolicyOutput, error) {
+	return c.iamClient.UpdateAssumeRolePolicy(ctx, params, optFns...)
+}
+
+// NewRolesAnywhereIAMConfigurationClient creates a new RolesAnywhereIAMConfigurationClient.
+// The client is not thread safe.
+func NewRolesAnywhereIAMConfigurationClient(ctx context.Context) (RolesAnywhereIAMConfigurationClient, error) {
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	httpClient, err := defaults.HTTPClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &defaultRolesAnywhereIAMConfigurationClient{
+		httpClient:           httpClient,
+		Client:               rolesanywhere.NewFromConfig(cfg),
+		iamClient:            iamutils.NewFromConfig(cfg),
+		CallerIdentityGetter: stsutils.NewFromConfig(cfg),
+	}, nil
+}
+
+// ConfigureRolesAnywhereIAM creates a new AWS IAM Roles Anywhere Trust Anchor.
+// It also creates a new AWS IAM Roles Anywhere Profile and a new AWS IAM Role which is used to sync Profiles into Teleport resources (AWS Apps).
+//
+// The following actions must be allowed by the IAM Role assigned in the Client.
+//   - rolesanywhere:CreateTrustAnchor
+//   - rolesanywhere:CreateProfile
+//   - iam:CreateRole
+//   - iam:GetRole
+//   - iam:UpdateAssumeRolePolicy
+func ConfigureRolesAnywhereIAM(ctx context.Context, clt RolesAnywhereIAMConfigurationClient, req TrustAnchorConfigureRequest) error {
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if req.AccountID == "" {
+		callerIdentity, err := clt.GetCallerIdentity(ctx, nil)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		req.AccountID = aws.ToString(callerIdentity.Account)
+	}
+
+	createRolesAnywhereTrustAnchorAction, err := createIAMRolesAnywhereTrustAnchor(clt, req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	createIAMSyncRoleAction, err := createIAMSyncRoleAction(clt, req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	assignListProfilesPolicyToSyncRoleAction, err := assignProfileSyncPolicyToRoleAction(clt, req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	createIAMSyncProfileAction, err := createIAMSyncProfileAction(clt, req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	trustAnchorSetUpARNsAction, err := awsactions.TrustAnchorSetUpARNs(clt, req.TrustAnchorName, req.SyncProfileName, req.SyncRoleName, req.stdout)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	actions := []provisioning.Action{
+		*createRolesAnywhereTrustAnchorAction,
+		*createIAMSyncRoleAction,
+		*assignListProfilesPolicyToSyncRoleAction,
+		*createIAMSyncProfileAction,
+		*trustAnchorSetUpARNsAction,
+	}
+
+	return trace.Wrap(provisioning.Run(ctx, provisioning.OperationConfig{
+		Name:        "awsra-trust-anchor",
+		Actions:     actions,
+		AutoConfirm: req.AutoConfirm,
+		Output:      req.stdout,
+	}))
+}
+
+func createIAMRolesAnywhereTrustAnchor(clt RolesAnywhereIAMConfigurationClient, req TrustAnchorConfigureRequest) (*provisioning.Action, error) {
+	return awsactions.CreateRolesAnywhereTrustAnchorProvider(clt, req.TrustAnchorName, req.TrustAnchorCertBase64, req.ownershipTags)
+}
+
+func createIAMSyncRoleAction(clt RolesAnywhereIAMConfigurationClient, req TrustAnchorConfigureRequest) (*provisioning.Action, error) {
+	return awsactions.CreateRoleForTrustAnchor(clt, awsactions.CreateRoleForTrustAnchorRequest{
+		AccountID:       req.AccountID,
+		RoleName:        req.SyncRoleName,
+		RoleDescription: "Used by Teleport to provide access to AWS resources.",
+		TrustAnchorName: req.TrustAnchorName,
+		Tags:            req.ownershipTags,
+	})
+}
+
+func createIAMSyncProfileAction(clt RolesAnywhereIAMConfigurationClient, req TrustAnchorConfigureRequest) (*provisioning.Action, error) {
+	syncRoleARN := fmt.Sprintf("arn:aws:iam::%s:role/%s", req.AccountID, req.SyncRoleName)
+
+	return awsactions.CreateRolesAnywhereProfileProvider(clt,
+		req.SyncProfileName,
+		syncRoleARN,
+		req.ownershipTags,
+	)
+}
+
+func assignProfileSyncPolicyToRoleAction(clt RolesAnywhereIAMConfigurationClient, req TrustAnchorConfigureRequest) (*provisioning.Action, error) {
+	policyStatement := awslib.StatementForAWSRolesAnywhereSyncRolePolicy()
+
+	return awsactions.AssignRolePolicy(
+		clt,
+		awsactions.RolePolicy{
+			RoleName:        req.SyncRoleName,
+			PolicyName:      "TeleportRolesAnywhereProfileSync",
+			PolicyStatement: policyStatement,
+		})
+}
diff --git a/lib/integrations/awsra/trustanchor_config_test.go b/lib/integrations/awsra/trustanchor_config_test.go
new file mode 100644
index 0000000000000..aed0af04390b0
--- /dev/null
+++ b/lib/integrations/awsra/trustanchor_config_test.go
@@ -0,0 +1,512 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	ratypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/cloud/aws/tags"
+)
+
+var badParameterCheck = func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+	require.True(t, trace.IsBadParameter(err), `expected "bad parameter", but got %v`, err)
+}
+
+func TestConfigureRolesAnywhereIAMReqDefaults(t *testing.T) {
+	baseRolesAnywhereConfigReq := func() TrustAnchorConfigureRequest {
+		return TrustAnchorConfigureRequest{
+			Cluster:               "mycluster",
+			AccountID:             "123456789012",
+			IntegrationName:       "myintegration",
+			TrustAnchorName:       "mytrustanchor",
+			TrustAnchorCertBase64: base64.StdEncoding.EncodeToString([]byte("-----BEGIN CERTIFICATE-----\nMIID...==\n-----END CERTIFICATE-----")),
+			SyncProfileName:       "mysyncprofile",
+			SyncRoleName:          "myrole",
+			AutoConfirm:           true,
+		}
+	}
+
+	for _, tt := range []struct {
+		name     string
+		req      func() TrustAnchorConfigureRequest
+		errCheck require.ErrorAssertionFunc
+		expected TrustAnchorConfigureRequest
+	}{
+		{
+			name:     "set defaults",
+			req:      baseRolesAnywhereConfigReq,
+			errCheck: require.NoError,
+			expected: TrustAnchorConfigureRequest{
+				Cluster:               "mycluster",
+				AccountID:             "123456789012",
+				IntegrationName:       "myintegration",
+				TrustAnchorName:       "mytrustanchor",
+				TrustAnchorCertBase64: base64.StdEncoding.EncodeToString([]byte("-----BEGIN CERTIFICATE-----\nMIID...==\n-----END CERTIFICATE-----")),
+				SyncProfileName:       "mysyncprofile",
+				SyncRoleName:          "myrole",
+				AutoConfirm:           true,
+				ownershipTags: tags.AWSTags{
+					"teleport.dev/origin":      "integration_awsrolesanywhere",
+					"teleport.dev/cluster":     "mycluster",
+					"teleport.dev/integration": "myintegration",
+				},
+				stdout: os.Stdout,
+			},
+		},
+		{
+			name: "missing cluster name",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.Cluster = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing integration name",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.IntegrationName = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing trust anchor name",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.TrustAnchorName = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing trust anchor cert",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.TrustAnchorCertBase64 = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing sync profile name",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.SyncProfileName = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing sync role name",
+			req: func() TrustAnchorConfigureRequest {
+				req := baseRolesAnywhereConfigReq()
+				req.SyncRoleName = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			req := tt.req()
+			err := req.CheckAndSetDefaults()
+			tt.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Equal(t, tt.expected, req)
+		})
+	}
+}
+
+func TestConfigureRolesAnywhereTrustAnchor(t *testing.T) {
+	ctx := context.Background()
+
+	baseRolesAnywhereConfigReq := func() TrustAnchorConfigureRequest {
+		return TrustAnchorConfigureRequest{
+			Cluster:               "mycluster",
+			AccountID:             "123456789012",
+			IntegrationName:       "myintegration",
+			TrustAnchorName:       "mytrustanchor",
+			TrustAnchorCertBase64: base64.StdEncoding.EncodeToString([]byte("-----BEGIN CERTIFICATE-----\nMIID...==\n-----END CERTIFICATE-----")),
+			SyncProfileName:       "mysyncprofile",
+			SyncRoleName:          "mysyncrole",
+			AutoConfirm:           true,
+		}
+	}
+
+	for _, tt := range []struct {
+		name                   string
+		req                    func() TrustAnchorConfigureRequest
+		existingTrustAnchors   []ratypes.TrustAnchorDetail
+		existingProfiles       []ratypes.ProfileDetail
+		existingRAResourceTags map[string][]ratypes.Tag
+		existingRoles          []mockRole
+		trustAnchorID          string
+		errCheck               require.ErrorAssertionFunc
+		externalStateCheck     func(*testing.T, mockIAMRolesAnywhereClient)
+	}{
+		{
+			name:          "valid",
+			req:           baseRolesAnywhereConfigReq,
+			errCheck:      require.NoError,
+			trustAnchorID: "my-trust-anchor-uuid",
+			externalStateCheck: func(t *testing.T, clt mockIAMRolesAnywhereClient) {
+				trustAnchors, err := clt.ListTrustAnchors(ctx, &rolesanywhere.ListTrustAnchorsInput{})
+				require.NoError(t, err)
+				require.Len(t, trustAnchors.TrustAnchors, 1)
+				require.Equal(t, "mytrustanchor", aws.ToString(trustAnchors.TrustAnchors[0].Name))
+				require.Equal(t, "my-trust-anchor-uuid", aws.ToString(trustAnchors.TrustAnchors[0].TrustAnchorId))
+
+				syncRoleTrustPolicy := clt.mockIAMRoles.existingRoles["mysyncrole"].assumeRolePolicyDoc
+				expectedSyncRoleTrustPolicy := `{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "sts:AssumeRole",
+                "sts:SetSourceIdentity",
+                "sts:TagSession"
+            ],
+            "Principal": {
+                "Service": "rolesanywhere.amazonaws.com"
+            },
+            "Condition": {
+                "ArnEquals": {
+                    "aws:SourceArn": "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/my-trust-anchor-uuid"
+                }
+            }
+        }
+    ]
+}`
+				require.Equal(t, expectedSyncRoleTrustPolicy, aws.ToString(syncRoleTrustPolicy))
+			},
+		},
+		{
+			name: "trust anchor already exists but is missing the required ownership tags",
+			req:  baseRolesAnywhereConfigReq,
+			existingTrustAnchors: []ratypes.TrustAnchorDetail{{
+				Name: aws.String("mytrustanchor"),
+			}},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(tt, err, "is not owned by this integration")
+			},
+		},
+		{
+			name: "profile already exists but is missing the required ownership tags",
+			req:  baseRolesAnywhereConfigReq,
+			existingProfiles: []ratypes.ProfileDetail{{
+				Name: aws.String("mysyncprofile"),
+			}},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(tt, err, "is not owned by this integration")
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			existingTrustAnchors := make(map[string]ratypes.TrustAnchorDetail, len(tt.existingTrustAnchors))
+			for _, trustAnchor := range tt.existingTrustAnchors {
+				existingTrustAnchors[aws.ToString(trustAnchor.TrustAnchorId)] = trustAnchor
+			}
+
+			existingProfiles := make(map[string]ratypes.ProfileDetail, len(tt.existingProfiles))
+			for _, profile := range tt.existingProfiles {
+				existingProfiles[aws.ToString(profile.ProfileId)] = profile
+			}
+
+			existingResourceTags := make(map[string][]ratypes.Tag, len(tt.existingRAResourceTags))
+			for resourceARN, resourceTags := range tt.existingRAResourceTags {
+				existingResourceTags[resourceARN] = resourceTags
+			}
+
+			existingRoles := make(map[string]iamtypes.Role, len(tt.existingRoles))
+			for _, role := range tt.existingRoles {
+				existingRoles[role.name] = iamtypes.Role{
+					Arn:                      aws.String("arn:aws:iam::123456789012:role/" + role.name),
+					AssumeRolePolicyDocument: role.assumeRolePolicyDoc,
+					Tags:                     role.tags,
+				}
+			}
+
+			clt := mockIAMRolesAnywhereClient{
+				mockIAMRolesAnywhere: mockIAMRolesAnywhere{
+					trustAnchorsByID: existingTrustAnchors,
+					profilesByID:     existingProfiles,
+					resourceTags:     existingResourceTags,
+					trustAnchorID:    tt.trustAnchorID,
+				},
+				mockIAMRoles: mockIAMRoles{
+					existingRoles: make(map[string]mockRole),
+				},
+			}
+
+			err := ConfigureRolesAnywhereIAM(ctx, &clt, tt.req())
+			tt.errCheck(t, err)
+
+			if tt.externalStateCheck != nil {
+				tt.externalStateCheck(t, clt)
+			}
+		})
+	}
+}
+
+type mockIAMRolesAnywhere struct {
+	trustAnchorID    string
+	trustAnchorsByID map[string]ratypes.TrustAnchorDetail
+	profilesByID     map[string]ratypes.ProfileDetail
+	resourceTags     map[string][]ratypes.Tag
+}
+
+func (m *mockIAMRolesAnywhere) ListTrustAnchors(ctx context.Context, params *rolesanywhere.ListTrustAnchorsInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTrustAnchorsOutput, error) {
+	return &rolesanywhere.ListTrustAnchorsOutput{
+		TrustAnchors: slices.Collect(maps.Values(m.trustAnchorsByID)),
+	}, nil
+}
+
+func (m *mockIAMRolesAnywhere) CreateTrustAnchor(ctx context.Context, params *rolesanywhere.CreateTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.CreateTrustAnchorOutput, error) {
+	newTrustAnchorID := uuid.NewString()
+	if m.trustAnchorID != "" {
+		newTrustAnchorID = m.trustAnchorID
+	}
+	newTrustAnchorARN := "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/" + newTrustAnchorID
+
+	m.trustAnchorsByID[newTrustAnchorID] = ratypes.TrustAnchorDetail{
+		Name:           params.Name,
+		TrustAnchorArn: aws.String(newTrustAnchorARN),
+		TrustAnchorId:  aws.String(newTrustAnchorID),
+		Enabled:        params.Enabled,
+	}
+
+	m.resourceTags[newTrustAnchorARN] = params.Tags
+
+	return nil, nil
+}
+
+func (m *mockIAMRolesAnywhere) UpdateTrustAnchor(ctx context.Context, params *rolesanywhere.UpdateTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.UpdateTrustAnchorOutput, error) {
+	existingTrustAnchor, ok := m.trustAnchorsByID[aws.ToString(params.TrustAnchorId)]
+	if !ok {
+		return nil, trace.NotFound("trust anchor %q not found", aws.ToString(params.TrustAnchorId))
+	}
+	existingTrustAnchor.Source = params.Source
+
+	m.trustAnchorsByID[aws.ToString(params.TrustAnchorId)] = existingTrustAnchor
+	return nil, nil
+}
+
+func (m *mockIAMRolesAnywhere) EnableTrustAnchor(ctx context.Context, params *rolesanywhere.EnableTrustAnchorInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.EnableTrustAnchorOutput, error) {
+	existingTrustAnchor, ok := m.trustAnchorsByID[aws.ToString(params.TrustAnchorId)]
+	if !ok {
+		return nil, trace.NotFound("trust anchor %q not found", aws.ToString(params.TrustAnchorId))
+	}
+	existingTrustAnchor.Enabled = aws.Bool(true)
+
+	m.trustAnchorsByID[aws.ToString(params.TrustAnchorId)] = existingTrustAnchor
+	return nil, nil
+}
+
+func (m *mockIAMRolesAnywhere) ListTagsForResource(ctx context.Context, params *rolesanywhere.ListTagsForResourceInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListTagsForResourceOutput, error) {
+	return &rolesanywhere.ListTagsForResourceOutput{
+		Tags: m.resourceTags[aws.ToString(params.ResourceArn)],
+	}, nil
+}
+
+func (m *mockIAMRolesAnywhere) ListProfiles(ctx context.Context, params *rolesanywhere.ListProfilesInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.ListProfilesOutput, error) {
+	if m.profilesByID == nil {
+		m.profilesByID = make(map[string]ratypes.ProfileDetail)
+	}
+
+	allProfiles := slices.Collect(maps.Values(m.profilesByID))
+	slices.SortFunc(allProfiles, func(a, b ratypes.ProfileDetail) int {
+		return strings.Compare(aws.ToString(a.ProfileArn), aws.ToString(b.ProfileArn))
+	})
+
+	return &rolesanywhere.ListProfilesOutput{
+		Profiles: allProfiles,
+	}, nil
+}
+
+func (m *mockIAMRolesAnywhere) CreateProfile(ctx context.Context, params *rolesanywhere.CreateProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.CreateProfileOutput, error) {
+	newProfileID := uuid.NewString()
+	newProfileARN := "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/" + newProfileID
+
+	m.profilesByID[newProfileID] = ratypes.ProfileDetail{
+		Name:       params.Name,
+		ProfileArn: aws.String(newProfileARN),
+		ProfileId:  aws.String(newProfileID),
+		Enabled:    params.Enabled,
+	}
+
+	m.resourceTags[newProfileARN] = params.Tags
+
+	return nil, nil
+}
+
+func (m *mockIAMRolesAnywhere) UpdateProfile(ctx context.Context, params *rolesanywhere.UpdateProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.UpdateProfileOutput, error) {
+	existingProfile, ok := m.profilesByID[aws.ToString(params.ProfileId)]
+	if !ok {
+		return nil, trace.NotFound("trust anchor %q not found", aws.ToString(params.ProfileId))
+	}
+	existingProfile.AcceptRoleSessionName = params.AcceptRoleSessionName
+	existingProfile.RoleArns = params.RoleArns
+
+	m.profilesByID[aws.ToString(params.ProfileId)] = existingProfile
+	return nil, nil
+}
+
+func (m *mockIAMRolesAnywhere) EnableProfile(ctx context.Context, params *rolesanywhere.EnableProfileInput, optFns ...func(*rolesanywhere.Options)) (*rolesanywhere.EnableProfileOutput, error) {
+	existingProfile, ok := m.profilesByID[aws.ToString(params.ProfileId)]
+	if !ok {
+		return nil, trace.NotFound("trust anchor %q not found", aws.ToString(params.ProfileId))
+	}
+	existingProfile.Enabled = aws.Bool(true)
+
+	m.profilesByID[aws.ToString(params.ProfileId)] = existingProfile
+	return nil, nil
+}
+
+type mockIAMRolesAnywhereClient struct {
+	mockIAMRolesAnywhere
+	mockIAMRoles
+}
+
+func (m *mockIAMRolesAnywhereClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return &sts.GetCallerIdentityOutput{
+		Account: aws.String("123456789012"),
+	}, nil
+}
+
+type mockRole struct {
+	name                string
+	assumeRolePolicyDoc *string
+	tags                []iamtypes.Tag
+	presetPolicyDoc     *string
+}
+
+type mockIAMRoles struct {
+	existingRoles map[string]mockRole
+}
+
+// CreateRole creates a new IAM Role.
+func (m *mockIAMRoles) CreateRole(ctx context.Context, params *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error) {
+	alreadyExistsMessage := fmt.Sprintf("Role %q already exists.", *params.RoleName)
+	_, found := m.existingRoles[aws.ToString(params.RoleName)]
+	if found {
+		return nil, &iamtypes.EntityAlreadyExistsException{
+			Message: &alreadyExistsMessage,
+		}
+	}
+	m.existingRoles[*params.RoleName] = mockRole{
+		tags:                params.Tags,
+		assumeRolePolicyDoc: params.AssumeRolePolicyDocument,
+	}
+
+	return &iam.CreateRoleOutput{
+		Role: &iamtypes.Role{
+			Arn: aws.String("arn:something"),
+		},
+	}, nil
+}
+
+// PutRolePolicy assigns a policy to an existing IAM Role.
+func (m *mockIAMRoles) PutRolePolicy(ctx context.Context, params *iam.PutRolePolicyInput, optFns ...func(*iam.Options)) (*iam.PutRolePolicyOutput, error) {
+	doesNotExistMessage := fmt.Sprintf("Role %q does not exist.", *params.RoleName)
+	if _, ok := m.existingRoles[aws.ToString(params.RoleName)]; !ok {
+		return nil, &iamtypes.NoSuchEntityException{
+			Message: &doesNotExistMessage,
+		}
+	}
+
+	m.existingRoles[*params.RoleName] = mockRole{
+		tags:                m.existingRoles[*params.RoleName].tags,
+		assumeRolePolicyDoc: m.existingRoles[*params.RoleName].assumeRolePolicyDoc,
+		presetPolicyDoc:     params.PolicyDocument,
+	}
+
+	return &iam.PutRolePolicyOutput{}, nil
+}
+
+// GetRole retrieves information about the specified role, including the role's path,
+// GUID, ARN, and the role's trust policy that grants permission to assume the
+// role.
+func (m *mockIAMRoles) GetRole(ctx context.Context, params *iam.GetRoleInput, optFns ...func(*iam.Options)) (*iam.GetRoleOutput, error) {
+	role, found := m.existingRoles[aws.ToString(params.RoleName)]
+	if !found {
+		return nil, trace.NotFound("role not found")
+	}
+	return &iam.GetRoleOutput{
+		Role: &iamtypes.Role{
+			Tags:                     role.tags,
+			AssumeRolePolicyDocument: role.assumeRolePolicyDoc,
+			Arn:                      aws.String("arn:aws:iam::123456789012:role/" + aws.ToString(params.RoleName)),
+		},
+	}, nil
+}
+
+// UpdateAssumeRolePolicy updates the policy that grants an IAM entity permission to assume a role.
+// This is typically referred to as the "role trust policy".
+func (m *mockIAMRoles) UpdateAssumeRolePolicy(ctx context.Context, params *iam.UpdateAssumeRolePolicyInput, optFns ...func(*iam.Options)) (*iam.UpdateAssumeRolePolicyOutput, error) {
+	role, found := m.existingRoles[aws.ToString(params.RoleName)]
+	if !found {
+		return nil, trace.NotFound("role not found")
+	}
+
+	role.assumeRolePolicyDoc = params.PolicyDocument
+	m.existingRoles[aws.ToString(params.RoleName)] = role
+
+	return &iam.UpdateAssumeRolePolicyOutput{}, nil
+}
+
+func (m *mockIAMRoles) TagRole(ctx context.Context, params *iam.TagRoleInput, _ ...func(*iam.Options)) (*iam.TagRoleOutput, error) {
+	roleName := aws.ToString(params.RoleName)
+	role, found := m.existingRoles[roleName]
+	if !found {
+		return nil, trace.NotFound("role not found")
+	}
+
+	tags := tags.AWSTags{}
+	for _, existingTag := range role.tags {
+		tags[*existingTag.Key] = *existingTag.Value
+	}
+	for _, newTag := range params.Tags {
+		tags[*newTag.Key] = *newTag.Value
+	}
+	role.tags = tags.ToIAMTags()
+	m.existingRoles[roleName] = role
+	return &iam.TagRoleOutput{}, nil
+}
diff --git a/lib/integrations/azureoidc/token_generator.go b/lib/integrations/azureoidc/token_generator.go
index 9f3524f6bde80..fcb402b94eeb8 100644
--- a/lib/integrations/azureoidc/token_generator.go
+++ b/lib/integrations/azureoidc/token_generator.go
@@ -52,7 +52,14 @@ type Cache interface {
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+
+	// ListProxyServers returns a paginated list of registered proxies.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
 }
 
 // GenerateEntraOIDCToken returns a JWT suitable for OIDC authentication to MS Graph API.
diff --git a/lib/integrations/externalauditstorage/configurator_test.go b/lib/integrations/externalauditstorage/configurator_test.go
index df845e15a1e15..b833a7ee5aeb5 100644
--- a/lib/integrations/externalauditstorage/configurator_test.go
+++ b/lib/integrations/externalauditstorage/configurator_test.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services/local"
 )
 
@@ -75,13 +76,13 @@ func TestConfiguratorIsUsed(t *testing.T) {
 	draftConfig := testDraftExternalAuditStorage(t)
 	tests := []struct {
 		name              string
-		modules           *modules.TestModules
+		modules           modulestest.Modules
 		resourceServiceFn func(t *testing.T, s *local.ExternalAuditStorageService)
 		wantIsUsed        bool
 	}{
 		{
 			name: "not cloud",
-			modules: &modules.TestModules{
+			modules: modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: false,
 				},
@@ -90,7 +91,7 @@ func TestConfiguratorIsUsed(t *testing.T) {
 		},
 		{
 			name: "cloud team",
-			modules: &modules.TestModules{
+			modules: modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud:               true,
 					IsUsageBasedBilling: true,
@@ -100,7 +101,7 @@ func TestConfiguratorIsUsed(t *testing.T) {
 		},
 		{
 			name: "cloud enterprise without config",
-			modules: &modules.TestModules{
+			modules: modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: true,
 					Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -112,7 +113,7 @@ func TestConfiguratorIsUsed(t *testing.T) {
 		},
 		{
 			name: "cloud enterprise with only draft",
-			modules: &modules.TestModules{
+			modules: modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: true,
 					Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -131,7 +132,7 @@ func TestConfiguratorIsUsed(t *testing.T) {
 		},
 		{
 			name: "cloud enterprise with cluster config",
-			modules: &modules.TestModules{
+			modules: modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: true,
 					Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -164,7 +165,7 @@ func TestConfiguratorIsUsed(t *testing.T) {
 				tt.resourceServiceFn(t, ecaSvc)
 			}
 
-			modules.SetTestModules(t, tt.modules)
+			modulestest.SetTestModules(t, tt.modules)
 
 			c, err := NewConfigurator(ctx, ecaSvc, integrationSvc, nil /*alertService*/)
 			require.NoError(t, err)
@@ -181,7 +182,7 @@ func TestCredentialsCache(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -338,7 +339,7 @@ func TestDraftConfigurator(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
diff --git a/lib/integrations/externalauditstorage/error_counter.go b/lib/integrations/externalauditstorage/error_counter.go
index 7525cd5631ffb..3d3e0d3576ceb 100644
--- a/lib/integrations/externalauditstorage/error_counter.go
+++ b/lib/integrations/externalauditstorage/error_counter.go
@@ -373,13 +373,55 @@ func (c *ErrorCountingSessionHandler) Upload(ctx context.Context, sessionID sess
 	return res, err
 }
 
+// UploadSummary calls [c.wrapped.UploadSummary] and counts the error or success.
+func (c *ErrorCountingSessionHandler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	res, err := c.wrapped.UploadSummary(ctx, sessionID, reader)
+	c.uploads.observe(err)
+	return res, err
+}
+
+// UploadMetadata calls [c.wrapped.UploadMetadata] and counts the error or success.
+func (c *ErrorCountingSessionHandler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	res, err := c.wrapped.UploadMetadata(ctx, sessionID, reader)
+	c.uploads.observe(err)
+	return res, err
+}
+
+// UploadThumbnail calls [c.wrapped.UploadThumbnail] and counts the error or success.
+func (c *ErrorCountingSessionHandler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	res, err := c.wrapped.UploadThumbnail(ctx, sessionID, reader)
+	c.uploads.observe(err)
+	return res, err
+}
+
 // Download calls [c.wrapped.Download] and counts the error or success.
-func (c *ErrorCountingSessionHandler) Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error {
+func (c *ErrorCountingSessionHandler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
 	err := c.wrapped.Download(ctx, sessionID, writer)
 	c.downloads.observe(err)
 	return err
 }
 
+// DownloadSummary calls [c.wrapped.DownloadSummary] and counts the error or success.
+func (c *ErrorCountingSessionHandler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	err := c.wrapped.DownloadSummary(ctx, sessionID, writer)
+	c.downloads.observe(err)
+	return err
+}
+
+// DownloadMetadata calls [c.wrapped.DownloadMetadata] and counts the error or success.
+func (c *ErrorCountingSessionHandler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	err := c.wrapped.DownloadMetadata(ctx, sessionID, writer)
+	c.downloads.observe(err)
+	return err
+}
+
+// DownloadThumbnail calls [c.wrapped.DownloadThumbnail()] and counts the error or success.
+func (c *ErrorCountingSessionHandler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	err := c.wrapped.DownloadThumbnail(ctx, sessionID, writer)
+	c.downloads.observe(err)
+	return err
+}
+
 // CreateUpload calls [c.wrapped.CreateUpload] and counts the error or success.
 func (c *ErrorCountingSessionHandler) CreateUpload(ctx context.Context, sessionID session.ID) (*events.StreamUpload, error) {
 	res, err := c.wrapped.CreateUpload(ctx, sessionID)
diff --git a/lib/integrations/externalauditstorage/error_counter_test.go b/lib/integrations/externalauditstorage/error_counter_test.go
index c22b7facf5cb8..46847a24d1393 100644
--- a/lib/integrations/externalauditstorage/error_counter_test.go
+++ b/lib/integrations/externalauditstorage/error_counter_test.go
@@ -51,7 +51,7 @@ func TestErrorCounter(t *testing.T) {
 		expectAlerts []alert
 	}{
 		{
-			desc: "upload errors alert",
+			desc: "recording upload errors alert",
 			steps: []testStep{
 				{
 					action: func(pack *testPack) {
@@ -68,7 +68,7 @@ func TestErrorCounter(t *testing.T) {
 			}},
 		},
 		{
-			desc: "download errors alert",
+			desc: "recording download errors alert",
 			steps: []testStep{
 				{
 					action: func(pack *testPack) {
@@ -84,6 +84,108 @@ func TestErrorCounter(t *testing.T) {
 				message: fmt.Sprintf(sessionDownloadFailureClusterAlertMsgTemplate, testError),
 			}},
 		},
+		{
+			desc: "summary upload errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.UploadSummary(ctx, "", nil)
+						pack.successHandler.UploadSummary(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionUploadFailureClusterAlert,
+				message: fmt.Sprintf(sessionUploadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
+		{
+			desc: "summary download errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.DownloadSummary(ctx, "", nil)
+						pack.successHandler.DownloadSummary(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionDownloadFailureClusterAlert,
+				message: fmt.Sprintf(sessionDownloadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
+		{
+			desc: "metadata upload errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.UploadMetadata(ctx, "", nil)
+						pack.successHandler.UploadMetadata(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionUploadFailureClusterAlert,
+				message: fmt.Sprintf(sessionUploadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
+		{
+			desc: "metadata download errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.DownloadMetadata(ctx, "", nil)
+						pack.successHandler.DownloadMetadata(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionDownloadFailureClusterAlert,
+				message: fmt.Sprintf(sessionDownloadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
+		{
+			desc: "thumbnail upload errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.UploadThumbnail(ctx, "", nil)
+						pack.successHandler.UploadThumbnail(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionUploadFailureClusterAlert,
+				message: fmt.Sprintf(sessionUploadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
+		{
+			desc: "thumbnail download errors alert",
+			steps: []testStep{
+				{
+					action: func(pack *testPack) {
+						pack.errHandler.DownloadThumbnail(ctx, "", nil)
+						pack.successHandler.DownloadThumbnail(ctx, "", nil)
+					},
+					repeat: 10,
+				},
+			},
+			err: testError,
+			expectAlerts: []alert{{
+				name:    sessionDownloadFailureClusterAlert,
+				message: fmt.Sprintf(sessionDownloadFailureClusterAlertMsgTemplate, testError),
+			}},
+		},
 		{
 			desc: "emit errors alert",
 			steps: []testStep{
@@ -276,6 +378,30 @@ func (h *errorHandler) Upload(ctx context.Context, sessionID session.ID, reader
 	return "", h.err
 }
 
-func (h *errorHandler) Download(ctx context.Context, sessionID session.ID, writer io.WriterAt) error {
+func (h *errorHandler) UploadSummary(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return "", h.err
+}
+
+func (h *errorHandler) UploadMetadata(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return "", h.err
+}
+
+func (h *errorHandler) UploadThumbnail(ctx context.Context, sessionID session.ID, reader io.Reader) (string, error) {
+	return "", h.err
+}
+
+func (h *errorHandler) Download(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.err
+}
+
+func (h *errorHandler) DownloadSummary(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.err
+}
+
+func (h *errorHandler) DownloadMetadata(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
+	return h.err
+}
+
+func (h *errorHandler) DownloadThumbnail(ctx context.Context, sessionID session.ID, writer events.RandomAccessWriter) error {
 	return h.err
 }
diff --git a/lib/inventory/controller.go b/lib/inventory/controller.go
index 67b3e92799401..93ffce14a7e5b 100644
--- a/lib/inventory/controller.go
+++ b/lib/inventory/controller.go
@@ -20,6 +20,7 @@ package inventory
 
 import (
 	"context"
+	"iter"
 	"log/slog"
 	"math/rand/v2"
 	"os"
@@ -29,11 +30,15 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"golang.org/x/time/rate"
+	gproto "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/inventory/internal/delay"
@@ -58,6 +63,9 @@ type Auth interface {
 	UpsertKubernetesServer(context.Context, types.KubeServer) (*types.KeepAlive, error)
 	DeleteKubernetesServer(ctx context.Context, hostID, name string) error
 
+	UpsertRelayServer(ctx context.Context, relayServer *presencev1.RelayServer) (*presencev1.RelayServer, error)
+	DeleteRelayServer(ctx context.Context, name string) error
+
 	KeepAliveServer(context.Context, types.KeepAlive) error
 	UpsertInstance(ctx context.Context, instance types.Instance) error
 }
@@ -94,6 +102,11 @@ const (
 	dbUpsertRetryOk  testEvent = "db-upsert-retry-ok"
 	dbUpsertRetryErr testEvent = "db-upsert-retry-err"
 
+	dbDelOk  testEvent = "db-del-ok"
+	dbDelErr testEvent = "db-del-err"
+
+	dbStopErr testEvent = "db-stop-err"
+
 	kubeKeepAliveOk  testEvent = "kube-keep-alive-ok"
 	kubeKeepAliveErr testEvent = "kube-keep-alive-err"
 	kubeKeepAliveDel testEvent = "kube-keep-alive-del"
@@ -253,6 +266,7 @@ type Controller struct {
 	appHBVariableDuration      *interval.VariableDuration
 	dbHBVariableDuration       *interval.VariableDuration
 	kubeHBVariableDuration     *interval.VariableDuration
+	relayHBVariableDuration    *interval.VariableDuration
 	maxKeepAliveErrs           int
 	usageReporter              usagereporter.UsageReporter
 	testEvents                 chan testEvent
@@ -284,6 +298,8 @@ func NewController(auth Auth, usageReporter usagereporter.UsageReporter, opts ..
 		appHBVariableDuration  *interval.VariableDuration
 		dbHBVariableDuration   *interval.VariableDuration
 		kubeHBVariableDuration *interval.VariableDuration
+
+		relayHBVariableDuration *interval.VariableDuration
 	)
 	serverTTL := apidefaults.ServerAnnounceTTL
 	if !variableRateHeartbeatsDisabledEnv() {
@@ -310,6 +326,11 @@ func NewController(auth Auth, usageReporter usagereporter.UsageReporter, opts ..
 			MaxDuration: options.serverKeepAlive * 4,
 			Step:        heartbeatStepSize,
 		})
+		relayHBVariableDuration = interval.NewVariableDuration(interval.VariableDurationConfig{
+			MinDuration: options.serverKeepAlive,
+			MaxDuration: options.serverKeepAlive * 4,
+			Step:        heartbeatStepSize,
+		})
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -325,6 +346,7 @@ func NewController(auth Auth, usageReporter usagereporter.UsageReporter, opts ..
 		appHBVariableDuration:      appHBVariableDuration,
 		dbHBVariableDuration:       dbHBVariableDuration,
 		kubeHBVariableDuration:     kubeHBVariableDuration,
+		relayHBVariableDuration:    relayHBVariableDuration,
 		maxKeepAliveErrs:           options.maxKeepAliveErrs,
 		auth:                       auth,
 		authID:                     options.authID,
@@ -360,6 +382,11 @@ func (c *Controller) GetControlStream(serverID string) (handle UpstreamHandle, o
 	return
 }
 
+// Handles gets the handles for the given server ID if they exist.
+func (c *Controller) Handles(serverID string) iter.Seq[UpstreamHandle] {
+	return c.store.Handles(serverID)
+}
+
 // UniqueHandles iterates across unique handles registered with this controller.
 // If multiple handles are registered for a given server, only
 // one handle is selected pseudorandomly to be observed.
@@ -424,11 +451,13 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 	// these delays are lazily initialized upon receipt of the first heartbeat
 	// since not all servers send all heartbeats
 	var sshKeepAliveDelay *delay.Delay
+	var relayKeepAliveDelay *delay.Delay
 
 	defer func() {
 		// this is a function expression because the variables are initialized
 		// later and we want to call Stop on the initialized value (if any)
 		sshKeepAliveDelay.Stop()
+		relayKeepAliveDelay.Stop()
 		handle.appKeepAliveDelay.Stop()
 		handle.dbKeepAliveDelay.Stop()
 		handle.kubeKeepAliveDelay.Stop()
@@ -458,6 +487,14 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 			handle.sshServer = nil
 		}
 
+		if handle.relayServer != nil {
+			c.onDisconnectFunc(teleport.ComponentRelay, 1)
+			if c.relayHBVariableDuration != nil {
+				c.relayHBVariableDuration.Dec()
+			}
+			handle.relayServer = nil
+		}
+
 		if len(handle.appServers) > 0 {
 			c.onDisconnectFunc(constants.KeepAliveApp, len(handle.appServers))
 			if c.appHBVariableDuration != nil {
@@ -517,6 +554,17 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 					}
 				}
 
+				if m.RelayServer != nil {
+					if relayKeepAliveDelay == nil {
+						relayKeepAliveDelay = c.createKeepAliveDelay(c.relayHBVariableDuration)
+					}
+
+					if err := c.handleRelayServerHB(handle, m.RelayServer, relayKeepAliveDelay); err != nil {
+						handle.CloseWithError(trace.Wrap(err))
+						return
+					}
+				}
+
 				if m.AppServer != nil {
 					if handle.appKeepAliveDelay == nil {
 						handle.appKeepAliveDelay = c.createKeepAliveMultiDelay(c.appHBVariableDuration)
@@ -554,6 +602,20 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 				c.handlePong(handle, m)
 			case *proto.UpstreamInventoryGoodbye:
 				handle.setGoodbye(m)
+			case *proto.UpstreamInventoryStopHeartbeat:
+				switch m.Kind {
+				case proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER:
+					if err := c.handleStopDatabaseServerHB(handle, m.Name); err != nil {
+						handle.CloseWithError(err)
+						return
+					}
+				default:
+					slog.WarnContext(c.closeContext, "Unexpected upstream stop heartbeat kind on control stream",
+						"server_id", handle.Hello().ServerID,
+						"kind", logutils.StringerAttr(m.Kind),
+					)
+				}
+
 			default:
 				slog.WarnContext(c.closeContext, "Unexpected upstream message type on control stream",
 					"message_type", logutils.TypeAttr(m),
@@ -579,6 +641,14 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 			}
 			c.testEvent(keepAliveSSHTick)
 
+		case now := <-relayKeepAliveDelay.Elapsed():
+			relayKeepAliveDelay.Advance(now)
+
+			if err := c.keepAliveRelayServer(handle, now); err != nil {
+				handle.CloseWithError(err)
+				return
+			}
+
 		case now := <-handle.appKeepAliveDelay.Elapsed():
 			key := handle.appKeepAliveDelay.Tick(now)
 
@@ -654,8 +724,19 @@ func (c *Controller) doResourceCleanup(handle *upstreamHandle) {
 		"apps", len(handle.appServers),
 		"dbs", len(handle.databaseServers),
 		"kube", len(handle.kubernetesServers),
+		"relay", handle.relayServer != nil,
 		"server_id", handle.Hello().ServerID,
 	)
+
+	if handle.relayServer != nil {
+		if err := c.auth.DeleteRelayServer(c.closeContext, handle.Hello().GetServerID()); err != nil {
+			slog.WarnContext(c.closeContext, "Failed to delete relay_server on termination",
+				"relay_server", handle.Hello().GetServerID(),
+				"error", err,
+			)
+		}
+	}
+
 	for _, app := range handle.appServers {
 		if err := c.cleanupLimiter.Wait(cleanupCtx); err != nil {
 			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
@@ -830,6 +911,17 @@ func (c *Controller) handleSSHServerHB(handle *upstreamHandle, sshServer *types.
 		return trace.AccessDenied("incorrect ssh server ID (expected %q, got %q)", handle.Hello().ServerID, sshServer.GetName())
 	}
 
+	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
+	// scope to defer to what was found in the identity during the initial hello.
+	if sshServer.Scope == "" {
+		sshServer.Scope = handle.Hello().GetScope()
+	}
+
+	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
+	if sshServer.Scope != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect ssh server scope (expected %q, got %q)", handle.Hello().GetScope(), sshServer.Scope)
+	}
+
 	// if a peer address is available in the context, use it to override zero-value addresses from
 	// the server heartbeat.
 	if handle.PeerAddr() != "" {
@@ -884,6 +976,68 @@ func (c *Controller) handleSSHServerHB(handle *upstreamHandle, sshServer *types.
 	return nil
 }
 
+func (c *Controller) handleRelayServerHB(handle *upstreamHandle, relayServer *presencev1.RelayServer, relayDelay *delay.Delay) error {
+	// the auth layer verifies that a stream's hello message matches the identity and capabilities of the
+	// client cert. after that point it is our responsibility to ensure that heartbeated information is
+	// consistent with the identity and capabilities claimed in the initial hello.
+	if !handle.HasService(types.RoleRelay) {
+		return trace.AccessDenied("control stream not configured to support relay service heartbeats")
+	}
+	if expected, actual := handle.Hello().GetServerID(), relayServer.GetMetadata().GetName(); expected != actual {
+		return trace.AccessDenied("incorrect relay server ID (expected %q, got %q)", expected, actual)
+	}
+
+	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
+	// scope to defer to what was found in the identity during the initial hello.
+	if relayServer.Scope == "" {
+		relayServer.Scope = handle.Hello().GetScope()
+	}
+
+	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
+	if relayServer.Scope != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect relay server scope (expected %q, got %q)", handle.Hello().GetScope(), relayServer.Scope)
+	}
+
+	// TODO(espadolini): check the relay_server for consistency if there's any
+	// checks that will not be performed by ValidateRelayServer (which happens
+	// on Upsert).
+
+	if handle.relayServer == nil {
+		c.onConnectFunc(teleport.ComponentRelay)
+		if c.relayHBVariableDuration != nil {
+			c.relayHBVariableDuration.Inc()
+		}
+	} else if handle.relayServerErrorCount == 0 && gproto.Equal(handle.relayServer, relayServer) {
+		// if we have successfully upserted this exact server the last time we
+		// don't need to upsert it again right now, we can let the keepalive
+		// ticker deal with it
+		return nil
+	}
+	handle.relayServer = relayServer
+
+	relayServer = gproto.CloneOf(handle.relayServer)
+	relayServer.GetMetadata().Expires = timestamppb.New(time.Now().Add(c.serverTTL))
+	if _, err := c.auth.UpsertRelayServer(c.closeContext, relayServer); err == nil {
+		// reset the error status
+		handle.relayServerErrorCount = 0
+		relayDelay.Reset()
+	} else {
+		closing := handle.relayServerErrorCount < 0 || handle.relayServerErrorCount >= c.maxKeepAliveErrs
+		slog.WarnContext(c.closeContext, "Failed to announce relay server",
+			"server_id", handle.Hello().GetServerID(),
+			"error", err,
+			"error_count", handle.relayServerErrorCount,
+			"closing", closing,
+		)
+
+		if closing {
+			return trace.Wrap(err, "failed to announce relay server")
+		}
+		handle.relayServerErrorCount = -1
+	}
+	return nil
+}
+
 func (c *Controller) handleAppServerHB(handle *upstreamHandle, appServer *types.AppServerV3) error {
 	// the auth layer verifies that a stream's hello message matches the identity and capabilities of the
 	// client cert. after that point it is our responsibility to ensure that heartbeated information is
@@ -895,6 +1049,17 @@ func (c *Controller) handleAppServerHB(handle *upstreamHandle, appServer *types.
 		return trace.AccessDenied("incorrect app server ID (expected %q, got %q)", handle.Hello().ServerID, appServer.GetHostID())
 	}
 
+	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
+	// scope to defer to what was found in the identity during the initial hello.
+	if appServer.Scope == "" {
+		appServer.Scope = handle.Hello().GetScope()
+	}
+
+	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
+	if appServer.Scope != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect app server scope (expected %q, got %q)", handle.Hello().GetScope(), appServer.Scope)
+	}
+
 	if handle.appServers == nil {
 		handle.appServers = make(map[resourceKey]*heartBeatInfo[*types.AppServerV3])
 	}
@@ -950,6 +1115,17 @@ func (c *Controller) handleDatabaseServerHB(handle *upstreamHandle, databaseServ
 		return trace.AccessDenied("incorrect database server ID (expected %q, got %q)", handle.Hello().ServerID, databaseServer.GetHostID())
 	}
 
+	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
+	// scope to defer to what was found in the identity during the initial hello.
+	if databaseServer.Scope == "" {
+		databaseServer.Scope = handle.Hello().GetScope()
+	}
+
+	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
+	if databaseServer.Scope != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect database server scope (expected %q, got %q)", handle.Hello().GetScope(), databaseServer.Scope)
+	}
+
 	if handle.databaseServers == nil {
 		handle.databaseServers = make(map[resourceKey]*heartBeatInfo[*types.DatabaseServerV3])
 	}
@@ -1005,6 +1181,17 @@ func (c *Controller) handleKubernetesServerHB(handle *upstreamHandle, kubernetes
 		return trace.AccessDenied("incorrect kubernetes server ID (expected %q, got %q)", handle.Hello().ServerID, kubernetesServer.GetHostID())
 	}
 
+	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
+	// scope to defer to what was found in the identity during the initial hello.
+	if kubernetesServer.Scope == "" {
+		kubernetesServer.Scope = handle.Hello().GetScope()
+	}
+
+	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
+	if kubernetesServer.Scope != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect kubernetes server scope (expected %q, got %q)", handle.Hello().GetScope(), kubernetesServer.Scope)
+	}
+
 	if handle.kubernetesServers == nil {
 		handle.kubernetesServers = make(map[resourceKey]*heartBeatInfo[*types.KubernetesServerV3])
 	}
@@ -1294,6 +1481,87 @@ func (c *Controller) keepAliveSSHServer(handle *upstreamHandle, now time.Time) e
 	return nil
 }
 
+func (c *Controller) keepAliveRelayServer(handle *upstreamHandle, now time.Time) error {
+	if handle.relayServer == nil {
+		return nil
+	}
+
+	relayServer := gproto.CloneOf(handle.relayServer)
+	relayServer.GetMetadata().Expires = timestamppb.New(now.Add(c.serverTTL))
+	_, err := c.auth.UpsertRelayServer(c.closeContext, relayServer)
+	if err == nil {
+		handle.relayServerErrorCount = 0
+		return nil
+	}
+	if handle.relayServerErrorCount < 0 {
+		slog.WarnContext(c.closeContext, "Failed to upsert relay server on retry",
+			"server_id", handle.Hello().GetServerID(),
+			"error", err,
+		)
+		// if we're here it means that we have failed to upsert it _again_,
+		// so we have fallen quite far behind
+		return trace.Wrap(err, "failed to upsert relay server on retry")
+	}
+
+	handle.relayServerErrorCount++
+
+	closing := handle.relayServerErrorCount > c.maxKeepAliveErrs
+	slog.WarnContext(c.closeContext, "Failed to keep alive relay server",
+		"server_id", handle.Hello().ServerID,
+		"error", err,
+		"error_count", handle.relayServerErrorCount,
+		"closing", closing,
+	)
+
+	if closing {
+		return trace.Wrap(err, "failed to keep alive relay server")
+	}
+
+	return nil
+}
+
+func (c *Controller) handleStopDatabaseServerHB(handle *upstreamHandle, name string) error {
+	// the auth layer verifies that a stream's hello message matches the identity and capabilities of the
+	// client cert. after that point it is our responsibility to ensure that heartbeated information is
+	// consistent with the identity and capabilities claimed in the initial hello.
+	if !handle.HasService(types.RoleDatabase) {
+		return trace.AccessDenied("control stream not configured to support database server heartbeats")
+	}
+	key := resourceKey{hostID: handle.Hello().ServerID, name: name}
+
+	if _, ok := handle.databaseServers[key]; !ok {
+		c.testEvent(dbStopErr)
+		slog.DebugContext(c.closeContext, "Unexpected stop database heartbeat message on control stream",
+			"database_name", key.name,
+			"server_id", handle.Hello().ServerID,
+		)
+		return nil
+	}
+
+	c.testEvent(dbKeepAliveDel)
+	c.onDisconnectFunc(constants.KeepAliveDatabase, 1)
+	if c.dbHBVariableDuration != nil {
+		c.dbHBVariableDuration.Dec()
+	}
+	delete(handle.databaseServers, key)
+	handle.dbKeepAliveDelay.Remove(key)
+
+	err := c.auth.DeleteDatabaseServer(c.closeContext, apidefaults.Namespace, key.hostID, key.name)
+	if err == nil {
+		c.testEvent(dbDelOk)
+	} else {
+		c.testEvent(dbDelErr)
+		if !trace.IsNotFound(err) {
+			slog.WarnContext(c.closeContext, "Failed to delete database server heartbeat",
+				"database_name", key.name,
+				"server_id", handle.Hello().ServerID,
+				"error", err,
+			)
+		}
+	}
+	return nil
+}
+
 func (c *Controller) createKeepAliveDelay(variableDuration *interval.VariableDuration) *delay.Delay {
 	return delay.New(delay.Params{
 		FirstInterval:    retryutils.HalfJitter(c.serverKeepAlive),
diff --git a/lib/inventory/controller_test.go b/lib/inventory/controller_test.go
index bfedae93d0c6b..377a6efed1698 100644
--- a/lib/inventory/controller_test.go
+++ b/lib/inventory/controller_test.go
@@ -24,7 +24,6 @@ import (
 	"io"
 	"math/rand/v2"
 	"os"
-	"slices"
 	"sync"
 	"testing"
 	"time"
@@ -40,14 +39,17 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/inventory/metadata"
 	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -55,9 +57,11 @@ type fakeAuth struct {
 	mu             sync.Mutex
 	failUpserts    int
 	failKeepAlives int
+	failDeletes    int
 
 	upserts    int
 	keepalives int
+	deletes    int
 	err        error
 
 	expectAddr      string
@@ -125,6 +129,14 @@ func (a *fakeAuth) UpsertDatabaseServer(_ context.Context, server types.Database
 }
 
 func (a *fakeAuth) DeleteDatabaseServer(ctx context.Context, namespace, hostID, name string) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.deletes++
+
+	if a.failDeletes > 0 {
+		a.failDeletes--
+		return trace.Errorf("delete failed as test condition")
+	}
 	return nil
 }
 
@@ -157,6 +169,16 @@ func (a *fakeAuth) KeepAliveServer(_ context.Context, ka types.KeepAlive) error
 	return a.err
 }
 
+// UpsertRelayServer implements [Auth].
+func (a *fakeAuth) UpsertRelayServer(ctx context.Context, relayServer *presencev1.RelayServer) (*presencev1.RelayServer, error) {
+	panic("unimplemented")
+}
+
+// DeleteRelayServer implements [Auth].
+func (a *fakeAuth) DeleteRelayServer(ctx context.Context, name string) error {
+	panic("unimplemented")
+}
+
 func (a *fakeAuth) UpsertInstance(ctx context.Context, instance types.Instance) error {
 	a.mu.Lock()
 	defer a.mu.Unlock()
@@ -179,15 +201,135 @@ func (a *fakeAuth) UpsertInstance(ctx context.Context, instance types.Instance)
 // TestSSHServerBasics verifies basic expected behaviors for a single control stream heartbeating
 // an ssh service.
 func TestSSHServerBasics(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testSSHServerBasics)
+	synctest.Test(t, testSSHServerScope)
+}
+
+func testSSHServerScope(t *testing.T) {
 	const serverID = "test-server"
 	const zeroAddr = "0.0.0.0:123"
 	const peerAddr = "1.2.3.4:456"
 	const wantAddr = "1.2.3.4:123"
 
-	t.Parallel()
+	ctx := t.Context()
 
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	events := make(chan testEvent, 1024)
+
+	auth := &fakeAuth{
+		expectAddr: wantAddr,
+	}
+
+	rc := &resourceCounter{}
+	controller := NewController(
+		auth,
+		usagereporter.DiscardUsageReporter{},
+		withServerKeepAlive(time.Millisecond*200),
+		withTestEventsChannel(events),
+		WithOnConnect(rc.onConnect),
+		WithOnDisconnect(rc.onDisconnect),
+	)
+	defer controller.Close()
+
+	// set up fake in-memory control stream
+	upstream, downstream := client.InventoryControlStreamPipe(client.ICSPipePeerAddr(peerAddr))
+	t.Cleanup(func() {
+		controller.Close()
+		downstream.Close()
+		upstream.Close()
+	})
+
+	// launch goroutine to respond to ping requests
+	go func() {
+		for {
+			select {
+			case msg := <-downstream.Recv():
+				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
+				})
+			case <-downstream.Done():
+				return
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+
+	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+		ServerID: serverID,
+		Version:  teleport.Version,
+		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
+		Scope:    "/aa/bb",
+	})
+
+	// verify that control stream handle is now accessible
+	handle, ok := controller.GetControlStream(serverID)
+	require.True(t, ok)
+
+	// verify that hb counter has been incremented
+	require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
+
+	// send a fake ssh server heartbeat with a scope matching registration
+	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		SSHServer: &types.ServerV2{
+			Metadata: types.Metadata{
+				Name: serverID,
+			},
+			Spec: types.ServerSpecV2{
+				Addr: zeroAddr,
+			},
+			Scope: "/aa/bb",
+		},
+	})
+	require.NoError(t, err)
+
+	// verify that heartbeat creates both an upsert and a keepalive
+	awaitEvents(t, events,
+		expect(sshUpsertOk, sshKeepAliveOk),
+		deny(sshUpsertErr, sshKeepAliveErr, handlerClose),
+	)
+
+	// send an ssh server heartbeat with a scope different from registration
+	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+		SSHServer: &types.ServerV2{
+			Metadata: types.Metadata{
+				Name: serverID,
+			},
+			Spec: types.ServerSpecV2{
+				Addr: zeroAddr,
+			},
+			Scope: "/aa/bb/cc",
+		},
+	})
+	require.NoError(t, err)
+
+	// verify that the handler closes
+	awaitEvents(t, events,
+		expect(handlerClose),
+		deny(sshUpsertOk, sshKeepAliveOk),
+	)
+
+	// verify that closure propagates to server and client side interfaces
+	closeTimeout := time.After(time.Second * 10)
+	select {
+	case <-handle.Done():
+	case <-closeTimeout:
+		t.Fatal("timeout waiting for handle closure")
+	}
+	select {
+	case <-downstream.Done():
+	case <-closeTimeout:
+		t.Fatal("timeout waiting for handle closure")
+	}
+}
+
+func testSSHServerBasics(t *testing.T) {
+	const serverID = "test-server"
+	const zeroAddr = "0.0.0.0:123"
+	const peerAddr = "1.2.3.4:456"
+	const wantAddr = "1.2.3.4:123"
+
+	ctx := t.Context()
 
 	events := make(chan testEvent, 1024)
 
@@ -301,6 +443,10 @@ func TestSSHServerBasics(t *testing.T) {
 	oldExpiry, expiry := expiry, auth.getLastServerExpiry()
 	require.Greater(t, expiry, oldExpiry)
 
+	auth.mu.Lock()
+	auth.failUpserts = 1
+	auth.mu.Unlock()
+
 	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
@@ -316,10 +462,6 @@ func TestSSHServerBasics(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	auth.mu.Lock()
-	auth.failUpserts = 1
-	auth.mu.Unlock()
-
 	// we should now see an upsert failure, but no additional
 	// keepalive failures, and the upsert should succeed on retry.
 	awaitEvents(t, events,
@@ -394,13 +536,14 @@ func TestSSHServerBasics(t *testing.T) {
 // TestAppServerBasics verifies basic expected behaviors for a single control stream heartbeating
 // an app service.
 func TestAppServerBasics(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testAppServerBasics)
+}
+func testAppServerBasics(t *testing.T) {
 	const serverID = "test-server"
 	const appCount = 3
 
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	events := make(chan testEvent, 1024)
 
@@ -627,13 +770,14 @@ func TestAppServerBasics(t *testing.T) {
 // TestDatabaseServerBasics verifies basic expected behaviors for a single control stream heartbeating
 // a database server.
 func TestDatabaseServerBasics(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testDatabaseServerBasics)
+}
+func testDatabaseServerBasics(t *testing.T) {
 	const serverID = "test-server"
 	const dbCount = 3
 
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	events := make(chan testEvent, 1024)
 
@@ -688,7 +832,7 @@ func TestDatabaseServerBasics(t *testing.T) {
 	require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
 
 	// send a fake db server heartbeat
-	for i := 0; i < dbCount; i++ {
+	for i := range dbCount {
 		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
 			DatabaseServer: &types.DatabaseServerV3{
 				Metadata: types.Metadata{
@@ -717,6 +861,39 @@ func TestDatabaseServerBasics(t *testing.T) {
 		deny(dbUpsertErr, dbKeepAliveErr, handlerClose),
 	)
 
+	// set up to induce delete failure
+	auth.mu.Lock()
+	auth.failDeletes = 1
+	auth.mu.Unlock()
+
+	// stop a heartbeat
+	err := downstream.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+		Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
+		Name: "db-1",
+	})
+	require.NoError(t, err)
+
+	// verify that keep alive stops, even if the heartbeat couldn't be deleted
+	awaitEvents(t, events,
+		expect(dbKeepAliveDel, dbDelErr),
+		deny(dbDelOk, dbUpsertErr, dbKeepAliveErr, handlerClose),
+	)
+	require.Equal(t, dbCount-1, rc.count())
+
+	// verify heartbeat stop keepalive idempotency
+	err = downstream.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+		Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
+		Name: "db-1",
+	})
+	require.NoError(t, err)
+	require.Equal(t, dbCount-1, rc.count())
+
+	awaitEvents(t, events,
+		expect(dbStopErr),
+		deny(dbKeepAliveDel, dbDelOk, dbDelErr, dbUpsertErr, dbKeepAliveErr, handlerClose),
+	)
+	require.Equal(t, dbCount-1, rc.count())
+
 	// set up to induce some failures, but not enough to cause the control
 	// stream to be closed.
 	auth.mu.Lock()
@@ -778,7 +955,7 @@ func TestDatabaseServerBasics(t *testing.T) {
 	defer cancel()
 
 	// execute ping
-	_, err := handle.Ping(pingCtx, 1)
+	_, err = handle.Ping(pingCtx, 1)
 	require.NoError(t, err)
 
 	// ensure that local db keepalive states have reset to healthy by waiting
@@ -860,6 +1037,10 @@ func TestDatabaseServerBasics(t *testing.T) {
 
 // TestInstanceHeartbeat verifies basic expected behaviors for instance heartbeat.
 func TestInstanceHeartbeat_Disabled(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testInstanceHeartbeat_Disabled)
+}
+func testInstanceHeartbeat_Disabled(t *testing.T) {
 	const serverID = "test-instance"
 	const peerAddr = "1.2.3.4:456"
 
@@ -908,6 +1089,10 @@ func TestInstanceHeartbeatDisabledEnv(t *testing.T) {
 
 // TestInstanceHeartbeat verifies basic expected behaviors for instance heartbeat.
 func TestInstanceHeartbeat(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testInstanceHeartbeat)
+}
+func testInstanceHeartbeat(t *testing.T) {
 	const serverID = "test-instance"
 	const peerAddr = "1.2.3.4:456"
 
@@ -1025,6 +1210,9 @@ func TestInstanceHeartbeat(t *testing.T) {
 // inventory control stream.
 func TestUpdateLabels(t *testing.T) {
 	t.Parallel()
+	synctest.Test(t, testUpdateLabels)
+}
+func testUpdateLabels(t *testing.T) {
 	const serverID = "test-instance"
 	const peerAddr = "1.2.3.4:456"
 
@@ -1052,11 +1240,19 @@ func TestUpdateLabels(t *testing.T) {
 		ServerID: "auth",
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
-	downstreamHandle, err := NewDownstreamHandle(func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
-		return downstream, nil
-	}, func(_ context.Context) (*proto.UpstreamInventoryHello, error) { return upstreamHello, nil })
+	downstreamHandle, err := NewDownstreamHandle(
+		func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
+			return downstream, nil
+		},
+		func(_ context.Context) (*proto.UpstreamInventoryHello, error) {
+			return upstreamHello, nil
+		},
+		withMetadataGetter(func(ctx context.Context) (*metadata.Metadata, error) {
+			return nil, context.Canceled
+		}),
+	)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, downstreamHandle.Close()) })
 
@@ -1078,17 +1274,18 @@ func TestUpdateLabels(t *testing.T) {
 	labels := map[string]string{"a": "1", "b": "2"}
 	require.NoError(t, upstreamHandle.UpdateLabels(ctx, proto.LabelUpdateKind_SSHServerCloudLabels, labels))
 
-	require.Eventually(t, func() bool {
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		require.Equal(t, labels, downstreamHandle.GetUpstreamLabels(proto.LabelUpdateKind_SSHServerCloudLabels))
-		return true
-	}, time.Second, 100*time.Millisecond)
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 // TestAgentMetadata verifies that an instance's agent metadata is received in
 // inventory control stream.
 func TestAgentMetadata(t *testing.T) {
 	t.Parallel()
-
+	synctest.Test(t, testAgentMetadata)
+}
+func testAgentMetadata(t *testing.T) {
 	const serverID = "test-instance"
 	const peerAddr = "1.2.3.4:456"
 
@@ -1116,13 +1313,15 @@ func TestAgentMetadata(t *testing.T) {
 		ServerID: "auth",
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
 	inventoryHandle, err := NewDownstreamHandle(
 		func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
 			return downstream, nil
 		},
-		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) { return upstreamHello, nil },
+		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
+			return upstreamHello, nil
+		},
 		withMetadataGetter(func(ctx context.Context) (*metadata.Metadata, error) {
 			return &metadata.Metadata{
 				OS:                    "llamaOS",
@@ -1154,15 +1353,15 @@ func TestAgentMetadata(t *testing.T) {
 	require.True(t, ok)
 
 	// Validate that the agent's metadata ends up in the auth server.
-	require.Eventually(t, func() bool {
-		return slices.Equal([]string{"llama", "alpaca"}, upstreamHandle.AgentMetadata().InstallMethods) &&
-			upstreamHandle.AgentMetadata().OS == "llamaOS"
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		md := upstreamHandle.AgentMetadata()
+		require.NotNil(t, md)
+		require.ElementsMatch(t, []string{"llama", "alpaca"}, md.InstallMethods)
+		require.Equal(t, "llamaOS", md.OS)
 	}, 10*time.Second, 200*time.Millisecond)
 }
 
 func TestGoodbye(t *testing.T) {
-	t.Parallel()
-
 	tests := []struct {
 		name            string
 		supportsGoodbye bool
@@ -1191,8 +1390,7 @@ func TestGoodbye(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
+		inner := func(t *testing.T) {
 			// Test Setup: crafting a controller and an upstream/downstream stream pipe
 			controller := NewController(
 				&fakeAuth{},
@@ -1218,16 +1416,22 @@ func TestGoodbye(t *testing.T) {
 			handle, err := NewDownstreamHandle(
 				func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
 					return currentDownstream, nil
-				}, func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
+				},
+				func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
 					return upstreamHello, nil
-				}, WithDownstreamClock(clock))
+				},
+				WithDownstreamClock(clock),
+				withMetadataGetter(func(ctx context.Context) (*metadata.Metadata, error) {
+					return nil, context.Canceled
+				}),
+			)
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, handle.Close())
 			})
 
 			// Test setup: wait for the downstream handler to finish its startup and respond to its hello
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 			defer cancel()
 			select {
 			case msg := <-upstream.Recv():
@@ -1244,7 +1448,7 @@ func TestGoodbye(t *testing.T) {
 			// Then send a Pong message to indicate the test is done.
 			nonce := rand.Int()
 			go func() {
-				ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)
+				ctx, cancel = context.WithTimeout(t.Context(), 10*time.Second)
 				defer cancel()
 				handle.SetAndSendGoodbye(ctx, test.deleteResources, test.softReload)
 
@@ -1311,7 +1515,7 @@ func TestGoodbye(t *testing.T) {
 			// Simulating a failure on the old control stream, asking for a reconnection
 			require.NoError(t, downstream.CloseWithError(io.EOF))
 
-			ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)
+			ctx, cancel = context.WithTimeout(t.Context(), 10*time.Second)
 			defer cancel()
 			// Wait to hit the handle linear retry, then jump into the future
 			require.NoError(t, clock.BlockUntilContext(ctx, 1))
@@ -1353,18 +1557,23 @@ func TestGoodbye(t *testing.T) {
 				}
 			}
 
+		}
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			synctest.Test(t, inner)
 		})
 	}
 }
 
 func TestKubernetesServerBasics(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testKubernetesServerBasics)
+}
+func testKubernetesServerBasics(t *testing.T) {
 	const serverID = "test-server"
 	const kubeCount = 3
 
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	events := make(chan testEvent, 1024)
 
@@ -1588,6 +1797,10 @@ func TestKubernetesServerBasics(t *testing.T) {
 }
 
 func TestGetSender(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testGetSender)
+}
+func testGetSender(t *testing.T) {
 	controller := NewController(
 		&fakeAuth{},
 		usagereporter.DiscardUsageReporter{},
@@ -1614,9 +1827,17 @@ func TestGetSender(t *testing.T) {
 		Services: types.SystemRoles{types.RoleNode, types.RoleApp}.StringSlice(),
 	}
 
-	handle, err := NewDownstreamHandle(func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
-		return downstream, nil
-	}, func(ctx context.Context) (*proto.UpstreamInventoryHello, error) { return upstreamHello, nil })
+	handle, err := NewDownstreamHandle(
+		func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
+			return downstream, nil
+		},
+		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
+			return upstreamHello, nil
+		},
+		withMetadataGetter(func(ctx context.Context) (*metadata.Metadata, error) {
+			return nil, context.Canceled
+		}),
+	)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, handle.Close()) })
 
@@ -1635,7 +1856,7 @@ func TestGetSender(t *testing.T) {
 	}
 	// Send the downstream hello so that the
 	// sender becomes available.
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 	defer cancel()
 	require.NoError(t, upstream.Send(ctx, downstreamHello))
 
@@ -1649,11 +1870,15 @@ func TestGetSender(t *testing.T) {
 
 // TestTimeReconciliation verifies basic behavior of the time reconciliation check.
 func TestTimeReconciliation(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testTimeReconciliation)
+}
+func testTimeReconciliation(t *testing.T) {
 	const serverID = "test-server"
 	const peerAddr = "1.2.3.4:456"
 	const wantAddr = "1.2.3.4:123"
 
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx := t.Context()
 	events := make(chan testEvent, 1024)
 	auth := &fakeAuth{
 		expectAddr: wantAddr,
@@ -1675,7 +1900,6 @@ func TestTimeReconciliation(t *testing.T) {
 		require.NoError(t, downstream.Close())
 		require.NoError(t, upstream.Close())
 		require.NoError(t, controller.Close())
-		cancel()
 	})
 
 	// Launch goroutine to respond to clock request.
@@ -1741,6 +1965,7 @@ func deny(events ...testEvent) eventOption {
 }
 
 func awaitEvents(t *testing.T, ch <-chan testEvent, opts ...eventOption) {
+	t.Helper()
 	options := eventOpts{
 		expect: make(map[testEvent]int),
 		deny:   make(map[testEvent]struct{}),
diff --git a/lib/inventory/internal/delay/delay_test.go b/lib/inventory/internal/delay/delay_test.go
index 2f93d7902e5ee..673a00e75704a 100644
--- a/lib/inventory/internal/delay/delay_test.go
+++ b/lib/inventory/internal/delay/delay_test.go
@@ -24,12 +24,12 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/interval"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/inventory/inventory.go b/lib/inventory/inventory.go
index 4d39aa48a7122..a6a6853803543 100644
--- a/lib/inventory/inventory.go
+++ b/lib/inventory/inventory.go
@@ -33,6 +33,7 @@ import (
 
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/inventory/internal/delay"
 	"github.com/gravitational/teleport/lib/inventory/metadata"
@@ -523,7 +524,7 @@ type UpstreamHandle interface {
 // when using this struct to inject control log entries, said entries won't be included until the next
 // normal instance heartbeat (though this may be triggered early via UpstreamHandle.HeartbeatInstance()).
 // The primary intended usage pattern is for periodic operations to append entries to the QualifiedPendingControlLog,
-// and then observe wether or not said entries end up being included on subsequent iterations. This
+// and then observe whether or not said entries end up being included on subsequent iterations. This
 // patterns lets us achieve a kind of lazy "locking", whereby complex coordination can occur without
 // large spikes in backend load. See the QualifiedPendingControlLog field for an example of this pattern.
 type instanceStateTracker struct {
@@ -709,6 +710,14 @@ type upstreamHandle struct {
 	// kubernetesServers track kubernetesServers server details.
 	kubernetesServers map[resourceKey]*heartBeatInfo[*types.KubernetesServerV3]
 
+	// relayServer, if set, is the current relay heartbeat.
+	relayServer *presencev1.RelayServer
+
+	// relayServerErrorCount counts how many times in a row we have failed to
+	// keepalive the relay server heartbeat, or, if negative, signals that we
+	// have failed to upsert a new resource.
+	relayServerErrorCount int
+
 	// appKeepAliveDelay is a multi-delay that controls the cadence of app server keepalive
 	// operations. Note that this is not created automatically by newUpstreamHandle.
 	appKeepAliveDelay *delay.Multi[resourceKey]
diff --git a/lib/inventory/metadata/metadata.go b/lib/inventory/metadata/metadata.go
index c31fd4fa2a8a3..da090e66580cb 100644
--- a/lib/inventory/metadata/metadata.go
+++ b/lib/inventory/metadata/metadata.go
@@ -37,6 +37,7 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/aws"
 )
 
 // Metadata contains the instance "system" metadata.
@@ -123,7 +124,7 @@ func (c *fetchConfig) setDefaults() {
 		c.fetchCloudMetadata = func(ctx context.Context, cloudEnvironment string) *types.CloudMetadata {
 			switch cloudEnvironment {
 			case "aws":
-				iid, err := utils.GetEC2InstanceIdentityDocument(ctx)
+				iid, err := aws.GetEC2InstanceIdentityDocument(ctx)
 				if err != nil {
 					return nil
 				}
diff --git a/lib/inventory/store.go b/lib/inventory/store.go
index 56dadb28d78be..a7d140bd117a6 100644
--- a/lib/inventory/store.go
+++ b/lib/inventory/store.go
@@ -20,6 +20,7 @@ package inventory
 
 import (
 	"hash/maphash"
+	"iter"
 	"sync"
 	"sync/atomic"
 )
@@ -63,6 +64,12 @@ func (s *Store) Get(serverID string) (handle UpstreamHandle, ok bool) {
 	return s.getShard(serverID).get(serverID)
 }
 
+// Handles attempts to load all known handlers for the given server ID.
+// If you only need one handler, use Get instead.
+func (s *Store) Handles(serverID string) iter.Seq[UpstreamHandle] {
+	return s.getShard(serverID).handles(serverID)
+}
+
 // Insert adds a new handle to the store.
 func (s *Store) Insert(handle UpstreamHandle) {
 	s.getShard(handle.Hello().ServerID).insert(handle)
@@ -144,6 +151,26 @@ func (s *shard) get(serverID string) (handle UpstreamHandle, ok bool) {
 	return handle, true
 }
 
+// handles gets all handles registered for a given hostID.
+// To get a random handle, use get() instead.
+func (s *shard) handles(serverID string) iter.Seq[UpstreamHandle] {
+	return func(yield func(UpstreamHandle) bool) {
+		s.rw.RLock()
+		defer s.rw.RUnlock()
+
+		entry, ok := s.m[serverID]
+		if !ok {
+			return
+		}
+
+		for _, handle := range entry.handles {
+			if !yield(handle) {
+				return
+			}
+		}
+	}
+}
+
 func (s *shard) iter(fn func(UpstreamHandle)) {
 	s.rw.RLock()
 	defer s.rw.RUnlock()
diff --git a/lib/inventory/store_test.go b/lib/inventory/store_test.go
index d8b39d3a1da13..e01e98b123cf6 100644
--- a/lib/inventory/store_test.go
+++ b/lib/inventory/store_test.go
@@ -99,6 +99,12 @@ func BenchmarkStore(b *testing.B) {
 // 1. Handles are loadable by ID.
 // 2. When multiple handles have the same ID, loads are distributed across them.
 func TestStoreAccess(t *testing.T) {
+	if testing.Short() {
+		t.Skip("TestStoreAccess is heavy")
+	}
+
+	t.Parallel()
+
 	store := NewStore()
 
 	// we keep a record of all handles inserted into the store
@@ -152,6 +158,12 @@ func TestStoreAccess(t *testing.T) {
 // every handle in the store, even when multiple handles are registered with
 // the same server ID.
 func TestAllHandles(t *testing.T) {
+	if testing.Short() {
+		t.Skip("TestAllHandles is heavy")
+	}
+
+	t.Parallel()
+
 	store := NewStore()
 
 	// we keep a record of all handles inserted into the store
diff --git a/lib/itertools/iterator.go b/lib/itertools/iterator.go
new file mode 100644
index 0000000000000..b6cba1f5d95a4
--- /dev/null
+++ b/lib/itertools/iterator.go
@@ -0,0 +1,92 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package itertools
+
+import (
+	"errors"
+)
+
+// ErrCannotReduceBatchSize is returned when an attempt is made to reduce the batch size
+// below the minimum allowed size.
+var ErrCannotReduceBatchSize = errors.New("cannot reduce batch size further")
+
+// DynamicBatchSizeIterator provides an iterator over batches of items with dynamic size adjustment.
+// It supports batch size reduction for retry scenarios via the ReduceSize() method.
+type DynamicBatchSizeIterator[T any] struct {
+	items        []T
+	currentSize  int
+	currentChunk []T
+}
+
+// DynamicBatchSize creates a new iterator that yields batches of items with dynamic size adjustment.
+//
+// Example usage:
+//
+//	chunks := itertools.DynamicBatchSize(items, 1000)
+//	for chunks.Next() {
+//	    chunk := chunks.Chunk()
+//	    if err := processBatch(chunk); err != nil {
+//	        if shouldReduceSize(err) {
+//	            if err := chunks.ReduceSize(); err != nil {
+//	                return err
+//	            }
+//	        }
+//	    }
+//	}
+func DynamicBatchSize[T any](items []T, defaultChunkSize int) *DynamicBatchSizeIterator[T] {
+	if defaultChunkSize <= 0 {
+		defaultChunkSize = 1
+	}
+	return &DynamicBatchSizeIterator[T]{
+		items:       items,
+		currentSize: defaultChunkSize,
+	}
+}
+
+// Next advances the iterator to the next batch. Returns true if there is a batch available,
+// false if the iterator is exhausted. If ReduceSize() was called on the previous iteration,
+// Next() will retry the current batch with the reduced size.
+func (it *DynamicBatchSizeIterator[T]) Next() bool {
+	// If currentChunk is not nil, advance past it
+	if it.currentChunk != nil {
+		it.items = it.items[len(it.currentChunk):]
+	}
+
+	if len(it.items) == 0 {
+		return false
+	}
+
+	end := min(it.currentSize, len(it.items))
+	it.currentChunk = it.items[:end]
+	return true
+}
+
+// Chunk returns the current batch of items. Should only be called after Next() returns true.
+func (it *DynamicBatchSizeIterator[T]) Chunk() []T {
+	return it.currentChunk
+}
+
+// ReduceSize reduces the batch size by half and signals that the current batch should be retried.
+// Returns ErrCannotReduceBatchSize if the batch size cannot be reduced further.
+func (it *DynamicBatchSizeIterator[T]) ReduceSize() error {
+	if len(it.currentChunk) <= 1 {
+		return ErrCannotReduceBatchSize
+	}
+	it.currentSize = (it.currentSize + 1) / 2
+	it.currentChunk = nil
+	return nil
+}
diff --git a/lib/itertools/iterator_test.go b/lib/itertools/iterator_test.go
new file mode 100644
index 0000000000000..004fe26548ae3
--- /dev/null
+++ b/lib/itertools/iterator_test.go
@@ -0,0 +1,156 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package itertools_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/itertools"
+)
+
+func TestDynamicBatchSize(t *testing.T) {
+	t.Parallel()
+
+	t.Run("basic", func(t *testing.T) {
+		items := []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
+
+		var got [][]int
+		chunks := itertools.DynamicBatchSize(items, 3)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+		}
+		require.Equal(t, [][]int{
+			{1, 2, 3},
+			{4, 5, 6},
+			{7, 8, 9},
+			{10},
+		}, got)
+	})
+
+	t.Run("reduce every second iteration", func(t *testing.T) {
+		items := sequence(62)
+		var got [][]int
+		i := 0
+		chunks := itertools.DynamicBatchSize(items, 30)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			i++
+			if i%2 == 0 && len(chunk) > 1 {
+				require.NoError(t, chunks.ReduceSize())
+				continue
+			}
+			got = append(got, chunk)
+		}
+		require.Equal(t, [][]int{
+			{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30},
+			{31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45},
+			{46, 47, 48, 49, 50, 51, 52, 53},
+			{54, 55, 56, 57},
+			{58, 59},
+			{60},
+			{61},
+			{62},
+		}, got)
+	})
+
+	t.Run("empty slice", func(t *testing.T) {
+		chunks := itertools.DynamicBatchSize([]int{}, 10)
+		for chunks.Next() {
+			require.Fail(t, "should not be called")
+		}
+	})
+
+	t.Run("single item", func(t *testing.T) {
+		items := []int{42}
+		var got [][]int
+		chunks := itertools.DynamicBatchSize(items, 10)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+		}
+		require.Equal(t, [][]int{{42}}, got)
+	})
+
+	t.Run("batch size of 1", func(t *testing.T) {
+		items := sequence(3)
+		var got [][]int
+
+		chunks := itertools.DynamicBatchSize(items, 1)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+		}
+		require.Equal(t, [][]int{{1}, {2}, {3}}, got)
+	})
+
+	t.Run("batch size larger than items", func(t *testing.T) {
+		items := sequence(5)
+		var got [][]int
+		chunks := itertools.DynamicBatchSize(items, 100)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+		}
+		require.Equal(t, [][]int{{1, 2, 3, 4, 5}}, got)
+	})
+
+	t.Run("cannot reduce batch size of 1", func(t *testing.T) {
+		items := []int{1}
+		chunks := itertools.DynamicBatchSize(items, 10)
+		for chunks.Next() {
+			err := chunks.ReduceSize()
+			require.ErrorIs(t, err, itertools.ErrCannotReduceBatchSize)
+		}
+	})
+
+	t.Run("break after first batch", func(t *testing.T) {
+		items := sequence(100)
+		var got [][]int
+		chunks := itertools.DynamicBatchSize(items, 10)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+			break
+		}
+		require.Equal(t, [][]int{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}}, got)
+	})
+
+	t.Run("invalid size", func(t *testing.T) {
+		items := sequence(10)
+		var got [][]int
+		chunks := itertools.DynamicBatchSize(items, 0)
+		for chunks.Next() {
+			chunk := chunks.Chunk()
+			got = append(got, chunk)
+		}
+		// When chunk size is invalid (0 or negative), it defaults to 1
+		require.Equal(t, [][]int{
+			{1}, {2}, {3}, {4}, {5}, {6}, {7}, {8}, {9}, {10},
+		}, got)
+	})
+}
+
+func sequence(n int) []int {
+	items := make([]int, n)
+	for i := range items {
+		items[i] = i + 1
+	}
+	return items
+}
diff --git a/lib/itertools/stream/stream.go b/lib/itertools/stream/stream.go
index 86d5fb2b6e838..17d6ff8105bf4 100644
--- a/lib/itertools/stream/stream.go
+++ b/lib/itertools/stream/stream.go
@@ -404,3 +404,100 @@ func MergeStreams[T any](
 		}
 	}
 }
+
+// MergeStreamsWithPriority merges two sorted streams prioritizing streamA when compare indicates items are equal.
+func MergeStreamsWithPriority[T any](
+	streamA Stream[T],
+	streamB Stream[T],
+	compare func(a, b T) int,
+) Stream[T] {
+	return func(yield func(T, error) bool) {
+		var itemA, itemB T
+
+		nextA, stopA := iter.Pull2(streamA)
+		defer stopA()
+		nextB, stopB := iter.Pull2(streamB)
+		defer stopB()
+
+		itemA, errA, okA := nextA()
+		itemB, errB, okB := nextB()
+
+		// Both streams have items, merge with priority for A
+		for okA && okB {
+			if errA != nil {
+				yield(*new(T), errA)
+				return
+			}
+			if errB != nil {
+				yield(*new(T), errB)
+				return
+			}
+
+			switch cmp := compare(itemA, itemB); {
+			case cmp < 0:
+				if !yield(itemA, nil) {
+					return
+				}
+				itemA, errA, okA = nextA()
+
+			case cmp > 0:
+				if !yield(itemB, nil) {
+					return
+				}
+				itemB, errB, okB = nextB()
+
+			default: // cmp == 0
+				// Yield A and skip B.
+				if !yield(itemA, nil) {
+					return
+				}
+				itemA, errA, okA = nextA()
+				itemB, errB, okB = nextB()
+			}
+		}
+
+		// Drain
+		for okA {
+			if errA != nil {
+				yield(*new(T), errA)
+				return
+			}
+			if !yield(itemA, nil) {
+				return
+			}
+			itemA, errA, okA = nextA()
+		}
+
+		for okB {
+			if errB != nil {
+				yield(*new(T), errB)
+				return
+			}
+			if !yield(itemB, nil) {
+				return
+			}
+			itemB, errB, okB = nextB()
+		}
+	}
+}
+
+// TakeWhile iterates the stream taking items while predicate returns true
+func TakeWhile[T any](stream Stream[T], predicate func(T) bool) Stream[T] {
+	return func(yield func(T, error) bool) {
+		for item, err := range stream {
+			if err != nil {
+				yield(*new(T), trace.Wrap(err))
+				return
+			}
+
+			if !predicate(item) {
+				return
+			}
+
+			if !yield(item, nil) {
+				return
+			}
+
+		}
+	}
+}
diff --git a/lib/itertools/stream/stream_test.go b/lib/itertools/stream/stream_test.go
index 44b39c1284f2f..90bf0d1a5b7db 100644
--- a/lib/itertools/stream/stream_test.go
+++ b/lib/itertools/stream/stream_test.go
@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"strings"
 	"testing"
 	"time"
 
@@ -884,3 +885,311 @@ func TestMergeStreams(t *testing.T) {
 		require.Equal(t, []int{1, 2, 3, 4, 5, 6}, out)
 	})
 }
+
+func TestMergeStreamsWithPriority(t *testing.T) {
+	t.Parallel()
+
+	type Item struct {
+		name   string
+		stream string
+	}
+
+	newItem := func(stream string, name string) Item {
+		return Item{name: name, stream: stream}
+	}
+
+	newItemSlice := func(stream string, names ...string) []Item {
+		out := make([]Item, 0, len(names))
+		for _, name := range names {
+			out = append(out, newItem(stream, name))
+		}
+		return out
+	}
+
+	compareFunc := func(a, b Item) int {
+		return strings.Compare(a.name, b.name)
+	}
+
+	// Test the case where the streams should have interlaced values.
+	t.Run("interlaced streams", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamB", "b"),
+			newItem("streamA", "c"),
+			newItem("streamB", "d"),
+			newItem("streamA", "e"),
+			newItem("streamB", "f"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Slice(newItemSlice("streamB", "b", "d", "f"))
+
+		got, err := Collect(MergeStreamsWithPriority(streamA, streamB, compareFunc))
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	// Test the case where streamA is empty.
+	t.Run("stream A empty", func(t *testing.T) {
+		want := []Item{
+			newItem("streamB", "b"),
+			newItem("streamB", "d"),
+			newItem("streamB", "f"),
+		}
+		streamA := Empty[Item]()
+		streamB := Slice(newItemSlice("streamB", "b", "d", "f"))
+
+		got, err := Collect(MergeStreamsWithPriority(streamA, streamB, compareFunc))
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+
+	})
+
+	// Test the case where streamB is empty.
+	t.Run("stream B empty", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamA", "c"),
+			newItem("streamA", "e"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Empty[Item]()
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	// Test the case where both streams are empty.
+	t.Run("both streams empty", func(t *testing.T) {
+		streamA := Empty[Item]()
+		streamB := Empty[Item]()
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Empty(t, got)
+	})
+
+	// Test the case where every value in streamA is lower than every value in streamB.
+	t.Run("compare always favors A", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamB", "b"),
+			newItem("streamA", "c"),
+			newItem("streamB", "d"),
+			newItem("streamA", "e"),
+			newItem("streamB", "f"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Slice(newItemSlice("streamB", "b", "d", "f"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	// Test the case where every value in streamB is lower than every value in streamA.
+	t.Run("compare always favors B", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamB", "b"),
+			newItem("streamA", "c"),
+			newItem("streamB", "d"),
+			newItem("streamA", "e"),
+			newItem("streamB", "f"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Slice(newItemSlice("streamB", "b", "d", "f"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("compare always favors A with clashing item yielding A", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamB", "b"),
+			newItem("streamA", "c"),
+			newItem("streamA", "e"),
+			newItem("streamB", "f"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Slice(newItemSlice("streamB", "b", "c", "f"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("compare always favors B with clashing item yielding A", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamB", "b"),
+			newItem("streamA", "c"),
+			newItem("streamA", "e"),
+			newItem("streamB", "f"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "c", "e"))
+		streamB := Slice(newItemSlice("streamB", "b", "c", "f"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("compare clashing keys always favors A", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamA", "b"),
+			newItem("streamA", "c"),
+		}
+		streamA := Slice(newItemSlice("streamA", "a", "b", "c"))
+		streamB := Slice(newItemSlice("streamB", "a", "b", "c"))
+
+		got, err := Collect(MergeStreamsWithPriority(streamA, streamB, compareFunc))
+		require.NoError(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("mid stream fail in A", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+		}
+
+		streamA := Chain(
+			Slice(newItemSlice("streamA", "a")),
+			Fail[Item](fmt.Errorf("some error")),
+			Slice(newItemSlice("streamA", "c", "e")),
+		)
+		streamB := Slice(newItemSlice("streamB", "b", "d", "f"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.Error(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("mid stream B with Fail and key clash", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamA", "b"),
+		}
+
+		streamA := Slice(newItemSlice("streamA", "a", "b", "c"))
+		streamB := Chain(
+			Slice(newItemSlice("streamB", "b")),
+			Fail[Item](fmt.Errorf("some error")),
+			Slice(newItemSlice("streamB", "d", "f")),
+		)
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.Error(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("tail stream B fails", func(t *testing.T) {
+		want := []Item{
+			newItem("streamA", "a"),
+			newItem("streamA", "b"),
+			newItem("streamA", "c"),
+			newItem("streamB", "d"),
+		}
+
+		streamA := Slice(newItemSlice("streamA", "a", "b", "c"))
+		streamB := Chain(
+			Slice(newItemSlice("streamB", "d")),
+			Fail[Item](fmt.Errorf("some error")),
+		)
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.Error(t, err)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("tail stream A fails", func(t *testing.T) {
+		want := []Item{
+			newItem("streamB", "a"),
+			newItem("streamB", "b"),
+			newItem("streamB", "c"),
+			newItem("streamA", "d"),
+		}
+
+		streamA := Chain(
+			Slice(newItemSlice("streamA", "d")),
+			Fail[Item](fmt.Errorf("some error")),
+		)
+		streamB := Slice(newItemSlice("streamB", "a", "b", "c"))
+
+		resultStream := MergeStreamsWithPriority(streamA, streamB, compareFunc)
+		got, err := Collect(resultStream)
+
+		require.Error(t, err)
+		require.Equal(t, want, got)
+	})
+
+}
+
+func TestTakeWhile(t *testing.T) {
+	t.Parallel()
+
+	// Regular operation
+	out, err := Collect(TakeWhile(
+		Slice([]int{1, 2, 3, 4, 5, 6}),
+		func(item int) bool {
+			return item < 4
+		},
+	))
+
+	require.NoError(t, err)
+	require.Equal(t, []int{1, 2, 3}, out)
+
+	out, err = Collect(TakeWhile(
+		Slice([]int{1, 2, 3, 4, 5, 6}),
+		func(_ int) bool {
+			return true
+		},
+	))
+
+	require.NoError(t, err)
+	require.Equal(t, []int{1, 2, 3, 4, 5, 6}, out)
+
+	// Propagate error
+	out, err = Collect(TakeWhile(
+		Fail[int](fmt.Errorf("unexpected error")),
+		func(_ int) bool {
+			return true
+		},
+	))
+
+	require.Error(t, err)
+	require.Empty(t, out)
+
+	// Test early exit
+	var actual []int
+	TakeWhile(Slice([]int{1, 2, 3, 4, 5, 6}),
+		func(item int) bool { return true },
+	)(func(item int, err error) bool {
+		actual = append(actual, item)
+		return item < 3
+	})
+	require.Equal(t, []int{1, 2, 3}, actual)
+
+}
diff --git a/lib/join/adapters.go b/lib/join/adapters.go
new file mode 100644
index 0000000000000..4c4bcf1c9cfc4
--- /dev/null
+++ b/lib/join/adapters.go
@@ -0,0 +1,118 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"encoding/pem"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func clientInitFromRegisterUsingTokenRequest(req *types.RegisterUsingTokenRequest, joinMethod string) *messages.ClientInit {
+	return &messages.ClientInit{
+		JoinMethod: &joinMethod,
+		TokenName:  req.Token,
+		SystemRole: req.Role.String(),
+	}
+}
+
+func clientParamsFromRegisterUsingTokenRequest(req *types.RegisterUsingTokenRequest) (*messages.ClientParams, error) {
+	rawTLSPub, _ := pem.Decode(req.PublicTLSKey)
+	if rawTLSPub == nil {
+		return nil, trace.BadParameter("failed to decode PublicTLSKey from PEM")
+	}
+	sshPub, _, _, _, err := ssh.ParseAuthorizedKey(req.PublicSSHKey)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing PublicSSHKey from authorized_keys format")
+	}
+	publicKeys := messages.PublicKeys{
+		PublicTLSKey: rawTLSPub.Bytes,
+		PublicSSHKey: sshPub.Marshal(),
+	}
+	var clientParams messages.ClientParams
+	if req.Role == types.RoleBot {
+		clientParams.BotParams = &messages.BotParams{
+			PublicKeys: publicKeys,
+			Expires:    req.Expires,
+		}
+	} else {
+		clientParams.HostParams = &messages.HostParams{
+			PublicKeys:           publicKeys,
+			HostName:             req.NodeName,
+			AdditionalPrincipals: req.AdditionalPrincipals,
+			DNSNames:             req.DNSNames,
+		}
+	}
+	return &clientParams, nil
+}
+
+func protoCertsFromCertificates(certs messages.Certificates) (*proto.Certs, error) {
+	sshCert, err := sshPubWireFormatToAuthorizedKey(certs.SSHCert)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshCAKeys, err := sshPubWireFormatsToAuthorizedKeys(certs.SSHCAKeys)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &proto.Certs{
+		TLS:        pemEncodeTLSCert(certs.TLSCert),
+		TLSCACerts: pemEncodeTLSCerts(certs.TLSCACerts),
+		SSH:        sshCert,
+		SSHCACerts: sshCAKeys, // SSHCACerts is a misnomer, they're just public keys.
+	}, nil
+}
+
+func pemEncodeTLSCerts(rawCerts [][]byte) [][]byte {
+	out := make([][]byte, len(rawCerts))
+	for i, rawCert := range rawCerts {
+		out[i] = pemEncodeTLSCert(rawCert)
+	}
+	return out
+}
+
+func pemEncodeTLSCert(rawCert []byte) []byte {
+	return pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: rawCert,
+	})
+}
+
+func sshPubWireFormatsToAuthorizedKeys(wireFormats [][]byte) ([][]byte, error) {
+	out := make([][]byte, len(wireFormats))
+	for i, wireFormat := range wireFormats {
+		var err error
+		out[i], err = sshPubWireFormatToAuthorizedKey(wireFormat)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return out, nil
+}
+
+func sshPubWireFormatToAuthorizedKey(wireFormat []byte) ([]byte, error) {
+	pub, err := ssh.ParsePublicKey(wireFormat)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return ssh.MarshalAuthorizedKey(pub), nil
+}
diff --git a/lib/join/azuredevops/azuredevops.go b/lib/join/azuredevops/azuredevops.go
new file mode 100644
index 0000000000000..d38f5b621bb1e
--- /dev/null
+++ b/lib/join/azuredevops/azuredevops.go
@@ -0,0 +1,196 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package azuredevops
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Validator is a validator for Azure Devops OIDC tokens.
+type Validator interface {
+	Validate(ctx context.Context, organizationID string, idToken string) (*IDTokenClaims, error)
+}
+
+// IDTokenClaims for the pipeline OIDC ID Token issued by Azure Devops
+type IDTokenClaims struct {
+	oidc.TokenClaims
+	// Sub provides some information about the Azure Devops pipeline run.
+	// Example:
+	// p://noahstride0304/testing-azure-devops-join/strideynet.azure-devops-testing
+	Sub string `json:"sub"`
+	// OrganizationName is the name of the Azure Devops organization the project
+	// and pipeline belongs to. This name is extracted from the Sub.
+	OrganizationName string `json:"-"`
+	// ProjectName is the name of the Azure Devops project the pipeline belongs
+	// to. This name is extracted from the Sub.
+	ProjectName string `json:"-"`
+	// PipelineName is the name of the Azure Devops pipeline that the token
+	// belongs to. This name is extracted from the Sub.
+	PipelineName string `json:"-"`
+
+	// OrganizationID is the ID of the organization the pipeline belongs to.
+	OrganizationID string `json:"org_id"`
+	// ProjectID is the ID of the project the pipeline belongs to.
+	ProjectID string `json:"prj_id"`
+	// DefinitionID is the ID of the pipeline definition.
+	DefinitionID string `json:"def_id"`
+	// RepositoryID is the ID of the repository. This is not a UUID as the other
+	// ID fields. Example:
+	// strideynet/azure-devops-testing
+	RepositoryID string `json:"rpo_id"`
+	// RepositoryURI is the URI of the repository.
+	RepositoryURI string `json:"rpo_uri"`
+	// RepositoryVersion is the "version" of the repository the pipeline is
+	// running against. For a git repo, this is the commit sha.
+	RepositoryVersion string `json:"rpo_ver"`
+	// RepositoryRef is the reference that the pipeline is running
+	// against. Example:
+	// refs/heads/main
+	RepositoryRef string `json:"rpo_ref"`
+	// RunID is the ID of the pipeline run that the token belongs to.
+	RunID string `json:"run_id"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// ForAudit returns a map of the claims with the names adjusted to match the
+// definition in the JoinToken allow rules. This allows us to provide a better
+// UX by using the same names in the allow rules as are presented in the audit
+// logs.
+func (c *IDTokenClaims) ForAudit() map[string]any {
+	return map[string]any{
+		"sub":               c.Sub,
+		"organization_name": c.OrganizationName,
+		"project_name":      c.ProjectName,
+		"pipeline_name":     c.PipelineName,
+		"organization_id":   c.OrganizationID,
+		"project_id":        c.ProjectID,
+		"definition_id":     c.DefinitionID,
+		"repository_id":     c.RepositoryID,
+		"repository_uri":    c.RepositoryURI,
+		"repository_ver":    c.RepositoryVersion,
+		"repository_ref":    c.RepositoryRef,
+		"raw":               c,
+	}
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsAzureDevops {
+	return &workloadidentityv1pb.JoinAttrsAzureDevops{
+		Pipeline: &workloadidentityv1pb.JoinAttrsAzureDevopsPipeline{
+			Sub:               c.Sub,
+			OrganizationName:  c.OrganizationName,
+			ProjectName:       c.ProjectName,
+			PipelineName:      c.PipelineName,
+			OrganizationId:    c.OrganizationID,
+			ProjectId:         c.ProjectID,
+			DefinitionId:      c.DefinitionID,
+			RepositoryId:      c.RepositoryID,
+			RepositoryVersion: c.RepositoryVersion,
+			RepositoryRef:     c.RepositoryRef,
+			RunId:             c.RunID,
+		},
+	}
+}
+
+// CheckIDTokenParams are parameters used to validate Azure Devops OIDC tokens.
+type CheckIDTokenParams struct {
+	// ProvisionToken is the Teleport provision token used for the join request.
+	ProvisionToken *types.ProvisionTokenV2
+	// IDToken is the Azure Devops OIDC token presented by the joining client.
+	IDToken string
+	// Validator is a validator for Azure Devops OIDC tokens.
+	Validator Validator
+}
+
+func (p *CheckIDTokenParams) check() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	}
+	p.ProvisionToken.CheckAndSetDefaults()
+	return nil
+}
+
+// CheckIDToken validates an Azure Devops OIDC token, verifying both the validity of
+// the OIDC token itself, as well as ensuring claims match any configured allow
+// rules in the provided provision token.
+func CheckIDToken(ctx context.Context, params *CheckIDTokenParams) (*IDTokenClaims, error) {
+	if err := params.check(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	claims, err := params.Validator.Validate(
+		ctx,
+		params.ProvisionToken.Spec.AzureDevops.OrganizationID,
+		params.IDToken,
+	)
+	if err != nil {
+		return claims, trace.Wrap(err)
+	}
+
+	return claims, trace.Wrap(checkAzureDevopsAllowRules(params.ProvisionToken, claims))
+}
+
+func checkAzureDevopsAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	// If a single rule passes, accept the IDToken
+	for _, rule := range token.Spec.AzureDevops.Allow {
+		if rule.Sub != "" && rule.Sub != claims.Sub {
+			continue
+		}
+		if rule.ProjectName != "" && rule.ProjectName != claims.ProjectName {
+			continue
+		}
+		if rule.PipelineName != "" && rule.PipelineName != claims.PipelineName {
+			continue
+		}
+		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
+			continue
+		}
+		if rule.DefinitionID != "" && claims.DefinitionID != rule.DefinitionID {
+			continue
+		}
+		if rule.RepositoryURI != "" && claims.RepositoryURI != rule.RepositoryURI {
+			continue
+		}
+		if rule.RepositoryVersion != "" && claims.RepositoryVersion != rule.RepositoryVersion {
+			continue
+		}
+		if rule.RepositoryRef != "" && claims.RepositoryRef != rule.RepositoryRef {
+			continue
+		}
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims failed to match any allow rules")
+}
diff --git a/lib/azuredevops/token_source.go b/lib/join/azuredevops/token_source.go
similarity index 100%
rename from lib/azuredevops/token_source.go
rename to lib/join/azuredevops/token_source.go
diff --git a/lib/azuredevops/token_source_test.go b/lib/join/azuredevops/token_source_test.go
similarity index 100%
rename from lib/azuredevops/token_source_test.go
rename to lib/join/azuredevops/token_source_test.go
diff --git a/lib/join/azuredevops/token_validator.go b/lib/join/azuredevops/token_validator.go
new file mode 100644
index 0000000000000..907296afb2dbe
--- /dev/null
+++ b/lib/join/azuredevops/token_validator.go
@@ -0,0 +1,131 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package azuredevops
+
+import (
+	"context"
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/oidc"
+)
+
+// audience is the static value that Azure DevOps uses for the `aud` claim in
+// issued ID Tokens. Unfortunately, this cannot be changed.
+const audience = "api://AzureADTokenExchange"
+
+func issuerURL(
+	organizationID string,
+	overrideHost string,
+	insecure bool,
+) string {
+	scheme := "https"
+	if insecure {
+		scheme = "http"
+	}
+	host := "vstoken.dev.azure.com"
+	if overrideHost != "" {
+		host = overrideHost
+	}
+	issuerURL := url.URL{
+		Scheme: scheme,
+		Host:   host,
+	}
+	return issuerURL.JoinPath(organizationID).String()
+}
+
+// IDTokenValidator validates an Azure Devops issued ID Token.
+type IDTokenValidator struct {
+	insecureDiscovery     bool
+	overrideDiscoveryHost string
+}
+
+// NewIDTokenValidator returns an initialized IDTokenValidator
+func NewIDTokenValidator() *IDTokenValidator {
+	return &IDTokenValidator{}
+}
+
+// Validate validates an Azure Devops issued ID token.
+func (id *IDTokenValidator) Validate(
+	ctx context.Context, organizationID, token string,
+) (*IDTokenClaims, error) {
+	issuer := issuerURL(
+		organizationID, id.overrideDiscoveryHost, id.insecureDiscovery,
+	)
+
+	claims, err := oidc.ValidateToken[*IDTokenClaims](ctx, issuer, audience, token)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating token")
+	}
+
+	parsed, err := parseSubClaim(claims.Sub)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing sub claim")
+	}
+	claims.OrganizationName = parsed.organizationName
+	claims.ProjectName = parsed.projectName
+	claims.PipelineName = parsed.pipelineName
+
+	if claims.OrganizationID != organizationID {
+		return nil, trace.BadParameter(
+			"organization ID in token (%s) does not match configured (%s)",
+			claims.OrganizationID, organizationID,
+		)
+	}
+
+	return claims, nil
+}
+
+type parsedSubClaim struct {
+	organizationName string
+	projectName      string
+	pipelineName     string
+}
+
+func parseSubClaim(sub string) (parsedSubClaim, error) {
+	parsed, err := url.Parse(sub)
+	if err != nil {
+		return parsedSubClaim{}, trace.Wrap(err, "parsing as url")
+	}
+
+	// Special p:// scheme indicates this is a Pipeline ID token rather than
+	// a service connection ID token (which starts sc://).
+	if parsed.Scheme != "p" {
+		return parsedSubClaim{}, trace.BadParameter(
+			"id token is not of pipeline kind (sub: %q)", sub,
+		)
+	}
+
+	out := parsedSubClaim{organizationName: parsed.Host}
+	// Now we need to handle the path, which is something like
+	// /project-name/pipeline-name
+	path, _ := strings.CutPrefix(parsed.Path, "/")
+	split := strings.Split(path, "/")
+	if len(split) != 2 {
+		return parsedSubClaim{}, trace.BadParameter(
+			"subject malformed, expected 2 path elements (sub: %q)", sub,
+		)
+	}
+	out.projectName = split[0]
+	out.pipelineName = split[1]
+
+	return out, nil
+}
diff --git a/lib/azuredevops/token_validator_test.go b/lib/join/azuredevops/token_validator_test.go
similarity index 100%
rename from lib/azuredevops/token_validator_test.go
rename to lib/join/azuredevops/token_validator_test.go
diff --git a/lib/join/azurejoin/azure.go b/lib/join/azurejoin/azure.go
new file mode 100644
index 0000000000000..798a30c672d87
--- /dev/null
+++ b/lib/join/azurejoin/azure.go
@@ -0,0 +1,538 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package azurejoin
+
+import (
+	"cmp"
+	"context"
+	"crypto/x509"
+	"encoding/base64"
+	"log/slog"
+	"net/url"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	armpolicy "github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/policy"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+	"github.com/digitorus/pkcs7"
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	liboidc "github.com/gravitational/teleport/lib/oidc"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	AzureAccessTokenAudience = "https://management.azure.com/"
+
+	// azureUserAgent specifies the Azure User-Agent identification for telemetry.
+	azureUserAgent = "teleport"
+	// azureVirtualMachine specifies the Azure virtual machine resource type.
+	azureVirtualMachine = "virtualMachines"
+	// azureVirtualMachineScaleSet specifies the Azure virtual machine scale set resource type.
+	azureVirtualMachineScaleSet = "virtualMachineScaleSets"
+)
+
+// Structs for unmarshaling attested data. Schema can be found at
+// https://learn.microsoft.com/en-us/azure/virtual-machines/linux/instance-metadata-service?tabs=linux#response-2
+
+// SignedAttestedData models the response from the attested data IMDS endpoint.
+type SignedAttestedData struct {
+	Encoding  string `json:"encoding"`
+	Signature string `json:"signature"`
+}
+
+type plan struct {
+	Name      string `json:"name"`
+	Product   string `json:"product"`
+	Publisher string `json:"publisher"`
+}
+
+type timestamp struct {
+	CreatedOn string `json:"createdOn"`
+	ExpiresOn string `json:"expiresOn"`
+}
+
+// AttestedData models the decoded data returned from the attested data IMDS endpoint.
+type AttestedData struct {
+	LicenseType    string    `json:"licenseType"`
+	Nonce          string    `json:"nonce"`
+	Plan           plan      `json:"plan"`
+	Timestamp      timestamp `json:"timestamp"`
+	ID             string    `json:"vmId"`
+	SubscriptionID string    `json:"subscriptionId"`
+	SKU            string    `json:"sku"`
+}
+
+// AccessTokenClaims models the claims in an Azure access token.
+type AccessTokenClaims struct {
+	oidc.TokenClaims
+	TenantID string `json:"tid"`
+	Version  string `json:"ver"`
+
+	// Azure JWT tokens include two optional claims that can be used to validate
+	// the subscription and resource group of a joining node. These claims hold
+	// different values depending on the assigned Managed Identity of the Azure VM:
+	// - xms_mirid:
+	//   - For System-Assigned Identity it represents the resource id of the VM.
+	//   - For User-Assigned Identity it represents the resource id of the user-assigned identity.
+	// - xms_az_rid:
+	//   - For System-Assigned Identity this claim is omitted.
+	//   - For User-Assigned Identity it represents the resource id of the VM.
+	//
+	// More details at: https://learn.microsoft.com/en-us/answers/questions/1282788/existence-of-xms-az-rid-field-in-activity-logs-of
+
+	ManangedIdentityResourceID string `json:"xms_mirid"`
+	AzureResourceID            string `json:"xms_az_rid"`
+}
+
+func (c *AccessTokenClaims) asJWTClaims() jwt.Claims {
+	return jwt.Claims{
+		Issuer:    c.Issuer,
+		Subject:   c.Subject,
+		Audience:  jwt.Audience(c.Audience),
+		Expiry:    jwt.NewNumericDate(c.Expiration.AsTime()),
+		NotBefore: jwt.NewNumericDate(c.NotBefore.AsTime()),
+		IssuedAt:  jwt.NewNumericDate(c.IssuedAt.AsTime()),
+		ID:        c.JWTID,
+	}
+}
+
+// AzureVerifyTokenFunc is a function type that verifies an azure VM token.
+type AzureVerifyTokenFunc func(ctx context.Context, rawIDToken string) (*AccessTokenClaims, error)
+
+// VMClientGetter is a function type that returns an Azure VM client for a
+// given subscription authenticated with a given static token credential.
+type VMClientGetter func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error)
+
+// AzureJoinConfig holds configurable options for Azure joining.
+type AzureJoinConfig struct {
+	// CertificateAuthorities, if set, overrides the root certificate
+	// authorities used to verify VM attested data.
+	CertificateAuthorities []*x509.Certificate
+	// Verify, if set, overrides the function used to verify azure VM tokens.
+	Verify AzureVerifyTokenFunc
+	// GetVMClient, if set, overrides the function used to get Azure VM clients.
+	GetVMClient VMClientGetter
+	// IssuerHTTPClient, if set, overrides the default HTTP client used to
+	// fetch the intermediate CA which issued the attested data document
+	// signing certificate.
+	IssuerHTTPClient utils.HTTPDoClient
+}
+
+func azureVerifyFuncFromOIDCVerifier(clientID string) AzureVerifyTokenFunc {
+	return func(ctx context.Context, rawIDToken string) (*AccessTokenClaims, error) {
+		token, err := jwt.ParseSigned(rawIDToken)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// Need to get the tenant ID before we verify so we can construct the issuer URL.
+		var unverifiedClaims AccessTokenClaims
+		if err := token.UnsafeClaimsWithoutVerification(&unverifiedClaims); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		issuer, err := url.JoinPath("https://sts.windows.net", unverifiedClaims.TenantID, "/")
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return liboidc.ValidateToken[*AccessTokenClaims](ctx, issuer, clientID, rawIDToken)
+	}
+}
+
+func (cfg *AzureJoinConfig) checkAndSetDefaults() error {
+	if cfg.Verify == nil {
+		cfg.Verify = azureVerifyFuncFromOIDCVerifier(AzureAccessTokenAudience)
+	}
+
+	if cfg.CertificateAuthorities == nil {
+		certs, err := getAzureRootCerts()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		cfg.CertificateAuthorities = certs
+	}
+	if cfg.GetVMClient == nil {
+		cfg.GetVMClient = func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error) {
+			// The User-Agent is added for debugging purposes. It helps identify
+			// and isolate teleport traffic.
+			opts := &armpolicy.ClientOptions{
+				ClientOptions: policy.ClientOptions{
+					Telemetry: policy.TelemetryOptions{
+						ApplicationID: azureUserAgent,
+					},
+				},
+			}
+			client, err := azure.NewVirtualMachinesClient(subscriptionID, token, opts)
+			return client, trace.Wrap(err)
+		}
+	}
+	if cfg.IssuerHTTPClient == nil {
+		httpClient, err := defaults.HTTPClient()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		cfg.IssuerHTTPClient = httpClient
+	}
+	return nil
+}
+
+// parseAndVeryAttestedData verifies that an attested data document was signed
+// by Azure. If verification is successful, it returns the ID of the VM that
+// produced the document.
+func parseAndVerifyAttestedData(
+	ctx context.Context,
+	cfg *AzureJoinConfig,
+	adBytes []byte,
+	intermediates []byte,
+	challenge string,
+) (subscriptionID, vmID string, err error) {
+	ad, p7, err := ParseAttestedData(adBytes)
+	if err != nil {
+		return "", "", trace.Wrap(err)
+	}
+	if ad.Nonce != challenge {
+		return "", "", trace.AccessDenied("challenge is missing or does not match")
+	}
+	if len(p7.Certificates) == 0 {
+		return "", "", trace.AccessDenied("no certificates for signature")
+	}
+	signingCert := p7.Certificates[0]
+
+	if !isAllowedDomain(signingCert.Subject.CommonName, allowedAzureCommonNames) {
+		return "", "", trace.AccessDenied(
+			"certificate common name does not match allow-list (%s)",
+			signingCert.Subject.CommonName,
+		)
+	}
+
+	if len(intermediates) > 0 {
+		// Client explicitly sent intermediate CAs, included them.
+		intermediates, err := x509.ParseCertificates(intermediates)
+		if err != nil {
+			return "", "", trace.Wrap(err, "parsing intermediate certificates sent by client")
+		}
+		p7.Certificates = append(p7.Certificates, intermediates...)
+	} else {
+		// Client did not send intermediates, fetch them from Azure.
+		intermediate, err := getAzureIssuerCert(ctx, p7.Certificates[0], cfg.IssuerHTTPClient)
+		if err != nil {
+			return "", "", trace.Wrap(err)
+		}
+		if intermediate != nil {
+			p7.Certificates = append(p7.Certificates, intermediate)
+		}
+	}
+
+	pool := x509.NewCertPool()
+	for _, cert := range cfg.CertificateAuthorities {
+		pool.AddCert(cert)
+	}
+
+	fixAzureSigningAlgorithm(p7)
+	if err := p7.VerifyWithChain(pool); err != nil {
+		return "", "", trace.Wrap(err)
+	}
+
+	return ad.SubscriptionID, ad.ID, nil
+}
+
+// ParseAttestedData returns the parsed VM attested data and a PKCS7 structure
+// which can be used to verify the signature.
+func ParseAttestedData(adBytes []byte) (*AttestedData, *pkcs7.PKCS7, error) {
+	var signedAD SignedAttestedData
+	if err := utils.FastUnmarshal(adBytes, &signedAD); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	if signedAD.Encoding != "pkcs7" {
+		return nil, nil, trace.AccessDenied("unsupported signature type: %v", signedAD.Encoding)
+	}
+
+	sigDER, err := base64.StdEncoding.DecodeString(signedAD.Signature)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "decoding attested data document from base64")
+	}
+
+	p7, err := pkcs7.Parse(sigDER)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	var ad AttestedData
+	if err := utils.FastUnmarshal(p7.Content, &ad); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return &ad, p7, nil
+}
+
+// verifyVMIdentity verifies that the provided access token came from the
+// correct Azure VM. Returns the Azure join attributes
+func verifyVMIdentity(
+	ctx context.Context,
+	cfg *AzureJoinConfig,
+	accessToken,
+	subscriptionID,
+	vmID string,
+	requestStart time.Time,
+	logger *slog.Logger,
+) (joinAttrs *workloadidentityv1pb.JoinAttrsAzure, err error) {
+	tokenClaims, err := cfg.Verify(ctx, accessToken)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	expectedIssuer, err := url.JoinPath("https://sts.windows.net", tokenClaims.TenantID, "/")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// v2 tokens have the version appended to the issuer.
+	if tokenClaims.Version == "2.0" {
+		expectedIssuer, err = url.JoinPath(expectedIssuer, "2.0")
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	expectedClaims := jwt.Expected{
+		Issuer:   expectedIssuer,
+		Audience: jwt.Audience{AzureAccessTokenAudience},
+		Time:     requestStart,
+	}
+
+	if err := tokenClaims.asJWTClaims().Validate(expectedClaims); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Listing all VMs in an Azure subscription during the verification process
+	// is problematic when there are a large number of VMs in an Azure subscription.
+	// In some cases this can lead to throttling due to Azure API rate limits.
+	// To address the issue, the verification process will first attempt to
+	// parse required VM identifiers from the token claims. If this method fails,
+	// fallback to the original method of listing VMs and parsing the VM identifiers
+	// from the VM resource.
+	vmSubscription, vmResourceGroup, err := claimsToIdentifiers(tokenClaims)
+	if err == nil {
+		if subscriptionID != vmSubscription {
+			return nil, trace.AccessDenied("subscription ID mismatch between attested data and access token")
+		}
+		return azureJoinToAttrs(vmSubscription, vmResourceGroup), nil
+	}
+	logger.WarnContext(ctx, "Failed to parse VM identifiers from claims. Retrying with Azure VM API.",
+		"error", err)
+
+	tokenCredential := azure.NewStaticCredential(azcore.AccessToken{
+		Token:     accessToken,
+		ExpiresOn: tokenClaims.GetExpiration(),
+	})
+	vmClient, err := cfg.GetVMClient(subscriptionID, tokenCredential)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resourceID, err := arm.ParseResourceID(tokenClaims.ManangedIdentityResourceID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var vm *azure.VirtualMachine
+
+	// If the token is from the system-assigned managed identity, the resource ID
+	// is for the VM itself and we can use it to look up the VM.
+	// This will also match scale set VMs (VMSS), the vmClient is responsible
+	// for properly retrieving their information.
+	if slices.Contains(resourceID.ResourceType.Types, azureVirtualMachine) {
+		vm, err = vmClient.Get(ctx, tokenClaims.ManangedIdentityResourceID)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if vm.VMID != vmID {
+			return nil, trace.AccessDenied("vm ID does not match")
+		}
+
+		// If the token is from a user-assigned managed identity, the resource ID is
+		// for the identity and we need to look the VM up by VM ID.
+	} else {
+		vm, err = vmClient.GetByVMID(ctx, vmID)
+		if err != nil {
+			if trace.IsNotFound(err) {
+				return nil, trace.AccessDenied("no VM found with matching VM ID")
+			}
+			return nil, trace.Wrap(err)
+		}
+	}
+	return azureJoinToAttrs(vm.Subscription, vm.ResourceGroup), nil
+}
+
+// claimsToIdentifiers returns the vm identifiers from the provided claims.
+func claimsToIdentifiers(tokenClaims *AccessTokenClaims) (subscriptionID, resourceGroupID string, err error) {
+	// xms_az_rid claim is omitted when the VM is assigned a System-Assigned Identity.
+	// The xms_mirid claim should be used instead.
+	rid := cmp.Or(tokenClaims.AzureResourceID, tokenClaims.ManangedIdentityResourceID)
+	resourceID, err := arm.ParseResourceID(rid)
+	if err != nil {
+		return "", "", trace.Wrap(err, "failed to parse resource id from claims")
+	}
+
+	for _, resourceType := range resourceID.ResourceType.Types {
+		switch resourceType {
+		case azureVirtualMachine, azureVirtualMachineScaleSet:
+			return resourceID.SubscriptionID, resourceID.ResourceGroupName, nil
+		}
+	}
+	return "", "", trace.BadParameter("unexpected resource type: %q", resourceID.ResourceType.Type)
+}
+
+func checkAzureAllowRules(vmID string, attrs *workloadidentityv1pb.JoinAttrsAzure, token *types.ProvisionTokenV2) error {
+	for _, rule := range token.Spec.Azure.Allow {
+		if rule.Subscription != attrs.Subscription {
+			continue
+		}
+		if !azureResourceGroupIsAllowed(rule.ResourceGroups, attrs.ResourceGroup) {
+			continue
+		}
+		return nil
+	}
+	return trace.AccessDenied("instance %v did not match any allow rules in token %v", vmID, token.GetName())
+}
+
+func azureResourceGroupIsAllowed(allowedResourceGroups []string, vmResourceGroup string) bool {
+	if len(allowedResourceGroups) == 0 {
+		return true
+	}
+
+	// ResourceGroups are case insensitive.
+	// https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/frequently-asked-questions#are-resource-group-names-case-sensitive
+	// The API returns them using capital case, but docs don't mention a specific case.
+	// Converting everything to the same case will ensure a proper comparison.
+	resourceGroup := strings.ToUpper(vmResourceGroup)
+	for _, allowedResourceGroup := range allowedResourceGroups {
+		if strings.EqualFold(resourceGroup, allowedResourceGroup) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func azureJoinToAttrs(subscriptionID, resourceGroupID string) *workloadidentityv1pb.JoinAttrsAzure {
+	return &workloadidentityv1pb.JoinAttrsAzure{
+		Subscription:  subscriptionID,
+		ResourceGroup: resourceGroupID,
+	}
+}
+
+// CheckAzureRequestParams holds all parameters for [CheckAzureRequest].
+type CheckAzureRequestParams struct {
+	// AzureJoinConfig holds configurable options for Azure joining.
+	AzureJoinConfig *AzureJoinConfig
+	// Token is the token used for the incoming request.
+	Token *types.ProvisionTokenV2
+	// Challenge is the challenge that was issued.
+	Challenge string
+	// AttestedData is the Azure attested data that was returned by the joining
+	// client. It must include the challenge as a nonce.
+	AttestedData []byte
+	// Intermediate encodes the intermediate CAs that issued the leaf certificate
+	// used to sign the attested data document, in x509 DER format.
+	Intermediate []byte
+	// AccessToken is the Azure access token that was returned by the joining client
+	AccessToken string
+	// Logger will be used for logging.
+	Logger *slog.Logger
+	// Clock overrides the system time.
+	Clock clockwork.Clock
+}
+
+func (p *CheckAzureRequestParams) checkAndSetDefaults() error {
+	switch {
+	case p.AzureJoinConfig == nil:
+		p.AzureJoinConfig = &AzureJoinConfig{}
+	case p.Token == nil:
+		return trace.BadParameter("Token is required")
+	case len(p.Challenge) == 0:
+		return trace.BadParameter("Challenge is required")
+	case len(p.AttestedData) == 0:
+		return trace.BadParameter("AttestedData is required")
+	case len(p.AccessToken) == 0:
+		return trace.BadParameter("AccessToken is required")
+	case p.Logger == nil:
+		return trace.BadParameter("Logger is required")
+	case p.Clock == nil:
+		p.Clock = clockwork.NewRealClock()
+	}
+	return trace.Wrap(p.AzureJoinConfig.checkAndSetDefaults())
+}
+
+// CheckAzureRequest checks an azure join request by verifying the VMs claims
+// and checking that they match an allow rule from the join token.
+func CheckAzureRequest(ctx context.Context, params CheckAzureRequestParams) (*workloadidentityv1pb.JoinAttrsAzure, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	requestStart := params.Clock.Now()
+
+	subID, vmID, err := parseAndVerifyAttestedData(
+		ctx,
+		params.AzureJoinConfig,
+		params.AttestedData,
+		params.Intermediate,
+		params.Challenge,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	attrs, err := verifyVMIdentity(ctx, params.AzureJoinConfig, params.AccessToken, subID, vmID, requestStart, params.Logger)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := checkAzureAllowRules(vmID, attrs, params.Token); err != nil {
+		return attrs, trace.Wrap(err)
+	}
+
+	return attrs, nil
+}
+
+// GenerateAzureChallenge generates a challenge for the Azure join method.
+func GenerateAzureChallenge() (string, error) {
+	challenge, err := joinutils.GenerateChallenge(base64.RawURLEncoding, 24)
+	return challenge, trace.Wrap(err)
+}
+
+// fixAzureSigningAlgorithm fixes a mismatch between the object IDs of the
+// hashing algorithm sent by Azure vs the ones expected by the pkcs7 library.
+// Specifically, Azure (incorrectly?) sends a [digest encryption algorithm]
+// where the pkcs7 structure's [signerInfo] expects a [digest algorithm].
+//
+// [signerInfo]: https://www.rfc-editor.org/rfc/rfc2315#section-6.4
+// [digest algorithm]: https://www.rfc-editor.org/rfc/rfc2315#section-6.3
+// [digest encryption algorithm]: https://www.rfc-editor.org/rfc/rfc2315#section-6.4
+func fixAzureSigningAlgorithm(p7 *pkcs7.PKCS7) {
+	for i, signer := range p7.Signers {
+		if signer.DigestAlgorithm.Algorithm.Equal(pkcs7.OIDEncryptionAlgorithmRSASHA256) {
+			p7.Signers[i].DigestAlgorithm.Algorithm = pkcs7.OIDDigestAlgorithmSHA256
+		}
+	}
+}
diff --git a/lib/auth/azure_certs.go b/lib/join/azurejoin/azure_certs.go
similarity index 77%
rename from lib/auth/azure_certs.go
rename to lib/join/azurejoin/azure_certs.go
index 00f4c4b3e4147..5ce76b77b3478 100644
--- a/lib/auth/azure_certs.go
+++ b/lib/join/azurejoin/azure_certs.go
@@ -16,19 +16,19 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package azurejoin
 
 import (
 	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -48,45 +48,89 @@ func isAllowedDomain(cn string, domains []string) bool {
 	return false
 }
 
-// getAzureIssuerCert fetches a x509 certificate's issuing certificate.
-func getAzureIssuerCert(ctx context.Context, cert *x509.Certificate) (*x509.Certificate, error) {
-	if len(cert.IssuingCertificateURL) == 0 {
-		return nil, nil
-	}
+func validateAzureCertIssuerURL(issuerURLString string) (string, error) {
+	// All active issuing certs are listed here
+	// https://www.microsoft.com/pkiops/docs/repository.htm
+	//
+	// The cert path always looks like the following, although this does not
+	// appear to be guaranteed by Microsoft.
+	// url: http://www.microsoft.com/pkiops/certs/<cert-name>.crt
+	//
+	// This code path is only used by the legacy join service which will be
+	// removed in v20, v18+ agents use the new join service where the joining
+	// client sends the intermediate CAs along with the request.
+	const (
+		allowedHost       = "www.microsoft.com"
+		allowedPathPrefix = "/pkiops/certs/"
+		allowedPathSuffix = ".crt"
+	)
 
-	httpClient, err := defaults.HTTPClient()
+	issuerURL, err := url.Parse(issuerURLString)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return "", trace.AccessDenied("url failed to parse")
+	}
+
+	switch issuerURL.Scheme {
+	case "http", "https":
+	default:
+		return "", trace.AccessDenied("invalid url scheme %q", issuerURL.Scheme)
+	}
+
+	if issuerURL.Host != allowedHost {
+		return "", trace.AccessDenied("invalid host %q", issuerURL.Host)
+	}
+
+	if !strings.HasPrefix(issuerURL.Path, allowedPathPrefix) ||
+		!strings.HasSuffix(issuerURL.Path, allowedPathSuffix) {
+		return "", trace.AccessDenied("invalid path, must match %s<name>%s",
+			allowedPathPrefix, allowedPathSuffix)
+	}
+
+	// Construct a new URL with only the scheme, host, and path to strip any
+	// possible extra fields like query params or fragments.
+	sanitizedURL := url.URL{
+		Scheme: issuerURL.Scheme,
+		Host:   allowedHost,
+		Path:   issuerURL.Path,
+	}
+	return sanitizedURL.String(), nil
+}
+
+// getAzureIssuerCert fetches a x509 certificate's issuing certificate.
+func getAzureIssuerCert(ctx context.Context, cert *x509.Certificate, httpClient utils.HTTPDoClient) (*x509.Certificate, error) {
+	if len(cert.IssuingCertificateURL) == 0 {
+		return nil, trace.BadParameter("certificate has no issuing certificate URL")
 	}
 
 	// Azure sends only one issuing cert.
 	issuerURL := cert.IssuingCertificateURL[0]
-	commonName := cert.Subject.CommonName
-	if !isAllowedDomain(commonName, allowedAzureCommonNames) {
-		return nil, trace.AccessDenied(
-			"certificate common name does not match allow-list (%s)",
-			commonName,
-		)
+	sanitizedIssuerURL, err := validateAzureCertIssuerURL(issuerURL)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating issuing certificate URL")
 	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, issuerURL, nil)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, sanitizedIssuerURL, nil /*body*/)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, trace.Wrap(err, "fetching issuing certificate")
 	}
 	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, trace.AccessDenied("failed to fetch issuing cert, got HTTP status code %d", resp.StatusCode)
+	}
+
 	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
 	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, trace.ReadError(resp.StatusCode, body)
+		return nil, trace.Wrap(err, "reading HTTP response body")
 	}
 
 	issuerCert, err := x509.ParseCertificate(body)
-	return issuerCert, trace.Wrap(err)
+	return issuerCert, trace.Wrap(err, "parsing issuing certificate")
 }
 
 func getAzureRootCerts() ([]*x509.Certificate, error) {
@@ -104,32 +148,13 @@ func getAzureRootCerts() ([]*x509.Certificate, error) {
 
 // These certificates can be found at
 // https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details.
-// Pinned on 2023-01-25.
+// Pinned on 2025-11-25.
 var rawAzureCerts = [][]byte{
-	// Baltimore CyberTrust Root
-	[]byte(`-----BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
-RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD
-VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX
-DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y
-ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy
-VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr
-mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr
-IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK
-mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu
-XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy
-dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye
-jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1
-BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3
-DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92
-9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx
-jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0
-Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz
-ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS
-R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp
------END CERTIFICATE-----`),
-
 	// DigiCert Global Root CA
+	//
+	// Note(Noah): It looks like the days of this CA may be numbered, according
+	// to https://techcommunity.microsoft.com/blog/azuregovernanceandmanagementblog/azure-instance-metadata-service-attested-data-tls-2025-critical-changes/2888953
+	// we can expect this to be removed in April 2026.
 	[]byte(`-----BEGIN CERTIFICATE-----
 MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
 MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
diff --git a/lib/auth/azure_certs_test.go b/lib/join/azurejoin/azure_certs_test.go
similarity index 98%
rename from lib/auth/azure_certs_test.go
rename to lib/join/azurejoin/azure_certs_test.go
index 322a3c58da1bc..7ebb1acccf004 100644
--- a/lib/auth/azure_certs_test.go
+++ b/lib/join/azurejoin/azure_certs_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package azurejoin
 
 import (
 	"testing"
diff --git a/lib/join/azurejoin/join_azure_test.go b/lib/join/azurejoin/join_azure_test.go
new file mode 100644
index 0000000000000..631ca29973565
--- /dev/null
+++ b/lib/join/azurejoin/join_azure_test.go
@@ -0,0 +1,1224 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package azurejoin_test
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/digitorus/pkcs7"
+	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+type mockAzureVMClient struct {
+	azure.VirtualMachinesClient
+	vms map[string]*azure.VirtualMachine
+}
+
+func (m *mockAzureVMClient) Get(_ context.Context, resourceID string) (*azure.VirtualMachine, error) {
+	vm, ok := m.vms[resourceID]
+	if !ok {
+		return nil, trace.NotFound("no vm with resource id %q", resourceID)
+	}
+	return vm, nil
+}
+
+func (m *mockAzureVMClient) GetByVMID(_ context.Context, vmID string) (*azure.VirtualMachine, error) {
+	for _, vm := range m.vms {
+		if vm.VMID == vmID {
+			return vm, nil
+		}
+	}
+	return nil, trace.NotFound("no vm with id %q", vmID)
+}
+
+func makeVMClientGetter(clients map[string]*mockAzureVMClient) azurejoin.VMClientGetter {
+	return func(subscriptionID string, _ *azure.StaticCredential) (azure.VirtualMachinesClient, error) {
+		if client, ok := clients[subscriptionID]; ok {
+			return client, nil
+		}
+		return nil, trace.NotFound("no client for subscription %q", subscriptionID)
+	}
+}
+
+func vmssResourceID(subscription, resourceGroup, name string) string {
+	return resourceID("Microsoft.Compute/virtualMachineScaleSets", subscription, resourceGroup, name)
+}
+
+func vmResourceID(subscription, resourceGroup, name string) string {
+	return resourceID("Microsoft.Compute/virtualMachines", subscription, resourceGroup, name)
+}
+
+func identityResourceID(subscription, resourceGroup, name string) string {
+	return resourceID("Microsoft.ManagedIdentity/userAssignedIdentities", subscription, resourceGroup, name)
+}
+
+func resourceID(resourceType, subscription, resourceGroup, name string) string {
+	return fmt.Sprintf(
+		"/subscriptions/%v/resourcegroups/%v/providers/%v/%v",
+		subscription, resourceGroup, resourceType, name,
+	)
+}
+
+func mockVerifyToken(err error) azurejoin.AzureVerifyTokenFunc {
+	return func(_ context.Context, rawToken string) (*azurejoin.AccessTokenClaims, error) {
+		if err != nil {
+			return nil, err
+		}
+		tok, err := jwt.ParseSigned(rawToken)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		var claims azurejoin.AccessTokenClaims
+		if err := tok.UnsafeClaimsWithoutVerification(&claims); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &claims, nil
+	}
+}
+
+func makeToken(managedIdentityResourceID, azureResourceID string, issueTime time.Time) (string, error) {
+	sig, err := jose.NewSigner(jose.SigningKey{
+		Algorithm: jose.HS256,
+		Key:       []byte("test-key"),
+	}, &jose.SignerOptions{})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	claims := azurejoin.AccessTokenClaims{
+		TokenClaims: oidc.TokenClaims{
+			Issuer:     "https://sts.windows.net/test-tenant-id/",
+			Audience:   []string{azurejoin.AzureAccessTokenAudience},
+			Subject:    "test",
+			IssuedAt:   oidc.FromTime(issueTime),
+			NotBefore:  oidc.FromTime(issueTime),
+			Expiration: oidc.FromTime(issueTime.Add(time.Minute)),
+			JWTID:      "id",
+		},
+		ManangedIdentityResourceID: managedIdentityResourceID,
+		AzureResourceID:            azureResourceID,
+		TenantID:                   "test-tenant-id",
+		Version:                    "1.0",
+	}
+	raw, err := jwt.Signed(sig).Claims(claims).CompactSerialize()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return raw, nil
+}
+
+func TestJoinAzure(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	a := server.Auth()
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	caChain := newFakeAzureCAChain(t)
+	httpClient := newFakeAzureIssuerHTTPClient(caChain.intermediateCertDER)
+	instanceKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	instanceCert := caChain.issueLeafCert(t,
+		instanceKey.Public(),
+		"instance.metadata.azure.com",
+		"http://www.microsoft.com/pkiops/certs/testcert.crt")
+
+	isAccessDenied := func(t require.TestingT, err error, _ ...any) {
+		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
+	}
+	isBadParameter := func(t require.TestingT, err error, _ ...any) {
+		require.True(t, trace.IsBadParameter(err), "expected Bad Parameter error, actual error: %v", err)
+	}
+
+	defaultSubscription := uuid.NewString()
+	defaultResourceGroup := "my-resource-group"
+	defaultVMName := "test-vm"
+	defaultIdentityName := "test-id"
+	defaultVMID := "my-vm-id"
+	defaultVMResourceID := vmResourceID(defaultSubscription, defaultResourceGroup, defaultVMName)
+	defaultIdentityResourceID := identityResourceID(defaultSubscription, defaultResourceGroup, defaultIdentityName)
+
+	tests := []struct {
+		name                           string
+		tokenManagedIdentityResourceID string
+		tokenAzureResourceID           string
+		tokenSubscription              string
+		tokenVMID                      string
+		requestTokenName               string
+		tokenSpec                      types.ProvisionTokenSpecV2
+		overrideReturnedChallenge      string
+		challengeResponseErr           error
+		certs                          []*x509.Certificate
+		verify                         azurejoin.AzureVerifyTokenFunc
+		assertError                    require.ErrorAssertionFunc
+	}{
+		{
+			name:              "basic passing case",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   defaultSubscription,
+							ResourceGroups: []string{defaultResourceGroup},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:              "resource group is case insensitive",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   defaultSubscription,
+							ResourceGroups: []string{"MY-resource-GROUP"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:              "wrong token",
+			requestTokenName:  "wrong-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:              "challenge response error",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:               mockVerifyToken(nil),
+			certs:                []*x509.Certificate{caChain.rootCert},
+			challengeResponseErr: trace.BadParameter("test error"),
+			assertError:          isBadParameter,
+		},
+		{
+			name:              "wrong subscription",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: "alternate-subscription-id",
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:              "wrong resource group",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   defaultSubscription,
+							ResourceGroups: []string{"alternate-resource-group"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:              "wrong challenge",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			overrideReturnedChallenge: "wrong-challenge",
+			verify:                    mockVerifyToken(nil),
+			certs:                     []*x509.Certificate{caChain.rootCert},
+			assertError:               isAccessDenied,
+		},
+		{
+			name:              "invalid signature",
+			requestTokenName:  "test-token",
+			tokenSubscription: defaultSubscription,
+			tokenVMID:         defaultVMID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{},
+			assertError: require.Error,
+		},
+		{
+			name:                           "attested data and access token from different VMs",
+			requestTokenName:               "test-token",
+			tokenSubscription:              defaultSubscription,
+			tokenVMID:                      "some-other-vm-id",
+			tokenManagedIdentityResourceID: defaultIdentityResourceID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "vm not found",
+			requestTokenName:               "test-token",
+			tokenSubscription:              defaultSubscription,
+			tokenVMID:                      "invalid-id",
+			tokenManagedIdentityResourceID: identityResourceID(defaultSubscription, defaultResourceGroup, "invalid-vm"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "lookup vm by id",
+			requestTokenName:               "test-token",
+			tokenSubscription:              defaultSubscription,
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: defaultIdentityResourceID,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:                           "vm is in a different subscription than the token it provides",
+			requestTokenName:               "test-token",
+			tokenSubscription:              defaultSubscription,
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: identityResourceID("some-other-subscription", defaultResourceGroup, defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription: defaultSubscription,
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			vmClient := &mockAzureVMClient{
+				vms: map[string]*azure.VirtualMachine{
+					defaultVMResourceID: {
+						ID:            defaultVMResourceID,
+						Name:          defaultVMName,
+						Subscription:  defaultSubscription,
+						ResourceGroup: defaultResourceGroup,
+						VMID:          defaultVMID,
+					},
+				},
+			}
+			getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
+				defaultSubscription: vmClient,
+			})
+
+			a.SetAzureJoinConfig(&azurejoin.AzureJoinConfig{
+				CertificateAuthorities: tc.certs,
+				Verify:                 tc.verify,
+				GetVMClient:            getVMClient,
+				IssuerHTTPClient:       httpClient,
+			})
+
+			token, err := types.NewProvisionTokenFromSpec(
+				"test-token",
+				time.Now().Add(time.Minute),
+				tc.tokenSpec)
+			require.NoError(t, err)
+			require.NoError(t, a.UpsertToken(ctx, token))
+			t.Cleanup(func() {
+				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
+			})
+
+			mirID := tc.tokenManagedIdentityResourceID
+			if mirID == "" {
+				mirID = vmResourceID(defaultSubscription, defaultResourceGroup, defaultVMName)
+			}
+
+			accessToken, err := makeToken(mirID, "", a.GetClock().Now())
+			require.NoError(t, err)
+
+			imdsClient := &fakeIMDSClient{
+				accessToken:       accessToken,
+				accessTokenErr:    tc.challengeResponseErr,
+				overrideChallenge: tc.overrideReturnedChallenge,
+				signingCert:       instanceCert,
+				signingKey:        instanceKey,
+				subscription:      tc.tokenSubscription,
+				vmID:              tc.tokenVMID,
+			}
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = joinclient.LegacyJoin(ctx, joinclient.JoinParams{
+					Token:      tc.requestTokenName,
+					JoinMethod: types.JoinMethodAzure,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance,
+						HostUUID: "testuuid",
+					},
+					AuthClient: nopClient,
+					AzureParams: joinclient.AzureParams{
+						ClientID:   tc.tokenVMID,
+						IMDSClient: imdsClient,
+					},
+				})
+				tc.assertError(t, err)
+			})
+			t.Run("new", func(t *testing.T) {
+				_, err = joinclient.Join(ctx, joinclient.JoinParams{
+					Token: tc.requestTokenName,
+					ID: state.IdentityID{
+						Role: types.RoleInstance,
+					},
+					AuthClient: nopClient,
+					AzureParams: joinclient.AzureParams{
+						ClientID:         tc.tokenVMID,
+						IMDSClient:       imdsClient,
+						IssuerHTTPClient: httpClient,
+					},
+				})
+				tc.assertError(t, err)
+			})
+		})
+	}
+}
+
+// TestAuth_RegisterUsingAzureClaims tests the Azure join method by verifying
+// joining VMs by the token claims rather than from the Azure VM API.
+func TestJoinAzureClaims(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	a := server.Auth()
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	caChain := newFakeAzureCAChain(t)
+	httpClient := newFakeAzureIssuerHTTPClient(caChain.intermediateCertDER)
+	instanceKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	instanceCert := caChain.issueLeafCert(t,
+		instanceKey.Public(),
+		"instance.metadata.azure.com",
+		"http://www.microsoft.com/pkiops/certs/testcert.crt")
+
+	isAccessDenied := func(t require.TestingT, err error, _ ...any) {
+		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
+	}
+	defaultSubscription := uuid.NewString()
+	defaultResourceGroup := "my-resource-group"
+	defaultVMName := "test-vm"
+	defaultIdentityName := "test-id"
+	defaultVMID := "my-vm-id"
+
+	botName := "botty"
+	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: botName,
+		},
+		Spec: &machineidv1pb.BotSpec{},
+	}, a.GetClock().Now(), "")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name                           string
+		tokenManagedIdentityResourceID string
+		tokenAzureResourceID           string
+		tokenSubscription              string
+		tokenVMID                      string
+		requestTokenName               string
+		tokenSpec                      types.ProvisionTokenSpecV2
+		challengeResponseErr           error
+		certs                          []*x509.Certificate
+		verify                         azurejoin.AzureVerifyTokenFunc
+		assertError                    require.ErrorAssertionFunc
+	}{
+		{
+			name:                           "system-managed identity ok",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "system-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "system-managed-test",
+							ResourceGroups: []string{"system-managed-test"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:                           "system-managed identity with wrong subscription",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "system-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   defaultSubscription,
+							ResourceGroups: []string{"system-managed-test"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "system-managed identity with wrong resource group",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "system-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: vmResourceID("system-managed-test", "system-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "system-managed-test",
+							ResourceGroups: []string{defaultResourceGroup},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "user-managed identity ok",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "user-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
+			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "user-managed-test",
+							ResourceGroups: []string{"user-managed-test"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:                           "user-managed identity with wrong subscription",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "user-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
+			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   defaultSubscription,
+							ResourceGroups: []string{"user-managed-test"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "user-managed identity with wrong resource group",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "user-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: identityResourceID("user-managed-test", "user-managed-test", defaultIdentityName),
+			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "user-managed-test",
+							ResourceGroups: []string{defaultResourceGroup},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "user-managed identity from different subscription",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "user-managed-test",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: identityResourceID("invalid-user-managed-test", "invalid-user-managed-test", defaultIdentityName),
+			tokenAzureResourceID:           vmResourceID("user-managed-test", "user-managed-test", defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "user-managed-test",
+							ResourceGroups: []string{"user-managed-test"},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+		{
+			name:                           "subscription mismatch between attestation and token",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "attested-subscription",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: vmResourceID("token-subscription", defaultResourceGroup, defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "token-subscription",
+							ResourceGroups: []string{defaultResourceGroup},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: isAccessDenied,
+		},
+		{
+			name:                           "vmss resource type",
+			requestTokenName:               "test-token",
+			tokenSubscription:              "token-subscription",
+			tokenVMID:                      defaultVMID,
+			tokenManagedIdentityResourceID: vmssResourceID("token-subscription", defaultResourceGroup, defaultVMName),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Azure: &types.ProvisionTokenSpecV2Azure{
+					Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+						{
+							Subscription:   "token-subscription",
+							ResourceGroups: []string{defaultResourceGroup},
+						},
+					},
+				},
+				JoinMethod: types.JoinMethodAzure,
+			},
+			verify:      mockVerifyToken(nil),
+			certs:       []*x509.Certificate{caChain.rootCert},
+			assertError: require.NoError,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			token, err := types.NewProvisionTokenFromSpec(
+				"test-token",
+				time.Now().Add(time.Minute),
+				tc.tokenSpec)
+			require.NoError(t, err)
+			require.NoError(t, a.UpsertToken(ctx, token))
+			t.Cleanup(func() {
+				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
+			})
+
+			mirID := tc.tokenManagedIdentityResourceID
+			azrID := tc.tokenAzureResourceID
+			accessToken, err := makeToken(mirID, azrID, a.GetClock().Now())
+			require.NoError(t, err)
+
+			vmClient := &mockAzureVMClient{
+				vms: map[string]*azure.VirtualMachine{},
+			}
+			getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
+				defaultSubscription: vmClient,
+			})
+
+			a.SetAzureJoinConfig(&azurejoin.AzureJoinConfig{
+				CertificateAuthorities: tc.certs,
+				Verify:                 tc.verify,
+				GetVMClient:            getVMClient,
+				IssuerHTTPClient:       httpClient,
+			})
+
+			imdsClient := &fakeIMDSClient{
+				accessToken:    accessToken,
+				accessTokenErr: tc.challengeResponseErr,
+				signingCert:    instanceCert,
+				signingKey:     instanceKey,
+				subscription:   tc.tokenSubscription,
+				vmID:           tc.tokenVMID,
+			}
+
+			t.Run("legacy", func(t *testing.T) {
+				// Try to join via the legacy join service.
+				_, err = joinclient.LegacyJoin(ctx, joinclient.JoinParams{
+					Token:      tc.requestTokenName,
+					JoinMethod: types.JoinMethodAzure,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance,
+						HostUUID: "testuuid",
+					},
+					AuthClient: nopClient,
+					AzureParams: joinclient.AzureParams{
+						ClientID:   tc.tokenVMID,
+						IMDSClient: imdsClient,
+					},
+				})
+				tc.assertError(t, err)
+			})
+			t.Run("new", func(t *testing.T) {
+				// Try to join via the new join service.
+				_, err = joinclient.Join(ctx, joinclient.JoinParams{
+					Token: tc.requestTokenName,
+					ID: state.IdentityID{
+						Role: types.RoleInstance,
+					},
+					AuthClient: nopClient,
+					AzureParams: joinclient.AzureParams{
+						ClientID:         tc.tokenVMID,
+						IMDSClient:       imdsClient,
+						IssuerHTTPClient: httpClient,
+					},
+				})
+				tc.assertError(t, err)
+			})
+			t.Run("bot", func(t *testing.T) {
+				// Try to join as a bot.
+				tokenSpec := tc.tokenSpec
+				tokenSpec.BotName = botName
+				tokenSpec.Roles = types.SystemRoles{types.RoleBot}
+				token, err := types.NewProvisionTokenFromSpec(
+					"test-token",
+					time.Now().Add(time.Minute),
+					tokenSpec)
+				require.NoError(t, err)
+				require.NoError(t, a.UpsertToken(ctx, token))
+
+				result, err := joinclient.Join(ctx, joinclient.JoinParams{
+					Token: tc.requestTokenName,
+					ID: state.IdentityID{
+						Role: types.RoleBot,
+					},
+					AuthClient: nopClient,
+					AzureParams: joinclient.AzureParams{
+						ClientID:         tc.tokenVMID,
+						IMDSClient:       imdsClient,
+						IssuerHTTPClient: httpClient,
+					},
+				})
+				tc.assertError(t, err)
+				if err != nil {
+					return
+				}
+
+				cert, err := tlsca.ParseCertificatePEM(result.Certs.TLS)
+				require.NoError(t, err)
+				identity, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
+				require.NoError(t, err)
+
+				// Make sure the LoginIP was set on the identity.
+				require.NotEmpty(t, identity.LoginIP)
+
+				// Make sure the JoinAttributes were set.
+				require.NotNil(t, identity.JoinAttributes)
+				require.NotNil(t, identity.JoinAttributes.Azure)
+				require.Equal(t, tc.tokenSubscription, identity.JoinAttributes.Azure.Subscription)
+			})
+		})
+	}
+}
+
+func TestAzureIssuerCert(t *testing.T) {
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		}})
+	require.NoError(t, err)
+	a := server.Auth()
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpec("testtoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		JoinMethod: types.JoinMethodAzure,
+		Roles:      types.SystemRoles{types.RoleNode},
+		Azure: &types.ProvisionTokenSpecV2Azure{
+			Allow: []*types.ProvisionTokenSpecV2Azure_Rule{
+				{
+					Subscription: "testsubscription",
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, a.UpsertToken(t.Context(), token))
+
+	caChain := newFakeAzureCAChain(t)
+
+	instanceKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	instanceID := vmResourceID("testsubscription", "testgroup", "testid")
+
+	accessToken, err := makeToken(instanceID, instanceID, a.GetClock().Now())
+	require.NoError(t, err)
+
+	defaultSubscription := uuid.NewString()
+	defaultResourceGroup := "my-resource-group"
+	defaultVMName := "test-vm"
+	defaultVMID := "my-vm-id"
+	defaultVMResourceID := vmResourceID(defaultSubscription, defaultResourceGroup, defaultVMName)
+	vmClient := &mockAzureVMClient{
+		vms: map[string]*azure.VirtualMachine{
+			defaultVMResourceID: {
+				ID:            defaultVMResourceID,
+				Name:          defaultVMName,
+				Subscription:  defaultSubscription,
+				ResourceGroup: defaultResourceGroup,
+				VMID:          defaultVMID,
+			},
+		},
+	}
+	getVMClient := makeVMClientGetter(map[string]*mockAzureVMClient{
+		defaultSubscription: vmClient,
+	})
+
+	isAccessDenied := func(t require.TestingT, err error, msgAndArgs ...any) {
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError), msgAndArgs...)
+	}
+	for _, tc := range []struct {
+		desc                      string
+		commonName                string
+		issuerURL                 string
+		errorAssertion            require.ErrorAssertionFunc
+		expecteRequestedIssuingCA bool
+	}{
+		{
+			desc:                      "passing",
+			commonName:                "instance.metadata.azure.com",
+			issuerURL:                 "http://www.microsoft.com/pkiops/certs/testca.crt",
+			errorAssertion:            require.NoError,
+			expecteRequestedIssuingCA: true,
+		},
+		{
+			desc:       "bad common name",
+			commonName: "instance.metadata.bad.example.com",
+			issuerURL:  "http://www.microsoft.com/pkiops/certs/testca.crt",
+			errorAssertion: func(t require.TestingT, err error, msgAndArgs ...any) {
+				isAccessDenied(t, err, msgAndArgs...)
+				require.ErrorContains(t, err, "certificate common name does not match allow-list")
+			},
+		},
+		{
+			desc:       "bad issuer host",
+			commonName: "instance.metadata.azure.com",
+			issuerURL:  "http://www.bad.example.com/pkiops/certs/testca.crt",
+			errorAssertion: func(t require.TestingT, err error, msgAndArgs ...any) {
+				isAccessDenied(t, err, msgAndArgs...)
+				require.ErrorContains(t, err, "validating issuing certificate URL")
+				require.ErrorContains(t, err, "invalid host")
+			},
+		},
+		{
+			desc:       "bad cert path",
+			commonName: "instance.metadata.azure.com",
+			issuerURL:  "http://www.microsoft.com/pkiops/badcerts/badca.crt",
+			errorAssertion: func(t require.TestingT, err error, msgAndArgs ...any) {
+				isAccessDenied(t, err, msgAndArgs...)
+				require.ErrorContains(t, err, "validating issuing certificate URL")
+				require.ErrorContains(t, err, "invalid path")
+			},
+		},
+		{
+			desc:       "bad url scheme",
+			commonName: "instance.metadata.azure.com",
+			issuerURL:  "bad://www.microsoft.com/pkiops/certs/testca.crt",
+			errorAssertion: func(t require.TestingT, err error, msgAndArgs ...any) {
+				isAccessDenied(t, err, msgAndArgs...)
+				require.ErrorContains(t, err, "validating issuing certificate URL")
+				require.ErrorContains(t, err, "invalid url scheme")
+			},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			// Generate an azure instance cert with the common name and issuer URL for the testcase.
+			instanceCert := caChain.issueLeafCert(t, instanceKey.Public(), tc.commonName, tc.issuerURL)
+			imdsClient := &fakeIMDSClient{
+				accessToken:  accessToken,
+				signingCert:  instanceCert,
+				signingKey:   instanceKey,
+				subscription: "testsubscription",
+				vmID:         instanceID,
+			}
+
+			// Fake the HTTP client used to fetch the issuer CA.
+			httpClient := newFakeAzureIssuerHTTPClient(caChain.intermediateCertDER)
+			a.SetAzureJoinConfig(&azurejoin.AzureJoinConfig{
+				CertificateAuthorities: []*x509.Certificate{caChain.rootCert},
+				Verify:                 mockVerifyToken(nil),
+				GetVMClient:            getVMClient,
+				IssuerHTTPClient:       httpClient,
+			})
+
+			// Join via the legacy join service.
+			_, err = joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+				Token:      "testtoken",
+				JoinMethod: types.JoinMethodAzure,
+				ID: state.IdentityID{
+					Role:     types.RoleInstance,
+					HostUUID: "testuuid",
+				},
+				AuthClient: nopClient,
+				AzureParams: joinclient.AzureParams{
+					ClientID:   instanceID,
+					IMDSClient: imdsClient,
+				},
+			})
+			tc.errorAssertion(t, err)
+
+			if tc.expecteRequestedIssuingCA {
+				require.Equal(t, 1, httpClient.called, "expected issuing CA to be requested once")
+			} else {
+				require.Equal(t, 0, httpClient.called, "expected issuing CA not to be requested")
+			}
+		})
+	}
+}
+
+type fakeIMDSClient struct {
+	accessToken    string
+	accessTokenErr error
+
+	// overrideChallenge overrides the challenge/nonce included in attested data.
+	overrideChallenge string
+	signingCert       *x509.Certificate
+	signingKey        crypto.Signer
+	subscription      string
+	vmID              string
+}
+
+func (c *fakeIMDSClient) IsAvailable(_ context.Context) bool {
+	return true
+}
+
+func (c *fakeIMDSClient) GetAttestedData(_ context.Context, nonce string) ([]byte, error) {
+	ad := azurejoin.AttestedData{
+		Nonce:          nonce,
+		SubscriptionID: c.subscription,
+		ID:             c.vmID,
+	}
+	if c.overrideChallenge != "" {
+		ad.Nonce = c.overrideChallenge
+	}
+	adBytes, err := json.Marshal(&ad)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	s, err := pkcs7.NewSignedData(adBytes)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := s.AddSigner(c.signingCert, c.signingKey, pkcs7.SignerInfoConfig{}); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	signature, err := s.Finish()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	signedAD := azurejoin.SignedAttestedData{
+		Encoding:  "pkcs7",
+		Signature: base64.StdEncoding.EncodeToString(signature),
+	}
+	signedADBytes, err := json.Marshal(&signedAD)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return signedADBytes, nil
+}
+
+func (c *fakeIMDSClient) GetAccessToken(_ context.Context, clientID string) (string, error) {
+	return c.accessToken, trace.Wrap(c.accessTokenErr)
+}
+
+type fakeAzureCAChain struct {
+	intermediateKey     crypto.Signer
+	intermediateCert    *x509.Certificate
+	intermediateCertDER []byte
+	rootCert            *x509.Certificate
+}
+
+func newFakeAzureCAChain(t *testing.T) *fakeAzureCAChain {
+	rootKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	rootCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "test root CA",
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageCertSign,
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+	}
+	rootCertDER, err := x509.CreateCertificate(rand.Reader, rootCertTemplate, rootCertTemplate, rootKey.Public(), rootKey)
+	require.NoError(t, err)
+	rootCert, err := x509.ParseCertificate(rootCertDER)
+	require.NoError(t, err)
+
+	intermediateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	intermediateCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "test intermediate CA",
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageCertSign,
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+	}
+	intermediateCertDER, err := x509.CreateCertificate(rand.Reader, intermediateCertTemplate, rootCert, intermediateKey.Public(), rootKey)
+	require.NoError(t, err)
+	intermediateCert, err := x509.ParseCertificate(intermediateCertDER)
+	require.NoError(t, err)
+
+	return &fakeAzureCAChain{
+		intermediateKey:     intermediateKey,
+		intermediateCert:    intermediateCert,
+		intermediateCertDER: intermediateCertDER,
+		rootCert:            rootCert,
+	}
+}
+
+func (c *fakeAzureCAChain) issueLeafCert(t *testing.T, pub crypto.PublicKey, commonName, issuerURL string) *x509.Certificate {
+	leafCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: commonName,
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		IssuingCertificateURL: []string{issuerURL},
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		BasicConstraintsValid: true,
+	}
+	leafCertDER, err := x509.CreateCertificate(rand.Reader, leafCertTemplate, c.intermediateCert, pub, c.intermediateKey)
+	require.NoError(t, err)
+	leafCert, err := x509.ParseCertificate(leafCertDER)
+	require.NoError(t, err)
+	return leafCert
+}
+
+type fakeAzureIssuerHTTPClient struct {
+	issuerCertDER []byte
+	called        int
+}
+
+func newFakeAzureIssuerHTTPClient(issuerCertDER []byte) *fakeAzureIssuerHTTPClient {
+	return &fakeAzureIssuerHTTPClient{
+		issuerCertDER: issuerCertDER,
+	}
+}
+func (c *fakeAzureIssuerHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	c.called++
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(bytes.NewReader(c.issuerCertDER)),
+	}, nil
+}
diff --git a/lib/join/bitbucket/bitbucket.go b/lib/join/bitbucket/bitbucket.go
new file mode 100644
index 0000000000000..aeeae00bb5590
--- /dev/null
+++ b/lib/join/bitbucket/bitbucket.go
@@ -0,0 +1,182 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bitbucket
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "bitbucket")
+
+// Validator is a validator for Bitbucket OIDC tokens.
+type Validator interface {
+	Validate(
+		ctx context.Context, idpURL, audience, token string,
+	) (*IDTokenClaims, error)
+}
+
+// IDTokenClaims
+// See the following for the structure:
+// https://support.atlassian.com/bitbucket-cloud/docs/integrate-pipelines-with-resource-servers-using-oidc/
+type IDTokenClaims struct {
+	oidc.TokenClaims
+
+	// Sub provides some information about the Bitbucket Pipelines run that
+	// generated this token. Format: {RepositoryUUID}:{StepUUID}
+	Sub string `json:"sub"`
+
+	// StepUUID is the UUID of the pipeline step for which this token was
+	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'
+	StepUUID string `json:"stepUuid"`
+
+	// RepositoryUUID is the UUID of the repository for which this token was
+	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'.
+	// This value may be found in the Pipelines -> OpenID Connect section of the
+	// repository settings.
+	RepositoryUUID string `json:"repositoryUuid"`
+
+	// PipelineUUID is the UUID of the pipeline for which this token was issued.
+	// Bitbucket UUIDs must begin and end with braces, e.g. '{...}'
+	PipelineUUID string `json:"pipelineUuid"`
+
+	// WorkspaceUUID is the UUID of the workspace for which this token was
+	// issued. Bitbucket UUIDs must begin and end with braces, e.g. '{...}'.
+	// This value may be found in the Pipelines -> OpenID Connect section of the
+	// repository settings.
+	WorkspaceUUID string `json:"workspaceUuid"`
+
+	// DeploymentEnvironmentUUID is the name of the deployment environment for
+	// which this pipeline was executed. Bitbucket UUIDs must begin and end with
+	// braces, e.g. '{...}'.
+	DeploymentEnvironmentUUID string `json:"deploymentEnvironmentUuid"`
+
+	// BranchName is the name of the branch on which this pipeline executed.
+	BranchName string `json:"branchName"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsBitbucket {
+	return &workloadidentityv1pb.JoinAttrsBitbucket{
+		Sub:                       c.Sub,
+		StepUuid:                  c.StepUUID,
+		RepositoryUuid:            c.RepositoryUUID,
+		PipelineUuid:              c.PipelineUUID,
+		WorkspaceUuid:             c.WorkspaceUUID,
+		DeploymentEnvironmentUuid: c.DeploymentEnvironmentUUID,
+		BranchName:                c.BranchName,
+	}
+}
+
+// CheckIDTokenParams are parameters used to validate Bitbucket OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Clock          clockwork.Clock
+	Validator      Validator
+}
+
+func (p *CheckIDTokenParams) checkAndSetDefaults() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	case p.Clock == nil:
+		p.Clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// CheckIDToken validates a Bitbucket OIDC token, verifying both the validity of
+// the OIDC token itself, as well as ensuring claims match any configured allow
+// rules in the provided provision token.
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*IDTokenClaims, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("bitbucket join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	claims, err := params.Validator.Validate(
+		ctx, token.Spec.Bitbucket.IdentityProviderURL, token.Spec.Bitbucket.Audience, string(params.IDToken),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	log.InfoContext(ctx, "Bitbucket run trying to join cluster",
+		"claims", claims,
+		"token", params.ProvisionToken.GetName(),
+	)
+
+	return claims, trace.Wrap(checkBitbucketAllowRules(token, claims))
+}
+
+func checkBitbucketAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	// If a single rule passes, accept the IDToken
+	for _, rule := range token.Spec.Bitbucket.Allow {
+		// Please consider keeping these field validators in the same order they
+		// are defined within the ProvisionTokenSpecV2Bitbucket proto spec.
+
+		if rule.WorkspaceUUID != "" && claims.WorkspaceUUID != rule.WorkspaceUUID {
+			continue
+		}
+
+		if rule.RepositoryUUID != "" && claims.RepositoryUUID != rule.RepositoryUUID {
+			continue
+		}
+
+		if rule.DeploymentEnvironmentUUID != "" && claims.DeploymentEnvironmentUUID != rule.DeploymentEnvironmentUUID {
+			continue
+		}
+
+		if rule.BranchName != "" && claims.BranchName != rule.BranchName {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/bitbucket/token_source.go b/lib/join/bitbucket/token_source.go
similarity index 100%
rename from lib/bitbucket/token_source.go
rename to lib/join/bitbucket/token_source.go
diff --git a/lib/bitbucket/token_source_test.go b/lib/join/bitbucket/token_source_test.go
similarity index 100%
rename from lib/bitbucket/token_source_test.go
rename to lib/join/bitbucket/token_source_test.go
diff --git a/lib/bitbucket/token_validator.go b/lib/join/bitbucket/token_validator.go
similarity index 100%
rename from lib/bitbucket/token_validator.go
rename to lib/join/bitbucket/token_validator.go
diff --git a/lib/bitbucket/token_validator_test.go b/lib/join/bitbucket/token_validator_test.go
similarity index 100%
rename from lib/bitbucket/token_validator_test.go
rename to lib/join/bitbucket/token_validator_test.go
diff --git a/lib/join/boundkeypair/boundkeypair.go b/lib/join/boundkeypair/boundkeypair.go
new file mode 100644
index 0000000000000..f58c11d472849
--- /dev/null
+++ b/lib/join/boundkeypair/boundkeypair.go
@@ -0,0 +1,983 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package boundkeypair
+
+import (
+	"context"
+	"crypto"
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/boundkeypair"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/jwt"
+	"github.com/gravitational/teleport/lib/services/readonly"
+	libsshutils "github.com/gravitational/teleport/lib/sshutils"
+)
+
+type BoundKeypairValidator interface {
+	IssueChallenge() (*boundkeypair.ChallengeDocument, error)
+	ValidateChallengeResponse(issued *boundkeypair.ChallengeDocument, compactResponse string) error
+}
+
+type CreateBoundKeypairValidator func(subject string, clusterName string, publicKey crypto.PublicKey) (BoundKeypairValidator, error)
+
+// issueBoundKeypairChallenge creates a new challenge for the given marshaled
+// public key in ssh authorized_keys format, requests a solution from the
+// client using the given `challengeResponse` function, and validates the
+// response.
+func issueBoundKeypairChallenge(
+	ctx context.Context,
+	params *JoinParams,
+	marshaledKey string,
+) error {
+	key, err := libsshutils.CryptoPublicKey([]byte(marshaledKey))
+	if err != nil {
+		return trace.Wrap(err, "parsing bound public key")
+	}
+
+	// The particular subject value doesn't strictly need to be the name of the
+	// bot or node (which may not be known, yet). Instead, we'll use the key ID,
+	// which could at least be useful for the client to know which key the
+	// challenge should be signed with.
+	keyID, err := jwt.KeyID(key)
+	if err != nil {
+		return trace.Wrap(err, "determining the key ID")
+	}
+
+	clusterName, err := params.AuthService.GetClusterName(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	params.Logger.DebugContext(ctx, "issuing bound keypair challenge", "key_id", keyID)
+
+	validator, err := params.CreateBoundKeypairValidator(keyID, clusterName.GetClusterName(), key)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	challenge, err := validator.IssueChallenge()
+	if err != nil {
+		return trace.Wrap(err, "generating a challenge document")
+	}
+
+	marshalledChallenge, err := json.Marshal(challenge)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	solution, err := params.IssueChallenge(&messages.BoundKeypairChallenge{
+		PublicKey: []byte(marshaledKey),
+		Challenge: string(marshalledChallenge),
+	})
+	if err != nil {
+		return trace.Wrap(err, "requesting a signed challenge")
+	}
+
+	if err := validator.ValidateChallengeResponse(
+		challenge,
+		string(solution.Solution),
+	); err != nil {
+		// TODO: Consider access denied instead?
+		return trace.Wrap(err, "validating challenge response")
+	}
+
+	params.Logger.InfoContext(ctx, "bound keypair challenge response verified successfully", "key_id", keyID)
+
+	return nil
+}
+
+// shouldRequestBoundKeypairRotation determines if a keypair rotation should be
+// requested given configured token field values.
+func shouldRequestBoundKeypairRotation(rotateAfter, lastRotatedAt *time.Time, now time.Time) bool {
+	if rotateAfter == nil {
+		// Field not set, nothing to do.
+		return false
+	}
+
+	if rotateAfter.After(now) {
+		// We haven't reached the rotation threshold, nothing to do.
+		return false
+	}
+
+	if lastRotatedAt == nil {
+		// There has not been a previous rotation, so rotate now.
+		return true
+	}
+
+	// Otherwise, rotate only if a rotation hasn't already taken place, i.e.
+	// `lastRotatedAt` is before the requested timestamp
+	return lastRotatedAt.Before(*rotateAfter)
+}
+
+// ensurePublicKeysNotEqual ensures the two public keys, in ssh authorized_keys
+// format, are parseable public keys and are not equal to one another. This can
+// be used to validate that clients actually provided a new key after receiving
+// a rotation request.
+func ensurePublicKeysNotEqual(a, b string) error {
+	aParsed, err := libsshutils.CryptoPublicKey([]byte(a))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	aEq, ok := aParsed.(interface {
+		Equal(x crypto.PublicKey) bool
+	})
+	if !ok {
+		return trace.BadParameter("invalid public key type %T", aParsed)
+	}
+
+	bParsed, err := libsshutils.CryptoPublicKey([]byte(b))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if aEq.Equal(bParsed) {
+		return trace.BadParameter("public key may not be reused after rotation")
+	}
+
+	return nil
+}
+
+// requestBoundKeypairRotation requests that clients generate a new keypair and
+// send the public key, then issues a signing challenge to ensure ownership of
+// the new key.
+func requestBoundKeypairRotation(
+	ctx context.Context,
+	params *JoinParams,
+) (string, error) {
+	cap, err := params.AuthService.GetAuthPreference(ctx)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	params.Logger.InfoContext(ctx, "requesting bound keypair rotation", "suite", cap.GetSignatureAlgorithmSuite())
+
+	// Request a new marshaled public key from the client.
+	algoSuite := types.SignatureAlgorithmSuiteToString(cap.GetSignatureAlgorithmSuite())
+	rotationResponse, err := params.IssueRotationRequest(&messages.BoundKeypairRotationRequest{
+		SignatureAlgorithmSuite: algoSuite,
+	})
+	if err != nil {
+		return "", trace.Wrap(err, "requesting a new public key")
+	}
+
+	// Issue a challenge against this new key to ensure ownership.
+	pubKey := string(rotationResponse.PublicKey)
+	if err := issueBoundKeypairChallenge(ctx, params, pubKey); err != nil {
+		return "", trace.Wrap(err, "solving challenge for new public key")
+	}
+
+	return pubKey, nil
+}
+
+// boundKeypairStatusMutator is a function called to mutate a bound keypair
+// status during a call to PatchProvisionToken(). These functions may be called
+// repeatedly if e.g. revision checks fail. To ensure invariants remain in
+// place, mutator functions may make assertions to ensure the provided backend
+// state is still sane before the update is committed.
+type boundKeypairStatusMutator func(*types.ProvisionTokenSpecV2BoundKeypair, *types.ProvisionTokenStatusV2BoundKeypair) error
+
+// mutateStatusConsumeRecovery consumes a "hard" join on the backend, incrementing
+// the recovery counter. This verifies that the backend recovery count has not
+// changed, and that total join count is at least the value when the mutator was
+// created.
+func mutateStatusConsumeRecovery(expectRecoveryCount uint32, expectMinRecoveryLimit uint32) boundKeypairStatusMutator {
+	now := time.Now()
+
+	return func(spec *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
+		// Ensure we have the expected number of rejoins left to prevent going
+		// below zero.
+		if status.RecoveryCount != expectRecoveryCount {
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		// Ensure the allowed join count has at least not decreased, but allow
+		// for collision with potentially increased values.
+		if spec.Recovery.Limit < expectMinRecoveryLimit {
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		status.RecoveryCount += 1
+		status.LastRecoveredAt = &now
+
+		return nil
+	}
+}
+
+// mutateStatusBoundPublicKey is a mutator that updates the bound public key
+// value. It ensures the backend public key is still the expected value before
+// performing the update.
+func mutateStatusBoundPublicKey(newPublicKey, expectPreviousKey string) boundKeypairStatusMutator {
+	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
+		if status.BoundPublicKey != expectPreviousKey {
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		status.BoundPublicKey = newPublicKey
+
+		return nil
+	}
+}
+
+// mutateStatusBoundBotInstance updates the bot instance ID currently bound to
+// this token. It ensures the expected previous ID is still the bound value
+// before performing the update.
+func mutateStatusBoundBotInstance(newBotInstance, expectPreviousBotInstance string) boundKeypairStatusMutator {
+	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
+		if status.BoundBotInstanceID != expectPreviousBotInstance {
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		status.BoundBotInstanceID = newBotInstance
+
+		return nil
+	}
+}
+
+// mutateStatusLastRotatedAt updates the `status.LastRotatedAt` field to
+// indicate a keypair rotation has taken place. It ensures the previous value
+// has not changed before performing the update.
+func mutateStatusLastRotatedAt(newValue, expectPrevValue *time.Time) boundKeypairStatusMutator {
+	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
+		switch {
+		case expectPrevValue == nil && status.LastRotatedAt == nil:
+			// no issue
+		case expectPrevValue != nil && status.LastRotatedAt == nil:
+			fallthrough
+		case expectPrevValue == nil && status.LastRotatedAt != nil:
+			fallthrough
+		case !expectPrevValue.Equal(*status.LastRotatedAt):
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		status.LastRotatedAt = newValue
+
+		return nil
+	}
+}
+
+// mutateStatusClearRegistrationSecret clears the registration secret field to
+// prevent further join attempts using this secret.
+func mutateStatusClearRegistrationSecret(oldValue string) boundKeypairStatusMutator {
+	return func(_ *types.ProvisionTokenSpecV2BoundKeypair, status *types.ProvisionTokenStatusV2BoundKeypair) error {
+		if status.RegistrationSecret != oldValue {
+			return trace.AccessDenied("unexpected backend state")
+		}
+
+		status.RegistrationSecret = ""
+		return nil
+	}
+}
+
+// formatTimePointer stringifies a *time.Time for logging, but gracefully
+// handles nil values.
+func formatTimePointer(t *time.Time) string {
+	if t == nil {
+		return "nil"
+	}
+
+	return t.String()
+}
+
+// emitBoundKeypairRecoveryEvent emits an audit event indicating a bound keypair
+// token was used to recover a bot.
+func emitBoundKeypairRecoveryEvent(
+	ctx context.Context,
+	params *JoinParams,
+	token *types.ProvisionTokenV2,
+	boundPublicKey string,
+	recoveryCount uint32,
+	err error,
+) {
+	var status apievents.Status
+	if err == nil {
+		status = apievents.Status{
+			Success: true,
+		}
+	} else {
+		status = apievents.Status{
+			Success: false,
+			Error:   err.Error(),
+		}
+	}
+
+	if err := params.AuthService.EmitAuditEvent(context.WithoutCancel(ctx), &apievents.BoundKeypairRecovery{
+		Metadata: apievents.Metadata{
+			Type: events.BoundKeypairRecovery,
+			Code: events.BoundKeypairRecoveryCode,
+		},
+		Status: status,
+		ConnectionMetadata: apievents.ConnectionMetadata{
+			RemoteAddr: params.Diag.Get().RemoteAddr,
+		},
+		TokenName:     token.GetName(),
+		BotName:       token.GetBotName(),
+		PublicKey:     boundPublicKey,
+		RecoveryCount: recoveryCount,
+		RecoveryMode:  token.Spec.BoundKeypair.Recovery.Mode,
+	}); err != nil {
+		params.Logger.WarnContext(ctx, "Failed to emit failed bound keypair recovery event", "error", err)
+	}
+}
+
+// emitBoundKeypairRotationEvent emits an audit event indicating a bound keypair
+// rotation occurred.
+func emitBoundKeypairRotationEvent(
+	ctx context.Context,
+	params *JoinParams,
+	token *types.ProvisionTokenV2,
+	prevPublicKey, newPublicKey string,
+	err error,
+) {
+	var status apievents.Status
+	if err == nil {
+		status = apievents.Status{
+			Success: true,
+		}
+	} else {
+		status = apievents.Status{
+			Success: false,
+			Error:   err.Error(),
+		}
+	}
+
+	if err := params.AuthService.EmitAuditEvent(context.WithoutCancel(ctx), &apievents.BoundKeypairRotation{
+		Metadata: apievents.Metadata{
+			Type: events.BoundKeypairRotation,
+			Code: events.BoundKeypairRotationCode,
+		},
+		Status: status,
+		ConnectionMetadata: apievents.ConnectionMetadata{
+			RemoteAddr: params.Diag.Get().RemoteAddr,
+		},
+		TokenName:         token.GetName(),
+		BotName:           token.GetBotName(),
+		PreviousPublicKey: prevPublicKey,
+		NewPublicKey:      newPublicKey,
+	}); err != nil {
+		params.Logger.WarnContext(ctx, "Failed to emit failed bound keypair rotation event", "error", err)
+	}
+}
+
+func tryLockBotInvalidJoinState(
+	ctx context.Context,
+	params *JoinParams,
+	ptv2 *types.ProvisionTokenV2,
+	validationError error,
+) {
+	log := params.Logger.With("join_token", ptv2.GetName(), "validation_error", validationError)
+
+	if auditErr := params.AuthService.EmitAuditEvent(context.WithoutCancel(ctx), &apievents.BoundKeypairJoinStateVerificationFailed{
+		Metadata: apievents.Metadata{
+			Type: events.BoundKeypairJoinStateVerificationFailed,
+			Code: events.BoundKeypairJoinStateVerificationFailedCode,
+		},
+		Status: apievents.Status{
+			Success: false,
+			Error:   validationError.Error(),
+		},
+		ConnectionMetadata: apievents.ConnectionMetadata{
+			RemoteAddr: params.Diag.Get().RemoteAddr,
+		},
+		TokenName: ptv2.GetName(),
+		BotName:   ptv2.GetBotName(),
+	}); auditErr != nil {
+		log.WarnContext(ctx, "Failed to emit failed join state verification event", "error", auditErr)
+	}
+
+	// Create a lock against this token.
+	lock, err := types.NewLock(uuid.New().String(), types.LockSpecV2{
+		Target: types.LockTarget{
+			JoinToken: ptv2.GetName(),
+		},
+		Message: fmt.Sprintf(
+			"The join token %q has been locked by bot %q after a client "+
+				"failed to verify its join state, possibly indicating a "+
+				"stolen keypair.",
+			ptv2.GetName(), ptv2.GetBotName(),
+		),
+		CreatedAt: params.Clock.Now(),
+	})
+	if err != nil {
+		params.Logger.ErrorContext(ctx, "Unable to create lock for bound keypair token")
+		return
+	}
+	if err := params.AuthService.UpsertLock(ctx, lock); err != nil {
+		log.ErrorContext(ctx, "Unable to create lock for bound keypair token after join state verification failed")
+	}
+}
+
+// verifyBoundKeypairJoinState verifies the client's provided join state
+// document if the current state of the token indicates the join state must be
+// verified. If verification is required and fails, this returns an error and
+// locks the token until a cluster admin can ensure the token hasn't been
+// compromised. If verification is not required, this is a no-op. Join state
+// should be verified whenever a client rejoins, but only after they have proven
+// ownership of their private key.
+func verifyBoundKeypairJoinState(
+	ctx context.Context,
+	params *JoinParams,
+	ptv2 *types.ProvisionTokenV2,
+	ca types.CertAuthority,
+) (previousBotInstnceID string, err error) {
+	recoveryMode, err := boundkeypair.ParseRecoveryMode(ptv2.Spec.BoundKeypair.Recovery.Mode)
+	if err != nil {
+		return "", trace.Wrap(err, "parsing recovery mode")
+	}
+
+	// Join state is required after the initial join (first recovery), so long
+	// as the mode is not insecure.
+	// Note: we don't verify join state if it isn't expected. This is partly
+	// to ensure server-side recovery will work if join state desyncs - a
+	// cluster admin can change the recovery mode to insecure or reset the
+	// recovery counter to zero and start over with a fresh join state, with
+	// no client intervention.
+	joinStateRequired := ptv2.Status.BoundKeypair.RecoveryCount > 0 && recoveryMode != boundkeypair.RecoveryModeInsecure
+	if !joinStateRequired {
+		params.Logger.DebugContext(
+			ctx,
+			"skipping join state verification, not required due to token state",
+			"recovery_count", ptv2.Status.BoundKeypair.RecoveryCount,
+			"recovery_mode", ptv2.Spec.BoundKeypair.Recovery.Mode,
+		)
+		return "", nil
+	}
+
+	// If join state is required but missing, raise an error.
+	hasIncomingJoinState := len(params.BoundKeypairInit.PreviousJoinState) > 0
+	if !hasIncomingJoinState {
+		return "", trace.AccessDenied("previous join state is required but was not provided")
+	}
+
+	params.Logger.DebugContext(ctx, "join state verification required, verifying")
+	joinState, err := boundkeypair.VerifyJoinState(
+		ca,
+		string(params.BoundKeypairInit.PreviousJoinState),
+		&boundkeypair.JoinStateParams{
+			Clock:       params.Clock,
+			ClusterName: ca.GetClusterName(), // equivalent to clusterName but saves a method param
+			Token:       ptv2,
+		},
+	)
+	if err != nil {
+		params.Logger.ErrorContext(ctx, "bound keypair join state verification failed", "error", err)
+		tryLockBotInvalidJoinState(ctx, params, ptv2, err)
+
+		return "", trace.AccessDenied("join state verification failed")
+	}
+
+	params.Logger.DebugContext(ctx, "join state verified successfully", "join_state", joinState)
+	// Now that we've verified it, return the previous bot instance ID.
+	return joinState.BotInstanceID, nil
+}
+
+// verifyLocksForBoundKeypairToken checks if any token-level locks are in place
+// against the given token.  This should ideally be called after the request has
+// been authenticated (exact criteria varies depending on token state) but
+// before the request has mutated anything on the server - including creation of
+// additional locks: we don't want to allow continuous lock creation.
+func verifyLocksForBoundKeypairToken(ctx context.Context, params *JoinParams, token *types.ProvisionTokenV2) error {
+	readOnlyAuthPref, err := params.AuthService.GetReadOnlyAuthPreference(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(params.AuthService.CheckLockInForce(
+		readOnlyAuthPref.GetLockingMode(),
+		[]types.LockTarget{{JoinToken: token.GetName()}},
+	))
+}
+
+// JoinParams holds all parameters necessary to handle a bound keypair join attempt.
+type JoinParams struct {
+	// AuthService is the auth service.
+	AuthService AuthService
+	// AuthCtx is authentication context for the request, relevant for re-join attempts.
+	AuthCtx *authz.Context
+	// Diag is the join attempt diagnostic.
+	Diag *diagnostic.Diagnostic
+	// ProvisionToken is the provision token used for the join attempt.
+	ProvisionToken provision.Token
+	// ClientInit is the ClientInit message sent by the joining client.
+	ClientInit *messages.ClientInit
+	// BoundKeypairInit is the BoundKeypairInit message sent by the joining client.
+	BoundKeypairInit *messages.BoundKeypairInit
+	// IssueChallenge sends a challenge to the joining client and returns the
+	// response.
+	IssueChallenge ChallengeResponseFunc
+	// IssueRotationRequest sends a rotation request to the joining client and
+	// returns the response.
+	IssueRotationRequest RotationFunc
+	// CreateBoundKeypairValidator is a function that creates a bound keypair
+	// validator, used to override the validator in tests.
+	CreateBoundKeypairValidator CreateBoundKeypairValidator
+	// GenerateBotCerts is a function that generates bot certificates.
+	GenerateBotCerts func(ctx context.Context, previousBotInstanceID string, claims any) (*messages.Certificates, string, error)
+	// Clock is the clock.
+	Clock clockwork.Clock
+	// Logger is a logger.
+	Logger *slog.Logger
+}
+
+// ChallengeResponseFunc is function that sends a bound keypair challenge and
+// returns the response.
+type ChallengeResponseFunc func(*messages.BoundKeypairChallenge) (*messages.BoundKeypairChallengeSolution, error)
+
+// RotationFunc is function that sends a bound keypair rotation request and
+// returns the response.
+type RotationFunc func(*messages.BoundKeypairRotationRequest) (*messages.BoundKeypairRotationResponse, error)
+
+func (p *JoinParams) checkAndSetDefaults() error {
+	switch {
+	case p.AuthService == nil:
+		return trace.BadParameter("AuthService is required")
+	case p.AuthCtx == nil:
+		return trace.BadParameter("AuthCtx is required")
+	case p.Diag == nil:
+		return trace.BadParameter("Diag is required")
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case p.ClientInit == nil:
+		return trace.BadParameter("ClientInit is required")
+	case p.BoundKeypairInit == nil:
+		return trace.BadParameter("BoundKeypairInit is required")
+	case p.IssueChallenge == nil:
+		return trace.BadParameter("IssueChallenge is required")
+	case p.IssueRotationRequest == nil:
+		return trace.BadParameter("IssueRotationRequest is required")
+	case p.Logger == nil:
+		return trace.BadParameter("Logger is required")
+	}
+	if p.CreateBoundKeypairValidator == nil {
+		p.CreateBoundKeypairValidator = func(subject string, clusterName string, publicKey crypto.PublicKey) (BoundKeypairValidator, error) {
+			return boundkeypair.NewChallengeValidator(subject, clusterName, publicKey)
+		}
+	}
+	if p.Clock == nil {
+		p.Clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// AuthService is the subset of the Auth service interface required to implement bound keypair joining.
+type AuthService interface {
+	EmitAuditEvent(ctx context.Context, e apievents.AuditEvent) error
+	GetClusterName(context.Context) (types.ClusterName, error)
+	GetCertAuthority(context.Context, types.CertAuthID, bool) (types.CertAuthority, error)
+	GetKeyStore() *keystore.Manager
+	PatchToken(context.Context, string, func(types.ProvisionToken) (types.ProvisionToken, error)) (types.ProvisionToken, error)
+	GetAuthPreference(context.Context) (types.AuthPreference, error)
+	GetReadOnlyAuthPreference(context.Context) (readonly.AuthPreference, error)
+	UpsertLock(context.Context, types.Lock) error
+	CheckLockInForce(constants.LockingMode, []types.LockTarget) error
+}
+
+// HandleBoundKeypairJoin handles joining requests for the bound keypair join
+// method.
+func HandleBoundKeypairJoin(
+	ctx context.Context,
+	params *JoinParams,
+) (*messages.BotResult, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Only bot joining is supported at the moment - unique ID verification is
+	// required and this is currently only implemented for bots.
+	if types.SystemRole(params.ClientInit.SystemRole) != types.RoleBot {
+		return nil, trace.BadParameter("bound keypair joining is only supported for bots")
+	}
+
+	ptv2, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", params.ProvisionToken)
+	}
+
+	log := params.Logger.With("token", ptv2.GetName())
+
+	if ptv2.Status == nil {
+		ptv2.Status = &types.ProvisionTokenStatusV2{}
+	}
+	if ptv2.Status.BoundKeypair == nil {
+		ptv2.Status.BoundKeypair = &types.ProvisionTokenStatusV2BoundKeypair{}
+	}
+
+	clusterName, err := params.AuthService.GetClusterName(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	spec := ptv2.Spec.BoundKeypair
+	status := ptv2.Status.BoundKeypair
+	hasBoundPublicKey := status.BoundPublicKey != ""
+	hasBoundBotInstance := status.BoundBotInstanceID != ""
+	hasIncomingBotInstance := params.AuthCtx.BotInstanceID != ""
+	hasJoinsRemaining := status.RecoveryCount < spec.Recovery.Limit
+
+	recoveryMode, err := boundkeypair.ParseRecoveryMode(spec.Recovery.Mode)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing recovery mode")
+	}
+
+	// if set, the bound bot instance will be updated in the backend
+	expectNewBotInstance := false
+
+	// the bound public key; may change during initial join or rotation. used to
+	// inform the returned public key value.
+	boundPublicKey := status.BoundPublicKey
+
+	// the recovery count; this is informational and used to generate extended
+	// claims for audit log purposes. The actual enforced value is incremented
+	// by `mutateStatusConsumeRecovery`.
+	recoveryCount := status.RecoveryCount
+
+	// Mutators to use during the token resource status patch at the end.
+	var mutators []boundKeypairStatusMutator
+
+	// Get the join state JWT signer CA
+	ca, err := params.AuthService.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.BoundKeypairCA,
+		DomainName: clusterName.GetClusterName(),
+	}, /* loadKeys */ true)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var verifiedPreviousBotInstanceID string
+	switch {
+	case !hasBoundPublicKey && !hasIncomingBotInstance:
+		// Normal initial join attempt. No bound key, and no incoming bot
+		// instance. Consumes a recovery attempt.
+		if recoveryMode == boundkeypair.RecoveryModeStandard && !hasJoinsRemaining {
+			return nil, trace.AccessDenied("no recovery attempts remaining")
+		}
+
+		if spec.Onboarding.InitialPublicKey != "" {
+			// An initial public key was configured, so we can immediately ask
+			// the client to complete a challenge.
+			if err := issueBoundKeypairChallenge(
+				ctx,
+				params,
+				spec.Onboarding.InitialPublicKey,
+			); err != nil {
+				log.WarnContext(ctx, "denying initial join attempt, client failed to complete challenge", "error", err)
+				emitBoundKeypairRecoveryEvent(ctx, params, ptv2, spec.Onboarding.InitialPublicKey, 0, err)
+				return nil, trace.AccessDenied("failed to complete challenge")
+			}
+
+			// Now that we've confirmed the key, we can consider it bound.
+			mutators = append(
+				mutators,
+				mutateStatusBoundPublicKey(spec.Onboarding.InitialPublicKey, ""),
+			)
+
+			boundPublicKey = spec.Onboarding.InitialPublicKey
+		} else if status.RegistrationSecret != "" {
+			// Shared error message for all registration secret check failures.
+			const errMsg = "a valid registration secret is required"
+
+			// A registration secret is expected.
+			if params.BoundKeypairInit.InitialJoinSecret == "" {
+				log.WarnContext(ctx, "denying join attempt, client failed to provide required registration secret")
+				emitBoundKeypairRecoveryEvent(ctx, params, ptv2, "", 0, trace.AccessDenied("no registration secret was provided"))
+				return nil, trace.AccessDenied(errMsg)
+			}
+
+			if spec.Onboarding.MustRegisterBefore != nil {
+				if params.Clock.Now().After(*spec.Onboarding.MustRegisterBefore) {
+					log.WarnContext(
+						ctx,
+						"denying join attempt due to expired registration secret",
+						"must_register_before",
+						spec.Onboarding.MustRegisterBefore,
+					)
+					return nil, trace.AccessDenied(errMsg)
+				}
+			}
+
+			// Verify the secret.
+			if subtle.ConstantTimeCompare([]byte(status.RegistrationSecret), []byte(params.BoundKeypairInit.InitialJoinSecret)) != 1 {
+				log.WarnContext(ctx, "denying join attempt, client provided incorrect registration secret")
+				emitBoundKeypairRecoveryEvent(ctx, params, ptv2, "", 0, trace.AccessDenied("registration secret comparison failed"))
+				return nil, trace.AccessDenied(errMsg)
+			}
+
+			// Ask the client for a new public key.
+			newPubKey, err := requestBoundKeypairRotation(ctx, params)
+			if err != nil {
+				// Audit note: `requestBoundKeypairRotation()` will also emit an
+				// audit event.
+				emitBoundKeypairRecoveryEvent(ctx, params, ptv2, "", 0, err)
+				return nil, trace.Wrap(err, "requesting public key")
+			}
+
+			// The rotation process verifies private key ownership, so we can
+			// consider it it bound. Note that for our purposes here, this
+			// initial join will not count as a rotation.
+			mutators = append(
+				mutators,
+				mutateStatusBoundPublicKey(newPubKey, ""),
+				mutateStatusClearRegistrationSecret(status.RegistrationSecret),
+			)
+
+			boundPublicKey = newPubKey
+		} else {
+			// Audit note: this would be an implementation error, so doesn't
+			// warrant an audit event.
+			return nil, trace.BadParameter("either an initial public key or registration secret is required")
+		}
+
+		// If we reach this point, it counts as a recovery, so add a join
+		// mutator.
+		mutators = append(
+			mutators,
+			mutateStatusConsumeRecovery(status.RecoveryCount, spec.Recovery.Limit),
+		)
+
+		// Verify locks here, but only after we've tentatively authenticated the
+		// request. We don't want to leak the lock status to random
+		// unauthenticated clients, and by this point, we haven't mutated any
+		// server-side state.
+		if err := verifyLocksForBoundKeypairToken(ctx, params, ptv2); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// Note: this is the initial join, so no join state to verify.
+
+		recoveryCount += 1
+		expectNewBotInstance = true
+		emitBoundKeypairRecoveryEvent(ctx, params, ptv2, boundPublicKey, recoveryCount, nil)
+	case !hasBoundPublicKey && hasIncomingBotInstance:
+		// Not allowed, at least at the moment. This would imply e.g. trying to
+		// change auth methods.
+		return nil, trace.BadParameter("cannot perform first bound keypair join with existing credentials")
+	case hasBoundPublicKey && !hasBoundBotInstance:
+		// TODO: Bad backend state, or maybe an incomplete previous join
+		// attempt. This shouldn't be a possible state, but we should handle it
+		// sanely anyway.
+		return nil, trace.BadParameter("bad backend state, please recreate the join token")
+	case hasBoundPublicKey && hasBoundBotInstance && hasIncomingBotInstance:
+		// Standard rejoin case, does not consume a rejoin.
+		if err := issueBoundKeypairChallenge(
+			ctx,
+			params,
+			status.BoundPublicKey,
+		); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// Verify locks here now that we've verified private key ownership but
+		// before we check join state. Otherwise, we could allow a lock creation
+		// loop.
+		if err := verifyLocksForBoundKeypairToken(ctx, params, ptv2); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// Once we've verified the client has the matching private key, validate
+		// the join state. This must be done after a successful challenge to
+		// make sure an otherwise unauthorized client can't trigger a lockout.
+		// This also needs to be done before rotation to prevent an attacker
+		// from rotating the key.
+		verifiedPreviousBotInstanceID, err = verifyBoundKeypairJoinState(ctx, params, ptv2, ca)
+		if err != nil {
+			return nil, trace.AccessDenied("join state verification failed")
+		}
+
+		// Join state verification will check the instance IDs in the token and
+		// join state document, but as a sanity check, we'll also ensure it
+		// matches the value extracted from the certs.
+		//
+		// It should not be possible for this check to fail at this point, as
+		// any event that might have cycled bot instance IDs should have also
+		// modified the join state causing a failure above. In any case, we'll
+		// keep this as a sanity check.
+		if status.BoundBotInstanceID != params.AuthCtx.BotInstanceID {
+			return nil, trace.AccessDenied("bot instance mismatch")
+		}
+
+		// Nothing else to do, no key change, no additional audit event; regular
+		// bot join event will be emitted later.
+	case hasBoundPublicKey && hasBoundBotInstance && !hasIncomingBotInstance:
+		if err := issueBoundKeypairChallenge(
+			ctx,
+			params,
+			status.BoundPublicKey,
+		); err != nil {
+			emitBoundKeypairRecoveryEvent(ctx, params, ptv2, boundPublicKey, recoveryCount, err)
+			return nil, trace.Wrap(err)
+		}
+
+		// Hard rejoin case, the client identity expired and a new bot instance
+		// is required. Consumes a rejoin.
+		if recoveryMode == boundkeypair.RecoveryModeStandard && !hasJoinsRemaining {
+			// Recovery limit only applies in "standard" mode.
+			return nil, trace.AccessDenied("no rejoins remaining")
+		}
+
+		// Verify locks here now that we've verified private key ownership but
+		// before we check join state. Otherwise, we could allow a lock creation
+		// loop.
+		if err := verifyLocksForBoundKeypairToken(ctx, params, ptv2); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// As in the standard case above, once we've verified the client has the
+		// matching private key, validate the join state.
+		verifiedPreviousBotInstanceID, err = verifyBoundKeypairJoinState(ctx, params, ptv2, ca)
+		if err != nil {
+			return nil, trace.AccessDenied("join state verification failed")
+		}
+
+		mutators = append(
+			mutators,
+			mutateStatusConsumeRecovery(status.RecoveryCount, spec.Recovery.Limit),
+		)
+
+		recoveryCount += 1
+		expectNewBotInstance = true
+		emitBoundKeypairRecoveryEvent(ctx, params, ptv2, boundPublicKey, recoveryCount, nil)
+	default:
+		log.ErrorContext(
+			ctx, "unexpected state",
+			"has_bound_public_key", hasBoundPublicKey,
+			"has_bound_bot_instance", hasBoundBotInstance,
+			"has_incoming_bot_instance", hasIncomingBotInstance,
+			"spec", spec,
+			"status", status,
+		)
+		return nil, trace.BadParameter("unexpected state")
+	}
+
+	// If we've crossed a keypair rotation threshold, request one now.
+	now := params.Clock.Now()
+	if shouldRequestBoundKeypairRotation(spec.RotateAfter, status.LastRotatedAt, now) {
+		log.DebugContext(
+			ctx, "requesting keypair rotation",
+			"rotate_after", formatTimePointer(spec.RotateAfter),
+			"last_rotated_at", formatTimePointer(status.LastRotatedAt),
+		)
+		newPubKey, err := requestBoundKeypairRotation(ctx, params)
+		if err != nil {
+			emitBoundKeypairRotationEvent(ctx, params, ptv2, boundPublicKey, "", err)
+			return nil, trace.Wrap(err)
+		}
+
+		// Don't let clients provide the same key again.
+		if err := ensurePublicKeysNotEqual(boundPublicKey, newPubKey); err != nil {
+			emitBoundKeypairRotationEvent(ctx, params, ptv2, boundPublicKey, newPubKey, err)
+			return nil, trace.Wrap(err)
+		}
+
+		mutators = append(mutators,
+			mutateStatusBoundPublicKey(newPubKey, boundPublicKey),
+			mutateStatusLastRotatedAt(&now, status.LastRotatedAt),
+		)
+
+		emitBoundKeypairRotationEvent(ctx, params, ptv2, boundPublicKey, newPubKey, nil)
+		boundPublicKey = newPubKey
+	}
+
+	certs, botInstanceID, err := params.GenerateBotCerts(ctx, verifiedPreviousBotInstanceID, &boundkeypair.Claims{
+		PublicKey:     boundPublicKey,
+		RecoveryCount: recoveryCount,
+		RecoveryMode:  recoveryMode,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if expectNewBotInstance {
+		mutators = append(
+			mutators,
+			mutateStatusBoundBotInstance(botInstanceID, status.BoundBotInstanceID),
+		)
+	}
+
+	// A reference to the final provision token state; may be modified below via
+	// mutators.
+	finalToken := ptv2
+
+	if len(mutators) > 0 {
+		patched, err := params.AuthService.PatchToken(ctx, ptv2.GetName(), func(token types.ProvisionToken) (types.ProvisionToken, error) {
+			ptv2, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+			if !ok {
+				return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", params.ProvisionToken)
+			}
+
+			// Apply all mutators. Individual mutators may make additional
+			// assertions to ensure invariants haven't changed.
+			for _, mutator := range mutators {
+				if err := mutator(ptv2.Spec.BoundKeypair, ptv2.Status.BoundKeypair); err != nil {
+					return nil, trace.Wrap(err, "applying status mutator")
+				}
+			}
+
+			return ptv2, nil
+		})
+		if err != nil {
+			return nil, trace.Wrap(err, "committing updated token state, please try again")
+		}
+
+		finalToken, ok = patched.(*types.ProvisionTokenV2)
+		if !ok {
+			// This should be impossible, but if it did fail, we can't generate
+			// a join state without an accurate token. The certs we just
+			// generated will be useless, so just return an error.
+			return nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", params.ProvisionToken)
+		}
+	}
+
+	signer, err := params.AuthService.GetKeyStore().GetJWTSigner(ctx, ca)
+	if err != nil {
+		return nil, trace.Wrap(err, "issuing join state document")
+	}
+
+	newJoinState, err := boundkeypair.IssueJoinState(signer, &boundkeypair.JoinStateParams{
+		Clock:       params.Clock,
+		ClusterName: clusterName.GetClusterName(),
+		Token:       finalToken,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "issuing join state document")
+	}
+
+	return &messages.BotResult{
+		Certificates: *certs,
+		BoundKeypairResult: &messages.BoundKeypairResult{
+			JoinState: []byte(newJoinState),
+			PublicKey: []byte(boundPublicKey),
+		},
+	}, nil
+}
diff --git a/lib/join/certsparams.go b/lib/join/certsparams.go
new file mode 100644
index 0000000000000..4281236fcc3e5
--- /dev/null
+++ b/lib/join/certsparams.go
@@ -0,0 +1,80 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"time"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// HostCertsParams is the set of parameters used to generate host certificates
+// when a host joins the cluster.
+type HostCertsParams struct {
+	// HostID is the unique ID of the host.
+	HostID string
+	// HostName is a user-friendly host name.
+	HostName string
+	// SystemRole is the main system role requested, e.g. Instance, Node, Proxy, etc.
+	SystemRole types.SystemRole
+	// AuthenticatedSystemRoles is a set of system roles that the Instance
+	// identity currently re-joining has authenticated.
+	AuthenticatedSystemRoles types.SystemRoles
+	// PublicTLSKey is the requested TLS public key in PEM-encoded PKIX DER format.
+	PublicTLSKey []byte
+	// PublicSSHKey is the requested SSH public key in SSH authorized keys format.
+	PublicSSHKey []byte
+	// AdditionalPrincipals is a list of additional principals
+	// to include in OpenSSH and X509 certificates
+	AdditionalPrincipals []string
+	// DNSNames is a list of DNS names to include in x509 certificates.
+	DNSNames []string
+	// RemoteAddr is the remote address of the host requesting a host certificate.
+	RemoteAddr string
+	// RawJoinClaims are raw claims asserted by specific join methods.
+	RawJoinClaims any
+}
+
+// BotCertsParams is the set of parameters used to generate bot certificates
+// when a bot joins the cluster.
+type BotCertsParams struct {
+	// PublicTLSKey is the requested TLS public key in PEM-encoded PKIX DER format.
+	PublicTLSKey []byte
+	// PublicSSHKey is the requested SSH public key in SSH authorized keys format.
+	PublicSSHKey []byte
+	// BotInstanceID is a trusted instance identifier for a Machine ID bot,
+	// provided to Auth by the Join Service when bots rejoin via a client
+	// certificate extension.
+	BotInstanceID string
+	// PreviousBotInstanceID is a trusted previous instance identifier for a
+	// Machine ID bot.
+	PreviousBotInstanceID string
+	// BotGeneration is a trusted generation counter value for Machine ID bots,
+	// provided to Auth by the Join Service when bots rejoin via a client
+	// certificate extension.
+	BotGeneration int32
+	// Expires is a desired time of the expiry of user certificates. This only
+	// applies to bot joining, and will be ignored by node joining.
+	Expires *time.Time
+	// RemoteAddr is the remote address of the bot requesting a bot certificate.
+	RemoteAddr string
+	// RawJoinClaims are raw claims asserted by specific join methods.
+	RawJoinClaims any
+	// Attrs is a collection of attributes that result from the join process.
+	Attrs *workloadidentityv1pb.JoinAttrs
+}
diff --git a/lib/join/circleci/circleci.go b/lib/join/circleci/circleci.go
new file mode 100644
index 0000000000000..a93962c434147
--- /dev/null
+++ b/lib/join/circleci/circleci.go
@@ -0,0 +1,164 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// CircleCI workload identity
+//
+// Key values:
+// Issuer of tokens: `https://oidc.circleci.com/org/ORGANIZATION_ID`
+// Audience: `ORGANIZATION_ID`
+//
+// `iat` and `exp` will be included and should be respected.
+//
+// Useful references:
+// - https://circleci.com/docs/openid-connect-tokens/
+
+package circleci
+
+import (
+	"context"
+	"net/url"
+	"slices"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "circleci")
+
+// Validator is a function that can be used to validate CircleCI tokens
+type Validator func(ctx context.Context, issuerURL, organizationID, token string) (*IDTokenClaims, error)
+
+// issuerURL generates a CircleCI issuer URL such that it avoids potential SSRF
+// from the user-provided organization ID.
+func issuerURL(organizationID string) string {
+	u := url.URL{
+		Scheme: "https",
+		Host:   "oidc.circleci.com",
+	}
+
+	return u.JoinPath("org", organizationID).String()
+}
+
+// IDTokenClaims is the structure of claims contained with a CircleCI issued
+// ID token.
+// See https://circleci.com/docs/openid-connect-tokens/
+type IDTokenClaims struct {
+	oidc.TokenClaims
+
+	// Sub identifies who is running the CircleCI job and where.
+	// In the format of: `org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID`
+	Sub string `json:"sub"`
+	// ContextIDs is a list of UUIDs for the contexts used in the job.
+	ContextIDs []string `json:"oidc.circleci.com/context-ids"`
+	// ProjectID is the ID of the project in which the job is running.
+	ProjectID string `json:"oidc.circleci.com/project-id"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsCircleCI {
+	return &workloadidentityv1pb.JoinAttrsCircleCI{
+		Sub:        c.Sub,
+		ContextIds: c.ContextIDs,
+		ProjectId:  c.ProjectID,
+	}
+}
+
+// CheckIDTokenParams are parameters used to validate CircleCI OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Validator      Validator
+}
+
+func (p *CheckIDTokenParams) checkAndSetDefaults() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	}
+	return nil
+}
+
+// CheckIDToken validates a CircleCI OIDC token, verifying both the validity of
+// the OIDC token itself, as well as ensuring claims match any configured allow
+// rules in the provided provision token.
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*IDTokenClaims, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("circleci join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	claims, err := params.Validator(
+		ctx,
+		issuerURL(token.Spec.CircleCI.OrganizationID),
+		token.Spec.CircleCI.OrganizationID,
+		string(params.IDToken),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	log.InfoContext(ctx, "CircleCI run trying to join cluster",
+		"claims", claims,
+		"token", params.ProvisionToken.GetName(),
+	)
+
+	return claims, trace.Wrap(checkCircleCIAllowRules(token, claims))
+}
+
+func checkCircleCIAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	// If a single rule passes, accept the IDToken
+	for _, rule := range token.Spec.CircleCI.Allow {
+		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
+			continue
+		}
+
+		// If ContextID is specified in rule, it must be contained in the slice
+		// of ContextIDs within the claims.
+		if rule.ContextID != "" && !slices.Contains(claims.ContextIDs, rule.ContextID) {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/circleci/token_source.go b/lib/join/circleci/token_source.go
similarity index 100%
rename from lib/circleci/token_source.go
rename to lib/join/circleci/token_source.go
diff --git a/lib/circleci/token_source_test.go b/lib/join/circleci/token_source_test.go
similarity index 100%
rename from lib/circleci/token_source_test.go
rename to lib/join/circleci/token_source_test.go
diff --git a/lib/join/circleci/token_validator.go b/lib/join/circleci/token_validator.go
new file mode 100644
index 0000000000000..68e226fa4b88c
--- /dev/null
+++ b/lib/join/circleci/token_validator.go
@@ -0,0 +1,34 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package circleci
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/lib/oidc"
+)
+
+func ValidateToken(
+	ctx context.Context,
+	issuerURL string,
+	organizationID string,
+	token string,
+) (*IDTokenClaims, error) {
+	return oidc.ValidateToken[*IDTokenClaims](ctx, issuerURL, organizationID, token)
+}
diff --git a/lib/join/circleci/token_validator_test.go b/lib/join/circleci/token_validator_test.go
new file mode 100644
index 0000000000000..159eec9e75818
--- /dev/null
+++ b/lib/join/circleci/token_validator_test.go
@@ -0,0 +1,208 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package circleci
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
+
+// fakeIDP pretends to be a circle CI org OIDC provider, e.g:
+// https://oidc.circleci.com/org/00f45056-5918-4171-9222-b538c76ed3f8/.well-known/openid-configuration
+type fakeIDP struct {
+	signer jose.Signer
+	server *httptest.Server
+}
+
+func (f *fakeIDP) issueToken(
+	t *testing.T,
+	organizationID string,
+	projectID string,
+	contextIDs []string,
+	issuedAt time.Time,
+	expiry time.Time,
+) string {
+	stdClaims := jwt.Claims{
+		Issuer:   f.issuerURL(organizationID),
+		Subject:  fmt.Sprintf("org/%s/project/%s/user/USER_ID", organizationID, projectID),
+		Audience: jwt.Audience{organizationID},
+		IssuedAt: jwt.NewNumericDate(issuedAt),
+		Expiry:   jwt.NewNumericDate(expiry),
+	}
+	customClaims := map[string]interface{}{
+		"oidc.circleci.com/project-id":  projectID,
+		"oidc.circleci.com/context-ids": contextIDs,
+	}
+	token, err := jwt.Signed(f.signer).
+		Claims(stdClaims).
+		Claims(customClaims).
+		CompactSerialize()
+	require.NoError(t, err)
+
+	return token
+}
+
+func (f *fakeIDP) issuerURL(orgID string) string {
+	return f.server.URL + "/org/" + orgID
+}
+
+func newFakeIDP(t *testing.T, organizationID string) *fakeIDP {
+	// Generate keypair for IDP
+	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA2048)
+	require.NoError(t, err)
+
+	signer, err := jose.NewSigner(
+		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
+		(&jose.SignerOptions{}).WithType("JWT"),
+	)
+	require.NoError(t, err)
+
+	providerMux := http.NewServeMux()
+	srv := httptest.NewServer(providerMux)
+	t.Cleanup(srv.Close)
+	orgURL := "/org/" + organizationID
+	providerMux.HandleFunc(orgURL+"/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		response := map[string]interface{}{
+			"claims_supported": []string{
+				"sub",
+				"aud",
+				"exp",
+				"iat",
+				"iss",
+				"jti",
+				"oidc.circleci.com/project-id",
+				"oidc.circleci.com/context-ids",
+			},
+			"id_token_signing_alg_values_supported": []string{"RS256"},
+			"issuer":                                srv.URL + orgURL,
+			"jwks_uri": fmt.Sprintf(
+				"%s/.well-known/jwks-pub.json",
+				srv.URL+orgURL,
+			),
+			"response_types_supported": []string{"id_token"},
+			"scopes_supported":         []string{"openid"},
+			"subject_types_supported":  []string{"public", "pairwise"},
+		}
+		responseBytes, err := json.Marshal(response)
+		require.NoError(t, err)
+		_, err = w.Write(responseBytes)
+		require.NoError(t, err)
+	})
+	providerMux.HandleFunc(orgURL+"/.well-known/jwks-pub.json", func(w http.ResponseWriter, r *http.Request) {
+		// mimic jwks endpoint with our own key
+		jwks := jose.JSONWebKeySet{
+			Keys: []jose.JSONWebKey{
+				{
+					Key: privateKey.Public(),
+				},
+			},
+		}
+		responseBytes, err := json.Marshal(jwks)
+		require.NoError(t, err)
+		_, err = w.Write(responseBytes)
+		require.NoError(t, err)
+	})
+
+	return &fakeIDP{
+		signer: signer,
+		server: srv,
+	}
+}
+
+func TestValidateToken(t *testing.T) {
+	t.Parallel()
+	realOrgID := "xyz-foo-bar-123"
+	fake := newFakeIDP(t, realOrgID)
+
+	tests := []struct {
+		name        string
+		assertError require.ErrorAssertionFunc
+		want        *IDTokenClaims
+		token       string
+	}{
+		{
+			name:        "success",
+			assertError: require.NoError,
+			token: fake.issueToken(
+				t,
+				realOrgID,
+				"a-project",
+				[]string{"a-context"},
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+			),
+			want: &IDTokenClaims{
+				ContextIDs: []string{"a-context"},
+				ProjectID:  "a-project",
+				Sub:        "org/xyz-foo-bar-123/project/a-project/user/USER_ID",
+			},
+		},
+		{
+			name:        "expired",
+			assertError: require.Error,
+			token: fake.issueToken(
+				t,
+				realOrgID,
+				"a-project",
+				[]string{"a-context"},
+				time.Now().Add(-10*time.Minute),
+				time.Now().Add(-5*time.Minute),
+			),
+		},
+		{
+			name:        "another org",
+			assertError: require.Error,
+			token: fake.issueToken(
+				t,
+				"not-the-configured-org",
+				"a-project",
+				[]string{"a-context"},
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+			),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			claims, err := ValidateToken(
+				ctx, fake.issuerURL(realOrgID), realOrgID, tt.token,
+			)
+			tt.assertError(t, err)
+			require.Empty(t,
+				cmp.Diff(claims, tt.want, cmpopts.IgnoreTypes(oidc.TokenClaims{})),
+			)
+		})
+	}
+}
diff --git a/lib/join/ec2join/certs.go b/lib/join/ec2join/certs.go
new file mode 100644
index 0000000000000..f7b77478b70b4
--- /dev/null
+++ b/lib/join/ec2join/certs.go
@@ -0,0 +1,754 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ec2join
+
+// These certificates can be found at
+// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-rsa2048.html
+var awsRSA2048CertBytes = map[string][]byte{
+	"af-south-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAIFI+O5A6/ZIMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTA2MDQx
+MjQ4MDRaGA8yMTk4MTEwNzEyNDgwNFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAy7/WHBBHOrk+20aumT07g8rxrSM0UXgki3eYgKauPCG4Xx//vwQbuZwI
+oeVmR9nqnhfij2wOcQdbLandh0EGtbxerete3IoXzd1KXJb11PVmzrzyu5SPBPuP
+iCeV4qdjjkXo2YWM6t9YQ911hcG96YSp89TBXFYUh3KLxfqAdTVhuC0NRGhXpyii
+j/czo9njofHhqhTr7UEyPun8NVS2QWctLQ86N5zWR3Q0GRoVqqMrJs0cowHTrVw2
+9Qr7QBjjBOVbyYmtYxm/DtiKprYV/e6bCAVok015X1sZDd3oCOQNoGlv5XbHJe2o
+JFD8GRRy2rkWO/lNwVFDcwec6zC3QwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCE
+goqzjpCpmMgCpszFHwvRaSMbspKtK7wNImUjrSBOfBJsfFulyg1Zgn2nDCK7kQhx
+jMJmNIvXbps3yMqQ2cHUkKcKf5t+WldfeT4Vk1Rz6HSA8sd0kgVcIesIaoy2aaXU
+VEB/oQziRGyKdN1d4TGYVZXG44CkrzSDvlbmfiTq5tL+kAieznVF3bzHgPZW6hKP
+EXC3G/IXrXicFEe6YyE1Rakl62VncYSXiGe/i2XvsiNH3Qlmnx5XS7W0SCN0oAxW
+EH9twibauv82DVg1WOkQu8EwFw8hFde9X0Rkiu0qVcuU8lJgFEvPWMDFU5sGB6ZM
+gkEKTzMvlZpPbBhg99Jl
+-----END CERTIFICATE-----`),
+	"ap-east-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAMoxixvs3YssMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA3MjAw
+ODQ0NDRaGA8yMTk3MTIyMzA4NDQ0NFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA4T1PNsOg0FDrGlWePoHeOSmOJTA3HCRy5LSbYD33GFU2eBrOIxoU/+SM
+rInKu3GghAMfH7WxPW3etIAZiyTDDU5RLcUq2Qwdr/ZpXAWpYocNc/CEmBFtfbxF
+z4uwBIN3/drM0RSbe/wP9EcgmNUGQMMZWeAji8sMtwpOblNWAP9BniUG0Flcz6Dp
+uPovwDTLdAYT3TyhzlohKL3f6O48TR5yTaV+3Ran2SGRhyJjfh3FRpP4VC+z5LnT
+WPQHN74Kdq35UgrUxNhJraMGCzznolUuoR/tFMwR93401GsM9fVA7SW3jjCGF81z
+PSzjy+ArKyQqIpLW1YGWDFk3sf08FQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDK
+2/+C3nPMgtyOFX/I3Cyk+Pui44IgOwCsIdNGwuJysdqp5VIfnjegEu2zIMWJSKGO
+lMZoQXjffkVZZ97J7RNDW06oB7kj3WVE8a7U4WEOfnO/CbMUf/x99CckNDwpjgW+
+K8V8SzAsQDvYZs2KaE+18GFfLVF1TGUYK2rPSZMHyX+v/TIlc/qUceBycrIQ/kke
+jDFsihUMLqgmOV2hXKUpIsmiWMGrFQV4AeV0iXP8L/ZhcepLf1t5SbsGdUA3AUY1
+3If8s81uTheiQjwY5t9nM0SY/1Th/tL3+RaEI79VNEVfG1FQ8mgqCK0ar4m0oZJl
+tmmEJM7xeURdpBBx36Di
+-----END CERTIFICATE-----`),
+	"ap-northeast-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAL9KIB7Fgvg/MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
+OTAwMjVaGA8yMTk1MDExNzA5MDAyNVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz0djWUcmRW85C5CiCKPFiTIvj6y2OuopFxNE5d3Wtab10bm06vnXVKXu
+tz3AndG+Dg0zIL0gMlU+QmrSR0PH2PfV9iejfLak9iwdm1WbwRrCEAj5VxPe0Q+I
+KeznOtxzqQ5Wo5NLE9bA61sziUAFNVsTFUzphEwRohcekYyd3bBC4v/RuAjCXHVx
+40z6AIksnAOGN2VABMlTeMNvPItKOCIeRLlllSqXX1gbtL1gxSW40JWdF3WPB68E
+e+/1U3F7OEr7XqmNODOL6yh92QqZ8fHjG+afOL9Y2Hc4g+P1nk4w4iohQOPABqzb
+MPjK7B2Rze0f9OEc51GBQu13kxkWWQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU5DS5IFdU/QwYbikgtWvkU3fDwRgwgY4GA1UdIwSBhjCBg4AU5DS5
+IFdU/QwYbikgtWvkU3fDwRihYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAL9KIB7Fgvg/MBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAG/N7ua8IE9IMyno0n5T57erBvLTOQ79fIJN
+Mf+mKRM7qRRsdg/eumFft0rLOKo54pJ+Kim2cngCWNhkzctRHBV567AJNt4+ZDG5
+hDgV0IxWO1+eaLE4qzqWP/9VrO+p3reuumgFZLVpvVpwXBBeBFUf2drUR14aWfI2
+L/6VGINXYs7uP8v/2VBS7r6XZRnPBUy/R4hv5efYXnjwA9gq8+a3stC2ur8m5ySl
+faKSwE4H320yAyaZWH4gpwUdbUlYgPHtm/ohRtiWPrN7KEG5Wq/REzMIjZCnxOfS
+6KR6PNjlhxBsImQhmBvz6j5PLQxOxBZIpDoiK278e/1Wqm9LrBc=
+-----END CERTIFICATE-----`),
+	"ap-northeast-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJANuCgCcHtOJhMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA5MTQx
+NTU3NDRaGA8yMTk1MDIxNzE1NTc0NFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA66iNv6pJPmGM20W8HbVYJSlKcAg2vUGx8xeAbzZIQdpGfkabVcUHGB6m
+Gy59VXDMDlrJckDDk6dxUOhmcX9z785TtVZURq1fua9QosdbTzX4kAgHGdp4xQEs
+mO6QZqg5qKjBP6xr3+PshfQ1rB8Bmwg0gXEm22CC7o77+7N7Mu2sWzWbiUR7vil4
+9FjWS8XmMNwFTlShp4l1TDTevDWW/uYmC30RThM9S4QPvTZ0rAS18hHVam8BCTxa
+LHaVCH/Yy52rsz0hM/FlghnSnK105ZKj+b+KIp3adBL8OMCjgc/Pxi0+j3HQLdYE
+32+FaXWU84D2iP2gDT28evnstzuYTQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC1
+mA4q+12pxy7By6g3nBk1s34PmWikNRJBwOqhF8ucGRv8aiNhRRye9lokcXomwo8r
+KHbbqvtK85l0xUZp/Cx4sm4aTgcMvfJP29jGLclDzeqADIvkWEJ4+xncxSYVlS9x
++78TvF/+8h9U2LnSl64PXaKdxHy2IsHIVRN4GtoaP2Xhpa1S0M328Jykq/571nfN
+1WRD1c/fQf1edgzRjhQ4whcAhv7WRRF+qTbfQJ/vDxy8lkiOsvU9XzUaZ0fZSfXX
+wXxZamQbONvFcxVHY/0PSiM8nQoUmkkBQuKleDwRWvkoJKYKyr3jvXK7HIWtMrO4
+jmXe0aMy3thyK6g5sJVg
+-----END CERTIFICATE-----`),
+	"ap-northeast-3": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAMn1yPk22ditMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNzA3MTkx
+MTEyNThaGA8yMTk2MTIyMjExMTI1OFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEArznEYef8IjhrJoazI0QGZkmlmHm/4rEbyQbMNifxjsDE8YWtHNwaM91z
+zmyK6Sk/tKlWxcnl3g31iq305ziyFPEewe5Qbwf1iz2cMsvfNBcTh/E6u+mBPH3J
+gvGanqUJt6c4IbipdEouIjjnynyVWd4D6erLl/ENijeR1OxVpaqSW5SBK7jms49E
+pw3wtbchEl3qsE42Ip4IYmWxqjgaxB7vps91n4kfyzAjUmklcqTfMfPCkzmJCRgp
+Vh1C79vRQhmriVKD6BXwfZ8tG3a7mijeDn7kTsQzgO07Z2SAE63PIO48JK8HcObH
+tXORUQ/XF1jzi/SIaUJZT7kq3kWl8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBj
+ThtO9dLvU2QmKuXAhxXjsIdlQgGG3ZGh/Vke4If1ymgLx95v2Vj9Moxk+gJuUSRL
+BzFte3TT6b3jPolbECgmAorjj8NxjC17N8QAAI1d0S0gI8kqkG7V8iRyPIFekv+M
+pcai1+cIv5IV5qAz8QOMGYfGdYkcoBjsgiyvMJu/2N2UbZJNGWvcEGkdjGJUYYOO
+NaspCAFm+6HA/K7BD9zXB1IKsprLgqhiIUgEaW3UFEbThJT+z8UfHG9fQjzzfN/J
+nT6vuY/0RRu1xAZPyh2gr5okN/s6rnmh2zmBHU1n8cbCc64MVfXe2g3EZ9Glq/9n
+izPrI09hMypJDP04ugQc
+-----END CERTIFICATE-----`),
+	"ap-south-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAPRYyD8TtmC0MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjAzMDcx
+MDQ1MDFaGA8yMTk1MDgxMTEwNDUwMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA0LSS5I/eCT2PM0+qusorBx67QL26BIWQHd/yF6ARtHBb/1DdFLRqE5Dj
+07Xw7eENC+T79mOxOAbeWg91KaODOzw6i9I/2/HpK0+NDEdD6sPKDA1d45jRra+v
+CqAjI+nV9Vw91wv7HjMk3RcjWGziM8/hw+3YNIutt7aQzZRwIWlBpcqx3/AFd8Eu
+2UsRMSHgkGUW6UzUF+h/U8218XfrauKNGmNKDYUhtmyBrHT+k6J0hQ4pN7fe6h+Z
+w9RVHm24BGhlLxLHLmsOIxvbrF277uX9Dxu1HfKfu5D2kimTY7xSZDNLR2dt+kNY
+/+iWdIeEFpPT0PLSILt52wP6stF+3QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBI
+E6w+WWC2gCfoJO6c9HMyGLMFEpqZmz1n5IcQt1h9iyO7Vkm1wkJiZsMhXpk73zXf
+TPxuXEacTX3SOEa07OIMCFwkusO5f6leOyFTynHCzBgZ3U0UkRVZA3WcpbNB6Dwy
+h7ysVlqyT9WZd7EOYm5j5oue2G2xdei+6etgn5UjyWm6liZGrcOF6WPTdmzqa6WG
+ApEqanpkQd/HM+hUYex/ZS6zEhd4CCDLgYkIjlrFbFb3pJ1OVLztIfSN5J4Oolpu
+JVCfIq5u1NkpzL7ys/Ub8eYipbzI6P+yxXiUSuF0v9b98ymczMYjrSQXIf1e8In3
+OP2CclCHoZ8XDQcvvKAh
+-----END CERTIFICATE-----`),
+	"ap-south-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAIVWfPw/X82fMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MDQx
+NDMwMjhaGA8yMjAxMTIwODE0MzAyOFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAg29QEFriG+qFEjYW/v62nN70lMJY/Hevx5TtmU/VIYBPQa3HUGTBAbbI
+2Tmy8UMpa8kZeaYeI3RAfiQWt0Ws7wUrBuO2Pdp518WDPaJUH7RWEuu1BDDkyZRW
+NAMNPCn3ph7Od243IFcLGku7HVekel5poqRpSfojrMasjlf+CvixUeAJbmFoxUHK
+kh5unzG2sZyO4wHXcJPQkRf5a8zSTPe9YZP1kXPPEv4p/jTSggaYPxXyS6QVaTlV
+zLeLFZ0fesLPMeil3KYQtV7IKLQiEA2F6dxWnxNWQlyMHtdq6PucfEmVx17i/Xza
+yNBRo0azY8WUNVkEXrRhp/pU8Nh3GQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU9AO1aZk9RLXk2ZvRVoUxYvQy9uwwgY4GA1UdIwSBhjCBg4AU9AO1
+aZk9RLXk2ZvRVoUxYvQy9uyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAIVWfPw/X82fMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBADexluMRQRftqViahCnauEWGdMvLCBr8A+Yr
+6hJq0guoxEk/lahxR137DnfMPuSbi1Rx5QKo7oBrWfG/zsgQUnF2IwHTzwD+i/2m
+XCane6FiS5RpK3lGdILq8ZmlhQk+6iI8yoZLr0LCfTh+CLgIKHOknfR5lFzgzAiF
+SI8/Q9mm+uvYtSTZECI6Zh57QZPoETAG/yl+9jiOy2lAelqa/k1i+Qo8gMfOc+Pm
+dwY7o6fV+oucgRlsdey6VM45LeyILQqv0RXtVzjuowanzmCCFMjgqiO9oZAWu4Oh
++F3unijELo01vZJs8s2N3KGlo3/jtUFTX6RTKShZlAPLwBi5GMI=
+-----END CERTIFICATE-----`),
+	"ap-southeast-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAJVMGw5SHkcvMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
+ODU3MTlaGA8yMTk1MDQwMzA4NTcxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAlaSSLfBl7OgmikjLReHuNhVuvM20dCsVzptUyRbut+KmIEEc24wd/xVy
+2RMIrydGedkW4tUjkUyOyfET5OAyT43jTzDPHZTkRSVkYjBdcYbe9o/0Q4P7IVS3
+XlvwrUu0qo9nSID0mxMnOoF1l8KAqnn10tQ0W+lNSTkasW7QVzcb+3okPEVhPAOq
+MnlY3vkMQGI8zX4iOKbEcSVIzf6wuIffXMGHVC/JjwihJ2USQ8fq6oy686g54P4w
+ROg415kLYcodjqThmGJPNUpAZ7MOc5Z4pymFuCHgNAZNvjhZDA842Ojecqm62zcm
+Tzh/pNMNeGCRYq2EQX0aQtYOIj7bOQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU6SSB+3qALorPMVNjToM1Bj3oJMswgY4GA1UdIwSBhjCBg4AU6SSB
++3qALorPMVNjToM1Bj3oJMuhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAJVMGw5SHkcvMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAF/0dWqkIEZKg5rca8o0P0VS+tolJJE/FRZO
+atHOeaQbWzyac6NEwjYeeV2kY63skJ+QPuYbSuIBLM8p/uTRIvYM4LZYImLGUvoO
+IdtJ8mAzq8CZ3ipdMs1hRqF5GRp8lg4w2QpX+PfhnW47iIOBiqSAUkIr3Y3BDaDn
+EjeXF6qS4iPIvBaQQ0cvdddNh/pE33/ceghbkZNTYkrwMyBkQlRTTVKXFN7pCRUV
++L9FuQ9y8mP0BYZa5e1sdkwebydU+eqVzsil98ntkhpjvRkaJ5+Drs8TjGaJWlRw
+5WuOr8unKj7YxdL1bv7//RtVYVVi296ldoRUYv4SCvJF11z0OdQ=
+-----END CERTIFICATE-----`),
+	"ap-southeast-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAL2bOgb+dq9rMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
+OTAwNTdaGA8yMTk1MDQwMzA5MDA1N1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAmRcyLWraysQS8yDC1b5Abs3TUaJabjqWu7d5gHik5Icd6dKl8EYpQSeS
+vz6pLhkgO4xBbCRGlgE8LS/OijcZ5HwdrxBiKbicR1YvIPaIyEQQvF5sX6UWkGYw
+Ma5IRGj4YbRmJkBybw+AAV9Icb5LJNOMWPi34OWM+2tMh+8L234v/JA6ogpdPuDr
+sM6YFHMZ0NWo58MQ0FnEj2D7H58Ti//vFPl0TaaPWaAIRF85zBiJtKcFJ6vPidqK
+f2/SDuAvZmyHC8ZBHg1moX9bR5FsU3QazfbW+c+JzAQWHj2AaQrGSCITxCMlS9sJ
+l51DeoZBjnx8cnRe+HCaC4YoRBiqIQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU/wHIo+r5U31VIsPoWoRVsNXGxowwgY4GA1UdIwSBhjCBg4AU/wHI
+o+r5U31VIsPoWoRVsNXGxoyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAL2bOgb+dq9rMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBACobLvj8IxlQyORTz/9q7/VJL509/p4HAeve
+92riHp6+Moi0/dSEYPeFTgdWB9W3YCNc34Ss9TJq2D7t/zLGGlbI4wYXU6VJjL0S
+hCjWeIyBXUZOZKFCb0DSJeUElsTRSXSFuVrZ9EAwjLvHni3BaC9Ve34iP71ifr75
+8Tpk6PEj0+JwiijFH8E4GhcV5chB0/iooU6ioQqJrMwFYnwo1cVZJD5v6D0mu9bS
+TMIJLJKv4QQQqPsNdjiB7G9bfkB6trP8fUVYLHLsVlIy5lGx+tgwFEYkG1N8IOO/
+2LCawwaWm8FYAFd3IZl04RImNs/IMG7VmH1bf4swHOBHgCN1uYo=
+-----END CERTIFICATE-----`),
+	"ap-southeast-3": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAMtdyRcH51j9MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA0MDgx
+MjM5MTZaGA8yMjAxMDkxMjEyMzkxNlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAvUsKCxoH6KXRYJLeYTWAQfaBQeCwhJaR56mfUeFHJE4g8aFjWkiN4uc1
+TvOyYNnIZKTHWmzmulmdinWNbwP0GiROHb/i7ro0HhvnptyycGt8ag8affiIbx5X
+7ohdwSN2KJ6G0IKflIx7f2NEI0oAMM/9k+T1eVF+MVWzpZoiDp8frLNkqp8+RAgz
+ScZsbRfwv3u/if5xJAvdg2nCkIWDMSHEVPoz0lJo7v0ZuDtWWsL1LHnL5ozvsKEk
++ZJyEi23r+U1hIT1NTBdp4yoigNQexedtwCSr7q36oOdDwvZpqYlkLi3uxZ4ta+a
+01pzOSTwMLgQZSbKWQrpMvsIAPrxoQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU1GgnGdNpbnL3lLF30Jomg7Ji9hYwgY4GA1UdIwSBhjCBg4AU1Ggn
+GdNpbnL3lLF30Jomg7Ji9hahYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAMtdyRcH51j9MBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBACVl00qQlatBKVeiWMrhpczsJroxDxlZTOba
+6wTMZk7c3akb6XMOSZFbGaifkebPZqTHEhDlrClM2j9AIlYcCx6YCrTf4cuhn2mD
+gcJN33143eOWSaeRY3ee4j+V9ne98y3kO2wLz95VrRgclPFR8po2iWGzGhwUi+FG
+q8dXeCH3N0DZgQsSgQWwmdNQXZZej6RHLU/8In5trHKLY0ppnLBjn/UZQbeTyW5q
+RJB3GaveXjfgFUWj2qOcDuRGaikdS+dYaLsi5z9cA3FolHzWxx9MOs8io8vKqQzV
+XUrLTNWwuhZy88cOlqGPxnoRbw7TmifwPw/cunNrsjUUOgs6ZTk=
+-----END CERTIFICATE-----`),
+	"ap-southeast-4": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAN4GTQ64zVs8MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTMx
+MzMzMDBaGA8yMjAxMTIxNzEzMzMwMFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA2BYgeCr+Rk/jIAEDOHS7wJql62vc83QEwjuzk0qOFEReIZzlN1fBRNXK
+g0T178Kd3gLYcE59wEFbTe/X5yOA1Lo95x1anSAo7R+Cisf9C2HQuJp+gVb+zx71
+lniPF7gHziGpm0M8DdAU/IW+wkZwGbP4z7Hq9+bJ0P2ltvPJ5yxSgkFuDsI9VBHa
+CLoprHsCHh2VdP8KcMgQQMmHe1NmBpyTk0ul/aLmQkCQEX6ZIRGOeq228fwlh/t+
+Ho+jv87duihVKic6MrL32SlD+maX0LSDUydWdaOLLTGkh7oV7+bFuH6msrXUu+Ur
+ZEP1r/MidCWMhfgrFzeTBzOHA97qxQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUcHMd1cHqzmsQ5hpUK3EMLhHdsi4wgY4GA1UdIwSBhjCBg4AUcHMd
+1cHqzmsQ5hpUK3EMLhHdsi6hYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAN4GTQ64zVs8MBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAI4PFyVN+7EGSObioiPnv0LL0f70SSzUZJ8p
+XO90d4rWea7jIbgZ2AKb+ErynkU9xVg7XQQ5k6KDWgp/4jYFL2dqnt/YAY4PS0un
+RSrYElawxLT0BcLn4rcSDC79vQe1xGC5//wDdV6b399COAHRAK6axWYy5w32u9PL
+uw0cIp3Ch8JoNwcgTHKRRGzePmBeR4PNqhHTArG4/dJk6/aUO4OpX0WzI6L67CGY
+6Nex3dau+gkLCK93dTEkrXtyXHu4wB0J9zd1w+iQ0SEa9eKc78/NjEsF/FZdGrWC
+t57lIMOOXJhQ1kRgSwNeZdQWV1dRakvO6sfcvVYkfj1wAvZvvAw=
+-----END CERTIFICATE-----`),
+	"ca-central-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAJNKhJhaJOuMMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA3Mjkx
+MTM3MTdaGA8yMTk2MDEwMjExMzcxN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAhDUh6j1ACSt057nSxAcwMaGr8Ez87VA2RW2HyY8l9XoHndnxmP50Cqld
++26AJtltlqHpI1YdtnZ6OrVgVhXcVtbvte0lZ3ldEzC3PMvmISBhHs6A3SWHA9ln
+InHbToLX/SWqBHLOX78HkPRaG2k0COHpRy+fG9gvz8HCiQaXCbWNFDHZev9OToNI
+xhXBVzIa3AgUnGMalCYZuh5AfVRCEeALG60kxMMC8IoAN7+HG+pMdqAhJxGUcMO0
+LBvmTGGeWhi04MUZWfOkwn9JjQZuyLg6B1OD4Y6s0LB2P1MovmSJKGY4JcF8Qu3z
+xxUbl7Bh9pvzFR5gJN1pjM2n3gJEPwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAJ
+UNKM+gIIHNk0G0tzv6vZBT+o/vt+tIp8lEoZwaPQh1121iw/I7ZvhMLAigx7eyvf
+IxUt9/nf8pxWaeGzi98RbSmbap+uxYRynqe1p5rifTamOsguuPrhVpl12OgRWLcT
+rjg/K60UMXRsmg2w/cxV45pUBcyVb5h6Op5uEVAVq+CVns13ExiQL6kk3guG4+Yq
+LvP1p4DZfeC33a2Rfre2IHLsJH5D4SdWcYqBsfTpf3FQThH0l0KoacGrXtsedsxs
+9aRd7OzuSEJ+mBxmzxSjSwM84Ooh78DjkdpQgv967p3d+8NiSLt3/n7MgnUy6WwB
+KtDujDnB+ttEHwRRngX7
+-----END CERTIFICATE-----`),
+	"ca-west-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJALyTn5IHrIZjMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMzEyMDcx
+NTM3MDFaGA8yMjAzMDUxMzE1MzcwMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA1GP5os424BJmGPCKOSgOclP7lzUiB85du03M4hfjzSOszsBpmBGFDLz1
+owYHtIxlq3+Vi1Lt5Qlx3id/ov1QyaBPFWXVeklHVXy9vieCcI3TdjGjTl1W/8MM
+m3X26QPcsnHM/Kk2wJ7s186MrqmdSsp3SCPpxv4vEG2Q9yR2bXY41hpc2rWlW8qU
+D0JGXluvmmAdFnto20l1XWZ6xFen1h60DRugek/ufCbN+ljKy0xLqPoavH0Ybjsb
+UpsAsBs7phaoN+X/5hIERfbp5LfVnqq54pNG5KNu4KynfW9+kA/WS4cJ6FTTN5t+
+y0P1HvcL+BL2RuDy6T2bB21xw5WqtQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQURTvu/Dd4zDnmS5G5CfVLnmUBNOswgY4GA1UdIwSBhjCBg4AURTvu
+/Dd4zDnmS5G5CfVLnmUBNOuhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJALyTn5IHrIZjMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAFt523A3Aug6/F8xxyITgA8gkU0btFhlXNSP
+U4U2OQ9n0tWI9WqnKNWH3KBxwY5EPitU6b3LM4xc9lDWpz7h2Pto+WhxP9LVKe6f
+r8r7teTLCVZ7cfYZHzHg+flZjVpAgzE5BVfrRlj3QKpv0hYT3J1wMtI++Vorq5Nf
+aPjzedehJLhmZVALwnfqfLrgv6/gmraP9Vmoa8U4D6AljNiQGYaLwyoPoRm3bUs2
+v1Mh9GkEQ1b9+1pFXcqgzJJTGRuiPCyPbECI79FAnx5JM/CkGJV8HlOmjIW1qkK1
+Y2qT7wzErrKLJyB53Pw15BdIM1onbDAQreZb0yZQLdoEl/tx7Uk=
+-----END CERTIFICATE-----`),
+	"cn-north-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAOtrM5XLDSjCMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQx
+MDAxNDJaGA8yMTk1MDExNzEwMDE0MlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAvVBz+WQNdPiM9S+aUULOQEriTmNDUrjLWLr7SfaOJScBzis5D5ju0jh1
++qJdkbuGKtFX5OTWTm8pWhInX+hIOoS3exC4BaANoa1A3o6quoG+Rsv72qQf8LLH
+sgEi6+LMlCN9TwnRKOToEabmDKorss4zFl7VSsbQJwcBSfOcIwbdRRaW9Ab6uJHu
+79L+mBR3Ea+G7vSDrVIA8goAPkae6jY9WGw9KxsOrcvNdQoEkqRVtHo4bs9fMRHU
+Etphj2gh4ObXlFN92VtvzD6QBs3CcoFWgyWGvzg+dNG5VCbsiiuRdmii3kcijZ3H
+Nv1wCcZoEAqH72etVhsuvNRC/xAP8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA8
+ezx5LRjzUU9EYWYhyYIEShFlP1qDHs7F4L46/5lc4pL8FPoQm5CZuAF31DJhYi/b
+fcV7i3n++/ymQbCLC6kAg8DUB7NrcROll5ag8d/JXGzcTCnlDXLXx1905fPNa+jI
+0q5quTmdmiSi0taeaKZmyUdhrB+a7ohWdSdlokEIOtbH1P+g5yll3bI2leYE6Tm8
+LKbyfK/532xJPqO9abx4Ddn89ZEC6vvWVNDgTsxERg992Wi+/xoSw3XxkgAryIv1
+zQ4dQ6irFmXwCWJqc6kHg/M5W+z60S/94+wGTXmp+19U6Rkq5jVMLh16XJXrXwHe
+4KcgIS/aQGVgjM6wivVA
+-----END CERTIFICATE-----`),
+	"cn-northwest-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAPu4ssY3BlzcMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEyMDMy
+MTI5MzJaGA8yMTk1MDUwODIxMjkzMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAsOiGi4A6+YTLzCdIyP8b8SCT2M/6PGKwzKJ5XbSBoL3gsnSWiFYqPg9c
+uJPNbiy9wSA9vlyfWMd90qvTfiNrT6vewP813QdJ3EENZOx4ERcf/Wd22tV72kxD
+yw1Q3I1OMH4bOItGQAxU5OtXCjBZEEUZooOkU8RoUQOU2Pql4NTiUpzWacNutAn5
+HHS7MDc4lUlsJqbN+5QW6fFrcNG/0Mrib3JbwdFUNhrQ5j+Yq5h78HarnUivnX/3
+Ap+oPbentv1qd7wvPJu556LZuhfqI0TohiIT1Ah+yUdN5osoaMxTHKKtf/CsSJ1F
+w3qXqFJQA0VWsqjFyHXFI32I/GOupwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+Um00QHvUsJSN6KATbghowLynHn3wZSQsuS8E0COpcFJFxP2SV0NYkERbXu0n/Vhi
+yq5F8v4/bRA2/xpedLWmvFs7QWlomuXhSnYFkd33Z5gnXPb9vRkLwiMSw4uXls35
+qQraczUJ9EXDhrv7VmngIk9H3YsxYrlDGEqh/oz4Ze4ULOgnfkauanHikk+BUEsg
+/jsTD+7e+niEzJPihHdsvKFDlud5pakEzyxovHwNJ1GS2I//yxrJFIL91mehjqEk
+RLPdNse7N6UvSnuXcOokwu6l6kfzigGkJBxkcq4gre3szZFdCQcUioj7Z4xtuTL8
+YMqfiDtN5cbD8R8ojw9Y
+-----END CERTIFICATE-----`),
+	"eu-central-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAKD+v6LeR/WrMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
+OTA4MTlaGA8yMTk1MDExNzA5MDgxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAka8FLhxs1cSJGK+Q+q/vTf8zVnDAPZ3U6oqppOW/cupCtpwMAQcky8DY
+Yb62GF7+C6usniaq/9W6xPn/3o//wti0cNt6MLsiUeHqNl5H/4U/Q/fR+GA8pJ+L
+npqZDG2tFi1WMvvGhGgIbScrjR4VO3TuKy+rZXMYvMRk1RXZ9gPhk6evFnviwHsE
+jV5AEjxLz3duD+u/SjPp1vloxe2KuWnyC+EKInnka909sl4ZAUh+qIYfZK85DAjm
+GJP4W036E9wTJQF2hZJrzsiB1MGyC1WI9veRISd30izZZL6VVXLXUtHwVHnVASrS
+zZDVpzj+3yD5hRXsvFigGhY0FCVFnwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUxC2l6pvJaRflgu3MUdN6zTuP6YcwgY4GA1UdIwSBhjCBg4AUxC2l
+6pvJaRflgu3MUdN6zTuP6YehYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAKD+v6LeR/WrMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAIK+DtbUPppJXFqQMv1f2Gky5/82ZwgbbfXa
+HBeGSii55b3tsyC3ZW5ZlMJ7Dtnr3vUkiWbV1EUaZGOUlndUFtXUMABCb/coDndw
+CAr53XTv7UwGVNe/AFO/6pQDdPxXn3xBhF0mTKPrOGdvYmjZUtQMSVb9lbMWCFfs
+w+SwDLnm5NF4yZchIcTs2fdpoyZpOHDXy0xgxO1gWhKTnYbaZOxkJvEvcckxVAwJ
+obF8NyJla0/pWdjhlHafEXEN8lyxyTTyOa0BGTuYOBD2cTYYynauVKY4fqHUkr3v
+Z6fboaHEd4RFamShM8uvSu6eEFD+qRmvqlcodbpsSOhuGNLzhOQ=
+-----END CERTIFICATE-----`),
+	"eu-central-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJALvT012pxTxNMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTgx
+NTEyMDdaGA8yMjAxMTIyMjE1MTIwN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAyn+Lsnq1ykrfYlZkk6aAAYNReNd9Iw8AUwCBkgOr2eBiBBepYxHwU85N
+++moQ+j0EV2VaahBeTLShGZZS1HsyK8+cYT2QzpghIoamcYhrPXyIxlWiRQlaqSg
+OFiE9bsqL3rCF5Vz+tOiTe5W/7ojfOFls6++g7ZpobwJlpMbuJepqyeHMPyjvO5A
+age81lJewc4bxo2ntaW0HCqNksqfYB78j6X6kn3PFpX7FaYAwZA+Xx6C7UCY7rNi
+UdQzfAo8htfJi4chz7frpUdQ9kl3IOQrsLshBB5fFUjl09NiFipCGBwi+8ZMeSn1
+5qwBI01BWXPfG7WX6Owyjhmh6JtE1wIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU8HN4vvJrsZgPQeksMBgJb9xR1yYwgY4GA1UdIwSBhjCBg4AU8HN4
+vvJrsZgPQeksMBgJb9xR1yahYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJALvT012pxTxNMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAGlHYDtcHpfBvdHx9HeQE8HgNugJUPdEqxun
+t9U33p8VFrs+uLPtrOd9HDJEGvvs5h84EUie/oGJxRt7V1Vlid1PvHf6cRmpjgqY
+YdggAVkZtY/PnFVmzf2bMVlSQPrqCl7U0zaw2Kvnj4zgX0rZyCetgrRZSUSxotyp
+978Wy9ccXwVSeYG/YAr5rJpS6ZH7eRQvUY0IzwFNeaOPgOTEVpcjWlV6+MQEvsEx
+W85q+s6AVr49eppEx8SLJsl0C23yB+L+t32tAveQImRWtJMpzZ5cxh/sYgDVeoC0
+85H1NK/7H9fAzT1cPu1oHSnB0xYzzHGOAmXmusMfwUk8fL1RQkE=
+-----END CERTIFICATE-----`),
+	"eu-north-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJALc/uRxg++EnMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA0MTAx
+NDAwMTFaGA8yMTk3MDkxMzE0MDAxMVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAzwCGJEJIxqtr2PD2a1mA6LhRzKhTBa1AZsg3eYfpETXIVlrpojMfvVoN
+qHvGshWLgrGTT6os/3gsaADheSaJKavxwX3X6tJA8fvEGqr3a1C1MffH9hBWbQqC
+LbfUTAbkwis4GdTUwOwPjT1Cm3u9R/VzilCNwkj7iQ65AFAI8Enmsw3UGldEsop4
+yChKB3KW3WI0FTh0+gD0YtjrqqYJxpGOYBpJp5vwdd3fZ4t1vidmDMs7liv4f9Bx
+p0oSmUobU4GUlFhBchK1DukICVQdnOVzdMonYm7s+HtpFbVHR8yf6QoixBKGdSal
+mBf7+y0ixjCn0pnC0VLVooGo4mi17QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDG
+4ONZiixgk2sjJctwbyD5WKLTH6+mxYcDw+3y/F0fWz561YORhP2FNnPOmEkf0Sl/
+Jqk4svzJbCbQeMzRoyaya/46d7UioXMHRZam5IaGBhOdQbi97R4VsQjwQj0RmQsq
+yDueDyuKTwWLK9KnvI+ZA6e6bRkdNGflK4N8GGKQ+fBhPwVELkbT9f16OJkezeeN
+S+F/gDADGJgmPXfjogICb4Kvshq0H5Lm/xZlDULF2g/cYhyNY6EOI/eS5m1I7R8p
+D/m6WoyZdpInxJfxW616OMkxQMRVsruLTNGtby3u1g6ScjmpFtvAMhYejBSdzKG4
+FEyxIdEjoeO1jhTsck3R
+-----END CERTIFICATE-----`),
+	"eu-south-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJAO/+DgYF78KwMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTA0Mjky
+MDM1MjJaGA8yMTk4MTAwMjIwMzUyMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAv1ZLV+Z/P6INq+R1qLkzETBg7sFGKPiwHekbpuB6lrRxKHhj8V9vaReM
+lnv1Ur5LAPpMPYDsuJ4WoUbPYAqVqyMAo7ikJHCCM1cXgZJefgN6z9bpS+uA3YVh
+V/0ipHh/X2hc2S9wvxKWiSHu6Aq9GVpqL035tJQD+NJuqFd+nXrtcw4yGtmvA6wl
+5Bjn8WdsP3xOTKjrByYY1BhXpP/f1ohU9jE9dstsRXLa+XTgTPWcWdCS2oRTWPGR
+c5Aeh47nnDsyQfP9gLxHeYeQItV/BD9kU/2Hn6mnRg/B9/TYH8qzlRTzLapXp4/5
+iNwusrTNexGl8BgvAPrfhjDpdgYuTwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB7
+5ya11K/hKgvaRTvZwVV8GlVZt0CGPtNvOi4AR/UN6TMm51BzUB5nurB4z0R2MoYO
+Uts9sLGvSFALJ4otoB77hyNpH3drttU1CVVwal/yK/RQLSon/IoUkaGEbqalu+mH
+nYad5IG4tEbmepX456XXcO58MKmnczNbPyw3FRzUZQtI/sf94qBwJ1Xo6XbzPKMy
+xjL57LHIZCssD+XPifXay69OFlsCIgLim11HgPkRIHEOXLSf3dsW9r+4CjoZqB/Z
+jj/P4TLCxbYCLkvglwaMjgEWF40Img0fhx7yT2X92MiSrs3oncv/IqfdVTiN8OXq
+jgnq1bf+EZEZKvb6UCQV
+-----END CERTIFICATE-----`),
+	"eu-south-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJALWSmO6DvSpQMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTgx
+MzU4NDNaGA8yMjAxMTIyMjEzNTg0M1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAuAAhuSpsHC00/fD2zNlBDpNLRndi9qbHsNeuz3WqN7Samj2aSrM2hS+i
+hUxx0BspZj0tZCOsbpPZ+i74NOEQtFeqQoEGvKhB1nJiF4y5I81HDhs5qHvoIivm
+7rbbik3zgm1PqS/DmDjVQaXPcD31Rd9ILwBmWEwJqHigyNVlxYtCzTQcrlBrvNZM
+dnNgCDAdX/HBEFxx9O12xeu0bSt0s+PJWZ1RTbYrNe7LIH6ntUqHxP/ziQ5trXEZ
+uqy7aWk1L8uK4jmyNph0lbaqBa3Y6pYmU1nC27UE4i3fnPB0LSiAr+SrwVvX1g4z
+ilo8kr+tbIF+JmcgYLBvO8Jwp+EUqQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUwvGzKJL9A5LReJ4Fxo5K6I20xcowgY4GA1UdIwSBhjCBg4AUwvGz
+KJL9A5LReJ4Fxo5K6I20xcqhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJALWSmO6DvSpQMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAJAZd31jyoTGLawAD2+v/vQsaB9vZIx5EImi
+G8YGkd61uFWeNhAmtrwyE/i6FDSIphDrMHBkvw/D3BsqK+Ev/JOK/VYuaYDx/8fp
+H4cwp9jC57CXzdIDREWNf6M9PsHFg2WA9XNNtClOZL5WJiJwel8eDSg+sqJUxE0l
+MW+QChq/20F6niyaRK4bXrZq14as7h+F9u3A9xHEOVP7Zk9C2ehrBXzCMLSDt3GV
+fEuMea2RxMhozwz34Hkdb6j18qoCfygubulovRNQjKw/cEmgPR16KfZPP5caILVt
+9qkYPvePmbiVswZDee73cDymJYxLqILpOZwyXvUH8StiH42FHZQ=
+-----END CERTIFICATE-----`),
+	"eu-west-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAOrmqHuaUt0vMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
+OTA2MTlaGA8yMTk1MDQwMzA5MDYxOVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAjE7nVu+aHLtzp9FYV25Qs1mvJ1JXD7J0iQ1Gs/RirW9a5ZECCtc4ssnf
+zQHq2JRVr0GRchvDrbm1HaP/avtFQR/Thvfltwu9AROVT22dUOTvERdkNzveoFCy
+hf52Rqf0DMrLXG8ZmQPPXPDFAv+sVMWCDftcChxRYZ6mP9O+TpgYNT1krD5PdvJU
+7HcXrkNHDYqbsg8A+Mu2hzl0QkvUET83Csg1ibeK54HP9w+FsD6F5W+6ZSHGJ88l
+FI+qYKs7xsjJQYgXWfEt6bbckWs1kZIaIOyMzYdPF6ClYzEec/UhIe/uJyUUNfpT
+VIsI5OltBbcPF4c7Y20jOIwwI2SgOQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUF2DgPUZivKQR/Zl8mB/MxIkjZDUwgY4GA1UdIwSBhjCBg4AUF2Dg
+PUZivKQR/Zl8mB/MxIkjZDWhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAOrmqHuaUt0vMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAGm6+57W5brzJ3+T8/XsIdLTuiBSe5ALgSqI
+qnO5usUKAeQsa+kZIJPyEri5i8LEodh46DAF1RlXTMYgXXxl0YggX88XPmPtok17
+l4hib/D9/lu4IaFIyLzYNSzsETYWKWoGVe7ZFz60MTRTwY2u8YgJ5dec7gQgPSGj
+avB0vTIgoW41G58sfw5b+wjXCsh0nROon79RcQFFhGnvup0MZ+JbljyhZUYFzCli
+31jPZiKzqWa87xh2DbAyvj2KZrZtTe2LQ48Z4G8wWytJzxEeZdREe4NoETf+Mu5G
+4CqoaPR05KWkdNUdGNwXewydb3+agdCgfTs+uAjeXKNdSpbhMYg=
+-----END CERTIFICATE-----`),
+	"eu-west-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJANBx0E2bOCEPMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA4MTEx
+NDU2NDJaGA8yMTk2MDExNTE0NTY0MlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEArYS3mJLGaMrh2DmiPLbqr4Z+xWXTzBWCjOwpsuHE9H6dWUUyl2Bgnu+Z
+d8QvW306Yleec45M4F2RA3J4hWHtShzsMlOJVRt+YulGeTf9OCPr26QmIFfs5nD4
+fgsJQEry2MBSGA9Fxq3Cw6qkWcrOPsCR+bHOU0XykdKl0MnIbpBf0kTfciAupQEA
+dEHnM2J1L2iI0NTLBgKxy5PXLH9weX20BFauNmHH9/J07OpwL20SN5f8TxcM9+pj
+Lbk8h1V4KdIwVQpdWkbDL9BCGlYjyadQJxSxz1J343NzrnDM0M4h4HtVaKOS7bQo
+Bqt2ruopLRCYgcuFHck/1348iAmbRQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBG
+wujwU1Otpi3iBgmhjMClgZyMMn0aQIxMigoFNqXMUNx1Mq/e/Tx+SNaOEAu0n2FF
+aiYjvY0/hXOx75ewzZvM7/zJWIdLdsgewpUqOBH4DXFhbSk2TxggSPb0WRqTBxq5
+Ed7F7+7GRIeBbRzdLqmISDnfqey8ufW0ks51XcQNomDIRG5s9XZ5KHviDCar8FgL
+HngBCdFI04CMagM+pwTO9XN1Ivt+NzUj208ca3oP1IwEAd5KhIhPLcihBQA5/Lpi
+h1s3170z1JQ1HZbDrH1pgp+8hSI0DwwDVb3IIH8kPR/J0Qn+hvOl2HOpaUg2Ly0E
+pt1RCZe+W7/dF4zsbqwK
+-----END CERTIFICATE-----`),
+	"eu-west-3": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJALWSfgHuT/ARMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNzA1MzEx
+MTE4MTZaGA8yMTk2MTEwMzExMTgxNlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAy5V7KDqnEvF3DrSProFcgu/oL+QYD62b1U+Naq8aPuljJe127Sm9WnWA
+EBdOSASkOaQ9fzjCPoG5SGgWKxYoZjsevHpmzjVv9+Ci+F57bSuMbjgUbvbRIFUB
+bxQojVoXQPHgK5v433ODxkQ4sjRyUbf4YV1AFdfU7zabC698YgPVOExGhXPlTvco
+8mlc631ubw2g52j0lzaozUkHPSbknTomhQIvO6kUfX0e0TDMH4jLDG2ZIrUB1L4r
+OWKG4KetduFrRZyDHF6ILZu+s6ywiMicUd+2UllDFC6oas+a8D11hmO/rpWU/ieV
+jj4rWAFrsebpn+Nhgy96iiVUGS2LuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDE
+iYv6FQ6knXCg+svlcaQG9q59xUC5z8HvJZ1+SxzPKKC4PKQdKvIIfE8GxVXqlZG1
+cl5WKTFDMapnzb9RV/DTaVzWx3cMYT77vm1Hl1XGjhx611CGcENH1egI3lOTILsa
++KfopuJEQQ9TDMAIkGjhA+KieU/U5Ctv9fdej6d0GC6OEuwKkTNzPWue6UMq8d4H
+2xqJboWsE1t4nybEosvZfQJcZ8jyIYcYBnsG13vCLM+ixjuU5MVVQNMY/gBJzqJB
+V+U0QiGiuT5cYgY/QihxdHt99zwGaE0ZBC7213NKrlNuLSrqhDI2NLu8NsExqOFy
+OmY0v/xVmQUQl26jJXaM
+-----END CERTIFICATE-----`),
+	"il-central-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAOVp1h2I9wW7MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA3MTUx
+MjQ0MTJaGA8yMjAxMTIxOTEyNDQxMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA13PkyWvl61iV/SYfO1UFO76UpDfPm2SF/Rz/o33cm699X++EYPxTnoEc
+vmWeS0I7eDXc4OCUiToG0sEx0klE0CX1Z1tK6qJ+zgWQLZ9SZEC9H0NsSA6LhrHu
+Nq0dzeK3LjhdfcX46/4GqdiptpdTuM4m/hOQ5yx4JMQ/n1sdpv4M5VLRWwWW9Lem
+ufb79Id7O9SispxgRsz1KXIjp7N9S4BY7itSXz97uSyzTqEjWZ6mDUhTu3t21GKC
+6flALGTTrG2yghEhz53rkvLsvwzjPSSlT6LIf0mrRPzHaf+EdaKoasElE1SHh+ZH
+9mI81HywpE+HZ+W+5hBCvjYp90Y1fwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU58tN2JO+yEGq5JbIXxGi4vRVPyIwgY4GA1UdIwSBhjCBg4AU58tN
+2JO+yEGq5JbIXxGi4vRVPyKhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAOVp1h2I9wW7MBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBANBN0e1EqNy4+IU2yQzMJ+Wy5ZIOtTP6GSBR
+7muVY1bDeAwtNTEOpwgrZVlC7/xq5Q0LC1y0Z70hHXEf8au7qStaAoUtxzvhTAZI
+NC0lwoFU56UFw4N0vZII17iqEfoqRC4PpI3OxqEJHFy0VLlvAzJoKB4QLLqDAYVA
+LXCiOLoVT+y9tRYsxw5MyO0Bi6fxQIIADl2bE9xkunTN1Jkkwqo3LxNy/ryz4QWR
+8K7jHUItifv4h/hxBKpHEquN8CkdvM9oeGl7I8PFrSFEpGr1euDXY0euZzzYiDBV
+m6GpTJgzpVsEuIX52dPcPemwQncoIfZyhWDW85MJUnby2WTEcFo=
+-----END CERTIFICATE-----`),
+	"me-central-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAM4h7b1CVhqqMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMjA0MTEx
+MDE1MDNaGA8yMjAxMDkxNTEwMTUwM1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEApybTWfMOhSoMpqPo72eqAmnn1dXGZM+G8EoZXzwHwT/+IHEXNB4q5N6k
+tudYLre1bJxuzEw+iProSHjmb9bB9YscRTofjVhBlt35Fc+i8BaMeH94SR/eE8QO
+mll8gnLNW3d62lyuhzuyv1e5wVlRqzYw+X2zRH4/wRDOCOpzjKoHIgyPKsMgwsw5
+aTZhNMsGxZN9dbkf0iCGeQLDytwU/JTh/HqvSr3VfUOapTJJiyAxoCtZWgp1/7wC
+RvOCSMRJobpUqxZgl/VsttwNkikSFz1wGkcYeSQvk+odbnYQckA8tdddoVI56eD4
+qtREQvfpMAX5v7fcqLexl5d5vH8uZQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUOadrbTs+OhzwoAgUJ7RqQNdwufkwgY4GA1UdIwSBhjCBg4AUOadr
+bTs+OhzwoAgUJ7RqQNdwufmhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAM4h7b1CVhqqMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAICTdAOGEOnII8HaGCpCB8us/hGFaLptJaAf
+D5SJAyVy66/mdfjGzE1BKkKxnbxemEVUIzbRidOnyilB+pKwN3edAjTZtWdpVA0V
+R/G/qQPmcVljtycBz4VC6SuOUYflGzLH1GZ6GJWbuDtFzw8r7HGdRN1wrEPe3UF2
+sMpuVezqnRUdvVRoVQP4jFgNsE7kNvtn2NiPhb/CtrxpcwIQ7r6YeoHcBSheuV1Z
+xZDHynC3KUprQGx1+Z9QqPrDf180MaoqAlTl4+W6Pr2NJYrVUFGS/ivYshMg574l
+CPU6r4wWZSKwEUXq4BInYX6z6iclp/p/J5QnJp2mAwyi6M+I13Y=
+-----END CERTIFICATE-----`),
+	"me-south-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJANZkFlQR2rKqMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xOTAyMDUx
+MzA2MjBaGA8yMTk4MDcxMTEzMDYyMFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAy4Vnit2eBpEjKgOKBmyupJzJAiT4fr74tuGJNwwa+Is2vH12jMZn9Il1
+UpvvEUYTIboIgISpf6SJ5LmV5rCv4jT4a1Wm0kjfNbiIlkUi8SxZrPypcw24m6ke
+BVuxQZrZDs+xDUYIZifTmdgD50u5YE+TLg+YmXKnVgxBU6WZjbuK2INohi71aPBw
+2zWUR7Gr/ggIpf635JLU3KIBLNEmrkXCVSnDFlsK4eeCrB7+UNak+4BwgpuykSGG
+Op9+2vsuNqFeU1l9daQeG9roHR+4rIWSPa0opmMxv5nctgypOrE6zKXx2dNXQldd
+VULv+WH7s6Vm4+yBeG8ctPYH5GOo+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBs
+ZcViiZdFdpcXESZP/KmZNDxB/kktlIEIhsQ+MNn29jayE5oLmtGjHj5dtA3XNKlr
+f6PVygVTKbtQLQqunRT83e8+7iCZMKI5ev7pITUQVvTUwI+Fc01JkYZxRFlVBuFA
+WGZO+98kxCS4n6tTwVt+nSuJr9BJRVC17apfHBgSS8c5OWna0VU/Cc9ka4eAfQR4
+7pYSDU3wSRE01cs30q34lXZ629IyFirSJ5TTOIc0osNL7vwMQYj8HOn4OBYqxKy8
+ZJyvfXsIPh0Na76PaBIs6ZlqAOflLrjGzxBPiwRM/XrGmF8ze4KzoUqJEnK13O6A
+KHKgfiigQZ1+gv5FlyXH
+-----END CERTIFICATE-----`),
+	"sa-east-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAMcyoxx4U0xxMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
+ODU4MDJaGA8yMTk1MDExNzA4NTgwMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAw45IhGZVbQcy1fHBqzROhO8CsrDzxj/WP4cRbJo/2DAnimVrCCDs5O86
+FA39Zo1xsDuJHDlwMKqeXYXkJXHYbcPWc6EYYAnR+PlLG+aNSOGUzsy202S03hT0
+B20hWPCqpPp39itIRhG4id6nbNRJOzLm6evHuepMAHR4/OV7hyGOiGaV/v9zqiNA
+pMCLhbh2xk0PO35HCVBuWt3HUjsgeks2eEsu9Ws6H3JXTCfiqp0TjyRWapM29OhA
+cRJfJ/d/+wBTz1fkWOZ7TF+EWRIN5ITEadlDTPnF1r8kBRuDcS/lIGFwrOOHLo4C
+cKoNgXkhTqDDBDu6oNBb2rS0K+sz3QIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUqBy7D847Ya/w321Dfr+rBJGsGTwwgY4GA1UdIwSBhjCBg4AUqBy7
+D847Ya/w321Dfr+rBJGsGTyhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAMcyoxx4U0xxMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBACOoWSBf7b9AlcNrl4lr3QWWSc7k90/tUZal
+PlT0G3Obl2x9T/ZiBsQpbUvs0lfotG0XqGVVHcIxF38EbVwbw9KJGXbGSCJSEJkW
+vGCtc/jYMHXfhx67Szmftm/MTYNvnzsyQQ3v8y3Rdah+xe1NPdpFrwmfL6xe3pFF
+cY33KdHA/3PNLdn9CaEsHmcmj3ctaaXLFIzZhQyyjtsrgGfTLvXeXRokktvsLDS/
+YgKedQ+jFjzVJqgr4NjfY/Wt7/8kbbdhzaqlB5pCPjLLzv0zp/XmO6k+JvOePOGh
+JzGk5t1QrSju+MqNPFk3+1O7o910Vrhqw1QRB0gr1ExrviLbyfU=
+-----END CERTIFICATE-----`),
+	"us-east-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJALFpzEAVWaQZMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
+ODU5MTJaGA8yMTk1MDExNzA4NTkxMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAjS2vqZu9mEOhOq+0bRpAbCUiapbZMFNQqRg7kTlr7Cf+gDqXKpHPjsng
+SfNz+JHQd8WPI+pmNs+q0Z2aTe23klmf2U52KH9/j1k8RlIbap/yFibFTSedmegX
+E5r447GbJRsHUmuIIfZTZ/oRlpuIIO5/Vz7SOj22tdkdY2ADp7caZkNxhSP915fk
+2jJMTBUOzyXUS2rBU/ulNHbTTeePjcEkvzVYPahD30TeQ+/A+uWUu89bHSQOJR8h
+Um4cFApzZgN3aD5j2LrSMu2pctkQwf9CaWyVznqrsGYjYOY66LuFzSCXwqSnFBfv
+fFBAFsjCgY24G2DoMyYkF3MyZlu+rwIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUrynSPp4uqSECwy+PiO4qyJ8TWSkwgY4GA1UdIwSBhjCBg4AUrynS
+Pp4uqSECwy+PiO4qyJ8TWSmhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJALFpzEAVWaQZMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBADW/s8lXijwdP6NkEoH1m9XLrvK4YTqkNfR6
+er/uRRgTx2QjFcMNrx+g87gAml11z+D0crAZ5LbEhDMs+JtZYR3ty0HkDk6SJM85
+haoJNAFF7EQ/zCp1EJRIkLLsC7bcDL/Eriv1swt78/BB4RnC9W9kSp/sxd5svJMg
+N9a6FAplpNRsWAnbP8JBlAP93oJzblX2LQXgykTghMkQO7NaY5hg/H5o4dMPclTK
+lYGqlFUCH6A2vdrxmpKDLmTn5//5pujdD2MN0df6sZWtxwZ0osljV4rDjm9Q3VpA
+NWIsDEcp3GUB4proOR+C7PNkY+VGODitBOw09qBGosCBstwyEqY=
+-----END CERTIFICATE-----`),
+	"us-east-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJAM07oeX4xevdMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNjA2MTAx
+MjU4MThaGA8yMTk1MTExNDEyNTgxOFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA6v6kGMnRmFDLxBEqXzP4npnL65OO0kmQ7w8YXQygSdmNIoScGSU5wfh9
+mZdcvCxCdxgALFsFqPvH8fqiE9ttI0fEfuZvHOs8wUsIdKr0Zz0MjSx3cik4tKET
+ch0EKfMnzKOgDBavraCDeX1rUDU0Rg7HFqNAOry3uqDmnqtk00XC9GenS3z/7ebJ
+fIBEPAam5oYMVFpX6M6St77WdNE8wEU8SuerQughiMVx9kMB07imeVHBiELbMQ0N
+lwSWRL/61fA02keGSTfSp/0m3u+lesf2VwVFhqIJs+JbsEscPxOkIRlzy8mGd/JV
+ONb/DQpTedzUKLgXbw7KtO3HTG9iXQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU2CTGYE5fTjx7gQXzdZSGPEWAJY4wgY4GA1UdIwSBhjCBg4AU2CTG
+YE5fTjx7gQXzdZSGPEWAJY6hYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJAM07oeX4xevdMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBANdqkIpVypr2PveqUsAKke1wKCOSuw1UmH9k
+xX1/VRoHbrI/UznrXtPQOPMmHA2LKSTedwsJuorUn3cFH6qNs8ixBDrl8pZwfKOY
+IBJcTFBbI1xBEFkZoO3wczzo5+8vPQ60RVqAaYb+iCa1HFJpccC3Ovajfa4GRdNb
+n6FYnluIcDbmpcQePoVQwX7W3oOYLB1QLN7fE6H1j4TBIsFdO3OuKzmaifQlwLYt
+DVxVCNDabpOr6Uozd5ASm4ihPPoEoKo7Ilp0fOT6fZ41U2xWA4+HF/89UoygZSo7
+K+cQ90xGxJ+gmlYbLFR5rbJOLfjrgDAb2ogbFy8LzHo2ZtSe60M=
+-----END CERTIFICATE-----`),
+	"us-gov-east-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJALPB6hxFhay8MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xODA0MTAx
+MjMyNDlaGA8yMTk3MDkxMzEyMzI0OVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAva9xsI9237KYb/SPWmeCVzi7giKNron8hoRDwlwwMC9+uHPd53UxzKLb
+pTgtJWAPkZVxEdl2Gdhwr3SULoKcKmkqE6ltVFrVuPT33La1UufguT9k8ZDDuO9C
+hQNHUdSVEuVrK3bLjaSsMOS7Uxmnn7lYT990IReowvnBNBsBlcabfQTBV04xfUG0
+/m0XUiUFjOxDBqbNzkEIblW7vK7ydSJtFMSljga54UAVXibQt9EAIF7B8k9l2iLa
+mu9yEjyQy+ZQICTuAvPUEWe6va2CHVY9gYQLA31/zU0VBKZPTNExjaqK4j8bKs1/
+7dOV1so39sIGBz21cUBec1o+yCS5SwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBt
+hO2W/Lm+Nk0qsXW6mqQFsAou0cASc/vtGNCyBfoFNX6aKXsVCHxq2aq2TUKWENs+
+mKmYu1lZVhBOmLshyllh3RRoL3Ohp3jCwXytkWQ7ElcGjDzNGc0FArzB8xFyQNdK
+MNvXDi/ErzgrHGSpcvmGHiOhMf3UzChMWbIr6udoDlMbSIO7+8F+jUJkh4Xl1lKb
+YeN5fsLZp7T/6YvbFSPpmbn1YoE2vKtuGKxObRrhU3h4JHdp1Zel1pZ6lh5iM0ec
+SD11SximGIYCjfZpRqI3q50mbxCd7ckULz+UUPwLrfOds4VrVVSj+x0ZdY19Plv2
+9shw5ez6Cn7E3IfzqNHO
+-----END CERTIFICATE-----`),
+	"us-gov-west-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIDOzCCAiOgAwIBAgIJANCOF0Q6ohnuMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA5MTAx
+OTQyNDdaGA8yMTk1MDIxMzE5NDI0N1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAzIcGTzNqie3f1olrrqcfzGfbymSM2QfbTzDIOG6xXXeFrCDAmOq0wUhi
+3fRCuoeHlKOWAPu76B9os71+zgF22dIDEVkpqHCjBrGzDQZXXUwOzhm+PmBUI8Z1
+qvbVD4ZYhjCujWWzrsX6Z4yEK7PEFjtf4M4W8euw0RmiNwjy+knIFa+VxK6aQv94
+lW98URFP2fD84xedHp6ozZlr3+RZSIFZsOiyxYsgiwTbesRMI0Y7LnkKGCIHQ/XJ
+OwSISWaCddbu59BZeADnyhl4f+pWaSQpQQ1DpXvZAVBYvCH97J1oAxLfH8xcwgSQ
+/se3wtn095VBt5b7qTVjOvy6vKZazwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA/
+S8+a9csfASkdtQUOLsBynAbsBCH9Gykq2m8JS7YE4TGvqlpnWehz78rFTzQwmz4D
+fwq8byPkl6DjdF9utqZ0JUo/Fxelxom0h6oievtBlSkmZJNbgc2WYm1zi6ptViup
+Y+4S2+vWZyg/X1PXD7wyRWuETmykk73uEyeWFBYKCHWsO9sI+62O4Vf8Jkuj/cie
+1NSJX8fkervfLrZSHBYhxLbL+actVEo00tiyZz8GnhgWx5faCY38D/k4Y/j5Vz99
+7lUX/+fWHT3+lTL8ZZK7fOQWh6NQpI0wTP9KtWqfOUwMIbgFQPoxkP00TWRmdmPz
+WOwTObEf9ouTnjG9OZ20
+-----END CERTIFICATE-----`),
+	"us-west-1": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJANNPkIpcyEtIMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTEwMjkw
+OTAzMDdaGA8yMTk1MDQwMzA5MDMwN1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEApHQGvHvq3SVCzDrC7575BW7GWLzcj8CLqYcL3YY7Jffupz7OjcftO57Z
+4fo5Pj0CaS8DtPzh8+8vdwUSMbiJ6cDd3ooio3MnCq6DwzmsY+pY7CiI3UVG7KcH
+4TriDqr1Iii7nB5MiPJ8wTeAqX89T3SYaf6Vo+4GCb3LCDGvnkZ9TrGcz2CHkJsj
+AIGwgopFpwhIjVYm7obmuIxSIUv+oNH0wXgDL029Zd98SnIYQd/njiqkzE+lvXgk
+4h4Tu17xZIKBgFcTtWPky+POGu81DYFqiWVEyR2JKKm2/iR1dL1YsT39kbNg47xY
+aR129sS4nB5Vw3TRQA2jL0ToTIxzhQIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQUgepyiONs8j+q67dmcWu+mKKDa+gwgY4GA1UdIwSBhjCBg4AUgepy
+iONs8j+q67dmcWu+mKKDa+ihYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJANNPkIpcyEtIMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAGLFWyutf1u0xcAc+kmnMPqtc/Q6b79VIX0E
+tNoKMI2KR8lcV8ZElXDb0NC6v8UeLpe1WBKjaWQtEjL1ifKg9hdY9RJj4RXIDSK7
+33qCQ8juF4vep2U5TTBd6hfWxt1Izi88xudjixmbpUU4YKr8UPbmixldYR+BEx0u
+B1KJi9l1lxvuc/Igy/xeHOAZEjAXzVvHp8Bne33VVwMiMxWECZCiJxE4I7+Y6fqJ
+pLLSFFJKbNaFyXlDiJ3kXyePEZSc1xiWeyRB2ZbTi5eu7vMG4i3AYWuFVLthaBgu
+lPfHafJpj/JDcqt2vKUKfur5edQ6j1CGdxqqjawhOTEqcN8m7us=
+-----END CERTIFICATE-----`),
+	"us-west-2": []byte(`-----BEGIN CERTIFICATE-----
+MIIEEjCCAvqgAwIBAgIJALZL3lrQCSTMMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0
+dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0xNTA4MTQw
+OTAxMzJaGA8yMTk1MDExNzA5MDEzMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgT
+EFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA02Y59qtAA0a6uzo7nEQcnJ26OKF+LRPwZfixBH+EbEN/Fx0gYy1jpjCP
+s5+VRNg6/WbfqAsV6X2VSjUKN59ZMnMY9ALA/Ipz0n00Huxj38EBZmX/NdNqKm7C
+qWu1q5kmIvYjKGiadfboU8wLwLcHo8ywvfgI6FiGGsEO9VMC56E/hL6Cohko11LW
+dizyvRcvg/IidazVkJQCN/4zC9PUOVyKdhW33jXy8BTg/QH927QuNk+ZzD7HH//y
+tIYxDhR6TIZsSnRjz3bOcEHxt1nsidc65mY0ejQty4hy7ioSiapw316mdbtE+RTN
+fcH9FPIFKQNBpiqfAW5Ebp3Lal3/+wIDAQABo4HUMIHRMAsGA1UdDwQEAwIHgDAd
+BgNVHQ4EFgQU7coQx8Qnd75qA9XotSWT3IhvJmowgY4GA1UdIwSBhjCBg4AU7coQ
+x8Qnd75qA9XotSWT3IhvJmqhYKReMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBX
+YXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQ4IJALZL3lrQCSTMMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBAFZ1e2MnzRaXCaLwEC1pW/f0oRG8nHrlPZ9W
+OYZEWbh+QanRgaikBNDtVTwARQcZm3z+HWSkaIx3cyb6vM0DSkZuiwzm1LJ9rDPc
+aBm03SEt5v8mcc7sXWvgFjCnUpzosmky6JheCD4O1Cf8k0olZ93FQnTrbg62OK0h
+83mGCDeVKU3hLH97FYoUq+3N/IliWFDhvibAYYKFJydZLhIdlCiiB99AM6Sg53rm
+oukS3csyUxZyTU2hQfdjyo1nqW9yhvFAKjnnggiwxNKTTPZzstKW8+cnYwiiTwJN
+QpVoZdt0SfbuNnmwRUMi+QbuccXweav29QeQ3ADqjgB0CZdSRKk=
+-----END CERTIFICATE-----`),
+}
diff --git a/lib/join/ec2join/certs_test.go b/lib/join/ec2join/certs_test.go
new file mode 100644
index 0000000000000..2f7d16a906b39
--- /dev/null
+++ b/lib/join/ec2join/certs_test.go
@@ -0,0 +1,34 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ec2join
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestAWSCerts asserts that all certificates parse.
+func TestAWSCerts(t *testing.T) {
+	for _, certBytes := range awsRSA2048CertBytes {
+		certPEM, _ := pem.Decode(certBytes)
+		_, err := x509.ParseCertificate(certPEM.Bytes)
+		require.NoError(t, err)
+	}
+}
diff --git a/lib/join/ec2join/ec2.go b/lib/join/ec2join/ec2.go
new file mode 100644
index 0000000000000..f7bf53b6c999d
--- /dev/null
+++ b/lib/join/ec2join/ec2.go
@@ -0,0 +1,424 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ec2join
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"slices"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go/tracing/smithyoteltracing"
+	"github.com/digitorus/pkcs7"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/otel"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/services"
+	awsutils "github.com/gravitational/teleport/lib/utils/aws"
+	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+)
+
+type EC2Client interface {
+	DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error)
+}
+
+// ec2ClientFromConfig returns a new ec2 client from the given aws config, or
+// may load the client from the passed context if one has been set (for tests).
+func ec2ClientFromConfig(cfg aws.Config) EC2Client {
+	return ec2.NewFromConfig(cfg, func(o *ec2.Options) {
+		o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
+	})
+}
+
+// checkEC2AllowRules checks that the iid matches at least one of the allow
+// rules of the given token.
+func checkEC2AllowRules(ctx context.Context, params *CheckEC2RequestParams, iid *imds.InstanceIdentityDocument) error {
+	allowRules := params.ProvisionToken.GetAllowRules()
+	for _, rule := range allowRules {
+		// if this rule specifies an AWS account, the IID must match
+		if len(rule.AWSAccount) > 0 {
+			if rule.AWSAccount != iid.AccountID {
+				continue
+			}
+		}
+		// if this rule specifies any AWS regions, the IID must match one of them
+		if len(rule.AWSRegions) > 0 {
+			if !slices.Contains(rule.AWSRegions, iid.Region) {
+				continue
+			}
+		}
+		// iid matches this allow rule. Check if it is running.
+		return trace.Wrap(checkInstanceRunning(ctx, params, iid.InstanceID, iid.Region, rule.AWSRole))
+	}
+	return trace.AccessDenied("instance %v did not match any allow rules in token %v", iid.InstanceID, params.ProvisionToken.GetName())
+}
+
+func checkInstanceRunning(ctx context.Context, params *CheckEC2RequestParams, instanceID, region, IAMRole string) error {
+	ec2Client := params.EC2Client
+	if ec2Client == nil {
+		awsClientConfig, err := config.LoadDefaultConfig(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		awsClientConfig.Region = region
+
+		// assume the configured IAM role if necessary
+		if IAMRole != "" {
+			stsClient := stsutils.NewFromConfig(awsClientConfig, func(o *sts.Options) {
+				o.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
+			})
+			creds := stscreds.NewAssumeRoleProvider(stsClient, IAMRole)
+			awsClientConfig.Credentials = aws.NewCredentialsCache(creds)
+		}
+		ec2Client = ec2ClientFromConfig(awsClientConfig)
+	}
+
+	output, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{
+		InstanceIds: []string{instanceID},
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if len(output.Reservations) == 0 || len(output.Reservations[0].Instances) == 0 {
+		return trace.AccessDenied("failed to get instance state")
+	}
+	instance := output.Reservations[0].Instances[0]
+	if instance.InstanceId == nil || *instance.InstanceId != instanceID {
+		return trace.AccessDenied("failed to get instance state")
+	}
+	if instance.State == nil || instance.State.Name != ec2types.InstanceStateNameRunning {
+		return trace.AccessDenied("instance is not running")
+	}
+	return nil
+}
+
+// parseAndVerifyIID parses the given Instance Identity Document and checks that
+// the signature is valid.
+func parseAndVerifyIID(iidBytes []byte) (*imds.InstanceIdentityDocument, error) {
+	sigPEM := fmt.Sprintf("-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----", string(iidBytes))
+	sigBER, _ := pem.Decode([]byte(sigPEM))
+	if sigBER == nil {
+		return nil, trace.AccessDenied("unable to decode Instance Identity Document")
+	}
+
+	p7, err := pkcs7.Parse(sigBER.Bytes)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var iid imds.InstanceIdentityDocument
+	if err := json.Unmarshal(p7.Content, &iid); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rawCert, ok := awsRSA2048CertBytes[iid.Region]
+	if !ok {
+		return nil, trace.AccessDenied("unsupported EC2 region: %q", iid.Region)
+	}
+	certPEM, _ := pem.Decode(rawCert)
+	cert, err := x509.ParseCertificate(certPEM.Bytes)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	p7.Certificates = []*x509.Certificate{cert}
+	if err = p7.Verify(); err != nil {
+		return nil, trace.AccessDenied("invalid signature")
+	}
+
+	return &iid, nil
+}
+
+func checkPendingTime(iid *imds.InstanceIdentityDocument, provisionToken provision.Token, clock clockwork.Clock) error {
+	timeSinceInstanceStart := clock.Since(iid.PendingTime)
+	// Sanity check IID is not from the future. Allow 1 minute of clock drift.
+	if timeSinceInstanceStart < -1*time.Minute {
+		return trace.AccessDenied("Instance Identity Document PendingTime appears to be in the future")
+	}
+	ttl := time.Duration(provisionToken.GetAWSIIDTTL())
+	if timeSinceInstanceStart > ttl {
+		return trace.AccessDenied("Instance Identity Document with PendingTime %v is older than configured TTL of %v", iid.PendingTime, ttl)
+	}
+	return nil
+}
+
+func nodeExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	_, err := presence.GetNode(ctx, defaults.Namespace, hostID)
+	switch {
+	case trace.IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, trace.Wrap(err)
+	default:
+		return true, nil
+	}
+}
+
+func proxyExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	proxies, err := clientutils.CollectWithFallback(ctx, presence.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return presence.GetProxies()
+	})
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	for _, proxy := range proxies {
+		if proxy.GetName() == hostID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func kubeExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	kubes, err := presence.GetKubernetesServers(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	for _, kube := range kubes {
+		if kube.GetHostID() == hostID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func dbExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	dbs, err := presence.ListResources(ctx, proto.ListResourcesRequest{
+		ResourceType:        types.KindDatabaseService,
+		PredicateExpression: fmt.Sprintf("resource.metadata.name == %q", hostID),
+		Limit:               1,
+	})
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	return len(dbs.Resources) > 0, nil
+}
+
+func appExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	apps, err := presence.GetApplicationServers(ctx, defaults.Namespace)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	for _, app := range apps {
+		if app.GetHostID() == hostID && app.Origin() != types.OriginOkta {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func oktaExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	apps, err := presence.GetApplicationServers(ctx, defaults.Namespace)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	for _, app := range apps {
+		if app.GetHostID() == hostID && app.Origin() == types.OriginOkta {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func desktopServiceExists(ctx context.Context, presence services.Presence, hostID string) (bool, error) {
+	svcs, err := presence.GetWindowsDesktopServices(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	for _, wds := range svcs {
+		if wds.GetName() == hostID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func resourceExists(ctx context.Context, presence services.Presence, role types.SystemRole, hostID string) (bool, error) {
+	switch role {
+	case types.RoleNode:
+		return nodeExists(ctx, presence, hostID)
+	case types.RoleProxy:
+		return proxyExists(ctx, presence, hostID)
+	case types.RoleKube:
+		return kubeExists(ctx, presence, hostID)
+	case types.RoleApp:
+		return appExists(ctx, presence, hostID)
+	case types.RoleDatabase:
+		return dbExists(ctx, presence, hostID)
+	case types.RoleWindowsDesktop:
+		return desktopServiceExists(ctx, presence, hostID)
+	case types.RoleOkta:
+		return oktaExists(ctx, presence, hostID)
+	case types.RoleDiscovery, types.RoleMDM:
+		// No appropriate check exists for these roles.
+		return false, nil
+	default:
+		return false, trace.BadParameter("role %s is unsupported for the EC2 join method", role)
+	}
+}
+
+func roleHasPresenceCheck(role types.SystemRole) bool {
+	switch role {
+	case types.RoleNode, types.RoleProxy, types.RoleKube, types.RoleApp,
+		types.RoleDatabase, types.RoleWindowsDesktop, types.RoleOkta:
+		return true
+	}
+	return false
+}
+
+// tryToDetectIdentityReuse performs a best-effort check to see if the specified role+id combination
+// is already in use by an instance. This will only detect re-use in the case where a recent heartbeat
+// clearly shows the combination in use since teleport maintains no long-term per-instance state.
+func tryToDetectIdentityReuse(ctx context.Context, params *CheckEC2RequestParams, hostID string) error {
+	if params.Role == types.RoleInstance {
+		// There is no "Instance" heartbeat, instead this must check if there
+		// are any heartbeats for any of the system roles granted by this
+		// token.
+		if params.SkipInstanceReuseCheck {
+			// This check must be skipped if called via the legacy join
+			// endpoint, where the Instance role may join after another system
+			// role may have already joined and upserted a heartbeat.
+			return nil
+		}
+		for _, role := range params.ProvisionToken.GetRoles() {
+			if !roleHasPresenceCheck(role) {
+				// There are a couple system roles (Discovery, MDM) that we
+				// current allow to join via EC2 join method even though they
+				// don't have any presence check.
+				continue
+			}
+			alreadyExists, err := resourceExists(ctx, params.Presence, role, hostID)
+			if err != nil {
+				return trace.Wrap(err, "checking if %s with ID %s already exists", params.Role, hostID)
+			}
+			if alreadyExists {
+				return trace.AccessDenied("server with host ID %q and role %q already exists", hostID, role)
+			}
+		}
+		return nil
+	}
+	alreadyExists, err := resourceExists(ctx, params.Presence, params.Role, hostID)
+	if err != nil {
+		return trace.Wrap(err, "checking if %s with ID %s already exists", params.Role, hostID)
+	}
+	if alreadyExists {
+		return trace.AccessDenied("server with host ID %q and role %q already exists", hostID, params.Role)
+	}
+	return nil
+}
+
+// CheckEC2RequestParams holds parameters for checking an EC2-method join request.
+type CheckEC2RequestParams struct {
+	// ProvisionToken is the provision token being used.
+	ProvisionToken provision.Token
+	// Role is the system role being requested.
+	Role types.SystemRole
+	// Document is a signed EC2 Instance Identity Document.
+	Document []byte
+	// RequestedHostID should be set if the joining client explicitly requested
+	// a specific host ID.
+	RequestedHostID *string
+	// Presence is a presence service used to check for existence of resource heartbeats.
+	Presence services.Presence
+	// EC2Client is an optional client to use to check if EC2 instances are
+	// running, if nil a default client will be used.
+	EC2Client EC2Client
+	// SkipInstanceReuseCheck should be set to true if being called by the
+	// legacy join RPC where heartbeat presence checks must be skipped for join
+	// attempts with the Instance role.
+	SkipInstanceReuseCheck bool
+	// Clock is a clock to use for the check.
+	Clock clockwork.Clock
+}
+
+func (p *CheckEC2RequestParams) checkAndSetDefaults() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case p.Role == "":
+		return trace.BadParameter("Role is required")
+	case len(p.Document) == 0:
+		return trace.BadParameter("Document is required")
+	case p.Presence == nil:
+		return trace.BadParameter("Presence service is required")
+	case p.Clock == nil:
+		p.Clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// CheckEC2Request checks register requests which use EC2 Simplified Node
+// Joining. This method checks that:
+//  1. The given Instance Identity Document has a valid signature (signed by AWS).
+//  2. There is no obvious signs that a node already joined the cluster from this EC2 instance (to
+//     reduce the risk of re-use of a stolen Instance Identity Document).
+//  3. The signed instance attributes match one of the allow rules for the
+//     corresponding token.
+//
+// Returns the host ID for the node, or an error if any of the checks fail.
+func CheckEC2Request(ctx context.Context, params *CheckEC2RequestParams) (string, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return "", trace.AccessDenied("%s", err.Error())
+	}
+
+	iid, err := parseAndVerifyIID(params.Document)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	hostID := awsutils.NodeIDFromIID(iid)
+	if params.RequestedHostID != nil && *params.RequestedHostID != hostID {
+		return "", trace.AccessDenied("requested host ID does not match the Instance Identity Document")
+	}
+
+	if err := checkPendingTime(iid, params.ProvisionToken, params.Clock); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	if err := tryToDetectIdentityReuse(ctx, params, hostID); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	if err := checkEC2AllowRules(ctx, params, iid); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return hostID, nil
+}
diff --git a/lib/join/ec2join/fuzz_test.go b/lib/join/ec2join/fuzz_test.go
new file mode 100644
index 0000000000000..48e2dc215d25e
--- /dev/null
+++ b/lib/join/ec2join/fuzz_test.go
@@ -0,0 +1,71 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ec2join
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func FuzzParseAndVerifyIID(f *testing.F) {
+	f.Add([]byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
+23sKICAiYWNjb3VudElkIiA6ICIyNzg1NzYyMjA0NTMiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
+Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMmEiLAogICJiaWxsaW5nUHJv
+ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
+YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wZmE5ZTFmNjQxNDJj
+ZGUxNyIsCiAgImluc3RhbmNlSWQiIDogImktMDc4NTE3Y2E4YTcwYTFkZGUiLAogICJpbnN0YW5j
+ZVR5cGUiIDogInQyLm1lZGl1bSIsCiAgImtlcm5lbElkIiA6IG51bGwsCiAgInBlbmRpbmdUaW1l
+IiA6ICIyMDIxLTA5LTAzVDIxOjI1OjQ0WiIsCiAgInByaXZhdGVJcCIgOiAiMTAuMC4wLjIwOSIs
+CiAgInJhbWRpc2tJZCIgOiBudWxsLAogICJyZWdpb24iIDogInVzLXdlc3QtMiIsCiAgInZlcnNp
+b24iIDogIjIwMTctMDktMzAiCn0AAAAAAAAxggIvMIICKwIBATBpMFwxCzAJBgNVBAYTAlVTMRkw
+FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQwIJALZL3lrQCSTMMA0GCWCGSAFlAwQCAQUAoIGYMBgGCSqGSIb3
+DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIxMDkwMzIxMjU0N1owLQYJKoZIhvcN
+AQk0MSAwHjANBglghkgBZQMEAgEFAKENBgkqhkiG9w0BAQsFADAvBgkqhkiG9w0BCQQxIgQgCH2d
+JiKmdx9uhxlm8ObWAvFOhqJb7k79+DW/T3ezwVUwDQYJKoZIhvcNAQELBQAEggEANWautigs/qZ6
+w8g5/EfWsAFj8kHgUD+xqsQ1HDrBUx3IQ498NMBZ78379B8RBfuzeVjbaf+yugov0fYrDbGvSRRw
+myy49TfZ9gdlpWQXzwSg3OPMDNToRoKw00/LQjSxcTCaPP4vMDEIjYMUqZ3i4uWYJJJ0Lb7fDMDk
+Anu7yHolVfbnvIAuZe8lGpc7ofCSBG5wulm+/pqzO25YPMH1cLEvOadE+3N2GxK6gRTLJoE98rsm
+LDp6OuU/b2QfaxU0ec6OogdtSJto/URI0/ygHmNAzBis470A29yh5nVwm6AkY4krjPsK7uiBIRhs
+lr5x0X6+ggQfF2BKAJ/BRcAHNgAAAAAAAA==`))
+	f.Add([]byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
+3XsKICAiYWNjb3VudElkIiA6ICI4ODM0NzQ2NjI4ODgiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
+Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMWMiLAogICJiaWxsaW5nUHJv
+ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
+YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wY2UzYzU1YTMxZDI5
+MDQwZSIsCiAgImluc3RhbmNlSWQiIDogImktMDFiOTQwYzQ1ZmQxMWZlNzQiLAogICJpbnN0YW5j
+ZVR5cGUiIDogInQyLm1pY3JvIiwKICAia2VybmVsSWQiIDogbnVsbCwKICAicGVuZGluZ1RpbWUi
+IDogIjIwMjEtMDktMTFUMDA6MTQ6MThaIiwKICAicHJpdmF0ZUlwIiA6ICIxNzIuMzEuMTIuMjUx
+IiwKICAicmFtZGlza0lkIiA6IG51bGwsCiAgInJlZ2lvbiIgOiAidXMtd2VzdC0xIiwKICAidmVy
+c2lvbiIgOiAiMjAxNy0wOS0zMCIKfQAAAAAAADGCAi8wggIrAgEBMGkwXDELMAkGA1UEBhMCVVMx
+GTAXBgNVBAgTEFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDAgkA00+QilzIS0gwDQYJYIZIAWUDBAIBBQCggZgwGAYJKoZI
+hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjEwOTExMDAxNDIyWjAtBgkqhkiG
+9w0BCTQxIDAeMA0GCWCGSAFlAwQCAQUAoQ0GCSqGSIb3DQEBCwUAMC8GCSqGSIb3DQEJBDEiBCDS
+1gNvxbYnEL6plVu8X/QmKPJFJwIJfi+2hIVjyKAOtjANBgkqhkiG9w0BAQsFAASCAQABKmghATg8
+VXkdiIGcTIPfKrc2v/zEIdLUAi+Ew5lrGUVjnNqrP9irGK4d9sVtcu/8UKp9RDoeJOQ6I/pRcwvT
+PJVHlhGnLyybr5ZVqkxiC09GASNnPe12dzCKkKD2rvW6mGR91cxpM94Xqi5UA/ZRqiXwpHo3LECN
+Gu38Hpdv6sBgD/av2Ohd+vEH2zvYVkp7ZfnFuDLWRSBQZgmKwVKVdOjrMmP32vb3vzhMBuOj+jbQ
+RwEmYIkRaEGNbrZgatjMJYmTWuLG26zws3avOK6kL6u38DV3wJPVB/G0Ira5MvC/ojGya+DrVngW
+VUP+3jgenPrd7OyCWPSwOoOBMhSlAAAAAAAA`))
+	f.Fuzz(func(t *testing.T, iidBytes []byte) {
+		require.NotPanics(t, func() {
+			parseAndVerifyIID(iidBytes)
+		})
+	})
+}
diff --git a/lib/join/env0/env0.go b/lib/join/env0/env0.go
new file mode 100644
index 0000000000000..f330794d87587
--- /dev/null
+++ b/lib/join/env0/env0.go
@@ -0,0 +1,131 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package env0
+
+import (
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+)
+
+// IDTokenClaims are the additional custom claims provided by Env0 for their
+// issued OIDC tokens. See also:
+// https://docs.envzero.com/guides/integrations/oidc-integrations
+// Example token claims:
+//
+//	{
+//	  "apiKeyType": "oidc",
+//	  "aud": "https://prod.env0.com",
+//	  "azp": "hoMiq9PdkRh9LUvVpH4wIErWg50VSG1b",
+//	  "deployerEmail": "user@email.com",
+//	  "deploymentLogId": "4224831d-05c4-4548-841d-d61988e179cb",
+//	  "deploymentType": "deploy",
+//	  "environmentId": "50aa6e65-2956-4984-aab3-27af9dcc06dc",
+//	  "environmentName": "teleport-env0-demo",
+//	  "exp": 1761193071,
+//	  "gty": "password",
+//	  "https://aws.amazon.com/tags": {
+//	    "principal_tags": {
+//	      "deployerEmail": ["user@email.com"],
+//	      "deploymentType": ["deploy"],
+//	      "environmentId": ["50aa6e65-2956-4984-aab3-27af9dcc06dc"],
+//	      "organizationId": ["948de0c4-94d6-4ad6-8e56-1374353e9a38"],
+//	      "projectId": ["df15f983-808a-49c7-bc91-910cb10411ec"],
+//	      "templateId": ["00d81864-757c-4449-a91c-cf6bee07e44a"]
+//	    }
+//	  },
+//	  "https://env0.com/apiKeyType": "oidc",
+//	  "https://env0.com/deployerEmail": "user@email.com",
+//	  "https://env0.com/deploymentLogId": "4224831d-05c4-4548-841d-d61988e179cb",
+//	  "https://env0.com/deploymentType": "deploy",
+//	  "https://env0.com/environmentId": "50aa6e65-2956-4984-aab3-27af9dcc06dc",
+//	  "https://env0.com/environmentName": "teleport-env0-demo",
+//	  "https://env0.com/organization": "948de0c4-94d6-4ad6-8e56-1374353e9a38",
+//	  "https://env0.com/organizationId": "948de0c4-94d6-4ad6-8e56-1374353e9a38",
+//	  "https://env0.com/projectId": "df15f983-808a-49c7-bc91-910cb10411ec",
+//	  "https://env0.com/projectName": "My First Project",
+//	  "https://env0.com/templateId": "00d81864-757c-4449-a91c-cf6bee07e44a",
+//	  "https://env0.com/templateName": "single-use-template-for-teleport-env0-demo",
+//	  "https://env0.com/workspaceName": "teleport-env0-demo-000000",
+//	  "iat": 1761106671,
+//	  "iss": "https://login.app.env0.com/",
+//	  "organization": "948de0c4-94d6-4ad6-8e56-1374353e9a38",
+//	  "organizationId": "948de0c4-94d6-4ad6-8e56-1374353e9a38",
+//	  "projectId": "df15f983-808a-49c7-bc91-910cb10411ec",
+//	  "projectName": "My First Project",
+//	  "sub": "auth0|68f8497fe94b94dab2324697",
+//	  "templateId": "00d81864-757c-4449-a91c-cf6bee07e44a",
+//	  "templateName": "single-use-template-for-teleport-env0-demo",
+//	  "workspaceName": "teleport-env0-demo-000000"
+//	}
+type IDTokenClaims struct {
+	oidc.TokenClaims
+
+	// OrganizationID is a unique identifier for the organization. Corresponds
+	// to `organizationId`.
+	OrganizationID string `json:"organizationId"`
+	// ProjectID is a unique identifier for the project. Corresponds to
+	// `projectId`.
+	ProjectID string `json:"projectId"`
+	// ProjectName is the name of the project. Corresponds to `projectName`.
+	ProjectName string `json:"projectName"`
+	// TemplateID is a unique identifier for the template. Corresponds to
+	// `templateId`.
+	TemplateID string `json:"templateId"`
+	// TemplateName is the name of the template. Corresponds to `templateName`.
+	TemplateName string `json:"templateName"`
+	// EnvironmentID is a unique identifier for the environment. Corresponds to
+	// `environmentId`.
+	EnvironmentID string `json:"environmentId"`
+	// EnvironmentName is the name of the environment. Corresponds to
+	// `environmentName`.
+	EnvironmentName string `json:"environmentName"`
+	// WorkspaceName is the name of the workspace. Corresponds to
+	// `workspaceName`.
+	WorkspaceName string `json:"workspaceName"`
+	// DeploymentLogID is a unique identifier for this deployment. Corresponds
+	// to `deploymentLogId`.
+	DeploymentLogID string `json:"deploymentLogId"`
+	// DeploymentType is the type of this deployment. Corresponds to
+	// `deploymentType`.
+	DeploymentType string `json:"deploymentType"`
+	// DeployerEmail is the email of the user that started this deployment.
+	// Corresponds to `deployerEmail`.
+	DeployerEmail string `json:"deployerEmail"`
+	// Env0Tag is an optional custom tag. Corresponds to `env0Tag`.
+	Env0Tag string `json:"env0Tag"`
+}
+
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsEnv0 {
+	return &workloadidentityv1pb.JoinAttrsEnv0{
+		Sub:             c.Subject,
+		OrganizationId:  c.OrganizationID,
+		ProjectId:       c.ProjectID,
+		ProjectName:     c.ProjectName,
+		TemplateId:      c.TemplateID,
+		TemplateName:    c.TemplateName,
+		EnvironmentId:   c.EnvironmentID,
+		EnvironmentName: c.EnvironmentName,
+		WorkspaceName:   c.WorkspaceName,
+		DeploymentLogId: c.DeploymentLogID,
+		DeploymentType:  c.DeploymentType,
+		DeployerEmail:   c.DeployerEmail,
+		Env0Tag:         c.Env0Tag,
+	}
+}
diff --git a/lib/join/env0/token_source.go b/lib/join/env0/token_source.go
new file mode 100644
index 0000000000000..d12119595fc63
--- /dev/null
+++ b/lib/join/env0/token_source.go
@@ -0,0 +1,55 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package env0
+
+import (
+	"github.com/gravitational/trace"
+)
+
+type envGetter func(key string) string
+
+// IDTokenSource allows a Env0 OIDC token to be fetched whilst within a job
+// execution.
+type IDTokenSource struct {
+	getEnv envGetter
+}
+
+// GetIDToken fetches an Env0 JWT from the local node's environment
+func (its *IDTokenSource) GetIDToken() (string, error) {
+	name := "ENV0_OIDC_TOKEN"
+
+	tok := its.getEnv(name)
+	if tok == "" {
+
+		return "", trace.BadParameter(
+			"%s environment variable missing, ensure 'Enable OIDC during deployments' is enabled in the workspace",
+			name,
+		)
+	}
+
+	return tok, nil
+}
+
+// NewIDTokenSource creates a new Env0 ID token source with the given audience
+// tag.
+func NewIDTokenSource(getEnv envGetter) *IDTokenSource {
+	return &IDTokenSource{
+		getEnv,
+	}
+}
diff --git a/lib/join/env0/validator.go b/lib/join/env0/validator.go
new file mode 100644
index 0000000000000..a83e9541550ca
--- /dev/null
+++ b/lib/join/env0/validator.go
@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package env0
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/client/rp"
+
+	"github.com/gravitational/teleport/lib/oidc"
+)
+
+const (
+	// env0IssuerURL is the env0 public issuer URL
+	env0IssuerURL = "https://login.app.env0.com/"
+
+	// env0Audience is the audience for the token. This is unfortunately hard
+	// coded.
+	env0Audience = "https://prod.env0.com"
+)
+
+// IDTokenValidator can be used to validate env0 OIDC tokens.
+type IDTokenValidator struct {
+	validator *oidc.CachingTokenValidator[*IDTokenClaims]
+}
+
+// ValidateToken validates an env0 OIDC token using a remote, cached OIDC
+// endpoint
+func (v *IDTokenValidator) ValidateToken(
+	ctx context.Context,
+	token []byte,
+) (*IDTokenClaims, error) {
+	validator, err := v.validator.GetValidator(ctx, env0IssuerURL, env0Audience)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Env0 issues tokens with a randomized azp, which we can't verify. It's
+	// an optional check, so we'll disable it.
+	withoutAZPVerifier := rp.WithAZPVerifier(func(string) error {
+		return nil
+	})
+
+	claims, err := validator.ValidateToken(ctx, string(token), withoutAZPVerifier)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating OIDC token")
+	}
+
+	return claims, nil
+}
+
+// NewOIDCTokenValidator constructs a KubernetesOIDCTokenValidator.
+func NewIDTokenValidator() (*IDTokenValidator, error) {
+	validator, err := oidc.NewCachingTokenValidator[*IDTokenClaims](clockwork.NewRealClock())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &IDTokenValidator{
+		validator: validator,
+	}, nil
+}
diff --git a/lib/join/gcp/gcp.go b/lib/join/gcp/gcp.go
new file mode 100644
index 0000000000000..c0a2ca9cb2725
--- /dev/null
+++ b/lib/join/gcp/gcp.go
@@ -0,0 +1,224 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gcp
+
+import (
+	"context"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "gcp")
+
+// Validator is an interface for GCP token validators, used in tests to provide
+// mock implementations.
+type Validator interface {
+	Validate(ctx context.Context, token string) (*IDTokenClaims, error)
+}
+
+// defaultIssuerHost is the issuer for GCP ID tokens.
+const defaultIssuerHost = "accounts.google.com"
+
+// ComputeEngine contains VM-specific token claims.
+type ComputeEngine struct {
+	// The ID of the instance's project.
+	ProjectID string `json:"project_id"`
+	// The instance's zone.
+	Zone string `json:"zone"`
+	// The instance's ID.
+	InstanceID string `json:"instance_id"`
+	// The instance's name.
+	InstanceName string `json:"instance_name"`
+}
+
+// Google contains Google-specific token claims.
+type Google struct {
+	ComputeEngine ComputeEngine `json:"compute_engine"`
+}
+
+// IDTokenClaims is the set of claims in a GCP ID token. GCP documentation for
+// claims can be found at
+// https://cloud.google.com/compute/docs/instances/verifying-instance-identity#payload
+type IDTokenClaims struct {
+	oidc.TokenClaims
+	// The email of the service account that this token was issued for.
+	Email  string `json:"email"`
+	Google Google `json:"google"`
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGCP {
+	attrs := &workloadidentityv1pb.JoinAttrsGCP{
+		ServiceAccount: c.Email,
+	}
+	if c.Google.ComputeEngine.InstanceName != "" {
+		attrs.Gce = &workloadidentityv1pb.JoinAttrsGCPGCE{
+			Project: c.Google.ComputeEngine.ProjectID,
+			Zone:    c.Google.ComputeEngine.Zone,
+			Id:      c.Google.ComputeEngine.InstanceID,
+			Name:    c.Google.ComputeEngine.InstanceName,
+		}
+	}
+
+	return attrs
+}
+
+// CheckIDTokenParams are parameters used to validate GCP OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Validator      Validator
+}
+
+func (p *CheckIDTokenParams) validate() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	}
+	return nil
+}
+
+// CheckIDToken verifies a GCP OIDC token
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*IDTokenClaims, error) {
+	if err := params.validate(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("gcp join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	claims, err := params.Validator.Validate(ctx, string(params.IDToken))
+	if err != nil {
+		log.WarnContext(ctx, "Unable to validate GCP IDToken",
+			"error", err,
+			"claims", claims,
+			"token", params.ProvisionToken.GetName(),
+		)
+		return nil, trace.Wrap(err)
+	}
+
+	log.InfoContext(ctx, "GCP VM trying to join cluster",
+		"claims", claims,
+		"token", params.ProvisionToken.GetName(),
+	)
+
+	// Note: try to return claims even in case of error to improve logging on
+	// failed auth attempts.
+	return claims, trace.Wrap(checkGCPAllowRules(token, claims))
+}
+
+func checkGCPAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	compute := claims.Google.ComputeEngine
+	// unmatchedLocation is true if the location restriction is set and the "google.compute_engine.zone"
+	// claim is not present in the IDToken. This happens when the joining node is not a GCE VM.
+	unmatchedLocation := false
+	// If a single rule passes, accept the IDToken.
+	for _, rule := range token.Spec.GCP.Allow {
+		if !slices.Contains(rule.ProjectIDs, compute.ProjectID) {
+			continue
+		}
+
+		if len(rule.ServiceAccounts) > 0 && !slices.Contains(rule.ServiceAccounts, claims.Email) {
+			continue
+		}
+
+		if len(rule.Locations) > 0 && !slices.ContainsFunc(rule.Locations, func(location string) bool {
+			return isGCPZoneInLocation(location, compute.Zone)
+		}) {
+			unmatchedLocation = true
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	// If the location restriction is set and the "google.compute_engine.zone" claim is not present in the IDToken,
+	// return a more specific error message.
+	if unmatchedLocation && compute.Zone == "" {
+		return trace.CompareFailed("id token %q claim is empty and didn't match the %q. "+
+			"Services running outside of GCE VM instances are incompatible with %q restriction.", "google.compute_engine.zone", "locations", "location")
+	}
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
+
+type gcpLocation struct {
+	globalLocation string
+	region         string
+	zone           string
+}
+
+func parseGCPLocation(location string) (*gcpLocation, error) {
+	parts := strings.Split(location, "-")
+	if len(parts) < 2 || len(parts) > 3 {
+		return nil, trace.BadParameter("location %q is not a valid GCP region or zone", location)
+	}
+	globalLocation, region := parts[0], parts[1]
+	var zone string
+	if len(parts) == 3 {
+		zone = parts[2]
+	}
+	return &gcpLocation{
+		globalLocation: globalLocation,
+		region:         region,
+		zone:           zone,
+	}, nil
+}
+
+// isGCPZoneInLocation checks if a zone belongs to a location, which can be
+// either a zone or region.
+func isGCPZoneInLocation(rawLocation, rawZone string) bool {
+	location, err := parseGCPLocation(rawLocation)
+	if err != nil {
+		return false
+	}
+	zone, err := parseGCPLocation(rawZone)
+	if err != nil {
+		return false
+	}
+	// Make sure zone is, in fact, a zone.
+	if zone.zone == "" {
+		return false
+	}
+
+	if location.globalLocation != zone.globalLocation || location.region != zone.region {
+		return false
+	}
+	return location.zone == "" || location.zone == zone.zone
+}
diff --git a/lib/join/gcp/gcp_test.go b/lib/join/gcp/gcp_test.go
new file mode 100644
index 0000000000000..3beb9b6eb03c8
--- /dev/null
+++ b/lib/join/gcp/gcp_test.go
@@ -0,0 +1,97 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gcp
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsGCPZoneInLocation(t *testing.T) {
+	t.Parallel()
+	passingCases := []struct {
+		name     string
+		location string
+		zone     string
+	}{
+		{
+			name:     "matching zone",
+			location: "us-west1-b",
+			zone:     "us-west1-b",
+		},
+		{
+			name:     "matching region",
+			location: "us-west1",
+			zone:     "us-west1-b",
+		},
+	}
+	for _, tc := range passingCases {
+		t.Run("accept "+tc.name, func(t *testing.T) {
+			require.True(t, isGCPZoneInLocation(tc.location, tc.zone))
+		})
+	}
+
+	failingCases := []struct {
+		name     string
+		location string
+		zone     string
+	}{
+		{
+			name:     "non-matching zone",
+			location: "europe-southwest1-b",
+			zone:     "us-west1-b",
+		},
+		{
+			name:     "non-matching region",
+			location: "europe-southwest1",
+			zone:     "us-west1-b",
+		},
+		{
+			name:     "malformed location",
+			location: "us",
+			zone:     "us-west1-b",
+		},
+		{
+			name:     "similar but non-matching region",
+			location: "europe-west1",
+			zone:     "europe-west12-a",
+		},
+		{
+			name:     "empty zone",
+			location: "us-west1",
+			zone:     "",
+		},
+		{
+			name:     "empty location",
+			location: "",
+			zone:     "us-west1-b",
+		},
+		{
+			name:     "invalid zone",
+			location: "us-west1",
+			zone:     "us-west1",
+		},
+	}
+	for _, tc := range failingCases {
+		t.Run("reject "+tc.name, func(t *testing.T) {
+			require.False(t, isGCPZoneInLocation(tc.location, tc.zone))
+		})
+	}
+}
diff --git a/lib/join/gcp/token_validator.go b/lib/join/gcp/token_validator.go
new file mode 100644
index 0000000000000..2046007c89141
--- /dev/null
+++ b/lib/join/gcp/token_validator.go
@@ -0,0 +1,121 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gcp
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/client/rp"
+
+	"github.com/gravitational/teleport/lib/oidc"
+)
+
+const audience = "teleport.cluster.local"
+
+// IDTokenValidatorConfig is the config for IDTokenValidator.
+type IDTokenValidatorConfig struct {
+	// issuerHost is the host of the Issuer for tokens issued by Google, to be
+	// overridden in tests. Defaults to "accounts.google.com".
+	issuerHost string
+	// insecure configures the validator to use HTTP rather than HTTPS, to be
+	// overridden in tests.
+	insecure bool
+}
+
+// IDTokenValidator validates ID tokens from GCP.
+type IDTokenValidator struct {
+	IDTokenValidatorConfig
+}
+
+func NewIDTokenValidator(cfg IDTokenValidatorConfig) *IDTokenValidator {
+	if cfg.issuerHost == "" {
+		cfg.issuerHost = defaultIssuerHost
+	}
+	return &IDTokenValidator{
+		IDTokenValidatorConfig: cfg,
+	}
+}
+
+func (id *IDTokenValidator) issuerURL() string {
+	scheme := "https"
+	if id.insecure {
+		scheme = "http"
+	}
+	return fmt.Sprintf("%s://%s", scheme, id.issuerHost)
+}
+
+// Validate validates an ID token.
+func (id *IDTokenValidator) Validate(ctx context.Context, token string) (*IDTokenClaims, error) {
+	issuer := id.issuerURL()
+
+	// GCP issues service account IDTokens with the `azp` claim set to the same
+	// value as the `sub` claim, rather than the `aud` claim. The `azp` check is
+	// optional, so we skip it in this non-standard case.
+	// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+	withoutAZPVerifier := rp.WithAZPVerifier(func(string) error {
+		return nil
+	})
+
+	claims, err := oidc.ValidateToken[*IDTokenClaims](ctx, issuer, audience, token, withoutAZPVerifier)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating token")
+	}
+
+	if claims.Google.ComputeEngine != (ComputeEngine{}) {
+		return claims, nil
+	}
+
+	if gcpDefaultServiceAccountEmailRegex.MatchString(claims.Email) {
+		return nil, trace.BadParameter("default compute engine service account %q is not supported", claims.Email)
+	}
+
+	// GKE Workload Identity tokens do not have the `google.compute_engine` claim
+	// and so to support Teleport services running on GKE, we need to extract the
+	// project ID from the email claim.
+	// Managed Service accounts running on GKE are not guaranteed to have domain emails
+	// with the following format: <sa_name>@<project_id>.iam.gserviceaccount.com
+	// See https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to_other_services
+	// See https://cloud.google.com/iam/docs/service-accounts#service_account_email_addresses
+	// See https://cloud.google.com/iam/docs/service-account-types#user-managed
+	matches := gcpUserManagedServiceAccountEmailRegex.FindStringSubmatch(claims.Email)
+	if len(matches) != 2 {
+		return nil, trace.BadParameter("invalid email claim: %q", claims.Email)
+	}
+
+	// Assign the project ID exatracted from the email to the Google claims.
+	claims.Google.ComputeEngine.ProjectID = matches[1]
+
+	return claims, nil
+}
+
+var (
+	// gcpUserManagedServiceAccountEmailRegex is the regex used to extract the project ID from
+	// the email claim of a GCP service account.
+	// See https://cloud.google.com/iam/docs/service-accounts#service_account_email_addresses
+	// See https://cloud.google.com/iam/docs/service-account-types#user-managed
+	gcpUserManagedServiceAccountEmailRegex = regexp.MustCompile(`(?s)^[^@]+@([^\.]+)\.iam\.gserviceaccount\.com$`)
+
+	// gcpDefaultServiceAccountEmailRegex is the regex used to identify when the default
+	// compute engine service account is being used. When this is the case, we return an
+	// error because the default compute engine service account is not supported.
+	gcpDefaultServiceAccountEmailRegex = regexp.MustCompile(`(?s)^[^@]+@developer\.gserviceaccount\.com$`)
+)
diff --git a/lib/join/gcp/token_validator_test.go b/lib/join/gcp/token_validator_test.go
new file mode 100644
index 0000000000000..70a12d66c0b1c
--- /dev/null
+++ b/lib/join/gcp/token_validator_test.go
@@ -0,0 +1,375 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gcp
+
+import (
+	"context"
+	"crypto"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
+
+type fakeIDP struct {
+	t         *testing.T
+	signer    jose.Signer
+	publicKey crypto.PublicKey
+	server    *httptest.Server
+}
+
+func newFakeIDP(t *testing.T) *fakeIDP {
+	// GCP uses RSA, prefer to test with it.
+	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA2048)
+	require.NoError(t, err)
+
+	signer, err := jose.NewSigner(
+		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
+		(&jose.SignerOptions{}).WithType("JWT"),
+	)
+	require.NoError(t, err)
+
+	f := &fakeIDP{
+		signer:    signer,
+		publicKey: privateKey.Public(),
+		t:         t,
+	}
+
+	providerMux := http.NewServeMux()
+	providerMux.HandleFunc(
+		"/.well-known/openid-configuration",
+		f.handleOpenIDConfig,
+	)
+	providerMux.HandleFunc(
+		"/.well-known/jwks",
+		f.handleJWKSEndpoint,
+	)
+
+	srv := httptest.NewServer(providerMux)
+	t.Cleanup(srv.Close)
+	f.server = srv
+	return f
+}
+
+func (f *fakeIDP) issuer() string {
+	return f.server.URL
+}
+
+func (f *fakeIDP) handleOpenIDConfig(w http.ResponseWriter, r *http.Request) {
+	response := map[string]interface{}{
+		"claims_supported": []string{
+			"sub",
+			"aud",
+			"exp",
+			"iat",
+			"iss",
+			"azp",
+			"email",
+			"google",
+		},
+		"id_token_signing_alg_values_supported": []string{"RS256"},
+		"issuer":                                f.issuer(),
+		"jwks_uri":                              f.issuer() + "/.well-known/jwks",
+		"response_types_supported":              []string{"id_token"},
+		"scopes_supported":                      []string{"openid"},
+		"subject_types_supported":               []string{"public", "pairwise"},
+	}
+	responseBytes, err := json.Marshal(response)
+	require.NoError(f.t, err)
+	_, err = w.Write(responseBytes)
+	require.NoError(f.t, err)
+}
+
+func (f *fakeIDP) handleJWKSEndpoint(w http.ResponseWriter, r *http.Request) {
+	jwks := jose.JSONWebKeySet{
+		Keys: []jose.JSONWebKey{
+			{
+				Key: f.publicKey,
+			},
+		},
+	}
+	responseBytes, err := json.Marshal(jwks)
+	require.NoError(f.t, err)
+	_, err = w.Write(responseBytes)
+	require.NoError(f.t, err)
+}
+
+func (f *fakeIDP) issueToken(
+	t *testing.T,
+	issuer,
+	audience,
+	sub string,
+	claims IDTokenClaims,
+	issuedAt time.Time,
+	expiry time.Time,
+) string {
+	stdClaims := jwt.Claims{
+		Issuer:    issuer,
+		Subject:   sub,
+		Audience:  jwt.Audience{audience},
+		IssuedAt:  jwt.NewNumericDate(issuedAt),
+		NotBefore: jwt.NewNumericDate(issuedAt),
+		Expiry:    jwt.NewNumericDate(expiry),
+	}
+	// GCP ID tokens have an "azp" claim that is the same as the "sub" claim.
+	// This azp is not included in the "aud" claim. It's a little murky whether
+	// this is spec-compliant. We should explicitly reproduce this in our tests
+	// since zealous oidc validation implementations may reject it.
+	claims.AuthorizedParty = sub
+	token, err := jwt.Signed(f.signer).
+		Claims(stdClaims).
+		Claims(claims).
+		CompactSerialize()
+	require.NoError(t, err)
+
+	return token
+}
+
+func TestIDTokenValidator_Validate(t *testing.T) {
+	t.Parallel()
+	idp := newFakeIDP(t)
+	clock := clockwork.NewFakeClock()
+
+	sampleCE := IDTokenClaims{
+		Google: Google{
+			ComputeEngine: ComputeEngine{
+				ProjectID:    "12345678",
+				Zone:         "z",
+				InstanceID:   "87654321",
+				InstanceName: "test-instance",
+			},
+		},
+	}
+	tests := []struct {
+		name        string
+		assertError require.ErrorAssertionFunc
+		want        IDTokenClaims
+		token       string
+	}{
+		{
+			name:        "success",
+			assertError: require.NoError,
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				sampleCE,
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+			want: sampleCE,
+		},
+		{
+			name:        "success but without compute engine claims",
+			assertError: require.NoError,
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.com",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+			want: IDTokenClaims{
+				Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.com",
+				Google: Google{
+					ComputeEngine: ComputeEngine{
+						ProjectID: "project-id",
+					},
+				},
+			},
+		},
+		{
+			name: "default service account: @developer.gserviceaccount.com domain",
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err, i...)
+				require.Contains(tt, err.Error(), "default compute engine service account")
+			},
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "tiago-1-sa-test2@developer.gserviceaccount.com",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name: "invalid service account email: gserviceaccount.com domain",
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err, i...)
+				require.Contains(tt, err.Error(), "invalid email claim")
+			},
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "tiago-1-sa-test2@project-id.gserviceaccount.coma",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name: "invalid service account email: gserviceaccount.coma domain",
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err, i...)
+				require.Contains(tt, err.Error(), "invalid email claim")
+			},
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "tiago-1-sa-test2@project-id.iam.gserviceaccount.coma",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name: "invalid service account email: google domain",
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err, i...)
+				require.Contains(tt, err.Error(), "invalid email claim")
+			},
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "tiago-1-sa-test2@project-id.iam.google.com",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name: "empty service account email",
+			assertError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err, i...)
+				require.Contains(tt, err.Error(), "invalid email claim")
+			},
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				IDTokenClaims{
+					Email: "",
+				},
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name:        "expired",
+			assertError: require.Error,
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				sampleCE,
+				clock.Now().Add(-15*time.Minute),
+				clock.Now().Add(-5*time.Minute),
+			),
+		},
+		{
+			name:        "future",
+			assertError: require.Error,
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"teleport.cluster.local",
+				"abcd1234",
+				sampleCE,
+				clock.Now().Add(10*time.Minute),
+				clock.Now().Add(20*time.Minute),
+			),
+		},
+		{
+			name:        "invalid audience",
+			assertError: require.Error,
+			token: idp.issueToken(
+				t,
+				idp.issuer(),
+				"incorrect.audience",
+				"abcd1234",
+				sampleCE,
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+		{
+			name:        "invalid issuer",
+			assertError: require.Error,
+			token: idp.issueToken(
+				t,
+				"http://the.wrong.issuer",
+				"teleport.cluster.local",
+				"abcd1234",
+				sampleCE,
+				clock.Now().Add(-5*time.Minute),
+				clock.Now().Add(5*time.Minute),
+			),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			v := NewIDTokenValidator(IDTokenValidatorConfig{
+				issuerHost: idp.server.Listener.Addr().String(),
+				insecure:   true,
+			})
+			claims, err := v.Validate(ctx, tc.token)
+			tc.assertError(t, err)
+			if err != nil {
+				return
+			}
+			require.NotNil(t, claims)
+			require.Empty(t,
+				cmp.Diff(*claims, tc.want, cmpopts.IgnoreTypes(oidc.TokenClaims{})),
+			)
+		})
+	}
+}
diff --git a/lib/join/githubactions/githubactions.go b/lib/join/githubactions/githubactions.go
new file mode 100644
index 0000000000000..b91cfdae55419
--- /dev/null
+++ b/lib/join/githubactions/githubactions.go
@@ -0,0 +1,267 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package githubactions
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/services"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "githubactions")
+
+// GitHub Workload Identity
+//
+// GH provides workloads with two environment variables to facilitate fetching
+// a ID token for that workload.
+//
+// ACTIONS_ID_TOKEN_REQUEST_TOKEN: A token that can be redeemed against the
+// identity service for an ID token.
+// ACTIONS_ID_TOKEN_REQUEST_URL: Indicates the URL of the identity service.
+//
+// To redeem the request token for an ID token, a GET request shall be made
+// to the specified URL with the specified token provided as a Bearer token
+// using the Authorization header.
+//
+// The `audience` query parameter can be used to customize the audience claim
+// within the resulting ID token.
+//
+// Valuable reference:
+// - https://github.com/actions/toolkit/blob/main/packages/core/src/oidc-utils.ts
+// - https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers
+//
+// The GitHub Issuer's well-known OIDC document is at
+// https://token.actions.githubusercontent.com/.well-known/openid-configuration
+// For GitHub Enterprise Servers, this will be at
+// https://$HOSTNAME/_services/token/.well-known/openid-configuration
+
+const DefaultIssuerHost = "token.actions.githubusercontent.com"
+
+// IDTokenClaims is the structure of claims contained within a Github issued
+// ID token.
+//
+// See the following for the structure:
+// https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token
+type IDTokenClaims struct {
+	oidc.TokenClaims
+	// Sub also known as Subject is a string that roughly uniquely indentifies
+	// the workload. The format of this varies depending on the type of
+	// github action run.
+	Sub string `json:"sub"`
+	// The personal account that initiated the workflow run.
+	Actor string `json:"actor"`
+	// The ID of personal account that initiated the workflow run.
+	ActorID string `json:"actor_id"`
+	// The target branch of the pull request in a workflow run.
+	BaseRef string `json:"base_ref"`
+	// The name of the environment used by the job.
+	Environment string `json:"environment"`
+	// The name of the event that triggered the workflow run.
+	EventName string `json:"event_name"`
+	// The source branch of the pull request in a workflow run.
+	HeadRef string `json:"head_ref"`
+	// This is the ref path to the reusable workflow used by this job.
+	JobWorkflowRef string `json:"job_workflow_ref"`
+	// The git ref that triggered the workflow run.
+	Ref string `json:"ref"`
+	// The type of ref, for example: "branch".
+	RefType string `json:"ref_type"`
+	// The visibility of the repository where the workflow is running. Accepts the following values: internal, private, or public.
+	RepositoryVisibility string `json:"repository_visibility"`
+	// The repository from where the workflow is running.
+	// This includes the name of the owner e.g `gravitational/teleport`
+	Repository string `json:"repository"`
+	// The ID of the repository from where the workflow is running.
+	RepositoryID string `json:"repository_id"`
+	// The name of the organization in which the repository is stored.
+	RepositoryOwner string `json:"repository_owner"`
+	// The ID of the organization in which the repository is stored.
+	RepositoryOwnerID string `json:"repository_owner_id"`
+	// The ID of the workflow run that triggered the workflow.
+	RunID string `json:"run_id"`
+	// The number of times this workflow has been run.
+	RunNumber string `json:"run_number"`
+	// The number of times this workflow run has been retried.
+	RunAttempt string `json:"run_attempt"`
+	// SHA is the commit SHA that triggered the workflow run.
+	SHA string `json:"sha"`
+	// The name of the workflow.
+	Workflow string `json:"workflow"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitHub {
+	attrs := &workloadidentityv1pb.JoinAttrsGitHub{
+		Sub:             c.Sub,
+		Actor:           c.Actor,
+		Environment:     c.Environment,
+		Ref:             c.Ref,
+		RefType:         c.RefType,
+		Repository:      c.Repository,
+		RepositoryOwner: c.RepositoryOwner,
+		Workflow:        c.Workflow,
+		EventName:       c.EventName,
+		Sha:             c.SHA,
+		RunId:           c.RunID,
+	}
+
+	return attrs
+}
+
+// GithubIDTokenValidator is a validator for Github OIDC tokens.
+type GithubIDTokenValidator interface {
+	Validate(
+		ctx context.Context, GHESHost string, enterpriseSlug string, token string,
+	) (*IDTokenClaims, error)
+}
+
+// GithubIDTokenJWKSValidator defines a validator function that can be used to
+// check an OIDC token against a known key.
+type GithubIDTokenJWKSValidator func(
+	now time.Time, jwksData []byte, token string,
+) (*IDTokenClaims, error)
+
+type CheckGithubIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Clock          clockwork.Clock
+	Validator      GithubIDTokenValidator
+	JWKSValidator  GithubIDTokenJWKSValidator
+}
+
+func (p *CheckGithubIDTokenParams) checkAndSetDefaults() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	case p.JWKSValidator == nil:
+		return trace.BadParameter("JWKSValidator is required")
+	case p.Clock == nil:
+		p.Clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// CheckGithubIDToken checks a Github OIDC token against a provision token.
+// If the token is valid and its claims match at least one allow rule, the
+// claims are returned.
+func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("github join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	// enterpriseOverride is a hostname to use instead of github.com when
+	// validating tokens. This allows GHES instances to be connected.
+	enterpriseOverride := token.Spec.GitHub.EnterpriseServerHost
+	enterpriseSlug := token.Spec.GitHub.EnterpriseSlug
+	if enterpriseOverride != "" || enterpriseSlug != "" {
+		if modules.GetModules().BuildType() != modules.BuildEnterprise {
+			return nil, trace.Wrap(services.ErrRequiresEnterprise, "github enterprise server joining")
+		}
+	}
+
+	var claims *IDTokenClaims
+	var err error
+	if token.Spec.GitHub.StaticJWKS != "" {
+		claims, err = params.JWKSValidator(
+			params.Clock.Now().UTC(),
+			[]byte(token.Spec.GitHub.StaticJWKS),
+			string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "validating with jwks")
+		}
+	} else {
+		claims, err = params.Validator.Validate(
+			ctx, enterpriseOverride, enterpriseSlug, string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "validating with oidc")
+		}
+	}
+
+	log.InfoContext(ctx, "Github actions run trying to join cluster",
+		"claims", claims,
+		"token", params.ProvisionToken.GetName(),
+	)
+
+	return claims, trace.Wrap(checkGithubAllowRules(token, claims))
+}
+
+func checkGithubAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	// If a single rule passes, accept the IDToken
+	for _, rule := range token.Spec.GitHub.Allow {
+		// Please consider keeping these field validators in the same order they
+		// are defined within the ProvisionTokenSpecV2Github proto spec.
+		if rule.Sub != "" && claims.Sub != rule.Sub {
+			continue
+		}
+		if rule.Repository != "" && claims.Repository != rule.Repository {
+			continue
+		}
+		if rule.RepositoryOwner != "" && claims.RepositoryOwner != rule.RepositoryOwner {
+			continue
+		}
+		if rule.Workflow != "" && claims.Workflow != rule.Workflow {
+			continue
+		}
+		if rule.Environment != "" && claims.Environment != rule.Environment {
+			continue
+		}
+		if rule.Actor != "" && claims.Actor != rule.Actor {
+			continue
+		}
+		if rule.Ref != "" && claims.Ref != rule.Ref {
+			continue
+		}
+		if rule.RefType != "" && claims.RefType != rule.RefType {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/githubactions/token_source.go b/lib/join/githubactions/token_source.go
similarity index 100%
rename from lib/githubactions/token_source.go
rename to lib/join/githubactions/token_source.go
diff --git a/lib/githubactions/token_source_test.go b/lib/join/githubactions/token_source_test.go
similarity index 100%
rename from lib/githubactions/token_source_test.go
rename to lib/join/githubactions/token_source_test.go
diff --git a/lib/githubactions/token_validator.go b/lib/join/githubactions/token_validator.go
similarity index 100%
rename from lib/githubactions/token_validator.go
rename to lib/join/githubactions/token_validator.go
diff --git a/lib/githubactions/token_validator_test.go b/lib/join/githubactions/token_validator_test.go
similarity index 100%
rename from lib/githubactions/token_validator_test.go
rename to lib/join/githubactions/token_validator_test.go
diff --git a/lib/join/gitlab/gitlab.go b/lib/join/gitlab/gitlab.go
new file mode 100644
index 0000000000000..c9b11cc6be872
--- /dev/null
+++ b/lib/join/gitlab/gitlab.go
@@ -0,0 +1,307 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package gitlab
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/provision"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "gitlab")
+
+// Validator provides implementations for verifying both standard OIDC and JWKS
+// tokens issues from GitLab instances.
+type Validator interface {
+	Validate(
+		ctx context.Context, domain string, token string,
+	) (*IDTokenClaims, error)
+	ValidateTokenWithJWKS(
+		ctx context.Context, jwks []byte, token string,
+	) (*IDTokenClaims, error)
+}
+
+// GitLab Workload Identity
+//
+// GL provides workloads with the ID token in an environment variable included
+// in the workflow config, with the specified audience:
+//
+// ```yaml
+// job-name:
+//  id_tokens:
+//    TBOT_GITLAB_JWT:
+//      aud: https://teleport.example.com
+// ```
+//
+// We will require the user to configure this to be `TBOT_GITLAB_JWT` and to
+// set this value to the name of their Teleport cluster.
+//
+// Valuable reference:
+// - https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html
+// - https://docs.gitlab.com/ee/ci/cloud_services/
+// - https://docs.gitlab.com/ee/ci/yaml/index.html#id_tokens
+//
+// The GitLab issuer's well-known OIDC document is at
+// https://gitlab.com/.well-known/openid-configuration
+// For GitLab self-hosted servers, this will be at
+// https://$HOSTNAME/.well-known/openid-configuration
+//
+// The minimum supported GitLab version is 15.7, as this is when ID token
+// support was introduced.
+
+// IDTokenClaims is the structure of claims contained within a GitLab issued
+// ID token.
+//
+// See the following for the structure:
+// https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html#id-tokens
+type IDTokenClaims struct {
+	oidc.TokenClaims
+	// Sub roughly uniquely identifies the workload. Example:
+	// `project_path:mygroup/my-project:ref_type:branch:ref:main`
+	// project_path:{group}/{project}:ref_type:{type}:ref:{branch_name}
+	Sub string `json:"sub"`
+	// Git ref for this job
+	Ref string `json:"ref"`
+	// Git ref type. Example:
+	// `branch` or `tag`
+	RefType string `json:"ref_type"`
+	// 	true if the Git ref is protected, false otherwise.
+	RefProtected string `json:"ref_protected"`
+	// Use this to scope to group or user level namespace by path. Example:
+	// `mygroup`
+	NamespacePath string `json:"namespace_path"`
+	// Use this to scope to group or user level namespace by ID.
+	NamespaceID string `json:"namespace_id"`
+	// Use this to scope to project by path. Example:
+	// `mygroup/myproject`
+	ProjectPath string `json:"project_path"`
+	// Use this to scope to project by ID.
+	ProjectID string `json:"project_id"`
+	// ID of the user executing the job
+	UserID string `json:"user_id"`
+	// Username of the user executing the job
+	UserLogin string `json:"user_login"`
+	// Email of the user executing the job
+	UserEmail string `json:"user_email"`
+	// Pipeline source.
+	// https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules
+	// Example: `web`
+	PipelineSource string `json:"pipeline_source"`
+	// ID of the pipeline.
+	PipelineID string `json:"pipeline_id"`
+	// Environment this job deploys to (if one is associated)
+	Environment string `json:"environment"`
+	// 	true if deployed environment is protected, false otherwise
+	EnvironmentProtected string `json:"environment_protected"`
+	// 	Environment action (environment:action) specified in the job.
+	EnvironmentAction string `json:"environment_action"`
+	// The ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
+	CIConfigRefURI string `json:"ci_config_ref_uri"`
+	// Git commit SHA for the ci_config_ref_uri.
+	CIConfigSHA string `json:"ci_config_sha"`
+	// 	The commit SHA for the job.
+	SHA string `json:"sha"`
+	// ID of the runner executing the job.
+	RunnerID int `json:"runner_id"`
+	// The type of runner used by the job. Can be either gitlab-hosted or self-hosted
+	RunnerEnvironment string `json:"runner_environment"`
+	// Deployment tier of the environment the job specifies
+	DeploymentTier string `json:"deployment_tier"`
+	// The visibility of the project where the pipeline is running. Can be internal, private, or public.
+	ProjectVisibility string `json:"project_visibility"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitLab {
+	attrs := &workloadidentityv1pb.JoinAttrsGitLab{
+		Sub:                  c.Sub,
+		Ref:                  c.Ref,
+		RefType:              c.RefType,
+		RefProtected:         c.RefProtected == "true",
+		NamespacePath:        c.NamespacePath,
+		ProjectPath:          c.ProjectPath,
+		UserLogin:            c.UserLogin,
+		UserEmail:            c.UserEmail,
+		PipelineId:           c.PipelineID,
+		Environment:          c.Environment,
+		EnvironmentProtected: c.EnvironmentProtected == "true",
+		RunnerId:             int64(c.RunnerID),
+		RunnerEnvironment:    c.RunnerEnvironment,
+		Sha:                  c.SHA,
+		CiConfigRefUri:       c.CIConfigRefURI,
+		CiConfigSha:          c.CIConfigSHA,
+	}
+
+	return attrs
+}
+
+// CheckIDTokenParams are parameters used to validate GitLab OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Validator      Validator
+}
+
+func (p *CheckIDTokenParams) validate() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	}
+	return nil
+}
+
+// CheckIDToken verifies a GitLab OIDC token
+func CheckIDToken(ctx context.Context, params *CheckIDTokenParams) (*IDTokenClaims, error) {
+	if err := params.validate(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("gitlab join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	var claims *IDTokenClaims
+	var err error
+	if token.Spec.GitLab.StaticJWKS != "" {
+		claims, err = params.Validator.ValidateTokenWithJWKS(
+			ctx, []byte(token.Spec.GitLab.StaticJWKS), string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "validating with static jwks")
+		}
+	} else {
+		claims, err = params.Validator.Validate(
+			ctx, token.Spec.GitLab.Domain, string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "validating with oidc")
+		}
+	}
+
+	log.InfoContext(ctx, "GitLab CI run trying to join cluster",
+		"claims", claims,
+		"token", params.ProvisionToken.GetName(),
+	)
+
+	return claims, trace.Wrap(checkGitLabAllowRules(token, claims))
+}
+
+func checkGitLabAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	// Helper for comparing a BoolOption with GitLabs string bool.
+	// Returns true if OK - returns false if not OK
+	boolEqual := func(want *types.BoolOption, got string) bool {
+		if want == nil {
+			return true
+		}
+		return (want.Value && got == "true") || (!want.Value && got == "false")
+	}
+
+	// If a single rule passes, accept the IDToken
+	for i, rule := range token.Spec.GitLab.Allow {
+		// Please consider keeping these field validators in the same order they
+		// are defined within the ProvisionTokenSpecV2GitLab proto spec.
+		subMatches, err := joinutils.GlobMatchAllowEmptyPattern(rule.Sub, claims.Sub)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) sub match", i)
+		}
+		if !subMatches {
+			continue
+		}
+		refMatches, err := joinutils.GlobMatchAllowEmptyPattern(rule.Ref, claims.Ref)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) ref match", i)
+		}
+		if !refMatches {
+			continue
+		}
+		if rule.RefType != "" && claims.RefType != rule.RefType {
+			continue
+		}
+		namespacePathMatches, err := joinutils.GlobMatchAllowEmptyPattern(rule.NamespacePath, claims.NamespacePath)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) namespace_path match", i)
+		}
+		if !namespacePathMatches {
+			continue
+		}
+		projectPathMatches, err := joinutils.GlobMatchAllowEmptyPattern(rule.ProjectPath, claims.ProjectPath)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) project_path match", i)
+		}
+		if !projectPathMatches {
+			continue
+		}
+		if rule.PipelineSource != "" && claims.PipelineSource != rule.PipelineSource {
+			continue
+		}
+		if rule.Environment != "" && claims.Environment != rule.Environment {
+			continue
+		}
+		if rule.UserLogin != "" && claims.UserLogin != rule.UserLogin {
+			continue
+		}
+		if rule.UserID != "" && claims.UserID != rule.UserID {
+			continue
+		}
+		if rule.UserEmail != "" && claims.UserEmail != rule.UserEmail {
+			continue
+		}
+		if !boolEqual(rule.RefProtected, claims.RefProtected) {
+			continue
+		}
+		if !boolEqual(rule.EnvironmentProtected, claims.EnvironmentProtected) {
+			continue
+		}
+		if rule.CIConfigSHA != "" && claims.CIConfigSHA != rule.CIConfigSHA {
+			continue
+		}
+		if rule.CIConfigRefURI != "" && claims.CIConfigRefURI != rule.CIConfigRefURI {
+			continue
+		}
+		if rule.DeploymentTier != "" && claims.DeploymentTier != rule.DeploymentTier {
+			continue
+		}
+		if rule.ProjectVisibility != "" && claims.ProjectVisibility != rule.ProjectVisibility {
+			continue
+		}
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/gitlab/token_source.go b/lib/join/gitlab/token_source.go
similarity index 100%
rename from lib/gitlab/token_source.go
rename to lib/join/gitlab/token_source.go
diff --git a/lib/gitlab/token_source_test.go b/lib/join/gitlab/token_source_test.go
similarity index 100%
rename from lib/gitlab/token_source_test.go
rename to lib/join/gitlab/token_source_test.go
diff --git a/lib/gitlab/token_validator.go b/lib/join/gitlab/token_validator.go
similarity index 100%
rename from lib/gitlab/token_validator.go
rename to lib/join/gitlab/token_validator.go
diff --git a/lib/gitlab/token_validator_test.go b/lib/join/gitlab/token_validator_test.go
similarity index 100%
rename from lib/gitlab/token_validator_test.go
rename to lib/join/gitlab/token_validator_test.go
diff --git a/lib/join/iamjoin/iam.go b/lib/join/iamjoin/iam.go
new file mode 100644
index 0000000000000..9a8a7f1772ea2
--- /dev/null
+++ b/lib/join/iamjoin/iam.go
@@ -0,0 +1,326 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package iamjoin
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"slices"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/join/iam"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/aws"
+)
+
+const (
+	// Hardcoding the sts API version here may be more strict than necessary,
+	// but this is set by the Teleport node and can only be changed when we
+	// update our AWS SDK dependency. Since Auth should always be upgraded
+	// before nodes, we will have a chance to update the check on Auth if we
+	// ever have a need to allow a newer API version.
+	expectedSTSIdentityRequestBody = "Action=GetCallerIdentity&Version=2011-06-15"
+
+	// AWS SignedHeaders will always be lowercase
+	// https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html#sigv4-auth-header-overview
+	challengeHeaderKey = "x-teleport-challenge"
+)
+
+// validateSTSHost returns an error if the given stsHost is not a valid regional
+// endpoint for the AWS STS service, or nil if it is valid. If fips is true, the
+// endpoint must be a valid FIPS endpoint.
+//
+// This is a security-critical check: we are allowing the client to tell us
+// which URL we should use to validate their identity. If the client could pass
+// off an attacker-controlled URL as the STS endpoint, the entire security
+// mechanism of the IAM join method would be compromised.
+//
+// To keep this validation simple and secure, we check the given endpoint
+// against a static list of known valid endpoints. We will need to update this
+// list as AWS adds new regions.
+func validateSTSHost(stsHost string, fips bool) error {
+	valid := slices.Contains(iam.ValidSTSEndpoints(), stsHost)
+	if !valid {
+		return trace.AccessDenied("IAM join request uses unknown STS host %q. "+
+			"This could mean that the Teleport Node attempting to join the cluster is "+
+			"running in a new AWS region which is unknown to this Teleport auth server. "+
+			"Alternatively, if this URL looks suspicious, an attacker may be attempting to "+
+			"join your Teleport cluster. "+
+			"Following is the list of valid STS endpoints known to this auth server. "+
+			"If a legitimate STS endpoint is not included, please file an issue at "+
+			"https://github.com/gravitational/teleport. %v",
+			stsHost, iam.ValidSTSEndpoints())
+	}
+
+	if fips && !slices.Contains(iam.FIPSSTSEndpoints(), stsHost) {
+		return trace.AccessDenied("node selected non-FIPS STS endpoint (%s) for the IAM join method", stsHost)
+	}
+
+	return nil
+}
+
+// validateSTSIdentityRequest checks that a received sts:GetCallerIdentity
+// request is valid and includes the challenge as a signed header. An example
+// valid request looks like:
+// ```
+// POST / HTTP/1.1
+// Host: sts.amazonaws.com
+// Accept: application/json
+// Authorization: AWS4-HMAC-SHA256 Credential=AAAAAAAAAAAAAAAAAAAA/20211108/us-east-1/sts/aws4_request, SignedHeaders=accept;content-length;content-type;host;x-amz-date;x-amz-security-token;x-teleport-challenge, Signature=999...
+// Content-Length: 43
+// Content-Type: application/x-www-form-urlencoded; charset=utf-8
+// User-Agent: aws-sdk-go/1.37.17 (go1.17.1; darwin; amd64)
+// X-Amz-Date: 20211108T190420Z
+// X-Amz-Security-Token: aaa...
+// X-Teleport-Challenge: 0ezlc3usTAkXeZTcfOazUq0BGrRaKmb4EwODk8U7J5A
+//
+// Action=GetCallerIdentity&Version=2011-06-15
+// ```
+func validateSTSIdentityRequest(req *http.Request, challenge string, fips bool) (err error) {
+	if err := validateSTSHost(req.Host, fips); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if req.Method != http.MethodPost {
+		return trace.AccessDenied("sts identity request method %q does not match expected method %q", req.RequestURI, http.MethodPost)
+	}
+
+	if req.Header.Get(challengeHeaderKey) != challenge {
+		return trace.AccessDenied("sts identity request does not include challenge header or it does not match")
+	}
+
+	authHeader := req.Header.Get(aws.AuthorizationHeader)
+
+	sigV4, err := aws.ParseSigV4(authHeader)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if !slices.Contains(sigV4.SignedHeaders, challengeHeaderKey) {
+		return trace.AccessDenied("sts identity request auth header %q does not include "+
+			challengeHeaderKey+" as a signed header", authHeader)
+	}
+
+	body, err := utils.GetAndReplaceRequestBody(req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if !bytes.Equal([]byte(expectedSTSIdentityRequestBody), body) {
+		return trace.BadParameter("sts request body %q does not equal expected %q", string(body), expectedSTSIdentityRequestBody)
+	}
+
+	return nil
+}
+
+func parseSTSRequest(req []byte) (*http.Request, error) {
+	httpReq, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(req)))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Unset RequestURI and set req.URL instead (necessary quirk of sending a
+	// request parsed by http.ReadRequest). Also, force https here.
+	if httpReq.RequestURI != "/" {
+		return nil, trace.AccessDenied("unexpected sts identity request URI: %q", httpReq.RequestURI)
+	}
+	httpReq.RequestURI = ""
+	httpReq.URL = &url.URL{
+		Scheme: "https",
+		Host:   httpReq.Host,
+	}
+	return httpReq, nil
+}
+
+// AWSIdentity holds aws Account and Arn, used for JSON parsing
+type AWSIdentity struct {
+	Account string `json:"Account"`
+	Arn     string `json:"Arn"`
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *AWSIdentity) JoinAttrs() *workloadidentityv1pb.JoinAttrsAWSIAM {
+	attrs := &workloadidentityv1pb.JoinAttrsAWSIAM{
+		Account: c.Account,
+		Arn:     c.Arn,
+	}
+
+	return attrs
+}
+
+// getCallerIdentityReponse is used for JSON parsing
+type getCallerIdentityResponse struct {
+	GetCallerIdentityResult AWSIdentity `json:"GetCallerIdentityResult"`
+}
+
+// stsIdentityResponse is used for JSON parsing
+type stsIdentityResponse struct {
+	GetCallerIdentityResponse getCallerIdentityResponse `json:"GetCallerIdentityResponse"`
+}
+
+// executeSTSIdentityRequest sends the sts:GetCallerIdentity HTTP request to the
+// AWS API, parses the response, and returns the awsIdentity
+func executeSTSIdentityRequest(ctx context.Context, client utils.HTTPDoClient, req *http.Request) (*AWSIdentity, error) {
+	if client == nil {
+		client = http.DefaultClient
+	}
+
+	// set the http request context so it can be canceled
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+
+	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, trace.AccessDenied("aws sts api returned status: %q body: %q",
+			resp.Status, body)
+	}
+
+	var identityResponse stsIdentityResponse
+	if err := json.Unmarshal(body, &identityResponse); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	id := &identityResponse.GetCallerIdentityResponse.GetCallerIdentityResult
+	if id.Account == "" {
+		return nil, trace.BadParameter("received empty AWS account ID from sts API")
+	}
+	if id.Arn == "" {
+		return nil, trace.BadParameter("received empty AWS identity ARN from sts API")
+	}
+	return id, nil
+}
+
+// arnMatches returns true if arn matches the pattern.
+// Pattern should be an AWS ARN which may include "*" to match any combination
+// of zero or more characters and "?" to match any single character.
+// See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html
+func arnMatches(pattern, arn string) (bool, error) {
+	return joinutils.GlobMatch(pattern, arn)
+}
+
+// checkIAMAllowRules checks if the given identity matches any of the given
+// allowRules.
+func checkIAMAllowRules(identity *AWSIdentity, allowRules []*types.TokenRule) error {
+	for _, rule := range allowRules {
+		// if this rule specifies an AWS account, the identity must match
+		if len(rule.AWSAccount) > 0 {
+			if rule.AWSAccount != identity.Account {
+				// account doesn't match, continue to check the next rule
+				continue
+			}
+		}
+		// if this rule specifies an AWS ARN, the identity must match
+		if len(rule.AWSARN) > 0 {
+			matches, err := arnMatches(rule.AWSARN, identity.Arn)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if !matches {
+				// arn doesn't match, continue to check the next rule
+				continue
+			}
+		}
+		// node identity matches this allow rule
+		return nil
+	}
+	return trace.AccessDenied("instance %v did not match any allow rules", identity.Arn)
+}
+
+// CheckIAMRequestParams holds parameters for checking an IAM-method join request.
+type CheckIAMRequestParams struct {
+	// Challenge is the challenge that was sent to the client.
+	Challenge string
+	// ProvisionToken is the provision token being used.
+	ProvisionToken provision.Token
+	// STSIdentityRequest is the signed sts:GetCallerIdentity request sent by
+	// the client in response to the challenge.
+	STSIdentityRequest []byte
+	// HTTPClient is an optional HTTP client to use for sending
+	// STSIdentityRequest to AWS, if nil a default client will be used.
+	HTTPClient utils.HTTPDoClient
+	// FIPS must be true if the server is in FIPS mode.
+	FIPS bool
+}
+
+// CheckIAMRequest checks if the given request satisfies the token rules and
+// included the required challenge.
+//
+// If the joining entity presents a valid IAM identity, this will be returned,
+// even if the identity does not match the token's allow rules. This is to
+// support inclusion in audit logs.
+func CheckIAMRequest(ctx context.Context, params *CheckIAMRequestParams) (*AWSIdentity, error) {
+	if params.ProvisionToken.GetJoinMethod() != types.JoinMethodIAM {
+		return nil, trace.AccessDenied("this token does not support the IAM join method")
+
+	}
+
+	// parse the incoming http request to the sts:GetCallerIdentity endpoint
+	identityRequest, err := parseSTSRequest(params.STSIdentityRequest)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing STS request")
+	}
+
+	// validate that the host, method, and headers are correct and the expected
+	// challenge is included in the signed portion of the request
+	if err := validateSTSIdentityRequest(identityRequest, params.Challenge, params.FIPS); err != nil {
+		return nil, trace.Wrap(err, "validating STS request")
+	}
+
+	// send the signed request to the public AWS API and get the node identity
+	// from the response
+	identity, err := executeSTSIdentityRequest(ctx, params.HTTPClient, identityRequest)
+	if err != nil {
+		return nil, trace.Wrap(err, "executing STS request")
+	}
+
+	// check that the node identity matches an allow rule for this token
+	if err := checkIAMAllowRules(identity, params.ProvisionToken.GetAllowRules()); err != nil {
+		// We return the identity since it's "validated" but does not match the
+		// rules. This allows us to include it in a failed join audit event
+		// as additional context to help the user understand why the join failed.
+		return identity, trace.Wrap(err, "checking allow rules")
+	}
+
+	return identity, nil
+}
+
+// GenerateIAMChallenge generates a random challenge string for the IAM join method.
+func GenerateIAMChallenge() (string, error) {
+	challenge, err := joinutils.GenerateChallenge(base64.RawStdEncoding, 32)
+	return challenge, trace.Wrap(err)
+}
diff --git a/lib/join/internal/authz/authz.go b/lib/join/internal/authz/authz.go
new file mode 100644
index 0000000000000..b30a92894ceb1
--- /dev/null
+++ b/lib/join/internal/authz/authz.go
@@ -0,0 +1,44 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package authz
+
+import (
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Context represents a distilled authenticated context for a join request.
+type Context struct {
+	// IsForwardedByProxy is true if the join request was actively forwarded by
+	// a proxy. As in, the proxy terminated the gRPC request, added
+	// proxy-supplied parameters, and forwarded it to the auth service.
+	IsForwardedByProxy bool
+	// IsInstance is true if the client authenticated as the Instance system role.
+	IsInstance bool
+	// IsBot is true if the client authenticated as the Bot system role.
+	IsBot bool
+	// SystemRoles is a list of additional system roles that an Instance
+	// authenticated as having.
+	SystemRoles types.SystemRoles
+	// HostID is an authenticated HostID.
+	HostID string
+	// BotGeneration is the current generation of an authenticated Bot.
+	BotGeneration uint64
+	// BotInstanceID is an authenticated Bot ID.
+	BotInstanceID string
+	// Scope is the assigned scope of the authenticated client.
+	Scope string
+}
diff --git a/lib/join/internal/diagnostic/diagnostic.go b/lib/join/internal/diagnostic/diagnostic.go
new file mode 100644
index 0000000000000..0ea00e7d1aa7f
--- /dev/null
+++ b/lib/join/internal/diagnostic/diagnostic.go
@@ -0,0 +1,121 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package diagnostic
+
+import (
+	"log/slog"
+	"sync"
+	"time"
+)
+
+// Diagnostic collects diagnostic information about a join attempt so that it
+// can be displayed in log messages and audit events. Because the join process
+// is highly concurrent, it provides safe methods for editing and retrieving
+// an [Info] struct.
+type Diagnostic struct {
+	mu   sync.Mutex
+	info Info
+}
+
+// Info holds diagnostic information for a join attempt.
+type Info struct {
+	RemoteAddr          string
+	ClientVersion       string
+	SafeTokenName       string
+	Role                string
+	RequestedJoinMethod string
+	TokenJoinMethod     string
+	TokenExpires        time.Time
+	NodeName            string
+	HostID              string
+	SystemRoles         []string
+	BotName             string
+	BotGeneration       uint64
+	BotInstanceID       string
+	Error               error
+	RawJoinAttrs        any
+}
+
+// New returns an empty diagnostic ready to use.
+func New() *Diagnostic {
+	return &Diagnostic{}
+}
+
+// Get returns a copy of the current collected [Info].
+func (d *Diagnostic) Get() Info {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.info
+}
+
+// Set accepts a function that will be called under a lock to atomically update
+// the collected [Info].
+func (d *Diagnostic) Set(f func(*Info)) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	f(&d.info)
+}
+
+// SlogAttrs returns the current collected info as a slice of [slog.Attr]
+// suitable for logging. Unset fields will be included as an empty [slog.Attr]
+// which are conventionally ignored by log handlers.
+func (info *Info) SlogAttrs() []slog.Attr {
+	return []slog.Attr{
+		stringAttr("error", info.Error.Error()),
+		stringAttr("remote_addr", info.RemoteAddr),
+		stringAttr("client_version", info.ClientVersion),
+		stringAttr("token_name", info.SafeTokenName),
+		stringAttr("role", info.Role),
+		stringAttr("requested_join_method", info.RequestedJoinMethod),
+		stringAttr("token_join_method", info.TokenJoinMethod),
+		timeAttr("token_expires", info.TokenExpires),
+		stringAttr("node_name", info.NodeName),
+		stringAttr("host_id", info.HostID),
+		stringSliceAttr("system_roles", info.SystemRoles),
+		stringAttr("bot_name", info.BotName),
+		uint64Attr("bot_generation", info.BotGeneration),
+		stringAttr("bot_instance_id", info.BotInstanceID),
+	}
+}
+
+func stringAttr(key, value string) slog.Attr {
+	if value == "" {
+		return slog.Attr{}
+	}
+	return slog.String(key, value)
+}
+
+func timeAttr(key string, t time.Time) slog.Attr {
+	if t.IsZero() {
+		return slog.Attr{}
+	}
+	return slog.Time(key, t)
+}
+
+func uint64Attr(key string, u uint64) slog.Attr {
+	if u == 0 {
+		return slog.Attr{}
+	}
+	return slog.Uint64(key, u)
+}
+
+func stringSliceAttr(key string, vals []string) slog.Attr {
+	if len(vals) == 0 {
+		return slog.Attr{}
+	}
+	return slog.Any(key, vals)
+}
diff --git a/lib/join/internal/messages/messages.go b/lib/join/internal/messages/messages.go
new file mode 100644
index 0000000000000..00444ab14be4c
--- /dev/null
+++ b/lib/join/internal/messages/messages.go
@@ -0,0 +1,708 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package messages
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+)
+
+// Request is implemented by all join request messages.
+type Request interface {
+	isRequest()
+}
+
+// embedRequest is embedded in all join request message as a shorthand for
+// implementing the [Request] interface on pointers to the message type.
+type embedRequest struct{}
+
+func (*embedRequest) isRequest() {}
+
+// ClientInit is the first messages sent from the client during the join
+// process, it contains parameters common to all join methods.
+type ClientInit struct {
+	embedRequest
+
+	// JoinMethod is the name of the join method that the client is configured to use.
+	// This parameter is optional, the client can leave it empty to allow the
+	// server to determine the join method based on the provision token named by
+	// TokenName, it will be sent to the client in the ServerInit message.
+	JoinMethod *string
+	// TokenName is the name of the join token.
+	// This is a secret if using the token join method, otherwise it is a
+	// non-secret name of a provision token resource.
+	TokenName string
+	// SystemRole is the system role requested, e.g. Proxy, Node, Instance, Bot.
+	SystemRole string
+	// ForwardedByProxy will be set to true when the message is forwarded by the
+	// Proxy service. When this is set the Auth service must ignore any
+	// any credentials authenticating the request, except for the purpose of
+	// accepting ProxySuppliedParameters.
+	ForwardedByProxy bool
+	// ProxySuppliedParams holds parameters added by the Proxy when
+	// nodes join via the proxy address. They must only be trusted if the
+	// incoming join request is authenticated as the Proxy.
+	ProxySuppliedParams *ProxySuppliedParams
+}
+
+func (i *ClientInit) Check() error {
+	switch {
+	case i.TokenName == "":
+		return trace.BadParameter("TokenName is required")
+	case i.SystemRole == "":
+		return trace.BadParameter("SystemRole is required")
+	}
+	return nil
+}
+
+// ProxySuppliedParams contains parameters added by the proxy when the
+// proxy terminates the initial TLS connection. These should only be trusted
+// when the request authenticates as a valid proxy.
+type ProxySuppliedParams struct {
+	// RemoteAddr is the remote address of the host requesting a certificate.
+	// It replaces 0.0.0.0 in the list of additional principals.
+	RemoteAddr string
+	// ClientVersion is the Teleport version of the client attempting to join.
+	ClientVersion string
+}
+
+// TokenInit is sent by the client in response to the ServerInit message for
+// the Token join method.
+//
+// The Token method join flow is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: TokenInit
+// 4. server->client: Result
+type TokenInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+}
+
+func (i *TokenInit) Check() error {
+	return trace.Wrap(i.ClientParams.check(), "checking ClientParams")
+}
+
+// ClientParams holds either host or bot join parameters.
+type ClientParams struct {
+	HostParams *HostParams
+	BotParams  *BotParams
+}
+
+func (p *ClientParams) check() error {
+	switch {
+	case p.HostParams == nil && p.BotParams == nil:
+		return trace.BadParameter("HostParams or BotParams must be set")
+	case p.HostParams != nil && p.BotParams != nil:
+		return trace.BadParameter("HostParams and BotParams cannot both be set")
+	}
+	if err := p.HostParams.check(); err != nil {
+		return trace.Wrap(err, "checking HostParams")
+	}
+	if err := p.BotParams.check(); err != nil {
+		return trace.Wrap(err, "checking BotParams")
+	}
+	return nil
+}
+
+// HostParams holds parameters that are specific to host joining and
+// irrelevant to bot joining.
+type HostParams struct {
+	// PublicKeys holds the host public keys.
+	PublicKeys PublicKeys
+	// HostName is the user-friendly node name for the host. This comes from
+	// teleport.nodename in the service configuration and defaults to the
+	// hostname. It is encoded as a valid principal in issued certificates.
+	HostName string
+	// AdditionalPrincipals is a list of additional principals requested.
+	AdditionalPrincipals []string
+	// DnsNames is a list of DNS names requested for inclusion in the x509 certificate.
+	DNSNames []string
+}
+
+func (p *HostParams) check() error {
+	switch {
+	case p == nil:
+		return nil
+	case p.HostName == "":
+		return trace.BadParameter("HostName is required")
+	}
+	return trace.Wrap(p.PublicKeys.check())
+}
+
+// BotParams holds parameters that are specific to bot joining and
+// irrelevant to host joining.
+type BotParams struct {
+	// PublicKeys holds the bot public keys.
+	PublicKeys PublicKeys
+	// Expires is a desired time of the expiry of certificates returned by
+	// registration.
+	Expires *time.Time
+}
+
+func (p *BotParams) check() error {
+	switch {
+	case p == nil:
+		return nil
+	case p.Expires.IsZero():
+		return trace.BadParameter("Expires is required")
+	}
+	return trace.Wrap(p.PublicKeys.check())
+}
+
+// PublicKeys holds public keys sent by the client requested subject keys for
+// issued certificates.
+type PublicKeys struct {
+	// PublicTlsKey is the public key requested for the subject of the x509 certificate.
+	// It must be encoded in PKIX, ASN.1 DER form.
+	PublicTLSKey []byte
+	// PublicSshKey is the public key requested for the subject of the SSH certificate.
+	// It must be encoded in SSH wire format.
+	PublicSSHKey []byte
+}
+
+func (k *PublicKeys) check() error {
+	switch {
+	case len(k.PublicTLSKey) == 0:
+		return trace.BadParameter("PublicTLSKey is required")
+	case len(k.PublicSSHKey) == 0:
+		return trace.BadParameter("PublicSSHKey is required")
+	}
+	return nil
+}
+
+// OIDCInit holds the OIDC identity token used for all OIDC-based join methods.
+//
+// The join flow for all OIDC-based join methods is:
+// 1. client->server: ClientInit
+// 2. server->client: ServerInit
+// 3. client->server: OIDCInit
+// 4. server->client: Result
+type OIDCInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+	// IDToken is the OIDC identity token.
+	IDToken []byte
+}
+
+// BoundKeypairInit is sent from the client in response to the ServerInit
+// message for the bound keypair join method.
+// The server is expected to respond with a BoundKeypairChallenge.
+//
+// The bound keypair method join flow is:
+//  1. client->server: ClientInit
+//  2. server->client: ServerInit
+//  3. client->server: BoundKeypairInit
+//  4. server->client: BoundKeypairChallenge
+//  5. client->server: BoundKeypairChallengeSolution
+//     (optional additional steps if keypair rotation is required)
+//     server->client: BoundKeypairRotationRequest
+//     client->server: BoundKeypairRotationResponse
+//     server->client: BoundKeypairChallenge
+//     client->server: BoundKeypairChallengeSolution
+//  6. server->client: Result containing BoundKeypairResult
+type BoundKeypairInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+	// If set, attempts to bind a new keypair using an initial join secret. Any
+	// value set here will be ignored if a keypair is already bound.
+	InitialJoinSecret string
+	// A document signed by Auth containing join state parameters from the
+	// previous join attempt. Not required on initial join; required on all
+	// subsequent joins.
+	PreviousJoinState []byte
+}
+
+// BoundKeypairChallenge is a challenge issued by the server that joining
+// clients are expected to complete.
+// The client is expected to respond with a BoundKeypairChallengeSolution.
+type BoundKeypairChallenge struct {
+	embedResponse
+
+	// The desired public key corresponding to the private key that should be
+	// used to sign this challenge, in SSH authorized keys format.
+	PublicKey []byte
+	// A challenge to sign with the requested public key. During keypair
+	// rotation, a second challenge will be provided to verify the new keypair
+	// before certs are returned.
+	Challenge string
+}
+
+// BoundKeypairChallengeSolution is sent from the client in response to the
+// BoundKeypairChallenge.
+// The server is expected to respond with either a Result or a
+// BoundKeypairRotationRequest.
+type BoundKeypairChallengeSolution struct {
+	embedRequest
+
+	// A solution to a challenge from the server. This generated by signing the
+	// challenge as a JWT using the keypair associated with the requested public
+	// key.
+	Solution []byte
+}
+
+// BoundKeypairRotationRequest is sent by the server in response to a
+// BoundKeypairChallenge when a keypair rotation is required. It acts like an
+// additional challenge, the client is expected to respond with a
+// BoundKeypairRotationResponse.
+type BoundKeypairRotationRequest struct {
+	embedResponse
+
+	// The signature algorithm suite in use by the cluster.
+	SignatureAlgorithmSuite string
+}
+
+// BoundKeypairRotationResponse is sent by the client in response to a
+// BoundKeypairRotationRequest from the server. The server is expected to
+// respond with an additional BoundKeypairChallenge for the new key.
+type BoundKeypairRotationResponse struct {
+	embedRequest
+
+	// The public key to be registered with auth. Clients should expect a
+	// subsequent challenge against this public key to be sent. This is encoded
+	// in SSH authorized keys format.
+	PublicKey []byte
+}
+
+// BoundKeypairResult holds additional result parameters relevant to the bound
+// keypair join method.
+type BoundKeypairResult struct {
+	// A signed join state document to be provided on the next join attempt.
+	JoinState []byte
+	// The public key registered with Auth at the end of the joining ceremony.
+	// After a successful keypair rotation, this should reflect the newly
+	// registered public key. This is encoded in SSH authorized keys format.
+	PublicKey []byte
+}
+
+// IAMInit is sent from the client in response to the ServerInit message for
+// the IAM join method.
+//
+// The IAM method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: IAMInit
+// 4. client<-server: IAMChallenge
+// 5. client->server: IAMChallengeSolution
+// 6. client<-server: Result
+type IAMInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+}
+
+// IAMChallenge is from the server in response to the IAMInit message from the client.
+// The client is expected to respond with a IAMChallengeSolution.
+type IAMChallenge struct {
+	embedResponse
+
+	// Challenge is a a crypto-random string that should be included by the
+	// client in the IAMChallengeSolution message.
+	Challenge string
+}
+
+// IAMChallengeSolution must be sent from the client in response to the
+// IAMChallenge message.
+type IAMChallengeSolution struct {
+	embedRequest
+
+	// STSIdentityRequest is a signed sts:GetCallerIdentity API request used
+	// to prove the AWS identity of a joining node. It must include the
+	// challenge string as a signed header.
+	STSIdentityRequest []byte
+}
+
+// EC2Init is sent from the client in response to the ServerInit message for
+// the EC2 join method.
+//
+// The EC2 method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: EC2Init
+// 4. client<-server: Result
+type EC2Init struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+	// Document is a signed EC2 Instance Identity Document used to prove the
+	// identity of a joining EC2 instance.
+	Document []byte
+}
+
+// OracleInit is sent from the client in response to the ServerInit message for
+// the Oracle join method.
+//
+// The Oracle method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: OracleInit
+// 4. client<-server: OracleChallenge
+// 5. client->server: OracleChallengeSolution
+// 6. client<-server: Result
+type OracleInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+}
+
+// OracleChallenge is from the server in response to the OracleInit message from the client.
+// The client is expected to respond with a OracleChallengeSolution.
+type OracleChallenge struct {
+	embedResponse
+
+	// Challenge is a a crypto-random string that should be signed by the
+	// client and included in the OracleChallengeSolution message.
+	Challenge string
+}
+
+// OracleChallengeSolution must be sent from the client in response to the
+// OracleChallenge message.
+type OracleChallengeSolution struct {
+	embedRequest
+
+	// Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
+	Cert []byte
+	// Intermediate encodes the intermediate CAs that issued the instance
+	// identity certificate, in PEM format.
+	Intermediate []byte
+	// Signature is a signature over the challenge, signed by the private key
+	// matching the instance identity certificate.
+	Signature []byte
+	// SignedRootCaReq is a signed request to the Oracle API for retreiving the
+	// root CAs that issued the instance identity certificate.
+	SignedRootCAReq []byte
+}
+
+// TPMInit is sent from the client in response to the ServerInit message for
+// the TPM join flow.
+//
+// The TPM method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: TPMInit
+// 4. client<-server: TPMEncryptedCredential
+// 5. client->server: TPMSolution
+// 6. client<-server: Result
+type TPMInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+	// Public is the encoded TPMT_PUBLIC structure containing the attestation
+	// public key and signing parameters.
+	Public []byte
+	// CreateData is the properties of the attestation key, encoded as a
+	// TPMS_CREATION_DATA structure.
+	CreateData []byte
+	// CreateAttestation is an assertion as to the details of the key, encoded
+	// as a TPMS_ATTEST structure.
+	CreateAttestation []byte
+	// CreateSignature is a signature of create_attestation, encoded as a
+	// TPMT_SIGNATURE structure.
+	CreateSignature []byte
+	// EKCert is the device's endorsement certificate in X509, ASN.1 DER form.
+	// This certificate contains the public key of the endorsement key. This is
+	// preferred to ek_key.
+	//
+	// Only one of EKCert and EKKey will be set.
+	EKCert []byte
+	// EKKey is the device's public endorsement key in PKIX, ASN.1 DER form.
+	// This is used when a TPM does not contain any endorsement certificates.
+	//
+	// Only one of EKCert and EKKey will be set.
+	EKKey []byte
+}
+
+// TPMEncryptedCredential is the message sent from the server in response to the
+// TPMInit message.
+type TPMEncryptedCredential struct {
+	embedResponse
+
+	// CredentialBlob is the `credential_blob` parameter to be used with the
+	// `ActivateCredential` command. This is used with the decrypted value of
+	// `secret` in a cryptographic process to decrypt the solution.
+	CredentialBlob []byte
+	// Secret is the `secret` parameter to be used with `ActivateCredential`.
+	// This is a seed which can be decrypted with the EK. The decrypted seed is
+	// then used when decrypting `credential_blob`.
+	Secret []byte
+}
+
+// TPMSolution is the message sent from the client in response to the
+// TPMEncryptedCredential message.
+type TPMSolution struct {
+	embedRequest
+
+	// Solution is the client's solution to TPMEncryptedCredential using
+	// ActivateCredential.
+	Solution []byte
+}
+
+// AzureInit is sent from the client in response to the ServerInit message for
+// the Azure join method.
+//
+// The Azure method join flow is:
+// 1. client->server: ClientInit
+// 2. client<-server: ServerInit
+// 3. client->server: AzureInit
+// 4. client<-server: AzureChallenge
+// 5. client->server: AzureChallengeSolution
+// 6. client<-server: Result
+type AzureInit struct {
+	embedRequest
+
+	// ClientParams holds parameters for the specific type of client trying to join.
+	ClientParams ClientParams
+}
+
+// AzureChallenge is sent from the server in response to the AzureInit message
+// from the client. The client is expected to respond with a
+// AzureChallengeSolution.
+type AzureChallenge struct {
+	embedResponse
+
+	// Challenge is a a crypto-random string that should be included by the
+	// client in the AzureChallengeSolution message.
+	Challenge string
+}
+
+// AzureChallenge message.
+// AzureChallengeSolution must be sent from the client in response to the
+type AzureChallengeSolution struct {
+	embedRequest
+
+	// AttestedData is a signed JSON document from an Azure VM's attested data
+	// metadata endpoint used to prove the identity of a joining node. It must
+	// include the challenge string as the nonce.
+	AttestedData []byte
+	// Intermediate encodes the intermediate CAs that issued the leaf certificate
+	// used to sign the attested data document, in x509 DER format.
+	Intermediate []byte
+	// AccessToken is a JWT signed by Azure, used to prove the identity of a
+	// joining node.
+	AccessToken string
+}
+
+// Response is implemented by all join response messages.
+type Response interface {
+	isResponse()
+}
+
+// embedResponse is embedded in all join response messages as a shorthand for
+// implementing the [Response] interface on pointers to the message type.
+type embedResponse struct{}
+
+func (*embedResponse) isResponse() {}
+
+// ServerInit is the first message sent from the server in response to the
+// ClientInit message.
+type ServerInit struct {
+	embedResponse
+
+	// JoinMethod is the name of the selected join method.
+	JoinMethod string
+	// SignatureAlgorithmSuite is the name of the signature algorithm suite
+	// currently configured for the cluster.
+	SignatureAlgorithmSuite types.SignatureAlgorithmSuite
+}
+
+// HostResult holds results for host joining.
+type HostResult struct {
+	embedResponse
+
+	// Certificates holds issued certificates and cluster CAs.
+	Certificates Certificates
+	// HostId is the unique ID assigned to the host.
+	HostID string
+}
+
+// BotResult holds results for bot joining.
+type BotResult struct {
+	embedResponse
+
+	// Certificates holds issued certificates and cluster CAs.
+	Certificates Certificates
+	// BoundKeypairResult holds extra result parameters relevant to the bound keypair join method.
+	BoundKeypairResult *BoundKeypairResult
+}
+
+// Certificates holds issued certificates and cluster CAs.
+type Certificates struct {
+	// TLSCert is an X.509 certificate encoded in ASN.1 DER form.
+	TLSCert []byte
+	// TLSCACerts is a list of TLS certificate authorities that the client should trust.
+	// Each certificate is encoding in ASN.1 DER form.
+	TLSCACerts [][]byte
+	// SSHCert is an SSH certificate encoded in SSH wire format.
+	SSHCert []byte
+	// SSHCAKeys is a list of SSH certificate authority public keys that the client should trust.
+	// Each CA key is encoded in SSH wire format.
+	SSHCAKeys [][]byte
+}
+
+// GivingUpReason is the reason a client is giving up on a join attempt.
+type GivingUpReason int
+
+const (
+	// GivingUpReasonUnspecified is an unspecified reason.
+	GivingUpReasonUnspecified GivingUpReason = iota
+	// GivingUpReasonUnsupportedJoinMethod means the client does not support
+	// the join method sent by the server.
+	GivingUpReasonUnsupportedJoinMethod
+	// GivingUpReasonUnsupportedMessageType means the client can not handle a
+	// message type sent by the server.
+	GivingUpReasonUnsupportedMessageType
+	// GivingUpReasonChallengeSolutionFailed means the client failed to solve a
+	// challenge sent by the server.
+	GivingUpReasonChallengeSolutionFailed
+)
+
+// GivingUp should be sent by clients that fail to complete the join flow so
+// that the Auth service can log an informative error message.
+type GivingUp struct {
+	embedRequest
+
+	// Reason is the reason the client is giving up.
+	Reason GivingUpReason
+	// Msg is an error message related to the failure.
+	Msg string
+}
+
+// ClientGaveUpError is an error type returned when a client explicitly gave up
+// on a join attempt.
+type ClientGaveUpError struct {
+	// Reason is the reason the client is giving up.
+	Reason GivingUpReason
+	// Msg is an error message related to the failure.
+	Msg string
+}
+
+func (e *ClientGaveUpError) Error() string {
+	var msg strings.Builder
+	msg.WriteString("client gave up on join attempt: ")
+	switch e.Reason {
+	case GivingUpReasonUnspecified:
+		msg.WriteString("reason unspecified")
+	case GivingUpReasonUnsupportedJoinMethod:
+		msg.WriteString("unsupported join method")
+	case GivingUpReasonUnsupportedMessageType:
+		msg.WriteString("unsupported message type")
+	case GivingUpReasonChallengeSolutionFailed:
+		msg.WriteString("challenge solution failed")
+	default:
+		msg.WriteString("unhandled reason")
+	}
+	if e.Msg != "" {
+		msg.WriteString(": ")
+		msg.WriteString(joinutils.SanitizeUntrustedString(e.Msg))
+	}
+	return msg.String()
+}
+
+// ClientStream represents the client side of a join request stream.
+// It can send [Request]s and receive [Response]s.
+//
+// To cancel a blocked Send or Recv, cancel the parent context used to create
+// the stream. This models the underlying gRPC stream.
+type ClientStream interface {
+	Send(Request) error
+	Recv() (Response, error)
+	CloseSend() error
+}
+
+// ServerStream represents the server side of a join request stream.
+// It can send [Response]s and receive [Request]s.
+//
+// To cancel a blocked Send or Recv you must return from the handler. This
+// models the underlying gRPC stream.
+type ServerStream interface {
+	Context() context.Context
+	Diagnostic() *diagnostic.Diagnostic
+	Send(Response) error
+	Recv() (Request, error)
+}
+
+// RecvRequest calls [ServerStream.Recv] and asserts the expected type of
+// the received message, returning an appropriate error if the client sent a
+// message with an unexpected type.
+func RecvRequest[T Request](ss ServerStream) (T, error) {
+	req, err := ss.Recv()
+	if err != nil {
+		var nul T
+		return nul, trace.Wrap(err)
+	}
+	return AssertRequestType[T](req)
+}
+
+// AssertRequestType performs a type assertion on a request and returns an
+// appropriate error if the request has an unexpected type.
+func AssertRequestType[T Request](req Request) (T, error) {
+	switch typedRequest := req.(type) {
+	case T:
+		return typedRequest, nil
+	case *GivingUp:
+		var nul T
+		return nul, trace.Wrap(&ClientGaveUpError{
+			Reason: typedRequest.Reason,
+			Msg:    typedRequest.Msg,
+		})
+	default:
+		var nul T
+		return nul, trace.BadParameter("expected client to send message of type %T, got %T", nul, req)
+	}
+}
+
+// RecvResponse calls [ClientStream.Recv] and asserts the expected type of
+// the received message. If a message of any type other than T is received a
+// [GivingUp] message will be sent on the client stream and an error will be
+// returned.
+func RecvResponse[T Response](cs ClientStream) (T, error) {
+	var nul T
+	resp, err := cs.Recv()
+	if err != nil {
+		return nul, trace.Wrap(err)
+	}
+	typedResp, ok := resp.(T)
+	if !ok {
+		err = trace.Errorf("expected server to send message of type %T, got %T", nul, resp)
+		sendGivingUpErr := cs.Send(&GivingUp{
+			Reason: GivingUpReasonUnsupportedMessageType,
+			Msg:    err.Error(),
+		})
+		return nul, trace.NewAggregate(
+			err,
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+	}
+	return typedResp, nil
+}
diff --git a/lib/join/join_azuredevops_test.go b/lib/join/join_azuredevops_test.go
new file mode 100644
index 0000000000000..c1aabacabf7ee
--- /dev/null
+++ b/lib/join/join_azuredevops_test.go
@@ -0,0 +1,356 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+)
+
+type mockAzureDevopsTokenValidator struct {
+	tokens map[string]map[string]azuredevops.IDTokenClaims
+}
+
+func (m *mockAzureDevopsTokenValidator) Validate(
+	_ context.Context, organizationID string, token string,
+) (*azuredevops.IDTokenClaims, error) {
+	orgTokens := m.tokens[organizationID]
+	if orgTokens == nil {
+		return nil, fmt.Errorf("bad organization ID: %s", organizationID)
+	}
+	claims, ok := orgTokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+
+	return &claims, nil
+}
+
+func TestJoinAzureDevops(t *testing.T) {
+	const (
+		validIDToken          = "test.fake.jwt"
+		validOrgID            = "0000-0000-0000-1337"
+		fakeSub               = "p://my-org/my-project/my-pipeline"
+		fakeOrgName           = "my-org"
+		fakeProjectName       = "my-project"
+		fakePipelineName      = "my-pipeline"
+		fakeProjectID         = "711ef6f7-0000-0000-0000-4b54d912999"
+		fakeDefinitionID      = "1"
+		fakeRepositoryURI     = "https://github.com/gravitational/teleport.git"
+		fakeRepositoryVersion = "e6b9eb29a288b27a3a82cc19c48b9d94b80aff36"
+		fakeRepositoryRef     = "refs/heads/main"
+	)
+
+	idTokenValidator := &mockAzureDevopsTokenValidator{
+		tokens: map[string]map[string]azuredevops.IDTokenClaims{
+			validOrgID: {
+				validIDToken: {
+					Sub:               fakeSub,
+					ProjectName:       fakeProjectName,
+					OrganizationName:  fakeOrgName,
+					ProjectID:         fakeProjectID,
+					DefinitionID:      fakeDefinitionID,
+					RepositoryURI:     fakeRepositoryURI,
+					RepositoryVersion: fakeRepositoryVersion,
+					RepositoryRef:     fakeRepositoryRef,
+					PipelineName:      fakePipelineName,
+				},
+			},
+		},
+	}
+
+	ctx := t.Context()
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	auth := server.Auth()
+	auth.SetAzureDevopsIDTokenValidator(idTokenValidator)
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	allowRule := func(modifier func(devops *types.ProvisionTokenSpecV2AzureDevops_Rule)) *types.ProvisionTokenSpecV2AzureDevops_Rule {
+		rule := &types.ProvisionTokenSpecV2AzureDevops_Rule{
+			Sub:               fakeSub,
+			ProjectName:       fakeProjectName,
+			PipelineName:      fakePipelineName,
+			ProjectID:         fakeProjectID,
+			DefinitionID:      fakeDefinitionID,
+			RepositoryURI:     fakeRepositoryURI,
+			RepositoryVersion: fakeRepositoryVersion,
+			RepositoryRef:     fakeRepositoryRef,
+		}
+		if modifier != nil {
+			modifier(rule)
+		}
+		return rule
+	}
+
+	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
+		require.ErrorContains(t, err, "id token claims failed to match any allow rules")
+		require.True(t, trace.IsAccessDenied(err))
+	})
+
+	tests := []struct {
+		name        string
+		idToken     string
+		tokenSpec   types.ProvisionTokenSpecV2
+		assertError require.ErrorAssertionFunc
+	}{
+		{
+			name: "success",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: require.NoError,
+		},
+		{
+			name: "multiple allow rules",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.Sub = "no-match"
+						}),
+						allowRule(nil),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: require.NoError,
+		},
+		{
+			name: "incorrect sub",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.Sub = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect project_name",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.ProjectName = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect pipeline name",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.PipelineName = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect project id",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.ProjectID = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect definition id",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.DefinitionID = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect repository uri",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.RepositoryURI = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect repository version",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.RepositoryVersion = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect repository ref",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2AzureDevops_Rule) {
+							rule.RepositoryRef = "wrong"
+						}),
+					},
+				},
+			},
+			idToken:     validIDToken,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "invalid token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodAzureDevops,
+				Roles:      []types.SystemRole{types.RoleNode},
+				AzureDevops: &types.ProvisionTokenSpecV2AzureDevops{
+					OrganizationID: validOrgID,
+					Allow: []*types.ProvisionTokenSpecV2AzureDevops_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			idToken: "some other token",
+			assertError: func(t require.TestingT, err error, i ...any) {
+				// The error identity is lost at the gRPC boundary, preventing
+				// ErrorIs, but we can check the string.
+				require.Error(t, err)
+				require.ErrorContains(t, err, errMockInvalidToken.Error())
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token, err := types.NewProvisionTokenFromSpec(
+				"testtoken", time.Now().Add(time.Minute), tt.tokenSpec,
+			)
+			require.NoError(t, err)
+			require.NoError(t, auth.UpsertToken(ctx, token))
+
+			t.Run("new", func(t *testing.T) {
+				_, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token: token.GetName(),
+					ID: state.IdentityID{
+						Role:     types.RoleInstance,
+						NodeName: "testnode",
+					},
+					IDToken:    tt.idToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+			t.Run("legacy", func(t *testing.T) {
+				_, err = joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      token.GetName(),
+					JoinMethod: types.JoinMethodAzureDevops,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance,
+						HostUUID: "testuuid",
+						NodeName: "testnode",
+					},
+					IDToken:    tt.idToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+		})
+	}
+}
diff --git a/lib/auth/join_bitbucket_test.go b/lib/join/join_bitbucket_test.go
similarity index 77%
rename from lib/auth/join_bitbucket_test.go
rename to lib/join/join_bitbucket_test.go
index 9c718de2ce3b6..2a911304dd157 100644
--- a/lib/auth/join_bitbucket_test.go
+++ b/lib/join/join_bitbucket_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package join_test
 
 import (
 	"context"
@@ -25,12 +25,17 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/bitbucket"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 const fakeBitbucketIDPURL = "https://api.bitbucket.org/2.0/workspaces/example/pipelines-config/identity/oidc"
@@ -54,7 +59,7 @@ func (m *mockBitbucketTokenValidator) Validate(
 	return &claims, nil
 }
 
-func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
+func TestJoinBitbucket(t *testing.T) {
 	const (
 		validIDToken          = "test.fake.jwt"
 		fakeAudience          = "ari:cloud:bitbucket::workspace/e2b9cba7-4ecf-452c-bb1c-87add4084c99"
@@ -80,18 +85,23 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 		},
 	}
 
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), func(server *Server) error {
-		server.bitbucketIDTokenValidator = idTokenValidator
-		return nil
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
 	})
 	require.NoError(t, err)
-	auth := p.a
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	authServer.Auth().SetBitbucketIDTokenValidator(idTokenValidator)
 
 	// helper for creating RegisterUsingTokenRequest
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
 		return &types.RegisterUsingTokenRequest{
@@ -146,7 +156,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name:          "multiple allow rules",
+			name:          "multiple-allow-rules",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -167,7 +177,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name:          "incorrect workspace uuid",
+			name:          "incorrect-workspace-uuid",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -186,7 +196,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect repository uuid",
+			name:          "incorrect-repository-uuid",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -205,7 +215,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect branch name",
+			name:          "incorrect-branch-name",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -224,7 +234,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect deployment environment",
+			name:          "incorrect-deployment-environment",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -243,7 +253,7 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "invalid token",
+			name:          "invalid-token",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodBitbucket,
@@ -257,17 +267,17 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 				},
 			},
 			request: newRequest("some other token"),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, errMockInvalidToken)
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "invalid token")
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.setEnterprise {
-				modules.SetTestModules(
+				modulestest.SetTestModules(
 					t,
-					&modules.TestModules{TestBuildType: modules.BuildEnterprise},
+					modulestest.Modules{TestBuildType: modules.BuildEnterprise},
 				)
 			}
 
@@ -278,8 +288,48 @@ func TestAuth_RegisterUsingToken_Bitbucket(t *testing.T) {
 			require.NoError(t, auth.CreateToken(ctx, token))
 			tt.request.Token = tt.name
 
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tt.request)
+				tt.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodBitbucket,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodBitbucket,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
 		})
 	}
 }
diff --git a/lib/join/join_bound_keypair_test.go b/lib/join/join_bound_keypair_test.go
new file mode 100644
index 0000000000000..7ee4f7def72f4
--- /dev/null
+++ b/lib/join/join_bound_keypair_test.go
@@ -0,0 +1,1459 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/tls"
+	"encoding/pem"
+	"errors"
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/boundkeypair"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+func testBoundKeypair(t *testing.T) (crypto.Signer, string) {
+	key, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+
+	return key.Signer, strings.TrimSpace(string(key.MarshalSSHPublicKey()))
+}
+
+// parseJoinState parses a join state token without verification, for testing
+// purposes only.
+func parseJoinState(t *testing.T, state []byte) *boundkeypair.JoinState {
+	token, err := jwt.ParseSigned(string(state))
+	require.NoError(t, err)
+
+	var doc boundkeypair.JoinState
+	require.NoError(t, token.UnsafeClaimsWithoutVerification(&doc))
+
+	return &doc
+}
+
+func newTestTLSServer(t *testing.T, clock clockwork.Clock) *authtest.TLSServer {
+	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		Dir:   t.TempDir(),
+		Clock: clock,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, as.Close()) })
+
+	srv, err := as.NewTestTLSServer()
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := srv.Close()
+		if errors.Is(err, net.ErrClosed) {
+			return
+		}
+		require.NoError(t, err)
+	})
+	return srv
+}
+
+func TestJoinBoundKeypair(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	correctSigner, correctPublicKey := testBoundKeypair(t)
+	rotatedSigner, rotatedPublicKey := testBoundKeypair(t)
+	incorrectSigner, incorrectPublicKey := testBoundKeypair(t)
+
+	signers := map[string]crypto.Signer{
+		correctPublicKey:   correctSigner,
+		rotatedPublicKey:   rotatedSigner,
+		incorrectPublicKey: incorrectSigner,
+	}
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+	startTime := clock.Now()
+
+	srv := newTestTLSServer(t, clock)
+	authServer := srv.Auth()
+
+	_, err := authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	jwtCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.BoundKeypairCA,
+		DomainName: srv.ClusterName(),
+	}, /* loadKeys */ true)
+	require.NoError(t, err)
+
+	jwtSigner, err := authServer.GetKeyStore().GetJWTSigner(ctx, jwtCA)
+	require.NoError(t, err)
+
+	// An invalid signer for signing "fake" JWTs.
+	invalidJWTSigner, _ := testBoundKeypair(t)
+
+	makeToken := func(mutators ...func(v2 *types.ProvisionTokenV2)) types.ProvisionTokenV2 {
+		token := types.ProvisionTokenV2{
+			Spec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodBoundKeypair,
+				Roles:      []types.SystemRole{types.RoleBot},
+				BotName:    "test",
+				BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+					Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{},
+					Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+						Mode: boundkeypair.RecoveryModeInsecure,
+					},
+				},
+			},
+			Status: &types.ProvisionTokenStatusV2{
+				BoundKeypair: &types.ProvisionTokenStatusV2BoundKeypair{},
+			},
+		}
+		for _, mutator := range mutators {
+			mutator(&token)
+		}
+		return token
+	}
+
+	withRecovery := func(mode string, count, limit uint32, botInstanceID string) func(*types.ProvisionTokenV2) {
+		return func(v2 *types.ProvisionTokenV2) {
+			v2.Spec.BoundKeypair.Recovery.Mode = mode
+			v2.Spec.BoundKeypair.Recovery.Limit = limit
+			v2.Status.BoundKeypair.RecoveryCount = count
+			v2.Status.BoundKeypair.BoundBotInstanceID = botInstanceID
+		}
+	}
+
+	withInitialKey := func(key string) func(*types.ProvisionTokenV2) {
+		return func(v2 *types.ProvisionTokenV2) {
+			v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = key
+		}
+	}
+
+	withBoundKey := func(key string) func(*types.ProvisionTokenV2) {
+		return func(v2 *types.ProvisionTokenV2) {
+			v2.Status.BoundKeypair.BoundPublicKey = key
+		}
+	}
+
+	makeJoinState := func(signer crypto.Signer, mutators ...func(s *boundkeypair.JoinStateParams)) string {
+		params := &boundkeypair.JoinStateParams{
+			Clock:       srv.Clock(),
+			ClusterName: srv.ClusterName(),
+		}
+
+		for _, mutator := range mutators {
+			mutator(params)
+		}
+
+		state, err := boundkeypair.IssueJoinState(signer, params)
+		require.NoError(t, err)
+
+		return state
+	}
+
+	withToken := func(mutators ...func(v2 *types.ProvisionTokenV2)) func(*boundkeypair.JoinStateParams) {
+		return func(jsp *boundkeypair.JoinStateParams) {
+			token := makeToken(mutators...)
+			jsp.Token = &token
+		}
+	}
+
+	type solver struct {
+		signingKeys  []string
+		rotationKeys []string
+
+		rotationCount  int
+		challengeCount int
+		solutionKeys   []string
+
+		getSigner         joinclient.GetSignerFunc
+		requestNewKeypair joinclient.KeygenFunc
+	}
+
+	makeSolver := func(mutators ...func(s *solver)) *solver {
+		s := &solver{}
+		for _, mutator := range mutators {
+			mutator(s)
+		}
+
+		s.getSigner = func(pubKey string) (crypto.Signer, error) {
+			// getSigner will return signers in order from s.signingKeys, these
+			// may not match pubKey requested but that will test signatures
+			// using an incorrect key.
+			s.challengeCount++
+			challengeNum := s.challengeCount
+			if s.challengeCount > len(s.signingKeys) {
+				return nil, trace.Errorf("unabled to sign (solver has %d signing keys, %d challenges requested)", len(s.signingKeys), challengeNum)
+			}
+			signerPubKey := s.signingKeys[challengeNum-1]
+			signer, ok := signers[signerPubKey]
+			if !ok {
+				return nil, trace.NotFound("key not found: %s", signerPubKey)
+			}
+			s.solutionKeys = append(s.solutionKeys, signerPubKey)
+			return signer, nil
+		}
+
+		s.requestNewKeypair = func(_ context.Context, _ cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+			// requestNewKeypair will return signers in order from
+			// s.rotationKeys.
+			s.rotationCount++
+			if s.rotationCount > len(s.rotationKeys) {
+				return nil, trace.BadParameter("can't generate key")
+			}
+			nextPubKey := s.rotationKeys[s.rotationCount-1]
+			signer, ok := signers[nextPubKey]
+			if !ok {
+				return nil, trace.NotFound("signer for rotatedPubKey not found")
+			}
+			return signer, nil
+		}
+
+		return s
+	}
+
+	withSigningKeys := func(pubKeys ...string) func(s *solver) {
+		return func(s *solver) {
+			s.signingKeys = pubKeys
+		}
+	}
+
+	withRotationKeys := func(pubKeys ...string) func(s *solver) {
+		return func(s *solver) {
+			s.rotationKeys = pubKeys
+		}
+	}
+
+	// Advance the clock a bit. Tests may reference `startTime` for a past
+	// reference point.
+	clock.Advance(time.Hour)
+
+	// Make an unauthenticated auth client that will be used for joining.
+	nopClient, err := srv.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+
+		token             types.ProvisionTokenV2
+		initialJoinSecret string
+		previousJoinState string
+		solver            *solver
+
+		assertError       require.ErrorAssertionFunc
+		assertResponse    func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult)
+		assertSolverState func(t *testing.T, s *solver)
+	}{
+		{
+			// an initial key but no bound key, and no bound bot instance. aka,
+			// initial join with preregistered key
+			name: "initial-join-success",
+
+			token:  makeToken(withInitialKey(correctPublicKey)),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *joinclient.BoundKeypairResult) {
+				// join count should be incremented
+				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
+				require.NotEmpty(t, v2.Status.BoundKeypair.BoundBotInstanceID)
+				require.NotEmpty(t, v2.Status.BoundKeypair.BoundPublicKey)
+			},
+		},
+		{
+			// no bound key, no bound bot instance, aka initial join without
+			// secret
+			name: "initial-join-with-wrong-key",
+
+			token:  makeToken(withInitialKey(correctPublicKey)),
+			solver: makeSolver(withSigningKeys(incorrectPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "failed to complete challenge")
+			},
+		},
+		{
+			// bound key but no valid incoming bot instance, i.e. the certs
+			// expired and triggered a hard rejoin
+			name: "rejoin-success",
+
+			token: makeToken(withBoundKey(correctPublicKey), func(v2 *types.ProvisionTokenV2) {
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *joinclient.BoundKeypairResult) {
+				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
+
+				// Should generate a new bot instance
+				require.NotEmpty(t, v2.Status.BoundKeypair.BoundBotInstanceID)
+				require.NotEqual(t, "asdf", v2.Status.BoundKeypair.BoundBotInstanceID)
+			},
+		},
+		{
+			// Bad state: somehow a key was registered without a bot instance.
+			// This should fail and prompt the user to recreate the token.
+			name: "bound-key-no-instance",
+
+			token:  makeToken(withBoundKey(correctPublicKey)),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "bad backend state")
+			},
+		},
+		{
+			name:        "standard-initial-recovery-success",
+			token:       makeToken(withRecovery("standard", 0, 1, ""), withInitialKey(correctPublicKey)),
+			solver:      makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
+
+				require.NotNil(t, res)
+				require.NotEmpty(t, res.JoinState)
+			},
+		},
+		{
+			name:              "standard-success-second-recovery",
+			token:             makeToken(withRecovery("standard", 1, 2, "id"), withInitialKey(correctPublicKey)),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError:       require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, uint32(2), v2.Status.BoundKeypair.RecoveryCount)
+				require.NotNil(t, res)
+				state := parseJoinState(t, res.JoinState)
+				require.Equal(t, v2.Status.BoundKeypair.RecoveryCount, state.RecoverySequence)
+			},
+		},
+		{
+			name:   "standard-failure-missing-join-state",
+			token:  makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:              "standard-failure-limit-exhausted",
+			token:             makeToken(withRecovery("standard", 2, 2, "id")),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("standard", 2, 2, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "no recovery attempts remaining")
+			},
+		},
+		{
+			// Attempts to join with an outdated join state document should fail.
+			name:              "standard-failure-recovery-count-mismatch",
+			token:             makeToken(withRecovery("standard", 2, 3, "id"), withBoundKey(correctPublicKey)),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("standard", 1, 3, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:              "standard-failure-invalid-jwt",
+			token:             makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
+			previousJoinState: "asdf",
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:              "standard-failure-invalid-jwt-signature",
+			token:             makeToken(withRecovery("standard", 1, 2, "id"), withBoundKey(correctPublicKey)),
+			previousJoinState: makeJoinState(invalidJWTSigner, withToken(withRecovery("standard", 1, 2, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:              "standard-failure-invalid-instance-id",
+			token:             makeToken(withRecovery("standard", 1, 2, "foo"), withBoundKey(correctPublicKey)),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:  "standard-failure-invalid-cluster",
+			token: makeToken(withRecovery("standard", 1, 2, "foo"), withBoundKey(correctPublicKey)),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("standard", 1, 2, "id")), func(s *boundkeypair.JoinStateParams) {
+				s.ClusterName = "wrong-cluster"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "join state verification failed")
+			},
+		},
+		{
+			name:              "relaxed-success-count-over-limit",
+			token:             makeToken(withRecovery("relaxed", 1, 0, "id"), withBoundKey(correctPublicKey)),
+			previousJoinState: makeJoinState(jwtSigner, withToken(withRecovery("relaxed", 1, 0, "id"))),
+			solver:            makeSolver(withSigningKeys(correctPublicKey)),
+			assertError:       require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, uint32(2), v2.Status.BoundKeypair.RecoveryCount)
+
+				require.NotNil(t, res)
+				require.NotEmpty(t, res.JoinState)
+
+				state := parseJoinState(t, res.JoinState)
+				require.Equal(t, v2.Status.BoundKeypair.RecoveryCount, state.RecoverySequence)
+			},
+		},
+		{
+			// Initial rotation, i.e. `LastRotatedAt` isn't set. This should
+			// trigger as soon as the `RotateAfter` threshold has been crossed.
+			name: "first-rotation-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey, rotatedPublicKey), withRotationKeys(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, rotatedPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, rotatedPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey, rotatedPublicKey}, s.solutionKeys)
+			},
+		},
+		{
+			// Initial rotation timestamp hasn't been reached
+			name: "first-rotation-skipped",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				rotateAfter := clock.Now().Add(time.Minute)
+				v2.Spec.BoundKeypair.RotateAfter = &rotateAfter
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey), withRotationKeys(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutionKeys)
+			},
+		},
+		{
+			// This should only trigger after `RotateAfter` has been crossed and
+			// `LastRotatedAt` isn't after it.
+			name: "second-rotation-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				rotateAfter := startTime.Add(10 * time.Minute)
+				v2.Spec.BoundKeypair.RotateAfter = &rotateAfter
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+				v2.Status.BoundKeypair.LastRotatedAt = &startTime
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey, rotatedPublicKey), withRotationKeys(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, rotatedPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, rotatedPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey, rotatedPublicKey}, s.solutionKeys)
+			},
+		},
+		{
+			// We shouldn't try to rotate again if LastRotatedAt is greater than
+			// RotateAfter.
+			name: "second-rotation-skipped",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+
+				rotatedAt := startTime.Add(10 * time.Minute)
+				v2.Status.BoundKeypair.LastRotatedAt = &rotatedAt
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey), withRotationKeys(rotatedPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutionKeys)
+			},
+		},
+		{
+			// If the client doesn't complete rotation, an error should be
+			// returned and the key should not change on the server.
+			name: "rotation-failure",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "requesting new keypair")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+				require.Equal(t, []string{correctPublicKey}, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "rotation-same-key-not-allowed",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.RotateAfter = &startTime
+
+				v2.Status.BoundKeypair.BoundPublicKey = correctPublicKey
+				v2.Status.BoundKeypair.BoundBotInstanceID = "asdf"
+			}),
+			solver: makeSolver(withSigningKeys(correctPublicKey, correctPublicKey), withRotationKeys(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "public key may not be reused after rotation")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 2, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+
+				// note: the client does complete the challenge for the
+				// duplicate key, but the attempt will ultimately be rejected
+				require.Equal(t, []string{correctPublicKey, correctPublicKey}, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "registration-success",
+
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+			}),
+			initialJoinSecret: "secret",
+			solver:            makeSolver(withSigningKeys(correctPublicKey), withRotationKeys(correctPublicKey)),
+
+			assertError: require.NoError,
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 1, s.rotationCount)
+
+				// we'll only be asked for one challenge
+				require.Equal(t, []string{correctPublicKey}, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Equal(t, correctPublicKey, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Equal(t, correctPublicKey, res.BoundPublicKey)
+			},
+		},
+		{
+			name: "registration-failure-wrong-secret",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+			}),
+			initialJoinSecret: "asdf",
+			solver:            makeSolver(),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Empty(t, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			// in this case, the server will generate a registration secret
+			// automatically since nothing was set in .Onboarding. we won't know
+			// it in the test, but will know it tried to check the provided
+			// secret due to the error message.
+			name: "registration-failure-wrong-secret-autogenerated",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = ""
+			}),
+			initialJoinSecret: "asdf",
+			solver:            makeSolver(),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Empty(t, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			// Joining with the a secret when a key was expected should be
+			// handled as if the client couldn't complete the challenge (which
+			// it can't)
+			name: "registration-failure-expected-key",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = correctPublicKey
+			}),
+			initialJoinSecret: "asdf",
+			solver:            makeSolver(withSigningKeys(rotatedPublicKey), withRotationKeys(rotatedPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "failed to complete challenge")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 1, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Equal(t, []string{rotatedPublicKey}, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+		{
+			name: "registration-failure-secret-expired",
+			token: makeToken(func(v2 *types.ProvisionTokenV2) {
+				v2.Spec.BoundKeypair.Onboarding.InitialPublicKey = ""
+				v2.Spec.BoundKeypair.Onboarding.RegistrationSecret = "secret"
+				v2.Spec.BoundKeypair.Onboarding.MustRegisterBefore = &startTime
+			}),
+			initialJoinSecret: "secret",
+			solver:            makeSolver(),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "a valid registration secret is required")
+			},
+			assertSolverState: func(t *testing.T, s *solver) {
+				require.EqualValues(t, 0, s.challengeCount)
+				require.EqualValues(t, 0, s.rotationCount)
+				require.Empty(t, s.solutionKeys)
+			},
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult) {
+				require.Empty(t, v2.Status.BoundKeypair.BoundPublicKey)
+				require.Nil(t, res)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token, err := types.NewProvisionTokenFromSpecAndStatus(
+				tt.name, time.Now().Add(2*time.Hour), tt.token.Spec, tt.token.Status,
+			)
+			require.NoError(t, err)
+
+			// note: we only override CreateToken in ServerWithRoles, so we'll
+			// need to call CreateBoundKeypairToken() directly to ensure
+			// computed fields (i.e. registration secrets) are handled properly.
+			require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+			joinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+				Token: token.GetName(),
+				ID: state.IdentityID{
+					Role: types.RoleBot,
+				},
+				AuthClient: nopClient,
+				BoundKeypairParams: &joinclient.BoundKeypairParams{
+					RegistrationSecret: tt.initialJoinSecret,
+					PreviousJoinState:  []byte(tt.previousJoinState),
+					GetSigner:          tt.solver.getSigner,
+					RequestNewKeypair:  tt.solver.requestNewKeypair,
+				},
+			})
+			tt.assertError(t, err)
+
+			if tt.assertResponse != nil {
+				pt, err := authServer.GetToken(ctx, tt.name)
+				require.NoError(t, err)
+				require.IsType(t, (*types.ProvisionTokenV2)(nil), pt)
+				var boundKeypairResult *joinclient.BoundKeypairResult
+				if joinResult != nil {
+					boundKeypairResult = joinResult.BoundKeypair
+				}
+				tt.assertResponse(t, pt.(*types.ProvisionTokenV2), boundKeypairResult)
+			}
+
+			if tt.assertSolverState != nil {
+				tt.assertSolverState(t, tt.solver)
+			}
+		})
+	}
+
+	rejoinTests := []struct {
+		name string
+
+		mutateToken func(*types.ProvisionTokenV2)
+		solver      *solver
+
+		assertError    require.ErrorAssertionFunc
+		assertResponse func(t *testing.T, v2 *types.ProvisionTokenV2, res *joinclient.BoundKeypairResult)
+	}{
+		{
+			// bound key, valid bound bot instance, aka "soft join"
+			name: "reauth-success",
+
+			mutateToken: func(v2 *types.ProvisionTokenV2) {},
+			solver:      makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: require.NoError,
+			assertResponse: func(t *testing.T, v2 *types.ProvisionTokenV2, _ *joinclient.BoundKeypairResult) {
+				// join count should not be incremented, it should be 1 from the initial join.
+				require.Equal(t, uint32(1), v2.Status.BoundKeypair.RecoveryCount)
+			},
+		},
+		{
+			// bound key, seemingly valid bot instance, but wrong key
+			// (should be impossible, but should fail anyway)
+			name: "reauth-with-wrong-key",
+
+			solver: makeSolver(withSigningKeys(incorrectPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "validating challenge response")
+			},
+		},
+		{
+			// The client somehow presents certs that refer to a different
+			// instance, maybe tried switching auth methods.
+			name: "bound-key-wrong-instance",
+
+			mutateToken: func(v2 *types.ProvisionTokenV2) {
+				v2.Status.BoundKeypair.BoundBotInstanceID = "qwerty"
+			},
+			solver: makeSolver(withSigningKeys(correctPublicKey)),
+
+			assertError: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "bot instance mismatch")
+			},
+		},
+	}
+	for _, tt := range rejoinTests {
+		t.Run(tt.name, func(t *testing.T) {
+			token := makeToken(withInitialKey(correctPublicKey))
+			token.SetName(tt.name)
+			initialSolver := makeSolver(withSigningKeys(correctPublicKey))
+			require.NoError(t, authServer.CreateBoundKeypairToken(ctx, &token))
+
+			initialJoinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+				Token: token.GetName(),
+				ID: state.IdentityID{
+					Role: types.RoleBot,
+				},
+				AuthClient: nopClient,
+				BoundKeypairParams: &joinclient.BoundKeypairParams{
+					GetSigner:         initialSolver.getSigner,
+					RequestNewKeypair: initialSolver.requestNewKeypair,
+				},
+			})
+			require.NoError(t, err)
+			botClient, err := clientFromJoinResult(srv, initialJoinResult)
+			require.NoError(t, err)
+
+			if tt.mutateToken != nil {
+				pt, err := authServer.GetToken(ctx, token.GetName())
+				require.NoError(t, err)
+				require.IsType(t, (*types.ProvisionTokenV2)(nil), pt)
+				tt.mutateToken(pt.(*types.ProvisionTokenV2))
+				require.NoError(t, authServer.UpsertToken(ctx, pt))
+			}
+
+			rejoinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+				Token: token.GetName(),
+				ID: state.IdentityID{
+					Role: types.RoleBot,
+				},
+				AuthClient: botClient,
+				BoundKeypairParams: &joinclient.BoundKeypairParams{
+					GetSigner:         tt.solver.getSigner,
+					RequestNewKeypair: tt.solver.requestNewKeypair,
+				},
+			})
+			tt.assertError(t, err)
+
+			if tt.assertResponse != nil {
+				pt, err := authServer.GetToken(ctx, token.GetName())
+				require.NoError(t, err)
+				require.IsType(t, (*types.ProvisionTokenV2)(nil), pt)
+				var boundKeypairResult *joinclient.BoundKeypairResult
+				if rejoinResult != nil {
+					boundKeypairResult = rejoinResult.BoundKeypair
+				}
+				tt.assertResponse(t, pt.(*types.ProvisionTokenV2), boundKeypairResult)
+			}
+		})
+	}
+}
+
+func TestJoinBoundKeypair_GenerationCounter(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	correctSigner, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, clock)
+	authServer := srv.Auth()
+
+	_, err := authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 3,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	// Make an unauthenticated auth client that will be used for joining.
+	nopClient, err := srv.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	joinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	firstInstance, generation := testExtractBotParamsFromCerts(t, joinResult.Certs)
+	require.Equal(t, uint64(1), generation)
+
+	// Rejoin several times.
+	for i := range 10 {
+		botClient, err := clientFromJoinResult(srv, joinResult)
+		require.NoError(t, err)
+
+		joinResult, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+			Token: token.GetName(),
+			ID: state.IdentityID{
+				Role: types.RoleBot,
+			},
+			AuthClient: botClient,
+			BoundKeypairParams: &joinclient.BoundKeypairParams{
+				PreviousJoinState: joinResult.BoundKeypair.JoinState,
+				GetSigner: func(pubKey string) (crypto.Signer, error) {
+					return correctSigner, nil
+				},
+				RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+					return nil, trace.Errorf("no rotation expected")
+				},
+			},
+		})
+		require.NoError(t, err)
+
+		instance, generation := testExtractBotParamsFromCerts(t, joinResult.Certs)
+		require.Equal(t, uint64(i+2), generation)
+		require.Equal(t, firstInstance, instance)
+	}
+
+	// Perform a recovery to get a new instance and reset the counter.
+	// A recovery entails joining with an unauthenticated client and the
+	// correct previous join state and bound key.
+	joinResult, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: joinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	secondInstance, generation := testExtractBotParamsFromCerts(t, joinResult.Certs)
+	require.Equal(t, uint64(1), generation)
+	require.NotEqual(t, firstInstance, secondInstance)
+
+	// Save an old client with outdated generation counter
+	oldClient, err := clientFromJoinResult(srv, joinResult)
+	require.NoError(t, err)
+
+	// Rejoin several more times.
+	for i := range 10 {
+		botClient, err := clientFromJoinResult(srv, joinResult)
+		require.NoError(t, err)
+
+		joinResult, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+			Token: token.GetName(),
+			ID: state.IdentityID{
+				Role: types.RoleBot,
+			},
+			AuthClient: botClient,
+			BoundKeypairParams: &joinclient.BoundKeypairParams{
+				PreviousJoinState: joinResult.BoundKeypair.JoinState,
+				GetSigner: func(pubKey string) (crypto.Signer, error) {
+					return correctSigner, nil
+				},
+				RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+					return nil, trace.Errorf("no rotation expected")
+				},
+			},
+		})
+		require.NoError(t, err)
+
+		instance, generation := testExtractBotParamsFromCerts(t, joinResult.Certs)
+		require.Equal(t, uint64(i+2), generation)
+		require.Equal(t, secondInstance, instance)
+	}
+
+	// Try an API call with the bot certs.
+	botClient, err := clientFromJoinResult(srv, joinResult)
+	require.NoError(t, err)
+	_, err = botClient.Ping(ctx)
+	require.NoError(t, err)
+
+	// Try to rejoin with an old client using the old generation count.
+	_, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: oldClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: joinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.Error(t, err)
+
+	// The token should now be locked.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: token.GetName(),
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "only one lock should be generated")
+	require.Contains(t, locks[0].Message(), "certificate generation mismatch")
+
+	// Using the previously working client, make sure API calls no longer work.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err = botClient.Ping(ctx)
+		assert.ErrorContains(t, err, "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Try rejoining again now that we know the lock is properly in force.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: botClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: joinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.ErrorContains(t, err, "have been locked due to a certificate generation mismatch")
+}
+
+// TestJoinBoundKeypair_JoinStateFailure tests that join state verification
+// will trigger a lock if the original client and a secondary client both
+// attempt to recover in sequence.
+func TestJoinBoundKeypair_JoinStateFailure(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	correctSigner, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, clock)
+	authServer := srv.Auth()
+
+	_, err := authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 3,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	// Make an unauthenticated auth client that will be used for joining.
+	nopClient, err := srv.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	originalJoinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Perform a recovery, this time with a join state.
+	recoverResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	recoveredBotClient, err := clientFromJoinResult(srv, recoverResult)
+	require.NoError(t, err)
+
+	// Try an API call with these certs.
+	_, err = recoveredBotClient.Ping(ctx)
+	require.NoError(t, err)
+
+	// Try to recover again, but with the original join state.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.Error(t, err)
+
+	// The token should now be locked - but only once.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: "bound-keypair-test",
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "only one lock should be generated")
+	require.Contains(t, locks[0].Message(), "failed to verify its join state")
+
+	// The previously working client should be locked.
+	require.Eventually(t, func() bool {
+		_, err = recoveredBotClient.Ping(ctx)
+		return err != nil && strings.Contains(err.Error(), "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Repeat the recovery attempt but with an Eventually() to consistently
+	// check the error message. Depending on exact timing / cache propagation /
+	// etc the lock may or may not be in force, but we also need to be
+	// absolutely certain to try to generate at least 2 locking events.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err = joinclient.Join(ctx, joinclient.JoinParams{
+			Token: token.GetName(),
+			ID: state.IdentityID{
+				Role: types.RoleBot,
+			},
+			AuthClient: nopClient,
+			BoundKeypairParams: &joinclient.BoundKeypairParams{
+				PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+				GetSigner: func(pubKey string) (crypto.Signer, error) {
+					return correctSigner, nil
+				},
+				RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+					return nil, trace.Errorf("no rotation expected")
+				},
+			},
+		})
+		require.ErrorContains(t, err, "a client failed to verify its join state")
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+// TestJoinBoundKeypair_JoinStateFailureDuringRenewal, similar to
+// _JoinStateFailure above, exercises the case where the original client still
+// has valid certs and isn't attempting a recovery of its own.
+func TestJoinBoundKeypair_JoinStateFailureDuringRenewal(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	correctSigner, correctPublicKey := testBoundKeypair(t)
+
+	clock := clockwork.NewFakeClockAt(time.Now().Round(time.Second).UTC())
+
+	srv := newTestTLSServer(t, clock)
+	authServer := srv.Auth()
+
+	_, err := authtest.CreateRole(ctx, authServer, "example", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	adminClient, err := srv.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "test",
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: []string{"example"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpecAndStatus(
+		"bound-keypair-test",
+		time.Now().Add(2*time.Hour),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodBoundKeypair,
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "test",
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: correctPublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{
+					Limit: 3,
+				},
+			},
+		},
+		&types.ProvisionTokenStatusV2{},
+	)
+	require.NoError(t, err)
+	require.NoError(t, authServer.CreateBoundKeypairToken(ctx, token))
+
+	// Make an unauthenticated auth client that will be used for joining.
+	nopClient, err := srv.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	// Perform the initial registration
+	originalJoinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+	originalBotClient, err := clientFromJoinResult(srv, originalJoinResult)
+	require.NoError(t, err)
+
+	// Perform a recovery, this time with a join state, simulating an attacker
+	// that has copied the certs.
+	attackerResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: nopClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	attackerClient, err := clientFromJoinResult(srv, attackerResult)
+	require.NoError(t, err)
+
+	// Try an API call with these certs.
+	_, err = attackerClient.Ping(ctx)
+	require.NoError(t, err)
+
+	// Simulate the original valid bot trying to rejoin to renew its
+	// certificates, with an authenticated client and the valid original join
+	// state.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
+		Token: token.GetName(),
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthClient: originalBotClient,
+		BoundKeypairParams: &joinclient.BoundKeypairParams{
+			PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+			GetSigner: func(pubKey string) (crypto.Signer, error) {
+				return correctSigner, nil
+			},
+			RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+				return nil, trace.Errorf("no rotation expected")
+			},
+		},
+	})
+	require.Error(t, err)
+
+	// The token should now be locked - but only once.
+	locks, err := srv.Auth().GetLocks(ctx, true, types.LockTarget{
+		JoinToken: "bound-keypair-test",
+	})
+	require.NoError(t, err)
+	require.Len(t, locks, 1, "only one lock should be generated")
+	require.Contains(t, locks[0].Message(), "failed to verify its join state")
+
+	// The previously working client should be locked.
+	require.Eventually(t, func() bool {
+		_, err = attackerClient.Ping(ctx)
+		return err != nil && strings.Contains(err.Error(), "access denied")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Repeat the valid bot rejoin attempt but with an Eventually() to
+	// consistently check the error message. Depending on exact timing / cache
+	// propagation / etc the lock may or may not be in force, but we also need
+	// to be absolutely certain to try to generate at least 2 locking events.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err = joinclient.Join(ctx, joinclient.JoinParams{
+			Token: token.GetName(),
+			ID: state.IdentityID{
+				Role: types.RoleBot,
+			},
+			AuthClient: originalBotClient,
+			BoundKeypairParams: &joinclient.BoundKeypairParams{
+				PreviousJoinState: originalJoinResult.BoundKeypair.JoinState,
+				GetSigner: func(pubKey string) (crypto.Signer, error) {
+					return correctSigner, nil
+				},
+				RequestNewKeypair: func(ctx context.Context, getSuite cryptosuites.GetSuiteFunc) (crypto.Signer, error) {
+					return nil, trace.Errorf("no rotation expected")
+				},
+			},
+		})
+		require.Error(t, err)
+		require.ErrorContains(t, err, "a client failed to verify its join state")
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+func clientFromJoinResult(srv *authtest.TLSServer, joinResult *joinclient.JoinResult) (*authclient.Client, error) {
+	certPemBlock, _ := pem.Decode(joinResult.Certs.TLS)
+	return srv.NewClientWithCert(tls.Certificate{
+		Certificate: [][]byte{certPemBlock.Bytes},
+		PrivateKey:  joinResult.PrivateKey,
+	})
+}
+
+type tHelper interface {
+	Helper()
+}
+
+func testExtractBotParamsFromCerts(t require.TestingT, certs *proto.Certs) (string, uint64) {
+	// we might not have .Helper() available for require.CollectT
+	if h, ok := t.(tHelper); ok {
+		h.Helper()
+	}
+
+	parsed, err := tlsca.ParseCertificatePEM(certs.TLS)
+	require.NoError(t, err)
+	ident, err := tlsca.FromSubject(parsed.Subject, parsed.NotAfter)
+	require.NoError(t, err)
+
+	return ident.BotInstanceID, ident.Generation
+}
diff --git a/lib/join/join_circleci_test.go b/lib/join/join_circleci_test.go
new file mode 100644
index 0000000000000..1bc9fbfbc6531
--- /dev/null
+++ b/lib/join/join_circleci_test.go
@@ -0,0 +1,268 @@
+/*
+ * Teleport
+ * Copyright (C) 2023-2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+)
+
+func TestAuth_RegisterUsingToken_CircleCI(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	var (
+		validIDToken  = "valid-token"
+		validOrg      = "valid-org"
+		validProject  = "valid-project"
+		validContextA = "valid-context-a"
+		validContextB = "valid-context-b"
+	)
+	// stand up auth server with mocked CircleCI token validator
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	authServer.Auth().SetCircleCITokenValidator(func(
+		ctx context.Context, issuerURL, organizationID, token string,
+	) (*circleci.IDTokenClaims, error) {
+		if organizationID == validOrg && token == validIDToken {
+			return &circleci.IDTokenClaims{
+				Sub:        "org/valid-org/project/valid-project/user/USER_ID",
+				ProjectID:  validProject,
+				ContextIDs: []string{validContextA, validContextB},
+			}, nil
+		}
+		return nil, errMockInvalidToken
+	})
+
+	// helper for creating RegisterUsingTokenRequest
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
+		return &types.RegisterUsingTokenRequest{
+			HostID:       "host-id",
+			Role:         types.RoleNode,
+			IDToken:      idToken,
+			PublicTLSKey: tlsPublicKey,
+			PublicSSHKey: sshPublicKey,
+		}
+	}
+	provisionTokenSpec := func(spec *types.ProvisionTokenSpecV2CircleCI) types.ProvisionTokenSpecV2 {
+		return types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodCircleCI,
+			Roles:      types.SystemRoles{types.RoleNode},
+			CircleCI:   spec,
+		}
+	}
+
+	// helpers for error assertions
+	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
+		messageMatch := assert.ErrorContains(t, err, "id token claims did not match any allow rules")
+		typeMatch := assert.True(t, trace.IsAccessDenied(err))
+		require.True(t, messageMatch && typeMatch)
+	})
+	tokenNotMatched := func(t require.TestingT, err error, i ...any) {
+		require.ErrorContains(t, err, "invalid token")
+	}
+	tests := []struct {
+		name        string
+		request     *types.RegisterUsingTokenRequest
+		tokenSpec   types.ProvisionTokenSpecV2
+		assertError require.ErrorAssertionFunc
+	}{
+		{
+			name:    "matching-all",
+			request: newRequest(validIDToken),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ProjectID: validProject,
+						ContextID: validContextA,
+					},
+				},
+			}),
+			assertError: require.NoError,
+		},
+		{
+			name:    "matching-second-context",
+			request: newRequest(validIDToken),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ContextID: validContextB,
+					},
+				},
+			}),
+			assertError: require.NoError,
+		},
+		{
+			name:    "invalid-org",
+			request: newRequest(validIDToken),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: "not-this-org",
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ContextID: validContextB,
+					},
+				},
+			}),
+			assertError: tokenNotMatched,
+		},
+		{
+			name:    "invalid-IDToken",
+			request: newRequest("not-this-token"),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ContextID: validContextB,
+					},
+				},
+			}),
+			assertError: tokenNotMatched,
+		},
+		{
+			name:    "missing-IDToken-in-request",
+			request: newRequest(""),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ContextID: validContextB,
+					},
+				},
+			}),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.Error(t, err)
+
+				msg := err.Error()
+				hasBackendError := strings.Contains(msg, "IDToken is required")
+				hasClientError := strings.Contains(msg, "'CIRCLE_OIDC_TOKEN' must be present")
+
+				require.True(t, hasBackendError || hasClientError, "matches at least one known error when IDToken is unset")
+			},
+		},
+		{
+			name:    "invalid-context",
+			request: newRequest(validIDToken),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ProjectID: validProject,
+						ContextID: "not-this-context",
+					},
+				},
+			}),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:    "invalid-project",
+			request: newRequest(validIDToken),
+			tokenSpec: provisionTokenSpec(&types.ProvisionTokenSpecV2CircleCI{
+				OrganizationID: validOrg,
+				Allow: []*types.ProvisionTokenSpecV2CircleCI_Rule{
+					{
+						ProjectID: "invalid-project",
+						ContextID: validContextA,
+					},
+				},
+			}),
+			assertError: allowRulesNotMatched,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create Token resource for use in test
+			token, err := types.NewProvisionTokenFromSpec(
+				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
+			)
+			require.NoError(t, err)
+			require.NoError(t, auth.CreateToken(ctx, token))
+			tt.request.Token = token.GetName()
+
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tt.request)
+				tt.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodCircleCI,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodCircleCI,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
+		})
+	}
+
+}
diff --git a/lib/join/join_ec2_test.go b/lib/join/join_ec2_test.go
new file mode 100644
index 0000000000000..98ff217c9cd06
--- /dev/null
+++ b/lib/join/join_ec2_test.go
@@ -0,0 +1,797 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/join/ec2join"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+)
+
+type ec2Instance struct {
+	iid         []byte
+	account     string
+	region      string
+	instanceID  string
+	pendingTime time.Time
+}
+
+var (
+	instance1 = ec2Instance{
+		iid: []byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
+23sKICAiYWNjb3VudElkIiA6ICIyNzg1NzYyMjA0NTMiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
+Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMmEiLAogICJiaWxsaW5nUHJv
+ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
+YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wZmE5ZTFmNjQxNDJj
+ZGUxNyIsCiAgImluc3RhbmNlSWQiIDogImktMDc4NTE3Y2E4YTcwYTFkZGUiLAogICJpbnN0YW5j
+ZVR5cGUiIDogInQyLm1lZGl1bSIsCiAgImtlcm5lbElkIiA6IG51bGwsCiAgInBlbmRpbmdUaW1l
+IiA6ICIyMDIxLTA5LTAzVDIxOjI1OjQ0WiIsCiAgInByaXZhdGVJcCIgOiAiMTAuMC4wLjIwOSIs
+CiAgInJhbWRpc2tJZCIgOiBudWxsLAogICJyZWdpb24iIDogInVzLXdlc3QtMiIsCiAgInZlcnNp
+b24iIDogIjIwMTctMDktMzAiCn0AAAAAAAAxggIvMIICKwIBATBpMFwxCzAJBgNVBAYTAlVTMRkw
+FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6
+b24gV2ViIFNlcnZpY2VzIExMQwIJALZL3lrQCSTMMA0GCWCGSAFlAwQCAQUAoIGYMBgGCSqGSIb3
+DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIxMDkwMzIxMjU0N1owLQYJKoZIhvcN
+AQk0MSAwHjANBglghkgBZQMEAgEFAKENBgkqhkiG9w0BAQsFADAvBgkqhkiG9w0BCQQxIgQgCH2d
+JiKmdx9uhxlm8ObWAvFOhqJb7k79+DW/T3ezwVUwDQYJKoZIhvcNAQELBQAEggEANWautigs/qZ6
+w8g5/EfWsAFj8kHgUD+xqsQ1HDrBUx3IQ498NMBZ78379B8RBfuzeVjbaf+yugov0fYrDbGvSRRw
+myy49TfZ9gdlpWQXzwSg3OPMDNToRoKw00/LQjSxcTCaPP4vMDEIjYMUqZ3i4uWYJJJ0Lb7fDMDk
+Anu7yHolVfbnvIAuZe8lGpc7ofCSBG5wulm+/pqzO25YPMH1cLEvOadE+3N2GxK6gRTLJoE98rsm
+LDp6OuU/b2QfaxU0ec6OogdtSJto/URI0/ygHmNAzBis470A29yh5nVwm6AkY4krjPsK7uiBIRhs
+lr5x0X6+ggQfF2BKAJ/BRcAHNgAAAAAAAA==`),
+		account:     "278576220453",
+		region:      "us-west-2",
+		instanceID:  "i-078517ca8a70a1dde",
+		pendingTime: time.Date(2021, time.September, 3, 21, 25, 44, 0, time.UTC),
+	}
+	instance2 = ec2Instance{
+		iid: []byte(`MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwGggCSABIIB
+3XsKICAiYWNjb3VudElkIiA6ICI4ODM0NzQ2NjI4ODgiLAogICJhcmNoaXRlY3R1cmUiIDogIng4
+Nl82NCIsCiAgImF2YWlsYWJpbGl0eVpvbmUiIDogInVzLXdlc3QtMWMiLAogICJiaWxsaW5nUHJv
+ZHVjdHMiIDogbnVsbCwKICAiZGV2cGF5UHJvZHVjdENvZGVzIiA6IG51bGwsCiAgIm1hcmtldHBs
+YWNlUHJvZHVjdENvZGVzIiA6IG51bGwsCiAgImltYWdlSWQiIDogImFtaS0wY2UzYzU1YTMxZDI5
+MDQwZSIsCiAgImluc3RhbmNlSWQiIDogImktMDFiOTQwYzQ1ZmQxMWZlNzQiLAogICJpbnN0YW5j
+ZVR5cGUiIDogInQyLm1pY3JvIiwKICAia2VybmVsSWQiIDogbnVsbCwKICAicGVuZGluZ1RpbWUi
+IDogIjIwMjEtMDktMTFUMDA6MTQ6MThaIiwKICAicHJpdmF0ZUlwIiA6ICIxNzIuMzEuMTIuMjUx
+IiwKICAicmFtZGlza0lkIiA6IG51bGwsCiAgInJlZ2lvbiIgOiAidXMtd2VzdC0xIiwKICAidmVy
+c2lvbiIgOiAiMjAxNy0wOS0zMCIKfQAAAAAAADGCAi8wggIrAgEBMGkwXDELMAkGA1UEBhMCVVMx
+GTAXBgNVBAgTEFdhc2hpbmd0b24gU3RhdGUxEDAOBgNVBAcTB1NlYXR0bGUxIDAeBgNVBAoTF0Ft
+YXpvbiBXZWIgU2VydmljZXMgTExDAgkA00+QilzIS0gwDQYJYIZIAWUDBAIBBQCggZgwGAYJKoZI
+hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjEwOTExMDAxNDIyWjAtBgkqhkiG
+9w0BCTQxIDAeMA0GCWCGSAFlAwQCAQUAoQ0GCSqGSIb3DQEBCwUAMC8GCSqGSIb3DQEJBDEiBCDS
+1gNvxbYnEL6plVu8X/QmKPJFJwIJfi+2hIVjyKAOtjANBgkqhkiG9w0BAQsFAASCAQABKmghATg8
+VXkdiIGcTIPfKrc2v/zEIdLUAi+Ew5lrGUVjnNqrP9irGK4d9sVtcu/8UKp9RDoeJOQ6I/pRcwvT
+PJVHlhGnLyybr5ZVqkxiC09GASNnPe12dzCKkKD2rvW6mGR91cxpM94Xqi5UA/ZRqiXwpHo3LECN
+Gu38Hpdv6sBgD/av2Ohd+vEH2zvYVkp7ZfnFuDLWRSBQZgmKwVKVdOjrMmP32vb3vzhMBuOj+jbQ
+RwEmYIkRaEGNbrZgatjMJYmTWuLG26zws3avOK6kL6u38DV3wJPVB/G0Ira5MvC/ojGya+DrVngW
+VUP+3jgenPrd7OyCWPSwOoOBMhSlAAAAAAAA`),
+		account:     "883474662888",
+		region:      "us-west-1",
+		instanceID:  "i-01b940c45fd11fe74",
+		pendingTime: time.Date(2021, time.September, 11, 0, 14, 18, 0, time.UTC),
+	}
+)
+
+type (
+	ec2ClientNoInstance struct{}
+	ec2ClientNotRunning struct{}
+	ec2ClientRunning    struct{}
+)
+
+func (c ec2ClientNoInstance) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
+	return &ec2.DescribeInstancesOutput{}, nil
+}
+
+func (c ec2ClientNotRunning) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
+	return &ec2.DescribeInstancesOutput{
+		Reservations: []ec2types.Reservation{
+			{
+				Instances: []ec2types.Instance{
+					{
+						InstanceId: &params.InstanceIds[0],
+						State: &ec2types.InstanceState{
+							Name: ec2types.InstanceStateNameTerminated,
+						},
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func (c ec2ClientRunning) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
+	return &ec2.DescribeInstancesOutput{
+		Reservations: []ec2types.Reservation{
+			{
+				Instances: []ec2types.Instance{
+					{
+						InstanceId: &params.InstanceIds[0],
+						State: &ec2types.InstanceState{
+							Name: ec2types.InstanceStateNameRunning,
+						},
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func TestJoinEC2(t *testing.T) {
+	ctx := context.Background()
+
+	testServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+
+	// upsert a node to test duplicates
+	node := &types.ServerV2{
+		Kind:    types.KindNode,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      instance2.account + "-" + instance2.instanceID,
+			Namespace: defaults.Namespace,
+		},
+	}
+	_, err = testServer.Auth().UpsertNode(ctx, node)
+	require.NoError(t, err)
+
+	nopClient, err := testServer.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	isAccessDenied := func(t require.TestingT, err error, args ...any) {
+		if helper, ok := t.(interface{ Helper() }); ok {
+			helper.Helper()
+		}
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError), args...)
+	}
+
+	badInstanceId := instance1.account + "-i-99999999"
+
+	testCases := []struct {
+		desc          string
+		tokenSpec     types.ProvisionTokenSpecV2
+		ec2Client     ec2join.EC2Client
+		document      []byte
+		requestHostID string
+		expectError   require.ErrorAssertionFunc
+		clock         clockwork.Clock
+	}{
+		{
+			desc: "basic passing case",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   require.NoError,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "pass with multiple rules",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance2.account,
+						AWSRegions: []string{instance2.region},
+					},
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   require.NoError,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "pass with multiple regions",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{"us-east-1", instance1.region, "us-east-2"},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   require.NoError,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "pass with no regions",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   require.NoError,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "wrong account",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "bad account",
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "wrong region",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{"bad region"},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "bad HostID",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: badInstanceId,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "no identity document",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "bad identity document",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      []byte("baddocument"),
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "instance already joined",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance2.account,
+						AWSRegions: []string{instance2.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance2.account + "-" + instance2.instanceID,
+			document:      instance2.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance2.pendingTime),
+		},
+		{
+			desc: "instance already joined, fake ID",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance2.account,
+						AWSRegions: []string{instance2.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance2.account + "-" + instance2.instanceID,
+			document:      instance2.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance2.pendingTime),
+		},
+		{
+			desc: "instance not running",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientNotRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "instance not exists",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientNoInstance{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime),
+		},
+		{
+			desc: "TTL expired",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime.Add(5*time.Minute + time.Second)),
+		},
+		{
+			desc: "custom TTL pass",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+				AWSIIDTTL: types.Duration(10 * time.Minute),
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   require.NoError,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime.Add(9 * time.Minute)),
+		},
+		{
+			desc: "custom TTL fail",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: instance1.account,
+						AWSRegions: []string{instance1.region},
+					},
+				},
+				AWSIIDTTL: types.Duration(10 * time.Minute),
+			},
+			ec2Client:     ec2ClientRunning{},
+			requestHostID: instance1.account + "-" + instance1.instanceID,
+			document:      instance1.iid,
+			expectError:   isAccessDenied,
+			clock:         clockwork.NewFakeClockAt(instance1.pendingTime.Add(11 * time.Minute)),
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			clock := tc.clock
+			if clock == nil {
+				clock = clockwork.NewRealClock()
+			}
+			testServer.Auth().SetClock(clock)
+
+			token, err := types.NewProvisionTokenFromSpec(
+				"test_token",
+				time.Now().Add(time.Minute),
+				tc.tokenSpec)
+			require.NoError(t, err)
+
+			err = testServer.Auth().UpsertToken(context.Background(), token)
+			require.NoError(t, err)
+
+			testServer.Auth().SetEC2ClientForEC2JoinMethod(tc.ec2Client)
+
+			t.Run("new", func(t *testing.T) {
+				if tc.requestHostID == badInstanceId {
+					// New join method does not allow the client so request a
+					// specific host ID, so the join would pass and fail the
+					// error assertion.
+					t.Skip()
+				}
+				_, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token: "test_token",
+					ID: state.IdentityID{
+						Role:     types.RoleInstance,
+						NodeName: "testnode",
+					},
+					AuthClient: nopClient,
+					GetInstanceIdentityDocumentFunc: func(_ context.Context) ([]byte, error) {
+						return tc.document, nil
+					},
+				})
+				tc.expectError(t, err)
+			})
+			t.Run("legacy", func(t *testing.T) {
+				_, err = joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      "test_token",
+					JoinMethod: types.JoinMethodEC2,
+					ID: state.IdentityID{
+						Role:     types.RoleNode,
+						NodeName: "testnode",
+						HostUUID: tc.requestHostID,
+					},
+					AuthClient: nopClient,
+					GetInstanceIdentityDocumentFunc: func(_ context.Context) ([]byte, error) {
+						return tc.document, nil
+					},
+				})
+				tc.expectError(t, err)
+			})
+
+			err = testServer.Auth().DeleteToken(context.Background(), token.GetName())
+			require.NoError(t, err)
+		})
+	}
+}
+
+// TestHostUniqueCheck tests the uniqueness check used by checkEC2JoinRequest
+func TestHostUniqueCheck(t *testing.T) {
+	testServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	a := testServer.Auth()
+
+	token, err := types.NewProvisionTokenFromSpec(
+		"test_token",
+		time.Now().Add(time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles: []types.SystemRole{
+				types.RoleNode,
+				types.RoleProxy,
+				types.RoleKube,
+				types.RoleDatabase,
+				types.RoleApp,
+				types.RoleWindowsDesktop,
+				types.RoleMDM,
+				types.RoleDiscovery,
+				types.RoleOkta,
+			},
+			Allow: []*types.TokenRule{
+				{
+					AWSAccount: instance1.account,
+					AWSRegions: []string{instance1.region},
+				},
+			},
+		})
+	require.NoError(t, err)
+
+	err = a.UpsertToken(context.Background(), token)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		role     types.SystemRole
+		upserter func(t *testing.T, hostID string)
+		deleter  func(t *testing.T, hostID string)
+	}{
+		{
+			role: types.RoleNode,
+			upserter: func(t *testing.T, hostID string) {
+				node := &types.ServerV2{
+					Kind:    types.KindNode,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      hostID,
+						Namespace: defaults.Namespace,
+					},
+				}
+				_, err := a.UpsertNode(context.Background(), node)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteNode(t.Context(), defaults.Namespace, hostID))
+			},
+		},
+		{
+			role: types.RoleProxy,
+			upserter: func(t *testing.T, hostID string) {
+				proxy := &types.ServerV2{
+					Kind:    types.KindProxy,
+					Version: types.V2,
+					Metadata: types.Metadata{
+						Name:      hostID,
+						Namespace: defaults.Namespace,
+					},
+				}
+				err := a.UpsertProxy(context.Background(), proxy)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteProxy(t.Context(), hostID))
+			},
+		},
+		{
+			role: types.RoleKube,
+			upserter: func(t *testing.T, hostID string) {
+				kube, err := types.NewKubernetesServerV3(
+					types.Metadata{
+						Name:      "test-kube-cluster",
+						Namespace: defaults.Namespace,
+					},
+					types.KubernetesServerSpecV3{
+						HostID:   hostID,
+						Hostname: "test-kube-hostname",
+						Cluster: &types.KubernetesClusterV3{
+							Metadata: types.Metadata{
+								Name:      "test-kube-cluster",
+								Namespace: defaults.Namespace,
+							},
+						},
+					})
+				require.NoError(t, err)
+				_, err = a.UpsertKubernetesServer(context.Background(), kube)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteKubernetesServer(t.Context(), hostID, "test-kube-cluster"))
+			},
+		},
+		{
+			role: types.RoleDatabase,
+			upserter: func(t *testing.T, hostID string) {
+				db, err := types.NewDatabaseServiceV1(
+					types.Metadata{
+						Name: hostID,
+					},
+					types.DatabaseServiceSpecV1{},
+				)
+				require.NoError(t, err)
+				_, err = a.UpsertDatabaseService(context.Background(), db)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteDatabaseService(t.Context(), hostID))
+			},
+		},
+		{
+			role: types.RoleApp,
+			upserter: func(t *testing.T, hostID string) {
+				app, err := types.NewAppV3(
+					types.Metadata{
+						Name:      "test-app",
+						Namespace: defaults.Namespace,
+					},
+					types.AppSpecV3{
+						URI: "https://app.localhost",
+					})
+				require.NoError(t, err)
+				appServer, err := types.NewAppServerV3(
+					types.Metadata{
+						Name:      "test-app",
+						Namespace: defaults.Namespace,
+					},
+					types.AppServerSpecV3{
+						HostID: hostID,
+						App:    app,
+					})
+				require.NoError(t, err)
+				_, err = a.UpsertApplicationServer(context.Background(), appServer)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteApplicationServer(t.Context(), defaults.Namespace, hostID, "test-app"))
+			},
+		},
+		{
+			role: types.RoleWindowsDesktop,
+			upserter: func(t *testing.T, hostID string) {
+				wds, err := types.NewWindowsDesktopServiceV3(types.Metadata{Name: hostID},
+					types.WindowsDesktopServiceSpecV3{
+						Addr:            "localhost:3028",
+						TeleportVersion: "10.2.2",
+					})
+				require.NoError(t, err)
+
+				_, err = a.UpsertWindowsDesktopService(context.Background(), wds)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteWindowsDesktopService(t.Context(), hostID))
+			},
+		},
+		{
+			role: types.RoleOkta,
+			upserter: func(t *testing.T, hostID string) {
+				app, err := types.NewAppV3(
+					types.Metadata{
+						Name:      "test-okta-app",
+						Namespace: defaults.Namespace,
+					},
+					types.AppSpecV3{
+						URI: "https://app.localhost",
+					})
+				require.NoError(t, err)
+				appServer, err := types.NewAppServerV3(
+					types.Metadata{
+						Name:      "test-okta-app",
+						Namespace: defaults.Namespace,
+					},
+					types.AppServerSpecV3{
+						HostID: hostID,
+						App:    app,
+					})
+				require.NoError(t, err)
+				appServer.SetOrigin(types.OriginOkta)
+				_, err = a.UpsertApplicationServer(context.Background(), appServer)
+				require.NoError(t, err)
+			},
+			deleter: func(t *testing.T, hostID string) {
+				require.NoError(t, a.DeleteApplicationServer(t.Context(), defaults.Namespace, hostID, "test-okta-app"))
+			},
+		},
+	}
+
+	a.SetEC2ClientForEC2JoinMethod(ec2ClientRunning{})
+	nopClient, err := testServer.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+	a.SetClock(clockwork.NewFakeClockAt(instance1.pendingTime))
+
+	for _, tc := range testCases {
+		t.Run(string(tc.role), func(t *testing.T) {
+			// Join works with no existing heartbeat.
+			_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+				Token: "test_token",
+				ID: state.IdentityID{
+					Role:     types.RoleInstance,
+					NodeName: "testnode",
+				},
+				AuthClient: nopClient,
+				GetInstanceIdentityDocumentFunc: func(_ context.Context) ([]byte, error) {
+					return instance1.iid, nil
+				},
+			})
+			require.NoError(t, err)
+
+			if tc.upserter != nil {
+				// Add the resource heartbeat.
+				name := instance1.account + "-" + instance1.instanceID
+				tc.upserter(t, name)
+
+				// Delete the resource heartbeat at the end of the test.
+				if tc.deleter != nil {
+					t.Cleanup(func() {
+						tc.deleter(t, name)
+					})
+				}
+
+				// Join should fail.
+				t.Run("new", func(t *testing.T) {
+					_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+						Token: "test_token",
+						ID: state.IdentityID{
+							Role:     types.RoleInstance,
+							NodeName: "testnode",
+						},
+						AuthClient: nopClient,
+						GetInstanceIdentityDocumentFunc: func(_ context.Context) ([]byte, error) {
+							return instance1.iid, nil
+						},
+					})
+					require.ErrorAs(t, err, new(*trace.AccessDeniedError), err)
+					require.ErrorContains(t, err, "already exists")
+				})
+				t.Run("legacy", func(t *testing.T) {
+					_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+						Token:      "test_token",
+						JoinMethod: types.JoinMethodEC2,
+						ID: state.IdentityID{
+							Role:     tc.role,
+							NodeName: "testnode",
+							HostUUID: instance1.account + "-" + instance1.instanceID,
+						},
+						AuthClient: nopClient,
+						GetInstanceIdentityDocumentFunc: func(_ context.Context) ([]byte, error) {
+							return instance1.iid, nil
+						},
+					})
+					require.ErrorAs(t, err, new(*trace.AccessDeniedError), err)
+					require.ErrorContains(t, err, "already exists")
+				})
+			}
+		})
+	}
+}
diff --git a/lib/join/join_gcp_test.go b/lib/join/join_gcp_test.go
new file mode 100644
index 0000000000000..b3aac86b7f748
--- /dev/null
+++ b/lib/join/join_gcp_test.go
@@ -0,0 +1,269 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/gcp"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+)
+
+type mockGCPTokenValidator struct {
+	tokens map[string]gcp.IDTokenClaims
+}
+
+func (m *mockGCPTokenValidator) Validate(_ context.Context, token string) (*gcp.IDTokenClaims, error) {
+	claims, ok := m.tokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+	return &claims, nil
+}
+
+func TestJoinGCP(t *testing.T) {
+	t.Parallel()
+
+	validIDToken := "test.fake.jwt"
+	idTokenValidator := &mockGCPTokenValidator{
+		tokens: map[string]gcp.IDTokenClaims{
+			validIDToken: {
+				Email: "service-account@example.com",
+				Google: gcp.Google{
+					ComputeEngine: gcp.ComputeEngine{
+						ProjectID:    "project1",
+						Zone:         "us-west1-b",
+						InstanceID:   "1234",
+						InstanceName: "test-instance",
+					},
+				},
+			},
+		},
+	}
+
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	authServer.Auth().SetGCPIDTokenValidator(idTokenValidator)
+
+	// helper for creating RegisterUsingTokenRequest
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
+		return &types.RegisterUsingTokenRequest{
+			HostID:       "host-id",
+			Role:         types.RoleNode,
+			IDToken:      idToken,
+			PublicTLSKey: tlsPublicKey,
+			PublicSSHKey: sshPublicKey,
+		}
+	}
+
+	allowRule := func(modifier func(*types.ProvisionTokenSpecV2GCP_Rule)) *types.ProvisionTokenSpecV2GCP_Rule {
+		rule := &types.ProvisionTokenSpecV2GCP_Rule{
+			ProjectIDs:      []string{"project1"},
+			Locations:       []string{"us-west1-b"},
+			ServiceAccounts: []string{"service-account@example.com"},
+		}
+		if modifier != nil {
+			modifier(rule)
+		}
+		return rule
+	}
+
+	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
+		require.ErrorContains(t, err, "id token claims did not match any allow rules")
+		require.True(t, trace.IsAccessDenied(err))
+	})
+	tests := []struct {
+		name        string
+		request     *types.RegisterUsingTokenRequest
+		tokenSpec   types.ProvisionTokenSpecV2
+		assertError require.ErrorAssertionFunc
+	}{
+		{
+			name: "success",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "multiple-allow-rules",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
+							rule.ProjectIDs = []string{"not-matching"}
+						}),
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "match-region-to-zone",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
+							rule.Locations = []string{"us-west1"}
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "incorrect-project-id",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
+							rule.ProjectIDs = []string{"not matching"}
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-location",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
+							rule.Locations = []string{"somewhere else"}
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-service-account",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGCP,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GCP: &types.ProvisionTokenSpecV2GCP{
+					Allow: []*types.ProvisionTokenSpecV2GCP_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GCP_Rule) {
+							rule.ServiceAccounts = []string{"something-else@example.com"}
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			token, err := types.NewProvisionTokenFromSpec(
+				tc.name, time.Now().Add(time.Minute), tc.tokenSpec,
+			)
+			require.NoError(t, err)
+			require.NoError(t, auth.CreateToken(ctx, token))
+			tc.request.Token = tc.name
+
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tc.request)
+				tc.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tc.request.Token,
+					JoinMethod: types.JoinMethodGCP,
+					ID: state.IdentityID{
+						Role:     tc.request.Role,
+						NodeName: "testnode",
+						HostUUID: tc.request.HostID,
+					},
+					IDToken:    tc.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tc.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tc.request.Token,
+					JoinMethod: types.JoinMethodGCP,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tc.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tc.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
+		})
+	}
+}
diff --git a/lib/join/join_github_test.go b/lib/join/join_github_test.go
new file mode 100644
index 0000000000000..93d5788b05d95
--- /dev/null
+++ b/lib/join/join_github_test.go
@@ -0,0 +1,500 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+)
+
+type mockIDTokenValidator struct {
+	tokens                   map[string]githubactions.IDTokenClaims
+	lastCalledGHESHost       string
+	lastCalledEnterpriseSlug string
+	lastCalledJWKS           string
+}
+
+var errMockInvalidToken = errors.New("invalid token")
+
+func (m *mockIDTokenValidator) Validate(
+	_ context.Context, ghes, enterpriseSlug, token string,
+) (*githubactions.IDTokenClaims, error) {
+	m.lastCalledGHESHost = ghes
+	m.lastCalledEnterpriseSlug = enterpriseSlug
+	claims, ok := m.tokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+
+	return &claims, nil
+}
+
+func (m *mockIDTokenValidator) reset() {
+	m.lastCalledGHESHost = ""
+	m.lastCalledEnterpriseSlug = ""
+	m.lastCalledJWKS = ""
+}
+
+func (m *mockIDTokenValidator) ValidateJWKS(
+	_ time.Time, jwks []byte, token string,
+) (*githubactions.IDTokenClaims, error) {
+	m.lastCalledJWKS = string(jwks)
+	claims, ok := m.tokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+	return &claims, nil
+}
+
+func checkMockGithubValidatorState(t *testing.T, validator *mockIDTokenValidator, spec types.ProvisionTokenSpecV2) {
+	t.Helper()
+
+	require.Equal(
+		t,
+		spec.GitHub.EnterpriseServerHost,
+		validator.lastCalledGHESHost,
+	)
+	require.Equal(
+		t,
+		spec.GitHub.EnterpriseSlug,
+		validator.lastCalledEnterpriseSlug,
+	)
+	require.Equal(
+		t,
+		spec.GitHub.StaticJWKS,
+		validator.lastCalledJWKS,
+	)
+}
+
+func TestJoinGHA(t *testing.T) {
+	validIDToken := "test.fake.jwt"
+	idTokenValidator := &mockIDTokenValidator{
+		tokens: map[string]githubactions.IDTokenClaims{
+			validIDToken: {
+				Sub:             "repo:octo-org/octo-repo:environment:prod",
+				Repository:      "octo-org/octo-repo",
+				RepositoryOwner: "octo-org",
+				Workflow:        "example-workflow",
+				Environment:     "prod",
+				Actor:           "octocat",
+				Ref:             "refs/heads/main",
+				RefType:         "branch",
+			},
+		},
+	}
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+
+	authServer.Auth().SetGHAIDTokenValidator(idTokenValidator)
+	authServer.Auth().SetGHAIDTokenJWKSValidator(idTokenValidator.ValidateJWKS)
+
+	// helper for creating RegisterUsingTokenRequest
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
+		return &types.RegisterUsingTokenRequest{
+			HostID:       "host-id",
+			Role:         types.RoleNode,
+			IDToken:      idToken,
+			PublicTLSKey: tlsPublicKey,
+			PublicSSHKey: sshPublicKey,
+		}
+	}
+
+	allowRule := func(modifier func(*types.ProvisionTokenSpecV2GitHub_Rule)) *types.ProvisionTokenSpecV2GitHub_Rule {
+		rule := &types.ProvisionTokenSpecV2GitHub_Rule{
+			Sub:             "repo:octo-org/octo-repo:environment:prod",
+			Repository:      "octo-org/octo-repo",
+			RepositoryOwner: "octo-org",
+			Workflow:        "example-workflow",
+			Environment:     "prod",
+			Actor:           "octocat",
+			Ref:             "refs/heads/main",
+			RefType:         "branch",
+		}
+		if modifier != nil {
+			modifier(rule)
+		}
+		return rule
+	}
+
+	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
+		require.ErrorContains(t, err, "id token claims did not match any allow rules")
+		require.True(t, trace.IsAccessDenied(err))
+	})
+	tests := []struct {
+		name          string
+		request       *types.RegisterUsingTokenRequest
+		tokenSpec     types.ProvisionTokenSpecV2
+		assertError   require.ErrorAssertionFunc
+		setEnterprise bool
+	}{
+		{
+			name: "success",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "success-with-jwks",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+					StaticJWKS: "my-jwks",
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "failure-with-jwks",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+					StaticJWKS: "my-jwks",
+				},
+			},
+			request:     newRequest("invalid"),
+			assertError: require.Error,
+		},
+		{
+			name: "ghes-override",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					EnterpriseServerHost: "my.ghes.instance",
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request:       newRequest(validIDToken),
+			assertError:   require.NoError,
+			setEnterprise: true,
+		},
+		{
+			name: "enterprise-slug",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					EnterpriseSlug: "slug",
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			setEnterprise: true,
+			request:       newRequest(validIDToken),
+			assertError:   require.NoError,
+		},
+		{
+			name: "ghes-override-requires-enterprise-license",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					EnterpriseServerHost: "my.ghes.instance",
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request: newRequest(validIDToken),
+			assertError: require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...any) {
+				// Note: testing over the network does not perfectly map errors
+				// so we can't use require.ErrorIs(..., services.ErrRequiresEnterprise)
+				require.ErrorContains(t, err, "this feature requires Teleport Enterprise")
+			}),
+		},
+		{
+			name: "enterprise-slug-requires-enterprise-license",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					EnterpriseSlug: "slug",
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request: newRequest(validIDToken),
+			assertError: require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...any) {
+				// Note: testing over the network does not perfectly map errors
+				// so we can't use require.ErrorIs(..., services.ErrRequiresEnterprise)
+				require.ErrorContains(t, err, "this feature requires Teleport Enterprise")
+			}),
+		},
+		{
+			name: "multiple-allow-rules",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Sub = "not matching"
+						}),
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name: "incorrect-sub",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Sub = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-repository",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Repository = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-repository-owner",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.RepositoryOwner = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-workflow",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Workflow = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-environment",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Environment = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-actor",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Actor = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-ref",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.Ref = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name: "incorrect-ref-type",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodGitHub,
+				Roles:      []types.SystemRole{types.RoleNode},
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2GitHub_Rule) {
+							rule.RefType = "not matching"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Cleanup(idTokenValidator.reset)
+			if tt.setEnterprise {
+				modulestest.SetTestModules(
+					t,
+					modulestest.Modules{TestBuildType: modules.BuildEnterprise},
+				)
+			}
+			token, err := types.NewProvisionTokenFromSpec(
+				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
+			)
+			require.NoError(t, err)
+			require.NoError(t, authServer.Auth().CreateToken(t.Context(), token))
+			tt.request.Token = tt.name
+
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodGitHub,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+
+				checkMockGithubValidatorState(t, idTokenValidator, tt.tokenSpec)
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodGitHub,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+
+				checkMockGithubValidatorState(t, idTokenValidator, tt.tokenSpec)
+			})
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = authServer.Auth().RegisterUsingToken(t.Context(), tt.request)
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+
+				checkMockGithubValidatorState(t, idTokenValidator, tt.tokenSpec)
+			})
+		})
+	}
+}
diff --git a/lib/auth/join_gitlab_test.go b/lib/join/join_gitlab_test.go
similarity index 83%
rename from lib/auth/join_gitlab_test.go
rename to lib/join/join_gitlab_test.go
index 61abdce31358c..7d7c73c8c866c 100644
--- a/lib/auth/join_gitlab_test.go
+++ b/lib/join/join_gitlab_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package join_test
 
 import (
 	"context"
@@ -24,11 +24,15 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/gitlab"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 )
 
 type mockGitLabTokenValidator struct {
@@ -63,7 +67,7 @@ func (m *mockGitLabTokenValidator) ValidateTokenWithJWKS(
 	return &claims, nil
 }
 
-func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
+func TestJoinGitlab(t *testing.T) {
 	validIDToken := "test.fake.jwt"
 	idTokenValidator := &mockGitLabTokenValidator{
 		tokens: map[string]gitlab.IDTokenClaims{
@@ -87,19 +91,24 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			},
 		},
 	}
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.gitlabIDTokenValidator = idTokenValidator
-		return nil
-	}
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
+
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
 	require.NoError(t, err)
-	auth := p.a
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	authServer.Auth().SetGitlabIDTokenValidator(idTokenValidator)
 
 	// helper for creating RegisterUsingTokenRequest
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
 		return &types.RegisterUsingTokenRequest{
@@ -165,7 +174,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "domain override",
+			name: "domain-override",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -180,7 +189,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "multiple allow rules",
+			name: "multiple-allow-rules",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -197,7 +206,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "incorrect sub",
+			name: "incorrect-sub",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -213,7 +222,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "globby project path match",
+			name: "globby-project-path-match",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -229,7 +238,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "globby project path mismatch",
+			name: "globby-project-path-mismatch",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -245,7 +254,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect project path",
+			name: "incorrect-project-path",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -261,7 +270,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect namespace path",
+			name: "incorrect-namespace-path",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -277,7 +286,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect pipeline source",
+			name: "incorrect-pipeline-source",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -293,7 +302,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect environment",
+			name: "incorrect-environment",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -309,7 +318,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect ref",
+			name: "incorrect-ref",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -325,7 +334,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect ref type",
+			name: "incorrect-ref-type",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -341,7 +350,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect user_login",
+			name: "incorrect-user_login",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -357,7 +366,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect user_id",
+			name: "incorrect-user_id",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -373,7 +382,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect user_email",
+			name: "incorrect-user_email",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -389,7 +398,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect ref_protected",
+			name: "incorrect-ref_protected",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -407,7 +416,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "ref_protected ignored if nil",
+			name: "ref_protected-ignored-if-nil",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -423,7 +432,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "incorrect environment_protected",
+			name: "incorrect-environment_protected",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -441,7 +450,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect ci_config_sha",
+			name: "incorrect-ci_config_sha",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -457,7 +466,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect ci_config_ref_uri",
+			name: "incorrect-ci_config_ref_uri",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -473,7 +482,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect deployment_tier",
+			name: "incorrect-deployment_tier",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -489,7 +498,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "incorrect project_visibility",
+			name: "incorrect-project_visibility",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -505,7 +514,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name: "success with JWKS",
+			name: "success-with-JWKS",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -520,7 +529,7 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name: "failure with JWKS",
+			name: "failure-with-JWKS",
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodGitLab,
 				Roles:      []types.SystemRole{types.RoleNode},
@@ -544,68 +553,65 @@ func TestAuth_RegisterUsingToken_GitLab(t *testing.T) {
 			require.NoError(t, auth.CreateToken(ctx, token))
 			tt.request.Token = tt.name
 
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
 
-			if tt.tokenSpec.GitLab.Domain != "" {
-				require.Equal(
-					t,
-					tt.tokenSpec.GitLab.Domain,
-					idTokenValidator.lastCalledDomain,
-				)
-			}
-			if tt.tokenSpec.GitLab.StaticJWKS != "" {
-				require.Equal(
-					t,
-					[]byte(tt.tokenSpec.GitLab.StaticJWKS),
-					idTokenValidator.lastCalledJWKS,
-				)
-			} else {
-				require.Nil(t, idTokenValidator.lastCalledJWKS)
-			}
-		})
-	}
-}
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tt.request)
+				tt.assertError(t, err)
 
-func Test_joinRuleGlobMatch(t *testing.T) {
-	tests := []struct {
-		name string
+				if tt.tokenSpec.GitLab.Domain != "" {
+					require.Equal(
+						t,
+						tt.tokenSpec.GitLab.Domain,
+						idTokenValidator.lastCalledDomain,
+					)
+				}
+				if tt.tokenSpec.GitLab.StaticJWKS != "" {
+					require.Equal(
+						t,
+						[]byte(tt.tokenSpec.GitLab.StaticJWKS),
+						idTokenValidator.lastCalledJWKS,
+					)
+				} else {
+					require.Nil(t, idTokenValidator.lastCalledJWKS)
+				}
+			})
 
-		rule  string
-		claim string
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodGitLab,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
 
-		want bool
-	}{
-		{
-			name:  "no rule",
-			rule:  "",
-			claim: "foo",
-			want:  true,
-		},
-		{
-			name:  "non-globby rule matches",
-			rule:  "foo",
-			claim: "foo",
-			want:  true,
-		},
-		{
-			name:  "globby rule matches",
-			rule:  "?est-*-foo",
-			claim: "test-string-foo",
-			want:  true,
-		},
-		{
-			name:  "globby rule mismatch",
-			rule:  "?est-*-foo",
-			claim: "ttest-bar-ffoo",
-			want:  false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := joinRuleGlobMatch(tt.rule, tt.claim)
-			require.NoError(t, err)
-			require.Equal(t, tt.want, got)
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodGitLab,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+				if err != nil {
+					return
+				}
+			})
 		})
 	}
 }
diff --git a/lib/join/join_iam_test.go b/lib/join/join_iam_test.go
new file mode 100644
index 0000000000000..e21fc454c36d7
--- /dev/null
+++ b/lib/join/join_iam_test.go
@@ -0,0 +1,745 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"text/template"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/join/iam"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join/iamjoin"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func responseFromAWSIdentity(id iamjoin.AWSIdentity) string {
+	return fmt.Sprintf(`{
+		"GetCallerIdentityResponse": {
+			"GetCallerIdentityResult": {
+				"Account": "%s",
+				"Arn": "%s"
+			}}}`, id.Account, id.Arn)
+}
+
+type mockClient struct {
+	respStatusCode int
+	respBody       string
+}
+
+func (c *mockClient) Do(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: c.respStatusCode,
+		Body:       io.NopCloser(strings.NewReader(c.respBody)),
+	}, nil
+}
+
+var identityRequestTemplate = template.Must(template.New("sts-request").Parse(`POST / HTTP/1.1
+Host: {{.Host}}
+User-Agent: aws-sdk-go/1.37.17 (go1.17.1; darwin; amd64)
+Content-Length: 43
+Accept: application/json
+Authorization: AWS4-HMAC-SHA256 Credential=AAAAAAAAAAAAAAAAAAAA/20211102/us-east-1/sts/aws4_request, SignedHeaders=accept;content-length;content-type;host;x-amz-date;x-amz-security-token;{{.SignedHeader}}, Signature=111
+Content-Type: application/x-www-form-urlencoded; charset=utf-8
+X-Amz-Date: 20211102T204300Z
+X-Amz-Security-Token: aaa
+X-Teleport-Challenge: {{.Challenge}}
+
+Action=GetCallerIdentity&Version=2011-06-15`))
+
+type identityRequestTemplateInput struct {
+	Host         string
+	SignedHeader string
+	Challenge    string
+}
+
+func defaultIdentityRequestTemplateInput(challenge string) identityRequestTemplateInput {
+	return identityRequestTemplateInput{
+		Host:         "sts.amazonaws.com",
+		SignedHeader: "x-teleport-challenge;",
+		Challenge:    challenge,
+	}
+}
+
+type challengeResponseOption func(*identityRequestTemplateInput)
+
+func withHost(host string) challengeResponseOption {
+	return func(templateInput *identityRequestTemplateInput) {
+		templateInput.Host = host
+	}
+}
+
+func withSignedHeader(signedHeader string) challengeResponseOption {
+	return func(templateInput *identityRequestTemplateInput) {
+		templateInput.SignedHeader = signedHeader
+	}
+}
+
+func withChallenge(challenge string) challengeResponseOption {
+	return func(templateInput *identityRequestTemplateInput) {
+		templateInput.Challenge = challenge
+	}
+}
+
+type iamJoinTestCase struct {
+	desc                     string
+	authServer               *authtest.Server
+	tokenName                string
+	requestTokenName         string
+	tokenSpec                types.ProvisionTokenSpecV2
+	stsClient                utils.HTTPDoClient
+	challengeResponseOptions []challengeResponseOption
+	challengeResponseErr     error
+	assertError              require.ErrorAssertionFunc
+}
+
+func TestJoinIAM(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	regularServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, regularServer.Shutdown(ctx)) })
+
+	fipsServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir:  t.TempDir(),
+			FIPS: true,
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, regularServer.Shutdown(ctx)) })
+
+	isAccessDenied := func(t require.TestingT, err error, _ ...interface{}) {
+		require.True(t, trace.IsAccessDenied(err), "expected Access Denied error, actual error: %v", err)
+	}
+	isBadParameter := func(t require.TestingT, err error, _ ...interface{}) {
+		require.True(t, trace.IsBadParameter(err), "expected Bad Parameter error, actual error: %v", err)
+	}
+
+	testCases := []iamJoinTestCase{
+		{
+			desc:             "basic passing case",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "wildcard arn 1",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::role/admins-*",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::role/admins-test",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "wildcard arn 2",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::role/admins-???",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::role/admins-123",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "arn assumed role",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "123456789012",
+						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "123456789012",
+					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "wildcard arn assumed role",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "123456789012",
+						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role/my-session-name",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "123456789012",
+					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "wildcard 2 arn assumed role",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "123456789012",
+						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role/*",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "123456789012",
+					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-001-test-role/my-session-name",
+				}),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "wrong wildcard arn assumed role",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "123456789012",
+						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "123456789012",
+					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-002-test-role/my-session-name",
+				}),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong wildcard 2 arn assumed role",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "123456789012",
+						AWSARN:     "arn:aws:sts::123456789012:assumed-role/my-*-test-role",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "123456789012",
+					Arn:     "arn:aws:sts::123456789012:assumed-role/my-super-002-test-role/my-session-name2",
+				}),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong token",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "wrong-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "challenge response error",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseErr: trace.BadParameter("test error"),
+			assertError:          isBadParameter,
+		},
+		{
+			desc:             "wrong arn",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::role/admins-???",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::role/admins-1234",
+				}),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong challenge",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withChallenge("wrong-challenge"),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong account",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "5678",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "sts api error",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusForbidden,
+				respBody:       "access denied",
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong sts host",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withHost("sts.wrong-host.amazonaws.com"),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "regional sts endpoint",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withHost("sts.us-west-2.amazonaws.com"),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "unsigned challenge header",
+			authServer:       regularServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withSignedHeader(""),
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "fips pass",
+			authServer:       fipsServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withHost("sts-fips.us-east-1.amazonaws.com"),
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "non-fips client fail",
+			authServer:       fipsServer,
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleNode},
+				Allow: []*types.TokenRule{
+					{
+						AWSAccount: "1234",
+						AWSARN:     "arn:aws::1111",
+					},
+				},
+				JoinMethod: types.JoinMethodIAM,
+			},
+			stsClient: &mockClient{
+				respStatusCode: http.StatusOK,
+				respBody: responseFromAWSIdentity(iamjoin.AWSIdentity{
+					Account: "1234",
+					Arn:     "arn:aws::1111",
+				}),
+			},
+			challengeResponseOptions: []challengeResponseOption{
+				withHost("sts.us-east-1.amazonaws.com"),
+			},
+			assertError: isAccessDenied,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			testIAMJoin(t, &tc)
+		})
+	}
+}
+
+func testIAMJoin(t *testing.T, tc *iamJoinTestCase) {
+	ctx := t.Context()
+	// Set mock client.
+	tc.authServer.Auth().SetHTTPClientForAWSSTS(tc.stsClient)
+
+	// Add token to auth server.
+	token, err := types.NewProvisionTokenFromSpec(
+		tc.tokenName,
+		time.Now().Add(time.Minute),
+		tc.tokenSpec)
+	require.NoError(t, err)
+	require.NoError(t, tc.authServer.Auth().UpsertToken(ctx, token))
+	t.Cleanup(func() {
+		assert.NoError(t, tc.authServer.Auth().DeleteToken(ctx, token.GetName()))
+	})
+
+	// Make an unauthenticated auth client that will be used for the join.
+	nopClient, err := tc.authServer.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+	defer nopClient.Close()
+
+	createSignedSTSIdentityRequest := func(ctx context.Context, challenge string, opts ...iam.STSIdentityRequestOption) ([]byte, error) {
+		if tc.challengeResponseErr != nil {
+			return nil, trace.Wrap(tc.challengeResponseErr)
+		}
+		templateInput := defaultIdentityRequestTemplateInput(challenge)
+		for _, opt := range tc.challengeResponseOptions {
+			opt(&templateInput)
+		}
+		var identityRequest bytes.Buffer
+		if err := identityRequestTemplate.Execute(&identityRequest, templateInput); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return identityRequest.Bytes(), nil
+	}
+
+	// Test joining via the legacy join service.
+	//
+	// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
+	t.Run("legacy", func(t *testing.T) {
+		_, err := joinclient.LegacyJoin(ctx, joinclient.JoinParams{
+			Token:      tc.requestTokenName,
+			JoinMethod: types.JoinMethodIAM,
+			ID: state.IdentityID{
+				Role:     types.RoleInstance,
+				HostUUID: "test-uuid",
+				NodeName: "test-node",
+			},
+			CreateSignedSTSIdentityRequestFunc: createSignedSTSIdentityRequest,
+			AuthClient:                         nopClient,
+		})
+		tc.assertError(t, err)
+	})
+
+	// Tests joining via the new join service with auth-assigned host UUIDs.
+	t.Run("new", func(t *testing.T) {
+		_, err := joinclient.Join(ctx, joinclient.JoinParams{
+			Token: tc.requestTokenName,
+			ID: state.IdentityID{
+				Role:     types.RoleInstance,
+				NodeName: "test-node",
+			},
+			CreateSignedSTSIdentityRequestFunc: createSignedSTSIdentityRequest,
+			AuthClient:                         nopClient,
+		})
+		tc.assertError(t, err)
+
+		// If the challenge-response is expected to fail, assert that a join
+		// failure event was emitted with an error message about the client
+		// giving up on the join attempt.
+		if tc.challengeResponseErr == nil {
+			return
+		}
+		assert.EventuallyWithT(t, func(t *assert.CollectT) {
+			evt, err := lastEvent(ctx, tc.authServer.Auth(), tc.authServer.Auth().GetClock(), "instance.join")
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(
+				&apievents.InstanceJoin{
+					Metadata: apievents.Metadata{
+						Type: "instance.join",
+						Code: events.InstanceJoinFailureCode,
+					},
+					Status: apievents.Status{
+						Success: false,
+						Error: fmt.Sprintf(
+							"receiving challenge solution\n\tclient gave up on join attempt: challenge solution failed: creating signed sts:GetCallerIdentity request %s",
+							tc.challengeResponseErr,
+						),
+					},
+					ConnectionMetadata: apievents.ConnectionMetadata{
+						RemoteAddr: "127.0.0.1",
+					},
+					Role:      "Instance",
+					Method:    "iam",
+					NodeName:  "test-node",
+					TokenName: "test-token",
+				},
+				evt,
+				protocmp.Transform(),
+				cmpopts.IgnoreMapEntries(func(key string, val any) bool {
+					return key == "Time" || key == "ID" || key == "TokenExpires"
+				}),
+			))
+		}, 5*time.Second, 5*time.Millisecond)
+	})
+}
diff --git a/lib/join/join_kubernetes_test.go b/lib/join/join_kubernetes_test.go
new file mode 100644
index 0000000000000..99c8bd0f951a8
--- /dev/null
+++ b/lib/join/join_kubernetes_test.go
@@ -0,0 +1,253 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+)
+
+type mockK8STokenReviewValidator struct {
+	tokens map[string]*kubetoken.ValidationResult
+}
+
+func (m *mockK8STokenReviewValidator) Validate(_ context.Context, token, _ string) (*kubetoken.ValidationResult, error) {
+	result, ok := m.tokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+
+	return result, nil
+}
+
+func TestJoinKubernetes(t *testing.T) {
+	// Test setup
+
+	// Creating an auth server with mock Kubernetes token validator
+	tokenReviewTokens := map[string]*kubetoken.ValidationResult{
+		"matching-implicit-in-cluster": {Username: "system:serviceaccount:namespace1:service-account1"},
+		// "matching-explicit-in-cluster" intentionally matches the second allow
+		// rule of explicitInCluster to ensure all rules are processed.
+		"matching-explicit-in-cluster": {Username: "system:serviceaccount:namespace2:service-account2"},
+		"user-token":                   {Username: "namespace1:service-account1"},
+	}
+	jwksTokens := map[string]*kubetoken.ValidationResult{
+		"jwks-matching-service-account":   {Username: "system:serviceaccount:static-jwks:matching"},
+		"jwks-mismatched-service-account": {Username: "system:serviceaccount:static-jwks:mismatched"},
+	}
+
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	auth.SetK8sTokenReviewValidator(&mockK8STokenReviewValidator{tokens: tokenReviewTokens})
+	auth.SetK8sJWKSValidator(func(_ time.Time, _ []byte, _ string, token string) (*kubetoken.ValidationResult, error) {
+		result, ok := jwksTokens[token]
+		if !ok {
+			return nil, errMockInvalidToken
+		}
+		return result, nil
+	})
+
+	// Creating and loading our two Kubernetes ProvisionTokens
+	implicitInClusterPT, err := types.NewProvisionTokenFromSpec("implicit-in-cluster", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
+		JoinMethod: types.JoinMethodKubernetes,
+		Roles:      []types.SystemRole{types.RoleNode},
+		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+				{ServiceAccount: "namespace1:service-account1"},
+				{ServiceAccount: "namespace1:service-account2"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	explicitInClusterPT, err := types.NewProvisionTokenFromSpec("explicit-in-cluster", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
+		JoinMethod: types.JoinMethodKubernetes,
+		Roles:      []types.SystemRole{types.RoleNode},
+		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+			Type: types.KubernetesJoinTypeInCluster,
+			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+				{ServiceAccount: "namespace2:service-account1"},
+				{ServiceAccount: "namespace2:service-account2"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	staticJWKSPT, err := types.NewProvisionTokenFromSpec("static-jwks", time.Now().Add(10*time.Minute), types.ProvisionTokenSpecV2{
+		JoinMethod: types.JoinMethodKubernetes,
+		Roles:      []types.SystemRole{types.RoleNode},
+		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+			Type: types.KubernetesJoinTypeStaticJWKS,
+			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+				{ServiceAccount: "static-jwks:matching"},
+			},
+			StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
+				JWKS: "fake-jwks",
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, auth.CreateToken(ctx, implicitInClusterPT))
+	require.NoError(t, auth.CreateToken(ctx, explicitInClusterPT))
+	require.NoError(t, auth.CreateToken(ctx, staticJWKSPT))
+
+	// Building a joinRequest builder
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+
+	newRequest := func(token, idToken string) *types.RegisterUsingTokenRequest {
+		return &types.RegisterUsingTokenRequest{
+			Token:        token,
+			HostID:       "host-id",
+			Role:         types.RoleNode,
+			IDToken:      idToken,
+			PublicTLSKey: tlsPublicKey,
+			PublicSSHKey: sshPublicKey,
+		}
+	}
+
+	tests := []struct {
+		name           string
+		kubeToken      string
+		provisionToken types.ProvisionToken
+		assertError    require.ErrorAssertionFunc
+	}{
+		{
+			"in_cluster (implicit): success",
+			"matching-implicit-in-cluster",
+			implicitInClusterPT,
+			require.NoError,
+		},
+		{
+			"in_cluster (explicit): success",
+			"matching-explicit-in-cluster",
+			explicitInClusterPT,
+			require.NoError,
+		},
+		{
+			"in_cluster: service account rule mismatch",
+			"matching-explicit-in-cluster",
+			implicitInClusterPT,
+			func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "kubernetes token did not match any allow rules")
+			},
+		},
+		{
+			"in_cluster: failed token join (unknown kubeToken)",
+			"unknown",
+			implicitInClusterPT,
+			func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "invalid token")
+			},
+		},
+		{
+			"in_cluster: failed token join (user token)",
+			"user-token",
+			implicitInClusterPT,
+			func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "kubernetes token did not match any allow rules")
+			},
+		},
+		{
+			"static_jwks: success",
+			"jwks-matching-service-account",
+			staticJWKSPT,
+			require.NoError,
+		},
+		{
+			"static_jwks: service account rule mismatch",
+			"jwks-mismatched-service-account",
+			staticJWKSPT,
+			func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "kubernetes token did not match any allow rules")
+			},
+		},
+		{
+			"static_jwks: validation fails",
+			"unknown",
+			staticJWKSPT,
+			func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "invalid token")
+			},
+		},
+	}
+
+	// Doing the real test
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err := auth.RegisterUsingToken(ctx, newRequest(tt.provisionToken.GetName(), tt.kubeToken))
+				tt.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.provisionToken.GetName(),
+					JoinMethod: types.JoinMethodKubernetes,
+					ID: state.IdentityID{
+						Role:     types.RoleNode,
+						NodeName: "testnode",
+						HostUUID: "host-id",
+					},
+					IDToken:    tt.kubeToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.provisionToken.GetName(),
+					JoinMethod: types.JoinMethodKubernetes,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.kubeToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+		})
+	}
+}
diff --git a/lib/join/join_spacelift_test.go b/lib/join/join_spacelift_test.go
new file mode 100644
index 0000000000000..3ed0e5fd5a8f5
--- /dev/null
+++ b/lib/join/join_spacelift_test.go
@@ -0,0 +1,385 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+)
+
+type mockSpaceliftTokenValidator struct {
+	tokens map[string]spacelift.IDTokenClaims
+}
+
+func (m *mockSpaceliftTokenValidator) Validate(
+	_ context.Context, hostname string, token string,
+) (*spacelift.IDTokenClaims, error) {
+	if hostname != "example.app.spacelift.io" {
+		return nil, fmt.Errorf("bad hostname: %s", hostname)
+	}
+
+	claims, ok := m.tokens[token]
+	if !ok {
+		return nil, errMockInvalidToken
+	}
+
+	return &claims, nil
+}
+
+func TestJoinSpacelift(t *testing.T) {
+	validIDToken := "test.fake.jwt"
+	idTokenValidator := &mockSpaceliftTokenValidator{
+		tokens: map[string]spacelift.IDTokenClaims{
+			validIDToken: {
+				Sub:        "space:root:stack:machineid-spacelift-test:run_type:TASK:scope:write",
+				SpaceID:    "root",
+				CallerType: "stack",
+				CallerID:   "machineid-spacelift-test",
+				RunType:    "TASK",
+				RunID:      "01HEQ9W9CJ5GWD35SKJ46X789V",
+				Scope:      "write",
+			},
+		},
+	}
+
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	auth.SetSpaceliftIDTokenValidator(idTokenValidator)
+
+	// helper for creating RegisterUsingTokenRequest
+	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
+	require.NoError(t, err)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	require.NoError(t, err)
+	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
+		return &types.RegisterUsingTokenRequest{
+			HostID:       "host-id",
+			Role:         types.RoleNode,
+			IDToken:      idToken,
+			PublicTLSKey: tlsPublicKey,
+			PublicSSHKey: sshPublicKey,
+		}
+	}
+
+	allowRule := func(modifier func(*types.ProvisionTokenSpecV2Spacelift_Rule)) *types.ProvisionTokenSpecV2Spacelift_Rule {
+		rule := &types.ProvisionTokenSpecV2Spacelift_Rule{
+			SpaceID:    "root",
+			CallerID:   "machineid-spacelift-test",
+			CallerType: "stack",
+			Scope:      "write",
+		}
+		if modifier != nil {
+			modifier(rule)
+		}
+		return rule
+	}
+
+	allowRulesNotMatched := require.ErrorAssertionFunc(func(t require.TestingT, err error, i ...interface{}) {
+		require.ErrorContains(t, err, "id token claims did not match any allow rules")
+		require.True(t, trace.IsAccessDenied(err))
+	})
+	tests := []struct {
+		name          string
+		setEnterprise bool
+		request       *types.RegisterUsingTokenRequest
+		tokenSpec     types.ProvisionTokenSpecV2
+		assertError   require.ErrorAssertionFunc
+	}{
+		{
+			name:          "success",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name:          "success-with-glob",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname:           "example.app.spacelift.io",
+					EnableGlobMatching: true,
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.SpaceID = "ro??"
+							rule.CallerID = "machineid-spacelift-*"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name:          "fail-with-glob",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname:           "example.app.spacelift.io",
+					EnableGlobMatching: true,
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.CallerID = "wahoo-spacelift-*"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "fail-with-disabled-glob",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname:           "example.app.spacelift.io",
+					EnableGlobMatching: false,
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.SpaceID = "ro??"
+							rule.CallerID = "machineid-spacelift-*"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "missing-enterprise",
+			setEnterprise: false,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request: newRequest(validIDToken),
+			assertError: func(t require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(t, err, "requires Teleport Enterprise")
+			},
+		},
+		{
+			name:          "multiple-allow-rules",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.SpaceID = "bar"
+						}),
+						allowRule(nil),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: require.NoError,
+		},
+		{
+			name:          "incorrect-space_id",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.SpaceID = "bar"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "incorrect-caller_id",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.CallerID = "bar"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "incorrect-caller_type",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.CallerType = "bar"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "incorrect-scope",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(func(rule *types.ProvisionTokenSpecV2Spacelift_Rule) {
+							rule.Scope = "bar"
+						}),
+					},
+				},
+			},
+			request:     newRequest(validIDToken),
+			assertError: allowRulesNotMatched,
+		},
+		{
+			name:          "invalid-token",
+			setEnterprise: true,
+			tokenSpec: types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodSpacelift,
+				Roles:      []types.SystemRole{types.RoleNode},
+				Spacelift: &types.ProvisionTokenSpecV2Spacelift{
+					Hostname: "example.app.spacelift.io",
+					Allow: []*types.ProvisionTokenSpecV2Spacelift_Rule{
+						allowRule(nil),
+					},
+				},
+			},
+			request: newRequest("some other token"),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "invalid token")
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.setEnterprise {
+				modulestest.SetTestModules(
+					t,
+					modulestest.Modules{TestBuildType: modules.BuildEnterprise},
+				)
+			}
+
+			token, err := types.NewProvisionTokenFromSpec(
+				tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
+			)
+			require.NoError(t, err)
+			require.NoError(t, auth.CreateToken(ctx, token))
+			tt.request.Token = tt.name
+
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tt.request)
+				tt.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodSpacelift,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodSpacelift,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+		})
+	}
+}
diff --git a/lib/auth/join_terraformcloud_test.go b/lib/join/join_terraformcloud_test.go
similarity index 81%
rename from lib/auth/join_terraformcloud_test.go
rename to lib/join/join_terraformcloud_test.go
index e6e423042ff32..9afb9d8c53652 100644
--- a/lib/auth/join_terraformcloud_test.go
+++ b/lib/join/join_terraformcloud_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package auth
+package join_test
 
 import (
 	"context"
@@ -25,12 +25,17 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
 	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/terraformcloud"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 type mockTerraformTokenValidator struct {
@@ -58,7 +63,7 @@ func (m *mockTerraformTokenValidator) Validate(
 	return &claims, nil
 }
 
-func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
+func TestJoinTerraformCloud(t *testing.T) {
 	validIDToken := "test.fake.jwt"
 	idTokenValidator := &mockTerraformTokenValidator{
 		tokens: map[string]terraformcloud.IDTokenClaims{
@@ -74,19 +79,25 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			},
 		},
 	}
-	var withTokenValidator ServerOption = func(server *Server) error {
-		server.terraformIDTokenValidator = idTokenValidator
-		return nil
-	}
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir(), withTokenValidator)
+
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			ClusterName: "test.localhost",
+			Dir:         t.TempDir(),
+		},
+	})
 	require.NoError(t, err)
-	auth := p.a
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(t.Context())) })
+	auth := authServer.Auth()
+
+	auth.SetTerraformIDTokenValidator(idTokenValidator)
 
 	// helper for creating RegisterUsingTokenRequest
 	sshPrivateKey, sshPublicKey, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
-	tlsPublicKey, err := PrivateKeyToPublicKeyTLS(sshPrivateKey)
+	tlsPublicKey, err := authtest.PrivateKeyToPublicKeyTLS(sshPrivateKey)
 	require.NoError(t, err)
 	newRequest := func(idToken string) *types.RegisterUsingTokenRequest {
 		return &types.RegisterUsingTokenRequest{
@@ -128,7 +139,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 		assertError   require.ErrorAssertionFunc
 	}{
 		{
-			name:          "success with all attributes",
+			name:          "success-with-all-attributes",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -143,7 +154,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name:          "missing enterprise",
+			name:          "missing-enterprise",
 			setEnterprise: false,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -164,7 +175,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			},
 		},
 		{
-			name:          "multiple allow rules",
+			name:          "multiple-allow-rules",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -190,7 +201,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name:          "incorrect organization id",
+			name:          "incorrect-organization-id",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -207,7 +218,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect organization name",
+			name:          "incorrect-organization-name",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -224,7 +235,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect project name",
+			name:          "incorrect-project-name",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -241,7 +252,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect project id",
+			name:          "incorrect-project-id",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -258,7 +269,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect workspace name",
+			name:          "incorrect-workspace-name",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -275,7 +286,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect workspace id",
+			name:          "incorrect-workspace-id",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -292,7 +303,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "incorrect run_phase",
+			name:          "incorrect-run_phase",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -311,7 +322,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: allowRulesNotMatched,
 		},
 		{
-			name:          "invalid token",
+			name:          "invalid-token",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -326,12 +337,12 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 				},
 			},
 			request: newRequest("some other token"),
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, errMockInvalidToken)
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "invalid token")
 			},
 		},
 		{
-			name:          "correct explicit audience",
+			name:          "correct-explicit-audience",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -350,7 +361,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			assertError: require.NoError,
 		},
 		{
-			name:          "incorrect audience",
+			name:          "incorrect-audience",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -371,7 +382,7 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			},
 		},
 		{
-			name:          "overridden hostname is honored",
+			name:          "overridden-hostname-is-honored",
 			setEnterprise: true,
 			tokenSpec: types.ProvisionTokenSpecV2{
 				JoinMethod: types.JoinMethodTerraformCloud,
@@ -395,9 +406,9 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.setEnterprise {
-				modules.SetTestModules(
+				modulestest.SetTestModules(
 					t,
-					&modules.TestModules{TestBuildType: modules.BuildEnterprise},
+					modulestest.Modules{TestBuildType: modules.BuildEnterprise},
 				)
 			}
 
@@ -409,8 +420,43 @@ func TestAuth_RegisterUsingToken_Terraform(t *testing.T) {
 			require.NoError(t, auth.CreateToken(ctx, token))
 			tt.request.Token = tt.name
 
-			_, err = auth.RegisterUsingToken(ctx, tt.request)
-			tt.assertError(t, err)
+			nopClient, err := authServer.NewClient(authtest.TestNop())
+			require.NoError(t, err)
+
+			t.Run("legacy", func(t *testing.T) {
+				_, err = auth.RegisterUsingToken(ctx, tt.request)
+				tt.assertError(t, err)
+			})
+
+			t.Run("legacy joinclient", func(t *testing.T) {
+				_, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodTerraformCloud,
+					ID: state.IdentityID{
+						Role:     tt.request.Role,
+						NodeName: "testnode",
+						HostUUID: tt.request.HostID,
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+
+			t.Run("new joinclient", func(t *testing.T) {
+				_, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token:      tt.request.Token,
+					JoinMethod: types.JoinMethodTerraformCloud,
+					ID: state.IdentityID{
+						Role:     types.RoleInstance, // RoleNode is not allowed
+						NodeName: "testnode",
+					},
+					IDToken:    tt.request.IDToken,
+					AuthClient: nopClient,
+				})
+				tt.assertError(t, err)
+			})
+
 		})
 	}
 }
diff --git a/lib/join/join_test.go b/lib/join/join_test.go
new file mode 100644
index 0000000000000..331083b9b1e9a
--- /dev/null
+++ b/lib/join/join_test.go
@@ -0,0 +1,635 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join_test
+
+import (
+	"context"
+	"net"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/http2"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport/api/constants"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	joinv1proto "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	authjoin "github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/join/joinv1"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
+)
+
+// TestJoinToken tests the full cycle of proxy and node joining via the join service.
+//
+// It first sets up a fake auth service running the gRPC join service.
+//
+// A fake proxy then joins to auth. It then uses its new credentials from the
+// join process to connect to auth and serve it's own join service forwarding
+// to the real service at auth.
+//
+// Finally, it tests various scenarios where a node attempts to join by
+// connecting to the proxy's gRPC join service.
+func TestJoinToken(t *testing.T) {
+	t.Parallel()
+
+	token1, err := types.NewProvisionTokenFromSpec("token1", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{
+			types.RoleInstance,
+			types.RoleProxy,
+			types.RoleNode,
+			types.RoleApp,
+		},
+	})
+	require.NoError(t, err)
+	token2, err := types.NewProvisionTokenFromSpec("token2", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{
+			types.RoleInstance,
+			types.RoleProxy,
+			types.RoleNode,
+			types.RoleDatabase,
+		},
+	})
+	require.NoError(t, err)
+
+	scopedToken1 := &joiningv1.ScopedToken{
+		Kind:    types.KindScopedToken,
+		Version: types.V1,
+		Scope:   "/aa",
+		Metadata: &headerv1.Metadata{
+			Name: "scoped1",
+		},
+		Spec: &joiningv1.ScopedTokenSpec{
+			AssignedScope: "/aa/bb",
+			Roles:         []string{types.RoleNode.String()},
+			JoinMethod:    string(types.JoinMethodToken),
+		},
+	}
+	scopedToken2 := proto.CloneOf(scopedToken1)
+	scopedToken2.Metadata.Name = "scoped2"
+	scopedToken2.Spec.AssignedScope = "/aa/cc"
+
+	scopedToken3 := proto.CloneOf(scopedToken1)
+	scopedToken3.Metadata.Name = "scoped3"
+
+	authService := newFakeAuthService(t)
+	require.NoError(t, authService.Auth().UpsertToken(t.Context(), token1))
+	require.NoError(t, authService.Auth().UpsertToken(t.Context(), token2))
+
+	_, err = authService.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+		Token: scopedToken1,
+	})
+	require.NoError(t, err)
+
+	_, err = authService.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+		Token: scopedToken2,
+	})
+	require.NoError(t, err)
+
+	_, err = authService.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+		Token: scopedToken3,
+	})
+	require.NoError(t, err)
+
+	proxy := newFakeProxy(authService)
+	proxy.join(t)
+	proxyListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { proxyListener.Close() })
+	proxy.runGRPCServer(t, proxyListener)
+
+	t.Run("invalid token", func(t *testing.T) {
+		_, err := joinViaProxy(
+			t.Context(),
+			"invalidtoken",
+			proxyListener.Addr(),
+		)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		ctx := t.Context()
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			evt, err := authService.lastEvent(ctx, "instance.join")
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(
+				&apievents.InstanceJoin{
+					Metadata: apievents.Metadata{
+						Type: "instance.join",
+						Code: events.InstanceJoinFailureCode,
+					},
+					Status: apievents.Status{
+						Success: false,
+						Error:   "token expired or not found",
+					},
+					ConnectionMetadata: apievents.ConnectionMetadata{
+						RemoteAddr: "127.0.0.1",
+					},
+					Role: "Instance",
+				},
+				evt,
+				protocmp.Transform(),
+				cmpopts.IgnoreMapEntries(func(key string, val any) bool {
+					return key == "Time" || key == "ID"
+				}),
+			))
+		}, 5*time.Second, 5*time.Millisecond, "expected instance.join failed event not found")
+	})
+
+	t.Run("join and rejoin", func(t *testing.T) {
+		// Node initially joins by connecting to the proxy's gRPC service.
+		identity, err := joinViaProxy(
+			t.Context(),
+			token1.GetName(),
+			proxyListener.Addr(),
+		)
+		require.NoError(t, err)
+		// Make sure the result contains a host ID and expected certificate roles.
+		require.NotEmpty(t, identity.ID.HostUUID)
+		require.Equal(t, types.RoleInstance, identity.ID.Role)
+		expectedSystemRoles := slices.DeleteFunc(
+			token1.GetRoles().StringSlice(),
+			func(s string) bool { return s == types.RoleInstance.String() },
+		)
+		require.ElementsMatch(t, expectedSystemRoles, identity.SystemRoles)
+
+		// Build an auth client with the new identity.
+		tlsConfig, err := identity.TLSConfig(nil /*cipherSuites*/)
+		require.NoError(t, err)
+		authClient, err := authService.TLS.NewClientWithCert(tlsConfig.Certificates[0])
+		require.NoError(t, err)
+
+		// Node can rejoin with a different token by dialing the auth service
+		// with an auth client authenticed with its original credentials.
+		//
+		// It should get back its original host ID and the combined roles of
+		// its original certificate and the new token.
+		newIdentity, err := rejoinViaAuthClient(
+			t.Context(),
+			token2.GetName(),
+			authClient,
+		)
+		require.NoError(t, err)
+		require.Equal(t, identity.ID, newIdentity.ID)
+		expectedSystemRoles = slices.DeleteFunc(
+			apiutils.Deduplicate(slices.Concat(
+				token1.GetRoles().StringSlice(),
+				token2.GetRoles().StringSlice(),
+			)),
+			func(s string) bool { return s == types.RoleInstance.String() },
+		)
+		require.ElementsMatch(t, expectedSystemRoles, newIdentity.SystemRoles)
+	})
+
+	t.Run("join and rejoin with scoped token", func(t *testing.T) {
+		// Node initially joins by connecting to the proxy's gRPC service.
+		identity, err := joinViaProxy(
+			t.Context(),
+			scopedToken1.GetMetadata().GetName(),
+			proxyListener.Addr(),
+		)
+		require.NoError(t, err)
+		// Make sure the result contains a host ID and expected certificate roles.
+		require.NotEmpty(t, identity.ID.HostUUID)
+		require.Equal(t, types.RoleInstance, identity.ID.Role)
+		expectedSystemRoles := slices.DeleteFunc(
+			scopedToken1.GetSpec().GetRoles(),
+			func(s string) bool { return s == types.RoleInstance.String() },
+		)
+		require.ElementsMatch(t, expectedSystemRoles, identity.SystemRoles)
+
+		require.Equal(t, scopedToken1.GetSpec().GetAssignedScope(), identity.AgentScope)
+		// Build an auth client with the new identity.
+		tlsConfig, err := identity.TLSConfig(nil /*cipherSuites*/)
+		require.NoError(t, err)
+		authClient, err := authService.TLS.NewClientWithCert(tlsConfig.Certificates[0])
+		require.NoError(t, err)
+
+		// Node can rejoin with a different token assigning the same scope
+		// by dialing the auth service with an auth client authenticated with
+		// its original credentials.
+		//
+		// It should get back its original host ID and the combined roles of
+		// its original certificate and the new token.
+		newIdentity, err := rejoinViaAuthClient(
+			t.Context(),
+			scopedToken3.GetMetadata().GetName(),
+			authClient,
+		)
+		require.NoError(t, err)
+		require.Equal(t, identity.AgentScope, newIdentity.AgentScope)
+		require.Equal(t, identity.ID.HostUUID, newIdentity.ID.HostUUID)
+		require.Equal(t, identity.ID.NodeName, newIdentity.ID.NodeName)
+		require.Equal(t, identity.ID.Role, newIdentity.ID.Role)
+		expectedSystemRoles = slices.DeleteFunc(
+			apiutils.Deduplicate(slices.Concat(
+				scopedToken1.GetSpec().GetRoles(),
+				scopedToken3.GetSpec().GetRoles(),
+			)),
+			func(s string) bool { return s == types.RoleInstance.String() },
+		)
+		require.ElementsMatch(t, expectedSystemRoles, newIdentity.SystemRoles)
+	})
+
+	t.Run("join and rejoin with mismatched scoped tokens", func(t *testing.T) {
+		// Node initially joins by connecting to the proxy's gRPC service.
+		identity, err := joinViaProxy(
+			t.Context(),
+			scopedToken1.GetMetadata().GetName(),
+			proxyListener.Addr(),
+		)
+		require.NoError(t, err)
+		// Make sure the result contains a host ID and expected certificate roles.
+		require.NotEmpty(t, identity.ID.HostUUID)
+		require.Equal(t, types.RoleInstance, identity.ID.Role)
+		expectedSystemRoles := slices.DeleteFunc(
+			scopedToken1.GetSpec().GetRoles(),
+			func(s string) bool { return s == types.RoleInstance.String() },
+		)
+		require.ElementsMatch(t, expectedSystemRoles, identity.SystemRoles)
+
+		require.Equal(t, scopedToken1.GetSpec().GetAssignedScope(), identity.AgentScope)
+		// Build an auth client with the new identity.
+		tlsConfig, err := identity.TLSConfig(nil /*cipherSuites*/)
+		require.NoError(t, err)
+		authClient, err := authService.TLS.NewClientWithCert(tlsConfig.Certificates[0])
+		require.NoError(t, err)
+
+		// Node cannot rejoin with a different token assigning a different scope.
+		_, err = rejoinViaAuthClient(
+			t.Context(),
+			scopedToken2.GetMetadata().GetName(),
+			authClient,
+		)
+		require.Error(t, err)
+	})
+
+	t.Run("join and rejoin with bad token", func(t *testing.T) {
+		// Node joins by connecting to the proxy's gRPC service.
+		identity, err := joinViaProxy(
+			t.Context(),
+			token1.GetName(),
+			proxyListener.Addr(),
+		)
+		require.NoError(t, err)
+
+		// Build an auth client with the new identity.
+		tlsConfig, err := identity.TLSConfig(nil /*cipherSuites*/)
+		require.NoError(t, err)
+		authClient, err := authService.TLS.NewClientWithCert(tlsConfig.Certificates[0])
+		require.NoError(t, err)
+
+		// Node the tries to rejoin with valid certs but an invalid token.
+		_, err = rejoinViaAuthClient(
+			t.Context(),
+			"invalidtoken",
+			authClient,
+		)
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+		ctx := t.Context()
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			evt, err := authService.lastEvent(ctx, "instance.join")
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(
+				&apievents.InstanceJoin{
+					Metadata: apievents.Metadata{
+						Type: "instance.join",
+						Code: events.InstanceJoinFailureCode,
+					},
+					Status: apievents.Status{
+						Success: false,
+						Error:   "token expired or not found",
+					},
+					ConnectionMetadata: apievents.ConnectionMetadata{
+						RemoteAddr: "127.0.0.1",
+					},
+					Role: "Instance",
+				},
+				evt,
+				protocmp.Transform(),
+				cmpopts.IgnoreMapEntries(func(key string, val any) bool {
+					return key == "Time" || key == "ID"
+				}),
+			))
+		}, 5*time.Second, 5*time.Millisecond, "expected instance.join failed event not found")
+	})
+}
+
+// TestJoinError asserts that attempts to join with an invalid token return an
+// AccessDenied error and do not fall back to joining via the legacy join
+// service.
+func TestJoinError(t *testing.T) {
+	t.Parallel()
+
+	token, err := types.NewProvisionTokenFromSpec("token1", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{
+			types.RoleNode,
+			types.RoleProxy,
+		},
+	})
+	require.NoError(t, err)
+
+	authService := newFakeAuthService(t)
+	require.NoError(t, authService.Auth().UpsertToken(t.Context(), token))
+
+	proxy := newFakeProxy(authService)
+	proxy.join(t)
+	proxyListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { proxyListener.Close() })
+	proxy.runGRPCServer(t, proxyListener)
+
+	// List on a free port just to guarantee an address that will reject/close
+	// all connection attempts.
+	badListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	testutils.RunTestBackgroundTask(t.Context(), t, &testutils.TestBackgroundTask{
+		Name: "bad listener",
+		Task: func(ctx context.Context) error {
+			for {
+				conn, err := badListener.Accept()
+				if err != nil {
+					if ctx.Err() != nil {
+						return ctx.Err()
+					}
+					return err
+				}
+				conn.Close()
+			}
+		},
+		Terminate: badListener.Close,
+	})
+
+	// Assert that the real AccessDenied error is returned with various
+	// configurations joining via an auth or proxy address.
+	for _, tc := range []struct {
+		desc       string
+		joinParams joinclient.JoinParams
+		assertErr  assert.ErrorAssertionFunc
+	}{
+		{
+			desc: "auth direct",
+			joinParams: joinclient.JoinParams{
+				AuthServers: []utils.NetAddr{utils.FromAddr(authService.TLS.Listener.Addr())},
+			},
+			assertErr: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				// Should get AccessDenied and should not fall back to joining
+				// via the legacy service.
+				return assert.ErrorAs(t, err, new(*trace.AccessDeniedError)) &&
+					assert.NotErrorAs(t, err, new(*joinclient.LegacyJoinError))
+			},
+		},
+		{
+			// With teleport config v2 or certain bot configurations a proxy
+			// address is passed in AuthServers, which supports both auth and
+			// proxy addresses.
+			desc: "proxy as auth",
+			joinParams: joinclient.JoinParams{
+				AuthServers: []utils.NetAddr{utils.FromAddr(proxyListener.Addr())},
+				Insecure:    true,
+			},
+			assertErr: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				// Should get AccessDenied and should not fall back to joining
+				// via the legacy service.
+				return assert.ErrorAs(t, err, new(*trace.AccessDeniedError)) &&
+					assert.NotErrorAs(t, err, new(*joinclient.LegacyJoinError))
+			},
+		},
+		{
+			desc: "proxy direct",
+			joinParams: joinclient.JoinParams{
+				ProxyServer: utils.FromAddr(proxyListener.Addr()),
+				Insecure:    true,
+			},
+			assertErr: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				// Should get AccessDenied and should not fall back to joining
+				// via the legacy service.
+				return assert.ErrorAs(t, err, new(*trace.AccessDeniedError)) &&
+					assert.NotErrorAs(t, err, new(*joinclient.LegacyJoinError))
+			},
+		},
+		{
+			desc: "bad auth address",
+			joinParams: joinclient.JoinParams{
+				AuthServers: []utils.NetAddr{utils.FromAddr(badListener.Addr())},
+			},
+			assertErr: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				// Should fall back to a legacy join attempt before failing.
+				return assert.ErrorAs(t, err, new(*joinclient.LegacyJoinError))
+			},
+		},
+		{
+			desc: "bad proxy address",
+			joinParams: joinclient.JoinParams{
+				ProxyServer: utils.FromAddr(badListener.Addr()),
+			},
+			assertErr: func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+				// Should fall back to a legacy join attempt before failing.
+				return assert.ErrorAs(t, err, new(*joinclient.LegacyJoinError))
+			},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			joinParams := tc.joinParams
+			joinParams.ID = state.IdentityID{
+				Role:     types.RoleInstance,
+				NodeName: "test",
+			}
+
+			joinParams.Token = "invalid"
+			_, err = joinclient.Join(t.Context(), joinParams)
+			tc.assertErr(t, err)
+		})
+	}
+}
+
+type fakeAuthService struct {
+	*authtest.Server
+}
+
+func newFakeAuthService(t *testing.T) *fakeAuthService {
+	testServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir:         t.TempDir(),
+			ClusterName: "testcluster",
+		},
+	})
+	require.NoError(t, err)
+	return &fakeAuthService{
+		Server: testServer,
+	}
+}
+
+func (s *fakeAuthService) lastEvent(ctx context.Context, eventType string) (apievents.AuditEvent, error) {
+	return lastEvent(ctx, s.Auth(), s.Auth().GetClock(), eventType)
+}
+
+func lastEvent(ctx context.Context, auditLog events.AuditLogger, clock clockwork.Clock, eventType string) (apievents.AuditEvent, error) {
+	events, _, err := auditLog.SearchEvents(ctx, events.SearchEventsRequest{
+		From:       clock.Now().Add(-time.Hour),
+		To:         clock.Now().Add(time.Hour),
+		EventTypes: []string{eventType},
+		Limit:      1,
+		Order:      types.EventOrderDescending,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if len(events) == 0 {
+		return nil, trace.NotFound("no matching events")
+	}
+	return events[0], nil
+}
+
+type fakeProxy struct {
+	auth     *fakeAuthService
+	identity *state.Identity
+}
+
+func newFakeProxy(auth *fakeAuthService) *fakeProxy {
+	return &fakeProxy{
+		auth: auth,
+	}
+}
+
+func (p *fakeProxy) join(t *testing.T) {
+	unauthenticatedAuthClt, err := p.auth.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	joinResult, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+		Token: "token1",
+		ID: state.IdentityID{
+			Role:     types.RoleInstance,
+			NodeName: "proxy",
+		},
+		AuthClient:           unauthenticatedAuthClt,
+		DNSNames:             []string{"proxy"},
+		AdditionalPrincipals: []string{"127.0.0.1"},
+	})
+	require.NoError(t, err)
+
+	privateKeyPEM, err := keys.MarshalPrivateKey(joinResult.PrivateKey)
+	require.NoError(t, err)
+	p.identity, err = state.ReadIdentityFromKeyPair(privateKeyPEM, joinResult.Certs)
+	require.NoError(t, err)
+}
+
+func (p *fakeProxy) runGRPCServer(t *testing.T, l net.Listener) {
+	tlsConfig, err := p.identity.TLSConfig(nil /*cipherSuites*/)
+	require.NoError(t, err)
+	// Set NextProtos such that the ALPN conn upgrade test passes.
+	tlsConfig.NextProtos = []string{string(constants.ALPNSNIProtocolReverseTunnel), string(common.ProtocolProxyGRPCInsecure), http2.NextProtoTLS}
+
+	grpcCreds := credentials.NewTLS(tlsConfig)
+
+	authenticatedAuthClientConn, err := grpc.NewClient(p.auth.TLS.Listener.Addr().String(),
+		grpc.WithTransportCredentials(grpcCreds),
+		grpc.WithStreamInterceptor(interceptors.GRPCClientStreamErrorInterceptor),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authenticatedAuthClientConn.Close())
+	})
+
+	grpcServer := grpc.NewServer(
+		grpc.Creds(grpcCreds),
+		grpc.StreamInterceptor(interceptors.GRPCServerStreamErrorInterceptor),
+	)
+	joinv1.RegisterProxyForwardingJoinServiceServer(grpcServer, joinv1proto.NewJoinServiceClient(authenticatedAuthClientConn))
+
+	testutils.RunTestBackgroundTask(t.Context(), t, &testutils.TestBackgroundTask{
+		Name: "proxy gRPC server",
+		Task: func(ctx context.Context) error {
+			return trace.Wrap(grpcServer.Serve(l))
+		},
+		Terminate: func() error {
+			grpcServer.Stop()
+			return nil
+		},
+	})
+}
+
+func joinViaProxy(
+	ctx context.Context,
+	token string,
+	addr net.Addr,
+) (*state.Identity, error) {
+	joinResult, err := joinclient.Join(ctx, joinclient.JoinParams{
+		Token: token,
+		ID: state.IdentityID{
+			Role:     types.RoleInstance,
+			NodeName: "node",
+		},
+		ProxyServer: utils.NetAddr{
+			AddrNetwork: addr.Network(),
+			Addr:        addr.String(),
+		},
+		AdditionalPrincipals: []string{"node"},
+		// The proxy's TLS cert for the test is not trusted.
+		Insecure: true,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	privateKeyPEM, err := keys.MarshalPrivateKey(joinResult.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return state.ReadIdentityFromKeyPair(privateKeyPEM, joinResult.Certs)
+}
+
+func rejoinViaAuthClient(
+	ctx context.Context,
+	token string,
+	authClient authjoin.AuthJoinClient,
+) (*state.Identity, error) {
+	joinResult, err := joinclient.Join(ctx, joinclient.JoinParams{
+		Token: token,
+		ID: state.IdentityID{
+			Role:     types.RoleInstance,
+			NodeName: "node",
+		},
+		AdditionalPrincipals: []string{"node"},
+		AuthClient:           authClient,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	privateKeyPEM, err := keys.MarshalPrivateKey(joinResult.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return state.ReadIdentityFromKeyPair(privateKeyPEM, joinResult.Certs)
+}
diff --git a/lib/join/joincerts/certsparams.go b/lib/join/joincerts/certsparams.go
new file mode 100644
index 0000000000000..3f736cfed7677
--- /dev/null
+++ b/lib/join/joincerts/certsparams.go
@@ -0,0 +1,80 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joincerts
+
+import (
+	"time"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// HostCertsParams is the set of parameters used to generate host certificates
+// when a host joins the cluster.
+type HostCertsParams struct {
+	// HostID is the unique ID of the host.
+	HostID string
+	// HostName is a user-friendly host name.
+	HostName string
+	// SystemRole is the main system role requested, e.g. Instance, Node, Proxy, etc.
+	SystemRole types.SystemRole
+	// AuthenticatedSystemRoles is a set of system roles that the Instance
+	// identity currently re-joining has authenticated.
+	AuthenticatedSystemRoles types.SystemRoles
+	// PublicTLSKey is the requested TLS public key in PEM-encoded PKIX DER format.
+	PublicTLSKey []byte
+	// PublicSSHKey is the requested SSH public key in SSH authorized keys format.
+	PublicSSHKey []byte
+	// AdditionalPrincipals is a list of additional principals
+	// to include in OpenSSH and X509 certificates
+	AdditionalPrincipals []string
+	// DNSNames is a list of DNS names to include in x509 certificates.
+	DNSNames []string
+	// RemoteAddr is the remote address of the host requesting a host certificate.
+	RemoteAddr string
+	// RawJoinClaims are raw claims asserted by specific join methods.
+	RawJoinClaims any
+}
+
+// BotCertsParams is the set of parameters used to generate bot certificates
+// when a bot joins the cluster.
+type BotCertsParams struct {
+	// PublicTLSKey is the requested TLS public key in PEM-encoded PKIX DER format.
+	PublicTLSKey []byte
+	// PublicSSHKey is the requested SSH public key in SSH authorized keys format.
+	PublicSSHKey []byte
+	// BotInstanceID is a trusted instance identifier for a Machine ID bot,
+	// provided to Auth by the Join Service when bots rejoin via a client
+	// certificate extension.
+	BotInstanceID string
+	// PreviousBotInstanceID is a trusted previous instance identifier for a
+	// Machine ID bot.
+	PreviousBotInstanceID string
+	// BotGeneration is a trusted generation counter value for Machine ID bots,
+	// provided to Auth by the Join Service when bots rejoin via a client
+	// certificate extension.
+	BotGeneration int32
+	// Expires is a desired time of the expiry of user certificates. This only
+	// applies to bot joining, and will be ignored by node joining.
+	Expires *time.Time
+	// RemoteAddr is the remote address of the bot requesting a bot certificate.
+	RemoteAddr string
+	// RawJoinClaims are raw claims asserted by specific join methods.
+	RawJoinClaims any
+	// Attrs is a collection of attributes that result from the join process.
+	Attrs *workloadidentityv1pb.JoinAttrs
+}
diff --git a/lib/join/joinclient/join.go b/lib/join/joinclient/join.go
new file mode 100644
index 0000000000000..7dc1f80cace3b
--- /dev/null
+++ b/lib/join/joinclient/join.go
@@ -0,0 +1,578 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"log/slog"
+	"os"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	authjoin "github.com/gravitational/teleport/lib/auth/join"
+	proxyinsecureclient "github.com/gravitational/teleport/lib/client/proxy/insecure"
+	"github.com/gravitational/teleport/lib/cloud/imds/gcp"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/env0"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinv1"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+	"github.com/gravitational/teleport/lib/utils/hostid"
+)
+
+type (
+	JoinParams   = authjoin.RegisterParams
+	JoinResult   = authjoin.RegisterResult
+	AzureParams  = authjoin.AzureParams
+	GitlabParams = authjoin.GitlabParams
+)
+
+// Join is used to join a cluster. A host or bot calls this with the name of a
+// provision token to get its initial certificates.
+func Join(ctx context.Context, params JoinParams) (*JoinResult, error) {
+	if err := params.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if params.AuthClient == nil && params.ID.HostUUID != "" {
+		// This check is skipped if AuthClient is provided because this is a
+		// re-join with an existing identity and the HostUUID will be
+		// maintained.
+		return nil, trace.BadParameter("HostUUID must not be provided to Join, it will be assigned by the Auth server")
+	}
+	if params.ID.Role != types.RoleInstance && params.ID.Role != types.RoleBot {
+		return nil, trace.BadParameter("Only Instance and Bot roles may be used for direct join attempts")
+	}
+	slog.InfoContext(ctx, "Trying to join with the new join service")
+	result, err := joinNew(ctx, params)
+	if trace.IsNotImplemented(err) || isConnectionError(err) {
+		// Fall back to joining via legacy service.
+		slog.InfoContext(ctx, "Joining via new join service failed, falling back to joining via the legacy join service", "error", err)
+		// Non-bots must provide their own host UUID when joining via legacy service.
+		if params.ID.HostUUID == "" && params.ID.Role != types.RoleBot {
+			hostID, err := hostid.Generate(ctx, params.JoinMethod)
+			if err != nil {
+				return nil, trace.Wrap(err, "generating host ID")
+			}
+			slog.InfoContext(ctx, "Generated host UUID for legacy join attempt", "host_uuid", hostID)
+			params.ID.HostUUID = hostID
+		}
+		result, err := LegacyJoin(ctx, params)
+		if err != nil {
+			return nil, trace.Wrap(&LegacyJoinError{err})
+		}
+		return result, nil
+	}
+	return result, trace.Wrap(err)
+}
+
+// LegacyJoin is used to join the cluster via the legacy service with client-chosen host UUIDs.
+func LegacyJoin(ctx context.Context, params JoinParams) (*JoinResult, error) {
+	if params.ID.Role != types.RoleBot && params.ID.HostUUID == "" {
+		return nil, trace.BadParameter("HostUUID is required for LegacyJoin")
+	}
+	//nolint:staticcheck // SA1019 falling back to deprecated method for compatibility.
+	result, err := authjoin.Register(ctx, params)
+	return result, trace.Wrap(err)
+}
+
+func joinNew(ctx context.Context, params JoinParams) (*JoinResult, error) {
+	if params.AuthClient != nil {
+		slog.InfoContext(ctx, "Attempting to join cluster with existing Auth client")
+		return joinViaAuthClient(ctx, params, params.AuthClient)
+	}
+	if !params.ProxyServer.IsEmpty() {
+		slog.InfoContext(ctx, "Attempting to join cluster via Proxy")
+		return joinViaProxy(ctx, params, params.ProxyServer.String())
+	}
+
+	// params.AuthServers could contain auth or proxy addresses, try both.
+	// params.CheckAndSetDefaults() asserts that this list is not empty when
+	// AuthClient and ProxyServer are both unset.
+	addr := params.AuthServers[0].String()
+	slog := slog.With("addr", addr)
+
+	type strategy struct {
+		name string
+		fn   func() (*JoinResult, error)
+	}
+	proxyStrategy := strategy{
+		name: "proxy",
+		fn: func() (*JoinResult, error) {
+			return joinViaProxy(ctx, params, addr)
+		},
+	}
+	authStrategy := strategy{
+		name: "auth",
+		fn: func() (*JoinResult, error) {
+			return joinViaAuth(ctx, params)
+		},
+	}
+	var strategies []strategy
+	if authjoin.LooksLikeProxy(params.AuthServers) {
+		slog.InfoContext(ctx, "Attempting to join cluster, address looks like a Proxy")
+		strategies = []strategy{proxyStrategy, authStrategy}
+	} else {
+		slog.InfoContext(ctx, "Attempting to join cluster, address looks like an Auth server")
+		strategies = []strategy{authStrategy, proxyStrategy}
+	}
+
+	var errs []error
+	for i, strat := range strategies { //nolint:misspell // strat is an intentional abbreviation of strategy
+		result, err := strat.fn()
+		switch {
+		case err == nil:
+			return result, nil
+		case !isConnectionError(err):
+			// Non-connection errors are hard failures: return immediately.
+			return nil, trace.Wrap(err, "joining via %s", strat.name)
+		}
+		// Connection error: keep for aggregate and try next strategy (if any).
+		errs = append(errs, trace.Wrap(err, "joining via %s", strat.name))
+		if i+1 < len(strategies) {
+			slog.InfoContext(ctx, "Failed to join cluster with a connection error, will try next method",
+				"method", strat.name, "next_method", strategies[i+1].name)
+		}
+	}
+	return nil, trace.NewAggregate(errs...)
+}
+
+func joinViaProxy(ctx context.Context, params JoinParams, proxyAddr string) (*JoinResult, error) {
+	// Connect to the proxy's insecure gRPC listener (this is regular TLS, the
+	// client is not authenticated because it doesn't have certs yet).
+	conn, err := proxyinsecureclient.NewConnection(ctx,
+		proxyinsecureclient.ConnectionConfig{
+			ProxyServer:  proxyAddr,
+			CipherSuites: params.CipherSuites,
+			Clock:        params.Clock,
+			Insecure:     params.Insecure,
+			Log:          slog.Default(),
+		},
+	)
+	if err != nil {
+		return nil, &connectionError{trace.Wrap(err, "building proxy client")}
+	}
+	defer conn.Close()
+	return joinWithClient(ctx, params, joinv1.NewClientFromConn(conn))
+}
+
+func joinViaAuth(ctx context.Context, params JoinParams) (*JoinResult, error) {
+	authClient, err := authjoin.NewAuthClient(ctx, params)
+	if err != nil {
+		return nil, &connectionError{trace.Wrap(err, "building auth client")}
+	}
+	defer authClient.Close()
+	return joinViaAuthClient(ctx, params, authClient)
+}
+
+func joinViaAuthClient(ctx context.Context, params JoinParams, authClient authjoin.AuthJoinClient) (*JoinResult, error) {
+	return joinWithClient(ctx, params, joinv1.NewClient(authClient.JoinV1Client()))
+}
+
+func joinWithClient(ctx context.Context, params JoinParams, client *joinv1.Client) (*JoinResult, error) {
+	// Clients may specify the join method or not, to let the server choose the
+	// method based on the provision token.
+	var joinMethodPtr *string
+	switch params.JoinMethod {
+	case types.JoinMethodUnspecified:
+		// leave joinMethodPtr nil to let the server pick based on the token
+	case types.JoinMethodToken,
+		types.JoinMethodAzure,
+		types.JoinMethodAzureDevops,
+		types.JoinMethodBitbucket,
+		types.JoinMethodBoundKeypair,
+		types.JoinMethodCircleCI,
+		types.JoinMethodEC2,
+		types.JoinMethodEnv0,
+		types.JoinMethodGCP,
+		types.JoinMethodGitHub,
+		types.JoinMethodGitLab,
+		types.JoinMethodIAM,
+		types.JoinMethodKubernetes,
+		types.JoinMethodOracle,
+		types.JoinMethodSpacelift,
+		types.JoinMethodTPM,
+		types.JoinMethodTerraformCloud:
+		joinMethod := string(params.JoinMethod)
+		joinMethodPtr = &joinMethod
+	default:
+		return nil, trace.NotImplemented("new join service is not implemented for method %v", params.JoinMethod)
+	}
+
+	// Initiate the join request, using a cancelable context to make sure the
+	// stream is closed when this function returns.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	stream, err := client.Join(ctx)
+	if err != nil {
+		// Connection errors may manifest when initiating the RPC.
+		return nil, &connectionError{trace.Wrap(err, "initiating join stream")}
+	}
+	defer stream.CloseSend()
+
+	// Send the ClientInit message with the intended join method, token name,
+	// and system role.
+	if err := stream.Send(&messages.ClientInit{
+		JoinMethod: joinMethodPtr,
+		TokenName:  params.Token,
+		SystemRole: params.ID.Role.String(),
+	}); err != nil {
+		// Failing to send the first message on the stream is always a connection error.
+		return nil, &connectionError{trace.Wrap(err, "sending ClientInit message")}
+	}
+
+	// Receive the ServerInit message.
+	serverInit, err := messages.RecvResponse[*messages.ServerInit](stream)
+	if err != nil {
+		err = trace.Wrap(err, "receiving ServerInit message")
+		if !trace.IsAccessDenied(err) && !trace.IsBadParameter(err) {
+			// Any unrecognized error reading the first response on the stream
+			// is likely to be a connection error.
+			err = &connectionError{err}
+		}
+		return nil, err
+	}
+
+	// Generate keys based on the signature algorithm suite from the ServerInit message.
+	signer, publicKeys, err := GenerateKeys(ctx, serverInit.SignatureAlgorithmSuite)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Build the ClientParams message that will be sent for all join methods.
+	clientParams := makeClientParams(params, publicKeys)
+
+	// Delegate out to the handler for the specific join method.
+	resultMsg, err := joinWithMethod(ctx, stream, params, clientParams, serverInit.JoinMethod)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Convert the result message into a JoinResult.
+	switch typedResult := resultMsg.(type) {
+	case *messages.HostResult:
+		return makeJoinResult(signer, typedResult.Certificates)
+	case *messages.BotResult:
+		joinResult, err := makeJoinResult(signer, typedResult.Certificates)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if typedResult.BoundKeypairResult != nil {
+			joinResult.BoundKeypair = &authjoin.BoundKeypairRegisterResult{
+				BoundPublicKey: string(typedResult.BoundKeypairResult.PublicKey),
+				JoinState:      typedResult.BoundKeypairResult.JoinState,
+			}
+		}
+		return joinResult, nil
+	default:
+		return nil, trace.BadParameter("unhandled result message type %T", resultMsg)
+	}
+}
+
+func joinWithMethod(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+	method string,
+) (messages.Response, error) {
+	var err error
+
+	switch types.JoinMethod(method) {
+	case types.JoinMethodToken:
+		return tokenJoin(stream, clientParams)
+	case types.JoinMethodAzure:
+		return azureJoin(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodAzureDevops:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = azuredevops.NewIDTokenSource(os.Getenv).GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodBitbucket:
+		// Tests may specify their own IDToken, so only overwrite it when empty.
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = bitbucket.NewIDTokenSource(os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodBoundKeypair:
+		return boundKeypairJoin(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodCircleCI:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = circleci.GetIDToken(os.Getenv)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodIAM:
+		return iamJoin(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodEC2:
+		return ec2Join(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodEnv0:
+		// Tests may specify their own IDToken, so only overwrite it when empty.
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = env0.NewIDTokenSource(os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodOracle:
+		return oracleJoin(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodGCP:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = gcp.GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodGitHub:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = githubactions.NewIDTokenSource().GetIDToken(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodGitLab:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = gitlab.NewIDTokenSource(gitlab.IDTokenSourceConfig{
+				EnvVarName: joinParams.GitlabParams.EnvVarName,
+			}).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodKubernetes:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = kubetoken.GetIDToken(os.Getenv, joinParams.KubernetesReadFileFunc)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodSpacelift:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = spacelift.NewIDTokenSource(os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+
+		return oidcJoin(stream, joinParams, clientParams)
+	case types.JoinMethodTPM:
+		return tpmJoin(ctx, stream, joinParams, clientParams)
+	case types.JoinMethodTerraformCloud:
+		if joinParams.IDToken == "" {
+			joinParams.IDToken, err = terraformcloud.NewIDTokenSource(joinParams.TerraformCloudAudienceTag, os.Getenv).GetIDToken()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+
+		return oidcJoin(stream, joinParams, clientParams)
+	default:
+		// TODO(nklaassen): implement remaining join methods.
+		sendGivingUpErr := stream.Send(&messages.GivingUp{
+			Reason: messages.GivingUpReasonUnsupportedJoinMethod,
+			Msg:    "join method " + method + " is not supported by this client",
+		})
+		return nil, trace.NewAggregate(
+			trace.NotImplemented("server selected join method %v which is not supported by this client", method),
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+	}
+}
+
+func tokenJoin(
+	stream messages.ClientStream,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The token join method is relatively simple, the flow is
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server Tokeninit
+	// client<-server Result
+	//
+	// At this point the ServerInit message has already been received, all
+	// that's left is to send the TokenInit message and receive the final result.
+	tokenInitMsg := &messages.TokenInit{
+		ClientParams: clientParams,
+	}
+	if err := stream.Send(tokenInitMsg); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Receive and return the final result.
+	result, err := stream.Recv()
+	return result, trace.Wrap(err)
+}
+
+func makeClientParams(params JoinParams, publicKeys *messages.PublicKeys) messages.ClientParams {
+	if params.ID.Role == types.RoleBot {
+		return messages.ClientParams{
+			BotParams: &messages.BotParams{
+				PublicKeys: *publicKeys,
+				Expires:    params.Expires,
+			},
+		}
+	}
+	return messages.ClientParams{
+		HostParams: &messages.HostParams{
+			PublicKeys:           *publicKeys,
+			HostName:             params.ID.NodeName,
+			AdditionalPrincipals: params.AdditionalPrincipals,
+			DNSNames:             params.DNSNames,
+		},
+	}
+}
+
+func makeJoinResult(signer crypto.Signer, certs messages.Certificates) (*JoinResult, error) {
+	// Callers expect proto.Certs with PEM-formatted TLS certs and
+	// authorized_keys formated SSH certs/keys.
+	sshCert, err := toAuthorizedKey(certs.SSHCert)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshCAKeys, err := toAuthorizedKeys(certs.SSHCAKeys)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &JoinResult{
+		Certs: &proto.Certs{
+			TLS:        pemEncodeTLSCert(certs.TLSCert),
+			TLSCACerts: pemEncodeTLSCerts(certs.TLSCACerts),
+			SSH:        sshCert,
+			SSHCACerts: sshCAKeys, // SSHCACerts is a misnomer, SSH CAs are just public keys.
+		},
+		PrivateKey: signer,
+	}, nil
+}
+
+func toAuthorizedKeys(wireFormats [][]byte) ([][]byte, error) {
+	out := make([][]byte, len(wireFormats))
+	for i, wireFormat := range wireFormats {
+		var err error
+		out[i], err = toAuthorizedKey(wireFormat)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return out, nil
+}
+
+func toAuthorizedKey(wireFormat []byte) ([]byte, error) {
+	sshPub, err := ssh.ParsePublicKey(wireFormat)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return ssh.MarshalAuthorizedKey(sshPub), nil
+}
+
+func pemEncodeTLSCerts(rawCerts [][]byte) [][]byte {
+	out := make([][]byte, len(rawCerts))
+	for i, rawCert := range rawCerts {
+		out[i] = pemEncodeTLSCert(rawCert)
+	}
+	return out
+}
+
+func pemEncodeTLSCert(rawCert []byte) []byte {
+	return pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: rawCert,
+	})
+}
+
+// GenerateKeys generates host keys appropriate for a cluster join request
+// according to the cluster's configured signature algorithm suite.
+func GenerateKeys(ctx context.Context, suite types.SignatureAlgorithmSuite) (crypto.Signer, *messages.PublicKeys, error) {
+	signer, err := cryptosuites.GenerateKey(
+		ctx,
+		cryptosuites.StaticAlgorithmSuite(suite),
+		cryptosuites.HostIdentity,
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	tlsPub, err := x509.MarshalPKIXPublicKey(signer.Public())
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	sshPub, err := ssh.NewPublicKey(signer.Public())
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return signer, &messages.PublicKeys{
+		PublicTLSKey: tlsPub,
+		PublicSSHKey: sshPub.Marshal(),
+	}, nil
+}
+
+type connectionError struct {
+	wrapped error
+}
+
+func (e *connectionError) Error() string {
+	return e.wrapped.Error()
+}
+
+func (e *connectionError) Unwrap() error {
+	return e.wrapped
+}
+
+func isConnectionError(err error) bool {
+	var ce *connectionError
+	return errors.As(err, &ce)
+}
+
+// LegacyJoinError is returned when the join attempt failed while attempting to
+// join via the legacy join service.
+type LegacyJoinError struct {
+	wrapped error
+}
+
+func (e *LegacyJoinError) Error() string {
+	return e.wrapped.Error()
+}
+
+func (e *LegacyJoinError) Unwrap() error {
+	return e.wrapped
+}
diff --git a/lib/join/joinclient/join_azure.go b/lib/join/joinclient/join_azure.go
new file mode 100644
index 0000000000000..a359d68e76f36
--- /dev/null
+++ b/lib/join/joinclient/join_azure.go
@@ -0,0 +1,135 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+	"crypto/x509"
+	"net/http"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/cloud/imds/azure"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func azureJoin(ctx context.Context, stream messages.ClientStream, joinParams JoinParams, clientParams messages.ClientParams) (messages.Response, error) {
+	// The Azure join method involves the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server AzureInit
+	// client<-server AzureChallenge
+	// client->server AzureChallengeSolution
+	// client<-server Result
+	//
+	// At this point the ServerInit messages has already been received, what's
+	// left is to send the AzureInit message, handle the challenge-response, and
+	// receive and return the final result.
+	if err := stream.Send(&messages.AzureInit{
+		ClientParams: clientParams,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending AzureInit")
+	}
+
+	challenge, err := messages.RecvResponse[*messages.AzureChallenge](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving AzureChallenge")
+	}
+
+	imds := joinParams.AzureParams.IMDSClient
+	if imds == nil {
+		imds = azure.NewInstanceMetadataClient()
+	}
+	if !imds.IsAvailable(ctx) {
+		return nil, trace.AccessDenied("could not reach instance metadata. Is Teleport running on an Azure VM?")
+	}
+	ad, err := imds.GetAttestedData(ctx, challenge.Challenge)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting attested data document")
+	}
+	intermediate, err := getIntermediate(ctx, joinParams.AzureParams.IssuerHTTPClient, ad)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting intermediate CA for attested data")
+	}
+	accessToken, err := imds.GetAccessToken(ctx, joinParams.AzureParams.ClientID)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting access token")
+	}
+
+	if err := stream.Send(&messages.AzureChallengeSolution{
+		AttestedData: ad,
+		Intermediate: intermediate,
+		AccessToken:  accessToken,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending AzureChallengeSolution")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
+
+func getIntermediate(ctx context.Context, httpClient utils.HTTPDoClient, ad []byte) ([]byte, error) {
+	_, p7, err := azurejoin.ParseAttestedData(ad)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing attested data document")
+	}
+	if len(p7.Certificates) == 0 {
+		return nil, trace.Errorf("attested data signature has no certificates")
+	}
+	leafCert := p7.Certificates[0]
+	if len(leafCert.IssuingCertificateURL) == 0 {
+		return nil, trace.Errorf("attested data leaf certificate has no issuing certificate URL")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, leafCert.IssuingCertificateURL[0], nil /*body*/)
+	if err != nil {
+		return nil, trace.Wrap(err, "building HTTP request")
+	}
+
+	if httpClient == nil {
+		httpClient, err = defaults.HTTPClient()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching intermediate certificate")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, trace.Errorf("failed to fetch intermediate cert, got HTTP status code %d", resp.StatusCode)
+	}
+
+	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
+	if err != nil {
+		return nil, trace.Wrap(err, "reading HTTP response body")
+	}
+
+	if _, err := x509.ParseCertificates(body); err != nil {
+		return nil, trace.Wrap(err, "parsing intermediate certificate")
+	}
+
+	return body, nil
+}
diff --git a/lib/join/joinclient/join_boundkeypair.go b/lib/join/joinclient/join_boundkeypair.go
new file mode 100644
index 0000000000000..dec019df716ed
--- /dev/null
+++ b/lib/join/joinclient/join_boundkeypair.go
@@ -0,0 +1,192 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+	"crypto"
+	"log/slog"
+	"strings"
+
+	"github.com/go-jose/go-jose/v3"
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/types"
+	authjoin "github.com/gravitational/teleport/lib/auth/join"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/jwt"
+)
+
+type (
+	BoundKeypairParams = authjoin.BoundKeypairParams
+	GetSignerFunc      = authjoin.GetSignerFunc
+	KeygenFunc         = authjoin.KeygenFunc
+	BoundKeypairResult = authjoin.BoundKeypairRegisterResult
+)
+
+func boundKeypairJoin(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The bound keypair join method is relatively complex compared to other
+	// join methods, the flow is:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server BoundKeypairInit
+	// client<-server BoundKeypairChallenge
+	// client->server BoundKeypairChallengeSolution
+	//   (optional additional steps if keypair rotation is required)
+	//   client<-server: BoundKeypairRotationRequest
+	//   client->server: BoundKeypairRotationResponse
+	//   client<-server: BoundKeypairChallenge
+	//   client->server: BoundKeypairChallengeSolution
+	// client<-server: Result containing BoundKeypairResult
+	//
+	// At this point the ServerInit message has already been received, this
+	// function needs to send the BoundKeyPairInit and then handle any
+	// challenges and rotation requests.
+	boundKeypairInit := &messages.BoundKeypairInit{
+		ClientParams:      clientParams,
+		InitialJoinSecret: joinParams.BoundKeypairParams.RegistrationSecret,
+		PreviousJoinState: joinParams.BoundKeypairParams.PreviousJoinState,
+	}
+	if err := stream.Send(boundKeypairInit); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	bkParams := joinParams.BoundKeypairParams
+	for {
+		msg, err := stream.Recv()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		switch kind := msg.(type) {
+		case *messages.BotResult:
+			// Return the final result.
+			return kind, nil
+		case *messages.BoundKeypairChallenge:
+			solution, err := solveBoundKeypairChallenge(bkParams, kind)
+			if err != nil {
+				sendGivingUpErr := stream.Send(&messages.GivingUp{
+					Reason: messages.GivingUpReasonChallengeSolutionFailed,
+					Msg:    err.Error(),
+				})
+				return nil, trace.NewAggregate(
+					err,
+					trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+				)
+			}
+			if err := stream.Send(&messages.BoundKeypairChallengeSolution{
+				Solution: solution,
+			}); err != nil {
+				return nil, trace.Wrap(err)
+			}
+		case *messages.BoundKeypairRotationRequest:
+			newPubkey, err := handleBoundKeypairRotationRequest(ctx, bkParams, kind)
+			if err != nil {
+				sendGivingUpErr := stream.Send(&messages.GivingUp{
+					Reason: messages.GivingUpReasonChallengeSolutionFailed,
+					Msg:    err.Error(),
+				})
+				return nil, trace.NewAggregate(
+					err,
+					trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+				)
+			}
+			if err := stream.Send(&messages.BoundKeypairRotationResponse{
+				PublicKey: newPubkey,
+			}); err != nil {
+				return nil, trace.Wrap(err)
+			}
+		default:
+			return nil, trace.Errorf("server sent unexpected message type %T", msg)
+		}
+	}
+}
+
+func solveBoundKeypairChallenge(bkParams *BoundKeypairParams, challengeMsg *messages.BoundKeypairChallenge) ([]byte, error) {
+	signer, err := bkParams.GetSigner(string(challengeMsg.PublicKey))
+	if err != nil {
+		return nil, trace.Wrap(err, "could not lookup signer for public key %s", string(challengeMsg.PublicKey))
+	}
+
+	alg, err := jwt.AlgorithmForPublicKey(signer.Public())
+	if err != nil {
+		return nil, trace.Wrap(err, "determining signing algorithm for public key")
+	}
+
+	opts := (&jose.SignerOptions{}).WithType("JWT")
+	key := jose.SigningKey{
+		Algorithm: alg,
+		Key:       signer,
+	}
+
+	joseSigner, err := jose.NewSigner(key, opts)
+	if err != nil {
+		return nil, trace.Wrap(err, "creating signer")
+	}
+
+	jws, err := joseSigner.Sign([]byte(challengeMsg.Challenge))
+	if err != nil {
+		return nil, trace.Wrap(err, "signing challenge")
+	}
+
+	serialized, err := jws.CompactSerialize()
+	if err != nil {
+		return nil, trace.Wrap(err, "serializing signed challenge")
+	}
+	return []byte(serialized), nil
+}
+
+func handleBoundKeypairRotationRequest(ctx context.Context, bkParams *BoundKeypairParams, rotationRequest *messages.BoundKeypairRotationRequest) ([]byte, error) {
+	if bkParams.RequestNewKeypair == nil {
+		return nil, trace.BadParameter("RequestNewKeypair is required")
+	}
+
+	slog.InfoContext(ctx, "Server has requested keypair rotation", "suite", rotationRequest.SignatureAlgorithmSuite)
+
+	suite, err := types.SignatureAlgorithmSuiteFromString(rotationRequest.SignatureAlgorithmSuite)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	newSigner, err := bkParams.RequestNewKeypair(ctx, cryptosuites.StaticAlgorithmSuite(suite))
+	if err != nil {
+		return nil, trace.Wrap(err, "requesting new keypair")
+	}
+
+	newPubkey, err := sshPubKeyFromSigner(newSigner)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return []byte(newPubkey), nil
+}
+
+// sshPubKeyFromSigner returns the public key of the given signer in ssh
+// authorized_keys format.
+func sshPubKeyFromSigner(signer crypto.Signer) (string, error) {
+	sshKey, err := ssh.NewPublicKey(signer.Public())
+	if err != nil {
+		return "", trace.Wrap(err, "creating SSH public key from signer")
+	}
+
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshKey))), nil
+}
diff --git a/lib/join/joinclient/join_ec2.go b/lib/join/joinclient/join_ec2.go
new file mode 100644
index 0000000000000..20a323dd0a185
--- /dev/null
+++ b/lib/join/joinclient/join_ec2.go
@@ -0,0 +1,64 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func ec2Join(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The EC2 join method involves the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server EC2Init
+	// client<-server Result
+	//
+	// At this point the ServerInit messages has already been received, what's
+	// left is to send the EC2Init message and receive and return the final
+	// result.
+	ec2IdentityDocument, err := joinParams.GetInstanceIdentityDocumentFunc(ctx)
+	if err != nil {
+		err = trace.Wrap(err, "getting signed EC2 Instance Identity Document")
+		sendGivingUpErr := stream.Send(&messages.GivingUp{
+			Reason: messages.GivingUpReasonUnspecified,
+			Msg:    err.Error(),
+		})
+		return nil, trace.NewAggregate(
+			err,
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+	}
+	if err := stream.Send(&messages.EC2Init{
+		ClientParams: clientParams,
+		Document:     ec2IdentityDocument,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending EC2Init")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
diff --git a/lib/join/joinclient/join_iam.go b/lib/join/joinclient/join_iam.go
new file mode 100644
index 0000000000000..ba0eafc421277
--- /dev/null
+++ b/lib/join/joinclient/join_iam.go
@@ -0,0 +1,81 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/auth/join/iam"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func iamJoin(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The IAM join method involves the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server IAMInit
+	// client<-server IAMChallenge
+	// client->server IAMChallengeSolution
+	// client<-server Result
+	//
+	// At this point the ServerInit messages has already been received, what's
+	// left is to send the IAMInit message, handle the challenge-response, and
+	// receive and return the final result.
+	if err := stream.Send(&messages.IAMInit{
+		ClientParams: clientParams,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending IAMInit")
+	}
+
+	challenge, err := messages.RecvResponse[*messages.IAMChallenge](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving IAMChallenge")
+	}
+
+	signedRequest, err := joinParams.CreateSignedSTSIdentityRequestFunc(ctx, challenge.Challenge,
+		iam.WithFIPSEndpoint(joinParams.FIPS),
+	)
+	if err != nil {
+		err = trace.Wrap(err, "creating signed sts:GetCallerIdentity request")
+		sendGivingUpErr := stream.Send(&messages.GivingUp{
+			Reason: messages.GivingUpReasonChallengeSolutionFailed,
+			Msg:    err.Error(),
+		})
+		return nil, trace.NewAggregate(
+			err,
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+
+	}
+
+	if err := stream.Send(&messages.IAMChallengeSolution{
+		STSIdentityRequest: signedRequest,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending IAMChallengeSolution")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
diff --git a/lib/join/joinclient/join_oidc.go b/lib/join/joinclient/join_oidc.go
new file mode 100644
index 0000000000000..f6ff0becdd99e
--- /dev/null
+++ b/lib/join/joinclient/join_oidc.go
@@ -0,0 +1,51 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+// oidcJoin handles stream interactions for most OIDC join methods that provide
+// a static OIDC assertion.
+func oidcJoin(
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The OIDC join methods involve the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server OIDCInit
+	// client<-server Result
+	//
+	// At this point the ServerInit messages has already been received, what's
+	// left is to send the OIDCInit message and receive and return the final
+	// result.
+	if err := stream.Send(&messages.OIDCInit{
+		ClientParams: clientParams,
+		IDToken:      []byte(joinParams.IDToken),
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending OIDCInit")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
diff --git a/lib/join/joinclient/join_oracle.go b/lib/join/joinclient/join_oracle.go
new file mode 100644
index 0000000000000..939afd7cbd8ed
--- /dev/null
+++ b/lib/join/joinclient/join_oracle.go
@@ -0,0 +1,76 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinclient/oracle"
+)
+
+func oracleJoin(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The Oracle join method involves the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server OracleInit
+	// client<-server OracleChallenge
+	// client->server OracleChallengeSolution
+	// client<-server Result
+	//
+	// At this point the ServerInit messages has already been received, what's
+	// left is to send the OracleInit message, handle the challenge-response, and
+	// receive and return the final result.
+	if err := stream.Send(&messages.OracleInit{
+		ClientParams: clientParams,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending OracleInit")
+	}
+
+	challenge, err := messages.RecvResponse[*messages.OracleChallenge](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving OracleChallenge")
+	}
+
+	solution, err := oracle.SolveChallenge(ctx, joinParams.OracleIMDSClient, challenge)
+	if err != nil {
+		err = trace.Wrap(err, "solving challenge")
+		sendGivingUpErr := stream.Send(&messages.GivingUp{
+			Reason: messages.GivingUpReasonChallengeSolutionFailed,
+			Msg:    err.Error(),
+		})
+		return nil, trace.NewAggregate(
+			err,
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+	}
+
+	if err := stream.Send(solution); err != nil {
+		return nil, trace.Wrap(err, "sending OracleChallengeSolution")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
diff --git a/lib/join/joinclient/join_tpm.go b/lib/join/joinclient/join_tpm.go
new file mode 100644
index 0000000000000..a3d53c65ad184
--- /dev/null
+++ b/lib/join/joinclient/join_tpm.go
@@ -0,0 +1,117 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinclient
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/google/go-attestation/attest"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func tpmJoin(
+	ctx context.Context,
+	stream messages.ClientStream,
+	joinParams JoinParams,
+	clientParams messages.ClientParams,
+) (messages.Response, error) {
+	// The TPM join method involves the following messages:
+	//
+	// client->server ClientInit
+	// client<-server ServerInit
+	// client->server TPMInit
+	// client<-server TPMEncryptedCredential
+	// client->server TPMSolution
+	// client<-server Result
+	//
+	// At this point the ServerInit message has already been received,
+	// what's left is to send the TPMInit message, handle the
+	// TPMEncryptedCredential->TPMSolution flow, and receive and return the
+	// final result.
+
+	log := slog.Default()
+
+	attestation, close, err := joinParams.AttestTPM(ctx, log)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer func() {
+		if err := close(); err != nil {
+			log.WarnContext(ctx, "Failed to close TPM", "error", err)
+		}
+	}()
+
+	tpmInit := &messages.TPMInit{
+		ClientParams:      clientParams,
+		Public:            attestation.AttestParams.Public,
+		CreateData:        attestation.AttestParams.CreateData,
+		CreateAttestation: attestation.AttestParams.CreateAttestation,
+		CreateSignature:   attestation.AttestParams.CreateSignature,
+	}
+
+	// Get the EKKey or EKCert. We want to prefer the EKCert if it is available
+	// as this is signed by the manufacturer.
+	switch {
+	case attestation.Data.EKCert != nil:
+		log.DebugContext(ctx, "Using EKCert for TPM registration",
+			"ekcert_serial", attestation.Data.EKCert.SerialNumber)
+		tpmInit.EKCert = attestation.Data.EKCert.Raw
+	case attestation.Data.EKPub != nil:
+		log.DebugContext(ctx, "Using EKKey for TPM registration",
+			"ekpub_hash", attestation.Data.EKPubHash)
+		tpmInit.EKKey = attestation.Data.EKPub
+	default:
+		return nil, trace.BadParameter("tpm has neither ekkey or ekcert")
+	}
+
+	if err := stream.Send(tpmInit); err != nil {
+		return nil, trace.Wrap(err, "sending TPMInit")
+	}
+
+	encryptedCredential, err := messages.RecvResponse[*messages.TPMEncryptedCredential](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving TPMEncryptedCredential")
+	}
+
+	solution, err := attestation.Solve(&attest.EncryptedCredential{
+		Credential: encryptedCredential.CredentialBlob,
+		Secret:     encryptedCredential.Secret,
+	})
+	if err != nil {
+		err = trace.Wrap(err, "activating credential")
+		sendGivingUpErr := stream.Send(&messages.GivingUp{
+			Reason: messages.GivingUpReasonChallengeSolutionFailed,
+			Msg:    err.Error(),
+		})
+		return nil, trace.NewAggregate(
+			err,
+			trace.Wrap(sendGivingUpErr, "sending GivingUp message to server"),
+		)
+	}
+
+	if err := stream.Send(&messages.TPMSolution{
+		Solution: solution,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending TPMSolution")
+	}
+
+	result, err := stream.Recv()
+	return result, trace.Wrap(err, "receiving join result")
+}
diff --git a/lib/join/joinclient/oracle/oracle.go b/lib/join/joinclient/oracle/oracle.go
new file mode 100644
index 0000000000000..52609002fcb7d
--- /dev/null
+++ b/lib/join/joinclient/oracle/oracle.go
@@ -0,0 +1,163 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Package oracle includes methods required for clients to join a Teleport
+// cluster using the Oracle join method.
+package oracle
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"io"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/oracle/oci-go-sdk/v65/common"
+	"github.com/oracle/oci-go-sdk/v65/common/auth"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// SolveChallenge solves an Oracle join challenge.
+func SolveChallenge(ctx context.Context, httpClient utils.HTTPDoClient, challenge *messages.OracleChallenge) (*messages.OracleChallengeSolution, error) {
+	signedRootCAReq, err := makeSignedRootCAReq(httpClient)
+	if err != nil {
+		return nil, trace.Wrap(err, "making signed root CA request")
+	}
+
+	cert, err := fetchIMDS(ctx, httpClient, "cert.pem")
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching instance cert from IMDS")
+	}
+
+	intermediate, err := fetchIMDS(ctx, httpClient, "intermediate.pem")
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching intermediate CA certs from IMDS")
+	}
+
+	keyPEM, err := fetchIMDS(ctx, httpClient, "key.pem")
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching instance private key from IMDS")
+	}
+
+	key, err := keys.ParsePrivateKey(keyPEM)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing instance private key")
+	}
+
+	signature, err := SignChallenge(key.Signer, challenge.Challenge)
+	if err != nil {
+		return nil, trace.Wrap(err, "signing challenge")
+	}
+
+	return &messages.OracleChallengeSolution{
+		Cert:            cert,
+		Intermediate:    intermediate,
+		Signature:       signature,
+		SignedRootCAReq: signedRootCAReq,
+	}, nil
+}
+
+// SignChallenge signs a challenge with a given instance private key.
+func SignChallenge(key crypto.Signer, challenge string) ([]byte, error) {
+	rsaKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		return nil, trace.BadParameter("only RSA keys are supported")
+	}
+	digest := sha256.Sum256([]byte(challenge))
+	pssOpts := &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA256}
+	signature, err := rsa.SignPSS(rand.Reader, rsaKey, crypto.SHA256, digest[:], pssOpts)
+	return signature, trace.Wrap(err)
+}
+
+func makeSignedRootCAReq(client utils.HTTPDoClient) ([]byte, error) {
+	provider, err := auth.InstancePrincipalConfigurationProviderWithCustomClient(
+		func(dispatcher common.HTTPRequestDispatcher) (common.HTTPRequestDispatcher, error) {
+			return client, nil
+		})
+	if err != nil {
+		return nil, trace.Wrap(err, "making oracle config provider")
+	}
+
+	localRegion, err := provider.Region()
+	if err != nil {
+		return nil, trace.Wrap(err, "finding local OCI region")
+	}
+	regionalAuthEndpoint := common.StringToRegion(localRegion).Endpoint("auth")
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL: &url.URL{
+			Scheme: "http",
+			Host:   regionalAuthEndpoint,
+			Path:   "/v1/instancePrincipalRootCACertificates",
+		},
+		Header: http.Header{
+			"Date": []string{time.Now().UTC().Format(http.TimeFormat)},
+		},
+	}
+
+	signer := common.DefaultRequestSigner(provider)
+	if err := signer.Sign(req); err != nil {
+		return nil, trace.Wrap(err, "signing request")
+	}
+
+	reqBytes, err := httputil.DumpRequestOut(req, false /*body*/)
+	if err != nil {
+		return nil, trace.Wrap(err, "dumping HTTP request to bytes")
+	}
+
+	return reqBytes, nil
+}
+
+// fetchIMDS fetches instance metadata from Oracle's IMDSv2, which is available
+// on every OCI instance https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm
+func fetchIMDS(ctx context.Context, client utils.HTTPDoClient, path string) ([]byte, error) {
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL: &url.URL{
+			Scheme: "http",
+			Host:   "169.254.169.254",
+			Path:   "/opc/v2/identity/" + path,
+		},
+		Header: http.Header{
+			// This header is required on all IMDSv2 requests.
+			"Authorization": []string{"Bearer Oracle"},
+		},
+	}
+	req = req.WithContext(ctx)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err, "sending request")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, trace.Errorf("HTTP request failed with status: %s", resp.Status)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, teleport.MaxHTTPResponseSize))
+	return body, trace.Wrap(err, "reading response body")
+}
diff --git a/lib/join/joinutils/utils.go b/lib/join/joinutils/utils.go
new file mode 100644
index 0000000000000..e049d34d17ce2
--- /dev/null
+++ b/lib/join/joinutils/utils.go
@@ -0,0 +1,132 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinutils
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"github.com/gravitational/trace"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+)
+
+// GlobMatch performs simple a simple glob-style match test on a string.
+// - '*' matches zero or more characters.
+// - '?' matches any single character.
+// It returns true if a match is detected.
+func GlobMatch(pattern, str string) (bool, error) {
+	pattern = regexp.QuoteMeta(pattern)
+	pattern = strings.ReplaceAll(pattern, `\*`, ".*")
+	pattern = strings.ReplaceAll(pattern, `\?`, ".")
+	pattern = "^" + pattern + "$"
+	matched, err := regexp.MatchString(pattern, str)
+	return matched, trace.Wrap(err)
+}
+
+// GlobMatchAllowEmptyPattern is used when comparing some rule fields from a
+// ProvisionToken  against a claim from a token. It allows simple pattern
+// matching:
+// - an empty pattern ("") matches all inputs
+// - '*' matches zero or more characters.
+// - '?' matches any single character.
+// It returns true if a match is detected.
+func GlobMatchAllowEmptyPattern(pattern, str string) (bool, error) {
+	if pattern == "" {
+		return true, nil
+	}
+	return GlobMatch(pattern, str)
+}
+
+// GenerateChallenge generates a crypto-random challenge with length random
+// bytes and encodes it to base64.
+func GenerateChallenge(encoding *base64.Encoding, length int) (string, error) {
+	// read crypto-random bytes to generate the challenge
+	challengeRawBytes := make([]byte, length)
+	if _, err := rand.Read(challengeRawBytes); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	// encode the challenge to base64 so it can be sent over HTTP
+	return encoding.EncodeToString(challengeRawBytes), nil
+}
+
+// RawJoinAttrsToStruct converts raw join attributes into a struct suitable for
+// logging or audit events.
+func RawJoinAttrsToStruct(in any) (*apievents.Struct, error) {
+	if in == nil {
+		return nil, nil
+	}
+	attrBytes, err := json.Marshal(in)
+	if err != nil {
+		return nil, trace.Wrap(err, "marshaling join attributes")
+	}
+	out := &apievents.Struct{}
+	if err := out.UnmarshalJSON(attrBytes); err != nil {
+		return nil, trace.Wrap(err, "unmarshaling join attributes")
+	}
+	return out, nil
+}
+
+// SanitizeUntrustedString sanitizes an untrusted string from a joining client
+// for inclusion in a log message or audit event.
+func SanitizeUntrustedString(in string) string {
+	var out strings.Builder
+	const maxLen = 512
+	wasSpace := false
+	for _, r := range in {
+		// Break once the output reaches the max length.
+		if out.Len() >= maxLen {
+			break
+		}
+
+		// Coalesce runs of spaces to a single space.
+		if unicode.IsSpace(r) {
+			if !wasSpace {
+				out.WriteRune(' ')
+			}
+			wasSpace = true
+			continue
+		}
+		wasSpace = false
+
+		// Strip all non-print characters.
+		if !unicode.IsPrint(r) {
+			out.WriteRune('_')
+			continue
+		}
+
+		// Allow all letters and numbers.
+		if unicode.IsLetter(r) || unicode.IsDigit(r) {
+			out.WriteRune(r)
+			continue
+		}
+
+		// Whitelist allowed symbols. Avoid allowing links or quotes.
+		switch r {
+		case '.', ',', ':', ';', '-', '+', '@':
+			out.WriteRune(r)
+		default:
+			out.WriteRune('_')
+		}
+	}
+	return out.String()
+}
diff --git a/lib/join/joinutils/utils_test.go b/lib/join/joinutils/utils_test.go
new file mode 100644
index 0000000000000..a418e12d15378
--- /dev/null
+++ b/lib/join/joinutils/utils_test.go
@@ -0,0 +1,68 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package joinutils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGlobMatchAllowEmptyPattern(t *testing.T) {
+	tests := []struct {
+		name string
+
+		rule  string
+		claim string
+
+		want bool
+	}{
+		{
+			name:  "no rule",
+			rule:  "",
+			claim: "foo",
+			want:  true,
+		},
+		{
+			name:  "non-globby rule matches",
+			rule:  "foo",
+			claim: "foo",
+			want:  true,
+		},
+		{
+			name:  "globby rule matches",
+			rule:  "?est-*-foo",
+			claim: "test-string-foo",
+			want:  true,
+		},
+		{
+			name:  "globby rule mismatch",
+			rule:  "?est-*-foo",
+			claim: "ttest-bar-ffoo",
+			want:  false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := GlobMatchAllowEmptyPattern(tt.rule, tt.claim)
+			require.NoError(t, err)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/lib/join/joinv1/client.go b/lib/join/joinv1/client.go
new file mode 100644
index 0000000000000..6000668052075
--- /dev/null
+++ b/lib/join/joinv1/client.go
@@ -0,0 +1,131 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"context"
+	"errors"
+	"io"
+
+	"github.com/gravitational/trace"
+	grpc "google.golang.org/grpc"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+// Client wraps a gRPC client to provide a protocol-agnostic client for cluster
+// joining.
+type Client struct {
+	grpcClient joinv1.JoinServiceClient
+}
+
+// NewClient returns a new [Client] wrapping the plain gRPC client.
+func NewClient(grpcClient joinv1.JoinServiceClient) *Client {
+	return &Client{
+		grpcClient: grpcClient,
+	}
+}
+
+// NewClientFromConn returns a new [Client] wrapping plain gRPC ClientConn.
+func NewClientFromConn(cc *grpc.ClientConn) *Client {
+	return &Client{
+		grpcClient: joinv1.NewJoinServiceClient(cc),
+	}
+}
+
+// Join implements cluster joining for nodes and bots.
+func (c *Client) Join(ctx context.Context) (messages.ClientStream, error) {
+	ctx, cancel := context.WithCancelCause(ctx)
+
+	grpcStream, err := c.grpcClient.Join(ctx)
+	if err != nil {
+		cancel(err)
+		return nil, trace.Wrap(err)
+	}
+
+	return &clientStream{
+		grpcStream: grpcStream,
+		cancel:     cancel,
+	}, nil
+}
+
+// clientStream implements [messages.ClientStream]. Internally it converts
+// [messages.Request] and [messages.Response] type to/from gRPC messages and
+// translates Send/Recv calls to calls on the real gRPC client.
+type clientStream struct {
+	grpcStream grpc.BidiStreamingClient[joinv1.JoinRequest, joinv1.JoinResponse]
+	cancel     context.CancelCauseFunc
+}
+
+// Send sends a request to the join service. Canceling the parent context
+// passed to Join will unblock the operation.
+func (s *clientStream) Send(msg messages.Request) (err error) {
+	defer func() {
+		if err != nil {
+			s.cancel(err)
+		}
+	}()
+	req, err := requestFromMessage(msg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if sendErr := s.grpcStream.Send(req); err != nil {
+		if errors.Is(sendErr, io.EOF) {
+			// From the docs on Send: if the error was generated by the client,
+			// the status is returned directly. Otherwise, io.EOF is returned,
+			// and the status of the stream may be discovered using Recv().
+			//
+			// Returning the error from Recv in this case makes sure the client
+			// sees the real error in cases where the RPC returned early with
+			// an error after the server sent a message and before the client
+			// sends a message. This has been known to occur when the server
+			// does not support a given join method.
+			_, recvErr := s.grpcStream.Recv()
+			if recvErr == nil {
+				// Sanity check.
+				return trace.Errorf("gRPC Send returned EOF and Recv returned nil")
+			}
+			return trace.Wrap(recvErr, "gRPC stream failed")
+		}
+		return trace.Wrap(err, "sending request to gRPC stream")
+	}
+	return nil
+}
+
+// Recv receives a response from the join service. Canceling the parent
+// context passed to Join will unblock the operation.
+func (s *clientStream) Recv() (msg messages.Response, err error) {
+	defer func() {
+		if err != nil && !errors.Is(err, io.EOF) {
+			s.cancel(err)
+		}
+	}()
+	resp, err := s.grpcStream.Recv()
+	if errors.Is(err, io.EOF) {
+		return nil, io.EOF
+	}
+	if err != nil {
+		return nil, trace.Wrap(err, "reading response from gRPC stream")
+	}
+	msg, err = responseToMessage(resp)
+	return msg, trace.Wrap(err)
+}
+
+func (s *clientStream) CloseSend() error {
+	return trace.Wrap(s.grpcStream.CloseSend())
+}
diff --git a/lib/join/joinv1/forwarding_server.go b/lib/join/joinv1/forwarding_server.go
new file mode 100644
index 0000000000000..23809754b0e57
--- /dev/null
+++ b/lib/join/joinv1/forwarding_server.go
@@ -0,0 +1,159 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	grpc "google.golang.org/grpc"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+)
+
+const (
+	joinRequestTimeout = time.Minute
+)
+
+// forwardingServer is a gRPC service meant to run on the Proxy which forwards
+// cluster join requests to the Auth service.
+//
+// This service intercepts ClientInit requests to set the ForwardedByProxy flag
+// and add ProxySuppliedParameters.
+type forwardingServer struct {
+	joinv1.UnsafeJoinServiceServer
+
+	grpcClient joinv1.JoinServiceClient
+}
+
+// RegisterProxyForwardingJoinServiceServer registers the Join gRPC service for
+// use on the Proxy, it will forward the client's IP address and Teleport version.
+func RegisterProxyForwardingJoinServiceServer(s grpc.ServiceRegistrar, grpcClient joinv1.JoinServiceClient) {
+	joinv1.RegisterJoinServiceServer(s, &forwardingServer{
+		grpcClient: grpcClient,
+	})
+}
+
+// Join forwards streaming join requests to the Auth service.
+func (s *forwardingServer) Join(serverStream grpc.BidiStreamingServer[joinv1.JoinRequest, joinv1.JoinResponse]) error {
+	peerInfo, err := peerInfoFromContext(serverStream.Context())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	proxySuppliedParams := &joinv1.ClientInit_ProxySuppliedParams{
+		RemoteAddr:    peerInfo.remoteAddr,
+		ClientVersion: peerInfo.clientVersion,
+	}
+
+	ctx, cancel := context.WithTimeoutCause(serverStream.Context(), joinRequestTimeout,
+		trace.LimitExceeded(
+			"join attempt timed out after %s, terminating the stream on the proxy",
+			joinRequestTimeout,
+		))
+	defer cancel()
+
+	clientStream, err := s.grpcClient.Join(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	errs := make(chan error, 2)
+	go func() {
+		errs <- s.forwardRequests(serverStream, clientStream, proxySuppliedParams)
+	}()
+	go func() {
+		errs <- s.forwardResponses(serverStream, clientStream)
+	}()
+
+	// Any Send or Recv on a gRPC stream may block and there is no way to
+	// cancel it without returning from the gRPC handler, so this function must
+	// return immediately on any error without waiting for all spawned
+	// goroutines to terminate. The parent context will be canceled before the
+	// handler terminates so any blocked Send or Recv on either stream should
+	// terminate quickly.
+	for range 2 {
+		select {
+		case <-ctx.Done():
+			err := context.Cause(ctx)
+			if errors.Is(err, context.Canceled) {
+				// A normal context.Canceled is expected when the client cleanly
+				// disconnects, no need to log or return it.
+				return nil
+			}
+			log.LogAttrs(ctx, slog.LevelWarn, "Forwarded join request canceled",
+				slog.Any("error", err),
+				slog.String("remote_addr", peerInfo.remoteAddr),
+				slog.String("client_version", peerInfo.clientVersion))
+			return trace.Wrap(err)
+		case err := <-errs:
+			if err != nil {
+				log.LogAttrs(ctx, slog.LevelWarn, "Forwarded join request failed",
+					slog.Any("error", err),
+					slog.String("remote_addr", peerInfo.remoteAddr),
+					slog.String("client_version", peerInfo.clientVersion))
+				return trace.Wrap(err)
+			}
+		}
+	}
+	return nil
+}
+
+func (s *forwardingServer) forwardRequests(
+	serverStream grpc.BidiStreamingServer[joinv1.JoinRequest, joinv1.JoinResponse],
+	clientStream grpc.BidiStreamingClient[joinv1.JoinRequest, joinv1.JoinResponse],
+	proxySuppliedParams *joinv1.ClientInit_ProxySuppliedParams,
+) error {
+	for {
+		req, err := serverStream.Recv()
+		if errors.Is(err, io.EOF) {
+			return trace.Wrap(clientStream.CloseSend())
+		}
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if _, ok := req.Payload.(*joinv1.JoinRequest_ClientInit); ok {
+			clientInit := req.Payload.(*joinv1.JoinRequest_ClientInit).ClientInit
+			clientInit.ForwardedByProxy = true
+			clientInit.ProxySuppliedParameters = proxySuppliedParams
+		}
+		if err := clientStream.Send(req); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+}
+
+func (s *forwardingServer) forwardResponses(
+	serverStream grpc.BidiStreamingServer[joinv1.JoinRequest, joinv1.JoinResponse],
+	clientStream grpc.BidiStreamingClient[joinv1.JoinRequest, joinv1.JoinResponse],
+) error {
+	for {
+		resp, err := clientStream.Recv()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if err := serverStream.Send(resp); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+}
diff --git a/lib/join/joinv1/messages.go b/lib/join/joinv1/messages.go
new file mode 100644
index 0000000000000..a4649a366f975
--- /dev/null
+++ b/lib/join/joinv1/messages.go
@@ -0,0 +1,604 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+// requestToMessage converts a gRPC JoinRequest into a protocol-agnostic [messages.Request].
+func requestToMessage(req *joinv1.JoinRequest) (messages.Request, error) {
+	switch msg := req.GetPayload().(type) {
+	case *joinv1.JoinRequest_ClientInit:
+		return clientInitToMessage(msg.ClientInit), nil
+	case *joinv1.JoinRequest_TokenInit:
+		return tokenInitToMessage(msg.TokenInit)
+	case *joinv1.JoinRequest_BoundKeypairInit:
+		return boundKeypairInitToMessage(msg.BoundKeypairInit)
+	case *joinv1.JoinRequest_IamInit:
+		return iamInitToMessage(msg.IamInit)
+	case *joinv1.JoinRequest_Ec2Init:
+		return ec2InitToMessage(msg.Ec2Init)
+	case *joinv1.JoinRequest_OidcInit:
+		return oidcInitToMessage(msg.OidcInit)
+	case *joinv1.JoinRequest_OracleInit:
+		return oracleInitToMessage(msg.OracleInit)
+	case *joinv1.JoinRequest_TpmInit:
+		return tpmInitToMessage(msg.TpmInit)
+	case *joinv1.JoinRequest_AzureInit:
+		return azureInitToMessage(msg.AzureInit)
+	case *joinv1.JoinRequest_Solution:
+		return challengeSolutionToMessage(msg.Solution)
+	case *joinv1.JoinRequest_GivingUp:
+		return givingUpToMessage(msg.GivingUp), nil
+	default:
+		return nil, trace.BadParameter("unrecognized join request message type %T", msg)
+	}
+}
+
+// requestFromMessage converts a [messages.Request] into a
+// [*joinv1.JoinRequest] to be sent over gRPC.
+func requestFromMessage(msg messages.Request) (*joinv1.JoinRequest, error) {
+	switch typedMsg := msg.(type) {
+	case *messages.ClientInit:
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_ClientInit{
+				ClientInit: clientInitFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.TokenInit:
+		tokenInit, err := tokenInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_TokenInit{
+				TokenInit: tokenInit,
+			},
+		}, nil
+	case *messages.BoundKeypairInit:
+		boundKeypairInit, err := boundKeypairInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_BoundKeypairInit{
+				BoundKeypairInit: boundKeypairInit,
+			},
+		}, nil
+	case *messages.IAMInit:
+		iamInit, err := iamInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_IamInit{
+				IamInit: iamInit,
+			},
+		}, nil
+	case *messages.EC2Init:
+		ec2Init, err := ec2InitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_Ec2Init{
+				Ec2Init: ec2Init,
+			},
+		}, nil
+	case *messages.OIDCInit:
+		oidcInit, err := oidcInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_OidcInit{
+				OidcInit: oidcInit,
+			},
+		}, nil
+	case *messages.OracleInit:
+		oracleInit, err := oracleInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_OracleInit{
+				OracleInit: oracleInit,
+			},
+		}, nil
+	case *messages.TPMInit:
+		tpmInit, err := tpmInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_TpmInit{
+				TpmInit: tpmInit,
+			},
+		}, nil
+	case *messages.AzureInit:
+		azureInit, err := azureInitFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_AzureInit{
+				AzureInit: azureInit,
+			},
+		}, nil
+	case *messages.BoundKeypairChallengeSolution,
+		*messages.BoundKeypairRotationResponse,
+		*messages.IAMChallengeSolution,
+		*messages.OracleChallengeSolution,
+		*messages.TPMSolution,
+		*messages.AzureChallengeSolution:
+		solution, err := challengeSolutionFromMessage(typedMsg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_Solution{
+				Solution: solution,
+			},
+		}, nil
+	case *messages.GivingUp:
+		return &joinv1.JoinRequest{
+			Payload: &joinv1.JoinRequest_GivingUp{
+				GivingUp: givingUpFromMessage(typedMsg),
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("unrecognized join request message type %T", msg)
+	}
+}
+
+func clientInitToMessage(req *joinv1.ClientInit) *messages.ClientInit {
+	msg := &messages.ClientInit{
+		TokenName:        req.GetTokenName(),
+		SystemRole:       req.GetSystemRole(),
+		ForwardedByProxy: req.GetForwardedByProxy(),
+	}
+	if joinMethod := req.GetJoinMethod(); joinMethod != "" {
+		msg.JoinMethod = &joinMethod
+	}
+	if proxySuppliedParams := req.GetProxySuppliedParameters(); proxySuppliedParams != nil {
+		msg.ProxySuppliedParams = &messages.ProxySuppliedParams{
+			RemoteAddr:    proxySuppliedParams.GetRemoteAddr(),
+			ClientVersion: proxySuppliedParams.GetClientVersion(),
+		}
+	}
+	return msg
+}
+
+func clientInitFromMessage(msg *messages.ClientInit) *joinv1.ClientInit {
+	req := &joinv1.ClientInit{
+		JoinMethod:       msg.JoinMethod,
+		TokenName:        msg.TokenName,
+		SystemRole:       msg.SystemRole,
+		ForwardedByProxy: msg.ForwardedByProxy,
+	}
+	if proxySuppliedParams := msg.ProxySuppliedParams; proxySuppliedParams != nil {
+		req.ProxySuppliedParameters = &joinv1.ClientInit_ProxySuppliedParams{
+			RemoteAddr:    proxySuppliedParams.RemoteAddr,
+			ClientVersion: proxySuppliedParams.ClientVersion,
+		}
+	}
+	return req
+}
+
+func tokenInitToMessage(req *joinv1.TokenInit) (*messages.TokenInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.TokenInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func tokenInitFromMessage(msg *messages.TokenInit) (*joinv1.TokenInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.TokenInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func clientParamsToMessage(req *joinv1.ClientParams) (messages.ClientParams, error) {
+	var msg messages.ClientParams
+	switch payload := req.GetPayload().(type) {
+	case *joinv1.ClientParams_HostParams:
+		msg.HostParams = hostParamsToMessage(payload.HostParams)
+	case *joinv1.ClientParams_BotParams:
+		msg.BotParams = botParamsToMessage(payload.BotParams)
+	default:
+		return msg, trace.BadParameter("unrecognized ClientParams payload type %T", payload)
+	}
+	return msg, nil
+}
+
+func clientParamsFromMessage(msg messages.ClientParams) (*joinv1.ClientParams, error) {
+	req := &joinv1.ClientParams{}
+	switch {
+	case msg.HostParams != nil:
+		req.Payload = &joinv1.ClientParams_HostParams{
+			HostParams: hostParamsFromMessage(msg.HostParams),
+		}
+	case msg.BotParams != nil:
+		req.Payload = &joinv1.ClientParams_BotParams{
+			BotParams: botParamsFromMessage(msg.BotParams),
+		}
+	default:
+		return nil, trace.BadParameter("ClientParams has no payload")
+	}
+	return req, nil
+}
+
+func hostParamsToMessage(req *joinv1.HostParams) *messages.HostParams {
+	return &messages.HostParams{
+		PublicKeys:           publicKeysToMessage(req.GetPublicKeys()),
+		HostName:             req.GetHostName(),
+		AdditionalPrincipals: req.GetAdditionalPrincipals(),
+		DNSNames:             req.GetDnsNames(),
+	}
+}
+
+func hostParamsFromMessage(msg *messages.HostParams) *joinv1.HostParams {
+	return &joinv1.HostParams{
+		PublicKeys:           publicKeysFromMessage(msg.PublicKeys),
+		HostName:             msg.HostName,
+		AdditionalPrincipals: msg.AdditionalPrincipals,
+		DnsNames:             msg.DNSNames,
+	}
+}
+
+func botParamsToMessage(req *joinv1.BotParams) *messages.BotParams {
+	msg := &messages.BotParams{
+		PublicKeys: publicKeysToMessage(req.GetPublicKeys()),
+	}
+	if req.Expires != nil {
+		expires := req.GetExpires().AsTime()
+		msg.Expires = &expires
+	}
+	return msg
+}
+
+func botParamsFromMessage(msg *messages.BotParams) *joinv1.BotParams {
+	req := &joinv1.BotParams{
+		PublicKeys: publicKeysFromMessage(msg.PublicKeys),
+	}
+	if msg.Expires != nil {
+		req.Expires = timestamppb.New(*msg.Expires)
+	}
+	return req
+}
+
+func publicKeysToMessage(req *joinv1.PublicKeys) messages.PublicKeys {
+	return messages.PublicKeys{
+		PublicTLSKey: req.GetPublicTlsKey(),
+		PublicSSHKey: req.GetPublicSshKey(),
+	}
+}
+
+func publicKeysFromMessage(msg messages.PublicKeys) *joinv1.PublicKeys {
+	return &joinv1.PublicKeys{
+		PublicTlsKey: msg.PublicTLSKey,
+		PublicSshKey: msg.PublicSSHKey,
+	}
+}
+
+func challengeSolutionToMessage(req *joinv1.ChallengeSolution) (messages.Request, error) {
+	switch payload := req.GetPayload().(type) {
+	case *joinv1.ChallengeSolution_BoundKeypairChallengeSolution:
+		return boundKeypairChallengeSolutionToMessage(payload.BoundKeypairChallengeSolution), nil
+	case *joinv1.ChallengeSolution_BoundKeypairRotationResponse:
+		return boundKeypairRotationResponseToMessage(payload.BoundKeypairRotationResponse), nil
+	case *joinv1.ChallengeSolution_IamChallengeSolution:
+		return iamChallengeSolutionToMessage(payload.IamChallengeSolution), nil
+	case *joinv1.ChallengeSolution_OracleChallengeSolution:
+		return oracleChallengeSolutionToMessage(payload.OracleChallengeSolution), nil
+	case *joinv1.ChallengeSolution_TpmSolution:
+		return tpmSolutionToMessage(payload.TpmSolution), nil
+	case *joinv1.ChallengeSolution_AzureChallengeSolution:
+		return azureChallengeSolutionToMessage(payload.AzureChallengeSolution), nil
+	default:
+		return nil, trace.BadParameter("unrecognized challenge solution message type %T", payload)
+	}
+}
+
+func challengeSolutionFromMessage(msg messages.Request) (*joinv1.ChallengeSolution, error) {
+	switch typedMsg := msg.(type) {
+	case *messages.BoundKeypairChallengeSolution:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_BoundKeypairChallengeSolution{
+				BoundKeypairChallengeSolution: boundKeypairChallengeSolutionFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.BoundKeypairRotationResponse:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_BoundKeypairRotationResponse{
+				BoundKeypairRotationResponse: boundKeypairRotationResponseFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.IAMChallengeSolution:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_IamChallengeSolution{
+				IamChallengeSolution: iamChallengeSolutionFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.OracleChallengeSolution:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_OracleChallengeSolution{
+				OracleChallengeSolution: oracleChallengeSolutionFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.TPMSolution:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_TpmSolution{
+				TpmSolution: tpmSolutionFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.AzureChallengeSolution:
+		return &joinv1.ChallengeSolution{
+			Payload: &joinv1.ChallengeSolution_AzureChallengeSolution{
+				AzureChallengeSolution: azureChallengeSolutionFromMessage(typedMsg),
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("unrecognized challenge solution message type %T", msg)
+	}
+}
+
+// responseToMessage converts a gRPC JoinResponse into a protocol-agnostic [messages.Response].
+func responseToMessage(resp *joinv1.JoinResponse) (messages.Response, error) {
+	switch typedResp := resp.GetPayload().(type) {
+	case *joinv1.JoinResponse_Init:
+		return serverInitToMessage(typedResp.Init)
+	case *joinv1.JoinResponse_Challenge:
+		return challengeToMessage(typedResp.Challenge)
+	case *joinv1.JoinResponse_Result:
+		return resultToMessage(typedResp.Result)
+	default:
+		return nil, trace.BadParameter("unrecognized join response message type %T", typedResp)
+	}
+}
+
+// responseFromMessage converts a [messages.Response] into a
+// [*joinv1.JoinResponse] to be sent over gRPC.
+func responseFromMessage(msg messages.Response) (*joinv1.JoinResponse, error) {
+	switch typedMsg := msg.(type) {
+	case *messages.ServerInit:
+		return &joinv1.JoinResponse{
+			Payload: &joinv1.JoinResponse_Init{
+				Init: serverInitFromMessage(typedMsg),
+			},
+		}, nil
+	case *messages.BoundKeypairChallenge,
+		*messages.BoundKeypairRotationRequest,
+		*messages.IAMChallenge,
+		*messages.OracleChallenge,
+		*messages.TPMEncryptedCredential,
+		*messages.AzureChallenge:
+		challenge, err := challengeFromMessage(msg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &joinv1.JoinResponse{
+			Payload: &joinv1.JoinResponse_Challenge{
+				Challenge: challenge,
+			},
+		}, nil
+	case *messages.HostResult:
+		return &joinv1.JoinResponse{
+			Payload: &joinv1.JoinResponse_Result{
+				Result: &joinv1.Result{
+					Payload: &joinv1.Result_HostResult{
+						HostResult: hostResultFromMessage(typedMsg),
+					},
+				},
+			},
+		}, nil
+	case *messages.BotResult:
+		return &joinv1.JoinResponse{
+			Payload: &joinv1.JoinResponse_Result{
+				Result: &joinv1.Result{
+					Payload: &joinv1.Result_BotResult{
+						BotResult: botResultFromMessage(typedMsg),
+					},
+				},
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("unrecognized join response message type %T", msg)
+	}
+}
+
+func serverInitToMessage(resp *joinv1.ServerInit) (*messages.ServerInit, error) {
+	sas, err := types.SignatureAlgorithmSuiteFromString(resp.GetSignatureAlgorithmSuite())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.ServerInit{
+		JoinMethod:              resp.GetJoinMethod(),
+		SignatureAlgorithmSuite: sas,
+	}, nil
+}
+
+func serverInitFromMessage(msg *messages.ServerInit) *joinv1.ServerInit {
+	return &joinv1.ServerInit{
+		JoinMethod:              msg.JoinMethod,
+		SignatureAlgorithmSuite: types.SignatureAlgorithmSuiteToString(msg.SignatureAlgorithmSuite),
+	}
+}
+
+func challengeToMessage(resp *joinv1.Challenge) (messages.Response, error) {
+	switch payload := resp.GetPayload().(type) {
+	case *joinv1.Challenge_BoundKeypairChallenge:
+		return boundKeypairChallengeToMessage(payload.BoundKeypairChallenge), nil
+	case *joinv1.Challenge_BoundKeypairRotationRequest:
+		return boundKeypairRotationRequestToMessage(payload.BoundKeypairRotationRequest), nil
+	case *joinv1.Challenge_IamChallenge:
+		return iamChallengeToMessage(payload.IamChallenge), nil
+	case *joinv1.Challenge_OracleChallenge:
+		return oracleChallengeToMessage(payload.OracleChallenge), nil
+	case *joinv1.Challenge_TpmEncryptedCredential:
+		return tpmEncryptedCredentialToMessage(payload.TpmEncryptedCredential), nil
+	case *joinv1.Challenge_AzureChallenge:
+		return azureChallengeToMessage(payload.AzureChallenge), nil
+	default:
+		return nil, trace.BadParameter("unrecognized challenge payload type %T", payload)
+	}
+}
+
+func challengeFromMessage(resp messages.Response) (*joinv1.Challenge, error) {
+	switch msg := resp.(type) {
+	case *messages.BoundKeypairChallenge:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_BoundKeypairChallenge{
+				BoundKeypairChallenge: boundKeypairChallengeFromMessage(msg),
+			},
+		}, nil
+	case *messages.BoundKeypairRotationRequest:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_BoundKeypairRotationRequest{
+				BoundKeypairRotationRequest: boundKeypairRotationRequestFromMessage(msg),
+			},
+		}, nil
+	case *messages.IAMChallenge:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_IamChallenge{
+				IamChallenge: iamChallengeFromMessage(msg),
+			},
+		}, nil
+	case *messages.OracleChallenge:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_OracleChallenge{
+				OracleChallenge: oracleChallengeFromMessage(msg),
+			},
+		}, nil
+	case *messages.TPMEncryptedCredential:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_TpmEncryptedCredential{
+				TpmEncryptedCredential: tpmEncryptedCredentialFromMessage(msg),
+			},
+		}, nil
+	case *messages.AzureChallenge:
+		return &joinv1.Challenge{
+			Payload: &joinv1.Challenge_AzureChallenge{
+				AzureChallenge: azureChallengeFromMessage(msg),
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("unrecognized challenge message type %T", msg)
+	}
+}
+
+func resultToMessage(resp *joinv1.Result) (messages.Response, error) {
+	switch payload := resp.GetPayload().(type) {
+	case *joinv1.Result_HostResult:
+		return hostResultToMessage(payload.HostResult), nil
+	case *joinv1.Result_BotResult:
+		return botResultToMessage(payload.BotResult), nil
+	default:
+		return nil, trace.BadParameter("unrecognized result payload type %T", payload)
+	}
+}
+
+func hostResultToMessage(resp *joinv1.HostResult) *messages.HostResult {
+	return &messages.HostResult{
+		Certificates: certificatesToMessage(resp.GetCertificates()),
+		HostID:       resp.GetHostId(),
+	}
+}
+
+func hostResultFromMessage(msg *messages.HostResult) *joinv1.HostResult {
+	return &joinv1.HostResult{
+		Certificates: certificatesFromMessage(&msg.Certificates),
+		HostId:       msg.HostID,
+	}
+}
+
+func botResultToMessage(resp *joinv1.BotResult) *messages.BotResult {
+	return &messages.BotResult{
+		Certificates:       certificatesToMessage(resp.GetCertificates()),
+		BoundKeypairResult: boundKeypairResultToMessage(resp.GetBoundKeypairResult()),
+	}
+}
+
+func botResultFromMessage(msg *messages.BotResult) *joinv1.BotResult {
+	return &joinv1.BotResult{
+		Certificates:       certificatesFromMessage(&msg.Certificates),
+		BoundKeypairResult: boundKeypairResultFromMessage(msg.BoundKeypairResult),
+	}
+}
+
+func certificatesToMessage(certs *joinv1.Certificates) messages.Certificates {
+	return messages.Certificates{
+		TLSCert:    certs.GetTlsCert(),
+		TLSCACerts: certs.GetTlsCaCerts(),
+		SSHCert:    certs.GetSshCert(),
+		SSHCAKeys:  certs.GetSshCaKeys(),
+	}
+}
+
+func certificatesFromMessage(certs *messages.Certificates) *joinv1.Certificates {
+	return &joinv1.Certificates{
+		TlsCert:    certs.TLSCert,
+		TlsCaCerts: certs.TLSCACerts,
+		SshCert:    certs.SSHCert,
+		SshCaKeys:  certs.SSHCAKeys,
+	}
+}
+
+func givingUpToMessage(req *joinv1.GivingUp) *messages.GivingUp {
+	reason := messages.GivingUpReasonUnspecified
+	switch req.GetReason() {
+	case joinv1.GivingUp_REASON_UNSUPPORTED_JOIN_METHOD:
+		reason = messages.GivingUpReasonUnsupportedJoinMethod
+	case joinv1.GivingUp_REASON_UNSUPPORTED_MESSAGE_TYPE:
+		reason = messages.GivingUpReasonUnsupportedMessageType
+	case joinv1.GivingUp_REASON_CHALLENGE_SOLUTION_FAILED:
+		reason = messages.GivingUpReasonChallengeSolutionFailed
+	}
+	return &messages.GivingUp{
+		Reason: reason,
+		Msg:    req.GetMsg(),
+	}
+}
+
+func givingUpFromMessage(msg *messages.GivingUp) *joinv1.GivingUp {
+	reason := joinv1.GivingUp_REASON_UNSPECIFIED
+	switch msg.Reason {
+	case messages.GivingUpReasonUnsupportedJoinMethod:
+		reason = joinv1.GivingUp_REASON_UNSUPPORTED_JOIN_METHOD
+	case messages.GivingUpReasonUnsupportedMessageType:
+		reason = joinv1.GivingUp_REASON_UNSUPPORTED_MESSAGE_TYPE
+	case messages.GivingUpReasonChallengeSolutionFailed:
+		reason = joinv1.GivingUp_REASON_CHALLENGE_SOLUTION_FAILED
+	}
+	return &joinv1.GivingUp{
+		Reason: reason,
+		Msg:    msg.Msg,
+	}
+}
diff --git a/lib/join/joinv1/messages_azure.go b/lib/join/joinv1/messages_azure.go
new file mode 100644
index 0000000000000..8fa1872e6b8c4
--- /dev/null
+++ b/lib/join/joinv1/messages_azure.go
@@ -0,0 +1,72 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func azureInitToMessage(req *joinv1.AzureInit) (*messages.AzureInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.AzureInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func azureInitFromMessage(msg *messages.AzureInit) (*joinv1.AzureInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.AzureInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func azureChallengeToMessage(req *joinv1.AzureChallenge) *messages.AzureChallenge {
+	return &messages.AzureChallenge{
+		Challenge: req.GetChallenge(),
+	}
+}
+
+func azureChallengeFromMessage(msg *messages.AzureChallenge) *joinv1.AzureChallenge {
+	return &joinv1.AzureChallenge{
+		Challenge: msg.Challenge,
+	}
+}
+
+func azureChallengeSolutionToMessage(req *joinv1.AzureChallengeSolution) *messages.AzureChallengeSolution {
+	return &messages.AzureChallengeSolution{
+		AttestedData: req.GetAttestedData(),
+		Intermediate: req.GetIntermediate(),
+		AccessToken:  req.GetAccessToken(),
+	}
+}
+
+func azureChallengeSolutionFromMessage(msg *messages.AzureChallengeSolution) *joinv1.AzureChallengeSolution {
+	return &joinv1.AzureChallengeSolution{
+		AttestedData: msg.AttestedData,
+		Intermediate: msg.Intermediate,
+		AccessToken:  msg.AccessToken,
+	}
+}
diff --git a/lib/join/joinv1/messages_boundkeypair.go b/lib/join/joinv1/messages_boundkeypair.go
new file mode 100644
index 0000000000000..10a28dad6dfdb
--- /dev/null
+++ b/lib/join/joinv1/messages_boundkeypair.go
@@ -0,0 +1,118 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func boundKeypairInitToMessage(req *joinv1.BoundKeypairInit) (*messages.BoundKeypairInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.BoundKeypairInit{
+		ClientParams:      clientParams,
+		InitialJoinSecret: req.GetInitialJoinSecret(),
+		PreviousJoinState: req.GetPreviousJoinState(),
+	}, nil
+}
+
+func boundKeypairInitFromMessage(msg *messages.BoundKeypairInit) (*joinv1.BoundKeypairInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.BoundKeypairInit{
+		ClientParams:      clientParams,
+		InitialJoinSecret: msg.InitialJoinSecret,
+		PreviousJoinState: msg.PreviousJoinState,
+	}, nil
+}
+
+func boundKeypairChallengeToMessage(resp *joinv1.BoundKeypairChallenge) *messages.BoundKeypairChallenge {
+	return &messages.BoundKeypairChallenge{
+		PublicKey: resp.GetPublicKey(),
+		Challenge: resp.GetChallenge(),
+	}
+}
+
+func boundKeypairChallengeFromMessage(msg *messages.BoundKeypairChallenge) *joinv1.BoundKeypairChallenge {
+	return &joinv1.BoundKeypairChallenge{
+		PublicKey: msg.PublicKey,
+		Challenge: msg.Challenge,
+	}
+}
+
+func boundKeypairChallengeSolutionToMessage(req *joinv1.BoundKeypairChallengeSolution) *messages.BoundKeypairChallengeSolution {
+	return &messages.BoundKeypairChallengeSolution{
+		Solution: req.GetSolution(),
+	}
+}
+
+func boundKeypairRotationRequestToMessage(resp *joinv1.BoundKeypairRotationRequest) *messages.BoundKeypairRotationRequest {
+	return &messages.BoundKeypairRotationRequest{
+		SignatureAlgorithmSuite: resp.GetSignatureAlgorithmSuite(),
+	}
+}
+
+func boundKeypairRotationRequestFromMessage(resp *messages.BoundKeypairRotationRequest) *joinv1.BoundKeypairRotationRequest {
+	return &joinv1.BoundKeypairRotationRequest{
+		SignatureAlgorithmSuite: resp.SignatureAlgorithmSuite,
+	}
+}
+
+func boundKeypairChallengeSolutionFromMessage(msg *messages.BoundKeypairChallengeSolution) *joinv1.BoundKeypairChallengeSolution {
+	return &joinv1.BoundKeypairChallengeSolution{
+		Solution: msg.Solution,
+	}
+}
+
+func boundKeypairRotationResponseToMessage(req *joinv1.BoundKeypairRotationResponse) *messages.BoundKeypairRotationResponse {
+	return &messages.BoundKeypairRotationResponse{
+		PublicKey: req.GetPublicKey(),
+	}
+}
+
+func boundKeypairRotationResponseFromMessage(msg *messages.BoundKeypairRotationResponse) *joinv1.BoundKeypairRotationResponse {
+	return &joinv1.BoundKeypairRotationResponse{
+		PublicKey: msg.PublicKey,
+	}
+}
+
+func boundKeypairResultToMessage(req *joinv1.BoundKeypairResult) *messages.BoundKeypairResult {
+	if req == nil {
+		return nil
+	}
+	return &messages.BoundKeypairResult{
+		JoinState: req.GetJoinState(),
+		PublicKey: req.GetPublicKey(),
+	}
+}
+
+func boundKeypairResultFromMessage(msg *messages.BoundKeypairResult) *joinv1.BoundKeypairResult {
+	if msg == nil {
+		return nil
+	}
+	return &joinv1.BoundKeypairResult{
+		JoinState: msg.JoinState,
+		PublicKey: msg.PublicKey,
+	}
+}
diff --git a/lib/join/joinv1/messages_ec2.go b/lib/join/joinv1/messages_ec2.go
new file mode 100644
index 0000000000000..2f7280f4a39de
--- /dev/null
+++ b/lib/join/joinv1/messages_ec2.go
@@ -0,0 +1,46 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func ec2InitToMessage(req *joinv1.EC2Init) (*messages.EC2Init, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.EC2Init{
+		ClientParams: clientParams,
+		Document:     req.GetDocument(),
+	}, nil
+}
+
+func ec2InitFromMessage(msg *messages.EC2Init) (*joinv1.EC2Init, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.EC2Init{
+		ClientParams: clientParams,
+		Document:     msg.Document,
+	}, nil
+}
diff --git a/lib/join/joinv1/messages_iam.go b/lib/join/joinv1/messages_iam.go
new file mode 100644
index 0000000000000..641b6f31fe1c3
--- /dev/null
+++ b/lib/join/joinv1/messages_iam.go
@@ -0,0 +1,68 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func iamInitToMessage(req *joinv1.IAMInit) (*messages.IAMInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.IAMInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func iamInitFromMessage(msg *messages.IAMInit) (*joinv1.IAMInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.IAMInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func iamChallengeToMessage(req *joinv1.IAMChallenge) *messages.IAMChallenge {
+	return &messages.IAMChallenge{
+		Challenge: req.GetChallenge(),
+	}
+}
+
+func iamChallengeFromMessage(msg *messages.IAMChallenge) *joinv1.IAMChallenge {
+	return &joinv1.IAMChallenge{
+		Challenge: msg.Challenge,
+	}
+}
+
+func iamChallengeSolutionToMessage(req *joinv1.IAMChallengeSolution) *messages.IAMChallengeSolution {
+	return &messages.IAMChallengeSolution{
+		STSIdentityRequest: req.GetStsIdentityRequest(),
+	}
+}
+
+func iamChallengeSolutionFromMessage(msg *messages.IAMChallengeSolution) *joinv1.IAMChallengeSolution {
+	return &joinv1.IAMChallengeSolution{
+		StsIdentityRequest: msg.STSIdentityRequest,
+	}
+}
diff --git a/lib/join/joinv1/messages_oidc.go b/lib/join/joinv1/messages_oidc.go
new file mode 100644
index 0000000000000..044f4a65939ce
--- /dev/null
+++ b/lib/join/joinv1/messages_oidc.go
@@ -0,0 +1,46 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func oidcInitToMessage(req *joinv1.OIDCInit) (*messages.OIDCInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.OIDCInit{
+		ClientParams: clientParams,
+		IDToken:      req.GetIdToken(),
+	}, nil
+}
+
+func oidcInitFromMessage(msg *messages.OIDCInit) (*joinv1.OIDCInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.OIDCInit{
+		ClientParams: clientParams,
+		IdToken:      msg.IDToken,
+	}, nil
+}
diff --git a/lib/join/joinv1/messages_oracle.go b/lib/join/joinv1/messages_oracle.go
new file mode 100644
index 0000000000000..3dad4998f4a59
--- /dev/null
+++ b/lib/join/joinv1/messages_oracle.go
@@ -0,0 +1,74 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func oracleInitToMessage(req *joinv1.OracleInit) (*messages.OracleInit, error) {
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.OracleInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func oracleInitFromMessage(msg *messages.OracleInit) (*joinv1.OracleInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joinv1.OracleInit{
+		ClientParams: clientParams,
+	}, nil
+}
+
+func oracleChallengeToMessage(req *joinv1.OracleChallenge) *messages.OracleChallenge {
+	return &messages.OracleChallenge{
+		Challenge: req.GetChallenge(),
+	}
+}
+
+func oracleChallengeFromMessage(msg *messages.OracleChallenge) *joinv1.OracleChallenge {
+	return &joinv1.OracleChallenge{
+		Challenge: msg.Challenge,
+	}
+}
+
+func oracleChallengeSolutionToMessage(req *joinv1.OracleChallengeSolution) *messages.OracleChallengeSolution {
+	return &messages.OracleChallengeSolution{
+		Cert:            req.GetCert(),
+		Intermediate:    req.GetIntermediate(),
+		Signature:       req.GetSignature(),
+		SignedRootCAReq: req.GetSignedRootCaReq(),
+	}
+}
+
+func oracleChallengeSolutionFromMessage(msg *messages.OracleChallengeSolution) *joinv1.OracleChallengeSolution {
+	return &joinv1.OracleChallengeSolution{
+		Cert:            msg.Cert,
+		Intermediate:    msg.Intermediate,
+		Signature:       msg.Signature,
+		SignedRootCaReq: msg.SignedRootCAReq,
+	}
+}
diff --git a/lib/join/joinv1/messages_test.go b/lib/join/joinv1/messages_test.go
new file mode 100644
index 0000000000000..3b0999ab091f4
--- /dev/null
+++ b/lib/join/joinv1/messages_test.go
@@ -0,0 +1,210 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+)
+
+// TestRequestToMessage tests that parsing a gRPC [joinv1.JoinRequest] into a
+// [messages.Request] does not trigger a panic on the server. These gRPC
+// requests come in over the network from untrusted clients.
+func TestRequestToMessage(t *testing.T) {
+	for _, tc := range []struct {
+		desc string
+		req  *joinv1.JoinRequest
+	}{
+		{
+			desc: "nil req",
+		},
+		{
+			desc: "nil payload",
+			req:  &joinv1.JoinRequest{},
+		},
+		{
+			desc: "empty ClientInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_ClientInit{},
+			},
+		},
+		{
+			desc: "empty TokenInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_TokenInit{},
+			},
+		},
+		{
+			desc: "empty BoundKeypairInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_BoundKeypairInit{},
+			},
+		},
+		{
+			desc: "empty IAMInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_IamInit{},
+			},
+		},
+		{
+			desc: "empty EC2Init",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Ec2Init{},
+			},
+		},
+		{
+			desc: "empty OIDCInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_OidcInit{},
+			},
+		},
+		{
+			desc: "empty OracleInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_OracleInit{},
+			},
+		},
+		{
+			desc: "empty TpmInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_TpmInit{},
+			},
+		},
+		{
+			desc: "empty AzureInit",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_AzureInit{},
+			},
+		},
+		{
+			desc: "empty HostParams",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_TokenInit{
+					TokenInit: &joinv1.TokenInit{
+						ClientParams: &joinv1.ClientParams{
+							Payload: &joinv1.ClientParams_HostParams{},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty BotParams",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_TokenInit{
+					TokenInit: &joinv1.TokenInit{
+						ClientParams: &joinv1.ClientParams{
+							Payload: &joinv1.ClientParams_BotParams{},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty Solution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{},
+			},
+		},
+		{
+			desc: "empty BoundKeypairChallengeSolution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_BoundKeypairChallengeSolution{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty BoundKeypairRotationResponse",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_BoundKeypairRotationResponse{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty IamChallengeSolution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_IamChallengeSolution{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty OracleChallengeSolution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_OracleChallengeSolution{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty TpmSolution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_TpmSolution{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty AzureSolution",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_Solution{
+					Solution: &joinv1.ChallengeSolution{
+						Payload: &joinv1.ChallengeSolution_AzureChallengeSolution{},
+					},
+				},
+			},
+		},
+		{
+			desc: "empty GivingUp",
+			req: &joinv1.JoinRequest{
+				Payload: &joinv1.JoinRequest_GivingUp{},
+			},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			// Put the request through a marshal/unmarshal to more closely
+			// model a request that could actually come in over the network.
+			// For example, in unmarshalled messages, the inner pointer of a
+			// oneof can never be nil.
+			buf, err := proto.Marshal(tc.req)
+			require.NoError(t, err)
+			var req joinv1.JoinRequest
+			err = proto.Unmarshal(buf, &req)
+			require.NoError(t, err)
+
+			require.NotPanics(t, func() {
+				_, _ = requestToMessage(&req)
+			})
+		})
+	}
+}
diff --git a/lib/join/joinv1/messages_tpm.go b/lib/join/joinv1/messages_tpm.go
new file mode 100644
index 0000000000000..8b2c23ddaa307
--- /dev/null
+++ b/lib/join/joinv1/messages_tpm.go
@@ -0,0 +1,97 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"github.com/gravitational/trace"
+
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+)
+
+func tpmInitToMessage(req *joinv1.TPMInit) (*messages.TPMInit, error) {
+	clientParams, err := clientParamsToMessage(req.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.TPMInit{
+		ClientParams:      clientParams,
+		Public:            req.Public,
+		CreateData:        req.CreateData,
+		CreateAttestation: req.CreateAttestation,
+		CreateSignature:   req.CreateSignature,
+		EKCert:            req.GetEkCert(),
+		EKKey:             req.GetEkKey(),
+	}, nil
+}
+
+func tpmInitFromMessage(msg *messages.TPMInit) (*joinv1.TPMInit, error) {
+	clientParams, err := clientParamsFromMessage(msg.ClientParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	req := &joinv1.TPMInit{
+		ClientParams:      clientParams,
+		Public:            msg.Public,
+		CreateData:        msg.CreateData,
+		CreateAttestation: msg.CreateAttestation,
+		CreateSignature:   msg.CreateSignature,
+	}
+	var (
+		hasEKCert = len(msg.EKCert) > 0
+		hasEKKey  = len(msg.EKKey) > 0
+	)
+	switch {
+	case hasEKCert == hasEKKey:
+		return nil, trace.BadParameter("exactly one of EKCert and EKKey must be set")
+	case hasEKCert:
+		req.Ek = &joinv1.TPMInit_EkCert{
+			EkCert: msg.EKCert,
+		}
+	case hasEKKey:
+		req.Ek = &joinv1.TPMInit_EkKey{
+			EkKey: msg.EKKey,
+		}
+	}
+	return req, nil
+}
+
+func tpmEncryptedCredentialToMessage(req *joinv1.TPMEncryptedCredential) *messages.TPMEncryptedCredential {
+	return &messages.TPMEncryptedCredential{
+		CredentialBlob: req.CredentialBlob,
+		Secret:         req.Secret,
+	}
+}
+
+func tpmEncryptedCredentialFromMessage(msg *messages.TPMEncryptedCredential) *joinv1.TPMEncryptedCredential {
+	return &joinv1.TPMEncryptedCredential{
+		CredentialBlob: msg.CredentialBlob,
+		Secret:         msg.Secret,
+	}
+}
+
+func tpmSolutionToMessage(req *joinv1.TPMSolution) *messages.TPMSolution {
+	return &messages.TPMSolution{
+		Solution: req.Solution,
+	}
+}
+
+func tpmSolutionFromMessage(msg *messages.TPMSolution) *joinv1.TPMSolution {
+	return &joinv1.TPMSolution{
+		Solution: msg.Solution,
+	}
+}
diff --git a/lib/join/joinv1/server.go b/lib/join/joinv1/server.go
new file mode 100644
index 0000000000000..f225a2bbbe18b
--- /dev/null
+++ b/lib/join/joinv1/server.go
@@ -0,0 +1,161 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joinv1
+
+import (
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+	grpc "google.golang.org/grpc"
+	"google.golang.org/grpc/peer"
+
+	"github.com/gravitational/teleport"
+	joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
+	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "joinv1")
+
+// messageServer describes the protocol-agnostic join server, referenced in
+// this package as an interface so that it doesn't need to import lib/join.
+type messageServer interface {
+	Join(messages.ServerStream) error
+}
+
+// RegisterJoinServiceServer registers the Join gRPC service.
+func RegisterJoinServiceServer(s grpc.ServiceRegistrar, server messageServer) {
+	joinv1.RegisterJoinServiceServer(s, &joinServer{
+		server: server,
+	})
+}
+
+// joinServer is the gRPC implementation of the new Join service with
+// auth-assigned host UUIDs. This implementation is replacing
+// lib/join/legacyservice. It is a thin gRPC layer that converts gRPC messages
+// to [messages.Request] and [messages.Response] and passes the stream down to
+// the protocol-agnostic [join.Server].
+type joinServer struct {
+	joinv1.UnsafeJoinServiceServer
+
+	server messageServer
+}
+
+// Join is a bidirectional streaming RPC that implements all join methods.
+// The client does not need to know the join method ahead of time, all it
+// needs is the token name.
+//
+// The client must send an ClientInit message on the JoinRequest stream to
+// initiate the join flow.
+//
+// The server will reply with a JoinResponse where the payload will vary
+// based on the join method specified in the provision token.
+func (s *joinServer) Join(grpcStream grpc.BidiStreamingServer[joinv1.JoinRequest, joinv1.JoinResponse]) (err error) {
+	peerInfo, err := peerInfoFromContext(grpcStream.Context())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	diag := diagnostic.New()
+	diag.Set(func(i *diagnostic.Info) {
+		i.RemoteAddr = peerInfo.remoteAddr
+		i.ClientVersion = peerInfo.clientVersion
+	})
+	ctx, cancel := context.WithTimeoutCause(grpcStream.Context(), joinRequestTimeout,
+		trace.LimitExceeded(
+			"join attempt timed out after %s, terminating the stream on the server",
+			joinRequestTimeout,
+		))
+	defer cancel()
+	messageStream := &serverStream{
+		grpcStream: grpcStream,
+		ctx:        ctx,
+		diag:       diag,
+	}
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- trace.Wrap(s.server.Join(messageStream))
+	}()
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(context.Cause(ctx))
+	case err := <-errCh:
+		return trace.Wrap(err)
+	}
+}
+
+// serverStream wraps a [grpc.BidiStreamingServer] to implement
+// [messages.ServerStream].
+type serverStream struct {
+	grpcStream grpc.BidiStreamingServer[joinv1.JoinRequest, joinv1.JoinResponse]
+	ctx        context.Context
+	diag       *diagnostic.Diagnostic
+}
+
+// Context returns the stream context.
+func (s *serverStream) Context() context.Context {
+	return s.ctx
+}
+
+// Diagnostic returns a diagnostic for the join attempt.
+func (s *serverStream) Diagnostic() *diagnostic.Diagnostic {
+	return s.diag
+}
+
+// Send translates a [messages.Response] to a [joinv1.JoinResponse] and sends
+// it on the gRPC stream.
+func (s *serverStream) Send(msg messages.Response) error {
+	resp, err := responseFromMessage(msg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(s.grpcStream.Send(resp))
+}
+
+// Recv receives a [joinv1.JoinRequest] from the gRPC stream and translates it
+// to a [messages.Request] before returning it.
+func (s *serverStream) Recv() (messages.Request, error) {
+	req, err := s.grpcStream.Recv()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	msg, err := requestToMessage(req)
+	return msg, trace.Wrap(err)
+}
+
+type peerInfo struct {
+	remoteAddr    string
+	clientVersion string
+}
+
+func peerInfoFromContext(ctx context.Context) (peerInfo, error) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return peerInfo{}, trace.Errorf("could not get gRPC peer from context (this is a bug)")
+	}
+	remoteAddr := p.Addr.String()
+	if ip, _, err := net.SplitHostPort(remoteAddr); err == nil {
+		remoteAddr = ip
+	}
+	clientVersion, _ := metadata.ClientVersionFromContext(ctx)
+	return peerInfo{
+		remoteAddr:    remoteAddr,
+		clientVersion: clientVersion,
+	}, nil
+}
diff --git a/lib/joinserver/joinserver.go b/lib/join/legacyjoin/joinserver.go
similarity index 93%
rename from lib/joinserver/joinserver.go
rename to lib/join/legacyjoin/joinserver.go
index 1b5cc3467bc8b..719150d8247a0 100644
--- a/lib/joinserver/joinserver.go
+++ b/lib/join/legacyjoin/joinserver.go
@@ -16,15 +16,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-// Package joinserver contains the implementation of the JoinService gRPC server
-// which runs on both Auth and Proxy.
-package joinserver
+// Package legacyjoin contains the implementation of the legacy JoinService
+// gRPC server which runs on both Auth and Proxy.
+package legacyjoin
 
 import (
 	"context"
 	"log/slog"
 	"net"
+	"os"
 	"slices"
+	"strconv"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -38,6 +40,21 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
+// Disabled returns true if the legacy join service is disabled in this environment.
+func Disabled() bool {
+	disabledVar := os.Getenv("TELEPORT_UNSTABLE_NO_AGENT_ID_SELECTION")
+	// Some of our env variables support strconv.ParseBool, others "yes", this will handle both.
+	truthy, _ := strconv.ParseBool(disabledVar)
+	truthy = truthy || disabledVar == "yes"
+	return truthy
+}
+
+// ErrDisabled is an error that will be returned of all legacy join RPCs when
+// Disabled returns true.
+var ErrDisabled = &trace.AccessDeniedError{
+	Message: "legacy join service has been disabled in this environment",
+}
+
 const (
 	joinRequestTimeout = time.Minute
 )
@@ -66,12 +83,16 @@ type joinServiceClient interface {
 	) (*proto.Certs, error)
 }
 
-// JoinServiceGRPCServer implements proto.JoinServiceServer and is designed
-// to run on both the Teleport Proxy and Auth servers.
+// JoinServiceGRPCServer implements the legacy proto.JoinServiceServer and is
+// designed to run on both the Teleport Proxy and Auth servers.
 //
 // On the Proxy, this uses a gRPC client to forward the request to the Auth
 // server. On the Auth Server, this is passed to auth.ServerWithRoles and
 // through to auth.Server to be handled.
+//
+// This is being phased out in favor of lib/join/joinv1.Service, but it will
+// remain here for a while for backward compat (ETA pending until we figure out
+// an LTS strategy).
 type JoinServiceGRPCServer struct {
 	proto.UnimplementedJoinServiceServer
 
@@ -402,11 +423,6 @@ func (s *JoinServiceGRPCServer) registerUsingBoundKeypair(srv proto.JoinService_
 		return trace.BadParameter("expected non-nil Init payload")
 	}
 
-	if initReq.InitialJoinSecret != "" {
-		// TODO: not supported yet.
-		return trace.NotImplemented("initial join secrets are not yet supported")
-	}
-
 	if initReq.JoinRequest == nil {
 		return trace.BadParameter(
 			"expected JoinRequest in RegisterUsingBoundKeypairInitialRequest, got nil",
@@ -501,6 +517,6 @@ func (s *JoinServiceGRPCServer) handleStreamingRegistration(ctx context.Context,
 			joinMethod, joinRequestTimeout,
 		)
 	case <-ctx.Done():
-		return trace.Wrap(ctx.Err())
+		return trace.Wrap(context.Cause(ctx))
 	}
 }
diff --git a/lib/joinserver/joinserver_test.go b/lib/join/legacyjoin/joinserver_test.go
similarity index 99%
rename from lib/joinserver/joinserver_test.go
rename to lib/join/legacyjoin/joinserver_test.go
index 2934ed3e08a29..91aec94b82308 100644
--- a/lib/joinserver/joinserver_test.go
+++ b/lib/join/legacyjoin/joinserver_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package joinserver
+package legacyjoin
 
 import (
 	"context"
diff --git a/lib/join/oraclejoin/claims.go b/lib/join/oraclejoin/claims.go
new file mode 100644
index 0000000000000..2eb67d977a6cd
--- /dev/null
+++ b/lib/join/oraclejoin/claims.go
@@ -0,0 +1,51 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+)
+
+// Claims are the claims extracted from the instance certificate.
+type Claims struct {
+	// TenancyID is the ID of the instance's tenant.
+	TenancyID string `json:"tenant_id"`
+	// CompartmentID is the ID of the instance's compartment.
+	CompartmentID string `json:"compartment_id"`
+	// InstanceID is the instance's ID.
+	InstanceID string `json:"instance_id"`
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c Claims) JoinAttrs() *workloadidentityv1pb.JoinAttrsOracle {
+	return &workloadidentityv1pb.JoinAttrsOracle{
+		TenancyId:     c.TenancyID,
+		CompartmentId: c.CompartmentID,
+		InstanceId:    c.InstanceID,
+	}
+}
+
+// Region extracts the region from an instance's claims.
+func (c Claims) Region() string {
+	region, err := ParseRegionFromOCID(c.InstanceID)
+	if err != nil {
+		return ""
+	}
+	return region
+}
diff --git a/lib/join/oraclejoin/join_test.go b/lib/join/oraclejoin/join_test.go
new file mode 100644
index 0000000000000..3fa38efe9ce93
--- /dev/null
+++ b/lib/join/oraclejoin/join_test.go
@@ -0,0 +1,826 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"log/slog"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/join/joinclient/oracle"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
+)
+
+// TestJoinOracle tests the Oracle join method, with faked OCI IMDS and API servers.
+func TestJoinOracle(t *testing.T) {
+	t.Parallel()
+
+	imdsListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	fakeIMDS, err := newFakeIMDS()
+	require.NoError(t, err)
+
+	testutils.RunTestBackgroundTask(t.Context(), t, &testutils.TestBackgroundTask{
+		Name: "fake IMDS server",
+		Task: func(ctx context.Context) error {
+			err := fakeIMDS.serve(imdsListener)
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			return trace.Wrap(err)
+		},
+		Terminate: imdsListener.Close,
+	})
+
+	oracleAPIListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	fakeOracleAPI := newFakeOracleAPI(fakeIMDS.cas.caCertBase64)
+
+	testutils.RunTestBackgroundTask(t.Context(), t, &testutils.TestBackgroundTask{
+		Name: "fake Oracle API server",
+		Task: func(ctx context.Context) error {
+			err := fakeOracleAPI.serve(oracleAPIListener)
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			return trace.Wrap(err)
+		},
+		Terminate: oracleAPIListener.Close,
+	})
+
+	fakeOracleAPIClient, err := newFakeHTTPClient(oracleAPIListener.Addr())
+	require.NoError(t, err)
+
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+		TLS: &authtest.TLSServerConfig{
+			APIConfig: &auth.APIConfig{
+				OracleHTTPClient: fakeOracleAPIClient,
+			},
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, server.Shutdown(t.Context())) })
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	isAccessDenied := func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+		return assert.ErrorAs(t, err, new(*trace.AccessDeniedError), msgAndArgs...)
+	}
+
+	for _, tc := range []struct {
+		desc             string
+		claims           oraclejoin.Claims
+		allowRules       []*types.ProvisionTokenSpecV2Oracle_Rule
+		tokenName        string
+		requestTokenName string
+		instanceKeyAlg   cryptosuites.Algorithm
+		assertion        assert.ErrorAssertionFunc
+	}{
+		{
+			desc: "allow tenant",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{Tenancy: makeTenancyID("mytenant")},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        assert.NoError,
+		},
+		{
+			desc: "allow tenant,compartment",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        assert.NoError,
+		},
+		{
+			desc: "allow tenant,compartment,region",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+					Regions: []string{"otherregion", "phx"},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        assert.NoError,
+		},
+		{
+			desc: "allow tenant,compartment,region,instance",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+					Regions: []string{"otherregion", "phx"},
+					Instances: []string{
+						makeInstanceID("phx", "otherinstance"),
+						makeInstanceID("phx", "myinstance"),
+					},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        assert.NoError,
+		},
+		{
+			desc: "allow multiple rules",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("othertenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+					},
+				},
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        assert.NoError,
+		},
+		{
+			desc: "wrong token",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{Tenancy: makeTenancyID("mytenant")},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "badtoken",
+			assertion:        isAccessDenied,
+		},
+		{
+			desc: "wrong tenant",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("badtenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{Tenancy: makeTenancyID("mytenant")},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        isAccessDenied,
+		},
+		{
+			desc: "wrong compartment",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "myinstance"),
+				CompartmentID: makeCompartmentID("badcompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        isAccessDenied,
+		},
+		{
+			desc: "wrong region",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("badregion", "myinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+					Regions: []string{"otherregion", "phx"},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        isAccessDenied,
+		},
+		{
+			desc: "wrong instance",
+			claims: oraclejoin.Claims{
+				InstanceID:    makeInstanceID("phx", "badinstance"),
+				CompartmentID: makeCompartmentID("mycompartment"),
+				TenancyID:     makeTenancyID("mytenant"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("mytenant"),
+					ParentCompartments: []string{
+						makeCompartmentID("othercompartment"),
+						makeCompartmentID("mycompartment"),
+					},
+					Regions: []string{"otherregion", "phx"},
+					Instances: []string{
+						makeInstanceID("phx", "otherinstance"),
+						makeInstanceID("phx", "myinstance"),
+					},
+				},
+			},
+			tokenName:        "mytoken",
+			requestTokenName: "mytoken",
+			assertion:        isAccessDenied,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			fakeIMDS.instanceClaims = tc.claims
+
+			imdsClient, err := newFakeHTTPClient(imdsListener.Addr())
+			require.NoError(t, err)
+
+			token, err := types.NewProvisionTokenFromSpec(
+				tc.tokenName,
+				time.Now().Add(time.Minute),
+				types.ProvisionTokenSpecV2{
+					JoinMethod: types.JoinMethodOracle,
+					Roles:      []types.SystemRole{types.RoleNode},
+					Oracle: &types.ProvisionTokenSpecV2Oracle{
+						Allow: tc.allowRules,
+					},
+				},
+			)
+			require.NoError(t, err)
+			require.NoError(t, server.Auth().UpsertToken(t.Context(), token))
+
+			_, err = joinclient.Join(t.Context(), joinclient.JoinParams{
+				Token: tc.requestTokenName,
+				ID: state.IdentityID{
+					Role: types.RoleInstance,
+				},
+				AuthClient:       nopClient,
+				OracleIMDSClient: imdsClient,
+			})
+			tc.assertion(t, err)
+		})
+	}
+}
+
+// TestInstanceKeyAlgorithms tests that the Oracle join method supports
+// multiple possible instance key algorithms and checks their parameters.
+func TestInstanceKeyAlgorithms(t *testing.T) {
+	t.Parallel()
+
+	cas, err := newCAChain()
+	require.NoError(t, err)
+
+	oracleAPIListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	fakeOracleAPI := newFakeOracleAPI(cas.caCertBase64)
+
+	testutils.RunTestBackgroundTask(t.Context(), t, &testutils.TestBackgroundTask{
+		Name: "fake Oracle API server",
+		Task: func(ctx context.Context) error {
+			err := fakeOracleAPI.serve(oracleAPIListener)
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			return trace.Wrap(err)
+		},
+		Terminate: oracleAPIListener.Close,
+	})
+
+	fakeOracleAPIClient, err := newFakeHTTPClient(oracleAPIListener.Addr())
+	require.NoError(t, err)
+
+	claims := oraclejoin.Claims{
+		TenancyID:     makeTenancyID("mytenant"),
+		CompartmentID: makeCompartmentID("mycompartment"),
+		InstanceID:    makeInstanceID("phx", "myinstance"),
+	}
+
+	token, err := types.NewProvisionTokenFromSpec(
+		"mytoken",
+		time.Now().Add(time.Minute),
+		types.ProvisionTokenSpecV2{
+			JoinMethod: types.JoinMethodOracle,
+			Roles:      []types.SystemRole{types.RoleNode},
+			Oracle: &types.ProvisionTokenSpecV2Oracle{
+				Allow: []*types.ProvisionTokenSpecV2Oracle_Rule{
+					{Tenancy: claims.TenancyID},
+				},
+			},
+		},
+	)
+	require.NoError(t, err)
+
+	challenge, err := joinutils.GenerateChallenge(base64.StdEncoding, 32)
+	require.NoError(t, err)
+
+	makeChallengeSolution := func(t *testing.T, instanceKey, signatureKey crypto.Signer) *messages.OracleChallengeSolution {
+		instanceCert, err := cas.issueInstanceCert(claims, instanceKey.Public())
+		require.NoError(t, err)
+
+		var signature []byte
+		switch priv := signatureKey.(type) {
+		case *rsa.PrivateKey:
+			signature, err = oracle.SignChallenge(priv, challenge)
+			require.NoError(t, err)
+		case *ecdsa.PrivateKey:
+			digest := sha256.Sum256([]byte(challenge))
+			signature, err = ecdsa.SignASN1(rand.Reader, priv, digest[:])
+			require.NoError(t, err)
+		case ed25519.PrivateKey:
+			signature = ed25519.Sign(priv, []byte(challenge))
+		}
+
+		// Make the root CA request but there's no need to actually sign it
+		// since this will be sent to the test's fake Oracle API.
+		rootCAReq := &http.Request{
+			Method: http.MethodGet,
+			URL: &url.URL{
+				Scheme: "http",
+				Host:   "auth.us-phoenix-1.oraclecloud.com",
+				Path:   "/v1/instancePrincipalRootCACertificates",
+			},
+			Header: http.Header{
+				"Date": []string{time.Now().UTC().Format(http.TimeFormat)},
+			},
+		}
+		rootCAReqBytes, err := httputil.DumpRequestOut(rootCAReq, false /*body*/)
+		require.NoError(t, err)
+
+		return &messages.OracleChallengeSolution{
+			Cert:            instanceCert,
+			Intermediate:    cas.intermediateCertPEM,
+			Signature:       signature,
+			SignedRootCAReq: rootCAReqBytes,
+		}
+	}
+
+	ecdsaP256Key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	_, ed25519Key, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+
+	isAccessDenied := func(t assert.TestingT, err error, msgAndArgs ...any) bool {
+		return assert.ErrorAs(t, err, new(*trace.AccessDeniedError), msgAndArgs...)
+	}
+
+	rootCACache := oraclejoin.NewRootCACache()
+
+	for _, tc := range []struct {
+		desc         string
+		instanceKey  crypto.Signer
+		signatureKey crypto.Signer
+		badSignature bool
+		assertion    assert.ErrorAssertionFunc
+	}{
+		{
+			// RSA key is too small.
+			desc:        "rsa1024",
+			instanceKey: parseTestKey(rsa1024Key),
+			assertion:   isAccessDenied,
+		},
+		{
+			// RSA key pass.
+			desc:        "rsa2048",
+			instanceKey: parseTestKey(rsa2048Key1),
+			assertion:   assert.NoError,
+		},
+		{
+			// ECDSA key rejected.
+			desc:        "ecdsaP256",
+			instanceKey: ecdsaP256Key,
+			assertion:   isAccessDenied,
+		},
+		{
+			// Ed25519 key rejected.
+			desc:        "ed25519",
+			instanceKey: ed25519Key,
+			assertion:   isAccessDenied,
+		},
+		{
+			desc:         "RSA key bad signature",
+			instanceKey:  parseTestKey(rsa2048Key1),
+			badSignature: true,
+			assertion:    isAccessDenied,
+		},
+		{
+			desc:         "challenge signed by different key",
+			instanceKey:  parseTestKey(rsa2048Key1),
+			signatureKey: parseTestKey(rsa2048Key2),
+			assertion:    isAccessDenied,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			if tc.signatureKey == nil {
+				tc.signatureKey = tc.instanceKey
+			}
+			solution := makeChallengeSolution(t, tc.instanceKey, tc.signatureKey)
+
+			if tc.badSignature {
+				solution.Signature[0] = solution.Signature[0] + 1
+			}
+
+			params := &oraclejoin.CheckChallengeSolutionParams{
+				Challenge:      challenge,
+				Solution:       solution,
+				ProvisionToken: token,
+				HTTPClient:     fakeOracleAPIClient,
+				RootCACache:    rootCACache,
+			}
+
+			_, err = oraclejoin.CheckChallengeSolution(t.Context(), params)
+			tc.assertion(t, err)
+		})
+	}
+}
+
+// fakeHTTPClient overrides the address and scheme of HTTP requests to direct
+// them to a faked server for a test.
+type fakeHTTPClient struct {
+	addr net.Addr
+	utils.HTTPDoClient
+}
+
+func newFakeHTTPClient(addr net.Addr) (*fakeHTTPClient, error) {
+	clt, err := defaults.HTTPClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &fakeHTTPClient{
+		addr:         addr,
+		HTTPDoClient: clt,
+	}, nil
+}
+
+func (c *fakeHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	slog.InfoContext(req.Context(), "HTTP request",
+		"method", req.Method,
+		"url", req.URL)
+	req.URL.Host = c.addr.String()
+	req.URL.Scheme = "http"
+	return c.HTTPDoClient.Do(req)
+}
+
+// fakeIMDS implements the subset of the HTTP interface of the OCI IMDS that is
+// used for Oracle joining.
+type fakeIMDS struct {
+	cas            *caChain
+	instanceKey    crypto.Signer
+	instanceClaims oraclejoin.Claims
+}
+
+func newFakeIMDS() (*fakeIMDS, error) {
+	cas, err := newCAChain()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	instanceKey := parseTestKey(rsa2048Key1)
+	f := &fakeIMDS{
+		cas:         cas,
+		instanceKey: instanceKey,
+	}
+	return f, nil
+}
+
+func (f *fakeIMDS) serve(lis net.Listener) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/opc/v2/instance/region", f.handleRegion)
+	mux.HandleFunc("/opc/v2/identity/cert.pem", f.handleCert)
+	mux.HandleFunc("/opc/v2/identity/key.pem", f.handleKey)
+	mux.HandleFunc("/opc/v2/identity/intermediate.pem", f.handleIntermediate)
+	mux.HandleFunc("/v1/x509", f.handleX509)
+	return trace.Wrap(http.Serve(lis, mux))
+}
+
+func (f *fakeIMDS) handleRegion(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte("phx"))
+}
+
+func (f *fakeIMDS) handleCert(w http.ResponseWriter, r *http.Request) {
+	instanceCert, err := f.cas.issueInstanceCert(f.instanceClaims, f.instanceKey.Public())
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error()))
+		return
+	}
+	w.Write(instanceCert)
+}
+
+func (f *fakeIMDS) handleKey(w http.ResponseWriter, r *http.Request) {
+	keyPEM, err := keys.MarshalPrivateKey(f.instanceKey)
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error()))
+		return
+	}
+	w.Write(keyPEM)
+}
+
+func (f *fakeIMDS) handleIntermediate(w http.ResponseWriter, r *http.Request) {
+	w.Write(f.cas.intermediateCertPEM)
+}
+
+func (f *fakeIMDS) handleX509(w http.ResponseWriter, r *http.Request) {
+	type token struct {
+		Token string `json:"token"`
+	}
+	resp := token{
+		Token: testJWT,
+	}
+	json.NewEncoder(w).Encode(resp)
+}
+
+// fakeOracleAPI implements the subset of the HTTP interface of the OCI auth
+// API that is used for Oracle joining.
+type fakeOracleAPI struct {
+	rootCABase64 string
+}
+
+func newFakeOracleAPI(rootCABase64 string) *fakeOracleAPI {
+	return &fakeOracleAPI{
+		rootCABase64: rootCABase64,
+	}
+}
+
+func (f *fakeOracleAPI) serve(lis net.Listener) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/v1/instancePrincipalRootCACertificates", f.handleRootCACertificates)
+	return trace.Wrap(http.Serve(lis, mux))
+}
+
+func (f *fakeOracleAPI) handleRootCACertificates(w http.ResponseWriter, r *http.Request) {
+	type rootCAResp struct {
+		Certificates []string `json:"certificates"`
+		RefreshIn    string   `json:"refreshIn"`
+	}
+	resp := rootCAResp{
+		Certificates: []string{f.rootCABase64},
+		RefreshIn:    time.Now().Add(time.Hour).Format(time.RFC3339),
+	}
+	json.NewEncoder(w).Encode(resp)
+}
+
+type caChain struct {
+	caCertPEM           []byte
+	caCertBase64        string
+	intermediateKey     crypto.Signer
+	intermediateCert    *x509.Certificate
+	intermediateCertPEM []byte
+}
+
+func newCAChain() (*caChain, error) {
+	caKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caCertPEM, err := tlsca.GenerateSelfSignedCAWithSigner(caKey, pkix.Name{CommonName: "root CA"}, nil, time.Hour)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caCert, err := tlsca.ParseCertificatePEM(caCertPEM)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caCertBase64 := strings.TrimSpace(string(caCertPEM))
+	caCertBase64 = strings.TrimPrefix(caCertBase64, "-----BEGIN CERTIFICATE-----\n")
+	caCertBase64 = strings.TrimSuffix(caCertBase64, "\n-----END CERTIFICATE-----")
+
+	intermediateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	intermediateCert := newX509Cert()
+	intermediateCert.Subject = pkix.Name{CommonName: "intermediate CA"}
+	intermediateCert.IsCA = true
+	intermediateCertDER, err := x509.CreateCertificate(rand.Reader, intermediateCert, caCert, intermediateKey.Public(), caKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	intermediateCertPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: intermediateCertDER})
+
+	return &caChain{
+		caCertPEM:           caCertPEM,
+		caCertBase64:        caCertBase64,
+		intermediateKey:     intermediateKey,
+		intermediateCert:    intermediateCert,
+		intermediateCertPEM: intermediateCertPEM,
+	}, nil
+}
+
+func (c *caChain) issueInstanceCert(claims oraclejoin.Claims, pub crypto.PublicKey) ([]byte, error) {
+	instanceCert := newX509Cert()
+	instanceCert.Subject = pkix.Name{
+		CommonName: "instance",
+		OrganizationalUnit: []string{
+			"opc-instance:" + claims.InstanceID,
+			"opc-compartment:" + claims.CompartmentID,
+			"opc-tenant:" + claims.TenancyID,
+			"opc-certtype:instance",
+		},
+	}
+	instanceCertDER, err := x509.CreateCertificate(rand.Reader, instanceCert, c.intermediateCert, pub, c.intermediateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: instanceCertDER}), nil
+}
+
+func newX509Cert() *x509.Certificate {
+	return &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		BasicConstraintsValid: true,
+	}
+}
+
+const (
+	// Generating RSA keys slow so these test use pre-generated keys.
+	rsa2048Key1 = string(`-----BEGIN TEST RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAxYsUIrplZRkTS30Zh1O0DVVr40KVky+3EZKiH8OWKaVGlqVk
+pmggHpw8pCQwAmxFqLoQxOntCch4p0Vfk/BahtAq0NZ+4qSGX8BIv48ESPudIAY7
+iDdNUn+2Xd1Z2lzHMJ9tKUtceVmTlDpOFjXDPxFK2cUg4dY4l6PgM4lJq2kS/Sbd
+9YIR/+ekCStKzXt5qziuwMx+tSxDmZ2DbQkdhCyStKNhouyDPxDB6LBLqlU9IZb8
+1NpoDaaZ+rv5MmD7hb5Yb6qSuT56zxygd+ae4Qzr7y7/aYqhUK210GsnvHoyK4hF
+QP8sAWg0ljgu6lgisjphZdUJ4lSo8wE5SkfCDQIDAQABAoIBAAGeXx7duiD28KKI
+tuHV/L6zOXwWOpWHKY/aTLvH5X4X3Zk0Z7u5VLILg6+woDgU3QlB5QtIA2o2G077
+kYnryUIbiI5Hg6ilwngcYjw3lshmT2ZIxsoZ8edAJqVkP+07H2K1m7Zf6LUR19S6
+GZOzAxOMN7nLFLblA3eynw6tDE58PTtQFZ/DGiCGi7Ac9mKc7EQ1juF8J+ZpzoHC
+fvx+huRDu7Bu0jlI+mYNcZgbDDynQxyPUOHCf3pk07DThccz1gZjCC0HyfjUjuYM
+PaAIHg+8cnrMHqd6+PL7zhjyH8pdiH1BTy/3R+ovYr4HiGugVq/onwVszXHwoGG9
+C1XyrH0CgYEA71xgZH+Bfb27AdeGm+N/6Dd54hDlfXD27F6zrp9qeqeVztSHH1/2
+mD/MxsvniXB7LJ5sWrbNz55Y7uycUAD1sfDKXoRZ8c2V6tpqde22jrQhpgbJ8uvx
+r2EYksBz7iV8rtfx/KMBk+sf6t+DZnztzENmmsh2HamuXo2br9cEEaMCgYEA00aG
+JaGDuwzv/O8RnXpIYMNxDQYr8jd6Bt7nkZcHVMdQtX6dnUPRXHFHAnpke9BCGiG2
+GjciaUpzSfgXvsbRMpfJR5hhyhml1MqtjguAlbpDXSaPQwcSTfbZvxHEV2PToXYB
+z+AII4tpsXD5N22HvreeapXTyBz3Lhhw8WEk+I8CgYBPUSgsBUiOt1GB4b6cZ73Z
+4JBGBl1VvRpF53fZVMA/FsuAt1JzZiRb/UBJXAZEt/5JIdI8GTmIJCvKOKPvqvG/
+3k/hFDCN/RdBtND0dSo6jZxc3QEMu3ziJeWzs4x3DPsNIUfx9L4wGwj/lsN/McTH
+HEqi3eyuFa1PbdN6aGDTywKBgQC1L1bdsLyyze6FwFQf8/1cFl++JpvLdi4M9F4s
+6hNcbi3V6AatFrrWB0M5adMAp2H43Q45Py0glLt4JO3gKsq/E5KG9rRuSD6B1Wqv
+VUfpn7ojiWz0s3zMJbUo+ciilTap0fTN27e/G9EBXfwrv5/ZO8j8aQ8dH1IPUuCQ
+8JlvGwKBgGlRuhLXrP3Cg0rhaupR0gUZPjPs9AQiGFs186oCYs6PKSFJ/LekbNuq
+uOuLdl2Bwlo6XFlT7I4FfAgzO+l35ER2Gihr8hIb8cC1dBAIR1ejXUhoC18NN8GJ
+As9vlQ+UkBUy4/0pl7S/Eet7CI0WSwalvjd7bI2Xiau5rO3aT5pQ
+-----END TEST RSA PRIVATE KEY-----`)
+	rsa2048Key2 = string(`-----BEGIN TEST RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAzsP7Kl+O4JUq5lqGTbbnIDFCJttQq4t/aRHF4LXXrby7JBvG
+HekpgRqflEw7U356iVf7GZoSq8XpNsUiWJ1M0sl9z49qmrsNzj9dwfd8dLN6XxJ5
+qnECL6SuHx/vwkaseppYQLXZijRQGKOj9h1s/tn8UjabmL9APC9TiYkSzkwsdRyR
+xXc9lwQQKRC/AjFKi1DWxAPw0DT1P+guvWZBk8Wwnqcs2uP4OUKoZ9GULD9Jf22Q
+kVlU4vkEp5VOaudv08y5enLhRRxLTzSDD0mctRHi+DnNApG2CiNdONkYm6rB5HBD
+6GYRd/kn+F0EZ93XEdf+gkMfY78PeHQFGi6T0QIDAQABAoIBAAwmPU/WZDPzf+ns
+mTMS046AM0XLCEWNzlngEGA6WMCENC9HrhxobKbOtJOUGr5QUo0kc53XAFB1ZVU+
+P/aBOhgYSXS7SOvSBvPyCqVqaeoF+Ja1vefTReockDPfyzvl4QRy2LGz6pYk3Pn9
+qS8KhP+N00/Vyc6WM+uPA/OACVaNM/1p+N/g5/W4zs3GQ8ssSBn/CMFaFeMeVwMk
+94Mj1UMXSfH6ORgnQtVeFSI/Fmx6QcHVoXqF2OWMcYth4XQHZtl7C+gMGSzSpIzn
+CURyAu1Ze70PbdWLPGisXV5GdFIBV6uMJRE9oj0vZqxTOChGY8n30elA0HUWUg2o
+CKKBqysCgYEA9xohrszEgZSkHuGNdpVt30AtzI+w9Ig6EtUGgDzp+PU0ossDQVQ/
+9/z5EinFs2e8I8hwxjy+u8OQdo43BGQ1t6AkQrCVH6aJXGvILK7so2yycwNPChS/
+hjweGV1fcr7kwn4jl9BRiKsLYLtn/bLX+Y9RiXumK1bMB7X2HSxUw7MCgYEA1jYD
+n2FE8YkUy0nSWpqkNZt8hb3HJzL265liYRTJxS8o0iAGjiVaZAfDG8gIhdkYXIh5
+P+FBmlAbhVecJrStO9RPGTpVVd0ntm6phOK4oqodWjV4I/f7GbT1yvpQFFus+hvP
+WNTUvlPKPe7K932d9m25Qs9mxeh7InV1QEn4GGsCgYEAk+UPDek/H/OQO29yVOxh
+A4MNJmdGWUWDxKu9pVlQDJLuexUZEKvVUZ8WkDlyO8u1vpEEdpH68rS9LUg3Q6ia
+whnWOhgoWPY7NpbIC35y4el38QCk+PqsGzK2LSZGr43zqzkGIqIreqotOCtStXSq
+cZLHEYtxTHU5zs+oy5Mx9KMCgYEAyAQDeeyPPaEsI2241xUSQ2P977t2m+mAmhjM
+va11gYM5cIqq1EuYjVKaIfSz0JcXoj9kR/uDEB3AtM9LZPDL2NOzT/EiAVzRWg0W
+iJhSosCJS9QlbCB+/E/2OiNkZr37VEZnY6DHTThb3Vx9dH584r8tf269ngon/9MB
+OphW6iUCgYB05lF3Smdw2mrJ25RrjNFhxY2zmgBAQBIEm/M736j4U/evLaJ/1ViV
+6cEjOsAJh6CeHsTQmJqf6AOOYqg0I1yK+YHBdu4H6Rwk0uWNEWPIc7h2m3TjKVUv
+8JBWbnqcO00Vy0o9FwEp7zAtW7RWLz730sTJ0WVnsVt5D2CXuqj2gw==
+-----END TEST RSA PRIVATE KEY-----`)
+	rsa1024Key = string(`-----BEGIN TEST RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDQ5Ez3fC5iVdHJyvzTX9p7GUyJOArMM/VJjMwbsln2hcBCq65s
+SRDfBPmgR9xz2rnvInJ0yGuPKT7g/VAP+J05EnU4uywXlua0ciXQk5GRWKFIbJfJ
+0RktwlOjchy2xwIyuZHPN40jHilNyZkJX90FCxXHnkm3/b6yc+kzkDAv4wIDAQAB
+AoGAMYiZeawgQaAxDYVNW4AkykDvBbDc2pxNg2HYOo8ZxxvjQcv9Id9XmVLQMMIp
+k+1fXsXP10J5QurYZriaphbhjOvSEhtsbw/HujHbxnOTaZtZNnfdmWWswO6JMtG2
+7wjs/McCM0XfjlO94xn4vTw2ajhxfaWsvDpMXm74SMq2Y6kCQQDih+wYUxG6zEAB
+y2wgSnQNHGFKTHAWgVskdy+cX99YXUlIqFE9HV/MS+5rzgejwLG1VSOrcsoZb6/p
+AKBESr/LAkEA7BDyxG1t3gi/JrG2C0CjM06DAl5Og7Gq0BoWw26QyA0u5EPmZmM1
+CW3V+ZTjp974/ZwaBEc8c5CzZnugVcCdSQJBAJ3cJnTU/pfz2e7mOVVPTQwN6OaD
+2eB1CHSi8fTBAr1rVLRjRymVnLqbd2x8yOoeUDiTOiYx+hA7upResVCl3n0CQEXd
+bjv8Nvvzkr8c8Ue7RZG1tshIqOwI9QjJ79q/KlJKtIoSHmpHCjdULnPDQO057G8C
+eCC0BIwfUzkNdZJrgyECQQDH1ZQu7J5Ol67adPPY//RLLFagKWH34Gb2XNT3HSMR
+JnKk+4N1PAV4hzYeOX0J+Tl6ugUyMCXQ9u62gw+a80Xn
+-----END TEST RSA PRIVATE KEY-----
+`)
+)
+
+func parseTestKey(keyPEM string) crypto.Signer {
+	key, err := keys.ParsePrivateKey([]byte(strings.ReplaceAll(keyPEM, "TEST ", "")))
+	if err != nil {
+		panic(err)
+	}
+	return key.Signer
+}
+
+const testJWT = `eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ0ZXN0IiwiaWF0IjoxNzYxODY4ODAwLCJleHAiOjMzMzE4Nzc3NjAwLCJhdWQiOiJ0ZWxlcG9ydC5leGFtcGxlLmNvbSIsInN1YiI6InRlc3QifQ.JRMX4mUsTbBQWNCz5HI543ZIaqMUPfVhQ7qWgg8l3cY`
diff --git a/lib/join/oraclejoin/oracle.go b/lib/join/oraclejoin/oracle.go
new file mode 100644
index 0000000000000..0b4d08dafc610
--- /dev/null
+++ b/lib/join/oraclejoin/oracle.go
@@ -0,0 +1,351 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/oracle/oci-go-sdk/v65/common"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// CheckChallengeSolutionParams holds parameters necessary to check an Oracle
+// join challenge solution.
+type CheckChallengeSolutionParams struct {
+	// Challenge is the challenge string that was issued to the client.
+	Challenge string
+	// Solution is the client's full solution to the challenge.
+	Solution *messages.OracleChallengeSolution
+	// ProvisionToken is the token being used for the request.
+	ProvisionToken provision.Token
+	// RootCACache caches Oracle root CAs per region.
+	RootCACache *RootCACache
+	// HTTPClient (optional) is an HTTP client that will be used to send
+	// requests to the Oracle API.
+	HTTPClient utils.HTTPDoClient
+}
+
+func (p *CheckChallengeSolutionParams) checkAndSetDefaults() error {
+	switch {
+	case p.Challenge == "":
+		return trace.BadParameter("Challenge is required")
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.Solution.Cert) == 0:
+		return trace.BadParameter("Cert is required")
+	case len(p.Solution.Intermediate) == 0:
+		return trace.BadParameter("Intermediate is required")
+	case len(p.Solution.Signature) == 0:
+		return trace.BadParameter("Signature is required")
+	case len(p.Solution.SignedRootCAReq) == 0:
+		return trace.BadParameter("SignedRootCAReq is required")
+	case p.RootCACache == nil:
+		return trace.BadParameter("RootCACache is required")
+	}
+	if p.HTTPClient == nil {
+		httpClient, err := defaults.HTTPClient()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		p.HTTPClient = httpClient
+	}
+	return nil
+}
+
+// CheckChallengeSolution checks an Oracle join challenge solution, and returns
+// an error if the solution cannot be verified. It returns instance claims, and
+// may return claims even when returning an error, which may be useful for
+// identifying an agent that is failing to join.
+func CheckChallengeSolution(ctx context.Context, params *CheckChallengeSolutionParams) (*Claims, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err, "checking request parameters")
+	}
+
+	identityCert, err := parseIdentityCert(params.Solution.Cert)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing identity certificate")
+	}
+
+	claims, err := parseClaims(identityCert)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing claims from identity certificate")
+	}
+
+	if err := verifyChallengeSignature(identityCert, []byte(params.Challenge), params.Solution.Signature); err != nil {
+		return claims, trace.Wrap(err)
+	}
+
+	intermediateCAPool, err := makeIntermediateCAPool(params.Solution.Intermediate)
+	if err != nil {
+		return claims, trace.Wrap(err, "parsing intermediate CA certificates")
+	}
+
+	rootCAPool, err := makeRootCAPool(ctx, params, claims.InstanceID)
+	if err != nil {
+		return claims, trace.Wrap(err, "building Oracle root CA pool")
+	}
+
+	if _, err := identityCert.Verify(x509.VerifyOptions{
+		Intermediates: intermediateCAPool,
+		Roots:         rootCAPool,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}); err != nil {
+		return claims, trace.AccessDenied("instance certificate chain did not verify to Oracle root CAs")
+	}
+
+	if err := CheckOracleAllowRules(claims, params.ProvisionToken); err != nil {
+		return claims, trace.Wrap(err)
+	}
+
+	return claims, nil
+}
+
+func parseIdentityCert(cert []byte) (*x509.Certificate, error) {
+	block, _ := pem.Decode(cert)
+	if block == nil {
+		return nil, trace.BadParameter("no PEM block found")
+	}
+	if block.Type != "CERTIFICATE" {
+		return nil, trace.BadParameter("expected PEM block of type CERTIFICATE, found %s", block.Type)
+	}
+	c, err := x509.ParseCertificate(block.Bytes)
+	return c, trace.Wrap(err, "parsing certificate DER")
+}
+
+func parseClaims(cert *x509.Certificate) (*Claims, error) {
+	var claims Claims
+	for _, ou := range cert.Subject.OrganizationalUnit {
+		chunks := strings.SplitN(ou, ":", 2)
+		if len(chunks) < 2 {
+			continue
+		}
+		switch chunks[0] {
+		case "opc-instance":
+			claims.InstanceID = chunks[1]
+		case "opc-compartment":
+			claims.CompartmentID = chunks[1]
+		case "opc-tenant":
+			claims.TenancyID = chunks[1]
+		case "opc-certtype":
+			if chunks[1] != "instance" {
+				return nil, trace.BadParameter("opc-certtype is not instance, found: %s", chunks[1])
+			}
+		}
+	}
+	switch {
+	case claims.InstanceID == "":
+		return nil, trace.BadParameter("no InstanceID found")
+	case claims.CompartmentID == "":
+		return nil, trace.BadParameter("no CompartmentID found")
+	case claims.TenancyID == "":
+		return nil, trace.BadParameter("no TenancyID found")
+	}
+	return &claims, nil
+}
+
+func verifyChallengeSignature(identityCert *x509.Certificate, challenge, signature []byte) error {
+	switch pub := identityCert.PublicKey.(type) {
+	case *rsa.PublicKey:
+		return trace.Wrap(verifyRSAChallengeSignature(pub, challenge, signature))
+	default:
+		return trace.AccessDenied("unsupported certificate key type %s", identityCert.PublicKeyAlgorithm.String())
+	}
+}
+
+func verifyRSAChallengeSignature(pub *rsa.PublicKey, challenge, signature []byte) error {
+	// pub.Size returns the key size in bytes, we require a 2048-bit key.
+	if pub.Size() < 2048/8 {
+		return trace.AccessDenied("instance key: RSA key is too small (minimum 2048 bits)")
+	}
+	if pub.Size() > 4096/8 {
+		return trace.AccessDenied("instance key: RSA key is too large (maximum 4096 bits)")
+	}
+	digest := sha256.Sum256(challenge)
+	if err := rsa.VerifyPSS(pub, crypto.SHA256, digest[:], signature, &rsa.PSSOptions{
+		SaltLength: rsa.PSSSaltLengthAuto,
+		Hash:       crypto.SHA256,
+	}); err != nil {
+		return trace.AccessDenied("RSA challenge signature did not verify")
+	}
+	return nil
+}
+
+func makeIntermediateCAPool(intermediateCAPEM []byte) (*x509.CertPool, error) {
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(intermediateCAPEM) {
+		return nil, trace.BadParameter("failed to parse any intermediate CAs")
+	}
+	return pool, nil
+}
+
+func makeRootCAPool(ctx context.Context, params *CheckChallengeSolutionParams, instanceID string) (*x509.CertPool, error) {
+	rootCAReq, err := parseRootCAReq(params.Solution.SignedRootCAReq)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing signed root CA request")
+	}
+
+	region, err := validateRootCAReq(rootCAReq, instanceID)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating root CA request")
+	}
+
+	rootCAPool, err := params.RootCACache.get(ctx, region, func() (*x509.CertPool, time.Time, error) {
+		return getRootCAPool(ctx, params.HTTPClient, rootCAReq)
+	})
+	return rootCAPool, trace.Wrap(err)
+}
+
+func parseRootCAReq(req []byte) (*http.Request, error) {
+	httpReq, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(req)))
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing HTTP request")
+	}
+
+	// Unset RequestURI and set URL (necessary quirk of sending a request parsed by
+	// http.ReadRequest)
+	httpReq.RequestURI = ""
+	httpReq.URL.Scheme = "https"
+	httpReq.URL.Host = httpReq.Host
+	// If the HTTP client sees this header set to gzip it will expect the
+	// caller to handle gzip itself instead of decoding automatically.
+	delete(httpReq.Header, "Accept-Encoding")
+	return httpReq, nil
+}
+
+func validateRootCAReq(req *http.Request, instanceID string) (string, error) {
+	const rootCAPath = "/v1/instancePrincipalRootCACertificates"
+	if req.URL.Path != rootCAPath {
+		return "", trace.BadParameter("path must be %s, got %s", rootCAPath, req.URL.Path)
+	}
+	expectedRegion, err := regionFromInstanceID(instanceID)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	expectedHostname := expectedRegion.Endpoint("auth")
+	if req.URL.Hostname() != expectedHostname {
+		return "", trace.BadParameter("hostname must be %s, got %s", expectedHostname, req.URL.Hostname())
+	}
+	return string(expectedRegion), nil
+}
+
+// regionFromInstanceID returns an oci region for a given instance ID. It will
+// return an error if the region name is not recognized by the SDK. This is a
+// critical check since this region will be used to validate the endpoint that
+// will be used to fetch the regional root CAs. If a bogus region were allowed
+// then teleport could be tricked into making a request to
+// auth.<bogus-region-name>.oraclecloud.com with potential tricks in
+// <bogus-region-name>.
+func regionFromInstanceID(instanceID string) (common.Region, error) {
+	// Expected InstanceID format ocid1.instance.<realm>.[region][.future-use].<id>
+	chunks := strings.SplitN(instanceID, ".", 5)
+	if len(chunks) < 5 {
+		return "", trace.BadParameter("instance ID does not have expected format, got %s", instanceID)
+	}
+	regionShortName := chunks[3]
+	region := common.StringToRegion(regionShortName)
+	if _, err := region.RealmID(); err != nil {
+		// StringToRegion always returns something, RealmID will return an
+		// error if it's not a real region.
+		return "", trace.AccessDenied("unsupported region %s", regionShortName)
+	}
+	return region, nil
+}
+
+func getRootCAPool(ctx context.Context, httpClient utils.HTTPDoClient, rootCAReq *http.Request) (*x509.CertPool, time.Time, error) {
+	resp, err := executeRootCAReq(ctx, httpClient, rootCAReq)
+	if err != nil {
+		return nil, time.Time{}, trace.Wrap(err, "executing Oracle root CA request")
+	}
+	rootCAPool, err := parseRootCAPool(resp)
+	if err != nil {
+		return nil, time.Time{}, trace.Wrap(err, "parsing Oracle root CA pool")
+	}
+	expires, err := time.Parse(time.RFC3339, resp.RefreshIn)
+	if err != nil {
+		expires = time.Now().Add(5 * time.Minute)
+	}
+	return rootCAPool, expires, nil
+}
+
+func executeRootCAReq(ctx context.Context, client utils.HTTPDoClient, req *http.Request) (*rootCAResp, error) {
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err, "sending request to Oracle API")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, trace.Errorf("HTTP request failed with status: %s", resp.Status)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, teleport.MaxHTTPResponseSize))
+	if err != nil {
+		return nil, trace.Wrap(err, "reading response body")
+	}
+
+	var parsedResp rootCAResp
+	if err := json.Unmarshal(body, &parsedResp); err != nil {
+		return nil, trace.Wrap(err, "parsing response")
+	}
+	return &parsedResp, nil
+}
+
+// rootCAResp models the JSON structure returned by Oracle's
+// /v1/instancePrincipalRootCACertificates API.
+type rootCAResp struct {
+	// Certificates is expected to be a list of base64-encoded ASN.1 DER X509
+	// certificates.
+	Certificates []string `json:"certificates"`
+	// RefreshIn is an RFC3339 timestamp indicating when the CA should be re-fetched.
+	RefreshIn string `json:"refreshIn"`
+}
+
+func parseRootCAPool(resp *rootCAResp) (*x509.CertPool, error) {
+	pool := x509.NewCertPool()
+	for _, certBase64 := range resp.Certificates {
+		bytes, err := base64.StdEncoding.DecodeString(certBase64)
+		if err != nil {
+			return nil, trace.Wrap(err, "decoding cert base64")
+		}
+		cert, err := x509.ParseCertificate(bytes)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing x509 certificate")
+		}
+		pool.AddCert(cert)
+	}
+	return pool, nil
+}
diff --git a/lib/join/oraclejoin/region.go b/lib/join/oraclejoin/region.go
new file mode 100644
index 0000000000000..fec58da4bf9f4
--- /dev/null
+++ b/lib/join/oraclejoin/region.go
@@ -0,0 +1,86 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/oracle/oci-go-sdk/v65/common"
+)
+
+// Hack: StringToRegion will lazily load regions from a config file if its
+// input isn't in its hard-coded list, in a non-threadsafe way. Call it here
+// to load the config ahead of time so future calls are threadsafe.
+var _ = common.StringToRegion("")
+
+// ParseRegion parses a string into a full (not abbreviated) Oracle Cloud
+// region. It returns the empty string if the input is not a valid region.
+func ParseRegion(rawRegion string) (region, realm string) {
+	canonicalRegion := common.StringToRegion(rawRegion)
+	realm, err := canonicalRegion.RealmID()
+	if err != nil {
+		return "", ""
+	}
+	return string(canonicalRegion), realm
+}
+
+var ociRealms = map[string]struct{}{
+	"oc1": {}, "oc2": {}, "oc3": {}, "oc4": {}, "oc8": {}, "oc9": {},
+	"oc10": {}, "oc14": {}, "oc15": {}, "oc19": {}, "oc20": {}, "oc21": {},
+	"oc23": {}, "oc24": {}, "oc26": {}, "oc29": {}, "oc35": {},
+}
+
+// ParseRegionFromOCID parses an Oracle OCID and returns the embedded region.
+// It returns an error if the input is not a valid OCID.
+func ParseRegionFromOCID(ocid string) (string, error) {
+	// OCID format: ocid1.<RESOURCE TYPE>.<REALM>.[REGION][.FUTURE USE].<UNIQUE ID>
+	// Check format.
+	ocidParts := strings.Split(ocid, ".")
+	switch len(ocidParts) {
+	case 5, 6:
+	default:
+		return "", trace.BadParameter("not an ocid")
+	}
+	// Check version.
+	if ocidParts[0] != "ocid1" {
+		return "", trace.BadParameter("invalid ocid version: %v", ocidParts[0])
+	}
+	// Check realm.
+	if _, ok := ociRealms[ocidParts[2]]; !ok {
+		return "", trace.BadParameter("invalid realm: %v", ocidParts[2])
+	}
+	resourceType := ocidParts[1]
+	region, realm := ParseRegion(ocidParts[3])
+	// Check type. Only instance OCIDs should have a region.
+	switch resourceType {
+	case "instance":
+		if region == "" {
+			return "", trace.BadParameter("invalid region: %v", region)
+		}
+		if realm != ocidParts[2] {
+			return "", trace.BadParameter("invalid realm %q for region %q", ocidParts[2], region)
+		}
+	case "compartment", "tenancy":
+		if ocidParts[3] != "" {
+			return "", trace.BadParameter("resource type %v should not have a region", resourceType)
+		}
+	default:
+		return "", trace.BadParameter("unsupported resource type: %v", resourceType)
+	}
+	return region, nil
+}
diff --git a/lib/join/oraclejoin/rootcacache.go b/lib/join/oraclejoin/rootcacache.go
new file mode 100644
index 0000000000000..903dca436dfd5
--- /dev/null
+++ b/lib/join/oraclejoin/rootcacache.go
@@ -0,0 +1,112 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	"context"
+	"crypto/x509"
+	"sync"
+	"time"
+)
+
+// RootCACache caches Oracle instance root CAs for each region. It is inspired
+// by lib/utils.FnCache which is designed for caching backend reads, but this
+// cache makes a couple different choices:
+//   - Each cache entry expiry is determined by the response we get from the
+//     Oracle API and unknown before making the request.
+//   - Error results are always retried at the next request.
+//   - There is no regularly scheduled cleanup, expired entries will be cleaned
+//     up on the next get. This cache will not be large, max 1 entry per OCI region.
+type RootCACache struct {
+	entries map[string]*rootCACacheEntry
+	mu      sync.Mutex
+}
+
+// NewRootCACache returns a new RootCACache, ready to use.
+func NewRootCACache() *RootCACache {
+	return &RootCACache{
+		entries: make(map[string]*rootCACacheEntry),
+	}
+}
+
+type getRootCAPoolFn func() (*x509.CertPool, time.Time, error)
+
+// get is the only method consumers of RootCACache should call. Given a key
+// (which should be the region of the root CA) and a getRootCAPoolFn, it will
+// return a cached root CA pool if one is present and not expired, else it will
+// call loadFn to request the root CA pool.
+func (c *RootCACache) get(ctx context.Context, key string, loadFn getRootCAPoolFn) (*x509.CertPool, error) {
+	entry := c.getEntry(key, loadFn)
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-entry.loaded:
+		return entry.caPool, entry.err
+	}
+}
+
+func (c *RootCACache) getEntry(key string, loadFn getRootCAPoolFn) *rootCACacheEntry {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := time.Now()
+
+	c.removeExpiredLocked(now)
+
+	if entry, ok := c.entries[key]; ok {
+		// There is an existing cache entry, return it. If the entry is expired
+		// or stores an error it would have been removed in removeExpiredLocked
+		// above.
+		return entry
+	}
+
+	// Create a new cache entry to store and return.
+	entry := &rootCACacheEntry{
+		loaded: make(chan struct{}),
+	}
+	c.entries[key] = entry
+	go func() {
+		entry.caPool, entry.expires, entry.err = loadFn()
+		close(entry.loaded)
+	}()
+
+	return entry
+}
+
+func (c *RootCACache) removeExpiredLocked(now time.Time) {
+	for key, entry := range c.entries {
+		select {
+		case <-entry.loaded:
+			if entry.expires.Before(now) || entry.err != nil {
+				delete(c.entries, key)
+			}
+		default:
+			// entry is still being loaded.
+			continue
+		}
+	}
+}
+
+type rootCACacheEntry struct {
+	// loaded will be closed when the entry is ready. It also acts as a memory barrier:
+	// the below fields must only be written before loaded is closed, and must
+	// only be read after it is closed.
+	loaded  chan struct{}
+	caPool  *x509.CertPool
+	expires time.Time
+	err     error
+}
diff --git a/lib/join/oraclejoin/rootcacache_test.go b/lib/join/oraclejoin/rootcacache_test.go
new file mode 100644
index 0000000000000..88063b1e415ae
--- /dev/null
+++ b/lib/join/oraclejoin/rootcacache_test.go
@@ -0,0 +1,109 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	"crypto/x509"
+	"errors"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func TestRootCACache(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testRootCACache)
+}
+
+func testRootCACache(t *testing.T) {
+	cache := NewRootCACache()
+
+	caPool := x509.NewCertPool()
+	const caTTL = 5 * time.Minute
+
+	var loadCount atomic.Int32
+	loadFn := func() (*x509.CertPool, time.Time, error) {
+		loadCount.Add(1)
+		time.Sleep(10 * time.Millisecond)
+		expires := time.Now().Add(caTTL)
+		return caPool, expires, nil
+	}
+
+	// Getting the same key many times only results in 1 load.
+	for range 10 {
+		pool, err := cache.get(t.Context(), "test", loadFn)
+		require.Equal(t, caPool, pool)
+		require.NoError(t, err)
+	}
+	require.Equal(t, int32(1), loadCount.Load())
+
+	// Waiting until the entry expires then getting the same key again a number
+	// of times results in 1 additional load.
+	time.Sleep(caTTL + time.Minute)
+	for range 10 {
+		_, err := cache.get(t.Context(), "test", loadFn)
+		require.NoError(t, err)
+	}
+	require.Equal(t, int32(2), loadCount.Load())
+
+	// Getting 10 different keys multiple times results in 10 total loads.
+	loadCount.Store(0)
+	for range 10 {
+		for i := range 10 {
+			_, err := cache.get(t.Context(), strconv.Itoa(i), loadFn)
+			require.NoError(t, err)
+		}
+	}
+	require.Equal(t, int32(10), loadCount.Load())
+
+	// Wait until all current entries expire, then do 1 more load, expired
+	// entries should be cleaned up.
+	time.Sleep(caTTL + time.Minute)
+	_, err := cache.get(t.Context(), "test", loadFn)
+	require.NoError(t, err)
+	require.Len(t, cache.entries, 1)
+
+	// Error values should not be cached.
+	_, err = cache.get(t.Context(), "testerror", func() (*x509.CertPool, time.Time, error) {
+		return nil, time.Time{}, errors.New("test error")
+	})
+	require.Error(t, err)
+	// An immediate re-fetch does not get the error.
+	_, err = cache.get(t.Context(), "testerror", loadFn)
+	require.NoError(t, err)
+
+	// Even with many concurrent calls the value will only be loaded once.
+	loadCount.Store(0)
+	var wg sync.WaitGroup
+	wg.Add(100)
+	for range 100 {
+		go func() {
+			_, err := cache.get(t.Context(), "concurrent", loadFn)
+			assert.NoError(t, err)
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+	require.Equal(t, int32(1), loadCount.Load())
+}
diff --git a/lib/join/oraclejoin/rules.go b/lib/join/oraclejoin/rules.go
new file mode 100644
index 0000000000000..283204185c247
--- /dev/null
+++ b/lib/join/oraclejoin/rules.go
@@ -0,0 +1,84 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin
+
+import (
+	"slices"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// CheckOracleAllowRules checks that a the oracle rules in a provision token
+// allow an OCI instance with the given claims to join the cluster.
+func CheckOracleAllowRules(claims *Claims, token provision.Token) error {
+	ptv2, ok := token.(*types.ProvisionTokenV2)
+	if !ok {
+		return trace.Errorf("Oracle join method only supports ProvisionTokenV2")
+	}
+	instanceRegion := claims.Region()
+	for _, rule := range ptv2.Spec.Oracle.Allow {
+		if rule.Tenancy != claims.TenancyID {
+			// rule.Tenancy is required, if it doesn't match the instance skip this rule.
+			continue
+		}
+		if !ruleAllowsCompartment(rule, claims.CompartmentID) {
+			// Skip this rule if it does not allow the instance's compartment.
+			continue
+		}
+		if !ruleAllowsRegion(rule, instanceRegion) {
+			// Skip this rule if it does not allow the instance's region.
+			continue
+		}
+		if !ruleAllowsInstanceID(rule, claims.InstanceID) {
+			// Skip this rule if it does not allow the instance's ID.
+			continue
+		}
+		// This rule allows the instance to join.
+		return nil
+	}
+	return trace.AccessDenied("instance %v did not match any allow rules in token %v", claims.InstanceID, token.GetName())
+}
+
+func ruleAllowsCompartment(rule *types.ProvisionTokenSpecV2Oracle_Rule, instanceCompartment string) bool {
+	if len(rule.ParentCompartments) == 0 {
+		// Empty list means all compartments are allowed.
+		return true
+	}
+	return slices.Contains(rule.ParentCompartments, instanceCompartment)
+}
+
+func ruleAllowsRegion(rule *types.ProvisionTokenSpecV2Oracle_Rule, instanceRegion string) bool {
+	if len(rule.Regions) == 0 {
+		// Empty list means all regions are allowed.
+		return true
+	}
+	return slices.ContainsFunc(rule.Regions, func(allowedRegion string) bool {
+		canonicalAllowedRegion, _ := ParseRegion(allowedRegion)
+		return canonicalAllowedRegion == instanceRegion
+	})
+}
+
+func ruleAllowsInstanceID(rule *types.ProvisionTokenSpecV2Oracle_Rule, instanceID string) bool {
+	if len(rule.Instances) == 0 {
+		// Empty list means all instance IDs are allowed.
+		return true
+	}
+	return slices.Contains(rule.Instances, instanceID)
+}
diff --git a/lib/join/oraclejoin/rules_test.go b/lib/join/oraclejoin/rules_test.go
new file mode 100644
index 0000000000000..e598af553e1ee
--- /dev/null
+++ b/lib/join/oraclejoin/rules_test.go
@@ -0,0 +1,252 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package oraclejoin_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
+)
+
+func makeOCID(resourceType, region, id string) string {
+	return fmt.Sprintf("ocid1.%s.oc1.%s.%s", resourceType, region, id)
+}
+
+func makeTenancyID(id string) string {
+	return makeOCID("tenancy", "", id)
+}
+
+func makeCompartmentID(id string) string {
+	return makeOCID("compartment", "", id)
+}
+
+func makeInstanceID(region, id string) string {
+	return makeOCID("instance", region, id)
+}
+
+func TestCheckOracleAllowRules(t *testing.T) {
+	t.Parallel()
+	isAccessDenied := func(t require.TestingT, err error, msgAndArgs ...any) {
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError), msgAndArgs...)
+	}
+	tests := []struct {
+		name       string
+		claims     oraclejoin.Claims
+		allowRules []*types.ProvisionTokenSpecV2Oracle_Rule
+		assert     require.ErrorAssertionFunc
+	}{
+		{
+			name: "ok",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "ok with instance",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+					Instances:          []string{makeInstanceID("us-phoenix-1", "baz")},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "ok with compartment wildcard",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("foo"),
+					Regions: []string{"us-phoenix-1"},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "ok with region wildcard",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "ok with region abbreviation in id",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("phx", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "ok with region abbreviation in token",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"phx"},
+				},
+			},
+			assert: require.NoError,
+		},
+		{
+			name: "wrong tenancy",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("something-else"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+					Instances:          []string{makeInstanceID("us-phoenix-1", "baz")},
+				},
+			},
+			assert: isAccessDenied,
+		},
+		{
+			name: "wrong compartment",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("something-else"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+					Instances:          []string{makeInstanceID("us-phoenix-1", "baz")},
+				},
+			},
+			assert: isAccessDenied,
+		},
+		{
+			name: "wrong region",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-ashburn-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+					Instances:          []string{makeInstanceID("us-phoenix-1", "baz")},
+				},
+			},
+			assert: isAccessDenied,
+		},
+		{
+			name: "wrong instance",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "notallowed"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy:            makeTenancyID("foo"),
+					ParentCompartments: []string{makeCompartmentID("bar")},
+					Regions:            []string{"us-phoenix-1"},
+					Instances:          []string{makeInstanceID("us-phoenix-1", "allowed")},
+				},
+			},
+			assert: isAccessDenied,
+		},
+		{
+			name: "block match across rules",
+			claims: oraclejoin.Claims{
+				TenancyID:     makeTenancyID("foo"),
+				CompartmentID: makeCompartmentID("bar"),
+				InstanceID:    makeInstanceID("us-phoenix-1", "baz"),
+			},
+			allowRules: []*types.ProvisionTokenSpecV2Oracle_Rule{
+				{
+					Tenancy: makeTenancyID("foo"),
+					Regions: []string{"us-ashburn-1"},
+				},
+				{
+					Tenancy: makeTenancyID("something-else"),
+				},
+			},
+			assert: isAccessDenied,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			token, err := types.NewProvisionTokenFromSpec("mytoken", time.Time{}, types.ProvisionTokenSpecV2{
+				Roles: []types.SystemRole{types.RoleInstance},
+				Oracle: &types.ProvisionTokenSpecV2Oracle{
+					Allow: tc.allowRules,
+				},
+			})
+			require.NoError(t, err)
+			tc.assert(t, oraclejoin.CheckOracleAllowRules(&tc.claims, token))
+		})
+	}
+}
diff --git a/lib/join/provision/token.go b/lib/join/provision/token.go
new file mode 100644
index 0000000000000..59cf1823082d2
--- /dev/null
+++ b/lib/join/provision/token.go
@@ -0,0 +1,49 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package provision
+
+import (
+	"time"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// A Token is used in the join service to facilitate provisioning.
+type Token interface {
+	// GetName returns the name of the token.
+	GetName() string
+	// GetSafeName returns the name of the token, sanitized appropriately for
+	// join methods where the name is secret. This should be used when logging
+	// the token name.
+	GetSafeName() string
+	// GetJoinMethod returns joining method that must be used with this token.
+	GetJoinMethod() types.JoinMethod
+	// GetRoles returns a list of teleport roles that will be granted to the
+	// resources provisioned with this token.
+	GetRoles() types.SystemRoles
+	// Expiry returns the token's expiration time.
+	Expiry() time.Time
+	// GetBotName returns the BotName field which must be set for joining bots.
+	GetBotName() string
+	// GetAssignedScope returns the scope that will be assigned to provisioned resources
+	// provisioned using the wrapped [joiningv1.ScopedToken].
+	GetAssignedScope() string
+	// GetAllowRules returns the list of allow rules.
+	GetAllowRules() []*types.TokenRule
+	// GetAWSIIDTTL returns the TTL of EC2 IIDs
+	GetAWSIIDTTL() types.Duration
+}
diff --git a/lib/join/server.go b/lib/join/server.go
new file mode 100644
index 0000000000000..e17b926978858
--- /dev/null
+++ b/lib/join/server.go
@@ -0,0 +1,774 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"cmp"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"log/slog"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/crypto/ssh"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/constants"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/keystore"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/ec2join"
+	"github.com/gravitational/teleport/lib/join/gcp"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	joinauthz "github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
+	"github.com/gravitational/teleport/lib/join/tpmjoin"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+	"github.com/gravitational/teleport/lib/scopes/joining"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/readonly"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/hostid"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "join")
+
+// AuthService is the subset of the Auth service interface required by the
+// JoinServer to implement joining.
+type AuthService interface {
+	ValidateToken(ctx context.Context, tokenName string) (types.ProvisionToken, error)
+	GenerateHostCertsForJoin(ctx context.Context, token provision.Token, req *HostCertsParams) (*proto.Certs, error)
+	GenerateBotCertsForJoin(ctx context.Context, token provision.Token, req *BotCertsParams) (*proto.Certs, string, error)
+	EmitAuditEvent(ctx context.Context, e apievents.AuditEvent) error
+	GetAuthPreference(ctx context.Context) (types.AuthPreference, error)
+	GetReadOnlyAuthPreference(context.Context) (readonly.AuthPreference, error)
+	GetClusterName(context.Context) (types.ClusterName, error)
+	GetCertAuthority(context.Context, types.CertAuthID, bool) (types.CertAuthority, error)
+	GetKeyStore() *keystore.Manager
+	PatchToken(context.Context, string, func(types.ProvisionToken) (types.ProvisionToken, error)) (types.ProvisionToken, error)
+	UpsertLock(context.Context, types.Lock) error
+	CheckLockInForce(constants.LockingMode, []types.LockTarget) error
+	GetClock() clockwork.Clock
+	GetHTTPClientForAWSSTS() utils.HTTPDoClient
+	GetAzureDevopsIDTokenValidator() azuredevops.Validator
+	GetBitbucketIDTokenValidator() bitbucket.Validator
+	GetEC2ClientForEC2JoinMethod() ec2join.EC2Client
+	GetCircleCITokenValidator() circleci.Validator
+	GetEnv0IDTokenValidator() Env0TokenValidator
+	GetGCPIDTokenValidator() gcp.Validator
+	GetGHAIDTokenValidator() githubactions.GithubIDTokenValidator
+	GetGHAIDTokenJWKSValidator() githubactions.GithubIDTokenJWKSValidator
+	GetGitlabIDTokenValidator() gitlab.Validator
+	GetK8sTokenReviewValidator() kubetoken.InClusterValidator
+	GetK8sJWKSValidator() kubetoken.JWKSValidator
+	GetK8sOIDCValidator() *kubetoken.KubernetesOIDCTokenValidator
+	GetSpaceliftIDTokenValidator() spacelift.Validator
+	GetTPMValidator() tpmjoin.TPMValidator
+	GetTerraformIDTokenValidator() terraformcloud.Validator
+	GetAzureJoinConfig() *azurejoin.AzureJoinConfig
+	services.Presence
+}
+
+// ServerConfig holds configuration parameters for [Server].
+type ServerConfig struct {
+	AuthService        AuthService
+	Authorizer         authz.Authorizer
+	FIPS               bool
+	OracleHTTPClient   utils.HTTPDoClient
+	ScopedTokenService services.ScopedTokenService
+}
+
+// Server implements cluster joining for nodes and bots.
+type Server struct {
+	cfg               *ServerConfig
+	oracleRootCACache *oraclejoin.RootCACache
+}
+
+// NewServer returns a new [Server] instance.
+func NewServer(cfg *ServerConfig) *Server {
+	return &Server{
+		cfg:               cfg,
+		oracleRootCACache: oraclejoin.NewRootCACache(),
+	}
+}
+
+// getProvisionToken attempts to resolve a name to a [provision.Token] by first attempting to
+// fetch a [joiningv1.ScopedToken] and then falling back to a [types.ProvisionTokenV2] if a
+// scoped token can not be found.
+func (s *Server) getProvisionToken(ctx context.Context, name string) (provision.Token, error) {
+	var scoped provision.Token
+	var scopedErr error
+
+	var classic provision.Token
+	var classicErr error
+
+	wg := &sync.WaitGroup{}
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		tok, err := s.cfg.ScopedTokenService.UseScopedToken(ctx, name)
+		if err != nil {
+			scopedErr = err
+			return
+		}
+
+		scoped, scopedErr = joining.NewToken(tok)
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		// Fetch the provision token and validate that it is not expired.
+		classic, classicErr = s.cfg.AuthService.ValidateToken(ctx, name)
+	}()
+	wg.Wait()
+
+	// we explicitly disallow a join if the provided token name returns both a scoped and classic provision token
+	if scoped != nil && classic != nil {
+		return nil, trace.AccessDenied("joining with an ambiguous token name is not permitted")
+	}
+
+	if scoped != nil {
+		return scoped, nil
+	}
+
+	if classic != nil {
+		return classic, nil
+	}
+
+	// if both errors are [trace.NotFoundError], just return a single err
+	if trace.IsNotFound(scopedErr) && trace.IsNotFound(classicErr) {
+		return nil, trace.NotFound("token expired or not found")
+	}
+
+	// prefer reporting errors other than [trace.NotFoundError]
+	if trace.IsNotFound(scopedErr) {
+		return nil, trace.Wrap(classicErr)
+	}
+
+	if trace.IsNotFound(classicErr) {
+		return nil, trace.Wrap(scopedErr)
+	}
+
+	// return both errors as an aggregate if we couldn't reasonably return one
+	return nil, trace.NewAggregate(scopedErr, classicErr)
+}
+
+// Join implements cluster joining for nodes and bots.
+//
+// It returns credentials for a node or bot to join the Teleport cluster using
+// a provision token.
+//
+// The client must request a specific role (and the role must match one of the
+// roles the token was generated for).
+//
+// If a token was generated with a TTL, it gets enforced (can't join after the
+// token expires).
+//
+// Only secret tokens are currently supported.
+// TODO(nklaassen): support all join methods.
+func (s *Server) Join(stream messages.ServerStream) (err error) {
+	ctx := stream.Context()
+	diag := stream.Diagnostic()
+	defer func() {
+		if err != nil {
+			diag.Set(func(i *diagnostic.Info) { i.Error = err })
+			handleJoinFailure(ctx, s.cfg.AuthService, diag)
+		}
+	}()
+
+	// Receive the first message from the client, which must always be ClientInit.
+	clientInit, err := messages.RecvRequest[*messages.ClientInit](stream)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Set any diagnostic info we can get from the ClientInit message.
+	diag.Set(func(i *diagnostic.Info) {
+		i.Role = joinutils.SanitizeUntrustedString(clientInit.SystemRole)
+		if clientInit.JoinMethod != nil {
+			i.RequestedJoinMethod = joinutils.SanitizeUntrustedString(*clientInit.JoinMethod)
+		}
+	})
+	if err := clientInit.Check(); err != nil {
+		return trace.Wrap(err, "validating ClientInit message")
+	}
+
+	// Authenticate the request in case the node/bot is rejoining with previous
+	// credentials.
+	authCtx, err := s.authenticate(ctx, diag, clientInit)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	token, err := s.getProvisionToken(ctx, clientInit.TokenName)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Set any diagnostic info we can get from the token.
+	diag.Set(func(i *diagnostic.Info) {
+		i.SafeTokenName = token.GetSafeName()
+		i.TokenJoinMethod = string(configuredJoinMethod(token))
+		i.TokenExpires = token.Expiry()
+		i.BotName = token.GetBotName()
+	})
+
+	// Validate that the requested join method matches the join method
+	// configured on the token, or that the client did not specify a specific
+	// join method and allow the server to choose it from the token.
+	joinMethod, err := checkJoinMethod(token, clientInit.JoinMethod)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Assert that the provision token allows the requested system role.
+	if err := TokenAllowsRole(token, types.SystemRole(clientInit.SystemRole)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if authCtx.IsInstance && authCtx.Scope != token.GetAssignedScope() {
+		return trace.BadParameter("tried to re-join instance from scope %q into %q", authCtx.Scope, token.GetAssignedScope())
+	}
+
+	authPref, err := s.cfg.AuthService.GetAuthPreference(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting cluster auth preference")
+	}
+
+	// Send the ServerInit message with the selected join method and current
+	// cluster signature algorithm suite so that the client can generate keys
+	// with the right algorithm.
+	if err := stream.Send(&messages.ServerInit{
+		JoinMethod:              string(joinMethod),
+		SignatureAlgorithmSuite: authPref.GetSignatureAlgorithmSuite(),
+	}); err != nil {
+		return trace.Wrap(err, "sending ServerInit message")
+	}
+
+	// Call out to the handler for the specific join method.
+	result, err := s.handleJoinMethod(stream, authCtx, clientInit, token, joinMethod)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Finally, send the result back to the client.
+	return trace.Wrap(stream.Send(result))
+}
+
+func (s *Server) handleJoinMethod(
+	stream messages.ServerStream,
+	authCtx *joinauthz.Context,
+	clientInit *messages.ClientInit,
+	token provision.Token,
+	joinMethod types.JoinMethod,
+) (messages.Response, error) {
+	switch joinMethod {
+	case types.JoinMethodAzure:
+		return s.handleAzureJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodAzureDevops:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateAzureDevopsToken)
+	case types.JoinMethodBitbucket:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateBitbucketToken)
+	case types.JoinMethodBoundKeypair:
+		return s.handleBoundKeypairJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodCircleCI:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateCircleCIToken)
+	case types.JoinMethodEC2:
+		return s.handleEC2Join(stream, authCtx, clientInit, token)
+	case types.JoinMethodEnv0:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateEnv0Token)
+	case types.JoinMethodGCP:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateGCPToken)
+	case types.JoinMethodGitHub:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateGithubToken)
+	case types.JoinMethodGitLab:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateGitlabToken)
+	case types.JoinMethodIAM:
+		return s.handleIAMJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodKubernetes:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateKubernetesToken)
+	case types.JoinMethodOracle:
+		return s.handleOracleJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodSpacelift:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateSpaceliftToken)
+	case types.JoinMethodTPM:
+		return s.handleTPMJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodToken:
+		return s.handleTokenJoin(stream, authCtx, clientInit, token)
+	case types.JoinMethodTerraformCloud:
+		return s.handleOIDCJoin(stream, authCtx, clientInit, token, s.validateTerraformCloudToken)
+	default:
+		// TODO(nklaassen): implement checks for all join methods.
+		return nil, trace.NotImplemented("join method %s is not yet implemented by the new join service", joinMethod)
+	}
+}
+
+func (s *Server) authenticate(ctx context.Context, diag *diagnostic.Diagnostic, clientInit *messages.ClientInit) (*joinauthz.Context, error) {
+	authCtx, err := s.cfg.Authorizer.Authorize(ctx)
+	if err != nil && !trace.IsAccessDenied(err) {
+		return nil, trace.Wrap(err, "unexpected error authorizing request")
+	}
+	if trace.IsAccessDenied(err) || authCtx == nil {
+		// No authentication or AccessDenied is okay, this is not normally an
+		// authenticated endpoint unless the client is re-joining or the
+		// request was forwarded by a proxy, just return an empty Context.
+		return &joinauthz.Context{}, nil
+	}
+	isProxy := authz.HasBuiltinRole(*authCtx, types.RoleProxy.String())
+	if !isProxy && clientInit.ProxySuppliedParams != nil {
+		return nil, trace.AccessDenied("client set ProxySuppliedParameters but did not authenticate as a proxy")
+	}
+	if clientInit.ForwardedByProxy {
+		if !isProxy {
+			return nil, trace.BadParameter("client claims to be a proxy forwarding the request but did not authenticate as a proxy (this is a bug)")
+		}
+		if clientInit.ProxySuppliedParams == nil {
+			return nil, trace.BadParameter("proxy forwarded request but did not set ProxySuppliedParams (this is a bug)")
+		}
+		diag.Set(func(i *diagnostic.Info) {
+			i.RemoteAddr = clientInit.ProxySuppliedParams.RemoteAddr
+			i.ClientVersion = clientInit.ProxySuppliedParams.ClientVersion
+		})
+		// Must ignore any authentication if the request was forwarded by a
+		// proxy to avoid forgery of a host ID or system role via the proxy
+		// credentials.
+		return &joinauthz.Context{
+			IsForwardedByProxy: true,
+		}, nil
+	}
+
+	id := authCtx.Identity.GetIdentity()
+
+	isInstance := slices.Equal(id.Groups, []string{types.RoleInstance.String()})
+	var systemRoles types.SystemRoles
+	if isInstance {
+		systemRoles, err = types.NewTeleportRoles(id.SystemRoles)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	hostID := ""
+	botInstanceID := ""
+	botGeneration := uint64(0)
+	if id.IsBot() {
+		botInstanceID = id.BotInstanceID
+		botGeneration = id.Generation
+	} else {
+		hostID = strings.SplitN(id.Username, ".", 2)[0]
+	}
+
+	// Set any diagnostic info we can get from the authenticated identity.
+	diag.Set(func(i *diagnostic.Info) {
+		i.HostID = hostID
+		i.SystemRoles = systemRoles.StringSlice()
+		i.BotInstanceID = botInstanceID
+		i.BotGeneration = botGeneration
+	})
+
+	return &joinauthz.Context{
+		IsInstance:    isInstance,
+		IsBot:         id.IsBot(),
+		SystemRoles:   systemRoles,
+		HostID:        hostID,
+		BotInstanceID: botInstanceID,
+		BotGeneration: botGeneration,
+		Scope:         id.AgentScope,
+	}, nil
+}
+
+func checkJoinMethod(token provision.Token, requestedJoinMethod *string) (types.JoinMethod, error) {
+	tokenJoinMethod := configuredJoinMethod(token)
+	if requestedJoinMethod == nil {
+		// Auto join method mode, the client didn't specify so use whatever is on the token.
+		return tokenJoinMethod, nil
+	}
+	if types.JoinMethod(*requestedJoinMethod) != tokenJoinMethod {
+		return "", trace.BadParameter(
+			"client requested join method %s, provision token only supports method %s",
+			*requestedJoinMethod, tokenJoinMethod)
+	}
+	return tokenJoinMethod, nil
+}
+
+// TokenAllowsRole asserts that the given provision token allows the
+// requested role, or else it returns an error.
+func TokenAllowsRole(token provision.Token, role types.SystemRole) error {
+	// Instance certs can be requested if the provision token allows at least
+	// one local service role (e.g. proxy, node, etc).
+	if role == types.RoleInstance {
+		hasLocalServiceRole := false
+		for _, role := range token.GetRoles() {
+			if role.IsLocalService() {
+				hasLocalServiceRole = true
+				break
+			}
+		}
+		if !hasLocalServiceRole {
+			return trace.AccessDenied("cannot requisition instance certs (token contains no local service roles)")
+		}
+	}
+
+	// Make sure the caller is requesting a role allowed by the token.
+	if !token.GetRoles().Include(role) && role != types.RoleInstance {
+		return trace.BadParameter("can not join the cluster, the token does not allow role %s", role)
+	}
+
+	return nil
+}
+
+func (s *Server) makeResult(
+	ctx context.Context,
+	diag *diagnostic.Diagnostic,
+	authCtx *joinauthz.Context,
+	clientInit *messages.ClientInit,
+	clientParams *messages.ClientParams,
+	token provision.Token,
+	rawClaims any,
+	attrs *workloadidentityv1pb.JoinAttrs,
+) (messages.Response, error) {
+	switch types.SystemRole(clientInit.SystemRole) {
+	case types.RoleInstance:
+		return s.makeHostResult(ctx, diag, authCtx, clientParams.HostParams, token, rawClaims)
+	case types.RoleBot:
+		result, _, err := s.makeBotResult(ctx, diag, authCtx, clientParams.BotParams, token, rawClaims, attrs)
+		return result, trace.Wrap(err)
+	default:
+		return nil, trace.NotImplemented("new join service only supports Instance and Bot system roles, client requested %s", clientInit.SystemRole)
+	}
+}
+
+func (s *Server) makeHostResult(
+	ctx context.Context,
+	diag *diagnostic.Diagnostic,
+	authCtx *joinauthz.Context,
+	hostParams *messages.HostParams,
+	token provision.Token,
+	rawClaims any,
+) (*messages.HostResult, error) {
+	certsParams, err := makeHostCertsParams(ctx, diag, authCtx, hostParams, configuredJoinMethod(token), token.GetAssignedScope(), rawClaims)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	certs, err := s.cfg.AuthService.GenerateHostCertsForJoin(ctx, token, certsParams)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	certificates, err := convertCerts(certs)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.HostResult{
+		Certificates: *certificates,
+		HostID:       certsParams.HostID,
+	}, nil
+}
+
+// MakeHostCertsParams returns [HostCertsParams] populated by the ClientInit
+// message and context of the request.
+func makeHostCertsParams(
+	ctx context.Context,
+	diag *diagnostic.Diagnostic,
+	authCtx *joinauthz.Context,
+	hostParams *messages.HostParams,
+	joinMethod types.JoinMethod,
+	scope string,
+	rawClaims any,
+) (*HostCertsParams, error) {
+	// GenerateHostCertsForJoin requires the TLS key to be PEM-encoded.
+	tlsPub, err := x509.ParsePKIXPublicKey(hostParams.PublicKeys.PublicTLSKey)
+	if err != nil {
+		return nil, trace.BadParameter("failed to parse TLS public key")
+	}
+	tlsPubPEM, err := keys.MarshalPublicKey(crypto.PublicKey(tlsPub))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// GenerateHostCertsForJoin requires the SSH key to be in authorized keys format.
+	sshPub, err := ssh.ParsePublicKey(hostParams.PublicKeys.PublicSSHKey)
+	if err != nil {
+		return nil, trace.BadParameter("failed to parse SSH public key")
+	}
+	sshAuthorizedKey := ssh.MarshalAuthorizedKey(sshPub)
+
+	params := &HostCertsParams{
+		SystemRole:           types.RoleInstance,
+		PublicTLSKey:         tlsPubPEM,
+		PublicSSHKey:         sshAuthorizedKey,
+		HostName:             hostParams.HostName,
+		AdditionalPrincipals: hostParams.AdditionalPrincipals,
+		DNSNames:             hostParams.DNSNames,
+		RemoteAddr:           diag.Get().RemoteAddr,
+		RawJoinClaims:        rawClaims,
+	}
+
+	if authCtx.IsInstance {
+		// Only authenticated Instance certs are allowed to re-join and
+		// maintain their existing host ID and authenticate additional system
+		// roles.
+		params.HostID = authCtx.HostID
+		params.AuthenticatedSystemRoles = authCtx.SystemRoles
+	} else if joinMethod == types.JoinMethodEC2 {
+		// EC2 join method uses a special host ID format that will be set in
+		// authCtx by the EC2 method handler.
+		params.HostID = authCtx.HostID
+	} else {
+		// Generate a new host ID to assign to the client.
+		hostID, err := hostid.Generate(ctx, joinMethod)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		params.HostID = hostID
+	}
+
+	return params, nil
+}
+
+func (s *Server) makeBotResult(
+	ctx context.Context,
+	diag *diagnostic.Diagnostic,
+	authCtx *joinauthz.Context,
+	botParams *messages.BotParams,
+	token provision.Token,
+	rawClaims any,
+	attrs *workloadidentityv1pb.JoinAttrs,
+) (*messages.BotResult, string, error) {
+	certsParams, err := makeBotCertsParams(diag, authCtx, botParams, rawClaims, attrs)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	certs, botInstanceID, err := s.cfg.AuthService.GenerateBotCertsForJoin(ctx, token, certsParams)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	certificates, err := convertCerts(certs)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	return &messages.BotResult{
+		Certificates: *certificates,
+	}, botInstanceID, nil
+}
+
+// makeBotCertsParams returns [BotCertsParams] populated by the
+// ClientInit message and context of the request.
+func makeBotCertsParams(
+	diag *diagnostic.Diagnostic,
+	authCtx *joinauthz.Context,
+	botParams *messages.BotParams,
+	rawClaims any,
+	attrs *workloadidentityv1pb.JoinAttrs,
+) (*BotCertsParams, error) {
+	// GenerateBotCertsForJoin requires the TLS key to be PEM-encoded.
+	tlsPub, err := x509.ParsePKIXPublicKey(botParams.PublicKeys.PublicTLSKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsPubPEM, err := keys.MarshalPublicKey(crypto.PublicKey(tlsPub))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// GenerateBotCertsForJoin requires the SSH key to be in authorized keys format.
+	sshPub, err := ssh.ParsePublicKey(botParams.PublicKeys.PublicSSHKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshAuthorizedKey := ssh.MarshalAuthorizedKey(sshPub)
+
+	return &BotCertsParams{
+		PublicTLSKey:  tlsPubPEM,
+		PublicSSHKey:  sshAuthorizedKey,
+		BotInstanceID: authCtx.BotInstanceID,
+		BotGeneration: int32(authCtx.BotGeneration),
+		Expires:       botParams.Expires,
+		RemoteAddr:    diag.Get().RemoteAddr,
+		RawJoinClaims: rawClaims,
+		Attrs:         attrs,
+	}, nil
+}
+
+// convertCerts converts the PEM-encoded TLS certs and the authorized_keys
+// formats SSH cert + keys into the wire formats required for
+// [messages.Certificates].
+func convertCerts(certs *proto.Certs) (*messages.Certificates, error) {
+	sshCert, err := rawSSHCert(certs.SSH)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// certs.SSHCACerts is a misnomer, SSH CAs are just public keys, not certificates.
+	sshCAKeys, err := rawSSHPublicKeys(certs.SSHCACerts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &messages.Certificates{
+		TLSCert:    rawTLSCert(certs.TLS),
+		TLSCACerts: rawTLSCerts(certs.TLSCACerts),
+		SSHCert:    sshCert,
+		SSHCAKeys:  sshCAKeys,
+	}, nil
+}
+
+// rawTLSCerts converts a slice of PEM-encoded TLS certificates to the raw ASN.1
+// DER form as required by [Result].
+func rawTLSCerts(pemBytes [][]byte) [][]byte {
+	out := make([][]byte, len(pemBytes))
+	for i, bytes := range pemBytes {
+		out[i] = rawTLSCert(bytes)
+	}
+	return out
+}
+
+// rawTLSCert converts a PEM-encoded TLS certificate to the raw ASN.1 DER form
+// as required by [Result].
+func rawTLSCert(pemBytes []byte) []byte {
+	pemBlock, _ := pem.Decode(pemBytes)
+	return pemBlock.Bytes
+}
+
+// rawSSHCert converts an SSH certificate or public key in SSH authorized_keys
+// format to the SSH wire format as required by [messages.Result].
+func rawSSHCert(authorizedKey []byte) ([]byte, error) {
+	pub, _, _, _, err := ssh.ParseAuthorizedKey(authorizedKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return pub.Marshal(), nil
+}
+
+// rawSSHPublicKeys converts a slices of SSH public keys in SSH authorized_keys
+// format to the SSH wire format as required by [messages.Result].
+func rawSSHPublicKeys(authorizedKeys [][]byte) ([][]byte, error) {
+	out := make([][]byte, len(authorizedKeys))
+	for i, authorizedKey := range authorizedKeys {
+		var err error
+		out[i], err = rawSSHCert(authorizedKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return out, nil
+}
+
+func setDiagnosticClientParams(diag *diagnostic.Diagnostic, clientParams *messages.ClientParams) {
+	if clientParams.HostParams != nil {
+		diag.Set(func(i *diagnostic.Info) {
+			i.NodeName = joinutils.SanitizeUntrustedString(clientParams.HostParams.HostName)
+		})
+	}
+}
+
+func handleJoinFailure(ctx context.Context, emitter apievents.Emitter, diag *diagnostic.Diagnostic) {
+	diagInfo := diag.Get()
+	slogAttrs := diagInfo.SlogAttrs()
+
+	// Fetch and encode RawJoinAttrs if they are available.
+	attributesStruct, err := joinutils.RawJoinAttrsToStruct(diagInfo.RawJoinAttrs)
+	if err != nil {
+		log.WarnContext(ctx, "Unable to fetch join attributes from join method", "error", err)
+	}
+	if attributesStruct != nil {
+		slogAttrs = append(slogAttrs, slog.Any("attributes", attributesStruct))
+	}
+
+	log.LogAttrs(ctx, slog.LevelWarn, "Failure to join cluster occurred", slogAttrs...)
+	if err := emitter.EmitAuditEvent(context.WithoutCancel(ctx), makeAuditEvent(diagInfo, attributesStruct)); err != nil {
+		log.WarnContext(ctx, "Failed to emit failed join event", "error", err)
+	}
+}
+
+func makeAuditEvent(info diagnostic.Info, attributesStruct *apievents.Struct) apievents.AuditEvent {
+	errorMessage := info.Error.Error()
+	if errors.Is(info.Error, context.Canceled) || status.Code(info.Error) == codes.Canceled {
+		errorMessage = "join attempt timed out or was aborted"
+	}
+	status := apievents.Status{
+		Success: false,
+		Error:   errorMessage,
+	}
+	if info.Role == types.RoleBot.String() {
+		return &apievents.BotJoin{
+			Metadata: apievents.Metadata{
+				Type: events.BotJoinEvent,
+				Code: events.BotJoinFailureCode,
+				Time: time.Now(),
+			},
+			Status: status,
+			ConnectionMetadata: apievents.ConnectionMetadata{
+				RemoteAddr: info.RemoteAddr,
+			},
+			Method:        cmp.Or(info.TokenJoinMethod, info.RequestedJoinMethod),
+			TokenName:     info.SafeTokenName,
+			BotName:       info.BotName,
+			BotInstanceID: info.BotInstanceID,
+			Attributes:    attributesStruct,
+		}
+	}
+	return &apievents.InstanceJoin{
+		Metadata: apievents.Metadata{
+			Type: events.InstanceJoinEvent,
+			Code: events.InstanceJoinFailureCode,
+			Time: time.Now(),
+		},
+		Status: status,
+		ConnectionMetadata: apievents.ConnectionMetadata{
+			RemoteAddr: info.RemoteAddr,
+		},
+		Method:       cmp.Or(info.TokenJoinMethod, info.RequestedJoinMethod),
+		TokenName:    info.SafeTokenName,
+		TokenExpires: info.TokenExpires,
+		Role:         info.Role,
+		NodeName:     info.NodeName,
+		Attributes:   attributesStruct,
+	}
+}
+
+func configuredJoinMethod(token provision.Token) types.JoinMethod {
+	method := token.GetJoinMethod()
+	if method == types.JoinMethodUnspecified {
+		return types.JoinMethodToken
+	}
+	return method
+}
diff --git a/lib/join/server_azure.go b/lib/join/server_azure.go
new file mode 100644
index 0000000000000..c0687eb8753cd
--- /dev/null
+++ b/lib/join/server_azure.go
@@ -0,0 +1,118 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"github.com/gravitational/trace"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/azurejoin"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleAzureJoin handles join attempts for the Azure join method.
+//
+// The Azure join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server AzureInit
+// client<-server AzureChallenge
+// client->server AzureChallengeSolution
+// client<-server Result
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the AzureInit message, handle the challenge-response, and send the
+// final result if everything checks out.
+func (s *Server) handleAzureJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	token provision.Token,
+) (messages.Response, error) {
+	// Receive the AzureInit message from the client.
+	azureInit, err := messages.RecvRequest[*messages.AzureInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving AzureInit message")
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &azureInit.ClientParams)
+
+	// Generate and send the challenge.
+	challenge, err := azurejoin.GenerateAzureChallenge()
+	if err != nil {
+		return nil, trace.Wrap(err, "generating challenge")
+	}
+	if err := stream.Send(&messages.AzureChallenge{
+		Challenge: challenge,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending AzureChallenge")
+	}
+
+	// Receive the solution from the client.
+	solution, err := messages.RecvRequest[*messages.AzureChallengeSolution](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving AzureChallengeSolution")
+	}
+
+	switch {
+	case len(solution.AttestedData) == 0:
+		return nil, trace.BadParameter("client did not send attested data")
+	case len(solution.Intermediate) == 0:
+		return nil, trace.BadParameter("client did not send intermediate CAs")
+	case len(solution.AccessToken) == 0:
+		return nil, trace.BadParameter("client did not send access token")
+	}
+
+	ptv2, ok := token.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("Azure join method only supports ProvisionTokenV2, got %T", token)
+	}
+
+	// Verify the client's identity and make sure it matches an allow rule in the provision token.
+	claims, err := azurejoin.CheckAzureRequest(stream.Context(), azurejoin.CheckAzureRequestParams{
+		AzureJoinConfig: s.cfg.AuthService.GetAzureJoinConfig(),
+		Token:           ptv2,
+		Challenge:       challenge,
+		AttestedData:    solution.AttestedData,
+		Intermediate:    solution.Intermediate,
+		AccessToken:     solution.AccessToken,
+		Logger:          log,
+		Clock:           s.cfg.AuthService.GetClock(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "checking Azure challenge solution")
+	}
+
+	// Make and return the final result message.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&azureInit.ClientParams,
+		token,
+		nil, // rawClaims
+		&workloadidentityv1pb.JoinAttrs{
+			Azure: claims,
+		},
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_azuredevops.go b/lib/join/server_azuredevops.go
new file mode 100644
index 0000000000000..2b535edcf203a
--- /dev/null
+++ b/lib/join/server_azuredevops.go
@@ -0,0 +1,57 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/azuredevops"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+func (s *Server) validateAzureDevopsToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	ptv2, ok := pt.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, nil, trace.BadParameter("Azure Devops joining only supports ProvisionTokenV2, got %T", pt)
+	}
+
+	claims, err := azuredevops.CheckIDToken(ctx, &azuredevops.CheckIDTokenParams{
+		ProvisionToken: ptv2,
+		IDToken:        string(idToken),
+		Validator:      s.cfg.AuthService.GetAzureDevopsIDTokenValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			AzureDevops: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_bitbucket.go b/lib/join/server_bitbucket.go
new file mode 100644
index 0000000000000..5b6546f99a9d6
--- /dev/null
+++ b/lib/join/server_bitbucket.go
@@ -0,0 +1,54 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/bitbucket"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+func (a *Server) validateBitbucketToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := bitbucket.CheckIDToken(ctx, &bitbucket.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetBitbucketIDTokenValidator(),
+		Clock:          a.cfg.AuthService.GetClock(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Bitbucket: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_boundkeypair.go b/lib/join/server_boundkeypair.go
new file mode 100644
index 0000000000000..38d9f152ce993
--- /dev/null
+++ b/lib/join/server_boundkeypair.go
@@ -0,0 +1,310 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/boundkeypair"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleBoundKeypairJoin handles join attempts for the bound keypair join
+// method.
+//
+// The bound keypair join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server BoundKeypairInit
+// client<-server BoundKeypairChallenge
+// client->server BoundKeypairChallengeSolution
+//
+//	(optional additional steps if keypair rotation is required)
+//	client<-server: BoundKeypairRotationRequest
+//	client->server: BoundKeypairRotationResponse
+//	client<-server: BoundKeypairChallenge
+//	client->server: BoundKeypairChallengeSolution
+//
+// client<-server: Result containing BoundKeypairResult
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the BoundKeypairInit message, handle the challenge-response (and
+// rotation if necessary), and send the final result if everything checks out.
+func (s *Server) handleBoundKeypairJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	token provision.Token,
+) (*messages.BotResult, error) {
+	ctx := stream.Context()
+	diag := stream.Diagnostic()
+	// Only bot joining is supported at the moment - unique ID verification is
+	// required and this is currently only implemented for bots.
+	if clientInit.SystemRole != types.RoleBot.String() {
+		return nil, trace.BadParameter("bound keypair joining is only supported for bots")
+	}
+
+	// Scoped tokens currently validate against being created with the bot role, but just in case
+	// we'll check and return a more helpful error message if one happens to make it through.
+	if token.GetAssignedScope() != "" {
+		return nil, trace.BadParameter("bound keypair joining is not supported by scoped tokens")
+	}
+
+	boundKeypairInit, err := messages.RecvRequest[*messages.BoundKeypairInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	issueChallenge := func(challenge *messages.BoundKeypairChallenge) (*messages.BoundKeypairChallengeSolution, error) {
+		if err := stream.Send(challenge); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		solution, err := messages.RecvRequest[*messages.BoundKeypairChallengeSolution](stream)
+		return solution, trace.Wrap(err)
+	}
+	issueRotationRequest := func(rotationReq *messages.BoundKeypairRotationRequest) (*messages.BoundKeypairRotationResponse, error) {
+		if err := stream.Send(rotationReq); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		rotationResp, err := messages.RecvRequest[*messages.BoundKeypairRotationResponse](stream)
+		return rotationResp, trace.Wrap(err)
+	}
+	generateBotCerts := func(ctx context.Context, previousBotInstanceID string, claims any) (*messages.Certificates, string, error) {
+		botCertsParams, err := makeBotCertsParams(
+			diag,
+			authCtx,
+			boundKeypairInit.ClientParams.BotParams,
+			claims,
+			nil, // TODO(timothyb89): workload id claims
+		)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		botCertsParams.PreviousBotInstanceID = previousBotInstanceID
+		protoCerts, botInstanceID, err := s.cfg.AuthService.GenerateBotCertsForJoin(ctx, token, botCertsParams)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		botCerts, err := convertCerts(protoCerts)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		return botCerts, botInstanceID, nil
+	}
+	return boundkeypair.HandleBoundKeypairJoin(ctx, &boundkeypair.JoinParams{
+		AuthService:          s.cfg.AuthService,
+		AuthCtx:              authCtx,
+		Diag:                 diag,
+		ProvisionToken:       token,
+		ClientInit:           clientInit,
+		BoundKeypairInit:     boundKeypairInit,
+		IssueChallenge:       issueChallenge,
+		IssueRotationRequest: issueRotationRequest,
+		GenerateBotCerts:     generateBotCerts,
+		Clock:                s.cfg.AuthService.GetClock(),
+		Logger:               log,
+	})
+}
+
+// AdaptRegisterUsingBoundKeypairMethod handles requests from the legacy join
+// gRPC service and adapts the request types to the protocol-agnostic types
+// defined in [messages] before calling [boundkeypair.HandleBoundKeypairJoin]
+// which contains the actual logic for bound keypair joining.
+//
+// TODO(nklaassen): DELETE IN 20 when removing the legacy join service.
+func AdaptRegisterUsingBoundKeypairMethod(
+	ctx context.Context,
+	a AuthService,
+	createBoundKeypairValidator boundkeypair.CreateBoundKeypairValidator,
+	req *proto.RegisterUsingBoundKeypairInitialRequest,
+	challengeResponse client.RegisterUsingBoundKeypairChallengeResponseFunc,
+) (_ *client.BoundKeypairRegistrationResponse, err error) {
+	diag := diagnostic.New()
+	diag.Set(func(i *diagnostic.Info) {
+		i.RemoteAddr = req.JoinRequest.RemoteAddr
+		i.Role = joinutils.SanitizeUntrustedString(req.JoinRequest.Role.String())
+		i.RequestedJoinMethod = string(types.JoinMethodBoundKeypair)
+		i.BotInstanceID = req.JoinRequest.BotInstanceID
+		i.BotGeneration = uint64(req.JoinRequest.BotGeneration)
+	})
+	defer func() {
+		if err != nil {
+			diag.Set(func(i *diagnostic.Info) { i.Error = err })
+			handleJoinFailure(ctx, a, diag)
+		}
+	}()
+
+	if legacyjoin.Disabled() {
+		return nil, trace.Wrap(legacyjoin.ErrDisabled)
+	}
+
+	// Construct an [authz.Context] to pass to HandleBoundKeypairJoin.
+	authCtx := &authz.Context{
+		// These are verified at the gRPC layer by the legacy join service.
+		BotInstanceID: req.JoinRequest.BotInstanceID,
+		BotGeneration: uint64(req.JoinRequest.BotGeneration),
+	}
+
+	// Only bot joining is supported at the moment - unique ID verification is
+	// required and this is currently only implemented for bots.
+	if req.JoinRequest.Role != types.RoleBot {
+		return nil, trace.BadParameter("bound keypair joining is only supported for bots")
+	}
+
+	provisionToken, err := a.ValidateToken(ctx, req.JoinRequest.Token)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Set any diagnostic info we can get from the token.
+	diag.Set(func(i *diagnostic.Info) {
+		i.SafeTokenName = provisionToken.GetSafeName()
+		i.TokenJoinMethod = string(provisionToken.GetJoinMethod())
+		i.TokenExpires = provisionToken.Expiry()
+		i.BotName = provisionToken.GetBotName()
+	})
+	if provisionToken.GetJoinMethod() != types.JoinMethodBoundKeypair {
+		return nil, trace.BadParameter("specified join token is not for `%s` method", types.JoinMethodBoundKeypair)
+	}
+
+	// Assert that the provision token allows the requested system role.
+	if err := TokenAllowsRole(provisionToken, req.JoinRequest.Role); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clientInit := clientInitFromRegisterUsingTokenRequest(req.JoinRequest, string(types.JoinMethodBoundKeypair))
+	clientParams, err := clientParamsFromRegisterUsingTokenRequest(req.JoinRequest)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	boundKeypairInit := &messages.BoundKeypairInit{
+		ClientParams:      *clientParams,
+		InitialJoinSecret: req.InitialJoinSecret,
+		PreviousJoinState: req.PreviousJoinState,
+	}
+
+	generateBotCerts := func(ctx context.Context, previousBotInstanceID string, claims any) (*messages.Certificates, string, error) {
+		botCertsParams, err := makeBotCertsParams(
+			diag,
+			authCtx,
+			clientParams.BotParams,
+			claims,
+			nil, // TODO(timothyb89): workload id claims
+		)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		botCertsParams.PreviousBotInstanceID = previousBotInstanceID
+		protoCerts, botInstanceID, err := a.GenerateBotCertsForJoin(ctx, provisionToken, botCertsParams)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		botCerts, err := convertCerts(protoCerts)
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		return botCerts, botInstanceID, nil
+	}
+
+	botResult, err := boundkeypair.HandleBoundKeypairJoin(ctx, &boundkeypair.JoinParams{
+		AuthService:                 a,
+		AuthCtx:                     authCtx,
+		Diag:                        diag,
+		ProvisionToken:              provisionToken,
+		ClientInit:                  clientInit,
+		BoundKeypairInit:            boundKeypairInit,
+		IssueChallenge:              adaptBoundKeypairChallenge(challengeResponse),
+		IssueRotationRequest:        adaptBoundKeypairRotationRequest(challengeResponse),
+		CreateBoundKeypairValidator: createBoundKeypairValidator,
+		GenerateBotCerts:            generateBotCerts,
+		Clock:                       a.GetClock(),
+		Logger:                      log,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	certs, err := protoCertsFromCertificates(botResult.Certificates)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &client.BoundKeypairRegistrationResponse{
+		Certs:          certs,
+		BoundPublicKey: string(botResult.BoundKeypairResult.PublicKey),
+		JoinState:      botResult.BoundKeypairResult.JoinState,
+	}, nil
+}
+
+func adaptBoundKeypairChallenge(challengeResponseFunc client.RegisterUsingBoundKeypairChallengeResponseFunc) boundkeypair.ChallengeResponseFunc {
+	return func(challengeMsg *messages.BoundKeypairChallenge) (*messages.BoundKeypairChallengeSolution, error) {
+		challenge := &proto.RegisterUsingBoundKeypairMethodResponse{
+			Response: &proto.RegisterUsingBoundKeypairMethodResponse_Challenge{
+				Challenge: &proto.RegisterUsingBoundKeypairChallenge{
+					PublicKey: string(challengeMsg.PublicKey),
+					Challenge: challengeMsg.Challenge,
+				},
+			},
+		}
+		resp, err := challengeResponseFunc(challenge)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		challengeResp := resp.GetChallengeResponse()
+		if challengeResp == nil {
+			return nil, trace.BadParameter("client did not send challenge response, got %T", resp.Payload)
+		}
+		return &messages.BoundKeypairChallengeSolution{
+			Solution: challengeResp.Solution,
+		}, nil
+	}
+}
+
+func adaptBoundKeypairRotationRequest(challengeResponseFunc client.RegisterUsingBoundKeypairChallengeResponseFunc) boundkeypair.RotationFunc {
+	return func(rotationMsg *messages.BoundKeypairRotationRequest) (*messages.BoundKeypairRotationResponse, error) {
+		suite, err := types.SignatureAlgorithmSuiteFromString(rotationMsg.SignatureAlgorithmSuite)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		challenge := &proto.RegisterUsingBoundKeypairMethodResponse{
+			Response: &proto.RegisterUsingBoundKeypairMethodResponse_Rotation{
+				Rotation: &proto.RegisterUsingBoundKeypairRotationRequest{
+					SignatureAlgorithmSuite: suite,
+				},
+			},
+		}
+		resp, err := challengeResponseFunc(challenge)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		rotationResp := resp.GetRotationResponse()
+		if rotationResp == nil {
+			return nil, trace.BadParameter("client did not send rotation response, got %T", resp.Payload)
+		}
+		return &messages.BoundKeypairRotationResponse{
+			PublicKey: []byte(rotationResp.PublicKey),
+		}, nil
+	}
+}
diff --git a/lib/join/server_circleci.go b/lib/join/server_circleci.go
new file mode 100644
index 0000000000000..346fd283ef223
--- /dev/null
+++ b/lib/join/server_circleci.go
@@ -0,0 +1,53 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/circleci"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+func (a *Server) validateCircleCIToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := circleci.CheckIDToken(ctx, &circleci.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetCircleCITokenValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Circleci: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_ec2.go b/lib/join/server_ec2.go
new file mode 100644
index 0000000000000..159cf4eb4b632
--- /dev/null
+++ b/lib/join/server_ec2.go
@@ -0,0 +1,90 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/ec2join"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleEC2Join handles join attempts for the IAM join method.
+//
+// The EC2 join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server EC2Init
+// client<-server Result
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the EC2Init message, check the request EC2 join request
+// invariants, and send the final result if everything checks out.
+func (s *Server) handleEC2Join(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	provisionToken provision.Token,
+) (messages.Response, error) {
+	// Receive the EC2Init message from the client.
+	ec2Init, err := messages.RecvRequest[*messages.EC2Init](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving EC2Init message")
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &ec2Init.ClientParams)
+
+	var requestedHostID *string
+	if authCtx.HostID != "" {
+		requestedHostID = &authCtx.HostID
+	}
+
+	hostID, err := ec2join.CheckEC2Request(stream.Context(), &ec2join.CheckEC2RequestParams{
+		ProvisionToken:  provisionToken,
+		Role:            types.SystemRole(clientInit.SystemRole),
+		RequestedHostID: requestedHostID,
+		Document:        ec2Init.Document,
+		Presence:        s.cfg.AuthService,
+		EC2Client:       s.cfg.AuthService.GetEC2ClientForEC2JoinMethod(),
+		Clock:           s.cfg.AuthService.GetClock(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "checking EC2 join attempt")
+	}
+
+	// At this point the request has been authenticated and the host ID
+	// returned by CheckEC2Request is legitimate. Set authCtx.HostID so that
+	// s.makeResult uses the EC2-format host ID instead of generating a UUID.
+	authCtx.HostID = hostID
+
+	// Make and return the final result message.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&ec2Init.ClientParams,
+		provisionToken,
+		nil, // ec2 method has no claims
+		nil, // ec2 method has no attrs
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_env0.go b/lib/join/server_env0.go
new file mode 100644
index 0000000000000..838b7a6fc7c74
--- /dev/null
+++ b/lib/join/server_env0.go
@@ -0,0 +1,104 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/env0"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+type Env0TokenValidator interface {
+	ValidateToken(
+		ctx context.Context,
+		token []byte,
+	) (*env0.IDTokenClaims, error)
+}
+
+// validateEnv0Token performs OIDC token verification for Env0-type JWTs,
+// suitable for use in `handleOIDCJoin`
+func (s *Server) validateEnv0Token(
+	ctx context.Context,
+	provisionToken provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	verifiedIdentity, err := s.cfg.AuthService.GetEnv0IDTokenValidator().ValidateToken(ctx, idToken)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "validating Env0 OIDC token")
+	}
+
+	ptv2, ok := provisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, nil, trace.BadParameter("expected *types.ProvisionTokenV2, got %T", provisionToken)
+	}
+
+	if err := checkEnv0AllowRules(ptv2, verifiedIdentity); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return verifiedIdentity, &workloadidentityv1.JoinAttrs{
+		Env0: verifiedIdentity.JoinAttrs(),
+	}, nil
+}
+
+func checkEnv0AllowRules(token *types.ProvisionTokenV2, claims *env0.IDTokenClaims) error {
+	for _, rule := range token.Spec.Env0.Allow {
+		if rule.OrganizationID != "" && claims.OrganizationID != rule.OrganizationID {
+			continue
+		}
+		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
+			continue
+		}
+		if rule.ProjectName != "" && claims.ProjectName != rule.ProjectName {
+			continue
+		}
+		if rule.TemplateID != "" && claims.TemplateID != rule.TemplateID {
+			continue
+		}
+		if rule.TemplateName != "" && claims.TemplateName != rule.TemplateName {
+			continue
+		}
+		if rule.EnvironmentID != "" && claims.EnvironmentID != rule.EnvironmentID {
+			continue
+		}
+		if rule.EnvironmentName != "" && claims.EnvironmentName != rule.EnvironmentName {
+			continue
+		}
+		if rule.WorkspaceName != "" && claims.WorkspaceName != rule.WorkspaceName {
+			continue
+		}
+		if rule.DeploymentType != "" && claims.DeploymentType != rule.DeploymentType {
+			continue
+		}
+		if rule.DeployerEmail != "" && claims.DeployerEmail != rule.DeployerEmail {
+			continue
+		}
+		if rule.Env0Tag != "" && claims.Env0Tag != rule.Env0Tag {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/join/server_env0_test.go b/lib/join/server_env0_test.go
new file mode 100644
index 0000000000000..196d874bf0919
--- /dev/null
+++ b/lib/join/server_env0_test.go
@@ -0,0 +1,486 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/join/env0"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+)
+
+type mockEnv0Validator struct {
+	claims  *env0.IDTokenClaims
+	idToken string
+}
+
+func (m *mockEnv0Validator) ValidateToken(ctx context.Context, token []byte) (*env0.IDTokenClaims, error) {
+	if string(token) == m.idToken {
+		return m.claims, nil
+	}
+
+	return nil, trace.AccessDenied("invalid token")
+}
+
+type env0JoinTestCase struct {
+	desc             string
+	tokenName        string
+	requestTokenName string
+	tokenSpec        types.ProvisionTokenSpecV2
+	oidcToken        string
+	validator        *mockEnv0Validator
+	assertError      require.ErrorAssertionFunc
+}
+
+func TestJoinEnv0(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, authServer.Shutdown(ctx)) })
+
+	// Define some fake names and IDs the fake "provider" will issue.
+	const (
+		defaultSubject         = "subject"
+		defaultOrganizationID  = "organization-id"
+		defaultProjectID       = "project-id"
+		defaultProjectName     = "project-name"
+		defaultTemplateID      = "template-id"
+		defaultTemplateName    = "template-name"
+		defaultEnvironmentID   = "environment-id "
+		defaultEnvironmentName = "environment-name"
+		defaultWorkspaceName   = "workspace-name"
+		defaultDeploymentType  = "deployment-type"
+		defaultDeployerEmail   = "deployer-email"
+		defaultCustomTag       = "custom-tag"
+	)
+	validator := func(expectToken string, mutator ...func(*env0.IDTokenClaims)) *mockEnv0Validator {
+		claims := &env0.IDTokenClaims{
+			TokenClaims: oidc.TokenClaims{
+				Subject: defaultSubject,
+			},
+			OrganizationID:  defaultOrganizationID,
+			ProjectID:       defaultProjectID,
+			ProjectName:     defaultProjectName,
+			TemplateID:      defaultTemplateID,
+			TemplateName:    defaultTemplateName,
+			EnvironmentID:   defaultEnvironmentID,
+			EnvironmentName: defaultEnvironmentName,
+			WorkspaceName:   defaultWorkspaceName,
+			DeploymentType:  defaultDeploymentType,
+			DeployerEmail:   defaultDeployerEmail,
+			Env0Tag:         defaultCustomTag,
+			DeploymentLogID: "foo",
+		}
+		for _, m := range mutator {
+			m(claims)
+		}
+
+		return &mockEnv0Validator{
+			idToken: expectToken,
+			claims:  claims,
+		}
+	}
+
+	isAccessDenied := func(t require.TestingT, err error, msgAndArgs ...any) {
+		require.ErrorAs(t, err, new(*trace.AccessDeniedError), msgAndArgs...)
+	}
+
+	testCases := []env0JoinTestCase{
+		{
+			desc:             "basic passing case",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+						},
+					},
+				},
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "passes with all rules configured",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							// Include a rule that won't match for good measure.
+							OrganizationID: "nope",
+							ProjectName:    "also nope",
+						},
+						{
+							OrganizationID:  defaultOrganizationID,
+							ProjectID:       defaultProjectID,
+							ProjectName:     defaultProjectName,
+							TemplateID:      defaultTemplateID,
+							TemplateName:    defaultTemplateName,
+							EnvironmentID:   defaultEnvironmentID,
+							EnvironmentName: defaultEnvironmentName,
+							WorkspaceName:   defaultWorkspaceName,
+							DeploymentType:  defaultDeploymentType,
+							DeployerEmail:   defaultDeployerEmail,
+							Env0Tag:         defaultCustomTag,
+						},
+					},
+				},
+			},
+			assertError: require.NoError,
+		},
+		{
+			desc:             "requested wrong token",
+			tokenName:        "test-token",
+			requestTokenName: "wrong-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "oidc token fails validation",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "invalid-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong organization",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: "other-org-id",
+							ProjectID:      defaultProjectID,
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong project id",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      "other-project-id",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong project name",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							ProjectName:    "other-project-name",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong template id",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							TemplateID:     "other-template-id",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong template name",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							TemplateName:   "other-template-name",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong environment id",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							EnvironmentID:  "other-environment-id",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong environment name",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID:  defaultOrganizationID,
+							ProjectID:       defaultProjectID,
+							EnvironmentName: "other-environment-name",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong workspace name",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							WorkspaceName:  "other-workspace-name",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong deployment type",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							DeploymentType: "other-deployment-type",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong deployer email",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							DeployerEmail:  "other-deployer-email",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+		{
+			desc:             "wrong custom tag",
+			tokenName:        "test-token",
+			requestTokenName: "test-token",
+			oidcToken:        "correct-token",
+			validator:        validator("correct-token"),
+			tokenSpec: types.ProvisionTokenSpecV2{
+				Roles:      []types.SystemRole{types.RoleNode},
+				JoinMethod: types.JoinMethodEnv0,
+				Env0: &types.ProvisionTokenSpecV2Env0{
+					Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+						{
+							OrganizationID: defaultOrganizationID,
+							ProjectID:      defaultProjectID,
+							Env0Tag:        "other-custom-tag",
+						},
+					},
+				},
+			},
+			assertError: isAccessDenied,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			testEnv0Join(t, authServer, &tc)
+		})
+	}
+}
+
+func testEnv0Join(t *testing.T, authServer *authtest.Server, tc *env0JoinTestCase) {
+	ctx := t.Context()
+	// Set mock client.
+	authServer.Auth().SetEnv0IDTokenValidator(tc.validator)
+
+	// Add token to auth server.
+	token, err := types.NewProvisionTokenFromSpec(
+		tc.tokenName,
+		time.Now().Add(time.Minute),
+		tc.tokenSpec)
+	require.NoError(t, err)
+	require.NoError(t, authServer.Auth().UpsertToken(ctx, token))
+	t.Cleanup(func() {
+		assert.NoError(t, authServer.Auth().DeleteToken(ctx, token.GetName()))
+	})
+
+	// Make an unauthenticated auth client that will be used for the join.
+	nopClient, err := authServer.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+	defer nopClient.Close()
+
+	// Tests joining via the new join service with auth-assigned host UUIDs.
+	_, err = joinclient.Join(ctx, joinclient.JoinParams{
+		Token: tc.requestTokenName,
+		ID: state.IdentityID{
+			Role:     types.RoleInstance,
+			NodeName: "test-node",
+		},
+		// joinWithMethod only creates a tokenSource when this is unset
+		IDToken:    tc.oidcToken,
+		AuthClient: nopClient,
+	})
+	tc.assertError(t, err)
+}
diff --git a/lib/join/server_gcp.go b/lib/join/server_gcp.go
new file mode 100644
index 0000000000000..3058bec665d05
--- /dev/null
+++ b/lib/join/server_gcp.go
@@ -0,0 +1,55 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/gcp"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// validateGCPToken performs validation and allow rule verification against
+// a GCP OIDC token.
+func (a *Server) validateGCPToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := gcp.CheckIDToken(ctx, &gcp.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetGCPIDTokenValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Gcp: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_github.go b/lib/join/server_github.go
new file mode 100644
index 0000000000000..526bd585593a1
--- /dev/null
+++ b/lib/join/server_github.go
@@ -0,0 +1,55 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/githubactions"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+func (a *Server) validateGithubToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetGHAIDTokenValidator(),
+		JWKSValidator:  a.cfg.AuthService.GetGHAIDTokenJWKSValidator(),
+		Clock:          a.cfg.AuthService.GetClock(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Github: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_gitlab.go b/lib/join/server_gitlab.go
new file mode 100644
index 0000000000000..25c295bec22ad
--- /dev/null
+++ b/lib/join/server_gitlab.go
@@ -0,0 +1,55 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/gitlab"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// validateGitlabToken performs validation and allow rule verification against
+// a Gitlab OIDC token.
+func (a *Server) validateGitlabToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := gitlab.CheckIDToken(ctx, &gitlab.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetGitlabIDTokenValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Gitlab: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_iam.go b/lib/join/server_iam.go
new file mode 100644
index 0000000000000..75c3404b22d4c
--- /dev/null
+++ b/lib/join/server_iam.go
@@ -0,0 +1,108 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"github.com/gravitational/trace"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/iamjoin"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleIAMJoin handles join attempts for the IAM join method.
+//
+// The IAM join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server IAMInit
+// client<-server IAMChallenge
+// client->server IAMChallengeSolution
+// client<-server Result
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the IAMInit message, handle the challenge-response, and send the
+// final result if everything checks out.
+func (s *Server) handleIAMJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	token provision.Token,
+) (messages.Response, error) {
+	// Receive the IAMInit message from the client.
+	iamInit, err := messages.RecvRequest[*messages.IAMInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving IAMInit message")
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &iamInit.ClientParams)
+
+	// Generate and send the challenge.
+	challenge, err := iamjoin.GenerateIAMChallenge()
+	if err != nil {
+		return nil, trace.Wrap(err, "generating challenge")
+	}
+	if err := stream.Send(&messages.IAMChallenge{
+		Challenge: challenge,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending challenge")
+	}
+
+	// Receive the solution from the client.
+	solution, err := messages.RecvRequest[*messages.IAMChallengeSolution](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving challenge solution")
+	}
+
+	// Verify the sts:GetCallerIdentity request, send it to AWS, and make sure
+	// the verified identity matches allow rules in the provision token.
+	verifiedIdentity, err := iamjoin.CheckIAMRequest(stream.Context(), &iamjoin.CheckIAMRequestParams{
+		Challenge:          challenge,
+		ProvisionToken:     token,
+		STSIdentityRequest: solution.STSIdentityRequest,
+		HTTPClient:         s.cfg.AuthService.GetHTTPClientForAWSSTS(),
+		FIPS:               s.cfg.FIPS,
+	})
+	// An identity will be returned even on error if the sts:GetCallerIdentity
+	// request was completed but no allow rules were matched, include it in the
+	// diagnostic for debugging.
+	stream.Diagnostic().Set(func(info *diagnostic.Info) {
+		info.RawJoinAttrs = verifiedIdentity
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "verifying challenge response")
+	}
+
+	// Make and return the final result message.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&iamInit.ClientParams,
+		token,
+		verifiedIdentity,
+		&workloadidentityv1pb.JoinAttrs{
+			Iam: verifiedIdentity.JoinAttrs(),
+		},
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_kubernetes.go b/lib/join/server_kubernetes.go
new file mode 100644
index 0000000000000..115be5d5b60c7
--- /dev/null
+++ b/lib/join/server_kubernetes.go
@@ -0,0 +1,64 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/provision"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+)
+
+// validateKubernetesToken performs validation and allow rule verification
+// against a Kubernetes OIDC token.
+func (a *Server) validateKubernetesToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	clusterName, err := a.cfg.AuthService.GetClusterName(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	claims, err := kubetoken.CheckIDToken(ctx, &kubetoken.CheckIDTokenParams{
+		ProvisionToken:     pt,
+		IDToken:            idToken,
+		Clock:              a.cfg.AuthService.GetClock(),
+		ClusterName:        clusterName.GetClusterName(),
+		InClusterValidator: a.cfg.AuthService.GetK8sTokenReviewValidator(),
+		JWKSValidator:      a.cfg.AuthService.GetK8sJWKSValidator(),
+		OIDCValidator:      a.cfg.AuthService.GetK8sOIDCValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Kubernetes: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_oidc.go b/lib/join/server_oidc.go
new file mode 100644
index 0000000000000..ca505b4467f43
--- /dev/null
+++ b/lib/join/server_oidc.go
@@ -0,0 +1,76 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// oidcTokenValidator is a function type that validates an OIDC token and checks that
+// it matches an allow rule configured in the provision token.
+type oidcTokenValidator func(
+	ctx context.Context,
+	provisionToken provision.Token,
+	idToken []byte,
+) (rawClaims any, joinAttrs *workloadidentityv1.JoinAttrs, err error)
+
+// handleOIDCJoin handles join attempts for all generic OIDC join methods.
+func (s *Server) handleOIDCJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	provisionToken provision.Token,
+	validator oidcTokenValidator,
+) (messages.Response, error) {
+	// Receive the OIDCInit message from the client.
+	oidcInit, err := messages.RecvRequest[*messages.OIDCInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &oidcInit.ClientParams)
+
+	rawClaims, joinAttrs, err := validator(stream.Context(), provisionToken, oidcInit.IDToken)
+	stream.Diagnostic().Set(func(info *diagnostic.Info) {
+		info.RawJoinAttrs = rawClaims
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "verifying OIDC token")
+	}
+
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&oidcInit.ClientParams,
+		provisionToken,
+		rawClaims,
+		joinAttrs,
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_oracle.go b/lib/join/server_oracle.go
new file mode 100644
index 0000000000000..b1eccb8b4be26
--- /dev/null
+++ b/lib/join/server_oracle.go
@@ -0,0 +1,108 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"encoding/base64"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/oraclejoin"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleOracleJoin handles join attempts for the Oracle join method.
+//
+// The Oracle join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server OracleInit
+// client<-server OracleChallenge
+// client->server OracleChallengeSolution
+// client<-server Result
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the OracleInit message, handle the challenge-response, and send the
+// final result if everything checks out.
+func (s *Server) handleOracleJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	provisionToken provision.Token,
+) (messages.Response, error) {
+	// Receive the OracleInit message from the client.
+	oracleInit, err := messages.RecvRequest[*messages.OracleInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving OracleInit message")
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &oracleInit.ClientParams)
+
+	// Generate and send the challenge.
+	challenge, err := joinutils.GenerateChallenge(base64.RawStdEncoding, 32)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating challenge")
+	}
+	if err := stream.Send(&messages.OracleChallenge{
+		Challenge: challenge,
+	}); err != nil {
+		return nil, trace.Wrap(err, "sending challenge")
+	}
+
+	// Receive the solution from the client.
+	solution, err := messages.RecvRequest[*messages.OracleChallengeSolution](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving challenge solution")
+	}
+
+	claims, err := oraclejoin.CheckChallengeSolution(stream.Context(), &oraclejoin.CheckChallengeSolutionParams{
+		Challenge:      challenge,
+		Solution:       solution,
+		ProvisionToken: provisionToken,
+		HTTPClient:     s.cfg.OracleHTTPClient,
+		RootCACache:    s.oracleRootCACache,
+	})
+	// CheckOracleRequest may return claims even when returning an error, which
+	// may aid in debugging.
+	stream.Diagnostic().Set(func(info *diagnostic.Info) {
+		info.RawJoinAttrs = claims
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "verifying challenge response")
+	}
+
+	// Make and return the final result message.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&oracleInit.ClientParams,
+		provisionToken,
+		claims,
+		&workloadidentityv1pb.JoinAttrs{
+			Oracle: claims.JoinAttrs(),
+		},
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_spacelift.go b/lib/join/server_spacelift.go
new file mode 100644
index 0000000000000..628a195af14e3
--- /dev/null
+++ b/lib/join/server_spacelift.go
@@ -0,0 +1,53 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/join/spacelift"
+)
+
+func (a *Server) validateSpaceliftToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetSpaceliftIDTokenValidator(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			Spacelift: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_terraformcloud.go b/lib/join/server_terraformcloud.go
new file mode 100644
index 0000000000000..6258272af7d13
--- /dev/null
+++ b/lib/join/server_terraformcloud.go
@@ -0,0 +1,61 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package join
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/join/terraformcloud"
+)
+
+// validateTerraformCloudToken performs validation and allow rule verification
+// against a Terraform Cloud OIDC token.
+func (a *Server) validateTerraformCloudToken(
+	ctx context.Context,
+	pt provision.Token,
+	idToken []byte,
+) (any, *workloadidentityv1.JoinAttrs, error) {
+	clusterName, err := a.cfg.AuthService.GetClusterName(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{
+		ProvisionToken: pt,
+		IDToken:        idToken,
+		Validator:      a.cfg.AuthService.GetTerraformIDTokenValidator(),
+		ClusterName:    clusterName.GetClusterName(),
+	})
+
+	// If possible, attach claims and workload ID attrs regardless of the error
+	// return. If the token fails to validate, these claims will ensure audit
+	// events remain useful.
+	var workloadIDAttrs *workloadidentityv1.JoinAttrs
+	if claims != nil {
+		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+			TerraformCloud: claims.JoinAttrs(),
+		}
+	}
+
+	return claims, workloadIDAttrs, trace.Wrap(err)
+}
diff --git a/lib/join/server_token.go b/lib/join/server_token.go
new file mode 100644
index 0000000000000..fb62500863321
--- /dev/null
+++ b/lib/join/server_token.go
@@ -0,0 +1,55 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+)
+
+// handleTokenJoin handles join attempts for the token join method.
+func (s *Server) handleTokenJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	token provision.Token,
+) (messages.Response, error) {
+	// Receive the TokenInit message from the client.
+	tokenInit, err := messages.RecvRequest[*messages.TokenInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &tokenInit.ClientParams)
+
+	// There are no additional checks for the token join method, just make the
+	// result message and return it.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&tokenInit.ClientParams,
+		token,
+		nil, /*rawClaims*/
+		nil, /*attrs*/
+	)
+	return result, trace.Wrap(err)
+}
diff --git a/lib/join/server_tpm.go b/lib/join/server_tpm.go
new file mode 100644
index 0000000000000..8b6f28327a3cd
--- /dev/null
+++ b/lib/join/server_tpm.go
@@ -0,0 +1,118 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package join
+
+import (
+	"github.com/google/go-attestation/attest"
+	"github.com/gravitational/trace"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/internal/authz"
+	"github.com/gravitational/teleport/lib/join/internal/diagnostic"
+	"github.com/gravitational/teleport/lib/join/internal/messages"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/join/tpmjoin"
+)
+
+// handleTPMJoin handles join attempts for the TPM join method.
+//
+// The TPM join method involves the following messages:
+//
+// client->server ClientInit
+// client<-server ServerInit
+// client->server TPMInit
+// client<-server TPMEncryptedCredential
+// client->server TPMSolution
+// client<-server Result
+//
+// At this point the ServerInit message has already been sent, what's left is
+// to receive the TPMInit message, handle the TPMEncryptedCredential->TPMSolution
+// flow, and return the final result if everything checks out.
+func (s *Server) handleTPMJoin(
+	stream messages.ServerStream,
+	authCtx *authz.Context,
+	clientInit *messages.ClientInit,
+	provisionToken provision.Token,
+) (messages.Response, error) {
+	ptv2, ok := provisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("TPM joining only supports types.ProvisionTokenV2, got %T", provisionToken)
+	}
+
+	// Receive the TPMInit message from the client.
+	tpmInit, err := messages.RecvRequest[*messages.TPMInit](stream)
+	if err != nil {
+		return nil, trace.Wrap(err, "receiving TPMInit message")
+	}
+	// Set any diagnostic info from the ClientParams.
+	setDiagnosticClientParams(stream.Diagnostic(), &tpmInit.ClientParams)
+
+	solve := func(ec *attest.EncryptedCredential) ([]byte, error) {
+		ecMsg := &messages.TPMEncryptedCredential{
+			CredentialBlob: ec.Credential,
+			Secret:         ec.Secret,
+		}
+		if err := stream.Send(ecMsg); err != nil {
+			return nil, trace.Wrap(err, "sending TPMEncryptedCredential")
+		}
+		solutionMsg, err := messages.RecvRequest[*messages.TPMSolution](stream)
+		if err != nil {
+			return nil, trace.Wrap(err, "receiving TPMSolution")
+		}
+		return solutionMsg.Solution, nil
+	}
+
+	validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), tpmjoin.CheckTPMRequestParams{
+		Token:        ptv2,
+		TPMValidator: s.cfg.AuthService.GetTPMValidator(),
+		EKCert:       tpmInit.EKCert,
+		EKKey:        tpmInit.EKKey,
+		AttestParams: attest.AttestationParameters{
+			Public:            tpmInit.Public,
+			CreateData:        tpmInit.CreateData,
+			CreateAttestation: tpmInit.CreateAttestation,
+			CreateSignature:   tpmInit.CreateSignature,
+		},
+		Solve: solve,
+	})
+	// validatedEK will be returned even on error if the TPM was validated but
+	// no allow rules were matched, include it in the diagnostic for debugging.
+	stream.Diagnostic().Set(func(info *diagnostic.Info) {
+		info.RawJoinAttrs = validatedEK
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Make and return the final result message.
+	result, err := s.makeResult(
+		stream.Context(),
+		stream.Diagnostic(),
+		authCtx,
+		clientInit,
+		&tpmInit.ClientParams,
+		provisionToken,
+		validatedEK,
+		&workloadidentityv1.JoinAttrs{
+			Tpm: validatedEK.JoinAttrs(),
+		},
+	)
+	return result, trace.Wrap(err)
+}
+
+type TPMValidator = tpmjoin.TPMValidator
diff --git a/lib/join/spacelift/spacelift.go b/lib/join/spacelift/spacelift.go
new file mode 100644
index 0000000000000..5d22c54c77877
--- /dev/null
+++ b/lib/join/spacelift/spacelift.go
@@ -0,0 +1,187 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package spacelift
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/joinutils"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/services"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "spacelift")
+
+type Validator interface {
+	Validate(
+		ctx context.Context, domain string, token string,
+	) (*IDTokenClaims, error)
+}
+
+// IDTokenClaims
+// See the following for the structure:
+// https://docs.spacelift.io/integrations/cloud-providers/oidc/#standard-claims
+type IDTokenClaims struct {
+	oidc.TokenClaims
+
+	// Sub provides some information about the Spacelift run that generated this
+	// token.
+	// space:<space_id>:(stack|module):<stack_id|module_id>:run_type:<run_type>:scope:<read|write>
+	Sub string `json:"sub"`
+	// SpaceID is the ID of the space in which the run that owns the token was
+	// executed.
+	SpaceID string `json:"spaceId"`
+	// CallerType is the type of the caller, ie. the entity that owns the run -
+	// either stack or module.
+	CallerType string `json:"callerType"`
+	// CallerID is the ID of the caller, ie. the stack or module that generated
+	// the run.
+	CallerID string `json:"callerId"`
+	// RunType is the type of the run.
+	// (PROPOSED, TRACKED, TASK, TESTING or DESTROY)
+	RunType string `json:"runType"`
+	// RunID is the ID of the run that owns the token.
+	RunID string `json:"runId"`
+	// Scope is the scope of the token - either read or write.
+	Scope string `json:"scope"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsSpacelift {
+	return &workloadidentityv1pb.JoinAttrsSpacelift{
+		Sub:        c.Sub,
+		SpaceId:    c.SpaceID,
+		CallerType: c.CallerType,
+		CallerId:   c.CallerID,
+		RunType:    c.RunType,
+		RunId:      c.RunID,
+		Scope:      c.Scope,
+	}
+}
+
+// CheckIDTokenParams are parameters used to validate Spacelift OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Validator      Validator
+}
+
+func (p *CheckIDTokenParams) validate() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	}
+	return nil
+}
+
+// CheckIDToken validates a Spacelift OIDC token, verifying both the validity of
+// the OIDC token itself, as well as ensuring claims match any configured allow
+// rules in the provided provision token.
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*IDTokenClaims, error) {
+	if err := params.validate(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("spacelift join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	if modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil, trace.Wrap(services.ErrRequiresEnterprise, "spacelift joining")
+	}
+
+	claims, err := params.Validator.Validate(
+		ctx, token.Spec.Spacelift.Hostname, string(params.IDToken),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	log.InfoContext(ctx, "Spacelift run trying to join cluster",
+		"claims", claims,
+		"token", token.GetName(),
+	)
+
+	return claims, trace.Wrap(checkSpaceliftAllowRules(token, claims))
+}
+
+func checkSpaceliftAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	globCheck := func(want string, got string) (bool, error) {
+		if token.Spec.Spacelift.EnableGlobMatching {
+			return joinutils.GlobMatchAllowEmptyPattern(want, got)
+		}
+		if want == "" {
+			return true, nil
+		}
+		return want == got, nil
+	}
+
+	// If a single rule passes, accept the IDToken
+	for i, rule := range token.Spec.Spacelift.Allow {
+		// Please consider keeping these field validators in the same order they
+		// are defined within the ProvisionTokenSpecV2Spacelift proto spec.
+		spaceIDMatch, err := globCheck(rule.SpaceID, claims.SpaceID)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) space_id glob match", i)
+		}
+		if !spaceIDMatch {
+			continue
+		}
+		callerIDMatch, err := globCheck(rule.CallerID, claims.CallerID)
+		if err != nil {
+			return trace.Wrap(err, "evaluating rule (%d) caller_id glob match", i)
+		}
+		if !callerIDMatch {
+			continue
+		}
+		if rule.CallerType != "" && claims.CallerType != rule.CallerType {
+			continue
+		}
+		if rule.Scope != "" && claims.Scope != rule.Scope {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/spacelift/token_source.go b/lib/join/spacelift/token_source.go
similarity index 100%
rename from lib/spacelift/token_source.go
rename to lib/join/spacelift/token_source.go
diff --git a/lib/spacelift/token_source_test.go b/lib/join/spacelift/token_source_test.go
similarity index 100%
rename from lib/spacelift/token_source_test.go
rename to lib/join/spacelift/token_source_test.go
diff --git a/lib/spacelift/token_validator.go b/lib/join/spacelift/token_validator.go
similarity index 100%
rename from lib/spacelift/token_validator.go
rename to lib/join/spacelift/token_validator.go
diff --git a/lib/spacelift/token_validator_test.go b/lib/join/spacelift/token_validator_test.go
similarity index 100%
rename from lib/spacelift/token_validator_test.go
rename to lib/join/spacelift/token_validator_test.go
diff --git a/lib/join/terraformcloud/terraform.go b/lib/join/terraformcloud/terraform.go
new file mode 100644
index 0000000000000..fe5f669096d08
--- /dev/null
+++ b/lib/join/terraformcloud/terraform.go
@@ -0,0 +1,188 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terraformcloud
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/services"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "terraformcloud")
+
+type Validator interface {
+	Validate(
+		ctx context.Context, audience, hostname, token string,
+	) (*IDTokenClaims, error)
+}
+
+// IDTokenClaims
+// See the following for the structure:
+// https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens
+type IDTokenClaims struct {
+	oidc.TokenClaims
+	// Sub provides some information about the Spacelift run that generated this
+	// token.
+	// organization:<org name>:project:<project name>:workspace:<workspace name>:run_phase:<phase>
+	Sub string `json:"sub"`
+
+	// OrganizationID is the ID of the HCP Terraform organization
+	OrganizationID string `json:"terraform_organization_id"`
+	// OrganizationName is the human-readable name of the HCP Terraform organization
+	OrganizationName string `json:"terraform_organization_name"`
+	// ProjectID is the ID of the HCP Terraform project
+	ProjectID string `json:"terraform_project_id"`
+	// ProjectName is the human-readable name of the HCP Terraform project
+	ProjectName string `json:"terraform_project_name"`
+	// WorkspaceID is the ID of the HCP Terraform project
+	WorkspaceID string `json:"terraform_workspace_id"`
+	// WorkspaceName is the human-readable name of the HCP Terraform workspace
+	WorkspaceName string `json:"terraform_workspace_name"`
+	// FullWorkspace is the full path to the workspace, e.g. `organization:<name>:project:<name>:workspace:<name>`
+	FullWorkspace string `json:"terraform_full_workspace"`
+	// RunID is the ID of the run the token was generated for.
+	RunID string `json:"terraform_run_id"`
+	// RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
+	RunPhase string `json:"terraform_run_phase"`
+}
+
+func (c *IDTokenClaims) GetSubject() string {
+	return c.Sub
+}
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsTerraformCloud {
+	return &workloadidentityv1pb.JoinAttrsTerraformCloud{
+		Sub:              c.Sub,
+		OrganizationName: c.OrganizationName,
+		ProjectName:      c.ProjectName,
+		WorkspaceName:    c.WorkspaceName,
+		FullWorkspace:    c.FullWorkspace,
+		RunId:            c.RunID,
+		RunPhase:         c.RunPhase,
+	}
+}
+
+// CheckIDTokenParams are parameters used to validate CircleCI OIDC tokens.
+type CheckIDTokenParams struct {
+	ProvisionToken provision.Token
+	IDToken        []byte
+	Validator      Validator
+	ClusterName    string
+}
+
+func (p *CheckIDTokenParams) checkAndSetDefaults() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.Validator == nil:
+		return trace.BadParameter("Validator is required")
+	case p.ClusterName == "":
+		return trace.BadParameter("ClusterName is required")
+	}
+	return nil
+}
+
+// CheckIDToken validates a CircleCI OIDC token, verifying both the validity of
+// the OIDC token itself, as well as ensuring claims match any configured allow
+// rules in the provided provision token.
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*IDTokenClaims, error) {
+	if err := params.checkAndSetDefaults(); err != nil {
+		return nil, trace.AccessDenied("%s", err.Error())
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter("terraform_cloud join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
+	}
+
+	hostnameOverride := token.Spec.TerraformCloud.Hostname
+	if hostnameOverride != "" && modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil, trace.Wrap(
+			services.ErrRequiresEnterprise,
+			"terraform_cloud joining for Terraform Enterprise",
+		)
+	}
+
+	aud := token.Spec.TerraformCloud.Audience
+	if aud == "" {
+		aud = params.ClusterName
+	}
+
+	claims, err := params.Validator.Validate(
+		ctx, aud, hostnameOverride, string(params.IDToken),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	log.InfoContext(ctx, "Terraform Cloud run trying to join cluster",
+		"claims", claims,
+		"token", token.GetName(),
+	)
+
+	return claims, trace.Wrap(checkTerraformCloudAllowRules(token, claims))
+}
+
+func checkTerraformCloudAllowRules(token *types.ProvisionTokenV2, claims *IDTokenClaims) error {
+	for _, rule := range token.Spec.TerraformCloud.Allow {
+		if rule.OrganizationID != "" && claims.OrganizationID != rule.OrganizationID {
+			continue
+		}
+		if rule.OrganizationName != "" && claims.OrganizationName != rule.OrganizationName {
+			continue
+		}
+		if rule.ProjectID != "" && claims.ProjectID != rule.ProjectID {
+			continue
+		}
+		if rule.ProjectName != "" && claims.ProjectName != rule.ProjectName {
+			continue
+		}
+		if rule.WorkspaceID != "" && claims.WorkspaceID != rule.WorkspaceID {
+			continue
+		}
+		if rule.WorkspaceName != "" && claims.WorkspaceName != rule.WorkspaceName {
+			continue
+		}
+		if rule.RunPhase != "" && claims.RunPhase != rule.RunPhase {
+			continue
+		}
+
+		// All provided rules met.
+		return nil
+	}
+
+	return trace.AccessDenied("id token claims did not match any allow rules")
+}
diff --git a/lib/terraformcloud/token_source.go b/lib/join/terraformcloud/token_source.go
similarity index 100%
rename from lib/terraformcloud/token_source.go
rename to lib/join/terraformcloud/token_source.go
diff --git a/lib/terraformcloud/token_source_test.go b/lib/join/terraformcloud/token_source_test.go
similarity index 100%
rename from lib/terraformcloud/token_source_test.go
rename to lib/join/terraformcloud/token_source_test.go
diff --git a/lib/terraformcloud/token_validator.go b/lib/join/terraformcloud/token_validator.go
similarity index 100%
rename from lib/terraformcloud/token_validator.go
rename to lib/join/terraformcloud/token_validator.go
diff --git a/lib/terraformcloud/token_validator_test.go b/lib/join/terraformcloud/token_validator_test.go
similarity index 100%
rename from lib/terraformcloud/token_validator_test.go
rename to lib/join/terraformcloud/token_validator_test.go
diff --git a/lib/join/tpmjoin/join_test.go b/lib/join/tpmjoin/join_test.go
new file mode 100644
index 0000000000000..ee8bab3b2bbe3
--- /dev/null
+++ b/lib/join/tpmjoin/join_test.go
@@ -0,0 +1,513 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package tpmjoin_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"log/slog"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/google/go-attestation/attest"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/tpm"
+)
+
+func TestJoinTPM(t *testing.T) {
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir: t.TempDir(),
+		},
+	})
+	require.NoError(t, err)
+
+	adminClient, err := server.NewClient(authtest.TestAdmin())
+	require.NoError(t, err)
+	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), &machineidv1.CreateBotRequest{
+		Bot: &machineidv1.Bot{
+			Metadata: &headerv1.Metadata{
+				Name: "testbot",
+			},
+			Kind: types.KindBot,
+			Spec: &machineidv1.BotSpec{},
+		},
+	})
+	require.NoError(t, err)
+
+	nopClient, err := server.NewClient(authtest.TestNop())
+	require.NoError(t, err)
+
+	goodTPMKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	goodTPMPub, err := x509.MarshalPKIXPublicKey(goodTPMKey.Public())
+	require.NoError(t, err)
+	goodTPMPubHash := tpm.HashEKPub(goodTPMPub)
+
+	badTPMKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+
+	fakeTPMValidator := newFakeTPMValidator()
+	server.Auth().SetTPMValidator(fakeTPMValidator.validate)
+
+	goodTPMCA, err := newFakeTPMCA()
+	require.NoError(t, err)
+	badTPMCA, err := newFakeTPMCA()
+	require.NoError(t, err)
+
+	tpmCert1, tpmCertSerial1, err := goodTPMCA.issueTPMCert(goodTPMKey.Public())
+	require.NoError(t, err)
+	tpmCert2, _, err := goodTPMCA.issueTPMCert(goodTPMKey.Public())
+	require.NoError(t, err)
+
+	allowRulesNotMatched := func(t require.TestingT, err error, i ...any) {
+		require.ErrorContains(t, err, "validated tpm attributes did not match any allow rules")
+		require.True(t, trace.IsAccessDenied(err))
+	}
+
+	for _, tc := range []struct {
+		desc            string
+		tokenSpec       *types.ProvisionTokenSpecV2TPM
+		tpmKey          crypto.Signer
+		tpmCert         []byte
+		badTPMSolution  bool
+		oss             bool
+		assertError     require.ErrorAssertionFunc
+		expectJoinAttrs verifiedAttrs
+	}{
+		{
+			desc: "success, ekpub",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash: goodTPMPubHash,
+					},
+				},
+			},
+			tpmKey:      goodTPMKey,
+			assertError: require.NoError,
+			expectJoinAttrs: verifiedAttrs{
+				ekPubHash: goodTPMPubHash,
+			},
+		},
+		{
+			desc: "success, ekcert",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey:      goodTPMKey,
+			tpmCert:     tpmCert1,
+			assertError: require.NoError,
+			expectJoinAttrs: verifiedAttrs{
+				ekPubHash:    goodTPMPubHash,
+				ekCertSerial: tpmCertSerial1,
+			},
+		},
+		{
+			desc: "success, both ek cert serial and ek pub hash match",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash:        goodTPMPubHash,
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey:      goodTPMKey,
+			tpmCert:     tpmCert1,
+			assertError: require.NoError,
+			expectJoinAttrs: verifiedAttrs{
+				ekPubHash:    goodTPMPubHash,
+				ekCertSerial: tpmCertSerial1,
+			},
+		},
+		{
+			desc: "success, ek cert verified",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				EKCertAllowedCAs: []string{string(goodTPMCA.caCertPEM)},
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey:      goodTPMKey,
+			tpmCert:     tpmCert1,
+			assertError: require.NoError,
+			expectJoinAttrs: verifiedAttrs{
+				ekPubHash:      goodTPMPubHash,
+				ekCertSerial:   tpmCertSerial1,
+				ekCertVerified: true,
+			},
+		},
+		{
+			desc: "success, ek cert verified and ek pub hash match",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				EKCertAllowedCAs: []string{string(goodTPMCA.caCertPEM)},
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash:        goodTPMPubHash,
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey:      goodTPMKey,
+			tpmCert:     tpmCert1,
+			assertError: require.NoError,
+			expectJoinAttrs: verifiedAttrs{
+				ekPubHash:      goodTPMPubHash,
+				ekCertSerial:   tpmCertSerial1,
+				ekCertVerified: true,
+			},
+		},
+		{
+			desc: "failure, mismatched ekpub",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash: goodTPMPubHash,
+					},
+				},
+			},
+			// TPM key does not match pubkey hash in token.
+			tpmKey:      badTPMKey,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			desc: "failure, mismatched ekcert serial",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey: goodTPMKey,
+			// TPM cert does not match serial in token.
+			tpmCert:     tpmCert2,
+			assertError: allowRulesNotMatched,
+		},
+		{
+			desc: "failure, ek cert not verified",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				// Token configures trust for a CA that did not sign the TPM cert.
+				EKCertAllowedCAs: []string{string(badTPMCA.caCertPEM)},
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKCertificateSerial: tpmCertSerial1,
+					},
+				},
+			},
+			tpmKey:  goodTPMKey,
+			tpmCert: tpmCert1,
+			assertError: func(t require.TestingT, err error, msgAndArgs ...any) {
+				require.ErrorAs(t, err, (new(*trace.AccessDeniedError)))
+				require.ErrorContains(t, err, "certificate signed by unknown authority")
+			},
+		},
+		{
+			desc: "failure, solution mismatch",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash: goodTPMPubHash,
+					},
+				},
+			},
+			tpmKey:         goodTPMKey,
+			badTPMSolution: true,
+			assertError: func(t require.TestingT, err error, msgAndArgs ...any) {
+				require.ErrorAs(t, err, (new(*trace.AccessDeniedError)))
+				require.ErrorContains(t, err, "invalid credential activation solution")
+			},
+		},
+		{
+			desc: "failure, oss",
+			tokenSpec: &types.ProvisionTokenSpecV2TPM{
+				Allow: []*types.ProvisionTokenSpecV2TPM_Rule{
+					{
+						EKPublicHash: goodTPMPubHash,
+					},
+				},
+			},
+			tpmKey: goodTPMKey,
+			oss:    true,
+			assertError: func(t require.TestingT, err error, msgAndArgs ...any) {
+				require.ErrorAs(t, err, (new(*trace.AccessDeniedError)))
+				require.ErrorContains(t, err, "this feature requires Teleport Enterprise")
+			},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			if !tc.oss {
+				modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
+			}
+
+			token, err := types.NewProvisionTokenFromSpec("mytoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+				JoinMethod: types.JoinMethodTPM,
+				Roles:      []types.SystemRole{types.RoleBot},
+				BotName:    "testbot",
+				TPM:        tc.tokenSpec,
+			})
+			require.NoError(t, err)
+			require.NoError(t, server.Auth().UpsertToken(t.Context(), token))
+
+			fakeTPM, err := newFakeTPM(tc.tpmKey, tc.tpmCert)
+			require.NoError(t, err)
+			fakeTPM.badSolution = tc.badTPMSolution
+
+			checkResult := func(t *testing.T, result *joinclient.JoinResult) {
+				t.Helper()
+
+				botCert, err := tlsca.ParseCertificatePEM(result.Certs.TLS)
+				require.NoError(t, err)
+
+				id, err := tlsca.FromSubject(botCert.Subject, botCert.NotAfter)
+				require.NoError(t, err)
+				tpmAttrs := id.JoinAttributes.Tpm
+				require.NotNil(t, tpmAttrs)
+				gotAttrs := verifiedAttrs{
+					ekPubHash:      tpmAttrs.EkPubHash,
+					ekCertSerial:   tpmAttrs.EkCertSerial,
+					ekCertVerified: tpmAttrs.EkCertVerified,
+				}
+				assert.Equal(t, tc.expectJoinAttrs, gotAttrs)
+			}
+
+			t.Run("legacy", func(t *testing.T) {
+				result, err := joinclient.LegacyJoin(t.Context(), joinclient.JoinParams{
+					Token:      token.GetName(),
+					JoinMethod: types.JoinMethodTPM,
+					ID: state.IdentityID{
+						Role: types.RoleBot,
+					},
+					AuthClient: nopClient,
+					AttestTPM:  fakeTPM.attest,
+				})
+				tc.assertError(t, err)
+				if err != nil {
+					return
+				}
+				checkResult(t, result)
+			})
+			t.Run("new", func(t *testing.T) {
+				result, err := joinclient.Join(t.Context(), joinclient.JoinParams{
+					Token: token.GetName(),
+					ID: state.IdentityID{
+						Role: types.RoleBot,
+					},
+					AuthClient: nopClient,
+					AttestTPM:  fakeTPM.attest,
+				})
+				tc.assertError(t, err)
+				if err != nil {
+					return
+				}
+				checkResult(t, result)
+			})
+		})
+	}
+
+}
+
+// fakeTPM is a minimal faked TPM that will return attestation parameters for a
+// key and cert it is configured with. It returns the constant "good-solution"
+// for all ec solutions, unless badSolution is set.
+type fakeTPM struct {
+	ekKey     crypto.Signer
+	ekPub     []byte
+	ekPubHash string
+
+	ekCert []byte
+
+	badSolution bool
+}
+
+func newFakeTPM(ekKey crypto.Signer, ekCert []byte) (*fakeTPM, error) {
+	ekPub, err := x509.MarshalPKIXPublicKey(ekKey.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	ekPubHash := tpm.HashEKPub(ekPub)
+
+	return &fakeTPM{
+		ekKey:     ekKey,
+		ekPub:     ekPub,
+		ekPubHash: ekPubHash,
+		ekCert:    ekCert,
+	}, nil
+}
+
+func (f *fakeTPM) attest(ctx context.Context, _ *slog.Logger) (*tpm.Attestation, func() error, error) {
+	close := func() error {
+		return nil
+	}
+	solve := func(*attest.EncryptedCredential) ([]byte, error) {
+		if f.badSolution {
+			return []byte("bad-solution"), nil
+		}
+		return []byte("good-solution"), nil
+	}
+	data := tpm.QueryRes{
+		EKPub:     f.ekPub,
+		EKPubHash: f.ekPubHash,
+	}
+	if f.ekCert != nil {
+		cert, err := x509.ParseCertificate(f.ekCert)
+		if err != nil {
+			return nil, close, trace.Wrap(err)
+		}
+		data.EKCert = &tpm.QueryEKCert{
+			Raw:          f.ekCert,
+			SerialNumber: tpm.SerialString(cert.SerialNumber),
+		}
+	}
+	return &tpm.Attestation{
+		Data: data,
+		AttestParams: attest.AttestationParameters{
+			Public: f.ekPub,
+		},
+		Solve: solve,
+	}, close, nil
+}
+
+// fakeTPMValidator is a minimal fakes TPM validator. It always issues empty
+// EncryptedCredential challenges and expects the solution to be
+// "good-solution", but it will legitimately validate certificates to their
+// issuing CA.
+type fakeTPMValidator struct{}
+
+func newFakeTPMValidator() *fakeTPMValidator {
+	return &fakeTPMValidator{}
+}
+
+func (f *fakeTPMValidator) validate(ctx context.Context, params tpm.ValidateParams) (*tpm.ValidatedTPM, error) {
+	ec := &attest.EncryptedCredential{}
+	clientSolution, err := params.Solve(ec)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if string(clientSolution) != "good-solution" {
+		return nil, trace.BadParameter("invalid credential activation solution")
+	}
+
+	validated := &tpm.ValidatedTPM{}
+
+	var ekCert *x509.Certificate
+	if params.EKCert != nil {
+		ekCert, err = x509.ParseCertificate(params.EKCert)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		validated.EKCertSerial = tpm.SerialString(ekCert.SerialNumber)
+		ekPubPKIX, err := x509.MarshalPKIXPublicKey(ekCert.PublicKey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		validated.EKPubHash = tpm.HashEKPub(ekPubPKIX)
+	}
+	if params.AllowedCAs != nil {
+		if ekCert == nil {
+			return nil, trace.BadParameter("tpm did not provide an EKCert to verify")
+		}
+		if _, err := ekCert.Verify(x509.VerifyOptions{
+			Roots: params.AllowedCAs,
+		}); err != nil {
+			return nil, trace.Wrap(err, "verifying EKCert")
+		}
+		validated.EKCertVerified = true
+	}
+	if params.EKKey != nil {
+		validated.EKPubHash = tpm.HashEKPub(params.EKKey)
+	}
+
+	return validated, nil
+}
+
+// fakeTPMCA issues fake TPM certificates.
+type fakeTPMCA struct {
+	caKey     crypto.Signer
+	caCert    *x509.Certificate
+	caCertPEM []byte
+	serial    int64
+}
+
+func newFakeTPMCA() (*fakeTPMCA, error) {
+	caKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caCertPEM, err := tlsca.GenerateSelfSignedCAWithSigner(caKey, pkix.Name{CommonName: "Test TPM CA"}, nil, time.Hour)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caCert, err := tlsca.ParseCertificatePEM(caCertPEM)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &fakeTPMCA{
+		caKey:     caKey,
+		caCert:    caCert,
+		caCertPEM: caCertPEM,
+	}, nil
+}
+
+func (f *fakeTPMCA) issueTPMCert(pub crypto.PublicKey) ([]byte, string, error) {
+	f.serial++
+	cert := &x509.Certificate{
+		SerialNumber:          big.NewInt(f.serial),
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		BasicConstraintsValid: true,
+		Subject: pkix.Name{
+			CommonName: "testtpm",
+		},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, cert, f.caCert, pub, f.caKey)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	return certDER, tpm.SerialString(cert.SerialNumber), nil
+}
+
+type verifiedAttrs struct {
+	ekPubHash      string
+	ekCertSerial   string
+	ekCertVerified bool
+}
diff --git a/lib/join/tpmjoin/tpm.go b/lib/join/tpmjoin/tpm.go
new file mode 100644
index 0000000000000..621a6c4318b2d
--- /dev/null
+++ b/lib/join/tpmjoin/tpm.go
@@ -0,0 +1,119 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package tpmjoin
+
+import (
+	"context"
+	"crypto/x509"
+
+	"github.com/google/go-attestation/attest"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tpm"
+)
+
+// TPMValidator is a function type that validates a TPM for the TPM join method.
+type TPMValidator func(ctx context.Context, params tpm.ValidateParams) (*tpm.ValidatedTPM, error)
+
+// CheckTPMRequestParams holds all parameters for CheckTPMRequest.
+type CheckTPMRequestParams struct {
+	// Token is the provision token used to validate the request.
+	Token *types.ProvisionTokenV2
+	// TPMValidator is a function that will be called to validate the presented TPM.
+	TPMValidator TPMValidator
+
+	// EKCert is the device's endorsement certificate in X509, ASN.1 DER form.
+	// This certificate contains the public key of the endorsement key. This is
+	// preferred to ek_key.
+	EKCert []byte
+	// The device's public endorsement key in PKIX, ASN.1 DER form. This is
+	// used when a TPM does not contain any endorsement certificates.
+	EKKey []byte
+	// AttestationParameters describes information about a key which is necessary
+	// for verifying its properties remotely.
+	AttestParams attest.AttestationParameters
+	// Solve is the function will be called when TPMValidator has prepared the
+	// challenge and needs the remote TPM to solve it.
+	Solve func(*attest.EncryptedCredential) ([]byte, error)
+}
+
+// CheckTPMRequest checks a TPM method join request.
+func CheckTPMRequest(ctx context.Context, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) {
+	if modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil, trace.Wrap(
+			services.ErrRequiresEnterprise,
+			"tpm joining",
+		)
+	}
+
+	certPool, err := buildCertPool(params.Token)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	validatedEK, err := params.TPMValidator(ctx, tpm.ValidateParams{
+		EKCert:       params.EKCert,
+		EKKey:        params.EKKey,
+		AttestParams: params.AttestParams,
+		AllowedCAs:   certPool,
+		Solve:        params.Solve,
+	})
+	if err != nil {
+		return nil, trace.AccessDenied("validating TPM: %v", err)
+	}
+
+	if err := checkTPMAllowRules(validatedEK, params.Token.Spec.TPM.Allow); err != nil {
+		return validatedEK, trace.Wrap(err)
+	}
+
+	return validatedEK, nil
+}
+
+func buildCertPool(token *types.ProvisionTokenV2) (*x509.CertPool, error) {
+	if len(token.Spec.TPM.EKCertAllowedCAs) == 0 {
+		// Certs are not validated if no CAs were configured.
+		return nil, nil
+	}
+	certPool := x509.NewCertPool()
+	for i, ca := range token.Spec.TPM.EKCertAllowedCAs {
+		if ok := certPool.AppendCertsFromPEM([]byte(ca)); !ok {
+			return nil, trace.BadParameter(
+				"ekcert_allowed_cas[%d] has an invalid or malformed PEM", i,
+			)
+		}
+	}
+	return certPool, nil
+}
+
+func checkTPMAllowRules(tpm *tpm.ValidatedTPM, rules []*types.ProvisionTokenSpecV2TPM_Rule) error {
+	// If a single rule passes, accept the TPM
+	for _, rule := range rules {
+		if rule.EKPublicHash != "" && tpm.EKPubHash != rule.EKPublicHash {
+			continue
+		}
+		if rule.EKCertificateSerial != "" && tpm.EKCertSerial != rule.EKCertificateSerial {
+			continue
+		}
+
+		// All rules met.
+		return nil
+	}
+	return trace.AccessDenied("validated tpm attributes did not match any allow rules")
+}
diff --git a/lib/jwt/jwt.go b/lib/jwt/jwt.go
index 74e04a232e0f5..d8ca5d61f5ef0 100644
--- a/lib/jwt/jwt.go
+++ b/lib/jwt/jwt.go
@@ -306,35 +306,46 @@ type SignParamsJWTSVID struct {
 func (k *Key) SignJWTSVID(p SignParamsJWTSVID) (string, error) {
 	// Record time here for consistency between exp and iat.
 	now := k.config.Clock.Now()
-	claims := jwt.Claims{
+
+	// We use map[string]any instead of jwt.Claims to avoid a json.Marshal/Unmarshal
+	// round-trip that would convert jwt.NumericDate (int64) to float64, causing
+	// timestamp claims to be serialized in scientific notation (e.g., "exp": 1.7e9).
+	// Using map[string]any preserves the jwt.NumericDate type until final marshaling.
+	claims := map[string]any{
 		// > 3.1. Subject:
 		// > The sub claim MUST be set to the SPIFFE ID of the workload to which it is issued.
-		Subject: p.SPIFFEID.String(),
+		"sub": p.SPIFFEID.String(),
+
 		// > 3.2. Audience:
 		// > The aud claim MUST be present, containing one or more values.
-		Audience: p.Audiences,
+		"aud": jwt.Audience(p.Audiences),
+
 		// > 3.3. Expiration Time:
 		// > The exp claim MUST be set
-		Expiry: jwt.NewNumericDate(now.Add(p.TTL)),
+		"exp": jwt.NewNumericDate(now.Add(p.TTL)),
+
 		// The spec makes no comment on inclusion of `iat`, but the SPIRE
 		// implementation does set this value and it feels like a good idea.
-		IssuedAt: jwt.NewNumericDate(now),
+		"iat": jwt.NewNumericDate(now),
+
 		// > 7.1. Replay Protection
 		// > the jti claim is permitted by this specification, it should be
 		// > noted that JWT-SVID validators are not required to track jti
 		// > uniqueness.
-		ID: p.JTI,
+		"jti": p.JTI,
+
 		// The SPIFFE specification makes no comment on the inclusion of `iss`,
 		// however, we provide this value so that the issued token can be a
 		// valid OIDC ID token and used with non-SPIFFE aware systems that do
 		// understand OIDC.
-		Issuer: p.Issuer,
+		"iss": p.Issuer,
 	}
+
 	if !p.SetIssuedAt.IsZero() {
-		claims.IssuedAt = jwt.NewNumericDate(p.SetIssuedAt)
+		claims["iat"] = jwt.NewNumericDate(p.SetIssuedAt)
 	}
 	if !p.SetExpiry.IsZero() {
-		claims.Expiry = jwt.NewNumericDate(p.SetExpiry)
+		claims["exp"] = jwt.NewNumericDate(p.SetExpiry)
 	}
 
 	// > 2.2. Key ID:
@@ -361,30 +372,17 @@ func (k *Key) SignJWTSVID(p SignParamsJWTSVID) (string, error) {
 	//
 	// > Registered claims not described in this document, in addition to
 	// > private claims, MAY be used as implementers see fit.
-	var rawClaims any = claims
 	if len(p.PrivateClaims) != 0 {
-		// This is slightly awkward. We take a round-trip through json.Marshal
-		// and json.Unmarshal to get a version of the claims we can add to.
-		marshaled, err := json.Marshal(rawClaims)
-		if err != nil {
-			return "", trace.Wrap(err, "marshaling claims")
-		}
-		var unmarshaled map[string]any
-		if err := json.Unmarshal(marshaled, &unmarshaled); err != nil {
-			return "", trace.Wrap(err, "unmarshaling claims")
-		}
-
 		// Only inject claims that don't conflict with an existing primary claim
 		// such as sub or aud.
 		for k, v := range p.PrivateClaims {
-			if _, ok := unmarshaled[k]; !ok {
-				unmarshaled[k] = v
+			if _, ok := claims[k]; !ok {
+				claims[k] = v
 			}
 		}
-		rawClaims = unmarshaled
 	}
 
-	return k.sign(rawClaims, opts)
+	return k.sign(claims, opts)
 }
 
 // SignEntraOIDC signs a JWT for the Entra ID Integration.
@@ -757,3 +755,43 @@ func (k *Key) SignPayload(payload []byte, opts *jose.SignerOptions) (*jose.JSONW
 	}
 	return signature, nil
 }
+
+// PluginTokenParam defines the parameters needed to sign a JWT token for a Teleport plugin.
+type PluginTokenParam struct {
+	// Audience is the Audience for the Token.
+	Audience []string
+	// Issuer is the issuer of the token.
+	Issuer string
+	// Subject is the system that is going to use the token.
+	Subject string
+	// Expires is the time to live for the token.
+	Expires time.Time
+}
+
+// SignPluginToken signs a JWT token for a Teleport plugin.
+func (k *Key) SignPluginToken(p PluginTokenParam) (string, error) {
+	claims := jwt.Claims{
+		Subject:   p.Subject,
+		Issuer:    p.Issuer,
+		Audience:  p.Audience,
+		NotBefore: jwt.NewNumericDate(k.config.Clock.Now().Add(-10 * time.Second)),
+		IssuedAt:  jwt.NewNumericDate(k.config.Clock.Now()),
+		Expiry:    jwt.NewNumericDate(p.Expires),
+	}
+
+	// RFC 7517 requires that `kid` be present in the JWT header if there are multiple keys in the JWKS.
+	// We ignore the error because go-jose omits the kid if it is empty.
+	kid, _ := KeyID(k.config.PublicKey)
+	return k.sign(claims, (&jose.SignerOptions{}).WithHeader("kid", kid))
+}
+
+// VerifyPluginToken verifies a JWT token for a Teleport plugin.
+func (k *Key) VerifyPluginToken(token string, claims PluginTokenParam) (*Claims, error) {
+	expectedClaims := jwt.Expected{
+		Issuer:   claims.Issuer,
+		Subject:  claims.Subject,
+		Audience: claims.Audience,
+		Time:     k.config.Clock.Now(),
+	}
+	return k.verify(token, expectedClaims)
+}
diff --git a/lib/jwt/jwt_test.go b/lib/jwt/jwt_test.go
index b9ab5cd17d622..8d102eef142fa 100644
--- a/lib/jwt/jwt_test.go
+++ b/lib/jwt/jwt_test.go
@@ -61,7 +61,7 @@ func TestSignAndVerify(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			//decode the signed token
+			// decode the signed token
 			decodedToken, err := josejwt.ParseSigned(token)
 			require.NoError(t, err)
 
@@ -379,3 +379,49 @@ func TestExpiry(t *testing.T) {
 		})
 	}
 }
+
+func TestKey_SignAndVerifyPluginToken(t *testing.T) {
+	t.Parallel()
+	for _, alg := range supportedAlgorithms {
+		t.Run(alg.String(), func(t *testing.T) {
+			privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(alg)
+			require.NoError(t, err)
+
+			clock := clockwork.NewFakeClockAt(time.Now())
+			const clusterName = "teleport-test"
+
+			// Create a new key that can sign and verify tokens.
+			key, err := New(&Config{
+				PrivateKey:  privateKey,
+				ClusterName: clusterName,
+				Clock:       clock,
+			})
+			require.NoError(t, err)
+
+			// Sign a token with the new key.
+			expiresIn := time.Minute * 5
+			token, err := key.SignPluginToken(PluginTokenParam{
+				Issuer:   "https://localhost/",
+				Subject:  "system:proxy",
+				Audience: []string{"plugin:12345"},
+				Expires:  clock.Now().Add(expiresIn),
+			})
+			require.NoError(t, err)
+
+			_, err = key.VerifyPluginToken(token, PluginTokenParam{
+				Issuer:   "https://localhost/",
+				Subject:  "system:proxy",
+				Audience: []string{"plugin:12345"},
+			})
+			require.NoError(t, err, token)
+
+			// Check that if params don't match verification fails
+			_, err = key.VerifyPluginToken(token, PluginTokenParam{
+				Issuer:   "https://localhost/",
+				Subject:  "system:proxy",
+				Audience: []string{"plugin:9999"},
+			})
+			require.Error(t, err)
+		})
+	}
+}
diff --git a/lib/kube/grpc/grpc.go b/lib/kube/grpc/grpc.go
index 7e59db205b80e..a17d580e7da0f 100644
--- a/lib/kube/grpc/grpc.go
+++ b/lib/kube/grpc/grpc.go
@@ -23,9 +23,12 @@ import (
 	"errors"
 	"log/slog"
 	"slices"
+	"strings"
 
 	"github.com/gravitational/trace"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/gravitational/teleport"
@@ -47,10 +50,11 @@ var errDone = errors.New("done iterating")
 // Server implements KubeService gRPC server.
 type Server struct {
 	proto.UnimplementedKubeServiceServer
-	cfg          Config
-	proxyAddress string
-	kubeProxySNI string
-	kubeClient   kubernetes.Interface
+	cfg               Config
+	proxyAddress      string
+	kubeProxySNI      string
+	kubeClient        kubernetes.Interface
+	kubeDynamicClient *dynamic.DynamicClient
 }
 
 // New creates a new instance of Kube gRPC handler.
@@ -70,7 +74,7 @@ func New(cfg Config) (*Server, error) {
 
 	s := &Server{cfg: cfg, proxyAddress: addr, kubeProxySNI: sni}
 
-	if s.kubeClient, err = s.buildKubeClient(); err != nil {
+	if err := s.buildKubeClient(); err != nil {
 		return nil, trace.Wrap(err, "unable to create kubeClient")
 	}
 
@@ -190,7 +194,7 @@ func (s *Server) ListKubernetesResources(ctx context.Context, req *proto.ListKub
 	case requiresFakePagination(req):
 		rsp, err := s.listResourcesUsingFakePagination(ctx, req)
 		return rsp, trail.ToGRPC(err)
-	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType):
+	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType) || strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube):
 		rsp, err := s.listKubernetesResources(ctx, true, req)
 		return rsp, trail.ToGRPC(err)
 	default:
@@ -282,6 +286,77 @@ func (s *Server) listKubernetesResources(
 	return rsp, trace.Wrap(err)
 }
 
+func fetchAPIGroups(ctx context.Context, clientset kubernetes.Interface) (*metav1.APIGroupList, error) {
+	restClient := clientset.Discovery().RESTClient()
+
+	var groupList metav1.APIGroupList
+	if err := restClient.Get().AbsPath("/apis").Do(ctx).Into(&groupList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &groupList, nil
+}
+
+func fetchAPIResources(ctx context.Context, clientset kubernetes.Interface, apiGroup, version string) (*metav1.APIResourceList, error) {
+	absPath := ""
+	if apiGroup == "" {
+		absPath = "/api/v1"
+	} else {
+		absPath = "/apis/" + apiGroup + "/" + version
+	}
+	restClient := clientset.Discovery().RESTClient()
+
+	var rsList metav1.APIResourceList
+	if err := restClient.Get().AbsPath(absPath).Do(ctx).Into(&rsList); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &rsList, nil
+}
+
+// lookupAPIGroupVersions looks up the GroupKind in the actual API Group list.
+// Returns the extracted api group name, and the list of versions, starting with the preferred version.
+func lookupAPIGroupVersions(ctx context.Context, kubeClient kubernetes.Interface, gk schema.GroupKind) (apiGroup string, versions []string, err error) {
+	if gk.Group == "" {
+		return "", []string{"v1"}, nil
+	}
+	groupList, err := fetchAPIGroups(ctx, kubeClient)
+	if err != nil {
+		return "", nil, trace.Wrap(err)
+	}
+	for _, g := range groupList.Groups {
+		if g.Name != gk.Group {
+			continue
+		}
+		versions := []string{g.PreferredVersion.Version}
+		for _, elem := range g.Versions {
+			if elem.Version == g.PreferredVersion.Version {
+				continue
+			}
+			versions = append(versions, elem.Version)
+		}
+		return gk.Group, versions, nil
+	}
+	return "", nil, trace.BadParameter("unsupported resource type %q in group %q", gk.Kind, gk.Group)
+}
+
+// lookupAPIResource looks up the given resource kind.apiGroup in the actual API Resource list for the given versions.
+// Expects the versions list to start with the preferred one and returns the first match.
+func lookupAPIResource(ctx context.Context, kubeClient kubernetes.Interface, gk schema.GroupKind, versions []string) (version string, isClusterWide bool, err error) {
+	// Lookup the resource version, starting from the group preferred version.
+	for _, v := range versions {
+		// Lookup the resource within the group/version.
+		// The goal is to 1) validate that the resource exists and 2) get the
+		// namespaced scope of the resource.
+		rs, err := fetchAPIResources(ctx, kubeClient, gk.Group, v)
+		if err != nil {
+			return "", false, trace.Wrap(err)
+		}
+		if idx := slices.IndexFunc(rs.APIResources, func(r metav1.APIResource) bool { return r.Name == gk.Kind }); idx != -1 {
+			return v, !rs.APIResources[idx].Namespaced, nil
+		}
+	}
+	return "", false, trace.BadParameter("unsupported resource type %q in group %q versions %v", gk.Kind, gk.Group, versions)
+}
+
 // iterateKubernetesResources creates a new Kubernetes Client with temporary user
 // certificates and iterates through the returned Kubernetes resources.
 // For each resources discovered, the fn function is called to decide the action.
@@ -299,9 +374,19 @@ func (s *Server) iterateKubernetesResources(
 	fn func(*types.KubernetesResourceV1, string) (int, error),
 ) error {
 	kubeClient := s.kubeClient
+	kubeDynamicClient := s.kubeDynamicClient
 
+	// Pagination.
 	continueKey := req.StartKey
 	itemsAppended := 0
+
+	// Unknown resources.
+	resourceType := req.ResourceType
+	apiGroup := ""
+	version := ""
+
+	// Flag to format/validate the resourceID.
+	isClusterWide := false
 	for {
 		var (
 			items           []kObject
@@ -312,6 +397,7 @@ func (s *Server) iterateKubernetesResources(
 			}
 		)
 
+		// TODO(@creack): DELETE IN v20.0.0 when we no longer support tsh v18.
 		switch req.ResourceType {
 		case types.KindKubePod:
 			lItems, err := kubeClient.CoreV1().Pods(req.KubernetesNamespace).List(ctx, listOpts)
@@ -335,6 +421,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeNamespace:
+			isClusterWide = true
 			lItems, err := kubeClient.CoreV1().Namespaces().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -356,6 +443,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeNode:
+			isClusterWide = true
 			lItems, err := kubeClient.CoreV1().Nodes().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -363,6 +451,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubePersistentVolume:
+			isClusterWide = true
 			lItems, err := kubeClient.CoreV1().PersistentVolumes().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -405,6 +494,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeClusterRole:
+			isClusterWide = true
 			lItems, err := kubeClient.RbacV1().ClusterRoles().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -419,6 +509,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeClusterRoleBinding:
+			isClusterWide = true
 			lItems, err := kubeClient.RbacV1().ClusterRoleBindings().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -447,6 +538,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeCertificateSigningRequest:
+			isClusterWide = true
 			lItems, err := kubeClient.CertificatesV1().CertificateSigningRequests().List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
@@ -461,11 +553,50 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		default:
-			return trace.BadParameter("unsupported resource type: %q", req.ResourceType)
+			// If we don't have a known legacy value, we expect a 'kube:' prefix.
+			if !strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube) {
+				return trace.BadParameter("unsupported resource type %q", resourceType)
+			}
+
+			// If the apiGroup var is not set, it is the first time we are here,
+			// Lookup the group versions to validate the requested group actually exists.
+			// The next iteration of paginatin, we don't need to lookup the values again.
+			if apiGroup == "" && version == "" {
+				// TODO(@creack): Consider caching the discovery. Needs to be periodically invalidated.
+				// As it is only for the access request search, it is likely not heavily used and the request
+				// is between us and kube_proxy which is likely on the same host.
+				gk := schema.ParseGroupKind(strings.TrimPrefix(req.ResourceType, types.AccessRequestPrefixKindKube))
+				resourceType = gk.Kind
+				g, versions, err := lookupAPIGroupVersions(ctx, kubeClient, gk)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				v, clusterWide, err := lookupAPIResource(ctx, kubeClient, gk, versions)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				apiGroup, version, isClusterWide = g, v, clusterWide
+			}
+
+			// NOTE: The CLI sends the 'default' namespace regardless of the kind. Make sure to clear it out for globals.
+			if req.KubernetesNamespace == defaults.Namespace && isClusterWide {
+				req.KubernetesNamespace = ""
+			}
+
+			lItems, err := kubeDynamicClient.Resource(schema.GroupVersionResource{
+				Group:    apiGroup,
+				Version:  version,
+				Resource: resourceType,
+			}).Namespace(req.KubernetesNamespace).List(ctx, listOpts)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
+			nextContinueKey = lItems.GetContinue()
 		}
 
 		for _, resource := range items {
-			resource, err := getKubernetesResourceFromKObject(resource, req.ResourceType)
+			resource, err := getKubernetesResourceFromKObject(resource, !isClusterWide, req.ResourceType)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -495,11 +626,19 @@ type kObject interface {
 // getKubernetesResourceFromKObject converts a Kubernetes object to a
 // KubernetesResourceV1.
 func getKubernetesResourceFromKObject(
-	kObj kObject,
+	kObj kObject, namespaced bool,
 	resourceType string,
 ) (*types.KubernetesResourceV1, error) {
+	if strings.HasPrefix(resourceType, types.AccessRequestPrefixKindKube) {
+		if namespaced {
+			resourceType = strings.Replace(resourceType, types.AccessRequestPrefixKindKube, types.AccessRequestPrefixKindKubeNamespaced, 1)
+		} else {
+			resourceType = strings.Replace(resourceType, types.AccessRequestPrefixKindKube, types.AccessRequestPrefixKindKubeClusterWide, 1)
+		}
+	}
 	return types.NewKubernetesResourceV1(
 		resourceType,
+		namespaced,
 		types.Metadata{
 			Name:   kObj.GetName(),
 			Labels: kObj.GetLabels(),
@@ -515,6 +654,9 @@ func getKubernetesResourceFromKObject(
 // This is needed because the Kubernetes API returns a list of items, but
 // only a list of pointers to items satisfies the kObject interface.
 func itemListToItemListPtr[T any](items []T) []*T {
+	if len(items) == 0 {
+		return nil
+	}
 	kObjects := make([]*T, len(items))
 	for i := range items {
 		kObjects[i] = &(items[i])
@@ -525,6 +667,9 @@ func itemListToItemListPtr[T any](items []T) []*T {
 // itemListToKObjectList is a helper function that converts a list of items
 // to a list of kObjects.
 func itemListToKObjectList[T kObject](items []T) []kObject {
+	if len(items) == 0 {
+		return nil
+	}
 	kObjects := make([]kObject, len(items))
 	for i, item := range items {
 		kObjects[i] = item
@@ -544,7 +689,7 @@ func (s *Server) listResourcesUsingFakePagination(
 		err error
 	)
 	switch {
-	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType):
+	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType) || strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube):
 		rsp, err = s.listKubernetesResources(ctx, false /* do not respect the limit value */, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/kube/grpc/grpc_test.go b/lib/kube/grpc/grpc_test.go
index 952cecc132259..f548fe82929d8 100644
--- a/lib/kube/grpc/grpc_test.go
+++ b/lib/kube/grpc/grpc_test.go
@@ -24,6 +24,7 @@ import (
 	"crypto/x509"
 	"log/slog"
 	"net"
+	"slices"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -39,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
@@ -118,7 +120,7 @@ func TestListKubernetesResources(t *testing.T) {
 				// set the role to allow searching as fullAccessRole.
 				role.SetSearchAsRoles(types.Allow, []string{fullAccessRole.GetName()})
 				// restrict querying to pods only
-				role.SetRequestKubernetesResources(types.Allow, []types.RequestKubernetesResource{{Kind: "namespace"}, {Kind: "pod"}})
+				role.SetRequestKubernetesResources(types.Allow, []types.RequestKubernetesResource{{Kind: "namespaces"}, {Kind: "pods"}})
 			},
 		},
 	)
@@ -137,7 +139,7 @@ func TestListKubernetesResources(t *testing.T) {
 				// set the role to allow searching as fullAccessRole.
 				role.SetSearchAsRoles(types.Allow, []string{fullAccessRole.GetName()})
 				// restrict querying to secrets only
-				role.SetRequestKubernetesResources(types.Allow, []types.RequestKubernetesResource{{Kind: "secret"}})
+				role.SetRequestKubernetesResources(types.Allow, []types.RequestKubernetesResource{{Kind: "secrets"}})
 
 			},
 		},
@@ -618,8 +620,9 @@ func TestListKubernetesResources(t *testing.T) {
 			tt.assertErr(t, err)
 			if tt.want != nil {
 				for _, want := range tt.want.Resources {
+					isClusterWide := slices.Contains(types.KubernetesClusterWideResourceKinds, want.Kind)
 					// fill in defaults
-					err := want.CheckAndSetDefaults()
+					err := want.CheckAndSetDefaults(!isClusterWide)
 					require.NoError(t, err)
 				}
 			}
@@ -631,7 +634,7 @@ func TestListKubernetesResources(t *testing.T) {
 // initGRPCServer creates a grpc server serving on the provided listener.
 func initGRPCServer(t *testing.T, testCtx *TestContext, listener net.Listener) {
 	clusterName := testCtx.ClusterName
-	serverIdentity, err := auth.NewServerIdentity(testCtx.AuthServer, testCtx.HostID, types.RoleProxy)
+	serverIdentity, err := authtest.NewServerIdentity(testCtx.AuthServer, testCtx.HostID, types.RoleProxy)
 	require.NoError(t, err)
 	tlsConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -660,7 +663,7 @@ func initGRPCServer(t *testing.T, testCtx *TestContext, listener net.Listener) {
 	)
 	t.Cleanup(grpcServer.GracefulStop)
 	// Auth client, lock watcher and authorizer for Kube proxy.
-	proxyAuthClient, err := testCtx.TLSServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := testCtx.TLSServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
diff --git a/lib/kube/grpc/utils.go b/lib/kube/grpc/utils.go
index 53770e1241ad9..a0b2d9ed53a8f 100644
--- a/lib/kube/grpc/utils.go
+++ b/lib/kube/grpc/utils.go
@@ -27,12 +27,13 @@ import (
 
 	"github.com/gravitational/trace"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/kube/internal"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -67,7 +68,7 @@ func getWebAddrAndKubeSNI(proxyAddr string) (string, string, error) {
 
 // buildKubeClient creates a new Kubernetes client that is used to communicate
 // with the Kubernetes API server.
-func (s *Server) buildKubeClient() (kubernetes.Interface, error) {
+func (s *Server) buildKubeClient() error {
 	const idleConnsPerHost = 25
 
 	tlsConfig := utils.TLSConfig(s.cfg.ConnTLSCipherSuites)
@@ -94,10 +95,21 @@ func (s *Server) buildKubeClient() (kubernetes.Interface, error) {
 
 	cfg := &rest.Config{
 		Host:      s.proxyAddress,
-		Transport: auth.NewImpersonatorRoundTripper(transport),
+		Transport: internal.NewImpersonatorRoundTripper(transport),
 	}
+
 	kubeClient, err := kubernetes.NewForConfig(cfg)
-	return kubeClient, trace.Wrap(err)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.kubeClient = kubeClient
+	dynamicClient, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.kubeDynamicClient = dynamicClient
+
+	return nil
 }
 
 // decideLimit returns the number of items we should request for. If respectLimit
diff --git a/lib/kube/grpc/utils_test.go b/lib/kube/grpc/utils_test.go
index a74958d9de9f0..94b33adc00f8f 100644
--- a/lib/kube/grpc/utils_test.go
+++ b/lib/kube/grpc/utils_test.go
@@ -52,11 +52,13 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/keygen"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/kube/proxy"
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
@@ -66,13 +68,13 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	sessPkg "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type TestContext struct {
 	HostID               string
 	ClusterName          string
-	TLSServer            *auth.TestTLSServer
+	TLSServer            *authtest.TLSServer
 	AuthServer           *auth.Server
 	AuthClient           *authclient.Client
 	Authz                authz.Authorizer
@@ -125,7 +127,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	kubeConfigLocation := newKubeConfigFile(t, cfg.Clusters...)
 
 	// Create and start test auth server.
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
 		ClusterName: testCtx.ClusterName,
 		Dir:         t.TempDir(),
@@ -141,7 +143,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		// the LockWatcher to hit the connection rate limit and fail with an error
 		// different from the expected one. We setup a custom rate limiter to avoid
 		// this issue.
-		auth.WithLimiterConfig(
+		authtest.WithLimiterConfig(
 			&limiter.Config{
 				MaxConnections: 100000,
 			},
@@ -162,12 +164,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	require.NoError(t, err)
 
 	// Auth client for Kube service.
-	testCtx.AuthClient, err = testCtx.TLSServer.NewClient(auth.TestServerID(types.RoleKube, testCtx.HostID))
+	testCtx.AuthClient, err = testCtx.TLSServer.NewClient(authtest.TestServerID(types.RoleKube, testCtx.HostID))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, testCtx.AuthClient.Close()) })
 
 	// Auth client, lock watcher and authorizer for Kube proxy.
-	proxyAuthClient, err := testCtx.TLSServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := testCtx.TLSServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
@@ -189,7 +191,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	require.NoError(t, err)
 
 	// TLS config for kube proxy and Kube service.
-	serverIdentity, err := auth.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleKube)
+	serverIdentity, err := authtest.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleKube)
 	require.NoError(t, err)
 	kubeServiceTLSConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -228,6 +230,19 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	testCtx.kubeProxyListener, err = net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
+	healthCheckManager, err := healthcheck.NewManager(
+		testCtx.Context,
+		healthcheck.ManagerConfig{
+			Component:               teleport.ComponentKube,
+			Events:                  client,
+			HealthCheckConfigReader: client,
+		},
+	)
+	require.NoError(t, err)
+	err = healthCheckManager.Start(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, healthCheckManager.Close()) })
+
 	inventoryHandle, err := inventory.NewDownstreamHandle(client.InventoryControlStream,
 		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
 			return &proto.UpstreamInventoryHello{
@@ -281,12 +296,13 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		// each time heartbeat is called we insert data into the channel.
 		// this is used to make sure that heartbeat started and the clusters
 		// are registered in the auth server
-		OnHeartbeat:      func(err error) {},
-		GetRotation:      func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
-		ResourceMatchers: cfg.ResourceMatchers,
-		OnReconcile:      cfg.OnReconcile,
-		Log:              utils.NewSlogLoggerForTests(),
-		InventoryHandle:  inventoryHandle,
+		OnHeartbeat:        func(err error) {},
+		GetRotation:        func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
+		ResourceMatchers:   cfg.ResourceMatchers,
+		OnReconcile:        cfg.OnReconcile,
+		Log:                logtest.NewLogger(),
+		InventoryHandle:    inventoryHandle,
+		HealthCheckManager: healthCheckManager,
 	})
 	require.NoError(t, err)
 
@@ -305,7 +321,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	t.Cleanup(kubeServersWatcher.Close)
 
 	// TLS config for kube proxy and Kube service.
-	proxyServerIdentity, err := auth.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleProxy)
+	proxyServerIdentity, err := authtest.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleProxy)
 	require.NoError(t, err)
 	proxyTLSConfig, err := proxyServerIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -316,9 +332,9 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	testCtx.KubeProxy, err = proxy.NewTLSServer(proxy.TLSServerConfig{
 		ForwarderConfig: proxy.ForwarderConfig{
 			ReverseTunnelSrv: &reversetunnelclient.FakeServer{
-				Sites: []reversetunnelclient.RemoteSite{
-					&fakeRemoteSite{
-						FakeRemoteSite: reversetunnelclient.NewFakeRemoteSite(testCtx.ClusterName, client),
+				FakeClusters: []reversetunnelclient.Cluster{
+					&fakeCluster{
+						FakeCluster: reversetunnelclient.NewFakeCluster(testCtx.ClusterName, client),
 						idToAddr: map[string]string{
 							testCtx.HostID: testCtx.kubeServerListener.Addr().String(),
 						},
@@ -362,11 +378,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		LimiterConfig: limiter.Config{
 			MaxConnections: 1000,
 		},
-		Log:             utils.NewSlogLoggerForTests(),
+		Log:             logtest.NewLogger(),
 		InventoryHandle: inventoryHandle,
 		GetRotation: func(role types.SystemRole) (*types.Rotation, error) {
 			return &types.Rotation{}, nil
 		},
+		HealthCheckManager: healthCheckManager,
 	})
 	require.NoError(t, err)
 	require.Equal(t, testCtx.KubeServer.Server.ReadTimeout, time.Duration(0), "kube server write timeout must be 0")
@@ -451,12 +468,12 @@ type RoleSpec struct {
 
 // CreateUserWithTraitsAndRole creates Teleport user and role with specified names
 func (c *TestContext) CreateUserWithTraitsAndRole(ctx context.Context, t *testing.T, username string, userTraits map[string][]string, roleSpec RoleSpec) (types.User, types.Role) {
-	user, role, err := auth.CreateUserAndRole(
+	user, role, err := authtest.CreateUserAndRole(
 		c.TLSServer.Auth(),
 		username,
 		[]string{roleSpec.Name},
 		nil,
-		auth.WithUserMutator(func(user types.User) {
+		authtest.WithUserMutator(func(user types.User) {
 			user.SetTraits(userTraits)
 		}),
 	)
@@ -664,14 +681,14 @@ func (f *fakeClient) CreateSessionTracker(ctx context.Context, st types.SessionT
 	}
 }
 
-// fakeRemoteSite is a fake remote site that uses a map to map server IDs to
+// fakeCluster is a fake cluster that uses a map to map server IDs to
 // addresses to simulate reverse tunneling.
-type fakeRemoteSite struct {
-	*reversetunnelclient.FakeRemoteSite
+type fakeCluster struct {
+	*reversetunnelclient.FakeCluster
 	idToAddr map[string]string
 }
 
-func (f *fakeRemoteSite) DialTCP(p reversetunnelclient.DialParams) (conn net.Conn, err error) {
+func (f *fakeCluster) DialTCP(p reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	// The server ID is the first part of the address.
 	addr, ok := f.idToAddr[strings.Split(p.ServerID, ".")[0]]
 	if !ok {
diff --git a/lib/kube/internal/http.go b/lib/kube/internal/http.go
new file mode 100644
index 0000000000000..0e8db4dab69a7
--- /dev/null
+++ b/lib/kube/internal/http.go
@@ -0,0 +1,111 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package internal
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/authz"
+)
+
+const (
+	// teleportImpersonateUserHeader is a header that specifies teleport user identity
+	// that the proxy is impersonating.
+	teleportImpersonateUserHeader = "Teleport-Impersonate-User"
+	// teleportImpersonateIPHeader is a header that specifies the real user IP address.
+	teleportImpersonateIPHeader = "Teleport-Impersonate-IP"
+)
+
+// ImpersonatorRoundTripper is a round tripper that impersonates a user with
+// the identity provided.
+type ImpersonatorRoundTripper struct {
+	http.RoundTripper
+}
+
+// NewImpersonatorRoundTripper returns a new impersonator round tripper.
+func NewImpersonatorRoundTripper(rt http.RoundTripper) *ImpersonatorRoundTripper {
+	return &ImpersonatorRoundTripper{
+		RoundTripper: rt,
+	}
+}
+
+// RoundTrip implements [http.RoundTripper] to include the identity
+// in the request header.
+func (r *ImpersonatorRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+
+	identity, err := authz.UserFromContext(req.Context())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	b, err := json.Marshal(identity.GetIdentity())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	req.Header.Set(teleportImpersonateUserHeader, string(b))
+
+	clientSrcAddr, err := authz.ClientSrcAddrFromContext(req.Context())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	req.Header.Set(teleportImpersonateIPHeader, clientSrcAddr.String())
+
+	return r.RoundTripper.RoundTrip(req)
+}
+
+// CloseIdleConnections ensures that the returned [net.RoundTripper]
+// has a CloseIdleConnections method.
+func (r *ImpersonatorRoundTripper) CloseIdleConnections() {
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if c, ok := r.RoundTripper.(closeIdler); ok {
+		c.CloseIdleConnections()
+	}
+}
+
+// IdentityForwardingHeaders returns a copy of the provided headers with
+// the TeleportImpersonateUserHeader and TeleportImpersonateIPHeader headers
+// set to the identity provided.
+// The returned headers shouldn't be used across requests as they contain
+// the client's IP address and the user's identity.
+func IdentityForwardingHeaders(ctx context.Context, originalHeaders http.Header) (http.Header, error) {
+	identity, err := authz.UserFromContext(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	b, err := json.Marshal(identity.GetIdentity())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	headers := originalHeaders.Clone()
+	headers.Set(teleportImpersonateUserHeader, string(b))
+
+	clientSrcAddr, err := authz.ClientSrcAddrFromContext(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	headers.Set(teleportImpersonateIPHeader, clientSrcAddr.String())
+	return headers, nil
+}
diff --git a/lib/kube/kubeconfig/kubeconfig.go b/lib/kube/kubeconfig/kubeconfig.go
index c77f9ce39afff..a7e0ceba2790e 100644
--- a/lib/kube/kubeconfig/kubeconfig.go
+++ b/lib/kube/kubeconfig/kubeconfig.go
@@ -21,7 +21,9 @@ package kubeconfig
 
 import (
 	"bytes"
+	"cmp"
 	"context"
+	"encoding/json"
 	"fmt"
 	"maps"
 	"os"
@@ -42,9 +44,24 @@ import (
 var log = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentKubeClient)
 
 const (
-	// teleportKubeClusterNameExtension is the name of the extension that
-	// contains the Teleport Kube cluster name.
-	teleportKubeClusterNameExtension = "teleport.kube.name"
+	// extKubeClusterName is the name of the extension that contains the
+	// Teleport Kube cluster name. Its associated value is a string.
+	extKubeClusterName = "teleport.kube.name"
+
+	// extTeleClusterName is the name of the extension that contains the
+	// Teleport cluster name. Its associated value is a string.
+	extTeleClusterName = "kubeconfig.teleport.dev/teleport-cluster-name"
+
+	// extProfileName is the name of the extension that contains the name of the
+	// profile that should be used to connect to the Kube cluster. Its
+	// associated value is a string.
+	extProfileName = "kubeconfig.teleport.dev/profile-name"
+
+	// extPreviousSelectedContext is the name of the extension that signals a
+	// context that was set as the current context before the Teleport client
+	// set a different context as the current context. Its associated value is
+	// written as a null and it's never read.
+	extPreviousSelectedContext = "teleport-prev-selec-ctx"
 )
 
 // Values are Teleport user data needed to generate kubeconfig entries.
@@ -68,8 +85,9 @@ type Values struct {
 	// This value is empty if a proxy was not specified.
 	ProxyAddr string
 
-	// TLSServerName is SNI host value passed to the server.
-	TLSServerName string
+	// TLSServerNameFunc, if set, returns the SNI used when connecting to a
+	// given kube cluster in a given Teleport cluster.
+	TLSServerNameFunc func(teleportClusterName, kubeClusterName string) string
 
 	// Impersonate allows to define the default impersonated user.
 	// Must be a subset of kubernetes_users or the Teleport username
@@ -91,6 +109,14 @@ type Values struct {
 	OverrideContext string
 }
 
+func (v Values) TLSServerName(teleportClusterName, kubeClusterName string) string {
+	if v.TLSServerNameFunc == nil {
+		return ""
+	}
+
+	return v.TLSServerNameFunc(teleportClusterName, kubeClusterName)
+}
+
 // ExecValues contain values for configuring tsh as an exec auth plugin in
 // kubeconfig.
 type ExecValues struct {
@@ -163,15 +189,9 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 	if len(cas) == 0 {
 		return trace.BadParameter("TLS trusted CAs missing in provided credentials")
 	}
-	config.Clusters[v.TeleportClusterName] = &clientcmdapi.Cluster{
-		Server:                   v.ClusterAddr,
-		CertificateAuthorityData: cas,
-		TLSServerName:            v.TLSServerName,
-	}
 
 	if v.Exec != nil {
 		// Called from tsh, use the exec plugin model.
-		clusterName := v.TeleportClusterName
 		envVars := make([]clientcmdapi.ExecEnvVar, 0, len(v.Exec.Env))
 		if v.Exec.Env != nil {
 			for name, value := range v.Exec.Env {
@@ -181,7 +201,6 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 
 		for _, c := range v.KubeClusters {
 			contextName := ContextName(v.TeleportClusterName, c)
-			authName := contextName
 			if contextTmpl != nil {
 				if contextName, err = executeKubeContextTemplate(contextTmpl, v.TeleportClusterName, c); err != nil {
 					return trace.Wrap(err)
@@ -210,9 +229,40 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 			if len(envVars) > 0 {
 				authInfo.Exec.Env = envVars
 			}
-			config.AuthInfos[authName] = authInfo
+			config.AuthInfos[contextName] = authInfo
+
+			setStringExtensionInAuthInfo(config.AuthInfos[contextName], extTeleClusterName, v.TeleportClusterName)
+			setStringExtensionInAuthInfo(config.AuthInfos[contextName], extKubeClusterName, c)
+
+			config.Clusters[contextName] = &clientcmdapi.Cluster{
+				Server:                   v.ClusterAddr,
+				CertificateAuthorityData: cas,
+				TLSServerName:            v.TLSServerName(v.TeleportClusterName, c),
+			}
+
+			setStringExtensionInCluster(config.Clusters[contextName], extTeleClusterName, v.TeleportClusterName)
+			setStringExtensionInCluster(config.Clusters[contextName], extKubeClusterName, c)
 
-			setContext(config.Contexts, contextName, clusterName, authName, c, v.Namespace)
+			// XXX(espadolini): this assumes (as just about everything in
+			// tsh does) that the profile name is exactly the same as the
+			// hostname of the Proxy web address, and it would be more correct
+			// to update every callsite to also pass the profile name
+			var profileName string
+			if v.ProxyAddr != "" {
+				p, err := utils.Host(v.ProxyAddr)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				profileName = p
+			}
+			if profileName != "" {
+				setStringExtensionInCluster(config.Clusters[contextName], extProfileName, profileName)
+				setStringExtensionInAuthInfo(config.AuthInfos[contextName], extProfileName, profileName)
+			}
+
+			clusterName := contextName
+			authName := contextName
+			setContext(config.Contexts, contextName, clusterName, authName, profileName, v.TeleportClusterName, c, v.Namespace)
 		}
 		if v.SelectCluster != "" {
 			contextName := ContextName(v.TeleportClusterName, v.SelectCluster)
@@ -236,12 +286,11 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 			return trace.BadParameter("Multi-cluster mode not supported when using Credentials")
 		}
 
-		clusterName := v.TeleportClusterName
-		contextName := clusterName
+		contextName := v.TeleportClusterName
 		var kubeClusterName string
 		if len(v.KubeClusters) == 1 {
 			kubeClusterName = v.KubeClusters[0]
-			contextName = ContextName(clusterName, kubeClusterName)
+			contextName = ContextName(v.TeleportClusterName, kubeClusterName)
 		}
 
 		// Called when generating an identity file, use plaintext credentials.
@@ -261,7 +310,37 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 				ClientCertificateData: v.Credentials.TLSCert,
 				ClientKeyData:         keyPEM,
 			}
-			setContext(config.Contexts, contextName, clusterName, contextName, kubeClusterName, v.Namespace)
+
+			config.Clusters[contextName] = &clientcmdapi.Cluster{
+				Server:                   v.ClusterAddr,
+				CertificateAuthorityData: cas,
+				TLSServerName:            v.TLSServerName(v.TeleportClusterName, cmp.Or(kubeClusterName, v.TeleportClusterName)),
+			}
+
+			setStringExtensionInCluster(config.Clusters[contextName], extTeleClusterName, v.TeleportClusterName)
+			setStringExtensionInAuthInfo(config.AuthInfos[contextName], extTeleClusterName, v.TeleportClusterName)
+
+			if kubeClusterName != "" {
+				setStringExtensionInCluster(config.Clusters[contextName], extKubeClusterName, kubeClusterName)
+				setStringExtensionInAuthInfo(config.AuthInfos[contextName], extKubeClusterName, kubeClusterName)
+			}
+
+			var profileName string
+			if v.ProxyAddr != "" {
+				p, err := utils.Host(v.ProxyAddr)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				profileName = p
+			}
+			if profileName != "" {
+				setStringExtensionInCluster(config.Clusters[contextName], extProfileName, profileName)
+				setStringExtensionInAuthInfo(config.AuthInfos[contextName], extProfileName, profileName)
+			}
+
+			authName := contextName
+			clusterName := contextName
+			setContext(config.Contexts, contextName, clusterName, authName, profileName, v.TeleportClusterName, kubeClusterName, v.Namespace)
 			setSelectedExtension(config.Contexts, config.CurrentContext, clusterName)
 			config.CurrentContext = contextName
 		} else if !trace.IsBadParameter(err) {
@@ -270,10 +349,29 @@ func UpdateConfig(path string, v Values, storeAllCAs bool, fs ConfigFS) error {
 		log.WarnContext(context.Background(), "Kubernetes integration is not supported when logging in with a hardware private key", "error", err)
 	}
 
+	// kubeconfig files generated by older versions of Teleport might use a
+	// single cluster with the same name as the Teleport cluster for all
+	// contexts, and we can't unconditionally delete it because there might be
+	// contexts that we haven't modified here that still use it (and it might in
+	// fact be used by the single-cluster mode if there's no kube cluster name
+	// available)
+	if _, legacyClusterExists := config.Clusters[v.TeleportClusterName]; legacyClusterExists {
+		var inUse bool
+		for _, context := range config.Contexts {
+			if context.Cluster == v.TeleportClusterName {
+				inUse = true
+				break
+			}
+		}
+		if !inUse {
+			delete(config.Clusters, v.TeleportClusterName)
+		}
+	}
+
 	return SaveConfig(path, *config, fs)
 }
 
-func setContext(contexts map[string]*clientcmdapi.Context, name, cluster, auth, kubeName, namespace string) {
+func setContext(contexts map[string]*clientcmdapi.Context, name, cluster, auth, profileName, teleportClusterName, kubeClusterName, namespace string) {
 	lastContext := contexts[name]
 	newContext := &clientcmdapi.Context{
 		Cluster:  cluster,
@@ -284,14 +382,14 @@ func setContext(contexts map[string]*clientcmdapi.Context, name, cluster, auth,
 		newContext.Extensions = lastContext.Extensions
 	}
 
-	if newContext.Extensions == nil {
-		newContext.Extensions = make(map[string]runtime.Object)
+	if teleportClusterName != "" {
+		setStringExtensionInContext(newContext, extTeleClusterName, teleportClusterName)
 	}
-	if kubeName != "" {
-		newContext.Extensions[teleportKubeClusterNameExtension] = &runtime.Unknown{
-			// We need to wrap the kubeName in quotes to make sure it is parsed as a string.
-			Raw: []byte(fmt.Sprintf("%q", kubeName)),
-		}
+	if kubeClusterName != "" {
+		setStringExtensionInContext(newContext, extKubeClusterName, kubeClusterName)
+	}
+	if profileName != "" {
+		setStringExtensionInContext(newContext, extProfileName, profileName)
 	}
 
 	// If a user specifies the default namespace we should override it.
@@ -303,66 +401,91 @@ func setContext(contexts map[string]*clientcmdapi.Context, name, cluster, auth,
 	contexts[name] = newContext
 }
 
-// RemoveByClusterName removes Teleport configuration from kubeconfig.
+// RemoveByProfileName removes Teleport configuration from the kubeconfig file
+// for a given profile.
 //
-// If `path` is empty, RemoveByClusterName will try to guess it based on the environment or
-// known defaults.
-func RemoveByClusterName(path, clusterName string) error {
+// If `path` is empty, RemoveByProfileName will try to guess it based on the
+// environment or known defaults.
+func RemoveByProfileName(path, profileName string) error {
 	// Load existing kubeconfig from disk.
 	config, err := Load(path)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	removeByClusterName(config, clusterName)
+	removeByProfileName(config, profileName)
 
 	// Update kubeconfig on disk.
 	return trace.Wrap(Save(path, *config))
 }
 
-func removeByClusterName(config *clientcmdapi.Config, clusterName string) {
-	// Remove Teleport related AuthInfos, Clusters, and Contexts from kubeconfig.
-	maps.DeleteFunc(
-		config.Contexts,
-		func(key string, val *clientcmdapi.Context) bool {
-			if !strings.HasPrefix(key, clusterName) && val.Cluster != clusterName {
-				return false
-			}
-			delete(config.AuthInfos, val.AuthInfo)
-			delete(config.Clusters, val.Cluster)
-			return true
-		},
-	)
-	prevSelectedCluster := searchForSelectedCluster(config.Contexts)
-	// Take an element from the list of contexts and make it the current
-	// context, unless current context points to something else.
-	if strings.HasPrefix(config.CurrentContext, clusterName) {
-		config.CurrentContext = prevSelectedCluster
+func removeByProfileName(config *clientcmdapi.Config, profileName string) {
+	maps.DeleteFunc(config.Clusters, func(k string, v *clientcmdapi.Cluster) bool {
+		n, ok := getStringExtensionFromCluster(v, extProfileName)
+		return ok && n == profileName
+	})
+	maps.DeleteFunc(config.AuthInfos, func(k string, v *clientcmdapi.AuthInfo) bool {
+		n, ok := getStringExtensionFromAuthInfo(v, extProfileName)
+		return ok && n == profileName
+	})
+	maps.DeleteFunc(config.Contexts, func(k string, v *clientcmdapi.Context) bool {
+		n, ok := getStringExtensionFromContext(v, extProfileName)
+		return ok && n == profileName
+	})
+
+	if config.CurrentContext != "" {
+		if _, ok := config.Contexts[config.CurrentContext]; !ok {
+			// we shouldn't leave a deleted context as the current context, so
+			// we'll try restoring the context that was selected before we
+			// started updating the file or we blank it
+			config.CurrentContext = searchForSelectedCluster(config.Contexts)
+		}
 	}
 }
 
-// RemoveByServerAddr removes all clusters with the provided server address
-// from kubeconfig
+// RemoveByServerAddr removes all clusters with the provided server address from
+// kubeconfig, all contexts using said clusters, and all authinfos referenced by
+// those clusters.
 //
 // If `path` is empty, RemoveByServerAddr will try to guess it based on the
 // environment or known defaults.
-func RemoveByServerAddr(path, wantServer string) error {
+func RemoveByServerAddr(path, serverAddr string) error {
 	// Load existing kubeconfig from disk.
 	config, err := Load(path)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	removeByServerAddr(config, wantServer)
+	removeByServerAddr(config, serverAddr)
 
 	// Update kubeconfig on disk.
 	return trace.Wrap(Save(path, *config))
 }
 
-func removeByServerAddr(config *clientcmdapi.Config, wantServer string) {
+func removeByServerAddr(config *clientcmdapi.Config, serverAddr string) {
 	for clusterName, cluster := range config.Clusters {
-		if cluster.Server == wantServer {
-			removeByClusterName(config, clusterName)
+		if cluster.Server != serverAddr {
+			continue
+		}
+
+		delete(config.Clusters, clusterName)
+
+		for contextName, context := range config.Contexts {
+			if context.Cluster != clusterName {
+				continue
+			}
+
+			delete(config.AuthInfos, context.AuthInfo)
+			delete(config.Contexts, contextName)
+		}
+	}
+
+	if config.CurrentContext != "" {
+		if _, ok := config.Contexts[config.CurrentContext]; !ok {
+			// we shouldn't leave a deleted context as the current context, so
+			// we'll try restoring the context that was selected before we
+			// started updating the file or we blank it
+			config.CurrentContext = searchForSelectedCluster(config.Contexts)
 		}
 	}
 }
@@ -498,59 +621,117 @@ func PathFromEnv() string {
 	return configPath
 }
 
-// ContextName returns a kubeconfig context name generated by this package.
+// ContextName returns a kubeconfig context name generated by this package if no
+// template override is provided by the user.
 func ContextName(teleportCluster, kubeCluster string) string {
-	return fmt.Sprintf("%s-%s", teleportCluster, kubeCluster)
+	return teleportCluster + "-" + kubeCluster
 }
 
-// KubeClusterFromContext extracts the kubernetes cluster name from context
-// name generated by this package.
-func KubeClusterFromContext(contextName string, ctx *clientcmdapi.Context, teleportCluster string) string {
-	switch {
-	// If the context name starts with teleport cluster name, it was
-	// generated by tsh.
-	case strings.HasPrefix(contextName, teleportCluster+"-"):
-		return strings.TrimPrefix(contextName, teleportCluster+"-")
-		// If the context cluster matches teleport cluster, it was generated by
-		// tsh using --set-context-override flag.
-	case ctx != nil && ctx.Cluster == teleportCluster:
-		if v, ok := ctx.Extensions[teleportKubeClusterNameExtension]; ok {
-			if raw, ok := v.(*runtime.Unknown); ok && trimQuotes(string(raw.Raw)) != "" {
-				// The value is a JSON string, so we need to trim the quotes.
-				return trimQuotes(string(raw.Raw))
-			}
+// KubeClusterFromContext extracts the kubernetes cluster name from a kubeconfig
+// context generated by this package.
+func KubeClusterFromContext(contextName string, context *clientcmdapi.Context, teleportClusterName string) string {
+	if context == nil {
+		// we only have a context name available; assume the default format for
+		// context names because we can't do much else
+		if suffix, found := strings.CutPrefix(contextName, teleportClusterName+"-"); found {
+			return suffix
 		}
-		return contextName
-	default:
 		return ""
 	}
+
+	extTeleClusterName, hasExtTeleCluster := getStringExtensionFromContext(context, extTeleClusterName)
+	extKubeClusterName, hasExtKubeCluster := getStringExtensionFromContext(context, extKubeClusterName)
+
+	if hasExtTeleCluster && hasExtKubeCluster && extTeleClusterName == teleportClusterName {
+		return extKubeClusterName
+	}
+
+	// older kubeconfig files produced by this package used the Teleport cluster
+	// name as the name of the cluster
+	if context.Cluster == teleportClusterName {
+		if hasExtKubeCluster {
+			return extKubeClusterName
+		}
+		contextName, _ := strings.CutPrefix(contextName, teleportClusterName+"-")
+		return contextName
+	}
+
+	return ""
 }
 
-func trimQuotes(s string) string {
-	return strings.TrimSuffix(strings.TrimPrefix(s, "\""), "\"")
+func jsonMarshalString(s string) []byte {
+	// this will encode invalid utf8 bytes as U+FFFD, but it is otherwise infallible
+	j, _ := json.Marshal(s)
+	return j
 }
 
-// SelectContext switches the active kubeconfig context to point to the
-// provided kubeCluster in teleportCluster.
-func SelectContext(teleportCluster, kubeCluster string) error {
-	kc, err := Load("")
-	if err != nil {
-		return trace.Wrap(err)
+func getStringExtensionFromContext(context *clientcmdapi.Context, extName string) (string, bool) {
+	if context == nil {
+		return "", false
 	}
-
-	kubeContext := ContextName(teleportCluster, kubeCluster)
-	if _, ok := kc.Contexts[kubeContext]; !ok {
-		return trace.NotFound("kubeconfig context %q not found", kubeContext)
+	return getStringExtensionFromExtensionsMap(context.Extensions, extName)
+}
+func getStringExtensionFromCluster(cluster *clientcmdapi.Cluster, extName string) (string, bool) {
+	if cluster == nil {
+		return "", false
 	}
-	setSelectedExtension(kc.Contexts, kc.CurrentContext, teleportCluster)
-	kc.CurrentContext = kubeContext
-	if err := Save("", *kc); err != nil {
-		return trace.Wrap(err)
+	return getStringExtensionFromExtensionsMap(cluster.Extensions, extName)
+}
+func getStringExtensionFromAuthInfo(authInfo *clientcmdapi.AuthInfo, extName string) (string, bool) {
+	if authInfo == nil {
+		return "", false
 	}
-	return nil
+	return getStringExtensionFromExtensionsMap(authInfo.Extensions, extName)
 }
+func getStringExtensionFromExtensionsMap(extensions map[string]runtime.Object, extName string) (string, bool) {
+	rawExt, _ := extensions[extName].(*runtime.Unknown)
+	if rawExt == nil {
+		return "", false
+	}
 
-const selectedExtension = "teleport-prev-selec-ctx"
+	var s string
+	if err := json.Unmarshal(rawExt.Raw, &s); err != nil {
+		return "", false
+	}
+
+	return s, true
+}
+
+func setStringExtensionInContext(context *clientcmdapi.Context, extName, extVal string) {
+	if context == nil {
+		return
+	}
+	if context.Extensions == nil {
+		context.Extensions = make(map[string]runtime.Object)
+	}
+	setStringExtensionInExtensionsMap(context.Extensions, extName, extVal)
+}
+func setStringExtensionInCluster(cluster *clientcmdapi.Cluster, extName, extVal string) {
+	if cluster == nil {
+		return
+	}
+	if cluster.Extensions == nil {
+		cluster.Extensions = make(map[string]runtime.Object)
+	}
+	setStringExtensionInExtensionsMap(cluster.Extensions, extName, extVal)
+}
+func setStringExtensionInAuthInfo(authInfo *clientcmdapi.AuthInfo, extName, extVal string) {
+	if authInfo == nil {
+		return
+	}
+	if authInfo.Extensions == nil {
+		authInfo.Extensions = make(map[string]runtime.Object)
+	}
+	setStringExtensionInExtensionsMap(authInfo.Extensions, extName, extVal)
+}
+func setStringExtensionInExtensionsMap(extensions map[string]runtime.Object, extName, extVal string) {
+	if extensions == nil {
+		return
+	}
+	extensions[extName] = &runtime.Unknown{
+		Raw: jsonMarshalString(extVal),
+	}
+}
 
 // setSelectedExtension sets an extension to indentify that the current non-teleport
 // context was selected before introducing Teleport contexts in kubeconfig.
@@ -563,14 +744,16 @@ const selectedExtension = "teleport-prev-selec-ctx"
 // this function deletes it and introduces it in the desired context.
 func setSelectedExtension(contexts map[string]*clientcmdapi.Context, prevCluster string, teleportCluster string) {
 	selected, ok := contexts[prevCluster]
-	if !ok || strings.HasPrefix(prevCluster, teleportCluster) || len(prevCluster) == 0 {
+	if !ok || strings.HasPrefix(prevCluster, teleportCluster+"-") || prevCluster == "" {
 		return
 	}
 	for _, v := range contexts {
-		delete(v.Extensions, selectedExtension)
+		delete(v.Extensions, extPreviousSelectedContext)
 	}
-
-	selected.Extensions[selectedExtension] = nil
+	if selected.Extensions == nil {
+		selected.Extensions = make(map[string]runtime.Object)
+	}
+	selected.Extensions[extPreviousSelectedContext] = nil
 }
 
 // searchForSelectedCluster looks for contexts that were previously selected
@@ -581,8 +764,8 @@ func searchForSelectedCluster(contexts map[string]*clientcmdapi.Context) string
 	count := 0
 	selected := ""
 	for k, v := range contexts {
-		if _, ok := v.Extensions[selectedExtension]; ok {
-			delete(v.Extensions, selectedExtension)
+		if _, ok := v.Extensions[extPreviousSelectedContext]; ok {
+			delete(v.Extensions, extPreviousSelectedContext)
 			count++
 			selected = k
 		}
diff --git a/lib/kube/kubeconfig/kubeconfig_test.go b/lib/kube/kubeconfig/kubeconfig_test.go
index 7a100d496f57e..7b037211d7988 100644
--- a/lib/kube/kubeconfig/kubeconfig_test.go
+++ b/lib/kube/kubeconfig/kubeconfig_test.go
@@ -188,25 +188,40 @@ func TestUpdate(t *testing.T) {
 
 	wantConfig := initialConfig.DeepCopy()
 	wantConfig.Contexts[wantConfig.CurrentContext].Extensions = map[string]runtime.Object{
-		selectedExtension: nil,
+		extPreviousSelectedContext: nil,
 	}
 	wantConfig.Clusters[clusterName] = &clientcmdapi.Cluster{
 		Server:                   clusterAddr,
 		CertificateAuthorityData: caCertPEM,
 		LocationOfOrigin:         kubeconfigPath,
-		Extensions:               map[string]runtime.Object{},
+		Extensions: map[string]runtime.Object{
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+		},
 	}
 	wantConfig.AuthInfos[clusterName] = &clientcmdapi.AuthInfo{
 		ClientCertificateData: creds.TLSCert,
 		ClientKeyData:         creds.TLSPrivateKey.PrivateKeyPEM(),
 		LocationOfOrigin:      kubeconfigPath,
-		Extensions:            map[string]runtime.Object{},
+		Extensions: map[string]runtime.Object{
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+		},
 	}
 	wantConfig.Contexts[clusterName] = &clientcmdapi.Context{
 		Cluster:          clusterName,
 		AuthInfo:         clusterName,
 		LocationOfOrigin: kubeconfigPath,
-		Extensions:       map[string]runtime.Object{},
+		Extensions: map[string]runtime.Object{
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+		},
 	}
 	wantConfig.CurrentContext = clusterName
 
@@ -293,19 +308,37 @@ func TestUpdateWithExec(t *testing.T) {
 
 			wantConfig := initialConfig.DeepCopy()
 			contextName := ContextName(clusterName, kubeCluster)
-			authInfoName := contextName
 			if tt.overrideContextName != "" {
 				contextName = tt.overrideContextName
 			}
-			wantConfig.Clusters[clusterName] = &clientcmdapi.Cluster{
+			authAndClusterName := contextName
+			wantConfig.Clusters[authAndClusterName] = &clientcmdapi.Cluster{
 				Server:                   clusterAddr,
 				CertificateAuthorityData: caCertPEM,
 				LocationOfOrigin:         kubeconfigPath,
-				Extensions:               map[string]runtime.Object{},
+				Extensions: map[string]runtime.Object{
+					extTeleClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + clusterName + `"`),
+						ContentType: "application/json",
+					},
+					extKubeClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + kubeCluster + `"`),
+						ContentType: "application/json",
+					},
+				},
 			}
-			wantConfig.AuthInfos[authInfoName] = &clientcmdapi.AuthInfo{
-				LocationOfOrigin:  kubeconfigPath,
-				Extensions:        map[string]runtime.Object{},
+			wantConfig.AuthInfos[authAndClusterName] = &clientcmdapi.AuthInfo{
+				LocationOfOrigin: kubeconfigPath,
+				Extensions: map[string]runtime.Object{
+					extTeleClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + clusterName + `"`),
+						ContentType: "application/json",
+					},
+					extKubeClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + kubeCluster + `"`),
+						ContentType: "application/json",
+					},
+				},
 				Impersonate:       tt.impersonatedUser,
 				ImpersonateGroups: tt.impersonatedGroups,
 				Exec: &clientcmdapi.ExecConfig{
@@ -321,12 +354,16 @@ func TestUpdateWithExec(t *testing.T) {
 				},
 			}
 			wantConfig.Contexts[contextName] = &clientcmdapi.Context{
-				Cluster:          clusterName,
-				AuthInfo:         authInfoName,
+				Cluster:          contextName,
+				AuthInfo:         contextName,
 				LocationOfOrigin: kubeconfigPath,
 				Extensions: map[string]runtime.Object{
-					teleportKubeClusterNameExtension: &runtime.Unknown{
-						Raw:         []byte(fmt.Sprintf("%q", kubeCluster)),
+					extTeleClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + clusterName + `"`),
+						ContentType: "application/json",
+					},
+					extKubeClusterName: &runtime.Unknown{
+						Raw:         []byte(`"` + kubeCluster + `"`),
 						ContentType: "application/json",
 					},
 				},
@@ -344,7 +381,8 @@ func TestUpdateWithExecAndProxy(t *testing.T) {
 	const (
 		clusterName = "teleport-cluster"
 		clusterAddr = "https://1.2.3.6:3080"
-		proxy       = "my-teleport-proxy:3080"
+		proxyHost   = "my-teleport-proxy"
+		proxy       = proxyHost + ":3080"
 		tshPath     = "/path/to/tsh"
 		kubeCluster = "my-cluster"
 		homeEnvVar  = "TELEPORT_HOME"
@@ -370,15 +408,41 @@ func TestUpdateWithExecAndProxy(t *testing.T) {
 
 	wantConfig := initialConfig.DeepCopy()
 	contextName := ContextName(clusterName, kubeCluster)
-	wantConfig.Clusters[clusterName] = &clientcmdapi.Cluster{
+	wantConfig.Clusters[contextName] = &clientcmdapi.Cluster{
 		Server:                   clusterAddr,
 		CertificateAuthorityData: caCertPEM,
 		LocationOfOrigin:         kubeconfigPath,
-		Extensions:               map[string]runtime.Object{},
+		Extensions: map[string]runtime.Object{
+			extProfileName: &runtime.Unknown{
+				Raw:         []byte(`"` + proxyHost + `"`),
+				ContentType: "application/json",
+			},
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+			extKubeClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + kubeCluster + `"`),
+				ContentType: "application/json",
+			},
+		},
 	}
 	wantConfig.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
 		LocationOfOrigin: kubeconfigPath,
-		Extensions:       map[string]runtime.Object{},
+		Extensions: map[string]runtime.Object{
+			extProfileName: &runtime.Unknown{
+				Raw:         []byte(`"` + proxyHost + `"`),
+				ContentType: "application/json",
+			},
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+			extKubeClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + kubeCluster + `"`),
+				ContentType: "application/json",
+			},
+		},
 		Exec: &clientcmdapi.ExecConfig{
 			APIVersion: "client.authentication.k8s.io/v1beta1",
 			Command:    tshPath,
@@ -393,12 +457,20 @@ func TestUpdateWithExecAndProxy(t *testing.T) {
 		},
 	}
 	wantConfig.Contexts[contextName] = &clientcmdapi.Context{
-		Cluster:          clusterName,
+		Cluster:          contextName,
 		AuthInfo:         contextName,
 		LocationOfOrigin: kubeconfigPath,
 		Extensions: map[string]runtime.Object{
-			teleportKubeClusterNameExtension: &runtime.Unknown{
-				Raw:         []byte(fmt.Sprintf("%q", kubeCluster)),
+			extProfileName: &runtime.Unknown{
+				Raw:         []byte(`"` + proxyHost + `"`),
+				ContentType: "application/json",
+			},
+			extTeleClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + clusterName + `"`),
+				ContentType: "application/json",
+			},
+			extKubeClusterName: &runtime.Unknown{
+				Raw:         []byte(`"` + kubeCluster + `"`),
 				ContentType: "application/json",
 			},
 		},
@@ -468,7 +540,7 @@ func TestRemoveByClusterName(t *testing.T) {
 	require.NoError(t, err)
 
 	// Remove those generated entries from kubeconfig.
-	err = RemoveByClusterName(kubeconfigPath, clusterName)
+	err = RemoveByServerAddr(kubeconfigPath, clusterAddr)
 	require.NoError(t, err)
 
 	// Verify that kubeconfig changed back to the initial state.
@@ -489,8 +561,9 @@ func TestRemoveByClusterName(t *testing.T) {
 	}, false)
 	require.NoError(t, err)
 
-	// This time, explicitly switch CurrentContext to "prod".
-	// Remove should preserve this CurrentContext!
+	// This time, explicitly switch CurrentContext to "prod" as if the user did
+	// so by editing the config file or with "kubectl config set". Remove should
+	// preserve this CurrentContext!
 	config, err = Load(kubeconfigPath)
 	require.NoError(t, err)
 	config.CurrentContext = "prod"
@@ -498,7 +571,7 @@ func TestRemoveByClusterName(t *testing.T) {
 	require.NoError(t, err)
 
 	// Remove teleport-generated entries from kubeconfig.
-	err = RemoveByClusterName(kubeconfigPath, clusterName)
+	err = RemoveByServerAddr(kubeconfigPath, clusterAddr)
 	require.NoError(t, err)
 
 	wantConfig = initialConfig.DeepCopy()
@@ -506,6 +579,9 @@ func TestRemoveByClusterName(t *testing.T) {
 	// it above and Remove shouldn't touch it unless it matches the cluster
 	// being removed.
 	wantConfig.CurrentContext = "prod"
+	wantConfig.Contexts["dev"].Extensions = map[string]runtime.Object{
+		extPreviousSelectedContext: nil,
+	}
 	config, err = Load(kubeconfigPath)
 	require.NoError(t, err)
 	require.Equal(t, wantConfig, config)
@@ -620,7 +696,7 @@ func TestKubeClusterFromContext(t *testing.T) {
 			name: "context name is {teleport-cluster}-cluster name",
 			args: args{
 				contextName:     "telecluster-cluster1",
-				ctx:             &clientcmdapi.Context{Cluster: "cluster1"},
+				ctx:             &clientcmdapi.Context{Cluster: "telecluster"},
 				teleportCluster: "telecluster",
 			},
 			want: "cluster1",
@@ -641,8 +717,8 @@ func TestKubeClusterFromContext(t *testing.T) {
 				ctx: &clientcmdapi.Context{
 					Cluster: "telecluster",
 					Extensions: map[string]runtime.Object{
-						teleportKubeClusterNameExtension: &runtime.Unknown{
-							Raw: []byte("\"another\""),
+						extKubeClusterName: &runtime.Unknown{
+							Raw: []byte(`"another"`),
 						},
 					},
 				},
diff --git a/lib/kube/kubeconfig/localproxy.go b/lib/kube/kubeconfig/localproxy.go
index 711195a83828a..93ed88db76d89 100644
--- a/lib/kube/kubeconfig/localproxy.go
+++ b/lib/kube/kubeconfig/localproxy.go
@@ -68,6 +68,8 @@ func (s LocalProxyClusters) TeleportClusters() []string {
 
 // LocalProxyValues contains values for generating local proxy kubeconfig
 type LocalProxyValues struct {
+	// TeleportProfileName is the name of the profile used for credentials.
+	TeleportProfileName string
 	// TeleportKubeClusterAddr is the Teleport Kubernetes access address.
 	TeleportKubeClusterAddr string
 	// LocalProxyURL is the local forward proxy's URL.
@@ -104,6 +106,7 @@ func CreateLocalProxyConfig(originalKubeConfig *clientcmdapi.Config, localProxyV
 	// entries before adding the ones for local proxy.
 	config := originalKubeConfig.DeepCopy()
 	config.CurrentContext = ""
+	removeByProfileName(config, localProxyValues.TeleportProfileName)
 	removeByServerAddr(config, localProxyValues.TeleportKubeClusterAddr)
 
 	for _, cluster := range localProxyValues.Clusters {
@@ -120,17 +123,28 @@ func CreateLocalProxyConfig(originalKubeConfig *clientcmdapi.Config, localProxyV
 			CertificateAuthorityData: localProxyValues.LocalProxyCAs[cluster.TeleportCluster],
 			TLSServerName:            common.KubeLocalProxySNI(cluster.TeleportCluster, cluster.KubeCluster),
 		}
+		setStringExtensionInCluster(config.Clusters[contextName], extProfileName, localProxyValues.TeleportProfileName)
+		setStringExtensionInCluster(config.Clusters[contextName], extTeleClusterName, cluster.TeleportCluster)
+		setStringExtensionInCluster(config.Clusters[contextName], extKubeClusterName, cluster.KubeCluster)
+
 		config.Contexts[contextName] = &clientcmdapi.Context{
 			Namespace: cluster.Namespace,
 			Cluster:   contextName,
 			AuthInfo:  contextName,
 		}
+		setStringExtensionInContext(config.Contexts[contextName], extProfileName, localProxyValues.TeleportProfileName)
+		setStringExtensionInContext(config.Contexts[contextName], extTeleClusterName, cluster.TeleportCluster)
+		setStringExtensionInContext(config.Contexts[contextName], extKubeClusterName, cluster.KubeCluster)
+
 		config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
 			ClientCertificateData: localProxyValues.LocalProxyCAs[cluster.TeleportCluster],
 			ClientKeyData:         localProxyValues.ClientKeyData,
 			Impersonate:           cluster.Impersonate,
 			ImpersonateGroups:     cluster.ImpersonateGroups,
 		}
+		setStringExtensionInAuthInfo(config.AuthInfos[contextName], extProfileName, localProxyValues.TeleportProfileName)
+		setStringExtensionInAuthInfo(config.AuthInfos[contextName], extTeleClusterName, cluster.TeleportCluster)
+		setStringExtensionInAuthInfo(config.AuthInfos[contextName], extKubeClusterName, cluster.KubeCluster)
 
 		// Set the first as current context or if matching the one from default
 		// kubeconfig.
@@ -143,40 +157,63 @@ func CreateLocalProxyConfig(originalKubeConfig *clientcmdapi.Config, localProxyV
 
 // LocalProxyClustersFromDefaultConfig loads Teleport kube clusters data saved
 // by `tsh kube login` in the default kubeconfig.
-func LocalProxyClustersFromDefaultConfig(defaultConfig *clientcmdapi.Config, clusterAddr string) (clusters LocalProxyClusters) {
-	for teleportClusterName, cluster := range defaultConfig.Clusters {
-		if cluster.Server != clusterAddr {
+func LocalProxyClustersFromDefaultConfig(defaultConfig *clientcmdapi.Config, profileName, clusterAddr string) (clusters LocalProxyClusters) {
+	for contextName, context := range defaultConfig.Contexts {
+		cluster, found := defaultConfig.Clusters[context.Cluster]
+		if !found {
+			continue
+		}
+		auth, found := defaultConfig.AuthInfos[context.AuthInfo]
+		if !found {
 			continue
 		}
 
-		for contextName, ctx := range defaultConfig.Contexts {
-			if ctx.Cluster != teleportClusterName {
-				continue
-			}
-			auth, found := defaultConfig.AuthInfos[contextName]
-			if !found {
+		if p, ok := getStringExtensionFromContext(context, extProfileName); ok {
+			// the context has the new extensions, no need to match by clusterAddr
+			if p != profileName {
 				continue
 			}
 
+			teleportCluster, _ := getStringExtensionFromContext(context, extTeleClusterName)
+			kubeCluster, _ := getStringExtensionFromContext(context, extKubeClusterName)
+
 			clusters = append(clusters, LocalProxyCluster{
-				TeleportCluster:   teleportClusterName,
-				KubeCluster:       KubeClusterFromContext(contextName, ctx, teleportClusterName),
-				Namespace:         ctx.Namespace,
+				TeleportCluster:   teleportCluster,
+				KubeCluster:       kubeCluster,
+				Namespace:         context.Namespace,
 				Impersonate:       auth.Impersonate,
 				ImpersonateGroups: auth.ImpersonateGroups,
 			})
+			continue
+		}
+
+		// the context was created by an older version, match by clusterAddr and
+		// try to guess at the kube cluster name
+		if cluster.Server != clusterAddr {
+			continue
 		}
+
+		clusters = append(clusters, LocalProxyCluster{
+			TeleportCluster:   context.Cluster,
+			KubeCluster:       KubeClusterFromContext(contextName, context, context.Cluster),
+			Namespace:         context.Namespace,
+			Impersonate:       auth.Impersonate,
+			ImpersonateGroups: auth.ImpersonateGroups,
+		})
 	}
+
 	return clusters
 }
 
-// FindTeleportClusterForLocalProxy finds the Teleport kube cluster based on
-// provided cluster address and context name, and prepares a LocalProxyCluster.
+// FindTeleportClusterForLocalProxy finds the Kube cluster name for a given
+// context (or the current context), and prepares a LocalProxyCluster if the
+// context is for the given Teleport cluster name or if the server addr matches
+// the expected one.
 //
 // When the cluster has a ProxyURL set, it means the provided kubeconfig is
 // already pointing to a local proxy through this ProxyURL and thus can be
 // skipped as there is no need to create a new local proxy.
-func FindTeleportClusterForLocalProxy(defaultConfig *clientcmdapi.Config, clusterAddr, contextName string) (LocalProxyCluster, bool) {
+func FindTeleportClusterForLocalProxy(defaultConfig *clientcmdapi.Config, contextName, profileName, serverAddr string) (LocalProxyCluster, bool) {
 	if contextName == "" {
 		contextName = defaultConfig.CurrentContext
 	}
@@ -185,8 +222,9 @@ func FindTeleportClusterForLocalProxy(defaultConfig *clientcmdapi.Config, cluste
 	if !found {
 		return LocalProxyCluster{}, false
 	}
+
 	cluster, found := defaultConfig.Clusters[context.Cluster]
-	if !found || cluster.Server != clusterAddr || cluster.ProxyURL != "" {
+	if !found {
 		return LocalProxyCluster{}, false
 	}
 	auth, found := defaultConfig.AuthInfos[context.AuthInfo]
@@ -194,9 +232,36 @@ func FindTeleportClusterForLocalProxy(defaultConfig *clientcmdapi.Config, cluste
 		return LocalProxyCluster{}, false
 	}
 
+	if cluster.ProxyURL != "" {
+		// a proxy is already set, it's either an existing local proxy or
+		// something we don't understand is going on, and either way we should
+		// skip this
+		return LocalProxyCluster{}, false
+	}
+
+	var teleportCluster, kubeCluster string
+	if c, ok := getStringExtensionFromCluster(cluster, extProfileName); ok {
+		// we have found the profile name extension, this is a modern
+		// configuration and we can just work by extensions without having to
+		// make guesses based on URLs and context names
+		if c != profileName {
+			return LocalProxyCluster{}, false
+		}
+		teleportCluster, _ = getStringExtensionFromCluster(cluster, extTeleClusterName)
+		kubeCluster, _ = getStringExtensionFromCluster(cluster, extKubeClusterName)
+	} else {
+		// this kubeconfig is old, match by server URL and try to guess what the
+		// kube cluster name is
+		if cluster.Server != serverAddr {
+			return LocalProxyCluster{}, false
+		}
+		teleportCluster = context.Cluster
+		kubeCluster = KubeClusterFromContext(contextName, context, context.Cluster)
+	}
+
 	return LocalProxyCluster{
-		TeleportCluster:   context.Cluster,
-		KubeCluster:       KubeClusterFromContext(contextName, context, context.Cluster),
+		TeleportCluster:   teleportCluster,
+		KubeCluster:       kubeCluster,
 		Namespace:         context.Namespace,
 		Impersonate:       auth.Impersonate,
 		ImpersonateGroups: auth.ImpersonateGroups,
diff --git a/lib/kube/kubeconfig/localproxy_test.go b/lib/kube/kubeconfig/localproxy_test.go
index 2f836d01833ec..518affceda9be 100644
--- a/lib/kube/kubeconfig/localproxy_test.go
+++ b/lib/kube/kubeconfig/localproxy_test.go
@@ -28,6 +28,8 @@ import (
 
 func TestLocalProxy(t *testing.T) {
 	const (
+		proxyHost           = "root-cluster.example.com"
+		proxy               = proxyHost + ":443"
 		rootKubeClusterAddr = "https://root-cluster.example.com"
 		rootClusterName     = "root-cluster"
 		leafClusterName     = "leaf-cluster"
@@ -47,6 +49,7 @@ func TestLocalProxy(t *testing.T) {
 		KubeClusters:        []string{"kube1"},
 		Credentials:         creds,
 		Exec:                exec,
+		ProxyAddr:           proxy,
 	}, false))
 	require.NoError(t, Update(kubeconfigPath, Values{
 		TeleportClusterName: rootClusterName,
@@ -54,6 +57,7 @@ func TestLocalProxy(t *testing.T) {
 		KubeClusters:        []string{"kube2"},
 		Credentials:         creds,
 		Exec:                exec,
+		ProxyAddr:           proxy,
 		SelectCluster:       "kube2",
 	}, false))
 	require.NoError(t, Update(kubeconfigPath, Values{
@@ -65,13 +69,14 @@ func TestLocalProxy(t *testing.T) {
 		Impersonate:         "as",
 		ImpersonateGroups:   []string{"group1", "group2"},
 		Exec:                exec,
+		ProxyAddr:           proxy,
 	}, false))
 
 	configAfterLogins, err := Load(kubeconfigPath)
 	require.NoError(t, err)
 
 	t.Run("LocalProxyClustersFromDefaultConfig", func(t *testing.T) {
-		clusters := LocalProxyClustersFromDefaultConfig(configAfterLogins, rootKubeClusterAddr)
+		clusters := LocalProxyClustersFromDefaultConfig(configAfterLogins, proxyHost, rootKubeClusterAddr)
 		require.ElementsMatch(t, LocalProxyClusters{
 			{
 				TeleportCluster: rootClusterName,
@@ -96,7 +101,7 @@ func TestLocalProxy(t *testing.T) {
 
 		// Simulate a scenario that kube3 is already pointing to a local proxy
 		// through ProxyURL.
-		inputConfig.Clusters[leafClusterName].ProxyURL = "https://localhost:8443"
+		inputConfig.Clusters[leafClusterName+"-kube3"].ProxyURL = "https://localhost:8443"
 
 		tests := []struct {
 			name          string
@@ -141,7 +146,7 @@ func TestLocalProxy(t *testing.T) {
 
 		for _, test := range tests {
 			t.Run(test.name, func(t *testing.T) {
-				cluster, found := FindTeleportClusterForLocalProxy(inputConfig, rootKubeClusterAddr, test.selectContext)
+				cluster, found := FindTeleportClusterForLocalProxy(inputConfig, test.selectContext, proxyHost, rootKubeClusterAddr)
 				test.checkResult(t, found)
 				require.Equal(t, test.wantCluster, cluster)
 			})
@@ -153,6 +158,7 @@ func TestLocalProxy(t *testing.T) {
 		clientKeyData := []byte("clientKeyData")
 		values := &LocalProxyValues{
 			LocalProxyCAs:           map[string][]byte{rootClusterName: caData},
+			TeleportProfileName:     proxyHost,
 			TeleportKubeClusterAddr: rootKubeClusterAddr,
 			LocalProxyURL:           "http://localhost:12345",
 			ClientKeyData:           clientKeyData,
@@ -183,14 +189,40 @@ func TestLocalProxy(t *testing.T) {
 			CertificateAuthorityData: caData,
 			TLSServerName:            "6b75626531.root-cluster",
 			LocationOfOrigin:         kubeconfigPath,
-			Extensions:               map[string]runtime.Object{},
+			Extensions: map[string]runtime.Object{
+				extProfileName: &runtime.Unknown{
+					Raw:         []byte(`"` + proxyHost + `"`),
+					ContentType: "application/json",
+				},
+				extTeleClusterName: &runtime.Unknown{
+					Raw:         []byte(`"` + rootClusterName + `"`),
+					ContentType: "application/json",
+				},
+				extKubeClusterName: &runtime.Unknown{
+					Raw:         []byte(`"kube1"`),
+					ContentType: "application/json",
+				},
+			},
 		}
 		wantConfig.Contexts["root-cluster-kube1"] = &clientcmdapi.Context{
 			Namespace:        "namespace",
 			Cluster:          "root-cluster-kube1",
 			AuthInfo:         "root-cluster-kube1",
 			LocationOfOrigin: kubeconfigPath,
-			Extensions:       map[string]runtime.Object{},
+			Extensions: map[string]runtime.Object{
+				extProfileName: &runtime.Unknown{
+					Raw:         []byte(`"` + proxyHost + `"`),
+					ContentType: "application/json",
+				},
+				extTeleClusterName: &runtime.Unknown{
+					Raw:         []byte(`"` + rootClusterName + `"`),
+					ContentType: "application/json",
+				},
+				extKubeClusterName: &runtime.Unknown{
+					Raw:         []byte(`"kube1"`),
+					ContentType: "application/json",
+				},
+			},
 		}
 		wantConfig.AuthInfos["root-cluster-kube1"] = &clientcmdapi.AuthInfo{
 			ClientCertificateData: caData,
@@ -198,7 +230,20 @@ func TestLocalProxy(t *testing.T) {
 			Impersonate:           "as",
 			ImpersonateGroups:     []string{"group1", "group2"},
 			LocationOfOrigin:      kubeconfigPath,
-			Extensions:            map[string]runtime.Object{},
+			Extensions: map[string]runtime.Object{
+				extProfileName: &runtime.Unknown{
+					Raw:         []byte(`"` + proxyHost + `"`),
+					ContentType: "application/json",
+				},
+				extTeleClusterName: &runtime.Unknown{
+					Raw:         []byte(`"` + rootClusterName + `"`),
+					ContentType: "application/json",
+				},
+				extKubeClusterName: &runtime.Unknown{
+					Raw:         []byte(`"kube1"`),
+					ContentType: "application/json",
+				},
+			},
 		}
 
 		// Current context is updated.
diff --git a/lib/kube/proxy/auth.go b/lib/kube/proxy/auth.go
index 61842aca77bf0..11b38186ff235 100644
--- a/lib/kube/proxy/auth.go
+++ b/lib/kube/proxy/auth.go
@@ -259,10 +259,10 @@ func checkImpersonationPermissions(ctx context.Context, cluster string, sarClien
 			},
 		}, metav1.CreateOptions{})
 		if err != nil {
-			return trace.Wrap(err, "failed to verify impersonation permissions for Kubernetes: %v; this may be due to missing the SelfSubjectAccessReview permission on the ClusterRole used by the proxy; please make sure that proxy has all the necessary permissions: https://goteleport.com/teleport/docs/kubernetes-ssh/#impersonation", err)
+			return trace.Wrap(err, "failed to verify impersonation permissions for Kubernetes: %v; this may be due to missing the SelfSubjectAccessReview permission on the ClusterRole used by the proxy; please make sure that proxy has all the necessary permissions: https://goteleport.com/docs/enroll-resources/kubernetes-access/controls/#enabling-impersonation", err)
 		}
 		if !resp.Status.Allowed {
-			return trace.AccessDenied("proxy can't impersonate Kubernetes %s at the cluster level; please make sure that proxy has all the necessary permissions: https://goteleport.com/teleport/docs/kubernetes-ssh/#impersonation", resource)
+			return trace.AccessDenied("proxy can't impersonate Kubernetes %s at the cluster level; please make sure that proxy has all the necessary permissions: https://goteleport.com/docs/enroll-resources/kubernetes-access/controls/#enabling-impersonation", resource)
 		}
 	}
 	return nil
diff --git a/lib/kube/proxy/auth_test.go b/lib/kube/proxy/auth_test.go
index 0d7cc19a37bc4..bde92b65d87bf 100644
--- a/lib/kube/proxy/auth_test.go
+++ b/lib/kube/proxy/auth_test.go
@@ -42,7 +42,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestCheckImpersonationPermissions(t *testing.T) {
@@ -337,7 +337,7 @@ current-context: foo
 					CheckImpersonationPermissions: tt.impersonationCheck,
 					Clock:                         clockwork.NewFakeClock(),
 				},
-				log: utils.NewSlogLoggerForTests(),
+				log: logtest.NewLogger(),
 			}
 			err := fwd.getKubeDetails(ctx)
 			tt.assertErr(t, err)
diff --git a/lib/kube/proxy/cluster_details.go b/lib/kube/proxy/cluster_details.go
index aba265a007c95..f5722d36420a0 100644
--- a/lib/kube/proxy/cluster_details.go
+++ b/lib/kube/proxy/cluster_details.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"encoding/base64"
 	"log/slog"
+	"net/http"
 	"strings"
 	"sync"
 	"time"
@@ -30,6 +31,8 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/eks"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	authzapi "k8s.io/api/authorization/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/version"
@@ -38,7 +41,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
@@ -86,8 +88,10 @@ type kubeDetails struct {
 
 // clusterDetailsConfig contains the configuration for creating a proxied cluster.
 type clusterDetailsConfig struct {
-	// cloudClients is the cloud clients to use for dynamic clusters.
-	cloudClients cloud.Clients
+	// azureClients provides Azure SDK clients
+	azureClients azure.Clients
+	// gcpClients provides GCP SDK clients
+	gcpClients gcp.Clients
 	// awsCloudClients provides AWS SDK clients.
 	awsCloudClients AWSClientGetter
 	// kubeCreds is the credentials to use for the cluster.
@@ -263,6 +267,93 @@ func (k *kubeDetails) getObjectGVK(resource apiResource) *schema.GroupVersionKin
 	}]
 }
 
+// GetProtocol returns the network protocol used for checking health.
+func (t *kubeDetails) GetProtocol() types.TargetHealthProtocol {
+	return types.TargetHealthProtocolHTTP
+}
+
+type operation struct {
+	verb     string
+	resource string
+	display  string
+}
+
+var permissionOps = []operation{
+	{
+		verb:     "impersonate",
+		resource: "users",
+		display:  "impersonate users",
+	},
+	{
+		verb:     "impersonate",
+		resource: "groups",
+		display:  "impersonate groups",
+	},
+	{
+		verb:     "impersonate",
+		resource: "serviceaccounts",
+		display:  "impersonate service accounts",
+	},
+	{
+		verb:     "get",
+		resource: "pods",
+		display:  "get pods",
+	},
+}
+
+const errorGuide = "Please see the Kubernetes Access Troubleshooting guide, https://goteleport.com/docs/enroll-resources/kubernetes-access/troubleshooting."
+
+// CheckHealth checks the health of a Kubernetes cluster.
+func (k *kubeDetails) CheckHealth(ctx context.Context) ([]string, error) {
+	addresses := []string{k.getTargetAddr()}
+	client := k.getKubeClient().AuthorizationV1().SelfSubjectAccessReviews()
+
+	// Check permissions to the Kubernetes cluster.
+	var missingPermissions []string
+	for _, op := range permissionOps {
+		resp, err := client.Create(ctx, &authzapi.SelfSubjectAccessReview{
+			Spec: authzapi.SelfSubjectAccessReviewSpec{
+				ResourceAttributes: &authzapi.ResourceAttributes{
+					Verb:     op.verb,
+					Resource: op.resource,
+				},
+			},
+		}, metav1.CreateOptions{})
+		if err != nil {
+			// Check whether the Kubernetes cluster is down.
+			// Avoid reporting permissions errors when the Kubernetes cluster is down.
+			if readyzErr := k.checkHealthReadyz(ctx); readyzErr != nil {
+				return addresses, trace.Wrap(readyzErr)
+			}
+			return addresses, trace.Wrap(err, "Unable to check Kubernetes permissions. %s", errorGuide)
+		}
+		if !resp.Status.Allowed {
+			missingPermissions = append(missingPermissions, op.display)
+		}
+	}
+	if len(missingPermissions) > 0 {
+		return addresses, trace.AccessDenied("Missing required Kubernetes permissions: %s. %s",
+			strings.Join(missingPermissions, ", "),
+			errorGuide)
+	}
+
+	return addresses, nil
+}
+
+// checkHealthReadyz checks the health of a Kubernetes cluster with the `/readyz` endpoint.
+func (k *kubeDetails) checkHealthReadyz(ctx context.Context) error {
+	readyzResult := k.getKubeClient().Discovery().RESTClient().Get().AbsPath("/readyz").Do(ctx)
+	if err := readyzResult.Error(); err != nil {
+		return trace.ConnectionProblem(err, "Unable to contact the Kubernetes cluster. %s", errorGuide)
+	}
+	var statusCode int
+	readyzResult.StatusCode(&statusCode)
+	if statusCode != http.StatusOK {
+		return trace.ConnectionProblem(nil, "Unhealthy Kubernetes cluster detected with status code %d. %s", statusCode, errorGuide)
+	}
+	return nil
+}
+
 // getKubeClusterCredentials generates kube credentials for dynamic clusters.
 func getKubeClusterCredentials(ctx context.Context, cfg clusterDetailsConfig) (kubeCreds, error) {
 	switch dynCredsCfg := (dynamicCredsConfig{
@@ -276,20 +367,20 @@ func getKubeClusterCredentials(ctx context.Context, cfg clusterDetailsConfig) (k
 	case cfg.cluster.IsKubeconfig():
 		return getStaticCredentialsFromKubeconfig(ctx, cfg.component, cfg.cluster, cfg.log, cfg.checker)
 	case cfg.cluster.IsAzure():
-		return getAzureCredentials(ctx, cfg.cloudClients, dynCredsCfg)
+		return getAzureCredentials(ctx, cfg.azureClients, dynCredsCfg)
 	case cfg.cluster.IsAWS():
 		return getAWSCredentials(ctx, cfg.awsCloudClients, dynCredsCfg)
 	case cfg.cluster.IsGCP():
-		return getGCPCredentials(ctx, cfg.cloudClients, dynCredsCfg)
+		return getGCPCredentials(ctx, cfg.gcpClients, dynCredsCfg)
 	default:
 		return nil, trace.BadParameter("authentication method provided for cluster %q not supported", cfg.cluster.GetName())
 	}
 }
 
 // getAzureCredentials creates a dynamicCreds that generates and updates the access credentials to a AKS Kubernetes cluster.
-func getAzureCredentials(ctx context.Context, cloudClients cloud.Clients, cfg dynamicCredsConfig) (*dynamicKubeCreds, error) {
+func getAzureCredentials(ctx context.Context, azureClients azure.Clients, cfg dynamicCredsConfig) (*dynamicKubeCreds, error) {
 	// create a client that returns the credentials for kubeCluster
-	cfg.client = azureRestConfigClient(cloudClients)
+	cfg.client = azureRestConfigClient(azureClients)
 
 	creds, err := newDynamicKubeCreds(
 		ctx,
@@ -299,9 +390,9 @@ func getAzureCredentials(ctx context.Context, cloudClients cloud.Clients, cfg dy
 }
 
 // azureRestConfigClient creates a dynamicCredsClient that returns credentials to a AKS cluster.
-func azureRestConfigClient(cloudClients cloud.Clients) dynamicCredsClient {
+func azureRestConfigClient(azureClients azure.Clients) dynamicCredsClient {
 	return func(ctx context.Context, cluster types.KubeCluster) (*rest.Config, time.Time, error) {
-		aksClient, err := cloudClients.GetAzureKubernetesClient(cluster.GetAzureConfig().SubscriptionID)
+		aksClient, err := azureClients.GetKubernetesClient(ctx, cluster.GetAzureConfig().SubscriptionID)
 		if err != nil {
 			return nil, time.Time{}, trace.Wrap(err)
 		}
@@ -434,17 +525,17 @@ func getStaticCredentialsFromKubeconfig(ctx context.Context, component KubeServi
 }
 
 // getGCPCredentials creates a dynamicKubeCreds that generates and updates the access credentials to a GKE kubernetes cluster.
-func getGCPCredentials(ctx context.Context, cloudClients cloud.Clients, cfg dynamicCredsConfig) (*dynamicKubeCreds, error) {
+func getGCPCredentials(ctx context.Context, gcpClients gcp.Clients, cfg dynamicCredsConfig) (*dynamicKubeCreds, error) {
 	// create a client that returns the credentials for kubeCluster
-	cfg.client = gcpRestConfigClient(cloudClients)
+	cfg.client = gcpRestConfigClient(gcpClients)
 	creds, err := newDynamicKubeCreds(ctx, cfg)
 	return creds, trace.Wrap(err)
 }
 
 // gcpRestConfigClient creates a dynamicCredsClient that returns credentials to a GKE cluster.
-func gcpRestConfigClient(cloudClients cloud.Clients) dynamicCredsClient {
+func gcpRestConfigClient(gcpClients gcp.Clients) dynamicCredsClient {
 	return func(ctx context.Context, cluster types.KubeCluster) (*rest.Config, time.Time, error) {
-		gkeClient, err := cloudClients.GetGCPGKEClient(ctx)
+		gkeClient, err := gcpClients.GetGKEClient(ctx)
 		if err != nil {
 			return nil, time.Time{}, trace.Wrap(err)
 		}
diff --git a/lib/kube/proxy/cluster_details_test.go b/lib/kube/proxy/cluster_details_test.go
index 987275702198f..2fca4fdc8a61f 100644
--- a/lib/kube/proxy/cluster_details_test.go
+++ b/lib/kube/proxy/cluster_details_test.go
@@ -33,7 +33,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestNewClusterDetails(t *testing.T) {
@@ -47,7 +47,7 @@ func TestNewClusterDetails(t *testing.T) {
 				kubeClient: client,
 			},
 			cluster: &types.KubernetesClusterV3{},
-			log:     utils.NewSlogLoggerForTests(),
+			log:     logtest.NewLogger(),
 			clock:   c,
 		}, client
 	}
diff --git a/lib/kube/proxy/ephemeral_containers.go b/lib/kube/proxy/ephemeral_containers.go
index baccb97026342..9de25cb83f811 100644
--- a/lib/kube/proxy/ephemeral_containers.go
+++ b/lib/kube/proxy/ephemeral_containers.go
@@ -248,7 +248,7 @@ func (f *Forwarder) impersonatedKubeClient(authCtx *authContext, headers http.He
 		return nil, nil, trace.NotFound("kubernetes cluster %q not found", authCtx.kubeClusterName)
 	}
 	restConfig := details.getKubeRestConfig()
-	kubeUser, kubeGroups, err := computeImpersonatedPrincipals(authCtx.kubeUsers, authCtx.kubeGroups, headers)
+	kubeUser, kubeGroups, err := computeImpersonatedPrincipals(authCtx.kubeUsers, authCtx.kubeGroups, authCtx.User.GetName(), headers)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
diff --git a/lib/kube/proxy/exec_test.go b/lib/kube/proxy/exec_test.go
index 8ef44b3be5508..cc0ed45908870 100644
--- a/lib/kube/proxy/exec_test.go
+++ b/lib/kube/proxy/exec_test.go
@@ -486,7 +486,7 @@ func TestExecWebsocketEndToEndErrReturn(t *testing.T) {
 	)
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.EqualValues(t, 0, kubeMock.KubeExecRequests.SPDY.Load(), "expected no SPDY requests")
+		require.EqualValues(t, 2, kubeMock.KubeExecRequests.SPDY.Load(), "expected no SPDY requests")
 		require.EqualValues(t, 2, kubeMock.KubeExecRequests.Websocket.Load(), "expected one websocket request")
 		kubeMock.Close()
 	})
@@ -595,8 +595,6 @@ func TestExecWebsocketEndToEndErrReturn(t *testing.T) {
 			require.Equal(t, "403", execEvent.ExitCode)
 			require.NotEmpty(t, execEvent.Error)
 			eventsLock.Unlock()
-
 		})
 	}
-
 }
diff --git a/lib/kube/proxy/forwarder.go b/lib/kube/proxy/forwarder.go
index 149e626cb6b85..72d1853341bcb 100644
--- a/lib/kube/proxy/forwarder.go
+++ b/lib/kube/proxy/forwarder.go
@@ -68,13 +68,14 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
+	"github.com/gravitational/teleport/lib/kube/internal"
 	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
 	"github.com/gravitational/teleport/lib/modules"
@@ -476,7 +477,7 @@ func (c *authContext) key() string {
 func (c *authContext) eventClusterMeta(req *http.Request) apievents.KubernetesClusterMetadata {
 	var kubeUsers, kubeGroups []string
 
-	if impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(c.kubeUsers, c.kubeGroups, req.Header); err == nil {
+	if impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(c.kubeUsers, c.kubeGroups, c.User.GetName(), req.Header); err == nil {
 		kubeUsers = []string{impersonateUser}
 		kubeGroups = impersonateGroups
 	} else {
@@ -718,8 +719,36 @@ func (f *Forwarder) writeResponseErrorToBody(rw http.ResponseWriter, respErr err
 	http.Error(rw, respErr.Error(), http.StatusInternalServerError)
 }
 
-// formatStatusResponseError formats the error response into a kube Status object.
+// formatForwardResponseError handles errors returned from requests to the Kubernetes API.
+// Any errors produced as a result of a GOAWAY request are forwarded to users as [http.StatusTooManyRequests]
+// with a Retry-After header set to inform clients that they should retry the request. All
+// other errors are formatted as a [metav1.Status] and written to the [http.ResponseWriter].
 func (f *Forwarder) formatStatusResponseError(rw http.ResponseWriter, respErr error) {
+	// This detects failed requests that were terminated by the server due to GOAWAY. There
+	// is no direct way to detect these errors. No exported constants or error types exist from the
+	// standard library, see https://github.com/golang/net/blob/5ac9daca088ab4f378d7df849f6c7d28bea86071/http2/transport.go#L694.
+	// When a failed request is found, we return a response that indicates  to clients that they
+	// should retry the request themselves.
+	if errString := respErr.Error(); strings.HasSuffix(errString, `after Request.Body was written; define Request.GetBody to avoid this error`) &&
+		strings.Contains(errString, `http2: Transport: cannot retry err`) {
+
+		data, err := runtime.Encode(globalKubeCodecs.LegacyCodec(), &kubeerrors.NewTooManyRequests("Connection closed by upstream Kubernetes server", 1).ErrStatus)
+		if err != nil {
+			f.log.WarnContext(f.ctx, "Failed encoding error into kube Status object", "error", err)
+			trace.WriteError(rw, respErr)
+			return
+		}
+
+		rw.Header().Set("Retry-After", "1")
+		rw.Header().Set(responsewriters.ContentTypeHeader, "application/json")
+		rw.WriteHeader(http.StatusTooManyRequests)
+
+		if _, err := rw.Write(data); err != nil && !utils.IsOKNetworkError(err) {
+			f.log.WarnContext(f.ctx, "Failed writing kube error response body", "error", err)
+		}
+		return
+	}
+
 	code := trace.ErrorToCode(respErr)
 	status := &metav1.Status{
 		Status: metav1.StatusFailure,
@@ -742,7 +771,7 @@ func (f *Forwarder) formatStatusResponseError(rw http.ResponseWriter, respErr er
 	// `Error from server (InternalError): an error on the server ("unknown")
 	// has prevented the request from succeeding`` instead of the correct reason.
 	rw.WriteHeader(trace.ErrorToCode(respErr))
-	if _, err := rw.Write(data); err != nil {
+	if _, err := rw.Write(data); err != nil && !utils.IsOKNetworkError(err) {
 		f.log.WarnContext(f.ctx, "Failed writing kube error response body", "error", err)
 	}
 }
@@ -964,8 +993,7 @@ func (f *Forwarder) getKubeAccessDetails(
 	accessChecker services.AccessChecker,
 	kubeClusterName string,
 	sessionTTL time.Duration,
-	kubeResource *types.KubernetesResource,
-	isClusterWideResource bool,
+	mr metaResource,
 ) (kubeAccessDetails, error) {
 	// Find requested kubernetes cluster name and get allowed kube users/groups names.
 	for _, s := range kubeServers {
@@ -994,11 +1022,13 @@ func (f *Forwarder) getKubeAccessDetails(
 		// results in the intersection of roles that match the "kubernetes_labels" and
 		// roles that allow access to the desired "kubernetes_resource".
 		// If from the intersection results an empty set, the request is denied.
-		if kubeResource != nil {
-			matchers = append(
-				matchers,
-				services.NewKubernetesResourceMatcher(*kubeResource, isClusterWideResource),
-			)
+		if !mr.isList {
+			if kubeResource := mr.rbacResource(); kubeResource != nil {
+				matchers = append(
+					matchers,
+					services.NewKubernetesResourceMatcher(*kubeResource, mr.isClusterWideResource()),
+				)
+			}
 		}
 		// accessChecker.CheckKubeGroupsAndUsers returns the accumulated kubernetes_groups
 		// and kubernetes_users that satisfy te provided matchers.
@@ -1063,16 +1093,18 @@ func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 
 	notFoundMessage := fmt.Sprintf("kubernetes cluster %q not found", actx.kubeClusterName)
 	var roleMatchers services.RoleMatchers
-	if rbacResource := actx.metaResource.rbacResource(); rbacResource != nil {
-		notFoundMessage = f.kubeResourceDeniedAccessMsg(
-			actx.User.GetName(),
-			actx.metaResource.verb,
-			actx.metaResource.requestedResource,
-		)
-		roleMatchers = services.RoleMatchers{
-			// Append a matcher that validates if the Kubernetes resource is allowed
-			// by the roles that satisfy the Kubernetes Cluster.
-			services.NewKubernetesResourceMatcher(*rbacResource, actx.metaResource.isClusterWideResource()),
+	if !actx.metaResource.isList {
+		if rbacResource := actx.metaResource.rbacResource(); rbacResource != nil {
+			notFoundMessage = f.kubeResourceDeniedAccessMsg(
+				actx.User.GetName(),
+				actx.metaResource.verb,
+				actx.metaResource.requestedResource,
+			)
+			roleMatchers = services.RoleMatchers{
+				// Append a matcher that validates if the Kubernetes resource is allowed
+				// by the roles that satisfy the Kubernetes Cluster.
+				services.NewKubernetesResourceMatcher(*rbacResource, actx.metaResource.isClusterWideResource()),
+			}
 		}
 	}
 	var kubeUsers, kubeGroups []string
@@ -1087,8 +1119,7 @@ func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 			actx.Checker,
 			actx.kubeClusterName,
 			actx.sessionTTL,
-			actx.metaResource.rbacResource(),
-			actx.metaResource.isClusterWideResource(),
+			actx.metaResource,
 		)
 		if err != nil && !trace.IsNotFound(err) {
 			if actx.metaResource.resourceDefinition != nil {
@@ -1135,17 +1166,19 @@ func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 		// If the user has active Access requests we need to validate that they allow
 		// the kubeResource.
 		// This is required because CheckAccess does not validate the subresource type.
-		if rbacResource := actx.metaResource.rbacResource(); rbacResource != nil && len(actx.Checker.GetAllowedResourceIDs()) > 0 {
-			// GetKubeResources returns the allowed and denied Kubernetes resources
-			// for the user. Since we have active access requests, the allowed
-			// resources will be the list of pods that the user requested access to if he
-			// requested access to specific pods or the list of pods that his roles
-			// allow if the user requested access a kubernetes cluster. If the user
-			// did not request access to any Kubernetes resource type, the allowed
-			// list will be empty.
-			allowed, denied := actx.Checker.GetKubeResources(ks)
-			if result, err := matchKubernetesResource(*rbacResource, actx.metaResource.isClusterWideResource(), allowed, denied); err != nil || !result {
-				return trace.AccessDenied("%s", notFoundMessage)
+		if !actx.metaResource.isList {
+			if rbacResource := actx.metaResource.rbacResource(); rbacResource != nil && len(actx.Checker.GetAllowedResourceIDs()) > 0 {
+				// GetKubeResources returns the allowed and denied Kubernetes resources
+				// for the user. Since we have active access requests, the allowed
+				// resources will be the list of pods that the user requested access to if he
+				// requested access to specific pods or the list of pods that his roles
+				// allow if the user requested access a kubernetes cluster. If the user
+				// did not request access to any Kubernetes resource type, the allowed
+				// list will be empty.
+				allowed, denied := actx.Checker.GetKubeResources(ks)
+				if result, err := matchKubernetesResource(*rbacResource, actx.metaResource.isClusterWideResource(), allowed, denied); err != nil || !result {
+					return trace.AccessDenied("%s", notFoundMessage)
+				}
 			}
 		}
 		// store a copy of the Kubernetes Cluster.
@@ -1324,7 +1357,7 @@ func (f *Forwarder) remoteJoin(ctx *authContext, w http.ResponseWriter, req *htt
 
 	headers := http.Header{}
 	if impersonationHeaders {
-		if headers, err = auth.IdentityForwardingHeaders(req.Context(), headers); err != nil {
+		if headers, err = internal.IdentityForwardingHeaders(req.Context(), headers); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -1597,7 +1630,7 @@ func (f *Forwarder) execNonInteractive(ctx *authContext, req *http.Request, _ ht
 // is allowed to start a session without moderation.
 func (f *Forwarder) canStartSessionAlone(authCtx *authContext) (bool, error) {
 	policySets := authCtx.Checker.SessionPolicySets()
-	authorizer := auth.NewSessionAccessEvaluator(policySets, types.KubernetesSessionKind, authCtx.User.GetName())
+	authorizer := moderation.NewSessionAccessEvaluator(policySets, types.KubernetesSessionKind, authCtx.User.GetName())
 	canStart, _, err := authorizer.FulfilledFor(nil)
 	if err != nil {
 		return false, trace.Wrap(err)
@@ -1808,11 +1841,22 @@ func (f *Forwarder) portForward(authCtx *authContext, w http.ResponseWriter, req
 	}
 
 	auditSent := map[string]bool{} // Set of `addr`. Can be multiple ports on single call. Using bool to simplify the check.
+	var auditSentMu sync.Mutex
 	onPortForward := func(addr string, success bool) {
-		if !sess.isLocalKubernetesCluster || auditSent[addr] {
+		if !sess.isLocalKubernetesCluster {
+			return
+		}
+
+		auditSentMu.Lock()
+		isAuditSent := auditSent[addr]
+		if !isAuditSent {
+			auditSent[addr] = true
+		}
+		auditSentMu.Unlock()
+		if isAuditSent {
 			return
 		}
-		auditSent[addr] = true
+
 		portForward := &apievents.PortForward{
 			Metadata: apievents.Metadata{
 				Type: events.PortForwardEvent,
@@ -1951,7 +1995,7 @@ func setupImpersonationHeaders(sess *clusterSession, headers http.Header) error
 		return nil
 	}
 
-	impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(sess.kubeUsers, sess.kubeGroups, headers)
+	impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(sess.kubeUsers, sess.kubeGroups, sess.User.GetName(), headers)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1990,7 +2034,9 @@ func copyImpersonationHeaders(dst, src http.Header) {
 // received in the `Impersonate-User` and `Impersonate-Groups` headers and the
 // allowed values. If the user didn't specify any user and groups to impersonate,
 // Teleport will use every group the user is allowed to impersonate.
-func computeImpersonatedPrincipals(kubeUsers, kubeGroups map[string]struct{}, headers http.Header) (string, []string, error) {
+func computeImpersonatedPrincipals(kubeUsers, kubeGroups map[string]struct{}, username string, headers http.Header) (string, []string, error) {
+	_, hasUserWildcard := kubeUsers[types.Wildcard]
+
 	var impersonateUser string
 	var impersonateGroups []string
 	for header, values := range headers {
@@ -2015,7 +2061,7 @@ func computeImpersonatedPrincipals(kubeUsers, kubeGroups map[string]struct{}, he
 			}
 			impersonateUser = values[0]
 
-			if _, ok := kubeUsers[impersonateUser]; !ok {
+			if _, ok := kubeUsers[impersonateUser]; !ok && !hasUserWildcard {
 				return "", nil, trace.AccessDenied("%v, user header %q is not allowed in roles", ImpersonationRequestDeniedMessage, impersonateUser)
 			}
 		case ImpersonateGroupHeader:
@@ -2049,20 +2095,24 @@ func computeImpersonatedPrincipals(kubeUsers, kubeGroups map[string]struct{}, he
 	// link the user identity with the IAM role, for example `IAM#{{external.email}}`
 	//
 	if impersonateUser == "" {
-		switch len(kubeUsers) {
-		// this is currently not possible as kube users have at least one
-		// user (user name), but in case if someone breaks it, catch here
-		case 0:
-			return "", nil, trace.AccessDenied("assumed at least one user to be present")
-		// if there is deterministic choice, make it to improve user experience
-		case 1:
-			for user := range kubeUsers {
-				impersonateUser = user
-				break
+		if hasUserWildcard {
+			impersonateUser = username
+		} else {
+			switch len(kubeUsers) {
+			// this is currently not possible as kube users have at least one
+			// user (user name), but in case if someone breaks it, catch here
+			case 0:
+				return "", nil, trace.AccessDenied("assumed at least one user to be present")
+			// if there is deterministic choice, make it to improve user experience
+			case 1:
+				for user := range kubeUsers {
+					impersonateUser = user
+					break
+				}
+			default:
+				return "", nil, trace.AccessDenied(
+					"please select a user to impersonate, refusing to select a user due to several kubernetes_users set up for this user")
 			}
-		default:
-			return "", nil, trace.AccessDenied(
-				"please select a user to impersonate, refusing to select a user due to several kubernetes_users set up for this user")
 		}
 	}
 
@@ -2122,7 +2172,7 @@ func (f *Forwarder) catchAll(authCtx *authContext, w http.ResponseWriter, req *h
 	// isWatchingCollectionRequest is true when the request is a watch request and
 	// the resource is a collection of resources, e.g. /api/v1/pods?watch=true.
 	// authCtx.kubeResource is only set when the request targets a single resource.
-	isWatchingCollectionRequest := authCtx.metaResource.verb == types.KubeVerbWatch && authCtx.metaResource.resourceDefinition == nil
+	isWatchingCollectionRequest := authCtx.metaResource.verb == types.KubeVerbWatch && authCtx.metaResource.isList
 
 	switch {
 	case isListRequest || isWatchingCollectionRequest:
@@ -2200,29 +2250,24 @@ func isRelevantWebsocketError(err error) bool {
 }
 
 func (f *Forwarder) getExecutor(sess *clusterSession, req *http.Request) (remotecommand.Executor, error) {
-	isWSSupported := false
-	if !sess.isLocalKubernetesCluster {
-		// We're forwarding it to another Teleport kube_service,
-		// which supports the websocket protocol.
-		isWSSupported = true
-	} else {
-		// We're accessing the Kubernetes cluster directly, check if it is version that supports new protocol.
-		f.rwMutexDetails.RLock()
-		if details, ok := f.clusterDetails[sess.kubeClusterName]; ok {
-			details.rwMu.RLock()
-			isWSSupported = kubernetesSupportsExecSubprotocolV5(details.kubeClusterVersion)
-			details.rwMu.RUnlock()
-		}
-		f.rwMutexDetails.RUnlock()
-	}
-
-	if isWSSupported {
-		wsExec, err := f.getWebsocketExecutor(sess, req)
-		return wsExec, trace.Wrap(err)
+	wsExec, err := f.getWebsocketExecutor(sess, req)
+	if err != nil {
+		return nil, trace.Wrap(err, "unable to create websocket executor")
 	}
-
 	spdyExec, err := f.getSPDYExecutor(sess, req)
-	return spdyExec, trace.Wrap(err)
+	if err != nil {
+		return nil, trace.Wrap(err, "unable to create spdy executor")
+	}
+	return remotecommand.NewFallbackExecutor(
+		wsExec,
+		spdyExec,
+		func(err error) bool {
+			// If the error is a known upgrade failure, we can retry with the other protocol.
+			return httpstream.IsUpgradeFailure(err) ||
+				httpstream.IsHTTPSProxyError(err) ||
+				kubeerrors.IsForbidden(err) ||
+				isTeleportUpgradeFailure(err)
+		})
 }
 
 func (f *Forwarder) getSPDYExecutor(sess *clusterSession, req *http.Request) (remotecommand.Executor, error) {
@@ -2271,12 +2316,11 @@ func (f *Forwarder) getPortForwardDialer(sess *clusterSession, req *http.Request
 	}
 
 	return portforward.NewFallbackDialer(wsDialer, spdyDialer, func(err error) bool {
-		result := httpstream.IsUpgradeFailure(err) || httpstream.IsHTTPSProxyError(err) || kubeerrors.IsForbidden(err) || isTeleportUpgradeFailure(err)
-		if result {
-			// If the error is a known upgrade failure, we can retry with the other protocol.
-			sess.connCtx, sess.connMonitorCancel = context.WithCancelCause(req.Context())
-		}
-		return result
+		// If the error is a known upgrade failure, we can retry with the other protocol.
+		return httpstream.IsUpgradeFailure(err) ||
+			httpstream.IsHTTPSProxyError(err) ||
+			kubeerrors.IsForbidden(err) ||
+			isTeleportUpgradeFailure(err)
 	}), nil
 }
 
@@ -2372,19 +2416,17 @@ type clusterSession struct {
 	// rbacSupportedResources is the list of resources that support RBAC for the
 	// current cluster.
 	rbacSupportedResources rbacSupportedResources
-	// connCtx is the context used to monitor the connection.
-	connCtx context.Context
-	// connMonitorCancel is the conn monitor connMonitorCancel function.
-	connMonitorCancel context.CancelCauseFunc
+	// sessionCtx is used with one or more connection contexts.
+	sessionCtx context.Context
+	// sessionCancel cancels the session context and related connection contexts.
+	sessionCancel context.CancelCauseFunc
 	// sendErrStatus is a function that sends an error status to the client.
 	sendErrStatus func(status *kubeerrors.StatusError) error
 }
 
-// close cancels the connection monitor context if available.
+// close cancels the session context and related connection contexts.
 func (s *clusterSession) close() {
-	if s.connMonitorCancel != nil {
-		s.connMonitorCancel(io.EOF)
-	}
+	s.sessionCancel(io.EOF)
 }
 
 func (s *clusterSession) monitorConn(conn net.Conn, err error, hostID string) (net.Conn, error) {
@@ -2392,14 +2434,20 @@ func (s *clusterSession) monitorConn(conn net.Conn, err error, hostID string) (n
 		return nil, trace.Wrap(err)
 	}
 
+	// Create a connection context from the session context.
+	// This separates session lifecycle from the connection attempt lifecycle.
+	// There may be multiple connection attempts within a session using FallbackExecutor/FallbackDialer.
+	// The approach avoids a potential race condition for s.sessionCancel.
+	connCtx, connCancel := context.WithCancelCause(s.sessionCtx)
+
 	tc, err := srv.NewTrackingReadConn(srv.TrackingReadConnConfig{
 		Conn:    conn,
 		Clock:   s.parent.cfg.Clock,
-		Context: s.connCtx,
-		Cancel:  s.connMonitorCancel,
+		Context: connCtx,
+		Cancel:  connCancel,
 	})
 	if err != nil {
-		s.connMonitorCancel(err)
+		connCancel(err)
 		return nil, trace.Wrap(err)
 	}
 	lockTargets := s.LockTargets()
@@ -2420,8 +2468,9 @@ func (s *clusterSession) monitorConn(conn net.Conn, err error, hostID string) (n
 		Clock:                 s.parent.cfg.Clock,
 		Tracker:               tc,
 		Conn:                  tc,
-		Context:               s.connCtx,
+		Context:               connCtx,
 		TeleportUser:          s.User.GetName(),
+		UserOriginClusterName: s.Identity.GetIdentity().OriginClusterName,
 		ServerID:              s.parent.cfg.HostID,
 		Logger:                s.parent.log,
 		Emitter:               s.parent.cfg.AuthClient,
@@ -2504,7 +2553,7 @@ func (f *Forwarder) newClusterSession(ctx context.Context, authCtx authContext)
 
 func (f *Forwarder) newClusterSessionRemoteCluster(ctx context.Context, authCtx authContext) (*clusterSession, error) {
 	f.log.DebugContext(ctx, "Forwarding kubernetes session to remote cluster", "auth_context", logutils.StringerAttr(authCtx))
-	connCtx, cancel := context.WithCancelCause(ctx)
+	sessionCtx, sessionCancel := context.WithCancelCause(ctx)
 	return &clusterSession{
 		parent:      f,
 		authContext: authCtx,
@@ -2512,10 +2561,10 @@ func (f *Forwarder) newClusterSessionRemoteCluster(ctx context.Context, authCtx
 		// and the targetKubernetes cluster endpoint is determined from the identity
 		// encoded in the TLS certificate. We're setting the dial endpoint to a hardcoded
 		// `kube.teleport.cluster.local` value to indicate this is a Kubernetes proxy request
-		targetAddr:        reversetunnelclient.LocalKubernetes,
-		requestContext:    ctx,
-		connCtx:           connCtx,
-		connMonitorCancel: cancel,
+		targetAddr:     reversetunnelclient.LocalKubernetes,
+		requestContext: ctx,
+		sessionCtx:     sessionCtx,
+		sessionCancel:  sessionCancel,
 	}, nil
 }
 
@@ -2551,7 +2600,7 @@ func (f *Forwarder) newClusterSessionLocal(ctx context.Context, authCtx authCont
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	connCtx, cancel := context.WithCancelCause(ctx)
+	sessionCtx, sessionCancel := context.WithCancelCause(ctx)
 	f.log.DebugContext(ctx, "Handling kubernetes session using local credentials", "auth_context", logutils.StringerAttr(authCtx))
 	return &clusterSession{
 		parent:                 f,
@@ -2561,19 +2610,19 @@ func (f *Forwarder) newClusterSessionLocal(ctx context.Context, authCtx authCont
 		requestContext:         ctx,
 		codecFactory:           codecFactory,
 		rbacSupportedResources: rbacSupportedResources,
-		connCtx:                connCtx,
-		connMonitorCancel:      cancel,
+		sessionCtx:             sessionCtx,
+		sessionCancel:          sessionCancel,
 	}, nil
 }
 
 func (f *Forwarder) newClusterSessionDirect(ctx context.Context, authCtx authContext) (*clusterSession, error) {
-	connCtx, cancel := context.WithCancelCause(ctx)
+	sessionCtx, sessionCancel := context.WithCancelCause(ctx)
 	return &clusterSession{
-		parent:            f,
-		authContext:       authCtx,
-		requestContext:    ctx,
-		connCtx:           connCtx,
-		connMonitorCancel: cancel,
+		parent:         f,
+		authContext:    authCtx,
+		requestContext: ctx,
+		sessionCtx:     sessionCtx,
+		sessionCancel:  sessionCancel,
 	}, nil
 }
 
diff --git a/lib/kube/proxy/forwarder_test.go b/lib/kube/proxy/forwarder_test.go
index 8405c6e217d9b..664644413f24f 100644
--- a/lib/kube/proxy/forwarder_test.go
+++ b/lib/kube/proxy/forwarder_test.go
@@ -19,15 +19,21 @@
 package proxy
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"os"
+	"slices"
 	"sort"
 	"sync/atomic"
 	"testing"
@@ -39,8 +45,11 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/julienschmidt/httprouter"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
 	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/transport"
@@ -63,6 +72,7 @@ import (
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 var (
@@ -124,13 +134,13 @@ func TestAuthenticate(t *testing.T) {
 	require.NoError(t, err)
 
 	tun := mockRevTunnel{
-		sites: map[string]reversetunnelclient.RemoteSite{
-			"remote": mockRemoteSite{name: "remote"},
-			"local":  mockRemoteSite{name: "local"},
+		sites: map[string]reversetunnelclient.Cluster{
+			"remote": mockCluster{name: "remote"},
+			"local":  mockCluster{name: "local"},
 		},
 	}
 	f := &Forwarder{
-		log: utils.NewSlogLoggerForTests(),
+		log: logtest.NewLogger(),
 		cfg: ForwarderConfig{
 			ClusterName:       "local",
 			CachingAuthClient: ap,
@@ -784,6 +794,7 @@ func TestSetupImpersonationHeaders(t *testing.T) {
 		desc          string
 		kubeUsers     []string
 		kubeGroups    []string
+		username      string
 		remoteCluster bool
 		isProxy       bool
 		inHeaders     http.Header
@@ -928,6 +939,33 @@ func TestSetupImpersonationHeaders(t *testing.T) {
 			},
 			errAssertion: require.NoError,
 		},
+		{
+			desc:       "kubernetes_users wildcard, no impersonation headers",
+			username:   "ted-lasso",
+			kubeUsers:  []string{types.Wildcard},
+			kubeGroups: []string{"kube-group-a"},
+			inHeaders:  http.Header{},
+			wantHeaders: http.Header{
+				ImpersonateUserHeader:  []string{"ted-lasso"},
+				ImpersonateGroupHeader: []string{"kube-group-a"},
+			},
+			errAssertion: require.NoError,
+		},
+		{
+			desc:       "kubernetes_users wildcard, impersonation headers given",
+			username:   "ted-lasso",
+			kubeUsers:  []string{types.Wildcard},
+			kubeGroups: []string{"kube-group-a"},
+			inHeaders: http.Header{
+				ImpersonateUserHeader:  []string{"kube-user-a"},
+				ImpersonateGroupHeader: []string{"kube-group-a"},
+			},
+			wantHeaders: http.Header{
+				ImpersonateUserHeader:  []string{"kube-user-a"},
+				ImpersonateGroupHeader: []string{"kube-group-a"},
+			},
+			errAssertion: require.NoError,
+		},
 	}
 	for _, tt := range tests {
 		tt := tt
@@ -940,6 +978,11 @@ func TestSetupImpersonationHeaders(t *testing.T) {
 				&clusterSession{
 					kubeAPICreds: kubeCreds,
 					authContext: authContext{
+						Context: authz.Context{
+							User: &types.UserV2{
+								Metadata: types.Metadata{Name: tt.username},
+							},
+						},
 						kubeUsers:       utils.StringsSet(tt.kubeUsers),
 						kubeGroups:      utils.StringsSet(tt.kubeGroups),
 						teleportCluster: teleportClusterClient{isRemote: tt.remoteCluster},
@@ -988,7 +1031,7 @@ func mockAuthCtx(t *testing.T, kubeCluster string, isRemote bool) authContext {
 func TestKubeFwdHTTPProxyEnv(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
-	f := newMockForwader(ctx, t)
+	f := newMockForwarder(ctx, t)
 
 	authCtx := mockAuthCtx(t, "kube-cluster", false)
 
@@ -1099,7 +1142,7 @@ func TestKubeFwdHTTPProxyEnv(t *testing.T) {
 	require.Equal(t, uint32(2), atomic.LoadUint32(&kubeAPICallCount))
 }
 
-func newMockForwader(ctx context.Context, t *testing.T) *Forwarder {
+func newMockForwarder(ctx context.Context, t *testing.T) *Forwarder {
 	clock := clockwork.NewFakeClock()
 	cachedTransport, err := utils.NewFnCache(utils.FnCacheConfig{
 		TTL:   transportCacheTTL,
@@ -1110,7 +1153,7 @@ func newMockForwader(ctx context.Context, t *testing.T) *Forwarder {
 	require.NoError(t, err)
 
 	return &Forwarder{
-		log:    utils.NewSlogLoggerForTests(),
+		log:    logtest.NewLogger(),
 		router: httprouter.New(),
 		cfg: ForwarderConfig{
 			Keygen:            testauthority.New(),
@@ -1159,15 +1202,15 @@ func (c *mockCAClient) GetCertAuthority(ctx context.Context, id types.CertAuthID
 	return nil, trace.NotFound("cluster not found")
 }
 
-// mockRemoteSite is a reversetunnelclient.RemoteSite implementation with hardcoded
+// mockCluster is a reversetunnelclient.Cluster implementation with hardcoded
 // name, because there's no easy way to construct a real
-// reversetunnelclient.RemoteSite.
-type mockRemoteSite struct {
-	reversetunnelclient.RemoteSite
+// reversetunnelclient.Cluster.
+type mockCluster struct {
+	reversetunnelclient.Cluster
 	name string
 }
 
-func (s mockRemoteSite) GetName() string { return s.name }
+func (s mockCluster) GetName() string { return s.name }
 
 type mockAccessPoint struct {
 	authclient.KubernetesAccessPoint
@@ -1210,10 +1253,10 @@ func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAut
 type mockRevTunnel struct {
 	reversetunnelclient.Server
 
-	sites map[string]reversetunnelclient.RemoteSite
+	sites map[string]reversetunnelclient.Cluster
 }
 
-func (t mockRevTunnel) GetSite(name string) (reversetunnelclient.RemoteSite, error) {
+func (t mockRevTunnel) Cluster(_ context.Context, name string) (reversetunnelclient.Cluster, error) {
 	s, ok := t.sites[name]
 	if !ok {
 		return nil, trace.NotFound("remote site %q not found", name)
@@ -1221,8 +1264,8 @@ func (t mockRevTunnel) GetSite(name string) (reversetunnelclient.RemoteSite, err
 	return s, nil
 }
 
-func (t mockRevTunnel) GetSites() ([]reversetunnelclient.RemoteSite, error) {
-	var sites []reversetunnelclient.RemoteSite
+func (t mockRevTunnel) Clusters(context.Context) ([]reversetunnelclient.Cluster, error) {
+	var sites []reversetunnelclient.Cluster
 	for _, s := range t.sites {
 		sites = append(sites, s)
 	}
@@ -1275,7 +1318,7 @@ func (m *mockWatcher) Done() <-chan struct{} {
 
 func newTestForwarder(ctx context.Context, cfg ForwarderConfig) *Forwarder {
 	return &Forwarder{
-		log:            utils.NewSlogLoggerForTests(),
+		log:            logtest.NewLogger(),
 		router:         httprouter.New(),
 		cfg:            cfg,
 		activeRequests: make(map[string]context.Context),
@@ -1519,6 +1562,11 @@ func Test_authContext_eventClusterMeta(t *testing.T) {
 	kubeClusterLabels := map[string]string{
 		"label": "value",
 	}
+	baseAuthCtx := authz.Context{
+		User: &types.UserV2{
+			Metadata: types.Metadata{Name: "ted-lasso"},
+		},
+	}
 	type args struct {
 		req *http.Request
 		ctx *authContext
@@ -1535,6 +1583,7 @@ func Test_authContext_eventClusterMeta(t *testing.T) {
 					Header: http.Header{},
 				},
 				ctx: &authContext{
+					Context:           baseAuthCtx,
 					kubeClusterName:   "clusterName",
 					kubeClusterLabels: kubeClusterLabels,
 					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}},
@@ -1558,6 +1607,7 @@ func Test_authContext_eventClusterMeta(t *testing.T) {
 					},
 				},
 				ctx: &authContext{
+					Context:           baseAuthCtx,
 					kubeClusterName:   "clusterName",
 					kubeClusterLabels: kubeClusterLabels,
 					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}, "kube-group-c": {}},
@@ -1578,6 +1628,7 @@ func Test_authContext_eventClusterMeta(t *testing.T) {
 					Header: http.Header{},
 				},
 				ctx: &authContext{
+					Context:           baseAuthCtx,
 					kubeClusterName:   "clusterName",
 					kubeClusterLabels: kubeClusterLabels,
 					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}, "kube-group-c": {}},
@@ -1595,8 +1646,8 @@ func Test_authContext_eventClusterMeta(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := tt.args.ctx.eventClusterMeta(tt.args.req)
-			sort.Strings(got.KubernetesGroups)
-			sort.Strings(got.KubernetesGroups)
+			slices.Sort(got.KubernetesUsers)
+			slices.Sort(got.KubernetesGroups)
 			require.Equal(t, tt.want, got)
 		})
 	}
@@ -1634,7 +1685,7 @@ func TestForwarderTLSConfigCAs(t *testing.T) {
 				return x509.NewCertPool(), nil
 			},
 		},
-		log: utils.NewSlogLoggerForTests(),
+		log: logtest.NewLogger(),
 		ctx: context.Background(),
 	}
 
@@ -1660,3 +1711,178 @@ func TestForwarderTLSConfigCAs(t *testing.T) {
 	})
 	require.True(t, getConnTLSRootsCalled)
 }
+
+func TestGOAWAYHandling(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	t.Cleanup(cancel)
+	f := newMockForwarder(ctx, t)
+
+	cert, err := tls.X509KeyPair(fixtures.LocalhostCert, fixtures.LocalhostKey)
+	require.NoError(t, err)
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	// Launch a server that replies with a GOAWAY.
+	gs := goawayServer{
+		listener: ln,
+		tlsConfig: &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			NextProtos:   []string{http2.NextProtoTLS},
+		},
+	}
+	t.Cleanup(func() { require.NoError(t, gs.Close()) })
+
+	go func() { require.NoError(t, gs.Serve()) }()
+
+	// Insert a fake Kubernetes cluster that forwards requests to the GOAWAY server above.
+	f.clusterDetails = map[string]*kubeDetails{
+		"kube-cluster": {
+			kubeCreds: &staticKubeCreds{
+				targetAddr: gs.URL(),
+				tlsConfig:  gs.tlsConfig,
+				transport: &http2.Transport{
+					TLSClientConfig: &tls.Config{
+						InsecureSkipVerify: true,
+					},
+				},
+			},
+		},
+	}
+
+	// Create a user session.
+	authCtx := mockAuthCtx(t, "kube-cluster", false)
+	sess, err := f.newClusterSession(ctx, authCtx)
+	require.NoError(t, err)
+	t.Cleanup(sess.close)
+
+	fwd, err := f.makeSessionForwarder(sess)
+	require.NoError(t, err)
+
+	// Forward all requests for this session to the GOAWAY server.
+	forwarderServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.URL, err = url.Parse(gs.URL())
+		require.NoError(t, err)
+		fwd.ServeHTTP(w, r)
+	}))
+
+	t.Cleanup(forwarderServer.Close)
+
+	// Issue a request that will be forwarded to the GOAWAY server and validate
+	// that the GOAWAY is caught and a 429 is returned to clients.
+	body := bytes.NewBuffer([]byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9})
+	req, err := http.NewRequest("GET", forwarderServer.URL, body)
+	require.NoError(t, err)
+	resp, err := forwarderServer.Client().Do(req)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { assert.NoError(t, resp.Body.Close()) })
+	require.Equal(t, http.StatusTooManyRequests, resp.StatusCode)
+	require.Equal(t, "1", resp.Header.Get("Retry-After"))
+
+	var status metav1.Status
+	err = json.NewDecoder(resp.Body).Decode(&status)
+	require.NoError(t, err)
+	require.Equal(t, metav1.StatusReasonTooManyRequests, status.Reason)
+}
+
+// goawayServer is a fake [http2.Server] that terminates all received client
+// connections in the same manner that a Kubernetes API Server would if
+// it closed the connection as a result of the GOAWAY chance being exceeded.
+type goawayServer struct {
+	listener  net.Listener
+	tlsConfig *tls.Config
+}
+
+// URL returns the address clients should use to connect to the server.
+func (g *goawayServer) URL() string {
+	return "https://" + g.listener.Addr().String()
+}
+
+// Serve listens and handles connections in a blocking manner. Call
+// [Close] to terminate handling new connections and unblock.
+func (g *goawayServer) Serve() error {
+	tlsLn := tls.NewListener(g.listener, g.tlsConfig)
+
+	for {
+		conn, err := tlsLn.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+			return err
+		}
+
+		if err := g.handleConn(conn); err != nil {
+			return err
+		}
+	}
+}
+
+// Close terminates the server and unblocks any calls to [Serve].
+func (g *goawayServer) Close() error {
+	return g.listener.Close()
+}
+
+// handleConn performs the initial HTTP/2 message exchange and then
+// replies with a GOAWAY before closing the connection.
+func (g *goawayServer) handleConn(conn net.Conn) error {
+	defer conn.Close()
+
+	// Consume and validate the client is communicating HTTP2
+	// before consuming any frames.
+	preface := make([]byte, len(http2.ClientPreface))
+	n, err := io.ReadFull(conn, preface)
+	if err != nil {
+		return err
+	}
+
+	if n != len(http2.ClientPreface) {
+		return errors.New("http2 client preface not fully provided")
+	}
+
+	if bytes.Contains(preface, []byte("HTTP/1.1")) {
+		return errors.New("expected HTTP2 in client preface, got HTTP 1.1")
+	}
+
+	// Start consuming HTTP2 frames
+	framer := http2.NewFramer(conn, conn)
+	framer.ReadMetaHeaders = hpack.NewDecoder(4096, nil)
+
+	// The first frame is the client SETTING
+	if _, err := framer.ReadFrame(); err != nil {
+		return err
+	}
+
+	// Respond with the server SETTINGS
+	if err := framer.WriteSettings(); err != nil {
+		return err
+	}
+
+	// Keep reading frames until the [http2.MetaHeadersFrame] is received and then
+	// issue a GOAWAY.
+	for {
+		frame, err := framer.ReadFrame()
+		if err != nil {
+			return err
+		}
+
+		switch f := frame.(type) {
+		case *http2.SettingsFrame:
+			if f.IsAck() {
+				continue
+			}
+			if err := framer.WriteSettingsAck(); err != nil {
+				return err
+			}
+		case *http2.MetaHeadersFrame:
+			if err := framer.WriteGoAway(f.StreamID-1, http2.ErrCodeNo, nil); err != nil {
+				return err
+			}
+
+			return nil
+		default:
+			continue
+		}
+	}
+}
diff --git a/lib/kube/proxy/kube_creds_test.go b/lib/kube/proxy/kube_creds_test.go
index ca2f537e6de05..55bd7fbad1c35 100644
--- a/lib/kube/proxy/kube_creds_test.go
+++ b/lib/kube/proxy/kube_creds_test.go
@@ -39,14 +39,15 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/fixtures"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type mockEKSClientGetter struct {
@@ -186,8 +187,10 @@ func Test_DynamicKubeCreds(t *testing.T) {
 			},
 		},
 	}
+
 	// Mock clients.
-	cloudclients := &cloud.TestCloudClients{
+
+	gcpClients := &gcptest.Clients{
 		GCPGKE: &mocks.GKEMock{
 			Notify: notify,
 			Clock:  fakeClock,
@@ -208,6 +211,9 @@ func Test_DynamicKubeCreds(t *testing.T) {
 				},
 			},
 		},
+	}
+
+	azureClients := &azuretest.Clients{
 		AzureAKSClientPerSub: map[string]azure.AKSClient{
 			"12345": &mocks.AKSMock{
 				Notify: notify,
@@ -339,7 +345,7 @@ func Test_DynamicKubeCreds(t *testing.T) {
 			name: "gcp gke cluster",
 			args: args{
 				cluster:             gkeKube,
-				client:              gcpRestConfigClient(cloudclients),
+				client:              gcpRestConfigClient(gcpClients),
 				validateBearerToken: func(_ string) error { return nil },
 			},
 			wantAddr: "api.gke.google.com:443",
@@ -348,7 +354,7 @@ func Test_DynamicKubeCreds(t *testing.T) {
 			name: "azure aks cluster",
 			args: args{
 				cluster:             aksKube,
-				client:              azureRestConfigClient(cloudclients),
+				client:              azureRestConfigClient(azureClients),
 				validateBearerToken: func(_ string) error { return nil },
 			},
 			wantAddr: "api.aks.microsoft.com:443",
@@ -365,7 +371,7 @@ func Test_DynamicKubeCreds(t *testing.T) {
 					) error {
 						return nil
 					},
-					log:                  utils.NewSlogLoggerForTests(),
+					log:                  logtest.NewLogger(),
 					kubeCluster:          tt.args.cluster,
 					client:               tt.args.client,
 					initialRenewInterval: ttl / 2,
diff --git a/lib/kube/proxy/moderated_sessions_test.go b/lib/kube/proxy/moderated_sessions_test.go
index 1b2abc5704ea2..7ca7e7df6bb0c 100644
--- a/lib/kube/proxy/moderated_sessions_test.go
+++ b/lib/kube/proxy/moderated_sessions_test.go
@@ -34,6 +34,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sync/errgroup"
 	"k8s.io/client-go/rest"
@@ -43,14 +44,17 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/events"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	sessionpkg "github.com/gravitational/teleport/lib/session"
 )
 
 func TestModeratedSessions(t *testing.T) {
 	// enable enterprise features to have access to ModeratedSessions.
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
 		Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 			entitlements.K8s: {Enabled: true},
 		},
@@ -296,6 +300,7 @@ func TestModeratedSessions(t *testing.T) {
 			// moderatorJoined is used to syncronize when the moderator joins the session.
 			moderatorJoined := make(chan struct{})
 			once := sync.Once{}
+			var sessionID string
 			if tt.args.moderator != nil {
 				// generate moderator certs
 				_, config := testCtx.GenTestKubeClientTLSCert(
@@ -307,7 +312,7 @@ func TestModeratedSessions(t *testing.T) {
 				// Simulate a moderator joining the session.
 				group.Go(func() error {
 					// waits for user to send the sessionID of his exec request.
-					sessionID := <-sessionIDC
+					sessionID = <-sessionIDC
 					// validate that the sessionID is valid and the reason is the one we expect.
 					if err := validateSessionTracker(testCtx, sessionID, tt.args.reason, tt.args.invite); err != nil {
 						return trace.Wrap(err)
@@ -471,6 +476,14 @@ func TestModeratedSessions(t *testing.T) {
 			})
 			// wait for every go-routine to finish without errors returned.
 			require.NoError(t, group.Wait())
+
+			if sessionID == "" || !tt.want.sessionEndEvent {
+				// if sessionID is empty, it means that the session never started
+				// (moderated session without the moderator joining)
+				return
+			}
+
+			validateSessionRecordingEvents(t, testCtx, sessionID)
 		})
 	}
 }
@@ -501,7 +514,7 @@ func validateSessionTracker(testCtx *TestContext, sessionID string, reason strin
 // Lock watcher connection to be stale and it takes ~5 minutes to happen.
 func TestInteractiveSessionsNoAuth(t *testing.T) {
 	// enable enterprise features to have access to ModeratedSessions.
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
 		Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 			entitlements.K8s: {Enabled: true},
 		},
@@ -526,12 +539,20 @@ func TestInteractiveSessionsNoAuth(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { kubeMock.Close() })
 
+	authClient := &fakeClient{
+		// ClientI is left nil intentionally because we to set it via AuthClientWrapper.
+		closeC: make(chan struct{}),
+	}
 	// creates a Kubernetes service with a configured cluster pointing to mock api server
 	testCtx := SetupTestContext(
 		context.Background(),
 		t,
 		TestConfig{
 			Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
+			WrapAuthClient: func(client authclient.ClientI) authclient.ClientI {
+				authClient.ClientI = client
+				return authClient
+			},
 		},
 	)
 	// close tests
@@ -619,7 +640,7 @@ func TestInteractiveSessionsNoAuth(t *testing.T) {
 	// Mark the lock as stale so that the session with strict locking is denied.
 	close(testCtx.lockWatcher.StaleC)
 	// force the auth client to return an error when trying to create a session.
-	close(testCtx.closeSessionTrackers)
+	close(authClient.closeC)
 
 	require.Eventually(t, func() bool {
 		return testCtx.lockWatcher.IsStale()
@@ -684,3 +705,56 @@ func TestInteractiveSessionsNoAuth(t *testing.T) {
 		})
 	}
 }
+
+func validateSessionRecordingEvents(t *testing.T, testCtx *TestContext, sessionID string) {
+	t.Helper()
+
+	// validate that session recording was correctly uploaded.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		err := testCtx.UploadHandler.Download(testCtx.Context, sessionpkg.ID(sessionID), &writerAtDiscarder{})
+		assert.NoError(t, err)
+	}, 10*time.Second, 50*time.Millisecond, "session recording was not uploaded")
+
+	auditsC, errC := testCtx.AuthServer.StreamSessionEvents(testCtx.Context, sessionpkg.ID(sessionID), 0)
+
+	var foundJoinEvent bool
+	var foundLeaveEvent bool
+	var foundEndEvent bool
+loop:
+	for {
+		select {
+		case event, ok := <-auditsC:
+			if !ok {
+				break loop
+			}
+			switch event.GetType() {
+			case events.SessionJoinEvent:
+				foundJoinEvent = true
+			case events.SessionLeaveEvent:
+				foundLeaveEvent = true
+			case events.SessionEndEvent:
+				foundEndEvent = true
+			}
+		case err, ok := <-errC:
+			if !ok {
+				break loop
+			}
+			require.NoError(t, err)
+		}
+	}
+	require.True(t, foundJoinEvent, "session join event not found")
+	require.True(t, foundLeaveEvent, "session leave event not found")
+	require.True(t, foundEndEvent, "session end event not found")
+}
+
+// writerAtDiscarder is a fake implementation of io.WriterAt
+// that discards all data written to it.
+type writerAtDiscarder struct{}
+
+func (f writerAtDiscarder) Write(p []byte) (int, error) {
+	return len(p), nil
+}
+
+func (f writerAtDiscarder) WriteAt(p []byte, offset int64) (int, error) {
+	return len(p), nil
+}
diff --git a/lib/kube/proxy/portforward_spdy.go b/lib/kube/proxy/portforward_spdy.go
index ad0b5e391a6e0..4de8a45dcbe27 100644
--- a/lib/kube/proxy/portforward_spdy.go
+++ b/lib/kube/proxy/portforward_spdy.go
@@ -19,6 +19,7 @@ package proxy
 import (
 	"context"
 	"fmt"
+	"io"
 	"log/slog"
 	"net"
 	"net/http"
@@ -199,7 +200,12 @@ func (h *portForwardProxy) forwardStreamPair(p *httpStreamPair, remotePort int64
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		if err := utils.ProxyConn(h.context, p.errorStream, targetErrorStream); err != nil {
+		// Close the target error stream to indicate no more writes.
+		if err := targetErrorStream.Close(); err != nil {
+			h.logger.DebugContext(h.context, "Unable to close target error stream", "error", err)
+		}
+		// Enables error propagation from Kube API server to kubectl client.
+		if _, err := io.Copy(p.errorStream, targetErrorStream); err != nil {
 			h.logger.DebugContext(h.context, "Unable to proxy portforward error-stream", "error", err)
 		}
 	}()
@@ -297,6 +303,8 @@ func (h *portForwardProxy) requestID(stream httpstream.Stream) (string, error) {
 // when the httpstream.Connection is closed.
 func (h *portForwardProxy) run() {
 	h.logger.DebugContext(h.context, "Waiting for port forward streams")
+	var wg sync.WaitGroup
+	defer wg.Wait()
 	for {
 		select {
 		case <-h.context.Done():
@@ -305,6 +313,9 @@ func (h *portForwardProxy) run() {
 		case <-h.sourceConn.CloseChan():
 			h.logger.DebugContext(h.context, "Upgraded connection closed")
 			return
+		case <-h.targetConn.CloseChan():
+			h.logger.DebugContext(h.context, "Target connection closed")
+			return
 		case stream := <-h.streamChan:
 			requestID, err := h.requestID(stream)
 			if err != nil {
@@ -323,7 +334,11 @@ func (h *portForwardProxy) run() {
 				err := trace.BadParameter("error processing stream for request %s: %v", requestID, err)
 				p.sendErr(err)
 			} else if complete {
-				go h.portForward(p)
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					h.portForward(p)
+				}()
 			}
 		}
 	}
diff --git a/lib/kube/proxy/portforward_test.go b/lib/kube/proxy/portforward_test.go
index 7dc7a147e22b7..56bffee874e71 100644
--- a/lib/kube/proxy/portforward_test.go
+++ b/lib/kube/proxy/portforward_test.go
@@ -20,12 +20,14 @@ package proxy
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"strconv"
 	"sync"
 	"testing"
 	"time"
@@ -33,6 +35,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
 	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/httpstream"
@@ -42,7 +45,7 @@ import (
 	"k8s.io/client-go/transport/spdy"
 
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestPortForwardKubeService(t *testing.T) {
@@ -139,7 +142,13 @@ func TestPortForwardKubeService(t *testing.T) {
 			readyCh := make(chan struct{})
 			// errCh receives a single error from ForwardPorts goroutine.
 			errCh := make(chan error)
-			t.Cleanup(func() { require.NoError(t, <-errCh) })
+			t.Cleanup(func() {
+				// ErrLostConnectionToPod is an expected error.
+				// Server allowed to communicate error to client.
+				if err := <-errCh; !errors.Is(err, portforward.ErrLostConnectionToPod) {
+					require.NoError(t, err)
+				}
+			})
 			// stopCh control the port forwarding lifecycle. When it gets closed the
 			// port forward will terminate.
 			stopCh := make(chan struct{})
@@ -149,7 +158,7 @@ func TestPortForwardKubeService(t *testing.T) {
 				podName:      podName,
 				podNamespace: podNamespace,
 				restConfig:   config,
-				podPort:      80,
+				podPorts:     []int{80},
 				stopCh:       stopCh,
 				readyCh:      readyCh,
 			})
@@ -188,7 +197,6 @@ func TestPortForwardKubeService(t *testing.T) {
 				// Dial a connection to localPort.
 				ports, err := fw.GetPorts()
 				require.NoError(t, err)
-				require.Len(t, ports, 1)
 
 				conn, err := net.Dial("tcp", fmt.Sprintf("localhost:%d", ports[0].Local))
 				require.NoError(t, err)
@@ -208,6 +216,110 @@ func TestPortForwardKubeService(t *testing.T) {
 	}
 }
 
+func TestPortForwardKubeServiceMultiPort(t *testing.T) {
+	t.Parallel()
+
+	kubeMock, err := testingkubemock.NewKubeAPIMock()
+	require.NoError(t, err)
+	t.Cleanup(func() { kubeMock.Close() })
+
+	// creates a Kubernetes service with a configured cluster pointing to mock api server
+	testCtx := SetupTestContext(
+		t.Context(),
+		t,
+		TestConfig{
+			Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
+		},
+	)
+	t.Cleanup(func() { require.NoError(t, testCtx.Close()) })
+
+	// create a user with access to kubernetes (kubernetes_user and kubernetes_groups specified)
+	user, _ := testCtx.CreateUserAndRole(
+		testCtx.Context,
+		t,
+		username,
+		RoleSpec{
+			Name:       roleName,
+			KubeUsers:  roleKubeUsers,
+			KubeGroups: roleKubeGroups,
+		})
+
+	// generate a kube client with user certs for auth
+	_, config := testCtx.GenTestKubeClientTLSCert(
+		t,
+		user.GetName(),
+		kubeCluster,
+	)
+
+	// Create 5 ports.
+	const portCount = 5
+	podPorts := make([]int, 0, portCount)
+	for port := 80; port < 80+portCount; port++ {
+		podPorts = append(podPorts, port)
+	}
+
+	readyCh := make(chan struct{})
+	stopCh := make(chan struct{})
+
+	forwarder := spdyPortForwardClientBuilder(t, portForwardRequestConfig{
+		podName:      podName,
+		podNamespace: podNamespace,
+		restConfig:   config,
+		podPorts:     podPorts,
+		stopCh:       stopCh,
+		readyCh:      readyCh,
+	})
+	t.Cleanup(func() {
+		close(stopCh)
+		forwarder.Close()
+	})
+	go func() { require.NoError(t, forwarder.ForwardPorts()) }()
+
+	// Wait for port forwarding to be ready.
+	select {
+	case <-time.After(5 * time.Second):
+		t.Fatal("Timeout waiting for port forwarding")
+	case <-readyCh:
+	}
+
+	// Port forwarding is ready.
+	portPairs, err := forwarder.GetPorts()
+	require.NoError(t, err)
+
+	g, _ := errgroup.WithContext(t.Context())
+	for _, p := range portPairs {
+		g.Go(func() error {
+			portString := strconv.Itoa(int(p.Local))
+			conn, err := net.Dial("tcp", net.JoinHostPort("localhost", portString))
+			if err != nil {
+				return fmt.Errorf("unable to dial local port %d: %w", p.Local, err)
+			}
+			defer conn.Close()
+
+			testData := "test-data-port-" + portString
+			if _, err := conn.Write([]byte(testData)); err != nil {
+				return fmt.Errorf("unable to write local port %d: %w", p.Local, err)
+			}
+
+			expected := testingkubemock.PortForwardPayload + podName + testData
+			buf := make([]byte, len(expected))
+			n, err := conn.Read(buf)
+
+			actual := string(buf[:n])
+			if n != len(expected) && actual != expected {
+				return fmt.Errorf("unexpected response on local port %d: expect %q, actual %q, error %w",
+					p.Local, actual, expected, err)
+			}
+
+			return nil
+		})
+	}
+
+	err = g.Wait()
+	require.NoError(t, err, "Port forwarding checks failed")
+
+}
+
 func portforwardURL(namespace, podName string, host string, query string) (*url.URL, error) {
 	u, err := url.Parse(host)
 	if err != nil {
@@ -227,7 +339,11 @@ func spdyPortForwardClientBuilder(t *testing.T, req portForwardRequestConfig) po
 	u, err := portforwardURL(req.podNamespace, req.podName, req.restConfig.Host, "")
 	require.NoError(t, err)
 	dialer := spdy.NewDialer(upgrader, &http.Client{Transport: transport}, http.MethodPost, u)
-	fw, err := portforward.New(dialer, []string{fmt.Sprintf("%d:%d", 0, req.podPort)}, req.stopCh, req.readyCh, os.Stdout, os.Stdin)
+	ports := make([]string, len(req.podPorts))
+	for n, port := range req.podPorts {
+		ports[n] = fmt.Sprintf("0:%d", port)
+	}
+	fw, err := portforward.New(dialer, ports, req.stopCh, req.readyCh, os.Stdout, os.Stdin)
 	require.NoError(t, err)
 	return fw
 }
@@ -249,8 +365,8 @@ type portForwardRequestConfig struct {
 	podName string
 	// podNamespace is the pod namespace.
 	podNamespace string
-	// podPort is the target port for the pod.
-	podPort int
+	// podPorts is the target port for the pod.
+	podPorts []int
 	// stopCh is the channel used to manage the port forward lifecycle
 	stopCh <-chan struct{}
 	// readyCh communicates when the tunnel is ready to receive traffic
@@ -284,7 +400,7 @@ func TestPortForwardProxy_run_connsClosed(t *testing.T) {
 			context:       context.Background(),
 			onPortForward: func(addr string, success bool) {},
 		},
-		logger:                utils.NewSlogLoggerForTests(),
+		logger:                logtest.NewLogger(),
 		sourceConn:            sourceConn,
 		targetConn:            targetConn,
 		streamChan:            make(chan httpstream.Stream),
@@ -326,8 +442,10 @@ func TestPortForwardProxy_run_connsClosed(t *testing.T) {
 		}
 	}, 5*time.Second, 100*time.Millisecond, "streams werent properly removed from targetConn")
 
-	require.True(t, sourceConn.streamsClosed(), "sourceConn streams not closed")
-	require.True(t, targetConn.streamsClosed(), "targetConn streams not closed")
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		assert.True(t, sourceConn.streamsClosed(), "sourceConn streams not closed")
+		assert.True(t, targetConn.streamsClosed(), "targetConn streams not closed")
+	}, 15*time.Second, 100*time.Millisecond, "streams not closed")
 }
 
 type fakeSPDYStream struct {
@@ -457,25 +575,25 @@ func TestPortForwardUnderlyingProtocol(t *testing.T) {
 		validateFunc func(*testing.T, *testingkubemock.KubeMockServer)
 	}{
 		{
-			name: "SPDY protocol, version < 1.31",
-			version: &version.Info{
-				GitVersion: "v1.30.0",
-			},
+			name:    "SPDY protocol, version < 1.31",
+			version: &version.Info{GitVersion: "v1.30.0"},
 			validateFunc: func(t *testing.T, kms *testingkubemock.KubeMockServer) {
-				// forward used SPDY to kubernetes API
-				require.EqualValues(t, 1, kms.KubePortforward.SPDY.Load())
-				require.EqualValues(t, 0, kms.KubePortforward.Websocket.Load())
+				require.EventuallyWithT(t, func(t *assert.CollectT) {
+					// forward used SPDY to kubernetes API
+					require.EqualValues(t, 1, kms.KubePortforward.SPDY.Load())
+					require.EqualValues(t, 0, kms.KubePortforward.Websocket.Load())
+				}, 5*time.Second, 100*time.Millisecond)
 			},
 		},
 		{
-			name: "Websocket protocol for clusters >=1.31",
-			version: &version.Info{
-				GitVersion: "v1.31.0",
-			},
+			name:    "Websocket protocol for clusters >=1.31",
+			version: &version.Info{GitVersion: "v1.31.0"},
 			validateFunc: func(t *testing.T, kms *testingkubemock.KubeMockServer) {
-				// forward used SPDY over websocket to kubernetes API
-				require.EqualValues(t, 0, kms.KubePortforward.SPDY.Load())
-				require.EqualValues(t, 1, kms.KubePortforward.Websocket.Load())
+				require.EventuallyWithT(t, func(t *assert.CollectT) {
+					// forward used SPDY over websocket to kubernetes API
+					require.EqualValues(t, 0, kms.KubePortforward.SPDY.Load())
+					require.EqualValues(t, 1, kms.KubePortforward.Websocket.Load())
+				}, 5*time.Second, 100*time.Millisecond)
 			},
 		},
 	}
@@ -488,9 +606,8 @@ func TestPortForwardUnderlyingProtocol(t *testing.T) {
 			)
 			require.NoError(t, err)
 			t.Cleanup(func() { kubeMock.Close() })
-			t.Cleanup(func() {
-				tt.validateFunc(t, kubeMock)
-			})
+			t.Cleanup(func() { tt.validateFunc(t, kubeMock) })
+
 			// creates a Kubernetes service with a configured cluster pointing to mock api server
 			testCtx := SetupTestContext(
 				context.Background(),
@@ -499,7 +616,6 @@ func TestPortForwardUnderlyingProtocol(t *testing.T) {
 					Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
 				},
 			)
-
 			t.Cleanup(func() { require.NoError(t, testCtx.Close()) })
 
 			// create a user with access to kubernetes (kubernetes_user and kubernetes_groups specified)
@@ -524,7 +640,13 @@ func TestPortForwardUnderlyingProtocol(t *testing.T) {
 			readyCh := make(chan struct{})
 			// errCh receives a single error from ForwardPorts goroutine.
 			errCh := make(chan error)
-			t.Cleanup(func() { require.NoError(t, <-errCh) })
+			t.Cleanup(func() {
+				// ErrLostConnectionToPod is an expected error.
+				// Server allowed to communicate error to client.
+				if err := <-errCh; !errors.Is(err, portforward.ErrLostConnectionToPod) {
+					require.NoError(t, err)
+				}
+			})
 			// stopCh control the port forwarding lifecycle. When it gets closed the
 			// port forward will terminate.
 			stopCh := make(chan struct{})
@@ -534,7 +656,7 @@ func TestPortForwardUnderlyingProtocol(t *testing.T) {
 				podName:      podName,
 				podNamespace: podNamespace,
 				restConfig:   config,
-				podPort:      80,
+				podPorts:     []int{80},
 				stopCh:       stopCh,
 				readyCh:      readyCh,
 			})
diff --git a/lib/kube/proxy/portforward_websocket.go b/lib/kube/proxy/portforward_websocket.go
index 4ca01ea473062..629090cc77a8f 100644
--- a/lib/kube/proxy/portforward_websocket.go
+++ b/lib/kube/proxy/portforward_websocket.go
@@ -266,11 +266,16 @@ func (h *websocketPortforwardHandler) forwardStreamPair(p *websocketChannelPair)
 	}()
 
 	wg := &sync.WaitGroup{}
-	wg.Add(1)
 
+	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		if err := utils.ProxyConn(h.context, p.errorStream, targetErrorStream); err != nil {
+		// Close the target error stream to indicate no more writes.
+		if err := targetErrorStream.Close(); err != nil {
+			h.logger.DebugContext(h.context, "Unable to close target error stream", "error", err)
+		}
+		// Enables error propagation from Kube API server to kubectl client.
+		if _, err := io.Copy(p.errorStream, targetErrorStream); err != nil {
 			h.logger.DebugContext(h.context, "Unable to proxy portforward error-stream", "error", err)
 		}
 	}()
diff --git a/lib/kube/proxy/resource_deletecollection.go b/lib/kube/proxy/resource_deletecollection.go
index 8bf2e15c57c07..87fbf2344bec2 100644
--- a/lib/kube/proxy/resource_deletecollection.go
+++ b/lib/kube/proxy/resource_deletecollection.go
@@ -277,8 +277,7 @@ func getItemsUsingReflection(obj runtime.Object) (getItemsUsingReflectionOutput,
 func setItemsUsingReflection(itemsR reflect.Value, underlyingType reflect.Type, items []kubeObjectInterface) {
 	// make a new slice of the same type as the original one.
 	slice := reflect.MakeSlice(itemsR.Type(), len(items), len(items))
-	for i := 0; i < len(items); i++ {
-		item := items[i]
+	for i, item := range items {
 		// convert the item to the underlying type of the slice.
 		// this is needed because items is a slice of pointers that
 		// satisfy the kubeObjectInterface interface.
@@ -294,16 +293,15 @@ func setItemsUsingReflection(itemsR reflect.Value, underlyingType reflect.Type,
 // newImpersonatedKubeClient creates a new Kubernetes Client that impersonates
 // a username and the groups.
 func newImpersonatedKubeClient(creds kubeCreds, username string, groups []string) (*dynamic.DynamicClient, error) {
-	c := &rest.Config{}
 	// clone cluster's rest config.
-	*c = *creds.getKubeRestConfig()
+	c := *creds.getKubeRestConfig()
 	// change the impersonated headers.
 	c.Impersonate = rest.ImpersonationConfig{
 		UserName: username,
 		Groups:   groups,
 	}
 	// TODO(tigrato): reuse the http client.
-	client, err := dynamic.NewForConfig(c)
+	client, err := dynamic.NewForConfig(&c)
 	return client, trace.Wrap(err)
 }
 
@@ -360,6 +358,7 @@ func deleteResources[T kubeObjectInterface](
 
 		impersonatedUsers, impersonatedGroups, err := computeImpersonatedPrincipals(
 			utils.StringsSet(allowedKubeUsers), utils.StringsSet(allowedKubeGroups),
+			params.authCtx.User.GetName(),
 			params.header,
 		)
 		if err != nil {
diff --git a/lib/kube/proxy/resource_filters.go b/lib/kube/proxy/resource_filters.go
index 887b874da6ef2..cd04d4b14ed50 100644
--- a/lib/kube/proxy/resource_filters.go
+++ b/lib/kube/proxy/resource_filters.go
@@ -43,7 +43,7 @@ import (
 // - deniedResources: excluded if (namespace,name) matches an entry even if it matches
 // the allowedResources's list.
 // - allowedResources: excluded if (namespace,name) not match a single entry.
-func newResourceFilterer(kind, group, verb string, isClusterWideResource bool, codecs *serializer.CodecFactory, allowedResources, deniedResources []types.KubernetesResource, log *slog.Logger) responsewriters.FilterWrapper {
+func newResourceFilterer(mr metaResource, codecs *serializer.CodecFactory, allowedResources, deniedResources []types.KubernetesResource, log *slog.Logger) responsewriters.FilterWrapper {
 	// If the list of allowed resources contains a wildcard and no deniedResources, then we
 	// don't need to filter anything.
 	if containsWildcard(allowedResources) && len(deniedResources) == 0 {
@@ -56,18 +56,15 @@ func newResourceFilterer(kind, group, verb string, isClusterWideResource bool, c
 			return nil, trace.Wrap(err)
 		}
 		return &resourceFilterer{
-			encoder:               encoder,
-			decoder:               decoder,
-			contentType:           contentType,
-			responseCode:          responseCode,
-			negotiator:            negotiator,
-			allowedResources:      allowedResources,
-			deniedResources:       deniedResources,
-			log:                   log,
-			kind:                  kind,
-			group:                 group,
-			verb:                  verb,
-			isClusterWideResource: isClusterWideResource,
+			encoder:          encoder,
+			decoder:          decoder,
+			contentType:      contentType,
+			responseCode:     responseCode,
+			negotiator:       negotiator,
+			allowedResources: allowedResources,
+			deniedResources:  deniedResources,
+			log:              log,
+			metaResource:     mr,
 		}, nil
 	}
 }
@@ -99,26 +96,24 @@ func containsWildcard(resources []types.KubernetesResource) bool {
 type resourceFilterer struct {
 	encoder runtime.Encoder
 	decoder runtime.Decoder
+
 	// contentType is the response "Content-Type" header.
 	contentType string
 	// responseCode is the response status code.
 	responseCode int
 	// negotiator is an instance of a client negotiator.
 	negotiator runtime.ClientNegotiator
+
 	// allowedResources is the list of kubernetes resources the user has access to.
 	allowedResources []types.KubernetesResource
 	// deniedResources is the list of kubernetes resources the user must not access.
 	deniedResources []types.KubernetesResource
+
 	// log is the logger.
 	log *slog.Logger
-	// kind is the type of the resource.
-	kind string
-	// group is the api group of the resource.
-	group string
-	// verb is the kube API verb based on HTTP verb.
-	verb string
-	// isClusterWideResource is true if the resource is cluster wide.
-	isClusterWideResource bool
+
+	// metaResource contains the information about the resource being filtered.
+	metaResource metaResource
 }
 
 // FilterBuffer receives a byte array, decodes the response into the appropriate
@@ -138,15 +133,14 @@ func (d *resourceFilterer) FilterBuffer(buf []byte, output io.Writer) error {
 		return trace.Wrap(err)
 	}
 
-	switch allowed, isList, err := d.FilterObj(obj); {
-	case err != nil:
+	if allowed, isList, err := d.FilterObj(obj); err != nil {
 		return trace.Wrap(err)
-	case isList:
-	case !allowed:
+	} else if !isList && !allowed {
 		// if the object is not a list and it's not allowed, then we should
 		// return an error.
 		return trace.AccessDenied("access denied")
 	}
+
 	// encode the filterer response back to the user.
 	return d.encode(obj, output)
 }
@@ -172,9 +166,9 @@ func (d *resourceFilterer) FilterObj(obj runtime.Object) (isAllowed bool, isList
 			return hasElemts, true, nil
 		}
 
-		r := getKubeResource(d.kind, d.group, d.verb, o)
+		r := getKubeResource(d.metaResource.requestedResource.resourceKind, d.metaResource.requestedResource.apiGroup, d.metaResource.verb, o)
 		result, err := matchKubernetesResource(
-			r, d.isClusterWideResource,
+			r, d.metaResource.isClusterWideResource(),
 			d.allowedResources, d.deniedResources,
 		)
 		if err != nil {
@@ -189,8 +183,9 @@ func (d *resourceFilterer) FilterObj(obj runtime.Object) (isAllowed bool, isList
 			return false, false, trace.Wrap(err)
 		}
 		return len(o.Rows) > 0, true, nil
+
 	default:
-		if isListObj(o) {
+		if _, ok := obj.(metav1.ListInterface); ok {
 			output, err := getItemsUsingReflection(obj)
 			if err != nil {
 				return false, false, trace.Wrap(err, "failed to get items from list object")
@@ -215,11 +210,6 @@ func (d *resourceFilterer) FilterObj(obj runtime.Object) (isAllowed bool, isList
 	}
 }
 
-func isListObj(obj runtime.Object) bool {
-	_, ok := obj.(metav1.ListInterface)
-	return ok
-}
-
 // decode decodes the buffer into the appropriate type if the responseCode
 // belongs to the range 200(OK)-206(PartialContent).
 // If it does not belong, it returns the buffer unchanged since it contains
@@ -289,8 +279,8 @@ type kubeObjectInterface interface {
 // filterResource validates if the user should access the current resource.
 func (d *resourceFilterer) filterResource(resource kubeObjectInterface) (bool, error) {
 	result, err := matchKubernetesResource(
-		getKubeResource(d.kind, d.group, d.verb, resource),
-		d.isClusterWideResource,
+		getKubeResource(d.metaResource.requestedResource.resourceKind, d.metaResource.requestedResource.apiGroup, d.metaResource.verb, resource),
+		d.metaResource.isClusterWideResource(),
 		d.allowedResources, d.deniedResources,
 	)
 	return result, trace.Wrap(err)
@@ -315,11 +305,11 @@ func (d *resourceFilterer) filterMetaV1Table(table *metav1.Table, allowedResourc
 		if err := d.decodePartialObjectMetadata(row); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		resource, err := getKubeResourcePartialMetadataObject(d.kind, d.group, d.verb, row.Object.Object)
+		resource, err := getKubeResourcePartialMetadataObject(d.metaResource.requestedResource.resourceKind, d.metaResource.requestedResource.apiGroup, d.metaResource.verb, row.Object.Object)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		if result, err := matchKubernetesResource(resource, d.isClusterWideResource, allowedResources, deniedResources); err == nil && result {
+		if result, err := matchKubernetesResource(resource, d.metaResource.isClusterWideResource(), allowedResources, deniedResources); err == nil && result {
 			resources = append(resources, *row)
 		} else if err != nil {
 			d.log.WarnContext(context.Background(), "Unable to compile regex expression", "error", err)
@@ -438,9 +428,7 @@ func filterBuffer(filterWrapper responsewriters.FilterWrapper, src *responsewrit
 // that the user must not have access to.
 // The filtered list is re-assigned to `obj.Object["items"]`.
 func (d *resourceFilterer) filterUnstructuredList(obj *unstructured.Unstructured) (hasElems bool) {
-	const (
-		itemsKey = "items"
-	)
+	const itemsKey = "items"
 	if obj == nil || obj.Object == nil {
 		return false
 	}
@@ -454,9 +442,9 @@ func (d *resourceFilterer) filterUnstructuredList(obj *unstructured.Unstructured
 	filteredList := make([]any, 0, len(objList.Items))
 	for _, resource := range objList.Items {
 		gvk := resource.GroupVersionKind()
-		r := getKubeResource(d.kind, gvk.Group, d.verb, &resource)
+		r := getKubeResource(d.metaResource.requestedResource.resourceKind, gvk.Group, d.metaResource.verb, &resource)
 		if result, err := matchKubernetesResource(
-			r, d.isClusterWideResource,
+			r, d.metaResource.isClusterWideResource(),
 			d.allowedResources, d.deniedResources,
 		); result {
 			filteredList = append(filteredList, resource.Object)
diff --git a/lib/kube/proxy/resource_filters_test.go b/lib/kube/proxy/resource_filters_test.go
index 22bdede072282..3655c93023094 100644
--- a/lib/kube/proxy/resource_filters_test.go
+++ b/lib/kube/proxy/resource_filters_test.go
@@ -41,7 +41,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	libslices "github.com/gravitational/teleport/lib/utils/slices"
 )
 
@@ -176,7 +176,17 @@ func Test_filterBuffer(t *testing.T) {
 
 				buf, decompress := newMemoryResponseWriter(t, data.Bytes(), tt.args.contentEncoding)
 
-				err = filterBuffer(newResourceFilterer(r, "", types.KubeVerbList, false, &globalKubeCodecs, allowedResources, nil, utils.NewSlogLoggerForTests()), buf)
+				mr := metaResource{
+					requestedResource: apiResource{
+						resourceKind: r,
+						apiGroup:     "",
+					},
+					resourceDefinition: &metav1.APIResource{
+						Namespaced: true,
+					},
+					verb: types.KubeVerbList,
+				}
+				err = filterBuffer(newResourceFilterer(mr, &globalKubeCodecs, allowedResources, nil, logtest.NewLogger()), buf)
 				require.NoError(t, err)
 
 				// Decompress the buffer to compare the result.
diff --git a/lib/kube/proxy/resource_list.go b/lib/kube/proxy/resource_list.go
index d86005e03f710..0c1dd323647e4 100644
--- a/lib/kube/proxy/resource_list.go
+++ b/lib/kube/proxy/resource_list.go
@@ -20,6 +20,7 @@ package proxy
 
 import (
 	"bytes"
+	"context"
 	"io"
 	"net/http"
 	"strings"
@@ -71,7 +72,7 @@ func (f *Forwarder) listResources(sess *clusterSession, w http.ResponseWriter, r
 	} else {
 		allowedResources, deniedResources := sess.Checker.GetKubeResources(sess.kubeCluster)
 
-		shouldBeAllowed, err := matchListRequestShouldBeAllowed(sess, sess.metaResource.requestedResource.resourceKind, sess.metaResource.requestedResource.apiGroup, allowedResources, deniedResources)
+		shouldBeAllowed, err := matchListRequestShouldBeAllowed(sess.metaResource, allowedResources, deniedResources)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -83,10 +84,9 @@ func (f *Forwarder) listResources(sess *clusterSession, w http.ResponseWriter, r
 			)
 			return nil, trace.AccessDenied("%s", notFoundMessage)
 		}
-		// isWatch identifies if the request is long-lived watch stream based on
+		// Identify if the request is long-lived watch stream based on
 		// HTTP connection.
-		isWatch := isKubeWatchRequest(req, sess.authContext.metaResource.requestedResource)
-		if !isWatch {
+		if !isKubeWatchRequest(req, sess.authContext.metaResource.requestedResource) {
 			// List resources.
 			status, err = f.listResourcesList(req, w, sess, allowedResources, deniedResources)
 		} else {
@@ -115,16 +115,14 @@ func (f *Forwarder) listResourcesList(req *http.Request, w http.ResponseWriter,
 	memBuffer := responsewriters.NewMemoryResponseWriter()
 	// Forward the request to the target cluster.
 	sess.forwarder.ServeHTTP(memBuffer, req)
-	_, ok := sess.rbacSupportedResources.getTeleportResourceKindFromAPIResource(sess.metaResource.requestedResource)
-	if !ok {
+	if _, ok := sess.rbacSupportedResources.getTeleportResourceKindFromAPIResource(sess.metaResource.requestedResource); !ok {
 		return http.StatusBadRequest, trace.BadParameter("unknown resource kind %q", sess.metaResource.requestedResource.resourceKind)
 	}
-	verb := sess.metaResource.verb
 
 	// filterBuffer filters the response to exclude resources the user doesn't have access to.
 	// The filtered payload will be written into memBuffer again.
 	if err := filterBuffer(
-		newResourceFilterer(sess.metaResource.requestedResource.resourceKind, sess.metaResource.requestedResource.apiGroup, verb, sess.metaResource.isClusterWideResource(), sess.codecFactory, allowedResources, deniedResources, f.log),
+		newResourceFilterer(sess.metaResource, sess.codecFactory, allowedResources, deniedResources, f.log),
 		memBuffer,
 	); err != nil {
 		return memBuffer.Status(), trace.Wrap(err)
@@ -141,23 +139,21 @@ func (f *Forwarder) listResourcesList(req *http.Request, w http.ResponseWriter,
 // has no access and present then a more user-friendly error message instead of returning
 // an empty list.
 // This function is not responsible for enforcing access rules.
-func matchListRequestShouldBeAllowed(sess *clusterSession, resourceKind, resourceGroup string, allowedResources, deniedResources []types.KubernetesResource) (bool, error) {
-	// TODO(@creack): Use metaResource.rbac()?
-	resource := types.KubernetesResource{
-		Kind:      resourceKind,
-		Namespace: sess.metaResource.requestedResource.namespace,
-		Verbs:     []string{sess.metaResource.verb},
-		APIGroup:  resourceGroup,
+func matchListRequestShouldBeAllowed(mr metaResource, allowedResources, deniedResources []types.KubernetesResource) (bool, error) {
+	resource := mr.rbacResource()
+	if resource == nil {
+		// Cluster is offline.
+		return false, nil
 	}
 
-	result, err := utils.KubeResourceCouldMatchRules(resource, sess.metaResource.isClusterWideResource(), deniedResources, types.Deny)
+	result, err := utils.KubeResourceCouldMatchRules(*resource, mr.isClusterWideResource(), deniedResources, types.Deny)
 	if err != nil {
 		return false, trace.Wrap(err)
 	} else if result {
 		return false, nil
 	}
 
-	result, err = utils.KubeResourceCouldMatchRules(resource, sess.metaResource.isClusterWideResource(), allowedResources, types.Allow)
+	result, err = utils.KubeResourceCouldMatchRules(*resource, mr.isClusterWideResource(), allowedResources, types.Allow)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
@@ -180,15 +176,11 @@ func (f *Forwarder) listResourcesWatcher(req *http.Request, w http.ResponseWrite
 	if !ok {
 		return http.StatusBadRequest, trace.BadParameter("unknown resource kind %q", sess.metaResource.requestedResource.resourceKind)
 	}
-	verb := sess.metaResource.verb
 	rw, err := responsewriters.NewWatcherResponseWriter(
 		w,
 		negotiator,
 		newResourceFilterer(
-			sess.metaResource.requestedResource.resourceKind,
-			sess.metaResource.requestedResource.apiGroup,
-			verb,
-			sess.metaResource.isClusterWideResource(),
+			sess.metaResource,
 			sess.codecFactory,
 			allowedResources,
 			deniedResources,
@@ -203,22 +195,22 @@ func (f *Forwarder) listResourcesWatcher(req *http.Request, w http.ResponseWrite
 	// push events that show ephemeral containers were started if there
 	// are any ephemeral containers waiting to be created for this pod
 	// by this user
-	done := make(chan struct{})
 	var wg sync.WaitGroup
+	ctx, cancel := context.WithCancel(req.Context())
 	if podName := isRequestTargetedToPod(req, sess.metaResource.requestedResource); podName != "" && ok {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
 
-			f.sendEphemeralContainerEvents(done, req, rw, sess, podName)
+			f.sendEphemeralContainerEvents(ctx, rw, sess, podName)
 		}()
 	}
-
 	// Forwards the request to the target cluster.
 	sess.forwarder.ServeHTTP(rw, req)
 	// Wait for the fake event pushing goroutine to finish
-	close(done)
+	cancel()
 	wg.Wait()
+
 	// Once the request terminates, close the watcher and waits for resources
 	// cleanup.
 	err = rw.Close()
@@ -229,21 +221,21 @@ func (f *Forwarder) listResourcesWatcher(req *http.Request, w http.ResponseWrite
 // each 5s from cache and see if they match the user and pod and namespace.
 // If any match exists, it will push a fake event to the watcher stream to trick
 // kubectl into creating the exec session.
-func (f *Forwarder) sendEphemeralContainerEvents(done <-chan struct{}, req *http.Request, rw *responsewriters.WatcherResponseWriter, sess *clusterSession, podName string) {
+func (f *Forwarder) sendEphemeralContainerEvents(ctx context.Context, rw *responsewriters.WatcherResponseWriter, sess *clusterSession, podName string) {
 	const backoff = 5 * time.Second
 	sentDebugContainers := map[string]struct{}{}
 	ticker := time.NewTicker(backoff)
 	defer ticker.Stop()
 	for {
 		wcs, err := f.getUserEphemeralContainersForPod(
-			req.Context(),
+			ctx,
 			sess.User.GetName(),
 			sess.kubeClusterName,
 			sess.metaResource.requestedResource.namespace,
 			podName,
 		)
 		if err != nil {
-			f.log.WarnContext(req.Context(), "error getting user ephemeral containers", "error", err)
+			f.log.WarnContext(ctx, "error getting user ephemeral containers", "error", err)
 			return
 		}
 
@@ -251,24 +243,22 @@ func (f *Forwarder) sendEphemeralContainerEvents(done <-chan struct{}, req *http
 			if _, ok := sentDebugContainers[wc.Spec.ContainerName]; ok {
 				continue
 			}
-			evt, err := f.getPatchedPodEvent(req.Context(), sess, wc)
+			evt, err := f.getPatchedPodEvent(ctx, sess, wc)
 			if err != nil {
-				f.log.WarnContext(req.Context(), "error pushing pod event", "error", err)
+				f.log.WarnContext(ctx, "error pushing pod event", "error", err)
 				continue
 			}
 			sentDebugContainers[wc.Spec.ContainerName] = struct{}{}
 			// push the event to the client
 			// this will lock until the event is pushed or the
 			// request context is done.
-			rw.PushVirtualEventToClient(req.Context(), evt)
+			rw.PushVirtualEventToClient(ctx, evt)
 		}
 
 		// wait a bit before querying the cache again, or return
 		// if the request has finished
 		select {
-		case <-req.Context().Done():
-			return
-		case <-done:
+		case <-ctx.Done():
 			return
 		case <-ticker.C:
 		}
diff --git a/lib/kube/proxy/resource_rbac_test.go b/lib/kube/proxy/resource_rbac_test.go
index 63729dc0bb6e5..4f264ec7d497f 100644
--- a/lib/kube/proxy/resource_rbac_test.go
+++ b/lib/kube/proxy/resource_rbac_test.go
@@ -25,6 +25,7 @@ import (
 	"mime"
 	"net/http"
 	"path"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -52,7 +53,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
 	tkm "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestListPodRBAC(t *testing.T) {
@@ -422,7 +423,7 @@ func TestListPodRBAC(t *testing.T) {
 			},
 		},
 		{
-			name: "user with pod access request that no longer fullfills the role requirements",
+			name: "user with legacy pod access request that no longer fullfills the role requirements",
 			args: args{
 				user:      userWithLimitedAccess,
 				namespace: metav1.NamespaceDefault,
@@ -457,7 +458,42 @@ func TestListPodRBAC(t *testing.T) {
 				},
 			},
 		},
-
+		{
+			name: "user with pod access request that no longer fullfills the role requirements",
+			args: args{
+				user:      userWithLimitedAccess,
+				namespace: metav1.NamespaceDefault,
+				opts: []GenTestKubeClientTLSCertOptions{
+					WithResourceAccessRequests(
+						types.ResourceID{
+							ClusterName:     testCtx.ClusterName,
+							Kind:            types.AccessRequestPrefixKindKubeNamespaced + "pods",
+							Name:            kubeCluster,
+							SubResourceName: fmt.Sprintf("%s/%s", metav1.NamespaceDefault, testPodName),
+						},
+					),
+				},
+			},
+			want: want{
+				listPodsResult: []string{},
+				listPodErr: &kubeerrors.StatusError{
+					ErrStatus: metav1.Status{
+						Status:  "Failure",
+						Message: "pods is forbidden: User \"limited_user\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"",
+						Code:    403,
+						Reason:  metav1.StatusReasonForbidden,
+					},
+				},
+				getTestPodResult: &kubeerrors.StatusError{
+					ErrStatus: metav1.Status{
+						Status:  "Failure",
+						Message: "pods \"test\" is forbidden: User \"limited_user\" cannot get resource \"pods\" in API group \"\" in the namespace \"default\"",
+						Code:    403,
+						Reason:  metav1.StatusReasonForbidden,
+					},
+				},
+			},
+		},
 		{
 			name: "list default namespace pods for user with limited access",
 			args: args{
@@ -643,7 +679,17 @@ func TestWatcherResponseWriter(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			userReader, userWriter := io.Pipe()
 			negotiator := newClientNegotiator(&globalKubeCodecs)
-			filterWrapper := newResourceFilterer("pods", "", types.KubeVerbWatch, false, &globalKubeCodecs, tt.args.allowed, tt.args.denied, utils.NewSlogLoggerForTests())
+			mr := metaResource{
+				requestedResource: apiResource{
+					resourceKind: "pods",
+					apiGroup:     "",
+				},
+				resourceDefinition: &metav1.APIResource{
+					Namespaced: true,
+				},
+				verb: types.KubeVerbWatch,
+			}
+			filterWrapper := newResourceFilterer(mr, &globalKubeCodecs, tt.args.allowed, tt.args.denied, logtest.NewLogger())
 			// watcher parses the data written into itself and if the user is allowed to
 			// receive the update, it writes the event into target.
 			watcher, err := responsewriters.NewWatcherResponseWriter(newFakeResponseWriter(userWriter) /*target*/, negotiator, filterWrapper)
@@ -1447,10 +1493,11 @@ func TestGenericCustomResourcesRBAC(t *testing.T) {
 
 	// create a user with full access to all namespaces.
 	// (kubernetes_user and kubernetes_groups specified)
-	userWithFullAccess, _ := testCtx.CreateUserAndRole(
+	userWithFullAccess, _ := testCtx.CreateUserAndRoleVersion(
 		testCtx.Context,
 		t,
 		usernameWithFullAccess,
+		types.V8,
 		RoleSpec{
 			Name:       usernameWithFullAccess,
 			KubeUsers:  roleKubeUsers,
@@ -1471,10 +1518,11 @@ func TestGenericCustomResourcesRBAC(t *testing.T) {
 	)
 
 	// create a user with limited access to kubernetes namespaces.
-	userWithLimitedAccess, _ := testCtx.CreateUserAndRole(
+	userWithLimitedAccess, _ := testCtx.CreateUserAndRoleVersion(
 		testCtx.Context,
 		t,
 		usernameWithLimitedAccess,
+		types.V8,
 		RoleSpec{
 			Name:       usernameWithLimitedAccess,
 			KubeUsers:  roleKubeUsers,
@@ -1501,10 +1549,11 @@ func TestGenericCustomResourcesRBAC(t *testing.T) {
 	)
 
 	// create a user with limited access to kubernetes namespaces.
-	userWithSpecificAccess, _ := testCtx.CreateUserAndRole(
+	userWithSpecificAccess, _ := testCtx.CreateUserAndRoleVersion(
 		testCtx.Context,
 		t,
 		usernameWithSpecificAccess,
+		types.V8,
 		RoleSpec{
 			Name:       usernameWithSpecificAccess,
 			KubeUsers:  roleKubeUsers,
@@ -1644,9 +1693,9 @@ func TestGenericCustomResourcesRBAC(t *testing.T) {
 					WithResourceAccessRequests(
 						types.ResourceID{
 							ClusterName:     testCtx.ClusterName,
-							Kind:            types.KindKubeNamespace,
+							Kind:            "kube:ns:*.*",
 							Name:            kubeCluster,
-							SubResourceName: "dev",
+							SubResourceName: "dev/*",
 						},
 					),
 				},
@@ -1838,7 +1887,7 @@ func TestV8JailedNamespaceListRBAC(t *testing.T) {
 				{
 					Kind:      types.Wildcard,
 					Name:      types.Wildcard,
-					Namespace: "^" + types.Wildcard + "$",
+					Namespace: "^.+$",
 					Verbs:     []string{types.Wildcard},
 					APIGroup:  types.Wildcard,
 				},
@@ -2442,7 +2491,7 @@ func TestV7V8Match(t *testing.T) {
 					Kind:      types.Wildcard,
 					APIGroup:  types.Wildcard,
 					Name:      types.Wildcard,
-					Namespace: "^" + types.Wildcard + "$",
+					Namespace: "^.+$",
 					Verbs:     []string{types.Wildcard},
 				},
 			}, nil),
@@ -2463,7 +2512,7 @@ func TestV7V8Match(t *testing.T) {
 					Kind:      types.Wildcard,
 					APIGroup:  types.Wildcard,
 					Name:      types.Wildcard,
-					Namespace: "^" + types.Wildcard + "$",
+					Namespace: "^.+$",
 					Verbs:     []string{types.Wildcard},
 				},
 			}, nil),
@@ -2484,7 +2533,7 @@ func TestV7V8Match(t *testing.T) {
 					Kind:      types.Wildcard,
 					APIGroup:  types.Wildcard,
 					Name:      types.Wildcard,
-					Namespace: "^" + types.Wildcard + "$",
+					Namespace: "^.+$",
 					Verbs:     []string{types.Wildcard},
 				},
 			}, nil),
@@ -2837,6 +2886,98 @@ func TestNamespaceListRBAC(t *testing.T) {
 				"dev",
 			},
 		},
+		{
+			name: "deny single ns",
+			user: newTestUser([]types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  "*",
+					Verbs: []string{types.Wildcard},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  "dev",
+					Verbs: []string{types.Wildcard},
+				},
+			}),
+			want: []string{
+				"default",
+				"test",
+				"prod",
+			},
+		},
+		{
+			name: "ns resource deny cluster-wide wildcard",
+			user: newTestUser([]types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  types.Wildcard,
+					Verbs: []string{types.Wildcard},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			want: []string{},
+		},
+		{
+			name: "ns pods deny cluster-wide wildcard",
+			user: newTestUser([]types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  types.Wildcard,
+					Verbs: []string{types.Wildcard},
+				},
+				{
+					Kind:      "pods",
+					Name:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Verbs:     []string{types.Wildcard},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			// Even though the user has access to pods and still can get pods in all NSs, the list namespace is empty
+			// because of the deny rule.
+			want: []string{},
+		},
+		{
+			name: "ns pods deny ns wildcard",
+			user: newTestUser([]types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  types.Wildcard,
+					Verbs: []string{types.Wildcard},
+				},
+				{
+					Kind:      "pods",
+					Name:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Verbs:     []string{types.Wildcard},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:  "namespaces",
+					Name:  types.Wildcard,
+					Verbs: []string{types.Wildcard},
+				},
+			}),
+			// Even though the user has access to pods and still can get pods in all NSs, the list namespace is empty
+			// because of the deny rule.
+			want: []string{},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -2853,6 +2994,269 @@ func TestNamespaceListRBAC(t *testing.T) {
 	}
 }
 
+func TestDenyClusterWideResources(t *testing.T) {
+	t.Parallel()
+
+	_, testCtx := newTestKubeCRDMock(t, tkm.WithTeleportRoleCRD)
+
+	newTestUser := newTestUserFactory(t, testCtx, "deny-cw", types.V8)
+
+	fullAccess := []types.KubernetesResource{
+		{
+			Kind:      types.Wildcard,
+			APIGroup:  types.Wildcard,
+			Name:      types.Wildcard,
+			Namespace: types.Wildcard,
+			Verbs:     []string{types.Wildcard},
+		},
+	}
+	podList := []string{
+		"nginx-1",
+		"nginx-2",
+		"test",
+		"nginx-1",
+		"nginx-2",
+	}
+
+	tests := []struct {
+		name string
+		user types.User
+		want []string
+	}{
+		{
+			name: "allow two ns deny all cluster-wide resources",
+			user: newTestUser([]types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "dev",
+					Verbs:     []string{types.Wildcard},
+				},
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "prod",
+					Verbs:     []string{types.Wildcard},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			want: []string{"nginx-1", "nginx-2"},
+		},
+		{
+			name: "full access deny all cluster-wide resources",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			want: podList,
+		},
+		{
+			name: "full access deny all cluster-wide resources and one ns",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+				{
+					Kind:  "namespaces",
+					Name:  "dev",
+					Verbs: []string{types.Wildcard},
+				},
+			}),
+			want: podList,
+		},
+		{
+			name: "full access deny all cluster-wide resources and wildcard ns",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "dev",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			want: []string{"nginx-1", "nginx-2", "test"},
+		},
+		{
+			name: "full access deny clusterroles and wildcard ns",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      "clusterroles",
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "",
+					Verbs:     []string{types.Wildcard},
+				},
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "dev",
+					Verbs:     []string{types.Wildcard},
+				},
+				{
+					Kind:  "namespaces",
+					Name:  "test",
+					Verbs: []string{"delete"},
+				},
+			}),
+			want: slices.Concat([]string{"default", "test", "prod"}, []string{"nginx-1", "nginx-2", "test"}),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Generate a kube dynClient with user certs for auth.
+			_, dynClient, _ := testCtx.GenTestKubeClientsTLSCert(t, tt.user.GetName(), kubeCluster)
+
+			got := []string{}
+			// Get namespaces in read-only, should work.
+			got = append(got, dynList(testCtx.Context, dynClient.Resource(gvr("v1/namespaces")))...)
+			// Get pods in all namespaces, should work.
+			got = append(got, dynList(testCtx.Context, dynClient.Resource(gvr("v1/pods")))...)
+			require.Equal(t, tt.want, got)
+
+			// Attempt to delete a namespace, should fail.
+			require.Error(t, dynClient.Resource(gvr("v1/namespaces")).Delete(testCtx.Context, "test", metav1.DeleteOptions{}))
+		})
+	}
+}
+
+func TestDeleteNamespace(t *testing.T) {
+	t.Parallel()
+
+	_, testCtx := newTestKubeCRDMock(t, tkm.WithTeleportRoleCRD)
+
+	newTestUser := newTestUserFactory(t, testCtx, "delete-ns", types.V8)
+
+	fullAccess := []types.KubernetesResource{
+		{
+			Kind:      types.Wildcard,
+			APIGroup:  types.Wildcard,
+			Name:      types.Wildcard,
+			Namespace: types.Wildcard,
+			Verbs:     []string{types.Wildcard},
+		},
+	}
+
+	tests := []struct {
+		name    string
+		user    types.User
+		ns      string
+		wantErr bool
+	}{
+		{
+			name: "full access deny all wildcard ns",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					APIGroup:  types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "test",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			ns:      "test",
+			wantErr: true,
+		},
+		{
+			name: "full access deny wildcard ns resource",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:     "namespaces",
+					APIGroup: types.Wildcard,
+					Name:     types.Wildcard,
+					Verbs:    []string{types.Wildcard},
+				},
+			}),
+			ns:      "test",
+			wantErr: true,
+		},
+		{
+			name: "full access deny specific ns resource - denied",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:     "namespaces",
+					APIGroup: types.Wildcard,
+					Name:     "test",
+					Verbs:    []string{types.Wildcard},
+				},
+			}),
+			ns:      "test",
+			wantErr: true,
+		},
+		{
+			name: "full access deny specific ns resource - allowed",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:     "namespaces",
+					APIGroup: types.Wildcard,
+					Name:     "test",
+					Verbs:    []string{types.Wildcard},
+				},
+			}),
+			ns:      "dev",
+			wantErr: false,
+		},
+		{
+			name: "full access deny unrelated resource - allowed",
+			user: newTestUser(fullAccess, []types.KubernetesResource{
+				{
+					Kind:      "pods",
+					Name:      types.Wildcard,
+					Namespace: "test",
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			ns: "test",
+			// TODO(@creack): Reconsider this behavior. We may consider denying this. Keeping as is for now
+			//                to maintain v17's / rolev7 behavior.
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Generate a kube dynClient with user certs for auth.
+			_, dynClient, _ := testCtx.GenTestKubeClientsTLSCert(t, tt.user.GetName(), kubeCluster)
+
+			// Attempt to delete a namespace, should fail.
+			if err := dynClient.Resource(gvr("v1/namespaces")).Delete(testCtx.Context, tt.ns, metav1.DeleteOptions{}); tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
 func TestFullNamespaceNoDeleteRBAC(t *testing.T) {
 	t.Parallel()
 
diff --git a/lib/kube/proxy/response_rewriter.go b/lib/kube/proxy/response_rewriter.go
index 59f0bea552d57..9966a584ef949 100644
--- a/lib/kube/proxy/response_rewriter.go
+++ b/lib/kube/proxy/response_rewriter.go
@@ -148,7 +148,7 @@ func collectSystemMastersTeleportRoles(s *clusterSession) []string {
 	// results in the intersection of roles that match the "kubernetes_labels" and
 	// roles that allow access to the desired "kubernetes_resource".
 	// If from the intersection results an empty set, the request is denied.
-	if rbacRes := s.metaResource.rbacResource(); rbacRes != nil {
+	if rbacRes := s.metaResource.rbacResource(); rbacRes != nil && !s.metaResource.isList {
 		matchers = append(
 			matchers,
 			services.NewKubernetesResourceMatcher(*rbacRes, s.metaResource.isClusterWideResource()),
diff --git a/lib/kube/proxy/roundtrip.go b/lib/kube/proxy/roundtrip.go
index 7fb1bf9c8517a..b8a21db0abc1f 100644
--- a/lib/kube/proxy/roundtrip.go
+++ b/lib/kube/proxy/roundtrip.go
@@ -42,7 +42,7 @@ import (
 	"k8s.io/apimachinery/third_party/forked/golang/netutil"
 
 	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/kube/internal"
 )
 
 // SpdyRoundTripper knows how to upgrade an HTTP request to one that supports
@@ -222,7 +222,7 @@ func (s *SpdyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	// If we're using identity forwarding, we need to add the impersonation
 	// headers to the request before we send the request.
 	if s.useIdentityForwarding {
-		if header, err = auth.IdentityForwardingHeaders(s.ctx, header); err != nil {
+		if header, err = internal.IdentityForwardingHeaders(s.ctx, header); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
diff --git a/lib/kube/proxy/roundtrip_websocket.go b/lib/kube/proxy/roundtrip_websocket.go
index 832d51c1c9cb6..ebbe03e76c662 100644
--- a/lib/kube/proxy/roundtrip_websocket.go
+++ b/lib/kube/proxy/roundtrip_websocket.go
@@ -26,11 +26,9 @@ import (
 	"github.com/gravitational/trace"
 	"k8s.io/apimachinery/pkg/util/httpstream"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
-	versionUtil "k8s.io/apimachinery/pkg/util/version"
-	"k8s.io/apimachinery/pkg/version"
 	kwebsocket "k8s.io/client-go/transport/websocket"
 
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/kube/internal"
 )
 
 // WebsocketRoundTripper knows how to upgrade an HTTP request to one that supports
@@ -70,7 +68,7 @@ func (w *WebsocketRoundTripper) RoundTrip(req *http.Request) (*http.Response, er
 	// If we're using identity forwarding, we need to add the impersonation
 	// headers to the request before we send the request.
 	if w.useIdentityForwarding {
-		if header, err = auth.IdentityForwardingHeaders(w.ctx, header); err != nil {
+		if header, err = internal.IdentityForwardingHeaders(w.ctx, header); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
@@ -112,21 +110,3 @@ func (w *WebsocketRoundTripper) RoundTrip(req *http.Request) (*http.Response, er
 
 	return wsResp, nil
 }
-
-var kubeExecSubprotocolV5MinVersion = func() *versionUtil.Version {
-	const kubeExecSubprotocolV5Version = "v1.30.0"
-	return versionUtil.MustParse(kubeExecSubprotocolV5Version)
-}()
-
-func kubernetesSupportsExecSubprotocolV5(serverVersion *version.Info) bool {
-	if serverVersion == nil {
-		return false
-	}
-
-	parsedVersion, err := versionUtil.ParseSemantic(serverVersion.GitVersion)
-	if err != nil {
-		return false
-	}
-
-	return parsedVersion.AtLeast(kubeExecSubprotocolV5MinVersion)
-}
diff --git a/lib/kube/proxy/scheme.go b/lib/kube/proxy/scheme.go
index d9b4b53a8e87e..c3735451969c1 100644
--- a/lib/kube/proxy/scheme.go
+++ b/lib/kube/proxy/scheme.go
@@ -38,6 +38,8 @@ import (
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/metrics/pkg/apis/metrics"
+	metricsv1beta1 "k8s.io/metrics/pkg/apis/metrics/v1beta1"
 )
 
 const (
@@ -69,6 +71,15 @@ func init() {
 func registerDefaultKubeTypes(s *runtime.Scheme) error {
 	// Register external types for Scheme
 	metav1.AddToGroupVersion(s, schema.GroupVersion{Group: "", Version: "v1"})
+
+	if err := metrics.AddToScheme(s); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := metricsv1beta1.AddToScheme(s); err != nil {
+		return trace.Wrap(err)
+	}
+
 	if err := metav1.AddMetaToScheme(s); err != nil {
 		return trace.Wrap(err)
 	}
@@ -169,7 +180,6 @@ func newClusterSchemaBuilder(log *slog.Logger, client kubernetes.Interface) (*se
 				resourceKind: apiResource.Name,
 			}
 
-			// TODO(@creack): Keep track of the namespaced field.
 			supportedResources[resourceKey] = apiResource
 
 			// Create the group version kind for the resource.
diff --git a/lib/kube/proxy/scheme_test.go b/lib/kube/proxy/scheme_test.go
index ae7075db251f4..8e3df55e3e75c 100644
--- a/lib/kube/proxy/scheme_test.go
+++ b/lib/kube/proxy/scheme_test.go
@@ -22,17 +22,22 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/metrics/pkg/apis/metrics"
+	metricsv1beta1 "k8s.io/metrics/pkg/apis/metrics/v1beta1"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestNewClusterSchemaBuilder tests that newClusterSchemaBuilder doesn't panic
 // when it's given types already registered in the global scheme.
 func Test_newClusterSchemaBuilder(t *testing.T) {
-	_, _, _, err := newClusterSchemaBuilder(utils.NewSlogLoggerForTests(), &clientSet{})
+	_, _, _, err := newClusterSchemaBuilder(logtest.NewLogger(), &clientSet{})
 	require.NoError(t, err)
 }
 
@@ -61,3 +66,76 @@ func (c *clientSet) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav1.AP
 		&fakeAPIResource,
 	}, nil
 }
+
+func TestRegisterDefaultKubeTypes(t *testing.T) {
+	scheme := runtime.NewScheme()
+	err := registerDefaultKubeTypes(scheme)
+	require.NoError(t, err)
+
+	// Check that some known types are registered
+	tests := []struct {
+		gvk          schema.GroupVersionKind
+		expectedType runtime.Object
+	}{
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"},
+			expectedType: &corev1.Pod{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodList"},
+			expectedType: &corev1.PodList{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "metrics.k8s.io", Version: "v1beta1", Kind: "PodMetrics"},
+			expectedType: &metricsv1beta1.PodMetrics{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "metrics.k8s.io", Version: "v1beta1", Kind: "NodeMetrics"},
+			expectedType: &metricsv1beta1.NodeMetrics{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "metrics.k8s.io", Version: runtime.APIVersionInternal, Kind: "PodMetrics"},
+			expectedType: &metrics.PodMetrics{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "metrics.k8s.io", Version: runtime.APIVersionInternal, Kind: "NodeMetrics"},
+			expectedType: &metrics.NodeMetrics{},
+		},
+
+		// --- metav1 types ---
+		{
+			gvk:          schema.GroupVersionKind{Group: "meta.k8s.io", Version: "v1", Kind: "PartialObjectMetadata"},
+			expectedType: &metav1.PartialObjectMetadata{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "meta.k8s.io", Version: "v1", Kind: "PartialObjectMetadataList"},
+			expectedType: &metav1.PartialObjectMetadataList{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Status"},
+			expectedType: &metav1.Status{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "APIVersions"},
+			expectedType: &metav1.APIVersions{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "APIGroupList"},
+			expectedType: &metav1.APIGroupList{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "APIGroup"},
+			expectedType: &metav1.APIGroup{},
+		},
+		{
+			gvk:          schema.GroupVersionKind{Group: "", Version: "v1", Kind: "APIResourceList"},
+			expectedType: &metav1.APIResourceList{},
+		},
+	}
+
+	for _, testCase := range tests {
+		newType, err := scheme.New(testCase.gvk)
+		require.NoError(t, err, "expected type %v to be registered", testCase.gvk)
+		require.IsType(t, testCase.expectedType, newType, "expected type %v to be of type %T", testCase.gvk, testCase.expectedType)
+	}
+}
diff --git a/lib/kube/proxy/self_subject_reviews_test.go b/lib/kube/proxy/self_subject_reviews_test.go
index 64176ca491b04..2f417443950b3 100644
--- a/lib/kube/proxy/self_subject_reviews_test.go
+++ b/lib/kube/proxy/self_subject_reviews_test.go
@@ -431,3 +431,171 @@ func TestSelfSubjectAccessReviewsRBAC(t *testing.T) {
 		})
 	}
 }
+
+// TestSelfSubjectAccessReviewsAllowed tests that the SelfSubjectAccessReview
+// endpoint can be accessed even if not explicitly allowed by the role.
+func TestSelfSubjectAccessReviewsAllowed(t *testing.T) {
+	t.Parallel()
+
+	_, testCtx := newTestKubeCRDMock(t, testingkubemock.WithTeleportRoleCRD)
+
+	newTestUserV7 := newTestUserFactory(t, testCtx, "", types.V7)
+	newTestUserV8 := newTestUserFactory(t, testCtx, "", types.V8)
+
+	tests := []struct {
+		name    string
+		user    types.User
+		wantErr bool
+	}{
+		{
+			name:    "full default access v7",
+			user:    newTestUserV7(nil, nil),
+			wantErr: false,
+		},
+		{
+			name:    "full default access v8",
+			user:    newTestUserV8(nil, nil),
+			wantErr: false,
+		},
+		{
+			name: "namespace access v7",
+			user: newTestUserV7([]types.KubernetesResource{
+				{
+					Kind:  types.KindKubeNamespace,
+					Name:  "default",
+					Verbs: []string{types.Wildcard},
+				},
+			}, nil),
+			wantErr: false,
+		},
+		{
+			name: "wildcard namespace access v8",
+			user: newTestUserV8([]types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: "default",
+					Verbs:     []string{types.Wildcard},
+					APIGroup:  types.Wildcard,
+				},
+			}, nil),
+			wantErr: false,
+		},
+		{
+			name: "single pod access v7",
+			user: newTestUserV7([]types.KubernetesResource{
+				{
+					Kind:      types.KindKubePod,
+					Name:      "pod-1",
+					Namespace: "default",
+					Verbs:     []string{"get"},
+				},
+			}, nil),
+			wantErr: false,
+		},
+		{
+			name: "single pod access v8",
+			user: newTestUserV8([]types.KubernetesResource{
+				{
+					Kind:      "pods",
+					Name:      "pod-1",
+					Namespace: "default",
+					Verbs:     []string{"get"},
+					APIGroup:  "",
+				},
+			}, nil),
+			wantErr: false,
+		},
+		// NOTE: SelfSubjectAccessReview can't be explicitly denied in role v7.
+		{
+			name: "explicit deny v8",
+			user: newTestUserV8([]types.KubernetesResource{
+				{
+					Kind:      "pods",
+					Name:      "pod-1",
+					Namespace: "default",
+					Verbs:     []string{"get"},
+					APIGroup:  "",
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:     "selfsubjectaccessreviews",
+					Name:     types.Wildcard,
+					Verbs:    []string{"create"},
+					APIGroup: "authorization.k8s.io",
+				},
+			}),
+			wantErr: true,
+		},
+		{
+			name: "wildcard deny v7",
+			user: newTestUserV7([]types.KubernetesResource{
+				{
+					Kind:      types.KindKubePod,
+					Name:      "pod-1",
+					Namespace: "default",
+					Verbs:     []string{"get"},
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Verbs:     []string{types.Wildcard},
+				},
+			}),
+			wantErr: true,
+		},
+		{
+			name: "wildcard deny v8",
+			user: newTestUserV8([]types.KubernetesResource{
+				{
+					Kind:      "pods",
+					Name:      "pod-1",
+					Namespace: "default",
+					Verbs:     []string{"get"},
+					APIGroup:  "",
+				},
+			}, []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Verbs:     []string{types.Wildcard},
+					APIGroup:  types.Wildcard,
+				},
+			}),
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Generate a kube dynClient with user certs for auth.
+			client, _, _ := testCtx.GenTestKubeClientsTLSCert(t, tt.user.GetName(), kubeCluster)
+
+			// Create a SelfSubjectAccessReview object.
+			obj := &authv1.SelfSubjectAccessReview{
+				Spec: authv1.SelfSubjectAccessReviewSpec{
+					ResourceAttributes: &authv1.ResourceAttributes{
+						Resource: "nodes",
+						Verb:     "list",
+					},
+				},
+			}
+
+			// Call the SelfSubjectAccessReview endpoint.
+			_, err := client.AuthorizationV1().SelfSubjectAccessReviews().Create(
+				context.TODO(),
+				obj,
+				metav1.CreateOptions{},
+			)
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/lib/kube/proxy/server.go b/lib/kube/proxy/server.go
index 3c0b9a510e336..f72e95598003e 100644
--- a/lib/kube/proxy/server.go
+++ b/lib/kube/proxy/server.go
@@ -40,19 +40,23 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
+	"github.com/gravitational/teleport/lib/relaytunnel"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/srv/ingress"
 	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+	"github.com/gravitational/teleport/lib/utils/log"
 )
 
 // TLSServerConfig is a configuration for TLS server
@@ -71,15 +75,21 @@ type TLSServerConfig struct {
 	GetRotation services.RotationGetter
 	// ConnectedProxyGetter gets the proxies teleport is connected to.
 	ConnectedProxyGetter *reversetunnel.ConnectedProxyGetter
+	// RelayInfoGetter is the function used to get the relay tunnel client info
+	// to fill in the server heartbeats.
+	RelayInfoGetter relaytunnel.GetRelayInfoFunc
 	// Log is the logger.
 	Log *slog.Logger
 	// Selectors is a list of resource monitor selectors.
 	ResourceMatchers []services.ResourceMatcher
 	// OnReconcile is called after each kube_cluster resource reconciliation.
 	OnReconcile func(types.KubeClusters)
-	// CloudClients is a set of cloud clients that Teleport supports.
-	CloudClients cloud.Clients
-	awsClients   *awsClientsGetter
+	// azureClients provides Azure SDK clients
+	azureClients azure.Clients
+	// gcpClients provides GCP SDK clients
+	gcpClients gcp.Clients
+	// awsCloudClients provides AWS SDK clients.
+	awsClients *awsClientsGetter
 	// StaticLabels is a map of static labels associated with this service.
 	// Each cluster advertised by this kubernetes_service will include these static labels.
 	// If the service and a cluster define labels with the same key,
@@ -110,6 +120,8 @@ type TLSServerConfig struct {
 	PROXYProtocolMode multiplexer.PROXYProtocolMode
 	// InventoryHandle is used to send kube server heartbeats via the inventory control stream.
 	InventoryHandle inventory.DownstreamHandle
+	// HealthCheckManager manages checking the health of Kubernetes clusters.
+	HealthCheckManager healthcheck.Manager
 }
 
 type awsClientsGetter struct{}
@@ -141,6 +153,9 @@ func (c *TLSServerConfig) CheckAndSetDefaults() error {
 	if c.InventoryHandle == nil {
 		return trace.BadParameter("missing parameter InventoryHandle")
 	}
+	if c.HealthCheckManager == nil {
+		return trace.BadParameter("missing parameter HealthCheckManager")
+	}
 
 	if err := c.validateLabelKeys(); err != nil {
 		return trace.Wrap(err)
@@ -156,12 +171,15 @@ func (c *TLSServerConfig) CheckAndSetDefaults() error {
 	if c.Log == nil {
 		c.Log = slog.Default()
 	}
-	if c.CloudClients == nil {
-		cloudClients, err := cloud.NewClients()
+	if c.azureClients == nil {
+		azureClients, err := azure.NewClients()
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		c.CloudClients = cloudClients
+		c.azureClients = azureClients
+	}
+	if c.gcpClients == nil {
+		c.gcpClients = gcp.NewClients()
 	}
 	if c.awsClients == nil {
 		c.awsClients = &awsClientsGetter{}
@@ -375,6 +393,31 @@ func (t *TLSServer) Serve(listener net.Listener, options ...ServeOption) error {
 	t.kubeClusterWatcher = kubeClusterWatcher
 	t.mu.Unlock()
 
+	if t.OnHeartbeat != nil {
+		// Kube uses heartbeat v2, which heartbeats resources but not the server itself
+		// If there are no resources, we will never report ready.
+		// We work around by reporting ready after the first successful watcher init.
+		var watcherWaiters []func() error
+		if kubeClusterWatcher != nil {
+			watcherWaiters = append(watcherWaiters, kubeClusterWatcher.WaitInitialization)
+		}
+		if t.KubernetesServersWatcher != nil {
+			watcherWaiters = append(watcherWaiters, t.KubernetesServersWatcher.WaitInitialization)
+		}
+		if len(watcherWaiters) > 0 {
+			go func() {
+				for _, w := range watcherWaiters {
+					err := w()
+					if err != nil {
+						t.OnHeartbeat(err)
+						return
+					}
+				}
+				t.OnHeartbeat(nil)
+			}()
+		}
+	}
+
 	// kubeServerWatcher is used by the kube proxy to watch for changes in the
 	// kubernetes servers of a cluster. Proxy requires it to update the kubeServersMap
 	// which holds the list of kubernetes_services connected to the proxy for a given
@@ -411,7 +454,7 @@ func (t *TLSServer) Shutdown(ctx context.Context) error {
 func (t *TLSServer) close(ctx context.Context) error {
 	var errs []error
 	for _, kubeCluster := range t.fwd.kubeClusters() {
-		errs = append(errs, t.unregisterKubeCluster(ctx, kubeCluster.GetName()))
+		errs = append(errs, t.unregisterKubeCluster(ctx, kubeCluster, true))
 	}
 	errs = append(errs, t.fwd.Close(), t.Server.Close())
 
@@ -436,6 +479,9 @@ func (t *TLSServer) close(ctx context.Context) error {
 		listClose = t.listener.Close()
 	}
 	t.mu.Unlock()
+
+	errs = append(errs, t.gcpClients.Close())
+
 	return trace.NewAggregate(append(errs, listClose)...)
 }
 
@@ -472,27 +518,110 @@ func (t *TLSServer) GetServerInfo(name string) (*types.KubernetesServerV3, error
 		name += teleport.KubeLegacyProxySuffix
 	}
 
+	var relayGroup string
+	var relayIDs []string
+	if t.RelayInfoGetter != nil {
+		// relayInfoGetter returns a copy of the slice, so we can move it in the
+		// protobuf message
+		relayGroup, relayIDs = t.RelayInfoGetter()
+	}
 	srv, err := types.NewKubernetesServerV3(
 		types.Metadata{
 			Name:      name,
 			Namespace: t.Namespace,
 		},
 		types.KubernetesServerSpecV3{
-			Version:  teleport.Version,
-			Hostname: addr,
-			HostID:   t.TLSServerConfig.HostID,
-			Rotation: t.getRotationState(),
-			Cluster:  cluster,
-			ProxyIDs: t.ConnectedProxyGetter.GetProxyIDs(),
+			Version:    teleport.Version,
+			Hostname:   addr,
+			HostID:     t.TLSServerConfig.HostID,
+			Rotation:   t.getRotationState(),
+			Cluster:    cluster,
+			ProxyIDs:   t.ConnectedProxyGetter.GetProxyIDs(),
+			RelayGroup: relayGroup,
+			RelayIds:   relayIDs,
 		},
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	srv.SetExpiry(t.Clock.Now().UTC().Add(apidefaults.ServerAnnounceTTL))
+
+	// Get the kube cluster health and send it to the auth server.
+	srv.SetTargetHealth(t.getTargetHealth(t.closeContext, cluster))
+
 	return srv, nil
 }
 
+// startHealthCheck starts checking the health of a Kubernetes cluster.
+func (t *TLSServer) startHealthCheck(cluster types.KubeCluster) error {
+	kubeDetails, err := t.fwd.findKubeDetailsByClusterName(cluster.GetName())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	err = t.HealthCheckManager.AddTarget(healthcheck.Target{
+		HealthChecker: kubeDetails,
+		GetResource:   func() types.ResourceWithLabels { return cluster },
+	})
+	return trace.Wrap(err)
+}
+
+// stopHealthCheck stops checking the health of a Kubernetes cluster.
+func (t *TLSServer) stopHealthCheck(cluster types.KubeCluster) error {
+	if err := t.HealthCheckManager.RemoveTarget(cluster); err != nil && !trace.IsNotFound(err) {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// startHeartbeatAndHealthCheck starts heart beats and health checks.
+func (t *TLSServer) startHeartbeatAndHealthCheck(cluster types.KubeCluster) error {
+	if err := t.startHealthCheck(cluster); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := t.startHeartbeat(cluster.GetName()); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// stopHeartbeatAndHealthCheck stops heart beats and health checks.
+func (t *TLSServer) stopHeartbeatAndHealthCheck(cluster types.KubeCluster) error {
+	var errs []error
+	if err := t.stopHealthCheck(cluster); err != nil {
+		errs = append(errs, err)
+	}
+	if err := t.stopHeartbeat(cluster.GetName()); err != nil {
+		errs = append(errs, err)
+	}
+	return trace.NewAggregate(errs...)
+}
+
+// getTargetHealth returns the health of a Kubernetes cluster.
+func (t *TLSServer) getTargetHealth(ctx context.Context, cluster types.KubeCluster) *types.TargetHealth {
+	health, err := t.HealthCheckManager.GetTargetHealth(cluster)
+	if err == nil {
+		return health
+	}
+	if trace.IsNotFound(err) {
+		return &types.TargetHealth{
+			Status:           string(types.TargetHealthStatusUnknown),
+			TransitionReason: string(types.TargetHealthTransitionReasonDisabled),
+			Message:          "Unable to find the Kubernetes cluster",
+		}
+	}
+
+	t.log.WarnContext(ctx, "Failed to get kube cluster health",
+		"kube_cluster", log.StringerAttr(cluster),
+		"error", err,
+	)
+	return &types.TargetHealth{
+		Status:           string(types.TargetHealthStatusUnknown),
+		TransitionReason: string(types.TargetHealthTransitionReasonInternalError),
+		TransitionError:  err.Error(),
+		Message:          "Teleport failed to get the Kubernetes cluster health status (this is a bug)",
+	}
+}
+
 // getKubeClusterWithServiceLabels finds the kube cluster by name, strips the credentials,
 // replaces the cluster dynamic labels with their latest value available and updates
 // the cluster with the service dynamic and static labels.
@@ -559,14 +688,14 @@ func (t *TLSServer) startStaticClustersHeartbeat() error {
 	// proxy_service will pretend to also be kube_server.
 	if t.KubeServiceType == KubeService ||
 		t.KubeServiceType == LegacyProxyService {
-		t.log.DebugContext(t.closeContext, "Starting kubernetes_service heartbeats")
-		for _, cluster := range t.fwd.kubeClusters() {
-			if err := t.startHeartbeat(cluster.GetName()); err != nil {
+		t.log.DebugContext(t.closeContext, "Starting kubernetes_service heartbeats and health checks")
+		for _, kc := range t.fwd.kubeClusters() {
+			if err := t.startHeartbeatAndHealthCheck(kc); err != nil {
 				return trace.Wrap(err)
 			}
 		}
 	} else {
-		t.log.DebugContext(t.closeContext, "No local kube credentials on proxy, will not start kubernetes_service heartbeats")
+		t.log.DebugContext(t.closeContext, "No local kube credentials on proxy, will not start kubernetes_service heartbeats and health checks")
 	}
 
 	return nil
diff --git a/lib/kube/proxy/server_test.go b/lib/kube/proxy/server_test.go
index fc3e949e08b03..10889a6dd2bbc 100644
--- a/lib/kube/proxy/server_test.go
+++ b/lib/kube/proxy/server_test.go
@@ -41,10 +41,11 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestServeConfigureError(t *testing.T) {
@@ -113,7 +114,7 @@ func TestMTLSClientCAs(t *testing.T) {
 	userCert := genCert(t, "user")
 	srv := &TLSServer{
 		TLSServerConfig: TLSServerConfig{
-			Log: utils.NewSlogLoggerForTests(),
+			Log: logtest.NewLogger(),
 			ForwarderConfig: ForwarderConfig{
 				ClusterName: mainClusterName,
 			},
@@ -124,7 +125,7 @@ func TestMTLSClientCAs(t *testing.T) {
 			},
 			GetRotation: func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
 		},
-		log: utils.NewSlogLoggerForTests(),
+		log: logtest.NewLogger(),
 	}
 
 	lis, err := net.Listen("tcp", "localhost:0")
@@ -206,7 +207,7 @@ func TestGetServerInfo(t *testing.T) {
 
 	srv := &TLSServer{
 		TLSServerConfig: TLSServerConfig{
-			Log: utils.NewSlogLoggerForTests(),
+			Log: logtest.NewLogger(),
 			ForwarderConfig: ForwarderConfig{
 				Clock:       clockwork.NewFakeClock(),
 				ClusterName: "kube-cluster",
@@ -214,8 +215,9 @@ func TestGetServerInfo(t *testing.T) {
 			},
 			AccessPoint:          ap,
 			TLS:                  &tls.Config{},
-			ConnectedProxyGetter: reversetunnel.NewConnectedProxyGetter(),
 			GetRotation:          func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
+			ConnectedProxyGetter: reversetunnel.NewConnectedProxyGetter(),
+			HealthCheckManager:   &mockHealthCheckManager{},
 		},
 		fwd: &Forwarder{
 			cfg: ForwarderConfig{},
@@ -353,3 +355,13 @@ func TestTLSServerConfig_validateLabelsKey(t *testing.T) {
 		})
 	}
 }
+
+type mockHealthCheckManager struct{}
+
+func (m *mockHealthCheckManager) Start(ctx context.Context) error               { return nil }
+func (m *mockHealthCheckManager) AddTarget(target healthcheck.Target) error     { return nil }
+func (m *mockHealthCheckManager) RemoveTarget(r types.ResourceWithLabels) error { return nil }
+func (m *mockHealthCheckManager) GetTargetHealth(r types.ResourceWithLabels) (*types.TargetHealth, error) {
+	return nil, nil
+}
+func (m *mockHealthCheckManager) Close() error { return nil }
diff --git a/lib/kube/proxy/sess.go b/lib/kube/proxy/sess.go
index f3043d915f35d..03b5a1af5a771 100644
--- a/lib/kube/proxy/sess.go
+++ b/lib/kube/proxy/sess.go
@@ -48,10 +48,11 @@ import (
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/recorder"
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
+	"github.com/gravitational/teleport/lib/services"
 	tsession "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/utils"
@@ -387,7 +388,7 @@ type session struct {
 
 	tracker *srv.SessionTracker
 
-	accessEvaluator auth.SessionAccessEvaluator
+	accessEvaluator moderation.SessionAccessEvaluator
 
 	recorder events.SessionPreparerRecorder
 
@@ -452,13 +453,33 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 	}
 
 	q := req.URL.Query()
-	accessEvaluator := auth.NewSessionAccessEvaluator(policySets, types.KubernetesSessionKind, ctx.User.GetName())
+	accessEvaluator := moderation.NewSessionAccessEvaluator(policySets, types.KubernetesSessionKind, ctx.User.GetName())
 
 	io := srv.NewTermManager()
 	streamContext, streamContextCancel := context.WithCancel(forwarder.ctx)
 	namespace := params.ByName("podNamespace")
 	podName := params.ByName("podName")
 	container := q.Get("container")
+
+	recorder, err := recorder.New(recorder.Config{
+		SessionID:    tsession.ID(id.String()),
+		ServerID:     forwarder.cfg.HostID,
+		Namespace:    forwarder.cfg.Namespace,
+		Clock:        forwarder.cfg.Clock,
+		ClusterName:  forwarder.cfg.ClusterName,
+		RecordingCfg: ctx.recordingConfig,
+		SyncStreamer: forwarder.cfg.AuthClient,
+		DataDir:      forwarder.cfg.DataDir,
+		Component:    teleport.Component(teleport.ComponentSession, teleport.ComponentProxyKube),
+		// Session stream is using server context, not session context,
+		// to make sure that session is uploaded even after it is closed
+		Context: forwarder.ctx,
+	})
+	if err != nil {
+		streamContextCancel()
+		return nil, trace.Wrap(err)
+	}
+
 	s := &session{
 		podName:                        podName,
 		podNamespace:                   namespace,
@@ -488,12 +509,12 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 		partiesWg:                      sync.WaitGroup{},
 		// if session ever starts, emitter and recorder will be replaced
 		// by actual emitter and recorder.
-		emitter: events.NewDiscardEmitter(),
-		recorder: events.WithNoOpPreparer(
-			events.NewDiscardRecorder(),
-		),
+		emitter:  forwarder.cfg.Emitter,
+		recorder: recorder,
 	}
 
+	s.io.AddWriter(sessionRecorderID, recorder)
+
 	s.io.OnWriteError = s.disconnectPartyOnErr
 	s.io.OnReadError = s.disconnectPartyOnErr
 
@@ -519,14 +540,14 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 // It is used to properly handle client disconnections.
 func (s *session) disconnectPartyOnErr(idString string, err error) {
 	if idString == sessionRecorderID {
-		s.log.ErrorContext(s.sess.connCtx, "Failed to write to session recorder, closing session")
+		s.log.ErrorContext(s.sess.sessionCtx, "Failed to write to session recorder, closing session")
 		s.Close()
 		return
 	}
 
 	id, uuidParseErr := uuid.Parse(idString)
 	if uuidParseErr != nil {
-		s.log.ErrorContext(s.sess.connCtx, "Unable to decode party id",
+		s.log.ErrorContext(s.sess.sessionCtx, "Unable to decode party id",
 			"party_id", idString,
 			"error", uuidParseErr,
 		)
@@ -535,14 +556,14 @@ func (s *session) disconnectPartyOnErr(idString string, err error) {
 
 	wasActive, leaveErr := s.leave(id)
 	if leaveErr != nil {
-		s.log.ErrorContext(s.sess.connCtx, "Failed to disconnect party from the session",
+		s.log.ErrorContext(s.sess.sessionCtx, "Failed to disconnect party from the session",
 			"party_id", idString,
 			"error", leaveErr,
 		)
 	}
 	if wasActive {
 		// log the error only if it was the reason for the user disconnection.
-		s.log.ErrorContext(s.sess.connCtx, "Encountered error with party, disconnecting them from the session",
+		s.log.ErrorContext(s.sess.sessionCtx, "Encountered error with party, disconnecting them from the session",
 			"error", err,
 			"party_id", idString,
 		)
@@ -561,11 +582,11 @@ func (s *session) checkPresence() error {
 		}
 
 		if participant.Mode == string(types.SessionModeratorMode) && time.Now().UTC().After(participant.LastActive.Add(PresenceMaxDifference)) {
-			s.log.DebugContext(s.sess.connCtx, "Participant is not active, kicking", "participant_id", participant.ID)
+			s.log.DebugContext(s.sess.sessionCtx, "Participant is not active, kicking", "participant_id", participant.ID)
 			id, _ := uuid.Parse(participant.ID)
 			_, err := s.unlockedLeave(id)
 			if err != nil {
-				s.log.WarnContext(s.sess.connCtx, "Failed to kick participant for inactivity",
+				s.log.WarnContext(s.sess.sessionCtx, "Failed to kick participant for inactivity",
 					"participant_id", participant.ID,
 					"error", err,
 				)
@@ -761,7 +782,6 @@ func (s *session) lockedSetupLaunch(request *remoteCommandRequest, eventPodMeta
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	var err error
 	s.started = true
 	sessionStart := s.forwarder.cfg.Clock.Now().UTC()
 
@@ -919,29 +939,6 @@ func (s *session) lockedSetupLaunch(request *remoteCommandRequest, eventPodMeta
 		}
 	}
 
-	recorder, err := recorder.New(recorder.Config{
-		SessionID:    tsession.ID(s.id.String()),
-		ServerID:     s.forwarder.cfg.HostID,
-		Namespace:    s.forwarder.cfg.Namespace,
-		Clock:        s.forwarder.cfg.Clock,
-		ClusterName:  s.forwarder.cfg.ClusterName,
-		RecordingCfg: s.ctx.recordingConfig,
-		SyncStreamer: s.forwarder.cfg.AuthClient,
-		DataDir:      s.forwarder.cfg.DataDir,
-		Component:    teleport.Component(teleport.ComponentSession, teleport.ComponentProxyKube),
-		// Session stream is using server context, not session context,
-		// to make sure that session is uploaded even after it is closed
-		Context: s.forwarder.ctx,
-	})
-	if err != nil {
-		return onFinish, trace.Wrap(err)
-	}
-
-	s.recorder = recorder
-	s.emitter = s.forwarder.cfg.Emitter
-
-	s.io.AddWriter(sessionRecorderID, recorder)
-
 	// If the identity is verified with an MFA device, we enabled MFA-based presence for the session.
 	if s.PresenceEnabled {
 		s.weakEventsWaiter.Add(1)
@@ -975,7 +972,7 @@ func (s *session) join(p *party, emitJoinEvent bool) error {
 	if p.Ctx.User.GetName() != s.ctx.User.GetName() {
 		roles := p.Ctx.Checker.Roles()
 
-		accessContext := auth.SessionAccessContext{
+		accessContext := moderation.SessionAccessContext{
 			Username: p.Ctx.User.GetName(),
 			Roles:    roles,
 		}
@@ -993,7 +990,8 @@ func (s *session) join(p *party, emitJoinEvent bool) error {
 	s.log.DebugContext(s.forwarder.ctx, "Tracking participant", "participant_id", p.ID)
 	participant := &types.Participant{
 		ID:         p.ID.String(),
-		User:       p.Ctx.User.GetName(),
+		User:       p.Ctx.Identity.GetIdentity().Username,
+		Cluster:    p.Ctx.Identity.GetIdentity().OriginClusterName,
 		Mode:       string(p.Mode),
 		LastActive: time.Now().UTC(),
 	}
@@ -1204,9 +1202,23 @@ func (s *session) emitSessionJoinEvent(p *party) {
 			RemoteAddr: s.params.ByName("podName"),
 		},
 	}
+	s.prepareAndEmitEvent(sessionJoinEvent)
+}
+
+func (s *session) prepareAndEmitEvent(evt apievents.AuditEvent) {
+	preparedEvent, err := s.recorder.PrepareSessionEvent(evt)
+	if err == nil {
+		evt = preparedEvent.GetAuditEvent()
+		if err := s.recorder.RecordEvent(s.forwarder.ctx, preparedEvent); err != nil {
+			s.forwarder.log.WarnContext(s.forwarder.ctx, "Failed to record event", "error", err, "event_type", evt.GetType())
+		}
+	} else {
+		s.forwarder.log.WarnContext(s.forwarder.ctx, "Failed to prepare event - event will not be recorded into session recording.", "error", err, "event_type", evt.GetType())
+	}
 
-	if err := s.emitter.EmitAuditEvent(s.forwarder.ctx, sessionJoinEvent); err != nil {
-		s.forwarder.log.WarnContext(s.forwarder.ctx, "Failed to emit event", "error", err)
+	// Always emit the event to the audit log, even if preparing
+	if err := s.emitter.EmitAuditEvent(s.forwarder.ctx, evt); err != nil {
+		s.forwarder.log.WarnContext(s.forwarder.ctx, "Failed to emit event to Audit Log.", "error", err, "event_type", evt.GetType())
 	}
 }
 
@@ -1254,9 +1266,7 @@ func (s *session) unlockedLeave(id uuid.UUID) (bool, error) {
 		},
 	}
 
-	if err := s.emitter.EmitAuditEvent(s.forwarder.ctx, sessionLeaveEvent); err != nil {
-		s.forwarder.log.WarnContext(s.forwarder.ctx, "Failed to emit event", "error", err)
-	}
+	s.prepareAndEmitEvent(sessionLeaveEvent)
 
 	s.log.DebugContext(s.forwarder.ctx, "No longer tracking participant", "participant_id", party.ID)
 	err := s.tracker.RemoveParticipant(s.forwarder.ctx, party.ID.String())
@@ -1322,15 +1332,22 @@ func (s *session) unlockedLeave(id uuid.UUID) (bool, error) {
 func (s *session) allParticipants() []string {
 	var participants []string
 	for _, p := range s.partiesHistorical {
-		participants = append(participants, p.Ctx.User.GetName())
+		username := services.UsernameForCluster(
+			services.UsernameForClusterConfig{
+				User:              p.Ctx.Identity.GetIdentity().Username,
+				OriginClusterName: p.Ctx.Identity.GetIdentity().OriginClusterName,
+				LocalClusterName:  p.Ctx.Identity.GetIdentity().TeleportCluster,
+			},
+		)
+		participants = append(participants, username)
 	}
 
 	return participants
 }
 
 // canStart checks if a session can start with the current set of participants.
-func (s *session) canStart() (bool, auth.PolicyOptions, error) {
-	var participants []auth.SessionAccessContext
+func (s *session) canStart() (bool, moderation.PolicyOptions, error) {
+	var participants []moderation.SessionAccessContext
 	for _, party := range s.parties {
 		if party.Ctx.User.GetName() == s.ctx.User.GetName() {
 			continue
@@ -1339,10 +1356,10 @@ func (s *session) canStart() (bool, auth.PolicyOptions, error) {
 		roleNames := party.Ctx.Identity.GetIdentity().Groups
 		roles, err := getRolesByName(s.forwarder, roleNames)
 		if err != nil {
-			return false, auth.PolicyOptions{}, trace.Wrap(err)
+			return false, moderation.PolicyOptions{}, trace.Wrap(err)
 		}
 
-		participants = append(participants, auth.SessionAccessContext{
+		participants = append(participants, moderation.SessionAccessContext{
 			Username: party.Ctx.User.GetName(),
 			Roles:    roles,
 			Mode:     party.Mode,
@@ -1384,7 +1401,9 @@ func (s *session) Close() error {
 			// wait for events to be emitted before closing the recorder/emitter.
 			// If we close it immediately we will lose session.end events.
 			s.weakEventsWaiter.Wait()
-			recorder.Close(s.forwarder.ctx)
+			if err := recorder.Complete(s.forwarder.ctx); err != nil {
+				s.log.ErrorContext(s.forwarder.ctx, "Failed to complete session recorder", "error", err)
+			}
 		}
 	})
 
diff --git a/lib/kube/proxy/sess_test.go b/lib/kube/proxy/sess_test.go
index 2c87ec555845d..4ae8f3147b824 100644
--- a/lib/kube/proxy/sess_test.go
+++ b/lib/kube/proxy/sess_test.go
@@ -42,12 +42,12 @@ import (
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestSessionEndError(t *testing.T) {
@@ -283,7 +283,7 @@ func Test_session_trackSession(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			sess := &session{
-				log: utils.NewSlogLoggerForTests(),
+				log: logtest.NewLogger(),
 				id:  uuid.New(),
 				req: &http.Request{
 					URL: &url.URL{
@@ -292,7 +292,7 @@ func Test_session_trackSession(t *testing.T) {
 				},
 				podName:         "podName",
 				podNamespace:    "podNamespace",
-				accessEvaluator: auth.NewSessionAccessEvaluator(tt.args.policies, types.KubernetesSessionKind, "username"),
+				accessEvaluator: moderation.NewSessionAccessEvaluator(tt.args.policies, types.KubernetesSessionKind, "username"),
 				ctx: authContext{
 					Context: authz.Context{
 						User: &types.UserV2{
diff --git a/lib/kube/proxy/streamproto/proto.go b/lib/kube/proxy/streamproto/proto.go
index 75f12b15e8b22..00e9c54ea6083 100644
--- a/lib/kube/proxy/streamproto/proto.go
+++ b/lib/kube/proxy/streamproto/proto.go
@@ -74,7 +74,7 @@ type SessionStream struct {
 	writeSync   sync.Mutex
 	done        chan struct{}
 	closeOnce   sync.Once
-	closed      int32
+	closed      atomic.Bool
 	MFARequired bool
 	Mode        types.SessionParticipantMode
 	isClient    bool
@@ -215,7 +215,7 @@ func (s *SessionStream) readTask() {
 
 		if ty == websocket.CloseMessage {
 			s.conn.Close()
-			atomic.StoreInt32(&s.closed, 1)
+			s.closed.Store(true)
 			return
 		}
 	}
@@ -236,11 +236,7 @@ func (s *SessionStream) Read(p []byte) (int, error) {
 }
 
 func (s *SessionStream) Write(data []byte) (int, error) {
-	s.writeSync.Lock()
-	defer s.writeSync.Unlock()
-
-	err := s.conn.WriteMessage(websocket.BinaryMessage, data)
-	if err != nil {
+	if err := s.write(websocket.BinaryMessage, data); err != nil {
 		return 0, trace.Wrap(err)
 	}
 
@@ -255,9 +251,7 @@ func (s *SessionStream) Resize(size *remotecommand.TerminalSize) error {
 		return trace.Wrap(err)
 	}
 
-	s.writeSync.Lock()
-	defer s.writeSync.Unlock()
-	return trace.Wrap(s.conn.WriteMessage(websocket.TextMessage, json))
+	return trace.Wrap(s.write(websocket.TextMessage, json))
 }
 
 // ResizeQueue returns a channel that will receive resize requests.
@@ -278,32 +272,37 @@ func (s *SessionStream) ForceTerminate() error {
 		return trace.Wrap(err)
 	}
 
-	s.writeSync.Lock()
-	defer s.writeSync.Unlock()
-
-	return trace.Wrap(s.conn.WriteMessage(websocket.TextMessage, json))
+	return trace.Wrap(s.write(websocket.TextMessage, json))
 }
 
 func (s *SessionStream) Done() <-chan struct{} {
 	return s.done
 }
 
+func (s *SessionStream) write(messageType int, data []byte) error {
+	s.writeSync.Lock()
+	defer s.writeSync.Unlock()
+
+	return trace.Wrap(s.conn.WriteMessage(messageType, data))
+}
+
 // Close closes the stream.
 func (s *SessionStream) Close() error {
-	if atomic.CompareAndSwapInt32(&s.closed, 0, 1) {
-		err := s.conn.WriteMessage(websocket.CloseMessage, []byte{})
-		if err != nil {
-			slog.WarnContext(context.Background(), "Failed to gracefully close websocket connection", "error", err)
-		}
-		t := time.NewTimer(time.Second * 5)
-		defer t.Stop()
-		select {
-		case <-s.done:
-		case <-t.C:
-			s.conn.Close()
-		}
-		s.closeOnce.Do(func() { close(s.done) })
+	if !s.closed.CompareAndSwap(false, true) {
+		return nil
+	}
+
+	if err := s.write(websocket.CloseMessage, nil); err != nil {
+		slog.WarnContext(context.Background(), "Failed to gracefully close websocket connection", "error", err)
+	}
+
+	var err error
+	select {
+	case <-s.done:
+	case <-time.After(5 * time.Second):
+		err = s.conn.Close()
 	}
+	s.closeOnce.Do(func() { close(s.done) })
 
-	return nil
+	return trace.Wrap(err)
 }
diff --git a/lib/kube/proxy/testing/kube_server/data/api_authorization.k8s.io_v1.json b/lib/kube/proxy/testing/kube_server/data/api_authorization.k8s.io_v1.json
new file mode 100644
index 0000000000000..64d3e5d4cefe3
--- /dev/null
+++ b/lib/kube/proxy/testing/kube_server/data/api_authorization.k8s.io_v1.json
@@ -0,0 +1,43 @@
+{
+  "kind": "APIResourceList",
+  "apiVersion": "v1",
+  "groupVersion": "authorization.k8s.io/v1",
+  "resources": [
+    {
+      "name": "localsubjectaccessreviews",
+      "singularName": "localsubjectaccessreview",
+      "namespaced": true,
+      "kind": "LocalSubjectAccessReview",
+      "verbs": [
+        "create"
+      ]
+    },
+    {
+      "name": "selfsubjectaccessreviews",
+      "singularName": "selfsubjectaccessreview",
+      "namespaced": false,
+      "kind": "SelfSubjectAccessReview",
+      "verbs": [
+        "create"
+      ]
+    },
+    {
+      "name": "selfsubjectrulesreviews",
+      "singularName": "selfsubjectrulesreview",
+      "namespaced": false,
+      "kind": "SelfSubjectRulesReview",
+      "verbs": [
+        "create"
+      ]
+    },
+    {
+      "name": "subjectaccessreviews",
+      "singularName": "subjectaccessreview",
+      "namespaced": false,
+      "kind": "SubjectAccessReview",
+      "verbs": [
+        "create"
+      ]
+    }
+  ]
+}
diff --git a/lib/kube/proxy/testing/kube_server/discovery.go b/lib/kube/proxy/testing/kube_server/discovery.go
index 235a4f28a88c8..c7f35e29cb2e5 100644
--- a/lib/kube/proxy/testing/kube_server/discovery.go
+++ b/lib/kube/proxy/testing/kube_server/discovery.go
@@ -40,13 +40,16 @@ var (
 	apiV1Response string
 	//go:embed data/apis_rbac.authorization.k8s.io_v1.json
 	apiRBACV1Response string
+	//go:embed data/api_authorization.k8s.io_v1.json
+	apiAuthzV1Response string
 )
 
 const (
-	apiEndpoint     = "/api"
-	apiV1Endpoint   = "/api/v1"
-	apisEndpoint    = "/apis"
-	apiRBACEndpoint = "/apis/rbac.authorization.k8s.io/v1"
+	apiEndpoint      = "/api"
+	apiV1Endpoint    = "/api/v1"
+	apisEndpoint     = "/apis"
+	apiRBACEndpoint  = "/apis/rbac.authorization.k8s.io/v1"
+	apiAuthzEndpoint = "/apis/authorization.k8s.io/v1"
 )
 
 func (s *KubeMockServer) discoveryEndpoint(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
@@ -60,6 +63,9 @@ func (s *KubeMockServer) discoveryEndpoint(w http.ResponseWriter, req *http.Requ
 	case apiRBACEndpoint:
 		w.Write([]byte(apiRBACV1Response))
 		return nil, nil
+	case apiAuthzEndpoint:
+		w.Write([]byte(apiAuthzV1Response))
+		return nil, nil
 	case apisEndpoint:
 		w.Write(apisDiscovery(s.crds))
 		return nil, nil
@@ -111,6 +117,19 @@ func apisDiscovery(crds map[GVP]*CRD) []byte {
 					},
 				},
 			},
+			{
+				Name: "authorization.k8s.io",
+				PreferredVersion: version{
+					GroupVersion: "authorization.k8s.io/v1",
+					Version:      "v1",
+				},
+				Versions: []version{
+					{
+						GroupVersion: "authorization.k8s.io/v1",
+						Version:      "v1",
+					},
+				},
+			},
 		},
 	}
 
diff --git a/lib/kube/proxy/testing/kube_server/kube_mock.go b/lib/kube/proxy/testing/kube_server/kube_mock.go
index 7342f791b8e79..eeea083d4e248 100644
--- a/lib/kube/proxy/testing/kube_server/kube_mock.go
+++ b/lib/kube/proxy/testing/kube_server/kube_mock.go
@@ -40,6 +40,7 @@ import (
 	"github.com/julienschmidt/httprouter"
 	"golang.org/x/net/http2"
 	v1 "k8s.io/api/authorization/v1"
+	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -185,6 +186,8 @@ type KubeMockServer struct {
 	KubePortforward      KubeUpgradeRequests
 	supportsTunneledSPDY bool
 
+	nsList *corev1.NamespaceList
+
 	crds map[GVP]*CRD
 }
 
@@ -204,6 +207,7 @@ func NewKubeAPIMock(opts ...Option) (*KubeMockServer, error) {
 			Minor:      "20",
 			GitVersion: "1.20.0",
 		},
+		nsList: defaultNamespaceList.DeepCopy(),
 	}
 	for _, o := range opts {
 		o(s)
@@ -251,6 +255,7 @@ func (s *KubeMockServer) setup() {
 	router.Handle("GET /api/{ver}/namespaces", s.withWriter(s.listNamespaces))
 	router.Handle("GET /api/{ver}/namespaces/{name}", s.withWriter(s.getNamespace))
 	router.Handle("DELETE /api/v1/namespaces/{name}", s.withWriter(s.deleteNamespace))
+	router.Handle("POST /api/{ver}/namespaces", s.withWriter(s.createNamespace))
 
 	router.Handle("GET /api/{ver}/namespaces/{namespace}/secrets", s.withWriter(s.listSecrets))
 	router.Handle("GET /api/{ver}/secrets", s.withWriter(s.listSecrets))
@@ -258,6 +263,7 @@ func (s *KubeMockServer) setup() {
 	router.Handle("DELETE /api/{ver}/namespaces/{namespace}/secrets/{name}", s.withWriter(s.deleteSecret))
 
 	router.Handle("POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews", s.withWriter(s.selfSubjectAccessReviews))
+	router.Handle("GET /apis/authorization.k8s.io/{ver}", s.withWriter(s.discoveryEndpoint))
 
 	for k, crd := range s.crds {
 		router.Handle("GET /apis/"+k.group+"/"+k.version+"/namespaces/{namespace}/"+k.plural, s.withWriter(s.listCRDs(crd)))
@@ -387,14 +393,23 @@ func (s *KubeMockServer) exec(w http.ResponseWriter, req *http.Request, p httpro
 	}
 	defer proxy.Close()
 
+	var outStream, errStream io.Writer
+	if request.tty {
+		outStream = proxy.stdoutStream
+		errStream = proxy.stderrStream
+	} else {
+		outStream = bytes.NewBuffer(nil)
+		errStream = bytes.NewBuffer(nil)
+	}
+
 	if request.stdout {
-		if _, err := proxy.stdoutStream.Write([]byte(request.containerName + "\n")); err != nil {
+		if _, err := outStream.Write([]byte(request.containerName + "\n")); err != nil {
 			s.log.ErrorContext(request.context, "unable to send to stdout", "error", err)
 		}
 	}
 
 	if request.stderr {
-		if _, err := proxy.stderrStream.Write([]byte(request.containerName + "\n")); err != nil {
+		if _, err := errStream.Write([]byte(request.containerName + "\n")); err != nil {
 			s.log.ErrorContext(request.context, "unable to send to stderr", "error", err)
 		}
 	}
@@ -424,19 +439,26 @@ func (s *KubeMockServer) exec(w http.ResponseWriter, req *http.Request, p httpro
 			}
 
 			if request.stdout {
-				if _, err := proxy.stdoutStream.Write(buffer); err != nil {
+				if _, err := outStream.Write(buffer); err != nil {
 					s.log.ErrorContext(request.context, "unable to send to stdout", "error", err)
 				}
 			}
 
 			if request.stderr {
-				if _, err := proxy.stderrStream.Write(buffer); err != nil {
-					s.log.ErrorContext(request.context, "unable to send to stdout", "error", err)
+				if _, err := errStream.Write(buffer); err != nil {
+					s.log.ErrorContext(request.context, "unable to send to stderr", "error", err)
 				}
 			}
-
 		}
+	}
 
+	if !request.tty {
+		if _, err := io.Copy(proxy.stdoutStream, outStream.(*bytes.Buffer)); err != nil {
+			s.log.ErrorContext(request.context, "unable to copy to stdout", "error", err)
+		}
+		if _, err := io.Copy(proxy.stderrStream, errStream.(*bytes.Buffer)); err != nil {
+			s.log.ErrorContext(request.context, "unable to copy to stderr", "error", err)
+		}
 	}
 
 	return nil, nil
@@ -870,7 +892,6 @@ func (s *KubeMockServer) portforward(w http.ResponseWriter, req *http.Request, p
 		}
 		upgrader := spdystream.NewResponseUpgraderWithPings(defaults.HighResPollingPeriod)
 		conn = upgrader.UpgradeResponse(w, req, httpStreamReceived(req.Context(), streamChan))
-
 	}
 
 	if conn == nil {
@@ -878,36 +899,118 @@ func (s *KubeMockServer) portforward(w http.ResponseWriter, req *http.Request, p
 		return nil, err
 	}
 	defer conn.Close()
-	var (
-		data      httpstream.Stream
-		errStream httpstream.Stream
-	)
+
+	// Create a context for managing goroutines.
+	ctx, cancel := context.WithCancel(req.Context())
+	defer cancel()
+
+	// Wait for all active port forwards to complete before returning.
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	// Get pod name
+	podName := p.ByName("name")
+
+	type portStream struct {
+		data       httpstream.Stream
+		error      httpstream.Stream
+		processing bool // Prevent duplicate handlers
+	}
+
+	portStreams := make(map[string]*portStream)
+	var streamsMu sync.Mutex
 
 	for {
 		select {
+		case <-ctx.Done():
+			s.log.InfoContext(ctx, "Context canceled")
+			return nil, nil
 		case <-conn.CloseChan():
+			s.log.InfoContext(ctx, "Connection closed")
 			return nil, nil
 		case stream := <-streamChan:
+			port := stream.Headers().Get(portHeader)
+			if port == "" {
+				s.log.WarnContext(ctx, "Skipping a stream without a port header")
+				continue
+			}
+
+			streamsMu.Lock()
+			if _, ok := portStreams[port]; !ok {
+				portStreams[port] = &portStream{}
+			}
+
+			ps := portStreams[port]
+
 			switch stream.Headers().Get(StreamType) {
 			case StreamTypeError:
-				errStream = stream
+				ps.error = stream
 			case StreamTypeData:
-				data = stream
+				ps.data = stream
+			default:
+				s.log.WarnContext(ctx, "Unknown stream type", "type", stream.Headers().Get(StreamType))
 			}
-		}
-		if errStream != nil && data != nil {
-			break
+
+			// Check whether the port is ready to process.
+			if ps.data != nil && ps.error != nil && !ps.processing {
+				ps.processing = true
+
+				// Process each port.
+				// Use a separate goroutine with each port for concurrency testing.
+				wg.Add(1)
+				go s.handlePortForward(ctx, &wg, port, podName, ps.data, ps.error)
+			}
+
+			streamsMu.Unlock()
 		}
 	}
+}
+
+// handlePortForward reads and writes to a port-forward stream.
+func (s *KubeMockServer) handlePortForward(ctx context.Context, wg *sync.WaitGroup, port string, podName string, dataStream, errorStream httpstream.Stream) {
+	defer wg.Done()
+	defer errorStream.Close()
+
+	// Unblock stream read when the context cancels.
+	stop := context.AfterFunc(ctx, func() { dataStream.Close() })
+	defer func() {
+		// Ensure that dataStream closes only once.
+		// httpstream.Stream.Close is not idempotent.
+		// stop() is true when AfterFunc hasn't run.
+		if stop() {
+			dataStream.Close()
+		}
+	}()
 
+	// Read from source.
 	buf := make([]byte, 1024)
-	n, err := data.Read(buf)
-	if err != nil {
-		errStream.Write([]byte(err.Error()))
-		return nil, nil
+	n, readErr := dataStream.Read(buf)
+
+	// Process any data received, regardless of error.
+	// Behavior is based on the io.Reader contract.
+	// Handles the case where Read returns data and io.EOF.
+	if n > 0 {
+		// Write to target.
+		_, writeErr := fmt.Fprint(dataStream, PortForwardPayload, podName, string(buf[:n]))
+		if writeErr != nil {
+			s.log.ErrorContext(ctx, "Unable to write response", "error", writeErr)
+			if _, errWriteErr := errorStream.Write([]byte(writeErr.Error())); errWriteErr != nil {
+				s.log.ErrorContext(ctx, "Unable to write error", "error", errWriteErr)
+			}
+		}
+		return
 	}
-	fmt.Fprint(data, PortForwardPayload, p.ByName("name"), string(buf[:n]))
-	return nil, nil
+
+	// Check for read error.
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		s.log.ErrorContext(ctx, "Read error", "port", port, "error", readErr)
+		if _, writeErr := errorStream.Write([]byte(readErr.Error())); writeErr != nil {
+			s.log.ErrorContext(ctx, "Unable to write error", "error", writeErr)
+		}
+		return
+	}
+
+	s.log.InfoContext(ctx, "Port forward completed", "port", port)
 }
 
 // httpStreamReceived is the httpstream.NewStreamHandler for port
diff --git a/lib/kube/proxy/testing/kube_server/namespaces.go b/lib/kube/proxy/testing/kube_server/namespaces.go
index 69c00137eb5e1..28ecf43d41d4b 100644
--- a/lib/kube/proxy/testing/kube_server/namespaces.go
+++ b/lib/kube/proxy/testing/kube_server/namespaces.go
@@ -19,7 +19,9 @@
 package kubeserver
 
 import (
+	"io"
 	"net/http"
+	"slices"
 	"sort"
 
 	"github.com/gravitational/trace"
@@ -28,9 +30,10 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
 )
 
-var namespaceList = corev1.NamespaceList{
+var defaultNamespaceList = corev1.NamespaceList{
 	TypeMeta: metav1.TypeMeta{
 		Kind:       "NamespaceList",
 		APIVersion: "v1",
@@ -58,25 +61,105 @@ func newNamespace(name string) corev1.Namespace {
 	}
 }
 
-func (s *KubeMockServer) listNamespaces(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
-	list := namespaceList.DeepCopy()
+func (s *KubeMockServer) listNamespaces(
+	w http.ResponseWriter,
+	req *http.Request,
+	p httprouter.Params,
+) (any, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	list := s.nsList.DeepCopy()
 	return list, nil
 }
 
-func (s *KubeMockServer) getNamespace(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
+func (s *KubeMockServer) getNamespace(
+	w http.ResponseWriter,
+	req *http.Request,
+	p httprouter.Params,
+) (any, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	name := p.ByName("name")
-	filter := func(role corev1.Namespace) bool {
-		return role.Name == name
+	filter := func(ns corev1.Namespace) bool {
+		return ns.Name == name
 	}
-	for _, role := range namespaceList.Items {
-		if filter(role) {
-			return role, nil
+	for _, ns := range s.nsList.Items {
+		if filter(ns) {
+			return ns, nil
 		}
 	}
 	return nil, trace.NotFound("namespace %q not found", name)
 }
 
-func (s *KubeMockServer) deleteNamespace(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
+func parseNamespace(req *http.Request) (*corev1.Namespace, error) {
+	data, err := io.ReadAll(req.Body)
+	_ = req.Body.Close()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if len(data) == 0 {
+		return nil, trace.BadParameter("no body")
+	}
+	decoder, err := newDecoderForContentType(
+		req.Header.Get(responsewriters.ContentTypeHeader),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	into := corev1.Namespace{}
+	objI, _, err := decoder.Decode(data, nil /* defaults */, &into)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	obj, ok := objI.(*corev1.Namespace)
+	if !ok {
+		return nil, trace.BadParameter(
+			"expected *corev1.Namespace, got %T", objI,
+		)
+	}
+	return obj, nil
+}
+
+func (s *KubeMockServer) createNamespace(
+	w http.ResponseWriter,
+	req *http.Request,
+	p httprouter.Params,
+) (any, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	ns, err := parseNamespace(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if ns.Name == "" {
+		return nil, trace.BadParameter("namespace name is required")
+	}
+
+	if slices.ContainsFunc(s.nsList.Items, func(existing corev1.Namespace) bool {
+		return existing.Name == ns.Name
+	}) {
+		return nil, trace.AlreadyExists(
+			"namespace %q already exists", ns.Name,
+		)
+	}
+
+	ns.ResourceVersion = "1"
+	s.nsList.Items = append(s.nsList.Items, *ns)
+	return &ns, nil
+}
+
+func (s *KubeMockServer) deleteNamespace(
+	w http.ResponseWriter,
+	req *http.Request,
+	p httprouter.Params,
+) (any, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	name := p.ByName("name")
 
 	deleteOpts, err := parseDeleteCollectionBody(req)
@@ -87,21 +170,26 @@ func (s *KubeMockServer) deleteNamespace(w http.ResponseWriter, req *http.Reques
 	if deleteOpts.Preconditions != nil && deleteOpts.Preconditions.UID != nil {
 		reqID = string(*deleteOpts.Preconditions.UID)
 	}
-	filter := func(role corev1.Namespace) bool {
-		return role.Name == name
+	filter := func(ns corev1.Namespace) bool {
+		return ns.Name == name
 	}
-	for _, role := range namespaceList.Items {
-		if filter(role) {
-			s.mu.Lock()
+	for i, ns := range s.nsList.Items {
+		if filter(ns) {
 			key := deletedResource{reqID, types.KindKubeNamespace}
 			s.deletedResources[key] = append(s.deletedResources[key], name)
-			s.mu.Unlock()
-			return role, nil
+			s.nsList.Items = slices.Delete(s.nsList.Items, i, i+1)
+			return ns, nil
 		}
 	}
 	return nil, trace.NotFound("namespace %q not found", name)
 }
 
+func (s *KubeMockServer) ListNamespaces() *corev1.NamespaceList {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.nsList.DeepCopy()
+}
+
 func (s *KubeMockServer) Deletednamespaces(reqID string) []string {
 	s.mu.Lock()
 	key := deletedResource{reqID, types.KindKubeNamespace}
diff --git a/lib/kube/proxy/transport.go b/lib/kube/proxy/transport.go
index 5f334af09a052..dee8783317e12 100644
--- a/lib/kube/proxy/transport.go
+++ b/lib/kube/proxy/transport.go
@@ -35,9 +35,10 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/kube/internal"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -178,7 +179,7 @@ func (f *Forwarder) newRemoteClusterTransport(clusterName string) (http.RoundTri
 
 	return instrumentedRoundtripper(
 		f.cfg.KubeServiceType,
-		auth.NewImpersonatorRoundTripper(h2Transport),
+		internal.NewImpersonatorRoundTripper(h2Transport),
 	), tlsConfig.Clone(), nil
 }
 
@@ -234,7 +235,7 @@ func (f *Forwarder) remoteClusterDialer(clusterName string) dialContextFunc {
 		)
 		defer span.End()
 
-		targetCluster, err := f.cfg.ReverseTunnelSrv.GetSite(clusterName)
+		targetCluster, err := f.cfg.ReverseTunnelSrv.Cluster(ctx, clusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -279,7 +280,7 @@ func (f *Forwarder) newLocalClusterTransport(kubeClusterName string) (http.Round
 
 	return instrumentedRoundtripper(
 		f.cfg.KubeServiceType,
-		auth.NewImpersonatorRoundTripper(h2Transport),
+		internal.NewImpersonatorRoundTripper(h2Transport),
 	), tlsConfig.Clone(), nil
 }
 
@@ -309,7 +310,7 @@ func (f *Forwarder) localClusterDialer(kubeClusterName string, opts ...contextDi
 		// Use the local reversetunnel.Site which knows how to dial by serverID
 		// (for "kubernetes_service" connected over a tunnel) and falls back to
 		// direct dial if needed.
-		localCluster, err := f.cfg.ReverseTunnelSrv.GetSite(f.cfg.ClusterName)
+		localCluster, err := f.cfg.ReverseTunnelSrv.Cluster(ctx, f.cfg.ClusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -319,19 +320,21 @@ func (f *Forwarder) localClusterDialer(kubeClusterName string, opts ...contextDi
 			return nil, trace.Wrap(err)
 		}
 
+		// Dial kube servers in the order of health status healthy, unknown, and unhealthy.
+		// Each health group is shuffled to distribute load.
+		// Unknown servers and unhealthy servers are still dialed
+		// in case health status changed since last check.
 		var errs []error
-		// Shuffle the list of servers to avoid always connecting to the same
-		// server.
-		for _, s := range utils.ShuffleVisit(kubeServers) {
+		for server := range healthcheck.OrderByTargetHealthStatus(kubeServers) {
 			// Validate that the requested kube cluster is registered.
-			kubeCluster := s.GetCluster()
-			if kubeCluster.GetName() != kubeClusterName || !opt.matches(s.GetHostID()) {
+			if server.GetCluster().GetName() != kubeClusterName || !opt.matches(server.GetHostID()) {
 				continue
 			}
+
 			// serverID is a unique identifier of the server in the cluster.
 			// It is a combination of the server's hostname and the cluster name.
 			// <host_id>.<cluster_name>
-			serverID := fmt.Sprintf("%s.%s", s.GetHostID(), f.cfg.ClusterName)
+			serverID := server.GetHostID() + "." + f.cfg.ClusterName
 			conn, err := localCluster.DialTCP(reversetunnelclient.DialParams{
 				// Send a sentinel value to the remote cluster because this connection
 				// will be used to forward multiple requests to the remote cluster from
@@ -339,18 +342,17 @@ func (f *Forwarder) localClusterDialer(kubeClusterName string, opts ...contextDi
 				// IP Pinning is based on the source IP address of the connection that
 				// we transport over HTTP headers so it's not affected.
 				From:     &utils.NetAddr{AddrNetwork: "tcp", Addr: "0.0.0.0:0"},
-				To:       &utils.NetAddr{AddrNetwork: "tcp", Addr: s.GetHostname()},
+				To:       &utils.NetAddr{AddrNetwork: "tcp", Addr: server.GetHostname()},
 				ConnType: types.KubeTunnel,
 				ServerID: serverID,
-				ProxyIDs: s.GetProxyIDs(),
+				ProxyIDs: server.GetProxyIDs(),
 			})
 			if err == nil {
-				opt.collect(s.GetHostID())
+				opt.collect(server.GetHostID())
 				return conn, nil
 			}
-			errs = append(errs, trace.Wrap(err))
+			errs = append(errs, err)
 		}
-
 		if len(errs) > 0 {
 			return nil, trace.NewAggregate(errs...)
 		}
diff --git a/lib/kube/proxy/transport_test.go b/lib/kube/proxy/transport_test.go
index 2f057a74a263a..eb78522b1b4c2 100644
--- a/lib/kube/proxy/transport_test.go
+++ b/lib/kube/proxy/transport_test.go
@@ -21,10 +21,14 @@ package proxy
 import (
 	"context"
 	"crypto/tls"
-	"fmt"
+	"errors"
+	"math"
 	"net"
+	"slices"
+	"strings"
 	"testing"
 
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
@@ -41,6 +45,7 @@ func TestForwarderClusterDialer(t *testing.T) {
 		hostId      = "hostId"
 		proxyIds    = []string{"proxyId"}
 		clusterName = "cluster"
+		health      = types.TargetHealthStatusHealthy
 	)
 	f := &Forwarder{
 		cfg: ForwarderConfig{
@@ -49,7 +54,7 @@ func TestForwarderClusterDialer(t *testing.T) {
 		},
 		getKubernetesServersForKubeCluster: func(_ context.Context, kubeClusterName string) ([]types.KubeServer, error) {
 			return []types.KubeServer{
-				newKubeServerWithProxyIDs(t, hostname, hostId, proxyIds),
+				newKubeServer(t, hostname, hostId, proxyIds, health),
 			}, nil
 		},
 	}
@@ -72,7 +77,7 @@ func TestForwarderClusterDialer(t *testing.T) {
 					Addr:        hostname,
 					AddrNetwork: "tcp",
 				},
-				ServerID: fmt.Sprintf("%s.%s", hostId, clusterName),
+				ServerID: hostId + "." + clusterName,
 				ConnType: types.KubeTunnel,
 				ProxyIDs: proxyIds,
 			},
@@ -110,7 +115,7 @@ type fakeReverseTunnel struct {
 	t    *testing.T
 }
 
-func (f *fakeReverseTunnel) GetSite(_ string) (reversetunnelclient.RemoteSite, error) {
+func (f *fakeReverseTunnel) Cluster(context.Context, string) (reversetunnelclient.Cluster, error) {
 	return &fakeRemoteSiteTunnel{
 		want: f.want,
 		t:    f.t,
@@ -118,7 +123,7 @@ func (f *fakeReverseTunnel) GetSite(_ string) (reversetunnelclient.RemoteSite, e
 }
 
 type fakeRemoteSiteTunnel struct {
-	reversetunnelclient.RemoteSite
+	reversetunnelclient.Cluster
 	want reversetunnelclient.DialParams
 	t    *testing.T
 }
@@ -128,7 +133,7 @@ func (f *fakeRemoteSiteTunnel) DialTCP(p reversetunnelclient.DialParams) (net.Co
 	return nil, nil
 }
 
-func newKubeServerWithProxyIDs(t *testing.T, hostname, hostID string, proxyIds []string) types.KubeServer {
+func newKubeServer(t *testing.T, hostname, hostID string, proxyIds []string, health types.TargetHealthStatus) types.KubeServer {
 	k, err := types.NewKubernetesClusterV3(types.Metadata{
 		Name: "cluster",
 	}, types.KubernetesClusterSpecV3{})
@@ -137,6 +142,11 @@ func newKubeServerWithProxyIDs(t *testing.T, hostname, hostID string, proxyIds [
 	ks, err := types.NewKubernetesServerV3FromCluster(k, hostname, hostID)
 	require.NoError(t, err)
 	ks.Spec.ProxyIDs = proxyIds
+	ks.Status = &types.KubernetesServerStatusV3{
+		TargetHealth: &types.TargetHealth{
+			Status: string(health),
+		},
+	}
 	return ks
 }
 
@@ -181,3 +191,167 @@ func TestDirectTransportNotCached(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "example.com", tlsConfig.ServerName)
 }
+
+func TestLocalClusterDialsByHealth(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	const (
+		hostname    = "localhost:8080"
+		clusterName = "cluster"
+	)
+	proxyIds := []string{"proxyId"}
+	tests := []struct {
+		name    string
+		servers []types.KubeServer
+	}{
+		{
+			name: "one",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "healthy-1", proxyIds, types.TargetHealthStatusHealthy),
+			},
+		},
+		{
+			name: "healthy",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "healthy-1", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-2", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-3", proxyIds, types.TargetHealthStatusHealthy),
+			},
+		},
+		{
+			name: "unknown",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "unknown-1", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-2", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-3", proxyIds, types.TargetHealthStatusUnknown),
+			},
+		},
+		{
+			name: "unhealthy",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "unhealthy-1", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-2", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-3", proxyIds, types.TargetHealthStatusUnhealthy),
+			},
+		},
+		{
+			name: "random",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "unhealthy-1", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "healthy-3", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "unknown-2", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "healthy-2", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "unknown-1", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unhealthy-3", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unknown-3", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unhealthy-2", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "healthy-1", proxyIds, types.TargetHealthStatusHealthy),
+			},
+		},
+		{
+			name: "reversed",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "unhealthy-3", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-2", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-1", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unknown-3", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-2", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-1", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "healthy-3", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-2", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-1", proxyIds, types.TargetHealthStatusHealthy),
+			},
+		},
+		{
+			name: "sorted",
+			servers: []types.KubeServer{
+				newKubeServer(t, hostname, "healthy-1", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-2", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "healthy-3", proxyIds, types.TargetHealthStatusHealthy),
+				newKubeServer(t, hostname, "unknown-1", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-2", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unknown-3", proxyIds, types.TargetHealthStatusUnknown),
+				newKubeServer(t, hostname, "unhealthy-1", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-2", proxyIds, types.TargetHealthStatusUnhealthy),
+				newKubeServer(t, hostname, "unhealthy-3", proxyIds, types.TargetHealthStatusUnhealthy),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := &Forwarder{
+				cfg: ForwarderConfig{
+					tracer:           otel.Tracer("test"),
+					ClusterName:      clusterName,
+					ReverseTunnelSrv: healthReverseTunnel{},
+				},
+				getKubernetesServersForKubeCluster: func(context.Context, string) ([]types.KubeServer, error) {
+					return tt.servers, nil
+				},
+			}
+			_, err := f.localClusterDialer(clusterName)(ctx, "tcp", "")
+			require.Error(t, err)
+
+			var aggErr trace.Aggregate
+			require.ErrorAs(t, err, &aggErr, "expected an aggregate error")
+			var healthErrs []healthError
+			for _, e := range aggErr.Errors() {
+				var he healthError
+				if errors.As(e, &he) {
+					healthErrs = append(healthErrs, he)
+				}
+			}
+
+			require.Len(t, healthErrs, len(tt.servers))
+			require.True(t, slices.IsSortedFunc(healthErrs, byHealthOrder),
+				"expected dialed errors to be order by healthy, unknown, and unhealthy")
+		})
+	}
+}
+
+type healthReverseTunnel struct {
+	reversetunnelclient.Server
+}
+
+func (f healthReverseTunnel) Cluster(context.Context, string) (reversetunnelclient.Cluster, error) {
+	return &healthRemoteSiteTunnel{}, nil
+}
+
+type healthRemoteSiteTunnel struct {
+	reversetunnelclient.Cluster
+}
+
+func (f healthRemoteSiteTunnel) DialTCP(p reversetunnelclient.DialParams) (net.Conn, error) {
+	// Extract health from ServerID.
+	// ServerID = <health>-<n>.<clusterName>
+	idx := strings.Index(p.ServerID, "-")
+	if idx < 0 {
+		return nil, trace.BadParameter("invalid server ID: %q", p.ServerID)
+	}
+	return nil, healthError{health: types.TargetHealthStatus(p.ServerID[:idx])}
+}
+
+type healthError struct {
+	health types.TargetHealthStatus
+}
+
+func (e healthError) Error() string {
+	return string(e.health)
+}
+
+func healthOrder(e healthError) int {
+	switch e.health {
+	case types.TargetHealthStatusHealthy:
+		return 0
+	case types.TargetHealthStatusUnknown:
+		return 1
+	case types.TargetHealthStatusUnhealthy:
+		return 2
+	}
+	return math.MaxInt
+}
+
+func byHealthOrder(a, b healthError) int {
+	return healthOrder(a) - healthOrder(b)
+}
diff --git a/lib/kube/proxy/url.go b/lib/kube/proxy/url.go
index 75aab4a1ec23a..bbb8a1b6090f1 100644
--- a/lib/kube/proxy/url.go
+++ b/lib/kube/proxy/url.go
@@ -40,14 +40,14 @@ type metaResource struct {
 	resourceDefinition *metav1.APIResource // Resource definition data from the schema.
 	requestedResource  apiResource         // User input, based on URL.
 	verb               string              // Verb of the user request.
-	isClusterWide      bool                // TODO(@creack): Remove this in favor of resourceDefinition.Namespaced.
+	isList             bool
 }
 
 func (mr *metaResource) isClusterWideResource() bool {
 	if mr == nil {
 		return false
 	}
-	return mr.isClusterWide || (mr.resourceDefinition != nil && !mr.resourceDefinition.Namespaced)
+	return mr.resourceDefinition != nil && !mr.resourceDefinition.Namespaced
 }
 
 func (mr *metaResource) rbacResource() *types.KubernetesResource {
@@ -237,11 +237,12 @@ func getResourceFromRequest(req *http.Request, kubeDetails *kubeDetails) (metaRe
 		// If the resource is not supported, return nil.
 		return out, nil
 	}
-	out.isClusterWide = !resource.Namespaced
+	out.resourceDefinition = &resource
 
 	if apiResource.resourceName == "" && out.verb != types.KubeVerbCreate {
 		// if the resource is supported but the resource name is not present and not a create request,
 		// return nil because it's a list request.
+		out.isList = true
 		return out, nil
 	}
 
@@ -254,7 +255,6 @@ func getResourceFromRequest(req *http.Request, kubeDetails *kubeDetails) (metaRe
 		apiResource.resourceName = resourceName
 		out.requestedResource = apiResource
 	}
-	out.resourceDefinition = &resource
 
 	return out, nil
 }
diff --git a/lib/kube/proxy/url_test.go b/lib/kube/proxy/url_test.go
index 519cf3d1cf6bb..ddda5d6dc81ed 100644
--- a/lib/kube/proxy/url_test.go
+++ b/lib/kube/proxy/url_test.go
@@ -133,20 +133,20 @@ func Test_getResourceFromRequest(t *testing.T) {
 		{path: "/apis/apps/", want: nil},
 		{path: "/apis/apps/v1", want: nil},
 		{path: "/apis/apps/v1/", want: nil},
-		{path: "/api/v1/pods", want: nil},
-		{path: "/api/v1/watch/pods", want: nil},
+		{path: "/api/v1/pods", want: &types.KubernetesResource{Kind: "pods", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/watch/pods", want: &types.KubernetesResource{Kind: "pods", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/kube-system", want: &types.KubernetesResource{Kind: "namespaces", Name: "kube-system", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/kube-system", want: &types.KubernetesResource{Kind: "namespaces", Name: "kube-system", Verbs: []string{"watch"}, APIGroup: ""}},
-		{path: "/api/v1/namespaces/kube-system/pods", want: nil},
-		{path: "/api/v1/watch/namespaces/kube-system/pods", want: nil},
+		{path: "/api/v1/namespaces/kube-system/pods", want: &types.KubernetesResource{Kind: "pods", Namespace: "kube-system", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods", want: &types.KubernetesResource{Kind: "pods", Namespace: "kube-system", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/kube-system/pods/foo", want: &types.KubernetesResource{Kind: "pods", Namespace: "kube-system", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/kube-system/pods/foo", want: &types.KubernetesResource{Kind: "pods", Namespace: "kube-system", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/apis/apiregistration.k8s.io/v1/apiservices/foo/status", want: nil},
 
 		// core
 		// Pods
-		{path: "/api/v1/pods", want: nil},
-		{path: "/api/v1/namespaces/default/pods", want: nil},
+		{path: "/api/v1/pods", want: &types.KubernetesResource{Kind: "pods", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/pods", want: &types.KubernetesResource{Kind: "pods", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/pods/foo", want: &types.KubernetesResource{Kind: "pods", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/pods/foo", want: &types.KubernetesResource{Kind: "pods", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/kube-system/pods/foo/exec", want: &types.KubernetesResource{Kind: "pods", Namespace: "kube-system", Name: "foo", Verbs: []string{"exec"}, APIGroup: ""}},
@@ -156,58 +156,58 @@ func Test_getResourceFromRequest(t *testing.T) {
 		{path: "/api/v1/namespaces/default/pods", body: bodyFuncWithoutGVK(), want: &types.KubernetesResource{Kind: "pods", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 
 		// Secrets
-		{path: "/api/v1/secrets", want: nil},
-		{path: "/api/v1/namespaces/default/secrets", want: nil},
+		{path: "/api/v1/secrets", want: &types.KubernetesResource{Kind: "secrets", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/secrets", want: &types.KubernetesResource{Kind: "secrets", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/secrets/foo", want: &types.KubernetesResource{Kind: "secrets", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/secrets/foo", want: &types.KubernetesResource{Kind: "secrets", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/secrets", body: bodyFunc("Secret", "v1"), want: &types.KubernetesResource{Kind: "secrets", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/secrets", body: bodyFuncWithoutGVK(), want: &types.KubernetesResource{Kind: "secrets", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 
 		// Configmaps
-		{path: "/api/v1/configmaps", want: nil},
-		{path: "/api/v1/namespaces/default/configmaps", want: nil},
+		{path: "/api/v1/configmaps", want: &types.KubernetesResource{Kind: "configmaps", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/configmaps", want: &types.KubernetesResource{Kind: "configmaps", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/configmaps/foo", want: &types.KubernetesResource{Kind: "configmaps", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/configmaps/foo", want: &types.KubernetesResource{Kind: "configmaps", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/configmaps", body: bodyFunc("ConfigMap", "v1"), want: &types.KubernetesResource{Kind: "configmaps", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/configmaps", body: bodyFuncWithoutGVK(), want: &types.KubernetesResource{Kind: "configmaps", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 
 		// Namespaces
-		{path: "/api/v1/namespaces", want: nil},
+		{path: "/api/v1/namespaces", want: &types.KubernetesResource{Kind: "namespaces", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default", want: &types.KubernetesResource{Kind: "namespaces", Name: "default", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default", want: &types.KubernetesResource{Kind: "namespaces", Name: "default", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces", body: bodyFunc("Namespace", "v1"), want: &types.KubernetesResource{Kind: "namespaces", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces", body: bodyFuncWithoutGVK(), want: &types.KubernetesResource{Kind: "namespaces", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 
 		// Nodes
-		{path: "/api/v1/nodes", want: nil},
+		{path: "/api/v1/nodes", want: &types.KubernetesResource{Kind: "nodes", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/nodes/foo/proxy/bar", want: &types.KubernetesResource{Kind: "nodes", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		// Services
-		{path: "/api/v1/services", want: nil},
-		{path: "/api/v1/namespaces/default/services", want: nil},
+		{path: "/api/v1/services", want: &types.KubernetesResource{Kind: "services", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/services", want: &types.KubernetesResource{Kind: "services", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/services/foo", want: &types.KubernetesResource{Kind: "services", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/services/foo", want: &types.KubernetesResource{Kind: "services", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/services", body: bodyFunc("Service", "v1"), want: &types.KubernetesResource{Kind: "services", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: ""}},
 
 		// ServiceAccounts
-		{path: "/api/v1/serviceaccounts", want: nil},
-		{path: "/api/v1/namespaces/default/serviceaccounts", want: nil},
+		{path: "/api/v1/serviceaccounts", want: &types.KubernetesResource{Kind: "serviceaccounts", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/serviceaccounts", want: &types.KubernetesResource{Kind: "serviceaccounts", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/serviceaccounts/foo", want: &types.KubernetesResource{Kind: "serviceaccounts", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/serviceaccounts/foo", want: &types.KubernetesResource{Kind: "serviceaccounts", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		// PersistentVolumes
-		{path: "/api/v1/persistentvolumes", want: nil},
-		{path: "/api/v1/namespaces/default/persistentvolumes", want: nil},
+		{path: "/api/v1/persistentvolumes", want: &types.KubernetesResource{Kind: "persistentvolumes", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/persistentvolumes", want: &types.KubernetesResource{Kind: "persistentvolumes", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/persistentvolumes/foo", want: &types.KubernetesResource{Kind: "persistentvolumes", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/persistentvolumes/foo", want: &types.KubernetesResource{Kind: "persistentvolumes", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 		// PersistentVolumeClaims
-		{path: "/api/v1/persistentvolumeclaims", want: nil},
-		{path: "/api/v1/namespaces/default/persistentvolumeclaims", want: nil},
+		{path: "/api/v1/persistentvolumeclaims", want: &types.KubernetesResource{Kind: "persistentvolumeclaims", Verbs: []string{"list"}, APIGroup: ""}},
+		{path: "/api/v1/namespaces/default/persistentvolumeclaims", want: &types.KubernetesResource{Kind: "persistentvolumeclaims", Namespace: "default", Verbs: []string{"list"}, APIGroup: ""}},
 		{path: "/api/v1/namespaces/default/persistentvolumeclaims/foo", want: &types.KubernetesResource{Kind: "persistentvolumeclaims", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: ""}},
 		{path: "/api/v1/watch/namespaces/default/persistentvolumeclaims/foo", want: &types.KubernetesResource{Kind: "persistentvolumeclaims", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: ""}},
 
 		// apis/apps
 		// Deployments
-		{path: "/apis/apps/v1/deployments", want: nil},
-		{path: "/apis/apps/v1/namespaces/default/deployments", want: nil},
+		{path: "/apis/apps/v1/deployments", want: &types.KubernetesResource{Kind: "deployments", Verbs: []string{"list"}, APIGroup: "apps"}},
+		{path: "/apis/apps/v1/namespaces/default/deployments", want: &types.KubernetesResource{Kind: "deployments", Namespace: "default", Verbs: []string{"list"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/namespaces/default/deployments/foo", want: &types.KubernetesResource{Kind: "deployments", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/watch/namespaces/default/deployments/foo", want: &types.KubernetesResource{Kind: "deployments", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/namespaces/default/deployments", body: bodyFunc("Deployment", "apps/v1"), want: &types.KubernetesResource{Kind: "deployments", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: "apps"}},
@@ -215,39 +215,39 @@ func Test_getResourceFromRequest(t *testing.T) {
 		{path: "/apis/apps/v1/namespaces/default/deployments", body: bodyFuncWithoutGVK(), want: &types.KubernetesResource{Kind: "deployments", Namespace: "default", Name: "foo-create", Verbs: []string{"create"}, APIGroup: "apps"}},
 
 		// Statefulsets
-		{path: "/apis/apps/v1/statefulsets", want: nil},
-		{path: "/apis/apps/v1/namespaces/default/statefulsets", want: nil},
+		{path: "/apis/apps/v1/statefulsets", want: &types.KubernetesResource{Kind: "statefulsets", Verbs: []string{"list"}, APIGroup: "apps"}},
+		{path: "/apis/apps/v1/namespaces/default/statefulsets", want: &types.KubernetesResource{Kind: "statefulsets", Namespace: "default", Verbs: []string{"list"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/namespaces/default/statefulsets/foo", want: &types.KubernetesResource{Kind: "statefulsets", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/watch/namespaces/default/statefulsets/foo", want: &types.KubernetesResource{Kind: "statefulsets", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "apps"}},
 		// Replicasets
-		{path: "/apis/apps/v1/replicasets", want: nil},
-		{path: "/apis/apps/v1/namespaces/default/replicasets", want: nil},
+		{path: "/apis/apps/v1/replicasets", want: &types.KubernetesResource{Kind: "replicasets", Verbs: []string{"list"}, APIGroup: "apps"}},
+		{path: "/apis/apps/v1/namespaces/default/replicasets", want: &types.KubernetesResource{Kind: "replicasets", Namespace: "default", Verbs: []string{"list"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/namespaces/default/replicasets/foo", want: &types.KubernetesResource{Kind: "replicasets", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/watch/namespaces/default/replicasets/foo", want: &types.KubernetesResource{Kind: "replicasets", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "apps"}},
 		// Daemonsets
-		{path: "/apis/apps/v1/daemonsets", want: nil},
-		{path: "/apis/apps/v1/namespaces/default/daemonsets", want: nil},
+		{path: "/apis/apps/v1/daemonsets", want: &types.KubernetesResource{Kind: "daemonsets", Verbs: []string{"list"}, APIGroup: "apps"}},
+		{path: "/apis/apps/v1/namespaces/default/daemonsets", want: &types.KubernetesResource{Kind: "daemonsets", Namespace: "default", Verbs: []string{"list"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/namespaces/default/daemonsets/foo", want: &types.KubernetesResource{Kind: "daemonsets", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "apps"}},
 		{path: "/apis/apps/v1/watch/namespaces/default/daemonsets/foo", want: &types.KubernetesResource{Kind: "daemonsets", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "apps"}},
 
 		// apis/batch
 		// Job
-		{path: "/apis/batch/v1/jobs", want: nil},
-		{path: "/apis/batch/v1/namespaces/default/jobs", want: nil},
+		{path: "/apis/batch/v1/jobs", want: &types.KubernetesResource{Kind: "jobs", Verbs: []string{"list"}, APIGroup: "batch"}},
+		{path: "/apis/batch/v1/namespaces/default/jobs", want: &types.KubernetesResource{Kind: "jobs", Namespace: "default", Verbs: []string{"list"}, APIGroup: "batch"}},
 		{path: "/apis/batch/v1/namespaces/default/jobs/foo", want: &types.KubernetesResource{Kind: "jobs", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "batch"}},
 		{path: "/apis/batch/v1/watch/namespaces/default/jobs/foo", want: &types.KubernetesResource{Kind: "jobs", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "batch"}},
 		// CronJob
-		{path: "/apis/batch/v1/cronjobs", want: nil},
-		{path: "/apis/batch/v1/namespaces/default/cronjobs", want: nil},
+		{path: "/apis/batch/v1/cronjobs", want: &types.KubernetesResource{Kind: "cronjobs", Verbs: []string{"list"}, APIGroup: "batch"}},
+		{path: "/apis/batch/v1/namespaces/default/cronjobs", want: &types.KubernetesResource{Kind: "cronjobs", Namespace: "default", Verbs: []string{"list"}, APIGroup: "batch"}},
 		{path: "/apis/batch/v1/namespaces/default/cronjobs/foo", want: &types.KubernetesResource{Kind: "cronjobs", Namespace: "default", Name: "foo", Verbs: []string{"get"}, APIGroup: "batch"}},
 		{path: "/apis/batch/v1/watch/namespaces/default/cronjobs/foo", want: &types.KubernetesResource{Kind: "cronjobs", Namespace: "default", Name: "foo", Verbs: []string{"watch"}, APIGroup: "batch"}},
 
 		// apis/certificates.k8s.io
-		{path: "/apis/certificates.k8s.io/v1/certificatesigningrequests", want: nil},
+		{path: "/apis/certificates.k8s.io/v1/certificatesigningrequests", want: &types.KubernetesResource{Kind: "certificatesigningrequests", Verbs: []string{"list"}, APIGroup: "certificates.k8s.io"}},
 		{path: "/apis/certificates.k8s.io/v1/certificatesigningrequests/foo", want: &types.KubernetesResource{Kind: "certificatesigningrequests", Name: "foo", Verbs: []string{"get"}, APIGroup: "certificates.k8s.io"}},
 
 		// apis/networking.k8s.io
-		{path: "/apis/networking.k8s.io/v1/ingresses", want: nil},
+		{path: "/apis/networking.k8s.io/v1/ingresses", want: &types.KubernetesResource{Kind: "ingresses", Verbs: []string{"list"}, APIGroup: "networking.k8s.io"}},
 		{path: "/apis/networking.k8s.io/v1/ingresses/foo", want: &types.KubernetesResource{Kind: "ingresses", Name: "foo", Verbs: []string{"get"}, APIGroup: "networking.k8s.io"}},
 	}
 
diff --git a/lib/kube/proxy/utils_test.go b/lib/kube/proxy/utils_test.go
index 651b875f29c3d..2cfbbca7c5711 100644
--- a/lib/kube/proxy/utils_test.go
+++ b/lib/kube/proxy/utils_test.go
@@ -53,11 +53,13 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/keygen"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
 	"github.com/gravitational/teleport/lib/limiter"
@@ -66,27 +68,27 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	sessPkg "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type TestContext struct {
-	HostID               string
-	ClusterName          string
-	TLSServer            *auth.TestTLSServer
-	AuthServer           *auth.Server
-	AuthClient           *authclient.Client
-	Authz                authz.Authorizer
-	KubeServer           *TLSServer
-	KubeProxy            *TLSServer
-	Emitter              *eventstest.ChannelEmitter
-	Context              context.Context
-	kubeServerListener   net.Listener
-	kubeProxyListener    net.Listener
-	cancel               context.CancelFunc
-	heartbeatCtx         context.Context
-	heartbeatCancel      context.CancelFunc
-	lockWatcher          *services.LockWatcher
-	closeSessionTrackers chan struct{}
+	HostID             string
+	ClusterName        string
+	TLSServer          *authtest.TLSServer
+	AuthServer         *auth.Server
+	AuthClient         *authclient.Client
+	Authz              authz.Authorizer
+	KubeServer         *TLSServer
+	KubeProxy          *TLSServer
+	Emitter            *eventstest.ChannelEmitter
+	Context            context.Context
+	UploadHandler      *eventstest.MemoryUploader
+	kubeServerListener net.Listener
+	kubeProxyListener  net.Listener
+	cancel             context.CancelFunc
+	heartbeatCtx       context.Context
+	heartbeatCancel    context.CancelFunc
+	lockWatcher        *services.LockWatcher
 }
 
 // KubeClusterConfig defines the cluster to be created
@@ -105,6 +107,7 @@ type TestConfig struct {
 	OnEvent              func(apievents.AuditEvent)
 	ClusterFeatures      func() proto.Features
 	CreateAuditStreamErr error
+	WrapAuthClient       func(authclient.ClientI) authclient.ClientI
 }
 
 // SetupTestContext creates a kube service with clusters configured.
@@ -112,23 +115,32 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	ctx, cancel := context.WithCancel(ctx)
 	heartbeatCtx, heartbeatCancel := context.WithCancel(ctx)
 	testCtx := &TestContext{
-		ClusterName:          "root.example.com",
-		HostID:               uuid.New().String(),
-		Context:              ctx,
-		cancel:               cancel,
-		heartbeatCtx:         heartbeatCtx,
-		heartbeatCancel:      heartbeatCancel,
-		closeSessionTrackers: make(chan struct{}),
+		ClusterName:     "root.example.com",
+		HostID:          uuid.New().String(),
+		Context:         ctx,
+		cancel:          cancel,
+		heartbeatCtx:    heartbeatCtx,
+		heartbeatCancel: heartbeatCancel,
+		UploadHandler:   eventstest.NewMemoryUploader(),
 	}
 	t.Cleanup(func() { testCtx.Close() })
 
 	kubeConfigLocation := newKubeConfigFile(t, cfg.Clusters...)
 
+	streamer, err := events.NewProtoStreamer(
+		events.ProtoStreamerConfig{
+			Uploader: testCtx.UploadHandler,
+		},
+	)
+	require.NoError(t, err)
+
 	// Create and start test auth server.
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
-		Clock:       clockwork.NewFakeClockAt(time.Now()),
-		ClusterName: testCtx.ClusterName,
-		Dir:         t.TempDir(),
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		Clock:         clockwork.NewFakeClockAt(time.Now()),
+		ClusterName:   testCtx.ClusterName,
+		Streamer:      streamer,
+		UploadHandler: testCtx.UploadHandler,
+		Dir:           t.TempDir(),
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
@@ -141,7 +153,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		// the LockWatcher to hit the connection rate limit and fail with an error
 		// different from the expected one. We setup a custom rate limiter to avoid
 		// this issue.
-		auth.WithLimiterConfig(
+		authtest.WithLimiterConfig(
 			&limiter.Config{
 				MaxConnections: 100000,
 			},
@@ -162,12 +174,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	require.NoError(t, err)
 
 	// Auth client for Kube service.
-	testCtx.AuthClient, err = testCtx.TLSServer.NewClient(auth.TestServerID(types.RoleKube, testCtx.HostID))
+	testCtx.AuthClient, err = testCtx.TLSServer.NewClient(authtest.TestServerID(types.RoleKube, testCtx.HostID))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, testCtx.AuthClient.Close()) })
 
 	// Auth client, lock watcher and authorizer for Kube proxy.
-	proxyAuthClient, err := testCtx.TLSServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := testCtx.TLSServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
@@ -189,7 +201,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	require.NoError(t, err)
 
 	// TLS config for kube proxy and Kube service.
-	serverIdentity, err := auth.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleKube)
+	serverIdentity, err := authtest.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleKube)
 	require.NoError(t, err)
 	kubeServiceTLSConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -240,6 +252,24 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
 
+	healthCheckManager, err := healthcheck.NewManager(
+		testCtx.Context,
+		healthcheck.ManagerConfig{
+			Component:               teleport.ComponentKube,
+			Events:                  client,
+			HealthCheckConfigReader: client,
+		},
+	)
+	require.NoError(t, err)
+	err = healthCheckManager.Start(testCtx.Context)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, healthCheckManager.Close()) })
+
+	var authClient authclient.ClientI = client
+	if cfg.WrapAuthClient != nil {
+		authClient = cfg.WrapAuthClient(client)
+	}
+
 	// Create kubernetes service server.
 	testCtx.KubeServer, err = NewTLSServer(TLSServerConfig{
 		ForwarderConfig: ForwarderConfig{
@@ -253,7 +283,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 			// directly to AuthClient solves the issue.
 			// We wrap the AuthClient with an events.TeeStreamer to send non-disk
 			// events like session.end to testCtx.emitter as well.
-			AuthClient: &fakeClient{ClientI: client, closeC: testCtx.closeSessionTrackers},
+			AuthClient: authClient,
 			// StreamEmitter is required although not used because we are using
 			// "node-sync" as session recording mode.
 			Emitter:           testCtx.Emitter,
@@ -281,12 +311,13 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		// each time heartbeat is called we insert data into the channel.
 		// this is used to make sure that heartbeat started and the clusters
 		// are registered in the auth server
-		OnHeartbeat:      func(err error) {},
-		GetRotation:      func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
-		ResourceMatchers: cfg.ResourceMatchers,
-		OnReconcile:      cfg.OnReconcile,
-		Log:              utils.NewSlogLoggerForTests(),
-		InventoryHandle:  inventoryHandle,
+		OnHeartbeat:        func(err error) {},
+		GetRotation:        func(role types.SystemRole) (*types.Rotation, error) { return &types.Rotation{}, nil },
+		ResourceMatchers:   cfg.ResourceMatchers,
+		OnReconcile:        cfg.OnReconcile,
+		Log:                logtest.NewLogger(),
+		InventoryHandle:    inventoryHandle,
+		HealthCheckManager: healthCheckManager,
 	})
 	require.NoError(t, err)
 
@@ -305,7 +336,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	t.Cleanup(kubeServersWatcher.Close)
 
 	// TLS config for kube proxy and Kube service.
-	proxyServerIdentity, err := auth.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleProxy)
+	proxyServerIdentity, err := authtest.NewServerIdentity(authServer.AuthServer, testCtx.HostID, types.RoleProxy)
 	require.NoError(t, err)
 	proxyTLSConfig, err := proxyServerIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -316,9 +347,9 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	testCtx.KubeProxy, err = NewTLSServer(TLSServerConfig{
 		ForwarderConfig: ForwarderConfig{
 			ReverseTunnelSrv: &reversetunnelclient.FakeServer{
-				Sites: []reversetunnelclient.RemoteSite{
-					&fakeRemoteSite{
-						FakeRemoteSite: reversetunnelclient.NewFakeRemoteSite(testCtx.ClusterName, client),
+				FakeClusters: []reversetunnelclient.Cluster{
+					&fakeCluster{
+						FakeCluster: reversetunnelclient.NewFakeCluster(testCtx.ClusterName, client),
 						idToAddr: map[string]string{
 							testCtx.HostID: testCtx.kubeServerListener.Addr().String(),
 						},
@@ -335,7 +366,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 			// directly to AuthClient solves the issue.
 			// We wrap the AuthClient with an events.TeeStreamer to send non-disk
 			// events like session.end to testCtx.emitter as well.
-			AuthClient: &fakeClient{ClientI: client, closeC: testCtx.closeSessionTrackers},
+			AuthClient: authClient,
 			// StreamEmitter is required although not used because we are using
 			// "node-sync" as session recording mode.
 			Emitter:           testCtx.Emitter,
@@ -362,11 +393,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		LimiterConfig: limiter.Config{
 			MaxConnections: 1000,
 		},
-		Log:             utils.NewSlogLoggerForTests(),
+		Log:             logtest.NewLogger(),
 		InventoryHandle: inventoryHandle,
 		GetRotation: func(role types.SystemRole) (*types.Rotation, error) {
 			return &types.Rotation{}, nil
 		},
+		HealthCheckManager: healthCheckManager,
 	})
 	require.NoError(t, err)
 	require.Equal(t, testCtx.KubeServer.Server.ReadTimeout, time.Duration(0), "kube server write timeout must be 0")
@@ -404,7 +436,7 @@ func (c *TestContext) startKubeServices(t *testing.T) {
 	go func() {
 		err := c.KubeServer.Serve(c.kubeServerListener)
 		// ignore server closed error returned when .Close is called.
-		if errors.Is(err, http.ErrServerClosed) {
+		if errors.Is(err, http.ErrServerClosed) || errors.Is(err, net.ErrClosed) {
 			return
 		}
 		assert.NoError(t, err)
@@ -413,7 +445,7 @@ func (c *TestContext) startKubeServices(t *testing.T) {
 	go func() {
 		err := c.KubeProxy.Serve(c.kubeProxyListener)
 		// ignore server closed error returned when .Close is called.
-		if errors.Is(err, http.ErrServerClosed) {
+		if errors.Is(err, http.ErrServerClosed) || errors.Is(err, net.ErrClosed) {
 			return
 		}
 		assert.NoError(t, err)
@@ -455,15 +487,15 @@ func (c *TestContext) CreateUserWithTraitsAndRole(ctx context.Context, t *testin
 }
 
 func (c *TestContext) CreateUserWithTraitsAndRoleVersion(ctx context.Context, t *testing.T, username string, userTraits map[string][]string, roleVersion string, roleSpec RoleSpec) (types.User, types.Role) {
-	user, role, err := auth.CreateUserAndRole(
+	user, role, err := authtest.CreateUserAndRole(
 		c.TLSServer.Auth(),
 		username,
 		[]string{roleSpec.Name},
 		nil,
-		auth.WithUserMutator(func(user types.User) {
+		authtest.WithUserMutator(func(user types.User) {
 			user.SetTraits(userTraits)
 		}),
-		auth.WithRoleVersion(roleVersion),
+		authtest.WithRoleVersion(roleVersion),
 	)
 	require.NoError(t, err)
 	role.SetKubeUsers(types.Allow, roleSpec.KubeUsers)
@@ -684,14 +716,14 @@ func (f *fakeClient) CreateSessionTracker(ctx context.Context, st types.SessionT
 	}
 }
 
-// fakeRemoteSite is a fake remote site that uses a map to map server IDs to
+// fakeCluster is a fake cluster that uses a map to map server IDs to
 // addresses to simulate reverse tunneling.
-type fakeRemoteSite struct {
-	*reversetunnelclient.FakeRemoteSite
+type fakeCluster struct {
+	*reversetunnelclient.FakeCluster
 	idToAddr map[string]string
 }
 
-func (f *fakeRemoteSite) DialTCP(p reversetunnelclient.DialParams) (conn net.Conn, err error) {
+func (f *fakeCluster) DialTCP(p reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	// The server ID is the first part of the address.
 	addr, ok := f.idToAddr[strings.Split(p.ServerID, ".")[0]]
 	if !ok {
diff --git a/lib/kube/proxy/watcher.go b/lib/kube/proxy/watcher.go
index 0c8587ff6e0d9..368d0860671c4 100644
--- a/lib/kube/proxy/watcher.go
+++ b/lib/kube/proxy/watcher.go
@@ -139,7 +139,7 @@ func (s *TLSServer) onUpdate(ctx context.Context, cluster, _ types.KubeCluster)
 }
 
 func (s *TLSServer) onDelete(ctx context.Context, cluster types.KubeCluster) error {
-	return s.unregisterKubeCluster(ctx, cluster.GetName())
+	return s.unregisterKubeCluster(ctx, cluster, false)
 }
 
 func (s *TLSServer) matcher(cluster types.KubeCluster) bool {
@@ -174,7 +174,8 @@ func (m *monitoredKubeClusters) get() map[string]types.KubeCluster {
 
 func (s *TLSServer) buildClusterDetailsConfigForCluster(cluster types.KubeCluster) clusterDetailsConfig {
 	return clusterDetailsConfig{
-		cloudClients:     s.CloudClients,
+		azureClients:     s.azureClients,
+		gcpClients:       s.gcpClients,
 		awsCloudClients:  s.awsClients,
 		cluster:          cluster,
 		log:              s.log,
@@ -194,7 +195,7 @@ func (s *TLSServer) registerKubeCluster(ctx context.Context, cluster types.KubeC
 		return trace.Wrap(err)
 	}
 	s.fwd.upsertKubeDetails(cluster.GetName(), clusterDetails)
-	return trace.Wrap(s.startHeartbeat(cluster.GetName()))
+	return trace.Wrap(s.startHeartbeatAndHealthCheck(cluster))
 }
 
 func (s *TLSServer) updateKubeCluster(ctx context.Context, cluster types.KubeCluster) error {
@@ -212,29 +213,32 @@ func (s *TLSServer) updateKubeCluster(ctx context.Context, cluster types.KubeClu
 // unregisterKubeCluster unregisters the proxied Kube Cluster from the agent.
 // This function is called when the dynamic cluster is deleted/no longer match
 // the agent's resource matcher or when the agent is shutting down.
-func (s *TLSServer) unregisterKubeCluster(ctx context.Context, name string) error {
+func (s *TLSServer) unregisterKubeCluster(ctx context.Context, cluster types.KubeCluster, isShutdown bool) error {
 	var errs []error
 
-	errs = append(errs, s.stopHeartbeat(name))
-	s.fwd.removeKubeDetails(name)
+	if err := s.stopHeartbeatAndHealthCheck(cluster); err != nil {
+		errs = append(errs, err)
+	}
+	clusterName := cluster.GetName()
+	s.fwd.removeKubeDetails(clusterName)
 
-	shouldDeleteCluster := services.ShouldDeleteServerHeartbeatsOnShutdown(ctx)
+	// A child process can be forked to upgrade the Teleport binary. The child
+	// will take over the heartbeats so do NOT delete them in that case.
+	shouldDeleteOnShutdown := services.ShouldDeleteServerHeartbeatsOnShutdown(ctx)
 	sender, ok := s.TLSServerConfig.InventoryHandle.GetSender()
 	if ok {
 		// Manual deletion per cluster is only required if the auth server
 		// doesn't support actively cleaning up database resources when the
 		// inventory control stream is terminated during shutdown.
 		if capabilities := sender.Hello().Capabilities; capabilities != nil {
-			shouldDeleteCluster = shouldDeleteCluster && !capabilities.KubernetesCleanup
+			shouldDeleteOnShutdown = shouldDeleteOnShutdown && !capabilities.KubernetesCleanup
 		}
 	}
 
-	// A child process can be forked to upgrade the Teleport binary. The child
-	// will take over the heartbeats so do NOT delete them in that case.
-	// When unregistering a dynamic cluster, the context is empty and the
-	// decision will be to delete the kubernetes server.
-	if shouldDeleteCluster {
-		errs = append(errs, s.deleteKubernetesServer(ctx, name))
+	if !isShutdown || shouldDeleteOnShutdown {
+		if err := s.deleteKubernetesServer(ctx, clusterName); err != nil {
+			errs = append(errs, err)
+		}
 	}
 
 	// close active sessions before returning.
@@ -244,9 +248,11 @@ func (s *TLSServer) unregisterKubeCluster(ctx context.Context, name string) erro
 	s.fwd.mu.Unlock()
 	// close active sessions
 	for _, sess := range sessions {
-		if sess.ctx.kubeClusterName == name {
+		if sess.ctx.kubeClusterName == clusterName {
 			// TODO(tigrato): check if we should send errors to each client
-			errs = append(errs, sess.Close())
+			if err := sess.Close(); err != nil {
+				errs = append(errs, err)
+			}
 		}
 	}
 
diff --git a/lib/kube/proxy/watcher_test.go b/lib/kube/proxy/watcher_test.go
index f666f7906d879..5c6619f13ed0d 100644
--- a/lib/kube/proxy/watcher_test.go
+++ b/lib/kube/proxy/watcher_test.go
@@ -20,6 +20,7 @@ package proxy
 
 import (
 	"context"
+	"fmt"
 	"maps"
 	"sort"
 	"strings"
@@ -33,10 +34,31 @@ import (
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/services"
 )
 
+type mockAuthClient struct {
+	authclient.ClientI
+	deleteCh chan string
+}
+
+func newMockAuthClient() *mockAuthClient {
+	return &mockAuthClient{
+		deleteCh: make(chan string, 1),
+	}
+}
+
+func (m *mockAuthClient) DeleteKubernetesServer(ctx context.Context, hostID, name string) error {
+	select {
+	case m.deleteCh <- name:
+	case <-time.After(5 * time.Second):
+		return fmt.Errorf("failed to signal kube server deletion")
+	}
+	return m.ClientI.DeleteKubernetesServer(ctx, hostID, name)
+}
+
 // TestWatcher verifies that kubernetes agent properly detects and applies
 // changes to kube_cluster resources.
 func TestWatcher(t *testing.T) {
@@ -47,6 +69,8 @@ func TestWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 	reconcileCh := make(chan types.KubeClusters)
+
+	authClient := newMockAuthClient()
 	// Setup kubernetes server that proxies one static kube cluster and
 	// watches for kube_clusters with label group=a.
 	testCtx := SetupTestContext(ctx, t, TestConfig{
@@ -63,6 +87,10 @@ func TestWatcher(t *testing.T) {
 				return
 			}
 		},
+		WrapAuthClient: func(client authclient.ClientI) authclient.ClientI {
+			authClient.ClientI = client
+			return authClient
+		},
 	})
 
 	require.Len(t, testCtx.KubeServer.fwd.kubeClusters(), 1)
@@ -180,6 +208,12 @@ func TestWatcher(t *testing.T) {
 	case <-time.After(time.Second):
 		t.Fatal("Didn't receive reconcile event after 1s.")
 	}
+	select {
+	case deleted := <-authClient.deleteCh:
+		require.Equal(t, kube1.GetName(), deleted)
+	case <-time.After(time.Second):
+		t.Fatal("Kube server wasn't deleted after 1s.")
+	}
 
 	// Remove kube2.
 	err = testCtx.AuthServer.DeleteKubernetesCluster(ctx, kube2.GetName())
@@ -194,6 +228,12 @@ func TestWatcher(t *testing.T) {
 	case <-time.After(time.Second):
 		t.Fatal("Didn't receive reconcile event after 1s.")
 	}
+	select {
+	case deleted := <-authClient.deleteCh:
+		require.Equal(t, kube2.GetName(), deleted)
+	case <-time.After(time.Second):
+		t.Fatal("Kube server wasn't deleted after 1s.")
+	}
 }
 
 func makeDynamicKubeCluster(t *testing.T, name, url string, labels map[string]string) (*types.KubernetesClusterV3, error) {
diff --git a/lib/kube/relay/hash.go b/lib/kube/relay/hash.go
new file mode 100644
index 0000000000000..0fe13033bbd1f
--- /dev/null
+++ b/lib/kube/relay/hash.go
@@ -0,0 +1,61 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relay
+
+import (
+	"crypto/sha256"
+	"encoding/base32"
+)
+
+// base32hex is the "Extended Hex Alphabet" defined in RFC 4648 but with
+// lowercase letters and no padding.
+var base32hex = base32.NewEncoding("0123456789abcdefghijklmnopqrstuv").WithPadding(base32.NoPadding)
+
+const (
+	hashLen = sha256.Size
+	// encodedHashLen is the length of the base32 encoding of [hashLen] bytes,
+	// without padding.
+	encodedHashLen = hashLen/5*8 + (hashLen%5*8+4)/5
+)
+
+func hashForTarget(teleportClusterName, kubeClusterName string) [hashLen]byte {
+	h := sha256.New()
+	var buf [hashLen]byte
+	buf = sha256.Sum256([]byte(teleportClusterName))
+	h.Write(buf[:])
+	buf = sha256.Sum256([]byte(kubeClusterName))
+	h.Write(buf[:])
+	h.Sum(buf[:0])
+	return buf
+}
+
+// SNILabelForKubeCluster returns the domain label used in front of [SNISuffix]
+// to identify a Kubernetes cluster as the target for a passively routed Relay
+// connection. It consists of [SNIPrefixForKubeCluster] ("cluster-") followed by
+// the base32hex encoding of the SHA256 hash of Teleport cluster name and
+// Kubernetes cluster name, for a total of 60 ASCII lowercase characters.
+func SNILabelForKubeCluster(teleportClusterName, kubeClusterName string) string {
+	h := hashForTarget(teleportClusterName, kubeClusterName)
+	return SNIPrefixForKubeCluster + base32hex.EncodeToString(h[:])
+}
+
+// FullSNIForKubeCluster returns the full server name used to identify a
+// Kubernetes cluster as the target for a passively routed Relay connection,
+// i.e. the same value as [SNILabelForKubeCluster] followed by [SNISuffix].
+func FullSNIForKubeCluster(teleportClusterName, kubeClusterName string) string {
+	return SNILabelForKubeCluster(teleportClusterName, kubeClusterName) + SNISuffix
+}
diff --git a/lib/kube/relay/hash_test.go b/lib/kube/relay/hash_test.go
new file mode 100644
index 0000000000000..cd101e380a2ce
--- /dev/null
+++ b/lib/kube/relay/hash_test.go
@@ -0,0 +1,69 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relay
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncodedHashLen(t *testing.T) {
+	//nolint:staticcheck // the explicit type in the declaration is the entire
+	// point of this statement
+	var _ [hashLen]byte = hashForTarget("", "")
+
+	//nolint:testifylint // the parameter order is deliberate,
+	// b32hex.EncodedLen(hashLen) is the source of truth and we are testing the
+	// value of the const
+	require.Equal(t, base32hex.EncodedLen(hashLen), encodedHashLen)
+}
+
+func TestHashForTarget(t *testing.T) {
+	testCases := []struct {
+		teleportClusterName    string
+		kubeClusterName        string
+		hash                   string
+		sniLabelForKubeCluster string
+	}{
+		{
+			teleportClusterName:    "",
+			kubeClusterName:        "",
+			hash:                   "-\xba]\xbc3\x9es\x16\xae\xa2h?\xaf\x83\x9c\x1b{\x1e\xe21=\xb7\x92\x11%\x88\x11\x8d\xf0f\xaa5",
+			sniLabelForKubeCluster: "cluster-5mt5rf1jjpphdbl2d0vqv0ss3dthtohh7mrp4495h08ors36l8qg",
+		},
+		{
+			teleportClusterName:    "teleport.example.com",
+			kubeClusterName:        "prod-1",
+			hash:                   "%0\x86\x19\x99\x17\x97\xf9uX~\x00\xe4?\xf4aPO\v\xde%gq\xc7\xdf\xc6\x05|\xd1y\xd7r",
+			sniLabelForKubeCluster: "cluster-4ko8c6cp2ubvitaofo0e8fvkc584u2uu4ljn3huvoo2npkbpqtp0",
+		},
+
+		{
+			teleportClusterName:    "8701ae5eecf94a25adc7a90e3f373a25",
+			kubeClusterName:        "3929312bc0c74cd491a882f7abd7edbd",
+			hash:                   "\x0f\x12\xae\xf8\x83\xc2\xd3 j-\xe9\x87\xea\xdf\x18s\xd7\f\xb6\xcf\xcd\xce\x17\x89\x19c\r\xa2\x99\xd8A\xdd",
+			sniLabelForKubeCluster: "cluster-1s9atu43ob9i0qhdt63ulnooefbgpdmfpn71f28pcc6q56eo87eg",
+		},
+	}
+
+	for _, tc := range testCases {
+		hft := hashForTarget(tc.teleportClusterName, tc.kubeClusterName)
+		require.Equal(t, tc.hash, string(hft[:]))
+		require.Equal(t, tc.sniLabelForKubeCluster, SNILabelForKubeCluster(tc.teleportClusterName, tc.kubeClusterName))
+	}
+}
diff --git a/lib/kube/relay/passive_forwarder.go b/lib/kube/relay/passive_forwarder.go
new file mode 100644
index 0000000000000..31436af2b3bb7
--- /dev/null
+++ b/lib/kube/relay/passive_forwarder.go
@@ -0,0 +1,413 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relay
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"log/slog"
+	"net"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/gravitational/trace"
+	lru "github.com/hashicorp/golang-lru/v2"
+
+	apiconstants "github.com/gravitational/teleport/api/constants"
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/services/readonly"
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// SNISuffix is the suffix of the server name that signals that a connection is
+// intended for Kubernetes Access through a relay. The format of the domain
+// label in front of SNISuffix depends on the desired target for the connection.
+// For now, the only supported class of targets is identified by a prefix of
+// [SNIPrefixForKubeCluster] ("cluster-") to signify a connection for a given
+// Kubernetes cluster by name.
+const SNISuffix = ".kuberelay." + apiconstants.APIDomain
+
+// SNIPrefixForKubeCluster is the prefix of the domain label used to identify a
+// Kubernetes cluster as the target for a passively routed Relay connection.
+const SNIPrefixForKubeCluster = "cluster-"
+
+// When adding more target types (for example "session-") keep in mind that the
+// entire reason for the hashing scheme in [SNILabelForKubeCluster] is that
+// individual labels are limited to 63 characters (and the total FQDN is limited
+// to 253 characters, but that's not relevant for us since Kube agents can only
+// have one wildcard label in front of [SNISuffix]), so mind the total length of
+// the data you need to encode.
+
+type RelayTunnelDialFunc = func(ctx context.Context, hostID string, tunnelType apitypes.TunnelType, src, dst net.Addr) (net.Conn, error)
+type RelayPeerDialFunc = func(ctx context.Context, hostID string, tunnelType apitypes.TunnelType, relayIDs []string, src, dst net.Addr) (net.Conn, error)
+
+type GetKubeServersWithFilterFunc = func(ctx context.Context, filter func(readonly.KubeServer) bool) ([]apitypes.KubeServer, error)
+
+// PassiveForwarderConfig contains the parameters for [NewPassiveForwarder].
+type PassiveForwarderConfig struct {
+	Log *slog.Logger
+
+	ClusterName string
+	GroupName   string
+
+	// GetKubeServersWithFilter should return the Kube server resources known to
+	// the cluster that pass the given filter function.
+	GetKubeServersWithFilter GetKubeServersWithFilterFunc
+
+	// LocalDial should dial the given target if it's available as a reverse
+	// tunnel attached to the local instance.
+	LocalDial RelayTunnelDialFunc
+	// PeerDial should dial the given target through a known list of relay IDs.
+	// It will only be called for targets that are advertising the same relay
+	// group, but the function should check that any given relay in the list
+	// belongs to the correct group before attempting to use it.
+	PeerDial RelayPeerDialFunc
+}
+
+// NewPassiveForwarder returns a [PassiveForwarder] with the given config.
+func NewPassiveForwarder(cfg PassiveForwarderConfig) (*PassiveForwarder, error) {
+	if cfg.Log == nil {
+		return nil, trace.BadParameter("missing Log")
+	}
+	if cfg.ClusterName == "" {
+		return nil, trace.BadParameter("missing ClusterName")
+	}
+	if cfg.GroupName == "" {
+		return nil, trace.BadParameter("missing GroupName")
+	}
+	if cfg.GetKubeServersWithFilter == nil {
+		return nil, trace.BadParameter("missing GetKubeServersWithFilter")
+	}
+	if cfg.LocalDial == nil {
+		return nil, trace.BadParameter("missing LocalDial")
+	}
+	if cfg.PeerDial == nil {
+		return nil, trace.BadParameter("missing PeerDial")
+	}
+
+	resolvedNames, err := lru.New[[hashLen]byte, string](64)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// This context is owned by PassiveForwarder and it's used for operations
+	// that get synchronously canceled by Close.
+	ctx, cancel := context.WithCancel(context.Background())
+
+	return &PassiveForwarder{
+		log: cfg.Log,
+
+		clusterName: cfg.ClusterName,
+		groupName:   cfg.GroupName,
+
+		getKubeServersWithFilter: cfg.GetKubeServersWithFilter,
+
+		localDial: cfg.LocalDial,
+		peerDial:  cfg.PeerDial,
+
+		resolvedNames: resolvedNames,
+
+		ctx:    ctx,
+		cancel: cancel,
+	}, nil
+}
+
+// PassiveForwarder implements the logic to route and forward connections to
+// Kubernetes Service agents connected to a Relay.
+type PassiveForwarder struct {
+	log *slog.Logger
+
+	clusterName string
+	groupName   string
+
+	getKubeServersWithFilter GetKubeServersWithFilterFunc
+
+	localDial RelayTunnelDialFunc
+	peerDial  RelayPeerDialFunc
+
+	// resolvedNames contains (hash, name) pairs for which
+	// hash == hashForTarget(clusterName, name); pairs are only _added_ to the
+	// LRU if v is a kube cluster served by an agent connected to this relay
+	// group, but that doesn't guarantee that the cluster is still being served
+	// if the pair is looked up at a later time.
+	resolvedNames *lru.Cache[[hashLen]byte, string]
+
+	// ctx is used to signal that long running operations should unblock and
+	// return, especially operations that have added to wg because Close should
+	// wait until their end. It's owned by PassiveForwarder and should be
+	// canceled by calling Close; it does not belong to a context tree and does
+	// not outlive any call with a parent context. The intended operation of
+	// this object is almost entirely based on I/O and explicit closing, so
+	// there's no natural way to receive contexts associated with individual
+	// operations triggered by callers of its methods.
+	ctx    context.Context
+	cancel context.CancelFunc
+
+	mu sync.Mutex
+	// wg synchronizes with ctx and mu: wg.Add must only be called while holding
+	// mu if ctx.Err == nil, wg.Wait must only be called after cancel is called
+	// while holding mu.
+	wg sync.WaitGroup
+}
+
+// Close closes all ongoing connections and blocks until the associated
+// resources are gone.
+func (p *PassiveForwarder) Close() error {
+	p.mu.Lock()
+	// we cancel the context while holding the lock to signal that nothing
+	// long-running should begin in the background, so nothing will add to wg
+	// and we can wait on it
+	p.cancel()
+	p.mu.Unlock()
+
+	p.wg.Wait()
+	return nil
+}
+
+// Dispatch checks if the given SNI refers to a connection for a Kubernetes
+// cluster through a Relay; if so, it returns true and the connection should be
+// ignored by the caller, otherwise the connection is left untouched and the
+// caller should handle it. The transcript contains data that was already sent
+// by the client (i.e. a TLS ClientHello) and will be sent to the agent before
+// forwarding more data from the connection. This method is intended to be used
+// with [relaytransport.SNIDispatchTransportCredentials].
+func (p *PassiveForwarder) Dispatch(serverName string, transcript *bytes.Buffer, rawConn net.Conn) (dispatched bool) {
+	sniPrefix, ok := strings.CutSuffix(serverName, SNISuffix)
+	if !ok {
+		return false
+	}
+
+	p.mu.Lock()
+	if p.ctx.Err() != nil {
+		p.mu.Unlock()
+		_ = rawConn.Close()
+		// the forwarder was closed and Close has potentially already returned,
+		// so we shouldn't spawn additional goroutines
+		return true
+	}
+	p.wg.Add(1)
+	go func() {
+		defer p.wg.Done()
+		p.forward(sniPrefix, transcript, rawConn)
+	}()
+	p.mu.Unlock()
+
+	return true
+}
+
+func (p *PassiveForwarder) forward(sniPrefix string, transcript *bytes.Buffer, clientConn net.Conn) {
+	ctx := p.ctx
+	log := p.log.With(
+		"client_addr", clientConn.RemoteAddr().String(),
+	)
+	// TODO(espadolini): there's no way to signal errors to the client, so the
+	// best we can do is to cut the connection abruptly - unfortunately, that
+	// will cause clients such as kubectl to treat requests as retriable, and
+	// it's only after a lengthy timeout that an error will actually be reported
+	// to the user. Then again, this same behavior also means that if the
+	// connection failure is caused by a temporary failure due to missing
+	// tunnels and the likes, the following retries have a chance of succeeding,
+	// so this behavior is not all bad.
+	defer clientConn.Close()
+
+	sniPrefix = strings.ToLower(sniPrefix)
+	encodedHash, ok := strings.CutPrefix(sniPrefix, SNIPrefixForKubeCluster)
+	if !ok || len(encodedHash) != encodedHashLen {
+		log.DebugContext(ctx,
+			"Received unsupported SNI for kube relay forwarding",
+			"sni_prefix", sniPrefix,
+		)
+		return
+	}
+	var desiredHash [hashLen]byte
+	if _, err := base32hex.Decode(desiredHash[:], []byte(encodedHash)); err != nil {
+		log.DebugContext(ctx,
+			"Received malformed hash in SNI for kube cluster relay forwarding",
+			"encoded_hash", encodedHash,
+		)
+		return
+	}
+
+	kubeClusterName, cached := p.resolvedNames.Get(desiredHash)
+	kubeServers, err := p.getKubeServersWithFilter(
+		ctx,
+		func(ks readonly.KubeServer) bool {
+			if ks.GetRelayGroup() != p.groupName {
+				return false
+			}
+
+			if kubeClusterName != "" {
+				return ks.GetCluster().GetName() == kubeClusterName
+			}
+
+			if desiredHash == hashForTarget(p.clusterName, ks.GetCluster().GetName()) {
+				kubeClusterName = ks.GetCluster().GetName()
+				if !cached {
+					p.resolvedNames.Add(desiredHash, kubeClusterName)
+				}
+				return true
+			}
+			return false
+		},
+	)
+	if err != nil {
+		if ctx.Err() != nil {
+			return
+		}
+		log.ErrorContext(ctx,
+			"Failed to retrieve kube servers for routing",
+			"encoded_hash", encodedHash,
+			"error", err,
+		)
+		return
+	}
+	if len(kubeServers) < 1 {
+		log.WarnContext(ctx,
+			"No kube server found for the desired hash in the local relay group",
+			"encoded_hash", encodedHash,
+		)
+		return
+	}
+
+	var agentConn net.Conn
+	var agentHostID string
+	for kubeServer := range healthcheck.OrderByTargetHealthStatus(kubeServers) {
+		target := kubeServer.GetHostID() + "." + p.clusterName
+
+		localTunnelConn, err := p.localDial(ctx,
+			target, apitypes.KubeTunnel,
+			clientConn.RemoteAddr(), clientConn.LocalAddr(),
+		)
+		if err == nil {
+			agentConn = localTunnelConn
+			agentHostID = kubeServer.GetHostID()
+			break
+		}
+
+		if !trace.IsNotFound(err) {
+			log.DebugContext(ctx,
+				"Failed to dial target in local relay tunnel server, trying peer dialing",
+				"agent_host_id", kubeServer.GetHostID(),
+				"error", err,
+			)
+		}
+
+		peerTunnelConn, err := p.peerDial(ctx,
+			target, apitypes.KubeTunnel,
+			slices.Clone(kubeServer.GetRelayIDs()),
+			clientConn.RemoteAddr(), clientConn.LocalAddr(),
+		)
+		if err == nil {
+			agentConn = peerTunnelConn
+			agentHostID = kubeServer.GetHostID()
+			break
+		}
+
+		log.DebugContext(ctx,
+			"Failed to dial target through relay peering, trying next target if any",
+			"agent_host_id", kubeServer.GetHostID(),
+			"error", err,
+		)
+	}
+	if agentConn == nil {
+		if ctx.Err() != nil {
+			return
+		}
+		log.WarnContext(ctx,
+			"Failed to open tunnel connection to any agent connected to this relay group serving the desired cluster",
+			"kube_cluster", kubeClusterName,
+		)
+		return
+	}
+	defer agentConn.Close()
+
+	defer context.AfterFunc(ctx, func() {
+		// this will unblock both sides of the copy (it's not sufficient to
+		// close just one, it might've already half-closed and the other
+		// direction might get stuck reading)
+		_ = agentConn.Close()
+		_ = clientConn.Close()
+	})()
+
+	log = log.With(
+		"kube_cluster", kubeClusterName,
+		"agent_host_id", agentHostID,
+	)
+	log.InfoContext(ctx,
+		"Forwarding kube connection to agent",
+	)
+	defer log.DebugContext(ctx,
+		"Done forwarding kube connection to agent",
+	)
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		defer log.Log(ctx, logutils.TraceLevel,
+			"Done copying data from client to agent",
+		)
+		if _, err := io.Copy(agentConn, transcript); err != nil {
+			log.Log(ctx, traceIfOKNetworkError(err, slog.LevelDebug),
+				"Got an error copying data from client transcript to agent",
+				"error", err,
+			)
+			_ = clientConn.Close()
+			_ = agentConn.Close()
+			return
+		}
+		if _, err := io.Copy(agentConn, clientConn); err != nil {
+			log.Log(ctx, traceIfOKNetworkError(err, slog.LevelDebug),
+				"Got an error copying data from client to agent",
+				"error", err,
+			)
+			_ = clientConn.Close()
+			_ = agentConn.Close()
+			return
+		}
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		defer log.Log(ctx, logutils.TraceLevel,
+			"Done copying data from agent to client",
+		)
+		if _, err := io.Copy(clientConn, agentConn); err != nil {
+			log.Log(ctx, traceIfOKNetworkError(err, slog.LevelDebug),
+				"Got an error copying data from agent to client",
+				"error", err,
+			)
+			_ = clientConn.Close()
+			_ = agentConn.Close()
+			return
+		}
+	}()
+}
+
+func traceIfOKNetworkError(err error, l slog.Level) slog.Level {
+	if err == nil || utils.IsOKNetworkError(err) {
+		return logutils.TraceLevel
+	}
+	return l
+}
diff --git a/lib/kube/relay/passive_forwarder_test.go b/lib/kube/relay/passive_forwarder_test.go
new file mode 100644
index 0000000000000..013d65cc9a8b1
--- /dev/null
+++ b/lib/kube/relay/passive_forwarder_test.go
@@ -0,0 +1,145 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relay
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services/readonly"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+func TestPassiveForwarder_Selection(t *testing.T) {
+	kubeServers := []*apitypes.KubernetesServerV3{
+		// not in any group
+		{
+			Spec: apitypes.KubernetesServerSpecV3{
+				RelayGroup: "",
+				HostID:     "host-a",
+				Cluster: &apitypes.KubernetesClusterV3{
+					Metadata: apitypes.Metadata{
+						Name: "cluster-a",
+					},
+				},
+			},
+		},
+		// in the group, unhealthy
+		{
+			Spec: apitypes.KubernetesServerSpecV3{
+				RelayGroup: "thisgroup",
+				HostID:     "host-b",
+				Cluster: &apitypes.KubernetesClusterV3{
+					Metadata: apitypes.Metadata{
+						Name: "cluster-b",
+					},
+				},
+			},
+			Status: &apitypes.KubernetesServerStatusV3{
+				TargetHealth: &apitypes.TargetHealth{
+					Status: "unhealthy",
+				},
+			},
+		},
+		// not in the correct group
+		{
+			Spec: apitypes.KubernetesServerSpecV3{
+				RelayGroup: "othergroup",
+				HostID:     "host-c",
+				Cluster: &apitypes.KubernetesClusterV3{
+					Metadata: apitypes.Metadata{
+						Name: "cluster-c",
+					},
+				},
+			},
+		},
+		// in the right group, healthy
+		{
+			Spec: apitypes.KubernetesServerSpecV3{
+				RelayGroup: "thisgroup",
+				HostID:     "host-b2",
+				Cluster: &apitypes.KubernetesClusterV3{
+					Metadata: apitypes.Metadata{
+						Name: "cluster-b",
+					},
+				},
+			},
+			Status: &apitypes.KubernetesServerStatusV3{
+				TargetHealth: &apitypes.TargetHealth{
+					Status: "healthy",
+				},
+			},
+		},
+	}
+
+	var localDialed []string
+	fwd, err := NewPassiveForwarder(PassiveForwarderConfig{
+		Log:         slog.Default(),
+		ClusterName: "clustername",
+		GroupName:   "thisgroup",
+		GetKubeServersWithFilter: func(ctx context.Context, filter func(readonly.KubeServer) bool) ([]apitypes.KubeServer, error) {
+			var out []apitypes.KubeServer
+			for _, s := range kubeServers {
+				if filter(s) {
+					out = append(out, s.Copy())
+				}
+			}
+			return out, nil
+		},
+		LocalDial: func(ctx context.Context, hostID string, tunnelType apitypes.TunnelType, src, dst net.Addr) (net.Conn, error) {
+			localDialed = append(localDialed, hostID)
+			return nil, trace.NotFound("no")
+		},
+		PeerDial: func(ctx context.Context, hostID string, tunnelType apitypes.TunnelType, relayIDs []string, src, dst net.Addr) (net.Conn, error) {
+			return nil, trace.ConnectionProblem(nil, "nope")
+		},
+	})
+	require.NoError(t, err)
+	defer fwd.Close()
+
+	fwd.forward(SNILabelForKubeCluster("clustername", "cluster-a"), new(bytes.Buffer), (*noopConn)(nil))
+	require.Empty(t, localDialed)
+	fwd.forward(SNILabelForKubeCluster("clustername", "cluster-c"), new(bytes.Buffer), (*noopConn)(nil))
+	require.Empty(t, localDialed)
+	// host-b2 is healthy so it will always be tried before the unhealthy host-b
+	for range 100 {
+		localDialed = []string{}
+		fwd.forward(SNILabelForKubeCluster("clustername", "cluster-b"), new(bytes.Buffer), (*noopConn)(nil))
+		require.Equal(t, []string{"host-b2.clustername", "host-b.clustername"}, localDialed)
+	}
+}
+
+type noopConn struct {
+	net.Conn
+}
+
+func (*noopConn) Close() error         { return nil }
+func (*noopConn) LocalAddr() net.Addr  { return &net.TCPAddr{} }
+func (*noopConn) RemoteAddr() net.Addr { return &net.TCPAddr{} }
diff --git a/lib/kube/token/claims/claims.go b/lib/kube/token/claims/claims.go
new file mode 100644
index 0000000000000..2c65fc5799723
--- /dev/null
+++ b/lib/kube/token/claims/claims.go
@@ -0,0 +1,57 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package claims
+
+import (
+	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+)
+
+// PodSubClaim are the Pod-specific claims we expect to find on a Kubernetes Service Account JWT.
+type PodSubClaim struct {
+	Name string `json:"name"`
+	UID  string `json:"uid"`
+}
+
+// ServiceAccountSubClaim are the Service Account-specific claims we expect to find on a Kubernetes Service Account JWT.
+type ServiceAccountSubClaim struct {
+	Name string `json:"name"`
+	UID  string `json:"uid"`
+}
+
+// KubernetesSubClaim are the Kubernetes-specific claims (under kubernetes.io)
+// we expect to find on a Kubernetes Service Account JWT.
+type KubernetesSubClaim struct {
+	Namespace      string                  `json:"namespace"`
+	ServiceAccount *ServiceAccountSubClaim `json:"serviceaccount"`
+	Pod            *PodSubClaim            `json:"pod"`
+}
+
+// ServiceAccountClaims are the claims we expect to find on a Kubernetes Service Account JWT.
+type ServiceAccountClaims struct {
+	jwt.Claims
+	Kubernetes *KubernetesSubClaim `json:"kubernetes.io"`
+}
+
+// OIDCServiceAccountClaims is a variant of `ServiceAccountClaims` intended for
+// use with the OIDC validator rather than plain JWKS.
+type OIDCServiceAccountClaims struct {
+	oidc.TokenClaims
+	Kubernetes *KubernetesSubClaim `json:"kubernetes.io"`
+}
diff --git a/lib/kube/token/join.go b/lib/kube/token/join.go
new file mode 100644
index 0000000000000..eca1f50db408e
--- /dev/null
+++ b/lib/kube/token/join.go
@@ -0,0 +1,148 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package token
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/join/provision"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, "kubetoken")
+
+type InClusterValidator interface {
+	Validate(ctx context.Context, token, clusterName string) (*ValidationResult, error)
+}
+
+type JWKSValidator func(now time.Time, jwksData []byte, clusterName string, token string) (*ValidationResult, error)
+
+// CheckIDTokenParams are parameters used to validate Kubernetes ID tokens, of
+// all subtypes (as specified by the ProvisionToken).
+type CheckIDTokenParams struct {
+	ProvisionToken     provision.Token
+	Clock              clockwork.Clock
+	ClusterName        string
+	IDToken            []byte
+	InClusterValidator InClusterValidator
+	JWKSValidator      JWKSValidator
+	OIDCValidator      *KubernetesOIDCTokenValidator
+}
+
+func (p *CheckIDTokenParams) validate() error {
+	switch {
+	case p.ProvisionToken == nil:
+		return trace.BadParameter("ProvisionToken is required")
+	case p.Clock == nil:
+		return trace.BadParameter("Clock is required")
+	case p.ClusterName == "":
+		return trace.BadParameter("ClusterName is required")
+	case len(p.IDToken) == 0:
+		return trace.BadParameter("IDToken is required")
+	case p.InClusterValidator == nil:
+		return trace.BadParameter("InClusterValidator is required")
+	case p.JWKSValidator == nil:
+		return trace.BadParameter("JWKSValidator is required")
+	case p.OIDCValidator == nil:
+		return trace.BadParameter("OIDCValidator is required")
+	}
+	return nil
+}
+
+// CheckIDToken verifies a Kubernetes IDToken, with specific verification steps
+// depending on the ProvisionToken in Teleport.
+func CheckIDToken(
+	ctx context.Context,
+	params *CheckIDTokenParams,
+) (*ValidationResult, error) {
+	if err := params.validate(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	token, ok := params.ProvisionToken.(*types.ProvisionTokenV2)
+	if !ok {
+		return nil, trace.BadParameter(
+			"kubernetes join method only supports ProvisionTokenV2, '%T' was provided",
+			params.ProvisionToken,
+		)
+	}
+
+	// Switch to join method subtype token validation.
+	var result *ValidationResult
+	var err error
+	switch token.Spec.Kubernetes.Type {
+	case types.KubernetesJoinTypeStaticJWKS:
+		result, err = params.JWKSValidator(
+			params.Clock.Now(),
+			[]byte(token.Spec.Kubernetes.StaticJWKS.JWKS),
+			params.ClusterName,
+			string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.WrapWithMessage(err, "reviewing kubernetes token with static_jwks")
+		}
+	case types.KubernetesJoinTypeOIDC:
+		result, err = params.OIDCValidator.ValidateToken(
+			ctx,
+			token.Spec.Kubernetes.OIDC.Issuer,
+			params.ClusterName,
+			string(params.IDToken),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "reviewing kubernetes token with oidc")
+		}
+	case types.KubernetesJoinTypeInCluster, types.KubernetesJoinTypeUnspecified:
+		result, err = params.InClusterValidator.Validate(ctx, string(params.IDToken), params.ClusterName)
+		if err != nil {
+			return nil, trace.WrapWithMessage(err, "reviewing kubernetes token with in_cluster")
+		}
+	default:
+		return nil, trace.BadParameter(
+			"unsupported kubernetes join method type (%s)",
+			token.Spec.Kubernetes.Type,
+		)
+	}
+
+	log.InfoContext(ctx, "Kubernetes workload trying to join cluster",
+		"validated_identity", result,
+		"token", token.GetName(),
+	)
+
+	return result, trace.Wrap(checkKubernetesAllowRules(token, result))
+}
+
+func checkKubernetesAllowRules(pt *types.ProvisionTokenV2, got *ValidationResult) error {
+	// If a single rule passes, accept the token
+	for _, rule := range pt.Spec.Kubernetes.Allow {
+		wantUsername := fmt.Sprintf("%s:%s", ServiceAccountNamePrefix, rule.ServiceAccount)
+		if wantUsername != got.Username {
+			continue
+		}
+		return nil
+	}
+
+	return trace.AccessDenied("kubernetes token did not match any allow rules")
+}
diff --git a/lib/kube/token/validator.go b/lib/kube/token/validator.go
index 0d88af8d46735..ecb17473b94d6 100644
--- a/lib/kube/token/validator.go
+++ b/lib/kube/token/validator.go
@@ -29,6 +29,7 @@ import (
 	"github.com/go-jose/go-jose/v3"
 	josejwt "github.com/go-jose/go-jose/v3/jwt"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	v1 "k8s.io/api/authentication/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/version"
@@ -38,6 +39,8 @@ import (
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
+	tokenclaims "github.com/gravitational/teleport/lib/kube/token/claims"
+	"github.com/gravitational/teleport/lib/oidc"
 )
 
 const (
@@ -121,7 +124,7 @@ func unsafeGetTokenAudiences(token string) ([]string, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	claims := &ServiceAccountClaims{}
+	claims := &tokenclaims.ServiceAccountClaims{}
 	err = jwt.UnsafeClaimsWithoutVerification(claims)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -251,32 +254,6 @@ func kubernetesSupportsBoundTokens(gitVersion string) (bool, error) {
 	return kubeVersion.AtLeast(minKubeVersion), nil
 }
 
-// PodSubClaim are the Pod-specific claims we expect to find on a Kubernetes Service Account JWT.
-type PodSubClaim struct {
-	Name string `json:"name"`
-	UID  string `json:"uid"`
-}
-
-// ServiceAccountSubClaim are the Service Account-specific claims we expect to find on a Kubernetes Service Account JWT.
-type ServiceAccountSubClaim struct {
-	Name string `json:"name"`
-	UID  string `json:"uid"`
-}
-
-// KubernetesSubClaim are the Kubernetes-specific claims (under kubernetes.io)
-// we expect to find on a Kubernetes Service Account JWT.
-type KubernetesSubClaim struct {
-	Namespace      string                  `json:"namespace"`
-	ServiceAccount *ServiceAccountSubClaim `json:"serviceaccount"`
-	Pod            *PodSubClaim            `json:"pod"`
-}
-
-// ServiceAccountClaims are the claims we expect to find on a Kubernetes Service Account JWT.
-type ServiceAccountClaims struct {
-	josejwt.Claims
-	Kubernetes *KubernetesSubClaim `json:"kubernetes.io"`
-}
-
 // ValidateTokenWithJWKS validates a Kubernetes Service Account JWT using a
 // configured JWKS.
 func ValidateTokenWithJWKS(
@@ -295,7 +272,7 @@ func ValidateTokenWithJWKS(
 		return nil, trace.Wrap(err, "parsing provided jwks")
 	}
 
-	claims := ServiceAccountClaims{}
+	claims := tokenclaims.ServiceAccountClaims{}
 	if err := jwt.Claims(jwks, &claims); err != nil {
 		return nil, trace.Wrap(err, "validating jwt signature")
 	}
@@ -351,3 +328,67 @@ func ValidateTokenWithJWKS(
 		},
 	}, nil
 }
+
+// NewKubernetesOIDCTokenValidator constructs a KubernetesOIDCTokenValidator.
+func NewKubernetesOIDCTokenValidator() (*KubernetesOIDCTokenValidator, error) {
+	validator, err := oidc.NewCachingTokenValidator[*tokenclaims.OIDCServiceAccountClaims](clockwork.NewRealClock())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &KubernetesOIDCTokenValidator{
+		validator: validator,
+	}, nil
+}
+
+// KubernetesOIDCTokenValidator is a validator that can validate Kubernetes
+// projected service account tokens against an external OIDC compatible IdP.
+type KubernetesOIDCTokenValidator struct {
+	validator *oidc.CachingTokenValidator[*tokenclaims.OIDCServiceAccountClaims]
+}
+
+// ValidateTokenWithJWKS validates a Kubernetes Service Account JWT using an
+// OIDC endpoint.
+func (v *KubernetesOIDCTokenValidator) ValidateToken(
+	ctx context.Context,
+	issuerURL string,
+	clusterName string,
+	token string,
+) (*ValidationResult, error) {
+	validator, err := v.validator.GetValidator(ctx, issuerURL, clusterName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	claims, err := validator.ValidateToken(ctx, token)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating OIDC token")
+	}
+
+	// Ensure this is a pod-bound service account token
+	if claims.Kubernetes == nil || claims.Kubernetes.Pod == nil || claims.Kubernetes.Pod.Name == "" {
+		return nil, trace.BadParameter("oidc joining requires the use of a projected pod bound service account token")
+	}
+
+	// Note: OIDC library requires valid exp and iat.
+	maxAllowedTTL := time.Minute * 30
+	if claims.GetExpiration().Sub(claims.GetIssuedAt()) > maxAllowedTTL {
+		return nil, trace.BadParameter("oidc joining requires the use of a service account token with a TTL of less than %s", maxAllowedTTL)
+	}
+
+	return &ValidationResult{
+		Raw:      claims,
+		Type:     types.KubernetesJoinTypeOIDC,
+		Username: claims.GetSubject(),
+		attrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+			Subject: claims.GetSubject(),
+			Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+				Name: claims.Kubernetes.Pod.Name,
+			},
+			ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+				Name:      claims.Kubernetes.ServiceAccount.Name,
+				Namespace: claims.Kubernetes.Namespace,
+			},
+		},
+	}, nil
+}
diff --git a/lib/kube/token/validator_test.go b/lib/kube/token/validator_test.go
index 70d68fddb766d..9e4ade25b290d 100644
--- a/lib/kube/token/validator_test.go
+++ b/lib/kube/token/validator_test.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"google.golang.org/protobuf/testing/protocmp"
 	v1 "k8s.io/api/authentication/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -43,6 +44,9 @@ import (
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/kube/token/claims"
+	"github.com/gravitational/teleport/lib/oidc/fakeissuer"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const (
@@ -466,12 +470,12 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 
 	now := time.Now()
 	clusterName := "example.teleport.sh"
-	validKubeSubclaim := &KubernetesSubClaim{
-		ServiceAccount: &ServiceAccountSubClaim{
+	validKubeSubclaim := &claims.KubernetesSubClaim{
+		ServiceAccount: &claims.ServiceAccountSubClaim{
 			Name: "my-service-account",
 			UID:  "8b77ea6d-3144-4203-9a8b-36eb5ad65596",
 		},
-		Pod: &PodSubClaim{
+		Pod: &claims.PodSubClaim{
 			Name: "my-pod-797959fdf-wptbj",
 			UID:  "413b22ca-4833-48d9-b6db-76219d583173",
 		},
@@ -481,7 +485,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 	tests := []struct {
 		name   string
 		signer jose.Signer
-		claims ServiceAccountClaims
+		claims claims.ServiceAccountClaims
 
 		wantResult *ValidationResult
 		wantAttrs  *workloadidentityv1pb.JoinAttrsKubernetes
@@ -490,7 +494,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "valid",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -518,7 +522,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "missing bound pod claim",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -526,8 +530,8 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 					NotBefore: jwt.NewNumericDate(now.Add(-1 * time.Minute)),
 					Expiry:    jwt.NewNumericDate(now.Add(10 * time.Minute)),
 				},
-				Kubernetes: &KubernetesSubClaim{
-					ServiceAccount: &ServiceAccountSubClaim{
+				Kubernetes: &claims.KubernetesSubClaim{
+					ServiceAccount: &claims.ServiceAccountSubClaim{
 						Name: "my-service-account",
 						UID:  "8b77ea6d-3144-4203-9a8b-36eb5ad65596",
 					},
@@ -539,7 +543,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "signed by unknown key",
 			signer: wrongSigner,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -554,7 +558,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "wrong audience",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{"wrong.audience"},
@@ -569,7 +573,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "no expiry",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -583,7 +587,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "no issued at",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -597,7 +601,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "too long ttl",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -616,7 +620,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "expired",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -631,7 +635,7 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		{
 			name:   "not yet valid",
 			signer: signer,
-			claims: ServiceAccountClaims{
+			claims: claims.ServiceAccountClaims{
 				Claims: jwt.Claims{
 					Subject:   "system:serviceaccount:default:my-service-account",
 					Audience:  jwt.Audience{clusterName},
@@ -678,3 +682,185 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateTokenWithOIDC(t *testing.T) {
+	t.Parallel()
+	log := logtest.NewLogger()
+
+	const idpAudience = "example.teleport.sh"
+	idp, err := fakeissuer.NewIDP(log)
+	require.NoError(t, err)
+	t.Cleanup(idp.Close)
+
+	wrongIDP, err := fakeissuer.NewIDP(log)
+	require.NoError(t, err)
+	t.Cleanup(wrongIDP.Close)
+
+	k8sClaim := &claims.KubernetesSubClaim{
+		Namespace: "default",
+		ServiceAccount: &claims.ServiceAccountSubClaim{
+			Name: "example",
+			UID:  "abcd-1234",
+		},
+		Pod: &claims.PodSubClaim{
+			Name: "example-pod",
+			UID:  "zxcv-1234",
+		},
+	}
+
+	mustIssueToken := func(token string, err error) string {
+		require.NoError(t, err)
+		return token
+	}
+
+	tests := []struct {
+		name     string
+		audience string
+		token    string
+
+		assertError require.ErrorAssertionFunc
+		want        *ValidationResult
+	}{
+		{
+			name:     "simple",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				idp.IssuerURL(),
+				idpAudience,
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+				k8sClaim,
+			)),
+			assertError: require.NoError,
+			want: &ValidationResult{
+				Username: "example",
+				Type:     types.KubernetesJoinTypeOIDC,
+				Raw: &claims.OIDCServiceAccountClaims{
+					TokenClaims: oidc.TokenClaims{
+						Issuer:   idp.IssuerURL(),
+						Subject:  "example",
+						Audience: oidc.Audience{idpAudience},
+					},
+					Kubernetes: k8sClaim,
+				},
+			},
+		},
+		{
+			name:     "invalid-audience",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				idp.IssuerURL(),
+				"invalid-audience.example.com",
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+				k8sClaim,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "audience is not valid")
+			},
+			want: nil,
+		},
+		{
+			name:     "invalid-issuer",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				"invalid-issuer",
+				idpAudience,
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+				k8sClaim,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "issuer does not match")
+			},
+			want: nil,
+		},
+		{
+			name:     "expired",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				idp.IssuerURL(),
+				idpAudience,
+				"example",
+				time.Now().Add(-10*time.Minute),
+				time.Now().Add(-5*time.Minute),
+				k8sClaim,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "token has expired")
+			},
+			want: nil,
+		},
+		{
+			name:     "ttl-too-long",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				idp.IssuerURL(),
+				idpAudience,
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(30*time.Minute),
+				k8sClaim,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "token with a TTL of less than")
+			},
+			want: nil,
+		},
+		{
+			name:     "missing-k8s-attrs",
+			audience: idpAudience,
+			token: mustIssueToken(idp.IssueToken(
+				idp.IssuerURL(),
+				idpAudience,
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+				nil,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "requires the use of a projected pod")
+			},
+			want: nil,
+		},
+		{
+			name:     "imposter-idp",
+			audience: idpAudience,
+			token: mustIssueToken(wrongIDP.IssueToken(
+				idp.IssuerURL(),
+				idpAudience,
+				"example",
+				time.Now().Add(-5*time.Minute),
+				time.Now().Add(5*time.Minute),
+				k8sClaim,
+			)),
+			assertError: func(t require.TestingT, err error, i ...any) {
+				require.ErrorContains(t, err, "signature verification failed")
+			},
+			want: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			validator, err := NewKubernetesOIDCTokenValidator()
+			require.NoError(t, err)
+
+			result, err := validator.ValidateToken(ctx, idp.IssuerURL(), tt.audience, tt.token)
+			tt.assertError(t, err)
+
+			require.Empty(t, cmp.Diff(
+				result, tt.want,
+				// Ignore some standard fields handled by the OIDC library.
+				cmpopts.IgnoreFields(oidc.TokenClaims{}, "Expiration", "IssuedAt", "NotBefore", "SignatureAlg"),
+				cmpopts.IgnoreUnexported(ValidationResult{}),
+			))
+		})
+	}
+
+}
diff --git a/lib/labels/labels_test.go b/lib/labels/labels_test.go
index 4294774d2d745..9aef7fb6a5896 100644
--- a/lib/labels/labels_test.go
+++ b/lib/labels/labels_test.go
@@ -28,11 +28,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/limiter/internal/ratelimit/ratelimit_test.go b/lib/limiter/internal/ratelimit/ratelimit_test.go
index 8e7ad91a32d0e..9463642d28f50 100644
--- a/lib/limiter/internal/ratelimit/ratelimit_test.go
+++ b/lib/limiter/internal/ratelimit/ratelimit_test.go
@@ -19,10 +19,12 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 )
 
 func TestLimitExceededError(t *testing.T) {
+	t.Parallel()
 	err := &limitExceededError{delay: 3 * time.Second}
 
 	require.True(t, trace.IsLimitExceeded(err))
@@ -31,3 +33,90 @@ func TestLimitExceededError(t *testing.T) {
 	require.ErrorAs(t, err, &le)
 	require.Equal(t, err.Error(), le.Message)
 }
+
+func TestTokenBucketSet_IsRateLimited(t *testing.T) {
+	t.Parallel()
+
+	t.Run("not rate limited when tokens available", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		rates := NewRateSet()
+		require.NoError(t, rates.Add(time.Minute, 10, 10))
+
+		tbs := NewTokenBucketSet(rates, clock)
+		require.False(t, tbs.IsRateLimited(), "should not be rate limited with full bucket")
+	})
+
+	t.Run("rate limited when no tokens available", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		rates := NewRateSet()
+		require.NoError(t, rates.Add(time.Minute, 10, 10))
+
+		tbs := NewTokenBucketSet(rates, clock)
+
+		// Consume all tokens
+		delay, err := tbs.Consume(10)
+		require.NoError(t, err)
+		require.Zero(t, delay)
+
+		// Now should be rate limited
+		require.True(t, tbs.IsRateLimited(), "should be rate limited after consuming all tokens")
+	})
+
+	t.Run("not rate limited after time passes", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		rates := NewRateSet()
+		require.NoError(t, rates.Add(time.Minute, 10, 10))
+
+		tbs := NewTokenBucketSet(rates, clock)
+
+		// Consume all tokens
+		delay, err := tbs.Consume(10)
+		require.NoError(t, err)
+		require.Zero(t, delay)
+
+		require.True(t, tbs.IsRateLimited(), "should be rate limited after consuming all tokens")
+
+		// Advance time to refill tokens
+		clock.Advance(time.Minute)
+
+		require.False(t, tbs.IsRateLimited())
+	})
+
+	t.Run("rate limited when any bucket is exhausted", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		rates := NewRateSet()
+		require.NoError(t, rates.Add(time.Minute, 10, 10))
+		require.NoError(t, rates.Add(time.Hour, 100, 100))
+
+		tbs := NewTokenBucketSet(rates, clock)
+
+		// Consume all tokens from the minute bucket
+		delay, err := tbs.Consume(10)
+		require.NoError(t, err)
+		require.Zero(t, delay)
+
+		// Should be rate limited even though hour bucket has tokens
+		require.True(t, tbs.IsRateLimited())
+	})
+
+	t.Run("does not consume tokens", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		rates := NewRateSet()
+		require.NoError(t, rates.Add(time.Minute, 10, 10))
+
+		tbs := NewTokenBucketSet(rates, clock)
+
+		// Check multiple times - should not consume tokens
+		require.False(t, tbs.IsRateLimited())
+		require.False(t, tbs.IsRateLimited())
+		require.False(t, tbs.IsRateLimited())
+
+		// Should still be able to consume all tokens
+		delay, err := tbs.Consume(10)
+		require.NoError(t, err)
+		require.Zero(t, delay)
+
+		// Now should be rate limited
+		require.True(t, tbs.IsRateLimited())
+	})
+}
diff --git a/lib/limiter/internal/ratelimit/tokenbucket.go b/lib/limiter/internal/ratelimit/tokenbucket.go
index f6d5e931ab18b..da3c548918a5d 100644
--- a/lib/limiter/internal/ratelimit/tokenbucket.go
+++ b/lib/limiter/internal/ratelimit/tokenbucket.go
@@ -70,6 +70,18 @@ func (tbs *TokenBucketSet) Update(rates *RateSet) {
 	}
 }
 
+// IsRateLimited checks if the bucket is currently rate-limited (no tokens available)
+// without actually consuming any tokens. Returns true if rate-limited, false otherwise.
+func (tbs *TokenBucketSet) IsRateLimited() bool {
+	for _, tokenBucket := range tbs.buckets {
+		tokenBucket.updateAvailableTokens()
+		if tokenBucket.availableTokens < 1 {
+			return true
+		}
+	}
+	return false
+}
+
 // Consume makes an attempt to consume the specified number of tokens from the
 // bucket. If there are enough tokens available then (0, nil) is returned.
 // If tokens to consume is larger than the burst size, then an error is returned
diff --git a/lib/limiter/limiter_test.go b/lib/limiter/limiter_test.go
index 29a0021598c16..ba4ddc3fc2062 100644
--- a/lib/limiter/limiter_test.go
+++ b/lib/limiter/limiter_test.go
@@ -36,10 +36,11 @@ import (
 
 	"github.com/gravitational/teleport/lib/limiter/internal/ratelimit"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -458,3 +459,45 @@ func mustServeAndReceiveStatusCode(t *testing.T, handler http.Handler, wantStatu
 
 	require.Equal(t, wantStatusCode, response.StatusCode)
 }
+
+func TestRateLimiter_IsRateLimited(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+	limiter, err := NewRateLimiter(Config{
+		Clock: clock,
+		Rates: []Rate{
+			{
+				Period:  time.Minute,
+				Average: 10,
+				Burst:   10,
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.False(t, limiter.IsRateLimited("token1"))
+
+	// Consume some tokens but not all
+	for range 5 {
+		require.NoError(t, limiter.RegisterRequest("token1", nil))
+	}
+
+	require.False(t, limiter.IsRateLimited("token1"))
+
+	// Consume the rest of the tokens
+	for range 4 {
+		require.NoError(t, limiter.RegisterRequest("token1", nil))
+	}
+	require.False(t, limiter.IsRateLimited("token1"))
+
+	// Consume the last token
+	require.NoError(t, limiter.RegisterRequest("token1", nil))
+	// Now token1 should be rate limited
+	require.True(t, limiter.IsRateLimited("token1"))
+	// token2 should not be rate limited
+	require.False(t, limiter.IsRateLimited("token2"))
+
+	clock.Advance(time.Minute)
+	// After time passes, token1 should not be rate limited anymore
+	require.False(t, limiter.IsRateLimited("token1"))
+}
diff --git a/lib/limiter/ratelimiter.go b/lib/limiter/ratelimiter.go
index e0edc4fdf1968..22c55a9c9c60d 100644
--- a/lib/limiter/ratelimiter.go
+++ b/lib/limiter/ratelimiter.go
@@ -101,6 +101,23 @@ func NewRateLimiter(config Config) (*RateLimiter, error) {
 	return &limiter, nil
 }
 
+// IsRateLimited checks if the provided token is currently rate-limited without
+// consuming any tokens. Returns true if the token would be rate-limited, false otherwise.
+// This is useful for checking rate limit status before executing expensive operations.
+func (l *RateLimiter) IsRateLimited(token string) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	bucketSet, ok := l.rateLimits.GetIfExists(token)
+	if !ok {
+		return false
+	}
+	bucket, ok := bucketSet.(*ratelimit.TokenBucketSet)
+	if !ok {
+		return false
+	}
+	return bucket.IsRateLimited()
+}
+
 // RegisterRequest increases number of requests for the provided token
 // Returns error if there are too many requests with the provided token.
 func (l *RateLimiter) RegisterRequest(token string, customRate *ratelimit.RateSet) error {
diff --git a/lib/loginrule/evaluator.go b/lib/loginrule/evaluator.go
index fe33bbf1274ca..20295c0dd0fc3 100644
--- a/lib/loginrule/evaluator.go
+++ b/lib/loginrule/evaluator.go
@@ -26,6 +26,9 @@ type EvaluationInput struct {
 	// or the internal static traits (for local users) which will be input to
 	// the login rule evaluation.
 	Traits map[string][]string
+	// Claims holds the original, unparsed provider claims. Each claim may be
+	// a standard string/list, or an arbitrary json object.
+	Claims map[string]any
 }
 
 // EvaluationOutput holds the output of a login rule evaluation.
diff --git a/lib/modules/modules.go b/lib/modules/modules.go
index 906ce1c2be15c..d2d5c61c339ca 100644
--- a/lib/modules/modules.go
+++ b/lib/modules/modules.go
@@ -25,6 +25,7 @@ import (
 	"crypto"
 	"errors"
 	"fmt"
+	"iter"
 	"os"
 	"runtime"
 	"strconv"
@@ -249,6 +250,8 @@ type AccessResourcesGetter interface {
 
 	GetLock(ctx context.Context, name string) (types.Lock, error)
 	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
+	ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error)
+	RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error]
 }
 
 type AccessListSuggestionClient interface {
@@ -257,6 +260,7 @@ type AccessListSuggestionClient interface {
 
 	GetAccessRequestAllowedPromotions(ctx context.Context, req types.AccessRequest) (*types.AccessRequestAllowedPromotions, error)
 	GetAccessRequests(ctx context.Context, filter types.AccessRequestFilter) ([]types.AccessRequest, error)
+	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
 }
 
 type RoleGetter interface {
@@ -291,6 +295,8 @@ type Modules interface {
 	AttestHardwareKey(context.Context, interface{}, *hardwarekey.AttestationStatement, crypto.PublicKey, time.Duration) (*keys.AttestationData, error)
 	// GenerateAccessRequestPromotions generates a list of valid promotions for given access request.
 	GenerateAccessRequestPromotions(context.Context, AccessResourcesGetter, types.AccessRequest) (*types.AccessRequestAllowedPromotions, error)
+	// GenerateLongTermResourceGrouping analyzes how resources can be grouped into access lists and returns information about optimal groupings for long-term access.
+	GenerateLongTermResourceGrouping(context.Context, AccessResourcesGetter, types.AccessRequest) (*types.LongTermResourceGrouping, error)
 	// GetSuggestedAccessLists generates a list of valid promotions for given access request.
 	GetSuggestedAccessLists(ctx context.Context, identity *tlsca.Identity, clt AccessListSuggestionClient, accessListGetter AccessListAndMembersGetter, requestID string) ([]*accesslist.AccessList, error)
 	// EnableRecoveryCodes enables the usage of recovery codes for resetting forgotten passwords
@@ -323,7 +329,10 @@ func SetModules(m Modules) {
 	modules = m
 }
 
-// GetModules returns the modules interface
+// GetModules returns the modules interface. It only works in the auth service
+// process, so any code that may be executed in a different context needs to
+// obtain modules or derived options from an auth-specific caller or an RPC
+// call to the auth server.
 func GetModules() Modules {
 	mutex.Lock()
 	defer mutex.Unlock()
@@ -432,6 +441,11 @@ func (p *defaultModules) AttestHardwareKey(_ context.Context, _ interface{}, _ *
 	return nil, trace.NotFound("no attestation data for the given key")
 }
 
+// GenerateLongTermResourceGrouping is a noop since OSS teleport does not support long-term Access Requests.
+func (p *defaultModules) GenerateLongTermResourceGrouping(_ context.Context, _ AccessResourcesGetter, _ types.AccessRequest) (*types.LongTermResourceGrouping, error) {
+	return &types.LongTermResourceGrouping{}, nil
+}
+
 // GenerateAccessRequestPromotions is a noop since OSS teleport does not support generating access list promotions.
 func (p *defaultModules) GenerateAccessRequestPromotions(_ context.Context, _ AccessResourcesGetter, _ types.AccessRequest) (*types.AccessRequestAllowedPromotions, error) {
 	// The default module does not support generating access list promotions.
diff --git a/lib/modules/modules_test.go b/lib/modules/modules_test.go
index b6d1313b5eb88..b74a6247772d7 100644
--- a/lib/modules/modules_test.go
+++ b/lib/modules/modules_test.go
@@ -31,7 +31,9 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestMain(m *testing.M) {
@@ -46,31 +48,35 @@ func TestOSSModules(t *testing.T) {
 
 func TestValidateAuthPreferenceOnCloud(t *testing.T) {
 	ctx := context.Background()
-	testServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testServer.Close()) })
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Cloud: true,
 		},
 	})
 
-	s, err := auth.NewTestTLSServer(auth.TestTLSServerConfig{
+	s, err := authtest.NewTestTLSServer(authtest.TLSServerConfig{
 		APIConfig: &auth.APIConfig{
-			AuthServer: testServer.AuthServer,
-			Authorizer: testServer.Authorizer,
-			AuditLog:   testServer.AuditLog,
-			Emitter:    testServer.AuditLog,
+			AuthServer:       testServer.AuthServer,
+			Authorizer:       testServer.Authorizer,
+			ScopedAuthorizer: testServer.ScopedAuthorizer,
+			AuditLog:         testServer.AuditLog,
+			Emitter:          testServer.AuditLog,
 		},
 		AuthServer: testServer,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, s.Close()) })
 
-	clt, err := s.NewClient(auth.TestAdmin())
+	clt, err := s.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, clt.Close()) })
 
 	ap := types.DefaultAuthPreference()
 	ap.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_LEGACY)
@@ -93,12 +99,13 @@ func TestValidateAuthPreferenceOnCloud(t *testing.T) {
 func TestValidateSessionRecordingConfigOnCloud(t *testing.T) {
 	ctx := context.Background()
 
-	testServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testServer.Close()) })
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Cloud: true,
@@ -157,6 +164,7 @@ func TestFeatures_ToProto(t *testing.T) {
 			string(entitlements.LicenseAutoUpdate):          {Enabled: true},
 			string(entitlements.AccessGraphDemoMode):        {Enabled: true},
 			string(entitlements.UnrestrictedManagedUpdates): {Enabled: true},
+			string(entitlements.ClientIPRestrictions):       {Enabled: true},
 		},
 		//	 Legacy Fields; remove in v18
 		Kubernetes:             true,
@@ -234,6 +242,7 @@ func TestFeatures_ToProto(t *testing.T) {
 			entitlements.LicenseAutoUpdate:          {Enabled: true, Limit: 0},
 			entitlements.AccessGraphDemoMode:        {Enabled: true, Limit: 0},
 			entitlements.UnrestrictedManagedUpdates: {Enabled: true, Limit: 0},
+			entitlements.ClientIPRestrictions:       {Enabled: true, Limit: 0},
 		},
 	}
 
diff --git a/lib/modules/modulestest/modules.go b/lib/modules/modulestest/modules.go
new file mode 100644
index 0000000000000..a245e093e67b3
--- /dev/null
+++ b/lib/modules/modulestest/modules.go
@@ -0,0 +1,159 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package modulestest
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/accesslist"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// Modules is an implementation of [modules.Modules] to be
+// used in tests that need to exercise various conditions
+// dictacted by a specific feature set.
+type Modules struct {
+	// TestBuild is returned from the BuildType function.
+	TestBuildType string
+	// TestFeatures is returned from the Features function.
+	TestFeatures modules.Features
+	// FIPS is returned from the IsBoringBinary function.
+	FIPS bool
+	// MockAttestationData is fake attestation data to return
+	// during tests when hardware key support is enabled. This
+	// attestation data is shared by all logins when set.
+	MockAttestationData *keys.AttestationData
+
+	GenerateAccessRequestPromotionsFn  func(ctx context.Context, accessListGetter modules.AccessResourcesGetter, accessReq types.AccessRequest) (*types.AccessRequestAllowedPromotions, error)
+	GenerateLongTermResourceGroupingFn func(ctx context.Context, clt modules.AccessResourcesGetter, req types.AccessRequest) (*types.LongTermResourceGrouping, error)
+}
+
+// AttestHardwareKey implements modules.Modules.
+func (m *Modules) AttestHardwareKey(context.Context, any, *hardwarekey.AttestationStatement, crypto.PublicKey, time.Duration) (*keys.AttestationData, error) {
+	if m.MockAttestationData != nil {
+		return m.MockAttestationData, nil
+	}
+	return nil, trace.NotFound("no attestation data for the given key")
+}
+
+// BuildType implements modules.Modules.
+func (m *Modules) BuildType() string {
+	return m.TestBuildType
+}
+
+// EnableAccessGraph implements modules.Modules.
+func (m *Modules) EnableAccessGraph() {}
+
+// EnableAccessMonitoring implements modules.Modules.
+func (m *Modules) EnableAccessMonitoring() {}
+
+// EnablePlugins implements modules.Modules.
+func (m *Modules) EnablePlugins() {}
+
+// EnableRecoveryCodes implements modules.Modules.
+func (m *Modules) EnableRecoveryCodes() {}
+
+// Features implements modules.Modules.
+func (m *Modules) Features() modules.Features {
+	return m.TestFeatures
+}
+
+// GenerateLongTermResourceGrouping implements modules.Modules.
+func (m *Modules) GenerateLongTermResourceGrouping(ctx context.Context, clt modules.AccessResourcesGetter, req types.AccessRequest) (*types.LongTermResourceGrouping, error) {
+	if m.GenerateLongTermResourceGroupingFn != nil {
+		return m.GenerateLongTermResourceGroupingFn(ctx, clt, req)
+	}
+	return nil, trace.NotImplemented("GenerateLongTermResourceGrouping not implemented")
+}
+
+// GenerateAccessRequestPromotions implements modules.Modules.
+func (m *Modules) GenerateAccessRequestPromotions(ctx context.Context, getter modules.AccessResourcesGetter, request types.AccessRequest) (*types.AccessRequestAllowedPromotions, error) {
+	if m.GenerateAccessRequestPromotionsFn != nil {
+		return m.GenerateAccessRequestPromotionsFn(ctx, getter, request)
+	}
+	return types.NewAccessRequestAllowedPromotions(nil), nil
+}
+
+// GetSuggestedAccessLists implements modules.Modules.
+func (m *Modules) GetSuggestedAccessLists(ctx context.Context, identity *tlsca.Identity, clt modules.AccessListSuggestionClient, accessListGetter modules.AccessListAndMembersGetter, requestID string) ([]*accesslist.AccessList, error) {
+	return nil, trace.NotImplemented("GetSuggestedAccessLists not implemented")
+}
+
+// IsBoringBinary implements modules.Modules.
+func (m *Modules) IsBoringBinary() bool {
+	return m.FIPS
+}
+
+// IsEnterpriseBuild implements modules.Modules.
+func (m *Modules) IsEnterpriseBuild() bool {
+	return m.BuildType() == modules.BuildEnterprise
+}
+
+// IsOSSBuild implements modules.Modules.
+func (m *Modules) IsOSSBuild() bool {
+	return m.BuildType() != modules.BuildEnterprise
+}
+
+// LicenseExpiry implements modules.Modules.
+func (m *Modules) LicenseExpiry() time.Time {
+	return time.Time{}
+}
+
+// PrintVersion implements modules.Modules.
+func (m *Modules) PrintVersion() {
+	fmt.Printf("Teleport v%s git:%s %s\n", teleport.Version, teleport.Gitref, runtime.Version())
+}
+
+// SetFeatures implements modules.Modules.
+func (m *Modules) SetFeatures(features modules.Features) {}
+
+// SetTestModules sets the value returned from GetModules to testModules
+// and reverts the change in the test cleanup function.
+// It cannot be used in parallel tests.
+//
+//	func TestWithFakeModules(t *testing.T) {
+//	   modules.SetTestModules(t, &modulestest.Modules{
+//	     TestBuildType: modules.BuildEnterprise,
+//	     TestFeatures: modules.Features{
+//	        Cloud: true,
+//	     },
+//	   })
+//
+//	   // test implementation
+//
+//	   // cleanup will revert module changes after test completes
+//	}
+//
+// TODO(tross): Get rid of global modules so this can be removed.
+func SetTestModules(tb testing.TB, testModules Modules) {
+	defaultModules := modules.GetModules()
+	tb.Cleanup(func() { modules.SetModules(defaultModules) })
+	tb.Setenv("TELEPORT_TEST_NOT_SAFE_FOR_PARALLEL", "true")
+	modules.SetModules(&testModules)
+}
diff --git a/lib/modules/test.go b/lib/modules/test.go
deleted file mode 100644
index efbe9c1e26684..0000000000000
--- a/lib/modules/test.go
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package modules
-
-import (
-	"context"
-	"crypto"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
-)
-
-// TestModules implements the Modules interface for testing.
-//
-// Setting Test* fields will return those values from interface
-// methods. IsBoringBinary and PrintVersion functions return the
-// same values from default modules.
-//
-// See SetTestModules for an example.
-type TestModules struct {
-	// TestBuildType is returned from the BuiltType function.
-	TestBuildType string
-	// TestFeatures is returned from the Features function.
-	TestFeatures Features
-	// FIPS allows tests to toggle fips behavior.
-	FIPS bool
-
-	defaultModules
-
-	// MockAttestationData is fake attestation data to return
-	// during tests when hardware key support is enabled. This
-	// attestation data is shared by all logins when set.
-	MockAttestationData *keys.AttestationData
-}
-
-// SetTestModules sets the value returned from GetModules to testModules
-// and reverts the change in the test cleanup function.
-// It must not be used in parallel tests.
-//
-//	func TestWithFakeModules(t *testing.T) {
-//	   modules.SetTestModules(t, &modules.TestModules{
-//	     TestBuildType: modules.BuildEnterprise,
-//	     TestFeatures: modules.Features{
-//	        Cloud: true,
-//	     },
-//	   })
-//
-//	   // test implementation
-//
-//	   // cleanup will revert module changes after test completes
-//	}
-func SetTestModules(t *testing.T, testModules Modules) {
-	defaultModules := GetModules()
-	t.Cleanup(func() { SetModules(defaultModules) })
-	t.Setenv("TELEPORT_TEST_NOT_SAFE_FOR_PARALLEL", "true")
-	SetModules(testModules)
-}
-
-// PrintVersion prints teleport version
-func (m *TestModules) PrintVersion() {
-	m.defaultModules.PrintVersion()
-}
-
-// IsBoringBinary checks if the binary was compiled with BoringCrypto.
-func (m *TestModules) IsBoringBinary() bool {
-	return m.FIPS
-}
-
-// Features returns supported features.
-func (m *TestModules) Features() Features {
-	return m.TestFeatures
-}
-
-// BuildType returns build type (OSS or Enterprise).
-func (m *TestModules) BuildType() string {
-	return m.TestBuildType
-}
-
-func (m *TestModules) IsEnterpriseBuild() bool {
-	return m.BuildType() == BuildEnterprise
-}
-
-func (m *TestModules) IsOSSBuild() bool {
-	return m.BuildType() != BuildEnterprise
-}
-
-// AttestHardwareKey attests a hardware key.
-func (m *TestModules) AttestHardwareKey(ctx context.Context, obj interface{}, as *hardwarekey.AttestationStatement, pk crypto.PublicKey, d time.Duration) (*keys.AttestationData, error) {
-	if m.MockAttestationData != nil {
-		return m.MockAttestationData, nil
-	}
-	return nil, trace.NotFound("no attestation data for the given key")
-}
diff --git a/lib/msgraph/client.go b/lib/msgraph/client.go
index 3c98f8e6c944b..4f74ed1531ce3 100644
--- a/lib/msgraph/client.go
+++ b/lib/msgraph/client.go
@@ -21,8 +21,10 @@ import (
 	"cmp"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -31,16 +33,22 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 
+	"github.com/gravitational/teleport"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
-// baseURL is the default value for [client.baseURL]. It is the address of MS Graph API v1.0.
-const baseURL = "https://graph.microsoft.com/v1.0"
+// graphVersion is the default version of the MS Graph API endpoint.
+const graphVersion = "v1.0"
 
 // defaultPageSize is the page size used when [Config.PageSize] is not specified.
 const defaultPageSize = 500
@@ -51,6 +59,9 @@ var scopes = []string{"https://graph.microsoft.com/.default"}
 // AzureTokenProvider defines a method to get an authorization token from the Entra STS.
 // Concrete implementations of this are defined by [github.com/Azure/azure-sdk-for-go/sdk/azidentity].
 type AzureTokenProvider interface {
+	// GetToken requests an access token from Microsoft Entra ID. Token providers from azidentity
+	// return cached tokens whenever possible and are safe for concurrent use.
+	// https://github.com/Azure/azure-sdk-for-go/blob/sdk/azidentity/v1.11.0/sdk/azidentity/TOKEN_CACHING.MD
 	GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error)
 }
 
@@ -85,6 +96,12 @@ type Config struct {
 	RetryConfig *retryutils.RetryV2Config
 	// PageSize limits the number of objects to return in one batch when using paginated requests (via the `$top` parameter).
 	PageSize int
+	// GraphEndpoint specifies root domain of the Graph API.
+	GraphEndpoint string
+	Logger        *slog.Logger
+	// MetricsRegistry configures where metrics should be registered.
+	// When nil, metrics are created but not registered.
+	MetricsRegistry *metrics.Registry
 }
 
 // SetDefaults sets the default values for optional fields.
@@ -101,6 +118,15 @@ func (cfg *Config) SetDefaults() {
 	if cfg.PageSize <= 0 {
 		cfg.PageSize = defaultPageSize
 	}
+	if cfg.GraphEndpoint == "" {
+		cfg.GraphEndpoint = types.MSGraphDefaultEndpoint
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.With(teleport.ComponentKey, "msgraph")
+	}
+	if cfg.MetricsRegistry == nil {
+		cfg.MetricsRegistry = metrics.NoopRegistry()
+	}
 }
 
 // Validate checks that required fields are set.
@@ -111,6 +137,9 @@ func (cfg *Config) Validate() error {
 	if cfg.HTTPClient == nil {
 		return trace.BadParameter("HTTPClient must be set")
 	}
+	if err := types.ValidateMSGraphEndpoints("", cfg.GraphEndpoint); err != nil {
+		return trace.Wrap(err)
+	}
 	return nil
 }
 
@@ -121,6 +150,8 @@ type Client struct {
 	retryConfig   retryutils.RetryV2Config
 	baseURL       *url.URL
 	pageSize      int
+	logger        *slog.Logger
+	metrics       *clientMetrics
 }
 
 // NewClient returns a new client for the given config.
@@ -129,23 +160,34 @@ func NewClient(cfg Config) (*Client, error) {
 	if err := cfg.Validate(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	uri, err := url.Parse(baseURL)
+	base, err := url.Parse(cfg.GraphEndpoint)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	m := newMetrics(cfg.MetricsRegistry)
+	// gracefully handle not being given a metric registry
+	if err := m.register(cfg.MetricsRegistry); err != nil {
+		cfg.Logger.ErrorContext(context.Background(), "Failed to register metrics.", "error", err)
+	}
+
 	return &Client{
 		httpClient:    cfg.HTTPClient,
 		tokenProvider: cfg.TokenProvider,
 		clock:         cfg.Clock,
 		retryConfig:   *cfg.RetryConfig,
-		baseURL:       uri,
+		baseURL:       base.JoinPath(graphVersion),
 		pageSize:      cfg.PageSize,
+		logger:        cfg.Logger,
+		metrics:       m,
 	}, nil
 }
 
 // request is the base function for HTTP API calls.
 // It implements retry handling in case of API throttling, see [https://learn.microsoft.com/en-us/graph/throttling].
-func (c *Client) request(ctx context.Context, method string, uri string, payload []byte) (*http.Response, error) {
+// If the response from the Graph API has status code outside of [200, 400) range, request attempts
+// to parse the response body as [GraphError] and if successful returns it as error.
+func (c *Client) request(ctx context.Context, method string, uri string, header http.Header, payload []byte) (*http.Response, error) {
 	var body io.ReadSeeker = nil
 	if len(payload) > 0 {
 		body = bytes.NewReader(payload)
@@ -155,17 +197,15 @@ func (c *Client) request(ctx context.Context, method string, uri string, payload
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if body != nil {
-		req.Header.Add("Content-Type", "application/json")
+	for key := range header {
+		for _, value := range header.Values(key) {
+			req.Header.Add(key, value)
+		}
 	}
 
-	token, err := c.tokenProvider.GetToken(ctx, policy.TokenRequestOptions{
-		Scopes: scopes,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to get azure authentication token")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
 	}
-	req.Header.Add("Authorization", "Bearer "+token.Token)
 
 	const maxRetries = 5
 	var retryAfter time.Duration
@@ -177,7 +217,8 @@ func (c *Client) request(ctx context.Context, method string, uri string, payload
 	}
 
 	var lastErr error
-	for i := 0; i < maxRetries; i++ {
+	var start time.Time
+	for range maxRetries {
 		if retryAfter > 0 {
 			select {
 			case <-c.clock.After(retryAfter):
@@ -185,18 +226,56 @@ func (c *Client) request(ctx context.Context, method string, uri string, payload
 				return nil, trace.NewAggregate(ctx.Err(), trace.Wrap(lastErr, "%s %s", req.Method, req.URL.Path))
 			}
 		}
+		token, err := c.tokenProvider.GetToken(ctx, policy.TokenRequestOptions{
+			Scopes: scopes,
+		})
+		if err != nil {
+			authFailedError := &azidentity.AuthenticationFailedError{}
+			if ok := errors.As(err, &authFailedError); ok && authFailedError.RawResponse != nil &&
+				authFailedError.RawResponse.Body != nil {
+				resp := authFailedError.RawResponse
+				authError, conversionErr := readAuthError(resp.Body, resp.StatusCode)
+				resp.Body.Close()
+				if conversionErr == nil {
+					err = authError
+				}
+			}
+			return nil, trace.Wrap(err, "failed to get azure authentication token")
+		}
+		req.Header.Set("Authorization", "Bearer "+token.Token)
+
+		requestID := uuid.NewString()
+		// https://learn.microsoft.com/en-us/graph/best-practices-concept#reliability-and-support
+		req.Header.Set("client-request-id", requestID)
 
+		start = c.clock.Now()
 		resp, err := c.httpClient.Do(req)
 		if err != nil {
 			return nil, trace.Wrap(err) // hard I/O error, bail
 		}
+		c.metrics.requestDuration.WithLabelValues(method).Observe(c.clock.Since(start).Seconds())
+		c.metrics.requestTotal.WithLabelValues(method, strconv.Itoa(resp.StatusCode))
 
 		if resp.StatusCode >= 200 && resp.StatusCode < 400 {
 			return resp, nil
 		}
 
-		graphError, err := readError(resp.Body)
-		resp.Body.Close()
+		respBody, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if err := resp.Body.Close(); err != nil {
+			c.logger.WarnContext(req.Context(), "Failed to close http.Response body", "error", err)
+		}
+
+		c.logger.DebugContext(req.Context(), "Request failed",
+			"body", string(respBody),
+			"status", resp.StatusCode,
+			"url", req.URL,
+			"client_request_id", requestID,
+		)
+
+		graphError, err := readError(respBody, resp.StatusCode)
 		if err != nil {
 			lastErr = err // error while reading the graph error, relay
 		} else if graphError != nil {
@@ -255,7 +334,7 @@ func roundtrip[T any](ctx context.Context, c *Client, method string, uri string,
 			return zero, trace.Wrap(err)
 		}
 	}
-	resp, err := c.request(ctx, method, uri, body)
+	resp, err := c.request(ctx, method, uri, nil /* extra headers */, body)
 	if err != nil {
 		return zero, trace.Wrap(err)
 	}
@@ -275,7 +354,7 @@ func (c *Client) patch(ctx context.Context, uri string, in any) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	resp, err := c.request(ctx, http.MethodPatch, uri, body)
+	resp, err := c.request(ctx, http.MethodPatch, uri, nil /* extra headers */, body)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/msgraph/client_test.go b/lib/msgraph/client_test.go
index 174b8f924ce14..1347a42a536cb 100644
--- a/lib/msgraph/client_test.go
+++ b/lib/msgraph/client_test.go
@@ -18,13 +18,16 @@ package msgraph
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strconv"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -36,6 +39,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 )
 
@@ -46,14 +50,40 @@ var retryConfig = retryutils.RetryV2Config{
 	Driver: retryutils.NewLinearDriver(time.Second),
 }
 
-type fakeTokenProvider struct{}
+type fakeTokenProvider struct {
+	mu    sync.Mutex
+	token string
+}
 
 func (t *fakeTokenProvider) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	if t.token == "" {
+		t.token = uuid.NewString()
+	}
+
 	return azcore.AccessToken{
-		Token: "foo",
+		Token: t.token,
 	}, nil
 }
 
+func (t *fakeTokenProvider) clearToken() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.token = ""
+}
+
+// inspectToken returns the current token without generating a new one if the current token is
+// empty. Useful in tests that need to verify that the client requested a new token after it was
+// cleared.
+func (t *fakeTokenProvider) inspectToken() string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	return t.token
+}
+
 const usersPayload = `[
     {
     	"businessPhones": [],
@@ -148,7 +178,7 @@ func paginatedHandler(t *testing.T, values []json.RawMessage) http.Handler {
 
 		nextLink := *r.URL
 		nextLink.Host = r.Host
-		nextLink.Scheme = "http"
+		nextLink.Scheme = "https"
 		vals := nextLink.Query()
 		// $skipToken is an opaque value in MS Graph, for testing purposes we use a simple offset.
 		vals.Set("$skipToken", strconv.Itoa(top+skip))
@@ -168,25 +198,22 @@ func TestIterateUsers_Empty(t *testing.T) {
 	t.Parallel()
 
 	mux := http.NewServeMux()
-	mux.HandleFunc("GET /users", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("GET /v1.0/users", func(w http.ResponseWriter, r *http.Request) {
 		_, err := strconv.Atoi(r.URL.Query().Get("$top"))
 		assert.NoError(t, err, "expected to get $top parameter")
 		w.Write([]byte(`{"value": []}`))
 	})
 
-	srv := httptest.NewServer(mux)
+	srv := httptest.NewTLSServer(mux)
 	t.Cleanup(func() { srv.Close() })
 
-	uri, err := url.Parse(srv.URL)
+	client, err := NewClient(Config{
+		HTTPClient:    newHTTPClient(srv),
+		TokenProvider: &fakeTokenProvider{},
+		RetryConfig:   &retryConfig,
+	})
 	require.NoError(t, err)
-	client := &Client{
-		httpClient:    &http.Client{},
-		tokenProvider: &fakeTokenProvider{},
-		retryConfig:   retryConfig,
-		baseURL:       uri,
-		pageSize:      defaultPageSize,
-	}
-	err = client.IterateUsers(context.Background(), func(*User) bool {
+	err = client.IterateUsers(t.Context(), func(*User) bool {
 		assert.Fail(t, "should never get called")
 		return true
 	})
@@ -199,23 +226,21 @@ func TestIterateUsers(t *testing.T) {
 	var sourceUsers []json.RawMessage
 	require.NoError(t, json.Unmarshal([]byte(usersPayload), &sourceUsers))
 	mux := http.NewServeMux()
-	mux.Handle("GET /users", paginatedHandler(t, sourceUsers))
+	mux.Handle("GET /v1.0/users", paginatedHandler(t, sourceUsers))
 
-	srv := httptest.NewServer(mux)
+	srv := httptest.NewTLSServer(mux)
 	t.Cleanup(func() { srv.Close() })
 
-	uri, err := url.Parse(srv.URL)
+	client, err := NewClient(Config{
+		HTTPClient:    newHTTPClient(srv),
+		TokenProvider: &fakeTokenProvider{},
+		RetryConfig:   &retryConfig,
+		PageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
+	})
 	require.NoError(t, err)
-	client := &Client{
-		httpClient:    &http.Client{},
-		tokenProvider: &fakeTokenProvider{},
-		retryConfig:   retryConfig,
-		baseURL:       uri,
-		pageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
-	}
 
 	var users []*User
-	err = client.IterateUsers(context.Background(), func(u *User) bool {
+	err = client.IterateUsers(t.Context(), func(u *User) bool {
 		users = append(users, u)
 		return true
 	})
@@ -280,7 +305,7 @@ func TestRetry(t *testing.T) {
 	t.Parallel()
 
 	appID := uuid.NewString()
-	route := "POST /applications/" + appID + "/federatedIdentityCredentials"
+	route := "POST /v1.0/applications/" + appID + "/federatedIdentityCredentials"
 	name := "foo"
 	fic := &FederatedIdentityCredential{Name: &name}
 	objPayload, err := json.Marshal(fic)
@@ -300,33 +325,31 @@ func TestRetry(t *testing.T) {
 		mux := http.NewServeMux()
 		mux.Handle(route, handler)
 
-		srv := httptest.NewServer(mux)
+		srv := httptest.NewTLSServer(mux)
 		t.Cleanup(func() { srv.Close() })
 
-		uri, err := url.Parse(srv.URL)
+		client, err := NewClient(Config{
+			HTTPClient:    newHTTPClient(srv),
+			TokenProvider: &fakeTokenProvider{},
+			RetryConfig:   &retryConfig,
+			Clock:         clock,
+		})
 		require.NoError(t, err)
-		client := &Client{
-			httpClient:    &http.Client{},
-			tokenProvider: &fakeTokenProvider{},
-			clock:         clock,
-			retryConfig:   retryConfig,
-			baseURL:       uri,
-		}
 
 		ret := make(chan error, 1)
 		go func() {
-			out, err := client.CreateFederatedIdentityCredential(context.Background(), appID, fic)
+			out, err := client.CreateFederatedIdentityCredential(t.Context(), appID, fic)
 			assert.Equal(t, fic, out)
 			ret <- err
 		}()
 
 		// Fail for the first time
-		clock.BlockUntil(1)
+		clock.BlockUntilContext(t.Context(), 1)
 		require.EqualValues(t, 1, handler.timesCalled.Load())
 
 		// Fail for the second time
 		clock.Advance(time.Duration(handler.retryAfter) * time.Second)
-		clock.BlockUntil(1)
+		clock.BlockUntilContext(t.Context(), 1)
 		require.EqualValues(t, 2, handler.timesCalled.Load())
 
 		// Succeed
@@ -351,33 +374,32 @@ func TestRetry(t *testing.T) {
 		mux := http.NewServeMux()
 		mux.Handle(route, handler)
 
-		srv := httptest.NewServer(mux)
+		srv := httptest.NewTLSServer(mux)
 		t.Cleanup(func() { srv.Close() })
 
-		uri, err := url.Parse(srv.URL)
+		client, err := NewClient(Config{
+			HTTPClient:    newHTTPClient(srv),
+			TokenProvider: &fakeTokenProvider{},
+			RetryConfig:   &retryConfig,
+			PageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
+			Clock:         clock,
+		})
 		require.NoError(t, err)
-		client := &Client{
-			httpClient:    &http.Client{},
-			tokenProvider: &fakeTokenProvider{},
-			clock:         clock,
-			retryConfig:   retryConfig,
-			baseURL:       uri,
-		}
 
 		ret := make(chan error, 1)
 		go func() {
-			out, err := client.CreateFederatedIdentityCredential(context.Background(), appID, fic)
+			out, err := client.CreateFederatedIdentityCredential(t.Context(), appID, fic)
 			assert.Equal(t, fic, out)
 			ret <- err
 		}()
 
 		// Fail for the first time
-		clock.BlockUntil(1)
+		clock.BlockUntilContext(t.Context(), 1)
 		require.EqualValues(t, 1, handler.timesCalled.Load())
 
 		// Fail for the second time
 		clock.Advance(time.Second)
-		clock.BlockUntil(1)
+		clock.BlockUntilContext(t.Context(), 1)
 		require.EqualValues(t, 2, handler.timesCalled.Load())
 
 		// Succeed
@@ -401,21 +423,79 @@ func TestRetry(t *testing.T) {
 		mux := http.NewServeMux()
 		mux.Handle(route, handler)
 
-		srv := httptest.NewServer(mux)
+		srv := httptest.NewTLSServer(mux)
 		t.Cleanup(func() { srv.Close() })
 
-		uri, err := url.Parse(srv.URL)
+		client, err := NewClient(Config{
+			HTTPClient:    newHTTPClient(srv),
+			TokenProvider: &fakeTokenProvider{},
+			RetryConfig:   &retryConfig,
+			Clock:         clock,
+		})
 		require.NoError(t, err)
-		client := &Client{
-			httpClient:    &http.Client{},
-			tokenProvider: &fakeTokenProvider{},
-			clock:         clock,
-			baseURL:       uri,
-		}
 
-		_, err = client.CreateFederatedIdentityCredential(context.Background(), appID, fic)
+		_, err = client.CreateFederatedIdentityCredential(t.Context(), appID, fic)
 		require.Error(t, err)
 	})
+
+	// This test simulates a situation in which the token expires between retries. It verifies that
+	// the client requests a token before each retry rather than requesting it just once before it
+	// enters the retry loop.
+	t.Run("refreshing token between retries", func(t *testing.T) {
+		handler := &failingHandler{
+			t:              t,
+			timesToFail:    1,
+			statusCode:     http.StatusTooManyRequests,
+			expectedBody:   objPayload,
+			successPayload: objPayload,
+			retryAfter:     10,
+		}
+		mux := http.NewServeMux()
+		mux.Handle(route, handler)
+
+		srv := httptest.NewTLSServer(mux)
+		t.Cleanup(func() { srv.Close() })
+
+		tokenProvider := &fakeTokenProvider{}
+		client, err := NewClient(Config{
+			HTTPClient:    newHTTPClient(srv),
+			TokenProvider: tokenProvider,
+			Clock:         clock,
+			RetryConfig:   &retryConfig,
+		})
+		require.NoError(t, err)
+
+		ret := make(chan error, 1)
+		go func() {
+			out, err := client.CreateFederatedIdentityCredential(context.Background(), appID, fic)
+			assert.Equal(t, fic, out)
+			ret <- err
+		}()
+
+		// First failure, the client now waits before retrying.
+		require.NoError(t, clock.BlockUntilContext(t.Context(), 1))
+		require.EqualValues(t, 1, handler.timesCalled.Load())
+		tokenBefore := tokenProvider.inspectToken()
+		require.NotEmpty(t, tokenBefore)
+
+		// Clear the token to simulate expiry.
+		tokenProvider.clearToken()
+
+		// Advance time to make the client try again.
+		clock.Advance(time.Duration(handler.retryAfter) * time.Second)
+		select {
+		case err := <-ret:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			require.Fail(t, "expected client to return")
+		}
+
+		tokenAfter := tokenProvider.inspectToken()
+		require.NotEmpty(t, tokenAfter,
+			"the client did not request a new token after the previous one was cleared")
+		require.NotEqual(t, tokenAfter, tokenBefore,
+			"the client did not get a new token for the second request")
+	})
 }
 
 const listGroupsMembersPayload = `[
@@ -443,23 +523,21 @@ func TestIterateGroupMembers(t *testing.T) {
 	require.NoError(t, json.Unmarshal([]byte(listGroupsMembersPayload), &membersJSON))
 	mux := http.NewServeMux()
 	groupID := "fd5be192-6e51-4f54-bbdf-30407435ceb7"
-	mux.Handle("GET /groups/"+groupID+"/members", paginatedHandler(t, membersJSON))
+	mux.Handle("GET /v1.0/groups/"+groupID+"/members", paginatedHandler(t, membersJSON))
 
-	srv := httptest.NewServer(mux)
+	srv := httptest.NewTLSServer(mux)
 	t.Cleanup(func() { srv.Close() })
 
-	uri, err := url.Parse(srv.URL)
+	client, err := NewClient(Config{
+		HTTPClient:    newHTTPClient(srv),
+		TokenProvider: &fakeTokenProvider{},
+		RetryConfig:   &retryConfig,
+		PageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
+	})
 	require.NoError(t, err)
-	client := &Client{
-		httpClient:    &http.Client{},
-		tokenProvider: &fakeTokenProvider{},
-		retryConfig:   retryConfig,
-		baseURL:       uri,
-		pageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
-	}
 
 	var members []GroupMember
-	err = client.IterateGroupMembers(context.Background(), groupID, func(u GroupMember) bool {
+	err = client.IterateGroupMembers(t.Context(), groupID, func(u GroupMember) bool {
 		members = append(members, u)
 		return true
 	})
@@ -509,25 +587,23 @@ func TestGetApplication(t *testing.T) {
 
 	mux := http.NewServeMux()
 	appID := "d2a39a2a-1636-457f-82f9-c2d76527e20e"
-	mux.Handle(fmt.Sprintf("GET /applications(appId='%s')", appID),
+	mux.Handle(fmt.Sprintf("GET /v1.0/applications(appId='%s')", appID),
 		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Write([]byte(getApplicationPayload))
 		}))
 
-	srv := httptest.NewServer(mux)
+	srv := httptest.NewTLSServer(mux)
 	t.Cleanup(func() { srv.Close() })
 
-	uri, err := url.Parse(srv.URL)
+	client, err := NewClient(Config{
+		TokenProvider: &fakeTokenProvider{},
+		HTTPClient:    newHTTPClient(srv),
+		RetryConfig:   &retryConfig,
+		PageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
+	})
 	require.NoError(t, err)
-	client := &Client{
-		httpClient:    &http.Client{},
-		tokenProvider: &fakeTokenProvider{},
-		retryConfig:   retryConfig,
-		baseURL:       uri,
-		pageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
-	}
 
-	app, err := client.GetApplication(context.Background(), appID)
+	app, err := client.GetApplication(t.Context(), appID)
 	require.NoError(t, err)
 	require.Equal(t, "aeee7e9f-57ad-4ea6-a236-cd10b2dbc0b4", *app.ID)
 
@@ -557,3 +633,194 @@ func TestGetApplication(t *testing.T) {
 }
 
 func toPtr[T any](s T) *T { return &s }
+
+func TestNewClient(t *testing.T) {
+	tests := []struct {
+		name                  string
+		config                Config
+		expectedGraphEndpoint string
+		errExpected           bool
+		errAssertion          require.ErrorAssertionFunc
+	}{
+		{
+			name: "empty endpoint sets default graph endpoint",
+			config: Config{
+				TokenProvider: &fakeTokenProvider{},
+				GraphEndpoint: "",
+			},
+			expectedGraphEndpoint: types.MSGraphDefaultEndpoint,
+			errAssertion:          require.NoError,
+		},
+		{
+			name: "configured endpoint",
+			config: Config{
+				TokenProvider: &fakeTokenProvider{},
+				GraphEndpoint: "https://dod-graph.microsoft.us",
+			},
+			expectedGraphEndpoint: "https://dod-graph.microsoft.us",
+			errAssertion:          require.NoError,
+		},
+		{
+			name: "invalid endpoint",
+			config: Config{
+				TokenProvider: &fakeTokenProvider{},
+				GraphEndpoint: "https://graph.windows.net",
+			},
+			errExpected:  true,
+			errAssertion: require.Error,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			clt, err := NewClient(test.config)
+			test.errAssertion(t, err)
+			if !test.errExpected {
+				require.Equal(t, test.expectedGraphEndpoint+"/"+graphVersion, clt.baseURL.String())
+			}
+		})
+	}
+}
+
+func TestIterateUsersTransitiveMemberOf(t *testing.T) {
+	userID := "9ef1bc41-1b26-4a66-b8bc-956b2a54f8dc"
+	allGroupsPath := fmt.Sprintf("/%s/users/%s/transitiveMemberOf", graphVersion, userID)
+	groupsPath := fmt.Sprintf("/%s/users/%s/transitiveMemberOf/%s", graphVersion, userID, graphNamespaceGroups)
+	directoryRolePath := fmt.Sprintf("/%s/users/%s/transitiveMemberOf/%s", graphVersion, userID, graphNamespaceDirectoryRoles)
+
+	consistencyHeaderValue := ""
+	foundQuery := make(url.Values)
+	requestedPath := ""
+	withRequestChecker := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestedPath = r.URL.Path
+			consistencyHeaderValue = r.Header.Get("ConsistencyLevel")
+			foundQuery = r.URL.Query()
+			next.ServeHTTP(w, r)
+		})
+	}
+
+	mux := http.NewServeMux()
+	var groups []json.RawMessage
+	require.NoError(t, json.Unmarshal([]byte(userGroups), &groups))
+	mux.Handle("GET "+allGroupsPath, withRequestChecker(paginatedHandler(t, groups)))
+	mux.Handle("GET "+groupsPath, withRequestChecker(paginatedHandler(t, groups)))
+	mux.Handle("GET "+directoryRolePath, withRequestChecker(paginatedHandler(t, groups)))
+	srv := httptest.NewTLSServer(mux)
+	t.Cleanup(func() { srv.Close() })
+
+	client, err := NewClient(Config{
+		HTTPClient:    newHTTPClient(srv),
+		TokenProvider: &fakeTokenProvider{},
+		RetryConfig:   &retryConfig,
+		PageSize:      2, // smaller page size so we actually fetch multiple pages with our small test payload
+	})
+	require.NoError(t, err)
+
+	assertConsistencyLevelHeader := func(t *testing.T, h string) {
+		t.Helper()
+		require.Equal(t, "eventual", h, "request made without ConsistencyLevel header")
+	}
+	assertCountQuery := func(t *testing.T, c string) {
+		t.Helper()
+		require.Equal(t, "true", c, "request made without $count query")
+	}
+	assertRequestedPath := func(t *testing.T, e, p string) {
+		t.Helper()
+		require.Equal(t, e, p, "expected request path did not match")
+	}
+
+	t.Run(types.EntraIDSecurityGroups, func(t *testing.T) {
+		var groupIDs []string
+		err := client.IterateUsersTransitiveMemberOf(t.Context(), userID, types.EntraIDSecurityGroups, func(group *Group) bool {
+			groupIDs = append(groupIDs, *group.ID)
+			return true
+		})
+		require.NoError(t, err)
+		require.Len(t, groupIDs, 5)
+
+		filterValue, err := url.QueryUnescape(foundQuery.Get("$filter"))
+		require.NoError(t, err)
+		require.Equal(t, securityGroupsFilter, filterValue, "security groups request made without filter query")
+		assertConsistencyLevelHeader(t, consistencyHeaderValue)
+		assertRequestedPath(t, groupsPath, requestedPath)
+		assertCountQuery(t, foundQuery.Get("$count"))
+	})
+
+	t.Run(types.EntraIDAllGroups, func(t *testing.T) {
+		var groupIDs []string
+		err := client.IterateUsersTransitiveMemberOf(t.Context(), userID, types.EntraIDAllGroups, func(group *Group) bool {
+			groupIDs = append(groupIDs, *group.ID)
+			return true
+		})
+		require.NoError(t, err)
+		require.Len(t, groupIDs, 5)
+
+		require.Empty(t, foundQuery.Get("$filter"), "non security groups request made with filter query")
+		assertConsistencyLevelHeader(t, consistencyHeaderValue)
+		assertRequestedPath(t, allGroupsPath, requestedPath)
+		assertCountQuery(t, foundQuery.Get("$count"))
+	})
+
+	t.Run(types.EntraIDDirectoryRoles, func(t *testing.T) {
+		var groupIDs []string
+		err := client.IterateUsersTransitiveMemberOf(t.Context(), userID, types.EntraIDDirectoryRoles, func(group *Group) bool {
+			groupIDs = append(groupIDs, *group.ID)
+			return true
+		})
+		require.NoError(t, err)
+		require.Len(t, groupIDs, 5)
+
+		require.Empty(t, foundQuery.Get("$filter"), "non security groups request made with filter query")
+		assertConsistencyLevelHeader(t, consistencyHeaderValue)
+		assertRequestedPath(t, directoryRolePath, requestedPath)
+		assertCountQuery(t, foundQuery.Get("$count"))
+	})
+
+	t.Run("unsupported-group-type", func(t *testing.T) {
+		var groupIDs []string
+		err := client.IterateUsersTransitiveMemberOf(t.Context(), userID, "unsupported-group-type", func(group *Group) bool {
+			groupIDs = append(groupIDs, *group.ID)
+			return true
+		})
+		require.Error(t, err)
+	})
+}
+
+var userGroups = `
+[
+	{
+		"id": "07af5ddc-0f6b-4237-8b3c-64815501d1d5"
+	},
+	{
+		"id": "dd034a93-4ac3-4095-8b9e-f521ad7eace9"
+	},
+	{
+		"id": "20b81a2c-fda0-41e7-8268-48a014be0b08"
+	},
+	{
+		"id": "97336101-e9a4-4455-9d19-945fd9178ff6"
+	},
+	{
+		"id": "76c1db72-be9c-4ed5-8a42-bdeec6a34502"
+	}
+]
+`
+
+func newHTTPClient(server *httptest.Server) *http.Client {
+	var d net.Dialer
+	httpClient := server.Client()
+	httpClient.Transport = &http.Transport{
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true,
+		},
+		// Ignore the address and always direct all requests to the fake API server.
+		// This allows tests to connect to the fake API server despite the client trying to reach the
+		// official endpoints.
+		DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return d.DialContext(ctx, "tcp", server.Listener.Addr().String())
+		},
+	}
+	return httpClient
+}
diff --git a/lib/msgraph/creds.go b/lib/msgraph/creds.go
new file mode 100644
index 0000000000000..06b0a598dbdcc
--- /dev/null
+++ b/lib/msgraph/creds.go
@@ -0,0 +1,89 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// VerifyCredentials checks if the credentials supplied to the client can be used to authenticate to
+// the Graph API and if they're authorized to get specific resources.
+package msgraph
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"slices"
+
+	"github.com/gravitational/trace"
+)
+
+var (
+	// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to
+	// the tenant not being found. It might also point to the subscription no longer being active.
+	ErrTenantNotFound = errors.New("tenant not found")
+	// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due
+	// to an invalid client ID or secret.
+	ErrInvalidCredentials = errors.New("invalid Graph API credentials")
+	// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app
+	// either doesn't have the permission required to access certain resources or the permission
+	// hasn't been grated by the administrator yet.
+	ErrClientUnauthorized = errors.New("authentication was successful but application does not have necessary permissions")
+)
+
+// IsCredentialsError determines whether err is one of the special errors returned by
+// [Client.VerifyCredentials].
+func IsCredentialsError(err error) bool {
+	return errors.Is(err, ErrTenantNotFound) ||
+		errors.Is(err, ErrInvalidCredentials) ||
+		errors.Is(err, ErrClientUnauthorized)
+}
+
+// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the
+// returned error to check for Graph or token errors related to credentials being insufficient in
+// some way.
+func (c *Client) VerifyCredentials(ctx context.Context, getResourcesFunc func(ctx context.Context, client *Client) error) error {
+	err := getResourcesFunc(ctx, c)
+
+	graphError := &GraphError{}
+	isGraphError := errors.As(err, &graphError)
+	authError := &AuthError{}
+	isAuthError := errors.As(err, &authError)
+
+	switch {
+	case isAuthError &&
+		(slices.Contains(authError.DiagCodes, DiagCodeTenantNotFound) ||
+			slices.Contains(authError.DiagCodes, DiagCodeInvalidTenantIdentifier)):
+		return trace.Wrap(ErrTenantNotFound, authError.ErrorDescription)
+
+	case isAuthError && authError.StatusCode == http.StatusBadRequest &&
+		authError.ErrorCode == "unauthorized_client":
+		// It likely means that the provided client ID doesn't exist under this tenant.
+		// https://login.microsoftonline.com/error?code=700016
+		return trace.Wrap(ErrInvalidCredentials, authError.ErrorDescription)
+
+	case isAuthError && authError.StatusCode == http.StatusUnauthorized:
+		// It likely means that the provided client secret doesn't match the client ID.
+		// https://login.microsoftonline.com/error?code=7000215
+		return trace.Wrap(ErrInvalidCredentials, authError.ErrorDescription)
+
+	case isGraphError && graphError.StatusCode == http.StatusUnauthorized:
+		// In this situation, the Graph API returns a very verbose and unhelpful error, hence why it's
+		// caught here and a more specific error is returned. On the off chance that the Graph API
+		// starts returning a more helpful message, let's also log it.
+		c.logger.WarnContext(ctx, "Graph API status unauthorized", "error", err)
+		return trace.Wrap(ErrClientUnauthorized)
+
+	default:
+		return trace.Wrap(err, "verifying Graph API credentials")
+	}
+}
diff --git a/lib/msgraph/creds_test.go b/lib/msgraph/creds_test.go
new file mode 100644
index 0000000000000..6d72e44b4080c
--- /dev/null
+++ b/lib/msgraph/creds_test.go
@@ -0,0 +1,172 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+package msgraph
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/fake"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVerifyCredentials(t *testing.T) {
+	resourceID := "foo"
+	graphErr := &GraphError{}
+	mux := http.NewServeMux()
+	mux.Handle(fmt.Sprintf("GET /v1.0/applications(appId='%s')", resourceID),
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			graphResponse := &graphErrorResponse{
+				Error: graphErr,
+			}
+			body, err := json.Marshal(graphResponse)
+			if !assert.NoError(t, err) {
+				return
+			}
+
+			w.WriteHeader(graphErr.StatusCode)
+			_, err = w.Write(body)
+			assert.NoError(t, err)
+		}))
+	srv := httptest.NewTLSServer(mux)
+	t.Cleanup(func() { srv.Close() })
+
+	tests := []struct {
+		name         string
+		tokenErr     error
+		graphErr     *GraphError
+		errAssertion require.ErrorAssertionFunc
+	}{
+		{
+			name: "tenant not found",
+			tokenErr: authErrorToSDKAuthFailedError(t, &AuthError{
+				ErrorCode:        "invalid_request",
+				ErrorDescription: "tenant not found",
+				DiagCodes:        []int{DiagCodeTenantNotFound},
+				StatusCode:       400,
+			}),
+			errAssertion: errorIs(ErrTenantNotFound),
+		},
+		{
+			name: "invalid tenant identifier",
+			tokenErr: authErrorToSDKAuthFailedError(t, &AuthError{
+				ErrorCode:        "invalid_request",
+				ErrorDescription: "tenant not found",
+				DiagCodes:        []int{DiagCodeInvalidTenantIdentifier},
+				StatusCode:       400,
+			}),
+			errAssertion: errorIs(ErrTenantNotFound),
+		},
+		{
+			name: "invalid client ID",
+			tokenErr: authErrorToSDKAuthFailedError(t, &AuthError{
+				ErrorCode:        "unauthorized_client",
+				ErrorDescription: "app not found",
+				StatusCode:       400,
+			}),
+			errAssertion: errorIs(ErrInvalidCredentials),
+		},
+		{
+			name: "invalid client secret",
+			tokenErr: authErrorToSDKAuthFailedError(t, &AuthError{
+				ErrorCode:        "invalid_client",
+				ErrorDescription: "invalid client secret provided",
+				StatusCode:       401,
+			}),
+			errAssertion: errorIs(ErrInvalidCredentials),
+		},
+		{
+			name: "insufficient permissions",
+			graphErr: &GraphError{
+				StatusCode: 401,
+				Code:       "InvalidAuthenticationToken",
+				Message:    "invalid authentication token",
+			},
+			errAssertion: errorIs(ErrClientUnauthorized),
+		},
+		{
+			name:         "unknown token error",
+			tokenErr:     errors.New("something went wrong with token"),
+			errAssertion: errorIsNotCredentialsError,
+		},
+		{
+			name: "unknown graph error",
+			graphErr: &GraphError{
+				StatusCode: 400,
+				Code:       "whoops",
+				Message:    "something went wrong",
+			},
+			errAssertion: errorIsNotCredentialsError,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// There's no way to clear an error from [fake.TokenCredential] once it's set, hence why
+			// together with a client it needs to be created within each individual test.
+			tokenProvider := &fake.TokenCredential{}
+			client, err := NewClient(Config{
+				TokenProvider: tokenProvider,
+				HTTPClient:    newHTTPClient(srv),
+			})
+			require.NoError(t, err)
+
+			if tt.tokenErr != nil {
+				tokenProvider.SetError(tt.tokenErr)
+			}
+			graphErr = tt.graphErr
+
+			err = client.VerifyCredentials(t.Context(), func(ctx context.Context, client *Client) error {
+				_, err := client.GetApplication(ctx, resourceID)
+				return err
+			})
+			tt.errAssertion(t, err)
+		})
+	}
+}
+
+func authErrorToSDKAuthFailedError(t *testing.T, authErr *AuthError) *azidentity.AuthenticationFailedError {
+	b, err := json.Marshal(authErr)
+	require.NoError(t, err)
+
+	sdkErr := azidentity.AuthenticationFailedError{}
+	sdkErr.RawResponse = &http.Response{
+		Body:       io.NopCloser(bytes.NewReader(b)),
+		StatusCode: authErr.StatusCode,
+	}
+
+	return &sdkErr
+}
+
+func errorIs(target error) require.ErrorAssertionFunc {
+	return func(t require.TestingT, err error, _ ...any) {
+		require.ErrorIs(t, err, target)
+	}
+}
+
+func errorIsNotCredentialsError(t require.TestingT, err error, _ ...any) {
+	require.Error(t, err)
+	require.False(t, IsCredentialsError(err))
+}
diff --git a/lib/msgraph/errors.go b/lib/msgraph/errors.go
index 5cad90a0bc5ab..37afebe8e7825 100644
--- a/lib/msgraph/errors.go
+++ b/lib/msgraph/errors.go
@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"strconv"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -40,11 +41,21 @@ type graphErrorResponse struct {
 }
 
 // GraphError defines the structure of errors returned from MS Graph API.
+// https://learn.microsoft.com/en-us/graph/errors#json-representation
 type GraphError struct {
-	Code       string       `json:"code,omitempty"`
-	Message    string       `json:"message,omitempty"`
-	InnerError *GraphError  `json:"innerError,omitempty"`
-	Details    []GraphError `json:"details,omitempty"`
+	// Code is the code for the error, e.g. "UnknownError", "BadRequest".
+	Code string `json:"code,omitempty"`
+	// Message is a developer ready message about the error that occurred. This shouldn't be displayed
+	// to the user directly.
+	Message string `json:"message,omitempty"`
+	// InnerError is an optional additional error object that is more specific than the top-level
+	// error.
+	InnerError *GraphError `json:"innerError,omitempty"`
+	// Details is an optional list of more error objects that provide a breakdown of multiple errors
+	// encountered while processing the request.
+	Details []GraphError `json:"details,omitempty"`
+	// StatusCode is the status code of the HTTP response that GraphError arrived with.
+	StatusCode int `json:"-"`
 }
 
 func (g *GraphError) Error() string {
@@ -60,13 +71,74 @@ func (g *GraphError) Error() string {
 	return strings.Join(parts, ": ")
 }
 
-func readError(r io.Reader) (*GraphError, error) {
+func readError(body []byte, statusCode int) (*GraphError, error) {
 	var errResponse graphErrorResponse
-	if err := json.NewDecoder(r).Decode(&errResponse); err != nil {
+	if err := json.Unmarshal(body, &errResponse); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if errResponse.Error != nil {
-		return errResponse.Error, nil
+	if errResponse.Error == nil {
+		return nil, nil
 	}
-	return nil, nil
+	graphError := errResponse.Error
+	graphError.StatusCode = statusCode
+	return graphError, nil
 }
+
+// AuthError is the error returned by [AzureTokenProvider.GetToken] indicating that an
+// authentication request has failed.
+// https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
+type AuthError struct {
+	// ErrorCode is the code string for the error, e.g. "invalid_client".
+	ErrorCode string `json:"error"`
+	// ErrorDescription is a specific error message that can help a developer identify the root cause
+	// of an authentication error.
+	ErrorDescription string `json:"error_description"`
+	// DiagCodes is a list of codes used by the security token service which map to specific reasons
+	// as to why a request have failed.
+	// https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes
+	DiagCodes  []int `json:"error_codes"`
+	StatusCode int   `json:"-"`
+}
+
+func (a *AuthError) Error() string {
+	var b strings.Builder
+	b.WriteString(a.ErrorDescription)
+	b.WriteString(" (")
+	b.WriteString(a.ErrorCode)
+	if len(a.DiagCodes) > 0 {
+		if len(a.DiagCodes) == 1 {
+			b.WriteString(", diag code ")
+		} else {
+			b.WriteString(", diag codes ")
+		}
+		for i, errorCode := range a.DiagCodes {
+			if i != 0 {
+				b.WriteString(", ")
+			}
+			b.WriteString(strconv.Itoa(errorCode))
+		}
+	}
+	b.WriteString(")")
+	return b.String()
+}
+
+func readAuthError(r io.Reader, statusCode int) (*AuthError, error) {
+	var authError AuthError
+	authError.StatusCode = statusCode
+	err := json.NewDecoder(r).Decode(&authError)
+	return &authError, trace.Wrap(err)
+}
+
+const (
+	// DiagCodeTenantNotFound is returned by the identity platform when the specific tenant doesn't
+	// exist. It might also mean that the tenant belongs to another cloud (see
+	// https://learn.microsoft.com/en-us/graph/deployments) or there are no active subscriptions for
+	// the tenant.
+	// https://login.microsoftonline.com/error?code=90002
+	DiagCodeTenantNotFound = 90002
+	// DiagCodeInvalidTenantIdentifier is returned by the identity platform when the identifier is
+	// neither a valid DNS name nor a valid external domain. This happes when the tenant is not a UUID
+	// and instead a regular string that doesn't match said requirements.
+	// https://login.microsoftonline.com/error?code=900023
+	DiagCodeInvalidTenantIdentifier = 900023
+)
diff --git a/lib/msgraph/errors_test.go b/lib/msgraph/errors_test.go
index e68ef004411e4..cd699307266cf 100644
--- a/lib/msgraph/errors_test.go
+++ b/lib/msgraph/errors_test.go
@@ -39,7 +39,7 @@ func TestUnmarshalGraphError(t *testing.T) {
 	t.Parallel()
 
 	t.Run("valid", func(t *testing.T) {
-		graphError, err := readError(strings.NewReader(msGraphErrorPayload))
+		graphError, err := readError([]byte(msGraphErrorPayload), 400)
 		require.NoError(t, err)
 		require.NotNil(t, graphError)
 		expected := &GraphError{
@@ -48,18 +48,91 @@ func TestUnmarshalGraphError(t *testing.T) {
 			InnerError: &GraphError{
 				Code: "invalidRange",
 			},
+			StatusCode: 400,
 		}
 		require.Equal(t, expected, graphError)
 	})
 
 	t.Run("invalid", func(t *testing.T) {
-		_, err := readError(strings.NewReader("invalid json"))
+		_, err := readError([]byte("invalid json"), 400)
 		require.Error(t, err)
 	})
 
 	t.Run("empty", func(t *testing.T) {
-		graphError, err := readError(strings.NewReader("{}"))
+		graphError, err := readError([]byte("{}"), 400)
 		require.NoError(t, err)
 		require.Nil(t, graphError)
 	})
 }
+
+const authErrorPayload = `{
+  "error": "invalid_scope",
+  "error_description": "AADSTS70011: The provided value for the input parameter 'scope' isn't valid. The scope https://example.contoso.com/activity.read isn't valid.\r\nTrace ID: 0000aaaa-11bb-cccc-dd22-eeeeee333333\r\nCorrelation ID: aaaa0000-bb11-2222-33cc-444444dddddd\r\nTimestamp: 2016-01-09 02:02:12Z",
+  "error_codes": [
+    70011
+  ],
+  "timestamp": "2016-01-09 02:02:12Z",
+  "trace_id": "0000aaaa-11bb-cccc-dd22-eeeeee333333",
+  "correlation_id": "aaaa0000-bb11-2222-33cc-444444dddddd",
+  "error_uri":"https://login.microsoftonline.com/error?code=70011"
+}`
+
+func TestUnmarshalAuthError(t *testing.T) {
+	t.Parallel()
+
+	t.Run("valid", func(t *testing.T) {
+		authError, err := readAuthError(strings.NewReader(authErrorPayload), 400)
+		require.NoError(t, err)
+		require.NotNil(t, authError)
+		expected := &AuthError{
+			ErrorCode:        "invalid_scope",
+			ErrorDescription: "AADSTS70011: The provided value for the input parameter 'scope' isn't valid. The scope https://example.contoso.com/activity.read isn't valid.\r\nTrace ID: 0000aaaa-11bb-cccc-dd22-eeeeee333333\r\nCorrelation ID: aaaa0000-bb11-2222-33cc-444444dddddd\r\nTimestamp: 2016-01-09 02:02:12Z",
+			DiagCodes:        []int{70011},
+			StatusCode:       400,
+		}
+		require.Equal(t, expected, authError)
+		expectedMessage := "AADSTS70011: The provided value for the input parameter 'scope' isn't valid. The scope https://example.contoso.com/activity.read isn't valid.\r\nTrace ID: 0000aaaa-11bb-cccc-dd22-eeeeee333333\r\nCorrelation ID: aaaa0000-bb11-2222-33cc-444444dddddd\r\nTimestamp: 2016-01-09 02:02:12Z " +
+			"(invalid_scope, diag code 70011)"
+		require.Equal(t, expectedMessage, authError.Error())
+	})
+
+	t.Run("invalid", func(t *testing.T) {
+		_, err := readAuthError(strings.NewReader("invalid json"), 400)
+		require.Error(t, err)
+	})
+
+	t.Run("message", func(t *testing.T) {
+		tests := []struct {
+			name      string
+			diagCodes []int
+			want      string
+		}{
+			{
+				name: "no diag codes",
+				want: "foo bar (invalid_client)",
+			},
+			{
+				name:      "one diag code",
+				diagCodes: []int{42},
+				want:      "foo bar (invalid_client, diag code 42)",
+			},
+			{
+				name:      "multiple diag codes",
+				diagCodes: []int{42, 37},
+				want:      "foo bar (invalid_client, diag codes 42, 37)",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				authError := &AuthError{
+					ErrorCode:        "invalid_client",
+					ErrorDescription: "foo bar",
+					DiagCodes:        tt.diagCodes,
+					StatusCode:       400,
+				}
+				require.Equal(t, tt.want, authError.Error())
+			})
+		}
+	})
+}
diff --git a/lib/msgraph/managed_device.go b/lib/msgraph/managed_device.go
new file mode 100644
index 0000000000000..f11e03cdd30aa
--- /dev/null
+++ b/lib/msgraph/managed_device.go
@@ -0,0 +1,78 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package msgraph
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/gravitational/trace"
+)
+
+// ManagedDevice represents a device from Intune's inventory.
+type ManagedDevice struct {
+	// ID is the unique ID of the device within Intune.
+	ID string `json:"id"`
+	// LastSyncDateTime is the time that the device last completed a successful sync with Intune.
+	LastSyncDateTime time.Time `json:"lastSyncDateTime"`
+	// DeviceRegistrationState describes whether a device was fully enrolled within Intune.
+	// Possible values are: notRegistered, registered, revoked, keyConflict, approvalPending,
+	// certificateReset, notRegisteredPendingEnrollment, unknown.
+	DeviceRegistrationState string `json:"deviceRegistrationState"`
+	SerialNumber            string `json:"serialNumber"`
+	// OperatingSystem is the OS of the device, e.g. "Windows", "macOS", "Linux (ubuntu)".
+	OperatingSystem string `json:"operatingSystem"`
+	// OSVersion is the version of the OS, e.g. "10.0.26100.4351" (Windows), "15.5 (24F74)" (macOS),
+	// "24.04" (Linux).
+	OSVersion string `json:"osVersion"`
+}
+
+// selectManagedDevice is the value for the $select query param when fetching managed devices so
+// that the client fetches only the fields that it needs.
+const selectManagedDevice = "id,lastSyncDateTime,deviceRegistrationState,operatingSystem,serialNumber,osVersion"
+
+// IterateManagedDevicePages iterates over managed devices, returning them page by page.
+// https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0
+func (c *Client) IterateManagedDevicePages(ctx context.Context, f func(mds []*ManagedDevice) bool, iterateOpts ...IterateOpt) error {
+	iterateOpts = append(iterateOpts, WithSelect(selectManagedDevice))
+	return iteratePage(c, ctx, "deviceManagement/managedDevices", f, iterateOpts...)
+}
+
+// WithLastSyncDateTimeGt filters the result to only those whose lastSyncDateTime is greater than
+// the given time.
+func WithLastSyncDateTimeGt(lastSyncDateTime time.Time) IterateOpt {
+	return func(ic *iterateConfig) {
+		if lastSyncDateTime.IsZero() {
+			return
+		}
+		// As noted in the docs, DateTimeOffset values aren't enclosed in quotes in $filter expressions.
+		// https://learn.microsoft.com/en-us/graph/filter-query-parameter
+		ic.filter = fmt.Sprintf("lastSyncDateTime gt %s", lastSyncDateTime.UTC().Format(time.RFC3339))
+	}
+}
+
+// GetManagedDevice returns a single managed device.
+// https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-get?view=graph-rest-1.0
+func (c *Client) GetManagedDevice(ctx context.Context, id string) (*ManagedDevice, error) {
+	uri := c.endpointURI("deviceManagement", "managedDevices", id)
+	uri.RawQuery = url.Values{"$select": {selectManagedDevice}}.Encode()
+	out, err := roundtrip[*ManagedDevice](ctx, c, http.MethodGet, uri.String(), nil)
+	return out, trace.Wrap(err)
+}
diff --git a/lib/msgraph/metrics.go b/lib/msgraph/metrics.go
new file mode 100644
index 0000000000000..d7bca2ee9f223
--- /dev/null
+++ b/lib/msgraph/metrics.go
@@ -0,0 +1,68 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package msgraph
+
+import (
+	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport/lib/observability/metrics"
+)
+
+type clientMetrics struct {
+	// requestsTotal keeps track of the number of requests done by the client
+	// This metric is labeled by status code.
+	requestTotal *prometheus.CounterVec
+	// requestDuration keeps track of the request duration, in seconds.
+	requestDuration *prometheus.HistogramVec
+}
+
+const (
+	metricsLabelStatus  = "status"
+	metricsLabelsMethod = "method"
+)
+
+func newMetrics(reg *metrics.Registry) *clientMetrics {
+	var namespace, subsystem string
+	if reg != nil {
+		namespace = reg.Namespace()
+		subsystem = reg.Subsystem()
+	}
+	return &clientMetrics{
+		requestTotal: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Namespace: namespace,
+			Subsystem: subsystem,
+			Name:      "request_total",
+			Help:      "Total number of requests made to MS Graph",
+		}, []string{metricsLabelsMethod, metricsLabelStatus}),
+		requestDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: namespace,
+			Subsystem: subsystem,
+			Name:      "request_duration_seconds",
+			Help:      "Request to MS Graph duration in seconds.",
+		}, []string{metricsLabelsMethod}),
+	}
+}
+
+func (metrics *clientMetrics) register(r prometheus.Registerer) error {
+	return trace.NewAggregate(
+		r.Register(metrics.requestTotal),
+		r.Register(metrics.requestDuration),
+	)
+}
diff --git a/lib/msgraph/models.go b/lib/msgraph/models.go
index 3984fee85ccdf..201677d8ab3d8 100644
--- a/lib/msgraph/models.go
+++ b/lib/msgraph/models.go
@@ -21,6 +21,8 @@ import (
 	"slices"
 
 	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 type GroupMember interface {
@@ -162,7 +164,7 @@ func decodeGroupMember(msg json.RawMessage) (GroupMember, error) {
 		Type string `json:"@odata.type"`
 	}
 
-	if err := json.Unmarshal(msg, &temp); err != nil {
+	if err := utils.FastUnmarshal(msg, &temp); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -171,11 +173,11 @@ func decodeGroupMember(msg json.RawMessage) (GroupMember, error) {
 	switch temp.Type {
 	case "#microsoft.graph.user":
 		var u *User
-		err = json.Unmarshal(msg, &u)
+		err = utils.FastUnmarshal(msg, &u)
 		member = u
 	case "#microsoft.graph.group":
 		var g *Group
-		err = json.Unmarshal(msg, &g)
+		err = utils.FastUnmarshal(msg, &g)
 		member = g
 	default:
 		// Return an error if we encounter a type we do not support.
diff --git a/lib/msgraph/paginated.go b/lib/msgraph/paginated.go
index a0b9488af9d70..5cd7f86068d55 100644
--- a/lib/msgraph/paginated.go
+++ b/lib/msgraph/paginated.go
@@ -27,14 +27,101 @@ import (
 	"strconv"
 
 	"github.com/gravitational/trace"
+	jsoniter "github.com/json-iterator/go"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
+type iterateConfig struct {
+	// filter is the $filter query param.
+	// https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http
+	filter string
+	// top is the $top query param.
+	// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#top
+	top int
+	// selector is the $select query param.
+	// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#select
+	selector string
+	// header includes headers that are going to be set during iteration.
+	header http.Header
+	// count is the $count query param.
+	// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#count
+	count bool
+}
+
+func (ic *iterateConfig) query() url.Values {
+	q := make(url.Values)
+	if ic.filter != "" {
+		q.Set("$filter", ic.filter)
+	}
+	if ic.top > 0 {
+		q.Set("$top", strconv.Itoa(ic.top))
+	}
+	if ic.selector != "" {
+		q.Set("$select", ic.selector)
+	}
+	if ic.count {
+		q.Set("$count", "true")
+	}
+	return q
+}
+
+func (c *Client) newIterateConfig() *iterateConfig {
+	return &iterateConfig{
+		top:    c.pageSize,
+		header: make(http.Header),
+	}
+}
+
+// IterateOpt is a function that can be passed to [Client] methods that iterate over API results.
+type IterateOpt func(*iterateConfig)
+
+// WithFilter sets the $filter query param.
+// https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http
+func WithFilter(filter string) IterateOpt {
+	return func(ic *iterateConfig) {
+		ic.filter = filter
+	}
+}
+
+// WithTop sets the $top query param. It overrides the default page size set in [Config].
+// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#top
+func WithTop(top int) IterateOpt {
+	return func(ic *iterateConfig) {
+		ic.top = top
+	}
+}
+
+// WithSelect sets the $select query param.
+// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#select
+func WithSelect(s string) IterateOpt {
+	return func(ic *iterateConfig) {
+		ic.selector = s
+	}
+}
+
+// WithCount sets the $count query param.
+// https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#count
+func WithCount() IterateOpt {
+	return func(ic *iterateConfig) {
+		ic.count = true
+	}
+}
+
+// WithHeader sets the value of a specific header.
+func WithHeader(key, value string) IterateOpt {
+	return func(ic *iterateConfig) {
+		ic.header.Set(key, value)
+	}
+}
+
 // iterateSimple implements pagination for "simple" object lists, where additional logic isn't needed
-func iterateSimple[T any](c *Client, ctx context.Context, endpoint string, f func(*T) bool) error {
+func iterateSimple[T any](c *Client, ctx context.Context, endpoint string, f func(*T) bool, iterateOpts ...IterateOpt) error {
 	var err error
 	itErr := c.iterate(ctx, endpoint, func(msg json.RawMessage) bool {
 		var page []T
-		if err = json.Unmarshal(msg, &page); err != nil {
+		if err = utils.FastUnmarshal(msg, &page); err != nil {
 			return false
 		}
 		for _, item := range page {
@@ -43,7 +130,25 @@ func iterateSimple[T any](c *Client, ctx context.Context, endpoint string, f fun
 			}
 		}
 		return true
-	})
+	}, iterateOpts...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(itErr)
+}
+
+func iteratePage[T any](c *Client, ctx context.Context, endpoint string, f func([]T) bool, iterateOpts ...IterateOpt) error {
+	var err error
+	itErr := c.iterate(ctx, endpoint, func(msg json.RawMessage) bool {
+		var page []T
+		if err = utils.FastUnmarshal(msg, &page); err != nil {
+			return false
+		}
+		if !f(page) {
+			return false
+		}
+		return true
+	}, iterateOpts...)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -51,19 +156,26 @@ func iterateSimple[T any](c *Client, ctx context.Context, endpoint string, f fun
 }
 
 // iterate implements pagination for "list" endpoints.
-func (c *Client) iterate(ctx context.Context, endpoint string, f func(json.RawMessage) bool) error {
+func (c *Client) iterate(ctx context.Context, endpoint string, f func(json.RawMessage) bool, iterateOpts ...IterateOpt) error {
+	ic := c.newIterateConfig()
+	for _, opt := range iterateOpts {
+		opt(ic)
+	}
+
 	uri := *c.baseURL
 	uri.Path = path.Join(uri.Path, endpoint)
-	uri.RawQuery = url.Values{"$top": {strconv.Itoa(c.pageSize)}}.Encode()
+
+	uri.RawQuery = ic.query().Encode()
+
 	uriString := uri.String()
 	for uriString != "" {
-		resp, err := c.request(ctx, http.MethodGet, uriString, nil)
+		resp, err := c.request(ctx, http.MethodGet, uriString, ic.header, nil /* payload */)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		var page oDataPage
-		if err := json.NewDecoder(resp.Body).Decode(&page); err != nil {
+		if err := jsoniter.ConfigFastest.NewDecoder(resp.Body).Decode(&page); err != nil {
 			resp.Body.Close()
 			return trace.Wrap(err)
 		}
@@ -81,43 +193,43 @@ func (c *Client) iterate(ctx context.Context, endpoint string, f func(json.RawMe
 // `f` will be called for each object in the result set.
 // if `f` returns `false`, the iteration is stopped (equivalent to `break` in a normal loop).
 // Ref: [https://learn.microsoft.com/en-us/graph/api/application-list].
-func (c *Client) IterateApplications(ctx context.Context, f func(*Application) bool) error {
-	return iterateSimple(c, ctx, "applications", f)
+func (c *Client) IterateApplications(ctx context.Context, f func(*Application) bool, opts ...IterateOpt) error {
+	return iterateSimple(c, ctx, "applications", f, opts...)
 }
 
 // IterateGroups lists all groups in the Entra ID directory using pagination.
 // `f` will be called for each object in the result set.
 // if `f` returns `false`, the iteration is stopped (equivalent to `break` in a normal loop).
 // Ref: [https://learn.microsoft.com/en-us/graph/api/group-list].
-func (c *Client) IterateGroups(ctx context.Context, f func(*Group) bool) error {
-	return iterateSimple(c, ctx, "groups", f)
+func (c *Client) IterateGroups(ctx context.Context, f func(*Group) bool, opts ...IterateOpt) error {
+	return iterateSimple(c, ctx, "groups", f, opts...)
 }
 
 // IterateUsers lists all users in the Entra ID directory using pagination.
 // `f` will be called for each object in the result set.
 // if `f` returns `false`, the iteration is stopped (equivalent to `break` in a normal loop).
 // Ref: [https://learn.microsoft.com/en-us/graph/api/user-list].
-func (c *Client) IterateUsers(ctx context.Context, f func(*User) bool) error {
-	return iterateSimple(c, ctx, "users", f)
+func (c *Client) IterateUsers(ctx context.Context, f func(*User) bool, opts ...IterateOpt) error {
+	return iterateSimple(c, ctx, "users", f, opts...)
 }
 
 // IterateServicePrincipals lists all service principals in the Entra ID directory using pagination.
 // `f` will be called for each object in the result set.
 // if `f` returns `false`, the iteration is stopped (equivalent to `break` in a normal loop).
 // Ref: [https://learn.microsoft.com/en-us/graph/api/serviceprincipal-list].
-func (c *Client) IterateServicePrincipals(ctx context.Context, f func(principal *ServicePrincipal) bool) error {
-	return iterateSimple(c, ctx, "servicePrincipals", f)
+func (c *Client) IterateServicePrincipals(ctx context.Context, f func(principal *ServicePrincipal) bool, opts ...IterateOpt) error {
+	return iterateSimple(c, ctx, "servicePrincipals", f, opts...)
 }
 
 // IterateGroupMembers lists all members for the given Entra ID group using pagination.
 // `f` will be called for each object in the result set.
 // if `f` returns `false`, the iteration is stopped (equivalent to `break` in a normal loop).
 // Ref: [https://learn.microsoft.com/en-us/graph/api/group-list-members].
-func (c *Client) IterateGroupMembers(ctx context.Context, groupID string, f func(GroupMember) bool) error {
+func (c *Client) IterateGroupMembers(ctx context.Context, groupID string, f func(GroupMember) bool, opts ...IterateOpt) error {
 	var err error
 	itErr := c.iterate(ctx, path.Join("groups", groupID, "members"), func(msg json.RawMessage) bool {
 		var page []json.RawMessage
-		if err = json.Unmarshal(msg, &page); err != nil {
+		if err = utils.FastUnmarshal(msg, &page); err != nil {
 			return false
 		}
 		for _, entry := range page {
@@ -138,7 +250,68 @@ func (c *Client) IterateGroupMembers(ctx context.Context, groupID string, f func
 			}
 		}
 		return true
-	})
+	}, opts...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(itErr)
+}
+
+const (
+	graphNamespaceGroups         = "microsoft.graph.group"
+	graphNamespaceDirectoryRoles = "microsoft.graph.directoryRole"
+)
+
+const (
+	securityGroupsFilter = `mailEnabled eq false and securityEnabled eq true`
+)
+
+// IterateUsersTransitiveMemberOf lists groups that the user is a member of
+// through a direct or nested group membership.
+// This method calls user's transitiveMemberOf endpoint https://learn.microsoft.com/en-us/graph/api/user-list-transitivememberof?view=graph-rest-1.0&tabs=http.
+// Supported endpoints:
+// - All groups and directory roles: /v1.0/users/<user-id>/transitiveMemberOf
+// - Security groups: /v1.0/users/<user-id>/transitiveMemberOf/microsoft.graph.group?$filter=mailEnabled eq false and securityEnabled eq true
+// - Directory roles: /v1.0/users/<user-id>/transitiveMemberOf/microsoft.graph.directoryRole
+// Only group ID is extracted from the response, so the DirectoryObject struct is sufficient
+// to parse groups as well ass directory roles response.
+func (c *Client) IterateUsersTransitiveMemberOf(ctx context.Context, userID, groupType string, f func(*Group) bool) error {
+	// MS Graph expects $count query parameter and
+	// "ConsistencyLevel: eventual" header set when using
+	// advanced query parameter such as $filter.
+	// https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http#legend
+	iterateOpts := []IterateOpt{
+		WithSelect("id"),
+		WithCount(),
+		WithHeader("ConsistencyLevel", "eventual"),
+	}
+
+	endpoint := path.Join("users", userID, "transitiveMemberOf")
+	switch groupType {
+	case types.EntraIDAllGroups:
+		// default endpoint suffices.
+	case types.EntraIDDirectoryRoles:
+		endpoint = path.Join(endpoint, graphNamespaceDirectoryRoles)
+	case types.EntraIDSecurityGroups:
+		endpoint = path.Join(endpoint, graphNamespaceGroups)
+		iterateOpts = append(iterateOpts, WithFilter(securityGroupsFilter))
+	default:
+		return trace.BadParameter("unexpected group type %q received, expected types are %q", groupType, types.EntraIDGroupsTypes)
+	}
+
+	var err error
+	itErr := c.iterate(ctx, endpoint, func(msg json.RawMessage) bool {
+		var page []Group
+		if err = utils.FastUnmarshal(msg, &page); err != nil {
+			return false
+		}
+		for _, item := range page {
+			if !f(&item) {
+				return false
+			}
+		}
+		return true
+	}, iterateOpts...)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/multiplexer/grpc/proxyline.go b/lib/multiplexer/grpc/proxyline.go
new file mode 100644
index 0000000000000..5c87f8b6f4bfa
--- /dev/null
+++ b/lib/multiplexer/grpc/proxyline.go
@@ -0,0 +1,59 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package grpc
+
+import (
+	"net"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/gravitational/teleport/lib/multiplexer"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// PPV2ServerCredentials is a wrapper around a gRPC
+// [credentials.TransportCredentials] that reads a PROXY protocol v2 header
+// before passing the incoming connection to the wrapped credentials. When used
+// as client credentials, the wrapped credentials are used as-is.
+type PPV2ServerCredentials struct {
+	_ struct{}
+
+	credentials.TransportCredentials
+}
+
+var _ credentials.TransportCredentials = PPV2ServerCredentials{}
+
+// Clone implements [credentials.TransportCredentials].
+func (p PPV2ServerCredentials) Clone() credentials.TransportCredentials {
+	return PPV2ServerCredentials{
+		TransportCredentials: p.TransportCredentials.Clone(),
+	}
+}
+
+// ServerHandshake implements [credentials.TransportCredentials].
+func (p PPV2ServerCredentials) ServerHandshake(nc net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	proxyLine, err := multiplexer.ReadProxyLineV2(nc)
+	if err != nil {
+		_ = nc.Close()
+		return nil, nil, trace.Wrap(err)
+	}
+	if proxyLine != nil {
+		nc = utils.NewConnWithAddr(nc, &proxyLine.Destination, &proxyLine.Source)
+	}
+	return p.TransportCredentials.ServerHandshake(nc)
+}
diff --git a/lib/multiplexer/grpc/proxyline_test.go b/lib/multiplexer/grpc/proxyline_test.go
new file mode 100644
index 0000000000000..1bcb996dfa32b
--- /dev/null
+++ b/lib/multiplexer/grpc/proxyline_test.go
@@ -0,0 +1,74 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package grpc
+
+import (
+	"bytes"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/gravitational/teleport/lib/multiplexer"
+)
+
+func TestPPV2ServerCredentials(t *testing.T) {
+	dispatchC := make(chan net.Conn, 1)
+
+	creds := PPV2ServerCredentials{TransportCredentials: dispatchCredentials{dispatchC: dispatchC}}
+
+	srv := grpc.NewServer(grpc.Creds(creds))
+	defer srv.Stop()
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer lis.Close()
+	go srv.Serve(lis)
+
+	rawConn, err := net.Dial(lis.Addr().Network(), lis.Addr().String())
+	require.NoError(t, err)
+	defer rawConn.Close()
+
+	// source=127.0.0.3:12345 destination=127.0.0.2:42
+	sampleIPv4Addresses := []byte{0x7F, 0x00, 0x00, 0x03, 0x7F, 0x00, 0x00, 0x02, 0x30, 0x39, 0x00, 0x2A}
+	// {0x21, 0x11, 0x00, 0x0C} - 4 bits version, 4 bits command, 4 bits address family, 4 bits protocol, 16 bits length
+	sampleProxyV2Line := bytes.Join([][]byte{multiplexer.ProxyV2Prefix, {0x21, 0x11, 0x00, 0x0C}, sampleIPv4Addresses}, nil)
+
+	require.NotEqual(t, "127.0.0.3:12345", rawConn.LocalAddr().String())
+	require.NotEqual(t, "127.0.0.2:42", rawConn.RemoteAddr().String())
+
+	_, err = rawConn.Write(sampleProxyV2Line)
+	require.NoError(t, err)
+
+	wrappedConn := <-dispatchC
+	defer wrappedConn.Close()
+	require.Equal(t, "127.0.0.2:42", wrappedConn.LocalAddr().String())
+	require.Equal(t, "127.0.0.3:12345", wrappedConn.RemoteAddr().String())
+}
+
+type dispatchCredentials struct {
+	credentials.TransportCredentials
+	dispatchC chan net.Conn
+}
+
+// ServerHandshake implements [credentials.TransportCredentials].
+func (d dispatchCredentials) ServerHandshake(c net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	d.dispatchC <- c
+	return nil, nil, credentials.ErrConnDispatched
+}
diff --git a/lib/multiplexer/multiplexer_test.go b/lib/multiplexer/multiplexer_test.go
index b5592564c25fd..0bdc59b6e97ee 100644
--- a/lib/multiplexer/multiplexer_test.go
+++ b/lib/multiplexer/multiplexer_test.go
@@ -53,10 +53,11 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/cert"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/multiplexer/proxyline.go b/lib/multiplexer/proxyline.go
index 0c9b81b2258fa..c15288493a6ae 100644
--- a/lib/multiplexer/proxyline.go
+++ b/lib/multiplexer/proxyline.go
@@ -32,7 +32,6 @@ import (
 	"net"
 	"strconv"
 	"strings"
-	"unsafe"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -258,6 +257,10 @@ type proxyV2Address4 struct {
 	DestinationPort uint16
 }
 
+// proxyV2Address4Size is the size of a [proxyV2Address4]. Its correctness is
+// enforced in proxyline_test.go to avoid having to import unsafe here.
+const proxyV2Address4Size = 12
+
 type proxyV2Address6 struct {
 	Source          [16]uint8
 	Destination     [16]uint8
@@ -265,6 +268,10 @@ type proxyV2Address6 struct {
 	DestinationPort uint16
 }
 
+// proxyV2Address6Size is the size of a [proxyV2Address6]. Its correctness is
+// enforced in proxyline_test.go to avoid having to import unsafe here.
+const proxyV2Address6Size = 36
+
 const (
 	Version2     = 2
 	ProxyCommand = 1
@@ -274,7 +281,7 @@ const (
 )
 
 // ReadProxyLineV2 reads PROXY protocol v2 line from the reader
-func ReadProxyLineV2(reader *bufio.Reader) (*ProxyLine, error) {
+func ReadProxyLineV2(reader io.Reader) (*ProxyLine, error) {
 	var header proxyV2Header
 	var ret ProxyLine
 	if err := binary.Read(reader, binary.BigEndian, &header); err != nil {
@@ -302,7 +309,7 @@ func ReadProxyLineV2(reader *bufio.Reader) (*ProxyLine, error) {
 	switch header.Protocol {
 	case ProtocolTCP4:
 		var addr proxyV2Address4
-		size = uint16(unsafe.Sizeof(addr))
+		size = proxyV2Address4Size
 		if err := binary.Read(reader, binary.BigEndian, &addr); err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -311,7 +318,7 @@ func ReadProxyLineV2(reader *bufio.Reader) (*ProxyLine, error) {
 		ret.Destination = net.TCPAddr{IP: addr.Destination[:], Port: int(addr.DestinationPort)}
 	case ProtocolTCP6:
 		var addr proxyV2Address6
-		size = uint16(unsafe.Sizeof(addr))
+		size = proxyV2Address6Size
 		if err := binary.Read(reader, binary.BigEndian, &addr); err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -324,13 +331,12 @@ func ReadProxyLineV2(reader *bufio.Reader) (*ProxyLine, error) {
 
 	// If there are more bytes left it means we've got TLVs
 	if header.Length > size {
-		tlvsBytes := &bytes.Buffer{}
-
-		if _, err := io.CopyN(tlvsBytes, reader, int64(header.Length-size)); err != nil {
+		tlvsBytes := make([]byte, header.Length-size)
+		if _, err := io.ReadFull(reader, tlvsBytes); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		tlvs, err := UnmarshalTLVs(tlvsBytes.Bytes())
+		tlvs, err := UnmarshalTLVs(tlvsBytes)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/multiplexer/proxyline_test.go b/lib/multiplexer/proxyline_test.go
index 8be61619d00d5..5a188093ca761 100644
--- a/lib/multiplexer/proxyline_test.go
+++ b/lib/multiplexer/proxyline_test.go
@@ -23,10 +23,12 @@ import (
 	"bytes"
 	"context"
 	"crypto/x509/pkix"
+	"encoding/binary"
 	"io"
 	"net"
 	"testing"
 	"time"
+	"unsafe"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -57,6 +59,18 @@ var (
 	sampleProxyV2LineEmptyTLV = bytes.Join([][]byte{ProxyV2Prefix, {0x21, 0x11, 0x00, 0x0F}, sampleIPv4Addresses, sampleEmptyTLV}, nil)
 )
 
+func TestPPv2SizeConsts(t *testing.T) {
+	//nolint:staticcheck // the fact that the two types are the same is precisely the point here
+	var (
+		_ [proxyV2Address4Size]struct{} = [unsafe.Sizeof(proxyV2Address4{})]struct{}{}
+		_ [proxyV2Address6Size]struct{} = [unsafe.Sizeof(proxyV2Address6{})]struct{}{}
+	)
+
+	// double-check the runtime size as measured by binary.Size
+	require.Equal(t, proxyV2Address4Size, binary.Size(proxyV2Address4{}))
+	require.Equal(t, proxyV2Address6Size, binary.Size(proxyV2Address6{}))
+}
+
 func TestReadProxyLine(t *testing.T) {
 	t.Parallel()
 
diff --git a/lib/multiplexer/test/ping.pb.go b/lib/multiplexer/test/ping.pb.go
index 744f96996a0fc..9a89eb7b5b38e 100644
--- a/lib/multiplexer/test/ping.pb.go
+++ b/lib/multiplexer/test/ping.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.8
 // 	protoc        (unknown)
 // source: teleport/lib/multiplexer/test/ping.proto
 
diff --git a/lib/multiplexer/testproxy.go b/lib/multiplexer/testproxy.go
index f03610d7e4f8f..f91959749b17b 100644
--- a/lib/multiplexer/testproxy.go
+++ b/lib/multiplexer/testproxy.go
@@ -29,6 +29,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestProxy is tcp passthrough proxy that sends a proxy-line when connecting
@@ -52,7 +53,7 @@ func NewTestProxy(target string, v2 bool) (*TestProxy, error) {
 		listener: listener,
 		target:   target,
 		closeCh:  make(chan struct{}),
-		log:      utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "test:proxy"),
+		log:      logtest.With(teleport.ComponentKey, "test:proxy"),
 		v2:       v2,
 	}, nil
 }
diff --git a/lib/observability/metrics/gatherers.go b/lib/observability/metrics/gatherers.go
new file mode 100644
index 0000000000000..e1cb59e260d6d
--- /dev/null
+++ b/lib/observability/metrics/gatherers.go
@@ -0,0 +1,58 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package metrics
+
+import (
+	"sync"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+)
+
+// SyncGatherers wraps a [prometheus.Gatherers] so it can be accessed
+// in a thread-safe fashion. Gatherer can be added with AddGatherer.
+type SyncGatherers struct {
+	mutex     sync.Mutex
+	gatherers prometheus.Gatherers
+}
+
+// NewSyncGatherers returns a thread-safe [prometheus.Gatherers].
+func NewSyncGatherers(gatherers ...prometheus.Gatherer) *SyncGatherers {
+	return &SyncGatherers{
+		gatherers: gatherers,
+	}
+}
+
+// AddGatherer adds a gatherer to the SyncGatherers slice.
+func (s *SyncGatherers) AddGatherer(g prometheus.Gatherer) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.gatherers = append(s.gatherers, g)
+}
+
+// Gather implements [prometheus.Gatherer].
+func (s *SyncGatherers) Gather() ([]*dto.MetricFamily, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	if s.gatherers == nil {
+		return nil, nil
+	}
+	return s.gatherers.Gather()
+}
diff --git a/lib/observability/metrics/grpc/grpc.go b/lib/observability/metrics/grpc/grpc.go
new file mode 100644
index 0000000000000..426b7c30f988c
--- /dev/null
+++ b/lib/observability/metrics/grpc/grpc.go
@@ -0,0 +1,65 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package grpcmetrics
+
+import (
+	grpcprom "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// CreateGRPCServerMetrics creates server gRPC metrics configuration that is to be registered and used by the caller
+// in an openmetrics unary and/or stream interceptor
+func CreateGRPCServerMetrics(
+	latencyEnabled bool, labels prometheus.Labels,
+) *grpcprom.ServerMetrics {
+	serverOpts := []grpcprom.ServerMetricsOption{
+		grpcprom.WithServerCounterOptions(grpcprom.WithConstLabels(labels)),
+	}
+	if latencyEnabled {
+		histOpts := grpcHistogramOpts(labels)
+		serverOpts = append(
+			serverOpts, grpcprom.WithServerHandlingTimeHistogram(histOpts...),
+		)
+	}
+	return grpcprom.NewServerMetrics(serverOpts...)
+}
+
+// CreateGRPCClientMetrics creates client gRPC metrics configuration that is to be registered and used by the caller
+// in an openmetrics unary and/or stream interceptor
+func CreateGRPCClientMetrics(
+	latencyEnabled bool, labels prometheus.Labels,
+) *grpcprom.ClientMetrics {
+	clientOpts := []grpcprom.ClientMetricsOption{
+		grpcprom.WithClientCounterOptions(grpcprom.WithConstLabels(labels)),
+	}
+	if latencyEnabled {
+		histOpts := grpcHistogramOpts(labels)
+		clientOpts = append(
+			clientOpts, grpcprom.WithClientHandlingTimeHistogram(histOpts...),
+		)
+	}
+	return grpcprom.NewClientMetrics(clientOpts...)
+}
+
+func grpcHistogramOpts(labels prometheus.Labels) []grpcprom.HistogramOption {
+	return []grpcprom.HistogramOption{
+		grpcprom.WithHistogramBuckets(prometheus.ExponentialBuckets(0.001, 2, 16)),
+		grpcprom.WithHistogramConstLabels(labels),
+	}
+}
diff --git a/lib/observability/metrics/prometheus.go b/lib/observability/metrics/prometheus.go
index 8085be0ef19b7..440a4078c696c 100644
--- a/lib/observability/metrics/prometheus.go
+++ b/lib/observability/metrics/prometheus.go
@@ -23,7 +23,6 @@ import (
 	"runtime"
 
 	"github.com/gravitational/trace"
-	grpcprom "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
 	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/gravitational/teleport"
@@ -34,6 +33,13 @@ import (
 //   - returns an error if a collector does not fulfill the consistency and
 //     uniqueness criteria
 func RegisterPrometheusCollectors(collectors ...prometheus.Collector) error {
+	return RegisterCollectors(prometheus.DefaultRegisterer, collectors...)
+}
+
+// RegisterCollectors registers the collectors in the registry. Any errors
+// for already registered collectors are ignored. Errors are only returned
+// if a collector does not fulfill the consistency and uniqueness criteria.
+func RegisterCollectors(registry prometheus.Registerer, collectors ...prometheus.Collector) error {
 	var errs []error
 	for _, c := range collectors {
 		if err := prometheus.Register(c); err != nil {
@@ -63,44 +69,3 @@ func BuildCollector() prometheus.Collector {
 		func() float64 { return 1 },
 	)
 }
-
-// CreateGRPCServerMetrics creates server gRPC metrics configuration that is to be registered and used by the caller
-// in an openmetrics unary and/or stream interceptor
-func CreateGRPCServerMetrics(
-	latencyEnabled bool, labels prometheus.Labels,
-) *grpcprom.ServerMetrics {
-	serverOpts := []grpcprom.ServerMetricsOption{
-		grpcprom.WithServerCounterOptions(grpcprom.WithConstLabels(labels)),
-	}
-	if latencyEnabled {
-		histOpts := grpcHistogramOpts(labels)
-		serverOpts = append(
-			serverOpts, grpcprom.WithServerHandlingTimeHistogram(histOpts...),
-		)
-	}
-	return grpcprom.NewServerMetrics(serverOpts...)
-}
-
-// CreateGRPCClientMetrics creates client gRPC metrics configuration that is to be registered and used by the caller
-// in an openmetrics unary and/or stream interceptor
-func CreateGRPCClientMetrics(
-	latencyEnabled bool, labels prometheus.Labels,
-) *grpcprom.ClientMetrics {
-	clientOpts := []grpcprom.ClientMetricsOption{
-		grpcprom.WithClientCounterOptions(grpcprom.WithConstLabels(labels)),
-	}
-	if latencyEnabled {
-		histOpts := grpcHistogramOpts(labels)
-		clientOpts = append(
-			clientOpts, grpcprom.WithClientHandlingTimeHistogram(histOpts...),
-		)
-	}
-	return grpcprom.NewClientMetrics(clientOpts...)
-}
-
-func grpcHistogramOpts(labels prometheus.Labels) []grpcprom.HistogramOption {
-	return []grpcprom.HistogramOption{
-		grpcprom.WithHistogramBuckets(prometheus.ExponentialBuckets(0.001, 2, 16)),
-		grpcprom.WithHistogramConstLabels(labels),
-	}
-}
diff --git a/lib/observability/metrics/registry.go b/lib/observability/metrics/registry.go
new file mode 100644
index 0000000000000..8c4f447577bd3
--- /dev/null
+++ b/lib/observability/metrics/registry.go
@@ -0,0 +1,129 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package metrics
+
+import (
+	"cmp"
+	"errors"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// Registry is a [prometheus.Registerer] for a Teleport process that
+// allows propagating additional information such as:
+//   - the metric namespace (`teleport`, `teleport_bot`, `teleport_plugins`)
+//   - an optional subsystem
+//
+// This should be passed anywhere that needs to register a metric.
+type Registry struct {
+	prometheus.Registerer
+
+	namespace string
+	subsystem string
+}
+
+// Namespace returns the namespace that should be used by metrics registered
+// in this Registry. Common namespaces are "teleport", "tbot", and
+// "teleport_plugins".
+func (r *Registry) Namespace() string {
+	return r.namespace
+}
+
+// Subsystem is the subsystem base that should be used by metrics registered in
+// this Registry. Subsystem parts can be added with WrapWithSubsystem.
+func (r *Registry) Subsystem() string {
+	return r.subsystem
+}
+
+// Wrap wraps a Registry by adding a component to its subsystem.
+// This should be used before passing a registry to a sub-component.
+// Example usage:
+//
+//	 rootReg := prometheus.NewRegistry()
+//	 process.AddGatherer(rootReg)
+//		reg, err := NewRegistry(rootReg, "teleport_plugins", "")
+//	 go runFooService(ctx, log, reg.Wrap("foo"))
+//	 go runBarService(ctx, log, reg.Wrap("bar"))
+func (r *Registry) Wrap(subsystem string) *Registry {
+	if r.subsystem != "" && subsystem != "" {
+		subsystem = r.subsystem + "_" + subsystem
+	} else {
+		subsystem = cmp.Or(r.subsystem, subsystem)
+	}
+
+	newReg := &Registry{
+		Registerer: r.Registerer,
+		namespace:  r.namespace,
+		subsystem:  subsystem,
+	}
+	return newReg
+}
+
+// NewRegistry creates a new Registry wrapping a prometheus registry.
+// This should only be called when starting the service management routines such
+// as: service.NewTeleport(), tbot.New(), or the hosted plugin manager.
+// Services and sub-services should take the registry as a parameter, like they
+// already do for the logger.
+// Example usage:
+//
+//	 rootReg := prometheus.NewRegistry()
+//	 process.AddGatherer(rootReg)
+//		reg, err := NewRegistry(rootReg, "teleport_plugins", "")
+//	 go runFooService(ctx, log, reg.Wrap("foo"))
+//	 go runBarService(ctx, log, reg.Wrap("bar"))
+func NewRegistry(reg prometheus.Registerer, namespace, subsystem string) (*Registry, error) {
+	if reg == nil {
+		return nil, errors.New("nil prometheus.Registerer (this is a bug)")
+	}
+	if namespace == "" {
+		return nil, errors.New("namespace is required (this is a bug)")
+	}
+	return &Registry{
+		Registerer: reg,
+		namespace:  namespace,
+		subsystem:  subsystem,
+	}, nil
+}
+
+// NoopRegistry returns a Registry that doesn't register metrics.
+// This can be used in tests, or to provide backward compatibility when a nil
+// Registry is passed.
+func NoopRegistry() *Registry {
+	return &Registry{
+		Registerer: noopRegistry{},
+		namespace:  "noop",
+		subsystem:  "",
+	}
+}
+
+type noopRegistry struct{}
+
+// Register implements [prometheus.Registerer].
+func (b noopRegistry) Register(collector prometheus.Collector) error {
+	return nil
+}
+
+// MustRegister implements [prometheus.Registerer].
+func (b noopRegistry) MustRegister(collector ...prometheus.Collector) {
+}
+
+// Unregister implements [prometheus.Registerer].
+func (b noopRegistry) Unregister(collector prometheus.Collector) bool {
+	return true
+}
diff --git a/lib/observability/metrics/registry_test.go b/lib/observability/metrics/registry_test.go
new file mode 100644
index 0000000000000..7bfc166a75f90
--- /dev/null
+++ b/lib/observability/metrics/registry_test.go
@@ -0,0 +1,72 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package metrics
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWrap(t *testing.T) {
+	testNamespace := "namespace"
+	tests := []struct {
+		name              string
+		existingSubsystem string
+		wrappingSubsystem string
+		expectedSubsystem string
+	}{
+		{
+			name:              "empty subsystem + empty subsystem",
+			existingSubsystem: "",
+			wrappingSubsystem: "",
+			expectedSubsystem: "",
+		},
+		{
+			name:              "empty subsystem + non-empty subsystem",
+			existingSubsystem: "",
+			wrappingSubsystem: "test",
+			expectedSubsystem: "test",
+		},
+		{
+			name:              "non-empty subsystem + empty subsystem",
+			existingSubsystem: "test",
+			wrappingSubsystem: "",
+			expectedSubsystem: "test",
+		},
+		{
+			name:              "non-empty subsystem + non-empty subsystem",
+			existingSubsystem: "test",
+			wrappingSubsystem: "test",
+			expectedSubsystem: "test_test",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			r := &Registry{
+				Registerer: nil,
+				namespace:  testNamespace,
+				subsystem:  test.existingSubsystem,
+			}
+			result := r.Wrap(test.wrappingSubsystem)
+			require.Equal(t, test.expectedSubsystem, result.subsystem)
+			require.Equal(t, testNamespace, result.namespace)
+		})
+	}
+}
diff --git a/lib/observability/tracing/client.go b/lib/observability/tracing/client.go
index 58295820f68db..db4e54a2d8361 100644
--- a/lib/observability/tracing/client.go
+++ b/lib/observability/tracing/client.go
@@ -22,19 +22,25 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
+	"log/slog"
 	"os"
 	"strconv"
 	"sync"
 	"time"
 
 	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+	otlpcommon "go.opentelemetry.io/proto/otlp/common/v1"
 	otlp "go.opentelemetry.io/proto/otlp/trace/v1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/protobuf/encoding/protojson"
+
+	"github.com/gravitational/teleport/lib/observability/tracing/internal/tracetransform"
 )
 
 type noopClient struct{}
@@ -226,3 +232,166 @@ func (f *RotatingFileClient) UploadTraces(ctx context.Context, protoSpans []*otl
 
 	return nil
 }
+
+// bufferedClient is an [otlptrace.Client] implementation that buffers uploaded
+// spans in memory until a real client and all resource attributes are available.
+type bufferedClient struct {
+	logger *slog.Logger
+
+	// mu synchronizes access to all below fields.
+	mu sync.Mutex
+
+	bufferedSpans [][]*otlp.ResourceSpans
+
+	// client and closer will not be modified and are safe to reference without
+	// locking after waitingForClient is false.
+	waitingForClient bool
+	client           otlptrace.Client
+	closer           io.Closer
+	started          bool
+
+	// delayedResourceAttrs will not be modified and is safe to reference
+	// without locking after waitingForDelayedResourceAttrs is false.
+	waitingForDelayedResourceAttrs bool
+	delayedResourceAttrs           []*otlpcommon.KeyValue
+}
+
+func newBufferedClient(cfg Config) (*bufferedClient, error) {
+	bufClient := &bufferedClient{
+		logger:                         cfg.Logger,
+		waitingForClient:               cfg.WaitForDelayedClient,
+		waitingForDelayedResourceAttrs: cfg.WaitForDelayedResourceAttrs,
+	}
+	if !cfg.WaitForDelayedClient {
+		var err error
+		bufClient.client, err = NewClient(cfg)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	return bufClient, nil
+}
+
+// Start implements [otlptrace.Client.Start].
+func (b *bufferedClient) Start(ctx context.Context) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.started = true
+	if b.client != nil {
+		return trace.Wrap(b.client.Start(ctx))
+	}
+	return nil
+}
+
+// Stop implements [otlptrace.Client.Stop].
+func (b *bufferedClient) Stop(ctx context.Context) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	var (
+		stopErr  error
+		closeErr error
+	)
+	if b.client != nil {
+		stopErr = trace.Wrap(b.client.Stop(ctx))
+	}
+	if b.closer != nil {
+		closeErr = trace.Wrap(b.closer.Close())
+	}
+	b.bufferedSpans = nil
+	return trace.NewAggregate(stopErr, closeErr)
+}
+
+// UploadTraces implements [otlptrace.Client.UploadTraces]. It may be called
+// concurrently. If the client is ready, the traces are immediately uploaded.
+// Otherwise, the traces are buffered in memory until the delayed client or
+// resource attributes are provided.
+func (b *bufferedClient) UploadTraces(ctx context.Context, protoSpans []*otlp.ResourceSpans) error {
+	b.mu.Lock()
+	if b.ready() {
+		b.mu.Unlock()
+		return b.uploadTracesToClient(ctx, protoSpans, b.delayedResourceAttrs)
+	}
+	b.bufferedSpans = append(b.bufferedSpans, protoSpans)
+	const maxBufferedSpanBatches = 32
+	if len(b.bufferedSpans) > maxBufferedSpanBatches {
+		// nil out the pointer in the backing array before reslicing so the GC
+		// can reclaim the memory, these batches of spans could be relatively large.
+		b.bufferedSpans[0] = nil
+		b.bufferedSpans = b.bufferedSpans[1:]
+	}
+	b.mu.Unlock()
+	return nil
+}
+
+// uploadTracesToClient must only be called after b is ready (both
+// waitingForClient and waitingForDelayedResourceAttrs are false), no locking
+// is required.
+func (b *bufferedClient) uploadTracesToClient(ctx context.Context, protoSpans []*otlp.ResourceSpans, delayedResourceAttrs []*otlpcommon.KeyValue) error {
+	// First append any delayed resource attributes to the spans.
+	for _, protoSpan := range protoSpans {
+		if protoSpan.Resource == nil {
+			continue
+		}
+		protoSpan.Resource.Attributes = append(protoSpan.Resource.Attributes, delayedResourceAttrs...)
+	}
+	// Upload the spans with all attributes to the real client.
+	return trace.Wrap(b.client.UploadTraces(ctx, protoSpans))
+}
+
+func (b *bufferedClient) setDelayedResourceAttrs(ctx context.Context, attrs []attribute.KeyValue) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if !b.waitingForDelayedResourceAttrs {
+		return trace.BadParameter("delayed resource attributes cannot be set more than once")
+	}
+	// Transform the attributes to the format required for use in uploadTracesToClient.
+	b.delayedResourceAttrs = tracetransform.KeyValues(attrs)
+	b.waitingForDelayedResourceAttrs = false
+	b.uploadBufferedSpansIfReady(ctx)
+	return nil
+}
+
+func (b *bufferedClient) setClient(ctx context.Context, client ClosableClient) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if !b.waitingForClient {
+		return trace.BadParameter("client cannot be set more than once")
+	}
+	b.client = client
+	b.closer = client
+	b.waitingForClient = false
+	if b.started {
+		if err := client.Start(ctx); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	b.uploadBufferedSpansIfReady(ctx)
+	return nil
+}
+
+// uploadBufferedSpansIfReady is called when either delayed resource attributes
+// or client is provided. If the client is now ready, it uploads all the
+// buffered spans to the real client in a background goroutine.
+func (b *bufferedClient) uploadBufferedSpansIfReady(ctx context.Context) {
+	if b.ready() {
+		// b.bufferedSpans will not be used after b becomes ready.
+		// Setting the slice to nil should allow the GC to reclaim the memory
+		// after all buffered spans have been uploaded and the goroutine exits.
+		bufferedSpans := b.bufferedSpans
+		b.bufferedSpans = nil
+		go func() {
+			// Spans are buffered and uploaded in their original chunk sizes as
+			// passed to UploadTraces to avoid exceeding the maximum size of a
+			// single message.
+			for _, spans := range bufferedSpans {
+				if err := b.uploadTracesToClient(ctx, spans, b.delayedResourceAttrs); err != nil {
+					b.logger.WarnContext(ctx, "Failed to upload chunk of buffered spans", "error", err)
+				}
+			}
+		}()
+	}
+}
+
+func (b *bufferedClient) ready() bool {
+	return !b.waitingForDelayedResourceAttrs && !b.waitingForClient
+}
diff --git a/lib/observability/tracing/collector.go b/lib/observability/tracing/collector.go
index 0520b977be0c9..296ae6addcf06 100644
--- a/lib/observability/tracing/collector.go
+++ b/lib/observability/tracing/collector.go
@@ -50,9 +50,10 @@ type Collector struct {
 	coltracepb.TraceServiceServer
 	tlsConfing *tls.Config
 
-	spanLock  sync.RWMutex
-	spans     []*otlp.ScopeSpans
-	exportedC chan struct{}
+	spanLock      sync.RWMutex
+	spans         []*otlp.ScopeSpans
+	resourceSpans []*otlp.ResourceSpans
+	exportedC     chan struct{}
 }
 
 // CollectorConfig configures how a Collector should be created.
@@ -198,6 +199,7 @@ func (c *Collector) Export(ctx context.Context, req *coltracepb.ExportTraceServi
 	c.spanLock.Lock()
 	defer c.spanLock.Unlock()
 
+	c.resourceSpans = append(c.resourceSpans, req.ResourceSpans...)
 	for _, span := range req.ResourceSpans {
 		c.spans = append(c.spans, span.ScopeSpans...)
 	}
@@ -222,6 +224,20 @@ func (c *Collector) Spans() []*otlp.ScopeSpans {
 	copy(spans, c.spans)
 
 	c.spans = nil
+	c.resourceSpans = nil
 
 	return spans
 }
+
+// ResourceSpans returns all collected resource spans and resets the collector.
+func (c *Collector) ResourceSpans() []*otlp.ResourceSpans {
+	c.spanLock.Lock()
+	defer c.spanLock.Unlock()
+	resourceSpans := make([]*otlp.ResourceSpans, len(c.resourceSpans))
+	copy(resourceSpans, c.resourceSpans)
+
+	c.spans = nil
+	c.resourceSpans = nil
+
+	return resourceSpans
+}
diff --git a/lib/observability/tracing/exporter.go b/lib/observability/tracing/exporter.go
index c766f6138f5f5..ae5f1d262039d 100644
--- a/lib/observability/tracing/exporter.go
+++ b/lib/observability/tracing/exporter.go
@@ -27,32 +27,50 @@ import (
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 )
 
-// NewExporter returns a new exporter that is configured per the provided Config.
-func NewExporter(ctx context.Context, cfg Config) (sdktrace.SpanExporter, error) {
+// newExporter returns a new exporter that is configured per the provided Config.
+// It also returns a *bufferedClient if one is required because the resource
+// attributes or the real client are not yet available, otherwise it will be
+// nil.
+func newExporter(ctx context.Context, cfg Config) (sdktrace.SpanExporter, *bufferedClient, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
 
-	traceClient, err := NewClient(cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
+	var (
+		traceClient otlptrace.Client
+		bufClient   *bufferedClient
+		err         error
+	)
+	if cfg.WaitForDelayedResourceAttrs || cfg.WaitForDelayedClient {
+		// newBufferedClient will create the client if possible, or wait for a
+		// delayed client to be provided later.
+		bufClient, err = newBufferedClient(cfg)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+		traceClient = bufClient
+	} else {
+		traceClient, err = NewClient(cfg)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
 	}
 
 	ctx, cancel := context.WithTimeout(ctx, cfg.DialTimeout)
 	defer cancel()
 	exporter, err := otlptrace.New(ctx, traceClient)
 	if err != nil {
-		return nil, trace.NewAggregate(err, traceClient.Stop(context.Background()))
+		return nil, nil, trace.NewAggregate(err, traceClient.Stop(context.Background()))
 	}
 
 	if cfg.Client == nil {
-		return exporter, nil
+		return exporter, bufClient, nil
 	}
 
 	return &wrappedExporter{
 		exporter: exporter,
 		closer:   cfg.Client,
-	}, nil
+	}, bufClient, nil
 }
 
 // wrappedExporter is a sdktrace.SpanExporter wrapper that is used to ensure that any
diff --git a/lib/observability/tracing/internal/tracetransform/attribute.go b/lib/observability/tracing/internal/tracetransform/attribute.go
new file mode 100644
index 0000000000000..104cb899deda6
--- /dev/null
+++ b/lib/observability/tracing/internal/tracetransform/attribute.go
@@ -0,0 +1,131 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+// Package tracetransform provides conversion functionality for the otlptrace
+// exporters.
+//
+// This code has been copied from https://github.com/open-telemetry/opentelemetry-go/blob/main/exporters/otlp/otlptrace/internal/tracetransform/attribute.go
+package tracetransform
+
+import (
+	"go.opentelemetry.io/otel/attribute"
+	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
+)
+
+// KeyValues transforms a slice of attribute KeyValues into OTLP key-values.
+func KeyValues(attrs []attribute.KeyValue) []*commonpb.KeyValue {
+	if len(attrs) == 0 {
+		return nil
+	}
+
+	out := make([]*commonpb.KeyValue, 0, len(attrs))
+	for _, kv := range attrs {
+		out = append(out, KeyValue(kv))
+	}
+	return out
+}
+
+// KeyValue transforms an attribute KeyValue into an OTLP key-value.
+func KeyValue(kv attribute.KeyValue) *commonpb.KeyValue {
+	return &commonpb.KeyValue{Key: string(kv.Key), Value: Value(kv.Value)}
+}
+
+// Value transforms an attribute Value into an OTLP AnyValue.
+func Value(v attribute.Value) *commonpb.AnyValue {
+	av := new(commonpb.AnyValue)
+	switch v.Type() {
+	case attribute.BOOL:
+		av.Value = &commonpb.AnyValue_BoolValue{
+			BoolValue: v.AsBool(),
+		}
+	case attribute.BOOLSLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: boolSliceValues(v.AsBoolSlice()),
+			},
+		}
+	case attribute.INT64:
+		av.Value = &commonpb.AnyValue_IntValue{
+			IntValue: v.AsInt64(),
+		}
+	case attribute.INT64SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: int64SliceValues(v.AsInt64Slice()),
+			},
+		}
+	case attribute.FLOAT64:
+		av.Value = &commonpb.AnyValue_DoubleValue{
+			DoubleValue: v.AsFloat64(),
+		}
+	case attribute.FLOAT64SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: float64SliceValues(v.AsFloat64Slice()),
+			},
+		}
+	case attribute.STRING:
+		av.Value = &commonpb.AnyValue_StringValue{
+			StringValue: v.AsString(),
+		}
+	case attribute.STRINGSLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: stringSliceValues(v.AsStringSlice()),
+			},
+		}
+	default:
+		av.Value = &commonpb.AnyValue_StringValue{
+			StringValue: "INVALID",
+		}
+	}
+	return av
+}
+
+func boolSliceValues(vals []bool) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_BoolValue{
+				BoolValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func int64SliceValues(vals []int64) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_IntValue{
+				IntValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func float64SliceValues(vals []float64) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_DoubleValue{
+				DoubleValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func stringSliceValues(vals []string) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_StringValue{
+				StringValue: v,
+			},
+		}
+	}
+	return converted
+}
diff --git a/lib/observability/tracing/tracing.go b/lib/observability/tracing/tracing.go
index 92809fd2b1619..e07faa8223311 100644
--- a/lib/observability/tracing/tracing.go
+++ b/lib/observability/tracing/tracing.go
@@ -21,6 +21,7 @@ package tracing
 import (
 	"context"
 	"crypto/tls"
+	"io"
 	"log/slog"
 	"net"
 	"net/url"
@@ -30,6 +31,7 @@ import (
 	"github.com/gravitational/trace"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
@@ -79,6 +81,18 @@ type Config struct {
 	// tracing provider. It should **NOT** be closed by the caller.
 	Client *tracing.Client
 
+	// WaitForDelayedClient indicates that the client is not available at the
+	// time the Provider is being created. If this is set to true, SetClient is
+	// expected to be called on the Provider. A limited number of spans will be
+	// buffered in memory until SetDelayedClient is called.
+	WaitForDelayedClient bool
+	// WaitForDelayedResourceAttrs indicates that some resource attributes are
+	// not available at the time the Provider is being created. If this is set
+	// to true, SetDelayedResourceAttrs is expected to be called on the
+	// Provider. A limited number of spans will be buffered in memory until
+	// SetDelayedResourceAttrs is called.
+	WaitForDelayedResourceAttrs bool
+
 	// exporterURL is the parsed value of ExporterURL that is populated
 	// by CheckAndSetDefaults
 	exporterURL *url.URL
@@ -90,10 +104,6 @@ func (c *Config) CheckAndSetDefaults() error {
 		return trace.BadParameter("service name cannot be empty")
 	}
 
-	if c.Client == nil && c.ExporterURL == "" {
-		return trace.BadParameter("exporter URL cannot be empty")
-	}
-
 	if c.DialTimeout <= 0 {
 		c.DialTimeout = DefaultExporterDialTimeout
 	}
@@ -102,7 +112,10 @@ func (c *Config) CheckAndSetDefaults() error {
 		c.Logger = slog.With(teleport.ComponentKey, teleport.ComponentTracing)
 	}
 
-	if c.Client != nil {
+	if c.Client == nil && !c.WaitForDelayedClient && c.ExporterURL == "" {
+		return trace.BadParameter("exporter URL cannot be empty")
+	}
+	if c.ExporterURL == "" {
 		return nil
 	}
 
@@ -144,7 +157,8 @@ func (c *Config) Endpoint() string {
 
 // Provider wraps the OpenTelemetry tracing provider to provide common tags for all tracers.
 type Provider struct {
-	provider *sdktrace.TracerProvider
+	provider       *sdktrace.TracerProvider
+	bufferedClient *bufferedClient
 
 	embedded.TracerProvider
 }
@@ -187,7 +201,7 @@ func NewTraceProvider(ctx context.Context, cfg Config) (*Provider, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	exporter, err := NewExporter(ctx, cfg)
+	exporter, bufClient, err := newExporter(ctx, cfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -228,9 +242,37 @@ func NewTraceProvider(ctx context.Context, cfg Config) (*Provider, error) {
 			sdktrace.WithResource(res),
 			sdktrace.WithSpanProcessor(sdktrace.NewBatchSpanProcessor(exporter)),
 		),
+		bufferedClient: bufClient,
 	}
 
 	otel.SetTracerProvider(provider)
 
 	return provider, nil
 }
+
+// SetDelayedResourceAttrs sets resource attributes that were not available
+// when the Provider was created but should be included in all exported spans.
+// The context may be used to upload buffered spans to the upstream client.
+func (p *Provider) SetDelayedResourceAttrs(ctx context.Context, attrs []attribute.KeyValue) error {
+	if p.bufferedClient == nil {
+		return trace.BadParameter("SetDelayedResourceAttrs called without setting cfg.WaitForDelayedAttributes")
+	}
+	return trace.Wrap(p.bufferedClient.setDelayedResourceAttrs(ctx, attrs))
+}
+
+// ClosableClient is an [otlptrace.Client] implementation that can also be closed.
+type ClosableClient interface {
+	otlptrace.Client
+	io.Closer
+}
+
+// SetClient provides a tracing client to the Provider that was not available
+// when the Provider was created. Ownership is transferred to the Provider, it
+// should not be closed by the caller. The context may be used to upload
+// buffered spans to the client.
+func (p *Provider) SetClient(ctx context.Context, clt ClosableClient) error {
+	if p.bufferedClient == nil {
+		return trace.BadParameter("SetClient called without setting cfg.WaitForDelayedClient")
+	}
+	return trace.Wrap(p.bufferedClient.setClient(ctx, clt))
+}
diff --git a/lib/observability/tracing/tracing_test.go b/lib/observability/tracing/tracing_test.go
index ce7253b380eb1..97a09b488a264 100644
--- a/lib/observability/tracing/tracing_test.go
+++ b/lib/observability/tracing/tracing_test.go
@@ -38,7 +38,10 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 )
 
 func generateTLSCertificate() (tls.Certificate, error) {
@@ -158,10 +161,11 @@ func TestNewExporter(t *testing.T) {
 	}()
 
 	cases := []struct {
-		name              string
-		config            Config
-		errAssertion      require.ErrorAssertionFunc
-		exporterAssertion require.ValueAssertionFunc
+		name                    string
+		config                  Config
+		errAssertion            require.ErrorAssertionFunc
+		exporterAssertion       require.ValueAssertionFunc
+		bufferedClientAssertion require.ValueAssertionFunc
 	}{
 		{
 			name: "invalid config",
@@ -169,7 +173,8 @@ func TestNewExporter(t *testing.T) {
 				require.Error(t, err, i...)
 				require.True(t, trace.IsBadParameter(err), i...)
 			},
-			exporterAssertion: require.Nil,
+			exporterAssertion:       require.Nil,
+			bufferedClientAssertion: require.Nil,
 		},
 		{
 			name: "invalid exporter url",
@@ -181,7 +186,8 @@ func TestNewExporter(t *testing.T) {
 				require.Error(t, err, i...)
 				require.True(t, trace.IsBadParameter(err), i...)
 			},
-			exporterAssertion: require.Nil,
+			exporterAssertion:       require.Nil,
+			bufferedClientAssertion: require.Nil,
 		},
 		{
 			name: "successful explicit grpc exporter",
@@ -190,8 +196,9 @@ func TestNewExporter(t *testing.T) {
 				ExporterURL: c.GRPCAddr(),
 				DialTimeout: time.Second,
 			},
-			errAssertion:      require.NoError,
-			exporterAssertion: require.NotNil,
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.Nil,
 		},
 		{
 			name: "successful inferred grpc exporter",
@@ -200,8 +207,9 @@ func TestNewExporter(t *testing.T) {
 				ExporterURL: c.GRPCAddr()[len("grpc://"):],
 				DialTimeout: time.Second,
 			},
-			errAssertion:      require.NoError,
-			exporterAssertion: require.NotNil,
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.Nil,
 		},
 		{
 			name: "successful http exporter",
@@ -210,8 +218,9 @@ func TestNewExporter(t *testing.T) {
 				ExporterURL: c.HTTPAddr(),
 				DialTimeout: time.Second,
 			},
-			errAssertion:      require.NoError,
-			exporterAssertion: require.NotNil,
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.Nil,
 		},
 		{
 			name: "file exporter",
@@ -219,19 +228,43 @@ func TestNewExporter(t *testing.T) {
 				Service:     "test",
 				ExporterURL: "file://" + t.TempDir(),
 			},
-			errAssertion:      require.NoError,
-			exporterAssertion: require.NotNil,
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.Nil,
+		},
+		{
+			name: "delayed resource attributes",
+			config: Config{
+				Service:                     "test",
+				ExporterURL:                 "file://" + t.TempDir(),
+				WaitForDelayedResourceAttrs: true,
+			},
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.NotNil,
+		},
+		{
+			name: "delayed client",
+			config: Config{
+				Service:              "test",
+				ExporterURL:          "file://" + t.TempDir(),
+				WaitForDelayedClient: true,
+			},
+			errAssertion:            require.NoError,
+			exporterAssertion:       require.NotNil,
+			bufferedClientAssertion: require.NotNil,
 		},
 	}
 
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
-			exporter, err := NewExporter(context.Background(), tt.config)
+			exporter, bufClient, err := newExporter(context.Background(), tt.config)
 			if exporter != nil {
 				t.Cleanup(func() { require.NoError(t, exporter.Shutdown(context.Background())) })
 			}
 			tt.errAssertion(t, err)
 			tt.exporterAssertion(t, exporter)
+			tt.bufferedClientAssertion(t, bufClient)
 		})
 	}
 }
@@ -373,6 +406,136 @@ func TestTraceProvider(t *testing.T) {
 	}
 }
 
+func TestDelayed(t *testing.T) {
+	for _, tc := range []struct {
+		desc                 string
+		staticResourceAttrs  []attribute.KeyValue
+		delayedResourceAttrs []attribute.KeyValue
+		delayClient          bool
+	}{
+		{
+			desc: "no delay",
+			staticResourceAttrs: []attribute.KeyValue{
+				attribute.String("static", "true"),
+			},
+		},
+		{
+			desc: "delayed resource attributes",
+			staticResourceAttrs: []attribute.KeyValue{
+				attribute.String("static", "true"),
+			},
+			delayedResourceAttrs: []attribute.KeyValue{
+				attribute.String("delayed", "true"),
+				attribute.Int("delayed_int", 3),
+			},
+		},
+		{
+			desc: "delayed client",
+			staticResourceAttrs: []attribute.KeyValue{
+				attribute.String("static", "true"),
+			},
+			delayClient: true,
+		},
+		{
+			desc: "both delayed",
+			staticResourceAttrs: []attribute.KeyValue{
+				attribute.String("static", "true"),
+			},
+			delayedResourceAttrs: []attribute.KeyValue{
+				attribute.String("delayed", "true"),
+				attribute.Int("delayed_int", 3),
+			},
+			delayClient: true,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			collector, err := NewCollector(CollectorConfig{})
+			require.NoError(t, err)
+
+			t.Cleanup(func() {
+				shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 3*time.Second)
+				defer shutdownCancel()
+				require.NoError(t, collector.Shutdown(shutdownCtx))
+			})
+			go func() {
+				assert.NoError(t, collector.Start())
+			}()
+
+			cfg := Config{
+				Service:                     "test",
+				SamplingRate:                1.0,
+				ExporterURL:                 collector.GRPCAddr(),
+				DialTimeout:                 time.Second,
+				Attributes:                  tc.staticResourceAttrs,
+				WaitForDelayedResourceAttrs: len(tc.delayedResourceAttrs) > 0,
+				WaitForDelayedClient:        tc.delayClient,
+			}
+
+			var delayedClient ClosableClient
+			if tc.delayClient {
+				clt, err := NewClient(cfg)
+				require.NoError(t, err)
+				delayedClient = &closeableClient{clt}
+				cfg.ExporterURL = ""
+			}
+
+			ctx := context.Background()
+			provider, err := NewTraceProvider(ctx, cfg)
+			require.NoError(t, err)
+
+			tracer := provider.Tracer("test")
+			const spanCount = 4
+
+			for i := range spanCount / 2 {
+				_, span := tracer.Start(ctx, fmt.Sprintf("test%d", i))
+				span.End()
+			}
+
+			if len(tc.delayedResourceAttrs) > 0 {
+				require.NoError(t, provider.SetDelayedResourceAttrs(t.Context(), tc.delayedResourceAttrs))
+			}
+			if tc.delayClient {
+				require.NoError(t, provider.SetClient(t.Context(), delayedClient))
+			}
+
+			for i := range spanCount / 2 {
+				_, span := tracer.Start(ctx, fmt.Sprintf("test%d", spanCount/2+i))
+				span.End()
+			}
+
+			require.NoError(t, provider.Shutdown(t.Context()))
+
+			resourceSpans := collector.ResourceSpans()
+			totalSpans := 0
+			for _, resourceSpan := range resourceSpans {
+				expectedResourceAttrs := make(map[string]struct{})
+				for _, attr := range tc.staticResourceAttrs {
+					expectedResourceAttrs[string(attr.Key)] = struct{}{}
+				}
+				for _, attr := range tc.delayedResourceAttrs {
+					expectedResourceAttrs[string(attr.Key)] = struct{}{}
+				}
+				for _, attr := range resourceSpan.Resource.Attributes {
+					delete(expectedResourceAttrs, attr.Key)
+				}
+				assert.Empty(t, expectedResourceAttrs, "some expected resource attributes were not included in this span")
+				for _, scopeSpan := range resourceSpan.ScopeSpans {
+					totalSpans += len(scopeSpan.Spans)
+				}
+			}
+			assert.Equal(t, spanCount, totalSpans)
+		})
+	}
+}
+
+type closeableClient struct {
+	otlptrace.Client
+}
+
+func (c *closeableClient) Close() error {
+	return nil
+}
+
 func TestConfig_CheckAndSetDefaults(t *testing.T) {
 	cases := []struct {
 		name           string
diff --git a/lib/oidc/caching_token_validator.go b/lib/oidc/caching_token_validator.go
new file mode 100644
index 0000000000000..3425e8460292c
--- /dev/null
+++ b/lib/oidc/caching_token_validator.go
@@ -0,0 +1,259 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package oidc
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/client"
+	"github.com/zitadel/oidc/v3/pkg/client/rp"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var log = logutils.NewPackageLogger(teleport.ComponentKey, teleport.Component("oidc"))
+
+const (
+	// discoveryTTL is the maximum duration a discovery configuration will be
+	// cached locally before being discarded
+	discoveryTTL = time.Hour
+
+	// keySetTTL is the maximum duration a particular keyset will be allowed to
+	// exist before being purged, regardless of whether or not it is being used
+	// actively. The underlying library may update its internal cache of keys
+	// within this window.
+	keySetTTL = time.Hour * 24
+
+	// validatorTTL is a maximum time a particular validator instance should
+	// remain in memory before being pruned if left unused.
+	validatorTTL = time.Hour * 24 * 2
+)
+
+// validatorKey is a composite key for the validator instance map
+type validatorKey struct {
+	issuer   string
+	audience string
+}
+
+// NewCachingTokenValidator creates a caching validator for the given issuer and
+// audience, using a real clock.
+func NewCachingTokenValidator[C oidc.Claims](clock clockwork.Clock) (*CachingTokenValidator[C], error) {
+	if clock == nil {
+		clock = clockwork.NewRealClock()
+	}
+
+	cache, err := utils.NewFnCache(utils.FnCacheConfig{
+		Clock:       clock,
+		TTL:         validatorTTL,
+		ReloadOnErr: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &CachingTokenValidator[C]{
+		clock: clock,
+		cache: cache,
+	}, nil
+}
+
+// CachingTokenValidator is a wrapper on top of `CachingValidatorInstance` that
+// automatically manages and prunes validator instances for a given
+// (issuer, audience) pair. This helps to ensure validators and key sets don't
+// remain in memory indefinitely if e.g. a Teleport auth token is modified to
+// use a different issuer or removed outright.
+type CachingTokenValidator[C oidc.Claims] struct {
+	clock clockwork.Clock
+
+	cache *utils.FnCache
+}
+
+// GetValidator retreives a validator for the given issuer and audience. This
+// will create a new validator instance if necessary, and will occasionally
+// prune old instances that have not been used to validate any tokens in some
+// time.
+func (v *CachingTokenValidator[C]) GetValidator(ctx context.Context, issuer, audience string) (*CachingValidatorInstance[C], error) {
+	key := validatorKey{issuer: issuer, audience: audience}
+	instance, err := utils.FnCacheGet(ctx, v.cache, key, func(ctx context.Context) (*CachingValidatorInstance[C], error) {
+		transport, err := defaults.Transport()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &CachingValidatorInstance[C]{
+			client:     &http.Client{Transport: otelhttp.NewTransport(transport)},
+			clock:      v.clock,
+			issuer:     issuer,
+			audience:   audience,
+			verifierFn: zoidcTokenVerifier[C],
+			logger:     log.With("issuer", issuer, "audience", audience),
+		}, nil
+	})
+
+	return instance, err
+}
+
+// CachingValidatorInstance provides an issuer-specific cache. It separately
+// caches the discovery config and `oidc.KeySet` to ensure each is reasonably
+// fresh, and purges sufficiently old key sets to ensure old keys are not
+// retained indefinitely.
+type CachingValidatorInstance[C oidc.Claims] struct {
+	issuer   string
+	audience string
+	clock    clockwork.Clock
+	client   *http.Client
+	logger   *slog.Logger
+
+	mu                     sync.Mutex
+	discoveryConfig        *oidc.DiscoveryConfiguration
+	discoveryConfigExpires time.Time
+	lastJWKSURI            string
+	keySet                 oidc.KeySet
+	keySetExpires          time.Time
+
+	// verifierFn is the function that actually verifies the token using the
+	// oidc library. `zitadel/oidc` doesn't provide any way to override the
+	// clock, so we use this for tests.
+	verifierFn func(
+		ctx context.Context,
+		issuer,
+		clientID string,
+		keySet oidc.KeySet,
+		token string,
+		opts ...rp.VerifierOption,
+	) (C, error)
+}
+
+func (v *CachingValidatorInstance[C]) getKeySet(
+	ctx context.Context,
+) (oidc.KeySet, error) {
+	// Note: We could consider an RWLock or singleflight if perf proves to be
+	// poor here. As written, I don't expect serialized warm-cache requests to
+	// accumulate enough to be worth the added complexity.
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	now := v.clock.Now()
+
+	if !v.discoveryConfigExpires.IsZero() && now.After(v.discoveryConfigExpires) {
+		// Invalidate the cached value.
+		v.discoveryConfig = nil
+		v.discoveryConfigExpires = time.Time{}
+
+		v.logger.DebugContext(ctx, "Invalidating expired discovery config")
+	}
+
+	if v.discoveryConfig == nil {
+		v.logger.DebugContext(ctx, "Fetching new discovery config")
+
+		// Note: This is the only blocking call inside the mutex.
+		// In the future, it might be a good idea to fetch the new discovery
+		// config async and keep it available if the refresh fails.
+		dc, err := client.Discover(ctx, v.issuer, v.client)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		v.discoveryConfig = dc
+		v.discoveryConfigExpires = now.Add(discoveryTTL)
+
+		if v.lastJWKSURI != "" && v.lastJWKSURI != dc.JwksURI {
+			// If the JWKS URI has changed, expire the keyset now.
+			v.keySet = nil
+			v.keySetExpires = time.Time{}
+		}
+		v.lastJWKSURI = dc.JwksURI
+	}
+
+	// If this upstream issue is fixed, we can remove this in favor of keeping
+	// the KeySet: https://github.com/zitadel/oidc/issues/747
+	if !v.keySetExpires.IsZero() && now.After(v.keySetExpires) {
+		// Invalidate the cached value.
+		v.keySet = nil
+		v.keySetExpires = time.Time{}
+
+		v.logger.DebugContext(ctx, "Invalidating expired KeySet")
+	}
+
+	if v.keySet == nil {
+		v.logger.DebugContext(ctx, "Creating new remote KeySet")
+		v.keySet = rp.NewRemoteKeySet(v.client, v.discoveryConfig.JwksURI)
+		v.keySetExpires = now.Add(keySetTTL)
+	}
+
+	return v.keySet, nil
+}
+
+func zoidcTokenVerifier[C oidc.Claims](
+	ctx context.Context,
+	issuer,
+	clientID string,
+	keySet oidc.KeySet,
+	token string,
+	opts ...rp.VerifierOption,
+) (C, error) {
+	verifier := rp.NewIDTokenVerifier(issuer, clientID, keySet, opts...)
+
+	// Note: VerifyIDToken() may mutate the KeySet (if the keyset is empty or if
+	// it encounters an unknown `kid`). The keyset manages a mutex of its own,
+	// so we don't need to protect this operation. It's acceptable for this
+	// keyset to be swapped in another thread and still used here; it will just
+	// be GC'd afterward.
+	claims, err := rp.VerifyIDToken[C](ctx, token, verifier)
+	if err != nil {
+		return *new(C), trace.Wrap(err, "verifying token")
+	}
+
+	return claims, nil
+}
+
+// ValidateToken verifies a compact encoded token against the configured
+// issuer and keys, potentially using cached OpenID configuration and JWKS
+// values.
+func (v *CachingValidatorInstance[C]) ValidateToken(
+	ctx context.Context,
+	token string,
+	opts ...rp.VerifierOption,
+) (C, error) {
+	timeoutCtx, cancel := context.WithTimeout(ctx, providerTimeout)
+	defer cancel()
+
+	ks, err := v.getKeySet(timeoutCtx)
+	if err != nil {
+		return *new(C), trace.Wrap(err)
+	}
+
+	claims, err := v.verifierFn(ctx, v.issuer, v.audience, ks, token, opts...)
+	if err != nil {
+		return *new(C), trace.Wrap(err)
+	}
+
+	return claims, nil
+}
diff --git a/lib/oidc/caching_token_validator_test.go b/lib/oidc/caching_token_validator_test.go
new file mode 100644
index 0000000000000..8e51ef93081d5
--- /dev/null
+++ b/lib/oidc/caching_token_validator_test.go
@@ -0,0 +1,396 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package oidc
+
+import (
+	"context"
+	"crypto"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/client/rp"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
+
+// fakeIDP provides a minimal fake OIDC provider for use in tests
+type fakeIDP struct {
+	t         *testing.T
+	clock     *clockwork.FakeClock
+	signer    jose.Signer
+	publicKey crypto.PublicKey
+	server    *httptest.Server
+	audience  string
+
+	useAlternateJWKSEndpoint atomic.Bool
+	configRequests           atomic.Uint32
+	jwksRequests             atomic.Uint32
+}
+
+func newFakeIDP(t *testing.T, clock *clockwork.FakeClock, audience string) *fakeIDP {
+	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.RSA2048)
+	require.NoError(t, err)
+
+	signer, err := jose.NewSigner(
+		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
+		(&jose.SignerOptions{}).WithType("JWT"),
+	)
+	require.NoError(t, err)
+
+	f := &fakeIDP{
+		clock:     clock,
+		signer:    signer,
+		publicKey: privateKey.Public(),
+		t:         t,
+		audience:  audience,
+	}
+
+	providerMux := http.NewServeMux()
+	providerMux.HandleFunc(
+		"/.well-known/openid-configuration",
+		f.handleOpenIDConfig,
+	)
+	providerMux.HandleFunc(
+		"/.well-known/jwks",
+		f.handleJWKSEndpoint,
+	)
+	providerMux.HandleFunc(
+		"/.well-known/jwks-alt",
+		f.handleJWKSEndpoint,
+	)
+
+	srv := httptest.NewServer(providerMux)
+	t.Cleanup(srv.Close)
+	f.server = srv
+	return f
+}
+
+func (f *fakeIDP) issuer() string {
+	return f.server.URL
+}
+
+func (f *fakeIDP) handleOpenIDConfig(w http.ResponseWriter, r *http.Request) {
+	jwksURI := f.issuer() + "/.well-known/jwks"
+	if f.useAlternateJWKSEndpoint.Load() {
+		jwksURI += "-alt"
+	}
+
+	response := map[string]any{
+		"claims_supported": []string{
+			"sub",
+			"iss",
+		},
+		"id_token_signing_alg_values_supported": []string{"RS256"},
+		"issuer":                                f.issuer(),
+		"jwks_uri":                              jwksURI,
+		"response_types_supported":              []string{"id_token"},
+		"scopes_supported":                      []string{"openid"},
+		"subject_types_supported":               []string{"public"},
+	}
+	responseBytes, err := json.Marshal(response)
+	require.NoError(f.t, err)
+	_, err = w.Write(responseBytes)
+	require.NoError(f.t, err)
+
+	f.configRequests.Add(1)
+}
+
+func (f *fakeIDP) handleJWKSEndpoint(w http.ResponseWriter, r *http.Request) {
+	jwks := jose.JSONWebKeySet{
+		Keys: []jose.JSONWebKey{
+			{
+				Key: f.publicKey,
+			},
+		},
+	}
+	responseBytes, err := json.Marshal(jwks)
+	require.NoError(f.t, err)
+	_, err = w.Write(responseBytes)
+	require.NoError(f.t, err)
+
+	f.jwksRequests.Add(1)
+}
+
+func (f *fakeIDP) issueToken(
+	t *testing.T,
+	audience,
+	sub string,
+	ttl time.Duration,
+) string {
+	claims := oidc.TokenClaims{
+		Issuer:     f.issuer(),
+		Subject:    sub,
+		Audience:   oidc.Audience{audience},
+		IssuedAt:   oidc.FromTime(f.clock.Now()),
+		NotBefore:  oidc.FromTime(f.clock.Now()),
+		Expiration: oidc.FromTime(f.clock.Now().Add(ttl)),
+	}
+
+	token, err := jwt.Signed(f.signer).
+		Claims(claims).
+		Serialize()
+	require.NoError(t, err)
+
+	return token
+}
+
+// TestCachingTokenValidator runs various tests against the caching token
+// validator
+func TestCachingTokenValidator(t *testing.T) {
+	t.Parallel()
+
+	const defaultAudience = "example.teleport.sh"
+
+	// A minimal validator that skips most checks, especially any that depend on
+	// the system clock. We do this mainly to still invoke
+	// `keySet.VerifySignature()`.
+	minimalValidator := func() func(
+		context.Context,
+		string, string, oidc.KeySet, string, ...rp.VerifierOption) (*oidc.TokenClaims, error) {
+		return func(
+			ctx context.Context,
+			issuer,
+			clientID string,
+			keySet oidc.KeySet,
+			token string,
+			opts ...rp.VerifierOption,
+		) (*oidc.TokenClaims, error) {
+			var claims oidc.TokenClaims
+			_, err := oidc.ParseToken(token, &claims)
+			if err != nil {
+				return nil, err
+			}
+
+			jws, err := jose.ParseSigned(token, []jose.SignatureAlgorithm{jose.RS256})
+			if err != nil {
+				return nil, err
+			}
+
+			_, err = keySet.VerifySignature(ctx, jws)
+			if err != nil {
+				return nil, err
+			}
+
+			return &claims, nil
+		}
+	}
+
+	tests := []struct {
+		name     string
+		audience string
+		execute  func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims])
+	}{
+		{
+			name:     "empty",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				// Do nothing.
+				require.Zero(t, idp.configRequests.Load())
+				require.Zero(t, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "single validator",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				val, err := v.GetValidator(t.Context(), idp.issuer(), defaultAudience)
+				require.NoError(t, err)
+
+				token := idp.issueToken(t, defaultAudience, "a", time.Hour)
+				claims, err := val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.Equal(t, "a", claims.Subject)
+				require.EqualValues(t, 1, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+
+				token = idp.issueToken(t, defaultAudience, "b", time.Hour)
+				claims, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.Equal(t, "b", claims.Subject)
+				require.EqualValues(t, 1, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "multiple validators",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				v1, err := v.GetValidator(t.Context(), idp.issuer(), "a.teleport.sh")
+				require.NoError(t, err)
+				v2, err := v.GetValidator(t.Context(), idp.issuer(), "b.teleport.sh")
+				require.NoError(t, err)
+
+				token := idp.issueToken(t, "a.teleport.sh", "a", time.Hour)
+				claims, err := v1.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.Equal(t, "a", claims.Subject)
+				require.EqualValues(t, 1, idp.configRequests.Load(), "config")
+				require.EqualValues(t, 1, idp.jwksRequests.Load(), "jwks")
+
+				token = idp.issueToken(t, "b.teleport.sh", "b", time.Hour)
+				claims, err = v2.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.Equal(t, "b", claims.Subject)
+				require.EqualValues(t, 2, idp.configRequests.Load())
+				require.EqualValues(t, 2, idp.jwksRequests.Load())
+
+				// Validating against a bad token should fail, and should not
+				// result in spurious requests.
+				token = idp.issueToken(t, "c.teleport.sh", "c", time.Hour)
+				_, err = v2.ValidateToken(t.Context(), token)
+				require.Error(t, err)
+
+				require.EqualValues(t, 2, idp.configRequests.Load())
+				require.EqualValues(t, 2, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "expired config",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				val, err := v.GetValidator(t.Context(), idp.issuer(), defaultAudience)
+				require.NoError(t, err)
+				val.verifierFn = minimalValidator()
+
+				token := idp.issueToken(t, defaultAudience, "a", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.EqualValues(t, 1, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+
+				idp.clock.Advance(discoveryTTL + time.Minute)
+				token = idp.issueToken(t, defaultAudience, "b", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				require.EqualValues(t, 2, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "stale config",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				val, err := v.GetValidator(t.Context(), idp.issuer(), defaultAudience)
+				require.NoError(t, err)
+				val.verifierFn = minimalValidator()
+
+				idp.clock.Advance(validatorTTL + time.Minute)
+
+				token := idp.issueToken(t, defaultAudience, "a", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				// This validation attempt should fetch both the config and JWKS
+				// endpoint.
+				require.EqualValues(t, 1, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+
+				idp.clock.Advance(discoveryTTL + time.Minute)
+				token = idp.issueToken(t, defaultAudience, "b", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				// Config should be reloaded, but the keyset will remain cached
+				require.EqualValues(t, 2, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "changed jwks uri",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				val, err := v.GetValidator(t.Context(), idp.issuer(), defaultAudience)
+				require.NoError(t, err)
+				val.verifierFn = minimalValidator()
+
+				idp.clock.Advance(validatorTTL + time.Minute)
+
+				token := idp.issueToken(t, defaultAudience, "a", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				// This validation attempt should fetch both the config and JWKS
+				// endpoint.
+				require.EqualValues(t, 1, idp.configRequests.Load())
+				require.EqualValues(t, 1, idp.jwksRequests.Load())
+
+				// Switch to the new endpoint, advance the clock enough to
+				// trigger a config refresh, and validate again.
+				idp.useAlternateJWKSEndpoint.Store(true)
+				idp.clock.Advance(discoveryTTL + time.Minute)
+				token = idp.issueToken(t, defaultAudience, "b", time.Hour)
+				_, err = val.ValidateToken(t.Context(), token)
+				require.NoError(t, err)
+
+				// Config should be reloaded, and the keyset should be reloaded.
+				require.EqualValues(t, 2, idp.configRequests.Load())
+				require.EqualValues(t, 2, idp.jwksRequests.Load())
+			},
+		},
+		{
+			name:     "validator pruning",
+			audience: defaultAudience,
+			execute: func(t *testing.T, idp *fakeIDP, v *CachingTokenValidator[*oidc.TokenClaims]) {
+				valOld, err := v.GetValidator(t.Context(), idp.issuer(), "a")
+				require.NoError(t, err)
+
+				// After just 1 hour, it should return the same pointer
+				idp.clock.Advance(time.Hour + time.Minute)
+
+				valTemp, err := v.GetValidator(t.Context(), idp.issuer(), "a")
+				require.NoError(t, err)
+				require.Same(t, valOld, valTemp)
+
+				// After 48 hours, make the request again. It's now past its
+				// TTL and should be recreated.
+				idp.clock.Advance(validatorTTL + time.Minute)
+				valNew, err := v.GetValidator(t.Context(), idp.issuer(), "a")
+				require.NoError(t, err)
+				require.NotSame(t, valNew, valOld)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clock := clockwork.NewFakeClock()
+			idp := newFakeIDP(t, clock, tt.audience)
+
+			validator, err := NewCachingTokenValidator[*oidc.TokenClaims](clock)
+			require.NoError(t, err)
+
+			tt.execute(t, idp, validator)
+		})
+	}
+}
diff --git a/integrations/lib/testing/fakejoin/kubesigner.go b/lib/oidc/fakeissuer/kubesigner.go
similarity index 84%
rename from integrations/lib/testing/fakejoin/kubesigner.go
rename to lib/oidc/fakeissuer/kubesigner.go
index 460bfff21320f..575703677433e 100644
--- a/integrations/lib/testing/fakejoin/kubesigner.go
+++ b/lib/oidc/fakeissuer/kubesigner.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package fakejoin
+package fakeissuer
 
 import (
 	"encoding/json"
@@ -30,7 +30,7 @@ import (
 	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport/lib/cryptosuites"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
+	tokenclaims "github.com/gravitational/teleport/lib/kube/token/claims"
 )
 
 // KubernetesSigner is a JWT signer that mimicks the Kubernetes one. The signer mock Kubernetes and
@@ -83,11 +83,16 @@ func (s *KubernetesSigner) GetMarshaledJWKS() (string, error) {
 	return string(jwksData), err
 }
 
+func (s *KubernetesSigner) signWithClaims(claims interface{}) (string, error) {
+	token, err := jwt.Signed(s.signer).Claims(claims).CompactSerialize()
+	return token, trace.Wrap(err)
+}
+
 // SignServiceAccountJWT returns a signed JWT valid 30 minutes (1 min in the past, 29 in the future).
 // This token has the Teleport cluster name in its audience as required by the Kubernetes JWKS join method.
 func (s *KubernetesSigner) SignServiceAccountJWT(pod, namespace, serviceAccount, clusterName string) (string, error) {
 	now := s.clock.Now()
-	claims := kubetoken.ServiceAccountClaims{
+	claims := tokenclaims.ServiceAccountClaims{
 		Claims: jwt.Claims{
 			Subject:  fmt.Sprintf("system:serviceaccount:%s:%s", namespace, serviceAccount),
 			Audience: jwt.Audience{clusterName},
@@ -97,18 +102,21 @@ func (s *KubernetesSigner) SignServiceAccountJWT(pod, namespace, serviceAccount,
 			// The Kubernetes JWKS join method rejects tokens valid more than 30 minutes.
 			Expiry: jwt.NewNumericDate(now.Add(29 * time.Minute)),
 		},
-		Kubernetes: &kubetoken.KubernetesSubClaim{
-			Namespace: namespace,
-			ServiceAccount: &kubetoken.ServiceAccountSubClaim{
-				Name: serviceAccount,
-				UID:  uuid.New().String(),
-			},
-			Pod: &kubetoken.PodSubClaim{
-				Name: pod,
-				UID:  uuid.New().String(),
-			},
+		Kubernetes: kubeClaims(pod, namespace, serviceAccount),
+	}
+	return s.signWithClaims(claims)
+}
+
+func kubeClaims(pod, namespace, serviceAccount string) *tokenclaims.KubernetesSubClaim {
+	return &tokenclaims.KubernetesSubClaim{
+		Namespace: namespace,
+		ServiceAccount: &tokenclaims.ServiceAccountSubClaim{
+			Name: serviceAccount,
+			UID:  uuid.New().String(),
+		},
+		Pod: &tokenclaims.PodSubClaim{
+			Name: pod,
+			UID:  uuid.New().String(),
 		},
 	}
-	token, err := jwt.Signed(s.signer).Claims(claims).CompactSerialize()
-	return token, trace.Wrap(err)
 }
diff --git a/lib/oidc/fakeissuer/oidc.go b/lib/oidc/fakeissuer/oidc.go
new file mode 100644
index 0000000000000..ffccd4003e763
--- /dev/null
+++ b/lib/oidc/fakeissuer/oidc.go
@@ -0,0 +1,169 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package fakeissuer
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+
+	tokenclaims "github.com/gravitational/teleport/lib/kube/token/claims"
+)
+
+// IDP provides a minimal fake OIDC provider for use in tests
+type IDP struct {
+	log    *slog.Logger
+	signer *KubernetesSigner
+	server *httptest.Server
+}
+
+// NewIDP creates a IDP and starts its HTTP server.
+// The caller is responsible for shutting down the server by calling
+// IDP.Close().
+func NewIDP(log *slog.Logger) (*IDP, error) {
+	if log == nil {
+		return nil, trace.BadParameter("nil logger")
+	}
+	signer, err := NewKubernetesSigner(clockwork.NewRealClock())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	f := &IDP{
+		signer: signer,
+		log:    log,
+	}
+
+	providerMux := http.NewServeMux()
+	providerMux.HandleFunc(
+		"/.well-known/openid-configuration",
+		f.handleOpenIDConfig,
+	)
+	providerMux.HandleFunc(
+		"/.well-known/jwks",
+		f.handleJWKSEndpoint,
+	)
+
+	srv := httptest.NewServer(providerMux)
+	f.server = srv
+	return f, nil
+}
+
+// Close shuts down the server and blocks until all outstanding
+// requests on this server have completed.
+func (f *IDP) Close() {
+	f.server.Close()
+}
+
+// IssuerURL returns the URL of the fake IDP.
+func (f *IDP) IssuerURL() string {
+	return f.server.URL
+}
+
+func (f *IDP) handleOpenIDConfig(w http.ResponseWriter, r *http.Request) {
+	// mimic `kubectl get --raw /.well-known/openid-configuration` for an EKS cluster
+	response := map[string]any{
+		"claims_supported": []string{
+			"sub",
+			"iss",
+		},
+		"id_token_signing_alg_values_supported": []string{"RS256"},
+		"issuer":                                f.IssuerURL(),
+		"jwks_uri":                              f.IssuerURL() + "/.well-known/jwks",
+		"response_types_supported":              []string{"id_token"},
+		"scopes_supported":                      []string{"openid"},
+		"subject_types_supported":               []string{"public"},
+	}
+	responseBytes, err := json.Marshal(response)
+	if err != nil {
+		f.log.ErrorContext(r.Context(), "failed to marshal openid-configuration", "error", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	_, err = w.Write(responseBytes)
+	if err != nil {
+		f.log.ErrorContext(r.Context(), "failed to write response", "error", err, "response", string(responseBytes))
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+}
+
+func (f *IDP) handleJWKSEndpoint(w http.ResponseWriter, r *http.Request) {
+	response, err := f.signer.GetMarshaledJWKS()
+	if err != nil {
+		f.log.ErrorContext(r.Context(), "failed to marshall JWKS", "error", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	_, err = w.Write([]byte(response))
+	if err != nil {
+		f.log.ErrorContext(r.Context(), "failed to write JWKS response", "error", err, "response", response)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
+}
+
+// IssueToken makes the IDP sign a token for the
+// chosen claims and expiry.
+func (f *IDP) IssueToken(
+	issuer,
+	audience,
+	sub string,
+	issuedAt time.Time,
+	expiry time.Time,
+	k8s *tokenclaims.KubernetesSubClaim,
+) (string, error) {
+	claims := tokenclaims.OIDCServiceAccountClaims{
+		TokenClaims: oidc.TokenClaims{
+			Issuer:     issuer,
+			Subject:    sub,
+			Audience:   oidc.Audience{audience},
+			IssuedAt:   oidc.FromTime(issuedAt),
+			NotBefore:  oidc.FromTime(issuedAt),
+			Expiration: oidc.FromTime(expiry),
+		},
+		Kubernetes: k8s,
+	}
+
+	return f.signer.signWithClaims(claims)
+}
+
+// IssueKubeToken makes the IDP sign a token for a Kubernetes pod.
+func (f *IDP) IssueKubeToken(pod, namespace, serviceAccount, clusterName string) (string, error) {
+	now := f.signer.clock.Now()
+	claims := tokenclaims.OIDCServiceAccountClaims{
+		TokenClaims: oidc.TokenClaims{
+			Issuer:     f.IssuerURL(),
+			Subject:    fmt.Sprintf("system:serviceaccount:%s:%s", namespace, serviceAccount),
+			Audience:   oidc.Audience{clusterName},
+			IssuedAt:   oidc.FromTime(now.Add(-time.Minute)),
+			NotBefore:  oidc.FromTime(now.Add(-time.Minute)),
+			Expiration: oidc.FromTime(now.Add(29 * time.Minute)),
+		},
+		Kubernetes: kubeClaims(pod, namespace, serviceAccount),
+	}
+
+	return f.signer.signWithClaims(claims)
+}
diff --git a/lib/oidc/token_validator.go b/lib/oidc/token_validator.go
index 001d369fdc87f..cbe1a916046f8 100644
--- a/lib/oidc/token_validator.go
+++ b/lib/oidc/token_validator.go
@@ -33,12 +33,13 @@ import (
 // giving up.
 const providerTimeout = 15 * time.Second
 
-// Validate validates an OIDC ID token for the specified claims type.
+// ValidateToken validates an OIDC ID token for the specified claims type.
 func ValidateToken[C oidc.Claims](
 	ctx context.Context,
 	issuerURL string,
 	audience string,
 	token string,
+	opts ...rp.VerifierOption,
 ) (C, error) {
 	timeoutCtx, cancel := context.WithTimeout(ctx, providerTimeout)
 	defer cancel()
@@ -56,7 +57,7 @@ func ValidateToken[C oidc.Claims](
 	// TODO(noah): Ideally we'd cache the remote keyset across joins/join tokens
 	// based on the issuer.
 	ks := rp.NewRemoteKeySet(otelhttp.DefaultClient, dc.JwksURI)
-	verifier := rp.NewIDTokenVerifier(issuerURL, audience, ks)
+	verifier := rp.NewIDTokenVerifier(issuerURL, audience, ks, opts...)
 	// TODO(noah): It'd be ideal if we could extend the verifier to use an
 	// injected "now" time.
 
diff --git a/lib/okta/plugin/interfaces.go b/lib/okta/plugin/interfaces.go
new file mode 100644
index 0000000000000..2f8d7509ac50d
--- /dev/null
+++ b/lib/okta/plugin/interfaces.go
@@ -0,0 +1,29 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package oktaplugin
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+type PluginGetter interface {
+	GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error)
+}
diff --git a/lib/okta/plugin/okta_plugin.go b/lib/okta/plugin/okta_plugin.go
index 53d7d7f727012..084878e78d073 100644
--- a/lib/okta/plugin/okta_plugin.go
+++ b/lib/okta/plugin/okta_plugin.go
@@ -24,11 +24,10 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
 )
 
 // Get fetches the Okta plugin if it exists and does proper type assertions.
-func Get(ctx context.Context, plugins services.Plugins, withSecrets bool) (*types.PluginV1, error) {
+func Get(ctx context.Context, plugins PluginGetter, withSecrets bool) (*types.PluginV1, error) {
 	plugin, err := plugins.GetPlugin(ctx, types.PluginTypeOkta, withSecrets)
 	if err != nil {
 		return nil, trace.Wrap(err, "getting Okta plugin")
diff --git a/lib/pam/pam_test.go b/lib/pam/pam_test.go
index 6d25eb639f8d6..8000089bab503 100644
--- a/lib/pam/pam_test.go
+++ b/lib/pam/pam_test.go
@@ -30,11 +30,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	// Skip this test if the binary was not built with PAM support.
 	if !BuildHasPAM() || !SystemHasPAM() {
diff --git a/lib/player/player.go b/lib/player/player.go
index 8628d9b5ac093..da97b6025fc33 100644
--- a/lib/player/player.go
+++ b/lib/player/player.go
@@ -498,7 +498,8 @@ func (p *Player) translateEvent(evt events.AuditEvent) (translatedEvent events.A
 
 // databaseTranslators maps database protocol event translators.
 var databaseTranslators = map[string]newSessionPrintTranslatorFunc{
-	defaults.ProtocolPostgres: func() sessionPrintTranslator { return db.NewPostgresTranslator() },
+	defaults.ProtocolPostgres:    func() sessionPrintTranslator { return db.NewPostgresTranslator() },
+	defaults.ProtocolCockroachDB: func() sessionPrintTranslator { return db.NewPostgresTranslator() },
 }
 
 // SupportedDatabaseProtocols a list of database protocols supported by the
diff --git a/lib/player/player_experimental_test.go b/lib/player/player_experimental_test.go
deleted file mode 100644
index 9d45eea92f4d7..0000000000000
--- a/lib/player/player_experimental_test.go
+++ /dev/null
@@ -1,109 +0,0 @@
-//go:build go1.24 && enablesynctest
-
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package player_test
-
-import (
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/player"
-)
-
-/*
-This file uses the experimental testing/synctest package introduced with Go 1.24:
-
-    https://go.dev/blog/synctest
-
-When editing this file, you should set GOEXPERIMENT=synctest for your editor/LSP
-to ensure that the language server doesn't fail to recognize the package.
-
-This file is also protected by a build tag to ensure that `go test` doesn't fail
-for users who haven't set the environment variable.
-*/
-
-// TestInterruptsDelay tests that the player responds to playback
-// controls even when it is waiting to emit an event.
-func TestInterruptsDelay(t *testing.T) {
-	synctest.Run(func() {
-		p, err := player.New(&player.Config{
-			SessionID: "test-session",
-			Streamer:  &simpleStreamer{count: 3, delay: 5000},
-		})
-		require.NoError(t, err)
-
-		synctest.Wait()
-
-		require.NoError(t, p.Play())
-		t.Cleanup(func() { p.Close() })
-
-		synctest.Wait() // player is now waiting to emit event 0
-
-		// emulate the user seeking forward while the player is waiting..
-		start := time.Now()
-		p.SetPos(10_001 * time.Millisecond)
-
-		// expect event 0 and event 1 to be emitted right away
-		evt0 := <-p.C()
-		evt1 := <-p.C()
-		require.Equal(t, int64(0), evt0.GetIndex())
-		require.Equal(t, int64(1), evt1.GetIndex())
-
-		// Time will advance automatically in the synctest bubble.
-		// This assertion checks that the player was unblocked by
-		// the SetPos call and not because enough time elapsed.
-		require.Zero(t, time.Since(start))
-
-		<-p.C()
-
-		// the user seeked to 10.001 seconds, it should take 4.999
-		// seconds to get the third event that arrives at second 15.
-		require.Equal(t, time.Since(start), 4999*time.Millisecond)
-	})
-}
-
-func TestSeekForward(t *testing.T) {
-	synctest.Run(func() {
-		p, err := player.New(&player.Config{
-			SessionID: "test-session",
-			Streamer:  &simpleStreamer{count: 1, delay: 6000},
-		})
-		require.NoError(t, err)
-		t.Cleanup(func() { p.Close() })
-		require.NoError(t, p.Play())
-
-		start := time.Now()
-
-		time.Sleep(100 * time.Millisecond)
-		p.SetPos(500 * time.Millisecond)
-		time.Sleep(100 * time.Millisecond)
-		p.SetPos(5900 * time.Millisecond)
-
-		<-p.C()
-
-		// It should take 300ms for the event to be emitted.
-		// Two 100ms sleeps (200ms), then a seek to 5.900 seconds which
-		// requires another 100ms to wait for the event at 6s.
-		require.Equal(t, time.Since(start), 300*time.Millisecond)
-	})
-}
diff --git a/lib/player/player_test.go b/lib/player/player_test.go
index 0ffd8417c13b6..73455995e7480 100644
--- a/lib/player/player_test.go
+++ b/lib/player/player_test.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/player"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 func TestBasicStream(t *testing.T) {
@@ -392,3 +393,69 @@ func (d *databaseStreamer) sendEvent(ctx context.Context, evts chan apievents.Au
 		d.idx++
 	}
 }
+
+// TestInterruptsDelay tests that the player responds to playback
+// controls even when it is waiting to emit an event.
+func TestInterruptsDelay(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		p, err := player.New(&player.Config{
+			SessionID: "test-session",
+			Streamer:  &simpleStreamer{count: 3, delay: 5000},
+		})
+		require.NoError(t, err)
+
+		synctest.Wait()
+
+		require.NoError(t, p.Play())
+		t.Cleanup(func() { p.Close() })
+
+		synctest.Wait() // player is now waiting to emit event 0
+
+		// emulate the user seeking forward while the player is waiting..
+		start := time.Now()
+		p.SetPos(10_001 * time.Millisecond)
+
+		// expect event 0 and event 1 to be emitted right away
+		evt0 := <-p.C()
+		evt1 := <-p.C()
+		require.Equal(t, int64(0), evt0.GetIndex())
+		require.Equal(t, int64(1), evt1.GetIndex())
+
+		// Time will advance automatically in the synctest bubble.
+		// This assertion checks that the player was unblocked by
+		// the SetPos call and not because enough time elapsed.
+		require.Zero(t, time.Since(start))
+
+		<-p.C()
+
+		// the user seeked to 10.001 seconds, it should take 4.999
+		// seconds to get the third event that arrives at second 15.
+		require.Equal(t, 4999*time.Millisecond, time.Since(start))
+	})
+}
+
+func TestSeekForward(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		p, err := player.New(&player.Config{
+			SessionID: "test-session",
+			Streamer:  &simpleStreamer{count: 1, delay: 6000},
+		})
+		require.NoError(t, err)
+		t.Cleanup(func() { p.Close() })
+		require.NoError(t, p.Play())
+
+		start := time.Now()
+
+		time.Sleep(100 * time.Millisecond)
+		p.SetPos(500 * time.Millisecond)
+		time.Sleep(100 * time.Millisecond)
+		p.SetPos(5900 * time.Millisecond)
+
+		<-p.C()
+
+		// It should take 300ms for the event to be emitted.
+		// Two 100ms sleeps (200ms), then a seek to 5.900 seconds which
+		// requires another 100ms to wait for the event at 6s.
+		require.Equal(t, 300*time.Millisecond, time.Since(start))
+	})
+}
diff --git a/lib/plugin/okta.go b/lib/plugin/okta.go
new file mode 100644
index 0000000000000..c7909ebd7497f
--- /dev/null
+++ b/lib/plugin/okta.go
@@ -0,0 +1,43 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package plugin
+
+import (
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func OktaParseTimeBetweenImports(syncSettings *types.PluginOktaSyncSettings) (time.Duration, error) {
+	if syncSettings == nil {
+		return 0, nil
+	}
+	raw := syncSettings.TimeBetweenImports
+	if raw == "" {
+		return 0, nil
+	}
+	parsed, err := time.ParseDuration(raw)
+	if err != nil {
+		return 0, trace.BadParameter("time_between_imports is not valid: %s", err)
+	}
+	if parsed < 0 {
+		return 0, trace.BadParameter("time_between_imports %q cannot be a negative value", raw)
+	}
+	return parsed, nil
+}
diff --git a/lib/plugin/validate.go b/lib/plugin/validate.go
new file mode 100644
index 0000000000000..efd476179d960
--- /dev/null
+++ b/lib/plugin/validate.go
@@ -0,0 +1,57 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package plugin
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Validate validates the plugin before writing it in the storage.
+func Validate(plugin types.Plugin) error {
+	if plugin == nil {
+		return nil
+	}
+	switch plugin.GetType() {
+	case types.PluginTypeOkta:
+		pluginV1, err := toPluginV1(plugin)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		return trace.Wrap(validateOkta(pluginV1))
+	}
+	return nil
+}
+
+func toPluginV1(plugin types.Plugin) (*types.PluginV1, error) {
+	pluginV1, ok := plugin.(*types.PluginV1)
+	if !ok {
+		return nil, trace.BadParameter("plugin.(%T) %q is not of type PluginV1", plugin, plugin.GetName())
+	}
+	return pluginV1, nil
+}
+
+func validateOkta(plugin *types.PluginV1) error {
+	oktaSettings := plugin.Spec.GetOkta()
+	if oktaSettings == nil {
+		return trace.BadParameter("plugin %q does not have Okta settings", plugin.GetName())
+	}
+
+	_, err := OktaParseTimeBetweenImports(oktaSettings.GetSyncSettings())
+	return trace.Wrap(err)
+}
diff --git a/lib/plugins/doc.go b/lib/plugins/doc.go
new file mode 100644
index 0000000000000..4cba798e6b525
--- /dev/null
+++ b/lib/plugins/doc.go
@@ -0,0 +1,18 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Package plugins contains codes used by hosted or self-hosted Plugins.
+package plugins
diff --git a/lib/plugins/filter/filter.go b/lib/plugins/filter/filter.go
new file mode 100644
index 0000000000000..6fe4528f0b68d
--- /dev/null
+++ b/lib/plugins/filter/filter.go
@@ -0,0 +1,187 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package filter
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// ErrUnknownFilter is returned when plugin sync filter
+// encounters an unknown filter type.
+var ErrUnknownFilter = &trace.BadParameterError{Message: "unknown PluginSyncFilter type"}
+
+// Filters is a collection of PluginSyncFilter.
+type Filters []*types.PluginSyncFilter
+
+// New creates a new Filters instance from the supplied [types.PluginSyncFilter]s.
+func New(r []*types.PluginSyncFilter) (Filters, error) {
+	out := Filters(r)
+	if err := out.validate(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return out, nil
+}
+
+// validate validates the Filters.
+func (f Filters) validate() error {
+	for _, v := range f {
+		if v.GetInclude() != nil {
+			switch filter := v.GetInclude().(type) {
+			case *types.PluginSyncFilter_Id:
+				if filter.Id == "" {
+					return trace.BadParameter("id cannot be empty")
+				}
+			case *types.PluginSyncFilter_NameRegex:
+				if _, err := utils.CompileExpression(v.GetNameRegex()); err != nil {
+					return trace.Wrap(err)
+				}
+			default:
+				return trace.WrapWithMessage(ErrUnknownFilter, "include filter: %T", filter)
+			}
+		}
+
+		if v.GetExclude() != nil {
+			switch filter := v.GetExclude().(type) {
+			case *types.PluginSyncFilter_ExcludeId:
+				if filter.ExcludeId == "" {
+					return trace.BadParameter("exclude_id cannot be empty")
+				}
+			case *types.PluginSyncFilter_ExcludeNameRegex:
+				if _, err := utils.CompileExpression(v.GetExcludeNameRegex()); err != nil {
+					return trace.Wrap(err)
+				}
+			default:
+				return trace.WrapWithMessage(ErrUnknownFilter, "exclude filter: %T", filter)
+			}
+		}
+	}
+	return nil
+}
+
+// MatchParam defines filter matcher parameters.
+type MatchParam struct {
+	// ID of an item to match.
+	ID string
+	// Name of an item to match.
+	Name string
+}
+
+// Matches checks if the given [item] matches with the [filters].
+// Exclude filters gets priority over Include filters.
+// Empty [filters] implies a default match.
+func Matches(filters Filters, param MatchParam) bool {
+	if len(filters) == 0 {
+		// Empty filter is considered a wildcard match.
+		return true
+	}
+
+	for _, filter := range filters {
+		if filter.GetExclude() == nil {
+			continue
+		}
+		switch v := filter.GetExclude().(type) {
+		case *types.PluginSyncFilter_ExcludeId:
+			if param.ID != "" && param.ID == v.ExcludeId {
+				return false
+			}
+		case *types.PluginSyncFilter_ExcludeNameRegex:
+			if param.Name != "" {
+				compiledExclude, err := utils.CompileExpression(v.ExcludeNameRegex)
+				if err == nil && compiledExclude.MatchString(param.Name) {
+					return false
+				}
+			}
+		default:
+			slog.ErrorContext(context.Background(), "PluginSyncFilter skipping an unknown include filter type", "type", logutils.TypeAttr(v))
+		}
+	}
+
+	hasInclude := false
+	for _, filter := range filters {
+		if filter.GetInclude() == nil {
+			continue
+		}
+		hasInclude = true
+		switch v := filter.GetInclude().(type) {
+		case *types.PluginSyncFilter_Id:
+			if param.ID != "" && param.ID == v.Id {
+				return true
+			}
+		case *types.PluginSyncFilter_NameRegex:
+			if param.Name != "" {
+				compiledFilter, err := utils.CompileExpression(v.NameRegex)
+				if err == nil && compiledFilter.MatchString(param.Name) {
+					return true
+				}
+			}
+		default:
+			slog.ErrorContext(context.Background(), "PluginSyncFilter skipping an unknown exclude filter type", "type", logutils.TypeAttr(v))
+		}
+	}
+	return !hasInclude
+}
+
+// Inputs is used to configure filters
+// in the Web UI or tctl. Field name matches with the
+// include and exclude fields of PluginSyncFilter proto.
+type Inputs struct {
+	ID               []string `json:"id"`
+	NameRegex        []string `json:"nameRegex"`
+	ExcludeID        []string `json:"excludeId"`
+	ExcludeNameRegex []string `json:"excludeNameRegex"`
+}
+
+// NewFromInputs returns a new [Filters] from [Inputs].
+func NewFromInputs(in Inputs) (Filters, error) {
+	cap := len(in.ID) + len(in.NameRegex) + len(in.ExcludeID) + len(in.ExcludeNameRegex)
+	protoFilters := make([]*types.PluginSyncFilter, 0, cap)
+
+	for _, id := range in.ID {
+		protoFilters = append(protoFilters, &types.PluginSyncFilter{
+			Include: &types.PluginSyncFilter_Id{Id: id},
+		})
+	}
+	for _, n := range in.NameRegex {
+		protoFilters = append(protoFilters, &types.PluginSyncFilter{
+			Include: &types.PluginSyncFilter_NameRegex{NameRegex: n},
+		})
+	}
+	for _, id := range in.ExcludeID {
+		protoFilters = append(protoFilters, &types.PluginSyncFilter{
+			Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: id},
+		})
+	}
+	for _, n := range in.ExcludeNameRegex {
+		protoFilters = append(protoFilters, &types.PluginSyncFilter{
+			Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: n},
+		})
+	}
+
+	filters, err := New(protoFilters)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return filters, nil
+}
diff --git a/lib/plugins/filter/filter_test.go b/lib/plugins/filter/filter_test.go
new file mode 100644
index 0000000000000..7963809e22a7e
--- /dev/null
+++ b/lib/plugins/filter/filter_test.go
@@ -0,0 +1,202 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package filter
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestMatches(t *testing.T) {
+	items := []MatchParam{
+		{ID: "1", Name: "apple"},
+		{ID: "2", Name: "banana"},
+		{ID: "3", Name: "cherry"},
+		{ID: "4", Name: "avocado"},
+	}
+
+	tests := []struct {
+		name     string
+		items    []MatchParam
+		filters  Filters
+		expected []MatchParam
+	}{
+		{
+			name:     "Filter by ID",
+			items:    items,
+			filters:  Filters{&types.PluginSyncFilter{Include: &types.PluginSyncFilter_Id{Id: "2"}}},
+			expected: []MatchParam{{ID: "2", Name: "banana"}},
+		},
+		{
+			name:     "Filter by Name",
+			items:    items,
+			filters:  Filters{&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "a*"}}},
+			expected: []MatchParam{{ID: "1", Name: "apple"}, {ID: "4", Name: "avocado"}},
+		},
+		{
+			name:     "Exclude All",
+			items:    items,
+			filters:  Filters{&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "teleport.internal/exclude_all"}}},
+			expected: nil,
+		},
+		{
+			name:     "No Filters (matches all)",
+			items:    items,
+			filters:  Filters{},
+			expected: items,
+		},
+		{
+			name:  "Multiple Filters",
+			items: items,
+			filters: Filters{
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_Id{Id: "2"}},
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "a*"}},
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_Id{Id: "4"}},
+			},
+			expected: []MatchParam{
+				{ID: "1", Name: "apple"},
+				{ID: "2", Name: "banana"},
+				{ID: "4", Name: "avocado"},
+			},
+		},
+		{
+			name:  "Exclude by ID",
+			items: items,
+			filters: Filters{
+				&types.PluginSyncFilter{Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: "2"}},
+			},
+			expected: []MatchParam{
+				{ID: "1", Name: "apple"},
+				{ID: "3", Name: "cherry"},
+				{ID: "4", Name: "avocado"},
+			},
+		},
+		{
+			name:  "Exclude by NameRegex",
+			items: items,
+			filters: Filters{
+				&types.PluginSyncFilter{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "a*"}},
+			},
+			expected: []MatchParam{
+				{ID: "2", Name: "banana"},
+				{ID: "3", Name: "cherry"},
+			},
+		},
+		{
+			name:  "Include and Exclude - exclude wins",
+			items: items,
+			filters: Filters{
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "*"}},
+				&types.PluginSyncFilter{Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: "1"}},
+			},
+			expected: []MatchParam{
+				{ID: "2", Name: "banana"},
+				{ID: "3", Name: "cherry"},
+				{ID: "4", Name: "avocado"},
+			},
+		},
+		{
+			name:  "Include and Exclude - exclude wins case 2",
+			items: items,
+			filters: Filters{
+				&types.PluginSyncFilter{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "a*"}},
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "a*"}},
+				&types.PluginSyncFilter{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "b*"}},
+			},
+			expected: []MatchParam{
+				{ID: "2", Name: "banana"},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var filtered []MatchParam
+			for _, i := range items {
+				if Matches(tt.filters, MatchParam{
+					ID:   i.ID,
+					Name: i.Name,
+				}) {
+					filtered = append(filtered, i)
+				}
+			}
+			require.ElementsMatch(t, tt.expected, filtered)
+		})
+	}
+}
+
+func TestNew(t *testing.T) {
+	type unsupportedFilterType struct {
+		types.PluginSyncFilter_Id
+	}
+	testCases := []struct {
+		name           string
+		filters        []*types.PluginSyncFilter
+		errorAssertion require.ErrorAssertionFunc
+	}{
+		{
+			name: "bad regex",
+			filters: []*types.PluginSyncFilter{
+				{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "^[)$"}},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "bad exclude regex",
+			filters: []*types.PluginSyncFilter{
+				{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "^[)$"}},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name:           "empty filter",
+			filters:        nil,
+			errorAssertion: require.NoError,
+		},
+		{
+			name: "empty include id",
+			filters: []*types.PluginSyncFilter{
+				{Include: &types.PluginSyncFilter_Id{}},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "empty exclude id",
+			filters: []*types.PluginSyncFilter{
+				{Exclude: &types.PluginSyncFilter_ExcludeId{}},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "unknown filter type",
+			filters: []*types.PluginSyncFilter{
+				{Include: &unsupportedFilterType{}},
+			},
+			errorAssertion: require.Error,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := New(test.filters)
+			test.errorAssertion(t, err)
+		})
+	}
+}
diff --git a/lib/proxy/peer/client.go b/lib/proxy/peer/client.go
index 56feb4714a7db..41a027a1a8d58 100644
--- a/lib/proxy/peer/client.go
+++ b/lib/proxy/peer/client.go
@@ -40,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	streamutils "github.com/gravitational/teleport/api/utils/grpc/stream"
 	"github.com/gravitational/teleport/lib/auth/authclient"
@@ -676,7 +677,10 @@ func (c *Client) getConnections(proxyIDs []string) ([]internal.ClientConn, bool,
 	c.metrics.reportTunnelError(errorProxyPeerTunnelNotFound)
 
 	// try to establish new connections otherwise.
-	proxies, err := c.config.AuthClient.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(c.ctx, c.config.AuthClient.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return c.config.AuthClient.GetProxies()
+	})
 	if err != nil {
 		c.metrics.reportTunnelError(errorProxyPeerFetchProxies)
 		return nil, false, trace.Wrap(err)
diff --git a/lib/proxy/peer/credentials_test.go b/lib/proxy/peer/credentials_test.go
index b2862677c9e1c..47ba246df6c04 100644
--- a/lib/proxy/peer/credentials_test.go
+++ b/lib/proxy/peer/credentials_test.go
@@ -32,7 +32,7 @@ import (
 	"google.golang.org/grpc/credentials"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type testCredentials struct {
@@ -113,7 +113,7 @@ func TestClientCredentials(t *testing.T) {
 				},
 			}
 
-			creds := newClientCredentials(test.expectedPeerID, test.peerAddr, utils.NewSlogLoggerForTests(), newTestCredentials(cert))
+			creds := newClientCredentials(test.expectedPeerID, test.peerAddr, logtest.NewLogger(), newTestCredentials(cert))
 
 			ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 			defer cancel()
diff --git a/lib/proxy/peer/quic/client.go b/lib/proxy/peer/quic/client.go
index b230f111c253a..8e0e5d074ad0c 100644
--- a/lib/proxy/peer/quic/client.go
+++ b/lib/proxy/peer/quic/client.go
@@ -278,7 +278,7 @@ func (c *ClientConn) Dial(nodeID string, src net.Addr, dst net.Addr, tunnelType
 		return nil, trace.Wrap(err)
 	}
 
-	var conn quic.Connection = earlyConn
+	conn := earlyConn
 	defer func() {
 		if err == nil {
 			return
@@ -466,7 +466,7 @@ func (c *ClientConn) Ping(ctx context.Context) error {
 // response buffer. Request and response are length-prefixed by a 32 bit little
 // endian integer, but the buffer size is also limited by [quicMaxMessageSize].
 // The given request buffer should already be length-prefixed.
-func sendUnary(deadline time.Time, sizedReqBuf []byte, conn quic.Connection) (_ []byte, _ quic.Stream, err error) {
+func sendUnary(deadline time.Time, sizedReqBuf []byte, conn *quic.Conn) (_ []byte, _ *quic.Stream, err error) {
 	stream, err := conn.OpenStream()
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -501,8 +501,8 @@ func sendUnary(deadline time.Time, sizedReqBuf []byte, conn quic.Connection) (_
 // streamConn is a [net.Conn] using a single [quic.Stream] in a dedicated
 // [quic.Connection].
 type streamConn struct {
-	st   quic.Stream
-	conn quic.Connection
+	st   *quic.Stream
+	conn *quic.Conn
 
 	src net.Addr
 	dst net.Addr
diff --git a/lib/proxy/peer/quic/quic_test.go b/lib/proxy/peer/quic/quic_test.go
index 5ed5a446b69cd..e3f33f0a966ae 100644
--- a/lib/proxy/peer/quic/quic_test.go
+++ b/lib/proxy/peer/quic/quic_test.go
@@ -45,10 +45,11 @@ import (
 	"github.com/gravitational/teleport/lib/proxy/peer/internal"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/proxy/peer/quic/server.go b/lib/proxy/peer/quic/server.go
index 2931837907b72..f065cf48817ca 100644
--- a/lib/proxy/peer/quic/server.go
+++ b/lib/proxy/peer/quic/server.go
@@ -41,6 +41,7 @@ import (
 	peerdial "github.com/gravitational/teleport/lib/proxy/peer/dial"
 	"github.com/gravitational/teleport/lib/proxy/peer/internal"
 	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // ServerConfig holds the parameters for [NewServer].
@@ -209,19 +210,19 @@ func (s *Server) Serve(transport *quic.Transport) error {
 	}
 }
 
-func (s *Server) handleConn(conn quic.EarlyConnection) {
+func (s *Server) handleConn(conn *quic.Conn) {
 	log := s.log.With(
 		"remote_addr", conn.RemoteAddr().String(),
 		"internal_id", uuid.NewString(),
 	)
 	state := conn.ConnectionState()
-	log.InfoContext(conn.Context(),
+	log.Log(conn.Context(), logutils.TraceLevel,
 		"handling new peer connection",
 		"gso", state.GSO,
 		"used_0rtt", state.Used0RTT,
 	)
 	defer func() {
-		log.DebugContext(conn.Context(),
+		log.Log(conn.Context(), logutils.TraceLevel,
 			"peer connection closed",
 			"error", ignoreCodeZero(context.Cause(conn.Context())),
 		)
@@ -250,7 +251,7 @@ func (s *Server) handleConn(conn quic.EarlyConnection) {
 	}
 }
 
-func (s *Server) handleStream(stream quic.Stream, conn quic.EarlyConnection, log *slog.Logger) {
+func (s *Server) handleStream(stream *quic.Stream, conn *quic.Conn, log *slog.Logger) {
 	log = log.With("stream_id", stream.StreamID())
 	log.DebugContext(conn.Context(), "handling stream")
 	defer log.DebugContext(conn.Context(), "done handling stream")
diff --git a/lib/proxy/relay.go b/lib/proxy/relay.go
new file mode 100644
index 0000000000000..329204cc2a0e1
--- /dev/null
+++ b/lib/proxy/relay.go
@@ -0,0 +1,206 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package proxy
+
+import (
+	"context"
+	"net"
+	"slices"
+
+	"github.com/gravitational/trace"
+
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/agentless"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/readonly"
+	"github.com/gravitational/teleport/lib/srv/transport/transportv1"
+	"github.com/gravitational/teleport/lib/sshagent"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+type RelayAccessPoint interface {
+	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
+	GetSessionRecordingConfig(ctx context.Context) (types.SessionRecordingConfig, error)
+}
+
+type NodeWatcher = *services.GenericWatcher[types.Server, readonly.Server]
+
+func getServerForRelay(ctx context.Context, scopePin *scopesv1.Pin, host, port string, accessPoint RelayAccessPoint, nodeWatcher NodeWatcher) (types.Server, error) {
+	return getServer(ctx, scopePin, host, port, &relayCluster{
+		accessPoint: accessPoint,
+		nodeWatcher: nodeWatcher,
+	})
+}
+
+type relayCluster struct {
+	accessPoint RelayAccessPoint
+	nodeWatcher NodeWatcher
+}
+
+var _ cluster = (*relayCluster)(nil)
+
+// GetNodes implements [cluster].
+func (s *relayCluster) GetNodes(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error) {
+	return s.nodeWatcher.CurrentResourcesWithFilter(ctx, fn)
+}
+
+// GetClusterNetworkingConfig implements [cluster].
+func (s *relayCluster) GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error) {
+	return s.accessPoint.GetClusterNetworkingConfig(ctx)
+
+}
+
+// GetGitServers implements [cluster].
+func (s *relayCluster) GetGitServers(context.Context, func(readonly.Server) bool) ([]types.Server, error) {
+	return nil, trace.NotImplemented("connectivity to git servers through the Relay service is not supported")
+}
+
+type RelayTunnelDialFunc = func(ctx context.Context, hostID string, tunnelType types.TunnelType, src, dst net.Addr) (net.Conn, error)
+type RelayPeerDialFunc = func(ctx context.Context, hostID string, tunnelType types.TunnelType, relayIDs []string, src, dst net.Addr) (net.Conn, error)
+
+type RelayRouterConfig struct {
+	// ClusterName is the name of the cluster that the relay belongs to. Routing
+	// to hosts in other clusters is not supported.
+	ClusterName string
+
+	// GroupName is the name of the relay group that the relay belongs to.
+	// Dialing hosts for which there's no tunnel available locally and that is
+	// connected to a different relay group is not supported.
+	GroupName string
+
+	// LocalDial should dial the given target if it's available as a reverse
+	// tunnel attached to the local instance.
+	LocalDial RelayTunnelDialFunc
+
+	// PeerDial should dial the given target through a known list of relay IDs.
+	// It will only be called for targets that are advertising the same relay
+	// group, but the function should check that any given relay in the list
+	// belongs to the correct group before attempting to use it.
+	PeerDial RelayPeerDialFunc
+
+	AccessPoint RelayAccessPoint
+	NodeWatcher NodeWatcher
+}
+
+// NewRelayRouter creates a [transportv1.Dialer] appropriate for use by a relay,
+// with the given parameters. The dialer will not open connections to auth
+// services, agentless SSH servers, or desktops, and it will only dial
+// (agentful) SSH servers if they have an open reverse tunnel to this relay or
+// to a relay in the same group.
+func NewRelayRouter(cfg RelayRouterConfig) (transportv1.Dialer, error) {
+	if cfg.ClusterName == "" {
+		return nil, trace.BadParameter("missing ClusterName")
+	}
+	if cfg.GroupName == "" {
+		return nil, trace.BadParameter("missing GroupName")
+	}
+	if cfg.LocalDial == nil {
+		return nil, trace.BadParameter("missing LocalDial")
+	}
+	if cfg.PeerDial == nil {
+		return nil, trace.BadParameter("missing PeerDial")
+	}
+	if cfg.AccessPoint == nil {
+		return nil, trace.BadParameter("missing AccessPoint")
+	}
+	if cfg.NodeWatcher == nil {
+		return nil, trace.BadParameter("missing NodeWatcher")
+	}
+	return &relayRouter{
+		clusterName: cfg.ClusterName,
+		groupName:   cfg.GroupName,
+		localDial:   cfg.LocalDial,
+		peerDial:    cfg.PeerDial,
+		accessPoint: cfg.AccessPoint,
+		nodeWatcher: cfg.NodeWatcher,
+	}, nil
+}
+
+type relayRouter struct {
+	clusterName string
+	groupName   string
+	localDial   RelayTunnelDialFunc
+	peerDial    RelayPeerDialFunc
+	accessPoint RelayAccessPoint
+	nodeWatcher NodeWatcher
+}
+
+var _ transportv1.Dialer = (*relayRouter)(nil)
+
+// DialHost implements [transportv1.Dialer].
+func (r *relayRouter) DialHost(ctx context.Context, scopePin *scopesv1.Pin, clientSrcAddr net.Addr, clientDstAddr net.Addr, host string, port string, cluster string, _ func(types.RemoteCluster) error, _ sshagent.ClientGetter, _ agentless.SignerCreator) (net.Conn, error) {
+	if cluster != r.clusterName {
+		return nil, trace.NotImplemented("dialing nodes for a different cluster through the Relay service is not supported")
+	}
+
+	src, err := r.accessPoint.GetSessionRecordingConfig(ctx)
+	if err != nil {
+		// deliberately not wrapping the error to not surface this as a NotFound
+		// or some other meaningful error
+		return nil, trace.Errorf("unable to determine recording mode: %s", err.Error())
+	}
+	if services.IsRecordAtProxy(src.GetMode()) {
+		return nil, trace.NotImplemented("connectivity to SSH servers through the Relay service is not supported in Proxy recording mode")
+	}
+
+	server, err := getServerForRelay(ctx, scopePin, host, port, r.accessPoint, r.nodeWatcher)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if server == nil {
+		return nil, trace.NotImplemented("direct dialing to nodes through the Relay service is not supported")
+	}
+
+	if server.IsOpenSSHNode() {
+		return nil, trace.NotImplemented("connectivity to agentless servers through the Relay service is not supported")
+	}
+
+	localConn, err := r.localDial(ctx, server.GetName()+"."+r.clusterName, types.NodeTunnel, clientSrcAddr, clientDstAddr)
+	if err == nil {
+		return utils.NewConnWithAddr(localConn, clientDstAddr, clientSrcAddr), nil
+	}
+	if !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
+	if server.GetRelayGroup() == "" {
+		return nil, trace.NotFound("dial target doesn't appear to be available through any Relay group")
+	}
+	if server.GetRelayGroup() != r.groupName {
+		return nil, trace.NotFound("dial target doesn't appear to be connected through this Relay group")
+	}
+
+	// peerDial might still fail to find a connection based on the advertised
+	// relay IDs, the filtering done above is just to make the logic explicit
+	peerConn, err := r.peerDial(ctx, server.GetName()+"."+r.clusterName, types.NodeTunnel, slices.Clone(server.GetRelayIDs()), clientSrcAddr, clientDstAddr)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return utils.NewConnWithAddr(peerConn, clientDstAddr, clientSrcAddr), nil
+}
+
+// DialSite implements [transportv1.Dialer].
+func (r *relayRouter) DialSite(context.Context, string, net.Addr, net.Addr) (net.Conn, error) {
+	return nil, trace.NotImplemented("connectivity to Auth services through the Relay service is not supported")
+}
+
+// DialWindowsDesktop implements [transportv1.Dialer].
+func (r *relayRouter) DialWindowsDesktop(context.Context, net.Addr, net.Addr, string, string, func(types.RemoteCluster) error) (net.Conn, error) {
+	return nil, trace.NotImplemented("connectivity to Windows desktops through the Relay service is not supported")
+}
diff --git a/lib/proxy/router.go b/lib/proxy/router.go
index fb1fa31845769..a83660a24b8f4 100644
--- a/lib/proxy/router.go
+++ b/lib/proxy/router.go
@@ -21,8 +21,6 @@ package proxy
 import (
 	"bytes"
 	"context"
-	"errors"
-	"fmt"
 	"log/slog"
 	"math/rand/v2"
 	"net"
@@ -36,6 +34,7 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
@@ -45,8 +44,9 @@ import (
 	"github.com/gravitational/teleport/lib/desktop"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services/readonly"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -103,13 +103,13 @@ func (c *ProxiedMetricConn) Close() error {
 	return trace.Wrap(c.Conn.Close())
 }
 
-type serverResolverFn = func(ctx context.Context, host, port string, site site) (types.Server, error)
+type serverResolverFn = func(ctx context.Context, scopePin *scopesv1.Pin, host, port string, cluster cluster) (types.Server, error)
 type windowsDesktopServiceConnectorFn = func(ctx context.Context, config *desktop.ConnectionConfig) (conn net.Conn, version string, err error)
 
-// SiteGetter provides access to connected local or remote sites
-type SiteGetter interface {
-	// GetSite returns the site matching the provided clusterName
-	GetSite(clusterName string) (reversetunnelclient.RemoteSite, error)
+// ClusterGetter provides access to connected local or remote clusters.
+type ClusterGetter interface {
+	// Cluster returns the cluster matching the provided clusterName
+	Cluster(ctx context.Context, clusterName string) (reversetunnelclient.Cluster, error)
 }
 
 // LocalAccessPoint provides access to remote cluster resources
@@ -127,8 +127,8 @@ type RouterConfig struct {
 	ClusterName string
 	// LocalAccessPoint is the proxy cache
 	LocalAccessPoint LocalAccessPoint
-	// SiteGetter allows looking up sites
-	SiteGetter SiteGetter
+	// ClusterGetter allows looking up clusters
+	ClusterGetter ClusterGetter
 	// TracerProvider allows tracers to be created
 	TracerProvider oteltrace.TracerProvider
 	// Log is an optional logger. A default logger will be created if not set.
@@ -150,7 +150,7 @@ func (c *RouterConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("LocalAccessPoint must be provided")
 	}
 
-	if c.SiteGetter == nil {
+	if c.ClusterGetter == nil {
 		return trace.BadParameter("SiteGetter must be provided")
 	}
 
@@ -178,8 +178,8 @@ func (c *RouterConfig) CheckAndSetDefaults() error {
 type Router struct {
 	clusterName                    string
 	localAccessPoint               LocalAccessPoint
-	localSite                      reversetunnelclient.RemoteSite
-	siteGetter                     SiteGetter
+	localCluster                   reversetunnelclient.Cluster
+	clusterGetter                  ClusterGetter
 	tracer                         oteltrace.Tracer
 	log                            *slog.Logger
 	serverResolver                 serverResolverFn
@@ -193,7 +193,7 @@ func NewRouter(cfg RouterConfig) (*Router, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	localSite, err := cfg.SiteGetter.GetSite(cfg.ClusterName)
+	localCluster, err := cfg.ClusterGetter.Cluster(context.Background(), cfg.ClusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -201,8 +201,8 @@ func NewRouter(cfg RouterConfig) (*Router, error) {
 	return &Router{
 		clusterName:                    cfg.ClusterName,
 		localAccessPoint:               cfg.LocalAccessPoint,
-		localSite:                      localSite,
-		siteGetter:                     cfg.SiteGetter,
+		localCluster:                   localCluster,
+		clusterGetter:                  cfg.ClusterGetter,
 		tracer:                         cfg.TracerProvider.Tracer("Router"),
 		log:                            cfg.Logger,
 		serverResolver:                 cfg.serverResolver,
@@ -213,7 +213,7 @@ func NewRouter(cfg RouterConfig) (*Router, error) {
 // DialHost dials the node that matches the provided host, port and cluster. If no matching node
 // is found an error is returned. If more than one matching node is found and the cluster networking
 // configuration is not set to route to the most recent an error is returned.
-func (r *Router) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, host, port, clusterName string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter teleagent.Getter, signer agentless.SignerCreator) (_ net.Conn, err error) {
+func (r *Router) DialHost(ctx context.Context, scopePin *scopesv1.Pin, clientSrcAddr, clientDstAddr net.Addr, host, port, clusterName string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter sshagent.ClientGetter, signer agentless.SignerCreator) (_ net.Conn, err error) {
 	ctx, span := r.tracer.Start(
 		ctx,
 		"router/DialHost",
@@ -231,90 +231,80 @@ func (r *Router) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.
 		tracing.EndSpan(span, err)
 	}()
 
-	site := r.localSite
+	cluster := r.localCluster
 	if clusterName != r.clusterName {
-		remoteSite, err := r.getRemoteCluster(ctx, clusterName, clusterAccessChecker)
+		if scopePin != nil {
+			return nil, trace.AccessDenied("identity pinned to scope %q cannot dial remote cluster %q (scoping does not support cross-cluster operations)", scopePin.GetScope(), clusterName)
+		}
+		remoteCluster, err := r.getRemoteCluster(ctx, clusterName, clusterAccessChecker)
 		if err != nil {
 			return nil, trace.Wrap(err, "looking up remote cluster %q", clusterName)
 		}
-		site = remoteSite
+		cluster = remoteCluster
 	}
 
 	span.AddEvent("looking up server")
-	target, err := r.serverResolver(ctx, host, port, remoteSite{site})
+	target, err := r.serverResolver(ctx, scopePin, host, port, fakeCluster{cluster})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	span.AddEvent("retrieved target server")
 
+	serverID := target.GetName() + "." + clusterName
+	hostClusterPrincipal := host + "." + clusterName
 	principals := []string{
 		host,
-		// Add in principal for when nodes are on leaf clusters.
-		host + "." + clusterName,
+		// Add in hostClusterPrincipal for when nodes are on leaf clusters.
+		hostClusterPrincipal,
 	}
 
-	var (
-		isAgentlessNode bool
-		serverID        string
-		serverAddr      string
-		proxyIDs        []string
-		sshSigner       ssh.Signer
-	)
+	// add hostUUID.cluster to the principals if it's different from hostClusterPrincipal.
+	if serverID != hostClusterPrincipal {
+		principals = append(principals, serverID)
+	}
 
-	if target != nil {
-		proxyIDs = target.GetProxyIDs()
-		serverID = fmt.Sprintf("%v.%v", target.GetName(), clusterName)
+	serverAddr := target.GetAddr()
+	switch {
+	case serverAddr != "":
+		h, _, err := net.SplitHostPort(serverAddr)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-		// add hostUUID.cluster to the principals
-		principals = append(principals, serverID)
+		principals = append(principals, h)
+	case serverAddr == "" && target.GetUseTunnel():
+		serverAddr = reversetunnelclient.LocalNode
+	}
 
-		// add ip if it exists to the principals
-		serverAddr = target.GetAddr()
+	// If the node is a registered openssh node don't set agentGetter
+	// so a SSH user agent will not be created when connecting to the remote node.
+	var sshSigner ssh.Signer
+	if target.IsOpenSSHNode() {
+		agentGetter = nil
 
-		switch {
-		case serverAddr != "":
-			h, _, err := net.SplitHostPort(serverAddr)
+		if target.GetSubKind() == types.SubKindOpenSSHNode {
+			// If the node is of SubKindOpenSSHNode, create the signer.
+			client, err := r.GetSiteClient(ctx, clusterName)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-
-			principals = append(principals, h)
-		case serverAddr == "" && target.GetUseTunnel():
-			serverAddr = reversetunnelclient.LocalNode
-		}
-		// If the node is a registered openssh node don't set agentGetter
-		// so a SSH user agent will not be created when connecting to the remote node.
-		if target.IsOpenSSHNode() {
-			agentGetter = nil
-			isAgentlessNode = true
-
-			if target.GetSubKind() == types.SubKindOpenSSHNode {
-				// If the node is of SubKindOpenSSHNode, create the signer.
-				client, err := r.GetSiteClient(ctx, clusterName)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				sshSigner, err = signer(ctx, r.localAccessPoint, client)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
+			sshSigner, err = signer(ctx, r.localAccessPoint, client)
+			if err != nil {
+				return nil, trace.Wrap(err)
 			}
 		}
-	} else {
-		return nil, trace.ConnectionProblem(errors.New("connection problem"), "direct dialing to nodes not found in inventory is not supported")
 	}
 
-	conn, err := site.Dial(reversetunnelclient.DialParams{
+	conn, err := cluster.Dial(reversetunnelclient.DialParams{
 		From:                  clientSrcAddr,
 		To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: serverAddr},
 		OriginalClientDstAddr: clientDstAddr,
 		GetUserAgent:          agentGetter,
-		IsAgentlessNode:       isAgentlessNode,
 		AgentlessSigner:       sshSigner,
 		Address:               host,
 		Principals:            apiutils.Deduplicate(principals),
 		ServerID:              serverID,
-		ProxyIDs:              proxyIDs,
+		ProxyIDs:              target.GetProxyIDs(),
 		ConnType:              types.NodeTunnel,
 		TargetServer:          target,
 	})
@@ -338,19 +328,18 @@ func (r *Router) DialWindowsDesktop(ctx context.Context, clientSrcAddr, clientDs
 			attribute.String("cluster", clusterName),
 		),
 	)
+	defer func() { tracing.EndSpan(span, err) }()
 
-	defer tracing.EndSpan(span, err)
-
-	site := r.localSite
+	cluster := r.localCluster
 	if clusterName != r.clusterName {
-		remoteSite, err := r.getRemoteCluster(ctx, clusterName, clusterAccessChecker)
+		remoteCluster, err := r.getRemoteCluster(ctx, clusterName, clusterAccessChecker)
 		if err != nil {
 			return nil, trace.Wrap(err, "looking up remote cluster %q", clusterName)
 		}
-		site = remoteSite
+		cluster = remoteCluster
 	}
 
-	accessPoint, err := site.CachingAccessPoint()
+	accessPoint, err := cluster.CachingAccessPoint()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -360,7 +349,7 @@ func (r *Router) DialWindowsDesktop(ctx context.Context, clientSrcAddr, clientDs
 	serviceConn, _, err := r.windowsDesktopServiceConnector(ctx, &desktop.ConnectionConfig{
 		Log:            r.log,
 		DesktopsGetter: accessPoint,
-		Site:           site,
+		Cluster:        cluster,
 		ClientSrcAddr:  clientSrcAddr,
 		ClientDstAddr:  clientDstAddr,
 		ClusterName:    clusterName,
@@ -413,9 +402,9 @@ func (c *checkedPrefixWriter) Write(p []byte) (int, error) {
 	return n, trace.Wrap(err)
 }
 
-// getRemoteCluster looks up the provided clusterName to determine if a remote site exists with
+// getRemoteCluster looks up the provided clusterName to determine if a remote cluster exists with
 // that name and determines if the user has access to it.
-func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, clusterAccessChecker func(types.RemoteCluster) error) (reversetunnelclient.RemoteSite, error) {
+func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, clusterAccessChecker func(types.RemoteCluster) error) (reversetunnelclient.Cluster, error) {
 	_, span := r.tracer.Start(
 		ctx,
 		"router/getRemoteCluster",
@@ -425,7 +414,7 @@ func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, clust
 	)
 	defer span.End()
 
-	site, err := r.siteGetter.GetSite(clusterName)
+	cluster, err := r.clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, utils.OpaqueAccessDenied(err)
 	}
@@ -439,26 +428,26 @@ func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, clust
 		return nil, utils.OpaqueAccessDenied(err)
 	}
 
-	return site, nil
+	return cluster, nil
 }
 
-// site is the minimum interface needed to match servers
-// for a reversetunnelclient.RemoteSite. It makes testing easier.
-type site interface {
+// cluster is the minimum interface needed to match servers
+// for a reversetunnelclient.Cluster. It makes testing easier.
+type cluster interface {
 	GetNodes(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error)
 	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
 	GetGitServers(context.Context, func(readonly.Server) bool) ([]types.Server, error)
 }
 
-// remoteSite is a site implementation that wraps
-// a reversetunnelclient.RemoteSite
-type remoteSite struct {
-	site reversetunnelclient.RemoteSite
+// fakeCluster is a cluster implementation that wraps
+// a reversetunnelclient.Cluster
+type fakeCluster struct {
+	cluster reversetunnelclient.Cluster
 }
 
-// GetNodes uses the wrapped sites NodeWatcher to filter nodes
-func (r remoteSite) GetNodes(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error) {
-	watcher, err := r.site.NodeWatcher()
+// GetNodes uses the wrapped cluster's NodeWatcher to filter nodes
+func (r fakeCluster) GetNodes(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error) {
+	watcher, err := r.cluster.NodeWatcher()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -467,9 +456,9 @@ func (r remoteSite) GetNodes(ctx context.Context, fn func(n readonly.Server) boo
 	return servers, trace.Wrap(err)
 }
 
-// GetGitServers uses the wrapped sites GitServerWatcher to filter git servers.
-func (r remoteSite) GetGitServers(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error) {
-	watcher, err := r.site.GitServerWatcher()
+// GetGitServers uses the wrapped cluster's GitServerWatcher to filter git servers.
+func (r fakeCluster) GetGitServers(ctx context.Context, fn func(n readonly.Server) bool) ([]types.Server, error) {
+	watcher, err := r.cluster.GitServerWatcher()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -477,9 +466,9 @@ func (r remoteSite) GetGitServers(ctx context.Context, fn func(n readonly.Server
 	return watcher.CurrentResourcesWithFilter(ctx, fn)
 }
 
-// GetClusterNetworkingConfig uses the wrapped sites cache to retrieve the ClusterNetworkingConfig
-func (r remoteSite) GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error) {
-	ap, err := r.site.CachingAccessPoint()
+// GetClusterNetworkingConfig uses the wrapped cluster's cache to retrieve the ClusterNetworkingConfig
+func (r fakeCluster) GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error) {
+	ap, err := r.cluster.CachingAccessPoint()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -489,27 +478,30 @@ func (r remoteSite) GetClusterNetworkingConfig(ctx context.Context) (types.Clust
 }
 
 // getServer attempts to locate a node matching the provided host and port in
-// the provided site.
-func getServer(ctx context.Context, host, port string, site site) (types.Server, error) {
+// the provided cluster.
+func getServer(ctx context.Context, scopePin *scopesv1.Pin, host, port string, cluster cluster) (types.Server, error) {
 	if org, ok := types.GetGitHubOrgFromNodeAddr(host); ok {
-		return getGitHubServer(ctx, org, site)
+		if scopePin != nil {
+			return nil, trace.AccessDenied("identity pinned to scope %q cannot dial github server for %q (scoped identities not supported)", scopePin.GetScope(), org)
+		}
+		return getGitHubServer(ctx, org, cluster)
 	}
-	return getServerWithResolver(ctx, host, port, site, nil /* use default resolver */)
+	return getServerWithResolver(ctx, scopePin, host, port, cluster, nil /* use default resolver */)
 }
 
 var disableUnqualifiedLookups = os.Getenv("TELEPORT_UNSTABLE_DISABLE_UNQUALIFIED_LOOKUPS") == "yes"
 
 // getServerWithResolver attempts to locate a node matching the provided host and port in
-// the provided site. The resolver argument is used in certain tests to mock DNS resolution
+// the provided cluster. The resolver argument is used in certain tests to mock DNS resolution
 // and can generally be left nil.
-func getServerWithResolver(ctx context.Context, host, port string, site site, resolver apiutils.HostResolver) (types.Server, error) {
-	if site == nil {
-		return nil, trace.BadParameter("invalid remote site provided")
+func getServerWithResolver(ctx context.Context, scopePin *scopesv1.Pin, host, port string, cluster cluster, resolver apiutils.HostResolver) (types.Server, error) {
+	if cluster == nil {
+		return nil, trace.BadParameter("invalid remote cluster provided")
 	}
 
 	strategy := types.RoutingStrategy_UNAMBIGUOUS_MATCH
 	var caseInsensitiveRouting bool
-	if cfg, err := site.GetClusterNetworkingConfig(ctx); err == nil {
+	if cfg, err := cluster.GetClusterNetworkingConfig(ctx); err == nil {
 		strategy = cfg.GetRoutingStrategy()
 		caseInsensitiveRouting = cfg.GetCaseInsensitiveRouting()
 	}
@@ -527,7 +519,22 @@ func getServerWithResolver(ctx context.Context, host, port string, site site, re
 
 	var maxScore int
 	scores := make(map[string]int)
-	matches, err := site.GetNodes(ctx, func(server readonly.Server) bool {
+	matches, err := cluster.GetNodes(ctx, func(server readonly.Server) bool {
+		if scopePin != nil {
+			// TODO(fspmarshall/scopes): implement scope-aware node storage. filtering agents based on scope is sub-optimal. scoping
+			// provides a natural machanism for efficiently storing resources in trees s.t. we only need query the subset of resources
+			// that are subject to the target scope. in very large clusters, reworking our node route table storage such that it is
+			// scope-partitioned could provide significant routing performance improvements.
+			agentScope := scopes.Root
+			if server.GetScope() != "" {
+				agentScope = server.GetScope()
+			}
+
+			if !scopes.ResourceScope(agentScope).IsSubjectToPolicyScope(scopePin.GetScope()) {
+				return false
+			}
+		}
+
 		score := routeMatcher.RouteToServerScore(server)
 		if score < 1 {
 			return false
@@ -553,6 +560,17 @@ func getServerWithResolver(ctx context.Context, host, port string, site site, re
 		}
 	}
 
+	// NOTE: there is an open question here about wether or not we should be doing scope-aware
+	// disambiguation when multiple matches are found. In some cases, this seems like the obviously
+	// right thing to do.  For example, when there is a match in `/foo` and a match in `/foo/bar`,
+	// it would seem obvious that the match in `/foo` should be preferred per scope hierarchy rules.
+	// However, not all cases are so clear (e.g. `/foo/bar` and `/foo/bax`), and there may be an
+	// argument that disambiguation within the set of scope-subject nodes may inadvertently hide
+	// the nature of scope-based routing and lead to a false sense of security, causing undesirable
+	// outcomes should the node in the parent scope ever go offline. For now, we are opting to leave
+	// scope-aware disambiguation as a future enhancement, in favor of only using scope to exclude those
+	// nodes that would *never* be routable per the provided scope pin.
+
 	if len(matches) > 1 {
 		// in the event of multiple matches, some matches may be of higher quality than others
 		// (e.g. matching an ip/hostname directly versus matching a resolved ip). if we have a
@@ -568,33 +586,37 @@ func getServerWithResolver(ctx context.Context, host, port string, site site, re
 		matches = filtered
 	}
 
-	var server types.Server
 	switch {
-	case strategy == types.RoutingStrategy_MOST_RECENT:
-		for _, m := range matches {
-			if server == nil || m.Expiry().After(server.Expiry()) {
-				server = m
-			}
-		}
+	case len(matches) == 1:
+		return matches[0], nil
+
 	case len(matches) > 1:
 		// TODO(tross) DELETE IN V20.0.0
 		// NodeIsAmbiguous is included in the error message for backwards compatibility
 		// with older nodes that expect to see that string in the error message.
-		return nil, trace.Wrap(teleport.ErrNodeIsAmbiguous, teleport.NodeIsAmbiguous)
-	case len(matches) == 1:
-		server = matches[0]
-	}
+		if strategy != types.RoutingStrategy_MOST_RECENT {
+			return nil, trace.Wrap(teleport.ErrNodeIsAmbiguous, teleport.NodeIsAmbiguous)
+		}
 
-	if routeMatcher.MatchesServerIDs() && server == nil {
-		idType := "UUID"
-		if aws.IsEC2NodeID(host) {
-			idType = "EC2"
+		var recentServer types.Server
+		for _, m := range matches {
+			if recentServer == nil || m.Expiry().After(recentServer.Expiry()) {
+				recentServer = m
+			}
 		}
+		return recentServer, nil
 
-		return nil, trace.NotFound("unable to locate node matching %s-like target %s", idType, host)
-	}
+	default: // no matches
+		if routeMatcher.MatchesServerIDs() {
+			idType := "UUID"
+			if aws.IsEC2NodeID(host) {
+				idType = "EC2"
+			}
+			return nil, trace.NotFound("unable to locate node matching %s-like target %s", idType, host)
+		}
 
-	return server, nil
+		return nil, trace.ConnectionProblem(nil, "target host %s is offline or does not exist", host)
+	}
 }
 
 // DialSite establishes a connection to the auth server in the provided
@@ -617,17 +639,17 @@ func (r *Router) DialSite(ctx context.Context, clusterName string, clientSrcAddr
 
 	// dial the local auth server
 	if clusterName == r.clusterName {
-		conn, err := r.localSite.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+		conn, err := r.localCluster.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
 		return conn, trace.Wrap(err)
 	}
 
-	// lookup the site and dial its auth server
-	site, err := r.siteGetter.GetSite(clusterName)
+	// lookup the cluster and dial its auth server
+	cluster, err := r.clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	conn, err := site.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+	conn, err := cluster.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -638,18 +660,18 @@ func (r *Router) DialSite(ctx context.Context, clusterName string, clientSrcAddr
 // GetSiteClient returns an auth client for the provided cluster.
 func (r *Router) GetSiteClient(ctx context.Context, clusterName string) (authclient.ClientI, error) {
 	if clusterName == r.clusterName {
-		return r.localSite.GetClient()
+		return r.localCluster.GetClient()
 	}
 
-	site, err := r.siteGetter.GetSite(clusterName)
+	cluster, err := r.clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return site.GetClient()
+	return cluster.GetClient()
 }
 
-func getGitHubServer(ctx context.Context, gitHubOrg string, site site) (types.Server, error) {
-	servers, err := site.GetGitServers(ctx, func(s readonly.Server) bool {
+func getGitHubServer(ctx context.Context, gitHubOrg string, cluster cluster) (types.Server, error) {
+	servers, err := cluster.GetGitServers(ctx, func(s readonly.Server) bool {
 		github := s.GetGitHub()
 		return github != nil && github.Organization == gitHubOrg
 	})
diff --git a/lib/proxy/router_test.go b/lib/proxy/router_test.go
index 2ff023e25195c..0c3af8bd5a77c 100644
--- a/lib/proxy/router_test.go
+++ b/lib/proxy/router_test.go
@@ -32,6 +32,7 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auth/authclient"
@@ -40,7 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services/readonly"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -76,6 +77,7 @@ func (t testSite) GetGitServers(ctx context.Context, fn func(n readonly.Server)
 }
 
 type server struct {
+	scope    string
 	name     string
 	hostname string
 	addr     string
@@ -91,6 +93,7 @@ func createServers(srvs []server) []types.Server {
 			Metadata: types.Metadata{
 				Name: s.name,
 			},
+			Scope: s.scope,
 			Spec: types.ServerSpecV2{
 				Addr:      s.addr,
 				Hostname:  s.hostname,
@@ -111,6 +114,150 @@ func (r *mockHostResolver) LookupHost(ctx context.Context, host string) (addrs [
 	return r.hosts[host], nil
 }
 
+// TestScopePinning verifies expected routing behavior for scoped nodes.
+func TestScopePinning(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	// set up servers across varioous scopes with various hostname collision
+	// scenarios (parent/child, same-scope, orthogonal scopes, etc).
+	servers := createServers([]server{
+		{
+			scope:    "",
+			name:     uuid.NewString(),
+			hostname: "unscoped.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/staging",
+			name:     uuid.NewString(),
+			hostname: "unique-parent.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/staging/west",
+			name:     uuid.NewString(),
+			hostname: "unique-child.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/staging",
+			name:     uuid.NewString(),
+			hostname: "orthogonal.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/prod",
+			name:     uuid.NewString(),
+			hostname: "orthogonal.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/staging",
+			name:     uuid.NewString(),
+			hostname: "parent-child.example.com",
+			addr:     "1.2.3.4:0",
+		},
+		{
+			scope:    "/staging/west",
+			name:     uuid.NewString(),
+			hostname: "parent-child.example.com",
+			addr:     "1.2.3.4:0",
+		},
+	})
+
+	tts := []struct {
+		name      string
+		host      string
+		pin       *scopesv1.Pin
+		ambiguous bool
+		unmatched bool
+	}{
+		{
+			name: "unscoped node reachable when unpinned",
+			host: "unscoped.example.com",
+			pin:  nil,
+		},
+		{
+			name:      "unscoped node unreachable when pinned",
+			host:      "unscoped.example.com",
+			pin:       &scopesv1.Pin{Scope: "/staging"},
+			unmatched: true,
+		},
+		{
+			name: "parent scoped node reachable when pinned to exact scope",
+			host: "unique-parent.example.com",
+			pin:  &scopesv1.Pin{Scope: "/staging"},
+		},
+		{
+			name:      "parent scoped node unreachable when pinned to child scope",
+			host:      "unique-parent.example.com",
+			pin:       &scopesv1.Pin{Scope: "/staging/west"},
+			unmatched: true,
+		},
+		{
+			name: "child scoped node reachable when pinned to child scope",
+			host: "unique-child.example.com",
+			pin:  &scopesv1.Pin{Scope: "/staging/west"},
+		},
+		{
+			name: "child scoped node reachable when pinned to parent scope",
+			host: "unique-child.example.com",
+			pin:  &scopesv1.Pin{Scope: "/staging"},
+		},
+		{
+			name: "no collisions from orthogonal scopes when pinned",
+			host: "orthogonal.example.com",
+			pin:  &scopesv1.Pin{Scope: "/staging"},
+		},
+		{
+			name:      "parent/child conflict when pinned to parent",
+			host:      "parent-child.example.com",
+			pin:       &scopesv1.Pin{Scope: "/staging"},
+			ambiguous: true,
+		},
+		{
+			name: "parent/child doesn't conflict when pinned to child",
+			host: "parent-child.example.com",
+			pin:  &scopesv1.Pin{Scope: "/staging/west"},
+		},
+		{
+			name:      "parent/child conflict when unpinned",
+			host:      "parent-child.example.com",
+			pin:       nil,
+			ambiguous: true,
+		},
+	}
+
+	// use strict routing to ensure only one match is possible per test case.
+	site := &testSite{
+		cfg: &types.ClusterNetworkingConfigV2{
+			Spec: types.ClusterNetworkingConfigSpecV2{
+				RoutingStrategy: types.RoutingStrategy_UNAMBIGUOUS_MATCH,
+			},
+		},
+		nodes: servers,
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			srv, err := getServer(ctx, tt.pin, tt.host, "0", site)
+			switch {
+			case tt.ambiguous:
+				require.ErrorIs(t, err, teleport.ErrNodeIsAmbiguous)
+			case tt.unmatched:
+				require.Error(t, err)
+				require.Contains(t, err.Error(), "offline or does not exist")
+			default:
+				require.NoError(t, err)
+				require.NotNil(t, srv)
+			}
+		})
+	}
+
+}
+
 // TestRouteScoring verifies expected behavior in the specific cases where multiple matches
 // of different quality are made.
 func TestRouteScoring(t *testing.T) {
@@ -232,7 +379,7 @@ func TestRouteScoring(t *testing.T) {
 
 	for _, tt := range tts {
 		t.Run(tt.desc, func(t *testing.T) {
-			srv, err := getServerWithResolver(ctx, tt.host, tt.port, site, resolver)
+			srv, err := getServerWithResolver(ctx, nil /*scopePin*/, tt.host, tt.port, site, resolver)
 			if tt.ambiguous {
 				require.ErrorIs(t, err, teleport.ErrNodeIsAmbiguous)
 				return
@@ -383,10 +530,12 @@ func TestGetServers(t *testing.T) {
 		serverAssertion func(t *testing.T, srv types.Server)
 	}{
 		{
-			name:         "no matches for hostname",
-			site:         testSite{cfg: &unambiguousCfg},
-			host:         "test",
-			errAssertion: require.NoError,
+			name: "no matches for hostname",
+			site: testSite{cfg: &unambiguousCfg},
+			host: "test",
+			errAssertion: func(t require.TestingT, err error, i ...any) {
+				require.True(t, trace.IsConnectionProblem(err), "Expected connection error but got %v", err)
+			},
 			serverAssertion: func(t *testing.T, srv types.Server) {
 				require.Empty(t, srv)
 			},
@@ -534,7 +683,7 @@ func TestGetServers(t *testing.T) {
 	ctx := context.Background()
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
-			srv, err := getServer(ctx, tt.host, tt.port, tt.site)
+			srv, err := getServer(ctx, nil /*scopePin*/, tt.host, tt.port, tt.site)
 			tt.errAssertion(t, err)
 			tt.serverAssertion(t, srv)
 		})
@@ -542,7 +691,7 @@ func TestGetServers(t *testing.T) {
 }
 
 func serverResolver(srv types.Server, err error) serverResolverFn {
-	return func(ctx context.Context, host, port string, site site) (types.Server, error) {
+	return func(ctx context.Context, scopePin *scopesv1.Pin, host, port string, site cluster) (types.Server, error) {
 		return srv, err
 	}
 }
@@ -628,19 +777,18 @@ func TestCheckedPrefixWriter(t *testing.T) {
 	})
 }
 
-type tunnel struct {
-	reversetunnelclient.Tunnel
-
-	site reversetunnelclient.RemoteSite
-	err  error
+type fakeClusterGetter struct {
+	ClusterGetter
+	cluster reversetunnelclient.Cluster
+	err     error
 }
 
-func (t tunnel) GetSite(cluster string) (reversetunnelclient.RemoteSite, error) {
-	return t.site, t.err
+func (t fakeClusterGetter) Cluster(context.Context, string) (reversetunnelclient.Cluster, error) {
+	return t.cluster, t.err
 }
 
 type testRemoteSite struct {
-	reversetunnelclient.RemoteSite
+	reversetunnelclient.Cluster
 
 	params reversetunnelclient.DialParams
 
@@ -665,14 +813,6 @@ func (r testRemoteSite) CachingAccessPoint() (authclient.RemoteProxyAccessPoint,
 	return nil, nil
 }
 
-type testSiteGetter struct {
-	site reversetunnelclient.RemoteSite
-}
-
-func (s testSiteGetter) GetSite(clusterName string) (reversetunnelclient.RemoteSite, error) {
-	return s.site, nil
-}
-
 type fakeConn struct {
 	net.Conn
 }
@@ -717,7 +857,7 @@ func TestRouter_DialHost(t *testing.T) {
 		},
 	}
 
-	agentGetter := func() (teleagent.Agent, error) {
+	agentGetter := func() (sshagent.Client, error) {
 		return nil, nil
 	}
 	createSigner := func(_ context.Context, _ agentless.LocalAccessPoint, _ agentless.CertGenerator) (ssh.Signer, error) {
@@ -748,9 +888,9 @@ func TestRouter_DialHost(t *testing.T) {
 		{
 			name: "failure looking up cluster",
 			router: Router{
-				clusterName: "leaf",
-				siteGetter:  tunnel{err: trace.NotFound("unknown cluster")},
-				tracer:      tracing.NoopTracer("test"),
+				clusterName:   "leaf",
+				clusterGetter: fakeClusterGetter{err: trace.NotFound("unknown cluster")},
+				tracer:        tracing.NoopTracer("test"),
 			},
 			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.Error(t, err)
@@ -762,7 +902,7 @@ func TestRouter_DialHost(t *testing.T) {
 			name: "dial failure",
 			router: Router{
 				clusterName:    "test",
-				localSite:      &testRemoteSite{err: trace.ConnectionProblem(context.DeadlineExceeded, "connection refused")},
+				localCluster:   &testRemoteSite{err: trace.ConnectionProblem(context.DeadlineExceeded, "connection refused")},
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(srv, nil),
 			},
@@ -776,7 +916,7 @@ func TestRouter_DialHost(t *testing.T) {
 			name: "dial success",
 			router: Router{
 				clusterName:    "test",
-				localSite:      &testRemoteSite{conn: fakeConn{}},
+				localCluster:   &testRemoteSite{conn: fakeConn{}},
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(srv, nil),
 			},
@@ -794,8 +934,8 @@ func TestRouter_DialHost(t *testing.T) {
 			name: "dial success to agentless node",
 			router: Router{
 				clusterName:    "test",
-				localSite:      &testRemoteSite{conn: fakeConn{}},
-				siteGetter:     &testSiteGetter{site: &testRemoteSite{conn: fakeConn{}}},
+				localCluster:   &testRemoteSite{conn: fakeConn{}},
+				clusterGetter:  &fakeClusterGetter{cluster: &testRemoteSite{conn: fakeConn{}}},
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(agentlessSrv, nil),
 			},
@@ -804,7 +944,6 @@ func TestRouter_DialHost(t *testing.T) {
 				require.Equal(t, agentlessSrv, params.TargetServer)
 				require.Nil(t, params.GetUserAgent)
 				require.NotNil(t, params.AgentlessSigner)
-				require.True(t, params.IsAgentlessNode)
 				require.NotNil(t, conn)
 				require.Contains(t, params.Principals, "host")
 				require.Contains(t, params.Principals, "host.test")
@@ -814,8 +953,8 @@ func TestRouter_DialHost(t *testing.T) {
 			name: "dial success to agentless node using EC2 Instance Connect Endpoint",
 			router: Router{
 				clusterName:    "test",
-				localSite:      &testRemoteSite{conn: fakeConn{}},
-				siteGetter:     &testSiteGetter{site: &testRemoteSite{conn: fakeConn{}}},
+				localCluster:   &testRemoteSite{conn: fakeConn{}},
+				clusterGetter:  &fakeClusterGetter{cluster: &testRemoteSite{conn: fakeConn{}}},
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(agentlessEC2ICESrv, nil),
 			},
@@ -824,7 +963,6 @@ func TestRouter_DialHost(t *testing.T) {
 				require.Equal(t, agentlessEC2ICESrv, params.TargetServer)
 				require.Nil(t, params.GetUserAgent)
 				require.Nil(t, params.AgentlessSigner)
-				require.True(t, params.IsAgentlessNode)
 				require.NotNil(t, conn)
 			},
 		},
@@ -834,11 +972,11 @@ func TestRouter_DialHost(t *testing.T) {
 
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
-			conn, err := tt.router.DialHost(ctx, &utils.NetAddr{}, &utils.NetAddr{}, "host", "0", "test", nil, agentGetter, createSigner)
+			conn, err := tt.router.DialHost(ctx, nil /*scopePin*/, &utils.NetAddr{}, &utils.NetAddr{}, "host", "0", "test", nil, agentGetter, createSigner)
 
 			var params reversetunnelclient.DialParams
-			if tt.router.localSite != nil {
-				params = tt.router.localSite.(*testRemoteSite).params
+			if tt.router.localCluster != nil {
+				params = tt.router.localCluster.(*testRemoteSite).params
 			}
 
 			tt.assertion(t, params, conn, err)
@@ -855,7 +993,7 @@ func TestRouter_DialSite(t *testing.T) {
 		name      string
 		cluster   string
 		localSite testRemoteSite
-		tunnel    tunnel
+		tunnel    fakeClusterGetter
 		assertion func(t *testing.T, conn net.Conn, err error)
 	}{
 		{
@@ -889,8 +1027,8 @@ func TestRouter_DialSite(t *testing.T) {
 		{
 			name:    "failure to dial remote site",
 			cluster: "leaf",
-			tunnel: tunnel{
-				site: &testRemoteSite{err: trace.ConnectionProblem(context.DeadlineExceeded, "connection refused")},
+			tunnel: fakeClusterGetter{
+				cluster: &testRemoteSite{err: trace.ConnectionProblem(context.DeadlineExceeded, "connection refused")},
 			},
 			assertion: func(t *testing.T, conn net.Conn, err error) {
 				require.Error(t, err)
@@ -901,7 +1039,7 @@ func TestRouter_DialSite(t *testing.T) {
 		{
 			name:    "unknown cluster",
 			cluster: "fake",
-			tunnel: tunnel{
+			tunnel: fakeClusterGetter{
 				err: trace.NotFound("unknown cluster"),
 			},
 			assertion: func(t *testing.T, conn net.Conn, err error) {
@@ -913,8 +1051,8 @@ func TestRouter_DialSite(t *testing.T) {
 		{
 			name:    "successfully  dial remote site",
 			cluster: "leaf",
-			tunnel: tunnel{
-				site: &testRemoteSite{conn: fakeConn{}},
+			tunnel: fakeClusterGetter{
+				cluster: &testRemoteSite{conn: fakeConn{}},
 			},
 			assertion: func(t *testing.T, conn net.Conn, err error) {
 				require.NoError(t, err)
@@ -928,10 +1066,10 @@ func TestRouter_DialSite(t *testing.T) {
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
 			router := Router{
-				clusterName: cluster,
-				localSite:   &tt.localSite,
-				siteGetter:  tt.tunnel,
-				tracer:      tracing.NoopTracer(cluster),
+				clusterName:   cluster,
+				localCluster:  &tt.localSite,
+				clusterGetter: tt.tunnel,
+				tracer:        tracing.NoopTracer(cluster),
 			}
 
 			conn, err := router.DialSite(ctx, tt.cluster, nil, nil)
@@ -951,9 +1089,9 @@ func TestRouter_DialWindowsDesktop(t *testing.T) {
 		{
 			name: "failure looking up cluster",
 			router: Router{
-				clusterName: "leaf",
-				siteGetter:  tunnel{err: trace.NotFound("unknown cluster")},
-				tracer:      tracing.NoopTracer("test"),
+				clusterName:   "leaf",
+				clusterGetter: fakeClusterGetter{err: trace.NotFound("unknown cluster")},
+				tracer:        tracing.NoopTracer("test"),
 			},
 			assertion: func(t *testing.T, conn net.Conn, err error) {
 				require.Error(t, err)
@@ -964,9 +1102,9 @@ func TestRouter_DialWindowsDesktop(t *testing.T) {
 		{
 			name: "failure connecting to desktop service",
 			router: Router{
-				clusterName: "test",
-				tracer:      tracing.NoopTracer("test"),
-				localSite:   &testRemoteSite{},
+				clusterName:  "test",
+				tracer:       tracing.NoopTracer("test"),
+				localCluster: &testRemoteSite{},
 				windowsDesktopServiceConnector: func(ctx context.Context, c *desktop.ConnectionConfig) (net.Conn, string, error) {
 					return nil, "", trace.ConnectionProblem(context.DeadlineExceeded, "connection refused")
 				},
@@ -980,9 +1118,9 @@ func TestRouter_DialWindowsDesktop(t *testing.T) {
 		{
 			name: "dial success",
 			router: Router{
-				clusterName: "test",
-				localSite:   &testRemoteSite{conn: fakeConn{}},
-				tracer:      tracing.NoopTracer("test"),
+				clusterName:  "test",
+				localCluster: &testRemoteSite{conn: fakeConn{}},
+				tracer:       tracing.NoopTracer("test"),
 				windowsDesktopServiceConnector: func(ctx context.Context, c *desktop.ConnectionConfig) (net.Conn, string, error) {
 					return fakeConn{}, "18.0.0", nil
 				},
diff --git a/lib/relaypeer/client.go b/lib/relaypeer/client.go
new file mode 100644
index 0000000000000..ce4bd66002c6f
--- /dev/null
+++ b/lib/relaypeer/client.go
@@ -0,0 +1,273 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaypeer
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"log/slog"
+	"net"
+	"slices"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/status"
+
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	"github.com/gravitational/teleport/api/trail"
+	"github.com/gravitational/teleport/api/types"
+	relaypeeringv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaypeering/v1alpha"
+	"github.com/gravitational/teleport/lib/proxy"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+type ClientAccessPoint interface {
+	GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error)
+}
+
+// ClientConfig contains parameters for [NewClient].
+type ClientConfig struct {
+	// HostID is the host ID of the local machine, to avoid peering with
+	// ourselves.
+	HostID string
+	// ClusterName is the name of the Teleport cluster we belong to.
+	ClusterName string
+	// GroupName is the relay group we belong to, to avoid attempting to connect
+	// to relays from a different group.
+	GroupName string
+	// AccessPoint is used to read information about other relays in the same
+	// group.
+	AccessPoint ClientAccessPoint
+
+	Log *slog.Logger
+
+	GetCertificate func() (*tls.Certificate, error)
+	GetPool        func() (*x509.CertPool, error)
+	Ciphersuites   []uint16
+}
+
+// NewClient creates a [Client] with a given configuration.
+func NewClient(cfg ClientConfig) (*Client, error) {
+	if cfg.HostID == "" {
+		return nil, trace.BadParameter("missing HostID")
+	}
+	if cfg.ClusterName == "" {
+		return nil, trace.BadParameter("missing ClusterName")
+	}
+	if cfg.GroupName == "" {
+		return nil, trace.BadParameter("missing GroupName")
+	}
+	if cfg.AccessPoint == nil {
+		return nil, trace.BadParameter("missing AccessPoint")
+	}
+	if cfg.Log == nil {
+		return nil, trace.BadParameter("missing Log")
+	}
+	if cfg.GetCertificate == nil {
+		return nil, trace.BadParameter("missing GetCertificate")
+	}
+	if cfg.GetPool == nil {
+		return nil, trace.BadParameter("missing GetPool")
+	}
+
+	return &Client{
+		hostID:      cfg.HostID,
+		clusterName: cfg.ClusterName,
+		groupName:   cfg.GroupName,
+		accessPoint: cfg.AccessPoint,
+
+		log: cfg.Log,
+
+		getCertificate: cfg.GetCertificate,
+		getPool:        cfg.GetPool,
+		ciphersuites:   cfg.Ciphersuites,
+	}, nil
+}
+
+// Client is used to open tunnel connections to services that are connected with
+// relay tunnels to the local relay group, but don't have a tunnel available
+// locally, and thus require bouncing the connection to a different peer relay
+// in the same relay group. It implements the client side of the relay peer
+// dialing protocol, and connects to peer relays through the advertised peer
+// address in the relay_server heartbeats.
+type Client struct {
+	hostID      string
+	clusterName string
+	groupName   string
+	accessPoint ClientAccessPoint
+
+	log *slog.Logger
+
+	getCertificate func() (*tls.Certificate, error)
+	getPool        func() (*x509.CertPool, error)
+	ciphersuites   []uint16
+}
+
+var _ proxy.RelayPeerDialFunc = (*Client)(nil).Dial
+
+// Dial will try to open a connection to a target host (in "<host id>.<cluster
+// name>" format) with a given tunnel type, trying to dial through a list of
+// peer relay IDs in random order. The list is assumed to be owned by Dial and
+// will be shuffled in place. The returned connection will have the given source
+// (remote) and destination (local) addresses.
+func (c *Client) Dial(ctx context.Context, dialTarget string, tunnelType types.TunnelType, relayIDs []string, src, dst net.Addr) (net.Conn, error) {
+	// it's assumed that all peer relays are equivalent
+	for _, relayID := range utils.ShuffleVisit(relayIDs) {
+		if relayID == c.hostID {
+			continue
+		}
+		nc, err := c.dialRelay(ctx, dialTarget, tunnelType, relayID, src, dst)
+		if err == nil {
+			c.log.DebugContext(ctx, "Successfully dialed through peer relay", "relay_id", relayID)
+			return nc, nil
+		}
+		c.log.DebugContext(ctx, "Failed to dial through peer relay", "relay_id", relayID, "error", err, "target", dialTarget)
+	}
+	return nil, trace.ConnectionProblem(nil, "unable to reach dial target through relay peering")
+}
+
+// dialRelay tries to open a connection to a target through a specific peer
+// relay.
+func (c *Client) dialRelay(ctx context.Context, dialTarget string, tunnelType types.TunnelType, relayID string, src net.Addr, dst net.Addr) (net.Conn, error) {
+	relayServer, err := c.accessPoint.GetRelayServer(ctx, relayID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if relayServer.GetSpec().GetRelayGroup() != c.groupName {
+		return nil, trace.BadParameter("peer relay server belongs to different relay group")
+	}
+
+	peerAddr := relayServer.GetSpec().GetPeerAddr()
+	if peerAddr == "" {
+		return nil, trace.BadParameter("no peer addr in peer relay server")
+	}
+
+	cert, err := c.getCertificate()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	pool, err := c.getPool()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	nc, err := new(net.Dialer).DialContext(ctx, "tcp", peerAddr)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	serverName, _, err := net.SplitHostPort(peerAddr)
+	if err != nil {
+		serverName = peerAddr
+	}
+
+	tlsConfig := &tls.Config{
+		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			return cert, nil
+		},
+
+		InsecureSkipVerify: true,
+		VerifyConnection: func(cs tls.ConnectionState) error {
+			if cs.NegotiatedProtocol == "" {
+				return trace.NotImplemented("relay peer protocol not supported")
+			}
+
+			opts := x509.VerifyOptions{
+				DNSName: "",
+
+				Roots:         pool,
+				Intermediates: nil,
+
+				KeyUsages: []x509.ExtKeyUsage{
+					x509.ExtKeyUsageServerAuth,
+				},
+			}
+			if len(cs.PeerCertificates) > 1 {
+				opts.Intermediates = x509.NewCertPool()
+				for _, cert := range cs.PeerCertificates[1:] {
+					opts.Intermediates.AddCert(cert)
+				}
+			}
+			if _, err := cs.PeerCertificates[0].Verify(opts); err != nil {
+				return trace.Wrap(err)
+			}
+
+			id, err := tlsca.FromSubject(cs.PeerCertificates[0].Subject, cs.PeerCertificates[0].NotAfter)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if !slices.Contains(id.Groups, string(types.RoleRelay)) &&
+				!slices.Contains(id.SystemRoles, string(types.RoleRelay)) {
+				return trace.BadParameter("dialed server is not a relay (roles %+q, system roles %+q)", id.Groups, id.SystemRoles)
+			}
+
+			if id.Username != relayID+"."+c.clusterName {
+				return trace.BadParameter("dialed server is the wrong relay (expected %+q, got %+q)", relayID, id.Username)
+			}
+
+			return nil
+		},
+
+		NextProtos: []string{simpleALPN},
+		ServerName: serverName,
+
+		CipherSuites: c.ciphersuites,
+		MinVersion:   tls.VersionTLS12,
+	}
+	tc := tls.Client(nc, tlsConfig)
+
+	explode := make(chan struct{})
+	defuse := context.AfterFunc(ctx, func() {
+		defer close(explode)
+		tc.SetDeadline(time.Unix(1, 0))
+	})
+	defer defuse()
+
+	if err := writeProto(tc, &relaypeeringv1alpha.DialRequest{
+		TargetHostId:   dialTarget,
+		ConnectionType: string(tunnelType),
+		Source:         addrToProto(src),
+		Destination:    addrToProto(dst),
+	}); err != nil {
+		defuse()
+		_ = tc.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	resp := new(relaypeeringv1alpha.DialResponse)
+	if err := readProto(tc, resp); err != nil {
+		defuse()
+		_ = tc.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	if !defuse() {
+		<-explode
+	}
+	tc.SetDeadline(time.Time{})
+
+	if err := trail.FromGRPC(status.FromProto(resp.GetStatus()).Err()); err != nil {
+		_ = tc.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	return tc, nil
+}
diff --git a/lib/relaypeer/common.go b/lib/relaypeer/common.go
new file mode 100644
index 0000000000000..1f94eb0537114
--- /dev/null
+++ b/lib/relaypeer/common.go
@@ -0,0 +1,110 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaypeer
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	relaypeeringv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaypeering/v1alpha"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// simpleALPN is the ALPN protocol name for the bespoke protocol used by peer
+// connections. Future variants of the protocol should use a different ALPN
+// protocol name.
+const simpleALPN = "teleport-relaypeer"
+
+// The teleport-relaypeer protocol consists of a DialRequest message sent by the
+// client followed by a DialResponse message sent by the server, containing a
+// google.rpc.Status. If the status is ok, the data for the connection will then
+// follow.
+//
+// Messages are sent in their protobuf wire format, prefixed by a little endian
+// 32 bit size. Messages must be smaller than maxMessageSize (128KiB).
+
+const maxMessageSize = 128 * 1024
+
+func readProto(r io.Reader, m proto.Message) error {
+	var sizeBuf [4]byte
+	if _, err := io.ReadFull(r, sizeBuf[:]); err != nil {
+		return trace.Wrap(err)
+	}
+	size := binary.LittleEndian.Uint32(sizeBuf[:])
+	if size > maxMessageSize {
+		return trace.LimitExceeded("bad size")
+	}
+
+	msgBuf := make([]byte, size)
+	if _, err := io.ReadFull(r, msgBuf); err != nil {
+		if errors.Is(err, io.EOF) {
+			return trace.Wrap(io.ErrUnexpectedEOF)
+		}
+		return trace.Wrap(err)
+	}
+
+	if err := proto.Unmarshal(msgBuf, m); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func writeProto(w io.Writer, m proto.Message) error {
+	msgBuf, err := proto.Marshal(m)
+	if err != nil {
+		return err
+	}
+	if len(msgBuf) > maxMessageSize {
+		return trace.LimitExceeded("bad size")
+	}
+	var sizeBuf [4]byte
+	binary.LittleEndian.PutUint32(sizeBuf[:], uint32(len(msgBuf)))
+	if _, err := w.Write(sizeBuf[:]); err != nil {
+		return trace.Wrap(err)
+	}
+	if _, err := w.Write(msgBuf); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func addrToProto(a net.Addr) *relaypeeringv1alpha.Addr {
+	if a == nil {
+		return nil
+	}
+
+	return &relaypeeringv1alpha.Addr{
+		Network: a.Network(),
+		Addr:    a.String(),
+	}
+}
+
+func addrFromProto(a *relaypeeringv1alpha.Addr) net.Addr {
+	if a == nil {
+		return nil
+	}
+
+	return &utils.NetAddr{
+		AddrNetwork: a.GetNetwork(),
+		Addr:        a.GetAddr(),
+	}
+}
diff --git a/lib/relaypeer/server.go b/lib/relaypeer/server.go
new file mode 100644
index 0000000000000..cf84ef0f5262a
--- /dev/null
+++ b/lib/relaypeer/server.go
@@ -0,0 +1,304 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaypeer
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport/api/trail"
+	"github.com/gravitational/teleport/api/types"
+	relaypeeringv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaypeering/v1alpha"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+type dialFunc = func(ctx context.Context, dialTarget string, tunnelType types.TunnelType, src, dst net.Addr) (net.Conn, error)
+
+// ServerConfig contains parameters for [NewServer].
+type ServerConfig struct {
+	Log *slog.Logger
+
+	GetCertificate func(ctx context.Context) (*tls.Certificate, error)
+	GetPool        func(ctx context.Context) (*x509.CertPool, error)
+	Ciphersuites   []uint16
+
+	// LocalDial should dial the given target host (in "<host ID>.<cluster
+	// name>" form) for a given tunnel type, returning a connection with the
+	// given source (remote) address and destination (local) address.
+	LocalDial dialFunc
+}
+
+// NewServer creates a [Server] with a given configuration.
+func NewServer(cfg ServerConfig) (*Server, error) {
+	if cfg.Log == nil {
+		return nil, trace.BadParameter("missing Log")
+	}
+	if cfg.GetCertificate == nil {
+		return nil, trace.BadParameter("missing GetCertificate")
+	}
+	if cfg.GetPool == nil {
+		return nil, trace.BadParameter("missing GetPool")
+	}
+	if cfg.LocalDial == nil {
+		return nil, trace.BadParameter("missing LocalDial")
+	}
+	ctx, ctxCancel := context.WithCancel(context.Background())
+	return &Server{
+		log: cfg.Log,
+
+		getCertificate: cfg.GetCertificate,
+		getPool:        cfg.GetPool,
+		ciphersuites:   cfg.Ciphersuites,
+
+		localDial: cfg.LocalDial,
+
+		ctx:       ctx,
+		ctxCancel: ctxCancel,
+	}, nil
+}
+
+// Server manages listeners and accepts connections for the relay peering dial
+// protocol, used by other relays in the same relay group to bounce connections
+// for which the local relay hopefully has a tunnel but the peer relay does not.
+// It implements the server side of the relay peering dial protocol. The
+// relay_server heartbeat for the local relay should be advertising a peer
+// address that lets the other relays reach the listener (or listeners) of this
+// server.
+type Server struct {
+	log *slog.Logger
+
+	getCertificate func(ctx context.Context) (*tls.Certificate, error)
+	getPool        func(ctx context.Context) (*x509.CertPool, error)
+	ciphersuites   []uint16
+
+	localDial dialFunc
+
+	mu sync.Mutex
+
+	wg sync.WaitGroup
+
+	// ctx should only be canceled while holding mu to synchronize adding
+	// connections and listeners to the maps and closing them, as well as adding
+	// tasks to wg, so it should not be externally cancelable.
+	ctx       context.Context
+	ctxCancel context.CancelFunc
+
+	tlsListeners map[net.Listener]struct{}
+	conns        map[io.Closer]struct{}
+}
+
+func (s *Server) ServeTLSListener(l net.Listener) error {
+	defer l.Close()
+
+	s.mu.Lock()
+	if s.ctx.Err() != nil {
+		s.mu.Unlock()
+		return trace.Errorf("server is already terminating")
+	}
+
+	s.wg.Add(1)
+	defer s.wg.Done()
+
+	if s.tlsListeners == nil {
+		s.tlsListeners = make(map[net.Listener]struct{})
+	}
+	s.tlsListeners[l] = struct{}{}
+	s.mu.Unlock()
+
+	defer func() {
+		s.mu.Lock()
+		delete(s.tlsListeners, l)
+		s.mu.Unlock()
+	}()
+
+	var tempDelay time.Duration
+	for {
+		if s.ctx.Err() != nil {
+			s.log.DebugContext(s.ctx, "Exiting due to requested termination")
+			return nil
+		}
+
+		c, err := l.Accept()
+		if err != nil {
+			if s.ctx.Err() != nil {
+				continue
+			}
+
+			if tempErr := *new(interface{ Temporary() bool }); errors.As(err, &tempErr) && tempErr.Temporary() {
+				tempDelay = max(5*time.Millisecond, min(2*tempDelay, time.Second))
+				select {
+				case <-time.After(tempDelay):
+				case <-s.ctx.Done():
+				}
+				continue
+			}
+			return trace.Wrap(err)
+		}
+		tempDelay = 0
+
+		s.mu.Lock()
+		if s.ctx.Err() != nil {
+			// a connection sneaked by right before we closed the listener
+			s.mu.Unlock()
+			_ = c.Close()
+			continue
+		}
+		if s.conns == nil {
+			s.conns = make(map[io.Closer]struct{})
+		}
+		s.conns[c] = struct{}{}
+		s.mu.Unlock()
+
+		s.wg.Add(1)
+		go func() {
+			defer s.wg.Done()
+			defer func() {
+				s.mu.Lock()
+				delete(s.conns, c)
+				s.mu.Unlock()
+			}()
+			err := s.handleTLSConnection(c)
+			s.log.DebugContext(context.Background(), "Finished handling peer connection", "error", err)
+		}()
+	}
+}
+
+func (s *Server) Close() error {
+	s.mu.Lock()
+	tlsListeners := s.tlsListeners
+	s.tlsListeners = nil
+	conns := s.conns
+	s.conns = nil
+	s.mu.Unlock()
+
+	for l := range tlsListeners {
+		_ = l.Close()
+	}
+	for c := range conns {
+		_ = c.Close()
+	}
+
+	s.wg.Wait()
+	return nil
+}
+
+func (s *Server) handleTLSConnection(nc net.Conn) error {
+	handshakeDeadline := time.Now().Add(30 * time.Second)
+	handshakeCtx, cancel := context.WithDeadline(context.Background(), handshakeDeadline)
+	defer cancel()
+
+	cert, err := s.getCertificate(handshakeCtx)
+	if err != nil {
+		_ = nc.Close()
+		return trace.Wrap(err)
+	}
+	pool, err := s.getPool(handshakeCtx)
+	if err != nil {
+		_ = nc.Close()
+		return trace.Wrap(err)
+	}
+
+	tlsConfig := &tls.Config{
+		GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+			return cert, nil
+		},
+		VerifyConnection: func(cs tls.ConnectionState) error {
+			if cs.NegotiatedProtocol == "" {
+				return trace.NotImplemented("relay peering protocol not supported")
+			}
+			if len(cs.VerifiedChains) < 1 {
+				return trace.AccessDenied("missing or invalid client certificate")
+			}
+
+			id, err := tlsca.FromSubject(cs.VerifiedChains[0][0].Subject, cs.VerifiedChains[0][0].NotAfter)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if !slices.Contains(id.Groups, string(types.RoleRelay)) &&
+				!slices.Contains(id.SystemRoles, string(types.RoleRelay)) {
+				return trace.BadParameter("client is not a relay (roles %+q, system roles %+q)", id.Groups, id.SystemRoles)
+			}
+
+			return nil
+		},
+		NextProtos: []string{simpleALPN},
+
+		ClientAuth: tls.RequireAndVerifyClientCert,
+		ClientCAs:  pool,
+
+		InsecureSkipVerify: false,
+
+		MinVersion:             tls.VersionTLS12,
+		CipherSuites:           s.ciphersuites,
+		SessionTicketsDisabled: true,
+	}
+
+	tc := tls.Server(nc, tlsConfig)
+	defer tc.Close()
+
+	if err := tc.HandshakeContext(handshakeCtx); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// the only possible negotiated protocol is here is the only supported one,
+	// "teleport-relaypeer"
+
+	tc.SetDeadline(handshakeDeadline)
+
+	req := new(relaypeeringv1alpha.DialRequest)
+	if err := readProto(tc, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	lc, err := s.localDial(
+		handshakeCtx,
+		req.GetTargetHostId(),
+		types.TunnelType(req.GetConnectionType()),
+		addrFromProto(req.GetSource()),
+		addrFromProto(req.GetDestination()),
+	)
+	if err != nil {
+		_ = writeProto(tc, &relaypeeringv1alpha.DialResponse{
+			Status: status.Convert(trail.ToGRPC(err)).Proto(),
+		})
+		return trace.Wrap(err)
+	}
+	defer lc.Close()
+
+	if err := writeProto(tc, &relaypeeringv1alpha.DialResponse{
+		Status: nil, // i.e. status.Convert(error(nil)).Proto()
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	tc.SetDeadline(time.Time{})
+
+	return utils.ProxyConn(context.Background(), lc, tc)
+}
diff --git a/lib/relaytransport/sni.go b/lib/relaytransport/sni.go
new file mode 100644
index 0000000000000..f7d1ecdf2981d
--- /dev/null
+++ b/lib/relaytransport/sni.go
@@ -0,0 +1,158 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytransport
+
+import (
+	"bytes"
+	"crypto/tls"
+	"io"
+	"net"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/credentials"
+)
+
+type SNIDispatchFunc = func(serverName string, transcript *bytes.Buffer, rawConn net.Conn) (dispatched bool)
+
+// SNIDispatchTransportCredentials is a wrapper around a
+// [credentials.TransportCredentials] that reads a TLS ClientHello from each
+// client connection and optionally dispatches the connection through a custom
+// function based on the Server Name Indication in the ClientHello, without
+// interacting with the connection otherwise.
+type SNIDispatchTransportCredentials struct {
+	_ struct{}
+
+	credentials.TransportCredentials
+
+	// DispatchFunc should return true if the connection with the given server
+	// name should not be handled by the gRPC server. The transcript buffer
+	// contains the data that was received from the connection (containing the
+	// TLS ClientHello and potentially more data).
+	DispatchFunc SNIDispatchFunc
+}
+
+var _ credentials.TransportCredentials = (*SNIDispatchTransportCredentials)(nil)
+
+// Clone implements [credentials.TransportCredentials].
+func (s *SNIDispatchTransportCredentials) Clone() credentials.TransportCredentials {
+	return &SNIDispatchTransportCredentials{
+		TransportCredentials: s.TransportCredentials.Clone(),
+		DispatchFunc:         s.DispatchFunc,
+	}
+}
+
+// ServerHandshake implements [credentials.TransportCredentials].
+func (s *SNIDispatchTransportCredentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	// the deadline for rawConn was set by the grpc server machinery based on
+	// the server connection timeout, we should not apply additional timeouts
+
+	transcript := new(bytes.Buffer)
+	var serverName string
+	var receivedHello bool
+	if err := tls.Server(
+		&transcripterConn{conn: rawConn, transcript: transcript},
+		&tls.Config{
+			GetConfigForClient: func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
+				serverName = chi.ServerName
+				receivedHello = true
+				return nil, io.EOF
+			},
+		},
+	).Handshake(); !receivedHello && err != nil {
+		_ = rawConn.Close()
+		return nil, nil, trace.Wrap(err)
+	}
+
+	if s.DispatchFunc(serverName, transcript, rawConn) {
+		return nil, nil, credentials.ErrConnDispatched
+	}
+
+	if transcript.Len() > 0 {
+		rawConn = &transcriptedConn{
+			Conn:       rawConn,
+			transcript: transcript,
+		}
+	}
+
+	return s.TransportCredentials.ServerHandshake(rawConn)
+}
+
+// transcripterConn is a net.Conn that also stores the data that was read from a
+// real net.Conn in a transcript, and for which every other operation is a noop.
+type transcripterConn struct {
+	transcript *bytes.Buffer
+	conn       net.Conn
+}
+
+var _ net.Conn = (*transcripterConn)(nil)
+
+// Close implements [net.Conn].
+func (p *transcripterConn) Close() error { return nil }
+
+// Read implements [net.Conn].
+func (p *transcripterConn) Read(b []byte) (n int, err error) {
+	n, err = p.conn.Read(b)
+	_, _ = p.transcript.Write(b[:n])
+	return n, err
+}
+
+// LocalAddr implements [net.Conn].
+func (p *transcripterConn) LocalAddr() net.Addr { return p.conn.LocalAddr() }
+
+// RemoteAddr implements [net.Conn].
+func (p *transcripterConn) RemoteAddr() net.Addr { return p.conn.RemoteAddr() }
+
+// SetDeadline implements [net.Conn].
+func (p *transcripterConn) SetDeadline(t time.Time) error { return nil }
+
+// SetReadDeadline implements [net.Conn].
+func (p *transcripterConn) SetReadDeadline(t time.Time) error { return nil }
+
+// SetWriteDeadline implements [net.Conn].
+func (p *transcripterConn) SetWriteDeadline(t time.Time) error { return nil }
+
+// Write implements [net.Conn].
+func (p *transcripterConn) Write(b []byte) (n int, err error) { return len(b), nil }
+
+// transcriptedConn is a net.Conn whose incoming data begins with the data in a
+// transcript.
+type transcriptedConn struct {
+	net.Conn
+	transcript *bytes.Buffer
+}
+
+var _ net.Conn = (*transcriptedConn)(nil)
+
+// Read implements [net.Conn].
+func (p *transcriptedConn) Read(b []byte) (n int, err error) {
+	if p.transcript == nil {
+		return p.Conn.Read(b)
+	}
+
+	// this is improper behavior since closing the Conn will not cause read
+	// errors until the transcript is exhausted and reads past the deadline will
+	// still succeed, but this net.Conn implementation is very much intended for
+	// a buffer containing a TLS ClientHello that gets fully read almost
+	// immediately anyway
+	n = copy(b, p.transcript.Next(len(b)))
+	if p.transcript.Len() < 1 {
+		p.transcript = nil
+	}
+
+	return n, nil
+}
diff --git a/lib/relaytransport/sni_test.go b/lib/relaytransport/sni_test.go
new file mode 100644
index 0000000000000..199158e5bbc4a
--- /dev/null
+++ b/lib/relaytransport/sni_test.go
@@ -0,0 +1,264 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytransport
+
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/gravitational/teleport/lib/utils/uds"
+)
+
+func TestSNIDispatch_NoDispatch(t *testing.T) {
+	caCert := requireExampleServerCert(t)
+	caPool := x509.NewCertPool()
+	caPool.AddCert(caCert.Leaf)
+
+	var eg errgroup.Group
+	defer eg.Wait()
+
+	// net.Pipe is unbuffered and crypto/tls doesn't work well with unbuffered
+	// connections (even though it should)
+	sc, cc, err := uds.NewSocketpair(uds.SocketTypeStream)
+	require.NoError(t, err)
+	defer sc.Close()
+	defer cc.Close()
+
+	// from the point of view of a client, the SNI dispatcher does not exist
+	eg.Go(func() error {
+		defer cc.Close()
+		tc := tls.Client(cc, &tls.Config{
+			ServerName: "foo.example.com",
+			RootCAs:    caPool,
+		})
+		if err := tc.Handshake(); err != nil {
+			return err
+		}
+		if _, err := tc.Write([]byte("a")); err != nil {
+			return err
+		}
+		if _, err := io.ReadFull(tc, make([]byte, 1)); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// a connection going through the dispatcher with the wrong SNI will not be
+	// dispatched, and it will be passed to the inner TransportCredentials
+	var transportCredentialsCalled, dispatchFuncCalled int
+	var dispatchErr error
+	returnedConn, _, err := (&SNIDispatchTransportCredentials{
+		DispatchFunc: func(serverName string, transcript *bytes.Buffer, rawConn net.Conn) (dispatched bool) {
+			dispatchFuncCalled++
+			if serverName != "foo.example.com" {
+				dispatchErr = fmt.Errorf("expected foo.example.com, got SNI %+q", serverName)
+			}
+			return false
+		},
+		TransportCredentials: transportCredentialsFunc(func(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+			transportCredentialsCalled++
+			return rawConn, nil, nil
+		}),
+	}).ServerHandshake(sc)
+	require.NoError(t, err)
+	require.NoError(t, dispatchErr)
+	require.Equal(t, 1, dispatchFuncCalled)
+	require.Equal(t, 1, transportCredentialsCalled)
+
+	// prove that we can use the non-dispatched conn as is
+	tc := tls.Server(returnedConn, &tls.Config{
+		Certificates: []tls.Certificate{caCert},
+	})
+	require.NoError(t, tc.Handshake())
+
+	_, err = tc.Write([]byte("a"))
+	require.NoError(t, err)
+	_, err = io.ReadFull(tc, make([]byte, 1))
+	require.NoError(t, err)
+
+	// the client is happy
+	require.NoError(t, eg.Wait())
+}
+
+func TestSNIDispatch_YesDispatch(t *testing.T) {
+	caCert := requireExampleServerCert(t)
+	caPool := x509.NewCertPool()
+	caPool.AddCert(caCert.Leaf)
+
+	var eg errgroup.Group
+	defer eg.Wait()
+
+	// net.Pipe is unbuffered and crypto/tls doesn't work well with unbuffered
+	// connections (even though it should)
+	sc, cc, err := uds.NewSocketpair(uds.SocketTypeStream)
+	require.NoError(t, err)
+	defer sc.Close()
+	defer cc.Close()
+
+	// from the point of view of a client, the SNI dispatcher does not exist
+	eg.Go(func() error {
+		defer cc.Close()
+		tc := tls.Client(cc, &tls.Config{
+			ServerName: "bar.example.com",
+			RootCAs:    caPool,
+		})
+		if err := tc.Handshake(); err != nil {
+			return err
+		}
+		if _, err := tc.Write([]byte("a")); err != nil {
+			return err
+		}
+		if _, err := io.ReadFull(tc, make([]byte, 1)); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// a connection going through the dispatcher with the correct SNI will be
+	// dispatched and the inner TransportCredentials doesn't see it
+	var transportCredentialsCalled, dispatchFuncCalled int
+	var dispatchErr error
+	var dispatchedTranscript *bytes.Buffer
+	var dispatchedConn net.Conn
+	_, _, err = (&SNIDispatchTransportCredentials{
+		DispatchFunc: func(serverName string, transcript *bytes.Buffer, rawConn net.Conn) (dispatched bool) {
+			dispatchFuncCalled++
+			if serverName != "bar.example.com" {
+				dispatchErr = fmt.Errorf("expected bar.example.com, got SNI %+q", serverName)
+				return false
+			}
+			dispatchedTranscript = transcript
+			dispatchedConn = rawConn
+			return true
+		},
+		TransportCredentials: transportCredentialsFunc(func(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+			transportCredentialsCalled++
+			return rawConn, nil, nil
+		}),
+	}).ServerHandshake(sc)
+	require.ErrorIs(t, err, credentials.ErrConnDispatched)
+	require.NoError(t, dispatchErr)
+	require.Equal(t, 1, dispatchFuncCalled)
+	require.Equal(t, 0, transportCredentialsCalled)
+
+	// the DispatchFunc gets the actual connection object plus a transcript
+	require.Same(t, sc, dispatchedConn)
+
+	// a TLS ClientHello is in there
+	require.NotNil(t, dispatchedTranscript)
+	require.NotZero(t, dispatchedTranscript.Len())
+
+	type nestedConn struct {
+		net.Conn
+	}
+	type bypassReader struct {
+		io.Reader
+		nestedConn
+	}
+	// methods in the io.Reader will take priority over nestedConn
+	scWithTranscript := bypassReader{
+		Reader:     io.MultiReader(dispatchedTranscript, dispatchedConn),
+		nestedConn: nestedConn{dispatchedConn},
+	}
+
+	// prove that we can use the dispatched conn if it's preceded by the
+	// returned transcript
+	tc := tls.Server(scWithTranscript, &tls.Config{
+		Certificates: []tls.Certificate{caCert},
+	})
+	require.NoError(t, tc.Handshake())
+
+	_, err = tc.Write([]byte("a"))
+	require.NoError(t, err)
+	_, err = io.ReadFull(tc, make([]byte, 1))
+	require.NoError(t, err)
+
+	// the client is happy
+	require.NoError(t, eg.Wait())
+}
+
+type transportCredentialsFunc func(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error)
+
+var _ credentials.TransportCredentials = transportCredentialsFunc(nil)
+
+// ServerHandshake implements [credentials.TransportCredentials].
+func (fn transportCredentialsFunc) ServerHandshake(c net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return fn(c)
+}
+
+// ClientHandshake implements [credentials.TransportCredentials].
+func (transportCredentialsFunc) ClientHandshake(context.Context, string, net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	panic("unimplemented")
+}
+
+// Clone implements [credentials.TransportCredentials].
+func (transportCredentialsFunc) Clone() credentials.TransportCredentials {
+	panic("unimplemented")
+}
+
+// Info implements [credentials.TransportCredentials].
+func (transportCredentialsFunc) Info() credentials.ProtocolInfo {
+	panic("unimplemented")
+}
+
+// OverrideServerName implements [credentials.TransportCredentials].
+func (transportCredentialsFunc) OverrideServerName(string) error {
+	panic("unimplemented")
+}
+
+func requireExampleServerCert(t *testing.T) tls.Certificate {
+	t.Helper()
+
+	_, key, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+
+	cert := &x509.Certificate{
+		NotBefore:   time.Now().Add(-24 * time.Hour),
+		NotAfter:    time.Now().Add(24 * time.Hour),
+		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+
+		DNSNames: []string{"*.example.com"},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, cert, cert, key.Public(), key)
+	require.NoError(t, err)
+
+	cert, err = x509.ParseCertificate(der)
+	require.NoError(t, err)
+
+	return tls.Certificate{
+		Certificate: [][]byte{der},
+		PrivateKey:  key,
+		Leaf:        cert,
+	}
+}
diff --git a/lib/relaytunnel/discover.go b/lib/relaytunnel/discover.go
new file mode 100644
index 0000000000000..5cab12b6c4e7f
--- /dev/null
+++ b/lib/relaytunnel/discover.go
@@ -0,0 +1,130 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
+	relaytunnelv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha"
+)
+
+//nolint:unused // used by StaticDiscoverServiceServer
+type unimplementedDiscoveryServiceServer = relaytunnelv1alpha.UnimplementedDiscoveryServiceServer
+
+// StaticDiscoverServiceServer is a [relaytunnelv1alpha.DiscoveryServiceServer]
+// implementation that responds with fixed data to the Discover rpc.
+type StaticDiscoverServiceServer struct {
+	_ struct{} // prevent unkeyed literals
+
+	unimplementedDiscoveryServiceServer //nolint:unused // required and used by grpc-go
+
+	RelayGroup            string
+	TargetConnectionCount int32
+	SupportedTunnelTypes  []string
+}
+
+var _ relaytunnelv1alpha.DiscoveryServiceServer = (*StaticDiscoverServiceServer)(nil)
+
+// Discover implements [relaytunnelv1alpha.DiscoveryServiceServer].
+func (d *StaticDiscoverServiceServer) Discover(ctx context.Context, req *relaytunnelv1alpha.DiscoverRequest) (*relaytunnelv1alpha.DiscoverResponse, error) {
+	return &relaytunnelv1alpha.DiscoverResponse{
+		RelayGroup:            d.RelayGroup,
+		TargetConnectionCount: d.TargetConnectionCount,
+		SupportedTunnelTypes:  d.SupportedTunnelTypes,
+	}, nil
+}
+
+type DiscoverParams struct {
+	GetCertificate func() (*tls.Certificate, error)
+	GetPool        func() (*x509.CertPool, error)
+	Ciphersuites   []uint16
+
+	Target string
+}
+
+// discover returns configuration and connectivity information from a Relay and
+// its group, given an API endpoint and some cluster authentication data. As the
+// discover API is intended to only be used sporadically and with what should be
+// a fresh server behind a load balancer every time, this function establishes a
+// brand new connection and disposes of it before returning.
+func discover(ctx context.Context, params DiscoverParams) (*relaytunnelv1alpha.DiscoverResponse, error) {
+	if params.GetCertificate == nil {
+		return nil, trace.BadParameter("missing GetCertificate")
+	}
+	if params.GetPool == nil {
+		return nil, trace.BadParameter("missing GetPool")
+	}
+
+	cert, err := params.GetCertificate()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	pool, err := params.GetPool()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tlsConfig := &tls.Config{
+		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			return cert, nil
+		},
+		RootCAs: pool,
+
+		// the [credentials.NewTLS] transport credentials will take care of SNI
+		// and ALPN
+		NextProtos: nil,
+		ServerName: "",
+
+		CipherSuites: params.Ciphersuites,
+		MinVersion:   tls.VersionTLS12,
+	}
+
+	cc, err := grpc.NewClient(params.Target,
+		grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)),
+		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
+		grpc.WithChainUnaryInterceptor(
+			metadata.UnaryClientInterceptor,
+			interceptors.GRPCClientUnaryErrorInterceptor,
+		),
+		grpc.WithChainStreamInterceptor(
+			metadata.StreamClientInterceptor,
+			interceptors.GRPCClientStreamErrorInterceptor,
+		),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer cc.Close()
+
+	clt := relaytunnelv1alpha.NewDiscoveryServiceClient(cc)
+
+	resp, err := clt.Discover(ctx, &relaytunnelv1alpha.DiscoverRequest{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return resp, nil
+}
diff --git a/lib/relaytunnel/infoholder.go b/lib/relaytunnel/infoholder.go
new file mode 100644
index 0000000000000..60f7055c1087d
--- /dev/null
+++ b/lib/relaytunnel/infoholder.go
@@ -0,0 +1,56 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"slices"
+	"sync"
+)
+
+type GetRelayInfoFunc = func() (relayGroup string, relayIDs []string)
+type SetRelayInfoFunc = func(relayGroup string, relayIDs []string)
+
+// InfoHolder is a concurrency-safe holder for the data from a relay tunnel
+// client that should be advertised in server heartbeats, i.e. the relay group
+// name and the list of relay host IDs that the client is connected to.
+type InfoHolder struct {
+	mu sync.Mutex
+
+	relayGroup string
+	relayIDs   []string
+}
+
+// GetRelayInfo returns a copy of the relay client info. The relay group name
+// can be the empty string and the list of relay host IDs can be empty.
+func (r *InfoHolder) GetRelayInfo() (relayGroup string, relayIDs []string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.relayGroup, slices.Clone(r.relayIDs)
+}
+
+var _ GetRelayInfoFunc = (*InfoHolder)(nil).GetRelayInfo
+
+// SetRelayInfo stores the given relay client info in the holder, to be later
+// given out via [InfoHolder.GetRelayInfo].
+func (r *InfoHolder) SetRelayInfo(relayGroup string, relayIDs []string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.relayGroup = relayGroup
+	r.relayIDs = relayIDs
+}
+
+var _ SetRelayInfoFunc = (*InfoHolder)(nil).SetRelayInfo
diff --git a/lib/relaytunnel/tunnel_client.go b/lib/relaytunnel/tunnel_client.go
new file mode 100644
index 0000000000000..16f7679dcc1d6
--- /dev/null
+++ b/lib/relaytunnel/tunnel_client.go
@@ -0,0 +1,667 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"io"
+	"log/slog"
+	"maps"
+	"net"
+	"net/netip"
+	"os"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport/api/trail"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	relaytunnelv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha"
+	"github.com/gravitational/teleport/lib/tlsca"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// ClientConfig contains the parameters for [NewClient].
+type ClientConfig struct {
+	Log *slog.Logger
+
+	GetCertificate func() (*tls.Certificate, error)
+	GetPool        func() (*x509.CertPool, error)
+	Ciphersuites   []uint16
+
+	TunnelType types.TunnelType
+	RelayAddr  string
+
+	// HandleConnection will be called with every new connection, and should
+	// block until it's done using the connection.
+	HandleConnection func(net.Conn)
+
+	// RelayInfoSetter will be called every time the relay group name is
+	// discovered (or changes, which shouldn't happen) and whenever the list of
+	// connected relay host IDs changes. It's always called with an owned,
+	// sorted list of host IDs.
+	RelayInfoSetter SetRelayInfoFunc
+}
+
+// NewClient creates a [Client] with a given configuration.
+func NewClient(cfg ClientConfig) (*Client, error) {
+	running, cancelRunning := context.WithCancel(context.Background())
+
+	c := &Client{
+		log: cfg.Log,
+
+		getCertificate: cfg.GetCertificate,
+		getPool:        cfg.GetPool,
+		ciphersuites:   cfg.Ciphersuites,
+
+		tunnelType: cfg.TunnelType,
+		relayAddr:  cfg.RelayAddr,
+
+		handleConnection: cfg.HandleConnection,
+		relayInfoSetter:  cfg.RelayInfoSetter,
+
+		ctx:       running,
+		cancelCtx: cancelRunning,
+	}
+
+	return c, nil
+}
+
+// Client is a relay tunnel client which will periodically discover the relay
+// server configuration and keep an appropriate amount of open tunnel connection
+// to distinct, non-terminating relay servers.
+type Client struct {
+	log *slog.Logger
+
+	getCertificate func() (*tls.Certificate, error)
+	getPool        func() (*x509.CertPool, error)
+	ciphersuites   []uint16
+
+	tunnelType types.TunnelType
+	relayAddr  string
+
+	handleConnection func(net.Conn)
+	relayInfoSetter  func(relayGroup string, relayIDs []string)
+
+	// mu protects the rest of the struct. Canceling the context and adding to
+	// the wait group without guards should only happen while holding the mutex.
+	mu sync.Mutex
+
+	wg sync.WaitGroup
+
+	// ctx has to synchronize with wg, so it should be a context that cannot
+	// be closed externally.
+	ctx       context.Context
+	cancelCtx context.CancelFunc
+
+	// started is used to prevent double calls to Start, but should not be used
+	// for other synchronization since it's never reset.
+	started bool
+
+	relayGroup            string
+	targetConnectionCount int
+
+	// activeConnections is keyed by relay username (i.e. host ID dot
+	// clustername). Closing a connection should eventually delete it from the
+	// map and release all of its tasks in wg.
+	activeConnections map[string]clientConn
+}
+
+// clientConn is used to keep track of open connections to relay servers.
+type clientConn interface {
+	io.Closer
+
+	// ServerIsTerminating should return true if the relay server at the remote
+	// end of the connection has announced that it's shutting down. It should
+	// not block or perform I/O, so the intended implementation is loading an
+	// atomic boolean.
+	ServerIsTerminating() bool
+}
+
+// Start will start an unstarted client, or return an error. Starting a closed
+// unstarted client will succeed and do nothing.
+func (c *Client) Start() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.started {
+		return trace.AlreadyExists("relay tunnel client already started")
+	}
+	c.started = true
+
+	if c.ctx.Err() != nil {
+		return nil
+	}
+
+	c.wg.Add(1)
+	go func() {
+		defer c.wg.Done()
+		c.dialLoopGrouped()
+	}()
+
+	c.wg.Add(1)
+	go func() {
+		defer c.wg.Done()
+		c.discoverLoop()
+	}()
+
+	return nil
+}
+
+func (c *Client) Close() error {
+	c.mu.Lock()
+	if c.ctx.Err() != nil {
+		c.mu.Unlock()
+		return os.ErrClosed
+	}
+	c.cancelCtx()
+
+	for _, cc := range c.activeConnections {
+		// Close might block and we're not expecting so many connections that we
+		// need to limit parallelism
+		go cc.Close()
+	}
+	c.mu.Unlock()
+
+	// this will wait for all client conns to exit, as well as the discovery and
+	// dial loops
+	c.wg.Wait()
+
+	return nil
+}
+
+func (c *Client) pushRelayInfoLocked() {
+	c.relayInfoSetter(c.relayGroup, slices.Sorted(maps.Keys(c.activeConnections)))
+}
+
+func (c *Client) discoverLoop() {
+	var discoveryErrorDelay time.Duration
+	for {
+		if c.ctx.Err() != nil {
+			c.log.InfoContext(c.ctx, "Exiting from discover loop due to requested termination")
+			return
+		}
+
+		if err := c.discoverOnce(c.ctx); err != nil {
+			if c.ctx.Err() != nil {
+				continue
+			}
+
+			c.log.WarnContext(c.ctx, "Failed to discover relay", "error", err)
+			discoveryErrorDelay = min(max(5*time.Second, discoveryErrorDelay*2), retryutils.SeventhJitter(30*time.Second))
+			select {
+			case <-time.After(discoveryErrorDelay):
+			case <-c.ctx.Done():
+			}
+			continue
+		}
+
+		discoveryErrorDelay = 0
+		c.log.DebugContext(c.ctx, "Relay discovery successful, waiting")
+
+		select {
+		case <-time.After(retryutils.SeventhJitter(5 * time.Minute)):
+		case <-c.ctx.Done():
+		}
+	}
+}
+
+func (c *Client) discoverOnce(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	resp, err := discover(ctx, DiscoverParams{
+		GetCertificate: c.getCertificate,
+		GetPool:        c.getPool,
+		Ciphersuites:   c.ciphersuites,
+		Target:         c.relayAddr,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	effectiveConnectionCount := resp.GetTargetConnectionCount()
+
+	supportedTunnelTypes := resp.GetSupportedTunnelTypes()
+	if len(supportedTunnelTypes) < 1 {
+		supportedTunnelTypes = []string{string(types.NodeTunnel)}
+	}
+
+	if !slices.Contains(supportedTunnelTypes, string(c.tunnelType)) {
+		// the relay group is not advertising support for the tunnel type we
+		// want, so we just stay at a connection count of 0 to not attempt
+		// opening connections that would not work anyway; the next check will
+		// try again, so if the relay is upgraded and starts supporting our
+		// tunnel type we will begin opening connections
+		c.log.ErrorContext(ctx,
+			"The specified relay server does not currently support the required tunnel type and no tunnels will be opened, will check again later",
+			"relay_addr", c.relayAddr,
+			"tunnel_type", string(c.tunnelType),
+			"supported_tunnel_types", supportedTunnelTypes,
+		)
+		effectiveConnectionCount = 0
+	}
+
+	c.updateDiscovery(ctx, resp.GetRelayGroup(), effectiveConnectionCount)
+
+	return nil
+}
+
+func (c *Client) updateDiscovery(ctx context.Context, relayGroup string, connectionCount int32) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if relayGroup != "" {
+		if c.relayGroup != "" && c.relayGroup != relayGroup {
+			c.log.WarnContext(ctx, "Relay group has changed", "old_relay_group", c.relayGroup, "new_relay_group", relayGroup)
+		}
+		c.relayGroup = relayGroup
+	}
+	if connectionCount > 0 {
+		c.targetConnectionCount = int(connectionCount)
+	}
+
+	c.pushRelayInfoLocked()
+}
+
+// dialLoopGrouped runs the logic to open new connections. Should only be called
+// while holding a task in the [Client.wg] wait group.
+func (c *Client) dialLoopGrouped() {
+	var dialErrorDelay time.Duration
+	for {
+		if c.ctx.Err() != nil {
+			c.log.InfoContext(c.ctx, "Exiting from dial loop due to requested termination")
+			return
+		}
+
+		// TODO(espadolini): figure out a nice way to wait for "events" rather
+		// than just checking repeatedly
+		if !c.shouldDial() {
+			c.log.LogAttrs(c.ctx, logutils.TraceLevel, "Not attempting new relay tunnel connection")
+			select {
+			case <-c.ctx.Done():
+			case <-time.After(2 * time.Second):
+			}
+			continue
+		}
+
+		// this ID is only used to tie logs of the same connection together
+		log := c.log.With("connection_id", uuid.NewString())
+		if err := c.dialOnceGrouped(log); err != nil {
+			level := slog.LevelWarn
+			if trace.IsAlreadyExists(err) {
+				level = slog.LevelDebug
+			}
+
+			log.Log(c.ctx, level, "Failed to dial relay tunnel", "error", err)
+			dialErrorDelay = min(max(2*time.Second, dialErrorDelay*2), retryutils.SeventhJitter(time.Minute))
+			select {
+			case <-c.ctx.Done():
+			case <-time.After(dialErrorDelay):
+			}
+			continue
+		}
+
+		dialErrorDelay = 0
+	}
+}
+
+// dialOnceGrouped will dial the relay address and return success after the
+// connection is established and stored in [Client.activeConnections]. Should
+// only be called while holding a task in the [Client.wg] wait group, as it will
+// need to spawn more goroutines tied to the waitgroup.
+func (c *Client) dialOnceGrouped(log *slog.Logger) error {
+	log.DebugContext(c.ctx, "Attempting new relay tunnel connection")
+
+	cert, err := c.getCertificate()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	pool, err := c.getPool()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	helloCtx, cancel := context.WithTimeout(c.ctx, 30*time.Second)
+	defer cancel()
+
+	nc, err := new(net.Dialer).DialContext(helloCtx, "tcp", c.relayAddr)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	serverName, _, err := net.SplitHostPort(c.relayAddr)
+	if err != nil {
+		serverName = c.relayAddr
+	}
+
+	var serverID *tlsca.Identity
+	tlsConfig := &tls.Config{
+		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			return cert, nil
+		},
+
+		// we're likely going to connect to a self-determined IP address, and we
+		// are not really going to get any benefit from allowing any
+		// self-determined address in IP SANs at join time just so we can verify
+		// them (or, even worse, requiring some general hostname based on the
+		// hostname), so instead we disregard the normal verification (which
+		// would enforce that the address is in the server cert's SANs) and we
+		// check that the server cert is valid for the Relay role; as a bonus,
+		// we get to be good clients and pass the appropriate SNI in our TLS
+		// ClientHello
+		InsecureSkipVerify: true,
+		VerifyConnection: func(cs tls.ConnectionState) error {
+			if cs.NegotiatedProtocol == "" {
+				return trace.NotImplemented("relay tunnel protocol not supported")
+			}
+
+			opts := x509.VerifyOptions{
+				DNSName: "",
+
+				Roots:         pool,
+				Intermediates: nil,
+
+				KeyUsages: []x509.ExtKeyUsage{
+					x509.ExtKeyUsageServerAuth,
+				},
+			}
+			if len(cs.PeerCertificates) > 1 {
+				opts.Intermediates = x509.NewCertPool()
+				for _, cert := range cs.PeerCertificates[1:] {
+					opts.Intermediates.AddCert(cert)
+				}
+			}
+			if _, err := cs.PeerCertificates[0].Verify(opts); err != nil {
+				return trace.Wrap(err)
+			}
+
+			id, err := tlsca.FromSubject(cs.PeerCertificates[0].Subject, cs.PeerCertificates[0].NotAfter)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			serverID = id
+
+			// multiple system roles (as used by the Instance cert) are
+			// currently only in SystemRoles (with Groups only containing the
+			// Instance role) for the sake of backwards compatibility, but
+			// there's no drawback to checking both
+			if !slices.Contains(id.Groups, string(types.RoleRelay)) &&
+				!slices.Contains(id.SystemRoles, string(types.RoleRelay)) {
+				return trace.BadParameter("dialed server is not a relay (roles %+q, system roles %+q)", id.Groups, id.SystemRoles)
+			}
+
+			serverHostID, _, _ := strings.Cut(id.Username, ".")
+			c.mu.Lock()
+			_, alreadyConnected := c.activeConnections[serverHostID]
+			c.mu.Unlock()
+			if alreadyConnected {
+				// by aborting the handshake here we reduce the cpu load on both
+				// client and server
+				return trace.AlreadyExists("relay %+q already claimed", serverHostID)
+			}
+
+			return nil
+		},
+
+		NextProtos: []string{yamuxTunnelALPN},
+		ServerName: serverName,
+
+		CipherSuites: c.ciphersuites,
+		MinVersion:   tls.VersionTLS12,
+	}
+
+	tc := tls.Client(nc, tlsConfig)
+	if err := tc.HandshakeContext(helloCtx); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// this is a copy of the default config as returned by [yamux.DefaultConfig]
+	// at the time of writing with a slightly tighter timing for
+	// StreamOpenTimeout (because we expect the control stream open request to
+	// be handled very promptly by the server) and our logger adapter
+	yamuxConfig := &yamux.Config{
+		AcceptBacklog: 128,
+
+		EnableKeepAlive:        true,
+		KeepAliveInterval:      30 * time.Second,
+		ConnectionWriteTimeout: 10 * time.Second,
+
+		// the window size defines a maximum throughput limit per stream based
+		// on the RTT but the relay is intended for use in low latency
+		// environments (it's the whole point of it) so unless we find a reason
+		// we will just stick with the default for now; the values can differ
+		// between client and server since they take effect on the receive
+		// direction of the stream
+		MaxStreamWindowSize: 256 * 1024,
+
+		StreamCloseTimeout: 5 * time.Minute,
+		StreamOpenTimeout:  30 * time.Second,
+
+		LogOutput: nil,
+		Logger:    (*yamuxLogger)(log),
+	}
+
+	session, err := yamux.Client(tc, yamuxConfig)
+	if err != nil {
+		_ = tc.Close()
+		return err
+	}
+
+	controlStream, err := session.OpenStream()
+	if err != nil {
+		_ = session.Close()
+		return trace.Wrap(err)
+	}
+	helloDeadline, _ := helloCtx.Deadline()
+	controlStream.SetDeadline(helloDeadline)
+
+	if err := writeProto(controlStream, &relaytunnelv1alpha.ClientHello{
+		TunnelType: string(c.tunnelType),
+	}); err != nil {
+		_ = controlStream.Close()
+		_ = session.Close()
+		return trace.Wrap(err)
+	}
+
+	serverHello := new(relaytunnelv1alpha.ServerHello)
+	if err := readProto(controlStream, serverHello); err != nil {
+		_ = controlStream.Close()
+		_ = session.Close()
+		return trace.Wrap(err)
+	}
+
+	controlStream.SetDeadline(time.Time{})
+
+	if err := trail.FromGRPC(status.FromProto(serverHello.GetStatus()).Err()); err != nil {
+		_ = controlStream.Close()
+		_ = session.Close()
+		return trace.Wrap(err)
+	}
+
+	serverHostID, _, _ := strings.Cut(serverID.Username, ".")
+	log.DebugContext(c.ctx, "Successfully connected", "server_id", serverHostID)
+
+	c.updateDiscovery(helloCtx, serverHello.GetRelayGroup(), serverHello.GetTargetConnectionCount())
+
+	c.mu.Lock()
+	if _, ok := c.activeConnections[serverHostID]; ok {
+		c.mu.Unlock()
+		_ = controlStream.Close()
+		_ = session.Close()
+		return trace.AlreadyExists("relay %+q already claimed after tunnel handshake (this is a bug)", serverHostID)
+	}
+	cc := &yamuxClientConn{
+		session: session,
+	}
+	if c.activeConnections == nil {
+		c.activeConnections = make(map[string]clientConn)
+	}
+	c.activeConnections[serverHostID] = cc
+	c.pushRelayInfoLocked()
+	c.mu.Unlock()
+
+	c.wg.Add(1)
+	go func() {
+		defer c.wg.Done()
+
+		defer func() {
+			c.mu.Lock()
+			delete(c.activeConnections, serverHostID)
+			c.pushRelayInfoLocked()
+			c.mu.Unlock()
+		}()
+
+		log := c.log.With("server_id", serverHostID)
+		log.InfoContext(c.ctx, "running relay tunnel client connection")
+		defer c.log.InfoContext(c.ctx, "done with relay tunnel client connection")
+		cc.run(controlStream, c.handleConnection, log)
+	}()
+
+	return nil
+}
+
+type yamuxClientConn struct {
+	session *yamux.Session
+
+	terminating atomic.Bool
+}
+
+func (c *yamuxClientConn) run(controlStream *yamux.Stream, handleConnection func(net.Conn), log *slog.Logger) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		defer c.session.Close()
+		defer controlStream.Close()
+		for {
+			// TODO(espadolini): add a way to reuse buffers and allocated
+			// messages for the control stream messages
+			controlMsg := new(relaytunnelv1alpha.ServerControl)
+			if err := readProto(controlStream, controlMsg); err != nil {
+				return
+			}
+
+			// we only set the value, we never reset it
+			if controlMsg.GetTerminating() {
+				c.terminating.Store(true)
+			}
+
+			log.DebugContext(context.Background(), "Received control message from server", "terminating", controlMsg.GetTerminating())
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		defer c.session.Close()
+		for {
+			stream, err := c.session.AcceptStream()
+			if err != nil {
+				return
+			}
+
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				log.DebugContext(context.Background(), "Serving tunneled connection", "stream_id", stream.StreamID())
+				defer log.DebugContext(context.Background(), "Done serving tunneled connection", "stream_id", stream.StreamID())
+				c.handleStream(stream, handleConnection)
+			}()
+		}
+	}()
+	wg.Wait()
+}
+
+func (c *yamuxClientConn) handleStream(stream *yamux.Stream, handleConnection func(net.Conn)) {
+	defer stream.Close()
+
+	dialReq := new(relaytunnelv1alpha.DialRequest)
+	if err := readProto(stream, dialReq); err != nil {
+		return
+	}
+	src := addrFromProto(dialReq.Source)
+	dst := addrFromProto(dialReq.Destination)
+	if src == nil || dst == nil {
+		err := trace.BadParameter("missing source or destination address")
+		_ = writeProto(stream, &relaytunnelv1alpha.DialResponse{
+			Status: status.Convert(trail.ToGRPC(err)).Proto(),
+		})
+		return
+	}
+
+	if err := writeProto(stream, &relaytunnelv1alpha.DialResponse{
+		Status: nil, // i.e. status.Convert(error(nil)).Proto()
+	}); err != nil {
+		return
+	}
+
+	// this is needed because a few places (including x/crypto/ssh of all
+	// things, which was then followed by the connection resumption handler)
+	// expect TCP addresses to be [*net.TCPAddr]s and will type assert on that
+	// rather than dealing in generic [net.Addr]s
+	if src.Network() == "tcp" {
+		ap, err := netip.ParseAddrPort(src.String())
+		if err == nil {
+			ap = netip.AddrPortFrom(ap.Addr().Unmap(), ap.Port())
+			src = net.TCPAddrFromAddrPort(ap)
+		}
+	}
+
+	nc := &yamuxStreamConn{
+		Stream: stream,
+
+		// on this side of the connection we are the destination and the peer is
+		// the source, the tunnel server will do the opposite
+		localAddr:  dst,
+		remoteAddr: src,
+	}
+	handleConnection(nc)
+}
+
+// Close implements [clientConn].
+func (c *yamuxClientConn) Close() error {
+	return c.session.Close()
+}
+
+// ServerIsTerminating implements [clientConn].
+func (c *yamuxClientConn) ServerIsTerminating() bool {
+	return c.terminating.Load()
+}
+
+func (c *Client) shouldDial() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	var thrivingConnections int
+	for _, cc := range c.activeConnections {
+		if !cc.ServerIsTerminating() {
+			thrivingConnections++
+		}
+	}
+
+	return thrivingConnections < c.targetConnectionCount
+}
diff --git a/lib/relaytunnel/tunnel_common.go b/lib/relaytunnel/tunnel_common.go
new file mode 100644
index 0000000000000..7a739410ed8e5
--- /dev/null
+++ b/lib/relaytunnel/tunnel_common.go
@@ -0,0 +1,226 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/protobuf/proto"
+
+	relaytunnelv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// yamuxTunnelALPN is the ALPN protocol name for the bespoke protocol used by
+// tunnel connections. Future variants of the protocol should use a different
+// ALPN protocol name.
+const yamuxTunnelALPN = "teleport-relaytunnel"
+
+// The teleport-relaytunnel protocol consists of a "control" yamux stream that's
+// opened by the client at the beginning of the session and stays open
+// throughout its lifetime, and some "dialing" streams opened by the server
+// afterwards.
+//
+// In the control stream the client sends a ClientHello message, the server
+// responds with a ServerHello message which contains a google.rpc.Status, and
+// if the status is ok, the stream continues with ClientControl messages sent by
+// the client and ServerControl messages sent by the server.
+//
+// In dialing streams the server sends a DialRequest message, the client
+// responds with a DialResponse message containing a google.rpc.Status, and in
+// case of success the data of the connection immediately follows on both ends.
+//
+// Messages are sent in their protobuf wire format, prefixed by a little endian
+// 32 bit size. Messages must be smaller than maxMessageSize (128KiB).
+
+const maxMessageSize = 128 * 1024
+
+func readProto(r io.Reader, m proto.Message) error {
+	var sizeBuf [4]byte
+	if _, err := io.ReadFull(r, sizeBuf[:]); err != nil {
+		return trace.Wrap(err)
+	}
+	size := binary.LittleEndian.Uint32(sizeBuf[:])
+	if size > maxMessageSize {
+		return trace.LimitExceeded("bad size")
+	}
+
+	msgBuf := make([]byte, size)
+	if _, err := io.ReadFull(r, msgBuf); err != nil {
+		if errors.Is(err, io.EOF) {
+			return trace.Wrap(io.ErrUnexpectedEOF)
+		}
+		return trace.Wrap(err)
+	}
+
+	if err := proto.Unmarshal(msgBuf, m); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func writeProto(w io.Writer, m proto.Message) error {
+	msgBuf, err := proto.Marshal(m)
+	if err != nil {
+		return err
+	}
+	if len(msgBuf) > maxMessageSize {
+		return trace.LimitExceeded("bad size")
+	}
+	var sizeBuf [4]byte
+	binary.LittleEndian.PutUint32(sizeBuf[:], uint32(len(msgBuf)))
+	if _, err := w.Write(sizeBuf[:]); err != nil {
+		return trace.Wrap(err)
+	}
+	if _, err := w.Write(msgBuf); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func addrToProto(a net.Addr) *relaytunnelv1alpha.Addr {
+	if a == nil {
+		return nil
+	}
+
+	return &relaytunnelv1alpha.Addr{
+		Network: a.Network(),
+		Addr:    a.String(),
+	}
+}
+
+func addrFromProto(a *relaytunnelv1alpha.Addr) net.Addr {
+	if a == nil {
+		return nil
+	}
+
+	return &utils.NetAddr{
+		AddrNetwork: a.GetNetwork(),
+		Addr:        a.GetAddr(),
+	}
+}
+
+type yamuxLogger slog.Logger
+
+var _ yamux.Logger = (*yamuxLogger)(nil)
+
+// Printf implements [yamux.Logger].
+func (l *yamuxLogger) Printf(format string, args ...any) {
+	if f, ok := strings.CutPrefix(format, "[ERR] "); ok {
+		//nolint:sloglint // we're adapting a fmt.Printf-like interface
+		(*slog.Logger)(l).ErrorContext(context.Background(), fmt.Sprintf(f, args...))
+	} else if f, ok := strings.CutPrefix(format, "[WARN] "); ok {
+		//nolint:sloglint // we're adapting a fmt.Printf-like interface
+		(*slog.Logger)(l).WarnContext(context.Background(), fmt.Sprintf(f, args...))
+	} else {
+		//nolint:sloglint // we're adapting a fmt.Printf-like interface
+		(*slog.Logger)(l).ErrorContext(context.Background(), fmt.Sprintf(format, args...))
+	}
+}
+
+// Print implements [yamux.Logger].
+func (l *yamuxLogger) Print(args ...any) {
+	// the Print method doesn't seem to be used by yamux, it's only implemented
+	// here for completeness' sake
+
+	//nolint:sloglint // we're adapting a fmt.Print-like interface
+	(*slog.Logger)(l).ErrorContext(context.Background(), fmt.Sprint(args...))
+}
+
+// Println implements [yamux.Logger].
+func (l *yamuxLogger) Println(args ...any) {
+	// the Println method doesn't seem to be used by yamux, it's only
+	// implemented here for completeness' sake, and the concept of adding a
+	// newline at the end of a log message is so weird that we will just avoid
+	// doing that and just redirect to Print instead
+
+	l.Print(args...)
+}
+
+// yamuxStreamConn is a [net.Conn] that wraps a [*yamux.Stream] to have
+// different local and remote addresses and to return the correct error from
+// Read and Write upon hitting a deadline (which is required for a
+// net/http.Server to correctly handle websockets when using a TLS connection,
+// which will instead result in a killed connection when the TLS layer hits a
+// [yamux.ErrTimeout] from Read, see
+// https://github.com/hashicorp/yamux/issues/156).
+//
+// The implementation of *yamux.Stream and thus of this type (as well as most
+// other net.Conn implementations in the codebase, like *multiplexer.Conn) are
+// not actually fulfilling the (absolutely inane) net.Conn requirement that
+// every method must be safe to call concurrently in any combination;
+// specifically, there must not be multiple concurrent calls to Read or multiple
+// concurrent calls to Write; this is already a requirement for the behavior of
+// TCP-like net.Conns to make any sense, and does not cause issues when using
+// this as the underlying connection for TLS or SSH.
+type yamuxStreamConn struct {
+	*yamux.Stream
+	localAddr  net.Addr
+	remoteAddr net.Addr
+}
+
+// Read implements [net.Conn].
+func (c *yamuxStreamConn) Read(b []byte) (int, error) {
+	n, err := c.Stream.Read(b)
+	//nolint:errorlint // this workaround is specifically to work around bad
+	//practices around net.Conn and exact error values
+	if err == yamux.ErrTimeout {
+		// yamux.ErrTimeout.Temporary() returns false, which makes [*tls.Conn]
+		// kill the connection; the correct error to return from Read or Write
+		// in case of a deadline is os.ErrDeadlineExceeded, and seeing as most
+		// things in the stdlib check for methods implemented directly by
+		// errors, we must return it as is without any wrapping
+		err = os.ErrDeadlineExceeded
+	}
+	return n, err
+}
+
+// Write implements [net.Conn].
+func (c *yamuxStreamConn) Write(b []byte) (int, error) {
+	n, err := c.Stream.Write(b)
+	//nolint:errorlint // this workaround is specifically to work around bad
+	//practices around net.Conn and exact error values
+	if err == yamux.ErrTimeout {
+		// yamux.ErrTimeout.Temporary() returns false, which makes [*tls.Conn]
+		// kill the connection; the correct error to return from Read or Write
+		// in case of a deadline is os.ErrDeadlineExceeded, and seeing as most
+		// things in the stdlib check for methods implemented directly by
+		// errors, we must return it as is without any wrapping
+		err = os.ErrDeadlineExceeded
+	}
+	return n, err
+}
+
+// LocalAddr implements [net.Conn].
+func (c *yamuxStreamConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+// RemoteAddr implements [net.Conn].
+func (c *yamuxStreamConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
diff --git a/lib/relaytunnel/tunnel_common_test.go b/lib/relaytunnel/tunnel_common_test.go
new file mode 100644
index 0000000000000..90ad233b54d03
--- /dev/null
+++ b/lib/relaytunnel/tunnel_common_test.go
@@ -0,0 +1,64 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"io"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/yamux"
+	"github.com/stretchr/testify/require"
+)
+
+func TestYamuxStreamConnDeadline(t *testing.T) {
+	t.Parallel()
+
+	conn1, conn2 := net.Pipe()
+
+	cfg := yamux.DefaultConfig()
+	cfg.LogOutput = io.Discard
+
+	sess1, err := yamux.Client(conn1, cfg)
+	require.NoError(t, err)
+	defer sess1.Close()
+
+	sess2, err := yamux.Server(conn2, cfg)
+	require.NoError(t, err)
+	defer sess2.Close()
+
+	stream, err := sess1.OpenStream()
+	require.NoError(t, err)
+	defer stream.Close()
+
+	streamConn := &yamuxStreamConn{Stream: stream}
+	require.NoError(t, streamConn.SetDeadline(time.Unix(1, 0)))
+
+	n, err := streamConn.Read(make([]byte, 1))
+	require.Zero(t, n)
+
+	//nolint:errorlint // because of bad practices around net.Conn in the
+	// ecosystem, we want the exact error value to be returned rather than a
+	// wrapper; require.Equal checks for deep equality, require.Same relies on
+	// the implementation detail of os.ErrDeadlineExceeded being a pointer, so
+	// we spell out the actual equality instead
+	if err != os.ErrDeadlineExceeded {
+		require.FailNow(t, "expected os.ErrDeadlineExceeded, got %v", err)
+	}
+}
diff --git a/lib/relaytunnel/tunnel_server.go b/lib/relaytunnel/tunnel_server.go
new file mode 100644
index 0000000000000..27b5b65dfdc39
--- /dev/null
+++ b/lib/relaytunnel/tunnel_server.go
@@ -0,0 +1,559 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package relaytunnel
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport/api/trail"
+	"github.com/gravitational/teleport/api/types"
+	relaytunnelv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// ServerConfig contains the parameters for [NewServer].
+type ServerConfig struct {
+	Log *slog.Logger
+
+	GetCertificate func(ctx context.Context) (*tls.Certificate, error)
+	GetPool        func(ctx context.Context) (*x509.CertPool, error)
+	Ciphersuites   []uint16
+
+	RelayGroup            string
+	TargetConnectionCount int32
+}
+
+// NewServer creates a [Server] with a given configuration.
+func NewServer(cfg ServerConfig) (*Server, error) {
+	if cfg.Log == nil {
+		return nil, trace.BadParameter("missing Log")
+	}
+	if cfg.GetCertificate == nil {
+		return nil, trace.BadParameter("missing GetCertificate")
+	}
+	if cfg.GetPool == nil {
+		return nil, trace.BadParameter("missing GetPool")
+	}
+
+	ctx, ctxCancel := context.WithCancel(context.Background())
+
+	return &Server{
+		log: cfg.Log,
+
+		getCertificate: cfg.GetCertificate,
+		getPool:        cfg.GetPool,
+		ciphersuites:   cfg.Ciphersuites,
+
+		relayGroup:            cfg.RelayGroup,
+		targetConnectionCount: cfg.TargetConnectionCount,
+
+		ctx:       ctx,
+		ctxCancel: ctxCancel,
+	}, nil
+}
+
+// Server is a relay tunnel server
+type Server struct {
+	log *slog.Logger
+
+	getCertificate func(ctx context.Context) (*tls.Certificate, error)
+	getPool        func(ctx context.Context) (*x509.CertPool, error)
+	ciphersuites   []uint16
+
+	relayGroup            string
+	targetConnectionCount int32
+
+	mu sync.Mutex
+
+	// ctx has to synchronize with wg, so it should be a context that cannot be
+	// closed externally.
+	ctx       context.Context
+	ctxCancel context.CancelFunc
+
+	wg sync.WaitGroup
+
+	// conns holds client connections per host ID and tunnel type. The
+	// connection received the latest is always the one that will be used for
+	// dialing, so order matters.
+	conns map[connKey][]serverConn
+}
+
+// GRPCServerCredentials returns some gRPC [credentials.TransportCredentials]
+// that will pass connections with a negotiated protocol of "h2" to the gRPC
+// server, while dispatching tunnel connections to the [Server].
+func (s *Server) GRPCServerCredentials() credentials.TransportCredentials {
+	return &grpcServerCredentials{
+		tunnelServer: s,
+
+		getCertificate: s.getCertificate,
+		getPool:        s.getPool,
+		ciphersuites:   s.ciphersuites,
+	}
+}
+
+type grpcServerCredentials struct {
+	tunnelServer *Server
+
+	getCertificate func(ctx context.Context) (*tls.Certificate, error)
+	getPool        func(ctx context.Context) (*x509.CertPool, error)
+	ciphersuites   []uint16
+}
+
+// ClientHandshake implements [credentials.TransportCredentials].
+func (*grpcServerCredentials) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	_ = rawConn.Close()
+	return nil, nil, trace.NotImplemented("these transport credentials can only be used as a server")
+}
+
+// OverrideServerName implements [credentials.TransportCredentials].
+func (*grpcServerCredentials) OverrideServerName(string) error {
+	return nil
+}
+
+// Clone implements [credentials.TransportCredentials].
+func (s *grpcServerCredentials) Clone() credentials.TransportCredentials {
+	// s is immutable so there's no need to copy anything
+	return s
+}
+
+// Info implements [credentials.TransportCredentials].
+func (s *grpcServerCredentials) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{
+		SecurityProtocol: "tls",
+		SecurityVersion:  "1.2",
+	}
+}
+
+// ServerHandshake implements [credentials.TransportCredentials].
+func (s *grpcServerCredentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	cert, err := s.getCertificate(ctx)
+	if err != nil {
+		_ = rawConn.Close()
+		return nil, nil, trace.Wrap(err)
+	}
+	pool, err := s.getPool(ctx)
+	if err != nil {
+		_ = rawConn.Close()
+		return nil, nil, trace.Wrap(err)
+	}
+
+	var clientID *tlsca.Identity
+	tlsConfig := &tls.Config{
+		GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+			return cert, nil
+		},
+		VerifyConnection: func(cs tls.ConnectionState) error {
+			if cs.NegotiatedProtocol == "" {
+				// client tried to connect with no ALPN (or with http/1.1 in its
+				// protocol list because of an undocumented behavior of the
+				// crypto/tls server handshake)
+				return trace.NotImplemented("missing ALPN in TLS ClientHello")
+			}
+			if len(cs.VerifiedChains) < 1 {
+				return trace.AccessDenied("missing or invalid client certificate")
+			}
+
+			if cs.NegotiatedProtocol == "h2" {
+				return nil
+			}
+
+			id, err := tlsca.FromSubject(cs.VerifiedChains[0][0].Subject, cs.VerifiedChains[0][0].NotAfter)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			clientID = id
+
+			return nil
+		},
+		NextProtos: []string{yamuxTunnelALPN, "h2"},
+
+		ClientAuth: tls.RequireAndVerifyClientCert,
+		ClientCAs:  pool,
+
+		InsecureSkipVerify: false,
+
+		MinVersion:             tls.VersionTLS12,
+		CipherSuites:           s.ciphersuites,
+		SessionTicketsDisabled: true,
+	}
+
+	tlsConn := tls.Server(rawConn, tlsConfig)
+	if err := tlsConn.Handshake(); err != nil {
+		_ = tlsConn.Close()
+		return nil, nil, trace.Wrap(err)
+	}
+
+	cs := tlsConn.ConnectionState()
+	if cs.NegotiatedProtocol == yamuxTunnelALPN {
+		go s.tunnelServer.handleYamuxTunnel(tlsConn, clientID)
+		return nil, nil, credentials.ErrConnDispatched
+	}
+	tlsInfo := credentials.TLSInfo{
+		State: cs,
+		CommonAuthInfo: credentials.CommonAuthInfo{
+			SecurityLevel: credentials.PrivacyAndIntegrity,
+		},
+	}
+
+	return tlsConn, tlsInfo, nil
+}
+
+func (s *Server) SetTerminating() {
+	// we have to acquire the lock while canceling the context because we
+	// shouldn't be adding to the connection map if we're terminating
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.setTerminatingLocked()
+}
+
+func (s *Server) setTerminatingLocked() {
+	s.ctxCancel()
+}
+
+// Shutdown will mark the server as terminating and then wait until either all
+// connections are gone or until the context expires (at which point all
+// connections are terminated).
+func (s *Server) Shutdown(ctx context.Context) {
+	s.SetTerminating()
+
+	defer context.AfterFunc(ctx, func() { _ = s.Close() })()
+
+	// we can wait after ensuring that the server is terminating, because we
+	// only Add if the server is not terminating
+	s.wg.Wait()
+}
+
+func (s *Server) Close() error {
+	s.mu.Lock()
+	s.setTerminatingLocked()
+	// we might have a lot of connections, so we take away the map and close
+	// them serially while the lock is not held
+	conns := s.conns
+	s.conns = nil
+	s.mu.Unlock()
+
+	for _, connSlice := range conns {
+		for _, conn := range connSlice {
+			_ = conn.Close()
+		}
+	}
+
+	// we can wait after ensuring that the server is terminating, because we
+	// only Add if the server is not terminating
+	s.wg.Wait()
+	return nil
+}
+
+func (s *Server) handleYamuxTunnel(c io.ReadWriteCloser, clientID *tlsca.Identity) error {
+	// this is a copy of the default config as returned by [yamux.DefaultConfig]
+	// at the time of writing with a slightly tighter timing for
+	// StreamOpenTimeout (because we expect the dialing stream open requests to
+	// be handled very promptly by the client) and our logger adapter
+	cfg := &yamux.Config{
+		AcceptBacklog: 128,
+
+		EnableKeepAlive:        true,
+		KeepAliveInterval:      30 * time.Second,
+		ConnectionWriteTimeout: 10 * time.Second,
+
+		// the window size defines a maximum throughput limit per stream based
+		// on the RTT but the relay is intended for use in low latency
+		// environments (it's the whole point of it) so unless we find a reason
+		// we will just stick with the default for now; the values can differ
+		// between client and server since they take effect on the receive
+		// direction of the stream
+		MaxStreamWindowSize: 256 * 1024,
+
+		StreamCloseTimeout: 5 * time.Minute,
+		StreamOpenTimeout:  30 * time.Second,
+
+		LogOutput: nil,
+		Logger:    (*yamuxLogger)(s.log),
+	}
+
+	session, err := yamux.Server(c, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer session.Close()
+
+	const helloTimeout = 30 * time.Second
+	helloDeadline := time.Now().Add(helloTimeout)
+	helloCtx, cancel := context.WithDeadline(context.Background(), helloDeadline)
+	defer cancel()
+
+	controlStream, err := session.AcceptStreamWithContext(helloCtx)
+	if err != nil {
+		return err
+	}
+	defer controlStream.Close()
+
+	controlStream.SetDeadline(helloDeadline)
+
+	clientHello := new(relaytunnelv1alpha.ClientHello)
+	if err := readProto(controlStream, clientHello); err != nil {
+		return trace.Wrap(err)
+	}
+
+	tunnelType := types.TunnelType(clientHello.GetTunnelType())
+	helloErr := func() error {
+		var requiredRole types.SystemRole
+		switch tunnelType {
+		case types.NodeTunnel:
+			requiredRole = types.RoleNode
+		case types.KubeTunnel:
+			requiredRole = types.RoleKube
+		default:
+			return trace.BadParameter("unsupported tunnel type %q", tunnelType)
+		}
+		if !slices.Contains(clientID.Groups, string(requiredRole)) && !slices.Contains(clientID.SystemRoles, string(requiredRole)) {
+			return trace.AccessDenied("required role %q not in client identity", requiredRole)
+		}
+		return nil
+	}()
+	if helloErr != nil {
+		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+			Status: status.Convert(trail.ToGRPC(helloErr)).Proto(),
+		})
+		return trace.Wrap(helloErr)
+	}
+
+	sc := &yamuxServerConn{
+		session: session,
+	}
+	if !s.addConn(clientID.Username, tunnelType, sc) {
+		// this can happen if a connection gets routed to our listener after we
+		// have advertised termination but before the load balancer has stopped
+		// sending connections our way
+		err := &trace.ConnectionProblemError{Message: "server is shutting down"}
+		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+			Status: status.Convert(trail.ToGRPC(err)).Proto(),
+		})
+		return trace.Wrap(err)
+	}
+	s.log.InfoContext(context.Background(), "new client connected", "client_id", clientID.Username, "tunnel_type", tunnelType)
+	defer s.log.InfoContext(context.Background(), "client disconnected", "client_id", clientID.Username, "tunnel_type", tunnelType)
+	defer s.removeConn(clientID.Username, tunnelType, sc)
+
+	controlStream.SetDeadline(time.Time{})
+
+	if err := writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+		Status: nil, // i.e. status.Convert(error(nil)).Proto()
+
+		RelayGroup:            s.relayGroup,
+		TargetConnectionCount: s.targetConnectionCount,
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	go func() {
+		// we unblock if the session gets closed rather than the control
+		// stream but currently they have the same lifetime and the session
+		// has a convenient channel to wait on
+		select {
+		case <-session.CloseChan():
+		case <-s.ctx.Done():
+		}
+
+		// currently the only message we have to send and we only send it once
+		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerControl{
+			Terminating: true,
+		})
+	}()
+
+	for {
+		// TODO(espadolini): add a way to reuse buffers and allocated messages
+		// for the control stream messages
+		controlMsg := new(relaytunnelv1alpha.ClientControl)
+		if err := readProto(controlStream, controlMsg); err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+func (s *Server) Dial(ctx context.Context, hostID string, tunnelType types.TunnelType, src, dst net.Addr) (net.Conn, error) {
+	var sc serverConn
+	s.mu.Lock()
+	scs := s.conns[connKey{
+		hostID:     hostID,
+		tunnelType: tunnelType,
+	}]
+	if len(scs) > 0 {
+		// new tunnels are appended to the store so by always taking the last we
+		// are prioritizing the last tunnel that connected to us, following the
+		// same logic as reversetunnel.localCluster.getRemoteConn
+		//
+		// TODO(espadolini): think about passing a nonce and a generation
+		// counter that gets bumped whenever we reload Teleport so newer
+		// executions of the same instance are guaranteed to be connected last;
+		// this applies to the reverse tunnel too
+		sc = scs[len(scs)-1]
+	}
+	s.mu.Unlock()
+
+	if sc == nil {
+		return nil, trace.NotFound("dial target not found among connected tunnels")
+	}
+
+	rwc, err := sc.dial(ctx, src, dst)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return rwc, nil
+}
+
+type connKey struct {
+	hostID     string
+	tunnelType types.TunnelType
+}
+
+func (s *Server) addConn(hostID string, tunnelType types.TunnelType, conn serverConn) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.ctx.Err() != nil {
+		return false
+	}
+
+	s.wg.Add(1)
+
+	if s.conns == nil {
+		s.conns = make(map[connKey][]serverConn)
+	}
+
+	ck := connKey{
+		hostID:     hostID,
+		tunnelType: tunnelType,
+	}
+	s.conns[ck] = append(s.conns[ck], conn)
+	return true
+}
+
+func (s *Server) removeConn(hostID string, tunnelType types.TunnelType, conn serverConn) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.wg.Done()
+
+	ck := connKey{
+		hostID:     hostID,
+		tunnelType: tunnelType,
+	}
+	conns := s.conns[ck]
+	idx := slices.Index(conns, conn)
+	if idx < 0 {
+		return
+	}
+	s.conns[ck] = slices.Delete(conns, idx, idx+1)
+}
+
+type serverConn interface {
+	io.Closer
+
+	dial(ctx context.Context, src, dst net.Addr) (net.Conn, error)
+}
+
+type yamuxServerConn struct {
+	session *yamux.Session
+}
+
+// Close implements [serverConn].
+func (c *yamuxServerConn) Close() error {
+	return trace.Wrap(c.session.Close())
+}
+
+var _ serverConn = (*yamuxServerConn)(nil)
+
+// dial implements [serverConn].
+func (c *yamuxServerConn) dial(ctx context.Context, src net.Addr, dst net.Addr) (net.Conn, error) {
+	stream, err := c.session.OpenStream()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// non-destructively stop the dial request-response when the dial context is
+	// canceled
+	explode := make(chan struct{})
+	defuse := context.AfterFunc(ctx, func() {
+		defer close(explode)
+		stream.SetDeadline(time.Unix(1, 0))
+	})
+	defer defuse()
+
+	req := &relaytunnelv1alpha.DialRequest{
+		Source:      addrToProto(src),
+		Destination: addrToProto(dst),
+	}
+	if err := writeProto(stream, req); err != nil {
+		defuse()
+		_ = stream.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	resp := new(relaytunnelv1alpha.DialResponse)
+	if err := readProto(stream, resp); err != nil {
+		defuse()
+		_ = stream.Close()
+		return nil, trace.Wrap(err)
+	}
+
+	if defuse() {
+		close(explode)
+	}
+
+	if err := status.FromProto(resp.GetStatus()).Err(); err != nil {
+		_ = stream.Close()
+		return nil, trail.FromGRPC(err)
+	}
+
+	<-explode
+	stream.SetDeadline(time.Time{})
+
+	nc := &yamuxStreamConn{
+		Stream: stream,
+
+		// on this side of the connection we are the source and the peer is the
+		// destination, the tunnel client will do the opposite
+		localAddr:  src,
+		remoteAddr: dst,
+	}
+
+	return nc, nil
+}
diff --git a/lib/reversetunnel/agent_dialer.go b/lib/reversetunnel/agent_dialer.go
index 01f79397c3dff..66fc94d38c5c8 100644
--- a/lib/reversetunnel/agent_dialer.go
+++ b/lib/reversetunnel/agent_dialer.go
@@ -94,7 +94,7 @@ func (d *agentDialer) DialContext(ctx context.Context, addr utils.NetAddr) (SSHC
 
 	// Build a new client connection. This is done to get access to incoming
 	// global requests which dialer.Dial would not provide.
-	conn, chans, reqs, err := tracessh.NewClientConn(ctx, pconn, addr.Addr, &ssh.ClientConfig{
+	conn, chans, reqs, err := tracessh.NewClientConnWithTimeout(ctx, pconn, addr.Addr, &ssh.ClientConfig{
 		User:            d.username,
 		Auth:            d.authMethods,
 		HostKeyCallback: callback,
diff --git a/lib/reversetunnel/agent_dialer_test.go b/lib/reversetunnel/agent_dialer_test.go
index ec912a51fa690..93154b95f122e 100644
--- a/lib/reversetunnel/agent_dialer_test.go
+++ b/lib/reversetunnel/agent_dialer_test.go
@@ -32,6 +32,7 @@ import (
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestAgentCertChecker validates that reverse tunnel agents properly validate
@@ -89,7 +90,7 @@ func TestAgentCertChecker(t *testing.T) {
 			dialer := agentDialer{
 				client:      &fakeClient{caKey: ca.PublicKey()},
 				authMethods: []ssh.AuthMethod{ssh.PublicKeys(signer)},
-				logger:      utils.NewSlogLoggerForTests(),
+				logger:      logtest.NewLogger(),
 			}
 
 			_, err = dialer.DialContext(context.Background(), *utils.MustParseAddr(sshServer.Addr()))
diff --git a/lib/reversetunnel/agentpool.go b/lib/reversetunnel/agentpool.go
index 2170b65403bf9..39c1aa26aeb57 100644
--- a/lib/reversetunnel/agentpool.go
+++ b/lib/reversetunnel/agentpool.go
@@ -271,13 +271,17 @@ func (p *AgentPool) run() error {
 		if err != nil {
 			if p.ctx.Err() != nil {
 				return nil
-			} else if isProxyAlreadyClaimed(err) {
+			}
+
+			level := slog.LevelWarn
+			if isProxyAlreadyClaimed(err) && !p.IsRemoteCluster {
 				// "proxy already claimed" is a fairly benign error, we should not
 				// spam the log with stack traces for it
-				p.logger.DebugContext(p.ctx, "Failed to connect agent", "error", err)
-			} else {
-				p.logger.DebugContext(p.ctx, "Failed to connect agent", "error", err)
+				level = slog.LevelDebug
+				err = trace.Unwrap(err)
 			}
+
+			p.logger.Log(p.ctx, level, "Failed to establish reverse tunnel", "error", err)
 		} else {
 			p.wg.Add(1)
 			p.active.add(agent)
@@ -456,7 +460,7 @@ func (p *AgentPool) newAgent(ctx context.Context, tracker *track.Tracker, lease
 	}
 
 	dialer := &agentDialer{
-		client:      p.Client,
+		client:      p.AccessPoint,
 		fips:        p.FIPS,
 		authMethods: p.AuthMethods,
 		options:     options,
diff --git a/lib/reversetunnel/localsite.go b/lib/reversetunnel/localsite.go
index 9a4f3c77dc00d..c4aa5c67c3b34 100644
--- a/lib/reversetunnel/localsite.go
+++ b/lib/reversetunnel/localsite.go
@@ -47,7 +47,7 @@ import (
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/srv/forward"
 	"github.com/gravitational/teleport/lib/srv/git"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 	proxyutils "github.com/gravitational/teleport/lib/utils/proxy"
@@ -237,23 +237,31 @@ func (s *localSite) DialAuthServer(params reversetunnelclient.DialParams) (net.C
 // shouldDialAndForward returns whether a connection should be proxied
 // and forwarded or not.
 func shouldDialAndForward(params reversetunnelclient.DialParams, recConfig types.SessionRecordingConfig) bool {
+	// only proxy and forward ssh connections
+	if params.ConnType != types.NodeTunnel {
+		return false
+	}
 	// connection is already being tunneled, do not forward
 	if params.FromPeerProxy {
 		return false
 	}
 	// the node is an agentless node, the connection must be forwarded
-	if params.TargetServer != nil && params.TargetServer.IsOpenSSHNode() {
+	if params.TargetServer.IsOpenSSHNode() {
 		return true
 	}
 	// proxy session recording mode is being used and an SSH session
 	// is being requested, the connection must be forwarded
-	if params.ConnType == types.NodeTunnel && services.IsRecordAtProxy(recConfig.GetMode()) {
+	if services.IsRecordAtProxy(recConfig.GetMode()) {
 		return true
 	}
 	return false
 }
 
 func (s *localSite) Dial(params reversetunnelclient.DialParams) (net.Conn, error) {
+	if params.TargetServer == nil && params.ConnType == types.NodeTunnel {
+		return nil, trace.BadParameter("target server is required for teleport nodes")
+	}
+
 	if params.TargetServer != nil && params.TargetServer.GetKind() == types.KindGitServer {
 		return s.dialAndForwardGit(params)
 	}
@@ -282,7 +290,8 @@ func shouldSendSignedPROXYHeader(signer multiplexer.PROXYHeaderSigner, useTunnel
 }
 
 func (s *localSite) maybeSendSignedPROXYHeader(params reversetunnelclient.DialParams, conn net.Conn, useTunnel bool) error {
-	if !shouldSendSignedPROXYHeader(s.srv.proxySigner, useTunnel, params.IsAgentlessNode, params.From, params.OriginalClientDstAddr) {
+	isAgentless := params.TargetServer != nil && params.TargetServer.IsOpenSSHNode()
+	if !shouldSendSignedPROXYHeader(s.srv.proxySigner, useTunnel, isAgentless, params.From, params.OriginalClientDstAddr) {
 		return nil
 	}
 
@@ -404,8 +413,8 @@ func (s *localSite) dialAndForwardGit(params reversetunnelclient.DialParams) (_
 func (s *localSite) dialAndForward(params reversetunnelclient.DialParams) (_ net.Conn, retErr error) {
 	ctx := s.srv.ctx
 
-	if params.GetUserAgent == nil && !params.IsAgentlessNode {
-		return nil, trace.BadParameter("agentless node require an agent getter")
+	if params.GetUserAgent == nil && !params.TargetServer.IsOpenSSHNode() {
+		return nil, trace.BadParameter("user agent getter is required for teleport nodes (this is a bug)")
 	}
 	s.logger.DebugContext(ctx, "Initiating dial and forwarding request",
 		"source_addr", logutils.StringerAttr(params.From),
@@ -413,7 +422,7 @@ func (s *localSite) dialAndForward(params reversetunnelclient.DialParams) (_ net
 	)
 
 	// request user agent connection if a SSH user agent is set
-	var userAgent teleagent.Agent
+	var userAgent sshagent.Client
 	if params.GetUserAgent != nil {
 		ua, err := params.GetUserAgent()
 		if err != nil {
@@ -451,7 +460,6 @@ func (s *localSite) dialAndForward(params reversetunnelclient.DialParams) (_ net
 		LocalAuthClient:          s.client,
 		TargetClusterAccessPoint: s.accessPoint,
 		UserAgent:                userAgent,
-		IsAgentlessNode:          params.IsAgentlessNode,
 		AgentlessSigner:          params.AgentlessSigner,
 		TargetConn:               targetConn,
 		SrcAddr:                  params.From,
@@ -463,20 +471,14 @@ func (s *localSite) dialAndForward(params reversetunnelclient.DialParams) (_ net
 		DataDir:                  s.srv.Config.DataDir,
 		Address:                  params.Address,
 		UseTunnel:                useTunnel,
-		HostUUID:                 s.srv.ID,
+		ProxyUUID:                s.srv.ID,
 		Emitter:                  s.srv.Config.Emitter,
 		ParentContext:            s.srv.Context,
 		LockWatcher:              s.srv.LockWatcher,
-		TargetID:                 params.ServerID,
-		TargetAddr:               params.To.String(),
-		TargetHostname:           params.Address,
 		TargetServer:             params.TargetServer,
 		Clock:                    s.clock,
 	}
-	// Ensure the hostname is set correctly if we have details of the target
-	if params.TargetServer != nil {
-		serverConfig.TargetHostname = params.TargetServer.GetHostname()
-	}
+
 	remoteServer, err := forward.New(serverConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -576,6 +578,15 @@ This usually means that the agent is offline or has disconnected. Check the
 agent logs and, if the issue persists, try restarting it or re-registering it
 with the cluster.`
 
+	if params.TargetServer != nil && (params.TargetServer.IsOpenSSHNode() || params.TargetServer.IsEICE()) {
+		errorMessageTemplate = `Teleport proxy failed to connect to %q server %q over %s:
+
+  %v
+
+This usually means that the server is offline or a firewall restriction is blocking the SSH connection.
+Check the firewall restrictions, verify that the instance is running and the sshd service is active.`
+	}
+
 	var toAddr string
 	if params.To != nil {
 		toAddr = params.To.String()
diff --git a/lib/reversetunnel/localsite_test.go b/lib/reversetunnel/localsite_test.go
index 543ecfd894c2e..5104edeb26fe6 100644
--- a/lib/reversetunnel/localsite_test.go
+++ b/lib/reversetunnel/localsite_test.go
@@ -40,10 +40,11 @@ import (
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	os.Exit(m.Run())
 }
@@ -62,7 +63,7 @@ func TestRemoteConnCleanup(t *testing.T) {
 	watcher, err := services.NewProxyWatcher(ctx, services.ProxyWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
 			Component: "test",
-			Logger:    utils.NewSlogLoggerForTests(),
+			Logger:    logtest.NewLogger(),
 			Clock:     clock,
 			Client:    clt,
 		},
@@ -77,7 +78,7 @@ func TestRemoteConnCleanup(t *testing.T) {
 		ctx:              ctx,
 		Config:           Config{Clock: clock},
 		localAuthClient:  &mockLocalSiteClient{},
-		logger:           utils.NewSlogLoggerForTests(),
+		logger:           logtest.NewLogger(),
 		offlineThreshold: time.Second,
 		proxyWatcher:     watcher,
 	}
@@ -258,7 +259,7 @@ func TestProxyResync(t *testing.T) {
 	watcher, err := services.NewProxyWatcher(ctx, services.ProxyWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
 			Component: "test",
-			Logger:    utils.NewSlogLoggerForTests(),
+			Logger:    logtest.NewLogger(),
 			Clock:     clock,
 			Client:    clt,
 		},
@@ -273,7 +274,7 @@ func TestProxyResync(t *testing.T) {
 		ctx:              ctx,
 		Config:           Config{Clock: clock},
 		localAuthClient:  &mockLocalSiteClient{},
-		logger:           utils.NewSlogLoggerForTests(),
+		logger:           logtest.NewLogger(),
 		offlineThreshold: 24 * time.Hour,
 		proxyWatcher:     watcher,
 	}
@@ -355,6 +356,10 @@ func (m *mockLocalSiteClient) GetProxies() ([]types.Server, error) {
 	return m.proxies, nil
 }
 
+func (m *mockLocalSiteClient) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	return m.proxies, "", nil
+}
+
 type mockWatcher struct {
 	events chan types.Event
 }
diff --git a/lib/reversetunnel/peer.go b/lib/reversetunnel/peer.go
index 9c922a20ddd78..b263bb7da61b5 100644
--- a/lib/reversetunnel/peer.go
+++ b/lib/reversetunnel/peer.go
@@ -139,7 +139,7 @@ func (p *clusterPeers) GetLastConnected() time.Time {
 }
 
 func (p *clusterPeers) DialAuthServer(reversetunnelclient.DialParams) (net.Conn, error) {
-	return nil, trace.ConnectionProblem(nil, "unable to dial to auth server, this proxy has not been discovered yet, try again later")
+	return nil, trace.ConnectionProblem(nil, "unable to dial auth server in leaf cluster %q, the leaf cluster has not established all tunnels yet, try again later", p.clusterName)
 }
 
 // Dial is used to connect a requesting client (say, tsh) to an SSH server
@@ -150,7 +150,7 @@ func (p *clusterPeers) Dial(params reversetunnelclient.DialParams) (conn net.Con
 }
 
 func (p *clusterPeers) DialTCP(params reversetunnelclient.DialParams) (conn net.Conn, err error) {
-	return nil, trace.ConnectionProblem(nil, "unable to dial, this proxy has not been discovered yet, try again later")
+	return nil, trace.ConnectionProblem(nil, "unable to dial %s in leaf cluster %q, the leaf cluster has not established all tunnels yet, try again later", params.String(), p.clusterName)
 }
 
 // IsClosed always returns false because clusterPeers is never closed.
@@ -198,20 +198,26 @@ func (s *clusterPeer) setConnInfo(ci types.TunnelConnection) {
 	s.connInfo = ci
 }
 
+func (s *clusterPeer) discoveryError(msg string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return trace.ConnectionProblem(nil, "%s, the leaf cluster %q has not established all tunnels yet, try again later", msg, s.connInfo.GetClusterName())
+}
+
 func (s *clusterPeer) CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error) {
-	return nil, trace.ConnectionProblem(nil, "unable to fetch access point, this proxy %v has not been discovered yet, try again later", s)
+	return nil, s.discoveryError("unable to fetch access point for leaf cluster")
 }
 
 func (s *clusterPeer) NodeWatcher() (*services.GenericWatcher[types.Server, readonly.Server], error) {
-	return nil, trace.ConnectionProblem(nil, "unable to fetch node watcher, this proxy %v has not been discovered yet, try again later", s)
+	return nil, s.discoveryError("unable to fetch node watcher for leaf cluster")
 }
 
 func (s *clusterPeer) GitServerWatcher() (*services.GenericWatcher[types.Server, readonly.Server], error) {
-	return nil, trace.ConnectionProblem(nil, "unable to fetch git server watcher, this proxy %v has not been discovered yet, try again later", s)
+	return nil, s.discoveryError("unable to fetch git server watcher for leaf cluster")
 }
 
 func (s *clusterPeer) GetClient() (authclient.ClientI, error) {
-	return nil, trace.ConnectionProblem(nil, "unable to fetch client, this proxy %v has not been discovered yet, try again later", s)
+	return nil, s.discoveryError("unable to fetch auth client for leaf cluster")
 }
 
 func (s *clusterPeer) String() string {
@@ -242,7 +248,7 @@ func (s *clusterPeer) GetLastConnected() time.Time {
 // located in a remote connected site, the connection goes through the
 // reverse proxy tunnel.
 func (s *clusterPeer) Dial(params reversetunnelclient.DialParams) (conn net.Conn, err error) {
-	return nil, trace.ConnectionProblem(nil, "unable to dial, this proxy %v has not been discovered yet, try again later", s)
+	return nil, s.discoveryError("unable to dial target")
 }
 
 // Close closes cluster peer connections
diff --git a/lib/reversetunnel/remotesite.go b/lib/reversetunnel/remotesite.go
index 46fbe8f06a204..75bf261e1d377 100644
--- a/lib/reversetunnel/remotesite.go
+++ b/lib/reversetunnel/remotesite.go
@@ -44,7 +44,7 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/srv/forward"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -563,7 +563,7 @@ func (s *remoteSite) updateCertAuthorities(retry retryutils.Retry, remoteWatcher
 				s.logger.DebugContext(s.ctx, "Remote cluster does not support cert authorities rotation yet")
 			case trace.IsCompareFailed(err):
 				s.logger.InfoContext(s.ctx, "Remote cluster has updated certificate authorities, going to force reconnect")
-				if err := s.srv.onSiteTunnelClose(&alwaysClose{RemoteSite: s}); err != nil {
+				if err := s.srv.onSiteTunnelClose(&alwaysClose{Cluster: s}); err != nil {
 					s.logger.WarnContext(s.ctx, "Failed to close remote site", "error", err)
 				}
 				return
@@ -798,6 +798,10 @@ func (s *remoteSite) DialAuthServer(params reversetunnelclient.DialParams) (net.
 // located in a remote connected site, the connection goes through the
 // reverse proxy tunnel.
 func (s *remoteSite) Dial(params reversetunnelclient.DialParams) (net.Conn, error) {
+	if params.TargetServer == nil && params.ConnType == types.NodeTunnel {
+		return nil, trace.BadParameter("target server is required for teleport nodes")
+	}
+
 	localRecCfg, err := s.localAccessPoint.GetSessionRecordingConfig(s.ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -831,13 +835,15 @@ func (s *remoteSite) DialTCP(params reversetunnelclient.DialParams) (net.Conn, e
 		"target_addr", logutils.StringerAttr(params.To),
 	)
 
+	isAgentless := params.TargetServer != nil && params.TargetServer.IsOpenSSHNode()
+
 	conn, err := s.connThroughTunnel(&sshutils.DialReq{
 		Address:         params.To.String(),
 		ServerID:        params.ServerID,
 		ConnType:        params.ConnType,
 		ClientSrcAddr:   stringOrEmpty(params.From),
 		ClientDstAddr:   stringOrEmpty(params.OriginalClientDstAddr),
-		IsAgentlessNode: params.IsAgentlessNode,
+		IsAgentlessNode: isAgentless,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -847,7 +853,7 @@ func (s *remoteSite) DialTCP(params reversetunnelclient.DialParams) (net.Conn, e
 }
 
 func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ net.Conn, retErr error) {
-	if params.GetUserAgent == nil && !params.IsAgentlessNode {
+	if params.GetUserAgent == nil && !params.TargetServer.IsOpenSSHNode() {
 		return nil, trace.BadParameter("user agent getter is required for teleport nodes")
 	}
 	s.logger.DebugContext(s.ctx, "Initiating dial and forward request",
@@ -856,7 +862,7 @@ func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ ne
 	)
 
 	// request user agent connection if a SSH user agent is set
-	var userAgent teleagent.Agent
+	var userAgent sshagent.Client
 	if params.GetUserAgent != nil {
 		ua, err := params.GetUserAgent()
 		if err != nil {
@@ -882,7 +888,7 @@ func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ ne
 		ConnType:        params.ConnType,
 		ClientSrcAddr:   stringOrEmpty(params.From),
 		ClientDstAddr:   stringOrEmpty(params.OriginalClientDstAddr),
-		IsAgentlessNode: params.IsAgentlessNode,
+		IsAgentlessNode: params.TargetServer.IsOpenSSHNode(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -895,7 +901,6 @@ func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ ne
 		LocalAuthClient:          s.localClient,
 		TargetClusterAccessPoint: s.remoteAccessPoint,
 		UserAgent:                userAgent,
-		IsAgentlessNode:          params.IsAgentlessNode,
 		AgentlessSigner:          params.AgentlessSigner,
 		TargetConn:               targetConn,
 		SrcAddr:                  params.From,
@@ -908,20 +913,13 @@ func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ ne
 		Address:                  params.Address,
 		UseTunnel:                UseTunnel(s.logger, targetConn),
 		FIPS:                     s.srv.FIPS,
-		HostUUID:                 s.srv.ID,
+		ProxyUUID:                s.srv.ID,
 		Emitter:                  s.srv.Config.Emitter,
 		ParentContext:            s.srv.Context,
 		LockWatcher:              s.srv.LockWatcher,
-		TargetID:                 params.ServerID,
-		TargetAddr:               params.To.String(),
-		TargetHostname:           params.Address,
 		TargetServer:             params.TargetServer,
 		Clock:                    s.clock,
 	}
-	// Ensure the hostname is set correctly if we have details of the target
-	if params.TargetServer != nil {
-		serverConfig.TargetHostname = params.TargetServer.GetHostname()
-	}
 	remoteServer, err := forward.New(serverConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/reversetunnel/srv.go b/lib/reversetunnel/srv.go
index bb72c5955f024..10eef00b30990 100644
--- a/lib/reversetunnel/srv.go
+++ b/lib/reversetunnel/srv.go
@@ -193,8 +193,7 @@ type Config struct {
 	// Logger specifies the logger
 	Logger *slog.Logger
 
-	// FIPS means Teleport was started in a FedRAMP/FIPS 140-2 compliant
-	// configuration.
+	// FIPS means Teleport was started in FedRAMP/FIPS mode.
 	FIPS bool
 
 	// Emitter is event emitter
@@ -397,7 +396,7 @@ func (s *server) disconnectClusters(connectedRemoteClusters []*remoteSite, remot
 	for _, cluster := range connectedRemoteClusters {
 		if _, ok := remoteMap[cluster.GetName()]; !ok {
 			s.logger.InfoContext(s.ctx, "Remote cluster has been deleted, disconnecting it from the proxy", "remote_cluster", cluster.GetName())
-			if err := s.onSiteTunnelClose(&alwaysClose{RemoteSite: cluster}); err != nil {
+			if err := s.onSiteTunnelClose(&alwaysClose{Cluster: cluster}); err != nil {
 				s.logger.DebugContext(s.ctx, "Failure closing cluster", "remote_cluster", cluster.GetName(), "error", err)
 			}
 			remoteClustersStats.DeleteLabelValues(cluster.GetName())
@@ -449,7 +448,7 @@ func (s *server) periodicFunctions() {
 // fetchClusterPeers pulls back all proxies that have registered themselves
 // (created a services.TunnelConnection) in the backend and compares them to
 // what was found in the previous iteration and updates the in-memory cluster
-// peer map. This map is used later by GetSite(s) to return either local or
+// peer map. This map is used later by Cluster(s) to return either local or
 // remote site, or if no match, a cluster peer.
 func (s *server) fetchClusterPeers() error {
 	conns, err := s.LocalAccessPoint.GetAllTunnelConnections()
@@ -922,10 +921,14 @@ func (s *server) keyAuth(conn ssh.ConnMetadata, key ssh.PublicKey) (perm *ssh.Pe
 		// effectively limit ourselves to only supporting local users by only checking the cert against local CAs.
 		clusterName = s.ClusterName
 
-		if len(ident.Roles) == 0 {
-			return nil, trace.BadParameter("certificate missing roles in %q extension; make sure your user has some roles assigned (or ask your Teleport admin to) and log in again (or export an identity file, if that's what you used)", teleport.CertExtensionTeleportRoles)
+		if ident.ScopePin != nil {
+			certRole = "scoped-identity@" + ident.ScopePin.GetScope()
+		} else {
+			if len(ident.Roles) == 0 {
+				return nil, trace.BadParameter("certificate missing roles in %q extension; make sure your user has some roles assigned (or ask your Teleport admin to) and log in again (or export an identity file, if that's what you used)", teleport.CertExtensionTeleportRoles)
+			}
+			certRole = ident.Roles[0]
 		}
-		certRole = ident.Roles[0]
 		certType = utils.ExtIntCertTypeUser
 		caType = types.UserCA
 	default:
@@ -1047,10 +1050,10 @@ func (s *server) upsertRemoteCluster(conn net.Conn, sshConn *ssh.ServerConn) (*r
 	return site, remoteConn, nil
 }
 
-func (s *server) GetSites() ([]reversetunnelclient.RemoteSite, error) {
+func (s *server) Clusters(context.Context) ([]reversetunnelclient.Cluster, error) {
 	s.RLock()
 	defer s.RUnlock()
-	out := make([]reversetunnelclient.RemoteSite, 0, len(s.remoteSites)+len(s.clusterPeers)+1)
+	out := make([]reversetunnelclient.Cluster, 0, len(s.remoteSites)+len(s.clusterPeers)+1)
 	out = append(out, s.localSite)
 
 	haveLocalConnection := make(map[string]bool)
@@ -1076,15 +1079,15 @@ func (s *server) getRemoteClusters() []*remoteSite {
 	return out
 }
 
-// GetSite returns a RemoteSite. The first attempt is to find and return a
-// remote site and that is what is returned if a remote agent has
+// Cluster returns the Cluster with the matching name. The first attempt
+// is to find and return a remote site and that is what is returned if a remote agent has
 // connected to this proxy. Next we loop over local sites and try and try and
 // return a local site. If that fails, we return a cluster peer. This happens
 // when you hit proxy that has never had an agent connect to it. If you end up
 // with a cluster peer your best bet is to wait until the agent has discovered
 // all proxies behind a load balancer. Note, the cluster peer is a
 // services.TunnelConnection that was created by another proxy.
-func (s *server) GetSite(name string) (reversetunnelclient.RemoteSite, error) {
+func (s *server) Cluster(_ context.Context, name string) (reversetunnelclient.Cluster, error) {
 	s.RLock()
 	defer s.RUnlock()
 	if s.localSite.GetName() == name {
@@ -1111,7 +1114,7 @@ func (s *server) GetProxyPeerClient() *peer.Client {
 // alwaysClose forces onSiteTunnelClose to remove and close
 // the site by always returning false from HasValidConnections.
 type alwaysClose struct {
-	reversetunnelclient.RemoteSite
+	reversetunnelclient.Cluster
 }
 
 func (a *alwaysClose) HasValidConnections() bool {
diff --git a/lib/reversetunnel/srv_test.go b/lib/reversetunnel/srv_test.go
index 4a9615f4cb29e..01be1b405d3a4 100644
--- a/lib/reversetunnel/srv_test.go
+++ b/lib/reversetunnel/srv_test.go
@@ -41,6 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func newCAAndSigner(t *testing.T, caType types.CertAuthType, name string) (types.CertAuthority, ssh.Signer) {
@@ -80,7 +81,7 @@ func TestServerKeyAuth(t *testing.T) {
 	leafUserCA, leafUserCASigner := newCAAndSigner(t, types.UserCA, "leaf")
 
 	s := &server{
-		logger: utils.NewSlogLoggerForTests(),
+		logger: logtest.NewLogger(),
 		Config: Config{Clock: clockwork.NewRealClock(), ClusterName: "root"},
 		localAccessPoint: mockAccessPoint{
 			cas: []types.CertAuthority{hostCA, userCA, leafHostCA, leafUserCA},
@@ -346,7 +347,7 @@ func TestOnlyAuthDial(t *testing.T) {
 	badListenerAddr := acceptAndCloseListener(t, true)
 
 	srv := &server{
-		logger: utils.NewSlogLoggerForTests(),
+		logger: logtest.NewLogger(),
 		ctx:    ctx,
 		Config: Config{
 			LocalAuthAddresses: []string{goodListenerAddr},
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
index eb4b60c9b6f21..44e007bb783fa 100644
--- a/lib/reversetunnel/transport.go
+++ b/lib/reversetunnel/transport.go
@@ -396,7 +396,7 @@ func (p *transport) getConn(addr string, r *sshutils.DialReq) (net.Conn, bool, e
 	// This function doesn't attempt to dial if a host with one of the
 	// search names is not registered. It's a fast check.
 	p.logger.DebugContext(p.closeContext, "Attempting to dial server through tunnel", "target_server_id", r.ServerID)
-	conn, err := p.tunnelDial(r)
+	conn, err := p.tunnelDial(p.closeContext, r)
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return nil, false, trace.Wrap(err)
@@ -444,14 +444,14 @@ func (p *transport) getConn(addr string, r *sshutils.DialReq) (net.Conn, bool, e
 
 // tunnelDial looks up the search names in the local site for a matching tunnel
 // connection. If a connection exists, it's used to dial through the tunnel.
-func (p *transport) tunnelDial(r *sshutils.DialReq) (net.Conn, error) {
+func (p *transport) tunnelDial(ctx context.Context, r *sshutils.DialReq) (net.Conn, error) {
 	// Extract the local site from the tunnel server. If no tunnel server
 	// exists, then exit right away this code may be running outside of a
 	// remote site.
 	if p.reverseTunnelServer == nil {
 		return nil, trace.NotFound("not found")
 	}
-	cluster, err := p.reverseTunnelServer.GetSite(p.localClusterName)
+	cluster, err := p.reverseTunnelServer.Cluster(ctx, p.localClusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/reversetunnelclient/api.go b/lib/reversetunnelclient/api.go
index 1be0980c03e2d..f2bf62d6cf6b3 100644
--- a/lib/reversetunnelclient/api.go
+++ b/lib/reversetunnelclient/api.go
@@ -32,7 +32,7 @@ import (
 	"github.com/gravitational/teleport/lib/proxy/peer"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 )
 
 // DialParams is a list of parameters used to Dial to a node within a cluster.
@@ -45,11 +45,7 @@ type DialParams struct {
 
 	// GetUserAgent gets an SSH agent for use in connecting to the remote host. Used by the
 	// forwarding proxy.
-	GetUserAgent teleagent.Getter
-
-	// IsAgentlessNode indicates whether the Node is an OpenSSH Node.
-	// This includes Nodes whose sub kind is OpenSSH and OpenSSHEICE.
-	IsAgentlessNode bool
+	GetUserAgent sshagent.ClientGetter
 
 	// AgentlessSigner is used for authenticating to the remote host when it is an
 	// agentless node.
@@ -98,58 +94,55 @@ func (params DialParams) String() string {
 	return fmt.Sprintf("from: %q to: %q", params.From, to)
 }
 
-// RemoteSite represents remote teleport site that can be accessed via
-// teleport tunnel or directly by proxy
-//
-// There are two implementations of this interface: local and remote sites.
-type RemoteSite interface {
-	// DialAuthServer returns a net.Conn to the Auth Server of a site.
+// Cluster represents a teleport cluster, either root or leaf,
+// that can be accessed via teleport tunnel or directly by proxy.
+type Cluster interface {
+	// DialAuthServer returns a net.Conn to the Auth Server of a cluster.
 	DialAuthServer(DialParams) (conn net.Conn, err error)
-	// Dial dials any address within the site network, in terminating
+	// Dial dials any address within the cluster network, in terminating
 	// mode it uses local instance of forwarding server to terminate
 	// and record the connection.
 	Dial(DialParams) (conn net.Conn, err error)
-	// DialTCP dials any address within the site network and
+	// DialTCP dials any address within the cluster network and
 	// ignores recording mode, used in components that need direct dialer.
 	DialTCP(DialParams) (conn net.Conn, err error)
-	// GetLastConnected returns last time the remote site was seen connected
+	// GetLastConnected returns last time the cluster was seen connected
 	GetLastConnected() time.Time
-	// GetName returns site name (identified by authority domain's name)
+	// GetName returns cluster name (identified by authority domain's name)
 	GetName() string
-	// GetStatus returns status of this site (either offline or connected)
+	// GetStatus returns status of this cluster (either offline or connected)
 	GetStatus() string
 	// GetClient returns client connected to remote auth server
 	GetClient() (authclient.ClientI, error)
 	// CachingAccessPoint returns access point that is lightweight
 	// but is resilient to auth server crashes
 	CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error)
-	// NodeWatcher returns the node watcher that maintains the node set for the site
+	// NodeWatcher returns the node watcher that maintains the node set for the cluster
 	NodeWatcher() (*services.GenericWatcher[types.Server, readonly.Server], error)
-	// GitServerWatcher returns the Git server watcher for the site
+	// GitServerWatcher returns the Git server watcher for the cluster
 	GitServerWatcher() (*services.GenericWatcher[types.Server, readonly.Server], error)
 	// GetTunnelsCount returns the amount of active inbound tunnels
 	// from the remote cluster
 	GetTunnelsCount() int
-	// IsClosed reports whether this RemoteSite has been closed and should no
+	// IsClosed reports whether this Cluster has been closed and should no
 	// longer be used.
 	IsClosed() bool
-	// Closer allows the site to be closed
+	// Closer allows the Cluster to be closed
 	io.Closer
 }
 
-// Tunnel provides access to connected local or remote clusters
-// using unified interface.
-type Tunnel interface {
-	// GetSites returns a list of connected remote sites
-	GetSites() ([]RemoteSite, error)
-	// GetSite returns remote site this node belongs to
-	GetSite(domainName string) (RemoteSite, error)
+// ClusterGetter allows retrieving connected [Cluster].
+type ClusterGetter interface {
+	// Clusters returns all connected clusters
+	Clusters(ctx context.Context) ([]Cluster, error)
+	// Cluster returns the cluster matching the provided name or a trace.NotFoundError.
+	Cluster(ctx context.Context, clusterName string) (Cluster, error)
 }
 
 // Server is a TCP/IP SSH server which listens on an SSH endpoint and remote/local
-// sites connect and register with it.
+// cluster connect and register with it.
 type Server interface {
-	Tunnel
+	ClusterGetter
 	// Start starts server
 	Start() error
 	// Close closes server's operations immediately
diff --git a/lib/reversetunnelclient/api_with_roles.go b/lib/reversetunnelclient/api_with_roles.go
index 6d0ec8dea38c1..094f0d16b5e9e 100644
--- a/lib/reversetunnelclient/api_with_roles.go
+++ b/lib/reversetunnelclient/api_with_roles.go
@@ -28,48 +28,48 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-// ClusterGetter is an interface that defines GetRemoteCluster method
-type ClusterGetter interface {
+// RemoteClusterGetter is an interface that defines GetRemoteCluster method
+type RemoteClusterGetter interface {
 	// GetRemoteCluster returns a remote cluster by name
 	GetRemoteCluster(ctx context.Context, clusterName string) (types.RemoteCluster, error)
 }
 
-// NewTunnelWithRoles returns new authorizing tunnel
-func NewTunnelWithRoles(tunnel Tunnel, localCluster string, clusterAccessChecker func(types.RemoteCluster) error, access ClusterGetter) *TunnelWithRoles {
-	return &TunnelWithRoles{
-		tunnel:               tunnel,
+// NewClusterGetterWithRoles returns new ClusterGetter wrapper that authorizes
+// access to queried clusters.
+func NewClusterGetterWithRoles(clusterGetter ClusterGetter, localCluster string, clusterAccessChecker func(types.RemoteCluster) error, remoteClusterGetter RemoteClusterGetter) *ClusterGetterWithRoles {
+	return &ClusterGetterWithRoles{
+		clusterGetter:        clusterGetter,
 		localCluster:         localCluster,
 		clusterAccessChecker: clusterAccessChecker,
-		access:               access,
+		remoteClusterGetter:  remoteClusterGetter,
 	}
 }
 
-// TunnelWithRoles authorizes requests
-type TunnelWithRoles struct {
-	tunnel Tunnel
+// ClusterGetterWithRoles authorizes requests
+type ClusterGetterWithRoles struct {
+	clusterGetter ClusterGetter
 
 	localCluster string
 
 	// clusterAccessChecker is used to check RBAC permissions.
 	clusterAccessChecker func(types.RemoteCluster) error
 
-	access ClusterGetter
+	remoteClusterGetter RemoteClusterGetter
 }
 
-// GetSites returns a list of connected remote sites
-func (t *TunnelWithRoles) GetSites() ([]RemoteSite, error) {
-	ctx := context.TODO()
-	clusters, err := t.tunnel.GetSites()
+// Clusters returns all connected Teleport clusters.
+func (t *ClusterGetterWithRoles) Clusters(ctx context.Context) ([]Cluster, error) {
+	clusters, err := t.clusterGetter.Clusters(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out := make([]RemoteSite, 0, len(clusters))
+	out := make([]Cluster, 0, len(clusters))
 	for _, cluster := range clusters {
 		if t.localCluster == cluster.GetName() {
 			out = append(out, cluster)
 			continue
 		}
-		rc, err := t.access.GetRemoteCluster(ctx, cluster.GetName())
+		rc, err := t.remoteClusterGetter.GetRemoteCluster(ctx, cluster.GetName())
 		if err != nil {
 			if !trace.IsNotFound(err) {
 				return nil, trace.Wrap(err)
@@ -88,17 +88,16 @@ func (t *TunnelWithRoles) GetSites() ([]RemoteSite, error) {
 	return out, nil
 }
 
-// GetSite returns remote site this node belongs to
-func (t *TunnelWithRoles) GetSite(clusterName string) (RemoteSite, error) {
-	ctx := context.TODO()
-	cluster, err := t.tunnel.GetSite(clusterName)
+// Cluster returns a cluster matching the provided clusterName
+func (t *ClusterGetterWithRoles) Cluster(ctx context.Context, clusterName string) (Cluster, error) {
+	cluster, err := t.clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, utils.OpaqueAccessDenied(err)
 	}
 	if t.localCluster == cluster.GetName() {
 		return cluster, nil
 	}
-	rc, err := t.access.GetRemoteCluster(ctx, clusterName)
+	rc, err := t.remoteClusterGetter.GetRemoteCluster(ctx, clusterName)
 	if err != nil {
 		return nil, utils.OpaqueAccessDenied(err)
 	}
diff --git a/lib/reversetunnelclient/fake.go b/lib/reversetunnelclient/fake.go
index f867f63f99219..aa1f87a9781a2 100644
--- a/lib/reversetunnelclient/fake.go
+++ b/lib/reversetunnelclient/fake.go
@@ -19,6 +19,7 @@
 package reversetunnelclient
 
 import (
+	"context"
 	"net"
 	"sync"
 	"sync/atomic"
@@ -31,47 +32,47 @@ import (
 // FakeServer is a fake Server implementation used in tests.
 type FakeServer struct {
 	Server
-	// Sites is a list of sites registered via this fake reverse tunnel.
-	Sites []RemoteSite
+	// FakeClusters is a list of clusters registered via this fake reverse tunnel.
+	FakeClusters []Cluster
 }
 
-// GetSites returns all available remote sites.
-func (s *FakeServer) GetSites() ([]RemoteSite, error) {
-	return s.Sites, nil
+// Clusters returns all available clusters.
+func (s *FakeServer) Clusters(context.Context) ([]Cluster, error) {
+	return s.FakeClusters, nil
 }
 
-// GetSite returns the remote site by name.
-func (s *FakeServer) GetSite(name string) (RemoteSite, error) {
-	for _, site := range s.Sites {
-		if site.GetName() == name {
-			return site, nil
+// Cluster returns the cluster by name.
+func (s *FakeServer) Cluster(_ context.Context, name string) (Cluster, error) {
+	for _, cluster := range s.FakeClusters {
+		if cluster.GetName() == name {
+			return cluster, nil
 		}
 	}
-	return nil, trace.NotFound("site %q not found", name)
+	return nil, trace.NotFound("cluster %q not found", name)
 }
 
-// FakeRemoteSite is a fake reversetunnelclient.RemoteSite implementation used in tests.
-type FakeRemoteSite struct {
-	RemoteSite
-	// Name is the remote site name.
+// FakeCluster is a fake reversetunnelclient.FakeCluster implementation used in tests.
+type FakeCluster struct {
+	Cluster
+	// Name is the cluster name.
 	Name string
 	// AccessPoint is the auth server client.
 	AccessPoint authclient.RemoteProxyAccessPoint
 	// OfflineTunnels is a list of server IDs that will return connection error.
 	OfflineTunnels map[string]struct{}
-	// connCh receives the connection when dialing this site.
+	// connCh receives the connection when dialing this cluster.
 	connCh chan net.Conn
 	// connCounter count how many connection requests the remote received.
 	connCounter int64
 	// closedMtx is a mutex that protects closed.
 	closedMtx sync.Mutex
-	// closed is set to true after the site is being closed.
+	// closed is set to true after the cluster is being closed.
 	closed bool
 }
 
-// NewFakeRemoteSite is a FakeRemoteSite constructor.
-func NewFakeRemoteSite(clusterName string, accessPoint authclient.RemoteProxyAccessPoint) *FakeRemoteSite {
-	return &FakeRemoteSite{
+// NewFakeCluster is a FakeCluster constructor.
+func NewFakeCluster(clusterName string, accessPoint authclient.RemoteProxyAccessPoint) *FakeCluster {
+	return &FakeCluster{
 		Name:        clusterName,
 		connCh:      make(chan net.Conn),
 		AccessPoint: accessPoint,
@@ -79,22 +80,22 @@ func NewFakeRemoteSite(clusterName string, accessPoint authclient.RemoteProxyAcc
 }
 
 // CachingAccessPoint returns caching auth server client.
-func (s *FakeRemoteSite) CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error) {
+func (s *FakeCluster) CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error) {
 	return s.AccessPoint, nil
 }
 
-// GetName returns the remote site name.
-func (s *FakeRemoteSite) GetName() string {
+// GetName returns the remote cluster name.
+func (s *FakeCluster) GetName() string {
 	return s.Name
 }
 
 // ProxyConn returns proxy connection channel with incoming connections.
-func (s *FakeRemoteSite) ProxyConn() <-chan net.Conn {
+func (s *FakeCluster) ProxyConn() <-chan net.Conn {
 	return s.connCh
 }
 
-// Dial returns the connection to the remote site.
-func (s *FakeRemoteSite) Dial(params DialParams) (net.Conn, error) {
+// Dial returns the connection to the remote cluster.
+func (s *FakeCluster) Dial(params DialParams) (net.Conn, error) {
 	atomic.AddInt64(&s.connCounter, 1)
 
 	if _, ok := s.OfflineTunnels[params.ServerID]; ok {
@@ -114,7 +115,7 @@ func (s *FakeRemoteSite) Dial(params DialParams) (net.Conn, error) {
 	return writerConn, nil
 }
 
-func (s *FakeRemoteSite) Close() error {
+func (s *FakeCluster) Close() error {
 	s.closedMtx.Lock()
 	defer s.closedMtx.Unlock()
 	close(s.connCh)
@@ -122,6 +123,6 @@ func (s *FakeRemoteSite) Close() error {
 	return nil
 }
 
-func (s *FakeRemoteSite) DialCount() int64 {
+func (s *FakeCluster) DialCount() int64 {
 	return atomic.LoadInt64(&s.connCounter)
 }
diff --git a/lib/reversetunnelclient/peer.go b/lib/reversetunnelclient/peer.go
index 00266d53b7df1..e3ede5dc6e5b5 100644
--- a/lib/reversetunnelclient/peer.go
+++ b/lib/reversetunnelclient/peer.go
@@ -17,6 +17,7 @@
 package reversetunnelclient
 
 import (
+	"context"
 	"net"
 
 	"github.com/gravitational/trace"
@@ -33,9 +34,9 @@ func (f PeerDialerFunc) Dial(clusterName string, request peerdial.DialParams) (n
 }
 
 // NewPeerDialer implements [peerdial.Dialer] for a reverse tunnel server.
-func NewPeerDialer(server Tunnel) PeerDialerFunc {
+func NewPeerDialer(clusterGetter ClusterGetter) PeerDialerFunc {
 	return func(clusterName string, request peerdial.DialParams) (net.Conn, error) {
-		site, err := server.GetSite(clusterName)
+		site, err := clusterGetter.Cluster(context.TODO(), clusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -48,7 +49,8 @@ func NewPeerDialer(server Tunnel) PeerDialerFunc {
 			FromPeerProxy: true,
 		}
 
-		conn, err := site.Dial(dialParams)
+		// peered dials should be passthru so we call [localCluster.DialTCP] directly
+		conn, err := site.DialTCP(dialParams)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/reversetunnelclient/transport.go b/lib/reversetunnelclient/transport.go
index 0c245676ee637..52643b06225da 100644
--- a/lib/reversetunnelclient/transport.go
+++ b/lib/reversetunnelclient/transport.go
@@ -23,6 +23,7 @@ import (
 	"crypto/tls"
 	"log/slog"
 	"net"
+	"time"
 
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
@@ -113,6 +114,16 @@ func (t *TunnelAuthDialer) DialContext(ctx context.Context, _, _ string) (net.Co
 		return nil, trace.Wrap(err)
 	}
 
+	ctx, cancel := context.WithTimeout(
+		ctx,
+		time.Minute, // default timeout to connect to server
+	)
+	defer cancel()
+	stopFn := context.AfterFunc(ctx, func() {
+		_ = sconn.Close()
+	})
+	defer stopFn()
+
 	// Build a net.Conn over the tunnel. Make this an exclusive connection:
 	// close the net.Conn as well as the channel upon close.
 	conn, _, err := sshutils.ConnectProxyTransport(
diff --git a/lib/scopes/access/access.go b/lib/scopes/access/access.go
new file mode 100644
index 0000000000000..dc2b61502a559
--- /dev/null
+++ b/lib/scopes/access/access.go
@@ -0,0 +1,356 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package access
+
+import (
+	"iter"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/scopes"
+)
+
+const (
+	// MaxRolesPerAssignment is the maximum number of roles@scope assignments that a given scoped role assignment
+	// resource may contain. This value is so low because our backend limits the number of keys that can be associated
+	// with a single atomic operation. Any significant increase to this value would necessitate a change to the
+	// scoped role backend model.
+	MaxRolesPerAssignment = 16
+
+	// KindScopedRole is the kind of a scoped role resource.
+	KindScopedRole = "scoped_role"
+
+	// KindScopedRoleAssignment is the kind of a scoped role assignment resource.
+	KindScopedRoleAssignment = "scoped_role_assignment"
+
+	// KindScopedToken is the kind of a scoped token resource.
+	KindScopedToken = "scoped_token"
+
+	// maxAssignableScopes is the maximum number of assignable scopes that a given scoped role resource may contain. Note that
+	// unlike MaxRolesPerAssignment, this is a fairly arbitrary limit and there isn't a strong reason to keep it low other than
+	// to avoid excess resource size and to keep our options open for the future.
+	maxAssignableScopes = 16
+)
+
+// RoleIsAssignableAtScope checks if the given role is assignable at the given scope.
+func RoleIsAssignableAtScope(role *scopedaccessv1.ScopedRole, scope string) bool {
+	for assignableScope := range WeakValidatedAssignableScopes(role) {
+		if scopes.Glob(assignableScope).Matches(scope) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// WeakValidatedAssignableScopes is a helper for iterating all well formed assignable scopes for a given role.
+func WeakValidatedAssignableScopes(role *scopedaccessv1.ScopedRole) iter.Seq[string] {
+	return func(yield func(string) bool) {
+		for _, assignableScope := range role.GetSpec().GetAssignableScopes() {
+			if err := scopes.WeakValidateGlob(assignableScope); err != nil {
+				// ignore invalid assignable scopes
+				continue
+			}
+
+			if !scopes.Glob(assignableScope).IsSubjectToPolicyResourceScope(role.GetScope()) {
+				// ignore assignable scopes that do not conform to assignment subjugation rules
+				continue
+			}
+
+			if !yield(assignableScope) {
+				return
+			}
+		}
+	}
+}
+
+// WeakValidateRole valides a role to ensure it is free of obvious issues that would render it unusable and/or
+// induce serious unintended behavior. Prefer using this function for validating roles loaded from "internal" sources
+// (e.g. backend/control-plane), and [StrongValidateRole] for validating roles loaded from "external" sources (e.g. user input).
+func WeakValidateRole(role *scopedaccessv1.ScopedRole) error {
+	if err := commonValidateRole(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := scopes.WeakValidate(role.GetScope()); err != nil {
+		return trace.BadParameter("scoped role %q has invalid scope: %v", role.GetMetadata().GetName(), err)
+	}
+
+	// NOTE: in strong validation, this is where we'd check that the assignable scopes are valid. In weak validation
+	// we don't do that and instead rely on invalid assignable scopes being filtered out
+	// and excluded during runtime assignment validation checks. This helps us ensure that outdated agents continue
+	// to be able to understand and process the subset of assignments that they are able to reason about.
+
+	return nil
+}
+
+// StrongValidateRole performs robust validation of a role to ensure it complies with all expected constraints. Prefer
+// using this function for validating roles loaded from "external" sources (e.g. user input), and [WeakValidateRole] for
+// validating roles loaded from "internal" sources (e.g. backend/control-plane).
+func StrongValidateRole(role *scopedaccessv1.ScopedRole) error {
+	if err := commonValidateRole(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := validateRoleName(role.GetMetadata().GetName()); err != nil {
+		return trace.BadParameter("scoped role name %q does not conform to segment naming rules: %v", role.GetMetadata().GetName(), err)
+	}
+
+	if err := scopes.StrongValidate(role.GetScope()); err != nil {
+		return trace.BadParameter("scoped role %q has invalid scope: %v", role.GetMetadata().GetName(), err)
+	}
+
+	if len(role.GetSpec().GetAssignableScopes()) == 0 {
+		return trace.BadParameter("scoped role %q does not have any assignable scopes", role.GetMetadata().GetName())
+	}
+
+	if len(role.GetSpec().GetAssignableScopes()) > maxAssignableScopes {
+		return trace.BadParameter("scoped role %q has too many assignable scopes (max %d)", role.GetMetadata().GetName(), maxAssignableScopes)
+	}
+
+	for _, scopeGlob := range role.GetSpec().GetAssignableScopes() {
+		if err := scopes.StrongValidateGlob(scopeGlob); err != nil {
+			return trace.BadParameter("scoped role %q has invalid assignable scope %q: %v", role.GetMetadata().GetName(), scopeGlob, err)
+		}
+
+		if !scopes.Glob(scopeGlob).IsSubjectToPolicyResourceScope(role.GetScope()) {
+			return trace.BadParameter("scoped role %q has assignable scope %q that is not a sub-scope of the role's scope %q", role.GetMetadata().GetName(), scopeGlob, role.GetScope())
+		}
+	}
+
+	// verify that all rules are allowed for scoped roles
+	for _, rule := range role.GetSpec().GetAllow().GetRules() {
+		for _, resource := range rule.GetResources() {
+			for _, verb := range rule.GetVerbs() {
+				if !isAllowedScopedRule(resource, verb) {
+					if verb == types.VerbRead && isAllowedScopedRule(resource, types.VerbReadNoSecrets) {
+						return trace.BadParameter("scoped role %q has rule with verb %q that is too permissive for resource %q, use %q instead", role.GetMetadata().GetName(), verb, resource, types.VerbReadNoSecrets)
+					}
+					return trace.BadParameter("scoped role %q has rule with unsupported resource/verb combination: %q/%q", role.GetMetadata().GetName(), resource, verb)
+				}
+			}
+		}
+	}
+
+	// verify that logins are well-formed
+	for _, login := range role.GetSpec().GetAllow().GetLogins() {
+		// we currently don't support any form of wildcard/regex/substitution in scoped role
+		// logins. we likely will support substitution in the future, but its best to disallow
+		// it until that has landed.
+		if strings.ContainsAny(login, "{}^$*") {
+			return trace.BadParameter("scoped role %q has invalid login %q", role.GetMetadata().GetName(), login)
+		}
+	}
+
+	// verify that node labels are well-formed
+	for _, label := range role.GetSpec().GetAllow().GetNodeLabels() {
+		// we currently don't support any form of wildcard/regex/substitution in scoped role
+		// node labels. we likely will support such things in the future, but its best to disallow
+		// them until that has landed.
+
+		if strings.ContainsAny(label.GetName(), "{}^$") {
+			return trace.BadParameter("scoped role %q has invalid node label name %q", role.GetMetadata().GetName(), label.GetName())
+		}
+		for _, value := range label.GetValues() {
+			if strings.ContainsAny(value, "{}^$") {
+				return trace.BadParameter("scoped role %q has invalid node label value %q for label %q", role.GetMetadata().GetName(), value, label.GetName())
+			}
+		}
+	}
+
+	// verify that scoped role converts to a valid unscoped role
+	if _, err := ScopedRoleToRole(role, role.GetScope()); err != nil {
+		return trace.BadParameter("scoped role %q is malformed: %v", role.GetMetadata().GetName(), err)
+	}
+
+	return nil
+}
+
+func validateRoleName(name string) error {
+	// note: having the scope name be validated as a segment name is a bit of an arbitrary choice, but its basically
+	// equivalent to what we would want from a standalone name requirement, and there may even be some future benefit
+	// if we ever need to encode a role assignment as a scope-like name.
+	return trace.Wrap(scopes.StrongValidateSegment(name))
+}
+
+// commonValidateRole performs the subset of role validation common to both weak and strong validation.
+func commonValidateRole(role *scopedaccessv1.ScopedRole) error {
+	if role.GetMetadata().GetName() == "" {
+		return trace.BadParameter("scoped role is missing metadata.name")
+	}
+
+	if role.GetKind() == "" {
+		return trace.BadParameter("scoped role %q is missing kind", role.GetMetadata().GetName())
+	}
+
+	if role.GetKind() != KindScopedRole {
+		return trace.BadParameter("scoped role %q has invalid kind %q, expected %q", role.GetMetadata().GetName(), role.GetKind(), KindScopedRole)
+	}
+
+	if role.GetSubKind() != "" {
+		return trace.BadParameter("scoped role %q has unknown sub_kind %q", role.GetMetadata().GetName(), role.GetSubKind())
+	}
+
+	if role.GetVersion() == "" {
+		return trace.BadParameter("scoped role %q is missing version", role.GetMetadata().GetName())
+	}
+
+	if role.GetVersion() != types.V1 {
+		return trace.BadParameter("scoped role %q has unsupported version %q (expected %q)", role.GetMetadata().GetName(), role.GetVersion(), types.V1)
+	}
+
+	if role.GetScope() == "" {
+		return trace.BadParameter("scoped role %q is missing scope", role.GetMetadata().GetName())
+	}
+
+	return nil
+}
+
+// WeakValidatedSubAssignments is a helper for iterating all well formed sub-assignments within a given assignment. Note that the concept
+// of a well-formed sub-assignment is distinct from whether or not an assignment is "boken/invalidated" in the sense used when
+// deciding whether or not an access-control check can be performed for a given scope. The only thing that is being filtered out
+// by this iterator is sub-assignments that are so obviously misconfigured that we can't reason about them at all. Sub-assignments
+// returned by this iterator may still be broken because they assign a nonexistent role, or to a scope that the target role is not
+// assignable to.
+func WeakValidatedSubAssignments(assignment *scopedaccessv1.ScopedRoleAssignment) iter.Seq[*scopedaccessv1.Assignment] {
+	return func(yield func(*scopedaccessv1.Assignment) bool) {
+		for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+			if subAssignment.GetRole() == "" {
+				// ignore sub-assignments with missing role
+				continue
+			}
+
+			if err := scopes.WeakValidate(subAssignment.GetScope()); err != nil {
+				// ignore sub-assignments with invalid scopes
+				continue
+			}
+
+			if !scopes.PolicyAssignmentScope(subAssignment.GetScope()).IsSubjectToPolicyResourceScope(assignment.GetScope()) {
+				// ignore sub-assignments with scopes that do not conform to assignment subjugation rules
+				continue
+			}
+
+			if !yield(subAssignment) {
+				return
+			}
+		}
+	}
+}
+
+// WeakValidateAssignment validates an assignment to ensure it is free of obvious issues that would render it unusable and/or
+// induce serious unintended behavior. Prefer using this function for validating assignments loaded from "internal" sources
+// (e.g. backend/control-plane), and [StrongValidateAssignment] for validating assignments loaded from "external" sources (e.g. user input).
+func WeakValidateAssignment(assignment *scopedaccessv1.ScopedRoleAssignment) error {
+	if err := commonValidateAssignment(assignment); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := scopes.WeakValidate(assignment.GetScope()); err != nil {
+		return trace.BadParameter("scoped role assignment %q has invalid scope: %v", assignment.GetMetadata().GetName(), err)
+	}
+
+	// NOTE: in strong validation, this is where we'd check that the sub-assignments are valid. In weak validation
+	// we don't do that and instead rely on invalid sub-assignments being filtered out and excluded during runtime
+	// assignment resolution.
+
+	return nil
+}
+
+// StrongValidateAssignment performs robust validation of an assignment to ensure it complies with all expected constraints. Prefer
+// using this function for validating assignments loaded from "external" sources (e.g. user input), and [WeakValidateAssignment] for
+// validating assignments loaded from "internal" sources (e.g. backend/control-plane).
+func StrongValidateAssignment(assignment *scopedaccessv1.ScopedRoleAssignment) error {
+	if err := commonValidateAssignment(assignment); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := uuid.Parse(assignment.GetMetadata().GetName()); err != nil {
+		return trace.BadParameter("scoped role assignment %q has invalid name (must be uuid): %v", assignment.GetMetadata().GetName(), err)
+	}
+
+	if err := scopes.StrongValidate(assignment.GetScope()); err != nil {
+		return trace.BadParameter("scoped role assignment %q has invalid scope: %v", assignment.GetMetadata().GetName(), err)
+	}
+
+	if len(assignment.GetSpec().GetAssignments()) == 0 {
+		return trace.BadParameter("scoped role assignment %q does not assign any roles", assignment.GetMetadata().GetName())
+	}
+
+	if len(assignment.GetSpec().GetAssignments()) > MaxRolesPerAssignment {
+		return trace.BadParameter("scoped role assignment %q contains too many sub-assignments (max %d)", assignment.GetMetadata().GetName(), MaxRolesPerAssignment)
+	}
+
+	for i, subAssignment := range assignment.GetSpec().GetAssignments() {
+		if subAssignment.GetRole() == "" {
+			return trace.BadParameter("scoped role assignment %q is missing role in sub-assignment %d", assignment.GetMetadata().GetName(), i)
+		}
+
+		if err := validateRoleName(subAssignment.GetRole()); err != nil {
+			return trace.BadParameter("scoped role assignment %q has invalid role name in sub-assignment %d: %v", assignment.GetMetadata().GetName(), i, err)
+		}
+
+		if err := scopes.StrongValidate(subAssignment.GetScope()); err != nil {
+			return trace.BadParameter("scoped role assignment %q has invalid scope in sub-assignment %d: %v", assignment.GetMetadata().GetName(), i, err)
+		}
+
+		if !scopes.PolicyAssignmentScope(subAssignment.GetScope()).IsSubjectToPolicyResourceScope(assignment.GetScope()) {
+			return trace.BadParameter("scoped role assignment %q has sub-assignment %d with scope %q that is not a sub-scope of the assignment's scope %q", assignment.GetMetadata().GetName(), i, subAssignment.GetScope(), assignment.GetScope())
+		}
+	}
+
+	return nil
+}
+
+func commonValidateAssignment(assignment *scopedaccessv1.ScopedRoleAssignment) error {
+	if assignment.GetMetadata().GetName() == "" {
+		return trace.BadParameter("scoped role assignment is missing metadata.name")
+	}
+
+	if assignment.GetKind() == "" {
+		return trace.BadParameter("scoped role assignment %q is missing kind", assignment.GetMetadata().GetName())
+	}
+
+	if assignment.GetKind() != KindScopedRoleAssignment {
+		return trace.BadParameter("scoped role assignment %q has invalid kind %q, expected %q", assignment.GetMetadata().GetName(), assignment.GetKind(), KindScopedRoleAssignment)
+	}
+
+	if assignment.GetSubKind() != "" {
+		return trace.BadParameter("scoped role assignment %q has unknown sub_kind %q", assignment.GetMetadata().GetName(), assignment.GetSubKind())
+	}
+
+	if assignment.GetVersion() == "" {
+		return trace.BadParameter("scoped role assignment %q is missing version", assignment.GetMetadata().GetName())
+	}
+
+	if assignment.GetVersion() != types.V1 {
+		return trace.BadParameter("scoped role assignment %q has unsupported version %q (expected %q)", assignment.GetMetadata().GetName(), assignment.GetVersion(), types.V1)
+	}
+
+	if assignment.GetScope() == "" {
+		return trace.BadParameter("scoped role assignment %q is missing scope", assignment.GetMetadata().GetName())
+	}
+
+	if assignment.GetSpec().GetUser() == "" {
+		return trace.BadParameter("scoped role assignment %q is missing spec.user", assignment.GetMetadata().GetName())
+	}
+
+	return nil
+}
diff --git a/lib/scopes/access/access_test.go b/lib/scopes/access/access_test.go
new file mode 100644
index 0000000000000..d8c73e4ac552f
--- /dev/null
+++ b/lib/scopes/access/access_test.go
@@ -0,0 +1,796 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package access
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// TestValidateRole verifies basic functionality of strong and weak role validation functions.
+func TestValidateRole(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name     string
+		role     *scopedaccessv1.ScopedRole
+		strongOk bool
+		weakOk   bool
+	}{
+		{
+			name: "basic",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: true,
+			weakOk:   true,
+		},
+		{
+			name: "unknown sub_kind",
+			role: &scopedaccessv1.ScopedRole{
+				Kind:    KindScopedRole,
+				SubKind: "unknown",
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing name",
+			role: &scopedaccessv1.ScopedRole{
+				Kind:     KindScopedRole,
+				Metadata: &headerv1.Metadata{},
+				Scope:    "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing kind",
+			role: &scopedaccessv1.ScopedRole{
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing version",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "malformed name",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "foo/bar",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "malformed kind",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: "role",
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "slightly malformed scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "foo/bar",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo/bar"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "siginifcantly malformed scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "foo@bar",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo/bar"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing assignable scopes",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope:   "/",
+				Spec:    &scopedaccessv1.ScopedRoleSpec{},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "slightly malformed assignable scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"foo/bar"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "siginifcantly malformed assignable scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"foo@bar"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true, // invalid assignable scopes are totally ignored, even if they don't pass weak validation rules
+		},
+		{
+			name: "impermissable assignable scope",
+			role: &scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/foo/bar",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo"},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			err := StrongValidateRole(tt.role)
+			if tt.strongOk {
+				require.NoError(t, err, "strong validation should not fail")
+			} else {
+				require.Error(t, err, "strong validation should fail")
+			}
+
+			err = WeakValidateRole(tt.role)
+			if tt.weakOk {
+				require.NoError(t, err, "weak validation should not fail")
+			} else {
+				require.Error(t, err, "weak validation should fail")
+			}
+		})
+	}
+}
+
+func TestValidateAsssignment(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name       string
+		assignment *scopedaccessv1.ScopedRoleAssignment
+		strongOk   bool
+		weakOk     bool
+	}{
+		{
+			name: "basic",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: true,
+			weakOk:   true,
+		},
+		{
+			name: "unknown sub_kind",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind:    KindScopedRoleAssignment,
+				SubKind: "unknown",
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing name",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind:     KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{},
+				Scope:    "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing kind",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing scope",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing version",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "malformed name",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: "not-a-uuid",
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "malformed kind",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: "not_scoped_role_assignment",
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "slightly malformed scope",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "foo",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "significantly malformed scope",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "foo@bar",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "impermissable assigned scope",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/foo/bar",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "malformed assigned scope",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "basic",
+			assignment: &scopedaccessv1.ScopedRoleAssignment{
+				Kind: KindScopedRoleAssignment,
+				Metadata: &headerv1.Metadata{
+					Name: uuid.New().String(),
+				},
+				Scope: "/",
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					User: "alice",
+					Assignments: []*scopedaccessv1.Assignment{
+						{
+							Role:  "test",
+							Scope: "/foo",
+						},
+					},
+				},
+				Version: types.V1,
+			},
+			strongOk: true,
+			weakOk:   true,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			err := StrongValidateAssignment(tt.assignment)
+			if tt.strongOk {
+				require.NoError(t, err, "strong validation should not fail")
+			} else {
+				require.Error(t, err, "strong validation should fail")
+			}
+
+			err = WeakValidateAssignment(tt.assignment)
+			if tt.weakOk {
+				require.NoError(t, err, "weak validation should not fail")
+			} else {
+				require.Error(t, err, "weak validation should fail")
+			}
+		})
+	}
+}
+
+func TestWeakValidatedAssignableScopes(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name             string
+		scope            string
+		assignableScopes []string
+		expect           []string
+	}{
+		{
+			name:             "basic",
+			scope:            "/foo",
+			assignableScopes: []string{"/foo/bar", "/foo/baz"},
+			expect:           []string{"/foo/bar", "/foo/baz"},
+		},
+		{
+			name:             "empty",
+			scope:            "/foo",
+			assignableScopes: nil,
+			expect:           nil,
+		},
+		{
+			name:             "mildly malformed",
+			scope:            "/foo",
+			assignableScopes: []string{"foo/bar", "foo/baz"},
+			expect:           []string{"foo/bar", "foo/baz"},
+		},
+		{
+			name:             "significantly malformed",
+			scope:            "/foo",
+			assignableScopes: []string{"foo@bar", "foo@baz"},
+			expect:           nil,
+		},
+		{
+			name:             "impermissible",
+			scope:            "/foo/bar",
+			assignableScopes: []string{"/foo", "/foo/bar"},
+			expect:           []string{"/foo/bar"},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			result := slices.Collect(WeakValidatedAssignableScopes(&scopedaccessv1.ScopedRole{
+				Scope: tt.scope,
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: tt.assignableScopes,
+				},
+			}))
+			require.Equal(t, tt.expect, result)
+		})
+	}
+}
+
+func TestWeakValidatedSubAssignments(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name        string
+		scope       string
+		assignments []*scopedaccessv1.Assignment
+		expect      []*scopedaccessv1.Assignment
+	}{
+		{
+			name:  "basic",
+			scope: "/foo",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+		},
+		{
+			name:  "mildly malformed scope",
+			scope: "/foo",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "foo/bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "foo/bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+		},
+		{
+			name:  "significantly malformed scope",
+			scope: "/foo",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "foo@bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+		},
+		{
+			name:  "impermissible scope",
+			scope: "/foo/bar",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+			},
+		},
+		{
+			name:  "missing scope",
+			scope: "/foo",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "",
+				},
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/baz",
+				},
+			},
+		},
+		{
+			name:  "missing role",
+			scope: "/foo",
+			assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "",
+					Scope: "/foo/baz",
+				},
+			},
+			expect: []*scopedaccessv1.Assignment{
+				{
+					Role:  "test",
+					Scope: "/foo/bar",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			result := slices.Collect(WeakValidatedSubAssignments(&scopedaccessv1.ScopedRoleAssignment{
+				Scope: tt.scope,
+				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+					Assignments: tt.assignments,
+				},
+			}))
+			require.Equal(t, tt.expect, result)
+		})
+	}
+}
diff --git a/lib/scopes/access/compat.go b/lib/scopes/access/compat.go
new file mode 100644
index 0000000000000..3b4ba9fddf1b1
--- /dev/null
+++ b/lib/scopes/access/compat.go
@@ -0,0 +1,203 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package access
+
+import (
+	"os"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+)
+
+// scopedRoleConditionsToRoleConditions converts scoped role conditions to classic role conditions.
+func scopedRoleConditionsToRoleConditions(src *scopedaccessv1.ScopedRoleConditions) types.RoleConditions {
+	var rules []types.Rule
+	for _, r := range src.GetRules() {
+		// as part of this conversion we expand multi-resource rules into multiple single-resource rules.
+		// this is because we need to filter out unsupported resource:verb combinations, which may not be
+		// sound if multiple resources are combined in a single rule.
+		for _, resource := range r.GetResources() {
+			var verbs []string
+			for _, verb := range r.GetVerbs() {
+				if !isAllowedScopedRule(resource, verb) {
+					// skip verbs that are not allowed for the resource kind. note that this differs from
+					// classic teleport role behavior, where we don't worry about unsupported resource:verb
+					// combinations because we theoretically won't have any access checks for unsupported
+					// combinations. scoped roles differ because there may be logic that is abstracting over
+					// scoped and unscoped identities doing access checks for verbs that aren't supported
+					// for scoped roles but *are* supported for classic roles. in such a scenario, if we
+					// decide to introduce scoped support for the verb in the future, we may end up changing
+					// the nature of the access check to better accommodate the scoping model. if we do,
+					// outdated instances running the old access check would behave unsoundly when handling
+					// the new rule.
+					continue
+				}
+				verbs = append(verbs, verb)
+			}
+			if len(verbs) == 0 {
+				// skip rules that have no allowed verbs.
+				continue
+			}
+			rules = append(rules, types.Rule{
+				Resources: []string{resource},
+				Verbs:     verbs,
+			})
+		}
+	}
+
+	var nodeLabels types.Labels
+	for _, label := range src.GetNodeLabels() {
+		if nodeLabels == nil {
+			nodeLabels = make(types.Labels)
+		}
+		nodeLabels[label.GetName()] = apiutils.Strings(label.GetValues())
+	}
+
+	return types.RoleConditions{
+		Rules:      rules,
+		Logins:     src.GetLogins(),
+		NodeLabels: nodeLabels,
+	}
+}
+
+// ScopedRoleToRole converts a scoped role to an equivalent classic role. Scoped roles do not implement their
+// own access-control logic for the most part, and instead rely on converting to classic roles for the final
+// step of evaluation. This functiona also accepts the assigned scope as a parameter because we conventionally
+// format converted role names as "<role-name>@<assigned-scope>" to help ensure reasonable error messages from
+// role evaluation logic.
+func ScopedRoleToRole(sr *scopedaccessv1.ScopedRole, assignedScope string) (types.Role, error) {
+	role, err := types.NewRoleWithVersion(sr.GetMetadata().GetName()+"@"+assignedScope, types.V8, types.RoleSpecV6{
+		// scoped roles support allow blocks, but not deny blocks.
+		Allow: scopedRoleConditionsToRoleConditions(sr.GetSpec().GetAllow()),
+		// no scoped role options have been implemented yet. all options blocks are default/placeholder values.
+		Options: types.RoleOptions{
+			// CertificateFormat is always set to "standard" for scoped roles. We don't anticipate needing to change
+			// this in the future, but if we did alternative options for controlling the parameter via some other
+			// mechanism should be investigated. Certificate format determination via scoped roles would be problematic.
+			CertificateFormat: constants.CertificateFormatStandard,
+			// MaxSessionTTL must be a global default value until we decide how to handle its effect on pinned certificate
+			// parameters. Likely we will need to decouple session TTL from certificate lifetime. See getScopedSessionTTL.
+			MaxSessionTTL: types.NewDuration(getScopedSessionTTL()),
+			// RequireMFAType is off until we decide how to handle its effect on pinned certificate parameters. This field
+			// is the underlying driver of the RequiredKeyPolicy checker method/cert attr. It is enforced at cert
+			// generation time, and also re-enforced during access. Due to the fact that descendant scopes must not be
+			// able to interfere with access granted at ancestral scopes, we have to support usecases where a cert may or
+			// may not have a given policy enforced for it depending on the scope of permit. There is a mechanism for
+			// looking up attestation data in the backend, so in theory we could support lazy lookup of this value instead
+			// of encoding it on certificates.  In practice, that may be sub-optimal (at least until PDP lands).
+			RequireMFAType: types.RequireMFAType_OFF,
+			// PinSourceIP is off until we decide how to handle its effect on pinned certificate parameters. In a perfect
+			// world, we would simply always include a record of the origin address on the certificate and only enforce
+			// it if the specific access decision was scoped s.t. pinning were required. In practice, this would be a very
+			// different and less robust feature than the source ip pinning of classic teleport roles. In classic teleport
+			// roles pinning actually sets the `source-address` critical option on the certificate, which is a well-known
+			// standard and is enforced both by openssh and by the crypto/ssh package.  It is likely that no scope-aware
+			// equivalent feature would ever be so robust. In light of that, it may be more desirable either to never
+			// support pinning for scoped roles, or introduce a new policy type that ascribes pinning as a control
+			// independent of scopes, either globally or per-user.
+			PinSourceIP: false,
+			// SSHPortForwarding must be a global default value until we decide how to handle its effects on pinned
+			// certificate parameters. Likely the solution will be two-part. Teleport agent ssh behavior should be reviewed
+			// to remove dependence on the certificate parameter in favor of always using the port forwarding permission
+			// determined at the scope of permit. Certificates generated to target openssh agents should encode the parameter
+			// determined at the scope of permit to the certificate.
+			SSHPortForwarding: getScopedPortForwardingConfig(),
+			// ForwardAgent must be a global default value until we decide how to handle its effects on pinned certificate
+			// parameters. Likely will follow the same behavior as SSHPortForwarding.
+			ForwardAgent: types.NewBool(getScopedForwardAgent()),
+			// PermitX11Forwarding is off until we decide how to handle its effect on pinned certificate parameters. Likely
+			// will follow the same behavior as SSHPortForwarding.
+			PermitX11Forwarding: types.NewBool(false),
+			// CertExtensions will likely *never* have a sane correlary for scoped roles. Scoped certificates include roles
+			// which only apply conditionally and necessarily must not apply to all access when the certificate is pinned to
+			// a parent scope. CertExtensions as a concept is incompatible with this goal.
+			CertExtensions: nil,
+			// Lock mode is unset (i.e. defers to cluster-wide default) until we decide how to handle its effect on pinned
+			// certificate creation. Role-affected locking behavior during certificate creation doesn't map well to pinned
+			// certificates. We do need to support custom locking mode for scoped roles eventually in order to make
+			// per-access lock evaluation specialization possible, but its likely that cert-creation locking behavior will
+			// need special handling of some kind.
+			Lock: "",
+			// ClientIdleTimeout is disabled until we can decide how to handle the cases where client idle timeout is
+			// being used independently of an access check (and therefore independent of a known target scope). It is possible
+			// that the correct way to handle this will be to break compatibility with classic roles and introduce separate
+			// per-protocol idle timeouts, with the global timeout always applying for operations that are not tied to a
+			// specific access check. By setting this value to zero we effectively make the default behavior one where we
+			// are always deferring to the global setting for scoped identities, which aught to be forwards compatible with
+			// whatever solution we eventually land on.
+			ClientIdleTimeout: types.NewDuration(0),
+
+			// DisconnectExpiredCert is disabled until we can decide how to handle the cases where disconnect on expired cert is
+			// being used independently of an access check (and therefore independent of a known target scope). It is possible
+			// that the correct way to handle this will be to break compatibility with classic roles and introduce separate
+			// per-protocol disconnect on expired cert, with the global setting always applying for operations that are not tied to a
+			// specific access check. By setting this value to false we effectively make the default behavior one where we
+			// are always deferring to the global setting for scoped identities, which aught to be forwards compatible with
+			// whatever solution we eventually land on	.
+			DisconnectExpiredCert: types.NewBool(false),
+		},
+	})
+	if err != nil {
+		return nil, trace.Errorf("failed to convert scoped role %q assigned at scope %q to classic role: %v", sr.GetMetadata().GetName(), assignedScope, err)
+	}
+
+	return role, nil
+}
+
+// getScopedSessionTTL returns the session TTL for scoped access sessions. This is currently hard-coded to be 8 hours unless
+// overridden by an unstable env var. We would eventually like to make this configurable, but the existing mechanics of
+// session TTLs violate scope isolation principals.  We will need to do a deeper rework of the handling of session ttls and
+// decouple them from certificate lifetimes before it will be sane for scoped roles to define custom session ttls. As a
+// holdover, the unstable var will allow administrators some rudimentary control in the event the default is unacceptable.
+// XXX: We *must not* introduce configurable session TTLs without reevaluating the behavior of the
+// ScopedAccessChecker.CheckLoginDuration and ScopedAccessChecker.AdjustSessionTTL methods.
+func getScopedSessionTTL() time.Duration {
+	if s := os.Getenv("TELEPORT_UNSTABLE_SCOPES_SESSION_TTL"); s != "" {
+		if ttl, err := time.ParseDuration(s); err == nil {
+			return ttl
+		}
+	}
+
+	return time.Hour * 8
+}
+
+// getScopedPortForwardingConfig returns the port forwarding configuration for scoped access. This is currently hard-coded to
+// be disabled unless overridden by an unstable env var. We would eventually like to make this configurable, but
+// certificate-based port forwarding permissions violate scope isolation principals. We will need to rework port forwarding
+// to decouple it from certificate parameters before it will be sane for scoped roles to define custom port forwarding behavior.
+// As a holdover, the unstable var will allow administrators some rudimentary control in the event the default is unacceptable.
+func getScopedPortForwardingConfig() *types.SSHPortForwarding {
+	value := os.Getenv("TELEPORT_UNSTABLE_SCOPES_PORT_FORWARDING") == "yes"
+	return &types.SSHPortForwarding{
+		Remote: &types.SSHRemotePortForwarding{Enabled: types.NewBoolOption(value)},
+		Local:  &types.SSHLocalPortForwarding{Enabled: types.NewBoolOption(value)},
+	}
+}
+
+// getScopedForwardAgent returns whether agent forwarding is enabled for scoped access. This is currently hard-coded to be
+// disabled unless overridden by an unstable env var. We would eventually like to make this configurable, but certificate-based
+// agent forwarding permissions violate scope isolation principals. We will need to rework agent forwarding to decouple it
+// from certificate parameters before it will be sane for scoped roles to define custom agent forwarding behavior. As a
+// holdover, the unstable var will allow administrators some rudimentary control in the event the default is unacceptable.
+func getScopedForwardAgent() bool {
+	return os.Getenv("TELEPORT_UNSTABLE_SCOPES_FORWARD_AGENT") == "yes"
+}
diff --git a/lib/scopes/access/compat_test.go b/lib/scopes/access/compat_test.go
new file mode 100644
index 0000000000000..7d1b378f79269
--- /dev/null
+++ b/lib/scopes/access/compat_test.go
@@ -0,0 +1,219 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package access
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+)
+
+// TestEmptyRoleConverts verifies that a scoped role that is empty except for
+// scoping/metadata converts to a reasonable default/unprivileged classic role.
+func TestEmptyRoleConverts(t *testing.T) {
+	t.Parallel()
+
+	role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+		Kind: KindScopedRole,
+		Metadata: &headerv1.Metadata{
+			Name: "test",
+		},
+		Scope: "/foo",
+		Spec: &scopedaccessv1.ScopedRoleSpec{
+			AssignableScopes: []string{"/foo/bar"},
+		},
+		Version: types.V1,
+	}, "/foo/bar")
+	require.NoError(t, err)
+	require.NotNil(t, role)
+	require.Equal(t, "test@/foo/bar", role.GetName())
+}
+
+// TestSSHConversion verifies the various SSH-related scoped role rule conversion scenarios.
+func TestSSHConversion(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name       string
+		conditions *scopedaccessv1.ScopedRoleConditions
+		expect     types.RoleConditions
+	}{
+		{
+			name:       "empty conditions",
+			conditions: &scopedaccessv1.ScopedRoleConditions{},
+			expect:     types.RoleConditions{},
+		},
+		{
+			name: "sparse",
+			conditions: &scopedaccessv1.ScopedRoleConditions{
+				Logins: []string{"root"},
+				NodeLabels: []*labelv1.Label{
+					{
+						Name:   "team",
+						Values: []string{"red"},
+					},
+				},
+			},
+			expect: types.RoleConditions{
+				Logins: []string{"root"},
+				NodeLabels: types.Labels{
+					"team": apiutils.Strings{"red"},
+				},
+			},
+		},
+		{
+			name: "full",
+			conditions: &scopedaccessv1.ScopedRoleConditions{
+				Logins: []string{"root", "admin"},
+				NodeLabels: []*labelv1.Label{
+					{
+						Name:   "env",
+						Values: []string{"prod", "staging"},
+					},
+					{
+						Name:   "team",
+						Values: []string{"blue"},
+					},
+				},
+			},
+			expect: types.RoleConditions{
+				Logins: []string{"root", "admin"},
+				NodeLabels: types.Labels{
+					"env":  apiutils.Strings{"prod", "staging"},
+					"team": apiutils.Strings{"blue"},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/foo",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo/bar"},
+					Allow:            tt.conditions,
+				},
+				Version: types.V1,
+			}, "/foo/bar")
+			require.NoError(t, err)
+			tt.expect.Namespaces = []string{"default"}
+			require.Empty(t, cmp.Diff(tt.expect, role.GetRoleConditions(types.Allow)))
+		})
+	}
+}
+
+// TestRulesConversion verifies various scoped role rule conversion scenarios.
+func TestRulesConversion(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name   string
+		rules  []*scopedaccessv1.ScopedRule
+		expect []types.Rule
+	}{
+		{
+			name: "basic",
+			rules: []*scopedaccessv1.ScopedRule{
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
+				},
+				{
+					Resources: []string{KindScopedRoleAssignment},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+				},
+			},
+			expect: []types.Rule{
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
+				},
+				{
+					Resources: []string{KindScopedRoleAssignment},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
+				},
+			},
+		},
+		{
+			name: "unsupported verb",
+			rules: []*scopedaccessv1.ScopedRule{
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList, types.VerbRead},
+				},
+			},
+			expect: []types.Rule{
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList},
+				},
+			},
+		},
+		{
+			name: "unsupported resource",
+			rules: []*scopedaccessv1.ScopedRule{
+				{
+					Resources: []string{types.KindCertAuthority},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
+				},
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
+				},
+			},
+			expect: []types.Rule{
+				{
+					Resources: []string{KindScopedRole},
+					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+				Kind: KindScopedRole,
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Scope: "/foo",
+				Spec: &scopedaccessv1.ScopedRoleSpec{
+					AssignableScopes: []string{"/foo/bar"},
+					Allow: &scopedaccessv1.ScopedRoleConditions{
+						Rules: tt.rules,
+					},
+				},
+				Version: types.V1,
+			}, "/foo/bar")
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(tt.expect, role.GetRules(types.Allow)))
+		})
+	}
+}
diff --git a/lib/scopes/access/verbs.go b/lib/scopes/access/verbs.go
new file mode 100644
index 0000000000000..6d0dc76306090
--- /dev/null
+++ b/lib/scopes/access/verbs.go
@@ -0,0 +1,76 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+package access
+
+import "github.com/gravitational/teleport/api/types"
+
+// isAllowedScopedVerb returns true if the given verb is allowed for the given scoped resource kind. Scoped roles are not sane
+// for use with all resource kind/verb combinations, so we restrict the allowed combinations here.
+func isAllowedScopedRule(kind string, verb string) bool {
+	switch kind {
+	case KindScopedRole:
+		// scoped roles can be read/written, and do not currently contain a concept of a secret.
+		return isReadWriteNoSecrets(verb)
+	case KindScopedRoleAssignment:
+		// scoped role assignments can be read/written, and do not currently contain a concept of a secret.
+		return isReadWriteNoSecrets(verb)
+	case types.KindScopedToken:
+		// scoped tokens can be read/written, and contain secrets.
+		return isReadWriteWithSecrets(verb)
+	default:
+		return false
+	}
+}
+
+// isReadWriteNoSecrets returns true if the given verb conforms to the "read-write-no-secrets" category of verbs.
+func isReadWriteNoSecrets(verb string) bool {
+	return isReadNoSecrets(verb) || isWrite(verb)
+}
+
+// isReadWriteWithSecrets returns true if the given verb conforms to the "read-write-with-secrets" category of verbs.
+func isReadWriteWithSecrets(verb string) bool {
+	return isReadWithSecrets(verb) || isWrite(verb)
+}
+
+// isReadNoSecrets returns true if the given verb conforms to the "read-no-secrets" category of verbs.
+func isReadNoSecrets(verb string) bool {
+	switch verb {
+	case types.VerbList, types.VerbReadNoSecrets:
+		return true
+	default:
+		return false
+	}
+}
+
+// isReadWithSecrets returns true if the given verb conforms to the "read-with-secrets" category of verbs.
+func isReadWithSecrets(verb string) bool {
+	switch verb {
+	case types.VerbList, types.VerbRead:
+		return true
+	default:
+		return false
+	}
+}
+
+// isWrite returns true if the given verb conforms to the "write" category of verbs.
+func isWrite(verb string) bool {
+	switch verb {
+	case types.VerbCreate, types.VerbUpdate, types.VerbDelete:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/lib/scopes/cache/access/access.go b/lib/scopes/cache/access/access.go
new file mode 100644
index 0000000000000..c61e2d1022458
--- /dev/null
+++ b/lib/scopes/cache/access/access.go
@@ -0,0 +1,429 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package access
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/defaults"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/cache/assignments"
+	"github.com/gravitational/teleport/lib/scopes/cache/roles"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// CacheConfig configures the scoped access cache.
+type CacheConfig struct {
+	Events            types.Events
+	Reader            services.ScopedAccessReader
+	MaxRetryPeriod    time.Duration
+	TTLCacheRetention time.Duration
+}
+
+// CheckAndSetDefaults verifies required fields and sets default values as appropriate.
+func (c *CacheConfig) CheckAndSetDefaults() error {
+	if c.Events == nil {
+		return trace.BadParameter("missing required parameter Events in scoped access cache config")
+	}
+
+	if c.Reader == nil {
+		return trace.BadParameter("missing required parameter Reader in scoped access cache config")
+	}
+
+	if c.MaxRetryPeriod <= 0 {
+		c.MaxRetryPeriod = defaults.MaxLongWatcherBackoff
+	}
+
+	if c.TTLCacheRetention <= 0 {
+		c.TTLCacheRetention = time.Second * 3
+	}
+
+	return nil
+}
+
+// state holds the cache state elements.
+type state struct {
+	roles       *roles.RoleCache
+	assignments *assignments.AssignmentCache
+}
+
+// Cache is an in-memory cache for scoped access resources. It provides similar features to the primary
+// teleport cache, but is specifically tailored to support scope-based queries that are difficult to implement
+// with the primary cache.
+type Cache struct {
+	cfg      CacheConfig
+	rw       sync.RWMutex
+	state    state
+	ok       bool
+	closed   bool
+	init     chan struct{}
+	initOnce sync.Once
+	cancel   context.CancelFunc
+	ttlCache *utils.FnCache
+	done     chan struct{}
+}
+
+// NewCache attempts to configure and start a new scoped access cache. The cache is immediately readable if returned,
+// but performance may be suboptimal until watcher init has completed.
+func NewCache(cfg CacheConfig) (*Cache, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	retry, err := retryutils.NewRetryV2(retryutils.RetryV2Config{
+		First:  retryutils.FullJitter(cfg.MaxRetryPeriod / 16),
+		Driver: retryutils.NewExponentialDriver(cfg.MaxRetryPeriod / 16),
+		Max:    cfg.MaxRetryPeriod,
+		Jitter: retryutils.HalfJitter,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	closeContext, cancel := context.WithCancel(context.Background())
+
+	ttlCache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:     cfg.TTLCacheRetention,
+		Context: closeContext,
+	})
+	if err != nil {
+		cancel()
+		return nil, trace.Wrap(err)
+	}
+
+	cache := &Cache{
+		cfg:      cfg,
+		ttlCache: ttlCache,
+		cancel:   cancel,
+		init:     make(chan struct{}),
+		done:     make(chan struct{}),
+	}
+
+	go cache.update(closeContext, retry)
+
+	return cache, nil
+}
+
+// Init returns a channel that is closed when the cache has completed its first init. Used in tests that
+// want to wait for cache readiness. commonly this avoids the effect of the read state apparently
+// "skipping" back in time slightly early in the test if cache init happens after one or more pre-init
+// reads.
+func (c *Cache) Init() <-chan struct{} {
+	return c.init
+}
+
+// GetScopedRole retrieves a scoped role by name.
+func (c *Cache) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.roles.GetScopedRole(ctx, req)
+}
+
+// ListScopedRoles returns a paginated list of scoped roles.
+func (c *Cache) ListScopedRoles(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.roles.ListScopedRoles(ctx, req)
+}
+
+// ListScopedRolesWithFilter returns a paginated list of scoped roles filtered by the provided filter function. This
+// method is used internally to implement access-controls on the ListScopedRoles grpc method.
+func (c *Cache) ListScopedRolesWithFilter(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest, filter func(*scopedaccessv1.ScopedRole) bool) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.roles.ListScopedRolesWithFilter(ctx, req, filter)
+}
+
+// GetScopedRoleAssignment retrieves a scoped role assignment by name.
+func (c *Cache) GetScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.assignments.GetScopedRoleAssignment(ctx, req)
+}
+
+// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+func (c *Cache) ListScopedRoleAssignments(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.assignments.ListScopedRoleAssignments(ctx, req)
+}
+
+// ListScopedRoleAssignmentsWithFilter returns a paginated list of scoped role assignments filtered by the provided
+// filter function. This method is used internally to implement access-controls on the ListScopedRoleAssignments grpc
+// method.
+func (c *Cache) ListScopedRoleAssignmentsWithFilter(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest, filter func(*scopedaccessv1.ScopedRoleAssignment) bool) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	state, err := c.read(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return state.assignments.ListScopedRoleAssignmentsWithFilter(ctx, req, filter)
+}
+
+// PopulatePinnedAssignmentsForUser populates the provided scope pin with all relevant assignments related to the
+// given user. The provided pin must already have its Scope field set.
+func (c *Cache) PopulatePinnedAssignmentsForUser(ctx context.Context, user string, pin *scopesv1.Pin) error {
+	state, err := c.read(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return state.assignments.PopulatePinnedAssignmentsForUser(ctx, user, pin)
+}
+
+// Close stops cache background operations and causes future reads to fail. It is safe to call multiple times.
+func (c *Cache) Close() error {
+	c.cancel()
+
+	// wait for done signal so that all reads with a "happens after" relation to close
+	// fail consistently.
+	<-c.done
+	return nil
+}
+
+// update is the main background loop that handles cache setup, update, and retry.
+func (c *Cache) update(ctx context.Context, retry retryutils.Retry) {
+	defer func() {
+		slog.InfoContext(ctx, "scoped access cache closing")
+		c.rw.Lock()
+		c.closed = true
+		c.rw.Unlock()
+		close(c.done)
+	}()
+
+	for {
+		err := c.fetchAndWatch(ctx, retry)
+		if ctx.Err() != nil {
+			return
+		}
+
+		slog.WarnContext(ctx, "scoped access cache failed", "error", err)
+
+		waitStart := time.Now()
+		select {
+		case <-retry.After():
+			retry.Inc()
+			slog.InfoContext(ctx, "attempting re-init of scoped access cache after delay", "delay", time.Since(waitStart))
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+// fetchAndWatch attempts to establish a watcher with the upstream events service, populate the cache
+// state, and process changes as they come in.
+func (c *Cache) fetchAndWatch(ctx context.Context, retry retryutils.Retry) error {
+	watcher, err := c.cfg.Events.NewWatcher(ctx, types.Watch{
+		Name: "scoped-access-cache",
+		Kinds: []types.WatchKind{
+			{
+				Kind: scopedaccess.KindScopedRole,
+			},
+			{
+				Kind: scopedaccess.KindScopedRoleAssignment,
+			},
+		},
+	})
+	if err != nil {
+		return trace.Errorf("failed to create watcher: %w", err)
+	}
+
+	defer watcher.Close()
+
+	select {
+	case event := <-watcher.Events():
+		if event.Type != types.OpInit {
+			return trace.BadParameter("expected init event, got %v instead", event.Type)
+		}
+	case <-watcher.Done():
+		if err := watcher.Error(); err != nil {
+			// watcher errors are expected if the watcher is closed before init completes.
+			return trace.Errorf("watcher failed while waiting for init event: %w", err)
+		}
+		return trace.Errorf("watcher failed while waiting for init event")
+	case <-time.After(retryutils.SeventhJitter(time.Minute)):
+		return trace.Errorf("timed out waiting for init event from watcher")
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	}
+
+	fetchStart := time.Now()
+	state, err := c.fetch(ctx)
+	if err != nil {
+		return trace.Errorf("failed to fetch initial state: %w", err)
+	}
+
+	slog.InfoContext(ctx, "scoped access cache fetched initial state", "elapsed", time.Since(fetchStart))
+
+	c.rw.Lock()
+	c.state = state
+	c.ok = true
+	c.rw.Unlock()
+
+	slog.InfoContext(ctx, "scoped access cache successfully initialized")
+	retry.Reset()
+
+	// signal that init has completed
+	c.initOnce.Do(func() {
+		close(c.init)
+	})
+
+	// start processing and applying changes
+	for {
+		select {
+		case event := <-watcher.Events():
+			if err := processEvent(ctx, state, event); err != nil {
+				return trace.Errorf("failed to process event: %w", err)
+			}
+		case <-watcher.Done():
+			if err := watcher.Error(); err != nil {
+				// watcher errors are expected if the watcher is closed before init completes.
+				return trace.Errorf("watcher failed during event processing: %w", err)
+			}
+			return trace.Errorf("watcher failed during event processing")
+		case <-ctx.Done():
+			return trace.Wrap(ctx.Err())
+		}
+	}
+}
+
+// processEvent attempts to update the provided cache state with the given event.
+func processEvent(ctx context.Context, state state, event types.Event) error {
+	switch event.Type {
+	case types.OpPut:
+		switch item := event.Resource.(type) {
+		case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]:
+			if err := state.roles.Put(item.UnwrapT()); err != nil {
+				return trace.Errorf("failed to put scoped role %q: %w", item.UnwrapT().GetMetadata().GetName(), err)
+			}
+		case types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]:
+			if err := state.assignments.Put(item.UnwrapT()); err != nil {
+				return trace.Errorf("failed to put scoped role assignment %q: %w", item.UnwrapT().GetMetadata().GetName(), err)
+			}
+		default:
+			return trace.BadParameter("unexpected resource type %T in put event", event.Resource)
+		}
+	case types.OpDelete:
+		switch event.Resource.GetKind() {
+		case scopedaccess.KindScopedRole:
+			state.roles.Delete(event.Resource.GetName())
+		case scopedaccess.KindScopedRoleAssignment:
+			state.assignments.Delete(event.Resource.GetName())
+		default:
+			return trace.BadParameter("unexpected resource kind %q in event delete event", event.Resource.GetKind())
+		}
+	default:
+		slog.WarnContext(ctx, "scoped access cache skipping unexpected event type", "event_type", event.Type)
+		return nil
+	}
+	return nil
+}
+
+// read gets a read-ready cache state suitable for use in serving reads. the underlying state may
+// be the actual primary cache state, or a ttl-cached image if the primary is unavailable.
+func (c *Cache) read(ctx context.Context) (state, error) {
+	c.rw.RLock()
+	primary, ok, closed := c.state, c.ok, c.closed
+	c.rw.RUnlock()
+
+	if closed {
+		// theoretically there's nothing wrong with reading *immediately* after close since cache reads are async/trailing
+		// anyhow, but allowing reads of a closed cache might mask more serious bugs so its better to fail fast.
+		return state{}, trace.Errorf("scoped access cache is closed")
+	}
+
+	if ok {
+		// the primary cache is available, return it immediately.
+		return primary, nil
+	}
+
+	// the cache is not ready, load a frozen readonly copy via ttl cache
+	temp, err := utils.FnCacheGet(ctx, c.ttlCache, "access-cache", func(ctx context.Context) (state, error) {
+		return c.fetch(ctx)
+	})
+
+	// primary may have been concurrently loaded. prefer using it if so.
+	c.rw.RLock()
+	primary, ok = c.state, c.ok
+	c.rw.RUnlock()
+
+	if ok {
+		return primary, nil
+	}
+
+	return temp, trace.Wrap(err)
+}
+
+// fetch loads all currently available roles and assignments from the upstream and builds a cache state.
+func (c *Cache) fetch(ctx context.Context) (state, error) {
+	roleCache := roles.NewRoleCache()
+
+	for role, err := range scopedutils.RangeScopedRoles(ctx, c.cfg.Reader, &scopedaccessv1.ListScopedRolesRequest{}) {
+		if err != nil {
+			return state{}, trace.Wrap(err)
+		}
+
+		if err := roleCache.Put(role); err != nil {
+			return state{}, trace.Wrap(err)
+		}
+	}
+
+	assignmentCache := assignments.NewAssignmentCache()
+
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, c.cfg.Reader, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		if err != nil {
+			return state{}, trace.Wrap(err)
+		}
+
+		if err := assignmentCache.Put(assignment); err != nil {
+			return state{}, trace.Wrap(err)
+		}
+	}
+
+	return state{
+		roles:       roleCache,
+		assignments: assignmentCache,
+	}, nil
+}
diff --git a/lib/scopes/cache/access/access_test.go b/lib/scopes/cache/access/access_test.go
new file mode 100644
index 0000000000000..8da40611e287d
--- /dev/null
+++ b/lib/scopes/cache/access/access_test.go
@@ -0,0 +1,498 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package access
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+// TestScopedAccessCacheReplication verifies basic replication behavior of the scoped access cache.
+func TestScopedAccessCacheReplication(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := local.NewScopedAccessService(backend)
+
+	events := local.NewEventsService(backend)
+
+	// populate roles prior to starting the cache so that we can cover
+	// loading of initial state.
+	var expectedRoleNames []string
+	expectedRoleRevisions := make(map[string]string)
+	for i := 0; i < 10; i++ {
+		name := fmt.Sprintf("role-%d", i)
+		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: newScopedRole(name),
+		})
+		require.NoError(t, err)
+
+		expectedRoleNames = append(expectedRoleNames, name)
+		expectedRoleRevisions[name] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// populate assignments prior to starting the cache so that we can cover
+	// loading of initial state.
+	var expectedAssignmentNames []string
+	for i := 0; i < 10; i++ {
+		assignment := newScopedRoleAssignment(expectedRoleNames[i])
+		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: assignment,
+			RoleRevisions: map[string]string{
+				expectedRoleNames[i]: expectedRoleRevisions[expectedRoleNames[i]],
+			},
+		})
+		require.NoError(t, err)
+
+		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	// start the cache with the service and events.
+	cache, err := NewCache(CacheConfig{
+		Events:            events,
+		Reader:            service,
+		TTLCacheRetention: time.Hour, // ensures state-changes are from watcher events rather than ttl cache reloads
+	})
+	require.NoError(t, err)
+
+	defer cache.Close()
+
+	// verify that initial role states are immediately available
+	var gotRoleNames []string
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedRoleNames, gotRoleNames)
+
+	// verify that initial assignment states are immediately available
+	var gotAssignmentNames []string
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, cache, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedAssignmentNames, gotAssignmentNames)
+
+	// perform additional role writes to cover event replication
+	for i := 10; i < 20; i++ {
+		name := fmt.Sprintf("role-%d", i)
+		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: newScopedRole(name),
+		})
+		require.NoError(t, err)
+
+		expectedRoleNames = append(expectedRoleNames, name)
+		expectedRoleRevisions[name] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// perform additional assignment writes to cover event replication
+	for i := 10; i < 20; i++ {
+		assignment := newScopedRoleAssignment(expectedRoleNames[i])
+		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: assignment,
+			RoleRevisions: map[string]string{
+				expectedRoleNames[i]: expectedRoleRevisions[expectedRoleNames[i]],
+			},
+		})
+		require.NoError(t, err)
+
+		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	// wait for the cache to replicate the new roles
+	waitForRoleCondition(t, cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		t.Helper()
+		return len(roles) >= len(expectedRoleNames)
+	})
+
+	gotRoleNames = nil
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+	require.ElementsMatch(t, expectedRoleNames, gotRoleNames)
+
+	// wait for the cache to replicate the new assignments
+	waitForAssignmentCondition(t, cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		t.Helper()
+		return len(assignments) >= len(expectedAssignmentNames)
+	})
+
+	gotAssignmentNames = nil
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, cache, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+	require.ElementsMatch(t, expectedAssignmentNames, gotAssignmentNames)
+
+	// test that cache can handle updates to existing roles (NOTE: no corellary for assignments)
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+
+		role.Metadata.Labels = map[string]string{"updated": "true"}
+
+		crsp, err := service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+
+		expectedRoleRevisions[role.GetMetadata().GetName()] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	waitForRoleCondition(t, cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		t.Helper()
+		for _, role := range roles {
+			if role.GetMetadata().GetLabels()["updated"] != "true" {
+				return false
+			}
+		}
+		return true
+	})
+
+	// test that cache can handle partial deletes for assignments
+	for _, name := range expectedAssignmentNames[0:10] {
+		_, err := service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+			Name: name,
+		})
+		require.NoError(t, err)
+	}
+
+	waitForAssignmentCondition(t, cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		t.Helper()
+		return len(assignments) <= len(expectedAssignmentNames)-10
+	})
+
+	gotAssignmentNames = nil
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, cache, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedAssignmentNames[10:], gotAssignmentNames)
+
+	// test that cache can handle delete of all assignments
+	for _, name := range expectedAssignmentNames[10:] {
+		_, err := service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+			Name: name,
+		})
+		require.NoError(t, err)
+	}
+
+	waitForAssignmentCondition(t, cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		t.Helper()
+		return len(assignments) == 0
+	})
+
+	// test that cache can handle partial deletes for roles
+	for _, name := range expectedRoleNames[0:10] {
+		_, err := service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+			Name: name,
+		})
+		require.NoError(t, err)
+	}
+
+	waitForRoleCondition(t, cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		t.Helper()
+		return len(roles) <= len(expectedRoleNames)-10
+	})
+
+	gotRoleNames = nil
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+	require.ElementsMatch(t, expectedRoleNames[10:], gotRoleNames)
+
+	// test that cache can handle delete of all roles
+	for _, name := range expectedRoleNames[10:] {
+		_, err := service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+			Name: name,
+		})
+		require.NoError(t, err)
+	}
+
+	waitForRoleCondition(t, cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		t.Helper()
+		return len(roles) == 0
+	})
+}
+
+// TestScopedAccessCacheFallback verified the fallback behavior of the scoped access cache
+// when the upstream event system is unavailable.
+func TestScopedAccessCacheFallback(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := local.NewScopedAccessService(backend)
+
+	events := &neverEvents{} // use a fake events service that never initializes watchers
+
+	// populate roles prior to starting the cache so that we can cover
+	// loading of initial state.
+	var expectedRoleNames []string
+	expectedRoleRevisions := make(map[string]string)
+	for i := 0; i < 10; i++ {
+		name := fmt.Sprintf("role-%d", i)
+		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: newScopedRole(name),
+		})
+		require.NoError(t, err)
+
+		expectedRoleNames = append(expectedRoleNames, name)
+		expectedRoleRevisions[name] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// populate assignments prior to starting the cache so that we can cover
+	// loading of initial state.
+	var expectedAssignmentNames []string
+	for i := 0; i < 10; i++ {
+		assignment := newScopedRoleAssignment(expectedRoleNames[i])
+		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: assignment,
+			RoleRevisions: map[string]string{
+				expectedRoleNames[i]: expectedRoleRevisions[expectedRoleNames[i]],
+			},
+		})
+		require.NoError(t, err)
+
+		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	// start the cache with the service and never-events.
+	cache, err := NewCache(CacheConfig{
+		Events:            events,
+		Reader:            service,
+		TTLCacheRetention: time.Millisecond * 10, // ensure we don't spend more than 1 cycle waiting
+	})
+	require.NoError(t, err)
+
+	defer cache.Close()
+
+	// verify that initial role states are immediately available
+	var gotRoleNames []string
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedRoleNames, gotRoleNames)
+
+	// verify that initial assignment states are immediately available
+	var gotAssignmentNames []string
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, cache, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedAssignmentNames, gotAssignmentNames)
+
+	// perform additional role writes to cover subsequent ttl-cache image loads
+	for i := 10; i < 20; i++ {
+		name := fmt.Sprintf("role-%d", i)
+		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: newScopedRole(name),
+		})
+		require.NoError(t, err)
+
+		expectedRoleNames = append(expectedRoleNames, name)
+		expectedRoleRevisions[name] = crsp.GetRole().GetMetadata().GetRevision()
+	}
+
+	// perform additional assignment writes to cover ttl-cache image loads
+	for i := 10; i < 20; i++ {
+		assignment := newScopedRoleAssignment(expectedRoleNames[i])
+		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			Assignment: assignment,
+			RoleRevisions: map[string]string{
+				expectedRoleNames[i]: expectedRoleRevisions[expectedRoleNames[i]],
+			},
+		})
+		require.NoError(t, err)
+
+		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	// wait for the new roles to become visible
+	waitForRoleCondition(t, cache, func(roles []*scopedaccessv1.ScopedRole) bool {
+		t.Helper()
+		return len(roles) >= len(expectedRoleNames)
+	})
+
+	gotRoleNames = nil
+	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+	require.ElementsMatch(t, expectedRoleNames, gotRoleNames)
+
+	// wait for the new assignments to become visible
+	waitForAssignmentCondition(t, cache, func(assignments []*scopedaccessv1.ScopedRoleAssignment) bool {
+		t.Helper()
+		return len(assignments) >= len(expectedAssignmentNames)
+	})
+
+	gotAssignmentNames = nil
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, cache, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+	require.ElementsMatch(t, expectedAssignmentNames, gotAssignmentNames)
+}
+
+func newScopedRole(name string) *scopedaccessv1.ScopedRole {
+	return &scopedaccessv1.ScopedRole{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleSpec{
+			AssignableScopes: []string{"/foo"},
+		},
+		Version: types.V1,
+	}
+}
+
+func newScopedRoleAssignment(roleName string) *scopedaccessv1.ScopedRoleAssignment {
+	return &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "alice",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  roleName,
+					Scope: "/foo",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+}
+
+func waitForRoleCondition(t *testing.T, reader services.ScopedRoleReader, condition func([]*scopedaccessv1.ScopedRole) bool) {
+	t.Helper()
+	timeout := time.After(30 * time.Second)
+	for {
+		var roles []*scopedaccessv1.ScopedRole
+		for role, err := range scopedutils.RangeScopedRoles(t.Context(), reader, &scopedaccessv1.ListScopedRolesRequest{}) {
+			require.NoError(t, err)
+			roles = append(roles, role)
+		}
+
+		if condition(roles) {
+			return
+		}
+
+		select {
+		case <-time.After(time.Millisecond * 120):
+		case <-timeout:
+			require.FailNow(t, "timeout waiting for role condition")
+		}
+	}
+}
+
+func waitForAssignmentCondition(t *testing.T, reader services.ScopedRoleAssignmentReader, condition func([]*scopedaccessv1.ScopedRoleAssignment) bool) {
+	t.Helper()
+	timeout := time.After(30 * time.Second)
+	for {
+		var assignments []*scopedaccessv1.ScopedRoleAssignment
+		for assignment, err := range scopedutils.RangeScopedRoleAssignments(t.Context(), reader, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+			require.NoError(t, err)
+			assignments = append(assignments, assignment)
+		}
+
+		if condition(assignments) {
+			return
+		}
+
+		select {
+		case <-time.After(time.Millisecond * 200):
+		case <-timeout:
+			require.FailNow(t, "timeout waiting for assignment condition")
+		}
+	}
+}
+
+// neverEvents is a fake event service whose watchers never initialize.
+type neverEvents struct{}
+
+func (e *neverEvents) NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error) {
+	return &neverWatcher{}, nil
+}
+
+// neverWatcher is a fake watcher that never initializes.
+type neverWatcher struct{}
+
+func (w *neverWatcher) Events() <-chan types.Event {
+	return nil
+}
+
+func (w *neverWatcher) Done() <-chan struct{} {
+	return nil
+}
+
+func (w *neverWatcher) Close() error {
+	return nil
+}
+
+func (w *neverWatcher) Error() error {
+	return nil
+}
diff --git a/lib/scopes/cache/assignments/assignment_cache.go b/lib/scopes/cache/assignments/assignment_cache.go
new file mode 100644
index 0000000000000..0a30b72ce8962
--- /dev/null
+++ b/lib/scopes/cache/assignments/assignment_cache.go
@@ -0,0 +1,194 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package assignments
+
+import (
+	"context"
+	"slices"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/cache"
+)
+
+const (
+	defaultPageSize = 256
+	maxPageSize     = 1024
+)
+
+// AssignmentCache is a cache for scoped role assignments.
+type AssignmentCache struct {
+	cache *cache.Cache[*scopedaccessv1.ScopedRoleAssignment, string]
+}
+
+// NewAssignmentCache creates a new assignment cache instance.
+func NewAssignmentCache() *AssignmentCache {
+	return &AssignmentCache{
+		cache: cache.Must(cache.Config[*scopedaccessv1.ScopedRoleAssignment, string]{
+			Scope: func(assignment *scopedaccessv1.ScopedRoleAssignment) string {
+				return assignment.GetScope()
+			},
+			Key: func(assignment *scopedaccessv1.ScopedRoleAssignment) string {
+				return assignment.GetMetadata().GetName()
+			},
+			Clone: proto.CloneOf[*scopedaccessv1.ScopedRoleAssignment],
+		}),
+	}
+}
+
+// GetScopedRoleAssignment gets an assignment by name.
+func (c *AssignmentCache) GetScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error) {
+	if req.GetName() == "" {
+		return nil, trace.BadParameter("missing scoped role assignment name in get request")
+	}
+
+	assignment, ok := c.cache.Get(req.GetName())
+	if !ok {
+		return nil, trace.NotFound("scoped role assignment %q not found", req.GetName())
+	}
+
+	return &scopedaccessv1.GetScopedRoleAssignmentResponse{
+		Assignment: assignment,
+	}, nil
+}
+
+// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+func (c *AssignmentCache) ListScopedRoleAssignments(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	return c.ListScopedRoleAssignmentsWithFilter(ctx, req, func(*scopedaccessv1.ScopedRoleAssignment) bool { return true })
+}
+
+// ListScopedRoleAssignmentsWithFilter returns a paginated list of scoped role assignments filtered by the provided filter
+// function. This method is used internally to implement access-controls on the ListScopedRoleAssignments grpc method.
+func (c *AssignmentCache) ListScopedRoleAssignmentsWithFilter(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest, externalFilter func(*scopedaccessv1.ScopedRoleAssignment) bool) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	pageSize := int(req.GetPageSize())
+	if pageSize <= 0 {
+		pageSize = defaultPageSize
+	}
+	if pageSize > maxPageSize {
+		pageSize = maxPageSize
+	}
+
+	if req.GetResourceScope() != nil && req.GetAssignedScope() != nil {
+		return nil, trace.BadParameter("cannot filter by both resource scope and assigned scope simultaneously")
+	}
+
+	filter := func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
+		if req.GetUser() != "" && assignment.GetSpec().GetUser() != req.GetUser() {
+			return false
+		}
+
+		if req.GetRole() != "" {
+			if !slices.ContainsFunc(assignment.GetSpec().Assignments, func(a *scopedaccessv1.Assignment) bool { return a.GetRole() == req.GetRole() }) {
+				// if the assignment does not have the requested role, skip it
+				return false
+			}
+		}
+
+		// apply the external filter after the basic request filter as the externally provided filter
+		// is often more expensive to evaluate.
+		if !externalFilter(assignment) {
+			return false
+		}
+
+		return true
+	}
+
+	cursor, err := cache.DecodeStringCursor(req.GetPageToken())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// resources subject to policy scope root is basically the scoped resource equivalent
+	// of a "get all". this is a reasonable default for most queries.
+	getter := c.cache.ResourcesSubjectToPolicyScope
+	scope := scopes.Root
+
+	// if a resource scope filter has been provided, the user has specified a custom scope/mode to
+	// query by.
+	if req.GetResourceScope() != nil {
+		// a resource-scope based filter has been provided
+		switch req.GetResourceScope().GetMode() {
+		case scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE:
+			getter = c.cache.ResourcesSubjectToPolicyScope
+		case scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE:
+			getter = c.cache.PoliciesApplicableToResourceScope
+		default:
+			return nil, trace.BadParameter("unsupported or unspecified scoping mode %q in scoped role assignment resource scope filter", req.GetResourceScope().GetMode())
+		}
+		scope = req.GetResourceScope().GetScope()
+	}
+
+	if req.GetAssignedScope() != nil {
+		// NOTE: we eventually want to be able to query assignments by the scopes at which they assign roles,
+		// instead of just resource scope. this is important for introspection/auditing but not necessary for
+		// the core funcationality of teleport until we've fully migrated to PDP. For now, the implementation has
+		// been deferred. (will require implementation of a more complex caching structure where each resource
+		// will be associable with multiple scopes)
+		return nil, trace.NotImplemented("assigned scope filtering for scoped role assignments is not yet supported")
+	}
+
+	var out []*scopedaccessv1.ScopedRoleAssignment
+	var nextCursor cache.Cursor[string]
+Outer:
+	for scope := range getter(scope, c.cache.WithFilter(filter), c.cache.WithCursor(cursor)) {
+		for assignment := range scope.Items() {
+			if len(out) == pageSize {
+				nextCursor = cache.Cursor[string]{
+					Scope: scope.Scope(),
+					Key:   assignment.GetMetadata().GetName(),
+				}
+				break Outer
+			}
+			out = append(out, assignment)
+		}
+	}
+
+	var nextPageToken string
+	if !nextCursor.IsZero() {
+		nextPageToken, err = cache.EncodeStringCursor(nextCursor)
+		if err != nil {
+			return nil, trace.Errorf("failed to encode cursor %+v: %w (this is a bug)", nextCursor, err)
+		}
+	}
+
+	return &scopedaccessv1.ListScopedRoleAssignmentsResponse{
+		Assignments:   out,
+		NextPageToken: nextPageToken,
+	}, nil
+}
+
+// Put adds a new assignment to the cache. It will overwrite any existing assignment with the same name.
+func (c *AssignmentCache) Put(assignment *scopedaccessv1.ScopedRoleAssignment) error {
+	if err := scopedaccess.WeakValidateAssignment(assignment); err != nil {
+		return trace.Wrap(err)
+	}
+
+	c.cache.Put(assignment)
+	return nil
+}
+
+// Del removes an assignment from the cache by name.
+func (c *AssignmentCache) Delete(name string) {
+	c.cache.Del(name)
+}
diff --git a/lib/scopes/cache/assignments/assignment_cache_test.go b/lib/scopes/cache/assignments/assignment_cache_test.go
new file mode 100644
index 0000000000000..6c80e949e3cf1
--- /dev/null
+++ b/lib/scopes/cache/assignments/assignment_cache_test.go
@@ -0,0 +1,646 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package assignments
+
+import (
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	headerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopespb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+)
+
+// TestListScopedRoleAssignmentsScenarios tests particular more tricky ListScopedRoleAssignments scenarios, such
+// as attempts to use an out-of-band cursor to read values outside of the target scope.
+func TestListScopedRoleAssignmentsScenarios(t *testing.T) {
+	t.Parallel()
+
+	assignments := []*scopedaccessv1.ScopedRoleAssignment{
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-03",
+			},
+			Scope: "/aa/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-05",
+						Scope: "/aa/bb",
+					},
+					{
+						Role:  "role-06",
+						Scope: "/aa/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-03",
+			},
+			Scope: "/aa/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-05",
+						Scope: "/aa/bb",
+					},
+					{
+						Role:  "role-06",
+						Scope: "/aa/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "carol-01",
+			},
+			Scope: "/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "carol",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-07",
+						Scope: "/bb",
+					},
+					{
+						Role:  "role-08",
+						Scope: "/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	cache := NewAssignmentCache()
+	for _, assignment := range assignments {
+		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+		cache.Put(assignment)
+
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, rsp.GetAssignment())
+	}
+
+	// verify expected behavior for standard cursors in resources subject to scope mode
+	rsp, err := cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:bob-02@/aa",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+
+	// try to inject a malicious root out-of-band cursor in resources subject to scope mode (no effect)
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:bob-01@/",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+
+	// try to inject a malicious orthogonal out-of-band cursor in resources subject to scope mode (no effect)
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:carol-01@/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+
+	// verify expected behavior for standard cursors in policies applicable to scope mode
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:bob-01@/",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"bob-01", "alice-02", "bob-02"}, collectAssignmentNames(rsp.Assignments))
+
+	// try to inject a malicious child out-of-band cursor in policies applicable to scope mode (effect is
+	// to ignore all items in valid query path).
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:bob-03@/aa/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Empty(t, collectAssignmentNames(rsp.Assignments))
+
+	// try to inject a malicious orthogonal out-of-band cursor in policies applicable to scope mode (effect is to
+	// ignore root, but process leaf normally).
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:carol-01@/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"alice-02", "bob-02"}, collectAssignmentNames(rsp.Assignments))
+
+	// verify rejection of unknown cursor version
+	_, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v2:bob-02@/aa",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+}
+
+// TestListScopedRoleAssignmentsBasics tests some basic functionality of the ListScopedRoleAssignments method.
+func TestListScopedRoleAssignmentsBasics(t *testing.T) {
+	t.Parallel()
+
+	assignments := []*scopedaccessv1.ScopedRoleAssignment{
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "carol-01",
+			},
+			Scope: "/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "carol",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-05",
+						Scope: "/bb",
+					},
+					{
+						Role:  "role-06",
+						Scope: "/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	tts := []struct {
+		name   string
+		req    *scopedaccessv1.ListScopedRoleAssignmentsRequest
+		expect [][]string
+	}{
+		{
+			name: "all single page explicit excess",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				PageSize: int32(len(assignments) + 1),
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+					"alice-02",
+					"bob-02",
+					"carol-01",
+				},
+			},
+		},
+		{
+			name: "all single page implicit excess",
+			req:  &scopedaccessv1.ListScopedRoleAssignmentsRequest{},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+					"alice-02",
+					"bob-02",
+					"carol-01",
+				},
+			},
+		},
+		{
+			name: "all single page exact",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				PageSize: int32(len(assignments)),
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+					"alice-02",
+					"bob-02",
+					"carol-01",
+				},
+			},
+		},
+		{
+			name: "all multi page",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				PageSize: 2,
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+				},
+				{
+					"alice-02",
+					"bob-02",
+				},
+				{
+					"carol-01",
+				},
+			},
+		},
+		{
+			name: "user single page",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				User: "alice",
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"alice-02",
+				},
+			},
+		},
+		{
+			name: "user multi page",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				PageSize: 1,
+				User:     "alice",
+			},
+			expect: [][]string{
+				{"alice-01"},
+				{"alice-02"},
+			},
+		},
+		{
+			name: "user nonexistent",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				User: "dave",
+			},
+			expect: nil,
+		},
+		{
+			name: "role single page",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				Role: "role-01",
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+				},
+			},
+		},
+		{
+			name: "role multi page",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				PageSize: 1,
+				Role:     "role-01",
+			},
+			expect: [][]string{
+				{"alice-01"},
+				{"bob-01"},
+			},
+		},
+		{
+			name: "role nonexistent",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				Role: "role-99",
+			},
+			expect: nil,
+		},
+		{
+			name: "resource scope root",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/",
+				},
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+					"alice-02",
+					"bob-02",
+					"carol-01",
+				},
+			},
+		},
+		{
+			name: "resource scope non-root",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/aa",
+				},
+			},
+			expect: [][]string{
+				{
+					"alice-02",
+					"bob-02",
+				},
+			},
+		},
+		{
+			name: "policy scope root",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/",
+				},
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+				},
+			},
+		},
+		{
+			name: "policy scope non-root",
+			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/aa",
+				},
+			},
+			expect: [][]string{
+				{
+					"alice-01",
+					"bob-01",
+					"alice-02",
+					"bob-02",
+				},
+			},
+		},
+	}
+
+	cache := NewAssignmentCache()
+	for _, assignment := range assignments {
+		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+		cache.Put(assignment)
+
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, rsp.GetAssignment())
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			var out [][]string
+			for {
+				rsp, err := cache.ListScopedRoleAssignments(t.Context(), tt.req)
+				require.NoError(t, err)
+
+				if len(rsp.Assignments) == 0 {
+					break
+				}
+
+				out = append(out, collectAssignmentNames(rsp.Assignments))
+
+				if rsp.NextPageToken == "" {
+					break
+				}
+
+				tt.req.PageToken = rsp.NextPageToken
+			}
+
+			require.Equal(t, tt.expect, out)
+		})
+	}
+}
+
+func collectAssignmentNames(assignments []*scopedaccessv1.ScopedRoleAssignment) []string {
+	var names []string
+	for _, assignment := range assignments {
+		names = append(names, assignment.Metadata.Name)
+	}
+	return names
+}
diff --git a/lib/scopes/cache/assignments/pinning.go b/lib/scopes/cache/assignments/pinning.go
new file mode 100644
index 0000000000000..510548b3e187b
--- /dev/null
+++ b/lib/scopes/cache/assignments/pinning.go
@@ -0,0 +1,131 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package assignments
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/cache"
+	"github.com/gravitational/teleport/lib/scopes/pinning"
+)
+
+// PopulatePinnedAssignmentsForUser populates the provided scope pin with all relevant assignments related to the
+// given user. The provided pin must already have its Scope field set.
+func (c *AssignmentCache) PopulatePinnedAssignmentsForUser(ctx context.Context, user string, pin *scopesv1.Pin) error {
+	if user == "" {
+		return trace.BadParameter("missing user in scoped assignment population request")
+	}
+	if pin == nil {
+		return trace.BadParameter("missing scope pin in assignment population request for user %q", user)
+	}
+
+	// validate the pin scope before proceeding. in theory the caller should be auth certificate generation logic which has
+	// already done strong validation, but a malformed scope pin would be a bad thing to have and catching the malformed scope
+	// during later pin validation steps produces confusing error messages.
+	if err := scopes.WeakValidate(pin.GetScope()); err != nil {
+		return trace.Errorf("invalid scope %q in assignment population request for user %q: %w", pin.GetScope(), user, err)
+	}
+
+	if pin.GetAssignments() == nil {
+		pin.Assignments = make(map[string]*scopesv1.PinnedAssignments)
+	}
+
+	if len(pin.GetAssignments()) != 0 {
+		return trace.BadParameter("assignment population attempted with pin that already contains assignments (this is a bug)")
+	}
+
+	// rather than just normalizing/deduplicating the individual subassignments manually, its
+	// easier to just build an ephemeral scope cache and let it do the work for us.
+	type entry struct {
+		scope string
+		role  string
+		key   string
+	}
+
+	ec := cache.Must(cache.Config[entry, string]{
+		Scope: func(e entry) string {
+			return e.scope
+		},
+		Key: func(e entry) string {
+			return e.key
+		},
+	})
+
+	// all non-orthogonal assignments for this user *may* assign roles relevant to this pin
+	assignments := c.cache.AllNonOrthogonalResources(pin.Scope, c.cache.WithFilter(func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
+		return assignment.GetSpec().GetUser() == user
+	}))
+
+	// iterate over all potentially relevant assignments and store each assigned role in the ephemeral cache
+	for scope := range assignments {
+		for assignment := range scope.Items() {
+			for subAssignment := range scopedaccess.WeakValidatedSubAssignments(assignment) {
+				if scopes.Compare(subAssignment.GetScope(), pin.GetScope()) == scopes.Orthogonal {
+					// a non-orthogonal assignment may still have sub-assignments that are orthogonal to the pin scope
+					// (e.g. an assignment at `/foo` is non-orthogonal to a pin at `/foo/bar`, but may contain a
+					// sub-assignment at `/foo/bin`).
+					continue
+				}
+				if subAssignment.GetRole() == "" {
+					// some future-proofing, we don't currently support sub-assignments without a role, but may at some
+					// point in the future.
+					continue
+				}
+				ec.Put(entry{
+					scope: subAssignment.GetScope(),
+					role:  subAssignment.GetRole(),
+					key:   subAssignment.GetRole() + "@" + subAssignment.GetScope(), // to satisfy cmp.Ordered
+				})
+			}
+		}
+	}
+
+	// iterate the full contents of the ephemeral cache and populate the pin with the relevant assignments.
+	for scope := range ec.ResourcesSubjectToPolicyScope(scopes.Root) {
+		var roles []string
+		for entry := range scope.Items() {
+			roles = append(roles, entry.role)
+		}
+		pin.Assignments[scope.Scope()] = &scopesv1.PinnedAssignments{
+			Roles: roles,
+		}
+	}
+
+	if len(pin.GetAssignments()) == 0 {
+		// in theory there isn't any harm in allowing pins to be created without any assignments, but we're choosing to err
+		// on the side of caution for now. this limitation may be lifted later. this condition would also be caught by standard
+		// strong validation, but the resulting error message would be confusing.
+		// NOTE: if lifting this restriction, the equivalent check in the strong pin validation logic must also be lifted.
+		return trace.NotFound("no scoped role assignments found for user %q applicable to pinned scope %q", user, pin.GetScope())
+	}
+
+	// perform a final weak validation of the pin to ensure that it is well-formed. this should be redundant since auth performs strong
+	// validation of all pins prior to encoding them on certs, but its worth being defensive due to how critical scope pins are.
+	if err := pinning.WeakValidate(pin); err != nil {
+		return trace.Errorf("pin for scope %q was invalid post-population (this is a bug): %w", pin.GetScope(), trace.Wrap(err))
+	}
+
+	return nil
+}
diff --git a/lib/scopes/cache/assignments/pinning_test.go b/lib/scopes/cache/assignments/pinning_test.go
new file mode 100644
index 0000000000000..55e0a3ac02604
--- /dev/null
+++ b/lib/scopes/cache/assignments/pinning_test.go
@@ -0,0 +1,283 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package assignments
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	headerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+)
+
+// TestPopulatePinnedAssignmentsForUser verifies the basic expected behavior of scope pin assignment population.
+func TestPopulatePinnedAssignmentsForUser(t *testing.T) {
+	t.Parallel()
+
+	assignments := []*scopedaccessv1.ScopedRoleAssignment{
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-01",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-02",
+						Scope: "/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-02",
+			},
+			Scope: "/aa",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "bob",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-03",
+						Scope: "/aa",
+					},
+					{
+						Role:  "role-04",
+						Scope: "/aa/bb",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "alice-03",
+			},
+			Scope: "/aa/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-05",
+						Scope: "/aa/bb",
+					},
+					{
+						Role:  "role-06",
+						Scope: "/aa/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "bob-03",
+			},
+			Scope: "/aa/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-05",
+						Scope: "/aa/bb",
+					},
+					{
+						Role:  "role-06",
+						Scope: "/aa/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerpb.Metadata{
+				Name: "carol-01",
+			},
+			Scope: "/bb",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "carol",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "role-07",
+						Scope: "/bb",
+					},
+					{
+						Role:  "role-08",
+						Scope: "/bb/cc",
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	cache := NewAssignmentCache()
+	for _, assignment := range assignments {
+		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+		cache.Put(assignment)
+
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			Name: assignment.GetMetadata().GetName(),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, rsp.GetAssignment())
+	}
+
+	tts := []struct {
+		name   string
+		user   string
+		pin    *scopesv1.Pin
+		ok     bool
+		expect *scopesv1.Pin
+	}{
+		{
+			name: "descendant",
+			user: "bob",
+			pin: &scopesv1.Pin{
+				Scope: "/aa/bb",
+			},
+			ok: true,
+			expect: &scopesv1.Pin{
+				Scope: "/aa/bb",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/aa": {
+						Roles: []string{"role-01", "role-03"},
+					},
+					"/aa/bb": {
+						Roles: []string{"role-04"},
+					},
+				},
+			},
+		},
+		{
+			name: "ancestral",
+			user: "alice",
+			pin: &scopesv1.Pin{
+				Scope: "/",
+			},
+			ok: true,
+			expect: &scopesv1.Pin{
+				Scope: "/",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/aa": {
+						Roles: []string{"role-01", "role-03"},
+					},
+					"/aa/bb": {
+						Roles: []string{"role-04", "role-05"},
+					},
+					"/aa/bb/cc": {
+						Roles: []string{"role-06"},
+					},
+					"/bb": {
+						Roles: []string{"role-02"},
+					},
+				},
+			},
+		},
+		{
+			name: "orthogonal",
+			user: "carol",
+			pin: &scopesv1.Pin{
+				Scope: "/xx",
+			},
+			ok: false,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			pin := proto.CloneOf(tt.pin)
+			err := cache.PopulatePinnedAssignmentsForUser(t.Context(), tt.user, pin)
+			if tt.ok {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				return
+			}
+			require.NotNil(t, pin)
+			require.Empty(t, cmp.Diff(pin, tt.expect, protocmp.Transform()))
+		})
+	}
+}
diff --git a/lib/scopes/cache/cache.go b/lib/scopes/cache/cache.go
index 6af901ce6337c..2030f7c853e5c 100644
--- a/lib/scopes/cache/cache.go
+++ b/lib/scopes/cache/cache.go
@@ -44,19 +44,11 @@ func (c *Cursor[K]) IsZero() bool {
 }
 
 // Option is a functional option that can be used to configure cache query behavior.
-type Option[K cmp.Ordered] func(*options[K])
+type Option[T any, K cmp.Ordered] func(*options[T, K])
 
-type options[K cmp.Ordered] struct {
+type options[T any, K cmp.Ordered] struct {
 	cursor Cursor[K]
-}
-
-// WithCursor specifies a cursor to use when querying the cache. If specified, the cache will
-// resume iteration from position described by the cursor. Passing in a zero value cursor
-// has no effect.
-func WithCursor[K cmp.Ordered](cursor Cursor[K]) Option[K] {
-	return func(o *options[K]) {
-		o.cursor = cursor
-	}
+	filter func(T) bool
 }
 
 // Config configures a cache.
@@ -122,19 +114,61 @@ func New[T any, K cmp.Ordered](cfg Config[T, K]) (*Cache[T, K], error) {
 	}, nil
 }
 
+// Must is a convenience function for creating a cache instance that panics on error. Cache creation only
+// panics if required configuration values are missing, so statically configured caches can confidently
+// use this helper to avoid unnecessary error ceremony.
+func Must[T any, K cmp.Ordered](cfg Config[T, K]) *Cache[T, K] {
+	cache, err := New(cfg)
+	if err != nil {
+		panic(err)
+	}
+	return cache
+}
+
 // KeyOf returns the primary key of the given value.
 func (c *Cache[T, K]) KeyOf(value T) K {
 	return c.cfg.Key(value)
 }
 
+// WithCursor specifies a cursor to use when querying the cache. If specified, the cache will
+// resume iteration from position described by the cursor. Passing in a zero value cursor
+// has no effect. Functional option is a method to work around go's terrible type inference.
+func (c *Cache[T, K]) WithCursor(cursor Cursor[K]) Option[T, K] {
+	return func(o *options[T, K]) {
+		o.cursor = cursor
+	}
+}
+
+// WithFilter specifies a filter to be used when querying the cache. If specified, the cache
+// will skip yielding items that do not match the filter. Functional option is a method to
+// work around go's terrible type inference.
+func (c *Cache[T, K]) WithFilter(filter func(T) bool) Option[T, K] {
+	return func(o *options[T, K]) {
+		o.filter = filter
+	}
+}
+
+// Get retrieves the value associated with the given primary key.
+func (c *Cache[T, K]) Get(key K) (T, bool) {
+	c.rw.RLock()
+	defer c.rw.RUnlock()
+
+	value, ok := c.items[key]
+	if !ok {
+		return *new(T), false
+	}
+
+	return c.cfg.Clone(value), true
+}
+
 // PoliciesApplicableToResourceScope iterates over the cached items using policy-application rules (i.e.
 // a descending iteration from root, through the leaf of the specified scope).
-func (c *Cache[T, K]) PoliciesApplicableToResourceScope(scope string, opts ...Option[K]) iter.Seq[ScopedItems[T]] {
+func (c *Cache[T, K]) PoliciesApplicableToResourceScope(scope string, opts ...Option[T, K]) iter.Seq[ScopedItems[T]] {
 	return func(yield func(ScopedItems[T]) bool) {
 		c.rw.RLock()
 		defer c.rw.RUnlock()
 
-		var options options[K]
+		var options options[T, K]
 		for _, opt := range opts {
 			opt(&options)
 		}
@@ -153,11 +187,8 @@ func (c *Cache[T, K]) PoliciesApplicableToResourceScope(scope string, opts ...Op
 		defer descender.Stop()
 
 		for segment := range scopes.DescendingSegments(scope) {
-			// yield the current scope if we've finished descending to resume position and it is non-empty
-			if descender.Yield() && current.members.Len() != 0 {
-				if !yield(newScopedItems(visited, descender.StartKey(), current.members, c.items, c.cfg.Clone)) {
-					return
-				}
+			if !maybeYieldScopedItems(yield, visited, &descender, current.members, c.items, c.cfg.Clone, options.filter) {
+				return
 			}
 
 			// get next scope if it exists
@@ -175,22 +206,20 @@ func (c *Cache[T, K]) PoliciesApplicableToResourceScope(scope string, opts ...Op
 		}
 
 		// yield the final scope if it is non-empty
-		if current.members.Len() != 0 {
-			if !yield(newScopedItems(visited, descender.StartKey(), current.members, c.items, c.cfg.Clone)) {
-				return
-			}
+		if !maybeYieldScopedItems(yield, visited, &descender, current.members, c.items, c.cfg.Clone, options.filter) {
+			return
 		}
 	}
 }
 
 // ResourcesSubjectToPolicyScope iterates over the cached items using resources-subjugation rules (i.e.
 // an exhaustive descending iteration of the specified scope and all of its descendants).
-func (c *Cache[T, K]) ResourcesSubjectToPolicyScope(scope string, opts ...Option[K]) iter.Seq[ScopedItems[T]] {
+func (c *Cache[T, K]) ResourcesSubjectToPolicyScope(scope string, opts ...Option[T, K]) iter.Seq[ScopedItems[T]] {
 	return func(yield func(ScopedItems[T]) bool) {
 		c.rw.RLock()
 		defer c.rw.RUnlock()
 
-		var options options[K]
+		var options options[T, K]
 		for _, opt := range opts {
 			opt(&options)
 		}
@@ -226,7 +255,64 @@ func (c *Cache[T, K]) ResourcesSubjectToPolicyScope(scope string, opts ...Option
 		}
 
 		// recursively yield starting position and all of its descendants
-		if !recursiveYield(yield, visited, &descender, current, c.items, c.cfg.Clone) {
+		if !recursiveYield(yield, visited, &descender, current, c.items, c.cfg.Clone, options.filter) {
+			return
+		}
+	}
+}
+
+// AllNonOrthogonalResources returns all resources at scopes non-orhthogonal to the given scope.  For example, given the
+// scope '/foo', this will return resources at '/', '/foo', '/foo/bar', etc, but not '/bar'. This operation is less typical
+// than either PoliciesApplicableToResourceScope or ResourcesSubjectToPolicyScope.  Currently, the only operation that wants
+// this kind of query is scope pin generation, which must discover all policies that might apply to access at the pinned scope
+// *or* any of its sub-scopes. This can reasonably be thought of as producing the union of the result of both the
+// PoliciesApplicableToResourceScope and ResourcesSubjectToPolicyScope methods.
+func (c *Cache[T, K]) AllNonOrthogonalResources(scope string, opts ...Option[T, K]) iter.Seq[ScopedItems[T]] {
+	return func(yield func(ScopedItems[T]) bool) {
+		c.rw.RLock()
+		defer c.rw.RUnlock()
+
+		var options options[T, K]
+		for _, opt := range opts {
+			opt(&options)
+		}
+
+		if c.root == nil {
+			return
+		}
+
+		// keep track of the segments visited
+		var visited []string
+
+		// search for start position, beginning at the root
+		current := c.root
+
+		descender := newDescender(options.cursor)
+		defer descender.Stop()
+
+		for segment := range scopes.DescendingSegments(scope) {
+			if !maybeYieldScopedItems(yield, visited, &descender, current.members, c.items, c.cfg.Clone, options.filter) {
+				return
+			}
+
+			// get next scope if it exists
+			var ok bool
+			current, ok = current.children.Get(segment)
+			if !ok {
+				// reached the end prior to finding the target scope,
+				// nothing to yield.
+				return
+			}
+
+			// advance the descender to the next scope
+			descender.Descend(segment)
+
+			// update visited segments
+			visited = append(visited, segment)
+		}
+
+		// recursively yield current position and all of its descendants
+		if !recursiveYield(yield, visited, &descender, current, c.items, c.cfg.Clone, options.filter) {
 			return
 		}
 	}
@@ -234,12 +320,10 @@ func (c *Cache[T, K]) ResourcesSubjectToPolicyScope(scope string, opts ...Option
 
 // recursiveYield is a helper function for recursively yielding all members of a given scope node, and all
 // members of all of its children. The returned bool is the return value of the last call to yield.
-func recursiveYield[T any, K cmp.Ordered](yield func(ScopedItems[T]) bool, visited []string, descender *descender[K], current *node[K], items map[K]T, clone func(T) T) bool {
+func recursiveYield[T any, K cmp.Ordered](yield func(ScopedItems[T]) bool, visited []string, descender *descender[K], current *node[K], items map[K]T, clone func(T) T, filter func(T) bool) bool {
 	// yield the current scope if we've finished descending to resume position and it is non-empty
-	if descender.Yield() && current.members.Len() != 0 {
-		if !yield(newScopedItems(visited, descender.StartKey(), current.members, items, clone)) {
-			return false
-		}
+	if !maybeYieldScopedItems(yield, visited, descender, current.members, items, clone, filter) {
+		return false
 	}
 
 	// recursively yield all child scopes
@@ -247,7 +331,7 @@ func recursiveYield[T any, K cmp.Ordered](yield func(ScopedItems[T]) bool, visit
 		descender.Descend(segment)
 
 		// recursively yield all child and all of its descendants
-		if !recursiveYield(yield, append(visited, segment), descender, child, items, clone) {
+		if !recursiveYield(yield, append(visited, segment), descender, child, items, clone, filter) {
 			return false
 		}
 	}
@@ -344,14 +428,47 @@ func (s *ScopedItems[T]) Items() iter.Seq[T] {
 	return s.items()
 }
 
+func maybeYieldScopedItems[T any, K cmp.Ordered](yield func(ScopedItems[T]) bool, segments []string, descender *descender[K], members *sortmap.Map[K, struct{}], items map[K]T, clone func(T) T, filter func(T) bool) bool {
+
+	if !descender.Yield() || members.Len() == 0 {
+		// we are still descending to a cursor position or there are no items to yield
+		return true /* continue iteration */
+	}
+
+	start := descender.StartKey()
+
+	if filter != nil {
+		// we don't want to yield a scope unless it contains at least one value that matches the filter,
+		// so we seek to the position of the first item prior to yielding.
+		var foundMatch bool
+		for key, _ := range members.Ascend(start) {
+			if !filter(items[key]) {
+				continue
+			}
+			start = key
+			foundMatch = true
+			break
+		}
+		if !foundMatch {
+			return true /* continue iteration */
+		}
+	}
+
+	return yield(newScopedItems(segments, start, members, items, clone, filter))
+}
+
 // newScopedItems is a helper function for creating a ScopedItems instance within a top-level iterator.
-func newScopedItems[T any, K cmp.Ordered](segments []string, start K, members *sortmap.Map[K, struct{}], items map[K]T, clone func(T) T) ScopedItems[T] {
+func newScopedItems[T any, K cmp.Ordered](segments []string, start K, members *sortmap.Map[K, struct{}], items map[K]T, clone func(T) T, filter func(T) bool) ScopedItems[T] {
 	return ScopedItems[T]{
 		segments: segments,
 		items: func() iter.Seq[T] {
 			return func(yield func(T) bool) {
 				for key, _ := range members.Ascend(start) {
-					if !yield(clone(items[key])) {
+					val := items[key]
+					if filter != nil && !filter(val) {
+						continue
+					}
+					if !yield(clone(val)) {
 						return
 					}
 				}
@@ -398,7 +515,7 @@ func (d *descender[K]) Descend(segment string) {
 	d.segment, d.descending = d.next()
 }
 
-// Yield indicates wether or not we've descended to the appropriate depth to
+// Yield indicates whether or not we've descended to the appropriate depth to
 // start yielding items.
 func (d *descender[K]) Yield() bool {
 	return !d.descending
diff --git a/lib/scopes/cache/cache_test.go b/lib/scopes/cache/cache_test.go
index 3f820561073a4..50cf4901297a1 100644
--- a/lib/scopes/cache/cache_test.go
+++ b/lib/scopes/cache/cache_test.go
@@ -42,6 +42,347 @@ func (i item[K]) Scope() string {
 	return i.scope
 }
 
+// TestCacheFiltering verifies the expected behavior of the cache when filtering is applied to
+// the policies-applicable-to-resource and resources-subject-to-policy queries.
+func TestCacheFiltering(t *testing.T) {
+	items := []item[int]{
+		{1, "/"},
+		{2, "/aa"},
+		{3, "/aa/bb"},
+		{4, "/aa/bb/cc"},
+		{5, "/aa/bb/cc/dd"},
+		{6, "/aa/bb/cc/dd/ee"},
+		{7, "/aa/bb/cc/dd/ee/ff"},
+		{8, "/aa/bb/cc/dd/ee/ff/gg"},
+	}
+
+	tts := []struct {
+		name                 string
+		scope                string
+		filter               func(item[int]) bool
+		policiesApplicableTo []item[int]
+		resourcesSubjectTo   []item[int]
+	}{
+		{
+			name:   "subscope all",
+			scope:  "/aa/bb/cc",
+			filter: func(i item[int]) bool { return true },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+				{2, "/aa"},
+				{3, "/aa/bb"},
+				{4, "/aa/bb/cc"},
+			},
+			resourcesSubjectTo: []item[int]{
+				{4, "/aa/bb/cc"},
+				{5, "/aa/bb/cc/dd"},
+				{6, "/aa/bb/cc/dd/ee"},
+				{7, "/aa/bb/cc/dd/ee/ff"},
+				{8, "/aa/bb/cc/dd/ee/ff/gg"},
+			},
+		},
+		{
+			name:                 "subscope none",
+			scope:                "/aa/bb/cc",
+			filter:               func(i item[int]) bool { return false },
+			policiesApplicableTo: nil,
+			resourcesSubjectTo:   nil,
+		},
+		{
+			name:   "subscope even",
+			scope:  "/aa/bb/cc",
+			filter: func(i item[int]) bool { return i.key%2 == 0 },
+			policiesApplicableTo: []item[int]{
+				{2, "/aa"},
+				{4, "/aa/bb/cc"},
+			},
+			resourcesSubjectTo: []item[int]{
+				{4, "/aa/bb/cc"},
+				{6, "/aa/bb/cc/dd/ee"},
+				{8, "/aa/bb/cc/dd/ee/ff/gg"},
+			},
+		},
+		{
+			name:   "subscope odd",
+			scope:  "/aa/bb/cc",
+			filter: func(i item[int]) bool { return i.key%2 != 0 },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+				{3, "/aa/bb"},
+			},
+			resourcesSubjectTo: []item[int]{
+				{5, "/aa/bb/cc/dd"},
+				{7, "/aa/bb/cc/dd/ee/ff"},
+			},
+		},
+		{
+			name:   "subscope first",
+			scope:  "/aa/bb/cc",
+			filter: func(i item[int]) bool { return i.key == 1 },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+			},
+			resourcesSubjectTo: nil,
+		},
+		{
+			name:                 "subscope last",
+			scope:                "/aa/bb/cc",
+			filter:               func(i item[int]) bool { return i.key == 8 },
+			policiesApplicableTo: nil,
+			resourcesSubjectTo: []item[int]{
+				{8, "/aa/bb/cc/dd/ee/ff/gg"},
+			},
+		},
+		{
+			name:   "root all",
+			scope:  "/",
+			filter: func(i item[int]) bool { return true },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+			},
+			resourcesSubjectTo: items,
+		},
+		{
+			name:                 "root none",
+			scope:                "/",
+			filter:               func(i item[int]) bool { return false },
+			policiesApplicableTo: nil,
+			resourcesSubjectTo:   nil,
+		},
+		{
+			name:                 "root even",
+			scope:                "/",
+			filter:               func(i item[int]) bool { return i.key%2 == 0 },
+			policiesApplicableTo: nil,
+			resourcesSubjectTo: []item[int]{
+				{2, "/aa"},
+				{4, "/aa/bb/cc"},
+				{6, "/aa/bb/cc/dd/ee"},
+				{8, "/aa/bb/cc/dd/ee/ff/gg"},
+			},
+		},
+		{
+			name:   "root odd",
+			scope:  "/",
+			filter: func(i item[int]) bool { return i.key%2 != 0 },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+			},
+			resourcesSubjectTo: []item[int]{
+				{1, "/"},
+				{3, "/aa/bb"},
+				{5, "/aa/bb/cc/dd"},
+				{7, "/aa/bb/cc/dd/ee/ff"},
+			},
+		},
+		{
+			name:   "root first",
+			scope:  "/",
+			filter: func(i item[int]) bool { return i.key == 1 },
+			policiesApplicableTo: []item[int]{
+				{1, "/"},
+			},
+			resourcesSubjectTo: []item[int]{
+				{1, "/"},
+			},
+		},
+		{
+			name:   "root last",
+			filter: func(i item[int]) bool { return i.key == 8 },
+			resourcesSubjectTo: []item[int]{
+				{8, "/aa/bb/cc/dd/ee/ff/gg"},
+			},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			var cloned int
+			cache, err := New(Config[item[int], int]{
+				Scope: (item[int]).Scope,
+				Key:   (item[int]).Key,
+				Clone: func(i item[int]) item[int] {
+					cloned++
+					return i
+				},
+			})
+			require.NoError(t, err)
+
+			for _, item := range items {
+				_, ok := cache.Get(item.Key())
+				require.False(t, ok, "item %+v should not be in cache before Put", item)
+
+				cache.Put(item)
+
+				got, ok := cache.Get(item.Key())
+				require.True(t, ok, "item %+v should be in cache after Put", item)
+				require.Equal(t, item, got, "item %+v should match after Put", item)
+				require.Equal(t, 1, cloned)
+				cloned = 0 // reset cloned counter after each Put
+			}
+
+			var policiesApplicableTo []item[int]
+			for scope := range cache.PoliciesApplicableToResourceScope(tt.scope, cache.WithFilter(tt.filter)) {
+				var seen int
+				for item := range scope.Items() {
+					seen++
+					policiesApplicableTo = append(policiesApplicableTo, item)
+				}
+				// verify that filtering doesn't cause empty scopes to be yielded
+				require.NotZero(t, seen, "scope=%s", scope.Scope())
+			}
+			require.Equal(t, tt.policiesApplicableTo, policiesApplicableTo)
+
+			// verify that clone was only called on items that matched the filter
+			require.Equal(t, len(tt.policiesApplicableTo), cloned)
+
+			cloned = 0
+			var resourcesSubjectTo []item[int]
+			for scope := range cache.ResourcesSubjectToPolicyScope(tt.scope, cache.WithFilter(tt.filter)) {
+				var seen int
+				for item := range scope.Items() {
+					seen++
+					resourcesSubjectTo = append(resourcesSubjectTo, item)
+				}
+				// verify that filtering doesn't cause empty scopes to be yielded
+				require.NotZero(t, seen, "scope=%s", scope.Scope())
+			}
+			require.Equal(t, tt.resourcesSubjectTo, resourcesSubjectTo)
+
+			// verify that clone was only called on items that matched the filter
+			require.Equal(t, len(tt.resourcesSubjectTo), cloned)
+
+			cloned = 0
+			var nonOrthogonalResources []item[int]
+			for scope := range cache.AllNonOrthogonalResources(tt.scope, cache.WithFilter(tt.filter)) {
+				var seen int
+				for item := range scope.Items() {
+					seen++
+					nonOrthogonalResources = append(nonOrthogonalResources, item)
+				}
+
+				// verify that filtering doesn't cause empty scopes to be yielded
+				require.NotZero(t, seen, "scope=%s", scope.Scope())
+			}
+
+			// verify that non-orthogonal is the union of policies-applicable-to and resources-subject-to in that order
+			expectedNonOrthogonal := joinAndDeduplicateItems(policiesApplicableTo, resourcesSubjectTo)
+			require.Equal(t, expectedNonOrthogonal, nonOrthogonalResources)
+
+			// verify that clone was only called on items that matched the filter
+			require.Equal(t, len(expectedNonOrthogonal), cloned)
+		})
+	}
+}
+
+// TestCacheAllNonOrthogonalResources verifies the expected behavior of the AllNonOrthogonalResources method separately
+// because most coverage is provided by asserting that it produces the union of the output of the other two
+// methods. This test primarily servers as a sanity-check to ensure that the other checks aren't wildly off-base.
+func TestCacheAllNonOrthogonalResources(t *testing.T) {
+	t.Parallel()
+
+	items := []item[int]{
+		{1, "/"},
+		{2, "/aa"},
+		{3, "/aa/bb"},
+		{4, "/aa/bb/cc"},
+		{5, "/aa/cc"},
+		{6, "/aa/cc/dd"},
+		{7, "/xx"},
+		{8, "/xx/yy"},
+	}
+
+	tts := []struct {
+		name   string
+		scope  string
+		expect []item[int]
+	}{
+		{
+			name:   "root",
+			scope:  "/",
+			expect: items,
+		},
+		{
+			name:  "leaf",
+			scope: "/aa/bb/cc",
+			expect: []item[int]{
+				{1, "/"},
+				{2, "/aa"},
+				{3, "/aa/bb"},
+				{4, "/aa/bb/cc"},
+			},
+		},
+		{
+			name:  "middle",
+			scope: "/aa",
+			expect: []item[int]{
+				{1, "/"},
+				{2, "/aa"},
+				{3, "/aa/bb"},
+				{4, "/aa/bb/cc"},
+				{5, "/aa/cc"},
+				{6, "/aa/cc/dd"},
+			},
+		},
+		{
+			name:  "other",
+			scope: "/xx",
+			expect: []item[int]{
+				{1, "/"},
+				{7, "/xx"},
+				{8, "/xx/yy"},
+			},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			cache, err := New(Config[item[int], int]{
+				Scope: (item[int]).Scope,
+				Key:   (item[int]).Key,
+			})
+			require.NoError(t, err)
+
+			for _, item := range items {
+				_, ok := cache.Get(item.Key())
+				require.False(t, ok, "item %+v should not be in cache before Put", item)
+
+				cache.Put(item)
+
+				got, ok := cache.Get(item.Key())
+				require.True(t, ok, "item %+v should be in cache after Put", item)
+				require.Equal(t, item, got, "item %+v should match after Put", item)
+			}
+
+			var nonOrthogonalResources []item[int]
+			for scope := range cache.AllNonOrthogonalResources(tt.scope) {
+				for item := range scope.Items() {
+					nonOrthogonalResources = append(nonOrthogonalResources, item)
+				}
+			}
+			require.Equal(t, tt.expect, nonOrthogonalResources, "scope=%s", tt.scope)
+		})
+	}
+}
+
+// joinAndDeduplicateItems joins multiple sets of items and deduplicates them based on their keys. Used in testing
+// the AllNonOrthogonalResources method since its output should always be the union of the output of
+// PoliciesApplicableToResourceScope and ResourcesSubjectToPolicyScope.
+func joinAndDeduplicateItems(sets ...[]item[int]) []item[int] {
+	// join all sets together and deduplicate
+	seen := make(map[int]struct{})
+	var result []item[int]
+	for _, set := range sets {
+		for _, item := range set {
+			if _, ok := seen[item.Key()]; !ok {
+				seen[item.Key()] = struct{}{}
+				result = append(result, item)
+			}
+		}
+	}
+	return result
+}
+
 // TestCacheConcurrency verifies the basic expected concurrency behavior of the cache.
 func TestCacheConcurrency(t *testing.T) {
 	t.Parallel()
@@ -60,7 +401,14 @@ func TestCacheConcurrency(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, item := range items {
+		_, ok := cache.Get(item.Key())
+		require.False(t, ok, "item %+v should not be in cache before Put", item)
+
 		cache.Put(item)
+
+		got, ok := cache.Get(item.Key())
+		require.True(t, ok, "item %+v should be in cache after Put", item)
+		require.Equal(t, item, got, "item %+v should match after Put", item)
 	}
 
 	// lockstepC is used to force the background queries to progress in lockstep
@@ -391,6 +739,28 @@ func TestCursorScenarios(t *testing.T) {
 				{13, "/aa/bb/cc/dd/ee/ff"},
 			},
 		},
+		{
+			// regression test case for a bug in initial cursor impl that
+			// would cause policy application mode to still yield items
+			// for scope/cursor combos that should have resulted in zero
+			// results if the leaf segment was non-empty.
+			name: "non-empty leaf segment bug",
+			items: []item[int]{
+				{0, "/"},
+				{1, "/aa"},
+				{2, "/aa/bb"},
+				{3, "/aa/bb/cc"},
+			},
+			scope: "/aa/bb",
+			cursor: Cursor[int]{
+				Scope: "/aa/bb/cc",
+				Key:   3,
+			},
+			policiesApplicableTo: nil, // would have contained {2, "/aa/bb"} prior to fix
+			resourcesSubjectTo: []item[int]{
+				{3, "/aa/bb/cc"},
+			},
+		},
 	}
 
 	for _, tt := range tts {
@@ -402,12 +772,19 @@ func TestCursorScenarios(t *testing.T) {
 			require.NoError(t, err)
 
 			for _, item := range tt.items {
+				_, ok := cache.Get(item.Key())
+				require.False(t, ok, "item %+v should not be in cache before Put", item)
+
 				cache.Put(item)
+
+				got, ok := cache.Get(item.Key())
+				require.True(t, ok, "item %+v should be in cache after Put", item)
+				require.Equal(t, item, got, "item %+v should match after Put", item)
 			}
 
 			// verify policies-applicable-to-resource iteration
 			var policiesApplicableTo []item[int]
-			for scope := range cache.PoliciesApplicableToResourceScope(tt.scope, WithCursor(tt.cursor)) {
+			for scope := range cache.PoliciesApplicableToResourceScope(tt.scope, cache.WithCursor(tt.cursor)) {
 				for item := range scope.Items() {
 					policiesApplicableTo = append(policiesApplicableTo, item)
 				}
@@ -417,13 +794,23 @@ func TestCursorScenarios(t *testing.T) {
 
 			// verify resources-subject-to-policy iteration
 			var resourcesSubjectTo []item[int]
-			for scope := range cache.ResourcesSubjectToPolicyScope(tt.scope, WithCursor(tt.cursor)) {
+			for scope := range cache.ResourcesSubjectToPolicyScope(tt.scope, cache.WithCursor(tt.cursor)) {
 				for item := range scope.Items() {
 					resourcesSubjectTo = append(resourcesSubjectTo, item)
 				}
 			}
 
 			require.Equal(t, tt.resourcesSubjectTo, resourcesSubjectTo)
+
+			// verify non-orhthogonal iteration
+			var nonOrthogonal []item[int]
+			for scope := range cache.AllNonOrthogonalResources(tt.scope, cache.WithCursor(tt.cursor)) {
+				for item := range scope.Items() {
+					nonOrthogonal = append(nonOrthogonal, item)
+				}
+			}
+			expectedNonOrthogonal := joinAndDeduplicateItems(policiesApplicableTo, resourcesSubjectTo)
+			require.Equal(t, expectedNonOrthogonal, nonOrthogonal, "scope=%s cursor=%+v", tt.scope, tt.cursor)
 		})
 	}
 }
@@ -571,7 +958,14 @@ func TestCursorPagination(t *testing.T) {
 			require.NoError(t, err)
 
 			for _, item := range tt.items {
+				_, ok := cache.Get(item.Key())
+				require.False(t, ok, "item %+v should not be in cache before Put", item)
+
 				cache.Put(item)
+
+				got, ok := cache.Get(item.Key())
+				require.True(t, ok, "item %+v should be in cache after Put", item)
+				require.Equal(t, item, got, "item %+v should match after Put", item)
 			}
 
 			// verify policies-applicable-to-resource iteration
@@ -595,7 +989,7 @@ func TestCursorPagination(t *testing.T) {
 			require.Equal(t, tt.policiesApplicableTo.firstPage, firstPage)
 
 			if !cursor.IsZero() {
-				for scope := range cache.PoliciesApplicableToResourceScope(tt.scope, WithCursor(cursor)) {
+				for scope := range cache.PoliciesApplicableToResourceScope(tt.scope, cache.WithCursor(cursor)) {
 					for item := range scope.Items() {
 						remaining = append(remaining, item)
 					}
@@ -627,7 +1021,7 @@ func TestCursorPagination(t *testing.T) {
 			require.Equal(t, tt.resourcesSubjectTo.firstPage, firstPage)
 
 			if !cursor.IsZero() {
-				for scope := range cache.ResourcesSubjectToPolicyScope(tt.scope, WithCursor(cursor)) {
+				for scope := range cache.ResourcesSubjectToPolicyScope(tt.scope, cache.WithCursor(cursor)) {
 					for item := range scope.Items() {
 						remaining = append(remaining, item)
 					}
diff --git a/lib/scopes/cache/roles/role_cache.go b/lib/scopes/cache/roles/role_cache.go
new file mode 100644
index 0000000000000..7b007e7cc31f9
--- /dev/null
+++ b/lib/scopes/cache/roles/role_cache.go
@@ -0,0 +1,171 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package roles
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopespb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/cache"
+)
+
+const (
+	defaultPageSize = 256
+	maxPageSize     = 1024
+)
+
+// RoleCache is a cache for scoped role roles.
+type RoleCache struct {
+	cache *cache.Cache[*scopedaccessv1.ScopedRole, string]
+}
+
+// NewRoleCache creates a new role cache instance.
+func NewRoleCache() *RoleCache {
+	return &RoleCache{
+		cache: cache.Must(cache.Config[*scopedaccessv1.ScopedRole, string]{
+			Scope: func(role *scopedaccessv1.ScopedRole) string {
+				return role.GetScope()
+			},
+			Key: func(role *scopedaccessv1.ScopedRole) string {
+				return role.GetMetadata().GetName()
+			},
+			Clone: proto.CloneOf[*scopedaccessv1.ScopedRole],
+		}),
+	}
+}
+
+// GetScopedRole gets a scoped role by name.
+func (c *RoleCache) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	if req.GetName() == "" {
+		return nil, trace.BadParameter("missing scoped role name in get request")
+	}
+
+	role, ok := c.cache.Get(req.GetName())
+	if !ok {
+		return nil, trace.NotFound("scoped role %q not found", req.GetName())
+	}
+
+	return &scopedaccessv1.GetScopedRoleResponse{
+		Role: role,
+	}, nil
+}
+
+// ListScopedRoles returns a paginated list of scoped roles.
+func (c *RoleCache) ListScopedRoles(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	return c.ListScopedRolesWithFilter(ctx, req, func(role *scopedaccessv1.ScopedRole) bool { return true })
+}
+
+// ListScopedRolesWithFilter returns a paginated list of scoped roles filtered by the provided filter function. This
+// method is used internally to implement access-controls on the ListScopedRoles grpc method.
+func (c *RoleCache) ListScopedRolesWithFilter(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest, filter func(*scopedaccessv1.ScopedRole) bool) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	pageSize := int(req.GetPageSize())
+	if pageSize <= 0 {
+		pageSize = defaultPageSize
+	}
+	if pageSize > maxPageSize {
+		pageSize = maxPageSize
+	}
+
+	if req.GetResourceScope() != nil && req.GetAssignableScope() != nil {
+		return nil, trace.BadParameter("cannot filter by both resource scope and assignable scope simultaneously")
+	}
+
+	cursor, err := cache.DecodeStringCursor(req.GetPageToken())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// resources subject to policy scope root is basically the scoped resource equivalent
+	// of a "get all". this is a reasonable default for most queries.
+	getter := c.cache.ResourcesSubjectToPolicyScope
+	scope := scopes.Root
+
+	// if a resource scope filter has been provided, the user has specified a custom scope/mode to
+	// query by.
+	if req.GetResourceScope() != nil {
+		// a resource-scope based filter has been provided
+		switch req.GetResourceScope().GetMode() {
+		case scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE:
+			getter = c.cache.ResourcesSubjectToPolicyScope
+		case scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE:
+			getter = c.cache.PoliciesApplicableToResourceScope
+		default:
+			return nil, trace.BadParameter("unsupported or unspecified scoping mode %q in scoped role role resource scope filter", req.GetResourceScope().GetMode())
+		}
+		scope = req.GetResourceScope().GetScope()
+	}
+
+	if req.GetAssignableScope() != nil {
+		// NOTE: we eventually want to be able to query roles by the scopes at which they are assignable,
+		// instead of just resource scope. this is important for introspection/auditing but not necessary for
+		// the core funcationality of teleport, so implementation has been deferred. (will require implementation
+		// of a more complex caching structure where each resource will be associable with multiple scopes)
+		return nil, trace.NotImplemented("assignable scope filtering for scoped role roles is not yet supported")
+	}
+
+	var out []*scopedaccessv1.ScopedRole
+	var nextCursor cache.Cursor[string]
+Outer:
+	for scope := range getter(scope, c.cache.WithCursor(cursor), c.cache.WithFilter(filter)) {
+		for role := range scope.Items() {
+			if len(out) == pageSize {
+				nextCursor = cache.Cursor[string]{
+					Scope: scope.Scope(),
+					Key:   role.GetMetadata().GetName(),
+				}
+				break Outer
+			}
+			out = append(out, role)
+		}
+	}
+
+	var nextPageToken string
+	if !nextCursor.IsZero() {
+		nextPageToken, err = cache.EncodeStringCursor(nextCursor)
+		if err != nil {
+			return nil, trace.Errorf("failed to encode cursor %+v: %w (this is a bug)", nextCursor, err)
+		}
+	}
+
+	return &scopedaccessv1.ListScopedRolesResponse{
+		Roles:         out,
+		NextPageToken: nextPageToken,
+	}, nil
+}
+
+// Put adds a new role to the cache. It will overwrite any existing role with the same name.
+func (c *RoleCache) Put(role *scopedaccessv1.ScopedRole) error {
+	if err := scopedaccess.WeakValidateRole(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	c.cache.Put(role)
+	return nil
+}
+
+// Del removes an role from the cache by name.
+func (c *RoleCache) Delete(name string) {
+	c.cache.Del(name)
+}
diff --git a/lib/scopes/cache/roles/role_cache_test.go b/lib/scopes/cache/roles/role_cache_test.go
new file mode 100644
index 0000000000000..02d08f842bd56
--- /dev/null
+++ b/lib/scopes/cache/roles/role_cache_test.go
@@ -0,0 +1,442 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package roles
+
+import (
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	headerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopespb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+)
+
+// TestListScopedRolesScenarios tests particular more tricky ListScopedRoles scenarios, such
+// as attempts to use an out-of-band cursor to read values outside of the target scope.
+func TestListScopedRoleASsignmentsScenarios(t *testing.T) {
+	t.Parallel()
+
+	roles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "admin-01",
+			},
+			Scope:   "/",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "admin-02",
+			},
+			Scope:   "/aa",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "user-01",
+			},
+			Scope:   "/",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "user-02",
+			},
+			Scope:   "/aa",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "admin-03",
+			},
+			Scope:   "/aa/bb",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "user-03",
+			},
+			Scope:   "/aa/bb",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "intern-01",
+			},
+			Scope:   "/bb",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+	}
+
+	cache := NewRoleCache()
+	for _, role := range roles {
+		_, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+			Name: role.GetMetadata().GetName(),
+		})
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+		cache.Put(role)
+
+		rsp, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+			Name: role.GetMetadata().GetName(),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, rsp.GetRole())
+	}
+
+	// verify expected behavior for standard cursors in resources subject to scope mode
+	rsp, err := cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:user-02@/aa",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+
+	// try to inject a malicious root out-of-band cursor in resources subject to scope mode (no effect)
+	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:user-01@/",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+
+	// try to inject a malicious orthogonal out-of-band cursor in resources subject to scope mode (no effect)
+	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:intern-01@/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+
+	// verify expected behavior for standard cursors in policies applicable to scope mode
+	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:user-01@/",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"user-01", "admin-02", "user-02"}, collectRoleNames(rsp.Roles))
+
+	// try to inject a malicious child out-of-band cursor in policies applicable to scope mode (effect is
+	// to ignore all items in valid query path).
+	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:user-03@/aa/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Empty(t, collectRoleNames(rsp.Roles))
+
+	// try to inject a malicious orthogonal out-of-band cursor in policies applicable to scope mode (effect is to
+	// ignore root, but process leaf normally).
+	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v1:intern-01@/bb",
+	})
+	require.NoError(t, err)
+	require.Empty(t, rsp.NextPageToken)
+	require.Equal(t, []string{"admin-02", "user-02"}, collectRoleNames(rsp.Roles))
+
+	// verify rejection of unknown cursor version
+	_, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
+		ResourceScope: &scopespb.Filter{
+			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+			Scope: "/aa",
+		},
+		PageToken: "v2:user-02@/aa",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+}
+
+// TestListScopedRolesBasics tests some basic functionality of the ListScopedRoles method.
+func TestListScopedRolesBasics(t *testing.T) {
+	t.Parallel()
+
+	roles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "admin-01",
+			},
+			Scope:   "/",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "admin-02",
+			},
+			Scope:   "/aa",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "user-01",
+			},
+			Scope:   "/",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "user-02",
+			},
+			Scope:   "/aa",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerpb.Metadata{
+				Name: "intern-01",
+			},
+			Scope:   "/bb",
+			Spec:    &scopedaccessv1.ScopedRoleSpec{},
+			Version: types.V1,
+		},
+	}
+
+	tts := []struct {
+		name   string
+		req    *scopedaccessv1.ListScopedRolesRequest
+		expect [][]string
+	}{
+		{
+			name: "all single page explicit excess",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				PageSize: int32(len(roles) + 1),
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+					"admin-02",
+					"user-02",
+					"intern-01",
+				},
+			},
+		},
+		{
+			name: "all single page implicit excess",
+			req:  &scopedaccessv1.ListScopedRolesRequest{},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+					"admin-02",
+					"user-02",
+					"intern-01",
+				},
+			},
+		},
+		{
+			name: "all single page exact",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				PageSize: int32(len(roles)),
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+					"admin-02",
+					"user-02",
+					"intern-01",
+				},
+			},
+		},
+		{
+			name: "all multi page",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				PageSize: 2,
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+				},
+				{
+					"admin-02",
+					"user-02",
+				},
+				{
+					"intern-01",
+				},
+			},
+		},
+		{
+			name: "resource scope root",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/",
+				},
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+					"admin-02",
+					"user-02",
+					"intern-01",
+				},
+			},
+		},
+		{
+			name: "resource scope non-root",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/aa",
+				},
+			},
+			expect: [][]string{
+				{
+					"admin-02",
+					"user-02",
+				},
+			},
+		},
+		{
+			name: "policy scope root",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/",
+				},
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+				},
+			},
+		},
+		{
+			name: "policy scope non-root",
+			req: &scopedaccessv1.ListScopedRolesRequest{
+				ResourceScope: &scopespb.Filter{
+					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/aa",
+				},
+			},
+			expect: [][]string{
+				{
+					"admin-01",
+					"user-01",
+					"admin-02",
+					"user-02",
+				},
+			},
+		},
+	}
+
+	cache := NewRoleCache()
+	for _, role := range roles {
+		_, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+			Name: role.GetMetadata().GetName(),
+		})
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+		cache.Put(role)
+
+		rsp, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+			Name: role.GetMetadata().GetName(),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, rsp.GetRole())
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			var out [][]string
+			for {
+				rsp, err := cache.ListScopedRoles(t.Context(), tt.req)
+				require.NoError(t, err)
+
+				if len(rsp.Roles) == 0 {
+					break
+				}
+
+				out = append(out, collectRoleNames(rsp.Roles))
+
+				if rsp.NextPageToken == "" {
+					break
+				}
+
+				tt.req.PageToken = rsp.NextPageToken
+			}
+
+			require.Equal(t, tt.expect, out)
+		})
+	}
+}
+
+func collectRoleNames(roles []*scopedaccessv1.ScopedRole) []string {
+	var names []string
+	for _, role := range roles {
+		names = append(names, role.Metadata.Name)
+	}
+	return names
+}
diff --git a/lib/scopes/cache/utils.go b/lib/scopes/cache/utils.go
new file mode 100644
index 0000000000000..d1cc7afc0a94b
--- /dev/null
+++ b/lib/scopes/cache/utils.go
@@ -0,0 +1,85 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cache
+
+import (
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/scopes"
+)
+
+// cursorV1Prefix is used to ensure that future changes in cursor format don't need to worry
+// about causing unintended behaviors of inadvertently passed to older instances.
+const cursorV1Prefix = "v1:"
+
+// DecodeStringCursor decodes a cursor of the form `v1:<key>@<scope>` into a Cursor[string] struct. This is a reasonable
+// default encoding for page tokens for string-keyed scoped items, so long as the key does not contain the '@' character.
+func DecodeStringCursor(cursor string) (Cursor[string], error) {
+	if cursor == "" {
+		return Cursor[string]{}, nil
+	}
+
+	if !strings.HasPrefix(cursor, cursorV1Prefix) {
+		return Cursor[string]{}, trace.BadParameter("cursor %q is not a valid v1 cursor", cursor)
+	}
+
+	var out Cursor[string]
+	var n int
+	for part := range strings.SplitSeq(strings.TrimPrefix(cursor, cursorV1Prefix), "@") {
+		n++
+		switch n {
+		case 1:
+			out.Key = part
+		case 2:
+			out.Scope = part
+		default:
+			return Cursor[string]{}, trace.BadParameter("too many parts in cursor: %q", cursor)
+		}
+	}
+
+	if out.Key == "" || out.Scope == "" {
+		return Cursor[string]{}, trace.BadParameter("cursor %q is missing key or scope", cursor)
+	}
+
+	if err := scopes.WeakValidate(out.Scope); err != nil {
+		return Cursor[string]{}, trace.BadParameter("cursor %q has invalid scope %q: %v", cursor, out.Scope, err)
+	}
+
+	return out, nil
+}
+
+// EncodeStringCursor encodes a cursor struct into a string of the form `v1:<key>@<scope>`. This is a reasonable
+// default encoding for page tokens for string-keyed scoped items, so long as the key does not contain the '@' character.
+func EncodeStringCursor(cursor Cursor[string]) (string, error) {
+	if cursor.Scope == "" && cursor.Key == "" {
+		return "", nil
+	}
+
+	if cursor.Scope == "" || cursor.Key == "" {
+		return "", trace.BadParameter("cursor key and scope must be non-empty")
+	}
+
+	if strings.Contains(cursor.Key, "@") {
+		return "", trace.BadParameter("cursor key %q contains invalid character '@'", cursor.Key)
+	}
+
+	return cursorV1Prefix + cursor.Key + "@" + cursor.Scope, nil
+}
diff --git a/lib/scopes/cache/utils_test.go b/lib/scopes/cache/utils_test.go
new file mode 100644
index 0000000000000..acf56ffc8fb71
--- /dev/null
+++ b/lib/scopes/cache/utils_test.go
@@ -0,0 +1,89 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cache
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStringCursorFormat(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name   string
+		cursor Cursor[string]
+		enc    string
+		ok     bool
+	}{
+		{
+			name:   "empty",
+			cursor: Cursor[string]{},
+			enc:    "",
+			ok:     true,
+		},
+		{
+			name:   "root",
+			cursor: Cursor[string]{Key: "foo", Scope: "/"},
+			enc:    "v1:foo@/",
+			ok:     true,
+		},
+		{
+			name:   "non-root",
+			cursor: Cursor[string]{Key: "foo", Scope: "/bar"},
+			enc:    "v1:foo@/bar",
+			ok:     true,
+		},
+		{
+			name:   "empty scope",
+			cursor: Cursor[string]{Key: "foo", Scope: ""},
+			enc:    "v1:foo@",
+			ok:     false,
+		},
+		{
+			name:   "empty key",
+			cursor: Cursor[string]{Key: "", Scope: "/bar"},
+			enc:    "v1:@/bar",
+			ok:     false,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			enc, err := EncodeStringCursor(tt.cursor)
+			if tt.ok {
+				require.NoError(t, err)
+				require.Equal(t, tt.enc, enc)
+			} else {
+				require.Error(t, err)
+				require.Empty(t, enc)
+			}
+
+			cursor, err := DecodeStringCursor(tt.enc)
+			if tt.ok {
+				require.NoError(t, err)
+				require.Equal(t, tt.cursor, cursor)
+			} else {
+				require.Error(t, err)
+				require.Equal(t, Cursor[string]{}, cursor)
+			}
+		})
+	}
+}
diff --git a/lib/scopes/feature.go b/lib/scopes/feature.go
new file mode 100644
index 0000000000000..87277bbcd926b
--- /dev/null
+++ b/lib/scopes/feature.go
@@ -0,0 +1,48 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package scopes
+
+import (
+	"os"
+
+	"github.com/gravitational/trace"
+
+	apiutils "github.com/gravitational/teleport/api/utils"
+)
+
+const (
+	// featureVarName is the name of the unstable scopes feature flag.
+	featureVarName = "TELEPORT_UNSTABLE_SCOPES"
+)
+
+// FeatureEnabled checks if the scopes feature is enabled.
+func FeatureEnabled() bool {
+	enabled, err := apiutils.ParseBool(os.Getenv(featureVarName))
+	return enabled && err == nil
+}
+
+// AssertFeatureEnabled checks if the scopes feature is enabled, and returns a helpful
+// error message if it is not.
+func AssertFeatureEnabled() error {
+	if !FeatureEnabled() {
+		return trace.Errorf("scoping features are not enabled, set " + featureVarName + "=yes to enable scoping features (caution: not ready for production use)")
+	}
+
+	return nil
+}
diff --git a/lib/scopes/feature_test.go b/lib/scopes/feature_test.go
new file mode 100644
index 0000000000000..153d26415d764
--- /dev/null
+++ b/lib/scopes/feature_test.go
@@ -0,0 +1,33 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package scopes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestFeatureEnabled verifies the expected behavior of the scope feature flag.
+func TestFeatureEnabled(t *testing.T) {
+	require.Error(t, AssertFeatureEnabled())
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+	require.NoError(t, AssertFeatureEnabled())
+
+}
diff --git a/lib/scopes/joining/token.go b/lib/scopes/joining/token.go
new file mode 100644
index 0000000000000..3cc45021f3ad7
--- /dev/null
+++ b/lib/scopes/joining/token.go
@@ -0,0 +1,265 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joining
+
+import (
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/scopes"
+)
+
+var rolesSupportingScopes = types.SystemRoles{
+	types.RoleNode,
+}
+
+var joinMethodsSupportingScopes = map[string]struct{}{
+	string(types.JoinMethodToken): {},
+}
+
+// StrongValidateToken checks if the scoped token is well-formed according to
+// all scoped token rules. This function *must* be used to validate any scoped
+// token being created from scratch. When validating existing scoped token
+// resources, this function should be avoided in favor of the
+// [WeakValidateToken] function.
+func StrongValidateToken(token *joiningv1.ScopedToken) error {
+	if expected, actual := types.KindScopedToken, token.GetKind(); expected != actual {
+		return trace.BadParameter("expected kind %v, got %q", expected, actual)
+	}
+	if expected, actual := types.V1, token.GetVersion(); expected != actual {
+		return trace.BadParameter("expected version %v, got %q", expected, actual)
+	}
+	if expected, actual := "", token.GetSubKind(); expected != actual {
+		return trace.BadParameter("expected sub_kind %v, got %q", expected, actual)
+	}
+	if name := token.GetMetadata().GetName(); name == "" {
+		return trace.BadParameter("missing name")
+	}
+
+	if token.GetScope() == "" {
+		return trace.BadParameter("scoped token must have a scope assigned")
+	}
+
+	spec := token.GetSpec()
+	if spec == nil {
+		return trace.BadParameter("spec must not be nil")
+	}
+
+	if err := scopes.StrongValidate(token.GetScope()); err != nil {
+		return trace.Wrap(err, "validating scoped token resource scope")
+	}
+
+	if err := scopes.StrongValidate(spec.AssignedScope); err != nil {
+		return trace.Wrap(err, "validating scoped token assigned scope")
+	}
+
+	if !scopes.ResourceScope(spec.AssignedScope).IsSubjectToPolicyScope(token.GetScope()) {
+		return trace.BadParameter("scoped token assigned scope must be descendant of its resource scope")
+	}
+
+	if _, ok := joinMethodsSupportingScopes[spec.JoinMethod]; !ok {
+		return trace.BadParameter("join method %q does not support scoping", spec.JoinMethod)
+	}
+
+	if len(spec.Roles) == 0 {
+		return trace.BadParameter("scoped token must have at least one role")
+	}
+
+	roles, err := types.NewTeleportRoles(spec.Roles)
+	if err != nil {
+		return trace.Wrap(err, "validating scoped token roles")
+	}
+
+	for _, role := range roles {
+		if !rolesSupportingScopes.Include(role) {
+			return trace.BadParameter("role %q does not support scoping", role)
+		}
+	}
+
+	return nil
+}
+
+// WeakValidateToken performs a weak form of validation on a scoped token. This
+// function is intended to catch bugs/incompatibilites that might have resulted
+// in a scoped token too malformed for us to safely reason about (e.g. due to
+// significant version drift). Use this function to validate scoped tokens
+// propagated from the control plane. Prefer using [StrongValidateToken] when
+// building a new scoped token from scratch.
+func WeakValidateToken(token *joiningv1.ScopedToken) error {
+	if token == nil {
+		return trace.BadParameter("missing scoped token")
+	}
+
+	if err := scopes.WeakValidate(token.GetScope()); err != nil {
+		return trace.Wrap(err, "validating scoped token resource scope")
+	}
+
+	if err := scopes.WeakValidate(token.GetSpec().GetAssignedScope()); err != nil {
+		return trace.Wrap(err, "validating scoped token assigned scope")
+	}
+
+	if len(token.GetSpec().GetRoles()) == 0 {
+		return trace.BadParameter("scoped token must have at least one role")
+	}
+
+	if _, ok := joinMethodsSupportingScopes[token.GetSpec().GetJoinMethod()]; !ok {
+		return trace.BadParameter("join method %q does not support scoping", token.GetSpec().GetJoinMethod())
+	}
+
+	return nil
+}
+
+// ValidateTokenForUse checks if a given scoped token can be used for
+// provisioning.
+func ValidateTokenForUse(token *joiningv1.ScopedToken) error {
+	if err := WeakValidateToken(token); err != nil {
+		return trace.Wrap(err)
+	}
+
+	ttl := token.GetMetadata().GetExpires()
+	if ttl == nil || ttl.AsTime().IsZero() {
+		return nil
+	}
+
+	now := time.Now().UTC()
+	if ttl.AsTime().Before(now) {
+		return trace.LimitExceeded("scoped token is expired")
+	}
+
+	return nil
+}
+
+// Token wraps a [joiningv1.ScopedToken] such that it can be used to provision
+// resources.
+type Token struct {
+	scoped     *joiningv1.ScopedToken
+	joinMethod types.JoinMethod
+	roles      types.SystemRoles
+}
+
+// NewToken returns the wrapped version of the given [joiningv1.ScopedToken].
+// It will return an error if the configured join method is not a valid
+// [types.JoinMethod] or if any of the configured roles are not a valid
+// [types.SystemRole]. The validated join method and roles are cached on the
+// [Scoped] wrapper itself so they can be read without repeating validation.
+func NewToken(token *joiningv1.ScopedToken) (*Token, error) {
+	joinMethod := types.JoinMethod(token.GetSpec().GetJoinMethod())
+	if err := types.ValidateJoinMethod(joinMethod); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	roles, err := types.NewTeleportRoles(token.GetSpec().GetRoles())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &Token{scoped: token, joinMethod: joinMethod, roles: roles}, nil
+}
+
+// GetName returns the name of a [joiningv1.ScopedToken].
+func (t *Token) GetName() string {
+	if t == nil {
+		return ""
+	}
+
+	return t.scoped.GetMetadata().GetName()
+}
+
+// GetJoinMethod returns the cached [types.JoinMethod] generated when the
+// [joiningv1.ScopedToken] was wrapped.
+func (t *Token) GetJoinMethod() types.JoinMethod {
+	if t == nil {
+		return types.JoinMethodUnspecified
+	}
+
+	return t.joinMethod
+}
+
+// GetRoles returns the cached [types.SystemRoles] generated when the
+// [joiningv1.ScopedToken] was wrapped.
+func (t *Token) GetRoles() types.SystemRoles {
+	if t == nil {
+		return nil
+	}
+	return t.roles
+}
+
+// GetSafeName returns the name of the scoped token, sanitized appropriately
+// for join methods where the name is secret. This should be used when logging
+// the token name.
+func (t *Token) GetSafeName() string {
+	return GetSafeScopedTokenName(t.scoped)
+}
+
+// GetSafeScopedTokenName returns the name of the scoped token, sanitized
+// appropriately for join methods where the name is secret. This should be used
+// when logging the token name.
+func GetSafeScopedTokenName(token *joiningv1.ScopedToken) string {
+	name := token.GetMetadata().GetName()
+	if types.JoinMethod(token.GetSpec().GetJoinMethod()) != types.JoinMethodToken {
+		return name
+	}
+
+	// If the token name is short, we just blank the whole thing.
+	if len(name) < 16 {
+		return strings.Repeat("*", len(name))
+	}
+
+	// If the token name is longer, we can show the last 25% of it to help
+	// the operator identify it.
+	hiddenBefore := int(0.75 * float64(len(name)))
+	name = name[hiddenBefore:]
+	name = strings.Repeat("*", hiddenBefore) + name
+	return name
+}
+
+// Expiry returns the [time.Time] representing when the wrapped
+// [joiningv1.ScopedToken] will expire.
+func (t *Token) Expiry() time.Time {
+	expiry := t.scoped.GetMetadata().GetExpires()
+	if expiry == nil {
+		return time.Time{}
+	}
+
+	return expiry.AsTime()
+}
+
+// GetBotName returns an empty string because scoped tokens do not currently
+// support configuring a bot name.
+func (t *Token) GetBotName() string {
+	return ""
+}
+
+// GetAssignedScope returns the scope that will be assigned to resources
+// provisioned using the wrapped [joiningv1.ScopedToken].
+func (t *Token) GetAssignedScope() string {
+	return t.scoped.GetSpec().GetAssignedScope()
+}
+
+// GetAllowRules returns the list of allow rules.
+func (t *Token) GetAllowRules() []*types.TokenRule {
+	return nil
+}
+
+// GetAWSIIDTTL returns the TTL of EC2 IIDs
+func (t *Token) GetAWSIIDTTL() types.Duration {
+	return types.NewDuration(0)
+}
diff --git a/lib/scopes/joining/token_test.go b/lib/scopes/joining/token_test.go
new file mode 100644
index 0000000000000..4d35582db853a
--- /dev/null
+++ b/lib/scopes/joining/token_test.go
@@ -0,0 +1,340 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package joining_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/scopes/joining"
+)
+
+func TestValidateScopedToken(t *testing.T) {
+	cases := []struct {
+		name              string
+		token             *joiningv1.ScopedToken
+		expectedStrongErr string
+		expectedWeakErr   string
+	}{
+		{
+			name: "invalid kind",
+			token: &joiningv1.ScopedToken{
+				Version: types.V1,
+				Scope:   "/aa",
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: fmt.Sprintf("expected kind %v, got %q", types.KindScopedToken, ""),
+		},
+		{
+			name: "invalid version",
+			token: &joiningv1.ScopedToken{
+				Kind:  types.KindScopedToken,
+				Scope: "/aa",
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: fmt.Sprintf("expected version %v, got %q", types.V1, ""),
+		},
+		{
+			name: "invalid subkind",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Version: types.V1,
+				Scope:   "/aa",
+				SubKind: "subkind",
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: fmt.Sprintf("expected sub_kind %v, got %q", "", "subkind"),
+		},
+		{
+			name: "missing name",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Version: types.V1,
+				Scope:   "/aa",
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "missing name",
+		},
+		{
+			name: "missing spec",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Version: types.V1,
+				Scope:   "/aa",
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+			},
+			expectedStrongErr: "spec must not be nil",
+			expectedWeakErr:   "validating scoped token assigned scope",
+		},
+		{
+			name: "missing scope",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "scoped token must have a scope assigned",
+			expectedWeakErr:   "validating scoped token resource scope",
+		},
+		{
+			name: "non-absolute scope",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token resource scope",
+		},
+		{
+			name: "scope with invalid characters",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb}",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token resource scope",
+			expectedWeakErr:   "validating scoped token resource scope",
+		},
+		{
+			name: "missing assigned scope",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:      []string{types.RoleNode.String()},
+					JoinMethod: string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token assigned scope",
+			expectedWeakErr:   "validating scoped token assigned scope",
+		},
+		{
+			name: "non-absolute assigned scope",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:         []string{types.RoleNode.String()},
+					AssignedScope: "aa/bb",
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token assigned scope",
+		},
+		{
+			name: "assigned scope with invalid character",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:         []string{types.RoleNode.String()},
+					AssignedScope: "aa/bb}",
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token assigned scope",
+			expectedWeakErr:   "validating scoped token assigned scope",
+		},
+		{
+			name: "assigned scope is not descendant of token scope",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:         []string{types.RoleNode.String()},
+					AssignedScope: "/bb/aa",
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "scoped token assigned scope must be descendant of its resource scope",
+		},
+		{
+			name: "invalid join method",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:         []string{types.RoleNode.String()},
+					AssignedScope: "/aa/bb",
+					JoinMethod:    string(types.JoinMethodUnspecified),
+				},
+			},
+			expectedStrongErr: fmt.Sprintf("join method %q does not support scoping", types.JoinMethodUnspecified),
+			expectedWeakErr:   fmt.Sprintf("join method %q does not support scoping", types.JoinMethodUnspecified),
+		},
+		{
+			name: "missing roles",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "scoped token must have at least one role",
+			expectedWeakErr:   "scoped token must have at least one role",
+		},
+		{
+			name: "invalid roles",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{"random_role"},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: "validating scoped token roles",
+		},
+		{
+			name: "unsupported roles",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					AssignedScope: "/aa/bb",
+					Roles:         []string{types.RoleNode.String(), types.RoleInstance.String()},
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+			expectedStrongErr: fmt.Sprintf("role %q does not support scoping", types.RoleInstance),
+		},
+		{
+			name: "valid scoped token",
+			token: &joiningv1.ScopedToken{
+				Kind:    types.KindScopedToken,
+				Scope:   "/aa/bb",
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "testtoken",
+				},
+				Spec: &joiningv1.ScopedTokenSpec{
+					Roles:         []string{types.RoleNode.String()},
+					AssignedScope: "/aa/bb",
+					JoinMethod:    string(types.JoinMethodToken),
+				},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := joining.StrongValidateToken(c.token)
+			if c.expectedStrongErr == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, c.expectedStrongErr)
+			}
+
+			err = joining.WeakValidateToken(c.token)
+			if c.expectedWeakErr == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, c.expectedWeakErr)
+			}
+		})
+	}
+}
diff --git a/lib/scopes/pinning/events.go b/lib/scopes/pinning/events.go
new file mode 100644
index 0000000000000..d73c136a5df06
--- /dev/null
+++ b/lib/scopes/pinning/events.go
@@ -0,0 +1,47 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package pinning
+
+import (
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types/events"
+)
+
+// ToEventsPin converts a scopesv1.Pin to an events.ScopePin. Used in the creation of
+// audit events that encode the identity parameters of an actor as part of the event.
+func ToEventsPin(pin *scopesv1.Pin) *events.ScopePin {
+	if pin == nil {
+		return nil
+	}
+
+	var ea map[string]*events.ScopePinnedAssignments
+	if assignments := pin.GetAssignments(); assignments != nil {
+		ea = make(map[string]*events.ScopePinnedAssignments, len(assignments))
+		for scope, assignment := range assignments {
+			ea[scope] = &events.ScopePinnedAssignments{
+				Roles: assignment.GetRoles(),
+			}
+		}
+	}
+
+	return &events.ScopePin{
+		Scope:       pin.GetScope(),
+		Assignments: ea,
+	}
+}
diff --git a/lib/scopes/pinning/pinning.go b/lib/scopes/pinning/pinning.go
new file mode 100644
index 0000000000000..97d6fd32298c9
--- /dev/null
+++ b/lib/scopes/pinning/pinning.go
@@ -0,0 +1,141 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package pinning
+
+import (
+	"iter"
+
+	"github.com/gravitational/trace"
+
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/lib/scopes"
+)
+
+// StrongValidate checks if the scope pin is well-formed according to all scope pin rules. This function
+// *must* be used to validate any scope pin being created from scratch. Use of this function should be
+// avoided for checking the validity of existing scope pins extracted from certificates and/or as part
+// of any agent-side checks. Prefer using [WeakValidate] in those cases.
+func StrongValidate(pin *scopesv1.Pin) error {
+	if pin == nil {
+		return trace.BadParameter("missing scope pin")
+	}
+
+	if err := scopes.StrongValidate(pin.GetScope()); err != nil {
+		return trace.Errorf("invalid pinned scope: %w", err)
+	}
+
+	if len(pin.GetAssignments()) == 0 {
+		// in theory there isn't any harm in allowing pins to be created without any assignments, but we're choosing to err
+		// on the side of caution for now. this limitation may be lifted later.
+		// NOTE: if lifting this restriction, the equivalent check in the pin building logic must also be lifted.
+		return trace.BadParameter("scope pin at %q contains no assignments", pin.GetScope())
+	}
+
+	for scope, assignment := range pin.GetAssignments() {
+		if err := scopes.StrongValidate(scope); err != nil {
+			return trace.Errorf("invalid pinned assignment scope %q: %w", scope, err)
+		}
+
+		if len(assignment.GetRoles()) == 0 {
+			return trace.BadParameter("scope pin at %q contains empty assignment for scope %q", pin.GetScope(), scope)
+		}
+
+		if !PinCompatibleWithPolicyScope(pin, scope) {
+			return trace.BadParameter("scope pin at %q contains assignment(s) at incompatible scope %q", pin.GetScope(), scope)
+		}
+	}
+
+	return nil
+}
+
+// WeakValidate performs a weak form of validation on a scope pin. This function is intended to catch
+// bugs/incompatibilities that might have resulted in a scope pin too malformed for us to safely reason
+// about (e.g. due to significant version drift). Use this function to validate scope pins extracted from
+// certificates or otherwsie propagated from the control plane. Prefer using [StrongValidate] when building
+// a new scope pin from scratch.
+func WeakValidate(pin *scopesv1.Pin) error {
+	if pin == nil {
+		return trace.BadParameter("missing scope pin")
+	}
+
+	if err := scopes.WeakValidate(pin.GetScope()); err != nil {
+		return trace.Errorf("invalid pinned scope: %w", err)
+	}
+
+	// validate that the scope of assignments are well-formed. due to how scoped access checks work, we cannot
+	// perform any checks if any scopes are malformed as we cannot determine whether or not the assignments
+	// within that scope ought to apply to the scope of the resource being targeted, and we cannot fallback
+	// to the strategy of only evaluating parent assignments since we cannot safely determine the intended
+	// parent/child relationship with the invalid scope.
+	for scope := range pin.GetAssignments() {
+		if err := scopes.WeakValidate(scope); err != nil {
+			return trace.Errorf("invalid pinned assignment scope: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// PinCompatibleWithPolicyScope checks if a given policy scope might affect access subject to the pin. When building a
+// pin, all compatible scoped role assignments must be encoded on the pin. Access while pinned may be affected by any policy
+// that is ancestral, equivalent, or descendant to the pin scope, meaning that all non-orthogonal scopes are compatible.
+func PinCompatibleWithPolicyScope(pin *scopesv1.Pin, scope string) bool {
+	return scopes.Compare(pin.GetScope(), scope) != scopes.Orthogonal
+}
+
+// PinAppliesToResourceScope verifies that the given pin pins a scope that applies to the given resource scope. Resources
+// that are not subject to the pinned scope cannot be accessed by the pinned identity, even if assigned roles would
+// otherwise allow access. Note that this is conceptually distinct from whether or not we can perform *access checks* with
+// a pin at a given scope. A pin at scope /foo/bar might still yield an allow decision at resource scope /foo, but only if
+// the target resource is assigned to /foo/bar or one of its descendants.
+func PinAppliesToResourceScope(pin *scopesv1.Pin, resourceScope string) bool {
+	return scopes.PolicyScope(pin.GetScope()).AppliesToResourceScope(resourceScope)
+}
+
+// AssignmentsForResourceScope returns a sequence of pinned assignments relevant to the target resource scope, starting
+// from the root scope and descending to the target. This is the correct order to evaluate access checks in, and is a suitable
+// building block for access-checking logic.
+func AssignmentsForResourceScope(pin *scopesv1.Pin, resourceScope string) (iter.Seq2[string, *scopesv1.PinnedAssignments], error) {
+	if !PinAppliesToResourceScope(pin, resourceScope) {
+		// a pin with a scope that does not apply to the resource scope should be caught at an
+		// earlier stage, but failure to catch this may be a security issue, so we include a
+		// redundant check here to prevent accidental misuse.
+		return nil, trace.Errorf("invalid resource scope %q for scope pin at %q in assignment lookup (this is a bug)", resourceScope, pin.GetScope())
+	}
+
+	return AssignmentsForResourceScopeUnchecked(pin, resourceScope), nil
+}
+
+// AssignmentsForResourceScopeUnchecked is like AssignmentsForResourceScope, but does not perform any validation to ensure that the target
+// resource scope is valid for the pin. This is used internally by some access-checker building logic which does its own validation
+// of resource scoping.
+func AssignmentsForResourceScopeUnchecked(pin *scopesv1.Pin, resourceScope string) iter.Seq2[string, *scopesv1.PinnedAssignments] {
+	return func(yield func(string, *scopesv1.PinnedAssignments) bool) {
+		for scope := range scopes.DescendingScopes(resourceScope) {
+			assignments, ok := pin.GetAssignments()[scope]
+			if !ok {
+				continue
+			}
+
+			if !yield(scope, assignments) {
+				return
+			}
+		}
+	}
+}
diff --git a/lib/scopes/pinning/pinning_test.go b/lib/scopes/pinning/pinning_test.go
new file mode 100644
index 0000000000000..07511fb6f3450
--- /dev/null
+++ b/lib/scopes/pinning/pinning_test.go
@@ -0,0 +1,284 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package pinning
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+)
+
+func TestValidate(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name     string
+		pin      *scopesv1.Pin
+		strongOk bool
+		weakOk   bool
+	}{
+		{
+			name: "basic",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/foo": {
+						Roles: []string{"r2"},
+					},
+					"/foo/bar": {
+						Roles: []string{"r3"},
+					},
+				},
+			},
+			strongOk: true,
+			weakOk:   true,
+		},
+		{
+			name: "missing scope",
+			pin: &scopesv1.Pin{
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "missing assignments",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "orthogonal assignment",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/bar": {
+						Roles: []string{"r2"},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "empty assignments",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/foo": {
+						Roles: []string{},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name: "malformed assignment scope",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"invalid@scope": {
+						Roles: []string{"r2"},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+		{
+			name: "malformed pin scope",
+			pin: &scopesv1.Pin{
+				Scope: "invalid@scope",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+				},
+			},
+			strongOk: false,
+			weakOk:   false,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			err := StrongValidate(tt.pin)
+			if tt.strongOk {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+			}
+
+			err = WeakValidate(tt.pin)
+			if tt.weakOk {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+			}
+		})
+	}
+}
+
+// TestAssignmentsForResourceScope verifies the expected behavior of the AssignmentsForResourceScope helper.
+func TestAssignmentsForResourceScope(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name   string
+		pin    *scopesv1.Pin
+		scope  string
+		ok     bool
+		expect []string
+	}{
+		{
+			name: "basic",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/foo": {
+						Roles: []string{"r2"},
+					},
+					"/foo/bar": {
+						Roles: []string{"r3"},
+					},
+				},
+			},
+			scope:  "/foo/bar",
+			ok:     true,
+			expect: []string{"/", "/foo", "/foo/bar"},
+		},
+		{
+			name: "no assignments for scope",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/foo/bar": {
+						Roles: []string{"r1"},
+					},
+				},
+			},
+			scope:  "/foo",
+			ok:     true,
+			expect: nil,
+		},
+		{
+			name: "partial assignments",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/foo/bar": {
+						Roles: []string{"r2"},
+					},
+					"/foo/bar/bin": {
+						Roles: []string{"r3"},
+					},
+					"/foo/bin": {
+						Roles: []string{"r4"},
+					},
+				},
+			},
+			scope:  "/foo/bar",
+			ok:     true,
+			expect: []string{"/", "/foo/bar"},
+		},
+		{
+			name: "parent resource scope",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/foo": {
+						Roles: []string{"r2"},
+					},
+				},
+			},
+			scope:  "/",
+			ok:     false,
+			expect: nil,
+		},
+		{
+			name: "orthogonal resource scope",
+			pin: &scopesv1.Pin{
+				Scope: "/foo",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/": {
+						Roles: []string{"r1"},
+					},
+					"/bar": {
+						Roles: []string{"r2"},
+					},
+				},
+			},
+			scope:  "/bar",
+			ok:     false,
+			expect: nil,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			var seen []string
+
+			assignments, err := AssignmentsForResourceScope(tt.pin, tt.scope)
+			if tt.ok {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				return
+			}
+
+			for scope, assignment := range assignments {
+				seen = append(seen, scope)
+				require.Empty(t, cmp.Diff(tt.pin.GetAssignments()[scope], assignment, protocmp.Transform()))
+			}
+			require.Equal(t, tt.expect, seen)
+		})
+	}
+}
diff --git a/lib/scopes/roles/roles.go b/lib/scopes/roles/roles.go
deleted file mode 100644
index d418f74db2424..0000000000000
--- a/lib/scopes/roles/roles.go
+++ /dev/null
@@ -1,307 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package roles
-
-import (
-	"iter"
-
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-
-	srpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/scopes"
-)
-
-const (
-	// MaxRolesPerAssignment is the maximum number of roles@scope assignments that a given scoped role assignment
-	// resource may contain. This value is so low because our backend limits the number of keys that can be associated
-	// with a single atomic operation. Any significant increase to this value would necessitate a change to the
-	// scoped role backend model.
-	MaxRolesPerAssignment = 16
-
-	// KindScopedRole is the kind of a scoped role resource.
-	KindScopedRole = "scoped_role"
-
-	// KindScopedRoleAssignment is the kind of a scoped role assignment resource.
-	KindScopedRoleAssignment = "scoped_role_assignment"
-
-	// maxAssignableScopes is the maximum number of assignable scopes that a given scoped role resource may contain. Note that
-	// unlike MaxRolesPerAssignment, this is a fairly arbitrary limit and there isn't a strong reason to keep it low other than
-	// to avoid excess resource size and to keep our options open for the future.
-	maxAssignableScopes = 16
-)
-
-// RoleIsAssignableAtScope checks if the given role is assignable at the given scope.
-func RoleIsAssignableAtScope(role *srpb.ScopedRole, scope string) bool {
-	for assignableScope := range WeakValidatedAssignableScopes(role) {
-		if scopes.Glob(assignableScope).Matches(scope) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// WeakValidatedAssignableScopes is a helper for iterating all well formed assignable scopes for a given role.
-func WeakValidatedAssignableScopes(role *srpb.ScopedRole) iter.Seq[string] {
-	return func(yield func(string) bool) {
-		for _, assignableScope := range role.GetSpec().GetAssignableScopes() {
-			if err := scopes.WeakValidateGlob(assignableScope); err != nil {
-				// ignore invalid assignable scopes
-				continue
-			}
-
-			if !scopes.Glob(assignableScope).IsSubjectToPolicyResourceScope(role.GetScope()) {
-				// ignore assignable scopes that do not conform to assignment subjugation rules
-				continue
-			}
-
-			if !yield(assignableScope) {
-				return
-			}
-		}
-	}
-}
-
-// WeakValidateRole valides a role to ensure it is free of obvious issues that would render it unusable and/or
-// induce serious unintended behavior. Prefer using this function for validating roles loaded from "internal" sources
-// (e.g. backend/control-plane), and [StrongValidateRole] for validating roles loaded from "external" sources (e.g. user input).
-func WeakValidateRole(role *srpb.ScopedRole) error {
-	if err := commonValidateRole(role); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := scopes.WeakValidate(role.GetScope()); err != nil {
-		return trace.BadParameter("scoped role %q has invalid scope: %v", role.GetMetadata().GetName(), err)
-	}
-
-	// NOTE: in strong validation, this is where we'd check that the assignable scopes are valid. In weak validation
-	// we don't do that and instead rely on invalid assignable scopes being filtered out
-	// and excluded during runtime assignment validation checks. This helps us ensure that outdated agents continue
-	// to be able to understand and process the subset of assignments that they are able to reason about.
-
-	return nil
-}
-
-// StrongValidateRole performs robust validation of a role to ensure it complies with all expected constraints. Prefer
-// using this function for validating roles loaded from "external" sources (e.g. user input), and [WeakValidateRole] for
-// validating roles loaded from "internal" sources (e.g. backend/control-plane).
-func StrongValidateRole(role *srpb.ScopedRole) error {
-	if err := commonValidateRole(role); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := validateRoleName(role.GetMetadata().GetName()); err != nil {
-		return trace.BadParameter("scoped role name %q does not conform to segment naming rules: %v", role.GetMetadata().GetName(), err)
-	}
-
-	if err := scopes.StrongValidate(role.GetScope()); err != nil {
-		return trace.BadParameter("scoped role %q has invalid scope: %v", role.GetMetadata().GetName(), err)
-	}
-
-	if len(role.GetSpec().GetAssignableScopes()) == 0 {
-		return trace.BadParameter("scoped role %q does not have any assignable scopes", role.GetMetadata().GetName())
-	}
-
-	if len(role.GetSpec().GetAssignableScopes()) > maxAssignableScopes {
-		return trace.BadParameter("scoped role %q has too many assignable scopes (max %d)", role.GetMetadata().GetName(), maxAssignableScopes)
-	}
-
-	for _, scopeGlob := range role.GetSpec().GetAssignableScopes() {
-		if err := scopes.StrongValidateGlob(scopeGlob); err != nil {
-			return trace.BadParameter("scoped role %q has invalid assignable scope %q: %v", role.GetMetadata().GetName(), scopeGlob, err)
-		}
-
-		if !scopes.Glob(scopeGlob).IsSubjectToPolicyResourceScope(role.GetScope()) {
-			return trace.BadParameter("scoped role %q has assignable scope %q that is not a sub-scope of the role's scope %q", role.GetMetadata().GetName(), scopeGlob, role.GetScope())
-		}
-	}
-
-	return nil
-}
-
-func validateRoleName(name string) error {
-	// note: having the scope name be validated as a segment name is a bit of an arbitrary choice, but its basically
-	// equivalent to what we would want from a standalone name requirement, and there may even be some future benefit
-	// if we ever need to encode a role assignment as a scope-like name.
-	return trace.Wrap(scopes.StrongValidateSegment(name))
-}
-
-// commonValidateRole performs the subset of role validation common to both weak and strong validation.
-func commonValidateRole(role *srpb.ScopedRole) error {
-	if role.GetMetadata().GetName() == "" {
-		return trace.BadParameter("scoped role is missing metadata.name")
-	}
-
-	if role.GetKind() == "" {
-		return trace.BadParameter("scoped role %q is missing kind", role.GetMetadata().GetName())
-	}
-
-	if role.GetKind() != KindScopedRole {
-		return trace.BadParameter("scoped role %q has invalid kind %q, expected %q", role.GetMetadata().GetName(), role.GetKind(), KindScopedRole)
-	}
-
-	if role.GetSubKind() != "" {
-		return trace.BadParameter("scoped role %q has unknown sub_kind %q", role.GetMetadata().GetName(), role.GetSubKind())
-	}
-
-	if role.GetVersion() == "" {
-		return trace.BadParameter("scoped role %q is missing version", role.GetMetadata().GetName())
-	}
-
-	if role.GetVersion() != types.V1 {
-		return trace.BadParameter("scoped role %q has unsupported version %q (expected %q)", role.GetMetadata().GetName(), role.GetVersion(), types.V1)
-	}
-
-	if role.GetScope() == "" {
-		return trace.BadParameter("scoped role %q is missing scope", role.GetMetadata().GetName())
-	}
-
-	return nil
-}
-
-// WeakValidatedSubAssignments is a helper for iterating all well formed sub-assignments within a given assignment. Note that the concept
-// of a well-formed sub-assignment is distinct from wether or not an assignment is "boken/invalidated" in the sense used when
-// deciding wether or not an access-control check can be performed for a given scope. The only thing that is being filtered out
-// by this iterator is sub-assignments that are so obviously misconfigured that we can't reason about them at all. Sub-assignments
-// returned by this iterator may still be broken because they assign a nonexistent role, or to a scope that the target role is not
-// assignable to.
-func WeakValidatedSubAssignments(assignment *srpb.ScopedRoleAssignment) iter.Seq[*srpb.Assignment] {
-	return func(yield func(*srpb.Assignment) bool) {
-		for _, subAssignment := range assignment.GetSpec().GetAssignments() {
-			if subAssignment.GetRole() == "" {
-				// ignore sub-assignments with missing role
-				continue
-			}
-
-			if err := scopes.WeakValidate(subAssignment.GetScope()); err != nil {
-				// ignore sub-assignments with invalid scopes
-				continue
-			}
-
-			if !scopes.PolicyAssignmentScope(subAssignment.GetScope()).IsSubjectToPolicyResourceScope(assignment.GetScope()) {
-				// ignore sub-assignments with scopes that do not conform to assignment subjugation rules
-				continue
-			}
-
-			if !yield(subAssignment) {
-				return
-			}
-		}
-	}
-}
-
-// WeakValidateAssignment validates an assignment to ensure it is free of obvious issues that would render it unusable and/or
-// induce serious unintended behavior. Prefer using this function for validating assignments loaded from "internal" sources
-// (e.g. backend/control-plane), and [StrongValidateAssignment] for validating assignments loaded from "external" sources (e.g. user input).
-func WeakValidateAssignment(assignment *srpb.ScopedRoleAssignment) error {
-	if err := commonValidateAssignment(assignment); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := scopes.WeakValidate(assignment.GetScope()); err != nil {
-		return trace.BadParameter("scoped role assignment %q has invalid scope: %v", assignment.GetMetadata().GetName(), err)
-	}
-
-	// NOTE: in strong validation, this is where we'd check that the sub-assignments are valid. In weak validation
-	// we don't do that and instead rely on invalid sub-assignments being filtered out and excluded during runtime
-	// assignment resolution.
-
-	return nil
-}
-
-// StrongValidateAssignment performs robust validation of an assignment to ensure it complies with all expected constraints. Prefer
-// using this function for validating assignments loaded from "external" sources (e.g. user input), and [WeakValidateAssignment] for
-// validating assignments loaded from "internal" sources (e.g. backend/control-plane).
-func StrongValidateAssignment(assignment *srpb.ScopedRoleAssignment) error {
-	if err := commonValidateAssignment(assignment); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if _, err := uuid.Parse(assignment.GetMetadata().GetName()); err != nil {
-		return trace.BadParameter("scoped role assignment %q has invalid name (must be uuid): %v", assignment.GetMetadata().GetName(), err)
-	}
-
-	if err := scopes.StrongValidate(assignment.GetScope()); err != nil {
-		return trace.BadParameter("scoped role assignment %q has invalid scope: %v", assignment.GetMetadata().GetName(), err)
-	}
-
-	if len(assignment.GetSpec().GetAssignments()) == 0 {
-		return trace.BadParameter("scoped role assignment %q does not assign any roles", assignment.GetMetadata().GetName())
-	}
-
-	if len(assignment.GetSpec().GetAssignments()) > MaxRolesPerAssignment {
-		return trace.BadParameter("scoped role assignment %q contains too many sub-assignments (max %d)", assignment.GetMetadata().GetName(), MaxRolesPerAssignment)
-	}
-
-	for i, subAssignment := range assignment.GetSpec().GetAssignments() {
-		if subAssignment.GetRole() == "" {
-			return trace.BadParameter("scoped role assignment %q is missing role in sub-assignment %d", assignment.GetMetadata().GetName(), i)
-		}
-
-		if err := validateRoleName(subAssignment.GetRole()); err != nil {
-			return trace.BadParameter("scoped role assignment %q has invalid role name in sub-assignment %d: %v", assignment.GetMetadata().GetName(), i, err)
-		}
-
-		if err := scopes.StrongValidate(subAssignment.GetScope()); err != nil {
-			return trace.BadParameter("scoped role assignment %q has invalid scope in sub-assignment %d: %v", assignment.GetMetadata().GetName(), i, err)
-		}
-
-		if !scopes.PolicyAssignmentScope(subAssignment.GetScope()).IsSubjectToPolicyResourceScope(assignment.GetScope()) {
-			return trace.BadParameter("scoped role assignment %q has sub-assignment %d with scope %q that is not a sub-scope of the assignment's scope %q", assignment.GetMetadata().GetName(), i, subAssignment.GetScope(), assignment.GetScope())
-		}
-	}
-
-	return nil
-}
-
-func commonValidateAssignment(assignment *srpb.ScopedRoleAssignment) error {
-	if assignment.GetMetadata().GetName() == "" {
-		return trace.BadParameter("scoped role assignment is missing metadata.name")
-	}
-
-	if assignment.GetKind() == "" {
-		return trace.BadParameter("scoped role assignment %q is missing kind", assignment.GetMetadata().GetName())
-	}
-
-	if assignment.GetKind() != KindScopedRoleAssignment {
-		return trace.BadParameter("scoped role assignment %q has invalid kind %q, expected %q", assignment.GetMetadata().GetName(), assignment.GetKind(), KindScopedRoleAssignment)
-	}
-
-	if assignment.GetSubKind() != "" {
-		return trace.BadParameter("scoped role assignment %q has unknown sub_kind %q", assignment.GetMetadata().GetName(), assignment.GetSubKind())
-	}
-
-	if assignment.GetVersion() == "" {
-		return trace.BadParameter("scoped role assignment %q is missing version", assignment.GetMetadata().GetName())
-	}
-
-	if assignment.GetVersion() != types.V1 {
-		return trace.BadParameter("scoped role assignment %q has unsupported version %q (expected %q)", assignment.GetMetadata().GetName(), assignment.GetVersion(), types.V1)
-	}
-
-	if assignment.GetScope() == "" {
-		return trace.BadParameter("scoped role assignment %q is missing scope", assignment.GetMetadata().GetName())
-	}
-
-	if assignment.GetSpec().GetUser() == "" {
-		return trace.BadParameter("scoped role assignment %q is missing spec.user", assignment.GetMetadata().GetName())
-	}
-
-	return nil
-}
diff --git a/lib/scopes/roles/roles_test.go b/lib/scopes/roles/roles_test.go
deleted file mode 100644
index 091e32ef7ab9d..0000000000000
--- a/lib/scopes/roles/roles_test.go
+++ /dev/null
@@ -1,796 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package roles
-
-import (
-	"slices"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-
-	headerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	srpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1"
-	"github.com/gravitational/teleport/api/types"
-)
-
-// TestValidateRole verifies basic functionality of strong and weak role validation functions.
-func TestValidateRole(t *testing.T) {
-	t.Parallel()
-
-	tts := []struct {
-		name     string
-		role     *srpb.ScopedRole
-		strongOk bool
-		weakOk   bool
-	}{
-		{
-			name: "basic",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: true,
-			weakOk:   true,
-		},
-		{
-			name: "unknown sub_kind",
-			role: &srpb.ScopedRole{
-				Kind:    KindScopedRole,
-				SubKind: "unknown",
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing name",
-			role: &srpb.ScopedRole{
-				Kind:     KindScopedRole,
-				Metadata: &headerpb.Metadata{},
-				Scope:    "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing kind",
-			role: &srpb.ScopedRole{
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing version",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "malformed name",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "foo/bar",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "malformed kind",
-			role: &srpb.ScopedRole{
-				Kind: "role",
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "slightly malformed scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "foo/bar",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo/bar"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "siginifcantly malformed scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "foo@bar",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo/bar"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing assignable scopes",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope:   "/",
-				Spec:    &srpb.ScopedRoleSpec{},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "slightly malformed assignable scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"foo/bar"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "siginifcantly malformed assignable scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"foo@bar"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true, // invalid assignable scopes are totally ignored, even if they don't pass weak validation rules
-		},
-		{
-			name: "impermissable assignable scope",
-			role: &srpb.ScopedRole{
-				Kind: KindScopedRole,
-				Metadata: &headerpb.Metadata{
-					Name: "test",
-				},
-				Scope: "/foo/bar",
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: []string{"/foo"},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-	}
-
-	for _, tt := range tts {
-		t.Run(tt.name, func(t *testing.T) {
-			err := StrongValidateRole(tt.role)
-			if tt.strongOk {
-				require.NoError(t, err, "strong validation should not fail")
-			} else {
-				require.Error(t, err, "strong validation should fail")
-			}
-
-			err = WeakValidateRole(tt.role)
-			if tt.weakOk {
-				require.NoError(t, err, "weak validation should not fail")
-			} else {
-				require.Error(t, err, "weak validation should fail")
-			}
-		})
-	}
-}
-
-func TestValidateAsssignment(t *testing.T) {
-	t.Parallel()
-
-	tts := []struct {
-		name       string
-		assignment *srpb.ScopedRoleAssignment
-		strongOk   bool
-		weakOk     bool
-	}{
-		{
-			name: "basic",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: true,
-			weakOk:   true,
-		},
-		{
-			name: "unknown sub_kind",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind:    KindScopedRoleAssignment,
-				SubKind: "unknown",
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing name",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind:     KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{},
-				Scope:    "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing kind",
-			assignment: &srpb.ScopedRoleAssignment{
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing scope",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "missing version",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "malformed name",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: "not-a-uuid",
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "malformed kind",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: "not_scoped_role_assignment",
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "slightly malformed scope",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "foo",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "significantly malformed scope",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "foo@bar",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   false,
-		},
-		{
-			name: "impermissable assigned scope",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/foo/bar",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "malformed assigned scope",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: false,
-			weakOk:   true,
-		},
-		{
-			name: "basic",
-			assignment: &srpb.ScopedRoleAssignment{
-				Kind: KindScopedRoleAssignment,
-				Metadata: &headerpb.Metadata{
-					Name: uuid.New().String(),
-				},
-				Scope: "/",
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					User: "alice",
-					Assignments: []*srpb.Assignment{
-						{
-							Role:  "test",
-							Scope: "/foo",
-						},
-					},
-				},
-				Version: types.V1,
-			},
-			strongOk: true,
-			weakOk:   true,
-		},
-	}
-
-	for _, tt := range tts {
-		t.Run(tt.name, func(t *testing.T) {
-			err := StrongValidateAssignment(tt.assignment)
-			if tt.strongOk {
-				require.NoError(t, err, "strong validation should not fail")
-			} else {
-				require.Error(t, err, "strong validation should fail")
-			}
-
-			err = WeakValidateAssignment(tt.assignment)
-			if tt.weakOk {
-				require.NoError(t, err, "weak validation should not fail")
-			} else {
-				require.Error(t, err, "weak validation should fail")
-			}
-		})
-	}
-}
-
-func TestWeakValidatedAssignableScopes(t *testing.T) {
-	t.Parallel()
-
-	tts := []struct {
-		name             string
-		scope            string
-		assignableScopes []string
-		expect           []string
-	}{
-		{
-			name:             "basic",
-			scope:            "/foo",
-			assignableScopes: []string{"/foo/bar", "/foo/baz"},
-			expect:           []string{"/foo/bar", "/foo/baz"},
-		},
-		{
-			name:             "empty",
-			scope:            "/foo",
-			assignableScopes: nil,
-			expect:           nil,
-		},
-		{
-			name:             "mildly malformed",
-			scope:            "/foo",
-			assignableScopes: []string{"foo/bar", "foo/baz"},
-			expect:           []string{"foo/bar", "foo/baz"},
-		},
-		{
-			name:             "significantly malformed",
-			scope:            "/foo",
-			assignableScopes: []string{"foo@bar", "foo@baz"},
-			expect:           nil,
-		},
-		{
-			name:             "impermissible",
-			scope:            "/foo/bar",
-			assignableScopes: []string{"/foo", "/foo/bar"},
-			expect:           []string{"/foo/bar"},
-		},
-	}
-
-	for _, tt := range tts {
-		t.Run(tt.name, func(t *testing.T) {
-			result := slices.Collect(WeakValidatedAssignableScopes(&srpb.ScopedRole{
-				Scope: tt.scope,
-				Spec: &srpb.ScopedRoleSpec{
-					AssignableScopes: tt.assignableScopes,
-				},
-			}))
-			require.Equal(t, tt.expect, result)
-		})
-	}
-}
-
-func TestWeakValidatedSubAssignments(t *testing.T) {
-	t.Parallel()
-
-	tts := []struct {
-		name        string
-		scope       string
-		assignments []*srpb.Assignment
-		expect      []*srpb.Assignment
-	}{
-		{
-			name:  "basic",
-			scope: "/foo",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-		},
-		{
-			name:  "mildly malformed scope",
-			scope: "/foo",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "foo/bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "foo/bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-		},
-		{
-			name:  "significantly malformed scope",
-			scope: "/foo",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "foo@bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-		},
-		{
-			name:  "impermissible scope",
-			scope: "/foo/bar",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-			},
-		},
-		{
-			name:  "missing scope",
-			scope: "/foo",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "",
-				},
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/baz",
-				},
-			},
-		},
-		{
-			name:  "missing role",
-			scope: "/foo",
-			assignments: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "",
-					Scope: "/foo/baz",
-				},
-			},
-			expect: []*srpb.Assignment{
-				{
-					Role:  "test",
-					Scope: "/foo/bar",
-				},
-			},
-		},
-	}
-
-	for _, tt := range tts {
-		t.Run(tt.name, func(t *testing.T) {
-			result := slices.Collect(WeakValidatedSubAssignments(&srpb.ScopedRoleAssignment{
-				Scope: tt.scope,
-				Spec: &srpb.ScopedRoleAssignmentSpec{
-					Assignments: tt.assignments,
-				},
-			}))
-			require.Equal(t, tt.expect, result)
-		})
-	}
-}
diff --git a/lib/scopes/scopes.go b/lib/scopes/scopes.go
index 76b3e80d95e54..1e303deca5b5e 100644
--- a/lib/scopes/scopes.go
+++ b/lib/scopes/scopes.go
@@ -23,14 +23,15 @@ import (
 	"iter"
 	"regexp"
 	"strings"
+	"unicode"
 
 	"github.com/gravitational/trace"
 )
 
 // segmentRegexp is the regular expression used to validate scope segments. It allows
-// alphanumeric characters, hyphens, underscores, and periods. It also requires that the
-// segment starts and ends with an alphanumeric character.
-var segmentRegexp = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9\-\_\.]*[a-zA-Z0-9]$`)
+// lowercase alphanumeric characters, hyphens, underscores, and periods. It also requires
+// that the segment starts and ends with an alphanumeric character.
+var segmentRegexp = regexp.MustCompile(`^[a-z0-9][a-z0-9\-\_\.]*[a-z0-9]$`)
 
 const (
 	// separator is the character used to separate segments in a scope and is the the value of the root scope.
@@ -61,6 +62,12 @@ const (
 	breakingChars = "\\@(){}\"'%*?#$!+=|<>,;~`&[]/"
 )
 
+// Root is the root scope. Non-policy resources being grandfathered into scoping should use this
+// as their default scope value, which will exclude the resource from administration by any policy
+// other than non-scoped policies and root-scoped policies. Note that there is no sane default scoping
+// for a policy. Policy resources should never use this or any other default scope value.
+const Root = separator
+
 // StrongValidate checks if the scope is valid according to all scope formatting rules. This function
 // *must* be called on all scope values received from user input and/or cluster-external sources (e.g.
 // an identity provider). Use of this function should be avoided when checking the validity of scopes
@@ -132,6 +139,14 @@ func StrongValidateSegment(segment string) error {
 		return trace.BadParameter("segment %q is too short (min characters %d)", segment, minSegmentSize)
 	}
 
+	// check for uppercase characters separately. this would be caught by the regex, but its better
+	// UX to call out uppercase characters specifically since its a common mistake.
+	for _, r := range segment {
+		if unicode.IsUpper(r) {
+			return trace.BadParameter("segment %q contains uppercase character(s)", segment)
+		}
+	}
+
 	if !segmentRegexp.MatchString(segment) {
 		return trace.BadParameter("segment %q is malformed", segment)
 	}
@@ -246,6 +261,37 @@ func DescendingSegments(scope string) iter.Seq[string] {
 	return strings.SplitSeq(strings.TrimSuffix(strings.TrimPrefix(scope, "/"), "/"), "/")
 }
 
+// DescendingScopes produces an iterator over the canonical representations of the parents of
+// a scope in descending order, ending with the canonical representation of the scope itself.
+// e.g. `DescendingScopes("/a/b/c")` will result in an iterator that returns `/`, `/a`, `/a/b`,
+// and `/a/b/c` in that order. `DescendingScopes("/")` will return a single-element iterator, and
+// `DescendingScopes("")` will return an empty iterator.
+//
+// Note that this function does not perform validation and is deliberately more relaxed about
+// its inputs than our validation functions allow.
+func DescendingScopes(scope string) iter.Seq[string] {
+	return func(yield func(string) bool) {
+		if scope == "" {
+			return
+		}
+
+		// start with the root scope
+		if !yield(separator) {
+			return
+		}
+
+		var segments []string
+		// iterate over the segments in descending order
+		for segment := range DescendingSegments(scope) {
+			segments = append(segments, segment)
+
+			if !yield(Join(segments...)) {
+				return
+			}
+		}
+	}
+}
+
 // Join joins the given segments into a single scope string. Note that this function
 // does not perform validation and will produce invalid scopes if one or more segments
 // are invalid.
@@ -271,13 +317,37 @@ func Join(segments ...string) string {
 	return scope
 }
 
+// NormalizeForEquality attempts to normalize a scope s.t. equivalent scopes will have identical string representations. The only way
+// scopes can currently be equivalent without being identical is by lacking a leading separator or containing a trailing separator.
+// In general, we prefer to avoid modifying scope values as a verson incompatibility or bug that causes modification of a scope to change
+// the result of scope comparison could result in a security issue. Normalizing on separators is the exception because separators
+// are purely syntactic and have no semantic meaning beyond delimiting segments, and we effectively are already forced to normalize
+// on separators (especially where scope caching is concerned, as scoped values must be organized by segment hierarchy for efficient
+// lookups).
+//
+// NOTE: it generally holds that NormalizeForEquality(x) == NormalizeForEquality(x) if Compare(x, y) == Equivalent and vice versa, *except*
+// in the case of two empty scopes. Empty scopes are invalid and considered orthogonal to one another, a proprerty which isn't really reasonable
+// to preserve in this normalization function. Avoid using this function in contexts where scope values may be empty.
+func NormalizeForEquality(scope string) string {
+	if scope == "" {
+		return ""
+	}
+
+	segments := make([]string, 0, strings.Count(scope, separator))
+	for segment := range DescendingSegments(scope) {
+		segments = append(segments, segment)
+	}
+
+	return Join(segments...)
+}
+
 // Relationship describes the relationship between two scopes, as determined by the [Compare] function. Note
 // that direct use of this type in access-control logic is discouraged, as it is easier to accidentally
 // misuse than the provided helpers (e.g. [PolicyScope]).
 type Relationship int
 
 const (
-	// Orhogonal indicates that the scopes are divergents/unrelated (e.g. '/foo' and '/bar').
+	// Orthogonal indicates that the scopes are divergents/unrelated (e.g. '/foo' and '/bar').
 	Orthogonal Relationship = iota
 	// Equivalent indicates that the scopes are equal. Some non-equal scope strings are still
 	// considered equivalent by [Compare] (e.g. 'foo' and '/foo/'), though the canonical representations
@@ -363,6 +433,49 @@ func Compare(lhs, rhs string) Relationship {
 	}
 }
 
+// Sort is a helper function for sorting scopes. Scope sort order differs from lexographic sort of
+// a scope's string representation in some cases. For example, the lexicographically sorted sequence
+// of scopes ['/aa', '/aa-bb', '/aa/bb'] is different from the scope-sorted sequence
+// ['/aa', '/aa/bb', '/aa-bb']. This function conforms to the standard go comparison contract, returning
+// a negative integer if lhs < rhs, zero if lhs == rhs, and a positive integer if lhs > rhs.
+func Sort(lhs, rhs string) int {
+	if lhs == rhs {
+		return 0
+	}
+
+	lNext, lStop := iter.Pull(DescendingSegments(lhs))
+	defer lStop()
+
+	rNext, rStop := iter.Pull(DescendingSegments(rhs))
+	defer rStop()
+
+	for {
+		lVal, lOk := lNext()
+		rVal, rOk := rNext()
+
+		switch {
+		case lOk && rOk:
+			// both scopes have segments left to compare
+			if c := strings.Compare(lVal, rVal); c == 0 {
+				// scopes are still equivalent at this level, continue processing
+				continue
+			} else {
+				// scopes have diverged
+				return c
+			}
+		case lOk && !rOk:
+			// the right hand side scope is an ancestor of the left hand side scope
+			return 1
+		case !lOk && rOk:
+			// the left hand side scope is an ancestor of the right hand side scope
+			return -1
+		case !lOk && !rOk:
+			// scopes are equivalent
+			return 0
+		}
+	}
+}
+
 // PolicyScope is a helper for constructing unambiguous checks in access control logic. Prefer helpers like
 // this over using the Compare function directly, as it improves readability and reduces the risk of misuse. Ex:
 //
diff --git a/lib/scopes/scopes_test.go b/lib/scopes/scopes_test.go
index f9c7efb8eccbf..f9ff422988dae 100644
--- a/lib/scopes/scopes_test.go
+++ b/lib/scopes/scopes_test.go
@@ -96,6 +96,24 @@ func TestValidateSegment(t *testing.T) {
 			strongOk: false,
 			weakOk:   false,
 		},
+		{
+			name:     "leading uppercase segment",
+			segment:  "Aa",
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name:     "middle uppsercase segment",
+			segment:  "aAa",
+			strongOk: false,
+			weakOk:   true,
+		},
+		{
+			name:     "trailing uppercase segment",
+			segment:  "aA",
+			strongOk: false,
+			weakOk:   true,
+		},
 	}
 
 	for _, tt := range tts {
@@ -411,6 +429,66 @@ func TestJoin(t *testing.T) {
 	}
 }
 
+// TestDescendingScopes tests the DescendingScopes function for various combinations of scopes, and verifies that
+func TestDescendingScopes(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name   string
+		scope  string
+		expect []string
+	}{
+		{
+			name:   "root",
+			scope:  "/",
+			expect: []string{"/"},
+		},
+		{
+			name:   "empty",
+			scope:  "",
+			expect: nil,
+		},
+		{
+			name:   "single-segment",
+			scope:  "/aa",
+			expect: []string{"/", "/aa"},
+		},
+		{
+			name:   "multi-segment",
+			scope:  "/aa/bb/cc",
+			expect: []string{"/", "/aa", "/aa/bb", "/aa/bb/cc"},
+		},
+		{
+			name:   "dangling separator single",
+			scope:  "/aa/",
+			expect: []string{"/", "/aa"},
+		},
+		{
+			name:   "dangling separator multi",
+			scope:  "/aa/bb/cc/",
+			expect: []string{"/", "/aa", "/aa/bb", "/aa/bb/cc"},
+		},
+		{
+			name:   "missing prefix single",
+			scope:  "aa",
+			expect: []string{"/", "/aa"},
+		},
+		{
+			name:   "missing prefix multi",
+			scope:  "aa/bb/cc",
+			expect: []string{"/", "/aa", "/aa/bb", "/aa/bb/cc"},
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			// verify that the iterator produces the expected scopes
+			scopes := slices.Collect(DescendingScopes(tt.scope))
+			require.Equal(t, tt.expect, scopes)
+		})
+	}
+}
+
 // TestCompare tests the Compare function for various combinations of scopes.
 func TestCompare(t *testing.T) {
 	t.Parallel()
@@ -509,6 +587,140 @@ func TestCompare(t *testing.T) {
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
 			require.Equal(t, tt.rel, Compare(tt.lhs, tt.rhs), "Compare(%q, %q)", tt.lhs, tt.rhs)
+
+			// verify that NormalizeForEquality produces equivalent equality results *except* in the case of two empty scopes,
+			// which are considered orthogonal by Compare but will end up being equal when normalized.
+			if tt.rel == Equivalent || (tt.lhs == "" && tt.rhs == "") {
+				require.Equal(t, NormalizeForEquality(tt.lhs), NormalizeForEquality(tt.rhs), "expected NormalizeForEquality(%q) == NormalizeForEquality(%q)", tt.lhs, tt.rhs)
+			} else {
+				require.NotEqual(t, NormalizeForEquality(tt.lhs), NormalizeForEquality(tt.rhs), "expected NormalizeForEquality(%q) != NormalizeForEquality(%q)", tt.lhs, tt.rhs)
+			}
+		})
+	}
+}
+
+func TestNormalizeForEquality(t *testing.T) {
+	tts := []struct {
+		name   string
+		scope  string
+		expect string
+	}{
+		{
+			name:   "root",
+			scope:  "/",
+			expect: "/",
+		},
+		{
+			name:   "dangling separator",
+			scope:  "/aa/bb/cc/",
+			expect: "/aa/bb/cc",
+		},
+		{
+			name:   "missing prefix",
+			scope:  "aa/bb/cc",
+			expect: "/aa/bb/cc",
+		},
+		{
+			name:   "both missing prefix and dangling separator",
+			scope:  "aa/bb/cc/",
+			expect: "/aa/bb/cc",
+		},
+		{
+			name:   "normal scope",
+			scope:  "/aa/bb/cc",
+			expect: "/aa/bb/cc",
+		},
+		{
+			name:   "empty scope",
+			scope:  "",
+			expect: "",
+		},
+		{
+			name:   "empty segment",
+			scope:  "/aa//bb/cc/",
+			expect: "/aa//bb/cc",
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expect, NormalizeForEquality(tt.scope), "NormalizeForEquality(%q)", tt.scope)
+		})
+	}
+}
+
+// Test Sort verifies that the Sort function produces the expected ordering for various scopes.
+func TestSort(t *testing.T) {
+	t.Parallel()
+
+	tts := []struct {
+		name        string
+		scopes      []string
+		expected    []string
+		lexographic bool
+	}{
+		{
+			name:        "basic hierarchy",
+			scopes:      []string{"/aa/bb", "/aa", "/", "/aa/bb/cc"},
+			expected:    []string{"/", "/aa", "/aa/bb", "/aa/bb/cc"},
+			lexographic: true,
+		},
+		{
+			name:        "basic non-lexographic",
+			scopes:      []string{"/aa-bb", "/aa", "/", "/aa/bb", "/aa/bb-cc"},
+			expected:    []string{"/", "/aa", "/aa/bb", "/aa/bb-cc", "/aa-bb"},
+			lexographic: false,
+		},
+		{
+			name:        "empty",
+			scopes:      []string{},
+			expected:    []string{},
+			lexographic: true,
+		},
+		{
+			name:        "single element",
+			scopes:      []string{"/aa/bb/cc"},
+			expected:    []string{"/aa/bb/cc"},
+			lexographic: true,
+		},
+		{
+			name:        "missing prefixes",
+			scopes:      []string{"/aa/bb/cc", "aa/bb", "/aa", "/", "xx/yy", "/xx/yy"},
+			expected:    []string{"/", "/aa", "aa/bb", "/aa/bb/cc", "xx/yy", "/xx/yy"},
+			lexographic: false,
+		},
+		{
+			name:        "dangling suffixes",
+			scopes:      []string{"/aa/bb/cc/", "/aa/", "/"},
+			expected:    []string{"/", "/aa/", "/aa/bb/cc/"},
+			lexographic: true,
+		},
+		{
+			name:        "prefix and suffix do not affect ordering of equivalents",
+			scopes:      []string{"xx/yy", "/aa/bb/", "/xx/yy", "/aa/bb", "/aa/bb/", "xx/yy"},
+			expected:    []string{"/aa/bb/", "/aa/bb", "/aa/bb/", "xx/yy", "/xx/yy", "xx/yy"},
+			lexographic: false,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			sorted := make([]string, len(tt.scopes))
+			copy(sorted, tt.scopes)
+
+			slices.SortFunc(sorted, Sort)
+
+			require.Equal(t, tt.expected, sorted, "expected scope sort")
+
+			lex := make([]string, len(tt.scopes))
+			copy(lex, tt.scopes)
+			slices.Sort(lex)
+
+			if tt.lexographic {
+				require.Equal(t, lex, sorted, "scope sort is expected to match lexographic sort")
+			} else {
+				require.NotEqual(t, lex, sorted, "scope sort is expected to differ from lexographic sort")
+			}
 		})
 	}
 }
diff --git a/lib/scopes/utils/range.go b/lib/scopes/utils/range.go
new file mode 100644
index 0000000000000..814ea78de9d1d
--- /dev/null
+++ b/lib/scopes/utils/range.go
@@ -0,0 +1,56 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package utils
+
+import (
+	"context"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// RangeScopedRoles is a helper function that streams scoped roles from the provided reader.
+// NOTE: this function mutates the request's PageToken field during iteration.
+func RangeScopedRoles(ctx context.Context, reader services.ScopedRoleReader, req *scopedaccessv1.ListScopedRolesRequest) stream.Stream[*scopedaccessv1.ScopedRole] {
+	return clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageToken string) ([]*scopedaccessv1.ScopedRole, string, error) {
+		req.PageSize = int32(pageSize)
+		req.PageToken = pageToken
+		rsp, err := reader.ListScopedRoles(ctx, req)
+		if err != nil {
+			return nil, "", err
+		}
+		return rsp.GetRoles(), rsp.GetNextPageToken(), nil
+	})
+}
+
+// RangeScopedRoleAssignments is a helper function that streams scoped role assignments from the provided reader.
+// NOTE: this function mutates the request's PageToken field during iteration.
+func RangeScopedRoleAssignments(ctx context.Context, reader services.ScopedRoleAssignmentReader, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) stream.Stream[*scopedaccessv1.ScopedRoleAssignment] {
+	return clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageToken string) ([]*scopedaccessv1.ScopedRoleAssignment, string, error) {
+		req.PageSize = int32(pageSize)
+		req.PageToken = pageToken
+		rsp, err := reader.ListScopedRoleAssignments(ctx, req)
+		if err != nil {
+			return nil, "", err
+		}
+		return rsp.GetAssignments(), rsp.GetNextPageToken(), nil
+	})
+}
diff --git a/lib/scopes/utils/range_test.go b/lib/scopes/utils/range_test.go
new file mode 100644
index 0000000000000..823b85567c48f
--- /dev/null
+++ b/lib/scopes/utils/range_test.go
@@ -0,0 +1,123 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package utils
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/cache/assignments"
+	"github.com/gravitational/teleport/lib/scopes/cache/roles"
+)
+
+func TestRangeScopedRoles(t *testing.T) {
+	const roleCount = 503
+
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	upstream := roles.NewRoleCache()
+
+	expectedRoleNames := make([]string, 0, roleCount)
+
+	for i := range roleCount {
+		name := fmt.Sprintf("role-%d", i)
+		err := upstream.Put(&scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Scope: "/foo",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		})
+		require.NoError(t, err)
+		expectedRoleNames = append(expectedRoleNames, name)
+	}
+
+	gotRoleNames := make([]string, 0, roleCount)
+
+	for role, err := range RangeScopedRoles(ctx, upstream, &scopedaccessv1.ListScopedRolesRequest{}) {
+		require.NoError(t, err)
+		require.NotNil(t, role)
+
+		gotRoleNames = append(gotRoleNames, role.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedRoleNames, gotRoleNames)
+}
+
+func TestRangeScopedRoleAssignments(t *testing.T) {
+	const assignmentCount = 503
+
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	upstream := assignments.NewAssignmentCache()
+
+	expectedAssignmentNames := make([]string, 0, assignmentCount)
+
+	for range assignmentCount {
+		name := uuid.New().String()
+		err := upstream.Put(&scopedaccessv1.ScopedRoleAssignment{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				User: "alice",
+				Assignments: []*scopedaccessv1.Assignment{
+					{
+						Role:  "some-role",
+						Scope: "/foo",
+					},
+				},
+			},
+			Version: types.V1,
+		})
+		require.NoError(t, err)
+		expectedAssignmentNames = append(expectedAssignmentNames, name)
+	}
+
+	gotAssignmentNames := make([]string, 0, assignmentCount)
+
+	for assignment, err := range RangeScopedRoleAssignments(ctx, upstream, &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		require.NoError(t, err)
+		require.NotNil(t, assignment)
+
+		gotAssignmentNames = append(gotAssignmentNames, assignment.GetMetadata().GetName())
+	}
+
+	require.ElementsMatch(t, expectedAssignmentNames, gotAssignmentNames)
+}
diff --git a/lib/secret/secret.go b/lib/secret/secret.go
index a27edd822a58c..e95f6f0650e8f 100644
--- a/lib/secret/secret.go
+++ b/lib/secret/secret.go
@@ -115,7 +115,7 @@ func (k Key) Open(ciphertext []byte) ([]byte, error) {
 	// (for example, for legacy secret package or attacker controlled data),
 	// reject invalid sized nonces.
 	if len(data.Nonce) != aesgcm.NonceSize() {
-		return nil, trace.BadParameter("invalid nonce sice, only %v supported", aesgcm.NonceSize())
+		return nil, trace.BadParameter("invalid nonce size, only %v supported", aesgcm.NonceSize())
 	}
 
 	plaintext, err := aesgcm.Open(nil, data.Nonce, data.Ciphertext, nil)
diff --git a/lib/secret/secret_test.go b/lib/secret/secret_test.go
index d98ad5b811e90..fb4d3f38d7a08 100644
--- a/lib/secret/secret_test.go
+++ b/lib/secret/secret_test.go
@@ -26,11 +26,11 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/secretsscanner/authorizedkeys/users_list.go b/lib/secretsscanner/authorizedkeys/users_list.go
deleted file mode 100644
index 70f3bc2bbdff1..0000000000000
--- a/lib/secretsscanner/authorizedkeys/users_list.go
+++ /dev/null
@@ -1,43 +0,0 @@
-//go:build !windows
-
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package authorizedkeys
-
-/*
-#cgo CFLAGS: -D_POSIX_PTHREAD_SEMANTICS
-#include <pwd.h>
-*/
-import "C"
-
-import (
-	"os/user"
-	"strconv"
-)
-
-// passwdC2Go converts `passwd` struct from C to golang native struct
-func passwdC2Go(passwdC *C.struct_passwd) user.User {
-	return user.User{
-		Name:     C.GoString(passwdC.pw_name),
-		Username: C.GoString(passwdC.pw_name),
-		Uid:      strconv.FormatUint(uint64(passwdC.pw_uid), 10),
-		Gid:      strconv.FormatUint(uint64(passwdC.pw_gid), 10),
-		HomeDir:  C.GoString(passwdC.pw_dir),
-	}
-}
diff --git a/lib/secretsscanner/authorizedkeys/users_list_darwin.go b/lib/secretsscanner/authorizedkeys/users_list_darwin.go
index 9155cf4392e68..7eeb334bfbfcb 100644
--- a/lib/secretsscanner/authorizedkeys/users_list_darwin.go
+++ b/lib/secretsscanner/authorizedkeys/users_list_darwin.go
@@ -19,29 +19,54 @@
 package authorizedkeys
 
 /*
-#cgo CFLAGS: -D_POSIX_PTHREAD_SEMANTICS
 #include <pwd.h>
 */
 import "C"
 
 import (
 	"os/user"
+	"runtime"
+	"strconv"
+
+	"github.com/gravitational/trace"
 )
 
-// getHostUsers returns a list of all users on the host
-// from local /etc/passwd file, LDAP, or other user databases.
-func getHostUsers() (results []user.User, _ error) {
+// getHostUsers returns the list of all users on the host from the user
+// directory (depending on system configuration this can be /etc/passwd,
+// LDAP...).
+func getHostUsers() ([]user.User, error) {
+	// on darwin the setpwent/getpwent/endpwent functions use thread-local
+	// storage so there's no need for a global lock but we must call the whole
+	// sequence from the same thread
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
 	C.setpwent()
-	var result *C.struct_passwd
+	defer C.endpwent()
+
+	var results []user.User
 	for {
-		result = C.getpwent() /* on darwin, getpwent() is reentrant */
-		if result == nil {
-			break
+		result, err := C.getpwent()
+		// cgo error convention, check the return value before errno
+		if result != nil {
+			results = append(results, passwdC2Go(result))
+			continue
+		}
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		results = append(results, passwdC2Go(result))
+		return results, nil
 	}
+}
 
-	C.endpwent()
-
-	return results, nil
+// passwdC2Go converts `passwd` struct from C to golang native struct
+func passwdC2Go(passwdC *C.struct_passwd) user.User {
+	name := C.GoString(passwdC.pw_name)
+	return user.User{
+		Name:     name,
+		Username: name,
+		Uid:      strconv.FormatUint(uint64(passwdC.pw_uid), 10),
+		Gid:      strconv.FormatUint(uint64(passwdC.pw_gid), 10),
+		HomeDir:  C.GoString(passwdC.pw_dir),
+	}
 }
diff --git a/lib/secretsscanner/authorizedkeys/users_list_linux.go b/lib/secretsscanner/authorizedkeys/users_list_linux.go
new file mode 100644
index 0000000000000..9e750d2123877
--- /dev/null
+++ b/lib/secretsscanner/authorizedkeys/users_list_linux.go
@@ -0,0 +1,74 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package authorizedkeys
+
+/*
+#define _XOPEN_SOURCE 500
+#include <pwd.h>
+*/
+import "C"
+
+import (
+	"os/user"
+	"strconv"
+	"sync"
+
+	"github.com/gravitational/trace"
+)
+
+// pwentLock should be acquired when using MT-Unsafe race:pwent functions (i.e.
+// setpwent/getpwent/endpwent).
+var pwentLock sync.Mutex
+
+// getHostUsers returns the list of all users on the host from the user
+// directory (depending on system configuration this can be /etc/passwd,
+// LDAP...).
+func getHostUsers() ([]user.User, error) {
+	pwentLock.Lock()
+	defer pwentLock.Unlock()
+
+	C.setpwent()
+	defer C.endpwent()
+
+	var results []user.User
+	for {
+		result, err := C.getpwent()
+		// cgo error convention, check the return value before errno
+		if result != nil {
+			results = append(results, passwdC2Go(result))
+			continue
+		}
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return results, nil
+	}
+}
+
+// passwdC2Go converts `passwd` struct from C to golang native struct
+func passwdC2Go(passwdC *C.struct_passwd) user.User {
+	name := C.GoString(passwdC.pw_name)
+	return user.User{
+		Name:     name,
+		Username: name,
+		Uid:      strconv.FormatUint(uint64(passwdC.pw_uid), 10),
+		Gid:      strconv.FormatUint(uint64(passwdC.pw_gid), 10),
+		HomeDir:  C.GoString(passwdC.pw_dir),
+	}
+}
diff --git a/lib/secretsscanner/authorizedkeys/users_list_other.go b/lib/secretsscanner/authorizedkeys/users_list_other.go
new file mode 100644
index 0000000000000..5355306b85027
--- /dev/null
+++ b/lib/secretsscanner/authorizedkeys/users_list_other.go
@@ -0,0 +1,38 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build !darwin && !linux
+
+package authorizedkeys
+
+import (
+	"os/user"
+
+	"github.com/gravitational/trace"
+)
+
+var alwaysFalse bool
+
+// getHostUsers returns ErrUnsupportedPlatform because this platform is not
+// supported. On supported platforms, it returns the list of all users on the
+// host from the user directory.
+func getHostUsers() ([]user.User, error) {
+	if alwaysFalse {
+		// thwart the well-meaning intentions of staticcheck
+		return nil, nil
+	}
+	return nil, trace.Wrap(ErrUnsupportedPlatform)
+}
diff --git a/lib/secretsscanner/authorizedkeys/users_list_unix.go b/lib/secretsscanner/authorizedkeys/users_list_unix.go
deleted file mode 100644
index b8c2dc45ffa9c..0000000000000
--- a/lib/secretsscanner/authorizedkeys/users_list_unix.go
+++ /dev/null
@@ -1,67 +0,0 @@
-//go:build !darwin
-
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package authorizedkeys
-
-/*
-#cgo CFLAGS: -D_POSIX_PTHREAD_SEMANTICS -D__USE_MISC
-#include <unistd.h>
-#include <sys/types.h>
-#include <pwd.h>
-#include <stdlib.h>
-*/
-import "C"
-
-import (
-	"os/user"
-
-	"github.com/gravitational/trace"
-)
-
-// getHostUsers returns a list of all users on the host
-// from local /etc/passwd file, LDAP, or other user databases.
-func getHostUsers() (results []user.User, _ error) {
-
-	bufSize := C.sysconf(C._SC_GETPW_R_SIZE_MAX)
-	if bufSize == -1 {
-		bufSize = 16384
-	}
-	if bufSize <= 0 || bufSize > 1<<20 {
-		return nil, trace.BadParameter("unreasonable _SC_GETPW_R_SIZE_MAX of %d", bufSize)
-	}
-	buf := C.malloc(C.size_t(bufSize))
-	defer C.free(buf)
-
-	C.setpwent()
-
-	var pwdBuf C.struct_passwd
-	for {
-		var result *C.struct_passwd
-		rv := C.getpwent_r(&pwdBuf, (*C.char)(buf), C.size_t(bufSize), &result)
-		if rv != 0 || result == nil {
-			break
-		}
-		results = append(results, passwdC2Go(&pwdBuf))
-	}
-
-	C.endpwent()
-
-	return results, nil
-}
diff --git a/lib/selinux/selinux.go b/lib/selinux/selinux.go
index b19683e10b85c..0e8e471699694 100644
--- a/lib/selinux/selinux.go
+++ b/lib/selinux/selinux.go
@@ -19,7 +19,7 @@
 package selinux
 
 type filePaths struct {
-	InstallDir     string
+	BinaryPath     string
 	DataDir        string
 	ConfigPath     string
 	UpgradeUnitDir string
diff --git a/lib/selinux/selinux_linux.go b/lib/selinux/selinux_linux.go
index 4d69b8973de6b..14fcc66e94272 100644
--- a/lib/selinux/selinux_linux.go
+++ b/lib/selinux/selinux_linux.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"context"
 	_ "embed"
+	"errors"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -31,6 +32,7 @@ import (
 	ocselinux "github.com/opencontainers/selinux/go-selinux"
 
 	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 	"github.com/gravitational/teleport/lib/versioncontrol"
 )
 
@@ -39,8 +41,13 @@ const (
 	selinuxRoot          = "/var/lib/selinux"
 	selinuxTypeTag       = "SELINUXTYPE"
 	moduleName           = "teleport_ssh"
+	execType             = "teleport_ssh_exec_t"
 	domain               = "teleport_ssh_t"
 	permissiveModuleName = "permissive_" + domain
+
+	// the SELinux user and role that Systemd services run as by default
+	selinuxSystemUser = "system_u"
+	selinuxSystemRole = "system_r"
 )
 
 //go:embed teleport_ssh.te
@@ -54,18 +61,33 @@ func ModuleSource() string {
 	return module
 }
 
-// FileContexts returns file contexts for the SELinux SSH module.
-func FileContexts(installDir, dataDir, configPath string) (string, error) {
+// FileContexts returns file contexts for the SELinux SSH module. If the
+// teleport binary is not calling this, then execPathOverride should be
+// set to the path of the teleport binary that should be confined by
+// SELinux.
+func FileContexts(dataDir, configPath, execPathOverride string) (string, error) {
 	fcTempl, err := template.New("selinux file contexts").Parse(fileContexts)
 	if err != nil {
 		return "", trace.Wrap(err, "failed to parse file contexts template")
 	}
 
+	binaryPath := execPathOverride
+	if binaryPath == "" {
+		binaryPath, err = os.Executable()
+		if err != nil {
+			return "", trace.Wrap(err, "failed to get the path of the executable")
+		}
+	}
+	binaryPath, err = filepath.EvalSymlinks(binaryPath)
+	if err != nil {
+		return "", trace.Wrap(err, "failed to expand symlinks for the executable")
+	}
+
 	// Generate a file specifying the locations of important dirs so SELinux
 	// will allow Teleport SSH to be able to access them.
 	var buf bytes.Buffer
 	err = fcTempl.Execute(&buf, filePaths{
-		InstallDir:     installDir,
+		BinaryPath:     binaryPath,
 		DataDir:        dataDir,
 		ConfigPath:     configPath,
 		UpgradeUnitDir: versioncontrol.UnitConfigDir,
@@ -77,9 +99,39 @@ func FileContexts(installDir, dataDir, configPath string) (string, error) {
 	return buf.String(), nil
 }
 
+type selinuxContext struct {
+	user               string
+	role               string
+	domain             string
+	multiLevelSecurity string
+}
+
+// parseLabel parses an SELinux context string.
+func parseLabel(label string) (*selinuxContext, error) {
+	seCtx, err := ocselinux.NewContext(label)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to parse SELinux context")
+	}
+
+	return &selinuxContext{
+		user:               seCtx["user"],
+		role:               seCtx["role"],
+		domain:             seCtx["type"],
+		multiLevelSecurity: seCtx["level"],
+	}, nil
+}
+
+func (c *selinuxContext) String() string {
+	if c.multiLevelSecurity == "" {
+		return c.user + ":" + c.role + ":" + c.domain
+	}
+	return c.user + ":" + c.role + ":" + c.domain + ":" + c.multiLevelSecurity
+}
+
 // CheckConfiguration returns an error if SELinux is not configured to
 // enforce the SSH service correctly.
 func CheckConfiguration(ensureEnforced bool, logger *slog.Logger) error {
+	// ensure SELinux is enabled and running with the correct mode.
 	if !ocselinux.GetEnabled() {
 		return trace.Errorf("SELinux is disabled or not present")
 	}
@@ -94,6 +146,20 @@ func CheckConfiguration(ensureEnforced bool, logger *slog.Logger) error {
 		}
 	}
 
+	// ensure we are running under the correct domain.
+	label, err := ocselinux.CurrentLabel()
+	if err != nil {
+		return trace.Wrap(err, "failed to get SELinux context")
+	}
+	seCtx, err := parseLabel(label)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if seCtx.domain != domain {
+		return trace.Wrap(diagnoseWrongDomain(seCtx, logger))
+	}
+
+	// ensure the SELinux module is installed and enabled.
 	selinuxType, err := readConfig(selinuxTypeTag)
 	if err != nil {
 		return trace.Wrap(err, "failed to find SELinux type")
@@ -106,7 +172,7 @@ func CheckConfiguration(ensureEnforced bool, logger *slog.Logger) error {
 	}
 
 	if !installed {
-		return trace.Errorf("the SSH SELinux module %s is not installed", moduleName)
+		return trace.NotFound("the SSH SELinux module %s is not installed", moduleName)
 	}
 	if disabled {
 		return trace.Errorf("the SSH SELinux module %s is disabled", moduleName)
@@ -122,6 +188,61 @@ func CheckConfiguration(ensureEnforced bool, logger *slog.Logger) error {
 	return nil
 }
 
+// this function attempts to diagnose why Teleport is not running under the correct SELinux domain.
+func diagnoseWrongDomain(procCtx *selinuxContext, logger *slog.Logger) error {
+	if procCtx.user != selinuxSystemUser || procCtx.role != selinuxSystemRole {
+		logger.WarnContext(
+			context.Background(),
+			"Teleport is not running as the system_u:system_r SELinux user and role, running Teleport as a Systemd service is recommended when --enable-selinux is passed",
+			"selinux_context", logutils.StringerAttr(procCtx),
+		)
+	}
+	const fallbackErrMsg = "" +
+		"Teleport is running under the wrong SELinux domain %q instead of %q, SELinux will not enforce Teleport correctly. " +
+		"Refer to https://goteleport.com/docs/admin-guides/management/security/selinux/ for more information."
+	fallbackErr := trace.Errorf(fallbackErrMsg, procCtx.domain, domain)
+
+	execPath, err := os.Executable()
+	if err != nil {
+		return trace.NewAggregate(trace.Wrap(err, "failed to get executable path"), fallbackErr)
+	}
+	label, err := ocselinux.FileLabel(execPath)
+	if err != nil {
+		return trace.NewAggregate(trace.Wrap(err, "failed to get SELinux label of executable"), fallbackErr)
+	}
+	fileCtx, err := parseLabel(label)
+	if err != nil {
+		return trace.NewAggregate(trace.Wrap(err, "failed to parse SELinux context"), fallbackErr)
+	}
+	if fileCtx.domain != domain {
+		const binaryLabelErrMsg = "" +
+			"Teleport binary %q is labeled with SELinux type %q, it needs to be labeled with type %q to be enforced by SELinux correctly. " +
+			"Refer to https://goteleport.com/docs/admin-guides/management/security/selinux/ for how to label the binary correctly."
+		return trace.Errorf(binaryLabelErrMsg, execPath, fileCtx.domain, execType)
+	}
+
+	return fallbackErr
+}
+
+// ModuleInstalled returns true if the SSH SELinux module is installed.
+func ModuleInstalled() (bool, error) {
+	selinuxType, err := readConfig(selinuxTypeTag)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+	if err != nil {
+		return false, trace.Wrap(err, "failed to find SELinux type")
+	}
+
+	modulesDir := filepath.Join(selinuxRoot, selinuxType, "active/modules")
+	installed, _, _, err := moduleStatus(modulesDir)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	return installed, nil
+}
+
 func moduleStatus(modulesDir string) (installed bool, disabled bool, permissive bool, err error) {
 	disabledModPath := filepath.Join(modulesDir, "disabled", moduleName)
 	// SELinux modules can't be disabled and permissive, so we can
diff --git a/lib/selinux/selinux_others.go b/lib/selinux/selinux_others.go
index b3cb240670c2e..f8084bfb8fef5 100644
--- a/lib/selinux/selinux_others.go
+++ b/lib/selinux/selinux_others.go
@@ -34,7 +34,7 @@ func ModuleSource() string {
 }
 
 // FileContexts returns file contexts for the SELinux SSH module.
-func FileContexts(installDir, dataDir, configPath string) (string, error) {
+func FileContexts(dataDir, configPath, execPathOverride string) (string, error) {
 	return "", trace.Errorf(errPlatformNotSupportedMsg)
 }
 
@@ -44,6 +44,11 @@ func CheckConfiguration(ensureEnforced bool, logger *slog.Logger) error {
 	return trace.Errorf(errPlatformNotSupportedMsg)
 }
 
+// ModuleInstalled returns true if the SSH SELinux module is installed.
+func ModuleInstalled() (bool, error) {
+	return false, trace.Errorf(errPlatformNotSupportedMsg)
+}
+
 // UserContext returns the SELinux context that should be used when
 // creating processes as a certain user.
 func UserContext(login string) (string, error) {
diff --git a/lib/selinux/selinux_test.go b/lib/selinux/selinux_test.go
index 7a3c9b8a158f8..98c43668cf1e7 100644
--- a/lib/selinux/selinux_test.go
+++ b/lib/selinux/selinux_test.go
@@ -35,7 +35,7 @@ func TestFileContextTemplate(t *testing.T) {
 	fcTempl, err := template.New("selinux file contexts").Parse(string(fileConTmpl))
 	require.NoError(t, err)
 	err = fcTempl.Execute(io.Discard, &filePaths{
-		InstallDir:     "/dir",
+		BinaryPath:     "/dir",
 		DataDir:        "/dir",
 		ConfigPath:     "/dir",
 		UpgradeUnitDir: "/dir",
diff --git a/lib/selinux/teleport_ssh.fc.tmpl b/lib/selinux/teleport_ssh.fc.tmpl
index c427211e4b896..5b97e97ebe406 100644
--- a/lib/selinux/teleport_ssh.fc.tmpl
+++ b/lib/selinux/teleport_ssh.fc.tmpl
@@ -1,9 +1,5 @@
-# teleport-update install dir
-{{ .InstallDir }}/versions/[0-9\.]+/bin/teleport  -- gen_context(system_u:object_r:teleport_ssh_exec_t,s0)
-# teleport binary installed by RPM package
-{{ .InstallDir }}/system/bin/teleport             -- gen_context(system_u:object_r:teleport_ssh_exec_t,s0)
-/usr/local/bin/teleport                           -- gen_context(system_u:object_r:teleport_ssh_exec_t,s0)
-/run/.teleport.pid                                -- gen_context(system_u:object_r:teleport_ssh_pid_t,s0)
-{{ .ConfigPath }}                                 -- gen_context(system_u:object_r:teleport_ssh_conf_t,s0)
-{{ .DataDir }}(/.*)?                                 gen_context(system_u:object_r:teleport_ssh_data_t,s0)
-{{ .UpgradeUnitDir }}(/.*)?                          gen_context(system_u:object_r:teleport_ssh_upgrade_data_t,s0)
+{{ .BinaryPath }}            -- gen_context(system_u:object_r:teleport_ssh_exec_t,s0)
+/run/teleport.pid            -- gen_context(system_u:object_r:teleport_ssh_pid_t,s0)
+{{ .ConfigPath }}            -- gen_context(system_u:object_r:teleport_ssh_conf_t,s0)
+{{ .DataDir }}(/.*)?            gen_context(system_u:object_r:teleport_ssh_data_t,s0)
+{{ .UpgradeUnitDir }}(/.*)?     gen_context(system_u:object_r:teleport_ssh_upgrade_data_t,s0)
diff --git a/lib/selinux/teleport_ssh.te b/lib/selinux/teleport_ssh.te
index 59ec76e719ce3..5766b65e64b8c 100644
--- a/lib/selinux/teleport_ssh.te
+++ b/lib/selinux/teleport_ssh.te
@@ -84,8 +84,25 @@ files_type(teleport_ssh_upgrade_data_t);
 # creation of initial process
 ##
 init_daemon_domain(teleport_ssh_t, teleport_ssh_exec_t)
-# needed if run manually from terminal
-allow teleport_ssh_t teleport_ssh_exec_t:file { exec_file_perms lock entrypoint map };
+# Allow any domain to execute Teleport; using 'domain' instead of a
+# specific domain type matches all SELinux domains.
+#
+# This is needed for SFTP support, as Teleport re-execs itself to start
+# an SFTP server. To re-exec, Teleport creates a child process that 
+# configures a grandchild process appropriately (in this case that is 
+# the SFTP server process). The child process will set the SELinux exec
+# label depending on what host login is specified before launching the
+# grandchild. This ensures the grandchild will inherit the correct SELinux
+# context that the host login user should have.
+#
+# Therefore for SFTP to function properly with any user login all SELinux
+# domains must be allowed to exec Teleport, as we don't know what 
+# domains host users will have when writing this module.
+#
+# This shouldn't be a problem from a security perspective though, as 
+# Teleport won't be allowed to do anything the user couldn't do already
+# due to SELinux enforcement.
+allow domain teleport_ssh_exec_t:file { exec_file_perms lock entrypoint map };
 
 ##
 # files
@@ -183,9 +200,6 @@ allow teleport_ssh_t self:capability { chown dac_read_search dac_override fowner
 fs_search_cgroup_dirs(teleport_ssh_t);
 fs_rw_cgroup_files(teleport_ssh_t);
 
-# allow SSH shell process to start a Teleport process (needed to detirmine home dir)
-allow unconfined_t teleport_ssh_exec_t:file entrypoint;
-
 # host auth
 auth_use_nsswitch(teleport_ssh_t);
 allow teleport_ssh_t passwd_file_t:file read_file_perms;
diff --git a/lib/service/acme.go b/lib/service/acme.go
index 340451b58be11..d36e429398fed 100644
--- a/lib/service/acme.go
+++ b/lib/service/acme.go
@@ -36,8 +36,8 @@ type hostPolicyCheckerConfig struct {
 	publicAddrs []utils.NetAddr
 	// clt is used to get the list of registered applications
 	clt app.Getter
-	// tun is a reverse tunnel
-	tun reversetunnelclient.Tunnel
+	// clusterGetter is used to retrieve connected Teleport clusters.
+	clusterGetter reversetunnelclient.ClusterGetter
 	// clusterName is a name of this cluster
 	clusterName string
 }
@@ -60,7 +60,7 @@ func (h *hostPolicyChecker) checkHost(ctx context.Context, host string) error {
 		return nil
 	}
 
-	_, _, err := app.ResolveFQDN(ctx, h.cfg.clt, h.cfg.tun, h.dnsNames, host)
+	_, _, err := app.ResolveFQDN(ctx, h.cfg.clt, h.cfg.clusterGetter, h.dnsNames, host)
 	if err == nil {
 		return nil
 	}
@@ -91,8 +91,8 @@ func (h *hostPolicyCheckerConfig) CheckAndSetDefaults() ([]string, error) {
 		return nil, trace.BadParameter("missing parameter clt")
 	}
 
-	if h.tun == nil {
-		return nil, trace.BadParameter("missing parameter tun")
+	if h.clusterGetter == nil {
+		return nil, trace.BadParameter("missing parameter clusterGetter")
 	}
 
 	dnsNames := make([]string, 0, len(h.publicAddrs))
diff --git a/lib/service/awsoidc.go b/lib/service/awsoidc.go
index 182f7cb643346..fa23815267eb4 100644
--- a/lib/service/awsoidc.go
+++ b/lib/service/awsoidc.go
@@ -32,8 +32,8 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
@@ -49,7 +49,7 @@ const (
 	maxConcurrentUpdates = 3
 )
 
-func (process *TeleportProcess) initAWSOIDCDeployServiceUpdater(channels automaticupgrades.Channels) error {
+func (process *TeleportProcess) initAWSOIDCDeployServiceUpdater(channels automaticupgrades.Channels, cache AWSOIDCDeployServiceUpdaterCache) error {
 	// start process only after teleport process has started
 	if _, err := process.WaitForEvent(process.GracefulExitContext(), TeleportReadyEvent); err != nil {
 		return trace.Wrap(err)
@@ -81,6 +81,7 @@ func (process *TeleportProcess) initAWSOIDCDeployServiceUpdater(channels automat
 
 	updater, err := NewDeployServiceUpdater(AWSOIDCDeployServiceUpdaterConfig{
 		Log:                    process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentProxy, "aws_oidc_deploy_service_updater")),
+		Cache:                  cache,
 		AuthClient:             authClient,
 		Clock:                  process.Clock,
 		TeleportClusterName:    clusterNameConfig.GetClusterName(),
@@ -95,12 +96,38 @@ func (process *TeleportProcess) initAWSOIDCDeployServiceUpdater(channels automat
 	return trace.Wrap(updater.Run(process.GracefulExitContext()))
 }
 
+// AWSOIDCDeployServiceUpdaterCache provides access to reading and listing resources using the cache.
+type AWSOIDCDeployServiceUpdaterCache interface {
+	// GetToken returns a provision token by name.
+	GetToken(ctx context.Context, name string) (types.ProvisionToken, error)
+	// GetDatabases returns all database resources.
+	GetDatabases(ctx context.Context) ([]types.Database, error)
+	// ListIntegrations returns a paginated list of all integration resources.
+	ListIntegrations(ctx context.Context, pageSize int, nextToken string) ([]types.Integration, string, error)
+}
+
+// AWSOIDCDeployServiceUpdaterClient provides methods to interact with other cluster services.
+type AWSOIDCDeployServiceUpdaterClient interface {
+	// GenerateAWSOIDCToken generates a token to be used when executing an AWS OIDC Integration action.
+	GenerateAWSOIDCToken(ctx context.Context, integration string) (string, error)
+	// AcquireSemaphore acquires lease with requested resources from semaphore.
+	AcquireSemaphore(ctx context.Context, params types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error)
+	// CancelSemaphoreLease cancels semaphore lease early.
+	CancelSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error
+	// GetClusterMaintenanceConfig gets the current maintenance window config singleton.
+	GetClusterMaintenanceConfig(ctx context.Context) (types.ClusterMaintenanceConfig, error)
+	// UpsertToken creates or updates a provision token.
+	UpsertToken(ctx context.Context, token types.ProvisionToken) error
+}
+
 // AWSOIDCDeployServiceUpdaterConfig specifies updater configs
 type AWSOIDCDeployServiceUpdaterConfig struct {
 	// Log is the logger
 	Log *slog.Logger
 	// AuthClient is the auth api client
-	AuthClient *authclient.Client
+	AuthClient AWSOIDCDeployServiceUpdaterClient
+	// Cache provides access to reading and listing resources.
+	Cache AWSOIDCDeployServiceUpdaterCache
 	// Clock is the local clock
 	Clock clockwork.Clock
 	// TeleportClusterName specifies the teleport cluster name
@@ -117,6 +144,10 @@ func (cfg *AWSOIDCDeployServiceUpdaterConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("auth client required")
 	}
 
+	if cfg.Cache == nil {
+		return trace.BadParameter("cache required")
+	}
+
 	if cfg.TeleportClusterName == "" {
 		return trace.BadParameter("teleport cluster name required")
 	}
@@ -210,7 +241,7 @@ func (updater *AWSOIDCDeployServiceUpdater) updateAWSOIDCDeployServices(ctx cont
 		return nil
 	}
 
-	databases, err := updater.AuthClient.GetDatabases(ctx)
+	databases, err := updater.Cache.GetDatabases(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -226,24 +257,14 @@ func (updater *AWSOIDCDeployServiceUpdater) updateAWSOIDCDeployServices(ctx cont
 		}
 	}
 
-	integrations, err := updater.AuthClient.ListAllIntegrations(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Perform updates in parallel across regions.
 	sem := semaphore.NewWeighted(maxConcurrentUpdates)
-	for _, ig := range integrations {
-		for region := range awsRegions {
-			if err := sem.Acquire(ctx, 1); err != nil {
-				return trace.Wrap(err)
-			}
-			go func(ig types.Integration, region string) {
-				defer sem.Release(1)
-				if err := updater.updateAWSOIDCDeployService(ctx, ig, region, stableVersion); err != nil {
-					updater.Log.WarnContext(ctx, "Failed to update AWS OIDC Deploy Service", "integration", ig.GetName(), "region", region, "error", err)
-				}
-			}(ig, region)
+	for integration, err := range clientutils.Resources(ctx, updater.Cache.ListIntegrations) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if err := updater.processIntegration(ctx, sem, awsRegions, integration, stableVersion); err != nil {
+			return trace.Wrap(err)
 		}
 	}
 
@@ -251,6 +272,21 @@ func (updater *AWSOIDCDeployServiceUpdater) updateAWSOIDCDeployServices(ctx cont
 	return trace.Wrap(sem.Acquire(ctx, maxConcurrentUpdates))
 }
 
+func (updater *AWSOIDCDeployServiceUpdater) processIntegration(ctx context.Context, sem *semaphore.Weighted, awsRegions map[string]any, ig types.Integration, stableVersion *semver.Version) error {
+	for region := range awsRegions {
+		if err := sem.Acquire(ctx, 1); err != nil {
+			return trace.Wrap(err)
+		}
+		go func(ig types.Integration, region string) {
+			defer sem.Release(1)
+			if err := updater.updateAWSOIDCDeployService(ctx, ig, region, stableVersion); err != nil {
+				updater.Log.WarnContext(ctx, "Failed to update AWS OIDC Deploy Service", "integration", ig.GetName(), "region", region, "error", err)
+			}
+		}(ig, region)
+	}
+	return nil
+}
+
 func (updater *AWSOIDCDeployServiceUpdater) updateAWSOIDCDeployService(ctx context.Context, integration types.Integration, awsRegion string, teleportVersion *semver.Version) error {
 	// Do not attempt update if integration is not an AWS OIDC integration.
 	if integration.GetAWSOIDCIntegrationSpec() == nil {
@@ -272,7 +308,7 @@ func (updater *AWSOIDCDeployServiceUpdater) updateAWSOIDCDeployService(ctx conte
 	}
 
 	// The deploy service client is initialized using AWS OIDC integration.
-	awsOIDCDeployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, req, updater.AuthClient)
+	awsOIDCDeployServiceClient, err := awsoidc.NewDeployServiceClient(ctx, req, updater.Cache, updater.AuthClient)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/service/connect.go b/lib/service/connect.go
index 3a55e16176971..ee72ba7997376 100644
--- a/lib/service/connect.go
+++ b/lib/service/connect.go
@@ -52,11 +52,12 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/join"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/joinclient"
 	"github.com/gravitational/teleport/lib/observability/metrics"
+	grpcmetrics "github.com/gravitational/teleport/lib/observability/metrics/grpc"
 	"github.com/gravitational/teleport/lib/openssh"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	servicebreaker "github.com/gravitational/teleport/lib/service/breaker"
@@ -72,9 +73,9 @@ const updateClientsJoinWarning = "This agent joined the cluster during the updat
 // service until succeeds or process gets shut down
 func (process *TeleportProcess) reconnectToAuthService(role types.SystemRole) (*Connector, error) {
 	retry, err := retryutils.NewLinear(retryutils.LinearConfig{
-		First:  retryutils.HalfJitter(process.Config.MaxRetryPeriod / 10),
-		Step:   process.Config.MaxRetryPeriod / 5,
-		Max:    process.Config.MaxRetryPeriod,
+		First:  retryutils.HalfJitter(process.Config.AuthConnectionConfig.InitialConnectionDelay),
+		Step:   process.Config.AuthConnectionConfig.BackoffStepDuration,
+		Max:    process.Config.AuthConnectionConfig.UpperLimitBetweenRetries,
 		Clock:  process.Clock,
 		Jitter: retryutils.HalfJitter,
 	})
@@ -90,14 +91,13 @@ func (process *TeleportProcess) reconnectToAuthService(role types.SystemRole) (*
 				// client, so it does not make sense to call reconnectToAuthService.
 				return nil, trace.BadParameter("reconnectToAuthService got a connector with no client, this is a logic error")
 			}
-
 			return connector, nil
 		} else {
 			switch {
 			case errors.As(connectErr, &invalidVersionErr{}):
 				return nil, trace.Wrap(connectErr)
-			case role == types.RoleNode && strings.Contains(connectErr.Error(), auth.TokenExpiredOrNotFound):
-				process.logger.ErrorContext(process.ExitContext(), "Can not join the cluster as node, the token expired or not found. Regenerate the token and try again.")
+			case strings.Contains(connectErr.Error(), auth.TokenExpiredOrNotFound):
+				process.logger.ErrorContext(process.ExitContext(), "Can not join the cluster, the token is expired or not found. Regenerate the token and try again.")
 			default:
 				process.logger.ErrorContext(process.ExitContext(), "Failed to establish connection to cluster.", "identity", role, "error", connectErr)
 				if process.Config.Version == defaults.TeleportConfigVersionV3 && process.Config.ProxyServer.IsEmpty() {
@@ -149,7 +149,7 @@ func (process *TeleportProcess) assertSystemRoles(rolesToAssert []types.SystemRo
 		}
 
 		err = conn.Client.AssertSystemRole(process.ExitContext(), proto.SystemRoleAssertion{
-			ServerID:    process.Config.HostUUID,
+			ServerID:    conn.HostUUID(),
 			AssertionID: assertionID,
 			SystemRole:  role,
 		})
@@ -210,7 +210,7 @@ func (process *TeleportProcess) connect(role types.SystemRole, opts ...certOptio
 	for _, opt := range opts {
 		opt(&options)
 	}
-	processState, err := process.storage.GetState(context.TODO(), role)
+	processState, err := process.storage.GetState(process.GracefulExitContext(), role)
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return nil, trace.Wrap(err)
@@ -220,13 +220,26 @@ func (process *TeleportProcess) connect(role types.SystemRole, opts ...certOptio
 		c, err := process.firstTimeConnect(role)
 		return c, trace.Wrap(err)
 	}
-	process.logger.DebugContext(process.ExitContext(), "Got connected state.", "rotation_state", logutils.StringerAttr(&processState.Spec.Rotation))
+	process.logger.DebugContext(process.GracefulExitContext(), "Got connected state.", "rotation_state", logutils.StringerAttr(&processState.Spec.Rotation))
 
 	identity, err := process.getIdentity(role)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	if role == types.RoleInstance {
+		// If necessary, heal the instance identity by rejoining to get a new
+		// identity with all required system roles. This is best-effort, any
+		// error will be logged and the current identity will continue to be
+		// used.
+		newIdentity, err := process.healInstanceIdentity(identity)
+		if err != nil {
+			process.logger.WarnContext(process.ExitContext(), "Failed to heal instance identity", "error", err)
+		} else {
+			identity = newIdentity
+		}
+	}
+
 	rotation := processState.Spec.Rotation
 
 	switch rotation.State {
@@ -310,6 +323,104 @@ func (process *TeleportProcess) connect(role types.SystemRole, opts ...certOptio
 	}
 }
 
+func (process *TeleportProcess) healInstanceIdentity(currentIdentity *state.Identity) (*state.Identity, error) {
+	currentSystemRoles := utils.NewSet(currentIdentity.SystemRoles...)
+	wantSystemRoles := utils.NewSetWithCapacity[string](len(process.instanceRoles))
+	for role := range process.instanceRoles {
+		wantSystemRoles.Add(string(role))
+	}
+
+	missingSystemRoles := wantSystemRoles.Clone().Subtract(currentSystemRoles)
+	if len(missingSystemRoles) == 0 {
+		// The current instance identity contains all required roles, nothing to do.
+		return currentIdentity, nil
+	}
+
+	process.logger.InfoContext(process.ExitContext(), "Instance identity is missing required system roles, will attempt to self-heal", "missing_roles", missingSystemRoles.Elements())
+	additionalPrincipals, dnsNames := process.instanceAdditionalPrincipals()
+	var (
+		newIdentity *state.Identity
+		err         error
+	)
+	if server := process.getLocalAuth(); server != nil {
+		process.logger.InfoContext(process.ExitContext(), "Generating new Instance identity with local auth service")
+		newIdentity, err = auth.GenerateIdentity(server, currentIdentity.ID, additionalPrincipals, dnsNames)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to generate new instance identity with local auth service")
+		}
+	} else {
+		process.logger.InfoContext(process.ExitContext(), "Must rejoin to get a new Instance identity")
+		if !process.Config.HasToken() {
+			return nil, trace.Errorf("must rejoin to obtain missing system roles but no join token is configured")
+		}
+
+		// Make an auth client authenticated with the current instance identity to use for the rejoin.
+		currentConnector, err := process.getConnector(currentIdentity, currentIdentity)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to make connector with current instance identity")
+		}
+		currentAuthClient := currentConnector.Client
+
+		// Rejoin.
+		joinParams, err := process.makeJoinParams(
+			currentIdentity.ID,
+			additionalPrincipals,
+			dnsNames,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to make join params")
+		}
+		joinParams.AuthClient = currentAuthClient
+		rejoinResult, err := joinclient.Join(process.GracefulExitContext(), *joinParams)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to rejoin")
+		}
+		privateKeyPEM, err := keys.MarshalPrivateKey(rejoinResult.PrivateKey)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to marshal private key")
+		}
+		newIdentity, err = state.ReadIdentityFromKeyPair(privateKeyPEM, rejoinResult.Certs)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to parse new identity")
+		}
+	}
+
+	newSystemRoles := utils.NewSet(newIdentity.SystemRoles...)
+
+	// Sanity check we didn't lose any system roles.
+	if lostRoles := currentSystemRoles.Clone().Subtract(newSystemRoles); len(lostRoles) > 0 {
+		return nil, trace.Errorf("new Instance identity is missing the following system roles from the current identity (this is a bug): %v", lostRoles.Elements())
+	}
+	// Sanity check the host ID didn't change.
+	if currentIdentity.ID.HostID() != newIdentity.ID.HostID() {
+		return nil, trace.Errorf("new Instance host ID %s does not match current host ID %s (this is a bug)",
+			newIdentity.ID.HostID(),
+			currentIdentity.ID.HostID())
+	}
+
+	gainedSystemRoles := newSystemRoles.Clone().Subtract(currentSystemRoles)
+	if len(gainedSystemRoles) == 0 {
+		process.logger.WarnContext(process.ExitContext(), "Did not gain any system roles")
+		// Don't bother saving or returning the new identity if no system roles were gained.
+		return currentIdentity, nil
+	}
+
+	if rolesStillMissing := missingSystemRoles.Clone().Subtract(newSystemRoles); len(rolesStillMissing) > 0 {
+		process.logger.WarnContext(process.ExitContext(), "Partially healed instance identity but some required system roles are still missing",
+			"gained_roles", gainedSystemRoles.Elements(),
+			"missing_roles", rolesStillMissing.Elements())
+	} else {
+		process.logger.InfoContext(process.ExitContext(), "Obtained new instance identity with all required system roles",
+			"gained_roles", gainedSystemRoles.Elements(),
+		)
+	}
+
+	if err := process.storage.WriteIdentity(state.IdentityCurrent, *newIdentity); err != nil {
+		return nil, trace.Wrap(err, "failed to write new identity to storage")
+	}
+	return newIdentity, nil
+}
+
 // newWatcher returns a new watcher,
 // either using local auth server connection or remote client
 func (process *TeleportProcess) newWatcher(conn *Connector, watch types.Watch) (types.Watcher, error) {
@@ -333,6 +444,17 @@ func (process *TeleportProcess) getCertAuthority(conn *Connector, id types.CertA
 	return conn.Client.GetCertAuthority(ctx, id, loadPrivateKeys)
 }
 
+// localReRegister wraps an [*auth.Server] and removes the scope parameter from the signature of
+// [auth.Server.GenerateHostCerts]
+type localReRegister struct {
+	*auth.Server
+}
+
+// GenerateHostCerts allows for generating host certs without providing a scope.
+func (l localReRegister) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequest) (*proto.Certs, error) {
+	return l.Server.GenerateHostCerts(ctx, req, "")
+}
+
 // reRegister receives new identity credentials for proxy, node and auth.
 // In case if auth servers, the role is 'TeleportAdmin' and instead of using
 // TLS client this method uses the local auth server.
@@ -348,7 +470,7 @@ func (process *TeleportProcess) reRegister(conn *Connector, additionalPrincipals
 	var clt auth.ReRegisterClient = conn.Client
 	var remoteAddr string
 	if srv := process.getLocalAuth(); srv != nil {
-		clt = srv
+		clt = localReRegister{srv}
 		// auth server typically extracts remote addr from conn. since we're using the local auth
 		// directly we must supply a reasonable remote addr value. preferably the advertise IP, but
 		// otherwise localhost. this behavior must be kept consistent with the equivalent behavior
@@ -375,100 +497,21 @@ func (process *TeleportProcess) reRegister(conn *Connector, additionalPrincipals
 }
 
 func (process *TeleportProcess) firstTimeConnect(role types.SystemRole) (*Connector, error) {
-	id := state.IdentityID{
-		Role:     role,
-		HostUUID: process.Config.HostUUID,
-		NodeName: process.Config.Hostname,
-	}
-	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(role)
+	identity, err := process.firstTimeConnectIdentity(role)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	var identity *state.Identity
-	if process.getLocalAuth() != nil {
-		// Auth service is on the same host, no need to go though the invitation
-		// procedure.
-		process.logger.DebugContext(process.ExitContext(), "This server has local Auth server started, using it to add role to the cluster.")
-		var systemRoles []types.SystemRole
-		if role == types.RoleInstance {
-			// normally this is taken from the join token, but if we're dealing with a local auth server, we
-			// need to determine the roles for the instance cert ourselves.
-			systemRoles = process.getInstanceRoles()
-		}
-
-		identity, err = auth.LocalRegister(id, process.getLocalAuth(), additionalPrincipals, dnsNames, process.Config.AdvertiseIP, systemRoles)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	} else {
-		// Auth server is remote, so we need a provisioning token.
-		if !process.Config.HasToken() {
-			return nil, trace.BadParameter("%v must join a cluster and needs a provisioning token", role)
-		}
-
-		process.logger.InfoContext(process.ExitContext(), "Joining the cluster with a secure token.")
-		token, err := process.Config.Token()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		dataDir := defaults.DataDir
-		if process.Config.DataDir != "" {
-			dataDir = process.Config.DataDir
-		}
-
-		registerParams := join.RegisterParams{
-			Token:                token,
-			ID:                   id,
-			AuthServers:          process.Config.AuthServerAddresses(),
-			ProxyServer:          process.Config.ProxyServer,
-			AdditionalPrincipals: additionalPrincipals,
-			DNSNames:             dnsNames,
-			CipherSuites:         process.Config.CipherSuites,
-			CAPins:               process.Config.CAPins,
-			CAPath:               filepath.Join(dataDir, defaults.CACertFile),
-			GetHostCredentials:   client.HostCredentials,
-			Clock:                process.Clock,
-			JoinMethod:           process.Config.JoinMethod,
-			// this circuit breaker is used for a client that only does a few
-			// requests before closing
-			CircuitBreakerConfig: breaker.NoopBreakerConfig(),
-			FIPS:                 process.Config.FIPS,
-			Insecure:             lib.IsInsecureDevMode(),
-		}
-		if registerParams.JoinMethod == types.JoinMethodAzure {
-			registerParams.AzureParams = join.AzureParams{
-				ClientID: process.Config.JoinParams.Azure.ClientID,
-			}
-		}
-
-		result, err := join.Register(process.ExitContext(), registerParams)
-		if err != nil {
-			if utils.IsUntrustedCertErr(err) {
-				return nil, trace.WrapWithMessage(err, utils.SelfSignedCertsMsg)
-			}
-			return nil, trace.Wrap(err)
-		}
-
-		privateKeyPEM, err := keys.MarshalPrivateKey(result.PrivateKey)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		identity, err = state.ReadIdentityFromKeyPair(privateKeyPEM, result.Certs)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
 
 	process.logger.InfoContext(process.ExitContext(), "Successfully obtained credentials to connect to the cluster.", "identity", role)
 	var connector *Connector
 	if role == types.RoleAdmin || role == types.RoleAuth {
+		var err error
 		connector, err = newConnector(identity, identity)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	} else {
+		var err error
 		connector, err = process.getConnector(identity, identity)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -505,10 +548,198 @@ func (process *TeleportProcess) firstTimeConnect(role types.SystemRole) (*Connec
 	if err != nil {
 		return nil, trace.NewAggregate(err, connector.Close())
 	}
+
+	if role == types.RoleInstance {
+		// Instance always joins first, only try to persist host ID after
+		// successfully completing the instance join and persisting the state
+		// and identity.
+		if err := process.storage.PersistAssignedHostID(process.GracefulExitContext(), process.Config, identity.ID.HostID()); err != nil {
+			return nil, trace.Wrap(err, "persisting host ID to storage")
+		}
+	}
 	process.logger.InfoContext(process.ExitContext(), "The process successfully wrote the credentials and state to the disk.", "identity", role)
 	return connector, nil
 }
 
+func (process *TeleportProcess) firstTimeConnectIdentity(role types.SystemRole) (*state.Identity, error) {
+	if localAuth := process.getLocalAuth(); localAuth != nil {
+		return process.firstTimeConnectIdentityLocal(role, localAuth)
+	}
+	return process.firstTimeConnectIdentityRemote(role)
+}
+
+func (process *TeleportProcess) firstTimeConnectIdentityLocal(role types.SystemRole, localAuth *auth.Server) (*state.Identity, error) {
+	// Auth service is on the same host, no need to go though the join process.
+	process.logger.DebugContext(process.GracefulExitContext(), "This server has local Auth server started, using it to add role to the cluster.")
+	var systemRoles []types.SystemRole
+	if role == types.RoleInstance {
+		// normally this is taken from the join token, but if we're dealing
+		// with a local auth server, we need to determine the roles for the
+		// instance cert ourselves.
+		systemRoles = process.getInstanceRoles()
+	}
+	id := state.IdentityID{
+		Role:     role,
+		HostUUID: localAuth.ServerID,
+		NodeName: process.Config.Hostname,
+	}
+	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(role, localAuth.ServerID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return auth.LocalRegister(id, localAuth, additionalPrincipals, dnsNames, process.Config.AdvertiseIP, systemRoles)
+}
+
+func (process *TeleportProcess) firstTimeConnectIdentityRemote(role types.SystemRole) (*state.Identity, error) {
+	if role == types.RoleInstance {
+		// Always need to go through the join process to get the first Instance
+		// identity.
+		return process.instanceJoin()
+	}
+	// Wait for the instance connector to see if it can be used to reregister
+	// without going through the join process.
+	instanceConn, err := waitForInstanceConnector(process, process.Config.Logger)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if instanceConn == nil {
+		return nil, trace.BadParameter("process exiting and Instance connector never became available")
+	}
+	instanceIdentity := instanceConn.clientState.Load().identity
+	if !instanceIdentity.HasSystemRole(role) {
+		// The instance connector does not have the role requested. Go through
+		// the join process to get an identity for this role. This identity
+		// will later be used to make a SystemRoleAssertion so that the
+		// Instance identity can self-heal by reregistering with this role.
+		//
+		// This identity MUST have the same UUID as the existing instance
+		// identity, so this join MUST use the legacy join process that allows
+		// the client to choose its own UUID. This is okay because we only
+		// reach this point if the Instance identity couldn't get a certificate
+		// with this requested role, which should only happen if the new join
+		// service with auth-assigned host UUIDs is not available.
+		//
+		// TODO(nklaassen): DELETE IN 20
+		process.Config.Logger.InfoContext(process.GracefulExitContext(), "Instance identity does not include required system role, must re-join with a provision token", "role", role)
+		return process.legacyJoinWithHostUUID(role, instanceIdentity.ID.HostID())
+	}
+	// The instance connector does have the role requested, we can reregister
+	// without going through the join process.
+	process.Config.Logger.InfoContext(process.GracefulExitContext(), "Instance identity already includes required system role, requesting role-specific certificates", "role", role)
+	id := state.IdentityID{
+		Role:     role,
+		HostUUID: instanceIdentity.ID.HostUUID,
+		NodeName: process.Config.Hostname,
+	}
+	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(role, id.HostID())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	identity, err := auth.ReRegister(process.GracefulExitContext(), auth.ReRegisterParams{
+		Client:               instanceConn.Client,
+		ID:                   id,
+		AdditionalPrincipals: additionalPrincipals,
+		DNSNames:             dnsNames,
+	})
+	return identity, trace.Wrap(err)
+}
+
+func (process *TeleportProcess) instanceJoin() (*state.Identity, error) {
+	id := state.IdentityID{
+		Role:     types.RoleInstance,
+		NodeName: process.Config.Hostname,
+	}
+	additionalPrincipals, dnsNames := process.instanceAdditionalPrincipals()
+	joinParams, err := process.makeJoinParams(id, additionalPrincipals, dnsNames)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	process.logger.InfoContext(process.ExitContext(), "Joining the cluster with a secure token.")
+	joinResult, err := joinclient.Join(process.GracefulExitContext(), *joinParams)
+	if err != nil {
+		if utils.IsUntrustedCertErr(err) {
+			return nil, trace.WrapWithMessage(err, utils.SelfSignedCertsMsg)
+		}
+		return nil, trace.Wrap(err)
+	}
+	privateKeyPEM, err := keys.MarshalPrivateKey(joinResult.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	identity, err := state.ReadIdentityFromKeyPair(privateKeyPEM, joinResult.Certs)
+	return identity, trace.Wrap(err)
+}
+
+func (process *TeleportProcess) legacyJoinWithHostUUID(role types.SystemRole, hostUUID string) (*state.Identity, error) {
+	id := state.IdentityID{
+		Role:     role,
+		NodeName: process.Config.Hostname,
+		HostUUID: hostUUID,
+	}
+	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(role, hostUUID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	joinParams, err := process.makeJoinParams(id, additionalPrincipals, dnsNames)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	process.logger.InfoContext(process.ExitContext(), "Joining the cluster with a secure token.")
+	joinResult, err := joinclient.LegacyJoin(process.GracefulExitContext(), *joinParams)
+	if err != nil {
+		if utils.IsUntrustedCertErr(err) {
+			return nil, trace.WrapWithMessage(err, utils.SelfSignedCertsMsg)
+		}
+		return nil, trace.Wrap(err)
+	}
+	privateKeyPEM, err := keys.MarshalPrivateKey(joinResult.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	identity, err := state.ReadIdentityFromKeyPair(privateKeyPEM, joinResult.Certs)
+	return identity, trace.Wrap(err)
+}
+
+func (process *TeleportProcess) makeJoinParams(
+	id state.IdentityID,
+	additionalPrincipals []string,
+	dnsNames []string,
+) (*joinclient.JoinParams, error) {
+	if !process.Config.HasToken() {
+		return nil, trace.BadParameter("must join a cluster but no token was configured")
+	}
+	token, err := process.Config.Token()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	dataDir := cmp.Or(process.Config.DataDir, defaults.DataDir)
+	joinParams := &joinclient.JoinParams{
+		Token:                token,
+		ID:                   id,
+		AuthServers:          process.Config.AuthServerAddresses(),
+		ProxyServer:          process.Config.ProxyServer,
+		AdditionalPrincipals: additionalPrincipals,
+		DNSNames:             dnsNames,
+		CipherSuites:         process.Config.CipherSuites,
+		CAPins:               process.Config.CAPins,
+		CAPath:               filepath.Join(dataDir, defaults.CACertFile),
+		GetHostCredentials:   client.HostCredentials,
+		Clock:                process.Clock,
+		JoinMethod:           process.Config.JoinMethod,
+		// this circuit breaker is used for a client that only does a few
+		// requests before closing
+		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
+		FIPS:                 process.Config.FIPS,
+		Insecure:             lib.IsInsecureDevMode(),
+	}
+	if joinParams.JoinMethod == types.JoinMethodAzure {
+		joinParams.AzureParams = joinclient.AzureParams{
+			ClientID: process.Config.JoinParams.Azure.ClientID,
+		}
+	}
+	return joinParams, nil
+}
+
 func (process *TeleportProcess) initOpenSSH() {
 	process.RegisterWithAuthServer(types.RoleNode, SSHIdentityEvent)
 	process.SSHD = openssh.NewSSHD(
@@ -578,7 +809,7 @@ func (process *TeleportProcess) syncOpenSSHRotationState() error {
 		}
 	}
 
-	if err := registerServer(process.Config, ctx, conn.Client, mostRecentRotation); err != nil {
+	if err := registerServer(process.Config, ctx, conn, mostRecentRotation); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -599,9 +830,9 @@ func (process *TeleportProcess) syncOpenSSHRotationState() error {
 	return nil
 }
 
-func registerServer(a *servicecfg.Config, ctx context.Context, client authclient.ClientI, lastRotation time.Time) error {
+func registerServer(a *servicecfg.Config, ctx context.Context, conn *Connector, lastRotation time.Time) error {
 	server, err := types.NewServerWithLabels(
-		a.HostUUID,
+		conn.HostUUID(),
 		types.KindNode,
 		types.ServerSpecV2{
 			Addr:     a.OpenSSH.InstanceAddr,
@@ -617,7 +848,7 @@ func registerServer(a *servicecfg.Config, ctx context.Context, client authclient
 	}
 	server.SetSubKind(types.SubKindOpenSSHNode)
 
-	if _, err := client.UpsertNode(ctx, server); err != nil {
+	if _, err := conn.Client.UpsertNode(ctx, server); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -848,11 +1079,18 @@ func (process *TeleportProcess) rotate(conn *Connector, localState state.StateV2
 	id := clientIdentity.ID
 	local := localState.Spec.Rotation
 
-	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(id.Role)
+	additionalPrincipals, dnsNames, err := process.getAdditionalPrincipals(id.Role, id.HostID())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	// Ensure the <hostname>.<clustername> principal is included and repair the
+	// host certificates if it is not. This is not included in the output of
+	// process.getAdditionalPrincipals which is usually called while joining
+	// before the cluster name is known.
+	additionalPrincipals = append(additionalPrincipals,
+		process.Config.Hostname+"."+conn.ClusterName())
+
 	var assertionID string
 	var systemRoles []types.SystemRole
 	var wantsSystemRoleRepair bool
@@ -861,6 +1099,12 @@ func (process *TeleportProcess) rotate(conn *Connector, localState state.StateV2
 		for _, baseRole := range clientIdentity.SystemRoles {
 			baseSystemRoles = append(baseSystemRoles, types.SystemRole(baseRole))
 		}
+		// Dangling system roles here should only be possible if
+		// healInstanceIdentity failed to get the necessary roles by rejoining
+		// via the new join service, this should only be necessary until the
+		// new join service supports all join methods.
+		//
+		// TODO(nklaassen): DELETE IN 20
 		var danglingSystemRoles []types.SystemRole
 		for _, activeRole := range process.getInstanceRoles() {
 			if slices.Contains(baseSystemRoles, activeRole) {
@@ -1062,7 +1306,7 @@ func (process *TeleportProcess) getConnector(clientIdentity, serverIdentity *sta
 	if clientIdentity.ID.Role != types.RoleInstance {
 		// non-instance roles should wait to see if the instance client can be reused
 		// before acquiring their own client.
-		if instanceConn := process.waitForInstanceConnector(); instanceConn != nil && instanceConn.Client != nil {
+		if instanceConn := process.waitForInstanceConnector(process.ExitContext()); instanceConn != nil && instanceConn.Client != nil {
 			instanceClientIdentity := instanceConn.clientState.Load().identity
 			if instanceClientIdentity.HasSystemRole(clientIdentity.ID.Role) {
 				process.logger.InfoContext(process.ExitContext(), "Reusing Instance client.", "identity", clientIdentity.ID.Role, "additional_system_roles", instanceClientIdentity.SystemRoles)
@@ -1262,7 +1506,7 @@ func (process *TeleportProcess) newClientDirect(authServers []utils.NetAddr, tls
 
 	var dialOpts []grpc.DialOption
 	if role == types.RoleProxy {
-		grpcMetrics := metrics.CreateGRPCClientMetrics(process.Config.Metrics.GRPCClientLatency, prometheus.Labels{teleport.TagClient: "teleport-proxy"})
+		grpcMetrics := grpcmetrics.CreateGRPCClientMetrics(process.Config.Metrics.GRPCClientLatency, prometheus.Labels{teleport.TagClient: "teleport-proxy"})
 		if err := metrics.RegisterPrometheusCollectors(grpcMetrics); err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
diff --git a/lib/service/db.go b/lib/service/db.go
index a345749029d74..ee4de382eaeef 100644
--- a/lib/service/db.go
+++ b/lib/service/db.go
@@ -29,6 +29,7 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/srv/db"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 func (process *TeleportProcess) shouldInitDatabases() bool {
@@ -134,7 +135,7 @@ func (process *TeleportProcess) initDatabaseService() (retErr error) {
 		AccessPoint:    accessPoint,
 		LockWatcher:    lockWatcher,
 		Clock:          process.Config.Clock,
-		ServerID:       process.Config.HostUUID,
+		ServerID:       conn.HostUUID(),
 		Emitter:        asyncEmitter,
 		EmitterContext: process.ExitContext(),
 		Logger:         process.logger,
@@ -155,7 +156,7 @@ func (process *TeleportProcess) initDatabaseService() (retErr error) {
 		Limiter:              connLimiter,
 		GetRotation:          process.GetRotation,
 		Hostname:             process.Config.Hostname,
-		HostID:               process.Config.HostUUID,
+		HostID:               conn.HostUUID(),
 		Databases:            databases,
 		CloudLabels:          process.cloudLabels,
 		ResourceMatchers:     process.Config.Databases.ResourceMatchers,
@@ -227,7 +228,9 @@ func (process *TeleportProcess) initDatabaseService() (retErr error) {
 	})
 
 	process.BroadcastEvent(Event{Name: DatabasesReady, Payload: nil})
-	logger.InfoContext(process.ExitContext(), "Database service has successfully started.", "database", databases)
+	logger.InfoContext(process.ExitContext(), "Database service has successfully started",
+		"databases", logutils.StringerSliceAttr(databases),
+	)
 
 	// Block and wait while the server and agent pool are running.
 	if err := dbService.Wait(); err != nil {
diff --git a/lib/service/desktop.go b/lib/service/desktop.go
index 0063dd64bd272..0aeba28e6629d 100644
--- a/lib/service/desktop.go
+++ b/lib/service/desktop.go
@@ -24,6 +24,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"os"
 	"strconv"
 
 	"github.com/gravitational/trace"
@@ -41,7 +42,6 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/desktop"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/winpki"
 )
 
 func (process *TeleportProcess) initWindowsDesktopService() {
@@ -223,20 +223,27 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(logger *slog
 		Labels:       cfg.WindowsDesktop.Labels,
 		HostLabelsFn: cfg.WindowsDesktop.HostLabels.LabelsForHost,
 		Heartbeat: desktop.HeartbeatConfig{
-			HostUUID:    cfg.HostUUID,
+			HostUUID:    conn.HostUUID(),
 			PublicAddr:  publicAddr,
 			StaticHosts: cfg.WindowsDesktop.StaticHosts,
 			OnHeartbeat: process.OnHeartbeat(teleport.ComponentWindowsDesktop),
 		},
 		ShowDesktopWallpaper: cfg.WindowsDesktop.ShowDesktopWallpaper,
-		LDAPConfig:           winpki.LDAPConfig(cfg.WindowsDesktop.LDAP),
+		LDAPConfig:           cfg.WindowsDesktop.LDAP,
 		KDCAddr:              cfg.WindowsDesktop.KDCAddr,
 		PKIDomain:            cfg.WindowsDesktop.PKIDomain,
 		Discovery:            cfg.WindowsDesktop.Discovery,
 		DiscoveryInterval:    cfg.WindowsDesktop.DiscoveryInterval,
+		PublishCRLInterval:   cfg.WindowsDesktop.PublishCRLInterval,
 		Hostname:             cfg.Hostname,
 		ConnectedProxyGetter: proxyGetter,
 		ResourceMatchers:     cfg.WindowsDesktop.ResourceMatchers,
+
+		// For now, NLA is opt-in via an environment variable.
+		// We'll make it the default behavior in a future release.
+		// NLA code is also not FIPS-compliant so we will disable it
+		// in FIPS mode
+		NLA: !process.Config.FIPS && os.Getenv("TELEPORT_ENABLE_RDP_NLA") == "yes",
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/service/diagnostic.go b/lib/service/diagnostic.go
index 3d912d9915e29..01dfd60b62411 100644
--- a/lib/service/diagnostic.go
+++ b/lib/service/diagnostic.go
@@ -21,8 +21,6 @@ import (
 	"net/http"
 
 	"github.com/gravitational/roundtrip"
-	"github.com/gravitational/trace"
-	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 
 	"github.com/gravitational/teleport"
@@ -37,10 +35,6 @@ type diagnosticHandlerConfig struct {
 }
 
 func (process *TeleportProcess) newDiagnosticHandler(config diagnosticHandlerConfig, logger *slog.Logger) (http.Handler, error) {
-	if process.state == nil {
-		return nil, trace.BadParameter("teleport process state machine has not yet been initialized (this is a bug)")
-	}
-
 	mux := http.NewServeMux()
 
 	if config.enableMetrics {
@@ -55,7 +49,7 @@ func (process *TeleportProcess) newDiagnosticHandler(config diagnosticHandlerCon
 		mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 			roundtrip.ReplyJSON(w, http.StatusOK, map[string]any{"status": "ok"})
 		})
-		mux.HandleFunc("/readyz", process.state.readinessHandler())
+		mux.HandleFunc("/readyz", process.HandleReadiness)
 	}
 
 	if config.enableLogLeveler {
@@ -68,15 +62,8 @@ func (process *TeleportProcess) newDiagnosticHandler(config diagnosticHandlerCon
 // newMetricsHandler creates a new metrics handler serving metrics both from the global prometheus registry and the
 // in-process one.
 func (process *TeleportProcess) newMetricsHandler() http.Handler {
-	// We gather metrics both from the in-process registry (preferred metrics registration method)
-	// and the global registry (used by some Teleport services and many dependencies).
-	gatherers := prometheus.Gatherers{
-		process.metricsRegistry,
-		prometheus.DefaultGatherer,
-	}
-
 	metricsHandler := promhttp.InstrumentMetricHandler(
-		process.metricsRegistry, promhttp.HandlerFor(gatherers, promhttp.HandlerOpts{
+		process.metricsRegistry, promhttp.HandlerFor(process, promhttp.HandlerOpts{
 			// Errors can happen if metrics are registered with identical names in both the local and the global registry.
 			// In this case, we log the error but continue collecting metrics. The first collected metric will win
 			// (the one from the local metrics registry takes precedence).
diff --git a/lib/service/discovery.go b/lib/service/discovery.go
index 1cdf5c14a17bf..e82795d84c51b 100644
--- a/lib/service/discovery.go
+++ b/lib/service/discovery.go
@@ -86,7 +86,7 @@ func (process *TeleportProcess) initDiscoveryService() error {
 		DiscoveryGroup:    process.Config.Discovery.DiscoveryGroup,
 		Emitter:           asyncEmitter,
 		AccessPoint:       accessPoint,
-		ServerID:          process.Config.HostUUID,
+		ServerID:          conn.HostUUID(),
 		Log:               process.logger,
 		ClusterName:       conn.ClusterName(),
 		ClusterFeatures:   process.GetClusterFeatures,
diff --git a/lib/service/discovery_test.go b/lib/service/discovery_test.go
index b6fec7e64fa81..226b308765634 100644
--- a/lib/service/discovery_test.go
+++ b/lib/service/discovery_test.go
@@ -29,6 +29,7 @@ import (
 	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/srv/discovery"
 )
@@ -68,7 +69,7 @@ func TestTeleportProcessIntegrationsOnly(t *testing.T) {
 				},
 			}
 
-			modules.SetTestModules(t, &modules.TestModules{TestFeatures: modules.Features{
+			modulestest.SetTestModules(t, modulestest.Modules{TestFeatures: modules.Features{
 				Cloud: tt.inputFeatureCloud,
 			}})
 
diff --git a/lib/service/kubernetes.go b/lib/service/kubernetes.go
index f25b46e42da4c..476a71273037d 100644
--- a/lib/service/kubernetes.go
+++ b/lib/service/kubernetes.go
@@ -31,10 +31,12 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	kubeproxy "github.com/gravitational/teleport/lib/kube/proxy"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
+	"github.com/gravitational/teleport/lib/relaytunnel"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
@@ -80,6 +82,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 
 	teleportClusterName := conn.ClusterName()
 	proxyGetter := reversetunnel.NewConnectedProxyGetter()
+	relayInfoHolder := new(relaytunnel.InfoHolder)
 
 	// This service can run in 2 modes:
 	// 1. Reachable (by the proxy) - registers with auth server directly and
@@ -90,6 +93,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 	// The listener exposes incoming connections over either mode.
 	var listener net.Listener
 	var agentPool *reversetunnel.AgentPool
+	var relayTunnelClient *relaytunnel.Client
 	switch {
 	// Filter out cases where both listen_addr and tunnel are set or both are
 	// not set.
@@ -150,6 +154,34 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 			}
 		}()
 		logger.InfoContext(process.ExitContext(), "Started reverse tunnel client.")
+
+		if cfg.RelayServer != "" {
+			relayTunnelClient, err = relaytunnel.NewClient(relaytunnel.ClientConfig{
+				Log: logger,
+
+				GetCertificate: conn.ClientGetCertificate,
+				GetPool:        conn.ClientGetPool,
+				Ciphersuites:   cfg.CipherSuites,
+
+				TunnelType: types.KubeTunnel,
+				RelayAddr:  cfg.RelayServer,
+
+				HandleConnection: shtl.HandleConnection,
+				RelayInfoSetter:  relayInfoHolder.SetRelayInfo,
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if err := relayTunnelClient.Start(); err != nil {
+				return trace.Wrap(err)
+			}
+			defer func() {
+				if retErr != nil {
+					relayTunnelClient.Close()
+				}
+			}()
+			logger.InfoContext(process.ExitContext(), "Started relay tunnel client.")
+		}
 	}
 
 	var dynLabels *labels.Dynamic
@@ -203,6 +235,22 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 		return trace.Wrap(err)
 	}
 
+	// Create a health check manager.
+	healthCheckManager, err := healthcheck.NewManager(
+		process.ExitContext(),
+		healthcheck.ManagerConfig{
+			Component:               teleport.ComponentKube,
+			Events:                  accessPoint,
+			HealthCheckConfigReader: accessPoint,
+		},
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if err := healthCheckManager.Start(process.ExitContext()); err != nil {
+		return trace.Wrap(err)
+	}
+
 	var publicAddr string
 	if len(cfg.Kube.PublicAddrs) > 0 {
 		publicAddr = cfg.Kube.PublicAddrs[0].String()
@@ -210,21 +258,20 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 
 	kubeServer, err := kubeproxy.NewTLSServer(kubeproxy.TLSServerConfig{
 		ForwarderConfig: kubeproxy.ForwarderConfig{
-			Namespace:         apidefaults.Namespace,
-			Keygen:            cfg.Keygen,
-			ClusterName:       teleportClusterName,
-			Authz:             authorizer,
-			AuthClient:        conn.Client,
-			Emitter:           asyncEmitter,
-			DataDir:           cfg.DataDir,
-			CachingAuthClient: accessPoint,
-			HostID:            cfg.HostUUID,
-			Context:           process.ExitContext(),
-			KubeconfigPath:    cfg.Kube.KubeconfigPath,
-			KubeClusterName:   cfg.Kube.KubeClusterName,
-			KubeServiceType:   kubeproxy.KubeService,
-			Component:         teleport.ComponentKube,
-
+			Namespace:                     apidefaults.Namespace,
+			Keygen:                        cfg.Keygen,
+			ClusterName:                   teleportClusterName,
+			Authz:                         authorizer,
+			AuthClient:                    conn.Client,
+			Emitter:                       asyncEmitter,
+			DataDir:                       cfg.DataDir,
+			CachingAuthClient:             accessPoint,
+			HostID:                        conn.HostUUID(),
+			Context:                       process.ExitContext(),
+			KubeconfigPath:                cfg.Kube.KubeconfigPath,
+			KubeClusterName:               cfg.Kube.KubeClusterName,
+			KubeServiceType:               kubeproxy.KubeService,
+			Component:                     teleport.ComponentKube,
 			LockWatcher:                   lockWatcher,
 			CheckImpersonationPermissions: cfg.Kube.CheckImpersonationPermissions,
 			PublicAddr:                    publicAddr,
@@ -236,6 +283,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 		OnHeartbeat:          process.OnHeartbeat(teleport.ComponentKube),
 		GetRotation:          process.GetRotation,
 		ConnectedProxyGetter: proxyGetter,
+		RelayInfoGetter:      relayInfoHolder.GetRelayInfo,
 		ResourceMatchers:     cfg.Kube.ResourceMatchers,
 		StaticLabels:         cfg.Kube.StaticLabels,
 		DynamicLabels:        dynLabels,
@@ -243,6 +291,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 		Log:                  process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentKube, process.id)),
 		PROXYProtocolMode:    multiplexer.PROXYProtocolOff, // Kube service doesn't need to process unsigned PROXY headers.
 		InventoryHandle:      process.inventoryHandle,
+		HealthCheckManager:   healthCheckManager,
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -282,9 +331,15 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 			warnOnErr(process.ExitContext(), kubeServer.Close(), logger)
 			agentPool.Stop()
 		}
+		if relayTunnelClient != nil {
+			relayTunnelClient.Close()
+		}
 		if asyncEmitter != nil {
 			warnOnErr(process.ExitContext(), asyncEmitter.Close(), logger)
 		}
+		if healthCheckManager != nil {
+			warnOnErr(process.ExitContext(), healthCheckManager.Close(), logger)
+		}
 		warnOnErr(process.ExitContext(), listener.Close(), logger)
 		warnOnErr(process.ExitContext(), conn.Close(), logger)
 
diff --git a/lib/service/listeners.go b/lib/service/listeners.go
index 1a2e709465484..4218d6b9d53ee 100644
--- a/lib/service/listeners.go
+++ b/lib/service/listeners.go
@@ -48,6 +48,9 @@ var (
 	ListenerProxyPeer         = ListenerType(teleport.Component(teleport.ComponentProxy, "peer"))
 	ListenerMetrics           = ListenerType(teleport.ComponentMetrics)
 	ListenerWindowsDesktop    = ListenerType(teleport.ComponentWindowsDesktop)
+	ListenerRelayTransport    = ListenerType(teleport.Component(teleport.ComponentRelay, "transport"))
+	ListenerRelayPeer         = ListenerType(teleport.Component(teleport.ComponentRelay, "peer"))
+	ListenerRelayTunnel       = ListenerType(teleport.Component(teleport.ComponentRelay, "tunnel"))
 )
 
 // Network returns the network used by the listener.
diff --git a/lib/service/pyroscope.go b/lib/service/pyroscope.go
index e3393b4b428e6..c5ec7b8a90ef8 100644
--- a/lib/service/pyroscope.go
+++ b/lib/service/pyroscope.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
 	"time"
 
@@ -27,6 +28,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // TODO: Replace logger when pyroscope uses slog
@@ -34,7 +36,25 @@ type pyroscopeLogger struct {
 	l *slog.Logger
 }
 
-func (l pyroscopeLogger) Infof(format string, args ...interface{}) {
+type roundTripper struct {
+	tripper http.RoundTripper
+	timeout time.Duration
+	logger  *slog.Logger
+}
+
+// CloseIdleConnections ensures idle connections of the wrapped
+// [http.RoundTripper] are closed.
+func (rt roundTripper) CloseIdleConnections() {
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+
+	if tr, ok := rt.tripper.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}
+
+func (l pyroscopeLogger) Infof(format string, args ...any) {
 	if !l.l.Handler().Enabled(context.Background(), slog.LevelInfo) {
 		return
 	}
@@ -42,7 +62,7 @@ func (l pyroscopeLogger) Infof(format string, args ...interface{}) {
 	l.l.Info(fmt.Sprintf(format, args...))
 }
 
-func (l pyroscopeLogger) Debugf(format string, args ...interface{}) {
+func (l pyroscopeLogger) Debugf(format string, args ...any) {
 	if !l.l.Handler().Enabled(context.Background(), slog.LevelDebug) {
 		return
 	}
@@ -51,7 +71,7 @@ func (l pyroscopeLogger) Debugf(format string, args ...interface{}) {
 	l.l.Debug(fmt.Sprintf(format, args...))
 }
 
-func (l pyroscopeLogger) Errorf(format string, args ...interface{}) {
+func (l pyroscopeLogger) Errorf(format string, args ...any) {
 	if !l.l.Handler().Enabled(context.Background(), slog.LevelError) {
 		return
 	}
@@ -60,6 +80,19 @@ func (l pyroscopeLogger) Errorf(format string, args ...interface{}) {
 	l.l.Error(fmt.Sprintf(format, args...))
 }
 
+func (rt roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	start := time.Now()
+	resp, err := rt.tripper.RoundTrip(req)
+	duration := time.Since(start)
+
+	threshold := rt.timeout * 90 / 100
+	if duration > threshold {
+		rt.logger.DebugContext(req.Context(), "Pyroscope upload exceeded threshold", "upload_duration", duration, "upload_threshold", threshold, "upload_url", logutils.StringerAttr(req.URL))
+	}
+
+	return resp, err
+}
+
 // createPyroscopeConfig generates the Pyroscope configuration for the Teleport process.
 func createPyroscopeConfig(ctx context.Context, logger *slog.Logger, address string) (pyroscope.Config, error) {
 	if address == "" {
@@ -71,6 +104,17 @@ func createPyroscopeConfig(ctx context.Context, logger *slog.Logger, address str
 		hostname = "unknown"
 	}
 
+	const httpTimeout = 60 * time.Second
+
+	httpClient := &http.Client{
+		Timeout: httpTimeout,
+		Transport: roundTripper{
+			tripper: http.DefaultTransport,
+			timeout: httpTimeout,
+			logger:  logger,
+		},
+	}
+
 	config := pyroscope.Config{
 		ApplicationName: teleport.ComponentTeleport,
 		ServerAddress:   address,
@@ -80,6 +124,8 @@ func createPyroscopeConfig(ctx context.Context, logger *slog.Logger, address str
 			"version": teleport.Version,
 			"git_ref": teleport.Gitref,
 		},
+		HTTPClient: httpClient,
+		UploadRate: 60 * time.Second,
 	}
 
 	// Evaluate if profile configuration is customized
@@ -90,21 +136,14 @@ func createPyroscopeConfig(ctx context.Context, logger *slog.Logger, address str
 		logger.InfoContext(ctx, "Pyroscope will configure profiles from env")
 	}
 
-	var uploadRate *time.Duration
 	if rate := os.Getenv("TELEPORT_PYROSCOPE_UPLOAD_RATE"); rate != "" {
 		parsedRate, err := time.ParseDuration(rate)
 		if err != nil {
 			logger.InfoContext(ctx, "invalid TELEPORT_PYROSCOPE_UPLOAD_RATE, ignoring value", "provided_value", rate, "error", err)
 		} else {
-			uploadRate = &parsedRate
+			logger.InfoContext(ctx, "TELEPORT_PYROSCOPE_UPLOAD_RATE configured", "rate", parsedRate)
+			config.UploadRate = parsedRate
 		}
-	} else {
-		logger.InfoContext(ctx, "TELEPORT_PYROSCOPE_UPLOAD_RATE not specified, using default")
-	}
-
-	// Set UploadRate or fall back to defaults
-	if uploadRate != nil {
-		config.UploadRate = *uploadRate
 	}
 
 	if value, isSet := os.LookupEnv("TELEPORT_PYROSCOPE_KUBE_COMPONENT"); isSet {
@@ -131,13 +170,13 @@ func (process *TeleportProcess) initPyroscope(address string) {
 	if err != nil {
 		logger.ErrorContext(process.ExitContext(), "error starting pyroscope profiler", "address", address, "error", err)
 	} else {
+		logger.InfoContext(process.ExitContext(), "Pyroscope has successfully started")
 		process.OnExit("pyroscope.profiler", func(payload any) {
 			// Observed rare and inconsistent panics, short term solution is to not wait for flush
 			profiler.Flush(false)
 			_ = profiler.Stop()
 		})
 	}
-	logger.InfoContext(process.ExitContext(), "Pyroscope has successfully started")
 }
 
 // getPyroscopeProfileTypesFromEnv sets the profile types based on environment variables.
diff --git a/lib/service/relay.go b/lib/service/relay.go
new file mode 100644
index 0000000000000..9821f1f136ec7
--- /dev/null
+++ b/lib/service/relay.go
@@ -0,0 +1,485 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package service
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"log/slog"
+	"net"
+	"net/netip"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/gravitational/teleport"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
+	relaytunnelv1alpha "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha"
+	"github.com/gravitational/teleport/lib/agentless"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/authz"
+	kuberelay "github.com/gravitational/teleport/lib/kube/relay"
+	multiplexergrpc "github.com/gravitational/teleport/lib/multiplexer/grpc"
+	"github.com/gravitational/teleport/lib/proxy"
+	"github.com/gravitational/teleport/lib/relaypeer"
+	"github.com/gravitational/teleport/lib/relaytransport"
+	"github.com/gravitational/teleport/lib/relaytunnel"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv"
+	"github.com/gravitational/teleport/lib/srv/transport/transportv1"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func (process *TeleportProcess) initRelay() {
+	process.RegisterWithAuthServer(apitypes.RoleRelay, RelayIdentityEvent)
+	process.RegisterCriticalFunc("relay.run", process.runRelayService)
+}
+
+func (process *TeleportProcess) runRelayService() error {
+	log := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentRelay, process.id))
+	sublogger := func(subcomponent string) *slog.Logger {
+		return process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentRelay, process.id, subcomponent))
+	}
+
+	defer func() {
+		if err := process.closeImportedDescriptors(teleport.ComponentRelay); err != nil {
+			log.WarnContext(process.ExitContext(), "Failed closing imported file descriptors.", "error", err)
+		}
+	}()
+
+	conn, err := process.WaitForConnector(RelayIdentityEvent, log)
+	if conn == nil {
+		return trace.Wrap(err)
+	}
+	defer conn.Close()
+
+	accessPoint, err := process.newLocalCacheForRelay(conn.Client, []string{teleport.ComponentRelay})
+	if err != nil {
+		return err
+	}
+
+	asyncEmitter, err := process.NewAsyncEmitter(conn.Client)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer asyncEmitter.Close()
+
+	lockWatcher, err := services.NewLockWatcher(process.ExitContext(), services.LockWatcherConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			Component: teleport.ComponentRelay,
+			Logger:    sublogger("lock_watcher"),
+			Client:    conn.Client,
+		},
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer lockWatcher.Close()
+
+	authorizerOpts := authz.AuthorizerOpts{
+		ClusterName:      conn.clusterName,
+		AccessPoint:      accessPoint,
+		ScopedRoleReader: accessPoint.ScopedRoleReader(),
+		LockWatcher:      lockWatcher,
+		Logger:           sublogger("authorizer"),
+		PermitCaching:    process.Config.CachePolicy.Enabled,
+	}
+
+	authorizer, err := authz.NewAuthorizer(authorizerOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	scopedAuthorizer, err := authz.NewScopedAuthorizer(authorizerOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	connMonitor, err := srv.NewConnectionMonitor(srv.ConnectionMonitorConfig{
+		AccessPoint:    accessPoint,
+		LockWatcher:    lockWatcher,
+		Clock:          process.Clock,
+		ServerID:       conn.hostID,
+		Emitter:        asyncEmitter,
+		EmitterContext: process.ExitContext(),
+		Logger:         sublogger("conn_monitor"),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	nodeWatcher, err := services.NewNodeWatcher(process.ExitContext(), services.NodeWatcherConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			Component:    teleport.ComponentRelay,
+			Logger:       sublogger("node_watcher"),
+			Client:       accessPoint,
+			MaxStaleness: time.Minute,
+		},
+		NodesGetter: accessPoint,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer nodeWatcher.Close()
+
+	kubeServerWatcher, err := services.NewKubeServerWatcher(process.ExitContext(), services.KubeServerWatcherConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			Component:    teleport.ComponentRelay,
+			Logger:       sublogger("kube_server_watcher"),
+			Client:       accessPoint,
+			MaxStaleness: time.Minute,
+		},
+		KubernetesServerGetter: accessPoint,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer kubeServerWatcher.Close()
+
+	tunnelServer, err := relaytunnel.NewServer(relaytunnel.ServerConfig{
+		Log: sublogger("tunnel_server"),
+		GetCertificate: func(ctx context.Context) (*tls.Certificate, error) {
+			return conn.serverGetCertificate()
+		},
+		GetPool: func(ctx context.Context) (*x509.CertPool, error) {
+			pool, _, err := authclient.ClientCertPool(ctx, accessPoint, conn.clusterName, apitypes.HostCA)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return pool, nil
+		},
+		Ciphersuites: process.Config.CipherSuites,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer tunnelServer.Close()
+
+	tunnelCreds := tunnelServer.GRPCServerCredentials()
+	if process.Config.Relay.TunnelPROXYProtocol {
+		tunnelCreds = multiplexergrpc.PPV2ServerCredentials{TransportCredentials: tunnelCreds}
+	}
+	tunnelGRPCServer := grpc.NewServer(
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
+		grpc.ChainUnaryInterceptor(
+			interceptors.GRPCServerUnaryErrorInterceptor,
+		),
+		grpc.ChainStreamInterceptor(
+			interceptors.GRPCServerStreamErrorInterceptor,
+		),
+		grpc.Creds(tunnelCreds),
+	)
+	defer tunnelGRPCServer.Stop()
+
+	relaytunnelv1alpha.RegisterDiscoveryServiceServer(tunnelGRPCServer, &relaytunnel.StaticDiscoverServiceServer{
+		RelayGroup:            process.Config.Relay.RelayGroup,
+		TargetConnectionCount: process.Config.Relay.TargetConnectionCount,
+		SupportedTunnelTypes: []string{
+			string(apitypes.NodeTunnel),
+			string(apitypes.KubeTunnel),
+		},
+	})
+
+	peerServer, err := relaypeer.NewServer(relaypeer.ServerConfig{
+		Log: sublogger("peer_server"),
+
+		GetCertificate: func(ctx context.Context) (*tls.Certificate, error) {
+			return conn.serverGetCertificate()
+		},
+		GetPool: func(ctx context.Context) (*x509.CertPool, error) {
+			pool, _, err := authclient.ClientCertPool(ctx, accessPoint, conn.clusterName, apitypes.HostCA)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return pool, nil
+		},
+		Ciphersuites: process.Config.CipherSuites,
+
+		LocalDial: tunnelServer.Dial,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer peerServer.Close()
+
+	transportTLSConfig, err := conn.ServerTLSConfig(process.Config.CipherSuites)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	transportTLSConfig.NextProtos = []string{"h2"}
+	transportTLSConfig.ClientAuth = tls.RequireAndVerifyClientCert
+	transportTLSConfig.GetConfigForClient = func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
+		pool, _, err := authclient.ClientCertPool(chi.Context(), accessPoint, conn.clusterName, apitypes.UserCA)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		utils.RefreshTLSConfigTickets(transportTLSConfig)
+		c := transportTLSConfig.Clone()
+		c.ClientCAs = pool
+		return c, nil
+	}
+
+	relayPeerClient, err := relaypeer.NewClient(relaypeer.ClientConfig{
+		HostID:      conn.hostID,
+		ClusterName: conn.clusterName,
+		GroupName:   process.Config.Relay.RelayGroup,
+
+		AccessPoint: accessPoint,
+		Log:         sublogger("peer_client"),
+
+		GetCertificate: conn.ClientGetCertificate,
+		GetPool:        conn.ClientGetPool,
+		Ciphersuites:   process.Config.CipherSuites,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	kubeForwarder, err := kuberelay.NewPassiveForwarder(kuberelay.PassiveForwarderConfig{
+		Log:                      sublogger("kube_forwarder"),
+		ClusterName:              conn.clusterName,
+		GroupName:                process.Config.Relay.RelayGroup,
+		GetKubeServersWithFilter: kubeServerWatcher.CurrentResourcesWithFilter,
+		LocalDial:                tunnelServer.Dial,
+		PeerDial:                 relayPeerClient.Dial,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer kubeForwarder.Close()
+
+	var transportCreds credentials.TransportCredentials
+	{
+		tc, err := auth.NewTransportCredentials(auth.TransportCredentialsConfig{
+			TransportCredentials: credentials.NewTLS(transportTLSConfig),
+			UserGetter: &auth.Middleware{
+				ClusterName: conn.clusterName,
+			},
+			Authorizer:        authorizer,
+			ScopedAuthorizer:  scopedAuthorizer,
+			GetAuthPreference: accessPoint.GetAuthPreference,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		transportCreds = tc
+	}
+	transportCreds = &relaytransport.SNIDispatchTransportCredentials{
+		TransportCredentials: transportCreds,
+		DispatchFunc:         kubeForwarder.Dispatch,
+	}
+	if process.Config.Relay.TransportPROXYProtocol {
+		transportCreds = multiplexergrpc.PPV2ServerCredentials{TransportCredentials: transportCreds}
+	}
+
+	relayRouter, err := proxy.NewRelayRouter(proxy.RelayRouterConfig{
+		ClusterName: conn.clusterName,
+		GroupName:   process.Config.Relay.RelayGroup,
+		LocalDial:   tunnelServer.Dial,
+		PeerDial:    relayPeerClient.Dial,
+		AccessPoint: accessPoint,
+		NodeWatcher: nodeWatcher,
+	})
+	if err != nil {
+		return err
+	}
+
+	transportListener, err := process.importOrCreateListener(ListenerRelayTransport, process.Config.Relay.TransportListenAddr.String())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer transportListener.Close()
+
+	tunnelListener, err := process.importOrCreateListener(ListenerRelayTunnel, process.Config.Relay.TunnelListenAddr.String())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer tunnelListener.Close()
+	go tunnelGRPCServer.Serve(tunnelListener)
+
+	peerListener, err := process.importOrCreateListener(ListenerRelayPeer, process.Config.Relay.PeerListenAddr.String())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer peerListener.Close()
+	go peerServer.ServeTLSListener(peerListener)
+
+	transportService, err := transportv1.NewService(transportv1.ServerConfig{
+		FIPS:   process.Config.FIPS,
+		Logger: sublogger("transport_service"),
+		Dialer: relayRouter,
+		SignerFn: func(*authz.ScopedContext, string) agentless.SignerCreator {
+			return func(context.Context, agentless.LocalAccessPoint, agentless.CertGenerator) (ssh.Signer, error) {
+				// the behavior of relayRouter is such that we should never
+				// attempt to connect to an agentless server
+				return nil, trace.Errorf("connections to agentless servers are not supported (this is a bug)")
+			}
+		},
+		ConnectionMonitor: connMonitor,
+		LocalAddr:         transportListener.Addr(),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	transportGRPCServer := grpc.NewServer(
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
+		grpc.ChainUnaryInterceptor(
+			interceptors.GRPCServerUnaryErrorInterceptor,
+		),
+		grpc.ChainStreamInterceptor(
+			interceptors.GRPCServerStreamErrorInterceptor,
+		),
+		grpc.Creds(transportCreds),
+	)
+	defer transportGRPCServer.Stop()
+
+	transportv1pb.RegisterTransportServiceServer(transportGRPCServer, transportService)
+
+	go transportGRPCServer.Serve(transportListener)
+
+	peerPublicAddr := process.Config.Relay.PeerPublicAddr
+	if peerPublicAddr == "" {
+		peerListenerPort := process.Config.Relay.PeerListenAddr.Port()
+		if a, _ := peerListener.Addr().(*net.TCPAddr); a != nil {
+			// handle the case where the server was configured to bind on port 0
+			peerListenerPort = uint16(a.Port)
+		}
+
+		hostIP, err := utils.GuessHostIP()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		hostNetIP, _ := netip.AddrFromSlice(hostIP)
+		peerPublicAddr = netip.AddrPortFrom(hostNetIP.Unmap(), peerListenerPort).String()
+	}
+
+	nonce := uuid.NewString()
+	var relayServer atomic.Pointer[presencev1.RelayServer]
+	relayServer.Store(&presencev1.RelayServer{
+		Kind:    apitypes.KindRelayServer,
+		SubKind: "",
+		Version: apitypes.V1,
+		Metadata: &headerv1.Metadata{
+			Name: conn.HostUUID(),
+		},
+		Spec: &presencev1.RelayServer_Spec{
+			Hostname:   process.Config.Hostname,
+			RelayGroup: process.Config.Relay.RelayGroup,
+			PeerAddr:   peerPublicAddr,
+			Nonce:      nonce,
+		},
+	})
+
+	hb, err := srv.NewRelayServerHeartbeat(srv.HeartbeatV2Config[*presencev1.RelayServer]{
+		InventoryHandle: process.inventoryHandle,
+		GetResource: func(context.Context) (*presencev1.RelayServer, error) {
+			return relayServer.Load(), nil
+		},
+
+		// there's no fallback announce mode, the relay service only works with
+		// clusters recent enough to support relay heartbeats through the ICS
+		Announcer: nil,
+
+		OnHeartbeat: process.OnHeartbeat(teleport.ComponentRelay),
+	}, sublogger("heartbeat"))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	go hb.Run()
+	defer hb.Close()
+
+	if err := process.closeImportedDescriptors(teleport.ComponentRelay); err != nil {
+		log.WarnContext(process.ExitContext(), "Failed closing imported file descriptors", "error", err)
+	}
+
+	process.BroadcastEvent(Event{Name: RelayReady})
+	log.InfoContext(process.ExitContext(), "The relay service has successfully started", "nonce", nonce)
+
+	_, _ = process.WaitForEvent(process.ExitContext(), TeleportTerminatingEvent)
+
+	log.InfoContext(process.ExitContext(), "Process is beginning shutdown, advertising terminating status and waiting for shutdown")
+
+	{
+		r := proto.CloneOf(relayServer.Load())
+		r.GetSpec().Terminating = true
+		relayServer.Store(r)
+	}
+
+	tunnelServer.SetTerminating()
+
+	exitEvent, _ := process.WaitForEvent(process.ExitContext(), TeleportExitEvent)
+	ctx, _ := exitEvent.Payload.(context.Context)
+	if ctx == nil {
+		// if we're here it's because we got an ungraceful exit event or
+		// WaitForEvent errored out because of the ungraceful shutdown; either
+		// way, process.ExitContext() is a done context and all operations
+		// should get canceled immediately
+		ctx = process.ExitContext()
+		log.InfoContext(ctx, "Stopping the relay service ungracefully")
+	} else {
+		log.InfoContext(ctx, "Stopping the relay service")
+	}
+
+	log.DebugContext(ctx, "Stopping servers")
+	eg, egCtx := errgroup.WithContext(ctx)
+	eg.Go(func() error {
+		defer context.AfterFunc(egCtx, tunnelGRPCServer.Stop)()
+		tunnelGRPCServer.GracefulStop()
+		return nil
+	})
+	eg.Go(func() error {
+		// TODO(espadolini): let connections continue (for a time?) before
+		// abruptly terminating them right after the shutdown delay
+		_ = tunnelServer.Close()
+		return nil
+	})
+	eg.Go(func() error {
+		// TODO(espadolini): let connections continue (for a time?) before
+		// abruptly terminating them right after the shutdown delay
+		_ = peerServer.Close()
+		return nil
+	})
+	eg.Go(func() error {
+		defer context.AfterFunc(egCtx, transportGRPCServer.Stop)()
+		transportGRPCServer.GracefulStop()
+		return nil
+	})
+	warnOnErr(egCtx, eg.Wait(), log)
+
+	warnOnErr(ctx, hb.Close(), log)
+	warnOnErr(ctx, conn.Close(), log)
+
+	log.InfoContext(ctx, "The relay service has stopped")
+
+	return nil
+}
diff --git a/lib/service/service.go b/lib/service/service.go
index 8c70e8589391c..ec18773c88abb 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -44,7 +44,6 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
-	"testing"
 	"time"
 
 	"github.com/coreos/go-semver/semver"
@@ -59,7 +58,6 @@ import (
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/sys/unix"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
@@ -79,11 +77,11 @@ import (
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/api/utils/aws"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auditd"
@@ -91,9 +89,14 @@ import (
 	"github.com/gravitational/teleport/lib/auth/accesspoint"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/keygen"
+	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata"
+	"github.com/gravitational/teleport/lib/auth/recordingmetadata/recordingmetadatav1"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
+	"github.com/gravitational/teleport/lib/auth/summarizer"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
 	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
@@ -102,11 +105,11 @@ import (
 	"github.com/gravitational/teleport/lib/backend/dynamo"
 	_ "github.com/gravitational/teleport/lib/backend/etcdbk"
 	"github.com/gravitational/teleport/lib/backend/firestore"
-	"github.com/gravitational/teleport/lib/backend/kubernetes"
 	_ "github.com/gravitational/teleport/lib/backend/lite"
 	_ "github.com/gravitational/teleport/lib/backend/pgbk"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/cache"
+	myrepl "github.com/gravitational/teleport/lib/client/db/mysql/repl"
 	pgrepl "github.com/gravitational/teleport/lib/client/db/postgres/repl"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 	"github.com/gravitational/teleport/lib/cloud"
@@ -117,6 +120,7 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/imds/azure"
 	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
 	oracleimds "github.com/gravitational/teleport/lib/cloud/imds/oracle"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/athena"
@@ -127,22 +131,29 @@ import (
 	"github.com/gravitational/teleport/lib/events/gcssessions"
 	"github.com/gravitational/teleport/lib/events/pgevents"
 	"github.com/gravitational/teleport/lib/events/s3sessions"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
 	"github.com/gravitational/teleport/lib/integrations/externalauditstorage"
 	"github.com/gravitational/teleport/lib/inventory"
-	"github.com/gravitational/teleport/lib/joinserver"
+	"github.com/gravitational/teleport/lib/join/joinv1"
+	"github.com/gravitational/teleport/lib/join/legacyjoin"
 	kubegrpc "github.com/gravitational/teleport/lib/kube/grpc"
 	kubeproxy "github.com/gravitational/teleport/lib/kube/proxy"
+	kuberelay "github.com/gravitational/teleport/lib/kube/relay"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
+	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/openssh"
+	"github.com/gravitational/teleport/lib/pam"
 	"github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/proxy"
 	"github.com/gravitational/teleport/lib/proxy/peer"
 	peerquic "github.com/gravitational/teleport/lib/proxy/peer/quic"
+	"github.com/gravitational/teleport/lib/relaytunnel"
 	"github.com/gravitational/teleport/lib/resumption"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -160,6 +171,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db"
 	"github.com/gravitational/teleport/lib/srv/desktop"
 	"github.com/gravitational/teleport/lib/srv/ingress"
+	"github.com/gravitational/teleport/lib/srv/mcp"
 	"github.com/gravitational/teleport/lib/srv/regular"
 	"github.com/gravitational/teleport/lib/srv/transport/transportv1"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -168,10 +180,12 @@ import (
 	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/cert"
-	"github.com/gravitational/teleport/lib/utils/hostid"
+	"github.com/gravitational/teleport/lib/utils/certreloader"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	procutils "github.com/gravitational/teleport/lib/utils/process"
 	"github.com/gravitational/teleport/lib/versioncontrol/endpoint"
 	uw "github.com/gravitational/teleport/lib/versioncontrol/upgradewindow"
+	libwatcher "github.com/gravitational/teleport/lib/watcher"
 	"github.com/gravitational/teleport/lib/web"
 	webapp "github.com/gravitational/teleport/lib/web/app"
 )
@@ -189,6 +203,11 @@ const (
 	// identity has been registered with the Auth Server.
 	ProxyIdentityEvent = "ProxyIdentity"
 
+	// RelayIdentityEvent is generated after the Teleport agent has successfully
+	// joined a cluster or reused credentials to connect to the control plane as
+	// a relay service.
+	RelayIdentityEvent = "RelayIdentityEvent"
+
 	// SSHIdentityEvent is generated when node's identity has been registered
 	// with the Auth Server.
 	SSHIdentityEvent = "SSHIdentity"
@@ -238,6 +257,10 @@ const (
 	// and is ready to start accepting connections.
 	ProxySSHReady = "ProxySSHReady"
 
+	// RelayReady is generated when a relay service is ready to accept
+	// connections.
+	RelayReady = "RelayReady"
+
 	// NodeSSHReady is generated when the Teleport node has initialized a SSH server
 	// and is ready to start accepting SSH connections.
 	NodeSSHReady = "NodeReady"
@@ -277,6 +300,18 @@ const (
 	// all listening sockets and exiting.
 	TeleportExitEvent = "TeleportExit"
 
+	// TeleportTerminatingEvent is generated when the Teleport process receives
+	// a signal to shut down. It's always generated as part of the process
+	// lifecycle and it's always generated before TeleportExitEvent, but there
+	// might be some configured delay between this event and the
+	// TeleportExitEvent signaling the actual beginning of the shut down
+	// procedures. It should be used to advertise the fact that the Teleport
+	// instance is going to shut down at some near time in the future, not to
+	// reduce the functionality of services - i.e., it's perfectly fine for
+	// services to ignore this event altogether, and nothing should get closed
+	// as a result of this event.
+	TeleportTerminatingEvent = "TeleportTerminating"
+
 	// TeleportPhaseChangeEvent is generated to indicate that the CA rotation
 	// phase has been updated, used in tests.
 	TeleportPhaseChangeEvent = "TeleportPhaseChange"
@@ -288,6 +323,13 @@ const (
 
 	// TeleportReadyEvent is generated to signal that all teleport
 	// internal components have started successfully.
+	// This event is used as a sync point to wait for all services to be started
+	// before kicking off new operations.
+	// This must not be confused as a Kube readiness check, checking the process
+	// ability to handle requests. The event can be emitted even while one or
+	// many services are not ready to process requests.
+	// If one need to measure readiness, they should rely on [process.state]
+	// and heartbeats.
 	TeleportReadyEvent = "TeleportReady"
 
 	// ServiceExitedWithErrorEvent is emitted whenever a service
@@ -300,6 +342,12 @@ const (
 
 	// TeleportOKEvent is emitted whenever a service is operating normally.
 	TeleportOKEvent = "TeleportOKEvent"
+
+	// TeleportStartingEvent is emitted when a service starts but is not ready yet.
+	// This helps with tracking that a service is expected to report ready.
+	// Without this Teleport will report ready as soon as the first service
+	// is registered and ready, even when other services are still starting up.
+	TeleportStartingEvent = "TeleportStarting"
 )
 
 func newConnector(clientIdentity, serverIdentity *state.Identity) (*Connector, error) {
@@ -318,6 +366,7 @@ func newConnector(clientIdentity, serverIdentity *state.Identity) (*Connector, e
 	c := &Connector{
 		clusterName: clientIdentity.ClusterName,
 		hostID:      clientIdentity.ID.HostUUID,
+		scope:       clientIdentity.AgentScope,
 		role:        clientIdentity.ID.Role,
 	}
 	c.clientState.Store(clientState)
@@ -385,6 +434,7 @@ type connectorState struct {
 type Connector struct {
 	clusterName string
 	hostID      string
+	scope       string
 	role        types.SystemRole
 
 	// clientState contains the current connector state for outbound connections
@@ -408,10 +458,21 @@ func (c *Connector) ClusterName() string {
 	return c.clusterName
 }
 
+// HostID returns the host ID in <uuid>.<clusterName> format.
 func (c *Connector) HostID() string {
 	return c.hostID
 }
 
+// HostUUID returns the plain host UUID.
+func (c *Connector) HostUUID() string {
+	return strings.TrimSuffix(c.hostID, "."+c.clusterName)
+}
+
+// Scope returns the host's AgentScope
+func (c *Connector) Scope() string {
+	return c.scope
+}
+
 func (c *Connector) Role() types.SystemRole {
 	return c.role
 }
@@ -663,11 +724,16 @@ type TeleportProcess struct {
 	// conflicts.
 	//
 	// Both the metricsRegistry and the default global registry are gathered by
-	// Telepeort's metric service.
+	// Teleport's metric service.
 	metricsRegistry *prometheus.Registry
 
-	// state is the process state machine tracking if the process is healthy or not.
-	state *processState
+	// We gather metrics both from the in-process registry (preferred metrics registration method)
+	// and the global registry (used by some Teleport services and many dependencies).
+	// optionally other systems can add their gatherers, this can be used if they
+	// need to add and remove metrics seevral times (e.g. hosted plugin metrics).
+	*metrics.SyncGatherers
+
+	tsrv reversetunnelclient.Server
 }
 
 // processIndex is an internal process index
@@ -679,6 +745,17 @@ func nextProcessID() int32 {
 	return atomic.AddInt32(&processID, 1)
 }
 
+// GetReverseTunnelServer returns the process's reverse tunnel server
+// or an error if it is not configured.
+// Reverse tunnel server is used by proxies to accept incoming
+// reverse tunnels from nodes/clusters.
+func (process *TeleportProcess) GetReverseTunnelServer() (reversetunnelclient.Server, error) {
+	if process.tsrv != nil {
+		return process.tsrv, nil
+	}
+	return nil, trace.BadParameter("reverse tunnel server not configured")
+}
+
 // GetAuthServer returns the process' auth server
 func (process *TeleportProcess) GetAuthServer() *auth.Server {
 	return process.localAuth
@@ -705,14 +782,25 @@ func (process *TeleportProcess) OnHeartbeat(component string) func(err error) {
 	}
 }
 
-func (process *TeleportProcess) findStaticIdentity(id state.IdentityID) (*state.Identity, error) {
+// ExpectService is used to advertise a service that should be running in the process.
+// Calling ExpectService while starting a service prevents the process from
+// turning ready while the service is not done starting.
+// After calling ExpectService for a component, one must call the OnHeartbeat callback
+// for the same component at least once to mark the service as running.
+// ExpectService should be called just before starting the service with
+// process.RegisterFunc or process.RegisterCriticalFunc.
+func (process *TeleportProcess) ExpectService(component string) {
+	process.BroadcastEvent(Event{Name: TeleportStartingEvent, Payload: component})
+}
+
+func (process *TeleportProcess) findStaticIdentity(role types.SystemRole) (*state.Identity, error) {
 	for i := range process.Config.Identities {
 		identity := process.Config.Identities[i]
-		if identity.ID.Equals(id) {
+		if identity.ID.Role == role {
 			return identity, nil
 		}
 	}
-	return nil, trace.NotFound("identity %v not found", &id)
+	return nil, trace.NotFound("identity %v not found", role)
 }
 
 // getConnectors returns a copy of the identities registered for auth server
@@ -865,13 +953,6 @@ func (process *TeleportProcess) getAuthSubjectiveAddr() string {
 	return process.authSubjectiveAddr
 }
 
-func (process *TeleportProcess) GetIdentityForTesting(t *testing.T, role types.SystemRole) (i *state.Identity, err error) {
-	if !testing.Testing() {
-		panic("GetIdentityForTesting can only be called in tests")
-	}
-	return process.getIdentity(role)
-}
-
 // getIdentity returns the current identity (credentials to the auth server) for
 // a given system role.
 func (process *TeleportProcess) getIdentity(role types.SystemRole) (i *state.Identity, err error) {
@@ -887,19 +968,19 @@ func (process *TeleportProcess) getIdentity(role types.SystemRole) (i *state.Ide
 		return nil, trace.Wrap(err)
 	}
 
-	id := state.IdentityID{
-		Role:     role,
-		HostUUID: process.Config.HostUUID,
-		NodeName: process.Config.Hostname,
-	}
 	if role == types.RoleAdmin {
 		// for admin identity use local auth server
 		// because admin identity is requested by auth server
 		// itself
-		principals, dnsNames, err := process.getAdditionalPrincipals(role)
+		principals, dnsNames, err := process.getAdditionalPrincipals(role, process.localAuth.ServerID)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		id := state.IdentityID{
+			Role:     role,
+			HostUUID: process.localAuth.ServerID,
+			NodeName: process.Config.Hostname,
+		}
 		i, err = auth.GenerateIdentity(process.localAuth, id, principals, dnsNames)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -907,12 +988,12 @@ func (process *TeleportProcess) getIdentity(role types.SystemRole) (i *state.Ide
 		return i, nil
 	}
 
-	// try to locate static identity provided in the file
-	i, err = process.findStaticIdentity(id)
+	// try to locate static identity provided in the config by tests
+	i, err = process.findStaticIdentity(role)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	process.logger.InfoContext(process.ExitContext(), "Found static identity in the config file, writing to disk.", "identity", logutils.StringerAttr(&id))
+	process.logger.InfoContext(process.ExitContext(), "Found static identity, writing to disk.", "role", role)
 	if err = process.storage.WriteIdentity(state.IdentityCurrent, *i); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -920,6 +1001,12 @@ func (process *TeleportProcess) getIdentity(role types.SystemRole) (i *state.Ide
 	return i, nil
 }
 
+// MetricsRegistry returns the process-scoped metrics registry.
+// New metrics must register against this and not the global prometheus registry.
+func (process *TeleportProcess) MetricsRegistry() prometheus.Registerer {
+	return process.metricsRegistry
+}
+
 // Process is a interface for processes
 type Process interface {
 	// Closer closes all resources used by the process
@@ -990,9 +1077,7 @@ func RunWithSignalChannel(ctx context.Context, cfg servicecfg.Config, newTelepor
 
 // NewTeleport takes the daemon configuration, instantiates all required services
 // and starts them under a supervisor, returning the supervisor object.
-func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
-	var err error
-
+func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) {
 	// Before we do anything reset the SIGINT handler back to the default.
 	system.ResetInterruptSignalHandler()
 
@@ -1007,14 +1092,16 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		"pid", fmt.Sprintf("%v.%v", os.Getpid(), processID),
 	)
 
-	// Use the custom metrics registry if specified, else create a new one.
-	// We must create the registry in NewTeleport, as opposed to ApplyConfig(),
+	defer func() {
+		if err != nil {
+			cfg.Logger.ErrorContext(context.Background(), "Failed to start Teleport instance", "error", err)
+		}
+	}()
+
+	// We must create the registry in NewTeleport, as opposed to the config,
 	// because some tests are running multiple Teleport instances from the same
-	// config.
-	metricsRegistry := cfg.MetricsRegistry
-	if metricsRegistry == nil {
-		metricsRegistry = prometheus.NewRegistry()
-	}
+	// config and reusing the same registry causes them to fail.
+	metricsRegistry := prometheus.NewRegistry()
 
 	// If FIPS mode was requested make sure binary is build against BoringCrypto.
 	if cfg.FIPS {
@@ -1048,6 +1135,24 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		cfg.Logger.InfoContext(context.Background(), "SELinux support is enabled for SSH service")
 	}
 
+	// If PAM is enabled, make sure that Teleport was built with PAM support
+	// and the PAM library was found at runtime.
+	if cfg.SSH.PAM != nil && cfg.SSH.PAM.Enabled {
+		if !pam.BuildHasPAM() {
+			const errorMessage = "Unable to start Teleport: PAM was enabled in file configuration but this \n" +
+				"Teleport binary was built without PAM support. To continue either download a \n" +
+				"Teleport binary build with PAM support from https://goteleport.com/teleport \n" +
+				"or disable PAM in file configuration."
+			return nil, trace.BadParameter("%s", errorMessage)
+		}
+		if !pam.SystemHasPAM() {
+			const errorMessage = "Unable to start Teleport: PAM was enabled in file configuration but this \n" +
+				"system does not have the needed PAM library installed. To continue either \n" +
+				"install libpam or disable PAM in file configuration."
+			return nil, trace.BadParameter("%s", errorMessage)
+		}
+	}
+
 	// create the data directory if it's missing
 	_, err = os.Stat(cfg.DataDir)
 	if os.IsNotExist(err) {
@@ -1067,37 +1172,17 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		}
 	}
 
-	supervisor := NewSupervisor(processID, cfg.Logger)
-	storage, err := storage.NewProcessStorage(supervisor.ExitContext(), filepath.Join(cfg.DataDir, teleport.ComponentProcess))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var kubeBackend kubernetesBackend
-	// If running in a Kubernetes Pod we must init the backend storage for `host_uuid` storage/retrieval.
-	if kubernetes.InKubeCluster() {
-		kubeBackend, err = kubernetes.New()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
 	}
 
-	// Load `host_uuid` from different storages. If this process is running in a Kubernetes Cluster,
-	// readOrGenerateHostID will try to read the `host_uuid` from the Kubernetes Secret. If the
-	// key is empty or if not running in a Kubernetes Cluster, it will read the
-	// `host_uuid` from local data directory.
-	// If no host id is available, it will generate a new host id and persist it to available storages.
-	if err := readOrGenerateHostID(supervisor.ExitContext(), cfg, kubeBackend); err != nil {
+	supervisor, err := NewSupervisor(processID, cfg.Logger, cfg.Clock)
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	_, err = uuid.Parse(cfg.HostUUID)
-	if err != nil && !aws.IsEC2NodeID(cfg.HostUUID) {
-		cfg.Logger.WarnContext(supervisor.ExitContext(), "Host UUID is not a true UUID (not eligible for UUID-based proxying)", "host_uuid", cfg.HostUUID)
-	}
-
-	if cfg.Clock == nil {
-		cfg.Clock = clockwork.NewRealClock()
+	store, err := storage.NewProcessStorage(supervisor.ExitContext(), filepath.Join(cfg.DataDir, teleport.ComponentProcess))
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	// full heartbeat announces are on average every 2/3 * 6/7 of the default
@@ -1119,7 +1204,9 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 
 	if cfg.DatabaseREPLRegistry == nil {
 		cfg.DatabaseREPLRegistry = dbrepl.NewREPLGetter(map[string]dbrepl.REPLNewFunc{
-			defaults.ProtocolPostgres: pgrepl.New,
+			defaults.ProtocolPostgres:    pgrepl.New,
+			defaults.ProtocolCockroachDB: pgrepl.New,
+			defaults.ProtocolMySQL:       myrepl.New,
 		})
 	}
 
@@ -1213,13 +1300,17 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		hostedPluginRoles:      make(map[types.SystemRole]string),
 		connectors:             make(map[types.SystemRole]*Connector),
 		importedDescriptors:    cfg.FileDescriptors,
-		storage:                storage,
+		storage:                store,
 		rotationCache:          rotationCache,
 		id:                     processID,
 		logger:                 cfg.Logger,
 		cloudLabels:            cloudLabels,
 		TracingProvider:        tracing.NoopProvider(),
 		metricsRegistry:        metricsRegistry,
+		SyncGatherers: metrics.NewSyncGatherers(
+			metricsRegistry,
+			prometheus.DefaultGatherer,
+		),
 	}
 
 	process.registerExpectedServices(cfg)
@@ -1262,13 +1353,17 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 	upgraderKind, externalUpgrader, upgraderVersion := process.detectUpgrader()
 
 	getHello := func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
+		hostID, err := process.WaitForHostID(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err, "waiting for host ID")
+		}
 		instanceRoles := process.getInstanceRoles()
 		services := make([]string, 0, len(instanceRoles))
 		for _, r := range instanceRoles {
 			services = append(services, string(r))
 		}
 		hello := &proto.UpstreamInventoryHello{
-			ServerID:         cfg.HostUUID,
+			ServerID:         hostID,
 			Version:          teleport.Version,
 			Services:         services,
 			Hostname:         cfg.Hostname,
@@ -1280,11 +1375,18 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 			hello.ExternalUpgraderVersion = "v" + upgraderVersion.String()
 		}
 
-		if upgraderKind == types.UpgraderKindTeleportUpdate {
-			info, err := autoupdate.ReadHelloUpdaterInfo(supervisor.ExitContext(), cfg.Logger, cfg.HostUUID)
+		if upgraderKind == types.UpgraderKindTeleportUpdate ||
+			upgraderKind == types.UpgraderKindKubeController {
+			info, err := autoupdate.ReadHelloUpdaterInfo(supervisor.ExitContext(), cfg.Logger, hostID)
+			// If the config file is not present for Kubernetes upgraders, do not set the updater info.
+			// This ensures that older chart versions maintain the same behavior when used with newer Teleport.
+			if errors.Is(err, autoupdate.ErrConfigNotFound) &&
+				upgraderKind == types.UpgraderKindKubeController {
+				return hello, nil
+			}
 			if err != nil {
-				// Failing to detect teleport-update info is not fatal, we continue.
-				cfg.Logger.WarnContext(supervisor.ExitContext(), "Error recovering teleport-update status, this might affect automatic update tracking and progress.", "error", err)
+				// Failing to detect updater info is not fatal, we continue.
+				cfg.Logger.WarnContext(supervisor.ExitContext(), "Error recovering updater status, this might affect automatic update tracking and progress.", "error", err)
 				info = &types.UpdaterV2Info{UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_UNREADABLE}
 			}
 			hello.UpdaterInfo = info
@@ -1366,12 +1468,6 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 
 	serviceStarted := false
 
-	ps, err := process.newProcessStateMachine()
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to initialize process state machine")
-	}
-	process.state = ps
-
 	if !cfg.DiagnosticAddr.IsEmpty() {
 		if err := process.initDiagnosticService(); err != nil {
 			return nil, trace.Wrap(err)
@@ -1422,6 +1518,9 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 	if cfg.Proxy.Enabled {
 		eventMapping.In = append(eventMapping.In, ProxySSHReady)
 	}
+	if cfg.Relay.Enabled {
+		eventMapping.In = append(eventMapping.In, RelayReady)
+	}
 	if cfg.Kube.Enabled {
 		eventMapping.In = append(eventMapping.In, KubernetesReady)
 	}
@@ -1480,6 +1579,13 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		warnOnErr(process.ExitContext(), process.closeImportedDescriptors(teleport.ComponentProxy), process.logger)
 	}
 
+	if cfg.Relay.Enabled {
+		process.initRelay()
+		serviceStarted = true
+	} else {
+		warnOnErr(process.ExitContext(), process.closeImportedDescriptors(teleport.ComponentRelay), process.logger)
+	}
+
 	if cfg.Kube.Enabled {
 		process.initKubernetes()
 		serviceStarted = true
@@ -1564,7 +1670,7 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 
 	// create the new pid file only after started successfully
 	if cfg.PIDFile != "" {
-		if err := createLockedPIDFile(cfg.PIDFile); err != nil {
+		if err := procutils.CreateLockedPIDFile(cfg.PIDFile); err != nil {
 			return nil, trace.Wrap(err, "creating pidfile")
 		}
 	}
@@ -1609,7 +1715,7 @@ func (process *TeleportProcess) detectUpgrader() (kind, externalName string, ver
 
 // configureUpgraderExporter configures the window exporter for upgraders that export windows.
 func (process *TeleportProcess) configureUpgraderExporter(kind string) error {
-	driver, err := uw.NewDriver(kind)
+	driver, err := uw.NewDriver(process.ExitContext(), kind)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1717,19 +1823,33 @@ func (process *TeleportProcess) getInstanceClient() *authclient.Client {
 	return conn.Client
 }
 
-// waitForInstanceConnector waits for the instance connector to become available. returns nil if
-// process shutdown is triggered or if this is an auth-only instance. Auth-only instances cannot
-// use the instance client because auth servers need to be able to fully initialize without a
-// valid CA in order to support HSMs.
-func (process *TeleportProcess) waitForInstanceConnector() *Connector {
+// waitForInstanceConnector waits for the instance connector to become
+// available. Returns nil if if this is an auth-only instance or ctx is
+// canceled. Auth-only instances cannot use the instance client because auth
+// servers need to be able to fully initialize without a valid CA in order to
+// support HSMs.
+func (process *TeleportProcess) waitForInstanceConnector(ctx context.Context) *Connector {
 	select {
 	case <-process.instanceConnectorReady:
 		return process.getInstanceConnector()
-	case <-process.ExitContext().Done():
+	case <-ctx.Done():
 		return nil
 	}
 }
 
+// WaitForHostID returns the local host UUID. If there is a local auth service,
+// it returns immediately, otherwise it waits for the instance connector to
+// become available.
+func (process *TeleportProcess) WaitForHostID(ctx context.Context) (string, error) {
+	if auth := process.getLocalAuth(); auth != nil {
+		return auth.ServerID, nil
+	}
+	if connector := process.waitForInstanceConnector(ctx); connector != nil {
+		return connector.HostUUID(), nil
+	}
+	return "", trace.Errorf("instance connector never became ready")
+}
+
 // makeInventoryControlStreamWhenReady is the same as makeInventoryControlStream except that it blocks until
 // the InstanceReady event is emitted.
 func (process *TeleportProcess) makeInventoryControlStreamWhenReady(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
@@ -1831,10 +1951,12 @@ func initAuthUploadHandler(ctx context.Context, auditConfig types.ClusterAuditCo
 		config := s3sessions.Config{
 			UseFIPSEndpoint: auditConfig.GetUseFIPSEndpoint(),
 		}
+		region := auditConfig.Region()
 		if externalAuditStorage.IsUsed() {
 			config.CredentialsProvider = externalAuditStorage.CredentialsProvider()
+			region = externalAuditStorage.GetSpec().Region
 		}
-		if err := config.SetFromURL(uri, auditConfig.Region()); err != nil {
+		if err := config.SetFromURL(uri, region); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
@@ -2041,6 +2163,7 @@ func (process *TeleportProcess) initAuthExternalAuditLog(auditConfig types.Clust
 func (process *TeleportProcess) initAuthService() error {
 	var err error
 	cfg := process.Config
+	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentAuth, process.id))
 
 	// Initialize the storage back-ends for keys, events and records
 	b, err := process.initAuthStorage()
@@ -2049,10 +2172,102 @@ func (process *TeleportProcess) initAuthService() error {
 	}
 	process.backend = b
 
+	clusterName := cfg.Auth.ClusterName.GetClusterName()
+	ident, err := process.storage.ReadIdentity(state.IdentityCurrent, types.RoleAdmin)
+	if err != nil && !trace.IsNotFound(err) {
+		return trace.Wrap(err)
+	}
+	if ident != nil {
+		clusterName = ident.ClusterName
+	}
+
+	cn, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+		ClusterName: clusterName,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	clusterConfig := cfg.ClusterConfiguration
+	if clusterConfig == nil {
+		clusterConfig, err = local.NewClusterConfigurationService(b)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	hostUUID, err := process.storage.ReadOrGenerateHostID(process.ExitContext(), cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if _, err := uuid.Parse(hostUUID); err != nil {
+		cfg.Logger.WarnContext(process.ExitContext(), "Host UUID is not a true UUID (not eligible for UUID-based proxying)", "host_uuid", hostUUID)
+	}
+
+	// create keystore
+	keystoreOpts := &keystore.Options{
+		HostUUID:             hostUUID,
+		ClusterName:          cn,
+		AuthPreferenceGetter: clusterConfig,
+		FIPS:                 cfg.FIPS,
+	}
+
+	switch {
+	case cfg.Auth.KeyStore.PKCS11 != servicecfg.PKCS11Config{}:
+		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+			return trace.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", auth.ErrRequiresEnterprise)
+		}
+	case cfg.Auth.KeyStore.GCPKMS != servicecfg.GCPKMSConfig{}:
+		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+			return trace.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", auth.ErrRequiresEnterprise)
+		}
+	case cfg.Auth.KeyStore.AWSKMS != nil:
+		if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
+			return trace.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", auth.ErrRequiresEnterprise)
+		}
+	}
+
+	keyStore, err := keystore.NewManager(process.GracefulExitContext(), &cfg.Auth.KeyStore, keystoreOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	localRecordingEncryption, err := local.NewRecordingEncryptionService(b)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	recordingEncryptionManager, err := recordingencryption.NewManager(process.GracefulExitContext(), recordingencryption.ManagerConfig{
+		Backend:       localRecordingEncryption,
+		Cache:         localRecordingEncryption,
+		KeyStore:      keyStore,
+		Logger:        logger,
+		ClusterConfig: clusterConfig,
+		LockConfig: backend.RunWhileLockedConfig{
+			LockConfiguration: backend.LockConfiguration{
+				Backend:            process.backend,
+				TTL:                time.Second * 30,
+				LockNameComponents: []string{"recording_encryption"},
+			},
+		},
+		InitialSessionRecordingConfig: cfg.Auth.SessionRecordingConfig,
+	})
+	if err != nil {
+		return trace.Wrap(err, "initializing session recording encryption")
+	}
+
+	clusterConfig = recordingEncryptionManager
 	var emitter apievents.Emitter
 	var streamer events.Streamer
 	var uploadHandler events.MultipartHandler
 	var externalAuditStorage *externalauditstorage.Configurator
+	encryptedIO, err := recordingencryption.NewEncryptedIO(clusterConfig, recordingEncryptionManager)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	sessionSummarizerProvider := summarizer.NewSessionSummarizerProvider()
+	recordingMetadataProvider := recordingmetadata.NewProvider()
 
 	// create the audit log, which will be consuming (and recording) all events
 	// and recording all sessions.
@@ -2091,7 +2306,10 @@ func (process *TeleportProcess) initAuthService() error {
 			}
 		}
 		streamer, err = events.NewProtoStreamer(events.ProtoStreamerConfig{
-			Uploader: uploadHandler,
+			Uploader:                  uploadHandler,
+			SessionSummarizerProvider: sessionSummarizerProvider,
+			RecordingMetadataProvider: recordingMetadataProvider,
+			Encrypter:                 encryptedIO,
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -2107,11 +2325,14 @@ func (process *TeleportProcess) initAuthService() error {
 		}
 
 		auditServiceConfig := events.AuditLogConfig{
-			Context:       process.ExitContext(),
-			DataDir:       filepath.Join(cfg.DataDir, teleport.LogsDir),
-			ServerID:      cfg.HostUUID,
-			UploadHandler: uploadHandler,
-			ExternalLog:   externalLog,
+			Context:                   process.ExitContext(),
+			DataDir:                   filepath.Join(cfg.DataDir, teleport.LogsDir),
+			ServerID:                  hostUUID,
+			UploadHandler:             uploadHandler,
+			ExternalLog:               externalLog,
+			Decrypter:                 encryptedIO,
+			SessionSummarizerProvider: sessionSummarizerProvider,
+			RecordingMetadataProvider: recordingMetadataProvider,
 		}
 		auditServiceConfig.UID, auditServiceConfig.GID, err = adminCreds()
 		if err != nil {
@@ -2133,15 +2354,6 @@ func (process *TeleportProcess) initAuthService() error {
 		}
 	}
 
-	clusterName := cfg.Auth.ClusterName.GetClusterName()
-	ident, err := process.storage.ReadIdentity(state.IdentityCurrent, types.RoleAdmin)
-	if err != nil && !trace.IsNotFound(err) {
-		return trace.Wrap(err)
-	}
-	if ident != nil {
-		clusterName = ident.ClusterName
-	}
-
 	checkingEmitter, err := events.NewCheckingEmitter(events.CheckingEmitterConfig{
 		Inner:       events.NewMultiEmitter(events.NewLoggingEmitter(process.GetClusterFeatures().Cloud), emitter),
 		Clock:       process.Clock,
@@ -2167,14 +2379,6 @@ func (process *TeleportProcess) initAuthService() error {
 		traceClt = clt
 	}
 
-	cn, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-		ClusterName: clusterName,
-	})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentAuth, process.id))
 	// Environment variable for disabling the check major version upgrade check and overrides
 	// latest known version in backend.
 	skipVersionCheckFromEnv := os.Getenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK") != ""
@@ -2183,48 +2387,52 @@ func (process *TeleportProcess) initAuthService() error {
 	authServer, err := auth.Init(
 		process.ExitContext(),
 		auth.InitConfig{
-			Backend:                 b,
-			VersionStorage:          process.storage,
-			SkipVersionCheck:        cfg.SkipVersionCheck || skipVersionCheckFromEnv,
-			Authority:               cfg.Keygen,
-			ClusterConfiguration:    cfg.ClusterConfiguration,
-			AutoUpdateService:       cfg.AutoUpdateService,
-			ClusterAuditConfig:      cfg.Auth.AuditConfig,
-			ClusterNetworkingConfig: cfg.Auth.NetworkingConfig,
-			SessionRecordingConfig:  cfg.Auth.SessionRecordingConfig,
-			ClusterName:             cn,
-			AuthServiceName:         cfg.Hostname,
-			DataDir:                 cfg.DataDir,
-			HostUUID:                cfg.HostUUID,
-			NodeName:                cfg.Hostname,
-			Authorities:             cfg.Auth.Authorities,
-			ApplyOnStartupResources: cfg.Auth.ApplyOnStartupResources,
-			BootstrapResources:      cfg.Auth.BootstrapResources,
-			ReverseTunnels:          cfg.ReverseTunnels,
-			Trust:                   cfg.Trust,
-			Presence:                cfg.Presence,
-			Events:                  cfg.Events,
-			Provisioner:             cfg.Provisioner,
-			Identity:                cfg.Identity,
-			Access:                  cfg.Access,
-			UsageReporter:           cfg.UsageReporter,
-			StaticTokens:            cfg.Auth.StaticTokens,
-			Roles:                   cfg.Auth.Roles,
-			AuthPreference:          cfg.Auth.Preference,
-			OIDCConnectors:          cfg.OIDCConnectors,
-			AuditLog:                process.auditLog,
-			CipherSuites:            cfg.CipherSuites,
-			KeyStoreConfig:          cfg.Auth.KeyStore,
-			Emitter:                 checkingEmitter,
-			Streamer:                events.NewReportingStreamer(streamer, process.Config.Testing.UploadEventsC),
-			TraceClient:             traceClt,
-			FIPS:                    cfg.FIPS,
-			LoadAllCAs:              cfg.Auth.LoadAllCAs,
-			AccessMonitoringEnabled: cfg.Auth.IsAccessMonitoringEnabled(),
-			Clock:                   cfg.Clock,
-			HTTPClientForAWSSTS:     cfg.Auth.HTTPClientForAWSSTS,
-			Tracer:                  process.TracingProvider.Tracer(teleport.ComponentAuth),
-			Logger:                  logger,
+			Backend:                   b,
+			VersionStorage:            process.storage,
+			SkipVersionCheck:          cfg.SkipVersionCheck || skipVersionCheckFromEnv,
+			Authority:                 cfg.Keygen,
+			ClusterConfiguration:      clusterConfig,
+			AutoUpdateService:         cfg.AutoUpdateService,
+			ClusterAuditConfig:        cfg.Auth.AuditConfig,
+			ClusterNetworkingConfig:   cfg.Auth.NetworkingConfig,
+			SessionRecordingConfig:    cfg.Auth.SessionRecordingConfig,
+			ClusterName:               cn,
+			AuthServiceName:           cfg.Hostname,
+			DataDir:                   cfg.DataDir,
+			HostUUID:                  hostUUID,
+			NodeName:                  cfg.Hostname,
+			Authorities:               cfg.Auth.Authorities,
+			ApplyOnStartupResources:   cfg.Auth.ApplyOnStartupResources,
+			BootstrapResources:        cfg.Auth.BootstrapResources,
+			ReverseTunnels:            cfg.ReverseTunnels,
+			Trust:                     cfg.Trust,
+			Presence:                  cfg.Presence,
+			Events:                    cfg.Events,
+			Provisioner:               cfg.Provisioner,
+			Identity:                  cfg.Identity,
+			Access:                    cfg.Access,
+			StaticTokens:              cfg.Auth.StaticTokens,
+			Roles:                     cfg.Auth.Roles,
+			AuthPreference:            cfg.Auth.Preference,
+			OIDCConnectors:            cfg.OIDCConnectors,
+			AuditLog:                  process.auditLog,
+			CipherSuites:              cfg.CipherSuites,
+			KeyStore:                  keyStore,
+			KeyStoreConfig:            cfg.Auth.KeyStore,
+			Emitter:                   checkingEmitter,
+			Streamer:                  events.NewReportingStreamer(streamer, process.Config.Testing.UploadEventsC),
+			TraceClient:               traceClt,
+			FIPS:                      cfg.FIPS,
+			LoadAllCAs:                cfg.Auth.LoadAllCAs,
+			AccessMonitoringEnabled:   cfg.Auth.IsAccessMonitoringEnabled(),
+			Clock:                     cfg.Clock,
+			HTTPClientForAWSSTS:       cfg.Auth.HTTPClientForAWSSTS,
+			MultipartHandler:          uploadHandler,
+			Tracer:                    process.TracingProvider.Tracer(teleport.ComponentAuth),
+			Logger:                    logger,
+			SessionSummarizerProvider: sessionSummarizerProvider,
+			RecordingEncryption:       recordingEncryptionManager,
+			RecordingMetadataProvider: recordingMetadataProvider,
 		}, func(as *auth.Server) error {
 			if !process.Config.CachePolicy.Enabled {
 				return nil
@@ -2240,12 +2448,14 @@ func (process *TeleportProcess) initAuthService() error {
 				return trace.Wrap(err)
 			}
 			as.Cache = cache
+			recordingEncryptionManager.SetCache(cache)
 
 			return nil
 		})
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	authServer.EncryptedIO = encryptedIO
 
 	lockWatcher, err := services.NewLockWatcher(process.ExitContext(), services.LockWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
@@ -2313,6 +2523,16 @@ func (process *TeleportProcess) initAuthService() error {
 	}
 	authServer.SetHeadlessAuthenticationWatcher(headlessAuthenticationWatcher)
 
+	recordingMetadataService, err := recordingmetadatav1.NewRecordingMetadataService(recordingmetadatav1.RecordingMetadataServiceConfig{
+		Streamer:      authServer,
+		UploadHandler: authServer,
+		Encrypter:     encryptedIO,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	recordingMetadataProvider.SetService(recordingMetadataService)
+
 	process.setLocalAuth(authServer)
 
 	// The auth server runs its own upload completer, which is necessary in sync recording modes where
@@ -2325,13 +2545,15 @@ func (process *TeleportProcess) initAuthService() error {
 		logger.WarnContext(process.ExitContext(), "auth service's upload completer is disabled, abandoned uploads may accumulate in external storage")
 	case uploadHandler != nil:
 		err = events.StartNewUploadCompleter(process.ExitContext(), events.UploadCompleterConfig{
-			Uploader:       uploadHandler,
-			Component:      teleport.ComponentAuth,
-			ClusterName:    clusterName,
-			AuditLog:       process.auditLog,
-			SessionTracker: authServer.Services,
-			Semaphores:     authServer.Services,
-			ServerID:       cfg.HostUUID,
+			Uploader:                  uploadHandler,
+			Component:                 teleport.ComponentAuth,
+			ClusterName:               clusterName,
+			AuditLog:                  process.auditLog,
+			SessionTracker:            authServer.Services,
+			Semaphores:                authServer.Services,
+			ServerID:                  hostUUID,
+			SessionSummarizerProvider: sessionSummarizerProvider,
+			RecordingMetadataProvider: recordingMetadataProvider,
 		})
 		if err != nil {
 			return trace.Wrap(err, "starting upload completer")
@@ -2346,10 +2568,12 @@ func (process *TeleportProcess) initAuthService() error {
 	// second, create the API Server: it's actually a collection of API servers,
 	// each serving requests for a "role" which is assigned to every connected
 	// client based on their certificate (user, server, admin, etc)
-	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
+
+	authorizerOpts := authz.AuthorizerOpts{
 		ClusterName:         clusterName,
 		AccessPoint:         authServer,
 		ReadOnlyAccessPoint: authServer,
+		ScopedRoleReader:    authServer.ScopedAccessCache,
 		MFAAuthenticator:    authServer,
 		LockWatcher:         lockWatcher,
 		Logger:              process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentAuth, process.id)),
@@ -2360,10 +2584,17 @@ func (process *TeleportProcess) initAuthService() error {
 			DisableGlobalMode: true,
 			DisableRoleMode:   true,
 		},
-	})
+	}
+
+	authorizer, err := authz.NewAuthorizer(authorizerOpts)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	scopedAuthorizer, err := authz.NewScopedAuthorizer(authorizerOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	var accessGraphCAData []byte
 	if cfg.AccessGraph.Enabled && cfg.AccessGraph.CA != "" {
 		accessGraphCAData, err = os.ReadFile(cfg.AccessGraph.CA)
@@ -2372,12 +2603,13 @@ func (process *TeleportProcess) initAuthService() error {
 		}
 	}
 	apiConf := &auth.APIConfig{
-		AuthServer:     authServer,
-		Authorizer:     authorizer,
-		AuditLog:       process.auditLog,
-		PluginRegistry: process.PluginRegistry,
-		Emitter:        authServer,
-		MetadataGetter: uploadHandler,
+		AuthServer:       authServer,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: scopedAuthorizer,
+		AuditLog:         process.auditLog,
+		PluginRegistry:   process.PluginRegistry,
+		Emitter:          authServer,
+		MetadataGetter:   uploadHandler,
 		AccessGraph: auth.AccessGraphConfig{
 			Enabled:  cfg.AccessGraph.Enabled,
 			Address:  cfg.AccessGraph.Addr,
@@ -2394,6 +2626,27 @@ func (process *TeleportProcess) initAuthService() error {
 		}
 	}
 
+	// We mark the process state as starting until the auth backend is ready.
+	// If cache is enabled, this will wait for the cache to be populated.
+	// We don't want auth to say its ready until its cache is populated,
+	// else a rollout might progress too quickly and cause backend pressure
+	// and outages.
+	{
+		component := teleport.Component(teleport.ComponentAuth, "backend")
+		process.ExpectService(component)
+		process.RegisterFunc("auth.wait-for-event-stream", func() error {
+			if err := libwatcher.WaitForReady(process.ExitContext(), libwatcher.WaitForReadyConfig{
+				Watcher: authServer,
+				Logger:  process.logger.With(teleport.ComponentLabel, component),
+				Clock:   process.Clock,
+			}); err != nil {
+				return trace.Wrap(err)
+			}
+			process.OnHeartbeat(component)(nil)
+			return nil
+		})
+	}
+
 	// Register TLS endpoint of the auth service
 	tlsConfig, err := connector.ServerTLSConfig(cfg.CipherSuites)
 	if err != nil {
@@ -2457,6 +2710,7 @@ func (process *TeleportProcess) initAuthService() error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+
 	process.RegisterCriticalFunc("auth.tls", func() error {
 		logger.InfoContext(process.ExitContext(), "Auth service is starting.", "version", teleport.Version, "git_ref", teleport.Gitref, "listen_address", authAddr)
 
@@ -2518,12 +2772,13 @@ func (process *TeleportProcess) initAuthService() error {
 				Version: types.V2,
 				Metadata: types.Metadata{
 					Namespace: apidefaults.Namespace,
-					Name:      process.Config.HostUUID,
+					Name:      connector.HostUUID(),
 				},
 				Spec: types.ServerSpecV2{
-					Addr:     authAddr,
-					Hostname: process.Config.Hostname,
-					Version:  teleport.Version,
+					Addr:              authAddr,
+					Hostname:          process.Config.Hostname,
+					Version:           teleport.Version,
+					ComponentFeatures: componentfeatures.ForAuthServer(),
 				},
 			}
 			state, err := process.storage.GetState(process.GracefulExitContext(), types.RoleAdmin)
@@ -2572,6 +2827,9 @@ func (process *TeleportProcess) initAuthService() error {
 	process.RegisterFunc("auth.autoupdate_agent_rollout_controller", func() error {
 		return trace.Wrap(agentRolloutController.Run(process.GracefulExitContext()), "running autoupdate_agent_rollout controller")
 	})
+	process.RegisterFunc("auth.autoupdate_bot_instance_version_reporter", func() error {
+		return trace.Wrap(authServer.BotInstanceVersionReporter.Run(process.GracefulExitContext()))
+	})
 
 	process.RegisterFunc("auth.server_info", func() error {
 		return trace.Wrap(auth.ReconcileServerInfos(process.GracefulExitContext(), authServer))
@@ -2587,7 +2845,7 @@ func (process *TeleportProcess) initAuthService() error {
 		Emitter:     authServer,
 		AccessPoint: authServer.Services,
 		Clock:       process.Clock,
-		HostID:      cfg.HostUUID,
+		HostID:      connector.HostUUID(),
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -2599,6 +2857,23 @@ func (process *TeleportProcess) initAuthService() error {
 		return trace.Wrap(err)
 	})
 
+	process.RegisterFunc("auth.aws-roles-anywhere.profile-sync.service", func() error {
+		return trace.Wrap(awsra.RunAWSRolesAnywhereProfileSyncerWhileLocked(process.GracefulExitContext(), awsra.AWSRolesAnywhereProfileSyncerParams{
+			Clock:             process.Clock,
+			Logger:            logger,
+			KeyStoreManager:   authServer.GetKeyStore(),
+			Cache:             authServer.Cache,
+			StatusReporter:    authServer.Services,
+			Backend:           process.backend,
+			AppServerUpserter: authServer.Services,
+			HostUUID:          hostUUID,
+		}))
+	})
+
+	process.RegisterFunc("auth.recording_encryption_resolver", func() error {
+		return trace.Wrap(recordingEncryptionManager.Watch(process.GracefulExitContext(), authServer.Services))
+	})
+
 	// execute this when process is asked to exit:
 	process.OnExit("auth.shutdown", func(payload any) {
 		// The listeners have to be closed here, because if shutdown
@@ -2644,9 +2919,30 @@ func payloadContext(payload any) context.Context {
 	return context.TODO()
 }
 
-// OnExit allows individual services to register a callback function which will be
-// called when Teleport Process is asked to exit. Usually services terminate themselves
-// when the callback is called
+// OnExit registers a callback to be executed when the Teleport process
+// is asked to exit. Typically, services use this to gracefully shut down.
+//
+// WARNING: Do not register OnExit callbacks from within flows that may
+// themselves be triggered during shutdown. Doing so can lead to races.
+//
+// ✅ Correct usage:
+//
+//	process.RegisterFunc("service.init", func() error { ... })
+//	process.OnExit("service.exit", func(any) { ... })
+//
+// Or
+//
+//	process.OnExit("service.exit", func(any) { ... })
+//	process.RegisterFunc("service.init", func() error { ... })
+//
+// ❌ Incorrect usage:
+//
+//	defer process.OnExit("service.exit", func(any) { ... })
+//	process.RegisterFunc("service.init", func() error { ... })
+//
+// These patterns cause the callback to be registered too late,
+// during shutdown itself, which may trigger races in
+// Supervisor.Wg.Add / Supervisor.Wg.Done.
 func (process *TeleportProcess) OnExit(serviceName string, callback func(interface{})) {
 	process.RegisterFunc(serviceName, func() error {
 		event, _ := process.WaitForEvent(context.TODO(), TeleportExitEvent)
@@ -2661,12 +2957,13 @@ func (process *TeleportProcess) newAccessCacheForServices(cfg accesspoint.Config
 	cfg.ProcessID = process.id
 	cfg.TracingProvider = process.TracingProvider
 	cfg.MaxRetryPeriod = process.Config.CachePolicy.MaxRetryPeriod
+	cfg.Registerer = process.metricsRegistry
 
 	cfg.Access = services.Access
-	cfg.AccessLists = services.AccessLists
+	cfg.AccessLists = services.AccessListsInternal
 	cfg.AccessMonitoringRules = services.AccessMonitoringRules
 	cfg.AppSession = services.Identity
-	cfg.Apps = services.Apps
+	cfg.Apps = services.Applications
 	cfg.ClusterConfig = services.ClusterConfigurationInternal
 	cfg.CrownJewels = services.CrownJewels
 	cfg.DatabaseObjects = services.DatabaseObjects
@@ -2694,7 +2991,7 @@ func (process *TeleportProcess) newAccessCacheForServices(cfg accesspoint.Config
 	cfg.UserLoginStates = services.UserLoginStates
 	cfg.Users = services.Identity
 	cfg.WebSession = services.Identity.WebSessions()
-	cfg.WebToken = services.Identity.WebTokens()
+	cfg.WebToken = services.Identity
 	cfg.WindowsDesktops = services.WindowsDesktops
 	cfg.WorkloadIdentity = services.WorkloadIdentities
 	cfg.DynamicWindowsDesktops = services.DynamicWindowsDesktops
@@ -2704,6 +3001,9 @@ func (process *TeleportProcess) newAccessCacheForServices(cfg accesspoint.Config
 	cfg.PluginStaticCredentials = services.PluginStaticCredentials
 	cfg.GitServers = services.GitServers
 	cfg.HealthCheckConfig = services.HealthCheckConfig
+	cfg.BotInstance = services.BotInstance
+	cfg.Plugin = services.Plugins
+	cfg.RecordingEncryption = services.RecordingEncryptionManager
 
 	return accesspoint.NewCache(cfg)
 }
@@ -2745,7 +3045,7 @@ func (process *TeleportProcess) newAccessCacheForClient(cfg accesspoint.Config,
 	cfg.UserLoginStates = client.UserLoginStateClient()
 	cfg.Users = client
 	cfg.WebSession = client.WebSessions()
-	cfg.WebToken = client.WebTokens()
+	cfg.WebToken = client
 	cfg.WindowsDesktops = client
 	cfg.DynamicWindowsDesktops = client.DynamicDesktopClient()
 	cfg.AutoUpdateService = client
@@ -2852,6 +3152,20 @@ func (process *TeleportProcess) newLocalCacheForProxy(clt authclient.ClientI, ca
 	return authclient.NewProxyWrapper(clt, cache), nil
 }
 
+func (process *TeleportProcess) newLocalCacheForRelay(clt authclient.ClientI, cacheName []string) (authclient.RelayAccessPoint, error) {
+	// if caching is disabled, return access point
+	if !process.Config.CachePolicy.Enabled {
+		return clt, nil
+	}
+
+	cache, err := process.NewLocalCache(clt, cache.ForRelay, cacheName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return authclient.NewRelayWrapper(clt, cache), nil
+}
+
 // newLocalCacheForRemoteProxy returns new instance of access point configured for a remote proxy.
 func (process *TeleportProcess) newLocalCacheForRemoteProxy(clt authclient.ClientI, cacheName []string) (authclient.RemoteProxyAccessPoint, error) {
 	// if caching is disabled, return access point
@@ -2994,6 +3308,7 @@ func (process *TeleportProcess) initSSH() error {
 	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentNode, process.id))
 
 	proxyGetter := reversetunnel.NewConnectedProxyGetter()
+	relayInfoHolder := new(relaytunnel.InfoHolder)
 
 	process.RegisterCriticalFunc("ssh.node", func() error {
 		// restartingOnGracefulShutdown will be set to true before the function
@@ -3108,12 +3423,6 @@ func (process *TeleportProcess) initSSH() error {
 
 		storagePresence := local.NewPresenceService(process.storage.BackendStorage)
 
-		// read the host UUID:
-		serverID, err := hostid.ReadOrCreateFile(cfg.DataDir)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
 		sessionController, err := srv.NewSessionController(srv.SessionControllerConfig{
 			Semaphores:     authClient,
 			AccessPoint:    authClient,
@@ -3122,7 +3431,7 @@ func (process *TeleportProcess) initSSH() error {
 			Component:      teleport.ComponentNode,
 			Logger:         process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentNode, process.id, "sessionctrl")),
 			TracerProvider: process.TracingProvider,
-			ServerID:       serverID,
+			ServerID:       conn.HostUUID(),
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -3138,6 +3447,9 @@ func (process *TeleportProcess) initSSH() error {
 			cfg.AdvertiseIP,
 			process.proxyPublicAddr(),
 			conn.Client,
+			regular.SetChildLogConfig(cfg),
+			regular.SetUUID(conn.HostUUID()),
+			regular.SetScope(conn.Scope()),
 			regular.SetLimiter(limiter),
 			regular.SetEmitter(&events.StreamerAndEmitter{Emitter: asyncEmitter, Streamer: conn.Client}),
 			regular.SetLabels(cfg.SSH.Labels, cfg.SSH.CmdLabels, process.cloudLabels),
@@ -3157,6 +3469,7 @@ func (process *TeleportProcess) initSSH() error {
 			regular.SetX11ForwardingConfig(cfg.SSH.X11),
 			regular.SetAllowFileCopying(cfg.SSH.AllowFileCopying),
 			regular.SetConnectedProxyGetter(proxyGetter),
+			regular.SetRelayInfoGetter(relayInfoHolder.GetRelayInfo),
 			regular.SetCreateHostUser(!cfg.SSH.DisableCreateHostUser),
 			regular.SetStoragePresenceService(storagePresence),
 			regular.SetInventoryControlHandle(process.inventoryHandle),
@@ -3191,7 +3504,7 @@ func (process *TeleportProcess) initSSH() error {
 		if os.Getenv("TELEPORT_UNSTABLE_DISABLE_SSH_RESUMPTION") == "" {
 			resumableServer = resumption.NewSSHServerWrapper(resumption.SSHServerWrapperConfig{
 				SSHServer: s.HandleConnection,
-				HostID:    serverID,
+				HostID:    conn.HostUUID(),
 				DataDir:   cfg.DataDir,
 			})
 
@@ -3203,6 +3516,7 @@ func (process *TeleportProcess) initSSH() error {
 		}
 
 		var agentPool *reversetunnel.AgentPool
+		var relayTunnelClient *relaytunnel.Client
 		if useLocalListener {
 			listener, err := process.importOrCreateListener(ListenerNodeSSH, cfg.SSH.Addr.Addr)
 			if err != nil {
@@ -3284,6 +3598,37 @@ func (process *TeleportProcess) initSSH() error {
 			}
 			logger.InfoContext(process.ExitContext(), "Service is starting in tunnel mode.")
 		}
+		if !conn.UseTunnel() && cfg.RelayServer != "" {
+			logger.WarnContext(process.ExitContext(), "Service is configured for relay tunnel mode but the agent is running in direct connection mode, so the configured relay will be ignored.")
+		}
+		if conn.UseTunnel() && cfg.RelayServer != "" {
+			var serverHandler reversetunnel.ServerHandler = s
+			if resumableServer != nil {
+				serverHandler = resumableServer
+			}
+
+			relayTunnelClient, err = relaytunnel.NewClient(relaytunnel.ClientConfig{
+				Log: logger,
+
+				GetCertificate: conn.ClientGetCertificate,
+				GetPool:        conn.ClientGetPool,
+				Ciphersuites:   cfg.CipherSuites,
+
+				TunnelType: types.NodeTunnel,
+				RelayAddr:  cfg.RelayServer,
+
+				HandleConnection: serverHandler.HandleConnection,
+				RelayInfoSetter:  relayInfoHolder.SetRelayInfo,
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if err := relayTunnelClient.Start(); err != nil {
+				return trace.Wrap(err)
+			}
+			defer relayTunnelClient.Close()
+			logger.InfoContext(process.ExitContext(), "Service is starting in relay tunnel mode.")
+		}
 
 		// Broadcast that the node has started.
 		process.BroadcastEvent(Event{Name: NodeSSHReady, Payload: nil})
@@ -3304,13 +3649,16 @@ func (process *TeleportProcess) initSSH() error {
 		} else {
 			logger.InfoContext(process.ExitContext(), "Shutting down gracefully.")
 			ctx := payloadContext(event.Payload)
-			restartingOnGracefulShutdown = services.IsProcessReloading(ctx) || services.HasProcessForked(ctx)
+			restartingOnGracefulShutdown = services.HasProcessForked(ctx)
 			warnOnErr(ctx, s.Shutdown(ctx), logger)
 		}
 
 		s.Wait()
 		agentPool.Stop()
 		agentPool.Wait()
+		if relayTunnelClient != nil {
+			relayTunnelClient.Close()
+		}
 
 		logger.InfoContext(process.ExitContext(), "Exited.")
 		return nil
@@ -3367,7 +3715,7 @@ func waitForInstanceConnector(process *TeleportProcess, log *slog.Logger) (*Conn
 			}
 			return result.c, nil
 		case <-t.C:
-			log.WarnContext(process.ExitContext(), "The Instance connector is still not available, process-wide services such as session uploading will not function")
+			log.WarnContext(process.ExitContext(), "The Instance connector is still not available, process-wide services will not function")
 		}
 	}
 }
@@ -3390,6 +3738,7 @@ func (process *TeleportProcess) initUploaderService() error {
 	// use the local auth server for uploads if auth happens to be
 	// running in this process, otherwise wait for the instance client
 	var uploaderClient procUploader
+	var encryptedRecordingMaxUploadSize int
 	if la := process.getLocalAuth(); la != nil {
 		// The auth service's upload completer is initialized separately,
 		// so as a special case we can stop early if auth happens to be
@@ -3405,6 +3754,7 @@ func (process *TeleportProcess) initUploaderService() error {
 			return trace.Wrap(err, "cannot get cluster name")
 		}
 		clusterName = cn.GetClusterName()
+
 	} else {
 		logger.DebugContext(process.ExitContext(), "auth is not running in-process, waiting for instance connector")
 		conn, err := waitForInstanceConnector(process, logger)
@@ -3416,6 +3766,10 @@ func (process *TeleportProcess) initUploaderService() error {
 		}
 		uploaderClient = conn.Client
 		clusterName = conn.ClusterName()
+
+		// encrypted uploads are aggregated and uploaded directly rather than with an event stream.
+		// Since we are using the gRPC client, we must set this maximum for the aggregation step.
+		encryptedRecordingMaxUploadSize = 4 * 1024 * 1024 // 4MiB, default gRPC max msg recv size.
 	}
 
 	logger.InfoContext(process.ExitContext(), "starting upload completer service")
@@ -3454,11 +3808,14 @@ func (process *TeleportProcess) initUploaderService() error {
 	corruptedDir := filepath.Join(paths[1]...)
 
 	fileUploader, err := filesessions.NewUploader(filesessions.UploaderConfig{
-		Streamer:         uploaderClient,
-		ScanDir:          uploadsDir,
-		CorruptedDir:     corruptedDir,
-		EventsC:          process.Config.Testing.UploadEventsC,
-		InitialScanDelay: 15 * time.Second,
+		Streamer:                        uploaderClient,
+		ScanDir:                         uploadsDir,
+		CorruptedDir:                    corruptedDir,
+		EventsC:                         process.Config.Testing.UploadEventsC,
+		InitialScanDelay:                15 * time.Second,
+		EncryptedRecordingUploader:      uploaderClient,
+		EncryptedRecordingUploadMaxSize: encryptedRecordingMaxUploadSize,
+		ConcurrentUploads:               2,
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -3624,41 +3981,6 @@ func (process *TeleportProcess) initMetricsService() error {
 	return nil
 }
 
-// newProcessStateMachine creates a state machine tracking the Teleport process
-// state. The state machine is then used by the diagnostics or the debug service
-// to evaluate the process health.
-func (process *TeleportProcess) newProcessStateMachine() (*processState, error) {
-	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentDiagnosticHealth, process.id))
-	// Create a state machine that will process and update the internal state of
-	// Teleport based off Events. Use this state machine to return the
-	// status from the /readyz endpoint.
-	ps, err := newProcessState(process)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	process.RegisterFunc("readyz.monitor", func() error {
-		// Start loop to monitor for events that are used to update Teleport state.
-		ctx, cancel := context.WithCancel(process.GracefulExitContext())
-		defer cancel()
-
-		eventCh := make(chan Event, 1024)
-		process.ListenForEvents(ctx, TeleportDegradedEvent, eventCh)
-		process.ListenForEvents(ctx, TeleportOKEvent, eventCh)
-
-		for {
-			select {
-			case e := <-eventCh:
-				ps.update(e)
-			case <-ctx.Done():
-				logger.DebugContext(process.ExitContext(), "Teleport is exiting, returning.")
-				return nil
-			}
-		}
-	})
-	return ps, nil
-}
-
 // initDiagnosticService starts diagnostic service currently serving healthz
 // and prometheus endpoints
 func (process *TeleportProcess) initDiagnosticService() error {
@@ -3740,10 +4062,6 @@ func (process *TeleportProcess) initDiagnosticService() error {
 // disable its sensitive pprof and log-setting endpoints, but the liveness
 // and readiness ones are always active.
 func (process *TeleportProcess) initDebugService(exposeDebugRoutes bool) error {
-	if process.state == nil {
-		return trace.BadParameter("teleport process state machine has not yet been initialized (this is a bug)")
-	}
-
 	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentDebug, process.id))
 
 	// Unix socket creation can fail on paths too long. Depending on the UNIX implementation,
@@ -3817,17 +4135,19 @@ func (process *TeleportProcess) initTracingService() error {
 	logger := process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentTracing, process.id))
 	logger.InfoContext(process.ExitContext(), "Initializing tracing provider and exporter.")
 
-	attrs := []attribute.KeyValue{
+	staticAttrs := []attribute.KeyValue{
 		attribute.String(tracing.ProcessIDKey, process.id),
 		attribute.String(tracing.HostnameKey, process.Config.Hostname),
-		attribute.String(tracing.HostIDKey, process.Config.HostUUID),
 	}
 
-	traceConf, err := process.Config.Tracing.Config(attrs...)
+	traceConf, err := process.Config.Tracing.Config(staticAttrs...)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	traceConf.Logger = process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentTracing, process.id))
+	// Host UUID is not ready at this point, it will be reported to the tracing
+	// provider in the goroutine below.
+	traceConf.WaitForDelayedResourceAttrs = true
 
 	provider, err := tracing.NewTraceProvider(process.ExitContext(), *traceConf)
 	if err != nil {
@@ -3835,6 +4155,20 @@ func (process *TeleportProcess) initTracingService() error {
 	}
 	process.TracingProvider = provider
 
+	go func() {
+		var delayedResourceAttrs []attribute.KeyValue
+		hostUUID, err := process.WaitForHostID(process.GracefulExitContext())
+		if err != nil {
+			logger.WarnContext(process.ExitContext(), "Failed to get host UUID, traces may be exported without host UUID attribute", "error", err)
+		} else {
+			delayedResourceAttrs = append(delayedResourceAttrs,
+				attribute.String(tracing.HostIDKey, hostUUID))
+		}
+		if err := process.TracingProvider.SetDelayedResourceAttrs(process.GracefulExitContext(), delayedResourceAttrs); err != nil {
+			logger.WarnContext(process.ExitContext(), "Failed to report delayed resource attributes to tracing provider", "error", err)
+		}
+	}()
+
 	process.OnExit("tracing.shutdown", func(payload interface{}) {
 		if payload == nil {
 			logger.InfoContext(process.ExitContext(), "Shutting down immediately.")
@@ -3853,11 +4187,22 @@ func (process *TeleportProcess) initTracingService() error {
 	return nil
 }
 
+func (process *TeleportProcess) instanceAdditionalPrincipals() (principals []string, dnsNames []string) {
+	if process.Config.Hostname != "" {
+		principals = append(principals, process.Config.Hostname)
+		if lh := utils.ToLowerCaseASCII(process.Config.Hostname); lh != process.Config.Hostname {
+			// openssh expects all hostnames to be lowercase
+			principals = append(principals, lh)
+		}
+	}
+	// Add default DNSNames to the dnsNames list.
+	dnsNames = append(dnsNames, auth.DefaultDNSNamesForRole(types.RoleInstance)...)
+	return principals, dnsNames
+}
+
 // getAdditionalPrincipals returns a list of additional principals to add
 // to role's service certificates.
-func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) ([]string, []string, error) {
-	var principals []string
-	var dnsNames []string
+func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole, hostUUID string) (principals []string, dnsNames []string, err error) {
 	if process.Config.Hostname != "" {
 		principals = append(principals, process.Config.Hostname)
 		if lh := utils.ToLowerCaseASCII(process.Config.Hostname); lh != process.Config.Hostname {
@@ -3865,12 +4210,10 @@ func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) (
 			principals = append(principals, lh)
 		}
 	}
-	var addrs []utils.NetAddr
-
 	// Add default DNSNames to the dnsNames list.
-	// For identities generated by teleport <= v6.1.6 the teleport.cluster.local DNS is not present
 	dnsNames = append(dnsNames, auth.DefaultDNSNamesForRole(role)...)
 
+	var addrs []utils.NetAddr
 	switch role {
 	case types.RoleProxy:
 		addrs = append(process.Config.Proxy.PublicAddrs,
@@ -3902,13 +4245,15 @@ func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) (
 				}
 			}
 		}
+	case types.RoleRelay:
+		dnsNames = append(dnsNames, process.Config.Relay.PublicHostnames...)
 	case types.RoleAuth, types.RoleAdmin:
 		addrs = process.Config.Auth.PublicAddrs
 	case types.RoleNode:
 		// DELETE IN 5.0: We are manually adding HostUUID here in order
 		// to allow UUID based routing to function with older Auth Servers
 		// which don't automatically add UUID to the principal list.
-		principals = append(principals, process.Config.HostUUID)
+		principals = append(principals, hostUUID)
 		addrs = process.Config.SSH.PublicAddrs
 		// If advertise IP is set, add it to the list of principals. Otherwise
 		// add in the default (0.0.0.0) which will be replaced by the Auth Server
@@ -3930,8 +4275,11 @@ func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) (
 			utils.NetAddr{Addr: reversetunnelclient.LocalKubernetes},
 		)
 		addrs = append(addrs, process.Config.Kube.PublicAddrs...)
+		if process.Config.RelayServer != "" {
+			dnsNames = append(dnsNames, "*"+kuberelay.SNISuffix)
+		}
 	case types.RoleApp, types.RoleOkta:
-		principals = append(principals, process.Config.HostUUID)
+		principals = append(principals, hostUUID)
 	case types.RoleWindowsDesktop:
 		addrs = append(addrs,
 			utils.NetAddr{Addr: string(teleport.PrincipalLocalhost)},
@@ -3997,10 +4345,6 @@ func (process *TeleportProcess) initProxy() error {
 
 		return nil
 	})
-	process.RegisterFunc("update.aws-oidc.deploy.service", func() error {
-		err := process.initAWSOIDCDeployServiceUpdater(process.Config.Proxy.AutomaticUpgradesChannels)
-		return trace.Wrap(err)
-	})
 	return nil
 }
 
@@ -4539,138 +4883,162 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		alpnServer               *alpnproxy.Proxy
 		reverseTunnelALPNServer  *alpnproxy.Proxy
 		clientTLSConfigGenerator *auth.ClientTLSConfigGenerator
+		healthCheckManager       healthcheck.Manager
+		// initShutdownMtx ensures that shutdown only occurs after the full
+		// setup has been completed.
+		//
+		// Consider the case where the process is terminated during startup:
+		// the server and listeners may not yet have been assigned to their
+		// variables. Without protection, the shutdown flow could be called
+		// on this partially initialized state.
+		//
+		// This mutex is primarily used in test flows to handle such corner
+		// cases and prevent shutdown from running prematurely.
+		initShutdownMtx sync.Mutex
 	)
+	initShutdownMtx.Lock()
+	defer initShutdownMtx.Unlock()
 
-	defer func() {
-		// execute this when process is asked to exit:
-		process.OnExit("proxy.shutdown", func(payload interface{}) {
-			// Close the listeners at the beginning of shutdown, because we are not
-			// really guaranteed to be capable to serve new requests if we're
-			// halfway through a shutdown, and double closing a listener is fine.
-			listeners.Close()
-			if payload == nil {
-				logger.InfoContext(process.ExitContext(), "Shutting down immediately")
-				if tsrv != nil {
-					warnOnErr(process.ExitContext(), tsrv.Close(), logger)
-				}
-				if rcWatcher != nil {
-					warnOnErr(process.ExitContext(), rcWatcher.Close(), logger)
-				}
-				if peerServer != nil {
-					warnOnErr(process.ExitContext(), peerServer.Close(), logger)
-				}
-				if peerQUICServer != nil {
-					warnOnErr(process.ExitContext(), peerQUICServer.Close(), logger)
-				}
-				if webServer != nil {
-					warnOnErr(process.ExitContext(), webServer.Close(), logger)
-				}
-				if minimalWebServer != nil {
-					warnOnErr(process.ExitContext(), minimalWebServer.Close(), logger)
-				}
-				if peerClient != nil {
-					warnOnErr(process.ExitContext(), peerClient.Stop(), logger)
-				}
-				if sshProxy != nil {
-					warnOnErr(process.ExitContext(), sshProxy.Close(), logger)
-				}
-				if sshGRPCServer != nil {
-					sshGRPCServer.Stop()
-				}
-				if kubeServer != nil {
-					warnOnErr(process.ExitContext(), kubeServer.Close(), logger)
-				}
-				if grpcServerPublic != nil {
-					grpcServerPublic.Stop()
-				}
-				if grpcServerMTLS != nil {
-					grpcServerMTLS.Stop()
-				}
-				if alpnServer != nil {
-					warnOnErr(process.ExitContext(), alpnServer.Close(), logger)
-				}
-				if reverseTunnelALPNServer != nil {
-					warnOnErr(process.ExitContext(), reverseTunnelALPNServer.Close(), logger)
-				}
+	// execute this when process is asked to exit:
+	process.OnExit("proxy.shutdown", func(payload interface{}) {
+		// If we're still phase interrupted by service shutdown, this Lock() will block until the
+		// deferred Unlock() to make sure that this shutdown function is not executed
+		// on partial state.
+		initShutdownMtx.Lock()
+		defer initShutdownMtx.Unlock()
+
+		// Close the listeners at the beginning of shutdown, because we are not
+		// really guaranteed to be capable to serve new requests if we're
+		// halfway through a shutdown, and double closing a listener is fine.
+		listeners.Close()
+		if payload == nil {
+			logger.InfoContext(process.ExitContext(), "Shutting down immediately")
+			if tsrv != nil {
+				warnOnErr(process.ExitContext(), tsrv.Close(), logger)
+			}
+			if rcWatcher != nil {
+				warnOnErr(process.ExitContext(), rcWatcher.Close(), logger)
+			}
+			if peerServer != nil {
+				warnOnErr(process.ExitContext(), peerServer.Close(), logger)
+			}
+			if peerQUICServer != nil {
+				warnOnErr(process.ExitContext(), peerQUICServer.Close(), logger)
+			}
+			if webServer != nil {
+				warnOnErr(process.ExitContext(), webServer.Close(), logger)
+			}
+			if minimalWebServer != nil {
+				warnOnErr(process.ExitContext(), minimalWebServer.Close(), logger)
+			}
+			if peerClient != nil {
+				warnOnErr(process.ExitContext(), peerClient.Stop(), logger)
+			}
+			if sshProxy != nil {
+				warnOnErr(process.ExitContext(), sshProxy.Close(), logger)
+			}
+			if sshGRPCServer != nil {
+				sshGRPCServer.Stop()
+			}
+			if kubeServer != nil {
+				warnOnErr(process.ExitContext(), kubeServer.Close(), logger)
+			}
+			if grpcServerPublic != nil {
+				grpcServerPublic.Stop()
+			}
+			if grpcServerMTLS != nil {
+				grpcServerMTLS.Stop()
+			}
+			if alpnServer != nil {
+				warnOnErr(process.ExitContext(), alpnServer.Close(), logger)
+			}
+			if reverseTunnelALPNServer != nil {
+				warnOnErr(process.ExitContext(), reverseTunnelALPNServer.Close(), logger)
+			}
 
-				if clientTLSConfigGenerator != nil {
-					clientTLSConfigGenerator.Close()
-				}
-			} else {
-				logger.InfoContext(process.ExitContext(), "Shutting down gracefully")
-				ctx := payloadContext(payload)
-				if tsrv != nil {
-					warnOnErr(ctx, tsrv.DrainConnections(ctx), logger)
-				}
-				if sshProxy != nil {
-					warnOnErr(ctx, sshProxy.Shutdown(ctx), logger)
-				}
-				if sshGRPCServer != nil {
-					sshGRPCServer.GracefulStop()
-				}
-				if webServer != nil {
-					warnOnErr(ctx, webServer.Shutdown(ctx), logger)
-				}
-				if minimalWebServer != nil {
-					warnOnErr(ctx, minimalWebServer.Shutdown(ctx), logger)
-				}
-				if tsrv != nil {
-					warnOnErr(ctx, tsrv.Shutdown(ctx), logger)
-				}
-				if rcWatcher != nil {
-					warnOnErr(ctx, rcWatcher.Close(), logger)
-				}
-				if peerServer != nil {
-					warnOnErr(ctx, peerServer.Shutdown(), logger)
-				}
-				if peerQUICServer != nil {
-					warnOnErr(ctx, peerQUICServer.Shutdown(ctx), logger)
-				}
-				if peerClient != nil {
-					peerClient.Shutdown(ctx)
-				}
-				if kubeServer != nil {
-					warnOnErr(ctx, kubeServer.Shutdown(ctx), logger)
-				}
-				if grpcServerPublic != nil {
-					grpcServerPublic.GracefulStop()
-				}
-				if grpcServerMTLS != nil {
-					grpcServerMTLS.GracefulStop()
-				}
-				if alpnServer != nil {
-					warnOnErr(ctx, alpnServer.Close(), logger)
-				}
-				if reverseTunnelALPNServer != nil {
-					warnOnErr(ctx, reverseTunnelALPNServer.Close(), logger)
-				}
+			if clientTLSConfigGenerator != nil {
+				clientTLSConfigGenerator.Close()
+			}
+			if healthCheckManager != nil {
+				warnOnErr(process.ExitContext(), healthCheckManager.Close(), logger)
+			}
+		} else {
+			logger.InfoContext(process.ExitContext(), "Shutting down gracefully")
+			ctx := payloadContext(payload)
+			if tsrv != nil {
+				warnOnErr(ctx, tsrv.DrainConnections(ctx), logger)
+			}
+			if sshProxy != nil {
+				warnOnErr(ctx, sshProxy.Shutdown(ctx), logger)
+			}
+			if sshGRPCServer != nil {
+				sshGRPCServer.GracefulStop()
+			}
+			if webServer != nil {
+				warnOnErr(ctx, webServer.Shutdown(ctx), logger)
+			}
+			if minimalWebServer != nil {
+				warnOnErr(ctx, minimalWebServer.Shutdown(ctx), logger)
+			}
+			if tsrv != nil {
+				warnOnErr(ctx, tsrv.Shutdown(ctx), logger)
+			}
+			if rcWatcher != nil {
+				warnOnErr(ctx, rcWatcher.Close(), logger)
+			}
+			if peerServer != nil {
+				warnOnErr(ctx, peerServer.Shutdown(), logger)
+			}
+			if peerQUICServer != nil {
+				warnOnErr(ctx, peerQUICServer.Shutdown(ctx), logger)
+			}
+			if peerClient != nil {
+				peerClient.Shutdown(ctx)
+			}
+			if kubeServer != nil {
+				warnOnErr(ctx, kubeServer.Shutdown(ctx), logger)
+			}
+			if grpcServerPublic != nil {
+				grpcServerPublic.GracefulStop()
+			}
+			if grpcServerMTLS != nil {
+				grpcServerMTLS.GracefulStop()
+			}
+			if alpnServer != nil {
+				warnOnErr(ctx, alpnServer.Close(), logger)
+			}
+			if reverseTunnelALPNServer != nil {
+				warnOnErr(ctx, reverseTunnelALPNServer.Close(), logger)
+			}
 
-				// Explicitly deleting proxy heartbeats helps the behavior of
-				// reverse tunnel agents during rollouts, as otherwise they'll keep
-				// trying to reach proxies until the heartbeats expire.
-				if services.ShouldDeleteServerHeartbeatsOnShutdown(ctx) {
-					if err := conn.Client.DeleteProxy(ctx, process.Config.HostUUID); err != nil {
-						if !trace.IsNotFound(err) {
-							logger.WarnContext(ctx, "Failed to delete heartbeat", "error", err)
-						} else {
-							logger.DebugContext(ctx, "Failed to delete heartbeat", "error", err)
-						}
+			// Explicitly deleting proxy heartbeats helps the behavior of
+			// reverse tunnel agents during rollouts, as otherwise they'll keep
+			// trying to reach proxies until the heartbeats expire.
+			if services.ShouldDeleteServerHeartbeatsOnShutdown(ctx) {
+				if err := conn.Client.DeleteProxy(ctx, conn.HostUUID()); err != nil {
+					if !trace.IsNotFound(err) {
+						logger.WarnContext(ctx, "Failed to delete heartbeat", "error", err)
+					} else {
+						logger.DebugContext(ctx, "Failed to delete heartbeat", "error", err)
 					}
 				}
+			}
 
-				if clientTLSConfigGenerator != nil {
-					clientTLSConfigGenerator.Close()
-				}
+			if clientTLSConfigGenerator != nil {
+				clientTLSConfigGenerator.Close()
 			}
-			if peerQUICTransport != nil {
-				_ = peerQUICTransport.Close()
-				_ = peerQUICTransport.Conn.Close()
+			if healthCheckManager != nil {
+				warnOnErr(process.ExitContext(), healthCheckManager.Close(), logger)
 			}
-			warnOnErr(process.ExitContext(), asyncEmitter.Close(), logger)
-			warnOnErr(process.ExitContext(), conn.Close(), logger)
-			logger.InfoContext(process.ExitContext(), "Exited")
-		})
-	}()
+		}
+		if peerQUICTransport != nil {
+			_ = peerQUICTransport.Close()
+			_ = peerQUICTransport.Conn.Close()
+		}
+		warnOnErr(process.ExitContext(), asyncEmitter.Close(), logger)
+		warnOnErr(process.ExitContext(), conn.Close(), logger)
+		logger.InfoContext(process.ExitContext(), "Exited")
+	})
 
 	// register SSH reverse tunnel server that accepts connections
 	// from remote teleport nodes
@@ -4699,7 +5067,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 			peerClient, err = peer.NewClient(peer.ClientConfig{
 				Context:           process.ExitContext(),
-				ID:                process.Config.HostUUID,
+				ID:                conn.HostUUID(),
 				AuthClient:        conn.Client,
 				AccessPoint:       accessPoint,
 				TLSCipherSuites:   cfg.CipherSuites,
@@ -4727,7 +5095,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 				Context:               process.ExitContext(),
 				Component:             teleport.Component(teleport.ComponentProxy, process.id),
-				ID:                    process.Config.HostUUID,
+				ID:                    conn.HostUUID(),
 				ClusterName:           clusterName,
 				Listener:              rtListener,
 				GetHostSigners:        conn.ServerGetHostSigners,
@@ -4757,6 +5125,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
+		process.tsrv = tsrv
 		process.RegisterCriticalFunc("proxy.reversetunnel.server", func() error {
 			logger.InfoContext(process.ExitContext(), "Starting reverse tunnel server", "version", teleport.Version, "git_ref", teleport.Gitref, "listen_address", cfg.Proxy.ReverseTunnelListenAddr.Addr, "cache_policy", process.Config.CachePolicy)
 			if err := tsrv.Start(); err != nil {
@@ -4783,7 +5152,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		router, err := proxy.NewRouter(proxy.RouterConfig{
 			ClusterName:      clusterName,
 			LocalAccessPoint: accessPoint,
-			SiteGetter:       tsrv,
+			ClusterGetter:    tsrv,
 			TracerProvider:   process.TracingProvider,
 			Logger:           process.logger.With(teleport.ComponentKey, "router"),
 		})
@@ -4794,12 +5163,6 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		proxyRouter = router
 	}
 
-	// read the host UUID:
-	serverID, err := hostid.ReadOrCreateFile(cfg.DataDir)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	sessionController, err := srv.NewSessionController(srv.SessionControllerConfig{
 		Semaphores:     accessPoint,
 		AccessPoint:    accessPoint,
@@ -4808,7 +5171,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		Component:      teleport.ComponentProxy,
 		Logger:         process.logger.With(teleport.ComponentKey, "sessionctrl"),
 		TracerProvider: process.TracingProvider,
-		ServerID:       serverID,
+		ServerID:       conn.HostUUID(),
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -4894,7 +5257,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			AccessPoint:    accessPoint,
 			LockWatcher:    lockWatcher,
 			Clock:          process.Clock,
-			ServerID:       cfg.HostUUID,
+			ServerID:       conn.HostUUID(),
 			Emitter:        asyncEmitter,
 			EmitterContext: process.GracefulExitContext(),
 			Logger:         process.logger,
@@ -4908,7 +5271,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			DataDir:           cfg.DataDir,
 			Emitter:           asyncEmitter,
 			Authorizer:        authorizer,
-			HostID:            cfg.HostUUID,
+			HostID:            conn.HostUUID(),
 			AuthClient:        conn.Client,
 			AccessPoint:       accessPoint,
 			TLSConfig:         serverTLSConfig,
@@ -4917,6 +5280,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			ServiceComponent:  teleport.ComponentWebProxy,
 			AWSConfigOptions: []awsconfig.OptionsFn{
 				awsconfig.WithOIDCIntegrationClient(conn.Client),
+				awsconfig.WithRolesAnywhereIntegrationClient(conn.Client),
 			},
 		})
 		if err != nil {
@@ -4936,19 +5300,40 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			return nil, trace.NotFound("no app found for endpoint %q", publicAddr)
 		})
 
+		if !cfg.Proxy.DisableTLS && cfg.Proxy.DisableALPNSNIListener {
+			listeners.tls, err = multiplexer.NewWebListener(multiplexer.WebListenerConfig{
+				Listener: tls.NewListener(listeners.web, tlsConfigWeb),
+			})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			listeners.web = listeners.tls.Web()
+			listeners.db.tls = listeners.tls.DB()
+
+			process.RegisterCriticalFunc("proxy.tls", func() error {
+				logger.InfoContext(process.ExitContext(), "TLS multiplexer is starting.", "listen_address", cfg.Proxy.WebAddr.Addr)
+				if err := listeners.tls.Serve(); !trace.IsConnectionProblem(err) {
+					logger.WarnContext(process.ExitContext(), "TLS multiplexer error.", "error", err)
+				}
+				logger.InfoContext(process.ExitContext(), "TLS multiplexer exited.")
+				return nil
+			})
+		}
+
 		webConfig := web.Config{
 			Proxy:                     tsrv,
 			AuthServers:               cfg.AuthServerAddresses()[0],
 			ProxyClient:               conn.Client,
 			ProxySSHAddr:              proxySSHAddr,
-			ProxyWebAddr:              cfg.Proxy.WebAddr,
+			ProxyWebAddr:              utils.FromAddr(listeners.web.Addr()),
 			ProxyPublicAddrs:          cfg.Proxy.PublicAddrs,
+			ProxyGroupID:              cfg.Proxy.ProxyGroupID,
 			CipherSuites:              cfg.CipherSuites,
 			FIPS:                      cfg.FIPS,
 			AccessPoint:               accessPoint,
 			Emitter:                   asyncEmitter,
 			PluginRegistry:            process.PluginRegistry,
-			HostUUID:                  process.Config.HostUUID,
+			HostUUID:                  conn.HostUUID(),
 			Context:                   process.GracefulExitContext(),
 			StaticFS:                  fs,
 			ClusterFeatures:           process.GetClusterFeatures(),
@@ -4974,29 +5359,10 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			FeatureWatchInterval:      retryutils.HalfJitter(web.DefaultFeatureWatchInterval * 2),
 			DatabaseREPLRegistry:      cfg.DatabaseREPLRegistry,
 		}
-		webHandler, err := web.NewHandler(webConfig)
+		webHandler, err := web.NewHandler(webConfig, web.SetClock(process.Clock))
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		if !cfg.Proxy.DisableTLS && cfg.Proxy.DisableALPNSNIListener {
-			listeners.tls, err = multiplexer.NewWebListener(multiplexer.WebListenerConfig{
-				Listener: tls.NewListener(listeners.web, tlsConfigWeb),
-			})
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			listeners.web = listeners.tls.Web()
-			listeners.db.tls = listeners.tls.DB()
-
-			process.RegisterCriticalFunc("proxy.tls", func() error {
-				logger.InfoContext(process.ExitContext(), "TLS multiplexer is starting.", "listen_address", cfg.Proxy.WebAddr.Addr)
-				if err := listeners.tls.Serve(); !trace.IsConnectionProblem(err) {
-					logger.WarnContext(process.ExitContext(), "TLS multiplexer error.", "error", err)
-				}
-				logger.InfoContext(process.ExitContext(), "TLS multiplexer exited.")
-				return nil
-			})
-		}
 
 		webServer, err = web.NewServer(web.ServerConfig{
 			Server: &http.Server{
@@ -5045,11 +5411,16 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 	// Register ALPN handler that will be accepting connections for plain
 	// TCP applications.
+	// Use the same handler for MCP protocols, for now.
 	if alpnRouter != nil {
 		alpnRouter.Add(alpnproxy.HandlerDecs{
 			MatchFunc: alpnproxy.MatchByProtocol(alpncommon.ProtocolTCP),
 			Handler:   webServer.HandleConnection,
 		})
+		alpnRouter.Add(alpnproxy.HandlerDecs{
+			MatchFunc: alpnproxy.MatchByProtocol(alpncommon.ProtocolMCP),
+			Handler:   webServer.HandleConnection,
+		})
 	}
 
 	var peerAddrString string
@@ -5155,6 +5526,8 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		"",
 		process.proxyPublicAddr(),
 		conn.Client,
+		regular.SetChildLogConfig(cfg),
+		regular.SetUUID(conn.HostUUID()),
 		regular.SetLimiter(proxyLimiter),
 		regular.SetProxyMode(peerAddrString, tsrv, accessPoint, proxyRouter),
 		regular.SetCiphers(cfg.Ciphers),
@@ -5181,13 +5554,21 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		return trace.Wrap(err)
 	}
 
-	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
-		ClusterName:   clusterName,
-		AccessPoint:   accessPoint,
-		LockWatcher:   lockWatcher,
-		Logger:        process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentReverseTunnelServer, process.id)),
-		PermitCaching: process.Config.CachePolicy.Enabled,
-	})
+	authorizerOpts := authz.AuthorizerOpts{
+		ClusterName:      clusterName,
+		AccessPoint:      accessPoint,
+		ScopedRoleReader: accessPoint.ScopedRoleReader(),
+		LockWatcher:      lockWatcher,
+		Logger:           process.logger.With(teleport.ComponentKey, teleport.Component(teleport.ComponentReverseTunnelServer, process.id)),
+		PermitCaching:    process.Config.CachePolicy.Enabled,
+	}
+
+	authorizer, err := authz.NewAuthorizer(authorizerOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	scopedAuthorizer, err := authz.NewScopedAuthorizer(authorizerOpts)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -5217,12 +5598,17 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	process.OnExit("tls.config.generator", func(a any) {
+		clientTLSConfigGenerator.Close()
+	})
+
 	sshGRPCTLSConfig.GetConfigForClient = clientTLSConfigGenerator.GetConfigForClient
 
 	sshGRPCCreds, err := auth.NewTransportCredentials(auth.TransportCredentialsConfig{
 		TransportCredentials: credentials.NewTLS(sshGRPCTLSConfig),
 		UserGetter:           authMiddleware,
 		Authorizer:           authorizer,
+		ScopedAuthorizer:     scopedAuthorizer,
 		GetAuthPreference:    accessPoint.GetAuthPreference,
 	})
 	if err != nil {
@@ -5230,17 +5616,12 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 	}
 
 	sshGRPCServer = grpc.NewServer(
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
 		grpc.ChainUnaryInterceptor(
 			interceptors.GRPCServerUnaryErrorInterceptor,
-			//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-			// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-			otelgrpc.UnaryServerInterceptor(),
 		),
 		grpc.ChainStreamInterceptor(
 			interceptors.GRPCServerStreamErrorInterceptor,
-			//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-			// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-			otelgrpc.StreamServerInterceptor(),
 		),
 		grpc.Creds(sshGRPCCreds),
 		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
@@ -5250,7 +5631,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		AccessPoint:    accessPoint,
 		LockWatcher:    lockWatcher,
 		Clock:          process.Clock,
-		ServerID:       serverID,
+		ServerID:       conn.HostUUID(),
 		Emitter:        asyncEmitter,
 		EmitterContext: process.ExitContext(),
 		Logger:         process.logger,
@@ -5263,8 +5644,15 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		FIPS:   cfg.FIPS,
 		Logger: process.logger.With(teleport.ComponentKey, "transport"),
 		Dialer: proxyRouter,
-		SignerFn: func(authzCtx *authz.Context, clusterName string) agentless.SignerCreator {
-			return agentless.SignerFromAuthzContext(authzCtx, accessPoint, clusterName)
+		SignerFn: func(authzCtx *authz.ScopedContext, clusterName string) agentless.SignerCreator {
+			if unscopedCtx, ok := authzCtx.UnscopedContext(); ok {
+				return agentless.SignerFromAuthzContext(unscopedCtx, accessPoint, clusterName)
+			}
+
+			return func(ctx context.Context, localAccessPoint agentless.LocalAccessPoint, certGen agentless.CertGenerator) (ssh.Signer, error) {
+				// TODO(fspamarshall/scopes): implement agentless transport signer for scoped identities
+				return nil, trace.NotImplemented("agentless transport signer is not implemented for scoped identities")
+			}
 		},
 		ConnectionMonitor: connMonitor,
 		LocalAddr:         listeners.sshGRPC.Addr(),
@@ -5356,6 +5744,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 		// Register TLS endpoint of the Kube proxy service
 		component := teleport.Component(teleport.ComponentProxy, teleport.ComponentProxyKube)
+
 		kubeServiceType := kubeproxy.ProxyService
 		if cfg.Proxy.Kube.LegacyKubeProxy {
 			kubeServiceType = kubeproxy.LegacyProxyService
@@ -5376,6 +5765,22 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			return trace.Wrap(err)
 		}
 
+		// Create a health check manager.
+		healthCheckManager, err = healthcheck.NewManager(
+			process.ExitContext(),
+			healthcheck.ManagerConfig{
+				Component:               component,
+				Events:                  accessPoint,
+				HealthCheckConfigReader: accessPoint,
+			},
+		)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if err := healthCheckManager.Start(process.ExitContext()); err != nil {
+			return trace.Wrap(err)
+		}
+
 		kubeServer, err = kubeproxy.NewTLSServer(kubeproxy.TLSServerConfig{
 			ForwarderConfig: kubeproxy.ForwarderConfig{
 				Namespace:                     apidefaults.Namespace,
@@ -5387,7 +5792,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 				Emitter:                       asyncEmitter,
 				DataDir:                       cfg.DataDir,
 				CachingAuthClient:             accessPoint,
-				HostID:                        cfg.HostUUID,
+				HostID:                        conn.HostUUID(),
 				ClusterOverride:               cfg.Proxy.Kube.ClusterOverride,
 				KubeconfigPath:                cfg.Proxy.Kube.KubeconfigPath,
 				Component:                     component,
@@ -5415,6 +5820,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			KubernetesServersWatcher: kubeServerWatcher,
 			PROXYProtocolMode:        cfg.Proxy.PROXYProtocolMode,
 			InventoryHandle:          process.inventoryHandle,
+			HealthCheckManager:       healthCheckManager,
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -5465,7 +5871,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			AccessPoint:    accessPoint,
 			LockWatcher:    lockWatcher,
 			Clock:          process.Config.Clock,
-			ServerID:       process.Config.HostUUID,
+			ServerID:       conn.HostUUID(),
 			Emitter:        asyncEmitter,
 			EmitterContext: process.ExitContext(),
 			Logger:         process.logger,
@@ -5647,6 +6053,11 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		}
 	}
 
+	process.RegisterFunc("update.aws-oidc.deploy.service", func() error {
+		err := process.initAWSOIDCDeployServiceUpdater(process.Config.Proxy.AutomaticUpgradesChannels, accessPoint)
+		return trace.Wrap(err)
+	})
+
 	return nil
 }
 
@@ -5759,10 +6170,10 @@ func (process *TeleportProcess) setupProxyTLSConfig(conn *Connector, tsrv revers
 			return nil, trace.ConvertSystemError(err)
 		}
 		hostChecker, err := newHostPolicyChecker(hostPolicyCheckerConfig{
-			publicAddrs: process.Config.Proxy.PublicAddrs,
-			clt:         conn.Client,
-			tun:         tsrv,
-			clusterName: conn.ClusterName(),
+			publicAddrs:   process.Config.Proxy.PublicAddrs,
+			clt:           conn.Client,
+			clusterGetter: tsrv,
+			clusterName:   conn.ClusterName(),
 		})
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -5788,10 +6199,10 @@ func (process *TeleportProcess) setupProxyTLSConfig(conn *Connector, tsrv revers
 		}
 		utils.SetupTLSConfig(tlsConfig, cfg.CipherSuites)
 	} else {
-		certReloader := NewCertReloader(CertReloaderConfig{
+		certReloader := certreloader.New(certreloader.Config{
 			KeyPairs:               process.Config.Proxy.KeyPairs,
 			KeyPairsReloadInterval: process.Config.Proxy.KeyPairsReloadInterval,
-		})
+		}, slog.With(teleport.ComponentKey, teleport.Component(teleport.ComponentProxy), "name", "proxytls"), nil)
 		if err := certReloader.Run(process.ExitContext()); err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -5841,7 +6252,7 @@ func (process *TeleportProcess) setupTLSConfigClientCAGeneratorForCluster(tlsCon
 		return trace.Wrap(err)
 	}
 
-	process.OnExit("closer", func(payload interface{}) {
+	process.OnExit("tls.config.generator", func(payload any) {
 		generator.Close()
 	})
 
@@ -6006,6 +6417,10 @@ func (process *TeleportProcess) registerExpectedServices(cfg *servicecfg.Config)
 		process.SetExpectedInstanceRole(types.RoleProxy, ProxyIdentityEvent)
 	}
 
+	if cfg.Relay.Enabled {
+		process.SetExpectedInstanceRole(types.RoleRelay, RelayIdentityEvent)
+	}
+
 	if cfg.Kube.Enabled {
 		process.SetExpectedInstanceRole(types.RoleKube, KubeIdentityEvent)
 	}
@@ -6042,6 +6457,7 @@ func (process *TeleportProcess) initApps() {
 	// "app_service" section, that is considered enabling "app_service".
 	if len(process.Config.Apps.Apps) == 0 &&
 		!process.Config.Apps.DebugApp &&
+		!process.Config.Apps.MCPDemoServer &&
 		len(process.Config.Apps.ResourceMatchers) == 0 {
 		return
 	}
@@ -6127,7 +6543,7 @@ func (process *TeleportProcess) initApps() {
 		// Loop over each application and create a server.
 		var applications types.Apps
 		for _, app := range process.Config.Apps.Apps {
-			publicAddr, err := getPublicAddr(accessPoint, app)
+			publicAddr, err := getPublicAddr(process.ExitContext(), accessPoint, app)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -6170,14 +6586,27 @@ func (process *TeleportProcess) initApps() {
 				UseAnyProxyPublicAddr: app.UseAnyProxyPublicAddr,
 				CORS:                  makeApplicationCORS(app.CORS),
 				TCPPorts:              makeApplicationTCPPorts(app.TCPPorts),
+				MCP:                   app.MCP,
 			})
 			if err != nil {
 				return trace.Wrap(err)
 			}
 
+			if err := services.ValidateApp(a, accessPoint); err != nil {
+				return trace.Wrap(err)
+			}
+
 			applications = append(applications, a)
 		}
 
+		if process.Config.Apps.MCPDemoServer {
+			if mcpDemoServer, err := mcp.NewDemoServerApp(); err != nil {
+				logger.ErrorContext(process.ExitContext(), "Failed to create MCP demo server app")
+			} else {
+				applications = append(applications, mcpDemoServer)
+			}
+		}
+
 		lockWatcher, err := services.NewLockWatcher(process.ExitContext(), services.LockWatcherConfig{
 			ResourceWatcherConfig: services.ResourceWatcherConfig{
 				Component: teleport.ComponentApp,
@@ -6224,7 +6653,7 @@ func (process *TeleportProcess) initApps() {
 			AccessPoint:         accessPoint,
 			LockWatcher:         lockWatcher,
 			Clock:               process.Config.Clock,
-			ServerID:            process.Config.HostUUID,
+			ServerID:            conn.HostUUID(),
 			Emitter:             asyncEmitter,
 			EmitterContext:      process.ExitContext(),
 			Logger:              process.logger,
@@ -6242,11 +6671,12 @@ func (process *TeleportProcess) initApps() {
 			Authorizer:        authorizer,
 			TLSConfig:         tlsConfig,
 			CipherSuites:      process.Config.CipherSuites,
-			HostID:            process.Config.HostUUID,
+			HostID:            conn.HostUUID(),
 			Emitter:           asyncEmitter,
 			ConnectionMonitor: connMonitor,
 			ServiceComponent:  teleport.ComponentApp,
 			Logger:            logger,
+			MCPDemoServer:     process.Config.Apps.MCPDemoServer,
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -6256,7 +6686,7 @@ func (process *TeleportProcess) initApps() {
 			Clock:                process.Config.Clock,
 			AuthClient:           conn.Client,
 			AccessPoint:          accessPoint,
-			HostID:               process.Config.HostUUID,
+			HostID:               conn.HostUUID(),
 			Hostname:             process.Config.Hostname,
 			GetRotation:          process.GetRotation,
 			Apps:                 applications,
@@ -6362,9 +6792,10 @@ func (process *TeleportProcess) initAuthStorage() (backend.Backend, error) {
 	}
 
 	reporter, err := backend.NewReporter(backend.ReporterConfig{
-		Component: teleport.ComponentBackend,
-		Backend:   backend.NewSanitizer(bk),
-		Tracer:    process.TracingProvider.Tracer(teleport.ComponentBackend),
+		Component:  teleport.ComponentBackend,
+		Backend:    backend.NewSanitizer(bk),
+		Tracer:     process.TracingProvider.Tracer(teleport.ComponentBackend),
+		Registerer: process.metricsRegistry,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -6395,24 +6826,45 @@ func (process *TeleportProcess) WaitWithContext(ctx context.Context) {
 // StartShutdown launches non-blocking graceful shutdown process that signals
 // completion, returns context that will be closed once the shutdown is done
 func (process *TeleportProcess) StartShutdown(ctx context.Context) context.Context {
-	// by the time we get here we've already extracted the parent pipe, which is
-	// the only potential imported file descriptor that's not a listening
-	// socket, so closing every imported FD with a prefix of "" will close all
-	// imported listeners that haven't been used so far
-	warnOnErr(process.ExitContext(), process.closeImportedDescriptors(""), process.logger)
-	warnOnErr(process.ExitContext(), process.stopListeners(), process.logger)
+	shutdownDelayTimer := process.Clock.NewTimer(process.Config.ShutdownDelay)
+	defer shutdownDelayTimer.Stop()
 
 	hasChildren := process.forkedTeleportCount.Load() > 0
+	if hasChildren {
+		ctx = services.ProcessForkedContext(ctx)
+	}
+
+	process.BroadcastEvent(Event{Name: TeleportTerminatingEvent})
+
 	if process.inventoryHandle != nil {
 		deleteResources := !hasChildren
 		if err := process.inventoryHandle.SetAndSendGoodbye(ctx, deleteResources, hasChildren); err != nil {
 			process.logger.WarnContext(process.ExitContext(), "Failed sending inventory goodbye during shutdown", "error", err)
 		}
 	}
-	if hasChildren {
-		ctx = services.ProcessForkedContext(ctx)
+
+	if d := process.Config.ShutdownDelay; d > 0 {
+		if hasChildren {
+			process.logger.InfoContext(ctx, "Ignoring shutdown delay due to the presence of forked processes")
+		} else {
+			process.logger.InfoContext(ctx, "Waiting for shutdown delay", "shutdown_delay", d.String())
+			select {
+			case <-shutdownDelayTimer.Chan():
+			case <-process.ExitContext().Done():
+				process.logger.WarnContext(ctx, "Skipping shutdown delay early due to process exit")
+			case <-ctx.Done():
+				process.logger.WarnContext(ctx, "Skipping shutdown delay early due to context cancellation")
+			}
+		}
 	}
 
+	// by the time we get here we've already extracted the parent pipe, which is
+	// the only potential imported file descriptor that's not a listening
+	// socket, so closing every imported FD with a prefix of "" will close all
+	// imported listeners that haven't been used so far
+	warnOnErr(process.ExitContext(), process.closeImportedDescriptors(""), process.logger)
+	warnOnErr(process.ExitContext(), process.stopListeners(), process.logger)
+
 	process.BroadcastEvent(Event{Name: TeleportExitEvent, Payload: ctx})
 	localCtx, cancel := context.WithCancel(ctx)
 	go func() {
@@ -6453,6 +6905,9 @@ func (process *TeleportProcess) Shutdown(ctx context.Context) {
 
 // Close broadcasts close signals and exits immediately
 func (process *TeleportProcess) Close() error {
+	// generate a TeleportTerminatingEvent to unblock any service waiting on
+	// that event before TeleportExitEvent
+	process.BroadcastEvent(Event{Name: TeleportTerminatingEvent})
 	process.BroadcastEvent(Event{Name: TeleportExitEvent})
 
 	var errors []error
@@ -6623,7 +7078,7 @@ func dumperHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 // getPublicAddr waits for a proxy to be registered with Teleport.
-func getPublicAddr(authClient authclient.ReadAppsAccessPoint, a servicecfg.App) (string, error) {
+func getPublicAddr(ctx context.Context, authClient authclient.ReadAppsAccessPoint, a servicecfg.App) (string, error) {
 	ticker := time.NewTicker(500 * time.Millisecond)
 	defer ticker.Stop()
 	timeout := time.NewTimer(5 * time.Second)
@@ -6632,8 +7087,7 @@ func getPublicAddr(authClient authclient.ReadAppsAccessPoint, a servicecfg.App)
 	for {
 		select {
 		case <-ticker.C:
-			publicAddr, err := app.FindPublicAddr(authClient, a.PublicAddr, a.Name)
-
+			publicAddr, err := app.FindPublicAddr(ctx, authClient, a.PublicAddr, a.Name)
 			if err == nil {
 				return publicAddr, nil
 			}
@@ -6653,158 +7107,6 @@ func newHTTPFileSystem() (http.FileSystem, error) {
 	return fs, nil
 }
 
-// readOrGenerateHostID tries to read the `host_uuid` from Kubernetes storage (if available) or local storage.
-// If the read operation returns no `host_uuid`, this function tries to pick it from the first static identity provided.
-// If no static identities were defined for the process, a new id is generated depending on the joining process:
-// - types.JoinMethodEC2: we will use the EC2 NodeID: {accountID}-{nodeID}
-// - Any other valid Joining method: a new UUID is generated.
-// Finally, if a new id is generated, this function writes it into local storage and Kubernetes storage (if available).
-// If kubeBackend is nil, the agent is not running in a Kubernetes Cluster.
-func readOrGenerateHostID(ctx context.Context, cfg *servicecfg.Config, kubeBackend kubernetesBackend) (err error) {
-	// Load `host_uuid` from different storages. If this process is running in a Kubernetes Cluster,
-	// readHostUUIDFromStorages will try to read the `host_uuid` from the Kubernetes Secret. If the
-	// key is empty or if not running in a Kubernetes Cluster, it will read the
-	// `host_uuid` from local data directory.
-	cfg.HostUUID, err = readHostIDFromStorages(ctx, cfg.DataDir, kubeBackend)
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			if errors.Is(err, fs.ErrPermission) {
-				cfg.Logger.ErrorContext(ctx, "Teleport does not have permission to write to the data directory. Ensure that you are running as a user with appropriate permissions.", "data_dir", cfg.DataDir)
-			}
-			return trace.Wrap(err)
-		}
-		// if there's no host uuid initialized yet, try to read one from the
-		// one of the identities
-		if len(cfg.Identities) != 0 {
-			cfg.HostUUID = cfg.Identities[0].ID.HostUUID
-			cfg.Logger.InfoContext(ctx, "Taking host UUID from first identity.", "host_uuid", cfg.HostUUID)
-		} else {
-			switch cfg.JoinMethod {
-			case types.JoinMethodToken,
-				types.JoinMethodUnspecified,
-				types.JoinMethodAzureDevops,
-				types.JoinMethodIAM,
-				types.JoinMethodCircleCI,
-				types.JoinMethodKubernetes,
-				types.JoinMethodGitHub,
-				types.JoinMethodGitLab,
-				types.JoinMethodAzure,
-				types.JoinMethodGCP,
-				types.JoinMethodTPM,
-				types.JoinMethodTerraformCloud,
-				types.JoinMethodOracle:
-				// Checking error instead of the usual uuid.New() in case uuid generation
-				// fails due to not enough randomness. It's been known to happen happen when
-				// Teleport starts very early in the node initialization cycle and /dev/urandom
-				// isn't ready yet.
-				rawID, err := uuid.NewRandom()
-				if err != nil {
-					return trace.BadParameter("" +
-						"Teleport failed to generate host UUID. " +
-						"This may happen if randomness source is not fully initialized when the node is starting up. " +
-						"Please try restarting Teleport again.")
-				}
-				cfg.HostUUID = rawID.String()
-			case types.JoinMethodEC2:
-				cfg.HostUUID, err = utils.GetEC2NodeID(ctx)
-				if err != nil {
-					return trace.Wrap(err)
-				}
-			default:
-				return trace.BadParameter("unknown join method %q", cfg.JoinMethod)
-			}
-			cfg.Logger.InfoContext(ctx, "Generating new host UUID", "host_uuid", cfg.HostUUID)
-		}
-		// persistHostUUIDToStorages will persist the host_uuid to the local storage
-		// and to Kubernetes Secret if this process is running on a Kubernetes Cluster.
-		if err := persistHostIDToStorages(ctx, cfg, kubeBackend); err != nil {
-			return trace.Wrap(err)
-		}
-	} else if kubeBackend != nil && hostid.ExistsLocally(cfg.DataDir) {
-		// This case is used when loading a Teleport pre-11 agent with storage attached.
-		// In this case, we have to copy the "host_uuid" from the agent to the secret
-		// in case storage is removed later.
-		// loadHostIDFromKubeSecret will check if the `host_uuid` is already in the secret.
-		if id, err := loadHostIDFromKubeSecret(ctx, kubeBackend); err != nil || len(id) == 0 {
-			// Forces the copy of the host_uuid into the Kubernetes Secret if PV storage is enabled.
-			// This is only required if PV storage is removed later.
-			if err := writeHostIDToKubeSecret(ctx, kubeBackend, cfg.HostUUID); err != nil {
-				return trace.Wrap(err)
-			}
-		}
-	}
-	return nil
-}
-
-// kubernetesBackend interface for kube storage backend.
-type kubernetesBackend interface {
-	// Put puts value into backend (creates if it does not
-	// exists, updates it otherwise)
-	Put(ctx context.Context, i backend.Item) (*backend.Lease, error)
-	// Get returns a single item or not found error
-	Get(ctx context.Context, key backend.Key) (*backend.Item, error)
-}
-
-// readHostIDFromStorages tries to read the `host_uuid` value from different storages,
-// depending on where the process is running.
-// If the process is running in a Kubernetes Cluster, this function will attempt
-// to read the `host_uuid` from the Kubernetes Secret. If it does not exist or
-// if it is not running on a Kubernetes cluster the read is done from the local
-// storage: `dataDir/host_uuid`.
-func readHostIDFromStorages(ctx context.Context, dataDir string, kubeBackend kubernetesBackend) (string, error) {
-	if kubeBackend != nil {
-		if hostID, err := loadHostIDFromKubeSecret(ctx, kubeBackend); err == nil && len(hostID) > 0 {
-			return hostID, nil
-		}
-	}
-	// Even if running in Kubernetes fallback to local storage if `host_uuid` was
-	// not found in secret.
-	hostID, err := hostid.ReadFile(dataDir)
-	return hostID, trace.Wrap(err)
-}
-
-// persistHostIDToStorages writes the cfg.HostUUID to local data and to
-// Kubernetes Secret if this process is running on a Kubernetes Cluster.
-func persistHostIDToStorages(ctx context.Context, cfg *servicecfg.Config, kubeBackend kubernetesBackend) error {
-	if err := hostid.WriteFile(cfg.DataDir, cfg.HostUUID); err != nil {
-		if errors.Is(err, fs.ErrPermission) {
-			cfg.Logger.ErrorContext(ctx, "Teleport does not have permission to write to the data directory. Ensure that you are running as a user with appropriate permissions.", "data_dir", cfg.DataDir)
-		}
-		return trace.Wrap(err)
-	}
-
-	// Persists the `host_uuid` into Kubernetes Secret for later reusage.
-	// This is required because `host_uuid` is part of the client secret
-	// and Auth connection will fail if we present a different `host_uuid`.
-	if kubeBackend != nil {
-		return trace.Wrap(writeHostIDToKubeSecret(ctx, kubeBackend, cfg.HostUUID))
-	}
-	return nil
-}
-
-// loadHostIDFromKubeSecret reads the host_uuid from the Kubernetes secret with
-// the expected key: `/host_uuid`.
-func loadHostIDFromKubeSecret(ctx context.Context, kubeBackend kubernetesBackend) (string, error) {
-	item, err := kubeBackend.Get(ctx, backend.NewKey(hostid.FileName))
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return string(item.Value), nil
-}
-
-// writeHostIDToKubeSecret writes the `host_uuid` into the Kubernetes secret under
-// the key `/host_uuid`.
-func writeHostIDToKubeSecret(ctx context.Context, kubeBackend kubernetesBackend, id string) error {
-	_, err := kubeBackend.Put(
-		ctx,
-		backend.Item{
-			Key:   backend.NewKey(hostid.FileName),
-			Value: []byte(id),
-		},
-	)
-	return trace.Wrap(err)
-}
-
 // initPublicGRPCServer creates and registers a gRPC server that does not use client
 // certificates for authentication. This is used by the join service, which nodes
 // use to receive a signed certificate from the auth server.
@@ -6814,6 +7116,7 @@ func (process *TeleportProcess) initPublicGRPCServer(
 	listener net.Listener,
 ) (*grpc.Server, error) {
 	server := grpc.NewServer(
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
 		grpc.ChainUnaryInterceptor(
 			interceptors.GRPCServerUnaryErrorInterceptor,
 			limiter.UnaryServerInterceptor(),
@@ -6841,9 +7144,11 @@ func (process *TeleportProcess) initPublicGRPCServer(
 		}),
 		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
 	)
-	joinServiceServer := joinserver.NewJoinServiceGRPCServer(conn.Client)
+	joinServiceServer := legacyjoin.NewJoinServiceGRPCServer(conn.Client)
 	proto.RegisterJoinServiceServer(server, joinServiceServer)
 
+	joinv1.RegisterProxyForwardingJoinServiceServer(server, conn.Client.JoinV1Client())
+
 	accessGraphProxySvc, err := secretsscannerproxy.New(
 		secretsscannerproxy.ServiceConfig{
 			AuthClient: conn.Client,
@@ -6910,6 +7215,7 @@ func (process *TeleportProcess) initSecureGRPCServer(cfg initSecureGRPCServerCfg
 	}
 
 	server := grpc.NewServer(
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
 		grpc.ChainUnaryInterceptor(authMiddleware.UnaryInterceptors()...),
 		grpc.ChainStreamInterceptor(authMiddleware.StreamInterceptors()...),
 		grpc.Creds(creds),
@@ -7032,35 +7338,3 @@ func (process *TeleportProcess) newExternalAuditStorageConfigurator() (*external
 	statusService := local.NewStatusService(process.backend)
 	return externalauditstorage.NewConfigurator(process.ExitContext(), easSvc, integrationSvc, statusService)
 }
-
-// createLockedPIDFile creates a PID file in the path specified by pidFile
-// containing the current PID, atomically swapping it in the final place and
-// leaving it with an exclusive advisory lock that will get released when the
-// process ends, for the benefit of "pkill -L".
-func createLockedPIDFile(pidFile string) error {
-	pending, err := renameio.NewPendingFile(pidFile, renameio.WithPermissions(0o644))
-	if err != nil {
-		return trace.ConvertSystemError(err)
-	}
-	defer pending.Cleanup()
-	if _, err := fmt.Fprintf(pending, "%v\n", os.Getpid()); err != nil {
-		return trace.ConvertSystemError(err)
-	}
-
-	const minimumDupFD = 3 // skip stdio
-	locker, err := unix.FcntlInt(pending.Fd(), unix.F_DUPFD_CLOEXEC, minimumDupFD)
-	runtime.KeepAlive(pending)
-	if err != nil {
-		return trace.ConvertSystemError(err)
-	}
-	if err := unix.Flock(locker, unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		_ = unix.Close(locker)
-		return trace.ConvertSystemError(err)
-	}
-	// deliberately leak the fd to hold the lock until the process dies
-
-	if err := pending.CloseAtomicallyReplace(); err != nil {
-		return trace.ConvertSystemError(err)
-	}
-	return nil
-}
diff --git a/lib/service/service_test.go b/lib/service/service_test.go
index b7bd9663856ea..abb50ff7cdf68 100644
--- a/lib/service/service_test.go
+++ b/lib/service/service_test.go
@@ -58,9 +58,8 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/state"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/backend/memory"
@@ -71,17 +70,19 @@ import (
 	"github.com/gravitational/teleport/lib/integrations/externalauditstorage"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/multiplexer"
+	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/hostid"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
 	os.Exit(m.Run())
 }
@@ -292,8 +293,11 @@ func TestMonitor(t *testing.T) {
 	require.NoError(t, err)
 
 	// this simulates events that happened to be broadcast before the
-	// readyz.monitor started listening for events
+	// process was started
+	process.ExpectService("dummy")
+	process.ExpectService(teleport.ComponentAuth)
 	process.BroadcastEvent(Event{Name: TeleportOKEvent, Payload: teleport.ComponentAuth})
+	process.BroadcastEvent(Event{Name: TeleportOKEvent, Payload: "dummy"})
 
 	require.NoError(t, process.Start())
 	t.Cleanup(func() {
@@ -387,10 +391,12 @@ func TestMonitor(t *testing.T) {
 func TestServiceCheckPrincipals(t *testing.T) {
 	// Create a test auth server to extract the server identity (SSH and TLS
 	// certificates).
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
 	tlsServer, err := testAuthServer.NewTestTLSServer()
 	require.NoError(t, err)
 	defer tlsServer.Close()
@@ -501,7 +507,7 @@ func TestServiceInitExternalLog(t *testing.T) {
 
 func TestAthenaAuditLogSetup(t *testing.T) {
 	ctx := context.Background()
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud: true,
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -520,7 +526,7 @@ func TestAthenaAuditLogSetup(t *testing.T) {
 			exitContext: context.Background(),
 		},
 		backend: backend,
-		logger:  utils.NewSlogLoggerForTests(),
+		logger:  logtest.NewLogger(),
 	}
 
 	integrationSvc, err := local.NewIntegrationsService(backend)
@@ -629,7 +635,6 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 	p := &TeleportProcess{
 		Config: &servicecfg.Config{
 			Hostname:    "global-hostname",
-			HostUUID:    "global-uuid",
 			AdvertiseIP: "1.2.3.4",
 			Proxy: servicecfg.ProxyConfig{
 				PublicAddrs:         utils.MustParseAddrList("proxy-public-1", "proxy-public-2"),
@@ -773,7 +778,7 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.role.String(), func(t *testing.T) {
-			principals, dns, err := p.getAdditionalPrincipals(tt.role)
+			principals, dns, err := p.getAdditionalPrincipals(tt.role, "global-uuid")
 			require.NoError(t, err)
 			require.Empty(t, cmp.Diff(principals, tt.wantPrincipals))
 			require.Empty(t, cmp.Diff(dns, tt.wantDNS, cmpopts.EquateEmpty()))
@@ -831,6 +836,7 @@ func TestSetupProxyTLSConfig(t *testing.T) {
 				"h2",
 				"acme-tls/1",
 				"teleport-tcp-ping",
+				"teleport-mcp-ping",
 				"teleport-postgres-ping",
 				"teleport-mysql-ping",
 				"teleport-mongodb-ping",
@@ -851,6 +857,7 @@ func TestSetupProxyTLSConfig(t *testing.T) {
 				"teleport-proxy-ssh-grpc",
 				"teleport-proxy-grpc",
 				"teleport-proxy-grpc-mtls",
+				"teleport-mcp",
 				"teleport-postgres",
 				"teleport-mysql",
 				"teleport-mongodb",
@@ -871,6 +878,7 @@ func TestSetupProxyTLSConfig(t *testing.T) {
 			acmeEnabled: false,
 			wantNextProtos: []string{
 				"teleport-tcp-ping",
+				"teleport-mcp-ping",
 				"teleport-postgres-ping",
 				"teleport-mysql-ping",
 				"teleport-mongodb-ping",
@@ -894,6 +902,7 @@ func TestSetupProxyTLSConfig(t *testing.T) {
 				"teleport-proxy-ssh-grpc",
 				"teleport-proxy-grpc",
 				"teleport-proxy-grpc-mtls",
+				"teleport-mcp",
 				"teleport-postgres",
 				"teleport-mysql",
 				"teleport-mongodb",
@@ -918,10 +927,12 @@ func TestSetupProxyTLSConfig(t *testing.T) {
 			cfg.Proxy.ACME.Enabled = tc.acmeEnabled
 			cfg.DataDir = makeTempDir(t)
 			cfg.Proxy.PublicAddrs = utils.MustParseAddrList("localhost")
+			supervisor, err := NewSupervisor("process-id", cfg.Logger, cfg.Clock)
+			require.NoError(t, err)
 			process := TeleportProcess{
 				Config: cfg,
 				// Setting Supervisor so that `ExitContext` can be called.
-				Supervisor: NewSupervisor("process-id", cfg.Logger),
+				Supervisor: supervisor,
 			}
 			tls, err := process.setupProxyTLSConfig(
 				&Connector{},
@@ -945,12 +956,12 @@ func TestTeleportProcess_reconnectToAuth(t *testing.T) {
 	cfg.Auth.Enabled = false
 	cfg.Proxy.Enabled = false
 	cfg.SSH.Enabled = true
-	cfg.MaxRetryPeriod = 5 * time.Millisecond
+	cfg.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(5 * time.Millisecond)
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.Testing.ConnectFailureC = make(chan time.Duration, 5)
 	cfg.Testing.ClientTimeout = time.Millisecond
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	process, err := NewTeleport(cfg)
 	require.NoError(t, err)
 
@@ -958,13 +969,15 @@ func TestTeleportProcess_reconnectToAuth(t *testing.T) {
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		c, err := process.reconnectToAuthService(types.RoleAdmin)
+		// This test must use RoleInstance because all other roles wait for the
+		// Instance connector without a timeout.
+		c, err := process.reconnectToAuthService(types.RoleInstance)
 		require.Equal(t, ErrTeleportExited, err)
 		require.Nil(t, c)
 	}()
 
 	timeout := time.After(10 * time.Second)
-	step := cfg.MaxRetryPeriod / 5.0
+	step := cfg.AuthConnectionConfig.BackoffStepDuration
 	for i := 0; i < 5; i++ {
 		// wait for connection to fail
 		select {
@@ -985,6 +998,169 @@ func TestTeleportProcess_reconnectToAuth(t *testing.T) {
 	wg.Wait()
 }
 
+// TestInstanceSelfRepair tests a node that first starts up with only the Proxy
+// service and joins the cluster with a token valid only for role Proxy, and
+// then restarts with the SSH service now enabled and a token valid only for
+// role Node. The instance identity should self-repair on the second startup to
+// get a certificate with both the Proxy and Node system roles.
+func TestInstanceSelfRepair(t *testing.T) {
+	// Setup: create an auth server with two tokens, one proxy proxies and one for nodes.
+	const clusterName = "testcluster"
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		Dir:         makeTempDir(t),
+		ClusterName: clusterName,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
+
+	tlsServer, err := testAuthServer.NewTestTLSServer()
+	require.NoError(t, err)
+	defer tlsServer.Close()
+
+	proxyToken, err := types.NewProvisionTokenFromSpec("proxytoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{types.RoleProxy},
+	})
+	require.NoError(t, err)
+	require.NoError(t, testAuthServer.AuthServer.UpsertToken(t.Context(), proxyToken))
+	sshToken, err := types.NewProvisionTokenFromSpec("sshToken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{types.RoleNode},
+	})
+	require.NoError(t, err)
+	require.NoError(t, testAuthServer.AuthServer.UpsertToken(t.Context(), sshToken))
+
+	logger := logtest.NewLogger()
+	dataDir := makeTempDir(t)
+	const hostName = "testhost"
+	newStartedProcess := func(token string, sshEnabled bool) *TeleportProcess {
+		cfg := servicecfg.MakeDefaultConfig()
+		cfg.SetAuthServerAddress(*utils.MustParseAddr(tlsServer.Listener.Addr().String()))
+		cfg.Clock = clockwork.NewRealClock()
+		cfg.DataDir = dataDir
+		cfg.Hostname = hostName
+		cfg.Auth.Enabled = false
+		cfg.Proxy.Enabled = true
+		cfg.Proxy.DisableWebInterface = true
+		cfg.Proxy.WebAddr = utils.NetAddr{Addr: "127.0.0.1:0", AddrNetwork: "tcp"}
+		cfg.SSH.Enabled = sshEnabled
+		cfg.SSH.Addr = utils.NetAddr{Addr: "127.0.0.1:0", AddrNetwork: "tcp"}
+		cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+		cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+		cfg.Logger = logger
+		cfg.SetToken(token)
+		cfg.JoinMethod = types.JoinMethodToken
+		process, err := NewTeleport(cfg)
+		require.NoError(t, err)
+		go process.Start()
+		return process
+	}
+
+	// Create and start a process with only the Proxy service enabled using the proxy-only token.
+	process := newStartedProcess(proxyToken.GetName(), false)
+
+	// Sanity check the Instance identity looks as expected with only the Proxy system role.
+	connector, err := process.WaitForConnector(InstanceIdentityEvent, logger)
+	require.NoError(t, err)
+	require.NotNil(t, connector)
+	id := connector.clientState.Load().identity
+	require.Equal(t, types.RoleInstance, id.ID.Role)
+	require.Equal(t, []string{types.RoleProxy.String()}, id.SystemRoles)
+	originalHostID := id.ID.HostID()
+
+	// Close the original process.
+	require.NoError(t, process.Close())
+	require.NoError(t, process.Wait())
+
+	// Start up a new process using the same data dir so that it has access to
+	// the previous Instance and Proxy certs, but enable the SSH service and
+	// provide the token that allows only role Node.
+	process = newStartedProcess(sshToken.GetName(), true)
+
+	// Get the new Instance identity and make sure it includes both the Proxy
+	// and Node system roles.
+	instanceConnector, err := process.WaitForConnector(InstanceIdentityEvent, logger)
+	require.NoError(t, err)
+	require.NotNil(t, instanceConnector)
+	instanceID := instanceConnector.clientState.Load().identity
+	require.Equal(t, types.RoleInstance, instanceID.ID.Role)
+	assert.ElementsMatch(t, []string{types.RoleProxy.String(), types.RoleNode.String()}, instanceID.SystemRoles)
+	// Make sure the host ID has not changed.
+	assert.Equal(t, instanceID.ID.HostID(), originalHostID)
+
+	// Make sure the SSH identity becomes available.
+	sshConnector, err := process.WaitForConnector(SSHIdentityEvent, logger)
+	require.NoError(t, err)
+	require.NotNil(t, sshConnector)
+	sshID := sshConnector.clientState.Load().identity
+	require.Equal(t, types.RoleNode, sshID.ID.Role)
+	// Make sure the host ID matches the original instance host ID.
+	assert.Equal(t, sshID.ID.HostID(), originalHostID)
+	// Make sure the SSH cert has all expected principals.
+	expectSSHPrincipals := expectedSSHPrincipals(sshID.ID.HostID(), hostName, clusterName)
+	require.ElementsMatch(t, expectSSHPrincipals, sshID.Cert.ValidPrincipals)
+
+	// Close the process to clean up.
+	require.NoError(t, process.Close())
+	require.NoError(t, process.Wait())
+}
+
+func TestSSHPrincipals(t *testing.T) {
+	const clusterName = "testcluster"
+	authServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			Dir:         t.TempDir(),
+			ClusterName: clusterName,
+		},
+	})
+	require.NoError(t, err)
+
+	token, err := types.NewProvisionTokenFromSpec("token", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
+		Roles: []types.SystemRole{types.RoleNode},
+	})
+	require.NoError(t, err)
+	require.NoError(t, authServer.Auth().UpsertToken(t.Context(), token))
+
+	logger := logtest.NewLogger()
+	const hostName = "testhost"
+	nodeCfg := servicecfg.MakeDefaultConfig()
+	nodeCfg.SetAuthServerAddress(*utils.MustParseAddr(authServer.TLS.Listener.Addr().String()))
+	nodeCfg.Clock = clockwork.NewRealClock()
+	nodeCfg.DataDir = t.TempDir()
+	nodeCfg.Hostname = hostName
+	nodeCfg.Auth.Enabled = false
+	nodeCfg.Proxy.Enabled = false
+	nodeCfg.SSH.Enabled = true
+	nodeCfg.SSH.Addr = utils.NetAddr{Addr: "127.0.0.1:0", AddrNetwork: "tcp"}
+	nodeCfg.SetToken(token.GetName())
+	nodeCfg.JoinMethod = types.JoinMethodToken
+	nodeCfg.Logger = logger
+	nodeProcess, err := NewTeleport(nodeCfg)
+	require.NoError(t, err)
+	go nodeProcess.Start()
+	defer func() {
+		assert.NoError(t, nodeProcess.Close())
+		assert.NoError(t, nodeProcess.Wait())
+	}()
+
+	nodeConnector, err := nodeProcess.WaitForConnector(SSHIdentityEvent, logger)
+	require.NoError(t, err)
+	nodeID := nodeConnector.clientState.Load().identity
+	expectSSHPrincipals := expectedSSHPrincipals(nodeID.ID.HostID(), hostName, clusterName)
+	assert.ElementsMatch(t, expectSSHPrincipals, nodeID.Cert.ValidPrincipals)
+}
+
+func expectedSSHPrincipals(hostID, hostName, clusterName string) []string {
+	return []string{
+		hostID,
+		hostID + "." + clusterName,
+		hostName,
+		hostName + "." + clusterName,
+		string(teleport.PrincipalLocalhost),
+		string(teleport.PrincipalLoopbackV4),
+		string(teleport.PrincipalLoopbackV6),
+	}
+
+}
+
 func TestTeleportProcessAuthVersionCheck(t *testing.T) {
 	t.Parallel()
 
@@ -1071,178 +1247,11 @@ func testVersionCheck(t *testing.T, nodeCfg *servicecfg.Config, skipVersionCheck
 	supervisor.signalExit()
 }
 
-func Test_readOrGenerateHostID(t *testing.T) {
-	var (
-		id          = uuid.New().String()
-		hostUUIDKey = "/host_uuid"
-	)
-	type args struct {
-		kubeBackend   *fakeKubeBackend
-		hostIDContent string
-		identity      []*state.Identity
-	}
-	tests := []struct {
-		name             string
-		args             args
-		wantFunc         func(string) bool
-		wantKubeItemFunc func(*backend.Item) bool
-	}{
-		{
-			name: "load from storage without kube backend",
-			args: args{
-				kubeBackend:   nil,
-				hostIDContent: id,
-			},
-			wantFunc: func(receivedID string) bool {
-				return receivedID == id
-			},
-		},
-		{
-			name: "Kube Backend is available but key is missing. Load from local storage and store in kube",
-			args: args{
-				kubeBackend: &fakeKubeBackend{
-					getData: nil,
-					getErr:  fmt.Errorf("key not found"),
-				},
-				hostIDContent: id,
-			},
-			wantFunc: func(receivedID string) bool {
-				return receivedID == id
-			},
-			wantKubeItemFunc: func(i *backend.Item) bool {
-				return cmp.Diff(&backend.Item{
-					Key:   backend.KeyFromString(hostUUIDKey),
-					Value: []byte(id),
-				}, i, cmp.AllowUnexported(backend.Key{})) == ""
-			},
-		},
-		{
-			name: "Kube Backend is available with key. Load from kube storage",
-			args: args{
-				kubeBackend: &fakeKubeBackend{
-					getData: &backend.Item{
-						Key:   backend.KeyFromString(hostUUIDKey),
-						Value: []byte(id),
-					},
-					getErr: nil,
-				},
-			},
-			wantFunc: func(receivedID string) bool {
-				return receivedID == id
-			},
-			wantKubeItemFunc: func(i *backend.Item) bool {
-				return i == nil
-			},
-		},
-		{
-			name: "No hostID available. Generate one and store it into Kube and Local Storage",
-			args: args{
-				kubeBackend: &fakeKubeBackend{
-					getData: nil,
-					getErr:  fmt.Errorf("key not found"),
-				},
-			},
-			wantFunc: func(receivedID string) bool {
-				_, err := uuid.Parse(receivedID)
-				return err == nil
-			},
-			wantKubeItemFunc: func(i *backend.Item) bool {
-				_, err := uuid.Parse(string(i.Value))
-				return err == nil && i.Key.String() == hostUUIDKey
-			},
-		},
-		{
-			name: "No hostID available. Generate one and store it into Local Storage",
-			args: args{
-				kubeBackend: nil,
-			},
-			wantFunc: func(receivedID string) bool {
-				_, err := uuid.Parse(receivedID)
-				return err == nil
-			},
-			wantKubeItemFunc: nil,
-		},
-		{
-			name: "No hostID available. Grab from provided static identity",
-			args: args{
-				kubeBackend: &fakeKubeBackend{
-					getData: nil,
-					getErr:  fmt.Errorf("key not found"),
-				},
-
-				identity: []*state.Identity{
-					{
-						ID: state.IdentityID{
-							HostUUID: id,
-						},
-					},
-				},
-			},
-			wantFunc: func(receivedID string) bool {
-				return receivedID == id
-			},
-			wantKubeItemFunc: func(i *backend.Item) bool {
-				_, err := uuid.Parse(string(i.Value))
-				return err == nil && i.Key.String() == hostUUIDKey
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dataDir := t.TempDir()
-			// write host_uuid file to temp dir.
-			if len(tt.args.hostIDContent) > 0 {
-				err := hostid.WriteFile(dataDir, tt.args.hostIDContent)
-				require.NoError(t, err)
-			}
-
-			cfg := &servicecfg.Config{
-				DataDir:    dataDir,
-				Logger:     slog.Default(),
-				JoinMethod: types.JoinMethodToken,
-				Identities: tt.args.identity,
-			}
-
-			var kubeBackend kubernetesBackend
-			if tt.args.kubeBackend != nil {
-				kubeBackend = tt.args.kubeBackend
-			}
-
-			err := readOrGenerateHostID(context.Background(), cfg, kubeBackend)
-			require.NoError(t, err)
-
-			require.True(t, tt.wantFunc(cfg.HostUUID))
-
-			if tt.args.kubeBackend != nil {
-				require.True(t, tt.wantKubeItemFunc(tt.args.kubeBackend.putData))
-			}
-		})
-	}
-}
-
-type fakeKubeBackend struct {
-	putData *backend.Item
-	getData *backend.Item
-	getErr  error
-}
-
-// Put puts value into backend (creates if it does not
-// exists, updates it otherwise)
-func (f *fakeKubeBackend) Put(ctx context.Context, i backend.Item) (*backend.Lease, error) {
-	f.putData = &i
-	return &backend.Lease{}, nil
-}
-
-// Get returns a single item or not found error
-func (f *fakeKubeBackend) Get(ctx context.Context, key backend.Key) (*backend.Item, error) {
-	return f.getData, f.getErr
-}
-
 func TestProxyGRPCServers(t *testing.T) {
 	hostID := uuid.NewString()
 	// Create a test auth server to extract the server identity (SSH and TLS
 	// certificates).
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClockAt(time.Now()),
 	})
@@ -1257,10 +1266,10 @@ func TestProxyGRPCServers(t *testing.T) {
 		require.NoError(t, tlsServer.Close())
 	})
 	// Create a new client using the server identity.
-	client, err := tlsServer.NewClient(auth.TestServerID(types.RoleProxy, hostID))
+	client, err := tlsServer.NewClient(authtest.TestServerID(types.RoleProxy, hostID))
 	require.NoError(t, err)
 	// TLS config for proxy service.
-	serverIdentity, err := auth.NewServerIdentity(testAuthServer.AuthServer, hostID, types.RoleProxy)
+	serverIdentity, err := authtest.NewServerIdentity(testAuthServer.AuthServer, hostID, types.RoleProxy)
 	require.NoError(t, err)
 
 	testConnector, err := newConnector(serverIdentity, serverIdentity)
@@ -1291,8 +1300,10 @@ func TestProxyGRPCServers(t *testing.T) {
 
 	// Create a new Teleport process to initialize the gRPC servers with KubeProxy
 	// enabled.
+	supervisor, err := NewSupervisor(hostID, logtest.NewLogger(), nil)
+	require.NoError(t, err)
 	process := &TeleportProcess{
-		Supervisor: NewSupervisor(hostID, utils.NewSlogLoggerForTests()),
+		Supervisor: supervisor,
 		Config: &servicecfg.Config{
 			Proxy: servicecfg.ProxyConfig{
 				Kube: servicecfg.KubeProxyConfig{
@@ -1300,7 +1311,7 @@ func TestProxyGRPCServers(t *testing.T) {
 				},
 			},
 		},
-		logger: utils.NewSlogLoggerForTests(),
+		logger: logtest.NewLogger(),
 	}
 
 	// Create a limiter with no limits.
@@ -1480,7 +1491,7 @@ func TestEnterpriseServicesEnabled(t *testing.T) {
 			if tt.enterprise {
 				buildType = modules.BuildEnterprise
 			}
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: buildType,
 			})
 
@@ -1618,32 +1629,33 @@ func TestDebugService(t *testing.T) {
 	fakeClock := clockwork.NewFakeClock()
 
 	dataDir := makeTempDir(t)
-	cfg := servicecfg.MakeDefaultConfig()
-	cfg.DebugService.Enabled = true
+	cfg := &servicecfg.Config{
+		Clock:   fakeClock,
+		DataDir: dataDir,
+	}
 	cfg.Clock = fakeClock
 	cfg.DataDir = dataDir
-	cfg.DiagnosticAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
-	cfg.SetAuthServerAddress(utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"})
-	cfg.Auth.Enabled = true
-	cfg.Proxy.Enabled = false
-	cfg.Auth.StorageConfig.Params["path"] = dataDir
-	cfg.Auth.ListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
-	cfg.SSH.Enabled = false
-	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 
-	process, err := NewTeleport(cfg)
-	require.NoError(t, err)
+	log := logtest.NewLogger()
 
-	require.NoError(t, process.Start())
-	t.Cleanup(func() {
-		require.NoError(t, process.Close())
-		require.NoError(t, process.Wait())
-	})
+	localRegistry := prometheus.NewRegistry()
+	additionalRegistry := prometheus.NewRegistry()
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
-	t.Cleanup(cancel)
-	_, err = process.WaitForEvent(ctx, TeleportOKEvent)
+	// In this test we don't want to spin a whole process and have to wait for
+	// every service to report ready (there's an integration test for this).
+	// So we craft a minimal process with only the debug service in it.
+	supervisor, err := NewSupervisor("supervisor-test", log, fakeClock)
 	require.NoError(t, err)
+	process := &TeleportProcess{
+		Config:          cfg,
+		Clock:           fakeClock,
+		logger:          log,
+		metricsRegistry: localRegistry,
+		SyncGatherers:   metrics.NewSyncGatherers(localRegistry, prometheus.DefaultGatherer),
+		Supervisor:      supervisor,
+	}
+
+	process.BroadcastEvent(Event{TeleportOKEvent, "dummy"})
 
 	httpClient := &http.Client{
 		Timeout: 10 * time.Second,
@@ -1654,6 +1666,9 @@ func TestDebugService(t *testing.T) {
 		},
 	}
 
+	require.NoError(t, process.initDebugService(true))
+	require.NoError(t, process.Start())
+
 	// Testing the debug listener.
 	// Fetch a random path, it should return 404 error.
 	req, err := httpClient.Get("http://debug/random")
@@ -1685,8 +1700,13 @@ func TestDebugService(t *testing.T) {
 		Namespace: "test",
 		Name:      "global_metric_" + nonce,
 	})
+	additionalMetric := prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace: "test",
+		Name:      "additional_metric_" + nonce,
+	})
 	require.NoError(t, process.metricsRegistry.Register(localMetric))
 	require.NoError(t, prometheus.Register(globalMetric))
+	require.NoError(t, additionalRegistry.Register(additionalMetric))
 
 	// Test execution: hit the metrics endpoint.
 	resp, err := httpClient.Get("http://debug/metrics")
@@ -1700,6 +1720,26 @@ func TestDebugService(t *testing.T) {
 	// Test validation: check that the metrics server served both the local and global registry.
 	require.Contains(t, string(body), "local_metric_"+nonce)
 	require.Contains(t, string(body), "global_metric_"+nonce)
+	// the additional registry is not yet added
+	require.NotContains(t, string(body), "additional_metric_"+nonce)
+
+	// Test execution: add the additional registry and lookup again
+	process.AddGatherer(additionalRegistry)
+
+	// Test execution: hit the metrics endpoint.
+	resp, err = httpClient.Get("http://debug/metrics")
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	body, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	// Test validation: check that the metrics server served both the local and global registry.
+	require.Contains(t, string(body), "local_metric_"+nonce)
+	require.Contains(t, string(body), "global_metric_"+nonce)
+	// Metric has been added
+	require.Contains(t, string(body), "additional_metric_"+nonce)
 }
 
 type mockInstanceMetadata struct {
@@ -2083,27 +2123,37 @@ func TestMetricsService(t *testing.T) {
 // health routes.
 func TestDiagnosticsService(t *testing.T) {
 	t.Parallel()
-	// Test setup: create a new teleport process
+
+	fakeClock := clockwork.NewFakeClock()
 	dataDir := makeTempDir(t)
-	cfg := servicecfg.MakeDefaultConfig()
-	cfg.DataDir = dataDir
-	cfg.SetAuthServerAddress(utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"})
-	cfg.Auth.Enabled = true
-	cfg.Proxy.Enabled = false
-	cfg.SSH.Enabled = false
-	cfg.DebugService.Enabled = false
-	cfg.Auth.StorageConfig.Params["path"] = dataDir
-	cfg.Auth.ListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
-	cfg.DiagnosticAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
+	cfg := &servicecfg.Config{
+		Clock:          fakeClock,
+		DataDir:        dataDir,
+		DiagnosticAddr: utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"},
+	}
 
-	// Test setup: Create and start the Teleport service.
-	process, err := NewTeleport(cfg)
+	log := logtest.NewLogger()
+	localRegistry := prometheus.NewRegistry()
+	additionalRegistry := prometheus.NewRegistry()
+
+	// In this test we don't want to spin a whole process and have to wait for
+	// every service to report ready (there's an integration test for this).
+	// So we craft a minimal process with only the debug service in it.
+	supervisor, err := NewSupervisor("supervisor-test", log, fakeClock)
 	require.NoError(t, err)
+	process := &TeleportProcess{
+		Config:          cfg,
+		Clock:           fakeClock,
+		logger:          log,
+		metricsRegistry: localRegistry,
+		SyncGatherers:   metrics.NewSyncGatherers(localRegistry, prometheus.DefaultGatherer),
+		Supervisor:      supervisor,
+	}
+
+	process.BroadcastEvent(Event{TeleportOKEvent, "dummy"})
+
+	require.NoError(t, process.initDiagnosticService())
 	require.NoError(t, process.Start())
-	t.Cleanup(func() {
-		assert.NoError(t, process.Close())
-		assert.NoError(t, process.Wait())
-	})
 
 	// Test setup: create our test metrics.
 	nonce := strings.ReplaceAll(uuid.NewString(), "-", "")
@@ -2115,13 +2165,13 @@ func TestDiagnosticsService(t *testing.T) {
 		Namespace: "test",
 		Name:      "global_metric_" + nonce,
 	})
+	additionalMetric := prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace: "test",
+		Name:      "additional_metric_" + nonce,
+	})
 	require.NoError(t, process.metricsRegistry.Register(localMetric))
 	require.NoError(t, prometheus.Register(globalMetric))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
-	t.Cleanup(cancel)
-	_, err = process.WaitForEvent(ctx, TeleportOKEvent)
-	require.NoError(t, err)
+	require.NoError(t, additionalRegistry.Register(additionalMetric))
 
 	// Test execution: query the metrics endpoint and check the tests metrics are here.
 	diagAddr, err := process.DiagnosticAddr()
@@ -2140,7 +2190,24 @@ func TestDiagnosticsService(t *testing.T) {
 	// Test validation: check that the metrics server served both the local and global registry.
 	require.Contains(t, string(body), "local_metric_"+nonce)
 	require.Contains(t, string(body), "global_metric_"+nonce)
+	// the additional registry is not yet added
+	require.NotContains(t, string(body), "additional_metric_"+nonce)
+
+	// Test execution: add the additional registry and lookup again
+	process.AddGatherer(additionalRegistry)
 
+	resp, err = http.Get(metricsURL.String())
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	body, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	require.Contains(t, string(body), "local_metric_"+nonce)
+	require.Contains(t, string(body), "global_metric_"+nonce)
+	// the additional registry is not yet added
+	require.Contains(t, string(body), "additional_metric_"+nonce)
 	// Fetch the liveness endpoint
 	healthURL, err := url.Parse("http://" + diagAddr.String())
 	require.NoError(t, err)
@@ -2170,3 +2237,181 @@ func makeTempDir(t *testing.T) string {
 	t.Cleanup(func() { os.RemoveAll(tempDir) })
 	return tempDir
 }
+
+// TestInstanceCertReissue tests the reissuance of an instance certificate when
+// the instance has malformed system roles using pre-constructed data directories
+// generated by an older teleport version that permitted token mix-and-match.
+func TestInstanceCertReissue(t *testing.T) {
+	t.Setenv("_insecuredevmode_no_parallel", "1") // panic if the test is or will become parallel
+	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
+	lib.SetInsecureDevMode(true)
+	defer lib.SetInsecureDevMode(false)
+
+	var eg errgroup.Group
+	defer func() { require.NoError(t, eg.Wait()) }()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// Create temporary directories for the auth and agent data directories.
+	authDir, agentDir := t.TempDir(), t.TempDir()
+
+	// Write the instance assets to the temporary directories to set up pre-existing
+	// state for our teleport instances to use.
+	require.NoError(t, basicDirCopy("testdata/auth", authDir))
+	require.NoError(t, basicDirCopy("testdata/agent", agentDir))
+
+	authCfg := servicecfg.MakeDefaultConfig()
+	authCfg.Version = defaults.TeleportConfigVersionV3
+	authCfg.DataDir = authDir
+	authCfg.Auth.Enabled = true
+	authCfg.Auth.ListenAddr.Addr = newListener(t, ListenerAuth, &authCfg.FileDescriptors)
+	authCfg.SetAuthServerAddress(authCfg.Auth.ListenAddr)
+	// ensure auth server is using the pre-constructed sqlite db
+	authCfg.Auth.StorageConfig.Params = backend.Params{defaults.BackendPath: filepath.Join(authDir, defaults.BackendDir)}
+	var err error
+	authCfg.Auth.ClusterName, err = services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+		ClusterName: "auth-server",
+	})
+	require.NoError(t, err)
+	authCfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+
+	authCfg.Proxy.Enabled = true
+	authCfg.Proxy.DisableWebInterface = true
+	proxyAddr := newListener(t, ListenerProxyWeb, &authCfg.FileDescriptors)
+	authCfg.Proxy.WebAddr.Addr = proxyAddr
+
+	authCfg.SSH.Enabled = true
+	authCfg.SSH.Addr.Addr = "localhost:0"
+	authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	authCfg.Logger = logtest.NewLogger()
+	authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+
+	authProc, err := NewTeleport(authCfg)
+	require.NoError(t, err)
+	require.NoError(t, authProc.Start())
+	eg.Go(func() error { return authProc.WaitForSignals(ctx, nil) })
+
+	authIdentity, err := authProc.getIdentity(types.RoleInstance)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy)}, authIdentity.SystemRoles)
+
+	authEventCh := make(chan Event)
+	authProc.ListenForEvents(ctx, TeleportCredentialsUpdatedEvent, authEventCh)
+
+	timeoutCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	_, err = authProc.WaitForEvent(timeoutCtx, TeleportCredentialsUpdatedEvent)
+	require.NoError(t, err, "timed out waiting for second auth identity")
+
+	authIdentity, err = authProc.getIdentity(types.RoleInstance)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy), string(types.RoleNode)}, authIdentity.SystemRoles)
+
+	agentCfg := servicecfg.MakeDefaultConfig()
+	agentCfg.Version = defaults.TeleportConfigVersionV3
+	agentCfg.DataDir = agentDir
+	agentCfg.ProxyServer = utils.NetAddr{
+		AddrNetwork: "tcp",
+		Addr:        proxyAddr,
+	}
+
+	agentCfg.Auth.Enabled = false
+	agentCfg.Proxy.Enabled = false
+	agentCfg.SSH.Enabled = true
+
+	agentCfg.WindowsDesktop.Enabled = true
+	agentCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	agentCfg.Logger = logtest.NewLogger()
+	agentCfg.AuthConnectionConfig = *servicecfg.DefaultRatioAuthConnectionConfig(time.Second)
+	agentCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+
+	agentProc, err := NewTeleport(agentCfg)
+	require.NoError(t, err)
+	require.NoError(t, agentProc.Start())
+	eg.Go(func() error { return agentProc.WaitForSignals(ctx, nil) })
+
+	agentIdentity, err := agentProc.getIdentity(types.RoleInstance)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{string(types.RoleNode)}, agentIdentity.SystemRoles)
+
+	_, err = agentProc.WaitForEvent(timeoutCtx, TeleportCredentialsUpdatedEvent)
+	require.NoError(t, err, "timed out waiting for second agent identity")
+
+	agentIdentity, err = agentProc.getIdentity(types.RoleInstance)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{string(types.RoleNode), string(types.RoleWindowsDesktop)}, agentIdentity.SystemRoles)
+}
+
+// newListener creates a new TCP listener on 127.0.0.1:0, adds it to the
+// FileDescriptor slice (with the specified type) and returns its actual local
+// address as a string (for use in configuration). The idea is to subvert
+// Teleport's file-descriptor injection mechanism (used to share ports between
+// parent and child processes) to inject preconfigured listeners to Teleport
+// instances under test. The ports are allocated and bound at runtime, so there
+// should be no issues with port clashes on parallel tests.
+//
+// The resulting file descriptor is added to the `fds` slice, which can then be
+// given to a teleport instance on startup in order to suppl
+func newListener(t *testing.T, ty ListenerType, fds *[]*servicecfg.FileDescriptor) string {
+	t.Helper()
+
+	l, err := net.Listen("tcp", net.JoinHostPort("localhost", "0"))
+	require.NoError(t, err)
+	defer l.Close()
+
+	// File() returns a dup of the listener's file descriptor as an *os.File, so
+	// the original net.Listener still needs to be closed.
+	lf, err := l.(*net.TCPListener).File()
+	require.NoError(t, err)
+	fd := &servicecfg.FileDescriptor{
+		Type:    string(ty),
+		Address: l.Addr().String(),
+		File:    lf,
+	}
+
+	// If the file descriptor slice ends up being passed to a TeleportProcess
+	// that successfully starts, listeners will either get "imported" and used
+	// or discarded and closed, this is just an extra safety measure that closes
+	// the listener at the end of the test anyway (the finalizer would do that
+	// anyway, in principle).
+	t.Cleanup(func() { require.NoError(t, fd.Close()) })
+
+	*fds = append(*fds, fd)
+	return l.Addr().String()
+}
+
+// basicDirCopy performs a very simplistic recursive copy from one directory to another. this helper was
+// written specifically for setting up teleport data directories for testing purposes and may not be
+// suitable for other applications.
+func basicDirCopy(src string, dst string) error {
+	entries, err := os.ReadDir(src)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := os.MkdirAll(dst, teleport.PrivateDirMode); err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			if err := basicDirCopy(filepath.Join(src, entry.Name()), filepath.Join(dst, entry.Name())); err != nil {
+				return trace.Wrap(err)
+			}
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(src, entry.Name()))
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if err := os.WriteFile(filepath.Join(dst, entry.Name()), data, teleport.PrivateDirMode); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
diff --git a/lib/service/servicecfg/app.go b/lib/service/servicecfg/app.go
index 28f843ed7b0c1..12b2a5792bb15 100644
--- a/lib/service/servicecfg/app.go
+++ b/lib/service/servicecfg/app.go
@@ -43,6 +43,9 @@ type AppsConfig struct {
 	// DebugApp enabled a header dumping debugging application.
 	DebugApp bool
 
+	// MCPDemoServer enables the "Teleport Demo" MCP server.
+	MCPDemoServer bool
+
 	// Apps is the list of applications that are being proxied.
 	Apps []App
 
@@ -108,6 +111,9 @@ type App struct {
 	// If this field is not empty, URI is expected to contain no port number and start with the tcp
 	// protocol.
 	TCPPorts []PortRange
+
+	// MCP contains MCP server-related configurations.
+	MCP *types.MCP
 }
 
 // CORS represents the configuration for Cross-Origin Resource Sharing (CORS)
@@ -156,9 +162,12 @@ func (a *App) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing application name")
 	}
 	if a.URI == "" {
-		if a.Cloud != "" {
+		switch {
+		case a.Cloud != "":
 			a.URI = fmt.Sprintf("cloud://%v", a.Cloud)
-		} else {
+		case a.MCP != nil && a.MCP.Command != "":
+			a.URI = types.SchemeMCPStdio + "://"
+		default:
 			return trace.BadParameter("missing application %q URI", a.Name)
 		}
 	}
diff --git a/lib/service/servicecfg/config.go b/lib/service/servicecfg/config.go
index cf89010016e13..a9e8f0f2d8f05 100644
--- a/lib/service/servicecfg/config.go
+++ b/lib/service/servicecfg/config.go
@@ -21,6 +21,8 @@ package servicecfg
 
 import (
 	"context"
+	"fmt"
+	"io"
 	"log/slog"
 	"net"
 	"net/http"
@@ -33,7 +35,6 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
-	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
@@ -49,8 +50,8 @@ import (
 	"github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/sshca"
-	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // Config contains the configuration for all services that Teleport can run.
@@ -73,6 +74,10 @@ type Config struct {
 	// ProxyServer is the address of the proxy
 	ProxyServer utils.NetAddr
 
+	// RelayServer is the optional address of the relay server that this agent
+	// should be opening tunnels to for supported services.
+	RelayServer string
+
 	// Identities is an optional list of pre-generated key pairs
 	// for teleport roles, this is helpful when server is preconfigured
 	Identities []*state.Identity
@@ -85,6 +90,10 @@ type Config struct {
 	// in case if they lose connection to auth servers
 	CachePolicy CachePolicy
 
+	// ShutdownDelay is a fixed delay between receiving a termination signal and
+	// the beginning of the shutdown procedures.
+	ShutdownDelay time.Duration
+
 	// Auth service configuration. Manages cluster state and configuration.
 	Auth AuthConfig
 
@@ -92,6 +101,9 @@ type Config struct {
 	// connections to the cluster.
 	Proxy ProxyConfig
 
+	// Relay contains the configuration for the Relay service.
+	Relay RelayConfig
+
 	// SSH service configuration. Manages SSH servers running within the cluster.
 	SSH SSHConfig
 
@@ -128,10 +140,6 @@ type Config struct {
 	// Keygen points to a key generator implementation
 	Keygen sshca.Authority
 
-	// HostUUID is a unique UUID of this host (it will be known via this UUID within
-	// a teleport cluster). It's automatically generated on 1st start
-	HostUUID string
-
 	// ReverseTunnels is a list of reverse tunnels to create on the
 	// first cluster start
 	ReverseTunnels []types.ReverseTunnel
@@ -160,8 +168,6 @@ type Config struct {
 	// Access is a service that controls access
 	Access services.Access
 
-	// UsageReporter is a service that reports usage events.
-	UsageReporter usagereporter.UsageReporter
 	// ClusterConfiguration is a service that provides cluster configuration
 	ClusterConfiguration services.ClusterConfigurationInternal
 
@@ -205,7 +211,7 @@ type Config struct {
 	// Clock is used to control time in tests.
 	Clock clockwork.Clock
 
-	// FIPS means FedRAMP/FIPS 140-2 compliant configuration was requested.
+	// FIPS means FedRAMP/FIPS compliant configuration was requested.
 	FIPS bool
 
 	// SkipVersionCheck means the version checking between server and client
@@ -218,10 +224,17 @@ type Config struct {
 	// Kube is a Kubernetes API gateway using Teleport client identities.
 	Kube KubeConfig
 
+	// LogConfig is the config used to initialize the logger and associated fields below.
+	// We keep the original config for child processes to initialize the same logger.
+	LogConfig logutils.Config
+
 	// Logger outputs messages using slog. The underlying handler respects
 	// the user supplied logging config.
 	Logger *slog.Logger
 
+	// LogWriter is the underlying log writer used by the Logger above.
+	LogWriter io.Writer
+
 	// LoggerLevel defines the Logger log level.
 	LoggerLevel *slog.LevelVar
 
@@ -232,8 +245,8 @@ type Config struct {
 	// attempts as used by the rotation state service
 	RotationConnectionInterval time.Duration
 
-	// MaxRetryPeriod is the maximum period between reconnection attempts to auth
-	MaxRetryPeriod time.Duration
+	// AuthConnectionConfig defines the Auth Service connection configuration.
+	AuthConnectionConfig AuthConnectionConfig
 
 	// TeleportHome is the path to tsh configuration and data, used
 	// for loading profiles when TELEPORT_HOME is set
@@ -261,12 +274,6 @@ type Config struct {
 	// protocol.
 	DatabaseREPLRegistry dbrepl.REPLRegistry
 
-	// MetricsRegistry is the prometheus metrics registry used by the Teleport process to register its metrics.
-	// As of today, not every Teleport metric is registered against this registry. Some Teleport services
-	// and Teleport dependencies are using the global registry.
-	// Both the MetricsRegistry and the default global registry are gathered by Teleport's metric service.
-	MetricsRegistry *prometheus.Registry
-
 	// token is either the token needed to join the auth server, or a path pointing to a file
 	// that contains the token
 	//
@@ -342,6 +349,59 @@ type AuditLogConfig struct {
 	StartDate time.Time
 }
 
+// AuthConnectionConfig defines the parameters used to connect to the Auth Service.
+type AuthConnectionConfig struct {
+	// UpperLimitBetweenRetries is the upper limit for how long to wait between retries.
+	UpperLimitBetweenRetries time.Duration
+	// InitialConnectionDelay is the initial delay before the first retry attempt.
+	// The retry logic will apply jitter to this duration.
+	InitialConnectionDelay time.Duration
+	// BackoffStepDuration is the amount of time added to the retry delay.
+	BackoffStepDuration time.Duration
+}
+
+// CheckAndSetDefaults checks and sets default values
+func (c *AuthConnectionConfig) CheckAndSetDefaults() error {
+	const minWatcherBackoff = 10 * time.Second
+
+	if c.UpperLimitBetweenRetries < 1 {
+		c.UpperLimitBetweenRetries = defaults.MaxWatcherBackoff
+	} else if c.UpperLimitBetweenRetries < minWatcherBackoff {
+		return trace.BadParameter("upper_limit_between_retries (%s) cannot be set below %s", c.UpperLimitBetweenRetries, minWatcherBackoff)
+	}
+
+	if c.InitialConnectionDelay < 1 {
+		c.InitialConnectionDelay = c.UpperLimitBetweenRetries / 10
+	} else if c.InitialConnectionDelay > c.UpperLimitBetweenRetries {
+		return trace.BadParameter(
+			"initial_connection_delay (%s) cannot be larger than upper_limit_between_retries (%s)",
+			c.InitialConnectionDelay,
+			c.UpperLimitBetweenRetries,
+		)
+	}
+
+	if c.BackoffStepDuration < 1 {
+		c.BackoffStepDuration = c.UpperLimitBetweenRetries / 5
+	} else if c.BackoffStepDuration > c.UpperLimitBetweenRetries {
+		return trace.BadParameter(
+			"backoff_step_duration (%s) cannot be larger than upper_limit_between_retries (%s)",
+			c.BackoffStepDuration,
+			c.UpperLimitBetweenRetries,
+		)
+	}
+
+	return nil
+}
+
+// DefaultRatioAuthConnectionConfig returns AuthConnectionConfig with parameters based on UpperLimitBetweenRetries
+func DefaultRatioAuthConnectionConfig(UpperLimitBetweenRetries time.Duration) *AuthConnectionConfig {
+	return &AuthConnectionConfig{
+		UpperLimitBetweenRetries: UpperLimitBetweenRetries,
+		InitialConnectionDelay:   UpperLimitBetweenRetries / 10,
+		BackoffStepDuration:      UpperLimitBetweenRetries / 5,
+	}
+}
+
 // RoleAndIdentityEvent is a role and its corresponding identity event.
 type RoleAndIdentityEvent struct {
 	// Role is a system role.
@@ -355,6 +415,7 @@ type RoleAndIdentityEvent struct {
 func DisableLongRunningServices(cfg *Config) {
 	cfg.Auth.Enabled = false
 	cfg.Proxy.Enabled = false
+	cfg.Relay.Enabled = false
 	cfg.SSH.Enabled = false
 	cfg.Kube.Enabled = false
 	cfg.Apps.Enabled = false
@@ -516,7 +577,7 @@ func (cfg *Config) DebugDumpToYAML() string {
 	return string(out)
 }
 
-// ApplyFIPSDefaults updates default configuration to be FedRAMP/FIPS 140-2
+// ApplyFIPSDefaults updates default configuration to be FedRAMP/FIPS
 // compliant.
 func ApplyFIPSDefaults(cfg *Config) {
 	cfg.FIPS = true
@@ -528,12 +589,12 @@ func ApplyFIPSDefaults(cfg *Config) {
 	cfg.MACAlgorithms = defaults.FIPSMACAlgorithms
 
 	// Only SSO based authentication is supported in FIPS mode. The SSO
-	// provider is where any FedRAMP/FIPS 140-2 compliance (like password
+	// provider is where any FedRAMP/FIPS compliance (like password
 	// complexity) should be enforced.
 	cfg.Auth.Preference.SetAllowLocalAuth(false)
 
 	// Update cluster configuration to record sessions at node, this way the
-	// entire cluster is FedRAMP/FIPS 140-2 compliant.
+	// entire cluster is FedRAMP/FIPS compliant.
 	cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtNode)
 }
 
@@ -557,6 +618,10 @@ func ApplyDefaults(cfg *Config) {
 		cfg.Logger = slog.Default()
 	}
 
+	if cfg.LogWriter == nil {
+		cfg.LogWriter = io.Discard
+	}
+
 	if cfg.LoggerLevel == nil {
 		cfg.LoggerLevel = new(slog.LevelVar)
 	}
@@ -634,7 +699,7 @@ func ApplyDefaults(cfg *Config) {
 	defaults.ConfigureLimiter(&cfg.WindowsDesktop.ConnLimiter)
 
 	cfg.RotationConnectionInterval = defaults.HighResPollingPeriod
-	cfg.MaxRetryPeriod = defaults.MaxWatcherBackoff
+	cfg.AuthConnectionConfig = *DefaultRatioAuthConnectionConfig(defaults.MaxWatcherBackoff)
 	cfg.Testing.ConnectFailureC = make(chan time.Duration, 1)
 	cfg.CircuitBreakerConfig = breaker.DefaultBreakerConfig(cfg.Clock)
 
@@ -737,6 +802,21 @@ func applyDefaults(cfg *Config) {
 	}
 }
 
+func warnIfUsingCloudOnWrongPort(log *slog.Logger, addr utils.NetAddr, defaultPort int) {
+	ctx := context.Background()
+	isCloud := strings.HasSuffix(addr.Host(), "."+defaults.CloudDomainSuffix)
+
+	if port := addr.Port(defaultPort); isCloud && port != defaults.CloudProxyListenPort {
+		//nolint:sloglint // We want to craft user-friendly and actionable messages here.
+		log.WarnContext(ctx,
+			fmt.Sprintf("Teleport Cloud Proxy Service runs on port 443, but the process is connecting to port %d. This is likely a misconfiguration and will prevent successfully joining the cluster.", port),
+			"port", port,
+			"address", addr.String())
+		//nolint:sloglint // We want to craft user-friendly and actionable messages here.
+		log.WarnContext(ctx, fmt.Sprintf("If you are experiencing connectivity issues, try using the following address: \"%s:%d\".", addr.Host(), defaults.CloudProxyListenPort))
+	}
+}
+
 func validateAuthOrProxyServices(cfg *Config) error {
 	haveAuthServers := len(cfg.authServers) > 0
 	haveProxyServer := !cfg.ProxyServer.IsEmpty()
@@ -765,6 +845,7 @@ func validateAuthOrProxyServices(cfg *Config) error {
 			if port == defaults.AuthListenPort {
 				cfg.Logger.WarnContext(context.Background(), "config: proxy_server is pointing to port 3025, is this the auth server address?")
 			}
+			warnIfUsingCloudOnWrongPort(cfg.Logger, cfg.ProxyServer, defaults.HTTPListenPort)
 		}
 
 		if haveAuthServers {
@@ -788,6 +869,8 @@ func validateAuthOrProxyServices(cfg *Config) error {
 		return trace.BadParameter("config: auth_servers is required")
 	}
 
+	warnIfUsingCloudOnWrongPort(cfg.Logger, cfg.authServers[0], defaults.AuthListenPort)
+
 	return nil
 }
 
@@ -796,6 +879,7 @@ func verifyEnabledService(cfg *Config) error {
 		cfg.Auth.Enabled,
 		cfg.SSH.Enabled,
 		cfg.Proxy.Enabled,
+		cfg.Relay.Enabled,
 		cfg.Kube.Enabled,
 		cfg.Apps.Enabled,
 		cfg.Databases.Enabled,
@@ -813,7 +897,8 @@ func verifyEnabledService(cfg *Config) error {
 	}
 
 	return trace.BadParameter(
-		"config: enable at least one of auth_service, ssh_service, proxy_service, app_service, database_service, kubernetes_service, windows_desktop_service, discovery_service, okta_service or jamf_service")
+		"config: enable at least one of auth_service, ssh_service, proxy_service, relay_service, app_service, database_service, kubernetes_service, windows_desktop_service, discovery_service, okta_service or jamf_service",
+	)
 }
 
 // SetLogLevel changes the loggers log level.
diff --git a/lib/service/servicecfg/config_test.go b/lib/service/servicecfg/config_test.go
index c72bdd4b52fc7..74e6a7a134a87 100644
--- a/lib/service/servicecfg/config_test.go
+++ b/lib/service/servicecfg/config_test.go
@@ -26,6 +26,7 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
@@ -68,6 +69,7 @@ func TestDefaultConfig(t *testing.T) {
 		"aes256-ctr",
 	})
 	require.ElementsMatch(t, config.KEXAlgorithms, []string{
+		"mlkem768x25519-sha256",
 		"curve25519-sha256",
 		"curve25519-sha256@libssh.org",
 		"ecdh-sha2-nistp256",
@@ -104,6 +106,12 @@ func TestDefaultConfig(t *testing.T) {
 
 	// Debug should always be enabled by default.
 	require.True(t, config.DebugService.Enabled)
+
+	// Reconnect section
+	require.Equal(t, defaults.MaxWatcherBackoff, config.AuthConnectionConfig.UpperLimitBetweenRetries)
+	require.Equal(t, 18*time.Second, config.AuthConnectionConfig.BackoffStepDuration)
+	require.Equal(t, 9*time.Second, config.AuthConnectionConfig.InitialConnectionDelay)
+
 }
 
 // TestCheckApp validates application configuration.
@@ -455,7 +463,7 @@ func TestValidateConfig(t *testing.T) {
 			config: &Config{
 				Version: defaults.TeleportConfigVersionV2,
 			},
-			wantErr: "config: enable at least one of auth_service, ssh_service, proxy_service, app_service, database_service, kubernetes_service, windows_desktop_service, discovery_service, okta_service ",
+			wantErr: "config: enable at least one of ",
 		},
 		{
 			desc: "no auth_servers or proxy_server specified",
@@ -547,6 +555,11 @@ func TestVerifyEnabledService(t *testing.T) {
 			config:           &Config{Proxy: ProxyConfig{Enabled: true}},
 			errAssertionFunc: require.NoError,
 		},
+		{
+			desc:             "relay enabled",
+			config:           &Config{Relay: RelayConfig{Enabled: true}},
+			errAssertionFunc: require.NoError,
+		},
 		{
 			desc:             "kube enabled",
 			config:           &Config{Kube: KubeConfig{Enabled: true}},
diff --git a/lib/service/servicecfg/database.go b/lib/service/servicecfg/database.go
index bf5ed3ac8c6b5..e79adca4fe473 100644
--- a/lib/service/servicecfg/database.go
+++ b/lib/service/servicecfg/database.go
@@ -87,8 +87,15 @@ type DatabaseAdminUser struct {
 
 // OracleOptions are additional Oracle options.
 type OracleOptions struct {
-	// AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
+	// AuditUser is the name of the Oracle database user that should be used to access
+	// the internal audit trail.
 	AuditUser string
+	// RetryCount is the maximum number of times to retry connecting to a
+	// host upon failure.
+	RetryCount int32
+	// ShuffleHostnames, when true, randomizes the order of hosts to connect to from
+	// the provided list.
+	ShuffleHostnames bool
 }
 
 // CheckAndSetDefaults validates the database proxy configuration.
@@ -156,6 +163,9 @@ func (d *Database) ToDatabase() (types.Database, error) {
 			ElastiCache: types.ElastiCache{
 				ReplicationGroupID: d.AWS.ElastiCache.ReplicationGroupID,
 			},
+			ElastiCacheServerless: types.ElastiCacheServerless{
+				CacheName: d.AWS.ElastiCacheServerless.CacheName,
+			},
 			MemoryDB: types.MemoryDB{
 				ClusterName: d.AWS.MemoryDB.ClusterName,
 			},
@@ -167,6 +177,10 @@ func (d *Database) ToDatabase() (types.Database, error) {
 		GCP: types.GCPCloudSQL{
 			ProjectID:  d.GCP.ProjectID,
 			InstanceID: d.GCP.InstanceID,
+			AlloyDB: types.AlloyDB{
+				EndpointType:     d.GCP.AlloyDB.EndpointType,
+				EndpointOverride: d.GCP.AlloyDB.EndpointOverride,
+			},
 		},
 		DynamicLabels: types.LabelsToV2(d.DynamicLabels),
 		AD: types.AD{
@@ -188,7 +202,9 @@ func (d *Database) ToDatabase() (types.Database, error) {
 
 func convOracleOptions(o OracleOptions) types.OracleOptions {
 	return types.OracleOptions{
-		AuditUser: o.AuditUser,
+		AuditUser:        o.AuditUser,
+		RetryCount:       o.RetryCount,
+		ShuffleHostnames: o.ShuffleHostnames,
 	}
 }
 
@@ -222,6 +238,8 @@ type DatabaseAWS struct {
 	RDS DatabaseAWSRDS
 	// ElastiCache contains ElastiCache specific settings.
 	ElastiCache DatabaseAWSElastiCache
+	// ElastiCacheServerless contains ElastiCacheServerless specific settings.
+	ElastiCacheServerless DatabaseAWSElastiCacheServerless
 	// MemoryDB contains MemoryDB specific settings.
 	MemoryDB DatabaseAWSMemoryDB
 	// SecretStore contains settings for managing secrets.
@@ -266,6 +284,12 @@ type DatabaseAWSElastiCache struct {
 	ReplicationGroupID string
 }
 
+// DatabaseAWSElastiCacheServerless contains settings for ElastiCache Serverless databases.
+type DatabaseAWSElastiCacheServerless struct {
+	// CacheName is the ElastiCache Serverless cache name.
+	CacheName string
+}
+
 // DatabaseAWSMemoryDB contains settings for MemoryDB databases.
 type DatabaseAWSMemoryDB struct {
 	// ClusterName is the MemoryDB cluster name.
@@ -286,6 +310,16 @@ type DatabaseGCP struct {
 	ProjectID string
 	// InstanceID is the Cloud SQL instance ID.
 	InstanceID string
+	// AlloyDB contains AlloyDB specific settings.
+	AlloyDB DatabaseGCPAlloyDB
+}
+
+// DatabaseGCPAlloyDB contains GCP specific settings for AlloyDB databases.
+type DatabaseGCPAlloyDB struct {
+	// EndpointType is the database endpoint type to use.
+	EndpointType string
+	// EndpointOverride is an override of endpoint address to use.
+	EndpointOverride string
 }
 
 // DatabaseAD contains database Active Directory configuration.
diff --git a/lib/service/servicecfg/relay.go b/lib/service/servicecfg/relay.go
new file mode 100644
index 0000000000000..63cbbd9ba7f0f
--- /dev/null
+++ b/lib/service/servicecfg/relay.go
@@ -0,0 +1,57 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package servicecfg
+
+import "net/netip"
+
+// RelayConfig contains the configuration for the Relay service.
+type RelayConfig struct {
+	Enabled bool
+
+	// RelayGroup is the Relay group name, required if the Relay service is
+	// enabled.
+	RelayGroup string
+
+	// TargetConnectionCount is the connection count that agents are supposed to
+	// maintain when connecting to the Relay group of this instance.
+	TargetConnectionCount int32
+
+	// PublicHostnames is the list of DNS names and IP addresses that the Relay
+	// service credentials should be authoritative for.
+	PublicHostnames []string
+
+	// TransportListenAddr is the listen address for the transport listener.
+	TransportListenAddr netip.AddrPort
+
+	// TransportPROXYProtocol is set if the transport listener should expect a
+	// PROXY protocol header in incoming connections.
+	TransportPROXYProtocol bool
+
+	// PeerListenAddr is the listen address for the peer listener.
+	PeerListenAddr netip.AddrPort
+
+	// PeerPublicAddr, if set, is the public address for the peer listener, in
+	// host:port format.
+	PeerPublicAddr string
+
+	// TunnelListenAddr is the listen address for the tunnel listener.
+	TunnelListenAddr netip.AddrPort
+
+	// TunnelPROXYProtocol is set if the tunnel listener should expect a PROXY
+	// protocol header in incoming connections.
+	TunnelPROXYProtocol bool
+}
diff --git a/lib/service/servicecfg/windows.go b/lib/service/servicecfg/windows.go
index d1b5d5b990d02..8be3f9b672317 100644
--- a/lib/service/servicecfg/windows.go
+++ b/lib/service/servicecfg/windows.go
@@ -24,6 +24,8 @@ import (
 	"regexp"
 	"time"
 
+	"github.com/gravitational/trace"
+
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
@@ -59,6 +61,9 @@ type WindowsDesktopConfig struct {
 	Discovery         []LDAPDiscoveryConfig
 	DiscoveryInterval time.Duration
 
+	// PublishCRLInterval determines how often CRLs should be published.
+	PublishCRLInterval time.Duration
+
 	// StaticHosts is an optional list of static Windows hosts to expose through this
 	// service.
 	StaticHosts []WindowsHost
@@ -146,10 +151,22 @@ type HostLabelRule struct {
 	Labels map[string]string
 }
 
+type LocateServer struct {
+	// Enabled will automatically locate the LDAP server using DNS SRV records.
+	// When enabled, Domain must be set, Addr will be ignored
+	// https://ldap.com/dns-srv-records-for-ldap/
+	Enabled bool
+	// Site is an LDAP site to locate servers from a specific logical site.
+	Site string
+}
+
 // LDAPConfig is the LDAP connection parameters.
 type LDAPConfig struct {
 	// Addr is the address:port of the LDAP server (typically port 389).
 	Addr string
+	// LocateServer automatically locates the LDAP server using DNS SRV records.
+	// https://ldap.com/dns-srv-records-for-ldap/
+	LocateServer LocateServer
 	// Domain is the ActiveDirectory domain name.
 	Domain string
 	// Username for LDAP authentication.
@@ -163,3 +180,22 @@ type LDAPConfig struct {
 	// CA is an optional CA cert to be used for verification if InsecureSkipVerify is set to false.
 	CA *x509.Certificate
 }
+
+// CheckAndSetDefaults verifies this LDAPConfig
+func (cfg *LDAPConfig) CheckAndSetDefaults() error {
+	if cfg.Addr == "" && !cfg.LocateServer.Enabled {
+		return trace.BadParameter("Addr is required if locate_server is false in LDAPConfig")
+	}
+	if cfg.Domain == "" {
+		return trace.BadParameter("missing Domain in LDAPConfig")
+	}
+	if cfg.Username == "" {
+		return trace.BadParameter("missing Username in LDAPConfig")
+	}
+
+	return nil
+}
+
+func (cfg *LDAPConfig) Enabled() bool {
+	return cfg.Addr != "" || cfg.LocateServer.Enabled
+}
diff --git a/lib/service/signals.go b/lib/service/signals.go
index 976e0a27beed8..dbfcf6a95a96d 100644
--- a/lib/service/signals.go
+++ b/lib/service/signals.go
@@ -294,7 +294,7 @@ func (process *TeleportProcess) createListener(typ ListenerType, address string)
 		return nil, trace.BadParameter("listening is blocked")
 	}
 
-	// When the process exists, the socket files are left behind (to cover
+	// When the process exits, the socket files are left behind (to cover
 	// forking scenarios). To guarantee there won't be errors like "address
 	// already in use", delete the file before starting the listener.
 	if typ.Network() == "unix" {
@@ -318,7 +318,7 @@ func (process *TeleportProcess) createListener(typ ListenerType, address string)
 
 	// The default behavior for unix listeners is to delete the file when the
 	// listener closes (unlinking). However, if the process forks, the file
-	// descriptor will be gone when its parent process exists, causing the new
+	// descriptor will be gone when its parent process exits, causing the new
 	// listener to have no socket file.
 	if unixListener, ok := listener.(*net.UnixListener); ok {
 		unixListener.SetUnlinkOnClose(false)
diff --git a/lib/service/state.go b/lib/service/state.go
index fab3b29a23bc4..e4580314120c6 100644
--- a/lib/service/state.go
+++ b/lib/service/state.go
@@ -26,13 +26,11 @@ import (
 	"time"
 
 	"github.com/gravitational/roundtrip"
-	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/client/debug"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/observability/metrics"
 )
 
 type componentStateEnum byte
@@ -64,9 +62,8 @@ func init() {
 
 // processState tracks the state of the Teleport process.
 type processState struct {
-	process *TeleportProcess
-	mu      sync.Mutex
-	states  map[string]*componentState
+	mu     sync.Mutex
+	states map[string]*componentState
 }
 
 type componentState struct {
@@ -74,42 +71,43 @@ type componentState struct {
 	state        componentStateEnum
 }
 
-// newProcessState returns a new FSM that tracks the state of the Teleport process.
-func newProcessState(process *TeleportProcess) (*processState, error) {
-	err := metrics.RegisterPrometheusCollectors(stateGauge)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+type updateResult int
 
-	return &processState{
-		process: process,
-		states:  make(map[string]*componentState),
-	}, nil
-}
+const (
+	_ updateResult = iota
 
-// update the state of a Teleport component.
-func (f *processState) update(event Event) {
+	updateStarting
+	updateStarted
+	updateDegraded
+	updateRecovering
+	updateRecovered
+)
+
+// update the state of a Teleport component. Returns a value depending on what
+// changed in the state of the component if something changed, or 0 if nothing
+// changed.
+func (f *processState) update(now time.Time, event, component string) updateResult {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	defer f.updateGauge()
 
-	component, ok := event.Payload.(string)
-	if !ok {
-		f.process.logger.ErrorContext(f.process.ExitContext(), "Received event broadcast without component name, this is a bug!", "event", event.Name)
-		return
-	}
 	s, ok := f.states[component]
 	if !ok {
+		if f.states == nil {
+			f.states = make(map[string]*componentState)
+		}
 		// Register a new component.
-		s = &componentState{recoveryTime: f.process.Clock.Now(), state: stateStarting}
+		s = &componentState{recoveryTime: now, state: stateStarting}
 		f.states[component] = s
 	}
 
-	switch event.Name {
+	switch event {
+	case TeleportStartingEvent:
+		return updateStarting
 	// If a degraded event was received, always change the state to degraded.
 	case TeleportDegradedEvent:
 		s.state = stateDegraded
-		f.process.logger.InfoContext(f.process.ExitContext(), "Detected Teleport component is running in a degraded state.", "component", component)
+		return updateDegraded
 	// If the current state is degraded, and a OK event has been
 	// received, change the state to recovering. If the current state is
 	// recovering and a OK events is received, if it's been longer
@@ -119,18 +117,19 @@ func (f *processState) update(event Event) {
 		switch s.state {
 		case stateStarting:
 			s.state = stateOK
-			f.process.logger.DebugContext(f.process.ExitContext(), "Teleport component has started.", "component", component)
+			return updateStarted
 		case stateDegraded:
 			s.state = stateRecovering
-			s.recoveryTime = f.process.Clock.Now()
-			f.process.logger.InfoContext(f.process.ExitContext(), "Teleport component is recovering from a degraded state.", "component", component)
+			s.recoveryTime = now
+			return updateRecovering
 		case stateRecovering:
-			if f.process.Clock.Since(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
+			if now.Sub(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
 				s.state = stateOK
-				f.process.logger.InfoContext(f.process.ExitContext(), "Teleport component has recovered from a degraded state.", "component", component)
+				return updateRecovered
 			}
 		}
 	}
+	return 0
 }
 
 // getStateLocked returns the overall process state based on the state of
@@ -176,32 +175,30 @@ func (f *processState) getState() componentStateEnum {
 	return f.getStateLocked()
 }
 
-func (f *processState) readinessHandler() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		switch f.getState() {
-		// 503
-		case stateDegraded:
-			roundtrip.ReplyJSON(w, http.StatusServiceUnavailable, debug.Readiness{
-				Status: "teleport is in a degraded state, check logs for details",
-				PID:    os.Getpid(),
-			})
-		// 400
-		case stateRecovering:
-			roundtrip.ReplyJSON(w, http.StatusBadRequest, debug.Readiness{
-				Status: "teleport is recovering from a degraded state, check logs for details",
-				PID:    os.Getpid(),
-			})
-		case stateStarting:
-			roundtrip.ReplyJSON(w, http.StatusBadRequest, debug.Readiness{
-				Status: "teleport is starting and hasn't joined the cluster yet",
-				PID:    os.Getpid(),
-			})
-		// 200
-		case stateOK:
-			roundtrip.ReplyJSON(w, http.StatusOK, debug.Readiness{
-				Status: "ok",
-				PID:    os.Getpid(),
-			})
-		}
+func (f *processState) handleReadiness(w http.ResponseWriter, r *http.Request) {
+	switch f.getState() {
+	// 503
+	case stateDegraded:
+		roundtrip.ReplyJSON(w, http.StatusServiceUnavailable, debug.Readiness{
+			Status: "teleport is in a degraded state, check logs for details",
+			PID:    os.Getpid(),
+		})
+	// 400
+	case stateRecovering:
+		roundtrip.ReplyJSON(w, http.StatusBadRequest, debug.Readiness{
+			Status: "teleport is recovering from a degraded state, check logs for details",
+			PID:    os.Getpid(),
+		})
+	case stateStarting:
+		roundtrip.ReplyJSON(w, http.StatusBadRequest, debug.Readiness{
+			Status: "teleport is starting and hasn't joined the cluster yet",
+			PID:    os.Getpid(),
+		})
+	// 200
+	case stateOK:
+		roundtrip.ReplyJSON(w, http.StatusOK, debug.Readiness{
+			Status: "ok",
+			PID:    os.Getpid(),
+		})
 	}
 }
diff --git a/lib/service/state_test.go b/lib/service/state_test.go
index 22cc5072e8006..42014db8257c4 100644
--- a/lib/service/state_test.go
+++ b/lib/service/state_test.go
@@ -21,7 +21,11 @@ package service
 import (
 	"testing"
 
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestProcessStateGetState(t *testing.T) {
@@ -90,3 +94,34 @@ func TestProcessStateGetState(t *testing.T) {
 		})
 	}
 }
+
+// TestProcessStateStarting validates that we correctly keep track of the starting services.
+func TestProcessStateStarting(t *testing.T) {
+	t.Parallel()
+	component := teleport.Component("test-component")
+	slowComponent := teleport.Component("slow-component")
+	log := logtest.NewLogger()
+
+	fakeClock := clockwork.NewFakeClock()
+	supervisor, err := NewSupervisor("test-process-state", log, fakeClock)
+	require.NoError(t, err)
+	process := &TeleportProcess{
+		Supervisor: supervisor,
+		Clock:      fakeClock,
+		logger:     log,
+	}
+	ps := &process.Supervisor.(*LocalSupervisor).processState
+
+	require.Equal(t, stateStarting, ps.getState(), "no services are running, we are starting")
+	process.OnHeartbeat(component)(nil)
+	require.Equal(t, stateOK, ps.getState(), "a single service is running, we are healthy")
+
+	process.ExpectService(slowComponent)
+	require.Equal(t, stateStarting, ps.getState(), "we know about a second service starting, we should be in starting state")
+
+	process.OnHeartbeat(component)(nil)
+	require.Equal(t, stateStarting, ps.getState(), "we know about a second service starting, we should still be in starting state")
+
+	process.OnHeartbeat(slowComponent)(nil)
+	require.Equal(t, stateOK, ps.getState(), "two services are running, we are healthy")
+}
diff --git a/lib/service/supervisor.go b/lib/service/supervisor.go
index 4c06277023628..85f0f4839bcf5 100644
--- a/lib/service/supervisor.go
+++ b/lib/service/supervisor.go
@@ -23,10 +23,12 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"sync"
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/gravitational/teleport"
@@ -104,6 +106,9 @@ type Supervisor interface {
 	// GracefulExitContext returns context that will be closed when
 	// a graceful or hard TeleportExitEvent is broadcast.
 	GracefulExitContext() context.Context
+
+	// HandleReadiness is the HTTP handler for "/readyz".
+	HandleReadiness(http.ResponseWriter, *http.Request)
 }
 
 // EventMapping maps a sequence of incoming
@@ -167,10 +172,22 @@ type LocalSupervisor struct {
 
 	// log specifies the logger
 	log *slog.Logger
+
+	// clock is used as a source of time, to support fake clocks in tests.
+	clock clockwork.Clock
+
+	// processState is the process state machine tracking if the process is
+	// healthy or not.
+	processState processState
 }
 
 // NewSupervisor returns new instance of initialized supervisor
-func NewSupervisor(id string, parentLog *slog.Logger) Supervisor {
+func NewSupervisor(id string, parentLog *slog.Logger, clock clockwork.Clock) (*LocalSupervisor, error) {
+	// used by processState
+	if err := metrics.RegisterPrometheusCollectors(stateGauge); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	ctx := context.TODO()
 
 	closeContext, cancel := context.WithCancel(ctx)
@@ -181,6 +198,10 @@ func NewSupervisor(id string, parentLog *slog.Logger) Supervisor {
 	// in the event of graceful exit must also terminate in the event of an immediate exit.
 	gracefulExitContext, signalGracefulExit := context.WithCancel(exitContext)
 
+	if clock == nil {
+		clock = clockwork.NewRealClock()
+	}
+
 	srv := &LocalSupervisor{
 		state:        stateCreated,
 		id:           id,
@@ -198,9 +219,12 @@ func NewSupervisor(id string, parentLog *slog.Logger) Supervisor {
 		signalGracefulExit:  signalGracefulExit,
 
 		log: parentLog.With(teleport.ComponentKey, teleport.Component(teleport.ComponentProcess, id)),
+
+		clock: clock,
 	}
+
 	go srv.fanOut()
-	return srv
+	return srv, nil
 }
 
 // Event is a special service event that can be generated
@@ -284,6 +308,7 @@ var metricsServicesRunningMap = map[string]string{
 	"ssh.node":             "ssh_service",
 	"auth.tls":             "auth_service",
 	"proxy.web":            "proxy_service",
+	"relay.run":            "relay_service",
 	"kube.init":            "kubernetes_service",
 	"apps.start":           "application_service",
 	"db.init":              "database_service",
@@ -292,7 +317,27 @@ var metricsServicesRunningMap = map[string]string{
 	"jamf.init":            "jamf_service",
 }
 
+// isShuttingDown returns true if the supervisor is in the process of shutting down
+// either gracefully or immediately.
+// Should be called with the lock held to make sure the state doesn't change
+func (s *LocalSupervisor) isShuttingDown() bool {
+	select {
+	case <-s.exitContext.Done():
+		return true
+	case <-s.gracefulExitContext.Done():
+		return true
+	default:
+		return false
+	}
+}
+
+// server starts the service in a separate goroutine.
+// Should be called with the lock held.
 func (s *LocalSupervisor) serve(srv Service) {
+	if s.isShuttingDown() {
+		s.log.WarnContext(s.closeContext, "Not starting new service, process is shutting down")
+		return
+	}
 	s.wg.Add(1)
 	go func() {
 		defer s.wg.Done()
@@ -355,6 +400,9 @@ func (s *LocalSupervisor) Services() []string {
 	return out
 }
 
+// Wait blocks until all registered services have exited.
+// It is invoked during process shutdown to ensure
+// that all registered services have exited.
 func (s *LocalSupervisor) Wait() error {
 	defer s.signalClose()
 	s.wg.Wait()
@@ -380,13 +428,23 @@ func (s *LocalSupervisor) GracefulExitContext() context.Context {
 	return s.gracefulExitContext
 }
 
+// HandleReadiness implements [Supervisor].
+func (s *LocalSupervisor) HandleReadiness(w http.ResponseWriter, r *http.Request) {
+	s.processState.handleReadiness(w, r)
+}
+
 // BroadcastEvent generates event and broadcasts it to all
 // subscribed parties.
 func (s *LocalSupervisor) BroadcastEvent(event Event) {
 	s.Lock()
 	defer s.Unlock()
 
-	if event.Name == TeleportExitEvent {
+	// some events have additional handling here because they affect the
+	// behavior or status of the process as a whole: Exit begins the shutdown by
+	// causing contexts to be closed, and Degraded/OK/Starting update the
+	// process' health.
+	switch event.Name {
+	case TeleportExitEvent:
 		// if exit event includes a context payload, it is a "graceful" exit, and
 		// we need to hold off closing the supervisor's exit context until after
 		// the graceful context has closed.  If not, it is an immediate exit.
@@ -402,6 +460,25 @@ func (s *LocalSupervisor) BroadcastEvent(event Event) {
 		} else {
 			s.signalExit()
 		}
+	case TeleportDegradedEvent, TeleportOKEvent, TeleportStartingEvent:
+		componentName, ok := event.Payload.(string)
+		if !ok {
+			s.log.ErrorContext(s.closeContext, "Received event broadcast without component name, this is a bug!", "event", event.Name)
+			break
+		}
+		updateResult := s.processState.update(s.clock.Now(), event.Name, componentName)
+		switch updateResult {
+		case updateStarting:
+			s.log.DebugContext(s.closeContext, "Teleport component is starting", "component", componentName)
+		case updateStarted:
+			s.log.DebugContext(s.closeContext, "Teleport component has started.", "component", componentName)
+		case updateDegraded:
+			s.log.InfoContext(s.closeContext, "Detected Teleport component is running in a degraded state.", "component", componentName)
+		case updateRecovering:
+			s.log.InfoContext(s.closeContext, "Teleport component is recovering from a degraded state.", "component", componentName)
+		case updateRecovered:
+			s.log.InfoContext(s.closeContext, "Teleport component has recovered from a degraded state.", "component", componentName)
+		}
 	}
 
 	s.events[event.Name] = event
diff --git a/integration/testdata/agent/host_uuid b/lib/service/testdata/agent/host_uuid
similarity index 100%
rename from integration/testdata/agent/host_uuid
rename to lib/service/testdata/agent/host_uuid
diff --git a/integration/testdata/agent/proc/sqlite.db b/lib/service/testdata/agent/proc/sqlite.db
similarity index 100%
rename from integration/testdata/agent/proc/sqlite.db
rename to lib/service/testdata/agent/proc/sqlite.db
diff --git a/integration/testdata/auth/backend/sqlite.db b/lib/service/testdata/auth/backend/sqlite.db
similarity index 100%
rename from integration/testdata/auth/backend/sqlite.db
rename to lib/service/testdata/auth/backend/sqlite.db
diff --git a/integration/testdata/auth/host_uuid b/lib/service/testdata/auth/host_uuid
similarity index 100%
rename from integration/testdata/auth/host_uuid
rename to lib/service/testdata/auth/host_uuid
diff --git a/integration/testdata/auth/proc/sqlite.db b/lib/service/testdata/auth/proc/sqlite.db
similarity index 100%
rename from integration/testdata/auth/proc/sqlite.db
rename to lib/service/testdata/auth/proc/sqlite.db
diff --git a/lib/services/access.go b/lib/services/access.go
index 283094851ae71..cd760988ebed0 100644
--- a/lib/services/access.go
+++ b/lib/services/access.go
@@ -21,6 +21,7 @@ package services
 import (
 	"context"
 	"fmt"
+	"iter"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -35,6 +36,8 @@ type LockGetter interface {
 	GetLock(ctx context.Context, name string) (types.Lock, error)
 	// GetLocks gets all/in-force locks that match at least one of the targets when specified.
 	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
+	ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error)
+	RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error]
 }
 
 // Access service manages roles and permissions.
diff --git a/lib/services/access_checker.go b/lib/services/access_checker.go
index 5ed8f1bcea19c..70f066476a572 100644
--- a/lib/services/access_checker.go
+++ b/lib/services/access_checker.go
@@ -29,9 +29,11 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/gravitational/teleport/api/constants"
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
@@ -273,6 +275,10 @@ type AccessChecker interface {
 	// EnumerateDatabaseNames specializes EnumerateEntities to enumerate db_names.
 	EnumerateDatabaseNames(database types.Database, extraNames ...string) EnumerationResult
 
+	// EnumerateMCPTools specializes EnumerateEntities to enumerate mcp.tools.
+	// mcp.tools support regexes and blobs so those expressions are returned.
+	EnumerateMCPTools(app types.Application) EnumerationResult
+
 	// GetAllowedLoginsForResource returns all of the allowed logins for the passed resource.
 	//
 	// Supports the following resource types:
@@ -296,6 +302,9 @@ type AccessChecker interface {
 // host SSH certificate, TLS certificate, or user information stored in the
 // backend.
 type AccessInfo struct {
+	// ScopePin is an optional pin that ties an identity to a specific scope and set of scoped roles. When
+	// set, the Roles field must not be set.
+	ScopePin *scopesv1.Pin
 	// Roles is the list of cluster local roles for the identity.
 	Roles []string
 	// Traits is the set of traits for the identity.
@@ -332,10 +341,31 @@ type accessChecker struct {
 //   - `access RoleGetter` should be a RoleGetter which will be used to fetch the
 //     full RoleSet
 func NewAccessChecker(info *AccessInfo, localCluster string, access RoleGetter) (AccessChecker, error) {
+	if info.ScopePin != nil {
+		return nil, trace.Errorf("cannot create standard access checker: %w", ErrScopedIdentity)
+	}
 	roleSet, err := FetchRoles(info.Roles, access, info.Traits)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	return newAccessChecker(info, localCluster, roleSet), nil
+}
+
+// NewAccessCheckerForUserSession is an alternative to NewAccessChecker that includes a UserSessionRoleNotFoundErrorMsg if
+// a role from the user's session is not found during the access check. This allows the Web UI to distinguish between
+// a user session role lookup error (which should prompt the user to re-login) vs. other role lookup
+// failures.
+func NewAccessCheckerForUserSession(info *AccessInfo, localCluster string, access RoleGetter) (AccessChecker, error) {
+	roleSet, err := FetchRoles(info.Roles, access, info.Traits)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			// Add the UserSessionRoleNotFoundErrorMsg message to indicate this role not found error was encountered fetching
+			// the user's session roles. This can only happen if the user's session certificate contains a role that no longer exists.
+			return nil, trace.Wrap(err, UserSessionRoleNotFoundErrorMsg)
+		}
+		return nil, trace.Wrap(err)
+	}
 	return &accessChecker{
 		info:         info,
 		localCluster: localCluster,
@@ -346,6 +376,10 @@ func NewAccessChecker(info *AccessInfo, localCluster string, access RoleGetter)
 // NewAccessCheckerWithRoleSet is similar to NewAccessChecker, but accepts the
 // full RoleSet rather than a RoleGetter.
 func NewAccessCheckerWithRoleSet(info *AccessInfo, localCluster string, roleSet RoleSet) AccessChecker {
+	return newAccessChecker(info, localCluster, roleSet)
+}
+
+func newAccessChecker(info *AccessInfo, localCluster string, roleSet RoleSet) *accessChecker {
 	return &accessChecker{
 		info:         info,
 		localCluster: localCluster,
@@ -367,6 +401,10 @@ type CurrentUserRoleGetter interface {
 // user's access to resources that may be located in remote/leaf Teleport
 // clusters.
 func NewAccessCheckerForRemoteCluster(ctx context.Context, localAccessInfo *AccessInfo, clusterName string, access CurrentUserRoleGetter) (AccessChecker, error) {
+	if localAccessInfo.ScopePin != nil {
+		return nil, trace.BadParameter("cannot create unscoped remote cluster AccessChecker based on scoped identity")
+	}
+
 	// Fetch the remote cluster's view of the current user's roles.
 	remoteRoles, err := access.GetCurrentUserRoles(ctx)
 	if err != nil {
@@ -427,14 +465,7 @@ func (a *accessChecker) checkAllowedResources(r AccessCheckable) error {
 	isLoggingEnabled := rbacLogger.Enabled(ctx, logutils.TraceLevel)
 
 	for _, resourceID := range a.info.AllowedResourceIDs {
-		if resourceID.ClusterName == a.localCluster &&
-			// If the allowed resource has `Kind=types.KindKubePod` or any other
-			// Kubernetes supported kinds - types.KubernetesResourcesKinds-, we allow the user to
-			// access the Kubernetes cluster that it belongs to.
-			// At this point, we do not verify that the accessed resource matches the
-			// allowed resources, but that verification happens in the caller function.
-			(resourceID.Kind == r.GetKind() || (slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) && r.GetKind() == types.KindKubernetesCluster)) &&
-			resourceID.Name == r.GetName() {
+		if resourceID.ClusterName == a.localCluster && matchesUCRResource(resourceID, r) {
 			// Allowed to access this resource by resource ID, move on to role checks.
 
 			if isLoggingEnabled {
@@ -466,6 +497,30 @@ func (a *accessChecker) checkAllowedResources(r AccessCheckable) error {
 	return trace.AccessDenied("access to %v denied, not in allowed resource IDs", r.GetKind())
 }
 
+// matchesUCRResource matches requested resource with its respective
+// resource type stored in the unified resource cache.
+func matchesUCRResource(requestedR types.ResourceID, r AccessCheckable) bool {
+	if requestedR.Name != r.GetName() {
+		return false
+	}
+	// If the allowed resource has `Kind=types.KindKubePod` or any other
+	// Kubernetes supported kinds - types.KubernetesResourcesKinds-, we allow the user to
+	// access the Kubernetes cluster that it belongs to.
+	// At this point, we do not verify that the accessed resource matches the
+	// allowed resources, but that verification happens in the caller function.
+	if slices.Contains(types.KubernetesResourcesKinds, requestedR.Kind) || strings.HasPrefix(requestedR.Kind, types.AccessRequestPrefixKindKube) {
+		return r.GetKind() == types.KindKubernetesCluster
+	}
+
+	// Identity Center account is stored as KindApp kind and
+	// KindIdentityCenterAccount subKind in the unified resource cache.
+	if requestedR.Kind == types.KindIdentityCenterAccount {
+		return r.GetKind() == types.KindApp && r.GetSubKind() == types.KindIdentityCenterAccount
+	}
+
+	return requestedR.Kind == r.GetKind()
+}
+
 // AccessInfo returns the AccessInfo that this access checker is based on.
 func (a *accessChecker) AccessInfo() *AccessInfo {
 	return a.info
@@ -516,7 +571,7 @@ func (a *accessChecker) GetKubeResources(cluster types.KubeCluster) (allowed, de
 		if elem.Kind == types.KindKubeNamespace {
 			allowedResourceIDs = append(allowedResourceIDs, types.ResourceID{
 				ClusterName:     elem.ClusterName,
-				Kind:            "namespaces",
+				Kind:            types.AccessRequestPrefixKindKubeClusterWide + "namespaces",
 				SubResourceName: elem.SubResourceName,
 				Name:            elem.Name,
 			})
@@ -532,14 +587,15 @@ func (a *accessChecker) GetKubeResources(cluster types.KubeCluster) (allowed, de
 			continue
 		}
 		switch {
-		case slices.Contains(types.KubernetesResourcesKinds, r.Kind):
+		case slices.Contains(types.KubernetesResourcesKinds, r.Kind) || strings.HasPrefix(r.Kind, types.AccessRequestPrefixKindKube):
 			namespace := ""
 			name := ""
-			// TODO(@creack): Make sure this gets handled in the AccessRequest PR.
-			if slices.Contains(types.KubernetesClusterWideResourceKinds, r.Kind) {
+			if slices.Contains(types.KubernetesClusterWideResourceKinds, r.Kind) || strings.HasPrefix(r.Kind, types.AccessRequestPrefixKindKubeClusterWide) {
 				// Cluster wide resources do not have a namespace.
 				name = r.SubResourceName
+				r.Kind = strings.TrimPrefix(r.Kind, types.AccessRequestPrefixKindKubeClusterWide)
 			} else {
+				r.Kind = strings.TrimPrefix(r.Kind, types.AccessRequestPrefixKindKubeNamespaced)
 				splitted := strings.SplitN(r.SubResourceName, "/", 3)
 				// This condition should never happen since SubResourceName is validated
 				// but it's better to validate it.
@@ -547,31 +603,44 @@ func (a *accessChecker) GetKubeResources(cluster types.KubeCluster) (allowed, de
 					continue
 				}
 				namespace = splitted[0]
+				// namespace * would also include cluster-wide resources, if we
+				// have a wildcard with a known namespaced resource, use a pattern
+				// that will not match cluster-wide resources.
+				if namespace == types.Wildcard {
+					namespace = "^.+$"
+				}
 				name = splitted[1]
 			}
 
-			// TODO(@creack): Find a better way. For now this only enables support for existing access requests.
-			// It doesnt support CRDs.
+			// Map legacy names to the new ones.
 			kind := types.KubernetesResourcesKindsPlurals[r.Kind]
 			if kind == "" {
 				kind = r.Kind
 			}
-			// NOTE: The 'namespace' behavior changed, to maintain backwards compatibility,
+			// NOTE: The kind 'namespace' behavior changed, to maintain backwards compatibility,
 			// map the legacy value to wildcard.
 			if r.Kind == types.KindKubeNamespace {
-				kind = types.Wildcard
+				// When requesting the legacy "namespace" kind, we include all api groups.
+				kind = types.Wildcard + "." + types.Wildcard
 				namespace = name
+				// namespace * would also include cluster-wide resources, if we
+				// have a wildcard with the legacy "namespace" kind, use a pattern
+				// that will not match cluster-wide resources.
 				if namespace == types.Wildcard {
-					namespace = "^" + types.Wildcard + "$"
+					namespace = "^.+$"
 				}
 				name = types.Wildcard
 			}
+
+			gk := schema.ParseGroupKind(kind)
+			if gk.Group == "" {
+				gk.Group = types.KubernetesResourcesV7KindGroups[r.Kind]
+			}
 			r := types.KubernetesResource{
-				Kind:      kind,
+				Kind:      gk.Kind,
 				Namespace: namespace,
 				Name:      name,
-				// TODO(@creack): Add support for CRDs in AccessRequests.
-				APIGroup: types.Wildcard,
+				APIGroup:  gk.Group,
 			}
 			// matchKubernetesResource checks if the Kubernetes Resource matches the tuple
 			// (kind, namespace, kame) from the allowed/denied list and does not match the resource
@@ -588,7 +657,7 @@ func (a *accessChecker) GetKubeResources(cluster types.KubeCluster) (allowed, de
 			return rolesAllowed, rolesDenied
 		}
 	}
-	return allowed, denied
+	return append(allowed, types.KubernetesResourceSelfSubjectAccessReview), denied
 }
 
 // matchKubernetesResource checks if the Kubernetes Resource does not match any
@@ -794,6 +863,26 @@ func (a *accessChecker) EnumerateDatabaseNames(database types.Database, extraNam
 	return a.EnumerateEntities(database, listFn, newMatcher, extraNames...)
 }
 
+// EnumerateMCPTools specializes EnumerateEntities to enumerate mcp.tools.
+func (a *accessChecker) EnumerateMCPTools(app types.Application) EnumerationResult {
+	listFn := func(role types.Role, condition types.RoleConditionType) []string {
+		if mcpSpec := role.GetMCPPermissions(condition); mcpSpec != nil {
+			return mcpSpec.Tools
+		}
+		return nil
+	}
+	// Do not use MCPToolMatcher. We are enumerating the expressions.
+	newMatcher := func(toolRegex string) RoleMatcher {
+		return RoleMatcherFunc(func(role types.Role, condition types.RoleConditionType) (bool, error) {
+			if mcpSpec := role.GetMCPPermissions(condition); mcpSpec != nil {
+				return slices.Contains(mcpSpec.Tools, toolRegex), nil
+			}
+			return false, nil
+		})
+	}
+	return a.EnumerateEntities(app, listFn, newMatcher)
+}
+
 // roleEntitiesListFn is used for listing a role's allowed/denied entities.
 type roleEntitiesListFn func(types.Role, types.RoleConditionType) []string
 
@@ -1027,9 +1116,7 @@ func (a *accessChecker) CheckAccessToRemoteCluster(rc types.RemoteCluster) error
 			slog.Any("error", err),
 			slog.Any("allow", labelMatchers),
 		)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+
 		if matchLabels {
 			return nil
 		}
@@ -1259,6 +1346,7 @@ func (a *accessChecker) HostSudoers(s types.Server) ([]string, error) {
 func AccessInfoFromLocalSSHIdentity(ident *sshca.Identity) *AccessInfo {
 	return &AccessInfo{
 		Username:           ident.Username,
+		ScopePin:           ident.ScopePin,
 		Roles:              ident.Roles,
 		Traits:             ident.Traits,
 		AllowedResourceIDs: ident.AllowedResourceIDs,
@@ -1269,6 +1357,10 @@ func AccessInfoFromLocalSSHIdentity(ident *sshca.Identity) *AccessInfo {
 // given remote cluster user's ssh identity. Remote roles will be mapped to
 // local roles based on the given roleMap.
 func AccessInfoFromRemoteSSHIdentity(unmappedIdentity *sshca.Identity, roleMap types.RoleMap) (*AccessInfo, error) {
+	if unmappedIdentity.ScopePin != nil {
+		return nil, trace.BadParameter("scope pinning is not supported for remote SSH identities")
+	}
+
 	// make a shallow copy of traits to avoid modifying the original
 	traits := make(map[string][]string, len(unmappedIdentity.Traits)+1)
 	for k, v := range unmappedIdentity.Traits {
@@ -1306,32 +1398,16 @@ func AccessInfoFromRemoteSSHIdentity(unmappedIdentity *sshca.Identity, roleMap t
 // AccessInfoFromLocalTLSIdentity returns a new AccessInfo populated from the given
 // tlsca.Identity. Should only be used for cluster local users as roles will not
 // be mapped.
-func AccessInfoFromLocalTLSIdentity(identity tlsca.Identity, access UserGetter) (*AccessInfo, error) {
-	roles := identity.Groups
-	traits := identity.Traits
-
-	// Legacy certs are not encoded with roles or traits,
-	// so we fallback to the traits and roles in the backend.
-	// empty traits are a valid use case in standard certs,
-	// so we only check for whether roles are empty.
-	if len(identity.Groups) == 0 {
-		u, err := access.GetUser(context.TODO(), identity.Username, false)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		const msg = "Failed to find roles in x509 identity. Fetching " +
-			"from backend. If the identity provider allows username changes, this can " +
-			"potentially allow an attacker to change the role of the existing user."
-		slog.WarnContext(context.Background(), msg, "username", identity.Username)
-		roles = u.GetRoles()
-		traits = u.GetTraits()
+func AccessInfoFromLocalTLSIdentity(identity tlsca.Identity) (*AccessInfo, error) {
+	if len(identity.Groups) == 0 && identity.ScopePin == nil {
+		return nil, trace.BadParameter("tls identity %q has no roles or scope pin, this may indicate a malformed certificate or one that was issued by an incompatible teleport version", identity.Username)
 	}
 
 	return &AccessInfo{
 		Username:           identity.Username,
-		Roles:              roles,
-		Traits:             traits,
+		ScopePin:           identity.ScopePin,
+		Roles:              identity.Groups,
+		Traits:             identity.Traits,
 		AllowedResourceIDs: identity.AllowedResourceIDs,
 	}, nil
 }
@@ -1340,6 +1416,10 @@ func AccessInfoFromLocalTLSIdentity(identity tlsca.Identity, access UserGetter)
 // given remote cluster user's tlsca.Identity. Remote roles will be mapped to
 // local roles based on the given roleMap.
 func AccessInfoFromRemoteTLSIdentity(identity tlsca.Identity, roleMap types.RoleMap) (*AccessInfo, error) {
+	if identity.ScopePin != nil {
+		return nil, trace.BadParameter("scope pinning is not supported for remote TLS identities")
+	}
+
 	// Set internal traits for the remote user. This allows Teleport to work by
 	// passing exact logins, Kubernetes users/groups, database users/names, and
 	// AWS Role ARNs to the remote cluster.
@@ -1389,8 +1469,8 @@ func AccessInfoFromRemoteTLSIdentity(identity tlsca.Identity, roleMap types.Role
 	}, nil
 }
 
-// UserState is a representation of a user's current state.
-type UserState interface {
+// UserAccessState is a representation of a user's current state required for calculating access.
+type UserAccessState interface {
 	// GetName returns the username associated with the user state.
 	GetName() string
 
@@ -1399,6 +1479,11 @@ type UserState interface {
 
 	// GetTraits returns the traits associated with the user's current sate.
 	GetTraits() map[string][]string
+}
+
+// UserState is a representation of a user's current state.
+type UserState interface {
+	UserAccessState
 
 	// GetUserType returns the user type for the user login state.
 	GetUserType() types.UserType
@@ -1419,12 +1504,22 @@ type UserState interface {
 // traits held be the given user state. This should only be used in cases where the
 // user does not have any active access requests (initial web login, initial
 // tbot certs, tests).
-func AccessInfoFromUserState(user UserState) *AccessInfo {
-	roles := user.GetRoles()
-	traits := user.GetTraits()
+func AccessInfoFromUserState(user UserAccessState) *AccessInfo {
+	return accessInfoFromUserState(user, user.GetRoles(), nil)
+}
+
+// ScopePinnedAccessInfoFromUserState returns a new AccessInfo populated from the
+// traits held by the user and the provided scope pin. Population/verification of the
+// scope pin must be performed prior to calling this function.
+func ScopePinnedAccessInfoFromUserState(user UserAccessState, pin *scopesv1.Pin) *AccessInfo {
+	return accessInfoFromUserState(user, nil, pin)
+}
+
+func accessInfoFromUserState(user UserAccessState, roles []string, pin *scopesv1.Pin) *AccessInfo {
 	return &AccessInfo{
 		Username: user.GetName(),
 		Roles:    roles,
-		Traits:   traits,
+		ScopePin: pin,
+		Traits:   user.GetTraits(),
 	}
 }
diff --git a/lib/services/access_checker_test.go b/lib/services/access_checker_test.go
index 35515a2224def..5a7e9486d77b7 100644
--- a/lib/services/access_checker_test.go
+++ b/lib/services/access_checker_test.go
@@ -19,9 +19,11 @@
 package services
 
 import (
+	"context"
 	"sort"
 	"testing"
 
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
@@ -233,7 +235,7 @@ func TestAccessCheckerKubeResources(t *testing.T) {
 					Name:      "dev",
 					Namespace: "dev",
 					Verbs:     []string{types.Wildcard},
-					APIGroup:  "*",
+					APIGroup:  "",
 				},
 			},
 			wantDenied:   emptySet,
@@ -372,7 +374,7 @@ func TestAccessCheckerKubeResources(t *testing.T) {
 					Name:      "dev",
 					Namespace: "dev",
 					Verbs:     []string{types.Wildcard},
-					APIGroup:  types.Wildcard,
+					APIGroup:  "",
 				},
 			},
 			wantDenied:   emptySet,
@@ -537,6 +539,10 @@ func TestAccessCheckerKubeResources(t *testing.T) {
 			tt.assertAccess(t, err)
 			sortKubeResourceSlice(gotAllowed)
 			sortKubeResourceSlice(gotDenied)
+			// The selfsubjectaccessrewview gets injected everywhere.
+			tt.wantAllowed = append(tt.wantAllowed, types.KubernetesResourceSelfSubjectAccessReview)
+			sortKubeResourceSlice(tt.wantAllowed)
+
 			require.EqualValues(t, tt.wantAllowed, gotAllowed)
 			require.EqualValues(t, tt.wantDenied, gotDenied)
 		})
@@ -902,3 +908,227 @@ func TestAccessCheckerWorkloadIdentity(t *testing.T) {
 		})
 	}
 }
+
+func TestIdentityCenterAccountAccessRequestMatcher(t *testing.T) {
+	const localCluster = "cluster"
+
+	tests := []struct {
+		info         *AccessInfo
+		name         string
+		resource     types.AppServerV3
+		assertAccess require.ErrorAssertionFunc
+	}{
+		{
+			name: "matches kind and subkind",
+			info: &AccessInfo{
+				AllowedResourceIDs: []types.ResourceID{
+					{
+						Kind:        types.KindIdentityCenterAccount,
+						ClusterName: localCluster,
+						Name:        "aws-dev",
+					},
+				},
+			},
+			resource: types.AppServerV3{
+				Kind:    types.KindApp,
+				SubKind: types.KindIdentityCenterAccount,
+				Metadata: types.Metadata{
+					Name: "aws-dev",
+				},
+			},
+			assertAccess: require.NoError,
+		},
+		{
+			name: "unmatched subkind",
+			info: &AccessInfo{
+				AllowedResourceIDs: []types.ResourceID{
+					{
+						Kind:        types.KindIdentityCenterAccount,
+						ClusterName: localCluster,
+						Name:        "aws-dev",
+					},
+				},
+			},
+			resource: types.AppServerV3{
+				Kind: types.KindApp,
+				Metadata: types.Metadata{
+					Name: "aws-dev",
+				},
+			},
+			assertAccess: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "not in allowed resource IDs")
+			},
+		},
+		{
+			name: "unmatched kind",
+			info: &AccessInfo{
+				AllowedResourceIDs: []types.ResourceID{
+					{
+						Kind:        types.KindIdentityCenterAccount,
+						ClusterName: localCluster,
+						Name:        "aws-dev",
+					},
+				},
+			},
+			resource: types.AppServerV3{
+				Kind:    types.KindAppSession,
+				SubKind: types.KindIdentityCenterAccount,
+				Metadata: types.Metadata{
+					Name: "aws-dev",
+				},
+			},
+			assertAccess: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "not in allowed resource IDs")
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			accessChecker := NewAccessCheckerWithRoleSet(tc.info, localCluster, NewRoleSet(newRole(func(rv *types.RoleV6) {})))
+			tc.assertAccess(t, accessChecker.CheckAccess(
+				&tc.resource,
+				AccessState{MFARequired: MFARequiredNever},
+			))
+		})
+	}
+}
+
+func TestAccessChecker_EnumerateMCPTools(t *testing.T) {
+	roleEmptyTools := newRole(func(rv *types.RoleV6) {
+		rv.SetName("empty")
+		rv.SetAppLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+	})
+	roleNoLabelsMatch := newRole(func(rv *types.RoleV6) {
+		rv.SetName("not-match")
+		rv.SetAppLabels(types.Allow, types.Labels{"env": []string{"prod"}})
+		rv.SetMCPPermissions(types.Allow, &types.MCPPermissions{
+			Tools: []string{"bar"},
+		})
+	})
+	roleAllowWildcard := newRole(func(rv *types.RoleV6) {
+		rv.SetName("dev")
+		rv.SetAppLabels(types.Allow, types.Labels{"env": []string{"dev"}})
+		rv.SetMCPPermissions(types.Allow, &types.MCPPermissions{
+			Tools: []string{"*"},
+		})
+	})
+	roleExplicitDeny := newRole(func(rv *types.RoleV6) {
+		rv.SetName("deny-bar")
+		rv.SetAppLabels(types.Allow, types.Labels{types.Wildcard: []string{types.Wildcard}})
+		rv.SetMCPPermissions(types.Deny, &types.MCPPermissions{
+			Tools: []string{"foo"},
+		})
+	})
+
+	mcpServer := &types.AppV3{
+		Kind: types.KindApp,
+		Metadata: types.Metadata{
+			Name: "mcp-everything",
+			Labels: map[string]string{
+				"env": "dev",
+			},
+		},
+	}
+
+	testCases := []struct {
+		name      string
+		roles     RoleSet
+		mcpServer types.Application
+		result    EnumerationResult
+	}{
+		{
+			name:      "no tools permission",
+			roles:     NewRoleSet(roleEmptyTools, roleNoLabelsMatch),
+			mcpServer: mcpServer,
+			result: EnumerationResult{
+				allowedDeniedMap: map[string]bool{},
+			},
+		},
+		{
+			name:      "allow wildcard, deny specific value",
+			roles:     NewRoleSet(roleAllowWildcard, roleExplicitDeny),
+			mcpServer: mcpServer,
+			result: EnumerationResult{
+				wildcardAllowed: true,
+				allowedDeniedMap: map[string]bool{
+					"foo": false,
+				},
+			},
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Run(tt.name, func(t *testing.T) {
+				accessChecker := makeAccessCheckerWithRoleSet(tt.roles)
+				enumResult := accessChecker.EnumerateMCPTools(tt.mcpServer)
+				require.Equal(t, tt.result, enumResult)
+			})
+		})
+	}
+}
+
+// TestUserSessionRoleNotFoundError ensures that role not found errors during user session access checks include UserSessionRoleNotFoundErrorMsg when appropriate,
+func TestUserSessionRoleNotFoundError(t *testing.T) {
+	// Create a mock RoleGetter that returns "role not found" error for a specific role
+	mockRoleGetter := &mockRoleGetter{
+		roles: map[string]types.Role{
+			"existing-role": newRole(func(rv *types.RoleV6) { rv.SetName("existing-role") }),
+		},
+	}
+
+	t.Run("NewAccessChecker with missing role does not add UserSessionRoleNotFoundErrorMsg", func(t *testing.T) {
+		accessInfo := &AccessInfo{
+			Roles: []string{"missing-role"},
+		}
+
+		_, err := NewAccessChecker(accessInfo, "cluster", mockRoleGetter)
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err))
+		require.Contains(t, err.Error(), "role missing-role is not found")
+		require.NotContains(t, err.Error(), UserSessionRoleNotFoundErrorMsg)
+	})
+
+	t.Run("NewAccessCheckerForUserSession with missing role adds UserSessionRoleNotFoundErrorMsg", func(t *testing.T) {
+		accessInfo := &AccessInfo{
+			Roles: []string{"missing-role"},
+		}
+
+		_, err := NewAccessCheckerForUserSession(accessInfo, "cluster", mockRoleGetter)
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err))
+		require.Contains(t, err.Error(), "role missing-role is not found")
+		require.Contains(t, err.Error(), UserSessionRoleNotFoundErrorMsg)
+	})
+
+	t.Run("NewAccessCheckerForUserSession with existing role succeeds", func(t *testing.T) {
+		accessInfo := &AccessInfo{
+			Roles: []string{"existing-role"},
+		}
+
+		checker, err := NewAccessCheckerForUserSession(accessInfo, "cluster", mockRoleGetter)
+		require.NoError(t, err)
+		require.NotNil(t, checker)
+	})
+}
+
+// mockRoleGetter implements RoleGetter for testing
+type mockRoleGetter struct {
+	roles map[string]types.Role
+}
+
+func (m *mockRoleGetter) GetRole(ctx context.Context, name string) (types.Role, error) {
+	if role, exists := m.roles[name]; exists {
+		return role, nil
+	}
+	// Return the same error format as the real implementation
+	return nil, trace.NotFound("role %v is not found", name)
+}
+
+func (m *mockRoleGetter) GetRoles(ctx context.Context) ([]types.Role, error) {
+	var roles []types.Role
+	for _, role := range m.roles {
+		roles = append(roles, role)
+	}
+	return roles, nil
+}
diff --git a/lib/services/access_list.go b/lib/services/access_list.go
index 73f1a47308956..ca7f8aaa8e6a7 100644
--- a/lib/services/access_list.go
+++ b/lib/services/access_list.go
@@ -20,13 +20,19 @@ package services
 
 import (
 	"context"
+	"encoding/base32"
+	"slices"
+	"strings"
 	"time"
 
+	"github.com/charlievieth/strcase"
 	"github.com/gravitational/trace"
+	"golang.org/x/text/cases"
 
 	accesslistclient "github.com/gravitational/teleport/api/client/accesslist"
 	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
 	"github.com/gravitational/teleport/api/types/accesslist"
+	"github.com/gravitational/teleport/lib/accesslists"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -40,12 +46,17 @@ type AccessListsGetter interface {
 	GetAccessLists(context.Context) ([]*accesslist.AccessList, error)
 	// ListAccessLists returns a paginated list of access lists.
 	ListAccessLists(context.Context, int, string) ([]*accesslist.AccessList, string, error)
+	// ListAccessListsV2 returns a filtered and sorted paginated list of access lists.
+	ListAccessListsV2(context.Context, *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error)
 	// GetAccessList returns the specified access list resource.
 	GetAccessList(context.Context, string) (*accesslist.AccessList, error)
 	// GetAccessListsToReview returns access lists that the user needs to review.
 	GetAccessListsToReview(context.Context) ([]*accesslist.AccessList, error)
 	// GetInheritedGrants returns grants inherited by access list accessListID from parent access lists.
 	GetInheritedGrants(context.Context, string) (*accesslist.Grants, error)
+	// ListUserAccessLists returns a paginated list of all access lists where the
+	// user is explicitly an owner or member.
+	ListUserAccessLists(context.Context, *accesslistv1.ListUserAccessListsRequest) ([]*accesslist.AccessList, string, error)
 }
 
 // AccessListsSuggestionsGetter defines an interface for reading access lists suggestions.
@@ -75,6 +86,43 @@ type AccessLists interface {
 	AccessRequestPromote(ctx context.Context, req *accesslistv1.AccessRequestPromoteRequest) (*accesslistv1.AccessRequestPromoteResponse, error)
 }
 
+// AccessListsInternal extends the public AccessList interface with internal-only
+// methods.
+type AccessListsInternal interface {
+	AccessLists
+
+	// UpdateAccessListAndOverwriteMembers conditionally updates the access list,
+	// overwriting the list's members if successful.
+	UpdateAccessListAndOverwriteMembers(context.Context, *accesslist.AccessList, []*accesslist.AccessListMember) (*accesslist.AccessList, []*accesslist.AccessListMember, error)
+
+	// CleanupAccessListStatus removes invalid Status.OwnerOf and Status.MemberOf references.
+	CleanupAccessListStatus(ctx context.Context, accessListName string) (*accesslist.AccessList, error)
+
+	// EnsureNestedAccessListStatuses goes over all nested owners and nested members of the named
+	// access list and ensures nested lists' statuses owner_of/member_of contain the access list name.
+	EnsureNestedAccessListStatuses(ctx context.Context, accessListName string) error
+
+	// InsertAccessListCollection inserts a complete collection of access lists and their members from a single
+	// upstream source (e.g. EntraID) using a batch operation for improved performance.
+	//
+	// This method is designed for bulk import scenarios where an entire access list collection needs to be
+	// synchronized from an external source. All access lists and members in the collection are
+	// inserted using chunked batch operations, minimizing memory allocation while still reducing
+	// the number of write operations. Due to the batch nature of this operation (access list hierarchy
+	// is known upfront), we can avoid per-access-list locking and global locks to improve performance.
+	//
+	// Important: This method assumes the collection is self-contained. Access lists in the collection
+	// cannot reference access lists outside the collection as members or owners. This is intentional for
+	// collections representing a complete snapshot from a single upstream source.
+	// The function should be used only once during initial import where
+	// we are sure that Teleport doesn't have any pre-existing access lists from the upstream and the
+	// internal relation between upstream access lists and internal access lists doesn't exist yet.
+	//
+	// Operation can fail due to backend shutdown. In that case, if partial state was created,
+	// use UpsertAccessListWithMembers/DeleteAccessListMember to reconcile to the desired state.
+	InsertAccessListCollection(ctx context.Context, collection *accesslists.Collection) error
+}
+
 // MarshalAccessList marshals the access list resource to JSON.
 func MarshalAccessList(accessList *accesslist.AccessList, opts ...MarshalOption) ([]byte, error) {
 	if err := accessList.CheckAndSetDefaults(); err != nil {
@@ -132,9 +180,6 @@ func (ImplicitAccessListError) Error() string {
 // AccessListMemberGetter defines an interface that can retrieve access list members.
 type AccessListMemberGetter interface {
 	// GetAccessListMember returns the specified access list member resource.
-	// May return a DynamicAccessListError if the requested access list has an
-	// implicit member list and the underlying implementation does not have
-	// enough information to compute the dynamic member record.
 	GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error)
 	// GetAccessList returns the specified access list resource.
 	GetAccessList(context.Context, string) (*accesslist.AccessList, error)
@@ -149,9 +194,6 @@ type AccessListMembersGetter interface {
 	// CountAccessListMembers will count all access list members.
 	CountAccessListMembers(ctx context.Context, accessListName string) (membersCount uint32, listCount uint32, err error)
 	// ListAccessListMembers returns a paginated list of all access list members.
-	// May return a DynamicAccessListError if the requested access list has an
-	// implicit member list and the underlying implementation does not have
-	// enough information to compute the dynamic member list.
 	ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
 	// ListAllAccessListMembers returns a paginated list of all access list members for all access lists.
 	ListAllAccessListMembers(ctx context.Context, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
@@ -276,3 +318,152 @@ func UnmarshalAccessListReview(data []byte, opts ...MarshalOption) (*accesslist.
 	}
 	return &review, nil
 }
+
+// CreateAccessListNextKey creates a pagination token based on the requested sort index name
+func CreateAccessListNextKey(al *accesslist.AccessList, indexName string) (string, error) {
+	switch indexName {
+	case "name":
+		return AccessListNameIndexKey(al), nil
+	case "auditNextDate":
+		return AccessListAuditDateIndexKey(al), nil
+	case "title":
+		return AccessListTitleIndexKey(al), nil
+	default:
+		return "", trace.BadParameter("unsupported sort %s but expected name, title or auditNextDate", indexName)
+	}
+}
+
+// AccessListNameIndexKey returns the resource name returned from GetName().
+func AccessListNameIndexKey(al *accesslist.AccessList) string {
+	return al.GetName()
+}
+
+// AccessListAuditDateIndexKey returns the DateOnly formatted next audit date
+// followed by the resource name for disambiguation.
+func AccessListAuditDateIndexKey(al *accesslist.AccessList) string {
+	if !al.IsReviewable() || al.Spec.Audit.NextAuditDate.IsZero() {
+		// Use last lexical character to ensure that ACLs without an audit date
+		// appear at the end when sorted. Otherwise we would compare against
+		// `0001-01-01 00:00:00` which would sort first, but actually means
+		// the access list is not eligible for review.
+		return "z/" + al.GetName()
+	}
+	return al.Spec.Audit.NextAuditDate.Format(time.DateOnly) + "/" + al.GetName()
+}
+
+// AccessListTitleIndexKey returns the access list title base32hex encoded
+// followed by the resource name for disambiguation.
+func AccessListTitleIndexKey(al *accesslist.AccessList) string {
+	title := cases.Fold().String(al.Spec.Title)
+	title = base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString([]byte(title))
+	return title + "/" + al.GetName()
+}
+
+// MatchAccessList returns true if the access list matches the given filter criteria.
+// The function applies filters in sequence: owners, then roles, then search.
+// All provided filters must match for the access list to be included.
+//
+//   - If owners filter is provided, the access list must have at least one matching owner
+//   - If roles filter is provided, the access list must grant at least one matching role
+//   - If search filter is provided, all search terms must be found across the access list's
+//     title, name, owner names, description, granted roles, and origin fields
+//
+// All matching is case-insensitive and supports partial matches.
+func MatchAccessList(al *accesslist.AccessList, req *accesslistv1.AccessListsFilter) bool {
+	if req == nil {
+		return true
+	}
+	search := req.GetSearch()
+	owners := req.GetOwners()
+	roles := req.GetRoles()
+	origin := req.GetOrigin()
+
+	if search == "" && len(owners) == 0 && len(roles) == 0 && origin == "" {
+		return true
+	}
+
+	// Step 1: Check owner filter if provided
+	if len(owners) > 0 {
+		ownerMatched := slices.ContainsFunc(owners, func(filterOwner string) bool {
+			return slices.ContainsFunc(al.Spec.Owners, func(alOwner accesslist.Owner) bool {
+				return strcase.Contains(alOwner.Name, filterOwner)
+			})
+		})
+		if !ownerMatched {
+			return false
+		}
+	}
+
+	// Step 2: Check role filter if provided
+	if len(roles) > 0 {
+		roleMatched := slices.ContainsFunc(roles, func(filterRole string) bool {
+			return slices.ContainsFunc(al.Spec.Grants.Roles, func(alRole string) bool {
+				return strcase.Contains(alRole, filterRole)
+			})
+		})
+		if !roleMatched {
+			return false
+		}
+	}
+
+	// Step 3: check the origin
+	if origin != "" && !strcase.Contains(al.Origin(), origin) {
+		return false
+	}
+
+	// Step 4: Check search filter if provided
+	if searchTerms := strings.Fields(search); len(searchTerms) > 0 {
+		// Check if all search terms are found across the access list fields
+		// without creating an intermediate slice
+		for _, term := range searchTerms {
+			termFound := false
+
+			// Check title
+			if strcase.Contains(al.Spec.Title, term) {
+				termFound = true
+			}
+
+			// Check name
+			if !termFound && strcase.Contains(al.GetName(), term) {
+				termFound = true
+			}
+
+			// Check description
+			if !termFound && strcase.Contains(al.Spec.Description, term) {
+				termFound = true
+			}
+
+			// Check origin
+			if !termFound && strcase.Contains(al.Origin(), term) {
+				termFound = true
+			}
+
+			// Check owner names
+			if !termFound {
+				for _, owner := range al.Spec.Owners {
+					if strcase.Contains(owner.Name, term) {
+						termFound = true
+						break
+					}
+				}
+			}
+
+			// Check roles
+			if !termFound {
+				for _, role := range al.Spec.Grants.Roles {
+					if strcase.Contains(role, term) {
+						termFound = true
+						break
+					}
+				}
+			}
+
+			// If this term wasn't found in any field, the search fails
+			if !termFound {
+				return false
+			}
+		}
+	}
+
+	return true
+}
diff --git a/lib/services/access_list_test.go b/lib/services/access_list_test.go
index b69074144981c..a2e79a6d4f9e1 100644
--- a/lib/services/access_list_test.go
+++ b/lib/services/access_list_test.go
@@ -25,6 +25,8 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/trait"
@@ -238,6 +240,153 @@ func TestAccessListReviewUnmarshal(t *testing.T) {
 	require.Equal(t, expected, actual)
 }
 
+func TestMatchAccessList(t *testing.T) {
+	al := &accesslist.AccessList{
+		Spec: accesslist.Spec{
+			Title:       "Production Database Access",
+			Description: "Access to production MySQL and PostgreSQL databases",
+			Owners: []accesslist.Owner{
+				{Name: "john.doe"},
+				{Name: "jane.smith"},
+			},
+			Grants: accesslist.Grants{
+				Roles: []string{"db-admin", "db-readonly", "backup-operator"},
+			},
+		},
+	}
+	al.SetName("prod-db-access")
+	al.SetOrigin(types.OriginOkta)
+
+	tests := []struct {
+		name     string
+		search   string
+		owners   []string
+		roles    []string
+		origin   string
+		expected bool
+	}{
+		{
+			name:     "empty search matches all",
+			expected: true,
+		},
+		{
+			name:     "whitespace only search matches all",
+			search:   "   ",
+			expected: true,
+		},
+		{
+			name:     "origin matches",
+			origin:   "okta",
+			expected: true,
+		},
+		{
+			name:     "origin does not match",
+			origin:   "teleport",
+			expected: false,
+		},
+		{
+			name:     "case insensitive title match",
+			search:   "database",
+			expected: true,
+		},
+		{
+			name:     "partial name match",
+			search:   "prod-db",
+			expected: true,
+		},
+		{
+			name:     "case insensitive owner match",
+			search:   "JANE",
+			expected: true,
+		},
+		{
+			name:     "case insensitive description match",
+			search:   "postgresql",
+			expected: true,
+		},
+		{
+			name:     "case insensitive role match",
+			search:   "BACKUP",
+			expected: true,
+		},
+		{
+			name:     "multiple terms all found",
+			search:   "Production db",
+			expected: true,
+		},
+		{
+			name:     "no match found",
+			search:   "nonexistent",
+			expected: false,
+		},
+		{
+			name:     "partial match but not all terms",
+			search:   "Production nonexistent",
+			expected: false,
+		},
+		{
+			name:     "single owner match",
+			owners:   []string{"john.doe"},
+			expected: true,
+		},
+		{
+			name:     "no owner match",
+			owners:   []string{"nonexistent.user"},
+			expected: false,
+		},
+		{
+			name:     "mixed owner match and no match",
+			owners:   []string{"john.doe", "nonexistent.user"},
+			expected: true,
+		},
+		{
+			name:     "single role match",
+			roles:    []string{"db-admin"},
+			expected: true,
+		},
+		{
+			name:     "no role match",
+			roles:    []string{"nonexistent-role"},
+			expected: false,
+		},
+		{
+			name:     "all filters match",
+			search:   "Production",
+			owners:   []string{"john.doe"},
+			roles:    []string{"db-admin"},
+			expected: true,
+		},
+		{
+			name:     "search matches but owner does not",
+			search:   "Production",
+			owners:   []string{"nonexistent.user"},
+			expected: false,
+		},
+		{
+			name:     "owner matches but search does not",
+			search:   "nonexistent",
+			owners:   []string{"john.doe"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filter := &accesslistv1.AccessListsFilter{
+				Search: tt.search,
+				Owners: tt.owners,
+				Roles:  tt.roles,
+				Origin: tt.origin,
+			}
+			result := MatchAccessList(al, filter)
+			if result != tt.expected {
+				t.Errorf("MatchAccessList(search: %q, owners: %v, roles: %v) = %v, want %v",
+					tt.search, tt.owners, tt.roles, result, tt.expected)
+			}
+		})
+	}
+}
+
 // TestAccessListReviewMarshal verifies a marshaled access list review resource can be unmarshaled back.
 func TestAccessListReviewMarshal(t *testing.T) {
 	expected, err := accesslist.NewAccessList(
@@ -356,6 +505,82 @@ spec:
   added_by: "test-user1"
 `
 
+func TestCreateAccessListNextKey(t *testing.T) {
+	al, err := accesslist.NewAccessList(
+		header.Metadata{
+			Name: "test-access-list",
+		},
+		accesslist.Spec{
+			Title: "zephyr",
+			Audit: accesslist.Audit{
+				NextAuditDate: time.Date(2025, 9, 11, 0, 0, 0, 0, time.UTC),
+			},
+		},
+	)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		indexName     string
+		expected      string
+		expectError   bool
+		withNoAudit   bool
+		notReviewable bool
+	}{
+		{
+			name:      "name index",
+			indexName: "name",
+			expected:  "test-access-list",
+		},
+		{
+			name:      "auditNextDate index",
+			indexName: "auditNextDate",
+			expected:  "2025-09-11/test-access-list",
+		},
+		{
+			name:        "auditNextDate index without review",
+			indexName:   "auditNextDate",
+			expected:    "z/test-access-list",
+			withNoAudit: true,
+		},
+		{
+			name:          "auditNextDate non-reviewable",
+			indexName:     "auditNextDate",
+			expected:      "z/test-access-list",
+			notReviewable: true,
+		},
+		{
+			name:      "title index",
+			indexName: "title",
+			expected:  "F9IN0Q3PE8/test-access-list",
+		},
+		{
+			name:        "unsupported index",
+			indexName:   "unsupported",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.withNoAudit {
+				al.Spec.Audit.NextAuditDate = time.Time{}
+			}
+			if tt.notReviewable {
+				al.Spec.Type = accesslist.Static
+			}
+			result, err := CreateAccessListNextKey(al, tt.indexName)
+			if tt.expectError {
+				require.Error(t, err)
+				require.True(t, trace.IsBadParameter(err))
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expected, result)
+			}
+		})
+	}
+}
+
 var accessListReviewYAML = `---
 kind: access_list_review
 version: v1
diff --git a/lib/services/access_monitoring_rules.go b/lib/services/access_monitoring_rules.go
index 0c3fdf97fdc97..baf4f1704b4da 100644
--- a/lib/services/access_monitoring_rules.go
+++ b/lib/services/access_monitoring_rules.go
@@ -21,6 +21,8 @@ package services
 import (
 	"context"
 	"slices"
+	"time"
+	_ "time/tzdata"
 
 	"github.com/gravitational/trace"
 
@@ -93,6 +95,10 @@ func ValidateAccessMonitoringRule(accessMonitoringRule *accessmonitoringrulesv1.
 		return trace.BadParameter("accessMonitoringRule condition is missing")
 	}
 
+	if err := validateSchedules(accessMonitoringRule.GetSpec().GetSchedules()); err != nil {
+		return trace.Wrap(err, "validating spec.schedules")
+	}
+
 	if accessMonitoringRule.Spec.Notification != nil && accessMonitoringRule.Spec.Notification.Name == "" {
 		return trace.BadParameter("accessMonitoringRule notification plugin name is missing")
 	}
@@ -137,6 +143,57 @@ func ValidateAccessMonitoringRule(accessMonitoringRule *accessmonitoringrulesv1.
 	return nil
 }
 
+func validateSchedules(schedules map[string]*accessmonitoringrulesv1.Schedule) error {
+	for name, schedule := range schedules {
+		if schedule.GetTime() == nil {
+			return trace.BadParameter("spec.schedules[%s].time is required", name)
+		}
+
+		if err := validateTimeSchedule(schedule.GetTime()); err != nil {
+			return trace.Wrap(err, "validating spec.schedules[%s].time", name)
+		}
+	}
+	return nil
+}
+
+func validateTimeSchedule(schedule *accessmonitoringrulesv1.TimeSchedule) error {
+	if _, err := time.LoadLocation(schedule.GetTimezone()); err != nil {
+		return trace.Wrap(err, "invalid timezone: refer to the IANA Time Zone Database for valid options")
+	}
+
+	if len(schedule.GetShifts()) == 0 {
+		return trace.BadParameter("at least one shift is required")
+	}
+
+	for _, shift := range schedule.GetShifts() {
+		if err := validateShift(shift); err != nil {
+			return trace.Wrap(err, "shift is invalid")
+		}
+	}
+	return nil
+}
+
+func validateShift(shift *accessmonitoringrulesv1.TimeSchedule_Shift) error {
+	if _, ok := types.ParseWeekday(shift.GetWeekday()); !ok {
+		return trace.BadParameter("failed to parse weekday: %v", shift.GetWeekday())
+	}
+
+	start, err := accessmonitoring.ClockTime(time.Time{}, shift.GetStart())
+	if err != nil {
+		return trace.Wrap(err, "invalid start time")
+	}
+
+	end, err := accessmonitoring.ClockTime(time.Time{}, shift.GetEnd())
+	if err != nil {
+		return trace.Wrap(err, "invalid end time")
+	}
+
+	if !start.Before(end) {
+		return trace.BadParameter("start time must be before end time")
+	}
+	return nil
+}
+
 // MarshalAccessMonitoringRule marshals AccessMonitoringRule resource to JSON.
 func MarshalAccessMonitoringRule(accessMonitoringRule *accessmonitoringrulesv1.AccessMonitoringRule, opts ...MarshalOption) ([]byte, error) {
 	return FastMarshalProtoResourceDeprecated(accessMonitoringRule, opts...)
diff --git a/lib/services/access_monitoring_rules_test.go b/lib/services/access_monitoring_rules_test.go
index 7290eb2e024d1..d666d2523ce5f 100644
--- a/lib/services/access_monitoring_rules_test.go
+++ b/lib/services/access_monitoring_rules_test.go
@@ -20,6 +20,7 @@ package services
 
 import (
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
@@ -124,6 +125,25 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 			},
 			assertErr: require.NoError,
 		},
+		{
+			description: "valid time schedule",
+			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
+				amr.Spec.Schedules = map[string]*accessmonitoringrulesv1.Schedule{
+					"default": {
+						Time: &accessmonitoringrulesv1.TimeSchedule{
+							Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+								{
+									Weekday: time.Monday.String(),
+									Start:   "00:00",
+									End:     "23:59",
+								},
+							},
+						},
+					},
+				}
+			},
+			assertErr: require.NoError,
+		},
 	}
 
 	validAMR := &accessmonitoringrulesv1.AccessMonitoringRule{
@@ -146,6 +166,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
+			t.Parallel()
 			amr, ok := proto.Clone(validAMR).(*accessmonitoringrulesv1.AccessMonitoringRule)
 			require.True(t, ok)
 
@@ -156,3 +177,195 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateSchedules(t *testing.T) {
+	tests := []struct {
+		description string
+		schedules   map[string]*accessmonitoringrulesv1.Schedule
+		assertErr   require.ErrorAssertionFunc
+	}{
+		{
+			description: "valid schedules",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "multiple schedules",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"on-call-1": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Saturday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+				"on-call-2": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Sunday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "schedule time not specified",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {},
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "time is required")
+			},
+		},
+		{
+			description: "does not contain any shifts",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "at least one shift is require")
+			},
+		},
+		{
+			description: "valid timezone (UTC)",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "UTC",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "valid timezone (America/Los_Angeles)",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "America/Los_Angeles",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "valid timezone (Europe/Lisbon)",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "Europe/Lisbon",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "valid timezone (Asia/Singapore)",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "Asia/Singapore",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: require.NoError,
+		},
+		{
+			description: "invalid timezone",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Timezone: "invalid",
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "00:00",
+								End:     "23:59",
+							},
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "invalid timezone")
+			},
+		},
+		{
+			description: "start time is not before end time",
+			schedules: map[string]*accessmonitoringrulesv1.Schedule{
+				"default": {
+					Time: &accessmonitoringrulesv1.TimeSchedule{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+							{
+								Weekday: time.Monday.String(),
+								Start:   "23:59",
+								End:     "00:00",
+							},
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.ErrorContains(t, err, "start time must be before end time")
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			t.Parallel()
+			test.assertErr(t, validateSchedules(test.schedules))
+		})
+	}
+}
diff --git a/lib/services/access_request.go b/lib/services/access_request.go
index e1700cd95b995..5b6fe9dfe75fb 100644
--- a/lib/services/access_request.go
+++ b/lib/services/access_request.go
@@ -31,6 +31,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/accessrequest"
@@ -66,6 +67,11 @@ const (
 	// `request.kubernetes_resources` config. It's also used to determine if a returned error
 	// contains this string (in tests and tsh) to customize error messages shown to user.
 	InvalidKubernetesKindAccessRequest = `your Teleport role's "request.kubernetes_resources" field`
+
+	// CannotRequestRole is used in error messages when a user attempts to request
+	// a role they are not allowed to use. It is also checked in returned errors
+	// (in tests and tsh) to customize the error message shown to the user.
+	CannotRequestRole = "can not request role"
 )
 
 // ValidateAccessRequest validates the AccessRequest and sets default values
@@ -181,6 +187,7 @@ type DynamicAccess interface {
 // actors with limited privileges.
 type DynamicAccessOracle interface {
 	GetAccessCapabilities(ctx context.Context, req types.AccessCapabilitiesRequest) (*types.AccessCapabilities, error)
+	GetRemoteAccessCapabilities(ctx context.Context, req types.RemoteAccessCapabilitiesRequest) (*types.RemoteAccessCapabilities, error)
 }
 
 func shouldFilterRequestableRolesByResource(a RequestValidatorGetter, req types.AccessCapabilitiesRequest) (bool, error) {
@@ -215,7 +222,7 @@ func CalculateAccessCapabilities(ctx context.Context, clock clockwork.Clock, clt
 	var caps types.AccessCapabilities
 	// all capabilities require use of a request validator.  calculating suggested reviewers
 	// requires that the validator be configured for variable expansion.
-	v, err := newRequestValidator(ctx, clock, clt, req.User, WithExpandVars(req.SuggestedReviewers))
+	v, err := NewRequestValidator(ctx, clock, clt, req.User, WithExpandVars(req.SuggestedReviewers))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -254,7 +261,35 @@ func CalculateAccessCapabilities(ctx context.Context, clock clockwork.Clock, clt
 	return &caps, nil
 }
 
-func (v *requestValidator) calcRequireReasonCap(ctx context.Context, req types.AccessCapabilitiesRequest, caps types.AccessCapabilities) (requireReason bool, err error) {
+// PruneMappedSearchAsRoles calculates the roles required to access the given
+// resources based on the supplied set of `search_as` roles.
+func PruneMappedSearchAsRoles(ctx context.Context, clock clockwork.Clock, getter RequestValidatorGetter, mappedUser UserState, mappedSearchAsRoles []string, resources []types.ResourceID, loginHint string) ([]string, error) {
+	clusterNameResource, err := getter.GetClusterName(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	localClusterName := clusterNameResource.GetClusterName()
+
+	hasRemoteResources := slices.ContainsFunc(resources,
+		func(rID types.ResourceID) bool { return rID.ClusterName != localClusterName })
+	if hasRemoteResources {
+		return nil, trace.BadParameter("request must only contain resources in local cluster")
+	}
+
+	rv, err := NewRequestValidatorForUser(ctx, clock, getter, mappedUser)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	roles, err := rv.pruneResourceRequestRoles(ctx, resources, loginHint, mappedSearchAsRoles)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return roles, nil
+}
+
+func (v *RequestValidator) calcRequireReasonCap(ctx context.Context, req types.AccessCapabilitiesRequest, caps types.AccessCapabilities) (requireReason bool, err error) {
 	var roles []string
 	if req.RequestableRoles {
 		roles = caps.RequestableRoles
@@ -273,7 +308,7 @@ func (v *requestValidator) calcRequireReasonCap(ctx context.Context, req types.A
 // allowedSearchAsRoles returns all allowed `allow.request.search_as_roles` for the user that are
 // not in the `deny.request.search_as_roles`. It does not filter out any roles that should not be
 // allowed based on requests.
-func (m *requestValidator) allowedSearchAsRoles() ([]string, error) {
+func (m *RequestValidator) allowedSearchAsRoles() ([]string, error) {
 	var rolesToRequest []string
 	for _, roleName := range m.roles.allowSearch {
 		if !m.canSearchAsRole(roleName) {
@@ -292,7 +327,7 @@ func (m *requestValidator) allowedSearchAsRoles() ([]string, error) {
 // applicable for the given list of resourceIDs.
 //
 // If loginHint is provided, it will attempt to prune the list to a single role.
-func (m *requestValidator) applicableSearchAsRoles(ctx context.Context, resourceIDs []types.ResourceID, loginHint string) ([]string, error) {
+func (m *RequestValidator) applicableSearchAsRoles(ctx context.Context, resourceIDs []types.ResourceID, loginHint string) ([]string, error) {
 	rolesToRequest, err := m.allowedSearchAsRoles()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -438,14 +473,14 @@ func ApplyAccessReview(req types.AccessRequest, rev types.AccessReview, author U
 		return trace.Wrap(err)
 	}
 
+	// set threshold indexes
+	rev.ThresholdIndexes = tids
+
 	// set a review created time if not already set
 	if rev.Created.IsZero() {
 		rev.Created = time.Now()
 	}
 
-	// set threshold indexes
-	rev.ThresholdIndexes = tids
-
 	// Resolved requests should not be updated.
 	switch {
 	case req.GetState().IsApproved():
@@ -769,10 +804,10 @@ type RequestValidatorGetter interface {
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 }
 
-// appendRoleMatchers constructs all role matchers for a given
+// AppendRoleMatchers constructs all role matchers for a given
 // AccessRequestConditions instance and appends them to the
 // supplied matcher slice.
-func appendRoleMatchers(matchers []parse.Matcher, roles []string, cms []types.ClaimMapping, traits map[string][]string) ([]parse.Matcher, error) {
+func AppendRoleMatchers(matchers []parse.Matcher, roles []string, cms []types.ClaimMapping, traits map[string][]string) ([]parse.Matcher, error) {
 	// build matchers for the role list
 	for _, r := range roles {
 		m, err := parse.NewMatcher(r)
@@ -1011,12 +1046,12 @@ func (c *ReviewPermissionChecker) push(role types.Role) error {
 
 	var err error
 
-	c.Roles.DenyReview[deny.Where], err = appendRoleMatchers(c.Roles.DenyReview[deny.Where], deny.Roles, deny.ClaimsToRoles, c.UserState.GetTraits())
+	c.Roles.DenyReview[deny.Where], err = AppendRoleMatchers(c.Roles.DenyReview[deny.Where], deny.Roles, deny.ClaimsToRoles, c.UserState.GetTraits())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	c.Roles.AllowReview[allow.Where], err = appendRoleMatchers(c.Roles.AllowReview[allow.Where], allow.Roles, allow.ClaimsToRoles, c.UserState.GetTraits())
+	c.Roles.AllowReview[allow.Where], err = AppendRoleMatchers(c.Roles.AllowReview[allow.Where], allow.Roles, allow.ClaimsToRoles, c.UserState.GetTraits())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1030,7 +1065,7 @@ func (c *ReviewPermissionChecker) push(role types.Role) error {
 // relevant rules, performs variable substitutions, and builds
 // a set of simple Allow/Deny datastructures.  These, in turn,
 // are used to validate and expand the access request.
-type requestValidator struct {
+type RequestValidator struct {
 	logger    *slog.Logger
 	clock     clockwork.Clock
 	opts      ValidateRequestOptions
@@ -1053,6 +1088,10 @@ type requestValidator struct {
 	// in spec.allow.request.roles and spec.allow.request.search_as_roles as roles requiring
 	// reason.
 	requiringReasonRoles map[string]struct{}
+	// customPromptRoles is a set of role names, which specifies a custom prompt when requested.
+	// Such roles are all requestable roles and search_as_roles allowed by a user's role
+	// which has spec.allow.request.reason.prompt set.
+	customPromptRoles map[string]string
 	// reasonPrompts are the prompts to be displayed in the UI for the reason input box. In the
 	// case of auto-request only the first prompt is displayed for backward compatibility.
 	reasonPrompts []string
@@ -1090,20 +1129,28 @@ type requestValidator struct {
 	}
 }
 
-// newRequestValidator configures a new RequestValidator for the specified user.
-func newRequestValidator(ctx context.Context, clock clockwork.Clock, getter RequestValidatorGetter, username string, opts ...ValidateRequestOption) (requestValidator, error) {
+// NewRequestValidator configures a new RequestValidator for the specified user.
+func NewRequestValidator(ctx context.Context, clock clockwork.Clock, getter RequestValidatorGetter, username string, opts ...ValidateRequestOption) (RequestValidator, error) {
 	uls, err := GetUserOrLoginState(ctx, getter, username)
 	if err != nil {
-		return requestValidator{}, trace.Wrap(err)
+		return RequestValidator{}, trace.Wrap(err)
 	}
 
-	m := requestValidator{
-		logger:    slog.With(teleport.ComponentKey, "request.validator"),
-		clock:     clock,
-		getter:    getter,
-		userState: uls,
+	v, err := NewRequestValidatorForUser(ctx, clock, getter, uls, opts...)
+	if err != nil {
+		return RequestValidator{}, trace.Wrap(err)
+	}
+	return v, nil
+}
 
+func NewRequestValidatorForUser(ctx context.Context, clock clockwork.Clock, getter RequestValidatorGetter, user UserState, opts ...ValidateRequestOption) (RequestValidator, error) {
+	m := RequestValidator{
+		logger:               slog.With(teleport.ComponentKey, "request.validator"),
+		clock:                clock,
+		getter:               getter,
+		userState:            user,
 		requiringReasonRoles: make(map[string]struct{}),
+		customPromptRoles:    make(map[string]string),
 	}
 	for _, opt := range opts {
 		opt(&m.opts)
@@ -1123,12 +1170,14 @@ func newRequestValidator(ctx context.Context, clock clockwork.Clock, getter Requ
 	for _, roleName := range m.userState.GetRoles() {
 		role, err := m.getter.GetRole(ctx, roleName)
 		if err != nil {
-			return requestValidator{}, trace.Wrap(err)
+			return RequestValidator{}, trace.Wrap(err)
 		}
 		if err := m.push(ctx, role); err != nil {
-			return requestValidator{}, trace.Wrap(err)
+			return RequestValidator{}, trace.Wrap(err)
 		}
 	}
+	// we retain a fixed order of global reason prompts for determinism of auto-request
+	// backward compatibility (only the first prompt is displayed for auto-requests)
 	slices.Sort(m.reasonPrompts)
 
 	return m, nil
@@ -1143,7 +1192,7 @@ func newRequestValidator(ctx context.Context, clock clockwork.Clock, getter Requ
 //
 // When requestValidator.opts.expandVars is true and req.GetDryRun() is true, it adds expanded
 // dry-run enrichment data to the request.
-func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest, identity tlsca.Identity) error {
+func (m *RequestValidator) validate(ctx context.Context, req types.AccessRequest, identity tlsca.Identity) error {
 	if m.userState.GetName() != req.GetUser() {
 		return trace.BadParameter("request validator configured for different user (this is a bug)")
 	}
@@ -1152,6 +1201,8 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 		return trace.BadParameter("only promoted requests can set the promoted access list title")
 	}
 
+	// TODO(kiosion): As part of Reviewer changes for long-term requests, roles, expiry, maxDur should not be allowed to be set.
+
 	// check for "wildcard request" (`roles=*`).  wildcard requests
 	// need to be expanded into a list consisting of all existing roles
 	// that the user does not hold and is allowed to request.
@@ -1181,10 +1232,18 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 	}
 
 	enrichment := &types.AccessRequestDryRunEnrichment{
-		ReasonMode:    types.RequestReasonModeOptional,
-		ReasonPrompts: m.reasonPrompts, // prompt is calculated in newRequestValidator
+		ReasonMode: types.RequestReasonModeOptional,
 	}
 
+	// populate the custom reason prompts: both from global prompts (spec.options.request_prompt) and
+	// from role/resource specific prompts (spec.allow.request.reason.prompt)
+	if err := m.populateCustomReasonPrompts(ctx, req.GetRoles(), req.GetRequestedResourceIDs()); err != nil {
+		return trace.Wrap(err)
+	}
+	// retain a deterministic order of reason prompts
+	slices.Sort(m.reasonPrompts)
+	enrichment.ReasonPrompts = m.reasonPrompts
+
 	switch {
 	// for dry-run, store the reason requirement in the enrichment data
 	case req.GetDryRun():
@@ -1202,7 +1261,11 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 			return trace.Wrap(err)
 		}
 		if required {
-			return trace.BadParameter("%s", explanation)
+			promptString := ""
+			if len(m.reasonPrompts) > 0 {
+				promptString = "\n" + strings.Join(m.reasonPrompts, "\n")
+			}
+			return trace.BadParameter("%s%s", explanation, promptString)
 		}
 	}
 
@@ -1213,11 +1276,11 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 				// Roles are normally determined automatically for resource
 				// access requests, this role must have been explicitly
 				// requested, or a new deny rule has since been added.
-				return trace.BadParameter("user %q can not request role %q", req.GetUser(), roleName)
+				return trace.BadParameter("user %q %s %q", req.GetUser(), CannotRequestRole, roleName)
 			}
 		} else {
-			if !m.canRequestRole(roleName) {
-				return trace.BadParameter("user %q can not request role %q", req.GetUser(), roleName)
+			if !m.CanRequestRole(roleName) {
+				return trace.BadParameter("user %q %s %q", req.GetUser(), CannotRequestRole, roleName)
 			}
 		}
 	}
@@ -1299,6 +1362,8 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 		// Pin the time to the current time to prevent time drift.
 		now := m.clock.Now().UTC()
 
+		// TODO(kiosion): The following logic shouldn't be relevant for long-term requests, post-Reviewer-changes.
+
 		// Calculate the expiration time of the elevated certificate that will
 		// be issued if the Access Request is approved.
 		sessionTTL, err := m.sessionTTL(ctx, identity, req, now)
@@ -1355,17 +1420,49 @@ func (m *requestValidator) validate(ctx context.Context, req types.AccessRequest
 }
 
 // isReasonRequired checks if the reason is required for the given roles and resource IDs.
-func (v *requestValidator) isReasonRequired(ctx context.Context, requestedRoles []string, requestedResourceIDs []types.ResourceID) (required bool, explanation string, err error) {
+func (v *RequestValidator) isReasonRequired(ctx context.Context, requestedRoles []string, requestedResourceIDs []types.ResourceID) (required bool, explanation string, err error) {
 	if v.requireReasonForAllRoles {
 		return true, "request reason must be specified (required request_access option in one of the roles)", nil
 	}
 
-	allApplicableRoles := requestedRoles
+	allApplicableRoles, err := v.getAllApplicableRoles(ctx, requestedRoles, requestedResourceIDs)
+	if err != nil {
+		return false, "", trace.Wrap(err)
+	}
+
+	for _, r := range allApplicableRoles {
+		if _, ok := v.requiringReasonRoles[r]; ok {
+			return true, fmt.Sprintf("request reason must be specified (required for role %q)", r), nil
+		}
+	}
+
+	return false, "", nil
+}
+
+func (v *RequestValidator) populateCustomReasonPrompts(ctx context.Context, requestedRoles []string, requestedResourceIDs []types.ResourceID) error {
+	allApplicableRoles, err := v.getAllApplicableRoles(ctx, requestedRoles, requestedResourceIDs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, r := range allApplicableRoles {
+		customPrompt, ok := v.customPromptRoles[r]
+		if ok && !slices.Contains(v.reasonPrompts, customPrompt) {
+			v.reasonPrompts = append(v.reasonPrompts, customPrompt)
+		}
+	}
+
+	return nil
+}
+
+// getAllApplicableRoles returns the combined roles for the given roles and resource IDs (search_as_roles)
+func (v *RequestValidator) getAllApplicableRoles(ctx context.Context, requestedRoles []string, requestedResourceIDs []types.ResourceID) (allApplicableRoles []string, err error) {
+	allApplicableRoles = requestedRoles
 	if len(requestedResourceIDs) > 0 {
 		// Do not provide loginHint. We want all matching search_as_roles for those resources.
 		roles, err := v.applicableSearchAsRoles(ctx, requestedResourceIDs, "")
 		if err != nil {
-			return false, "", trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		if len(allApplicableRoles) == 0 {
 			allApplicableRoles = roles
@@ -1374,19 +1471,13 @@ func (v *requestValidator) isReasonRequired(ctx context.Context, requestedRoles
 		}
 	}
 
-	for _, r := range allApplicableRoles {
-		if _, ok := v.requiringReasonRoles[r]; ok {
-			return true, fmt.Sprintf("request reason must be specified (required for role %q)", r), nil
-		}
-	}
-
-	return false, "", nil
+	return allApplicableRoles, nil
 }
 
 // calculateMaxAccessDuration calculates the maximum time for the access request.
 // The max duration time is the minimum of the max_duration time set on the request
 // and the max_duration time set on the request role.
-func (m *requestValidator) calculateMaxAccessDuration(req types.AccessRequest, sessionTTL time.Duration) (time.Duration, error) {
+func (m *RequestValidator) calculateMaxAccessDuration(req types.AccessRequest, sessionTTL time.Duration) (time.Duration, error) {
 	// Check if the maxDuration time is set.
 	maxDurationTime := req.GetMaxDuration()
 	maxDuration := maxDurationTime.Sub(req.GetCreationTime())
@@ -1427,7 +1518,7 @@ func (m *requestValidator) calculateMaxAccessDuration(req types.AccessRequest, s
 	return minAdjDuration, nil
 }
 
-func (m *requestValidator) maxDurationForRole(roleName string) time.Duration {
+func (m *RequestValidator) maxDurationForRole(roleName string) time.Duration {
 	var maxDurationForRole time.Duration
 	for _, tms := range m.maxDurationMatchers {
 		for _, matcher := range tms.matchers {
@@ -1444,7 +1535,7 @@ func (m *requestValidator) maxDurationForRole(roleName string) time.Duration {
 // calculatePendingRequestTTL calculates the TTL of the Access Request (how long it will await
 // approval). request TTL is capped to the smaller value between the const requestTTL and the
 // access request access expiry.
-func (m *requestValidator) calculatePendingRequestTTL(r types.AccessRequest, now time.Time) (time.Duration, error) {
+func (m *RequestValidator) calculatePendingRequestTTL(r types.AccessRequest, now time.Time) (time.Duration, error) {
 	accessExpiryTTL := r.GetAccessExpiry().Sub(now)
 
 	// If no expiration provided, use default.
@@ -1480,7 +1571,7 @@ func (m *requestValidator) calculatePendingRequestTTL(r types.AccessRequest, now
 
 // sessionTTL calculates the TTL of the elevated certificate that will be issued
 // if the Access Request is approved.
-func (m *requestValidator) sessionTTL(ctx context.Context, identity tlsca.Identity, r types.AccessRequest, now time.Time) (time.Duration, error) {
+func (m *RequestValidator) sessionTTL(ctx context.Context, identity tlsca.Identity, r types.AccessRequest, now time.Time) (time.Duration, error) {
 	ttl, err := m.truncateTTL(ctx, identity, r.GetAccessExpiry(), r.GetRoles(), now)
 	if err != nil {
 		return 0, trace.BadParameter("invalid session TTL: %v", err)
@@ -1499,7 +1590,7 @@ func (m *requestValidator) sessionTTL(ctx context.Context, identity tlsca.Identi
 
 // truncateTTL will truncate given expiration by identity expiration and
 // shortest session TTL of any role.
-func (m *requestValidator) truncateTTL(ctx context.Context, identity tlsca.Identity, expiry time.Time, roles []string, now time.Time) (time.Duration, error) {
+func (m *RequestValidator) truncateTTL(ctx context.Context, identity tlsca.Identity, expiry time.Time, roles []string, now time.Time) (time.Duration, error) {
 	ttl := apidefaults.MaxCertDuration
 
 	// Reduce by remaining TTL on requesting certificate (identity).
@@ -1534,7 +1625,7 @@ func (m *requestValidator) truncateTTL(ctx context.Context, identity tlsca.Ident
 
 // getResourceViewingRoles gets the subset of the user's roles that could be used
 // to view resources (i.e., base roles + search as roles).
-func (m *requestValidator) getResourceViewingRoles() []string {
+func (m *RequestValidator) getResourceViewingRoles() []string {
 	roles := slices.Clone(m.userState.GetRoles())
 	for _, role := range m.roles.allowSearch {
 		if m.canSearchAsRole(role) {
@@ -1550,7 +1641,7 @@ func (m *requestValidator) getResourceViewingRoles() []string {
 // when checking against a known role list. If resource IDs or a login hints
 // are provided, roles will be filtered to only include those that would
 // allow access to the given resource with the given login.
-func (m *requestValidator) getRequestableRoles(ctx context.Context, identity tlsca.Identity, resourceIDs []types.ResourceID, loginHint string) ([]string, error) {
+func (m *RequestValidator) getRequestableRoles(ctx context.Context, identity tlsca.Identity, resourceIDs []types.ResourceID, loginHint string) ([]string, error) {
 	allRoles, err := m.getter.GetRoles(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1586,7 +1677,7 @@ func (m *requestValidator) getRequestableRoles(ctx context.Context, identity tls
 	var expanded []string
 	for _, role := range allRoles {
 		n := role.GetName()
-		if slices.Contains(m.userState.GetRoles(), n) || !m.canRequestRole(n) {
+		if slices.Contains(m.userState.GetRoles(), n) || !m.CanRequestRole(n) {
 			continue
 		}
 
@@ -1635,7 +1726,7 @@ func setAllowRequestKubeResourceLookup(allowKubernetesResources []types.RequestK
 // push compiles a role's configuration into the request validator.
 // All of the requesting user's statically assigned roles must be pushed
 // before validation begins.
-func (m *requestValidator) push(ctx context.Context, role types.Role) error {
+func (m *RequestValidator) push(ctx context.Context, role types.Role) error {
 	var err error
 
 	m.requireReasonForAllRoles = m.requireReasonForAllRoles || role.GetOptions().RequestAccess.RequireReason()
@@ -1647,22 +1738,35 @@ func (m *requestValidator) push(ctx context.Context, role types.Role) error {
 
 	allow, deny := role.GetAccessRequestConditions(types.Allow), role.GetAccessRequestConditions(types.Deny)
 
-	if allow.Reason != nil && allow.Reason.Mode.Required() {
-		for _, r := range allow.Roles {
-			m.requiringReasonRoles[r] = struct{}{}
+	if allow.Reason != nil {
+		if allow.Reason.Mode.Required() {
+			for _, r := range allow.Roles {
+				m.requiringReasonRoles[r] = struct{}{}
+			}
+			for _, r := range allow.SearchAsRoles {
+				m.requiringReasonRoles[r] = struct{}{}
+			}
 		}
-		for _, r := range allow.SearchAsRoles {
-			m.requiringReasonRoles[r] = struct{}{}
+
+		customPrompt := strings.TrimSpace(allow.Reason.Prompt)
+		if len(customPrompt) > 0 {
+			for _, r := range allow.Roles {
+				m.customPromptRoles[r] = customPrompt
+			}
+			for _, r := range allow.SearchAsRoles {
+				m.customPromptRoles[r] = customPrompt
+			}
 		}
 	}
 
-	setAllowRequestKubeResourceLookup(allow.KubernetesResources, allow.SearchAsRoles, m.kubernetesResource.allow)
+	// NOTE: Not using allow.KubernetesResources as we need to map older roles to new values.
+	setAllowRequestKubeResourceLookup(role.GetRequestKubernetesResources(types.Allow), allow.SearchAsRoles, m.kubernetesResource.allow)
 
-	if len(deny.KubernetesResources) > 0 {
-		m.kubernetesResource.deny = append(m.kubernetesResource.deny, deny.KubernetesResources...)
+	if deniedKubeResources := role.GetRequestKubernetesResources(types.Deny); len(deniedKubeResources) > 0 {
+		m.kubernetesResource.deny = append(m.kubernetesResource.deny, deniedKubeResources...)
 	}
 
-	m.roles.denyRequest, err = appendRoleMatchers(m.roles.denyRequest, deny.Roles, deny.ClaimsToRoles, m.userState.GetTraits())
+	m.roles.denyRequest, err = AppendRoleMatchers(m.roles.denyRequest, deny.Roles, deny.ClaimsToRoles, m.userState.GetTraits())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1670,7 +1774,7 @@ func (m *requestValidator) push(ctx context.Context, role types.Role) error {
 	// record what will be the starting index of the allow and deny matchers for this role, if it applies any.
 	astart := len(m.roles.allowRequest)
 
-	m.roles.allowRequest, err = appendRoleMatchers(m.roles.allowRequest, allow.Roles, allow.ClaimsToRoles, m.userState.GetTraits())
+	m.roles.allowRequest, err = AppendRoleMatchers(m.roles.allowRequest, allow.Roles, allow.ClaimsToRoles, m.userState.GetTraits())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1723,12 +1827,17 @@ func (m *requestValidator) push(ctx context.Context, role types.Role) error {
 // setRolesForResourceRequest determines if the given access request is
 // resource-based, and if so, it determines which underlying roles are necessary
 // and adds them to the request.
-func (m *requestValidator) setRolesForResourceRequest(ctx context.Context, req types.AccessRequest) error {
+func (m *RequestValidator) setRolesForResourceRequest(ctx context.Context, req types.AccessRequest) error {
 	if !m.opts.expandVars {
 		// Don't set the roles if expandVars is not set, they have probably
 		// already been set and we are just validating the request.
 		return nil
 	}
+	if req.GetRequestKind().IsLongTerm() {
+		// Don't set roles on LongTerm requests; they are only allowed
+		// to be search-based resource requests.
+		return nil
+	}
 	if len(req.GetRequestedResourceIDs()) == 0 {
 		// This is not a resource request.
 		return nil
@@ -1747,18 +1856,37 @@ func (m *requestValidator) setRolesForResourceRequest(ctx context.Context, req t
 	return nil
 }
 
+// requestResourcesToStrings formats the resource list as <kind>.<apiGroup>.
+// Removes wildcards if any.
+func requestResourcesToStrings(resources, denied []types.RequestKubernetesResource) []string {
+	strs := make([]string, 0, len(resources))
+	for _, resource := range resources {
+		str := resource.Kind
+		if resource.APIGroup != "" {
+			str += "." + resource.APIGroup
+		}
+		if resource.Kind == types.Wildcard && len(denied) > 0 {
+			str += "(- " + strings.Join(requestResourcesToStrings(denied, nil), ", ") + ")"
+		}
+		strs = append(strs, str)
+	}
+	return strs
+}
+
 // pruneRequestedRolesNotMatchingKubernetesResourceKinds will filter out the kubernetes kinds from the requested resource IDs (kube_cluster and its subresources)
 // disregarding whether it's leaf or root cluster request, and for each requested role, ensures that all requested kube resource kind are allowed by the role.
 // Roles not matching with every kind requested, will be pruned from the requested roles.
 //
 // Returns pruned roles, and a map of requested roles with allowed kinds (with denied applied), used to help aid user in case a request gets rejected,
 // lets user know which kinds are allowed for each requested roles.
-func (m *requestValidator) pruneRequestedRolesNotMatchingKubernetesResourceKinds(requestedResourceIDs []types.ResourceID, requestedRoles []string) ([]string, map[string][]string) {
+func (m *RequestValidator) pruneRequestedRolesNotMatchingKubernetesResourceKinds(requestedResourceIDs []types.ResourceID, requestedRoles []string) ([]string, map[string][]string) {
 	// Filter for the kube_cluster and its subresource kinds.
-	requestedKubeKinds := make(map[string]struct{})
+	requestedKubeKinds := map[gk]struct{}{}
 	for _, resourceID := range requestedResourceIDs {
-		if resourceID.Kind == types.KindKubernetesCluster || slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) {
-			requestedKubeKinds[resourceID.Kind] = struct{}{}
+		if resourceID.Kind == types.KindKubernetesCluster {
+			requestedKubeKinds[gk{kind: types.KindKubernetesCluster}] = struct{}{}
+		} else if slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) || strings.HasPrefix(resourceID.Kind, types.AccessRequestPrefixKindKube) {
+			requestedKubeKinds[normalizeKubernetesKind(resourceID.Kind)] = struct{}{}
 		}
 	}
 
@@ -1766,12 +1894,12 @@ func (m *requestValidator) pruneRequestedRolesNotMatchingKubernetesResourceKinds
 		return requestedRoles, nil
 	}
 
-	goodRoles := make(map[string]struct{})
-	mappedRequestedRolesToAllowedKinds := make(map[string][]string)
+	goodRoles := map[string]struct{}{}
+	mappedRequestedRolesToAllowedKinds := map[string][]string{}
 	for _, requestedRoleName := range requestedRoles {
-		allowedKinds, deniedKinds := getKubeResourceKinds(m.kubernetesResource.allow[requestedRoleName]), getKubeResourceKinds(m.kubernetesResource.deny)
+		allowedKinds, deniedKinds := m.kubernetesResource.allow[requestedRoleName], m.kubernetesResource.deny
 
-		// Any resource is allowed.
+		// If there is nothing in allowed nor deny, everything is allowed.
 		if len(allowedKinds) == 0 && len(deniedKinds) == 0 {
 			goodRoles[requestedRoleName] = struct{}{}
 			continue
@@ -1779,28 +1907,63 @@ func (m *requestValidator) pruneRequestedRolesNotMatchingKubernetesResourceKinds
 
 		// All supported kube kinds are allowed when there was nothing configured.
 		if len(allowedKinds) == 0 {
-			allowedKinds = types.KubernetesResourcesKinds
-			allowedKinds = append(allowedKinds, types.KindKubernetesCluster)
+			allowedKinds = append(allowedKinds,
+				types.RequestKubernetesResource{Kind: types.Wildcard, APIGroup: types.Wildcard},
+			)
+			// If there is nothing in deny, also include kube_cluster.
+			if len(deniedKinds) == 0 {
+				allowedKinds = append(allowedKinds,
+					types.RequestKubernetesResource{Kind: types.KindKubernetesCluster},
+				)
+			}
 		}
 
-		// Filter out denied kinds from the allowed kinds
-		if len(deniedKinds) > 0 && len(allowedKinds) > 0 {
-			allowedKinds = getAllowedKubeResourceKinds(allowedKinds, deniedKinds)
-		}
+		allowedKinds = slices.DeleteFunc(allowedKinds, func(in types.RequestKubernetesResource) bool {
+			for _, elem := range deniedKinds {
+				if matchRequestKubernetesResources(gk{group: in.APIGroup, kind: in.Kind}, elem, types.Allow) {
+					return true
+				}
+			}
+			return false
+		})
 
-		mappedRequestedRolesToAllowedKinds[requestedRoleName] = allowedKinds
+		// TODO(@creack): Consider removing this. We shouldn't disclose to the user what they could request when getting an access denied error.
+		//                Keeping existing behavior for now.
+		mappedRequestedRolesToAllowedKinds[requestedRoleName] = requestResourcesToStrings(allowedKinds, deniedKinds)
 
-		roleIsDenied := false
+		// If we have any requested kinds that is either not allowed or that is denied, reject the role.
+		// TODO(@creack): Reconsider this, we may want to allow some kinds and deny others.
+		//                Keeping existing behavior for now.
+		filteredAllowedKinds := make([]types.RequestKubernetesResource, 0, len(requestedKubeKinds))
 		for requestedKubeKind := range requestedKubeKinds {
-			if !slices.Contains(allowedKinds, requestedKubeKind) {
-				roleIsDenied = true
-				continue
+			for _, k := range allowedKinds {
+				if matchRequestKubernetesResources(requestedKubeKind, k, types.Allow) {
+					filteredAllowedKinds = append(filteredAllowedKinds, types.RequestKubernetesResource{Kind: requestedKubeKind.kind, APIGroup: requestedKubeKind.group})
+					break
+				}
 			}
 		}
+		if len(filteredAllowedKinds) != len(requestedKubeKinds) {
+			// If we don't have as many allowed kinds as request, we reject the role.
+			continue
+		}
 
-		if !roleIsDenied {
-			goodRoles[requestedRoleName] = struct{}{}
+		// If there is something to deny, make sure we reject 'namespace' and 'kube_cluster', as it would grant access to everything.
+		for requestedKubeKind := range requestedKubeKinds {
+			for _, k := range deniedKinds {
+				if requestedKubeKind.kind == types.KindKubernetesCluster || requestedKubeKind.kind == "namespaces" {
+					// We have a deny entry and the request is for a kube_cluster or namespaces, reject.
+					return nil, mappedRequestedRolesToAllowedKinds
+				}
+
+				if matchRequestKubernetesResources(requestedKubeKind, k, types.Deny) {
+					// If we have any requested kinds that is denied, reject all roles.
+					return nil, mappedRequestedRolesToAllowedKinds
+				}
+			}
 		}
+
+		goodRoles[requestedRoleName] = struct{}{}
 	}
 
 	return slices.Collect(maps.Keys(goodRoles)), mappedRequestedRolesToAllowedKinds
@@ -1866,8 +2029,8 @@ func (c *thresholdCollector) pushThreshold(t types.AccessReviewThreshold) (uint3
 	return uint32(len(c.Thresholds) - 1), nil
 }
 
-// canRequestRole checks if a given role can be requested.
-func (m *requestValidator) canRequestRole(name string) bool {
+// CanRequestRole checks if a given role can be requested.
+func (m *RequestValidator) CanRequestRole(name string) bool {
 	for _, deny := range m.roles.denyRequest {
 		if deny.Match(name) {
 			return false
@@ -1883,7 +2046,7 @@ func (m *requestValidator) canRequestRole(name string) bool {
 
 // canSearchAsRole check if a given role can be requested through a search-based
 // access request
-func (m *requestValidator) canSearchAsRole(name string) bool {
+func (m *RequestValidator) canSearchAsRole(name string) bool {
 	if slices.Contains(m.roles.denySearch, name) {
 		return false
 	}
@@ -1897,7 +2060,7 @@ func (m *requestValidator) canSearchAsRole(name string) bool {
 
 // collectSetsForRole collects the threshold index sets which describe the various groups of
 // thresholds which must pass in order for a request for the given role to be approved.
-func (m *requestValidator) collectSetsForRole(c *thresholdCollector, role string) ([]types.ThresholdIndexSet, error) {
+func (m *RequestValidator) collectSetsForRole(c *thresholdCollector, role string) ([]types.ThresholdIndexSet, error) {
 	var sets []types.ThresholdIndexSet
 
 Outer:
@@ -1962,7 +2125,7 @@ func (m *annotationMatcher) matchesRequest(req types.AccessRequest) bool {
 //
 // Annotations are only applied to access requests requests when one of the requested roles matches one of the
 // role matchers.
-func (m *requestValidator) insertAllowedAnnotations(ctx context.Context, conditions types.AccessRequestConditions, roleRequestMatchers, resourceRequestMatchers []parse.Matcher) {
+func (m *RequestValidator) insertAllowedAnnotations(ctx context.Context, conditions types.AccessRequestConditions, roleRequestMatchers, resourceRequestMatchers []parse.Matcher) {
 	for annotationKey, annotationValueTemplates := range conditions.Annotations {
 		// iterate through all new values and expand any
 		// variable interpolation syntax they contain.
@@ -1987,7 +2150,7 @@ func (m *requestValidator) insertAllowedAnnotations(ctx context.Context, conditi
 
 // insertDeniedAnnotations constructs all denied annotations for a given AccessRequestConditions instance
 // from one of the users current roles and adds them to the denied annotations set.
-func (m *requestValidator) insertDeniedAnnotations(ctx context.Context, conditions types.AccessRequestConditions) {
+func (m *RequestValidator) insertDeniedAnnotations(ctx context.Context, conditions types.AccessRequestConditions) {
 	for annotationKey, annotationValueTemplates := range conditions.Annotations {
 		// iterate through all new values and expand any
 		// variable interpolation syntax they contain.
@@ -2009,7 +2172,7 @@ func (m *requestValidator) insertDeniedAnnotations(ctx context.Context, conditio
 
 // systemAnnotations calculates the system annotations for a pending
 // access request.
-func (m *requestValidator) systemAnnotations(req types.AccessRequest) (map[string][]string, error) {
+func (m *RequestValidator) systemAnnotations(req types.AccessRequest) (map[string][]string, error) {
 	annotations := make(map[string][]string)
 
 	for annotation, allowMatchers := range m.annotations.allow {
@@ -2061,7 +2224,7 @@ func WithExpandVars(expandVars bool) ValidateRequestOption {
 // If both [WithExpandVars] is set to true and req.GetDryRun() is true it adds expanded dry-run
 // enrichment data in the provided request.
 func ValidateAccessRequestForUser(ctx context.Context, clock clockwork.Clock, getter RequestValidatorGetter, req types.AccessRequest, identity tlsca.Identity, opts ...ValidateRequestOption) error {
-	v, err := newRequestValidator(ctx, clock, getter, req.GetUser(), opts...)
+	v, err := NewRequestValidator(ctx, clock, getter, req.GetUser(), opts...)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -2158,7 +2321,7 @@ func getInvalidKubeKindAccessRequestsError(mappedRequestedRolesToAllowedKinds ma
 // resource is in a leaf cluster.
 //
 // If loginHint is provided, it will attempt to prune the list to a single role.
-func (m *requestValidator) pruneResourceRequestRoles(
+func (m *RequestValidator) pruneResourceRequestRoles(
 	ctx context.Context,
 	resourceIDs []types.ResourceID,
 	loginHint string,
@@ -2169,8 +2332,7 @@ func (m *requestValidator) pruneResourceRequestRoles(
 		return roles, nil
 	}
 
-	var mappedRequestedRolesToAllowedKinds map[string][]string
-	roles, mappedRequestedRolesToAllowedKinds = m.pruneRequestedRolesNotMatchingKubernetesResourceKinds(resourceIDs, roles)
+	roles, mappedRequestedRolesToAllowedKinds := m.pruneRequestedRolesNotMatchingKubernetesResourceKinds(resourceIDs, roles)
 	if len(roles) == 0 { // all roles got pruned from not matching every kube requested kind.
 		return nil, getInvalidKubeKindAccessRequestsError(mappedRequestedRolesToAllowedKinds, false /* requestedRoles */)
 	}
@@ -2304,33 +2466,7 @@ func countAllowedLogins(role types.Role) int {
 	return len(allowed)
 }
 
-// getKubeResourceKinds just extracts the kinds from the list.
-// If a wildcard is present, then all supported resource types are returned.
-func getKubeResourceKinds(kubernetesResources []types.RequestKubernetesResource) []string {
-	var kinds []string
-	for _, rm := range kubernetesResources {
-		if rm.Kind == types.Wildcard {
-			return types.KubernetesResourcesKinds
-		}
-		kinds = append(kinds, rm.Kind)
-	}
-	return kinds
-}
-
-// getAllowedKubeResourceKinds returns only the allowed kinds that were not in the
-// denied list.
-func getAllowedKubeResourceKinds(allowedKinds []string, deniedKinds []string) []string {
-	allowed := make(map[string]struct{}, len(allowedKinds))
-	for _, kind := range allowedKinds {
-		allowed[kind] = struct{}{}
-	}
-	for _, kind := range deniedKinds {
-		delete(allowed, kind)
-	}
-	return slices.Collect(maps.Keys(allowed))
-}
-
-func (m *requestValidator) roleAllowsResource(
+func (m *RequestValidator) roleAllowsResource(
 	role types.Role,
 	resource types.ResourceWithLabels,
 	loginHint string,
@@ -2360,7 +2496,7 @@ func (m *requestValidator) roleAllowsResource(
 // requested access. Except for resource Kinds present in types.KubernetesResourcesKinds,
 // the underlying resources are the same as requested. If the resource requested
 // is a Kubernetes resource, we return the underlying Kubernetes cluster.
-func (m *requestValidator) getUnderlyingResourcesByResourceIDs(ctx context.Context, resourceIDs []types.ResourceID) ([]types.ResourceWithLabels, error) {
+func (m *RequestValidator) getUnderlyingResourcesByResourceIDs(ctx context.Context, resourceIDs []types.ResourceID) ([]types.ResourceWithLabels, error) {
 	if len(resourceIDs) == 0 {
 		return []types.ResourceWithLabels{}, nil
 	}
@@ -2370,7 +2506,7 @@ func (m *requestValidator) getUnderlyingResourcesByResourceIDs(ctx context.Conte
 	// requested is fulfilled by at least one role.
 	searchableResourcesIDs := slices.Clone(resourceIDs)
 	for i := range searchableResourcesIDs {
-		if slices.Contains(types.KubernetesResourcesKinds, searchableResourcesIDs[i].Kind) {
+		if slices.Contains(types.KubernetesResourcesKinds, searchableResourcesIDs[i].Kind) || strings.HasPrefix(searchableResourcesIDs[i].Kind, types.AccessRequestPrefixKindKube) {
 			searchableResourcesIDs[i].Kind = types.KindKubernetesCluster
 		}
 	}
@@ -2385,17 +2521,53 @@ func getKubeResourcesFromResourceIDs(resourceIDs []types.ResourceID, clusterName
 	kubernetesResources := make([]types.KubernetesResource, 0, len(resourceIDs))
 
 	for _, resourceID := range resourceIDs {
-		if slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) && resourceID.Name == clusterName {
+		if resourceID.Name != clusterName {
+			continue
+		}
+		// TODO(@creack): DELETE IN v20.0.0 when we no longer support legacy access request formats.
+		// Special case to support legacy "namespace" kind request.
+		if resourceID.Kind == types.KindKubeNamespace {
+			// If the target namespace is a wildcard, update the pattern to make sure cluster-wide resources won't be matched.
+			targetNS := resourceID.SubResourceName
+			if targetNS == types.Wildcard {
+				targetNS = "^.+$"
+			}
+			kubernetesResources = append(kubernetesResources,
+				types.KubernetesResource{
+					Kind:     "namespaces",
+					Name:     resourceID.SubResourceName,
+					APIGroup: "",
+				},
+				types.KubernetesResource{
+					Kind:      types.Wildcard,
+					Name:      types.Wildcard,
+					Namespace: targetNS,
+					APIGroup:  "",
+				},
+			)
+			continue
+		}
+		if slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) || strings.HasPrefix(resourceID.Kind, types.AccessRequestPrefixKindKube) {
 			kind := types.KubernetesResourcesKindsPlurals[resourceID.Kind]
 			if kind == "" {
 				kind = resourceID.Kind
 			}
+			isClusterWide := slices.Contains(types.KubernetesClusterWideResourceKinds, resourceID.Kind) || strings.HasPrefix(kind, types.AccessRequestPrefixKindKubeClusterWide)
+			if !isClusterWide {
+				kind = strings.TrimPrefix(kind, types.AccessRequestPrefixKindKubeNamespaced)
+			} else {
+				kind = strings.TrimPrefix(kind, types.AccessRequestPrefixKindKubeClusterWide)
+			}
+			gk := schema.ParseGroupKind(kind)
+			if gk.Group == "" {
+				gk.Group = types.KubernetesResourcesV7KindGroups[resourceID.Kind]
+			}
 			switch {
-			// TODO(@creack): Make sure this is handled in the AccessRequest PR.
-			case slices.Contains(types.KubernetesClusterWideResourceKinds, resourceID.Kind):
+			case isClusterWide:
 				kubernetesResources = append(kubernetesResources, types.KubernetesResource{
-					Kind: kind,
-					Name: resourceID.SubResourceName,
+					Kind:     gk.Kind,
+					Name:     resourceID.SubResourceName,
+					APIGroup: gk.Group,
 				})
 			default:
 				splits := strings.Split(resourceID.SubResourceName, "/")
@@ -2403,9 +2575,10 @@ func getKubeResourcesFromResourceIDs(resourceIDs []types.ResourceID, clusterName
 					return nil, trace.BadParameter("subresource name %q does not follow <namespace>/<name> format", resourceID.SubResourceName)
 				}
 				kubernetesResources = append(kubernetesResources, types.KubernetesResource{
-					Kind:      kind,
+					Kind:      gk.Kind,
 					Namespace: splits[0],
 					Name:      splits[1],
+					APIGroup:  gk.Group,
 				})
 			}
 		}
diff --git a/lib/services/access_request_test.go b/lib/services/access_request_test.go
index 349bf31b7938d..09852d4608c26 100644
--- a/lib/services/access_request_test.go
+++ b/lib/services/access_request_test.go
@@ -19,8 +19,12 @@
 package services
 
 import (
+	"bytes"
 	"context"
+	"embed"
+	"errors"
 	"fmt"
+	"io"
 	"slices"
 	"strconv"
 	"strings"
@@ -32,6 +36,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	kyaml "k8s.io/apimachinery/pkg/util/yaml"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
@@ -39,7 +44,6 @@ import (
 	"github.com/gravitational/teleport/api/types/trait"
 	"github.com/gravitational/teleport/api/types/userloginstate"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -56,6 +60,17 @@ type mockGetter struct {
 	clusterName string
 }
 
+func (m *mockGetter) ListUserLoginStates(ctx context.Context, pageSize int, nextToken string) ([]*userloginstate.UserLoginState, string, error) {
+	if pageSize != 0 && pageSize < len(m.userStates) {
+		return nil, "", trace.BadParameter("page size %d exceeds total items %d", pageSize, len(m.userStates))
+	}
+	out := make([]*userloginstate.UserLoginState, 0, len(m.userStates))
+	for _, v := range m.userStates {
+		out = append(out, v)
+	}
+	return out, "", nil
+}
+
 // user inserts a new user with the specified roles and returns the username.
 func (m *mockGetter) user(t *testing.T, roles ...string) string {
 	name := uuid.New().String()
@@ -742,7 +757,7 @@ func TestReviewThresholds(t *testing.T) {
 
 			// perform request validation (necessary in order to initialize internal
 			// request variables like annotations and thresholds).
-			validator, err := newRequestValidator(ctx, clock, g, tt.requestor, WithExpandVars(true))
+			validator, err := NewRequestValidator(ctx, clock, g, tt.requestor, WithExpandVars(true))
 			require.NoError(t, err, "scenario=%q", tt.desc)
 
 			err = validator.validate(ctx, req, identity)
@@ -962,7 +977,8 @@ func TestPluginDataExpectations(t *testing.T) {
 			"missing": "key",
 		},
 	})
-	fixtures.AssertCompareFailed(t, err)
+
+	require.True(t, trace.IsCompareFailed(err))
 
 	// Expect a value to not exist when it does exist.
 	err = data.Update(types.PluginDataUpdateParams{
@@ -977,7 +993,7 @@ func TestPluginDataExpectations(t *testing.T) {
 			"spam":  "",
 		},
 	})
-	fixtures.AssertCompareFailed(t, err)
+	require.True(t, trace.IsCompareFailed(err))
 
 	// Expect the correct state, updating one key and removing another.
 	err = data.Update(types.PluginDataUpdateParams{
@@ -1276,7 +1292,7 @@ func TestRolesForResourceRequest(t *testing.T) {
 				Expires: clock.Now().UTC().Add(8 * time.Hour),
 			}
 
-			validator, err := newRequestValidator(context.Background(), clock, g, uls.GetName(), WithExpandVars(true))
+			validator, err := NewRequestValidator(context.Background(), clock, g, uls.GetName(), WithExpandVars(true))
 			require.NoError(t, err)
 
 			err = validator.validate(context.Background(), req, identity)
@@ -1290,9 +1306,7 @@ func TestRolesForResourceRequest(t *testing.T) {
 	}
 }
 
-func TestPruneRequestRoles(t *testing.T) {
-	ctx := context.Background()
-
+func newFixture(t *testing.T) (*mockGetter, string) {
 	clusterName := "my-cluster"
 
 	g := &mockGetter{
@@ -1473,6 +1487,13 @@ func TestPruneRequestRoles(t *testing.T) {
 	require.NoError(t, err)
 	g.desktops[desktop.GetName()] = desktop
 
+	return g, user
+}
+
+func TestPruneMappedSearchAs(t *testing.T) {
+	ctx := context.Background()
+	g, user := newFixture(t)
+
 	testCases := []struct {
 		desc               string
 		requestResourceIDs []types.ResourceID
@@ -1484,7 +1505,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "without login hint",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node",
 				},
@@ -1497,7 +1518,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "label expression role",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "responders-node",
 				},
@@ -1508,7 +1529,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "user login hint",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node",
 				},
@@ -1521,12 +1542,12 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "multiple nodes",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node",
 				},
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node-2",
 				},
@@ -1539,7 +1560,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "root login hint",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node",
 				},
@@ -1552,7 +1573,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "root login unavailable",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "denied-node",
 				},
@@ -1565,7 +1586,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "kube request",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindKubernetesCluster,
 					Name:        "kube",
 				},
@@ -1577,7 +1598,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "db request",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindDatabase,
 					Name:        "db",
 				},
@@ -1589,7 +1610,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "app request",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindApp,
 					Name:        "app",
 				},
@@ -1601,7 +1622,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "windows request",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindWindowsDesktop,
 					Name:        "windows",
 				},
@@ -1613,27 +1634,27 @@ func TestPruneRequestRoles(t *testing.T) {
 			desc: "mixed request",
 			requestResourceIDs: []types.ResourceID{
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindNode,
 					Name:        "admins-node",
 				},
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindKubernetesCluster,
 					Name:        "kube",
 				},
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindDatabase,
 					Name:        "db",
 				},
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindApp,
 					Name:        "app",
 				},
 				{
-					ClusterName: clusterName,
+					ClusterName: g.clusterName,
 					Kind:        types.KindWindowsDesktop,
 					Name:        "windows",
 				},
@@ -1690,6 +1711,251 @@ func TestPruneRequestRoles(t *testing.T) {
 	}
 }
 
+// requireBadParameter is a [require.ErrorAssertionFunc] that asserts the supplied error value is a BadParameter error
+func requireBadParameter(t require.TestingT, err error, msgAndArgs ...any) {
+	var bpe *trace.BadParameterError
+	require.ErrorAs(t, err, &bpe, msgAndArgs...)
+}
+
+// remoteCapsAssertion is the signature for functions assrting the properties of
+type remoteCapsAssertion func(t require.TestingT, actual []string, msgAndArgs ...any)
+
+// expectRoles is a [remoteCapsAssertion] that asserts the returned role set contains a specific set of roles.
+// The role order is ignored, but otherwise the role sets must be identical.
+func expectRoles(expected ...string) remoteCapsAssertion {
+	return func(t require.TestingT, actual []string, msgAndArgs ...any) {
+		require.ElementsMatch(t, expected, actual, msgAndArgs...)
+	}
+}
+
+// undefinedRoles is a [remoteCapsAssertion] that makes no assertions about the supplied capabilities.
+// The correct value is literally undefined.
+func undefinedRoles(require.TestingT, []string, ...any) {
+}
+
+func TestPruneMappedRoles(t *testing.T) {
+	ctx := context.Background()
+	g, username := newFixture(t)
+
+	// GIVEN a user state with no standing roles, implying that the search-as roles *must*
+	// come from the supplied list...
+	userState, ok := g.userStates[username]
+	require.True(t, ok, "user should exist")
+	userState.Spec.Roles = nil
+
+	testCases := []struct {
+		desc               string
+		loginHint          string
+		requestResourceIDs []types.ResourceID
+		errorAssertion     require.ErrorAssertionFunc
+		capsAssertion      remoteCapsAssertion
+		expectRoles        []string
+	}{
+		{
+			desc: "without login hint",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+			},
+			errorAssertion: require.NoError,
+			capsAssertion:  expectRoles("node-admins", "node-access"),
+		},
+		{
+			desc: "label expression role",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "responders-node",
+				},
+			},
+			errorAssertion: require.NoError,
+			capsAssertion:  expectRoles("node-team", "node-access"),
+		},
+		{
+			desc: "user login hint",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+			},
+			loginHint:      "responder",
+			errorAssertion: require.NoError,
+			// With "responder" login hint, only request node-access.
+			capsAssertion: expectRoles("node-access"),
+		},
+		{
+			desc: "multiple nodes with login hint",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node-2",
+				},
+			},
+			loginHint:      "responder",
+			errorAssertion: require.NoError,
+			// With "responder" login hint, only request node-access.
+			capsAssertion: expectRoles("node-access"),
+		},
+		{
+			desc: "root login hint",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+			},
+			loginHint:      "root",
+			errorAssertion: require.NoError,
+			// With "root" login hint, request node-admins.
+			capsAssertion: expectRoles("node-admins"),
+		},
+		{
+			desc: "root login unavailable",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "denied-node",
+				},
+			},
+			loginHint: "root",
+			// No roles grant access with the desired login, return an error.
+			errorAssertion: requireBadParameter,
+			capsAssertion:  undefinedRoles,
+		},
+		{
+			desc: "kube request",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindKubernetesCluster,
+					Name:        "kube",
+				},
+			},
+			errorAssertion: require.NoError,
+			// Request for kube cluster should only request kube-admins
+			capsAssertion: expectRoles("kube-admins"),
+		},
+		{
+			desc: "db request",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindDatabase,
+					Name:        "db",
+				},
+			},
+			errorAssertion: require.NoError,
+			// Request for db should only request db-admins
+			capsAssertion: expectRoles("db-admins"),
+		},
+		{
+			desc: "app request",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindApp,
+					Name:        "app",
+				},
+			},
+			errorAssertion: require.NoError,
+			// Request for app should only request app-admins
+			capsAssertion: expectRoles("app-admins"),
+		},
+		{
+			desc: "windows request",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindWindowsDesktop,
+					Name:        "windows",
+				},
+			},
+			errorAssertion: require.NoError,
+			// Request for windows should only request windows-admins
+			capsAssertion: expectRoles("windows-admins"),
+		},
+		{
+			desc: "mixed request",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindKubernetesCluster,
+					Name:        "kube",
+				},
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindDatabase,
+					Name:        "db",
+				},
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindApp,
+					Name:        "app",
+				},
+				{
+					ClusterName: g.clusterName,
+					Kind:        types.KindWindowsDesktop,
+					Name:        "windows",
+				},
+			},
+			errorAssertion: require.NoError,
+			// Request for different kinds should request all necessary roles
+			capsAssertion: expectRoles("node-access", "node-admins", "kube-admins", "db-admins", "app-admins", "windows-admins"),
+		},
+		{
+			desc: "foreign resource",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: "leaf",
+					Kind:        types.KindNode,
+					Name:        "admins-node",
+				},
+			},
+			errorAssertion: requireBadParameter,
+			capsAssertion:  undefinedRoles,
+		},
+	}
+
+	localSearchAsRoles := []string{
+		"node-admins",
+		"node-access",
+		"node-team",
+		"kube-admins",
+		"db-admins",
+		"app-admins",
+		"windows-admins",
+		"empty",
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.desc, func(t *testing.T) {
+			clock := clockwork.NewFakeClock()
+			caps, err := PruneMappedSearchAsRoles(ctx, clock, g, userState, localSearchAsRoles, testCase.requestResourceIDs, testCase.loginHint)
+			testCase.errorAssertion(t, err)
+			testCase.capsAssertion(t, caps)
+		})
+	}
+}
+
 func TestGetRequestableRoles(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -1941,7 +2207,7 @@ func TestCalculatePendingRequestTTL(t *testing.T) {
 				roles:      map[string]types.Role{"bar": role},
 			}
 
-			validator, err := newRequestValidator(context.Background(), clock, getter, "foo", WithExpandVars(true))
+			validator, err := NewRequestValidator(context.Background(), clock, getter, "foo", WithExpandVars(true))
 			require.NoError(t, err)
 
 			request, err := types.NewAccessRequest("some-id", "foo", "bar")
@@ -2016,7 +2282,7 @@ func TestSessionTTL(t *testing.T) {
 				roles: map[string]types.Role{"bar": role},
 			}
 
-			validator, err := newRequestValidator(context.Background(), clock, getter, "foo", WithExpandVars(true))
+			validator, err := NewRequestValidator(context.Background(), clock, getter, "foo", WithExpandVars(true))
 			require.NoError(t, err)
 
 			request, err := types.NewAccessRequest("some-id", "foo", "bar")
@@ -2071,11 +2337,11 @@ func TestAutoRequest(t *testing.T) {
 	cases := []struct {
 		name      string
 		roles     []types.Role
-		assertion func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities)
+		assertion func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities)
 	}{
 		{
 			name: "no roles",
-			assertion: func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities) {
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
 				require.False(t, validator.requireReasonForAllRoles)
 				require.False(t, validator.autoRequestOnLogin)
 				require.Empty(t, validator.reasonPrompts)
@@ -2088,7 +2354,7 @@ func TestAutoRequest(t *testing.T) {
 		{
 			name:  "with prompt",
 			roles: []types.Role{empty, optionalRole, promptRole},
-			assertion: func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities) {
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
 				require.False(t, validator.requireReasonForAllRoles)
 				require.False(t, validator.autoRequestOnLogin)
 				require.Len(t, validator.reasonPrompts, 1)
@@ -2102,7 +2368,7 @@ func TestAutoRequest(t *testing.T) {
 		{
 			name:  "with auto request",
 			roles: []types.Role{alwaysRole},
-			assertion: func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities) {
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
 				require.False(t, validator.requireReasonForAllRoles)
 				require.True(t, validator.autoRequestOnLogin)
 				require.Empty(t, validator.reasonPrompts)
@@ -2115,7 +2381,7 @@ func TestAutoRequest(t *testing.T) {
 		{
 			name:  "with prompt and auto request",
 			roles: []types.Role{promptRole, alwaysRole},
-			assertion: func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities) {
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
 				require.False(t, validator.requireReasonForAllRoles)
 				require.True(t, validator.autoRequestOnLogin)
 				require.Len(t, validator.reasonPrompts, 1)
@@ -2129,7 +2395,7 @@ func TestAutoRequest(t *testing.T) {
 		{
 			name:  "with reason and auto prompt",
 			roles: []types.Role{reasonRole},
-			assertion: func(t *testing.T, validator *requestValidator, accessCaps *types.AccessCapabilities) {
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
 				require.True(t, validator.requireReasonForAllRoles)
 				require.True(t, validator.autoRequestOnLogin)
 				require.Empty(t, validator.reasonPrompts)
@@ -2162,7 +2428,7 @@ func TestAutoRequest(t *testing.T) {
 
 		getter.userStates[uls.GetName()] = uls
 
-		validator, err := newRequestValidator(ctx, clock, getter, uls.GetName(), WithExpandVars(true))
+		validator, err := NewRequestValidator(ctx, clock, getter, uls.GetName(), WithExpandVars(true))
 		require.NoError(t, err)
 
 		accessCapabilities, err := CalculateAccessCapabilities(ctx, clock, getter, tlsca.Identity{}, types.AccessCapabilitiesRequest{
@@ -2173,7 +2439,6 @@ func TestAutoRequest(t *testing.T) {
 
 		test.assertion(t, &validator, accessCapabilities)
 	}
-
 }
 
 func TestReasonRequired(t *testing.T) {
@@ -2431,7 +2696,7 @@ func TestReasonRequired(t *testing.T) {
 
 			// test RequestValidator.Validate
 			{
-				validator, err := newRequestValidator(ctx, clock, g, uls.GetName(), WithExpandVars(true))
+				validator, err := NewRequestValidator(ctx, clock, g, uls.GetName(), WithExpandVars(true))
 				require.NoError(t, err)
 
 				req, err := types.NewAccessRequestWithResources(
@@ -2853,7 +3118,7 @@ func TestValidate_RequestedMaxDuration(t *testing.T) {
 				Expires: now.Add(defaultSessionTTL),
 			}
 
-			validator, err := newRequestValidator(context.Background(), clock, g, tt.requestor, WithExpandVars(true))
+			validator, err := NewRequestValidator(context.Background(), clock, g, tt.requestor, WithExpandVars(true))
 			require.NoError(t, err)
 
 			req.SetCreationTime(now)
@@ -2903,7 +3168,7 @@ func TestValidate_RequestedPendingTTLAndMaxDuration(t *testing.T) {
 		Expires: now.Add(defaultSessionTTL),
 	}
 
-	validator, err := newRequestValidator(context.Background(), clock, g, "alice", WithExpandVars(true))
+	validator, err := NewRequestValidator(context.Background(), clock, g, "alice", WithExpandVars(true))
 	require.NoError(t, err)
 
 	requestedMaxDuration := 4 * day
@@ -2921,299 +3186,222 @@ func TestValidate_RequestedPendingTTLAndMaxDuration(t *testing.T) {
 	require.Equal(t, now.Add(requestedPendingTTL), req.Expiry())
 }
 
-// TestValidate_WithAllowRequestKubernetesResources tests that requests containing
+//go:embed testdata/roles
+var testdataRoles embed.FS
+
+// loadTestRoles reads one or more files from lib/services/testdata/roles and returns the parsed
+// roles as a map keys by role name.
+func loadTestRoles(t *testing.T, targets ...string) map[string]types.Role {
+	t.Helper()
+
+	roles := map[string]types.Role{}
+	for _, target := range targets {
+		roleContent, err := testdataRoles.ReadFile("testdata/roles/" + target + ".yaml")
+		require.NoError(t, err, "Failed to read test roles from embedded file: %q.", target)
+
+		for d := kyaml.NewYAMLOrJSONDecoder(bytes.NewReader(roleContent), 32*1024); ; {
+			var r types.RoleV6
+			if err := d.Decode(&r); err != nil {
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				t.Fatalf("Failed to decode role: %s", err)
+			}
+			// The k8s yaml parser yields an empty document when the file
+			// starts with the "---" header (which is required by the default by yamllint).
+			// Skip the empty document.
+			if r.Kind == "" {
+				continue
+			}
+			role, err := types.NewRoleWithVersion(r.GetName(), r.GetVersion(), r.Spec)
+			require.NoError(t, err, "Failed to create role %q.", r.GetName())
+			if _, ok := roles[r.GetName()]; ok {
+				t.Fatalf("Duplicate role name %q found in test data.", r.GetName())
+			}
+			roles[r.GetName()] = role
+		}
+	}
+	return roles
+}
+
+// initAccessRequestValidateTest initializes a mockGetter for testing access request validation.
+// Returns a function that takes the user name and its list of roles for the test case and returns the mockGetter.
+func initAccessRequestValidateTest(t *testing.T, clusterName string, roles map[string]types.Role) func(t *testing.T, userName string, userRoles []string) *mockGetter {
+	t.Helper()
+
+	// Define a kube server
+	kube, err := types.NewKubernetesClusterV3(types.Metadata{Name: "kube"}, types.KubernetesClusterSpecV3{})
+	require.NoError(t, err)
+	kubeServer, err := types.NewKubernetesServerV3FromCluster(kube, "_", "_")
+	require.NoError(t, err)
+
+	// Define a db server
+	db, err := types.NewDatabaseV3(types.Metadata{
+		Name: "db",
+	}, types.DatabaseSpecV3{
+		Protocol: "postgres",
+		URI:      "example.com:3000",
+	})
+	require.NoError(t, err)
+	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+		Name: db.GetName(),
+	}, types.DatabaseServerSpecV3{
+		HostID:   "db-server",
+		Hostname: "db-server",
+		Database: db,
+	})
+	require.NoError(t, err)
+
+	return func(t *testing.T, userName string, userRoles []string) *mockGetter {
+		t.Helper()
+
+		uls, err := userloginstate.New(header.Metadata{Name: userName}, userloginstate.Spec{Roles: userRoles})
+		require.NoError(t, err)
+
+		return &mockGetter{
+			roles:       roles,
+			clusterName: clusterName,
+			userStates:  map[string]*userloginstate.UserLoginState{uls.GetName(): uls},
+			kubeServers: map[string]types.KubeServer{kube.GetName(): kubeServer},
+			dbServers:   map[string]types.DatabaseServer{dbServer.GetName(): dbServer},
+		}
+	}
+}
+
+// TestValidate_WithAllowRequestKubernetesResources_LegacyRequestFormat tests that requests containing
 // kubernetes resources, the kinds are enforced defined by users static role
 // field `request.kubernetes_resources`
-func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
-	myClusterName := "teleport-cluster"
+// Test cases with legacy request format hitting various role versions.
+func TestValidate_WithAllowRequestKubernetesResources_LegacyRequestFormat(t *testing.T) {
+	const myClusterName = "teleport-cluster"
 
-	// set up test roles
-	roleDesc := map[string]types.RoleSpecV6{
-		"kube-access-wildcard": {
-			Allow: types.RoleConditions{
-				KubernetesLabels: types.Labels{
-					"*": {"*"},
-				},
-				KubernetesResources: []types.KubernetesResource{
-					{Kind: "*", Namespace: "*", Name: "*", Verbs: []string{"*"}, APIGroup: "*"},
-				},
+	roles := loadTestRoles(t, "v7_kube_accessrequest_validate", "v8_kube_accessrequest_validate")
+	newMockGetter := initAccessRequestValidateTest(t, myClusterName, roles)
+
+	// start test
+	testCases := []struct {
+		desc                      string
+		userStaticRoles           []string
+		requestResourceIDs        []types.ResourceID
+		requestRoles              []string
+		wantInvalidRequestKindErr bool
+		wantNoRolesConfiguredErr  bool
+		expectedRequestRoles      []string
+	}{
+		{
+			desc:                 "v7 request.kubernetes_resources undefined allows anything (kube_cluster and its subresources)",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
-		"kube-no-access": {
-			Allow: types.RoleConditions{},
-		},
-		"kube-access-namespace": {
-			Allow: types.RoleConditions{
-				KubernetesLabels: types.Labels{
-					"*": {"*"},
-				},
-				KubernetesResources: []types.KubernetesResource{
-					{Kind: "*", Namespace: "*", Name: "*", Verbs: []string{"*"}, APIGroup: "*"},
-				},
-			},
-		},
-		"kube-access-pod": {
-			Allow: types.RoleConditions{
-				KubernetesLabels: types.Labels{
-					"*": {"*"},
-				},
-				KubernetesResources: []types.KubernetesResource{
-					{Kind: "pods", Namespace: "*", Name: "*", Verbs: []string{"*"}, APIGroup: "*"},
-				},
-			},
-		},
-		"kube-access-deployment": {
-			Allow: types.RoleConditions{
-				KubernetesLabels: types.Labels{
-					"*": {"*"},
-				},
-				KubernetesResources: []types.KubernetesResource{
-					{Kind: "deployments", Namespace: "*", Name: "*", Verbs: []string{"*"}, APIGroup: "*"},
-				},
-			},
-		},
-		"db-access-wildcard": {
-			Allow: types.RoleConditions{
-				DatabaseLabels: types.Labels{
-					"*": {"*"},
-				},
+		{
+			desc:                 "v8 request.kubernetes_resources undefined allows anything (kube_cluster and its subresources)",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
 
-		"request-undefined_search-wildcard": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
-				},
-			},
-		},
-		"request-pod_search-as-roles-undefined": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubePod},
-					},
-				},
-			},
-		},
-		"request-namespace_search-namespace": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-namespace", "db-access-wildcard"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeNamespace},
-					},
-				},
-			},
-		},
-		// Allows requesting for any subresources, but NOT kube_cluster
-		"request-wildcard_search-wildcard": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.Wildcard},
-					},
-				},
-			},
-		},
-		// Allows wildcard search, but should only accept kube secret
-		"request-secret_search-wildcard": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-wildcard"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeSecret},
-					},
-				},
-			},
-		},
-		"request-pod_search-pods": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-pod"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubePod},
-					},
-				},
-			},
-		},
-		"request-deployment_search-deployment": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-deployment"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeDeployment},
-					},
-				},
-			},
-		},
-		"request-deployment-pod_search-deployment-pod": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-deployment", "kube-access-pod"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeDeployment},
-						{Kind: types.KindKubePod},
-					},
-				},
-			},
-		},
-		"request-namespace-but-no-access": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"db-access-wildcard", "kube-no-access"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindNamespace},
-					},
-				},
+		{
+			desc:                 "v7 request.kubernetes_resources undefined takes precedence over configured allow field (allows anything)",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard", "v7-kube-request-secret_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
-		"request-namespace_search-namespace_deny-secret": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-namespace"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindNamespace},
-					},
-				},
-			},
-			Deny: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeSecret},
-					},
-				},
+		{
+			desc:                 "v8 request.kubernetes_resources undefined takes precedence over configured allow field (allows anything)",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard", "v8-kube-request-secret_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
-		"request-undefined_search-wildcard_deny-deployment-pod": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-wildcard"},
-				},
-			},
-			Deny: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.KindKubeDeployment},
-						{Kind: types.KindKubePod},
-					},
-				},
+
+		{
+			desc:            "v7 configured deny request.kubernetes_resources takes precedence over undefined deny field",
+			userStaticRoles: []string{"v7-kube-request-wildcard-cancels-deny-wildcard", "v7-kube-request-namespace_search-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
-		"request-wildcard-cancels-deny-wildcard": {
-			Allow: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					SearchAsRoles: []string{"kube-access-namespace"},
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.Wildcard},
-					},
-				},
-			},
-			Deny: types.RoleConditions{
-				Request: &types.AccessRequestConditions{
-					KubernetesResources: []types.RequestKubernetesResource{
-						{Kind: types.Wildcard},
-					},
-				},
+		{
+			desc:            "v8 configured deny request.kubernetes_resources takes precedence over undefined deny field",
+			userStaticRoles: []string{"v8-kube-request-wildcard-cancels-deny-wildcard", "v8-kube-request-namespace_search-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
-	}
-	roles := make(map[string]types.Role)
-	for name, spec := range roleDesc {
-		role, err := types.NewRole(name, spec)
-		require.NoError(t, err)
-		roles[name] = role
-	}
-
-	// Define a kube server
-	kube, err := types.NewKubernetesClusterV3(types.Metadata{
-		Name: "kube",
-	},
-		types.KubernetesClusterSpecV3{},
-	)
-	require.NoError(t, err)
-	kubeServer, err := types.NewKubernetesServerV3FromCluster(kube, "_", "_")
-	require.NoError(t, err)
-
-	// Define a db server
-	db, err := types.NewDatabaseV3(types.Metadata{
-		Name: "db",
-	}, types.DatabaseSpecV3{
-		Protocol: "postgres",
-		URI:      "example.com:3000",
-	})
-	require.NoError(t, err)
-	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-		Name: db.GetName(),
-	}, types.DatabaseServerSpecV3{
-		HostID:   "db-server",
-		Hostname: "db-server",
-		Database: db,
-	})
-	require.NoError(t, err)
 
-	// start test
-	testCases := []struct {
-		desc                      string
-		userStaticRoles           []string
-		requestResourceIDs        []types.ResourceID
-		requestRoles              []string
-		wantInvalidRequestKindErr bool
-		wantNoRolesConfiguredErr  bool
-		expectedRequestRoles      []string
-	}{
 		{
-			desc:                 "request.kubernetes_resources undefined allows anything (kube_cluster and its subresources)",
-			userStaticRoles:      []string{"request-undefined_search-wildcard"},
-			expectedRequestRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
+			desc:                 "v7 request.kubernetes_resources does not get applied with a role without search_as_roles defined",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace", "v7-kube-request-pod_search-as-roles-undefined"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
 		{
-			desc:                 "request.kubernetes_resources undefined takes precedence over configured allow field (allows anything)",
-			userStaticRoles:      []string{"request-undefined_search-wildcard", "request-secret_search-wildcard"},
-			expectedRequestRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
+			desc:                 "v8 request.kubernetes_resources does not get applied with a role without search_as_roles defined",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace", "v8-kube-request-pod_search-as-roles-undefined"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
+
 		{
-			desc:            "configured deny request.kubernetes_resources takes precedence over undefined deny field",
-			userStaticRoles: []string{"request-wildcard-cancels-deny-wildcard", "request-namespace_search-namespace"},
+			desc:                 "v7 wildcard allows any kube subresources",
+			userStaticRoles:      []string{"v7-kube-request-wildcard_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
 			},
-			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc:                 "request.kubernetes_resources does not get applied with a role without search_as_roles defined",
-			userStaticRoles:      []string{"request-namespace_search-namespace", "request-pod_search-as-roles-undefined"},
-			expectedRequestRoles: []string{"kube-access-namespace", "db-access-wildcard"},
+			desc:                 "v8 wildcard allows any kube subresources",
+			userStaticRoles:      []string{"v8-kube-request-wildcard_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
 			},
 		},
+
 		{
-			desc:                 "wildcard allows any kube subresources",
-			userStaticRoles:      []string{"request-wildcard_search-wildcard"},
-			expectedRequestRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
+			desc:            "v7 wildcard rejects kube_cluster kind among other valid requests",
+			userStaticRoles: []string{"v7-kube-request-wildcard_search-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
-				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc:            "wildcard rejects kube_cluster kind among other valid requests",
-			userStaticRoles: []string{"request-wildcard_search-wildcard"},
+			desc:            "v8 wildcard rejects kube_cluster kind among other valid requests",
+			userStaticRoles: []string{"v8-kube-request-wildcard_search-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
@@ -3221,55 +3409,101 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
+		{
+			desc:            "v7 wildcard rejects single kube_cluster request",
+			userStaticRoles: []string{"v7-kube-request-wildcard_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
 		{
-			desc:            "wildcard rejects single kube_cluster request",
-			userStaticRoles: []string{"request-wildcard_search-wildcard"},
+			desc:            "v8 wildcard rejects single kube_cluster request",
+			userStaticRoles: []string{"v8-kube-request-wildcard_search-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
+		{
+			desc:            "v7 error with `no roles configured` if search_as_roles does not grant kube resource access",
+			userStaticRoles: []string{"v7-kube-request-namespace-but-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantNoRolesConfiguredErr: true,
+		},
 		{
-			desc:            "error with `no roles configured` if search_as_roles does not grant kube resource access",
-			userStaticRoles: []string{"request-namespace-but-no-access"},
+			desc:            "v8 error with `no roles configured` if search_as_roles does not grant kube resource access",
+			userStaticRoles: []string{"v8-kube-request-namespace-but-no-access"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 			},
 			wantNoRolesConfiguredErr: true,
 		},
+
+		{
+			desc: "v7 prune search_as_roles that does not meet request.kubernetes_resources (unconfigured field)",
+			// search as role "kube-access-namespace" got pruned b/c the request included "kube_cluster" which wasn't allowed.
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard", "v7-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
 		{
-			desc: "prune search_as_roles that does not meet request.kubernetes_resources (unconfigured field)",
+			desc: "v8 prune search_as_roles that does not meet request.kubernetes_resources (unconfigured field)",
 			// search as role "kube-access-namespace" got pruned b/c the request included "kube_cluster" which wasn't allowed.
-			userStaticRoles:      []string{"request-undefined_search-wildcard", "request-namespace_search-namespace"},
-			expectedRequestRoles: []string{"kube-access-wildcard", "db-access-wildcard"},
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard", "v8-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
+
+		{
+			desc: "v7 prune search_as_roles that does not match request.kubernetes_resources field",
+			userStaticRoles: []string{
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
 		{
-			desc: "prune search_as_roles that does not match request.kubernetes_resources field",
+			desc: "v8 prune search_as_roles that does not match request.kubernetes_resources field",
 			userStaticRoles: []string{
-				"request-pod_search-pods",
-				"request-namespace_search-namespace",
-				"request-deployment_search-deployment",
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
 			},
-			expectedRequestRoles: []string{"kube-access-namespace", "db-access-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
 			},
 		},
+
 		{
-			desc: "reject when kinds don't match (root only)",
+			desc: "v7 reject when kinds don't match (root only)",
 			userStaticRoles: []string{
-				"request-pod_search-pods",
-				"request-namespace_search-namespace",
-				"request-deployment_search-deployment",
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
 			},
-			expectedRequestRoles: []string{"kube-access-pod", "kube-access-namespace", "db-access-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-pod", "v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
@@ -3278,115 +3512,281 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc: "reject when kinds don't match (leaf only)",
+			desc: "v8 reject when kinds don't match (root only)",
 			userStaticRoles: []string{
-				"request-pod_search-pods",
-				"request-namespace_search-namespace",
-				"request-deployment_search-deployment",
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
 			},
+			expectedRequestRoles: []string{"v8-kube-access-pod", "v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindDatabase, ClusterName: "some-leaf", Name: "db2"},
-				{Kind: types.KindKubeSecret, ClusterName: "some-leaf", Name: "leaf-kube", SubResourceName: "namespace/secret-name"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubePod, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod-name"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
 		{
-			desc: "reject when kinds don't match (mix of leaf and root cluster)",
+			desc: "v7 reject when kinds don't match (leaf only)",
 			userStaticRoles: []string{
-				"request-pod_search-pods",
-				"request-namespace_search-namespace",
-				"request-deployment_search-deployment",
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
 			},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeDeployment, ClusterName: "some-leaf", Name: "kube", SubResourceName: "namespace/secret-name"},
-				{Kind: types.KindNamespace, ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+				{Kind: types.KindDatabase, ClusterName: "some-leaf", Name: "db2"},
+				{Kind: types.KindKubeSecret, ClusterName: "some-leaf", Name: "leaf-kube", SubResourceName: "namespace/secret-name"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc: "prune roles that does not give you access",
+			desc: "v8 reject when kinds don't match (leaf only)",
 			userStaticRoles: []string{
-				"request-namespace_search-namespace",
-				"request-namespace-but-no-access",
-				"request-deployment_search-deployment",
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
 			},
-			expectedRequestRoles: []string{"kube-access-namespace"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: types.KindDatabase, ClusterName: "some-leaf", Name: "db2"},
+				{Kind: types.KindKubeSecret, ClusterName: "some-leaf", Name: "leaf-kube", SubResourceName: "namespace/secret-name"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
+
 		{
-			desc: "don't further prune roles when leaf requests are present",
+			desc: "v7 reject when kinds don't match (mix of leaf and root cluster)",
 			userStaticRoles: []string{
-				"request-namespace_search-namespace",
-				"request-namespace-but-no-access",
-				"request-deployment_search-deployment",
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
 			},
-			// db-access-wildcard and kube-no-access shouldn't be in the list, but a leaf is present
-			// which skips matcher tests.
-			expectedRequestRoles: []string{"kube-access-namespace", "db-access-wildcard", "kube-no-access"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: types.KindKubeDeployment, ClusterName: "some-leaf", Name: "kube", SubResourceName: "namespace/secret-name"},
 				{Kind: types.KindNamespace, ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc:            "reject if kinds don't match even though search_as_roles allows wildcard access",
-			userStaticRoles: []string{"request-secret_search-wildcard"},
+			desc: "v8 reject when kinds don't match (mix of leaf and root cluster)",
+			userStaticRoles: []string{
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
+			},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: types.KindKubeDeployment, ClusterName: "some-leaf", Name: "kube", SubResourceName: "namespace/secret-name"},
+				{Kind: types.KindNamespace, ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
 		{
-			desc:                 "allow namespace request when deny is not matched",
-			userStaticRoles:      []string{"request-namespace_search-namespace_deny-secret"},
-			expectedRequestRoles: []string{"kube-access-namespace"},
+			desc: "v7 prune roles that does not give you access",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
 			},
 		},
 		{
-			desc:                 "allow namespace request when deny is not matched with leaf clusters",
-			userStaticRoles:      []string{"request-namespace_search-namespace_deny-secret"},
-			expectedRequestRoles: []string{"kube-access-namespace"},
+			desc: "v8 prune roles that does not give you access",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace"},
-				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace2"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
 			},
 		},
+
 		{
-			desc:                 "allow a list of different request.kubernetes_resources from same role",
-			userStaticRoles:      []string{"request-deployment-pod_search-deployment-pod", "request-namespace_search-namespace"},
-			expectedRequestRoles: []string{"kube-access-deployment", "kube-access-pod"},
+			desc: "v7 don't further prune roles when leaf requests are present",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			// db-access-wildcard and kube-no-access shouldn't be in the list, but a leaf is present
+			// which skips matcher tests.
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard", "v7-kube-no-access"},
 			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
-				{Kind: types.KindKubePod, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: types.KindNamespace, ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
 			},
 		},
 		{
-			desc:            "deny request when deny is defined from another role (denies are globally matched)",
-			userStaticRoles: []string{"request-namespace_search-namespace_deny-secret", "request-secret_search-wildcard"},
-			requestResourceIDs: []types.ResourceID{
-				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			desc: "v8 don't further prune roles when leaf requests are present",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			// db-access-wildcard and kube-no-access shouldn't be in the list, but a leaf is present
+			// which skips matcher tests.
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard", "v8-kube-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: types.KindNamespace, ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+			},
+		},
+
+		{
+			desc:            "v7 reject if kinds don't match even though search_as_roles allows wildcard access",
+			userStaticRoles: []string{"v7-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 reject if kinds don't match even though search_as_roles allows wildcard access",
+			userStaticRoles: []string{"v8-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny namespace request when deny is not matched",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny namespace request when deny is not matched",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny namespace request when deny is not matched with leaf clusters",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny namespace request when deny is not matched with leaf clusters",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 allow a list of different request.kubernetes_resources from same role",
+			userStaticRoles:      []string{"v7-kube-request-deployment-pod_search-deployment-pod", "v7-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-deployment", "v7-kube-access-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+				{Kind: types.KindKubePod, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod"},
+			},
+		},
+		{
+			desc:                 "v8 allow a list of different request.kubernetes_resources from same role",
+			userStaticRoles:      []string{"v8-kube-request-deployment-pod_search-deployment-pod", "v8-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-deployment", "v8-kube-access-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+				{Kind: types.KindKubePod, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod"},
+			},
+		},
+
+		{
+			desc:            "v7 deny request when deny is defined from another role (denies are globally matched)",
+			userStaticRoles: []string{"v7-kube-request-namespace_search-namespace_deny-secret", "v7-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 deny request when deny is defined from another role (denies are globally matched)",
+			userStaticRoles: []string{"v8-kube-request-namespace_search-namespace_deny-secret", "v8-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeSecret, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny wildcard request when deny is not matched - ns",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny wildcard request when deny is not matched - ns",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny wildcard request when deny is not matched - cluster",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny wildcard request when deny is not matched - cluster",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
 		{
-			desc:                 "allow wildcard request when deny is not matched",
-			userStaticRoles:      []string{"request-undefined_search-wildcard_deny-deployment-pod"},
-			expectedRequestRoles: []string{"kube-access-wildcard"},
+			desc:            "v7 deny wildcard request when deny is matched",
+			userStaticRoles: []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
 			},
+			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc:            "deny wildcard request when deny is matched",
-			userStaticRoles: []string{"request-undefined_search-wildcard_deny-deployment-pod"},
+			desc:            "v8 deny wildcard request when deny is matched",
+			userStaticRoles: []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
@@ -3394,46 +3794,82 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
+		{
+			desc:            "v7 request.kubernetes_resources cancel each other (config error where no kube resources becomes requestable)",
+			userStaticRoles: []string{"v7-kube-request-wildcard-cancels-deny-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
 		{
-			desc:            "request.kubernetes_resources cancel each other (config error where no kube resources becomes requestable)",
-			userStaticRoles: []string{"request-wildcard-cancels-deny-wildcard"},
+			desc:            "v8 request.kubernetes_resources cancel each other (config error where no kube resources becomes requestable)",
+			userStaticRoles: []string{"v8-kube-request-wildcard-cancels-deny-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
+		{
+			desc:                 "v7 request.kubernetes_resources cancel each other also rejects kube_cluster kinds (config error)",
+			userStaticRoles:      []string{"v7-kube-request-wildcard-cancels-deny-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
 		{
-			desc:                 "request.kubernetes_resources cancel each other also rejects kube_cluster kinds (config error)",
-			userStaticRoles:      []string{"request-wildcard-cancels-deny-wildcard"},
-			expectedRequestRoles: []string{"kube-access-wildcard"},
+			desc:                 "v8 request.kubernetes_resources cancel each other also rejects kube_cluster kinds (config error)",
+			userStaticRoles:      []string{"v8-kube-request-wildcard-cancels-deny-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
 			},
 			wantInvalidRequestKindErr: true,
 		},
+
+		{
+			desc: "v7 allow when requested role matches requested kinds",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestRoles:         []string{"v7-kube-access-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+		},
 		{
-			desc: "allow when requested role matches requested kinds",
+			desc: "v8 allow when requested role matches requested kinds",
 			userStaticRoles: []string{
-				"request-namespace_search-namespace",
-				"request-namespace-but-no-access",
-				"request-deployment_search-deployment",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
 			},
-			requestRoles:         []string{"kube-access-namespace"},
-			expectedRequestRoles: []string{"kube-access-namespace"},
+			requestRoles:         []string{"v8-kube-access-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
 			},
 		},
+
 		{
-			desc: "reject when requested role does not match ALL requested kinds",
+			desc: "v7 reject when requested role does not match ALL requested kinds",
 			userStaticRoles: []string{
-				"request-namespace_search-namespace",
-				"request-namespace-but-no-access",
-				"request-deployment_search-deployment",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
 			},
-			requestRoles: []string{"kube-access-namespace", "kube-access-deployment"},
+			requestRoles: []string{"v7-kube-access-namespace", "v7-kube-access-deployment"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
@@ -3441,13 +3877,42 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 			wantInvalidRequestKindErr: true,
 		},
 		{
-			desc: "reject when requested role does not allow all requested kinds",
+			desc: "v8 reject when requested role does not match ALL requested kinds",
 			userStaticRoles: []string{
-				"request-namespace_search-namespace",
-				"request-namespace-but-no-access",
-				"request-deployment_search-deployment",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
 			},
-			requestRoles: []string{"kube-access-namespace"},
+			requestRoles: []string{"v8-kube-access-namespace", "v8-kube-access-deployment"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 reject when requested role does not allow all requested kinds",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when requested role does not allow all requested kinds",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"v8-kube-access-namespace"},
 			requestResourceIDs: []types.ResourceID{
 				{Kind: types.KindKubeNamespace, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
 				{Kind: types.KindKubeDeployment, ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
@@ -3457,39 +3922,21 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			uls, err := userloginstate.New(header.Metadata{
-				Name: "test-user",
-			}, userloginstate.Spec{
-				Roles: tc.userStaticRoles,
-			})
-			require.NoError(t, err)
-			userStates := map[string]*userloginstate.UserLoginState{
-				uls.GetName(): uls,
-			}
-
-			g := &mockGetter{
-				roles:       roles,
-				userStates:  userStates,
-				clusterName: myClusterName,
-				kubeServers: make(map[string]types.KubeServer),
-				dbServers:   make(map[string]types.DatabaseServer),
-			}
-			g.kubeServers[kube.GetName()] = kubeServer
-			g.dbServers[dbServer.GetName()] = dbServer
+			// Init the mock.
+			const userName = "test-user"
+			g := newMockGetter(t, userName, tc.userStaticRoles)
 
-			req, err := types.NewAccessRequestWithResources(
-				"some-id", uls.GetName(), tc.requestRoles, tc.requestResourceIDs)
+			// Create the access request.
+			req, err := types.NewAccessRequestWithResources("some-id", userName, tc.requestRoles, tc.requestResourceIDs)
 			require.NoError(t, err)
 
+			// Create the request validator.
 			clock := clockwork.NewFakeClock()
-			identity := tlsca.Identity{
-				Expires: clock.Now().UTC().Add(8 * time.Hour),
-			}
-
-			validator, err := newRequestValidator(context.Background(), clock, g, uls.GetName(), WithExpandVars(true))
+			validator, err := NewRequestValidator(t.Context(), clock, g, userName, WithExpandVars(true))
 			require.NoError(t, err)
 
-			err = validator.validate(context.Background(), req, identity)
+			// Execute the validation.
+			err = validator.validate(t.Context(), req, tlsca.Identity{Expires: clock.Now().UTC().Add(8 * time.Hour)})
 			if tc.wantInvalidRequestKindErr {
 				require.Error(t, err)
 				require.Contains(t, err.Error(), InvalidKubernetesKindAccessRequest)
@@ -3504,6 +3951,968 @@ func TestValidate_WithAllowRequestKubernetesResources(t *testing.T) {
 	}
 }
 
+// TestValidate_WithAllowRequestKubernetesResource tests that requests containing
+// kubernetes resources, the kinds are enforced defined by users static role
+// field `request.kubernetes_resources`
+// Test cases with the new (>=v18) access request format hitting various role versions.
+func TestValidate_WithAllowRequestKubernetesResource(t *testing.T) {
+	const myClusterName = "teleport-cluster"
+
+	roles := loadTestRoles(t, "v7_kube_accessrequest_validate", "v8_kube_accessrequest_validate")
+	newMockGetter := initAccessRequestValidateTest(t, myClusterName, roles)
+
+	// start test
+	testCases := []struct {
+		desc                      string
+		userStaticRoles           []string
+		requestResourceIDs        []types.ResourceID
+		requestRoles              []string
+		wantInvalidRequestKindErr bool
+		wantNoRolesConfiguredErr  bool
+		expectedRequestRoles      []string
+	}{
+		{
+			desc:                 "v7 request.kubernetes_resources undefined allows anything (kube_cluster and its subresources)",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+		{
+			desc:                 "v8 request.kubernetes_resources undefined allows anything (kube_cluster and its subresources)",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+
+		{
+			desc:                 "v7 request.kubernetes_resources undefined takes precedence over configured allow field (allows anything)",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard", "v7-kube-request-secret_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+		{
+			desc:                 "v8 request.kubernetes_resources undefined takes precedence over configured allow field (allows anything)",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard", "v8-kube-request-secret_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+
+		{
+			desc:            "v7 configured deny request.kubernetes_resources takes precedence over undefined deny field",
+			userStaticRoles: []string{"v7-kube-request-wildcard-cancels-deny-wildcard", "v7-kube-request-namespace_search-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 configured deny request.kubernetes_resources takes precedence over undefined deny field",
+			userStaticRoles: []string{"v8-kube-request-wildcard-cancels-deny-wildcard", "v8-kube-request-namespace_search-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 request.kubernetes_resources does not get applied with a role without search_as_roles defined",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace", "v7-kube-request-pod_search-as-roles-undefined"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
+		{
+			desc:                 "v8 request.kubernetes_resources does not get applied with a role without search_as_roles defined",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace", "v8-kube-request-pod_search-as-roles-undefined"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
+
+		{
+			desc:                 "v7 wildcard allows any kube subresources",
+			userStaticRoles:      []string{"v7-kube-request-wildcard_search-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:ns:secrets", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+		},
+		{
+			desc:                 "v8 wildcard allows any kube subresources",
+			userStaticRoles:      []string{"v8-kube-request-wildcard_search-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:ns:secrets", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+		},
+
+		{
+			desc:            "v7 wildcard rejects kube_cluster kind among other valid requests",
+			userStaticRoles: []string{"v7-kube-request-wildcard_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 wildcard rejects kube_cluster kind among other valid requests",
+			userStaticRoles: []string{"v8-kube-request-wildcard_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:            "v7 wildcard rejects single kube_cluster request",
+			userStaticRoles: []string{"v7-kube-request-wildcard_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 wildcard rejects single kube_cluster request",
+			userStaticRoles: []string{"v8-kube-request-wildcard_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:            "v7 error with `no roles configured` if search_as_roles does not grant kube resource access",
+			userStaticRoles: []string{"v7-kube-request-namespace-but-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantNoRolesConfiguredErr: true,
+		},
+		{
+			desc:            "v8 error with `no roles configured` if search_as_roles does not grant kube resource access",
+			userStaticRoles: []string{"v8-kube-request-namespace-but-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantNoRolesConfiguredErr: true,
+		},
+
+		{
+			desc: "v7 prune search_as_roles that does not meet request.kubernetes_resources (unconfigured field)",
+			// search as role "kube-access-namespace" got pruned b/c the request included "kube_cluster" which wasn't allowed.
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard", "v7-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+		{
+			desc: "v8 prune search_as_roles that does not meet request.kubernetes_resources (unconfigured field)",
+			// search as role "kube-access-namespace" got pruned b/c the request included "kube_cluster" which wasn't allowed.
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard", "v8-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace/*"},
+			},
+		},
+
+		{
+			desc: "v7 prune search_as_roles that does not match request.kubernetes_resources field1",
+			userStaticRoles: []string{
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
+		{
+			desc: "v8 prune search_as_roles that does not match request.kubernetes_resources field1",
+			userStaticRoles: []string{
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+		},
+
+		{
+			desc: "v7 reject when kinds don't match (root only)",
+			userStaticRoles: []string{
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v7-kube-access-pod", "v7-kube-access-namespace", "v7-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/*"},
+				{Kind: "kube:ns:pods", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when kinds don't match (root only)",
+			userStaticRoles: []string{
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v8-kube-access-pod", "v8-kube-access-namespace", "v8-kube-db-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: myClusterName, Name: "db"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:ns:*.*", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/*"},
+				{Kind: "kube:ns:pods", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 reject when kinds don't match (leaf only)",
+			userStaticRoles: []string{
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: "some-leaf", Name: "db2"},
+				{Kind: "kube:ns:secrets", ClusterName: "some-leaf", Name: "leaf-kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when kinds don't match (leaf only)",
+			userStaticRoles: []string{
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindDatabase, ClusterName: "some-leaf", Name: "db2"},
+				{Kind: "kube:ns:secrets", ClusterName: "some-leaf", Name: "leaf-kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 reject when kinds don't match (mix of leaf and root cluster)",
+			userStaticRoles: []string{
+				"v7-kube-request-pod_search-pods",
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:deployments.apps", ClusterName: "some-leaf", Name: "kube", SubResourceName: "namespace/secret-name"},
+				{Kind: "kube:cw:namespaces", ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when kinds don't match (mix of leaf and root cluster)",
+			userStaticRoles: []string{
+				"v8-kube-request-pod_search-pods",
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:deployments.apps", ClusterName: "some-leaf", Name: "kube", SubResourceName: "namespace/secret-name"},
+				{Kind: "kube:cw:namespaces", ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 prune roles that does not give you access",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+		},
+		{
+			desc: "v8 prune roles that does not give you access",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+		},
+
+		{
+			desc: "v7 don't further prune roles when leaf requests are present",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			// db-access-wildcard and kube-no-access shouldn't be in the list, but a leaf is present
+			// which skips matcher tests.
+			expectedRequestRoles: []string{"v7-kube-access-namespace", "v7-kube-db-access-wildcard", "v7-kube-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: "kube:cw:namespaces", ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+			},
+		},
+		{
+			desc: "v8 don't further prune roles when leaf requests are present",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			// db-access-wildcard and kube-no-access shouldn't be in the list, but a leaf is present
+			// which skips matcher tests.
+			expectedRequestRoles: []string{"v8-kube-access-namespace", "v8-kube-db-access-wildcard", "v8-kube-no-access"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+				{Kind: "kube:cw:namespaces", ClusterName: "some-leaf", Name: "kube-leaf", SubResourceName: "namespace"},
+			},
+		},
+
+		{
+			desc:            "v7 reject if kinds don't match even though search_as_roles allows wildcard access",
+			userStaticRoles: []string{"v7-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 reject if kinds don't match even though search_as_roles allows wildcard access",
+			userStaticRoles: []string{"v8-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "some-namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny namespace request when deny is not matched",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny namespace request when deny is not matched",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny namespace request when deny is not matched with leaf clusters",
+			userStaticRoles:      []string{"v7-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny namespace request when deny is not matched with leaf clusters",
+			userStaticRoles:      []string{"v8-kube-request-namespace_search-namespace_deny-secret"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: "leaf-cluster", Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 allow a list of different request.kubernetes_resources from same role",
+			userStaticRoles:      []string{"v7-kube-request-deployment-pod_search-deployment-pod", "v7-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-deployment", "v7-kube-access-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+				{Kind: "kube:ns:pods", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod"},
+			},
+		},
+		{
+			desc:                 "v8 allow a list of different request.kubernetes_resources from same role",
+			userStaticRoles:      []string{"v8-kube-request-deployment-pod_search-deployment-pod", "v8-kube-request-namespace_search-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-deployment", "v8-kube-access-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+				{Kind: "kube:ns:pods", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/pod"},
+			},
+		},
+
+		{
+			desc:            "v7 deny request when deny is defined from another role (denies are globally matched)",
+			userStaticRoles: []string{"v7-kube-request-namespace_search-namespace_deny-secret", "v7-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:secrets", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 deny request when deny is defined from another role (denies are globally matched)",
+			userStaticRoles: []string{"v8-kube-request-namespace_search-namespace_deny-secret", "v8-kube-request-secret_search-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:ns:secrets", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/secret-name"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny wildcard request when deny is not matched - ns",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny wildcard request when deny is not matched - ns",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 deny wildcard request when deny is not matched - cluster",
+			userStaticRoles:      []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 deny wildcard request when deny is not matched - cluster",
+			userStaticRoles:      []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:            "v7 deny wildcard request when deny is matched",
+			userStaticRoles: []string{"v7-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 deny wildcard request when deny is matched",
+			userStaticRoles: []string{"v8-kube-request-undefined_search-wildcard_deny-deployment-pod"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:            "v7 request.kubernetes_resources cancel each other (config error where no kube resources becomes requestable)",
+			userStaticRoles: []string{"v7-kube-request-wildcard-cancels-deny-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:            "v8 request.kubernetes_resources cancel each other (config error where no kube resources becomes requestable)",
+			userStaticRoles: []string{"v8-kube-request-wildcard-cancels-deny-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc:                 "v7 request.kubernetes_resources cancel each other also rejects kube_cluster kinds (config error)",
+			userStaticRoles:      []string{"v7-kube-request-wildcard-cancels-deny-wildcard"},
+			expectedRequestRoles: []string{"v7-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc:                 "v8 request.kubernetes_resources cancel each other also rejects kube_cluster kinds (config error)",
+			userStaticRoles:      []string{"v8-kube-request-wildcard-cancels-deny-wildcard"},
+			expectedRequestRoles: []string{"v8-kube-access-wildcard"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: types.KindKubernetesCluster, ClusterName: myClusterName, Name: "kube"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 allow when requested role matches requested kinds",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestRoles:         []string{"v7-kube-access-namespace"},
+			expectedRequestRoles: []string{"v7-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+		},
+		{
+			desc: "v8 allow when requested role matches requested kinds",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestRoles:         []string{"v8-kube-access-namespace"},
+			expectedRequestRoles: []string{"v8-kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+		},
+
+		{
+			desc: "v7 reject when requested role does not match ALL requested kinds",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"v7-kube-access-namespace", "v7-kube-access-deployment"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when requested role does not match ALL requested kinds",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"v8-kube-access-namespace", "v8-kube-access-deployment"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace2"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+
+		{
+			desc: "v7 reject when requested role does not allow all requested kinds",
+			userStaticRoles: []string{
+				"v7-kube-request-namespace_search-namespace",
+				"v7-kube-request-namespace-but-no-access",
+				"v7-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+		{
+			desc: "v8 reject when requested role does not allow all requested kinds",
+			userStaticRoles: []string{
+				"v8-kube-request-namespace_search-namespace",
+				"v8-kube-request-namespace-but-no-access",
+				"v8-kube-request-deployment_search-deployment",
+			},
+			requestRoles: []string{"kube-access-namespace"},
+			requestResourceIDs: []types.ResourceID{
+				{Kind: "kube:cw:namespaces", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace"},
+				{Kind: "kube:cw:deployments.apps", ClusterName: myClusterName, Name: "kube", SubResourceName: "namespace/deployment"},
+			},
+			wantInvalidRequestKindErr: true,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			// Init the mock.
+			const userName = "test-user"
+			g := newMockGetter(t, userName, tc.userStaticRoles)
+
+			// Create the access request.
+			req, err := types.NewAccessRequestWithResources("some-id", userName, tc.requestRoles, tc.requestResourceIDs)
+			require.NoError(t, err)
+
+			// Create the request validator.
+			clock := clockwork.NewFakeClock()
+			validator, err := NewRequestValidator(t.Context(), clock, g, userName, WithExpandVars(true))
+			require.NoError(t, err)
+
+			// Execute the validation.
+			err = validator.validate(t.Context(), req, tlsca.Identity{Expires: clock.Now().UTC().Add(8 * time.Hour)})
+			if tc.wantInvalidRequestKindErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), InvalidKubernetesKindAccessRequest)
+			} else if tc.wantNoRolesConfiguredErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), `no roles configured in the "search_as_roles"`)
+			} else {
+				require.NoError(t, err)
+				require.ElementsMatch(t, tc.expectedRequestRoles, req.GetRoles())
+			}
+		})
+	}
+}
+
+// TestReasonPrompts tests that custom prompts (both global (spec.options.request_prompt)
+// and local (spec.allow.request.reason.prompt)) are properly handled.
+func TestReasonPrompts(t *testing.T) {
+	t.Parallel()
+
+	clusterName := "my-test-cluster"
+
+	g := &mockGetter{
+		roles:       make(map[string]types.Role),
+		userStates:  make(map[string]*userloginstate.UserLoginState),
+		nodes:       make(map[string]types.Server),
+		clusterName: clusterName,
+	}
+
+	nodeDesc := []struct {
+		name   string
+		labels map[string]string
+	}{
+		{
+			name: "fork-node",
+			labels: map[string]string{
+				"cutlery": "fork",
+			},
+		},
+		{
+			name: "spoon-node",
+			labels: map[string]string{
+				"cutlery": "spoon",
+			},
+		},
+	}
+	for _, desc := range nodeDesc {
+		node, err := types.NewServerWithLabels(desc.name, types.KindNode, types.ServerSpecV2{}, desc.labels)
+		require.NoError(t, err)
+		g.nodes[desc.name] = node
+	}
+
+	roleDesc := map[string]types.RoleSpecV6{
+		"cutlery-access": {
+			Allow: types.RoleConditions{
+				NodeLabels: types.Labels{
+					"cutlery": []string{types.Wildcard},
+				},
+			},
+		},
+		"fork-access": {
+			Allow: types.RoleConditions{
+				NodeLabels: types.Labels{
+					"cutlery": []string{"fork"},
+				},
+			},
+		},
+		"fork-access-requester": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					Roles: []string{"fork-access"},
+				},
+			},
+		},
+		"fork-access-requester-global-prompt": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					Roles: []string{"fork-access"},
+				},
+			},
+			Options: types.RoleOptions{
+				RequestPrompt: "global test prompt",
+			},
+		},
+		"fork-access-requester-local-prompt": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					Roles: []string{"fork-access"},
+					Reason: &types.AccessRequestConditionsReason{
+						Prompt: "local test prompt",
+					},
+				},
+			},
+		},
+		"fork-access-requester-both-prompts": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					Roles: []string{"fork-access"},
+					Reason: &types.AccessRequestConditionsReason{
+						Prompt: "local test prompt",
+					},
+				},
+			},
+			Options: types.RoleOptions{
+				RequestPrompt: "global test prompt",
+			},
+		},
+		"fork-node-requester": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					SearchAsRoles: []string{"fork-access"},
+				},
+			},
+		},
+		"fork-node-requester-local-prompt": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					SearchAsRoles: []string{"fork-access"},
+					Reason: &types.AccessRequestConditionsReason{
+						Prompt: "resource - local test prompt",
+					},
+				},
+			},
+		},
+		"fork-node-requester-both-prompts": {
+			Allow: types.RoleConditions{
+				Request: &types.AccessRequestConditions{
+					SearchAsRoles: []string{"fork-access"},
+					Reason: &types.AccessRequestConditionsReason{
+						Prompt: "resource - local test prompt",
+					},
+				},
+			},
+			Options: types.RoleOptions{
+				RequestPrompt: "resource - global test prompt",
+			},
+		},
+	}
+	for name, spec := range roleDesc {
+		role, err := types.NewRole(name, spec)
+		require.NoError(t, err)
+		g.roles[name] = role
+	}
+
+	testCases := []struct {
+		name               string
+		currentRoles       []string
+		requestRoles       []string
+		requestResourceIDs []types.ResourceID
+		assertion          func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities)
+	}{
+		{
+			name:         "role request: contains no prompt",
+			currentRoles: []string{"fork-access-requester"},
+			requestRoles: []string{"fork-access"},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Empty(t, validator.reasonPrompts)
+				require.Empty(t, accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "role request: contains global prompt",
+			currentRoles: []string{"fork-access-requester-global-prompt"},
+			requestRoles: []string{"fork-access"},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Len(t, validator.reasonPrompts, 1)
+				require.Equal(t, "global test prompt", validator.reasonPrompts[0])
+
+				require.Equal(t, "global test prompt", accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "role request: contains local prompt",
+			currentRoles: []string{"fork-access-requester-local-prompt"},
+			requestRoles: []string{"fork-access"},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Len(t, validator.reasonPrompts, 1)
+				require.Equal(t, "local test prompt", validator.reasonPrompts[0])
+
+				require.Empty(t, accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "role request: contains both prompts",
+			currentRoles: []string{"fork-access-requester-both-prompts"},
+			requestRoles: []string{"fork-access"},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Len(t, validator.reasonPrompts, 2)
+				require.Equal(t, "global test prompt", validator.reasonPrompts[0])
+				require.Equal(t, "local test prompt", validator.reasonPrompts[1])
+
+				require.Equal(t, "global test prompt", accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "resource request: contains no prompts",
+			currentRoles: []string{"fork-node-requester"},
+			requestResourceIDs: []types.ResourceID{
+				{ClusterName: clusterName, Kind: types.KindNode, Name: "fork-node"},
+			},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Empty(t, validator.reasonPrompts)
+				require.Empty(t, accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "resource request: contains local prompt",
+			currentRoles: []string{"fork-node-requester-local-prompt"},
+			requestResourceIDs: []types.ResourceID{
+				{ClusterName: clusterName, Kind: types.KindNode, Name: "fork-node"},
+			},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Len(t, validator.reasonPrompts, 1)
+				require.Equal(t, "resource - local test prompt", validator.reasonPrompts[0])
+
+				require.Empty(t, accessCaps.RequestPrompt)
+			},
+		},
+		{
+			name:         "resource request: contains both prompts",
+			currentRoles: []string{"fork-node-requester-both-prompts"},
+			requestResourceIDs: []types.ResourceID{
+				{ClusterName: clusterName, Kind: types.KindNode, Name: "fork-node"},
+			},
+			assertion: func(t *testing.T, validator *RequestValidator, accessCaps *types.AccessCapabilities) {
+				require.Len(t, validator.reasonPrompts, 2)
+				require.Equal(t, "resource - global test prompt", validator.reasonPrompts[0])
+				require.Equal(t, "resource - local test prompt", validator.reasonPrompts[1])
+
+				require.Equal(t, "resource - global test prompt", accessCaps.RequestPrompt)
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			clock := clockwork.NewFakeClock()
+
+			uls, err := userloginstate.New(header.Metadata{
+				Name: "test-user",
+			}, userloginstate.Spec{
+				Roles: tc.currentRoles,
+				Traits: trait.Traits{
+					"logins": []string{"abcd"},
+				},
+			})
+			require.NoError(t, err)
+			g.userStates[uls.GetName()] = uls
+
+			identity := tlsca.Identity{
+				Expires: clock.Now().UTC().Add(8 * time.Hour),
+			}
+
+			validator, err := NewRequestValidator(ctx, clock, g, uls.GetName(), WithExpandVars(true))
+			require.NoError(t, err)
+
+			req, err := types.NewAccessRequestWithResources(
+				"some-id", uls.GetName(), tc.requestRoles, tc.requestResourceIDs)
+			require.NoError(t, err)
+
+			// perform request validation (necessary in order to initialize internal
+			// request variables, ie. reason prompts).
+			err = validator.validate(ctx, req, identity)
+			require.NoError(t, err)
+
+			capReq := types.AccessCapabilitiesRequest{
+				User:             uls.GetName(),
+				ResourceIDs:      tc.requestResourceIDs,
+				RequestableRoles: len(tc.requestResourceIDs) == 0,
+			}
+
+			accessCapabilities, err := CalculateAccessCapabilities(ctx, clock, g, identity, capReq)
+			require.NoError(t, err)
+
+			tc.assertion(t, &validator, accessCapabilities)
+		})
+	}
+}
+
 type roleTestSet map[string]struct {
 	condition types.RoleConditions
 	options   types.RoleOptions
diff --git a/lib/services/app.go b/lib/services/app.go
index 609a994daa3be..e6028bbbd3312 100644
--- a/lib/services/app.go
+++ b/lib/services/app.go
@@ -19,19 +19,27 @@
 package services
 
 import (
+	"cmp"
 	"context"
 	"fmt"
+	"iter"
+	"log/slog"
+	"net/http"
 	"net/url"
 	"os"
 	"strings"
 	"sync"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/net/idna"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/validation"
 	kyaml "k8s.io/apimachinery/pkg/util/yaml"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -39,12 +47,16 @@ import (
 type AppGetter interface {
 	// GetApps returns all application resources.
 	GetApps(context.Context) ([]types.Application, error)
+	// ListApps returns a page of application resources.
+	ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error)
+	// Apps returns application resources within the range [start, end).
+	Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error]
 	// GetApp returns the specified application resource.
 	GetApp(ctx context.Context, name string) (types.Application, error)
 }
 
-// Apps defines an interface for managing application resources.
-type Apps interface {
+// Applications defines an interface for managing application resources.
+type Applications interface {
 	// AppGetter provides methods for fetching application resources.
 	AppGetter
 	// CreateApp creates a new application resource.
@@ -57,6 +69,69 @@ type Apps interface {
 	DeleteAllApps(context.Context) error
 }
 
+// ValidateApp validates the Application resource.
+func ValidateApp(app types.Application, proxyGetter ProxyGetter) error {
+	// If no public address is set, there's nothing to validate.
+	if app.GetPublicAddr() == "" {
+		return nil
+	}
+
+	// The app's spec has already been validated in CheckAndSetDefaults, so we can assume the public address is a valid
+	// address. The remainder of this function focuses on detecting conflicts with proxy public addresses because the
+	// proxy addresses are not part of the app spec and need to be fetched separately.
+	appAddr, err := utils.ParseAddr(app.GetPublicAddr())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Convert the application's public address hostname to its ASCII representation for comparison. Strip any trailing
+	// dots to ensure consistent comparison.
+	asciiAppHostname, err := idna.ToASCII(strings.TrimRight(appAddr.Host(), "."))
+	if err != nil {
+		return trace.Wrap(err, "app %q has an invalid IDN hostname %q", app.GetName(), appAddr.Host())
+	}
+
+	proxyServers, err := clientutils.CollectWithFallback(context.TODO(), proxyGetter.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return proxyGetter.GetProxies()
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Prevent routing conflicts and session hijacking by ensuring the application's public address does not match the
+	// public address of any proxy. If an application shares a public address with a proxy, requests intended for the
+	// proxy could be misrouted to the application, compromising security.
+	for _, proxyServer := range proxyServers {
+		proxyAddrs, err := utils.ParseAddrs(proxyServer.GetPublicAddrs())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		for _, proxyAddr := range proxyAddrs {
+			// Also convert the proxy's public address hostname to its ASCII representation for comparison and strip any
+			// trailing dots.
+			asciiProxyHostname, err := idna.ToASCII(strings.TrimRight(proxyAddr.Host(), "."))
+			if err != nil {
+				return trace.Wrap(err, "proxy %q has an invalid IDN hostname %q", proxyServer.GetName(), proxyAddr)
+			}
+
+			// Compare the ASCII-normalized hostnames for equality, ignoring case.
+			if strings.EqualFold(asciiProxyHostname, asciiAppHostname) {
+				return trace.BadParameter(
+					"Application %q public address %q conflicts with the Teleport Proxy public address. "+
+						"Configure the application to use a unique public address that does not match the proxy's public addresses. "+
+						"Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/#customize-public-address.",
+					app.GetName(),
+					app.GetPublicAddr(),
+				)
+			}
+		}
+	}
+
+	return nil
+}
+
 // MarshalApp marshals Application resource to JSON.
 func MarshalApp(app types.Application, opts ...MarshalOption) ([]byte, error) {
 	cfg, err := CollectOptions(opts)
@@ -183,9 +258,12 @@ func NewApplicationFromKubeService(service corev1.Service, clusterName, protocol
 	}
 
 	app, err := types.NewAppV3(types.Metadata{
-		Name:        appName,
-		Description: fmt.Sprintf("Discovered application in Kubernetes cluster %q", clusterName),
-		Labels:      labels,
+		Name: appName,
+		Description: cmp.Or(
+			getDescription(service.GetAnnotations()),
+			fmt.Sprintf("Discovered application in Kubernetes cluster %q", clusterName),
+		),
+		Labels: labels,
 	}, types.AppSpecV3{
 		URI:                appURI,
 		Rewrite:            rewriteConfig,
@@ -235,6 +313,10 @@ func getAppRewriteConfig(annotations map[string]string) (*types.Rewrite, error)
 	return &rw, nil
 }
 
+func getDescription(annotations map[string]string) string {
+	return annotations[types.DiscoveryDescription]
+}
+
 func getPublicAddr(annotations map[string]string) string {
 	return annotations[types.DiscoveryPublicAddr]
 }
@@ -303,3 +385,27 @@ func getClusterDomain() string {
 	}
 	return "cluster.local"
 }
+
+// RewriteHeadersAndApplyValueTraits rewrites the provided request's headers
+// while applying value traits to them.
+func RewriteHeadersAndApplyValueTraits(r *http.Request, rewrites iter.Seq[*types.Header], traits wrappers.Traits, log *slog.Logger) {
+	for header := range rewrites {
+		values, err := ApplyValueTraits(header.Value, traits)
+		if err != nil {
+			log.DebugContext(r.Context(), "Failed to apply traits",
+				"header_value", header.Value,
+				"error", err,
+			)
+			continue
+		}
+		r.Header.Del(header.Name)
+		for _, value := range values {
+			switch http.CanonicalHeaderKey(header.Name) {
+			case teleport.HostHeader:
+				r.Host = value
+			default:
+				r.Header.Add(header.Name, value)
+			}
+		}
+	}
+}
diff --git a/lib/services/app_test.go b/lib/services/app_test.go
index 2dadd3fdb6cf6..290b9071a9b7d 100644
--- a/lib/services/app_test.go
+++ b/lib/services/app_test.go
@@ -19,8 +19,14 @@
 package services
 
 import (
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"slices"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -29,6 +35,192 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
+func TestValidateApp(t *testing.T) {
+	tests := []struct {
+		name       string
+		app        types.Application
+		proxyAddrs []string
+		wantErr    string
+	}{
+		{
+			name: "no public addr, no error",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+		},
+		{
+			name: "public addr does not conflict",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "app.example.com"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+		},
+		{
+			name: "public addr matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "web.example.com"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "public addr with trailing dot matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "web.example.com."})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "public addr with multiple trailing dots matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "web.example.com..."})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "public addr with mixed casing matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "WeB.ExAmPle.CoM"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"web.example.com:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "multiple proxy addrs, one matches",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "web.example.com"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"other.com:443", "web.example.com:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "public addr with IDN matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "例.cn"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"xn--fsq.cn:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "public addr with IDN does not conflict with non-IDN proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "münchen.de"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"example.com:443"},
+		},
+		{
+			name: "IDN with mixed case matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "MünchEn.de"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"münchen.de:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "IDN with subdomains matches proxy host",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "sub.münchen.de"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"sub.xn--mnchen-3ya.de:443"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+		{
+			name: "empty proxy addrs",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "example.com"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{},
+		},
+		{
+			name: "multiple conflicting proxies",
+			app: func() types.Application {
+				app, err := types.NewAppV3(types.Metadata{Name: "app"}, types.AppSpecV3{URI: "http://localhost:8080", PublicAddr: "example.com"})
+				require.NoError(t, err)
+				return app
+			}(),
+			proxyAddrs: []string{"example.com:443", "example.com:80"},
+			wantErr:    "conflicts with the Teleport Proxy public address",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateApp(tt.app, &mockProxyGetter{addrs: tt.proxyAddrs})
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// mockProxyGetter is a test implementation of ProxyGetter.
+type mockProxyGetter struct {
+	addrs []string
+}
+
+func (m *mockProxyGetter) GetProxies() ([]types.Server, error) {
+	servers := make([]types.Server, 0, len(m.addrs))
+
+	for _, addr := range m.addrs {
+		servers = append(
+			servers,
+			&types.ServerV2{
+				Spec: types.ServerSpecV2{
+					PublicAddrs: []string{addr},
+				},
+			},
+		)
+	}
+
+	return servers, nil
+}
+
+func (m *mockProxyGetter) ListProxyServers(_ context.Context, _ int, _ string) ([]types.Server, string, error) {
+	servers := make([]types.Server, 0, len(m.addrs))
+
+	for _, addr := range m.addrs {
+		servers = append(
+			servers,
+			&types.ServerV2{
+				Spec: types.ServerSpecV2{
+					PublicAddrs: []string{addr},
+				},
+			},
+		)
+	}
+
+	return servers, "", nil
+}
+
 // TestApplicationUnmarshal verifies an app resource can be unmarshaled.
 func TestApplicationUnmarshal(t *testing.T) {
 	expected, err := types.NewAppV3(types.Metadata{
@@ -375,3 +567,25 @@ func TestInsecureSkipVerify(t *testing.T) {
 		require.Equal(t, tt.expected, result)
 	}
 }
+
+func TestRewriteHeadersAndApplyValueTraits(t *testing.T) {
+	r := httptest.NewRequest("GET", "/foo", nil)
+	r.Header.Set("x-no-rewrite", "no-rewrite")
+	rewrites := []*types.Header{
+		{Name: "host", Value: "1.2.3.4"},
+		{Name: "x-rewrite", Value: "{{external.rewrite}}"},
+		// Missing traits should log a debug message that this rewrite is skipped.
+		{Name: "x-bad-rewrite", Value: "{{external.bad_rewrite}}"},
+	}
+	traits := map[string][]string{
+		"rewrite": {"value1", "value2"},
+	}
+	RewriteHeadersAndApplyValueTraits(r, slices.Values(rewrites), traits, slog.Default())
+
+	assert.Equal(t, "1.2.3.4", r.Host)
+	wantHeaders := make(http.Header)
+	wantHeaders.Add("x-rewrite", "value1")
+	wantHeaders.Add("x-rewrite", "value2")
+	wantHeaders.Add("x-no-rewrite", "no-rewrite")
+	assert.Equal(t, wantHeaders, r.Header)
+}
diff --git a/lib/services/autoupdates.go b/lib/services/autoupdates.go
index c30e244531fdc..6f0f3dbe3884b 100644
--- a/lib/services/autoupdates.go
+++ b/lib/services/autoupdates.go
@@ -40,6 +40,12 @@ type AutoUpdateServiceGetter interface {
 
 	// ListAutoUpdateAgentReports returns an AutoUpdateAgentReports page.
 	ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pageToken string) ([]*autoupdate.AutoUpdateAgentReport, string, error)
+
+	// GetAutoUpdateBotInstanceReport gets the singleton auto-update bot report.
+	GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdate.AutoUpdateBotInstanceReport, error)
+
+	// DeleteAutoUpdateBotInstanceReport deletes the singleton auto-update bot instance report.
+	DeleteAutoUpdateBotInstanceReport(ctx context.Context) error
 }
 
 // AutoUpdateService stores the autoupdate service.
@@ -96,4 +102,7 @@ type AutoUpdateService interface {
 
 	// DeleteAllAutoUpdateAgentReports deletes all AutoUpdateAgentReport resources.
 	DeleteAllAutoUpdateAgentReports(ctx context.Context) error
+
+	// UpsertAutoUpdateBotInstanceReport creates or updates the bot instance report.
+	UpsertAutoUpdateBotInstanceReport(ctx context.Context, spec *autoupdate.AutoUpdateBotInstanceReport) (*autoupdate.AutoUpdateBotInstanceReport, error)
 }
diff --git a/lib/services/bot_instance.go b/lib/services/bot_instance.go
index cf6d6b9360ecf..df9fcd3bacb1e 100644
--- a/lib/services/bot_instance.go
+++ b/lib/services/bot_instance.go
@@ -18,10 +18,14 @@ package services
 
 import (
 	"context"
+	"slices"
 
+	"github.com/charlievieth/strcase"
 	"github.com/gravitational/trace"
 
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1/expression"
+	"github.com/gravitational/teleport/lib/utils/typical"
 )
 
 // BotInstance is an interface for the BotInstance service.
@@ -33,7 +37,7 @@ type BotInstance interface {
 	GetBotInstance(ctx context.Context, botName, instanceID string) (*machineidv1.BotInstance, error)
 
 	// ListBotInstances
-	ListBotInstances(ctx context.Context, botName string, pageSize int, lastToken string, search string) ([]*machineidv1.BotInstance, string, error)
+	ListBotInstances(ctx context.Context, pageSize int, lastToken string, options *ListBotInstancesRequestOptions) ([]*machineidv1.BotInstance, string, error)
 
 	// DeleteBotInstance
 	DeleteBotInstance(ctx context.Context, botName, instanceID string) error
@@ -78,3 +82,114 @@ func MarshalBotInstance(object *machineidv1.BotInstance, opts ...MarshalOption)
 func UnmarshalBotInstance(data []byte, opts ...MarshalOption) (*machineidv1.BotInstance, error) {
 	return UnmarshalProtoResource[*machineidv1.BotInstance](data, opts...)
 }
+
+func MatchBotInstance(b *machineidv1.BotInstance, botName string, search string, exp typical.Expression[*expression.Environment, bool]) bool {
+	if botName != "" && b.GetSpec().GetBotName() != botName {
+		return false
+	}
+
+	heartbeat := GetBotInstanceLatestHeartbeat(b)
+	authentication := GetBotInstanceLatestAuthentication(b)
+
+	if exp != nil {
+		if match, err := exp.Evaluate(&expression.Environment{
+			Metadata:             b.GetMetadata(),
+			Spec:                 b.GetSpec(),
+			LatestHeartbeat:      heartbeat,
+			LatestAuthentication: authentication,
+		}); err != nil || !match {
+			return false
+		}
+	}
+
+	if search == "" {
+		return true
+	}
+
+	values := []string{
+		b.Spec.BotName,
+		b.Spec.InstanceId,
+	}
+
+	if heartbeat != nil {
+		values = append(values, heartbeat.Hostname, heartbeat.JoinMethod, heartbeat.Version, "v"+heartbeat.Version)
+	}
+
+	return slices.ContainsFunc(values, func(val string) bool {
+		return strcase.Contains(val, search)
+	})
+}
+
+// GetBotInstanceLatestHeartbeat returns the most recent heartbeat for the
+// given bot instance.
+func GetBotInstanceLatestHeartbeat(botInstance *machineidv1.BotInstance) *machineidv1.BotInstanceStatusHeartbeat {
+	heartbeat := botInstance.GetStatus().GetInitialHeartbeat()
+	latestHeartbeats := botInstance.GetStatus().GetLatestHeartbeats()
+	if len(latestHeartbeats) > 0 {
+		heartbeat = latestHeartbeats[len(latestHeartbeats)-1]
+	}
+	return heartbeat
+}
+
+// GetBotInstanceLatestAuthentication returns the most recent authentication for
+// the given bot instance.
+func GetBotInstanceLatestAuthentication(botInstance *machineidv1.BotInstance) *machineidv1.BotInstanceStatusAuthentication {
+	authentication := botInstance.GetStatus().GetInitialAuthentication()
+	latestAuthentications := botInstance.GetStatus().GetLatestAuthentications()
+	if len(latestAuthentications) > 0 {
+		authentication = latestAuthentications[len(latestAuthentications)-1]
+	}
+	return authentication
+}
+
+type ListBotInstancesRequestOptions struct {
+	// The sort field to use for the results. If empty, the default sort field
+	// is used.
+	SortField string
+	// The sort order to use for the results. If empty, the default sort order
+	// is used.
+	SortDesc bool
+	// The name of the Bot to list BotInstances for. If empty, all BotInstances
+	// will be listed.
+	FilterBotName string
+	// A search term used to filter the results. If non-empty, it's used to
+	// match against supported fields.
+	FilterSearchTerm string
+	// A Teleport predicate language query used to filter the results.
+	FilterQuery string
+}
+
+func (o *ListBotInstancesRequestOptions) GetSortField() string {
+	if o == nil {
+		return ""
+	}
+	return o.SortField
+}
+
+func (o *ListBotInstancesRequestOptions) GetSortDesc() bool {
+	if o == nil {
+		return false
+	}
+	return o.SortDesc
+}
+
+func (o *ListBotInstancesRequestOptions) GetFilterBotName() string {
+	if o == nil {
+		return ""
+	}
+	return o.FilterBotName
+}
+
+func (o *ListBotInstancesRequestOptions) GetFilterSearchTerm() string {
+	if o == nil {
+		return ""
+	}
+	return o.FilterSearchTerm
+}
+
+func (o *ListBotInstancesRequestOptions) GetFilterQuery() string {
+	if o == nil {
+		return ""
+	}
+	return o.FilterQuery
+}
diff --git a/lib/services/configuration.go b/lib/services/configuration.go
index e020401728a44..1e90bc8e235af 100644
--- a/lib/services/configuration.go
+++ b/lib/services/configuration.go
@@ -20,6 +20,7 @@ package services
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
@@ -42,7 +43,7 @@ type ClusterConfiguration interface {
 	ClusterNameGetter
 
 	// GetStaticTokens gets services.StaticTokens from the backend.
-	GetStaticTokens() (types.StaticTokens, error)
+	GetStaticTokens(context.Context) (types.StaticTokens, error)
 	// SetStaticTokens sets services.StaticTokens on the backend.
 	SetStaticTokens(types.StaticTokens) error
 	// DeleteStaticTokens deletes static tokens resource
@@ -103,6 +104,11 @@ type ClusterConfiguration interface {
 
 	// GetInstallers gets all installer scripts from the backend
 	GetInstallers(context.Context) ([]types.Installer, error)
+	// ListInstallers returns a page of installer script resources.
+	ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error)
+	// RangeInstallers returns installer script resources within the range [start, end).
+	RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error]
+
 	// GetInstaller gets the installer script from the backend
 	GetInstaller(ctx context.Context, name string) (types.Installer, error)
 	// SetInstaller sets the installer script in the backend
diff --git a/lib/services/configuration_test.go b/lib/services/configuration_test.go
index b4a45e284fe59..b93c95c9792fd 100644
--- a/lib/services/configuration_test.go
+++ b/lib/services/configuration_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestAuthPreferenceValidate(t *testing.T) {
@@ -181,7 +182,7 @@ func TestAuthPreferenceValidate(t *testing.T) {
 					t.Setenv(teleport.EnvVarAllowNoSecondFactor, "true")
 				}
 
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestFeatures: tc.features,
 				})
 
diff --git a/lib/services/database.go b/lib/services/database.go
index 7c558d9f1ca59..b7531e860339c 100644
--- a/lib/services/database.go
+++ b/lib/services/database.go
@@ -21,6 +21,7 @@ package services
 import (
 	"context"
 	"errors"
+	"iter"
 	"log/slog"
 	"net"
 	"net/netip"
@@ -47,6 +48,10 @@ import (
 type DatabaseGetter interface {
 	// GetDatabases returns all database resources.
 	GetDatabases(context.Context) ([]types.Database, error)
+	// ListDatabases returns a page of database resources.
+	ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error)
+	// RangeDatabases returns database resources within the range [start, end).
+	RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error]
 	// GetDatabase returns the specified database resource.
 	GetDatabase(ctx context.Context, name string) (types.Database, error)
 }
@@ -138,6 +143,10 @@ func ValidateDatabase(db types.Database) error {
 		if err := validateMongoDB(db); err != nil {
 			return trace.Wrap(err)
 		}
+	} else if db.GetProtocol() == defaults.ProtocolOracle {
+		if err := validateOracleURI(db.GetURI()); err != nil {
+			return trace.BadParameter("invalid Oracle database %q address: %q, error: %v", db.GetName(), db.GetURI(), err)
+		}
 	} else if db.GetProtocol() == defaults.ProtocolRedis {
 		_, err := connection.ParseRedisAddress(db.GetURI())
 		if err != nil {
@@ -160,12 +169,16 @@ func ValidateDatabase(db types.Database) error {
 			return trace.BadParameter("GCP Spanner database %q address should be %q",
 				db.GetName(), gcputils.SpannerEndpoint)
 		}
+	} else if db.GetType() == types.DatabaseTypeAlloyDB {
+		_, err := gcputils.ParseAlloyDBConnectionURI(db.GetURI())
+		if err != nil {
+			return trace.Wrap(err, "invalid AlloyDB address")
+		}
 	} else if needsURIValidation(db) {
 		if _, _, err := net.SplitHostPort(db.GetURI()); err != nil {
 			return trace.BadParameter("invalid database %q address %q: %v", db.GetName(), db.GetURI(), err)
 		}
 	}
-
 	if db.GetTLS().CACert != "" {
 		if _, err := tlsca.ParseCertificatePEM([]byte(db.GetTLS().CACert)); err != nil {
 			return trace.BadParameter("provided database %q CA doesn't appear to be a valid x509 certificate: %v", db.GetName(), err)
@@ -354,6 +367,20 @@ func ValidateSQLServerURI(uri string) error {
 	return nil
 }
 
+func validateOracleURI(uri string) error {
+	parts := strings.Split(uri, ",")
+	for _, part := range parts {
+		if strings.TrimSpace(part) == "" {
+			return trace.BadParameter("invalid empty part of URI %q", uri)
+		}
+		_, _, err := net.SplitHostPort(part)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
 func isDNSError(err error) bool {
 	if err == nil {
 		return false
diff --git a/lib/services/database_test.go b/lib/services/database_test.go
index f1a186b00d95f..04298ea78cdd8 100644
--- a/lib/services/database_test.go
+++ b/lib/services/database_test.go
@@ -33,8 +33,24 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-// TestDatabaseUnmarshal verifies a database resource can be unmarshaled.
-func TestDatabaseUnmarshal(t *testing.T) {
+// TestDatabaseUnmarshalTLSModes verifies database resource unmarshalling for both string and integer representation of DatabaseTLSMode enum.
+func TestDatabaseUnmarshalTLSModes(t *testing.T) {
+	const databaseYAML = `---
+kind: db
+version: v3
+metadata:
+  name: test-database
+  description: "Test description"
+  labels:
+    env: dev
+spec:
+  protocol: "postgres"
+  uri: "localhost:5432"
+  tls:
+    mode: %v
+  ca_cert: |-
+%v`
+
 	t.Parallel()
 	tlsModes := map[string]types.DatabaseTLSMode{
 		"":            types.DatabaseTLSMode_VERIFY_FULL,
@@ -492,6 +508,14 @@ func TestValidateDatabase(t *testing.T) {
 			},
 			expectError: false,
 		},
+		{
+			inputName: "valid-alloy-db",
+			inputSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			expectError: false,
+		},
 	}
 
 	for _, test := range tests {
@@ -533,6 +557,48 @@ func TestValidateSQLServerDatabaseURI(t *testing.T) {
 	}
 }
 
+func TestValidateOracleURI(t *testing.T) {
+	tests := []struct {
+		name    string
+		uri     string
+		wantErr string
+	}{
+		{
+			name: "single",
+			uri:  "host1:2484",
+		},
+		{
+			name: "multiple",
+			uri:  "host1:2484,host2:2484",
+		},
+		{
+			name:    "invalid empty",
+			uri:     "",
+			wantErr: `invalid empty part of URI ""`,
+		},
+		{
+			name:    "invalid one of",
+			uri:     "host1:2484,host2,host3:1234",
+			wantErr: `address host2: missing port in address`,
+		},
+		{
+			name:    "empty one of",
+			uri:     "host1:2484,,",
+			wantErr: `invalid empty part of URI "host1:2484,,"`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateOracleURI(tt.uri)
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+			}
+		})
+	}
+}
+
 // indent returns the string where each line is indented by the specified
 // number of spaces.
 func indent(s string, spaces int) string {
@@ -543,19 +609,3 @@ func indent(s string, spaces int) string {
 	}
 	return strings.Join(lines, "\n")
 }
-
-var databaseYAML = `---
-kind: db
-version: v3
-metadata:
-  name: test-database
-  description: "Test description"
-  labels:
-    env: dev
-spec:
-  protocol: "postgres"
-  uri: "localhost:5432"
-  tls:
-    mode: %v
-  ca_cert: |-
-%v`
diff --git a/lib/services/expiry/expiry_test.go b/lib/services/expiry/expiry_test.go
index c9ce9a076a99a..1560b669d203a 100644
--- a/lib/services/expiry/expiry_test.go
+++ b/lib/services/expiry/expiry_test.go
@@ -29,15 +29,15 @@ import (
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/events/eventstest"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestExpiry(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clock,
 		AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -51,7 +51,7 @@ func TestExpiry(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { authServer.Close() })
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	mockEmitter := &eventstest.MockRecorderEmitter{}
 	cfg := &Config{
 		Log:         logger,
diff --git a/lib/services/fuzz_test.go b/lib/services/fuzz_test.go
index 0aa3679e5e9e2..26b7072ae3f9d 100644
--- a/lib/services/fuzz_test.go
+++ b/lib/services/fuzz_test.go
@@ -19,6 +19,7 @@
 package services
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -123,3 +124,40 @@ func FuzzParserEvalBoolPredicate(f *testing.F) {
 		})
 	})
 }
+
+func FuzzValidateApp(f *testing.F) {
+	f.Add("web.example.com:443", "app.example.com")         // valid: different addresses
+	f.Add("", "app.example.com")                            // valid: empty proxy address
+	f.Add("proxy.example.com:443", "")                      // valid: empty app address
+	f.Add("example.com", "app.example.com")                 // valid: proxy without port
+	f.Add("web.example.com:443", "web.example.com")         // conflict: same as proxy
+	f.Add("web.example.com:443", "web.example.com.")        // conflict: trailing dot
+	f.Add("web.example.com:443", "web.example.com..")       // conflict: multiple trailing dots
+	f.Add("web.example.com:443", "WeB.ExAmPle.CoM")         // conflict: case insensitive
+	f.Add("web.example.com:443,other.com:443", "other.com") // conflict: matches second proxy
+	f.Add("xn--mnchen-3ya.de:443", "münchen.de")            // conflict: IDN
+	f.Add("münchen.de:443", "MünchEn.de")                   // conflict: IDN case insensitive
+	f.Add("example.com:443,example.com:80", "example.com")  // conflict: multiple proxy ports
+
+	f.Fuzz(func(t *testing.T, proxyPublicAddrs string, appPublicAddr string) {
+		// NewAppV3 and ValidateApp should never panic regardless of input.
+		require.NotPanics(t, func() {
+			// Create app with a fuzzy public address.
+			app, err := types.NewAppV3(types.Metadata{Name: "fuzz-app"}, types.AppSpecV3{
+				URI:        "http://localhost:8080",
+				PublicAddr: appPublicAddr,
+			})
+			if err != nil {
+				// Fuzzing may produce invalid values that fail to create an App.
+				// If so, skip this iteration since the test cannot continue.
+				t.Skip("skipping invalid app spec")
+			}
+
+			proxyAddrList := strings.Split(proxyPublicAddrs, ",")
+			mockProxyGetter := &mockProxyGetter{addrs: proxyAddrList}
+
+			// Validate the app against the mock proxy addresses.
+			_ = ValidateApp(app, mockProxyGetter)
+		})
+	})
+}
diff --git a/lib/services/github.go b/lib/services/github.go
index 1294b7db5cc7a..0444cc5f0b2ac 100644
--- a/lib/services/github.go
+++ b/lib/services/github.go
@@ -176,12 +176,20 @@ func MarshalOSSGithubConnector(githubConnector types.GithubConnector, opts ...Ma
 			return nil, trace.Wrap(err)
 		}
 
-		// Only return an error if the endpoint url is set and the build is OSS
-		// so that the enterprise marshaler can call this marshaler to produce
-		// the final output without receiving an error.
-		if modules.GetModules().IsOSSBuild() &&
-			githubConnector.Spec.EndpointURL != "" {
-			return nil, fmt.Errorf("GitHub endpoint URL is set: %w", ErrRequiresEnterprise)
+		// Return an error for OSS build if the endpoint url is set, but it is
+		// not the public GitHub endpoint. Empty endpoint url is also allowed.
+		//
+		// Note that the enterprise marshaler also calls this marshaler to
+		// produce the final output.
+		if modules.GetModules().IsOSSBuild() {
+			if githubConnector.Spec.EndpointURL != "" &&
+				githubConnector.Spec.EndpointURL != types.GithubURL {
+				return nil, fmt.Errorf("GitHub endpoint URL is set: %w", ErrRequiresEnterprise)
+			}
+			if githubConnector.Spec.APIEndpointURL != "" &&
+				githubConnector.Spec.APIEndpointURL != types.GithubAPIURL {
+				return nil, fmt.Errorf("GitHub API endpoint URL is set: %w", ErrRequiresEnterprise)
+			}
 		}
 		return utils.FastMarshal(maybeResetProtoRevision(cfg.PreserveRevision, githubConnector))
 	default:
diff --git a/lib/services/github_test.go b/lib/services/github_test.go
index c14ea618e69f3..e48e910c2e460 100644
--- a/lib/services/github_test.go
+++ b/lib/services/github_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestUnmarshal(t *testing.T) {
@@ -68,12 +69,13 @@ func TestUnmarshal(t *testing.T) {
 }
 
 func TestMarshal(t *testing.T) {
-	connector, err := types.NewGithubConnector("github", types.GithubConnectorSpecV3{
-		ClientID:     "aaa",
-		ClientSecret: "bbb",
-		RedirectURL:  "https://localhost:3080/v1/webapi/github/callback",
-		Display:      "GitHub",
-		EndpointURL:  "https://github.com",
+	connectorWithPublicEndpoint, err := types.NewGithubConnector("github", types.GithubConnectorSpecV3{
+		ClientID:       "aaa",
+		ClientSecret:   "bbb",
+		RedirectURL:    "https://localhost:3080/v1/webapi/github/callback",
+		Display:        "GitHub",
+		EndpointURL:    "https://github.com",
+		APIEndpointURL: "https://api.github.com",
 		TeamsToRoles: []types.TeamRolesMapping{
 			{
 				Organization: "gravitational",
@@ -84,20 +86,46 @@ func TestMarshal(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	t.Run("oss", func(t *testing.T) {
-		_, err = MarshalGithubConnector(connector)
+	connectorWithPrivateEndpoint, err := types.NewGithubConnector("github", types.GithubConnectorSpecV3{
+		ClientID:       "aaa",
+		ClientSecret:   "bbb",
+		RedirectURL:    "https://localhost:3080/v1/webapi/github/callback",
+		Display:        "GitHub",
+		EndpointURL:    "https://my-private-github.com",
+		APIEndpointURL: "https://api.my-private-github.com",
+		TeamsToRoles: []types.TeamRolesMapping{
+			{
+				Organization: "gravitational",
+				Team:         "admins",
+				Roles:        []string{teleport.PresetAccessRoleName},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	t.Run("oss with public endpoint", func(t *testing.T) {
+		marshaled, err := MarshalGithubConnector(connectorWithPublicEndpoint)
+		require.NoError(t, err)
+
+		unmarshaled, err := UnmarshalGithubConnector(marshaled)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(connectorWithPublicEndpoint, unmarshaled))
+	})
+
+	t.Run("oss with private endpoint", func(t *testing.T) {
+		_, err := MarshalGithubConnector(connectorWithPrivateEndpoint)
 		require.ErrorIs(t, err, ErrRequiresEnterprise, "expected ErrRequiresEnterprise, got %T", err)
 	})
 
 	t.Run("enterprise", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+		modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
-		marshaled, err := MarshalGithubConnector(connector)
+		marshaled, err := MarshalGithubConnector(connectorWithPrivateEndpoint)
 		require.NoError(t, err)
 
 		unmarshaled, err := UnmarshalGithubConnector(marshaled)
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(connector, unmarshaled))
+		require.Empty(t, cmp.Diff(connectorWithPrivateEndpoint, unmarshaled))
 	})
 }
 
diff --git a/lib/services/health_check_config.go b/lib/services/health_check_config.go
index 2bacc2094dae0..cdced82ca7c78 100644
--- a/lib/services/health_check_config.go
+++ b/lib/services/health_check_config.go
@@ -71,8 +71,6 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 		return trace.BadParameter("spec is missing")
 	case s.Spec.Match == nil:
 		return trace.BadParameter("spec.match is missing")
-	case len(s.Spec.Match.DbLabels) == 0 && len(s.Spec.Match.DbLabelsExpression) == 0:
-		return trace.BadParameter("at least one of spec.match.db_labels or spec.match.db_labels_expression must be set")
 	}
 
 	for _, label := range s.Spec.Match.DbLabels {
@@ -86,6 +84,17 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 		}
 	}
 
+	for _, label := range s.Spec.Match.KubernetesLabels {
+		if err := validateLabel(label); err != nil {
+			return trace.BadParameter("invalid spec.kubernetes_labels: %v", err)
+		}
+	}
+	if expr := s.Spec.Match.KubernetesLabelsExpression; len(expr) > 0 {
+		if _, err := parseLabelExpression(expr); err != nil {
+			return trace.BadParameter("invalid spec.kubernetes_labels_expression: %v", err)
+		}
+	}
+
 	timeout := s.Spec.Timeout.AsDuration()
 	switch {
 	case timeout == 0:
diff --git a/lib/services/health_check_config_test.go b/lib/services/health_check_config_test.go
index 95f846061893c..aa2b2c627678f 100644
--- a/lib/services/health_check_config_test.go
+++ b/lib/services/health_check_config_test.go
@@ -38,6 +38,12 @@ func TestValidateHealthCheckConfig(t *testing.T) {
 			require.ErrorContains(t, err, substr)
 		}
 	}
+	var noErr = func() require.ErrorAssertionFunc {
+		return func(t require.TestingT, err error, _ ...any) {
+			t.(*testing.T).Helper()
+			require.NoError(t, err)
+		}
+	}
 
 	testCases := []struct {
 		name       string
@@ -199,22 +205,6 @@ func TestValidateHealthCheckConfig(t *testing.T) {
 			},
 			requireErr: errContains("spec.match is missing"),
 		},
-		{
-			name: "missing matcher is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
-				Version: types.V1,
-				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
-					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match:    &healthcheckconfigv1.Matcher{},
-					Timeout:  durationpb.New(time.Second),
-					Interval: durationpb.New(2 * time.Second),
-				},
-			},
-			requireErr: errContains("at least one of spec.match.db_labels or spec.match.db_labels_expression must be set"),
-		},
 		{
 			name: "invalid label matcher",
 			in: &healthcheckconfigv1.HealthCheckConfig{
@@ -403,6 +393,16 @@ func TestValidateHealthCheckConfig(t *testing.T) {
 			},
 			requireErr: errContains("spec.unhealthy_threshold (11) must not be greater than 10"),
 		},
+		{
+			name:       "database virtual default ok",
+			in:         VirtualDefaultHealthCheckConfigDB(),
+			requireErr: noErr(),
+		},
+		{
+			name:       "kube virtual default ok",
+			in:         VirtualDefaultHealthCheckConfigKube(),
+			requireErr: noErr(),
+		},
 	}
 
 	for _, tc := range testCases {
diff --git a/lib/services/identity.go b/lib/services/identity.go
index 01a4cbacb6538..c0c448ac135a0 100644
--- a/lib/services/identity.go
+++ b/lib/services/identity.go
@@ -26,6 +26,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/x509"
+	"iter"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -186,6 +187,12 @@ type Identity interface {
 	// GetOIDCConnectors returns valid registered connectors, withSecrets adds or removes client secret from return
 	// results.  Invalid Connectors are simply logged but errors are not forwarded.
 	GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]types.OIDCConnector, error)
+	// ListOIDCConnectors returns a page of valid registered connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListOIDCConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.OIDCConnector, string, error)
+	// RangeOIDCConnectors returns valid registered connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeOIDCConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.OIDCConnector, error]
 
 	// CreateOIDCAuthRequest creates new auth request
 	CreateOIDCAuthRequest(ctx context.Context, req types.OIDCAuthRequest, ttl time.Duration) error
@@ -214,6 +221,12 @@ type Identity interface {
 	// GetSAMLConnectors returns valid registered connectors, withSecrets adds or removes secret from return results.
 	// Invalid Connectors are simply logged but errors are not forwarded.
 	GetSAMLConnectorsWithValidationOptions(ctx context.Context, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, error)
+	// ListSAMLConnectorsWithOptions returns a page of valid registered connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListSAMLConnectorsWithOptions(ctx context.Context, limit int, start string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, string, error)
+	// RangeSAMLConnectorsWithOptions returns valid registered connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeSAMLConnectorsWithOptions(ctx context.Context, start, end string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) iter.Seq2[types.SAMLConnector, error]
 
 	// CreateSAMLAuthRequest creates new auth request
 	CreateSAMLAuthRequest(ctx context.Context, req types.SAMLAuthRequest, ttl time.Duration) error
@@ -236,6 +249,12 @@ type Identity interface {
 
 	// GetGithubConnectors returns valid Github connectors, invalid Connectors are simply logged but errors are not forwarded.
 	GetGithubConnectors(ctx context.Context, withSecrets bool) ([]types.GithubConnector, error)
+	// ListGithubConnectors returns a page of valid registered Github connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error)
+	// RangeGithubConnectors returns valid registered Github connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error]
 
 	// GetGithubConnector returns a Github connector by its name
 	GetGithubConnector(ctx context.Context, name string, withSecrets bool) (types.GithubConnector, error)
@@ -266,8 +285,8 @@ type Identity interface {
 	// DeleteUserToken deletes a user token.
 	DeleteUserToken(ctx context.Context, tokenID string) error
 
-	// GetUserTokens returns all user tokens.
-	GetUserTokens(ctx context.Context) ([]types.UserToken, error)
+	// ListUserTokens returns a page of user tokens.
+	ListUserTokens(ctx context.Context, limit int, startKey string) ([]types.UserToken, string, error)
 
 	// GetUserToken returns a user token by id.
 	GetUserToken(ctx context.Context, tokenID string) (types.UserToken, error)
@@ -293,7 +312,7 @@ type Identity interface {
 	HeadlessAuthenticationService
 
 	types.WebSessionsGetter
-	types.WebTokensGetter
+	WebToken
 
 	// AppSession defines application session features.
 	AppSession
@@ -323,6 +342,10 @@ type SnowflakeSession interface {
 	GetSnowflakeSession(context.Context, types.GetSnowflakeSessionRequest) (types.WebSession, error)
 	// GetSnowflakeSessions gets all Snowflake web sessions.
 	GetSnowflakeSessions(context.Context) ([]types.WebSession, error)
+	// ListSnowflakeSessions returns a page of Snowflake web sessions.
+	ListSnowflakeSessions(ctx context.Context, limit int, start string) ([]types.WebSession, string, error)
+	// RangeSnowflakeSessions returns Snowflake web sessions within the range [start, end).
+	RangeSnowflakeSessions(ctx context.Context, start, end string) iter.Seq2[types.WebSession, error]
 	// UpsertSnowflakeSession upserts a Snowflake web session.
 	UpsertSnowflakeSession(context.Context, types.WebSession) error
 	// DeleteSnowflakeSession removes a Snowflake web session.
diff --git a/lib/services/identitycenter.go b/lib/services/identitycenter.go
index 219c909c934d5..49152a371d67a 100644
--- a/lib/services/identitycenter.go
+++ b/lib/services/identitycenter.go
@@ -21,12 +21,10 @@ import (
 	"fmt"
 
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/emptypb"
 
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 // IdentityCenterAccount wraps a raw identity center record in a new type to
@@ -64,10 +62,11 @@ type IdentityCenterAccountID string
 type IdentityCenterAccountGetter interface {
 	// ListIdentityCenterAccounts provides a paged list of all known identity
 	// center accounts
-	ListIdentityCenterAccounts(context.Context, int, *pagination.PageRequestToken) ([]IdentityCenterAccount, pagination.NextPageToken, error)
+	ListIdentityCenterAccounts(context.Context, int, string) ([]*identitycenterv1.Account, string, error)
+	ListIdentityCenterAccounts2(context.Context, int, string) ([]*identitycenterv1.Account, string, error)
 
 	// GetIdentityCenterAccount fetches a specific Identity Center Account
-	GetIdentityCenterAccount(context.Context, IdentityCenterAccountID) (IdentityCenterAccount, error)
+	GetIdentityCenterAccount(context.Context, string) (*identitycenterv1.Account, error)
 }
 
 // IdentityCenterAccounts defines read/write access to Identity Center account
@@ -76,23 +75,25 @@ type IdentityCenterAccounts interface {
 	IdentityCenterAccountGetter
 
 	// CreateIdentityCenterAccount creates a new Identity Center Account record
-	CreateIdentityCenterAccount(context.Context, IdentityCenterAccount) (IdentityCenterAccount, error)
+	CreateIdentityCenterAccount(context.Context, *identitycenterv1.Account) (*identitycenterv1.Account, error)
+	CreateIdentityCenterAccount2(context.Context, *identitycenterv1.Account) (*identitycenterv1.Account, error)
 
 	// UpdateIdentityCenterAccount performs a conditional update on an Identity
 	// Center Account record, returning the updated record on success.
-	UpdateIdentityCenterAccount(context.Context, IdentityCenterAccount) (IdentityCenterAccount, error)
+	UpdateIdentityCenterAccount(context.Context, *identitycenterv1.Account) (*identitycenterv1.Account, error)
+	UpdateIdentityCenterAccount2(context.Context, *identitycenterv1.Account) (*identitycenterv1.Account, error)
 
 	// UpsertIdentityCenterAccount performs an *unconditional* upsert on an
 	// Identity Center Account record, returning the updated record on success.
 	// Be careful when mixing UpsertIdentityCenterAccount() with resources
 	// protected by optimistic locking
-	UpsertIdentityCenterAccount(context.Context, IdentityCenterAccount) (IdentityCenterAccount, error)
+	UpsertIdentityCenterAccount(context.Context, *identitycenterv1.Account) (*identitycenterv1.Account, error)
 
 	// DeleteIdentityCenterAccount deletes an Identity Center Account record
 	DeleteIdentityCenterAccount(context.Context, IdentityCenterAccountID) error
 
 	// DeleteAllIdentityCenterAccounts deletes all Identity Center Account records
-	DeleteAllIdentityCenterAccounts(context.Context, *identitycenterv1.DeleteAllIdentityCenterAccountsRequest) (*emptypb.Empty, error)
+	DeleteAllIdentityCenterAccounts(context.Context) error
 }
 
 // PrincipalAssignmentID is a strongly-typed ID for Identity Center Principal
@@ -104,7 +105,8 @@ type PrincipalAssignmentID string
 type IdentityCenterPrincipalAssignments interface {
 	// ListPrincipalAssignments lists all PrincipalAssignment records in the
 	// service
-	ListPrincipalAssignments(context.Context, int, *pagination.PageRequestToken) ([]*identitycenterv1.PrincipalAssignment, pagination.NextPageToken, error)
+	ListPrincipalAssignments(context.Context, int, string) ([]*identitycenterv1.PrincipalAssignment, string, error)
+	ListPrincipalAssignments2(context.Context, int, string) ([]*identitycenterv1.PrincipalAssignment, string, error)
 
 	// CreatePrincipalAssignment creates a new Principal Assignment record in
 	// the service from the supplied in-memory representation. Returns the
@@ -126,7 +128,7 @@ type IdentityCenterPrincipalAssignments interface {
 	DeletePrincipalAssignment(context.Context, PrincipalAssignmentID) error
 
 	// DeleteAllPrincipalAssignments deletes all assignment record
-	DeleteAllPrincipalAssignments(context.Context, *identitycenterv1.DeleteAllPrincipalAssignmentsRequest) (*emptypb.Empty, error)
+	DeleteAllPrincipalAssignments(context.Context) error
 }
 
 // PermissionSetID is a strongly typed ID for an identitycenterv1.PermissionSet
@@ -136,7 +138,8 @@ type PermissionSetID string
 // identitycenterv1.PermissionSet records in the service.
 type IdentityCenterPermissionSets interface {
 	// ListPermissionSets list the known Permission Sets
-	ListPermissionSets(context.Context, int, *pagination.PageRequestToken) ([]*identitycenterv1.PermissionSet, pagination.NextPageToken, error)
+	ListPermissionSets(context.Context, int, string) ([]*identitycenterv1.PermissionSet, string, error)
+	ListPermissionSets2(context.Context, int, string) ([]*identitycenterv1.PermissionSet, string, error)
 
 	// CreatePermissionSet creates a new PermissionSet record based on the
 	// supplied in-memory representation, returning the created record on
@@ -154,7 +157,7 @@ type IdentityCenterPermissionSets interface {
 	DeletePermissionSet(context.Context, PermissionSetID) error
 
 	// DeleteAllPermissionSets deletes all Identity Center PermissionSets.
-	DeleteAllPermissionSets(context.Context, *identitycenterv1.DeleteAllPermissionSetsRequest) (*emptypb.Empty, error)
+	DeleteAllPermissionSets(context.Context) error
 }
 
 // IdentityCenterAccountAssignment wraps a raw identitycenterv1.AccountAssignment
@@ -186,12 +189,11 @@ type IdentityCenterAccountAssignmentID string
 // IdentityCenterAccountAssignmentGetter provides read-only access to Identity
 // Center Account Assignment records
 type IdentityCenterAccountAssignmentGetter interface {
-	// GetAccountAssignment fetches a specific Account Assignment record.
-	GetAccountAssignment(context.Context, IdentityCenterAccountAssignmentID) (IdentityCenterAccountAssignment, error)
+	// GetIdentityCenterAccountAssignment fetches a specific Account Assignment record.
+	GetIdentityCenterAccountAssignment(context.Context, string) (*identitycenterv1.AccountAssignment, error)
 
-	// ListAccountAssignments lists all IdentityCenterAccountAssignment record
-	// known to the service
-	ListAccountAssignments(context.Context, int, *pagination.PageRequestToken) ([]IdentityCenterAccountAssignment, pagination.NextPageToken, error)
+	// ListIdentityCenterAccountAssignments provides a page of AccountAssignment records.
+	ListIdentityCenterAccountAssignments(context.Context, int, string) ([]*identitycenterv1.AccountAssignment, string, error)
 }
 
 // IdentityCenterAccountAssignments defines the operations to create and maintain
@@ -199,24 +201,24 @@ type IdentityCenterAccountAssignmentGetter interface {
 type IdentityCenterAccountAssignments interface {
 	IdentityCenterAccountAssignmentGetter
 
-	// CreateAccountAssignment creates a new Account Assignment record in
+	// CreateIdentityCenterAccountAssignment creates a new Account Assignment record in
 	// the service from the supplied in-memory representation. Returns the
 	// created record on success.
-	CreateAccountAssignment(context.Context, IdentityCenterAccountAssignment) (IdentityCenterAccountAssignment, error)
+	CreateIdentityCenterAccountAssignment(context.Context, *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error)
 
-	// UpdateAccountAssignment performs a conditional update on the supplied
+	// UpdateIdentityCenterAccountAssignment performs a conditional update on the supplied
 	// Account Assignment, returning the updated record on success.
-	UpdateAccountAssignment(context.Context, IdentityCenterAccountAssignment) (IdentityCenterAccountAssignment, error)
+	UpdateIdentityCenterAccountAssignment(context.Context, *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error)
 
 	// UpsertAccountAssignment performs an unconditional update on the supplied
 	// Account Assignment, returning the updated record on success.
-	UpsertAccountAssignment(context.Context, IdentityCenterAccountAssignment) (IdentityCenterAccountAssignment, error)
+	UpsertAccountAssignment(context.Context, *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error)
 
 	// DeleteAccountAssignment deletes a specific account assignment
 	DeleteAccountAssignment(context.Context, IdentityCenterAccountAssignmentID) error
 
 	// DeleteAllAccountAssignments deletes all known account assignments
-	DeleteAllAccountAssignments(context.Context, *identitycenterv1.DeleteAllAccountAssignmentsRequest) (*emptypb.Empty, error)
+	DeleteAllAccountAssignments(context.Context) error
 }
 
 // IdentityCenter combines all the resource managers used by the Identity Center plugin
diff --git a/lib/services/kubernetes.go b/lib/services/kubernetes.go
index cbdac0b038885..4ea8ef9f6c788 100644
--- a/lib/services/kubernetes.go
+++ b/lib/services/kubernetes.go
@@ -20,6 +20,7 @@ package services
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
@@ -31,6 +32,10 @@ import (
 type KubernetesClusterGetter interface {
 	// GetKubernetesClusters returns all kubernetes cluster resources.
 	GetKubernetesClusters(context.Context) ([]types.KubeCluster, error)
+	// ListKubernetesClusters returns a page of registered kubernetes clusters.
+	ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error)
+	// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+	RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error]
 	// GetKubernetesCluster returns the specified kubernetes cluster resource.
 	GetKubernetesCluster(ctx context.Context, name string) (types.KubeCluster, error)
 }
diff --git a/lib/services/local/access.go b/lib/services/local/access.go
index 55f53a1715268..aabc4eedace22 100644
--- a/lib/services/local/access.go
+++ b/lib/services/local/access.go
@@ -20,6 +20,7 @@ package local
 
 import (
 	"context"
+	"iter"
 	"log/slog"
 	"strings"
 	"time"
@@ -30,7 +31,9 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 )
 
 // AccessService manages roles
@@ -103,57 +106,48 @@ func (s *AccessService) ListRoles(ctx context.Context, req *proto.ListRolesReque
 		startKey = backend.NewKey(rolesPrefix, req.StartKey, paramsPrefix)
 	}
 
-	endKey := backend.RangeEnd(backend.ExactKey(rolesPrefix))
-
-	var roles []*types.RoleV6
-	if err := backend.IterateRange(ctx, s.Backend, startKey, endKey, limit+1, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(roles) > limit {
-				return true, nil
-			}
+	var resp proto.ListRolesResponse
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: startKey,
+		EndKey:   backend.RangeEnd(backend.ExactKey(rolesPrefix)),
+	}) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-			if !item.Key.HasSuffix(backend.NewKey(paramsPrefix)) {
-				// Item represents a different resource type in the
-				// same namespace.
-				continue
-			}
+		if !item.Key.HasSuffix(backend.NewKey(paramsPrefix)) {
+			// Item represents a different resource type in the
+			// same namespace.
+			continue
+		}
 
-			role, err := services.UnmarshalRoleV6(
-				item.Value,
-				services.WithExpires(item.Expires),
-				services.WithRevision(item.Revision),
+		role, err := services.UnmarshalRoleV6(
+			item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision),
+		)
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to unmarshal role",
+				"key", item.Key,
+				"error", err,
 			)
-			if err != nil {
-				s.logger.WarnContext(ctx, "Failed to unmarshal role",
-					"key", item.Key,
-					"error", err,
-				)
-				continue
-			}
-
-			// if a filter was provided, skip roles that fail to match.
-			if req.Filter != nil && !req.Filter.Match(role) {
-				continue
-			}
+			continue
+		}
 
-			roles = append(roles, role)
+		// if a filter was provided, skip roles that fail to match.
+		if req.Filter != nil && !req.Filter.Match(role) {
+			continue
 		}
 
-		return len(roles) > limit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
+		if len(resp.Roles) >= limit {
+			resp.NextKey = role.GetName()
+			return &resp, nil
+		}
 
-	var nextKey string
-	if len(roles) > limit {
-		nextKey = roles[limit].GetName()
-		roles = roles[:limit]
+		resp.Roles = append(resp.Roles, role)
 	}
 
-	return &proto.ListRolesResponse{
-		Roles:   roles,
-		NextKey: nextKey,
-	}, nil
+	return &resp, nil
 }
 
 // CreateRole creates a new role.
@@ -286,37 +280,89 @@ func (s *AccessService) GetLock(ctx context.Context, name string) (types.Lock, e
 	return services.UnmarshalLock(item.Value, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
 }
 
+func matchLock(lock types.Lock, filter *types.LockFilter, now time.Time) (types.Lock, bool) {
+	if filter == nil {
+		return lock, true
+	}
+
+	if filter.InForceOnly && !lock.IsInForce(now) {
+		return nil, false
+	}
+
+	// If no targets specified, return all of the found/in-force locks.
+	if len(filter.Targets) == 0 {
+		return lock, true
+	}
+
+	// Otherwise, use the targets as filters.
+	for _, target := range filter.Targets {
+		if target.Match(lock) {
+			return lock, true
+		}
+	}
+
+	return nil, false
+}
+
 // GetLocks gets all/in-force locks that match at least one of the targets when specified.
 func (s *AccessService) GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error) {
-	startKey := backend.ExactKey(locksPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
-	if err != nil {
-		return nil, trace.Wrap(err)
+	filter := &types.LockFilter{
+		InForceOnly: inForceOnly,
+		Targets:     make([]*types.LockTarget, 0, len(targets)),
+	}
+
+	for _, tgt := range targets {
+		filter.Targets = append(filter.Targets, &tgt)
+	}
+
+	return stream.Collect(s.RangeLocks(ctx, "", "", filter))
+}
+
+// RangeLocks returns locks within the range [start, end) matching a given filter.
+func (s *AccessService) RangeLocks(ctx context.Context, start, end string, filter *types.LockFilter) iter.Seq2[types.Lock, error] {
+	startKey := backend.NewKey(locksPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(locksPrefix))
+	if end != "" {
+		endKey = backend.NewKey(locksPrefix, end).ExactKey()
 	}
 
-	out := []types.Lock{}
-	for _, item := range result.Items {
-		lock, err := services.UnmarshalLock(item.Value, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+	mapFn := func(item backend.Item) (types.Lock, bool) {
+		lock, err := services.UnmarshalLock(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
 		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if inForceOnly && !lock.IsInForce(s.Clock().Now()) {
-			continue
-		}
-		// If no targets specified, return all of the found/in-force locks.
-		if len(targets) == 0 {
-			out = append(out, lock)
-			continue
-		}
-		// Otherwise, use the targets as filters.
-		for _, target := range targets {
-			if target.Match(lock) {
-				out = append(out, lock)
-				break
-			}
+			slog.WarnContext(ctx, "Failed to unmarshal lock",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
 		}
-	}
-	return out, nil
+
+		return matchLock(lock, filter, s.Clock().Now())
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(
+				ctx,
+				backend.ItemsParams{
+					StartKey: startKey,
+					EndKey:   endKey,
+				},
+			),
+			mapFn,
+		),
+		func(lock types.Lock) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || lock.GetName() < end
+		},
+	)
+}
+
+// ListLocks returns a page of locks matching a filter
+func (s *AccessService) ListLocks(ctx context.Context, limit int, startKey string, filter *types.LockFilter) ([]types.Lock, string, error) {
+	return generic.CollectPageAndCursor(s.RangeLocks(ctx, startKey, "", filter), limit, types.Lock.GetName)
 }
 
 // UpsertLock upserts a lock.
diff --git a/lib/services/local/access_list.go b/lib/services/local/access_list.go
index a70788a91d38f..87d4a05be83c6 100644
--- a/lib/services/local/access_list.go
+++ b/lib/services/local/access_list.go
@@ -20,7 +20,10 @@ package local
 
 import (
 	"context"
+	"iter"
+	"maps"
 	"slices"
+	"strings"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
@@ -36,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/accesslists"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
@@ -73,6 +77,7 @@ const (
 // consistent view to the rest of the Teleport application. It makes no decisions
 // about granting or withholding list membership.
 type AccessListService struct {
+	backend       backend.Backend
 	clock         clockwork.Clock
 	service       *generic.Service[*accesslist.AccessList]
 	memberService *generic.Service[*accesslist.AccessListMember]
@@ -87,10 +92,17 @@ type accessListAndMembersGetter struct {
 func (s *accessListAndMembersGetter) ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, pageToken string) ([]*accesslist.AccessListMember, string, error) {
 	return s.memberService.WithPrefix(accessListName).ListResources(ctx, pageSize, pageToken)
 }
+
 func (s *accessListAndMembersGetter) GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error) {
 	return s.service.GetResource(ctx, name)
 }
 
+// GetAccessListMember returns the specified access list member resource.
+// If a user is not directly a member of the access list the NotFound error is returned.
+func (s *accessListAndMembersGetter) GetAccessListMember(ctx context.Context, accessListName, memberName string) (*accesslist.AccessListMember, error) {
+	return s.memberService.WithPrefix(accessListName).GetResource(ctx, memberName)
+}
+
 // compile-time assertion that the AccessListService implements the AccessLists
 // interface
 var _ services.AccessLists = (*AccessListService)(nil)
@@ -141,6 +153,7 @@ func NewAccessListService(b backend.Backend, clock clockwork.Clock, opts ...Serv
 	}
 
 	return &AccessListService{
+		backend:       b,
 		clock:         clock,
 		service:       service,
 		memberService: memberService,
@@ -165,15 +178,22 @@ func (a *AccessListService) ListAccessLists(ctx context.Context, pageSize int, n
 	return a.service.ListResources(ctx, pageSize, nextToken)
 }
 
+// ListAccessListsV2 returns a filtered and sorted paginated list of access lists.
+func (a *AccessListService) ListAccessListsV2(ctx context.Context, req *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error) {
+	// Currently, the backend only sorts on lexicographical keys and not
+	// based on fields within a resource
+	if req.SortBy != nil && (req.GetSortBy().Field != "name" || req.GetSortBy().IsDesc != false) {
+		return nil, "", trace.CompareFailed("unsupported sort, only name:asc is supported, but got %q (desc = %t)", req.GetSortBy().Field, req.GetSortBy().IsDesc)
+	}
+
+	return a.service.ListResourcesWithFilter(ctx, int(req.GetPageSize()), req.GetPageToken(), func(item *accesslist.AccessList) bool {
+		return services.MatchAccessList(item, req.GetFilter())
+	})
+}
+
 // GetAccessList returns the specified access list resource.
 func (a *AccessListService) GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error) {
-	var accessList *accesslist.AccessList
-	err := a.service.RunWhileLocked(ctx, lockName(name), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		var err error
-		accessList, err = a.service.GetResource(ctx, name)
-		return trace.Wrap(err)
-	})
-	return accessList, trace.Wrap(err)
+	return a.service.GetResource(ctx, name)
 }
 
 // GetAccessListsToReview returns access lists that the user needs to review. This is not implemented in the local service.
@@ -204,7 +224,7 @@ func (a *AccessListService) runOpWithLock(ctx context.Context, accessList *acces
 	}
 
 	var upserted *accesslist.AccessList
-	var existingList *accesslist.AccessList
+	var existingAccessList *accesslist.AccessList
 
 	opFn := a.service.UpsertResource
 	if op == opTypeUpdate {
@@ -214,26 +234,20 @@ func (a *AccessListService) runOpWithLock(ctx context.Context, accessList *acces
 	validateAccessList := func() error {
 		var err error
 
-		if op == opTypeUpdate {
-			existingList, err = a.service.GetResource(ctx, accessList.GetName())
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			// Set memberOf / ownerOf to the existing values to prevent them from being updated.
-			accessList.Status.MemberOf = existingList.Status.MemberOf
-			accessList.Status.OwnerOf = existingList.Status.OwnerOf
-		} else {
-			// In case the MemberOf/OwnerOf fields were manually changed, set to empty.
-			accessList.Status.MemberOf = []string{}
-			accessList.Status.OwnerOf = []string{}
+		existingAccessList, err = a.service.GetResource(ctx, accessList.GetName())
+		if op == opTypeUpsert && trace.IsNotFound(err) {
+			// Not having already existing access_list in the backend is ok in case of
+			// upsert.
+		} else if err != nil {
+			return trace.Wrap(err)
 		}
-
+		preserveAccessListFields(existingAccessList, accessList)
 		listMembers, err := a.memberService.WithPrefix(accessList.GetName()).GetResources(ctx)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
-		return accesslists.ValidateAccessListWithMembers(ctx, accessList, listMembers, &accessListAndMembersGetter{a.service, a.memberService})
+		return accesslists.ValidateAccessListWithMembers(ctx, existingAccessList, accessList, listMembers, &accessListAndMembersGetter{a.service, a.memberService})
 	}
 
 	updateAccessList := func() error {
@@ -243,16 +257,6 @@ func (a *AccessListService) runOpWithLock(ctx context.Context, accessList *acces
 	}
 
 	reconcileOwners := func() error {
-		// Create map to store owners for efficient lookup
-		originalOwnersMap := make(map[string]struct{})
-		if existingList != nil {
-			for _, owner := range existingList.Spec.Owners {
-				if owner.MembershipKind == accesslist.MembershipKindList {
-					originalOwnersMap[owner.Name] = struct{}{}
-				}
-			}
-		}
-
 		currentOwnersMap := make(map[string]struct{})
 		for _, owner := range accessList.Spec.Owners {
 			if owner.MembershipKind == accesslist.MembershipKindList {
@@ -262,18 +266,23 @@ func (a *AccessListService) runOpWithLock(ctx context.Context, accessList *acces
 
 		// update references for new owners
 		for ownerName := range currentOwnersMap {
-			if _, exists := originalOwnersMap[ownerName]; !exists {
-				if err := a.updateAccessListOwnerOf(ctx, accessList.GetName(), ownerName, true); err != nil {
-					return trace.Wrap(err)
-				}
+			if err := a.updateAccessListOwnerOf(ctx, accessList.GetName(), ownerName, true); err != nil {
+				return trace.Wrap(err)
 			}
 		}
 
 		// update references for old owners
-		for ownerName := range originalOwnersMap {
-			if _, exists := currentOwnersMap[ownerName]; !exists {
-				if err := a.updateAccessListOwnerOf(ctx, accessList.GetName(), ownerName, false); err != nil {
-					return trace.Wrap(err)
+		if existingAccessList != nil {
+			for _, owner := range existingAccessList.Spec.Owners {
+				if owner.MembershipKind != accesslist.MembershipKindList {
+					continue
+				}
+				// If this owner access list is not an owner anymore after the
+				// update/upsert, its status.owner_of has to be updated.
+				if _, exists := currentOwnersMap[owner.Name]; !exists {
+					if err := a.updateAccessListOwnerOf(ctx, accessList.GetName(), owner.Name, false); err != nil {
+						return trace.Wrap(err)
+					}
 				}
 			}
 		}
@@ -317,20 +326,9 @@ func (a *AccessListService) DeleteAccessList(ctx context.Context, name string) e
 			return trace.Wrap(err)
 		}
 
-		// Check if the access list is a member or owner of any other access lists.
-		if len(accessList.Status.MemberOf) > 0 {
-			for _, memberOf := range accessList.Status.MemberOf {
-				if _, err := a.service.GetResource(ctx, memberOf); err == nil {
-					return trace.AccessDenied("Cannot delete '%s', as it is a member of one or more other Access Lists", accessList.Spec.Title)
-				}
-			}
-		}
-		if len(accessList.Status.OwnerOf) > 0 {
-			for _, ownerOf := range accessList.Status.OwnerOf {
-				if _, err := a.service.GetResource(ctx, ownerOf); err == nil {
-					return trace.AccessDenied("Cannot delete '%s', as it is an owner of one or more other Access Lists", accessList.Spec.Title)
-				}
-			}
+		// Check if the Access List has any blocking relationships.
+		if err := a.checkDeletionBlockingRelationships(ctx, accessList); err != nil {
+			return trace.Wrap(err)
 		}
 
 		// Delete all associated members.
@@ -397,36 +395,29 @@ func (a *AccessListService) GetSuggestedAccessLists(ctx context.Context, accessR
 func (a *AccessListService) CountAccessListMembers(ctx context.Context, accessListName string) (users uint32, lists uint32, err error) {
 	count := uint(0)
 	listCount := uint(0)
-	err = a.service.RunWhileLocked(ctx, lockName(accessListName), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		var err error
-		members, err := a.memberService.WithPrefix(accessListName).GetResources(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		for _, member := range members {
-			if member.Spec.MembershipKind == accesslist.MembershipKindList {
-				listCount++
-			} else {
-				count++
-			}
+	members, err := a.memberService.WithPrefix(accessListName).GetResources(ctx)
+	if err != nil {
+		return 0, 0, trace.Wrap(err)
+	}
+	for _, member := range members {
+		if member.Spec.MembershipKind == accesslist.MembershipKindList {
+			listCount++
+		} else {
+			count++
 		}
-		return nil
-	})
+	}
 
 	return uint32(count), uint32(listCount), trace.Wrap(err)
 }
 
 // ListAccessListMembers returns a paginated list of all access list members.
 func (a *AccessListService) ListAccessListMembers(ctx context.Context, accessListName string, pageSize int, nextToken string) ([]*accesslist.AccessListMember, string, error) {
-	var members []*accesslist.AccessListMember
-	err := a.service.RunWhileLocked(ctx, lockName(accessListName), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		_, err := a.service.GetResource(ctx, accessListName)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		members, nextToken, err = a.memberService.WithPrefix(accessListName).ListResources(ctx, pageSize, nextToken)
-		return trace.Wrap(err)
-	})
+	_, err := a.service.GetResource(ctx, accessListName)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	members, nextToken, err := a.memberService.WithPrefix(accessListName).ListResources(ctx, pageSize, nextToken)
+
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
@@ -448,15 +439,11 @@ func (a *AccessListService) ListAllAccessListMembers(ctx context.Context, pageSi
 
 // GetAccessListMember returns the specified access list member resource.
 func (a *AccessListService) GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error) {
-	var member *accesslist.AccessListMember
-	err := a.service.RunWhileLocked(ctx, lockName(accessList), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		_, err := a.service.GetResource(ctx, accessList)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		member, err = a.memberService.WithPrefix(accessList).GetResource(ctx, memberName)
-		return trace.Wrap(err)
-	})
+	_, err := a.service.GetResource(ctx, accessList)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	member, err := a.memberService.WithPrefix(accessList).GetResource(ctx, memberName)
 	return member, trace.Wrap(err)
 }
 
@@ -522,14 +509,11 @@ func (a *AccessListService) updateAccessListOwnerOf(ctx context.Context, accessL
 // Returned Owners are not validated for ownership requirements – use `IsAccessListOwner` for validation.
 func (a *AccessListService) GetAccessListOwners(ctx context.Context, accessListName string) ([]*accesslist.Owner, error) {
 	var owners []*accesslist.Owner
-	err := a.service.RunWhileLocked(ctx, lockName(accessListName), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		accessList, err := a.service.GetResource(ctx, accessListName)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		owners, err = accesslists.GetOwnersFor(ctx, accessList, &accessListAndMembersGetter{a.service, a.memberService})
-		return trace.Wrap(err)
-	})
+	accessList, err := a.service.GetResource(ctx, accessListName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	owners, err = accesslists.GetOwnersFor(ctx, accessList, &accessListAndMembersGetter{a.service, a.memberService})
 	return owners, trace.Wrap(err)
 }
 
@@ -552,16 +536,23 @@ func (a *AccessListService) UpsertAccessListMember(ctx context.Context, member *
 		}
 
 		upserted, err = a.memberService.WithPrefix(member.Spec.AccessList).UpsertResource(ctx, member)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-		if err == nil && member.Spec.MembershipKind == accesslist.MembershipKindList {
+		if member.Spec.MembershipKind == accesslist.MembershipKindList {
 			if err := a.updateAccessListMemberOf(ctx, member.Spec.AccessList, member.Spec.Name, true); err != nil {
 				return trace.Wrap(err)
 			}
 		}
 
-		return trace.Wrap(err)
+		return nil
 	}
 
+	// without this check creating the lock may fail with "special characters are not allowed in resource names"
+	if member.Spec.AccessList == "" {
+		return nil, trace.BadParameter("access_list_member %s: spec.access_list field empty", member.GetName())
+	}
 	err := a.service.RunWhileLocked(ctx, []string{accessListResourceLockName}, accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
 		return a.service.RunWhileLocked(ctx, lockName(member.Spec.AccessList), accessListLockTTL, action)
 	})
@@ -571,6 +562,10 @@ func (a *AccessListService) UpsertAccessListMember(ctx context.Context, member *
 // UpdateAccessListMember conditionally updates an access list member resource.
 func (a *AccessListService) UpdateAccessListMember(ctx context.Context, member *accesslist.AccessListMember) (*accesslist.AccessListMember, error) {
 	var updated *accesslist.AccessListMember
+	// without this check creating the lock may fail with "special characters are not allowed in resource names"
+	if member.Spec.AccessList == "" {
+		return nil, trace.BadParameter("access_list_member %s: spec.access_list field empty", member.GetName())
+	}
 	err := a.service.RunWhileLocked(ctx, []string{accessListResourceLockName}, accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
 		return a.service.RunWhileLocked(ctx, lockName(member.Spec.AccessList), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
 			memberList, err := a.service.GetResource(ctx, member.Spec.AccessList)
@@ -588,7 +583,17 @@ func (a *AccessListService) UpdateAccessListMember(ctx context.Context, member *
 			}
 
 			updated, err = a.memberService.WithPrefix(member.Spec.AccessList).ConditionalUpdateResource(ctx, member)
-			return trace.Wrap(err)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if member.Spec.MembershipKind == accesslist.MembershipKindList {
+				if err := a.updateAccessListMemberOf(ctx, member.Spec.AccessList, member.Spec.Name, true); err != nil {
+					return trace.Wrap(err)
+				}
+			}
+
+			return nil
 		})
 	})
 	return updated, trace.Wrap(err)
@@ -666,12 +671,32 @@ func (a *AccessListService) DeleteAllAccessListMembers(ctx context.Context) erro
 	return trace.Wrap(a.memberService.DeleteAllResources(ctx))
 }
 
-// UpsertAccessListWithMembers creates or updates an access list resource and its members.
-func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, accessList *accesslist.AccessList, membersIn []*accesslist.AccessListMember) (*accesslist.AccessList, []*accesslist.AccessListMember, error) {
+type writeFn func(context.Context, *accesslist.AccessList) (*accesslist.AccessList, error)
+
+func (a *AccessListService) selectWriteFn(op opType) (writeFn, error) {
+	switch op {
+	case opTypeUpdate:
+		return a.service.ConditionalUpdateResource, nil
+
+	case opTypeUpsert:
+		return a.service.UpsertResource, nil
+	}
+
+	return nil, trace.BadParameter("Unknown Access List write operation: %d", op)
+}
+
+// writeAccessListWithMembers holds all of the common logic for updating and
+// upserting an access list and it's collection of members.
+func (a *AccessListService) writeAccessListWithMembers(ctx context.Context, accessList *accesslist.AccessList, membersIn []*accesslist.AccessListMember, op opType) (*accesslist.AccessList, []*accesslist.AccessListMember, error) {
 	if err := accessList.CheckAndSetDefaults(); err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 
+	writeFn, err := a.selectWriteFn(op)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
 	for _, m := range membersIn {
 		if err := m.CheckAndSetDefaults(); err != nil {
 			return nil, nil, trace.Wrap(err)
@@ -679,20 +704,24 @@ func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, acc
 	}
 
 	validateAccessList := func() error {
-		existingList, err := a.service.GetResource(ctx, accessList.GetName())
-		if err != nil && !trace.IsNotFound(err) {
-			return trace.Wrap(err)
+		existingAccessList, err := a.service.GetResource(ctx, accessList.GetName())
+		if err != nil {
+			// a not found error is totally legal for an upsert operation, but
+			// fatal for an update.
+			if op == opTypeUpdate || !trace.IsNotFound(err) {
+				return trace.Wrap(err)
+			}
 		}
-		if existingList != nil {
-			accessList.Status.MemberOf = existingList.Status.MemberOf
-			accessList.Status.OwnerOf = existingList.Status.OwnerOf
-		} else {
-			// In case the MemberOf/OwnerOf fields were manually changed, set to empty.
-			accessList.Status.MemberOf = []string{}
-			accessList.Status.OwnerOf = []string{}
+
+		if op == opTypeUpdate {
+			if accessList.Metadata.Revision != existingAccessList.Metadata.Revision {
+				return trace.CompareFailed("access list revision does not match. it may have been concurrently modified")
+			}
 		}
 
-		if err := accesslists.ValidateAccessListWithMembers(ctx, accessList, membersIn, &accessListAndMembersGetter{a.service, a.memberService}); err != nil {
+		preserveAccessListFields(existingAccessList, accessList)
+
+		if err := accesslists.ValidateAccessListWithMembers(ctx, existingAccessList, accessList, membersIn, &accessListAndMembersGetter{a.service, a.memberService}); err != nil {
 			return trace.Wrap(err)
 		}
 
@@ -763,21 +792,9 @@ func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, acc
 			}
 		}
 
-		// Add any remaining members to the access list.
-		for _, member := range membersMap {
-			upserted, err := a.memberService.WithPrefix(accessList.GetName()).UpsertResource(ctx, member)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			// Update memberOf field if nested list.
-			if member.Spec.MembershipKind == accesslist.MembershipKindList {
-				if err := a.updateAccessListMemberOf(ctx, accessList.GetName(), member.Spec.Name, true); err != nil {
-					return trace.Wrap(err)
-				}
-			}
-			member.SetRevision(upserted.GetRevision())
+		if err := a.insertMembersAndUpdateNestedRelationships(ctx, slices.Collect(maps.Values(membersMap))); err != nil {
+			return trace.Wrap(err)
 		}
-
 		return nil
 	}
 
@@ -793,9 +810,9 @@ func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, acc
 		return nil
 	}
 
-	updateAccessList := func() error {
+	writeAccessList := func() error {
 		var err error
-		accessList, err = a.service.UpsertResource(ctx, accessList)
+		accessList, err = writeFn(ctx, accessList)
 		return trace.Wrap(err)
 	}
 
@@ -809,7 +826,7 @@ func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, acc
 		actions = append(actions, func() error { return a.VerifyAccessListCreateLimit(ctx, accessList.GetName()) })
 	}
 
-	actions = append(actions, validateAccessList, reconcileMembers, updateAccessList, reconcileOwners)
+	actions = append(actions, validateAccessList, reconcileMembers, writeAccessList, reconcileOwners)
 
 	if err := a.service.RunWhileLocked(ctx, []string{accessListResourceLockName}, 2*accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
 		return a.service.RunWhileLocked(ctx, lockName(accessList.GetName()), 2*accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
@@ -827,20 +844,38 @@ func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, acc
 	return accessList, membersIn, nil
 }
 
+// UpsertAccessListWithMembers creates or updates an access list resource and its members.
+func (a *AccessListService) UpsertAccessListWithMembers(ctx context.Context, accessList *accesslist.AccessList, membersIn []*accesslist.AccessListMember) (*accesslist.AccessList, []*accesslist.AccessListMember, error) {
+	upsertedACL, upsertedMembers, err := a.writeAccessListWithMembers(ctx, accessList, membersIn, opTypeUpsert)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return upsertedACL, upsertedMembers, nil
+}
+
+// UpdateAccessListAndOverwriteMembers does a conditional update on an AccessList and
+// all its members. For the purposes of this update, the Access List's member
+// records  are covered under the enclosing Access List's revision.
+func (a *AccessListService) UpdateAccessListAndOverwriteMembers(ctx context.Context, accessList *accesslist.AccessList, membersIn []*accesslist.AccessListMember) (*accesslist.AccessList, []*accesslist.AccessListMember, error) {
+	updatedACL, udatedMembers, err := a.writeAccessListWithMembers(ctx, accessList, membersIn, opTypeUpdate)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return updatedACL, udatedMembers, nil
+}
+
 func (a *AccessListService) AccessRequestPromote(_ context.Context, _ *accesslistv1.AccessRequestPromoteRequest) (*accesslistv1.AccessRequestPromoteResponse, error) {
 	return nil, trace.NotImplemented("AccessRequestPromote should not be called")
 }
 
 // ListAccessListReviews will list access list reviews for a particular access list.
 func (a *AccessListService) ListAccessListReviews(ctx context.Context, accessList string, pageSize int, pageToken string) (reviews []*accesslist.Review, nextToken string, err error) {
-	err = a.service.RunWhileLocked(ctx, lockName(accessList), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		_, err := a.service.GetResource(ctx, accessList)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		reviews, nextToken, err = a.reviewService.WithPrefix(accessList).ListResources(ctx, pageSize, pageToken)
-		return trace.Wrap(err)
-	})
+	_, err = a.service.GetResource(ctx, accessList)
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	reviews, nextToken, err = a.reviewService.WithPrefix(accessList).ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
@@ -887,6 +922,10 @@ func (a *AccessListService) CreateAccessListReview(ctx context.Context, review *
 			return trace.Wrap(err)
 		}
 
+		if !accessList.IsReviewable() {
+			return trace.BadParameter("access_list %q is not reviewable", accessList.GetName())
+		}
+
 		if createdReview.Spec.Changes.MembershipRequirementsChanged != nil {
 			if accessListRequiresEqual(*createdReview.Spec.Changes.MembershipRequirementsChanged, accessList.Spec.MembershipRequires) {
 				createdReview.Spec.Changes.MembershipRequirementsChanged = nil
@@ -916,10 +955,24 @@ func (a *AccessListService) CreateAccessListReview(ctx context.Context, review *
 			return trace.Wrap(err)
 		}
 
-		nextAuditDate = accessList.SelectNextReviewDate()
+		nextAuditDate, err = accessList.SelectNextReviewDate()
+		if err != nil {
+			return trace.Wrap(err, "selecting next review date")
+		}
 		accessList.Spec.Audit.NextAuditDate = nextAuditDate
 
 		for _, removedMember := range review.Spec.Changes.RemovedMembers {
+			_, err := a.memberService.WithPrefix(review.Spec.AccessList).GetResource(ctx, removedMember)
+			if err != nil && !trace.IsNotFound(err) {
+				return trace.Wrap(err)
+			}
+			isAccessListMember := err == nil
+
+			if isAccessListMember {
+				if err := a.updateAccessListMemberOf(ctx, review.Spec.AccessList, removedMember, false); err != nil {
+					return trace.Wrap(err)
+				}
+			}
 			if err := a.memberService.WithPrefix(review.Spec.AccessList).DeleteResource(ctx, removedMember); err != nil {
 				return trace.Wrap(err)
 			}
@@ -978,14 +1031,11 @@ func accessListRequiresEqual(a, b accesslist.Requires) bool {
 
 // DeleteAccessListReview will delete an access list review from the backend.
 func (a *AccessListService) DeleteAccessListReview(ctx context.Context, accessListName, reviewName string) error {
-	err := a.service.RunWhileLocked(ctx, lockName(accessListName), accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
-		_, err := a.service.GetResource(ctx, accessListName)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		return trace.Wrap(a.reviewService.WithPrefix(accessListName).DeleteResource(ctx, reviewName))
-	})
-	return trace.Wrap(err)
+	_, err := a.service.GetResource(ctx, accessListName)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(a.reviewService.WithPrefix(accessListName).DeleteResource(ctx, reviewName))
 }
 
 // DeleteAllAccessListReviews will delete all access list reviews from all access lists.
@@ -1038,6 +1088,18 @@ func (a *AccessListService) VerifyAccessListCreateLimit(ctx context.Context, tar
 	return trace.AccessDenied("%s", limitReachedMessage)
 }
 
+func preserveAccessListFields(existingAccessList, accessList *accesslist.AccessList) {
+	if existingAccessList != nil {
+		// Set MemberOf/OwnerOf to the existing values to prevent them from being updated.
+		accessList.Status.MemberOf = existingAccessList.Status.MemberOf
+		accessList.Status.OwnerOf = existingAccessList.Status.OwnerOf
+	} else {
+		// For newly created AccessList make sure MemberOf/OwnerOf are empty.
+		accessList.Status.MemberOf = []string{}
+		accessList.Status.OwnerOf = []string{}
+	}
+}
+
 // keepAWSIdentityCenterLabels preserves member labels if
 // it originated from AWS Identity Center plugin.
 // The Web UI does not currently preserve metadata labels so this function should be called
@@ -1051,3 +1113,321 @@ func keepAWSIdentityCenterLabels(old, new *accesslist.AccessListMember) {
 		new.Metadata.Labels = old.GetAllLabels()
 	}
 }
+
+func (a *AccessListService) insertMembersAndUpdateNestedRelationships(ctx context.Context, members []*accesslist.AccessListMember) error {
+	if err := a.insertMembers(ctx, members); err != nil {
+		return trace.Wrap(err)
+	}
+	// In case of nested access list members.
+	if err := a.updatedMembersNestedRelationships(ctx, members); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (a *AccessListService) insertMembers(ctx context.Context, members []*accesslist.AccessListMember) error {
+	items, err := a.membersToBackendItems(members)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	revs, err := backend.PutBatch(ctx, a.backend, items)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	for i, rev := range revs {
+		members[i].SetRevision(rev)
+	}
+	return nil
+}
+
+func (a *AccessListService) membersToBackendItems(members []*accesslist.AccessListMember) ([]backend.Item, error) {
+	out := make([]backend.Item, 0, len(members))
+	for _, member := range members {
+		item, err := a.memberService.WithPrefix(member.Spec.AccessList).MakeBackendItem(member)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		out = append(out, item)
+	}
+	return out, nil
+}
+
+func (a *AccessListService) updatedMembersNestedRelationships(ctx context.Context, members []*accesslist.AccessListMember) error {
+	for _, member := range members {
+		if member.Spec.MembershipKind != accesslist.MembershipKindList {
+			continue
+		}
+		// Update memberOf field if nested list.
+		if err := a.updateAccessListMemberOf(ctx, member.Spec.AccessList, member.Spec.Name, true); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
+// CleanupAccessListStatus removes invalid Status.OwnerOf and Status.MemberOf references.
+func (a *AccessListService) CleanupAccessListStatus(ctx context.Context, accessListName string) (*accesslist.AccessList, error) {
+	return a.runWithGlobalLockAccessList(ctx, accessListName, func() (*accesslist.AccessList, error) {
+		accessList, err := a.service.GetResource(ctx, accessListName)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		var ownerRefreshErr error
+		accessList.Status.OwnerOf = slices.DeleteFunc(accessList.Status.OwnerOf, func(ownerOf string) bool {
+			ownedList, err := a.service.GetResource(ctx, ownerOf)
+			if err != nil {
+				if trace.IsNotFound(err) {
+					return true
+				}
+				ownerRefreshErr = err
+				return false
+			}
+			isActualOwner := slices.ContainsFunc(ownedList.Spec.Owners, func(ownedListOwner accesslist.Owner) bool {
+				return ownedListOwner.MembershipKind == accesslist.MembershipKindList && ownedListOwner.Name == accessList.GetName()
+			})
+			return !isActualOwner
+		})
+		if ownerRefreshErr != nil {
+			return nil, trace.Wrap(ownerRefreshErr)
+		}
+
+		var memberRefreshErr error
+		accessList.Status.MemberOf = slices.DeleteFunc(accessList.Status.MemberOf, func(memberOf string) bool {
+			if _, err := a.memberService.WithPrefix(memberOf).GetResource(ctx, accessList.GetName()); err != nil {
+				if trace.IsNotFound(err) {
+					return true
+				}
+				memberRefreshErr = err
+			}
+			return false
+		})
+		if memberRefreshErr != nil {
+			return nil, trace.Wrap(memberRefreshErr)
+		}
+
+		accessList, err = a.service.UpdateResource(ctx, accessList)
+		return accessList, trace.Wrap(err)
+	})
+}
+
+// EnsureNestedAccessListStatuses goes over all nested owners and nested members of the named
+// access list and ensures nested lists' statuses owner_of/member_of contain the access list name.
+func (a *AccessListService) EnsureNestedAccessListStatuses(ctx context.Context, accessListName string) error {
+	return a.runWithGlobalLock(ctx, accessListName, func() error {
+		accessList, err := a.service.GetResource(ctx, accessListName)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		for _, owner := range accessList.Spec.Owners {
+			if owner.MembershipKind == accesslist.MembershipKindList {
+				if err := a.updateAccessListOwnerOf(ctx, accessListName, owner.Name, true); err != nil {
+					return trace.Wrap(err)
+				}
+			}
+		}
+
+		members, err := a.memberService.WithPrefix(accessListName).GetResources(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		for _, member := range members {
+			if member.Spec.MembershipKind == accesslist.MembershipKindList {
+				if err := a.updateAccessListMemberOf(ctx, accessListName, member.GetName(), true); err != nil {
+					return trace.Wrap(err)
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+// InsertAccessListCollection inserts a complete collection of access lists and their members from a single
+// upstream source (e.g. EntraID) using a batch operation for improved performance.
+//
+// This method is designed for bulk import scenarios where an entire access list collection needs to be
+// synchronized from an external source. All access lists and members in the collection are
+// inserted using chunked batch operations, minimizing memory allocation while still reducing
+// the number of write operations. Due to the batch nature of this operation (access list hierarchy
+// is known upfront), we can avoid per-access-list locking and global locks to improve performance.
+//
+// Important: This method assumes the collection is self-contained. Access lists in the collection
+// cannot reference access lists outside the collection as members or owners. This is intentional for
+// collections representing a complete snapshot from a single upstream source.
+// The function should be used only once during initial import where
+// we are sure that Teleport doesn't have any pre-existing access lists from the upstream and the
+// internal relation between upstream access lists and internal access lists doesn't exist yet.
+//
+// Operation can fail due to backend shutdown. In that case, if partial state was created,
+// use UpsertAccessListWithMembers/DeleteAccessListMember to reconcile to the desired state.
+func (a *AccessListService) InsertAccessListCollection(ctx context.Context, collection *accesslists.Collection) error {
+	if err := collection.Validate(ctx); err != nil {
+		return trace.Wrap(err)
+	}
+	// Collect backend items in chunks of 800 items each to avoid high memory consumption
+	// from constructing a large slice of all backend items at once. PutBatch will then
+	// leverage its own internal chunking to write items to the backend in smaller batches.
+	// TODO(smallinsky) align the chunk size with the one used in backend.PutBatch
+	for chunk, err := range stream.Chunks(a.collectionToBackendItemsIter(collection), 800) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if _, err := backend.PutBatch(ctx, a.backend, chunk); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
+// collectionToBackendItemsIter converts access list collection to an iterator of backend items.
+// The iterator yields access list members first, followed by their parent access list.
+func (a *AccessListService) collectionToBackendItemsIter(collection *accesslists.Collection) iter.Seq2[backend.Item, error] {
+	return func(yield func(backend.Item, error) bool) {
+		for aclName, members := range collection.MembersByAccessList {
+			acl, ok := collection.AccessListsByName[aclName]
+			if !ok {
+				yield(backend.Item{}, trace.NotFound("access list %q not found", aclName))
+				return
+			}
+			for _, member := range members {
+				item, err := a.memberService.WithPrefix(member.Spec.AccessList).MakeBackendItem(member)
+				if err != nil {
+					yield(backend.Item{}, trace.Wrap(err))
+					return
+				}
+				if !yield(item, nil) {
+					return
+				}
+			}
+			item, err := a.service.MakeBackendItem(acl)
+			if err != nil {
+				yield(backend.Item{}, trace.Wrap(err))
+				return
+			}
+			if !yield(item, nil) {
+				return
+			}
+		}
+	}
+}
+
+// ListUserAccessLists is not implemented in the local service.
+func (a *AccessListService) ListUserAccessLists(ctx context.Context, req *accesslistv1.ListUserAccessListsRequest) ([]*accesslist.AccessList, string, error) {
+	return nil, "", trace.NotImplemented("ListUserAccessLists should not be called on local service")
+}
+
+func (a *AccessListService) runWithGlobalLock(ctx context.Context, accessListName string, fn func() error) error {
+	return a.service.RunWhileLocked(ctx, []string{accessListResourceLockName}, 2*accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
+		return a.service.RunWhileLocked(ctx, lockName(accessListName), 2*accessListLockTTL, func(ctx context.Context, _ backend.Backend) error {
+			return trace.Wrap(fn())
+		})
+	})
+}
+
+func (a *AccessListService) runWithGlobalLockAccessList(ctx context.Context, accessListName string, fn func() (*accesslist.AccessList, error)) (*accesslist.AccessList, error) {
+	var res *accesslist.AccessList
+	err := a.runWithGlobalLock(ctx, accessListName, func() error {
+		var err error
+		res, err = fn()
+		return trace.Wrap(err)
+	})
+	return res, err
+}
+
+// checkDeletionBlockingRelationships checks if the access list has any relationships that would block deletion
+func (a *AccessListService) checkDeletionBlockingRelationships(ctx context.Context, accessList *accesslist.AccessList) error {
+	if err := a.checkDeletionBlockingMemberRelationships(ctx, accessList); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := a.checkDeletionBlockingOwnerRelationships(ctx, accessList); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// checkDeletionBlockingMemberRelationships checks if the access list is a member of any other access lists that would block deletion
+func (a *AccessListService) checkDeletionBlockingMemberRelationships(ctx context.Context, accessList *accesslist.AccessList) error {
+	memberOf := accessList.GetStatus().MemberOf
+	if len(memberOf) == 0 {
+		return nil
+	}
+
+	memberOfTitles := make([]string, 0, len(memberOf))
+	for _, memberOf := range memberOf {
+		parentList, err := a.service.GetResource(ctx, memberOf)
+		if err != nil {
+			if trace.IsNotFound(err) {
+				continue
+			}
+			return trace.Wrap(err, `fetching parent list "%s"`, memberOf)
+		}
+		member, err := a.memberService.WithPrefix(parentList.GetName()).GetResource(ctx, accessList.GetName())
+		if err != nil {
+			if trace.IsNotFound(err) {
+				continue
+			}
+			return trace.Wrap(err, `fetching access list member for "%s"`, memberOf)
+		}
+		if member.Spec.MembershipKind == accesslist.MembershipKindList {
+			memberOfTitles = append(memberOfTitles, parentList.Spec.Title)
+		}
+	}
+
+	if len(memberOfTitles) > 0 {
+		return trace.AccessDenied(`Cannot delete "%s", as it is a member of Access Lists: %s`,
+			accessList.Spec.Title, quoteAndJoin(memberOfTitles))
+	}
+
+	return nil
+}
+
+// checkDeletionBlockingOwnerRelationships checks if the access list owns any other access lists that would block deletion
+func (a *AccessListService) checkDeletionBlockingOwnerRelationships(ctx context.Context, accessList *accesslist.AccessList) error {
+	ownerOf := accessList.GetStatus().OwnerOf
+	if len(ownerOf) == 0 {
+		return nil
+	}
+
+	ownerOfTitles := make([]string, 0, len(ownerOf))
+	for _, ownerOf := range ownerOf {
+		ownedList, err := a.service.GetResource(ctx, ownerOf)
+		if err != nil {
+			if trace.IsNotFound(err) {
+				continue
+			}
+			return trace.Wrap(err, `fetching owned list "%s"`, ownerOf)
+		}
+		isActualOwner := false
+		for _, owner := range ownedList.Spec.Owners {
+			if owner.Name == accessList.GetName() && owner.MembershipKind == accesslist.MembershipKindList {
+				isActualOwner = true
+				break
+			}
+		}
+		if isActualOwner {
+			ownerOfTitles = append(ownerOfTitles, ownedList.Spec.Title)
+		}
+	}
+
+	if len(ownerOfTitles) > 0 {
+		return trace.AccessDenied(`Cannot delete "%s", as it is an owner of Access Lists: %s`,
+			accessList.Spec.Title, quoteAndJoin(ownerOfTitles))
+	}
+
+	return nil
+}
+
+// quoteAndJoin takes a slice of strings and returns them quoted and comma-separated
+func quoteAndJoin(items []string) string {
+	if len(items) == 0 {
+		return ""
+	}
+	quotedItems := make([]string, len(items))
+	for i, item := range items {
+		quotedItems[i] = `"` + item + `"`
+	}
+	return strings.Join(quotedItems, ", ")
+}
diff --git a/lib/services/local/access_list_test.go b/lib/services/local/access_list_test.go
index 76c8c205cb306..9edca05d347d6 100644
--- a/lib/services/local/access_list_test.go
+++ b/lib/services/local/access_list_test.go
@@ -21,12 +21,15 @@ package local
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
@@ -35,10 +38,17 @@ import (
 	"github.com/gravitational/teleport/api/types/common"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/trait"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib/accesslists"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/backendtest"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/utils"
+	sliceutils "github.com/gravitational/teleport/lib/utils/slices"
 )
 
 // TestAccessListCRUD tests backend operations with access list resources.
@@ -150,6 +160,218 @@ func requireAccessDenied(t require.TestingT, err error, i ...any) {
 	)
 }
 
+func Test_AccessList_validation_noTypeChange(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	type testCase struct {
+		name         string
+		accessList   *accesslist.AccessList
+		illegalTypes []accesslist.Type
+	}
+
+	for _, tc := range []testCase{
+		{
+			name:         "from default",
+			accessList:   newAccessList(t, "test-default-access-list-1", clock),
+			illegalTypes: []accesslist.Type{accesslist.Static, accesslist.SCIM},
+		},
+		{
+			name:         "from static",
+			accessList:   newAccessList(t, "test-static-access-list-1", clock, withType(accesslist.Static)),
+			illegalTypes: []accesslist.Type{accesslist.Default, accesslist.SCIM},
+		},
+		{
+			name:         "from scim",
+			accessList:   newAccessList(t, "test-scim-access-list-1", clock, withType(accesslist.SCIM)),
+			illegalTypes: []accesslist.Type{accesslist.Default, accesslist.Static},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			accessList, err := service.UpsertAccessList(ctx, tc.accessList)
+			require.NoError(t, err)
+
+			for _, typ := range tc.illegalTypes {
+				t.Run(string(typ), func(t *testing.T) {
+					accessList.Spec.Type = typ
+					if !typ.IsReviewable() {
+						accessList.Spec.Audit = accesslist.Audit{}
+					}
+
+					_, err := service.UpdateAccessList(ctx, accessList)
+					require.Error(t, err)
+					require.ErrorContains(t, err, "cannot be changed")
+					require.True(t, trace.IsBadParameter(err))
+
+					_, err = service.UpsertAccessList(ctx, accessList)
+					require.Error(t, err)
+					require.ErrorContains(t, err, "cannot be changed")
+					require.True(t, trace.IsBadParameter(err))
+
+					_, _, err = service.UpsertAccessListWithMembers(ctx, accessList, nil)
+					require.Error(t, err)
+					require.ErrorContains(t, err, "cannot be changed")
+					require.True(t, trace.IsBadParameter(err))
+				})
+			}
+		})
+	}
+}
+
+func Test_AccessList_validation_DeprecatedDynamic_special_case(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	accessList := newAccessList(t, "test-scim-access-list-1", clock)
+
+	t.Run("dynamic is stored as default", func(t *testing.T) {
+		_, err := backend.NewSanitizer(mem).Get(ctx, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+		require.Error(t, err)
+		require.True(t, trace.IsNotFound(err))
+
+		accessList.Spec.Type = accesslist.DeprecatedDynamic
+		_, err = service.UpsertAccessList(ctx, accessList)
+		require.NoError(t, err)
+
+		accessList = getAccessListDirectlyFromBackend(t, mem, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+		require.NoError(t, err)
+		require.Equal(t, accesslist.Default, accessList.Spec.Type)
+	})
+
+	t.Run("if stored already stored as dynamic", func(t *testing.T) {
+		verificationDescValue := "updated to deprecated dynamic bypassing defaulting"
+
+		t.Run("store with dynamic type directly in the backend", func(t *testing.T) {
+			accessList, err = service.GetAccessList(ctx, accessList.GetName())
+			require.NoError(t, err)
+			require.NotEqual(t, verificationDescValue, accessList.Spec.Description)
+
+			modifyAccessListDirectlyInBackend(t, mem, accessList, service.service.MakeBackendItem, func(al *accesslist.AccessList) {
+				al.Spec.Type = accesslist.DeprecatedDynamic
+				al.Spec.Description = verificationDescValue
+			})
+		})
+
+		t.Run("getting through service return default when stored as deprecated dynamic", func(t *testing.T) {
+			accessList, err := service.GetAccessList(ctx, accessList.GetName())
+			require.NoError(t, err)
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.Default, accessList.Spec.Type)
+
+			accessList = getAccessListDirectlyFromBackend(t, mem, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.DeprecatedDynamic, accessList.Spec.Type)
+		})
+
+		t.Run("modifying access list type stored as deprecated dynamic is still not allowed", func(t *testing.T) {
+			accessList = getAccessListDirectlyFromBackend(t, mem, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.DeprecatedDynamic, accessList.Spec.Type)
+
+			accessList, err := service.GetAccessList(ctx, accessList.GetName())
+			require.NoError(t, err)
+
+			accessList.Spec.Type = accesslist.SCIM
+			accessList.Spec.Audit = accesslist.Audit{}
+
+			_, err = service.UpsertAccessList(ctx, accessList)
+			require.Error(t, err)
+			require.ErrorContains(t, err, `type "" cannot be changed to "scim"`)
+			require.True(t, trace.IsBadParameter(err))
+
+			accessList.Spec.Type = accesslist.Static
+			accessList.Spec.Audit = accesslist.Audit{}
+
+			_, err = service.UpsertAccessList(ctx, accessList)
+			require.Error(t, err)
+			require.ErrorContains(t, err, `type "" cannot be changed to "static"`)
+			require.True(t, trace.IsBadParameter(err))
+		})
+
+		t.Run("modifying through service changes stored as deprecated dynamic type to default", func(t *testing.T) {
+			accessList = getAccessListDirectlyFromBackend(t, mem, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.DeprecatedDynamic, accessList.Spec.Type)
+
+			accessList, err := service.GetAccessList(ctx, accessList.GetName())
+			require.NoError(t, err)
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+
+			accessList.Spec.Type = accesslist.DeprecatedDynamic
+			_, err = service.UpsertAccessList(ctx, accessList)
+			require.NoError(t, err)
+
+			accessList, err = service.GetAccessList(ctx, accessList.GetName())
+			require.NoError(t, err)
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.Default, accessList.Spec.Type)
+
+			accessList = getAccessListDirectlyFromBackend(t, mem, service.service.MakeKey(backend.NewKey(accessList.GetName())))
+			require.Equal(t, verificationDescValue, accessList.Spec.Description)
+			require.Equal(t, accesslist.Default, accessList.Spec.Type)
+		})
+
+	})
+}
+
+func getAccessListDirectlyFromBackend(t *testing.T, storage backend.Backend, key backend.Key) *accesslist.AccessList {
+	t.Helper()
+	ctx := context.Background()
+
+	item, err := backend.NewSanitizer(storage).Get(ctx, key)
+	require.NoError(t, err)
+	accessList := new(accesslist.AccessList)
+	err = utils.FastUnmarshal(item.Value, &accessList)
+	require.NoError(t, err)
+	return accessList
+}
+
+func modifyAccessListDirectlyInBackend(
+	t *testing.T,
+	storage backend.Backend,
+	accessList *accesslist.AccessList,
+	makeItemFn func(*accesslist.AccessList, ...any) (backend.Item, error),
+	modifyFn func(*accesslist.AccessList),
+) {
+	t.Helper()
+	ctx := context.Background()
+
+	item, err := makeItemFn(accessList)
+	require.NoError(t, err)
+
+	// Now, because makeItemFn calls CheckAndSetDefault and we don't want to have any values
+	// defaulted/validated do the unmarshal/modify/marshal dance.
+
+	accessList = new(accesslist.AccessList)
+	err = utils.FastUnmarshal(item.Value, &accessList)
+	require.NoError(t, err)
+
+	modifyFn(accessList)
+	item.Value, err = utils.FastMarshal(accessList)
+	require.NoError(t, err)
+
+	// And finally store the modified, non-defaulted, non-validated item.
+
+	_, err = backend.NewSanitizer(storage).Put(ctx, item)
+	require.NoError(t, err)
+}
+
 // TestAccessList_EntitlementLimits asserts that any limits on creating
 // AccessLists are correctly enforced at Upsert time.
 func TestAccessList_EntitlementLimits(t *testing.T) {
@@ -313,7 +535,7 @@ func TestAccessList_EntitlementLimits(t *testing.T) {
 					// target because the `newAccessListService()` fixture also sets the
 					// test modules, and that would clobber our test setup if we went
 					// first
-					modules.SetTestModules(t, &modules.TestModules{
+					modulestest.SetTestModules(t, modulestest.Modules{
 						TestBuildType: modules.BuildEnterprise,
 						TestFeatures: modules.Features{
 							Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -325,7 +547,7 @@ func TestAccessList_EntitlementLimits(t *testing.T) {
 
 					// ALSO GIVEN a number of pre-created AccessLists...
 					var preCreatedACLs []*accesslist.AccessList
-					for i := 0; i < tc.existingACLCount; i++ {
+					for i := range tc.existingACLCount {
 						// note that we write these setup resources directly to the back-end
 						// service in order to bypass any limit enforcement. This lets us
 						// set up a wider range of interesting test cases
@@ -418,7 +640,129 @@ func TestAccessListDedupeOwnersBackwardsCompat(t *testing.T) {
 	require.Len(t, accessList.Spec.Owners, 2)
 }
 
-func TestAccessListUpsertWithMembers(t *testing.T) {
+func deleteAllAccessLists(t *testing.T, service *AccessListService) func() {
+	return func() {
+		require.NoError(t, service.DeleteAllAccessLists(context.Background()))
+	}
+}
+
+// getAccessListMembers fetches the current list of members for the given access
+// list, sorted by name
+func getAccessListMembers(t *testing.T, service *AccessListService, listName string) []*accesslist.AccessListMember {
+	getPage := func(ctx context.Context, pageSize int, pageToken string) ([]*accesslist.AccessListMember, string, error) {
+		return service.ListAccessListMembers(ctx, listName, pageSize, pageToken)
+	}
+	members, err := stream.Collect(clientutils.Resources(t.Context(), getPage))
+	require.NoError(t, err)
+	return members
+}
+
+type writeAccessListWithMembersFn func(context.Context, *accesslist.AccessList, []*accesslist.AccessListMember) (*accesslist.AccessList, []*accesslist.AccessListMember, error)
+
+func testAddAndRemoveAccessListMembers(t *testing.T, service *AccessListService, clock clockwork.Clock, fnUnderTest writeAccessListWithMembersFn) {
+	t.Run("add and remove members", func(t *testing.T) {
+		const listName = "test-add-members-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
+		ctx := t.Context()
+
+		toAccessListMember := func(name string) *accesslist.AccessListMember {
+			return newAccessListMember(t, listName, name)
+		}
+
+		cmpOpts := []cmp.Option{
+			cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+			cmpopts.EquateEmpty(),
+		}
+
+		// GIVEN an existing Access List
+		acl, err := service.UpsertAccessList(ctx, newAccessList(t, listName, clock))
+		require.NoError(t, err)
+
+		var expectedMemberNames []string
+		for _, memberName := range []string{"alice", "bob", "carol", "dave"} {
+			expectedMemberNames = append(expectedMemberNames, memberName)
+			members := sliceutils.Map(expectedMemberNames, toAccessListMember)
+
+			// WHEN I update the Access List to have one or more users,
+			// EXPECT that the operation succeeds and all member are present
+			// in both the returned member list and in the backend service
+			updatedACL, updatedMembers, err := fnUnderTest(ctx, acl, members)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(acl, updatedACL, cmpOpts...))
+			require.Empty(t, cmp.Diff(members, updatedMembers, cmpOpts...))
+
+			backendMembers := getAccessListMembers(t, service, listName)
+			require.Empty(t, cmp.Diff(members, backendMembers, cmpOpts...))
+		}
+
+		for len(expectedMemberNames) > 0 {
+			expectedMemberNames = expectedMemberNames[1:]
+			members := sliceutils.Map(expectedMemberNames, toAccessListMember)
+
+			// WHEN I update the Access List to remove a user, EXPECT that
+			// the operation succeeds and that only the expected members
+			// are present in the returned member list and in the backend
+			// service
+			updatedACL, updatedMembers, err := fnUnderTest(ctx, acl, members)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(acl, updatedACL, cmpOpts...))
+			require.Empty(t, cmp.Diff(members, updatedMembers, cmpOpts...))
+
+			backendMembers := getAccessListMembers(t, service, listName)
+			require.Empty(t, cmp.Diff(members, backendMembers, cmpOpts...))
+		}
+	})
+}
+
+func testSetEmptyAccessListMembers(t *testing.T, service *AccessListService, clock clockwork.Clock, fnUnderTest writeAccessListWithMembersFn) {
+	t.Run("setting empty member list deletes members", func(t *testing.T) {
+		ctx := t.Context()
+
+		emptyLists := []struct {
+			name  string
+			value []*accesslist.AccessListMember
+		}{
+			{
+				name:  "nil",
+				value: nil,
+			},
+			{
+				name:  "zero-length",
+				value: []*accesslist.AccessListMember{},
+			},
+		}
+
+		for _, emptyList := range emptyLists {
+			t.Run(emptyList.name, func(t *testing.T) {
+				t.Cleanup(deleteAllAccessLists(t, service))
+				listName := "test-set-empty-members-list" + emptyList.name
+
+				// GIVEN an access list with several members...
+				acl, _, err := service.UpsertAccessListWithMembers(ctx,
+					newAccessList(t, listName, clock),
+					[]*accesslist.AccessListMember{
+						newAccessListMember(t, listName, "alice"),
+						newAccessListMember(t, listName, "bob"),
+						newAccessListMember(t, listName, "carol"),
+						newAccessListMember(t, listName, "dave"),
+					})
+				require.NoError(t, err)
+				require.Len(t, getAccessListMembers(t, service, listName), 4)
+
+				// WHEN I update it with an empty member list
+				_, members, err := fnUnderTest(ctx, acl, emptyList.value)
+				require.NoError(t, err)
+
+				// EXPECT that both the returned member list and the member
+				// collection from the backend are empty
+				require.Empty(t, members)
+				require.Empty(t, getAccessListMembers(t, service, listName))
+			})
+		}
+	})
+}
+
+func TestUpsertAccessListWithMembers(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 
@@ -430,65 +774,197 @@ func TestAccessListUpsertWithMembers(t *testing.T) {
 
 	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
 
-	// Create a couple access lists.
-	accessList1 := newAccessList(t, "accessList1", clock)
-
 	cmpOpts := []cmp.Option{
 		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.EquateEmpty(),
 	}
 
-	t.Run("create access list", func(t *testing.T) {
-		// Create both access lists.
-		accessList, _, err := service.UpsertAccessListWithMembers(ctx, accessList1, []*accesslist.AccessListMember{})
-		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(accessList1, accessList, cmpOpts...))
+	t.Run("create empty", func(t *testing.T) {
+		emptyLists := []struct {
+			name  string
+			value []*accesslist.AccessListMember
+		}{
+			{
+				name:  "nil",
+				value: nil,
+			},
+			{
+				name:  "zero-length",
+				value: []*accesslist.AccessListMember{},
+			},
+		}
+		for _, empty := range emptyLists {
+			t.Run(empty.name, func(t *testing.T) {
+				t.Cleanup(deleteAllAccessLists(t, service))
+				listName := "test-create-acl-list-" + empty.name
+
+				acl := newAccessList(t, listName, clock)
+				createdACL, createdMembers, err := service.UpsertAccessListWithMembers(ctx, acl, empty.value)
+				require.NoError(t, err)
+				require.Empty(t, createdMembers)
+				require.Empty(t, cmp.Diff(createdACL, acl, cmpOpts...))
+			})
+		}
 	})
 
-	accessList1Member1 := newAccessListMember(t, accessList1.GetName(), "alice")
-
-	t.Run("add member to the access list", func(t *testing.T) {
-		// Add access list members.
-		updatedAccessList, updatedMembers, err := service.UpsertAccessListWithMembers(ctx, accessList1, []*accesslist.AccessListMember{accessList1Member1})
-		require.NoError(t, err)
-		// Assert that access list is returned.
-		require.Empty(t, cmp.Diff(updatedAccessList, updatedAccessList, cmpOpts...))
-		// Assert that the member is returned.
-		require.Len(t, updatedMembers, 1)
-		require.Empty(t, cmp.Diff(updatedMembers[0], accessList1Member1, cmpOpts...))
+	t.Run("create with members", func(t *testing.T) {
+		const listName = "test-create-with-members-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
 
-		listMembers, err := service.GetAccessListMember(ctx, accessList1.GetName(), accessList1Member1.GetName())
+		acl := newAccessList(t, listName, clock)
+		members := []*accesslist.AccessListMember{newAccessListMember(t, listName, "alice")}
+		createdACL, createdMembers, err := service.UpsertAccessListWithMembers(ctx, acl, members)
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(listMembers, accessList1Member1, cmpOpts...))
+		require.Empty(t, cmp.Diff(acl, createdACL, cmpOpts...))
+		require.Empty(t, cmp.Diff(members, createdMembers, cmpOpts...))
+		require.Empty(t, cmp.Diff(members, getAccessListMembers(t, service, listName), cmpOpts...))
 	})
 
-	accessList1Member2 := newAccessListMember(t, accessList1.GetName(), "bob")
+	testAddAndRemoveAccessListMembers(t, service, clock, service.UpsertAccessListWithMembers)
+
+	testSetEmptyAccessListMembers(t, service, clock, service.UpsertAccessListWithMembers)
 
-	t.Run("add another member to the access list", func(t *testing.T) {
-		// Add access list members.
-		updatedAccessList, updatedMembers, err := service.UpsertAccessListWithMembers(ctx, accessList1, []*accesslist.AccessListMember{accessList1Member1, accessList1Member2})
+	t.Run("colliding updates", func(t *testing.T) {
+		const listName = "test-colliding-updates-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
+
+		// GIVEN an existing Access List...
+		originalACL, _, err := service.UpsertAccessListWithMembers(ctx,
+			newAccessList(t, listName, clock),
+			[]*accesslist.AccessListMember{
+				newAccessListMember(t, listName, "alice"),
+				newAccessListMember(t, listName, "bob"),
+				newAccessListMember(t, listName, "carol"),
+				newAccessListMember(t, listName, "dave"),
+			})
 		require.NoError(t, err)
-		// Assert that access list is returned.
-		require.Empty(t, cmp.Diff(updatedAccessList, updatedAccessList, cmpOpts...))
-		// Assert that the member is returned.
-		require.Len(t, updatedMembers, 2)
-		require.Empty(t, cmp.Diff(updatedMembers, []*accesslist.AccessListMember{accessList1Member1, accessList1Member2}, cmpOpts...))
 
-		listMembers, err := service.GetAccessListMember(ctx, accessList1.GetName(), accessList1Member1.GetName())
+		// GIVEN an updated version of the original access list, which
+		// will have a new version string...
+		update := originalACL.Clone()
+		update.Spec.Title = "updated list once"
+		_, err = service.UpsertAccessList(ctx, update)
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(listMembers, accessList1Member1, cmpOpts...))
 
-		listMembers, err = service.GetAccessListMember(ctx, accessList1.GetName(), accessList1Member2.GetName())
+		// WHEN I submit an updated Access List based on the original Access List revision
+		secondUpdate := originalACL.Clone()
+		secondUpdate.Spec.Title = "overridden update"
+		updatedMembers := []*accesslist.AccessListMember{
+			newAccessListMember(t, listName, "erica"),
+			newAccessListMember(t, listName, "fred"),
+			newAccessListMember(t, listName, "giselle"),
+			newAccessListMember(t, listName, "hector"),
+		}
+		finalACL, finalMembers, updateErr := service.UpsertAccessListWithMembers(ctx, secondUpdate, updatedMembers)
+
+		// EXPECT an upsert to succeed
+		require.NoError(t, updateErr)
+
+		// EXPECT the returned Access List and member list to match the
+		// requested update
+		require.Empty(t, cmp.Diff(finalACL, secondUpdate, cmpOpts...))
+		require.Empty(t, cmp.Diff(finalMembers, updatedMembers, cmpOpts...))
+
+		// EXPECT the actual backend records to match the updated values
+		backendACL, err := service.GetAccessList(ctx, listName)
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(listMembers, accessList1Member2, cmpOpts...))
+		require.Empty(t, cmp.Diff(backendACL, secondUpdate, cmpOpts...))
+		require.Empty(t, cmp.Diff(getAccessListMembers(t, service, listName), updatedMembers))
+	})
+}
+
+func TestUpdateAccessListAndOverwriteMembers(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	cmpOpts := []cmp.Option{
+		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.EquateEmpty(),
+	}
+
+	t.Run("update non-existing", func(t *testing.T) {
+		const listName = "test-update-acl-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
+
+		acl := newAccessList(t, listName, clock)
+		_, _, err := service.UpdateAccessListAndOverwriteMembers(ctx, acl, []*accesslist.AccessListMember{})
+
+		var NotFound *trace.NotFoundError
+		require.ErrorAs(t, err, &NotFound)
+	})
+
+	t.Run("update non-existing with members", func(t *testing.T) {
+		const listName = "test-update-with-members-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
+
+		acl := newAccessList(t, listName, clock)
+		members := []*accesslist.AccessListMember{newAccessListMember(t, listName, "alice")}
+		_, _, err := service.UpdateAccessListAndOverwriteMembers(ctx, acl, members)
+
+		var NotFound *trace.NotFoundError
+		require.ErrorAs(t, err, &NotFound)
 	})
 
-	t.Run("empty members removes all members", func(t *testing.T) {
-		_, _, err = service.UpsertAccessListWithMembers(ctx, accessList1, []*accesslist.AccessListMember{})
+	testAddAndRemoveAccessListMembers(t, service, clock, service.UpdateAccessListAndOverwriteMembers)
+
+	testSetEmptyAccessListMembers(t, service, clock, service.UpdateAccessListAndOverwriteMembers)
+
+	t.Run("colliding updates", func(t *testing.T) {
+		const listName = "test-colliding-updates-list"
+		t.Cleanup(deleteAllAccessLists(t, service))
+
+		// GIVEN an existing Access List (note that we're deliberately
+		// using UpsertAccessListWithMembers because this is part of the
+		// test setup rather than the test action itself.)
+		originalACL, originalMembers, err := service.UpsertAccessListWithMembers(ctx,
+			newAccessList(t, listName, clock),
+			[]*accesslist.AccessListMember{
+				newAccessListMember(t, listName, "alice"),
+				newAccessListMember(t, listName, "bob"),
+				newAccessListMember(t, listName, "carol"),
+				newAccessListMember(t, listName, "dave"),
+			})
+		require.NoError(t, err)
+
+		// GIVEN an updated version of the original access list, which
+		// will have a new version string...
+		update := originalACL.Clone()
+		update.Spec.Title = "updated list once"
+
+		updatedACL, err := service.UpsertAccessList(ctx, update)
 		require.NoError(t, err)
 
-		members, _, err := service.ListAccessListMembers(ctx, accessList1.GetName(), 0 /* default size*/, "")
+		// WHEN I try to submit an updated Access List based on the original
+		// Access List revision
+		secondUpdate := originalACL.Clone()
+		secondUpdate.Spec.Title = "overridden update"
+		updatedMembers := []*accesslist.AccessListMember{
+			newAccessListMember(t, listName, "erica"),
+			newAccessListMember(t, listName, "fred"),
+			newAccessListMember(t, listName, "giselle"),
+			newAccessListMember(t, listName, "hector"),
+		}
+		_, _, err = service.UpdateAccessListAndOverwriteMembers(ctx, secondUpdate, updatedMembers)
+
+		// EXPECT a conditional update to fail
+		var cmpFailedErr *trace.CompareFailedError
+		require.ErrorAs(t, err, &cmpFailedErr)
+
+		// EXPECT that the backend Access List record has not been changed
+		backendACL, err := service.GetAccessList(ctx, listName)
 		require.NoError(t, err)
-		require.Empty(t, members)
+		require.Empty(t, cmp.Diff(backendACL, updatedACL, cmpOpts...))
+
+		// EXPECT that the member list has not been changed
+		require.Empty(t, cmp.Diff(getAccessListMembers(t, service, listName), originalMembers, cmpOpts...))
 	})
 }
 
@@ -662,6 +1138,135 @@ func TestAccessListMembersCRUD(t *testing.T) {
 	require.ErrorIs(t, err, trace.NotFound("access_list %q doesn't exist", accessList2.GetName()))
 }
 
+func Test_AccessListMember_Validation(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	accessList := newAccessList(t, "test-access-list-1", clock)
+	accessList, err = service.UpsertAccessList(ctx, accessList)
+	require.NoError(t, err)
+
+	accessListMember := newAccessListMember(t, accessList.GetName(), "test-access-list-member-1")
+
+	t.Run("modifying member fails if name is empty", func(t *testing.T) {
+		oldName := accessListMember.Spec.Name
+		runAccessListMemberValidationSuite(
+			t, service, accessList, accessListMember,
+			func(m *accesslist.AccessListMember) { m.Spec.Name = "" },
+			func(m *accesslist.AccessListMember) { m.Spec.Name = oldName },
+			func(t *testing.T, err error) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "spec name")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		)
+	})
+
+	t.Run("modifying member fails if spec.name and metadata.name do not match", func(t *testing.T) {
+		oldName := accessListMember.Spec.Name
+		runAccessListMemberValidationSuite(
+			t, service, accessList, accessListMember,
+			func(m *accesslist.AccessListMember) { m.Spec.Name = "some_other_name" },
+			func(m *accesslist.AccessListMember) { m.Spec.Name = oldName },
+			func(t *testing.T, err error) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "spec name")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		)
+	})
+
+	t.Run("modifying member fails if access_list is empty", func(t *testing.T) {
+		oldAccessList := accessListMember.Spec.AccessList
+		runAccessListMemberValidationSuite(
+			t, service, accessList, accessListMember,
+			func(m *accesslist.AccessListMember) { m.Spec.AccessList = "" },
+			func(m *accesslist.AccessListMember) { m.Spec.AccessList = oldAccessList },
+			func(t *testing.T, err error) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "access_list field empty")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		)
+	})
+
+	t.Run("modifying member fails if joined is empty", func(t *testing.T) {
+		oldJoined := accessListMember.Spec.Joined
+		runAccessListMemberValidationSuite(
+			t, service, accessList, accessListMember,
+			func(m *accesslist.AccessListMember) { m.Spec.Joined = time.Time{} },
+			func(m *accesslist.AccessListMember) { m.Spec.Joined = oldJoined },
+			func(t *testing.T, err error) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "joined field empty")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		)
+	})
+
+	t.Run("modifying member fails if added_by is empty", func(t *testing.T) {
+		oldAddedBy := accessListMember.Spec.AddedBy
+		runAccessListMemberValidationSuite(
+			t, service, accessList, accessListMember,
+			func(m *accesslist.AccessListMember) { m.Spec.AddedBy = "" },
+			func(m *accesslist.AccessListMember) { m.Spec.AddedBy = oldAddedBy },
+			func(t *testing.T, err error) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "added_by field is empty")
+				require.True(t, trace.IsBadParameter(err))
+			},
+		)
+	})
+}
+
+func runAccessListMemberValidationSuite(
+	t *testing.T,
+	service *AccessListService,
+	accessList *accesslist.AccessList, member *accesslist.AccessListMember,
+	makeBad, makeGood func(*accesslist.AccessListMember),
+	errorCheck func(t *testing.T, err error),
+) {
+	t.Helper()
+	ctx := context.Background()
+
+	makeBad(member)
+
+	_, err := service.UpsertAccessListMember(ctx, member)
+	errorCheck(t, err)
+
+	_, _, err = service.UpsertAccessListWithMembers(ctx, accessList, []*accesslist.AccessListMember{member})
+	errorCheck(t, err)
+
+	makeGood(member)
+
+	member, err = service.UpsertAccessListMember(ctx, member)
+	require.NoError(t, err)
+
+	makeBad(member)
+
+	_, err = service.UpdateAccessListMember(ctx, member)
+	errorCheck(t, err)
+
+	_, err = service.UpsertAccessListMember(ctx, member)
+	errorCheck(t, err)
+
+	_, _, err = service.UpsertAccessListWithMembers(ctx, accessList, []*accesslist.AccessListMember{member})
+	errorCheck(t, err)
+
+	makeGood(member)
+
+	err = service.DeleteAccessListMember(ctx, member.Spec.AccessList, member.Spec.Name)
+	require.NoError(t, err)
+}
+
 func TestUpsertAndUpdateAccessListWithMembers_PreservesIdentityCenterLablesForExistingMembers(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
@@ -721,7 +1326,7 @@ func TestAccessListReviewCRUD(t *testing.T) {
 
 	// Create a couple access lists.
 	accessList1 := newAccessList(t, "accessList1", clock)
-	accessList2 := newAccessList(t, "accessList2", clock)
+	accessList2 := newAccessList(t, "accessList2", clock, withType(accesslist.DeprecatedDynamic))
 
 	accessList1OrigDate := accessList1.Spec.Audit.NextAuditDate
 	accessList2OrigDate := accessList2.Spec.Audit.NextAuditDate
@@ -890,27 +1495,107 @@ func TestAccessListReviewCRUD(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func TestAccessListRequiresEqual(t *testing.T) {
-	t.Parallel()
+func Test_CreateAccessListReview_NestedListMemberRemoval(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
 
-	tests := []struct {
-		name     string
-		a        accesslist.Requires
-		b        accesslist.Requires
-		expected bool
-	}{
-		{
-			name:     "empty",
-			expected: true,
-		},
-		{
-			name: "both equal",
-			a: accesslist.Requires{
-				Roles: []string{"a", "b", "c"},
-				Traits: trait.Traits{
-					"trait1": []string{"val1", "val2"},
-					"trait2": []string{"val1", "val2"},
-				},
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	a1, err := service.UpsertAccessList(ctx, newAccessList(t, "test_list_1", clock))
+	require.NoError(t, err)
+
+	memberList1, err := service.UpsertAccessList(ctx, newAccessList(t, "test_list_member_1", clock))
+	require.NoError(t, err)
+
+	assertMemberOf(t, ctx, service, memberList1.GetName(), nil)
+
+	// When nested access list member is added, expect it's status.member_of to be updated.
+
+	_, err = service.UpsertAccessListMember(ctx, newAccessListMember(t,
+		a1.GetName(),
+		memberList1.GetName(),
+		withMembershipKind(accesslist.MembershipKindList),
+	))
+	require.NoError(t, err)
+
+	assertMemberOf(t, ctx, service, memberList1.GetName(), []string{a1.GetName()})
+
+	// When nested access list member is removed via the review, expect it's status.member_of
+	// to be updated.
+
+	a1r1 := newAccessListReview(t, a1.GetName(), "al1-review1")
+	a1r1.Spec.Changes.RemovedMembers = []string{
+		memberList1.GetName(),
+	}
+	_, _, err = service.CreateAccessListReview(ctx, a1r1)
+	require.NoError(t, err)
+
+	assertMemberOf(t, ctx, service, memberList1.GetName(), nil)
+}
+
+func Test_CreateAccessListReview_FailForNonReviewable(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	// Create a couple access lists.
+	accessList1 := newAccessList(t, "accessList1", clock, withType(accesslist.Static))
+	accessList2 := newAccessList(t, "accessList2", clock, withType(accesslist.SCIM))
+
+	// Create both access lists.
+	_, err = service.UpsertAccessList(ctx, accessList1)
+	require.NoError(t, err)
+	_, err = service.UpsertAccessList(ctx, accessList2)
+	require.NoError(t, err)
+
+	accessList1Review := newAccessListReview(t, accessList1.GetName(), "al1-review")
+	accessList2Review := newAccessListReview(t, accessList2.GetName(), "al2-review")
+
+	// Add access list review.
+	_, _, err = service.CreateAccessListReview(ctx, accessList1Review)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "is not reviewable")
+	require.True(t, trace.IsBadParameter(err))
+	_, _, err = service.CreateAccessListReview(ctx, accessList2Review)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "is not reviewable")
+	require.True(t, trace.IsBadParameter(err))
+}
+
+func TestAccessListRequiresEqual(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		a        accesslist.Requires
+		b        accesslist.Requires
+		expected bool
+	}{
+		{
+			name:     "empty",
+			expected: true,
+		},
+		{
+			name: "both equal",
+			a: accesslist.Requires{
+				Roles: []string{"a", "b", "c"},
+				Traits: trait.Traits{
+					"trait1": []string{"val1", "val2"},
+					"trait2": []string{"val1", "val2"},
+				},
 			},
 			b: accesslist.Requires{
 				Roles: []string{"a", "b", "c"},
@@ -1009,50 +1694,83 @@ func TestAccessListRequiresEqual(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			require.Equal(t, test.expected, accessListRequiresEqual(test.a, test.b))
 		})
 	}
 }
 
-func newAccessList(t *testing.T, name string, clock clockwork.Clock) *accesslist.AccessList {
+type newAccessListOptions struct {
+	typ            accesslist.Type
+	owners         []accesslist.Owner
+	ownerRequires  accesslist.Requires
+	memberRequires accesslist.Requires
+}
+
+type newAccessListOpt func(*newAccessListOptions)
+
+func withType(typ accesslist.Type) newAccessListOpt {
+	return func(o *newAccessListOptions) {
+		o.typ = typ
+	}
+}
+
+func withOwners(owners []accesslist.Owner) newAccessListOpt {
+	return func(o *newAccessListOptions) {
+		o.owners = owners
+	}
+}
+
+func newAccessList(t *testing.T, name string, clock clockwork.Clock, opts ...newAccessListOpt) *accesslist.AccessList {
 	t.Helper()
 
+	options := newAccessListOptions{
+		owners: []accesslist.Owner{
+			{
+				Name:        "test-user1",
+				Description: "test user 1",
+			},
+			{
+				Name:        "test-user2",
+				Description: "test user 2",
+			},
+		},
+		memberRequires: accesslist.Requires{
+			Roles: []string{"mrole1", "mrole2"},
+			Traits: map[string][]string{
+				"mtrait1": {"mvalue1", "mvalue2"},
+				"mtrait2": {"mvalue3", "mvalue4"},
+			},
+		},
+		ownerRequires: accesslist.Requires{
+			Roles: []string{"orole1", "orole2"},
+			Traits: map[string][]string{
+				"otrait1": {"ovalue1", "ovalue2"},
+				"otrait2": {"ovalue3", "ovalue4"},
+			},
+		},
+	}
+	for _, o := range opts {
+		o(&options)
+	}
+
+	audit := accesslist.Audit{}
+	if options.typ.IsReviewable() {
+		audit.NextAuditDate = clock.Now()
+	}
+
 	accessList, err := accesslist.NewAccessList(
 		header.Metadata{
 			Name: name,
 		},
 		accesslist.Spec{
-			Title:       "title",
-			Description: "test access list",
-			Owners: []accesslist.Owner{
-				{
-					Name:        "test-user1",
-					Description: "test user 1",
-				},
-				{
-					Name:        "test-user2",
-					Description: "test user 2",
-				},
-			},
-			Audit: accesslist.Audit{
-				NextAuditDate: clock.Now(),
-			},
-			MembershipRequires: accesslist.Requires{
-				Roles: []string{"mrole1", "mrole2"},
-				Traits: map[string][]string{
-					"mtrait1": {"mvalue1", "mvalue2"},
-					"mtrait2": {"mvalue3", "mvalue4"},
-				},
-			},
-			OwnershipRequires: accesslist.Requires{
-				Roles: []string{"orole1", "orole2"},
-				Traits: map[string][]string{
-					"otrait1": {"ovalue1", "ovalue2"},
-					"otrait2": {"ovalue3", "ovalue4"},
-				},
-			},
+			Type:               options.typ,
+			Title:              name + " title",
+			Description:        "test access list",
+			Owners:             options.owners,
+			Audit:              audit,
+			MembershipRequires: options.memberRequires,
+			OwnershipRequires:  options.ownerRequires,
 			Grants: accesslist.Grants{
 				Roles: []string{"grole1", "grole2"},
 				Traits: map[string][]string{
@@ -1067,20 +1785,60 @@ func newAccessList(t *testing.T, name string, clock clockwork.Clock) *accesslist
 	return accessList
 }
 
-func newAccessListMember(t *testing.T, accessList, name string) *accesslist.AccessListMember {
+func createAccessList(t *testing.T, service *AccessListService, name string, clock clockwork.Clock, opts ...newAccessListOpt) *accesslist.AccessList {
+	t.Helper()
+	ctx := context.Background()
+	accessList := newAccessList(t, name, clock, opts...)
+	upserted, err := service.UpsertAccessList(ctx, accessList)
+	require.NoError(t, err)
+	return upserted
+}
+
+func getAccessList(t *testing.T, service *AccessListService, name string) *accesslist.AccessList {
+	t.Helper()
+	ctx := context.Background()
+
+	al, err := service.GetAccessList(ctx, name)
+	require.NoError(t, err)
+
+	return al
+}
+
+type accessListMemberOptions struct {
+	membershipKind string
+	expires        time.Time
+}
+
+type accessListMemberOpt func(*accessListMemberOptions)
+
+func withMembershipKind(membershipKind string) accessListMemberOpt {
+	return func(o *accessListMemberOptions) {
+		o.membershipKind = membershipKind
+	}
+}
+
+func newAccessListMember(t *testing.T, accessList, name string, opts ...accessListMemberOpt) *accesslist.AccessListMember {
 	t.Helper()
 
+	options := accessListMemberOptions{
+		expires: time.Now().Add(time.Hour * 24),
+	}
+	for _, o := range opts {
+		o(&options)
+	}
+
 	member, err := accesslist.NewAccessListMember(
 		header.Metadata{
 			Name: name,
 		},
 		accesslist.AccessListMemberSpec{
-			AccessList: accessList,
-			Name:       name,
-			Joined:     time.Now(),
-			Expires:    time.Now().Add(time.Hour * 24),
-			Reason:     "a reason",
-			AddedBy:    "dummy",
+			AccessList:     accessList,
+			Name:           name,
+			Joined:         time.Now(),
+			Expires:        options.expires,
+			Reason:         "a reason",
+			AddedBy:        "dummy",
+			MembershipKind: options.membershipKind,
 		},
 	)
 	require.NoError(t, err)
@@ -1088,6 +1846,17 @@ func newAccessListMember(t *testing.T, accessList, name string) *accesslist.Acce
 	return member
 }
 
+func createAccessListMember(t *testing.T, service *AccessListService, accessList, name string, opts ...accessListMemberOpt) *accesslist.AccessListMember {
+	t.Helper()
+	ctx := t.Context()
+
+	m := newAccessListMember(t, accessList, name, opts...)
+	m, err := service.UpsertAccessListMember(ctx, m)
+	require.NoError(t, err)
+
+	return m
+}
+
 func newAccessListReview(t *testing.T, accessList, name string) *accesslist.Review {
 	t.Helper()
 
@@ -1152,12 +1921,12 @@ func TestAccessListService_ListAllAccessListMembers(t *testing.T) {
 
 	// Create several access lists.
 	expectedMembers := make([]*accesslist.AccessListMember, totalMembers)
-	for i := 0; i < numAccessLists; i++ {
+	for i := range numAccessLists {
 		alName := strconv.Itoa(i)
 		_, err := service.UpsertAccessList(ctx, newAccessList(t, alName, clock))
 		require.NoError(t, err)
 
-		for j := 0; j < numAccessListMembersPerAccessList; j++ {
+		for j := range numAccessListMembersPerAccessList {
 			member := newAccessListMember(t, alName, fmt.Sprintf("%03d", j))
 			expectedMembers[i*numAccessListMembersPerAccessList+j] = member
 			_, err := service.UpsertAccessListMember(ctx, member)
@@ -1201,12 +1970,12 @@ func TestAccessListService_ListAllAccessListReviews(t *testing.T) {
 
 	// Create several access lists.
 	expectedReviews := make([]*accesslist.Review, totalReviews)
-	for i := 0; i < numAccessLists; i++ {
+	for i := range numAccessLists {
 		alName := strconv.Itoa(i)
 		_, err := service.UpsertAccessList(ctx, newAccessList(t, alName, clock))
 		require.NoError(t, err)
 
-		for j := 0; j < numAccessListReviewsPerAccessList; j++ {
+		for j := range numAccessListReviewsPerAccessList {
 			review, err := accesslist.NewReview(
 				header.Metadata{
 					Name: strconv.Itoa(j),
@@ -1248,10 +2017,478 @@ func TestAccessListService_ListAllAccessListReviews(t *testing.T) {
 	))
 }
 
-func newAccessListService(t *testing.T, mem *memory.Memory, clock clockwork.Clock, igsEnabled bool) *AccessListService {
+func TestAccessListService_Status_OwnerOf(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	ownerAccessList1 := createAccessList(t, service, "test-owners-acl-"+uuid.NewString(), clock)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), nil)
+	ownerAccessList2 := createAccessList(t, service, "test-owners-acl-"+uuid.NewString(), clock)
+	requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), nil)
+
+	accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock,
+		withOwners([]accesslist.Owner{
+			{
+				Name:           ownerAccessList1.GetName(),
+				MembershipKind: accesslist.MembershipKindList,
+			},
+		}),
+	)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+	ownerAccessList1, _, err = service.UpsertAccessListWithMembers(ctx, ownerAccessList1, nil)
+	require.NoError(t, err)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+	ownerAccessList1, err = service.UpsertAccessList(ctx, ownerAccessList1)
+	require.NoError(t, err)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+	ownerAccessList1, err = service.UpdateAccessList(ctx, ownerAccessList1)
+	require.NoError(t, err)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+	t.Run("origin access list updates and upserts fix status.owner_of of existing list owners", func(t *testing.T) {
+		requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+		err = service.updateAccessListOwnerOf(ctx, accessList.GetName(), ownerAccessList1.GetName(), false /* new - this will delete */)
+		require.NoError(t, err)
+		requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{})
+
+		accessList, err = service.UpsertAccessList(ctx, accessList)
+		require.NoError(t, err)
+		requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+
+		err = service.updateAccessListOwnerOf(ctx, accessList.GetName(), ownerAccessList1.GetName(), false /* new - this will delete */)
+		require.NoError(t, err)
+		requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{})
+
+		accessList, err = service.UpdateAccessList(ctx, accessList)
+		require.NoError(t, err)
+		requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), []string{accessList.GetName()})
+	})
+
+	t.Run("when list owner is deleted during update or upsert former owners list status.owner_of is updated", func(t *testing.T) {
+		requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), nil)
+
+		owner2 := accesslist.Owner{
+			Name:           ownerAccessList2.GetName(),
+			MembershipKind: accesslist.MembershipKindList,
+		}
+
+		accessList.Spec.Owners = append(accessList.Spec.Owners, owner2)
+		accessList, err = service.UpsertAccessList(ctx, accessList)
+		requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), []string{accessList.GetName()})
+
+		accessList.Spec.Owners = slices.DeleteFunc(accessList.Spec.Owners, func(o accesslist.Owner) bool {
+			return o.Name == owner2.Name
+		})
+		accessList, err = service.UpsertAccessList(ctx, accessList)
+		requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), nil)
+
+		accessList.Spec.Owners = append(accessList.Spec.Owners, owner2)
+		accessList, err = service.UpdateAccessList(ctx, accessList)
+		requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), []string{accessList.GetName()})
+
+		accessList.Spec.Owners = slices.DeleteFunc(accessList.Spec.Owners, func(o accesslist.Owner) bool {
+			return o.Name == owner2.Name
+		})
+		accessList, err = service.UpdateAccessList(ctx, accessList)
+		requireStatusOwnerOf(t, service, ownerAccessList2.GetName(), nil)
+	})
+
+	err = service.DeleteAccessList(ctx, accessList.GetName())
+	require.NoError(t, err)
+	requireStatusOwnerOf(t, service, ownerAccessList1.GetName(), nil)
+}
+
+func TestAccessListService_Status_MemberOf(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	t.Run("creation for UpsertAccessListMember", func(t *testing.T) {
+		accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock)
+		nestedAccessList := createAccessList(t, service, "test-nested-acl-"+uuid.NewString(), clock)
+
+		_, err = service.UpsertAccessListMember(ctx, newAccessListMember(t,
+			accessList.GetName(),
+			nestedAccessList.GetName(),
+			withMembershipKind(accesslist.MembershipKindList),
+		))
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		err = service.DeleteAccessListMember(ctx, accessList.GetName(), nestedAccessList.GetName())
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), nil)
+	})
+
+	t.Run("creation for UpsertAccessListWithMembers", func(t *testing.T) {
+		accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock)
+		nestedAccessList := createAccessList(t, service, "test-nested-acl-"+uuid.NewString(), clock)
+
+		_, _, err = service.UpsertAccessListWithMembers(
+			ctx,
+			accessList,
+			[]*accesslist.AccessListMember{
+				newAccessListMember(t,
+					accessList.GetName(),
+					nestedAccessList.GetName(),
+					withMembershipKind(accesslist.MembershipKindList),
+				),
+			},
+		)
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		_, _, err = service.UpsertAccessListWithMembers(
+			ctx,
+			accessList,
+			[]*accesslist.AccessListMember{
+				// delete the member
+			},
+		)
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), nil)
+	})
+
+	t.Run("member updates and upserts do not affect MemberOf", func(t *testing.T) {
+		accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock)
+		nestedAccessList := createAccessList(t, service, "test-nested-acl-"+uuid.NewString(), clock)
+
+		member, err := service.UpsertAccessListMember(ctx, newAccessListMember(t,
+			accessList.GetName(),
+			nestedAccessList.GetName(),
+			withMembershipKind(accesslist.MembershipKindList),
+		))
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		updatedMember, err := service.UpdateAccessListMember(ctx, member)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		_, err = service.UpsertAccessListMember(ctx, updatedMember)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+	})
+
+	t.Run("member access list updates and upserts do not affect its MemberOf", func(t *testing.T) {
+		accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock)
+		nestedAccessList := createAccessList(t, service, "test-nested-acl-"+uuid.NewString(), clock)
+
+		_, err = service.UpsertAccessListMember(ctx, newAccessListMember(t,
+			accessList.GetName(),
+			nestedAccessList.GetName(),
+			withMembershipKind(accesslist.MembershipKindList),
+		))
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		nestedAccessList, _, err = service.UpsertAccessListWithMembers(ctx, nestedAccessList, nil)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		nestedAccessList, err = service.UpdateAccessList(ctx, nestedAccessList)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		nestedAccessList, err = service.UpsertAccessList(ctx, nestedAccessList)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+	})
+
+	t.Run("member updates and upserts fix status.member_of of existing members", func(t *testing.T) {
+		accessList := createAccessList(t, service, "test-acl-"+uuid.NewString(), clock)
+		nestedAccessList := createAccessList(t, service, "test-nested-acl-"+uuid.NewString(), clock)
+
+		member, err := service.UpsertAccessListMember(ctx, newAccessListMember(t,
+			accessList.GetName(),
+			nestedAccessList.GetName(),
+			withMembershipKind(accesslist.MembershipKindList),
+		))
+		require.NoError(t, err)
+
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		err = service.updateAccessListMemberOf(ctx, accessList.GetName(), nestedAccessList.GetName(), false /* new - this will delete */)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{})
+
+		updatedMember, err := service.UpdateAccessListMember(ctx, member)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+
+		err = service.updateAccessListMemberOf(ctx, accessList.GetName(), nestedAccessList.GetName(), false /* new - this will delete */)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{})
+
+		_, err = service.UpsertAccessListMember(ctx, updatedMember)
+		require.NoError(t, err)
+		requireStatusMemberOf(t, service, nestedAccessList.GetName(), []string{accessList.GetName()})
+	})
+}
+
+func TestAccessListService_CleanupAccessListStatus(t *testing.T) {
+	ctx := t.Context()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	const a1, a2, a3, a4, a5, a6 = "al_1", "al_2", "al_3", "al_4", "al_5", "al_6"
+
+	userOwner := accesslist.Owner{MembershipKind: accesslist.MembershipKindUser, Name: "test_user_1"}
+	a1Owner := accesslist.Owner{MembershipKind: accesslist.MembershipKindList, Name: a1}
+
+	// a1 is the target access list which status will be fixed
+	_ = createAccessList(t, service, a1, clock)
+	// a2 is a list owned by a1
+	_ = createAccessList(t, service, a2, clock,
+		withOwners([]accesslist.Owner{userOwner, a1Owner}))
+	// a3 is an owned list which will be deleted without updating a1 status
+	_ = createAccessList(t, service, a3, clock,
+		withOwners([]accesslist.Owner{userOwner, a1Owner}))
+	// a4 is another owned list by a1, for this one ownership will be removed without updating a1 status
+	a4List := createAccessList(t, service, a4, clock,
+		withOwners([]accesslist.Owner{userOwner, a1Owner}))
+	// a5 is a parent for a1 (a1 is a member of a3)
+	_ = createAccessList(t, service, a5, clock)
+	_ = createAccessListMember(t, service, a5, a1, withMembershipKind(accesslist.MembershipKindList))
+	// a6 is the list of which a1 is a member; the membership will be removed without updating a1 status
+	_ = createAccessList(t, service, a6, clock)
+	_ = createAccessListMember(t, service, a6, a1, withMembershipKind(accesslist.MembershipKindList))
+
+	// Let's verify the a1 status is correct
+	requireStatusOwnerOf(t, service, a1, []string{a2, a3, a4})
+	requireStatusMemberOf(t, service, a1, []string{a5, a6})
+
+	// Let's now break the a1 status, we need to use generic service directly to bypass status
+	// updates
+	service.service.DeleteResource(ctx, a3)
+	a4List.Spec.Owners = []accesslist.Owner{userOwner} // remove a1Owner
+	service.service.UpdateResource(ctx, a4List)
+	service.memberService.WithPrefix(a6).DeleteResource(ctx, a1)
+
+	// Let's check the status remain untouched:
+	// - a3 should be removed from owner_of because it doesn't exist anymore
+	// - a4 should be removed from owner_of because a1 is not an owner anymore
+	requireStatusOwnerOf(t, service, a1, []string{a2, a3, a4})
+	// - a6 should be removed from member_of because a6/a1 membership doesn't exist anymore
+	requireStatusMemberOf(t, service, a1, []string{a5, a6})
+
+	// Run cleanup
+	fixedA1List, err := service.CleanupAccessListStatus(ctx, a1)
+	require.NoError(t, err)
+
+	// Check status of the returned list
+	require.Equal(t, []string{a2}, fixedA1List.Status.OwnerOf)
+	require.Equal(t, []string{a5}, fixedA1List.Status.MemberOf)
+
+	// Also check the status in the storage
+	requireStatusOwnerOf(t, service, a1, []string{a2})
+	requireStatusMemberOf(t, service, a1, []string{a5})
+
+	// Now let's see if CleanupStatus can cope with emptying status completely
+
+	// Let's remove remove a1->a2 ownership and a5->a1 membership using the generic service and
+	// therefore bypassing status update
+	a2List := getAccessList(t, service, a2)
+	a2List.Spec.Owners = []accesslist.Owner{userOwner} // remove a1Owner
+	service.service.UpdateResource(ctx, a2List)
+	service.memberService.WithPrefix(a5).DeleteResource(ctx, a1)
+
+	// Verify the status is broken now as it should be empty
+	requireStatusOwnerOf(t, service, a1, []string{a2})
+	requireStatusMemberOf(t, service, a1, []string{a5})
+
+	// Run cleanup
+	fixedA1List, err = service.CleanupAccessListStatus(ctx, a1)
+	require.NoError(t, err)
+
+	// Check status of the returned list
+	require.Empty(t, fixedA1List.Status.OwnerOf)
+	require.Empty(t, fixedA1List.Status.MemberOf)
+
+	// Also check the status in the storage
+	requireStatusOwnerOf(t, service, a1, []string{})
+	requireStatusMemberOf(t, service, a1, []string{})
+}
+
+func TestAccessListService_CleanupAccessListStatus_does_not_panic(t *testing.T) {
+	for range 10 {
+		ctx := t.Context()
+		clock := clockwork.NewFakeClock()
+
+		mem, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clock,
+		})
+		require.NoError(t, err)
+
+		service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+		const a1, a2, a3, a4, a5 = "al_1", "al_2", "al_3", "al_4", "al_5"
+
+		a1Owner := accesslist.Owner{MembershipKind: accesslist.MembershipKindList, Name: a1}
+
+		// a1 is owner of a2 and a3 and member of a4 and a5
+		_ = createAccessList(t, service, a1, clock)
+
+		_ = createAccessList(t, service, a2, clock,
+			withOwners([]accesslist.Owner{a1Owner}))
+		_ = createAccessList(t, service, a3, clock,
+			withOwners([]accesslist.Owner{a1Owner}))
+		_ = createAccessList(t, service, a4, clock)
+		_ = createAccessListMember(t, service, a4, a1, withMembershipKind(accesslist.MembershipKindList))
+		_ = createAccessList(t, service, a5, clock)
+		_ = createAccessListMember(t, service, a5, a1, withMembershipKind(accesslist.MembershipKindList))
+
+		// Recreate the service, but with the randomly erroring backend. This is a wrapper so all
+		// the data will be retained.
+		service = newAccessListService(t, backendtest.NewRandomlyErroringBackend(mem), clock, true /* igsEnabled */)
+
+		require.NotPanics(t, func() {
+			_, _ = service.CleanupAccessListStatus(ctx, a1)
+		})
+	}
+}
+
+func TestAccessListService_EnsureNestedAccessListStatuses(t *testing.T) {
+	ctx := t.Context()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	const a1, a2, a3, a4, a5, a6 = "al_1", "al_2", "al_3", "al_4", "al_5", "al_6"
+	const ghost = "ghost_list"
+
+	a2Owner := accesslist.Owner{MembershipKind: accesslist.MembershipKindList, Name: a2}
+	a3Owner := accesslist.Owner{MembershipKind: accesslist.MembershipKindList, Name: a3}
+
+	// Setup:
+	// - a1 is the list that will be missing from other list status owner_of/member_of
+	// - a2 is the owned list which status.owned_of will be fixed by adding a1
+	// - a3 is the owned list which status.owned_of will be partially fixed by adding a1
+	// - a4 is the member list which status.member_of will be fixed by adding a1
+	// - a5 is the member list which status.member_of will be partially fixed by adding a1
+
+	a2List := createAccessList(t, service, a2, clock)
+	a3List := createAccessList(t, service, a3, clock)
+
+	_ = createAccessList(t, service, a1, clock, withOwners([]accesslist.Owner{a2Owner, a3Owner}))
+
+	a4List := createAccessList(t, service, a4, clock)
+	_ = createAccessListMember(t, service, a1, a4, withMembershipKind(accesslist.MembershipKindList))
+	a5List := createAccessList(t, service, a5, clock)
+	_ = createAccessListMember(t, service, a1, a5, withMembershipKind(accesslist.MembershipKindList))
+
+	// Verify the target statuses
+	requireStatusOwnerOf(t, service, a2, []string{a1})
+	requireStatusOwnerOf(t, service, a3, []string{a1})
+	requireStatusOwnerOf(t, service, a4, []string{})
+	requireStatusOwnerOf(t, service, a5, []string{})
+
+	requireStatusMemberOf(t, service, a2, []string{})
+	requireStatusMemberOf(t, service, a3, []string{})
+	requireStatusMemberOf(t, service, a4, []string{a1})
+	requireStatusMemberOf(t, service, a5, []string{a1})
+
+	// Let's break the statuses
+	a2List.Status.OwnerOf = nil
+	a3List.Status.OwnerOf = []string{ghost}
+	a4List.Status.MemberOf = nil
+	a5List.Status.MemberOf = []string{ghost}
+	for _, al := range []*accesslist.AccessList{a2List, a3List, a4List, a5List} {
+		_, err := service.service.UpdateResource(ctx, al)
+		require.NoError(t, err, "access_list = %q", al.GetName())
+	}
+
+	// Verify the statuses are broken now:
+	requireStatusOwnerOf(t, service, a2, []string{})
+	requireStatusOwnerOf(t, service, a3, []string{ghost})
+	requireStatusOwnerOf(t, service, a4, []string{})
+	requireStatusOwnerOf(t, service, a5, []string{})
+
+	requireStatusMemberOf(t, service, a2, []string{})
+	requireStatusMemberOf(t, service, a3, []string{})
+	requireStatusMemberOf(t, service, a4, []string{})
+	requireStatusMemberOf(t, service, a5, []string{ghost})
+
+	// Ensure a1 is present where it should be (apply the fix)
+	err = service.EnsureNestedAccessListStatuses(ctx, a1)
+	require.NoError(t, err)
+
+	// Verify the statuses are fixed (a1 is added back, but ghost is not removed as we applied
+	// the fix for a1 only):
+	requireStatusOwnerOf(t, service, a2, []string{a1})
+	requireStatusOwnerOf(t, service, a3, []string{ghost, a1})
+	requireStatusOwnerOf(t, service, a4, []string{})
+	requireStatusOwnerOf(t, service, a5, []string{})
+
+	requireStatusMemberOf(t, service, a2, []string{})
+	requireStatusMemberOf(t, service, a3, []string{})
+	requireStatusMemberOf(t, service, a4, []string{a1})
+	requireStatusMemberOf(t, service, a5, []string{ghost, a1})
+}
+
+func requireStatusOwnerOf(t *testing.T, service *AccessListService, accessListName string, ownerOf []string) {
+	t.Helper()
+	ctx := context.Background()
+	accessList, err := service.GetAccessList(ctx, accessListName)
+	require.NoError(t, err)
+	slices.Sort(ownerOf)
+	slices.Sort(accessList.Status.OwnerOf)
+	require.ElementsMatch(t, ownerOf, accessList.Status.OwnerOf)
+}
+
+func requireStatusMemberOf(t *testing.T, service *AccessListService, accessListName string, memberOf []string) {
+	t.Helper()
+	ctx := context.Background()
+	accessList, err := service.GetAccessList(ctx, accessListName)
+	require.NoError(t, err)
+	slices.Sort(memberOf)
+	slices.Sort(accessList.Status.MemberOf)
+	require.ElementsMatch(t, memberOf, accessList.Status.MemberOf)
+}
+
+func newAccessListService(t *testing.T, b backend.Backend, clock clockwork.Clock, igsEnabled bool) *AccessListService {
 	t.Helper()
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.Identity:    {Enabled: igsEnabled},
@@ -1260,8 +2497,364 @@ func newAccessListService(t *testing.T, mem *memory.Memory, clock clockwork.Cloc
 		},
 	})
 
-	service, err := NewAccessListService(backend.NewSanitizer(mem), clock)
+	service, err := NewAccessListService(backend.NewSanitizer(b), clock)
 	require.NoError(t, err)
 
 	return service
 }
+
+func assertMemberOf(t *testing.T, ctx context.Context, svc *AccessListService, name string, expected []string) {
+	t.Helper()
+	item, err := svc.GetAccessList(ctx, name)
+	require.NoError(t, err)
+	require.ElementsMatch(t, expected, item.Status.MemberOf)
+}
+
+func TestInsertAccessListCollection(t *testing.T) {
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+
+	t.Run("memberOf and ownerOf check", func(t *testing.T) {
+		mem, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clock,
+		})
+		require.NoError(t, err)
+
+		service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+		list3 := newAccessList(t, "list3", clock)
+		list4 := newAccessList(t, "list4", clock)
+
+		list1.Spec.Owners = append(list1.Spec.Owners, accesslist.Owner{
+			Name:           list2.GetName(),
+			MembershipKind: accesslist.MembershipKindList,
+		})
+
+		collection := &accesslists.Collection{}
+		require.NoError(t, collection.AddAccessList(list1, nil))
+		require.NoError(t, collection.AddAccessList(list2, nil))
+		require.NoError(t, collection.AddAccessList(list3, []*accesslist.AccessListMember{
+			newAccessListMember(t, list3.GetName(), list1.GetName(), withMembershipKind(accesslist.MembershipKindList))}),
+		)
+		require.NoError(t, collection.AddAccessList(list4, []*accesslist.AccessListMember{
+			newAccessListMember(t, list4.GetName(), list2.GetName(), withMembershipKind(accesslist.MembershipKindList))}),
+		)
+
+		err = service.InsertAccessListCollection(ctx, collection)
+		require.NoError(t, err)
+
+		// list1: no ownerOf, memberOf list3
+		result1, err := service.GetAccessList(ctx, list1.GetName())
+		require.NoError(t, err)
+		require.Empty(t, result1.Status.OwnerOf)
+		require.Equal(t, []string{list3.GetName()}, result1.Status.MemberOf)
+
+		// list2: ownerOf list1, memberOf list4
+		result2, err := service.GetAccessList(ctx, list2.GetName())
+		require.NoError(t, err)
+		require.Equal(t, []string{list1.GetName()}, result2.Status.OwnerOf)
+		require.Equal(t, []string{list4.GetName()}, result2.Status.MemberOf)
+
+		// list3 and list4: no ownerOf, no memberOf
+		result3, err := service.GetAccessList(ctx, list3.GetName())
+		require.NoError(t, err)
+		require.Empty(t, result3.Status.OwnerOf)
+		require.Empty(t, result3.Status.MemberOf)
+		result4, err := service.GetAccessList(ctx, list4.GetName())
+		require.NoError(t, err)
+		require.Empty(t, result4.Status.OwnerOf)
+		require.Empty(t, result4.Status.MemberOf)
+	})
+
+	t.Run("circular reference in nested lists", func(t *testing.T) {
+		mem, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clock,
+		})
+		require.NoError(t, err)
+
+		service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+		list1 := newAccessList(t, "list1", clock)
+		list2 := newAccessList(t, "list2", clock)
+
+		// Create circular reference: list1 -> list2 -> list1
+		member1 := newAccessListMember(t, list1.GetName(), list2.GetName(), withMembershipKind(accesslist.MembershipKindList))
+		member2 := newAccessListMember(t, list2.GetName(), list1.GetName(), withMembershipKind(accesslist.MembershipKindList))
+
+		collection := &accesslists.Collection{
+			MembersByAccessList: make(map[string][]*accesslist.AccessListMember),
+			AccessListsByName:   make(map[string]*accesslist.AccessList),
+		}
+		err = collection.AddAccessList(list1, []*accesslist.AccessListMember{member1})
+		require.NoError(t, err)
+		err = collection.AddAccessList(list2, []*accesslist.AccessListMember{member2})
+		require.NoError(t, err)
+
+		require.Error(t, service.InsertAccessListCollection(ctx, collection))
+	})
+
+	t.Run("insert large collection with 1k+ members", func(t *testing.T) {
+		mem, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clock,
+		})
+		require.NoError(t, err)
+
+		service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+		collection := &accesslists.Collection{}
+
+		// Create 3 access lists with different member counts to test chunking.
+		// Total members: 500 + 600 + 400 = 1500 members across 3 lists.
+		list1 := newAccessList(t, "large-list-1", clock)
+		members1 := make([]*accesslist.AccessListMember, 500)
+		for i := 0; i < 500; i++ {
+			members1[i] = newAccessListMember(t, list1.GetName(), fmt.Sprintf("member-%d", i))
+		}
+		require.NoError(t, collection.AddAccessList(list1, members1))
+
+		list2 := newAccessList(t, "large-list-2", clock)
+		members2 := make([]*accesslist.AccessListMember, 600)
+		for i := 0; i < 600; i++ {
+			members2[i] = newAccessListMember(t, list2.GetName(), fmt.Sprintf("member-%d", i))
+		}
+		require.NoError(t, collection.AddAccessList(list2, members2))
+
+		list3 := newAccessList(t, "large-list-3", clock)
+		members3 := make([]*accesslist.AccessListMember, 400)
+		for i := 0; i < 400; i++ {
+			members3[i] = newAccessListMember(t, list3.GetName(), fmt.Sprintf("member-%d", i))
+		}
+		require.NoError(t, collection.AddAccessList(list3, members3))
+
+		err = service.InsertAccessListCollection(ctx, collection)
+		require.NoError(t, err)
+
+		acls, err := service.service.GetResources(ctx)
+		require.NoError(t, err)
+		require.Len(t, acls, 3)
+
+		allMembers1, err := service.memberService.WithPrefix(list1.GetName()).GetResources(ctx)
+		require.NoError(t, err)
+		require.Len(t, allMembers1, 500)
+
+		allMembers2, err := service.memberService.WithPrefix(list2.GetName()).GetResources(ctx)
+		require.NoError(t, err)
+		require.Len(t, allMembers2, 600)
+
+		allMembers3, err := service.memberService.WithPrefix(list3.GetName()).GetResources(ctx)
+		require.NoError(t, err)
+		require.Len(t, allMembers3, 400)
+	})
+}
+
+type nestedAccessListCase struct {
+	name         string
+	targetName   string
+	relatedNames []string
+}
+
+// runNestedAccessListCases encapsulates common logic for testing nested access list deletion prevention.
+func runNestedAccessListCases(
+	t *testing.T,
+	role string,
+	cases []nestedAccessListCase,
+	setup func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList),
+	cleanup func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList),
+) {
+	t.Helper()
+
+	ctx := t.Context()
+	clock := clockwork.NewFakeClock()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service := newAccessListService(t, mem, clock, true /* igsEnabled */)
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			target, err := service.UpsertAccessList(ctx, newAccessList(t, tc.targetName, clock))
+			require.NoError(t, err)
+
+			related := make([]*accesslist.AccessList, 0, len(tc.relatedNames))
+			for _, name := range tc.relatedNames {
+				rel, err := service.UpsertAccessList(ctx, newAccessList(t, name, clock))
+				require.NoError(t, err)
+				related = append(related, rel)
+			}
+
+			setup(t, ctx, service, target, related)
+
+			// Deletion should be denied initially
+			err = service.DeleteAccessList(ctx, target.GetName())
+			require.Error(t, err)
+			require.True(t, trace.IsAccessDenied(err), "expected access denied error, got %v", err)
+
+			relatedTitles := make([]string, len(related))
+			for i, l := range related {
+				relatedTitles[i] = fmt.Sprintf(`"%s"`, l.Spec.Title)
+			}
+
+			expected := fmt.Sprintf(
+				`Cannot delete "%s", as it is %s of Access Lists: %s`,
+				target.Spec.Title,
+				role,
+				strings.Join(relatedTitles, ", "),
+			)
+			require.Contains(t, err.Error(), expected)
+
+			cleanup(t, ctx, service, target, related)
+
+			// Now deletion should succeed
+			err = service.DeleteAccessList(ctx, target.GetName())
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestAccessListDeletePrevention_NestedMemberLists(t *testing.T) {
+	runNestedAccessListCases(
+		t,
+		"a member",
+		[]nestedAccessListCase{
+			{
+				name:         "cannot delete list that is a member of another list",
+				targetName:   "child-list",
+				relatedNames: []string{"parent-list"},
+			},
+			{
+				name:         "handles formatting multiple member relationships",
+				targetName:   "child-list",
+				relatedNames: []string{"parent-list-1", "parent-list-2"},
+			},
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Create membership between target and all related lists
+			for _, parent := range related {
+				member := newAccessListMember(t, parent.GetName(), target.GetName(), withMembershipKind(accesslist.MembershipKindList))
+				_, err := service.UpsertAccessListMember(ctx, member)
+				require.NoError(t, err)
+			}
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Remove all created memberships
+			for _, parent := range related {
+				err := service.DeleteAccessListMember(ctx, parent.GetName(), target.GetName())
+				require.NoError(t, err)
+			}
+		},
+	)
+}
+
+func TestAccessListDeletePrevention_NestedOwnerLists(t *testing.T) {
+	runNestedAccessListCases(
+		t,
+		"an owner",
+		[]nestedAccessListCase{
+			{
+				name:         "cannot delete list that is an owner of another list",
+				targetName:   "owner-list",
+				relatedNames: []string{"target-list"},
+			},
+			{
+				name:         "handles formatting multiple owner relationships",
+				targetName:   "owner-list",
+				relatedNames: []string{"owned-1", "owned-2", "owned-3"},
+			},
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Add target as owner to all related lists
+			for _, owned := range related {
+				owned.Spec.Owners = append(owned.Spec.Owners, accesslist.Owner{
+					Name:           target.GetName(),
+					MembershipKind: accesslist.MembershipKindList,
+					Description:    "owner list as owner",
+				})
+				_, err := service.UpsertAccessList(ctx, owned)
+				require.NoError(t, err)
+			}
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Remove target as owner from all related lists
+			for _, owned := range related {
+				owned.Spec.Owners = slices.DeleteFunc(owned.Spec.Owners, func(o accesslist.Owner) bool {
+					return o.Name == target.GetName()
+				})
+				_, err := service.UpsertAccessList(ctx, owned)
+				require.NoError(t, err)
+			}
+		},
+	)
+}
+
+func TestAccessListDeletePrevention_MissingReferences(t *testing.T) {
+	runNestedAccessListCases(
+		t,
+		"a member",
+		[]nestedAccessListCase{
+			{
+				name:         "missing member references allow deletion",
+				targetName:   "child-list",
+				relatedNames: []string{"parent-list"},
+			},
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Create membership between target and all related lists
+			for _, parent := range related {
+				member := newAccessListMember(t, parent.GetName(), target.GetName(), withMembershipKind(accesslist.MembershipKindList))
+				_, err := service.UpsertAccessListMember(ctx, member)
+				require.NoError(t, err)
+			}
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Simulate stale references: hard-delete related lists and their members.
+			for _, parent := range related {
+				err := service.service.DeleteResource(ctx, parent.GetName())
+				require.NoError(t, err)
+				err = service.memberService.WithPrefix(parent.GetName()).DeleteAllResources(ctx)
+				require.NoError(t, err)
+			}
+		},
+	)
+	runNestedAccessListCases(
+		t,
+		"an owner",
+		[]nestedAccessListCase{
+			{
+				name:         "missing owner references allow deletion",
+				targetName:   "owner-list",
+				relatedNames: []string{"target-list"},
+			},
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Add target as owner to all related lists
+			for _, owned := range related {
+				owned.Spec.Owners = append(owned.Spec.Owners, accesslist.Owner{
+					Name:           target.GetName(),
+					MembershipKind: accesslist.MembershipKindList,
+					Description:    "owner list as owner",
+				})
+				_, err := service.UpsertAccessList(ctx, owned)
+				require.NoError(t, err)
+			}
+		},
+		func(t *testing.T, ctx context.Context, service *AccessListService, target *accesslist.AccessList, related []*accesslist.AccessList) {
+			// Simulate stale references: hard-delete related lists and their members.
+			for _, owned := range related {
+				err := service.service.DeleteResource(ctx, owned.GetName())
+				require.NoError(t, err)
+				err = service.memberService.WithPrefix(owned.GetName()).DeleteAllResources(ctx)
+				require.NoError(t, err)
+			}
+		},
+	)
+}
diff --git a/lib/services/local/access_test.go b/lib/services/local/access_test.go
index 780bb9f8e2614..4d564c1c78a02 100644
--- a/lib/services/local/access_test.go
+++ b/lib/services/local/access_test.go
@@ -22,32 +22,68 @@ import (
 	"context"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
+func TestRoleNotFound(t *testing.T) {
+	t.Parallel()
+
+	backend, err := memory.New(memory.Config{
+		Context: t.Context(),
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	access := NewAccessService(backend)
+
+	_, err = access.GetRole(t.Context(), "test-role")
+	assert.Error(t, err)
+	assert.True(t, trace.IsNotFound(err))
+	assert.Equal(t, "role test-role is not found", err.Error())
+}
+
 func TestLockCRUD(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
+	newLockFilter := func(inForceOnly bool, targets ...types.LockTarget) *types.LockFilter {
+		filter := &types.LockFilter{
+			InForceOnly: inForceOnly,
+			Targets:     make([]*types.LockTarget, 0, len(targets)),
+		}
+		for _, tgt := range targets {
+			filter.Targets = append(filter.Targets, &tgt)
+		}
+		return filter
+	}
+
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
 	backend, err := memory.New(memory.Config{
 		Context: ctx,
-		Clock:   clockwork.NewFakeClock(),
+		Clock:   clock,
 	})
 	require.NoError(t, err)
 
 	access := NewAccessService(backend)
+	expireTime1 := clock.Now().Add(1 * time.Hour)
+	expireTime2 := clock.Now().Add(5 * time.Hour)
 
 	lock1, err := types.NewLock("lock1", types.LockSpecV2{
 		Target: types.LockTarget{
 			User: "user-A",
 		},
+		Expires: &expireTime1,
 	})
 	require.NoError(t, err)
 
@@ -55,6 +91,7 @@ func TestLockCRUD(t *testing.T) {
 		Target: types.LockTarget{
 			ServerID: "node",
 		},
+		Expires: &expireTime2,
 	})
 	require.NoError(t, err)
 
@@ -64,6 +101,15 @@ func TestLockCRUD(t *testing.T) {
 		require.NoError(t, err)
 		require.Empty(t, locks)
 
+		locks, err = stream.Collect(access.RangeLocks(ctx, "", "", nil /* no filter */))
+		require.NoError(t, err)
+		require.Empty(t, locks)
+
+		locks, next, err := access.ListLocks(ctx, 0, "", nil /* no filter */)
+		require.NoError(t, err)
+		require.Empty(t, locks)
+		require.Empty(t, next)
+
 		// Create locks.
 		err = access.UpsertLock(ctx, lock1)
 		require.NoError(t, err)
@@ -83,6 +129,58 @@ func TestLockCRUD(t *testing.T) {
 					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			}
 		})
+		t.Run("ListLocks", func(t *testing.T) {
+			t.Parallel()
+			for _, inForceOnly := range []bool{true, false} {
+				locks, next, err := access.ListLocks(ctx, 0, "", newLockFilter(inForceOnly))
+				require.Empty(t, next)
+				require.NoError(t, err)
+				require.Len(t, locks, 2)
+				require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+				page1, page2Start, err := access.ListLocks(ctx, 1, "", newLockFilter(inForceOnly))
+				require.NotEmpty(t, page2Start)
+				require.NoError(t, err)
+				require.Len(t, page1, 1)
+				require.Empty(t, cmp.Diff([]types.Lock{lock1}, page1,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+				page2, next, err := access.ListLocks(ctx, 0, page2Start, newLockFilter(inForceOnly))
+				require.Empty(t, next)
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff([]types.Lock{lock2}, page2,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+				require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, append(page1, page2...),
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			}
+		})
+		t.Run("RangeLocks", func(t *testing.T) {
+			t.Parallel()
+			for _, inForceOnly := range []bool{true, false} {
+				locks, err := stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(inForceOnly)))
+				require.NoError(t, err)
+				require.Len(t, locks, 2)
+				require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+				_, page2Start, _ := access.ListLocks(ctx, 1, "", newLockFilter(inForceOnly))
+
+				page1, err := stream.Collect(access.RangeLocks(ctx, "", page2Start, newLockFilter(inForceOnly)))
+				require.NoError(t, err)
+				require.Len(t, page1, 1)
+				require.Empty(t, cmp.Diff([]types.Lock{lock1}, page1,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+				page2, err := stream.Collect(access.RangeLocks(ctx, page2Start, "", newLockFilter(inForceOnly)))
+				require.NoError(t, err)
+				require.Len(t, page2, 1)
+				require.Empty(t, cmp.Diff([]types.Lock{lock2}, page2,
+					cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+			}
+		})
 		t.Run("GetLocks with targets", func(t *testing.T) {
 			t.Parallel()
 			// Match both locks with the targets.
@@ -105,6 +203,53 @@ func TestLockCRUD(t *testing.T) {
 			require.NoError(t, err)
 			require.Empty(t, locks)
 		})
+		t.Run("ListLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			// Match both locks with the targets.
+			locks, next, err := access.ListLocks(ctx, 0, "", newLockFilter(false, lock1.Target(), lock2.Target()))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match only one of the locks.
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, next, err = access.ListLocks(ctx, 0, "", newLockFilter(false, lock1.Target(), roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match none of the locks.
+			locks, next, err = access.ListLocks(ctx, 0, "", newLockFilter(false, roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Empty(t, locks)
+		})
+		t.Run("RangeLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			// Match both locks with the targets.
+			locks, err := stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(false, lock1.Target(), lock2.Target())))
+			require.NoError(t, err)
+			require.Len(t, locks, 2)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match only one of the locks.
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, err = stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(false, lock1.Target(), roleTarget)))
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Match none of the locks.
+			locks, err = stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(false, roleTarget)))
+			require.NoError(t, err)
+			require.Empty(t, locks)
+		})
 		t.Run("GetLock", func(t *testing.T) {
 			t.Parallel()
 			// Get one of the locks.
@@ -120,6 +265,118 @@ func TestLockCRUD(t *testing.T) {
 		})
 	})
 
+	// Advance time and check some locks are no longer in force
+	clock.Advance(2 * time.Hour)
+
+	t.Run("LockGettersInForce", func(t *testing.T) {
+		t.Run("GetLocks", func(t *testing.T) {
+			t.Parallel()
+			locks, err := access.GetLocks(ctx, true)
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+		})
+		t.Run("ListLocks", func(t *testing.T) {
+			t.Parallel()
+			// Only return in force locks
+			locks, next, err := access.ListLocks(ctx, 0, "", newLockFilter(true))
+			require.Empty(t, next)
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// No filter returns all
+			locks, next, err = access.ListLocks(ctx, 0, "", nil)
+			require.Empty(t, next)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		})
+		t.Run("RangeLocks", func(t *testing.T) {
+			t.Parallel()
+			// Only return in force locks
+			locks, err := stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(true)))
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// No filter returns all
+			locks, err = stream.Collect(access.RangeLocks(ctx, "", "", nil))
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff([]types.Lock{lock1, lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		})
+
+		t.Run("GetLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			locks, err := access.GetLocks(ctx, true, lock1.Target(), lock2.Target())
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, err = access.GetLocks(ctx, true, lock1.Target(), roleTarget)
+			require.NoError(t, err)
+			require.Empty(t, locks)
+			require.Empty(t, locks)
+
+			// Match none of the locks.
+			locks, err = access.GetLocks(ctx, true, roleTarget)
+			require.NoError(t, err)
+			require.Empty(t, locks)
+		})
+		t.Run("ListLocks with targets", func(t *testing.T) {
+			t.Parallel()
+
+			// Match all but only lock2 is in force
+			locks, next, err := access.ListLocks(ctx, 0, "", newLockFilter(true, lock1.Target(), lock2.Target()))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Target match but not in force
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, next, err = access.ListLocks(ctx, 0, "", newLockFilter(true, lock1.Target(), roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Empty(t, locks)
+
+			// Nothing matched when some locks are in force
+			locks, next, err = access.ListLocks(ctx, 0, "", newLockFilter(true, roleTarget))
+			require.NoError(t, err)
+			require.Empty(t, next)
+			require.Empty(t, locks)
+		})
+		t.Run("RangeLocks with targets", func(t *testing.T) {
+			t.Parallel()
+			// Match all but only lock2 is in force
+			locks, err := stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(true, lock1.Target(), lock2.Target())))
+			require.NoError(t, err)
+			require.Len(t, locks, 1)
+			require.Empty(t, cmp.Diff([]types.Lock{lock2}, locks,
+				cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+			// Target match but not in force
+			roleTarget := types.LockTarget{Role: "role-A"}
+			locks, err = stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(true, lock1.Target(), roleTarget)))
+			require.NoError(t, err)
+			require.Empty(t, locks)
+
+			// Nothing matched when some locks are in force
+			locks, err = stream.Collect(access.RangeLocks(ctx, "", "", newLockFilter(true, roleTarget)))
+			require.NoError(t, err)
+			require.Empty(t, locks)
+		})
+	})
+
 	t.Run("UpsertLock", func(t *testing.T) {
 		// Get one of the locks.
 		lock, err := access.GetLock(ctx, lock1.GetName())
@@ -195,3 +452,139 @@ func TestLockCRUD(t *testing.T) {
 		require.Empty(t, locks)
 	})
 }
+
+func Test_matchLock(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+	expiredTime := clock.Now().Add(-2 * time.Hour)
+	futureTime := clock.Now().Add(time.Hour)
+	nowTime := clock.Now()
+
+	tests := []struct {
+		name   string
+		lock   types.Lock
+		filter *types.LockFilter
+		want   bool
+	}{
+		{
+			name: "nil filter matches",
+			want: true,
+		},
+		{
+			name: "inactive lock is not matched when InForceOnly is set",
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &expiredTime,
+				},
+			},
+			filter: &types.LockFilter{
+				InForceOnly: true,
+			},
+			want: false,
+		},
+		{
+			name: "active lock is matched when InForceOnly is set",
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
+				},
+			},
+			filter: &types.LockFilter{
+				InForceOnly: true,
+			},
+			want: true,
+		},
+		{
+			name: "no targets is a match when InForceOnly is false regardless of lock",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+			},
+			want: true,
+		},
+		{
+			name: "targets given do not match",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
+					Target: types.LockTarget{
+						User: "charlie",
+					},
+				},
+			},
+
+			want: false,
+		},
+		{
+			name: "targets given match",
+			filter: &types.LockFilter{
+				InForceOnly: false,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+					{
+						User: "charlie",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &futureTime,
+					Target: types.LockTarget{
+						User: "charlie",
+					},
+				},
+			},
+
+			want: true,
+		},
+		{
+			name: "targets given match but lock is expired with InForceOnly set",
+			filter: &types.LockFilter{
+				InForceOnly: true,
+				Targets: []*types.LockTarget{
+					{
+						User: "alice",
+					},
+					{
+						User: "bob",
+					},
+					{
+						User: "charlie",
+					},
+				},
+			},
+			lock: &types.LockV2{
+				Spec: types.LockSpecV2{
+					Expires: &expiredTime,
+					Target: types.LockTarget{
+						User: "charlie",
+					},
+				},
+			},
+
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, got := matchLock(tt.lock, tt.filter, nowTime)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/lib/services/local/apps.go b/lib/services/local/apps.go
index f058d7fbd754f..0841fef3705ca 100644
--- a/lib/services/local/apps.go
+++ b/lib/services/local/apps.go
@@ -20,9 +20,11 @@ package local
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
@@ -38,6 +40,75 @@ func NewAppService(backend backend.Backend) *AppService {
 	return &AppService{Backend: backend}
 }
 
+// Apps returns application resources within the range [start, end).
+func (s *AppService) Apps(ctx context.Context, start, end string) iter.Seq2[types.Application, error] {
+	return func(yield func(types.Application, error) bool) {
+		appKey := backend.NewKey(appPrefix)
+		endKey := backend.RangeEnd(appKey)
+		if end != "" {
+			endKey = appKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+		}
+		for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+			StartKey: appKey.AppendKey(backend.KeyFromString(start)),
+			EndKey:   endKey,
+		}) {
+			if err != nil {
+				yield(nil, err)
+				return
+			}
+
+			app, err := services.UnmarshalApp(item.Value,
+				services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+			if err != nil {
+				continue
+			}
+
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			if end != "" && app.GetName() >= end {
+				return
+			}
+
+			if !yield(app, nil) {
+				return
+			}
+		}
+	}
+}
+
+// ListApps returns a page of application resources.
+func (s *AppService) ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error) {
+	// Adjust page size, so it can't be too large.
+	if limit <= 0 || limit > defaults.DefaultChunkSize {
+		limit = defaults.DefaultChunkSize
+	}
+
+	appKey := backend.NewKey(appPrefix)
+	var out []types.Application
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: appKey.AppendKey(backend.KeyFromString(startKey)),
+		EndKey:   backend.RangeEnd(appKey),
+		Limit:    limit + 1,
+	}) {
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		app, err := services.UnmarshalApp(item.Value,
+			services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+		if err != nil {
+			continue
+		}
+
+		if len(out) == limit {
+			return out, app.GetName(), nil
+		}
+
+		out = append(out, app)
+	}
+
+	return out, "", nil
+}
+
 // GetApps returns all application resources.
 func (s *AppService) GetApps(ctx context.Context) ([]types.Application, error) {
 	startKey := backend.ExactKey(appPrefix)
diff --git a/lib/services/local/apps_test.go b/lib/services/local/apps_test.go
index d437a8fb8a8c9..fe9288f3f0cc8 100644
--- a/lib/services/local/apps_test.go
+++ b/lib/services/local/apps_test.go
@@ -19,13 +19,17 @@
 package local
 
 import (
+	"cmp"
 	"context"
+	"slices"
+	"strconv"
 	"testing"
 
-	"github.com/google/go-cmp/cmp"
+	gocmp "github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -63,6 +67,18 @@ func TestAppsCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, out)
 
+	out, next, err := service.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	var iterOut []types.Application
+	for app, err := range service.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, iterOut)
+
 	// Create both apps.
 	err = service.CreateApp(ctx, app1)
 	require.NoError(t, err)
@@ -72,14 +88,30 @@ func TestAppsCRUD(t *testing.T) {
 	// Fetch all apps.
 	out, err = service.GetApps(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Application{app1, app2}, out,
+	require.Empty(t, gocmp.Diff([]types.Application{app1, app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, next, err = service.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Application{app1, app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, gocmp.Diff([]types.Application{app1, app2}, iterOut,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
 	// Fetch a specific application.
 	app, err := service.GetApp(ctx, app2.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(app2, app,
+	require.Empty(t, gocmp.Diff(app2, app,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
@@ -97,16 +129,33 @@ func TestAppsCRUD(t *testing.T) {
 	require.NoError(t, err)
 	app, err = service.GetApp(ctx, app1.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(app1, app,
+	require.Empty(t, gocmp.Diff(app1, app,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
 	// Delete an application.
 	err = service.DeleteApp(ctx, app1.GetName())
 	require.NoError(t, err)
+
 	out, err = service.GetApps(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Application{app2}, out,
+	require.Empty(t, gocmp.Diff([]types.Application{app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, next, err = service.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Application{app2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, gocmp.Diff([]types.Application{app2}, iterOut,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
@@ -117,7 +166,90 @@ func TestAppsCRUD(t *testing.T) {
 	// Delete all applications.
 	err = service.DeleteAllApps(ctx)
 	require.NoError(t, err)
+
 	out, err = service.GetApps(ctx)
 	require.NoError(t, err)
 	require.Empty(t, out)
+
+	out, next, err = service.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	require.Empty(t, iterOut)
+
+	// Test pagination
+	var expected []types.Application
+	for i := range 1324 {
+		app, err := types.NewAppV3(types.Metadata{
+			Name: "app" + strconv.Itoa(i+1),
+		}, types.AppSpecV3{
+			URI: "localhost",
+		})
+		require.NoError(t, err)
+
+		require.NoError(t, service.CreateApp(ctx, app))
+		expected = append(expected, app)
+	}
+	slices.SortFunc(expected, func(a, b types.Application) int {
+		return cmp.Compare(a.GetName(), b.GetName())
+	})
+
+	out, err = service.GetApps(ctx)
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected))
+	assert.Empty(t, gocmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	page1, page2Start, err := service.ListApps(ctx, 0, "")
+	require.NoError(t, err)
+	assert.Len(t, page1, 1000)
+	require.NotEmpty(t, page2Start)
+
+	page2, next, err := service.ListApps(ctx, 1000, page2Start)
+	require.NoError(t, err)
+	assert.Len(t, page2, len(expected)-1000)
+	require.Empty(t, next)
+
+	listed := append(page1, page2...)
+	assert.Empty(t, gocmp.Diff(expected, listed,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, "", page2Start) {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	assert.Len(t, iterOut, len(page1))
+	assert.Empty(t, gocmp.Diff(page1, iterOut,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, "", "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+	assert.Len(t, iterOut, len(expected))
+	assert.Empty(t, gocmp.Diff(expected, iterOut,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	iterOut = nil
+	for app, err := range service.Apps(ctx, page2Start, "") {
+		require.NoError(t, err)
+		iterOut = append(iterOut, app)
+	}
+
+	assert.Len(t, iterOut, len(expected)-1000)
+	assert.Empty(t, gocmp.Diff(expected, append(page1, iterOut...),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
 }
diff --git a/lib/services/local/autoupdate.go b/lib/services/local/autoupdate.go
index 3ee58395f451c..65760da3d1553 100644
--- a/lib/services/local/autoupdate.go
+++ b/lib/services/local/autoupdate.go
@@ -32,18 +32,20 @@ import (
 )
 
 const (
-	autoUpdateConfigPrefix       = "auto_update_config"
-	autoUpdateVersionPrefix      = "auto_update_version"
-	autoUpdateAgentRolloutPrefix = "auto_update_agent_rollout"
-	autoUpdateAgentReportPrefix  = "auto_update_agent_report"
+	autoUpdateConfigPrefix            = "auto_update_config"
+	autoUpdateVersionPrefix           = "auto_update_version"
+	autoUpdateAgentRolloutPrefix      = "auto_update_agent_rollout"
+	autoUpdateAgentReportPrefix       = "auto_update_agent_report"
+	autoUpdateBotInstanceReportPrefix = "auto_update_bot_instance_report"
 )
 
 // AutoUpdateService is responsible for managing AutoUpdateConfig and AutoUpdateVersion singleton resources.
 type AutoUpdateService struct {
-	config  *generic.ServiceWrapper[*autoupdate.AutoUpdateConfig]
-	version *generic.ServiceWrapper[*autoupdate.AutoUpdateVersion]
-	rollout *generic.ServiceWrapper[*autoupdate.AutoUpdateAgentRollout]
-	report  *generic.ServiceWrapper[*autoupdate.AutoUpdateAgentReport]
+	config            *generic.ServiceWrapper[*autoupdate.AutoUpdateConfig]
+	version           *generic.ServiceWrapper[*autoupdate.AutoUpdateVersion]
+	rollout           *generic.ServiceWrapper[*autoupdate.AutoUpdateAgentRollout]
+	agentReport       *generic.ServiceWrapper[*autoupdate.AutoUpdateAgentReport]
+	botInstanceReport *generic.ServiceWrapper[*autoupdate.AutoUpdateBotInstanceReport]
 }
 
 // NewAutoUpdateService returns a new AutoUpdateService.
@@ -93,7 +95,7 @@ func NewAutoUpdateService(b backend.Backend) (*AutoUpdateService, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	report, err := generic.NewServiceWrapper(
+	agentReport, err := generic.NewServiceWrapper(
 		generic.ServiceConfig[*autoupdate.AutoUpdateAgentReport]{
 			Backend:       b,
 			ResourceKind:  types.KindAutoUpdateAgentRollout,
@@ -105,11 +107,24 @@ func NewAutoUpdateService(b backend.Backend) (*AutoUpdateService, error) {
 		return nil, trace.Wrap(err)
 	}
 
+	botInstanceReport, err := generic.NewServiceWrapper(
+		generic.ServiceConfig[*autoupdate.AutoUpdateBotInstanceReport]{
+			Backend:       b,
+			ResourceKind:  types.KindAutoUpdateBotInstanceReport,
+			BackendPrefix: backend.NewKey(autoUpdateBotInstanceReportPrefix),
+			MarshalFunc:   services.MarshalProtoResource[*autoupdate.AutoUpdateBotInstanceReport],
+			UnmarshalFunc: services.UnmarshalProtoResource[*autoupdate.AutoUpdateBotInstanceReport],
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	return &AutoUpdateService{
-		config:  config,
-		version: version,
-		rollout: rollout,
-		report:  report,
+		config:            config,
+		version:           version,
+		rollout:           rollout,
+		agentReport:       agentReport,
+		botInstanceReport: botInstanceReport,
 	}, nil
 }
 
@@ -229,13 +244,13 @@ func (s *AutoUpdateService) DeleteAutoUpdateAgentRollout(ctx context.Context) er
 
 // ListAutoUpdateAgentReports returns a paginated list of AutoUpdateAgentReport resources.
 func (s *AutoUpdateService) ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pageToken string) ([]*autoupdate.AutoUpdateAgentReport, string, error) {
-	agentReports, nextKey, err := s.report.ListResources(ctx, pageSize, pageToken)
+	agentReports, nextKey, err := s.agentReport.ListResources(ctx, pageSize, pageToken)
 	return agentReports, nextKey, trace.Wrap(err)
 }
 
 // GetAutoUpdateAgentReport returns the specified AutoUpdateAgentReport resource.
 func (s *AutoUpdateService) GetAutoUpdateAgentReport(ctx context.Context, name string) (*autoupdate.AutoUpdateAgentReport, error) {
-	agentReport, err := s.report.GetResource(ctx, name)
+	agentReport, err := s.agentReport.GetResource(ctx, name)
 	return agentReport, trace.Wrap(err)
 }
 
@@ -244,7 +259,7 @@ func (s *AutoUpdateService) CreateAutoUpdateAgentReport(ctx context.Context, age
 	if err := update.ValidateAutoUpdateAgentReport(agentReport); err != nil {
 		return nil, trace.Wrap(err, "validating autoupdate agent report")
 	}
-	created, err := s.report.CreateResource(ctx, agentReport)
+	created, err := s.agentReport.CreateResource(ctx, agentReport)
 	return created, trace.Wrap(err)
 }
 
@@ -253,7 +268,7 @@ func (s *AutoUpdateService) UpdateAutoUpdateAgentReport(ctx context.Context, age
 	if err := update.ValidateAutoUpdateAgentReport(agentReport); err != nil {
 		return nil, trace.Wrap(err, "validating autoupdate agent report")
 	}
-	updated, err := s.report.ConditionalUpdateResource(ctx, agentReport)
+	updated, err := s.agentReport.ConditionalUpdateResource(ctx, agentReport)
 	return updated, trace.Wrap(err)
 }
 
@@ -262,18 +277,18 @@ func (s *AutoUpdateService) UpsertAutoUpdateAgentReport(ctx context.Context, age
 	if err := update.ValidateAutoUpdateAgentReport(agentReport); err != nil {
 		return nil, trace.Wrap(err, "validating autoupdate agent report")
 	}
-	upserted, err := s.report.UpsertResource(ctx, agentReport)
+	upserted, err := s.agentReport.UpsertResource(ctx, agentReport)
 	return upserted, trace.Wrap(err)
 }
 
 // DeleteAutoUpdateAgentReport removes the specified AutoUpdateAgentReport resource.
 func (s *AutoUpdateService) DeleteAutoUpdateAgentReport(ctx context.Context, name string) error {
-	return trace.Wrap(s.report.DeleteResource(ctx, name))
+	return trace.Wrap(s.agentReport.DeleteResource(ctx, name))
 }
 
 // DeleteAllAutoUpdateAgentReports removes all AutoUpdateAgentReport resources.
 func (s *AutoUpdateService) DeleteAllAutoUpdateAgentReports(ctx context.Context) error {
-	return trace.Wrap(s.report.DeleteAllResources(ctx))
+	return trace.Wrap(s.agentReport.DeleteAllResources(ctx))
 }
 
 // itemFromAutoUpdateConfig generates `backend.Item` from `AutoUpdateConfig` resource type.
@@ -327,3 +342,23 @@ func itemFromAutoUpdateVersion(version *autoupdate.AutoUpdateVersion) (*backend.
 	}
 	return item, nil
 }
+
+// GetAutoUpdateBotInstanceReport gets the singleton auto-update bot report.
+func (s *AutoUpdateService) GetAutoUpdateBotInstanceReport(ctx context.Context) (*autoupdate.AutoUpdateBotInstanceReport, error) {
+	report, err := s.botInstanceReport.GetResource(ctx, types.MetaNameAutoUpdateBotInstanceReport)
+	return report, trace.Wrap(err)
+}
+
+// UpsertAutoUpdateBotInstanceReport creates or updates the bot instance report.
+func (s *AutoUpdateService) UpsertAutoUpdateBotInstanceReport(ctx context.Context, report *autoupdate.AutoUpdateBotInstanceReport) (*autoupdate.AutoUpdateBotInstanceReport, error) {
+	if err := update.ValidateAutoUpdateBotInstanceReport(report); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	report, err := s.botInstanceReport.UpsertResource(ctx, report)
+	return report, trace.Wrap(err)
+}
+
+// DeleteAutoUpdateBotInstanceReport deletes the singleton auto-update bot instance report.
+func (s *AutoUpdateService) DeleteAutoUpdateBotInstanceReport(ctx context.Context) error {
+	return trace.Wrap(s.botInstanceReport.DeleteResource(ctx, types.MetaNameAutoUpdateBotInstanceReport))
+}
diff --git a/lib/services/local/bot_instance.go b/lib/services/local/bot_instance.go
index c1a35d2816dd0..2256d46d0caa5 100644
--- a/lib/services/local/bot_instance.go
+++ b/lib/services/local/bot_instance.go
@@ -18,8 +18,6 @@ package local
 
 import (
 	"context"
-	"slices"
-	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -28,9 +26,11 @@ import (
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1/expression"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
+	"github.com/gravitational/teleport/lib/utils/typical"
 )
 
 const (
@@ -94,40 +94,43 @@ func (b *BotInstanceService) GetBotInstance(ctx context.Context, botName, instan
 // ListBotInstances lists all matching bot instances. A bot name and/or search terms can be optionally provided.
 // If an non-empty bot name is provided, only instances for that bot will be fetched.
 // If an non-empty search term is provided, only instances with a value containing the term in supported fields are fetched.
-// Supported search fields include; bot name, instance id, hostname (latest), tbot version (latest), join method (latest)
-func (b *BotInstanceService) ListBotInstances(ctx context.Context, botName string, pageSize int, lastKey string, search string) ([]*machineidv1.BotInstance, string, error) {
+// Supported search fields include; bot name, instance id, hostname (latest), tbot version (latest), join method (latest).
+// Sorting by bot name in ascending order is supported - an error is returned for any other sort type.
+func (b *BotInstanceService) ListBotInstances(ctx context.Context, pageSize int, lastKey string, options *services.ListBotInstancesRequestOptions) ([]*machineidv1.BotInstance, string, error) {
+	if options.GetSortField() != "" && options.GetSortField() != "bot_name" {
+		return nil, "", trace.CompareFailed("unsupported sort, only bot_name field is supported, but got %q", options.GetSortField())
+	}
+	if options.GetSortDesc() {
+		return nil, "", trace.CompareFailed("unsupported sort, only ascending order is supported")
+	}
+
 	var service *generic.ServiceWrapper[*machineidv1.BotInstance]
-	if botName == "" {
+	if options.GetFilterBotName() == "" {
 		// If botName is empty, return instances for all bots by not using a service prefix
 		service = b.service
 	} else {
-		service = b.service.WithPrefix(botName)
+		service = b.service.WithPrefix(options.GetFilterBotName())
+	}
+
+	var exp typical.Expression[*expression.Environment, bool]
+	if options.GetFilterQuery() != "" {
+		parser, err := expression.NewBotInstanceExpressionParser()
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		exp, err = parser.Parse(options.GetFilterQuery())
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
 	}
 
-	if search == "" {
+	if options.GetFilterSearchTerm() == "" && exp == nil {
 		r, nextToken, err := service.ListResources(ctx, pageSize, lastKey)
 		return r, nextToken, trace.Wrap(err)
 	}
 
 	r, nextToken, err := service.ListResourcesWithFilter(ctx, pageSize, lastKey, func(item *machineidv1.BotInstance) bool {
-		latestHeartbeats := item.GetStatus().GetLatestHeartbeats()
-		heartbeat := item.Status.InitialHeartbeat // Use initial heartbeat as a fallback
-		if len(latestHeartbeats) > 0 {
-			heartbeat = latestHeartbeats[len(latestHeartbeats)-1]
-		}
-
-		values := []string{
-			item.Spec.BotName,
-			item.Spec.InstanceId,
-		}
-
-		if heartbeat != nil {
-			values = append(values, heartbeat.Hostname, heartbeat.JoinMethod, heartbeat.Version, "v"+heartbeat.Version)
-		}
-
-		return slices.ContainsFunc(values, func(val string) bool {
-			return strings.Contains(strings.ToLower(val), strings.ToLower(search))
-		})
+		return services.MatchBotInstance(item, "", options.GetFilterSearchTerm(), exp)
 	})
 
 	return r, nextToken, trace.Wrap(err)
@@ -140,6 +143,11 @@ func (b *BotInstanceService) DeleteBotInstance(ctx context.Context, botName, ins
 	return trace.Wrap(serviceWithPrefix.DeleteResource(ctx, instanceID))
 }
 
+// DeleteAllBotInstances deletes all bot instances for all bots
+func (b *BotInstanceService) DeleteAllBotInstances(ctx context.Context) error {
+	return trace.Wrap(b.service.DeleteAllResources(ctx))
+}
+
 // PatchBotInstance uses the supplied function to patch the bot instance
 // matching the given (botName, instanceID) key and persists the patched
 // resource. It will make multiple attempts if a `CompareFailed` error is
diff --git a/lib/services/local/bot_instance_test.go b/lib/services/local/bot_instance_test.go
index dc9a451faba17..fe35c8ce5ba20 100644
--- a/lib/services/local/bot_instance_test.go
+++ b/lib/services/local/bot_instance_test.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // newBotInstance creates (but does not insert) a bot instance that is ready for
@@ -159,7 +160,7 @@ func createInstances(t *testing.T, ctx context.Context, service *BotInstanceServ
 }
 
 // listInstances fetches all instances from the BotInstanceService matching the botName filter
-func listInstances(t *testing.T, ctx context.Context, service *BotInstanceService, botName string, searchTerm string) []*machineidv1.BotInstance {
+func listInstances(t *testing.T, ctx context.Context, service *BotInstanceService, options *services.ListBotInstancesRequestOptions) []*machineidv1.BotInstance {
 	t.Helper()
 
 	var resources []*machineidv1.BotInstance
@@ -168,7 +169,7 @@ func listInstances(t *testing.T, ctx context.Context, service *BotInstanceServic
 	var err error
 
 	for {
-		bis, nextKey, err = service.ListBotInstances(ctx, botName, 0, nextKey, searchTerm)
+		bis, nextKey, err = service.ListBotInstances(ctx, 0, nextKey, options)
 		require.NoError(t, err)
 
 		resources = append(resources, bis...)
@@ -235,7 +236,7 @@ func TestBotInstanceCreateMetadata(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
+			ctx := t.Context()
 
 			mem, err := memory.New(memory.Config{
 				Context: ctx,
@@ -258,7 +259,7 @@ func TestBotInstanceCreateMetadata(t *testing.T) {
 func TestBotInstanceInvalidGetters(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
+	ctx := t.Context()
 	clock := clockwork.NewFakeClock()
 
 	mem, err := memory.New(memory.Config{
@@ -282,7 +283,7 @@ func TestBotInstanceInvalidGetters(t *testing.T) {
 func TestBotInstanceCRUD(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
+	ctx := t.Context()
 	clock := clockwork.NewFakeClock()
 
 	mem, err := memory.New(memory.Config{
@@ -307,7 +308,9 @@ func TestBotInstanceCRUD(t *testing.T) {
 	require.EqualExportedValues(t, patched, bi2)
 	require.Equal(t, bi.Metadata.Name, bi2.Metadata.Name)
 
-	resources := listInstances(t, ctx, service, "example", "")
+	resources := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+		FilterBotName: "example",
+	})
 
 	require.Len(t, resources, 1, "must list only 1 bot instance")
 	require.EqualExportedValues(t, patched, resources[0])
@@ -338,7 +341,7 @@ func TestBotInstanceCRUD(t *testing.T) {
 func TestBotInstanceList(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
+	ctx := t.Context()
 	clock := clockwork.NewFakeClock()
 
 	mem, err := memory.New(memory.Config{
@@ -354,14 +357,18 @@ func TestBotInstanceList(t *testing.T) {
 	bIds := createInstances(t, ctx, service, "b", 4)
 
 	// listing "a" should only return known "a" instances
-	aInstances := listInstances(t, ctx, service, "a", "")
+	aInstances := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+		FilterBotName: "a",
+	})
 	require.Len(t, aInstances, 3)
 	for _, ins := range aInstances {
 		require.Contains(t, aIds, ins.Spec.InstanceId)
 	}
 
 	// listing "b" should only return known "b" instances
-	bInstances := listInstances(t, ctx, service, "b", "")
+	bInstances := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+		FilterBotName: "b",
+	})
 	require.Len(t, bInstances, 4)
 	for _, ins := range bInstances {
 		require.Contains(t, bIds, ins.Spec.InstanceId)
@@ -376,14 +383,16 @@ func TestBotInstanceList(t *testing.T) {
 	}
 
 	// Listing an empty bot name ("") should return all instances.
-	allInstances := listInstances(t, ctx, service, "", "")
+	allInstances := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+		FilterBotName: "",
+	})
 	require.Len(t, allInstances, 7)
 	for _, ins := range allInstances {
 		require.Contains(t, allIds, ins.Spec.InstanceId)
 	}
 }
 
-// TestBotInstanceListWithSearchFilter verifies list and filtering wit39db3c10-870c-4544-aeec-9fc2e961eca3h search
+// TestBotInstanceListWithSearchFilter verifies list and filtering with search
 // term functionality for bot instances.
 func TestBotInstanceListWithSearchFilter(t *testing.T) {
 	t.Parallel()
@@ -402,7 +411,7 @@ func TestBotInstanceListWithSearchFilter(t *testing.T) {
 		},
 		{
 			name:       "match on instance id",
-			searchTerm: "cb2c352",
+			searchTerm: "CB2C352",
 			instance:   newBotInstance("test-bot", withBotInstanceId("cb2c3523-01f6-4258-966b-ace9f38f9862")),
 		},
 		{
@@ -429,7 +438,7 @@ func TestBotInstanceListWithSearchFilter(t *testing.T) {
 
 	for _, tc := range tcs {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
+			ctx := t.Context()
 
 			mem, err := memory.New(memory.Config{
 				Context: ctx,
@@ -445,10 +454,76 @@ func TestBotInstanceListWithSearchFilter(t *testing.T) {
 			_, err = service.CreateBotInstance(ctx, newBotInstance("bot-not-matched"))
 			require.NoError(t, err)
 
-			instances := listInstances(t, ctx, service, "", tc.searchTerm)
+			instances := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+				FilterSearchTerm: tc.searchTerm,
+			})
 
 			require.Len(t, instances, 1)
 			require.Equal(t, tc.instance.Spec.InstanceId, instances[0].Spec.InstanceId)
 		})
 	}
 }
+
+// TestBotInstanceListWithQuery verifies list and filtering with query
+// functionality for bot instances.
+func TestBotInstanceListWithQuery(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+	ctx := t.Context()
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	service, err := NewBotInstanceService(backend.NewSanitizer(mem), clock)
+	require.NoError(t, err)
+
+	instance := newBotInstance("test-bot", withBotInstanceHeartbeatHostname("svr-eu-tel-123-a"))
+	_, err = service.CreateBotInstance(ctx, instance)
+	require.NoError(t, err)
+	_, err = service.CreateBotInstance(ctx, newBotInstance("bot-not-matched"))
+	require.NoError(t, err)
+
+	instances := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
+		FilterQuery: `status.latest_heartbeat.hostname == "svr-eu-tel-123-a"`,
+	})
+
+	require.Len(t, instances, 1)
+	require.Equal(t, instance.Spec.InstanceId, instances[0].Spec.InstanceId)
+}
+
+// TestBotInstanceListWithSort verifies sorting returns a not-implemented error.
+func TestBotInstanceListWithSort(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+
+	ctx := t.Context()
+
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	service, err := NewBotInstanceService(backend.NewSanitizer(mem), clock)
+	require.NoError(t, err)
+
+	_, _, err = service.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		SortField: "test_field",
+		SortDesc:  false,
+	})
+	require.Error(t, err)
+	require.ErrorContains(t, err, "unsupported sort, only bot_name field is supported, but got \"test_field\"")
+
+	_, _, err = service.ListBotInstances(ctx, 0, "", &services.ListBotInstancesRequestOptions{
+		SortField: "bot_name",
+		SortDesc:  true,
+	})
+	require.Error(t, err)
+	require.ErrorContains(t, err, "unsupported sort, only ascending order is supported")
+
+	_, _, err = service.ListBotInstances(ctx, 0, "", nil)
+	require.NoError(t, err)
+}
diff --git a/lib/services/local/configuration.go b/lib/services/local/configuration.go
index 472a44e56e1a5..ab59965874a92 100644
--- a/lib/services/local/configuration.go
+++ b/lib/services/local/configuration.go
@@ -21,6 +21,8 @@ package local
 import (
 	"context"
 	"errors"
+	"iter"
+	"log/slog"
 
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
@@ -29,6 +31,7 @@ import (
 	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/services"
@@ -131,8 +134,8 @@ func (s *ClusterConfigurationService) UpsertClusterName(c types.ClusterName) err
 }
 
 // GetStaticTokens gets the list of static tokens used to provision nodes.
-func (s *ClusterConfigurationService) GetStaticTokens() (types.StaticTokens, error) {
-	item, err := s.Get(context.TODO(), backend.NewKey(clusterConfigPrefix, staticTokensPrefix))
+func (s *ClusterConfigurationService) GetStaticTokens(ctx context.Context) (types.StaticTokens, error) {
+	item, err := s.Get(ctx, backend.NewKey(clusterConfigPrefix, staticTokensPrefix))
 	if err != nil {
 		if trace.IsNotFound(err) {
 			return nil, trace.NotFound("static tokens not found")
@@ -601,6 +604,46 @@ func (s *ClusterConfigurationService) GetInstallers(ctx context.Context) ([]type
 	return installers, nil
 }
 
+// ListInstallers returns a page of installer script resources.
+func (s *ClusterConfigurationService) ListInstallers(ctx context.Context, limit int, start string) ([]types.Installer, string, error) {
+	return generic.CollectPageAndCursor(s.RangeInstallers(ctx, start, ""), limit, types.Installer.GetName)
+}
+
+// RangeInstallers returns installer script resources from the backend within the range [start, end).
+func (s *ClusterConfigurationService) RangeInstallers(ctx context.Context, start, end string) iter.Seq2[types.Installer, error] {
+	mapFn := func(item backend.Item) (types.Installer, bool) {
+		installer, err := services.UnmarshalInstaller(item.Value)
+		if err != nil {
+			slog.WarnContext(ctx, "Failed to unmarshal installer",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
+		}
+		return installer, true
+	}
+
+	startKey := backend.NewKey(clusterConfigPrefix, scriptsPrefix, installerPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(clusterConfigPrefix, scriptsPrefix, installerPrefix))
+	if end != "" {
+		endKey = backend.NewKey(clusterConfigPrefix, scriptsPrefix, installerPrefix, end).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(db types.Installer) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || db.GetName() < end
+		})
+}
+
 func (s *ClusterConfigurationService) GetUIConfig(ctx context.Context) (types.UIConfig, error) {
 	item, err := s.Get(ctx, backend.NewKey(clusterConfigPrefix, uiPrefix))
 	if err != nil {
@@ -675,7 +718,7 @@ func (s *ClusterConfigurationService) GetClusterMaintenanceConfig(ctx context.Co
 	item, err := s.Get(ctx, backend.NewKey(clusterConfigPrefix, maintenancePrefix))
 	if err != nil {
 		if trace.IsNotFound(err) {
-			return nil, trace.NotFound("no maintenance config has been created")
+			return nil, trace.NotFound("cluster maintenance config not found")
 		}
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/services/local/configuration_test.go b/lib/services/local/configuration_test.go
index 9c8443d952b59..c68a3903b94f0 100644
--- a/lib/services/local/configuration_test.go
+++ b/lib/services/local/configuration_test.go
@@ -20,9 +20,11 @@ package local
 
 import (
 	"context"
+	"fmt"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v2"
@@ -30,8 +32,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 type configContext struct {
@@ -64,7 +66,7 @@ func TestAuthPreference(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.AuthPreference(t)
@@ -76,7 +78,7 @@ func TestAccessGraphSettings(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.AccessGraphSettings(t)
@@ -88,7 +90,7 @@ func TestClusterName(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS:      clusterConfig,
 		LocalConfigS: clusterConfig,
 	}
@@ -101,7 +103,7 @@ func TestClusterNetworkingConfig(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.ClusterNetworkingConfig(t)
@@ -113,7 +115,7 @@ func TestClusterAuditConfig(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.ClusterNetworkingConfig(t)
@@ -125,7 +127,7 @@ func TestSessionRecordingConfig(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.SessionRecordingConfig(t)
@@ -137,7 +139,7 @@ func TestStaticTokens(t *testing.T) {
 	clusterConfig, err := NewClusterConfigurationService(tt.bk)
 	require.NoError(t, err)
 
-	suite := &suite.ServicesTestSuite{
+	suite := &ServicesTestSuite{
 		ConfigS: clusterConfig,
 	}
 	suite.StaticTokens(t)
@@ -245,3 +247,86 @@ func TestAuditConfigMarshal(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(auditConfig, out))
 }
+
+func TestInstallerPagination(t *testing.T) {
+	ctx := t.Context()
+
+	tt := setupConfigContext(context.Background(), t)
+	s, err := NewClusterConfigurationService(tt.bk)
+	require.NoError(t, err)
+
+	newResource := func(name string) types.Installer {
+		contents := "#!/bin/bash some script stuff"
+		inst, err := types.NewInstallerV1(name, contents)
+		require.NoError(t, err)
+		return inst
+	}
+
+	pageSize := 2
+	totalItems := pageSize*2 + (pageSize / 2)
+	var want []types.Installer
+
+	for i := range totalItems {
+		inst := newResource(fmt.Sprintf("installer-%d", i))
+		require.NoError(t, s.SetInstaller(ctx, inst))
+		want = append(want, inst)
+	}
+
+	t.Cleanup(func() {
+		for _, conn := range want {
+			s.DeleteInstaller(ctx, conn.GetName())
+		}
+	})
+
+	t.Run("GetInstallers", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.GetInstallers(ctx)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListInstallers", func(t *testing.T) {
+		// no limits
+		conns, next, err := s.ListInstallers(ctx, 0, "")
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.ListInstallers(ctx, pageSize, "")
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.ListInstallers(ctx, 0, page2Start)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeInstallers", func(t *testing.T) {
+		// full range
+		conns, err := stream.Collect(s.RangeInstallers(ctx, "", ""))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.RangeInstallers(ctx, want[pageSize].GetName(), ""))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.RangeInstallers(ctx, "", want[pageSize*2].GetName()))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.RangeInstallers(ctx, want[pageSize].GetName(), want[pageSize*2].GetName()))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+}
diff --git a/lib/services/local/databases.go b/lib/services/local/databases.go
index 8248d34951162..8a3047d308a87 100644
--- a/lib/services/local/databases.go
+++ b/lib/services/local/databases.go
@@ -20,22 +20,31 @@ package local
 
 import (
 	"context"
+	"iter"
+	"log/slog"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 )
 
 // DatabaseService manages database resources in the backend.
 type DatabaseService struct {
 	backend.Backend
+	logger *slog.Logger
 }
 
 // NewDatabasesService creates a new DatabasesService.
 func NewDatabasesService(backend backend.Backend) *DatabaseService {
-	return &DatabaseService{Backend: backend}
+	return &DatabaseService{
+		Backend: backend,
+		logger:  slog.With(teleport.ComponentKey, "DatabaseService"),
+	}
 }
 
 // GetDatabases returns all database resources.
@@ -57,6 +66,49 @@ func (s *DatabaseService) GetDatabases(ctx context.Context) ([]types.Database, e
 	return databases, nil
 }
 
+// ListDatabases returns a page of database resources.
+func (s *DatabaseService) ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error) {
+	return generic.CollectPageAndCursor(s.RangeDatabases(ctx, startKey, ""), limit, types.Database.GetName)
+}
+
+// RangeDatabases returns database resources within the range [start, end).
+func (s *DatabaseService) RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error] {
+	mapFn := func(item backend.Item) (types.Database, bool) {
+		database, err := services.UnmarshalDatabase(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to unmarshal database",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
+		}
+		return database, true
+	}
+
+	dbKey := backend.NewKey(databasesPrefix)
+	startKey := dbKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(dbKey)
+	if end != "" {
+		endKey = dbKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(db types.Database) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || db.GetName() < end
+		})
+}
+
 // GetDatabase returns the specified database resource.
 func (s *DatabaseService) GetDatabase(ctx context.Context, name string) (types.Database, error) {
 	item, err := s.Get(ctx, backend.NewKey(databasesPrefix, name))
diff --git a/lib/services/local/databases_test.go b/lib/services/local/databases_test.go
index c4c212bfdb808..3e2bf691b2eee 100644
--- a/lib/services/local/databases_test.go
+++ b/lib/services/local/databases_test.go
@@ -19,18 +19,23 @@
 package local
 
 import (
+	"cmp"
 	"context"
+	"slices"
+	"strconv"
 	"testing"
 
-	"github.com/google/go-cmp/cmp"
+	gocmp "github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 // TestDatabasesCRUD tests backend operations with database resources.
@@ -66,6 +71,15 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, out)
 
+	out, next, err := service.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	out, err = stream.Collect(service.RangeDatabases(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, out)
+
 	// Create both databases.
 	err = service.CreateDatabase(ctx, db1)
 	require.NoError(t, err)
@@ -85,14 +99,27 @@ func TestDatabasesCRUD(t *testing.T) {
 	// Fetch all databases.
 	out, err = service.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Database{dbBadURI, db1, db2}, out,
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db1, db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, next, err = service.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db1, db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	out, err = stream.Collect(service.RangeDatabases(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db1, db2}, out,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
 	// Fetch a specific database.
 	db, err := service.GetDatabase(ctx, db2.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(db2, db,
+	require.Empty(t, gocmp.Diff(db2, db,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
@@ -110,7 +137,7 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	db, err = service.GetDatabase(ctx, db1.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(db1, db,
+	require.Empty(t, gocmp.Diff(db1, db,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
@@ -119,7 +146,20 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	out, err = service.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Database{dbBadURI, db2}, out,
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, next, err = service.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db2}, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	out, err = stream.Collect(service.RangeDatabases(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, gocmp.Diff([]types.Database{dbBadURI, db2}, out,
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
@@ -133,4 +173,73 @@ func TestDatabasesCRUD(t *testing.T) {
 	out, err = service.GetDatabases(ctx)
 	require.NoError(t, err)
 	require.Empty(t, out)
+
+	out, next, err = service.ListDatabases(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	out, err = stream.Collect(service.RangeDatabases(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Test pagination
+	expected := make([]types.Database, 0, 50)
+	for i := range 50 {
+		db, err := types.NewDatabaseV3(types.Metadata{
+			Name: "db" + strconv.Itoa(i+1),
+		}, types.DatabaseSpecV3{
+			Protocol: defaults.ProtocolPostgres,
+			URI:      "localhost",
+		})
+		require.NoError(t, err)
+		require.NoError(t, service.CreateDatabase(t.Context(), db))
+		expected = append(expected, db)
+	}
+	slices.SortFunc(expected, func(a, b types.Database) int {
+		return cmp.Compare(a.GetMetadata().Name, b.GetMetadata().Name)
+	})
+
+	out, err = service.GetDatabases(ctx)
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected))
+	assert.Empty(t, gocmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	page1, page2Start, err := service.ListDatabases(t.Context(), 10, "")
+	require.NoError(t, err)
+	assert.Len(t, page1, 10)
+	assert.NotEmpty(t, page2Start)
+
+	page2, next, err := service.ListDatabases(t.Context(), 1000, page2Start)
+	require.NoError(t, err)
+	assert.Len(t, page2, len(expected)-10)
+	assert.Empty(t, next)
+
+	listed := append(page1, page2...)
+	assert.Empty(t, gocmp.Diff(expected, listed,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(service.RangeDatabases(t.Context(), "", page2Start))
+	require.NoError(t, err)
+	assert.Len(t, out, len(page1))
+	assert.Empty(t, gocmp.Diff(page1, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(service.RangeDatabases(t.Context(), "", ""))
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected))
+	assert.Empty(t, gocmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(service.RangeDatabases(t.Context(), page2Start, ""))
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected)-10)
+	assert.Empty(t, gocmp.Diff(expected, append(page1, out...),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
 }
diff --git a/lib/services/local/desktops.go b/lib/services/local/desktops.go
index 6d7f9f0c36ebf..db7d5c33a383e 100644
--- a/lib/services/local/desktops.go
+++ b/lib/services/local/desktops.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
@@ -223,8 +224,8 @@ func (s *WindowsDesktopService) DeleteAllWindowsDesktops(ctx context.Context) er
 // ListWindowsDesktops returns all Windows desktops matching filter.
 func (s *WindowsDesktopService) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
 	reqLimit := req.Limit
-	if reqLimit <= 0 {
-		return nil, trace.BadParameter("nonpositive parameter limit")
+	if reqLimit <= 0 || reqLimit > defaults.DefaultChunkSize {
+		reqLimit = defaults.DefaultChunkSize
 	}
 
 	filter := services.MatchResourceFilter{
@@ -260,54 +261,44 @@ func (s *WindowsDesktopService) ListWindowsDesktops(ctx context.Context, req typ
 		}
 	}
 
-	// Get most limit+1 results to determine if there will be a next key.
-	maxLimit := reqLimit + 1
-	var desktops []types.WindowsDesktop
-	if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, maxLimit, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(desktops) == maxLimit {
-				break
-			}
-
-			desktop, err := s.itemToWindowsDesktop(&item)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
+	var resp types.ListWindowsDesktopsResponse
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: rangeStart,
+		EndKey:   rangeEnd,
+	}) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-			if !req.WindowsDesktopFilter.Match(desktop) {
-				continue
-			}
+		desktop, err := s.itemToWindowsDesktop(&item)
+		if err != nil {
+			continue
+		}
 
-			switch match, err := services.MatchResourceByFilters(desktop, filter, nil /* ignore dup matches */); {
-			case err != nil:
-				return false, trace.Wrap(err)
-			case match:
-				desktops = append(desktops, desktop)
-			}
+		if !req.WindowsDesktopFilter.Match(desktop) {
+			continue
 		}
 
-		return len(desktops) == maxLimit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
+		switch match, err := services.MatchResourceByFilters(desktop, filter, nil /* ignore dup matches */); {
+		case err != nil:
+			return nil, trace.Wrap(err)
+		case match:
+			if len(resp.Desktops) >= reqLimit {
+				resp.NextKey = backend.GetPaginationKey(desktop)
+				return &resp, nil
+			}
 
-	var nextKey string
-	if len(desktops) > reqLimit {
-		nextKey = backend.GetPaginationKey(desktops[len(desktops)-1])
-		// Truncate the last item that was used to determine next row existence.
-		desktops = desktops[:reqLimit]
+			resp.Desktops = append(resp.Desktops, desktop)
+		}
 	}
 
-	return &types.ListWindowsDesktopsResponse{
-		Desktops: desktops,
-		NextKey:  nextKey,
-	}, nil
+	return &resp, nil
 }
 
 func (s *WindowsDesktopService) ListWindowsDesktopServices(ctx context.Context, req types.ListWindowsDesktopServicesRequest) (*types.ListWindowsDesktopServicesResponse, error) {
 	reqLimit := req.Limit
-	if reqLimit <= 0 {
-		return nil, trace.BadParameter("nonpositive parameter limit")
+	if reqLimit <= 0 || reqLimit > defaults.DefaultChunkSize {
+		reqLimit = defaults.DefaultChunkSize
 	}
 
 	rangeStart := backend.NewKey(windowsDesktopServicesPrefix, req.StartKey)
@@ -326,48 +317,38 @@ func (s *WindowsDesktopService) ListWindowsDesktopServices(ctx context.Context,
 		filter.PredicateExpression = expression
 	}
 
-	// Get most limit+1 results to determine if there will be a next key.
-	maxLimit := reqLimit + 1
-	var desktopServices []types.WindowsDesktopService
-	if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, maxLimit, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(desktopServices) == maxLimit {
-				break
-			}
-
-			desktop, err := services.UnmarshalWindowsDesktopService(
-				item.Value,
-				services.WithExpires(item.Expires),
-				services.WithRevision(item.Revision),
-			)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
+	var resp types.ListWindowsDesktopServicesResponse
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: rangeStart,
+		EndKey:   rangeEnd,
+	}) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-			switch match, err := services.MatchResourceByFilters(desktop, filter, nil /* ignore dup matches */); {
-			case err != nil:
-				return false, trace.Wrap(err)
-			case match:
-				desktopServices = append(desktopServices, desktop)
-			}
+		desktop, err := services.UnmarshalWindowsDesktopService(
+			item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision),
+		)
+		if err != nil {
+			continue
 		}
 
-		return len(desktopServices) == maxLimit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
+		switch match, err := services.MatchResourceByFilters(desktop, filter, nil /* ignore dup matches */); {
+		case err != nil:
+			return nil, trace.Wrap(err)
+		case match:
+			if len(resp.DesktopServices) >= reqLimit {
+				resp.NextKey = backend.GetPaginationKey(desktop)
+				return &resp, nil
+			}
 
-	var nextKey string
-	if len(desktopServices) > reqLimit {
-		nextKey = backend.GetPaginationKey(desktopServices[len(desktopServices)-1])
-		// Truncate the last item that was used to determine next row existence.
-		desktopServices = desktopServices[:reqLimit]
+			resp.DesktopServices = append(resp.DesktopServices, desktop)
+		}
 	}
 
-	return &types.ListWindowsDesktopServicesResponse{
-		DesktopServices: desktopServices,
-		NextKey:         nextKey,
-	}, nil
+	return &resp, nil
 }
 
 const (
diff --git a/lib/services/local/desktops_test.go b/lib/services/local/desktops_test.go
index 0a0b319555fb0..7e733c9cdae03 100644
--- a/lib/services/local/desktops_test.go
+++ b/lib/services/local/desktops_test.go
@@ -253,8 +253,8 @@ func TestListWindowsDesktops_Filters(t *testing.T) {
 		{
 			name:    "NOK invalid limit",
 			filter:  types.ListWindowsDesktopsRequest{},
-			assert:  require.Error,
-			wantLen: 0,
+			assert:  require.NoError,
+			wantLen: 3,
 		},
 		{
 			name: "matching host id",
diff --git a/lib/services/local/dynamic_access.go b/lib/services/local/dynamic_access.go
index 6ed3af08de8d1..3d1e404908ba0 100644
--- a/lib/services/local/dynamic_access.go
+++ b/lib/services/local/dynamic_access.go
@@ -66,6 +66,9 @@ func (s *DynamicAccessService) CreateAccessRequestV2(ctx context.Context, req ty
 	if req.GetDryRun() {
 		return nil, trace.BadParameter("dry run access request made it to DynamicAccessService, this is a bug")
 	}
+	if req.GetLongTermResourceGrouping() != nil {
+		return nil, trace.BadParameter("long term resource grouping should not be persisted, this is a bug")
+	}
 	item, err := itemFromAccessRequest(req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -334,42 +337,39 @@ func (s *DynamicAccessService) ListAccessRequests(ctx context.Context, req *prot
 	}
 	endKey := backend.RangeEnd(backend.ExactKey(accessRequestsPrefix))
 
-	if err := backend.IterateRange(ctx, s.Backend, startKey, endKey, limit+1, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(rsp.AccessRequests) > limit {
-				return true, nil
-			}
-
-			if !item.Key.HasSuffix(backend.NewKey(paramsPrefix)) {
-				// Item represents a different resource type in the
-				// same namespace.
-				continue
-			}
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: startKey,
+		EndKey:   endKey,
+	}) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-			accessRequest, err := itemToAccessRequest(item)
-			if err != nil {
-				s.logger.WarnContext(ctx, "Failed to unmarshal access request",
-					"key", item.Key,
-					"error", err,
-				)
-				continue
-			}
+		if !item.Key.HasSuffix(backend.NewKey(paramsPrefix)) {
+			// Item represents a different resource type in the
+			// same namespace.
+			continue
+		}
 
-			if !req.Filter.Match(accessRequest) {
-				continue
-			}
+		accessRequest, err := itemToAccessRequest(item)
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to unmarshal access request",
+				"key", item.Key,
+				"error", err,
+			)
+			continue
+		}
 
-			rsp.AccessRequests = append(rsp.AccessRequests, accessRequest)
+		if !req.Filter.Match(accessRequest) {
+			continue
 		}
 
-		return len(rsp.AccessRequests) > limit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
+		if len(rsp.AccessRequests) >= limit {
+			rsp.NextKey = accessRequest.GetName()
+			return &rsp, nil
+		}
 
-	if len(rsp.AccessRequests) > limit {
-		rsp.NextKey = rsp.AccessRequests[limit].GetName()
-		rsp.AccessRequests = rsp.AccessRequests[:limit]
+		rsp.AccessRequests = append(rsp.AccessRequests, accessRequest)
 	}
 
 	return &rsp, nil
diff --git a/lib/services/local/events.go b/lib/services/local/events.go
index c667f3e50a3d5..af9fab7d97a0c 100644
--- a/lib/services/local/events.go
+++ b/lib/services/local/events.go
@@ -20,6 +20,7 @@ package local
 
 import (
 	"context"
+	"errors"
 	"log/slog"
 	"strings"
 
@@ -42,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/devicetrust"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
 )
@@ -104,10 +106,16 @@ func (e *EventsService) NewWatcher(ctx context.Context, watch types.Watch) (type
 			parser = newAutoUpdateAgentRolloutParser()
 		case types.KindAutoUpdateAgentReport:
 			parser = newAutoUpdateAgentReportParser()
+		case types.KindAutoUpdateBotInstanceReport:
+			parser = newAutoUpdateBotInstanceReportParser()
 		case types.KindNamespace:
 			parser = newNamespaceParser(kind.Name)
 		case types.KindRole:
 			parser = newRoleParser()
+		case scopedaccess.KindScopedRole:
+			parser = newScopedRoleParser()
+		case scopedaccess.KindScopedRoleAssignment:
+			parser = newScopedRoleAssignmentParser()
 		case types.KindUser:
 			parser = newUserParser()
 		case types.KindNode:
@@ -258,6 +266,14 @@ func (e *EventsService) NewWatcher(ctx context.Context, watch types.Watch) (type
 			parser = newWorkloadIdentityX509RevocationParser()
 		case types.KindHealthCheckConfig:
 			parser = newHealthCheckConfigParser()
+		case types.KindRecordingEncryption:
+			parser = newRecordingEncryptionParser()
+		case types.KindRotatedKey:
+			parser = newRotatedKeyParser()
+		case types.KindRelayServer:
+			parser = newRelayServerParser()
+		case types.KindScopedToken:
+			parser = newScopedTokenParser()
 		default:
 			if watch.AllowPartialSuccess {
 				continue
@@ -328,6 +344,10 @@ func (w *watcher) parseEvent(e backend.Event) ([]types.Event, []error) {
 		if p.match(e.Item.Key) {
 			resource, err := p.parse(e)
 			if err != nil {
+				if eo := parseEventOverrideError(nil); errors.As(err, &eo) {
+					events = append(events, eo...)
+					continue
+				}
 				errs = append(errs, trace.Wrap(err))
 				continue
 			}
@@ -387,7 +407,10 @@ func (w *watcher) Close() error {
 // resourceParser is an interface
 // for parsing resource from backend byte event stream
 type resourceParser interface {
-	// parse parses resource from the backend event
+	// parse parses resource from the backend event; if the returned error is a
+	// parseEventOverrideError then the returned resource is ignored and the
+	// events in the parseEventOverrideError will be added to the generated
+	// events instead.
 	parse(event backend.Event) (types.Resource, error)
 	// match returns true if event key matches
 	match(key backend.Key) bool
@@ -395,6 +418,10 @@ type resourceParser interface {
 	prefixes() []backend.Key
 }
 
+type parseEventOverrideError []types.Event
+
+func (p parseEventOverrideError) Error() string { return "parseEventOverrideError" }
+
 // baseParser is a partial implementation of resourceParser for the most common
 // resource types (stored under a static prefix).
 type baseParser struct {
@@ -904,6 +931,45 @@ func (p *autoUpdateAgentReportParser) parse(event backend.Event) (types.Resource
 	}
 }
 
+func newAutoUpdateBotInstanceReportParser() *autoUpdateBotInstanceReportParser {
+	return &autoUpdateBotInstanceReportParser{
+		baseParser: newBaseParser(backend.NewKey(autoUpdateBotInstanceReportPrefix)),
+	}
+}
+
+type autoUpdateBotInstanceReportParser struct {
+	baseParser
+}
+
+func (p *autoUpdateBotInstanceReportParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpDelete:
+		name := event.Item.Key.TrimPrefix(backend.NewKey(autoUpdateBotInstanceReportPrefix)).String()
+		if name == "" {
+			return nil, trace.NotFound("failed parsing %v", event.Item.Key.String())
+		}
+		return &types.ResourceHeader{
+			Kind:    types.KindAutoUpdateBotInstanceReport,
+			Version: types.V1,
+			Metadata: types.Metadata{
+				Name:      strings.TrimPrefix(name, backend.SeparatorString),
+				Namespace: apidefaults.Namespace,
+			},
+		}, nil
+	case types.OpPut:
+		autoUpdateBotInstanceReport, err := services.UnmarshalProtoResource[*autoupdate.AutoUpdateBotInstanceReport](event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return types.Resource153ToLegacy(autoUpdateBotInstanceReport), nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
+
 func newNamespaceParser(name string) *namespaceParser {
 	prefix := backend.NewKey(namespacesPrefix)
 	if name != "" {
@@ -996,6 +1062,74 @@ func (p *roleParser) parse(event backend.Event) (types.Resource, error) {
 	}
 }
 
+func newScopedRoleParser() *scopedRoleParser {
+	return &scopedRoleParser{
+		baseParser: newBaseParser(scopedRoleWatchPrefix()),
+	}
+}
+
+type scopedRoleParser struct {
+	baseParser
+}
+
+func (p *scopedRoleParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpDelete:
+		name := strings.TrimPrefix(event.Item.Key.TrimPrefix(scopedRoleWatchPrefix()).String(), backend.SeparatorString)
+		if name == "" || strings.Contains(name, "/") {
+			return nil, trace.NotFound("failed parsing %v", event.Item.Key.String())
+		}
+		return &types.ResourceHeader{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: types.Metadata{
+				Name: name,
+			},
+		}, nil
+	case types.OpPut:
+		role, err := scopedRoleFromItem(&event.Item)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return types.Resource153ToLegacy(role), nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
+
+func newScopedRoleAssignmentParser() *scopedRoleAssignmentParser {
+	return &scopedRoleAssignmentParser{
+		baseParser: newBaseParser(scopedRoleAssignmentWatchPrefix()),
+	}
+}
+
+type scopedRoleAssignmentParser struct {
+	baseParser
+}
+
+func (p *scopedRoleAssignmentParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpDelete:
+		name := strings.TrimPrefix(event.Item.Key.TrimPrefix(scopedRoleAssignmentWatchPrefix()).String(), backend.SeparatorString)
+		if name == "" || strings.Contains(name, "/") {
+			return nil, trace.NotFound("failed parsing %v", event.Item.Key.String())
+		}
+		return &types.ResourceHeader{
+			Kind: scopedaccess.KindScopedRoleAssignment,
+			Metadata: types.Metadata{
+				Name: name,
+			},
+		}, nil
+	case types.OpPut:
+		assignment, err := scopedRoleAssignmentFromItem(&event.Item)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return types.Resource153ToLegacy(assignment), nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
+
 func newAccessRequestParser(m map[string]string) (*accessRequestParser, error) {
 	var filter types.AccessRequestFilter
 	if err := filter.FromMap(m); err != nil {
@@ -2362,8 +2496,9 @@ type headlessAuthenticationParser struct {
 func (p *headlessAuthenticationParser) parse(event backend.Event) (types.Resource, error) {
 	switch event.Type {
 	case types.OpDelete:
-		name := event.Item.Key.TrimPrefix(backend.NewKey(headlessAuthenticationPrefix)).String()
-		if name == "" {
+		// Key should look like [headlessAuthenticationPrefix]/[usersPrefix]/{user_id}/{headless_id}
+		components := event.Item.Key.Components()
+		if len(components) != 4 || components[0] != headlessAuthenticationPrefix || components[1] != usersPrefix {
 			return nil, trace.NotFound("failed parsing %v", event.Item.Key.String())
 		}
 
@@ -2371,7 +2506,7 @@ func (p *headlessAuthenticationParser) parse(event backend.Event) (types.Resourc
 			Kind:    types.KindHeadlessAuthentication,
 			Version: types.V1,
 			Metadata: types.Metadata{
-				Name:      strings.TrimPrefix(name, backend.SeparatorString),
+				Name:      components[3],
 				Namespace: apidefaults.Namespace,
 			},
 		}, nil
diff --git a/lib/services/local/events_test.go b/lib/services/local/events_test.go
index 7d3bc59229b32..f305956c29e64 100644
--- a/lib/services/local/events_test.go
+++ b/lib/services/local/events_test.go
@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -84,9 +83,9 @@ func TestWatchers(t *testing.T) {
 			kind: types.KindCertAuthority,
 			causeEvents: func(subtestCtx context.Context, subtestT *testing.T, backend backend.Backend) {
 				// GIVEN an empty backend, WHEN I create 3 new CAs
-				userCA := suite.NewTestCA(types.UserCA, "example.com")
-				hostCA := suite.NewTestCA(types.HostCA, "example.com")
-				hostCARemote := suite.NewTestCA(types.HostCA, "remote.com")
+				userCA := NewTestCA(types.UserCA, "example.com")
+				hostCA := NewTestCA(types.HostCA, "example.com")
+				hostCARemote := NewTestCA(types.HostCA, "remote.com")
 				require.NoError(subtestT, CreateResources(subtestCtx, backend, userCA, hostCA, hostCARemote))
 			},
 			validateEvents: func(subtestCtx context.Context, subtestT *testing.T, watcher types.Watcher) {
@@ -118,9 +117,9 @@ func TestWatchers(t *testing.T) {
 			filter: types.CertAuthorityFilter{types.HostCA: "example.com"}.IntoMap(),
 			causeEvents: func(subtestCtx context.Context, subtestT *testing.T, backend backend.Backend) {
 				// GIVEN an empty backend, WHEN I create some new CAs
-				userCA := suite.NewTestCA(types.UserCA, "example.com")
-				hostCA := suite.NewTestCA(types.HostCA, "example.com")
-				hostCARemote := suite.NewTestCA(types.HostCA, "remote.com")
+				userCA := NewTestCA(types.UserCA, "example.com")
+				hostCA := NewTestCA(types.HostCA, "example.com")
+				hostCARemote := NewTestCA(types.HostCA, "remote.com")
 				require.NoError(subtestT, CreateResources(subtestCtx, backend, userCA, hostCA, hostCARemote))
 			},
 			validateEvents: func(subtestCtx context.Context, subtestT *testing.T, watcher types.Watcher) {
diff --git a/lib/services/local/generic/generic.go b/lib/services/local/generic/generic.go
index dcd75a8c4a2e5..2458178abcbe9 100644
--- a/lib/services/local/generic/generic.go
+++ b/lib/services/local/generic/generic.go
@@ -20,6 +20,8 @@ package generic
 
 import (
 	"context"
+	"iter"
+	"log/slog"
 	"strings"
 	"time"
 
@@ -29,6 +31,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // Resource represents a Teleport resource that may be generically
@@ -155,13 +158,18 @@ func (s *Service[T]) CountResources(ctx context.Context) (uint, error) {
 	rangeEnd := backend.RangeEnd(rangeStart)
 
 	count := uint(0)
-	err := backend.IterateRange(ctx, s.backend, rangeStart, rangeEnd, int(s.pageLimit),
-		func(items []backend.Item) (stop bool, err error) {
-			count += uint(len(items))
-			return false, nil
-		})
+	for _, err := range s.backend.Items(ctx, backend.ItemsParams{
+		StartKey: rangeStart,
+		EndKey:   rangeEnd,
+	}) {
+		if err != nil {
+			return 0, trace.Wrap(err)
+		}
+
+		count++
+	}
 
-	return count, trace.Wrap(err)
+	return count, nil
 }
 
 // GetResources returns a list of all resources.
@@ -177,7 +185,9 @@ func (s *Service[T]) GetResources(ctx context.Context) ([]T, error) {
 
 	out := make([]T, 0, len(result.Items))
 	for _, item := range result.Items {
-		resource, err := s.unmarshalFunc(item.Value, services.WithRevision(item.Revision))
+		resource, err := s.unmarshalFunc(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -187,6 +197,41 @@ func (s *Service[T]) GetResources(ctx context.Context) ([]T, error) {
 	return out, nil
 }
 
+// Resources returns a stream of resources within the range [startKey, endKey].
+// If both keys are empty, then the entire range is returned.
+func (s *Service[T]) Resources(ctx context.Context, startKey, endKey string) iter.Seq2[T, error] {
+	params := backend.ItemsParams{
+		StartKey: s.backendPrefix.AppendKey(backend.KeyFromString(startKey)),
+	}
+	if endKey == "" {
+		params.EndKey = backend.RangeEnd(s.backendPrefix.ExactKey())
+	} else {
+		params.EndKey = s.backendPrefix.AppendKey(backend.KeyFromString(endKey))
+	}
+	return func(yield func(T, error) bool) {
+		for item, err := range s.backend.Items(ctx, params) {
+			if err != nil {
+				var t T
+				yield(t, trace.Wrap(err))
+				return
+			}
+
+			resource, err := s.unmarshalFunc(item.Value,
+				services.WithExpires(item.Expires),
+				services.WithRevision(item.Revision))
+			if err != nil {
+				// unmarshal errors are logged and skipped
+				slog.WarnContext(ctx, "skipping resource due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+				return
+			}
+
+			if !yield(resource, nil) {
+				return
+			}
+		}
+	}
+}
+
 // ListResources returns a paginated list of resources.
 func (s *Service[T]) ListResources(ctx context.Context, pageSize int, pageToken string) ([]T, string, error) {
 	resources, _, nextKey, err := s.listResourcesReturnNextResourceWithKey(ctx, pageSize, pageToken)
@@ -201,92 +246,78 @@ func (s *Service[T]) ListResourcesReturnNextResource(ctx context.Context, pageSi
 }
 
 func (s *Service[T]) listResourcesReturnNextResourceWithKey(ctx context.Context, pageSize int, pageToken string) ([]T, *T, string, error) {
-	rangeStart := s.backendPrefix.AppendKey(backend.KeyFromString(pageToken))
-	rangeEnd := backend.RangeEnd(s.backendPrefix.ExactKey())
-
 	// Adjust page size, so it can't be too large.
 	if pageSize <= 0 || pageSize > int(s.pageLimit) {
 		pageSize = int(s.pageLimit)
 	}
 
-	limit := pageSize + 1
-
-	// no filter provided get the range directly
-	result, err := s.backend.GetRange(ctx, rangeStart, rangeEnd, limit)
-	if err != nil {
-		return nil, nil, "", trace.Wrap(err)
-	}
-
-	out := make([]T, 0, len(result.Items))
-	var lastKey backend.Key
-	for _, item := range result.Items {
-		resource, err := s.unmarshalFunc(item.Value, services.WithRevision(item.Revision))
+	var out []T
+	for item, err := range s.backend.Items(ctx, backend.ItemsParams{
+		StartKey: s.backendPrefix.AppendKey(backend.KeyFromString(pageToken)),
+		EndKey:   backend.RangeEnd(s.backendPrefix.ExactKey()),
+		Limit:    pageSize + 1,
+	}) {
 		if err != nil {
 			return nil, nil, "", trace.Wrap(err)
 		}
-		out = append(out, resource)
-		lastKey = item.Key
-	}
 
-	var (
-		next    *T
-		nextKey string
-	)
-	if len(out) > pageSize {
-		next = &out[pageSize]
-		// Truncate the last item that was used to determine next row existence.
-		out = out[:pageSize]
-		nextKey = strings.TrimPrefix(lastKey.TrimPrefix(s.backendPrefix).String(), string(backend.Separator))
+		resource, err := s.unmarshalFunc(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+		if err != nil {
+			// unmarshal errors are logged and skipped
+			slog.WarnContext(ctx, "skipping resource due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+			continue
+		}
+
+		if len(out) == pageSize {
+			nextKey := strings.TrimPrefix(item.Key.TrimPrefix(s.backendPrefix).String(), string(backend.Separator))
+			return out, &resource, nextKey, nil
+		}
+
+		out = append(out, resource)
 	}
 
-	return out, next, nextKey, nil
+	return out, nil, "", nil
 }
 
 // ListResourcesWithFilter returns a paginated list of resources that match the given filter.
 func (s *Service[T]) ListResourcesWithFilter(ctx context.Context, pageSize int, pageToken string, matcher func(T) bool) ([]T, string, error) {
-	rangeStart := s.backendPrefix.AppendKey(backend.KeyFromString(pageToken))
-	rangeEnd := backend.RangeEnd(s.backendPrefix.ExactKey())
 
 	// Adjust page size, so it can't be too large.
 	if pageSize <= 0 || pageSize > int(s.pageLimit) {
 		pageSize = int(s.pageLimit)
 	}
 
-	var resources []T
-	var lastKey backend.Key
-	if err := backend.IterateRange(
-		ctx,
-		s.backend,
-		rangeStart,
-		rangeEnd,
-		pageSize+1,
-		func(items []backend.Item) (stop bool, err error) {
-			for _, item := range items {
-				resource, err := s.unmarshalFunc(item.Value, services.WithRevision(item.Revision), services.WithRevision(item.Revision))
-				if err != nil {
-					return false, trace.Wrap(err)
-				}
-				if matcher(resource) {
-					lastKey = item.Key
-					resources = append(resources, resource)
-					if len(resources) >= pageSize+1 {
-						return true, nil
-					}
-				}
-			}
-			return false, nil
-		}); err != nil {
-		return nil, "", trace.Wrap(err)
-	}
+	var out []T
+	for item, err := range s.backend.Items(ctx, backend.ItemsParams{
+		StartKey: s.backendPrefix.AppendKey(backend.KeyFromString(pageToken)),
+		EndKey:   backend.RangeEnd(s.backendPrefix.ExactKey()),
+	}) {
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		resource, err := s.unmarshalFunc(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+		if err != nil {
+			continue
+		}
 
-	var nextKey string
-	if len(resources) > pageSize {
-		nextKey = strings.TrimPrefix(lastKey.TrimPrefix(s.backendPrefix).String(), string(backend.Separator))
-		// Truncate the last item that was used to determine next row existence.
-		resources = resources[:pageSize]
+		if !matcher(resource) {
+			continue
+		}
+
+		if len(out) == pageSize {
+			nextKey := strings.TrimPrefix(item.Key.TrimPrefix(s.backendPrefix).String(), string(backend.Separator))
+			return out, nextKey, nil
+		}
+
+		out = append(out, resource)
 	}
 
-	return resources, nextKey, nil
+	return out, "", nil
 }
 
 // GetResource returns the specified resource.
@@ -299,7 +330,8 @@ func (s *Service[T]) GetResource(ctx context.Context, name string) (resource T,
 		return resource, trace.Wrap(err)
 	}
 	resource, err = s.unmarshalFunc(item.Value,
-		services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+		services.WithExpires(item.Expires),
+		services.WithRevision(item.Revision))
 	return resource, trace.Wrap(err)
 }
 
@@ -429,7 +461,8 @@ func (s *Service[T]) UpdateAndSwapResource(ctx context.Context, name string, mod
 	}
 
 	resource, err := s.unmarshalFunc(existingItem.Value,
-		services.WithExpires(existingItem.Expires), services.WithRevision(existingItem.Revision))
+		services.WithExpires(existingItem.Expires),
+		services.WithRevision(existingItem.Revision))
 	if err != nil {
 		return t, trace.Wrap(err)
 	}
diff --git a/lib/services/local/generic/generic_test.go b/lib/services/local/generic/generic_test.go
index 4f18c183bec94..349dc1d90028e 100644
--- a/lib/services/local/generic/generic_test.go
+++ b/lib/services/local/generic/generic_test.go
@@ -48,10 +48,13 @@ type testResource struct {
 }
 
 func newTestResource(name string) *testResource {
+	expires := time.Now()
+
 	tr := &testResource{
 		ResourceHeader: types.ResourceHeader{
 			Metadata: types.Metadata{
-				Name: name,
+				Name:    name,
+				Expires: &expires,
 			},
 			Kind:    "test_resource",
 			Version: types.V1,
@@ -67,10 +70,13 @@ type testResourceSpec struct {
 }
 
 func newTestResourceWithSpec(name string, specPropA string) *testResource {
+	expires := time.Now()
+
 	tr := &testResource{
 		ResourceHeader: types.ResourceHeader{
 			Metadata: types.Metadata{
-				Name: name,
+				Name:    name,
+				Expires: &expires,
 			},
 			Kind:    "test_resource",
 			Version: types.V1,
@@ -114,6 +120,11 @@ func unmarshalResource(data []byte, opts ...services.MarshalOption) (*testResour
 	if err := r.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	// Mimic the behavior of resources that utilize protojson such as `PluginStaticCredentials` which
+	// fail to unmarshal time correctly and require a `WithExpires` service marshal option on the backend.
+	r.SetExpiry(time.Time{})
+
 	if cfg.Revision != "" {
 		r.SetRevision(cfg.Revision)
 	}
@@ -160,7 +171,9 @@ func TestGenericCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	require.NotEmpty(t, r1.GetRevision())
+	require.NotEmpty(t, r1.Expiry())
 	require.NotEmpty(t, r2.GetRevision())
+	require.NotEmpty(t, r2.Expiry())
 	require.NotEqual(t, r1.GetRevision(), r2.GetRevision())
 
 	// Fetch all resources using paging default.
@@ -202,6 +215,46 @@ func TestGenericCRUD(t *testing.T) {
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 	))
 
+	// Retrieve all resources from the stream
+	var streamedResources []*testResource
+	for r, err := range service.Resources(ctx, "", "") {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff(paginatedOut, streamedResources,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Retrieve all resources from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, r1.GetName(), r2.GetName()) {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff(paginatedOut, streamedResources,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Retrieve a single resource from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, r2.GetName(), "") {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff([]*testResource{r2}, streamedResources,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Retrieve a single resource from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, "", r1.GetName()) {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff([]*testResource{r1}, streamedResources,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
 	// Fetch a specific service provider.
 	r, err := service.GetResource(ctx, r2.GetName())
 	require.NoError(t, err)
@@ -219,6 +272,7 @@ func TestGenericCRUD(t *testing.T) {
 
 	// Update a resource.
 	r1.SetStaticLabels(map[string]string{"newlabel": "newvalue"})
+	r1.SetExpiry(time.Now().Add(20 * time.Hour))
 	r1, err = service.UpdateResource(ctx, r1)
 	require.NoError(t, err)
 	r, err = service.GetResource(ctx, r1.GetName())
@@ -259,6 +313,7 @@ func TestGenericCRUD(t *testing.T) {
 
 	// Upsert a resource (update).
 	r1.SetStaticLabels(map[string]string{"newerlabel": "newervalue"})
+	r1.SetExpiry(time.Now().Add(20 * time.Hour))
 	r1, err = service.UpsertResource(ctx, r1)
 	require.NoError(t, err)
 	out, nextToken, err = service.ListResources(ctx, 200, "")
@@ -291,7 +346,9 @@ func TestGenericCRUD(t *testing.T) {
 		item, err := b.Get(ctx, service.MakeKey(backend.NewKey(r1.GetName())))
 		require.NoError(t, err)
 
-		r, err = unmarshalResource(item.Value, services.WithRevision(item.Revision))
+		r, err = unmarshalResource(item.Value,
+			services.WithRevision(item.Revision),
+			services.WithExpires(item.Expires))
 		require.NoError(t, err)
 		require.Empty(t, cmp.Diff(r1, r,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
diff --git a/lib/services/local/generic/generic_wrapper.go b/lib/services/local/generic/generic_wrapper.go
index fe6ffb0fe5708..01693689a6a31 100644
--- a/lib/services/local/generic/generic_wrapper.go
+++ b/lib/services/local/generic/generic_wrapper.go
@@ -18,6 +18,7 @@ package generic
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/trace"
 
@@ -149,3 +150,21 @@ func (s ServiceWrapper[T]) ListResourcesWithFilter(ctx context.Context, pageSize
 	}
 	return out, nextToken, trace.Wrap(err)
 }
+
+// Resources returns a stream of resources within the range [startKey, endKey].
+// If both keys are empty, then the entire range is returned.
+func (s *ServiceWrapper[T]) Resources(ctx context.Context, startKey, endKey string) iter.Seq2[T, error] {
+	return func(yield func(T, error) bool) {
+		for adapter, err := range s.service.Resources(ctx, startKey, endKey) {
+			if err != nil {
+				var t T
+				yield(t, err)
+				return
+			}
+
+			if !yield(adapter.resource, nil) {
+				return
+			}
+		}
+	}
+}
diff --git a/lib/services/local/generic/generic_wrapper_test.go b/lib/services/local/generic/generic_wrapper_test.go
index 0996e3eb07dfc..ff148502d4ccb 100644
--- a/lib/services/local/generic/generic_wrapper_test.go
+++ b/lib/services/local/generic/generic_wrapper_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -165,10 +166,42 @@ func TestGenericWrapperCRUD(t *testing.T) {
 	require.Equal(t, 2, numPages)
 	require.Equal(t, []*testResource153{r1, r2}, paginatedOut)
 
+	// Retrieve all resources from the stream
+	var streamedResources []*testResource153
+	for r, err := range service.Resources(ctx, "", "") {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff(paginatedOut, streamedResources, protocmp.Transform()))
+
+	// Retrieve all resources from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, r1.GetMetadata().GetName(), r2.GetMetadata().GetName()) {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff(paginatedOut, streamedResources, protocmp.Transform()))
+
+	// Retrieve a single resource from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, r2.GetMetadata().GetName(), "") {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff([]*testResource153{r2}, streamedResources, protocmp.Transform()))
+
+	// Retrieve a single resource from the stream
+	streamedResources = nil
+	for r, err := range service.Resources(ctx, "", r1.GetMetadata().GetName()) {
+		require.NoError(t, err)
+		streamedResources = append(streamedResources, r)
+	}
+	require.Empty(t, cmp.Diff([]*testResource153{r1}, streamedResources, protocmp.Transform()))
+
 	// Fetch a specific service provider.
 	r, err := service.GetResource(ctx, r2.GetMetadata().GetName())
 	require.NoError(t, err)
-	require.Equal(t, r2, r)
+	require.Empty(t, cmp.Diff(r2, r, protocmp.Transform()))
 
 	// Try to fetch a resource that doesn't exist.
 	_, err = service.GetResource(ctx, "doesnotexist")
@@ -207,7 +240,7 @@ func TestGenericWrapperCRUD(t *testing.T) {
 	out, nextToken, err = service.ListResources(ctx, 200, "")
 	require.NoError(t, err)
 	require.Empty(t, nextToken)
-	require.Equal(t, []*testResource153{r2}, out)
+	require.Empty(t, cmp.Diff([]*testResource153{r2}, out, protocmp.Transform()))
 
 	// Upsert a resource (create).
 	r1, err = service.UpsertResource(ctx, r1)
diff --git a/lib/services/local/generic/helpers.go b/lib/services/local/generic/helpers.go
index 9d647baaa0d75..7391342830795 100644
--- a/lib/services/local/generic/helpers.go
+++ b/lib/services/local/generic/helpers.go
@@ -21,7 +21,11 @@ package generic
 import (
 	"time"
 
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -71,3 +75,33 @@ func FastMarshal[T MarshalableResource](key backend.Key, r T) (backend.Item, err
 		Revision: r.GetRevision(),
 	}, nil
 }
+
+// CollectPageAndCursor collects items from a stream until either the stream is empty or an item limit is reached.
+func CollectPageAndCursor[T any](s stream.Stream[T], limit int, cursorFn func(T) string) ([]T, string, error) {
+	var next string
+	var seen int
+
+	if limit <= 0 || limit > defaults.DefaultChunkSize {
+		limit = defaults.DefaultChunkSize
+	}
+
+	out, err := stream.Collect(
+		stream.TakeWhile(
+			s,
+			func(item T) bool {
+				if seen < limit {
+					seen++
+					return true
+				}
+				next = cursorFn(item)
+				return false
+			},
+		),
+	)
+
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return out, next, nil
+}
diff --git a/lib/services/local/generic/helpers_test.go b/lib/services/local/generic/helpers_test.go
new file mode 100644
index 0000000000000..f571097c21e7c
--- /dev/null
+++ b/lib/services/local/generic/helpers_test.go
@@ -0,0 +1,74 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package generic_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services/local/generic"
+)
+
+func TestCollectPageAndCursor(t *testing.T) {
+	tests := []struct {
+		name      string
+		s         stream.Stream[int]
+		limit     int
+		wantItems []int
+		wantNext  string
+		errAssert func(require.TestingT, error, ...any)
+	}{
+		{
+			name:      "empty stream",
+			s:         stream.Empty[int](),
+			errAssert: require.NoError,
+		},
+		{
+			name:      "default limit",
+			s:         stream.Slice([]int{1, 2, 3, 4}),
+			wantItems: []int{1, 2, 3, 4},
+			errAssert: require.NoError,
+		},
+		{
+			name:      "limit hit",
+			s:         stream.Slice([]int{1, 2, 3, 4}),
+			limit:     2,
+			wantItems: []int{1, 2},
+			wantNext:  "3",
+			errAssert: require.NoError,
+		},
+		{
+			name:      "error propagated",
+			s:         stream.Fail[int](trace.BadParameter("ooops")),
+			errAssert: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, gotNext, gotErr := generic.CollectPageAndCursor(tt.s, tt.limit,
+				func(item int) string { return fmt.Sprintf("%d", item) })
+			require.Empty(t, cmp.Diff(tt.wantItems, got))
+			require.Equal(t, tt.wantNext, gotNext)
+			tt.errAssert(t, gotErr)
+		})
+	}
+}
diff --git a/lib/services/local/health_check_config.go b/lib/services/local/health_check_config.go
index 869dec40f7532..8ee062d49d34f 100644
--- a/lib/services/local/health_check_config.go
+++ b/lib/services/local/health_check_config.go
@@ -20,13 +20,17 @@ package local
 
 import (
 	"context"
+	"iter"
+	"strings"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
 )
@@ -58,33 +62,107 @@ func NewHealthCheckConfigService(b backend.Backend) (*HealthCheckConfigService,
 	}, nil
 }
 
+func (*HealthCheckConfigService) hasVirtualResource(name string) bool {
+	switch name {
+	case teleport.VirtualDefaultHealthCheckConfigDBName,
+		teleport.VirtualDefaultHealthCheckConfigKubeName:
+		return true
+	default:
+		return false
+	}
+}
+
+func (*HealthCheckConfigService) getVirtualResource(name string) *healthcheckconfigv1.HealthCheckConfig {
+	switch name {
+	case teleport.VirtualDefaultHealthCheckConfigDBName:
+		return services.VirtualDefaultHealthCheckConfigDB()
+	case teleport.VirtualDefaultHealthCheckConfigKubeName:
+		return services.VirtualDefaultHealthCheckConfigKube()
+	}
+	return nil
+}
+
+func (*HealthCheckConfigService) rangeVirtualResources(start string) iter.Seq2[*healthcheckconfigv1.HealthCheckConfig, error] {
+	return func(yield func(*healthcheckconfigv1.HealthCheckConfig, error) bool) {
+		switch {
+		case start <= teleport.VirtualDefaultHealthCheckConfigDBName:
+			if !yield(services.VirtualDefaultHealthCheckConfigDB(), nil) {
+				return
+			}
+			fallthrough
+		case start <= teleport.VirtualDefaultHealthCheckConfigKubeName:
+			if !yield(services.VirtualDefaultHealthCheckConfigKube(), nil) {
+				return
+			}
+		}
+	}
+}
+
 // CreateHealthCheckConfig creates a new HealthCheckConfig resource.
 func (s *HealthCheckConfigService) CreateHealthCheckConfig(ctx context.Context, config *healthcheckconfigv1.HealthCheckConfig) (*healthcheckconfigv1.HealthCheckConfig, error) {
+	// we don't need to check if config refers to a potentially virtual resource
+	// because creating on top of a virtual resource is very convenient so it's
+	// a break from the semantics of Create that we want to allow
 	created, err := s.svc.CreateResource(ctx, config)
 	return created, trace.Wrap(err)
 }
 
 // GetHealthCheckConfig returns the specified HealthCheckConfig resource.
+// A virtual resource, if requested, is always returned even if it doesn't exist in the backend.
 func (s *HealthCheckConfigService) GetHealthCheckConfig(ctx context.Context, name string) (*healthcheckconfigv1.HealthCheckConfig, error) {
 	item, err := s.svc.GetResource(ctx, name)
 	if err != nil {
+		if trace.IsNotFound(err) {
+			if virtualResource := s.getVirtualResource(name); virtualResource != nil {
+				return virtualResource, nil
+			}
+		}
 		return nil, trace.Wrap(err)
 	}
 	return item, nil
 }
 
 // ListHealthCheckConfigs returns a paginated list of HealthCheckConfig resources.
+// Virtual resources are always returned even if they don't exist in the backend.
 func (s *HealthCheckConfigService) ListHealthCheckConfigs(ctx context.Context, pageSize int, pageToken string) ([]*healthcheckconfigv1.HealthCheckConfig, string, error) {
-	items, nextKey, err := s.svc.ListResources(ctx, pageSize, pageToken)
+	items, nextPageToken, err := generic.CollectPageAndCursor(
+		iterstream.MergeStreamsWithPriority(
+			s.svc.Resources(ctx, pageToken, ""),
+			s.rangeVirtualResources(pageToken),
+			func(a, b *healthcheckconfigv1.HealthCheckConfig) int {
+				return strings.Compare(a.GetMetadata().GetName(), b.GetMetadata().GetName())
+			},
+		),
+		pageSize,
+		func(v *healthcheckconfigv1.HealthCheckConfig) string {
+			return v.GetMetadata().GetName()
+		},
+	)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
 
-	return items, nextKey, nil
+	return items, nextPageToken, nil
 }
 
 // UpdateHealthCheckConfig updates an existing HealthCheckConfig resource.
 func (s *HealthCheckConfigService) UpdateHealthCheckConfig(ctx context.Context, config *healthcheckconfigv1.HealthCheckConfig) (*healthcheckconfigv1.HealthCheckConfig, error) {
+	if virtualResource := s.getVirtualResource(config.GetMetadata().GetName()); virtualResource != nil && config.GetMetadata().GetRevision() == virtualResource.GetMetadata().GetRevision() {
+		// a (successful) conditional update on a virtual resource is a create
+		// in storage; no real storage item is going to have the same revision
+		// as the virtual resource, so this must be a conditional update on the
+		// virtual resource that we know of
+		created, err := s.svc.CreateResource(ctx, config)
+		if err != nil {
+			if trace.IsAlreadyExists(err) {
+				return nil, trace.Wrap(backend.ErrIncorrectRevision)
+			}
+			return nil, trace.Wrap(err)
+		}
+		return created, nil
+	}
+	// if this was intended to be a conditional update on a virtual resource it
+	// was not a successful one, but we can let the storage deal with it
 	updated, err := s.svc.ConditionalUpdateResource(ctx, config)
 	return updated, trace.Wrap(err)
 }
@@ -97,7 +175,13 @@ func (s *HealthCheckConfigService) UpsertHealthCheckConfig(ctx context.Context,
 
 // DeleteHealthCheckConfig removes the specified HealthCheckConfig resource.
 func (s *HealthCheckConfigService) DeleteHealthCheckConfig(ctx context.Context, name string) error {
-	return trace.Wrap(s.svc.DeleteResource(ctx, name))
+	err := s.svc.DeleteResource(ctx, name)
+	if trace.IsNotFound(err) && s.hasVirtualResource(name) {
+		// we want to allow deleting virtual resources as a noop even if it's a
+		// little break from the standard semantics of Delete
+		return nil
+	}
+	return trace.Wrap(err)
 }
 
 // DeleteAllHealthCheckConfigs removes all HealthCheckConfig resources.
@@ -105,29 +189,43 @@ func (s *HealthCheckConfigService) DeleteAllHealthCheckConfigs(ctx context.Conte
 	return trace.Wrap(s.svc.DeleteAllResources(ctx))
 }
 
-func newHealthCheckConfigParser() *healthCheckConfigParser {
-	return &healthCheckConfigParser{
-		baseParser: newBaseParser(backend.NewKey(healthCheckConfigPrefix)),
+func newHealthCheckConfigParser() resourceParser {
+	return healthCheckConfigParser{}
+}
+
+type healthCheckConfigParser struct{}
+
+func (healthCheckConfigParser) prefixes() []backend.Key {
+	return []backend.Key{
+		backend.ExactKey(healthCheckConfigPrefix),
 	}
 }
 
-type healthCheckConfigParser struct {
-	baseParser
+func (healthCheckConfigParser) match(key backend.Key) bool {
+	return strings.HasPrefix(key.String(), backend.SeparatorString+healthCheckConfigPrefix+backend.SeparatorString)
 }
 
 func (healthCheckConfigParser) parse(event backend.Event) (types.Resource, error) {
 	switch event.Type {
 	case types.OpDelete:
-		components := event.Item.Key.Components()
-		if len(components) < 2 {
-			return nil, trace.NotFound("failed parsing %s", event.Item.Key)
+		key := event.Item.Key.String()
+		name, found := strings.CutPrefix(key, backend.SeparatorString+healthCheckConfigPrefix+backend.SeparatorString)
+		if !found {
+			return nil, trace.NotFound("failed parsing "+types.KindHealthCheckConfig+" key %+q", key)
+		}
+
+		if virtualResource := (*HealthCheckConfigService)(nil).getVirtualResource(name); virtualResource != nil {
+			return nil, parseEventOverrideError{{
+				Type:     types.OpPut,
+				Resource: types.Resource153ToLegacy(virtualResource),
+			}}
 		}
 
 		return &types.ResourceHeader{
 			Kind:    types.KindHealthCheckConfig,
 			Version: types.V1,
 			Metadata: types.Metadata{
-				Name:      components[1],
+				Name:      name,
 				Namespace: apidefaults.Namespace,
 			},
 		}, nil
diff --git a/lib/services/local/health_check_config_test.go b/lib/services/local/health_check_config_test.go
index b3c3e9c11cf31..c534741ec6216 100644
--- a/lib/services/local/health_check_config_test.go
+++ b/lib/services/local/health_check_config_test.go
@@ -23,11 +23,13 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"
 
+	"github.com/gravitational/teleport"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
@@ -35,103 +37,362 @@ import (
 	"github.com/gravitational/teleport/api/types/healthcheckconfig"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 func TestHealthCheckConfigService(t *testing.T) {
 	t.Parallel()
+	ctx := t.Context()
 
-	ctx := context.Background()
-	mem, err := memory.New(memory.Config{
-		Context: ctx,
-		Clock:   clockwork.NewFakeClock(),
-	})
-	require.NoError(t, err)
-	service, err := NewHealthCheckConfigService(backend.NewSanitizer(mem))
-	require.NoError(t, err)
+	tests := []struct {
+		name string
+		run  func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService)
+	}{
+		{
+			name: "create",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				_, err := svc.CreateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
 
-	cfg1 := newHealthCheckConfig(t, "cfg1")
-	cfg2 := newHealthCheckConfig(t, "cfg2")
+				cfg2 := newHealthCfg(t, "cfg2")
+				_, err = svc.CreateHealthCheckConfig(ctx, cfg2)
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "create invalid",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg := newHealthCfg(t, "invalid")
+				cfg.Spec = nil
+				_, err := svc.CreateHealthCheckConfig(ctx, cfg)
+				require.Error(t, err)
+			},
+		},
+		{
+			name: "create virtual defaults not persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, cfg := range newHealthCfgDefaults(t) {
+					t.Run(cfg.GetMetadata().GetName(), func(t *testing.T) {
+						// Create a virtual default which hasn't been written to the backend.
+						out, err := svc.CreateHealthCheckConfig(ctx, cfg)
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfg, out, protocmp.Transform()))
+					})
+				}
+			},
+		},
+		{
+			name: "create virtual default concurrent",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				errChan := make(chan error, 2)
+				for i := 0; i < 2; i++ {
+					go func() {
+						cfg := services.VirtualDefaultHealthCheckConfigDB()
+						_, err := svc.CreateHealthCheckConfig(ctx, cfg)
+						errChan <- err
+					}()
+				}
+				err1 := <-errChan
+				err2 := <-errChan
 
-	t.Run("empty", func(t *testing.T) {
-		out, _, err := service.ListHealthCheckConfigs(ctx, 10, "")
-		require.NoError(t, err)
-		require.Empty(t, out)
-	})
+				if err1 == nil {
+					require.True(t, trace.IsAlreadyExists(err2))
+				} else {
+					require.NoError(t, err2)
+					require.True(t, trace.IsAlreadyExists(err1))
+				}
+			},
+		},
+		{
+			name: "get",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				_, err := svc.CreateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
 
-	t.Run("invalid resource is rejected", func(t *testing.T) {
-		cfg := newHealthCheckConfig(t, "example")
-		cfg.Spec = nil
-		_, err := service.CreateHealthCheckConfig(ctx, cfg)
-		require.Error(t, err)
-	})
+				out, err := svc.GetHealthCheckConfig(ctx, cfg1.GetMetadata().GetName())
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff(cfg1, out, protocmp.Transform()))
+			},
+		},
+		{
+			name: "get not found",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				_, err := svc.GetHealthCheckConfig(ctx, "not-found")
+				require.True(t, trace.IsNotFound(err))
+			},
+		},
+		{
+			name: "get virtual defaults not persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for name, cfg := range newHealthCfgDefaultsMap(t) {
+					t.Run(name, func(t *testing.T) {
+						// Get a virtual default which hasn't been written to the backend.
+						out, err := svc.GetHealthCheckConfig(ctx, name)
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfg, out, protocmp.Transform()))
+					})
+				}
+			},
+		},
+		{
+			name: "list with paging",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				cfg1, err := svc.CreateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
+				cfg2 := newHealthCfg(t, "cfg2")
+				cfg2, err = svc.CreateHealthCheckConfig(ctx, cfg2)
+				require.NoError(t, err)
 
-	t.Run("create", func(t *testing.T) {
-		_, err := service.CreateHealthCheckConfig(ctx, cfg1)
-		require.NoError(t, err)
-		_, err = service.CreateHealthCheckConfig(ctx, cfg2)
-		require.NoError(t, err)
-	})
+				var cfgs []*healthcheckconfigv1.HealthCheckConfig
+				var token string
+				for {
+					out, nextToken, err := svc.ListHealthCheckConfigs(ctx, 1, token)
+					require.NoError(t, err)
+					require.Len(t, out, 1)
+					cfgs = append(cfgs, out...)
+					if nextToken == "" {
+						break
+					}
+					token = nextToken
+				}
 
-	t.Run("list", func(t *testing.T) {
-		out, _, err := service.ListHealthCheckConfigs(ctx, 10, "")
-		require.NoError(t, err)
-		requireEqualHealthCheckConfigs(t, out, cfg1, cfg2)
-	})
+				require.Len(t, cfgs, teleport.VirtualDefaultHealthCheckConfigCount+2)
+				requireContainsHealthCheckConfigs(t, cfgs, cfg1, cfg2)
+			},
+		},
+		{
+			name: "list with paging splitting virtual defaults",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				// Create one regular config that sorts between virtual defaults
+				// (assuming virtual defaults are named alphabetically)
+				cfg := newHealthCfg(t, "aaa-config") // Sorts before virtual defaults
+				_, err := svc.CreateHealthCheckConfig(ctx, cfg)
+				require.NoError(t, err)
 
-	t.Run("list with token", func(t *testing.T) {
-		out1, token, err := service.ListHealthCheckConfigs(ctx, 1, "")
-		require.NoError(t, err)
-		require.NotEmpty(t, token)
-		require.Len(t, out1, 1)
-		out2, token, err := service.ListHealthCheckConfigs(ctx, 1, token)
-		require.NoError(t, err)
-		require.Empty(t, token)
-		require.Len(t, out2, 1)
+				pageSize := teleport.VirtualDefaultHealthCheckConfigCount
+				page1, token, err := svc.ListHealthCheckConfigs(ctx, pageSize, "")
+				require.NoError(t, err)
+				require.Len(t, page1, pageSize)
+				require.NotEmpty(t, token)
 
-		combined := append(out1, out2...)
-		require.Contains(t, combined, cfg1)
-		require.Contains(t, combined, cfg2)
-	})
+				page2, token2, err := svc.ListHealthCheckConfigs(ctx, pageSize, token)
+				require.NoError(t, err)
+				require.Len(t, page2, 1)
+				require.Empty(t, token2)
+				require.Empty(t, cmp.Diff(
+					services.VirtualDefaultHealthCheckConfigKube(),
+					page2[0], protocmp.Transform()))
+			},
+		},
+		{
+			name: "list virtual defaults not persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				out, _, err := svc.ListHealthCheckConfigs(ctx, 10, "")
+				require.NoError(t, err)
+				require.Len(t, out, teleport.VirtualDefaultHealthCheckConfigCount)
+				require.True(t, slices.IsSortedFunc(out, func(a, b *healthcheckconfigv1.HealthCheckConfig) int {
+					return strings.Compare(a.GetMetadata().GetName(), b.GetMetadata().GetName())
+				}), "expected virtual defaults to be sorted")
+				requireEqualHealthCheckConfigs(t, out, newHealthCfgDefaults(t)...)
+			},
+		},
+		{
+			name: "update",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				cfg1, err := svc.CreateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
 
-	t.Run("get and update", func(t *testing.T) {
-		out, err := service.GetHealthCheckConfig(ctx, cfg1.Metadata.Name)
-		require.NoError(t, err)
-		require.Equal(t, out, cfg1)
+				cfg1.Spec.HealthyThreshold = 3
+				cfgUpd, err := svc.UpdateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
+				require.Equal(t, cfg1.Spec.HealthyThreshold, cfgUpd.Spec.HealthyThreshold)
 
-		out.Spec.HealthyThreshold = 3
-		out, err = service.UpdateHealthCheckConfig(ctx, out)
-		require.NoError(t, err)
-		require.Equal(t, uint32(3), out.Spec.HealthyThreshold)
-	})
+				cfgGet, err := svc.GetHealthCheckConfig(ctx, cfg1.GetMetadata().GetName())
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff(cfgUpd, cfgGet, protocmp.Transform()))
 
-	t.Run("delete not found", func(t *testing.T) {
-		err := service.DeleteHealthCheckConfig(ctx, "asdf")
-		require.IsType(t, trace.NotFound(""), err)
-	})
+				cfgGet.Spec.HealthyThreshold = 9
+				cfgUpd2, err := svc.UpdateHealthCheckConfig(ctx, cfgGet)
+				require.NoError(t, err)
+				require.Equal(t, cfgGet.Spec.HealthyThreshold, cfgUpd2.Spec.HealthyThreshold)
+			},
+		},
+		{
+			name: "update virtual defaults not persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, name := range healthCfgDefaultNames {
+					t.Run(name, func(t *testing.T) {
+						// Get a virtual default which hasn't been written to the backend,
+						// then update.
+						cfg, err := svc.GetHealthCheckConfig(ctx, name)
+						require.NoError(t, err)
+						cfg.Spec.Match.Disabled = true
+						out, err := svc.UpdateHealthCheckConfig(ctx, cfg)
+						require.NoError(t, err)
+						require.Equal(t, cfg.Spec.Match.Disabled, out.Spec.Match.Disabled)
+					})
+				}
+			},
+		},
+		{
+			name: "update virtual defaults persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, cfg := range newHealthCfgDefaults(t) {
+					t.Run(cfg.GetMetadata().GetName(), func(t *testing.T) {
+						// Write a virtual default to the backend,
+						// then update.
+						cfgCrt, err := svc.CreateHealthCheckConfig(ctx, cfg)
+						require.NoError(t, err)
+						cfgCrt.Spec.Match.Disabled = true
+						out, err := svc.UpdateHealthCheckConfig(ctx, cfgCrt)
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfgCrt, out, protocmp.Transform()))
+					})
+				}
+			},
+		},
+		{
+			name: "upsert",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				cfgUps, err := svc.UpsertHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff(cfgUps, cfg1, protocmp.Transform()))
 
-	t.Run("delete", func(t *testing.T) {
-		require.NoError(t, service.DeleteHealthCheckConfig(ctx, cfg1.Metadata.Name))
-	})
+				cfgGet, err := svc.GetHealthCheckConfig(ctx, cfgUps.GetMetadata().GetName())
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff(cfgUps, cfgGet, protocmp.Transform()))
 
-	t.Run("upsert", func(t *testing.T) {
-		cfg3 := newHealthCheckConfig(t, "cfg3")
-		_, err := service.UpsertHealthCheckConfig(ctx, cfg3)
-		require.NoError(t, err)
+				cfgGet.Spec.HealthyThreshold = 9
+				out, err := svc.UpsertHealthCheckConfig(ctx, cfgGet)
+				require.NoError(t, err)
+				require.Empty(t, cmp.Diff(cfgGet, out, protocmp.Transform()))
+			},
+		},
+		{
+			name: "upsert virtual defaults",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, cfg := range newHealthCfgDefaults(t) {
+					t.Run(cfg.GetMetadata().GetName(), func(t *testing.T) {
+						cfgUps, err := svc.UpsertHealthCheckConfig(ctx, cfg)
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfgUps, cfg, protocmp.Transform()))
 
-		out, _, err := service.ListHealthCheckConfigs(ctx, 10, "")
-		require.NoError(t, err)
-		requireEqualHealthCheckConfigs(t, out, cfg2, cfg3)
-	})
+						cfgGet, err := svc.GetHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfgUps, cfgGet, protocmp.Transform()))
 
-	t.Run("delete all", func(t *testing.T) {
-		require.NoError(t, service.DeleteAllHealthCheckConfigs(ctx))
-		out, _, err := service.ListHealthCheckConfigs(ctx, 10, "")
-		require.NoError(t, err)
-		require.Empty(t, out)
+						cfgGet.Spec.Match.Disabled = true
+						out, err := svc.UpsertHealthCheckConfig(ctx, cfgGet)
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfgGet, out, protocmp.Transform()))
+					})
+				}
+			},
+		},
+		{
+			name: "delete",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				cfg1 := newHealthCfg(t, "cfg1")
+				_, err := svc.CreateHealthCheckConfig(ctx, cfg1)
+				require.NoError(t, err)
+
+				err = svc.DeleteHealthCheckConfig(ctx, cfg1.GetMetadata().GetName())
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "delete not found",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				err := svc.DeleteHealthCheckConfig(ctx, "not-found")
+				require.True(t, trace.IsNotFound(err))
+			},
+		},
+		{
+			name: "delete virtual defaults not persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, cfg := range newHealthCfgDefaults(t) {
+					t.Run(cfg.GetMetadata().GetName(), func(t *testing.T) {
+						// Delete a virtual default which hasn't been written to the backend,
+						// then get the new virtual default which is unwritten to the backend.
+						err := svc.DeleteHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
+						require.NoError(t, err)
+
+						out, err := svc.GetHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
+						require.NoError(t, err)
+						require.Empty(t, cmp.Diff(cfg, out, protocmp.Transform()))
+					})
+				}
+			},
+		},
+		{
+			name: "delete virtual defaults persisted",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				for _, cfg := range newHealthCfgDefaults(t) {
+					t.Run(cfg.GetMetadata().GetName(), func(t *testing.T) {
+						// Write a virtual default to the backend, then delete,
+						// then get the new virtual default which is unwritten to the backend.
+						_, err := svc.CreateHealthCheckConfig(ctx, cfg)
+						require.NoError(t, err)
+
+						err = svc.DeleteHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
+						require.NoError(t, err)
+
+						out, err := svc.GetHealthCheckConfig(ctx, cfg.GetMetadata().GetName())
+						require.NoError(t, err)
+						requireEqualHealthCfg(t, cfg, out)
+					})
+				}
+			},
+		},
+		{
+			name: "delete all",
+			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
+				_, err := svc.CreateHealthCheckConfig(ctx, newHealthCfg(t, "cfg1"))
+				require.NoError(t, err)
+				_, err = svc.CreateHealthCheckConfig(ctx, newHealthCfg(t, "cfg2"))
+				require.NoError(t, err)
+				_, err = svc.CreateHealthCheckConfig(ctx, newHealthCfg(t, "cfg3"))
+				require.NoError(t, err)
+
+				err = svc.DeleteAllHealthCheckConfigs(ctx)
+				require.NoError(t, err)
+
+				out, _, err := svc.ListHealthCheckConfigs(ctx, 10, "")
+				require.NoError(t, err)
+				require.Len(t, out, teleport.VirtualDefaultHealthCheckConfigCount)
+				requireEqualHealthCheckConfigs(t, out, newHealthCfgDefaults(t)...)
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			tt.run(t, ctx, newHealthSvc(t, ctx))
+		})
+	}
+}
+
+func newHealthSvc(t *testing.T, ctx context.Context) *HealthCheckConfigService {
+	t.Helper()
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		mem.Close()
 	})
+	svc, err := NewHealthCheckConfigService(backend.NewSanitizer(mem))
+	require.NoError(t, err)
+	return svc
 }
 
-func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
+func newHealthCfg(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	cfg, err := healthcheckconfig.NewHealthCheckConfig(name,
 		&healthcheckconfigv1.HealthCheckConfigSpec{
@@ -147,19 +408,6 @@ func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.Health
 	return cfg
 }
 
-func requireEqualHealthCheckConfigs(t *testing.T, got []*healthcheckconfigv1.HealthCheckConfig, want ...*healthcheckconfigv1.HealthCheckConfig) {
-	t.Helper()
-	cmpByName := func(a, b *healthcheckconfigv1.HealthCheckConfig) int {
-		return strings.Compare(a.Metadata.GetName(), b.Metadata.GetName())
-	}
-	require.Empty(t, cmp.Diff(
-		slices.SortedFunc(slices.Values(want), cmpByName),
-		slices.SortedFunc(slices.Values(got), cmpByName),
-		protocmp.Transform(),
-		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
-	))
-}
-
 func TestHealthCheckConfigParser(t *testing.T) {
 	t.Parallel()
 	parser := newHealthCheckConfigParser()
@@ -174,7 +422,34 @@ func TestHealthCheckConfigParser(t *testing.T) {
 		resource, err := parser.parse(event)
 		require.NoError(t, err)
 		require.Equal(t, "example", resource.GetMetadata().Name)
+		require.Equal(t, types.KindHealthCheckConfig, resource.GetKind())
 	})
+
+	t.Run("delete virtual default returns override error", func(t *testing.T) {
+		for _, name := range healthCfgDefaultNames {
+			t.Run(name, func(t *testing.T) {
+				event := backend.Event{
+					Type: types.OpDelete,
+					Item: backend.Item{
+						Key: backend.NewKey(healthCheckConfigPrefix, name),
+					},
+				}
+
+				require.True(t, parser.match(event.Item.Key))
+
+				_, err := parser.parse(event)
+
+				var overrideErr parseEventOverrideError
+				require.ErrorAs(t, err, &overrideErr,
+					"deleting virtual default should return parseEventOverrideError")
+				require.Len(t, overrideErr, 1)
+				require.Equal(t, types.OpPut, overrideErr[0].Type)
+				require.Equal(t, name, overrideErr[0].Resource.GetName())
+				require.Equal(t, types.KindHealthCheckConfig, overrideErr[0].Resource.GetKind())
+			})
+		}
+	})
+
 	t.Run("put", func(t *testing.T) {
 		event := backend.Event{
 			Type: types.OpPut,
@@ -211,5 +486,61 @@ func TestHealthCheckConfigParser(t *testing.T) {
 		resource, err := parser.parse(event)
 		require.NoError(t, err)
 		require.Equal(t, "example", resource.GetMetadata().Name)
+		require.Equal(t, types.KindHealthCheckConfig, resource.GetKind())
 	})
+
+}
+
+func newHealthCfgDefaults(t *testing.T) []*healthcheckconfigv1.HealthCheckConfig {
+	t.Helper()
+	return []*healthcheckconfigv1.HealthCheckConfig{
+		services.VirtualDefaultHealthCheckConfigDB(),
+		services.VirtualDefaultHealthCheckConfigKube(),
+	}
+}
+
+func newHealthCfgDefaultsMap(t *testing.T) map[string]*healthcheckconfigv1.HealthCheckConfig {
+	t.Helper()
+	return map[string]*healthcheckconfigv1.HealthCheckConfig{
+		teleport.VirtualDefaultHealthCheckConfigDBName:   services.VirtualDefaultHealthCheckConfigDB(),
+		teleport.VirtualDefaultHealthCheckConfigKubeName: services.VirtualDefaultHealthCheckConfigKube(),
+	}
 }
+
+func requireEqualHealthCfg(t *testing.T, expect *healthcheckconfigv1.HealthCheckConfig, actual *healthcheckconfigv1.HealthCheckConfig) {
+	t.Helper()
+	require.Empty(t, cmp.Diff(expect, actual,
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+	))
+}
+
+func requireEqualHealthCheckConfigs(t *testing.T, got []*healthcheckconfigv1.HealthCheckConfig, want ...*healthcheckconfigv1.HealthCheckConfig) {
+	t.Helper()
+	require.Empty(t,
+		cmp.Diff(want, got,
+			cmpopts.SortSlices(func(a, b *healthcheckconfigv1.HealthCheckConfig) bool {
+				return a.GetMetadata().GetName() < b.GetMetadata().GetName()
+			}),
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		),
+	)
+}
+
+func requireContainsHealthCheckConfigs(t *testing.T, actual []*healthcheckconfigv1.HealthCheckConfig, expected ...*healthcheckconfigv1.HealthCheckConfig) {
+	t.Helper()
+	for _, exp := range expected {
+		found := slices.ContainsFunc(actual, func(cfg *healthcheckconfigv1.HealthCheckConfig) bool {
+			return cmp.Equal(exp, cfg, protocmp.Transform())
+		})
+		require.True(t, found, "config %q not found in list", exp.GetMetadata().GetName())
+	}
+}
+
+var (
+	healthCfgDefaultNames = []string{
+		teleport.VirtualDefaultHealthCheckConfigDBName,
+		teleport.VirtualDefaultHealthCheckConfigKubeName,
+	}
+)
diff --git a/lib/services/local/identitycenter.go b/lib/services/local/identitycenter.go
index fb3713ce67b22..625abd4e80957 100644
--- a/lib/services/local/identitycenter.go
+++ b/lib/services/local/identitycenter.go
@@ -21,7 +21,6 @@ import (
 	"log/slog"
 
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
@@ -29,7 +28,6 @@ import (
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 const (
@@ -72,7 +70,6 @@ func (cfg *IdentityCenterServiceConfig) CheckAndSetDefaults() error {
 // IdentityCenterService handles low-level CRUD operations for the identity-
 // center related resources
 type IdentityCenterService struct {
-	identitycenterv1.UnimplementedIdentityCenterServiceServer
 	accounts             *generic.ServiceWrapper[*identitycenterv1.Account]
 	permissionSets       *generic.ServiceWrapper[*identitycenterv1.PermissionSet]
 	principalAssignments *generic.ServiceWrapper[*identitycenterv1.PrincipalAssignment]
@@ -96,6 +93,7 @@ func NewIdentityCenterService(cfg IdentityCenterServiceConfig) (*IdentityCenterS
 		BackendPrefix: backend.NewKey(awsResourcePrefix, awsAccountPrefix),
 		MarshalFunc:   services.MarshalProtoResource[*identitycenterv1.Account],
 		UnmarshalFunc: services.UnmarshalProtoResource[*identitycenterv1.Account],
+		PageLimit:     identityCenterPageSize,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating accounts service")
@@ -107,6 +105,7 @@ func NewIdentityCenterService(cfg IdentityCenterServiceConfig) (*IdentityCenterS
 		BackendPrefix: backend.NewKey(awsResourcePrefix, awsPermissionSetPrefix),
 		MarshalFunc:   services.MarshalProtoResource[*identitycenterv1.PermissionSet],
 		UnmarshalFunc: services.UnmarshalProtoResource[*identitycenterv1.PermissionSet],
+		PageLimit:     identityCenterPageSize,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating permission sets service")
@@ -118,6 +117,7 @@ func NewIdentityCenterService(cfg IdentityCenterServiceConfig) (*IdentityCenterS
 		BackendPrefix: backend.NewKey(awsResourcePrefix, awsPrincipalAssignmentPrefix),
 		MarshalFunc:   services.MarshalProtoResource[*identitycenterv1.PrincipalAssignment],
 		UnmarshalFunc: services.UnmarshalProtoResource[*identitycenterv1.PrincipalAssignment],
+		PageLimit:     identityCenterPageSize,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating principal assignments service")
@@ -129,6 +129,7 @@ func NewIdentityCenterService(cfg IdentityCenterServiceConfig) (*IdentityCenterS
 		BackendPrefix: backend.NewKey(awsResourcePrefix, awsAccountAssignmentPrefix),
 		MarshalFunc:   services.MarshalProtoResource[*identitycenterv1.AccountAssignment],
 		UnmarshalFunc: services.UnmarshalProtoResource[*identitycenterv1.AccountAssignment],
+		PageLimit:     identityCenterPageSize,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating account assignments service")
@@ -146,67 +147,83 @@ func NewIdentityCenterService(cfg IdentityCenterServiceConfig) (*IdentityCenterS
 
 // ListIdentityCenterAccounts provides a paged list of all AWS accounts known
 // to the Identity Center integration
-func (svc *IdentityCenterService) ListIdentityCenterAccounts(ctx context.Context, pageSize int, page *pagination.PageRequestToken) ([]services.IdentityCenterAccount, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = identityCenterPageSize
-	}
-
-	pageToken, err := page.Consume()
+func (svc *IdentityCenterService) ListIdentityCenterAccounts(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.Account, string, error) {
+	accounts, nextPage, err := svc.ListIdentityCenterAccounts2(ctx, pageSize, pageToken)
 	if err != nil {
-		return nil, "", trace.Wrap(err, "listing identity center assignment records")
+		return nil, "", trace.Wrap(err)
 	}
 
+	return accounts, nextPage, nil
+}
+
+// ListIdentityCenterAccounts2 provides a paged list of all AWS accounts known
+// to the Identity Center integration
+func (svc *IdentityCenterService) ListIdentityCenterAccounts2(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.Account, string, error) {
 	accounts, nextPage, err := svc.accounts.ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing identity center assignment records")
 	}
 
-	result := make([]services.IdentityCenterAccount, len(accounts))
-	for i, acct := range accounts {
-		result[i] = services.IdentityCenterAccount{Account: acct}
-	}
-
-	return result, pagination.NextPageToken(nextPage), nil
+	return accounts, nextPage, nil
 }
 
 // CreateIdentityCenterAccount creates a new Identity Center Account record
-func (svc *IdentityCenterService) CreateIdentityCenterAccount(ctx context.Context, acct services.IdentityCenterAccount) (services.IdentityCenterAccount, error) {
-	created, err := svc.accounts.CreateResource(ctx, acct.Account)
+func (svc *IdentityCenterService) CreateIdentityCenterAccount(ctx context.Context, acct *identitycenterv1.Account) (*identitycenterv1.Account, error) {
+	created, err := svc.CreateIdentityCenterAccount2(ctx, acct)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err, "creating identity center account")
+		return nil, trace.Wrap(err)
 	}
-	return services.IdentityCenterAccount{Account: created}, nil
+	return created, nil
+}
+
+// CreateIdentityCenterAccount2 creates a new Identity Center Account record
+func (svc *IdentityCenterService) CreateIdentityCenterAccount2(ctx context.Context, acct *identitycenterv1.Account) (*identitycenterv1.Account, error) {
+	created, err := svc.accounts.CreateResource(ctx, acct)
+	if err != nil {
+		return nil, trace.Wrap(err, "creating identity center account")
+	}
+	return created, nil
 }
 
 // GetIdentityCenterAccount fetches a specific Identity Center Account
-func (svc *IdentityCenterService) GetIdentityCenterAccount(ctx context.Context, name services.IdentityCenterAccountID) (services.IdentityCenterAccount, error) {
-	acct, err := svc.accounts.GetResource(ctx, string(name))
+func (svc *IdentityCenterService) GetIdentityCenterAccount(ctx context.Context, name string) (*identitycenterv1.Account, error) {
+	acct, err := svc.accounts.GetResource(ctx, name)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err, "fetching identity center account")
+		return nil, trace.Wrap(err, "fetching identity center account")
 	}
-	return services.IdentityCenterAccount{Account: acct}, nil
+	return acct, nil
 }
 
 // UpdateIdentityCenterAccount performs a conditional update on an Identity
 // Center Account record, returning the updated record on success.
-func (svc *IdentityCenterService) UpdateIdentityCenterAccount(ctx context.Context, acct services.IdentityCenterAccount) (services.IdentityCenterAccount, error) {
-	updated, err := svc.accounts.ConditionalUpdateResource(ctx, acct.Account)
+func (svc *IdentityCenterService) UpdateIdentityCenterAccount(ctx context.Context, acct *identitycenterv1.Account) (*identitycenterv1.Account, error) {
+	updated, err := svc.UpdateIdentityCenterAccount2(ctx, acct)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err, "updating identity center account record")
+		return nil, trace.Wrap(err)
+	}
+	return updated, nil
+}
+
+// UpdateIdentityCenterAccount2 performs a conditional update on an Identity
+// Center Account record, returning the updated record on success.
+func (svc *IdentityCenterService) UpdateIdentityCenterAccount2(ctx context.Context, acct *identitycenterv1.Account) (*identitycenterv1.Account, error) {
+	updated, err := svc.accounts.ConditionalUpdateResource(ctx, acct)
+	if err != nil {
+		return nil, trace.Wrap(err, "updating identity center account record")
 	}
-	return services.IdentityCenterAccount{Account: updated}, nil
+	return updated, nil
 }
 
 // UpsertIdentityCenterAccount performs an *unconditional* upsert on an
 // Identity Center Account record, returning the updated record on success.
 // Be careful when mixing UpsertIdentityCenterAccount() with resources
 // protected by optimistic locking
-func (svc *IdentityCenterService) UpsertIdentityCenterAccount(ctx context.Context, acct services.IdentityCenterAccount) (services.IdentityCenterAccount, error) {
-	updated, err := svc.accounts.UpsertResource(ctx, acct.Account)
+func (svc *IdentityCenterService) UpsertIdentityCenterAccount(ctx context.Context, acct *identitycenterv1.Account) (*identitycenterv1.Account, error) {
+	updated, err := svc.accounts.UpsertResource(ctx, acct)
 	if err != nil {
-		return services.IdentityCenterAccount{}, trace.Wrap(err, "upserting identity center account record")
+		return nil, trace.Wrap(err, "upserting identity center account record")
 	}
-	return services.IdentityCenterAccount{Account: updated}, nil
+	return updated, nil
 }
 
 // DeleteIdentityCenterAccount deletes an Identity Center Account record
@@ -215,26 +232,26 @@ func (svc *IdentityCenterService) DeleteIdentityCenterAccount(ctx context.Contex
 }
 
 // DeleteAllIdentityCenterAccounts deletes all Identity Center Account records
-func (svc *IdentityCenterService) DeleteAllIdentityCenterAccounts(ctx context.Context, req *identitycenterv1.DeleteAllIdentityCenterAccountsRequest) (*emptypb.Empty, error) {
-	return &emptypb.Empty{}, trace.Wrap(svc.accounts.DeleteAllResources(ctx))
+func (svc *IdentityCenterService) DeleteAllIdentityCenterAccounts(ctx context.Context) error {
+	return trace.Wrap(svc.accounts.DeleteAllResources(ctx))
 }
 
-// ListPrincipalAssignments lists all PrincipalAssignment records in the service
-func (svc *IdentityCenterService) ListPrincipalAssignments(ctx context.Context, pageSize int, page *pagination.PageRequestToken) ([]*identitycenterv1.PrincipalAssignment, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = identityCenterPageSize
-	}
-
-	pageToken, err := page.Consume()
+// ListPrincipalAssignments lists a page of PrincipalAssignment records in the service.
+func (svc *IdentityCenterService) ListPrincipalAssignments(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PrincipalAssignment, string, error) {
+	resp, nextPage, err := svc.ListPrincipalAssignments2(ctx, pageSize, pageToken)
 	if err != nil {
-		return nil, "", trace.Wrap(err, "extracting page token")
+		return nil, "", trace.Wrap(err)
 	}
+	return resp, nextPage, nil
+}
 
+// ListPrincipalAssignments2 lists a page of PrincipalAssignment records in the service.
+func (svc *IdentityCenterService) ListPrincipalAssignments2(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PrincipalAssignment, string, error) {
 	resp, nextPage, err := svc.principalAssignments.ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing identity center assignment records")
 	}
-	return resp, pagination.NextPageToken(nextPage), nil
+	return resp, nextPage, nil
 }
 
 // CreatePrincipalAssignment creates a new Principal Assignment record in the
@@ -283,24 +300,27 @@ func (svc *IdentityCenterService) DeletePrincipalAssignment(ctx context.Context,
 }
 
 // DeleteAllPrincipalAssignments deletes all assignment record
-func (svc *IdentityCenterService) DeleteAllPrincipalAssignments(ctx context.Context, req *identitycenterv1.DeleteAllPrincipalAssignmentsRequest) (*emptypb.Empty, error) {
-	return &emptypb.Empty{}, trace.Wrap(svc.principalAssignments.DeleteAllResources(ctx))
+func (svc *IdentityCenterService) DeleteAllPrincipalAssignments(ctx context.Context) error {
+	return trace.Wrap(svc.principalAssignments.DeleteAllResources(ctx))
 }
 
-// ListPermissionSets list the known Permission Sets in the managed Identity Center
-func (svc *IdentityCenterService) ListPermissionSets(ctx context.Context, pageSize int, page *pagination.PageRequestToken) ([]*identitycenterv1.PermissionSet, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = identityCenterPageSize
-	}
-	pageToken, err := page.Consume()
+// ListPermissionSets returns a page of known Permission Sets in the managed Identity Center
+func (svc *IdentityCenterService) ListPermissionSets(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PermissionSet, string, error) {
+	resp, nextPage, err := svc.ListPermissionSets2(ctx, pageSize, pageToken)
 	if err != nil {
-		return nil, "", trace.Wrap(err, "extracting page token")
+		return nil, "", trace.Wrap(err, "listing identity center permission set records")
 	}
+	return resp, nextPage, nil
+}
+
+// ListPermissionSets2 returns a page of known Permission Sets in the managed Identity Center
+func (svc *IdentityCenterService) ListPermissionSets2(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.PermissionSet, string, error) {
+
 	resp, nextPage, err := svc.permissionSets.ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing identity center permission set records")
 	}
-	return resp, pagination.NextPageToken(nextPage), nil
+	return resp, nextPage, nil
 }
 
 // CreatePermissionSet creates a new PermissionSet record based on the supplied
@@ -338,71 +358,88 @@ func (svc *IdentityCenterService) DeletePermissionSet(ctx context.Context, name
 }
 
 // DeleteAllPermissionSets deletes all Identity Center PermissionSet
-func (svc *IdentityCenterService) DeleteAllPermissionSets(ctx context.Context, req *identitycenterv1.DeleteAllPermissionSetsRequest) (*emptypb.Empty, error) {
-	return &emptypb.Empty{}, trace.Wrap(svc.permissionSets.DeleteAllResources(ctx))
+func (svc *IdentityCenterService) DeleteAllPermissionSets(ctx context.Context) error {
+	return trace.Wrap(svc.permissionSets.DeleteAllResources(ctx))
 }
 
-// ListAccountAssignments lists all IdentityCenterAccountAssignment record
-// known to the service
-func (svc *IdentityCenterService) ListAccountAssignments(ctx context.Context, pageSize int, page *pagination.PageRequestToken) ([]services.IdentityCenterAccountAssignment, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = identityCenterPageSize
-	}
-	pageToken, err := page.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err, "extracting page token")
-	}
+// ListIdentityCenterAccountAssignments returns a page of IdentityCenterAccountAssignment records.
+func (svc *IdentityCenterService) ListIdentityCenterAccountAssignments(ctx context.Context, pageSize int, pageToken string) ([]*identitycenterv1.AccountAssignment, string, error) {
 	assignments, nextPage, err := svc.accountAssignments.ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing identity center assignment records")
 	}
 
-	result := make([]services.IdentityCenterAccountAssignment, len(assignments))
-	for i, asmt := range assignments {
-		result[i] = services.IdentityCenterAccountAssignment{AccountAssignment: asmt}
-	}
-
-	return result, pagination.NextPageToken(nextPage), nil
+	return assignments, nextPage, nil
 }
 
 // CreateAccountAssignment creates a new Account Assignment record in
 // the service from the supplied in-memory representation. Returns the
 // created record on success.
 func (svc *IdentityCenterService) CreateAccountAssignment(ctx context.Context, asmt services.IdentityCenterAccountAssignment) (services.IdentityCenterAccountAssignment, error) {
-	created, err := svc.accountAssignments.CreateResource(ctx, asmt.AccountAssignment)
+	created, err := svc.CreateIdentityCenterAccountAssignment(ctx, asmt.AccountAssignment)
 	if err != nil {
-		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err, "creating principal assignment")
+		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err)
 	}
 	return services.IdentityCenterAccountAssignment{AccountAssignment: created}, nil
 }
 
+// CreateIdentityCenterAccountAssignment creates a new Account Assignment record in
+// the service from the supplied in-memory representation. Returns the
+// created record on success.
+func (svc *IdentityCenterService) CreateIdentityCenterAccountAssignment(ctx context.Context, asmt *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error) {
+	created, err := svc.accountAssignments.CreateResource(ctx, asmt)
+	if err != nil {
+		return nil, trace.Wrap(err, "creating principal assignment")
+	}
+	return created, nil
+}
+
 // GetAccountAssignment fetches a specific Account Assignment record.
 func (svc *IdentityCenterService) GetAccountAssignment(ctx context.Context, name services.IdentityCenterAccountAssignmentID) (services.IdentityCenterAccountAssignment, error) {
-	asmt, err := svc.accountAssignments.GetResource(ctx, string(name))
+	asmt, err := svc.GetIdentityCenterAccountAssignment(ctx, string(name))
 	if err != nil {
-		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err, "fetching principal assignment")
+		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err)
 	}
 	return services.IdentityCenterAccountAssignment{AccountAssignment: asmt}, nil
 }
 
+// GetIdentityCenterAccountAssignment fetches a specific Account Assignment record.
+func (svc *IdentityCenterService) GetIdentityCenterAccountAssignment(ctx context.Context, name string) (*identitycenterv1.AccountAssignment, error) {
+	asmt, err := svc.accountAssignments.GetResource(ctx, name)
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching principal assignment")
+	}
+	return asmt, nil
+}
+
 // UpdateAccountAssignment performs a conditional update on the supplied
 // Account Assignment, returning the updated record on success.
 func (svc *IdentityCenterService) UpdateAccountAssignment(ctx context.Context, asmt services.IdentityCenterAccountAssignment) (services.IdentityCenterAccountAssignment, error) {
-	updated, err := svc.accountAssignments.ConditionalUpdateResource(ctx, asmt.AccountAssignment)
+	updated, err := svc.UpdateIdentityCenterAccountAssignment(ctx, asmt.AccountAssignment)
 	if err != nil {
-		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err, "updating principal assignment record")
+		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err)
 	}
 	return services.IdentityCenterAccountAssignment{AccountAssignment: updated}, nil
 }
 
+// UpdateIdentityCenterAccountAssignment performs a conditional update on the supplied
+// Account Assignment, returning the updated record on success.
+func (svc *IdentityCenterService) UpdateIdentityCenterAccountAssignment(ctx context.Context, asmt *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error) {
+	updated, err := svc.accountAssignments.ConditionalUpdateResource(ctx, asmt)
+	if err != nil {
+		return nil, trace.Wrap(err, "updating principal assignment record")
+	}
+	return updated, nil
+}
+
 // UpsertAccountAssignment performs an unconditional upsert on the supplied
 // Account Assignment, returning the updated record on success.
-func (svc *IdentityCenterService) UpsertAccountAssignment(ctx context.Context, asmt services.IdentityCenterAccountAssignment) (services.IdentityCenterAccountAssignment, error) {
-	updated, err := svc.accountAssignments.UpsertResource(ctx, asmt.AccountAssignment)
+func (svc *IdentityCenterService) UpsertAccountAssignment(ctx context.Context, asmt *identitycenterv1.AccountAssignment) (*identitycenterv1.AccountAssignment, error) {
+	updated, err := svc.accountAssignments.UpsertResource(ctx, asmt)
 	if err != nil {
-		return services.IdentityCenterAccountAssignment{}, trace.Wrap(err, "upserting principal assignment record")
+		return nil, trace.Wrap(err, "upserting principal assignment record")
 	}
-	return services.IdentityCenterAccountAssignment{AccountAssignment: updated}, nil
+	return updated, nil
 }
 
 // DeleteAccountAssignment deletes a specific account assignment
@@ -411,6 +448,6 @@ func (svc *IdentityCenterService) DeleteAccountAssignment(ctx context.Context, n
 }
 
 // DeleteAllAccountAssignments deletes all known account assignments
-func (svc *IdentityCenterService) DeleteAllAccountAssignments(ctx context.Context, req *identitycenterv1.DeleteAllAccountAssignmentsRequest) (*emptypb.Empty, error) {
-	return &emptypb.Empty{}, trace.Wrap(svc.accountAssignments.DeleteAllResources(ctx))
+func (svc *IdentityCenterService) DeleteAllAccountAssignments(ctx context.Context) error {
+	return trace.Wrap(svc.accountAssignments.DeleteAllResources(ctx))
 }
diff --git a/lib/services/local/identitycenter_test.go b/lib/services/local/identitycenter_test.go
index 0a2c085fa76ce..b42fcc2c0e058 100644
--- a/lib/services/local/identitycenter_test.go
+++ b/lib/services/local/identitycenter_test.go
@@ -24,27 +24,25 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/types/known/emptypb"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
 )
 
 func newTestBackend(t *testing.T, ctx context.Context, clock clockwork.Clock) backend.Backend {
 	t.Helper()
-	sqliteBackend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	bk, err := memory.New(memory.Config{
 		Clock: clock,
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.NoError(t, sqliteBackend.Close())
+		require.NoError(t, bk.Close())
 	})
-	return sqliteBackend
+	return bk
 }
 
 func TestIdentityCenterResourceCRUD(t *testing.T) {
@@ -58,7 +56,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 		getResource        func(context.Context, services.IdentityCenter, string) (types.Resource153, error)
 		updateResource     func(context.Context, services.IdentityCenter, types.Resource153) (types.Resource153, error)
 		upsertResource     func(context.Context, services.IdentityCenter, types.Resource153) (types.Resource153, error)
-		deleteAllResources func(context.Context, services.IdentityCenter) (*emptypb.Empty, error)
+		deleteAllResources func(context.Context, services.IdentityCenter) error
 	}{
 		{
 			name: "Account",
@@ -66,18 +64,18 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				return makeTestIdentityCenterAccount(subtestT, subtestCtx, svc, id)
 			},
 			getResource: func(subtestCtx context.Context, svc services.IdentityCenter, id string) (types.Resource153, error) {
-				return svc.GetIdentityCenterAccount(subtestCtx, services.IdentityCenterAccountID(id))
+				return svc.GetIdentityCenterAccount(subtestCtx, id)
 			},
 			updateResource: func(subtestCtx context.Context, svc services.IdentityCenter, r types.Resource153) (types.Resource153, error) {
-				acct := r.(services.IdentityCenterAccount)
-				return svc.UpdateIdentityCenterAccount(subtestCtx, acct)
+				acct := r.(*identitycenterv1.Account)
+				return svc.UpdateIdentityCenterAccount2(subtestCtx, acct)
 			},
 			upsertResource: func(subtestCtx context.Context, svc services.IdentityCenter, r types.Resource153) (types.Resource153, error) {
-				acct := r.(services.IdentityCenterAccount)
+				acct := r.(*identitycenterv1.Account)
 				return svc.UpsertIdentityCenterAccount(subtestCtx, acct)
 			},
-			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) (*emptypb.Empty, error) {
-				return svc.DeleteAllIdentityCenterAccounts(subtestCtx, &identitycenterv1.DeleteAllIdentityCenterAccountsRequest{})
+			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) error {
+				return svc.DeleteAllIdentityCenterAccounts(subtestCtx)
 			},
 		},
 		{
@@ -92,8 +90,8 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				ps := r.(*identitycenterv1.PermissionSet)
 				return svc.UpdatePermissionSet(subtestCtx, ps)
 			},
-			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) (*emptypb.Empty, error) {
-				return svc.DeleteAllPermissionSets(subtestCtx, &identitycenterv1.DeleteAllPermissionSetsRequest{})
+			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) error {
+				return svc.DeleteAllPermissionSets(subtestCtx)
 			},
 		},
 		{
@@ -102,18 +100,18 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				return makeTestIdentityCenterAccountAssignment(subtestT, subtestCtx, svc, id)
 			},
 			getResource: func(subtestCtx context.Context, svc services.IdentityCenter, id string) (types.Resource153, error) {
-				return svc.GetAccountAssignment(subtestCtx, services.IdentityCenterAccountAssignmentID(id))
+				return svc.GetIdentityCenterAccountAssignment(subtestCtx, id)
 			},
 			updateResource: func(subtestCtx context.Context, svc services.IdentityCenter, r types.Resource153) (types.Resource153, error) {
-				asmt := r.(services.IdentityCenterAccountAssignment)
-				return svc.UpdateAccountAssignment(subtestCtx, asmt)
+				asmt := r.(*identitycenterv1.AccountAssignment)
+				return svc.UpdateIdentityCenterAccountAssignment(subtestCtx, asmt)
 			},
 			upsertResource: func(subtestCtx context.Context, svc services.IdentityCenter, r types.Resource153) (types.Resource153, error) {
-				asmt := r.(services.IdentityCenterAccountAssignment)
+				asmt := r.(*identitycenterv1.AccountAssignment)
 				return svc.UpsertAccountAssignment(subtestCtx, asmt)
 			},
-			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) (*emptypb.Empty, error) {
-				return svc.DeleteAllAccountAssignments(subtestCtx, &identitycenterv1.DeleteAllAccountAssignmentsRequest{})
+			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) error {
+				return svc.DeleteAllAccountAssignments(subtestCtx)
 			},
 		},
 		{
@@ -132,8 +130,8 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				asmt := r.(*identitycenterv1.PrincipalAssignment)
 				return svc.UpsertPrincipalAssignment(subtestCtx, asmt)
 			},
-			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) (*emptypb.Empty, error) {
-				return svc.DeleteAllPrincipalAssignments(subtestCtx, &identitycenterv1.DeleteAllPrincipalAssignmentsRequest{})
+			deleteAllResources: func(subtestCtx context.Context, svc services.IdentityCenter) error {
+				return svc.DeleteAllPrincipalAssignments(subtestCtx)
 			},
 		},
 	}
@@ -257,8 +255,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				require.ElementsMatch(t, resourceTestNames, resourceNamesFromBackend)
 
 				// WHEN I attempt to Delete resources
-				_, err = test.deleteAllResources(ctx, uut)
-				require.NoError(t, err)
+				require.NoError(t, test.deleteAllResources(ctx, uut))
 
 				// EXPECT that the backend reflects the resource were deleted.
 				for _, v := range resourceTestNames {
@@ -270,22 +267,20 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 	}
 }
 
-func makeTestIdentityCenterAccount(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) services.IdentityCenterAccount {
+func makeTestIdentityCenterAccount(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) *identitycenterv1.Account {
 	t.Helper()
-	created, err := svc.CreateIdentityCenterAccount(ctx, services.IdentityCenterAccount{
-		Account: &identitycenterv1.Account{
-			Kind:     types.KindIdentityCenterAccount,
-			Version:  types.V1,
-			Metadata: &headerv1.Metadata{Name: id},
-			Spec: &identitycenterv1.AccountSpec{
-				Id:          "aws-account-id-" + id,
-				Arn:         fmt.Sprintf("arn:aws:sso::%s:", id),
-				Description: "Test account " + id,
-				PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
-					{
-						Name: "dummy",
-						Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
-					},
+	created, err := svc.CreateIdentityCenterAccount2(ctx, &identitycenterv1.Account{
+		Kind:     types.KindIdentityCenterAccount,
+		Version:  types.V1,
+		Metadata: &headerv1.Metadata{Name: id},
+		Spec: &identitycenterv1.AccountSpec{
+			Id:          "aws-account-id-" + id,
+			Arn:         fmt.Sprintf("arn:aws:sso::%s:", id),
+			Description: "Test account " + id,
+			PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
+				{
+					Name: "dummy",
+					Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
 				},
 			},
 		},
@@ -310,22 +305,20 @@ func makeTestIdentityCenterPermissionSet(t *testing.T, ctx context.Context, svc
 	return created
 }
 
-func makeTestIdentityCenterAccountAssignment(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) services.IdentityCenterAccountAssignment {
+func makeTestIdentityCenterAccountAssignment(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) *identitycenterv1.AccountAssignment {
 	t.Helper()
-	created, err := svc.CreateAccountAssignment(ctx, services.IdentityCenterAccountAssignment{
-		AccountAssignment: &identitycenterv1.AccountAssignment{
-			Kind:     types.KindIdentityCenterAccountAssignment,
-			Version:  types.V1,
-			Metadata: &headerv1.Metadata{Name: id},
-			Spec: &identitycenterv1.AccountAssignmentSpec{
-				Display: "Some-Permission-set on Some-AWS-account",
-				PermissionSet: &identitycenterv1.PermissionSetInfo{
-					Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
-					Name: "some permission set",
-				},
-				AccountName: "Some Account Name",
-				AccountId:   "some account id",
+	created, err := svc.CreateIdentityCenterAccountAssignment(ctx, &identitycenterv1.AccountAssignment{
+		Kind:     types.KindIdentityCenterAccountAssignment,
+		Version:  types.V1,
+		Metadata: &headerv1.Metadata{Name: id},
+		Spec: &identitycenterv1.AccountAssignmentSpec{
+			Display: "Some-Permission-set on Some-AWS-account",
+			PermissionSet: &identitycenterv1.PermissionSetInfo{
+				Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
+				Name: "some permission set",
 			},
+			AccountName: "Some Account Name",
+			AccountId:   "some account id",
 		},
 	})
 	require.NoError(t, err)
diff --git a/lib/services/local/integrations.go b/lib/services/local/integrations.go
index 8137b3fbbbb77..50c5ade062fb1 100644
--- a/lib/services/local/integrations.go
+++ b/lib/services/local/integrations.go
@@ -153,11 +153,9 @@ func integrationDeletionConditions(ctx context.Context, bk backend.Backend, name
 	}
 	deleteConditionalActions = append(deleteConditionalActions, easDeleteConditions...)
 
-	awsIcDeleteCondition, err := integrationReferencedByAWSICPlugin(ctx, bk, name)
-	if err != nil {
+	if err := integrationReferencedByAWSICPlugin(ctx, bk, name); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	deleteConditionalActions = append(deleteConditionalActions, awsIcDeleteCondition...)
 
 	return deleteConditionalActions, nil
 }
@@ -196,15 +194,12 @@ func integrationReferencedByEAS(ctx context.Context, bk backend.Backend, name st
 }
 
 // integrationReferencedByAWSICPlugin returns an error if the integration name is referenced
-// by an existing AWS Identity Center plugin. In case the AWS Identity Center plugin exists
-// but does not reference this integration, a conditional action is returned with a revision
-// of the plugin to ensure that plugin hasn't changed during deletion of the AWS OIDC integration.
-func integrationReferencedByAWSICPlugin(ctx context.Context, bk backend.Backend, name string) ([]backend.ConditionalAction, error) {
-	var conditionalActions []backend.ConditionalAction
+// by an existing AWS Identity Center plugin.
+func integrationReferencedByAWSICPlugin(ctx context.Context, bk backend.Backend, name string) error {
 	pluginService := NewPluginsService(bk)
 	plugins, err := pluginService.GetPlugins(ctx, false)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
 
 	for _, p := range plugins {
@@ -212,25 +207,19 @@ func integrationReferencedByAWSICPlugin(ctx context.Context, bk backend.Backend,
 		if !ok {
 			continue
 		}
-		if pluginV1.GetType() != types.PluginType(types.PluginTypeAWSIdentityCenter) {
-			continue
-		}
-		if awsIC := pluginV1.Spec.GetAwsIc(); awsIC != nil {
-			switch awsIC.IntegrationName {
-			case name:
-				return nil, trace.BadParameter("cannot delete AWS OIDC integration currently referenced by AWS Identity Center integration %q", pluginV1.GetName())
-			default:
-				conditionalActions = append(conditionalActions, backend.ConditionalAction{
-					Key:       backend.NewKey(pluginsPrefix, name),
-					Action:    backend.Nop(),
-					Condition: backend.Revision(pluginV1.GetRevision()),
-				})
-				return conditionalActions, nil
+		switch pluginV1.GetType() {
+		case types.PluginTypeAWSIdentityCenter:
+			if awsIC := pluginV1.Spec.GetAwsIc(); awsIC != nil {
+				if awsIC.IntegrationName == name {
+					return trace.BadParameter("cannot delete AWS OIDC integration currently referenced by AWS Identity Center integration %q", pluginV1.GetName())
+				}
 			}
+		default:
+			continue
 		}
 	}
 
-	return conditionalActions, nil
+	return nil
 }
 
 // DeleteAllIntegrations removes all Integration resources. This should only be used in a cache.
diff --git a/lib/services/local/inventory.go b/lib/services/local/inventory.go
index 0eba8cadd618b..a0217b8c4ac3a 100644
--- a/lib/services/local/inventory.go
+++ b/lib/services/local/inventory.go
@@ -24,54 +24,58 @@ import (
 	"github.com/gravitational/trace"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/internalutils/stream"
+	apistream "github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
 )
 
 // GetInstances iterates all teleport instances.
-func (s *PresenceService) GetInstances(ctx context.Context, req types.InstanceFilter) stream.Stream[types.Instance] {
-	const pageSize = 1_000
+func (s *PresenceService) GetInstances(ctx context.Context, req types.InstanceFilter) apistream.Stream[types.Instance] {
 	if req.ServerID != "" {
 		instance, err := s.getInstance(ctx, req.ServerID)
 		if err != nil {
 			if trace.IsNotFound(err) {
-				return stream.Empty[types.Instance]()
+				return apistream.Empty[types.Instance]()
 			}
-			return stream.Fail[types.Instance](trace.Wrap(err))
+			return apistream.Fail[types.Instance](trace.Wrap(err))
 		}
 		if !req.Match(instance) {
-			return stream.Empty[types.Instance]()
+			return apistream.Empty[types.Instance]()
 		}
-		return stream.Once(instance)
+		return apistream.Once(instance)
 	}
 
 	startKey := backend.ExactKey(instancePrefix)
 	endKey := backend.RangeEnd(startKey)
-	items := backend.StreamRange(ctx, s, startKey, endKey, pageSize)
-	return stream.FilterMap(items, func(item backend.Item) (types.Instance, bool) {
-		instance, err := generic.FastUnmarshal[*types.InstanceV1](item)
-		if err != nil {
-			s.logger.WarnContext(ctx, "Skipping instance failed to unmarshal",
-				"key", item.Key,
-				"error", err,
-			)
-			return nil, false
-		}
-		if err := instance.CheckAndSetDefaults(); err != nil {
-			s.logger.WarnContext(ctx, "Skipping invalid instance",
-				"key", item.Key,
-				"error", err,
-			)
-			return nil, false
-		}
-		if !req.Match(instance) {
-			return nil, false
-		}
-		return instance, true
-	})
+	return stream.IntoLegacy(stream.FilterMap(
+		s.Backend.Items(
+			ctx,
+			backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+		func(item backend.Item) (types.Instance, bool) {
+			instance, err := generic.FastUnmarshal[*types.InstanceV1](item)
+			if err != nil {
+				return nil, false
+			}
+
+			if err := instance.CheckAndSetDefaults(); err != nil {
+				s.logger.WarnContext(ctx, "Skipping invalid instance",
+					"key", item.Key,
+					"error", err,
+				)
+				return nil, false
+			}
+			if !req.Match(instance) {
+				return nil, false
+			}
+			return instance, true
+		},
+	))
 }
 
 // getInstance gets an instance resource by server ID.
diff --git a/lib/services/local/kube.go b/lib/services/local/kube.go
index 335f8ca3952ca..381e8a72baf9d 100644
--- a/lib/services/local/kube.go
+++ b/lib/services/local/kube.go
@@ -20,41 +20,110 @@ package local
 
 import (
 	"context"
+	"iter"
+	"log/slog"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 )
 
 // KubernetesService manages kubernetes resources in the backend.
 type KubernetesService struct {
 	backend.Backend
+	logger *slog.Logger
 }
 
 // NewKubernetesService creates a new KubernetesService.
 func NewKubernetesService(backend backend.Backend) *KubernetesService {
-	return &KubernetesService{Backend: backend}
+	return &KubernetesService{
+		Backend: backend,
+		logger:  slog.With(teleport.ComponentKey, "KubernetesService"),
+	}
 }
 
 // GetKubernetesClusters returns all kubernetes cluster resources.
 func (s *KubernetesService) GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error) {
-	startKey := backend.ExactKey(kubernetesPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
+	out, err := stream.Collect(s.RangeKubernetesClusters(ctx, "", ""))
+
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	kubeClusters := make([]types.KubeCluster, len(result.Items))
-	for i, item := range result.Items {
+
+	return out, nil
+}
+
+// ListKubernetesClusters returns a page of registered kubernetes clusters.
+func (s *KubernetesService) ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error) {
+	// Adjust page size, so it can't be too large.
+	if limit <= 0 || limit > defaults.DefaultChunkSize {
+		limit = defaults.DefaultChunkSize
+	}
+
+	var next string
+	var seen int
+	out, err := stream.Collect(
+		stream.TakeWhile(
+			s.RangeKubernetesClusters(ctx, start, ""),
+			func(cluster types.KubeCluster) bool {
+				if seen < limit {
+					seen++
+					return true
+				}
+				next = cluster.GetName()
+				return false
+			},
+		),
+	)
+
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return out, next, nil
+}
+
+// RangeKubernetesClusters returns kubernetes clusters within the range [start, end).
+func (s *KubernetesService) RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error] {
+	mapFn := func(item backend.Item) (types.KubeCluster, bool) {
 		cluster, err := services.UnmarshalKubeCluster(item.Value,
-			services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
 		if err != nil {
-			return nil, trace.Wrap(err)
+			s.logger.WarnContext(ctx, "Failed to unmarshal kubernetes cluster",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
 		}
-		kubeClusters[i] = cluster
+		return cluster, true
+	}
+
+	kubernetesKey := backend.NewKey(kubernetesPrefix)
+	startKey := kubernetesKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(kubernetesKey)
+	if end != "" {
+		endKey = kubernetesKey.AppendKey(backend.KeyFromString(end)).ExactKey()
 	}
-	return kubeClusters, nil
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(cluster types.KubeCluster) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || cluster.GetName() < end
+		})
 }
 
 // GetKubernetesCluster returns the specified kubernetes cluster resource.
diff --git a/lib/services/local/kube_test.go b/lib/services/local/kube_test.go
index b093ff6d265da..9da3967297ed8 100644
--- a/lib/services/local/kube_test.go
+++ b/lib/services/local/kube_test.go
@@ -30,6 +30,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 // TestKubernetesCRUD tests backend operations with kubernetes resources.
@@ -53,6 +54,10 @@ func TestKubernetesCRUD(t *testing.T) {
 		Name: "c2",
 	}, types.KubernetesClusterSpecV3{})
 	require.NoError(t, err)
+	kubeCluster3, err := types.NewKubernetesClusterV3(types.Metadata{
+		Name: "c3",
+	}, types.KubernetesClusterSpecV3{})
+	require.NoError(t, err)
 
 	// Initially we expect no Kubernetess.
 	out, err := service.GetKubernetesClusters(ctx)
@@ -64,20 +69,49 @@ func TestKubernetesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	err = service.CreateKubernetesCluster(ctx, kubeCluster2)
 	require.NoError(t, err)
+	err = service.CreateKubernetesCluster(ctx, kubeCluster3)
+	require.NoError(t, err)
+
+	expectedAll := []types.KubeCluster{kubeCluster1, kubeCluster2, kubeCluster3}
+	diffopt := cmpopts.IgnoreFields(types.Metadata{}, "Revision")
 
 	// Fetch all Kubernetess.
 	out, err = service.GetKubernetesClusters(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.KubeCluster{kubeCluster1, kubeCluster2}, out,
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-	))
+	require.Empty(t, cmp.Diff(expectedAll, out, diffopt))
+
+	// List with page limit
+	page1, page2Start, err := service.ListKubernetesClusters(ctx, 2, "")
+	require.NoError(t, err)
+	require.NotEmpty(t, page2Start)
+	require.Len(t, page1, 2)
+
+	// List with start
+	page2, next, err := service.ListKubernetesClusters(ctx, 2, page2Start)
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Len(t, page2, 1)
+	require.Empty(t, cmp.Diff(expectedAll, append(page1, page2...), diffopt))
+
+	// Range over all
+	out, err = stream.Collect(service.RangeKubernetesClusters(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expectedAll, out, diffopt))
+
+	// Range with upper bound
+	out, err = stream.Collect(service.RangeKubernetesClusters(ctx, "", page2Start))
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(page1, out, diffopt))
+
+	// Range with lower bound
+	out, err = stream.Collect(service.RangeKubernetesClusters(ctx, page2Start, ""))
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(page2, out, diffopt))
 
 	// Fetch a specific Kubernetes.
 	cluster, err := service.GetKubernetesCluster(ctx, kubeCluster2.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(kubeCluster2, cluster,
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-	))
+	require.Empty(t, cmp.Diff(kubeCluster2, cluster, diffopt))
 
 	// Try to fetch a Kubernetes that doesn't exist.
 	_, err = service.GetKubernetesCluster(ctx, "doesnotexist")
@@ -93,18 +127,16 @@ func TestKubernetesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	cluster, err = service.GetKubernetesCluster(ctx, kubeCluster1.GetName())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(kubeCluster1, cluster,
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-	))
+	require.Empty(t, cmp.Diff(kubeCluster1, cluster, diffopt))
 
 	// Delete a Kubernetes.
 	err = service.DeleteKubernetesCluster(ctx, kubeCluster1.GetName())
 	require.NoError(t, err)
+
+	expectedAll = []types.KubeCluster{kubeCluster2, kubeCluster3}
 	out, err = service.GetKubernetesClusters(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.KubeCluster{kubeCluster2}, out,
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-	))
+	require.Empty(t, cmp.Diff(expectedAll, out, diffopt))
 
 	// Try to delete a Kubernetes that doesn't exist.
 	err = service.DeleteKubernetesCluster(ctx, "doesnotexist")
diff --git a/lib/services/local/okta.go b/lib/services/local/okta.go
index dfbca6b4d29ee..5e53115a30cb3 100644
--- a/lib/services/local/okta.go
+++ b/lib/services/local/okta.go
@@ -172,7 +172,7 @@ func (o *OktaService) UpdateOktaAssignmentStatus(ctx context.Context, name, stat
 		// Only update the status if the given duration has passed.
 		sinceLastTransition := o.clock.Since(currentAssignment.GetLastTransition())
 		if sinceLastTransition < timeHasPassed {
-			return trace.BadParameter("only %s has passed since last transition", sinceLastTransition)
+			return trace.BadParameter("only %s has passed since last transition (want at least %s)", sinceLastTransition, timeHasPassed)
 		}
 
 		if err := currentAssignment.SetStatus(status); err != nil {
diff --git a/lib/services/local/okta_test.go b/lib/services/local/okta_test.go
index 93dfa85a87f03..4952a26374ec7 100644
--- a/lib/services/local/okta_test.go
+++ b/lib/services/local/okta_test.go
@@ -403,7 +403,8 @@ func TestOktaAssignmentCRUD(t *testing.T) {
 
 	// Fail to update the status because not enough time has passed.
 	err = service.UpdateOktaAssignmentStatus(ctx, assignment1.GetName(), constants.OktaAssignmentStatusPending, time.Hour)
-	require.ErrorIs(t, err, trace.BadParameter("only 0s has passed since last transition"))
+	require.ErrorContains(t, err, "only 0s has passed since last transition")
+	require.True(t, trace.IsBadParameter(err))
 
 	// Successfully update the status for an assignment.
 	require.NoError(t, assignment1.SetStatus(constants.OktaAssignmentStatusSuccessful))
diff --git a/lib/services/local/plugins.go b/lib/services/local/plugins.go
index 10a502e5382a7..dafd56ad7dcee 100644
--- a/lib/services/local/plugins.go
+++ b/lib/services/local/plugins.go
@@ -20,13 +20,16 @@ package local
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/gravitational/trace"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	libplugin "github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/services"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 const pluginsPrefix = "plugins"
@@ -43,6 +46,9 @@ func NewPluginsService(backend backend.Backend) *PluginsService {
 
 // CreatePlugin implements services.Plugins
 func (s *PluginsService) CreatePlugin(ctx context.Context, plugin types.Plugin) error {
+	if err := libplugin.Validate(plugin); err != nil {
+		return trace.Wrap(err)
+	}
 	value, err := services.MarshalPlugin(plugin)
 	if err != nil {
 		return trace.Wrap(err)
@@ -56,7 +62,6 @@ func (s *PluginsService) CreatePlugin(ctx context.Context, plugin types.Plugin)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
 	return nil
 }
 
@@ -74,6 +79,9 @@ func (s *PluginsService) DeletePlugin(ctx context.Context, name string) error {
 
 // UpdatePlugin updates a plugin resource.
 func (s *PluginsService) UpdatePlugin(ctx context.Context, plugin types.Plugin) (types.Plugin, error) {
+	if err := libplugin.Validate(plugin); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	if err := services.CheckAndSetDefaults(plugin); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -170,7 +178,8 @@ func (s *PluginsService) ListPlugins(ctx context.Context, limit int, startKey st
 	for _, item := range result.Items {
 		plugin, err := services.UnmarshalPlugin(item.Value, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
 		if err != nil {
-			return nil, "", trace.Wrap(err)
+			slog.WarnContext(ctx, "skipping plugin resource due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+			continue
 		}
 		if !withSecrets {
 			plugin = plugin.WithoutSecrets().(types.Plugin)
diff --git a/lib/services/local/plugins_test.go b/lib/services/local/plugins_test.go
index 34629ae8d1e33..bb68769419fbd 100644
--- a/lib/services/local/plugins_test.go
+++ b/lib/services/local/plugins_test.go
@@ -36,6 +36,7 @@ import (
 
 // TestPluginsCRUD tests backend operations with plugin resources.
 func TestPluginsCRUD(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	mem, err := memory.New(memory.Config{
@@ -142,6 +143,7 @@ func TestPluginsCRUD(t *testing.T) {
 }
 
 func TestListPlugins(t *testing.T) {
+	t.Parallel()
 	const pageSize = 5
 	const numPlugins = 2*pageSize + 1
 	ctx := context.Background()
@@ -218,3 +220,107 @@ func TestListPlugins(t *testing.T) {
 		))
 	})
 }
+
+func TestPlugins_validate_okta(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	dummyStaticCreds := &types.PluginCredentialsV1{
+		Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
+			StaticCredentialsRef: &types.PluginStaticCredentialsRef{
+				Labels: map[string]string{"test_cred_label_1": "test_cred_value_1"},
+			},
+		},
+	}
+
+	setupServiceFn := func() *PluginsService {
+		mem, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+		t.Cleanup(func() { mem.Close() })
+
+		return NewPluginsService(mem)
+	}
+
+	// SyncSettings validation
+	for _, tt := range []struct {
+		desc         string
+		syncSettings *types.PluginOktaSyncSettings
+		requireErrFn func(t require.TestingT, err error, msgAndArgs ...any)
+	}{
+		{
+			desc:         "nil_sync_settings_is_ok",
+			syncSettings: nil,
+			requireErrFn: require.NoError,
+		},
+		{
+			desc:         "empty_sync_settings_is_ok",
+			syncSettings: &types.PluginOktaSyncSettings{},
+			requireErrFn: require.NoError,
+		},
+		{
+			desc: "time_between_imports_has_to_be_a_duration",
+			syncSettings: &types.PluginOktaSyncSettings{
+				TimeBetweenImports: "not-a-duration",
+			},
+			requireErrFn: func(t require.TestingT, err error, msgAndArgs ...any) {
+				require.Error(t, err)
+				require.True(t, trace.IsBadParameter(err))
+				require.ErrorContains(t, err, `time_between_imports is not valid: time: invalid duration "not-a-duration"`)
+			},
+		},
+		{
+			desc: "time_between_imports_has_to_be_positive",
+			syncSettings: &types.PluginOktaSyncSettings{
+				TimeBetweenImports: "-20s",
+			},
+			requireErrFn: func(t require.TestingT, err error, msgAndArgs ...any) {
+				require.Error(t, err)
+				require.True(t, trace.IsBadParameter(err))
+				require.ErrorContains(t, err, `time_between_imports "-20s" cannot be a negative value`)
+			},
+		},
+		{
+			desc: "time_between_imports_ok",
+			syncSettings: &types.PluginOktaSyncSettings{
+				TimeBetweenImports: "3h",
+			},
+			requireErrFn: require.NoError,
+		},
+	} {
+		t.Run(tt.desc, func(t *testing.T) {
+			svc := setupServiceFn()
+
+			plugin1 := types.NewPluginV1(types.Metadata{Name: "test_plugin_1"}, types.PluginSpecV1{
+				Settings: &types.PluginSpecV1_Okta{
+					Okta: &types.PluginOktaSettings{
+						OrgUrl: "https://my.okta.org.example.com",
+					},
+				},
+			}, nil)
+			plugin1.Credentials = dummyStaticCreds
+
+			plugin1.Spec.GetOkta().SyncSettings = tt.syncSettings
+			err := svc.CreatePlugin(ctx, plugin1)
+			tt.requireErrFn(t, err, "CreatePlugin")
+
+			// Make sure the plugin is in the backend and refresh the revision, so
+			// UpdatePlugin can be tested.
+			if err != nil {
+				plugin1.Spec.GetOkta().SyncSettings = nil
+				err = svc.CreatePlugin(ctx, plugin1)
+				require.NoError(t, err)
+			}
+			p, err := svc.GetPlugin(ctx, plugin1.GetName(), true)
+			require.NoError(t, err)
+			require.IsType(t, &types.PluginV1{}, p)
+			plugin1 = p.(*types.PluginV1)
+
+			plugin1.Spec.GetOkta().SyncSettings = tt.syncSettings
+			_, err = svc.UpdatePlugin(ctx, plugin1)
+			tt.requireErrFn(t, err, "UpdatePlugin")
+		})
+	}
+}
diff --git a/lib/services/local/presence.go b/lib/services/local/presence.go
index cdea18a20801c..0203c13a95f57 100644
--- a/lib/services/local/presence.go
+++ b/lib/services/local/presence.go
@@ -20,6 +20,7 @@ package local
 
 import (
 	"context"
+	"iter"
 	"log/slog"
 	"sort"
 	"time"
@@ -31,11 +32,16 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/internalutils/stream"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	apistream "github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/typical"
 )
@@ -46,41 +52,60 @@ type PresenceService struct {
 	logger *slog.Logger
 	jitter retryutils.Jitter
 	backend.Backend
+
+	relayServers *generic.ServiceWrapper[*presencev1.RelayServer]
 }
 
+var _ services.PresenceInternal = (*PresenceService)(nil)
+
 // backendItemToResourceFunc defines a function that unmarshals a
 // `backend.Item` into the implementation of `types.Resource`.
 type backendItemToResourceFunc func(item backend.Item) (types.ResourceWithLabels, error)
 
 // NewPresenceService returns new presence service instance
 func NewPresenceService(b backend.Backend) *PresenceService {
+	relayServers, err := generic.NewServiceWrapper(generic.ServiceConfig[*presencev1.RelayServer]{
+		Backend:       b,
+		ResourceKind:  types.KindRelayServer,
+		BackendPrefix: backend.NewKey(relayServersPrefix),
+		MarshalFunc:   services.MarshalProtoResource[*presencev1.RelayServer],
+		UnmarshalFunc: services.UnmarshalProtoResource[*presencev1.RelayServer],
+		ValidateFunc:  services.ValidateRelayServer,
+	})
+	if err != nil {
+		panic("impossible: failed to construct relay_server service wrapper")
+	}
 	return &PresenceService{
 		logger:  slog.With(teleport.ComponentKey, "Presence"),
 		jitter:  retryutils.FullJitter,
 		Backend: b,
+
+		relayServers: relayServers,
 	}
 }
 
 // GetServerInfos returns a stream of ServerInfos.
-func (s *PresenceService) GetServerInfos(ctx context.Context) stream.Stream[types.ServerInfo] {
+func (s *PresenceService) GetServerInfos(ctx context.Context) apistream.Stream[types.ServerInfo] {
 	startKey := backend.ExactKey(serverInfoPrefix)
 	endKey := backend.RangeEnd(startKey)
-	items := backend.StreamRange(ctx, s, startKey, endKey, apidefaults.DefaultChunkSize)
-	return stream.FilterMap(items, func(item backend.Item) (types.ServerInfo, bool) {
-		si, err := services.UnmarshalServerInfo(
-			item.Value,
-			services.WithExpires(item.Expires),
-			services.WithRevision(item.Revision),
-		)
-		if err != nil {
-			s.logger.WarnContext(ctx, "Failed to unmarshal server info",
-				"key", item.Key,
-				"error", err,
+	return stream.IntoLegacy(stream.FilterMap(
+		s.Backend.Items(ctx, backend.ItemsParams{StartKey: startKey, EndKey: endKey}),
+		func(item backend.Item) (types.ServerInfo, bool) {
+			si, err := services.UnmarshalServerInfo(
+				item.Value,
+				services.WithExpires(item.Expires),
+				services.WithRevision(item.Revision),
 			)
-			return nil, false
-		}
-		return si, true
-	})
+			if err != nil {
+				s.logger.WarnContext(ctx, "Failed to unmarshal server info",
+					"key", item.Key,
+					"error", err,
+				)
+				return nil, false
+			}
+			return si, true
+		},
+	))
 }
 
 // GetServerInfo returns a ServerInfo by name.
@@ -319,11 +344,63 @@ func (s *PresenceService) UpdateNode(ctx context.Context, server types.Server) (
 	return server, nil
 }
 
+// rangeAuthServers returns auth servers within the range [start, end]
+func (s *PresenceService) rangeAuthServers(ctx context.Context, start, end string) iter.Seq2[types.Server, error] {
+	mapFn := func(item backend.Item) (types.Server, bool) {
+		server, err := services.UnmarshalServer(item.Value, types.KindAuthServer, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+		if err != nil {
+			s.logger.WarnContext(ctx, "Skipping item during ListAuthServers because conversion from backend item failed", "key", item.Key, "error", err)
+			return nil, false
+		}
+		return server, true
+	}
+
+	startKey := backend.NewKey(authServersPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(authServersPrefix))
+	if end != "" {
+		endKey = backend.NewKey(authServersPrefix, end).ExactKey()
+	}
+
+	return stream.FilterMap(s.Backend.Items(ctx, backend.ItemsParams{StartKey: startKey, EndKey: endKey}), mapFn)
+}
+
+// rangeProxyServers returns proxy servers within the range [start, end]
+func (s *PresenceService) rangeProxyServers(ctx context.Context, start, end string) iter.Seq2[types.Server, error] {
+	mapFn := func(item backend.Item) (types.Server, bool) {
+		server, err := services.UnmarshalServer(item.Value, types.KindProxy, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+		if err != nil {
+			s.logger.WarnContext(ctx, "Skipping item during ListProxyServers because conversion from backend item failed", "key", item.Key, "error", err)
+			return nil, false
+		}
+		return server, true
+	}
+	startKey := backend.NewKey(proxiesPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(proxiesPrefix))
+	if end != "" {
+		endKey = backend.NewKey(proxiesPrefix, end).ExactKey()
+	}
+
+	return stream.FilterMap(s.Backend.Items(ctx, backend.ItemsParams{StartKey: startKey, EndKey: endKey}), mapFn)
+}
+
+func serverToPaginationKey(s types.Server) string {
+	return backend.GetPaginationKey(s)
+}
+
 // GetAuthServers returns a list of registered servers
+//
+// Deprecated: Prefer paginated variant [ListAuthServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
 func (s *PresenceService) GetAuthServers() ([]types.Server, error) {
 	return s.getServers(context.TODO(), types.KindAuthServer, authServersPrefix)
 }
 
+// ListAuthServers returns a paginated list of registered auth servers.
+func (s *PresenceService) ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	return generic.CollectPageAndCursor(s.rangeAuthServers(ctx, pageToken, ""), pageSize, serverToPaginationKey)
+}
+
 // UpsertAuthServer registers auth server presence, permanently if ttl is 0 or
 // for the specified duration with second resolution if it's >= 1 second
 func (s *PresenceService) UpsertAuthServer(ctx context.Context, server types.Server) error {
@@ -349,10 +426,19 @@ func (s *PresenceService) UpsertProxy(ctx context.Context, server types.Server)
 }
 
 // GetProxies returns a list of registered proxies
+//
+// Deprecated: Prefer paginated variant [ListProxyServers].
+//
+// TODO(kiosion): DELETE IN 21.0.0
 func (s *PresenceService) GetProxies() ([]types.Server, error) {
 	return s.getServers(context.TODO(), types.KindProxy, proxiesPrefix)
 }
 
+// ListProxyServers returns a paginated list of registered proxy servers.
+func (s *PresenceService) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	return generic.CollectPageAndCursor(s.rangeProxyServers(ctx, pageToken, ""), pageSize, serverToPaginationKey)
+}
+
 // DeleteAllProxies deletes all proxies
 func (s *PresenceService) DeleteAllProxies() error {
 	startKey := backend.ExactKey(proxiesPrefix)
@@ -765,6 +851,60 @@ func (s *PresenceService) GetSemaphores(ctx context.Context, filter types.Semaph
 	return sems, nil
 }
 
+func (s *PresenceService) rangeSemaphores(ctx context.Context, start string, filter *types.SemaphoreFilter) iter.Seq2[types.Semaphore, error] {
+	mapFn := func(item backend.Item) (types.Semaphore, bool) {
+		sem, err := services.UnmarshalSemaphore(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to unmarshal semaphore",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
+		}
+
+		return sem, filter.Match(sem)
+	}
+
+	startKey := backend.NewKey(semaphoresPrefix).AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(backend.NewKey(semaphoresPrefix))
+
+	filterKind := filter.GetSemaphoreKind()
+	filterName := filter.GetSemaphoreName()
+
+	// If the filter is set we optimize the ranges to avoid fetching items that will be filtered.
+	if filterKind != "" && filterName != "" {
+		// Special case when both kind and name are set the result should yield only a single item.
+		startKey = backend.NewKey(semaphoresPrefix, filterKind, filterName)
+		endKey = startKey
+	} else if filterKind != "" {
+		// Terminate range early as we know the only kind requested.
+		endKey = backend.RangeEnd(backend.NewKey(semaphoresPrefix, filterKind))
+		if start == "" {
+			// We are not resuming previous list, skip to the start of the correct kind range
+			startKey = backend.NewKey(semaphoresPrefix, filterKind)
+		}
+	}
+
+	return stream.FilterMap(
+		s.Backend.Items(ctx, backend.ItemsParams{
+			StartKey: startKey,
+			EndKey:   endKey,
+		}),
+		mapFn,
+	)
+}
+
+func semaphoreToPageToken(sem types.Semaphore) string {
+	return sem.GetSubKind() + backend.SeparatorString + sem.GetName()
+}
+
+// ListSemaphores returns a page of semaphores matching supplied filter.
+func (s *PresenceService) ListSemaphores(ctx context.Context, limit int, start string, filter *types.SemaphoreFilter) ([]types.Semaphore, string, error) {
+	return generic.CollectPageAndCursor(s.rangeSemaphores(ctx, start, filter), limit, semaphoreToPageToken)
+}
+
 // DeleteSemaphore deletes a semaphore matching the supplied filter
 func (s *PresenceService) DeleteSemaphore(ctx context.Context, filter types.SemaphoreFilter) error {
 	if filter.SemaphoreKind == "" || filter.SemaphoreName == "" {
@@ -1218,6 +1358,26 @@ func (s *PresenceService) GetSAMLIdPServiceProviders(ctx context.Context, opts .
 	return serviceProviders, nil
 }
 
+// GetRelayServer implements [services.Presence].
+func (s *PresenceService) GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error) {
+	return s.relayServers.GetResource(ctx, name)
+}
+
+// ListRelayServers implements [services.Presence].
+func (s *PresenceService) ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencev1.RelayServer, nextPageToken string, _ error) {
+	return s.relayServers.ListResources(ctx, pageSize, pageToken)
+}
+
+// DeleteRelayServer implements [services.Presence].
+func (s *PresenceService) DeleteRelayServer(ctx context.Context, name string) error {
+	return s.relayServers.DeleteResource(ctx, name)
+}
+
+// UpsertRelayServer implements [services.PresenceInternal].
+func (s *PresenceService) UpsertRelayServer(ctx context.Context, relayServer *presencev1.RelayServer) (*presencev1.RelayServer, error) {
+	return s.relayServers.UpsertResource(ctx, relayServer)
+}
+
 // ListResources returns a paginated list of resources.
 // It implements various filtering for scenarios where the call comes directly
 // here (without passing through the RBAC).
@@ -1263,6 +1423,12 @@ func (s *PresenceService) listResources(ctx context.Context, req proto.ListResou
 	case types.KindUserGroup:
 		keyPrefix = []string{userGroupPrefix}
 		unmarshalItemFunc = backendItemToUserGroup
+	case types.KindIdentityCenterAccount:
+		keyPrefix = []string{awsResourcePrefix, awsAccountPrefix}
+		unmarshalItemFunc = backendItemToIdentityCenterAccount
+	case types.KindIdentityCenterAccountAssignment:
+		keyPrefix = []string{awsResourcePrefix, awsAccountAssignmentPrefix}
+		unmarshalItemFunc = backendItemToIdentityCenterAccountAssignment
 	case types.KindGitServer:
 		keyPrefix = []string{gitServerPrefix}
 		unmarshalItemFunc = backendItemToServer(types.KindGitServer)
@@ -1286,45 +1452,35 @@ func (s *PresenceService) listResources(ctx context.Context, req proto.ListResou
 		filter.PredicateExpression = expression
 	}
 
-	// Get most limit+1 results to determine if there will be a next key.
 	reqLimit := int(req.Limit)
-	maxLimit := reqLimit + 1
-	var resources []types.ResourceWithLabels
-	if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, maxLimit, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(resources) == maxLimit {
-				break
-			}
-
-			resource, err := unmarshalItemFunc(item)
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
+	var resp types.ListResourcesResponse
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: rangeStart,
+		EndKey:   rangeEnd,
+	}) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-			switch match, err := services.MatchResourceByFilters(resource, filter, nil /* ignore dup matches */); {
-			case err != nil:
-				return false, trace.Wrap(err)
-			case match:
-				resources = append(resources, resource)
-			}
+		resource, err := unmarshalItemFunc(item)
+		if err != nil {
+			continue
 		}
 
-		return len(resources) == maxLimit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
+		switch match, err := services.MatchResourceByFilters(resource, filter, nil /* ignore dup matches */); {
+		case err != nil:
+			return nil, trace.Wrap(err)
+		case match:
+			if len(resp.Resources) >= reqLimit {
+				resp.NextKey = backend.GetPaginationKey(resource)
+				return &resp, nil
+			}
 
-	var nextKey string
-	if len(resources) > reqLimit {
-		nextKey = backend.GetPaginationKey(resources[len(resources)-1])
-		// Truncate the last item that was used to determine next row existence.
-		resources = resources[:reqLimit]
+			resp.Resources = append(resp.Resources, resource)
+		}
 	}
 
-	return &types.ListResourcesResponse{
-		Resources: resources,
-		NextKey:   nextKey,
-	}, nil
+	return &resp, nil
 }
 
 // listResourcesWithSort supports sorting by falling back to retrieving all resources
@@ -1654,6 +1810,78 @@ func backendItemToUserGroup(item backend.Item) (types.ResourceWithLabels, error)
 	)
 }
 
+func backendItemToIdentityCenterAccount(item backend.Item) (types.ResourceWithLabels, error) {
+	assignment, err := services.UnmarshalProtoResource[*identitycenterv1.Account](
+		item.Value,
+		services.WithExpires(item.Expires),
+		services.WithRevision(item.Revision),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return types.Resource153ToResourceWithLabels(
+		services.IdentityCenterAccount{Account: assignment},
+	), nil
+}
+
+func backendItemToIdentityCenterAccountAssignment(item backend.Item) (types.ResourceWithLabels, error) {
+	assignment, err := services.UnmarshalProtoResource[*identitycenterv1.AccountAssignment](
+		item.Value,
+		services.WithExpires(item.Expires),
+		services.WithRevision(item.Revision),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return types.Resource153ToResourceWithLabels(
+		services.IdentityCenterAccountAssignment{AccountAssignment: assignment},
+	), nil
+}
+
+func newRelayServerParser() resourceParser {
+	return relayServerParser{}
+}
+
+type relayServerParser struct{}
+
+// parse implements [resourceParser].
+func (relayServerParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpDelete:
+		return types.Resource153ToLegacy(&presencev1.RelayServer{
+			Kind:    types.KindRelayServer,
+			SubKind: "",
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: event.Item.Key.TrimPrefix(backend.ExactKey(relayServersPrefix)).String(),
+			},
+		}), nil
+	case types.OpPut:
+		r, err := services.UnmarshalProtoResource[*presencev1.RelayServer](
+			event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return types.Resource153ToLegacy(r), nil
+	default:
+		return nil, trace.BadParameter("event %v is unknown or not supported (this is a bug)", event.Type)
+	}
+}
+
+// match implements [resourceParser].
+func (relayServerParser) match(key backend.Key) bool {
+	return key.HasPrefix(backend.ExactKey(relayServersPrefix))
+}
+
+// prefixes implements [resourceParser].
+func (relayServerParser) prefixes() []backend.Key {
+	return []backend.Key{backend.ExactKey(relayServersPrefix)}
+}
+
 const (
 	reverseTunnelsPrefix         = "reverseTunnels"
 	tunnelConnectionsPrefix      = "tunnelConnections"
@@ -1675,4 +1903,5 @@ const (
 	loginTimePrefix              = "hostuser_interaction_time"
 	serverInfoPrefix             = "serverInfos"
 	cloudLabelsPrefix            = "cloudLabels"
+	relayServersPrefix           = "relay_servers"
 )
diff --git a/lib/services/local/presence_test.go b/lib/services/local/presence_test.go
index bdde28091b242..7bd9a6c920e45 100644
--- a/lib/services/local/presence_test.go
+++ b/lib/services/local/presence_test.go
@@ -19,9 +19,11 @@
 package local
 
 import (
+	gocmp "cmp"
 	"context"
 	"fmt"
 	"maps"
+	"slices"
 	"testing"
 	"time"
 
@@ -31,17 +33,19 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	gproto "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 // TestApplicationServersCRUD verifies backend operations on app servers.
@@ -50,11 +54,11 @@ func TestApplicationServersCRUD(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 
-	backend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	backend, err := memory.New(memory.Config{
 		Clock: clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = backend.Close() })
 
 	presence := NewPresenceService(backend)
 
@@ -156,11 +160,11 @@ func TestDatabaseServersCRUD(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 
-	backend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	backend, err := memory.New(memory.Config{
 		Clock: clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = backend.Close() })
 
 	presence := NewPresenceService(backend)
 
@@ -239,10 +243,11 @@ func TestDatabaseServersCRUD(t *testing.T) {
 func TestNodeCRUD(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	lite, err := lite.NewWithConfig(ctx, lite.Config{Path: t.TempDir()})
+	backend, err := memory.New(memory.Config{})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = backend.Close() })
 
-	presence := NewPresenceService(lite)
+	presence := NewPresenceService(backend)
 
 	node1, err := types.NewServerWithLabels("node1", types.KindNode, types.ServerSpecV2{}, nil)
 	require.NoError(t, err)
@@ -619,11 +624,11 @@ func TestListResources(t *testing.T) {
 		test := test
 		t.Run(testName, func(t *testing.T) {
 			t.Parallel()
-			backend, err := lite.NewWithConfig(ctx, lite.Config{
-				Path:  t.TempDir(),
+			backend, err := memory.New(memory.Config{
 				Clock: clock,
 			})
 			require.NoError(t, err)
+			t.Cleanup(func() { _ = backend.Close() })
 
 			presence := NewPresenceService(backend)
 
@@ -756,11 +761,11 @@ func TestListResources_Helpers(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 	namespace := apidefaults.Namespace
-	bend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	bend, err := memory.New(memory.Config{
 		Clock: clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = bend.Close() })
 	presence := NewPresenceService(bend)
 
 	tests := []struct {
@@ -816,7 +821,7 @@ func TestListResources_Helpers(t *testing.T) {
 
 	// Add some test servers.
 	for i := 0; i < 20; i++ {
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", namespace)
 		_, err = presence.UpsertNode(ctx, server)
 		require.NoError(t, err)
 	}
@@ -943,29 +948,29 @@ func TestFakePaginate_TotalCount(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 	namespace := apidefaults.Namespace
-	bend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	bend, err := memory.New(memory.Config{
 		Clock: clock,
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = bend.Close() })
 	presence := NewPresenceService(bend)
 
 	// Add some control servers.
-	server := suite.NewServer(types.KindNode, "foo-bar", "127.0.0.1:2022", namespace)
+	server := NewServer(types.KindNode, "foo-bar", "127.0.0.1:2022", namespace)
 	_, err = presence.UpsertNode(ctx, server)
 	require.NoError(t, err)
 
-	server = suite.NewServer(types.KindNode, "foo-baz", "127.0.0.1:2022", namespace)
+	server = NewServer(types.KindNode, "foo-baz", "127.0.0.1:2022", namespace)
 	_, err = presence.UpsertNode(ctx, server)
 	require.NoError(t, err)
 
-	server = suite.NewServer(types.KindNode, "foo-qux", "127.0.0.1:2022", namespace)
+	server = NewServer(types.KindNode, "foo-qux", "127.0.0.1:2022", namespace)
 	_, err = presence.UpsertNode(ctx, server)
 	require.NoError(t, err)
 
 	// Add some test servers.
 	for i := 0; i < 10; i++ {
-		server := suite.NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", namespace)
+		server := NewServer(types.KindNode, uuid.New().String(), "127.0.0.1:2022", namespace)
 		_, err = presence.UpsertNode(ctx, server)
 		require.NoError(t, err)
 	}
@@ -1072,9 +1077,9 @@ func TestFakePaginate_TotalCount(t *testing.T) {
 func TestPresenceService_CancelSemaphoreLease(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
+	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, bk.Close()) })
+	t.Cleanup(func() { _ = bk.Close() })
 	presence := NewPresenceService(bk)
 
 	maxLeases := 5
@@ -1105,6 +1110,15 @@ func TestPresenceService_CancelSemaphoreLease(t *testing.T) {
 	require.Len(t, semaphores, 1)
 	require.Len(t, semaphores[0].LeaseRefs(), maxLeases)
 
+	semaphores, next, err := presence.ListSemaphores(ctx, 0, "", &types.SemaphoreFilter{
+		SemaphoreKind: "test",
+		SemaphoreName: "test",
+	})
+	require.NoError(t, err)
+	require.Empty(t, next)
+	require.Len(t, semaphores, 1)
+	require.Len(t, semaphores[0].LeaseRefs(), maxLeases)
+
 	// Cancel the leases concurrently and ensure that all
 	// cancellations are honored
 	errCh := make(chan error, maxLeases)
@@ -1128,6 +1142,16 @@ func TestPresenceService_CancelSemaphoreLease(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, semaphores, 1)
 	require.Empty(t, semaphores[0].LeaseRefs())
+
+	semaphores, next, err = presence.ListSemaphores(ctx, 0, "", &types.SemaphoreFilter{
+		SemaphoreKind: "test",
+		SemaphoreName: "test",
+	})
+
+	require.Empty(t, next)
+	require.NoError(t, err)
+	require.Len(t, semaphores, 1)
+	require.Empty(t, semaphores[0].LeaseRefs())
 }
 
 // TestListResources_DuplicateResourceFilterByLabel tests that we can search for a specific label
@@ -1136,11 +1160,11 @@ func TestListResources_DuplicateResourceFilterByLabel(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
-	backend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	backend, err := memory.New(memory.Config{
 		Clock: clockwork.NewFakeClock(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = backend.Close() })
 
 	presence := NewPresenceService(backend)
 
@@ -1261,10 +1285,9 @@ func TestServerInfoCRUD(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
-	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
+	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, bk.Close()) })
-
+	t.Cleanup(func() { _ = bk.Close() })
 	presence := NewPresenceService(bk)
 
 	serverInfoA, err := types.NewServerInfo(types.Metadata{
@@ -1415,3 +1438,256 @@ func TestPresenceService_UpsertReverseTunnel(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(got, fetched))
 }
+
+func TestPresenceService_RelayServer(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	defer bk.Close()
+
+	var p *PresenceService
+	require.NotPanics(t, func() {
+		p = NewPresenceService(bk)
+	})
+
+	_, err = p.UpsertRelayServer(ctx, nil)
+	require.ErrorAs(t, err, new(*trace.BadParameterError))
+
+	relayA := &presencev1.RelayServer{
+		Kind:    types.KindRelayServer,
+		SubKind: "",
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "a",
+		},
+	}
+
+	upsertedA, err := p.UpsertRelayServer(ctx, gproto.CloneOf(relayA))
+	require.NoError(t, err)
+	require.NotNil(t, upsertedA.GetMetadata())
+
+	diffOpts := []cmp.Option{
+		protocmp.Transform(),
+		protocmp.IgnoreFields((*headerv1.Metadata)(nil), "revision"),
+	}
+
+	require.Empty(t, cmp.Diff(relayA, upsertedA, diffOpts...))
+
+	gottenA, err := p.GetRelayServer(ctx, "a")
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(relayA, gottenA, diffOpts...))
+
+	_, err = p.GetRelayServer(ctx, "b")
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+
+	err = p.DeleteRelayServer(ctx, "a")
+	require.NoError(t, err)
+
+	_, err = p.GetRelayServer(ctx, "a")
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+	err = p.DeleteRelayServer(ctx, "a")
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+
+	relayB := &presencev1.RelayServer{
+		Kind:    types.KindRelayServer,
+		SubKind: "",
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "b",
+		},
+	}
+
+	_, err = p.UpsertRelayServer(ctx, gproto.CloneOf(relayA))
+	require.NoError(t, err)
+	_, err = p.UpsertRelayServer(ctx, gproto.CloneOf(relayB))
+	require.NoError(t, err)
+
+	listedRelays, nextPageToken, err := p.ListRelayServers(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, nextPageToken)
+	require.Len(t, listedRelays, 2)
+	require.Empty(t, cmp.Diff(relayA, listedRelays[0], diffOpts...))
+	require.Empty(t, cmp.Diff(relayB, listedRelays[1], diffOpts...))
+
+	shortList, nextPageToken, err := p.ListRelayServers(ctx, 1, "")
+	require.NoError(t, err)
+	require.Equal(t, "b", nextPageToken)
+	require.Len(t, shortList, 1)
+	require.Empty(t, cmp.Diff(relayA, shortList[0], diffOpts...))
+
+	shortList, nextPageToken, err = p.ListRelayServers(ctx, 1, "b")
+	require.NoError(t, err)
+	require.Empty(t, nextPageToken)
+	require.Len(t, shortList, 1)
+	require.Empty(t, cmp.Diff(relayB, shortList[0], diffOpts...))
+}
+
+func TestPresenceService_ListSemaphores(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	t.Cleanup(func() { bk.Close() })
+	presence := NewPresenceService(bk)
+
+	newRequest := func(kind, name string) types.AcquireSemaphoreRequest {
+		return types.AcquireSemaphoreRequest{
+			SemaphoreKind: kind,
+			SemaphoreName: name,
+			MaxLeases:     5,
+			Expires:       time.Now().Add(time.Hour),
+			Holder:        "test",
+		}
+	}
+
+	expectedFromReq := func(req types.AcquireSemaphoreRequest) types.Semaphore {
+		sem := &types.SemaphoreV3{
+			SubKind: req.SemaphoreKind,
+			Metadata: types.Metadata{
+				Name: req.SemaphoreName,
+			}}
+		sem.CheckAndSetDefaults()
+		return sem
+	}
+
+	pageSize := 12
+	totalItems := pageSize*2 + (pageSize / 2)
+	expected := make([]types.Semaphore, 0, totalItems)
+
+	for i := range totalItems {
+		kind := types.SemaphoreKindConnection
+		name := fmt.Sprintf("sem-%05d", i)
+		switch {
+		case i%5 == 0:
+			kind = types.SemaphoreKindUploadCompleter
+		case i%3 == 0:
+			// every third name is duplicated with previous item
+			name = expected[i-1].GetName()
+			kind = types.SemaphoreKindKubernetesConnection
+		case i%2 == 0:
+			kind = types.SemaphoreKindAccessListReminderLimiter
+		}
+		request := newRequest(kind, name)
+		_, err := presence.AcquireSemaphore(ctx, request)
+		require.NoError(t, err)
+		expected = append(expected, expectedFromReq(request))
+
+	}
+
+	slices.SortFunc(expected, func(a, b types.Semaphore) int {
+		if c := gocmp.Compare(a.GetSubKind(), b.GetSubKind()); c != 0 {
+			return c
+		}
+		return gocmp.Compare(a.GetName(), b.GetName())
+	})
+	diffopts := cmp.Options{cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(types.SemaphoreSpecV3{}, "Leases"),
+		cmpopts.IgnoreFields(types.Metadata{}, "Expires")}
+
+	t.Run("filter by name", func(t *testing.T) {
+		wantName := "sem-00002"
+		page, next, err := presence.ListSemaphores(ctx, 0, "", &types.SemaphoreFilter{
+			SemaphoreName: wantName,
+		})
+
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Len(t, page, 2)
+		for _, sem := range page {
+			require.Equal(t, wantName, sem.GetName())
+		}
+		require.NotEqual(t, page[0].GetSubKind(), page[1].GetSubKind())
+	})
+
+	t.Run("filter by name and kind returns single item", func(t *testing.T) {
+		wantKind := types.SemaphoreKindUploadCompleter
+		wantName := "sem-00000"
+		page, next, err := presence.ListSemaphores(ctx, 0, "", &types.SemaphoreFilter{
+			SemaphoreKind: wantKind,
+			SemaphoreName: wantName,
+		})
+
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Len(t, page, 1)
+		require.Equal(t, wantKind, page[0].GetSubKind())
+		require.Equal(t, wantName, page[0].GetName())
+	})
+
+	t.Run("unfiltered list all", func(t *testing.T) {
+		got, gotNext, err := presence.ListSemaphores(ctx, 1000, "", nil)
+		require.NoError(t, err)
+		require.Empty(t, gotNext)
+		require.Len(t, got, totalItems)
+		require.Empty(t, cmp.Diff(expected, got, diffopts...))
+	})
+
+	t.Run("pagination unfiltered", func(t *testing.T) {
+		page1, page2Start, err := presence.ListSemaphores(ctx, pageSize, "", nil)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Len(t, page1, pageSize)
+		require.Empty(t, cmp.Diff(expected[:pageSize], page1, diffopts...))
+
+		page2, page3Start, err := presence.ListSemaphores(ctx, pageSize, page2Start, nil)
+		require.NoError(t, err)
+		require.NotEmpty(t, page3Start)
+		require.Len(t, page2, pageSize)
+		require.Empty(t, cmp.Diff(expected[pageSize:pageSize*2], page2, diffopts...))
+
+		page3, next, err := presence.ListSemaphores(ctx, pageSize, page3Start, nil)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Len(t, page3, totalItems-2*pageSize)
+		require.Empty(t, cmp.Diff(expected[pageSize*2:], page3, diffopts...))
+
+		allPages := append(page1, append(page2, page3...)...)
+		require.Empty(t, cmp.Diff(expected, allPages, diffopts...))
+	})
+
+	t.Run("pagination filtered by kind", func(t *testing.T) {
+		filter := &types.SemaphoreFilter{SemaphoreKind: types.SemaphoreKindKubernetesConnection}
+		page1, page2Start, err := presence.ListSemaphores(ctx, 2, "", filter)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Len(t, page1, 2)
+
+		page2, page3Start, err := presence.ListSemaphores(ctx, 2, page2Start, filter)
+		require.NoError(t, err)
+		require.NotEmpty(t, page3Start)
+		require.Len(t, page2, 2)
+
+		page3, next, err := presence.ListSemaphores(ctx, 0, page3Start, filter)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Len(t, page3, 4)
+
+		allPages := append(page1, append(page2, page3...)...)
+
+		for _, sem := range allPages {
+			require.Equal(t, types.SemaphoreKindKubernetesConnection, sem.GetSubKind())
+		}
+	})
+
+	t.Run("pagination filtered by name", func(t *testing.T) {
+		wantName := "sem-00002"
+		filter := &types.SemaphoreFilter{SemaphoreName: wantName}
+		page1, page2Start, err := presence.ListSemaphores(ctx, 1, "", filter)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Len(t, page1, 1)
+
+		page2, next, err := presence.ListSemaphores(ctx, 0, page2Start, filter)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Len(t, page2, 1)
+
+		allPages := append(page1, page2...)
+		for _, sem := range allPages {
+			require.Equal(t, wantName, sem.GetName())
+		}
+	})
+
+}
diff --git a/lib/services/local/provisioning.go b/lib/services/local/provisioning.go
index e2a018a988f8f..30da54d5ebde1 100644
--- a/lib/services/local/provisioning.go
+++ b/lib/services/local/provisioning.go
@@ -20,11 +20,13 @@ package local
 
 import (
 	"context"
+	"strings"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -175,6 +177,8 @@ func (s *ProvisioningService) DeleteToken(ctx context.Context, token string) err
 }
 
 // GetTokens returns all active (non-expired) provisioning tokens
+// Deprecated: use [ListProvisionTokens] instead.
+// TODO(hugoShaka): DELETE IN 19.0.0
 func (s *ProvisioningService) GetTokens(ctx context.Context) ([]types.ProvisionToken, error) {
 	startKey := backend.ExactKey(tokensPrefix)
 	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
@@ -189,11 +193,72 @@ func (s *ProvisioningService) GetTokens(ctx context.Context) ([]types.ProvisionT
 			services.WithRevision(item.Revision),
 		)
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return nil, trace.Wrap(err, "unmarshaling token (key: %q)", item.Key)
 		}
 		tokens[i] = t
 	}
 	return tokens, nil
 }
 
+// ListProvisionTokens returns a paginated list of provision tokens. Items can
+// be filtered by role and bot name. Tokens with ANY of the provided roles are
+// returned. If a bot name is provided, only tokens having a role of Bot are
+// returned.
+func (s *ProvisioningService) ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error) {
+	// Bound page size (0 - 1_000)
+	if pageSize <= 0 || pageSize > int(defaults.MaxIterationLimit) {
+		pageSize = int(defaults.MaxIterationLimit)
+	}
+
+	prefix := backend.NewKey(tokensPrefix)
+	var out []types.ProvisionToken
+	for item, err := range s.Items(ctx, backend.ItemsParams{
+		StartKey: prefix.AppendKey(backend.KeyFromString(pageToken)),
+		EndKey:   backend.RangeEnd(prefix.ExactKey()),
+	}) {
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		t, err := services.UnmarshalProvisionToken(
+			item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision),
+		)
+		if err != nil {
+			return nil, "", trace.Wrap(err, "unmarshaling token (key: %q)", item.Key)
+		}
+
+		if len(out) == pageSize {
+			nextKey := strings.TrimPrefix(
+				item.Key.TrimPrefix(backend.ExactKey(tokensPrefix)).String(),
+				string(backend.Separator),
+			)
+			return out, nextKey, nil
+		}
+
+		if !MatchToken(t, anyRoles, botName) {
+			continue
+		}
+
+		out = append(out, t)
+	}
+
+	return out, "", nil
+}
+
+// MatchToken validates a token against a set of roles and a bot name filters.
+// If a bot name is provided, it additionally checks if the token has a role of bot.
+func MatchToken(t types.ProvisionToken, anyRoles types.SystemRoles, botName string) bool {
+	if len(anyRoles) > 0 && !t.GetRoles().IncludeAny(anyRoles...) {
+		return false
+	}
+
+	if botName != "" && (!t.GetRoles().Include(types.RoleBot) || t.GetBotName() != botName) {
+		return false
+	}
+
+	return true
+}
+
 const tokensPrefix = "tokens"
diff --git a/lib/services/local/provisioning_test.go b/lib/services/local/provisioning_test.go
new file mode 100644
index 0000000000000..bc026794a7ef6
--- /dev/null
+++ b/lib/services/local/provisioning_test.go
@@ -0,0 +1,313 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local_test
+
+import (
+	"context"
+	"strconv"
+	"testing"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+func TestProvisioningService_ListProvisionTokens_Pagination(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	cases := []struct {
+		name     string
+		count    int
+		pageSize int
+		nextPage string
+	}{
+		{
+			name:     "empty",
+			count:    10,
+			pageSize: defaults.MaxIterationLimit,
+			nextPage: "",
+		},
+		{
+			name:     "count smaller than page size",
+			count:    1,
+			pageSize: 2,
+			nextPage: "",
+		},
+		{
+			name:     "count bigger than page size",
+			count:    3,
+			pageSize: 2,
+			nextPage: "test-token-3",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			service := newProvisioningService(t, clockwork.NewFakeClock())
+
+			for j := range tc.count {
+				err := service.CreateToken(ctx, &types.ProvisionTokenV2{
+					Metadata: types.Metadata{
+						Name: "test-token-" + strconv.Itoa(j+1),
+					},
+					Spec: types.ProvisionTokenSpecV2{
+						Roles: []types.SystemRole{
+							types.RoleAdmin,
+						},
+					},
+				})
+				require.NoError(t, err)
+			}
+
+			result, nextPage, err := service.ListProvisionTokens(ctx, tc.pageSize, "", nil, "")
+			require.NoError(t, err)
+			assert.Equal(t, tc.nextPage, nextPage)
+			if tc.count > tc.pageSize {
+				assert.Len(t, result, tc.pageSize)
+
+				result, nextPage, err = service.ListProvisionTokens(ctx, tc.pageSize, nextPage, nil, "")
+				require.NoError(t, err)
+
+				assert.Empty(t, nextPage)
+				assert.Len(t, result, tc.count-tc.pageSize)
+			} else {
+				assert.Len(t, result, tc.count)
+			}
+		})
+	}
+}
+
+func TestProvisioningService_ListProvisionTokens_Filters(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	service := newProvisioningService(t, clockwork.NewFakeClock())
+
+	tokens := []struct {
+		roles   types.SystemRoles
+		botName string
+	}{
+		{
+			roles:   types.SystemRoles{types.RoleAdmin},
+			botName: "",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleAdmin, types.RoleBot},
+			botName: "bot-1",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleBot},
+			botName: "bot-2",
+		},
+		{
+			roles:   types.SystemRoles{types.RoleBot},
+			botName: "bot-1",
+		},
+	}
+
+	for i, token := range tokens {
+		err := service.CreateToken(ctx, &types.ProvisionTokenV2{
+			Metadata: types.Metadata{
+				Name: "test-token-" + strconv.Itoa(i+1),
+			},
+			Spec: types.ProvisionTokenSpecV2{
+				Roles:   token.roles,
+				BotName: token.botName,
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	result, _, err := service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "")
+	require.NoError(t, err)
+	assert.Len(t, result, 4)
+
+	t.Run("filter roles", func(t *testing.T) {
+		result, _, err = service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin, types.RoleNode, types.RoleBot}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 4)
+
+		result, _, err = service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin, types.RoleNode}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 2)
+
+		result, _, err = service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleBot}, "")
+		require.NoError(t, err)
+		assert.Len(t, result, 3)
+	})
+
+	t.Run("filter bot name", func(t *testing.T) {
+		result, _, err := service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "bot-1")
+		require.NoError(t, err)
+		require.Len(t, result, 2)
+		assert.Equal(t, "test-token-2", result[0].GetName())
+
+		result, _, err = service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", nil, "bot-2")
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "test-token-3", result[0].GetName())
+	})
+
+	t.Run("filter roles and bot name", func(t *testing.T) {
+		result, _, err := service.ListProvisionTokens(ctx, defaults.MaxIterationLimit, "", types.SystemRoles{types.RoleAdmin}, "bot-1")
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "test-token-2", result[0].GetName())
+	})
+}
+
+func TestMatchToken(t *testing.T) {
+	t.Parallel()
+
+	tokenEmpty := types.ProvisionTokenSpecV2{}
+
+	tokenWithNodeRole := types.ProvisionTokenSpecV2{
+		Roles: types.SystemRoles{types.RoleNode},
+	}
+
+	tokenBot1WithNoBotRole := types.ProvisionTokenSpecV2{
+		Roles:   nil,
+		BotName: "bot-1",
+	}
+
+	tokenBot1WithBotRole := types.ProvisionTokenSpecV2{
+		Roles:   types.SystemRoles{types.RoleBot},
+		BotName: "bot-1",
+	}
+
+	tokenBot1WithNodeAndBotRole := types.ProvisionTokenSpecV2{
+		Roles:   types.SystemRoles{types.RoleNode, types.RoleBot},
+		BotName: "bot-1",
+	}
+
+	tc := []struct {
+		name          string
+		filterRoles   types.SystemRoles
+		filterBotName string
+		tokens        []struct {
+			spec  types.ProvisionTokenSpecV2
+			match bool
+		}
+	}{
+		{
+			name:          "empty filters",
+			filterRoles:   nil,
+			filterBotName: "",
+			tokens: []struct {
+				spec  types.ProvisionTokenSpecV2
+				match bool
+			}{
+				{spec: tokenEmpty, match: true},
+				{spec: tokenWithNodeRole, match: true},
+				{spec: tokenBot1WithNoBotRole, match: true},
+				{spec: tokenBot1WithBotRole, match: true},
+				{spec: tokenBot1WithNodeAndBotRole, match: true},
+			},
+		},
+		{
+			name:          "role filter (single)",
+			filterRoles:   types.SystemRoles{types.RoleNode},
+			filterBotName: "",
+			tokens: []struct {
+				spec  types.ProvisionTokenSpecV2
+				match bool
+			}{
+				{spec: tokenEmpty, match: false},
+				{spec: tokenWithNodeRole, match: true},
+				{spec: tokenBot1WithNoBotRole, match: false},
+				{spec: tokenBot1WithBotRole, match: false},
+				{spec: tokenBot1WithNodeAndBotRole, match: true},
+			},
+		},
+		{
+			name:          "role filter (multiple)",
+			filterRoles:   types.SystemRoles{types.RoleNode, types.RoleBot},
+			filterBotName: "",
+			tokens: []struct {
+				spec  types.ProvisionTokenSpecV2
+				match bool
+			}{
+				{spec: tokenEmpty, match: false},
+				{spec: tokenWithNodeRole, match: true},
+				{spec: tokenBot1WithNoBotRole, match: false},
+				{spec: tokenBot1WithBotRole, match: true},
+				{spec: tokenBot1WithNodeAndBotRole, match: true},
+			},
+		},
+		{
+			name:          "bot name filter",
+			filterRoles:   nil,
+			filterBotName: "bot-1",
+			tokens: []struct {
+				spec  types.ProvisionTokenSpecV2
+				match bool
+			}{
+				{spec: tokenEmpty, match: false},
+				{spec: tokenWithNodeRole, match: false},
+				{spec: tokenBot1WithNoBotRole, match: false},
+				{spec: tokenBot1WithBotRole, match: true},
+				{spec: tokenBot1WithNodeAndBotRole, match: true},
+			},
+		},
+		{
+			name:          "role and bot name filters",
+			filterRoles:   types.SystemRoles{types.RoleNode},
+			filterBotName: "bot-1",
+			tokens: []struct {
+				spec  types.ProvisionTokenSpecV2
+				match bool
+			}{
+				{spec: tokenEmpty, match: false},
+				{spec: tokenWithNodeRole, match: false},
+				{spec: tokenBot1WithNoBotRole, match: false},
+				{spec: tokenBot1WithBotRole, match: false},
+				{spec: tokenBot1WithNodeAndBotRole, match: true},
+			},
+		},
+	}
+
+	for _, c := range tc {
+		t.Run(c.name, func(t *testing.T) {
+			for _, token := range c.tokens {
+				match := local.MatchToken(&types.ProvisionTokenV2{
+					Metadata: types.Metadata{
+						Name: "test-token",
+					},
+					Spec: token.spec,
+				}, c.filterRoles, c.filterBotName)
+				assert.Equal(t, token.match, match, "not match token: %+v", token.spec)
+			}
+		})
+	}
+}
+
+func newProvisioningService(t *testing.T, clock clockwork.Clock) *local.ProvisioningService {
+	t.Helper()
+	backend, err := memory.New(memory.Config{
+		Context: context.Background(),
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	service := local.NewProvisioningService(backend)
+	return service
+}
diff --git a/lib/services/local/provisioningstates.go b/lib/services/local/provisioningstates.go
index 45c9fffe24791..f9a8910166a21 100644
--- a/lib/services/local/provisioningstates.go
+++ b/lib/services/local/provisioningstates.go
@@ -20,14 +20,12 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/emptypb"
 
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local/generic"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 const (
@@ -37,7 +35,6 @@ const (
 
 // ProvisioningStateService handles low-level CRUD operations for the provisioning status
 type ProvisioningStateService struct {
-	provisioningv1.UnimplementedProvisioningServiceServer
 	service *generic.ServiceWrapper[*provisioningv1.PrincipalState]
 }
 
@@ -52,6 +49,7 @@ func NewProvisioningStateService(backendInstance backend.Backend) (*Provisioning
 		BackendPrefix: backend.NewKey(provisioningStatePrefix),
 		MarshalFunc:   services.MarshalProtoResource[*provisioningv1.PrincipalState],
 		UnmarshalFunc: services.UnmarshalProtoResource[*provisioningv1.PrincipalState],
+		PageLimit:     provisioningStatePageSize,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -124,22 +122,24 @@ func (ss *ProvisioningStateService) GetProvisioningState(ctx context.Context, do
 	return state, nil
 }
 
-// GetProvisioningState fetches a provisioning state record from the supplied
+// ListProvisioningStates fetches a page of provisioning state records from the supplied
 // downstream
-func (ss *ProvisioningStateService) ListProvisioningStates(ctx context.Context, downstreamID services.DownstreamID, pageSize int, page *pagination.PageRequestToken) ([]*provisioningv1.PrincipalState, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = provisioningStatePageSize
-	}
-
-	token, err := page.Consume()
+func (ss *ProvisioningStateService) ListProvisioningStates(ctx context.Context, downstreamID services.DownstreamID, pageSize int, pageToken string) ([]*provisioningv1.PrincipalState, string, error) {
+	resp, nextPage, err := ss.ListProvisioningStates2(ctx, downstreamID, pageSize, pageToken)
 	if err != nil {
-		return nil, "", trace.Wrap(err)
+		return nil, "", trace.Wrap(err, "listing provisioning state records")
 	}
-	resp, nextPage, err := ss.service.WithPrefix(string(downstreamID)).ListResources(ctx, pageSize, token)
+	return resp, nextPage, nil
+}
+
+// ListProvisioningStates fetches a page of provisioning state records from the supplied
+// downstream
+func (ss *ProvisioningStateService) ListProvisioningStates2(ctx context.Context, downstreamID services.DownstreamID, pageSize int, pageToken string) ([]*provisioningv1.PrincipalState, string, error) {
+	resp, nextPage, err := ss.service.WithPrefix(string(downstreamID)).ListResources(ctx, pageSize, pageToken)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing provisioning state records")
 	}
-	return resp, pagination.NextPageToken(nextPage), nil
+	return resp, nextPage, nil
 }
 
 // ListProvisioningStatesForAllDownstreams lists all provisioning state records for all
@@ -149,21 +149,29 @@ func (ss *ProvisioningStateService) ListProvisioningStates(ctx context.Context,
 func (ss *ProvisioningStateService) ListProvisioningStatesForAllDownstreams(
 	ctx context.Context,
 	pageSize int,
-	page *pagination.PageRequestToken,
-) ([]*provisioningv1.PrincipalState, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = provisioningStatePageSize
-	}
-
-	token, err := page.Consume()
+	token string,
+) ([]*provisioningv1.PrincipalState, string, error) {
+	resp, nextPage, err := ss.ListProvisioningStatesForAllDownstreams2(ctx, pageSize, token)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
+	return resp, nextPage, nil
+}
+
+// ListProvisioningStatesForAllDownstreams2 lists all provisioning state records for all
+// downstream receivers. Note that the returned record names may not be unique
+// across all downstream receivers. Check the records' `DownstreamID` field
+// to disambiguate.
+func (ss *ProvisioningStateService) ListProvisioningStatesForAllDownstreams2(
+	ctx context.Context,
+	pageSize int,
+	token string,
+) ([]*provisioningv1.PrincipalState, string, error) {
 	resp, nextPage, err := ss.service.ListResources(ctx, pageSize, token)
 	if err != nil {
 		return nil, "", trace.Wrap(err, "listing provisioning state records")
 	}
-	return resp, pagination.NextPageToken(nextPage), nil
+	return resp, nextPage, nil
 }
 
 // DeleteProvisioningState deletes a given principal's provisioning state
@@ -174,8 +182,8 @@ func (ss *ProvisioningStateService) DeleteProvisioningState(ctx context.Context,
 
 // DeleteDownstreamProvisioningStates deletes *all* provisioning records for
 // a given downstream
-func (ss *ProvisioningStateService) DeleteDownstreamProvisioningStates(ctx context.Context, req *provisioningv1.DeleteDownstreamProvisioningStatesRequest) (*emptypb.Empty, error) {
-	return &emptypb.Empty{}, trace.Wrap(ss.service.WithPrefix(req.GetDownstreamId()).DeleteAllResources(ctx))
+func (ss *ProvisioningStateService) DeleteDownstreamProvisioningStates(ctx context.Context, downstreamID services.DownstreamID) error {
+	return trace.Wrap(ss.service.WithPrefix(string(downstreamID)).DeleteAllResources(ctx))
 }
 
 // DeleteAllProvisioningStates deletes *all* provisioning records for a *all*
diff --git a/lib/services/local/provisioningstates_test.go b/lib/services/local/provisioningstates_test.go
index 638639910b5d3..c5640cc3f8603 100644
--- a/lib/services/local/provisioningstates_test.go
+++ b/lib/services/local/provisioningstates_test.go
@@ -27,20 +27,20 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend/lite"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
 )
 
 func TestProvisioningUpdate(t *testing.T) {
 	ctx := context.Background()
 
-	backend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
+	bk, err := memory.New(memory.Config{
 		Clock: clockwork.NewFakeClock(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = bk.Close() })
 
-	uut, err := NewProvisioningStateService(backend)
+	uut, err := NewProvisioningStateService(bk)
 	require.NoError(t, err)
 
 	t.Run("downstream is honored", func(t *testing.T) {
diff --git a/lib/services/local/recording_encryption.go b/lib/services/local/recording_encryption.go
new file mode 100644
index 0000000000000..7d503f0876e5e
--- /dev/null
+++ b/lib/services/local/recording_encryption.go
@@ -0,0 +1,219 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+	"crypto/x509"
+
+	"github.com/gravitational/trace"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
+)
+
+const (
+	recordingEncryptionPrefix = "recording_encryption"
+	rotatedKeyPrefix          = "recording_encryption_rotated"
+)
+
+// RecordingEncryptionService exposes backend functionality for working with the
+// cluster's RecordingEncryption resource.
+type RecordingEncryptionService struct {
+	encryption *generic.ServiceWrapper[*recordingencryptionv1.RecordingEncryption]
+	rotatedKey *generic.ServiceWrapper[*recordingencryptionv1.RotatedKey]
+}
+
+var _ services.RecordingEncryption = (*RecordingEncryptionService)(nil)
+
+// NewRecordingEncryptionService creates a new RecordingEncryptionService.
+func NewRecordingEncryptionService(b backend.Backend) (*RecordingEncryptionService, error) {
+	const pageLimit = 100
+	encryption, err := generic.NewServiceWrapper(generic.ServiceConfig[*recordingencryptionv1.RecordingEncryption]{
+		Backend:       b,
+		PageLimit:     pageLimit,
+		ResourceKind:  types.KindRecordingEncryption,
+		BackendPrefix: backend.NewKey(recordingEncryptionPrefix),
+		MarshalFunc:   services.MarshalProtoResource[*recordingencryptionv1.RecordingEncryption],
+		UnmarshalFunc: services.UnmarshalProtoResource[*recordingencryptionv1.RecordingEncryption],
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rotatedKey, err := generic.NewServiceWrapper(generic.ServiceConfig[*recordingencryptionv1.RotatedKey]{
+		Backend:       b,
+		PageLimit:     pageLimit,
+		ResourceKind:  types.KindRotatedKey,
+		BackendPrefix: backend.NewKey(rotatedKeyPrefix),
+		MarshalFunc:   services.MarshalProtoResource[*recordingencryptionv1.RotatedKey],
+		UnmarshalFunc: services.UnmarshalProtoResource[*recordingencryptionv1.RotatedKey],
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &RecordingEncryptionService{
+		encryption: encryption,
+		rotatedKey: rotatedKey,
+	}, nil
+}
+
+// CreateRecordingEncryption creates a new RecordingEncryption in the backend.
+func (s *RecordingEncryptionService) CreateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
+	if encryption.Metadata == nil {
+		encryption.Metadata = &headerv1.Metadata{}
+	}
+	encryption.Metadata.Name = types.MetaNameRecordingEncryption
+	encryption.Kind = types.KindRecordingEncryption
+	created, err := s.encryption.CreateResource(ctx, encryption)
+	return created, trace.Wrap(err)
+}
+
+// UpdateRecordingEncryption replaces the RecordingEncryption resource with the given one.
+func (s *RecordingEncryptionService) UpdateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
+	if encryption.Metadata == nil {
+		encryption.Metadata = &headerv1.Metadata{}
+	}
+	encryption.Metadata.Name = types.MetaNameRecordingEncryption
+	encryption.Kind = types.KindRecordingEncryption
+	updated, err := s.encryption.ConditionalUpdateResource(ctx, encryption)
+	return updated, trace.Wrap(err)
+}
+
+// DeleteRecordingEncryption removes the RecordingEncryption from the cluster.
+func (s *RecordingEncryptionService) DeleteRecordingEncryption(ctx context.Context) error {
+	return trace.Wrap(s.encryption.DeleteResource(ctx, types.MetaNameRecordingEncryption))
+}
+
+// GetRecordingEncryption retrieves the RecordingEncryption for the cluster.
+func (s *RecordingEncryptionService) GetRecordingEncryption(ctx context.Context) (*recordingencryptionv1.RecordingEncryption, error) {
+	encryption, err := s.encryption.GetResource(ctx, types.MetaNameRecordingEncryption)
+	return encryption, trace.Wrap(err)
+}
+
+// CreateRotatedKey creates a new RotatedKey in the backend keyed on the fingerprint of the given public key.
+func (s *RecordingEncryptionService) CreateRotatedKey(ctx context.Context, key *types.EncryptionKeyPair) (*recordingencryptionv1.RotatedKey, error) {
+	parsed, err := x509.ParsePKIXPublicKey(key.PublicKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	fp, err := recordingencryption.Fingerprint(parsed)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	created, err := s.rotatedKey.CreateResource(ctx, &recordingencryptionv1.RotatedKey{
+		Metadata: &headerv1.Metadata{
+			Name: fp,
+		},
+		Kind: types.KindRotatedKey,
+		Spec: &recordingencryptionv1.RotatedKeySpec{
+			EncryptionKeyPair: key,
+		},
+	})
+	return created, trace.Wrap(err)
+}
+
+// GetRotatedKey retrieves the RotatedKey related to the given public key fingerprint from the backend.
+func (s *RecordingEncryptionService) GetRotatedKey(ctx context.Context, fingerprint string) (*recordingencryptionv1.RotatedKey, error) {
+	rotatedKey, err := s.rotatedKey.GetResource(ctx, fingerprint)
+	return rotatedKey, trace.Wrap(err)
+}
+
+// DeleteRotatedKey removes the RotatedKey related with the given public key fingerprint from the backend.
+func (s *RecordingEncryptionService) DeleteRotatedKey(ctx context.Context, fingerprint string) error {
+	return trace.Wrap(s.rotatedKey.DeleteResource(ctx, fingerprint))
+}
+
+type recordingEncryptionParser struct {
+	baseParser
+}
+
+func newRecordingEncryptionParser() *recordingEncryptionParser {
+	return &recordingEncryptionParser{
+		baseParser: newBaseParser(backend.NewKey(recordingEncryptionPrefix)),
+	}
+}
+
+func (p *recordingEncryptionParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpPut:
+		recordingEncryption, err := services.UnmarshalProtoResource[*recordingencryptionv1.RecordingEncryption](
+			event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "unmarshaling resource from event")
+		}
+		return types.Resource153ToLegacy(recordingEncryption), nil
+	case types.OpDelete:
+		return &types.ResourceHeader{
+			Kind:    types.KindRecordingEncryption,
+			Version: types.V1,
+			Metadata: types.Metadata{
+				Name: types.MetaNameRecordingEncryption,
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
+
+type rotatedKeyParser struct {
+	baseParser
+}
+
+func newRotatedKeyParser() *rotatedKeyParser {
+	return &rotatedKeyParser{
+		baseParser: newBaseParser(backend.NewKey(rotatedKeyPrefix)),
+	}
+}
+
+func (p *rotatedKeyParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpPut:
+		rotatedKey, err := services.UnmarshalProtoResource[*recordingencryptionv1.RotatedKey](
+			event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "unmarshaling resource from event")
+		}
+
+		return types.Resource153ToLegacy(rotatedKey), nil
+	case types.OpDelete:
+		header, err := services.UnmarshalProtoResource[*headerv1.ResourceHeader](
+			event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "unmarshaling deleted resource header")
+		}
+		return types.Resource153ToLegacy(header), nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
diff --git a/lib/services/local/recording_encryption_test.go b/lib/services/local/recording_encryption_test.go
new file mode 100644
index 0000000000000..5cdcc75afc886
--- /dev/null
+++ b/lib/services/local/recording_encryption_test.go
@@ -0,0 +1,182 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/recordingencryption"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+)
+
+func TestRecordingEncryption(t *testing.T) {
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	service, err := NewRecordingEncryptionService(backend.NewSanitizer(bk))
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	initialEncryption := pb.RecordingEncryption{
+		Spec: &pb.RecordingEncryptionSpec{
+			ActiveKeyPairs: nil,
+		},
+	}
+
+	// get should fail when there's no recording encryption
+	_, err = service.GetRecordingEncryption(ctx)
+	require.Error(t, err)
+
+	created, err := service.CreateRecordingEncryption(ctx, &initialEncryption)
+	require.NoError(t, err)
+
+	encryption, err := service.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+
+	require.Empty(t, created.Spec.ActiveKeyPairs)
+	require.Empty(t, encryption.Spec.ActiveKeyPairs)
+
+	encryption.Spec.ActiveKeyPairs = []*pb.KeyPair{
+		{
+			KeyPair: &types.EncryptionKeyPair{
+				PrivateKey: []byte("recording encryption private"),
+				PublicKey:  []byte("recording encryption public"),
+				Hash:       0,
+			},
+		},
+	}
+
+	updated, err := service.UpdateRecordingEncryption(ctx, encryption)
+	require.NoError(t, err)
+	require.Len(t, updated.Spec.ActiveKeyPairs, 1)
+	require.EqualExportedValues(t, encryption.Spec.ActiveKeyPairs[0], updated.Spec.ActiveKeyPairs[0])
+
+	encryption, err = service.GetRecordingEncryption(ctx)
+	require.NoError(t, err)
+	require.Len(t, encryption.Spec.ActiveKeyPairs, 1)
+	require.EqualExportedValues(t, updated.Spec.ActiveKeyPairs[0], encryption.Spec.ActiveKeyPairs[0])
+
+	err = service.DeleteRecordingEncryption(ctx)
+	require.NoError(t, err)
+	_, err = service.GetRecordingEncryption(ctx)
+	require.Error(t, err)
+}
+
+func TestRotatedKeys(t *testing.T) {
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	service, err := NewRecordingEncryptionService(backend.NewSanitizer(bk))
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	privateKey, err := keys.ParsePrivateKey(testRSA4096PrivateKeyPEM)
+	require.NoError(t, err)
+	publicKey := privateKey.Public()
+
+	fingerprint, err := recordingencryption.Fingerprint(publicKey)
+	require.NoError(t, err)
+
+	publicKeyDER, err := x509.MarshalPKIXPublicKey(publicKey)
+	require.NoError(t, err)
+
+	// get should fail when there's no rotated key
+	_, err = service.GetRotatedKey(ctx, fingerprint)
+	require.Error(t, err)
+
+	created, err := service.CreateRotatedKey(ctx, &types.EncryptionKeyPair{
+		PrivateKey:     testRSA4096PrivateKeyPEM,
+		PublicKey:      publicKeyDER,
+		PrivateKeyType: types.PrivateKeyType_RAW,
+	})
+	require.NoError(t, err)
+	require.Equal(t, testRSA4096PrivateKeyPEM, created.Spec.EncryptionKeyPair.PrivateKey)
+	require.Equal(t, publicKeyDER, created.Spec.EncryptionKeyPair.PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, created.Spec.EncryptionKeyPair.PrivateKeyType)
+
+	rotatedKey, err := service.GetRotatedKey(ctx, fingerprint)
+	require.NoError(t, err)
+
+	require.Equal(t, testRSA4096PrivateKeyPEM, rotatedKey.Spec.EncryptionKeyPair.PrivateKey)
+	require.Equal(t, publicKeyDER, rotatedKey.Spec.EncryptionKeyPair.PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, rotatedKey.Spec.EncryptionKeyPair.PrivateKeyType)
+
+	err = service.DeleteRotatedKey(ctx, fingerprint)
+	require.NoError(t, err)
+	_, err = service.GetRotatedKey(ctx, fingerprint)
+	require.Error(t, err)
+}
+
+var testRSA4096PrivateKeyPEM = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAwkUne5dEkxnKL825MRCoz2SjGTiD8Xat8mZSrD1N8XiEf0yE
+ocNwdQ3JuJFruIyzrHiMWEuutW2bN/vG6CxET6QUT0WUN67xBnjT4rt/Xbf5W7vI
+fHdmxvFZYVmboTQW4jFxAJt1AnzKDqPakLdLx7wsbs96z47aagS94Vhh0tGq5QsJ
+HbfLVLK7DbEmKbgmYX3Lw7rg89xwDC638O+h/pmPyZbVYvFD7aCbuq4L8otaXt8s
+YqJXAjx4Wmk4bQxz3HXKZ+2YRobRP18aSt+AT7/vswN1dpLIL0XmpDv9Ic4tmHmR
+nF0jcfzWuGt4iJ1Ru3M0xBAPnKW56Q5MA6V2t3peOpNM0xbaZ4mzn85Uyg3z2sFu
+YKvCmg+UDvzVpewmuxKR41slGfEm5a42CCv7rt7w+0lRLG4aFsD6Hy4il4Ur1HHW
+KOKxZX8bdvhhybW5hQKVeqcGVOCqKK5bsuhEd3CQzlCjU4G01/z+5nL2EXKFQZsU
+Uo8qIwDF9Zt6yPfW32nU54UMBVCx51o/RavqvRJ4+SOF7HmY0BXuXrBYShDWtbbc
+jmNBSEyfiSnmbxwVQfgJ09L2xVWXRLf0wz2JaLxQ5WaOgaw8XKci9hkNoZVXcq7d
+4rqRcpEfALxXabRQqtt8aMu8clcGWfjdtxZ5vGwAzOm9V7+Mz3j4ysUUm58CAwEA
+AQKCAgB0ksa0dPrjQlB/CvWbqaGCgaMVGUKjfFG46Qmm7Up+IZFwSdw0rXAn7VQk
+eq6nGVcfoV6mBRQbLmA74ctjulxrZcwCHYBpQYLEHXEX1ucAt8rb7vzJI2T68Axw
+TDMFMpqgtIZYlPBLw9IDovMeb777ZcFL5RiOv+v0PlAqjrx0ovfnZQ3dVVKfynhQ
+KQL7edMeITxKgTNHYfmidc5Ot5z/h+ouT2JQcvIN/5gzFwl4S4K49zZNIZkQcHTP
+29/OH/DOU6hXYM1FVNTvMAQ49ZCrSkNtqh+sPTv+kfVqi8zDolLd8eUcbQ898Thv
+hZ3YbH6E+waot/KGTzQV00xty7ZGK3Lb7c4CmTcX80lb2YFemxwkIXRwC3uqmr/y
+gajyLGnFE8Pu92WAP2fiPEfwqXtekew3TtBC+psFRQF+Y15myfyhndNR/qtFPSvB
+ooWeZQVUU/o0solCE6q/b1uyQxpZK/Z/GJewmtI3tfkDmTGADCeH4O+sPNtmO6xN
+GSmctHPQyE+u2lNp+WCGVS+vbwFct9guMQEvVM5CBU1/mmOKeaNJOl4N6mj7GuqN
+R5tQ1suOLlzsAOeCrVDTdpiQfx2UfDNKPk9wv2yu/tTBbOwHfxEUT+EiUrEXKrUI
+n5DR14HJ+qnQNOk5sZUJ7G4ISZO0voSXeJJOguMGwaXajjbK8QKCAQEA4P39m4k2
+uv1LAspsELKvfJEaGdNaUAiHeQGK2co/S53p11/gx7D+EX7yJtVfp/nka/kZruzt
+PiIb4nNIkY2giEMVoGYqOWQsLWUbIH70apqUBi+h1qs7RuIW+JaAE3e45gq/dguv
++w2CSNS+lcV/3laFDP80npg1y/RgKuacke+1Bfu0O/qrrJOTAh7cvbWiBQyRsDqQ
+yhVb9L49fjhSSNHajU97ybKPXQ9w7zcFrpSaz5Or4mBl027vscJ3i2euabPINGmj
+bSe32QUO1UzW8YTNGYlVZrfUYz7AvSZ1tr/Kf7/drf1kIBx/WiyyaDCyMqS4Slwb
+ZjVoxKidFjtfpQKCAQEA3QtAcI7rMjrRO8SBkKFcZ14LY3iyLO/k5oVOa+ePQ8WR
+rHUUxLdAixgnlEdUVgxjZG78zpAi8VUbvjUooMuHKXcaEWVEmfuNz+PAiImu/HxS
+EBsPKjqZgpNcDMwnQ8yMFsiX2YUGuvXMkcaZbkHqWOHOCXhUeXVG4HZxboEMgArh
++bYhruP9G3NpuVRDFCQGq1RiFCPKQlyZMtvCGl694GE5EsWWglaPWkJGzGuT9hlq
+fQCQB+UunYO1xmNpIn0MX0vKySu8SUdMp3NtDcqUVDf3t2EqoPe4OCJJ4z4D7+Xi
+HO6wOs8raWXajumLMxU/LCLmR291eGHy/yuvDlzq8wKCAQEAxFYgx2e38Pk0Sh0m
+rHOhm8xrwHmlaA3pWnk0F9Xb4jrNYvryBpC3RcFHwweUT9tLr8VS2kk6xmuxda0w
+eIPkwMP5zV0aH7cAriR6xaLD23tFDRjn25LVSYfmj8uVvGdPXL+oUHTmfuhM9w1f
+uwb8DKPnu23BF1ywJWj9urI/k0Jg7/W0VFrtEM4/DSytaIdl+Y38XJLe4to8wph4
+xPqVI6KtW38vANXnMUhWPwn+1VgsuFOfPQ7uDNHULYUMGQTDOM6AOOyuhoSQdLtr
+NEu3jk9bQ5uKgPaOSoTqYKV9N5qqNUzTQA/NHhCAOcqjbTSBbJw9jfZOmqSk5mhV
+nJ73WQKCAQEA0CnGd7m/+L+3R4fZVHEBaj8Ajp6dfQA2Gnkzzx50pqgqdbSU6GSD
+HfqTW2qJG7fy6iQzY/wNTCSQSeIZ7sN8+Cm3nOY3YqOpezvKl0rCRfh198Dj2Sry
+YiuQJmUkHQ9GZjZl+mzyV6MfEbFr0I+2uBl+RSDSvMcbBkvEqwJQ2UxmXxmMQv1l
+4TIhQGz/9rmupi6DZuAFm9VEWMbn1pmeSu6EJw94nCoUOjXsIpq07rAkvq+G9Eh6
+S9A7oScBXX9R5XSk9ip/2KqSn6dt7ez3HxDN8h5JXOmszQBNgPloD8X32LNXtype
+gZVv6+I4OtUpdtEu99sZT1M+2dszsl0CzQKCAQAHfAGLuGg9cwCbcH41H9HHj2du
+/B+C20AZzUHZVDjYaKWJVZuxVZrWaogsPrarmxgbXrnsQwINugVtA/+OETQ466D6
+Re6osCSpPeQtHLJBrVkcp+Wqv2oWbiSeyNQduZLQ01Kp698p6Ytw5Ns0x40hVBKq
+vaN6ewsznUZWAzmscJweTOTQTrks46eTJy0jckd/0CHcqrVV9c5UuSMy1StXpBsm
+dWw2AGVtikZzY/BI4g/d2efNM0Yg+QTuehqBmQr6UX+mmT74egolafEkI52g6Vg+
+Xf6bcJnKeYqP0rVR377Ge6riSt1cyNwNFMY9VCWjk2YFK2PfT65+QXMI7yTi
+-----END RSA PRIVATE KEY-----`)
diff --git a/lib/services/local/resource_test.go b/lib/services/local/resource_test.go
index 65c17006951b2..c067fa380bfce 100644
--- a/lib/services/local/resource_test.go
+++ b/lib/services/local/resource_test.go
@@ -34,7 +34,6 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 )
 
 func TestCreateResourcesProvisionToken(t *testing.T) {
@@ -145,8 +144,8 @@ func TestCertAuthorityResource(t *testing.T) {
 	ctx := context.Background()
 	tt := setupServicesContext(ctx, t)
 
-	userCA := suite.NewTestCA(types.UserCA, "example.com")
-	hostCA := suite.NewTestCA(types.HostCA, "example.com")
+	userCA := NewTestCA(types.UserCA, "example.com")
+	hostCA := NewTestCA(types.HostCA, "example.com")
 
 	// Check basic dynamic item creation
 	err := CreateResources(ctx, tt.bk, userCA, hostCA)
diff --git a/lib/services/local/saml_idp_service_provider_test.go b/lib/services/local/saml_idp_service_provider_test.go
index 47dbe4982029e..9e8a7ceb4a642 100644
--- a/lib/services/local/saml_idp_service_provider_test.go
+++ b/lib/services/local/saml_idp_service_provider_test.go
@@ -37,7 +37,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	preset "github.com/gravitational/teleport/api/types/samlsp"
 	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -592,6 +591,64 @@ func TestCreateSAMLIdPServiceProvider_GetTeleportSPSSODescriptor(t *testing.T) {
 	require.Equal(t, 3, index)
 }
 
+// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_AwsIc settings.
+func NewIdentityCenterPlugin(serviceProviderName, integrationName string) *types.PluginV1 {
+	return &types.PluginV1{
+		Metadata: types.Metadata{
+			Name: types.PluginTypeAWSIdentityCenter,
+			Labels: map[string]string{
+				types.HostedPluginLabel: "true",
+			},
+		},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_AwsIc{
+				AwsIc: &types.PluginAWSICSettings{
+					IntegrationName:         integrationName,
+					Region:                  "test-region",
+					Arn:                     "test-arn",
+					AccessListDefaultOwners: []string{"user1", "user2"},
+					ProvisioningSpec: &types.AWSICProvisioningSpec{
+						BaseUrl: "https://example.com",
+					},
+					SamlIdpServiceProviderName: serviceProviderName,
+				},
+			},
+		},
+	}
+}
+
+// NewIdentityCenterPlugin returns a new types.PluginV1 with PluginSpecV1_Mattermost settings.
+func NewMattermostPlugin() *types.PluginV1 {
+	return &types.PluginV1{
+		SubKind: types.PluginSubkindAccess,
+		Metadata: types.Metadata{
+			Labels: map[string]string{
+				"teleport.dev/hosted-plugin": "true",
+			},
+			Name: types.PluginTypeMattermost,
+		},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_Mattermost{
+				Mattermost: &types.PluginMattermostSettings{
+					ServerUrl:     "https://example.com",
+					Channel:       "test_channel",
+					Team:          "test_team",
+					ReportToEmail: "test@example.com",
+				},
+			},
+		},
+		Credentials: &types.PluginCredentialsV1{
+			Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
+				StaticCredentialsRef: &types.PluginStaticCredentialsRef{
+					Labels: map[string]string{
+						"plugin": "mattermost",
+					},
+				},
+			},
+		},
+	}
+}
+
 func TestDeleteSAMLServiceProviderWhenReferencedByPlugin(t *testing.T) {
 	ctx := context.Background()
 	backend, err := memory.New(memory.Config{
@@ -615,13 +672,13 @@ func TestDeleteSAMLServiceProviderWhenReferencedByPlugin(t *testing.T) {
 	require.NoError(t, samlService.CreateSAMLIdPServiceProvider(ctx, sp))
 
 	// service provider should not be deleted when referenced by the plugin.
-	require.NoError(t, pluginService.CreatePlugin(ctx, fixtures.NewIdentityCenterPlugin(t, sp.GetName(), sp.GetName())))
+	require.NoError(t, pluginService.CreatePlugin(ctx, NewIdentityCenterPlugin(sp.GetName(), sp.GetName())))
 	err = samlService.DeleteSAMLIdPServiceProvider(ctx, sp.GetName())
 	require.ErrorContains(t, err, "referenced by AWS Identity Center integration")
 
 	// service provider should be deleted once the referenced plugin itself is deleted.
 	// other existing plugin should not prevent SAML service provider from deletion.
-	require.NoError(t, pluginService.CreatePlugin(ctx, fixtures.NewMattermostPlugin(t)))
+	require.NoError(t, pluginService.CreatePlugin(ctx, NewMattermostPlugin()))
 	require.NoError(t, pluginService.DeletePlugin(ctx, types.PluginTypeAWSIdentityCenter))
 	require.NoError(t, samlService.DeleteSAMLIdPServiceProvider(ctx, sp.GetName()))
 }
diff --git a/lib/services/local/scoped_access.go b/lib/services/local/scoped_access.go
new file mode 100644
index 0000000000000..b2e4485f20435
--- /dev/null
+++ b/lib/services/local/scoped_access.go
@@ -0,0 +1,850 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package local
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"github.com/gravitational/teleport"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// scoped role and assignment state is modeled with the following key ranges:
+//
+//  - `/scoped_role/role/<role-name>`             (the location of the role resource, stored at author-chosen name)
+//  - `/scoped_role/assignment/<assignment-name>` (the assignment resource itself, always stored at a random UUID)
+//  - `/scoped_role/user_lock/<username>`         (a value that is randomized each time associated user's assignments are modified)
+//  - `/scoped_role/role_lock/<role-name>`        (a value that is randomized each time associated role's assignments are modified)
+//
+// These four key ranges allow for efficient management of roles and assignmments atomically. Assignments are stored homogenously,
+// but the provided lock values make it easy for backend operations to assert that the assignments related to a given user/role
+// are not concurrently changed, indepdnent of the total number of assignments or the number of roles they effect (each assignment
+// may assign multiple roles). Cleanup of role locks is the responsibility of the DeleteScopedRole operation, and cleanup of user locks
+// is the responsibility of the DeleteScopedRoleAssignment operation.
+//
+// NOTE: this model does not provide means of making one assignment invalidate another (e.g. in the case of OIDC assignments,
+// for which only one should be valid at a time), and does not invalidate assignments on user deletion.
+
+const (
+	scopedRolePrefix              = "scoped_role"
+	scopedRoleRoleComponent       = "role"
+	scopedRoleAssignmentComponent = "assignment"
+	userAssignmentLockComponent   = "user_lock"
+	roleAssignmentLockComponent   = "role_lock"
+)
+
+// ScopedAccessService manages backend state for the ScopedRole and ScopedRoleAssignment types.
+type ScopedAccessService struct {
+	bk     backend.Backend
+	logger *slog.Logger
+}
+
+// NewScopedAccessService creates a new ScopedAccessService for the specified backend.
+func NewScopedAccessService(bk backend.Backend) *ScopedAccessService {
+	return &ScopedAccessService{
+		bk:     bk,
+		logger: slog.With(teleport.ComponentKey, "scopedrole"),
+	}
+}
+
+func (s *ScopedAccessService) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	if req.GetName() == "" {
+		return nil, trace.BadParameter("missing scoped role name in get request")
+	}
+
+	item, err := s.bk.Get(ctx, scopedRoleKey(req.GetName()))
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return nil, trace.NotFound("scoped role %q not found", req.GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	role, err := scopedRoleFromItem(item)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := scopedaccess.WeakValidateRole(role); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.GetScopedRoleResponse{
+		Role: role,
+	}, nil
+}
+
+// ListScopedRoles returns a paginated list of scoped roles.
+// NOTE: this method is only used by local auth caches, and doesn't implement sorting, filtering, or pagination.
+func (s *ScopedAccessService) ListScopedRoles(ctx context.Context, req *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
+	if req.GetResourceScope() != nil {
+		return nil, trace.NotImplemented("filtering by resource scope is not implemented for direct backend scoped role reads")
+	}
+
+	if req.GetAssignableScope() != nil {
+		return nil, trace.NotImplemented("filtering by assignable scope is not implemented for direct backend scoped role reads")
+	}
+
+	if req.GetPageToken() != "" {
+		return nil, trace.NotImplemented("pagination is not implemented for direct backend scoped role reads")
+	}
+
+	var out []*scopedaccessv1.ScopedRole
+	for role, err := range s.StreamScopedRoles(ctx) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		out = append(out, role)
+	}
+
+	return &scopedaccessv1.ListScopedRolesResponse{
+		Roles: out,
+	}, nil
+}
+
+// StreamScopedRoles returns a stream of all scoped roles in the backend. Malformed roles are skipped. Returned roles
+// have had weak validation applied.
+func (s *ScopedAccessService) StreamScopedRoles(ctx context.Context) stream.Stream[*scopedaccessv1.ScopedRole] {
+	return func(yield func(*scopedaccessv1.ScopedRole, error) bool) {
+		startKey := scopedRoleKey("")
+		params := backend.ItemsParams{
+			StartKey: startKey,
+			EndKey:   backend.RangeEnd(startKey),
+		}
+
+		for item, err := range s.bk.Items(ctx, params) {
+			if err != nil {
+				// backend errors terminate the stream
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			role, err := scopedRoleFromItem(&item)
+			if err != nil {
+				// per-role errors are logged and skipped
+				s.logger.WarnContext(ctx, "skipping scoped role due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+				continue
+			}
+
+			if err := scopedaccess.WeakValidateRole(role); err != nil {
+				// per-role errors are logged and skipped
+				s.logger.WarnContext(ctx, "skipping scoped role due to validation error", "error", err, "key", logutils.StringerAttr(item.Key))
+				continue
+			}
+
+			if !yield(role, nil) {
+				return
+			}
+		}
+	}
+}
+
+func (s *ScopedAccessService) CreateScopedRole(ctx context.Context, req *scopedaccessv1.CreateScopedRoleRequest) (*scopedaccessv1.CreateScopedRoleResponse, error) {
+	role := req.GetRole()
+	if role == nil {
+		return nil, trace.BadParameter("missing scoped role in create request")
+	}
+
+	if err := scopedaccess.StrongValidateRole(role); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	item, err := scopedRoleToItem(role)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// we make efforts elsewhere to ensure that roles cannot be deleted s.t. they leave behind dangling assignments,
+	// but it is best to be absolutely certain about that.
+	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(role.GetMetadata().GetName()))
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+		lockItem = nil
+	}
+
+	lockCondition := backend.NotExists()
+	if lockItem != nil {
+		lockCondition = backend.Revision(lockItem.Revision)
+		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+				if subAssignment.GetRole() != role.GetMetadata().GetName() {
+					continue
+				}
+
+				// an assignment already exists referencing this role, we need to check if that is because
+				// a role with this name exists, or because the assignment is dangling.
+				_, err = s.bk.Get(ctx, scopedRoleKey(role.GetMetadata().GetName()))
+				if err != nil {
+					if !trace.IsNotFound(err) {
+						return nil, trace.Wrap(err)
+					}
+					// this is a dangling assignment, we need to return an error
+					return nil, trace.CompareFailed("cannot create scoped role %q while extant assignment %q references it", role.GetMetadata().GetName(), assignment.GetMetadata().GetName())
+				}
+				return nil, trace.CompareFailed("scoped role %q already exists", role.GetMetadata().GetName())
+			}
+		}
+	}
+
+	revision, err := s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
+		{
+			Key:       item.Key,
+			Condition: backend.NotExists(),
+			Action:    backend.Put(item),
+		},
+		{
+			Key:       roleAssignmentLockKey(role.GetMetadata().GetName()),
+			Condition: lockCondition,
+			Action:    backend.Nop(), // assignments update the lock, roles just assert that it is unchanged
+		},
+	})
+	if err != nil {
+		if errors.Is(err, backend.ErrConditionFailed) {
+			return nil, trace.CompareFailed("scoped role %q or an associated assignment already exist", role.GetMetadata().GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.CreateScopedRoleResponse{
+		Role: scopedRoleWithRevision(role, revision),
+	}, nil
+}
+
+func (s *ScopedAccessService) UpdateScopedRole(ctx context.Context, req *scopedaccessv1.UpdateScopedRoleRequest) (*scopedaccessv1.UpdateScopedRoleResponse, error) {
+	role := req.GetRole()
+	if role == nil {
+		return nil, trace.BadParameter("missing scoped role in update request")
+	}
+
+	if err := scopedaccess.StrongValidateRole(role); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	extant, err := s.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: role.GetMetadata().GetName(),
+	})
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+		return nil, trace.CompareFailed("scoped role %q was deleted", role.GetMetadata().GetName())
+	}
+
+	if role.GetMetadata().GetRevision() != "" && role.GetMetadata().GetRevision() != extant.GetRole().GetMetadata().GetRevision() {
+		return nil, trace.CompareFailed("scoped role %q has been concurrently modified", role.GetMetadata().GetName())
+	}
+
+	// disallow change of resource scope via update. use of scopes.Compare directly is generally discouraged,
+	// but that is due to ease of misuse, which isn't really a concern for a simple equivalence check.
+	if scopes.Compare(role.GetScope(), extant.GetRole().GetScope()) != scopes.Equivalent {
+		// XXX: the current implementation of our access-control logic relies upon this invarient being enforced. if we ever
+		// relax this restriction here we *must* first modify the outer access-control logic to understand the concept of
+		// scope changing and correctly validate the transition.
+		return nil, trace.BadParameter("cannot modify the resource scope of scoped role %q (%q -> %q)", role.GetMetadata().GetName(), extant.GetRole().GetScope(), role.GetScope())
+	}
+
+	// acquire the assignment lock and verify that the update doesn't validate any extant assignments
+	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(role.GetMetadata().GetName()))
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+		lockItem = nil
+	}
+
+	lockCondition := backend.NotExists()
+	if lockItem != nil {
+		lockCondition = backend.Revision(lockItem.Revision)
+		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+				if subAssignment.GetRole() != role.GetMetadata().GetName() {
+					continue
+				}
+
+				if !scopedaccess.RoleIsAssignableAtScope(extant.GetRole(), subAssignment.GetScope()) {
+					// theoretically, we prevent broken assignments. in practice, its best to
+					// assume they may exist and to not allow them to prevent an otherwsie
+					// valid update. We will still force all broken assignments to be
+					// removed at the time of role deletion.
+					continue
+				}
+
+				if !scopedaccess.RoleIsAssignableAtScope(role, subAssignment.GetScope()) {
+					return nil, trace.BadParameter("update of scoped role %q would invalidate assignment %q which assigns it to user %q at scope %q", role.GetMetadata().GetName(), assignment.GetMetadata().GetName(), assignment.GetSpec().GetUser(), subAssignment.GetScope())
+				}
+			}
+		}
+	}
+
+	item, err := scopedRoleToItem(role)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	revision, err := s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
+		{
+			Key:       item.Key,
+			Condition: backend.Revision(item.Revision),
+			Action:    backend.Put(item),
+		},
+		{
+			Key:       roleAssignmentLockKey(role.GetMetadata().GetName()),
+			Condition: lockCondition,
+			Action:    backend.Nop(),
+		},
+	})
+	if err != nil {
+		if errors.Is(err, backend.ErrConditionFailed) {
+			return nil, trace.CompareFailed("scoped role %q or an associated assignment was concurrently modified", role.GetMetadata().GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.UpdateScopedRoleResponse{
+		Role: scopedRoleWithRevision(role, revision),
+	}, nil
+}
+
+func (s *ScopedAccessService) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleRequest) (*scopedaccessv1.DeleteScopedRoleResponse, error) {
+	roleName := req.GetName()
+	if roleName == "" {
+		return nil, trace.BadParameter("missing scoped role name in delete request")
+	}
+
+	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(roleName))
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+		lockItem = nil
+	}
+
+	lockCondition := backend.NotExists()
+	if lockItem != nil {
+		lockCondition = backend.Revision(lockItem.Revision)
+	}
+
+	// now that we have a lock condition established, we can read all assignments with a "happens after" relationship
+	// to the current lock value and verify that no assignments target this role.
+	for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+			if subAssignment.GetRole() == roleName {
+				return nil, trace.CompareFailed("cannot delete scoped role %q while assignment %q assigns it to a user", roleName, assignment.GetMetadata().GetName())
+			}
+		}
+	}
+
+	roleCondition := backend.Exists()
+	if rev := req.GetRevision(); rev != "" {
+		roleCondition = backend.Revision(rev)
+	}
+
+	// atomically delete the role and its associated assignment lock while asserting that no assignments
+	// have been concurrently applied that target this role.
+	_, err = s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
+		{
+			Key:       scopedRoleKey(roleName),
+			Condition: roleCondition,
+			Action:    backend.Delete(),
+		},
+		{
+			Key:       roleAssignmentLockKey(roleName),
+			Condition: lockCondition,
+			Action:    backend.Delete(),
+		},
+	})
+
+	if err != nil {
+		if errors.Is(err, backend.ErrConditionFailed) {
+			return nil, trace.CompareFailed("scoped role %q has been concurrently modified and/or assigned", roleName)
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.DeleteScopedRoleResponse{}, nil
+}
+
+func (s *ScopedAccessService) GetScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error) {
+	assignmentName := req.GetName()
+	if assignmentName == "" {
+		return nil, trace.BadParameter("missing scoped role assignment name in get request")
+	}
+
+	item, err := s.bk.Get(ctx, scopedRoleAssignmentKey(assignmentName))
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return nil, trace.NotFound("scoped role assignment %q not found", assignmentName)
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	assignment, err := scopedRoleAssignmentFromItem(item)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := scopedaccess.WeakValidateAssignment(assignment); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.GetScopedRoleAssignmentResponse{
+		Assignment: assignment,
+	}, nil
+}
+
+// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+// NOTE: this method is only used by local auth caches, and doesn't implement sorting, filtering, or pagination.
+func (s *ScopedAccessService) ListScopedRoleAssignments(ctx context.Context, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error) {
+	if req.GetResourceScope() != nil {
+		return nil, trace.NotImplemented("filtering by resource scope is not implemented for direct backend scoped role assignment reads")
+	}
+
+	if req.GetAssignedScope() != nil {
+		return nil, trace.NotImplemented("filtering by assigned scope is not implemented for direct backend scoped role assignment reads")
+	}
+
+	if req.GetPageToken() != "" {
+		return nil, trace.NotImplemented("pagination is not implemented for direct backend scoped role assignment reads")
+	}
+
+	var out []*scopedaccessv1.ScopedRoleAssignment
+	for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		out = append(out, assignment)
+	}
+
+	return &scopedaccessv1.ListScopedRoleAssignmentsResponse{
+		Assignments: out,
+	}, nil
+}
+
+// StreamScopedRoleAssignments returns a stream of all scoped role assignments in the backend. Malformed assignments are skipped.
+// Returned assignments have had weak validation applied.
+func (s *ScopedAccessService) StreamScopedRoleAssignments(ctx context.Context) stream.Stream[*scopedaccessv1.ScopedRoleAssignment] {
+	return func(yield func(*scopedaccessv1.ScopedRoleAssignment, error) bool) {
+		startKey := scopedRoleAssignmentKey("")
+		params := backend.ItemsParams{
+			StartKey: startKey,
+			EndKey:   backend.RangeEnd(startKey),
+		}
+
+		for item, err := range s.bk.Items(ctx, params) {
+			if err != nil {
+				// backend errors terminate the stream
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			assignment, err := scopedRoleAssignmentFromItem(&item)
+			if err != nil {
+				// per-assignment errors are logged and skipped
+				s.logger.WarnContext(ctx, "skipping scoped role assignment due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+				continue
+			}
+
+			if err := scopedaccess.WeakValidateAssignment(assignment); err != nil {
+				// per-assignment errors are logged and skipped
+				s.logger.WarnContext(ctx, "skipping scoped role assignment due to validation error", "error", err, "key", logutils.StringerAttr(item.Key))
+				continue
+			}
+
+			if !yield(assignment, nil) {
+				return
+			}
+		}
+	}
+}
+
+func (s *ScopedAccessService) CreateScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.CreateScopedRoleAssignmentRequest) (*scopedaccessv1.CreateScopedRoleAssignmentResponse, error) {
+	assignment := req.GetAssignment()
+	if assignment == nil {
+		return nil, trace.BadParameter("missing scoped role assignment in create request")
+	}
+
+	if err := scopedaccess.StrongValidateAssignment(assignment); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// independently enforce the max number of roles per assignment limit here since not all validation
+	// may necessarily enforce it, but it is a hard-limit for the backend impl.
+	if len(assignment.GetSpec().GetAssignments()) > scopedaccess.MaxRolesPerAssignment {
+		return nil, trace.BadParameter("scoped role assignment resource %q contains too many sub-assignments (max %d)", assignment.GetMetadata().GetName(), scopedaccess.MaxRolesPerAssignment)
+	}
+
+	item, err := scopedRoleAssignmentToItem(assignment)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// set up conditional actions for assignment and user lock
+	condacts := []backend.ConditionalAction{
+		{
+			Key:       item.Key,
+			Condition: backend.NotExists(),
+			Action:    backend.Put(item),
+		},
+		{
+			Key:       userAssignmentLockKey(assignment.GetSpec().GetUser()),
+			Condition: backend.Whatever(),
+			Action: backend.Put(backend.Item{
+				Value: newUserAssignmentLockVal(assignment.GetSpec().GetUser()),
+			}),
+		},
+	}
+
+	assertedRoles := make(map[string]struct{})
+
+	// set up conditional actions for each assigned role lock
+	for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+		// operation must verify that all associated roles have not been concurrently modified
+		// as such modification could theoretically invalidate prior access-control checks.
+		roleRevision, ok := req.GetRoleRevisions()[subAssignment.GetRole()]
+		if !ok {
+			// this is a bug in the API layer, we should never be missing a role revision as it should be
+			// filled in with the revision of the role used for the access-control check.
+			return nil, trace.BadParameter("missing role revision for role %q in backend create (this is a bug)", subAssignment.GetRole())
+		}
+
+		rrsp, err := s.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+			Name: subAssignment.GetRole(),
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if rrsp.GetRole().GetMetadata().GetRevision() != roleRevision {
+			return nil, trace.CompareFailed("scoped role %q has been concurrently modified", subAssignment.GetRole())
+		}
+
+		// verify that the role is scoped to the same resource scope as the assignment itself
+		// NOTE: this restriction may eventually be relaxed in favor of something more flexible,
+		// but as of right now we haven't decided what that should look like.
+		if scopes.Compare(rrsp.GetRole().GetScope(), assignment.GetScope()) != scopes.Equivalent {
+			return nil, trace.BadParameter("role %q is not scoped to the same resource scope as assignment %q (%q -> %q)", subAssignment.GetRole(), assignment.GetMetadata().GetName(), rrsp.GetRole().GetScope(), assignment.GetScope())
+		}
+
+		// verify that the role is assignable at the specified scope
+		if !scopedaccess.RoleIsAssignableAtScope(rrsp.GetRole(), subAssignment.GetScope()) {
+			return nil, trace.BadParameter("scoped role %q is not configured to be assignable at scope %q", subAssignment.GetRole(), subAssignment.GetScope())
+		}
+
+		if _, ok := assertedRoles[subAssignment.GetRole()]; ok {
+			// a previous sub-assignment already caused us to assert the revision
+			// of this role, we can skip the assertion/lock update step.
+			continue
+		}
+
+		// assert that role is unchanged and modify associated role lock so that role modifications can
+		// detect concurrent modifications to their assignments.
+		condacts = append(condacts, []backend.ConditionalAction{
+			{
+				Key:       scopedRoleKey(subAssignment.GetRole()),
+				Condition: backend.Revision(roleRevision),
+				Action:    backend.Nop(),
+			},
+			{
+				Key:       roleAssignmentLockKey(subAssignment.GetRole()),
+				Condition: backend.Whatever(),
+				Action: backend.Put(backend.Item{
+					Value: newRoleAssignmentLockVal(subAssignment.GetRole()),
+				}),
+			},
+		}...)
+
+		assertedRoles[subAssignment.GetRole()] = struct{}{}
+	}
+
+	revision, err := s.bk.AtomicWrite(ctx, condacts)
+	if err != nil {
+		if errors.Is(err, backend.ErrConditionFailed) {
+			// return a general concurrent-modification error since it isn't clear which condition faile
+			return nil, trace.CompareFailed("scoped role assignment %q failed due to concurrent modification of associated resources", assignment.GetMetadata().GetName())
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.CreateScopedRoleAssignmentResponse{
+		Assignment: scopedRoleAssignmentWithRevision(assignment, revision),
+	}, nil
+}
+
+func (s *ScopedAccessService) DeleteScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleAssignmentRequest) (*scopedaccessv1.DeleteScopedRoleAssignmentResponse, error) {
+	assignmentName := req.GetName()
+	if assignmentName == "" {
+		return nil, trace.BadParameter("missing scoped role assignment name in delete request")
+	}
+
+	extant, err := s.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: assignmentName,
+	})
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return nil, trace.CompareFailed("scoped role assignment %q was concurrently delete", assignmentName)
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	if rev := req.GetRevision(); rev != "" && rev != extant.Assignment.GetMetadata().GetRevision() {
+		return nil, trace.CompareFailed("scoped role assignment %q has been concurrently modified", assignmentName)
+	}
+
+	// check to see if we have a lock on the user. if so, we need to check to see if we're the last assignment
+	// relying on the lock. if we are, we can delete it.
+	userLockItem, err := s.bk.Get(ctx, userAssignmentLockKey(extant.Assignment.GetSpec().GetUser()))
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err)
+		}
+		userLockItem = nil
+	}
+
+	// start with initial condition assuming non-existence. note that this really should never happen unless
+	// we have a bug somewhere else, but there isn't really a downside to being resilient to it.
+	userLockCondition := backend.NotExists()
+	userLockAction := backend.Nop()
+	if userLockItem != nil {
+		userLockCondition = backend.Revision(userLockItem.Revision)
+		userLockAction = backend.Put(backend.Item{
+			Value: newUserAssignmentLockVal(extant.Assignment.GetSpec().GetUser()),
+		})
+
+		// check to see if we're the last assignment relying on the user lock. if so, we should delete it.
+		var hasOtherAssignments bool
+		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if assignment.GetSpec().GetUser() != extant.Assignment.GetSpec().GetUser() {
+				// skip assignments related to other users
+				continue
+			}
+			if assignment.GetMetadata().GetName() == extant.Assignment.GetMetadata().GetName() {
+				// skip the assignment we're currently deleting
+				continue
+			}
+
+			// found another assignment for the same user
+			hasOtherAssignments = true
+			break
+		}
+
+		if !hasOtherAssignments {
+			// no other assignments for this user, we can delete the lock
+			userLockAction = backend.Delete()
+		}
+	}
+
+	condacts := []backend.ConditionalAction{
+		{
+			Key:       scopedRoleAssignmentKey(assignmentName),
+			Condition: backend.Revision(extant.Assignment.GetMetadata().GetRevision()),
+			Action:    backend.Delete(),
+		},
+		{
+			Key:       userAssignmentLockKey(extant.Assignment.GetSpec().GetUser()),
+			Condition: userLockCondition,
+			Action:    userLockAction,
+		},
+	}
+
+	lockedRoles := make(map[string]struct{})
+
+	for _, subAssignment := range extant.Assignment.GetSpec().GetAssignments() {
+
+		if _, ok := lockedRoles[subAssignment.GetRole()]; ok {
+			// a previous sub-assignment already caused us to update the lock
+			// of this role, we can skip this update step.
+			continue
+		}
+
+		// operation must modify all associated role locks to ensure that role operations can
+		// efficiently assert that no assigment related to the role has changed.
+		condacts = append(condacts, backend.ConditionalAction{
+			Key:       roleAssignmentLockKey(subAssignment.GetRole()),
+			Condition: backend.Whatever(),
+			Action: backend.Put(backend.Item{
+				Value: newRoleAssignmentLockVal(subAssignment.GetRole()),
+			}),
+		})
+
+		lockedRoles[subAssignment.GetRole()] = struct{}{}
+	}
+
+	if _, err := s.bk.AtomicWrite(ctx, condacts); err != nil {
+		if errors.Is(err, backend.ErrConditionFailed) {
+			return nil, trace.CompareFailed("scoped role assignment %q or another related assignment was concurrently modified", assignmentName)
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	return &scopedaccessv1.DeleteScopedRoleAssignmentResponse{}, nil
+}
+
+func scopedRoleKey(roleName string) backend.Key {
+	return backend.NewKey(scopedRolePrefix, scopedRoleRoleComponent, roleName)
+}
+
+func scopedRoleWatchPrefix() backend.Key {
+	return backend.ExactKey(scopedRolePrefix, scopedRoleRoleComponent)
+}
+
+func scopedRoleAssignmentKey(assignmentID string) backend.Key {
+	return backend.NewKey(scopedRolePrefix, scopedRoleAssignmentComponent, assignmentID)
+}
+
+func scopedRoleAssignmentWatchPrefix() backend.Key {
+	return backend.ExactKey(scopedRolePrefix, scopedRoleAssignmentComponent)
+}
+
+func userAssignmentLockKey(username string) backend.Key {
+	return backend.NewKey(scopedRolePrefix, userAssignmentLockComponent, username)
+}
+
+func roleAssignmentLockKey(roleName string) backend.Key {
+	return backend.NewKey(scopedRolePrefix, roleAssignmentLockComponent, roleName)
+}
+
+// newUserAssignmentLockVal generates a new user assignment lock value for the specified username. A random
+// element is used to ensure that the lock value changes for each operation that changes assignments.
+func newUserAssignmentLockVal(username string) []byte {
+	return []byte(rand.Text() + "-" + username)
+}
+
+// newRoleAssignmentLockVal generates a new role assignment lock value for the specified role name. A random
+// element is used to ensure that the lock value changes for each operation that changes assignments.
+func newRoleAssignmentLockVal(roleName string) []byte {
+	return []byte(rand.Text() + "-" + roleName)
+}
+
+func scopedRoleFromItem(item *backend.Item) (*scopedaccessv1.ScopedRole, error) {
+	var role scopedaccessv1.ScopedRole
+	if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(item.Value, &role); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if role.GetMetadata() == nil {
+
+		return nil, trace.BadParameter("role at %q is critically malformed (missing metadata)", item.Key)
+	}
+
+	role.Metadata.Revision = item.Revision
+	role.Metadata.Expires = utils.TimeIntoProto(item.Expires)
+	return &role, nil
+}
+
+func scopedRoleToItem(role *scopedaccessv1.ScopedRole) (backend.Item, error) {
+	if role.GetMetadata() == nil {
+		return backend.Item{}, trace.BadParameter("missing metadata in scoped role")
+	}
+
+	if role.GetMetadata().Expires != nil {
+		return backend.Item{}, trace.BadParameter("scoped roles do not support expiration")
+	}
+
+	data, err := protojson.Marshal(role)
+	if err != nil {
+		return backend.Item{}, trace.Wrap(err)
+	}
+
+	return backend.Item{
+		Key:      scopedRoleKey(role.GetMetadata().GetName()),
+		Value:    data,
+		Revision: role.GetMetadata().GetRevision(),
+	}, nil
+}
+
+func scopedRoleAssignmentFromItem(item *backend.Item) (*scopedaccessv1.ScopedRoleAssignment, error) {
+	var assignment scopedaccessv1.ScopedRoleAssignment
+	if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(item.Value, &assignment); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if assignment.GetMetadata() == nil {
+		return nil, trace.BadParameter("assignment at %q is critically malformed (missing metadata)", item.Key)
+	}
+
+	assignment.Metadata.Revision = item.Revision
+	assignment.Metadata.Expires = utils.TimeIntoProto(item.Expires)
+	return &assignment, nil
+}
+
+func scopedRoleAssignmentToItem(assignment *scopedaccessv1.ScopedRoleAssignment) (backend.Item, error) {
+	if assignment.GetMetadata() == nil {
+		return backend.Item{}, trace.BadParameter("missing metadata in scoped role assignment")
+	}
+
+	if assignment.GetMetadata().Expires != nil {
+		return backend.Item{}, trace.BadParameter("scoped role assignments do not support expiration")
+	}
+
+	data, err := protojson.Marshal(assignment)
+	if err != nil {
+		return backend.Item{}, trace.Wrap(err)
+	}
+
+	return backend.Item{
+		Key:      scopedRoleAssignmentKey(assignment.GetMetadata().GetName()),
+		Value:    data,
+		Revision: assignment.GetMetadata().GetRevision(),
+	}, nil
+}
+
+// scopedRoleWithRevision creates a copy of the provided role with an updated revision.
+func scopedRoleWithRevision(role *scopedaccessv1.ScopedRole, revision string) *scopedaccessv1.ScopedRole {
+	role = apiutils.CloneProtoMsg(role)
+	role.Metadata.Revision = revision
+	return role
+}
+
+// scopedRoleAssignmentWithRevision creates a shallow copy of the provided assignment with an updated revision.
+func scopedRoleAssignmentWithRevision(assignment *scopedaccessv1.ScopedRoleAssignment, revision string) *scopedaccessv1.ScopedRoleAssignment {
+	assignment = apiutils.CloneProtoMsg(assignment)
+	assignment.Metadata.Revision = revision
+	return assignment
+}
diff --git a/lib/services/local/scoped_access_test.go b/lib/services/local/scoped_access_test.go
new file mode 100644
index 0000000000000..fbd29cca16f92
--- /dev/null
+++ b/lib/services/local/scoped_access_test.go
@@ -0,0 +1,825 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package local
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+)
+
+// TestScopedRoleEvents verifies the expected behavior of backend events for the ScopedRole family of types.
+func TestScopedRoleEvents(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := NewScopedAccessService(backend)
+
+	events := NewEventsService(backend)
+
+	watcher, err := events.NewWatcher(ctx, types.Watch{
+		Kinds: []types.WatchKind{
+			{
+				Kind: scopedaccess.KindScopedRole,
+			},
+			{
+				Kind: scopedaccess.KindScopedRoleAssignment,
+			},
+		},
+	})
+	require.NoError(t, err)
+	defer watcher.Close()
+
+	getNextEvent := func() types.Event {
+		select {
+		case event := <-watcher.Events():
+			return event
+		case <-watcher.Done():
+			require.FailNow(t, "Watcher exited with error", watcher.Error())
+		case <-time.After(time.Second * 5):
+			require.FailNow(t, "Timeout waiting for event", watcher.Error())
+		}
+
+		panic("unreachable")
+	}
+
+	event := getNextEvent()
+	require.Equal(t, types.OpInit, event.Type)
+
+	// Create a ScopedRole and verify create event is well-formed.
+	role := &scopedaccessv1.ScopedRole{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: &headerv1.Metadata{
+			Name: "test-role",
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleSpec{
+			AssignableScopes: []string{"/foo", "/bar"},
+		},
+		Version: types.V1,
+	}
+
+	crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: role,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpPut, event.Type)
+
+	resource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]).UnwrapT()
+	require.Empty(t, cmp.Diff(crsp.Role, resource, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// delete the role and verify delete event is well-formed.
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: role.Metadata.Name,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpDelete, event.Type)
+
+	require.Empty(t, cmp.Diff(&types.ResourceHeader{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: types.Metadata{
+			Name: role.Metadata.Name,
+		},
+	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
+
+	// recreate scoped role so that we can use it for testing assignment events
+	crsp, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: role,
+	})
+	require.NoError(t, err)
+
+	_ = getNextEvent() // drain the role create event
+
+	assignment := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "alice",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  role.Metadata.Name,
+					Scope: "/foo",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	acrsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment,
+		RoleRevisions: map[string]string{
+			role.Metadata.Name: crsp.Role.Metadata.Revision,
+		},
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpPut, event.Type)
+	assignmentResource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]).UnwrapT()
+	require.Empty(t, cmp.Diff(acrsp.Assignment, assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// delete the assignment and verify delete event is well-formed.
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: assignment.Metadata.Name,
+	})
+	require.NoError(t, err)
+
+	event = getNextEvent()
+	require.Equal(t, types.OpDelete, event.Type)
+
+	require.Empty(t, cmp.Diff(&types.ResourceHeader{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: types.Metadata{
+			Name: assignment.Metadata.Name,
+		},
+	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
+}
+
+// TestScopedRoleBasicCRUD tests the basic CRUD operations of the ScopedAccessService, excluding the more non-trivial
+// scenarios involving roles with active assignments, which are tested separately.
+func TestScopedRoleBasicCRUD(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := NewScopedAccessService(backend)
+
+	basicRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "basic-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "basic-02",
+			},
+			Scope: "/bar",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/bar/**"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "basic-03",
+			},
+			Scope: "/baz",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/baz/**"},
+			},
+			Version: types.V1,
+		},
+	}
+
+	var revisions []string
+
+	// verify the expected behavior of CreateScopedRole
+	for _, role := range basicRoles {
+		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, crsp.Role.Metadata.Revision)
+		require.Empty(t, cmp.Diff(role, crsp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+		// Check that the role can be retrieved.
+		grsp, err := service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+			Name: role.Metadata.Name,
+		})
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(crsp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
+
+		revisions = append(revisions, grsp.Role.Metadata.Revision)
+	}
+
+	require.Len(t, revisions, len(basicRoles))
+
+	// verify that create fails if the role already exists
+	_, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: basicRoles[0],
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify a basic allowable update
+	basic01Mod := apiutils.CloneProtoMsg(basicRoles[0])
+	basic01Mod.Spec.AssignableScopes = []string{"/foo", "/bar"}
+	basic01Mod.Metadata.Revision = revisions[0]
+
+	ursp, err := service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: basic01Mod,
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, ursp.Role.Metadata.Revision)
+	require.Empty(t, cmp.Diff(basic01Mod, ursp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// verify that update really happened
+	grsp, err := service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: basic01Mod.Metadata.Name,
+	})
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(ursp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// verify that update fails if the revision is wrong
+	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: basic01Mod,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that update is rejected if the role's scope is changed
+	basic01Mod = apiutils.CloneProtoMsg(ursp.Role)
+	basic01Mod.Scope = "/foo"
+
+	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: basic01Mod,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// verify that update fails if the role does not exist
+	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: &scopedaccessv1.ScopedRole{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name:     "non-existent",
+				Revision: revisions[0],
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that delete fails if the role does not exist
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: "non-existent",
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that delete fails if the revision does not match
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name:     basicRoles[0].Metadata.Name,
+		Revision: revisions[0],
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify successful unconditional delete
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name: basicRoles[0].Metadata.Name,
+	})
+	require.NoError(t, err)
+
+	// verify that the role is gone
+	_, err = service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: basicRoles[0].Metadata.Name,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+	// verify successful conditional delete
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name:     basicRoles[1].Metadata.Name,
+		Revision: revisions[1],
+	})
+	require.NoError(t, err)
+
+	// verify that the role is gone
+	_, err = service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		Name: basicRoles[1].Metadata.Name,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+}
+
+// TestScopedRoleAssignmentBasicCRD tests the basic CRD operations of the ScopedRoleAssignmentService, excluding the more non-trivial
+// scenarios involving roles with active assignments, which are tested separately.
+func TestScopedRoleAssignmentBasicCRD(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := NewScopedAccessService(backend)
+
+	roles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-02",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-03",
+			},
+			Scope: "/foo",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		},
+	}
+
+	var roleRevisions []string
+
+	// Create the roles.
+	for _, role := range roles {
+		rsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+
+		roleRevisions = append(roleRevisions, rsp.Role.Metadata.Revision)
+	}
+
+	// basic root assignment to test standard CRD operations with (initially invalid,
+	// will be modified later to be valid)
+	assignment01 := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "alice",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "role-02", // not assignable to root
+					Scope: "/",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	// check that assignment to root fails since the target role is only assignable to /foo
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-02": roleRevisions[1],
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// check that assignment with an invalid resource scope fails
+	assignment01.Spec.Assignments[0].Role = "role-01" // fix role to be assignable to root
+	assignment01.Scope = "/foo"                       // invalid scope for root assignment
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// check that assignment of correct role still fails if revision is incorrect
+	assignment01.Scope = "/" // fix scope to be valid for root assignment
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[1], // revision of role-02, not role-01
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// check that assignment of correct role with correct revision works
+	crsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+		},
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
+	require.Empty(t, cmp.Diff(crsp.Assignment, assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// Check that the assignment can be retrieved.
+	grsp, err := service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: assignment01.Metadata.Name,
+	})
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// verify that create fails if the assignment already exists
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that delete of assignment with incorrect revision fails
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name:     assignment01.Metadata.Name,
+		Revision: roleRevisions[0],
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that delete of assignment with correct revision works
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name:     assignment01.Metadata.Name,
+		Revision: crsp.Assignment.Metadata.Revision,
+	})
+	require.NoError(t, err)
+
+	// verify that the assignment is gone
+	_, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: assignment01.Metadata.Name,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
+
+	// set up a more non-trivial assignment with multiple sub-assignments
+	assignment02 := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "bob",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "role-01",
+					Scope: "/foo",
+				},
+				{
+					Role:  "role-02",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "role-03", // role-03 cannot by assigned to by an assignment in the root resource scope
+					Scope: "/foo",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	// verify that assignment with a mix of conflicting and correct resource scopes fails
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment02,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			"role-02": roleRevisions[1],
+			"role-03": roleRevisions[2],
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// verify that a mix of valid and invalid role revisions fails
+	assignment02.Spec.Assignments = assignment02.Spec.Assignments[:2] // remove role-03 assignment
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment02,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			"role-02": roleRevisions[2], // revision of role-03, not role-02
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// verify that assignment with some but not all of the role revisions fails
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment02,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			// role-02 is missing
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// verify that assignment with all of the role revisions works
+	crsp, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment02,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			"role-02": roleRevisions[1],
+		},
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
+	require.Empty(t, cmp.Diff(crsp.Assignment, assignment02, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// Check that the assignment can be retrieved
+	grsp, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		Name: assignment02.Metadata.Name,
+	})
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
+
+	// create an assignment that assigns the same role at multiple separate scopes (covers a specific
+	// bug where original impl would construct invalid conditional actions when multiple sub-assignments
+	// are made for the same role).
+	assignment03 := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "carol",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "role-01",
+					Scope: "/foo",
+				},
+				{
+					Role:  "role-01",
+					Scope: "/bar",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	// check that creation of assignment works
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment03,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+		},
+	})
+	require.NoError(t, err)
+
+	// verify that deletion of assignment works
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name: assignment03.Metadata.Name,
+	})
+	require.NoError(t, err)
+}
+
+// TestScopedRoleAssignmentInteraction verifies the expected interaction rules between scoped roles and
+// scoped role assignments.
+func TestScopedRoleAssignmentInteraction(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	defer backend.Close()
+
+	service := NewScopedAccessService(backend)
+
+	roles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-01",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-02",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/foo"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-03",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/bar"},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "role-04",
+			},
+			Scope: "/",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/bin"},
+			},
+			Version: types.V1,
+		},
+	}
+
+	var roleRevisions []string
+
+	// Create the roles.
+	for _, role := range roles {
+		rsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			Role: role,
+		})
+		require.NoError(t, err)
+
+		roleRevisions = append(roleRevisions, rsp.Role.Metadata.Revision)
+	}
+
+	// set up a non-trivial assignment with multiple sub-assignments
+	assignment01 := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: uuid.New().String(),
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "alice",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "role-01",
+					Scope: "/foo",
+				},
+				{
+					Role:  "role-02",
+					Scope: "/foo/bar",
+				},
+				{
+					Role:  "role-03",
+					Scope: "/bar",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	crsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			"role-02": roleRevisions[1],
+			"role-03": roleRevisions[2],
+		},
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
+	require.Empty(t, cmp.Diff(crsp.Assignment, assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// check that unrelated role can be deleted
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name:     "role-04",
+		Revision: roleRevisions[3],
+	})
+	require.NoError(t, err)
+
+	// check that deleting a role referenced by an assignment fails
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name:     "role-01",
+		Revision: roleRevisions[0],
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// check that updated a role s.t. it would invalidate an assignment fails
+	updatedRole := apiutils.CloneProtoMsg(roles[1])
+	updatedRole.Spec.AssignableScopes = []string{"/bin"} // role-02 is now assignable to /bin, not /foo
+	updatedRole.Metadata.Revision = roleRevisions[1]
+	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: updatedRole,
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+
+	// check that deletion of a role s.t. it would invalidate an assignment fails
+	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		Name:     "role-02",
+		Revision: roleRevisions[1],
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
+
+	// delete the assignment
+	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		Name:     assignment01.Metadata.Name,
+		Revision: crsp.Assignment.Metadata.Revision,
+	})
+	require.NoError(t, err)
+
+	// check that update of role now succeeds
+	urrsp, err := service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: updatedRole,
+	})
+	require.NoError(t, err)
+
+	// check that recreate of assignment would now fail due to conflicting role
+	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: assignment01,
+		RoleRevisions: map[string]string{
+			"role-01": roleRevisions[0],
+			"role-02": urrsp.Role.Metadata.Revision, // revision of updated role-02
+			"role-03": roleRevisions[2],
+		},
+	})
+	require.Error(t, err)
+	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
+}
diff --git a/lib/services/local/scoped_roles.go b/lib/services/local/scoped_roles.go
deleted file mode 100644
index 624282301607c..0000000000000
--- a/lib/services/local/scoped_roles.go
+++ /dev/null
@@ -1,760 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package local
-
-import (
-	"context"
-	"crypto/rand"
-	"errors"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/encoding/protojson"
-
-	"github.com/gravitational/teleport"
-	srpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/itertools/stream"
-	"github.com/gravitational/teleport/lib/scopes"
-	sr "github.com/gravitational/teleport/lib/scopes/roles"
-	"github.com/gravitational/teleport/lib/utils"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
-)
-
-// scoped role and assignment state is modeled with the following key ranges:
-//
-//  - `/scoped_role/role/<role-name>`             (the location of the role resource, stored at author-chosen name)
-//  - `/scoped_role/assignment/<assignment-name>` (the assignment resource itself, always stored at a random UUID)
-//  - `/scoped_role/user_lock/<username>`         (a value that is randomized each time associated user's assignments are modified)
-//  - `/scoped_role/role_lock/<role-name>`        (a value that is randomized each time associated role's assignments are modified)
-//
-// These four key ranges allow for efficient management of roles and assignmments atomically. Assignments are stored homogenously,
-// but the provided lock values make it easy for backend operations to assert that the assignments related to a given user/role
-// are not concurrently changed, indepdnent of the total number of assignments or the number of roles they effect (each assignment
-// may assign multiple roles). Cleanup of role locks is the responsibility of the DeleteScopedRole operation, and cleanup of user locks
-// is the responsibility of the DeleteScopedRoleAssignment operation.
-//
-// NOTE: this model does not provide means of making one assignment invalidate another (e.g. in the case of OIDC assignments,
-// for which only one should be valid at a time), and does not invalidate assignments on user deletion.
-
-const (
-	scopedRolePrefix              = "scoped_role"
-	scopedRoleRoleComponent       = "role"
-	scopedRoleAssignmentComponent = "assignment"
-	userAssignmentLockComponent   = "user_lock"
-	roleAssignmentLockComponent   = "role_lock"
-)
-
-// ScopedRoleService manages backend state for the ScopedRole and ScopedRoleAssignment types.
-type ScopedRoleService struct {
-	bk     backend.Backend
-	logger *slog.Logger
-}
-
-// NewScopedRoleService creates a new ScopedRoleService for the specified backend.
-func NewScopedRoleService(bk backend.Backend) *ScopedRoleService {
-	return &ScopedRoleService{
-		bk:     bk,
-		logger: slog.With(teleport.ComponentKey, "scopedrole"),
-	}
-}
-
-func (s *ScopedRoleService) GetScopedRole(ctx context.Context, req *srpb.GetScopedRoleRequest) (*srpb.GetScopedRoleResponse, error) {
-	if req.GetName() == "" {
-		return nil, trace.BadParameter("missing scoped role name in get request")
-	}
-
-	item, err := s.bk.Get(ctx, scopedRoleKey(req.GetName()))
-	if err != nil {
-		if trace.IsNotFound(err) {
-			return nil, trace.NotFound("scoped role %q not found", req.GetName())
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	role, err := scopedRoleFromItem(item)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if err := sr.WeakValidateRole(role); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.GetScopedRoleResponse{
-		Role: role,
-	}, nil
-}
-
-// StreamScopedRoles returns a stream of all scoped roles in the backend. Malformed roles are skipped. Returned roles
-// have had weak validation applied.
-func (s *ScopedRoleService) StreamScopedRoles(ctx context.Context) stream.Stream[*srpb.ScopedRole] {
-	return func(yield func(*srpb.ScopedRole, error) bool) {
-		startKey := scopedRoleKey("")
-		params := backend.ItemsParams{
-			StartKey: startKey,
-			EndKey:   backend.RangeEnd(startKey),
-		}
-
-		for item, err := range s.bk.Items(ctx, params) {
-			if err != nil {
-				// backend errors terminate the stream
-				yield(nil, trace.Wrap(err))
-				return
-			}
-
-			role, err := scopedRoleFromItem(&item)
-			if err != nil {
-				// per-role errors are logged and skipped
-				s.logger.WarnContext(ctx, "skipping scoped role due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
-				continue
-			}
-
-			if err := sr.WeakValidateRole(role); err != nil {
-				// per-role errors are logged and skipped
-				s.logger.WarnContext(ctx, "skipping scoped role due to validation error", "error", err, "key", logutils.StringerAttr(item.Key))
-				continue
-			}
-
-			if !yield(role, nil) {
-				return
-			}
-		}
-	}
-}
-
-func (s *ScopedRoleService) CreateScopedRole(ctx context.Context, req *srpb.CreateScopedRoleRequest) (*srpb.CreateScopedRoleResponse, error) {
-	role := req.GetRole()
-	if role == nil {
-		return nil, trace.BadParameter("missing scoped role in create request")
-	}
-
-	if err := sr.StrongValidateRole(role); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	item, err := scopedRoleToItem(role)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// we make efforts elsewhere to ensure that roles cannot be deleted s.t. they leave behind dangling assignments,
-	// but it is best to be absolutely certain about that.
-	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(role.GetMetadata().GetName()))
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
-		}
-		lockItem = nil
-	}
-
-	lockCondition := backend.NotExists()
-	if lockItem != nil {
-		lockCondition = backend.Revision(lockItem.Revision)
-		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			for _, subAssignment := range assignment.GetSpec().GetAssignments() {
-				if subAssignment.GetRole() != role.GetMetadata().GetName() {
-					continue
-				}
-
-				// an assignment already exists referencing this role, we need to check if that is because
-				// a role with this name exists, or because the assignment is dangling.
-				_, err = s.bk.Get(ctx, scopedRoleKey(role.GetMetadata().GetName()))
-				if err != nil {
-					if !trace.IsNotFound(err) {
-						return nil, trace.Wrap(err)
-					}
-					// this is a dangling assignment, we need to return an error
-					return nil, trace.CompareFailed("cannot create scoped role %q while extant assignment %q references it", role.GetMetadata().GetName(), assignment.GetMetadata().GetName())
-				}
-				return nil, trace.CompareFailed("scoped role %q already exists", role.GetMetadata().GetName())
-			}
-		}
-	}
-
-	revision, err := s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
-		{
-			Key:       item.Key,
-			Condition: backend.NotExists(),
-			Action:    backend.Put(item),
-		},
-		{
-			Key:       roleAssignmentLockKey(role.GetMetadata().GetName()),
-			Condition: lockCondition,
-			Action:    backend.Nop(), // assignments update the lock, roles just assert that it is unchanged
-		},
-	})
-	if err != nil {
-		if errors.Is(err, backend.ErrConditionFailed) {
-			return nil, trace.CompareFailed("scoped role %q or an associated assignment already exist", role.GetMetadata().GetName())
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.CreateScopedRoleResponse{
-		Role: scopedRoleWithRevision(role, revision),
-	}, nil
-}
-
-func (s *ScopedRoleService) UpdateScopedRole(ctx context.Context, req *srpb.UpdateScopedRoleRequest) (*srpb.UpdateScopedRoleResponse, error) {
-	role := req.GetRole()
-	if role == nil {
-		return nil, trace.BadParameter("missing scoped role in update request")
-	}
-
-	if err := sr.StrongValidateRole(role); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	extant, err := s.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-		Name: role.GetMetadata().GetName(),
-	})
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
-		}
-		return nil, trace.CompareFailed("scoped role %q was deleted", role.GetMetadata().GetName())
-	}
-
-	if role.GetMetadata().GetRevision() != "" && role.GetMetadata().GetRevision() != extant.GetRole().GetMetadata().GetRevision() {
-		return nil, trace.CompareFailed("scoped role %q has been concurrently modified", role.GetMetadata().GetName())
-	}
-
-	// disallow change of resource scope via update. use of scopes.Compare directly is generally discouraged,
-	// but that is due to ease of misuse, which isn't really a concern for a simple equivalence check.
-	if scopes.Compare(role.GetScope(), extant.GetRole().GetScope()) != scopes.Equivalent {
-		return nil, trace.BadParameter("cannot modify the resource scope of scoped role %q (%q -> %q)", role.GetMetadata().GetName(), extant.GetRole().GetScope(), role.GetScope())
-	}
-
-	// acquire the assignment lock and verify that the update doesn't validate any extant assignments
-	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(role.GetMetadata().GetName()))
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
-		}
-		lockItem = nil
-	}
-
-	lockCondition := backend.NotExists()
-	if lockItem != nil {
-		lockCondition = backend.Revision(lockItem.Revision)
-		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			for _, subAssignment := range assignment.GetSpec().GetAssignments() {
-				if subAssignment.GetRole() != role.GetMetadata().GetName() {
-					continue
-				}
-
-				if !sr.RoleIsAssignableAtScope(extant.GetRole(), subAssignment.GetScope()) {
-					// theoretically, we prevent broken assignments. in practice, its best to
-					// assume they may exist and to not allow them to prevent an otherwsie
-					// valid update. We will still force all broken assignments to be
-					// removed at the time of role deletion.
-					continue
-				}
-
-				if !sr.RoleIsAssignableAtScope(role, subAssignment.GetScope()) {
-					return nil, trace.BadParameter("update of scoped role %q would invalidate assignment %q which assigns it to user %q at scope %q", role.GetMetadata().GetName(), assignment.GetMetadata().GetName(), assignment.GetSpec().GetUser(), subAssignment.GetScope())
-				}
-			}
-		}
-	}
-
-	item, err := scopedRoleToItem(role)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	revision, err := s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
-		{
-			Key:       item.Key,
-			Condition: backend.Revision(item.Revision),
-			Action:    backend.Put(item),
-		},
-		{
-			Key:       roleAssignmentLockKey(role.GetMetadata().GetName()),
-			Condition: lockCondition,
-			Action:    backend.Nop(),
-		},
-	})
-	if err != nil {
-		if errors.Is(err, backend.ErrConditionFailed) {
-			return nil, trace.CompareFailed("scoped role %q or an associated assignment was concurrently modified", role.GetMetadata().GetName())
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.UpdateScopedRoleResponse{
-		Role: scopedRoleWithRevision(role, revision),
-	}, nil
-}
-
-func (s *ScopedRoleService) DeleteScopedRole(ctx context.Context, req *srpb.DeleteScopedRoleRequest) (*srpb.DeleteScopedRoleResponse, error) {
-	roleName := req.GetName()
-	if roleName == "" {
-		return nil, trace.BadParameter("missing scoped role name in delete request")
-	}
-
-	lockItem, err := s.bk.Get(ctx, roleAssignmentLockKey(roleName))
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
-		}
-		lockItem = nil
-	}
-
-	lockCondition := backend.NotExists()
-	if lockItem != nil {
-		lockCondition = backend.Revision(lockItem.Revision)
-	}
-
-	// now that we have a lock condition established, we can read all assignments with a "happens after" relationship
-	// to the current lock value and verify that no assignments target this role.
-	for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		for _, subAssignment := range assignment.GetSpec().GetAssignments() {
-			if subAssignment.GetRole() == roleName {
-				return nil, trace.CompareFailed("cannot delete scoped role %q while assignment %q assigns it to a user", roleName, assignment.GetMetadata().GetName())
-			}
-		}
-	}
-
-	roleCondition := backend.Exists()
-	if rev := req.GetRevision(); rev != "" {
-		roleCondition = backend.Revision(rev)
-	}
-
-	// atomically delete the role and its associated assignment lock while asserting that no assignments
-	// have been concurrently applied that target this role.
-	_, err = s.bk.AtomicWrite(ctx, []backend.ConditionalAction{
-		{
-			Key:       scopedRoleKey(roleName),
-			Condition: roleCondition,
-			Action:    backend.Delete(),
-		},
-		{
-			Key:       roleAssignmentLockKey(roleName),
-			Condition: lockCondition,
-			Action:    backend.Delete(),
-		},
-	})
-
-	if err != nil {
-		if errors.Is(err, backend.ErrConditionFailed) {
-			return nil, trace.CompareFailed("scoped role %q has been concurrently modified and/or assigned", roleName)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.DeleteScopedRoleResponse{}, nil
-}
-
-func (s *ScopedRoleService) GetScopedRoleAssignment(ctx context.Context, req *srpb.GetScopedRoleAssignmentRequest) (*srpb.GetScopedRoleAssignmentResponse, error) {
-	assignmentName := req.GetName()
-	if assignmentName == "" {
-		return nil, trace.BadParameter("missing scoped role assignment name in get request")
-	}
-
-	item, err := s.bk.Get(ctx, scopedRoleAssignmentKey(assignmentName))
-	if err != nil {
-		if trace.IsNotFound(err) {
-			return nil, trace.NotFound("scoped role assignment %q not found", assignmentName)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	assignment, err := scopedRoleAssignmentFromItem(item)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if err := sr.WeakValidateAssignment(assignment); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.GetScopedRoleAssignmentResponse{
-		Assignment: assignment,
-	}, nil
-}
-
-// StreamScopedRoleAssignments returns a stream of all scoped role assignments in the backend. Malformed assignments are skipped.
-// Returned assignments have had weak validation applied.
-func (s *ScopedRoleService) StreamScopedRoleAssignments(ctx context.Context) stream.Stream[*srpb.ScopedRoleAssignment] {
-	return func(yield func(*srpb.ScopedRoleAssignment, error) bool) {
-		startKey := scopedRoleAssignmentKey("")
-		params := backend.ItemsParams{
-			StartKey: startKey,
-			EndKey:   backend.RangeEnd(startKey),
-		}
-
-		for item, err := range s.bk.Items(ctx, params) {
-			if err != nil {
-				// backend errors terminate the stream
-				yield(nil, trace.Wrap(err))
-				return
-			}
-
-			assignment, err := scopedRoleAssignmentFromItem(&item)
-			if err != nil {
-				// per-assignment errors are logged and skipped
-				s.logger.WarnContext(ctx, "skipping scoped role assignment due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
-				continue
-			}
-
-			if err := sr.WeakValidateAssignment(assignment); err != nil {
-				// per-assignment errors are logged and skipped
-				s.logger.WarnContext(ctx, "skipping scoped role assignment due to validation error", "error", err, "key", logutils.StringerAttr(item.Key))
-				continue
-			}
-
-			if !yield(assignment, nil) {
-				return
-			}
-		}
-	}
-}
-
-func (s *ScopedRoleService) CreateScopedRoleAssignment(ctx context.Context, req *srpb.CreateScopedRoleAssignmentRequest) (*srpb.CreateScopedRoleAssignmentResponse, error) {
-	assignment := req.GetAssignment()
-	if assignment == nil {
-		return nil, trace.BadParameter("missing scoped role assignment in create request")
-	}
-
-	if err := sr.StrongValidateAssignment(assignment); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// independently enforce the max number of roles per assignment limit here since not all validation
-	// may necessarily enforce it, but it is a hard-limit for the backend impl.
-	if len(assignment.GetSpec().GetAssignments()) > sr.MaxRolesPerAssignment {
-		return nil, trace.BadParameter("scoped role assignment resource %q contains too many sub-assignments (max %d)", assignment.GetMetadata().GetName(), sr.MaxRolesPerAssignment)
-	}
-
-	item, err := scopedRoleAssignmentToItem(assignment)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// set up conditional actions for assignment and user lock
-	condacts := []backend.ConditionalAction{
-		{
-			Key:       item.Key,
-			Condition: backend.NotExists(),
-			Action:    backend.Put(item),
-		},
-		{
-			Key:       userAssignmentLockKey(assignment.GetSpec().GetUser()),
-			Condition: backend.Whatever(),
-			Action: backend.Put(backend.Item{
-				Value: newUserAssignmentLockVal(assignment.GetSpec().GetUser()),
-			}),
-		},
-	}
-
-	// set up conditional actions for each assigned role lock
-	for _, subAssignment := range assignment.GetSpec().GetAssignments() {
-		// operation must verify that all associated roles have not been concurrently modified
-		// as such modification could theoretically invalidate prior access-control checks.
-		roleRevision, ok := req.GetRoleRevisions()[subAssignment.GetRole()]
-		if !ok {
-			// this is a bug in the API layer, we should never be missing a role revision as it should be
-			// filled in with the revision of the role used for the access-control check.
-			return nil, trace.BadParameter("missing role revision for role %q in backend create (this is a bug)", subAssignment.GetRole())
-		}
-
-		rrsp, err := s.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-			Name: subAssignment.GetRole(),
-		})
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		if rrsp.GetRole().GetMetadata().GetRevision() != roleRevision {
-			return nil, trace.CompareFailed("scoped role %q has been concurrently modified", subAssignment.GetRole())
-		}
-
-		// verify that the role is scoped to the same resource scope as the assignment itself
-		// NOTE: this restriction may eventually be relaxed in favor of something more flexible,
-		// but as of right now we haven't decided what that should look like.
-		if scopes.Compare(rrsp.GetRole().GetScope(), assignment.GetScope()) != scopes.Equivalent {
-			return nil, trace.BadParameter("role %q is not scoped to the same resource scope as assignment %q (%q -> %q)", subAssignment.GetRole(), assignment.GetMetadata().GetName(), rrsp.GetRole().GetScope(), subAssignment.GetScope())
-		}
-
-		// verify that the role is assignable at the specified scope
-		if !sr.RoleIsAssignableAtScope(rrsp.GetRole(), subAssignment.GetScope()) {
-			return nil, trace.BadParameter("scoped role %q is not configured to be assignable at scope %q", subAssignment.GetRole(), subAssignment.GetScope())
-		}
-
-		// assert that role is unchanged and modify associated role lock so that role modifications can
-		// detect concurrent modifications to their assignments.
-		condacts = append(condacts, []backend.ConditionalAction{
-			{
-				Key:       scopedRoleKey(subAssignment.GetRole()),
-				Condition: backend.Revision(roleRevision),
-				Action:    backend.Nop(),
-			},
-			{
-				Key:       roleAssignmentLockKey(subAssignment.GetRole()),
-				Condition: backend.Whatever(),
-				Action: backend.Put(backend.Item{
-					Value: newRoleAssignmentLockVal(subAssignment.GetRole()),
-				}),
-			},
-		}...)
-	}
-
-	revision, err := s.bk.AtomicWrite(ctx, condacts)
-	if err != nil {
-		if errors.Is(err, backend.ErrConditionFailed) {
-			// return a general concurrent-modification error since it isn't clear which condition faile
-			return nil, trace.CompareFailed("scoped role assignment %q failed due to concurrent modification of associated resources", assignment.GetMetadata().GetName())
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.CreateScopedRoleAssignmentResponse{
-		Assignment: scopedRoleAssignmentWithRevision(assignment, revision),
-	}, nil
-}
-
-func (s *ScopedRoleService) DeleteScopedRoleAssignment(ctx context.Context, req *srpb.DeleteScopedRoleAssignmentRequest) (*srpb.DeleteScopedRoleAssignmentResponse, error) {
-	assignmentName := req.GetName()
-	if assignmentName == "" {
-		return nil, trace.BadParameter("missing scoped role assignment name in delete request")
-	}
-
-	extant, err := s.GetScopedRoleAssignment(ctx, &srpb.GetScopedRoleAssignmentRequest{
-		Name: assignmentName,
-	})
-	if err != nil {
-		if trace.IsNotFound(err) {
-			return nil, trace.CompareFailed("scoped role assignment %q was concurrently delete", assignmentName)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	if rev := req.GetRevision(); rev != "" && rev != extant.Assignment.GetMetadata().GetRevision() {
-		return nil, trace.CompareFailed("scoped role assignment %q has been concurrently modified", assignmentName)
-	}
-
-	// check to see if we have a lock on the user. if so, we need to check to see if we're the last assignment
-	// relying on the lock. if we are, we can delete it.
-	userLockItem, err := s.bk.Get(ctx, userAssignmentLockKey(extant.Assignment.GetSpec().GetUser()))
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
-		}
-		userLockItem = nil
-	}
-
-	// start with initial condition assuming non-existence. note that this really should never happen unless
-	// we have a bug somewhere else, but there isn't really a downside to being resilient to it.
-	userLockCondition := backend.NotExists()
-	userLockAction := backend.Nop()
-	if userLockItem != nil {
-		userLockCondition = backend.Revision(userLockItem.Revision)
-		userLockAction = backend.Put(backend.Item{
-			Value: newUserAssignmentLockVal(extant.Assignment.GetSpec().GetUser()),
-		})
-
-		// check to see if we're the last assignment relying on the user lock. if so, we should delete it.
-		var hasOtherAssignments bool
-		for assignment, err := range s.StreamScopedRoleAssignments(ctx) {
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			if assignment.GetSpec().GetUser() != extant.Assignment.GetSpec().GetUser() {
-				// skip assignments related to other users
-				continue
-			}
-			if assignment.GetMetadata().GetName() == extant.Assignment.GetMetadata().GetName() {
-				// skip the assignment we're currently deleting
-				continue
-			}
-
-			// found another assignment for the same user
-			hasOtherAssignments = true
-			break
-		}
-
-		if !hasOtherAssignments {
-			// no other assignments for this user, we can delete the lock
-			userLockAction = backend.Delete()
-		}
-	}
-
-	condacts := []backend.ConditionalAction{
-		{
-			Key:       scopedRoleAssignmentKey(assignmentName),
-			Condition: backend.Revision(extant.Assignment.GetMetadata().GetRevision()),
-			Action:    backend.Delete(),
-		},
-		{
-			Key:       userAssignmentLockKey(extant.Assignment.GetSpec().GetUser()),
-			Condition: userLockCondition,
-			Action:    userLockAction,
-		},
-	}
-
-	for _, subAssignment := range extant.Assignment.GetSpec().GetAssignments() {
-		// operation must modify all associated role locks to ensure that role operations can
-		// efficiently assert that no assigment related to the role has changed.
-		condacts = append(condacts, backend.ConditionalAction{
-			Key:       roleAssignmentLockKey(subAssignment.GetRole()),
-			Condition: backend.Whatever(),
-			Action: backend.Put(backend.Item{
-				Value: newRoleAssignmentLockVal(subAssignment.GetRole()),
-			}),
-		})
-	}
-
-	if _, err := s.bk.AtomicWrite(ctx, condacts); err != nil {
-		if errors.Is(err, backend.ErrConditionFailed) {
-			return nil, trace.CompareFailed("scoped role assignment %q or another related assignment was concurrently modified", assignmentName)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	return &srpb.DeleteScopedRoleAssignmentResponse{}, nil
-}
-
-func scopedRoleKey(roleName string) backend.Key {
-	return backend.NewKey(scopedRolePrefix, scopedRoleRoleComponent, roleName)
-}
-
-func scopedRoleAssignmentKey(assignmentID string) backend.Key {
-	return backend.NewKey(scopedRolePrefix, scopedRoleAssignmentComponent, assignmentID)
-}
-
-func userAssignmentLockKey(username string) backend.Key {
-	return backend.NewKey(scopedRolePrefix, userAssignmentLockComponent, username)
-}
-
-func roleAssignmentLockKey(roleName string) backend.Key {
-	return backend.NewKey(scopedRolePrefix, roleAssignmentLockComponent, roleName)
-}
-
-// newUserAssignmentLockVal generates a new user assignment lock value for the specified username. A random
-// element is used to ensure that the lock value changes for each operation that changes assignments.
-func newUserAssignmentLockVal(username string) []byte {
-	return []byte(rand.Text() + "-" + username)
-}
-
-// newRoleAssignmentLockVal generates a new role assignment lock value for the specified role name. A random
-// element is used to ensure that the lock value changes for each operation that changes assignments.
-func newRoleAssignmentLockVal(roleName string) []byte {
-	return []byte(rand.Text() + "-" + roleName)
-}
-
-func scopedRoleFromItem(item *backend.Item) (*srpb.ScopedRole, error) {
-	var role srpb.ScopedRole
-	if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(item.Value, &role); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if role.GetMetadata() == nil {
-		return nil, trace.BadParameter("role at %q is critically malformed (missing metadata)", item.Key)
-	}
-
-	role.Metadata.Revision = item.Revision
-	role.Metadata.Expires = utils.TimeIntoProto(item.Expires)
-	return &role, nil
-}
-
-func scopedRoleToItem(role *srpb.ScopedRole) (backend.Item, error) {
-	if role.GetMetadata() == nil {
-		return backend.Item{}, trace.BadParameter("missing metadata in scoped role")
-	}
-
-	if role.GetMetadata().Expires != nil {
-		return backend.Item{}, trace.BadParameter("scoped roles do not support expiration")
-	}
-
-	data, err := protojson.Marshal(role)
-	if err != nil {
-		return backend.Item{}, trace.Wrap(err)
-	}
-
-	return backend.Item{
-		Key:      scopedRoleKey(role.GetMetadata().GetName()),
-		Value:    data,
-		Revision: role.GetMetadata().GetRevision(),
-	}, nil
-}
-
-func scopedRoleAssignmentFromItem(item *backend.Item) (*srpb.ScopedRoleAssignment, error) {
-	var assignment srpb.ScopedRoleAssignment
-	if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(item.Value, &assignment); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if assignment.GetMetadata() == nil {
-		return nil, trace.BadParameter("assignment at %q is critically malformed (missing metadata)", item.Key)
-	}
-
-	assignment.Metadata.Revision = item.Revision
-	assignment.Metadata.Expires = utils.TimeIntoProto(item.Expires)
-	return &assignment, nil
-}
-
-func scopedRoleAssignmentToItem(assignment *srpb.ScopedRoleAssignment) (backend.Item, error) {
-	if assignment.GetMetadata() == nil {
-		return backend.Item{}, trace.BadParameter("missing metadata in scoped role assignment")
-	}
-
-	if assignment.GetMetadata().Expires != nil {
-		return backend.Item{}, trace.BadParameter("scoped role assignments do not support expiration")
-	}
-
-	data, err := protojson.Marshal(assignment)
-	if err != nil {
-		return backend.Item{}, trace.Wrap(err)
-	}
-
-	return backend.Item{
-		Key:      scopedRoleAssignmentKey(assignment.GetMetadata().GetName()),
-		Value:    data,
-		Revision: assignment.GetMetadata().GetRevision(),
-	}, nil
-}
-
-// scopedRoleWithRevision creates a copy of the provided role with an updated revision.
-func scopedRoleWithRevision(role *srpb.ScopedRole, revision string) *srpb.ScopedRole {
-	role = apiutils.CloneProtoMsg(role)
-	role.Metadata.Revision = revision
-	return role
-}
-
-// scopedRoleAssignmentWithRevision creates a shallow copy of the provided assignment with an updated revision.
-func scopedRoleAssignmentWithRevision(assignment *srpb.ScopedRoleAssignment, revision string) *srpb.ScopedRoleAssignment {
-	assignment = apiutils.CloneProtoMsg(assignment)
-	assignment.Metadata.Revision = revision
-	return assignment
-}
diff --git a/lib/services/local/scoped_roles_test.go b/lib/services/local/scoped_roles_test.go
deleted file mode 100644
index 90e9237bf3da1..0000000000000
--- a/lib/services/local/scoped_roles_test.go
+++ /dev/null
@@ -1,641 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package local
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/testing/protocmp"
-
-	headerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	srpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopedrole/v1"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/backend/memory"
-	sr "github.com/gravitational/teleport/lib/scopes/roles"
-)
-
-// TestScopedRoleBasicCRUD tests the basic CRUD operations of the ScopedRoleService, excluding the more non-trivial
-// scenarios involving roles with active assignments, which are tested separately.
-func TestScopedRoleBasicCRUD(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	backend, err := memory.New(memory.Config{
-		Context: ctx,
-	})
-	require.NoError(t, err)
-
-	defer backend.Close()
-
-	service := NewScopedRoleService(backend)
-
-	basicRoles := []*srpb.ScopedRole{
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "basic-01",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/foo"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "basic-02",
-			},
-			Scope: "/bar",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/bar/**"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "basic-03",
-			},
-			Scope: "/baz",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/baz/**"},
-			},
-			Version: types.V1,
-		},
-	}
-
-	var revisions []string
-
-	// verify the expected behavior of CreateScopedRole
-	for _, role := range basicRoles {
-		crsp, err := service.CreateScopedRole(ctx, &srpb.CreateScopedRoleRequest{
-			Role: role,
-		})
-		require.NoError(t, err)
-		require.NotEmpty(t, crsp.Role.Metadata.Revision)
-		require.Empty(t, cmp.Diff(role, crsp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerpb.Metadata{}, "revision")))
-
-		// Check that the role can be retrieved.
-		grsp, err := service.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-			Name: role.Metadata.Name,
-		})
-		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(crsp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
-
-		revisions = append(revisions, grsp.Role.Metadata.Revision)
-	}
-
-	require.Len(t, revisions, len(basicRoles))
-
-	// verify that create fails if the role already exists
-	_, err = service.CreateScopedRole(ctx, &srpb.CreateScopedRoleRequest{
-		Role: basicRoles[0],
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify a basic allowable update
-	basic01Mod := apiutils.CloneProtoMsg(basicRoles[0])
-	basic01Mod.Spec.AssignableScopes = []string{"/foo", "/bar"}
-	basic01Mod.Metadata.Revision = revisions[0]
-
-	ursp, err := service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: basic01Mod,
-	})
-	require.NoError(t, err)
-	require.NotEmpty(t, ursp.Role.Metadata.Revision)
-	require.Empty(t, cmp.Diff(basic01Mod, ursp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerpb.Metadata{}, "revision")))
-
-	// verify that update really happened
-	grsp, err := service.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-		Name: basic01Mod.Metadata.Name,
-	})
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ursp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
-
-	// verify that update fails if the revision is wrong
-	_, err = service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: basic01Mod,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that update is rejected if the role's scope is changed
-	basic01Mod = apiutils.CloneProtoMsg(ursp.Role)
-	basic01Mod.Scope = "/foo"
-
-	_, err = service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: basic01Mod,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// verify that update fails if the role does not exist
-	_, err = service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: &srpb.ScopedRole{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name:     "non-existent",
-				Revision: revisions[0],
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/foo"},
-			},
-			Version: types.V1,
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that delete fails if the role does not exist
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name: "non-existent",
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that delete fails if the revision does not match
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name:     basicRoles[0].Metadata.Name,
-		Revision: revisions[0],
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify successful unconditional delete
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name: basicRoles[0].Metadata.Name,
-	})
-	require.NoError(t, err)
-
-	// verify that the role is gone
-	_, err = service.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-		Name: basicRoles[0].Metadata.Name,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
-
-	// verify successful conditional delete
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name:     basicRoles[1].Metadata.Name,
-		Revision: revisions[1],
-	})
-	require.NoError(t, err)
-
-	// verify that the role is gone
-	_, err = service.GetScopedRole(ctx, &srpb.GetScopedRoleRequest{
-		Name: basicRoles[1].Metadata.Name,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
-}
-
-// TestScopedRoleAssignmentBasicCRD tests the basic CRD operations of the ScopedRoleAssignmentService, excluding the more non-trivial
-// scenarios involving roles with active assignments, which are tested separately.
-func TestScopedRoleAssignmentBasicCRD(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	backend, err := memory.New(memory.Config{
-		Context: ctx,
-	})
-	require.NoError(t, err)
-
-	defer backend.Close()
-
-	service := NewScopedRoleService(backend)
-
-	roles := []*srpb.ScopedRole{
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-01",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-02",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/foo"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-03",
-			},
-			Scope: "/foo",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/foo"},
-			},
-			Version: types.V1,
-		},
-	}
-
-	var roleRevisions []string
-
-	// Create the roles.
-	for _, role := range roles {
-		rsp, err := service.CreateScopedRole(ctx, &srpb.CreateScopedRoleRequest{
-			Role: role,
-		})
-		require.NoError(t, err)
-
-		roleRevisions = append(roleRevisions, rsp.Role.Metadata.Revision)
-	}
-
-	// basic root assignment to test standard CRD operations with (initially invalid,
-	// will be modified later to be valid)
-	assignment01 := &srpb.ScopedRoleAssignment{
-		Kind: sr.KindScopedRoleAssignment,
-		Metadata: &headerpb.Metadata{
-			Name: uuid.New().String(),
-		},
-		Scope: "/",
-		Spec: &srpb.ScopedRoleAssignmentSpec{
-			User: "alice",
-			Assignments: []*srpb.Assignment{
-				{
-					Role:  "role-02", // not assignable to root
-					Scope: "/",
-				},
-			},
-		},
-		Version: types.V1,
-	}
-
-	// check that assignment to root fails since the target role is only assignable to /foo
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-02": roleRevisions[1],
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// check that assignment with an invalid resource scope fails
-	assignment01.Spec.Assignments[0].Role = "role-01" // fix role to be assignable to root
-	assignment01.Scope = "/foo"                       // invalid scope for root assignment
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// check that assignment of correct role still fails if revision is incorrect
-	assignment01.Scope = "/" // fix scope to be valid for root assignment
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[1], // revision of role-02, not role-01
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// check that assignment of correct role with correct revision works
-	crsp, err := service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-		},
-	})
-	require.NoError(t, err)
-	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(crsp.Assignment, assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerpb.Metadata{}, "revision")))
-
-	// Check that the assignment can be retrieved.
-	grsp, err := service.GetScopedRoleAssignment(ctx, &srpb.GetScopedRoleAssignmentRequest{
-		Name: assignment01.Metadata.Name,
-	})
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
-
-	// verify that create fails if the assignment already exists
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that delete of assignment with incorrect revision fails
-	_, err = service.DeleteScopedRoleAssignment(ctx, &srpb.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: roleRevisions[0],
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that delete of assignment with correct revision works
-	_, err = service.DeleteScopedRoleAssignment(ctx, &srpb.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: crsp.Assignment.Metadata.Revision,
-	})
-	require.NoError(t, err)
-
-	// verify that the assignment is gone
-	_, err = service.GetScopedRoleAssignment(ctx, &srpb.GetScopedRoleAssignmentRequest{
-		Name: assignment01.Metadata.Name,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
-
-	// set up a more non-trivial assignment with multiple sub-assignments
-	assignment02 := &srpb.ScopedRoleAssignment{
-		Kind: sr.KindScopedRoleAssignment,
-		Metadata: &headerpb.Metadata{
-			Name: uuid.New().String(),
-		},
-		Scope: "/",
-		Spec: &srpb.ScopedRoleAssignmentSpec{
-			User: "bob",
-			Assignments: []*srpb.Assignment{
-				{
-					Role:  "role-01",
-					Scope: "/foo",
-				},
-				{
-					Role:  "role-02",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "role-03", // role-03 cannot by assigned to by an assignment in the root resource scope
-					Scope: "/foo",
-				},
-			},
-		},
-		Version: types.V1,
-	}
-
-	// verify that assignment with a mix of conflicting and correct resource scopes fails
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment02,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			"role-02": roleRevisions[1],
-			"role-03": roleRevisions[2],
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// verify that a mix of valid and invalid role revisions fails
-	assignment02.Spec.Assignments = assignment02.Spec.Assignments[:2] // remove role-03 assignment
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment02,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			"role-02": roleRevisions[2], // revision of role-03, not role-02
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// verify that assignment with some but not all of the role revisions fails
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment02,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			// role-02 is missing
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// verify that assignment with all of the role revisions works
-	crsp, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment02,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			"role-02": roleRevisions[1],
-		},
-	})
-	require.NoError(t, err)
-	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(crsp.Assignment, assignment02, protocmp.Transform(), protocmp.IgnoreFields(&headerpb.Metadata{}, "revision")))
-
-	// Check that the assignment can be retrieved
-	grsp, err = service.GetScopedRoleAssignment(ctx, &srpb.GetScopedRoleAssignmentRequest{
-		Name: assignment02.Metadata.Name,
-	})
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
-}
-
-// TestScopedRoleAssignmentInteraction verifies the expected interaction rules between scoped roles and
-// scoped role assignments.
-func TestScopedRoleAssignmentInteraction(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	backend, err := memory.New(memory.Config{
-		Context: ctx,
-	})
-	require.NoError(t, err)
-
-	defer backend.Close()
-
-	service := NewScopedRoleService(backend)
-
-	roles := []*srpb.ScopedRole{
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-01",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-02",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/foo"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-03",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/bar"},
-			},
-			Version: types.V1,
-		},
-		{
-			Kind: sr.KindScopedRole,
-			Metadata: &headerpb.Metadata{
-				Name: "role-04",
-			},
-			Scope: "/",
-			Spec: &srpb.ScopedRoleSpec{
-				AssignableScopes: []string{"/bin"},
-			},
-			Version: types.V1,
-		},
-	}
-
-	var roleRevisions []string
-
-	// Create the roles.
-	for _, role := range roles {
-		rsp, err := service.CreateScopedRole(ctx, &srpb.CreateScopedRoleRequest{
-			Role: role,
-		})
-		require.NoError(t, err)
-
-		roleRevisions = append(roleRevisions, rsp.Role.Metadata.Revision)
-	}
-
-	// set up a non-trivial assignment with multiple sub-assignments
-	assignment01 := &srpb.ScopedRoleAssignment{
-		Kind: sr.KindScopedRoleAssignment,
-		Metadata: &headerpb.Metadata{
-			Name: uuid.New().String(),
-		},
-		Scope: "/",
-		Spec: &srpb.ScopedRoleAssignmentSpec{
-			User: "alice",
-			Assignments: []*srpb.Assignment{
-				{
-					Role:  "role-01",
-					Scope: "/foo",
-				},
-				{
-					Role:  "role-02",
-					Scope: "/foo/bar",
-				},
-				{
-					Role:  "role-03",
-					Scope: "/bar",
-				},
-			},
-		},
-		Version: types.V1,
-	}
-
-	crsp, err := service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			"role-02": roleRevisions[1],
-			"role-03": roleRevisions[2],
-		},
-	})
-	require.NoError(t, err)
-	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(crsp.Assignment, assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerpb.Metadata{}, "revision")))
-
-	// check that unrelated role can be deleted
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name:     "role-04",
-		Revision: roleRevisions[3],
-	})
-	require.NoError(t, err)
-
-	// check that deleting a role referenced by an assignment fails
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name:     "role-01",
-		Revision: roleRevisions[0],
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// check that updated a role s.t. it would invalidate an assignment fails
-	updatedRole := apiutils.CloneProtoMsg(roles[1])
-	updatedRole.Spec.AssignableScopes = []string{"/bin"} // role-02 is now assignable to /bin, not /foo
-	updatedRole.Metadata.Revision = roleRevisions[1]
-	_, err = service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: updatedRole,
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-
-	// check that deletion of a role s.t. it would invalidate an assignment fails
-	_, err = service.DeleteScopedRole(ctx, &srpb.DeleteScopedRoleRequest{
-		Name:     "role-02",
-		Revision: roleRevisions[1],
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
-
-	// delete the assignment
-	_, err = service.DeleteScopedRoleAssignment(ctx, &srpb.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: crsp.Assignment.Metadata.Revision,
-	})
-	require.NoError(t, err)
-
-	// check that update of role now succeeds
-	urrsp, err := service.UpdateScopedRole(ctx, &srpb.UpdateScopedRoleRequest{
-		Role: updatedRole,
-	})
-	require.NoError(t, err)
-
-	// check that recreate of assignment would now fail due to conflicting role
-	_, err = service.CreateScopedRoleAssignment(ctx, &srpb.CreateScopedRoleAssignmentRequest{
-		Assignment: assignment01,
-		RoleRevisions: map[string]string{
-			"role-01": roleRevisions[0],
-			"role-02": urrsp.Role.Metadata.Revision, // revision of updated role-02
-			"role-03": roleRevisions[2],
-		},
-	})
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
-}
diff --git a/lib/services/local/scoped_tokens.go b/lib/services/local/scoped_tokens.go
new file mode 100644
index 0000000000000..794219340fb17
--- /dev/null
+++ b/lib/services/local/scoped_tokens.go
@@ -0,0 +1,248 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/scopes"
+	"github.com/gravitational/teleport/lib/scopes/joining"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
+)
+
+const (
+	scopedTokenPrefix = "scoped_token"
+)
+
+// ScopedTokenService exposes backend functionality for working with scoped token resources.
+type ScopedTokenService struct {
+	svc *generic.ServiceWrapper[*joiningv1.ScopedToken]
+}
+
+// NewScopedTokenService creates a new ScopedTokenService.
+func NewScopedTokenService(b backend.Backend) (*ScopedTokenService, error) {
+	const pageLimit = 100
+	svc, err := generic.NewServiceWrapper(generic.ServiceConfig[*joiningv1.ScopedToken]{
+		Backend:       b,
+		PageLimit:     pageLimit,
+		ResourceKind:  types.KindScopedToken,
+		BackendPrefix: backend.NewKey(scopedTokenPrefix),
+		MarshalFunc:   services.MarshalProtoResource[*joiningv1.ScopedToken],
+		UnmarshalFunc: services.UnmarshalProtoResource[*joiningv1.ScopedToken],
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &ScopedTokenService{
+		svc: svc,
+	}, nil
+}
+
+// CreateScopedToken adds a scoped token to the auth server.
+func (s *ScopedTokenService) CreateScopedToken(ctx context.Context, req *joiningv1.CreateScopedTokenRequest) (*joiningv1.CreateScopedTokenResponse, error) {
+	if err := joining.StrongValidateToken(req.GetToken()); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	created, err := s.svc.CreateResource(ctx, req.GetToken())
+	return &joiningv1.CreateScopedTokenResponse{
+		Token: created,
+	}, trace.Wrap(err)
+}
+
+// GetScopedToken finds and returns a scoped token by name.
+func (s *ScopedTokenService) GetScopedToken(ctx context.Context, req *joiningv1.GetScopedTokenRequest) (*joiningv1.GetScopedTokenResponse, error) {
+	token, err := s.svc.GetResource(ctx, req.GetName())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := joining.WeakValidateToken(token); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &joiningv1.GetScopedTokenResponse{Token: token}, nil
+}
+
+// UseScopedToken fetches a scoped join token by unique name and checks if it
+// can be used for provisioning. Expired tokens will be deleted.
+func (s *ScopedTokenService) UseScopedToken(ctx context.Context, name string) (*joiningv1.ScopedToken, error) {
+	token, err := s.svc.GetResource(ctx, name)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := joining.ValidateTokenForUse(token); err != nil {
+		if trace.IsLimitExceeded(err) {
+			if err := s.svc.DeleteResource(ctx, name); err != nil {
+				return nil, trace.LimitExceeded("cleaning up expired token: %v", err)
+			}
+		}
+		return nil, trace.Wrap(err)
+	}
+	return token, nil
+}
+
+func evalScopeFilter(filter *scopesv1.Filter, scope string) bool {
+	if filter == nil {
+		return true
+	}
+
+	switch filter.Mode {
+	case scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE:
+		return scopes.ResourceScope(scope).IsSubjectToPolicyScope(filter.Scope)
+	case scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE:
+		return scopes.PolicyScope(scope).AppliesToResourceScope(filter.Scope)
+	}
+
+	return true
+}
+
+// ListScopedTokens retrieves a paginated list of scoped join tokens.
+func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv1.ListScopedTokensRequest) (*joiningv1.ListScopedTokensResponse, error) {
+	// we only want to return filters if at least one of the filters
+	// has been defined, otherwise we should return nil so that the
+	// backend can choose to perform a simple list operation instead
+	// of a list with filter
+	switch {
+	case req.ResourceScope != nil:
+	case req.AssignedScope != nil:
+	case len(req.Roles) > 0:
+	case len(req.Labels) > 0:
+	default:
+		tokens, cursor, err := s.svc.ListResources(ctx, int(req.GetLimit()), req.GetCursor())
+
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &joiningv1.ListScopedTokensResponse{
+			Tokens: tokens,
+			Cursor: cursor,
+		}, nil
+	}
+
+	if req.GetAssignedScope().GetScope() != "" {
+		if err := scopes.WeakValidate(req.GetAssignedScope().GetScope()); err != nil {
+			return nil, trace.BadParameter("invalid scope for assigned filter: %s", req.GetAssignedScope().GetScope())
+		}
+
+	}
+
+	if req.GetResourceScope().GetScope() != "" {
+		if err := scopes.WeakValidate(req.GetResourceScope().GetScope()); err != nil {
+			return nil, trace.BadParameter("invalid scope for resource filter: %s", req.GetResourceScope().GetScope())
+		}
+	}
+
+	filterRoles, err := types.NewTeleportRoles(req.GetRoles())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	filterFn := func(token *joiningv1.ScopedToken) bool {
+		if len(req.GetRoles()) > 0 {
+			roles, err := types.NewTeleportRoles(token.Spec.Roles)
+			if err != nil {
+				return false
+			}
+
+			if !filterRoles.IncludeAny(roles...) {
+				return false
+			}
+		}
+
+		if !evalScopeFilter(req.GetAssignedScope(), token.Spec.AssignedScope) {
+			return false
+		}
+
+		if !evalScopeFilter(req.GetResourceScope(), token.Scope) {
+			return false
+		}
+
+		for k, v := range req.GetLabels() {
+			if token.GetMetadata().GetLabels()[k] != v {
+				return false
+			}
+		}
+
+		if err := joining.WeakValidateToken(token); err != nil {
+			return false
+		}
+
+		return true
+	}
+
+	tokens, cursor, err := s.svc.ListResourcesWithFilter(ctx, int(req.GetLimit()), req.GetCursor(), filterFn)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &joiningv1.ListScopedTokensResponse{
+		Tokens: tokens,
+		Cursor: cursor,
+	}, nil
+}
+
+// DeleteScopedToken deletes a scoped token by name.
+func (s *ScopedTokenService) DeleteScopedToken(ctx context.Context, req *joiningv1.DeleteScopedTokenRequest) (*joiningv1.DeleteScopedTokenResponse, error) {
+	return nil, trace.Wrap(s.svc.DeleteResource(ctx, req.GetName()))
+}
+
+type scopedTokenParser struct {
+	baseParser
+}
+
+func newScopedTokenParser() *scopedTokenParser {
+	return &scopedTokenParser{
+		baseParser: newBaseParser(backend.NewKey(scopedTokenPrefix)),
+	}
+}
+
+func (p *scopedTokenParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpPut:
+		scopedToken, err := services.UnmarshalProtoResource[*joiningv1.ScopedToken](
+			event.Item.Value,
+			services.WithExpires(event.Item.Expires),
+			services.WithRevision(event.Item.Revision),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "unmarshaling resource from event")
+		}
+		return types.Resource153ToLegacy(scopedToken), nil
+	case types.OpDelete:
+		name := event.Item.Key.TrimPrefix(backend.NewKey(scopedTokenPrefix)).String()
+		if name == "" {
+			return nil, trace.NotFound("failed parsing %v", event.Item.Key)
+		}
+		return &types.ResourceHeader{
+			Kind:    types.KindScopedToken,
+			Version: types.V1,
+			Metadata: types.Metadata{
+				Name: name,
+			},
+		}, nil
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
diff --git a/lib/services/local/scoped_tokens_test.go b/lib/services/local/scoped_tokens_test.go
new file mode 100644
index 0000000000000..49003fc6bcb45
--- /dev/null
+++ b/lib/services/local/scoped_tokens_test.go
@@ -0,0 +1,350 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local_test
+
+import (
+	"cmp"
+	"slices"
+	"testing"
+	"time"
+
+	gocmp "github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+func TestScopedTokenService(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	clock.Advance(-30 * time.Hour)
+	bk, err := memory.New(memory.Config{
+		Clock: clock,
+	})
+	require.NoError(t, err)
+	// service, err := local.NewScopedTokenService(backend.NewSanitizer(bk))
+	service, err := local.NewScopedTokenService(bk)
+	require.NoError(t, err)
+
+	ctx := t.Context()
+
+	token := &joiningv1.ScopedToken{
+		Kind:    types.KindScopedToken,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "testtoken",
+		},
+		Scope: "/test",
+		Spec: &joiningv1.ScopedTokenSpec{
+			AssignedScope: "/test/one",
+			JoinMethod:    "token",
+			Roles:         []string{types.RoleNode.String()},
+		},
+	}
+
+	created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		Token: token,
+	})
+	require.NoError(t, err)
+	cmpOpts := []gocmp.Option{
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		protocmp.Transform(),
+	}
+	assert.Empty(t, gocmp.Diff(token, created.Token, cmpOpts...))
+
+	fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		Name: token.Metadata.Name,
+	})
+	require.NoError(t, err)
+	assert.Empty(t, gocmp.Diff(created.Token, fetched.Token, cmpOpts...))
+
+	_, err = service.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+		Name: fetched.Token.Metadata.Name,
+	})
+	require.NoError(t, err)
+	_, err = service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		Name: fetched.Token.Metadata.Name,
+	})
+	require.True(t, trace.IsNotFound(err))
+
+	expiredToken := proto.CloneOf(token)
+	expiredToken.Metadata.Name = "expiredtoken"
+	expiredToken.Metadata.Expires = timestamppb.New(time.Now().UTC().Add(-25 * time.Hour))
+
+	activeToken := proto.CloneOf(token)
+	activeToken.Metadata.Name = "activetoken"
+	activeToken.Metadata.Expires = timestamppb.New(time.Now().UTC().Add(25 * time.Hour))
+
+	expiredRes, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		Token: expiredToken,
+	})
+	require.NoError(t, err)
+
+	activeRes, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		Token: activeToken,
+	})
+	require.NoError(t, err)
+
+	// expired tokens should error and delete the token
+	expiredToken, err = service.UseScopedToken(ctx, expiredRes.Token.Metadata.Name)
+	require.True(t, trace.IsLimitExceeded(err))
+	require.Nil(t, expiredToken)
+
+	_, err = service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		Name: expiredRes.Token.Metadata.Name,
+	})
+	require.True(t, trace.IsNotFound(err))
+
+	// active tokens should function like a get
+	activeToken, err = service.UseScopedToken(ctx, activeToken.Metadata.Name)
+	require.NoError(t, err)
+	assert.Empty(t, gocmp.Diff(activeToken, activeRes.Token, cmpOpts...))
+
+	fetchedActive, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		Name: activeRes.Token.Metadata.Name,
+	})
+	require.NoError(t, err)
+	assert.Empty(t, gocmp.Diff(activeRes.Token, fetchedActive.Token, cmpOpts...))
+}
+
+func TestScopedTokenList(t *testing.T) {
+	bk, err := memory.New(memory.Config{})
+	require.NoError(t, err)
+	service, err := local.NewScopedTokenService(backend.NewSanitizer(bk))
+	require.NoError(t, err)
+
+	ctx := t.Context()
+
+	test := &joiningv1.ScopedToken{
+		Kind:    types.KindScopedToken,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "test",
+		},
+		Scope: "/test",
+		Spec: &joiningv1.ScopedTokenSpec{
+			AssignedScope: "/test",
+			JoinMethod:    "token",
+			Roles: []string{
+				types.RoleNode.String(),
+			},
+		},
+	}
+
+	test1 := proto.CloneOf(test)
+	test1.Metadata.Name = "test1"
+	test1.Scope = "/test/aa"
+	test1.Spec.AssignedScope = test1.Scope
+
+	test2 := proto.CloneOf(test)
+	test2.Metadata.Name = "test2"
+	test2.Scope = "/test/bb"
+	test2.Spec.AssignedScope = test2.Scope
+	test2.Metadata.Labels = map[string]string{
+		"hello": "world",
+	}
+
+	test3 := proto.CloneOf(test)
+	test3.Metadata.Name = "test3"
+	test3.Scope = "/test/aa/bb"
+	test3.Spec.AssignedScope = test3.Scope
+
+	test4 := proto.CloneOf(test)
+	test4.Metadata.Name = "test4"
+	test4.Spec.AssignedScope = "/test/aa"
+	test4.Scope = "/test/aa"
+	test4.Spec.AssignedScope = test4.Scope
+
+	stage := proto.CloneOf(test)
+	stage.Metadata.Name = "stage"
+	stage.Scope = "/stage"
+	stage.Spec.AssignedScope = stage.Scope
+
+	stage1 := proto.CloneOf(stage)
+	stage1.Metadata.Name = "stage1"
+	stage1.Spec.AssignedScope = "/stage/aa"
+
+	stage2 := proto.CloneOf(stage)
+	stage2.Metadata.Name = "stage2"
+	stage2.Scope = "/stage/aa"
+	stage2.Spec.AssignedScope = "/stage/aa"
+
+	allTokens := []*joiningv1.ScopedToken{test, test1, test2, test3, test4, stage, stage1, stage2}
+	for _, token := range allTokens {
+		_, err = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+		require.NoError(t, err)
+	}
+
+	sortFn := func(left *joiningv1.ScopedToken, right *joiningv1.ScopedToken) int {
+		return cmp.Compare(left.Metadata.Name, right.Metadata.Name)
+	}
+	cases := []struct {
+		name     string
+		req      *joiningv1.ListScopedTokensRequest
+		expected []*joiningv1.ScopedToken
+	}{
+		{
+			name:     "all tokens (no filters)",
+			req:      &joiningv1.ListScopedTokensRequest{},
+			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4, stage, stage1, stage2},
+		},
+		{
+			name: "tokens assigning scope descendant of /test",
+			req: &joiningv1.ListScopedTokensRequest{
+				AssignedScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4},
+		},
+		{
+			name: "tokens assigning scope descendant of /test/aa",
+			req: &joiningv1.ListScopedTokensRequest{
+				AssignedScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test/aa",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test1, test3, test4},
+		},
+		{
+			name: "tokens assigning scope ancestor to /test/bb",
+			req: &joiningv1.ListScopedTokensRequest{
+				AssignedScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/test/bb",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test, test2},
+		},
+		{
+			name: "tokens descendants of /test",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4},
+		},
+		{
+			name: "tokens descendants of /test/aa",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test/aa",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test1, test3, test4},
+		},
+		{
+			name: "tokens ancestor to /test/bb",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
+					Scope: "/test/bb",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test, test2},
+		},
+		{
+			name: "tokens descendant of /stage assigning /stage/aa",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/stage",
+				},
+				AssignedScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/stage/aa",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{stage1, stage2},
+		},
+		{
+			name: "tokens descendant of /stage/aa assigning /stage/aa",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/stage/aa",
+				},
+				AssignedScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/stage/aa",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{stage2},
+		},
+		{
+			name: "tokens in /test scope applying auth role",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test",
+				},
+				Roles: []string{types.RoleAuth.String()},
+			},
+			expected: []*joiningv1.ScopedToken{},
+		},
+		{
+			name: "tokens in /test scope filtered by label",
+			req: &joiningv1.ListScopedTokensRequest{
+				ResourceScope: &scopesv1.Filter{
+					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
+					Scope: "/test",
+				},
+				Roles: []string{types.RoleNode.String()},
+				Labels: map[string]string{
+					"hello": "world",
+				},
+			},
+			expected: []*joiningv1.ScopedToken{test2},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			req := proto.CloneOf(c.req)
+			req.Limit = 10
+			res, err := service.ListScopedTokens(ctx, req)
+			require.NoError(t, err)
+
+			slices.SortStableFunc(c.expected, sortFn)
+			slices.SortStableFunc(res.GetTokens(), sortFn)
+			require.Len(t, res.GetTokens(), len(c.expected))
+			for i, token := range res.GetTokens() {
+				cmpOpts := []gocmp.Option{
+					protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+					protocmp.Transform(),
+				}
+				assert.Empty(t, gocmp.Diff(c.expected[i], token, cmpOpts...))
+			}
+		})
+	}
+}
diff --git a/lib/services/local/services_test.go b/lib/services/local/services_test.go
index 842a92ea60968..c8aced1c2dd89 100644
--- a/lib/services/local/services_test.go
+++ b/lib/services/local/services_test.go
@@ -28,18 +28,17 @@ import (
 
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/services/suite"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
 type servicesContext struct {
 	bk    backend.Backend
-	suite *suite.ServicesTestSuite
+	suite *ServicesTestSuite
 }
 
 func setupServicesContext(ctx context.Context, t *testing.T) *servicesContext {
@@ -65,7 +64,7 @@ func setupServicesContext(ctx context.Context, t *testing.T) *servicesContext {
 	identityService, err := NewTestIdentityService(tt.bk)
 	require.NoError(t, err)
 
-	tt.suite = &suite.ServicesTestSuite{
+	tt.suite = &ServicesTestSuite{
 		TrustS:         caService,
 		TrustInternalS: caService,
 		PresenceS:      presenceService,
@@ -101,12 +100,15 @@ func TestCRUD(t *testing.T) {
 	t.Run("TestToken", tt.suite.TokenCRUD)
 	t.Run("TestRoles", tt.suite.RolesCRUD)
 	t.Run("TestSAMLCRUD", tt.suite.SAMLCRUD)
+	t.Run("TestSAMLPagination", tt.suite.SAMLPagination)
 	t.Run("TestTunnelConnectionsCRUD", tt.suite.TunnelConnectionsCRUD)
 	t.Run("TestGithubConnectorCRUD", tt.suite.GithubConnectorCRUD)
+	t.Run("TestGithubPagination", tt.suite.GithubPagination)
 	t.Run("TestEvents", tt.suite.Events)
 	t.Run("TestEventsClusterConfig", tt.suite.EventsClusterConfig)
 	t.Run("TestNetworkRestrictions", func(t *testing.T) { tt.suite.NetworkRestrictions(t) })
 	t.Run("TestOIDCCRUD", tt.suite.OIDCCRUD)
+	t.Run("TestOIDCPagination", tt.suite.OIDCPagination)
 }
 
 func TestSemaphore(t *testing.T) {
diff --git a/lib/services/local/session.go b/lib/services/local/session.go
index 816ae30e9cc98..499e2457ecc89 100644
--- a/lib/services/local/session.go
+++ b/lib/services/local/session.go
@@ -20,6 +20,8 @@ package local
 
 import (
 	"context"
+	"iter"
+	"log/slog"
 	"slices"
 
 	"github.com/gravitational/trace"
@@ -27,7 +29,9 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 )
 
 // GetAppSession gets an application web session.
@@ -71,85 +75,80 @@ func (s *IdentityService) ListAppSessions(ctx context.Context, pageSize int, pag
 
 // GetSnowflakeSessions gets all Snowflake web sessions.
 func (s *IdentityService) GetSnowflakeSessions(ctx context.Context) ([]types.WebSession, error) {
-	startKey := backend.ExactKey(snowflakePrefix, sessionsPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
+	out, err := stream.Collect(s.rangeSessions(ctx, "", "", "", snowflakePrefix, sessionsPrefix))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	out := make([]types.WebSession, len(result.Items))
-	for i, item := range result.Items {
-		session, err := services.UnmarshalWebSession(item.Value, services.WithRevision(item.Revision))
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		out[i] = session
-	}
 	return out, nil
 }
 
+// ListSnowflakeSessions gets a paginated list of Snowflake web sessions.
+func (s *IdentityService) ListSnowflakeSessions(ctx context.Context, pageSize int, pageToken string) ([]types.WebSession, string, error) {
+	return s.listSessions(ctx, pageSize, pageToken, "", snowflakePrefix, sessionsPrefix)
+}
+
+// RangeSnowflakeSessions returns Snowflake web sessions within the range [start, end).
+func (s *IdentityService) RangeSnowflakeSessions(ctx context.Context, start, end string) iter.Seq2[types.WebSession, error] {
+	return s.rangeSessions(ctx, start, end, "", snowflakePrefix, sessionsPrefix)
+}
+
 // listSessions gets a paginated list of sessions.
 func (s *IdentityService) listSessions(ctx context.Context, pageSize int, pageToken, user string, keyPrefix ...string) ([]types.WebSession, string, error) {
-	rangeStart := backend.NewKey(append(keyPrefix, pageToken)...)
-	rangeEnd := backend.RangeEnd(backend.ExactKey(keyPrefix...))
-
 	// Adjust page size, so it can't be too large.
 	if pageSize <= 0 || pageSize > maxSessionPageSize {
 		pageSize = maxSessionPageSize
 	}
 
-	// Increment pageSize to allow for the extra item represented by nextKey.
-	// We skip this item in the results below.
-	limit := pageSize + 1
-	var out []types.WebSession
+	return generic.CollectPageAndCursor(
+		s.rangeSessions(ctx, pageToken, "", user, keyPrefix...),
+		pageSize,
+		types.WebSession.GetName,
+	)
+}
 
-	if user == "" {
-		// no filter provided get the range directly
-		result, err := s.GetRange(ctx, rangeStart, rangeEnd, limit)
+func (s *IdentityService) rangeSessions(ctx context.Context, start, end string, user string, keyPrefix ...string) iter.Seq2[types.WebSession, error] {
+	mapFn := func(item backend.Item) (types.WebSession, bool) {
+		// TODO(okraport): Do not unmarshal the expiry and instead rely on the unmarshalled fields.
+		// This is because currently the backend expiry is the minima of Expires and BearerTokenExpires.
+		// Address this and revisit unmarshal opts.
+		session, err := services.UnmarshalWebSession(item.Value,
+			services.WithRevision(item.Revision))
 		if err != nil {
-			return nil, "", trace.Wrap(err)
+			s.logger.WarnContext(ctx, "Failed to unmarshal web session",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
 		}
 
-		out = make([]types.WebSession, 0, len(result.Items))
-		for _, item := range result.Items {
-			session, err := services.UnmarshalWebSession(item.Value, services.WithRevision(item.Revision))
-			if err != nil {
-				return nil, "", trace.Wrap(err)
-			}
-			out = append(out, session)
+		if user != "" && session.GetUser() != user {
+			return session, false
 		}
-	} else {
-		// iterate over the sessions to filter only those matching the provided user
-		if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, limit, func(items []backend.Item) (stop bool, err error) {
-			for _, item := range items {
-				if len(out) == limit {
-					break
-				}
-
-				session, err := services.UnmarshalWebSession(item.Value, services.WithRevision(item.Revision))
-				if err != nil {
-					return false, trace.Wrap(err)
-				}
-
-				if session.GetUser() == user {
-					out = append(out, session)
-				}
-			}
-
-			return len(out) == limit, nil
-		}); err != nil {
-			return nil, "", trace.Wrap(err)
-		}
-	}
 
-	var nextKey string
-	if len(out) > pageSize {
-		nextKey = backend.GetPaginationKey(out[len(out)-1])
-		// Truncate the last item that was used to determine next row existence.
-		out = out[:pageSize]
-	}
-
-	return out, nextKey, nil
+		return session, true
+	}
+
+	sessionKey := backend.NewKey(keyPrefix...)
+	startKey := sessionKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(sessionKey)
+	if end != "" {
+		endKey = sessionKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(session types.WebSession) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || session.GetName() < end
+		})
 }
 
 // UpsertAppSession creates an application web session.
@@ -355,17 +354,12 @@ type webSessions struct {
 	backend backend.Backend
 }
 
-// WebTokens returns the web token manager.
-func (s *IdentityService) WebTokens() types.WebTokenInterface {
-	return &webTokens{backend: s.Backend}
-}
-
-// Get returns the web token described with req.
-func (r *webTokens) Get(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
+// GetWebToken returns the web token described with req.
+func (r *IdentityService) GetWebToken(ctx context.Context, req types.GetWebTokenRequest) (types.WebToken, error) {
 	if err := req.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	item, err := r.backend.Get(ctx, webTokenKey(req.Token))
+	item, err := r.Get(ctx, webTokenKey(req.Token))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -376,25 +370,59 @@ func (r *webTokens) Get(ctx context.Context, req types.GetWebTokenRequest) (type
 	return token, nil
 }
 
-// List gets all web tokens.
-func (r *webTokens) List(ctx context.Context) (out []types.WebToken, err error) {
-	startKey := backend.ExactKey(webPrefix, tokensPrefix)
-	result, err := r.backend.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
+// GetWebTokens gets all web tokens.
+func (r *IdentityService) GetWebTokens(ctx context.Context) (out []types.WebToken, err error) {
+	tokens, err := stream.Collect(r.RangeWebTokens(ctx, "", ""))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	for _, item := range result.Items {
-		token, err := services.UnmarshalWebToken(item.Value, services.WithRevision(item.Revision))
+	return tokens, nil
+}
+
+// ListWebTokens returns a page of web tokens
+func (r *IdentityService) ListWebTokens(ctx context.Context, limit int, start string) ([]types.WebToken, string, error) {
+	return generic.CollectPageAndCursor(r.RangeWebTokens(ctx, start, ""), limit, types.WebToken.GetToken)
+}
+
+// RangeWebTokens returns web tokens within the range [start, end).
+func (r *IdentityService) RangeWebTokens(ctx context.Context, start, end string) iter.Seq2[types.WebToken, error] {
+	mapFn := func(item backend.Item) (types.WebToken, bool) {
+		token, err := services.UnmarshalWebToken(item.Value,
+			services.WithRevision(item.Revision))
 		if err != nil {
-			return nil, trace.Wrap(err)
+			slog.WarnContext(ctx, "Failed to unmarshal web token",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
 		}
-		out = append(out, token)
-	}
-	return out, nil
+		return token, true
+	}
+
+	tokenKey := backend.NewKey(webPrefix, tokensPrefix)
+	startKey := tokenKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(tokenKey)
+	if end != "" {
+		endKey = tokenKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			r.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(token types.WebToken) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || token.GetToken() < end
+		})
 }
 
-// Upsert updates the existing or inserts a new web token.
-func (r *webTokens) Upsert(ctx context.Context, token types.WebToken) error {
+// UpsertWebToken updates the existing or inserts a new web token.
+func (r *IdentityService) UpsertWebToken(ctx context.Context, token types.WebToken) error {
 	rev := token.GetRevision()
 	bytes, err := services.MarshalWebToken(token, services.WithVersion(types.V3))
 	if err != nil {
@@ -407,34 +435,30 @@ func (r *webTokens) Upsert(ctx context.Context, token types.WebToken) error {
 		Expires:  metadata.Expiry(),
 		Revision: rev,
 	}
-	_, err = r.backend.Put(ctx, item)
+	_, err = r.Put(ctx, item)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
-// Delete deletes the web token specified with req from the storage.
-func (r *webTokens) Delete(ctx context.Context, req types.DeleteWebTokenRequest) error {
+// DeleteWebToken deletes the web token specified with req from the storage.
+func (r *IdentityService) DeleteWebToken(ctx context.Context, req types.DeleteWebTokenRequest) error {
 	if err := req.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-	return trace.Wrap(r.backend.Delete(ctx, webTokenKey(req.Token)))
+	return trace.Wrap(r.Delete(ctx, webTokenKey(req.Token)))
 }
 
-// DeleteAll removes all web tokens.
-func (r *webTokens) DeleteAll(ctx context.Context) error {
+// DeleteAllWebTokens removes all web tokens.
+func (r *IdentityService) DeleteAllWebTokens(ctx context.Context) error {
 	startKey := backend.ExactKey(webPrefix, tokensPrefix)
-	if err := r.backend.DeleteRange(ctx, startKey, backend.RangeEnd(startKey)); err != nil {
+	if err := r.DeleteRange(ctx, startKey, backend.RangeEnd(startKey)); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
-type webTokens struct {
-	backend backend.Backend
-}
-
 func webSessionKey(sessionID string) backend.Key {
 	return backend.NewKey(webPrefix, sessionsPrefix, sessionID)
 }
diff --git a/lib/services/local/session_test.go b/lib/services/local/session_test.go
index 3547e55c698ad..60ec29a328f7e 100644
--- a/lib/services/local/session_test.go
+++ b/lib/services/local/session_test.go
@@ -20,16 +20,23 @@ package local
 
 import (
 	"context"
+	"fmt"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 func TestDeleteUserAppSessions(t *testing.T) {
@@ -172,3 +179,253 @@ func TestListAppSessions(t *testing.T) {
 		}
 	}
 }
+
+func TestListSnowflakeSessions(t *testing.T) {
+	t.Parallel()
+
+	clock := clockwork.NewFakeClock()
+	backend, err := memory.New(memory.Config{
+		Context: context.Background(),
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	identity, err := NewTestIdentityService(backend)
+	require.NoError(t, err)
+
+	users := []string{"alice", "bob"}
+	ctx := context.Background()
+
+	// the default page size is used if the pageSize
+	// provide to ListSnowflakeSessions is 0 || > maxSessionPageSize
+	const useDefaultPageSize = 0
+
+	// Validate no sessions exist
+	sessions, next, err := identity.ListSnowflakeSessions(ctx, useDefaultPageSize, "")
+	require.NoError(t, err)
+	require.Empty(t, sessions)
+	require.Empty(t, next)
+
+	// Create 3 pages worth of sessions. One full
+	// page per user and one partial page with 5
+	// sessions per user.
+	var expected []types.WebSession
+	for range maxSessionPageSize + 5 {
+		for _, user := range users {
+			session, err := types.NewWebSession(uuid.New().String(), types.KindSnowflakeSession, types.WebSessionSpecV2{
+				User:    user,
+				Expires: clock.Now().Add(time.Hour),
+			})
+			require.NoError(t, err)
+
+			err = identity.UpsertSnowflakeSession(ctx, session)
+			require.NoError(t, err)
+			expected = append(expected, session)
+		}
+	}
+
+	// Validate page size is truncated to maxSessionPageSize
+	sessions, next, err = identity.ListSnowflakeSessions(ctx, maxSessionPageSize+maxSessionPageSize*2/3, "")
+	require.NoError(t, err)
+	require.Len(t, sessions, maxSessionPageSize)
+	require.NotEmpty(t, next)
+
+	opts := []cmp.Option{
+		cmpopts.SortSlices(func(a, b types.WebSession) bool {
+			return a.GetName() < b.GetName()
+		}),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	}
+
+	sessions, err = stream.Collect(clientutils.Resources(ctx, identity.ListSnowflakeSessions))
+	require.NoError(t, err)
+	require.Len(t, sessions, len(expected))
+	require.Empty(t, cmp.Diff(expected, sessions, opts...))
+
+	// reset token
+	next = ""
+
+	// Validate that sessions are retrieved for all users
+	// with the default page size
+	for {
+		sessions, next, err = identity.ListSnowflakeSessions(ctx, useDefaultPageSize, next)
+		require.NoError(t, err)
+		if next == "" {
+			require.Len(t, sessions, 10)
+			break
+		} else {
+			require.Len(t, sessions, maxSessionPageSize)
+		}
+	}
+}
+
+func TestWebTokenCRUD(t *testing.T) {
+	ctx := t.Context()
+	clock := clockwork.NewFakeClock()
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	identity, err := NewTestIdentityService(backend)
+	require.NoError(t, err)
+
+	newToken := func(name, user string) types.WebToken {
+		expires := clock.Now().Add(time.Hour)
+		token, err := types.NewWebToken(expires, types.WebTokenSpecV3{
+			Token: name,
+			User:  user,
+		})
+
+		require.NoError(t, err)
+		return token
+	}
+
+	// Initially we expect no tokens.
+	out, err := identity.GetWebTokens(ctx)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	out, next, err := identity.ListWebTokens(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Create some tokens.
+	var expected []types.WebToken
+	for i := range 5 {
+		tk := newToken(fmt.Sprintf("resource-%d", i), "bob")
+		err := identity.UpsertWebToken(ctx, tk)
+		require.NoError(t, err)
+		expected = append(expected, tk)
+	}
+
+	// Fetch all tokens.
+	out, err = identity.GetWebTokens(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, next, err = identity.ListWebTokens(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+	require.Empty(t, next)
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Fetch a specific token.
+	token, err := identity.GetWebToken(ctx, types.GetWebTokenRequest{
+		Token: expected[1].GetName(),
+		User:  expected[1].GetUser(),
+	})
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected[1], token,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Try to fetch a token that doesn't exist.
+	_, err = identity.GetWebToken(ctx, types.GetWebTokenRequest{
+		Token: "doesnotexist",
+		User:  "alice",
+	})
+	require.IsType(t, trace.NotFound(""), err)
+
+	// Upsert.
+	expected[1].SetUser("alice")
+	err = identity.UpsertWebToken(ctx, expected[1])
+	require.NoError(t, err)
+	token, err = identity.GetWebToken(ctx, types.GetWebTokenRequest{
+		Token: expected[1].GetName(),
+		User:  expected[1].GetUser(),
+	})
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected[1], token,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	page1, page2Start, err := identity.ListWebTokens(ctx, 2, "")
+	require.NoError(t, err)
+	assert.Len(t, page1, 2)
+	assert.NotEmpty(t, page2Start)
+
+	page2, next, err := identity.ListWebTokens(ctx, 1000, page2Start)
+	require.NoError(t, err)
+	assert.Len(t, page2, len(expected)-2)
+	assert.Empty(t, next)
+
+	listed := append(page1, page2...)
+
+	assert.Empty(t, cmp.Diff(expected, listed,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", page2Start))
+	require.NoError(t, err)
+	assert.Len(t, out, len(page1))
+	assert.Empty(t, cmp.Diff(page1, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", ""))
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected))
+	assert.Empty(t, cmp.Diff(expected, out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, page2Start, ""))
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected)-2)
+	assert.Empty(t, cmp.Diff(expected, append(page1, out...),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Try to delete a token that doesn't exist.
+	err = identity.DeleteWebToken(ctx, types.DeleteWebTokenRequest{
+		Token: "doesnotexist",
+		User:  "doesnotexist",
+	})
+	require.IsType(t, trace.NotFound(""), err)
+
+	err = identity.DeleteWebToken(ctx, types.DeleteWebTokenRequest{
+		Token: expected[0].GetToken(),
+		User:  expected[0].GetUser(),
+	})
+	require.NoError(t, err)
+
+	// Verify deleted
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", ""))
+	require.NoError(t, err)
+	assert.Len(t, out, len(expected)-1)
+	assert.Empty(t, cmp.Diff(expected[1:], out,
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+	))
+
+	// Delete all tokens.
+	err = identity.DeleteAllWebTokens(ctx)
+	require.NoError(t, err)
+	out, err = identity.GetWebTokens(ctx)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	out, next, err = identity.ListWebTokens(ctx, 0, "")
+	require.NoError(t, err)
+	require.Empty(t, out)
+	require.Empty(t, next)
+
+	out, err = stream.Collect(identity.RangeWebTokens(ctx, "", ""))
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+}
diff --git a/lib/services/local/sessiontracker.go b/lib/services/local/sessiontracker.go
index 95ec34895d78e..a2094ca6abac8 100644
--- a/lib/services/local/sessiontracker.go
+++ b/lib/services/local/sessiontracker.go
@@ -62,7 +62,7 @@ func (s *sessionTracker) loadSession(ctx context.Context, sessionID string) (typ
 }
 
 // UpdatePresence updates the presence status of a user in a session.
-func (s *sessionTracker) UpdatePresence(ctx context.Context, sessionID, user string) error {
+func (s *sessionTracker) UpdatePresence(ctx context.Context, sessionID, user, userTeleportCluster string) error {
 	for i := 0; i < updateRetryLimit; i++ {
 		sessionItem, err := s.bk.Get(ctx, backend.NewKey(sessionPrefix, sessionID))
 		if err != nil {
@@ -74,7 +74,7 @@ func (s *sessionTracker) UpdatePresence(ctx context.Context, sessionID, user str
 			return trace.Wrap(err)
 		}
 
-		if err := session.UpdatePresence(user, s.bk.Clock().Now().UTC()); err != nil {
+		if err := session.UpdatePresence(user, userTeleportCluster, s.bk.Clock().Now().UTC()); err != nil {
 			return trace.Wrap(err)
 		}
 
diff --git a/lib/services/local/spiffe_federations_test.go b/lib/services/local/spiffe_federations_test.go
index 7ce3ffaa25529..6f4de5d01fb1b 100644
--- a/lib/services/local/spiffe_federations_test.go
+++ b/lib/services/local/spiffe_federations_test.go
@@ -166,9 +166,9 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(page, func(federation *machineidv1.SPIFFEFederation) bool {
+			require.True(t, slices.ContainsFunc(page, func(federation *machineidv1.SPIFFEFederation) bool {
 				return proto.Equal(created, federation)
-			})
+			}))
 		}
 	})
 	t.Run("pagination", func(t *testing.T) {
@@ -190,9 +190,9 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 		require.Len(t, fetched, 49)
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(fetched, func(federation *machineidv1.SPIFFEFederation) bool {
+			require.True(t, slices.ContainsFunc(fetched, func(federation *machineidv1.SPIFFEFederation) bool {
 				return proto.Equal(created, federation)
-			})
+			}))
 		}
 	})
 }
diff --git a/lib/services/local/suite_test.go b/lib/services/local/suite_test.go
new file mode 100644
index 0000000000000..6b58887b3ce19
--- /dev/null
+++ b/lib/services/local/suite_test.go
@@ -0,0 +1,2683 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+	"crypto/x509/pkix"
+	"fmt"
+	"log/slog"
+	"sort"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
+	protobuf "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/clusterconfig"
+	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// ServicesTestSuite is an acceptance test suite
+// for services. It is used for local implementations and implementations
+// using gRPC to guarantee consistency between local and remote services
+type ServicesTestSuite struct {
+	Access         services.Access
+	TrustS         services.Trust
+	TrustInternalS services.TrustInternal
+	PresenceS      services.Presence
+	ProvisioningS  services.Provisioner
+	WebS           services.Identity
+	ConfigS        services.ClusterConfiguration
+	// LocalConfigS is used for local config which can only be
+	// managed by the Auth service directly (static tokens).
+	// Used by some tests to differentiate between a server
+	// and client interface.
+	LocalConfigS  services.ClusterConfigurationInternal
+	EventsS       types.Events
+	UsersS        services.UsersService
+	RestrictionsS services.Restrictions
+	ChangesC      chan any
+	Clock         *clockwork.FakeClock
+}
+
+func (s *ServicesTestSuite) Users() services.UsersService {
+	if s.WebS != nil {
+		return s.WebS
+	}
+	return s.UsersS
+}
+
+func userSlicesEqual(t *testing.T, a []types.User, b []types.User) {
+	require.Lenf(t, a, len(b), "a: %#v b: %#v", a, b)
+
+	sort.Sort(services.Users(a))
+	sort.Sort(services.Users(b))
+
+	for i := range a {
+		usersEqual(t, a[i], b[i])
+	}
+}
+
+func usersEqual(t *testing.T, a types.User, b types.User) {
+	require.True(t, services.UsersEquals(a, b), cmp.Diff(a, b))
+}
+
+func newUser(name string, roles []string) types.User {
+	return &types.UserV2{
+		Kind:    types.KindUser,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      name,
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.UserSpecV2{
+			Roles: roles,
+		},
+	}
+}
+
+func (s *ServicesTestSuite) UsersCRUD(t *testing.T) {
+	ctx := context.Background()
+
+	u, err := s.WebS.GetUsers(ctx, false)
+	require.NoError(t, err)
+	require.Empty(t, u)
+
+	u1 := newUser("user1", nil)
+	u2 := newUser("user2", nil)
+	_, err = s.WebS.CreateUser(ctx, u1)
+	require.NoError(t, err)
+	_, err = s.WebS.CreateUser(ctx, u2)
+	require.NoError(t, err)
+	require.NoError(t, s.WebS.UpsertPassword("user1", []byte("secretpassword123")))
+	require.NoError(t, s.WebS.UpsertPassword("user2", []byte("secretpassword234")))
+
+	u1.SetPasswordState(types.PasswordState_PASSWORD_STATE_SET)
+	u2.SetPasswordState(types.PasswordState_PASSWORD_STATE_SET)
+
+	u, err = s.WebS.GetUsers(ctx, false)
+	require.NoError(t, err)
+	userSlicesEqual(t, u, []types.User{u1, u2})
+
+	out, err := s.WebS.GetUser(ctx, "user1", false)
+	require.NoError(t, err)
+	usersEqual(t, out, u[0])
+
+	user := newUser("user1", []string{"admin", "user"})
+	user, err = s.WebS.UpsertUser(ctx, user)
+	require.NoError(t, err)
+
+	out, err = s.WebS.GetUser(ctx, "user1", false)
+	require.NoError(t, err)
+	usersEqual(t, out, user)
+
+	out, err = s.WebS.GetUser(ctx, "user1", false)
+	require.NoError(t, err)
+	usersEqual(t, out, user)
+
+	require.NoError(t, s.WebS.DeleteUser(ctx, "user1"))
+
+	u, err = s.WebS.GetUsers(ctx, false)
+	require.NoError(t, err)
+	userSlicesEqual(t, u, []types.User{u2})
+
+	err = s.WebS.DeleteUser(ctx, "user1")
+	require.True(t, trace.IsNotFound(err))
+
+	// bad username
+	_, err = s.WebS.UpsertUser(ctx, newUser("", nil))
+	require.True(t, trace.IsBadParameter(err))
+}
+
+func (s *ServicesTestSuite) UsersExpiry(t *testing.T) {
+	ctx := context.Background()
+	expiresAt := s.Clock.Now().Add(1 * time.Minute)
+
+	_, err := s.WebS.UpsertUser(ctx, &types.UserV2{
+		Kind:    types.KindUser,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      "foo",
+			Namespace: apidefaults.Namespace,
+			Expires:   &expiresAt,
+		},
+		Spec: types.UserSpecV2{},
+	})
+	require.NoError(t, err)
+
+	// Make sure the user exists.
+	u, err := s.WebS.GetUser(ctx, "foo", false)
+	require.NoError(t, err)
+	require.Equal(t, "foo", u.GetName())
+
+	s.Clock.Advance(2 * time.Minute)
+
+	// Make sure the user is now gone.
+	_, err = s.WebS.GetUser(ctx, "foo", false)
+	require.Error(t, err)
+}
+
+func (s *ServicesTestSuite) LoginAttempts(t *testing.T) {
+	user1 := uuid.NewString()
+
+	user := newUser(user1, []string{"admin", "user"})
+	user, err := s.WebS.UpsertUser(context.Background(), user)
+	require.NoError(t, err)
+
+	attempts, err := s.WebS.GetUserLoginAttempts(user.GetName())
+	require.NoError(t, err)
+	require.Empty(t, attempts)
+
+	clock := clockwork.NewFakeClock()
+	attempt1 := services.LoginAttempt{Time: clock.Now().UTC(), Success: false}
+	err = s.WebS.AddUserLoginAttempt(user.GetName(), attempt1, defaults.AttemptTTL)
+	require.NoError(t, err)
+
+	attempt2 := services.LoginAttempt{Time: clock.Now().UTC(), Success: false}
+	err = s.WebS.AddUserLoginAttempt(user.GetName(), attempt2, defaults.AttemptTTL)
+	require.NoError(t, err)
+
+	attempts, err = s.WebS.GetUserLoginAttempts(user.GetName())
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(attempts, []services.LoginAttempt{attempt1, attempt2}))
+	require.False(t, services.LastFailed(3, attempts))
+	require.True(t, services.LastFailed(2, attempts))
+}
+
+func (s *ServicesTestSuite) CertAuthCRUD(t *testing.T) {
+	ctx := context.Background()
+	ca := NewTestCA(types.UserCA, "example.com")
+	require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
+
+	out, err := s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(out, ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	cas, err := s.TrustS.GetCertAuthorities(ctx, types.UserCA, false)
+	require.NoError(t, err)
+	ca2 := ca.Clone().(*types.CertAuthorityV2)
+	ca2.Spec.ActiveKeys.SSH[0].PrivateKey = nil
+	ca2.Spec.ActiveKeys.TLS[0].Key = nil
+	require.Empty(t, cmp.Diff(cas[0], ca2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	cas, err = s.TrustS.GetCertAuthorities(ctx, types.UserCA, true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(cas[0], ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	cas, err = s.TrustS.GetCertAuthorities(ctx, types.UserCA, true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(cas[0], ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.TrustS.DeleteCertAuthority(ctx, *ca.ID())
+	require.NoError(t, err)
+
+	// test compare and swap
+	ca = NewTestCA(types.UserCA, "example.com")
+	require.NoError(t, s.TrustS.CreateCertAuthority(ctx, ca))
+
+	clock := clockwork.NewFakeClock()
+	newCA := *ca
+	rotation := types.Rotation{
+		State:       types.RotationStateInProgress,
+		CurrentID:   "id1",
+		GracePeriod: types.NewDuration(time.Hour),
+		Started:     clock.Now(),
+	}
+	newCA.SetRotation(rotation)
+
+	err = s.TrustS.CompareAndSwapCertAuthority(&newCA, ca)
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(&newCA, out, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// test conditional update
+	ca = NewTestCA(types.UserCA, "update.example.com")
+	rev, err := s.TrustInternalS.CreateCertAuthorities(ctx, ca)
+	require.NoError(t, err)
+
+	newCA = *ca
+	rotation = types.Rotation{
+		State:       types.RotationStateInProgress,
+		CurrentID:   "id1",
+		GracePeriod: types.NewDuration(time.Hour),
+		Started:     clock.Now(),
+	}
+	newCA.SetRotation(rotation)
+
+	// verify that mismatched revision does not work
+	_, err = s.TrustInternalS.UpdateCertAuthority(ctx, &newCA)
+	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
+
+	// verify that revision returned by create causes update to succeed
+	newCA.SetRevision(rev)
+	_, err = s.TrustInternalS.UpdateCertAuthority(ctx, &newCA)
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(&newCA, out, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// verify 'bulk' ca operations
+
+	clusterNames := []string{
+		"foo.example.com",
+		"bar.example.com",
+		"bin.example.com",
+		"baz.example.com",
+	}
+
+	cas = nil
+	for _, cn := range clusterNames {
+		cas = append(cas, NewTestCA(types.UserCA, cn))
+	}
+
+	rev, err = s.TrustInternalS.CreateCertAuthorities(ctx, cas...)
+	require.NoError(t, err)
+
+	// verify that all CAs were created and that they all have the expected revision
+	for _, original := range cas {
+		ca, err := s.TrustS.GetCertAuthority(ctx, original.GetID(), true)
+		require.NoError(t, err)
+		require.Equal(t, rev, ca.GetRevision())
+		require.Empty(t, cmp.Diff(original, ca, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	}
+
+	// set up bulk delete
+	var ids []types.CertAuthID
+	for _, ca := range cas {
+		ids = append(ids, ca.GetID())
+	}
+
+	require.NoError(t, s.TrustInternalS.DeleteCertAuthorities(ctx, ids...))
+
+	// verify that bulk deletion succeeded
+	for _, ca := range cas {
+		_, err := s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
+		require.True(t, trace.IsNotFound(err), "err: %v", err)
+	}
+}
+
+// NewServer creates a new server resource
+func NewServer(kind, name, addr, namespace string) *types.ServerV2 {
+	return &types.ServerV2{
+		Kind:    kind,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Spec: types.ServerSpecV2{
+			Addr: addr,
+		},
+	}
+}
+
+func (s *ServicesTestSuite) ServerCRUD(t *testing.T) {
+	ctx := context.Background()
+
+	// SSH service.
+	out, err := s.PresenceS.GetNodes(ctx, apidefaults.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	srv := NewServer(types.KindNode, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
+	srv.Spec.Hostname = "llama"
+	_, err = s.PresenceS.UpsertNode(ctx, srv)
+	require.NoError(t, err)
+
+	node, err := s.PresenceS.GetNode(ctx, srv.Metadata.Namespace, srv.GetName())
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(node, srv, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out, err = s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{srv}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.PresenceS.DeleteNode(ctx, srv.Metadata.Namespace, srv.GetName())
+	require.NoError(t, err)
+
+	out, err = s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Proxy service.
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = s.PresenceS.GetProxies()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	proxy := NewServer(types.KindProxy, "proxy1", "127.0.0.1:2023", apidefaults.Namespace)
+	proxy.Spec.Hostname = "proxy.llama"
+	require.NoError(t, s.PresenceS.UpsertProxy(ctx, proxy))
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = s.PresenceS.GetProxies()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{proxy}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.PresenceS.DeleteProxy(ctx, proxy.GetName())
+	require.NoError(t, err)
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = s.PresenceS.GetProxies()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Auth service.
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = s.PresenceS.GetAuthServers()
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	auth := NewServer(types.KindAuthServer, "auth1", "127.0.0.1:2025", apidefaults.Namespace)
+	auth.Spec.Hostname = "auth.llama"
+	require.NoError(t, s.PresenceS.UpsertAuthServer(ctx, auth))
+
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	out, err = s.PresenceS.GetAuthServers()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out, []types.Server{auth}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+}
+
+// AppServerCRUD tests CRUD functionality for services.Server.
+func (s *ServicesTestSuite) AppServerCRUD(t *testing.T) {
+	ctx := context.Background()
+
+	// Expect not to be returned any applications and trace.NotFound.
+	out, err := s.PresenceS.GetApplicationServers(ctx, apidefaults.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	// Make an app and an app server.
+	app, err := types.NewAppV3(types.Metadata{Name: "foo"},
+		types.AppSpecV3{URI: "http://127.0.0.1:8080", PublicAddr: "foo.example.com"})
+	require.NoError(t, err)
+	server, err := types.NewAppServerV3(types.Metadata{
+		Name:      app.GetName(),
+		Namespace: apidefaults.Namespace,
+	}, types.AppServerSpecV3{
+		Hostname: "localhost",
+		HostID:   uuid.New().String(),
+		App:      app,
+	})
+	require.NoError(t, err)
+
+	// Upsert application.
+	_, err = s.PresenceS.UpsertApplicationServer(ctx, server)
+	require.NoError(t, err)
+
+	// Check again, expect a single application to be found.
+	out, err = s.PresenceS.GetApplicationServers(ctx, server.GetNamespace())
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff([]types.AppServer{server}, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// Remove the application.
+	err = s.PresenceS.DeleteApplicationServer(ctx, server.Metadata.Namespace, server.GetHostID(), server.GetName())
+	require.NoError(t, err)
+
+	// Now expect no applications to be returned.
+	out, err = s.PresenceS.GetApplicationServers(ctx, server.Metadata.Namespace)
+	require.NoError(t, err)
+	require.Empty(t, out)
+}
+
+func newReverseTunnel(clusterName string, dialAddrs []string) *types.ReverseTunnelV2 {
+	return &types.ReverseTunnelV2{
+		Kind:    types.KindReverseTunnel,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      clusterName,
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.ReverseTunnelSpecV2{
+			ClusterName: clusterName,
+			DialAddrs:   dialAddrs,
+		},
+	}
+}
+
+func (s *ServicesTestSuite) PasswordCRUD(t *testing.T) {
+	ctx := context.Background()
+
+	_, err := s.WebS.GetPasswordHash("user1")
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("%#v", err))
+
+	u1 := newUser("user1", nil)
+	_, err = s.WebS.CreateUser(ctx, u1)
+	require.NoError(t, err)
+
+	err = s.WebS.UpsertPassword("user1", []byte("secretpassword123"))
+	require.NoError(t, err)
+
+	hash, err := s.WebS.GetPasswordHash("user1")
+	require.NoError(t, err)
+	err = bcrypt.CompareHashAndPassword(hash, []byte("secretpassword123"))
+	require.NoError(t, err)
+
+	err = s.WebS.UpsertPassword("user1", []byte("secretpassword321"))
+	require.NoError(t, err)
+
+	hash, err = s.WebS.GetPasswordHash("user1")
+	require.NoError(t, err)
+	err = bcrypt.CompareHashAndPassword(hash, []byte("secretpassword321"))
+	require.NoError(t, err)
+}
+
+func (s *ServicesTestSuite) WebSessionCRUD(t *testing.T) {
+	ctx := context.Background()
+	req := types.GetWebSessionRequest{User: "user1", SessionID: "sid1"}
+	_, err := s.WebS.WebSessions().Get(ctx, req)
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("%#v", err))
+
+	dt := s.Clock.Now().Add(1 * time.Minute)
+	ws, err := types.NewWebSession("sid1", types.KindWebSession,
+		types.WebSessionSpecV2{
+			User:    "user1",
+			Pub:     []byte("pub123"),
+			Priv:    []byte("priv123"),
+			Expires: dt,
+		})
+	require.NoError(t, err)
+
+	err = s.WebS.WebSessions().Upsert(ctx, ws)
+	require.NoError(t, err)
+
+	out, err := s.WebS.WebSessions().Get(ctx, req)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(out, ws, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	ws1, err := types.NewWebSession("sid1", types.KindWebSession,
+		types.WebSessionSpecV2{
+			User:    "user1",
+			Pub:     []byte("pub321"),
+			Priv:    []byte("priv321"),
+			Expires: dt,
+		})
+	require.NoError(t, err)
+
+	err = s.WebS.WebSessions().Upsert(ctx, ws1)
+	require.NoError(t, err)
+
+	out2, err := s.WebS.WebSessions().Get(ctx, req)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(out2, ws1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	require.NoError(t, s.WebS.WebSessions().Delete(ctx, types.DeleteWebSessionRequest{
+		User:      req.User,
+		SessionID: req.SessionID,
+	}))
+
+	_, err = s.WebS.WebSessions().Get(ctx, req)
+	require.True(t, trace.IsNotFound(err))
+}
+
+func (s *ServicesTestSuite) TokenCRUD(t *testing.T) {
+	ctx := context.Background()
+	_, err := s.ProvisioningS.GetToken(ctx, "token")
+	require.True(t, trace.IsNotFound(err))
+
+	tok, err := types.NewProvisionToken("token", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
+	require.NoError(t, err)
+
+	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
+
+	token, err := s.ProvisioningS.GetToken(ctx, "token")
+	require.NoError(t, err)
+	require.True(t, token.GetRoles().Include(types.RoleAuth))
+	require.True(t, token.GetRoles().Include(types.RoleNode))
+	require.False(t, token.GetRoles().Include(types.RoleProxy))
+	require.Equal(t, time.Time{}, token.Expiry())
+
+	require.NoError(t, s.ProvisioningS.DeleteToken(ctx, "token"))
+
+	_, err = s.ProvisioningS.GetToken(ctx, "token")
+	require.True(t, trace.IsNotFound(err))
+
+	// check tokens backwards compatibility and marshal/unmarshal
+	expiry := time.Now().UTC().Add(time.Hour)
+	v1 := &types.ProvisionTokenV1{
+		Token:   "old",
+		Roles:   types.SystemRoles{types.RoleNode, types.RoleProxy},
+		Expires: expiry,
+	}
+	v2, err := types.NewProvisionToken(v1.Token, v1.Roles, expiry)
+	require.NoError(t, err)
+
+	// Tokens in different version formats are backwards and forwards
+	// compatible
+	require.Empty(t, cmp.Diff(v1.V2(), v2))
+	require.Empty(t, cmp.Diff(v2.V1(), v1))
+
+	// Marshal V1, unmarshal V2
+	data, err := services.MarshalProvisionToken(v2, services.WithVersion(types.V1))
+	require.NoError(t, err)
+
+	out, err := services.UnmarshalProvisionToken(data)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(out, v2))
+
+	// Test delete tokens
+	tok, err = types.NewProvisionToken("token1", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
+	require.NoError(t, err)
+	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
+
+	tok, err = types.NewProvisionToken("token2", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
+	require.NoError(t, err)
+	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
+
+	tokens, err := stream.Collect(clientutils.Resources(ctx,
+		func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+			return s.ProvisioningS.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+		}))
+	require.NoError(t, err)
+	require.Len(t, tokens, 2)
+
+	err = s.ProvisioningS.DeleteToken(ctx, tokens[0].GetName())
+	require.NoError(t, err)
+
+	err = s.ProvisioningS.DeleteToken(ctx, tokens[1].GetName())
+	require.NoError(t, err)
+
+	tokens, err = stream.Collect(clientutils.Resources(ctx,
+		func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+			return s.ProvisioningS.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+		}))
+	require.NoError(t, err)
+	require.Empty(t, tokens)
+}
+
+func (s *ServicesTestSuite) RolesCRUD(t *testing.T) {
+	ctx := context.Background()
+
+	out, err := s.Access.GetRoles(ctx)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	role := types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V6,
+		Metadata: types.Metadata{
+			Name:      "role1",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.RoleSpecV6{
+			Options: types.RoleOptions{
+				MaxSessionTTL:     types.Duration(time.Hour),
+				PortForwarding:    types.NewBoolOption(true),
+				CertificateFormat: constants.CertificateFormatStandard,
+				BPF:               apidefaults.EnhancedEvents(),
+			},
+			Allow: types.RoleConditions{
+				Logins:           []string{"root", "bob"},
+				NodeLabels:       types.Labels{types.Wildcard: []string{types.Wildcard}},
+				AppLabels:        types.Labels{types.Wildcard: []string{types.Wildcard}},
+				KubernetesLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+				DatabaseLabels:   types.Labels{types.Wildcard: []string{types.Wildcard}},
+				Namespaces:       []string{apidefaults.Namespace},
+				Rules: []types.Rule{
+					types.NewRule(types.KindRole, services.RO()),
+				},
+			},
+			Deny: types.RoleConditions{
+				Namespaces: []string{apidefaults.Namespace},
+			},
+		},
+	}
+
+	upserted, err := s.Access.UpsertRole(ctx, &role)
+	require.NoError(t, err)
+	rout, err := s.Access.GetRole(ctx, role.Metadata.Name)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, rout, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	role.Spec.Allow.Logins = []string{"bob"}
+	upserted, err = s.Access.UpsertRole(ctx, &role)
+	require.NoError(t, err)
+	rout, err = s.Access.GetRole(ctx, role.Metadata.Name)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, rout, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.Access.DeleteRole(ctx, role.Metadata.Name)
+	require.NoError(t, err)
+
+	_, err = s.Access.GetRole(ctx, role.Metadata.Name)
+	require.True(t, trace.IsNotFound(err))
+}
+
+func (s *ServicesTestSuite) SAMLCRUD(t *testing.T) {
+	ctx := context.Background()
+	connector := &types.SAMLConnectorV2{
+		Kind:    types.KindSAML,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      "saml1",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.SAMLConnectorSpecV2{
+			Display:                  "SAML",
+			Issuer:                   "http://example.com",
+			SSO:                      "https://example.com/saml/sso",
+			AssertionConsumerService: "https://localhost/acs",
+			Audience:                 "https://localhost/aud",
+			ServiceProviderIssuer:    "https://localhost/iss",
+			AttributesToRoles: []types.AttributeMapping{
+				{Name: "groups", Value: "admin", Roles: []string{"admin"}},
+			},
+			Cert: fixtures.TLSCACertPEM,
+			SigningKeyPair: &types.AsymmetricKeyPair{
+				PrivateKey: fixtures.TLSCAKeyPEM,
+				Cert:       fixtures.TLSCACertPEM,
+			},
+		},
+	}
+	err := services.ValidateSAMLConnector(connector, nil)
+	require.NoError(t, err)
+	upserted, err := s.WebS.UpsertSAMLConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	t.Cleanup(func() {
+		s.WebS.DeleteSAMLConnector(ctx, connector.GetName())
+	})
+
+	connectors, err := s.WebS.GetSAMLConnectors(ctx, true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.SAMLConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out2, err := s.WebS.GetSAMLConnector(ctx, connector.GetName(), false)
+	require.NoError(t, err)
+	connectorNoSecrets := *connector
+	connectorNoSecrets.Spec.SigningKeyPair.PrivateKey = ""
+	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	connectorsNoSecrets, err := s.WebS.GetSAMLConnectors(ctx, false)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.SAMLConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.WebS.DeleteSAMLConnector(ctx, connector.GetName())
+	require.NoError(t, err)
+
+	err = s.WebS.DeleteSAMLConnector(ctx, connector.GetName())
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	_, err = s.WebS.GetSAMLConnector(ctx, connector.GetName(), true)
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	created, err := s.WebS.CreateSAMLConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, created.GetRevision())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("not-saml")
+
+	updated, err := s.WebS.UpdateSAMLConnector(ctx, connector)
+	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
+	require.Nil(t, updated)
+
+	connector.SetRevision(created.GetRevision())
+	updated, err = s.WebS.UpdateSAMLConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, updated.GetRevision())
+	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
+	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("llama")
+
+	upserted, err = s.WebS.UpsertSAMLConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, upserted.GetRevision())
+	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
+	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
+}
+
+func (s *ServicesTestSuite) SAMLPagination(t *testing.T) {
+	ctx := t.Context()
+
+	newResource := func(name string) *types.SAMLConnectorV2 {
+		return &types.SAMLConnectorV2{
+			Kind:    types.KindSAML,
+			Version: types.V2,
+			Metadata: types.Metadata{
+				Name:      name,
+				Namespace: apidefaults.Namespace,
+			},
+			Spec: types.SAMLConnectorSpecV2{
+				Display:                  "SAML",
+				Issuer:                   "http://example.com",
+				SSO:                      "https://example.com/saml/sso",
+				AssertionConsumerService: "https://localhost/acs",
+				Audience:                 "https://localhost/aud",
+				ServiceProviderIssuer:    "https://localhost/iss",
+				AttributesToRoles: []types.AttributeMapping{
+					{Name: "groups", Value: "admin", Roles: []string{"admin"}},
+				},
+				Cert: fixtures.TLSCACertPEM,
+				SigningKeyPair: &types.AsymmetricKeyPair{
+					PrivateKey: fixtures.TLSCAKeyPEM,
+					Cert:       fixtures.TLSCACertPEM,
+				},
+			},
+		}
+	}
+
+	pageSize := 2
+	totalItems := pageSize*2 + (pageSize / 2)
+	var expected []types.SAMLConnector
+	var expectedWithoutSecrets []types.SAMLConnector
+	for i := range totalItems {
+		connector := newResource(fmt.Sprintf("connector-%d", i))
+		_, err := s.WebS.UpsertSAMLConnector(ctx, connector)
+		require.NoError(t, err)
+		expected = append(expected, connector)
+
+		connectorNoSecrets := *connector
+		connectorNoSecrets.Spec.SigningKeyPair = &types.AsymmetricKeyPair{
+			PrivateKey: "",
+			Cert:       fixtures.TLSCACertPEM,
+		}
+		expectedWithoutSecrets = append(expectedWithoutSecrets, &connectorNoSecrets)
+	}
+
+	t.Cleanup(func() {
+		for _, conn := range expected {
+			s.WebS.DeleteSAMLConnector(ctx, conn.GetName())
+		}
+	})
+
+	t.Run("GetSAMLConnectors", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetSAMLConnectors(ctx, false)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expectedWithoutSecrets, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("GetSAMLConnectors with secrets", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetSAMLConnectors(ctx, true)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expected, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListSAMLConnectorsWithOptions", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// no limits
+		conns, next, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListSAMLConnectorsWithOptions with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// no limits
+		conns, next, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListSAMLConnectorsWithOptions(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeSAMLConnectorsWithOptions", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeSAMLConnectorsWithOptions with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeSAMLConnectorsWithOptions(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+}
+
+func (s *ServicesTestSuite) OIDCCRUD(t *testing.T) {
+	ctx := t.Context()
+
+	connector := &types.OIDCConnectorV3{
+		Kind:    types.KindOIDC,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      "oidc1",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.OIDCConnectorSpecV3{
+			Display:      "SAML",
+			IssuerURL:    "http://example.com",
+			ClientID:     "aaa",
+			ClientSecret: "bbb",
+			RedirectURLs: []string{"https://localhost:3080/v1/webapi/github/callback"},
+			ClaimsToRoles: []types.ClaimMapping{
+				{
+					Claim: "abc",
+					Value: "xyz",
+					Roles: []string{"admin"},
+				},
+			},
+		},
+	}
+
+	upserted, err := s.WebS.UpsertOIDCConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	t.Cleanup(func() {
+		s.WebS.DeleteOIDCConnector(ctx, connector.GetName())
+	})
+
+	connectors, err := s.WebS.GetOIDCConnectors(ctx, true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.OIDCConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out2, err := s.WebS.GetOIDCConnector(ctx, connector.GetName(), false)
+	require.NoError(t, err)
+	connectorNoSecrets := *connector
+	connectorNoSecrets.Spec.ClientSecret = ""
+	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	connectorsNoSecrets, err := s.WebS.GetOIDCConnectors(ctx, false)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.OIDCConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.WebS.DeleteOIDCConnector(ctx, connector.GetName())
+	require.NoError(t, err)
+
+	err = s.WebS.DeleteOIDCConnector(ctx, connector.GetName())
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	_, err = s.WebS.GetOIDCConnector(ctx, connector.GetName(), true)
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	created, err := s.WebS.CreateOIDCConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, created.GetRevision())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("not-saml")
+
+	updated, err := s.WebS.UpdateOIDCConnector(ctx, connector)
+	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
+	require.Nil(t, updated)
+
+	connector.SetRevision(created.GetRevision())
+	updated, err = s.WebS.UpdateOIDCConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, updated.GetRevision())
+	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
+	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("llama")
+
+	upserted, err = s.WebS.UpsertOIDCConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, upserted.GetRevision())
+	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
+	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
+}
+
+func (s *ServicesTestSuite) OIDCPagination(t *testing.T) {
+	ctx := t.Context()
+
+	newResource := func(name string) *types.OIDCConnectorV3 {
+		return &types.OIDCConnectorV3{
+			Kind:    types.KindOIDC,
+			Version: types.V2,
+			Metadata: types.Metadata{
+				Name:      name,
+				Namespace: apidefaults.Namespace,
+			},
+			Spec: types.OIDCConnectorSpecV3{
+				Display:      "SAML",
+				IssuerURL:    "http://example.com",
+				ClientID:     "aaa",
+				ClientSecret: "bbb",
+				RedirectURLs: []string{"https://localhost:3080/v1/webapi/github/callback"},
+				ClaimsToRoles: []types.ClaimMapping{
+					{
+						Claim: "abc",
+						Value: "xyz",
+						Roles: []string{"admin"},
+					},
+				},
+			},
+		}
+	}
+
+	pageSize := 2
+	totalItems := pageSize*2 + (pageSize / 2)
+	var expected []types.OIDCConnector
+	var expectedWithoutSecrets []types.OIDCConnector
+	for i := range totalItems {
+		connector := newResource(fmt.Sprintf("connector-%d", i))
+		_, err := s.WebS.UpsertOIDCConnector(ctx, connector)
+		require.NoError(t, err)
+		expected = append(expected, connector)
+
+		connectorNoSecrets := *connector
+		connectorNoSecrets.Spec.ClientSecret = ""
+		expectedWithoutSecrets = append(expectedWithoutSecrets, &connectorNoSecrets)
+	}
+
+	t.Cleanup(func() {
+		for _, conn := range expected {
+			s.WebS.DeleteOIDCConnector(ctx, conn.GetName())
+		}
+	})
+
+	t.Run("GetOIDCConnectors", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetOIDCConnectors(ctx, false)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expectedWithoutSecrets, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("GetOIDCConnectors with secrets", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetOIDCConnectors(ctx, true)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expected, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListOIDCConnectors", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// no limits
+		conns, next, err := s.WebS.ListOIDCConnectors(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListOIDCConnectors(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListOIDCConnectors(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListOIDCConnectors with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// no limits
+		conns, next, err := s.WebS.ListOIDCConnectors(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListOIDCConnectors(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListOIDCConnectors(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeOIDCConnectors", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeOIDCConnectors(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeOIDCConnectors with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeOIDCConnectors(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeOIDCConnectors(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+}
+
+func (s *ServicesTestSuite) TunnelConnectionsCRUD(t *testing.T) {
+	clusterName := "example.com"
+	out, err := s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	dt := s.Clock.Now()
+	conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
+		ClusterName:   clusterName,
+		ProxyName:     "p1",
+		LastHeartbeat: dt,
+	})
+	require.NoError(t, err)
+
+	err = s.TrustS.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out, err = s.TrustS.GetAllTunnelConnections()
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	dt = dt.Add(time.Hour)
+	conn.SetLastHeartbeat(dt)
+
+	err = s.TrustS.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.TrustS.DeleteAllTunnelConnections()
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
+
+	err = s.TrustS.DeleteAllTunnelConnections()
+	require.NoError(t, err)
+
+	// test delete individual connection
+	err = s.TrustS.UpsertTunnelConnection(conn)
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.TrustS.DeleteTunnelConnection(clusterName, conn.GetName())
+	require.NoError(t, err)
+
+	out, err = s.TrustS.GetTunnelConnections(clusterName)
+	require.NoError(t, err)
+	require.Empty(t, out)
+}
+
+func (s *ServicesTestSuite) GithubConnectorCRUD(t *testing.T) {
+	ctx := context.Background()
+	connector := &types.GithubConnectorV3{
+		Kind:    types.KindGithubConnector,
+		Version: types.V3,
+		Metadata: types.Metadata{
+			Name:      "github",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.GithubConnectorSpecV3{
+			ClientID:     "aaa",
+			ClientSecret: "bbb",
+			RedirectURL:  "https://localhost:3080/v1/webapi/github/callback",
+			Display:      "GitHub",
+			TeamsToRoles: []types.TeamRolesMapping{
+				{
+					Organization: "gravitational",
+					Team:         "admins",
+					Roles:        []string{"admin"},
+				},
+			},
+		},
+	}
+	err := connector.CheckAndSetDefaults()
+	require.NoError(t, err)
+	upserted, err := s.WebS.UpsertGithubConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	t.Cleanup(func() {
+		s.WebS.DeleteGithubConnector(ctx, connector.GetName())
+	})
+
+	connectors, err := s.WebS.GetGithubConnectors(ctx, true)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.GithubConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	out2, err := s.WebS.GetGithubConnector(ctx, connector.GetName(), false)
+	require.NoError(t, err)
+	connectorNoSecrets := *connector
+	connectorNoSecrets.Spec.ClientSecret = ""
+	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	connectorsNoSecrets, err := s.WebS.GetGithubConnectors(ctx, false)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff([]types.GithubConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.WebS.DeleteGithubConnector(ctx, connector.GetName())
+	require.NoError(t, err)
+
+	err = s.WebS.DeleteGithubConnector(ctx, connector.GetName())
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	_, err = s.WebS.GetGithubConnector(ctx, connector.GetName(), true)
+	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
+
+	created, err := s.WebS.CreateGithubConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, created.GetRevision())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("not-github")
+
+	updated, err := s.WebS.UpdateGithubConnector(ctx, connector)
+	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
+	require.Nil(t, updated)
+
+	connector.SetRevision(created.GetRevision())
+	updated, err = s.WebS.UpdateGithubConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, updated.GetRevision())
+	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
+	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
+
+	connector = utils.CloneProtoMsg(connector)
+	connector.SetRevision(uuid.NewString())
+	connector.SetDisplay("llama")
+
+	upserted, err = s.WebS.UpsertGithubConnector(ctx, connector)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.NotEmpty(t, upserted.GetRevision())
+	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
+	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
+}
+
+func (s *ServicesTestSuite) GithubPagination(t *testing.T) {
+	ctx := t.Context()
+
+	newResource := func(name string) *types.GithubConnectorV3 {
+		return &types.GithubConnectorV3{
+			Kind:    types.KindGithubConnector,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name:      name,
+				Namespace: apidefaults.Namespace,
+			},
+			Spec: types.GithubConnectorSpecV3{
+				ClientID:     "aaa",
+				ClientSecret: "bbb",
+				RedirectURL:  "https://localhost:3080/v1/webapi/github/callback",
+				Display:      "GitHub",
+				TeamsToRoles: []types.TeamRolesMapping{
+					{
+						Organization: "gravitational",
+						Team:         "admins",
+						Roles:        []string{"admin"},
+					},
+				},
+			},
+		}
+	}
+
+	pageSize := 2
+	totalItems := pageSize*2 + (pageSize / 2)
+	var expected []types.GithubConnector
+	var expectedWithoutSecrets []types.GithubConnector
+	for i := range totalItems {
+		connector := newResource(fmt.Sprintf("connector-%d", i))
+		_, err := s.WebS.UpsertGithubConnector(ctx, connector)
+		require.NoError(t, err)
+		expected = append(expected, connector)
+
+		connectorNoSecrets := *connector
+		connectorNoSecrets.Spec.ClientSecret = ""
+		expectedWithoutSecrets = append(expectedWithoutSecrets, &connectorNoSecrets)
+	}
+
+	t.Cleanup(func() {
+		for _, conn := range expected {
+			s.WebS.DeleteGithubConnector(ctx, conn.GetName())
+		}
+	})
+
+	t.Run("GetGithubConnectors", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetGithubConnectors(ctx, false)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expectedWithoutSecrets, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("GetGithubConnectors with secrets", func(t *testing.T) {
+		// Verify legacy getters still work as expected.
+		conns, err := s.WebS.GetGithubConnectors(ctx, true)
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(expected, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListGithubConnectors", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// no limits
+		conns, next, err := s.WebS.ListGithubConnectors(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListGithubConnectors(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListGithubConnectors(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("ListGithubConnectors with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// no limits
+		conns, next, err := s.WebS.ListGithubConnectors(ctx, 0, "", withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// page limit
+		page1, page2Start, err := s.WebS.ListGithubConnectors(ctx, pageSize, "", withSecrets)
+		require.NoError(t, err)
+		require.NotEmpty(t, page2Start)
+		require.Empty(t, cmp.Diff(want[:pageSize], page1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// rest with start
+		page2, next, err := s.WebS.ListGithubConnectors(ctx, 0, page2Start, withSecrets)
+		require.NoError(t, err)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(want[pageSize:], page2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		require.Empty(t, cmp.Diff(want, append(page1, page2...), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeGithubConnectors", func(t *testing.T) {
+		withSecrets := false
+		want := expectedWithoutSecrets
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeGithubConnectors(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+	t.Run("RangeGithubConnectors with secrets", func(t *testing.T) {
+		withSecrets := true
+		want := expected
+
+		// full range
+		conns, err := stream.Collect(s.WebS.RangeGithubConnectors(ctx, "", "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want, conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, want[pageSize].GetName(), "", withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with end
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, "", want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		// with start and end
+		conns, err = stream.Collect(s.WebS.RangeGithubConnectors(ctx, want[pageSize].GetName(), want[pageSize*2].GetName(), withSecrets))
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(want[pageSize:pageSize*2], conns, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	})
+
+}
+
+// AuthPreference tests authentication preference service
+func (s *ServicesTestSuite) AuthPreference(t *testing.T) {
+	ctx := context.Background()
+	ap, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
+		Type:                  constants.Local,
+		SecondFactor:          constants.SecondFactorOTP,
+		DisconnectExpiredCert: types.NewBoolOption(true),
+	})
+	require.NoError(t, err)
+
+	// Create a preference when one does not exist.
+	created, err := s.ConfigS.CreateAuthPreference(ctx, ap)
+	require.NoError(t, err)
+	require.NotEmpty(t, created.GetRevision())
+
+	// Validate the created preference matches the retrieve preference.
+	gotAP, err := s.ConfigS.GetAuthPreference(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(ap, gotAP), cmpopts.IgnoreFields(types.Metadata{}, "Revision"))
+
+	// Validate that update only works if the revision matches.
+	gotAP.SetRevision("123")
+	_, err = s.ConfigS.UpdateAuthPreference(ctx, gotAP)
+	require.True(t, trace.IsCompareFailed(err))
+
+	// Validate that upserting overwrites the value regardless of the revision.
+	upserted, err := s.ConfigS.UpsertAuthPreference(ctx, gotAP)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, gotAP), cmpopts.IgnoreFields(types.Metadata{}, "Revision"))
+}
+
+// AccessGraphSettings tests access graph settings service
+func (s *ServicesTestSuite) AccessGraphSettings(t *testing.T) {
+	ctx := context.Background()
+	ap, err := clusterconfig.NewAccessGraphSettings(
+		&clusterconfigpb.AccessGraphSettingsSpec{
+			SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
+		},
+	)
+	require.NoError(t, err)
+
+	created, err := s.ConfigS.CreateAccessGraphSettings(ctx, ap)
+	require.NoError(t, err)
+	require.NotEmpty(t, created.GetMetadata().GetRevision())
+
+	// Validate the created preference matches the retrieve preference.
+	got, err := s.ConfigS.GetAccessGraphSettings(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(ap, got, protocmp.Transform()))
+
+	// Validate that update only works if the revision matches.
+	got.Metadata.Revision = "123"
+	_, err = s.ConfigS.UpdateAccessGraphSettings(ctx, got)
+	require.True(t, trace.IsCompareFailed(err))
+
+	// Validate that upserting overwrites the value regardless of the revision.
+	upserted, err := s.ConfigS.UpsertAccessGraphSettings(ctx, protobuf.Clone(got).(*clusterconfigpb.AccessGraphSettings))
+	require.NoError(t, err)
+	require.NotEmpty(t, upserted.GetMetadata().GetRevision())
+	upserted.Metadata.Revision = ""
+	got.Metadata.Revision = ""
+	require.Empty(t, cmp.Diff(upserted, got, protocmp.Transform()))
+}
+
+// SessionRecordingConfig tests session recording configuration.
+func (s *ServicesTestSuite) SessionRecordingConfig(t *testing.T) {
+	ctx := context.Background()
+	recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		Mode: types.RecordAtProxy,
+	})
+	require.NoError(t, err)
+
+	// Validate updating a non-existent config fails.
+	_, err = s.ConfigS.UpdateSessionRecordingConfig(ctx, recConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	// Create a config when one does not exist.
+	created, err := s.ConfigS.CreateSessionRecordingConfig(ctx, recConfig)
+	require.NoError(t, err)
+	require.NotEmpty(t, created.GetRevision())
+
+	// Validate the created config matches the retrieve config.
+	gotRecConfig, err := s.ConfigS.GetSessionRecordingConfig(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(recConfig, gotRecConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// Validate that update only works if the revision matches.
+	gotRecConfig.SetRevision("123")
+	_, err = s.ConfigS.UpdateSessionRecordingConfig(ctx, gotRecConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	created.SetMode(types.RecordAtNode)
+
+	updated, err := s.ConfigS.UpdateSessionRecordingConfig(ctx, created)
+	require.NoError(t, err)
+	require.Equal(t, types.RecordAtNode, updated.GetMode())
+
+	// Validate that upserting overwrites the value regardless of the revision.
+	upserted, err := s.ConfigS.UpsertSessionRecordingConfig(ctx, gotRecConfig)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, gotRecConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+}
+
+func (s *ServicesTestSuite) StaticTokens(t *testing.T) {
+	ctx := t.Context()
+	// set static tokens
+	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+		StaticTokens: []types.ProvisionTokenV1{
+			{
+				Token:   "tok1",
+				Roles:   types.SystemRoles{types.RoleNode},
+				Expires: time.Now().UTC().Add(time.Hour),
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	err = s.ConfigS.SetStaticTokens(staticTokens)
+	require.NoError(t, err)
+
+	out, err := s.ConfigS.GetStaticTokens(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(staticTokens, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.ConfigS.DeleteStaticTokens()
+	require.NoError(t, err)
+
+	_, err = s.ConfigS.GetStaticTokens(ctx)
+	require.True(t, trace.IsNotFound(err))
+}
+
+// Options provides functional arguments
+// to turn certain parts of the test suite off
+type Options struct {
+	// SkipDelete turns off deletes in tests
+	SkipDelete bool
+}
+
+// Option is a functional suite option
+type Option func(s *Options)
+
+// SkipDelete instructs tests to skip testing delete features
+func SkipDelete() Option {
+	return func(s *Options) {
+		s.SkipDelete = true
+	}
+}
+
+// CollectOptions collects suite options
+func CollectOptions(opts ...Option) Options {
+	var suiteOpts Options
+	for _, o := range opts {
+		o(&suiteOpts)
+	}
+	return suiteOpts
+}
+
+// ClusterName tests cluster name.
+func (s *ServicesTestSuite) ClusterName(t *testing.T, opts ...Option) {
+	ctx := context.Background()
+	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+		ClusterName: "example.com",
+	})
+	require.NoError(t, err)
+	err = s.LocalConfigS.SetClusterName(clusterName)
+	require.NoError(t, err)
+
+	gotName, err := s.ConfigS.GetClusterName(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(clusterName, gotName, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	err = s.LocalConfigS.DeleteClusterName()
+	require.NoError(t, err)
+
+	_, err = s.ConfigS.GetClusterName(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = s.LocalConfigS.UpsertClusterName(clusterName)
+	require.NoError(t, err)
+
+	gotName, err = s.ConfigS.GetClusterName(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(clusterName, gotName, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+}
+
+// ClusterNetworkingConfig tests cluster networking configuration.
+func (s *ServicesTestSuite) ClusterNetworkingConfig(t *testing.T) {
+	ctx := context.Background()
+	netConfig, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
+		ClientIdleTimeout: types.NewDuration(17 * time.Second),
+		KeepAliveCountMax: 3000,
+	})
+	require.NoError(t, err)
+
+	// Validate updating a non-existent config fails.
+	_, err = s.ConfigS.UpdateClusterNetworkingConfig(ctx, netConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	// Create a config when one does not exist.
+	created, err := s.ConfigS.CreateClusterNetworkingConfig(ctx, netConfig)
+	require.NoError(t, err)
+	require.NotEmpty(t, created.GetRevision())
+
+	// Validate the created config matches the retrieve config.
+	gotNetConfig, err := s.ConfigS.GetClusterNetworkingConfig(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(netConfig, gotNetConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// Validate that update only works if the revision matches.
+	gotNetConfig.SetRevision("123")
+	_, err = s.ConfigS.UpdateClusterNetworkingConfig(ctx, gotNetConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	created.SetKeepAliveCountMax(10)
+
+	updated, err := s.ConfigS.UpdateClusterNetworkingConfig(ctx, created)
+	require.NoError(t, err)
+	require.Equal(t, int64(10), updated.GetKeepAliveCountMax())
+
+	// Validate that upserting overwrites the value regardless of the revision.
+	upserted, err := s.ConfigS.UpsertClusterNetworkingConfig(ctx, gotNetConfig)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, gotNetConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+}
+
+// ClusterAuditConfig tests cluster audit configuration.
+func (s *ServicesTestSuite) ClusterAuditConfig(t *testing.T) {
+	ctx := context.Background()
+	auditConfig, err := types.NewClusterAuditConfig(types.ClusterAuditConfigSpecV2{
+		Region:                  "us-east-1",
+		EnableContinuousBackups: true,
+	})
+	require.NoError(t, err)
+
+	// Validate updating a non-existent config fails.
+	_, err = s.ConfigS.UpdateClusterAuditConfig(ctx, auditConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	// Create a config when one does not exist.
+	created, err := s.ConfigS.CreateClusterAuditConfig(ctx, auditConfig)
+	require.NoError(t, err)
+	require.NotEmpty(t, created.GetRevision())
+
+	// Validate the created config matches the retrieve config.
+	gotAuditConfig, err := s.ConfigS.GetClusterAuditConfig(ctx)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(auditConfig, gotAuditConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+	// Validate that update only works if the revision matches.
+	gotAuditConfig.SetRevision("123")
+	_, err = s.ConfigS.UpdateClusterAuditConfig(ctx, gotAuditConfig)
+	require.True(t, trace.IsCompareFailed(err))
+
+	created.SetRegion("us-west-2")
+
+	updated, err := s.ConfigS.UpdateClusterAuditConfig(ctx, created)
+	require.NoError(t, err)
+	require.Equal(t, "us-west-2", updated.Region())
+
+	// Validate that upserting overwrites the value regardless of the revision.
+	upserted, err := s.ConfigS.UpsertClusterAuditConfig(ctx, gotAuditConfig)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(upserted, gotAuditConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+}
+
+// sem wrapper is a helper for overriding the keepalive
+// method on the semaphore service.
+type semWrapper struct {
+	types.Semaphores
+	keepAlive func(context.Context, types.SemaphoreLease) error
+}
+
+func (w *semWrapper) KeepAliveSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error {
+	return w.keepAlive(ctx, lease)
+}
+
+func (s *ServicesTestSuite) SemaphoreFlakiness(t *testing.T) {
+	ctx := context.Background()
+	const renewals = 3
+	// wrap our services.Semaphores instance to cause two out of three lease
+	// keepalive attempts fail with a meaningless error.  Locks should make
+	// at *least* three attempts before their expiry, so locks should not
+	// fail under these conditions.
+	keepAlives := new(uint64)
+	wrapper := &semWrapper{
+		Semaphores: s.PresenceS,
+		keepAlive: func(ctx context.Context, lease types.SemaphoreLease) error {
+			kn := atomic.AddUint64(keepAlives, 1)
+			if kn%3 == 0 {
+				return s.PresenceS.KeepAliveSemaphoreLease(ctx, lease)
+			}
+			return trace.Errorf("uh-oh!")
+		},
+	}
+
+	cfg := services.SemaphoreLockConfig{
+		Service:  wrapper,
+		Expiry:   time.Hour,
+		TickRate: time.Millisecond * 50,
+		Params: types.AcquireSemaphoreRequest{
+			SemaphoreKind: types.SemaphoreKindConnection,
+			SemaphoreName: "alice",
+			MaxLeases:     1,
+		},
+	}
+
+	cancelCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	lock, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
+	require.NoError(t, err)
+
+	for range renewals {
+		select {
+		case <-lock.Renewed():
+			continue
+		case <-lock.Done():
+			t.Fatalf("Lost semaphore lock: %v", lock.Wait())
+		case <-time.After(time.Second * 30):
+			t.Fatalf("Timeout waiting for renewals")
+		}
+	}
+}
+
+// SemaphoreContention checks that a large number of concurrent acquisitions
+// all succeed if MaxLeases is sufficiently high.  Note that we do not test
+// the same property holds for releasing semaphores; release operations are
+// best-effort and allowed to fail.  Also, "large" in this context is still
+// fairly small.  Semaphores aren't cheap and the auth server is expected
+// to start returning "too much contention" errors at around 100 concurrent
+// attempts.
+func (s *ServicesTestSuite) SemaphoreContention(t *testing.T) {
+	ctx := context.Background()
+	const locks int64 = 50
+	const iters = 5
+	for i := range iters {
+		cfg := services.SemaphoreLockConfig{
+			Service: s.PresenceS,
+			Expiry:  time.Hour,
+			Params: types.AcquireSemaphoreRequest{
+				SemaphoreKind: types.SemaphoreKindConnection,
+				SemaphoreName: fmt.Sprintf("sem-%d", i), // avoid overlap between iterations
+				MaxLeases:     locks,
+			},
+		}
+		// we leak lock handles in the spawned goroutines, so
+		// context-based cancellation is needed to cleanup the
+		// background keepalive activity.
+		cancelCtx, cancel := context.WithCancel(ctx)
+		acquireErrs := make(chan error, locks)
+		for range locks {
+			go func() {
+				_, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
+				acquireErrs <- err
+			}()
+		}
+		for range locks {
+			require.NoError(t, <-acquireErrs)
+		}
+		cancel()
+		require.NoError(t, s.PresenceS.DeleteSemaphore(ctx, types.SemaphoreFilter{
+			SemaphoreKind: cfg.Params.SemaphoreKind,
+			SemaphoreName: cfg.Params.SemaphoreName,
+		}))
+	}
+}
+
+// SemaphoreConcurrency verifies that a large number of concurrent
+// acquisitions result in the correct number of successful acquisitions.
+func (s *ServicesTestSuite) SemaphoreConcurrency(t *testing.T) {
+	ctx := context.Background()
+	const maxLeases int64 = 20
+	const attempts int64 = 200
+	cfg := services.SemaphoreLockConfig{
+		Service: s.PresenceS,
+		Expiry:  time.Hour,
+		Params: types.AcquireSemaphoreRequest{
+			SemaphoreKind: types.SemaphoreKindConnection,
+			SemaphoreName: "alice",
+			MaxLeases:     maxLeases,
+		},
+	}
+	// we leak lock handles in the spawned goroutines, so
+	// context-based cancellation is needed to cleanup the
+	// background keepalive activity.
+	cancelCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	var success int64
+	var failure int64
+	var wg sync.WaitGroup
+	for range attempts {
+		wg.Add(1)
+		go func() {
+			_, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
+			if err == nil {
+				atomic.AddInt64(&success, 1)
+			} else {
+				atomic.AddInt64(&failure, 1)
+			}
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+	require.Equal(t, maxLeases, atomic.LoadInt64(&success))
+	require.Equal(t, attempts-maxLeases, atomic.LoadInt64(&failure))
+}
+
+// SemaphoreLock verifies correct functionality of the basic
+// semaphore lock scenarios.
+func (s *ServicesTestSuite) SemaphoreLock(t *testing.T) {
+	ctx := context.Background()
+
+	cfg := services.SemaphoreLockConfig{
+		Service: s.PresenceS,
+		Expiry:  time.Hour,
+		Params: types.AcquireSemaphoreRequest{
+			SemaphoreKind: types.SemaphoreKindConnection,
+			SemaphoreName: "alice",
+			MaxLeases:     1,
+		},
+	}
+	cancelCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	lock, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
+	require.NoError(t, err)
+
+	// MaxLeases is 1, so second acquire op fails.
+	_, err = services.AcquireSemaphoreLock(cancelCtx, cfg)
+	require.True(t, trace.IsLimitExceeded(err))
+
+	// Lock is successfully released.
+	lock.Stop()
+	require.NoError(t, lock.Wait())
+
+	// Acquire new lock with short expiry
+	// and high tick rate to verify renewals.
+	cfg.Expiry = time.Second
+	cfg.TickRate = time.Millisecond * 50
+	lock, err = services.AcquireSemaphoreLock(cancelCtx, cfg)
+	require.NoError(t, err)
+
+	timeout := time.After(time.Second)
+
+	for i := range 3 {
+		select {
+		case <-lock.Done():
+			t.Fatalf("Unexpected lock failure: %v", lock.Wait())
+		case <-timeout:
+			t.Fatalf("Timeout waiting for lock renewal %d", i)
+		case <-lock.Renewed():
+		}
+	}
+
+	// forcibly delete the semaphore
+	require.NoError(t, s.PresenceS.DeleteSemaphore(ctx, types.SemaphoreFilter{
+		SemaphoreKind: cfg.Params.SemaphoreKind,
+		SemaphoreName: cfg.Params.SemaphoreName,
+	}))
+
+	select {
+	case <-lock.Done():
+		require.True(t, trace.IsNotFound(lock.Wait()))
+	case <-time.After(time.Millisecond * 1500):
+		t.Errorf("timeout waiting for semaphore lock failure")
+	}
+}
+
+// Events tests various events variations
+func (s *ServicesTestSuite) Events(t *testing.T) {
+	ctx := context.Background()
+	testCases := []eventTest{
+		{
+			name: "Cert authority with secrets",
+			kind: types.WatchKind{
+				Kind:        types.KindCertAuthority,
+				LoadSecrets: true,
+			},
+			crud: func(context.Context) types.Resource {
+				ca := NewTestCA(types.UserCA, "example.com")
+				require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
+
+				out, err := s.TrustS.GetCertAuthority(ctx, *ca.ID(), true)
+				require.NoError(t, err)
+
+				require.NoError(t, s.TrustS.DeleteCertAuthority(ctx, *ca.ID()))
+				return out
+			},
+		},
+	}
+	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
+
+	testCases = []eventTest{
+		{
+			name: "Cert authority without secrets",
+			kind: types.WatchKind{
+				Kind:        types.KindCertAuthority,
+				LoadSecrets: false,
+			},
+			crud: func(context.Context) types.Resource {
+				ca := NewTestCA(types.UserCA, "example.com")
+				require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
+
+				out, err := s.TrustS.GetCertAuthority(ctx, *ca.ID(), false)
+				require.NoError(t, err)
+
+				require.NoError(t, s.TrustS.DeleteCertAuthority(ctx, *ca.ID()))
+				return out
+			},
+		},
+	}
+	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
+
+	testCases = []eventTest{
+		{
+			name: "Token",
+			kind: types.WatchKind{
+				Kind: types.KindToken,
+			},
+			crud: func(context.Context) types.Resource {
+				expires := time.Now().UTC().Add(time.Hour)
+				tok, err := types.NewProvisionToken("token",
+					types.SystemRoles{types.RoleAuth, types.RoleNode}, expires)
+				require.NoError(t, err)
+
+				require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
+
+				token, err := s.ProvisioningS.GetToken(ctx, "token")
+				require.NoError(t, err)
+
+				require.NoError(t, s.ProvisioningS.DeleteToken(ctx, "token"))
+				return token
+			},
+		},
+		{
+			name: "Static tokens",
+			kind: types.WatchKind{
+				Kind: types.KindStaticTokens,
+			},
+			crud: func(context.Context) types.Resource {
+				staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+					StaticTokens: []types.ProvisionTokenV1{
+						{
+							Token:   "tok1",
+							Roles:   types.SystemRoles{types.RoleNode},
+							Expires: time.Now().UTC().Add(time.Hour),
+						},
+					},
+				})
+				require.NoError(t, err)
+
+				err = s.LocalConfigS.SetStaticTokens(staticTokens)
+				require.NoError(t, err)
+
+				out, err := s.LocalConfigS.GetStaticTokens(ctx)
+				require.NoError(t, err)
+
+				err = s.LocalConfigS.DeleteStaticTokens()
+				require.NoError(t, err)
+
+				return out
+			},
+		},
+		{
+			name: "Role",
+			kind: types.WatchKind{
+				Kind: types.KindRole,
+			},
+			crud: func(context.Context) types.Resource {
+				role, err := types.NewRole("role1", types.RoleSpecV6{
+					Options: types.RoleOptions{
+						MaxSessionTTL: types.Duration(time.Hour),
+					},
+					Allow: types.RoleConditions{
+						Logins:     []string{"root", "bob"},
+						NodeLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+					},
+					Deny: types.RoleConditions{},
+				})
+				require.NoError(t, err)
+
+				_, err = s.Access.UpsertRole(ctx, role)
+				require.NoError(t, err)
+
+				out, err := s.Access.GetRole(ctx, role.GetName())
+				require.NoError(t, err)
+
+				err = s.Access.DeleteRole(ctx, role.GetName())
+				require.NoError(t, err)
+
+				return out
+			},
+		},
+		{
+			name: "User",
+			kind: types.WatchKind{
+				Kind: types.KindUser,
+			},
+			crud: func(context.Context) types.Resource {
+				user := newUser("user1", []string{constants.DefaultImplicitRole})
+				user, err := s.Users().UpsertUser(ctx, user)
+				require.NoError(t, err)
+
+				out, err := s.Users().GetUser(ctx, user.GetName(), false)
+				require.NoError(t, err)
+
+				require.NoError(t, s.Users().DeleteUser(ctx, user.GetName()))
+				return out
+			},
+		},
+		{
+			name: "Node",
+			kind: types.WatchKind{
+				Kind: types.KindNode,
+			},
+			crud: func(context.Context) types.Resource {
+				srv := NewServer(types.KindNode, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
+
+				_, err := s.PresenceS.UpsertNode(ctx, srv)
+				require.NoError(t, err)
+
+				out, err := s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
+				require.NoError(t, err)
+
+				err = s.PresenceS.DeleteAllNodes(ctx, srv.Metadata.Namespace)
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Proxy",
+			kind: types.WatchKind{
+				Kind: types.KindProxy,
+			},
+			crud: func(context.Context) types.Resource {
+				srv := NewServer(types.KindProxy, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
+
+				err := s.PresenceS.UpsertProxy(ctx, srv)
+				require.NoError(t, err)
+
+				//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+				out, err := s.PresenceS.GetProxies()
+				require.NoError(t, err)
+
+				err = s.PresenceS.DeleteAllProxies()
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Tunnel connection",
+			kind: types.WatchKind{
+				Kind: types.KindTunnelConnection,
+			},
+			crud: func(context.Context) types.Resource {
+				conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
+					ClusterName:   "example.com",
+					ProxyName:     "p1",
+					LastHeartbeat: time.Now().UTC(),
+				})
+				require.NoError(t, err)
+
+				err = s.TrustS.UpsertTunnelConnection(conn)
+				require.NoError(t, err)
+
+				out, err := s.TrustS.GetTunnelConnections("example.com")
+				require.NoError(t, err)
+
+				err = s.TrustS.DeleteAllTunnelConnections()
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Reverse tunnel",
+			kind: types.WatchKind{
+				Kind: types.KindReverseTunnel,
+			},
+			crud: func(context.Context) types.Resource {
+				tunnel := newReverseTunnel("example.com", []string{"example.com:2023"})
+				_, err := s.PresenceS.UpsertReverseTunnel(ctx, tunnel)
+				require.NoError(t, err)
+
+				out, _, err := s.PresenceS.ListReverseTunnels(
+					ctx, 0, "",
+				)
+				require.NoError(t, err)
+
+				err = s.PresenceS.DeleteReverseTunnel(ctx, tunnel.Spec.ClusterName)
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+		{
+			name: "Remote cluster",
+			kind: types.WatchKind{
+				Kind: types.KindRemoteCluster,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				rc, err := types.NewRemoteCluster("example.com")
+				rc.SetConnectionStatus(teleport.RemoteClusterStatusOffline)
+				require.NoError(t, err)
+				_, err = s.TrustS.CreateRemoteCluster(ctx, rc)
+				require.NoError(t, err)
+
+				out, err := s.TrustS.GetRemoteClusters(ctx)
+				require.NoError(t, err)
+
+				err = s.TrustS.DeleteRemoteCluster(ctx, rc.GetName())
+				require.NoError(t, err)
+
+				return out[0]
+			},
+		},
+	}
+	// this also tests the partial success mode by requesting an unknown kind
+	s.runEventsTests(t, testCases, types.Watch{
+		Kinds:               append(eventsTestKinds(testCases), types.WatchKind{Kind: "unknown"}),
+		AllowPartialSuccess: true,
+	})
+
+	// tests that a watch fails given an unknown kind when the partial success mode is not enabled
+	s.runUnknownEventsTest(t, types.Watch{Kinds: []types.WatchKind{
+		{Kind: types.KindNamespace},
+		{Kind: "unknown"},
+	}})
+
+	// tests that a watch fails if all given kinds are unknown even if the success mode is enabled
+	s.runUnknownEventsTest(t, types.Watch{
+		Kinds: []types.WatchKind{
+			{Kind: "unrecognized"},
+			{Kind: "unidentified"},
+		},
+		AllowPartialSuccess: true,
+	})
+}
+
+// EventsClusterConfig tests cluster config resource events
+func (s *ServicesTestSuite) EventsClusterConfig(t *testing.T) {
+	testCases := []eventTest{
+		{
+			name: "Cluster name",
+			kind: types.WatchKind{
+				Kind: types.KindClusterName,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+					ClusterName: "example.com",
+				})
+				require.NoError(t, err)
+
+				err = s.LocalConfigS.UpsertClusterName(clusterName)
+				require.NoError(t, err)
+
+				out, err := s.ConfigS.GetClusterName(ctx)
+				require.NoError(t, err)
+
+				err = s.LocalConfigS.DeleteClusterName()
+				require.NoError(t, err)
+				return out
+			},
+		},
+		{
+			name: "Cluster audit configuration",
+			kind: types.WatchKind{
+				Kind: types.KindClusterAuditConfig,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				auditConfig, err := types.NewClusterAuditConfig(types.ClusterAuditConfigSpecV2{
+					Region:           "us-west-1",
+					Type:             "dynamodb",
+					AuditSessionsURI: "file:///home/log",
+					AuditEventsURI:   []string{"dynamodb://audit_table_name", "file:///home/test/log"},
+				})
+				require.NoError(t, err)
+
+				err = s.ConfigS.SetClusterAuditConfig(ctx, auditConfig)
+				require.NoError(t, err)
+
+				out, err := s.ConfigS.GetClusterAuditConfig(ctx)
+				require.NoError(t, err)
+
+				err = s.ConfigS.DeleteClusterAuditConfig(ctx)
+				require.NoError(t, err)
+				return out
+			},
+		},
+		{
+			name: "Cluster networking configuration",
+			kind: types.WatchKind{
+				Kind: types.KindClusterNetworkingConfig,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				netConfig, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
+					ClientIdleTimeout: types.Duration(5 * time.Second),
+				})
+				require.NoError(t, err)
+
+				_, err = s.ConfigS.UpsertClusterNetworkingConfig(ctx, netConfig)
+				require.NoError(t, err)
+
+				out, err := s.ConfigS.GetClusterNetworkingConfig(ctx)
+				require.NoError(t, err)
+
+				err = s.ConfigS.DeleteClusterNetworkingConfig(ctx)
+				require.NoError(t, err)
+				return out
+			},
+		},
+		{
+			name: "Session recording configuration",
+			kind: types.WatchKind{
+				Kind: types.KindSessionRecordingConfig,
+			},
+			crud: func(ctx context.Context) types.Resource {
+				recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+					Mode: types.RecordAtProxySync,
+				})
+				require.NoError(t, err)
+
+				_, err = s.ConfigS.UpsertSessionRecordingConfig(ctx, recConfig)
+				require.NoError(t, err)
+
+				out, err := s.ConfigS.GetSessionRecordingConfig(ctx)
+				require.NoError(t, err)
+
+				err = s.ConfigS.DeleteSessionRecordingConfig(ctx)
+				require.NoError(t, err)
+				return out
+			},
+		},
+	}
+	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
+}
+
+// NetworkRestrictions tests network restrictions.
+func (s *ServicesTestSuite) NetworkRestrictions(t *testing.T, opts ...Option) {
+	ctx := context.Background()
+
+	// blank slate, should be get/delete should fail
+	_, err := s.RestrictionsS.GetNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
+
+	allow := []types.AddressCondition{
+		{CIDR: "10.0.1.0/24"},
+		{CIDR: "10.0.2.2"},
+	}
+	deny := []types.AddressCondition{
+		{CIDR: "10.1.0.0/16"},
+		{CIDR: "8.8.8.8"},
+	}
+
+	expected := types.NewNetworkRestrictions()
+	expected.SetAllow(allow)
+	expected.SetDeny(deny)
+
+	// set and make sure we get it back
+	err = s.RestrictionsS.SetNetworkRestrictions(ctx, expected)
+	require.NoError(t, err)
+
+	actual, err := s.RestrictionsS.GetNetworkRestrictions(ctx)
+	require.NoError(t, err)
+
+	require.Empty(t, cmp.Diff(expected.GetAllow(), actual.GetAllow()))
+	require.Empty(t, cmp.Diff(expected.GetDeny(), actual.GetDeny()))
+
+	// now delete should work ok and get should fail again
+	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
+	require.NoError(t, err)
+
+	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
+	require.True(t, trace.IsNotFound(err))
+}
+
+func (s *ServicesTestSuite) runEventsTests(t *testing.T, testCases []eventTest, watch types.Watch) {
+	ctx := context.Background()
+	w, err := s.EventsS.NewWatcher(ctx, watch)
+	require.NoError(t, err)
+	defer w.Close()
+
+	select {
+	case event := <-w.Events():
+		require.Equal(t, types.OpInit, event.Type)
+		watchStatus, ok := event.Resource.(types.WatchStatus)
+		require.True(t, ok)
+		expectedKinds := eventsTestKinds(testCases)
+		require.Equal(t, expectedKinds, watchStatus.GetKinds())
+	case <-w.Done():
+		t.Fatalf("Watcher exited with error %v", w.Error())
+	case <-time.After(2 * time.Second):
+		t.Fatalf("Timeout waiting for init event")
+	}
+
+	// filter out all events that could have been inserted
+	// by the initialization routines
+skiploop:
+	for {
+		select {
+		case event := <-w.Events():
+			slog.DebugContext(ctx, "Skipping pre-test event", "event", event)
+			continue skiploop
+		default:
+			break skiploop
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Logf("test case %q", tc.name)
+		resource := tc.crud(ctx)
+
+		ExpectResource(t, w, 3*time.Second, resource)
+
+		meta := resource.GetMetadata()
+		header := &types.ResourceHeader{
+			Kind:    resource.GetKind(),
+			SubKind: resource.GetSubKind(),
+			Version: resource.GetVersion(),
+			Metadata: types.Metadata{
+				Name:      meta.Name,
+				Namespace: meta.Namespace,
+			},
+		}
+		ExpectDeleteResource(t, w, 3*time.Second, header)
+	}
+}
+
+func (s *ServicesTestSuite) runUnknownEventsTest(t *testing.T, watch types.Watch) {
+	ctx := context.Background()
+	w, err := s.EventsS.NewWatcher(ctx, watch)
+	if err != nil {
+		// depending on the implementation of EventsS, it might fail here immediately
+		// or later before returning the first event from the watcher.
+		return
+	}
+	defer w.Close()
+
+	select {
+	case <-w.Events():
+		t.Fatal("unexpected event from watcher that is supposed to fail")
+	case <-w.Done():
+		require.Error(t, w.Error())
+	case <-time.After(2 * time.Second):
+		t.Fatal("Timeout waiting for error from watcher")
+	}
+}
+
+type eventTest struct {
+	name string
+	kind types.WatchKind
+	crud func(context.Context) types.Resource
+}
+
+func eventsTestKinds(tests []eventTest) []types.WatchKind {
+	out := make([]types.WatchKind, len(tests))
+	for i, tc := range tests {
+		out[i] = tc.kind
+	}
+	return out
+}
+
+// ExpectResource expects a Put event of a certain resource
+func ExpectResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
+	timeoutC := time.After(timeout)
+waitLoop:
+	for {
+		select {
+		case <-timeoutC:
+			t.Fatalf("Timeout waiting for event")
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		case event := <-w.Events():
+			if event.Type != types.OpPut {
+				slog.DebugContext(context.Background(), "Skipping event", "event", event)
+				continue
+			}
+			if resource.GetName() != event.Resource.GetName() || resource.GetKind() != event.Resource.GetKind() || resource.GetSubKind() != event.Resource.GetSubKind() {
+				slog.DebugContext(context.Background(), "Skipping event", "event", event)
+				continue waitLoop
+			}
+			require.Empty(t, cmp.Diff(resource, event.Resource))
+			break waitLoop
+		}
+	}
+}
+
+// ExpectDeleteResource expects a delete event of a certain kind
+func ExpectDeleteResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
+	timeoutC := time.After(timeout)
+waitLoop:
+	for {
+		select {
+		case <-timeoutC:
+			t.Fatalf("Timeout waiting for delete resource %v", resource)
+		case <-w.Done():
+			t.Fatalf("Watcher exited with error %v", w.Error())
+		case event := <-w.Events():
+			if event.Type != types.OpDelete {
+				slog.DebugContext(context.Background(), "Skipping stale event",
+					"event_type", event.Type,
+					"resource_name", event.Resource.GetName(),
+				)
+				continue
+			}
+
+			// Server resources may have subkind set, but the backend
+			// generating this delete event doesn't know the subkind.
+			// Set it to prevent the check below from failing.
+			if event.Resource.GetKind() == types.KindNode {
+				event.Resource.SetSubKind(resource.GetSubKind())
+			}
+
+			require.Empty(t, cmp.Diff(resource, event.Resource))
+			break waitLoop
+		}
+	}
+}
+
+// NewTestCA returns new test authority with a test key as a public and
+// signing key
+func NewTestCA(caType types.CertAuthType, clusterName string, privateKeys ...[]byte) *types.CertAuthorityV2 {
+	return NewTestCAWithConfig(TestCAConfig{
+		Type:        caType,
+		ClusterName: clusterName,
+		PrivateKeys: privateKeys,
+		Clock:       clockwork.NewRealClock(),
+	})
+}
+
+// TestCAConfig defines the configuration for generating
+// a test certificate authority
+type TestCAConfig struct {
+	Type        types.CertAuthType
+	PrivateKeys [][]byte
+	Clock       clockwork.Clock
+	ClusterName string
+	// the below string fields default to ClusterName if left empty
+	ResourceName        string
+	SubjectOrganization string
+}
+
+// NewTestCAWithConfig generates a new certificate authority with the specified
+// configuration
+// Keep this function in-sync with lib/auth/auth.go:newKeySet().
+// TODO(jakule): reuse keystore.KeyStore interface to match newKeySet().
+func NewTestCAWithConfig(config TestCAConfig) *types.CertAuthorityV2 {
+	var keyPEM []byte
+	var key *keys.PrivateKey
+
+	if config.ResourceName == "" {
+		config.ResourceName = config.ClusterName
+	}
+	if config.SubjectOrganization == "" {
+		config.SubjectOrganization = config.ClusterName
+	}
+
+	switch config.Type {
+	case types.DatabaseCA, types.SAMLIDPCA, types.OIDCIdPCA:
+		// These CAs only support RSA.
+		keyPEM = fixtures.PEMBytes["rsa"]
+	case types.DatabaseClientCA:
+		// The db client CA also only supports RSA, but some tests rely on it
+		// being different than the DB CA.
+		keyPEM = fixtures.PEMBytes["rsa-db-client"]
+	}
+	if len(config.PrivateKeys) > 0 {
+		// Allow test to override the private key.
+		keyPEM = config.PrivateKeys[0]
+	}
+
+	if keyPEM != nil {
+		var err error
+		key, err = keys.ParsePrivateKey(keyPEM)
+		if err != nil {
+			panic(err)
+		}
+	} else {
+		// If config.PrivateKeys was not set and this CA does not exclusively
+		// support RSA, generate an ECDSA key. Signatures are ~10x faster than
+		// RSA and generating a new key is actually faster than parsing a PEM
+		// fixture.
+		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+		if err != nil {
+			panic(err)
+		}
+		key, err = keys.NewPrivateKey(signer)
+		if err != nil {
+			panic(err)
+		}
+		keyPEM = key.PrivateKeyPEM()
+	}
+
+	ca := &types.CertAuthorityV2{
+		Kind:    types.KindCertAuthority,
+		SubKind: string(config.Type),
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      config.ResourceName,
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.CertAuthoritySpecV2{
+			Type:        config.Type,
+			ClusterName: config.ClusterName,
+		},
+	}
+
+	// Add SSH keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.OpenSSHCA:
+		ca.Spec.ActiveKeys.SSH = []*types.SSHKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  key.MarshalSSHPublicKey(),
+		}}
+	}
+
+	// Add TLS keys if necessary.
+	switch config.Type {
+	case types.UserCA, types.HostCA, types.DatabaseCA, types.DatabaseClientCA, types.SAMLIDPCA, types.SPIFFECA, types.AWSRACA:
+		cert, err := tlsca.GenerateSelfSignedCAWithConfig(tlsca.GenerateCAConfig{
+			Signer: key.Signer,
+			Entity: pkix.Name{
+				CommonName:   config.ClusterName,
+				Organization: []string{config.SubjectOrganization},
+			},
+			TTL:   defaults.CATTL,
+			Clock: config.Clock,
+		})
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.TLS = []*types.TLSKeyPair{{
+			Key:  keyPEM,
+			Cert: cert,
+		}}
+	}
+
+	// Add JWT keys if necessary.
+	switch config.Type {
+	case types.JWTSigner, types.OIDCIdPCA, types.SPIFFECA, types.OktaCA, types.BoundKeypairCA:
+		pubKeyPEM, err := keys.MarshalPublicKey(key.Public())
+		if err != nil {
+			panic(err)
+		}
+		ca.Spec.ActiveKeys.JWT = []*types.JWTKeyPair{{
+			PrivateKey: keyPEM,
+			PublicKey:  pubKeyPEM,
+		}}
+	}
+
+	return ca
+}
diff --git a/lib/services/local/summarizer.go b/lib/services/local/summarizer.go
new file mode 100644
index 0000000000000..2685041c17daf
--- /dev/null
+++ b/lib/services/local/summarizer.go
@@ -0,0 +1,324 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+	"iter"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/summarizer"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// SummarizerService implements the [services.Summarizer]
+// interface and manages summarization configuration resources in the backend.
+type SummarizerService struct {
+	backend       backend.Backend
+	modelService  *generic.ServiceWrapper[*summarizerv1.InferenceModel]
+	secretService *generic.ServiceWrapper[*summarizerv1.InferenceSecret]
+	policyService *generic.ServiceWrapper[*summarizerv1.InferencePolicy]
+}
+
+var _ services.Summarizer = (*SummarizerService)(nil)
+
+// CreateInferenceModel creates a new session summary inference model in the
+// backend.
+func (s *SummarizerService) CreateInferenceModel(
+	ctx context.Context, model *summarizerv1.InferenceModel,
+) (*summarizerv1.InferenceModel, error) {
+	res, err := s.modelService.CreateResource(ctx, model)
+	return res, trace.Wrap(err)
+}
+
+// DeleteInferenceModel deletes a session summary inference model from the
+// backend by name.
+func (s *SummarizerService) DeleteInferenceModel(
+	ctx context.Context, name string,
+) error {
+	return trace.Wrap(s.modelService.DeleteResource(ctx, name))
+}
+
+// GetInferenceModel retrieves a session summary inference model from the
+// backend by name.
+func (s *SummarizerService) GetInferenceModel(
+	ctx context.Context, name string,
+) (*summarizerv1.InferenceModel, error) {
+	res, err := s.modelService.GetResource(ctx, name)
+	return res, trace.Wrap(err)
+}
+
+// ListInferenceModels lists session summary inference models in the backend
+// with pagination support. Returns a slice of models and a next page token.
+func (s *SummarizerService) ListInferenceModels(
+	ctx context.Context, size int, pageToken string,
+) ([]*summarizerv1.InferenceModel, string, error) {
+	res, nextToken, err := s.modelService.ListResources(ctx, size, pageToken)
+	return res, nextToken, trace.Wrap(err)
+}
+
+// UpdateInferenceModel updates an existing session summary inference model in
+// the backend.
+func (s *SummarizerService) UpdateInferenceModel(
+	ctx context.Context, model *summarizerv1.InferenceModel,
+) (*summarizerv1.InferenceModel, error) {
+	res, err := s.modelService.ConditionalUpdateResource(ctx, model)
+	return res, trace.Wrap(err)
+}
+
+// UpsertInferenceModel creates or updates a session summary inference model in
+// the backend. If the model already exists, it will be updated.
+func (s *SummarizerService) UpsertInferenceModel(
+	ctx context.Context, model *summarizerv1.InferenceModel,
+) (*summarizerv1.InferenceModel, error) {
+	res, err := s.modelService.UpsertResource(ctx, model)
+	return res, trace.Wrap(err)
+}
+
+// CreateInferenceSecret creates a new session summary inference secret in the
+// backend. The returned object contains the secret value and should be handled
+// with care.
+func (s *SummarizerService) CreateInferenceSecret(
+	ctx context.Context, secret *summarizerv1.InferenceSecret,
+) (*summarizerv1.InferenceSecret, error) {
+	res, err := s.secretService.CreateResource(ctx, secret)
+	return res, trace.Wrap(err)
+}
+
+// DeleteInferenceSecret deletes a session summary inference secret from the
+// backend by name.
+func (s *SummarizerService) DeleteInferenceSecret(
+	ctx context.Context, name string) error {
+	return trace.Wrap(s.secretService.DeleteResource(ctx, name))
+}
+
+// GetInferenceSecret retrieves a session summary inference secret from the
+// backend by name. The returned object contains the secret value and should be
+// handled with care.
+func (s *SummarizerService) GetInferenceSecret(
+	ctx context.Context, name string,
+) (*summarizerv1.InferenceSecret, error) {
+	res, err := s.secretService.GetResource(ctx, name)
+	return res, trace.Wrap(err)
+}
+
+// ListInferenceSecrets lists session summary inference secrets in the backend
+// with pagination support. Returns a slice of secrets and a next page token.
+// The returned objects contain the secret values and should be handled with
+// care.
+func (s *SummarizerService) ListInferenceSecrets(
+	ctx context.Context, size int, pageToken string,
+) ([]*summarizerv1.InferenceSecret, string, error) {
+	res, nextToken, err := s.secretService.ListResources(ctx, size, pageToken)
+	return res, nextToken, trace.Wrap(err)
+}
+
+// UpdateInferenceSecret updates an existing session summary inference secret
+// in the backend. The returned object contains the secret value and should be
+// handled with care.
+func (s *SummarizerService) UpdateInferenceSecret(
+	ctx context.Context, secret *summarizerv1.InferenceSecret,
+) (*summarizerv1.InferenceSecret, error) {
+	res, err := s.secretService.ConditionalUpdateResource(ctx, secret)
+	return res, trace.Wrap(err)
+}
+
+// UpsertInferenceSecret creates or updates a session summary inference
+// secretin the backend. If the secret already exists, it will be updated. The
+// returned object contains the secret value and should be handled with care.
+func (s *SummarizerService) UpsertInferenceSecret(
+	ctx context.Context, secret *summarizerv1.InferenceSecret,
+) (*summarizerv1.InferenceSecret, error) {
+	res, err := s.secretService.UpsertResource(ctx, secret)
+	return res, trace.Wrap(err)
+}
+
+// CreateInferencePolicy creates a new session summary inference policy in the
+// backend.
+func (s *SummarizerService) CreateInferencePolicy(
+	ctx context.Context, policy *summarizerv1.InferencePolicy,
+) (*summarizerv1.InferencePolicy, error) {
+	res, err := s.policyService.CreateResource(ctx, policy)
+	return res, trace.Wrap(err)
+}
+
+// DeleteInferencePolicy deletes a session summary inference policy from the
+// backend by name.
+func (s *SummarizerService) DeleteInferencePolicy(
+	ctx context.Context, name string,
+) error {
+	return trace.Wrap(s.policyService.DeleteResource(ctx, name))
+}
+
+// GetInferencePolicy retrieves a session summary inference policy from the
+// backend by name.
+func (s *SummarizerService) GetInferencePolicy(
+	ctx context.Context, name string,
+) (*summarizerv1.InferencePolicy, error) {
+	res, err := s.policyService.GetResource(ctx, name)
+	return res, trace.Wrap(err)
+}
+
+// ListInferencePolicies lists session summary inference policies in the
+// backend with pagination support. Returns a slice of policies and a next page
+// token.
+func (s *SummarizerService) ListInferencePolicies(
+	ctx context.Context, size int, pageToken string,
+) ([]*summarizerv1.InferencePolicy, string, error) {
+	res, nextToken, err := s.policyService.ListResources(ctx, size, pageToken)
+	return res, nextToken, trace.Wrap(err)
+}
+
+// UpdateInferencePolicy updates an existing session summary inference policy
+// in the backend.
+func (s *SummarizerService) UpdateInferencePolicy(
+	ctx context.Context, policy *summarizerv1.InferencePolicy,
+) (*summarizerv1.InferencePolicy, error) {
+	res, err := s.policyService.ConditionalUpdateResource(ctx, policy)
+	return res, trace.Wrap(err)
+}
+
+// UpsertInferencePolicy creates or updates a session summary inference policy
+// in the backend. If the policy already exists, it will be updated.
+func (s *SummarizerService) UpsertInferencePolicy(
+	ctx context.Context, policy *summarizerv1.InferencePolicy,
+) (*summarizerv1.InferencePolicy, error) {
+	res, err := s.policyService.UpsertResource(ctx, policy)
+	return res, trace.Wrap(err)
+}
+
+// AllInferencePolicies returns an iterator that retrieves all session summary
+// inference policies from the backend, without pagination.
+func (s *SummarizerService) AllInferencePolicies(
+	ctx context.Context,
+) iter.Seq2[*summarizerv1.InferencePolicy, error] {
+	// The v18 implementation of this function is a specialization of the
+	// generic.Service.Resources function from v19. It was copied here directly
+	// to avoid backporting the entire PR that introduced it.
+	backendPrefix := backend.NewKey(inferencePolicyPrefix)
+	params := backend.ItemsParams{
+		StartKey: backendPrefix,
+		EndKey:   backend.RangeEnd(backendPrefix.ExactKey()),
+	}
+	return func(yield func(*summarizerv1.InferencePolicy, error) bool) {
+		for item, err := range s.backend.Items(ctx, params) {
+			if err != nil {
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			resource, err := services.UnmarshalProtoResource[*summarizerv1.InferencePolicy](
+				item.Value, services.WithRevision(item.Revision),
+			)
+			if err != nil {
+				// unmarshal errors are logged and skipped
+				slog.WarnContext(ctx, "skipping resource due to unmarshal error", "error", err, "key", logutils.StringerAttr(item.Key))
+				return
+			}
+
+			if !yield(resource, nil) {
+				return
+			}
+		}
+	}
+}
+
+const (
+	inferenceModelPrefix  = "inference_models"
+	inferenceSecretPrefix = "inference_secrets"
+	inferencePolicyPrefix = "inference_policies"
+)
+
+// SummarizerServiceConfig provides data necessary to initialize a
+// [SummarizerService].
+type SummarizerServiceConfig struct {
+	// Backend is the resource storage backend.
+	Backend backend.Backend
+	// EnableBedrock enables access to Amazon Bedrock models. Currently, this
+	// should only be turned on outside Teleport Cloud. Setting it to true allows
+	// creating inference_model resources that use the Bedrock inference
+	// provider.
+	EnableBedrock bool
+}
+
+// NewSummarizerService returns a service that manages summarization
+// configuration resources in the backend.
+func NewSummarizerService(cfg SummarizerServiceConfig) (*SummarizerService, error) {
+	validateInferenceModel := func(m *summarizerv1.InferenceModel) error {
+		err := summarizer.ValidateInferenceModel(m)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if !cfg.EnableBedrock && m.GetSpec().GetBedrock() != nil {
+			return trace.BadParameter("Amazon Bedrock models are unavailable in Teleport Cloud")
+		}
+		return nil
+	}
+
+	modelService, err := generic.NewServiceWrapper(
+		generic.ServiceConfig[*summarizerv1.InferenceModel]{
+			Backend:       cfg.Backend,
+			ResourceKind:  types.KindInferenceModel,
+			BackendPrefix: backend.NewKey(inferenceModelPrefix),
+			MarshalFunc:   services.MarshalProtoResource[*summarizerv1.InferenceModel],
+			UnmarshalFunc: services.UnmarshalProtoResource[*summarizerv1.InferenceModel],
+			ValidateFunc:  validateInferenceModel,
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	secretService, err := generic.NewServiceWrapper(
+		generic.ServiceConfig[*summarizerv1.InferenceSecret]{
+			Backend:       cfg.Backend,
+			ResourceKind:  types.KindInferenceSecret,
+			BackendPrefix: backend.NewKey(inferenceSecretPrefix),
+			MarshalFunc:   services.MarshalProtoResource[*summarizerv1.InferenceSecret],
+			UnmarshalFunc: services.UnmarshalProtoResource[*summarizerv1.InferenceSecret],
+			ValidateFunc:  summarizer.ValidateInferenceSecret,
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	policyService, err := generic.NewServiceWrapper(
+		generic.ServiceConfig[*summarizerv1.InferencePolicy]{
+			Backend:       cfg.Backend,
+			ResourceKind:  types.KindInferencePolicy,
+			BackendPrefix: backend.NewKey(inferencePolicyPrefix),
+			MarshalFunc:   services.MarshalProtoResource[*summarizerv1.InferencePolicy],
+			UnmarshalFunc: services.UnmarshalProtoResource[*summarizerv1.InferencePolicy],
+			ValidateFunc:  services.ValidateInferencePolicy,
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &SummarizerService{
+		backend:       cfg.Backend,
+		modelService:  modelService,
+		secretService: secretService,
+		policyService: policyService,
+	}, nil
+}
diff --git a/lib/services/local/summarizer_test.go b/lib/services/local/summarizer_test.go
new file mode 100644
index 0000000000000..1bf1d987c6960
--- /dev/null
+++ b/lib/services/local/summarizer_test.go
@@ -0,0 +1,842 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package local
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/summarizer"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+)
+
+func newInferenceModel(name string) *summarizerv1.InferenceModel {
+	return summarizer.NewInferenceModel(name, &summarizerv1.InferenceModelSpec{
+		Provider: &summarizerv1.InferenceModelSpec_Openai{
+			Openai: &summarizerv1.OpenAIProvider{
+				OpenaiModelId: "gpt-4o",
+			},
+		},
+	})
+}
+
+func newInferenceSecret(name string) *summarizerv1.InferenceSecret {
+	return summarizer.NewInferenceSecret(name, &summarizerv1.InferenceSecretSpec{
+		Value: "super-secret-value",
+	})
+}
+
+func newInferencePolicy(name string) *summarizerv1.InferencePolicy {
+	return summarizer.NewInferencePolicy(name, &summarizerv1.InferencePolicySpec{
+		Kinds: []string{string(types.SSHSessionKind)},
+		Model: "dummy-model",
+	})
+}
+
+func setupSummarizerTest(
+	t *testing.T,
+) (context.Context, *SummarizerService) {
+	t.Parallel()
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	service, err := NewSummarizerService(SummarizerServiceConfig{
+		Backend: backend.NewSanitizer(mem),
+	})
+	require.NoError(t, err)
+	return ctx, service
+}
+
+func TestSummarizerService_CreateInferenceModel(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferenceModel("dummy-model")
+		got, err := service.CreateInferenceModel(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceModel),
+		)
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("invalid", func(t *testing.T) {
+		m := newInferenceModel("invalid-model")
+		m.Spec.GetOpenai().OpenaiModelId = ""
+		_, err := service.CreateInferenceModel(
+			ctx,
+			proto.Clone(m).(*summarizerv1.InferenceModel),
+		)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, trace.BadParameter("spec.openai.openai_model_id is required"))
+	})
+	t.Run("no Bedrock unless enabled", func(t *testing.T) {
+		m := summarizer.NewInferenceModel("bedrock-model", &summarizerv1.InferenceModelSpec{
+			Provider: &summarizerv1.InferenceModelSpec_Bedrock{
+				Bedrock: &summarizerv1.BedrockProvider{
+					Region:         "us-east-1",
+					BedrockModelId: "amazon.nova-pro-v1:0",
+				},
+			},
+		})
+		_, err := service.CreateInferenceModel(ctx, m)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, trace.BadParameter("Amazon Bedrock models are unavailable in Teleport Cloud"))
+	})
+	t.Run("no upsert", func(t *testing.T) {
+		res := newInferenceModel("no-upsert")
+		_, err := service.CreateInferenceModel(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferenceModel),
+		)
+		require.NoError(t, err)
+		_, err = service.CreateInferenceModel(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferenceModel),
+		)
+		require.Error(t, err)
+		assert.True(t, trace.IsAlreadyExists(err))
+	})
+}
+
+func TestSummarizerService_CreateInferenceModel_BedrockAllowed(t *testing.T) {
+	// Perform a similar setup procedure, but enable Bedrock.
+	t.Parallel()
+	ctx := context.Background()
+	clock := clockwork.NewFakeClock()
+	mem, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	service, err := NewSummarizerService(SummarizerServiceConfig{
+		Backend:       backend.NewSanitizer(mem),
+		EnableBedrock: true,
+	})
+	require.NoError(t, err)
+
+	want := summarizer.NewInferenceModel("bedrock-model", &summarizerv1.InferenceModelSpec{
+		Provider: &summarizerv1.InferenceModelSpec_Bedrock{
+			Bedrock: &summarizerv1.BedrockProvider{
+				Region:         "us-east-1",
+				BedrockModelId: "amazon.nova-pro-v1:0",
+			},
+		},
+	})
+
+	got, err := service.CreateInferenceModel(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferenceModel),
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.Empty(t, cmp.Diff(
+		want,
+		got,
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+	))
+}
+
+func TestSummarizerService_UpsertInferenceModel(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	want := newInferenceModel("dummy-model")
+	got, err := service.UpsertInferenceModel(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferenceModel),
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.Empty(t, cmp.Diff(
+		want,
+		got,
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+	))
+
+	// Ensure we can upsert over an existing resource
+	_, err = service.UpsertInferenceModel(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferenceModel),
+	)
+	require.NoError(t, err)
+}
+
+func TestSummarizerService_ListInferenceModels(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+	// Create entities to list
+	createdObjects := []*summarizerv1.InferenceModel{}
+	// Create 49 entities to test an incomplete page at the end.
+	for i := range 49 {
+		created, err := service.CreateInferenceModel(
+			ctx,
+			newInferenceModel(fmt.Sprintf("model-%d", i)),
+		)
+		require.NoError(t, err)
+		createdObjects = append(createdObjects, created)
+	}
+	t.Run("default page size", func(t *testing.T) {
+		page, nextToken, err := service.ListInferenceModels(ctx, 0, "")
+		require.NoError(t, err)
+		assert.Len(t, page, 49)
+		assert.Empty(t, nextToken)
+
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(page, func(model *summarizerv1.InferenceModel) bool {
+				return proto.Equal(created, model)
+			}))
+		}
+	})
+	t.Run("pagination", func(t *testing.T) {
+		fetched := []*summarizerv1.InferenceModel{}
+		token := ""
+		iterations := 0
+		for {
+			iterations++
+			page, nextToken, err := service.ListInferenceModels(ctx, 10, token)
+			require.NoError(t, err)
+			fetched = append(fetched, page...)
+			if nextToken == "" {
+				break
+			}
+			token = nextToken
+		}
+		assert.Equal(t, 5, iterations)
+
+		assert.Len(t, fetched, 49)
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(fetched, func(model *summarizerv1.InferenceModel) bool {
+				return proto.Equal(created, model)
+			}))
+		}
+	})
+}
+
+func TestSummarizerService_GetInferenceModel(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferenceModel("dummy-model")
+		_, err := service.CreateInferenceModel(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceModel),
+		)
+		require.NoError(t, err)
+		got, err := service.GetInferenceModel(ctx, "dummy-model")
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("not found", func(t *testing.T) {
+		_, err := service.GetInferenceModel(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_DeleteInferenceModel(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		_, err := service.CreateInferenceModel(
+			ctx,
+			newInferenceModel("dummy-model"),
+		)
+		require.NoError(t, err)
+
+		_, err = service.GetInferenceModel(ctx, "dummy-model")
+		require.NoError(t, err)
+
+		err = service.DeleteInferenceModel(ctx, "dummy-model")
+		require.NoError(t, err)
+
+		_, err = service.GetInferenceModel(ctx, "dummy-model")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+	t.Run("not found", func(t *testing.T) {
+		err := service.DeleteInferenceModel(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_UpdateInferenceModel(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		// Create resource for us to Update since we can't update a non-existent resource.
+		created, err := service.CreateInferenceModel(
+			ctx,
+			newInferenceModel("dummy-model"),
+		)
+		require.NoError(t, err)
+		want := proto.Clone(created).(*summarizerv1.InferenceModel)
+		want.Spec.GetOpenai().BaseUrl = "https://localhost:4000"
+
+		updated, err := service.UpdateInferenceModel(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceModel),
+		)
+		require.NoError(t, err)
+		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			updated,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+
+		got, err := service.GetInferenceModel(ctx, "dummy-model")
+		require.NoError(t, err)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+	})
+	t.Run("no create", func(t *testing.T) {
+		_, err := service.UpdateInferenceModel(
+			ctx,
+			newInferenceModel("non-existing-model"),
+		)
+		require.Error(t, err)
+	})
+}
+
+func TestSummarizerService_CreateInferenceSecret(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferenceSecret("dummy-secret")
+		got, err := service.CreateInferenceSecret(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceSecret),
+		)
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("invalid", func(t *testing.T) {
+		s := newInferenceSecret("invalid-secret")
+		s.Spec.Value = ""
+		_, err := service.CreateInferenceSecret(
+			ctx,
+			proto.Clone(s).(*summarizerv1.InferenceSecret),
+		)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, trace.BadParameter("spec.value is required"))
+	})
+	t.Run("no upsert", func(t *testing.T) {
+		res := newInferenceSecret("no-upsert")
+		_, err := service.CreateInferenceSecret(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferenceSecret),
+		)
+		require.NoError(t, err)
+		_, err = service.CreateInferenceSecret(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferenceSecret),
+		)
+		require.Error(t, err)
+		assert.True(t, trace.IsAlreadyExists(err))
+	})
+}
+
+func TestSummarizerService_UpsertInferenceSecret(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	want := newInferenceSecret("dummy-secret")
+	got, err := service.UpsertInferenceSecret(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferenceSecret),
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.Empty(t, cmp.Diff(
+		want,
+		got,
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+	))
+
+	// Ensure we can upsert over an existing resource
+	_, err = service.UpsertInferenceSecret(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferenceSecret),
+	)
+	require.NoError(t, err)
+}
+
+func TestSummarizerService_ListInferenceSecrets(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+	// Create entities to list
+	createdObjects := []*summarizerv1.InferenceSecret{}
+	// Create 49 entities to test an incomplete page at the end.
+	for i := range 49 {
+		created, err := service.CreateInferenceSecret(
+			ctx,
+			newInferenceSecret(fmt.Sprintf("secret-%d", i)),
+		)
+		require.NoError(t, err)
+		createdObjects = append(createdObjects, created)
+	}
+	t.Run("default page size", func(t *testing.T) {
+		page, nextToken, err := service.ListInferenceSecrets(ctx, 0, "")
+		require.NoError(t, err)
+		assert.Len(t, page, 49)
+		assert.Empty(t, nextToken)
+
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(page, func(secret *summarizerv1.InferenceSecret) bool {
+				return proto.Equal(created, secret)
+			}))
+		}
+	})
+	t.Run("pagination", func(t *testing.T) {
+		fetched := []*summarizerv1.InferenceSecret{}
+		token := ""
+		iterations := 0
+		for {
+			iterations++
+			page, nextToken, err := service.ListInferenceSecrets(ctx, 10, token)
+			require.NoError(t, err)
+			fetched = append(fetched, page...)
+			if nextToken == "" {
+				break
+			}
+			token = nextToken
+		}
+		assert.Equal(t, 5, iterations)
+
+		assert.Len(t, fetched, 49)
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(fetched, func(secret *summarizerv1.InferenceSecret) bool {
+				return proto.Equal(created, secret)
+			}))
+		}
+	})
+}
+
+func TestSummarizerService_GetInferenceSecret(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferenceSecret("dummy-secret")
+		_, err := service.CreateInferenceSecret(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceSecret),
+		)
+		require.NoError(t, err)
+		got, err := service.GetInferenceSecret(ctx, "dummy-secret")
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("not found", func(t *testing.T) {
+		_, err := service.GetInferenceSecret(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_DeleteInferenceSecret(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		_, err := service.CreateInferenceSecret(
+			ctx,
+			newInferenceSecret("dummy-secret"),
+		)
+		require.NoError(t, err)
+
+		_, err = service.GetInferenceSecret(ctx, "dummy-secret")
+		require.NoError(t, err)
+
+		err = service.DeleteInferenceSecret(ctx, "dummy-secret")
+		require.NoError(t, err)
+
+		_, err = service.GetInferenceSecret(ctx, "dummy-secret")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+	t.Run("not found", func(t *testing.T) {
+		err := service.DeleteInferenceSecret(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_UpdateInferenceSecret(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		// Create resource for us to Update since we can't update a non-existent resource.
+		created, err := service.CreateInferenceSecret(
+			ctx,
+			newInferenceSecret("dummy-secret"),
+		)
+		require.NoError(t, err)
+		want := proto.Clone(created).(*summarizerv1.InferenceSecret)
+		want.Spec.Value = "new-secret-value"
+
+		updated, err := service.UpdateInferenceSecret(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferenceSecret),
+		)
+		require.NoError(t, err)
+		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			updated,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+
+		got, err := service.GetInferenceSecret(ctx, "dummy-secret")
+		require.NoError(t, err)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+	})
+	t.Run("no create", func(t *testing.T) {
+		_, err := service.UpdateInferenceSecret(
+			ctx,
+			newInferenceSecret("non-existing-secret"),
+		)
+		require.Error(t, err)
+	})
+}
+
+func TestSummarizerService_CreateInferencePolicy(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferencePolicy("dummy-policy")
+		got, err := service.CreateInferencePolicy(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferencePolicy),
+		)
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("invalid", func(t *testing.T) {
+		p := newInferencePolicy("invalid-policy")
+		p.Spec.Filter = "$%^@$"
+		_, err := service.CreateInferencePolicy(
+			ctx,
+			proto.Clone(p).(*summarizerv1.InferencePolicy),
+		)
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "spec.filter has to be a valid predicate")
+	})
+	t.Run("no upsert", func(t *testing.T) {
+		res := newInferencePolicy("no-upsert")
+		_, err := service.CreateInferencePolicy(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferencePolicy),
+		)
+		require.NoError(t, err)
+		_, err = service.CreateInferencePolicy(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(res).(*summarizerv1.InferencePolicy),
+		)
+		require.Error(t, err)
+		assert.True(t, trace.IsAlreadyExists(err))
+	})
+}
+
+func TestSummarizerService_UpsertInferencePolicy(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	want := newInferencePolicy("dummy-policy")
+	got, err := service.UpsertInferencePolicy(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferencePolicy),
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.Empty(t, cmp.Diff(
+		want,
+		got,
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+	))
+
+	// Ensure we can upsert over an existing resource
+	_, err = service.UpsertInferencePolicy(
+		ctx,
+		// Clone to avoid Marshaling modifying want
+		proto.Clone(want).(*summarizerv1.InferencePolicy),
+	)
+	require.NoError(t, err)
+}
+
+func TestSummarizerService_ListInferencePolicies(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+	// Create entities to list
+	createdObjects := []*summarizerv1.InferencePolicy{}
+	// Create 49 entities to test an incomplete page at the end.
+	for i := range 49 {
+		created, err := service.CreateInferencePolicy(
+			ctx,
+			newInferencePolicy(fmt.Sprintf("policy-%d", i)),
+		)
+		require.NoError(t, err)
+		createdObjects = append(createdObjects, created)
+	}
+	t.Run("default page size", func(t *testing.T) {
+		page, nextToken, err := service.ListInferencePolicies(ctx, 0, "")
+		require.NoError(t, err)
+		assert.Len(t, page, 49)
+		assert.Empty(t, nextToken)
+
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(page, func(policy *summarizerv1.InferencePolicy) bool {
+				return proto.Equal(created, policy)
+			}))
+		}
+	})
+	t.Run("pagination", func(t *testing.T) {
+		fetched := []*summarizerv1.InferencePolicy{}
+		token := ""
+		iterations := 0
+		for {
+			iterations++
+			page, nextToken, err := service.ListInferencePolicies(ctx, 10, token)
+			require.NoError(t, err)
+			fetched = append(fetched, page...)
+			if nextToken == "" {
+				break
+			}
+			token = nextToken
+		}
+		assert.Equal(t, 5, iterations)
+
+		assert.Len(t, fetched, 49)
+		// Expect that we get all the things we have created
+		for _, created := range createdObjects {
+			assert.True(t, slices.ContainsFunc(fetched, func(policy *summarizerv1.InferencePolicy) bool {
+				return proto.Equal(created, policy)
+			}))
+		}
+	})
+}
+
+func TestSummarizerService_GetInferencePolicy(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		want := newInferencePolicy("dummy-policy")
+		_, err := service.CreateInferencePolicy(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferencePolicy),
+		)
+		require.NoError(t, err)
+		got, err := service.GetInferencePolicy(ctx, "dummy-policy")
+		require.NoError(t, err)
+		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+	})
+	t.Run("not found", func(t *testing.T) {
+		_, err := service.GetInferencePolicy(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_DeleteInferencePolicy(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		_, err := service.CreateInferencePolicy(
+			ctx,
+			newInferencePolicy("dummy-policy"),
+		)
+		require.NoError(t, err)
+
+		_, err = service.GetInferencePolicy(ctx, "dummy-policy")
+		require.NoError(t, err)
+
+		err = service.DeleteInferencePolicy(ctx, "dummy-policy")
+		require.NoError(t, err)
+
+		_, err = service.GetInferencePolicy(ctx, "dummy-policy")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+	t.Run("not found", func(t *testing.T) {
+		err := service.DeleteInferencePolicy(ctx, "foobar")
+		require.Error(t, err)
+		assert.True(t, trace.IsNotFound(err))
+	})
+}
+
+func TestSummarizerService_UpdateInferencePolicy(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+
+	t.Run("ok", func(t *testing.T) {
+		// Create resource for us to Update since we can't update a non-existent resource.
+		created, err := service.CreateInferencePolicy(
+			ctx,
+			newInferencePolicy("dummy-policy"),
+		)
+		require.NoError(t, err)
+		want := proto.Clone(created).(*summarizerv1.InferencePolicy)
+		want.Spec.Kinds = []string{string(types.SSHSessionKind), string(types.DatabaseSessionKind)}
+
+		updated, err := service.UpdateInferencePolicy(
+			ctx,
+			// Clone to avoid Marshaling modifying want
+			proto.Clone(want).(*summarizerv1.InferencePolicy),
+		)
+		require.NoError(t, err)
+		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.Empty(t, cmp.Diff(
+			want,
+			updated,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+
+		got, err := service.GetInferencePolicy(ctx, "dummy-policy")
+		require.NoError(t, err)
+		assert.Empty(t, cmp.Diff(
+			want,
+			got,
+			protocmp.Transform(),
+			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
+		))
+		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+	})
+	t.Run("no create", func(t *testing.T) {
+		_, err := service.UpdateInferencePolicy(
+			ctx,
+			newInferencePolicy("non-existing-policy"),
+		)
+		require.Error(t, err)
+	})
+}
+
+func TestSummarizerService_AllInferencePolicies(t *testing.T) {
+	ctx, service := setupSummarizerTest(t)
+	// Create entities to retrieve
+	createdObjects := []*summarizerv1.InferencePolicy{}
+	for i := range 5 {
+		created, err := service.CreateInferencePolicy(
+			ctx,
+			newInferencePolicy(fmt.Sprintf("policy-%d", i)),
+		)
+		require.NoError(t, err)
+		createdObjects = append(createdObjects, created)
+	}
+
+	fetched := []*summarizerv1.InferencePolicy{}
+	for policy, err := range service.AllInferencePolicies(ctx) {
+		require.NoError(t, err)
+		fetched = append(fetched, policy)
+	}
+	assert.Len(t, fetched, 5)
+
+	// Expect that we get all the things we have created
+	for _, created := range createdObjects {
+		assert.True(t, slices.ContainsFunc(fetched, func(policy *summarizerv1.InferencePolicy) bool {
+			return proto.Equal(created, policy)
+		}))
+	}
+}
diff --git a/lib/services/local/trust.go b/lib/services/local/trust.go
index 1b867c45b6884..9912b042bc984 100644
--- a/lib/services/local/trust.go
+++ b/lib/services/local/trust.go
@@ -21,6 +21,7 @@ package local
 import (
 	"context"
 	"errors"
+	"iter"
 	"log/slog"
 	"slices"
 	"sort"
@@ -28,22 +29,28 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 )
 
 // CA is local implementation of Trust service that
 // is using local backend
 type CA struct {
 	backend.Backend
+	logger *slog.Logger
 }
 
 // NewCAService returns new instance of CAService
 func NewCAService(b backend.Backend) *CA {
 	return &CA{
 		Backend: b,
+		// TODO(okraport): Update local services to take an optional logger override option to support test loggers.
+		logger: slog.With(teleport.ComponentKey, "trust"),
 	}
 }
 
@@ -721,6 +728,49 @@ func (s *CA) GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster, er
 	return out, nil
 }
 
+// ListTrustedClusters returns a page of Trusted Cluster resources.
+func (s *CA) ListTrustedClusters(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error) {
+	return generic.CollectPageAndCursor(s.RangeTrustedClusters(ctx, startKey, ""), limit, types.TrustedCluster.GetName)
+}
+
+// RangeTrustedClusters returns Trusted Cluster resources within the range [start, end).
+func (s *CA) RangeTrustedClusters(ctx context.Context, start, end string) iter.Seq2[types.TrustedCluster, error] {
+	mapFn := func(item backend.Item) (types.TrustedCluster, bool) {
+		cluster, err := services.UnmarshalTrustedCluster(item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to unmarshal TrustedCluster",
+				"key", item.Key,
+				"error", err,
+			)
+			return nil, false
+		}
+		return cluster, true
+	}
+
+	clusterKey := backend.NewKey(trustedClustersPrefix)
+	startKey := clusterKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(clusterKey)
+	if end != "" {
+		endKey = clusterKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(cluster types.TrustedCluster) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || cluster.GetName() < end
+		})
+}
+
 // DeleteTrustedCluster removes a TrustedCluster from the backend by name.
 func (s *CA) DeleteTrustedCluster(ctx context.Context, name string) error {
 	return s.DeleteTrustedClusterInternal(ctx, name, nil /* no cert authorities */)
diff --git a/lib/services/local/trust_test.go b/lib/services/local/trust_test.go
index 3188c546e6c16..1292203487dce 100644
--- a/lib/services/local/trust_test.go
+++ b/lib/services/local/trust_test.go
@@ -34,9 +34,8 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -488,7 +487,7 @@ func TestTrustedClusterCRUD(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
 
-	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
+	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, bk.Close()) })
 
@@ -537,10 +536,51 @@ func TestTrustedClusterCRUD(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(ca, gotCA, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 
+	wantTcs := []types.TrustedCluster{tc, stc}
+	compareOpts := []cmp.Option{
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+		cmpopts.SortSlices(func(a, b types.TrustedCluster) bool {
+			return a.GetName() < b.GetName()
+		},
+		)}
+
 	// get all clusters
 	allTC, err := trustService.GetTrustedClusters(ctx)
 	require.NoError(t, err)
 	require.Len(t, allTC, 2)
+	require.Empty(t, cmp.Diff(wantTcs, allTC, compareOpts...))
+
+	// No page limit.
+	allTC, next, err := trustService.ListTrustedClusters(ctx, 0, "")
+	require.NoError(t, err)
+	require.Len(t, allTC, 2)
+	require.Empty(t, next)
+	require.Empty(t, cmp.Diff(wantTcs, allTC, compareOpts...))
+
+	// Check page limits.
+	firstPage, next, err := trustService.ListTrustedClusters(ctx, 1, "")
+	require.NoError(t, err)
+	require.Len(t, firstPage, 1)
+	require.NotEmpty(t, next)
+
+	// Ensure upper limit works.
+	rangeEnd, err := stream.Collect(trustService.RangeTrustedClusters(ctx, "", next))
+	require.NoError(t, err)
+	require.Len(t, rangeEnd, 1)
+	require.NotEmpty(t, next)
+	require.Empty(t, cmp.Diff(firstPage, rangeEnd, compareOpts...))
+
+	// Full range.
+	allTC, err = stream.Collect(trustService.RangeTrustedClusters(ctx, "", ""))
+	require.NoError(t, err)
+	require.Len(t, allTC, 2)
+	require.Empty(t, cmp.Diff(wantTcs, allTC, compareOpts...))
+
+	// Ensure start token work for range.
+	secondPage, err := stream.Collect(trustService.RangeTrustedClusters(ctx, next, ""))
+	require.NoError(t, err)
+	require.Len(t, secondPage, 1)
+	require.Empty(t, cmp.Diff(wantTcs, append(firstPage, secondPage...), compareOpts...))
 
 	// verify that enabling/disabling correctly shows/hides CAs
 	tc.SetEnabled(false)
diff --git a/lib/services/local/user_login_state.go b/lib/services/local/user_login_state.go
index a73c77b238dc4..59b996e904701 100644
--- a/lib/services/local/user_login_state.go
+++ b/lib/services/local/user_login_state.go
@@ -84,3 +84,9 @@ func (u *UserLoginStateService) DeleteUserLoginState(ctx context.Context, name s
 func (u *UserLoginStateService) DeleteAllUserLoginStates(ctx context.Context) error {
 	return trace.Wrap(u.svc.DeleteAllResources(ctx))
 }
+
+// ListUserLoginStates returns a paginated list of user login state resources.
+func (u *UserLoginStateService) ListUserLoginStates(ctx context.Context, pageSize int, nextToken string) ([]*userloginstate.UserLoginState, string, error) {
+	items, token, err := u.svc.ListResources(ctx, pageSize, nextToken)
+	return items, token, trace.Wrap(err)
+}
diff --git a/lib/services/local/user_login_state_test.go b/lib/services/local/user_login_state_test.go
index 6cee3e7eaefe9..251c069850218 100644
--- a/lib/services/local/user_login_state_test.go
+++ b/lib/services/local/user_login_state_test.go
@@ -31,7 +31,9 @@ import (
 
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/userloginstate"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 )
 
 // TestUserLoginStateCRUD tests backend operations with user login state resources.
@@ -117,3 +119,40 @@ func newUserLoginState(t *testing.T, name string) *userloginstate.UserLoginState
 
 	return userLoginState
 }
+
+func TestListUserLoginStates(t *testing.T) {
+	ctx := context.Background()
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+	})
+	require.NoError(t, err)
+
+	service, err := NewUserLoginStateService(backend)
+	require.NoError(t, err)
+
+	items, err := stream.Collect(clientutils.Resources(ctx, service.ListUserLoginStates))
+	require.NoError(t, err)
+	require.Empty(t, items)
+
+	state1 := newUserLoginState(t, "state1")
+	state2 := newUserLoginState(t, "state2")
+
+	_, err = service.UpsertUserLoginState(ctx, state1)
+	require.NoError(t, err)
+	_, err = service.UpsertUserLoginState(ctx, state2)
+	require.NoError(t, err)
+
+	items, err = stream.Collect(clientutils.Resources(ctx, service.ListUserLoginStates))
+	require.NoError(t, err)
+
+	require.NoError(t, err)
+	require.Len(t, items, 2)
+
+	cmpOpts := []cmp.Option{
+		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.SortSlices(func(a, b *userloginstate.UserLoginState) bool {
+			return a.GetName() < b.GetName()
+		}),
+	}
+	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{state1, state2}, items, cmpOpts...))
+}
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index 08c38a798812a..fd916ee7e4a5f 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -26,14 +26,14 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"io"
+	"iter"
 	"log/slog"
 	"sort"
 	"strings"
 	"sync"
-	"testing"
 	"time"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
@@ -45,13 +45,14 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
-	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local/generic"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -89,11 +90,6 @@ func NewIdentityService(backend backend.Backend) (*IdentityService, error) {
 // used in tests. It will use weaker cryptography to minimize the time it takes
 // to perform flakiness tests and decrease the probability of timeouts.
 func NewTestIdentityService(backend backend.Backend) (*IdentityService, error) {
-	if !testing.Testing() {
-		// Don't allow using weak cryptography in production.
-		panic("Attempted to create a test identity service outside of a test")
-	}
-
 	s, err := NewIdentityService(backend)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -120,13 +116,9 @@ func (s *IdentityService) ListUsers(ctx context.Context, req *userspb.ListUsersR
 		pageSize = apidefaults.DefaultChunkSize
 	}
 
-	// Artificially inflate the limit to account for user secrets
-	// which have the same prefix.
-	limit := int(pageSize) * 4
-
-	itemStream := backend.StreamRange(ctx, s.Backend, rangeStart, rangeEnd, limit)
+	itemStream := s.Backend.Items(ctx, backend.ItemsParams{StartKey: rangeStart, EndKey: rangeEnd})
 
-	var userStream stream.Stream[*types.UserV2]
+	var userStream iter.Seq2[*types.UserV2, error]
 	if req.WithSecrets {
 		userStream = s.streamUsersWithSecrets(itemStream)
 	} else {
@@ -143,21 +135,20 @@ func (s *IdentityService) ListUsers(ctx context.Context, req *userspb.ListUsersR
 		})
 	}
 
-	users, full := stream.Take(userStream, int(pageSize))
+	var resp userspb.ListUsersResponse
+	for user, err := range userStream {
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 
-	var nextToken string
-	if full && userStream.Next() {
-		nextToken = nextUserToken(users[len(users)-1])
-	}
+		if len(resp.Users) >= int(pageSize) {
+			resp.NextPageToken = nextUserToken(resp.Users[len(resp.Users)-1])
+			return &resp, nil
+		}
 
-	if err := userStream.Done(); err != nil {
-		return nil, trace.Wrap(err)
+		resp.Users = append(resp.Users, user)
 	}
-
-	return &userspb.ListUsersResponse{
-		Users:         users,
-		NextPageToken: nextToken,
-	}, nil
+	return &resp, nil
 }
 
 // nextUserToken returns the last token for the given user. This
@@ -171,7 +162,7 @@ func nextUserToken(user types.User) string {
 
 // streamUsersWithSecrets is a helper that converts a stream of backend items over the user key range into a stream
 // of users along with their associated secrets.
-func (s *IdentityService) streamUsersWithSecrets(itemStream stream.Stream[backend.Item]) stream.Stream[*types.UserV2] {
+func (s *IdentityService) streamUsersWithSecrets(itemStream iter.Seq2[backend.Item, error]) iter.Seq2[*types.UserV2, error] {
 	type collector struct {
 		items userItems
 		name  string
@@ -241,7 +232,7 @@ func (s *IdentityService) streamUsersWithSecrets(itemStream stream.Stream[backen
 
 // streamUsersWithoutSecrets is a helper that converts a stream of backend items over the user range into a stream of
 // user resources without any included secrets.
-func (s *IdentityService) streamUsersWithoutSecrets(itemStream stream.Stream[backend.Item]) stream.Stream[*types.UserV2] {
+func (s *IdentityService) streamUsersWithoutSecrets(itemStream iter.Seq2[backend.Item, error]) iter.Seq2[*types.UserV2, error] {
 	suffix := backend.NewKey(paramsPrefix)
 	userStream := stream.FilterMap(itemStream, func(item backend.Item) (*types.UserV2, bool) {
 		if !item.Key.HasSuffix(suffix) {
@@ -1590,28 +1581,62 @@ func (s *IdentityService) GetOIDCConnector(ctx context.Context, name string, wit
 
 // GetOIDCConnectors returns registered connectors, withSecrets adds or removes client secret from return results
 func (s *IdentityService) GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]types.OIDCConnector, error) {
-	startKey := backend.ExactKey(webPrefix, connectorsPrefix, oidcPrefix, connectorsPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	var connectors []types.OIDCConnector
-	for _, item := range result.Items {
-		conn, err := services.UnmarshalOIDCConnector(item.Value, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+	return stream.Collect(s.RangeOIDCConnectors(ctx, "", "", withSecrets))
+}
+
+// ListOIDCConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) ListOIDCConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.OIDCConnector, string, error) {
+	return generic.CollectPageAndCursor(s.RangeOIDCConnectors(ctx, start, "", withSecrets), limit, types.OIDCConnector.GetName)
+}
+
+// RangeOIDCConnectors returns valid registered connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) RangeOIDCConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.OIDCConnector, error] {
+	mapFn := func(item backend.Item) (types.OIDCConnector, bool) {
+		conn, err := services.UnmarshalOIDCConnector(
+			item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision),
+		)
+
 		if err != nil {
-			s.logger.ErrorContext(ctx, "Error unmarshaling OIDC Connector",
+			s.logger.ErrorContext(ctx, "Failed to unmarshal OIDC Connector",
 				"key", item.Key,
 				"error", err,
 			)
-			continue
+			return nil, false
 		}
+
 		if !withSecrets {
 			conn.SetClientSecret("")
 			conn.SetGoogleServiceAccount("")
 		}
-		connectors = append(connectors, conn)
+
+		return conn, true
 	}
-	return connectors, nil
+
+	connectorKey := backend.NewKey(webPrefix, connectorsPrefix, oidcPrefix, connectorsPrefix)
+	startKey := connectorKey.AppendKey(backend.KeyFromString(start))
+	endKey := backend.RangeEnd(connectorKey)
+	if end != "" {
+		endKey = connectorKey.AppendKey(backend.KeyFromString(end)).ExactKey()
+	}
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(conn types.OIDCConnector) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || conn.GetName() < end
+		})
+
 }
 
 // CreateOIDCAuthRequest creates new auth request
@@ -1764,27 +1789,39 @@ func (s *IdentityService) GetSAMLConnectorWithValidationOptions(ctx context.Cont
 // GetSAMLConnectors returns registered connectors
 // withSecrets includes or excludes private key values from return results
 func (s *IdentityService) GetSAMLConnectors(ctx context.Context, withSecrets bool) ([]types.SAMLConnector, error) {
-	return s.GetSAMLConnectorsWithValidationOptions(ctx, withSecrets)
+	return stream.Collect(s.RangeSAMLConnectorsWithOptions(ctx, "", "", withSecrets))
 }
 
 // GetSAMLConnectorsWithValidationOptions returns registered connectors
 // withSecrets includes or excludes private key values from return results
 func (s *IdentityService) GetSAMLConnectorsWithValidationOptions(ctx context.Context, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, error) {
-	startKey := backend.ExactKey(webPrefix, connectorsPrefix, samlPrefix, connectorsPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	var connectors []types.SAMLConnector
-	for _, item := range result.Items {
-		conn, err := services.UnmarshalSAMLConnectorWithValidationOptions(item.Value, opts, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+	return stream.Collect(s.RangeSAMLConnectorsWithOptions(ctx, "", "", withSecrets, opts...))
+}
+
+// ListSAMLConnectorsWithOptions returns a page of valid registered SAML connectors.
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) ListSAMLConnectorsWithOptions(ctx context.Context, limit int, start string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) ([]types.SAMLConnector, string, error) {
+	return generic.CollectPageAndCursor(s.RangeSAMLConnectorsWithOptions(ctx, start, "", withSecrets, opts...), limit, types.SAMLConnector.GetName)
+}
+
+// RangeSAMLConnectorsWithOptions returns valid registered SAML connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) RangeSAMLConnectorsWithOptions(ctx context.Context, start, end string, withSecrets bool, opts ...types.SAMLConnectorValidationOption) iter.Seq2[types.SAMLConnector, error] {
+	mapFn := func(item backend.Item) (types.SAMLConnector, bool) {
+		conn, err := services.UnmarshalSAMLConnectorWithValidationOptions(
+			item.Value,
+			opts,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision))
+
 		if err != nil {
-			s.logger.ErrorContext(ctx, "Error unmarshaling SAML Connector",
+			s.logger.ErrorContext(ctx, "Failed to unmarshal SAML Connector",
 				"key", item.Key,
 				"error", err,
 			)
-			continue
+			return nil, false
 		}
+
 		if !withSecrets {
 			keyPair := conn.GetSigningKeyPair()
 			if keyPair != nil {
@@ -1792,9 +1829,30 @@ func (s *IdentityService) GetSAMLConnectorsWithValidationOptions(ctx context.Con
 				conn.SetSigningKeyPair(keyPair)
 			}
 		}
-		connectors = append(connectors, conn)
+
+		return conn, true
+	}
+
+	startKey := backend.NewKey(webPrefix, connectorsPrefix, samlPrefix, connectorsPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(webPrefix, connectorsPrefix, samlPrefix, connectorsPrefix))
+	if end != "" {
+		endKey = backend.NewKey(webPrefix, connectorsPrefix, samlPrefix, connectorsPrefix, end).ExactKey()
 	}
-	return connectors, nil
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(conn types.SAMLConnector) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || conn.GetName() < end
+		},
+	)
 }
 
 // CreateSAMLAuthRequest creates new auth request
@@ -2011,27 +2069,60 @@ func (s *IdentityService) CreateGithubConnector(ctx context.Context, connector t
 
 // GetGithubConnectors returns all configured Github connectors
 func (s *IdentityService) GetGithubConnectors(ctx context.Context, withSecrets bool) ([]types.GithubConnector, error) {
-	startKey := backend.ExactKey(webPrefix, connectorsPrefix, githubPrefix, connectorsPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	var connectors []types.GithubConnector
-	for _, item := range result.Items {
-		connector, err := services.UnmarshalGithubConnector(item.Value, services.WithRevision(item.Revision))
+	return stream.Collect(s.RangeGithubConnectors(ctx, "", "", withSecrets))
+}
+
+// ListGithubConnectors returns a page of valid registered connectors.
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error) {
+	return generic.CollectPageAndCursor(s.RangeGithubConnectors(ctx, start, "", withSecrets), limit, types.GithubConnector.GetName)
+}
+
+// RangeGithubConnectors returns valid registered connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (s *IdentityService) RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error] {
+	mapFn := func(item backend.Item) (types.GithubConnector, bool) {
+		conn, err := services.UnmarshalGithubConnector(
+			item.Value,
+			services.WithExpires(item.Expires),
+			services.WithRevision(item.Revision),
+		)
+
 		if err != nil {
-			s.logger.ErrorContext(ctx, "Error unmarshaling GitHub Connector",
+			s.logger.ErrorContext(ctx, "Failed to unmarshal GitHub Connector",
 				"key", item.Key,
 				"error", err,
 			)
-			continue
+			return nil, false
 		}
+
 		if !withSecrets {
-			connector.SetClientSecret("")
+			conn.SetClientSecret("")
 		}
-		connectors = append(connectors, connector)
+
+		return conn, true
+	}
+
+	startKey := backend.NewKey(webPrefix, connectorsPrefix, githubPrefix, connectorsPrefix, start)
+	endKey := backend.RangeEnd(backend.NewKey(webPrefix, connectorsPrefix, githubPrefix, connectorsPrefix))
+	if end != "" {
+		endKey = backend.NewKey(webPrefix, connectorsPrefix, githubPrefix, connectorsPrefix, end).ExactKey()
 	}
-	return connectors, nil
+
+	return stream.TakeWhile(
+		stream.FilterMap(
+			s.Backend.Items(ctx, backend.ItemsParams{
+				StartKey: startKey,
+				EndKey:   endKey,
+			}),
+			mapFn,
+		),
+		func(conn types.GithubConnector) bool {
+			// The range is not inclusive of the end key, so return early
+			// if the end has been reached.
+			return end == "" || conn.GetName() < end
+		})
+
 }
 
 // GetGithubConnector returns a particular Github connector.
diff --git a/lib/services/local/users_test.go b/lib/services/local/users_test.go
index 455cc724da7f5..90fe5c1953f4b 100644
--- a/lib/services/local/users_test.go
+++ b/lib/services/local/users_test.go
@@ -1380,7 +1380,7 @@ func TestIdentityService_ListUsers(t *testing.T) {
 	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no more users exist")
 	assert.Empty(t, cmp.Diff(expectedUsers, rsp.Users, cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")), "not all users returned from listing operation")
 
-	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{})
+	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{WithSecrets: true})
 	assert.NoError(t, err, "no error returned when no users exist")
 	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no users exist")
 	assert.Empty(t, cmp.Diff(expectedUsers, rsp.Users), "not all users returned from listing operation")
diff --git a/lib/services/local/usertoken.go b/lib/services/local/usertoken.go
index 29c7010472854..e0d29371508bf 100644
--- a/lib/services/local/usertoken.go
+++ b/lib/services/local/usertoken.go
@@ -23,34 +23,45 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/services"
 )
 
-// GetUserTokens returns all user tokens.
-func (s *IdentityService) GetUserTokens(ctx context.Context) ([]types.UserToken, error) {
-	startKey := backend.ExactKey(userTokenPrefix)
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
-	if err != nil {
-		return nil, trace.Wrap(err)
+// ListUserTokens returns a page of user tokens.
+func (s *IdentityService) ListUserTokens(ctx context.Context, limit int, startKey string) ([]types.UserToken, string, error) {
+	// Adjust page size, so it can't be too large.
+	if limit <= 0 || limit > defaults.DefaultChunkSize {
+		limit = defaults.DefaultChunkSize
 	}
 
-	var tokens []types.UserToken
-	for _, item := range result.Items {
-		if !item.Key.HasSuffix(backend.NewKey(paramsPrefix)) {
+	rangeStart := backend.ExactKey(userTokenPrefix)
+	rangeEnd := backend.RangeEnd(rangeStart)
+	if startKey != "" {
+		rangeStart = backend.NewKey(userTokenPrefix, startKey)
+	}
+	var out []types.UserToken
+	for item, err := range s.Backend.Items(ctx, backend.ItemsParams{
+		StartKey: rangeStart,
+		EndKey:   rangeEnd,
+		Limit:    limit + 1,
+	}) {
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+		userToken, err := services.UnmarshalUserToken(item.Value, services.WithExpires(item.Expires), services.WithRevision(item.Revision))
+		if err != nil {
 			continue
 		}
 
-		token, err := services.UnmarshalUserToken(item.Value)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if len(out) == limit {
+			return out, userToken.GetName(), nil
 		}
 
-		tokens = append(tokens, token)
+		out = append(out, userToken)
 	}
-
-	return tokens, nil
+	return out, "", nil
 }
 
 // DeleteUserToken deletes user token by ID.
diff --git a/lib/services/local/usertoken_test.go b/lib/services/local/usertoken_test.go
new file mode 100644
index 0000000000000..08cb8121a8e63
--- /dev/null
+++ b/lib/services/local/usertoken_test.go
@@ -0,0 +1,148 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package local
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/memory"
+)
+
+func setupIdentityTest(t *testing.T) *IdentityService {
+	clock := clockwork.NewFakeClock()
+	mem, err := memory.New(memory.Config{
+		Context: t.Context(),
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+	service, err := NewIdentityService(backend.NewSanitizer(mem))
+	require.NoError(t, err)
+	return service
+}
+
+func TestIdentityService_ListUserTokens(t *testing.T) {
+	t.Parallel()
+	t.Run("none", func(t *testing.T) {
+		ctx := t.Context()
+		service := setupIdentityTest(t)
+		userTokens, _, err := service.ListUserTokens(ctx, 5, "")
+		require.NoError(t, err)
+		require.Empty(t, userTokens)
+	})
+	t.Run("list all", func(t *testing.T) {
+		service := setupIdentityTest(t)
+		ctx := t.Context()
+		userToken1, err := service.CreateUserToken(ctx, &types.UserTokenV3{
+			Kind:    types.KindUserToken,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name: "token-user-1",
+			},
+			Spec: types.UserTokenSpecV3{
+				User:    "user1",
+				Created: time.Now(),
+			},
+		})
+		require.NoError(t, err)
+		userToken2, err := service.CreateUserToken(ctx, &types.UserTokenV3{
+			Kind:    types.KindUserToken,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name: "token-user-2",
+			},
+			Spec: types.UserTokenSpecV3{
+				User:    "user2",
+				Created: time.Now(),
+			},
+		})
+		require.NoError(t, err)
+		userTokens, next, err := service.ListUserTokens(ctx, 5, "")
+		require.NoError(t, err)
+		require.Len(t, userTokens, 2)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(
+			userToken1,
+			userTokens[0],
+			protocmp.Transform(),
+		))
+		require.Empty(t, cmp.Diff(
+			userToken2,
+			userTokens[1],
+			protocmp.Transform(),
+		))
+	})
+	t.Run("list paged", func(t *testing.T) {
+		service := setupIdentityTest(t)
+		ctx := t.Context()
+		userToken1, err := service.CreateUserToken(ctx, &types.UserTokenV3{
+			Kind:    types.KindUserToken,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name: "token-user-1",
+			},
+			Spec: types.UserTokenSpecV3{
+				User:    "user1",
+				Created: time.Now(),
+			},
+		})
+		require.NoError(t, err)
+		userToken2, err := service.CreateUserToken(ctx, &types.UserTokenV3{
+			Kind:    types.KindUserToken,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name: "token-user-2",
+			},
+			Spec: types.UserTokenSpecV3{
+				User:    "user2",
+				Created: time.Now(),
+			},
+		})
+		require.NoError(t, err)
+		userTokens, next, err := service.ListUserTokens(ctx, 1, "")
+		t.Log(userTokens)
+		t.Log(next)
+		require.NoError(t, err)
+		require.Len(t, userTokens, 1)
+		require.NotEmpty(t, next)
+		require.Empty(t, cmp.Diff(
+			userToken1,
+			userTokens[0],
+			protocmp.Transform(),
+		))
+		userTokens, next, err = service.ListUserTokens(ctx, 1, next)
+		t.Log(userTokens)
+		t.Log(next)
+		require.NoError(t, err)
+		require.Len(t, userTokens, 1)
+		require.Empty(t, next)
+		require.Empty(t, cmp.Diff(
+			userToken2,
+			userTokens[0],
+			protocmp.Transform(),
+		))
+	})
+}
diff --git a/lib/services/local/workload_identity.go b/lib/services/local/workload_identity.go
index b2bc9df620cce..e1966a60f2f12 100644
--- a/lib/services/local/workload_identity.go
+++ b/lib/services/local/workload_identity.go
@@ -78,9 +78,31 @@ func (b *WorkloadIdentityService) GetWorkloadIdentity(
 // ListWorkloadIdentities lists all WorkloadIdentities using a given page size
 // and last key.
 func (b *WorkloadIdentityService) ListWorkloadIdentities(
-	ctx context.Context, pageSize int, currentToken string,
+	ctx context.Context,
+	pageSize int,
+	currentToken string,
+	options *services.ListWorkloadIdentitiesRequestOptions,
 ) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
-	r, nextToken, err := b.service.ListResources(ctx, pageSize, currentToken)
+	if options.GetSortField() != "" && options.GetSortField() != "name" {
+		return nil, "", trace.CompareFailed("unsupported sort, only name field is supported, but got %q", options.GetSortField())
+	}
+	if options.GetSortDesc() {
+		return nil, "", trace.CompareFailed("unsupported sort, only ascending order is supported")
+	}
+
+	if options.GetFilterSearchTerm() == "" {
+		r, nextToken, err := b.service.ListResources(ctx, pageSize, currentToken)
+		return r, nextToken, trace.Wrap(err)
+	}
+
+	r, nextToken, err := b.service.ListResourcesWithFilter(
+		ctx,
+		pageSize,
+		currentToken,
+		func(item *workloadidentityv1pb.WorkloadIdentity) bool {
+			return services.MatchWorkloadIdentity(item, options.GetFilterSearchTerm())
+		},
+	)
 	return r, nextToken, trace.Wrap(err)
 }
 
diff --git a/lib/services/local/workload_identity_test.go b/lib/services/local/workload_identity_test.go
index 37ae4c900bacb..6fdb7a98f8683 100644
--- a/lib/services/local/workload_identity_test.go
+++ b/lib/services/local/workload_identity_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
@@ -34,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 func setupWorkloadIdentityServiceTest(
@@ -61,7 +63,8 @@ func newValidWorkloadIdentity(name string) *workloadidentityv1pb.WorkloadIdentit
 		},
 		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
 			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
-				Id: "/test",
+				Id:   "/test/" + name,
+				Hint: "This is hint " + name,
 			},
 		},
 	}
@@ -157,16 +160,16 @@ func TestWorkloadIdentityService_ListWorkloadIdentities(t *testing.T) {
 		createdObjects = append(createdObjects, created)
 	}
 	t.Run("default page size", func(t *testing.T) {
-		page, nextToken, err := service.ListWorkloadIdentities(ctx, 0, "")
+		page, nextToken, err := service.ListWorkloadIdentities(ctx, 0, "", nil)
 		require.NoError(t, err)
 		require.Len(t, page, 49)
 		require.Empty(t, nextToken)
 
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(page, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
+			require.True(t, slices.ContainsFunc(page, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 	t.Run("pagination", func(t *testing.T) {
@@ -175,7 +178,7 @@ func TestWorkloadIdentityService_ListWorkloadIdentities(t *testing.T) {
 		iterations := 0
 		for {
 			iterations++
-			page, nextToken, err := service.ListWorkloadIdentities(ctx, 10, token)
+			page, nextToken, err := service.ListWorkloadIdentities(ctx, 10, token, nil)
 			require.NoError(t, err)
 			fetched = append(fetched, page...)
 			if nextToken == "" {
@@ -188,11 +191,56 @@ func TestWorkloadIdentityService_ListWorkloadIdentities(t *testing.T) {
 		require.Len(t, fetched, 49)
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
+			require.True(t, slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
+	t.Run("default sort", func(t *testing.T) {
+		page, nextToken, err := service.ListWorkloadIdentities(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, page, 49)
+		require.Empty(t, nextToken)
+
+		prevName := ""
+		for i := range len(page) {
+			assert.Greater(t, page[i].GetMetadata().GetName(), prevName)
+			prevName = page[i].GetMetadata().GetName()
+		}
+	})
+	t.Run("unsupported sort field error", func(t *testing.T) {
+		_, _, err := service.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortField: "blah",
+		})
+		require.ErrorContains(t, err, `unsupported sort, only name field is supported, but got "blah"`)
+	})
+	t.Run("unsupported sort order error", func(t *testing.T) {
+		_, _, err := service.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			SortDesc: true,
+		})
+		require.ErrorContains(t, err, "unsupported sort, only ascending order is supported")
+	})
+	t.Run("search filter match on name", func(t *testing.T) {
+		page, _, err := service.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			FilterSearchTerm: "9",
+		})
+		require.NoError(t, err)
+		assert.Len(t, page, 4)
+	})
+	t.Run("search filter match on spiffe id", func(t *testing.T) {
+		page, _, err := service.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			FilterSearchTerm: "test/22",
+		})
+		require.NoError(t, err)
+		assert.Len(t, page, 1)
+	})
+	t.Run("search filter match on spiffe hint", func(t *testing.T) {
+		page, _, err := service.ListWorkloadIdentities(ctx, 0, "", &services.ListWorkloadIdentitiesRequestOptions{
+			FilterSearchTerm: "hint 13",
+		})
+		require.NoError(t, err)
+		assert.Len(t, page, 1)
+	})
 }
 
 func TestWorkloadIdentityService_GetWorkloadIdentity(t *testing.T) {
@@ -263,14 +311,14 @@ func TestWorkloadIdentityService_DeleteAllWorkloadIdentities(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	page, _, err := service.ListWorkloadIdentities(ctx, 0, "")
+	page, _, err := service.ListWorkloadIdentities(ctx, 0, "", nil)
 	require.NoError(t, err)
 	require.Len(t, page, 2)
 
 	err = service.DeleteAllWorkloadIdentities(ctx)
 	require.NoError(t, err)
 
-	page, _, err = service.ListWorkloadIdentities(ctx, 0, "")
+	page, _, err = service.ListWorkloadIdentities(ctx, 0, "", nil)
 	require.NoError(t, err)
 	require.Empty(t, page)
 }
diff --git a/lib/services/local/workload_identity_x509_revocation_test.go b/lib/services/local/workload_identity_x509_revocation_test.go
index a434b36c2dce6..00c478a64ee47 100644
--- a/lib/services/local/workload_identity_x509_revocation_test.go
+++ b/lib/services/local/workload_identity_x509_revocation_test.go
@@ -170,9 +170,9 @@ func TestWorkloadIdentityX509RevocationService_List(t *testing.T) {
 
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(page, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
+			require.True(t, slices.ContainsFunc(page, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 	t.Run("pagination", func(t *testing.T) {
@@ -194,9 +194,9 @@ func TestWorkloadIdentityX509RevocationService_List(t *testing.T) {
 		require.Len(t, fetched, 49)
 		// Expect that we get all the things we have created
 		for _, created := range createdObjects {
-			slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
+			require.True(t, slices.ContainsFunc(fetched, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
 				return proto.Equal(created, resource)
-			})
+			}))
 		}
 	})
 }
diff --git a/lib/services/lock.go b/lib/services/lock.go
index 095dfc54e6e54..8724ffc1947e9 100644
--- a/lib/services/lock.go
+++ b/lib/services/lock.go
@@ -66,6 +66,12 @@ func ProxyingLockTargets(localClusterName, serverID string, accessInfo *AccessIn
 	if trustedDevice := unmappedIdentity.DeviceID; trustedDevice != "" {
 		lockTargets = append(lockTargets, types.LockTarget{Device: trustedDevice})
 	}
+	if joinToken := unmappedIdentity.JoinToken; joinToken != "" {
+		lockTargets = append(lockTargets, types.LockTarget{JoinToken: joinToken})
+	}
+	if botInstanceID := unmappedIdentity.BotInstanceID; botInstanceID != "" {
+		lockTargets = append(lockTargets, types.LockTarget{BotInstanceID: botInstanceID})
+	}
 	roles := apiutils.Deduplicate(append(accessInfo.Roles, unmappedIdentity.Roles...))
 	lockTargets = append(lockTargets, RolesToLockTargets(roles)...)
 	lockTargets = append(lockTargets, AccessRequestsToLockTargets(unmappedIdentity.ActiveRequests)...)
@@ -87,6 +93,12 @@ func LockTargetsFromTLSIdentity(id tlsca.Identity) []types.LockTarget {
 	if id.DeviceExtensions.DeviceID != "" {
 		lockTargets = append(lockTargets, types.LockTarget{Device: id.DeviceExtensions.DeviceID})
 	}
+	if id.JoinToken != "" {
+		lockTargets = append(lockTargets, types.LockTarget{JoinToken: id.JoinToken})
+	}
+	if id.BotInstanceID != "" {
+		lockTargets = append(lockTargets, types.LockTarget{BotInstanceID: id.BotInstanceID})
+	}
 	lockTargets = append(lockTargets, AccessRequestsToLockTargets(id.ActiveRequests)...)
 	return lockTargets
 }
diff --git a/lib/services/lock_test.go b/lib/services/lock_test.go
index 1c7ff93671b14..66a9c143f8a61 100644
--- a/lib/services/lock_test.go
+++ b/lib/services/lock_test.go
@@ -40,6 +40,8 @@ func TestLockTargetsFromTLSIdentity(t *testing.T) {
 			DeviceExtensions: tlsca.DeviceExtensions{
 				DeviceID: "trusted-device-id",
 			},
+			JoinToken:     "example",
+			BotInstanceID: "a-b-c-d",
 		}
 
 		// Test.
@@ -49,6 +51,8 @@ func TestLockTargetsFromTLSIdentity(t *testing.T) {
 			{User: identity.Username},
 			{MFADevice: identity.MFAVerified},
 			{Device: identity.DeviceExtensions.DeviceID},
+			{JoinToken: "example"},
+			{BotInstanceID: "a-b-c-d"},
 		}
 		// Insert roles at the start to match `got`s order.
 		// The test itself doesn't care about the order, it's just easier to test
@@ -71,6 +75,8 @@ func TestSSHAccessLockTargets(t *testing.T) {
 		const trustedDevice = "my-trusted-device-1"
 		const osLogin = "camel"
 		const teleportUser = "llama"
+		const joinToken = "some-join-token"
+		const botInstanceID = "a-b-c-d"
 		mappedRoles := []string{"access", "editor"}
 		unmappedRoles := []string{"unmapped-role-1", "unmapped-role-2", "access"}
 		accessRequests := []string{"access-request-1", "access-request-2"}
@@ -81,6 +87,8 @@ func TestSSHAccessLockTargets(t *testing.T) {
 			DeviceID:       trustedDevice,
 			Roles:          unmappedRoles,
 			ActiveRequests: accessRequests,
+			JoinToken:      joinToken,
+			BotInstanceID:  botInstanceID,
 		}
 
 		accessInfo := &services.AccessInfo{
@@ -95,6 +103,8 @@ func TestSSHAccessLockTargets(t *testing.T) {
 			{ServerID: serverID + "." + clusterName},
 			{MFADevice: mfaDevice},
 			{Device: trustedDevice},
+			{JoinToken: joinToken},
+			{BotInstanceID: botInstanceID},
 		}
 		for _, role := range mappedRoles {
 			want = append(want, types.LockTarget{Role: role})
diff --git a/lib/services/matchers.go b/lib/services/matchers.go
index fc9080ac6ab41..9108b29c185e4 100644
--- a/lib/services/matchers.go
+++ b/lib/services/matchers.go
@@ -22,9 +22,11 @@ import (
 	"context"
 	"log/slog"
 	"slices"
+	"strings"
 
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
@@ -96,14 +98,13 @@ func SimplifyAzureMatchers(matchers []types.AzureMatcher) []types.AzureMatcher {
 				regions[i] = azureutils.NormalizeLocation(region)
 			}
 		}
-		result = append(result, types.AzureMatcher{
-			Subscriptions:  subs,
-			ResourceGroups: groups,
-			Regions:        regions,
-			Types:          ts,
-			ResourceTags:   m.ResourceTags,
-			Params:         m.Params,
-		})
+		elem := m
+		elem.Subscriptions = subs
+		elem.ResourceGroups = groups
+		elem.Regions = regions
+		elem.Types = ts
+
+		result = append(result, elem)
 	}
 	return result
 }
@@ -133,12 +134,10 @@ func MatchResourceLabels(matchers []ResourceMatcher, labels map[string]string) b
 // resourceWithTargetHealth wraps a resource to provide target health info.
 type resourceWithTargetHealth struct {
 	types.ResourceWithLabels
-	health types.TargetHealth
+	health types.TargetHealthStatus
 }
 
-var _ types.TargetHealthGetter = (*resourceWithTargetHealth)(nil)
-
-func (r *resourceWithTargetHealth) GetTargetHealth() types.TargetHealth {
+func (r *resourceWithTargetHealth) GetTargetHealthStatus() types.TargetHealthStatus {
 	return r.health
 }
 
@@ -147,6 +146,20 @@ func (r *resourceWithTargetHealth) GetTargetHealth() types.TargetHealth {
 // only applies to resource Application.
 type ResourceSeenKey struct{ name, kind, addr string }
 
+// MatchResourcesByFilters filters provided resources with profiled filter.
+func MatchResourcesByFilters[E types.ResourceWithLabels, S ~[]E](all S, filter MatchResourceFilter) (S, error) {
+	var filtered S
+	for _, r := range all {
+		match, err := MatchResourceByFilters(r, filter, nil)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		} else if match {
+			filtered = append(filtered, r)
+		}
+	}
+	return filtered, nil
+}
+
 // MatchResourceByFilters returns true if all filter values given matched against the resource.
 //
 // If no filters were provided, we will treat that as a match.
@@ -191,7 +204,7 @@ func MatchResourceByFilters(resource types.ResourceWithLabels, filter MatchResou
 		}
 		specResource = &resourceWithTargetHealth{
 			ResourceWithLabels: server.GetDatabase(),
-			health:             server.GetTargetHealth(),
+			health:             server.GetTargetHealthStatus(),
 		}
 		key.name = specResource.GetName()
 	case types.KindAppServer, types.KindSAMLIdPServiceProvider:
@@ -211,7 +224,7 @@ func MatchResourceByFilters(resource types.ResourceWithLabels, filter MatchResou
 		// We check if the resource kind is a Kubernetes resource kind to reduce the amount of
 		// of cases we need to handle. If the resource type didn't match any arm before
 		// and it is not a Kubernetes resource kind, we return an error.
-		if !slices.Contains(types.KubernetesResourcesKinds, filter.ResourceKind) {
+		if !slices.Contains(types.KubernetesResourcesKinds, filter.ResourceKind) && !strings.HasPrefix(filter.ResourceKind, types.AccessRequestPrefixKindKube) {
 			return false, trace.NotImplemented("filtering for resource kind %q not supported", kind)
 		}
 		specResource = resource
@@ -286,7 +299,10 @@ func matchAndFilterKubeClusters(resource types.ResourceWithLabels, filter MatchR
 		if kubeCluster == nil {
 			return false, nil
 		}
-		match, err := matchResourceByFilters(kubeCluster, filter)
+		match, err := matchResourceByFilters(&resourceWithTargetHealth{
+			ResourceWithLabels: kubeCluster,
+			health:             server.GetTargetHealthStatus(),
+		}, filter)
 		return match, trace.Wrap(err)
 	default:
 		return false, trace.BadParameter("unexpected kube server of type %T", resource)
@@ -317,3 +333,21 @@ func (m *MatchResourceFilter) IsSimple() bool {
 		m.PredicateExpression == nil &&
 		len(m.Kinds) == 0
 }
+
+// MatchResourceFilterFromListResourceRequest converts a
+// proto.ListResourcesRequest to MatchResourceFilter.
+func MatchResourceFilterFromListResourceRequest(req *proto.ListResourcesRequest) (MatchResourceFilter, error) {
+	filter := MatchResourceFilter{
+		ResourceKind:   req.ResourceType,
+		Labels:         req.Labels,
+		SearchKeywords: req.SearchKeywords,
+	}
+	if req.PredicateExpression != "" {
+		expression, err := NewResourceExpression(req.PredicateExpression)
+		if err != nil {
+			return MatchResourceFilter{}, trace.Wrap(err)
+		}
+		filter.PredicateExpression = expression
+	}
+	return filter, nil
+}
diff --git a/lib/services/matchers_test.go b/lib/services/matchers_test.go
index 14a43313a04b3..9f8c4b36c48b0 100644
--- a/lib/services/matchers_test.go
+++ b/lib/services/matchers_test.go
@@ -139,6 +139,63 @@ func TestMatchResourceLabels(t *testing.T) {
 	}
 }
 
+func TestSimplifyAzureMatchers(t *testing.T) {
+	matchers := []types.AzureMatcher{
+		{
+			Subscriptions: []string{"sub-1", types.Wildcard, "sub-1"},
+			Regions:       []string{"eu-west-1", "eu-west-2"},
+			Types:         []string{"mysql", "mysql", "postgres"},
+			ResourceTags:  types.Labels{"env": []string{"prod"}},
+			Params: &types.InstallerParams{
+				JoinMethod: types.JoinMethodAzure,
+				JoinToken:  "token-1",
+				Azure: &types.AzureInstallerParams{
+					ClientID: "client-1",
+				},
+			},
+			Integration: "integration-1",
+		},
+		{
+			ResourceGroups: []string{
+				"rg-1",
+				types.Wildcard,
+				"rg-1",
+			},
+			Types:       []string{"redis"},
+			Integration: "integration-2",
+		},
+	}
+
+	simplified := SimplifyAzureMatchers(matchers)
+
+	want := []types.AzureMatcher{
+		{
+			Subscriptions:  []string{types.Wildcard},
+			ResourceGroups: []string{types.Wildcard},
+			Regions:        []string{"eu-west-1", "eu-west-2"},
+			Types:          []string{"mysql", "postgres"},
+			ResourceTags:   types.Labels{"env": []string{"prod"}},
+			Params: &types.InstallerParams{
+				JoinMethod: types.JoinMethodAzure,
+				JoinToken:  "token-1",
+				Azure: &types.AzureInstallerParams{
+					ClientID: "client-1",
+				},
+			},
+			Integration: "integration-1",
+		},
+		{
+			Subscriptions:  []string{types.Wildcard},
+			ResourceGroups: []string{types.Wildcard},
+			Regions:        []string{types.Wildcard},
+			Types:          []string{"redis"},
+			Integration:    "integration-2",
+		},
+	}
+
+	require.Equal(t, want, simplified)
+}
+
 func TestMatchResourceByFilters_Helper(t *testing.T) {
 	t.Parallel()
 
@@ -475,9 +532,9 @@ func TestMatchResourceByHealthStatus(t *testing.T) {
 			matchedNames:     []string{"db-server-0"},
 		},
 		{
-			name:             "unhealthy db status and message",
+			name:             "unhealthy db status",
 			resources:        dbServers,
-			filterExpression: `health.message == "failed to fizz the buzz" && health.status == "unhealthy"`,
+			filterExpression: `health.status == "unhealthy"`,
 			matchedNames:     []string{"db-server-1"},
 		},
 		{
@@ -495,7 +552,7 @@ func TestMatchResourceByHealthStatus(t *testing.T) {
 		{
 			name:             "server health is empty",
 			resources:        []types.ResourceWithLabels{server},
-			filterExpression: `!exists(health.status) && health.message == ""`,
+			filterExpression: `!exists(health.status)`,
 			matchedNames:     []string{"server"},
 		},
 	}
@@ -661,6 +718,26 @@ func TestMatchResourceByFilters(t *testing.T) {
 				PredicateExpression: filterExpression,
 			},
 		},
+		{
+			name: "MCP server with mcp kind filter",
+			resource: func() types.ResourceWithLabels {
+				return newAppServerFromApp(t, newMCPServerApp(t, "foo"))
+			},
+			filters: MatchResourceFilter{
+				Kinds:               []string{types.KindMCP},
+				PredicateExpression: filterExpression,
+			},
+		},
+		{
+			name: "MCP server with app kind filter",
+			resource: func() types.ResourceWithLabels {
+				return newAppServerFromApp(t, newMCPServerApp(t, "foo"))
+			},
+			filters: MatchResourceFilter{
+				Kinds:               []string{types.KindApp},
+				PredicateExpression: filterExpression,
+			},
+		},
 	}
 
 	for _, tc := range testcases {
@@ -731,3 +808,55 @@ func TestResourceMatchersToTypes(t *testing.T) {
 		})
 	}
 }
+
+func TestMatchResourcesByFilters(t *testing.T) {
+	appServers := make(types.AppServers, 5)
+	oddOrEven := func(i int) string {
+		if i%2 == 1 {
+			return "odd"
+		}
+		return "even"
+	}
+	for i := range len(appServers) {
+		app, err := types.NewAppV3(types.Metadata{
+			Name:   fmt.Sprintf("app-%d", i),
+			Labels: map[string]string{"group": oddOrEven(i)},
+		}, types.AppSpecV3{
+			URI: "http://localhost:8888",
+		})
+		require.NoError(t, err)
+		appServers[i] = newAppServerFromApp(t, app)
+	}
+
+	evenAppServers, err := MatchResourcesByFilters(appServers, MatchResourceFilter{
+		ResourceKind: types.KindAppServer,
+		Labels:       map[string]string{"group": "even"},
+	})
+
+	require.NoError(t, err)
+	require.IsType(t, types.AppServers{}, evenAppServers)
+	require.Equal(t,
+		[]string{"app-0", "app-2", "app-4"},
+		slices.Collect(types.ResourceNames(evenAppServers)),
+	)
+}
+
+func newMCPServerApp(t *testing.T, name string) *types.AppV3 {
+	t.Helper()
+	app, err := types.NewAppV3(types.Metadata{
+		Name: name,
+	}, types.AppSpecV3{
+		MCP: &types.MCP{
+			Command:       "test",
+			RunAsHostUser: "test",
+		},
+	})
+	require.NoError(t, err)
+	return app
+}
+
+func newAppServerFromApp(t *testing.T, app *types.AppV3) types.AppServer {
+	appServer, err := types.NewAppServerV3FromApp(app, "_", "_")
+	require.NoError(t, err)
+	return appServer
+}
diff --git a/lib/services/parser.go b/lib/services/parser.go
index 15a037e405b32..b13d98ee6dee0 100644
--- a/lib/services/parser.go
+++ b/lib/services/parser.go
@@ -48,6 +48,9 @@ type RuleContext interface {
 	// GetResource returns resource if specified in the context,
 	// if unspecified, returns error.
 	GetResource() (types.Resource, error)
+	// GetAccessChecker returns access checker if specified in the context,
+	// if unspecified, returns error.
+	GetAccessChecker() (AccessChecker, error)
 }
 
 var (
@@ -145,17 +148,33 @@ func predicateIsSubset(a interface{}, b ...interface{}) predicate.BoolPredicate
 	}
 }
 
-// NewWhereParser returns standard parser for `where` section in access rules.
-func NewWhereParser(ctx RuleContext) (predicate.Parser, error) {
-	return predicate.NewParser(predicate.Def{
+func newDefaultWhereParserDef(ctx RuleContext) predicate.Def {
+	def := predicate.Def{
 		Operators: predicate.Operators{
 			AND: predicate.And,
 			OR:  predicate.Or,
 			NOT: predicate.Not,
+			EQ:  predicate.Equals,
+			NEQ: func(a any, b any) predicate.BoolPredicate {
+				return func() bool {
+					return !predicate.Equals(a, b)()
+				}
+			},
 		},
 		Functions: map[string]interface{}{
 			"equals":       predicate.Equals,
 			"contains":     predicate.Contains,
+			"contains_all": predicateContainsAll,
+			"contains_any": predicateContainsAny,
+			"set": func(a ...any) []string {
+				aVal := make([]string, 0, len(a))
+				for _, v := range a {
+					if str, ok := v.(string); ok {
+						aVal = append(aVal, str)
+					}
+				}
+				return aVal
+			},
 			"all_end_with": predicateAllEndWith,
 			"all_equal":    predicateAllEqual,
 			"is_subset":    predicateIsSubset,
@@ -192,7 +211,69 @@ func NewWhereParser(ctx RuleContext) (predicate.Parser, error) {
 		},
 		GetIdentifier: ctx.GetIdentifier,
 		GetProperty:   GetStringMapValue,
-	})
+	}
+	return def
+}
+
+// WhereParserOpt is a function that modifies the default
+// predicate.Def used to create a parser for the `where` section in access rules.
+type WhereParserOpt func(RuleContext, *predicate.Def)
+
+// WithCanViewFunction adds a can_view function to the parser definition.
+// This function will be used to check if the user has access to the resource
+// specified in the context.
+func WithCanViewFunction() WhereParserOpt {
+	return func(ctx RuleContext, def *predicate.Def) {
+		def.Functions["can_view"] = CanViewResourceFunc(ctx)
+	}
+}
+
+// ConditionalOption applies the specified option if the condition is true.
+// Otherwise, the returned option is a no-op.
+func ConditionalOption(condition bool, option WhereParserOpt) WhereParserOpt {
+	return func(ctx RuleContext, def *predicate.Def) {
+		if condition {
+			option(ctx, def)
+		}
+	}
+}
+
+// NewWhereParser returns standard parser for `where` section in access rules.
+func NewWhereParser(ctx RuleContext, opts ...WhereParserOpt) (predicate.Parser, error) {
+	def := newDefaultWhereParserDef(ctx)
+	for _, opt := range opts {
+		opt(ctx, &def)
+	}
+	return predicate.NewParser(def)
+}
+
+// CanViewResourceFunc returns a function that checks if the user has access
+// to the resource specified in the context.
+func CanViewResourceFunc(ctx RuleContext) func() predicate.BoolPredicate {
+	return func() predicate.BoolPredicate {
+		return func() bool {
+			resource, err := ctx.GetResource()
+			if err != nil {
+				return false
+			}
+			accessCheckableResource, ok := resource.(AccessCheckable)
+			if !ok {
+				return false
+			}
+
+			checker, err := ctx.GetAccessChecker()
+			if err != nil {
+				return false
+			}
+
+			// We do not enforce MFA or Device Trust for this check because
+			// we don't have a way of checking it from the context.
+			return checker.CheckAccess(accessCheckableResource, AccessState{
+				MFARequired: MFARequiredNever,
+				MFAVerified: true,
+			}) == nil
+		}
+	}
 }
 
 // GetStringMapValue is a helper function that returns property
@@ -303,6 +384,9 @@ type Context struct {
 	HostCert *HostCertContext
 	// SessionTracker is an optional session tracker, in case if the rule checks access to the tracker.
 	SessionTracker types.SessionTracker
+	// AccessChecker is an optional access checker that can be used
+	// to check access to other resources.
+	AccessChecker AccessChecker
 }
 
 // String returns user friendly representation of this context
@@ -317,8 +401,6 @@ const (
 	ResourceIdentifier = "resource"
 	// ResourceLabelsIdentifier refers to the static and dynamic labels in a resource.
 	ResourceLabelsIdentifier = "labels"
-	// ResourceHealthIdentifier refers to the resource's endpoint target health.
-	ResourceHealthIdentifier = "health"
 	// ResourceNameIdentifier refers to two different fields depending on the kind of resource:
 	//   - KindNode will refer to its resource.spec.hostname field
 	//   - All other kinds will refer to its resource.metadata.name field
@@ -356,6 +438,13 @@ func (ctx *Context) GetResource() (types.Resource, error) {
 	}
 }
 
+func (ctx *Context) GetAccessChecker() (AccessChecker, error) {
+	if ctx.AccessChecker == nil {
+		return nil, trace.NotFound("access checker is not set in the context")
+	}
+	return ctx.AccessChecker, nil
+}
+
 // GetIdentifier returns identifier defined in a context
 func (ctx *Context) GetIdentifier(fields []string) (interface{}, error) {
 	switch fields[0] {
@@ -384,10 +473,23 @@ func (ctx *Context) GetIdentifier(fields []string) (interface{}, error) {
 	case SessionIdentifier:
 		var session events.AuditEvent = &events.SessionEnd{}
 		switch ctx.Session.(type) {
-		case *events.SessionEnd, *events.WindowsDesktopSessionEnd:
+		case *events.SessionEnd, *events.WindowsDesktopSessionEnd, *events.DatabaseSessionEnd:
 			session = ctx.Session
 		}
-		return predicate.GetFieldByTag(session, teleport.JSON, fields[1:])
+		v, origErr := predicate.GetFieldByTag(session, teleport.JSON, fields[1:])
+		if trace.IsNotFound(origErr) {
+			// Special case: session is a special resource because
+			// it's backed by different object kinds (events.SessionEnd,
+			// events.WindowsDesktopSessionEnd, events.DatabaseSessionEnd)
+			// and these objects have different schemas, so it's possible that
+			// the parser can't find a field mentioned in the "where" clause.
+			// In this case, we try to find the field in all supported
+			// session end events and return the value if found.
+			if v, err := getMissingEmptyFieldForSessionEnd(fields); err == nil {
+				return v, nil
+			}
+		}
+		return v, trace.Wrap(origErr)
 	case SSHSessionIdentifier:
 		// Do not expose the original session.Session, instead transform it into a
 		// ctxSession so the exposed fields match our desired API.
@@ -427,6 +529,16 @@ func (ctx *Context) GetIdentifier(fields []string) (interface{}, error) {
 	}
 }
 
+func getMissingEmptyFieldForSessionEnd(fields []string) (any, error) {
+	for _, emptySession := range []events.AuditEvent{&events.SessionEnd{}, &events.WindowsDesktopSessionEnd{}, &events.DatabaseSessionEnd{}} {
+		v, err := predicate.GetFieldByTag(emptySession, teleport.JSON, fields[1:])
+		if err == nil {
+			return v, nil
+		}
+	}
+	return nil, trace.NotFound("field %q is not found in any supported session end event", strings.Join(fields, "."))
+}
+
 // ctxSession represents the public contract of a session.Session, as exposed
 // to a Context rule.
 // See RFD 82: https://github.com/gravitational/teleport/blob/master/rfd/0082-session-tracker-resource-rbac.md
@@ -453,7 +565,14 @@ func toCtxTracker(t types.SessionTracker) ctxTracker {
 		participants := s.GetParticipants()
 		names := make([]string, len(participants))
 		for i, participant := range participants {
-			names[i] = participant.User
+			// Participant for RBAC must be represented as `remote-{user}-{cluster}`.
+			// if they belong to a different cluster. This is because the user
+			// is also named like that when they authenticate.
+			names[i] = UsernameForCluster(UsernameForClusterConfig{
+				User:              participant.User,
+				OriginClusterName: participant.Cluster,
+				LocalClusterName:  s.GetClusterName(),
+			})
 		}
 
 		return names
@@ -693,6 +812,30 @@ func newParserForIdentifierSubcondition(ctx RuleContext, identifier string) (pre
 				}
 				return types.WhereExpr{Not: &expr}
 			},
+			EQ: func(a, b any) types.WhereExpr {
+				aExpr, ok := a.(types.WhereExpr)
+				if !ok {
+					aExpr = types.WhereExpr{Literal: a}
+				}
+				bExpr, ok := b.(types.WhereExpr)
+				if !ok {
+					bExpr = types.WhereExpr{Literal: b}
+				}
+				return types.WhereExpr{Equals: types.WhereExpr2{L: &aExpr, R: &bExpr}}
+			},
+			NEQ: func(a, b any) types.WhereExpr {
+				aExpr, ok := a.(types.WhereExpr)
+				if !ok {
+					aExpr = types.WhereExpr{Literal: a}
+				}
+				bExpr, ok := b.(types.WhereExpr)
+				if !ok {
+					bExpr = types.WhereExpr{Literal: b}
+				}
+				return types.WhereExpr{
+					Not: &types.WhereExpr{Equals: types.WhereExpr2{L: &aExpr, R: &bExpr}},
+				}
+			},
 		},
 		Functions: map[string]interface{}{
 			"equals": binaryPred(predicate.Equals, func(a, b types.WhereExpr) types.WhereExpr {
@@ -701,6 +844,24 @@ func newParserForIdentifierSubcondition(ctx RuleContext, identifier string) (pre
 			"contains": binaryPred(predicate.Contains, func(a, b types.WhereExpr) types.WhereExpr {
 				return types.WhereExpr{Contains: types.WhereExpr2{L: &a, R: &b}}
 			}),
+			"contains_all": binaryPred(predicateContainsAll, func(a, b types.WhereExpr) types.WhereExpr {
+				return types.WhereExpr{ContainsAll: types.WhereExpr2{L: &a, R: &b}}
+			}),
+			"contains_any": binaryPred(predicateContainsAny, func(a, b types.WhereExpr) types.WhereExpr {
+				return types.WhereExpr{ContainsAny: types.WhereExpr2{L: &a, R: &b}}
+			}),
+			"set": func(a ...any) types.WhereExpr {
+				aVal := make([]string, 0, len(a))
+				for _, v := range a {
+					if str, ok := v.(string); ok {
+						aVal = append(aVal, str)
+					}
+				}
+				return types.WhereExpr{Literal: aVal}
+			},
+			"can_view": func() types.WhereExpr {
+				return types.WhereExpr{CanView: &types.WhereNoExpr{}}
+			},
 		},
 		GetIdentifier: func(fields []string) (interface{}, error) {
 			if fields[0] == identifier {
@@ -723,6 +884,14 @@ func newParserForIdentifierSubcondition(ctx RuleContext, identifier string) (pre
 			if !keyOK {
 				keyExpr = types.WhereExpr{Literal: keyVal}
 			}
+			if mapExpr.Field != "" && keyExpr.Literal != nil {
+				return types.WhereExpr{
+					MapRef: &types.WhereExpr2{
+						L: &mapExpr,
+						R: &keyExpr,
+					},
+				}, nil
+			}
 			if mapExpr.Literal == nil || keyExpr.Literal == nil {
 				// TODO: Add support for general WhereExpr.
 				return nil, trace.BadParameter("GetProperty is implemented only for literals")
@@ -732,6 +901,63 @@ func newParserForIdentifierSubcondition(ctx RuleContext, identifier string) (pre
 	})
 }
 
+// predicateContainsAll is a custom function to test if all entries in a []string
+// are contained in another []string. Order does not matter, but all entries
+// in the second slice must be present in the first slice.
+func predicateContainsAll(a, b any) predicate.BoolPredicate {
+	return func() bool {
+		aval, ok := a.([]string)
+		if !ok {
+			return false
+		}
+		bval, ok := b.([]string)
+		if !ok {
+			return false
+		}
+
+		if len(aval) == 0 || len(bval) == 0 {
+			return false
+		}
+		aSet := make(map[string]struct{}, len(aval))
+		for _, v := range aval {
+			aSet[v] = struct{}{}
+		}
+		for _, v := range bval {
+			if _, ok := aSet[v]; !ok {
+				return false
+			}
+		}
+		return true
+	}
+}
+
+// predicateContainsAny is a custom function to test if any entry in a []string
+func predicateContainsAny(a, b any) predicate.BoolPredicate {
+	return func() bool {
+		aval, ok := a.([]string)
+		if !ok {
+			return false
+		}
+		bval, ok := b.([]string)
+		if !ok {
+			return false
+		}
+		if len(aval) == 0 || len(bval) == 0 {
+			return false
+		}
+		aSet := make(map[string]struct{}, len(aval))
+		for _, v := range aval {
+			aSet[v] = struct{}{}
+		}
+		for _, v := range bval {
+			if _, ok := aSet[v]; ok {
+				return true
+			}
+		}
+		return false
+	}
+}
+
 // NewResourceExpression returns a [typical.Expression] that is to be evaluated against a
 // [types.ResourceWithLabels]. It is customized to allow short identifiers common in all
 // resources:
@@ -765,6 +991,12 @@ func NewResourceExpression(expression string) (typical.Expression[types.Resource
 
 				return r.GetName(), nil
 			}),
+			"health.status": typical.DynamicVariable(func(r types.ResourceWithLabels) (string, error) {
+				if r, ok := r.(types.TargetHealthStatusGetter); ok {
+					return string(r.GetTargetHealthStatus()), nil
+				}
+				return "", nil
+			}),
 		},
 		Functions: map[string]typical.Function{
 			"hasPrefix": typical.BinaryFunction[types.ResourceWithLabels](func(s, suffix string) (bool, error) {
@@ -787,19 +1019,10 @@ func NewResourceExpression(expression string) (typical.Expression[types.Resource
 			}),
 		},
 		GetUnknownIdentifier: func(env types.ResourceWithLabels, fields []string) (any, error) {
-			switch fields[0] {
-			case ResourceIdentifier:
+			if fields[0] == ResourceIdentifier {
 				if f, err := predicate.GetFieldByTag(env, teleport.JSON, fields[1:]); err == nil {
 					return f, nil
 				}
-			case ResourceHealthIdentifier:
-				var resourceHealth types.TargetHealth
-				if h, ok := env.(types.TargetHealthGetter); ok {
-					resourceHealth = h.GetTargetHealth()
-				}
-				if f, err := predicate.GetFieldByTag(resourceHealth, teleport.JSON, fields[1:]); err == nil {
-					return f, nil
-				}
 			}
 
 			identifier := strings.Join(fields, ".")
diff --git a/lib/services/parser_test.go b/lib/services/parser_test.go
index 5fb17af8f9eb5..6c2feead18c80 100644
--- a/lib/services/parser_test.go
+++ b/lib/services/parser_test.go
@@ -19,13 +19,18 @@
 package services
 
 import (
+	"fmt"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"github.com/vulcand/predicate"
 
+	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -33,6 +38,9 @@ func TestParserForIdentifierSubcondition(t *testing.T) {
 	t.Parallel()
 	user, err := types.NewUser("test-user")
 	require.NoError(t, err)
+	user.SetTraits(map[string][]string{
+		"test": {"value1", "value2"},
+	})
 	testCase := func(cond string, expected types.WhereExpr) func(*testing.T) {
 		return func(t *testing.T) {
 			parser, err := newParserForIdentifierSubcondition(&Context{User: user}, SessionIdentifier)
@@ -431,6 +439,7 @@ func TestParserHostCertContext(t *testing.T) {
 				`all_equal(host_cert.principals, "foo.example.com")`,
 				`is_subset(host_cert.principals, "a", "b", "foo.example.com")`,
 				`all_end_with(host_cert.principals, ".example.com")`,
+				`contains_any(set("a", "b", "foo.example.com"), host_cert.principals)`,
 			},
 			negative: []string{
 				`all_equal(host_cert.principals, "foo")`,
@@ -494,3 +503,420 @@ func TestParserHostCertContext(t *testing.T) {
 		})
 	}
 }
+
+func TestPredicateContainsAll(t *testing.T) {
+	tests := []struct {
+		name string
+		a    []string
+		b    []string
+		want bool
+	}{
+		{
+			name: "both empty",
+			a:    []string{},
+			b:    []string{},
+			want: false,
+		},
+		{
+			name: "a empty, b not",
+			a:    []string{},
+			b:    []string{"a"},
+			want: false,
+		},
+		{
+			name: "a not empty, b empty",
+			a:    []string{"a"},
+			b:    []string{},
+			want: false,
+		},
+		{
+			name: "a contains b",
+			a:    []string{"a", "b", "c"},
+			b:    []string{"a", "c"},
+			want: true,
+		},
+		{
+			name: "a does not contain b",
+			a:    []string{"a", "b", "c"},
+			b:    []string{"a", "d"},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := predicateContainsAll(tt.a, tt.b)
+			require.Equal(t, tt.want, got())
+		})
+	}
+}
+
+func TestPredicateContainsAny(t *testing.T) {
+	tests := []struct {
+		name string
+		a    []string
+		b    []string
+		want bool
+	}{
+		{
+			name: "both empty",
+			a:    []string{},
+			b:    []string{},
+			want: false,
+		},
+		{
+			name: "a empty, b not",
+			a:    []string{},
+			b:    []string{"a"},
+			want: false,
+		},
+		{
+			name: "a not empty, b empty",
+			a:    []string{"a"},
+			b:    []string{},
+			want: false, // no elements in b to be contained in a
+		},
+		{
+			name: "a contains b",
+			a:    []string{"a", "b", "c"},
+			b:    []string{"a", "c"},
+			want: true,
+		},
+		{
+			name: "a does not contain b",
+			a:    []string{"a", "b", "c"},
+			b:    []string{"d", "e"},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := predicateContainsAny(tt.a, tt.b)
+			require.Equal(t, tt.want, got())
+		})
+	}
+}
+
+func TestCanView(t *testing.T) {
+	newRole := func(mut func(*types.RoleV6)) *types.RoleV6 {
+		r := newRole(mut)
+		r.Spec.Allow.Rules = append(r.Spec.Allow.Rules, types.Rule{
+			Resources: []string{types.KindSession},
+			Verbs:     []string{types.VerbRead, types.VerbList},
+			Where:     "can_view()",
+		})
+		r.CheckAndSetDefaults()
+		return r
+	}
+
+	user, err := types.NewUser("test-user")
+	require.NoError(t, err)
+	type check struct {
+		server    types.Server
+		hasAccess bool
+	}
+	serverNoLabels := &types.ServerV2{
+		Kind: types.KindNode,
+		Metadata: types.Metadata{
+			Name: "a",
+		},
+	}
+	serverWorker := &types.ServerV2{
+		Kind: types.KindNode,
+		Metadata: types.Metadata{
+			Name:      "b",
+			Namespace: apidefaults.Namespace,
+			Labels:    map[string]string{"role": "worker", "status": "follower"},
+		},
+	}
+	namespaceC := "namespace-c"
+	serverDB := &types.ServerV2{
+		Kind: types.KindNode,
+		Metadata: types.Metadata{
+			Name:      "c",
+			Namespace: namespaceC,
+			Labels:    map[string]string{"role": "db", "status": "follower"},
+		},
+	}
+	serverDBWithSuffix := &types.ServerV2{
+		Kind: types.KindNode,
+		Metadata: types.Metadata{
+			Name:      "c2",
+			Namespace: namespaceC,
+			Labels:    map[string]string{"role": "db01", "status": "follower01"},
+		},
+	}
+	testCases := []struct {
+		name   string
+		roles  []*types.RoleV6
+		checks []check
+	}{
+		{
+			name:  "empty role set has access to nothing",
+			roles: []*types.RoleV6{},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: false},
+				{server: serverDB, hasAccess: false},
+			},
+		},
+		{
+			name: "role is limited to labels in default namespace",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"admin"}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{"worker"}}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: false},
+			},
+		},
+		{
+			name: "role matches any label out of multiple labels",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"admin"}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{"worker2", "worker"}}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: false},
+			},
+		},
+		{
+			name: "node_labels with empty list value matches nothing",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"admin"}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{}}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: false},
+				{server: serverDB, hasAccess: false},
+			},
+		},
+		{
+			name: "one role is more permissive than another",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"admin"}
+					r.Spec.Allow.Namespaces = []string{apidefaults.Namespace}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{"worker"}}
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"root", "admin"}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: true},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: true},
+			},
+		},
+		{
+			name: "one role needs to access servers sharing the partially same label value",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"admin"}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{"^db(.*)$"}, "status": []string{"follow*"}}
+					r.Spec.Allow.Namespaces = []string{namespaceC}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: false},
+				{server: serverDB, hasAccess: true},
+				{server: serverDBWithSuffix, hasAccess: true},
+			},
+		},
+		{
+			name: "no logins means  access",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = nil
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: true},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: true},
+			},
+		},
+		// MFA.
+		{
+			name: "one role requires MFA but MFA was not verified",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"root"}
+					r.Spec.Allow.NodeLabels = types.Labels{"role": []string{"worker"}}
+					r.Spec.Options.RequireMFAType = types.RequireMFAType_SESSION
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"root"}
+					r.Spec.Options.RequireMFAType = types.RequireMFAType_OFF
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: true},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: true},
+			},
+		},
+
+		// Device Trust.
+		{
+			name: "role requires trusted device, device not verified",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.Logins = []string{"root"}
+					r.Spec.Options.DeviceTrustMode = constants.DeviceTrustModeRequired
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: true},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: true},
+			},
+		},
+		{
+			name: "label expressions",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.NodeLabels = nil
+					r.Spec.Allow.NodeLabelsExpression = `labels.role == "worker" && labels.status == "follower"`
+					r.Spec.Allow.Logins = []string{"root"}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, hasAccess: false},
+				{server: serverWorker, hasAccess: true},
+				{server: serverDB, hasAccess: false},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			accessChecker := makeAccessCheckerWithRolePointers(tc.roles)
+			for j, check := range tc.checks {
+				comment := fmt.Sprintf("check #%v:  server: %v, should access: %v", j, check.server.GetName(), check.hasAccess)
+				serviceCtx := &Context{
+					User:          user,
+					AccessChecker: accessChecker,
+					Resource:      check.server,
+				}
+				err := accessChecker.CheckAccessToRule(
+					serviceCtx,
+					check.server.GetNamespace(),
+					types.KindSession,
+					types.VerbRead,
+				)
+				if check.hasAccess {
+					require.NoError(t, err, comment)
+				} else {
+					require.True(t, trace.IsAccessDenied(err), "Got err = %v/%T, wanted AccessDenied. %v", err, err, comment)
+				}
+			}
+		})
+	}
+}
+
+func TestSessionTrackerRBAC(t *testing.T) {
+	t.Parallel()
+	localCluster := "local-cluster"
+	remoteCluster := "remote-cluster"
+	tracker, err := types.NewSessionTracker(types.SessionTrackerSpecV1{
+		SessionID:   uuid.NewString(),
+		Kind:        types.KindSSHSession,
+		Hostname:    "hostname",
+		ClusterName: localCluster,
+		Login:       "root",
+		Participants: []types.Participant{
+			{
+				ID:      uuid.New().String(),
+				User:    "eve",
+				Cluster: localCluster,
+				Mode:    string(types.SessionPeerMode),
+			},
+			{
+				ID:      uuid.New().String(),
+				User:    "alice",
+				Cluster: remoteCluster,
+				Mode:    string(types.SessionObserverMode),
+			},
+			{
+				ID:      uuid.New().String(),
+				User:    "bob",
+				Cluster: localCluster,
+				Mode:    string(types.SessionObserverMode),
+			},
+		},
+		Expires: time.Now().UTC().Add(24 * time.Hour),
+	})
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name        string
+		username    string
+		userCluster string
+		checkAccess require.BoolAssertionFunc
+	}{
+		{
+			name:        "same user and same cluster as peer participant",
+			username:    "eve",
+			userCluster: localCluster,
+			checkAccess: require.True,
+		},
+		{
+			name:        "same user but different cluster as peer participant",
+			username:    "eve",
+			userCluster: remoteCluster,
+			checkAccess: require.False,
+		},
+		{
+			name:        "different user but same cluster as peer participant",
+			username:    "alice",
+			userCluster: localCluster,
+			checkAccess: require.False,
+		},
+		{
+			name:        "observer participant, same cluster",
+			username:    "bob",
+			userCluster: localCluster,
+			checkAccess: require.True,
+		},
+		{
+			name:        "not a participant, same cluster",
+			username:    "mallory",
+			userCluster: localCluster,
+			checkAccess: require.False,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			user, err := types.NewUser(UsernameForCluster(UsernameForClusterConfig{
+				User:              tc.username,
+				LocalClusterName:  localCluster,
+				OriginClusterName: tc.userCluster,
+			}))
+			require.NoError(t, err)
+			ctx := &Context{
+				User:           user,
+				SessionTracker: tracker,
+			}
+			parser, err := NewWhereParser(ctx)
+			require.NoError(t, err)
+			expr, err := parser.Parse("contains(session_tracker.participants, user.metadata.name)")
+			require.NoError(t, err)
+			pred, ok := expr.(predicate.BoolPredicate)
+			require.True(t, ok)
+			tc.checkAccess(t, pred())
+		})
+	}
+}
diff --git a/lib/services/plugins.go b/lib/services/plugins.go
index c0a350e773bb9..571761925c506 100644
--- a/lib/services/plugins.go
+++ b/lib/services/plugins.go
@@ -22,7 +22,7 @@ import (
 	"bytes"
 	"context"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
diff --git a/lib/services/presence.go b/lib/services/presence.go
index 9a62b5a063e24..78937247e5c0a 100644
--- a/lib/services/presence.go
+++ b/lib/services/presence.go
@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 )
@@ -30,7 +31,13 @@ import (
 // ProxyGetter is a service that gets proxies.
 type ProxyGetter interface {
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+	// ListProxyServers returns a paginated list of registered Proxy servers.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
 }
 
 // NodesGetter is a service that gets nodes.
@@ -82,8 +89,15 @@ type Presence interface {
 	UpsertNode(ctx context.Context, server types.Server) (*types.KeepAlive, error)
 
 	// GetAuthServers returns a list of registered servers
+	//
+	// Deprecated: Prefer paginated variant [ListAuthServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetAuthServers() ([]types.Server, error)
 
+	// ListAuthServers returns a paginated list of registered auth servers.
+	ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+
 	// UpsertAuthServer registers auth server presence, permanently if ttl is 0 or
 	// for the specified duration with second resolution if it's >= 1 second
 	UpsertAuthServer(ctx context.Context, server types.Server) error
@@ -175,6 +189,13 @@ type Presence interface {
 	// DeleteAllWindowsDesktopServices removes all Windows desktop services.
 	DeleteAllWindowsDesktopServices(context.Context) error
 
+	// GetRelayServer returns the relay server heartbeat with a given name.
+	GetRelayServer(ctx context.Context, name string) (*presencev1.RelayServer, error)
+	// ListRelayServers returns a paginated list of relay server heartbeats.
+	ListRelayServers(ctx context.Context, pageSize int, pageToken string) (_ []*presencev1.RelayServer, nextPageToken string, _ error)
+	// DeleteRelayServer deletes a relay server heartbeat by name.
+	DeleteRelayServer(ctx context.Context, name string) error
+
 	// ListResources returns a paginated list of resources.
 	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
 }
@@ -187,4 +208,7 @@ type PresenceInternal interface {
 	UpsertHostUserInteractionTime(ctx context.Context, name string, loginTime time.Time) error
 	GetHostUserInteractionTime(ctx context.Context, name string) (time.Time, error)
 	UpdateNode(ctx context.Context, server types.Server) (types.Server, error)
+
+	// UpsertRelayServer creates or updates a relay server heartbeat, unconditionally.
+	UpsertRelayServer(ctx context.Context, relayServer *presencev1.RelayServer) (*presencev1.RelayServer, error)
 }
diff --git a/lib/services/presets.go b/lib/services/presets.go
index 902dc29714301..3b882954579dc 100644
--- a/lib/services/presets.go
+++ b/lib/services/presets.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/modules"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -212,12 +213,20 @@ func NewPresetEditorRole() types.Role {
 					types.NewRule(types.KindAutoUpdateVersion, RW()),
 					types.NewRule(types.KindAutoUpdateConfig, RW()),
 					types.NewRule(types.KindAutoUpdateAgentRollout, RO()),
+					types.NewRule(types.KindAutoUpdateBotInstanceReport, RO()),
 					types.NewRule(types.KindGitServer, RW()),
 					types.NewRule(types.KindWorkloadIdentityX509Revocation, RW()),
 					types.NewRule(types.KindHealthCheckConfig, RW()),
 					types.NewRule(types.KindSigstorePolicy, RW()),
 					types.NewRule(types.KindWorkloadIdentityX509IssuerOverride, RW()),
 					types.NewRule(types.KindWorkloadIdentityX509IssuerOverrideCSR, RW()),
+					types.NewRule(types.KindInferenceModel, RW()),
+					types.NewRule(types.KindInferenceSecret, RW()),
+					types.NewRule(types.KindInferencePolicy, RW()),
+					types.NewRule(types.KindClientIPRestriction, RW()),
+					types.NewRule(scopedaccess.KindScopedRole, RW()),
+					types.NewRule(scopedaccess.KindScopedRoleAssignment, RW()),
+					types.NewRule(types.KindScopedToken, RW()),
 				},
 			},
 		},
@@ -300,6 +309,9 @@ func NewPresetAccessRole() types.Role {
 					types.NewRule(types.KindInstance, RO()),
 					types.NewRule(types.KindClusterMaintenanceConfig, RO()),
 				},
+				MCP: &types.MCPPermissions{
+					Tools: []string{teleport.TraitInternalMCPTools},
+				},
 			},
 		},
 	}
@@ -590,6 +602,77 @@ func NewPresetWildcardWorkloadIdentityIssuerRole() types.Role {
 	return role
 }
 
+// NewPresetAccessPluginRole returns a new pre-defined role for self-hosted
+// access request plugins.
+func NewPresetAccessPluginRole() types.Role {
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V7,
+		Metadata: types.Metadata{
+			Name:        teleport.PresetAccessPluginRoleName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Default access plugin role",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Rules: []types.Rule{
+					types.NewRule(types.KindAccessRequest, RO()),
+					types.NewRule(types.KindAccessPluginData, RW()),
+					types.NewRule(types.KindAccessMonitoringRule, RO()),
+					types.NewRule(types.KindAccessList, RO()),
+					types.NewRule(types.KindRole, RO()),
+					types.NewRule(types.KindUser, RO()),
+					types.NewRule(types.KindUserLoginState, RO()),
+				},
+				ReviewRequests: &types.AccessReviewConditions{
+					PreviewAsRoles: []string{
+						teleport.PresetListAccessRequestResourcesRoleName,
+					},
+				},
+			},
+		},
+	}
+	return role
+}
+
+// NewPresetListAccessRequestResourcesRole returns a new pre-defined role that
+// allows reading access request resources.
+func NewPresetListAccessRequestResourcesRole() types.Role {
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V7,
+		Metadata: types.Metadata{
+			Name:        teleport.PresetListAccessRequestResourcesRoleName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Default list access request resources role",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Rules: []types.Rule{
+					types.NewRule(types.KindNode, RO()),
+					types.NewRule(types.KindApp, RO()),
+					types.NewRule(types.KindDatabase, RO()),
+					types.NewRule(types.KindKubernetesCluster, RO()),
+				},
+				// To enable all access plugin features, the role requires read
+				// access to all of the following resources.
+				AppLabels:        types.Labels{types.Wildcard: []string{types.Wildcard}},
+				DatabaseLabels:   types.Labels{types.Wildcard: []string{types.Wildcard}},
+				GroupLabels:      types.Labels{types.Wildcard: []string{types.Wildcard}},
+				KubernetesLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+				NodeLabels:       types.Labels{types.Wildcard: []string{types.Wildcard}},
+			},
+		},
+	}
+	return role
+}
+
 // SystemOktaAccessRoleName is the name of the system role that allows
 // access to Okta resources. This will be used by the Okta requester role to
 // search for Okta resources.
@@ -721,6 +804,7 @@ func NewPresetTerraformProviderRole() types.Role {
 					types.NewRule(types.KindClusterNetworkingConfig, RW()),
 					types.NewRule(types.KindDatabase, RW()),
 					types.NewRule(types.KindDevice, RW()),
+					types.NewRule(types.KindDiscoveryConfig, RW()),
 					types.NewRule(types.KindGithub, RW()),
 					types.NewRule(types.KindLoginRule, RW()),
 					types.NewRule(types.KindNode, RW()),
@@ -742,6 +826,7 @@ func NewPresetTerraformProviderRole() types.Role {
 					types.NewRule(types.KindAutoUpdateConfig, RW()),
 					types.NewRule(types.KindAutoUpdateVersion, RW()),
 					types.NewRule(types.KindHealthCheckConfig, RW()),
+					types.NewRule(types.KindIntegration, RW()),
 				},
 			},
 		},
@@ -749,20 +834,48 @@ func NewPresetTerraformProviderRole() types.Role {
 	return role
 }
 
-// NewPresetHealthCheckConfig returns a preset default health_check_config that
-// enables health checks for all resources.
-func NewPresetHealthCheckConfig() *healthcheckconfigv1.HealthCheckConfig {
-	return &healthcheckconfigv1.HealthCheckConfig{
-		Kind:    types.KindHealthCheckConfig,
-		Version: types.V1,
-		Metadata: &headerv1.Metadata{
-			Name:        teleport.PresetDefaultHealthCheckConfigName,
-			Description: "Enables all health checks by default",
+// NewPresetMCPUserRole returns a new pre-defined role for accessing MCP
+// servers.
+func NewPresetMCPUserRole() types.Role {
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V8,
+		Metadata: types.Metadata{
+			Name:        teleport.PresetMCPUserRoleName,
 			Namespace:   apidefaults.Namespace,
+			Description: "Access to MCP servers",
 			Labels: map[string]string{
 				types.TeleportInternalResourceType: types.PresetResource,
 			},
 		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				AppLabels: map[string]apiutils.Strings{
+					types.AppSubKindLabel: []string{types.SubKindMCP},
+				},
+				MCP: &types.MCPPermissions{
+					Tools: []string{types.Wildcard},
+				},
+			},
+		},
+	}
+	return role
+}
+
+// VirtualDefaultHealthCheckConfigDB returns a health_check_config enabling
+// health checks for all databases resources, and is intended to be used as a
+// virtual default resource. Its name is "default" for historical reasons.
+func VirtualDefaultHealthCheckConfigDB() *healthcheckconfigv1.HealthCheckConfig {
+	return &healthcheckconfigv1.HealthCheckConfig{
+		Kind:    types.KindHealthCheckConfig,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name:        teleport.VirtualDefaultHealthCheckConfigDBName,
+			Description: "Enables health checks for all databases by default",
+			// this revision MUST be changed every time we change the contents
+			// of the preset so that conditional updates can check against it
+			Revision: "af391615-1e42-4237-aa2b-155e6abbd41a",
+		},
 		Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
 			Match: &healthcheckconfigv1.Matcher{
 				// match all databases
@@ -775,6 +888,32 @@ func NewPresetHealthCheckConfig() *healthcheckconfigv1.HealthCheckConfig {
 	}
 }
 
+// VirtualDefaultHealthCheckConfigKube returns a health_check_config enabling
+// health checks for all Kubernetes resources. It's intended to be used as a
+// virtual default resource.
+func VirtualDefaultHealthCheckConfigKube() *healthcheckconfigv1.HealthCheckConfig {
+	return &healthcheckconfigv1.HealthCheckConfig{
+		Kind:    types.KindHealthCheckConfig,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name:        teleport.VirtualDefaultHealthCheckConfigKubeName,
+			Description: "Enables health checks for all Kubernetes clusters by default.",
+			// this revision MUST be changed every time we change the contents
+			// of the preset so that conditional updates can check against it
+			Revision: "d796f007-e60c-4747-8dde-f479aff6b743",
+		},
+		Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
+			Match: &healthcheckconfigv1.Matcher{
+				// match all kubernetes clusters
+				KubernetesLabels: []*labelv1.Label{{
+					Name:   types.Wildcard,
+					Values: []string{types.Wildcard},
+				}},
+			},
+		},
+	}
+}
+
 // bootstrapRoleMetadataLabels are metadata labels that will be applied to each role.
 // These are intended to add labels for older roles that didn't previously have them.
 func bootstrapRoleMetadataLabels() map[string]map[string]string {
@@ -797,16 +936,19 @@ func bootstrapRoleMetadataLabels() map[string]map[string]string {
 		teleport.SystemIdentityCenterAccessRoleName: {
 			types.TeleportInternalResourceType: types.SystemResource,
 		},
-		// Group access, reviewer and requester are intentionally not added here as there may be
-		// existing customer defined roles that have these labels.
+		// These roles are intentionally not added here as there may be existing
+		// customer defined roles that have these labels:
+		// group-access, reviewer, requester, mcp-user
 	}
 }
 
 var defaultAllowRulesMap = map[string][]types.Rule{
-	teleport.PresetAuditorRoleName:           NewPresetAuditorRole().GetRules(types.Allow),
-	teleport.PresetEditorRoleName:            NewPresetEditorRole().GetRules(types.Allow),
-	teleport.PresetAccessRoleName:            NewPresetAccessRole().GetRules(types.Allow),
-	teleport.PresetTerraformProviderRoleName: NewPresetTerraformProviderRole().GetRules(types.Allow),
+	teleport.PresetAuditorRoleName:                    NewPresetAuditorRole().GetRules(types.Allow),
+	teleport.PresetEditorRoleName:                     NewPresetEditorRole().GetRules(types.Allow),
+	teleport.PresetAccessRoleName:                     NewPresetAccessRole().GetRules(types.Allow),
+	teleport.PresetTerraformProviderRoleName:          NewPresetTerraformProviderRole().GetRules(types.Allow),
+	teleport.PresetAccessPluginRoleName:               NewPresetAccessPluginRole().GetRules(types.Allow),
+	teleport.PresetListAccessRequestResourcesRoleName: NewPresetListAccessRequestResourcesRole().GetRules(types.Allow),
 }
 
 // defaultAllowRules has the Allow rules that should be set as default when
@@ -837,6 +979,13 @@ func defaultAllowLabels(enterprise bool) map[string]types.RoleConditions {
 			NodeLabels:           wildcardLabels,
 			WindowsDesktopLabels: wildcardLabels,
 		},
+		teleport.PresetListAccessRequestResourcesRoleName: {
+			AppLabels:        wildcardLabels,
+			DatabaseLabels:   wildcardLabels,
+			GroupLabels:      wildcardLabels,
+			KubernetesLabels: wildcardLabels,
+			NodeLabels:       wildcardLabels,
+		},
 	}
 
 	if enterprise {
@@ -951,7 +1100,7 @@ func AddRoleDefaults(ctx context.Context, role types.Role) (types.Role, error) {
 	// Check if the role has a TeleportInternalResourceType attached. We do this after setting the role metadata
 	// labels because we set the role metadata labels for roles that have been well established (access,
 	// editor, auditor) that may not already have this label set, but we don't set it for newer roles
-	// (group-access, reviewer, requester) that may have customer definitions.
+	// (group-access, reviewer, requester, mcp-user) that may have customer definitions.
 	resourceType := labels[types.TeleportInternalResourceType]
 	if resourceType != types.PresetResource && resourceType != types.SystemResource {
 		return nil, trace.AlreadyExists("not modifying user created role")
@@ -990,6 +1139,7 @@ func AddRoleDefaults(ctx context.Context, role types.Role) (types.Role, error) {
 			types.KindNode,
 			types.KindUserGroup,
 			types.KindWindowsDesktop,
+			types.KindKubernetesCluster,
 		} {
 			var labels types.Labels
 			switch kind {
@@ -1005,6 +1155,8 @@ func AddRoleDefaults(ctx context.Context, role types.Role) (types.Role, error) {
 				labels = defaultLabels.GroupLabels
 			case types.KindWindowsDesktop:
 				labels = defaultLabels.WindowsDesktopLabels
+			case types.KindKubernetesCluster:
+				labels = defaultLabels.KubernetesLabels
 			}
 			labelsUpdated, err := updateAllowLabels(role, kind, labels)
 			if err != nil {
@@ -1044,6 +1196,15 @@ func AddRoleDefaults(ctx context.Context, role types.Role) (types.Role, error) {
 		}
 	}
 
+	if role.GetMCPPermissions(types.Allow) == nil {
+		if mcpTools := defaultMCPTools()[role.GetName()]; len(mcpTools) > 0 {
+			role.SetMCPPermissions(types.Allow, &types.MCPPermissions{
+				Tools: mcpTools,
+			})
+			changed = true
+		}
+	}
+
 	if !changed {
 		return nil, trace.AlreadyExists("no change")
 	}
@@ -1161,3 +1322,9 @@ func defaultGitHubOrgs() map[string][]string {
 		teleport.PresetAccessRoleName: []string{teleport.TraitInternalGitHubOrgs},
 	}
 }
+
+func defaultMCPTools() map[string][]string {
+	return map[string][]string{
+		teleport.PresetAccessRoleName: []string{teleport.TraitInternalMCPTools},
+	}
+}
diff --git a/lib/services/presets_test.go b/lib/services/presets_test.go
index a646ee72516c5..beb48ecd618b3 100644
--- a/lib/services/presets_test.go
+++ b/lib/services/presets_test.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestAddRoleDefaults(t *testing.T) {
@@ -144,6 +145,9 @@ func TestAddRoleDefaults(t *testing.T) {
 						GitHubPermissions: []types.GitHubPermission{{
 							Organizations: defaultGitHubOrgs()[teleport.PresetAccessRoleName],
 						}},
+						MCP: &types.MCPPermissions{
+							Tools: defaultMCPTools()[teleport.PresetAccessRoleName],
+						},
 					},
 				},
 			},
@@ -179,6 +183,9 @@ func TestAddRoleDefaults(t *testing.T) {
 						GitHubPermissions: []types.GitHubPermission{{
 							Organizations: defaultGitHubOrgs()[teleport.PresetAccessRoleName],
 						}},
+						MCP: &types.MCPPermissions{
+							Tools: defaultMCPTools()[teleport.PresetAccessRoleName],
+						},
 					},
 				},
 			},
@@ -197,6 +204,9 @@ func TestAddRoleDefaults(t *testing.T) {
 						GitHubPermissions: []types.GitHubPermission{{
 							Organizations: defaultGitHubOrgs()[teleport.PresetAccessRoleName],
 						}},
+						MCP: &types.MCPPermissions{
+							Tools: defaultMCPTools()[teleport.PresetAccessRoleName],
+						},
 					},
 				},
 			},
@@ -216,6 +226,9 @@ func TestAddRoleDefaults(t *testing.T) {
 						GitHubPermissions: []types.GitHubPermission{{
 							Organizations: defaultGitHubOrgs()[teleport.PresetAccessRoleName],
 						}},
+						MCP: &types.MCPPermissions{
+							Tools: defaultMCPTools()[teleport.PresetAccessRoleName],
+						},
 					},
 				},
 			},
@@ -742,6 +755,7 @@ func TestAddRoleDefaults(t *testing.T) {
 								Verbs: RW(),
 							},
 							// The missing resources got added as individual rules
+							types.NewRule(types.KindDiscoveryConfig, RW()),
 							types.NewRule(types.KindAccessMonitoringRule, RW()),
 							types.NewRule(types.KindDynamicWindowsDesktop, RW()),
 							types.NewRule(types.KindStaticHostUser, RW()),
@@ -750,7 +764,93 @@ func TestAddRoleDefaults(t *testing.T) {
 							types.NewRule(types.KindAutoUpdateConfig, RW()),
 							types.NewRule(types.KindAutoUpdateVersion, RW()),
 							types.NewRule(types.KindHealthCheckConfig, RW()),
+							types.NewRule(types.KindIntegration, RW()),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "access-plugin (default roles match preset rules)",
+			role: &types.RoleV6{
+				Kind:    types.KindRole,
+				Version: types.V8,
+				Metadata: types.Metadata{
+					Name:        teleport.PresetAccessPluginRoleName,
+					Namespace:   apidefaults.Namespace,
+					Description: "Default access plugin role",
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
+			expectedErr: require.NoError,
+			expected: &types.RoleV6{
+				Kind:    types.KindRole,
+				Version: types.V8,
+				Metadata: types.Metadata{
+					Name:        teleport.PresetAccessPluginRoleName,
+					Namespace:   apidefaults.Namespace,
+					Description: "Default access plugin role",
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						Rules: []types.Rule{
+							// The missing resources got added as individual rules
+							types.NewRule(types.KindAccessRequest, RO()),
+							types.NewRule(types.KindAccessPluginData, RW()),
+							types.NewRule(types.KindAccessMonitoringRule, RO()),
+							types.NewRule(types.KindAccessList, RO()),
+							types.NewRule(types.KindRole, RO()),
+							types.NewRule(types.KindUser, RO()),
+							types.NewRule(types.KindUserLoginState, RO()),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "list-access-request-resources (default roles match preset rules)",
+			role: &types.RoleV6{
+				Kind:    types.KindRole,
+				Version: types.V8,
+				Metadata: types.Metadata{
+					Name:        teleport.PresetListAccessRequestResourcesRoleName,
+					Namespace:   apidefaults.Namespace,
+					Description: "Default list access request resources role",
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
+			expectedErr: require.NoError,
+			expected: &types.RoleV6{
+				Kind:    types.KindRole,
+				Version: types.V8,
+				Metadata: types.Metadata{
+					Name:        teleport.PresetListAccessRequestResourcesRoleName,
+					Namespace:   apidefaults.Namespace,
+					Description: "Default list access request resources role",
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						Rules: []types.Rule{
+							types.NewRule(types.KindNode, RO()),
+							types.NewRule(types.KindApp, RO()),
+							types.NewRule(types.KindDatabase, RO()),
+							types.NewRule(types.KindKubernetesCluster, RO()),
 						},
+						AppLabels:        types.Labels{types.Wildcard: []string{types.Wildcard}},
+						DatabaseLabels:   types.Labels{types.Wildcard: []string{types.Wildcard}},
+						GroupLabels:      types.Labels{types.Wildcard: []string{types.Wildcard}},
+						KubernetesLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+						NodeLabels:       types.Labels{types.Wildcard: []string{types.Wildcard}},
 					},
 				},
 			},
@@ -760,7 +860,7 @@ func TestAddRoleDefaults(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			if test.enterprise {
-				modules.SetTestModules(t, &modules.TestModules{
+				modulestest.SetTestModules(t, modulestest.Modules{
 					TestBuildType: modules.BuildEnterprise,
 				})
 			}
diff --git a/lib/services/process.go b/lib/services/process.go
index fb6e6bee61795..a9e130ab6db2d 100644
--- a/lib/services/process.go
+++ b/lib/services/process.go
@@ -20,17 +20,6 @@ package services
 
 import "context"
 
-// ProcessReloadContext adds a flag to the context to indicate the Teleport
-// process is reloading.
-func ProcessReloadContext(parent context.Context) context.Context {
-	return addFlagToContext[processReloadFlag](parent)
-}
-
-// IsProcessReloading returns true if the Teleport process is reloading.
-func IsProcessReloading(ctx context.Context) bool {
-	return getFlagFromContext[processReloadFlag](ctx)
-}
-
 // ProcessForkedContext adds a flag to the context to indicate the Teleport
 // process has running forked child(ren).
 func ProcessForkedContext(parent context.Context) context.Context {
@@ -47,12 +36,6 @@ func HasProcessForked(ctx context.Context) bool {
 // should be deleted based on the process shutdown context.
 func ShouldDeleteServerHeartbeatsOnShutdown(ctx context.Context) bool {
 	switch {
-	// During a reload, deregistration of the old heartbeats by the old
-	// instance may race with the creation of the new heartbeats by the new
-	// instance. Thus skip deleting the heartbeats to prevent them from
-	// disappearing momentarily after the reload.
-	case IsProcessReloading(ctx):
-		return false
 	// A child process can be forked to upgrade the Teleport binary. The child
 	// will take over the heartbeats so do NOT delete them in that case. In
 	// worst case scenarios if the child fails to register new heartbeats, the
@@ -72,5 +55,4 @@ func getFlagFromContext[FlagType any](ctx context.Context) bool {
 	return ok
 }
 
-type processReloadFlag struct{}
 type processForkedFlag struct{}
diff --git a/lib/services/process_test.go b/lib/services/process_test.go
index 0f05aa7a6b230..4764b2d6d6525 100644
--- a/lib/services/process_test.go
+++ b/lib/services/process_test.go
@@ -31,8 +31,5 @@ func TestShouldDeleteServerHeartbeatsOnShutdown(t *testing.T) {
 
 	require.True(t, ShouldDeleteServerHeartbeatsOnShutdown(ctx))
 	require.True(t, ShouldDeleteServerHeartbeatsOnShutdown(context.WithValue(ctx, contextKey("key"), "value")))
-	require.False(t, ShouldDeleteServerHeartbeatsOnShutdown(ProcessReloadContext(ctx)))
 	require.False(t, ShouldDeleteServerHeartbeatsOnShutdown(ProcessForkedContext(ctx)))
-	require.False(t, ShouldDeleteServerHeartbeatsOnShutdown(ProcessReloadContext(ProcessForkedContext(ctx))))
-	require.False(t, ShouldDeleteServerHeartbeatsOnShutdown(context.WithValue(ProcessReloadContext(ctx), contextKey("key"), "value")))
 }
diff --git a/lib/services/provisioning.go b/lib/services/provisioning.go
index ea48c4cd93abb..839a946fd5f54 100644
--- a/lib/services/provisioning.go
+++ b/lib/services/provisioning.go
@@ -45,6 +45,8 @@ type Provisioner interface {
 	DeleteToken(ctx context.Context, token string) error
 
 	// GetTokens returns all non-expired tokens
+	// Deprecated: use [ListProvisionTokens] instead.
+	// TODO(hugoShaka): DELETE IN 19.0.0
 	GetTokens(ctx context.Context) ([]types.ProvisionToken, error)
 
 	// PatchToken performs a conditional update on the named token using
@@ -54,6 +56,9 @@ type Provisioner interface {
 		token string,
 		updateFn func(types.ProvisionToken) (types.ProvisionToken, error),
 	) (types.ProvisionToken, error)
+
+	// ListProvisionTokens retrieves a paginated list of provision tokens.
+	ListProvisionTokens(ctx context.Context, pageSize int, pageToken string, anyRoles types.SystemRoles, botName string) ([]types.ProvisionToken, string, error)
 }
 
 // MustCreateProvisionToken returns a new valid provision token
diff --git a/lib/services/provisioningstates.go b/lib/services/provisioningstates.go
index 0a141cc115f2f..67ad649ad0e8f 100644
--- a/lib/services/provisioningstates.go
+++ b/lib/services/provisioningstates.go
@@ -19,10 +19,7 @@ package services
 import (
 	"context"
 
-	"google.golang.org/protobuf/types/known/emptypb"
-
 	provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 // DownstreamID holds the configured ID of a downstream identity "receiver". For
@@ -48,7 +45,8 @@ type DownstreamProvisioningStates interface {
 
 	// ListProvisioningStates lists all provisioning state records for a given
 	// downstream receiver.
-	ListProvisioningStates(context.Context, DownstreamID, int, *pagination.PageRequestToken) ([]*provisioningv1.PrincipalState, pagination.NextPageToken, error)
+	ListProvisioningStates(context.Context, DownstreamID, int, string) ([]*provisioningv1.PrincipalState, string, error)
+	ListProvisioningStates2(context.Context, DownstreamID, int, string) ([]*provisioningv1.PrincipalState, string, error)
 
 	// Creates a new backend PrincipalState record. The target DownstreamID is
 	// drawn from the supplied record.
@@ -71,7 +69,7 @@ type DownstreamProvisioningStates interface {
 
 	// DeleteDownstreamProvisioningStates deletes *all* provisioning records for
 	// a given downstream
-	DeleteDownstreamProvisioningStates(context.Context, *provisioningv1.DeleteDownstreamProvisioningStatesRequest) (*emptypb.Empty, error)
+	DeleteDownstreamProvisioningStates(context.Context, DownstreamID) error
 }
 
 // ProvisioningStates defines an interface for managing a Provisioning Principal
@@ -83,7 +81,8 @@ type ProvisioningStates interface {
 	// records for all downstream receivers. Note that the returned record names
 	// may not be unique across all downstream receivers. Check the records'
 	// `DownstreamID` field to disambiguate.
-	ListProvisioningStatesForAllDownstreams(context.Context, int, *pagination.PageRequestToken) ([]*provisioningv1.PrincipalState, pagination.NextPageToken, error)
+	ListProvisioningStatesForAllDownstreams(context.Context, int, string) ([]*provisioningv1.PrincipalState, string, error)
+	ListProvisioningStatesForAllDownstreams2(context.Context, int, string) ([]*provisioningv1.PrincipalState, string, error)
 
 	// DeleteAllProvisioningStates deletes all provisioning state records for
 	// all downstream receivers.
diff --git a/lib/services/readonly/cache.go b/lib/services/readonly/cache.go
index f553ba2089196..c6a9b02a3ed8f 100644
--- a/lib/services/readonly/cache.go
+++ b/lib/services/readonly/cache.go
@@ -53,7 +53,7 @@ type CacheConfig struct {
 	// Disabled is a flag that can be used to disable ttl-caching. Useful in tests that
 	// don't play nicely with stale data.
 	Disabled bool
-	// ReloadOnErr controls wether or not the underlying ttl cache will hold onto error
+	// ReloadOnErr controls whether or not the underlying ttl cache will hold onto error
 	// entries for the full TTL, or reload error entries immediately. As a general rule,
 	// this value aught to be true on auth servers and false on agents, though in practice
 	// the difference is small unless an unusually long TTL is used.
diff --git a/lib/services/readonly/readonly.go b/lib/services/readonly/readonly.go
index dcb6c8623030b..b712bed374cf1 100644
--- a/lib/services/readonly/readonly.go
+++ b/lib/services/readonly/readonly.go
@@ -55,6 +55,8 @@ type AuthPreference interface {
 	Clone() types.AuthPreference
 }
 
+var _ AuthPreference = types.AuthPreference(nil)
+
 type sealedAuthPreference struct {
 	AuthPreference
 }
@@ -78,6 +80,8 @@ type ClusterNetworkingConfig interface {
 	Clone() types.ClusterNetworkingConfig
 }
 
+var _ ClusterNetworkingConfig = types.ClusterNetworkingConfig(nil)
+
 type sealedClusterNetworkingConfig struct {
 	ClusterNetworkingConfig
 }
@@ -100,6 +104,8 @@ type SessionRecordingConfig interface {
 	Clone() types.SessionRecordingConfig
 }
 
+var _ SessionRecordingConfig = types.SessionRecordingConfig(nil)
+
 type sealedSessionRecordingConfig struct {
 	SessionRecordingConfig
 }
@@ -122,7 +128,7 @@ type AccessGraphSettings interface {
 }
 
 type sealedAccessGraphSettings struct {
-	*clusterconfigpb.AccessGraphSettings
+	settings *clusterconfigpb.AccessGraphSettings
 }
 
 // sealAccessGraphSettings returns a read-only version of the SessionRecordingConfig.
@@ -135,11 +141,11 @@ func sealAccessGraphSettings(c *clusterconfigpb.AccessGraphSettings) AccessGraph
 }
 
 func (a sealedAccessGraphSettings) SecretsScanConfig() clusterconfigpb.AccessGraphSecretsScanConfig {
-	return a.GetSpec().GetSecretsScanConfig()
+	return a.settings.GetSpec().GetSecretsScanConfig()
 }
 
 func (a sealedAccessGraphSettings) Clone() *clusterconfigpb.AccessGraphSettings {
-	return protobuf.Clone(a.AccessGraphSettings).(*clusterconfigpb.AccessGraphSettings)
+	return protobuf.CloneOf(a.settings)
 }
 
 // Resource is a read only variant of [types.Resource].
@@ -160,6 +166,8 @@ type Resource interface {
 	GetRevision() string
 }
 
+var _ Resource = types.Resource(nil)
+
 // ResourceWithOrigin is a read only variant of [types.ResourceWithOrigin].
 type ResourceWithOrigin interface {
 	Resource
@@ -167,6 +175,8 @@ type ResourceWithOrigin interface {
 	Origin() string
 }
 
+var _ ResourceWithOrigin = types.ResourceWithOrigin(nil)
+
 // ResourceWithLabels is a read only variant of [types.ResourceWithLabels].
 type ResourceWithLabels interface {
 	ResourceWithOrigin
@@ -181,6 +191,8 @@ type ResourceWithLabels interface {
 	MatchSearch(searchValues []string) bool
 }
 
+var _ ResourceWithLabels = types.ResourceWithLabels(nil)
+
 // Application is a read only variant of [types.Application].
 type Application interface {
 	// ResourceWithLabels provides common resource methods.
@@ -234,6 +246,8 @@ type Application interface {
 	GetCORS() *types.CORSPolicy
 }
 
+var _ Application = types.Application(nil)
+
 // KubeServer is a read only variant of [types.KubeServer].
 type KubeServer interface {
 	// ResourceWithLabels provides common resource methods.
@@ -258,8 +272,13 @@ type KubeServer interface {
 	GetCluster() types.KubeCluster
 	// GetProxyIDs returns a list of proxy ids this service is connected to.
 	GetProxyIDs() []string
+	// GetRelayGroup returns the name of the Relay group that the kube server is
+	// connected to.
+	GetRelayGroup() string
 }
 
+var _ KubeServer = types.KubeServer(nil)
+
 // KubeCluster is a read only variant of [types.KubeCluster].
 type KubeCluster interface {
 	// ResourceWithLabels provides common resource methods.
@@ -291,12 +310,14 @@ type KubeCluster interface {
 	// IsKubeconfig identifies if the KubeCluster contains kubeconfig data.
 	IsKubeconfig() bool
 	// Copy returns a copy of this kube cluster resource.
-	Copy() *types.KubernetesClusterV3
+	Copy() types.KubeCluster
 	// GetCloud gets the cloud this kube cluster is running on, or an empty string if it
 	// isn't running on a cloud provider.
 	GetCloud() string
 }
 
+var _ KubeCluster = types.KubeCluster(nil)
+
 // Database is a read only variant of [types.Database].
 type Database interface {
 	// ResourceWithLabels provides common resource methods.
@@ -385,6 +406,8 @@ type Database interface {
 	IsUsernameCaseInsensitive() bool
 }
 
+var _ Database = types.Database(nil)
+
 // Server is a read only variant of [types.Server].
 type Server interface {
 	// ResourceWithLabels provides common resource headers
@@ -442,8 +465,13 @@ type Server interface {
 
 	// GetGitHub returns the GitHub server spec.
 	GetGitHub() *types.GitHubServerMetadata
+
+	// GetScope returns the scope this server belongs to.
+	GetScope() string
 }
 
+var _ Server = types.Server(nil)
+
 // DynamicWindowsDesktop represents a Windows desktop host that is automatically discovered by Windows Desktop Service.
 type DynamicWindowsDesktop interface {
 	// ResourceWithLabels provides common resource methods.
@@ -460,5 +488,7 @@ type DynamicWindowsDesktop interface {
 	// use the size passed by the client over TDP.
 	GetScreenSize() (width, height uint32)
 	// Copy returns a copy of this dynamic Windows desktop
-	Copy() *types.DynamicWindowsDesktopV1
+	Copy() types.DynamicWindowsDesktop
 }
+
+var _ DynamicWindowsDesktop = types.DynamicWindowsDesktop(nil)
diff --git a/lib/services/reconciler.go b/lib/services/reconciler.go
index 9aa23cac0007f..a7cae8d16f3db 100644
--- a/lib/services/reconciler.go
+++ b/lib/services/reconciler.go
@@ -21,11 +21,14 @@ package services
 import (
 	"context"
 	"log/slog"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/observability/metrics"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
@@ -55,6 +58,17 @@ type GenericReconcilerConfig[K comparable, T any] struct {
 	OnDelete func(context.Context, T) error
 	// Logger emits log messages.
 	Logger *slog.Logger
+	// Metrics is an optional ReconcilerMetrics created by the caller.
+	// The caller is responsible for registering the metrics.
+	// Metrics can be nil, in this case the generic reconciler will generate its
+	// own metrics, which won't be registered.
+	// Passing a metrics struct might look like a cumbersome API but we have 2 challenges:
+	// - some parts of Teleport are using one-shot reconcilers. Registering
+	//   metrics on every run would fail and we would lose the past reconciliation
+	//   data.
+	// - we have many reconcilers in Teleport and making the caller create the
+	//   metrics beforehand allows them to specify the metric subsystem.
+	Metrics *ReconcilerMetrics
 	// AllowOriginChanges is a flag that allows the reconciler to change the
 	// origin value of a reconciled resource. By default, origin changes are
 	// disallowed to enforce segregation between of resources from different
@@ -88,17 +102,82 @@ func (c *GenericReconcilerConfig[K, T]) CheckAndSetDefaults() error {
 	if c.Logger == nil {
 		c.Logger = slog.With(teleport.ComponentKey, "reconciler")
 	}
+	if c.Metrics == nil {
+		var err error
+		// If we are not given metrics, we create our own so we don't
+		// panic when trying to increment/observe.
+		c.Metrics, err = NewReconcilerMetrics(metrics.NoopRegistry().Wrap("unknown"))
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
 	return nil
 }
 
+// ReconcilerMetrics is a set of metrics that the reconciler will update during
+// its reconciliation cycle.
+type ReconcilerMetrics struct {
+	reconciliationTotal    *prometheus.CounterVec
+	reconciliationDuration *prometheus.HistogramVec
+}
+
+const (
+	metricLabelResult          = "result"
+	metricLabelResultSuccess   = "success"
+	metricLabelResultError     = "error"
+	metricLabelResultNoop      = "noop"
+	metricLabelOperation       = "operation"
+	metricLabelOperationCreate = "create"
+	metricLabelOperationUpdate = "update"
+	metricLabelOperationDelete = "delete"
+	metricLabelKind            = "kind"
+)
+
+// NewReconcilerMetrics creates subsystem-scoped metrics for the reconciler.
+// The caller is responsible for registering them into an appropriate registry.
+// The same ReconcilerMetrics can be used across different reconcilers.
+// The metrics subsystem cannot be empty.
+func NewReconcilerMetrics(reg *metrics.Registry) (*ReconcilerMetrics, error) {
+	if reg == nil {
+		return nil, trace.BadParameter("missing metrics registry (this is a bug)")
+	}
+	if reg.Subsystem() == "" {
+		return nil, trace.BadParameter("missing metrics subsystem (this is a bug)")
+	}
+	return &ReconcilerMetrics{
+		reconciliationTotal: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Namespace: reg.Namespace(),
+			Subsystem: reg.Subsystem(),
+			Name:      "reconciliation_total",
+			Help:      "Total number of individual resource reconciliations.",
+		}, []string{metricLabelKind, metricLabelOperation, metricLabelResult}),
+		reconciliationDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: reg.Namespace(),
+			Subsystem: reg.Subsystem(),
+			Name:      "reconciliation_duration_seconds",
+			Help:      "The duration of individual resource reconciliation in seconds.",
+		}, []string{metricLabelKind, metricLabelOperation}),
+	}, nil
+}
+
+// Register metrics in the specified [prometheus.Registerer], returns an error
+// if any metric fails, but still tries to register every metric before returning.
+func (m *ReconcilerMetrics) Register(r prometheus.Registerer) error {
+	return trace.NewAggregate(
+		r.Register(m.reconciliationTotal),
+		r.Register(m.reconciliationDuration),
+	)
+}
+
 // NewGenericReconciler creates a new GenericReconciler with provided configuration.
 func NewGenericReconciler[K comparable, T any](cfg GenericReconcilerConfig[K, T]) (*GenericReconciler[K, T], error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &GenericReconciler[K, T]{
-		cfg:    cfg,
-		logger: cfg.Logger,
+		cfg:     cfg,
+		logger:  cfg.Logger,
+		metrics: cfg.Metrics,
 	}, nil
 }
 
@@ -108,8 +187,9 @@ func NewGenericReconciler[K comparable, T any](cfg GenericReconcilerConfig[K, T]
 // It's used in combination with watchers by agents (app, database, desktop)
 // to enable dynamically registered resources.
 type GenericReconciler[K comparable, T any] struct {
-	cfg    GenericReconcilerConfig[K, T]
-	logger *slog.Logger
+	cfg     GenericReconcilerConfig[K, T]
+	logger  *slog.Logger
+	metrics *ReconcilerMetrics
 }
 
 // Reconcile reconciles currently registered resources with new resources and
@@ -137,6 +217,8 @@ func (r *GenericReconciler[K, T]) Reconcile(ctx context.Context) error {
 		}
 	}
 
+	// TODO(zmb3): with a large number of resources, this can return a lengthy
+	// error message that is difficult to parse
 	return trace.NewAggregate(errs...)
 }
 
@@ -152,11 +234,36 @@ func (r *GenericReconciler[K, T]) processRegisteredResource(ctx context.Context,
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	r.logger.InfoContext(ctx, "Resource was removed, deleting", "name", key)
-	if err := r.cfg.OnDelete(ctx, registered); err != nil {
+	r.logger.InfoContext(ctx, "Resource was removed, deleting", "kind", kind, "name", key)
+	start := time.Now()
+	err = r.cfg.OnDelete(ctx, registered)
+	r.metrics.reconciliationDuration.With(prometheus.Labels{
+		metricLabelKind:      kind,
+		metricLabelOperation: metricLabelOperationDelete,
+	}).Observe(time.Since(start).Seconds())
+	if err != nil {
+		if trace.IsNotFound(err) {
+			r.logger.Log(ctx, logutils.TraceLevel, "Failed to delete resource", "kind", kind, "name", key, "err", err)
+			r.metrics.reconciliationTotal.With(prometheus.Labels{
+				metricLabelKind:      kind,
+				metricLabelOperation: metricLabelOperationDelete,
+				metricLabelResult:    metricLabelResultNoop,
+			}).Inc()
+			return nil
+		}
+		r.metrics.reconciliationTotal.With(prometheus.Labels{
+			metricLabelKind:      kind,
+			metricLabelOperation: metricLabelOperationDelete,
+			metricLabelResult:    metricLabelResultError,
+		}).Inc()
 		return trace.Wrap(err, "failed to delete  %v %v", kind, key)
 	}
 
+	r.metrics.reconciliationTotal.With(prometheus.Labels{
+		metricLabelKind:      kind,
+		metricLabelOperation: metricLabelOperationDelete,
+		metricLabelResult:    metricLabelResultSuccess,
+	}).Inc()
 	return nil
 }
 
@@ -172,13 +279,31 @@ func (r *GenericReconciler[K, T]) processNewResource(ctx context.Context, curren
 			return trace.Wrap(err)
 		}
 		if r.cfg.Matcher(newT) {
-			r.logger.InfoContext(ctx, "New resource matches, creating", "name", key)
-			if err := r.cfg.OnCreate(ctx, newT); err != nil {
+			r.logger.InfoContext(ctx, "New resource matches, creating", "kind", kind, "name", key)
+			start := time.Now()
+			err = r.cfg.OnCreate(ctx, newT)
+			r.metrics.reconciliationDuration.With(prometheus.Labels{
+				metricLabelKind:      kind,
+				metricLabelOperation: metricLabelOperationCreate,
+			}).Observe(time.Since(start).Seconds())
+
+			if err != nil {
+				r.metrics.reconciliationTotal.With(prometheus.Labels{
+					metricLabelKind:      kind,
+					metricLabelOperation: metricLabelOperationCreate,
+					metricLabelResult:    metricLabelResultError,
+				}).Inc()
 				return trace.Wrap(err, "failed to create %v %v", kind, key)
 			}
+			r.metrics.reconciliationTotal.With(
+				prometheus.Labels{
+					metricLabelKind:      kind,
+					metricLabelOperation: metricLabelOperationCreate,
+					metricLabelResult:    metricLabelResultSuccess,
+				}).Inc()
 			return nil
 		}
-		r.logger.DebugContext(ctx, "New resource doesn't match, not creating", "name", key)
+		r.logger.DebugContext(ctx, "New resource doesn't match, not creating", "kind", kind, "name", key)
 		return nil
 	}
 
@@ -193,8 +318,9 @@ func (r *GenericReconciler[K, T]) processNewResource(ctx context.Context, curren
 			return trace.Wrap(err)
 		}
 		if registeredOrigin != newOrigin {
+			kind, _ := types.GetKind(newT)
 			r.logger.WarnContext(ctx, "New resource has different origin, not updating",
-				"name", key, "new_origin", newOrigin, "existing_origin", registeredOrigin)
+				"kind", kind, "name", key, "new_origin", newOrigin, "existing_origin", registeredOrigin)
 			return nil
 		}
 	}
@@ -208,15 +334,56 @@ func (r *GenericReconciler[K, T]) processNewResource(ctx context.Context, curren
 	if r.cfg.CompareResources(newT, registered) != Equal {
 		if r.cfg.Matcher(newT) {
 			r.logger.InfoContext(ctx, "Existing resource updated, updating", "name", key)
-			if err := r.cfg.OnUpdate(ctx, newT, registered); err != nil {
+			start := time.Now()
+			err := r.cfg.OnUpdate(ctx, newT, registered)
+			r.metrics.reconciliationDuration.With(prometheus.Labels{
+				metricLabelKind:      kind,
+				metricLabelOperation: metricLabelOperationUpdate,
+			}).Observe(time.Since(start).Seconds())
+			if err != nil {
+				r.metrics.reconciliationTotal.With(prometheus.Labels{
+					metricLabelKind:      kind,
+					metricLabelOperation: metricLabelOperationUpdate,
+					metricLabelResult:    metricLabelResultError,
+				}).Inc()
 				return trace.Wrap(err, "failed to update %v %v", kind, key)
 			}
+			r.metrics.reconciliationTotal.With(prometheus.Labels{
+				metricLabelKind:      kind,
+				metricLabelOperation: metricLabelOperationUpdate,
+				metricLabelResult:    metricLabelResultSuccess,
+			}).Inc()
 			return nil
 		}
 		r.logger.InfoContext(ctx, "Existing resource updated and no longer matches, deleting", "name", key)
-		if err := r.cfg.OnDelete(ctx, registered); err != nil {
+		start := time.Now()
+		err := r.cfg.OnDelete(ctx, registered)
+		r.metrics.reconciliationDuration.With(prometheus.Labels{
+			metricLabelKind:      kind,
+			metricLabelOperation: metricLabelOperationDelete,
+		}).Observe(time.Since(start).Seconds())
+		if err != nil {
+			if trace.IsNotFound(err) {
+				r.logger.Log(ctx, logutils.TraceLevel, "Failed to delete resource", "kind", kind, "name", key, "err", err)
+				r.metrics.reconciliationTotal.With(prometheus.Labels{
+					metricLabelKind:      kind,
+					metricLabelOperation: metricLabelOperationDelete,
+					metricLabelResult:    metricLabelResultNoop,
+				}).Inc()
+				return nil
+			}
+			r.metrics.reconciliationTotal.With(prometheus.Labels{
+				metricLabelKind:      kind,
+				metricLabelOperation: metricLabelOperationDelete,
+				metricLabelResult:    metricLabelResultError,
+			}).Inc()
 			return trace.Wrap(err, "failed to delete %v %v", kind, key)
 		}
+		r.metrics.reconciliationTotal.With(prometheus.Labels{
+			metricLabelKind:      kind,
+			metricLabelOperation: metricLabelOperationDelete,
+			metricLabelResult:    metricLabelResultSuccess,
+		}).Inc()
 		return nil
 	}
 
diff --git a/lib/services/reconciler_test.go b/lib/services/reconciler_test.go
index ad97fb61c904d..aec0293761936 100644
--- a/lib/services/reconciler_test.go
+++ b/lib/services/reconciler_test.go
@@ -23,6 +23,7 @@ import (
 	"maps"
 	"testing"
 
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -106,6 +107,26 @@ func TestReconciler(t *testing.T) {
 			registeredResources: []testResource{makeDynamicResource("res1", nil)},
 			onDeleteCalls:       []testResource{makeDynamicResource("res1", nil)},
 		},
+		{
+			description: "removing a resource that doesn't exist is not an error",
+			selectors: []ResourceMatcher{{
+				Labels: types.Labels{"foo": []string{"bar"}},
+			}},
+			// Note the label change below. This means the resource no longer matches and should be removed.
+			registeredResources: []testResource{makeDynamicResource("res1", map[string]string{"foo": "bar"})},
+			newResources:        []testResource{makeDynamicResource("res1", map[string]string{"baz": "quux"})},
+
+			// Simulate the resource having already expired from the backend.
+			configure: func(cfg *ReconcilerConfig[testResource]) {
+				originalDelete := cfg.OnDelete
+				cfg.OnDelete = func(ctx context.Context, tr testResource) error {
+					originalDelete(ctx, tr)
+					return trace.NotFound("resource does not exist")
+				}
+			},
+
+			onDeleteCalls: []testResource{makeDynamicResource("res1", map[string]string{"foo": "bar"})},
+		},
 		{
 			description: "resource with updated matching labels should be updated",
 			selectors: []ResourceMatcher{{
diff --git a/lib/services/recording_encryption.go b/lib/services/recording_encryption.go
new file mode 100644
index 0000000000000..5ddeb0b7bb442
--- /dev/null
+++ b/lib/services/recording_encryption.go
@@ -0,0 +1,44 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services
+
+import (
+	"context"
+
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// RecordingEncryption handles CRUD operations for the RecordingEncryption resource.
+type RecordingEncryption interface {
+	// CreateRecordingEncryption creates a new RecordingEncryption in the backend if one
+	// does not already exist.
+	CreateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error)
+	// UpdateRecordingEncryption replaces the RecordingEncryption resource with the given one.
+	UpdateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error)
+	// DeleteRecordingEncryption removes the RecordingEncryption from the cluster.
+	DeleteRecordingEncryption(ctx context.Context) error
+	// GetRecordingEncryption retrieves the RecordingEncryption for the cluster.
+	GetRecordingEncryption(ctx context.Context) (*recordingencryptionv1.RecordingEncryption, error)
+
+	// CreateRotatedKey creates a new RotatedKey in the backend.
+	CreateRotatedKey(ctx context.Context, key *types.EncryptionKeyPair) (*recordingencryptionv1.RotatedKey, error)
+	// GetRotatedKey retrieves the RotatedKey related to the given fingerprint.
+	GetRotatedKey(ctx context.Context, fingerprint string) (*recordingencryptionv1.RotatedKey, error)
+	// DeleteRotatedKey retrieves the RotatedKey related to the given fingerprint.
+	DeleteRotatedKey(ctx context.Context, fingerprint string) error
+}
diff --git a/lib/services/relay_server.go b/lib/services/relay_server.go
new file mode 100644
index 0000000000000..98bdeec02e8b2
--- /dev/null
+++ b/lib/services/relay_server.go
@@ -0,0 +1,55 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services
+
+import (
+	"github.com/gravitational/trace"
+
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	apitypes "github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/common"
+)
+
+// ValidateRelayServer will check the given relay server for validity. Should be
+// called before writing a new value in the cluster state storage and before
+// using a value. The value will not be modified.
+func ValidateRelayServer(resource *presencev1.RelayServer) error {
+	if expected, actual := apitypes.KindRelayServer, resource.GetKind(); expected != actual {
+		return trace.BadParameter("expected kind %v, got %q", expected, actual)
+	}
+	if expected, actual := "", resource.GetSubKind(); expected != actual {
+		return trace.BadParameter("expected sub_kind %v, got %q", expected, actual)
+	}
+	if expected, actual := apitypes.V1, resource.GetVersion(); expected != actual {
+		return trace.BadParameter("expected version %v, got %q", expected, actual)
+	}
+	if name := resource.GetMetadata().GetName(); name == "" {
+		return trace.BadParameter("missing name")
+	}
+	for key := range resource.GetMetadata().GetLabels() {
+		if key == apitypes.OriginLabel {
+			return trace.BadParameter("origin label unsupported")
+		}
+		if !common.IsValidLabelKey(key) {
+			return trace.BadParameter("invalid label key %q", key)
+		}
+	}
+
+	// TODO(espadolini): validate spec contents, nothing to validate so far
+
+	return nil
+}
diff --git a/lib/services/resource.go b/lib/services/resource.go
index 65a731ea10413..7c02e36fb001b 100644
--- a/lib/services/resource.go
+++ b/lib/services/resource.go
@@ -37,6 +37,7 @@ import (
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -274,6 +275,10 @@ func ParseShortcut(in string) (string, error) {
 		return types.KindAutoUpdateVersion, nil
 	case types.KindAutoUpdateAgentRollout:
 		return types.KindAutoUpdateAgentRollout, nil
+	case types.KindAutoUpdateAgentReport:
+		return types.KindAutoUpdateAgentReport, nil
+	case types.KindAutoUpdateBotInstanceReport:
+		return types.KindAutoUpdateBotInstanceReport, nil
 	case types.KindGitServer, types.KindGitServer + "s":
 		return types.KindGitServer, nil
 	case types.KindWorkloadIdentityX509Revocation, types.KindWorkloadIdentityX509Revocation + "s":
@@ -284,6 +289,18 @@ func ParseShortcut(in string) (string, error) {
 		return types.KindSigstorePolicy, nil
 	case types.KindHealthCheckConfig, types.KindHealthCheckConfig + "s", "hcc":
 		return types.KindHealthCheckConfig, nil
+	case scopedaccess.KindScopedRole, scopedaccess.KindScopedRole + "s", "scopedrole", "scopedroles":
+		return scopedaccess.KindScopedRole, nil
+	case scopedaccess.KindScopedRoleAssignment, scopedaccess.KindScopedRoleAssignment + "s", "scopedroleassignment", "scopedroleassignments":
+		return scopedaccess.KindScopedRoleAssignment, nil
+	case types.KindInferenceModel, "inference_models":
+		return types.KindInferenceModel, nil
+	case types.KindInferenceSecret, "inference_secrets":
+		return types.KindInferenceSecret, nil
+	case types.KindInferencePolicy, "inference_policies":
+		return types.KindInferencePolicy, nil
+	case types.KindRelayServer, types.KindRelayServer + "s":
+		return types.KindRelayServer, nil
 	}
 	return "", trace.BadParameter("unsupported resource: %q - resources should be expressed as 'type/name', for example 'connector/github'", in)
 }
@@ -970,6 +987,26 @@ func UnmarshalProtoResource[T ProtoResourcePtr[U], U any](data []byte, opts ...M
 	return resource, nil
 }
 
+// UnmarshalProtoResourceArray unmarshals an array of ProtoResources from JSON using [UnmarshalProtoResource] on each
+// individual element.
+func UnmarshalProtoResourceArray[T ProtoResourcePtr[U], U any](data []byte, opts ...MarshalOption) ([]T, error) {
+	var msgs []json.RawMessage
+	if err := json.Unmarshal(data, &msgs); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resources := make([]T, 0, len(msgs))
+	for _, msg := range msgs {
+		resource, err := UnmarshalProtoResource[T](msg, opts...)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		resources = append(resources, resource)
+	}
+
+	return resources, nil
+}
+
 // FastMarshalProtoResourceDeprecated marshals a ProtoResource to JSON using [utils.FastMarshal] and respecting [opts].
 //
 // Deprecated: this should not be used for new types, prefer [MarshalProtoResource]. Existing types should not
diff --git a/lib/services/role.go b/lib/services/role.go
index 130cedc5a7a7e..04817690dc92b 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -174,6 +174,9 @@ func RoleWithVersionForUser(u types.User, v string) types.Role {
 			KubernetesLabels:      types.Labels{types.Wildcard: []string{types.Wildcard}},
 			DatabaseServiceLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
 			DatabaseLabels:        types.Labels{types.Wildcard: []string{types.Wildcard}},
+			MCP: &types.MCPPermissions{
+				Tools: []string{types.Wildcard},
+			},
 			Rules: []types.Rule{
 				types.NewRule(types.KindRole, RW()),
 				types.NewRule(types.KindAuthConnector, RW()),
@@ -386,7 +389,12 @@ func validateRoleExpressions(r types.Role) error {
 // validateRule parses the where and action fields to validate the rule.
 func validateRule(r types.Rule) error {
 	if len(r.Where) != 0 {
-		parser, err := NewWhereParser(&Context{})
+		parser, err := NewWhereParser(&Context{},
+			ConditionalOption(
+				slices.Contains(r.Resources, types.KindSession),
+				WithCanViewFunction(),
+			),
+		)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -564,6 +572,7 @@ func ApplyTraits(r types.Role, traits map[string][]string) (types.Role, error) {
 			types.KindWindowsDesktop,
 			types.KindUserGroup,
 			types.KindSAMLIdPServiceProvider,
+			types.KindWorkloadIdentity,
 		} {
 			labelMatchers, err := r.GetLabelMatchers(condition, kind)
 			if err != nil {
@@ -612,6 +621,11 @@ func ApplyTraits(r types.Role, traits map[string][]string) (types.Role, error) {
 		outCond.Roles = apiutils.Deduplicate(outCond.Roles)
 		outCond.Where = inCond.Where
 		r.SetImpersonateConditions(condition, outCond)
+
+		if mcp := r.GetMCPPermissions(condition); mcp != nil {
+			mcp.Tools = applyValueTraitsSlice(mcp.Tools, traits, "mcp.tools")
+			r.SetMCPPermissions(condition, mcp)
+		}
 	}
 
 	return r, nil
@@ -695,7 +709,8 @@ func ApplyValueTraits(val string, traits map[string][]string) ([]string, error)
 				constants.TraitDBNames, constants.TraitDBUsers, constants.TraitDBRoles,
 				constants.TraitAWSRoleARNs, constants.TraitAzureIdentities,
 				constants.TraitGCPServiceAccounts, constants.TraitJWT,
-				constants.TraitGitHubOrgs:
+				constants.TraitGitHubOrgs, constants.TraitMCPTools,
+				constants.TraitDefaultRelayAddr:
 			default:
 				return trace.BadParameter("unsupported variable %q", name)
 			}
@@ -1029,6 +1044,22 @@ func (result *EnumerationResult) WildcardDenied() bool {
 	return result.wildcardDenied
 }
 
+// ToEntities converts result back to allowed and denied entity slices.
+//
+// If wildcard is denied, only "*" is returned for the denied slice.
+// If wildcard is allowed, allowed entities will be appended to the allowed
+// slice after the "*" as a hint for users to select.
+// Denied entities is only included if the wildcard is allowed.
+func (result *EnumerationResult) ToEntities() (allowed, denied []string) {
+	if result.wildcardDenied {
+		return nil, []string{types.Wildcard}
+	}
+	if result.wildcardAllowed {
+		return append([]string{types.Wildcard}, result.Allowed()...), result.Denied()
+	}
+	return result.Allowed(), nil
+}
+
 // NewEnumerationResult returns new EnumerationResult.
 func NewEnumerationResult() EnumerationResult {
 	return EnumerationResult{
@@ -1038,6 +1069,34 @@ func NewEnumerationResult() EnumerationResult {
 	}
 }
 
+// NewEnumerationResultFromEntities creates a new EnumerationResult and
+// populates the result with provided allowed and denied entries.
+func NewEnumerationResultFromEntities(allowed, denied []string) EnumerationResult {
+	var wildcardAllowed bool
+	var wildcardDenied bool
+	allowedDeniedMap := make(map[string]bool)
+	for _, allow := range allowed {
+		if allow == types.Wildcard {
+			wildcardAllowed = true
+		} else {
+			allowedDeniedMap[allow] = true
+		}
+	}
+	for _, deny := range denied {
+		if deny == types.Wildcard {
+			wildcardDenied = true
+			wildcardAllowed = false
+			break
+		}
+		allowedDeniedMap[deny] = false
+	}
+	return EnumerationResult{
+		allowedDeniedMap: allowedDeniedMap,
+		wildcardAllowed:  wildcardAllowed,
+		wildcardDenied:   wildcardDenied,
+	}
+}
+
 // MatchNamespace returns true if given list of namespace matches
 // target namespace, wildcard matches everything.
 func MatchNamespace(selectors []string, namespace string) (bool, string) {
@@ -1140,6 +1199,9 @@ func (m mapLabelGetter) GetAllLabels() map[string]string {
 
 // MatchLabelGetter matches selector against labelGetter. Empty selector matches
 // nothing, wildcard matches everything.
+//
+// Keep in sync with front-end implementation;
+//   - web/packages/teleport/src/Bots/Add/Shared/kubernetes.ts:34
 func MatchLabelGetter(selector types.Labels, labelGetter LabelGetter) (bool, string, error) {
 	// Empty selector matches nothing.
 	if len(selector) == 0 {
@@ -2596,6 +2658,8 @@ func (set RoleSet) checkAccess(r AccessCheckable, traits wrappers.Traits, state
 		additionalDeniedMessage = "Confirm Kubernetes user or group."
 	case types.KindWindowsDesktop:
 		additionalDeniedMessage = "Confirm Windows user."
+	case types.KindSAMLIdPServiceProvider:
+		additionalDeniedMessage = "Confirm app_labels."
 	}
 
 	// Check deny rules.
@@ -2641,7 +2705,7 @@ func (set RoleSet) checkAccess(r AccessCheckable, traits wrappers.Traits, state
 
 	// TODO(codingllama): Consider making EnableDeviceVerification opt-out instead
 	//  of opt-in.
-	deviceAllowed := !state.EnableDeviceVerification || state.DeviceVerified
+	deviceTrusted := !state.EnableDeviceVerification || state.DeviceVerified
 
 	var errs []error
 	allowed := false
@@ -2697,7 +2761,7 @@ func (set RoleSet) checkAccess(r AccessCheckable, traits wrappers.Traits, state
 		// (and gets an early exit) or we need to check every applicable role to
 		// ensure the access is permitted.
 
-		if mfaAllowed && deviceAllowed {
+		if mfaAllowed && deviceTrusted {
 			logger.LogAttrs(ctx, logutils.TraceLevel, "Access to resource granted, allow rule in role matched",
 				slog.String("role", role.GetName()),
 			)
@@ -2713,7 +2777,19 @@ func (set RoleSet) checkAccess(r AccessCheckable, traits wrappers.Traits, state
 		}
 
 		// Device verification.
-		if !deviceAllowed && role.GetOptions().DeviceTrustMode == constants.DeviceTrustModeRequired {
+		var deviceVerificationPassed bool
+		switch role.GetOptions().DeviceTrustMode {
+		case constants.DeviceTrustModeOff, constants.DeviceTrustModeOptional, "":
+			// OK, extensions not enforced.
+			deviceVerificationPassed = true
+		case constants.DeviceTrustModeRequiredForHumans:
+			// Humans must use trusted devices, bots can use untrusted devices.
+			deviceVerificationPassed = deviceTrusted || state.IsBot
+		case constants.DeviceTrustModeRequired:
+			// Only trusted devices allowed for bot human and bot users.
+			deviceVerificationPassed = deviceTrusted
+		}
+		if !deviceVerificationPassed {
 			logger.LogAttrs(ctx, logutils.TraceLevel, "Access to resource denied, role requires a trusted device",
 				slog.String("role", role.GetName()),
 			)
@@ -3124,7 +3200,11 @@ func (p boolParser) Parse(string) (interface{}, error) {
 // namespace to the specified resource and verb.
 // silent controls whether the access violations are logged.
 func (set RoleSet) CheckAccessToRule(ctx RuleContext, namespace string, resource string, verb string) error {
-	whereParser, err := NewWhereParser(ctx)
+	whereParser, err := NewWhereParser(
+		ctx,
+		// register can_view function if the resource is a session.
+		ConditionalOption(resource == types.KindSession, WithCanViewFunction()),
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -3398,13 +3478,101 @@ func (set RoleSet) GetAllowedSearchAsRoles(allowFilters ...SearchAsRolesOption)
 	return apiutils.Deduplicate(allowed)
 }
 
+type gk struct{ group, kind string }
+
+// noramlize the give kube kind. Maps legacy values to plural+group, trim the kube: prefix.
+// Returns <kind>[.<group>].
+func normalizeKubernetesKind(in string) (out gk) {
+	// Check if we have a legacy kind.
+	out.group = types.KubernetesResourcesV7KindGroups[in]
+	out.kind = types.KubernetesResourcesKindsPlurals[in]
+	if out.kind == "" {
+		switch {
+		case in == types.KindKubeNamespace:
+			out.kind = "namespaces"
+			return out
+		case strings.HasPrefix(in, types.AccessRequestPrefixKindKubeNamespaced):
+			out.kind = strings.TrimPrefix(in, types.AccessRequestPrefixKindKubeNamespaced)
+		case strings.HasPrefix(in, types.AccessRequestPrefixKindKubeClusterWide):
+			out.kind = strings.TrimPrefix(in, types.AccessRequestPrefixKindKubeClusterWide)
+			// Subset if the two first used in search. Must be last.
+		case strings.HasPrefix(in, types.AccessRequestPrefixKindKube):
+			out.kind = strings.TrimPrefix(in, types.AccessRequestPrefixKindKube)
+		}
+	}
+	if out.group != "" { // If we have a group, we are dealing with legacy value, we have the noramlized version.
+		return out
+	}
+
+	// Otherwise, parse the group from the trimmed input.
+	if i := strings.Index(out.kind, "."); i != -1 {
+		out.group = out.kind[i+1:]
+		out.kind = out.kind[:i]
+		return out
+	}
+	return out
+}
+
+// matchRequestKubernetesResources checks if the input matches the reference
+// based on the condition type.
+//
+// Similar logic as utils.KubeResourceMatchesRegex(), but with support for wildcard input
+// and without support for verbs/names/namespaces.
+//
+// Examples:
+// Request: *.apps        Deny: deployments.apps -> match.
+// Request: *.apps        Deny: deployments.*    -> match. (*.apps could be deployments.apps which matches deployments.*)
+// Request: *.apps        Deny: *.*	         -> match.
+// Request: deployments.* Deny: deployments.apps -> match.
+// Request: deployments.* Deny: deployments.*    -> match.
+// Request: deployments.* Deny: *.*	         -> match.
+// Request: *.*           Deny: deployments.apps -> match.
+// Request: *.*           Deny: deployments.*    -> match.
+// Request: *.*           Deny: *.*	         -> match.
+func matchRequestKubernetesResources(input gk, reference types.RequestKubernetesResource, cond types.RoleConditionType) bool {
+	// If we have an exact match, we are done.
+	if input.kind == reference.Kind && input.group == reference.APIGroup {
+		return true
+	}
+	// If the reference is a wildcard and the input kube_cluster, we don't match allow, but we match deny.
+	// Ref:
+	//  https://github.com/gravitational/teleport/blob/master/rfd/0183-access-request-kube-resource-allow-list.md#as-an-admin-i-want-to-require-users-to-request-for-kubernetes-subresources-instead-of-the-whole-kubernetes-cluster
+	if reference.Kind == types.Wildcard && input.kind == types.KindKubernetesCluster {
+		return cond == types.Deny
+	}
+
+	if cond == types.Allow {
+		// In allow mode, if the reference kind is not a wildcard and doesn't match exactly, we reject.
+		if reference.Kind != types.Wildcard && input.kind != reference.Kind {
+			return false
+		}
+
+		// If the reference api group is a wildcard or is an exact match, we are done.
+		if reference.APIGroup == types.Wildcard || input.group == reference.APIGroup {
+			return true
+		}
+
+		// Otherwise, attempt to match the api group pattern.
+		ok, _ := utils.MatchString(input.group, reference.APIGroup)
+		return ok
+	}
+	// In deny mode, we reject only if both input/ref are not wildcard and are not equal.
+	if reference.Kind != types.Wildcard && input.kind != types.Wildcard && input.kind != reference.Kind {
+		return false
+	}
+	// If there is no conflict on the kind, check the group. As we support pattern matching, check both sides.
+	ok1, _ := utils.MatchString(input.group, reference.APIGroup)
+	ok2, _ := utils.MatchString(reference.APIGroup, input.group)
+	return ok1 || ok2
+}
+
 // GetAllowedSearchAsRolesForKubeResourceKind returns all of the allowed SearchAsRoles
 // that allowed requesting to the requested Kubernetes resource kind.
 func (set RoleSet) GetAllowedSearchAsRolesForKubeResourceKind(requestedKubeResourceKind string) []string {
 	// Return no results if encountering any denies since its globally matched.
 	for _, role := range set {
-		for _, kr := range role.GetAccessRequestConditions(types.Deny).KubernetesResources {
-			if kr.Kind == types.Wildcard || kr.Kind == requestedKubeResourceKind {
+		for _, kr := range role.GetRequestKubernetesResources(types.Deny) {
+			if matchRequestKubernetesResources(normalizeKubernetesKind(requestedKubeResourceKind), kr, types.Deny) {
 				return nil
 			}
 		}
@@ -3418,12 +3586,12 @@ func (set RoleSet) GetAllowedSearchAsRolesForKubeResourceKind(requestedKubeResou
 func WithAllowedKubernetesResourceKindFilter(requestedKubeResourceKind string) SearchAsRolesOption {
 	return func(role types.Role) bool {
 		allowed := role.GetAccessRequestConditions(types.Allow).KubernetesResources
-		// any kind is allowed if nothing was configured.
+		// Any kind is allowed if nothing was configured.
 		if len(allowed) == 0 {
 			return true
 		}
-		for _, kr := range role.GetAccessRequestConditions(types.Allow).KubernetesResources {
-			if kr.Kind == types.Wildcard || kr.Kind == requestedKubeResourceKind {
+		for _, kr := range role.GetRequestKubernetesResources(types.Allow) {
+			if matchRequestKubernetesResources(normalizeKubernetesKind(requestedKubeResourceKind), kr, types.Allow) {
 				return true
 			}
 		}
@@ -3484,6 +3652,9 @@ type AccessState struct {
 	// It's recommended to set this in tandem with EnableDeviceVerification.
 	// See [dtauthz.IsTLSDeviceVerified] and [dtauthz.IsSSHDeviceVerified].
 	DeviceVerified bool
+	// IsBot determines whether the user certificate belongs to a bot. It's used
+	// when deciding whether to enforce device verification.
+	IsBot bool
 }
 
 // MFARequired determines when MFA is required for a user to access a resource.
@@ -3502,6 +3673,13 @@ const (
 	MFARequiredPerRole MFARequired = "per-role"
 )
 
+// UserSessionRoleNotFoundErrorMsg is added to "role not found" errors when they occur
+// during user session roles validation. This allows the Web UI to distinguish between
+// a user session role lookup error (which should prompt the user to re-login) vs. other role lookup
+// failures.
+// Keep in sync with teleport/src/services/api/api.ts(isUserSessionRoleNotFoundError)
+const UserSessionRoleNotFoundErrorMsg = "user session role not found"
+
 // UnmarshalRole unmarshals the Role resource from JSON.
 func UnmarshalRole(bytes []byte, opts ...MarshalOption) (types.Role, error) {
 	return UnmarshalRoleV6(bytes, opts...)
@@ -3585,5 +3763,26 @@ func AccessStateFromSSHIdentity(ctx context.Context, ident *sshca.Identity, chec
 
 	state.EnableDeviceVerification = true
 	state.DeviceVerified = dtauthz.IsSSHDeviceVerified(ident)
+	state.IsBot = ident.IsBot()
 	return state, nil
 }
+
+// MCPToolMatcher matches a role against MCP tool.
+type MCPToolMatcher struct {
+	Name string
+}
+
+// Match matches MCP tool name against provided role and condition.
+func (m *MCPToolMatcher) Match(role types.Role, condition types.RoleConditionType) (bool, error) {
+	mcpSpec := role.GetMCPPermissions(condition)
+	if mcpSpec == nil {
+		return false, nil
+	}
+	match, err := utils.SliceMatchesRegex(m.Name, mcpSpec.Tools)
+	return match, trace.Wrap(err)
+}
+
+// String returns the matcher's string representation.
+func (m *MCPToolMatcher) String() string {
+	return fmt.Sprintf("MCPToolMatcher(Name=%v)", m.Name)
+}
diff --git a/lib/services/role_test.go b/lib/services/role_test.go
index c3c8ca60be9e5..b2aa65a76a731 100644
--- a/lib/services/role_test.go
+++ b/lib/services/role_test.go
@@ -42,6 +42,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/sshutils"
@@ -204,7 +205,7 @@ func TestRoleParse(t *testing.T) {
 					}
 				}`,
 			error:        trace.BadParameter(""),
-			matchMessage: "invalid or unsupported",
+			matchMessage: "kind \"abcd\" is not supported in role version \"v6\"",
 		},
 		{
 			name: "validation error, kubernetes_resources kind namespace not supported in v6",
@@ -862,6 +863,39 @@ func TestValidateRole(t *testing.T) {
 				"unsupported function: containz",
 			},
 		},
+		{
+			name: "unsupported function for non session",
+			spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Rules: []types.Rule{
+						{
+							Resources: []string{"roles"},
+							Verbs:     []string{"read", "list"},
+							Where:     "can_view()",
+						},
+					},
+				},
+			},
+			expectWarnings: []string{
+				"parsing allow rule",
+				"could not parse 'where' rule",
+				"unsupported function: can_view",
+			},
+		},
+		{
+			name: "supported function for session",
+			spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Rules: []types.Rule{
+						{
+							Resources: []string{"session"},
+							Verbs:     []string{"read", "list"},
+							Where:     "can_view()",
+						},
+					},
+				},
+			},
+		},
 		{
 			name: "unsupported function in where",
 			spec: types.RoleSpecV6{
@@ -2965,6 +2999,8 @@ func TestApplyTraits(t *testing.T) {
 		outKubeResources        []types.KubernetesResource
 		inGitHubPermissions     []types.GitHubPermission
 		outGitHubPermissions    []types.GitHubPermission
+		inMCPPermissions        *types.MCPPermissions
+		outMCPPermissions       *types.MCPPermissions
 	}
 	tests := []struct {
 		comment  string
@@ -3761,6 +3797,34 @@ func TestApplyTraits(t *testing.T) {
 				}},
 			},
 		},
+		{
+			comment: "MCP permissions in allow rule",
+			inTraits: map[string][]string{
+				"mcp_tools": {"get_*", "search_files"},
+			},
+			allow: rule{
+				inMCPPermissions: &types.MCPPermissions{
+					Tools: []string{"{{internal.mcp_tools}}"},
+				},
+				outMCPPermissions: &types.MCPPermissions{
+					Tools: []string{"get_*", "search_files"},
+				},
+			},
+		},
+		{
+			comment: "MCP permissions in deny rule",
+			inTraits: map[string][]string{
+				"mcp_tools": {"get_*", "search_files"},
+			},
+			deny: rule{
+				inMCPPermissions: &types.MCPPermissions{
+					Tools: []string{"{{internal.mcp_tools}}"},
+				},
+				outMCPPermissions: &types.MCPPermissions{
+					Tools: []string{"get_*", "search_files"},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.comment, func(t *testing.T) {
@@ -3793,6 +3857,7 @@ func TestApplyTraits(t *testing.T) {
 						HostSudoers:          tt.allow.inSudoers,
 						KubernetesResources:  tt.allow.inKubeResources,
 						GitHubPermissions:    tt.allow.inGitHubPermissions,
+						MCP:                  tt.allow.inMCPPermissions,
 					},
 					Deny: types.RoleConditions{
 						Logins:               tt.deny.inLogins,
@@ -3815,6 +3880,7 @@ func TestApplyTraits(t *testing.T) {
 						HostSudoers:          tt.deny.outSudoers,
 						KubernetesResources:  tt.deny.inKubeResources,
 						GitHubPermissions:    tt.deny.inGitHubPermissions,
+						MCP:                  tt.deny.inMCPPermissions,
 					},
 				},
 			}
@@ -4562,9 +4628,10 @@ func TestRoleSetEnumerateDatabaseUsersAndNames(t *testing.T) {
 		Metadata: types.Metadata{Name: "allow_deny_same", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:    []string{apidefaults.Namespace},
-				DatabaseUsers: []string{"root"},
-				DatabaseNames: []string{"root"},
+				DatabaseLabels: types.Labels{"env": []string{"stage"}},
+				Namespaces:     []string{apidefaults.Namespace},
+				DatabaseUsers:  []string{"root"},
+				DatabaseNames:  []string{"root"},
 			},
 			Deny: types.RoleConditions{
 				Namespaces:    []string{apidefaults.Namespace},
@@ -6373,7 +6440,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					},
 					Options: types.RoleOptions{
 						IDP: &types.IdPOptions{},
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc:    require.NoError,
@@ -6389,7 +6457,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 						IDP: &types.IdPOptions{
 							SAML: &types.IdPSAMLOptions{},
 						},
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc:    require.NoError,
@@ -6400,7 +6469,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7IdPEnabled", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc:    require.NoError,
@@ -6411,7 +6481,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7IdPDisabled", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, false),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc: func(tt require.TestingT, err error, i ...interface{}) {
@@ -6424,11 +6495,13 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7IdPEnabled", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 				createRole(t, "roleV7IdPDisabled", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, false),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc: func(tt require.TestingT, err error, i ...interface{}) {
@@ -6441,7 +6514,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7IdPEnabled", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: false,
 			errAssertionFunc: func(tt require.TestingT, err error, i ...interface{}) {
@@ -6464,7 +6538,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					},
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, false),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc: func(tt require.TestingT, err error, i ...interface{}) {
@@ -6486,7 +6561,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					},
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc:    require.NoError,
@@ -6498,7 +6574,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					Allow: roleV8SAMLAllowed(t),
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, false),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			errAssertionFunc:    require.NoError,
@@ -6519,7 +6596,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					},
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6538,7 +6616,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					Options: types.RoleOptions{
 						RequireMFAType: types.RequireMFAType_SESSION,
 						IDP:            idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6557,7 +6636,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					Options: types.RoleOptions{
 						RequireMFAType: types.RequireMFAType_SESSION,
 						IDP:            idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6572,7 +6652,9 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7MFARequired", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}})},
+					},
+				}),
+			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
 				MFARequired: MFARequiredAlways,
@@ -6588,7 +6670,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 				createRole(t, "roleV7MFARequired", types.V7, types.RoleSpecV6{
 					Options: types.RoleOptions{
 						IDP: idpEnabled(t, true),
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6605,7 +6688,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					Allow: roleV8SAMLAllowed(t),
 					Options: types.RoleOptions{
 						RequireMFAType: types.RequireMFAType_SESSION,
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6623,7 +6707,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 					Allow: roleV8SAMLAllowed(t),
 					Options: types.RoleOptions{
 						RequireMFAType: types.RequireMFAType_SESSION,
-					}}),
+					},
+				}),
 			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
@@ -6637,7 +6722,8 @@ func TestCheckAccessToSAMLIdP(t *testing.T) {
 			roles: RoleSet{
 				createRole(t, "roleV8MFARequired", types.V8, types.RoleSpecV6{
 					Allow: roleV8SAMLAllowed(t),
-				})},
+				}),
+			},
 			authPrefSamlEnabled: true,
 			state: AccessState{
 				MFARequired: MFARequiredAlways,
@@ -6747,6 +6833,24 @@ func TestCheckAccessToKubernetes(t *testing.T) {
 			},
 		},
 	}
+	matchingLabelsRoleWithDeviceTrustForHumans := &types.RoleV6{
+		Metadata: types.Metadata{
+			Name:      "matching-labels-devicetrust-humans",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.RoleSpecV6{
+			Options: types.RoleOptions{
+				DeviceTrustMode: constants.DeviceTrustModeRequiredForHumans,
+			},
+			Allow: types.RoleConditions{
+				Namespaces: []string{apidefaults.Namespace},
+				KubernetesLabels: types.Labels{
+					"foo": apiutils.Strings{"bar"},
+					"baz": apiutils.Strings{"qux"},
+				},
+			},
+		},
+	}
 	noLabelsRole := &types.RoleV6{
 		Metadata: types.Metadata{
 			Name:      "no-labels",
@@ -6886,6 +6990,28 @@ func TestCheckAccessToKubernetes(t *testing.T) {
 			},
 			hasAccess: true, // doesn't match device trust role
 		},
+		{
+			name:    "role requires device trust for all, is bot",
+			roles:   []*types.RoleV6{matchingLabelsRoleWithDeviceTrust},
+			cluster: clusterWithLabels,
+			state: AccessState{
+				EnableDeviceVerification: true,
+				DeviceVerified:           false,
+				IsBot:                    true,
+			},
+			hasAccess: false,
+		},
+		{
+			name:    "role requires device trust for humans, is bot",
+			roles:   []*types.RoleV6{matchingLabelsRoleWithDeviceTrustForHumans},
+			cluster: clusterWithLabels,
+			state: AccessState{
+				EnableDeviceVerification: true,
+				DeviceVerified:           false,
+				IsBot:                    true,
+			},
+			hasAccess: true,
+		},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -8042,6 +8168,7 @@ func TestGetKubeResources(t *testing.T) {
 			set := NewRoleSet(tc.roles...)
 			accessChecker := makeAccessCheckerWithRoleSet(set)
 			allowed, denied := accessChecker.GetKubeResources(cluster)
+			tc.expectAllowed = append(tc.expectAllowed, types.KubernetesResourceSelfSubjectAccessReview)
 			require.ElementsMatch(t, tc.expectAllowed, allowed, "allow list mismatch")
 			require.ElementsMatch(t, tc.expectDenied, denied, "deny list mismatch")
 		})
@@ -9967,3 +10094,950 @@ func TestCheckAccessToGitServer(t *testing.T) {
 		})
 	}
 }
+
+func TestMatchRequestKubernetesResource(t *testing.T) {
+	tests := []struct {
+		input     gk
+		reference types.RequestKubernetesResource
+		cond      types.RoleConditionType
+		expected  bool
+	}{
+		// Deny not match.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Deny, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Deny, false},
+		{gk{kind: "deployments", group: "batch"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "batch"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Deny, false},
+		// Same checks with allow.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "batch"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "batch"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Allow, false},
+
+		// Deny match.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		// Same checks with allow.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "deployments", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "ap*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+
+		// Allow not match. Some dups from earlier, but keeping them for logic, before it was the counter-part of the deny, here it is the main check.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ba*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "a*"}, types.Allow, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ba*"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, false},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, false},
+		// Same checks with deny.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Deny, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ba*"}, types.Deny, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "jobs", APIGroup: "*"}, types.Deny, false},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "a*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "batch"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "batch"}, types.Deny, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ba*"}, types.Deny, false},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+
+		// Allow match. Some dups from earlier, but keeping them for logic, before it was the counter-part of the deny, here it is the main check.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ap*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Allow, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ap*"}, types.Allow, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Allow, true},
+		// Same checks with deny.
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ap*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "deployments", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "deployments", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "apps"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+		{gk{kind: "*", group: "apps"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "ap*"}, types.Deny, true},
+		{gk{kind: "*", group: "*"}, types.RequestKubernetesResource{Kind: "*", APIGroup: "*"}, types.Deny, true},
+	}
+
+	for i, test := range tests {
+		t.Run(fmt.Sprint(i), func(t *testing.T) {
+			if result := matchRequestKubernetesResources(test.input, test.reference, test.cond); result != test.expected {
+				checkType := "allow"
+				if test.cond == types.Deny {
+					checkType = "deny"
+				}
+				t.Fatalf("Checking '%s.%s' %s by '%s.%s', expected %t, got %t",
+					test.input.kind, test.input.group, checkType, test.reference.Kind, test.reference.APIGroup, test.expected, result)
+			}
+		})
+	}
+}
+
+func TestMCPToolMatcher(t *testing.T) {
+	roleWithSpecificAllow := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V8,
+		Metadata: types.Metadata{
+			Name:      "ai_user",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				MCP: &types.MCPPermissions{
+					Tools: []string{
+						"allow_literal",
+						"^allow(_regex)+$",
+						"allow_glob*",
+					},
+				},
+			},
+		},
+	}
+
+	roleWithWildcardAllow := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V8,
+		Metadata: types.Metadata{
+			Name:      "ai_user",
+			Namespace: apidefaults.Namespace,
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				MCP: &types.MCPPermissions{
+					Tools: []string{"*"},
+				},
+			},
+			Deny: types.RoleConditions{
+				MCP: &types.MCPPermissions{
+					Tools: []string{"deny_literal"},
+				},
+			},
+		},
+	}
+
+	tests := []struct {
+		testToolName  string
+		testRole      types.Role
+		testCondition types.RoleConditionType
+		requireMatch  require.BoolAssertionFunc
+	}{
+		{
+			testToolName:  "deny_empty",
+			testRole:      roleWithSpecificAllow,
+			testCondition: types.Deny,
+			requireMatch:  require.False,
+		},
+		{
+			testToolName:  "allow_literal",
+			testRole:      roleWithSpecificAllow,
+			testCondition: types.Allow,
+			requireMatch:  require.True,
+		},
+		{
+			testToolName:  "allow_regex_regex",
+			testRole:      roleWithSpecificAllow,
+			testCondition: types.Allow,
+			requireMatch:  require.True,
+		},
+		{
+			testToolName:  "allow_globbb",
+			testRole:      roleWithSpecificAllow,
+			testCondition: types.Allow,
+			requireMatch:  require.True,
+		},
+		{
+			testToolName:  "allow_wildcard",
+			testRole:      roleWithWildcardAllow,
+			testCondition: types.Allow,
+			requireMatch:  require.True,
+		},
+		{
+			testToolName:  "deny_literal",
+			testRole:      roleWithWildcardAllow,
+			testCondition: types.Deny,
+			requireMatch:  require.True,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.testToolName, func(t *testing.T) {
+			matcher := MCPToolMatcher{
+				Name: tt.testToolName,
+			}
+			match, err := matcher.Match(tt.testRole, tt.testCondition)
+			require.NoError(t, err)
+			tt.requireMatch(t, match)
+		})
+	}
+}
+
+func TestNewEnumerationResultFromEntities(t *testing.T) {
+	tests := []struct {
+		name         string
+		inputAllowed []string
+		inputDenied  []string
+		wantAllowed  []string
+		wantDenied   []string
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name:         "wildcard denied",
+			inputAllowed: []string{"allow_entry"},
+			inputDenied:  []string{"deny_entry", "*"},
+			wantDenied:   []string{"*"},
+		},
+		{
+			name:         "wildcard allowed",
+			inputAllowed: []string{"allow_entry", "*", "deny_overwrite"},
+			inputDenied:  []string{"deny_overwrite"},
+			wantAllowed:  []string{"*", "allow_entry"},
+			wantDenied:   []string{"deny_overwrite"},
+		},
+		{
+			name:         "no wildcard",
+			inputAllowed: []string{"allow_entry_1", "deny_overwrite", "allow_entry_2"},
+			inputDenied:  []string{"deny_overwrite", "deny_entry"},
+			wantAllowed:  []string{"allow_entry_1", "allow_entry_2"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := NewEnumerationResultFromEntities(test.inputAllowed, test.inputDenied)
+
+			actualAllowed, actualDenied := result.ToEntities()
+			require.Equal(t, test.wantAllowed, actualAllowed)
+			require.Equal(t, test.wantDenied, actualDenied)
+		})
+	}
+}
+
+func TestSessionRecordingRBAC(t *testing.T) {
+	newUser := func(name string, traits map[string][]string, roles []string) types.User {
+		user, err := types.NewUser(name)
+		require.NoError(t, err)
+		user.SetTraits(traits)
+		user.SetRoles(roles)
+		return user
+	}
+	newRole := func(allow, deny *types.Rule) *types.RoleV6 {
+		var denyRules []types.Rule
+		var denyNamespaces []string
+		if deny != nil {
+			denyRules = []types.Rule{*deny}
+			denyNamespaces = []string{apidefaults.Namespace}
+		}
+		var allowRules []types.Rule
+		if allow != nil {
+			allowRules = []types.Rule{*allow}
+		}
+		return &types.RoleV6{
+			Metadata: types.Metadata{
+				Name:      "test-role",
+				Namespace: apidefaults.Namespace,
+			},
+			Spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					Namespaces: []string{apidefaults.Namespace},
+					NodeLabels: types.Labels{
+						"env": []string{"prod"},
+					},
+					Rules: allowRules,
+				},
+				Deny: types.RoleConditions{
+					Rules:      denyRules,
+					Namespaces: denyNamespaces,
+				},
+			},
+		}
+	}
+
+	newServer := func(name string, labels map[string]string) types.Server {
+		server, err := types.NewServer(name, types.KindNode, types.ServerSpecV2{})
+		require.NoError(t, err)
+		server.SetStaticLabels(labels)
+		return server
+	}
+
+	serverWithAccess := newServer("server-with-access", map[string]string{
+		"env": "prod",
+	})
+
+	serverWithoutAccess := newServer("server-without-access", map[string]string{
+		"env": "dev",
+	})
+
+	alice := newUser(
+		"alice",
+		map[string][]string{
+			"group": {"prod"},
+			"team":  {"engineering"},
+		}, []string{"role1"})
+
+	bob := newUser(
+		"bob",
+		map[string][]string{
+			"group": {"prod"},
+			"team":  {"engineering"},
+		}, []string{"role1"})
+
+	john := newUser(
+		"john",
+		map[string][]string{
+			"group": {"sre"},
+			"team":  {"sre"},
+		}, []string{"role2"})
+
+	testCases := []struct {
+		name                     string
+		roles                    RoleSet
+		accessRequestResourceIds []types.ResourceID
+		context                  Context
+		errCheck                 require.ErrorAssertionFunc
+	}{
+		{
+			name:  "0 - empty role set has access to nothing",
+			roles: RoleSet{},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "1 - user can read session",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "2 - user can read session with trait match",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], "prod")`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "3 - user can not read session with missing trait match",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], "missing")`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "4 - alice user can read session if he is a participant",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(session.participants, user.metadata.name)`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+
+		{
+			name: "5 - bob user can read session if he is a participant",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(session.participants, user.metadata.name)`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "6 - john user can not read session because he is a participant",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(session.participants, user.metadata.name)`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "7 - alice can read session if server label matches",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], session.server_labels["env"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "8 - john can not read session because server label doesn't match",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], session.server_labels["env"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "9 - bob can read session if he shares any role with the session user",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_any(user.spec.roles, session.user_roles)`,
+				}, nil),
+			},
+			context: Context{
+				User:    bob,
+				Session: newSessionEndEvent(),
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "10 - john can not read session because he shares no roles with the session user",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_any(user.spec.roles, session.user_roles)`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "11 - bob can read session if he belongs to the same team as the session user",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "12 - john can not read session because he belongs to a different team",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "13 - bob can read session if he belongs to the same team as the session user",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newWindowsSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "14 - john can not read session because he belongs to a different team",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newWindowsSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "15 - alice can't read session because of deny rule",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+				}, nil),
+				newRole(nil, &types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], "prod")`,
+				}),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "15 - alice can read session because of deny rule does not match",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+				}, nil),
+				newRole(nil, &types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], "missing")`,
+				}),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "16 - alice can read session because she can access the server",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view()`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "17 - alice can not read session because she can't access the server",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view()`,
+				}, nil),
+			},
+			context: Context{
+				User:     alice,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithoutAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "18 - alice can not read session because resource doesn't exist",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view()`,
+				}, nil),
+			},
+			context: Context{
+				User:    alice,
+				Session: newSessionEndEvent(),
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "19 - bob can read session because he has access and belongs to the same team as the session user",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view() && contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "20 - john can not read session because he has access but belongs to a different team",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view() && contains_all(user.spec.traits["team"], session.user_traits["team"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "21 - bob can read database session because his group matches with env label for database",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], session.db_labels["env"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newDatabaseSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "21 - john can not read database session because his group does not match with env label for database",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `contains(user.spec.traits["group"], session.db_labels["env"])`,
+				}, nil),
+			},
+			context: Context{
+				User:     john,
+				Session:  newDatabaseSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "20 - bob can read session because he has access request for the server",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view()`,
+				}, nil),
+			},
+			accessRequestResourceIds: []types.ResourceID{
+				{
+					ClusterName: "local",
+					Kind:        types.KindNode,
+					Name:        serverWithAccess.GetName(),
+				},
+			},
+			context: Context{
+				User:     bob,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+		{
+			name: "21 - bob can't read session because he has access request for a different server",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `can_view()`,
+				}, nil),
+			},
+			accessRequestResourceIds: []types.ResourceID{
+				{
+					ClusterName: "local",
+					Kind:        types.KindNode,
+					Name:        serverWithoutAccess.GetName(),
+				},
+			},
+			context: Context{
+				User:     bob,
+				Session:  newSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "22 - bob can't read windows session because his role references session.server_labels",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `session.server_labels["env"]=="prod"`,
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newWindowsSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: requireAccessDenied,
+		},
+		{
+			name: "23 - bob can read windows session one of his roles allow it",
+			roles: RoleSet{
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+					Where:     `session.server_labels["env"]=="prod"`,
+				}, nil),
+				newRole(&types.Rule{
+					Resources: []string{types.KindSession},
+					Verbs:     []string{types.VerbRead},
+				}, nil),
+			},
+			context: Context{
+				User:     bob,
+				Session:  newWindowsSessionEndEvent(),
+				Resource: serverWithAccess,
+			},
+			errCheck: require.NoError,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			tc.context.AccessChecker = NewAccessCheckerWithRoleSet(&AccessInfo{AllowedResourceIDs: tc.accessRequestResourceIds}, "local", tc.roles)
+			result := tc.roles.CheckAccessToRule(&tc.context, apidefaults.Namespace, types.KindSession, types.VerbRead)
+			tc.errCheck(t, result)
+		})
+	}
+}
+
+func newSessionEndEvent() *apievents.SessionEnd {
+	startTime := time.Date(2020, 3, 30, 15, 58, 54, 561*int(time.Millisecond), time.UTC)
+	endTime := startTime.Add(time.Minute)
+	return &apievents.SessionEnd{
+		Metadata: apievents.Metadata{
+			Index: 20,
+			Type:  "session.end",
+			ID:    "da455e0f-c27d-459f-a218-4e83b3db9426",
+			Code:  "T2004I",
+			Time:  endTime,
+		},
+		ServerMetadata: apievents.ServerMetadata{
+			ServerVersion:   teleport.Version,
+			ServerID:        "6a7c593d-345a-431f-9e21-4049be982fa5",
+			ServerNamespace: "default",
+			ServerLabels:    map[string]string{"env": "prod"},
+		},
+		SessionMetadata: apievents.SessionMetadata{
+			SessionID: "cb116fb0-9227-4889-9392-aedd13a914a6",
+		},
+		UserMetadata: apievents.UserMetadata{
+			User:      "alice",
+			UserRoles: []string{"role1"},
+			UserTraits: map[string][]string{
+				"group": {"prod"},
+				"team":  {"engineering"},
+			},
+		},
+		EnhancedRecording: true,
+		Interactive:       true,
+		Participants:      []string{"alice", "bob"},
+		StartTime:         startTime,
+		EndTime:           endTime,
+	}
+}
+
+func newWindowsSessionEndEvent() *apievents.WindowsDesktopSessionEnd {
+	startTime := time.Date(2020, 3, 30, 15,
+		58, 54, 561*int(time.Millisecond), time.UTC)
+	endTime := startTime.Add(time.Minute)
+	return &apievents.WindowsDesktopSessionEnd{
+		Metadata: apievents.Metadata{
+			Index: 20,
+			Type:  "session.end",
+			ID:    "da455e0f-c27d-459f-a218-4e83b3db9426",
+			Code:  "T2004I",
+			Time:  endTime,
+		},
+		DesktopLabels: map[string]string{"env": "prod"},
+		UserMetadata: apievents.UserMetadata{
+			User:      "alice",
+			UserRoles: []string{"role1"},
+			UserTraits: map[string][]string{
+				"group": {"prod"},
+				"team":  {"engineering"},
+			},
+		},
+		Participants: []string{"alice", "bob"},
+		StartTime:    startTime,
+		EndTime:      endTime,
+	}
+}
+
+func newDatabaseSessionEndEvent() *apievents.DatabaseSessionEnd {
+	startTime := time.Date(2020, 3, 30, 15,
+		58, 54, 561*int(time.Millisecond), time.UTC)
+	endTime := startTime.Add(time.Minute)
+	return &apievents.DatabaseSessionEnd{
+		Metadata: apievents.Metadata{
+			Index: 20,
+			Type:  "session.end",
+			ID:    "da455e0f-c27d-459f-a218-4e83b3db9426",
+			Code:  "T2004I",
+			Time:  endTime,
+		},
+		DatabaseMetadata: apievents.DatabaseMetadata{
+			DatabaseLabels: map[string]string{"env": "prod"},
+		},
+		UserMetadata: apievents.UserMetadata{
+			User:      "alice",
+			UserRoles: []string{"role1"},
+			UserTraits: map[string][]string{
+				"group": {"prod"},
+				"team":  {"engineering"},
+			},
+		},
+		StartTime: startTime,
+		EndTime:   endTime,
+	}
+}
diff --git a/lib/services/scim.go b/lib/services/scim.go
index 0aea09d1e4a33..6823954cfe743 100644
--- a/lib/services/scim.go
+++ b/lib/services/scim.go
@@ -32,4 +32,5 @@ type SCIM interface {
 	UpdateSCIMResource(context.Context, *scimpb.UpdateSCIMResourceRequest) (*scimpb.Resource, error)
 	CreateSCIMResource(context.Context, *scimpb.CreateSCIMResourceRequest) (*scimpb.Resource, error)
 	DeleteSCIMResource(context.Context, *scimpb.DeleteSCIMResourceRequest) (*emptypb.Empty, error)
+	PatchSCIMResource(context.Context, *scimpb.PatchSCIMResourceRequest) (*scimpb.Resource, error)
 }
diff --git a/lib/services/scoped.go b/lib/services/scoped.go
new file mode 100644
index 0000000000000..83ed122dc5caf
--- /dev/null
+++ b/lib/services/scoped.go
@@ -0,0 +1,104 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package services
+
+import (
+	"context"
+
+	scopedaccessclient "github.com/gravitational/teleport/api/client/scopes/access"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+)
+
+// ScopedAccessClientGetter provides a method to get a scoped access service client. This interface works directly with
+// the API client, but sub-components should prefer to use more specific interfaces where possible.
+type ScopedAccessClientGetter interface {
+	// ScopedAccessServiceClient returns a client for the scoped access service.
+	ScopedAccessServiceClient() *scopedaccessclient.Client
+}
+
+// ScopedAccess provides an API for managing scoped access-control resources.
+type ScopedAccess interface {
+	ScopedAccessReader
+	ScopedAccessWriter
+}
+
+// ScopedAccessReader provides an interface for reading scoped access resources.
+type ScopedAccessReader interface {
+	ScopedRoleReader
+	ScopedRoleAssignmentReader
+}
+
+// CachedScopedAccessReader extends ScopedAccessReader with cache-specific methods.
+type CachedScopedAccessReader interface {
+	ScopedAccessReader
+
+	// ListScopedRolesWithFilter returns a paginated list of scoped roles filtered by the provided filter function. This
+	// method is used internally to implement access-controls on the ListScopedRoles grpc method.
+	ListScopedRolesWithFilter(context.Context, *scopedaccessv1.ListScopedRolesRequest, func(*scopedaccessv1.ScopedRole) bool) (*scopedaccessv1.ListScopedRolesResponse, error)
+
+	// ListScopedRoleAssignmentsWithFilter returns a paginated list of scoped role assignments filtered by the provided
+	// filter function. This method is used internally to implement access-controls on the ListScopedRoleAssignments grpc
+	// method.
+	ListScopedRoleAssignmentsWithFilter(context.Context, *scopedaccessv1.ListScopedRoleAssignmentsRequest, func(*scopedaccessv1.ScopedRoleAssignment) bool) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error)
+}
+
+// ScopedAccessWriter provides an interface for writing scoped access resources.
+type ScopedAccessWriter interface {
+	ScopedRoleWriter
+	ScopedRoleAssignmentWriter
+}
+
+// ScopedRoleReader provides an interface for reading scoped roles.
+type ScopedRoleReader interface {
+	// GetScopedRole gets a scoped role by name.
+	GetScopedRole(context.Context, *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error)
+
+	// ListScopedRoles returns a paginated list of scoped roles.
+	ListScopedRoles(context.Context, *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error)
+}
+
+// ScopedRoleWriter provides an interface for writing scoped roles.
+type ScopedRoleWriter interface {
+	// CreateScopedRole creates a new scoped role.
+	CreateScopedRole(context.Context, *scopedaccessv1.CreateScopedRoleRequest) (*scopedaccessv1.CreateScopedRoleResponse, error)
+
+	// UpdateScopedRole updates a scoped role.
+	UpdateScopedRole(context.Context, *scopedaccessv1.UpdateScopedRoleRequest) (*scopedaccessv1.UpdateScopedRoleResponse, error)
+
+	// DeleteScopedRole deletes a scoped role.
+	DeleteScopedRole(context.Context, *scopedaccessv1.DeleteScopedRoleRequest) (*scopedaccessv1.DeleteScopedRoleResponse, error)
+}
+
+// ScopedRoleAssignmentReader provides an interface for reading scoped role assignments.
+type ScopedRoleAssignmentReader interface {
+	// GetScopedRoleAssignment gets a scoped role assignment by name.
+	GetScopedRoleAssignment(context.Context, *scopedaccessv1.GetScopedRoleAssignmentRequest) (*scopedaccessv1.GetScopedRoleAssignmentResponse, error)
+
+	// ListScopedRoleAssignments returns a paginated list of scoped role assignments.
+	ListScopedRoleAssignments(context.Context, *scopedaccessv1.ListScopedRoleAssignmentsRequest) (*scopedaccessv1.ListScopedRoleAssignmentsResponse, error)
+}
+
+// ScopedRoleAssignmentWriter provides an interface for writing scoped role assignments.
+type ScopedRoleAssignmentWriter interface {
+	// CreateScopedRoleAssignment creates a new scoped role assignment.
+	CreateScopedRoleAssignment(context.Context, *scopedaccessv1.CreateScopedRoleAssignmentRequest) (*scopedaccessv1.CreateScopedRoleAssignmentResponse, error)
+
+	// DeleteScopedRoleAssignment deletes a scoped role assignment.
+	DeleteScopedRoleAssignment(context.Context, *scopedaccessv1.DeleteScopedRoleAssignmentRequest) (*scopedaccessv1.DeleteScopedRoleAssignmentResponse, error)
+}
diff --git a/lib/services/scoped_access_checker.go b/lib/services/scoped_access_checker.go
new file mode 100644
index 0000000000000..5fba8490b857e
--- /dev/null
+++ b/lib/services/scoped_access_checker.go
@@ -0,0 +1,526 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/scopes/pinning"
+	"github.com/gravitational/teleport/lib/utils/once"
+)
+
+// ErrScopedIdentity is returned when a component intended for use only with unscoped identities receives a scoped
+// identity. Methods that implement scoping support may check for this error and fallback to scoped authorization
+// as appropriate.
+var ErrScopedIdentity = &trace.AccessDeniedError{
+	Message: "scoped identities not supported",
+}
+
+// ScopedAccessCheckerContext is the top-level scoped access checker state. It builds and caches scoped access
+// checkers "at" specific scopes, based on a user's identity.
+type ScopedAccessCheckerContext struct {
+	builder scopedAccessCheckerBuilder
+	// cachedCheckerForScope wraps builder.newCheckerAtScope with a [once.KeyedValue] to retain previously built
+	// checkers. this retention behavior is intended to support APIs that require multiple separate scoped
+	// access checks to be performed for separate resources within the same request.
+	cachedCheckerForScope func(ctx context.Context, scope string) (*ScopedAccessChecker, error)
+}
+
+// NewScopedAccessCheckerContext builds a scoped access checker context for a given identity. The context is
+// used to build scoped access checkers at various scopes, and to evaluate access to resources within those
+// scopes. Note that the supplied context.Context is captured and used to propagate cancellation during loading
+// of scoped roles. Cancellation of the context while access checks are still in progress may result in
+// spurious access denied errors.
+func NewScopedAccessCheckerContext(ctx context.Context, info *AccessInfo, localCluster string, reader ScopedRoleReader) (*ScopedAccessCheckerContext, error) {
+	builder := scopedAccessCheckerBuilder{
+		info:         info,
+		localCluster: localCluster,
+		reader:       reader,
+	}
+
+	if err := builder.Check(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cachedCheckerForScope, _ := once.KeyedValue(builder.newCheckerAtScope)
+
+	return &ScopedAccessCheckerContext{
+		builder:               builder,
+		cachedCheckerForScope: cachedCheckerForScope,
+	}, nil
+}
+
+// ScopePin returns the scope pin that this context was created from.
+func (c *ScopedAccessCheckerContext) ScopePin() *scopesv1.Pin {
+	return c.builder.info.ScopePin
+}
+
+// CheckersForResourceScope returns a stream of scoped access checkers, descending from root to the specified resource
+// scope. This is the mechanism that *must* be used for getting checkers when checking access to a resource. This
+// method both evaluates immediate compliance of the resource scope with the scope pin, and yields correctly ordered
+// checkers for resource access evaluation. Subsequent decision parameterization must be performed with the checker that
+// yielded the initial allow decision.
+func (c *ScopedAccessCheckerContext) CheckersForResourceScope(ctx context.Context, scope string) stream.Stream[*ScopedAccessChecker] {
+	return c.checkersForResourceScope(ctx, scope, true /* enforce pin */)
+}
+
+// RiskyUnpinnedCheckersForResourceScope returns a stream of scoped access checkers, descending from root to the specified
+// resource scope, but does not enforce the pinning scope. This is a risky operation that should only be used for certain APIs
+// that make an exception to pinning exclusion rules (e.g. allowing read operations to succeed for resources in a parent to the
+// pinned scope).
+func (c *ScopedAccessCheckerContext) RiskyUnpinnedCheckersForResourceScope(ctx context.Context, scope string) stream.Stream[*ScopedAccessChecker] {
+	// this method is a risky variant of CheckersForResourceScope that does not enforce the pinning scope, and should only be used
+	// in contexts where the caller is certain that the resource scope is compatible with the pinning scope.
+	return c.checkersForResourceScope(ctx, scope, false /* enforce pin */)
+}
+
+func (c *ScopedAccessCheckerContext) checkersForResourceScope(ctx context.Context, scope string, enforcePin bool) stream.Stream[*ScopedAccessChecker] {
+	return func(yield func(*ScopedAccessChecker, error) bool) {
+		// deny immediately if the resource scope is not subject to the pinned scope. note that this denial isn't just an
+		// optimization, we have to perform this check separately from whatever access checks are performed by particular
+		// checkers. This is vital as the pin scope itself may deny access to a resource that would be permitted by any
+		// particular checker. For example, if a user has a scoped role assigned at /foo which grants access to all ssh
+		// nodes, but they are pinned to scope /foo/bar, the checker at /foo needs to permit access to all nodes subject to
+		// /foo, but the pin only permits access to resources subject to /foo/bar, even if the final allow decision is
+		// determined by a checker at /foo.
+		if enforcePin && !pinning.PinAppliesToResourceScope(c.builder.info.ScopePin, scope) {
+			yield(nil, trace.AccessDenied("scope pin %q does not apply to resource scope %q", c.builder.info.ScopePin.GetScope(), scope))
+			return
+		}
+
+		for checkerScope := range scopes.DescendingScopes(scope) {
+			checker, err := c.cachedCheckerForScope(ctx, checkerScope)
+			if err != nil {
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			if !yield(checker, nil) {
+				return
+			}
+		}
+	}
+}
+
+// RiskyEnumerateCheckers returns a stream of all possible scoped access checkers for the identity in an undefined order. This method
+// is not relevant for traditional access-control decisions as it yields checkers unrelated to any particular resource scope, but is
+// necessary for examining the full set of possible permissions during certain operations, such as when determining the full set of
+// ssh logins that a use might have access to. Note that use of this method should be treated with extreme caution.  Accidental misuse
+// could easily result in a scope isolation violation.
+func (c *ScopedAccessCheckerContext) RiskyEnumerateCheckers(ctx context.Context) stream.Stream[*ScopedAccessChecker] {
+	return func(yield func(*ScopedAccessChecker, error) bool) {
+		for scope := range c.builder.info.ScopePin.Assignments {
+			checker, err := c.cachedCheckerForScope(ctx, scope)
+			if err != nil {
+				yield(nil, trace.Wrap(err))
+				return
+			}
+
+			if !yield(checker, nil) {
+				return
+			}
+		}
+	}
+}
+
+// scopedAccessCheckerBuilder is a helper that builds scoped access checkers.
+type scopedAccessCheckerBuilder struct {
+	info         *AccessInfo
+	localCluster string
+	reader       ScopedRoleReader
+}
+
+// Check verifies that the builder was provided will all necessary parameters and that they are well-formed.
+func (b *scopedAccessCheckerBuilder) Check() error {
+	if b.reader == nil {
+		return trace.BadParameter("cannot create scoped access checkers without a scoped role reader")
+	}
+
+	if b.localCluster == "" {
+		return trace.BadParameter("cannot create scoped access checkers without a local cluster name")
+	}
+
+	if b.info.ScopePin == nil {
+		return trace.BadParameter("cannot create scoped access checkers for unscoped identity")
+	}
+
+	if len(b.info.AllowedResourceIDs) != 0 {
+		return trace.BadParameter("cannot create scoped access checkers for identity with active resource IDs")
+	}
+
+	// validate that the scope pin is well-formed
+	if err := pinning.WeakValidate(b.info.ScopePin); err != nil {
+		return trace.Errorf("cannot create scoped access checkers: %w", err)
+	}
+
+	return nil
+}
+
+func (b *scopedAccessCheckerBuilder) newCheckerAtScope(ctx context.Context, scope string) (*ScopedAccessChecker, error) {
+	// TODO(fspmarshall/scopes): implement the ability to pull already loaded roles from parent checkers
+	// in order to reduce redunant role fetches.
+
+	// validate that the target scope is compatible with the scope pin. note that this check is conceptually
+	// distinct from checking whether or not the pinned scope permits access to resources at the target scope.
+	// scope pinning rules disallow access to resources that are not equivalent or descendant to the pinned
+	// scope, but during access evaluation we must create checkers for all parent scopes as well. this check
+	// just verifies that we aren't creating a checker for an *orthogonal* scope. a full access-control check
+	// implementation must use [ScopedAccessCheckerContext.CheckersForResourceScope] in order to ensure that
+	// pinning is properly enforced for the resource scope.
+	if !pinning.PinCompatibleWithPolicyScope(b.info.ScopePin, scope) {
+		return nil, trace.AccessDenied("an identity pinned to scope %q cannot inform access decisions at scope %q", b.info.ScopePin.GetScope(), scope)
+	}
+
+	// fetch all assigned scoped roles and convert them to classic roles to drive the underlying access checks.
+	// we need to use the unchecked variant of assignments for resource scope because the standard variant
+	// refuses to produce an iterator for a scope that is a parent of the pinned scope, and this method will
+	// get called to build parent checkers as part of legitimate access checks. it is the responsibility of the
+	// caller of this method to determine that it is being used in a context that respects correct pinning rules.
+	var roles []types.Role
+	for scope, assigned := range pinning.AssignmentsForResourceScopeUnchecked(b.info.ScopePin, scope) {
+		if len(assigned.GetRoles()) == 0 {
+			continue
+		}
+
+		rolesForScope, err := fetchAndConvertScopedRoles(ctx, scope, assigned.GetRoles(), b.reader)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		roles = append(roles, rolesForScope...)
+	}
+
+	checker := newAccessChecker(b.info, b.localCluster, NewRoleSet(roles...))
+
+	return &ScopedAccessChecker{
+		scope:   scope,
+		checker: checker,
+	}, nil
+}
+
+// ScopedAccessChecker is similar to AccessChecker, but performs scoped checks. Note that usage patterns differ with
+// scoped access checks in comparison to standard access checkers since scoped access checkers can be set up "at"
+// various scopes, and the scope of subsequent checks may depend on the scope at which an allow was reached in a
+// previous check. For example, if an allow decision was reached for ssh access at a particular node, then checks for
+// parameters (e.g. x11 forwarding) must be performed at that same scope, even if that scope is a parent of the
+// node's scope rather than the node's scope itself. On the other hand, a ListNodes operation should have read
+// permssions for each individual node evaluated starting from the root scope, and descending to the node's scope if
+// necessary. In general, a decision *about* access to a resource always happens at the highest scope along the
+// resource's scope path at which primary access to the resource is allowed.
+type ScopedAccessChecker struct {
+	scope   string
+	checker *accessChecker
+}
+
+// RiskyNewScopedAccessCheckerAtScope creates a scoped access checker at the specified scope. Note that creating a scoped
+// access checker at a specific target scope rather than using [ScopedAccessCheckerContext] is typically incorrect as it
+// bypasses scope pin enforcement. This function exists solely to support a few niche use-cases where standard scope pinning
+// behavior is not applicable.
+func RiskyNewScopedAccessCheckerAtScope(ctx context.Context, scope string, info *AccessInfo, localCluster string, reader ScopedRoleReader) (*ScopedAccessChecker, error) {
+	builder := scopedAccessCheckerBuilder{
+		info:         info,
+		localCluster: localCluster,
+		reader:       reader,
+	}
+
+	if err := builder.Check(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return builder.newCheckerAtScope(ctx, scope)
+}
+
+// Scope returns the scope "at" which the checker was created. A scoped access checker created at a given scope includes
+// all scoped roles assigned to the user at that scope, and all ancestral scopes.
+func (c *ScopedAccessChecker) Scope() string {
+	return c.scope
+}
+
+// ScopePin returns the scope pin that this checker was created from.
+func (c *ScopedAccessChecker) ScopePin() *scopesv1.Pin {
+	return c.checker.info.ScopePin
+}
+
+// Traits returns the set of user traits.
+func (c *ScopedAccessChecker) Traits() wrappers.Traits {
+	// identical in scoped/unscoped contexts generally (there is no concept of
+	// scoped traits currently, and none is planned or would be feasible at least
+	// until we've fully migrated to PDP and deprecated certificate-based traits).
+	return c.checker.Traits()
+}
+
+// CheckAccessToRules verifies that *all* of a series of verbs are permitted for the specified resource.
+func (c *ScopedAccessChecker) CheckAccessToRules(ctx RuleContext, resource string, verbs ...string) error {
+	return checkAccessToRulesImpl(c.checker, ctx, resource, verbs...)
+}
+
+// CheckAccessToRemoteCluster checks access to remote cluster
+func (c *ScopedAccessChecker) CheckAccessToRemoteCluster(cluster types.RemoteCluster) error {
+	// remote cluster access is never permitted for scoped identities
+	// NOTE: it is unclear whether or not this method should even be implemented for the scoped access checker. it may be more
+	// sensible to force outer enforcement logic to grapple with the fact that a scoped checker does not support remote clusters
+	// at the type-level. this has been implemented experimentally to explore the pattern of having the scoped access checker
+	// implement methods that always deny for unsupported features.
+	return trace.AccessDenied("remote cluster access is not permitted for scoped identities")
+}
+
+// CheckLoginDuration checks if role set can login up to given duration and
+// returns a combined list of allowed logins.
+func (c *ScopedAccessChecker) CheckLoginDuration(ttl time.Duration) ([]string, error) {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.CheckLoginDuration(ttl)
+}
+
+// AdjustSessionTTL will reduce the requested ttl to lowest max allowed TTL
+// for this role set, otherwise it returns ttl unchanged
+func (c *ScopedAccessChecker) AdjustSessionTTL(ttl time.Duration) time.Duration {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.AdjustSessionTTL(ttl)
+}
+
+// PrivateKeyPolicy returns the enforced private key policy for this role set,
+// or the provided defaultPolicy - whichever is stricter.
+func (c *ScopedAccessChecker) PrivateKeyPolicy(defaultPolicy keys.PrivateKeyPolicy) (keys.PrivateKeyPolicy, error) {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.PrivateKeyPolicy(defaultPolicy)
+}
+
+// PinSourceIP forces the same client IP for certificate generation and SSH usage
+func (c *ScopedAccessChecker) PinSourceIP() bool {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.PinSourceIP()
+}
+
+// CanPortForward returns true if this RoleSet can forward ports.
+func (c *ScopedAccessChecker) CanPortForward() bool {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+
+	// NOTE: internally this method relies upon the SSHPortForwardMode() method. if future work
+	// on the scoped access checker causes us to change the behavior of that method, we will
+	// need to rework this method as well to ensure that it behaves consistently.
+	return c.checker.CanPortForward()
+}
+
+// CanForwardAgents returns true if this role set offers capability to forward
+// agents.
+func (c *ScopedAccessChecker) CanForwardAgents() bool {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.CanForwardAgents()
+}
+
+// PermitX11Forwarding returns true if this RoleSet allows X11 Forwarding.
+func (c *ScopedAccessChecker) PermitX11Forwarding() bool {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.PermitX11Forwarding()
+}
+
+// LockingMode returns the locking mode to apply with this checker.
+func (c *ScopedAccessChecker) LockingMode(defaultMode constants.LockingMode) constants.LockingMode {
+	// the naive implementation of this method for scopes may have problematic interactions with
+	// cert parameter generation. see ../scopes/access/compat.go for more detailed discussion.
+	return c.checker.LockingMode(defaultMode)
+}
+
+// AccessInfo returns the AccessInfo that this access checker is based on.
+func (c *ScopedAccessChecker) AccessInfo() *AccessInfo {
+	return c.checker.info
+}
+
+// HostSudoers returns the sudoers rules for the host.
+func (c *ScopedAccessChecker) HostSudoers(srv types.Server) ([]string, error) {
+	// scoped roles do not currently support host sudoers, but we don't currently foresee
+	// issues with mirroring the classic role interface here since host sudoers are not
+	// certificate-bound and are not calculated pre-access-check. depeding on wether or not
+	// we end up permitting scoped roles side-effects, the server parameter may be unnecessary.
+	return c.checker.HostSudoers(srv)
+}
+
+// EnhancedRecordingSet returns the set of enhanced session recording
+// events to capture.
+func (c *ScopedAccessChecker) EnhancedRecordingSet() map[string]bool {
+	// scoped roles do not currently support enhanced session recording, but we don't currently
+	// foresee issues with mirroring the classic role interface here since enhanced session
+	// recording settings are not certificate-bound and are not calculated pre-access-check.
+	return c.checker.EnhancedRecordingSet()
+}
+
+// HostUsers returns host user information matching a server or nil if
+// a role disallows host user creation
+func (c *ScopedAccessChecker) HostUsers(srv types.Server) (*decisionpb.HostUsersInfo, error) {
+	// scoped roles do not currently support host users, but we don't currently foresee
+	// issues with mirroring the classic role interface here since host users are not
+	// certificate-bound and are not calculated pre-access-check. depeding on wether or not
+	// we end up permitting scoped roles side-effects, the server parameter may be unnecessary.
+	return c.checker.HostUsers(srv)
+}
+
+// CheckAgentForward checks if the role can request to forward the SSH agent
+// for this user.
+func (c *ScopedAccessChecker) CheckAgentForward(login string) error {
+	// scoped roles do not currently support agent forwarding, but we don't currently foresee
+	// issues with mirroring the classic role interface for the login-dependant variant of the
+	// check since this variant of the check is not related to the certificate-bound agent forwarding
+	// permission, and is not calculated pre-access-check. depeding on wether or not
+	// we end up permitting scoped roles side-effects, the login parameter may be unnecessary.
+	return c.checker.CheckAgentForward(login)
+}
+
+// MaxConnections returns the maximum number of concurrent ssh connections
+// allowed.  If MaxConnections is zero then no maximum was defined
+// and the number of concurrent connections is unconstrained.
+func (c *ScopedAccessChecker) MaxConnections() int64 {
+	// scoped roles do not currently support max connections, but we don't currently foresee
+	// issues with mirroring the classic role interface here since max connections is not
+	// certificate-bound and is not calculated pre-access-check.
+	return c.checker.MaxConnections()
+}
+
+// MaxSessions returns the maximum number of concurrent ssh sessions
+// per connection.  If MaxSessions is zero then no maximum was defined
+// and the number of sessions is unconstrained.
+func (c *ScopedAccessChecker) MaxSessions() int64 {
+	// scoped roles do not currently support max sessions, but we don't currently foresee
+	// issues with mirroring the classic role interface here since max sessions is not
+	// certificate-bound and is not calculated pre-access-check.
+	return c.checker.MaxSessions()
+}
+
+// CanCopyFiles returns true if the role set has enabled remote file
+// operations via SCP or SFTP.
+func (c *ScopedAccessChecker) CanCopyFiles() bool {
+	// scoped roles do not currently support remote file operations, but we don't currently foresee
+	// issues with mirroring the classic role interface here since remote file operation permission
+	// is not certificate-bound and is not calculated pre-access-check.
+	return c.checker.CanCopyFiles()
+}
+
+// SSHPortForwardMode returns the SSHPortForwardMode.
+func (c *ScopedAccessChecker) SSHPortForwardMode() decisionpb.SSHPortForwardMode {
+	// scoped roles do not currently support port forwarding modes, but we don't currently foresee
+	// issues with mirroring the classic role interface here sine this method is not certificate-bound
+	// and is not calculated pre-access-check. note that due to the fact that the more general
+	// CanPortForward() method does affect certificate parameters, this method's behavior is currently
+	// determined by some hard-coding in ../scopes/access/compat.go. this method isn't currently useful
+	// as a result, but resolution of questions around the port forwarding certificate parameter will
+	// unblock this method.
+	return c.checker.SSHPortForwardMode()
+}
+
+// AdjustClientIdleTimeout adjusts requested idle timeout
+// to the lowest max allowed timeout, the most restrictive
+// option will be picked, negative values will be assumed as 0
+func (c *ScopedAccessChecker) AdjustClientIdleTimeout(timeout time.Duration) time.Duration {
+	// scoped roles do not currently support client idle timeouts, but we don't currently foresee
+	// issues with mirroring the classic role interface here and this method is not used to
+	// derive certificate parameters.  *however*, there are some usages of this method that
+	// are not pre-access-check. This method can be used now for post-access-check adjustments,
+	// but further work will need to be done to determine how we want to handle client idle
+	// timeouts in the context of scoped roles. See ../scopes/access/compat.go for more
+	// discussion.
+	return c.checker.AdjustClientIdleTimeout(timeout)
+}
+
+// AdjustDisconnectExpiredCert adjusts the value based on the role set
+// the most restrictive option will be picked
+func (c *ScopedAccessChecker) AdjustDisconnectExpiredCert(disconnect bool) bool {
+	// scoped roles do not currently support disconnect on expired certs, but we don't currently foresee
+	// issues with mirroring the classic role interface here since this method is not used to
+	// derive certificate parameters. *however*, there are some usages of this method that
+	// are not pre-access-check. This method can be used now for post-access-check adjustments,
+	// but further work will need to be done to determine how we want to handle disconnect on
+	// expired certs in the context of scoped roles. See ../scopes/access/compat.go for more
+	// discussion.
+	return c.checker.AdjustDisconnectExpiredCert(disconnect)
+}
+
+// SessionRecordingMode returns the recording mode for a specific service.
+func (c *ScopedAccessChecker) SessionRecordingMode(service constants.SessionRecordingService) constants.SessionRecordingMode {
+	// scoped roles do not currently support session recording modes, but we don't currently foresee
+	// issues with mirroring the classic role interface here since session recording mode is not
+	// certificate-bound and is not calculated pre-access-check.
+	return c.checker.SessionRecordingMode(service)
+}
+
+// CheckAccessToSSHServer checks access to an SSH server with optional role matchers. Note that this function
+// is a thin wrapper around the standard [AccessChecker.CheckAccess] method. The purpose of this method is to
+// provide a more constrained access-checking API since the majority of access-checkable resources are not
+// supported by scopes yet.
+func (c *ScopedAccessChecker) CheckAccessToSSHServer(target types.Server, state AccessState, osUser string) error {
+	return c.checker.CheckAccess(
+		target,
+		state,
+		NewLoginMatcher(osUser),
+	)
+}
+
+// CanAccessSSHServer is a helper method that checkes whether access to the specified SSH server is possible.
+// This method is used to determine read access to SSH servers, and does not take into account elements like
+// MFA state or os login. This helper is based on the behavior of auth.resourceChecker.CanAccess. The purpose
+// of this method is to provide a more constrained access-checking API since the majority of access-checkable
+// resources are not supported by scopes yet.
+func (c *ScopedAccessChecker) CanAccessSSHServer(target types.Server) error {
+	return c.checker.CheckAccess(target, AccessState{MFAVerified: true})
+}
+
+// fetchAndConvertScopedRoles fetches scoped roles by name and converts them to classic roles.
+func fetchAndConvertScopedRoles(ctx context.Context, scope string, names []string, reader ScopedRoleReader) ([]types.Role, error) {
+	roles := make([]types.Role, 0, len(names))
+	for _, name := range names {
+		rsp, err := reader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+			Name: name,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		role, err := scopedaccess.ScopedRoleToRole(rsp.Role, scope)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// TODO(fspmarshall): figure out how/when we want to support trait interpolation in scoped
+		// roles. When we do, that will likely need to be done here. Wether we should perform trait
+		// interpolation on the per-conversion scoped role and add support piecemeal, or inherit
+		// identical trait interpolation from classic role behavior isn't clear yet, so at this
+		// stage we're just opting to skip entirely.
+
+		roles = append(roles, role)
+	}
+
+	return roles, nil
+}
diff --git a/lib/services/scoped_tokens.go b/lib/services/scoped_tokens.go
new file mode 100644
index 0000000000000..7900d9dc37111
--- /dev/null
+++ b/lib/services/scoped_tokens.go
@@ -0,0 +1,43 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services
+
+import (
+	"context"
+
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+)
+
+// ScopedTokenService handles CRUD operations for the ScopedToken resource.
+type ScopedTokenService interface {
+	// CreateScopedToken creates a scoped join token.
+	CreateScopedToken(ctx context.Context, req *joiningv1.CreateScopedTokenRequest) (*joiningv1.CreateScopedTokenResponse, error)
+
+	// GetScopedToken fetches a scoped join token by unique name
+	GetScopedToken(ctx context.Context, req *joiningv1.GetScopedTokenRequest) (*joiningv1.GetScopedTokenResponse, error)
+
+	// UseScopedToken fetches a scoped join token by unique name and checks if it can
+	// be used for provisioning. If the token is expired, [UseScopedToken] should also
+	// delete it from the backend.
+	UseScopedToken(ctx context.Context, name string) (*joiningv1.ScopedToken, error)
+	// ListScopedTokens retrieves a paginated list of scoped join tokens
+	ListScopedTokens(ctx context.Context, req *joiningv1.ListScopedTokensRequest) (*joiningv1.ListScopedTokensResponse, error)
+
+	// DeleteScopedToken deletes a named scoped join token. Imlementations must guarantee that
+	// this returns trace.NotFound error if the token doesn't exist
+	DeleteScopedToken(ctx context.Context, req *joiningv1.DeleteScopedTokenRequest) (*joiningv1.DeleteScopedTokenResponse, error)
+}
diff --git a/lib/services/semaphore.go b/lib/services/semaphore.go
index b8ec7e96b1347..4917fcee9813f 100644
--- a/lib/services/semaphore.go
+++ b/lib/services/semaphore.go
@@ -175,7 +175,7 @@ func (l *SemaphoreLock) keepAlive() {
 			defer cancel()
 			err = l.cfg.Service.CancelSemaphoreLease(cancelContext, lease)
 			if err != nil {
-				slog.WarnContext(cancelContext, "Failed to cancel semaphore lease %s/%s: %v",
+				slog.WarnContext(cancelContext, "Failed to cancel semaphore lease",
 					"semaphore_kind", lease.SemaphoreKind,
 					"semaphore_name", lease.SemaphoreName,
 					"error", err,
@@ -255,6 +255,11 @@ type AcquireSemaphoreWithRetryConfig struct {
 	Service types.Semaphores
 	Request types.AcquireSemaphoreRequest
 	Retry   retryutils.LinearConfig
+	// TTL, if set, will be used to set the expiry of the request.
+	TTL time.Duration
+	// Now, if set, will be used instead of time.Now when calculating the expiry
+	// of the request.
+	Now func() time.Time
 }
 
 // AcquireSemaphoreWithRetry tries to acquire the semaphore according to the
@@ -264,9 +269,16 @@ func AcquireSemaphoreWithRetry(ctx context.Context, req AcquireSemaphoreWithRetr
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if req.Now == nil {
+		req.Now = time.Now
+	}
 	var lease *types.SemaphoreLease
 	err = retry.For(ctx, func() (err error) {
-		lease, err = req.Service.AcquireSemaphore(ctx, req.Request)
+		r := req.Request
+		if req.TTL > 0 {
+			r.Expires = req.Now().Add(req.TTL)
+		}
+		lease, err = req.Service.AcquireSemaphore(ctx, r)
 		return trace.Wrap(err)
 	})
 	if err != nil {
diff --git a/lib/services/server.go b/lib/services/server.go
index 638524b2bfa96..d5b9f122365a1 100644
--- a/lib/services/server.go
+++ b/lib/services/server.go
@@ -25,7 +25,6 @@ import (
 	"slices"
 	"time"
 
-	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -128,7 +127,30 @@ func compareServers(a, b types.Server) int {
 	if !slices.Equal(a.GetProxyIDs(), b.GetProxyIDs()) {
 		return Different
 	}
-	if !cmp.Equal(a.GetGitHub(), b.GetGitHub()) {
+
+	if a.GetRelayGroup() != b.GetRelayGroup() {
+		return Different
+	}
+	if !slices.Equal(a.GetRelayIDs(), b.GetRelayIDs()) {
+		return Different
+	}
+
+	if (a.GetGitHub() == nil && b.GetGitHub() != nil) ||
+		(a.GetGitHub() != nil && b.GetGitHub() == nil) {
+		return Different
+	}
+
+	if a.GetGitHub() != nil && b.GetGitHub() != nil {
+		if a.GetGitHub().Integration != b.GetGitHub().Integration {
+			return Different
+		}
+
+		if a.GetGitHub().Organization != b.GetGitHub().Organization {
+			return Different
+		}
+	}
+
+	if a.GetScope() != b.GetScope() {
 		return Different
 	}
 	// OnlyTimestampsDifferent check must be after all Different checks.
@@ -155,12 +177,21 @@ func compareApplicationServers(a, b types.AppServer) int {
 	if !r.Matches(b.GetRotation()) {
 		return Different
 	}
-	if !cmp.Equal(a.GetApp(), b.GetApp()) {
+	if !a.GetApp().IsEqual(b.GetApp()) {
 		return Different
 	}
 	if !slices.Equal(a.GetProxyIDs(), b.GetProxyIDs()) {
 		return Different
 	}
+	if a.GetRelayGroup() != b.GetRelayGroup() {
+		return Different
+	}
+	if !slices.Equal(a.GetRelayIDs(), b.GetRelayIDs()) {
+		return Different
+	}
+	if a.GetScope() != b.GetScope() {
+		return Different
+	}
 	// OnlyTimestampsDifferent check must be after all Different checks.
 	if !a.Expiry().Equal(b.Expiry()) {
 		return OnlyTimestampsDifferent
@@ -211,12 +242,21 @@ func compareKubernetesServers(a, b types.KubeServer) int {
 	if !r.Matches(b.GetRotation()) {
 		return Different
 	}
-	if !cmp.Equal(a.GetCluster(), b.GetCluster()) {
+	if !a.GetCluster().IsEqual(b.GetCluster()) {
 		return Different
 	}
 	if !slices.Equal(a.GetProxyIDs(), b.GetProxyIDs()) {
 		return Different
 	}
+	if a.GetRelayGroup() != b.GetRelayGroup() {
+		return Different
+	}
+	if !slices.Equal(a.GetRelayIDs(), b.GetRelayIDs()) {
+		return Different
+	}
+	if a.GetScope() != b.GetScope() {
+		return Different
+	}
 	// OnlyTimestampsDifferent check must be after all Different checks.
 	if !a.Expiry().Equal(b.Expiry()) {
 		return OnlyTimestampsDifferent
@@ -241,12 +281,21 @@ func compareDatabaseServers(a, b types.DatabaseServer) int {
 	if !r.Matches(b.GetRotation()) {
 		return Different
 	}
-	if !cmp.Equal(a.GetDatabase(), b.GetDatabase()) {
+	if !a.GetDatabase().IsEqual(b.GetDatabase()) {
 		return Different
 	}
 	if !slices.Equal(a.GetProxyIDs(), b.GetProxyIDs()) {
 		return Different
 	}
+	if a.GetRelayGroup() != b.GetRelayGroup() {
+		return Different
+	}
+	if !slices.Equal(a.GetRelayIDs(), b.GetRelayIDs()) {
+		return Different
+	}
+	if a.GetScope() != b.GetScope() {
+		return Different
+	}
 	// OnlyTimestampsDifferent check must be after all Different checks.
 	if !a.Expiry().Equal(b.Expiry()) {
 		return OnlyTimestampsDifferent
@@ -270,6 +319,12 @@ func compareWindowsDesktopServices(a, b types.WindowsDesktopService) int {
 	if !slices.Equal(a.GetProxyIDs(), b.GetProxyIDs()) {
 		return Different
 	}
+	if a.GetRelayGroup() != b.GetRelayGroup() {
+		return Different
+	}
+	if !slices.Equal(a.GetRelayIDs(), b.GetRelayIDs()) {
+		return Different
+	}
 	// OnlyTimestampsDifferent check must be after all Different checks.
 	if !a.Expiry().Equal(b.Expiry()) {
 		return OnlyTimestampsDifferent
diff --git a/lib/services/servers_test.go b/lib/services/servers_test.go
index 359698bc52e30..ed67d92f3449f 100644
--- a/lib/services/servers_test.go
+++ b/lib/services/servers_test.go
@@ -105,6 +105,11 @@ func TestServersCompare(t *testing.T) {
 			},
 		}
 		require.Equal(t, Different, CompareServers(node, &node2))
+
+		// Scope has changed
+		node2 = *node
+		node2.Scope = "test"
+		require.Equal(t, Different, CompareServers(node, &node2))
 	})
 
 	t.Run("compare DatabaseServices", func(t *testing.T) {
diff --git a/lib/services/services_test.go b/lib/services/services_test.go
index d7f3a277a7440..86e0d4b4f8b23 100644
--- a/lib/services/services_test.go
+++ b/lib/services/services_test.go
@@ -28,11 +28,11 @@ import (
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/services/session.go b/lib/services/session.go
index 69f56e369581e..ab6a7524b149c 100644
--- a/lib/services/session.go
+++ b/lib/services/session.go
@@ -19,7 +19,9 @@
 package services
 
 import (
+	"context"
 	"encoding/json"
+	"iter"
 
 	"github.com/gravitational/trace"
 
@@ -83,6 +85,24 @@ func MarshalWebSession(webSession types.WebSession, opts ...MarshalOption) ([]by
 	}
 }
 
+// WebToken defines an interface for managing web token resources.
+type WebToken interface {
+	// GetWebToken gets a web token.
+	GetWebToken(context.Context, types.GetWebTokenRequest) (types.WebToken, error)
+	// GetWebTokens gets all web tokens.
+	GetWebTokens(context.Context) ([]types.WebToken, error)
+	// ListWebTokens returns a page of web tokens
+	ListWebTokens(ctx context.Context, limit int, start string) ([]types.WebToken, string, error)
+	// RangeWebTokens returns web tokens within the range [start, end).
+	RangeWebTokens(ctx context.Context, start, end string) iter.Seq2[types.WebToken, error]
+	// UpsertWebToken updates the existing or inserts a new web token.
+	UpsertWebToken(context.Context, types.WebToken) error
+	// DeleteWebToken deletes a web token.
+	DeleteWebToken(context.Context, types.DeleteWebTokenRequest) error
+	// DeleteAllWebTokens deletes all web tokens.
+	DeleteAllWebTokens(context.Context) error
+}
+
 // MarshalWebToken serializes the web token as JSON-encoded payload
 func MarshalWebToken(webToken types.WebToken, opts ...MarshalOption) ([]byte, error) {
 	cfg, err := CollectOptions(opts)
diff --git a/lib/services/session_recording.go b/lib/services/session_recording.go
new file mode 100644
index 0000000000000..0486d2c70934d
--- /dev/null
+++ b/lib/services/session_recording.go
@@ -0,0 +1,112 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package services
+
+import (
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+)
+
+// ExtendWithSessionEnd extends the context with a session end event and
+// rebuilds the resource from the event. An AccessChecker must be provided
+// to allow access checks to other resources in the where clause.
+func (ctx *Context) ExtendWithSessionEnd(sessionEnd apievents.AuditEvent, checker AccessChecker) {
+	ctx.Session = sessionEnd
+	ctx.Resource = rebuildResourceFromSessionEndEvent(sessionEnd)
+	// AccessCheker is set here to allow access checks to other resources
+	// in the where clause.
+	ctx.AccessChecker = checker
+}
+
+// rebuildResourceFromSessionEndEvent rebuilds a resource from a session end event.
+// This is used to reconstruct the resource that was active at the time of the session end event
+// for audit log RBAC purposes.
+func rebuildResourceFromSessionEndEvent(event apievents.AuditEvent) types.Resource {
+	switch sEnd := event.(type) {
+	case *apievents.SessionEnd:
+		if sEnd == nil {
+			return nil
+		}
+		switch sEnd.Protocol {
+		case apievents.EventProtocolSSH:
+			return &types.ServerV2{
+				Kind:    types.KindNode,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name:      sEnd.ServerMetadata.ServerID,
+					Namespace: sEnd.ServerMetadata.ServerNamespace,
+					Labels:    sEnd.ServerMetadata.ServerLabels,
+				},
+				Spec: types.ServerSpecV2{
+					Addr:     sEnd.ServerMetadata.ServerAddr,
+					Hostname: sEnd.ServerMetadata.ServerHostname,
+				},
+			}
+		case apievents.EventProtocolKube:
+			return &types.KubernetesClusterV3{
+				Kind:    types.KindKubernetesCluster,
+				Version: types.V3,
+				Metadata: types.Metadata{
+					Name:      sEnd.KubernetesClusterMetadata.KubernetesCluster,
+					Namespace: apidefaults.Namespace,
+					Labels:    sEnd.KubernetesClusterMetadata.KubernetesLabels,
+				},
+				Spec: types.KubernetesClusterSpecV3{},
+			}
+		}
+	case *apievents.WindowsDesktopSessionEnd:
+		if sEnd == nil {
+			return nil
+		}
+		return &types.WindowsDesktopV3{
+			ResourceHeader: types.ResourceHeader{
+				Kind:    types.KindWindowsDesktop,
+				Version: types.V3,
+				Metadata: types.Metadata{
+					Name:      sEnd.DesktopName,
+					Namespace: apidefaults.Namespace,
+					Labels:    sEnd.DesktopLabels,
+				},
+			},
+			Spec: types.WindowsDesktopSpecV3{
+				Addr:   sEnd.DesktopAddr,
+				Domain: sEnd.Domain,
+			},
+		}
+	case *apievents.DatabaseSessionEnd:
+		if sEnd == nil {
+			return nil
+		}
+		return &types.DatabaseV3{
+			Kind:    types.KindDatabase,
+			Version: types.V3,
+			Metadata: types.Metadata{
+				Name:      sEnd.DatabaseService,
+				Namespace: apidefaults.Namespace,
+				Labels:    sEnd.DatabaseLabels,
+			},
+			Spec: types.DatabaseSpecV3{
+				Protocol: sEnd.DatabaseProtocol,
+				URI:      sEnd.DatabaseURI,
+			},
+		}
+	}
+	return nil
+}
diff --git a/lib/services/session_recording_test.go b/lib/services/session_recording_test.go
new file mode 100644
index 0000000000000..699bd34a4110c
--- /dev/null
+++ b/lib/services/session_recording_test.go
@@ -0,0 +1,209 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package services
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+)
+
+func TestRebuildResourceFromSessionEndEvent(t *testing.T) {
+	tests := []struct {
+		name  string
+		event apievents.AuditEvent
+		want  types.Resource
+	}{
+		{
+			name:  "nil event",
+			event: nil,
+			want:  nil,
+		},
+		{
+			name:  "nil with type set session.end",
+			event: (*apievents.SessionEnd)(nil),
+			want:  nil,
+		},
+		{
+			name:  "nil with type set windows.desktop.session.end",
+			event: (*apievents.WindowsDesktopSessionEnd)(nil),
+			want:  nil,
+		},
+		{
+			name:  "nil with type set database.session.end",
+			event: (*apievents.DatabaseSessionEnd)(nil),
+			want:  nil,
+		},
+		{
+			name: "non session.end event",
+			event: &apievents.UserLogin{
+				Metadata: apievents.Metadata{
+					ClusterName: "test-cluster",
+				},
+				UserMetadata: apievents.UserMetadata{
+					User: "test-user",
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "session.end with SSH session",
+			event: &apievents.SessionEnd{
+				Metadata: apievents.Metadata{
+					ClusterName: "test-cluster",
+				},
+				ConnectionMetadata: apievents.ConnectionMetadata{
+					Protocol: apievents.EventProtocolSSH,
+				},
+				ServerMetadata: apievents.ServerMetadata{
+					ServerID:        "server-id-123",
+					ServerHostname:  "server-host-123",
+					ServerAddr:      "server-addr-123",
+					ServerNamespace: "default",
+					ServerLabels: map[string]string{
+						"env":  "prod",
+						"team": "devops",
+					},
+				},
+			},
+			want: &types.ServerV2{
+				Kind:    types.KindNode,
+				Version: types.V2,
+				Metadata: types.Metadata{
+					Name:      "server-id-123",
+					Namespace: "default",
+					Labels: map[string]string{
+						"env":  "prod",
+						"team": "devops",
+					},
+				},
+				Spec: types.ServerSpecV2{
+					Addr:     "server-addr-123",
+					Hostname: "server-host-123",
+				},
+			},
+		},
+		{
+			name: "session.end for Kube",
+			event: &apievents.SessionEnd{
+				Metadata: apievents.Metadata{
+					ClusterName: "test-cluster",
+				},
+				ConnectionMetadata: apievents.ConnectionMetadata{
+					Protocol: apievents.EventProtocolKube,
+				},
+				KubernetesClusterMetadata: apievents.KubernetesClusterMetadata{
+					KubernetesCluster: "kube-cluster-123",
+					KubernetesLabels: map[string]string{
+						"env":  "staging",
+						"team": "backend",
+					},
+				},
+			},
+			want: &types.KubernetesClusterV3{
+				Kind:    types.KindKubernetesCluster,
+				Version: types.V3,
+				Metadata: types.Metadata{
+					Name:      "kube-cluster-123",
+					Namespace: "default",
+					Labels: map[string]string{
+						"env":  "staging",
+						"team": "backend",
+					},
+				},
+				Spec: types.KubernetesClusterSpecV3{},
+			},
+		},
+		{
+			name: "windows sessio end",
+			event: &apievents.WindowsDesktopSessionEnd{
+				WindowsDesktopService: "win-desktop-service",
+				DesktopName:           "win-desktop-name",
+				DesktopAddr:           "win-desktop-addr",
+				DesktopLabels: map[string]string{
+					"env":  "prod",
+					"team": "devops",
+				},
+			},
+			want: &types.WindowsDesktopV3{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindWindowsDesktop,
+					Version: types.V3,
+					Metadata: types.Metadata{
+						Name:      "win-desktop-name",
+						Namespace: "default",
+						Labels: map[string]string{
+							"env":  "prod",
+							"team": "devops",
+						},
+					},
+				},
+				Spec: types.WindowsDesktopSpecV3{
+					Addr: "win-desktop-addr",
+				},
+			},
+		},
+		{
+			name: "database session end",
+			event: &apievents.DatabaseSessionEnd{
+				DatabaseMetadata: apievents.DatabaseMetadata{
+					DatabaseService: "db-service",
+					DatabaseName:    "db-name",
+					DatabaseLabels: map[string]string{
+						"env":  "qa",
+						"team": "analytics",
+					},
+				},
+			},
+			want: &types.DatabaseV3{
+				Kind:    types.KindDatabase,
+				Version: types.V3,
+				Metadata: types.Metadata{
+					Name:      "db-service",
+					Namespace: "default",
+					Labels: map[string]string{
+						"env":  "qa",
+						"team": "analytics",
+					},
+				},
+				Spec: types.DatabaseSpecV3{},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := rebuildResourceFromSessionEndEvent(tt.event)
+			require.Equal(t, tt.want, got)
+
+			if tt.want == nil {
+				return
+			}
+
+			sctx := &Context{}
+			checker := &accessChecker{}
+			sctx.ExtendWithSessionEnd(tt.event, checker)
+			require.Equal(t, tt.want, sctx.Resource)
+			require.Same(t, checker, sctx.AccessChecker)
+			require.Same(t, tt.event, sctx.Session)
+		})
+	}
+}
diff --git a/lib/services/sessionrecording.go b/lib/services/sessionrecording.go
index 496bf02716276..c808d1048f575 100644
--- a/lib/services/sessionrecording.go
+++ b/lib/services/sessionrecording.go
@@ -19,6 +19,9 @@
 package services
 
 import (
+	"slices"
+	"strings"
+
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
@@ -86,3 +89,60 @@ func MarshalSessionRecordingConfig(recConfig types.SessionRecordingConfig, opts
 		return nil, trace.BadParameter("unrecognized session recording config version %T", recConfig)
 	}
 }
+
+const (
+	KeyTypeAWS      = "aws_kms"
+	KeyTypeGCP      = "gcp_kms"
+	KeyTypePKCS11   = "pkcs11"
+	KeyTypeSoftware = "software"
+)
+
+var errRecordingEncryptionWithFIPS = &trace.BadParameterError{Message: `non-FIPS compliant session recording setting: "encryption" must not be enabled`}
+var errManualKeyManagementInCloud = &trace.BadParameterError{Message: `"manual_key_management" configuration is unsupported in Teleport Cloud`}
+
+// ValidateSessionRecordingConfig checks that the state of a [SessionRecordingConfig] meets constraints.
+func ValidateSessionRecordingConfig(cfg types.SessionRecordingConfig, fips, cloud bool) error {
+	if !slices.Contains(types.SessionRecordingModes, cfg.GetMode()) {
+		return trace.BadParameter("session recording mode must be one of %v; got %q", strings.Join(types.SessionRecordingModes, ","), cfg.GetMode())
+	}
+
+	encryptionCfg := cfg.GetEncryptionConfig()
+	if encryptionCfg == nil || !encryptionCfg.Enabled {
+		return nil
+	}
+
+	if fips && encryptionCfg.Enabled {
+		return trace.Wrap(errRecordingEncryptionWithFIPS)
+	}
+
+	manualKeyManagement := encryptionCfg.ManualKeyManagement
+	if manualKeyManagement == nil || !manualKeyManagement.Enabled {
+		return nil
+	}
+
+	if cloud {
+		return trace.Wrap(errManualKeyManagementInCloud)
+	}
+
+	if len(manualKeyManagement.ActiveKeys) == 0 {
+		return trace.BadParameter("at least one active key must be configured when using manually managed encryption keys")
+	}
+
+	for _, label := range manualKeyManagement.ActiveKeys {
+		switch strings.ToLower(label.Type) {
+		case KeyTypeAWS, KeyTypeGCP, KeyTypePKCS11, KeyTypeSoftware:
+		default:
+			return trace.BadParameter("invalid key type %q found for active manually managed key", label.Type)
+		}
+	}
+
+	for _, label := range manualKeyManagement.RotatedKeys {
+		switch strings.ToLower(label.Type) {
+		case KeyTypeAWS, KeyTypeGCP, KeyTypePKCS11, KeyTypeSoftware:
+		default:
+			return trace.BadParameter("invalid key type %q found for rotated manually managed key", label.Type)
+		}
+	}
+
+	return nil
+}
diff --git a/lib/services/sessionrecording_test.go b/lib/services/sessionrecording_test.go
new file mode 100644
index 0000000000000..afbc5f48ebdb4
--- /dev/null
+++ b/lib/services/sessionrecording_test.go
@@ -0,0 +1,178 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+func TestValidateSessionRecordingConfig(t *testing.T) {
+	cases := []struct {
+		name      string
+		spec      types.SessionRecordingConfigSpecV2
+		params    types.SignatureAlgorithmSuiteParams
+		cloud     bool
+		fips      bool
+		expectErr error
+	}{
+		{
+			name: "valid config",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+			},
+			fips:      true,
+			cloud:     true,
+			expectErr: nil,
+		},
+		{
+			name: "valid config: encryption",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+				},
+			},
+			expectErr: nil,
+		},
+		{
+			name: "valid config: manual encryption",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+					ManualKeyManagement: &types.ManualKeyManagementConfig{
+						Enabled: true,
+						ActiveKeys: []*types.KeyLabel{
+							{
+								Type:  "aws_kms",
+								Label: "test",
+							},
+						},
+					},
+				},
+			},
+			expectErr: nil,
+		},
+		{
+			name: "invalid config: session mode",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "invalid",
+			},
+			expectErr: trace.BadParameter("session recording mode must be one of %v; got %q", strings.Join(types.SessionRecordingModes, ","), "invalid"),
+		},
+		{
+			name: "invalid config: encryption with FIPS",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+				},
+			},
+			fips:      true,
+			expectErr: trace.BadParameter("non-FIPS compliant session recording setting"),
+		},
+		{
+			name: "invalid config: manual encryption in cloud",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+					ManualKeyManagement: &types.ManualKeyManagementConfig{
+						Enabled: true,
+					},
+				},
+			},
+			cloud:     true,
+			expectErr: trace.BadParameter(`"manual_key_management" configuration is unsupported in Teleport Cloud`),
+		},
+		{
+			name: "invalid config: manual encryption without active keys",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+					ManualKeyManagement: &types.ManualKeyManagementConfig{
+						Enabled: true,
+					},
+				},
+			},
+			expectErr: trace.BadParameter("at least one active key must be configured when using manually managed encryption keys"),
+		},
+		{
+			name: "invalid config: invalid manual key type",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+					ManualKeyManagement: &types.ManualKeyManagementConfig{
+						Enabled: true,
+						ActiveKeys: []*types.KeyLabel{
+							{
+								Type:  "unsupported",
+								Label: "test",
+							},
+						},
+					},
+				},
+			},
+			expectErr: trace.BadParameter("invalid key type \"unsupported\" found for active manually managed key"),
+		},
+		{
+			name: "invalid config: invalid manual rotated key type",
+			spec: types.SessionRecordingConfigSpecV2{
+				Mode: "node",
+				Encryption: &types.SessionRecordingEncryptionConfig{
+					Enabled: true,
+					ManualKeyManagement: &types.ManualKeyManagementConfig{
+						Enabled: true,
+						ActiveKeys: []*types.KeyLabel{
+							{
+								Type:  "pkcs11",
+								Label: "test",
+							},
+						},
+						RotatedKeys: []*types.KeyLabel{
+							{
+								Type:  "unsupported",
+								Label: "test",
+							},
+						},
+					},
+				},
+			},
+			expectErr: trace.BadParameter("invalid key type \"unsupported\" found for rotated manually managed key"),
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := services.ValidateSessionRecordingConfig(&types.SessionRecordingConfigV2{Spec: c.spec}, c.fips, c.cloud)
+			if c.expectErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, c.expectErr.Error())
+			}
+		})
+	}
+}
diff --git a/lib/services/sessiontracker.go b/lib/services/sessiontracker.go
index ed1419ba3d50d..c59fa37acc67a 100644
--- a/lib/services/sessiontracker.go
+++ b/lib/services/sessiontracker.go
@@ -50,7 +50,7 @@ type SessionTrackerService interface {
 	RemoveSessionTracker(ctx context.Context, sessionID string) error
 
 	// UpdatePresence updates the presence status of a user in a session.
-	UpdatePresence(ctx context.Context, sessionID, user string) error
+	UpdatePresence(ctx context.Context, sessionID, user, userCluster string) error
 }
 
 // UnmarshalSessionTracker unmarshals the Session resource from JSON.
diff --git a/lib/services/split_access_checker.go b/lib/services/split_access_checker.go
new file mode 100644
index 0000000000000..875b94426a066
--- /dev/null
+++ b/lib/services/split_access_checker.go
@@ -0,0 +1,349 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/api/utils/keys"
+	dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/sshca"
+)
+
+// CommonAccessChecker defines the common methods that are identical across both scoped and unscoped access checkers.
+type CommonAccessChecker interface {
+	AccessInfo() *AccessInfo
+	Traits() wrappers.Traits
+	CheckLoginDuration(ttl time.Duration) ([]string, error)
+	AdjustSessionTTL(ttl time.Duration) time.Duration
+	PrivateKeyPolicy(defaultPolicy keys.PrivateKeyPolicy) (keys.PrivateKeyPolicy, error)
+	PinSourceIP() bool
+	CanPortForward() bool
+	CanForwardAgents() bool
+	PermitX11Forwarding() bool
+	LockingMode(defaultMode constants.LockingMode) constants.LockingMode
+	CheckAccessToRules(ctx RuleContext, resource string, verbs ...string) error
+	HostSudoers(types.Server) ([]string, error)
+	EnhancedRecordingSet() map[string]bool
+	HostUsers(types.Server) (*decisionpb.HostUsersInfo, error)
+	CheckAgentForward(login string) error
+	MaxConnections() int64
+	MaxSessions() int64
+	CanCopyFiles() bool
+	SSHPortForwardMode() decisionpb.SSHPortForwardMode
+	AdjustClientIdleTimeout(timeout time.Duration) time.Duration
+	AdjustDisconnectExpiredCert(disconnect bool) bool
+	SessionRecordingMode(service constants.SessionRecordingService) constants.SessionRecordingMode
+	CheckAccessToSSHServer(target types.Server, state AccessState, osUser string) error
+	CanAccessSSHServer(target types.Server) error
+}
+
+// ScopedAccessCheckerSubset defines the methods that are specific to scoped access checkers.
+type ScopedAccessCheckerSubset interface {
+	ScopePin() *scopesv1.Pin
+}
+
+// UnscopedAccessCheckerSubset defines the methods that are specific to unscoped access checkers.
+type UnscopedAccessCheckerSubset interface {
+	RoleNames() []string
+	CertificateFormat() string
+	GetAllowedResourceIDs() []types.ResourceID
+	CertificateExtensions() []*types.CertExtension
+	CheckAccessToRemoteCluster(cluster types.RemoteCluster) error
+	CheckKubeGroupsAndUsers(ttl time.Duration, overrideTTL bool, matchers ...RoleMatcher) (groups []string, users []string, err error)
+	CheckDatabaseNamesAndUsers(ttl time.Duration, overrideTTL bool) (names []string, users []string, err error)
+	CheckAWSRoleARNs(ttl time.Duration, overrideTTL bool) ([]string, error)
+	CheckAzureIdentities(ttl time.Duration, overrideTTL bool) ([]string, error)
+	CheckGCPServiceAccounts(ttl time.Duration, overrideTTL bool) ([]string, error)
+}
+
+// SplitAccessChecker is used in logic that needs to branch based on whether it is operating on a scoped or unscoped access checker. It
+// provides a Common interface that is always present, and one of either a Scoped or Unscoped interface that is present depending on
+// which underlying access checker is being used. If a method that previously existed on one of the Subset interfaces is implemented
+// by the second checker and moved to the Common interface, then the it should be removed from the Subset interface in order to ensure
+// that we don't continue to accidentally call it on the old location.
+type SplitAccessChecker struct {
+	common   CommonAccessChecker
+	unscoped UnscopedAccessCheckerSubset
+	scoped   ScopedAccessCheckerSubset
+}
+
+func NewUnscopedSplitAccessChecker(checker AccessChecker) *SplitAccessChecker {
+	return &SplitAccessChecker{
+		common:   &accessCheckerShim{checker},
+		unscoped: checker,
+	}
+}
+
+func NewScopedSplitAccessChecker(checker *ScopedAccessChecker) *SplitAccessChecker {
+	return &SplitAccessChecker{
+		common: checker,
+		scoped: checker,
+	}
+}
+
+// Common gets the common access checker interface that is shared between both scoped and unscoped access checkers.
+func (c *SplitAccessChecker) Common() CommonAccessChecker {
+	return c.common
+}
+
+// Unscoped gets the unscoped access checker interface if it is present.
+func (c *SplitAccessChecker) Unscoped() (checker UnscopedAccessCheckerSubset, ok bool) {
+	return c.unscoped, c.unscoped != nil
+}
+
+// Scoped gets the scoped access checker interface if it is present.
+func (c *SplitAccessChecker) Scoped() (checker ScopedAccessCheckerSubset, ok bool) {
+	return c.scoped, c.scoped != nil
+}
+
+// accessCheckerShim provides a compatibility shim to allow using an unscoped checker in a manner more consistent with
+// a scoped access checker. In particular, some scoped access checker methods are simpler than their unscoped equivalents
+// and this shim implemented the simplified versions of those methods.
+type accessCheckerShim struct {
+	AccessChecker
+}
+
+// CheckAccessToRules verifies that *all* of a series of verbs are permitted for the specified resource. This function differs from
+// the unscoped AccessChecker.CheckAccessToRule in a number of ways. It does not support advanced context-based features or namespacing,
+// and accepts a set of verbs all of which must evaluate to allow for the check to succeed.
+func (c *accessCheckerShim) CheckAccessToRules(ctx RuleContext, resource string, verbs ...string) error {
+	return checkAccessToRulesImpl(c.AccessChecker, ctx, resource, verbs...)
+}
+
+// CheckMaybeHasAccessToRules behaves like [AccessChecker.GuessIfAccessIsPossible], except that it supports multiple
+// verbs and does not support namespaces.
+func (c *accessCheckerShim) CheckMaybeHasAccessToRules(ctx RuleContext, resource string, verbs ...string) error {
+	return checkMaybeHasAccessToRulesImpl(c.AccessChecker, ctx, resource, verbs...)
+}
+
+// CheckAccessToSSHServer checks access to an SSH server with optional role matchers. Note that this function
+// is a thin wrapper around the standard [AccessChecker.CheckAccess] method. The purpose of this method is to
+// provide a more constrained access-checking API since the majority of access-checkable resources are not
+// supported by scopes yet.
+func (c *accessCheckerShim) CheckAccessToSSHServer(target types.Server, state AccessState, osUser string) error {
+	return c.AccessChecker.CheckAccess(
+		target,
+		state,
+		NewLoginMatcher(osUser),
+	)
+}
+
+// CanAccessSSHServer is a helper method that checkes whether access to the specified SSH server is possible.
+// This method is used to determine read access to SSH servers, and does not take into account elements like
+// MFA state or os login. This helper is based on the behavior of auth.resourceChecker.CanAccess. The purpose
+// of this method is to provide a more constrained access-checking API since the majority of access-checkable
+// resources are not supported by scopes yet.
+func (c *accessCheckerShim) CanAccessSSHServer(target types.Server) error {
+	return c.AccessChecker.CheckAccess(target, AccessState{MFAVerified: true})
+}
+
+func checkAccessToRulesImpl(checker AccessChecker, ctx RuleContext, resource string, verbs ...string) error {
+	if len(verbs) == 0 {
+		return trace.BadParameter("malformed rule check for %q, no verbs provided (this is a bug)", resource)
+	}
+
+	for _, verb := range verbs {
+		if err := checker.CheckAccessToRule(ctx, apidefaults.Namespace, resource, verb); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+func checkMaybeHasAccessToRulesImpl(checker AccessChecker, ctx RuleContext, resource string, verbs ...string) error {
+	if len(verbs) == 0 {
+		return trace.BadParameter("malformed maybe has access to rule check for %q, no verbs provided (this is a bug)", resource)
+	}
+
+	for _, verb := range verbs {
+		if err := checker.GuessIfAccessIsPossible(ctx, apidefaults.Namespace, resource, verb); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+// SplitAccessCheckerContext is an abstraction to allow passing either a scoped access checker context or a standard access checker
+// to functions that need to operate on either.
+type SplitAccessCheckerContext struct {
+	scopedContext   *ScopedAccessCheckerContext
+	unscopedChecker AccessChecker
+}
+
+// NewUnscopedSplitAccessCheckerContext creates a SplitAccessCheckerContext from an unscoped AccessChecker.
+func NewUnscopedSplitAccessCheckerContext(checker AccessChecker) *SplitAccessCheckerContext {
+	return &SplitAccessCheckerContext{
+		unscopedChecker: checker,
+	}
+}
+
+// NewScopedSplitAccessCheckerContext creates a SplitAccessCheckerContext from a scoped access checker context.
+func NewScopedSplitAccessCheckerContext(ctx *ScopedAccessCheckerContext) *SplitAccessCheckerContext {
+	return &SplitAccessCheckerContext{
+		scopedContext: ctx,
+	}
+}
+
+// Scoped
+func (c *SplitAccessCheckerContext) Scoped() *ScopedAccessCheckerContext {
+	return c.scopedContext
+}
+
+// ScopePin returns the scope pin associated with the context, if any.
+func (c *SplitAccessCheckerContext) ScopePin() (*scopesv1.Pin, bool) {
+	if c.scopedContext == nil {
+		return nil, false
+	}
+	return c.scopedContext.ScopePin(), true
+}
+
+// CheckMaybeHasAccessToRules returns an error if the context definitely does not have access to the provided rules. in practice
+// this currently just serves to exit early in the event that we are dealing with an unscoped identity without appropriate
+// permissions, but it could be extended in future to perform more complex checks if needed.
+func (c *SplitAccessCheckerContext) CheckMaybeHasAccessToRules(ctx RuleContext, resource string, verbs ...string) error {
+	if c.scopedContext == nil {
+		shim := accessCheckerShim{c.unscopedChecker}
+		return shim.CheckMaybeHasAccessToRules(ctx, resource, verbs...)
+	}
+
+	return nil
+}
+
+// CheckersForResourceScope returns a stream of SplitAccessCheckers that are appropriate for the provided resource scope. If the
+// underlying state is scoped this will be a stream of checkers descending to the target resource scope.
+func (c *SplitAccessCheckerContext) CheckersForResourceScope(ctx context.Context, scope string) stream.Stream[*SplitAccessChecker] {
+	return func(yield func(*SplitAccessChecker, error) bool) {
+		if c.scopedContext == nil {
+			yield(NewUnscopedSplitAccessChecker(c.unscopedChecker), nil)
+			return
+		}
+
+		for checker, err := range c.scopedContext.CheckersForResourceScope(ctx, scope) {
+			if err != nil {
+				yield(nil, trace.Wrap(err))
+				return
+			}
+			if !yield(NewScopedSplitAccessChecker(checker), nil) {
+				return
+			}
+		}
+	}
+}
+
+// RiskyUnpinnedCheckersForResourceScope is equivalent to CheckersForResourceScope except that it bypasses enforcement of pinning scope. This is a
+// risky operation that should only be used for certain APIs that make an exception to pinning exclusion rules
+func (c *SplitAccessCheckerContext) RiskyUnpinnedCheckersForResourceScope(ctx context.Context, scope string) stream.Stream[*SplitAccessChecker] {
+	return func(yield func(*SplitAccessChecker, error) bool) {
+		if c.scopedContext == nil {
+			yield(NewUnscopedSplitAccessChecker(c.unscopedChecker), nil)
+			return
+		}
+
+		for checker, err := range c.scopedContext.RiskyUnpinnedCheckersForResourceScope(ctx, scope) {
+			if err != nil {
+				yield(nil, trace.Wrap(err))
+				return
+			}
+			if !yield(NewScopedSplitAccessChecker(checker), nil) {
+				return
+			}
+		}
+	}
+}
+
+// Decision is a helper function that takes care of boilerplate for simple potentially scoped decisions.  It calls
+// the provided decision function until one of three conditions is met:
+//
+// 1. Decision function executes without error (allow)
+// 2. Decision function returns an AccessExplicitlyDenied error (explicit deny)
+// 3. Checkers for all scopes in resource scope path have been visited (implicit deny)
+func (c *SplitAccessCheckerContext) Decision(ctx context.Context, scope string, fn func(*SplitAccessChecker) error) error {
+	return c.decision(ctx, c.CheckersForResourceScope(ctx, scope), fn)
+}
+
+// RiskyUnpinnedDecision is equivalent to Decision except that it bypasses enforcement of pinning scope. This is a
+// risky operation that should only be used for certain APIs that make an exception to pinning exclusion rules
+// (e.g. allowing read operations to succeed for resources in a parent to the pinned scope).
+func (c *SplitAccessCheckerContext) RiskyUnpinnedDecision(ctx context.Context, scope string, fn func(*SplitAccessChecker) error) error {
+	return c.decision(ctx, c.RiskyUnpinnedCheckersForResourceScope(ctx, scope), fn)
+}
+
+func (c *SplitAccessCheckerContext) decision(ctx context.Context, checkers stream.Stream[*SplitAccessChecker], fn func(*SplitAccessChecker) error) error {
+	for checker, err := range checkers {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		err = fn(checker)
+		switch {
+		case err == nil:
+			return nil
+		case IsAccessExplicitlyDenied(err):
+			return trace.Wrap(err)
+		default:
+			// implicit deny, continue to the next check
+			continue
+		}
+	}
+
+	return trace.AccessDenied("access denied (decision)")
+}
+
+func (c *SplitAccessCheckerContext) AccessStateFromSSHIdentity(ctx context.Context, ident *sshca.Identity, authPrefGetter AuthPreferenceGetter) (AccessState, error) {
+	if c.scopedContext == nil {
+		// in unscoped state, defer to regular access state building
+		return AccessStateFromSSHIdentity(ctx, ident, c.unscopedChecker, authPrefGetter)
+	}
+
+	authPref, err := authPrefGetter.GetAuthPreference(ctx)
+	if err != nil {
+		return AccessState{}, trace.Wrap(err)
+	}
+
+	if authPref.GetRequireMFAType().IsSessionMFARequired() {
+		// TODO(fspmarshall/scopes): implement scoped MFA
+		// NOTE: this will require additional refactoring of relevant access-checking logic. currently, we often
+		// check MFA requirements *before* we determine access to the underlying resource, but a scoped MFA model
+		// will need to first determine the scope of access *before* we can determine whether MFA is required for that scope.
+		return AccessState{}, trace.AccessDenied("cannot perform scoped access when cluster-level MFA is required (scoped MFA is not implemented)")
+	}
+
+	return AccessState{
+		// MFA state is hard-coded here because scoped roles do not support MFA yet, and the above check should reject
+		// cases where cluster-level config would obligate MFA.
+		MFARequired:              MFARequiredNever,
+		MFAVerified:              false,
+		EnableDeviceVerification: true,
+		DeviceVerified:           dtauthz.IsSSHDeviceVerified(ident),
+		IsBot:                    ident.IsBot(),
+	}, nil
+}
diff --git a/lib/services/suite/presence_test.go b/lib/services/suite/presence_test.go
deleted file mode 100644
index 7cc0558635858..0000000000000
--- a/lib/services/suite/presence_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package suite
-
-import (
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-)
-
-func TestServerLabels(t *testing.T) {
-	emptyLabels := make(map[string]string)
-	// empty
-	server := &types.ServerV2{}
-	require.Empty(t, server.GetAllLabels())
-	require.True(t, types.MatchLabels(server, emptyLabels))
-	require.False(t, types.MatchLabels(server, map[string]string{"a": "b"}))
-
-	// more complex
-	server = &types.ServerV2{
-		Metadata: types.Metadata{
-			Labels: map[string]string{
-				"role": "database",
-			},
-		},
-		Spec: types.ServerSpecV2{
-			CmdLabels: map[string]types.CommandLabelV2{
-				"time": {
-					Period:  types.NewDuration(time.Second),
-					Command: []string{"time"},
-					Result:  "now",
-				},
-			},
-		},
-	}
-
-	require.Empty(t, cmp.Diff(server.GetAllLabels(), map[string]string{
-		"role": "database",
-		"time": "now",
-	}))
-
-	require.True(t, types.MatchLabels(server, emptyLabels))
-	require.False(t, types.MatchLabels(server, map[string]string{"a": "b"}))
-	require.True(t, types.MatchLabels(server, map[string]string{"role": "database"}))
-	require.True(t, types.MatchLabels(server, map[string]string{"time": "now"}))
-	require.True(t, types.MatchLabels(server, map[string]string{"time": "now", "role": "database"}))
-}
diff --git a/lib/services/suite/suite.go b/lib/services/suite/suite.go
deleted file mode 100644
index fd474aac6eb71..0000000000000
--- a/lib/services/suite/suite.go
+++ /dev/null
@@ -1,2159 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package suite
-
-import (
-	"context"
-	"crypto/x509/pkix"
-	"fmt"
-	"log/slog"
-	"sort"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/bcrypt"
-	protobuf "google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/testing/protocmp"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/constants"
-	apidefaults "github.com/gravitational/teleport/api/defaults"
-	clusterconfigpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/clusterconfig"
-	"github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tlsca"
-)
-
-// NewTestCA returns new test authority with a test key as a public and
-// signing key
-func NewTestCA(caType types.CertAuthType, clusterName string, privateKeys ...[]byte) *types.CertAuthorityV2 {
-	return NewTestCAWithConfig(TestCAConfig{
-		Type:        caType,
-		ClusterName: clusterName,
-		PrivateKeys: privateKeys,
-		Clock:       clockwork.NewRealClock(),
-	})
-}
-
-// TestCAConfig defines the configuration for generating
-// a test certificate authority
-type TestCAConfig struct {
-	Type        types.CertAuthType
-	PrivateKeys [][]byte
-	Clock       clockwork.Clock
-	ClusterName string
-	// the below string fields default to ClusterName if left empty
-	ResourceName        string
-	SubjectOrganization string
-}
-
-// NewTestCAWithConfig generates a new certificate authority with the specified
-// configuration
-// Keep this function in-sync with lib/auth/auth.go:newKeySet().
-// TODO(jakule): reuse keystore.KeyStore interface to match newKeySet().
-func NewTestCAWithConfig(config TestCAConfig) *types.CertAuthorityV2 {
-	var keyPEM []byte
-	var key *keys.PrivateKey
-
-	if config.ResourceName == "" {
-		config.ResourceName = config.ClusterName
-	}
-	if config.SubjectOrganization == "" {
-		config.SubjectOrganization = config.ClusterName
-	}
-
-	switch config.Type {
-	case types.DatabaseCA, types.SAMLIDPCA, types.OIDCIdPCA:
-		// These CAs only support RSA.
-		keyPEM = fixtures.PEMBytes["rsa"]
-	case types.DatabaseClientCA:
-		// The db client CA also only supports RSA, but some tests rely on it
-		// being different than the DB CA.
-		keyPEM = fixtures.PEMBytes["rsa-db-client"]
-	}
-	if len(config.PrivateKeys) > 0 {
-		// Allow test to override the private key.
-		keyPEM = config.PrivateKeys[0]
-	}
-
-	if keyPEM != nil {
-		var err error
-		key, err = keys.ParsePrivateKey(keyPEM)
-		if err != nil {
-			panic(err)
-		}
-	} else {
-		// If config.PrivateKeys was not set and this CA does not exclusively
-		// support RSA, generate an ECDSA key. Signatures are ~10x faster than
-		// RSA and generating a new key is actually faster than parsing a PEM
-		// fixture.
-		signer, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
-		if err != nil {
-			panic(err)
-		}
-		key, err = keys.NewPrivateKey(signer)
-		if err != nil {
-			panic(err)
-		}
-		keyPEM = key.PrivateKeyPEM()
-	}
-
-	ca := &types.CertAuthorityV2{
-		Kind:    types.KindCertAuthority,
-		SubKind: string(config.Type),
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      config.ResourceName,
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.CertAuthoritySpecV2{
-			Type:        config.Type,
-			ClusterName: config.ClusterName,
-		},
-	}
-
-	// Add SSH keys if necessary.
-	switch config.Type {
-	case types.UserCA, types.HostCA, types.OpenSSHCA:
-		ca.Spec.ActiveKeys.SSH = []*types.SSHKeyPair{{
-			PrivateKey: keyPEM,
-			PublicKey:  key.MarshalSSHPublicKey(),
-		}}
-	}
-
-	// Add TLS keys if necessary.
-	switch config.Type {
-	case types.UserCA, types.HostCA, types.DatabaseCA, types.DatabaseClientCA, types.SAMLIDPCA, types.SPIFFECA, types.AWSRACA:
-		cert, err := tlsca.GenerateSelfSignedCAWithConfig(tlsca.GenerateCAConfig{
-			Signer: key.Signer,
-			Entity: pkix.Name{
-				CommonName:   config.ClusterName,
-				Organization: []string{config.SubjectOrganization},
-			},
-			TTL:   defaults.CATTL,
-			Clock: config.Clock,
-		})
-		if err != nil {
-			panic(err)
-		}
-		ca.Spec.ActiveKeys.TLS = []*types.TLSKeyPair{{
-			Key:  keyPEM,
-			Cert: cert,
-		}}
-	}
-
-	// Add JWT keys if necessary.
-	switch config.Type {
-	case types.JWTSigner, types.OIDCIdPCA, types.SPIFFECA, types.OktaCA, types.BoundKeypairCA:
-		pubKeyPEM, err := keys.MarshalPublicKey(key.Public())
-		if err != nil {
-			panic(err)
-		}
-		ca.Spec.ActiveKeys.JWT = []*types.JWTKeyPair{{
-			PrivateKey: keyPEM,
-			PublicKey:  pubKeyPEM,
-		}}
-	}
-
-	return ca
-}
-
-// ServicesTestSuite is an acceptance test suite
-// for services. It is used for local implementations and implementations
-// using gRPC to guarantee consistency between local and remote services
-type ServicesTestSuite struct {
-	Access         services.Access
-	TrustS         services.Trust
-	TrustInternalS services.TrustInternal
-	PresenceS      services.Presence
-	ProvisioningS  services.Provisioner
-	WebS           services.Identity
-	ConfigS        services.ClusterConfiguration
-	// LocalConfigS is used for local config which can only be
-	// managed by the Auth service directly (static tokens).
-	// Used by some tests to differentiate between a server
-	// and client interface.
-	LocalConfigS  services.ClusterConfigurationInternal
-	EventsS       types.Events
-	UsersS        services.UsersService
-	RestrictionsS services.Restrictions
-	ChangesC      chan interface{}
-	Clock         *clockwork.FakeClock
-}
-
-func (s *ServicesTestSuite) Users() services.UsersService {
-	if s.WebS != nil {
-		return s.WebS
-	}
-	return s.UsersS
-}
-
-func userSlicesEqual(t *testing.T, a []types.User, b []types.User) {
-	require.Lenf(t, a, len(b), "a: %#v b: %#v", a, b)
-
-	sort.Sort(services.Users(a))
-	sort.Sort(services.Users(b))
-
-	for i := range a {
-		usersEqual(t, a[i], b[i])
-	}
-}
-
-func usersEqual(t *testing.T, a types.User, b types.User) {
-	require.True(t, services.UsersEquals(a, b), cmp.Diff(a, b))
-}
-
-func newUser(name string, roles []string) types.User {
-	return &types.UserV2{
-		Kind:    types.KindUser,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      name,
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.UserSpecV2{
-			Roles: roles,
-		},
-	}
-}
-
-func (s *ServicesTestSuite) UsersCRUD(t *testing.T) {
-	ctx := context.Background()
-
-	u, err := s.WebS.GetUsers(ctx, false)
-	require.NoError(t, err)
-	require.Empty(t, u)
-
-	u1 := newUser("user1", nil)
-	u2 := newUser("user2", nil)
-	_, err = s.WebS.CreateUser(ctx, u1)
-	require.NoError(t, err)
-	_, err = s.WebS.CreateUser(ctx, u2)
-	require.NoError(t, err)
-	require.NoError(t, s.WebS.UpsertPassword("user1", []byte("secretpassword123")))
-	require.NoError(t, s.WebS.UpsertPassword("user2", []byte("secretpassword234")))
-
-	u1.SetPasswordState(types.PasswordState_PASSWORD_STATE_SET)
-	u2.SetPasswordState(types.PasswordState_PASSWORD_STATE_SET)
-
-	u, err = s.WebS.GetUsers(ctx, false)
-	require.NoError(t, err)
-	userSlicesEqual(t, u, []types.User{u1, u2})
-
-	out, err := s.WebS.GetUser(ctx, "user1", false)
-	require.NoError(t, err)
-	usersEqual(t, out, u[0])
-
-	user := newUser("user1", []string{"admin", "user"})
-	user, err = s.WebS.UpsertUser(ctx, user)
-	require.NoError(t, err)
-
-	out, err = s.WebS.GetUser(ctx, "user1", false)
-	require.NoError(t, err)
-	usersEqual(t, out, user)
-
-	out, err = s.WebS.GetUser(ctx, "user1", false)
-	require.NoError(t, err)
-	usersEqual(t, out, user)
-
-	require.NoError(t, s.WebS.DeleteUser(ctx, "user1"))
-
-	u, err = s.WebS.GetUsers(ctx, false)
-	require.NoError(t, err)
-	userSlicesEqual(t, u, []types.User{u2})
-
-	err = s.WebS.DeleteUser(ctx, "user1")
-	require.True(t, trace.IsNotFound(err))
-
-	// bad username
-	_, err = s.WebS.UpsertUser(ctx, newUser("", nil))
-	require.True(t, trace.IsBadParameter(err))
-}
-
-func (s *ServicesTestSuite) UsersExpiry(t *testing.T) {
-	ctx := context.Background()
-	expiresAt := s.Clock.Now().Add(1 * time.Minute)
-
-	_, err := s.WebS.UpsertUser(ctx, &types.UserV2{
-		Kind:    types.KindUser,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      "foo",
-			Namespace: apidefaults.Namespace,
-			Expires:   &expiresAt,
-		},
-		Spec: types.UserSpecV2{},
-	})
-	require.NoError(t, err)
-
-	// Make sure the user exists.
-	u, err := s.WebS.GetUser(ctx, "foo", false)
-	require.NoError(t, err)
-	require.Equal(t, "foo", u.GetName())
-
-	s.Clock.Advance(2 * time.Minute)
-
-	// Make sure the user is now gone.
-	_, err = s.WebS.GetUser(ctx, "foo", false)
-	require.Error(t, err)
-}
-
-func (s *ServicesTestSuite) LoginAttempts(t *testing.T) {
-	user1 := uuid.NewString()
-
-	user := newUser(user1, []string{"admin", "user"})
-	user, err := s.WebS.UpsertUser(context.Background(), user)
-	require.NoError(t, err)
-
-	attempts, err := s.WebS.GetUserLoginAttempts(user.GetName())
-	require.NoError(t, err)
-	require.Empty(t, attempts)
-
-	clock := clockwork.NewFakeClock()
-	attempt1 := services.LoginAttempt{Time: clock.Now().UTC(), Success: false}
-	err = s.WebS.AddUserLoginAttempt(user.GetName(), attempt1, defaults.AttemptTTL)
-	require.NoError(t, err)
-
-	attempt2 := services.LoginAttempt{Time: clock.Now().UTC(), Success: false}
-	err = s.WebS.AddUserLoginAttempt(user.GetName(), attempt2, defaults.AttemptTTL)
-	require.NoError(t, err)
-
-	attempts, err = s.WebS.GetUserLoginAttempts(user.GetName())
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(attempts, []services.LoginAttempt{attempt1, attempt2}))
-	require.False(t, services.LastFailed(3, attempts))
-	require.True(t, services.LastFailed(2, attempts))
-}
-
-func (s *ServicesTestSuite) CertAuthCRUD(t *testing.T) {
-	ctx := context.Background()
-	ca := NewTestCA(types.UserCA, "example.com")
-	require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
-
-	out, err := s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(out, ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	cas, err := s.TrustS.GetCertAuthorities(ctx, types.UserCA, false)
-	require.NoError(t, err)
-	ca2 := ca.Clone().(*types.CertAuthorityV2)
-	ca2.Spec.ActiveKeys.SSH[0].PrivateKey = nil
-	ca2.Spec.ActiveKeys.TLS[0].Key = nil
-	require.Empty(t, cmp.Diff(cas[0], ca2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	cas, err = s.TrustS.GetCertAuthorities(ctx, types.UserCA, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(cas[0], ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	cas, err = s.TrustS.GetCertAuthorities(ctx, types.UserCA, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(cas[0], ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.TrustS.DeleteCertAuthority(ctx, *ca.ID())
-	require.NoError(t, err)
-
-	// test compare and swap
-	ca = NewTestCA(types.UserCA, "example.com")
-	require.NoError(t, s.TrustS.CreateCertAuthority(ctx, ca))
-
-	clock := clockwork.NewFakeClock()
-	newCA := *ca
-	rotation := types.Rotation{
-		State:       types.RotationStateInProgress,
-		CurrentID:   "id1",
-		GracePeriod: types.NewDuration(time.Hour),
-		Started:     clock.Now(),
-	}
-	newCA.SetRotation(rotation)
-
-	err = s.TrustS.CompareAndSwapCertAuthority(&newCA, ca)
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(&newCA, out, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// test conditional update
-	ca = NewTestCA(types.UserCA, "update.example.com")
-	rev, err := s.TrustInternalS.CreateCertAuthorities(ctx, ca)
-	require.NoError(t, err)
-
-	newCA = *ca
-	rotation = types.Rotation{
-		State:       types.RotationStateInProgress,
-		CurrentID:   "id1",
-		GracePeriod: types.NewDuration(time.Hour),
-		Started:     clock.Now(),
-	}
-	newCA.SetRotation(rotation)
-
-	// verify that mismatched revision does not work
-	_, err = s.TrustInternalS.UpdateCertAuthority(ctx, &newCA)
-	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
-
-	// verify that revision returned by create causes update to succeed
-	newCA.SetRevision(rev)
-	_, err = s.TrustInternalS.UpdateCertAuthority(ctx, &newCA)
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(&newCA, out, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// verify 'bulk' ca operations
-
-	clusterNames := []string{
-		"foo.example.com",
-		"bar.example.com",
-		"bin.example.com",
-		"baz.example.com",
-	}
-
-	cas = nil
-	for _, cn := range clusterNames {
-		cas = append(cas, NewTestCA(types.UserCA, cn))
-	}
-
-	rev, err = s.TrustInternalS.CreateCertAuthorities(ctx, cas...)
-	require.NoError(t, err)
-
-	// verify that all CAs were created and that they all have the expected revision
-	for _, original := range cas {
-		ca, err := s.TrustS.GetCertAuthority(ctx, original.GetID(), true)
-		require.NoError(t, err)
-		require.Equal(t, rev, ca.GetRevision())
-		require.Empty(t, cmp.Diff(original, ca, cmpopts.EquateApproxTime(time.Second), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	}
-
-	// set up bulk delete
-	var ids []types.CertAuthID
-	for _, ca := range cas {
-		ids = append(ids, ca.GetID())
-	}
-
-	require.NoError(t, s.TrustInternalS.DeleteCertAuthorities(ctx, ids...))
-
-	// verify that bulk deletion succeeded
-	for _, ca := range cas {
-		_, err := s.TrustS.GetCertAuthority(ctx, ca.GetID(), true)
-		require.True(t, trace.IsNotFound(err), "err: %v", err)
-	}
-}
-
-// NewServer creates a new server resource
-func NewServer(kind, name, addr, namespace string) *types.ServerV2 {
-	return &types.ServerV2{
-		Kind:    kind,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Spec: types.ServerSpecV2{
-			Addr: addr,
-		},
-	}
-}
-
-func (s *ServicesTestSuite) ServerCRUD(t *testing.T) {
-	ctx := context.Background()
-
-	// SSH service.
-	out, err := s.PresenceS.GetNodes(ctx, apidefaults.Namespace)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	srv := NewServer(types.KindNode, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
-	srv.Spec.Hostname = "llama"
-	_, err = s.PresenceS.UpsertNode(ctx, srv)
-	require.NoError(t, err)
-
-	node, err := s.PresenceS.GetNode(ctx, srv.Metadata.Namespace, srv.GetName())
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(node, srv, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	out, err = s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out, []types.Server{srv}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.PresenceS.DeleteNode(ctx, srv.Metadata.Namespace, srv.GetName())
-	require.NoError(t, err)
-
-	out, err = s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	// Proxy service.
-	out, err = s.PresenceS.GetProxies()
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	proxy := NewServer(types.KindProxy, "proxy1", "127.0.0.1:2023", apidefaults.Namespace)
-	proxy.Spec.Hostname = "proxy.llama"
-	require.NoError(t, s.PresenceS.UpsertProxy(ctx, proxy))
-
-	out, err = s.PresenceS.GetProxies()
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out, []types.Server{proxy}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.PresenceS.DeleteProxy(ctx, proxy.GetName())
-	require.NoError(t, err)
-
-	out, err = s.PresenceS.GetProxies()
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	// Auth service.
-	out, err = s.PresenceS.GetAuthServers()
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	auth := NewServer(types.KindAuthServer, "auth1", "127.0.0.1:2025", apidefaults.Namespace)
-	auth.Spec.Hostname = "auth.llama"
-	require.NoError(t, s.PresenceS.UpsertAuthServer(ctx, auth))
-
-	out, err = s.PresenceS.GetAuthServers()
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out, []types.Server{auth}, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-}
-
-// AppServerCRUD tests CRUD functionality for services.Server.
-func (s *ServicesTestSuite) AppServerCRUD(t *testing.T) {
-	ctx := context.Background()
-
-	// Expect not to be returned any applications and trace.NotFound.
-	out, err := s.PresenceS.GetApplicationServers(ctx, apidefaults.Namespace)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	// Make an app and an app server.
-	app, err := types.NewAppV3(types.Metadata{Name: "foo"},
-		types.AppSpecV3{URI: "http://127.0.0.1:8080", PublicAddr: "foo.example.com"})
-	require.NoError(t, err)
-	server, err := types.NewAppServerV3(types.Metadata{
-		Name:      app.GetName(),
-		Namespace: apidefaults.Namespace,
-	}, types.AppServerSpecV3{
-		Hostname: "localhost",
-		HostID:   uuid.New().String(),
-		App:      app,
-	})
-	require.NoError(t, err)
-
-	// Upsert application.
-	_, err = s.PresenceS.UpsertApplicationServer(ctx, server)
-	require.NoError(t, err)
-
-	// Check again, expect a single application to be found.
-	out, err = s.PresenceS.GetApplicationServers(ctx, server.GetNamespace())
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff([]types.AppServer{server}, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// Remove the application.
-	err = s.PresenceS.DeleteApplicationServer(ctx, server.Metadata.Namespace, server.GetHostID(), server.GetName())
-	require.NoError(t, err)
-
-	// Now expect no applications to be returned.
-	out, err = s.PresenceS.GetApplicationServers(ctx, server.Metadata.Namespace)
-	require.NoError(t, err)
-	require.Empty(t, out)
-}
-
-func newReverseTunnel(clusterName string, dialAddrs []string) *types.ReverseTunnelV2 {
-	return &types.ReverseTunnelV2{
-		Kind:    types.KindReverseTunnel,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      clusterName,
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.ReverseTunnelSpecV2{
-			ClusterName: clusterName,
-			DialAddrs:   dialAddrs,
-		},
-	}
-}
-
-func (s *ServicesTestSuite) PasswordCRUD(t *testing.T) {
-	ctx := context.Background()
-
-	_, err := s.WebS.GetPasswordHash("user1")
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("%#v", err))
-
-	u1 := newUser("user1", nil)
-	_, err = s.WebS.CreateUser(ctx, u1)
-	require.NoError(t, err)
-
-	err = s.WebS.UpsertPassword("user1", []byte("secretpassword123"))
-	require.NoError(t, err)
-
-	hash, err := s.WebS.GetPasswordHash("user1")
-	require.NoError(t, err)
-	err = bcrypt.CompareHashAndPassword(hash, []byte("secretpassword123"))
-	require.NoError(t, err)
-
-	err = s.WebS.UpsertPassword("user1", []byte("secretpassword321"))
-	require.NoError(t, err)
-
-	hash, err = s.WebS.GetPasswordHash("user1")
-	require.NoError(t, err)
-	err = bcrypt.CompareHashAndPassword(hash, []byte("secretpassword321"))
-	require.NoError(t, err)
-}
-
-func (s *ServicesTestSuite) WebSessionCRUD(t *testing.T) {
-	ctx := context.Background()
-	req := types.GetWebSessionRequest{User: "user1", SessionID: "sid1"}
-	_, err := s.WebS.WebSessions().Get(ctx, req)
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("%#v", err))
-
-	dt := s.Clock.Now().Add(1 * time.Minute)
-	ws, err := types.NewWebSession("sid1", types.KindWebSession,
-		types.WebSessionSpecV2{
-			User:    "user1",
-			Pub:     []byte("pub123"),
-			Priv:    []byte("priv123"),
-			Expires: dt,
-		})
-	require.NoError(t, err)
-
-	err = s.WebS.WebSessions().Upsert(ctx, ws)
-	require.NoError(t, err)
-
-	out, err := s.WebS.WebSessions().Get(ctx, req)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(out, ws, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	ws1, err := types.NewWebSession("sid1", types.KindWebSession,
-		types.WebSessionSpecV2{
-			User:    "user1",
-			Pub:     []byte("pub321"),
-			Priv:    []byte("priv321"),
-			Expires: dt,
-		})
-	require.NoError(t, err)
-
-	err = s.WebS.WebSessions().Upsert(ctx, ws1)
-	require.NoError(t, err)
-
-	out2, err := s.WebS.WebSessions().Get(ctx, req)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(out2, ws1, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	require.NoError(t, s.WebS.WebSessions().Delete(ctx, types.DeleteWebSessionRequest{
-		User:      req.User,
-		SessionID: req.SessionID,
-	}))
-
-	_, err = s.WebS.WebSessions().Get(ctx, req)
-	require.True(t, trace.IsNotFound(err))
-}
-
-func (s *ServicesTestSuite) TokenCRUD(t *testing.T) {
-	ctx := context.Background()
-	_, err := s.ProvisioningS.GetToken(ctx, "token")
-	require.True(t, trace.IsNotFound(err))
-
-	tok, err := types.NewProvisionToken("token", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
-	require.NoError(t, err)
-
-	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
-
-	token, err := s.ProvisioningS.GetToken(ctx, "token")
-	require.NoError(t, err)
-	require.True(t, token.GetRoles().Include(types.RoleAuth))
-	require.True(t, token.GetRoles().Include(types.RoleNode))
-	require.False(t, token.GetRoles().Include(types.RoleProxy))
-	require.Equal(t, time.Time{}, token.Expiry())
-
-	require.NoError(t, s.ProvisioningS.DeleteToken(ctx, "token"))
-
-	_, err = s.ProvisioningS.GetToken(ctx, "token")
-	require.True(t, trace.IsNotFound(err))
-
-	// check tokens backwards compatibility and marshal/unmarshal
-	expiry := time.Now().UTC().Add(time.Hour)
-	v1 := &types.ProvisionTokenV1{
-		Token:   "old",
-		Roles:   types.SystemRoles{types.RoleNode, types.RoleProxy},
-		Expires: expiry,
-	}
-	v2, err := types.NewProvisionToken(v1.Token, v1.Roles, expiry)
-	require.NoError(t, err)
-
-	// Tokens in different version formats are backwards and forwards
-	// compatible
-	require.Empty(t, cmp.Diff(v1.V2(), v2))
-	require.Empty(t, cmp.Diff(v2.V1(), v1))
-
-	// Marshal V1, unmarshal V2
-	data, err := services.MarshalProvisionToken(v2, services.WithVersion(types.V1))
-	require.NoError(t, err)
-
-	out, err := services.UnmarshalProvisionToken(data)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(out, v2))
-
-	// Test delete tokens
-	tok, err = types.NewProvisionToken("token1", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
-	require.NoError(t, err)
-	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
-
-	tok, err = types.NewProvisionToken("token2", types.SystemRoles{types.RoleAuth, types.RoleNode}, time.Time{})
-	require.NoError(t, err)
-	require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
-
-	tokens, err := s.ProvisioningS.GetTokens(ctx)
-	require.NoError(t, err)
-	require.Len(t, tokens, 2)
-
-	err = s.ProvisioningS.DeleteToken(ctx, tokens[0].GetName())
-	require.NoError(t, err)
-
-	err = s.ProvisioningS.DeleteToken(ctx, tokens[1].GetName())
-	require.NoError(t, err)
-
-	tokens, err = s.ProvisioningS.GetTokens(ctx)
-	require.NoError(t, err)
-	require.Empty(t, tokens)
-}
-
-func (s *ServicesTestSuite) RolesCRUD(t *testing.T) {
-	ctx := context.Background()
-
-	out, err := s.Access.GetRoles(ctx)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	role := types.RoleV6{
-		Kind:    types.KindRole,
-		Version: types.V6,
-		Metadata: types.Metadata{
-			Name:      "role1",
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.RoleSpecV6{
-			Options: types.RoleOptions{
-				MaxSessionTTL:     types.Duration(time.Hour),
-				PortForwarding:    types.NewBoolOption(true),
-				CertificateFormat: constants.CertificateFormatStandard,
-				BPF:               apidefaults.EnhancedEvents(),
-			},
-			Allow: types.RoleConditions{
-				Logins:           []string{"root", "bob"},
-				NodeLabels:       types.Labels{types.Wildcard: []string{types.Wildcard}},
-				AppLabels:        types.Labels{types.Wildcard: []string{types.Wildcard}},
-				KubernetesLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
-				DatabaseLabels:   types.Labels{types.Wildcard: []string{types.Wildcard}},
-				Namespaces:       []string{apidefaults.Namespace},
-				Rules: []types.Rule{
-					types.NewRule(types.KindRole, services.RO()),
-				},
-			},
-			Deny: types.RoleConditions{
-				Namespaces: []string{apidefaults.Namespace},
-			},
-		},
-	}
-
-	upserted, err := s.Access.UpsertRole(ctx, &role)
-	require.NoError(t, err)
-	rout, err := s.Access.GetRole(ctx, role.Metadata.Name)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, rout, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	role.Spec.Allow.Logins = []string{"bob"}
-	upserted, err = s.Access.UpsertRole(ctx, &role)
-	require.NoError(t, err)
-	rout, err = s.Access.GetRole(ctx, role.Metadata.Name)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, rout, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.Access.DeleteRole(ctx, role.Metadata.Name)
-	require.NoError(t, err)
-
-	_, err = s.Access.GetRole(ctx, role.Metadata.Name)
-	require.True(t, trace.IsNotFound(err))
-}
-
-func (s *ServicesTestSuite) SAMLCRUD(t *testing.T) {
-	ctx := context.Background()
-	connector := &types.SAMLConnectorV2{
-		Kind:    types.KindSAML,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      "saml1",
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.SAMLConnectorSpecV2{
-			Display:                  "SAML",
-			Issuer:                   "http://example.com",
-			SSO:                      "https://example.com/saml/sso",
-			AssertionConsumerService: "https://localhost/acs",
-			Audience:                 "https://localhost/aud",
-			ServiceProviderIssuer:    "https://localhost/iss",
-			AttributesToRoles: []types.AttributeMapping{
-				{Name: "groups", Value: "admin", Roles: []string{"admin"}},
-			},
-			Cert: fixtures.TLSCACertPEM,
-			SigningKeyPair: &types.AsymmetricKeyPair{
-				PrivateKey: fixtures.TLSCAKeyPEM,
-				Cert:       fixtures.TLSCACertPEM,
-			},
-		},
-	}
-	err := services.ValidateSAMLConnector(connector, nil)
-	require.NoError(t, err)
-	upserted, err := s.WebS.UpsertSAMLConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectors, err := s.WebS.GetSAMLConnectors(ctx, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.SAMLConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	out2, err := s.WebS.GetSAMLConnector(ctx, connector.GetName(), false)
-	require.NoError(t, err)
-	connectorNoSecrets := *connector
-	connectorNoSecrets.Spec.SigningKeyPair.PrivateKey = ""
-	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectorsNoSecrets, err := s.WebS.GetSAMLConnectors(ctx, false)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.SAMLConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.WebS.DeleteSAMLConnector(ctx, connector.GetName())
-	require.NoError(t, err)
-
-	err = s.WebS.DeleteSAMLConnector(ctx, connector.GetName())
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	_, err = s.WebS.GetSAMLConnector(ctx, connector.GetName(), true)
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	created, err := s.WebS.CreateSAMLConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, created.GetRevision())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("not-saml")
-
-	updated, err := s.WebS.UpdateSAMLConnector(ctx, connector)
-	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
-	require.Nil(t, updated)
-
-	connector.SetRevision(created.GetRevision())
-	updated, err = s.WebS.UpdateSAMLConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, updated.GetRevision())
-	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
-	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("llama")
-
-	upserted, err = s.WebS.UpsertSAMLConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, upserted.GetRevision())
-	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
-	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
-}
-
-func (s *ServicesTestSuite) OIDCCRUD(t *testing.T) {
-	ctx := context.Background()
-	connector := &types.OIDCConnectorV3{
-		Kind:    types.KindOIDC,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      "oidc1",
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.OIDCConnectorSpecV3{
-			Display:      "SAML",
-			IssuerURL:    "http://example.com",
-			ClientID:     "aaa",
-			ClientSecret: "bbb",
-			RedirectURLs: []string{"https://localhost:3080/v1/webapi/github/callback"},
-			ClaimsToRoles: []types.ClaimMapping{
-				{
-					Claim: "abc",
-					Value: "xyz",
-					Roles: []string{"admin"},
-				},
-			},
-		},
-	}
-
-	upserted, err := s.WebS.UpsertOIDCConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectors, err := s.WebS.GetOIDCConnectors(ctx, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.OIDCConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	out2, err := s.WebS.GetOIDCConnector(ctx, connector.GetName(), false)
-	require.NoError(t, err)
-	connectorNoSecrets := *connector
-	connectorNoSecrets.Spec.ClientSecret = ""
-	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectorsNoSecrets, err := s.WebS.GetOIDCConnectors(ctx, false)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.OIDCConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.WebS.DeleteOIDCConnector(ctx, connector.GetName())
-	require.NoError(t, err)
-
-	err = s.WebS.DeleteOIDCConnector(ctx, connector.GetName())
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	_, err = s.WebS.GetOIDCConnector(ctx, connector.GetName(), true)
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	created, err := s.WebS.CreateOIDCConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, created.GetRevision())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("not-saml")
-
-	updated, err := s.WebS.UpdateOIDCConnector(ctx, connector)
-	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
-	require.Nil(t, updated)
-
-	connector.SetRevision(created.GetRevision())
-	updated, err = s.WebS.UpdateOIDCConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, updated.GetRevision())
-	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
-	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("llama")
-
-	upserted, err = s.WebS.UpsertOIDCConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, upserted.GetRevision())
-	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
-	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
-}
-
-func (s *ServicesTestSuite) TunnelConnectionsCRUD(t *testing.T) {
-	clusterName := "example.com"
-	out, err := s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	dt := s.Clock.Now()
-	conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
-		ClusterName:   clusterName,
-		ProxyName:     "p1",
-		LastHeartbeat: dt,
-	})
-	require.NoError(t, err)
-
-	err = s.TrustS.UpsertTunnelConnection(conn)
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	out, err = s.TrustS.GetAllTunnelConnections()
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	dt = dt.Add(time.Hour)
-	conn.SetLastHeartbeat(dt)
-
-	err = s.TrustS.UpsertTunnelConnection(conn)
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.TrustS.DeleteAllTunnelConnections()
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Empty(t, out)
-
-	err = s.TrustS.DeleteAllTunnelConnections()
-	require.NoError(t, err)
-
-	// test delete individual connection
-	err = s.TrustS.UpsertTunnelConnection(conn)
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Len(t, out, 1)
-	require.Empty(t, cmp.Diff(out[0], conn, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.TrustS.DeleteTunnelConnection(clusterName, conn.GetName())
-	require.NoError(t, err)
-
-	out, err = s.TrustS.GetTunnelConnections(clusterName)
-	require.NoError(t, err)
-	require.Empty(t, out)
-}
-
-func (s *ServicesTestSuite) GithubConnectorCRUD(t *testing.T) {
-	ctx := context.Background()
-	connector := &types.GithubConnectorV3{
-		Kind:    types.KindGithubConnector,
-		Version: types.V3,
-		Metadata: types.Metadata{
-			Name:      "github",
-			Namespace: apidefaults.Namespace,
-		},
-		Spec: types.GithubConnectorSpecV3{
-			ClientID:     "aaa",
-			ClientSecret: "bbb",
-			RedirectURL:  "https://localhost:3080/v1/webapi/github/callback",
-			Display:      "GitHub",
-			TeamsToRoles: []types.TeamRolesMapping{
-				{
-					Organization: "gravitational",
-					Team:         "admins",
-					Roles:        []string{"admin"},
-				},
-			},
-		},
-	}
-	err := connector.CheckAndSetDefaults()
-	require.NoError(t, err)
-	upserted, err := s.WebS.UpsertGithubConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, connector, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectors, err := s.WebS.GetGithubConnectors(ctx, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.GithubConnector{connector}, connectors, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	out2, err := s.WebS.GetGithubConnector(ctx, connector.GetName(), false)
-	require.NoError(t, err)
-	connectorNoSecrets := *connector
-	connectorNoSecrets.Spec.ClientSecret = ""
-	require.Empty(t, cmp.Diff(out2, &connectorNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	connectorsNoSecrets, err := s.WebS.GetGithubConnectors(ctx, false)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.GithubConnector{&connectorNoSecrets}, connectorsNoSecrets, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.WebS.DeleteGithubConnector(ctx, connector.GetName())
-	require.NoError(t, err)
-
-	err = s.WebS.DeleteGithubConnector(ctx, connector.GetName())
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	_, err = s.WebS.GetGithubConnector(ctx, connector.GetName(), true)
-	require.True(t, trace.IsNotFound(err), fmt.Sprintf("expected not found, got %T", err))
-
-	created, err := s.WebS.CreateGithubConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, created, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, created.GetRevision())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("not-github")
-
-	updated, err := s.WebS.UpdateGithubConnector(ctx, connector)
-	require.ErrorIs(t, err, backend.ErrIncorrectRevision)
-	require.Nil(t, updated)
-
-	connector.SetRevision(created.GetRevision())
-	updated, err = s.WebS.UpdateGithubConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, updated, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, updated.GetRevision())
-	require.NotEqual(t, created.GetRevision(), updated.GetRevision())
-	require.NotEqual(t, created.GetDisplay(), updated.GetDisplay())
-
-	connector = utils.CloneProtoMsg(connector)
-	connector.SetRevision(uuid.NewString())
-	connector.SetDisplay("llama")
-
-	upserted, err = s.WebS.UpsertGithubConnector(ctx, connector)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(connector, upserted, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.NotEmpty(t, upserted.GetRevision())
-	require.NotEqual(t, updated.GetRevision(), upserted.GetRevision())
-	require.NotEqual(t, updated.GetDisplay(), upserted.GetDisplay())
-}
-
-// AuthPreference tests authentication preference service
-func (s *ServicesTestSuite) AuthPreference(t *testing.T) {
-	ctx := context.Background()
-	ap, err := types.NewAuthPreferenceFromConfigFile(types.AuthPreferenceSpecV2{
-		Type:                  constants.Local,
-		SecondFactor:          constants.SecondFactorOTP,
-		DisconnectExpiredCert: types.NewBoolOption(true),
-	})
-	require.NoError(t, err)
-
-	// Create a preference when one does not exist.
-	created, err := s.ConfigS.CreateAuthPreference(ctx, ap)
-	require.NoError(t, err)
-	require.NotEmpty(t, created.GetRevision())
-
-	// Validate the created preference matches the retrieve preference.
-	gotAP, err := s.ConfigS.GetAuthPreference(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ap, gotAP), cmpopts.IgnoreFields(types.Metadata{}, "Revision"))
-
-	// Validate that update only works if the revision matches.
-	gotAP.SetRevision("123")
-	_, err = s.ConfigS.UpdateAuthPreference(ctx, gotAP)
-	require.True(t, trace.IsCompareFailed(err))
-
-	// Validate that upserting overwrites the value regardless of the revision.
-	upserted, err := s.ConfigS.UpsertAuthPreference(ctx, gotAP)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, gotAP), cmpopts.IgnoreFields(types.Metadata{}, "Revision"))
-}
-
-// AccessGraphSettings tests access graph settings service
-func (s *ServicesTestSuite) AccessGraphSettings(t *testing.T) {
-	ctx := context.Background()
-	ap, err := clusterconfig.NewAccessGraphSettings(
-		&clusterconfigpb.AccessGraphSettingsSpec{
-			SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-		},
-	)
-	require.NoError(t, err)
-
-	created, err := s.ConfigS.CreateAccessGraphSettings(ctx, ap)
-	require.NoError(t, err)
-	require.NotEmpty(t, created.GetMetadata().GetRevision())
-
-	// Validate the created preference matches the retrieve preference.
-	got, err := s.ConfigS.GetAccessGraphSettings(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ap, got, protocmp.Transform()))
-
-	// Validate that update only works if the revision matches.
-	got.Metadata.Revision = "123"
-	_, err = s.ConfigS.UpdateAccessGraphSettings(ctx, got)
-	require.True(t, trace.IsCompareFailed(err))
-
-	// Validate that upserting overwrites the value regardless of the revision.
-	upserted, err := s.ConfigS.UpsertAccessGraphSettings(ctx, protobuf.Clone(got).(*clusterconfigpb.AccessGraphSettings))
-	require.NoError(t, err)
-	require.NotEmpty(t, upserted.GetMetadata().GetRevision())
-	upserted.Metadata.Revision = ""
-	got.Metadata.Revision = ""
-	require.Empty(t, cmp.Diff(upserted, got, protocmp.Transform()))
-}
-
-// SessionRecordingConfig tests session recording configuration.
-func (s *ServicesTestSuite) SessionRecordingConfig(t *testing.T) {
-	ctx := context.Background()
-	recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-		Mode: types.RecordAtProxy,
-	})
-	require.NoError(t, err)
-
-	// Validate updating a non-existent config fails.
-	_, err = s.ConfigS.UpdateSessionRecordingConfig(ctx, recConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	// Create a config when one does not exist.
-	created, err := s.ConfigS.CreateSessionRecordingConfig(ctx, recConfig)
-	require.NoError(t, err)
-	require.NotEmpty(t, created.GetRevision())
-
-	// Validate the created config matches the retrieve config.
-	gotRecConfig, err := s.ConfigS.GetSessionRecordingConfig(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(recConfig, gotRecConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// Validate that update only works if the revision matches.
-	gotRecConfig.SetRevision("123")
-	_, err = s.ConfigS.UpdateSessionRecordingConfig(ctx, gotRecConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	created.SetMode(types.RecordAtNode)
-
-	updated, err := s.ConfigS.UpdateSessionRecordingConfig(ctx, created)
-	require.NoError(t, err)
-	require.Equal(t, types.RecordAtNode, updated.GetMode())
-
-	// Validate that upserting overwrites the value regardless of the revision.
-	upserted, err := s.ConfigS.UpsertSessionRecordingConfig(ctx, gotRecConfig)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, gotRecConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-}
-
-func (s *ServicesTestSuite) StaticTokens(t *testing.T) {
-	// set static tokens
-	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
-		StaticTokens: []types.ProvisionTokenV1{
-			{
-				Token:   "tok1",
-				Roles:   types.SystemRoles{types.RoleNode},
-				Expires: time.Now().UTC().Add(time.Hour),
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	err = s.ConfigS.SetStaticTokens(staticTokens)
-	require.NoError(t, err)
-
-	out, err := s.ConfigS.GetStaticTokens()
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(staticTokens, out, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.ConfigS.DeleteStaticTokens()
-	require.NoError(t, err)
-
-	_, err = s.ConfigS.GetStaticTokens()
-	require.True(t, trace.IsNotFound(err))
-}
-
-// Options provides functional arguments
-// to turn certain parts of the test suite off
-type Options struct {
-	// SkipDelete turns off deletes in tests
-	SkipDelete bool
-}
-
-// Option is a functional suite option
-type Option func(s *Options)
-
-// SkipDelete instructs tests to skip testing delete features
-func SkipDelete() Option {
-	return func(s *Options) {
-		s.SkipDelete = true
-	}
-}
-
-// CollectOptions collects suite options
-func CollectOptions(opts ...Option) Options {
-	var suiteOpts Options
-	for _, o := range opts {
-		o(&suiteOpts)
-	}
-	return suiteOpts
-}
-
-// ClusterName tests cluster name.
-func (s *ServicesTestSuite) ClusterName(t *testing.T, opts ...Option) {
-	ctx := context.Background()
-	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-		ClusterName: "example.com",
-	})
-	require.NoError(t, err)
-	err = s.LocalConfigS.SetClusterName(clusterName)
-	require.NoError(t, err)
-
-	gotName, err := s.ConfigS.GetClusterName(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(clusterName, gotName, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	err = s.LocalConfigS.DeleteClusterName()
-	require.NoError(t, err)
-
-	_, err = s.ConfigS.GetClusterName(ctx)
-	require.True(t, trace.IsNotFound(err))
-
-	err = s.LocalConfigS.UpsertClusterName(clusterName)
-	require.NoError(t, err)
-
-	gotName, err = s.ConfigS.GetClusterName(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(clusterName, gotName, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-}
-
-// ClusterNetworkingConfig tests cluster networking configuration.
-func (s *ServicesTestSuite) ClusterNetworkingConfig(t *testing.T) {
-	ctx := context.Background()
-	netConfig, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
-		ClientIdleTimeout: types.NewDuration(17 * time.Second),
-		KeepAliveCountMax: 3000,
-	})
-	require.NoError(t, err)
-
-	// Validate updating a non-existent config fails.
-	_, err = s.ConfigS.UpdateClusterNetworkingConfig(ctx, netConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	// Create a config when one does not exist.
-	created, err := s.ConfigS.CreateClusterNetworkingConfig(ctx, netConfig)
-	require.NoError(t, err)
-	require.NotEmpty(t, created.GetRevision())
-
-	// Validate the created config matches the retrieve config.
-	gotNetConfig, err := s.ConfigS.GetClusterNetworkingConfig(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(netConfig, gotNetConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// Validate that update only works if the revision matches.
-	gotNetConfig.SetRevision("123")
-	_, err = s.ConfigS.UpdateClusterNetworkingConfig(ctx, gotNetConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	created.SetKeepAliveCountMax(10)
-
-	updated, err := s.ConfigS.UpdateClusterNetworkingConfig(ctx, created)
-	require.NoError(t, err)
-	require.Equal(t, int64(10), updated.GetKeepAliveCountMax())
-
-	// Validate that upserting overwrites the value regardless of the revision.
-	upserted, err := s.ConfigS.UpsertClusterNetworkingConfig(ctx, gotNetConfig)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, gotNetConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-}
-
-// ClusterAuditConfig tests cluster audit configuration.
-func (s *ServicesTestSuite) ClusterAuditConfig(t *testing.T) {
-	ctx := context.Background()
-	auditConfig, err := types.NewClusterAuditConfig(types.ClusterAuditConfigSpecV2{
-		Region:                  "us-east-1",
-		EnableContinuousBackups: true,
-	})
-	require.NoError(t, err)
-
-	// Validate updating a non-existent config fails.
-	_, err = s.ConfigS.UpdateClusterAuditConfig(ctx, auditConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	// Create a config when one does not exist.
-	created, err := s.ConfigS.CreateClusterAuditConfig(ctx, auditConfig)
-	require.NoError(t, err)
-	require.NotEmpty(t, created.GetRevision())
-
-	// Validate the created config matches the retrieve config.
-	gotAuditConfig, err := s.ConfigS.GetClusterAuditConfig(ctx)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(auditConfig, gotAuditConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-
-	// Validate that update only works if the revision matches.
-	gotAuditConfig.SetRevision("123")
-	_, err = s.ConfigS.UpdateClusterAuditConfig(ctx, gotAuditConfig)
-	require.True(t, trace.IsCompareFailed(err))
-
-	created.SetRegion("us-west-2")
-
-	updated, err := s.ConfigS.UpdateClusterAuditConfig(ctx, created)
-	require.NoError(t, err)
-	require.Equal(t, "us-west-2", updated.Region())
-
-	// Validate that upserting overwrites the value regardless of the revision.
-	upserted, err := s.ConfigS.UpsertClusterAuditConfig(ctx, gotAuditConfig)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(upserted, gotAuditConfig, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-}
-
-// sem wrapper is a helper for overriding the keepalive
-// method on the semaphore service.
-type semWrapper struct {
-	types.Semaphores
-	keepAlive func(context.Context, types.SemaphoreLease) error
-}
-
-func (w *semWrapper) KeepAliveSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error {
-	return w.keepAlive(ctx, lease)
-}
-
-func (s *ServicesTestSuite) SemaphoreFlakiness(t *testing.T) {
-	ctx := context.Background()
-	const renewals = 3
-	// wrap our services.Semaphores instance to cause two out of three lease
-	// keepalive attempts fail with a meaningless error.  Locks should make
-	// at *least* three attempts before their expiry, so locks should not
-	// fail under these conditions.
-	keepAlives := new(uint64)
-	wrapper := &semWrapper{
-		Semaphores: s.PresenceS,
-		keepAlive: func(ctx context.Context, lease types.SemaphoreLease) error {
-			kn := atomic.AddUint64(keepAlives, 1)
-			if kn%3 == 0 {
-				return s.PresenceS.KeepAliveSemaphoreLease(ctx, lease)
-			}
-			return trace.Errorf("uh-oh!")
-		},
-	}
-
-	cfg := services.SemaphoreLockConfig{
-		Service:  wrapper,
-		Expiry:   time.Hour,
-		TickRate: time.Millisecond * 50,
-		Params: types.AcquireSemaphoreRequest{
-			SemaphoreKind: types.SemaphoreKindConnection,
-			SemaphoreName: "alice",
-			MaxLeases:     1,
-		},
-	}
-
-	cancelCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	lock, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
-	require.NoError(t, err)
-
-	for i := 0; i < renewals; i++ {
-		select {
-		case <-lock.Renewed():
-			continue
-		case <-lock.Done():
-			t.Fatalf("Lost semaphore lock: %v", lock.Wait())
-		case <-time.After(time.Second * 30):
-			t.Fatalf("Timeout waiting for renewals")
-		}
-	}
-}
-
-// SemaphoreContention checks that a large number of concurrent acquisitions
-// all succeed if MaxLeases is sufficiently high.  Note that we do not test
-// the same property holds for releasing semaphores; release operations are
-// best-effort and allowed to fail.  Also, "large" in this context is still
-// fairly small.  Semaphores aren't cheap and the auth server is expected
-// to start returning "too much contention" errors at around 100 concurrent
-// attempts.
-func (s *ServicesTestSuite) SemaphoreContention(t *testing.T) {
-	ctx := context.Background()
-	const locks int64 = 50
-	const iters = 5
-	for i := 0; i < iters; i++ {
-		cfg := services.SemaphoreLockConfig{
-			Service: s.PresenceS,
-			Expiry:  time.Hour,
-			Params: types.AcquireSemaphoreRequest{
-				SemaphoreKind: types.SemaphoreKindConnection,
-				SemaphoreName: fmt.Sprintf("sem-%d", i), // avoid overlap between iterations
-				MaxLeases:     locks,
-			},
-		}
-		// we leak lock handles in the spawned goroutines, so
-		// context-based cancellation is needed to cleanup the
-		// background keepalive activity.
-		cancelCtx, cancel := context.WithCancel(ctx)
-		acquireErrs := make(chan error, locks)
-		for i := int64(0); i < locks; i++ {
-			go func() {
-				_, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
-				acquireErrs <- err
-			}()
-		}
-		for i := int64(0); i < locks; i++ {
-			require.NoError(t, <-acquireErrs)
-		}
-		cancel()
-		require.NoError(t, s.PresenceS.DeleteSemaphore(ctx, types.SemaphoreFilter{
-			SemaphoreKind: cfg.Params.SemaphoreKind,
-			SemaphoreName: cfg.Params.SemaphoreName,
-		}))
-	}
-}
-
-// SemaphoreConcurrency verifies that a large number of concurrent
-// acquisitions result in the correct number of successful acquisitions.
-func (s *ServicesTestSuite) SemaphoreConcurrency(t *testing.T) {
-	ctx := context.Background()
-	const maxLeases int64 = 20
-	const attempts int64 = 200
-	cfg := services.SemaphoreLockConfig{
-		Service: s.PresenceS,
-		Expiry:  time.Hour,
-		Params: types.AcquireSemaphoreRequest{
-			SemaphoreKind: types.SemaphoreKindConnection,
-			SemaphoreName: "alice",
-			MaxLeases:     maxLeases,
-		},
-	}
-	// we leak lock handles in the spawned goroutines, so
-	// context-based cancellation is needed to cleanup the
-	// background keepalive activity.
-	cancelCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	var success int64
-	var failure int64
-	var wg sync.WaitGroup
-	for i := int64(0); i < attempts; i++ {
-		wg.Add(1)
-		go func() {
-			_, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
-			if err == nil {
-				atomic.AddInt64(&success, 1)
-			} else {
-				atomic.AddInt64(&failure, 1)
-			}
-			wg.Done()
-		}()
-	}
-	wg.Wait()
-	require.Equal(t, maxLeases, atomic.LoadInt64(&success))
-	require.Equal(t, attempts-maxLeases, atomic.LoadInt64(&failure))
-}
-
-// SemaphoreLock verifies correct functionality of the basic
-// semaphore lock scenarios.
-func (s *ServicesTestSuite) SemaphoreLock(t *testing.T) {
-	ctx := context.Background()
-
-	cfg := services.SemaphoreLockConfig{
-		Service: s.PresenceS,
-		Expiry:  time.Hour,
-		Params: types.AcquireSemaphoreRequest{
-			SemaphoreKind: types.SemaphoreKindConnection,
-			SemaphoreName: "alice",
-			MaxLeases:     1,
-		},
-	}
-	cancelCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	lock, err := services.AcquireSemaphoreLock(cancelCtx, cfg)
-	require.NoError(t, err)
-
-	// MaxLeases is 1, so second acquire op fails.
-	_, err = services.AcquireSemaphoreLock(cancelCtx, cfg)
-	require.True(t, trace.IsLimitExceeded(err))
-
-	// Lock is successfully released.
-	lock.Stop()
-	require.NoError(t, lock.Wait())
-
-	// Acquire new lock with short expiry
-	// and high tick rate to verify renewals.
-	cfg.Expiry = time.Second
-	cfg.TickRate = time.Millisecond * 50
-	lock, err = services.AcquireSemaphoreLock(cancelCtx, cfg)
-	require.NoError(t, err)
-
-	timeout := time.After(time.Second)
-
-	for i := 0; i < 3; i++ {
-		select {
-		case <-lock.Done():
-			t.Fatalf("Unexpected lock failure: %v", lock.Wait())
-		case <-timeout:
-			t.Fatalf("Timeout waiting for lock renewal %d", i)
-		case <-lock.Renewed():
-		}
-	}
-
-	// forcibly delete the semaphore
-	require.NoError(t, s.PresenceS.DeleteSemaphore(ctx, types.SemaphoreFilter{
-		SemaphoreKind: cfg.Params.SemaphoreKind,
-		SemaphoreName: cfg.Params.SemaphoreName,
-	}))
-
-	select {
-	case <-lock.Done():
-		require.True(t, trace.IsNotFound(lock.Wait()))
-	case <-time.After(time.Millisecond * 1500):
-		t.Errorf("timeout waiting for semaphore lock failure")
-	}
-}
-
-// Events tests various events variations
-func (s *ServicesTestSuite) Events(t *testing.T) {
-	ctx := context.Background()
-	testCases := []eventTest{
-		{
-			name: "Cert authority with secrets",
-			kind: types.WatchKind{
-				Kind:        types.KindCertAuthority,
-				LoadSecrets: true,
-			},
-			crud: func(context.Context) types.Resource {
-				ca := NewTestCA(types.UserCA, "example.com")
-				require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
-
-				out, err := s.TrustS.GetCertAuthority(ctx, *ca.ID(), true)
-				require.NoError(t, err)
-
-				require.NoError(t, s.TrustS.DeleteCertAuthority(ctx, *ca.ID()))
-				return out
-			},
-		},
-	}
-	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
-
-	testCases = []eventTest{
-		{
-			name: "Cert authority without secrets",
-			kind: types.WatchKind{
-				Kind:        types.KindCertAuthority,
-				LoadSecrets: false,
-			},
-			crud: func(context.Context) types.Resource {
-				ca := NewTestCA(types.UserCA, "example.com")
-				require.NoError(t, s.TrustS.UpsertCertAuthority(ctx, ca))
-
-				out, err := s.TrustS.GetCertAuthority(ctx, *ca.ID(), false)
-				require.NoError(t, err)
-
-				require.NoError(t, s.TrustS.DeleteCertAuthority(ctx, *ca.ID()))
-				return out
-			},
-		},
-	}
-	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
-
-	testCases = []eventTest{
-		{
-			name: "Token",
-			kind: types.WatchKind{
-				Kind: types.KindToken,
-			},
-			crud: func(context.Context) types.Resource {
-				expires := time.Now().UTC().Add(time.Hour)
-				tok, err := types.NewProvisionToken("token",
-					types.SystemRoles{types.RoleAuth, types.RoleNode}, expires)
-				require.NoError(t, err)
-
-				require.NoError(t, s.ProvisioningS.UpsertToken(ctx, tok))
-
-				token, err := s.ProvisioningS.GetToken(ctx, "token")
-				require.NoError(t, err)
-
-				require.NoError(t, s.ProvisioningS.DeleteToken(ctx, "token"))
-				return token
-			},
-		},
-		{
-			name: "Static tokens",
-			kind: types.WatchKind{
-				Kind: types.KindStaticTokens,
-			},
-			crud: func(context.Context) types.Resource {
-				staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
-					StaticTokens: []types.ProvisionTokenV1{
-						{
-							Token:   "tok1",
-							Roles:   types.SystemRoles{types.RoleNode},
-							Expires: time.Now().UTC().Add(time.Hour),
-						},
-					},
-				})
-				require.NoError(t, err)
-
-				err = s.LocalConfigS.SetStaticTokens(staticTokens)
-				require.NoError(t, err)
-
-				out, err := s.LocalConfigS.GetStaticTokens()
-				require.NoError(t, err)
-
-				err = s.LocalConfigS.DeleteStaticTokens()
-				require.NoError(t, err)
-
-				return out
-			},
-		},
-		{
-			name: "Role",
-			kind: types.WatchKind{
-				Kind: types.KindRole,
-			},
-			crud: func(context.Context) types.Resource {
-				role, err := types.NewRole("role1", types.RoleSpecV6{
-					Options: types.RoleOptions{
-						MaxSessionTTL: types.Duration(time.Hour),
-					},
-					Allow: types.RoleConditions{
-						Logins:     []string{"root", "bob"},
-						NodeLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
-					},
-					Deny: types.RoleConditions{},
-				})
-				require.NoError(t, err)
-
-				_, err = s.Access.UpsertRole(ctx, role)
-				require.NoError(t, err)
-
-				out, err := s.Access.GetRole(ctx, role.GetName())
-				require.NoError(t, err)
-
-				err = s.Access.DeleteRole(ctx, role.GetName())
-				require.NoError(t, err)
-
-				return out
-			},
-		},
-		{
-			name: "User",
-			kind: types.WatchKind{
-				Kind: types.KindUser,
-			},
-			crud: func(context.Context) types.Resource {
-				user := newUser("user1", []string{constants.DefaultImplicitRole})
-				user, err := s.Users().UpsertUser(ctx, user)
-				require.NoError(t, err)
-
-				out, err := s.Users().GetUser(ctx, user.GetName(), false)
-				require.NoError(t, err)
-
-				require.NoError(t, s.Users().DeleteUser(ctx, user.GetName()))
-				return out
-			},
-		},
-		{
-			name: "Node",
-			kind: types.WatchKind{
-				Kind: types.KindNode,
-			},
-			crud: func(context.Context) types.Resource {
-				srv := NewServer(types.KindNode, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
-
-				_, err := s.PresenceS.UpsertNode(ctx, srv)
-				require.NoError(t, err)
-
-				out, err := s.PresenceS.GetNodes(ctx, srv.Metadata.Namespace)
-				require.NoError(t, err)
-
-				err = s.PresenceS.DeleteAllNodes(ctx, srv.Metadata.Namespace)
-				require.NoError(t, err)
-
-				return out[0]
-			},
-		},
-		{
-			name: "Proxy",
-			kind: types.WatchKind{
-				Kind: types.KindProxy,
-			},
-			crud: func(context.Context) types.Resource {
-				srv := NewServer(types.KindProxy, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
-
-				err := s.PresenceS.UpsertProxy(ctx, srv)
-				require.NoError(t, err)
-
-				out, err := s.PresenceS.GetProxies()
-				require.NoError(t, err)
-
-				err = s.PresenceS.DeleteAllProxies()
-				require.NoError(t, err)
-
-				return out[0]
-			},
-		},
-		{
-			name: "Tunnel connection",
-			kind: types.WatchKind{
-				Kind: types.KindTunnelConnection,
-			},
-			crud: func(context.Context) types.Resource {
-				conn, err := types.NewTunnelConnection("conn1", types.TunnelConnectionSpecV2{
-					ClusterName:   "example.com",
-					ProxyName:     "p1",
-					LastHeartbeat: time.Now().UTC(),
-				})
-				require.NoError(t, err)
-
-				err = s.TrustS.UpsertTunnelConnection(conn)
-				require.NoError(t, err)
-
-				out, err := s.TrustS.GetTunnelConnections("example.com")
-				require.NoError(t, err)
-
-				err = s.TrustS.DeleteAllTunnelConnections()
-				require.NoError(t, err)
-
-				return out[0]
-			},
-		},
-		{
-			name: "Reverse tunnel",
-			kind: types.WatchKind{
-				Kind: types.KindReverseTunnel,
-			},
-			crud: func(context.Context) types.Resource {
-				tunnel := newReverseTunnel("example.com", []string{"example.com:2023"})
-				_, err := s.PresenceS.UpsertReverseTunnel(ctx, tunnel)
-				require.NoError(t, err)
-
-				out, _, err := s.PresenceS.ListReverseTunnels(
-					ctx, 0, "",
-				)
-				require.NoError(t, err)
-
-				err = s.PresenceS.DeleteReverseTunnel(ctx, tunnel.Spec.ClusterName)
-				require.NoError(t, err)
-
-				return out[0]
-			},
-		},
-		{
-			name: "Remote cluster",
-			kind: types.WatchKind{
-				Kind: types.KindRemoteCluster,
-			},
-			crud: func(ctx context.Context) types.Resource {
-				rc, err := types.NewRemoteCluster("example.com")
-				rc.SetConnectionStatus(teleport.RemoteClusterStatusOffline)
-				require.NoError(t, err)
-				_, err = s.TrustS.CreateRemoteCluster(ctx, rc)
-				require.NoError(t, err)
-
-				out, err := s.TrustS.GetRemoteClusters(ctx)
-				require.NoError(t, err)
-
-				err = s.TrustS.DeleteRemoteCluster(ctx, rc.GetName())
-				require.NoError(t, err)
-
-				return out[0]
-			},
-		},
-	}
-	// this also tests the partial success mode by requesting an unknown kind
-	s.runEventsTests(t, testCases, types.Watch{
-		Kinds:               append(eventsTestKinds(testCases), types.WatchKind{Kind: "unknown"}),
-		AllowPartialSuccess: true,
-	})
-
-	// tests that a watch fails given an unknown kind when the partial success mode is not enabled
-	s.runUnknownEventsTest(t, types.Watch{Kinds: []types.WatchKind{
-		{Kind: types.KindNamespace},
-		{Kind: "unknown"},
-	}})
-
-	// tests that a watch fails if all given kinds are unknown even if the success mode is enabled
-	s.runUnknownEventsTest(t, types.Watch{
-		Kinds: []types.WatchKind{
-			{Kind: "unrecognized"},
-			{Kind: "unidentified"},
-		},
-		AllowPartialSuccess: true,
-	})
-}
-
-// EventsClusterConfig tests cluster config resource events
-func (s *ServicesTestSuite) EventsClusterConfig(t *testing.T) {
-	testCases := []eventTest{
-		{
-			name: "Cluster name",
-			kind: types.WatchKind{
-				Kind: types.KindClusterName,
-			},
-			crud: func(ctx context.Context) types.Resource {
-				clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-					ClusterName: "example.com",
-				})
-				require.NoError(t, err)
-
-				err = s.LocalConfigS.UpsertClusterName(clusterName)
-				require.NoError(t, err)
-
-				out, err := s.ConfigS.GetClusterName(ctx)
-				require.NoError(t, err)
-
-				err = s.LocalConfigS.DeleteClusterName()
-				require.NoError(t, err)
-				return out
-			},
-		},
-		{
-			name: "Cluster audit configuration",
-			kind: types.WatchKind{
-				Kind: types.KindClusterAuditConfig,
-			},
-			crud: func(ctx context.Context) types.Resource {
-				auditConfig, err := types.NewClusterAuditConfig(types.ClusterAuditConfigSpecV2{
-					Region:           "us-west-1",
-					Type:             "dynamodb",
-					AuditSessionsURI: "file:///home/log",
-					AuditEventsURI:   []string{"dynamodb://audit_table_name", "file:///home/test/log"},
-				})
-				require.NoError(t, err)
-
-				err = s.ConfigS.SetClusterAuditConfig(ctx, auditConfig)
-				require.NoError(t, err)
-
-				out, err := s.ConfigS.GetClusterAuditConfig(ctx)
-				require.NoError(t, err)
-
-				err = s.ConfigS.DeleteClusterAuditConfig(ctx)
-				require.NoError(t, err)
-				return out
-			},
-		},
-		{
-			name: "Cluster networking configuration",
-			kind: types.WatchKind{
-				Kind: types.KindClusterNetworkingConfig,
-			},
-			crud: func(ctx context.Context) types.Resource {
-				netConfig, err := types.NewClusterNetworkingConfigFromConfigFile(types.ClusterNetworkingConfigSpecV2{
-					ClientIdleTimeout: types.Duration(5 * time.Second),
-				})
-				require.NoError(t, err)
-
-				_, err = s.ConfigS.UpsertClusterNetworkingConfig(ctx, netConfig)
-				require.NoError(t, err)
-
-				out, err := s.ConfigS.GetClusterNetworkingConfig(ctx)
-				require.NoError(t, err)
-
-				err = s.ConfigS.DeleteClusterNetworkingConfig(ctx)
-				require.NoError(t, err)
-				return out
-			},
-		},
-		{
-			name: "Session recording configuration",
-			kind: types.WatchKind{
-				Kind: types.KindSessionRecordingConfig,
-			},
-			crud: func(ctx context.Context) types.Resource {
-				recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-					Mode: types.RecordAtProxySync,
-				})
-				require.NoError(t, err)
-
-				_, err = s.ConfigS.UpsertSessionRecordingConfig(ctx, recConfig)
-				require.NoError(t, err)
-
-				out, err := s.ConfigS.GetSessionRecordingConfig(ctx)
-				require.NoError(t, err)
-
-				err = s.ConfigS.DeleteSessionRecordingConfig(ctx)
-				require.NoError(t, err)
-				return out
-			},
-		},
-	}
-	s.runEventsTests(t, testCases, types.Watch{Kinds: eventsTestKinds(testCases)})
-}
-
-// NetworkRestrictions tests network restrictions.
-func (s *ServicesTestSuite) NetworkRestrictions(t *testing.T, opts ...Option) {
-	ctx := context.Background()
-
-	// blank slate, should be get/delete should fail
-	_, err := s.RestrictionsS.GetNetworkRestrictions(ctx)
-	require.True(t, trace.IsNotFound(err))
-
-	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
-	require.True(t, trace.IsNotFound(err))
-
-	allow := []types.AddressCondition{
-		{CIDR: "10.0.1.0/24"},
-		{CIDR: "10.0.2.2"},
-	}
-	deny := []types.AddressCondition{
-		{CIDR: "10.1.0.0/16"},
-		{CIDR: "8.8.8.8"},
-	}
-
-	expected := types.NewNetworkRestrictions()
-	expected.SetAllow(allow)
-	expected.SetDeny(deny)
-
-	// set and make sure we get it back
-	err = s.RestrictionsS.SetNetworkRestrictions(ctx, expected)
-	require.NoError(t, err)
-
-	actual, err := s.RestrictionsS.GetNetworkRestrictions(ctx)
-	require.NoError(t, err)
-
-	require.Empty(t, cmp.Diff(expected.GetAllow(), actual.GetAllow()))
-	require.Empty(t, cmp.Diff(expected.GetDeny(), actual.GetDeny()))
-
-	// now delete should work ok and get should fail again
-	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
-	require.NoError(t, err)
-
-	err = s.RestrictionsS.DeleteNetworkRestrictions(ctx)
-	require.True(t, trace.IsNotFound(err))
-}
-
-func (s *ServicesTestSuite) runEventsTests(t *testing.T, testCases []eventTest, watch types.Watch) {
-	ctx := context.Background()
-	w, err := s.EventsS.NewWatcher(ctx, watch)
-	require.NoError(t, err)
-	defer w.Close()
-
-	select {
-	case event := <-w.Events():
-		require.Equal(t, types.OpInit, event.Type)
-		watchStatus, ok := event.Resource.(types.WatchStatus)
-		require.True(t, ok)
-		expectedKinds := eventsTestKinds(testCases)
-		require.Equal(t, expectedKinds, watchStatus.GetKinds())
-	case <-w.Done():
-		t.Fatalf("Watcher exited with error %v", w.Error())
-	case <-time.After(2 * time.Second):
-		t.Fatalf("Timeout waiting for init event")
-	}
-
-	// filter out all events that could have been inserted
-	// by the initialization routines
-skiploop:
-	for {
-		select {
-		case event := <-w.Events():
-			slog.DebugContext(ctx, "Skipping pre-test event", "event", event)
-			continue skiploop
-		default:
-			break skiploop
-		case <-w.Done():
-			t.Fatalf("Watcher exited with error %v", w.Error())
-		}
-	}
-
-	for _, tc := range testCases {
-		t.Logf("test case %q", tc.name)
-		resource := tc.crud(ctx)
-
-		ExpectResource(t, w, 3*time.Second, resource)
-
-		meta := resource.GetMetadata()
-		header := &types.ResourceHeader{
-			Kind:    resource.GetKind(),
-			SubKind: resource.GetSubKind(),
-			Version: resource.GetVersion(),
-			Metadata: types.Metadata{
-				Name:      meta.Name,
-				Namespace: meta.Namespace,
-			},
-		}
-		ExpectDeleteResource(t, w, 3*time.Second, header)
-	}
-}
-
-func (s *ServicesTestSuite) runUnknownEventsTest(t *testing.T, watch types.Watch) {
-	ctx := context.Background()
-	w, err := s.EventsS.NewWatcher(ctx, watch)
-	if err != nil {
-		// depending on the implementation of EventsS, it might fail here immediately
-		// or later before returning the first event from the watcher.
-		return
-	}
-	defer w.Close()
-
-	select {
-	case <-w.Events():
-		t.Fatal("unexpected event from watcher that is supposed to fail")
-	case <-w.Done():
-		require.Error(t, w.Error())
-	case <-time.After(2 * time.Second):
-		t.Fatal("Timeout waiting for error from watcher")
-	}
-}
-
-type eventTest struct {
-	name string
-	kind types.WatchKind
-	crud func(context.Context) types.Resource
-}
-
-func eventsTestKinds(tests []eventTest) []types.WatchKind {
-	out := make([]types.WatchKind, len(tests))
-	for i, tc := range tests {
-		out[i] = tc.kind
-	}
-	return out
-}
-
-// ExpectResource expects a Put event of a certain resource
-func ExpectResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
-	timeoutC := time.After(timeout)
-waitLoop:
-	for {
-		select {
-		case <-timeoutC:
-			t.Fatalf("Timeout waiting for event")
-		case <-w.Done():
-			t.Fatalf("Watcher exited with error %v", w.Error())
-		case event := <-w.Events():
-			if event.Type != types.OpPut {
-				slog.DebugContext(context.Background(), "Skipping event", "event", event)
-				continue
-			}
-			if resource.GetName() != event.Resource.GetName() || resource.GetKind() != event.Resource.GetKind() || resource.GetSubKind() != event.Resource.GetSubKind() {
-				slog.DebugContext(context.Background(), "Skipping event", "event", event)
-				continue waitLoop
-			}
-			require.Empty(t, cmp.Diff(resource, event.Resource))
-			break waitLoop
-		}
-	}
-}
-
-// ExpectDeleteResource expects a delete event of a certain kind
-func ExpectDeleteResource(t *testing.T, w types.Watcher, timeout time.Duration, resource types.Resource) {
-	timeoutC := time.After(timeout)
-waitLoop:
-	for {
-		select {
-		case <-timeoutC:
-			t.Fatalf("Timeout waiting for delete resource %v", resource)
-		case <-w.Done():
-			t.Fatalf("Watcher exited with error %v", w.Error())
-		case event := <-w.Events():
-			if event.Type != types.OpDelete {
-				slog.DebugContext(context.Background(), "Skipping stale event",
-					"event_type", event.Type,
-					"resource_name", event.Resource.GetName(),
-				)
-				continue
-			}
-
-			// Server resources may have subkind set, but the backend
-			// generating this delete event doesn't know the subkind.
-			// Set it to prevent the check below from failing.
-			if event.Resource.GetKind() == types.KindNode {
-				event.Resource.SetSubKind(resource.GetSubKind())
-			}
-
-			require.Empty(t, cmp.Diff(resource, event.Resource))
-			break waitLoop
-		}
-	}
-}
diff --git a/lib/services/summarizer.go b/lib/services/summarizer.go
new file mode 100644
index 0000000000000..6d2782ed7be2c
--- /dev/null
+++ b/lib/services/summarizer.go
@@ -0,0 +1,235 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services
+
+import (
+	"context"
+	"iter"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/vulcand/predicate"
+
+	"github.com/gravitational/teleport"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/events"
+	apisummarizer "github.com/gravitational/teleport/api/types/summarizer"
+)
+
+// Summarizer is a service that provides methods to manage summary inference
+// configuration resources in the backend.
+type Summarizer interface {
+	// CreateInferenceModel creates a new session summary inference model in the
+	// backend.
+	CreateInferenceModel(ctx context.Context, model *summarizerv1.InferenceModel) (*summarizerv1.InferenceModel, error)
+	// GetInferenceModel retrieves a session summary inference model from the
+	// backend by name.
+	GetInferenceModel(ctx context.Context, name string) (*summarizerv1.InferenceModel, error)
+	// UpdateInferenceModel updates an existing session summary inference model
+	// in the backend.
+	UpdateInferenceModel(ctx context.Context, model *summarizerv1.InferenceModel) (*summarizerv1.InferenceModel, error)
+	// UpsertInferenceModel creates or updates a session summary inference model
+	// in the backend. If the model already exists, it will be updated.
+	UpsertInferenceModel(ctx context.Context, model *summarizerv1.InferenceModel) (*summarizerv1.InferenceModel, error)
+	// DeleteInferenceModel deletes a session summary inference model from the
+	// backend by name.
+	DeleteInferenceModel(ctx context.Context, name string) error
+	// ListInferenceModels lists session summary inference models in the backend
+	// with pagination support. Returns a slice of models and a next page token.
+	ListInferenceModels(ctx context.Context, size int, pageToken string) ([]*summarizerv1.InferenceModel, string, error)
+
+	// CreateInferenceSecret creates a new session summary inference secret in
+	// the backend. The returned object contains the secret value and should be
+	// handled with care.
+	CreateInferenceSecret(ctx context.Context, secret *summarizerv1.InferenceSecret) (*summarizerv1.InferenceSecret, error)
+	// GetInferenceSecret retrieves a session summary inference secret from the
+	// backend by name. The returned object contains the secret value and should
+	// be handled with care.
+	GetInferenceSecret(ctx context.Context, name string) (*summarizerv1.InferenceSecret, error)
+	// UpdateInferenceSecret updates an existing session summary inference secret
+	// in the backend. The returned object contains the secret value and should
+	// be handled with care.
+	UpdateInferenceSecret(ctx context.Context, secret *summarizerv1.InferenceSecret) (*summarizerv1.InferenceSecret, error)
+	// UpsertInferenceSecret creates or updates a session summary inference
+	// secretin the backend. If the secret already exists, it will be updated.
+	// The returned object contains the secret value and should be handled with
+	// care.
+	UpsertInferenceSecret(ctx context.Context, secret *summarizerv1.InferenceSecret) (*summarizerv1.InferenceSecret, error)
+	// DeleteInferenceSecret deletes a session summary inference secret from the
+	// backend by name.
+	DeleteInferenceSecret(ctx context.Context, name string) error
+	// ListInferenceSecrets lists session summary inference secrets in the
+	// backend with pagination support. Returns a slice of secrets and a next
+	// page token. The returned objects contain the secret values and should be
+	// handled with care.
+	ListInferenceSecrets(ctx context.Context, size int, pageToken string) ([]*summarizerv1.InferenceSecret, string, error)
+
+	// CreateInferencePolicy creates a new session summary inference policy in
+	// the backend.
+	CreateInferencePolicy(ctx context.Context, policy *summarizerv1.InferencePolicy) (*summarizerv1.InferencePolicy, error)
+	// GetInferencePolicy retrieves a session summary inference policy from the
+	// backend by name.
+	GetInferencePolicy(ctx context.Context, name string) (*summarizerv1.InferencePolicy, error)
+	// UpdateInferencePolicy updates an existing session summary inference policy
+	// in the backend.
+	UpdateInferencePolicy(ctx context.Context, policy *summarizerv1.InferencePolicy) (*summarizerv1.InferencePolicy, error)
+	// UpsertInferencePolicy creates or updates a session summary inference
+	// policy in the backend. If the policy already exists, it will be updated.
+	UpsertInferencePolicy(ctx context.Context, policy *summarizerv1.InferencePolicy) (*summarizerv1.InferencePolicy, error)
+	// DeleteInferencePolicy deletes a session summary inference policy from the
+	// backend by name.
+	DeleteInferencePolicy(ctx context.Context, name string) error
+	// ListInferencePolicies lists session summary inference policies in the
+	// backend with pagination support. Returns a slice of policies and a next
+	// page token.
+	ListInferencePolicies(ctx context.Context, size int, pageToken string) ([]*summarizerv1.InferencePolicy, string, error)
+	// AllInferencePolicies returns an iterator that retrieves all session
+	// summary inference policies from the backend, without pagination.
+	AllInferencePolicies(ctx context.Context) iter.Seq2[*summarizerv1.InferencePolicy, error]
+}
+
+// InferencePolicyMatchingContext is a special kind of [RuleContext] that is
+// used for matching inference policies to sessions using predicates. It also
+// allows validating inference policy filter expressions, since it matches
+// identifiers for any supported resource and session event types, regardless
+// which one is being used (or if none is).
+type InferencePolicyMatchingContext struct {
+	// User is the user who initiated the session.
+	User UserState
+	// Resource is the resource being accessed.
+	Resource types.Resource
+	// Session is a session.end or windows.desktop.session.end event. These
+	// events hold information about session recordings.
+	Session events.AuditEvent
+}
+
+// GetIdentifier returns the value of an identifier defined in a context.
+func (ctx *InferencePolicyMatchingContext) GetIdentifier(fields []string) (any, error) {
+	switch fields[0] {
+	case UserIdentifier:
+		var user UserState
+		if ctx.User == nil {
+			user = emptyUser
+		} else {
+			user = ctx.User
+		}
+		val, err := predicate.GetFieldByTag(user, teleport.JSON, fields[1:])
+		return val, trace.Wrap(err)
+
+	case ResourceIdentifier:
+		// First, try to fetch field value from the resource in the context.
+		val, origErr := predicate.GetFieldByTag(ctx.Resource, teleport.JSON, fields[1:])
+		if origErr == nil {
+			return val, nil
+		}
+		if !trace.IsNotFound(origErr) {
+			return nil, trace.Wrap(origErr)
+		}
+
+		// Otherwise, try to fetch field value from dummy resources of all
+		// supported types to figure out if it exists in any of the supported
+		// types. If it does, a zero value is returned; otherwise, an error is
+		// returned.
+		for _, dummyResource := range []types.Resource{
+			&types.ServerV2{}, &types.KubernetesClusterV3{}, &types.DatabaseV3{},
+		} {
+			zeroVal, err := predicate.GetFieldByTag(dummyResource, teleport.JSON, fields[1:])
+			if err == nil {
+				return zeroVal, nil
+			}
+			if trace.IsNotFound(err) {
+				continue
+			}
+			return val, trace.Wrap(origErr)
+		}
+		return val, trace.Wrap(origErr)
+
+	case SessionIdentifier:
+		// First, try to fetch field value from the session in the context.
+		var session events.AuditEvent = &events.SessionEnd{}
+		switch ctx.Session.(type) {
+		case *events.SessionEnd, *events.DatabaseSessionEnd:
+			session = ctx.Session
+		}
+		val, origErr := predicate.GetFieldByTag(session, teleport.JSON, fields[1:])
+		if origErr == nil {
+			return val, nil
+		}
+		if !trace.IsNotFound(origErr) {
+			return nil, trace.Wrap(origErr)
+		}
+
+		// Otherwise, try to fetch field value from dummy events of all supported
+		// types to figure out if it exists in any of the supported types. If it
+		// does, a zero value is returned; otherwise, an error is returned.
+		if zeroVal, err := getMissingEmptyFieldForSessionEnd(fields); err == nil {
+			return zeroVal, nil
+		}
+		return val, trace.Wrap(origErr)
+
+	default:
+		return nil, trace.NotFound("%v is not defined", strings.Join(fields, "."))
+	}
+}
+
+// Returns an error, since this context does not support access checks.
+func (ctx *InferencePolicyMatchingContext) GetAccessChecker() (AccessChecker, error) {
+	return nil, trace.NotFound(
+		"access checker is not supported by InferencePolicyMatchingContext",
+	)
+}
+
+// GetResource returns resource specified in the context,
+// returns error if not specified.
+func (ctx *InferencePolicyMatchingContext) GetResource() (types.Resource, error) {
+	if ctx.Resource == nil {
+		return nil, trace.NotFound("resource is not set in the context")
+	}
+	return ctx.Resource, nil
+}
+
+// ExtendWithSessionEnd extends the context with a session end event and
+// rebuilds the resource from the event.
+func (ctx *InferencePolicyMatchingContext) ExtendWithSessionEnd(sessionEnd events.AuditEvent) {
+	ctx.Session = sessionEnd
+	ctx.Resource = rebuildResourceFromSessionEndEvent(sessionEnd)
+}
+
+// ValidateInferencePolicy validates an inference policy, including checking
+// filter syntax. This function wraps [apisummarizer.ValidateInferencePolicy],
+// as no function in the api/types tree can depend on the lib/services package.
+func ValidateInferencePolicy(p *summarizerv1.InferencePolicy) error {
+	err := apisummarizer.ValidateInferencePolicy(p)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s := p.GetSpec()
+	if s.GetFilter() != "" {
+		parser, err := NewWhereParser(&InferencePolicyMatchingContext{})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if _, err = parser.Parse(s.GetFilter()); err != nil {
+			return trace.Wrap(err, "spec.filter has to be a valid predicate")
+		}
+	}
+
+	return nil
+}
diff --git a/lib/services/summarizer_test.go b/lib/services/summarizer_test.go
new file mode 100644
index 0000000000000..5fe0b54fec2a6
--- /dev/null
+++ b/lib/services/summarizer_test.go
@@ -0,0 +1,277 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package services
+
+import (
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/vulcand/predicate"
+
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/events"
+	apisummarizer "github.com/gravitational/teleport/api/types/summarizer"
+)
+
+func TestInferencePolicyMatchingContext(t *testing.T) {
+	t.Parallel()
+
+	user, err := types.NewUser("alice")
+	require.NoError(t, err)
+
+	server, err := types.NewServer("server-1", types.KindNode, types.ServerSpecV2{Hostname: "host-1"})
+	require.NoError(t, err)
+
+	kubeCluster, err := types.NewKubernetesClusterV3(
+		types.Metadata{Name: "kube-1"},
+		types.KubernetesClusterSpecV3{
+			Kubeconfig: []byte("dummy-kubeconfig"),
+		},
+	)
+	require.NoError(t, err)
+
+	database, err := types.NewDatabaseV3(
+		types.Metadata{Name: "db-1"},
+		types.DatabaseSpecV3{Protocol: types.DatabaseProtocolPostgreSQL, URI: "postgres://dummy"},
+	)
+	require.NoError(t, err)
+
+	kubeSessionEnd := &events.SessionEnd{
+		KubernetesPodMetadata: events.KubernetesPodMetadata{KubernetesPodName: "pod-1"},
+	}
+
+	dbSessionEnd := &events.DatabaseSessionEnd{
+		DatabaseMetadata: events.DatabaseMetadata{DatabaseProtocol: types.DatabaseProtocolPostgreSQL},
+	}
+
+	cases := []struct {
+		name       string
+		user       types.User
+		resource   types.Resource
+		session    events.AuditEvent
+		expression string
+		expected   any
+		notFound   bool
+	}{
+		{
+			name:       "known user field",
+			user:       user,
+			expression: "user.metadata.name",
+			expected:   "alice",
+		},
+		{
+			name:       "unknown user field",
+			user:       user,
+			expression: "user.spec.unknown",
+			notFound:   true,
+		},
+		{
+			name:       "known server field",
+			resource:   server,
+			expression: "resource.spec.hostname",
+			expected:   "host-1",
+		},
+		{
+			name:       "unknown server field",
+			resource:   server,
+			expression: "resource.spec.unknown",
+			notFound:   true,
+		},
+		{
+			name:       "known database field",
+			resource:   database,
+			expression: "resource.spec.protocol",
+			expected:   types.DatabaseProtocolPostgreSQL,
+		},
+		{
+			name:       "unknown database field",
+			resource:   database,
+			expression: "resource.spec.unknown",
+			notFound:   true,
+		},
+		{
+			name:       "known Kubernetes cluster field",
+			resource:   kubeCluster,
+			expression: "resource.spec.kubeconfig",
+			expected:   []byte("dummy-kubeconfig"),
+		},
+		{
+			name:       "unknown Kubernetes cluster field",
+			resource:   kubeCluster,
+			expression: "resource.spec.unknown",
+			notFound:   true,
+		},
+		{
+			name:       "known shell session field",
+			session:    kubeSessionEnd,
+			expression: "session.kubernetes_pod_name",
+			expected:   "pod-1",
+		},
+		{
+			name:       "unknown shell session field",
+			session:    kubeSessionEnd,
+			expression: "session.unknown",
+			notFound:   true,
+		},
+		{
+			name:       "known database session field",
+			session:    dbSessionEnd,
+			expression: "session.db_protocol",
+			expected:   types.DatabaseProtocolPostgreSQL,
+		},
+		{
+			name:       "unknown database session field",
+			session:    dbSessionEnd,
+			expression: "session.unknown",
+			notFound:   true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := &InferencePolicyMatchingContext{
+				User:     tc.user,
+				Resource: tc.resource,
+				Session:  tc.session,
+			}
+			parser, err := NewWhereParser(ctx)
+			require.NoError(t, err)
+
+			val, err := parser.Parse(tc.expression)
+			if tc.notFound {
+				require.Error(t, err)
+				assert.True(t, trace.IsNotFound(err))
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.expected, val)
+			}
+		})
+	}
+}
+
+func TestInferencePolicyMatchingContext_MixedTypeBooleanExpressions(t *testing.T) {
+	t.Parallel()
+
+	server, err := types.NewServer("server-1", types.KindNode, types.ServerSpecV2{Hostname: "host-1"})
+	require.NoError(t, err)
+
+	kubeSessionEnd := &events.SessionEnd{
+		KubernetesPodMetadata: events.KubernetesPodMetadata{KubernetesPodName: "pod-1"},
+	}
+
+	cases := []struct {
+		name      string
+		predicate string
+	}{
+		{
+			name:      "mixing server and database predicates",
+			predicate: `resource.spec.protocol == "postgres" || resource.spec.hostname == "host-1"`,
+		},
+		{
+			name:      "mixing Kubernetes and database session predicates",
+			predicate: `session.db_protocol == "postgres" || session.kubernetes_pod_name == "pod-1"`,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := &InferencePolicyMatchingContext{
+				Resource: server,
+				Session:  kubeSessionEnd,
+			}
+			parser, err := NewWhereParser(ctx)
+			require.NoError(t, err)
+
+			parseResult, err := parser.Parse(tc.predicate)
+			require.NoError(t, err)
+			pred, ok := parseResult.(predicate.BoolPredicate)
+			require.True(t, ok, "expected BoolPredicate, got %T", parseResult)
+			assert.True(t, pred())
+		})
+	}
+}
+
+func TestValidateInferencePolicy(t *testing.T) {
+	t.Parallel()
+
+	allKinds := []string{"ssh", "k8s", "db"}
+
+	cases := []struct {
+		name         string
+		kinds        []string
+		filter       string
+		errorMessage string
+	}{
+		{name: "valid empty filter", kinds: allKinds, filter: ""},
+		{name: "valid user filter", kinds: allKinds, filter: `contains(user.spec.roles, "admin")`},
+		{name: "valid server filter", kinds: allKinds, filter: `equals(resource.spec.hostname, "node1")`},
+		{name: "valid db filter", kinds: allKinds, filter: `equals(resource.spec.protocol, "postgres")`},
+		{name: "valid kube filter", kinds: allKinds, filter: `resource.metadata.labels["env"] == "prod"`},
+		{name: "valid shell session filter", kinds: allKinds, filter: `contains(session.participants, "joe")`},
+		{name: "valid db session filter", kinds: allKinds, filter: `session.db_protocol == "postgres"`},
+
+		{
+			name:         "invalid kinds",
+			kinds:        nil,
+			errorMessage: "spec.kinds are required",
+		},
+		{
+			name:         "invalid filter syntax",
+			kinds:        allKinds,
+			filter:       "equals(resource.metadata.name, ",
+			errorMessage: "spec.filter has to be a valid predicate",
+		},
+		{
+			name:         "invalid user filter field",
+			kinds:        allKinds,
+			filter:       `user.metadata.foo == "bar"`,
+			errorMessage: "field name foo is not found",
+		},
+		{
+			name:         "invalid resource filter field",
+			kinds:        allKinds,
+			filter:       `resource.spec.foo == "bar"`,
+			errorMessage: "field name spec.foo is not found",
+		},
+		{
+			name:         "invalid session filter field",
+			kinds:        allKinds,
+			filter:       `session.foo == "bar"`,
+			errorMessage: "field name foo is not found",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			p := apisummarizer.NewInferencePolicy("my-policy", &summarizerv1.InferencePolicySpec{
+				Kinds:  tc.kinds,
+				Filter: tc.filter,
+				Model:  "my-model",
+			})
+			err := ValidateInferencePolicy(p)
+			if tc.errorMessage == "" {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				assert.ErrorContains(t, err, tc.errorMessage)
+			}
+		})
+	}
+}
diff --git a/lib/services/testdata/roles/v7_kube_accessrequest_validate.yaml b/lib/services/testdata/roles/v7_kube_accessrequest_validate.yaml
new file mode 100644
index 0000000000000..60351a4901141
--- /dev/null
+++ b/lib/services/testdata/roles/v7_kube_accessrequest_validate.yaml
@@ -0,0 +1,252 @@
+# Set of v7 roles for Kubernetes related tests.
+# Make sure to maintain `v7-kube-` prefix in all names.
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-access-wildcard
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: '*'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-no-access
+spec:
+  allow: {}
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-access-namespace
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'namespace'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-access-pod
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'pod'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-access-deployment
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'deployment'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-db-access-wildcard
+spec:
+  allow:
+    db_labels:
+      '*': '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-undefined_search-wildcard
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-wildcard
+      - v7-kube-db-access-wildcard
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-pod_search-as-roles-undefined
+spec:
+  allow:
+    request:
+      kubernetes_resources:
+      - kind: 'pod'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-namespace_search-namespace
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-namespace
+      - v7-kube-db-access-wildcard
+      kubernetes_resources:
+      - kind: 'namespace'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-wildcard_search-wildcard
+  description: Allows requesting for any subresources, but NOT kube_cluster
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-wildcard
+      - v7-kube-db-access-wildcard
+      kubernetes_resources:
+      - kind: '*'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-secret_search-wildcard
+  description: Allows wildcard search, but should only accept kube secret
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-wildcard
+      kubernetes_resources:
+      - kind: 'secret'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-pod_search-pods
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-pod
+      kubernetes_resources:
+      - kind: 'pod'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-deployment_search-deployment
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-deployment
+      kubernetes_resources:
+      - kind: 'deployment'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-deployment-pod_search-deployment-pod
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-deployment
+      - v7-kube-access-pod
+      kubernetes_resources:
+      - kind: 'deployment'
+      - kind: 'pod'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-namespace-but-no-access
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-db-access-wildcard
+      - v7-kube-no-access
+      kubernetes_resources:
+      - kind: 'namespace'
+  deny: {}
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-namespace_search-namespace_deny-secret
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-namespace
+      kubernetes_resources:
+      - kind: 'namespace'
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: 'secret'
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-undefined_search-wildcard_deny-deployment-pod
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-wildcard
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: 'deployment'
+      - kind: 'pod'
+---
+kind: role
+version: v7
+metadata:
+  name: v7-kube-request-wildcard-cancels-deny-wildcard
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v7-kube-access-namespace
+      kubernetes_resources:
+      - kind: '*'
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: '*'
diff --git a/lib/services/testdata/roles/v8_kube_accessrequest_validate.yaml b/lib/services/testdata/roles/v8_kube_accessrequest_validate.yaml
new file mode 100644
index 0000000000000..f4b1c74bda615
--- /dev/null
+++ b/lib/services/testdata/roles/v8_kube_accessrequest_validate.yaml
@@ -0,0 +1,277 @@
+# Set of v8 roles for Kubernetes related tests.
+# Make sure to maintain `v8-kube-` prefix in all names.
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-access-wildcard
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: '*'
+      api_group: '*'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-no-access
+spec:
+  allow: {}
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-access-namespace
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'namespaces'
+      api_group: '*'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+    - kind: '*'
+      api_group: '*'
+      name: '*'
+      namespace: '^.*$'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-access-pod
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'pods'
+      api_group: ''
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-access-deployment
+spec:
+  allow:
+    kubernetes_labels:
+      '*': '*'
+    kubernetes_resources:
+    - kind: 'deployments'
+      api_group: 'apps'
+      name: '*'
+      namespace: '*'
+      verbs:
+      - '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-db-access-wildcard
+spec:
+  allow:
+    db_labels:
+      '*': '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-undefined_search-wildcard
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-wildcard
+      - v8-kube-db-access-wildcard
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-pod_search-as-roles-undefined
+spec:
+  allow:
+    request:
+      kubernetes_resources:
+      - kind: 'pods'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-namespace_search-namespace
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-namespace
+      - v8-kube-db-access-wildcard
+      kubernetes_resources:
+      - kind: 'namespaces'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-wildcard_search-wildcard
+  description: Allows requesting for any subresources, but NOT kube_cluster
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-wildcard
+      - v8-kube-db-access-wildcard
+      kubernetes_resources:
+      - kind: '*'
+        api_group: '*'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-secret_search-wildcard
+  description: Allows wildcard search, but should only accept kube secret
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-wildcard
+      kubernetes_resources:
+      - kind: 'secrets'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-pod_search-pods
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-pod
+      kubernetes_resources:
+      - kind: 'pods'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-deployment_search-deployment
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-deployment
+      kubernetes_resources:
+      - kind: 'deployments'
+        api_group: 'apps'
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-deployment-pod_search-deployment-pod
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-deployment
+      - v8-kube-access-pod
+      kubernetes_resources:
+      - kind: 'deployments'
+        api_group: 'apps'
+      - kind: 'pods'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-namespace-but-no-access
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-db-access-wildcard
+      - v8-kube-no-access
+      kubernetes_resources:
+      - kind: 'namespaces'
+        api_group: ''
+  deny: {}
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-namespace_search-namespace_deny-secret
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-namespace
+      kubernetes_resources:
+      - kind: 'namespaces'
+        api_group: ''
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: 'secrets'
+        api_group: ''
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-undefined_search-wildcard_deny-deployment-pod
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-wildcard
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: 'deployments'
+        api_group: 'apps'
+      - kind: 'pods'
+        api_group: ''
+---
+kind: role
+version: v8
+metadata:
+  name: v8-kube-request-wildcard-cancels-deny-wildcard
+spec:
+  allow:
+    request:
+      search_as_roles:
+      - v8-kube-access-namespace
+      kubernetes_resources:
+      - kind: '*'
+        api_group: '*'
+  deny:
+    request:
+      kubernetes_resources:
+      - kind: '*'
+        api_group: '*'
diff --git a/lib/services/trust.go b/lib/services/trust.go
index 94b282500e65b..2619cbd62e1fe 100644
--- a/lib/services/trust.go
+++ b/lib/services/trust.go
@@ -20,6 +20,7 @@ package services
 
 import (
 	"context"
+	"iter"
 
 	"github.com/gravitational/teleport/api/types"
 )
@@ -127,6 +128,12 @@ type Clusters interface {
 	// GetTrustedClusters returns all TrustedClusters in the backend.
 	GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster, error)
 
+	// ListTrustedClusters returns a page of Trusted Cluster resources.
+	ListTrustedClusters(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error)
+
+	// RangeTrustedClusters returns Trusted Cluster resources within the range [start, end).
+	RangeTrustedClusters(ctx context.Context, start, end string) iter.Seq2[types.TrustedCluster, error]
+
 	// DeleteTrustedCluster removes a TrustedCluster from the backend by name.
 	DeleteTrustedCluster(ctx context.Context, name string) error
 
diff --git a/lib/services/trustedcluster.go b/lib/services/trustedcluster.go
index 90bdcf6366b8b..839cd95abc513 100644
--- a/lib/services/trustedcluster.go
+++ b/lib/services/trustedcluster.go
@@ -21,6 +21,8 @@ package services
 import (
 	"errors"
 	"fmt"
+	"maps"
+	"slices"
 
 	"github.com/gravitational/trace"
 
@@ -99,27 +101,30 @@ func parseRoleMap(r types.RoleMap) (map[string][]string, error) {
 	return directMatch, nil
 }
 
-// MapRoles maps local roles to remote roles
-func MapRoles(r types.RoleMap, remoteRoles []string) ([]string, error) {
-	_, err := parseRoleMap(r)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	seen := make(map[string]struct{})
-	var outRoles []string
-	// when no remote roles are specified, assume that
-	// there is a single empty remote role (that should match wildcards)
-	if len(remoteRoles) == 0 {
-		remoteRoles = []string{""}
+func mapRoles(remoteUserRoles []string, r types.RoleMap) (map[string]utils.Set[string], error) {
+	// define a mapping from local roles to the possible remote roles that may
+	// have granted them access
+	index := make(map[string]utils.Set[string])
+	addToIndex := func(localRole, remoteRole string) {
+		remoteRoles, ok := index[localRole]
+		if !ok {
+			index[localRole] = utils.NewSet[string](remoteRole)
+			return
+		}
+		remoteRoles.Add(remoteRole)
 	}
+
+	// Run the role mapping forwards over the remote roles, collecting which
+	// localRoles are granted by which remote roles
 	for _, mapping := range r {
 		expression := mapping.Remote
-		for _, remoteRole := range remoteRoles {
+		for _, remoteRole := range remoteUserRoles {
 			// never map default implicit role, it is always
 			// added by default
 			if remoteRole == constants.DefaultImplicitRole {
 				continue
 			}
+
 			for _, replacementRole := range mapping.Local {
 				replacement, err := utils.ReplaceRegexp(expression, replacementRole, remoteRole)
 				switch {
@@ -129,11 +134,7 @@ func MapRoles(r types.RoleMap, remoteRoles []string) ([]string, error) {
 					if replacement == "" {
 						continue
 					}
-					if _, ok := seen[replacement]; ok {
-						continue
-					}
-					seen[replacement] = struct{}{}
-					outRoles = append(outRoles, replacement)
+					addToIndex(replacement, remoteRole)
 				case errors.Is(err, utils.ErrReplaceRegexNotFound):
 					continue
 				default:
@@ -142,7 +143,50 @@ func MapRoles(r types.RoleMap, remoteRoles []string) ([]string, error) {
 			}
 		}
 	}
-	return outRoles, nil
+
+	return index, nil
+}
+
+// MapRoles maps remote roles to local roles
+func MapRoles(r types.RoleMap, remoteRoles []string) ([]string, error) {
+	_, err := parseRoleMap(r)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// when no remote roles are specified, assume that
+	// there is a single empty remote role (that should match wildcards)
+	if len(remoteRoles) == 0 {
+		remoteRoles = []string{""}
+	}
+
+	index, err := mapRoles(remoteRoles, r)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return slices.Collect(maps.Keys(index)), nil
+}
+
+// UnmapRoles attempts to deduce what remote-cluster roles a user might have,
+// given the set of local roles the user has.
+func UnmapRoles(r types.RoleMap, remoteUserRoles, localRoles []string) ([]string, error) {
+	index, err := mapRoles(remoteUserRoles, r)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// collect the remote roles of interest
+	remoteRoleSet := utils.NewSet[string]()
+	for _, localRole := range localRoles {
+		rr, ok := index[localRole]
+		if !ok {
+			return nil, trace.BadParameter("not all local roles could be mapped to remote roles")
+		}
+		remoteRoleSet.Add(rr.Elements()...)
+	}
+
+	return remoteRoleSet.Elements(), nil
 }
 
 // UnmarshalTrustedCluster unmarshals the TrustedCluster resource from JSON.
diff --git a/lib/services/unified_resource.go b/lib/services/unified_resource.go
index 4af8e030208b6..e8567f56083a0 100644
--- a/lib/services/unified_resource.go
+++ b/lib/services/unified_resource.go
@@ -33,12 +33,13 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
-	"github.com/gravitational/teleport/lib/utils/pagination"
 )
 
 // UnifiedResourceCacheConfig is used to configure a UnifiedResourceCache
@@ -65,7 +66,7 @@ type UnifiedResourceCache struct {
 	typeTree *btree.BTreeG[*item]
 	// resources is a map of all resources currently tracked in the tree
 	// the key is always name/type
-	resources       map[string]resource
+	resources       map[string]resourceCollection
 	initializationC chan struct{}
 	stale           bool
 	once            sync.Once
@@ -97,7 +98,7 @@ func NewUnifiedResourceCache(ctx context.Context, cfg UnifiedResourceCacheConfig
 		typeTree: btree.NewG(cfg.BTreeDegree, func(a, b *item) bool {
 			return a.Less(b)
 		}),
-		resources:       make(map[string]resource),
+		resources:       make(map[string]resourceCollection),
 		initializationC: make(chan struct{}),
 		ResourceGetter:  cfg.ResourceGetter,
 		cache:           lazyCache,
@@ -127,31 +128,26 @@ func (cfg *UnifiedResourceCacheConfig) CheckAndSetDefaults() error {
 func (c *UnifiedResourceCache) putLocked(resource resource) {
 	key := resourceKey(resource)
 	sortKey := makeResourceSortKey(resource)
-	oldResource, exists := c.resources[key]
-	if exists {
+	if collection, exists := c.resources[key]; exists {
 		// If the resource has changed in such a way that the sort keys
 		// for the nameTree or typeTree change, remove the old entries
 		// from those trees before adding a new one. This can happen
 		// when a node's hostname changes
-		oldSortKey := makeResourceSortKey(oldResource)
+		oldSortKey := makeResourceSortKey(collection.get())
 		if oldSortKey.byName.Compare(sortKey.byName) != 0 {
 			c.deleteSortKey(oldSortKey)
 		}
+		collection.put(resource)
+	} else {
+		c.resources[key] = newResourceCollection(resource)
 	}
-	c.resources[key] = resource
 	c.nameTree.ReplaceOrInsert(&item{Key: sortKey.byName, Value: key})
 	c.typeTree.ReplaceOrInsert(&item{Key: sortKey.byType, Value: key})
 }
 
 func putResources[T resource](cache *UnifiedResourceCache, resources []T) {
 	for _, resource := range resources {
-		// generate the unique resource key and add the resource to the resources map
-		key := resourceKey(resource)
-		cache.resources[key] = resource
-
-		sortKey := makeResourceSortKey(resource)
-		cache.nameTree.ReplaceOrInsert(&item{Key: sortKey.byName, Value: key})
-		cache.typeTree.ReplaceOrInsert(&item{Key: sortKey.byType, Value: key})
+		cache.putLocked(resource)
 	}
 }
 
@@ -167,14 +163,16 @@ func (c *UnifiedResourceCache) deleteSortKey(sortKey resourceSortKey) error {
 
 func (c *UnifiedResourceCache) deleteLocked(res types.Resource) error {
 	key := resourceKey(res)
-	resource, exists := c.resources[key]
+	collection, exists := c.resources[key]
 	if !exists {
 		return trace.NotFound("cannot delete resource: key %s not found in unified resource cache", key)
 	}
 
-	sortKey := makeResourceSortKey(resource)
-	c.deleteSortKey(sortKey)
-	delete(c.resources, key)
+	if empty := collection.remove(res); empty {
+		sortKey := makeResourceSortKey(collection.get())
+		c.deleteSortKey(sortKey)
+		delete(c.resources, key)
+	}
 	return nil
 }
 
@@ -243,13 +241,13 @@ func (c *UnifiedResourceCache) iterateItems(ctx context.Context, start string, s
 						}
 					}
 
-					r, ok := cache.resources[item.Value]
+					collection, ok := cache.resources[item.Value]
 					if !ok {
 						return true
 					}
 
-					if len(kinds) == 0 || c.itemKindMatches(r, kindsMap) {
-						items = append(items, iteratedItem{key: item.Key, resource: r})
+					if len(kinds) == 0 || c.itemKindMatches(collection.get(), kindsMap) {
+						items = append(items, iteratedItem{key: item.Key, resource: collection.get()})
 					}
 
 					if len(items) >= defaultPageSize {
@@ -329,7 +327,7 @@ func (c *UnifiedResourceCache) KubernetesServers(ctx context.Context, params Uni
 
 // WindowsDesktops iterates over all cached windows desktops starting from the provided key.
 func (c *UnifiedResourceCache) WindowsDesktops(ctx context.Context, params UnifiedResourcesIterateParams) iter.Seq2[types.WindowsDesktop, error] {
-	return iterateUnifiedResourceCache(ctx, c, params, types.KindWindowsDesktop, func(desktop types.WindowsDesktop) types.WindowsDesktop { return desktop.Copy() })
+	return iterateUnifiedResourceCache(ctx, c, params, types.KindWindowsDesktop, types.WindowsDesktop.Copy)
 }
 
 // GitServers iterates over all cached git servers starting from the provided key.
@@ -342,7 +340,7 @@ func (c *UnifiedResourceCache) SAMLIdPServiceProviders(ctx context.Context, para
 	return iterateUnifiedResourceCache(ctx, c, params, types.KindSAMLIdPServiceProvider, types.SAMLIdPServiceProvider.Copy)
 }
 
-func iterateUnifiedResourceCache[T any](ctx context.Context, c *UnifiedResourceCache, params UnifiedResourcesIterateParams, kind string, cloneFn func(T) T) iter.Seq2[T, error] {
+func iterateUnifiedResourceCache[T resource](ctx context.Context, c *UnifiedResourceCache, params UnifiedResourcesIterateParams, kind string, cloneFn func(T) T) iter.Seq2[T, error] {
 	return func(yield func(T, error) bool) {
 		sortBy := types.SortBy{IsDesc: params.Descending, Field: SortByName}
 		for i, err := range c.iterateItems(ctx, params.Start, sortBy, kind) {
@@ -352,9 +350,17 @@ func iterateUnifiedResourceCache[T any](ctx context.Context, c *UnifiedResourceC
 				return
 			}
 
-			if !yield(cloneFn(i.resource.(T)), nil) {
+			switch r := i.resource.(type) {
+			case T:
+				if !yield(cloneFn(r), nil) {
+					return
+				}
+			default:
+				var t T
+				yield(t, trace.BadParameter("expected type %T, got %T", t, r))
 				return
 			}
+
 		}
 	}
 }
@@ -411,6 +417,10 @@ func (c *UnifiedResourceCache) itemKindMatches(r resource, kinds map[string]stru
 			return ok
 		}
 
+		if _, ok := kinds[types.KindMCP]; ok && r.GetSubKind() == types.KindMCP {
+			return true
+		}
+
 		_, ok := kinds[types.KindIdentityCenterAccount]
 		return ok
 	case types.KindKubeServer:
@@ -441,8 +451,19 @@ func (c *UnifiedResourceCache) itemKindMatches(r resource, kinds map[string]stru
 			return ok
 		}
 
-		_, ok := kinds[types.KindAppServer]
-		return ok
+		if _, ok := kinds[types.KindAppServer]; ok {
+			return ok
+		}
+
+		if _, ok := kinds[types.KindMCP]; ok {
+			type appGetter interface {
+				GetApp() types.Application
+			}
+			if appServer, ok := r.(appGetter); ok && appServer.GetApp().GetSubKind() == types.SubKindMCP {
+				return true
+			}
+		}
+		return false
 	default:
 		return false
 	}
@@ -473,7 +494,11 @@ func (c *UnifiedResourceCache) GetUnifiedResourcesByIDs(ctx context.Context, ids
 			if !found || res == nil {
 				continue
 			}
-			resource := cache.resources[res.Value]
+			collection, ok := cache.resources[res.Value]
+			if !ok {
+				continue
+			}
+			resource := collection.get()
 			match, err := matchFn(resource)
 			if err != nil {
 				return trace.Wrap(err)
@@ -660,20 +685,7 @@ func (c *UnifiedResourceCache) getDatabaseServers(ctx context.Context) ([]types.
 	if err != nil {
 		return nil, trace.Wrap(err, "getting database servers for unified resource watcher")
 	}
-	// because it's possible to have multiple replicas of a database server serving the same database
-	// we only want to store one based on its internal database resource
-	unique := map[string]struct{}{}
-	resources := make([]types.DatabaseServer, 0, len(newDbs))
-	for _, dbServer := range newDbs {
-		db := dbServer.GetDatabase()
-		if _, ok := unique[db.GetName()]; ok {
-			continue
-		}
-		unique[db.GetName()] = struct{}{}
-		resources = append(resources, dbServer)
-	}
-
-	return resources, nil
+	return newDbs, nil
 }
 
 // getKubeServers will get all kube servers
@@ -682,18 +694,7 @@ func (c *UnifiedResourceCache) getKubeServers(ctx context.Context) ([]types.Kube
 	if err != nil {
 		return nil, trace.Wrap(err, "getting kube servers for unified resource watcher")
 	}
-	unique := map[string]struct{}{}
-	resources := make([]types.KubeServer, 0, len(newKubes))
-	for _, kubeServer := range newKubes {
-		cluster := kubeServer.GetCluster()
-		if _, ok := unique[cluster.GetName()]; ok {
-			continue
-		}
-		unique[cluster.GetName()] = struct{}{}
-		resources = append(resources, kubeServer)
-	}
-
-	return resources, nil
+	return newKubes, nil
 }
 
 // getAppServers will get all application servers
@@ -702,18 +703,7 @@ func (c *UnifiedResourceCache) getAppServers(ctx context.Context) ([]types.AppSe
 	if err != nil {
 		return nil, trace.Wrap(err, "getting app servers for unified resource watcher")
 	}
-	unique := map[string]struct{}{}
-	resources := make([]types.AppServer, 0, len(newApps))
-	for _, appServer := range newApps {
-		app := appServer.GetApp()
-		if _, ok := unique[app.GetName()]; ok {
-			continue
-		}
-		unique[app.GetName()] = struct{}{}
-		resources = append(resources, appServer)
-	}
-
-	return resources, nil
+	return newApps, nil
 }
 
 // getDesktops will get all windows desktops
@@ -750,20 +740,20 @@ func (c *UnifiedResourceCache) getSAMLApps(ctx context.Context) ([]types.SAMLIdP
 
 func (c *UnifiedResourceCache) getIdentityCenterAccounts(ctx context.Context) ([]resource, error) {
 	var accounts []resource
-	var pageRequest pagination.PageRequestToken
+	var startKey string
 	for {
-		resultsPage, nextPage, err := c.ListIdentityCenterAccounts(ctx, apidefaults.DefaultChunkSize, &pageRequest)
+		resp, nextKey, err := c.ListIdentityCenterAccounts(ctx, apidefaults.DefaultChunkSize, startKey)
 		if err != nil {
 			return nil, trace.Wrap(err, "getting AWS Identity Center accounts for resource watcher")
 		}
-		for _, acct := range resultsPage {
-			accounts = append(accounts, IdentityCenterAccountToAppServer(acct.Account))
+		for _, acct := range resp {
+			accounts = append(accounts, IdentityCenterAccountToAppServer(acct))
 		}
 
-		if nextPage == pagination.EndOfList {
+		if nextKey == "" {
 			break
 		}
-		pageRequest.Update(nextPage)
+		startKey = nextKey
 	}
 	return accounts, nil
 }
@@ -786,7 +776,7 @@ func (c *UnifiedResourceCache) getGitServers(ctx context.Context) (all []types.S
 }
 
 // read applies the supplied closure to either the primary tree or the ttl-based fallback tree depending on
-// wether or not the cache is currently healthy.  locking is handled internally and the passed-in tree should
+// whether or not the cache is currently healthy.  locking is handled internally and the passed-in tree should
 // not be accessed after the closure completes.
 func (c *UnifiedResourceCache) read(ctx context.Context, fn func(cache *UnifiedResourceCache) error) error {
 	c.rw.RLock()
@@ -807,7 +797,7 @@ func (c *UnifiedResourceCache) read(ctx context.Context, fn func(cache *UnifiedR
 			typeTree: btree.NewG(c.cfg.BTreeDegree, func(a, b *item) bool {
 				return a.Less(b)
 			}),
-			resources:       make(map[string]resource),
+			resources:       make(map[string]resourceCollection),
 			ResourceGetter:  c.ResourceGetter,
 			initializationC: make(chan struct{}),
 		}
@@ -940,6 +930,241 @@ type resource interface {
 	CloneResource() types.ResourceWithLabels
 }
 
+type resourceCollection interface {
+	get() resource
+	put(r resource)
+	// remove removes a resource from the collection and returns true if the
+	// collection itself should be removed.
+	remove(r types.Resource) bool
+}
+
+func newResourceCollection(r resource) resourceCollection {
+	switch r := r.(type) {
+	case types.DatabaseServer:
+		return newServerResourceCollection(r,
+			func(srv types.DatabaseServer, servers map[string]types.DatabaseServer) types.DatabaseServer {
+				return &aggregatedDatabase{
+					DatabaseServer: srv,
+					status:         aggregateHealthStatuses(servers),
+				}
+			})
+	case types.KubeServer:
+		return newServerResourceCollection(r,
+			func(srv types.KubeServer, servers map[string]types.KubeServer) types.KubeServer {
+				return &aggregatedKube{
+					KubeServer: srv,
+					status:     aggregateHealthStatuses(servers),
+				}
+			})
+	case types.AppServer:
+		return newServerResourceCollection(r,
+			func(srv types.AppServer, servers map[string]types.AppServer) types.AppServer {
+				return &aggregatedAppServer{
+					AppServer: srv,
+					features:  intersectComponentFeaturesForAppServers(servers),
+				}
+			})
+	case serverResource:
+		return newServerResourceCollection(r, nil)
+	default:
+		return &singularResourceCollection{latest: r}
+	}
+}
+
+func aggregateHealthStatuses[T types.TargetHealthStatusGetter](hgs map[string]T) types.TargetHealthStatus {
+	return types.AggregateHealthStatus(func(yield func(types.TargetHealthStatus) bool) {
+		for _, hg := range hgs {
+			if !yield(hg.GetTargetHealthStatus()) {
+				return
+			}
+		}
+	})
+}
+
+type singularResourceCollection struct {
+	latest resource
+}
+
+func (c *singularResourceCollection) get() resource { return c.latest }
+
+func (c *singularResourceCollection) put(r resource) { c.latest = r }
+
+func (c *singularResourceCollection) remove(types.Resource) bool { return true }
+
+// serverResource is a type of resource that may have multiple agents
+// heartbeating it.
+type serverResource interface {
+	resource
+	GetHostID() string
+}
+
+type serverResourceCollection[R serverResource] struct {
+	aggregate     R
+	aggregationFn func(latest R, servers map[string]R) R
+	servers       map[string]R
+}
+
+func newServerResourceCollection[R serverResource](r R, aggFn func(latest R, servers map[string]R) R) *serverResourceCollection[R] {
+	if aggFn == nil {
+		aggFn = func(r R, _ map[string]R) R {
+			return r
+		}
+	}
+	collection := &serverResourceCollection[R]{
+		servers:       make(map[string]R),
+		aggregationFn: aggFn,
+	}
+	collection.put(r)
+	return collection
+}
+
+func (c *serverResourceCollection[R]) get() resource {
+	return c.aggregate
+}
+
+func (c *serverResourceCollection[R]) put(r resource) {
+	if r, ok := r.(R); ok {
+		c.servers[r.GetHostID()] = r
+		c.aggregate = c.aggregationFn(r, c.servers)
+	}
+}
+
+func (c *serverResourceCollection[R]) remove(r types.Resource) bool {
+	// This looks insane, but we only get a [types.ResourceHeader] in
+	// [types.OpDelete] events.
+	// The types that actually implement [resourceServer] all store the host ID
+	// in the description of the resource header metadata on deletion.
+	// If a new type is added that implements [resourceServer] and the
+	// unified resource watchers starts watching it, then please:
+	// - add it to the isResourceServer helper func
+	// - ensure host ID is stored in the metadata description in its event parser
+	// - add test coverage for it in TestUnifiedResourceWatcher_DeleteEvent
+	delete(c.servers, r.GetMetadata().Description)
+	for _, s := range c.servers {
+		c.aggregate = c.aggregationFn(s, c.servers)
+		return false
+	}
+	return true
+}
+
+// aggregatedAppServer wraps an app server with aggregated ComponentFeatures
+// in order to perform an intersection of all features reported by multiple
+// AppServers serving the same app. Only ComponentFeatures supported by *all*
+// AppServers will be reported in the aggregated Resource.
+type aggregatedAppServer struct {
+	types.AppServer
+	features *componentfeaturesv1.ComponentFeatures
+}
+
+// Copy returns a copy of the underlying app server with aggregated
+// [componentfeaturesv1.ComponentFeatures].
+func (a *aggregatedAppServer) Copy() types.AppServer {
+	out := a.AppServer.Copy()
+	out.SetComponentFeatures(a.GetComponentFeatures())
+	return out
+}
+
+// CloneResource returns a copy of the underlying app server with
+// aggregated [componentfeaturesv1.ComponentFeatures].
+func (a *aggregatedAppServer) CloneResource() types.ResourceWithLabels {
+	return a.Copy()
+}
+
+func (a *aggregatedAppServer) GetComponentFeatures() *componentfeaturesv1.ComponentFeatures {
+	if a.features == nil {
+		return nil
+	}
+	return componentfeatures.Join(a.features)
+}
+
+func intersectComponentFeaturesForAppServers(servers map[string]types.AppServer) *componentfeaturesv1.ComponentFeatures {
+	allFeatures := make([]*componentfeaturesv1.ComponentFeatures, 0, len(servers))
+	for _, s := range servers {
+		allFeatures = append(allFeatures, s.GetComponentFeatures())
+	}
+	return componentfeatures.Intersect(allFeatures...)
+}
+
+// aggregatedDatabase wraps a database server with aggregated health status.
+// It is assumed that multiple heartbeats with the same resource name but
+// different host IDs may be received and they may report different health
+// statuses.
+// This type provides the following properties:
+//   - avoid cloning the resource *before* filtering.
+//   - when the resource is cloned *after* filtering, set the clone's health
+//     status to the aggregate health status.
+//
+// Go generics do not support embedding a generic type, otherwise this type
+// would be made generic.
+type aggregatedDatabase struct {
+	types.DatabaseServer
+	status types.TargetHealthStatus
+}
+
+// This type MUST implement [types.DatabaseServer] to act as a facade type,
+// otherwise dynamic assertions elsewhere will fail.
+var _ types.DatabaseServer = (*aggregatedDatabase)(nil)
+
+// GetTargetHealthStatus gets the aggregate health status for filtering by
+// health status.
+func (d *aggregatedDatabase) GetTargetHealthStatus() types.TargetHealthStatus {
+	return d.status
+}
+
+// Copy returns a copy of the underlying database server with aggregated health
+// status.
+func (d *aggregatedDatabase) Copy() types.DatabaseServer {
+	out := d.DatabaseServer.Copy()
+	out.SetTargetHealthStatus(d.status)
+	return out
+}
+
+// CloneResource returns a copy of the underlying database server with
+// aggregated health status.
+func (d *aggregatedDatabase) CloneResource() types.ResourceWithLabels {
+	return d.Copy()
+}
+
+// aggregatedKube wraps a kube server with aggregated health status.
+// It is assumed that multiple heartbeats with the same resource name but
+// different host IDs may be received and they may report different health
+// statuses.
+// This type provides the following properties:
+//   - avoid cloning the resource *before* filtering.
+//   - when the resource is cloned *after* filtering, set the clone's health
+//     status to the aggregate health status.
+//
+// Go generics do not support embedding a generic type, otherwise this type
+// would be made generic.
+type aggregatedKube struct {
+	types.KubeServer
+	status types.TargetHealthStatus
+}
+
+// This type MUST implement [types.KubeServer] to act as a facade type,
+// otherwise dynamic assertions elsewhere will fail.
+var _ types.KubeServer = (*aggregatedKube)(nil)
+
+// GetTargetHealthStatus gets the aggregate health status for filtering by
+// health status.
+func (d *aggregatedKube) GetTargetHealthStatus() types.TargetHealthStatus {
+	return d.status
+}
+
+// Copy returns a copy of the underlying kube server with aggregated health
+// status.
+func (d *aggregatedKube) Copy() types.KubeServer {
+	out := d.KubeServer.Copy()
+	out.SetTargetHealthStatus(d.status)
+	return out
+}
+
+// CloneResource returns a copy of the underlying kube server with
+// aggregated health status.
+func (d *aggregatedKube) CloneResource() types.ResourceWithLabels {
+	return d.Copy()
+}
+
 type item struct {
 	// Key is a key of the key value item. This will be different based on which sorting tree
 	// the item is in
@@ -1045,6 +1270,27 @@ func MakePaginatedResource(requestType string, r types.ResourceWithLabels, requi
 			},
 			RequiresRequest: requiresRequest,
 		}
+	case types.KindIdentityCenterAccount:
+		unwrapper, ok := resource.(types.Resource153UnwrapperT[IdentityCenterAccount])
+		if !ok {
+			return nil, trace.BadParameter("%s has invalid type %T", resourceKind, resource)
+		}
+
+		protoResource = &proto.PaginatedResource{
+			Resource: &proto.PaginatedResource_AppServer{
+				AppServer: IdentityCenterAccountToAppServer(unwrapper.UnwrapT().Account),
+			},
+			RequiresRequest: requiresRequest,
+		}
+	case types.KindIdentityCenterAccountAssignment:
+		unwrapper, ok := resource.(types.Resource153UnwrapperT[IdentityCenterAccountAssignment])
+		if !ok {
+			return nil, trace.BadParameter("%s has invalid type %T", resourceKind, resource)
+		}
+		protoResource = &proto.PaginatedResource{
+			Resource:        proto.PackICAccountAssignment(unwrapper.UnwrapT().AccountAssignment),
+			RequiresRequest: requiresRequest,
+		}
 	case types.KindGitServer:
 		server, ok := resource.(*types.ServerV2)
 		if !ok {
diff --git a/lib/services/unified_resource_test.go b/lib/services/unified_resource_test.go
index f8f1a8277c8ed..8e2b00e444be8 100644
--- a/lib/services/unified_resource_test.go
+++ b/lib/services/unified_resource_test.go
@@ -37,6 +37,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	identitycenterv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -44,6 +45,7 @@ import (
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 )
@@ -110,6 +112,9 @@ func TestUnifiedResourceWatcher(t *testing.T) {
 		Database: db,
 	})
 	require.NoError(t, err)
+	health := dbServer.GetTargetHealth()
+	health.Status = "unknown"
+	dbServer.SetTargetHealth(health)
 	_, err = clt.UpsertDatabaseServer(ctx, dbServer)
 	require.NoError(t, err)
 	gitServer := newGitServer(t, "my-org")
@@ -190,6 +195,7 @@ func TestUnifiedResourceWatcher(t *testing.T) {
 		cmpopts.EquateEmpty(),
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(types.AppServerSpecV3{}, "ComponentFeatures"),
 		// Ignore order.
 		cmpopts.SortSlices(func(a, b types.ResourceWithLabels) bool { return a.GetName() < b.GetName() }),
 	))
@@ -222,6 +228,7 @@ func TestUnifiedResourceWatcher(t *testing.T) {
 		cmpopts.EquateEmpty(),
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(types.AppServerSpecV3{}, "ComponentFeatures"),
 
 		// Ignore order.
 		cmpopts.SortSlices(func(a, b types.ResourceWithLabels) bool { return a.GetName() < b.GetName() }),
@@ -253,6 +260,9 @@ func TestUnifiedResourceCacheIterateResources(t *testing.T) {
 		Database: db,
 	})
 	require.NoError(t, err)
+	health := dbServer.GetTargetHealth()
+	health.Status = "unknown"
+	dbServer.SetTargetHealth(health)
 	_, err = clt.UpsertDatabaseServer(ctx, dbServer)
 	require.NoError(t, err)
 	gitServer := newGitServer(t, "my-org")
@@ -296,7 +306,19 @@ func TestUnifiedResourceCacheIterateResources(t *testing.T) {
 
 	kubeCluster, err := types.NewKubernetesClusterV3(types.Metadata{Name: "kube-cluster"}, types.KubernetesClusterSpecV3{})
 	require.NoError(t, err)
-	kubeServer, err := types.NewKubernetesServerV3FromCluster(kubeCluster, "foo", "1")
+	kubeServer, err := types.NewKubernetesServerV3(types.Metadata{
+		Name: "kube1-server",
+	}, types.KubernetesServerSpecV3{
+		Hostname: "kube-hostname",
+		HostID:   uuid.NewString(),
+		Cluster:  kubeCluster,
+	})
+	kubeHealth := kubeServer.GetTargetHealth()
+	if kubeHealth == nil {
+		kubeHealth = &types.TargetHealth{}
+	}
+	kubeHealth.Status = "unknown"
+	kubeServer.SetTargetHealth(kubeHealth)
 	require.NoError(t, err)
 	_, err = clt.UpsertKubernetesServer(ctx, kubeServer)
 	require.NoError(t, err)
@@ -319,6 +341,7 @@ func TestUnifiedResourceCacheIterateResources(t *testing.T) {
 	compareResourceOpts := []cmp.Option{cmpopts.EquateEmpty(),
 		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(types.AppServerSpecV3{}, "ComponentFeatures"),
 
 		// Ignore order.
 		cmpopts.SortSlices(func(a, b types.ResourceWithLabels) bool { return a.GetName() < b.GetName() }),
@@ -342,7 +365,8 @@ func TestUnifiedResourceCacheIterateResources(t *testing.T) {
 		switch kind {
 		case types.KindAppServer:
 			kind = types.KindApp
-			if r.GetSubKind() == types.KindIdentityCenterAccount {
+			switch r.GetSubKind() {
+			case types.KindIdentityCenterAccount:
 				kind = types.KindIdentityCenterAccount
 			}
 		case types.KindDatabaseServer:
@@ -405,7 +429,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 
 	const resourceCount = 1234
 	ids := make([]string, 0, resourceCount)
-	for i := 0; i < resourceCount; i++ {
+	for i := range resourceCount {
 		ids = append(ids, "resource"+strconv.Itoa(i))
 	}
 
@@ -445,27 +469,33 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 		{
 			name: "databases",
 			createResource: func(name string, c *client) error {
-				db, err := types.NewDatabaseV3(types.Metadata{
-					Name: name,
-				}, types.DatabaseSpecV3{
-					Protocol: "test-protocol",
-					URI:      "test-uri",
-				})
-				if err != nil {
-					return err
-				}
-				dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-					Name: name,
-				}, types.DatabaseServerSpecV3{
-					Hostname: "hostname:" + name,
-					HostID:   uuid.NewString(),
-					Database: db,
-				})
-				if err != nil {
-					return err
+				for _, status := range []string{"healthy", "unhealthy", "unknown"} {
+					db, err := types.NewDatabaseV3(types.Metadata{
+						Name: name,
+					}, types.DatabaseSpecV3{
+						Protocol: "test-protocol",
+						URI:      "test-uri",
+					})
+					if err != nil {
+						return err
+					}
+					dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+						Name: name,
+					}, types.DatabaseServerSpecV3{
+						Hostname: "hostname:" + name,
+						HostID:   uuid.NewString(),
+						Database: db,
+					})
+					if err != nil {
+						return err
+					}
+					dbServer.SetTargetHealth(types.TargetHealth{Status: status})
+					_, err = c.UpsertDatabaseServer(ctx, dbServer)
+					if err != nil {
+						return err
+					}
 				}
-				_, err = c.UpsertDatabaseServer(ctx, dbServer)
-				return err
+				return nil
 			},
 			iterateResources: func(urc *services.UnifiedResourceCache, descending bool) iter.Seq2[GetNamer, error] {
 				return func(yield func(GetNamer, error) bool) {
@@ -516,16 +546,28 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 		{
 			name: "kubernetes",
 			createResource: func(name string, c *client) error {
-				kubeCluster, err := types.NewKubernetesClusterV3(types.Metadata{Name: name}, types.KubernetesClusterSpecV3{})
-				if err != nil {
-					return err
-				}
-				kubeServer, err := types.NewKubernetesServerV3FromCluster(kubeCluster, name, "1")
-				if err != nil {
-					return err
+				for _, status := range []string{"healthy", "unhealthy", "unknown"} {
+					kubeCluster, err := types.NewKubernetesClusterV3(types.Metadata{Name: name}, types.KubernetesClusterSpecV3{})
+					if err != nil {
+						return err
+					}
+					kubeServer, err := types.NewKubernetesServerV3(types.Metadata{
+						Name: name,
+					}, types.KubernetesServerSpecV3{
+						Hostname: "hostname:" + name,
+						HostID:   uuid.NewString(),
+						Cluster:  kubeCluster,
+					})
+					if err != nil {
+						return err
+					}
+					kubeServer.SetTargetHealth(&types.TargetHealth{Status: status})
+					_, err = c.UpsertKubernetesServer(ctx, kubeServer)
+					if err != nil {
+						return err
+					}
 				}
-				_, err = c.UpsertKubernetesServer(ctx, kubeServer)
-				return err
+				return nil
 			},
 			iterateResources: func(urc *services.UnifiedResourceCache, descending bool) iter.Seq2[GetNamer, error] {
 				return func(yield func(GetNamer, error) bool) {
@@ -663,7 +705,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			for i := 0; i < resourceCount; i++ {
+			for i := range resourceCount {
 				require.NoError(t, test.createResource(ids[i], clt), "creating resource %d", i)
 			}
 
@@ -684,6 +726,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 						if r.GetName() != ids[count] {
 							t.Fatalf("expected resource named %s, got %s", ids[count], r.GetName())
 						}
+						requireHealthStatusIfGiven(t, r, types.TargetHealthStatusMixed)
 						count++
 					}
 
@@ -698,6 +741,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 						if r.GetName() != ids[count] {
 							t.Fatalf("expected resource named %s, got %s", ids[count], r.GetName())
 						}
+						requireHealthStatusIfGiven(t, r, types.TargetHealthStatusMixed)
 						count--
 					}
 
@@ -720,6 +764,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 							if r.GetName() != ids[count] {
 								t.Fatalf("expected resource named %s, got %s", ids[count], r.GetName())
 							}
+							requireHealthStatusIfGiven(t, r, types.TargetHealthStatusMixed)
 							count++
 						}
 
@@ -748,6 +793,7 @@ func TestUnifiedResourceCacheIteration(t *testing.T) {
 							if r.GetName() != ids[count] {
 								t.Fatalf("expected resource named %s, got %s", ids[count], r.GetName())
 							}
+							requireHealthStatusIfGiven(t, r, types.TargetHealthStatusMixed)
 							count--
 						}
 
@@ -802,6 +848,124 @@ func TestUnifiedResourceWatcher_PreventDuplicates(t *testing.T) {
 
 }
 
+func TestUnifiedResourceCache_AppServerComponentFeaturesIntersection(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	const appName = "aws-console-app"
+
+	makeAppServer := func(
+		t *testing.T,
+		hostID string,
+		features *componentfeaturesv1.ComponentFeatures,
+	) *types.AppServerV3 {
+		t.Helper()
+		srv, err := types.NewAppServerV3(
+			types.Metadata{Name: appName},
+			types.AppServerSpecV3{
+				HostID: hostID,
+				App:    newApp(t, appName),
+			},
+		)
+		require.NoError(t, err)
+		if features != nil {
+			srv.SetComponentFeatures(features)
+		}
+		return srv
+	}
+
+	findAppServer := func(
+		t *testing.T,
+		w *services.UnifiedResourceCache,
+		appName string,
+	) types.AppServer {
+		t.Helper()
+		var (
+			aggregatedServer types.AppServer
+			count            int
+		)
+		for srv, err := range w.AppServers(ctx, services.UnifiedResourcesIterateParams{}) {
+			require.NoError(t, err)
+			if srv.GetApp() == nil || srv.GetApp().GetName() != appName {
+				continue
+			}
+			aggregatedServer = srv
+			count++
+		}
+		require.Equal(t, 1, count, "expected exactly one AppServer for app %q", appName)
+		require.NotNil(t, aggregatedServer, "expected non-nil AppServer for app %q", appName)
+		return aggregatedServer
+	}
+
+	createUnifiedResourceCache := func(t *testing.T, clt *client) *services.UnifiedResourceCache {
+		t.Helper()
+		w, err := services.NewUnifiedResourceCache(ctx, services.UnifiedResourceCacheConfig{
+			ResourceWatcherConfig: services.ResourceWatcherConfig{
+				Component: teleport.ComponentUnifiedResource,
+				Client:    clt,
+			},
+			ResourceGetter: clt,
+		})
+		require.NoError(t, err)
+		assert.Eventually(t, func() bool {
+			return w.IsInitialized()
+		}, 5*time.Second, 10*time.Millisecond, "unified resource watcher never initialized")
+		return w
+	}
+
+	t.Run("feature advertised by only one AppServer is not advertised by the aggregated AppServer", func(t *testing.T) {
+		t.Parallel()
+
+		clt := newClient(t)
+
+		shared := componentfeatures.FeatureResourceConstraintsV1
+		onlyOnOne := componentfeatures.FeatureID(9999)
+
+		appSrv1 := makeAppServer(t, "host-1", componentfeatures.New(shared, onlyOnOne))
+		_, err := clt.UpsertApplicationServer(ctx, appSrv1)
+		require.NoError(t, err)
+		appSrv2 := makeAppServer(t, "host-2", componentfeatures.New(shared))
+		_, err = clt.UpsertApplicationServer(ctx, appSrv2)
+		require.NoError(t, err)
+
+		w := createUnifiedResourceCache(t, clt)
+
+		// There should be a single AppServer for this app, with features = intersection(shared, onlyOnOne) = shared
+		aggregatedServer := findAppServer(t, w, appName)
+		cf := aggregatedServer.GetComponentFeatures()
+
+		require.NotNil(t, cf, "aggregated AppServer should have non-nil ComponentFeatures")
+		require.ElementsMatch(t, []componentfeaturesv1.ComponentFeatureID{
+			shared.ToProto(),
+		}, cf.GetFeatures(), fmt.Sprintf("expected intersection to contain only '%s'", shared.String()))
+	})
+
+	t.Run("any empty or nil feature set yields empty intersection", func(t *testing.T) {
+		t.Parallel()
+
+		clt := newClient(t)
+
+		shared := componentfeatures.FeatureResourceConstraintsV1
+
+		appSrv1 := makeAppServer(t, "host-1", componentfeatures.New(shared))
+		_, err := clt.UpsertApplicationServer(ctx, appSrv1)
+		require.NoError(t, err)
+		appSrv2 := makeAppServer(t, "host-2", nil)
+		_, err = clt.UpsertApplicationServer(ctx, appSrv2)
+		require.NoError(t, err)
+
+		w := createUnifiedResourceCache(t, clt)
+
+		// There should be a single AppServer for this app, with features = intersection(shared, empty) = empty
+		aggregatedServer := findAppServer(t, w, appName)
+		cf := aggregatedServer.GetComponentFeatures()
+
+		require.NotNil(t, cf, "aggregated AppServer should have non-nil ComponentFeatures")
+		require.Empty(t, cf.Features, "expected empty intersection when one of the feature sets is nil or empty")
+	})
+}
+
 func TestUnifiedResourceWatcher_DeleteEvent(t *testing.T) {
 	t.Parallel()
 
@@ -821,24 +985,28 @@ func TestUnifiedResourceWatcher_DeleteEvent(t *testing.T) {
 	_, err = clt.UpsertNode(ctx, node)
 	require.NoError(t, err)
 
-	// add a database server
-	db, err := types.NewDatabaseV3(types.Metadata{
-		Name: "db1",
-	}, types.DatabaseSpecV3{
-		Protocol: "test-protocol",
-		URI:      "test-uri",
-	})
-	require.NoError(t, err)
-	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-		Name: "db1-server",
-	}, types.DatabaseServerSpecV3{
-		Hostname: "db-hostname",
-		HostID:   uuid.NewString(),
-		Database: db,
-	})
-	require.NoError(t, err)
-	_, err = clt.UpsertDatabaseServer(ctx, dbServer)
-	require.NoError(t, err)
+	// add multiple database servers for the same db (HA setup)
+	var dbServers []*types.DatabaseServerV3
+	for range 3 {
+		db, err := types.NewDatabaseV3(types.Metadata{
+			Name: "db1",
+		}, types.DatabaseSpecV3{
+			Protocol: "test-protocol",
+			URI:      "test-uri",
+		})
+		require.NoError(t, err)
+		dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+			Name: "db1-server",
+		}, types.DatabaseServerSpecV3{
+			Hostname: "db-hostname",
+			HostID:   uuid.NewString(),
+			Database: db,
+		})
+		require.NoError(t, err)
+		_, err = clt.UpsertDatabaseServer(ctx, dbServer)
+		require.NoError(t, err)
+		dbServers = append(dbServers, dbServer)
+	}
 
 	// add a saml app
 	samlapp, err := types.NewSAMLIdPServiceProvider(
@@ -854,52 +1022,64 @@ func TestUnifiedResourceWatcher_DeleteEvent(t *testing.T) {
 	err = clt.CreateSAMLIdPServiceProvider(ctx, samlapp)
 	require.NoError(t, err)
 
-	// Add an app server
-	app, err := types.NewAppServerV3(
-		types.Metadata{Name: "app1"},
-		types.AppServerSpecV3{
-			HostID: "app1-host-id",
-			App:    newApp(t, "app1"),
-		},
-	)
-	require.NoError(t, err)
-	_, err = clt.UpsertApplicationServer(ctx, app)
-	require.NoError(t, err)
+	// Add multiple app servers for the same app (HA setup)
+	var appServers []*types.AppServerV3
+	for range 3 {
+		app, err := types.NewAppServerV3(
+			types.Metadata{Name: "app1"},
+			types.AppServerSpecV3{
+				HostID: uuid.NewString(),
+				App:    newApp(t, "app1"),
+			},
+		)
+		require.NoError(t, err)
+		_, err = clt.UpsertApplicationServer(ctx, app)
+		require.NoError(t, err)
+		appServers = append(appServers, app)
+	}
 
-	// add desktop
-	desktop, err := types.NewWindowsDesktopV3(
-		"desktop",
-		map[string]string{"label": string(make([]byte, 0))},
-		types.WindowsDesktopSpecV3{
-			Addr:   "addr",
-			HostID: "HostID",
-		})
-	require.NoError(t, err)
-	err = clt.UpsertWindowsDesktop(ctx, desktop)
-	require.NoError(t, err)
+	// add multiple desktops (HA setup)
+	var desktops []*types.WindowsDesktopV3
+	for range 3 {
+		desktop, err := types.NewWindowsDesktopV3(
+			"desktop",
+			map[string]string{"label": string(make([]byte, 0))},
+			types.WindowsDesktopSpecV3{
+				Addr:   "addr",
+				HostID: uuid.NewString(),
+			})
+		require.NoError(t, err)
+		err = clt.UpsertWindowsDesktop(ctx, desktop)
+		require.NoError(t, err)
+		desktops = append(desktops, desktop)
+	}
 
-	// add kube
-	kube, err := types.NewKubernetesClusterV3(
-		types.Metadata{
-			Name:      "kube",
-			Namespace: defaults.Namespace,
-		},
-		types.KubernetesClusterSpecV3{},
-	)
-	require.NoError(t, err)
-	kubeServer, err := types.NewKubernetesServerV3(
-		types.Metadata{
-			Name:      "kube_server",
-			Namespace: defaults.Namespace,
-		},
-		types.KubernetesServerSpecV3{
-			Cluster: kube,
-			HostID:  "hostID",
-		},
-	)
-	require.NoError(t, err)
-	_, err = clt.UpsertKubernetesServer(ctx, kubeServer)
-	require.NoError(t, err)
+	// add multiple kube servers (HA setup)
+	var kubeServers []*types.KubernetesServerV3
+	for range 3 {
+		kube, err := types.NewKubernetesClusterV3(
+			types.Metadata{
+				Name:      "kube",
+				Namespace: defaults.Namespace,
+			},
+			types.KubernetesClusterSpecV3{},
+		)
+		require.NoError(t, err)
+		kubeServer, err := types.NewKubernetesServerV3(
+			types.Metadata{
+				Name:      "kube_server",
+				Namespace: defaults.Namespace,
+			},
+			types.KubernetesServerSpecV3{
+				Cluster: kube,
+				HostID:  uuid.NewString(),
+			},
+		)
+		require.NoError(t, err)
+		_, err = clt.UpsertKubernetesServer(ctx, kubeServer)
+		require.NoError(t, err)
+		kubeServers = append(kubeServers, kubeServer)
+	}
 
 	icAcct := newICAccount(t, ctx, clt)
 
@@ -913,28 +1093,69 @@ func TestUnifiedResourceWatcher_DeleteEvent(t *testing.T) {
 		return len(res) == 8
 	}, 5*time.Second, 10*time.Millisecond, "Timed out waiting for unified resources to be added")
 
-	// delete everything
-	err = clt.DeleteNode(ctx, "default", node.GetName())
+	// delete just one of each of the HA servers
+	err = clt.DeleteDatabaseServer(ctx, "default", dbServers[0].Spec.HostID, dbServers[0].GetName())
 	require.NoError(t, err)
-	err = clt.DeleteDatabaseServer(ctx, "default", dbServer.Spec.HostID, dbServer.GetName())
+	dbServers = dbServers[1:]
+	err = clt.DeleteApplicationServer(ctx, "default", appServers[0].Spec.HostID, appServers[0].GetName())
 	require.NoError(t, err)
-	err = clt.DeleteSAMLIdPServiceProvider(ctx, samlapp.GetName())
+	appServers = appServers[1:]
+	err = clt.DeleteWindowsDesktop(ctx, desktops[0].Spec.HostID, desktops[0].GetName())
 	require.NoError(t, err)
-	err = clt.DeleteApplicationServer(ctx, "default", app.Spec.HostID, app.GetName())
+	desktops = desktops[1:]
+	err = clt.DeleteKubernetesServer(ctx, kubeServers[0].Spec.HostID, kubeServers[0].GetName())
 	require.NoError(t, err)
-	err = clt.DeleteWindowsDesktop(ctx, desktop.Spec.HostID, desktop.GetName())
+	kubeServers = kubeServers[1:]
+
+	// delete everything else
+	err = clt.DeleteNode(ctx, "default", node.GetName())
 	require.NoError(t, err)
-	err = clt.DeleteKubernetesServer(ctx, kubeServer.Spec.HostID, kubeServer.GetName())
+	err = clt.DeleteSAMLIdPServiceProvider(ctx, samlapp.GetName())
 	require.NoError(t, err)
 	err = clt.DeleteIdentityCenterAccount(ctx, services.IdentityCenterAccountID(icAcct.GetMetadata().GetName()))
 	require.NoError(t, err)
 	err = clt.DeleteGitServer(ctx, gitServer.GetName())
 	require.NoError(t, err)
 
-	assert.Eventually(t, func() bool {
-		res, _ := w.GetUnifiedResources(ctx)
-		return len(res) == 0
-	}, 5*time.Second, 10*time.Millisecond, "Timed out waiting for unified resources to be deleted")
+	duplicatedServerNames := []string{
+		appServers[0].GetName(),
+		dbServers[0].GetName(),
+		desktops[0].GetName(),
+		kubeServers[0].GetName(),
+	}
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		res, err := w.GetUnifiedResources(ctx)
+		if !assert.NoError(t, err) {
+			return
+		}
+		assert.ElementsMatch(t, duplicatedServerNames, slices.Collect(types.ResourceNames(res)))
+	}, 5*time.Second, 100*time.Millisecond, "Timed out waiting for unified resources to be deleted except for HA servers")
+
+	// delete all remaining (db, kube, app, desktop) servers
+	for _, dbServer := range dbServers {
+		err = clt.DeleteDatabaseServer(ctx, "default", dbServer.Spec.HostID, dbServer.GetName())
+		require.NoError(t, err)
+	}
+	for _, appServer := range appServers {
+		err = clt.DeleteApplicationServer(ctx, "default", appServer.Spec.HostID, appServer.GetName())
+		require.NoError(t, err)
+	}
+	for _, desktop := range desktops {
+		err = clt.DeleteWindowsDesktop(ctx, desktop.Spec.HostID, desktop.GetName())
+		require.NoError(t, err)
+	}
+	for _, kubeServer := range kubeServers {
+		err = clt.DeleteKubernetesServer(ctx, kubeServer.Spec.HostID, kubeServer.GetName())
+		require.NoError(t, err)
+	}
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		res, err := w.GetUnifiedResources(ctx)
+		if !assert.NoError(t, err) {
+			return
+		}
+		assert.Empty(t, res)
+	}, 5*time.Second, 100*time.Millisecond, "Timed out waiting for unified resources to be deleted")
 }
 
 func newTestEntityDescriptor(entityID string) string {
@@ -967,35 +1188,34 @@ func newICAccount(t *testing.T, ctx context.Context, svc services.IdentityCenter
 
 	accountID := t.Name()
 
-	icAcct, err := svc.CreateIdentityCenterAccount(ctx, services.IdentityCenterAccount{
-		Account: &identitycenterv1.Account{
-			Kind:    types.KindIdentityCenterAccount,
-			Version: types.V1,
-			Metadata: &headerv1.Metadata{
-				Name: t.Name(),
-				Labels: map[string]string{
-					types.OriginLabel: common.OriginAWSIdentityCenter,
-				},
+	icAcct, err := svc.CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+		Kind:    types.KindIdentityCenterAccount,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: t.Name(),
+			Labels: map[string]string{
+				types.OriginLabel: common.OriginAWSIdentityCenter,
 			},
-			Spec: &identitycenterv1.AccountSpec{
-				Id:          accountID,
-				Arn:         "arn:aws:sso:::account/" + accountID,
-				Name:        "Test AWS Account",
-				Description: "Used for testing",
-				PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
-					{
-						Name: "Alpha",
-						Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-alpha",
-					},
-					{
-						Name: "Beta",
-						Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-beta",
-					},
+		},
+		Spec: &identitycenterv1.AccountSpec{
+			Id:          accountID,
+			Arn:         "arn:aws:sso:::account/" + accountID,
+			Name:        "Test AWS Account",
+			Description: "Used for testing",
+			PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
+				{
+					Name: "Alpha",
+					Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-alpha",
+				},
+				{
+					Name: "Beta",
+					Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-beta",
 				},
 			},
-		}})
+		},
+	})
 	require.NoError(t, err, "creating Identity Center Account")
-	return icAcct.Account
+	return icAcct
 }
 
 func TestOktaAppServers(t *testing.T) {
@@ -1047,3 +1267,148 @@ func mustCreateOktaAppServer(t *testing.T, name, friendlyName string) *types.App
 	require.NoError(t, err)
 	return resource
 }
+
+func requireHealthStatusIfGiven(t *testing.T, r any, want types.TargetHealthStatus) {
+	t.Helper()
+	if r, ok := r.(types.TargetHealthStatusGetter); ok {
+		require.Equal(t, want, r.GetTargetHealthStatus(), "resource %v", r)
+	}
+}
+
+func newAppServerFromApp(t *testing.T, app *types.AppV3) *types.AppServerV3 {
+	t.Helper()
+	appServer, err := types.NewAppServerV3(
+		types.Metadata{
+			Name: app.GetName(),
+		},
+		types.AppServerSpecV3{
+			HostID: fmt.Sprintf("%s-host-id", app.GetName()),
+			App:    app,
+		},
+	)
+	require.NoError(t, err)
+	return appServer
+}
+
+func newMCPServerApp(t *testing.T, name string) *types.AppV3 {
+	t.Helper()
+	app, err := types.NewAppV3(types.Metadata{
+		Name: name,
+	}, types.AppSpecV3{
+		MCP: &types.MCP{
+			Command:       "test",
+			RunAsHostUser: "test",
+		},
+	})
+	require.NoError(t, err)
+	return app
+}
+
+func TestUnifiedResourceCacheIterateMCPServers(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	clt := newClient(t)
+
+	app, err := types.NewAppServerV3(
+		types.Metadata{Name: "app1"},
+		types.AppServerSpecV3{
+			HostID: "app1-host-id",
+			App:    newApp(t, "app1"),
+		},
+	)
+	require.NoError(t, err)
+	_, err = clt.UpsertApplicationServer(ctx, app)
+	require.NoError(t, err)
+
+	mcpServer := newAppServerFromApp(t, newMCPServerApp(t, "mcp1"))
+	_, err = clt.UpsertApplicationServer(ctx, mcpServer)
+	require.NoError(t, err)
+
+	w, err := services.NewUnifiedResourceCache(ctx, services.UnifiedResourceCacheConfig{
+		ResourceWatcherConfig: services.ResourceWatcherConfig{
+			Component: teleport.ComponentUnifiedResource,
+			Client:    clt,
+		},
+		ResourceGetter: clt,
+	})
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		return w.IsInitialized()
+	}, 5*time.Second, 10*time.Millisecond, "unified resource watcher never initialized")
+
+	compareResourceOpts := []cmp.Option{cmpopts.EquateEmpty(),
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
+		cmpopts.IgnoreFields(types.AppServerSpecV3{}, "ComponentFeatures"),
+
+		// Ignore order.
+		cmpopts.SortSlices(func(a, b types.ResourceWithLabels) bool { return a.GetName() < b.GetName() }),
+	}
+
+	collect := func(t *testing.T, iter iter.Seq2[types.ResourceWithLabels, error]) (collected []types.ResourceWithLabels) {
+		for r, err := range iter {
+			require.NoError(t, err)
+			collected = append(collected, r)
+		}
+		return collected
+	}
+
+	tests := []struct {
+		name       string
+		inputKinds []string
+		expected   []types.ResourceWithLabels
+	}{
+		{
+			name: "no kinds provided",
+			expected: []types.ResourceWithLabels{
+				app, mcpServer,
+			},
+		},
+		{
+			name: "app kind",
+			inputKinds: []string{
+				types.KindApp, types.KindDatabaseServer,
+			},
+			expected: []types.ResourceWithLabels{
+				app, mcpServer,
+			},
+		},
+		{
+			name: "mcp kind",
+			inputKinds: []string{
+				types.KindMCP, types.KindDatabase,
+			},
+			expected: []types.ResourceWithLabels{
+				mcpServer,
+			},
+		},
+		{
+			name: "mcp and app kind",
+			inputKinds: []string{
+				types.KindMCP, types.KindApp,
+			},
+			expected: []types.ResourceWithLabels{
+				app, mcpServer,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := collect(t, w.Resources(
+				ctx,
+				"",
+				types.SortBy{Field: services.SortByKind},
+				test.inputKinds...,
+			))
+			require.Empty(t, cmp.Diff(
+				test.expected,
+				actual,
+				compareResourceOpts...,
+			))
+
+		})
+	}
+}
diff --git a/lib/services/user.go b/lib/services/user.go
index dd02c9fc5ed1a..751a7fd340899 100644
--- a/lib/services/user.go
+++ b/lib/services/user.go
@@ -143,3 +143,26 @@ func MarshalUser(user types.User, opts ...MarshalOption) ([]byte, error) {
 func UsernameForRemoteCluster(localUsername, localClusterName string) string {
 	return fmt.Sprintf("remote-%v-%v", localUsername, localClusterName)
 }
+
+// UsernameForClusterConfig is a configuration struct for UsernameForCluster.
+type UsernameForClusterConfig struct {
+	// User is the username.
+	User string
+	// OriginClusterName is the cluster name where the user is authenticated.
+	OriginClusterName string
+	// LocalClusterName is the local cluster name.
+	LocalClusterName string
+}
+
+// UsernameForCluster returns an username that is prefixed with "remote-"
+// and suffixed with cluster name if the user is from a remote cluster,
+// otherwise returns the local username.
+func UsernameForCluster(cfg UsernameForClusterConfig) string {
+	// originClusterName == "" is a special case for backward compatibility
+	// with older clients that do not send origin cluster name.
+	// In this case we assume the user is local.
+	if cfg.OriginClusterName == cfg.LocalClusterName || cfg.OriginClusterName == "" {
+		return cfg.User
+	}
+	return UsernameForRemoteCluster(cfg.User, cfg.OriginClusterName)
+}
diff --git a/lib/services/user_login_state.go b/lib/services/user_login_state.go
index 8097dbd15c4d9..d28f0033f8258 100644
--- a/lib/services/user_login_state.go
+++ b/lib/services/user_login_state.go
@@ -31,9 +31,10 @@ import (
 type UserLoginStatesGetter interface {
 	// GetUserLoginStates returns the all user login state resources.
 	GetUserLoginStates(context.Context) ([]*userloginstate.UserLoginState, error)
-
 	// GetUserLoginState returns the specified user login state resource.
 	GetUserLoginState(context.Context, string) (*userloginstate.UserLoginState, error)
+	// ListUserLoginStates returns a paginated list of user login state resources.
+	ListUserLoginStates(ctx context.Context, pageSize int, nextToken string) ([]*userloginstate.UserLoginState, string, error)
 }
 
 // UserLoginStates is the interface for managing with user login states.
@@ -101,10 +102,10 @@ type UserOrLoginStateGetter interface {
 	UserGetter
 }
 
-// GetUserOrLoginState will return the given user or the login state associated with the user.
+// GetUserOrLoginState will return the given user login state or if not found, the user itself.
 func GetUserOrLoginState(ctx context.Context, getter UserOrLoginStateGetter, username string) (UserState, error) {
 	uls, err := getter.GetUserLoginState(ctx, username)
-	if err != nil && !trace.IsNotFound(err) {
+	if err != nil && !trace.IsNotFound(err) && !trace.IsAccessDenied(err) {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/services/user_test.go b/lib/services/user_test.go
index 16e10b1ae6c4c..a40c325383fca 100644
--- a/lib/services/user_test.go
+++ b/lib/services/user_test.go
@@ -368,3 +368,53 @@ func claimsToAttributes(claims map[string]any) saml2.AssertionInfo {
 	}
 	return info
 }
+
+func TestUsernameForCluster(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		username         string
+		originCluster    string
+		localClusterName string
+		expected         string
+	}{
+
+		{
+			username:         "alice",
+			originCluster:    "leaf",
+			localClusterName: "root",
+			expected:         "remote-alice-leaf",
+		},
+		{
+			username:         "bob",
+			originCluster:    "",
+			localClusterName: "root",
+			expected:         "bob",
+		},
+		{
+			username:         "carol",
+			originCluster:    "leaf.cluster",
+			localClusterName: "root.cluster",
+			expected:         "remote-carol-leaf.cluster",
+		},
+		{
+			username:         "dave",
+			originCluster:    "leaf-cluster",
+			localClusterName: "leaf-cluster",
+			expected:         "dave",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.username, func(t *testing.T) {
+			result := UsernameForCluster(
+				UsernameForClusterConfig{
+					User:              test.username,
+					OriginClusterName: test.originCluster,
+					LocalClusterName:  test.localClusterName,
+				},
+			)
+			require.Equal(t, test.expected, result)
+		})
+	}
+}
diff --git a/lib/services/useracl.go b/lib/services/useracl.go
index 77602945e338a..45d265c06a93c 100644
--- a/lib/services/useracl.go
+++ b/lib/services/useracl.go
@@ -122,6 +122,10 @@ type UserACL struct {
 	FileTransferAccess bool `json:"fileTransferAccess"`
 	// GitServers defines access to Git servers.
 	GitServers ResourceAccess `json:"gitServers"`
+	// WorkloadIdentity defines access to Workload Identity
+	WorkloadIdentity ResourceAccess `json:"workloadIdentity"`
+	// ClientIPRestriction defines access to Cloud IP Restrictions
+	ClientIPRestriction ResourceAccess `json:"clientIpRestriction"`
 }
 
 func hasAccess(roleSet RoleSet, ctx *Context, kind string, verbs ...string) bool {
@@ -217,6 +221,7 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 	userTasksAccess := newAccess(userRoles, ctx, types.KindUserTask)
 	reviewRequests := userRoles.MaybeCanReviewRequests()
 	fileTransferAccess := userRoles.CanCopyFiles()
+	workloadIdentity := newAccess(userRoles, ctx, types.KindWorkloadIdentity)
 
 	var auditQuery ResourceAccess
 	var securityReports ResourceAccess
@@ -227,6 +232,11 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 
 	contact := newAccess(userRoles, ctx, types.KindContact)
 
+	var clientIPRestrictions ResourceAccess
+	if features.Cloud {
+		clientIPRestrictions = newAccess(userRoles, ctx, types.KindClientIPRestriction)
+	}
+
 	return UserACL{
 		AccessRequests:          requestAccess,
 		AppServers:              appServerAccess,
@@ -271,5 +281,7 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 		Contact:                 contact,
 		FileTransferAccess:      fileTransferAccess,
 		GitServers:              gitServersAccess,
+		WorkloadIdentity:        workloadIdentity,
+		ClientIPRestriction:     clientIPRestrictions,
 	}
 }
diff --git a/lib/services/useracl_test.go b/lib/services/useracl_test.go
index 189d24bfa2f2c..17d781903e638 100644
--- a/lib/services/useracl_test.go
+++ b/lib/services/useracl_test.go
@@ -55,6 +55,10 @@ func TestNewUserACL(t *testing.T) {
 			Resources: []string{types.KindContact},
 			Verbs:     RW(),
 		},
+		{
+			Resources: []string{types.KindClientIPRestriction},
+			Verbs:     RW(),
+		},
 	})
 
 	// not setting the rule, or explicitly denying, both denies Access
@@ -110,12 +114,15 @@ func TestNewUserACL(t *testing.T) {
 	require.Empty(t, cmp.Diff(userContext.Download, denied))
 	require.Empty(t, cmp.Diff(userContext.Contact, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.GitServers, denied))
+	// cloud IP restrictions should be denied because features doesn't include Cloud
+	require.Empty(t, cmp.Diff(userContext.ClientIPRestriction, denied))
 
 	// test enabling of the 'Use' verb
 	require.Empty(t, cmp.Diff(userContext.Integrations, ResourceAccess{true, true, true, true, true, true}))
 
 	userContext = NewUserACL(user, roleSet, proto.Features{Cloud: true}, true, false)
 	require.Empty(t, cmp.Diff(userContext.Billing, ResourceAccess{true, true, false, false, false, false}))
+	require.Empty(t, cmp.Diff(userContext.ClientIPRestriction, allowedRW))
 
 	// test that desktopRecordingEnabled being false overrides the roleSet.RecordDesktopSession() returning true
 	userContext = NewUserACL(user, roleSet, proto.Features{}, false, false)
diff --git a/lib/services/watcher.go b/lib/services/watcher.go
index d4eeb46a6cf7d..38437220cbed6 100644
--- a/lib/services/watcher.go
+++ b/lib/services/watcher.go
@@ -34,8 +34,10 @@ import (
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/defaults"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -401,17 +403,24 @@ func NewProxyWatcher(ctx context.Context, cfg ProxyWatcherConfig) (*GenericWatch
 		cfg.ProxyDiffer = func(old, new types.Server) bool { return true }
 	}
 
+	proxyGetter := cfg.ProxyGetter
 	w, err := NewGenericResourceWatcher(ctx, GenericWatcherConfig[types.Server, readonly.Server]{
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindProxy,
 		ResourceKey:           types.Server.GetName,
 		ResourceGetter: func(ctx context.Context) ([]types.Server, error) {
-			return cfg.ProxyGetter.GetProxies()
+			return clientutils.CollectWithFallback(ctx, proxyGetter.ListProxyServers, func(context.Context) ([]types.Server, error) {
+				//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+				return proxyGetter.GetProxies()
+			})
 		},
 		ResourcesC:                          cfg.ProxiesC,
 		ResourceDiffer:                      cfg.ProxyDiffer,
 		RequireResourcesForInitialBroadcast: true,
 		CloneFunc:                           types.Server.DeepCopy,
+		ReadOnlyFunc: func(resource types.Server) readonly.Server {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -436,13 +445,14 @@ func NewDatabaseWatcher(ctx context.Context, cfg DatabaseWatcherConfig) (*Generi
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindDatabase,
 		ResourceKey:           types.Database.GetName,
-		ResourceGetter: func(ctx context.Context) ([]types.Database, error) {
-			return cfg.DatabaseGetter.GetDatabases(ctx)
-		},
-		ResourcesC: cfg.DatabasesC,
+		ResourceGetter:        cfg.DatabaseGetter.GetDatabases,
+		ResourcesC:            cfg.DatabasesC,
 		CloneFunc: func(resource types.Database) types.Database {
 			return resource.Copy()
 		},
+		ReadOnlyFunc: func(resource types.Database) readonly.Database {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -467,13 +477,14 @@ func NewAppWatcher(ctx context.Context, cfg AppWatcherConfig) (*GenericWatcher[t
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindApp,
 		ResourceKey:           types.Application.GetName,
-		ResourceGetter: func(ctx context.Context) ([]types.Application, error) {
-			return cfg.AppGetter.GetApps(ctx)
-		},
-		ResourcesC: cfg.AppsC,
+		ResourceGetter:        cfg.AppGetter.GetApps,
+		ResourcesC:            cfg.AppsC,
 		CloneFunc: func(resource types.Application) types.Application {
 			return resource.Copy()
 		},
+		ReadOnlyFunc: func(resource types.Application) readonly.Application {
+			return resource
+		},
 	})
 
 	return w, trace.Wrap(err)
@@ -496,14 +507,15 @@ func NewKubeServerWatcher(ctx context.Context, cfg KubeServerWatcherConfig) (*Ge
 	w, err := NewGenericResourceWatcher(ctx, GenericWatcherConfig[types.KubeServer, readonly.KubeServer]{
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindKubeServer,
-		ResourceGetter: func(ctx context.Context) ([]types.KubeServer, error) {
-			return cfg.KubernetesServerGetter.GetKubernetesServers(ctx)
-		},
+		ResourceGetter:        cfg.KubernetesServerGetter.GetKubernetesServers,
 		ResourceKey: func(resource types.KubeServer) string {
 			return resource.GetHostID() + resource.GetName()
 		},
 		DisableUpdateBroadcast: true,
 		CloneFunc:              types.KubeServer.Copy,
+		ReadOnlyFunc: func(resource types.KubeServer) readonly.KubeServer {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -524,17 +536,21 @@ func NewKubeClusterWatcher(ctx context.Context, cfg KubeClusterWatcherConfig) (*
 		return nil, trace.BadParameter("KubernetesClusterGetter must be provided")
 	}
 
+	getter := cfg.KubernetesClusterGetter
 	w, err := NewGenericResourceWatcher(ctx, GenericWatcherConfig[types.KubeCluster, readonly.KubeCluster]{
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindKubernetesCluster,
 		ResourceGetter: func(ctx context.Context) ([]types.KubeCluster, error) {
-			return cfg.KubernetesClusterGetter.GetKubernetesClusters(ctx)
+			return iterstream.Collect(getter.RangeKubernetesClusters(ctx, "", ""))
 		},
 		ResourceKey: types.KubeCluster.GetName,
 		ResourcesC:  cfg.KubeClustersC,
 		CloneFunc: func(resource types.KubeCluster) types.KubeCluster {
 			return resource.Copy()
 		},
+		ReadOnlyFunc: func(resource types.KubeCluster) readonly.KubeCluster {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -556,19 +572,20 @@ type DynamicWindowsDesktopWatcherConfig struct {
 // NewDynamicWindowsDesktopWatcher returns a new instance of DynamicWindowsDesktopWatcher.
 func NewDynamicWindowsDesktopWatcher(ctx context.Context, cfg DynamicWindowsDesktopWatcherConfig) (*GenericWatcher[types.DynamicWindowsDesktop, readonly.DynamicWindowsDesktop], error) {
 	if cfg.DynamicWindowsDesktopGetter == nil {
-		return nil, trace.BadParameter("KubernetesClusterGetter must be provided")
+		return nil, trace.BadParameter("DynamicWindowsDesktopGetter must be provided")
 	}
-
+	getter := cfg.DynamicWindowsDesktopGetter
 	w, err := NewGenericResourceWatcher(ctx, GenericWatcherConfig[types.DynamicWindowsDesktop, readonly.DynamicWindowsDesktop]{
 		ResourceWatcherConfig: cfg.ResourceWatcherConfig,
 		ResourceKind:          types.KindDynamicWindowsDesktop,
 		ResourceGetter: pagerFn[types.DynamicWindowsDesktop](
-			cfg.DynamicWindowsDesktopGetter.ListDynamicWindowsDesktops,
+			getter.ListDynamicWindowsDesktops,
 		).getAll,
 		ResourceKey: types.DynamicWindowsDesktop.GetName,
 		ResourcesC:  cfg.DynamicWindowsDesktopsC,
-		CloneFunc: func(resource types.DynamicWindowsDesktop) types.DynamicWindowsDesktop {
-			return resource.Copy()
+		CloneFunc:   types.DynamicWindowsDesktop.Copy,
+		ReadOnlyFunc: func(resource types.DynamicWindowsDesktop) readonly.DynamicWindowsDesktop {
+			return resource
 		},
 	})
 	return w, trace.Wrap(err)
@@ -583,8 +600,8 @@ type GenericWatcherConfig[T any, R any] struct {
 	ResourceDiffer func(old, new T) bool
 	// ResourceKey defines how the resources should be keyed.
 	ResourceKey func(resource T) string
-	// ResourcesC is a channel used to report the current resourxe set. It receives
-	// a fresh list at startup and subsequently a list of all known resourxes
+	// ResourcesC is a channel used to report the current resource set. It receives
+	// a fresh list at startup and subsequently a list of all known resources
 	// whenever an addition or deletion is detected.
 	ResourcesC chan []T
 	// CloneFunc defines how a resource is cloned. All resources provided via
@@ -592,6 +609,11 @@ type GenericWatcherConfig[T any, R any] struct {
 	// or [GenericWatcher.CurrentResourcesWithFilter] will be cloned by this
 	// mechanism before being provided to callers.
 	CloneFunc func(resource T) T
+	// ReadOnlyFunc returns the read-only view of a resource. Ideally this will
+	// be a type conversion (but we can't statically express that as constraints
+	// on T and R) but it's also possible to wrapper the original resource.
+	// Making the read-only view should be much cheaper than CloneFunc.
+	ReadOnlyFunc func(resource T) R
 	ResourceWatcherConfig
 	// ResourceKind specifies the kind of resource the watcher is monitoring.
 	ResourceKind string
@@ -623,6 +645,13 @@ func (cfg *GenericWatcherConfig[T, R]) CheckAndSetDefaults() error {
 		return trace.BadParameter("ResourceKey not provided to generic resource watcher")
 	}
 
+	if cfg.CloneFunc == nil {
+		return trace.BadParameter("CloneFunc not provided to generic resource watcher")
+	}
+	if cfg.ReadOnlyFunc == nil {
+		return trace.BadParameter("ReadOnlyFunc not provided to generic resource watcher")
+	}
+
 	if cfg.ResourceDiffer == nil {
 		cfg.ResourceDiffer = func(T, T) bool { return true }
 	}
@@ -697,13 +726,9 @@ func (g *GenericWatcher[T, R]) CurrentResourcesWithFilter(ctx context.Context, f
 	g.rw.RLock()
 	defer g.rw.RUnlock()
 
-	r := func(a any) R {
-		return a.(R)
-	}
-
 	var out []T
 	for _, resource := range g.current {
-		if filter(r(resource)) {
+		if filter(g.ReadOnlyFunc(resource)) {
 			out = append(out, g.CloneFunc(resource))
 		}
 	}
@@ -711,7 +736,8 @@ func (g *GenericWatcher[T, R]) CurrentResourcesWithFilter(ctx context.Context, f
 	return out, nil
 }
 
-// genericCollector accompanies resourceWatcher when monitoring proxies.
+// genericCollector accompanies resourceWatcher when monitoring proxies. T is
+// the resource type, R is a read-only view over T.
 type genericCollector[T any, R any] struct {
 	GenericWatcherConfig[T, R]
 	// current holds a map of the currently known resources (keyed by server name,
@@ -753,19 +779,31 @@ func (g *genericCollector[T, R]) refreshStaleResources(ctx context.Context) erro
 	}
 
 	_, err := utils.FnCacheGet(ctx, g.cache, g.GenericWatcherConfig.ResourceKind, func(ctx context.Context) (any, error) {
-		current, err := g.getResources(ctx)
+		newCurrent, err := g.getResources(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		// There is a chance that the watcher reinitialized while
-		// getting resources happened above. Check if we are still stale
-		if g.stale.CompareAndSwap(true, false) {
-			g.rw.Lock()
-			g.current = current
-			g.rw.Unlock()
+		// as an optimization, we can check if the collector is still stale
+		// before grabbing the write lock
+		if !g.stale.Load() {
+			// the view is no longer stale, discard newCurrent and proceed with
+			// the data in g.current
+			return nil, nil
 		}
 
+		g.rw.Lock()
+		defer g.rw.Unlock()
+
+		// check the staleness again since it might've changed since we were not
+		// holding the lock
+		if !g.stale.Load() {
+			return nil, nil
+		}
+
+		g.current = newCurrent
+		g.stale.Store(false)
+
 		return nil, nil
 	})
 
@@ -1030,10 +1068,21 @@ func (p *lockCollector) initializationChan() <-chan struct{} {
 // getResourcesAndUpdateCurrent is called when the resources should be
 // (re-)fetched directly.
 func (p *lockCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
-	locks, err := p.LockGetter.GetLocks(ctx, true)
+	locks, err := clientutils.CollectWithFallback(
+		ctx,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return p.LockGetter.ListLocks(ctx, limit, start, &types.LockFilter{InForceOnly: true})
+		},
+		func(ctx context.Context) ([]types.Lock, error) {
+			// TODO(okraport): DELETE IN v21
+			const inForceOnlyTrue = true
+			return p.LockGetter.GetLocks(ctx, inForceOnlyTrue)
+		},
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+
 	newCurrent := map[string]types.Lock{}
 	for _, lock := range locks {
 		newCurrent[lock.GetName()] = lock
@@ -1372,6 +1421,9 @@ func NewNodeWatcher(ctx context.Context, cfg NodeWatcherConfig) (*GenericWatcher
 		ResourceKey:            types.Server.GetName,
 		DisableUpdateBroadcast: true,
 		CloneFunc:              types.Server.DeepCopy,
+		ReadOnlyFunc: func(resource types.Server) readonly.Server {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -1723,6 +1775,9 @@ func NewGitServerWatcher(ctx context.Context, cfg GitServerWatcherConfig) (*Gene
 		ResourceKey:            types.Server.GetName,
 		DisableUpdateBroadcast: !cfg.EnableUpdateBroadcast,
 		CloneFunc:              types.Server.DeepCopy,
+		ReadOnlyFunc: func(resource types.Server) readonly.Server {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
@@ -1768,6 +1823,9 @@ func NewHealthCheckConfigWatcher(
 		},
 		ResourcesC: cfg.ResourcesC,
 		CloneFunc:  apiutils.CloneProtoMsg[*healthcheckconfigv1.HealthCheckConfig],
+		ReadOnlyFunc: func(resource *healthcheckconfigv1.HealthCheckConfig) *healthcheckconfigv1.HealthCheckConfig {
+			return resource
+		},
 	})
 	return w, trace.Wrap(err)
 }
diff --git a/lib/services/watcher_test.go b/lib/services/watcher_test.go
index ac9013e4d1f35..87d9d6c7ae5f9 100644
--- a/lib/services/watcher_test.go
+++ b/lib/services/watcher_test.go
@@ -36,6 +36,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
@@ -50,6 +51,7 @@ import (
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 var _ types.Events = (*errorWatcher)(nil)
@@ -68,6 +70,10 @@ func (n nopProxyGetter) GetProxies() ([]types.Server, error) {
 	return nil, nil
 }
 
+func (n nopProxyGetter) ListProxyServers(_ context.Context, _ int, _ string) ([]types.Server, string, error) {
+	return nil, "", nil
+}
+
 func TestResourceWatcher_Backoff(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -396,108 +402,117 @@ func TestLockWatcherSubscribeWithEmptyTarget(t *testing.T) {
 func TestLockWatcherStale(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
-	clock := clockwork.NewFakeClock()
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+		clock := clockwork.NewRealClock()
 
-	bk, err := memory.New(memory.Config{
-		Context: ctx,
-		Clock:   clock,
-	})
-	require.NoError(t, err)
+		bk, err := memory.New(memory.Config{
+			Context: ctx,
+			Clock:   clock,
+		})
+		require.NoError(t, err)
 
-	type client struct {
-		services.Access
-		types.Events
-	}
+		type client struct {
+			services.Access
+			types.Events
+		}
 
-	access := local.NewAccessService(bk)
-	events := &withUnreliability{Events: local.NewEventsService(bk)}
-	w, err := services.NewLockWatcher(ctx, services.LockWatcherConfig{
-		ResourceWatcherConfig: services.ResourceWatcherConfig{
-			Component:      "test",
-			MaxRetryPeriod: 200 * time.Millisecond,
-			Client: &client{
-				Access: access,
-				Events: events,
+		access := local.NewAccessService(bk)
+		events := &withUnreliability{Events: local.NewEventsService(bk)}
+		w, err := services.NewLockWatcher(ctx, services.LockWatcherConfig{
+			ResourceWatcherConfig: services.ResourceWatcherConfig{
+				Component:      "test",
+				MaxRetryPeriod: 200 * time.Millisecond,
+				Client: &client{
+					Access: access,
+					Events: events,
+				},
+				Clock: clock,
 			},
-			Clock: clock,
-		},
-	})
-	require.NoError(t, err)
-	t.Cleanup(w.Close)
-	select {
-	case <-w.LoopC:
-	case <-time.After(15 * time.Second):
-		t.Fatal("Timeout waiting for LockWatcher loop.")
-	}
-
-	// Subscribe to lock watcher updates.
-	target := types.LockTarget{ServerID: "node"}
-	require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
-	require.NoError(t, w.CheckLockInForce(constants.LockingModeStrict, target))
-	sub, err := w.Subscribe(ctx, target)
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, sub.Close()) })
+		})
+		require.NoError(t, err)
+		t.Cleanup(w.Close)
+		select {
+		case <-w.LoopC:
+		case <-time.After(15 * time.Second):
+			t.Fatal("Timeout waiting for LockWatcher loop.")
+		}
 
-	// Close the underlying watcher. Until LockMaxStaleness is exceeded, no error
-	// should be returned.
-	events.setUnreliable(true)
-	bk.CloseWatchers()
-	select {
-	case event := <-sub.Events():
-		t.Fatalf("Unexpected event: %v.", event)
-	case <-sub.Done():
-		t.Fatal("Lock watcher subscription has unexpectedly exited.")
-	case <-time.After(2 * time.Second):
-	}
-	require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
-	require.NoError(t, w.CheckLockInForce(constants.LockingModeStrict, target))
+		// Subscribe to lock watcher updates.
+		target := types.LockTarget{ServerID: "node"}
+		require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
+		require.NoError(t, w.CheckLockInForce(constants.LockingModeStrict, target))
+		sub, err := w.Subscribe(ctx, target)
+		require.NoError(t, err)
+		t.Cleanup(func() { require.NoError(t, sub.Close()) })
 
-	// Advance the clock to exceed LockMaxStaleness.
-	clock.Advance(defaults.LockMaxStaleness + time.Second)
-	select {
-	case event := <-sub.Events():
-		require.Equal(t, types.OpUnreliable, event.Type)
-	case <-sub.Done():
-		t.Fatal("Lock watcher subscription has unexpectedly exited.")
-	case <-time.After(15 * time.Second):
-		t.Fatal("Timeout waiting for OpUnreliable.")
-	}
-	require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
-	expectLockInForce(t, nil, w.CheckLockInForce(constants.LockingModeStrict, target))
+		// Close the underlying watcher. Until LockMaxStaleness is exceeded, no error
+		// should be returned.
+		events.setUnreliable(true)
+		bk.CloseWatchers()
+		select {
+		case event := <-sub.Events():
+			t.Fatalf("Unexpected event: %v.", event)
+		case <-sub.Done():
+			t.Fatal("Lock watcher subscription has unexpectedly exited.")
+		case <-time.After(2 * time.Second):
+		}
+		require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
+		require.NoError(t, w.CheckLockInForce(constants.LockingModeStrict, target))
 
-	// Add a lock matching the subscription target.
-	lock, err := types.NewLock("test-lock", types.LockSpecV2{
-		Target: target,
-	})
-	require.NoError(t, err)
-	require.NoError(t, access.UpsertLock(ctx, lock))
+		synctest.Wait()
+		// Advance the clock to exceed LockMaxStaleness.
+		time.Sleep(defaults.LockMaxStaleness + time.Second)
+		synctest.Wait()
 
-	// Make the event stream reliable again. That should broadcast any matching
-	// locks added in the meantime.
-	events.setUnreliable(false)
-	clock.Advance(time.Second)
-ExpectPut:
-	for {
 		select {
 		case event := <-sub.Events():
-			// There might be additional OpUnreliable events in the queue.
-			if event.Type == types.OpUnreliable {
-				continue ExpectPut
-			}
-			require.Equal(t, types.OpPut, event.Type)
-			receivedLock, ok := event.Resource.(types.Lock)
-			require.True(t, ok)
-			require.Empty(t, resourceDiff(receivedLock, lock))
-			break ExpectPut
+			require.Equal(t, types.OpUnreliable, event.Type)
 		case <-sub.Done():
 			t.Fatal("Lock watcher subscription has unexpectedly exited.")
 		case <-time.After(15 * time.Second):
-			t.Fatal("Timeout waiting for OpPut.")
+			t.Fatal("Timeout waiting for OpUnreliable.")
 		}
-	}
-	expectLockInForce(t, lock, w.CheckLockInForce(constants.LockingModeBestEffort, target))
-	expectLockInForce(t, lock, w.CheckLockInForce(constants.LockingModeStrict, target))
+		require.NoError(t, w.CheckLockInForce(constants.LockingModeBestEffort, target))
+		expectLockInForce(t, nil, w.CheckLockInForce(constants.LockingModeStrict, target))
+
+		// Add a lock matching the subscription target.
+		lock, err := types.NewLock("test-lock", types.LockSpecV2{
+			Target: target,
+		})
+		require.NoError(t, err)
+		require.NoError(t, access.UpsertLock(ctx, lock))
+
+		// Make the event stream reliable again. That should broadcast any matching
+		// locks added in the meantime.
+		events.setUnreliable(false)
+
+		synctest.Wait()
+		// Advance the clock to exceed LockMaxStaleness.
+		time.Sleep(time.Second)
+		synctest.Wait()
+	ExpectPut:
+		for {
+			select {
+			case event := <-sub.Events():
+				// There might be additional OpUnreliable events in the queue.
+				if event.Type == types.OpUnreliable {
+					continue ExpectPut
+				}
+				require.Equal(t, types.OpPut, event.Type)
+				receivedLock, ok := event.Resource.(types.Lock)
+				require.True(t, ok)
+				require.Empty(t, resourceDiff(receivedLock, lock))
+				break ExpectPut
+			case <-sub.Done():
+				t.Fatal("Lock watcher subscription has unexpectedly exited.")
+			case <-time.After(15 * time.Second):
+				t.Fatal("Timeout waiting for OpPut.")
+			}
+		}
+		expectLockInForce(t, lock, w.CheckLockInForce(constants.LockingModeBestEffort, target))
+		expectLockInForce(t, lock, w.CheckLockInForce(constants.LockingModeStrict, target))
+	})
 }
 
 type withUnreliability struct {
@@ -656,7 +671,7 @@ func TestAppWatcher(t *testing.T) {
 	require.NoError(t, err)
 
 	type client struct {
-		services.Apps
+		services.Applications
 		types.Events
 	}
 
@@ -666,8 +681,8 @@ func TestAppWatcher(t *testing.T) {
 			Component:      "test",
 			MaxRetryPeriod: 200 * time.Millisecond,
 			Client: &client{
-				Apps:   appService,
-				Events: local.NewEventsService(bk),
+				Applications: appService,
+				Events:       local.NewEventsService(bk),
 			},
 		},
 		AppGetter: appService,
@@ -1495,7 +1510,7 @@ func TestHealthCheckConfigWatcher(t *testing.T) {
 
 	select {
 	case resources := <-w.ResourcesC:
-		require.Empty(t, resources)
+		require.Len(t, resources, teleport.VirtualDefaultHealthCheckConfigCount)
 	case <-w.Done():
 		require.FailNow(t, "Watcher has unexpectedly exited.")
 	case <-time.After(2 * time.Second):
@@ -1513,8 +1528,8 @@ func TestHealthCheckConfigWatcher(t *testing.T) {
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		filtered, err := w.CurrentResources(ctx)
-		assert.NoError(t, err)
-		assert.Len(t, filtered, len(resources))
+		require.NoError(t, err)
+		require.Len(t, filtered, len(resources)+teleport.VirtualDefaultHealthCheckConfigCount)
 	}, time.Second, 100*time.Millisecond, "Timeout waiting for watcher to receive resources.")
 
 	filtered, err := w.CurrentResourcesWithFilter(ctx, func(s *healthcheckconfigv1.HealthCheckConfig) bool {
@@ -1528,8 +1543,8 @@ func TestHealthCheckConfigWatcher(t *testing.T) {
 	require.NoError(t, localSvc.DeleteHealthCheckConfig(ctx, resources[0].GetMetadata().GetName()))
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		filtered, err := w.CurrentResources(ctx)
-		assert.NoError(t, err)
-		assert.Len(t, filtered, len(resources)-1)
+		require.NoError(t, err)
+		require.Len(t, filtered, len(resources)-1+teleport.VirtualDefaultHealthCheckConfigCount)
 	}, time.Second, time.Millisecond, "Timeout waiting for watcher to receive resources.")
 
 	filtered, err = w.CurrentResourcesWithFilter(ctx, func(s *healthcheckconfigv1.HealthCheckConfig) bool {
diff --git a/lib/services/workload_identity.go b/lib/services/workload_identity.go
index 76277dfdec944..0deda1e568327 100644
--- a/lib/services/workload_identity.go
+++ b/lib/services/workload_identity.go
@@ -18,6 +18,7 @@ package services
 
 import (
 	"context"
+	"slices"
 	"strings"
 	"time"
 
@@ -39,7 +40,10 @@ type WorkloadIdentities interface {
 	// ListWorkloadIdentities lists all WorkloadIdentities using Google style
 	// pagination.
 	ListWorkloadIdentities(
-		ctx context.Context, pageSize int, lastToken string,
+		ctx context.Context,
+		pageSize int,
+		lastToken string,
+		options *ListWorkloadIdentitiesRequestOptions,
 	) ([]*workloadidentityv1pb.WorkloadIdentity, string, error)
 	// CreateWorkloadIdentity creates a new WorkloadIdentity.
 	CreateWorkloadIdentity(
@@ -133,3 +137,52 @@ func ValidateWorkloadIdentity(s *workloadidentityv1pb.WorkloadIdentity) error {
 
 	return nil
 }
+
+type ListWorkloadIdentitiesRequestOptions struct {
+	// The sort field to use for the results. If empty, the default sort field is used.
+	SortField string
+	// The sort order to use for the results. If empty, the default sort order is used.
+	SortDesc bool
+	// A search term used to filter the results. If non-empty, it's used to match against supported fields.
+	FilterSearchTerm string
+}
+
+func (o *ListWorkloadIdentitiesRequestOptions) GetSortField() string {
+	if o == nil {
+		return ""
+	}
+	return o.SortField
+}
+
+func (o *ListWorkloadIdentitiesRequestOptions) GetSortDesc() bool {
+	if o == nil {
+		return false
+	}
+	return o.SortDesc
+}
+
+func (o *ListWorkloadIdentitiesRequestOptions) GetFilterSearchTerm() string {
+	if o == nil {
+		return ""
+	}
+	return o.FilterSearchTerm
+}
+
+func MatchWorkloadIdentity(item *workloadidentityv1pb.WorkloadIdentity, filterSearchTerm string) bool {
+	if item == nil {
+		return false
+	}
+	if filterSearchTerm == "" {
+		return true
+	}
+
+	values := []string{
+		item.GetMetadata().GetName(),
+		item.GetSpec().GetSpiffe().GetId(),
+		item.GetSpec().GetSpiffe().GetHint(),
+	}
+
+	return slices.ContainsFunc(values, func(val string) bool {
+		return strings.Contains(strings.ToLower(val), strings.ToLower(filterSearchTerm))
+	})
+}
diff --git a/lib/session/session.go b/lib/session/session.go
index 4205845168c8f..f6c66c34e34c2 100644
--- a/lib/session/session.go
+++ b/lib/session/session.go
@@ -21,6 +21,7 @@
 package session
 
 import (
+	"cmp"
 	"fmt"
 	"strconv"
 	"strings"
@@ -30,6 +31,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/moby/term"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -170,6 +172,8 @@ type Party struct {
 	RemoteAddr string `json:"remote_addr"`
 	// User is a teleport user using this session
 	User string `json:"user"`
+	// Cluster is the cluster name the user is authenticated against.
+	Cluster string `json:"cluster"`
 	// ServerID is an address of the server
 	ServerID string `json:"server_id"`
 	// LastActive is a last time this party was active
@@ -234,6 +238,17 @@ func (p *TerminalParams) Winsize() *term.Winsize {
 	}
 }
 
+// CheckAndSetDefaults checks and sets default terminal params.
+func (p *TerminalParams) CheckAndSetDefaults() error {
+	p.W = cmp.Or(p.W, teleport.DefaultTerminalWidth)
+	p.H = cmp.Or(p.H, teleport.DefaultTerminalHeight)
+	if p.W < 0 || p.H < 0 ||
+		p.W >= 4096 || p.H >= 4096 {
+		return trace.BadParameter("term: bad dimensions(%dx%d)", p.W, p.H)
+	}
+	return nil
+}
+
 // MaxSessionSliceLength is the maximum number of sessions per time window
 // that the backend will return.
 const MaxSessionSliceLength = 1000
diff --git a/lib/spacelift/spacelift.go b/lib/spacelift/spacelift.go
deleted file mode 100644
index a0ca76304f651..0000000000000
--- a/lib/spacelift/spacelift.go
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package spacelift
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// IDTokenClaims
-// See the following for the structure:
-// https://docs.spacelift.io/integrations/cloud-providers/oidc/#standard-claims
-type IDTokenClaims struct {
-	oidc.TokenClaims
-
-	// Sub provides some information about the Spacelift run that generated this
-	// token.
-	// space:<space_id>:(stack|module):<stack_id|module_id>:run_type:<run_type>:scope:<read|write>
-	Sub string `json:"sub"`
-	// SpaceID is the ID of the space in which the run that owns the token was
-	// executed.
-	SpaceID string `json:"spaceId"`
-	// CallerType is the type of the caller, ie. the entity that owns the run -
-	// either stack or module.
-	CallerType string `json:"callerType"`
-	// CallerID is the ID of the caller, ie. the stack or module that generated
-	// the run.
-	CallerID string `json:"callerId"`
-	// RunType is the type of the run.
-	// (PROPOSED, TRACKED, TASK, TESTING or DESTROY)
-	RunType string `json:"runType"`
-	// RunID is the ID of the run that owns the token.
-	RunID string `json:"runId"`
-	// Scope is the scope of the token - either read or write.
-	Scope string `json:"scope"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsSpacelift {
-	return &workloadidentityv1pb.JoinAttrsSpacelift{
-		Sub:        c.Sub,
-		SpaceId:    c.SpaceID,
-		CallerType: c.CallerType,
-		CallerId:   c.CallerID,
-		RunType:    c.RunType,
-		RunId:      c.RunID,
-		Scope:      c.Scope,
-	}
-}
diff --git a/lib/srv/alpnproxy/auth/auth_proxy.go b/lib/srv/alpnproxy/auth/auth_proxy.go
index acd1041b5d72a..b7d806f3a49e3 100644
--- a/lib/srv/alpnproxy/auth/auth_proxy.go
+++ b/lib/srv/alpnproxy/auth/auth_proxy.go
@@ -38,29 +38,29 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-type sitesGetter interface {
-	GetSites() ([]reversetunnelclient.RemoteSite, error)
+type ClusterGetter interface {
+	Cluster(context.Context, string) (reversetunnelclient.Cluster, error)
 }
 
 // NewAuthProxyDialerService create new instance of AuthProxyDialerService.
-func NewAuthProxyDialerService(reverseTunnelServer sitesGetter, localClusterName string, authServers []string, proxySigner multiplexer.PROXYHeaderSigner, tracer oteltrace.Tracer) *AuthProxyDialerService {
+func NewAuthProxyDialerService(clusterGetter ClusterGetter, localClusterName string, authServers []string, proxySigner multiplexer.PROXYHeaderSigner, tracer oteltrace.Tracer) *AuthProxyDialerService {
 	return &AuthProxyDialerService{
-		reverseTunnelServer: reverseTunnelServer,
-		localClusterName:    localClusterName,
-		authServers:         authServers,
-		proxySigner:         proxySigner,
-		tracer:              tracer,
+		clusterGetter:    clusterGetter,
+		localClusterName: localClusterName,
+		authServers:      authServers,
+		proxySigner:      proxySigner,
+		tracer:           tracer,
 	}
 }
 
 // AuthProxyDialerService allows dialing local/remote auth service base on SNI value encoded as destination auth
 // cluster name and ALPN set to teleport-auth protocol.
 type AuthProxyDialerService struct {
-	reverseTunnelServer sitesGetter
-	localClusterName    string
-	authServers         []string
-	proxySigner         multiplexer.PROXYHeaderSigner
-	tracer              oteltrace.Tracer
+	clusterGetter    ClusterGetter
+	localClusterName string
+	authServers      []string
+	proxySigner      multiplexer.PROXYHeaderSigner
+	tracer           oteltrace.Tracer
 }
 
 func (s *AuthProxyDialerService) HandleConnection(ctx context.Context, conn net.Conn, connInfo alpnproxy.ConnectionInfo) error {
@@ -102,7 +102,7 @@ func (s *AuthProxyDialerService) dialAuthServer(ctx context.Context, clusterName
 	if clusterNameFromSNI == s.localClusterName {
 		return s.dialLocalAuthServer(ctx, clientSrcAddr, clientDstAddr)
 	}
-	if s.reverseTunnelServer != nil {
+	if s.clusterGetter != nil {
 		return s.dialRemoteAuthServer(ctx, clusterNameFromSNI, clientSrcAddr, clientDstAddr)
 	}
 	return nil, trace.NotFound("auth server for %q cluster name not found", clusterNameFromSNI)
@@ -160,21 +160,17 @@ func (s *AuthProxyDialerService) dialRemoteAuthServer(ctx context.Context, clust
 		))
 	defer span.End()
 
-	sites, err := s.reverseTunnelServer.GetSites()
+	cluster, err := s.clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	for _, site := range sites {
-		if site.GetName() != clusterName {
-			continue
-		}
-		conn, err := site.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return conn, nil
+
+	conn, err := cluster.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
-	return nil, trace.NotFound("cluster name %q not found", clusterName)
+
+	return conn, nil
 }
 
 func (s *AuthProxyDialerService) proxyConn(ctx context.Context, upstreamConn, downstreamConn net.Conn) error {
diff --git a/lib/srv/alpnproxy/aws_local_proxy_test.go b/lib/srv/alpnproxy/aws_local_proxy_test.go
index c510421f84655..bdefff8e2382d 100644
--- a/lib/srv/alpnproxy/aws_local_proxy_test.go
+++ b/lib/srv/alpnproxy/aws_local_proxy_test.go
@@ -19,6 +19,7 @@
 package alpnproxy
 
 import (
+	"bufio"
 	"bytes"
 	"encoding/xml"
 	"net/http"
@@ -72,6 +73,33 @@ func TestAWSAccessMiddleware(t *testing.T) {
 		require.Equal(t, http.StatusOK, recorder.Code)
 	})
 
+	t.Run("request with body", func(t *testing.T) {
+		body := []byte("body")
+		req := httptest.NewRequest(http.MethodPost, "http://sts.us-east-2.amazonaws.com", bytes.NewReader(body))
+		payloadHash, err := awsutils.GetV4PayloadHash(req)
+		require.NoError(t, err)
+		awsutils.NewSigner("sts").SignHTTP(t.Context(), localCred, req, payloadHash, "sts", "us-east-2", time.Now())
+
+		recorder := httptest.NewRecorder()
+		require.False(t, m.HandleRequest(recorder, req))
+		require.Equal(t, http.StatusOK, recorder.Code)
+	})
+
+	t.Run("request with body but Content-Length not signed", func(t *testing.T) {
+		rawRequest := `POST http://sts.us-east-2.amazonaws.com HTTP/1.1
+Authorization: AWS4-HMAC-SHA256 Credential=local-proxy/20250723/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=ba02b2b46d9a90ddc85e1d5a8b64c92a4800fc9efc2faf2ea8ca146fd54a5185
+X-Amz-Date: 20250723T193337Z
+Content-Length: 4
+
+body`
+		req, err := http.ReadRequest(bufio.NewReader(bytes.NewBufferString(rawRequest)))
+		require.NoError(t, err)
+
+		recorder := httptest.NewRecorder()
+		require.False(t, m.HandleRequest(recorder, req))
+		require.Equal(t, http.StatusOK, recorder.Code)
+	})
+
 	// Verifies sts:AssumeRole output can be handled successfully. The
 	// credentials should be saved afterwards.
 	t.Run("handle sts:AssumeRole response", func(t *testing.T) {
diff --git a/lib/srv/alpnproxy/azure_msi_middleware.go b/lib/srv/alpnproxy/azure_msi_middleware.go
deleted file mode 100644
index 6e462f2de8906..0000000000000
--- a/lib/srv/alpnproxy/azure_msi_middleware.go
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package alpnproxy
-
-import (
-	"crypto"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"sync"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/jwt"
-)
-
-// AzureMSIMiddleware implements a simplified version of MSI server serving auth tokens.
-type AzureMSIMiddleware struct {
-	DefaultLocalProxyHTTPMiddleware
-
-	// Identity is the Azure identity to be served by the server. Only single identity will be provided.
-	Identity string
-	// TenantID to be returned in a claim. Doesn't have to match actual TenantID as recognized by Azure.
-	TenantID string
-	// ClientID to be returned in a claim.
-	ClientID string
-
-	// Clock is used to override time in tests.
-	Clock clockwork.Clock
-	// Log is the Logger.
-	Log *slog.Logger
-	// Secret to be provided by the client.
-	Secret string
-
-	// privateKey used to sign JWT
-	privateKey   crypto.Signer
-	privateKeyMu sync.RWMutex
-}
-
-var _ LocalProxyHTTPMiddleware = &AzureMSIMiddleware{}
-
-func (m *AzureMSIMiddleware) CheckAndSetDefaults() error {
-	if m.Clock == nil {
-		m.Clock = clockwork.NewRealClock()
-	}
-	if m.Log == nil {
-		m.Log = slog.With(teleport.ComponentKey, "azure_msi")
-	}
-
-	if m.Secret == "" {
-		return trace.BadParameter("missing Secret")
-	}
-	if m.Identity == "" {
-		return trace.BadParameter("missing Identity")
-	}
-	if m.TenantID == "" {
-		return trace.BadParameter("missing TenantID")
-	}
-	if m.ClientID == "" {
-		return trace.BadParameter("missing ClientID")
-	}
-	return nil
-}
-
-func (m *AzureMSIMiddleware) HandleRequest(rw http.ResponseWriter, req *http.Request) bool {
-	if req.Host == types.TeleportAzureMSIEndpoint {
-		if err := m.msiEndpoint(rw, req); err != nil {
-			m.Log.WarnContext(req.Context(), "Bad MSI request", "error", err)
-			trace.WriteError(rw, trace.Wrap(err))
-		}
-		return true
-	}
-
-	return false
-}
-
-// SetPrivateKey updates the private key.
-func (m *AzureMSIMiddleware) SetPrivateKey(privateKey crypto.Signer) {
-	m.privateKeyMu.Lock()
-	defer m.privateKeyMu.Unlock()
-	m.privateKey = privateKey
-}
-func (m *AzureMSIMiddleware) getPrivateKey() (crypto.Signer, error) {
-	m.privateKeyMu.RLock()
-	defer m.privateKeyMu.RUnlock()
-	if m.privateKey == nil {
-		// Use a plain error to return status code 500.
-		return nil, trace.Errorf("missing private key set in AzureMSIMiddleware")
-	}
-	return m.privateKey, nil
-}
-
-func (m *AzureMSIMiddleware) msiEndpoint(rw http.ResponseWriter, req *http.Request) error {
-	// request validation
-	if req.URL.Path != ("/" + m.Secret) {
-		return trace.BadParameter("invalid secret")
-	}
-
-	metadata := req.Header.Get("Metadata")
-	if metadata != "true" {
-		return trace.BadParameter("expected Metadata header with value 'true'")
-	}
-
-	err := req.ParseForm()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	resource := req.Form.Get("resource")
-	if resource == "" {
-		return trace.BadParameter("missing value for parameter 'resource'")
-	}
-
-	// check that msi_res_id matches expected Azure Identity
-	requestedAzureIdentity := req.Form.Get("msi_res_id")
-	if requestedAzureIdentity != m.Identity {
-		m.Log.WarnContext(req.Context(), "Requested unexpected identity", "requested_identity", requestedAzureIdentity, "expected_identity", m.Identity)
-		return trace.BadParameter("unexpected value for parameter 'msi_res_id': %v", requestedAzureIdentity)
-	}
-
-	respBody, err := m.fetchMSILoginResp(resource)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	m.Log.InfoContext(req.Context(), "MSI: returning token for identity", "identity", m.Identity)
-
-	rw.Header().Add("Content-Type", "application/json; charset=utf-8")
-	rw.Header().Add("Content-Length", fmt.Sprintf("%v", len(respBody)))
-	rw.WriteHeader(200)
-	_, _ = rw.Write(respBody)
-	return nil
-}
-
-func (m *AzureMSIMiddleware) fetchMSILoginResp(resource string) ([]byte, error) {
-	now := m.Clock.Now()
-
-	notBefore := now.Add(-10 * time.Second)
-	expiresOn := now.Add(time.Hour * 24 * 365)
-	expiresIn := int64(expiresOn.Sub(now).Seconds())
-
-	accessToken, err := m.toJWT(jwt.AzureTokenClaims{
-		TenantID: m.TenantID,
-		Resource: resource,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	response := map[string]any{
-		"access_token":   accessToken,
-		"client_id":      m.ClientID,
-		"not_before":     notBefore.Unix(),
-		"expires_on":     expiresOn.Unix(),
-		"expires_in":     expiresIn,
-		"ext_expires_in": expiresIn,
-		"token_type":     "Bearer",
-		"resource":       resource,
-	}
-
-	out, err := json.MarshalIndent(response, "", "  ")
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return out, nil
-}
-
-func (m *AzureMSIMiddleware) toJWT(claims jwt.AzureTokenClaims) (string, error) {
-	privateKey, err := m.getPrivateKey()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	// Create a new key that can sign and verify tokens.
-	key, err := jwt.New(&jwt.Config{
-		Clock:       m.Clock,
-		PrivateKey:  privateKey,
-		ClusterName: types.TeleportAzureMSIEndpoint, // todo get cluster name
-	})
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	token, err := key.SignAzureToken(claims)
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	return token, nil
-}
diff --git a/lib/srv/alpnproxy/azure_msi_middleware_test.go b/lib/srv/alpnproxy/azure_msi_middleware_test.go
deleted file mode 100644
index c1fd2a42d5bea..0000000000000
--- a/lib/srv/alpnproxy/azure_msi_middleware_test.go
+++ /dev/null
@@ -1,263 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package alpnproxy
-
-import (
-	"crypto"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/jwt"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func TestAzureMSIMiddlewareHandleRequest(t *testing.T) {
-	t.Parallel()
-	for _, alg := range []cryptosuites.Algorithm{cryptosuites.RSA2048, cryptosuites.ECDSAP256} {
-		t.Run(alg.String(), func(t *testing.T) {
-			testAzureMSIMiddlewareHandleRequest(t, alg)
-		})
-	}
-}
-
-func testAzureMSIMiddlewareHandleRequest(t *testing.T, alg cryptosuites.Algorithm) {
-	newPrivateKey := func() crypto.Signer {
-		privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(alg)
-		require.NoError(t, err)
-		return privateKey
-	}
-	privateKey := newPrivateKey()
-	m := &AzureMSIMiddleware{
-		Identity: "azureTestIdentity",
-		TenantID: "cafecafe-cafe-4aaa-cafe-cafecafecafe",
-		ClientID: "decaffff-cafe-4aaa-cafe-cafecafecafe",
-		Log:      utils.NewSlogLoggerForTests(),
-		Clock:    clockwork.NewFakeClockAt(time.Date(2022, 1, 1, 9, 0, 0, 0, time.UTC)),
-		Secret:   "my-secret",
-	}
-	require.NoError(t, m.CheckAndSetDefaults())
-
-	tests := []struct {
-		name           string
-		url            string
-		headers        map[string]string
-		privateKey     crypto.Signer
-		expectedHandle bool
-		expectedCode   int
-		expectedBody   string
-		verifyBody     func(t *testing.T, body []byte)
-	}{
-		{
-			name:           "ignore non-msi requests",
-			url:            "https://graph.windows.net/foo/bar/baz",
-			privateKey:     privateKey,
-			expectedHandle: false,
-		},
-		{
-			name:           "invalid request, wrong secret",
-			url:            "https://azure-msi.teleport.dev/bad-secret",
-			headers:        nil,
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"invalid secret\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, missing secret",
-			url:            "https://azure-msi.teleport.dev",
-			headers:        nil,
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"invalid secret\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, missing metadata",
-			url:            "https://azure-msi.teleport.dev/my-secret",
-			headers:        nil,
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"expected Metadata header with value 'true'\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, bad metadata value",
-			url:            "https://azure-msi.teleport.dev/my-secret",
-			headers:        map[string]string{"Metadata": "false"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"expected Metadata header with value 'true'\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, missing arguments",
-			url:            "https://azure-msi.teleport.dev/my-secret",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing value for parameter 'resource'\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, missing resource",
-			url:            "https://azure-msi.teleport.dev/my-secret?msi_res_id=azureTestIdentity",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing value for parameter 'resource'\"\n    }\n}",
-		},
-		{
-			name:           "invalid request, missing identity",
-			url:            "https://azure-msi.teleport.dev/my-secret?resource=myresource",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"unexpected value for parameter 'msi_res_id': \"\n    }\n}",
-		},
-		{
-			name:           "invalid request, wrong identity",
-			url:            "https://azure-msi.teleport.dev/my-secret?resource=myresource&msi_res_id=azureTestWrongIdentity",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   400,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"unexpected value for parameter 'msi_res_id': azureTestWrongIdentity\"\n    }\n}",
-		},
-		{
-			name:           "well-formatted request",
-			url:            "https://azure-msi.teleport.dev/my-secret?resource=myresource&msi_res_id=azureTestIdentity",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     privateKey,
-			expectedHandle: true,
-			expectedCode:   200,
-			verifyBody: func(t *testing.T, body []byte) {
-				type request struct {
-					AccessToken  string `json:"access_token"`
-					ClientID     string `json:"client_id"`
-					Resource     string `json:"resource"`
-					TokenType    string `json:"token_type"`
-					ExpiresIn    int    `json:"expires_in"`
-					ExpiresOn    int    `json:"expires_on"`
-					ExtExpiresIn int    `json:"ext_expires_in"`
-					NotBefore    int    `json:"not_before"`
-				}
-				var req request
-				require.NoError(t, json.Unmarshal(body, &req))
-
-				expected := request{
-					ClientID:     "decaffff-cafe-4aaa-cafe-cafecafecafe",
-					Resource:     "myresource",
-					TokenType:    "Bearer",
-					ExpiresIn:    31536000,
-					ExpiresOn:    1672563600,
-					ExtExpiresIn: 31536000,
-					NotBefore:    1641027590,
-				}
-
-				fromJWT := func(token string, pk crypto.Signer) (*jwt.AzureTokenClaims, error) {
-					key, err := jwt.New(&jwt.Config{
-						Clock:       m.Clock,
-						PrivateKey:  pk,
-						ClusterName: types.TeleportAzureMSIEndpoint,
-					})
-					require.NoError(t, err)
-					return key.VerifyAzureToken(token)
-				}
-
-				claims, err := fromJWT(req.AccessToken, privateKey)
-				require.NoError(t, err)
-				require.Equal(t, jwt.AzureTokenClaims{
-					TenantID: "cafecafe-cafe-4aaa-cafe-cafecafecafe",
-					Resource: "myresource",
-				}, *claims)
-
-				// verify that verification fails with different private key
-				_, err = fromJWT(req.AccessToken, newPrivateKey())
-				require.Error(t, err)
-
-				require.Equal(t, expected.ClientID, req.ClientID)
-				require.Equal(t, expected.Resource, req.Resource)
-				require.Equal(t, expected.TokenType, req.TokenType)
-				require.Equal(t, expected.ExpiresIn, req.ExpiresIn)
-				require.Equal(t, expected.ExpiresOn, req.ExpiresOn)
-				require.Equal(t, expected.ExtExpiresIn, req.ExtExpiresIn)
-				require.Equal(t, expected.NotBefore, req.NotBefore)
-			},
-		},
-		{
-			name:           "no private key set",
-			url:            "https://azure-msi.teleport.dev/my-secret?resource=myresource&msi_res_id=azureTestIdentity",
-			headers:        map[string]string{"Metadata": "true"},
-			privateKey:     nil,
-			expectedHandle: true,
-			expectedCode:   500,
-			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing private key set in AzureMSIMiddleware\"\n    }\n}",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			m.SetPrivateKey(tt.privateKey)
-
-			// prepare request
-			req, err := http.NewRequest("GET", tt.url, strings.NewReader(""))
-			require.NoError(t, err)
-
-			for k, v := range tt.headers {
-				req.Header.Set(k, v)
-			}
-
-			recorder := httptest.NewRecorder()
-
-			// run handler
-			handled := m.HandleRequest(recorder, req)
-			require.Equal(t, tt.expectedHandle, handled)
-			if !handled {
-				// skip the rest of test
-				return
-			}
-
-			// check results
-			resp := recorder.Result()
-			require.Equal(t, tt.expectedCode, resp.StatusCode)
-
-			body, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			require.NoError(t, resp.Body.Close())
-
-			if tt.verifyBody != nil {
-				tt.verifyBody(t, body)
-			} else {
-				require.Equal(t, tt.expectedBody, string(body))
-			}
-		})
-	}
-}
diff --git a/lib/srv/alpnproxy/azure_token_middleware.go b/lib/srv/alpnproxy/azure_token_middleware.go
new file mode 100644
index 0000000000000..9a1704a2aea94
--- /dev/null
+++ b/lib/srv/alpnproxy/azure_token_middleware.go
@@ -0,0 +1,240 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package alpnproxy
+
+import (
+	"crypto"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/jwt"
+)
+
+// AzureTokenMiddleware implements a simplified version of MSI and Identity
+// servers serving auth tokens.
+//
+// https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#rest-endpoint-reference
+type AzureTokenMiddleware struct {
+	DefaultLocalProxyHTTPMiddleware
+
+	// Identity is the Azure identity to be served by the server. Only single identity will be provided.
+	Identity string
+	// TenantID to be returned in a claim. Doesn't have to match actual TenantID as recognized by Azure.
+	TenantID string
+	// ClientID to be returned in a claim.
+	ClientID string
+
+	// Clock is used to override time in tests.
+	Clock clockwork.Clock
+	// Log is the Logger.
+	Log *slog.Logger
+	// Secret to be provided by the client.
+	Secret string
+
+	// privateKey used to sign JWT
+	privateKey   crypto.Signer
+	privateKeyMu sync.RWMutex
+}
+
+var _ LocalProxyHTTPMiddleware = &AzureTokenMiddleware{}
+
+func (m *AzureTokenMiddleware) CheckAndSetDefaults() error {
+	if m.Clock == nil {
+		m.Clock = clockwork.NewRealClock()
+	}
+	if m.Log == nil {
+		m.Log = slog.With(teleport.ComponentKey, "azure_token")
+	}
+
+	if m.Secret == "" {
+		return trace.BadParameter("missing Secret")
+	}
+	if m.Identity == "" {
+		return trace.BadParameter("missing Identity")
+	}
+	if m.TenantID == "" {
+		return trace.BadParameter("missing TenantID")
+	}
+	if m.ClientID == "" {
+		return trace.BadParameter("missing ClientID")
+	}
+	return nil
+}
+
+func (m *AzureTokenMiddleware) HandleRequest(rw http.ResponseWriter, req *http.Request) bool {
+	var err error
+	switch req.Host {
+	case types.TeleportAzureMSIEndpoint:
+		err = m.handleEndpoint(rw, req, MSIResourceFieldName, strings.TrimPrefix(req.URL.Path, "/"))
+	case types.TeleportAzureIdentityEndpoint:
+		err = m.handleEndpoint(rw, req, IdentityResourceFieldName, req.Header.Get(IdentitySecretHeader))
+	default:
+		m.Log.DebugContext(req.Context(), "Unsupported token host", "host", req.Host)
+		return false
+	}
+	if err != nil {
+		m.Log.WarnContext(req.Context(), "Bad token request", "error", err)
+		trace.WriteError(rw, trace.Wrap(err))
+	}
+
+	return true
+}
+
+// SetPrivateKey updates the private key.
+func (m *AzureTokenMiddleware) SetPrivateKey(privateKey crypto.Signer) {
+	m.privateKeyMu.Lock()
+	defer m.privateKeyMu.Unlock()
+	m.privateKey = privateKey
+}
+func (m *AzureTokenMiddleware) getPrivateKey() (crypto.Signer, error) {
+	m.privateKeyMu.RLock()
+	defer m.privateKeyMu.RUnlock()
+	if m.privateKey == nil {
+		// Use a plain error to return status code 500.
+		return nil, trace.Errorf("missing private key set in AzureTokenMiddleware")
+	}
+	return m.privateKey, nil
+}
+
+// handleEndpoint handles the Azure identity token generation.
+func (m *AzureTokenMiddleware) handleEndpoint(rw http.ResponseWriter, req *http.Request, resourceFieldName string, secret string) error {
+	// request validation
+	if secret != m.Secret {
+		return trace.BadParameter("invalid secret")
+	}
+
+	metadata := req.Header.Get("Metadata")
+	if metadata != "true" {
+		return trace.BadParameter("expected Metadata header with value 'true'")
+	}
+
+	if err := req.ParseForm(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	resource := req.Form.Get("resource")
+	if resource == "" {
+		return trace.BadParameter("missing value for parameter 'resource'")
+	}
+
+	// check that resource field matches expected Azure Identity
+	requestedAzureIdentity := req.Form.Get(resourceFieldName)
+	if requestedAzureIdentity != m.Identity {
+		m.Log.WarnContext(req.Context(), "Requested unexpected identity", "requested_identity", requestedAzureIdentity, "expected_identity", m.Identity)
+		return trace.BadParameter("unexpected value for parameter '%s': %v", resourceFieldName, requestedAzureIdentity)
+	}
+
+	respBody, err := m.fetchLoginResp(resource)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	m.Log.InfoContext(req.Context(), "Returning token for identity", "identity", m.Identity)
+
+	rw.Header().Add("Content-Type", "application/json; charset=utf-8")
+	rw.Header().Add("Content-Length", fmt.Sprintf("%v", len(respBody)))
+	rw.WriteHeader(200)
+	_, _ = rw.Write(respBody)
+	return nil
+}
+
+func (m *AzureTokenMiddleware) fetchLoginResp(resource string) ([]byte, error) {
+	now := m.Clock.Now()
+
+	notBefore := now.Add(-10 * time.Second)
+	expiresOn := now.Add(time.Hour * 24 * 365)
+	expiresIn := int64(expiresOn.Sub(now).Seconds())
+
+	accessToken, err := m.toJWT(jwt.AzureTokenClaims{
+		TenantID: m.TenantID,
+		Resource: resource,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	response := map[string]any{
+		"access_token":   accessToken,
+		"client_id":      m.ClientID,
+		"not_before":     notBefore.Unix(),
+		"expires_on":     expiresOn.Unix(),
+		"expires_in":     expiresIn,
+		"ext_expires_in": expiresIn,
+		"token_type":     "Bearer",
+		"resource":       resource,
+	}
+
+	out, err := json.MarshalIndent(response, "", "  ")
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return out, nil
+}
+
+func (m *AzureTokenMiddleware) toJWT(claims jwt.AzureTokenClaims) (string, error) {
+	privateKey, err := m.getPrivateKey()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	// Create a new key that can sign and verify tokens.
+	key, err := jwt.New(&jwt.Config{
+		Clock:      m.Clock,
+		PrivateKey: privateKey,
+		// TODO(gabrielcorado): use the cluster name. This value must match the
+		// one used by the proxy.
+		ClusterName: types.TeleportAzureMSIEndpoint,
+	})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	token, err := key.SignAzureToken(claims)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return token, nil
+}
+
+const (
+	// IdentitySecretHeader is the HTTP header that contains the identity
+	// secret on App Service identity requests.
+	//
+	// https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#rest-endpoint-reference
+	IdentitySecretHeader = "X-IDENTITY-HEADER"
+	// IdentityResourceFieldName is the request field name that contains the
+	// Azure identity on App Service identity requests.
+	//
+	// https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#rest-endpoint-reference
+	IdentityResourceFieldName = "mi_res_id"
+	// MSIResourceFieldName is the request field name that contains the Azure
+	// Identity on MSI identity requests.
+	MSIResourceFieldName = "msi_res_id"
+)
diff --git a/lib/srv/alpnproxy/azure_token_middleware_test.go b/lib/srv/alpnproxy/azure_token_middleware_test.go
new file mode 100644
index 0000000000000..eb7573a6affe3
--- /dev/null
+++ b/lib/srv/alpnproxy/azure_token_middleware_test.go
@@ -0,0 +1,330 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package alpnproxy
+
+import (
+	"crypto"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/jwt"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestAzureTokenMiddlewareHandleRequest(t *testing.T) {
+	t.Parallel()
+	for _, alg := range []cryptosuites.Algorithm{cryptosuites.RSA2048, cryptosuites.ECDSAP256} {
+		for _, endpoint := range []struct {
+			name              string
+			endpoint          string
+			resourceFieldName string
+			secret            func(string) azureRequestModifier
+		}{
+			{name: "msi", endpoint: types.TeleportAzureMSIEndpoint, resourceFieldName: MSIResourceFieldName, secret: msiSecretModifier},
+			{name: "identity", endpoint: types.TeleportAzureIdentityEndpoint, resourceFieldName: IdentityResourceFieldName, secret: identitySecretModifier},
+		} {
+			t.Run(alg.String()+"_"+endpoint.name, func(t *testing.T) {
+				testAzureTokenMiddlewareHandleRequest(t, alg, endpoint.endpoint, endpoint.secret, endpoint.resourceFieldName)
+			})
+		}
+	}
+}
+
+func testAzureTokenMiddlewareHandleRequest(t *testing.T, alg cryptosuites.Algorithm, endpoint string, endpointSecret func(string) azureRequestModifier, resourceFieldName string) {
+	newPrivateKey := func() crypto.Signer {
+		privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(alg)
+		require.NoError(t, err)
+		return privateKey
+	}
+	privateKey := newPrivateKey()
+	m := &AzureTokenMiddleware{
+		Identity: "azureTestIdentity",
+		TenantID: "cafecafe-cafe-4aaa-cafe-cafecafecafe",
+		ClientID: "decaffff-cafe-4aaa-cafe-cafecafecafe",
+		Log:      logtest.NewLogger(),
+		Clock:    clockwork.NewFakeClockAt(time.Date(2022, 1, 1, 9, 0, 0, 0, time.UTC)),
+		Secret:   "my-secret",
+	}
+	require.NoError(t, m.CheckAndSetDefaults())
+
+	tests := []struct {
+		name           string
+		url            string
+		params         map[string]string
+		headers        map[string]string
+		privateKey     crypto.Signer
+		secretFunc     azureRequestModifier
+		expectedHandle bool
+		expectedCode   int
+		expectedBody   string
+		verifyBody     func(t *testing.T, body []byte)
+	}{
+		{
+			name:           "ignore non-msi requests",
+			url:            "https://graph.windows.net/foo/bar/baz",
+			privateKey:     privateKey,
+			expectedHandle: false,
+		},
+		{
+			name:           "invalid request, wrong secret",
+			url:            endpoint,
+			headers:        map[string]string{},
+			secretFunc:     endpointSecret("bad-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"invalid secret\"\n    }\n}",
+		},
+		{
+			name:           "invalid request, missing secret",
+			url:            endpoint,
+			headers:        map[string]string{},
+			secretFunc:     emptySecretMethod,
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"invalid secret\"\n    }\n}",
+		},
+		{
+			name:           "invalid request, missing metadata",
+			url:            endpoint,
+			headers:        map[string]string{},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"expected Metadata header with value 'true'\"\n    }\n}",
+		},
+		{
+			name:           "invalid request, bad metadata value",
+			url:            endpoint,
+			headers:        map[string]string{"Metadata": "false"},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"expected Metadata header with value 'true'\"\n    }\n}",
+		},
+		{
+			name:           "invalid request, missing arguments",
+			url:            endpoint,
+			headers:        map[string]string{"Metadata": "true"},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing value for parameter 'resource'\"\n    }\n}",
+		},
+		{
+			name:    "invalid request, missing resource",
+			url:     endpoint,
+			headers: map[string]string{"Metadata": "true"},
+			params: map[string]string{
+				resourceFieldName: "azureTestIdentity",
+			},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing value for parameter 'resource'\"\n    }\n}",
+		},
+		{
+			name:    "invalid request, missing identity",
+			url:     endpoint,
+			headers: map[string]string{"Metadata": "true"},
+			params: map[string]string{
+				"resource": "myresource",
+			},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   fmt.Sprintf("{\n    \"error\": {\n        \"message\": \"unexpected value for parameter '%s': \"\n    }\n}", resourceFieldName),
+		},
+		{
+			name:    "invalid request, wrong identity",
+			url:     endpoint,
+			headers: map[string]string{"Metadata": "true"},
+			params: map[string]string{
+				resourceFieldName: "azureTestWrongIdentity",
+				"resource":        "myresource",
+			},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   400,
+			expectedBody:   fmt.Sprintf("{\n    \"error\": {\n        \"message\": \"unexpected value for parameter '%s': azureTestWrongIdentity\"\n    }\n}", resourceFieldName),
+		},
+		{
+			name:    "well-formatted request",
+			url:     endpoint,
+			headers: map[string]string{"Metadata": "true"},
+			params: map[string]string{
+				resourceFieldName: "azureTestIdentity",
+				"resource":        "myresource",
+			},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     privateKey,
+			expectedHandle: true,
+			expectedCode:   200,
+			verifyBody: func(t *testing.T, body []byte) {
+				type request struct {
+					AccessToken  string `json:"access_token"`
+					ClientID     string `json:"client_id"`
+					Resource     string `json:"resource"`
+					TokenType    string `json:"token_type"`
+					ExpiresIn    int    `json:"expires_in"`
+					ExpiresOn    int    `json:"expires_on"`
+					ExtExpiresIn int    `json:"ext_expires_in"`
+					NotBefore    int    `json:"not_before"`
+				}
+				var req request
+				require.NoError(t, json.Unmarshal(body, &req))
+
+				expected := request{
+					ClientID:     "decaffff-cafe-4aaa-cafe-cafecafecafe",
+					Resource:     "myresource",
+					TokenType:    "Bearer",
+					ExpiresIn:    31536000,
+					ExpiresOn:    1672563600,
+					ExtExpiresIn: 31536000,
+					NotBefore:    1641027590,
+				}
+
+				fromJWT := func(token string, pk crypto.Signer) (*jwt.AzureTokenClaims, error) {
+					key, err := jwt.New(&jwt.Config{
+						Clock:       m.Clock,
+						PrivateKey:  pk,
+						ClusterName: types.TeleportAzureMSIEndpoint,
+					})
+					require.NoError(t, err)
+					return key.VerifyAzureToken(token)
+				}
+
+				claims, err := fromJWT(req.AccessToken, privateKey)
+				require.NoError(t, err)
+				require.Equal(t, jwt.AzureTokenClaims{
+					TenantID: "cafecafe-cafe-4aaa-cafe-cafecafecafe",
+					Resource: "myresource",
+				}, *claims)
+
+				// verify that verification fails with different private key
+				_, err = fromJWT(req.AccessToken, newPrivateKey())
+				require.Error(t, err)
+
+				require.Equal(t, expected.ClientID, req.ClientID)
+				require.Equal(t, expected.Resource, req.Resource)
+				require.Equal(t, expected.TokenType, req.TokenType)
+				require.Equal(t, expected.ExpiresIn, req.ExpiresIn)
+				require.Equal(t, expected.ExpiresOn, req.ExpiresOn)
+				require.Equal(t, expected.ExtExpiresIn, req.ExtExpiresIn)
+				require.Equal(t, expected.NotBefore, req.NotBefore)
+			},
+		},
+		{
+			name:    "no private key set",
+			url:     endpoint,
+			headers: map[string]string{"Metadata": "true"},
+			params: map[string]string{
+				resourceFieldName: "azureTestIdentity",
+				"resource":        "myresource",
+			},
+			secretFunc:     endpointSecret("my-secret"),
+			privateKey:     nil,
+			expectedHandle: true,
+			expectedCode:   500,
+			expectedBody:   "{\n    \"error\": {\n        \"message\": \"missing private key set in AzureTokenMiddleware\"\n    }\n}",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m.SetPrivateKey(tt.privateKey)
+
+			params := url.Values{}
+			for name, value := range tt.params {
+				params.Set(name, value)
+			}
+
+			// prepare request
+			req, err := http.NewRequest("GET", "https://"+tt.url+"?"+params.Encode(), strings.NewReader(""))
+			require.NoError(t, err)
+
+			for k, v := range tt.headers {
+				req.Header.Set(k, v)
+			}
+
+			if tt.secretFunc != nil {
+				tt.secretFunc(req)
+			}
+			recorder := httptest.NewRecorder()
+
+			// run handler
+			handled := m.HandleRequest(recorder, req)
+			require.Equal(t, tt.expectedHandle, handled)
+			if !handled {
+				// skip the rest of test
+				return
+			}
+
+			// check results
+			resp := recorder.Result()
+			require.Equal(t, tt.expectedCode, resp.StatusCode)
+
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			require.NoError(t, resp.Body.Close())
+
+			if tt.verifyBody != nil {
+				tt.verifyBody(t, body)
+			} else {
+				require.Equal(t, tt.expectedBody, string(body))
+			}
+		})
+	}
+}
+
+// azureRequestModifier modifies an Azure request.
+type azureRequestModifier func(req *http.Request)
+
+func msiSecretModifier(secret string) azureRequestModifier {
+	return func(req *http.Request) {
+		req.URL = req.URL.JoinPath(secret)
+	}
+}
+
+func identitySecretModifier(secret string) azureRequestModifier {
+	return func(req *http.Request) {
+		req.Header.Add(IdentitySecretHeader, secret)
+	}
+}
+
+func emptySecretMethod(_ *http.Request) {}
diff --git a/lib/srv/alpnproxy/common/protocols.go b/lib/srv/alpnproxy/common/protocols.go
index d4cbbcfa4c190..054391d13f3ff 100644
--- a/lib/srv/alpnproxy/common/protocols.go
+++ b/lib/srv/alpnproxy/common/protocols.go
@@ -118,6 +118,9 @@ const (
 	// ProtocolPingSuffix is TLS ALPN suffix used to wrap connections with
 	// Ping.
 	ProtocolPingSuffix Protocol = "-ping"
+
+	// ProtocolMCP is TLS ALPN protocol value used to indicate MCP connections.
+	ProtocolMCP Protocol = "teleport-mcp"
 )
 
 // SupportedProtocols is the list of supported ALPN protocols.
@@ -138,6 +141,7 @@ var SupportedProtocols = WithPingProtocols(
 		ProtocolProxySSHGRPC,
 		ProtocolProxyGRPCInsecure,
 		ProtocolProxyGRPCSecure,
+		ProtocolMCP,
 	}, DatabaseProtocols...),
 )
 
@@ -150,6 +154,18 @@ func ProtocolsToString(protocols []Protocol) []string {
 	return out
 }
 
+// ProtocolToStringsWithPing converts Protocol to a list of strings, adding the
+// ping version if the protocol supports it.
+func ProtocolToStringsWithPing(protocol Protocol) []string {
+	if HasPingSupport(protocol) {
+		return []string{
+			string(ProtocolWithPing(protocol)),
+			string(protocol),
+		}
+	}
+	return []string{string(protocol)}
+}
+
 // ToALPNProtocol maps provided database protocol to ALPN protocol.
 func ToALPNProtocol(dbProtocol string) (Protocol, error) {
 	switch dbProtocol {
@@ -231,6 +247,7 @@ var DatabaseProtocols = []Protocol{
 var ProtocolsWithPingSupport = append(
 	DatabaseProtocols,
 	ProtocolTCP,
+	ProtocolMCP,
 )
 
 // WithPingProtocols adds Ping protocols to the list for each protocol that
diff --git a/lib/srv/alpnproxy/common/protocols_test.go b/lib/srv/alpnproxy/common/protocols_test.go
index f7d24c56d4a20..79a2a81183e1e 100644
--- a/lib/srv/alpnproxy/common/protocols_test.go
+++ b/lib/srv/alpnproxy/common/protocols_test.go
@@ -50,3 +50,8 @@ func TestIsDBTLSProtocol(t *testing.T) {
 	require.False(t, IsDBTLSProtocol("teleport-tcp"))
 	require.False(t, IsDBTLSProtocol(""))
 }
+
+func TestProtocolToStringsWithPing(t *testing.T) {
+	require.Equal(t, []string{"teleport-proxy-grpc-mtls"}, ProtocolToStringsWithPing(ProtocolProxyGRPCSecure))
+	require.Equal(t, []string{"teleport-mcp-ping", "teleport-mcp"}, ProtocolToStringsWithPing(ProtocolMCP))
+}
diff --git a/lib/srv/alpnproxy/forward_proxy.go b/lib/srv/alpnproxy/forward_proxy.go
index f1fec62a8fab1..64ee8242a745c 100644
--- a/lib/srv/alpnproxy/forward_proxy.go
+++ b/lib/srv/alpnproxy/forward_proxy.go
@@ -202,7 +202,7 @@ func isAWSSSMWebsocketRequest(req *http.Request) bool {
 // request.
 func MatchAzureRequests(req *http.Request) bool {
 	h := req.URL.Hostname()
-	return azure.IsAzureEndpoint(h) || types.TeleportAzureMSIEndpoint == h
+	return azure.IsAzureEndpoint(h) || types.TeleportAzureMSIEndpoint == h || types.TeleportAzureIdentityEndpoint == h
 }
 
 // MatchGCPRequests is a MatchFunc that returns true if request is an GCP API request.
diff --git a/lib/srv/alpnproxy/helpers_test.go b/lib/srv/alpnproxy/helpers_test.go
index 30f72b5543624..e175cf1a7191e 100644
--- a/lib/srv/alpnproxy/helpers_test.go
+++ b/lib/srv/alpnproxy/helpers_test.go
@@ -36,21 +36,22 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type Suite struct {
 	serverListener net.Listener
 	router         *Router
 	ca             *tlsca.CertAuthority
-	authServer     *auth.TestAuthServer
-	tlsServer      *auth.TestTLSServer
+	authServer     *authtest.AuthServer
+	tlsServer      *authtest.TLSServer
 	accessPoint    *authclient.Client
 }
 
@@ -64,7 +65,7 @@ func NewSuite(t *testing.T) *Suite {
 		l.Close()
 	})
 
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "root.example.com",
 		Dir:         t.TempDir(),
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
@@ -81,7 +82,7 @@ func NewSuite(t *testing.T) *Suite {
 		require.NoError(t, err)
 	})
 
-	ap, err := tlsServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	ap, err := tlsServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, ap.Close())
@@ -124,7 +125,7 @@ func (s *Suite) CreateProxyServer(t *testing.T) *Proxy {
 		Listener:          s.serverListener,
 		WebTLSConfig:      tlsConfig,
 		Router:            s.router,
-		Log:               utils.NewSlogLoggerForTests(),
+		Log:               logtest.NewLogger(),
 		AccessPoint:       s.accessPoint,
 		IdentityTLSConfig: tlsConfig,
 		ClusterName:       "root",
diff --git a/lib/srv/alpnproxy/kube.go b/lib/srv/alpnproxy/kube.go
index fe9635763a0ff..4267a63ff5cf6 100644
--- a/lib/srv/alpnproxy/kube.go
+++ b/lib/srv/alpnproxy/kube.go
@@ -43,6 +43,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/defaults"
+	kuberelay "github.com/gravitational/teleport/lib/kube/relay"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
@@ -80,6 +81,9 @@ type KubeMiddleware struct {
 	clock clockwork.Clock
 	// headless controls whether proxy is working in headless login mode.
 	headless bool
+	// relay signals that the local proxy is routing requests to the kube
+	// forwarder of a relay with the given address rather than of a proxy.
+	relay bool
 
 	logger       *slog.Logger
 	closeContext context.Context
@@ -99,6 +103,11 @@ type KubeMiddlewareConfig struct {
 	Clock        clockwork.Clock
 	Logger       *slog.Logger
 	CloseContext context.Context
+
+	// Relay signals that the middleware should provide the appropriate SNI
+	// override to connect to the Kube forwarder of a Relay rather than the one
+	// of a Proxy.
+	Relay bool
 }
 
 // NewKubeMiddleware creates a new KubeMiddleware.
@@ -110,6 +119,7 @@ func NewKubeMiddleware(cfg KubeMiddlewareConfig) LocalProxyHTTPMiddleware {
 		clock:        cfg.Clock,
 		logger:       cfg.Logger,
 		closeContext: cfg.CloseContext,
+		relay:        cfg.Relay,
 	}
 }
 
@@ -203,6 +213,29 @@ func (m *KubeMiddleware) HandleRequest(rw http.ResponseWriter, req *http.Request
 	return false
 }
 
+// GetServerName implements [LocalProxyHTTPMiddleware].
+func (m *KubeMiddleware) GetServerName(req *http.Request) (string, bool, error) {
+	if !m.relay {
+		// if we're not connecting to a Relay we should use the standard SNI
+		// configured in the LocalProxy
+		return "", false, nil
+	}
+
+	if req.TLS == nil {
+		return "", false, trace.BadParameter("expected a https request with a TLS connection state")
+	}
+	teleportCluster := common.TeleportClusterFromKubeLocalProxySNI(req.TLS.ServerName)
+	if teleportCluster == "" {
+		return "", false, trace.BadParameter("invalid Teleport cluster name in SNI %+q", req.TLS.ServerName)
+	}
+	kubeCluster, err := common.KubeClusterFromKubeLocalProxySNI(req.TLS.ServerName)
+	if err != nil {
+		return "", false, trace.BadParameter("invalid Kubernetes cluster name in SNI %+q", req.TLS.ServerName)
+	}
+
+	return kuberelay.FullSNIForKubeCluster(teleportCluster, kubeCluster), true, nil
+}
+
 func (m *KubeMiddleware) getCertForRequest(req *http.Request) (tls.Certificate, error) {
 	if req.TLS == nil {
 		return tls.Certificate{}, trace.BadParameter("expect a TLS request")
@@ -218,13 +251,13 @@ func (m *KubeMiddleware) getCertForRequest(req *http.Request) (tls.Certificate,
 	return cert, nil
 }
 
-// OverwriteClientCerts overwrites the client certs used for upstream connection.
-func (m *KubeMiddleware) OverwriteClientCerts(req *http.Request) ([]tls.Certificate, error) {
+// GetClientCerts implements [LocalProxyHTTPMiddleware].
+func (m *KubeMiddleware) GetClientCerts(req *http.Request) ([]tls.Certificate, bool, error) {
 	cert, err := m.getCertForRequest(req)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, false, trace.Wrap(err)
 	}
-	return []tls.Certificate{cert}, nil
+	return []tls.Certificate{cert}, true, nil
 }
 
 // ErrUserInputRequired returned when user's input required to relogin and/or reissue new certificate.
diff --git a/lib/srv/alpnproxy/local_proxy.go b/lib/srv/alpnproxy/local_proxy.go
index 3bb718ebc70bb..11e38616cdd93 100644
--- a/lib/srv/alpnproxy/local_proxy.go
+++ b/lib/srv/alpnproxy/local_proxy.go
@@ -236,7 +236,7 @@ func (l *LocalProxy) handleDownstreamConnection(ctx context.Context, downstreamC
 		return trace.Wrap(err)
 	}
 
-	upstreamConn, err := dialALPNMaybePing(ctx, l.cfg.RemoteProxyAddr, l.getALPNDialerConfig(cert))
+	upstreamConn, err := dialALPNMaybePing(ctx, l.cfg.RemoteProxyAddr, l.getALPNDialerConfig(l.cfg.SNI, cert))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -261,7 +261,7 @@ func (l *LocalProxy) HandleTCPConnector(ctx context.Context, connector func() (n
 		return trace.Wrap(err)
 	}
 
-	upstreamConn, err := dialALPNMaybePing(ctx, l.cfg.RemoteProxyAddr, l.getALPNDialerConfig(cert))
+	upstreamConn, err := dialALPNMaybePing(ctx, l.cfg.RemoteProxyAddr, l.getALPNDialerConfig(l.cfg.SNI, cert))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -299,20 +299,20 @@ func (l *LocalProxy) Close() error {
 	return nil
 }
 
-func (l *LocalProxy) getALPNDialerConfig(certs ...tls.Certificate) client.ALPNDialerConfig {
+func (l *LocalProxy) getALPNDialerConfig(serverName string, certs ...tls.Certificate) client.ALPNDialerConfig {
 	return client.ALPNDialerConfig{
 		ALPNConnUpgradeRequired: l.cfg.ALPNConnUpgradeRequired,
 		TLSConfig: &tls.Config{
 			NextProtos:         common.ProtocolsToString(l.cfg.Protocols),
 			InsecureSkipVerify: l.cfg.InsecureSkipVerify,
-			ServerName:         l.cfg.SNI,
+			ServerName:         serverName,
 			Certificates:       certs,
 			RootCAs:            l.cfg.RootCAs,
 		},
 	}
 }
 
-func (l *LocalProxy) makeHTTPReverseProxy(certs ...tls.Certificate) *httputil.ReverseProxy {
+func (l *LocalProxy) makeHTTPReverseProxy(serverName string, certs ...tls.Certificate) *httputil.ReverseProxy {
 	return &httputil.ReverseProxy{
 		Director: func(outReq *http.Request) {
 			outReq.URL.Scheme = "https"
@@ -341,7 +341,7 @@ func (l *LocalProxy) makeHTTPReverseProxy(certs ...tls.Certificate) *httputil.Re
 			http.Error(w, http.StatusText(code), code)
 		},
 		Transport: &http.Transport{
-			DialTLSContext: client.NewALPNDialer(l.getALPNDialerConfig(certs...)).DialContext,
+			DialTLSContext: client.NewALPNDialer(l.getALPNDialerConfig(serverName, certs...)).DialContext,
 		},
 	}
 }
@@ -404,15 +404,27 @@ func (l *LocalProxy) startHTTPAccessProxy(ctx context.Context) error {
 }
 
 func (l *LocalProxy) getHTTPReverseProxyForReq(req *http.Request) (*httputil.ReverseProxy, error) {
-	certs, err := l.cfg.HTTPMiddleware.OverwriteClientCerts(req)
-	if trace.IsNotImplemented(err) {
-		return l.makeHTTPReverseProxy(l.getCert()), nil
-	} else if err != nil {
+	serverName, ok, err := l.cfg.HTTPMiddleware.GetServerName(req)
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if ok {
+		l.cfg.Log.DebugContext(req.Context(), "got SNI from middleware", "server_name", serverName)
+	} else {
+		serverName = l.cfg.SNI
+	}
+
+	certs, ok, err := l.cfg.HTTPMiddleware.GetClientCerts(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if ok {
+		l.cfg.Log.DebugContext(req.Context(), "got certs from middleware")
+	} else {
+		certs = []tls.Certificate{l.getCert()}
+	}
 
-	l.cfg.Log.DebugContext(req.Context(), "overwrote certs")
-	return l.makeHTTPReverseProxy(certs...), nil
+	return l.makeHTTPReverseProxy(serverName, certs...), nil
 }
 
 // getCert returns the local proxy's configured TLS certificate.
diff --git a/lib/srv/alpnproxy/local_proxy_http_middleware.go b/lib/srv/alpnproxy/local_proxy_http_middleware.go
index b0aab1c539b65..70f1eb92727a0 100644
--- a/lib/srv/alpnproxy/local_proxy_http_middleware.go
+++ b/lib/srv/alpnproxy/local_proxy_http_middleware.go
@@ -21,8 +21,6 @@ package alpnproxy
 import (
 	"crypto/tls"
 	"net/http"
-
-	"github.com/gravitational/trace"
 )
 
 // LocalProxyHTTPMiddleware provides callback functions for LocalProxy in HTTP proxy mode.
@@ -36,28 +34,51 @@ type LocalProxyHTTPMiddleware interface {
 	// HandleResponse processes the server response before sending it to the client.
 	HandleResponse(resp *http.Response) error
 
-	// OverwriteClientCerts overwrites the client certs used for upstream connection.
-	OverwriteClientCerts(req *http.Request) ([]tls.Certificate, error)
+	// GetClientCerts optionally returns client certs that should be used for
+	// the connection to the upstream server for the given request. The method
+	// can return a false bool to signal that the [LocalProxy] should use the
+	// client cert from its own config.
+	GetClientCerts(req *http.Request) ([]tls.Certificate, bool, error)
+
+	// OverwriteServerName optionally returns a SNI that should be used for the
+	// connection to the upstream server for the given request, or a false bool
+	// to use the SNI from the [LocalProxy]'s own config.
+	GetServerName(req *http.Request) (string, bool, error)
 
 	// ClearCerts clears the middleware certs.
 	// It will try to reissue them when a new request comes in.
 	ClearCerts()
 }
 
-// DefaultLocalProxyHTTPMiddleware provides default implementations for LocalProxyHTTPMiddleware.
+// DefaultLocalProxyHTTPMiddleware provides default no-op implementations for
+// [LocalProxyHTTPMiddleware].
 type DefaultLocalProxyHTTPMiddleware struct {
 }
 
-func (m *DefaultLocalProxyHTTPMiddleware) CheckAndSetDefaults() error {
+// CheckAndSetDefaults implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) CheckAndSetDefaults() error {
 	return nil
 }
-func (m *DefaultLocalProxyHTTPMiddleware) HandleRequest(rw http.ResponseWriter, req *http.Request) bool {
+
+// HandleRequest implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) HandleRequest(rw http.ResponseWriter, req *http.Request) bool {
 	return false
 }
-func (m *DefaultLocalProxyHTTPMiddleware) HandleResponse(resp *http.Response) error {
+
+// HandleResponse implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) HandleResponse(resp *http.Response) error {
 	return nil
 }
-func (m *DefaultLocalProxyHTTPMiddleware) OverwriteClientCerts(req *http.Request) ([]tls.Certificate, error) {
-	return nil, trace.NotImplemented("not implemented")
+
+// GetClientCerts implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) GetClientCerts(req *http.Request) ([]tls.Certificate, bool, error) {
+	return nil, false, nil
+}
+
+// GetServerName implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) GetServerName(req *http.Request) (string, bool, error) {
+	return "", false, nil
 }
-func (m *DefaultLocalProxyHTTPMiddleware) ClearCerts() {}
+
+// ClearCerts implements [LocalProxyHTTPMiddleware].
+func (DefaultLocalProxyHTTPMiddleware) ClearCerts() {}
diff --git a/lib/srv/alpnproxy/local_proxy_test.go b/lib/srv/alpnproxy/local_proxy_test.go
index 8e82bad0c4a36..b2ccf3af5b5d1 100644
--- a/lib/srv/alpnproxy/local_proxy_test.go
+++ b/lib/srv/alpnproxy/local_proxy_test.go
@@ -50,7 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestHandleAWSAccessSigVerification tests if LocalProxy verifies the AWS SigV4 signature of incoming request.
@@ -546,8 +546,9 @@ func TestKubeMiddleware(t *testing.T) {
 			assert.Contains(t, rw.Buffer().String(), "context canceled")
 
 			// but certificate still was reissued.
-			certs, err := km.OverwriteClientCerts(req)
+			certs, ok, err := km.GetClientCerts(req)
 			assert.NoError(t, err)
+			assert.True(t, ok)
 			if !assert.Len(t, certs, 1) {
 				return
 			}
@@ -614,7 +615,7 @@ func TestKubeMiddleware(t *testing.T) {
 			km := NewKubeMiddleware(KubeMiddlewareConfig{
 				Certs:        tt.startCerts,
 				CertReissuer: certReissuer,
-				Logger:       utils.NewSlogLoggerForTests(),
+				Logger:       logtest.NewLogger(),
 				Clock:        tt.clock,
 				CloseContext: context.Background(),
 			})
@@ -622,12 +623,13 @@ func TestKubeMiddleware(t *testing.T) {
 			// HandleRequest will reissue certificate if needed
 			km.HandleRequest(responsewriters.NewMemoryResponseWriter(), &req)
 
-			certs, err := km.OverwriteClientCerts(&req)
+			certs, ok, err := km.GetClientCerts(&req)
 
 			if tt.wantErr != "" {
 				require.ErrorContains(t, err, tt.wantErr)
 			} else {
 				require.NoError(t, err)
+				require.True(t, ok)
 				require.Len(t, certs, 1)
 				require.Equal(t, tt.overwrittenCert, certs[0])
 			}
diff --git a/lib/srv/app/aws/handler.go b/lib/srv/app/aws/handler.go
index 476ad04e42c1c..98ab3855f9804 100644
--- a/lib/srv/app/aws/handler.go
+++ b/lib/srv/app/aws/handler.go
@@ -176,7 +176,7 @@ func (s *signerHandler) serveCommonRequest(sessCtx *common.SessionContext, w htt
 			ExternalID:  sessCtx.App.GetAWSExternalID(),
 			SessionName: sessCtx.Identity.Username,
 		}),
-		awsconfig.WithCredentialsMaybeIntegration(sessCtx.App.GetIntegration()),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: sessCtx.App.GetIntegration()}),
 	)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/srv/app/aws/handler_test.go b/lib/srv/app/aws/handler_test.go
index e51210582db35..ff4970c2c3b5f 100644
--- a/lib/srv/app/aws/handler_test.go
+++ b/lib/srv/app/aws/handler_test.go
@@ -56,10 +56,11 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/srv/app/azure/handler.go b/lib/srv/app/azure/handler.go
index 04cf06ff5e950..3192fcb95471f 100644
--- a/lib/srv/app/azure/handler.go
+++ b/lib/srv/app/azure/handler.go
@@ -257,8 +257,10 @@ func (s *handler) parseAuthHeader(token string, pubKey crypto.PublicKey) (*jwt.A
 
 	// Create a new key that can sign and verify tokens.
 	key, err := jwt.New(&jwt.Config{
-		Clock:       s.Clock,
-		PublicKey:   pubKey,
+		Clock:     s.Clock,
+		PublicKey: pubKey,
+		// TODO(gabrielcorado): use the cluster name. This value must match the
+		// one used by the local proxy middleware.
 		ClusterName: types.TeleportAzureMSIEndpoint,
 	})
 	if err != nil {
diff --git a/lib/srv/app/cloud.go b/lib/srv/app/cloud.go
index caf38957b4d26..4535180f78139 100644
--- a/lib/srv/app/cloud.go
+++ b/lib/srv/app/cloud.go
@@ -38,6 +38,7 @@ import (
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
 	"github.com/gravitational/teleport/lib/tlsca"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 )
@@ -62,6 +63,9 @@ type AWSSigninRequest struct {
 	// Integration is the Integration name to use to generate credentials.
 	// If empty, it will use ambient credentials
 	Integration string
+	// RolesAnywhereMetadata contains the Profile/Role information to use when
+	// sourcing the credentials from a Roles Anywhere integration.
+	RolesAnywhereMetadata awsconfig.RolesAnywhereMetadata
 }
 
 // CheckAndSetDefaults validates the request.
@@ -177,58 +181,72 @@ func (c *cloud) getAWSSigninToken(ctx context.Context, req *AWSSigninRequest, en
 	// "SessionDuration" is not provided, the web console session duration will
 	// be bound to the duration used in the next AssumeRole call.
 
+	integrationMetadata := awsconfig.IntegrationMetadata{
+		Name:                  req.Integration,
+		RolesAnywhereMetadata: req.RolesAnywhereMetadata,
+	}
+
+	// When using Roles Anywhere integration, the session duration is set to the maximum allowed for temporary sessions: 1h.
+	// TODO(marco): add support for longer sessions which Roles Anywhere allows for but, requires us to know the Role's maximum session duration.
+	if req.RolesAnywhereMetadata.ProfileARN != "" {
+		duration, err := c.getFederationDuration(req, true /* temporarySession */)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+
+		req.RolesAnywhereMetadata.SessionDuration = duration
+	}
+
 	// Sign In requests target IAM endpoints which don't require a region.
 	region := ""
 	baseCfg, err := c.awsCachedProvider.GetConfig(ctx, region,
-		awsconfig.WithCredentialsMaybeIntegration(req.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(integrationMetadata),
 	)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	temporarySession, err := isSessionUsingTemporaryCredentials(ctx, baseCfg)
+	if baseCfg.Credentials == nil {
+		return "", trace.NotFound("session credentials not found")
+	}
+
+	baseCreds, err := baseCfg.Credentials.Retrieve(ctx)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	duration, err := c.getFederationDuration(req, temporarySession)
+	temporarySession, err := isSessionUsingTemporaryCredentials(baseCreds)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	assumeRole := awsconfig.AssumeRole{
-		RoleARN:    req.Identity.RouteToApp.AWSRoleARN,
-		ExternalID: req.ExternalID,
-		// Setting role session name to Teleport username will allow to
-		// associate CloudTrail events with the Teleport user.
-		SessionName: req.Identity.Username,
+	duration, err := c.getFederationDuration(req, temporarySession)
+	if err != nil {
+		return "", trace.Wrap(err)
 	}
 
-	// Setting web console session duration through AssumeRole call for AWS
-	// sessions with temporary credentials.
-	// Technically the session duration can be set this way for
-	// non-temporary sessions. However, the AssumeRole call will fail if we
-	// are requesting duration longer than the maximum session duration of
-	// the role we are assuming. In addition, the session credentials may
-	// not have permission to perform a get-role on the role. Therefore,
-	// "SessionDuration" parameter will be defined when calling federation
-	// endpoint below instead of here, for non-temporary sessions.
+	awsConfigOptions := append(c.cfg.AWSConfigOptions,
+		awsconfig.WithCredentialsMaybeIntegration(integrationMetadata),
+		awsconfig.WithBaseCredentialsProvider(baseCfg.Credentials),
+	)
+
+	// Most flows for providing AWS Access, require the following:
+	// - access to credentials for a helper Role (EC2 instance profile's Role, AWS OIDC Integration Role, etc.)
+	// - use the credentials to call sts:AssumeRole to obtain the credentials for the target role
+	// - use the credentials to call the federation endpoint to obtain the federation URL
 	//
-	// https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
-	if temporarySession {
-		c.cfg.Logger.DebugContext(ctx, "Temporary session")
-		assumeRole.Duration = duration
+	// The exception is the IAM Roles Anywhere integration which only uses the target role (no intermediate role).
+	switch {
+	case req.RolesAnywhereMetadata.ProfileARN != "":
+	default:
+		awsConfigOptions = append(awsConfigOptions,
+			getAssumeDetailedRolesOption(ctx, req, temporarySession, duration),
+		)
 	}
 
 	// Do not use cache provider to avoid returning credentials with wrong
 	// expiry duration.
-	awsCfg, err := awsconfig.GetConfig(ctx, region,
-		append(c.cfg.AWSConfigOptions,
-			awsconfig.WithCredentialsMaybeIntegration(req.Integration),
-			awsconfig.WithBaseCredentialsProvider(baseCfg.Credentials),
-			awsconfig.WithDetailedAssumeRole(assumeRole),
-		)...,
-	)
+	awsCfg, err := awsconfig.GetConfig(ctx, region, awsConfigOptions...)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -285,19 +303,38 @@ func (c *cloud) getAWSSigninToken(ctx context.Context, req *AWSSigninRequest, en
 	return fedResp.SigninToken, nil
 }
 
+func getAssumeDetailedRolesOption(ctx context.Context, req *AWSSigninRequest, temporarySession bool, duration time.Duration) awsconfig.OptionsFn {
+	assumeRole := awsconfig.AssumeRole{
+		RoleARN:    req.Identity.RouteToApp.AWSRoleARN,
+		ExternalID: req.ExternalID,
+		// Setting role session name to Teleport username will allow to
+		// associate CloudTrail events with the Teleport user.
+		SessionName: req.Identity.Username,
+	}
+
+	// Setting web console session duration through AssumeRole call for AWS
+	// sessions with temporary credentials.
+	// Technically the session duration can be set this way for
+	// non-temporary sessions. However, the AssumeRole call will fail if we
+	// are requesting duration longer than the maximum session duration of
+	// the role we are assuming. In addition, the session credentials may
+	// not have permission to perform a get-role on the role. Therefore,
+	// "SessionDuration" parameter will be defined when calling federation
+	// endpoint below instead of here, for non-temporary sessions.
+	//
+	// https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
+	if temporarySession {
+		assumeRole.Duration = duration
+	}
+
+	return awsconfig.WithDetailedAssumeRole(assumeRole)
+}
+
 // isSessionUsingTemporaryCredentials checks if the current aws session is
 // using temporary credentials.
 //
 // https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html
-func isSessionUsingTemporaryCredentials(ctx context.Context, cfg aws.Config) (bool, error) {
-	if cfg.Credentials == nil {
-		return false, trace.NotFound("session credentials not found")
-	}
-
-	credentials, err := cfg.Credentials.Retrieve(ctx)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
+func isSessionUsingTemporaryCredentials(credentials aws.Credentials) (bool, error) {
 
 	switch credentials.Source {
 	case ec2rolecreds.ProviderName:
@@ -320,7 +357,11 @@ func isSessionUsingTemporaryCredentials(ctx context.Context, cfg aws.Config) (bo
 		// ssocreds.Provider is an AWS credential provider that retrieves
 		// temporary AWS credentials by exchanging an SSO login token.
 		// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/ssocreds#Provider
-		ssocreds.ProviderName:
+		ssocreds.ProviderName,
+
+		// When using the AWS Roles Anywhere integration, the credentials are temporary:
+		// https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html#response-elements
+		awsra.AWSCredentialsSourceRolesAnywhere:
 		return true, nil
 	}
 
diff --git a/lib/srv/app/cloud_test.go b/lib/srv/app/cloud_test.go
index 065fb6c80b395..f0a3ba570d1aa 100644
--- a/lib/srv/app/cloud_test.go
+++ b/lib/srv/app/cloud_test.go
@@ -84,25 +84,16 @@ func TestIsSessionUsingTemporaryCredentials(t *testing.T) {
 			},
 			expectBool: true,
 		},
-		{
-			name:        "bad config",
-			credentials: nil,
-			expectError: trace.IsNotFound,
-		},
-		{
-			name: "failed to get credentials",
-			credentials: &mockCredentialsProvider{
-				retrieveError: trace.AccessDenied(""),
-			},
-			expectError: trace.IsAccessDenied,
-		},
 	}
 
 	for _, test := range tests {
 		test := test // capture range variable
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
-			isTemporary, err := isSessionUsingTemporaryCredentials(ctx, aws.Config{Credentials: test.credentials})
+			awsCredentials, err := test.credentials.Retrieve(ctx)
+			require.NoError(t, err)
+
+			isTemporary, err := isSessionUsingTemporaryCredentials(awsCredentials)
 
 			if test.expectError != nil {
 				require.True(t, test.expectError(err))
diff --git a/lib/srv/app/common/header_rewriter.go b/lib/srv/app/common/header_rewriter.go
index 707e16ea505c3..de2251611de57 100644
--- a/lib/srv/app/common/header_rewriter.go
+++ b/lib/srv/app/common/header_rewriter.go
@@ -19,8 +19,14 @@
 package common
 
 import (
+	"context"
+	"iter"
+	"log/slog"
 	"net/http/httputil"
+	"slices"
 
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/iterutils"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
@@ -55,3 +61,19 @@ func (hr *HeaderRewriter) Rewrite(req *httputil.ProxyRequest) {
 		req.Out.Header.Set(XForwardedSSL, sslOff)
 	}
 }
+
+// AppRewriteHeaders returns an iterator for app headers to rewrite. Reserved
+// headers are skipped.
+func AppRewriteHeaders(ctx context.Context, rewrite *types.Rewrite, log *slog.Logger) iter.Seq[*types.Header] {
+	var headers []*types.Header
+	if rewrite != nil {
+		headers = rewrite.Headers
+	}
+	return iterutils.Filter(func(header *types.Header) bool {
+		if IsReservedHeader(header.Name) {
+			log.DebugContext(ctx, "Not rewriting Teleport reserved header", "header_name", header.Name)
+			return false
+		}
+		return true
+	}, slices.Values(headers))
+}
diff --git a/lib/srv/app/common/header_rewriter_test.go b/lib/srv/app/common/header_rewriter_test.go
index ff349d52aaf91..ccb166dde1426 100644
--- a/lib/srv/app/common/header_rewriter_test.go
+++ b/lib/srv/app/common/header_rewriter_test.go
@@ -19,15 +19,20 @@
 package common
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"slices"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
@@ -148,3 +153,39 @@ func TestHeaderRewriter(t *testing.T) {
 		})
 	}
 }
+
+func TestAppRewriteHeaders(t *testing.T) {
+	tests := []struct {
+		name        string
+		rewrite     *types.Rewrite
+		wantHeaders []*types.Header
+	}{
+		{
+			name:        "no rewrite",
+			rewrite:     nil,
+			wantHeaders: nil,
+		},
+		{
+			name: "reserved header is filtered",
+			rewrite: &types.Rewrite{
+				Headers: []*types.Header{
+					{Name: "test-key-1", Value: "test-value-1"},
+					{Name: "teleport-jwt-assertion", Value: "teleport-jwt-assertion-value"},
+					{Name: "test-key-2", Value: "test-value-2"},
+					{Name: "X-Real-Ip", Value: "1.2.3.4"},
+				},
+			},
+			wantHeaders: []*types.Header{
+				{Name: "test-key-1", Value: "test-value-1"},
+				{Name: "test-key-2", Value: "test-value-2"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actualHeaders := AppRewriteHeaders(context.Background(), test.rewrite, slog.Default())
+			require.Equal(t, test.wantHeaders, slices.Collect(actualHeaders))
+		})
+	}
+}
diff --git a/lib/srv/app/common/jwt.go b/lib/srv/app/common/jwt.go
new file mode 100644
index 0000000000000..77f9fdf0a4301
--- /dev/null
+++ b/lib/srv/app/common/jwt.go
@@ -0,0 +1,78 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// AppTokenGenerator defines an interface for generating JWT token for an
+// application (by auth).
+type AppTokenGenerator interface {
+	GenerateAppToken(context.Context, types.GenerateAppTokenRequest) (string, error)
+}
+
+// GenerateJWTAndTraits is helper that generates a JWT for an application and
+// populates the user traits with the result JWT for templating.
+func GenerateJWTAndTraits(
+	ctx context.Context,
+	identity *tlsca.Identity,
+	app types.Application,
+	generator AppTokenGenerator,
+) (string, wrappers.Traits, error) {
+	rewrite := app.GetRewrite()
+	traits := identity.Traits
+	roles := identity.Groups
+	if rewrite != nil {
+		switch rewrite.JWTClaims {
+		case types.JWTClaimsRewriteNone:
+			traits = nil
+			roles = nil
+		case types.JWTClaimsRewriteRoles:
+			traits = nil
+		case types.JWTClaimsRewriteTraits:
+			roles = nil
+		case "", types.JWTClaimsRewriteRolesAndTraits:
+		}
+	}
+
+	// Request a JWT token that will be attached to all requests.
+	jwt, err := generator.GenerateAppToken(ctx, types.GenerateAppTokenRequest{
+		Username: identity.Username,
+		Roles:    roles,
+		Traits:   traits,
+		URI:      app.GetURI(),
+		Expires:  identity.Expires,
+	})
+	if err != nil {
+		return "", nil, trace.Wrap(err)
+	}
+	if traits == nil {
+		traits = make(wrappers.Traits)
+	}
+	traits[constants.TraitJWT] = []string{jwt}
+	return jwt, traits, trace.Wrap(err)
+}
diff --git a/lib/srv/app/connections_handler.go b/lib/srv/app/connections_handler.go
index 3cd60725c5797..4afe47e1235fd 100644
--- a/lib/srv/app/connections_handler.go
+++ b/lib/srv/app/connections_handler.go
@@ -42,6 +42,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/authz"
@@ -54,6 +55,7 @@ import (
 	appazure "github.com/gravitational/teleport/lib/srv/app/azure"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	appgcp "github.com/gravitational/teleport/lib/srv/app/gcp"
+	"github.com/gravitational/teleport/lib/srv/mcp"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
@@ -113,6 +115,9 @@ type ConnectionsHandlerConfig struct {
 
 	// Logger is the slog.Logger.
 	Logger *slog.Logger
+
+	// MCPDemoServer enables the "Teleport Demo" MCP server.
+	MCPDemoServer bool
 }
 
 // CheckAndSetDefaults validates the config values and sets defaults.
@@ -175,6 +180,7 @@ type ConnectionsHandler struct {
 	httpServer *http.Server
 	tlsConfig  *tls.Config
 	tcpServer  *tcpServer
+	mcpServer  *mcp.Server
 
 	// cache holds sessionChunk objects for in-flight app sessions.
 	cache *utils.FnCache
@@ -273,12 +279,26 @@ func NewConnectionsHandler(closeContext context.Context, cfg *ConnectionsHandler
 	}
 	c.tcpServer = tcpServer
 
+	// Handle MCP servers.
+	c.mcpServer, err = mcp.NewServer(mcp.ServerConfig{
+		Emitter:          c.cfg.Emitter,
+		ParentContext:    c.closeContext,
+		HostID:           c.cfg.HostID,
+		AccessPoint:      c.cfg.AccessPoint,
+		EnableDemoServer: c.cfg.MCPDemoServer,
+		CipherSuites:     c.cfg.CipherSuites,
+		AuthClient:       c.cfg.AuthClient,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	// Make copy of server's TLS configuration and update it with the specific
 	// functionality this server needs, like requiring client certificates.
 	c.tlsConfig = CopyAndConfigureTLS(c.log, c.cfg.AccessPoint, c.cfg.TLSConfig)
 
 	// Figure out the port the proxy is running on.
-	c.proxyPort = c.getProxyPort()
+	c.proxyPort = c.getProxyPort(c.closeContext)
 
 	return c, nil
 }
@@ -440,8 +460,11 @@ func (c *ConnectionsHandler) serveHTTP(w http.ResponseWriter, r *http.Request) e
 }
 
 // getProxyPort tries to figure out the address the proxy is running at.
-func (c *ConnectionsHandler) getProxyPort() string {
-	servers, err := c.cfg.AccessPoint.GetProxies()
+func (c *ConnectionsHandler) getProxyPort(ctx context.Context) string {
+	servers, err := clientutils.CollectWithFallback(ctx, c.cfg.AccessPoint.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return c.cfg.AccessPoint.GetProxies()
+	})
 	if err != nil {
 		return strconv.Itoa(defaults.HTTPListenPort)
 	}
@@ -469,6 +492,12 @@ func (c *ConnectionsHandler) serveAWSWebConsole(w http.ResponseWriter, r *http.R
 		Issuer:      app.GetPublicAddr(),
 		ExternalID:  app.GetAWSExternalID(),
 		Integration: app.GetIntegration(),
+		RolesAnywhereMetadata: awsconfig.RolesAnywhereMetadata{
+			ProfileARN:                    app.GetAWSRolesAnywhereProfileARN(),
+			ProfileAcceptsRoleSessionName: app.GetAWSRolesAnywhereAcceptRoleSessionName(),
+			RoleARN:                       identity.RouteToApp.AWSRoleARN,
+			IdentityUsername:              identity.Username,
+		},
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -539,10 +568,12 @@ func (c *ConnectionsHandler) authorizeContext(ctx context.Context) (*authz.Conte
 		app,
 		state,
 		matchers...); {
-	case errors.Is(err, services.ErrTrustedDeviceRequired):
-		// Let the trusted device error through for clarity.
-		return nil, nil, trace.Wrap(services.ErrTrustedDeviceRequired)
+	case errors.Is(err, services.ErrTrustedDeviceRequired) || errors.Is(err, services.ErrSessionMFARequired):
+		// When access is denied due to trusted device or session MFA requirements, these specific errors
+		// are returned directly to provide clarity to the client about the additional authentication steps needed.
+		return nil, nil, trace.Wrap(err)
 	case err != nil:
+		// Other access denial errors are wrapped and obfuscated to prevent leaking sensitive details.
 		c.log.WarnContext(c.closeContext, "Access denied to application.",
 			"app", app.GetName(),
 			"error", err,
@@ -579,14 +610,19 @@ func (c *ConnectionsHandler) handleConnection(conn net.Conn) (func(), error) {
 	// The behavior here is a little hard to track. To be clear here, if authorization fails
 	// the following will occur:
 	// 1. If the application is a TCP application, error out immediately as expected.
-	// 2. If the application is an HTTP application, store the error and let the HTTP handler
+	// 2. If the application is an MCP application, let the MCP server handler
+	//    returns the error on first request.
+	// 3. If the application is an HTTP application, store the error and let the HTTP handler
 	//    serve the error directly so that it's properly converted to an HTTP status code.
 	//    This will ensure users will get a 403 when authorization fails.
 	if err != nil {
-		if !app.IsTCP() {
-			c.setConnAuth(tlsConn, err)
-		} else {
+		switch {
+		case app.IsTCP():
 			return nil, trace.Wrap(err)
+		case app.IsMCP():
+			return nil, trace.Wrap(c.mcpServer.HandleUnauthorizedConnection(ctx, conn, app, err))
+		default:
+			c.setConnAuth(tlsConn, err)
 		}
 	} else {
 		// Monitor the connection an update the context.
@@ -602,17 +638,28 @@ func (c *ConnectionsHandler) handleConnection(conn net.Conn) (func(), error) {
 
 	// Application access supports plain TCP connections which are handled
 	// differently than HTTP requests from web apps.
-	if app.IsTCP() {
+	switch {
+	case app.IsTCP():
 		identity := authCtx.Identity.GetIdentity()
 		defer cancel(nil)
 		return nil, trace.Wrap(c.handleTCPApp(ctx, tlsConn, &identity, app))
-	}
 
-	cleanup := func() {
-		cancel(nil)
-		c.deleteConnAuth(tlsConn)
+	case app.IsMCP():
+		defer cancel(nil)
+		sessionCtx := mcp.SessionCtx{
+			ClientConn: tlsConn,
+			AuthCtx:    authCtx,
+			App:        app,
+		}
+		return nil, trace.Wrap(c.mcpServer.HandleSession(ctx, &sessionCtx))
+
+	default:
+		cleanup := func() {
+			cancel(nil)
+			c.deleteConnAuth(tlsConn)
+		}
+		return cleanup, trace.Wrap(c.handleHTTPApp(ctx, tlsConn))
 	}
-	return cleanup, trace.Wrap(c.handleHTTPApp(ctx, tlsConn))
 }
 
 // handleHTTPApp handles connection for an HTTP application.
@@ -681,18 +728,21 @@ func (c *ConnectionsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		c.log.WarnContext(c.closeContext, "Failed to serve request", "error", err)
 
-		// Covert trace error type to HTTP and write response, make sure we close the
+		// Convert trace error type to HTTP and write response, make sure we close the
 		// connection afterwards so that the monitor is recreated if needed.
 		code := trace.ErrorToCode(err)
 
 		var text string
-		if errors.Is(err, services.ErrTrustedDeviceRequired) {
-			// Return a nicer error message for device trust errors.
-			text = `Access to this app requires a trusted device.
+		switch {
+		case errors.Is(err, services.ErrTrustedDeviceRequired):
+			text = `A trusted device is required to access this resource but this device has not been registered as a trusted device; use 'tsh device enroll' to register as a trusted device.
 
 See https://goteleport.com/docs/admin-guides/access-controls/device-trust/device-management/#troubleshooting for help.
 `
-		} else {
+		case errors.Is(err, services.ErrSessionMFARequired):
+			text = authclient.ErrNoMFADevices.Error()
+
+		default:
 			text = http.StatusText(code)
 		}
 
diff --git a/lib/srv/app/gcp/handler.go b/lib/srv/app/gcp/handler.go
index 912bfcca5370a..d942c49cfb9d3 100644
--- a/lib/srv/app/gcp/handler.go
+++ b/lib/srv/app/gcp/handler.go
@@ -34,7 +34,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/utils/gcp"
-	"github.com/gravitational/teleport/lib/cloud"
+	libgcp "github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
@@ -92,11 +92,9 @@ func (s *HandlerConfig) CheckAndSetDefaults() error {
 		s.Log = slog.With(teleport.ComponentKey, "gcp:fwd")
 	}
 	if s.cloudClientGCP == nil {
-		clients, err := cloud.NewClients()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		s.cloudClientGCP = &cloudClientGCPImpl[*gcpcredentials.IamCredentialsClient]{getGCPIAMClient: clients.GetGCPIAMClient}
+		// TODO (Tener): clients should be closed when no longer in use.
+		clients := libgcp.NewClients()
+		s.cloudClientGCP = &cloudClientGCPImpl[*gcpcredentials.IamCredentialsClient]{getGCPIAMClient: clients.GetIAMClient}
 	}
 	return nil
 }
diff --git a/lib/srv/app/server.go b/lib/srv/app/server.go
index b085a96fd7e31..62125d4c3051a 100644
--- a/lib/srv/app/server.go
+++ b/lib/srv/app/server.go
@@ -35,6 +35,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/reversetunnel"
@@ -351,8 +352,13 @@ func (s *Server) getServerInfo(app types.Application) (*types.AppServerV3, error
 		App:      copy,
 		ProxyIDs: s.c.ConnectedProxyGetter.GetProxyIDs(),
 	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	server.SetComponentFeatures(componentfeatures.ForAppServer(server))
 
-	return server, trace.Wrap(err)
+	return server, nil
 }
 
 // getRotationState is a helper to return this server's CA rotation state.
@@ -435,6 +441,18 @@ func (s *Server) Start(ctx context.Context) (err error) {
 	if s.watcher, err = s.startResourceWatcher(ctx); err != nil {
 		return trace.Wrap(err)
 	}
+
+	// App uses heartbeat v2, which heartbeats resources but not the server itself
+	// If there are no resources, we will never report ready.
+	// We workaround by reporting ready after the first successful watcher init.
+	// We only need to do this if the watcher is non-nil, because if
+	// it's nil we are advertising some static app and will heartbeat.
+	if s.watcher != nil && s.c.OnHeartbeat != nil {
+		go func() {
+			s.c.OnHeartbeat(s.watcher.WaitInitialization())
+		}()
+	}
+
 	return nil
 }
 
diff --git a/lib/srv/app/server_test.go b/lib/srv/app/server_test.go
index 9dc4f3f8c570e..c35f65190d97f 100644
--- a/lib/srv/app/server_test.go
+++ b/lib/srv/app/server_test.go
@@ -56,10 +56,12 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/inventory"
@@ -70,20 +72,24 @@ import (
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
+	logtest.InitLogger(testing.Verbose)
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
 	modules.SetInsecureTestMode(true)
-	os.Exit(m.Run())
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 type Suite struct {
 	clock        *clockwork.FakeClock
 	dataDir      string
-	authServer   *auth.TestAuthServer
-	tlsServer    *auth.TestTLSServer
+	authServer   *authtest.AuthServer
+	tlsServer    *authtest.TLSServer
 	authClient   *authclient.Client
 	appServer    *Server
 	hostCertPool *x509.CertPool
@@ -165,6 +171,7 @@ func SetUpSuite(t *testing.T) *Suite {
 
 func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 	s := &Suite{}
+	s.closeContext, s.closeFunc = context.WithCancel(t.Context())
 
 	s.clock = clockwork.NewFakeClock()
 	s.dataDir = t.TempDir()
@@ -173,7 +180,7 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 
 	var err error
 	// Create Auth Server.
-	s.authServer, err = auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	s.authServer, err = authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "root.example.com",
 		Dir:         s.dataDir,
 		Clock:       s.clock,
@@ -182,13 +189,16 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 	require.NoError(t, err)
 	t.Cleanup(func() { s.authServer.Close() })
 
+	recordingMode := types.RecordOff
 	if config.ServerStreamer != nil {
-		_, err = s.authServer.AuthServer.UpsertSessionRecordingConfig(s.closeContext, &types.SessionRecordingConfigV2{
-			Spec: types.SessionRecordingConfigSpecV2{Mode: types.RecordAtNodeSync},
-		})
-		require.NoError(t, err)
+		recordingMode = types.RecordAtNodeSync
 	}
 
+	_, err = s.authServer.AuthServer.UpsertSessionRecordingConfig(s.closeContext, &types.SessionRecordingConfigV2{
+		Spec: types.SessionRecordingConfigSpecV2{Mode: recordingMode},
+	})
+	require.NoError(t, err)
+
 	s.tlsServer, err = s.authServer.NewTestTLSServer()
 	require.NoError(t, err)
 
@@ -226,11 +236,9 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 		},
 	}
 	// Create user for regular tests.
-	s.user, err = auth.CreateUser(context.Background(), s.tlsServer.Auth(), "foo", s.role)
+	s.user, err = authtest.CreateUser(context.Background(), s.tlsServer.Auth(), "foo", s.role)
 	require.NoError(t, err)
 
-	s.closeContext, s.closeFunc = context.WithCancel(context.Background())
-
 	// Create a in-memory HTTP server that will respond with a UUID. This value
 	// will be checked in the client later to ensure a connection was made.
 	s.message = uuid.New().String()
@@ -308,14 +316,14 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 	require.NoError(t, err)
 
 	// Create a client with a machine role of RoleApp.
-	s.authClient, err = s.tlsServer.NewClient(auth.TestServerID(types.RoleApp, s.hostUUID))
+	s.authClient, err = s.tlsServer.NewClient(authtest.TestServerID(types.RoleApp, s.hostUUID))
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
 		s.authClient.Close()
 	})
 
-	serverIdentity, err := auth.NewServerIdentity(s.authServer.AuthServer, s.hostUUID, types.RoleApp)
+	serverIdentity, err := authtest.NewServerIdentity(s.authServer.AuthServer, s.hostUUID, types.RoleApp)
 	require.NoError(t, err)
 	tlsConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -465,15 +473,10 @@ func TestStart(t *testing.T) {
 
 	// Fetch the services.App that the service heartbeat.
 	var servers []types.AppServer
-	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		apps, err := s.authServer.AuthServer.GetApplicationServers(s.closeContext, defaults.Namespace)
-		if !assert.NoError(t, err) {
-			return
-		}
-
-		if !assert.Len(t, apps, 3) {
-			return
-		}
+		require.NoError(t, err)
+		require.Len(t, apps, 3)
 		servers = apps
 	}, 10*time.Second, 100*time.Millisecond)
 
@@ -500,7 +503,7 @@ func TestStart(t *testing.T) {
 
 	sort.Sort(types.AppServers(servers))
 	require.Empty(t, cmp.Diff([]types.AppServer{serverAWS, serverAWSWithIntegration, serverFoo}, servers,
-		cmpopts.IgnoreFields(types.Metadata{}, "Revision", "Expires")))
+		cmpopts.IgnoreFields(types.Metadata{}, "Revision", "Expires"), cmpopts.IgnoreFields(types.AppServerSpecV3{}, "ComponentFeatures")))
 
 	// Check the expiry time is correct.
 	for _, server := range servers {
@@ -914,6 +917,7 @@ func TestAuthorize(t *testing.T) {
 		roleAppLabels        types.Labels
 		appLabels            map[string]string
 		requireTrustedDevice bool // assigns user to a role that requires trusted devices
+		requireMFADevice     bool // assigns user to a role that requires an enrolled MFA device
 		wantStatus           int
 		assertBody           func(t *testing.T, gotBody string) bool // optional, matched against s.message if nil
 	}{
@@ -957,7 +961,16 @@ func TestAuthorize(t *testing.T) {
 			requireTrustedDevice: true,
 			wantStatus:           http.StatusForbidden,
 			assertBody: func(t *testing.T, gotBody string) bool {
-				const want = "app requires a trusted device"
+				const want = "trusted device is required to access this resource"
+				return assert.Contains(t, gotBody, want, "response body mismatch")
+			},
+		},
+		{
+			name:             "enrolled MFA device required",
+			requireMFADevice: true,
+			wantStatus:       http.StatusForbidden,
+			assertBody: func(t *testing.T, gotBody string) bool {
+				const want = "Multi-factor authentication (MFA) is required to access this resource"
 				return assert.Contains(t, gotBody, want, "response body mismatch")
 			},
 		},
@@ -972,11 +985,24 @@ func TestAuthorize(t *testing.T) {
 				RoleAppLabels: test.roleAppLabels,
 			})
 
-			if test.requireTrustedDevice {
+			// Helper to create and assign a role to the user, then refresh certificate.
+			assignRoleAndRefreshCert := func(roleName string, roleSpec types.RoleSpecV6) {
 				authServer := s.authServer.AuthServer
+				role, err := types.NewRole(roleName, roleSpec)
+				require.NoError(t, err, "NewRole")
+				role, err = authServer.CreateRole(ctx, role)
+				require.NoError(t, err, "CreateRole")
 
-				// Create a role that requires a trusted device.
-				requiredDevRole, err := types.NewRole("require-trusted-devices-app", types.RoleSpecV6{
+				user := s.user
+				user.AddRole(role.GetName())
+				user, err = authServer.Services.UpdateUser(ctx, user)
+				require.NoError(t, err, "UpdateUser")
+
+				s.clientCertificate = s.generateCertificate(t, user, s.appFoo.GetPublicAddr(), "" /* awsRoleARN */)
+			}
+
+			if test.requireTrustedDevice {
+				assignRoleAndRefreshCert("require-trusted-devices-app", types.RoleSpecV6{
 					Options: types.RoleOptions{
 						DeviceTrustMode: constants.DeviceTrustModeRequired,
 					},
@@ -984,18 +1010,17 @@ func TestAuthorize(t *testing.T) {
 						AppLabels: types.Labels{"*": []string{"*"}},
 					},
 				})
-				require.NoError(t, err, "NewRole")
-				requiredDevRole, err = authServer.CreateRole(ctx, requiredDevRole)
-				require.NoError(t, err, "CreateRole")
-
-				// Add role to test user.
-				user := s.user
-				user.AddRole(requiredDevRole.GetName())
-				user, err = authServer.Services.UpdateUser(ctx, user)
-				require.NoError(t, err, "UpdateUser")
+			}
 
-				// Refresh user certificate.
-				s.clientCertificate = s.generateCertificate(t, user, s.appFoo.GetPublicAddr(), "" /* awsRoleARN */)
+			if test.requireMFADevice {
+				assignRoleAndRefreshCert("require-mfa-app", types.RoleSpecV6{
+					Options: types.RoleOptions{
+						RequireMFAType: types.RequireMFAType_SESSION,
+					},
+					Allow: types.RoleConditions{
+						AppLabels: types.Labels{"*": []string{"*"}},
+					},
+				})
 			}
 
 			if test.cloudLabels != nil {
diff --git a/lib/srv/app/session.go b/lib/srv/app/session.go
index a9ab09c3c9e38..695ddbe194086 100644
--- a/lib/srv/app/session.go
+++ b/lib/srv/app/session.go
@@ -30,10 +30,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/recorder"
 	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
@@ -146,40 +144,11 @@ func (c *ConnectionsHandler) newSessionChunk(ctx context.Context, identity *tlsc
 // withJWTTokenForwarder is a sessionOpt that creates a forwarder that attaches
 // a generated JWT token to all requests.
 func (c *ConnectionsHandler) withJWTTokenForwarder(ctx context.Context, sess *sessionChunk, identity *tlsca.Identity, app types.Application) error {
-	rewrite := app.GetRewrite()
-	traits := identity.Traits
-	roles := identity.Groups
-	if rewrite != nil {
-		switch rewrite.JWTClaims {
-		case types.JWTClaimsRewriteNone:
-			traits = nil
-			roles = nil
-		case types.JWTClaimsRewriteRoles:
-			traits = nil
-		case types.JWTClaimsRewriteTraits:
-			roles = nil
-		case "", types.JWTClaimsRewriteRolesAndTraits:
-		}
-	}
-
-	// Request a JWT token that will be attached to all requests.
-	jwt, err := c.cfg.AuthClient.GenerateAppToken(ctx, types.GenerateAppTokenRequest{
-		Username: identity.Username,
-		Roles:    roles,
-		Traits:   traits,
-		URI:      app.GetURI(),
-		Expires:  identity.Expires,
-	})
+	jwt, traits, err := common.GenerateJWTAndTraits(ctx, identity, app, c.cfg.AuthClient)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	// Add JWT token to the traits so it can be used in headers templating.
-	if traits == nil {
-		traits = make(wrappers.Traits)
-	}
-	traits[constants.TraitJWT] = []string{jwt}
-
 	// Create a rewriting transport that will be used to forward requests.
 	transport, err := newTransport(c.closeContext,
 		&transportConfig{
@@ -189,6 +158,7 @@ func (c *ConnectionsHandler) withJWTTokenForwarder(ctx context.Context, sess *se
 			jwt:          jwt,
 			traits:       traits,
 			log:          c.log,
+			hostID:       c.cfg.HostID,
 		})
 	if err != nil {
 		return trace.Wrap(err)
@@ -343,7 +313,8 @@ func (c *ConnectionsHandler) createTracker(sess *sessionChunk, identity *tlsca.I
 		ClusterName: identity.RouteToApp.ClusterName,
 		Login:       identity.GetUserMetadata().Login,
 		Participants: []types.Participant{{
-			User: identity.Username,
+			User:    identity.Username,
+			Cluster: identity.OriginClusterName,
 		}},
 		HostUser:     identity.Username,
 		Created:      c.cfg.Clock.Now(),
diff --git a/lib/srv/app/session_test.go b/lib/srv/app/session_test.go
index c0352d4285852..1835b405a98ad 100644
--- a/lib/srv/app/session_test.go
+++ b/lib/srv/app/session_test.go
@@ -28,7 +28,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func newSessionChunk(timeout time.Duration) *sessionChunk {
@@ -37,7 +37,7 @@ func newSessionChunk(timeout time.Duration) *sessionChunk {
 		closeC:       make(chan struct{}),
 		inflightCond: sync.NewCond(&sync.Mutex{}),
 		closeTimeout: timeout,
-		log:          utils.NewSlogLoggerForTests(),
+		log:          logtest.NewLogger(),
 		streamCloser: events.NewDiscardRecorder(),
 	}
 }
diff --git a/lib/srv/app/transport.go b/lib/srv/app/transport.go
index 262ce70626825..0eeebcbf57aa1 100644
--- a/lib/srv/app/transport.go
+++ b/lib/srv/app/transport.go
@@ -51,6 +51,8 @@ type transportConfig struct {
 	jwt          string
 	traits       wrappers.Traits
 	log          *slog.Logger
+	// hostID is purely for troubleshooting purposes (put in the error messages)
+	hostID string
 }
 
 // Check validates configuration.
@@ -164,6 +166,10 @@ func (t *transport) RoundTrip(r *http.Request) (*http.Response, error) {
 				"raw_error", err, "human_error", strings.Join(strings.Fields(message), " "))
 		}
 
+		if t.hostID != "" {
+			message = message + "\n\nThe ID of the Teleport Application Service instance that generated this error is " + t.hostID + "."
+		}
+
 		code := trace.ErrorToCode(err)
 		return &http.Response{
 			StatusCode: code,
@@ -198,45 +204,14 @@ func (t *transport) rewriteRequest(r *http.Request) error {
 	r.URL.Scheme = t.uri.Scheme
 	r.URL.Host = t.uri.Host
 
+	// Add in JWT headers.
+	r.Header.Set(teleport.AppJWTHeader, t.jwt)
 	// Add headers from rewrite configuration.
-	rewriteHeaders(r, t.transportConfig)
-
+	rewriteHeaders := common.AppRewriteHeaders(r.Context(), t.app.GetRewrite(), t.log)
+	services.RewriteHeadersAndApplyValueTraits(r, rewriteHeaders, t.traits, t.log)
 	return nil
 }
 
-// rewriteHeaders applies headers rewrites from the application configuration.
-func rewriteHeaders(r *http.Request, c *transportConfig) {
-	// Add in JWT headers.
-	r.Header.Set(teleport.AppJWTHeader, c.jwt)
-
-	if c.app.GetRewrite() == nil || len(c.app.GetRewrite().Headers) == 0 {
-		return
-	}
-	for _, header := range c.app.GetRewrite().Headers {
-		if common.IsReservedHeader(header.Name) {
-			c.log.DebugContext(r.Context(), "Not rewriting Teleport reserved header", "header_name", header.Name)
-			continue
-		}
-		values, err := services.ApplyValueTraits(header.Value, c.traits)
-		if err != nil {
-			c.log.DebugContext(r.Context(), "Failed to apply traits",
-				"header_value", header.Value,
-				"error", err,
-			)
-			continue
-		}
-		r.Header.Del(header.Name)
-		for _, value := range values {
-			switch http.CanonicalHeaderKey(header.Name) {
-			case teleport.HostHeader:
-				r.Host = value
-			default:
-				r.Header.Add(header.Name, value)
-			}
-		}
-	}
-}
-
 // needsPathRedirect checks if the request should be redirected to a different path.
 // At the moment, the only time a redirect happens is if URI specified is not
 // "/" and the public address being requested is "/".
diff --git a/lib/srv/app/watcher.go b/lib/srv/app/watcher.go
index 1e7b50e4707f2..673d9570fd48a 100644
--- a/lib/srv/app/watcher.go
+++ b/lib/srv/app/watcher.go
@@ -26,6 +26,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/utils"
@@ -88,11 +89,20 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.GenericWat
 		for {
 			select {
 			case apps := <-watcher.ResourcesC:
-				appsWithAddr := make(types.Apps, 0, len(apps))
 				for _, app := range apps {
-					appsWithAddr = append(appsWithAddr, s.guessPublicAddr(app))
+					if app.GetPublicAddr() == "" {
+						pubAddr, err := FindPublicAddr(ctx, s.c.AccessPoint, app.GetPublicAddr(), app.GetName())
+						if err == nil {
+							app.SetPublicAddr(pubAddr)
+						} else {
+							s.log.ErrorContext(s.closeContext, "Unable to find public address for app, leaving empty",
+								"app_name", app.GetName(),
+								"error", err,
+							)
+						}
+					}
 				}
-				s.monitoredApps.setResources(appsWithAddr)
+				s.monitoredApps.setResources(apps)
 				select {
 				case s.reconcileCh <- struct{}{}:
 				case <-ctx.Done():
@@ -107,42 +117,34 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.GenericWat
 	return watcher, nil
 }
 
-// guessPublicAddr will guess PublicAddr for given application if it is missing, based on proxy information and app name.
-func (s *Server) guessPublicAddr(app types.Application) types.Application {
-	if app.GetPublicAddr() != "" {
-		return app
-	}
-	appCopy := app.Copy()
-	pubAddr, err := FindPublicAddr(s.c.AccessPoint, app.GetPublicAddr(), app.GetName())
-	if err == nil {
-		appCopy.Spec.PublicAddr = pubAddr
-	} else {
-		s.log.ErrorContext(s.closeContext, "Unable to find public address for app, leaving empty",
-			"app_name", app.GetName(),
-			"error", err,
-		)
-	}
-	return appCopy
-}
-
 // FindPublicAddrClient is a client used for finding public addresses.
 type FindPublicAddrClient interface {
 	// GetProxies returns a list of proxy servers registered in the cluster
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 
+	// ListProxyServers returns a paginated list of registered proxy servers.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 }
 
 // FindPublicAddr tries to resolve the public address of the proxy of this cluster.
-func FindPublicAddr(client FindPublicAddrClient, appPublicAddr string, appName string) (string, error) {
+func FindPublicAddr(ctx context.Context, client FindPublicAddrClient, appPublicAddr string, appName string) (string, error) {
 	// If the application has a public address already set, use it.
 	if appPublicAddr != "" {
 		return appPublicAddr, nil
 	}
 
 	// Fetch list of proxies, if first has public address set, use it.
-	servers, err := client.GetProxies()
+	servers, err := clientutils.CollectWithFallback(ctx, client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return client.GetProxies()
+	})
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
diff --git a/lib/srv/app/watcher_test.go b/lib/srv/app/watcher_test.go
index a319d1b25cb58..3cd19b8cf4bf0 100644
--- a/lib/srv/app/watcher_test.go
+++ b/lib/srv/app/watcher_test.go
@@ -19,13 +19,13 @@
 package app
 
 import (
-	"context"
+	"cmp"
 	"maps"
-	"sort"
+	"slices"
 	"testing"
 	"time"
 
-	"github.com/google/go-cmp/cmp"
+	gocmp "github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/stretchr/testify/require"
 
@@ -36,7 +36,7 @@ import (
 // TestWatcher verifies that app agent properly detects and applies
 // changes to application resources.
 func TestWatcher(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// Make a static configuration app.
 	app0, err := makeStaticApp("app0", nil)
@@ -60,11 +60,27 @@ func TestWatcher(t *testing.T) {
 		},
 	})
 
+	// Create a single Proxy with a PublicAddr to exercise that
+	// apps without a PublicAddr automatically get one specified
+	// by the watcher.
+	require.NoError(t, s.authServer.AuthServer.UpsertProxy(t.Context(), &types.ServerV2{
+		Kind:    types.KindProxy,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name: "FakeProxy",
+		},
+		Spec: types.ServerSpecV2{
+			PublicAddrs: []string{"test.example.com"},
+		},
+	}))
+
 	// Only app0 should be registered initially.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -77,11 +93,18 @@ func TestWatcher(t *testing.T) {
 	err = s.authServer.AuthServer.CreateApp(ctx, app1)
 	require.NoError(t, err)
 
+	// Set the PublicAddr _after_ creating the app. The watched apps will
+	// automatically have the address set if empty. In order for the comparisons
+	// below to pass this needs to be set on app1.
+	app1.SetPublicAddr("app1.test.example.com")
+
 	// It should be registered.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app1}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app1}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -97,8 +120,10 @@ func TestWatcher(t *testing.T) {
 	// It should not be registered, old app0 should remain.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app1}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app1}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -108,14 +133,21 @@ func TestWatcher(t *testing.T) {
 	// Create app with label group=b.
 	app2, err := makeDynamicApp("app2", map[string]string{"group": "b"})
 	require.NoError(t, err)
+
+	// Set the PublicAddr _before_ creating the app. The watcher should
+	// not modify apps with an already specified PublicAddr.
+	app2.SetPublicAddr("app2.some.other.addr.example.com")
+
 	err = s.authServer.AuthServer.CreateApp(ctx, app2)
 	require.NoError(t, err)
 
 	// It shouldn't be registered.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app1}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app1}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -130,8 +162,10 @@ func TestWatcher(t *testing.T) {
 	// Both should be registered now.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app1, app2}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app1, app2}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -146,8 +180,10 @@ func TestWatcher(t *testing.T) {
 	// app2 should get updated.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app1, app2}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app1, app2}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -162,8 +198,10 @@ func TestWatcher(t *testing.T) {
 	// Only app0 and app2 should remain registered.
 	select {
 	case a := <-reconcileCh:
-		sort.Sort(a)
-		require.Empty(t, cmp.Diff(types.Apps{app0, app2}, a,
+		slices.SortFunc(a, func(a, b types.Application) int {
+			return cmp.Compare(a.GetName(), b.GetName())
+		})
+		require.Empty(t, gocmp.Diff(types.Apps{app0, app2}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
@@ -177,7 +215,7 @@ func TestWatcher(t *testing.T) {
 	// Only static app should remain.
 	select {
 	case a := <-reconcileCh:
-		require.Empty(t, cmp.Diff(types.Apps{app0}, a,
+		require.Empty(t, gocmp.Diff(types.Apps{app0}, a,
 			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 		))
 	case <-time.After(time.Second):
diff --git a/lib/srv/authhandlers.go b/lib/srv/authhandlers.go
index d0788cef2d3c5..b3ae4372d3e1c 100644
--- a/lib/srv/authhandlers.go
+++ b/lib/srv/authhandlers.go
@@ -20,6 +20,7 @@ package srv
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net"
@@ -41,11 +42,12 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auditd"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/connectmycomputer"
 	"github.com/gravitational/teleport/lib/decision"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/observability/metrics"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -92,8 +94,7 @@ type AuthHandlerConfig struct {
 	// or an agentless server.
 	TargetServer types.Server
 
-	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
-	// configuration.
+	// FIPS mode means Teleport started in FedRAMP/FIPS mode.
 	FIPS bool
 
 	// Clock specifies the time provider. Will be used to override the time anchor
@@ -130,6 +131,7 @@ func (c *AuthHandlerConfig) CheckAndSetDefaults() error {
 // used by the regular and forwarding server.
 type AuthHandlers struct {
 	loginChecker
+	scopedLoginChecker
 	proxyingChecker
 	gitForwardingChecker
 
@@ -158,6 +160,7 @@ func NewAuthHandlers(config *AuthHandlerConfig) (*AuthHandlers, error) {
 	}
 
 	ah.loginChecker = lc
+	ah.scopedLoginChecker = lc
 	ah.proxyingChecker = lc
 	ah.gitForwardingChecker = lc
 
@@ -230,9 +233,24 @@ func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityCon
 	if err != nil {
 		return IdentityContext{}, trace.Wrap(err)
 	}
-	accessChecker, err := services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), h.c.AccessPoint)
-	if err != nil {
-		return IdentityContext{}, trace.Wrap(err)
+
+	var unstableAccessChecker services.AccessChecker
+	if accessInfo.ScopePin == nil {
+		// TODO(fspmarshall/scopes): rework session joining & cluster access checking logic to be compatible
+		// with scoped identities (or at least move the lack of support behind a better abstraction). for now, any codepath
+		// that would result in use of the unstable checker just returns empty joining policies.
+		unstableAccessChecker, err = services.NewAccessChecker(accessInfo, clusterName.GetClusterName(), h.c.AccessPoint)
+		if err != nil {
+			return IdentityContext{}, trace.Wrap(err)
+		}
+	}
+
+	unstableClusterAccessChecker := func(cluster types.RemoteCluster) error {
+		if unstableAccessChecker == nil {
+			return trace.AccessDenied("scoped identities do not support cross-cluster operations")
+		}
+
+		return unstableAccessChecker.CheckAccessToRemoteCluster(cluster)
 	}
 
 	return IdentityContext{
@@ -242,8 +260,8 @@ func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityCon
 		GitForwardingPermit:                 gitForwardingPermit,
 		Login:                               sconn.User(),
 		CertAuthority:                       certAuthority,
-		UnstableSessionJoiningAccessChecker: accessChecker,
-		UnstableClusterAccessChecker:        accessChecker.CheckAccessToRemoteCluster,
+		UnstableSessionJoiningAccessChecker: unstableAccessChecker,
+		UnstableClusterAccessChecker:        unstableClusterAccessChecker,
 		TeleportUser:                        unmappedIdentity.Username,
 		RouteToCluster:                      unmappedIdentity.RouteToCluster,
 		UnmappedRoles:                       unmappedIdentity.Roles,
@@ -254,7 +272,11 @@ func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityCon
 		Renewable:                           unmappedIdentity.Renewable,
 		BotName:                             unmappedIdentity.BotName,
 		BotInstanceID:                       unmappedIdentity.BotInstanceID,
+		JoinToken:                           unmappedIdentity.JoinToken,
 		PreviousIdentityExpires:             unmappedIdentity.PreviousIdentityExpires,
+		OriginClusterName:                   certAuthority.GetClusterName(),
+		MappedRoles:                         accessInfo.Roles,
+		Traits:                              accessInfo.Traits,
 	}, nil
 }
 
@@ -291,14 +313,6 @@ func (h *AuthHandlers) CheckX11Forward(ctx *ServerContext) error {
 	return trace.AccessDenied("x11 forwarding not permitted")
 }
 
-func (h *AuthHandlers) CheckFileCopying(ctx *ServerContext) error {
-	if ctx.Identity.AccessPermit != nil && ctx.Identity.AccessPermit.SshFileCopy {
-		return nil
-	}
-
-	return trace.Wrap(errRoleFileCopyingNotPermitted)
-}
-
 // CheckPortForward checks if port forwarding is allowed for the users RoleSet.
 func (h *AuthHandlers) CheckPortForward(addr string, ctx *ServerContext, requestedMode decisionpb.SSHPortForwardMode) error {
 	if ctx.Identity.AccessPermit == nil {
@@ -443,6 +457,14 @@ func (h *AuthHandlers) UserKeyAuth(conn ssh.ConnMetadata, key ssh.PublicKey) (pp
 			h.log.WarnContext(ctx, "Failed to append Trace to ConnectionDiagnostic", "error", err)
 		}
 
+		// If the target of the auth attempt is a Teleport SSH server, we want
+		// to return node info in the audit event.
+		var hostID, hostName string
+		if h.c.TargetServer != nil {
+			hostID = h.c.TargetServer.GetName()
+			hostName = h.c.TargetServer.GetHostname()
+		}
+
 		if err := h.c.Emitter.EmitAuditEvent(h.c.Server.Context(), &apievents.AuthAttempt{
 			Metadata: apievents.Metadata{
 				Type: events.AuthAttemptEvent,
@@ -457,6 +479,10 @@ func (h *AuthHandlers) UserKeyAuth(conn ssh.ConnMetadata, key ssh.PublicKey) (pp
 				LocalAddr:  conn.LocalAddr().String(),
 				RemoteAddr: conn.RemoteAddr().String(),
 			},
+			ServerMetadata: apievents.ServerMetadata{
+				ServerID:       hostID,
+				ServerHostname: hostName,
+			},
 			Status: apievents.Status{
 				Success: false,
 				Error:   err.Error(),
@@ -567,12 +593,18 @@ func (h *AuthHandlers) UserKeyAuth(conn ssh.ConnMetadata, key ssh.PublicKey) (pp
 		diagnosticTracing = true
 		if h.c.TargetServer != nil && h.c.TargetServer.IsOpenSSHNode() {
 			accessPermit, err = h.evaluateSSHAccess(ident, ca, clusterName.GetClusterName(), h.c.TargetServer, conn.User())
+			if errors.Is(err, services.ErrScopedIdentity) {
+				accessPermit, err = h.evaluateScopedSSHAccess(ident, ca, clusterName.GetClusterName(), h.c.TargetServer, conn.User())
+			}
 		} else {
 			proxyPermit, err = h.evaluateProxying(ident, ca, clusterName.GetClusterName())
 		}
 	case teleport.ComponentNode:
 		diagnosticTracing = true
 		accessPermit, err = h.evaluateSSHAccess(ident, ca, clusterName.GetClusterName(), h.c.Server.GetInfo(), conn.User())
+		if errors.Is(err, services.ErrScopedIdentity) {
+			accessPermit, err = h.evaluateScopedSSHAccess(ident, ca, clusterName.GetClusterName(), h.c.Server.GetInfo(), conn.User())
+		}
 	default:
 		return nil, trace.BadParameter("cannot determine appropriate authorization checks for unknown component %q (this is a bug)", h.c.Component)
 	}
@@ -693,7 +725,7 @@ func (h *AuthHandlers) hostKeyCallback(hostname string, remote net.Addr, key ssh
 	ctx := h.c.Server.Context()
 
 	// For SubKindOpenSSHEICENode we use SSH Keys (EC2 does not support Certificates in ec2.SendSSHPublicKey).
-	if h.c.Server.TargetMetadata().ServerSubKind == types.SubKindOpenSSHEICENode {
+	if h.c.Server.GetInfo().GetSubKind() == types.SubKindOpenSSHEICENode {
 		return nil
 	}
 
@@ -712,21 +744,21 @@ func (h *AuthHandlers) hostKeyCallback(hostname string, remote net.Addr, key ssh
 	return nil
 }
 
-// IsUserAuthority is called during checking the client key, to see if the
-// key used to sign the certificate was a Teleport CA.
-func (h *AuthHandlers) IsUserAuthority(cert ssh.PublicKey) bool {
-	if _, err := h.authorityForCert(types.UserCA, cert); err != nil {
+// IsUserAuthority is called during checking the issuer of a client certificate,
+// to see if it was a Teleport CA.
+func (h *AuthHandlers) IsUserAuthority(authority ssh.PublicKey) bool {
+	if _, err := h.authorityForCert(types.UserCA, authority); err != nil {
 		return false
 	}
 
 	return true
 }
 
-// IsHostAuthority is called when checking the host certificate a server
-// presents. It make sure that the key used to sign the host certificate was a
-// Teleport CA.
-func (h *AuthHandlers) IsHostAuthority(cert ssh.PublicKey, address string) bool {
-	if _, err := h.authorityForCert(types.HostCA, cert); err != nil {
+// IsHostAuthority is called when checking the issuer of a host certificate a
+// server presents. It make sure that the key used to sign the host certificate
+// was a Teleport CA.
+func (h *AuthHandlers) IsHostAuthority(authority ssh.PublicKey, address string) bool {
+	if _, err := h.authorityForCert(types.HostCA, authority); err != nil {
 		h.log.DebugContext(h.c.Server.Context(), "Unable to find SSH host CA", "error", err)
 		return false
 	}
@@ -754,6 +786,10 @@ type loginChecker interface {
 	evaluateSSHAccess(ident *sshca.Identity, ca types.CertAuthority, clusterName string, target types.Server, osUser string) (*decisionpb.SSHAccessPermit, error)
 }
 
+type scopedLoginChecker interface {
+	evaluateScopedSSHAccess(ident *sshca.Identity, ca types.CertAuthority, clusterName string, target types.Server, osUser string) (*decisionpb.SSHAccessPermit, error)
+}
+
 type proxyingChecker interface {
 	// evaluateProxying evaluates the capabilities/constraints related to a user's
 	// attempt to access proxy forwarding.
@@ -777,8 +813,10 @@ type proxyingPermit struct {
 	PrivateKeyPolicy      keys.PrivateKeyPolicy
 	LockTargets           []types.LockTarget
 	MaxConnections        int64
+	SSHFileCopy           bool
 	DisconnectExpiredCert time.Time
 	MappedRoles           []string
+	SessionRecordingMode  constants.SessionRecordingMode
 }
 
 func (a *ahLoginChecker) evaluateProxying(ident *sshca.Identity, ca types.CertAuthority, clusterName string) (*proxyingPermit, error) {
@@ -821,8 +859,10 @@ func (a *ahLoginChecker) evaluateProxying(ident *sshca.Identity, ca types.CertAu
 		PrivateKeyPolicy:      privateKeyPolicy,
 		LockTargets:           lockTargets,
 		MaxConnections:        accessChecker.MaxConnections(),
+		SSHFileCopy:           accessChecker.CanCopyFiles(),
 		DisconnectExpiredCert: getDisconnectExpiredCertFromSSHIdentity(accessChecker, authPref, ident),
 		MappedRoles:           accessInfo.Roles,
+		SessionRecordingMode:  accessChecker.SessionRecordingMode(constants.SessionRecordingServiceSSH),
 	}, nil
 }
 
@@ -877,6 +917,130 @@ func (a *ahLoginChecker) evaluateGitForwarding(ident *sshca.Identity, ca types.C
 	}, nil
 }
 
+func (a *ahLoginChecker) evaluateScopedSSHAccess(ident *sshca.Identity, ca types.CertAuthority, clusterName string, target types.Server, osUser string) (*decisionpb.SSHAccessPermit, error) {
+	// use the server's shutdown context.
+	ctx := a.c.Server.Context()
+
+	accessInfo, err := fetchAccessInfo(ident, ca, clusterName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// build an access checker context based on the provided scoped identity.
+	scopedCheckerContext, err := services.NewScopedAccessCheckerContext(ctx, accessInfo, clusterName, a.c.AccessPoint.ScopedRoleReader())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// even though this function isn't currently polymorphic over scoped vs unscoped identities,
+	// we use the split context here so that in the future it will be easy to refactor this function to
+	// accept unscoped identities as well.
+	checkerContext := services.NewScopedSplitAccessCheckerContext(scopedCheckerContext)
+
+	state, err := checkerContext.AccessStateFromSSHIdentity(ctx, ident, a.c.AccessPoint)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if osUser == teleport.SSHSessionJoinPrincipal {
+		// TODO(fspmarshall/scopes): scoped session joining
+		// NOTE: getting session joining fully working with scoped access will be tricky. session joining permissions
+		// are complex, have yet to be ported to the more easily refactored PDP-style evaluation pattern, and do not
+		// slot easily into the current scoped access-checking model since they bypass standard node access checks. the
+		// majority of this function is written such that it should work for scoped and unscoped identities, but must be
+		// kept separate from the unscoped version until we decide how to handle session joining.
+		return nil, trace.NotImplemented("session joining for scoped identities is not implemented")
+	}
+
+	serverV2, ok := target.(*types.ServerV2)
+	if !ok {
+		return nil, trace.BadParameter("expected target to be of type *types.ServerV2, got %T", target)
+	}
+
+	agentScope := scopes.Root
+	if serverV2.Scope != "" {
+		agentScope = serverV2.Scope
+	}
+
+	// perform the primary node access check and exfiltrate the checker if successful
+	// for use in calculating the remaining fields of the permit.
+	var checker *services.SplitAccessChecker
+	if err := checkerContext.Decision(ctx, agentScope, func(c *services.SplitAccessChecker) error {
+		if err := c.Common().CheckAccessToSSHServer(
+			target,
+			state,
+			osUser,
+		); err != nil {
+			return trace.Wrap(err)
+		}
+
+		checker = c
+		return nil
+	}); err != nil {
+		return nil, trace.AccessDenied("user %s@%s is not authorized to login as %v@%s: %v",
+			ident.Username, ca.GetClusterName(), osUser, clusterName, err)
+	}
+
+	// load net config (used during calculation of client idle timeout)
+	netConfig, err := a.c.AccessPoint.GetClusterNetworkingConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// load auth preference (used during calculation of locking mode)
+	authPref, err := a.c.AccessPoint.GetAuthPreference(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	privateKeyPolicy, err := checker.Common().PrivateKeyPolicy(authPref.GetPrivateKeyPolicy())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	lockTargets := services.SSHAccessLockTargets(clusterName, target.GetName(), osUser, accessInfo, ident)
+
+	hostSudoers, err := checker.Common().HostSudoers(target)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var bpfEvents []string
+	for event := range checker.Common().EnhancedRecordingSet() {
+		bpfEvents = append(bpfEvents, event)
+	}
+
+	hostUsersInfo, err := checker.Common().HostUsers(target)
+	if err != nil {
+		if !trace.IsAccessDenied(err) {
+			return nil, trace.Wrap(err)
+		}
+		// the way host user creation permissions currently work, an "access denied" just indicates
+		// that host user creation is disabled, and does not indicate that access should be disallowed.
+		// for the purposes of the decision service, we represent this disabled state as nil.
+		hostUsersInfo = nil
+	}
+
+	return &decisionpb.SSHAccessPermit{
+		ForwardAgent:          checker.Common().CheckAgentForward(osUser) == nil,
+		X11Forwarding:         checker.Common().PermitX11Forwarding(),
+		MaxConnections:        checker.Common().MaxConnections(),
+		MaxSessions:           checker.Common().MaxSessions(),
+		SshFileCopy:           checker.Common().CanCopyFiles(),
+		PortForwardMode:       checker.Common().SSHPortForwardMode(),
+		ClientIdleTimeout:     durationpb.New(checker.Common().AdjustClientIdleTimeout(netConfig.GetClientIdleTimeout())),
+		DisconnectExpiredCert: timestampFromGoTime(getDisconnectExpiredCertFromSSHIdentityScoped(checker, authPref, ident)),
+		SessionRecordingMode:  string(checker.Common().SessionRecordingMode(constants.SessionRecordingServiceSSH)),
+		LockingMode:           string(checker.Common().LockingMode(authPref.GetLockingMode())),
+		PrivateKeyPolicy:      string(privateKeyPolicy),
+		LockTargets:           decision.LockTargetsToProto(lockTargets),
+		MappedRoles:           accessInfo.Roles,
+		HostSudoers:           hostSudoers,
+		BpfEvents:             bpfEvents,
+		HostUsersInfo:         hostUsersInfo,
+	}, nil
+}
+
 // evaluateSSHAccess checks the given certificate (supplied by a connected
 // client) to see if this certificate can be allowed to login as user:login
 // pair to requested server and if RBAC rules allow login.
@@ -904,7 +1068,7 @@ func (a *ahLoginChecker) evaluateSSHAccess(ident *sshca.Identity, ca types.CertA
 	var isModeratedSessionJoin bool
 	// custom moderated session join permissions allow bypass of the standard node access checks
 	if osUser == teleport.SSHSessionJoinPrincipal &&
-		auth.RoleSupportsModeratedSessions(accessChecker.Roles()) {
+		moderation.RoleSupportsModeratedSessions(accessChecker.Roles()) {
 
 		// bypass of standard node access checks can only proceed if MFA is not required and/or
 		// the MFA ceremony was already completed.
@@ -999,9 +1163,9 @@ func fetchAccessInfo(ident *sshca.Identity, ca types.CertAuthority, clusterName
 	return accessInfo, trace.Wrap(err)
 }
 
-// authorityForCert checks if the certificate was signed by a Teleport
-// Certificate Authority and returns it.
-func (h *AuthHandlers) authorityForCert(caType types.CertAuthType, key ssh.PublicKey) (types.CertAuthority, error) {
+// authorityForCert searches for the Teleport Certificate Authority that
+// contains the issuer of a certificate and returns it.
+func (h *AuthHandlers) authorityForCert(caType types.CertAuthType, authority ssh.PublicKey) (types.CertAuthority, error) {
 	// get all certificate authorities for given type
 	cas, err := h.c.AccessPoint.GetCertAuthorities(h.c.Server.Context(), caType, false)
 	if err != nil {
@@ -1018,21 +1182,9 @@ func (h *AuthHandlers) authorityForCert(caType types.CertAuthType, key ssh.Publi
 			return nil, trace.Wrap(err)
 		}
 		for _, checker := range checkers {
-			// if we have a certificate, compare the certificate signing key against
-			// the ca key. otherwise check the public key that was passed in. this is
-			// due to the differences in how this function is called by the user and
-			// host checkers.
-			switch v := key.(type) {
-			case *ssh.Certificate:
-				if apisshutils.KeysEqual(v.SignatureKey, checker) {
-					ca = cas[i]
-					break
-				}
-			default:
-				if apisshutils.KeysEqual(key, checker) {
-					ca = cas[i]
-					break
-				}
+			if apisshutils.KeysEqual(authority, checker) {
+				ca = cas[i]
+				break
 			}
 		}
 	}
@@ -1050,6 +1202,10 @@ func getDisconnectExpiredCertFromSSHIdentity(
 	authPref types.AuthPreference,
 	identity *sshca.Identity,
 ) time.Time {
+	return getDisconnectExpiredCertFromSSHIdentityScoped(services.NewUnscopedSplitAccessChecker(checker), authPref, identity)
+}
+
+func getDisconnectExpiredCertFromSSHIdentityScoped(checker *services.SplitAccessChecker, authPref types.AuthPreference, identity *sshca.Identity) time.Time {
 	// In the case where both disconnect_expired_cert and require_session_mfa are enabled,
 	// the PreviousIdentityExpires value of the certificate will be used, which is the
 	// expiry of the certificate used to issue the short lived MFA verified certificate.
@@ -1057,7 +1213,7 @@ func getDisconnectExpiredCertFromSSHIdentity(
 	// See https://github.com/gravitational/teleport/issues/18544
 
 	// If the session doesn't need to be disconnected on cert expiry just return the default value.
-	if !checker.AdjustDisconnectExpiredCert(authPref.GetDisconnectExpiredCert()) {
+	if !checker.Common().AdjustDisconnectExpiredCert(authPref.GetDisconnectExpiredCert()) {
 		return time.Time{}
 	}
 
diff --git a/lib/srv/authhandlers_test.go b/lib/srv/authhandlers_test.go
index d463612a236e0..2d909e9173a74 100644
--- a/lib/srv/authhandlers_test.go
+++ b/lib/srv/authhandlers_test.go
@@ -20,6 +20,8 @@ package srv
 
 import (
 	"context"
+	"crypto/ed25519"
+	"crypto/rand"
 	"net"
 	"testing"
 
@@ -30,12 +32,19 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/sshca"
 )
 
@@ -59,6 +68,36 @@ func (m mockCAandAuthPrefGetter) GetCertAuthorities(_ context.Context, caType ty
 	return cas, nil
 }
 
+type mockScopedRoleReaderGetter struct {
+	AccessPoint
+	scopedRoles []*scopedaccessv1.ScopedRole
+}
+
+func (m mockScopedRoleReaderGetter) ScopedRoleReader() services.ScopedRoleReader {
+	return mockScopedRoleGetter{
+		scopedRoles: m.scopedRoles,
+	}
+}
+
+// mockScopedRoleGetter is a mock implementation of ScopedRoleGetter for testing. It implements the entire
+// [services.ScopedRoleReader] interface, but calls to other methods will panic. user key auth should only ever
+// invoke GetScopedRole.
+type mockScopedRoleGetter struct {
+	services.ScopedRoleReader
+	scopedRoles []*scopedaccessv1.ScopedRole
+}
+
+func (m mockScopedRoleGetter) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
+	for _, role := range m.scopedRoles {
+		if role.Metadata.Name == req.Name {
+			return &scopedaccessv1.GetScopedRoleResponse{
+				Role: role,
+			}, nil
+		}
+	}
+	return nil, trace.NotFound("scoped role %q not found", req.Name)
+}
+
 type mockLoginChecker struct {
 	rbacChecked bool
 }
@@ -254,7 +293,7 @@ func TestRBAC(t *testing.T) {
 			cert, err := sshutils.ParseCertificate(c)
 			require.NoError(t, err)
 
-			// preform public key authentication
+			// perform public key authentication
 			_, err = ah.UserKeyAuth(&mockConnMetadata{}, cert)
 			require.NoError(t, err)
 
@@ -264,6 +303,322 @@ func TestRBAC(t *testing.T) {
 	}
 }
 
+// TestScopedRBAC verifies that scoped RBAC checks are performed correctly.
+func TestScopedRBAC(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	node, err := types.NewNode("testnode", types.SubKindTeleportNode, types.ServerSpecV2{
+		Addr:     "1.2.3.4:22",
+		Hostname: "testnode",
+	}, map[string]string{
+		"team": "red",
+	})
+	require.NoError(t, err)
+
+	serverV2 := node.(*types.ServerV2)
+	serverV2.Scope = "/staging/west"
+
+	// create User CA
+	userCAPriv, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	userCA, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+		Type:        types.UserCA,
+		ClusterName: "localhost",
+		ActiveKeys: types.CAKeySet{
+			SSH: []*types.SSHKeyPair{
+				{
+					PublicKey:      userCAPriv.MarshalSSHPublicKey(),
+					PrivateKey:     userCAPriv.PrivateKeyPEM(),
+					PrivateKeyType: types.PrivateKeyType_RAW,
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// create mock SSH server and add a cluster name
+	server := newMockServer(t)
+
+	// set the mock SSH server's view of itself when performing RBAC
+	// checks in `ComponentNode` mode.
+	server.setInfo(node)
+
+	clusterName, err := types.NewClusterName(types.ClusterNameSpecV2{
+		ClusterName: "localhost",
+		ClusterID:   "cluster_id",
+	})
+	require.NoError(t, err)
+	err = server.auth.SetClusterName(clusterName)
+	require.NoError(t, err)
+
+	_, err = server.auth.CreateClusterNetworkingConfig(ctx, types.DefaultClusterNetworkingConfig())
+	require.NoError(t, err)
+
+	scopedRoles := []*scopedaccessv1.ScopedRole{
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-west-red",
+			},
+			Scope: "/staging/west",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/west"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"testuser"},
+					NodeLabels: []*labelv1.Label{
+						{
+							Name:   "team",
+							Values: []string{"red"},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-west-blue",
+			},
+			Scope: "/staging/west",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/west"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"testuser"},
+					NodeLabels: []*labelv1.Label{
+						{
+							Name:   "team",
+							Values: []string{"blue"},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-east-red",
+			},
+			Scope: "/staging/east",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/east"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"testuser"},
+					NodeLabels: []*labelv1.Label{
+						{
+							Name:   "team",
+							Values: []string{"red"},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "prod-west-red",
+			},
+			Scope: "/prod/west",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/prod/west"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"testuser"},
+					NodeLabels: []*labelv1.Label{
+						{
+							Name:   "team",
+							Values: []string{"red"},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-west-no-labels",
+			},
+			Scope: "/staging/west",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/west"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"testuser"},
+				},
+			},
+			Version: types.V1,
+		},
+		{
+			Kind: scopedaccess.KindScopedRole,
+			Metadata: &headerv1.Metadata{
+				Name: "staging-west-wrong-login",
+			},
+			Scope: "/staging/west",
+			Spec: &scopedaccessv1.ScopedRoleSpec{
+				AssignableScopes: []string{"/staging/west"},
+				Allow: &scopedaccessv1.ScopedRoleConditions{
+					Logins: []string{"wronguser"},
+					NodeLabels: []*labelv1.Label{
+						{
+							Name:   "team",
+							Values: []string{"red"},
+						},
+					},
+				},
+			},
+			Version: types.V1,
+		},
+	}
+
+	accessPoint := mockScopedRoleReaderGetter{
+		AccessPoint: mockCAandAuthPrefGetter{
+			AccessPoint: server.auth,
+			authPref:    types.DefaultAuthPreference(),
+			cas: map[types.CertAuthType][]types.CertAuthority{
+				types.UserCA: {userCA},
+			},
+		},
+		scopedRoles: scopedRoles,
+	}
+
+	tts := []struct {
+		name    string
+		pin     *scopesv1.Pin
+		allowed bool
+	}{
+		{
+			name: "basic allow",
+			pin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/west": {
+						Roles: []string{"staging-west-red"},
+					},
+				},
+			},
+			allowed: true,
+		},
+		{
+			name: "too narrow scope",
+			pin: &scopesv1.Pin{
+				Scope: "/staging/west/narrow",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/west": {
+						Roles: []string{"staging-west-red"},
+					},
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "label mismatch",
+			pin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/west": {
+						Roles: []string{"staging-west-blue"},
+					},
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "scope permission mismatch",
+			pin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/east": {
+						Roles: []string{"staging-east-red"},
+					},
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "orthogonal scope",
+			pin: &scopesv1.Pin{
+				Scope: "/prod",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/prod/west": {
+						Roles: []string{"prod-west-red"},
+					},
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "no labels",
+			pin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/west": {
+						Roles: []string{"staging-west-no-labels"},
+					},
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "wrong login",
+			pin: &scopesv1.Pin{
+				Scope: "/staging",
+				Assignments: map[string]*scopesv1.PinnedAssignments{
+					"/staging/west": {
+						Roles: []string{"staging-west-wrong-login"},
+					},
+				},
+			},
+			allowed: false,
+		},
+	}
+
+	for _, tt := range tts {
+		t.Run(tt.name, func(t *testing.T) {
+			config := &AuthHandlerConfig{
+				Server:       server,
+				Component:    teleport.ComponentNode,
+				Emitter:      &eventstest.MockRecorderEmitter{},
+				AccessPoint:  accessPoint,
+				TargetServer: node,
+			}
+			ah, err := NewAuthHandlers(config)
+			require.NoError(t, err)
+
+			// create SSH certificate
+			caSigner, err := ssh.NewSignerFromKey(userCAPriv)
+			require.NoError(t, err)
+			keygen := testauthority.New()
+			privateKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+			require.NoError(t, err)
+
+			c, err := keygen.GenerateUserCert(sshca.UserCertificateRequest{
+				CASigner:      caSigner,
+				PublicUserKey: ssh.MarshalAuthorizedKey(privateKey.SSHPublicKey()),
+				Identity: sshca.Identity{
+					Username:   "testuser",
+					Principals: []string{"testuser"},
+					ScopePin:   tt.pin,
+				},
+			})
+			require.NoError(t, err)
+
+			cert, err := sshutils.ParseCertificate(c)
+			require.NoError(t, err)
+
+			// preform public key authentication
+			_, err = ah.UserKeyAuth(&mockConnMetadata{}, cert)
+			if tt.allowed {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				require.True(t, trace.IsAccessDenied(err))
+			}
+		})
+	}
+}
+
 // TestForwardingGitLocalOnly verifies that remote identities are categorically rejected
 // by UserKeyAuth when the auth handler is running as a ForwardingGit component.
 func TestForwardingGitLocalOnly(t *testing.T) {
@@ -574,3 +929,151 @@ func TestRBACJoinMFA(t *testing.T) {
 		})
 	}
 }
+
+func TestAuthorityForCert(t *testing.T) {
+	rawCA1, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca1, err := ssh.NewPublicKey(rawCA1)
+	require.NoError(t, err)
+
+	rawCA2, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca2, err := ssh.NewPublicKey(rawCA2)
+	require.NoError(t, err)
+
+	rawCA3, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	ca3, err := ssh.NewPublicKey(rawCA3)
+	require.NoError(t, err)
+
+	ah := &AuthHandlers{c: &AuthHandlerConfig{
+		Server: (*mockServer)(nil),
+		AccessPoint: mockCAandAuthPrefGetter{
+			cas: map[types.CertAuthType][]types.CertAuthority{
+				types.UserCA: {&types.CertAuthorityV2{
+					Spec: types.CertAuthoritySpecV2{
+						ActiveKeys: types.CAKeySet{
+							SSH: []*types.SSHKeyPair{
+								{PublicKey: ssh.MarshalAuthorizedKey(ca1)},
+								{PublicKey: ssh.MarshalAuthorizedKey(ca2)},
+							},
+						},
+					},
+				}},
+			},
+		},
+	}}
+
+	cert1 := &ssh.Certificate{
+		Key:          ca1,
+		SignatureKey: ca1,
+	}
+
+	_, err = ah.authorityForCert(types.UserCA, ca1)
+	require.NoError(t, err)
+	_, err = ah.authorityForCert(types.UserCA, ca2)
+	require.NoError(t, err)
+	_, err = ah.authorityForCert(types.UserCA, ca3)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
+
+	_, err = ah.authorityForCert(types.UserCA, cert1)
+	require.ErrorAs(t, err, new(*trace.AccessDeniedError), "a certificate signed by a certificate should not pass validation")
+}
+
+// TestAuthAttemptAuditEvent tests that AuthAttempt audit event returns host id
+// and hostname of target node.
+func TestAuthAttemptAuditEvent(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	// create dummy node
+	node, err := types.NewServer("testie_node", types.KindNode, types.ServerSpecV2{
+		Addr:     "1.2.3.4:22",
+		Hostname: "testie",
+		Version:  types.V2,
+	})
+	require.NoError(t, err)
+
+	// create User CA
+	userCAPriv, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+	userCA, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+		Type:        types.UserCA,
+		ClusterName: "localhost",
+		ActiveKeys: types.CAKeySet{
+			SSH: []*types.SSHKeyPair{
+				{
+					PublicKey:      userCAPriv.MarshalSSHPublicKey(),
+					PrivateKey:     userCAPriv.PrivateKeyPEM(),
+					PrivateKeyType: types.PrivateKeyType_RAW,
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// create mock SSH server and add a cluster name
+	server := newMockServer(t)
+	clusterName, err := types.NewClusterName(types.ClusterNameSpecV2{
+		ClusterName: "localhost",
+		ClusterID:   "cluster_id",
+	})
+	require.NoError(t, err)
+	err = server.auth.SetClusterName(clusterName)
+	require.NoError(t, err)
+
+	_, err = server.auth.CreateClusterNetworkingConfig(ctx, types.DefaultClusterNetworkingConfig())
+	require.NoError(t, err)
+
+	accessPoint := mockCAandAuthPrefGetter{
+		AccessPoint: server.auth,
+		authPref:    types.DefaultAuthPreference(),
+		cas: map[types.CertAuthType][]types.CertAuthority{
+			types.UserCA: {userCA},
+		},
+	}
+
+	// create mock emitter
+	emitter := &eventstest.MockRecorderEmitter{}
+
+	// create auth handler
+	config := &AuthHandlerConfig{
+		Server:       server,
+		Component:    teleport.ComponentNode,
+		Emitter:      emitter,
+		AccessPoint:  accessPoint,
+		TargetServer: node,
+	}
+	ah, err := NewAuthHandlers(config)
+	require.NoError(t, err)
+
+	// create SSH certificate
+	caSigner, err := ssh.NewSignerFromKey(userCAPriv)
+	require.NoError(t, err)
+	keygen := testauthority.New()
+	privateKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+
+	c, err := keygen.GenerateUserCert(sshca.UserCertificateRequest{
+		CASigner:      caSigner,
+		PublicUserKey: ssh.MarshalAuthorizedKey(privateKey.SSHPublicKey()),
+		Identity: sshca.Identity{
+			Username:   "testuser",
+			Principals: []string{"testuser"},
+		},
+	})
+	require.NoError(t, err)
+
+	cert, err := sshutils.ParseCertificate(c)
+	require.NoError(t, err)
+
+	// perform public key authentication, should fail because no login checker set
+	_, err = ah.UserKeyAuth(&mockConnMetadata{}, cert)
+	require.Error(t, err)
+
+	// audit event (AuthAttempt) should include node's host id and hostname
+	authEvent := emitter.LastEvent().(*apievents.AuthAttempt)
+	require.Equal(t, node.GetName(), authEvent.ServerID)
+	require.Equal(t, node.GetHostname(), authEvent.ServerHostname)
+}
diff --git a/lib/srv/ctx.go b/lib/srv/ctx.go
index 5f8a100e77138..147836788317d 100644
--- a/lib/srv/ctx.go
+++ b/lib/srv/ctx.go
@@ -20,11 +20,14 @@ package srv
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -42,17 +45,18 @@ import (
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/decision"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	rsession "github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/srv/uacc"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/envutils"
@@ -94,6 +98,9 @@ type AccessPoint interface {
 	// Semaphores provides semaphore operations
 	types.Semaphores
 
+	// ScopedRoleReader returns a read-only scoped role client.
+	ScopedRoleReader() services.ScopedRoleReader
+
 	// GetClusterName returns cluster name
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 
@@ -149,12 +156,13 @@ type Server interface {
 	GetDataDir() string
 
 	// GetPAM returns PAM configuration for this server.
-	GetPAM() (*servicecfg.PAMConfig, error)
+	GetPAM() *servicecfg.PAMConfig
 
 	// GetClock returns a clock setup for the server
 	GetClock() clockwork.Clock
 
 	// GetInfo returns a services.Server that represents this server.
+	// In the case of the Proxy forwarder, this is the node target.
 	GetInfo() types.Server
 
 	// UseTunnel used to determine if this node has connected to this cluster
@@ -168,7 +176,7 @@ type Server interface {
 	Context() context.Context
 
 	// GetUserAccountingPaths returns the path of the user accounting database and log. Returns empty for system defaults.
-	GetUserAccountingPaths() (utmp, wtmp, btmp string)
+	GetUserAccountingPaths() (utmp, wtmp, btmp, wtmpdb string)
 
 	// GetLockWatcher gets the server's lock watcher.
 	GetLockWatcher() *services.LockWatcher
@@ -189,8 +197,20 @@ type Server interface {
 	// support or not.
 	GetSELinuxEnabled() bool
 
-	// TargetMetadata returns metadata about the session target node.
-	TargetMetadata() apievents.ServerMetadata
+	// EventMetadata returns [events.ServerMetadata] for this server.
+	EventMetadata() apievents.ServerMetadata
+
+	// ChildLogConfig returns the log configuration for handling logs from
+	// child processes.
+	ChildLogConfig() ChildLogConfig
+}
+
+// ChildLogConfig is the log configuration for handling logs from child processes.
+type ChildLogConfig struct {
+	ExecLogConfig
+
+	// Writer is the output writer to use for the logger. May be nil.
+	Writer io.Writer
 }
 
 // IdentityContext holds all identity information associated with the user
@@ -217,6 +237,9 @@ type IdentityContext struct {
 	// TeleportUser is the Teleport user associated with the connection.
 	TeleportUser string
 
+	// ClusterName is the name of the cluster the user authenticated with.
+	OriginClusterName string
+
 	// Impersonator is a user acting on behalf of other user
 	Impersonator string
 
@@ -238,6 +261,13 @@ type IdentityContext struct {
 	// trusted-cluster-related role mapping being applied.
 	UnmappedRoles []string
 
+	// MappedRoles lists the final roles of this Teleport user after
+	// trusted-cluster-related role mapping has been applied.
+	MappedRoles []string
+
+	// Traits are the identity traits derived from the certificate.
+	Traits wrappers.Traits
+
 	// CertValidBefore is set to the expiry time of a certificate, or
 	// empty, if cert does not expire
 	CertValidBefore time.Time
@@ -263,6 +293,11 @@ type IdentityContext struct {
 	// this identity is associated with, if any.
 	BotInstanceID string
 
+	// JoinToken is the name of the join token used to join this bot identity,
+	// if any, and will not be set for bot instances that joined using the
+	// `token` join method.
+	JoinToken string
+
 	// PreviousIdentityExpires is the expiry time of the identity/cert that this
 	// identity/cert was derived from. It is used to determine a session's hard
 	// deadline in cases where both require_session_mfa and disconnect_expired_cert
@@ -298,9 +333,14 @@ type ServerContext struct {
 	// term holds PTY if it was requested by the session.
 	term Terminal
 
-	// sessionID holds the session ID that will be used when a new
-	// session is created.
-	sessionID rsession.ID
+	// sessionParams are parameters associated with this server session.
+	sessionParams *tracessh.SessionParams
+
+	// newSessionID is set if this server context is going to create a new session.
+	// This field must be set through [ServerContext.SetNewSessionID] for non-join
+	// sessions as soon as a session channel is accepted in order to inform
+	// the client of the to-be session ID.
+	newSessionID rsession.ID
 
 	// session holds the active session (if there's an active one).
 	session *session
@@ -375,6 +415,9 @@ type ServerContext struct {
 	cmdr *os.File
 	cmdw *os.File
 
+	// logw is used to send logs from the child process to the parent process.
+	logw *os.File
+
 	// cont{r,w} is used to send the continue signal from the parent process
 	// to the child process.
 	contr *os.File
@@ -424,7 +467,7 @@ type ServerContext struct {
 // the ServerContext is closed.  The ctx parameter should be a child of the ctx
 // associated with the scope of the parent ConnectionContext to ensure that
 // cancellation of the ConnectionContext propagates to the ServerContext.
-func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, srv Server, identityContext IdentityContext, monitorOpts ...func(*MonitorConfig)) (*ServerContext, error) {
+func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, srv Server, identityContext IdentityContext, sessionParams *tracessh.SessionParams, monitorOpts ...func(*MonitorConfig)) (*ServerContext, error) {
 	recConfig, err := srv.GetAccessPoint().GetSessionRecordingConfig(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -464,6 +507,7 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		id:                     int(atomic.AddInt32(&ctxID, int32(1))),
 		env:                    make(map[string]string),
 		srv:                    srv,
+		sessionParams:          sessionParams,
 		ExecResultCh:           make(chan ExecResult, 10),
 		SubsystemResultCh:      make(chan SubsystemResult, 10),
 		ClusterName:            parent.ServerConn.Permissions.Extensions[utils.CertTeleportClusterName],
@@ -472,7 +516,7 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		clientIdleTimeout:      clientIdleTimeout,
 		cancelContext:          cancelContext,
 		cancel:                 cancel,
-		ServerSubKind:          srv.TargetMetadata().ServerSubKind,
+		ServerSubKind:          srv.GetInfo().GetSubKind(),
 	}
 
 	child.Logger = slog.With(
@@ -509,6 +553,7 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		Conn:                  child.ServerConn,
 		Context:               cancelContext,
 		TeleportUser:          child.Identity.TeleportUser,
+		UserOriginClusterName: child.Identity.OriginClusterName,
 		Login:                 child.Identity.Login,
 		ServerID:              child.srv.ID(),
 		Logger:                child.Logger,
@@ -559,6 +604,34 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 	child.AddCloser(child.killShellr)
 	child.AddCloser(child.killShellw)
 
+	// If the log writer is a file, we can pass it directly to the child
+	// process to write to. Otherwise, we need to create a pipe to the child
+	// process and stream the logs to the log writer.
+	logCfg := child.srv.ChildLogConfig()
+	if fileWriter, ok := logCfg.Writer.(*os.File); ok {
+		child.logw = fileWriter
+	} else {
+		// Create a pipe so we can pass the writing side as an *os.File to the child process.
+		// Then we can copy from the reading side to the log writer (e.g. syslog, log file w/ concurrency protection).
+		r, w, err := os.Pipe()
+		if err != nil {
+			childErr := child.Close()
+			return nil, trace.NewAggregate(err, childErr)
+		}
+
+		child.logw = w
+		child.AddCloser(r)
+		child.AddCloser(w)
+
+		// Copy logs from the child process to the parent process over
+		// the pipe until it is closed by the child context.
+		go func() {
+			if _, err := io.Copy(logCfg.Writer, r); err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, os.ErrClosed) {
+				slog.ErrorContext(child.CancelContext(), "Failed to copy logs over pipe", "error", err)
+			}
+		}()
+	}
+
 	return child, nil
 }
 
@@ -575,13 +648,17 @@ func (c *ServerContext) ID() int {
 }
 
 // SessionID returns the ID of the session in the context.
-func (c *ServerContext) SessionID() rsession.ID {
+//
+// This value is not set until during and after the "shell" / "exec" channel request.
+func (c *ServerContext) SessionID() string {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
-	if c.session == nil {
-		return c.sessionID
+
+	if c.session != nil {
+		return string(c.session.id)
 	}
-	return c.session.id
+
+	return ""
 }
 
 // GetServer returns the underlying server which this context was created in.
@@ -589,46 +666,6 @@ func (c *ServerContext) GetServer() Server {
 	return c.srv
 }
 
-// CreateOrJoinSession will look in the SessionRegistry for the session ID. If
-// no session is found, a new one is created. If one is found, it is returned.
-func (c *ServerContext) CreateOrJoinSession(ctx context.Context, reg *SessionRegistry) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	// As SSH conversation progresses, at some point a session will be created and
-	// its ID will be added to the environment
-	ssid, found := c.getEnvLocked(sshutils.SessionEnvVar)
-	if !found {
-		c.sessionID = rsession.NewID()
-		c.Logger.DebugContext(ctx, "Will create new session for SSH connection")
-		return nil
-	}
-
-	// make sure whatever session is requested is a valid session
-	id, err := rsession.ParseID(ssid)
-	if err != nil {
-		return trace.BadParameter("invalid session ID")
-	}
-
-	// update ctx with the session if it exists
-	if sess, found := reg.findSession(*id); found {
-		c.sessionID = *id
-		c.session = sess
-		c.Logger.DebugContext(ctx, "Joining active SSH session", "session_id", c.session.id)
-	} else {
-		// TODO(capnspacehook): DELETE IN 17.0.0 - by then all supported
-		// clients should only set TELEPORT_SESSION when they want to
-		// join a session. Always return an error instead of using a
-		// new ID.
-		//
-		// to prevent the user from controlling the session ID, generate
-		// a new one
-		c.sessionID = rsession.NewID()
-		c.Logger.DebugContext(ctx, "Creating new SSH session")
-	}
-
-	return nil
-}
-
 // TrackActivity keeps track of all activity on ssh.Channel. The caller should
 // use the returned ssh.Channel instead of the original one.
 func (c *ServerContext) TrackActivity(ch ssh.Channel) ssh.Channel {
@@ -678,39 +715,64 @@ func (c *ServerContext) SetEnv(key, val string) {
 	c.mu.Unlock()
 }
 
-// GetEnv returns a environment variable within this context.
-func (c *ServerContext) GetEnv(key string) (string, bool) {
+// GetSessionParams gets session params for the current session.
+func (c *ServerContext) GetSessionParams() tracessh.SessionParams {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
-	return c.getEnvLocked(key)
-}
 
-func (c *ServerContext) getEnvLocked(key string) (string, bool) {
-	val, ok := c.env[key]
-	if ok {
-		return val, true
+	// Teleport ssh clients should provide session params upfront in the session channel request.
+	if c.sessionParams != nil {
+		return *c.sessionParams
+	}
+
+	// If this is an old client, it will provide session params from
+	// env variables sometime between the session channel request and shell request.
+	// TODO(Joerger): DELETE IN v20.0.0 - just return empty params for an old Teleport client / openSSH client session.
+	sessionParams := tracessh.SessionParams{
+		WebProxyAddr:                   c.env[teleport.SSHSessionWebProxyAddr],
+		Reason:                         c.env[teleport.EnvSSHSessionReason],
+		DisplayParticipantRequirements: utils.AsBool(c.env[teleport.EnvSSHSessionDisplayParticipantRequirements]),
+		JoinSessionID:                  c.env[sshutils.SessionEnvVar],
+		JoinMode:                       types.SessionParticipantMode(c.env[teleport.EnvSSHJoinMode]),
+		ModeratedSessionID:             c.env[sftp.EnvModeratedSessionID],
 	}
-	return c.Parent().GetEnv(key)
+
+	if invitedUsers := c.env[teleport.EnvSSHSessionInvited]; invitedUsers != "" {
+		if err := json.Unmarshal([]byte(invitedUsers), &sessionParams.Invited); err != nil {
+			slog.WarnContext(context.Background(), "Failed to parse invited users", "error", err)
+		}
+	}
+
+	return sessionParams
+}
+
+// SetNewSessionID sets the ID for a new session in this server context.
+func (c *ServerContext) SetNewSessionID(ctx context.Context, sid rsession.ID) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.newSessionID = sid
+}
+
+// GetNewSessionID gets the ID for a new session in this server context.
+func (c *ServerContext) GetNewSessionID() rsession.ID {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.newSessionID
 }
 
 // setSession sets the context's session
-func (c *ServerContext) setSession(ctx context.Context, sess *session, ch ssh.Channel) {
+func (c *ServerContext) setSession(ctx context.Context, sess *session) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.session = sess
-
-	// inform the client of the session ID that is being used in a new
-	// goroutine to reduce latency
-	go func() {
-		c.Logger.DebugContext(ctx, "Sending current session ID")
-		_, err := ch.SendRequest(teleport.CurrentSessionIDRequest, false, []byte(sess.ID()))
-		if err != nil {
-			c.Logger.DebugContext(ctx, "Failed to send the current session ID", "error", err)
-		}
-	}()
 }
 
 // getSession returns the context's session
+//
+// The associated session is not set in the server context until a
+// shell / exec channel has been initiated for the session, so out-of-band
+// session requests that can occur before these channel requests should
+// consider fallback mechanisms.
 func (c *ServerContext) getSession() *session {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
@@ -734,6 +796,11 @@ func (c *ServerContext) CheckFileCopyingAllowed() error {
 		return nil
 	}
 
+	// check if proxying permit is defined and authorizes file copying
+	if permit := c.Identity.ProxyingPermit; permit != nil && permit.SSHFileCopy {
+		return nil
+	}
+
 	return trace.Wrap(errRoleFileCopyingNotPermitted)
 }
 
@@ -746,8 +813,11 @@ func (c *ServerContext) CheckSFTPAllowed(registry *SessionRegistry) error {
 	}
 
 	// ensure moderated session policies allow starting an unattended session
-	policySets := c.Identity.UnstableSessionJoiningAccessChecker.SessionPolicySets()
-	checker := auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, c.Identity.TeleportUser)
+	var policySets []*types.SessionTrackerPolicySet
+	if c.Identity.UnstableSessionJoiningAccessChecker != nil {
+		policySets = c.Identity.UnstableSessionJoiningAccessChecker.SessionPolicySets()
+	}
+	checker := moderation.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, c.Identity.TeleportUser)
 	canStart, _, err := checker.FulfilledFor(nil)
 	if err != nil {
 		return trace.Wrap(err)
@@ -892,7 +962,7 @@ func (c *ServerContext) reportStats(conn utils.Stater) {
 			Type:  events.SessionDataEvent,
 			Code:  events.SessionDataCode,
 		},
-		ServerMetadata:  c.srv.TargetMetadata(),
+		ServerMetadata:  c.srv.EventMetadata(),
 		SessionMetadata: c.GetSessionMetadata(),
 		UserMetadata:    c.Identity.GetUserMetadata(),
 		ConnectionMetadata: apievents.ConnectionMetadata{
@@ -913,6 +983,15 @@ func (c *ServerContext) reportStats(conn utils.Stater) {
 	serverRX.Add(float64(rxBytes))
 }
 
+// ShouldHandleRecording returns whether this server context is responsible for
+// recording session events, including session recording, audit events, and session tracking.
+func (c *ServerContext) ShouldHandleSessionRecording() bool {
+	// The only time this server is not responsible for recording the session is when this
+	// is a Teleport Node with Proxy recording mode turned on, where the forwarding node will
+	// handle the recording.
+	return c.srv.Component() != teleport.ComponentNode || !services.IsRecordAtProxy(c.SessionRecordingConfig.GetMode())
+}
+
 func (c *ServerContext) Close() error {
 	// If the underlying connection is holding tracking information, report that
 	// to the audit log at close.
@@ -984,12 +1063,8 @@ func getPAMConfig(c *ServerContext) (*PAMConfig, error) {
 		return nil, nil
 	}
 
-	localPAMConfig, err := c.srv.GetPAM()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	// We use nil/empty to figure out if PAM is disabled later.
+	localPAMConfig := c.srv.GetPAM()
 	if !localPAMConfig.Enabled {
 		return nil, nil
 	}
@@ -1080,6 +1155,7 @@ func (c *ServerContext) ExecCommand() (*ExecCommand, error) {
 
 	// Create the execCommand that will be sent to the child process.
 	return &ExecCommand{
+		LogConfig:             c.srv.ChildLogConfig().ExecLogConfig,
 		Command:               command,
 		DestinationAddress:    c.DstAddr,
 		Username:              c.Identity.TeleportUser,
@@ -1106,14 +1182,17 @@ func (id *IdentityContext) GetUserMetadata() apievents.UserMetadata {
 	}
 
 	return apievents.UserMetadata{
-		Login:          id.Login,
-		User:           id.TeleportUser,
-		Impersonator:   id.Impersonator,
-		AccessRequests: id.ActiveRequests,
-		TrustedDevice:  id.UnmappedIdentity.GetDeviceMetadata(),
-		UserKind:       userKind,
-		BotName:        id.BotName,
-		BotInstanceID:  id.BotInstanceID,
+		Login:           id.Login,
+		User:            id.TeleportUser,
+		Impersonator:    id.Impersonator,
+		AccessRequests:  id.ActiveRequests,
+		TrustedDevice:   id.UnmappedIdentity.GetDeviceMetadata(),
+		UserKind:        userKind,
+		BotName:         id.BotName,
+		BotInstanceID:   id.BotInstanceID,
+		UserClusterName: id.OriginClusterName,
+		UserRoles:       slices.Clone(id.MappedRoles),
+		UserTraits:      id.Traits.Clone(),
 	}
 }
 
@@ -1146,15 +1225,20 @@ func buildEnvironment(ctx *ServerContext) []string {
 		}
 		if session.id != "" {
 			env.AddTrusted(teleport.SSHSessionID, string(session.id))
+			env.AddTrusted(sshutils.SessionEnvVar, string(session.id))
 		}
 	}
 
 	// Set some Teleport specific environment variables: SSH_TELEPORT_USER,
-	// SSH_TELEPORT_HOST_UUID, and SSH_TELEPORT_CLUSTER_NAME.
+	// SSH_TELEPORT_HOST_UUID, SSH_TELEPORT_CLUSTER_NAME, and SSH_SESSION_WEBPROXY_ADDR.
 	env.AddTrusted(teleport.SSHTeleportHostUUID, ctx.srv.ID())
 	env.AddTrusted(teleport.SSHTeleportClusterName, ctx.ClusterName)
 	env.AddTrusted(teleport.SSHTeleportUser, ctx.Identity.TeleportUser)
 
+	if ctx.GetSessionParams().WebProxyAddr != "" {
+		env.AddTrusted(teleport.SSHSessionWebProxyAddr, ctx.GetSessionParams().WebProxyAddr)
+	}
+
 	// At the end gather all dynamically defined environment variables
 	ctx.VisitEnv(env.AddUnique)
 
@@ -1181,23 +1265,13 @@ func closeAll(closers ...io.Closer) error {
 }
 
 func newUaccMetadata(c *ServerContext) (*UaccMetadata, error) {
-	addr := c.ConnectionContext.ServerConn.RemoteAddr()
-	hostname, _, err := net.SplitHostPort(addr.String())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	preparedAddr, err := uacc.PrepareAddr(addr)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	utmpPath, wtmpPath, btmpPath := c.srv.GetUserAccountingPaths()
-
+	utmpPath, wtmpPath, btmpPath, wtmpdbPath := c.srv.GetUserAccountingPaths()
 	return &UaccMetadata{
-		Hostname:   hostname,
-		RemoteAddr: preparedAddr,
+		RemoteAddr: utils.FromAddr(c.ConnectionContext.ServerConn.RemoteAddr()),
 		UtmpPath:   utmpPath,
 		WtmpPath:   wtmpPath,
 		BtmpPath:   btmpPath,
+		WtmpdbPath: wtmpdbPath,
 	}, nil
 }
 
@@ -1253,7 +1327,7 @@ func (c *ServerContext) GetExecRequest() (Exec, error) {
 
 func (c *ServerContext) GetSessionMetadata() apievents.SessionMetadata {
 	return apievents.SessionMetadata{
-		SessionID:        string(c.SessionID()),
+		SessionID:        c.SessionID(),
 		WithMFA:          c.Identity.UnmappedIdentity.MFAVerified,
 		PrivateKeyPolicy: string(c.Identity.UnmappedIdentity.PrivateKeyPolicy),
 	}
@@ -1297,3 +1371,33 @@ func (c *ServerContext) ConsumeApprovedFileTransferRequest() *FileTransferReques
 
 	return req
 }
+
+// The child does not signal until completing PAM setup, which can take an arbitrary
+// amount of time, so we use a reasonably long timeout to avoid dubious lockouts.
+const childReadyWaitTimeout = 3 * time.Minute
+
+// WaitForChild waits for the child process to signal ready through the named pipe.
+func (c *ServerContext) WaitForChild(ctx context.Context) error {
+	bpfService := c.srv.GetBPF()
+	pam := c.srv.GetPAM()
+
+	// Only wait for the child to be "ready" if BPF and PAM are enabled. This is required
+	// because PAM might inadvertently move the child process to another cgroup
+	// by invoking systemd. If this happens, then the cgroup filter used by BPF
+	// will be looking for events in the wrong cgroup and no events will be captured.
+	// However, unconditionally waiting for the child to be ready results in PAM
+	// deadlocking because stdin/stdout/stderr which it uses to relay details from
+	// PAM auth modules are not properly copied until _after_ the shell request is
+	// replied to.
+	var waitErr error
+	if bpfService.Enabled() && pam.Enabled {
+		if waitErr = waitForSignal(ctx, c.readyr, childReadyWaitTimeout); waitErr != nil {
+			c.Logger.ErrorContext(ctx, "Child process never became ready.", "error", waitErr)
+		}
+	}
+
+	closeErr := c.readyr.Close()
+	// Set to nil so the close in the context doesn't attempt to re-close.
+	c.readyr = nil
+	return trace.NewAggregate(waitErr, closeErr)
+}
diff --git a/lib/srv/ctx_test.go b/lib/srv/ctx_test.go
index 4ec4d68a44943..adc65dd4efe59 100644
--- a/lib/srv/ctx_test.go
+++ b/lib/srv/ctx_test.go
@@ -19,7 +19,6 @@
 package srv
 
 import (
-	"context"
 	"testing"
 
 	"github.com/gogo/protobuf/proto"
@@ -30,10 +29,9 @@ import (
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/services"
-	rsession "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/sshca"
-	"github.com/gravitational/teleport/lib/sshutils"
 )
 
 func TestCheckSFTPAllowed(t *testing.T) {
@@ -44,6 +42,7 @@ func TestCheckSFTPAllowed(t *testing.T) {
 		name                 string
 		nodeAllowFileCopying bool
 		permit               *decisionpb.SSHAccessPermit
+		proxyingPermit       *proxyingPermit
 		sessionPolicies      []*types.SessionRequirePolicy
 		expectedErr          error
 	}{
@@ -79,6 +78,22 @@ func TestCheckSFTPAllowed(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
+		{
+			name:                 "proxying role disallowed",
+			nodeAllowFileCopying: true,
+			proxyingPermit: &proxyingPermit{
+				SSHFileCopy: false,
+			},
+			expectedErr: errRoleFileCopyingNotPermitted,
+		},
+		{
+			name:                 "proxying role allowed",
+			nodeAllowFileCopying: true,
+			proxyingPermit: &proxyingPermit{
+				SSHFileCopy: true,
+			},
+			expectedErr: nil,
+		},
 		{
 			name:                 "moderated sessions enforced",
 			nodeAllowFileCopying: true,
@@ -123,6 +138,7 @@ func TestCheckSFTPAllowed(t *testing.T) {
 			)
 
 			ctx.Identity.AccessPermit = tt.permit
+			ctx.Identity.ProxyingPermit = tt.proxyingPermit
 
 			err := ctx.CheckSFTPAllowed(nil)
 			if tt.expectedErr == nil {
@@ -147,6 +163,11 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 				Impersonator:   "llama",
 				Login:          "alpaca1",
 				ActiveRequests: []string{"access-req1", "access-req2"},
+				MappedRoles:    []string{"role1", "role2"},
+				Traits: wrappers.Traits{
+					"trait1": []string{"value1", "value2"},
+					"trait2": []string{"value3"},
+				},
 			},
 			want: apievents.UserMetadata{
 				User:           "alpaca",
@@ -154,6 +175,11 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 				Impersonator:   "llama",
 				AccessRequests: []string{"access-req1", "access-req2"},
 				UserKind:       apievents.UserKind_USER_KIND_HUMAN,
+				UserRoles:      []string{"role1", "role2"},
+				UserTraits: wrappers.Traits{
+					"trait1": []string{"value1", "value2"},
+					"trait2": []string{"value3"},
+				},
 			},
 		},
 		{
@@ -255,84 +281,3 @@ func TestSSHAccessLockTargets(t *testing.T) {
 		}
 	})
 }
-
-func TestCreateOrJoinSession(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	srv := newMockServer(t)
-	registry, err := NewSessionRegistry(SessionRegistryConfig{
-		clock:                 srv.clock,
-		Srv:                   srv,
-		SessionTrackerService: srv.auth,
-	})
-	require.NoError(t, err)
-
-	runningSessionID := rsession.NewID()
-	sess, _, err := newSession(ctx, runningSessionID, registry, newTestServerContext(t, srv, nil, nil), newMockSSHChannel(), sessionTypeInteractive)
-	require.NoError(t, err)
-
-	t.Cleanup(sess.Stop)
-
-	registry.sessions[runningSessionID] = sess
-
-	tests := []struct {
-		name              string
-		sessionID         string
-		wantSameSessionID bool
-	}{
-		{
-			name:              "no session ID",
-			wantSameSessionID: false,
-		},
-		// TODO(capnspacehook): Check that an error is returned in v17
-		{
-			name:              "new session ID",
-			sessionID:         string(rsession.NewID()),
-			wantSameSessionID: false,
-		},
-		{
-			name:              "existing session ID",
-			sessionID:         runningSessionID.String(),
-			wantSameSessionID: true,
-		},
-		{
-			name:              "existing session ID in Windows format",
-			sessionID:         "{" + runningSessionID.String() + "}",
-			wantSameSessionID: true,
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx, cancel := context.WithCancel(ctx)
-			defer cancel()
-
-			parsedSessionID := new(rsession.ID)
-			var err error
-			if tt.sessionID != "" {
-				parsedSessionID, err = rsession.ParseID(tt.sessionID)
-				require.NoError(t, err)
-			}
-
-			scx := newTestServerContext(t, srv, nil, nil)
-			if tt.sessionID != "" {
-				scx.SetEnv(sshutils.SessionEnvVar, tt.sessionID)
-			}
-
-			err = scx.CreateOrJoinSession(ctx, registry)
-			require.NoError(t, err)
-			require.False(t, scx.sessionID.IsZero())
-			if tt.wantSameSessionID {
-				require.Equal(t, parsedSessionID.String(), scx.sessionID.String())
-			} else {
-				require.NotEqual(t, parsedSessionID.String(), scx.sessionID.String())
-			}
-		})
-	}
-}
diff --git a/lib/srv/db/access_test.go b/lib/srv/db/access_test.go
index 6d58c3142bbb6..78f650d8edd82 100644
--- a/lib/srv/db/access_test.go
+++ b/lib/srv/db/access_test.go
@@ -29,13 +29,13 @@ import (
 	"io"
 	"net"
 	"os"
+	"slices"
 	"sync"
 	"testing"
 	"time"
 
 	"github.com/ClickHouse/ch-go"
 	cqlclient "github.com/datastax/go-cassandra-native-protocol/client"
-	elastic "github.com/elastic/go-elasticsearch/v8"
 	mysqlclient "github.com/go-mysql-org/go-mysql/client"
 	mysqllib "github.com/go-mysql-org/go-mysql/mysql"
 	"github.com/google/uuid"
@@ -45,6 +45,7 @@ import (
 	mssql "github.com/microsoft/go-mssqldb"
 	opensearchclt "github.com/opensearch-project/opensearch-go/v2"
 	goredis "github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mongodb.org/mongo-driver/bson"
 	"go.mongodb.org/mongo-driver/mongo"
@@ -54,16 +55,21 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
-	clients "github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
-	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
@@ -71,6 +77,7 @@ import (
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
@@ -90,25 +97,30 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/objects"
 	"github.com/gravitational/teleport/lib/srv/db/opensearch"
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
-	"github.com/gravitational/teleport/lib/srv/db/redis"
 	redisprotocol "github.com/gravitational/teleport/lib/srv/db/redis/protocol"
+	redis "github.com/gravitational/teleport/lib/srv/db/redis/testing"
 	"github.com/gravitational/teleport/lib/srv/db/snowflake"
-	"github.com/gravitational/teleport/lib/srv/db/spanner"
+	spanner "github.com/gravitational/teleport/lib/srv/db/spanner/testing"
 	"github.com/gravitational/teleport/lib/srv/db/sqlserver"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers/db"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/cert"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
+	logtest.InitLogger(testing.Verbose)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
 	modules.SetInsecureTestMode(true)
 	registerTestSnowflakeEngine()
 	registerTestElasticsearchEngine()
 	registerTestSQLServerEngine()
-	os.Exit(m.Run())
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 // TestAccessPostgres verifies access scenarios to a Postgres database based
@@ -374,16 +386,24 @@ func TestAccessMySQL(t *testing.T) {
 
 func TestMySQLServerVersionUpdateOnConnection(t *testing.T) {
 	ctx := context.Background()
-	testCtx := setupTestContext(
-		ctx,
-		t,
-		withSelfHostedMySQL("mysql",
-			// Set an older version in DB spec.
-			withMySQLServerVersionInDBSpec("6.6.6-before"),
-			// Set a newer version in TestServer.
-			withMySQLServerVersion("8.8.8-after"),
-		),
-	)
+	testCtx := setupTestContext(ctx, t)
+	// disable default health check, because health checks will extract and
+	// update the server version before we connect
+	hcc, err := testCtx.authServer.GetHealthCheckConfig(ctx, teleport.VirtualDefaultHealthCheckConfigDBName)
+	require.NoError(t, err)
+	hcc.Spec.Match.Disabled = true
+	_, err = testCtx.authServer.UpsertHealthCheckConfig(ctx, hcc)
+	require.NoError(t, err)
+	testCtx.server = testCtx.setupDatabaseServer(ctx, t, agentParams{
+		Databases: types.Databases{
+			withSelfHostedMySQL("mysql",
+				// Set an older version in DB spec.
+				withMySQLServerVersionInDBSpec("6.6.6-before"),
+				// Set a newer version in TestServer.
+				withMySQLServerVersion("8.8.8-after"),
+			)(t, ctx, testCtx),
+		},
+	})
 	go testCtx.startHandlingConnections()
 
 	// Confirm the server version configured in the spec.
@@ -1112,7 +1132,7 @@ func TestMongoDBMaxMessageSize(t *testing.T) {
 
 // TestAccessDisabled makes sure database access can be disabled via modules.
 func TestAccessDisabled(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.DB: {Enabled: false},
@@ -1468,19 +1488,19 @@ func TestRedisNil(t *testing.T) {
 }
 
 type testContext struct {
-	hostID         string
-	clusterName    string
-	tlsServer      *auth.TestTLSServer
-	authServer     *auth.Server
-	authClient     *authclient.Client
-	proxyServer    *ProxyServer
-	mux            *multiplexer.Mux
-	mysqlListener  net.Listener
-	webListener    *multiplexer.WebListener
-	fakeRemoteSite *reversetunnelclient.FakeRemoteSite
-	server         *Server
-	emitter        *eventstest.ChannelEmitter
-	databaseCA     types.CertAuthority
+	hostID        string
+	clusterName   string
+	tlsServer     *authtest.TLSServer
+	authServer    *auth.Server
+	authClient    *authclient.Client
+	proxyServer   *ProxyServer
+	mux           *multiplexer.Mux
+	mysqlListener net.Listener
+	webListener   *multiplexer.WebListener
+	fakeCluster   *reversetunnelclient.FakeCluster
+	server        *Server
+	emitter       *eventstest.ChannelEmitter
+	databaseCA    types.CertAuthority
 	// postgres is a collection of Postgres databases the test uses.
 	postgres map[string]testPostgres
 	// mysql is a collection of MySQL databases the test uses.
@@ -1623,7 +1643,7 @@ func (c *testContext) startHandlingConnections() {
 	// Start all proxy services.
 	c.startProxy()
 	// Start handling database client connections on the database server.
-	for conn := range c.fakeRemoteSite.ProxyConn() {
+	for conn := range c.fakeCluster.ProxyConn() {
 		go c.server.HandleConnection(conn)
 	}
 }
@@ -2069,7 +2089,7 @@ func (c *testContext) snowflakeClient(ctx context.Context, teleportUser, dbServi
 }
 
 // elasticsearchClient returns an Elasticsearch test DB client.
-func (c *testContext) elasticsearchClient(ctx context.Context, teleportUser, dbService, dbUser string) (*elastic.Client, *alpnproxy.LocalProxy, error) {
+func (c *testContext) elasticsearchClient(ctx context.Context, teleportUser, dbService, dbUser string) (*elasticsearch.TestClient, *alpnproxy.LocalProxy, error) {
 	route := tlsca.RouteToDatabase{
 		ServiceName: dbService,
 		Protocol:    defaults.ProtocolElasticsearch,
@@ -2217,7 +2237,7 @@ func withClientIdleTimeout(clientIdleTimeout time.Duration) roleOptFn {
 // createUserAndRole creates Teleport user and role with specified names
 // and allowed database users/names properties.
 func (c *testContext) createUserAndRole(ctx context.Context, t testing.TB, userName, roleName string, dbUsers, dbNames []string, roleOpts ...roleOptFn) (types.User, types.Role) {
-	user, role, err := auth.CreateUserAndRole(c.tlsServer.Auth(), userName, []string{roleName}, nil)
+	user, role, err := authtest.CreateUserAndRole(c.tlsServer.Auth(), userName, []string{roleName}, nil)
 	require.NoError(t, err)
 	role.SetDatabaseUsers(types.Allow, dbUsers)
 	role.SetDatabaseNames(types.Allow, dbNames)
@@ -2290,7 +2310,7 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 	t.Cleanup(func() { testCtx.Close() })
 
 	// Create and start test auth server.
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Clock:       testCtx.clock,
 		ClusterName: testCtx.clusterName,
 		AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -2335,7 +2355,7 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 	require.NoError(t, err)
 
 	// Auth client for database service.
-	testCtx.authClient, err = testCtx.tlsServer.NewClient(auth.TestServerID(types.RoleDatabase, testCtx.hostID))
+	testCtx.authClient, err = testCtx.tlsServer.NewClient(authtest.TestServerID(types.RoleDatabase, testCtx.hostID))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, testCtx.authClient.Close()) })
 
@@ -2343,7 +2363,7 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 	require.NoError(t, err)
 
 	// Auth client, lock watcher and authorizer for database proxy.
-	proxyAuthClient, err := testCtx.tlsServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := testCtx.tlsServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
@@ -2362,7 +2382,7 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 	require.NoError(t, err)
 
 	// TLS config for database proxy and database service.
-	serverIdentity, err := auth.NewServerIdentity(authServer.AuthServer, testCtx.hostID, types.RoleDatabase)
+	serverIdentity, err := authtest.NewServerIdentity(authServer.AuthServer, testCtx.hostID, types.RoleDatabase)
 	require.NoError(t, err)
 	tlsConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -2374,11 +2394,11 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 	}
 
 	// Establish fake reversetunnel b/w database proxy and database service.
-	testCtx.fakeRemoteSite = reversetunnelclient.NewFakeRemoteSite(testCtx.clusterName, proxyAuthClient)
-	t.Cleanup(func() { require.NoError(t, testCtx.fakeRemoteSite.Close()) })
+	testCtx.fakeCluster = reversetunnelclient.NewFakeCluster(testCtx.clusterName, proxyAuthClient)
+	t.Cleanup(func() { require.NoError(t, testCtx.fakeCluster.Close()) })
 	tunnel := &reversetunnelclient.FakeServer{
-		Sites: []reversetunnelclient.RemoteSite{
-			testCtx.fakeRemoteSite,
+		FakeClusters: []reversetunnelclient.Cluster{
+			testCtx.fakeCluster,
 		},
 	}
 	// Empty config means no limit.
@@ -2398,7 +2418,7 @@ func setupTestContext(ctx context.Context, t testing.TB, withDatabases ...withDa
 		ServerID:       testCtx.hostID,
 		Emitter:        testCtx.emitter,
 		EmitterContext: ctx,
-		Logger:         utils.NewSlogLoggerForTests(),
+		Logger:         logtest.NewLogger(),
 	})
 	require.NoError(t, err)
 
@@ -2444,8 +2464,10 @@ type agentParams struct {
 	OnHeartbeat func(error)
 	// CADownloader defines the CA downloader.
 	CADownloader CADownloader
-	// CloudClients is the cloud API clients for database service.
-	CloudClients clients.Clients
+	// AzureClients provides Azure SDK clients.
+	AzureClients azure.Clients
+	// GCPClients provides GCP SDK clients.
+	GCPClients gcp.Clients
 	// AWSConfigProvider provides [aws.Config] for AWS SDK service clients.
 	AWSConfigProvider awsconfig.Provider
 	// AWSDatabaseFetcherFactory provides AWS database fetchers
@@ -2486,11 +2508,16 @@ func (p *agentParams) setDefaults(c *testContext) {
 		}
 	}
 
-	if p.CloudClients == nil {
-		p.CloudClients = &clients.TestCloudClients{
+	if p.GCPClients == nil {
+		p.GCPClients = &gcptest.Clients{
 			GCPSQL: p.GCPSQL,
 		}
 	}
+
+	if p.AzureClients == nil {
+		p.AzureClients = &azuretest.Clients{}
+	}
+
 	if p.AWSConfigProvider == nil {
 		p.AWSConfigProvider = &mocks.AWSConfigProvider{Err: trace.AccessDenied("AWS SDK clients are disabled for tests by default")}
 	}
@@ -2511,7 +2538,7 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 	p.setDefaults(c)
 
 	// Database service credentials.
-	serverIdentity, err := auth.NewServerIdentity(c.authServer, p.HostID, types.RoleDatabase)
+	serverIdentity, err := authtest.NewServerIdentity(c.authServer, p.HostID, types.RoleDatabase)
 	require.NoError(t, err)
 	tlsConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -2535,7 +2562,8 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 	testAuth, err := newTestAuth(common.AuthConfig{
 		AuthClient:        c.authClient,
 		AccessPoint:       c.authClient,
-		Clients:           &clients.TestCloudClients{},
+		AzureClients:      &azuretest.Clients{},
+		GCPClients:        &gcptest.Clients{},
 		Clock:             c.clock,
 		AWSConfigProvider: p.AWSConfigProvider,
 	})
@@ -2552,7 +2580,7 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 		ServerID:       p.HostID,
 		Emitter:        c.emitter,
 		EmitterContext: context.Background(),
-		Logger:         utils.NewSlogLoggerForTests(),
+		Logger:         logtest.NewLogger(),
 	})
 	require.NoError(t, err)
 
@@ -2561,7 +2589,7 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 	}
 
 	// Auth client for this database server identity.
-	clt, err := c.tlsServer.NewClient(auth.TestServerID(types.RoleDatabase, p.HostID))
+	clt, err := c.tlsServer.NewClient(authtest.TestServerID(types.RoleDatabase, p.HostID))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, clt.Close()) })
 
@@ -2611,7 +2639,8 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 		OnReconcile:               p.OnReconcile,
 		DatabaseObjects:           p.DatabaseObjects,
 		ConnectionMonitor:         connMonitor,
-		CloudClients:              p.CloudClients,
+		AzureClients:              p.AzureClients,
+		GCPClients:                p.GCPClients,
 		AWSConfigProvider:         p.AWSConfigProvider,
 		AWSDatabaseFetcherFactory: p.AWSDatabaseFetcherFactory,
 		AWSMatchers:               p.AWSMatchers,
@@ -2625,20 +2654,16 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 
 	if !p.NoStart {
 		require.NoError(t, server.Start(ctx))
-
-		// Explicitly send a heartbeat for any statically defined dbs.
-		for _, db := range p.Databases {
-			select {
-			case sender := <-inventoryHandle.Sender():
-				dbServer, err := server.getServerInfo(ctx, db)
-				require.NoError(t, err)
-				require.NoError(t, sender.Send(ctx, &proto.InventoryHeartbeat{
-					DatabaseServer: dbServer,
-				}))
-			case <-time.After(20 * time.Second):
-				t.Fatal("timed out waiting for inventory handle sender")
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			dbServers, err := c.proxyServer.cfg.AccessPoint.GetDatabaseServers(ctx, apidefaults.Namespace)
+			if !assert.NoError(t, err) {
+				return
 			}
-		}
+			assert.Subset(t,
+				slices.Collect(types.ResourceNames(dbServers)),
+				slices.Collect(types.ResourceNames(p.Databases)),
+			)
+		}, 20*time.Second, 100*time.Millisecond, "waiting for database servers to become available")
 	}
 
 	return server
@@ -3215,12 +3240,15 @@ func withSelfHostedMongoWithAdminUser(name, adminUsername string, opts ...mongod
 
 func withSelfHostedRedis(name string, opts ...redis.TestServerOption) withDatabaseOption {
 	return func(t testing.TB, ctx context.Context, testCtx *testContext) types.Database {
-		redisServer, err := redis.NewTestServer(t, common.TestServerConfig{
+		redisServer, err := redis.NewTestServer(common.TestServerConfig{
 			Name:       name,
 			AuthClient: testCtx.authClient,
 			ClientAuth: tls.RequireAndVerifyClientCert,
 		}, opts...)
 		require.NoError(t, err)
+		t.Cleanup(func() {
+			redisServer.Close()
+		})
 
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
@@ -3314,11 +3342,14 @@ func withClickhouseHTTP(name string) withDatabaseOption {
 
 func withElastiCacheRedis(name string, token, engineVersion string) withDatabaseOption {
 	return func(t testing.TB, ctx context.Context, testCtx *testContext) types.Database {
-		redisServer, err := redis.NewTestServer(t, common.TestServerConfig{
+		redisServer, err := redis.NewTestServer(common.TestServerConfig{
 			Name:       name,
 			AuthClient: testCtx.authClient,
 		}, redis.TestServerPassword(token))
 		require.NoError(t, err)
+		t.Cleanup(func() {
+			redisServer.Close()
+		})
 
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
@@ -3349,13 +3380,56 @@ func withElastiCacheRedis(name string, token, engineVersion string) withDatabase
 	}
 }
 
+func withElastiCacheServerlessRedis(name string, token, engineVersion string) withDatabaseOption {
+	return func(t testing.TB, ctx context.Context, testCtx *testContext) types.Database {
+		redisServer, err := redis.NewTestServer(common.TestServerConfig{
+			Name:       name,
+			AuthClient: testCtx.authClient,
+		}, redis.TestServerPassword(token))
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			redisServer.Close()
+		})
+
+		database, err := types.NewDatabaseV3(types.Metadata{
+			Name: name,
+			Labels: map[string]string{
+				"engine-version": engineVersion,
+			},
+		}, types.DatabaseSpecV3{
+			Protocol:      defaults.ProtocolRedis,
+			URI:           fmt.Sprintf("rediss://%s", net.JoinHostPort("localhost", redisServer.Port())),
+			DynamicLabels: dynamicLabels,
+			AWS: types.AWS{
+				Region: "us-west-1",
+				ElastiCacheServerless: types.ElastiCacheServerless{
+					CacheName: "example-cache",
+				},
+			},
+			// Set CA cert to pass cert validation.
+			TLS: types.DatabaseTLS{
+				CACert: string(testCtx.databaseCA.GetActiveKeys().TLS[0].Cert),
+			},
+		})
+		require.NoError(t, err)
+		testCtx.redis[name] = testRedis{
+			db:       redisServer,
+			resource: database,
+		}
+		return database
+	}
+}
+
 func withMemoryDBRedis(name string, token, engineVersion string) withDatabaseOption {
 	return func(t testing.TB, ctx context.Context, testCtx *testContext) types.Database {
-		redisServer, err := redis.NewTestServer(t, common.TestServerConfig{
+		redisServer, err := redis.NewTestServer(common.TestServerConfig{
 			Name:       name,
 			AuthClient: testCtx.authClient,
 		}, redis.TestServerPassword(token))
 		require.NoError(t, err)
+		t.Cleanup(func() {
+			redisServer.Close()
+		})
 
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
@@ -3388,11 +3462,14 @@ func withMemoryDBRedis(name string, token, engineVersion string) withDatabaseOpt
 
 func withAzureRedis(name string, token string) withDatabaseOption {
 	return func(t testing.TB, ctx context.Context, testCtx *testContext) types.Database {
-		redisServer, err := redis.NewTestServer(t, common.TestServerConfig{
+		redisServer, err := redis.NewTestServer(common.TestServerConfig{
 			Name:       name,
 			AuthClient: testCtx.authClient,
 		}, redis.TestServerPassword(token))
 		require.NoError(t, err)
+		t.Cleanup(func() {
+			redisServer.Close()
+		})
 
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
diff --git a/lib/srv/db/audit_test.go b/lib/srv/db/audit_test.go
index 37aa736fad253..9f30e690a4784 100644
--- a/lib/srv/db/audit_test.go
+++ b/lib/srv/db/audit_test.go
@@ -37,7 +37,7 @@ import (
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
-	"github.com/gravitational/teleport/lib/srv/db/redis"
+	redis "github.com/gravitational/teleport/lib/srv/db/redis/testing"
 )
 
 // TestAuditPostgres verifies proper audit events are emitted for Postgres
@@ -392,8 +392,10 @@ func requireBindEvent(t *testing.T, testCtx *testContext) *events.PostgresBind {
 	return bindEvent
 }
 
-func requireEvent(t *testing.T, testCtx *testContext, code string) events.AuditEvent {
-	t.Helper()
+func requireEvent(t require.TestingT, testCtx *testContext, code string) events.AuditEvent {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
 	event := waitForAnyEvent(t, testCtx)
 	require.Equal(t, code, event.GetCode())
 	return event
@@ -417,8 +419,10 @@ func requireQueryEventWithDBName(t *testing.T, testCtx *testContext, code, query
 	require.Equal(t, dbName, queryEvent.DatabaseName)
 }
 
-func waitForAnyEvent(t *testing.T, testCtx *testContext) events.AuditEvent {
-	t.Helper()
+func waitForAnyEvent(t require.TestingT, testCtx *testContext) events.AuditEvent {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
 	select {
 	case event := <-testCtx.emitter.C():
 		return event
diff --git a/lib/srv/db/auth_test.go b/lib/srv/db/auth_test.go
index 9c82d58481ef9..df8e21dee3693 100644
--- a/lib/srv/db/auth_test.go
+++ b/lib/srv/db/auth_test.go
@@ -68,6 +68,8 @@ func TestAuthTokens(t *testing.T) {
 		withAzureRedis("redis-azure-incorrect-token", "qwe123"),
 		withElastiCacheRedis("redis-elasticache-correct-token", elastiCacheRedisToken, "7.0.0"),
 		withElastiCacheRedis("redis-elasticache-incorrect-token", "qwe123", "7.0.0"),
+		withElastiCacheServerlessRedis("redis-elasticache-serverless-correct-token", elastiCacheServerlessRedisToken, "8.0.0"),
+		withElastiCacheServerlessRedis("redis-elasticache-serverless-incorrect-token", "qwe123", "8.0.0"),
 		withMemoryDBRedis("redis-memorydb-correct-token", memorydbToken, "7.0"),
 		withMemoryDBRedis("redis-memorydb-incorrect-token", "qwe123", "7.0"),
 		withSpanner("spanner-correct-token", cloudSpannerAuthToken),
@@ -199,6 +201,18 @@ func TestAuthTokens(t *testing.T) {
 			// Make sure we print a user-friendly IAM auth error.
 			err: "Make sure that IAM auth is enabled",
 		},
+		{
+			desc:     "correct ElastiCache Serverless redis auth token",
+			service:  "redis-elasticache-serverless-correct-token",
+			protocol: defaults.ProtocolRedis,
+		},
+		{
+			desc:     "incorrect ElastiCache Redis auth token",
+			service:  "redis-elasticache-serverless-incorrect-token",
+			protocol: defaults.ProtocolRedis,
+			// Make sure we print a user-friendly IAM auth error.
+			err: "Make sure that IAM auth is enabled",
+		},
 		{
 			desc:     "correct MemoryDB auth token",
 			service:  "redis-memorydb-correct-token",
@@ -319,6 +333,8 @@ const (
 	azureRedisToken = "azure-redis-token"
 	// elastiCacheRedisToken is a mock ElastiCache Redis token.
 	elastiCacheRedisToken = "elasticache-redis-token"
+	// elastiCacheServerlessRedisToken is a mock ElastiCache Serverless redis token.
+	elastiCacheServerlessRedisToken = "elasticache-serverless-redis-token"
 	// memorydbToken is a mock MemoryDB auth token.
 	memorydbToken = "memorydb-token"
 	// atlasAuthUser is a mock Mongo Atlas IAM auth user.
@@ -366,7 +382,12 @@ func (a *testAuth) GetRedshiftServerlessAuthToken(ctx context.Context, database
 }
 
 func (a *testAuth) GetElastiCacheRedisToken(ctx context.Context, database types.Database, databaseUser string) (string, error) {
-	return elastiCacheRedisToken, nil
+	if database.IsElastiCache() {
+		return elastiCacheRedisToken, nil
+	} else if database.IsElastiCacheServerless() {
+		return elastiCacheServerlessRedisToken, nil
+	}
+	return "", trace.BadParameter("database is not an elasticache database %+v", database)
 }
 
 func (a *testAuth) GetMemoryDBToken(ctx context.Context, database types.Database, databaseUser string) (string, error) {
@@ -378,6 +399,10 @@ func (a *testAuth) GetCloudSQLAuthToken(ctx context.Context, databaseUser string
 	return cloudSQLAuthToken, nil
 }
 
+func (a *testAuth) GetAlloyDBAuthToken(ctx context.Context, databaseUser string) (string, error) {
+	return "", trace.NotImplemented("GetAlloyDBAuthToken is not implemented")
+}
+
 func (a *testAuth) GetSpannerTokenSource(ctx context.Context, databaseUser string) (oauth2.TokenSource, error) {
 	return &fakeTokenSource{
 		token:  cloudSpannerAuthToken,
diff --git a/lib/srv/db/autousers_test.go b/lib/srv/db/autousers_test.go
index 279ce900f1664..150428c198c10 100644
--- a/lib/srv/db/autousers_test.go
+++ b/lib/srv/db/autousers_test.go
@@ -31,7 +31,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/label"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/srv/db/common/databaseobjectimportrule"
 	"github.com/gravitational/teleport/lib/srv/db/mongodb"
@@ -151,7 +151,7 @@ func TestAutoUsersPostgres(t *testing.T) {
 			}
 
 			// Create user with role that allows user provisioning.
-			_, role, err := auth.CreateUserAndRole(testCtx.tlsServer.Auth(), "alice", []string{"auto"}, nil)
+			_, role, err := authtest.CreateUserAndRole(testCtx.tlsServer.Auth(), "alice", []string{"auto"}, nil)
 			require.NoError(t, err)
 			options := role.GetOptions()
 			options.CreateDatabaseUserMode = tc.mode
@@ -331,7 +331,7 @@ func TestAutoUsersMySQL(t *testing.T) {
 			go testCtx.startHandlingConnections()
 
 			// Create user with role that allows user provisioning.
-			_, role, err := auth.CreateUserAndRole(testCtx.tlsServer.Auth(), tc.teleportUser, []string{"auto"}, nil)
+			_, role, err := authtest.CreateUserAndRole(testCtx.tlsServer.Auth(), tc.teleportUser, []string{"auto"}, nil)
 			require.NoError(t, err)
 			options := role.GetOptions()
 			options.CreateDatabaseUserMode = tc.mode
@@ -415,7 +415,7 @@ func TestAutoUsersMongoDB(t *testing.T) {
 			go testCtx.startHandlingConnections()
 
 			// Create user with role that allows user provisioning.
-			_, role, err := auth.CreateUserAndRole(testCtx.tlsServer.Auth(), username, []string{"auto"}, nil)
+			_, role, err := authtest.CreateUserAndRole(testCtx.tlsServer.Auth(), username, []string{"auto"}, nil)
 			require.NoError(t, err)
 			options := role.GetOptions()
 			options.CreateDatabaseUserMode = test.mode
diff --git a/lib/srv/db/ca.go b/lib/srv/db/ca.go
index 6f1a91b7c71df..b0146e3f6f8e1 100644
--- a/lib/srv/db/ca.go
+++ b/lib/srv/db/ca.go
@@ -106,6 +106,7 @@ func (s *Server) shouldInitCACertLocked(database types.Database) bool {
 		types.DatabaseTypeRedshift,
 		types.DatabaseTypeRedshiftServerless,
 		types.DatabaseTypeElastiCache,
+		types.DatabaseTypeElastiCacheServerless,
 		types.DatabaseTypeMemoryDB,
 		types.DatabaseTypeAWSKeyspaces,
 		types.DatabaseTypeDynamoDB,
@@ -187,6 +188,7 @@ func (s *Server) getCACertPaths(database types.Database) ([]string, error) {
 	//
 	// AWS MemoryDB uses same CA as ElastiCache.
 	case types.DatabaseTypeElastiCache,
+		types.DatabaseTypeElastiCacheServerless,
 		types.DatabaseTypeMemoryDB,
 		types.DatabaseTypeDynamoDB:
 		return []string{filepath.Join(s.cfg.DataDir, filepath.Base(amazonRootCA1URL))}, nil
@@ -316,6 +318,7 @@ func (d *realDownloader) Download(ctx context.Context, database types.Database,
 		types.DatabaseTypeRedshiftServerless:
 		return d.downloadFromURL(redshiftCAURLForDatabase(database))
 	case types.DatabaseTypeElastiCache,
+		types.DatabaseTypeElastiCacheServerless,
 		types.DatabaseTypeMemoryDB,
 		types.DatabaseTypeDynamoDB:
 		return d.downloadFromURL(amazonRootCA1URL)
@@ -345,6 +348,7 @@ func (d *realDownloader) GetVersion(ctx context.Context, database types.Database
 		types.DatabaseTypeRedshiftServerless:
 		return d.getVersionFromURL(database, redshiftCAURLForDatabase(database))
 	case types.DatabaseTypeElastiCache,
+		types.DatabaseTypeElastiCacheServerless,
 		types.DatabaseTypeMemoryDB:
 		return d.getVersionFromURL(database, amazonRootCA1URL)
 	case types.DatabaseTypeAzure:
diff --git a/lib/srv/db/ca_test.go b/lib/srv/db/ca_test.go
index 685314ff8879e..1fca3e8f28fdc 100644
--- a/lib/srv/db/ca_test.go
+++ b/lib/srv/db/ca_test.go
@@ -61,6 +61,25 @@ func TestInitCACert(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	elastiCacheServerless, err := types.NewDatabaseV3(types.Metadata{
+		Name: "elasti-serverless",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolRedis,
+		URI:      "localhost:6379",
+		AWS: types.AWS{
+			Region: "us-east-1",
+			ElastiCacheServerless: types.ElastiCacheServerless{
+				CacheName: "serverless-example",
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.True(t, elastiCacheServerless.IsElastiCacheServerless())
+
+	elastiCacheServerlessWithCert := elastiCacheServerless.Copy()
+	elastiCacheServerlessWithCert.SetName("elasti-serverless-with-cert")
+	elastiCacheServerlessWithCert.SetCA("elasticache-serverless-test-cert")
+
 	rds, err := types.NewDatabaseV3(types.Metadata{
 		Name: "rds",
 	}, types.DatabaseSpecV3{
@@ -155,6 +174,8 @@ func TestInitCACert(t *testing.T) {
 
 	allDatabases := []types.Database{
 		selfHosted,
+		elastiCacheServerless,
+		elastiCacheServerlessWithCert,
 		rds,
 		rdsWithCert,
 		redshift,
@@ -186,6 +207,16 @@ func TestInitCACert(t *testing.T) {
 			database: rdsWithCert.GetName(),
 			cert:     rdsWithCert.GetCA(),
 		},
+		{
+			desc:     "should download ElastiCache CA when it's not set",
+			database: elastiCacheServerless.GetName(),
+			cert:     fixtures.TLSCACertPEM,
+		},
+		{
+			desc:     "shouldn't download ElastiCache CA when it's set",
+			database: elastiCacheServerlessWithCert.GetName(),
+			cert:     elastiCacheServerlessWithCert.GetCA(),
+		},
 		{
 			desc:     "should download Redshift CA when it's not set",
 			database: redshift.GetName(),
@@ -519,7 +550,7 @@ func setupPostgres(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *tes
 	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.fakeCluster.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -564,7 +595,7 @@ func setupMySQL(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.fakeCluster.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -614,7 +645,7 @@ func setupMongo(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.fakeCluster.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
diff --git a/lib/srv/db/cassandra/engine.go b/lib/srv/db/cassandra/engine.go
index b28c476380d0e..09d330e7460c6 100644
--- a/lib/srv/db/cassandra/engine.go
+++ b/lib/srv/db/cassandra/engine.go
@@ -36,7 +36,6 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/cassandra/protocol"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -322,11 +321,3 @@ func (e *Engine) getAuth(sessionCtx *common.Session) (handshakeHandler, error) {
 func getEndpoint(db types.Database) string {
 	return db.GetURI()
 }
-
-// NewEndpointsResolver returns an endpoint resolver.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	uri := getEndpoint(db)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{uri}, nil
-	}), nil
-}
diff --git a/lib/srv/db/cassandra/handshake.go b/lib/srv/db/cassandra/handshake.go
index adcccaded08aa..692ddea999b33 100644
--- a/lib/srv/db/cassandra/handshake.go
+++ b/lib/srv/db/cassandra/handshake.go
@@ -21,7 +21,6 @@ package cassandra
 import (
 	"context"
 
-	"github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/sigv4"
 	"github.com/datastax/go-cassandra-native-protocol/frame"
 	"github.com/datastax/go-cassandra-native-protocol/message"
 	"github.com/datastax/go-cassandra-native-protocol/primitive"
@@ -30,6 +29,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/srv/db/cassandra/protocol"
+	"github.com/gravitational/teleport/lib/srv/db/cassandra/sigv4"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 )
@@ -219,11 +219,15 @@ func (a *authAWSSigV4Auth) getSigV4Authenticator(ctx context.Context) (gocql.Aut
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	auth := sigv4.NewAwsAuthenticator()
-	auth.Region = meta.Region
-	auth.AccessKeyId = cred.AccessKeyID
-	auth.SessionToken = cred.SessionToken
-	auth.SecretAccessKey = cred.SecretAccessKey
+	auth := sigv4.AwsAuthenticator{
+		// AWS Keyspaces databases do require region to be specified in the AWS
+		// metadata so there is no need to grab it from config or environment
+		// variables.
+		Region:          meta.Region,
+		AccessKeyId:     cred.AccessKeyID,
+		SessionToken:    cred.SessionToken,
+		SecretAccessKey: cred.SecretAccessKey,
+	}
 	return auth, nil
 }
 
diff --git a/lib/srv/db/cassandra/healthcheck.go b/lib/srv/db/cassandra/healthcheck.go
new file mode 100644
index 0000000000000..65f3644f65d47
--- /dev/null
+++ b/lib/srv/db/cassandra/healthcheck.go
@@ -0,0 +1,34 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cassandra
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker returns an endpoint health checker.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	uri := getEndpoint(cfg.Database)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{uri}, nil
+	}), nil
+}
diff --git a/lib/srv/db/cassandra/sigv4/crypt.go b/lib/srv/db/cassandra/sigv4/crypt.go
new file mode 100644
index 0000000000000..ee0bcf83a4e8c
--- /dev/null
+++ b/lib/srv/db/cassandra/sigv4/crypt.go
@@ -0,0 +1,113 @@
+/*
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License").
+ *  You may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+package sigv4
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+)
+
+// Note that this file is copied from the original lib:
+// https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/blob/3de2214b893e307a7447a754489e4d7dfdf6d0c0/sigv4/internal/crypt.go
+
+// extractNonce extracts the nonce from a request payload needed for calls from
+// payload returned by Amazon Keyspaces.
+func extractNonce(req []byte) (string, error) {
+	text := string(req)
+	if !strings.HasPrefix(text, "nonce=") {
+		return "", trace.Errorf("request does not contain nonce property")
+	}
+	nonce := strings.Split(text, "nonce=")[1]
+	return nonce, nil
+}
+
+// toCredDateStamp converts time to an aws credential timestamp
+// such as 2020-06-09T22:41:51.000Z -> '20200609'
+func toCredDateStamp(t time.Time) string {
+	return fmt.Sprintf("%d%02d%02d", t.Year(), t.Month(), t.Day())
+}
+
+// computeScope computes the scope to be used in the request
+func computeScope(t time.Time, region string) string {
+	a := []string{
+		toCredDateStamp(t),
+		region,
+		"cassandra",
+		"aws4_request"}
+	return strings.Join(a, "/")
+}
+
+func formCanonicalRequest(accessKeyId string, scope string, t time.Time, nonce string) string {
+	nonceHash := sha256.Sum256([]byte(nonce))
+	headers := []string{
+		"X-Amz-Algorithm=AWS4-HMAC-SHA256",
+		fmt.Sprintf("X-Amz-Credential=%s%%2F%s", accessKeyId, url.QueryEscape(scope)),
+		fmt.Sprintf("X-Amz-Date=%s", url.QueryEscape(t.Format("2006-01-02T15:04:05.000Z"))),
+		"X-Amz-Expires=900"}
+	sort.Strings(headers)
+	queryString := strings.Join(headers, "&")
+
+	return fmt.Sprintf("PUT\n/authenticate\n%s\nhost:cassandra\n\nhost\n%s", queryString, hex.EncodeToString(nonceHash[:]))
+}
+
+// applyHmac applies hmac with given string
+// useful as our protocol requires lots of iterative hmacs
+func applyHmac(data string, hashSecret []byte) []byte {
+	h := hmac.New(sha256.New, hashSecret)
+	h.Write([]byte(data))
+	return h.Sum(nil)
+}
+
+func deriveSigningKey(secret string, t time.Time, region string) []byte {
+	// we successively apply the hmac secret in multiple iterations rather then simply
+	// write it once (as per the Amazon Keyspaces protocol)
+	s := "AWS4" + secret
+	h := applyHmac(toCredDateStamp(t), []byte(s))
+	h = applyHmac(region, h)
+	h = applyHmac("cassandra", h)
+	h = applyHmac("aws4_request", h)
+	return h
+}
+
+func createSignature(canonicalRequest string, t time.Time, signingScope string, signingKey []byte) []byte {
+	digest := sha256.Sum256([]byte(canonicalRequest))
+	s := fmt.Sprintf("AWS4-HMAC-SHA256\n%s\n%s\n%s", t.Format("2006-01-02T15:04:05.000Z"), signingScope, hex.EncodeToString(digest[:]))
+	return applyHmac(s, signingKey)
+}
+
+// buildAWSSignedResponse creates response that can be sent for a SigV4
+// challenge this includes both the signature and the metadata supporting
+// signature.
+func buildSignedResponse(region string, nonce string, accessKeyId string, secret string, sessionToken string, t time.Time) string {
+	scope := computeScope(t, region)
+	canonicalRequest := formCanonicalRequest(accessKeyId, scope, t, nonce)
+	signingKey := deriveSigningKey(secret, t, region)
+	signature := createSignature(canonicalRequest, t, scope, signingKey)
+	result := fmt.Sprintf("signature=%s,access_key=%s,amzdate=%s", hex.EncodeToString(signature), accessKeyId, t.Format("2006-01-02T15:04:05.000Z"))
+	if sessionToken != "" {
+		result += fmt.Sprintf(",session_token=%s", sessionToken)
+	}
+	return result
+}
diff --git a/lib/srv/db/cassandra/sigv4/crypt_test.go b/lib/srv/db/cassandra/sigv4/crypt_test.go
new file mode 100644
index 0000000000000..1d887502aa990
--- /dev/null
+++ b/lib/srv/db/cassandra/sigv4/crypt_test.go
@@ -0,0 +1,108 @@
+/*
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License").
+ *  You may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+package sigv4
+
+import (
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Note that all of these tests are copied from the original library:
+// https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/blob/3de2214b893e307a7447a754489e4d7dfdf6d0c0/sigv4/internal/crypt_test.go
+
+const (
+	nonce       = "91703fdc2ef562e19fbdab0f58e42fe5"
+	region      = "us-west-2"
+	accessKeyId = "UserID-1"
+	secret      = "UserSecretKey-1"
+)
+
+// buildStdInstant produces arbitrary time 2020-06-09T22:41:51Z
+func buildStdInstant() time.Time {
+	result, _ := time.Parse(time.RFC3339, "2020-06-09T22:41:51Z")
+	return result
+}
+
+// TestExtractNonceSuccess tests we should switch to sigv4 when initially
+// challenged.
+func TestExtractNonceSuccess(t *testing.T) {
+	challenge := []byte("nonce=1256")
+	actualNonce, _ := extractNonce(challenge)
+	assert.Equal(t, "1256", actualNonce)
+}
+
+func TestExtractNonceMissing(t *testing.T) {
+	challenge := []byte("n1256")
+	_, err := extractNonce(challenge)
+	assert.Error(t, err)
+}
+
+func TestComputeScope(t *testing.T) {
+	scope := computeScope(buildStdInstant(), "us-west-2")
+	assert.Equal(t, "20200609/us-west-2/cassandra/aws4_request", scope)
+}
+
+func TestFormCanonicalRequest(t *testing.T) {
+	scope := "20200609/us-west-2/cassandra/aws4_request"
+	canonicalRequest := "PUT\n" +
+		"/authenticate\n" +
+		"X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=UserID-1%2F20200609%2Fus-west-2%2Fcassandra%2Faws4_request&X-Amz-Date=2020-06-09T22%3A41%3A51.000Z&X-Amz-Expires=900\n" +
+		"host:cassandra\n\n" +
+		"host\n" +
+		"ddf250111597b3f35e51e649f59e3f8b30ff5b247166d709dc1b1e60bd927070"
+
+	actual := formCanonicalRequest("UserID-1", scope, buildStdInstant(), nonce)
+	assert.Equal(t, canonicalRequest, actual)
+}
+
+func TestDeriveSigningKey(t *testing.T) {
+	expected := "7fb139473f153aec1b05747b0cd5cd77a1186d22ae895a3a0128e699d72e1aba"
+
+	actual := deriveSigningKey(secret, buildStdInstant(), region)
+	assert.Equal(t, expected, hex.EncodeToString(actual))
+}
+
+func TestCreateSignature(t *testing.T) {
+	signingKey, _ := hex.DecodeString("7fb139473f153aec1b05747b0cd5cd77a1186d22ae895a3a0128e699d72e1aba")
+	scope := "20200609/us-west-2/cassandra/aws4_request"
+	canonicalRequest := "PUT\n" +
+		"/authenticate\n" +
+		"X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=UserID-1%2F20200609%2Fus-west-2%2Fcassandra%2Faws4_request&X-Amz-Date=2020-06-09T22%3A41%3A51.000Z&X-Amz-Expires=900\n" +
+		"host:cassandra\n\n" +
+		"host\n" +
+		"ddf250111597b3f35e51e649f59e3f8b30ff5b247166d709dc1b1e60bd927070"
+
+	actual := createSignature(canonicalRequest, buildStdInstant(), scope, signingKey)
+	expected := "7f3691c18a81b8ce7457699effbfae5b09b4e0714ab38c1292dbdf082c9ddd87"
+	assert.Equal(t, expected, hex.EncodeToString(actual))
+}
+
+func TestBuildSignedResponse(t *testing.T) {
+	actual := buildSignedResponse(region, nonce, accessKeyId, secret, "", buildStdInstant())
+	expected := "signature=7f3691c18a81b8ce7457699effbfae5b09b4e0714ab38c1292dbdf082c9ddd87,access_key=UserID-1,amzdate=2020-06-09T22:41:51.000Z"
+	assert.Equal(t, expected, actual)
+}
+
+func TestBuildSignedResponseWithSessionToken(t *testing.T) {
+	sessionToken := "sess-token-1"
+	actual := buildSignedResponse(region, nonce, accessKeyId, secret, sessionToken, buildStdInstant())
+	expected := "signature=7f3691c18a81b8ce7457699effbfae5b09b4e0714ab38c1292dbdf082c9ddd87,access_key=UserID-1,amzdate=2020-06-09T22:41:51.000Z,session_token=sess-token-1"
+	assert.Equal(t, expected, actual)
+}
diff --git a/lib/srv/db/cassandra/sigv4/sigv4.go b/lib/srv/db/cassandra/sigv4/sigv4.go
new file mode 100644
index 0000000000000..6b74e7cf7b488
--- /dev/null
+++ b/lib/srv/db/cassandra/sigv4/sigv4.go
@@ -0,0 +1,101 @@
+/*
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License").
+ *  You may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+package sigv4
+
+import (
+	"time"
+
+	"github.com/gocql/gocql"
+	"github.com/gravitational/trace"
+)
+
+// Note that this file is copied from the original lib with some minor
+// adjustments like removing unused AWS session and callback:
+// https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/blob/3de2214b893e307a7447a754489e4d7dfdf6d0c0/sigv4/sigv4.go
+
+// AwsAuthenticator implements gocql.Authenticator for AWS Keyspaces.
+type AwsAuthenticator struct {
+	Region          string
+	AccessKeyId     string
+	SecretAccessKey string
+	SessionToken    string
+	currentTime     time.Time
+}
+
+func (a AwsAuthenticator) Challenge(req []byte) ([]byte, gocql.Authenticator, error) {
+	// copy these rather than use a reference due to how gocql creates connections (it's just
+	// safer if everything is a fresh copy).
+	auth := signingAuthenticator{
+		region:          a.Region,
+		accessKeyId:     a.AccessKeyId,
+		secretAccessKey: a.SecretAccessKey,
+		sessionToken:    a.SessionToken,
+		currentTime:     a.currentTime,
+	}
+	return []byte("SigV4\000\000"), auth, nil
+}
+
+func (a AwsAuthenticator) Success([]byte) error {
+	return nil
+}
+
+// signingAuthenticator is the internal private authenticator we actually use
+type signingAuthenticator struct {
+	region          string
+	accessKeyId     string
+	secretAccessKey string
+	sessionToken    string
+
+	// currentTime is mainly used for testing and not exposed
+	currentTime time.Time
+}
+
+func (p signingAuthenticator) Challenge(req []byte) ([]byte, gocql.Authenticator, error) {
+	nonce, err := extractNonce(req)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// init the time if not provided.
+	t := p.currentTime
+	if t.IsZero() {
+		t = time.Now().UTC()
+	}
+
+	accessKeyId := p.accessKeyId
+	secretAccessKey := p.secretAccessKey
+	sessionToken := p.sessionToken
+
+	signedResponse := buildSignedResponse(
+		p.region,
+		nonce,
+		accessKeyId,
+		secretAccessKey,
+		sessionToken,
+		t,
+	)
+
+	// copy this to a separate byte array to prevent some slicing corruption with how the framer object works
+	resp := make([]byte, len(signedResponse))
+	copy(resp, signedResponse)
+
+	return resp, nil, nil
+}
+
+func (p signingAuthenticator) Success([]byte) error {
+	return nil
+}
diff --git a/lib/srv/db/cassandra/sigv4/sigv4_test.go b/lib/srv/db/cassandra/sigv4/sigv4_test.go
new file mode 100644
index 0000000000000..ddebc96837e9c
--- /dev/null
+++ b/lib/srv/db/cassandra/sigv4/sigv4_test.go
@@ -0,0 +1,55 @@
+/*
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License").
+ *  You may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+package sigv4
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Note that all of these tests are copied from the original library:
+// https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/blob/3de2214b893e307a7447a754489e4d7dfdf6d0c0/sigv4/sigv4_test.go
+
+// We should switch to sigv4 when initially challenged
+func TestShouldReturnSigV4iInitially(t *testing.T) {
+	target := AwsAuthenticator{}
+	resp, _, _ := target.Challenge(nil)
+
+	assert.Equal(t, "SigV4\000\000", string(resp))
+}
+
+func TestShouldTranslate(t *testing.T) {
+	target := buildStdTarget()
+	_, challenger, _ := target.Challenge(nil)
+
+	stdNonce := []byte("nonce=91703fdc2ef562e19fbdab0f58e42fe5")
+	resp, _, _ := challenger.Challenge(stdNonce)
+	expected := "signature=7f3691c18a81b8ce7457699effbfae5b09b4e0714ab38c1292dbdf082c9ddd87,access_key=UserID-1,amzdate=2020-06-09T22:41:51.000Z"
+	assert.Equal(t, expected, string(resp))
+}
+
+func buildStdTarget() *AwsAuthenticator {
+	target := AwsAuthenticator{
+		Region:          "us-west-2",
+		AccessKeyId:     "UserID-1",
+		SecretAccessKey: "UserSecretKey-1",
+	}
+	target.currentTime, _ = time.Parse(time.RFC3339, "2020-06-09T22:41:51Z")
+	return &target
+}
diff --git a/lib/srv/db/cassandra/test.go b/lib/srv/db/cassandra/test.go
index 1593d2f4ba016..6a917d6a25f5c 100644
--- a/lib/srv/db/cassandra/test.go
+++ b/lib/srv/db/cassandra/test.go
@@ -38,7 +38,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // Session alias for easier use.
@@ -143,7 +143,7 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (*T
 		port:      port,
 		tlsConfig: tlsConfig,
 		server:    server,
-		logger: utils.NewSlogLoggerForTests().With(
+		logger: logtest.With(
 			teleport.ComponentKey, defaults.ProtocolCassandra,
 			"name", config.Name,
 		),
diff --git a/lib/srv/db/clickhouse/engine_http.go b/lib/srv/db/clickhouse/engine_http.go
index e2e0254246fb5..eb279ec4d7e05 100644
--- a/lib/srv/db/clickhouse/engine_http.go
+++ b/lib/srv/db/clickhouse/engine_http.go
@@ -21,27 +21,23 @@ package clickhouse
 import (
 	"bufio"
 	"bytes"
-	"cmp"
 	"compress/flate"
 	"compress/gzip"
 	"context"
 	"encoding/hex"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/url"
 
 	"github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/andybalholm/brotli"
 	"github.com/gravitational/trace"
-	"golang.org/x/net/http/httpproxy"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -231,32 +227,3 @@ func getURL(db types.Database) (*url.URL, error) {
 	u.Scheme = "https"
 	return u, nil
 }
-
-// NewHTTPEndpointsResolver resolves a ClickHouse HTTP endpoint from DB URI.
-func NewHTTPEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	dbURL, err := getURL(db)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Not all of our DB engines respect http proxy env vars, but this one does.
-	// The endpoint resolved for TCP health checks should be the one that the
-	// agent will actually connect to, since often proxy env vars are set to
-	// accommodate self-imposed network restrictions that force external traffic
-	// to go through a proxy.
-	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
-	proxyURL, err := proxyFunc(dbURL)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if proxyURL != nil {
-		dbURL = proxyURL
-	}
-	host := dbURL.Hostname()
-	port := cmp.Or(dbURL.Port(), "443")
-	hostPort := net.JoinHostPort(host, port)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{hostPort}, nil
-	}), nil
-}
diff --git a/lib/srv/db/clickhouse/engine_native.go b/lib/srv/db/clickhouse/engine_native.go
index e1ccbc73e97b9..1431aaa737c6c 100644
--- a/lib/srv/db/clickhouse/engine_native.go
+++ b/lib/srv/db/clickhouse/engine_native.go
@@ -27,7 +27,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -66,14 +65,3 @@ func getNativeEndpoint(db types.Database) (string, error) {
 	}
 	return u.Host, nil
 }
-
-// NewNativeEndpointsResolver resolves a ClickHouse native endpoint from DB URI.
-func NewNativeEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	endpoint, err := getNativeEndpoint(db)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{endpoint}, nil
-	}), nil
-}
diff --git a/lib/srv/db/clickhouse/healthcheck.go b/lib/srv/db/clickhouse/healthcheck.go
new file mode 100644
index 0000000000000..a1efb2f4134f0
--- /dev/null
+++ b/lib/srv/db/clickhouse/healthcheck.go
@@ -0,0 +1,71 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package clickhouse
+
+import (
+	"cmp"
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/net/http/httpproxy"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHTTPEndpointHealthChecker resolves a ClickHouse HTTP endpoint from DB URI.
+func NewHTTPEndpointHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	dbURL, err := getURL(cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Not all of our DB engines respect http proxy env vars, but this one does.
+	// The endpoint resolved for TCP health checks should be the one that the
+	// agent will actually connect to, since often proxy env vars are set to
+	// accommodate self-imposed network restrictions that force external traffic
+	// to go through a proxy.
+	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	proxyURL, err := proxyFunc(dbURL)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if proxyURL != nil {
+		dbURL = proxyURL
+	}
+	host := dbURL.Hostname()
+	port := cmp.Or(dbURL.Port(), "443")
+	hostPort := net.JoinHostPort(host, port)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{hostPort}, nil
+	}), nil
+}
+
+// NewNativeEndpointHealthChecker resolves a ClickHouse native endpoint from DB URI.
+func NewNativeEndpointHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	endpoint, err := getNativeEndpoint(cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{endpoint}, nil
+	}), nil
+}
diff --git a/lib/srv/db/clickhouse/test.go b/lib/srv/db/clickhouse/test.go
index 485d6db968a36..9e3a7bdb30b4a 100644
--- a/lib/srv/db/clickhouse/test.go
+++ b/lib/srv/db/clickhouse/test.go
@@ -37,7 +37,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestServerOption allows setting test server options.
@@ -93,7 +93,7 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (*T
 		listener:  config.Listener,
 		port:      port,
 		tlsConfig: tlsConfig,
-		logger: utils.NewSlogLoggerForTests().With(
+		logger: logtest.With(
 			teleport.ComponentKey, defaults.ProtocolClickHouse,
 			"name", config.Name,
 		),
diff --git a/lib/srv/db/cloud/iam.go b/lib/srv/db/cloud/iam.go
index 29f9ebd2ed6e3..f7bac088b8c75 100644
--- a/lib/srv/db/cloud/iam.go
+++ b/lib/srv/db/cloud/iam.go
@@ -207,6 +207,8 @@ func (c *IAM) isSetupRequiredForDatabase(ctx context.Context, database types.Dat
 			return true
 		}
 		return ok
+	case types.DatabaseTypeElastiCacheServerless:
+		return true
 	case types.DatabaseTypeMemoryDB:
 		ok, err := iam.CheckMemoryDBSupportsIAMAuth(database)
 		if err != nil {
@@ -322,10 +324,6 @@ func (c *IAM) processTask(ctx context.Context, task iamTask) error {
 			SemaphoreName: configurator.cfg.identity.GetName(),
 			MaxLeases:     1,
 			Holder:        c.cfg.HostID,
-
-			// If the semaphore fails to release for some reason, it will expire in a
-			// minute on its own.
-			Expires: c.cfg.Clock.Now().Add(time.Minute),
 		},
 
 		// Retry with some jitters up to twice of the semaphore expire time.
@@ -334,6 +332,11 @@ func (c *IAM) processTask(ctx context.Context, task iamTask) error {
 			Max:    2 * time.Minute,
 			Jitter: retryutils.HalfJitter,
 		},
+
+		// If the semaphore fails to release for some reason, it will expire in a
+		// minute on its own.
+		TTL: time.Minute,
+		Now: c.cfg.Clock.Now,
 	})
 	if err != nil {
 		c.iamPolicyStatus.Store(task.database.GetName(), types.IAMPolicyStatus_IAM_POLICY_STATUS_FAILED)
diff --git a/lib/srv/db/cloud/iam_test.go b/lib/srv/db/cloud/iam_test.go
index 7f3d01290b6e2..059c8c8985588 100644
--- a/lib/srv/db/cloud/iam_test.go
+++ b/lib/srv/db/cloud/iam_test.go
@@ -120,6 +120,20 @@ func TestAWSIAM(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	elasticacheServerlessDB, err := types.NewDatabaseV3(types.Metadata{
+		Name: "aws-elasticache-serverless",
+	}, types.DatabaseSpecV3{
+		Protocol: "redis",
+		URI:      "example.serverless.cac1.cache.amazonaws.com:6379",
+		AWS: types.AWS{
+			AccountID: "123456789012",
+			ElastiCacheServerless: types.ElastiCacheServerless{
+				CacheName: "example",
+			},
+		},
+	})
+	require.NoError(t, err)
+
 	memDB, err := types.NewDatabaseV3(types.Metadata{
 		Name: "aws-memorydb",
 	}, types.DatabaseSpecV3{
@@ -219,6 +233,13 @@ func TestAWSIAM(t *testing.T) {
 				return true // it always is for ElastiCache.
 			},
 		},
+		"ElastiCache Serverless": {
+			database:           elasticacheServerlessDB,
+			wantPolicyContains: elasticacheServerlessDB.GetAWS().ElastiCacheServerless.CacheName,
+			getIAMAuthEnabled: func() bool {
+				return true // it always is for ElastiCache.
+			},
+		},
 		"MemoryDB": {
 			database:           memDB,
 			wantPolicyContains: memDB.GetAWS().MemoryDB.ClusterName,
diff --git a/lib/srv/db/cloud/meta.go b/lib/srv/db/cloud/meta.go
index a9f8ea648e0a8..e3c635ebaf958 100644
--- a/lib/srv/db/cloud/meta.go
+++ b/lib/srv/db/cloud/meta.go
@@ -52,6 +52,7 @@ import (
 // elasticacheClient defines a subset of the AWS ElastiCache client API.
 type elasticacheClient interface {
 	elasticache.DescribeReplicationGroupsAPIClient
+	elasticache.DescribeServerlessCachesAPIClient
 }
 
 // iamClient defines a subset of the AWS IAM client API.
@@ -197,6 +198,8 @@ func (m *Metadata) Update(ctx context.Context, database types.Database) error {
 		return m.updateAWS(ctx, database, m.fetchRedshiftServerlessMetadata)
 	case types.DatabaseTypeElastiCache:
 		return m.updateAWS(ctx, database, m.fetchElastiCacheMetadata)
+	case types.DatabaseTypeElastiCacheServerless:
+		return m.updateAWS(ctx, database, m.fetchElastiCacheServerlessMetadata)
 	case types.DatabaseTypeMemoryDB:
 		return m.updateAWS(ctx, database, m.fetchMemoryDBMetadata)
 	}
@@ -339,6 +342,26 @@ func (m *Metadata) fetchElastiCacheMetadata(ctx context.Context, database types.
 	return discoverycommon.MetadataFromElastiCacheCluster(cluster, endpointType)
 }
 
+// fetchElastiCacheServerlessMetadata fetches metadata for the provided
+// ElastiCache serverless database.
+func (m *Metadata) fetchElastiCacheServerlessMetadata(ctx context.Context, database types.Database) (*types.AWS, error) {
+	meta := database.GetAWS()
+	awsCfg, err := m.cfg.AWSConfigProvider.GetConfig(ctx, meta.Region,
+		awsconfig.WithAssumeRole(meta.AssumeRoleARN, meta.ExternalID),
+		awsconfig.WithAmbientCredentials(),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	clt := m.cfg.awsClients.getElastiCacheClient(awsCfg)
+	cache, err := describeElastiCacheServerlessCache(ctx, clt, meta.ElastiCacheServerless.CacheName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return discoverycommon.MetadataFromElastiCacheServerlessCache(cache)
+}
+
 // fetchMemoryDBMetadata fetches metadata for the provided MemoryDB database.
 func (m *Metadata) fetchMemoryDBMetadata(ctx context.Context, database types.Database) (*types.AWS, error) {
 	meta := database.GetAWS()
@@ -430,11 +453,26 @@ func describeElastiCacheCluster(ctx context.Context, elastiCacheClient elasticac
 		return nil, common.ConvertError(err)
 	}
 	if len(out.ReplicationGroups) != 1 {
-		return nil, trace.BadParameter("expected 1 ElastiCache cluster for %v, got %+v", replicationGroupID, out.ReplicationGroups)
+		return nil, trace.BadParameter("expected 1 ElastiCache cluster for %v, got %d", replicationGroupID, len(out.ReplicationGroups))
 	}
 	return &out.ReplicationGroups[0], nil
 }
 
+// describeElastiCacheServerlessCache returns AWS ElastiCache Serverless Redis cache for the
+// specified ID.
+func describeElastiCacheServerlessCache(ctx context.Context, client elasticacheClient, name string) (*ectypes.ServerlessCache, error) {
+	out, err := client.DescribeServerlessCaches(ctx, &elasticache.DescribeServerlessCachesInput{
+		ServerlessCacheName: aws.String(name),
+	})
+	if err != nil {
+		return nil, common.ConvertError(err)
+	}
+	if len(out.ServerlessCaches) != 1 {
+		return nil, trace.BadParameter("expected 1 ElastiCache Serverless cache for %v, got %d", name, len(out.ServerlessCaches))
+	}
+	return &out.ServerlessCaches[0], nil
+}
+
 // describeMemoryDBCluster returns AWS MemoryDB cluster for the specified ID.
 func describeMemoryDBCluster(ctx context.Context, client memoryDBClient, clusterName string) (*memorydbtypes.Cluster, error) {
 	out, err := client.DescribeClusters(ctx, &memorydb.DescribeClustersInput{
diff --git a/lib/srv/db/cloud/meta_test.go b/lib/srv/db/cloud/meta_test.go
index 46ef553afb297..75fca53e2f335 100644
--- a/lib/srv/db/cloud/meta_test.go
+++ b/lib/srv/db/cloud/meta_test.go
@@ -110,6 +110,13 @@ func TestAWSMetadata(t *testing.T) {
 				UserGroupIds:             []string{"my-user-group"},
 			},
 		},
+		Caches: []ectypes.ServerlessCache{
+			{
+				ARN:                 aws.String("arn:aws:elasticache:ca-central-1:123456789012:serverlesscache:my-serverless-example"),
+				ServerlessCacheName: aws.String("my-serverless-example"),
+				UserGroupId:         aws.String("my-serverless-user-group"),
+			},
+		},
 	}
 
 	// Configure MemoryDB API mock.
@@ -276,6 +283,25 @@ func TestAWSMetadata(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "ElastiCacheServerless",
+			inAWS: types.AWS{
+				AssumeRoleARN: "arn:aws:iam::123456789012:role/DBDiscoverer",
+				ExternalID:    "externalID123",
+				ElastiCacheServerless: types.ElastiCacheServerless{
+					CacheName: "my-serverless-example",
+				},
+			},
+			outAWS: types.AWS{
+				AccountID:     "123456789012",
+				Region:        "ca-central-1",
+				AssumeRoleARN: "arn:aws:iam::123456789012:role/DBDiscoverer",
+				ExternalID:    "externalID123",
+				ElastiCacheServerless: types.ElastiCacheServerless{
+					CacheName: "my-serverless-example",
+				},
+			},
+		},
 		{
 			name: "MemoryDB",
 			inAWS: types.AWS{
diff --git a/lib/srv/db/cloud/resource_checker.go b/lib/srv/db/cloud/resource_checker.go
index 85cd9df8a47fc..0b566b511989e 100644
--- a/lib/srv/db/cloud/resource_checker.go
+++ b/lib/srv/db/cloud/resource_checker.go
@@ -26,8 +26,8 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -46,7 +46,7 @@ type DiscoveryResourceCheckerConfig struct {
 	// ResourceMatchers is a list of database resource matchers.
 	ResourceMatchers []services.ResourceMatcher
 	// AzureClients is an interface for retrieving Azure cloud clients.
-	AzureClients cloud.AzureClients
+	AzureClients azure.Clients
 	// Context is the database server close context.
 	Context context.Context
 	// Logger is used for logging.
@@ -56,11 +56,11 @@ type DiscoveryResourceCheckerConfig struct {
 // CheckAndSetDefaults validates the config and sets default values.
 func (c *DiscoveryResourceCheckerConfig) CheckAndSetDefaults() error {
 	if c.AzureClients == nil {
-		cloudClients, err := cloud.NewClients()
+		azureClients, err := azure.NewClients()
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		c.AzureClients = cloudClients
+		c.AzureClients = azureClients
 	}
 	if c.AWSConfigProvider == nil {
 		return trace.BadParameter("missing AWSConfigProvider")
diff --git a/lib/srv/db/cloud/resource_checker_credentials.go b/lib/srv/db/cloud/resource_checker_credentials.go
index 1e3854d32bd97..00ed140cf4bdc 100644
--- a/lib/srv/db/cloud/resource_checker_credentials.go
+++ b/lib/srv/db/cloud/resource_checker_credentials.go
@@ -28,9 +28,9 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -43,7 +43,7 @@ import (
 type credentialsChecker struct {
 	awsConfigProvider awsconfig.Provider
 	awsClients        awsClientProvider
-	azureClients      cloud.AzureClients
+	azureClients      azure.Clients
 	resourceMatchers  []services.ResourceMatcher
 	logger            *slog.Logger
 	cache             *utils.FnCache
@@ -128,7 +128,7 @@ func (c *credentialsChecker) getAWSIdentity(ctx context.Context, meta *types.AWS
 
 func (c *credentialsChecker) checkAzure(ctx context.Context, database types.Database) {
 	allSubIDs, err := utils.FnCacheGet(ctx, c.cache, types.CloudAzure, func(ctx context.Context) ([]string, error) {
-		client, err := c.azureClients.GetAzureSubscriptionClient()
+		client, err := c.azureClients.GetSubscriptionClient(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/srv/db/cloud/resource_checker_url.go b/lib/srv/db/cloud/resource_checker_url.go
index 10200c71f8e58..2303f07738a5e 100644
--- a/lib/srv/db/cloud/resource_checker_url.go
+++ b/lib/srv/db/cloud/resource_checker_url.go
@@ -98,16 +98,17 @@ func convIsEndpoint(isEndpoint isEndpointFunc) checkDatabaseFunc {
 // Check permforms url checks.
 func (c *urlChecker) Check(ctx context.Context, database types.Database) error {
 	checkersByDatabaseType := map[string]checkDatabaseFunc{
-		types.DatabaseTypeRDS:                c.checkAWS(c.checkRDS, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
-		types.DatabaseTypeRDSOracle:          c.checkAWS(c.checkRDS, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
-		types.DatabaseTypeRDSProxy:           c.checkAWS(c.checkRDSProxy, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
-		types.DatabaseTypeRedshift:           c.checkAWS(c.checkRedshift, convIsEndpoint(apiawsutils.IsRedshiftEndpoint)),
-		types.DatabaseTypeRedshiftServerless: c.checkAWS(c.checkRedshiftServerless, convIsEndpoint(apiawsutils.IsRedshiftServerlessEndpoint)),
-		types.DatabaseTypeElastiCache:        c.checkAWS(c.checkElastiCache, convIsEndpoint(apiawsutils.IsElastiCacheEndpoint)),
-		types.DatabaseTypeMemoryDB:           c.checkAWS(c.checkMemoryDB, convIsEndpoint(apiawsutils.IsMemoryDBEndpoint)),
-		types.DatabaseTypeOpenSearch:         c.checkAWS(c.checkOpenSearch, c.checkOpenSearchEndpoint),
-		types.DatabaseTypeDocumentDB:         c.checkAWS(c.checkDocumentDB, convIsEndpoint(apiawsutils.IsDocumentDBEndpoint)),
-		types.DatabaseTypeAzure:              c.checkAzure,
+		types.DatabaseTypeRDS:                   c.checkAWS(c.checkRDS, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
+		types.DatabaseTypeRDSOracle:             c.checkAWS(c.checkRDS, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
+		types.DatabaseTypeRDSProxy:              c.checkAWS(c.checkRDSProxy, convIsEndpoint(apiawsutils.IsRDSEndpoint)),
+		types.DatabaseTypeRedshift:              c.checkAWS(c.checkRedshift, convIsEndpoint(apiawsutils.IsRedshiftEndpoint)),
+		types.DatabaseTypeRedshiftServerless:    c.checkAWS(c.checkRedshiftServerless, convIsEndpoint(apiawsutils.IsRedshiftServerlessEndpoint)),
+		types.DatabaseTypeElastiCache:           c.checkAWS(c.checkElastiCache, convIsEndpoint(apiawsutils.IsElastiCacheEndpoint)),
+		types.DatabaseTypeElastiCacheServerless: c.checkAWS(c.checkElastiCacheServerless, convIsEndpoint(apiawsutils.IsElastiCacheServerlessEndpoint)),
+		types.DatabaseTypeMemoryDB:              c.checkAWS(c.checkMemoryDB, convIsEndpoint(apiawsutils.IsMemoryDBEndpoint)),
+		types.DatabaseTypeOpenSearch:            c.checkAWS(c.checkOpenSearch, c.checkOpenSearchEndpoint),
+		types.DatabaseTypeDocumentDB:            c.checkAWS(c.checkDocumentDB, convIsEndpoint(apiawsutils.IsDocumentDBEndpoint)),
+		types.DatabaseTypeAzure:                 c.checkAzure,
 	}
 
 	if check := checkersByDatabaseType[database.GetType()]; check != nil {
diff --git a/lib/srv/db/cloud/resource_checker_url_aws.go b/lib/srv/db/cloud/resource_checker_url_aws.go
index 0e9bb81cca895..d9c54ebe6bd93 100644
--- a/lib/srv/db/cloud/resource_checker_url_aws.go
+++ b/lib/srv/db/cloud/resource_checker_url_aws.go
@@ -234,6 +234,27 @@ func (c *urlChecker) checkElastiCache(ctx context.Context, database types.Databa
 	return trace.Wrap(requireContainsDatabaseURLAndEndpointType(databases, database, cluster))
 }
 
+func (c *urlChecker) checkElastiCacheServerless(ctx context.Context, database types.Database) error {
+	meta := database.GetAWS()
+	awsCfg, err := c.awsConfigProvider.GetConfig(ctx, meta.Region,
+		awsconfig.WithAssumeRole(meta.AssumeRoleARN, meta.ExternalID),
+		awsconfig.WithAmbientCredentials(),
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	clt := c.awsClients.getElastiCacheClient(awsCfg)
+	cache, err := describeElastiCacheServerlessCache(ctx, clt, meta.ElastiCacheServerless.CacheName)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	fetchedDB, err := common.NewDatabaseFromElastiCacheServerlessCache(cache, nil)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(requireContainsDatabaseURLAndEndpointType(types.Databases{fetchedDB}, database, cache))
+}
+
 func (c *urlChecker) checkMemoryDB(ctx context.Context, database types.Database) error {
 	meta := database.GetAWS()
 	awsCfg, err := c.awsConfigProvider.GetConfig(ctx, meta.Region,
diff --git a/lib/srv/db/cloud/resource_checker_url_aws_test.go b/lib/srv/db/cloud/resource_checker_url_aws_test.go
index 754879b78eb47..745b9f6742dff 100644
--- a/lib/srv/db/cloud/resource_checker_url_aws_test.go
+++ b/lib/srv/db/cloud/resource_checker_url_aws_test.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
 	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
 	memorydbtypes "github.com/aws/aws-sdk-go-v2/service/memorydb/types"
 	opensearchtypes "github.com/aws/aws-sdk-go-v2/service/opensearch/types"
@@ -35,7 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestURLChecker_AWS(t *testing.T) {
@@ -92,6 +93,15 @@ func TestURLChecker_AWS(t *testing.T) {
 	require.NoError(t, err)
 	testCases = append(testCases, append(elastiCacheClusterDBs, elastiCacheClusterConfigurationModeDB)...)
 
+	// ElastiCache Serverless.
+	elastiCacheServerlessCache := mocks.ElastiCacheServerless("ec-serverless-redis", region)
+	elastiCacheServerlessCacheDB, err := common.NewDatabaseFromElastiCacheServerlessCache(elastiCacheServerlessCache, nil)
+	require.NoError(t, err)
+	elastiCacheServerlessValkeyCache := mocks.ElastiCacheServerless("ec-serverless-valkey", region, func(c *ectypes.ServerlessCache) { c.Engine = aws.String("valkey") })
+	elastiCacheServerlessValkeyCacheDB, err := common.NewDatabaseFromElastiCacheServerlessCache(elastiCacheServerlessValkeyCache, nil)
+	require.NoError(t, err)
+	testCases = append(testCases, elastiCacheServerlessCacheDB, elastiCacheServerlessValkeyCacheDB)
+
 	// MemoryDB.
 	memoryDBCluster := mocks.MemoryDBCluster("memorydb", region)
 	memoryDBClusterDB, err := common.NewDatabaseFromMemoryDBCluster(memoryDBCluster, nil)
@@ -132,6 +142,7 @@ func TestURLChecker_AWS(t *testing.T) {
 			awsClients: fakeAWSClients{
 				ecClient: &mocks.ElastiCacheClient{
 					ReplicationGroups: []ectypes.ReplicationGroup{*elastiCacheClusterConfigurationMode, *elastiCacheCluster},
+					Caches:            []ectypes.ServerlessCache{*elastiCacheServerlessCache, *elastiCacheServerlessValkeyCache},
 				},
 				mdbClient: &mocks.MemoryDBClient{
 					Clusters: []memorydbtypes.Cluster{*memoryDBCluster},
@@ -172,7 +183,7 @@ func TestURLChecker_AWS(t *testing.T) {
 		t.Run(method.name, func(t *testing.T) {
 			c := newURLChecker(DiscoveryResourceCheckerConfig{
 				AWSConfigProvider: method.awsConfigProvider,
-				Logger:            utils.NewSlogLoggerForTests(),
+				Logger:            logtest.NewLogger(),
 			})
 			c.awsClients = method.awsClients
 
diff --git a/lib/srv/db/cloud/resource_checker_url_azure_test.go b/lib/srv/db/cloud/resource_checker_url_azure_test.go
index 910cdc10a020e..6e039a1b8b234 100644
--- a/lib/srv/db/cloud/resource_checker_url_azure_test.go
+++ b/lib/srv/db/cloud/resource_checker_url_azure_test.go
@@ -26,7 +26,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestURLChecker_Azure(t *testing.T) {
@@ -47,7 +47,7 @@ func TestURLChecker_Azure(t *testing.T) {
 	}
 
 	c := newURLChecker(DiscoveryResourceCheckerConfig{
-		Logger: utils.NewSlogLoggerForTests(),
+		Logger: logtest.NewLogger(),
 	})
 	for _, database := range testCases {
 		t.Run(database.GetName(), func(t *testing.T) {
diff --git a/lib/srv/db/cloud/users/users_test.go b/lib/srv/db/cloud/users/users_test.go
index 937e85f267225..9b21756e48823 100644
--- a/lib/srv/db/cloud/users/users_test.go
+++ b/lib/srv/db/cloud/users/users_test.go
@@ -40,11 +40,11 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/secrets"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/srv/db/common/audit.go b/lib/srv/db/common/audit.go
index 4ade27fa861a3..7578636b4d02d 100644
--- a/lib/srv/db/common/audit.go
+++ b/lib/srv/db/common/audit.go
@@ -30,6 +30,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	libevents "github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // Audit defines an interface for database access audit events logger.
@@ -171,10 +172,20 @@ func (a *audit) OnSessionEnd(ctx context.Context, session *Session) {
 		Metadata: MakeEventMetadata(session,
 			libevents.DatabaseSessionEndEvent,
 			libevents.DatabaseSessionEndCode),
-		UserMetadata:     MakeUserMetadata(session),
-		SessionMetadata:  MakeSessionMetadata(session),
-		DatabaseMetadata: MakeDatabaseMetadata(session),
-		StartTime:        session.StartTime,
+		UserMetadata:       MakeUserMetadata(session),
+		SessionMetadata:    MakeSessionMetadata(session),
+		ConnectionMetadata: MakeConnectionMetadata(session),
+		DatabaseMetadata:   MakeDatabaseMetadata(session),
+		StartTime:          session.StartTime,
+		Participants: []string{
+			services.UsernameForCluster(
+				services.UsernameForClusterConfig{
+					User:              session.Identity.Username,
+					OriginClusterName: session.Identity.OriginClusterName,
+					LocalClusterName:  session.Identity.TeleportCluster,
+				},
+			),
+		},
 	}
 	endTime := a.cfg.Clock.Now()
 	event.SetTime(endTime)
@@ -373,6 +384,15 @@ func MakeUserMetadata(session *Session) events.UserMetadata {
 	return session.Identity.GetUserMetadata()
 }
 
+// MakeConnectionMetadata returns common connection metadata for database session.
+func MakeConnectionMetadata(session *Session) events.ConnectionMetadata {
+	return events.ConnectionMetadata{
+		RemoteAddr: session.ClientIP,
+		LocalAddr:  session.Database.GetURI(),
+		Protocol:   libevents.EventProtocolDB,
+	}
+}
+
 // MakeSessionMetadata returns common session metadata for database session.
 func MakeSessionMetadata(session *Session) events.SessionMetadata {
 	return events.SessionMetadata{
@@ -387,6 +407,7 @@ func MakeDatabaseMetadata(session *Session) events.DatabaseMetadata {
 	return events.DatabaseMetadata{
 		DatabaseService:  session.Database.GetName(),
 		DatabaseProtocol: session.Database.GetProtocol(),
+		DatabaseLabels:   session.Database.GetAllLabels(),
 		DatabaseURI:      session.Database.GetURI(),
 		DatabaseName:     session.DatabaseName,
 		DatabaseUser:     session.DatabaseUser,
diff --git a/lib/srv/db/common/auth.go b/lib/srv/db/common/auth.go
index f7eeef95ca306..c3f5ed02243a7 100644
--- a/lib/srv/db/common/auth.go
+++ b/lib/srv/db/common/auth.go
@@ -51,11 +51,12 @@ import (
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/cloud"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
-	libazure "github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/imds"
+	azureimds "github.com/gravitational/teleport/lib/cloud/imds/azure"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	dbiam "github.com/gravitational/teleport/lib/srv/db/common/iam"
@@ -85,6 +86,8 @@ type Auth interface {
 	GetMemoryDBToken(ctx context.Context, database types.Database, databaseUser string) (string, error)
 	// GetCloudSQLAuthToken generates Cloud SQL auth token.
 	GetCloudSQLAuthToken(ctx context.Context, databaseUser string) (string, error)
+	// GetAlloyDBAuthToken generates AlloyDB auth token.
+	GetAlloyDBAuthToken(ctx context.Context, databaseUser string) (string, error)
 	// GetSpannerTokenSource returns an oauth token source for GCP Spanner.
 	GetSpannerTokenSource(ctx context.Context, databaseUser string) (oauth2.TokenSource, error)
 	// GetCloudSQLPassword generates password for a Cloud SQL database user.
@@ -169,17 +172,23 @@ type AuthConfig struct {
 	AuthClient AuthClient
 	// AccessPoint is a caching client connected to the Auth Server.
 	AccessPoint AccessPoint
-	// Clients provides interface for obtaining cloud provider clients.
-	Clients cloud.Clients
+
 	// Clock is the clock implementation.
 	Clock clockwork.Clock
 	// Logger is used for logging.
 	Logger *slog.Logger
+
+	// AzureClients provides Azure SDK clients.
+	AzureClients azure.Clients
+	// GCPClients provides GCP SDK clients.
+	GCPClients gcp.Clients
 	// AWSConfigProvider provides [aws.Config] for AWS SDK service clients.
 	AWSConfigProvider awsconfig.Provider
-
 	// awsClients is an SDK client provider.
 	awsClients awsClientProvider
+
+	// azureIMDSClient is an optional IMDS client, overridden in tests.
+	azureIMDSClient imds.Client
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
@@ -190,8 +199,11 @@ func (c *AuthConfig) CheckAndSetDefaults() error {
 	if c.AccessPoint == nil {
 		return trace.BadParameter("missing AccessPoint")
 	}
-	if c.Clients == nil {
-		return trace.BadParameter("missing Clients")
+	if c.AzureClients == nil {
+		return trace.BadParameter("missing AzureClients")
+	}
+	if c.GCPClients == nil {
+		return trace.BadParameter("missing GCPClients")
 	}
 	if c.AWSConfigProvider == nil {
 		return trace.BadParameter("missing AWSConfigProvider")
@@ -206,6 +218,9 @@ func (c *AuthConfig) CheckAndSetDefaults() error {
 	if c.awsClients == nil {
 		c.awsClients = defaultAWSClients{}
 	}
+	if c.azureIMDSClient == nil {
+		c.azureIMDSClient = azureimds.NewInstanceMetadataClient()
+	}
 	return nil
 }
 
@@ -483,6 +498,24 @@ func (a *dbAuth) GetCloudSQLAuthToken(ctx context.Context, databaseUser string)
 	return tok.AccessToken, nil
 }
 
+// GetAlloyDBAuthToken returns authorization token that will be used as a
+// password when connecting to AlloyDB databases.
+func (a *dbAuth) GetAlloyDBAuthToken(ctx context.Context, databaseUser string) (string, error) {
+	// https://cloud.google.com/alloydb/docs/connect-iam#procedure
+	scopes := []string{
+		"https://www.googleapis.com/auth/alloydb.login",
+	}
+	ts, err := a.getCloudTokenSource(ctx, databaseUser, scopes)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	tok, err := ts.Token()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return tok.AccessToken, nil
+}
+
 // GetSpannerTokenSource returns an oauth token source for GCP Spanner.
 func (a *dbAuth) GetSpannerTokenSource(ctx context.Context, databaseUser string) (oauth2.TokenSource, error) {
 	// https://developers.google.com/identity/protocols/oauth2/scopes#spanner
@@ -498,7 +531,7 @@ func (a *dbAuth) GetSpannerTokenSource(ctx context.Context, databaseUser string)
 }
 
 func (a *dbAuth) getCloudTokenSource(ctx context.Context, databaseUser string, scopes []string) (*cloudTokenSource, error) {
-	gcpIAM, err := a.cfg.Clients.GetGCPIAMClient(ctx)
+	gcpIAM, err := a.cfg.GCPClients.GetIAMClient(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -566,7 +599,7 @@ or "iam.serviceAccounts.getAccessToken" IAM permission.
 // It is used to generate a one-time password when connecting to GCP MySQL
 // databases which don't support IAM authentication.
 func (a *dbAuth) GetCloudSQLPassword(ctx context.Context, database types.Database, databaseUser string) (string, error) {
-	gcpCloudSQL, err := a.cfg.Clients.GetGCPSQLAdminClient(ctx)
+	gcpCloudSQL, err := a.cfg.GCPClients.GetSQLAdminClient(ctx)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -627,7 +660,7 @@ SQL Admin" GCP IAM role, or "cloudsql.users.update" IAM permission.
 // GetAzureAccessToken generates Azure database access token.
 func (a *dbAuth) GetAzureAccessToken(ctx context.Context) (string, error) {
 	a.cfg.Logger.DebugContext(ctx, "Generating Azure access token")
-	cred, err := a.cfg.Clients.GetAzureCredential()
+	cred, err := a.cfg.AzureClients.GetCredential(ctx)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -666,6 +699,10 @@ func (a *dbAuth) GetElastiCacheRedisToken(ctx context.Context, database types.Da
 		region:       meta.Region,
 		credProvider: awsCfg.Credentials,
 		clock:        a.cfg.Clock,
+		isServerless: database.IsElastiCacheServerless(),
+	}
+	if tokenReq.isServerless {
+		tokenReq.targetID = meta.ElastiCacheServerless.CacheName
 	}
 	token, err := tokenReq.toSignedRequestURI(ctx)
 	return token, trace.Wrap(err)
@@ -704,15 +741,15 @@ func (a *dbAuth) GetAzureCacheForRedisToken(ctx context.Context, database types.
 		return "", trace.Wrap(err)
 	}
 
-	var client libazure.CacheForRedisClient
+	var client azure.CacheForRedisClient
 	switch resourceID.ResourceType.String() {
 	case "Microsoft.Cache/Redis":
-		client, err = a.cfg.Clients.GetAzureRedisClient(resourceID.SubscriptionID)
+		client, err = a.cfg.AzureClients.GetRedisClient(ctx, resourceID.SubscriptionID)
 		if err != nil {
 			return "", trace.Wrap(err)
 		}
 	case "Microsoft.Cache/redisEnterprise", "Microsoft.Cache/redisEnterprise/databases":
-		client, err = a.cfg.Clients.GetAzureRedisEnterpriseClient(resourceID.SubscriptionID)
+		client, err = a.cfg.AzureClients.GetRedisEnterpriseClient(ctx, resourceID.SubscriptionID)
 		if err != nil {
 			return "", trace.Wrap(err)
 		}
@@ -932,9 +969,15 @@ func shouldUseSystemCertPool(database types.Database) bool {
 	case types.DatabaseTypeOpenSearch:
 		// OpenSearch is commonly hosted on AWS and uses Amazon Root CAs.
 		return true
+
 	case types.DatabaseTypeSpanner:
 		// Spanner is hosted on GCP.
 		return true
+
+	case types.DatabaseTypeMongoAtlas:
+		// Atlas may use either Let's Encrypt or Google GTS Root R3/R4:
+		// https://www.mongodb.com/docs/atlas/reference/faq/security/
+		return true
 	}
 	return false
 }
@@ -953,6 +996,11 @@ func setupTLSConfigServerName(tlsConfig *tls.Config, database types.Database) er
 		return nil
 	}
 
+	if database.GetType() == types.DatabaseTypeAlloyDB {
+		// The server name will be configured dynamically by the engine.
+		return nil
+	}
+
 	switch database.GetProtocol() {
 	case defaults.ProtocolMongoDB:
 		// Don't set the ServerName when connecting to a MongoDB cluster - in case
@@ -1104,17 +1152,8 @@ func (a *dbAuth) GetAzureIdentityResourceID(ctx context.Context, identityName st
 
 // getCurrentAzureVM fetches current Azure Virtual Machine struct. If Teleport
 // is not running on Azure, returns an error.
-func (a *dbAuth) getCurrentAzureVM(ctx context.Context) (*libazure.VirtualMachine, error) {
-	metadataClient, err := a.cfg.Clients.GetInstanceMetadataClient(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if metadataClient.GetType() != types.InstanceMetadataTypeAzure {
-		return nil, trace.BadParameter("fetching Azure identity resource ID is only supported on Azure")
-	}
-
-	instanceID, err := metadataClient.GetID(ctx)
+func (a *dbAuth) getCurrentAzureVM(ctx context.Context) (*azure.VirtualMachine, error) {
+	instanceID, err := a.cfg.azureIMDSClient.GetID(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1124,7 +1163,7 @@ func (a *dbAuth) getCurrentAzureVM(ctx context.Context) (*libazure.VirtualMachin
 		return nil, trace.Wrap(err)
 	}
 
-	vmClient, err := a.cfg.Clients.GetAzureVirtualMachinesClient(parsedInstanceID.SubscriptionID)
+	vmClient, err := a.cfg.AzureClients.GetVirtualMachinesClient(ctx, parsedInstanceID.SubscriptionID)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1202,7 +1241,7 @@ func (a *dbAuth) GetAWSIAMCreds(ctx context.Context, database types.Database, da
 
 // Close releases all resources used by authenticator.
 func (a *dbAuth) Close() error {
-	return a.cfg.Clients.Close()
+	return a.cfg.GCPClients.Close()
 }
 
 // getVerifyCloudSQLCertificate returns a function that performs verification
@@ -1267,10 +1306,12 @@ func externalIDForChainedAssumeRole(meta types.AWS) string {
 type awsRedisIAMTokenRequest struct {
 	// userID is the ElastiCache user ID.
 	userID string
-	// targetID is the ElastiCache replication group ID or the MemoryDB cluster name.
+	// targetID is the ElastiCache replication group ID or the MemoryDB cluster name or a serverless cache ID.
 	targetID string
 	// region is the AWS region.
 	region string
+	// isServerless is true if the request is for ElastiCache serverless.
+	isServerless bool
 	// credProvider are used to presign with AWS SigV4.
 	credProvider aws.CredentialsProvider
 	// clock is the clock implementation.
@@ -1328,8 +1369,13 @@ func (r *awsRedisIAMTokenRequest) toSignedRequestURI(ctx context.Context) (strin
 // getSignableRequest creates a new request suitable for pre-signing with SigV4.
 func (r *awsRedisIAMTokenRequest) getSignableRequest() (*http.Request, error) {
 	query := url.Values{
-		"Action": {"connect"},
-		"User":   {r.userID},
+		"Action":        {"connect"},
+		"User":          {r.userID},
+		"X-Amz-Expires": {"900"},
+	}
+	if r.isServerless {
+		// https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html
+		query.Add("ResourceType", "ServerlessCache")
 	}
 	reqURI := url.URL{
 		Scheme:   "http",
diff --git a/lib/srv/db/common/auth_test.go b/lib/srv/db/common/auth_test.go
index 3819d3a1f0487..3f5014f7af475 100644
--- a/lib/srv/db/common/auth_test.go
+++ b/lib/srv/db/common/auth_test.go
@@ -19,6 +19,7 @@
 package common
 
 import (
+	"cmp"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -30,27 +31,30 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/redshift"
 	rss "github.com/aws/aws-sdk-go-v2/service/redshiftserverless"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
-	libcloudazure "github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	"github.com/gravitational/teleport/lib/cloud/imds"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -60,14 +64,16 @@ func TestAuthGetAzureCacheForRedisToken(t *testing.T) {
 	auth, err := NewAuth(AuthConfig{
 		AuthClient:  new(authClientMock),
 		AccessPoint: new(accessPointMock),
-		Clients: &cloud.TestCloudClients{
-			AzureRedis: libcloudazure.NewRedisClientByAPI(&libcloudazure.ARMRedisMock{
+		AzureClients: &azuretest.Clients{
+			AzureRedis: azure.NewRedisClientByAPI(&azure.ARMRedisMock{
 				Token: "azure-redis-token",
 			}),
-			AzureRedisEnterprise: libcloudazure.NewRedisEnterpriseClientByAPI(nil, &libcloudazure.ARMRedisEnterpriseDatabaseMock{
+			AzureRedisEnterprise: azure.NewRedisEnterpriseClientByAPI(nil, &azure.ARMRedisEnterpriseDatabaseMock{
 				Token: "azure-redis-enterprise-token",
 			}),
 		},
+		GCPClients: &gcptest.Clients{},
+
 		AWSConfigProvider: &mocks.AWSConfigProvider{},
 	})
 	require.NoError(t, err)
@@ -122,7 +128,8 @@ func TestAuthGetRedshiftServerlessAuthToken(t *testing.T) {
 		Clock:             clock,
 		AuthClient:        new(authClientMock),
 		AccessPoint:       new(accessPointMock),
-		Clients:           &cloud.TestCloudClients{},
+		AzureClients:      &azuretest.Clients{},
+		GCPClients:        &gcptest.Clients{},
 		AWSConfigProvider: &mocks.AWSConfigProvider{STSClient: stsMock},
 		awsClients: fakeAWSClients{
 			rssClient: &mocks.RedshiftServerlessClient{
@@ -150,7 +157,8 @@ func TestAuthGetTLSConfig(t *testing.T) {
 	auth, err := NewAuth(AuthConfig{
 		AuthClient:        new(authClientMock),
 		AccessPoint:       new(accessPointMock),
-		Clients:           &cloud.TestCloudClients{},
+		AzureClients:      &azuretest.Clients{},
+		GCPClients:        &gcptest.Clients{},
 		AWSConfigProvider: &mocks.AWSConfigProvider{},
 	})
 	require.NoError(t, err)
@@ -242,6 +250,12 @@ func TestAuthGetTLSConfig(t *testing.T) {
 			expectServerName: "my-postgres.postgres.database.azure.com",
 			expectRootCAs:    systemCertPoolWithCA,
 		},
+		{
+			name:                     "MongoDB Atlas with downloaded CA",
+			sessionDatabase:          newMongoAtlasDatabaseWithCA(t, fixtures.TLSCACertPEM),
+			expectClientCertificates: true,
+			expectRootCAs:            systemCertPoolWithCA,
+		},
 	}
 
 	for _, test := range tests {
@@ -252,44 +266,43 @@ func TestAuthGetTLSConfig(t *testing.T) {
 				"defaultUser")
 			require.NoError(t, err)
 
-			require.Equal(t, test.expectServerName, tlsConfig.ServerName)
-			require.Equal(t, test.expectInsecureSkipVerify, tlsConfig.InsecureSkipVerify)
-			require.True(t, test.expectRootCAs.Equal(tlsConfig.RootCAs))
+			assert.Equal(t, test.expectServerName, tlsConfig.ServerName)
+			assert.Equal(t, test.expectInsecureSkipVerify, tlsConfig.InsecureSkipVerify)
+			assert.True(t, test.expectRootCAs.Equal(tlsConfig.RootCAs))
 
 			if test.expectClientCertificates {
-				require.Len(t, tlsConfig.Certificates, 1)
+				assert.Len(t, tlsConfig.Certificates, 1)
 			} else {
-				require.Empty(t, tlsConfig.Certificates)
+				assert.Empty(t, tlsConfig.Certificates)
 			}
 
 			if test.expectVerifyConnection {
-				require.NotNil(t, tlsConfig.VerifyConnection)
+				assert.NotNil(t, tlsConfig.VerifyConnection)
 			} else {
-				require.Nil(t, tlsConfig.VerifyConnection)
+				assert.Nil(t, tlsConfig.VerifyConnection)
 			}
 		})
 	}
 }
 
 func TestGetAzureIdentityResourceID(t *testing.T) {
-	ctx := context.Background()
-
 	for _, tc := range []struct {
 		desc                string
 		identityName        string
-		clients             *cloud.TestCloudClients
+		imds                imds.Client
+		cloud               azure.Clients
 		errAssertion        require.ErrorAssertionFunc
 		resourceIDAssertion require.ValueAssertionFunc
 	}{
 		{
 			desc:         "running on Azure and identity is attached",
 			identityName: "identity",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(&libcloudazure.ARMComputeMock{
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
 					GetResult: mocks.AzureVM([]string{identityResourceID(t, "identity")}),
 				}, nil /* scaleSetAPI */),
 			},
@@ -301,12 +314,12 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "running on Azure without the identity",
 			identityName: "random-identity-not-attached",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(&libcloudazure.ARMComputeMock{
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
 					GetResult: mocks.AzureVM([]string{identityResourceID(t, "identity")}),
 				}, nil /* scaleSetAPI */),
 			},
@@ -316,12 +329,12 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "running on Azure wrong format identity",
 			identityName: "identity",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(&libcloudazure.ARMComputeMock{
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
 					GetResult: mocks.AzureVM([]string{"identity"}),
 				}, nil /* scaleSetAPI */),
 			},
@@ -331,11 +344,9 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "running outside of Azure",
 			identityName: "identity",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "i-1234567890abcdef0",
-					instanceType: types.InstanceMetadataTypeEC2,
-				},
+			imds: &imdsMock{
+				id:           "i-1234567890abcdef0",
+				instanceType: types.InstanceMetadataTypeEC2,
 			},
 			errAssertion:        require.Error,
 			resourceIDAssertion: require.Empty,
@@ -343,12 +354,12 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "running on azure but failed to get VM",
 			identityName: "random-identity-not-attached",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(&libcloudazure.ARMComputeMock{
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
 					GetErr: errors.New("failed to get VM"),
 				}, nil /* scaleSetAPI */),
 			},
@@ -358,14 +369,14 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "scale set vm running on Azure and identity is attached",
 			identityName: "identity",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(
 					nil, /* api */
-					&libcloudazure.ARMScaleSetMock{
+					&azure.ARMScaleSetMock{
 						GetResult: mocks.AzureScaleSetVM([]string{identityResourceID(t, "identity")}),
 					},
 				),
@@ -378,14 +389,14 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "scale set vm running on Azure without the identity",
 			identityName: "random-identity-not-attached",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(
 					nil, /* api */
-					&libcloudazure.ARMScaleSetMock{
+					&azure.ARMScaleSetMock{
 						GetResult: mocks.AzureScaleSetVM([]string{identityResourceID(t, "identity")}),
 					},
 				),
@@ -396,14 +407,14 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "scale set vm running on Azure wrong format identity",
 			identityName: "random-identity-not-attached",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(
 					nil, /* api */
-					&libcloudazure.ARMScaleSetMock{
+					&azure.ARMScaleSetMock{
 						GetResult: mocks.AzureScaleSetVM([]string{"identity"}),
 					},
 				),
@@ -414,14 +425,14 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 		{
 			desc:         "scale set vm running but failed to get VM",
 			identityName: "identity",
-			clients: &cloud.TestCloudClients{
-				InstanceMetadata: &imdsMock{
-					id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
-					instanceType: types.InstanceMetadataTypeAzure,
-				},
-				AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(
+			imds: &imdsMock{
+				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0",
+				instanceType: types.InstanceMetadataTypeAzure,
+			},
+			cloud: &azuretest.Clients{
+				AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(
 					nil, /* api */
-					&libcloudazure.ARMScaleSetMock{
+					&azure.ARMScaleSetMock{
 						GetErr: trace.NotFound("vm not found"),
 					},
 				),
@@ -432,14 +443,17 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			auth, err := NewAuth(AuthConfig{
+				AzureClients:    cmp.Or[azure.Clients](tc.cloud, &azuretest.Clients{}),
+				azureIMDSClient: tc.imds,
+
 				AuthClient:        new(authClientMock),
 				AccessPoint:       new(accessPointMock),
-				Clients:           tc.clients,
+				GCPClients:        &gcptest.Clients{},
 				AWSConfigProvider: &mocks.AWSConfigProvider{},
 			})
 			require.NoError(t, err)
 
-			resourceID, err := auth.GetAzureIdentityResourceID(ctx, tc.identityName)
+			resourceID, err := auth.GetAzureIdentityResourceID(t.Context(), tc.identityName)
 			tc.errAssertion(t, err)
 			tc.resourceIDAssertion(t, resourceID)
 		})
@@ -449,7 +463,7 @@ func TestGetAzureIdentityResourceID(t *testing.T) {
 func TestGetAzureIdentityResourceIDCache(t *testing.T) {
 	ctx := context.Background()
 	identityName := "identity"
-	virtualMachinesMock := &libcloudazure.ARMComputeMock{
+	virtualMachinesMock := &azure.ARMComputeMock{
 		GetErr: errors.New("failed to fetch VM"),
 	}
 
@@ -459,13 +473,14 @@ func TestGetAzureIdentityResourceIDCache(t *testing.T) {
 		Clock:       clock,
 		AuthClient:  new(authClientMock),
 		AccessPoint: new(accessPointMock),
-		Clients: &cloud.TestCloudClients{
-			InstanceMetadata: &imdsMock{
-				id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
-				instanceType: types.InstanceMetadataTypeAzure,
-			},
-			AzureVirtualMachines: libcloudazure.NewVirtualMachinesClientByAPI(virtualMachinesMock, nil /* scaleSetAPI */),
+		AzureClients: &azuretest.Clients{
+			AzureVirtualMachines: azure.NewVirtualMachinesClientByAPI(virtualMachinesMock, nil /* scaleSetAPI */),
+		},
+		azureIMDSClient: &imdsMock{
+			id:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.compute/virtualmachines/vm",
+			instanceType: types.InstanceMetadataTypeAzure,
 		},
+		GCPClients:        &gcptest.Clients{},
 		AWSConfigProvider: &mocks.AWSConfigProvider{},
 	})
 	require.NoError(t, err)
@@ -662,6 +677,36 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 				query := u.Query()
 				require.Equal(t, "connect", query.Get("Action"))
 				require.Equal(t, "some-user", query.Get("User"))
+				require.Empty(t, query.Get("ResourceType"))
+				require.Equal(t, "host", query.Get("X-Amz-SignedHeaders"))
+				require.Equal(t, "token", query.Get("X-Amz-Security-Token"))
+				require.Equal(t, "FAKEACCESSKEYID/20010203/ca-central-1/elasticache/aws4_request",
+					query.Get("X-Amz-Credential"))
+			},
+			checkSTS: func(t *testing.T, stsMock *mocks.STSClient) {
+				t.Helper()
+				require.Contains(t, stsMock.GetAssumedRoleARNs(), "arn:aws:iam::123456789012:role/RedisRole")
+				require.Contains(t, stsMock.GetAssumedRoleExternalIDs(), "externalElastiCacheRedis")
+			},
+		},
+		"ElastiCache Serverless Redis": {
+			checkGetAuthFn: func(t *testing.T, auth Auth) {
+				t.Helper()
+				databaseUser := "some-user"
+				database := newElastiCacheServerlessRedisDatabase(t,
+					withAssumeRole(types.AssumeRole{
+						RoleARN:    "arn:aws:iam::123456789012:role/RedisRole",
+						ExternalID: "externalElastiCacheRedis",
+					}))
+				token, err := auth.GetElastiCacheRedisToken(ctx, database, databaseUser)
+				require.NoError(t, err)
+				u, err := url.Parse(token)
+				require.NoError(t, err)
+				require.Equal(t, "example-serverless/", u.Path)
+				query := u.Query()
+				require.Equal(t, "connect", query.Get("Action"))
+				require.Equal(t, "some-user", query.Get("User"))
+				require.Equal(t, "ServerlessCache", query.Get("ResourceType"))
 				require.Equal(t, "host", query.Get("X-Amz-SignedHeaders"))
 				require.Equal(t, "token", query.Get("X-Amz-Security-Token"))
 				require.Equal(t, "FAKEACCESSKEYID/20010203/ca-central-1/elasticache/aws4_request",
@@ -678,10 +723,11 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 	fakeSTS := &mocks.STSClient{}
 	clock := clockwork.NewFakeClockAt(time.Date(2001, time.February, 3, 0, 0, 0, 0, time.UTC))
 	auth, err := NewAuth(AuthConfig{
-		Clock:       clock,
-		AuthClient:  new(authClientMock),
-		AccessPoint: new(accessPointMock),
-		Clients:     &cloud.TestCloudClients{},
+		Clock:        clock,
+		AuthClient:   new(authClientMock),
+		AccessPoint:  new(accessPointMock),
+		GCPClients:   &gcptest.Clients{},
+		AzureClients: &azuretest.Clients{},
 		AWSConfigProvider: &mocks.AWSConfigProvider{
 			STSClient: fakeSTS,
 		},
@@ -764,10 +810,11 @@ func TestGetAWSIAMCreds(t *testing.T) {
 	} {
 		t.Run(name, func(t *testing.T) {
 			auth, err := NewAuth(AuthConfig{
-				Clock:       clock,
-				AuthClient:  new(authClientMock),
-				AccessPoint: new(accessPointMock),
-				Clients:     &cloud.TestCloudClients{},
+				Clock:        clock,
+				AuthClient:   new(authClientMock),
+				AccessPoint:  new(accessPointMock),
+				GCPClients:   &gcptest.Clients{},
+				AzureClients: &azuretest.Clients{},
 				AWSConfigProvider: &mocks.AWSConfigProvider{
 					STSClient: tt.stsMock,
 				},
@@ -869,6 +916,20 @@ func newMongoAtlasDatabase(t *testing.T, aws types.AWS) types.Database {
 	return database
 }
 
+func newMongoAtlasDatabaseWithCA(t *testing.T, ca string) types.Database {
+	t.Helper()
+
+	database, err := types.NewDatabaseV3(types.Metadata{
+		Name: "test-database",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolMongoDB,
+		URI:      "test.xxxxxxx.mongodb.net",
+	})
+	require.NoError(t, err)
+	database.SetStatusCA(ca)
+	return database
+}
+
 type databaseSpecOpt func(spec *types.DatabaseSpecV3)
 
 func withCA(ca string) databaseSpecOpt {
@@ -901,6 +962,22 @@ func newElastiCacheRedisDatabase(t *testing.T, specOpts ...databaseSpecOpt) type
 	return database
 }
 
+func newElastiCacheServerlessRedisDatabase(t *testing.T, specOpts ...databaseSpecOpt) types.Database {
+	t.Helper()
+	spec := types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolRedis,
+		URI:      "example-serverless-abc123.serverless.cac1.cache.amazonaws.com:6379",
+	}
+	for _, opt := range specOpts {
+		opt(&spec)
+	}
+	database, err := types.NewDatabaseV3(types.Metadata{
+		Name: "test-database",
+	}, spec)
+	require.NoError(t, err)
+	return database
+}
+
 func newRedshiftDatabase(t *testing.T, specOpts ...databaseSpecOpt) types.Database {
 	t.Helper()
 
@@ -1092,3 +1169,42 @@ func (f fakeAWSClients) getRedshiftServerlessClient(cfg aws.Config, optFns ...fu
 func (f fakeAWSClients) getSTSClient(cfg aws.Config, optFns ...func(*sts.Options)) stsClient {
 	return f.stsClient
 }
+
+func Test_awsRedisIAMTokenRequest(t *testing.T) {
+	ctx := context.Background()
+	at := time.Date(2022, time.December, 22, 22, 22, 0, 0, time.UTC)
+	clock := clockwork.NewFakeClockAt(at)
+	cred := credentials.NewStaticCredentialsProvider("FAKEACCESSKEYID", "secret", "token")
+
+	tests := []struct {
+		desc         string
+		isServerless bool
+		want         string
+	}{
+		{
+			desc: "elasticache cluster",
+			want: "test-target-id/?Action=connect&User=test-user&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=FAKEACCESSKEYID%2F20221222%2Fus-east-1%2Felasticache%2Faws4_request&X-Amz-Date=20221222T222200Z&X-Amz-Expires=900&X-Amz-Security-Token=token&X-Amz-SignedHeaders=host&X-Amz-Signature=bfccda7e654c97d44179402051403c94b9ffe84d436cb373813dfbf3ffbf1643",
+		},
+		{
+			desc:         "elasticache serverless",
+			want:         "test-target-id/?Action=connect&ResourceType=ServerlessCache&User=test-user&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=FAKEACCESSKEYID%2F20221222%2Fus-east-1%2Felasticache%2Faws4_request&X-Amz-Date=20221222T222200Z&X-Amz-Expires=900&X-Amz-Security-Token=token&X-Amz-SignedHeaders=host&X-Amz-Signature=3db457acad7e2409be0b6baa722395527e431f4b2bc89087bfaffe9c966cd81b",
+			isServerless: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			tokenReq := awsRedisIAMTokenRequest{
+				userID:       "test-user",
+				targetID:     "test-target-id",
+				serviceName:  "elasticache",
+				region:       "us-east-1",
+				credProvider: cred,
+				clock:        clock,
+				isServerless: test.isServerless,
+			}
+			token, err := tokenReq.toSignedRequestURI(ctx)
+			require.NoError(t, err)
+			require.Equal(t, test.want, token)
+		})
+	}
+}
diff --git a/lib/srv/db/common/autousers.go b/lib/srv/db/common/autousers.go
index a3fb92784bb7f..4ca927d1f060e 100644
--- a/lib/srv/db/common/autousers.go
+++ b/lib/srv/db/common/autousers.go
@@ -185,7 +185,6 @@ func (a *UserProvisioner) makeAcquireSemaphoreConfig(sessionCtx *Session) servic
 			// in a user's name from being rejected by the backend when creating the semaphore.
 			SemaphoreName: hex.EncodeToString([]byte(sessionCtx.Database.GetName() + "-" + sessionCtx.DatabaseUser)),
 			MaxLeases:     1,
-			Expires:       a.Clock.Now().Add(time.Minute),
 		},
 		// If multiple connections are being established simultaneously to the
 		// same database as the same user, retry for a few seconds.
@@ -194,5 +193,7 @@ func (a *UserProvisioner) makeAcquireSemaphoreConfig(sessionCtx *Session) servic
 			Max:   time.Second,
 			Clock: a.Clock,
 		},
+		TTL: time.Minute,
+		Now: a.Clock.Now,
 	}
 }
diff --git a/lib/srv/db/common/connect/connect.go b/lib/srv/db/common/connect/connect.go
index ebfc8581fddf2..1be2ee49ab776 100644
--- a/lib/srv/db/common/connect/connect.go
+++ b/lib/srv/db/common/connect/connect.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // DatabaseServersGetter is an interface for retrieving information about
@@ -68,8 +69,6 @@ func GetDatabaseServers(ctx context.Context, params GetDatabaseServersParams) ([
 		return nil, trace.Wrap(err)
 	}
 
-	params.Logger.DebugContext(ctx, "Available database servers.", "cluster", params.ClusterName, "servers", servers)
-
 	// Find out which database servers proxy the database a user is
 	// connecting to using routing information from identity.
 	var result []types.DatabaseServer
@@ -79,6 +78,11 @@ func GetDatabaseServers(ctx context.Context, params GetDatabaseServersParams) ([
 		}
 	}
 
+	params.Logger.DebugContext(ctx, "Available database servers",
+		"cluster", params.ClusterName,
+		"servers", logutils.StringerSliceAttr(result),
+	)
+
 	if len(result) != 0 {
 		return result, nil
 	}
@@ -219,7 +223,7 @@ type ConnectParams struct {
 }
 
 func (p *ConnectParams) CheckAndSetDefaults() error {
-	if p.Logger != nil {
+	if p.Logger == nil {
 		p.Logger = slog.Default()
 	}
 
@@ -304,7 +308,7 @@ func Connect(ctx context.Context, params ConnectParams) (net.Conn, ConnectStats,
 	// group the servers by target health, shuffle each group, and then iterate
 	// over the concatenated groups in order ascending order of health.
 	params.ShuffleFunc(params.Servers)
-	groups := types.GroupByTargetHealth(params.Servers)
+	groups := types.GroupByTargetHealthStatus(params.Servers)
 	// There may be multiple database servers proxying the same database. If
 	// we get a connection problem error trying to dial one of them, likely
 	// the database server is down so try the next one.
diff --git a/lib/srv/db/common/connect/connect_test.go b/lib/srv/db/common/connect/connect_test.go
index e1b6fa60afd37..a00001af2dd86 100644
--- a/lib/srv/db/common/connect/connect_test.go
+++ b/lib/srv/db/common/connect/connect_test.go
@@ -33,11 +33,12 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestGetDatabaseServers(t *testing.T) {
@@ -69,7 +70,7 @@ func TestGetDatabaseServers(t *testing.T) {
 	} {
 		t.Run(name, func(t *testing.T) {
 			servers, err := GetDatabaseServers(context.Background(), GetDatabaseServersParams{
-				Logger:                utils.NewSlogLoggerForTests(),
+				Logger:                logtest.NewLogger(),
 				ClusterName:           "root",
 				DatabaseServersGetter: tc.getter,
 				Identity:              tc.identity,
@@ -82,7 +83,7 @@ func TestGetDatabaseServers(t *testing.T) {
 
 func TestGetServerTLSConfig(t *testing.T) {
 	clusterName := "root"
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
 		ClusterName: clusterName,
 		AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -93,7 +94,7 @@ func TestGetServerTLSConfig(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
 
-	user, role, err := auth.CreateUserAndRole(authServer.AuthServer, "alice", []string{"db-access"}, nil)
+	user, role, err := authtest.CreateUserAndRole(authServer.AuthServer, "alice", []string{"db-access"}, nil)
 	require.NoError(t, err)
 
 	for name, tc := range map[string]struct {
@@ -142,7 +143,7 @@ func TestGetServerTLSConfig(t *testing.T) {
 
 func TestConnect(t *testing.T) {
 	clusterName := "root"
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
 		ClusterName: clusterName,
 		AuthPreferenceSpec: &types.AuthPreferenceSpecV2{
@@ -153,7 +154,7 @@ func TestConnect(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
 
-	user, role, err := auth.CreateUserAndRole(authServer.AuthServer, "alice", []string{"db-access"}, nil)
+	user, role, err := authtest.CreateUserAndRole(authServer.AuthServer, "alice", []string{"db-access"}, nil)
 	require.NoError(t, err)
 
 	for name, tc := range map[string]struct {
@@ -190,7 +191,7 @@ func TestConnect(t *testing.T) {
 	} {
 		t.Run(name, func(t *testing.T) {
 			conn, stats, err := Connect(context.Background(), ConnectParams{
-				Logger:         utils.NewSlogLoggerForTests(),
+				Logger:         logtest.NewLogger(),
 				Identity:       tc.identity,
 				Servers:        tc.dialer.getServers(),
 				ShuffleFunc:    ShuffleSort,
@@ -264,7 +265,7 @@ func (d *databaseServersMock) GetDatabaseServers(_ context.Context, _ string, _
 func newDialerMock(t *testing.T, authServer *auth.Server, dbName string, availableServers []string, unavailableServers []string) *dialerMock {
 	m := &dialerMock{serverConfig: make(map[string]*tls.Config)}
 	for _, host := range availableServers {
-		serverIdentity, err := auth.NewServerIdentity(authServer, host, types.RoleDatabase)
+		serverIdentity, err := authtest.NewServerIdentity(authServer, host, types.RoleDatabase)
 		require.NoError(t, err)
 		tlsConfig, err := serverIdentity.TLSConfig(nil)
 		require.NoError(t, err)
diff --git a/lib/srv/db/common/engines.go b/lib/srv/db/common/engines.go
index a7e2e56078ea1..1ba789036b39a 100644
--- a/lib/srv/db/common/engines.go
+++ b/lib/srv/db/common/engines.go
@@ -29,8 +29,8 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/srv/db/common/enterprise"
 )
 
@@ -107,7 +107,7 @@ type EngineConfig struct {
 	// AWSConfigProvider provides [aws.Config] for AWS SDK service clients.
 	AWSConfigProvider awsconfig.Provider
 	// GCPClients provides access to Google Cloud API clients.
-	GCPClients cloud.GCPClients
+	GCPClients gcp.Clients
 	// Context is the database server close context.
 	Context context.Context
 	// Clock is the clock interface.
diff --git a/lib/srv/db/common/engines_test.go b/lib/srv/db/common/engines_test.go
index 14a56c4fc4cd7..c92c8edb162f6 100644
--- a/lib/srv/db/common/engines_test.go
+++ b/lib/srv/db/common/engines_test.go
@@ -29,7 +29,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 )
 
@@ -41,8 +41,6 @@ func TestRegisterEngine(t *testing.T) {
 		RegisterEngine(nil, "test")
 	})
 
-	cloudClients, err := cloud.NewClients()
-	require.NoError(t, err)
 	ec := EngineConfig{
 		Context:           context.Background(),
 		Clock:             clockwork.NewFakeClock(),
@@ -51,7 +49,7 @@ func TestRegisterEngine(t *testing.T) {
 		Audit:             &testAudit{},
 		AuthClient:        &authclient.Client{},
 		AWSConfigProvider: &mocks.AWSConfigProvider{},
-		GCPClients:        cloudClients,
+		GCPClients:        &gcptest.Clients{},
 	}
 	require.NoError(t, ec.CheckAndSetDefaults())
 
diff --git a/lib/srv/db/common/errors.go b/lib/srv/db/common/errors.go
index 29584918cbbdd..728c49c8db347 100644
--- a/lib/srv/db/common/errors.go
+++ b/lib/srv/db/common/errors.go
@@ -46,30 +46,20 @@ func ConvertError(err error) error {
 	if err == nil {
 		return nil
 	}
-	// Unwrap original error first.
-	var traceErr *trace.TraceErr
-	if errors.As(err, &traceErr) {
-		return ConvertError(trace.Unwrap(err))
-	}
-	var pgErr pgError
-	if errors.As(err, &pgErr) {
-		return ConvertError(pgErr.Unwrap())
-	}
-
-	var c causer
-	if errors.As(err, &c) {
-		return ConvertError(c.Cause())
-	}
-	if _, ok := status.FromError(err); ok {
-		return trail.FromGRPC(err)
-	}
 
+	var causeErr causer
 	var googleAPIErr *googleapi.Error
 	var awsRequestFailureErr *awshttp.ResponseError
 	var azResponseErr *azcore.ResponseError
 	var pgError *pgconn.PgError
 	var myError *mysql.MyError
+
+	// Unwrap trace error first.
 	switch err := trace.Unwrap(err); {
+	case errors.As(err, &causeErr):
+		return ConvertError(causeErr.Cause())
+	case isGRPCStatusError(err):
+		return trail.FromGRPC(err)
 	case errors.As(err, &googleAPIErr):
 		return convertGCPError(googleAPIErr)
 	case errors.As(err, &awsRequestFailureErr):
@@ -84,6 +74,11 @@ func ConvertError(err error) error {
 	return err // Return unmodified.
 }
 
+func isGRPCStatusError(err error) bool {
+	_, ok := status.FromError(err)
+	return ok
+}
+
 // convertGCPError converts GCP errors to trace errors.
 func convertGCPError(err *googleapi.Error) error {
 	switch err.Code {
@@ -124,11 +119,6 @@ type causer interface {
 	Cause() error
 }
 
-// pgError defines an interface for errors wrapped by Postgres driver.
-type pgError interface {
-	Unwrap() error
-}
-
 // ConvertConnectError converts common connection errors to trace errors with
 // extra information/recommendations if necessary.
 func ConvertConnectError(err error, sessionCtx *Session) error {
@@ -155,7 +145,7 @@ func ConvertConnectError(err error, sessionCtx *Session) error {
 
 	if trace.IsAccessDenied(err) {
 		switch sessionCtx.Database.GetType() {
-		case types.DatabaseTypeElastiCache:
+		case types.DatabaseTypeElastiCache, types.DatabaseTypeElastiCacheServerless:
 			return createElastiCacheRedisAccessDeniedError(err, sessionCtx)
 		case types.DatabaseTypeMemoryDB:
 			return createMemoryDBAccessDeniedError(err, sessionCtx)
diff --git a/lib/srv/db/common/errors_test.go b/lib/srv/db/common/errors_test.go
index 3d02aaa33a82d..982f74376e4f6 100644
--- a/lib/srv/db/common/errors_test.go
+++ b/lib/srv/db/common/errors_test.go
@@ -19,10 +19,13 @@
 package common
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/go-mysql-org/go-mysql/mysql"
 	"github.com/gravitational/trace"
+	"github.com/jackc/pgconn"
+	"github.com/jackc/pgerrcode"
 	"github.com/stretchr/testify/require"
 )
 
@@ -48,3 +51,63 @@ func Test_isRDSMySQLIAMAuthError(t *testing.T) {
 	require.False(t, isRDSMySQLIAMAuthError(noDBError))
 	require.False(t, isRDSMySQLIAMAuthError(trace.AccessDenied("access denied")))
 }
+
+type someErr struct {
+	inner error
+}
+
+func (e *someErr) Error() string {
+	if e.inner == nil {
+		return "inner: nil"
+	}
+	return "inner: " + e.inner.Error()
+}
+func (e *someErr) Unwrap() error {
+	return e.inner
+}
+
+func TestConvertError(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              error
+		checkError         require.ErrorAssertionFunc
+		checkErrorContains string
+	}{
+		{
+			name:       "nil",
+			input:      nil,
+			checkError: require.NoError,
+		},
+		{
+			name: "PgError",
+			input: trace.Wrap(&pgconn.PgError{
+				Code:    pgerrcode.CannotConnectNow,
+				Message: "CannotConnectNow",
+			}),
+			checkError:         require.Error,
+			checkErrorContains: "CannotConnectNow",
+		},
+		{
+			name:               "wrapped",
+			input:              &someErr{inner: trace.Wrap(fmt.Errorf("dummy error"))},
+			checkError:         require.Error,
+			checkErrorContains: "dummy error",
+		},
+		{
+			name:  "wrapped nil",
+			input: &someErr{inner: &someErr{inner: nil}},
+			// We should NOT return `nil` by unwrapping.
+			checkError:         require.Error,
+			checkErrorContains: "inner: inner: nil",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output := ConvertError(tt.input)
+			tt.checkError(t, output)
+			if output != nil {
+				require.ErrorContains(t, output, tt.checkErrorContains)
+			}
+		})
+	}
+}
diff --git a/lib/srv/db/common/iam/aws.go b/lib/srv/db/common/iam/aws.go
index a7899f3b91382..58390e8eb626e 100644
--- a/lib/srv/db/common/iam/aws.go
+++ b/lib/srv/db/common/iam/aws.go
@@ -40,6 +40,8 @@ func GetAWSPolicyDocument(db types.Database) (*awslib.PolicyDocument, Placeholde
 		return getRedshiftPolicyDocument(db)
 	case types.DatabaseTypeElastiCache:
 		return getElastiCachePolicyDocument(db)
+	case types.DatabaseTypeElastiCacheServerless:
+		return getElastiCacheServerlessPolicyDocument(db)
 	case types.DatabaseTypeMemoryDB:
 		return getMemoryDBPolicyDocument(db)
 	default:
@@ -264,6 +266,34 @@ func getElastiCachePolicyDocument(db types.Database) (*awslib.PolicyDocument, Pl
 	return policyDoc, placeholders, nil
 }
 
+// getElastiCacheServerlessPolicyDocument returns the policy document used for
+// ElastiCache databases.
+//
+// https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html
+func getElastiCacheServerlessPolicyDocument(db types.Database) (*awslib.PolicyDocument, Placeholders, error) {
+	meta := db.GetAWS()
+	partition := awsutils.GetPartitionFromRegion(meta.Region)
+	region := meta.Region
+	accountID := meta.AccountID
+	cacheName := meta.ElastiCacheServerless.CacheName
+
+	placeholders := Placeholders(nil).
+		setPlaceholderIfEmpty(&region, "{region}").
+		setPlaceholderIfEmpty(&partition, "{partition}").
+		setPlaceholderIfEmpty(&accountID, "{account_id}").
+		setPlaceholderIfEmpty(&cacheName, "{cache_name}")
+
+	policyDoc := awslib.NewPolicyDocument(&awslib.Statement{
+		Effect:  awslib.EffectAllow,
+		Actions: awslib.SliceOrString{"elasticache:Connect"},
+		Resources: awslib.SliceOrString{
+			fmt.Sprintf("arn:%v:elasticache:%v:%v:serverlesscache:%v", partition, region, accountID, cacheName),
+			fmt.Sprintf("arn:%v:elasticache:%v:%v:user:*", partition, region, accountID),
+		},
+	})
+	return policyDoc, placeholders, nil
+}
+
 // getMemoryDBPolicyDocument returns the policy document used for MemoryDB
 // databases.
 //
diff --git a/lib/srv/db/common/iam/aws_test.go b/lib/srv/db/common/iam/aws_test.go
index b6a5bef5c09d1..e01d63df387f8 100644
--- a/lib/srv/db/common/iam/aws_test.go
+++ b/lib/srv/db/common/iam/aws_test.go
@@ -78,6 +78,20 @@ func TestGetAWSPolicyDocument(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	elasticacheServerless, err := types.NewDatabaseV3(types.Metadata{
+		Name: "aws-elasticache-serverless",
+	}, types.DatabaseSpecV3{
+		Protocol: "redis",
+		URI:      "example-abc123.serverless.cac1.cache.amazonaws.com:6379",
+		AWS: types.AWS{
+			AccountID: "123456789012",
+			ElastiCacheServerless: types.ElastiCacheServerless{
+				CacheName: "example",
+			},
+		},
+	})
+	require.NoError(t, err)
+
 	memorydb, err := types.NewDatabaseV3(types.Metadata{
 		Name: "aws-memorydb",
 	}, types.DatabaseSpecV3{
@@ -158,6 +172,22 @@ func TestGetAWSPolicyDocument(t *testing.T) {
             ]
         }
     ]
+}`,
+		},
+		{
+			inputDatabase: elasticacheServerless,
+			expectPolicyDocument: `{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "elasticache:Connect",
+            "Resource": [
+                "arn:aws:elasticache:ca-central-1:123456789012:serverlesscache:example",
+                "arn:aws:elasticache:ca-central-1:123456789012:user:*"
+            ]
+        }
+    ]
 }`,
 		},
 		{
diff --git a/lib/srv/db/common/interfaces.go b/lib/srv/db/common/interfaces.go
index ba32cd839ea72..197ef7f6dd9e6 100644
--- a/lib/srv/db/common/interfaces.go
+++ b/lib/srv/db/common/interfaces.go
@@ -61,7 +61,7 @@ type ProxyContext struct {
 	// Identity is the authorized client Identity.
 	Identity tlsca.Identity
 	// Cluster is the remote Cluster running the database server.
-	Cluster reversetunnelclient.RemoteSite
+	Cluster reversetunnelclient.Cluster
 	// Servers is a list of database Servers that proxy the requested database.
 	Servers []types.DatabaseServer
 	// AuthContext is a context of authenticated user.
diff --git a/lib/srv/db/common/kerberos/kinit/kinit.go b/lib/srv/db/common/kerberos/kinit/kinit.go
index c7454a6b36585..cc741ab437776 100644
--- a/lib/srv/db/common/kerberos/kinit/kinit.go
+++ b/lib/srv/db/common/kerberos/kinit/kinit.go
@@ -178,7 +178,6 @@ func (d *dbCertGetter) getCertificate(ctx context.Context, username string) (*ge
 		TTL:                time.Minute * 10,
 		Domain:             d.domain,
 		ClusterName:        clusterName.GetClusterName(),
-		OmitCDP:            true,
 		Username:           username,
 		ActiveDirectorySID: sid,
 	}
diff --git a/lib/srv/db/common/kerberos/kinit/kinit_test.go b/lib/srv/db/common/kerberos/kinit/kinit_test.go
index ab526efcac8c5..bbb94c18e3475 100644
--- a/lib/srv/db/common/kerberos/kinit/kinit_test.go
+++ b/lib/srv/db/common/kerberos/kinit/kinit_test.go
@@ -21,14 +21,17 @@ package kinit
 import (
 	"context"
 	_ "embed"
+	"log/slog"
 	"os"
 	"testing"
 
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/winpki"
 )
 
@@ -162,3 +165,36 @@ func TestKRBConfString(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, expectedConfString, krb5Config)
 }
+
+type mockConnector struct {
+}
+
+func (m *mockConnector) GetActiveDirectorySID(ctx context.Context, username string) (sid string, err error) {
+	return "S-1-5-21-2191801808-3167526388-2669316733-1104", nil
+}
+
+func TestGetCertificate(t *testing.T) {
+	auth := &mockAuthClient{
+		generateDatabaseCert: func(ctx context.Context, request *proto.DatabaseCertRequest) (*proto.DatabaseCertResponse, error) {
+			require.NotEmpty(t, request.CRLDomain)
+
+			csr, err := tlsca.ParseCertificateRequestPEM(request.CSR)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			require.Equal(t, "CN=alice", csr.Subject.String())
+			require.Len(t, csr.Extensions, 3)
+			return generateDatabaseCert(ctx, request)
+		},
+	}
+
+	getter := &dbCertGetter{
+		logger:        slog.New(slog.DiscardHandler),
+		auth:          auth,
+		domain:        "example.com",
+		ldapConnector: &mockConnector{},
+	}
+
+	_, err := getter.getCertificate(context.Background(), "alice")
+	require.NoError(t, err)
+}
diff --git a/lib/srv/db/common/kerberos/kinit/ldap.go b/lib/srv/db/common/kerberos/kinit/ldap.go
index 487afe073d042..5a45da5c40704 100644
--- a/lib/srv/db/common/kerberos/kinit/ldap.go
+++ b/lib/srv/db/common/kerberos/kinit/ldap.go
@@ -20,13 +20,10 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"fmt"
 	"log/slog"
-	"net"
 	"strings"
 	"time"
 
-	"github.com/go-ldap/ldap/v3"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
@@ -50,8 +47,6 @@ type ldapConnector struct {
 	authClient winpki.AuthInterface
 
 	ldapConfig ldapConnectionConfig
-
-	dialLDAPServerFunc func(ctx context.Context) (ldap.Client, error) // only used in tests.
 }
 
 type LDAPConnector interface {
@@ -101,51 +96,6 @@ func newLDAPConnector(logger *slog.Logger, authClient winpki.AuthInterface, adCo
 	}, nil
 }
 
-const (
-	// ldapDialTimeout is the timeout for dialing the LDAP server
-	// when making an initial connection
-	ldapDialTimeout = 15 * time.Second
-	// ldapRequestTimeout is the timeout for making LDAP requests.
-	// It is larger than the dial timeout because LDAP queries in large
-	// Active Directory environments may take longer to complete.
-	ldapRequestTimeout = 45 * time.Second
-
-	// attrSAMAccountName is the SAM Account name of an LDAP object.
-	attrSAMAccountName = "sAMAccountName"
-	// attrSAMAccountType is the SAM Account type for an LDAP object.
-	attrSAMAccountType = "sAMAccountType"
-	// AccountTypeUser is the SAM account type for user accounts.
-	// See https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype
-	// (SAM_USER_OBJECT)
-	AccountTypeUser = "805306368"
-)
-
-func (s *ldapConnector) dialLDAPServer(ctx context.Context, clusterName string) (ldap.Client, error) {
-	if s.dialLDAPServerFunc != nil {
-		return s.dialLDAPServerFunc(ctx)
-	}
-
-	tc, err := s.tlsConfigForLDAP(ctx, clusterName)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	ldapURL := "ldaps://" + s.ldapConfig.address
-	s.logger.DebugContext(ctx, "Dialing LDAP server", "url", ldapURL)
-
-	conn, err := ldap.DialURL(
-		ldapURL,
-		ldap.DialWithDialer(&net.Dialer{Timeout: ldapDialTimeout}),
-		ldap.DialWithTLSConfig(tc),
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	conn.SetTimeout(ldapRequestTimeout)
-
-	return conn, nil
-}
-
 // GetActiveDirectorySID queries LDAP to get SID of a given username.
 func (s *ldapConnector) GetActiveDirectorySID(ctx context.Context, username string) (sid string, err error) {
 	clusterName, err := s.authClient.GetClusterName(ctx)
@@ -153,39 +103,24 @@ func (s *ldapConnector) GetActiveDirectorySID(ctx context.Context, username stri
 		return "", trace.Wrap(err)
 	}
 
-	var activeDirectorySID string
-	// Find the user's SID
-	filter := winpki.CombineLDAPFilters([]string{
-		fmt.Sprintf("(%s=%s)", attrSAMAccountType, AccountTypeUser),
-		fmt.Sprintf("(%s=%s)", attrSAMAccountName, username),
-	})
-
-	domainDN := winpki.DomainDN(s.ldapConfig.domain)
-
-	s.logger.DebugContext(ctx, "Querying LDAP for objectSid of Windows user", "username", username, "filter", filter, "domain", domainDN)
-
-	ldapConn, err := s.dialLDAPServer(ctx, clusterName.GetClusterName())
+	tc, err := s.tlsConfigForLDAP(ctx, clusterName.GetClusterName())
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	lc := winpki.NewLDAPClient(ldapConn)
-
-	entries, err := lc.ReadWithFilter(domainDN, filter, []string{winpki.AttrObjectSid})
+	s.logger.DebugContext(ctx, "Querying LDAP for objectSid of Windows user", "username", username)
+	client, err := winpki.DialLDAP(ctx, &winpki.LDAPConfig{
+		Addr:   s.ldapConfig.address,
+		Domain: s.ldapConfig.domain,
+		Logger: s.logger,
+	}, tc)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	if len(entries) == 0 {
-		return "", trace.NotFound("could not find Windows account %q", username)
-	} else if len(entries) > 1 {
-		s.logger.WarnContext(ctx, "found multiple entries for user, taking the first", "username", username)
-	}
-	activeDirectorySID, err = winpki.ADSIDStringFromLDAPEntry(entries[0])
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	s.logger.DebugContext(ctx, "Found objectSid Windows user", "username", username, "sid", activeDirectorySID)
-	return activeDirectorySID, nil
+
+	defer client.Close()
+
+	return client.GetActiveDirectorySID(ctx, username)
 }
 
 func (s *ldapConnector) tlsConfigForLDAP(ctx context.Context, clusterName string) (*tls.Config, error) {
@@ -208,7 +143,6 @@ func (s *ldapConnector) tlsConfigForLDAP(ctx context.Context, clusterName string
 		ClusterName:        clusterName,
 		Domain:             s.ldapConfig.domain,
 		ActiveDirectorySID: s.ldapConfig.serviceAccountSID,
-		OmitCDP:            true,
 	}
 
 	certPEM, keyPEM, caCerts, err := winpki.DatabaseCredentials(ctx, s.authClient, req)
diff --git a/lib/srv/db/common/kerberos/kinit/ldap_test.go b/lib/srv/db/common/kerberos/kinit/ldap_test.go
index 9146fbd025a61..39702d343ef8f 100644
--- a/lib/srv/db/common/kerberos/kinit/ldap_test.go
+++ b/lib/srv/db/common/kerberos/kinit/ldap_test.go
@@ -23,7 +23,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-ldap/ldap/v3"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
@@ -91,6 +90,8 @@ func (m *mockAuthClient) GetClusterName(ctx context.Context) (types.ClusterName,
 func TestTLSConfigForLDAP(t *testing.T) {
 	auth := &mockAuthClient{
 		generateDatabaseCert: func(ctx context.Context, request *proto.DatabaseCertRequest) (*proto.DatabaseCertResponse, error) {
+			require.NotEmpty(t, request.CRLDomain)
+
 			csr, err := tlsca.ParseCertificateRequestPEM(request.CSR)
 			if err != nil {
 				return nil, trace.Wrap(err)
@@ -120,65 +121,3 @@ func TestTLSConfigForLDAP(t *testing.T) {
 	require.NotEmpty(t, tlsConfig.Certificates)
 	require.NotNil(t, tlsConfig.RootCAs)
 }
-
-type mockLDAPClient struct {
-	searchWithPaging func(searchRequest *ldap.SearchRequest, pagingSize uint32) (*ldap.SearchResult, error)
-	ldap.Client
-}
-
-func (m *mockLDAPClient) SearchWithPaging(searchRequest *ldap.SearchRequest, pagingSize uint32) (*ldap.SearchResult, error) {
-	if m.searchWithPaging == nil {
-		return nil, trace.BadParameter("callback function searchWithPaging not set")
-	}
-	return m.searchWithPaging(searchRequest, pagingSize)
-}
-
-func TestGetActiveDirectorySID(t *testing.T) {
-	adConfig := types.AD{
-		KeytabFile:             "",
-		Krb5File:               "",
-		SPN:                    "",
-		Domain:                 "example.com",
-		LDAPCert:               fixtures.TLSCACertPEM,
-		KDCHostName:            "ldap.example.com",
-		LDAPServiceAccountName: "DOMAIN\\test-service-account",
-		LDAPServiceAccountSID:  "S-1-5-21-2191801808-3167526388-2669316733-1104",
-	}
-
-	connector, err := newLDAPConnector(slog.Default(), &mockAuthClient{}, adConfig)
-	require.NoError(t, err)
-
-	connector.dialLDAPServerFunc = func(ctx context.Context) (ldap.Client, error) {
-		return &mockLDAPClient{searchWithPaging: func(searchRequest *ldap.SearchRequest, pagingSize uint32) (*ldap.SearchResult, error) {
-			if searchRequest.BaseDN != "DC=example,DC=com" {
-				return nil, trace.BadParameter("unexpected value of base_dn")
-			}
-			if searchRequest.Filter != "(\u0026(sAMAccountType=805306368)(sAMAccountName=DOMAIN\\test-user))" {
-				return nil, trace.BadParameter("unexpected value of filter")
-			}
-			if len(searchRequest.Attributes) != 1 {
-				return nil, trace.BadParameter("unexpected number of search attributes")
-			}
-			if searchRequest.Attributes[0] != "objectSid" {
-				return nil, trace.BadParameter("unexpected value of search attribute")
-			}
-
-			const sidValue = "\u0001\u0005\u0000\u0000\u0000\u0000\u0000\u0005\u0015\u0000\u0000\u0000\ufffd=\ufffd\ufffd\ufffd\ufffd̼}\ufffd\u001a\ufffd\ufffd\u0001\u0000\u0000"
-
-			attr := ldap.NewEntryAttribute("objectSid", []string{sidValue})
-
-			return &ldap.SearchResult{
-				Entries: []*ldap.Entry{
-					{
-						DN:         "CN=test-user,CN=Users,DC=example,DC=com",
-						Attributes: []*ldap.EntryAttribute{attr},
-					},
-				},
-			}, nil
-		}}, nil
-	}
-
-	sid, err := connector.GetActiveDirectorySID(context.Background(), "DOMAIN\\test-user")
-	require.NoError(t, err)
-	require.Equal(t, "S-1-5-21-1035845615-4022190063-3220159935-3183472573", sid)
-}
diff --git a/lib/srv/db/common/role/role.go b/lib/srv/db/common/role/role.go
index add1fc96ff4f2..89a259264493d 100644
--- a/lib/srv/db/common/role/role.go
+++ b/lib/srv/db/common/role/role.go
@@ -85,25 +85,23 @@ func databaseNameMatcher(dbProtocol, database string) *services.DatabaseNameMatc
 		// databases is different and there's no way to prevent cross-database
 		// queries so only apply RBAC to db_users.
 		defaults.ProtocolCockroachDB,
-		// Redis integration doesn't support schema access control.
+		// Most database protocols do not support schema access control.
 		defaults.ProtocolRedis,
-		// Cassandra integration doesn't support schema access control.
 		defaults.ProtocolCassandra,
-		// Elasticsearch integration doesn't support schema access control.
 		defaults.ProtocolElasticsearch,
-		// OpenSearch integration doesn't support schema access control.
 		defaults.ProtocolOpenSearch,
-		// DynamoDB integration doesn't support schema access control.
 		defaults.ProtocolDynamoDB,
-		// Snowflake integration doesn't support schema access control.
 		defaults.ProtocolSnowflake,
-		// Oracle integration doesn't support schema access control.
 		defaults.ProtocolOracle,
-		// Clickhouse Database Access doesn't support schema access control
 		defaults.ProtocolClickHouse,
-		defaults.ProtocolClickHouseHTTP:
+		defaults.ProtocolClickHouseHTTP,
+		defaults.ProtocolSQLServer:
 		return nil
 	default:
+		// Protocols that do support database name matcher:
+		// - postgres
+		// - mongodb
+		// - cloud spanner
 		return &services.DatabaseNameMatcher{Name: database}
 	}
 }
diff --git a/lib/srv/db/common/session.go b/lib/srv/db/common/session.go
index 575df62c71f53..781a07679dc38 100644
--- a/lib/srv/db/common/session.go
+++ b/lib/srv/db/common/session.go
@@ -70,6 +70,8 @@ type Session struct {
 	PostgresPID uint32
 	// UserAgent identifies the type of client used on the session.
 	UserAgent string
+	// ClientIP is the client IP address.
+	ClientIP string
 }
 
 // String returns string representation of the session parameters.
@@ -86,6 +88,7 @@ func (c *Session) GetAccessState(authPref readonly.AuthPreference) services.Acce
 	state.MFAVerified = c.Identity.IsMFAVerified()
 	state.EnableDeviceVerification = true
 	state.DeviceVerified = dtauthz.IsTLSDeviceVerified(&c.Identity.DeviceExtensions)
+	state.IsBot = c.Identity.IsBot()
 	return state
 }
 
diff --git a/lib/srv/db/common/session_test.go b/lib/srv/db/common/session_test.go
index d5c42baf78b52..5fb9874b91a5d 100644
--- a/lib/srv/db/common/session_test.go
+++ b/lib/srv/db/common/session_test.go
@@ -80,6 +80,19 @@ func TestSession_GetAccessState(t *testing.T) {
 				EnableDeviceVerification: true,
 			},
 		},
+		{
+			name: "bot",
+			session: common.Session{
+				Identity: tlsca.Identity{
+					BotName: "wall-e",
+				},
+				Checker: checker,
+			},
+			want: services.AccessState{
+				EnableDeviceVerification: true,
+				IsBot:                    true,
+			},
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/lib/srv/db/common/test.go b/lib/srv/db/common/test.go
index 4eb03e85ae7e1..ed7ffbb6395b1 100644
--- a/lib/srv/db/common/test.go
+++ b/lib/srv/db/common/test.go
@@ -135,7 +135,7 @@ func MakeTestServerTLSConfig(config TestServerConfig) (*tls.Config, error) {
 	resp, err := config.AuthClient.GenerateDatabaseCert(context.Background(),
 		&proto.DatabaseCertRequest{
 			CSR:           csr,
-			ServerName:    cn,
+			ServerNames:   []string{cn, "127.0.0.1", "::1"},
 			TTL:           proto.Duration(time.Hour),
 			RequesterName: proto.DatabaseCertRequest_TCTL,
 		})
diff --git a/lib/srv/db/dynamodb/engine.go b/lib/srv/db/dynamodb/engine.go
index 019183a288271..3271b0bd3b48a 100644
--- a/lib/srv/db/dynamodb/engine.go
+++ b/lib/srv/db/dynamodb/engine.go
@@ -21,7 +21,6 @@ package dynamodb
 import (
 	"bufio"
 	"bytes"
-	"cmp"
 	"context"
 	"encoding/json"
 	"io"
@@ -37,7 +36,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/dynamodbstreams"
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
-	"golang.org/x/net/http/httpproxy"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
@@ -48,7 +46,6 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 	libaws "github.com/gravitational/teleport/lib/utils/aws"
 	"github.com/gravitational/teleport/lib/utils/aws/dynamodbutils"
@@ -495,40 +492,3 @@ func getTargetHeader(req *http.Request) (string, error) {
 	}
 	return target, nil
 }
-
-// NewEndpointsResolver resolves endpoints from DB URI.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	aws := db.GetAWS()
-	fips := dynamodbutils.IsFIPSEnabled()
-	resolverFns := []resolverFn{
-		resolveDynamoDBEndpoint,
-		resolveDynamoDBStreamsEndpoint,
-	}
-	return endpoints.ResolverFn(func(ctx context.Context) ([]string, error) {
-		addrs := make([]string, 0, len(resolverFns))
-		for _, resolve := range resolverFns {
-			re, err := resolve(ctx, aws.Region, aws.AccountID, fips)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			// Not all of our DB engines respect http proxy env vars, but this one does.
-			// The endpoint resolved for TCP health checks should be the one that the
-			// agent will actually connect to, since often proxy env vars are set to
-			// accommodate self-imposed network restrictions that force external traffic
-			// to go through a proxy.
-			proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
-			proxyURL, err := proxyFunc(re.URL)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			if proxyURL != nil {
-				re.URL = proxyURL
-			}
-			host := re.URL.Hostname()
-			port := cmp.Or(re.URL.Port(), "443")
-			addrs = append(addrs, net.JoinHostPort(host, port))
-		}
-		return addrs, nil
-	}), nil
-}
diff --git a/lib/srv/db/dynamodb/healthcheck.go b/lib/srv/db/dynamodb/healthcheck.go
new file mode 100644
index 0000000000000..94b0cf7a49406
--- /dev/null
+++ b/lib/srv/db/dynamodb/healthcheck.go
@@ -0,0 +1,79 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package dynamodb
+
+import (
+	"cmp"
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/net/http/httpproxy"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+	"github.com/gravitational/teleport/lib/utils/aws/dynamodbutils"
+)
+
+// NewHealthChecker resolves endpoints from DB URI.
+func NewHealthChecker(ctx context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	resolver, err := NewEndpointsResolver(ctx, cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return healthcheck.NewTargetDialer(resolver.Resolve), nil
+}
+
+// NewEndpointsResolver resolves endpoints from DB URI.
+func NewEndpointsResolver(_ context.Context, db types.Database) (healthcheck.Resolver, error) {
+	aws := db.GetAWS()
+	fips := dynamodbutils.IsFIPSEnabled()
+	resolverFns := []resolverFn{
+		resolveDynamoDBEndpoint,
+		resolveDynamoDBStreamsEndpoint,
+	}
+	return healthcheck.EndpointsResolverFunc(func(ctx context.Context) ([]string, error) {
+		addrs := make([]string, 0, len(resolverFns))
+		for _, resolve := range resolverFns {
+			re, err := resolve(ctx, aws.Region, aws.AccountID, fips)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			// Not all of our DB engines respect http proxy env vars, but this one does.
+			// The endpoint resolved for TCP health checks should be the one that the
+			// agent will actually connect to, since often proxy env vars are set to
+			// accommodate self-imposed network restrictions that force external traffic
+			// to go through a proxy.
+			proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+			proxyURL, err := proxyFunc(re.URL)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			if proxyURL != nil {
+				re.URL = proxyURL
+			}
+			host := re.URL.Hostname()
+			port := cmp.Or(re.URL.Port(), "443")
+			addrs = append(addrs, net.JoinHostPort(host, port))
+		}
+		return addrs, nil
+	}), nil
+}
diff --git a/lib/srv/db/elasticsearch/engine.go b/lib/srv/db/elasticsearch/engine.go
index e7636111b9ea9..f7746a32e8bf8 100644
--- a/lib/srv/db/elasticsearch/engine.go
+++ b/lib/srv/db/elasticsearch/engine.go
@@ -21,7 +21,6 @@ package elasticsearch
 import (
 	"bufio"
 	"bytes"
-	"cmp"
 	"context"
 	"encoding/json"
 	"io"
@@ -31,18 +30,15 @@ import (
 	"strconv"
 	"strings"
 
-	elastic "github.com/elastic/go-elasticsearch/v8/typedapi/types"
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -74,8 +70,18 @@ func (e *Engine) SendError(err error) {
 		return
 	}
 
+	// ErrorCause type.
+	//
+	// https://github.com/elastic/elasticsearch-specification/blob/f6a370d0fba975752c644fc730f7c45610e28f36/specification/_types/Errors.ts#L25-L50
+	type ErrorCause struct {
+		// Reason A human-readable explanation of the error, in English.
+		Reason *string `json:"reason,omitempty"`
+		// Type The type of error
+		Type string `json:"type"`
+	}
+
 	reason := err.Error()
-	cause := elastic.ErrorCause{
+	cause := ErrorCause{
 		Reason: &reason,
 		Type:   "internal_server_error_exception",
 	}
@@ -302,17 +308,3 @@ func parseURI(uri string) (*url.URL, error) {
 	u.Scheme = "https"
 	return u, nil
 }
-
-// NewEndpointsResolver resolves an endpoint from DB URI.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	dbURL, err := parseURI(db.GetURI())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	host := dbURL.Hostname()
-	port := cmp.Or(dbURL.Port(), "443")
-	hostPort := net.JoinHostPort(host, port)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{hostPort}, nil
-	}), nil
-}
diff --git a/lib/srv/db/elasticsearch/healthcheck.go b/lib/srv/db/elasticsearch/healthcheck.go
new file mode 100644
index 0000000000000..773e21ebfae55
--- /dev/null
+++ b/lib/srv/db/elasticsearch/healthcheck.go
@@ -0,0 +1,44 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package elasticsearch
+
+import (
+	"cmp"
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker resolves an endpoint from DB URI.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	dbURL, err := parseURI(cfg.Database.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	host := dbURL.Hostname()
+	port := cmp.Or(dbURL.Port(), "443")
+	hostPort := net.JoinHostPort(host, port)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{hostPort}, nil
+	}), nil
+}
diff --git a/lib/srv/db/elasticsearch/test.go b/lib/srv/db/elasticsearch/test.go
index 6b46d2afd3d10..3f4a86da0f043 100644
--- a/lib/srv/db/elasticsearch/test.go
+++ b/lib/srv/db/elasticsearch/test.go
@@ -24,9 +24,10 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strconv"
+	"strings"
 
-	"github.com/elastic/go-elasticsearch/v8"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/srv/db/common"
@@ -114,18 +115,44 @@ func (s *TestServer) Close() error {
 	return s.listener.Close()
 }
 
-// MakeTestClient returns Redis client connection according to the provided
-// parameters.
-func MakeTestClient(_ context.Context, config common.TestClientConfig) (*elasticsearch.Client, error) {
-	es, err := elasticsearch.NewClient(elasticsearch.Config{
-		Addresses: []string{"http://" + config.Address},
-	})
+type TestClient struct {
+	addr string
+}
 
+func (t TestClient) Ping() (*http.Response, error) {
+	u := url.URL{
+		Scheme: "http",
+		Host:   t.addr,
+		Path:   "/",
+	}
+	req, err := http.NewRequest(http.MethodHead, u.String(), http.NoBody)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, err
+	}
+
+	return http.DefaultClient.Do(req)
+}
+
+func (t TestClient) Query(q string) (*http.Response, error) {
+	u := url.URL{
+		Scheme: "http",
+		Host:   t.addr,
+		Path:   "/_sql",
+	}
+	req, err := http.NewRequest(http.MethodGet, u.String(), strings.NewReader(q))
+	if err != nil {
+		return nil, err
 	}
 
-	return es, nil
+	return http.DefaultClient.Do(req)
+}
+
+// MakeTestClient returns Redis client connection according to the provided
+// parameters.
+func MakeTestClient(_ context.Context, config common.TestClientConfig) (*TestClient, error) {
+	return &TestClient{
+		addr: config.Address,
+	}, nil
 }
 
 const (
diff --git a/lib/srv/db/elasticsearch_test.go b/lib/srv/db/elasticsearch_test.go
index 7c326381a0c09..47774de4ffed7 100644
--- a/lib/srv/db/elasticsearch_test.go
+++ b/lib/srv/db/elasticsearch_test.go
@@ -21,10 +21,12 @@ package db
 import (
 	"context"
 	"crypto/tls"
+	"io"
 	"net"
-	"strings"
+	"net/http"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -48,6 +50,7 @@ func newTestElasticsearchEngine(ec common.EngineConfig) common.Engine {
 }
 
 func TestAccessElasticsearch(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	testCtx := setupTestContext(ctx, t, withElasticsearch("Elasticsearch"))
 	go testCtx.startHandlingConnections()
@@ -116,26 +119,27 @@ func TestAccessElasticsearch(t *testing.T) {
 			require.NoError(t, err)
 
 			// Execute a query.
-			result, err := dbConn.SQL.Query(strings.NewReader(`{ "query": "SELECT 42" }`))
+			result, err := dbConn.Query(`{ "query": "SELECT 42" }`)
 			require.NoError(t, err)
 
 			if test.err {
 				t.Logf("result: %v", result)
-				require.True(t, result.IsError())
-				require.Equal(t, 401, result.StatusCode)
+				assert.NoError(t, result.Body.Close())
+				require.Equal(t, http.StatusUnauthorized, result.StatusCode)
 				return
 			}
-			require.NoError(t, err)
-			require.False(t, result.IsError())
-			require.False(t, result.HasWarnings())
-			require.Equal(t, `[200 OK] {"columns":[{"name":"42","type":"integer"}],"rows":[[42]]}`, result.String())
 
-			require.NoError(t, result.Body.Close())
+			out, err := io.ReadAll(result.Body)
+			assert.NoError(t, err)
+			assert.NoError(t, result.Body.Close())
+			require.Equal(t, http.StatusOK, result.StatusCode)
+			require.Equal(t, `{"columns":[{"name":"42","type":"integer"}],"rows":[[42]]}`, string(out))
 		})
 	}
 }
 
 func TestAuditElasticsearch(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 	testCtx := setupTestContext(ctx, t, withElasticsearch("Elasticsearch"))
 	go testCtx.startHandlingConnections()
@@ -148,9 +152,9 @@ func TestAuditElasticsearch(t *testing.T) {
 		require.NoError(t, err)
 
 		resp, err := dbConn.Ping()
-
 		require.NoError(t, err)
-		require.True(t, resp.IsError())
+		assert.NoError(t, resp.Body.Close())
+		require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
 
 		waitForEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
 		proxy.Close()
@@ -169,15 +173,19 @@ func TestAuditElasticsearch(t *testing.T) {
 		// Connect should trigger successful session start event.
 		resp, err := dbConn.Ping()
 		require.NoError(t, err)
-		require.False(t, resp.IsError())
+		assert.NoError(t, resp.Body.Close())
+		require.Equal(t, http.StatusOK, resp.StatusCode)
 		waitForEvent(t, testCtx, libevents.DatabaseSessionStartCode)
 	})
 
 	t.Run("command sends", func(t *testing.T) {
 		// should trigger Query event.
-		result, err := dbConn.SQL.Query(strings.NewReader(`{ "query": "SELECT 42" }`))
+		result, err := dbConn.Query(`{ "query": "SELECT 42" }`)
 		require.NoError(t, err)
-		require.Equal(t, `[200 OK] {"columns":[{"name":"42","type":"integer"}],"rows":[[42]]}`, result.String())
+		out, err := io.ReadAll(result.Body)
+		assert.NoError(t, err)
+		assert.NoError(t, result.Body.Close())
+		assert.Equal(t, `{"columns":[{"name":"42","type":"integer"}],"rows":[[42]]}`, string(out))
 
 		_ = waitForEvent(t, testCtx, libevents.ElasticsearchRequestCode)
 
diff --git a/lib/srv/db/endpoints/endpoints.go b/lib/srv/db/endpoints/endpoints.go
index 6ae49979ce7a9..fef3d22f62a45 100644
--- a/lib/srv/db/endpoints/endpoints.go
+++ b/lib/srv/db/endpoints/endpoints.go
@@ -16,21 +16,18 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+// TODO(gavin): delete this package after updating e to not depend on it.
 package endpoints
 
 import (
 	"context"
-	"sync"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
-)
-
-var (
-	resolverBuilders   = make(map[string]ResolverBuilder)
-	resolverBuildersMu sync.RWMutex
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
 )
 
 // ResolverBuilder constructs a [Resolver].
@@ -58,56 +55,19 @@ type ResolverBuilderConfig struct {
 
 // GCPClients are clients used to resolve GCP endpoints.
 type GCPClients interface {
-	// GetGCPSQLAdminClient returns GCP Cloud SQL Admin client.
-	GetGCPSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
+	// GetSQLAdminClient returns GCP Cloud SQL Admin client.
+	GetSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
+	// GetAlloyDBClient returns GCP AlloyDB Admin client.
+	GetAlloyDBClient(context.Context) (gcp.AlloyDBAdminClient, error)
 }
 
 // RegisterResolver registers a new database endpoint resolver.
 func RegisterResolver(builder ResolverBuilder, names ...string) {
-	resolverBuildersMu.Lock()
-	defer resolverBuildersMu.Unlock()
-	for _, name := range names {
-		resolverBuilders[name] = builder
-	}
-}
-
-// GetResolverBuilders is used in tests to cleanup after overriding a resolver.
-func GetResolverBuilders(names ...string) (map[string]ResolverBuilder, error) {
-	resolverBuildersMu.RLock()
-	defer resolverBuildersMu.RUnlock()
-	out := map[string]ResolverBuilder{}
-	for _, name := range names {
-		builder, ok := resolverBuilders[name]
-		if !ok {
-			return nil, trace.NotFound("database endpoint resolver builder %q is not registered", name)
+	healthchecks.RegisterHealthChecker(func(ctx context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+		resolver, err := builder(ctx, cfg.Database, ResolverBuilderConfig{GCPClients: cfg.GCPClients})
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		out[name] = builder
-	}
-	return out, nil
-}
-
-// GetResolver returns a resolver for the given database.
-func GetResolver(ctx context.Context, db types.Database, cfg ResolverBuilderConfig) (Resolver, error) {
-	name := db.GetProtocol()
-	resolverBuildersMu.RLock()
-	builder, ok := resolverBuilders[name]
-	resolverBuildersMu.RUnlock()
-	if !ok {
-		return nil, trace.NotFound("database endpoint resolver %q is not registered", name)
-	}
-
-	resolver, err := builder(ctx, db, cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return resolver, nil
-}
-
-// IsRegistered returns true if the given database protocol has been registered.
-func IsRegistered(db types.Database) bool {
-	name := db.GetProtocol()
-	resolverBuildersMu.RLock()
-	defer resolverBuildersMu.RUnlock()
-	_, ok := resolverBuilders[name]
-	return ok
+		return healthcheck.NewTargetDialer(resolver.Resolve), nil
+	}, names...)
 }
diff --git a/lib/srv/db/endpoints/endpoints_test.go b/lib/srv/db/endpoints/endpoints_test.go
deleted file mode 100644
index fd64d6fe6b679..0000000000000
--- a/lib/srv/db/endpoints/endpoints_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package endpoints
-
-import (
-	"context"
-	"fmt"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-)
-
-func TestGetResolver(t *testing.T) {
-	tests := []struct {
-		desc    string
-		builder ResolverBuilder
-		wantErr string
-	}{
-		{
-			desc:    "valid",
-			builder: fakeResolverBuilder{}.builderFunc(),
-		},
-		{
-			desc:    "builder error",
-			builder: fakeResolverBuilder{builderErr: trace.Errorf("failed to build resolver")}.builderFunc(),
-			wantErr: "failed to build resolver",
-		},
-		{
-			desc:    "builder not registered",
-			builder: nil,
-			wantErr: "is not registered",
-		},
-	}
-
-	ctx := context.Background()
-	for i, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			db := &types.DatabaseV3{}
-			db.SetName("dummy")
-			db.Spec.Protocol = fmt.Sprintf("fake-%v", i)
-			if test.builder != nil {
-				RegisterResolver(test.builder, db.Spec.Protocol)
-				t.Cleanup(func() {
-					resolverBuildersMu.Lock()
-					defer resolverBuildersMu.Unlock()
-					delete(resolverBuilders, db.Spec.Protocol)
-				})
-			}
-
-			resolver, err := GetResolver(ctx, db, ResolverBuilderConfig{})
-			if test.wantErr != "" {
-				require.ErrorContains(t, err, test.wantErr)
-				require.Nil(t, resolver)
-				return
-			}
-			require.NoError(t, err)
-			require.NotNil(t, resolver)
-		})
-	}
-}
-
-type fakeResolverBuilder struct {
-	builderErr error
-}
-
-func (f fakeResolverBuilder) builderFunc() ResolverBuilder {
-	return func(context.Context, types.Database, ResolverBuilderConfig) (Resolver, error) {
-		if f.builderErr != nil {
-			return nil, trace.Wrap(f.builderErr)
-		}
-		return fakeResolver{}, nil
-	}
-}
-
-type fakeResolver struct{}
-
-func (f fakeResolver) Resolve(context.Context) ([]string, error) {
-	return nil, nil
-}
diff --git a/lib/srv/db/ha_test.go b/lib/srv/db/ha_test.go
index a93aec4d836d6..dc86ad6ceea22 100644
--- a/lib/srv/db/ha_test.go
+++ b/lib/srv/db/ha_test.go
@@ -60,7 +60,7 @@ func TestHA(t *testing.T) {
 		Databases: types.Databases{offlineDB},
 		HostID:    offlineHostID,
 	})
-	testCtx.fakeRemoteSite.OfflineTunnels = map[string]struct{}{
+	testCtx.fakeCluster.OfflineTunnels = map[string]struct{}{
 		fmt.Sprintf("%v.%v", offlineHostID, testCtx.clusterName): {},
 	}
 
@@ -78,7 +78,7 @@ func TestHA(t *testing.T) {
 		HostID:    onlineHostID,
 	})
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.fakeCluster.ProxyConn() {
 			go onlineServer.HandleConnection(conn)
 		}
 	}()
diff --git a/lib/srv/db/healthchecks/healthchecks.go b/lib/srv/db/healthchecks/healthchecks.go
new file mode 100644
index 0000000000000..c5deda5ebf9da
--- /dev/null
+++ b/lib/srv/db/healthchecks/healthchecks.go
@@ -0,0 +1,147 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthchecks
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/common"
+)
+
+var (
+	healthCheckerBuilders   = make(map[string]HealthCheckerBuilder)
+	healthCheckerBuildersMu sync.RWMutex
+)
+
+// RegisterHealthChecker registers a new database health checker.
+func RegisterHealthChecker(builder HealthCheckerBuilder, names ...string) {
+	healthCheckerBuildersMu.Lock()
+	defer healthCheckerBuildersMu.Unlock()
+	for _, name := range names {
+		healthCheckerBuilders[name] = builder
+	}
+}
+
+// GetHealthCheckBuilders is used in tests to cleanup after overriding a resolver.
+func GetHealthCheckBuilders(names ...string) (map[string]HealthCheckerBuilder, error) {
+	healthCheckerBuildersMu.RLock()
+	defer healthCheckerBuildersMu.RUnlock()
+	out := map[string]HealthCheckerBuilder{}
+	for _, name := range names {
+		builder, ok := healthCheckerBuilders[name]
+		if !ok {
+			return nil, trace.NotFound("database endpoint resolver builder %q is not registered", name)
+		}
+		out[name] = builder
+	}
+	return out, nil
+}
+
+// GetHealthChecker returns a health checker for the given database.
+func GetHealthChecker(ctx context.Context, cfg HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	if err := cfg.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	name := cfg.Database.GetProtocol()
+	healthCheckerBuildersMu.RLock()
+	builder, ok := healthCheckerBuilders[name]
+	healthCheckerBuildersMu.RUnlock()
+	if !ok {
+		return nil, trace.NotFound("database endpoint resolver %q is not registered", name)
+	}
+
+	checker, err := builder(ctx, cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return checker, nil
+}
+
+// IsRegistered returns true if the given database protocol has been registered.
+func IsRegistered(db types.Database) bool {
+	name := db.GetProtocol()
+	healthCheckerBuildersMu.RLock()
+	defer healthCheckerBuildersMu.RUnlock()
+	_, ok := healthCheckerBuilders[name]
+	return ok
+}
+
+// HealthCheckerBuilder builds a database [healthcheck.HealthChecker].
+type HealthCheckerBuilder func(ctx context.Context, cfg HealthCheckerConfig) (healthcheck.HealthChecker, error)
+
+// HealthCheckerConfig is the config for a database [healthcheck.HealthChecker].
+type HealthCheckerConfig struct {
+	// Auth handles database access authentication.
+	Auth common.Auth
+	// AuthClient is the cluster auth server client.
+	AuthClient *authclient.Client
+	// Clock is an optional clock to use
+	Clock clockwork.Clock
+	// Database is the database to health check.
+	Database types.Database
+	// GCPClients are used to access GCP API for health checks.
+	GCPClients GCPClients
+	// Log is an optional logger.
+	Log *slog.Logger
+	// UpdateProxiedDatabase finds the proxied database by name and uses the
+	// provided function to update the database's status. Returns
+	// trace.NotFound if the name is not found otherwise forwards the error
+	// from the provided callback function.
+	UpdateProxiedDatabase func(string, func(types.Database) error) error
+}
+
+func (cfg *HealthCheckerConfig) checkAndSetDefaults() error {
+	switch {
+	case cfg.Auth == nil:
+		return trace.BadParameter("missing Auth")
+	case cfg.AuthClient == nil:
+		return trace.BadParameter("missing AuthClient")
+	case cfg.Database == nil:
+		return trace.BadParameter("missing Database")
+	case cfg.GCPClients == nil:
+		return trace.BadParameter("missing GCPClients")
+	case cfg.UpdateProxiedDatabase == nil:
+		return trace.BadParameter("missing UpdateProxiedDatabase")
+	}
+
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	if cfg.Log == nil {
+		cfg.Log = slog.Default()
+	}
+	return nil
+}
+
+// GCPClients are clients used to resolve GCP endpoints.
+type GCPClients interface {
+	// GetSQLAdminClient returns GCP Cloud SQL Admin client.
+	GetSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
+	// GetAlloyDBClient returns GCP AlloyDB Admin client.
+	GetAlloyDBClient(context.Context) (gcp.AlloyDBAdminClient, error)
+}
diff --git a/lib/srv/db/healthchecks/healthchecks_test.go b/lib/srv/db/healthchecks/healthchecks_test.go
new file mode 100644
index 0000000000000..768a059696671
--- /dev/null
+++ b/lib/srv/db/healthchecks/healthchecks_test.go
@@ -0,0 +1,116 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package healthchecks
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/common"
+)
+
+func TestGetHealthChecker(t *testing.T) {
+	tests := []struct {
+		desc    string
+		builder HealthCheckerBuilder
+		wantErr string
+	}{
+		{
+			desc:    "valid",
+			builder: fakeHealthCheckerBuilder{}.builderFunc(),
+		},
+		{
+			desc:    "builder error",
+			builder: fakeHealthCheckerBuilder{builderErr: trace.Errorf("failed to build resolver")}.builderFunc(),
+			wantErr: "failed to build resolver",
+		},
+		{
+			desc:    "builder not registered",
+			builder: nil,
+			wantErr: "is not registered",
+		},
+	}
+
+	ctx := context.Background()
+	for i, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			db := &types.DatabaseV3{}
+			db.SetName("dummy")
+			db.Spec.Protocol = fmt.Sprintf("fake-%v", i)
+			if test.builder != nil {
+				RegisterHealthChecker(test.builder, db.Spec.Protocol)
+				t.Cleanup(func() {
+					healthCheckerBuildersMu.Lock()
+					defer healthCheckerBuildersMu.Unlock()
+					delete(healthCheckerBuilders, db.Spec.Protocol)
+				})
+			}
+
+			resolver, err := GetHealthChecker(ctx, HealthCheckerConfig{
+				Auth:                  fakeAuth{},
+				AuthClient:            &authclient.Client{},
+				Clock:                 clockwork.NewFakeClock(),
+				Database:              db,
+				GCPClients:            fakeGCPClients{},
+				UpdateProxiedDatabase: func(string, func(types.Database) error) error { return nil },
+			})
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+				require.Nil(t, resolver)
+				return
+			}
+			require.NoError(t, err)
+			require.NotNil(t, resolver)
+		})
+	}
+}
+
+type fakeHealthCheckerBuilder struct {
+	builderErr error
+}
+
+func (f fakeHealthCheckerBuilder) builderFunc() HealthCheckerBuilder {
+	return func(context.Context, HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+		if f.builderErr != nil {
+			return nil, trace.Wrap(f.builderErr)
+		}
+		return healthcheck.NewTargetDialer(func(ctx context.Context) ([]string, error) {
+			return nil, nil
+		}), nil
+	}
+}
+
+type fakeAuth struct {
+	common.Auth
+}
+
+type fakeGCPClients struct {
+	gcp.Clients
+}
diff --git a/lib/srv/db/mongodb/connect.go b/lib/srv/db/mongodb/connect.go
index 5eda71825f2b4..1214931841da7 100644
--- a/lib/srv/db/mongodb/connect.go
+++ b/lib/srv/db/mongodb/connect.go
@@ -21,6 +21,7 @@ package mongodb
 import (
 	"context"
 	"crypto/tls"
+	"net/http"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -36,7 +37,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 )
 
@@ -68,17 +68,15 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	err = top.Connect()
-	if err != nil {
+	if err := top.Connect(); err != nil {
+		e.Log.DebugContext(e.Context, "Failed to connect topology", "error", err)
 		return nil, nil, trace.Wrap(err)
 	}
-	server, err := top.SelectServer(ctx, selector)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	e.Log.DebugContext(e.Context, "Connecting to cluster.", "topology", top, "server", server)
-	conn, err := server.Connection(ctx)
+	conn, err := e.selectServerConn(ctx, top, selector)
 	if err != nil {
+		if err := top.Disconnect(ctx); err != nil {
+			e.Log.WarnContext(e.Context, "Failed to close topology", "error", err)
+		}
 		return nil, nil, trace.Wrap(err)
 	}
 
@@ -93,6 +91,23 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 	return conn, closeFn, nil
 }
 
+func (e *Engine) selectServerConn(ctx context.Context, top *topology.Topology, selector description.ServerSelector) (driver.Connection, error) {
+	e.Log.DebugContext(e.Context, "Selecting server from topology", "topology", top)
+	server, err := top.SelectServer(ctx, selector)
+	if err != nil {
+		e.Log.DebugContext(e.Context, "failed to select server", "error", err)
+		return nil, trace.Wrap(err)
+	}
+
+	e.Log.DebugContext(e.Context, "Connecting to server", "server", server)
+	conn, err := server.Connection(ctx)
+	if err != nil {
+		e.Log.DebugContext(e.Context, "failed to connect to server", "error", err)
+		return nil, trace.Wrap(err)
+	}
+	return conn, nil
+}
+
 // getTopologyOptions constructs topology options for connecting to a MongoDB server.
 func (e *Engine) getTopologyOptions(ctx context.Context, sessionCtx *common.Session) (*topology.Config, description.ServerSelector, error) {
 	clientCfg, err := makeClientOptionsFromDatabaseURI(sessionCtx.Database.GetURI())
@@ -137,7 +152,7 @@ func (e *Engine) getConnectionOptions(ctx context.Context, sessionCtx *common.Se
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	authenticator, err := e.getAuthenticator(ctx, sessionCtx)
+	authenticator, err := e.getAuthenticator(ctx, sessionCtx, clientCfg.HTTPClient)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -158,12 +173,12 @@ func (e *Engine) getConnectionOptions(ctx context.Context, sessionCtx *common.Se
 				// client connecting to Teleport will get an error when they try
 				// to send its own metadata since client metadata is immutable.
 				&handshaker{},
-				&auth.HandshakeOptions{Authenticator: authenticator, HTTPClient: clientCfg.HTTPClient})
+				&auth.HandshakeOptions{Authenticator: authenticator})
 		}),
 	}, nil
 }
 
-func (e *Engine) getAuthenticator(ctx context.Context, sessionCtx *common.Session) (auth.Authenticator, error) {
+func (e *Engine) getAuthenticator(ctx context.Context, sessionCtx *common.Session, httpClient *http.Client) (auth.Authenticator, error) {
 	dbType := sessionCtx.Database.GetType()
 	isAtlasDB := dbType == types.DatabaseTypeMongoAtlas
 
@@ -175,15 +190,15 @@ func (e *Engine) getAuthenticator(ctx context.Context, sessionCtx *common.Sessio
 
 	switch {
 	case isAtlasDB && awsutils.IsRoleARN(sessionCtx.DatabaseUser):
-		return e.getAWSAuthenticator(ctx, sessionCtx)
+		return e.getAWSAuthenticator(ctx, sessionCtx, httpClient)
 	case dbType == types.DatabaseTypeDocumentDB:
 		// DocumentDB uses the same the IAM authenticator as MongoDB Atlas.
-		return e.getAWSAuthenticator(ctx, sessionCtx)
+		return e.getAWSAuthenticator(ctx, sessionCtx, httpClient)
 	default:
 		e.Log.DebugContext(e.Context, "Authenticating to database using certificates.")
 		authenticator, err := auth.CreateAuthenticator(auth.MongoDBX509, &auth.Cred{
 			Username: x509Username(sessionCtx),
-		})
+		}, httpClient)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -194,7 +209,7 @@ func (e *Engine) getAuthenticator(ctx context.Context, sessionCtx *common.Sessio
 
 // getAWSAuthenticator fetches the AWS credentials and initializes the MongoDB
 // authenticator.
-func (e *Engine) getAWSAuthenticator(ctx context.Context, sessionCtx *common.Session) (auth.Authenticator, error) {
+func (e *Engine) getAWSAuthenticator(ctx context.Context, sessionCtx *common.Session, httpClient *http.Client) (auth.Authenticator, error) {
 	e.Log.DebugContext(e.Context, "Authenticating to database using AWS IAM authentication.")
 
 	username, password, sessToken, err := e.Auth.GetAWSIAMCreds(ctx, sessionCtx.Database, sessionCtx.DatabaseUser)
@@ -209,7 +224,7 @@ func (e *Engine) getAWSAuthenticator(ctx context.Context, sessionCtx *common.Ses
 		Props: map[string]string{
 			awsSecretTokenKey: sessToken,
 		},
-	})
+	}, httpClient)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -232,27 +247,6 @@ func makeClientOptionsFromDatabaseURI(uri string) (*options.ClientOptions, error
 	return clientCfg, nil
 }
 
-// NewEndpointsResolver returns a health check target endpoint resolver.
-// SRV URI (mongodb+srv://) is resolved to a seed list from DNS SRV record
-// https://www.mongodb.com/docs/manual/reference/connection-string/#srv-connection-format
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	return newEndpointsResolver(db.GetURI()), nil
-}
-
-func newEndpointsResolver(uri string) endpoints.Resolver {
-	return endpoints.ResolverFn(func(ctx context.Context) ([]string, error) {
-		clientCfg, err := makeClientOptionsFromDatabaseURI(uri)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		endpoints := make([]string, 0, len(clientCfg.Hosts))
-		for _, host := range clientCfg.Hosts {
-			endpoints = append(endpoints, address.Address(host).String())
-		}
-		return endpoints, nil
-	})
-}
-
 // getServerSelector returns selector for picking the server to connect to,
 // which is mostly useful when connecting to a MongoDB replica set.
 //
diff --git a/lib/srv/db/mongodb/healthcheck.go b/lib/srv/db/mongodb/healthcheck.go
new file mode 100644
index 0000000000000..110a1d0139eca
--- /dev/null
+++ b/lib/srv/db/mongodb/healthcheck.go
@@ -0,0 +1,51 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mongodb
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"go.mongodb.org/mongo-driver/mongo/address"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker returns an endpoint health checker.
+// SRV URI (mongodb+srv://) is resolved to a seed list from DNS SRV record
+// https://www.mongodb.com/docs/manual/reference/connection-string/#srv-connection-format
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	resolver := newEndpointsResolver(cfg.Database.GetURI())
+	return healthcheck.NewTargetDialer(resolver.Resolve), nil
+}
+
+func newEndpointsResolver(uri string) healthcheck.EndpointsResolverFunc {
+	return func(ctx context.Context) ([]string, error) {
+		clientCfg, err := makeClientOptionsFromDatabaseURI(uri)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		endpoints := make([]string, 0, len(clientCfg.Hosts))
+		for _, host := range clientCfg.Hosts {
+			endpoints = append(endpoints, address.Address(host).String())
+		}
+		return endpoints, nil
+	}
+}
diff --git a/lib/srv/db/mongodb/protocol/errors.go b/lib/srv/db/mongodb/protocol/errors.go
index e7cd94b6ca88e..887f90a33dc23 100644
--- a/lib/srv/db/mongodb/protocol/errors.go
+++ b/lib/srv/db/mongodb/protocol/errors.go
@@ -28,16 +28,7 @@ import (
 
 // ReplyError sends error wire message to the client.
 func ReplyError(clientConn net.Conn, replyTo Message, clientErr error) (err error) {
-	if msgCompressed, ok := replyTo.(*MessageOpCompressed); ok {
-		replyTo = msgCompressed.GetOriginal()
-	}
-	var errMessage Message
-	switch replyTo.(type) {
-	case *MessageOpMsg: // When client request is OP_MSG, reply should be OP_MSG as well.
-		errMessage, err = makeOpMsgError(clientErr)
-	default: // Send OP_REPLY otherwise.
-		errMessage, err = makeOpReplyError(clientErr)
-	}
+	errMessage, err := MakeErrorMessage(replyTo, clientErr)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -54,6 +45,20 @@ func ReplyError(clientConn net.Conn, replyTo Message, clientErr error) (err erro
 	return nil
 }
 
+// MakeErrorMessage builds an error message as either an OP_REPLY or OP_MSG
+// depending on the message being replied to.
+func MakeErrorMessage(replyTo Message, clientErr error) (Message, error) {
+	if msgCompressed, ok := replyTo.(*MessageOpCompressed); ok {
+		replyTo = msgCompressed.GetOriginal()
+	}
+	switch replyTo.(type) {
+	case *MessageOpMsg: // When client request is OP_MSG, reply should be OP_MSG as well.
+		return makeOpMsgError(clientErr)
+	default: // Send OP_REPLY otherwise.
+		return makeOpReplyError(clientErr)
+	}
+}
+
 // makeOpReplyError builds a OP_REPLY error wire message.
 func makeOpReplyError(err error) (Message, error) {
 	document, err := bson.Marshal(bson.M{
diff --git a/lib/srv/db/mongodb/protocol/opcompressed.go b/lib/srv/db/mongodb/protocol/opcompressed.go
index 70e7bddeb637e..3ea629c71b7ca 100644
--- a/lib/srv/db/mongodb/protocol/opcompressed.go
+++ b/lib/srv/db/mongodb/protocol/opcompressed.go
@@ -103,6 +103,7 @@ func readOpCompressed(header MessageHeader, payload []byte, maxMessageSize uint3
 		return nil, trace.BadParameter("malformed OP_COMPRESSED: missing compressor ID %v", payload)
 	}
 	compressedSize := header.MessageLength - 25 // header (16) + original opcode (4) + uncompressed size (4) + compressor ID (1)
+	//nolint:staticcheck // SA1019. This func is removed in the v2 driver.
 	compressedMessage, _, ok := wiremessage.ReadCompressedCompressedMessage(rem, compressedSize)
 	if !ok {
 		return nil, trace.BadParameter("malformed OP_COMPRESSED: missing compressed message %v", payload)
diff --git a/lib/srv/db/mongodb/test.go b/lib/srv/db/mongodb/test.go
index 3e04fd810edb9..244bc179985d5 100644
--- a/lib/srv/db/mongodb/test.go
+++ b/lib/srv/db/mongodb/test.go
@@ -43,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/mongodb/protocol"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // MakeTestClient returns MongoDB client connection according to the provided
@@ -97,6 +98,9 @@ type TestServer struct {
 	// saslConversionTracker map to track which SASL mechanism is being used by
 	// the conversion ID.
 	saslConversationTracker sync.Map
+
+	// fakeUserAuthError maps fake errors to specific users during auth handshake
+	fakeUserAuthError map[string]error
 }
 
 // TestServerOption allows to set test server options.
@@ -116,6 +120,15 @@ func TestServerMaxMessageSize(maxMessageSize uint32) TestServerOption {
 	}
 }
 
+func TestServerSetFakeUserAuthError(user string, fakeErr error) TestServerOption {
+	return func(ts *TestServer) {
+		if !strings.HasPrefix(user, "CN=") {
+			user = "CN=" + user
+		}
+		ts.fakeUserAuthError[user] = fakeErr
+	}
+}
+
 // NewTestServer returns a new instance of a test MongoDB server.
 func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (svr *TestServer, err error) {
 	err = config.CheckAndSetDefaults()
@@ -132,8 +145,8 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (sv
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	log := utils.NewSlogLoggerForTests().With(
-		teleport.ComponentKey, defaults.ProtocolMongoDB,
+	tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
+	log := logtest.With(teleport.ComponentKey, defaults.ProtocolMongoDB,
 		"name", config.Name,
 	)
 	server := &TestServer{
@@ -147,6 +160,7 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (sv
 			userEventsCh: make(chan UserEvent, 100),
 			users:        make(map[string]userWithTracking),
 		},
+		fakeUserAuthError: map[string]error{},
 	}
 	for _, o := range opts {
 		o(server)
@@ -186,7 +200,7 @@ func (s *TestServer) Serve() error {
 // handleConnection receives Mongo wire messages from the client connection
 // and sends back the response messages.
 func (s *TestServer) handleConnection(conn net.Conn) error {
-	release, err := s.trackUserConnection(conn)
+	username, release, err := s.trackUserConnection(conn)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -199,7 +213,7 @@ func (s *TestServer) handleConnection(conn net.Conn) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		reply, err := s.handleMessage(message)
+		reply, err := s.handleMessage(username, message)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -211,7 +225,7 @@ func (s *TestServer) handleConnection(conn net.Conn) error {
 }
 
 // handleMessage makes response for the provided command received from client.
-func (s *TestServer) handleMessage(message protocol.Message) (protocol.Message, error) {
+func (s *TestServer) handleMessage(username string, message protocol.Message) (protocol.Message, error) {
 	command, err := message.GetCommand()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -222,7 +236,7 @@ func (s *TestServer) handleMessage(message protocol.Message) (protocol.Message,
 	case commandHello:
 		return s.handleHello(message)
 	case commandAuth:
-		return s.handleAuth(message)
+		return s.handleAuth(username, message)
 	case commandPing:
 		return s.handlePing(message)
 	case commandFind:
@@ -252,7 +266,7 @@ func (s *TestServer) handleMessage(message protocol.Message) (protocol.Message,
 }
 
 // handleAuth makes response to the client's "authenticate" command.
-func (s *TestServer) handleAuth(message protocol.Message) (protocol.Message, error) {
+func (s *TestServer) handleAuth(username string, message protocol.Message) (protocol.Message, error) {
 	// If authentication token is set on the server, it should only use SASL.
 	// This avoid false positives where Teleport uses the wrong authentication
 	// method.
@@ -268,6 +282,9 @@ func (s *TestServer) handleAuth(message protocol.Message) (protocol.Message, err
 	if command != commandAuth {
 		return nil, trace.BadParameter("expected authenticate command, got: %s", message)
 	}
+	if err, ok := s.fakeUserAuthError[username]; ok && err != nil {
+		return protocol.MakeErrorMessage(message, err)
+	}
 	authReply, err := makeOKReply()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -624,16 +641,16 @@ func (t *usersTracker) UserEventsCh() <-chan UserEvent {
 	return t.userEventsCh
 }
 
-func (t *usersTracker) trackUserConnection(conn net.Conn) (func(), error) {
+func (t *usersTracker) trackUserConnection(conn net.Conn) (string, func(), error) {
 	tlsConn, ok := conn.(*tls.Conn)
 	if !ok {
-		return func() {}, nil
+		return "", func() {}, nil
 	}
 
 	if err := tlsConn.Handshake(); err != nil {
-		return nil, trace.Wrap(err)
+		return "", nil, trace.Wrap(err)
 	} else if len(tlsConn.ConnectionState().PeerCertificates) == 0 {
-		return func() {}, nil
+		return "", func() {}, nil
 	}
 
 	username := "CN=" + tlsConn.ConnectionState().PeerCertificates[0].Subject.CommonName
@@ -644,7 +661,7 @@ func (t *usersTracker) trackUserConnection(conn net.Conn) (func(), error) {
 		user.activeConnections[conn] = struct{}{}
 	}
 
-	return func() {
+	return username, func() {
 		// Untrack per-user active connections.
 		t.usersMu.Lock()
 		defer t.usersMu.Unlock()
diff --git a/lib/srv/db/mysql/autousers.go b/lib/srv/db/mysql/autousers.go
index bc26cb72cd757..190cc94f38ed7 100644
--- a/lib/srv/db/mysql/autousers.go
+++ b/lib/srv/db/mysql/autousers.go
@@ -147,7 +147,7 @@ func (e *Engine) ActivateUser(ctx context.Context, sessionCtx *common.Session) e
 
 	// Use "tp-<hash>" in case DatabaseUser is over max username length.
 	sessionCtx.DatabaseUser = maybeHashUsername(sessionCtx.DatabaseUser, conn.maxUsernameLength())
-	e.Log.InfoContext(e.Context, "Activating MySQL user.", "user", sessionCtx.DatabaseUser, "roles", sessionCtx.DatabaseRoles, "identity", sessionCtx.Identity.Username)
+	e.Log.InfoContext(e.Context, "Activating MySQL user", "user", sessionCtx.DatabaseUser, "roles", sessionCtx.DatabaseRoles, "identity", sessionCtx.Identity.Username)
 
 	// Prep JSON.
 	details, err := makeActivateUserDetails(sessionCtx, sessionCtx.Identity.Username)
@@ -162,7 +162,7 @@ func (e *Engine) ActivateUser(ctx context.Context, sessionCtx *common.Session) e
 		details,
 	)
 	if err != nil {
-		e.Log.DebugContext(e.Context, "Call teleport_activate_user failed.", "error", err)
+		e.Log.DebugContext(e.Context, "Call teleport_activate_user failed", "error", err)
 		err = convertActivateError(sessionCtx, err)
 		e.Audit.OnDatabaseUserCreate(ctx, sessionCtx, err)
 		return trace.Wrap(err)
@@ -183,7 +183,7 @@ func (e *Engine) DeactivateUser(ctx context.Context, sessionCtx *common.Session)
 	}
 	defer conn.Close()
 
-	e.Log.InfoContext(e.Context, "Deactivating MySQL user.", "user", sessionCtx.DatabaseUser, "identity", sessionCtx.Identity.Username)
+	e.Log.InfoContext(e.Context, "Deactivating MySQL user", "user", sessionCtx.DatabaseUser, "identity", sessionCtx.Identity.Username)
 
 	err = conn.executeAndCloseResult(
 		fmt.Sprintf("CALL %s(?)", deactivateUserProcedureName),
@@ -191,7 +191,7 @@ func (e *Engine) DeactivateUser(ctx context.Context, sessionCtx *common.Session)
 	)
 
 	if getSQLState(err) == common.SQLStateActiveUser {
-		e.Log.DebugContext(e.Context, "Failed to deactivate user.", "user", sessionCtx.DatabaseUser, "error", err)
+		e.Log.DebugContext(e.Context, "Failed to deactivate user", "user", sessionCtx.DatabaseUser, "error", err)
 		return nil
 	}
 
@@ -211,12 +211,12 @@ func (e *Engine) DeleteUser(ctx context.Context, sessionCtx *common.Session) err
 	}
 	defer conn.Close()
 
-	e.Log.InfoContext(e.Context, "Deleting MySQL user.", "database_user", sessionCtx.DatabaseUser, "identity", sessionCtx.Identity.Username)
+	e.Log.InfoContext(e.Context, "Deleting MySQL user", "database_user", sessionCtx.DatabaseUser, "identity", sessionCtx.Identity.Username)
 
 	result, err := conn.Execute(fmt.Sprintf("CALL %s(?)", deleteUserProcedureName), sessionCtx.DatabaseUser)
 	if err != nil {
 		if getSQLState(err) == common.SQLStateActiveUser {
-			e.Log.DebugContext(e.Context, "Failed to delete user.", "user", sessionCtx.DatabaseUser, "error", err)
+			e.Log.DebugContext(e.Context, "Failed to delete user", "user", sessionCtx.DatabaseUser, "error", err)
 			return nil
 		}
 
@@ -228,12 +228,12 @@ func (e *Engine) DeleteUser(ctx context.Context, sessionCtx *common.Session) err
 	deleted := true
 	switch readDeleteUserResult(result) {
 	case common.SQLStateUserDropped:
-		e.Log.DebugContext(e.Context, "User deleted successfully.", "user", sessionCtx.DatabaseUser)
+		e.Log.DebugContext(e.Context, "User deleted successfully", "user", sessionCtx.DatabaseUser)
 	case common.SQLStateUserDeactivated:
-		e.Log.InfoContext(e.Context, "Unable to delete user, it was disabled instead.", "user", sessionCtx.DatabaseUser)
+		e.Log.InfoContext(e.Context, "Unable to delete user, it was disabled instead", "user", sessionCtx.DatabaseUser)
 		deleted = false
 	default:
-		e.Log.WarnContext(e.Context, "Unable to determine user deletion state.", "user", sessionCtx.DatabaseUser)
+		e.Log.WarnContext(e.Context, "Unable to determine user deletion state", "user", sessionCtx.DatabaseUser)
 	}
 	e.Audit.OnDatabaseUserDeactivate(ctx, sessionCtx, deleted, nil)
 
@@ -277,7 +277,7 @@ func (e *Engine) setupDatabaseForAutoUsers(conn *clientConn, sessionCtx *common.
 	}
 
 	// If update is necessary, do a transaction.
-	e.Log.DebugContext(e.Context, "Updating stored procedures for MySQL server.", "database", sessionCtx.Database.GetName())
+	e.Log.DebugContext(e.Context, "Updating stored procedures for MySQL server")
 	return trace.Wrap(doTransaction(conn, func() error {
 		for _, procedureName := range allProcedureNames {
 			dropCommand := fmt.Sprintf("DROP PROCEDURE IF EXISTS %s", procedureName)
@@ -376,7 +376,7 @@ func checkMySQLSupportedVersion(ctx context.Context, log *slog.Logger, serverVer
 	ver, err := semver.NewVersion(serverVersion)
 	switch {
 	case err != nil:
-		log.DebugContext(ctx, "Invalid MySQL server version. Assuming role management is supported.", "server_version", serverVersion)
+		log.DebugContext(ctx, "Invalid MySQL server version. Assuming role management is supported", "server_version", serverVersion)
 		return nil
 
 	// Reference:
@@ -406,7 +406,7 @@ func checkMariaDBSupportedVersion(ctx context.Context, log *slog.Logger, serverV
 	ver, err := semver.NewVersion(serverVersion)
 	switch {
 	case err != nil:
-		log.DebugContext(ctx, "Invalid MariaDB server version. Assuming role management is supported.", "server_version", serverVersion)
+		log.DebugContext(ctx, "Invalid MariaDB server version. Assuming role management is supported", "server_version", serverVersion)
 		return nil
 
 	case ver.Major > 10:
@@ -544,7 +544,7 @@ func getCreateProcedureCommand(conn *clientConn, procedureName string) (string,
 const (
 	// procedureVersion is a hard-coded string that is set as procedure
 	// comments to indicate the procedure version.
-	procedureVersion = "teleport-auto-user-v4"
+	procedureVersion = "teleport-auto-user-v5"
 
 	// mysqlMaxUsernameLength is the maximum username/role length for MySQL.
 	//
diff --git a/lib/srv/db/mysql/connector.go b/lib/srv/db/mysql/connector.go
new file mode 100644
index 0000000000000..a29cf24ee4409
--- /dev/null
+++ b/lib/srv/db/mysql/connector.go
@@ -0,0 +1,317 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/client"
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/time/rate"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/srv/db/common"
+	discoverycommon "github.com/gravitational/teleport/lib/srv/discovery/common"
+)
+
+func newConnector(cfg connectorConfig) (*connector, error) {
+	if err := cfg.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &connector{
+		connectorConfig: cfg,
+		gcpAuth: &gcpAuth{
+			auth:         cfg.auth,
+			authClient:   cfg.authClient,
+			clients:      cfg.gcpClients,
+			clock:        cfg.clock,
+			database:     cfg.database,
+			databaseUser: cfg.databaseUser,
+			log:          cfg.log,
+			// avoid checking the ssl mode more than once every 30 minutes
+			sometimes: &rate.Sometimes{Interval: 30 * time.Minute},
+		},
+	}, nil
+}
+
+type connectorConfig struct {
+	auth       common.Auth
+	authClient *authclient.Client
+	clock      clockwork.Clock
+	gcpClients gcpClients
+	log        *slog.Logger
+
+	database     types.Database
+	databaseName string
+	databaseUser string
+}
+
+func (cfg *connectorConfig) checkAndSetDefaults() error {
+	if cfg.auth == nil {
+		return trace.BadParameter("missing auth")
+	}
+	if cfg.authClient == nil {
+		return trace.BadParameter("missing authClient")
+	}
+	if cfg.gcpClients == nil {
+		return trace.BadParameter("missing gcpClients")
+	}
+	if cfg.database == nil {
+		return trace.BadParameter("missing database")
+	}
+	if cfg.databaseUser == "" {
+		return trace.BadParameter("missing databaseUser")
+	}
+
+	if cfg.clock == nil {
+		cfg.clock = clockwork.NewRealClock()
+	}
+	if cfg.log == nil {
+		cfg.log = slog.Default()
+	}
+	return nil
+}
+
+// connector connects to MySQL databases.
+type connector struct {
+	connectorConfig
+
+	gcpAuth *gcpAuth
+}
+
+// connect establishes connection to MySQL database.
+func (c *connector) connect(
+	ctx context.Context,
+	certExpiry time.Time,
+	onDial func(context.Context, net.Conn),
+) (*client.Conn, error) {
+	tlsConfig, err := c.auth.GetTLSConfig(ctx, certExpiry, c.database, c.databaseUser)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	user := c.databaseUser
+	connectOpt := func(conn *client.Conn) error {
+		conn.SetTLSConfig(tlsConfig)
+		return nil
+	}
+
+	var dialer client.Dialer
+	var password string
+	switch {
+	case c.database.IsRDS(), c.database.IsRDSProxy():
+		password, err = c.auth.GetRDSAuthToken(ctx, c.database, c.databaseUser)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case c.database.IsCloudSQL():
+		user, password, err = c.gcpAuth.getGCPUserAndPassword(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		requireSSL, err := c.gcpAuth.checkSSLRequired(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// Create ephemeral certificate and append to TLS config when
+		// the instance requires SSL. Also use a TLS dialer instead of
+		// the default net dialer when GCP requires SSL.
+		if requireSSL {
+			if err := c.gcpAuth.appendGCPClientCert(ctx, certExpiry, tlsConfig); err != nil {
+				return nil, trace.Wrap(err)
+			}
+			connectOpt = func(*client.Conn) error {
+				return nil
+			}
+			dialer = newGCPTLSDialer(tlsConfig)
+		}
+	case c.database.IsAzure():
+		password, err = c.auth.GetAzureAccessToken(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		user = discoverycommon.MakeAzureDatabaseLoginUsername(c.database, user)
+	}
+
+	// Use default net dialer unless it is already initialized.
+	if dialer == nil {
+		var nd net.Dialer
+		dialer = nd.DialContext
+	}
+
+	c.log.DebugContext(ctx, "Connecting to database")
+	// TODO(r0mant): Set CLIENT_INTERACTIVE flag on the client?
+	conn, err := client.ConnectWithDialer(ctx, "tcp", c.database.GetURI(),
+		user,
+		password,
+		c.databaseName,
+		func(ctx context.Context, network, address string) (net.Conn, error) {
+			conn, err := dialer(ctx, network, address)
+			if err != nil {
+				return nil, trace.Wrap(newDialError(err))
+			}
+			if onDial != nil {
+				recorder := newRecorderConn(conn)
+				onDial(ctx, recorder)
+				return recorder.rewind(), nil
+			}
+			return conn, nil
+		},
+		connectOpt,
+		// client-set capabilities only.
+		// TODO(smallinsky) Forward "real" capabilities from mysql client to mysql server.
+		withClientCapabilities(
+			mysql.CLIENT_MULTI_RESULTS,
+			mysql.CLIENT_MULTI_STATEMENTS,
+		),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return conn, nil
+}
+
+// updateServerVersion updates the server runtime version if the version
+// reported by the database is different from the version in status
+// configuration.
+func updateServerVersion(
+	ctx context.Context,
+	log *slog.Logger,
+	db types.Database,
+	serverVersion string,
+	updateProxiedDatabase func(string, func(types.Database) error) error,
+) error {
+	statusVersion := db.GetMySQLServerVersion()
+
+	// Update only when needed.
+	if serverVersion == "" || serverVersion == statusVersion {
+		return nil
+	}
+
+	// Note that db may be a copy of the database cached by database service.
+	// Call updateProxiedDatabase to update the original as well.
+	db.SetMySQLServerVersion(serverVersion)
+	doUpdate := func(db types.Database) error {
+		db.SetMySQLServerVersion(serverVersion)
+		return nil
+	}
+
+	log.DebugContext(ctx, "Updated MySQL server version",
+		"old_version", statusVersion,
+		"version", serverVersion,
+	)
+	return trace.Wrap(updateProxiedDatabase(db.GetName(), doUpdate))
+}
+
+func newRecorderConn(conn net.Conn) *recorderConn {
+	rc := &recorderConn{Conn: conn}
+	rc.reset()
+	return rc
+}
+
+type recorderConn struct {
+	net.Conn
+	// buf contains the recorded data read since the last reset or rewind.
+	buf bytes.Buffer
+	// recordingReader is used to limit reads from the conn that are written to the
+	// buffer. The recorder enforces a limit to prevent accidental memory
+	// exhaustion.
+	recordingReader *io.LimitedReader
+}
+
+// Read implements [io.Reader]. All reads from the connection are recorded up
+// to a fixed size limit. After the limit is reached, all further reads are not
+// recorded.
+func (rc *recorderConn) Read(p []byte) (int, error) {
+	return io.MultiReader(rc.recordingReader, rc.Conn).Read(p)
+}
+
+func (rc *recorderConn) reset() {
+	const bufferSizeLimit = 1 << 20 // 1MB
+	rc.buf.Reset()
+	rc.recordingReader = &io.LimitedReader{
+		R: io.TeeReader(rc.Conn, &rc.buf),
+		N: bufferSizeLimit,
+	}
+}
+
+// remainingBufferSize returns the remaining size, in bytes, of the current
+// recorder buffer.
+func (rc *recorderConn) remainingBufferSize() int {
+	return int(rc.recordingReader.N)
+}
+
+// rewind sets the underlying [net.Conn] to a [bufferedConn] that reads from the
+// recorded data first, then the connection itself. After calling rewind the
+// recorder can be reused, but it should not be used once recording is no longer
+// necessary, since it will continue to buffer reads in memory up to its buffer
+// limit.
+// The [net.Conn] returned will replay recorded data, but it will not record
+// further reads, so it should be used once recording is no longer needed.
+func (rc *recorderConn) rewind() net.Conn {
+	rc.Conn = newBufferedConn(bytes.NewReader(bytes.Clone(rc.buf.Bytes())), rc.Conn)
+	rc.reset()
+	return rc.Conn
+}
+
+func newBufferedConn(recording io.Reader, conn net.Conn) *bufferedConn {
+	return &bufferedConn{
+		Conn:      conn,
+		recording: recording,
+	}
+}
+
+type bufferedConn struct {
+	net.Conn
+	recording io.Reader
+}
+
+func (bc *bufferedConn) Read(p []byte) (int, error) {
+	return io.MultiReader(bc.recording, bc.Conn).Read(p)
+}
+
+// dialError is used to mark errors encountered when attempting to connect
+// to the MySQL database.
+type dialError struct{ inner error }
+
+// newDialError returns a dialError.
+func newDialError(inner error) *dialError {
+	if inner == nil {
+		return nil
+	}
+	return &dialError{inner: inner}
+}
+
+func (d *dialError) Error() string { return d.inner.Error() }
+func (d *dialError) Unwrap() error { return d.inner }
+
+// isDialError checks if the error is from failing to dial the MySQL database.
+func isDialError(err error) bool {
+	var target *dialError
+	return errors.As(err, &target)
+}
diff --git a/lib/srv/db/mysql/connector_test.go b/lib/srv/db/mysql/connector_test.go
new file mode 100644
index 0000000000000..fc68d1a3cb138
--- /dev/null
+++ b/lib/srv/db/mysql/connector_test.go
@@ -0,0 +1,139 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net"
+	"strings"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_isDialError(t *testing.T) {
+	tests := []struct {
+		desc string
+		err  error
+		want bool
+	}{
+		{
+			desc: "non dial error",
+			err:  errors.New("llama stampede!"),
+		},
+		{
+			desc: "dial error",
+			err:  newDialError(errors.New("failed to dial x.x.x.x")),
+			want: true,
+		},
+		{
+			desc: "nil error",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			require.Equal(t, test.want, isDialError(trace.Wrap(test.err)))
+		})
+	}
+}
+
+func Test_recorderConn(t *testing.T) {
+	mustWrite := func(t *testing.T, w io.Writer, data string) {
+		t.Helper()
+		n, err := io.WriteString(w, data)
+		require.NoError(t, err)
+		require.Equal(t, len(data), n)
+	}
+
+	mustRead := func(t *testing.T, r io.Reader, want string) {
+		t.Helper()
+		buf := make([]byte, len(want))
+		n, err := io.ReadFull(r, buf)
+		require.NoError(t, err)
+		require.Equal(t, want, string(buf[:n]))
+	}
+
+	conn := &fakeConn{}
+	recorder := newRecorderConn(conn)
+
+	t.Run("rewind and replay reads", func(t *testing.T) {
+		mustWrite(t, conn, "hello")
+		mustRead(t, recorder, "hello")
+
+		mustWrite(t, conn, "world")
+		mustRead(t, recorder, "world")
+
+		recorder.rewind()
+		mustRead(t, recorder, "helloworld")
+		recorder.rewind()
+		mustRead(t, recorder, "helloworld")
+		recorder.rewind()
+		mustRead(t, recorder, "helloworld")
+
+		mustWrite(t, conn, "!")
+		recorder.rewind()
+		mustRead(t, recorder, "helloworld!")
+		rawConn := recorder.rewind()
+		mustRead(t, rawConn, "helloworld!")
+		mustRead(t, rawConn, "")
+		mustRead(t, recorder, "")
+	})
+
+	t.Run("limits memory usage", func(t *testing.T) {
+		recorder.reset()
+		bufferLimit := recorder.remainingBufferSize()
+		require.Positive(t, bufferLimit)
+		xs := strings.Repeat("x", bufferLimit)
+		mustWrite(t, conn, xs)
+		mustWrite(t, conn, "y")
+
+		got, err := io.ReadAll(recorder)
+		require.NoError(t, err, "exceeding the buffer limit should not produce an error")
+		require.Equal(t, xs+"y", string(got))
+
+		for range 3 {
+			t.Run("rewind and replay up to buffer limit", func(t *testing.T) {
+				recorder.rewind()
+				remaining := recorder.remainingBufferSize()
+				require.Equal(t, bufferLimit, remaining, "after rewinding we should be able to record the full limit again")
+				got, err := io.ReadAll(recorder)
+				require.NoError(t, err, "exceeding the buffer limit should not produce an error")
+				require.Equal(t, xs, string(got), "the last byte exceeded the recording limit and should not have been recorded")
+				mustWrite(t, conn, "z")
+				mustRead(t, recorder, "z")
+			})
+		}
+	})
+}
+
+type fakeConn struct {
+	net.Conn
+	buf bytes.Buffer
+}
+
+func (c *fakeConn) Read(b []byte) (n int, err error) {
+	return c.buf.Read(b)
+}
+
+func (c *fakeConn) Write(b []byte) (n int, err error) {
+	return c.buf.Write(b)
+}
diff --git a/lib/srv/db/mysql/engine.go b/lib/srv/db/mysql/engine.go
index 0a46b373c8207..e0a3850799ed1 100644
--- a/lib/srv/db/mysql/engine.go
+++ b/lib/srv/db/mysql/engine.go
@@ -21,28 +21,18 @@ package mysql
 import (
 	"context"
 	"crypto/tls"
-	"fmt"
 	"io"
 	"net"
-	"time"
 
 	"github.com/go-mysql-org/go-mysql/client"
 	"github.com/go-mysql-org/go-mysql/mysql"
-	"github.com/go-mysql-org/go-mysql/packet"
 	"github.com/go-mysql-org/go-mysql/server"
 	"github.com/gravitational/trace"
-	"golang.org/x/time/rate"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/cloud/gcp"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/srv/db/cloud"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/srv/db/mysql/protocol"
-	discoverycommon "github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -62,20 +52,34 @@ type Engine struct {
 	// EngineConfig is the common database engine configuration.
 	common.EngineConfig
 	// proxyConn is a client connection.
-	proxyConn server.Conn
+	proxyConn *server.Conn
 }
 
 // InitializeConnection initializes the engine with client connection.
 func (e *Engine) InitializeConnection(clientConn net.Conn, _ *common.Session) error {
-	// Make server conn to get access to protocol's WriteOK/WriteError methods.
-	e.proxyConn = server.Conn{Conn: packet.NewConn(clientConn)}
+	e.proxyConn = makeProxyConn(clientConn)
 	return nil
 }
 
+func makeProxyConn(clientConn net.Conn) *server.Conn {
+	return server.MakeConn(
+		clientConn,
+		server.NewServer(
+			DefaultServerVersion,
+			mysql.DEFAULT_COLLATION_ID,
+			mysql.AUTH_CACHING_SHA2_PASSWORD,
+			nil,
+			nil,
+		),
+		&credentialProvider{},
+		server.EmptyHandler{},
+	)
+}
+
 // SendError sends an error to connected client in the MySQL understandable format.
 func (e *Engine) SendError(err error) {
 	if writeErr := e.proxyConn.WriteError(trace.Unwrap(err)); writeErr != nil {
-		e.Log.DebugContext(e.Context, "Failed to send error to MySQL client.", "client_error", err, "write_error", writeErr)
+		e.Log.DebugContext(e.Context, "Failed to send error to MySQL client", "client_error", err, "write_error", writeErr)
 	}
 }
 
@@ -102,7 +106,7 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 	defer func() {
 		err := e.GetUserProvisioner(e).Teardown(ctx, sessionCtx)
 		if err != nil {
-			e.Log.ErrorContext(e.Context, "Failed to teardown the user.", "error", err)
+			e.Log.ErrorContext(e.Context, "Failed to teardown the user", "error", err)
 		}
 	}()
 
@@ -118,7 +122,7 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 	defer func() {
 		err := serverConn.Quit()
 		if err != nil {
-			e.Log.ErrorContext(ctx, "Failed to close connection to MySQL server.", "error", err)
+			e.Log.ErrorContext(ctx, "Failed to close connection to MySQL server", "error", err)
 		}
 	}()
 
@@ -127,17 +131,21 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 
 	// Internally, updateServerVersion() updates databases only when database version
 	// is not set, or it has changed since previous call.
-	if err := e.updateServerVersion(sessionCtx, serverConn); err != nil {
-		// Log but do not fail connection if the version update fails.
-		e.Log.WarnContext(ctx, "Failed to update the MySQL server version.", "error", err)
-
+	e.updateServerVersion(ctx, sessionCtx.Database, serverConn)
+
+	// notify proxy of auth/connect success. At this point the original client
+	// should consider the connection phase completed.
+	if err := notifyProxy(ctx, e.Log, getHandshakeMode(), e.proxyConn); err != nil {
+		e.Log.ErrorContext(ctx, "Failed to notify proxy of connection",
+			"error", err,
+		)
+		return trace.Wrap(err)
 	}
 
-	// Send back OK packet to indicate auth/connect success. At this point
-	// the original client should consider the connection phase completed.
-	err = e.proxyConn.WriteOK(nil)
-	if err != nil {
-		return trace.Wrap(err)
+	if attrs := e.proxyConn.Attributes(); attrs != nil {
+		if clientName, ok := attrs[clientNameParamName]; ok {
+			sessionCtx.UserAgent = clientName
+		}
 	}
 
 	e.Audit.OnSessionStart(e.Context, sessionCtx, nil)
@@ -152,40 +160,24 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 	go e.receiveFromServer(serverConn, e.proxyConn.Conn, serverErrCh, sessionCtx)
 	select {
 	case err := <-clientErrCh:
-		e.Log.DebugContext(e.Context, "Client done.", "error", err)
+		e.Log.DebugContext(e.Context, "Client done", "error", err)
 	case err := <-serverErrCh:
-		e.Log.DebugContext(e.Context, "Server done.", "error", err)
+		e.Log.DebugContext(e.Context, "Server done", "error", err)
 	case <-ctx.Done():
-		e.Log.DebugContext(e.Context, "Context canceled.")
+		e.Log.DebugContext(e.Context, "Context canceled")
 	}
 	return nil
 }
 
-// updateServerVersion updates the server runtime version if the version reported by the database is different from
-// the version in status configuration.
-func (e *Engine) updateServerVersion(sessionCtx *common.Session, serverConn *client.Conn) error {
-	serverVersion := serverConn.GetServerVersion()
-	statusVersion := sessionCtx.Database.GetMySQLServerVersion()
-
-	// Update only when needed.
-	if serverVersion == "" || serverVersion == statusVersion {
-		return nil
-	}
-
-	// Note that sessionCtx.Database is a copy of the database cached by
-	// database service. Call e.UpdateProxiedDatabase to do the update instead of
-	// setting the copy.
-	doUpdate := func(db types.Database) error {
-		db.SetMySQLServerVersion(serverVersion)
-		return nil
-	}
-
-	if err := e.UpdateProxiedDatabase(sessionCtx.Database.GetName(), doUpdate); err != nil {
-		return trace.Wrap(err)
+// updateServerVersion updates the server runtime version if the version
+// reported by the database is different from the version in status
+// configuration.
+func (e *Engine) updateServerVersion(ctx context.Context, db types.Database, serverConn *client.Conn) {
+	err := updateServerVersion(ctx, e.Log, db, serverConn.GetServerVersion(), e.UpdateProxiedDatabase)
+	if err != nil {
+		// Log but do not fail connection if the version update fails.
+		e.Log.WarnContext(ctx, "Failed to update the MySQL server version", "error", err)
 	}
-
-	e.Log.DebugContext(e.Context, "Updated MySQL server version.", "version", serverVersion)
-	return nil
 }
 
 // checkAccess does authorization check for MySQL connection about to be established.
@@ -220,95 +212,31 @@ func (e *Engine) checkAccess(ctx context.Context, sessionCtx *common.Session) er
 
 // connect establishes connection to MySQL database.
 func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (*client.Conn, error) {
-	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx.GetExpiry(), sessionCtx.Database, sessionCtx.DatabaseUser)
+	connector, err := e.newConnector(sessionCtx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	user := sessionCtx.DatabaseUser
-	connectOpt := func(conn *client.Conn) error {
-		conn.SetTLSConfig(tlsConfig)
-		return nil
-	}
-
-	var dialer client.Dialer
-	var password string
-	switch {
-	case sessionCtx.Database.IsRDS(), sessionCtx.Database.IsRDSProxy():
-		password, err = e.Auth.GetRDSAuthToken(ctx, sessionCtx.Database, sessionCtx.DatabaseUser)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	case sessionCtx.Database.IsCloudSQL():
-		// Get the client once for subsequent calls (it acquires a read lock).
-		gcpClient, err := e.GCPClients.GetGCPSQLAdminClient(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		user, password, err = e.getGCPUserAndPassword(ctx, sessionCtx, gcpClient)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		// Detect whether the instance is set to require SSL.
-		// Fallback to not requiring SSL for access denied errors.
-		requireSSL, err := cloud.GetGCPRequireSSL(ctx, sessionCtx.Database, gcpClient)
-		if err != nil && !trace.IsAccessDenied(err) {
-			return nil, trace.Wrap(err)
-		}
-		// Create ephemeral certificate and append to TLS config when
-		// the instance requires SSL. Also use a TLS dialer instead of
-		// the default net dialer when GCP requires SSL.
-		if requireSSL {
-			err = cloud.AppendGCPClientCert(ctx, &cloud.AppendGCPClientCertRequest{
-				GCPClient:   gcpClient,
-				GenerateKey: e.Auth.GenerateDatabaseClientKey,
-				Expiry:      sessionCtx.GetExpiry(),
-				Database:    sessionCtx.Database,
-				TLSConfig:   tlsConfig,
-			})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			connectOpt = func(*client.Conn) error {
-				return nil
-			}
-			dialer = newGCPTLSDialer(tlsConfig)
-		}
-	case sessionCtx.Database.IsAzure():
-		password, err = e.Auth.GetAzureAccessToken(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		user = discoverycommon.MakeAzureDatabaseLoginUsername(sessionCtx.Database, user)
-	}
-
-	// Use default net dialer unless it is already initialized.
-	if dialer == nil {
-		var nd net.Dialer
-		dialer = nd.DialContext
-	}
-
-	// TODO(r0mant): Set CLIENT_INTERACTIVE flag on the client?
-	conn, err := client.ConnectWithDialer(ctx, "tcp", sessionCtx.Database.GetURI(),
-		user,
-		password,
-		sessionCtx.DatabaseName,
-		dialer,
-		connectOpt,
-		// client-set capabilities only.
-		// TODO(smallinsky) Forward "real" capabilities from mysql client to mysql server.
-		withClientCapabilities(
-			mysql.CLIENT_MULTI_RESULTS,
-			mysql.CLIENT_MULTI_STATEMENTS,
-		),
-	)
+	conn, err := connector.connect(ctx, sessionCtx.GetExpiry(), nil)
 	if err != nil {
 		return nil, common.ConvertConnectError(err, sessionCtx)
 	}
 	return conn, nil
 }
 
+func (e *Engine) newConnector(sessionCtx *common.Session) (*connector, error) {
+	return newConnector(connectorConfig{
+		auth:       e.Auth,
+		authClient: e.AuthClient,
+		clock:      e.Clock,
+		gcpClients: e.GCPClients,
+		log:        e.Log,
+
+		database:     sessionCtx.Database,
+		databaseName: sessionCtx.DatabaseName,
+		databaseUser: sessionCtx.DatabaseUser,
+	})
+}
+
 func withClientCapabilities(caps ...uint32) func(conn *client.Conn) error {
 	return func(conn *client.Conn) error {
 		for _, cap := range caps {
@@ -327,7 +255,7 @@ func (e *Engine) receiveFromClient(clientConn, serverConn net.Conn, clientErrCh
 		"server", serverConn.RemoteAddr(),
 	)
 	defer func() {
-		log.DebugContext(e.Context, "Stop receiving from client.")
+		log.DebugContext(e.Context, "Stop receiving from client")
 		close(clientErrCh)
 	}()
 
@@ -337,10 +265,10 @@ func (e *Engine) receiveFromClient(clientConn, serverConn net.Conn, clientErrCh
 		packet, err := protocol.ParsePacket(clientConn)
 		if err != nil {
 			if utils.IsOKNetworkError(err) {
-				log.DebugContext(e.Context, "Client connection closed.")
+				log.DebugContext(e.Context, "Client connection closed")
 				return
 			}
-			log.ErrorContext(e.Context, "Failed to read client packet.", "error", err)
+			log.ErrorContext(e.Context, "Failed to read client packet", "error", err)
 			clientErrCh <- err
 			return
 		}
@@ -359,7 +287,7 @@ func (e *Engine) receiveFromClient(clientConn, serverConn net.Conn, clientErrCh
 			// We do not want to allow changing the connection user and instead
 			// force users to go through normal reconnect flow so log the
 			// attempt and close the client connection.
-			log.WarnContext(e.Context, "Rejecting attempt to change user.", "user", pkt.User(), "session", sessionCtx)
+			log.WarnContext(e.Context, "Rejecting attempt to change user", "user", pkt.User(), "session", sessionCtx)
 			return
 		case *protocol.Quit:
 			return
@@ -409,7 +337,7 @@ func (e *Engine) receiveFromClient(clientConn, serverConn net.Conn, clientErrCh
 		}
 		_, err = protocol.WritePacket(packet.Bytes(), serverConn)
 		if err != nil {
-			log.ErrorContext(e.Context, "Failed to write server packet.", "error", err)
+			log.ErrorContext(e.Context, "Failed to write server packet", "error", err)
 			clientErrCh <- err
 			return
 		}
@@ -436,7 +364,7 @@ func (e *Engine) receiveFromServer(serverConn, clientConn net.Conn, serverErrCh
 
 		var count int64
 		defer func() {
-			log.DebugContext(e.Context, "Stopped parsing messages from server.", "parsed_total", count)
+			log.DebugContext(e.Context, "Stopped parsing messages from server", "parsed_total", count)
 		}()
 
 		for {
@@ -456,65 +384,16 @@ func (e *Engine) receiveFromServer(serverConn, clientConn net.Conn, serverErrCh
 	total, err := io.Copy(clientConn, io.TeeReader(serverConn, copyWriter))
 	if err != nil {
 		if utils.IsOKNetworkError(err) {
-			log.DebugContext(e.Context, "Server connection closed.")
+			log.DebugContext(e.Context, "Server connection closed")
 		} else {
-			log.WarnContext(e.Context, "Server -> Client copy finished with unexpected error.", "error", err)
+			log.WarnContext(e.Context, "Server -> Client copy finished with unexpected error", "error", err)
 		}
 	}
 
-	log.DebugContext(e.Context, "Stopped receiving from server.", "total_bytes", total)
+	log.DebugContext(e.Context, "Stopped receiving from server", "total_bytes", total)
 	serverErrCh <- trace.Wrap(err)
 }
 
-// makeAcquireSemaphoreConfig builds parameters for acquiring a semaphore
-// for connecting to a MySQL Cloud SQL instance for this session.
-func (e *Engine) makeAcquireSemaphoreConfig(sessionCtx *common.Session) services.AcquireSemaphoreWithRetryConfig {
-	return services.AcquireSemaphoreWithRetryConfig{
-		Service: e.AuthClient,
-		// The semaphore will serialize connections to the database as specific
-		// user. If we fail to release the lock for some reason, it will expire
-		// in a minute anyway.
-		Request: types.AcquireSemaphoreRequest{
-			SemaphoreKind: "gcp-mysql-token",
-			SemaphoreName: fmt.Sprintf("%v-%v", sessionCtx.Database.GetName(), sessionCtx.DatabaseUser),
-			MaxLeases:     1,
-			Expires:       e.Clock.Now().Add(time.Minute),
-		},
-		// If multiple connections are being established simultaneously to the
-		// same database as the same user, retry for a few seconds.
-		Retry: retryutils.LinearConfig{
-			Step:  time.Second,
-			Max:   time.Second,
-			Clock: e.Clock,
-		},
-	}
-}
-
-// newGCPTLSDialer returns a TLS dialer configured to connect to the Cloud Proxy
-// port rather than the default MySQL port.
-func newGCPTLSDialer(tlsConfig *tls.Config) client.Dialer {
-	return func(ctx context.Context, network, address string) (net.Conn, error) {
-		// Workaround issue generating ephemeral certificates for secure connections
-		// by creating a TLS connection to the Cloud Proxy port overriding the
-		// MySQL client's connection. MySQL on the default port does not trust
-		// the ephemeral certificate's CA but Cloud Proxy does.
-		address = getGCPTLSAddress(address)
-		tlsDialer := tls.Dialer{Config: tlsConfig}
-		return tlsDialer.DialContext(ctx, network, address)
-	}
-}
-
-// getGCPTLSAddress returns the appropriate address for a Cloud SQL MySQL
-// instance, possibly overriding the default port to instead use the Cloud Proxy
-// port.
-func getGCPTLSAddress(address string) string {
-	host, port, err := net.SplitHostPort(address)
-	if err == nil && port == gcpSQLListenPort {
-		return net.JoinHostPort(host, gcpSQLProxyListenPort)
-	}
-	return address
-}
-
 // FetchMySQLVersion connects to MySQL database and tries to read the handshake packet and return the version.
 // In case of error the message returned by the database is propagated in returned error.
 func FetchMySQLVersion(ctx context.Context, database types.Database) (string, error) {
@@ -529,61 +408,3 @@ func FetchMySQLVersion(ctx context.Context, database types.Database) (string, er
 
 	return protocol.FetchMySQLVersionInternal(ctx, dialer, database.GetURI())
 }
-
-const (
-	// gcpSQLListenPort is the port used by Cloud SQL MySQL instances.
-	gcpSQLListenPort = "3306"
-	// gcpSQLProxyListenPort is the port used by Cloud Proxy for MySQL instances.
-	gcpSQLProxyListenPort = "3307"
-)
-
-// resolverClients are API clients needed to resolve MySQL endpoints.
-type resolverClients interface {
-	// GetGCPSQLAdminClient returns GCP Cloud SQL Admin client.
-	GetGCPSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
-}
-
-// NewEndpointsResolver returns a database target endpoint resolver.
-func NewEndpointsResolver(_ context.Context, db types.Database, cfg endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	return newEndpointsResolver(db, cfg.GCPClients)
-}
-
-func newEndpointsResolver(db types.Database, clients resolverClients) (endpoints.Resolver, error) {
-	switch {
-	case db.IsCloudSQL():
-		return newCloudSQLEndpointResolver(db, clients), nil
-	default:
-		return endpoints.ResolverFn(func(ctx context.Context) ([]string, error) {
-			return []string{db.GetURI()}, nil
-		}), nil
-	}
-}
-
-func newCloudSQLEndpointResolver(db types.Database, clients resolverClients) endpoints.Resolver {
-	// avoid checking the ssl mode more than once every 15 minutes.
-	sometimes := rate.Sometimes{Interval: 15 * time.Minute}
-	var requireSSL bool
-	return endpoints.ResolverFn(func(ctx context.Context) ([]string, error) {
-		var requireSSLErr error
-		sometimes.Do(func() {
-			clt, err := clients.GetGCPSQLAdminClient(ctx)
-			if err != nil {
-				requireSSLErr = trace.Wrap(err)
-				return
-			}
-
-			requireSSL, err = cloud.GetGCPRequireSSL(ctx, db, clt)
-			if err != nil && !trace.IsAccessDenied(err) {
-				requireSSLErr = trace.Wrap(err)
-				return
-			}
-		})
-		if requireSSLErr != nil {
-			return nil, trace.Wrap(requireSSLErr)
-		}
-		if requireSSL {
-			return []string{getGCPTLSAddress(db.GetURI())}, nil
-		}
-		return []string{db.GetURI()}, nil
-	})
-}
diff --git a/lib/srv/db/mysql/engine_test.go b/lib/srv/db/mysql/engine_test.go
index b26920d0a578d..31c19e8483094 100644
--- a/lib/srv/db/mysql/engine_test.go
+++ b/lib/srv/db/mysql/engine_test.go
@@ -29,15 +29,14 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
-	sqladmin "google.golang.org/api/sqladmin/v1beta4"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud/gcp"
-	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
 	os.Exit(m.Run())
 }
@@ -196,141 +195,3 @@ func TestFetchMySQLVersionDoesntBlock(t *testing.T) {
 		require.FailNow(t, "connection should return before")
 	}
 }
-
-type fakeDB struct {
-	types.Database
-	uri        string
-	isCloudSQL bool
-}
-
-func (f fakeDB) IsCloudSQL() bool {
-	return f.isCloudSQL
-}
-
-func (f fakeDB) GetGCP() types.GCPCloudSQL {
-	return types.GCPCloudSQL{
-		ProjectID:  "<project-id>",
-		InstanceID: "<instance-id>",
-	}
-}
-
-func (f fakeDB) GetURI() string {
-	return f.uri
-}
-
-type fakeResolverClients struct {
-	getClientErr error
-	client       *mocks.GCPSQLAdminClientMock
-}
-
-func (f fakeResolverClients) GetGCPSQLAdminClient(context.Context) (gcp.SQLAdminClient, error) {
-	return f.client, f.getClientErr
-}
-
-func TestNewEndpointsResolver(t *testing.T) {
-	t.Parallel()
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	tests := []struct {
-		desc          string
-		db            types.Database
-		clients       resolverClients
-		wantEndpoints []string
-		wantErr       string
-	}{
-		{
-			desc:          "default",
-			db:            fakeDB{uri: "example.com:3306"},
-			wantEndpoints: []string{"example.com:3306"},
-		},
-		{
-			desc: "cloudsql db failed to get admin client",
-			db:   fakeDB{uri: "example.com:3306", isCloudSQL: true},
-			clients: fakeResolverClients{
-				getClientErr: trace.Errorf("failed to get Cloud SQL admin client"),
-			},
-			wantErr: "failed to get Cloud SQL admin client",
-		},
-		{
-			desc: "cloudsql db requires ssl",
-			db:   fakeDB{uri: "example.com:3306", isCloudSQL: true},
-			clients: fakeResolverClients{
-				client: &mocks.GCPSQLAdminClientMock{
-					DatabaseInstance: &sqladmin.DatabaseInstance{
-						Settings: &sqladmin.Settings{
-							IpConfiguration: &sqladmin.IpConfiguration{
-								RequireSsl: true,
-							},
-						},
-					},
-				},
-			},
-			wantEndpoints: []string{"example.com:3307"},
-		},
-		{
-			desc: "cloudsql db non-default port is not overridden when ssl is required",
-			db:   fakeDB{uri: "example.com:1234", isCloudSQL: true},
-			clients: fakeResolverClients{
-				client: &mocks.GCPSQLAdminClientMock{
-					DatabaseInstance: &sqladmin.DatabaseInstance{
-						Settings: &sqladmin.Settings{
-							IpConfiguration: &sqladmin.IpConfiguration{
-								RequireSsl: true,
-							},
-						},
-					},
-				},
-			},
-			wantEndpoints: []string{"example.com:1234"},
-		},
-		{
-			desc: "cloudsql db does not require ssl",
-			db:   fakeDB{uri: "example.com:3306", isCloudSQL: true},
-			clients: fakeResolverClients{
-				client: &mocks.GCPSQLAdminClientMock{
-					DatabaseInstance: &sqladmin.DatabaseInstance{
-						Settings: &sqladmin.Settings{
-							IpConfiguration: &sqladmin.IpConfiguration{
-								RequireSsl: false,
-							},
-						},
-					},
-				},
-			},
-			wantEndpoints: []string{"example.com:3306"},
-		},
-		{
-			desc: "cloudsql db access denied to check ssl setting ",
-			db:   fakeDB{uri: "example.com:3306", isCloudSQL: true},
-			clients: fakeResolverClients{
-				client: &mocks.GCPSQLAdminClientMock{
-					GetDatabaseInstanceError: trace.AccessDenied("unauthorized"),
-				},
-			},
-			wantEndpoints: []string{"example.com:3306"},
-		},
-		{
-			desc: "cloudsql db other error when checking ssl setting ",
-			db:   fakeDB{uri: "example.com:3306", isCloudSQL: true},
-			clients: fakeResolverClients{
-				client: &mocks.GCPSQLAdminClientMock{
-					GetDatabaseInstanceError: trace.NotFound("not found"),
-				},
-			},
-			wantErr: "Failed to get Cloud SQL instance information",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			resolver, err := newEndpointsResolver(test.db, test.clients)
-			require.NoError(t, err)
-			got, err := resolver.Resolve(ctx)
-			if test.wantErr != "" {
-				require.ErrorContains(t, err, test.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			require.EqualValues(t, test.wantEndpoints, got)
-		})
-	}
-}
diff --git a/lib/srv/db/mysql/gcp.go b/lib/srv/db/mysql/gcp.go
index 386b991a15543..3176f77fbd7b1 100644
--- a/lib/srv/db/mysql/gcp.go
+++ b/lib/srv/db/mysql/gcp.go
@@ -20,17 +20,48 @@ package mysql
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
+	"log/slog"
+	"net"
 	"strings"
+	"time"
 
+	"github.com/go-mysql-org/go-mysql/client"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/time/rate"
 
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv/db/cloud"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 )
 
+const (
+	// gcpMySQLDBUserTypeBuiltIn indicates the database's built-in user type.
+	gcpMySQLDBUserTypeBuiltIn = "BUILT_IN"
+	// gcpMySQLDBUserTypeServiceAccount indicates a Cloud IAM service account.
+	gcpMySQLDBUserTypeServiceAccount = "CLOUD_IAM_SERVICE_ACCOUNT"
+	//  gcpMySQLDBUserTypeGroupServiceAccount indicates a Cloud IAM group service account.
+	gcpMySQLDBUserTypeGroupServiceAccount = "CLOUD_IAM_GROUP_SERVICE_ACCOUNT"
+	// gcpMySQLDBUserTypeUser indicates a Cloud IAM user.
+	gcpMySQLDBUserTypeUser = "CLOUD_IAM_USER"
+	// gcpMySQLDBUserTypeGroupUser indicates a Cloud IAM group login user.
+	gcpMySQLDBUserTypeGroupUser = "CLOUD_IAM_GROUP_USER"
+)
+
+const (
+	// gcpSQLListenPort is the port used by Cloud SQL MySQL instances.
+	gcpSQLListenPort = "3306"
+	// gcpSQLProxyListenPort is the port used by Cloud Proxy for MySQL instances.
+	gcpSQLProxyListenPort = "3307"
+)
+
 func isDBUserFullGCPServerAccountID(dbUser string) bool {
 	// Example: mysql-iam-user@my-project-id.iam.gserviceaccount.com
 	return strings.Contains(dbUser, "@") &&
@@ -48,15 +79,37 @@ func gcpServiceAccountToDatabaseUser(serviceAccountName string) string {
 	return user
 }
 
-func databaseUserToGCPServiceAccount(sessionCtx *common.Session) string {
-	return fmt.Sprintf("%s@%s.iam.gserviceaccount.com", sessionCtx.DatabaseUser, sessionCtx.Database.GetGCP().ProjectID)
+func databaseUserToGCPServiceAccount(database types.Database, dbUser string) string {
+	return fmt.Sprintf("%s@%s.iam.gserviceaccount.com", dbUser, database.GetGCP().ProjectID)
+}
+
+type gcpClients interface {
+	GetSQLAdminClient(context.Context) (gcp.SQLAdminClient, error)
 }
 
-func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.Session, gcpClient gcp.SQLAdminClient) (string, string, error) {
+type gcpAuth struct {
+	auth         common.Auth
+	authClient   *authclient.Client
+	clients      gcpClients
+	clock        clockwork.Clock
+	database     types.Database
+	databaseUser string
+	log          *slog.Logger
+
+	requireSSL    bool
+	requireSSLErr error
+	sometimes     *rate.Sometimes
+}
+
+func (a *gcpAuth) getGCPUserAndPassword(ctx context.Context) (string, string, error) {
+	gcpClient, err := a.clients.GetSQLAdminClient(ctx)
+	if err != nil {
+		return "", "", trace.Wrap(err)
+	}
 	// If `--db-user` is the full service account email ID, use IAM Auth.
-	if isDBUserFullGCPServerAccountID(sessionCtx.DatabaseUser) {
-		user := gcpServiceAccountToDatabaseUser(sessionCtx.DatabaseUser)
-		password, err := e.getGCPIAMAuthToken(ctx, sessionCtx)
+	if isDBUserFullGCPServerAccountID(a.databaseUser) {
+		user := gcpServiceAccountToDatabaseUser(a.databaseUser)
+		password, err := a.getGCPIAMAuthToken(ctx, a.databaseUser)
 		if err != nil {
 			return "", "", trace.Wrap(err)
 		}
@@ -67,18 +120,20 @@ func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.S
 	// for GCP MySQL. For GCP Postgres, "user@my-project-id.iam" is the actual
 	// mapped in-database username. However, the mapped in-database username
 	// for GCP MySQL does not have the "@my-project-id.iam" part.
-	if isDBUserShortGCPServiceAccountID(sessionCtx.DatabaseUser) {
-		return "", "", trace.BadParameter("username %q is not accepted for GCP MySQL. Please use the in-database username or the full service account Email ID.", sessionCtx.DatabaseUser)
+	if isDBUserShortGCPServiceAccountID(a.databaseUser) {
+		return "", "", trace.BadParameter("username %q is not accepted for GCP MySQL. Please use the in-database username or the full service account Email ID.", a.databaseUser)
 	}
 
 	// Get user info to decide how to authenticate.
-	user := sessionCtx.DatabaseUser
-	dbUserInfo, err := gcpClient.GetUser(ctx, sessionCtx.Database, sessionCtx.DatabaseUser)
+	user := a.databaseUser
+	dbUserInfo, err := gcpClient.GetUser(ctx, a.database, a.databaseUser)
 	switch {
 	// GetUser permission is new for IAM auth. If no permission, assume legacy password user.
 	case trace.IsAccessDenied(err):
-		e.Log.DebugContext(e.Context, "Access denied to get GCP MySQL database user info. Continue with password auth.", "user", sessionCtx.DatabaseUser)
-		password, err := e.getGCPOneTimePassword(ctx, sessionCtx)
+		a.log.DebugContext(ctx, "Access denied to get GCP MySQL database user info, continuing with password auth",
+			"user", a.databaseUser,
+		)
+		password, err := a.getGCPOneTimePassword(ctx)
 		if err != nil {
 			return "", "", trace.Wrap(err)
 		}
@@ -88,7 +143,7 @@ func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.S
 	// that catching not found here also prevents Google creating a new
 	// database user during OTP generation.
 	case trace.IsNotFound(err):
-		return "", "", trace.NotFound("database user %q does not exist in database %q", sessionCtx.DatabaseUser, sessionCtx.Database.GetName())
+		return "", "", trace.NotFound("database user %q does not exist in database %q", a.databaseUser, a.database.GetName())
 
 	// Report any other error.
 	case err != nil:
@@ -100,7 +155,7 @@ func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.S
 	switch dbUserInfo.Type {
 	case "",
 		gcpMySQLDBUserTypeBuiltIn:
-		password, err := e.getGCPOneTimePassword(ctx, sessionCtx)
+		password, err := a.getGCPOneTimePassword(ctx)
 		if err != nil {
 			return "", "", trace.Wrap(err)
 		}
@@ -108,8 +163,8 @@ func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.S
 
 	case gcpMySQLDBUserTypeServiceAccount,
 		gcpMySQLDBUserTypeGroupServiceAccount:
-		serviceAccountName := databaseUserToGCPServiceAccount(sessionCtx)
-		password, err := e.getGCPIAMAuthToken(ctx, sessionCtx.WithUser(serviceAccountName))
+		serviceAccountName := databaseUserToGCPServiceAccount(a.database, a.databaseUser)
+		password, err := a.getGCPIAMAuthToken(ctx, serviceAccountName)
 		if err != nil {
 			return "", "", trace.Wrap(err)
 		}
@@ -124,16 +179,16 @@ func (e *Engine) getGCPUserAndPassword(ctx context.Context, sessionCtx *common.S
 	}
 }
 
-func (e *Engine) getGCPIAMAuthToken(ctx context.Context, sessionCtx *common.Session) (string, error) {
-	e.Log.DebugContext(ctx, "Authenticating GCP MySQL with IAM auth.", "session", sessionCtx)
+func (a *gcpAuth) getGCPIAMAuthToken(ctx context.Context, dbUser string) (string, error) {
+	a.log.DebugContext(ctx, "Authenticating GCP MySQL with IAM auth", "db_user", dbUser)
 
 	// Note that sessionCtx.DatabaseUser is the service account.
-	password, err := e.Auth.GetCloudSQLAuthToken(ctx, sessionCtx.DatabaseUser)
+	password, err := a.auth.GetCloudSQLAuthToken(ctx, dbUser)
 	return password, trace.Wrap(err)
 }
 
-func (e *Engine) getGCPOneTimePassword(ctx context.Context, sessionCtx *common.Session) (string, error) {
-	e.Log.DebugContext(ctx, "Authenticating GCP MySQL with password auth.", "session", sessionCtx)
+func (a *gcpAuth) getGCPOneTimePassword(ctx context.Context) (string, error) {
+	a.log.DebugContext(ctx, "Authenticating GCP MySQL with password auth")
 
 	// For Cloud SQL MySQL legacy auth, we use one-time passwords by resetting
 	// the database user password for each connection. Thus, acquire a lock to
@@ -141,7 +196,7 @@ func (e *Engine) getGCPOneTimePassword(ctx context.Context, sessionCtx *common.S
 	// serialized.
 	retryCtx, cancel := context.WithTimeout(ctx, defaults.DatabaseConnectTimeout)
 	defer cancel()
-	lease, err := services.AcquireSemaphoreWithRetry(retryCtx, e.makeAcquireSemaphoreConfig(sessionCtx))
+	lease, err := services.AcquireSemaphoreWithRetry(retryCtx, a.makeAcquireSemaphoreConfig())
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -149,27 +204,104 @@ func (e *Engine) getGCPOneTimePassword(ctx context.Context, sessionCtx *common.S
 	// below. If the semaphore fails to release for some reason, it will
 	// expire in a minute on its own.
 	defer func() {
-		err := e.AuthClient.CancelSemaphoreLease(ctx, *lease)
+		err := a.authClient.CancelSemaphoreLease(ctx, *lease)
 		if err != nil {
-			e.Log.ErrorContext(ctx, "Failed to cancel lease.", "lease", lease, "error", err)
+			a.log.ErrorContext(ctx, "Failed to cancel lease", "lease", lease, "error", err)
 		}
 	}()
-	password, err := e.Auth.GetCloudSQLPassword(ctx, sessionCtx.Database, sessionCtx.DatabaseUser)
+	password, err := a.auth.GetCloudSQLPassword(ctx, a.database, a.databaseUser)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 	return password, nil
 }
 
-const (
-	// gcpMySQLDBUserTypeBuiltIn indicates the database's built-in user type.
-	gcpMySQLDBUserTypeBuiltIn = "BUILT_IN"
-	// gcpMySQLDBUserTypeServiceAccount indicates a Cloud IAM service account.
-	gcpMySQLDBUserTypeServiceAccount = "CLOUD_IAM_SERVICE_ACCOUNT"
-	//  gcpMySQLDBUserTypeGroupServiceAccount indicates a Cloud IAM group service account.
-	gcpMySQLDBUserTypeGroupServiceAccount = "CLOUD_IAM_GROUP_SERVICE_ACCOUNT"
-	// gcpMySQLDBUserTypeUser indicates a Cloud IAM user.
-	gcpMySQLDBUserTypeUser = "CLOUD_IAM_USER"
-	// gcpMySQLDBUserTypeGroupUser indicates a Cloud IAM group login user.
-	gcpMySQLDBUserTypeGroupUser = "CLOUD_IAM_GROUP_USER"
-)
+// makeAcquireSemaphoreConfig builds parameters for acquiring a semaphore
+// for connecting to a MySQL Cloud SQL instance for this session.
+func (a *gcpAuth) makeAcquireSemaphoreConfig() services.AcquireSemaphoreWithRetryConfig {
+	return services.AcquireSemaphoreWithRetryConfig{
+		Service: a.authClient,
+		// The semaphore will serialize connections to the database as specific
+		// user. If we fail to release the lock for some reason, it will expire
+		// in a minute anyway.
+		Request: types.AcquireSemaphoreRequest{
+			SemaphoreKind: "gcp-mysql-token",
+			SemaphoreName: fmt.Sprintf("%v-%v", a.database.GetName(), a.databaseUser),
+			MaxLeases:     1,
+		},
+		// If multiple connections are being established simultaneously to the
+		// same database as the same user, retry for a few seconds.
+		Retry: retryutils.LinearConfig{
+			Step:  time.Second,
+			Max:   time.Second,
+			Clock: a.clock,
+		},
+		TTL: time.Minute,
+		Now: a.clock.Now,
+	}
+}
+
+func (a *gcpAuth) checkSSLRequired(ctx context.Context) (bool, error) {
+	a.sometimes.Do(func() {
+		client, err := a.clients.GetSQLAdminClient(ctx)
+		if err != nil {
+			a.requireSSL = false
+			a.requireSSLErr = err
+			return
+		}
+		a.requireSSL, a.requireSSLErr = checkGCPRequireSSL(ctx, a.database, client)
+	})
+	return a.requireSSL, trace.Wrap(a.requireSSLErr)
+}
+
+func checkGCPRequireSSL(ctx context.Context, database types.Database, client gcp.SQLAdminClient) (bool, error) {
+	// Detect whether the instance is set to require SSL.
+	// Fallback to not requiring SSL for access denied errors.
+	requireSSL, err := cloud.GetGCPRequireSSL(ctx, database, client)
+	if err != nil {
+		if trace.IsAccessDenied(err) {
+			return false, nil
+		}
+		return false, trace.Wrap(err)
+	}
+	return requireSSL, nil
+}
+
+func (a *gcpAuth) appendGCPClientCert(ctx context.Context, certExpiry time.Time, tlsConfig *tls.Config) error {
+	gcpClient, err := a.clients.GetSQLAdminClient(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(cloud.AppendGCPClientCert(ctx, &cloud.AppendGCPClientCertRequest{
+		GCPClient:   gcpClient,
+		GenerateKey: a.auth.GenerateDatabaseClientKey,
+		Expiry:      certExpiry,
+		Database:    a.database,
+		TLSConfig:   tlsConfig,
+	}))
+}
+
+// newGCPTLSDialer returns a TLS dialer configured to connect to the Cloud Proxy
+// port rather than the default MySQL port.
+func newGCPTLSDialer(tlsConfig *tls.Config) client.Dialer {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		// Workaround issue generating ephemeral certificates for secure connections
+		// by creating a TLS connection to the Cloud Proxy port overriding the
+		// MySQL client's connection. MySQL on the default port does not trust
+		// the ephemeral certificate's CA but Cloud Proxy does.
+		address = getGCPTLSAddress(address)
+		tlsDialer := tls.Dialer{Config: tlsConfig}
+		return tlsDialer.DialContext(ctx, network, address)
+	}
+}
+
+// getGCPTLSAddress returns the appropriate address for a Cloud SQL MySQL
+// instance, possibly overriding the default port to instead use the Cloud Proxy
+// port.
+func getGCPTLSAddress(address string) string {
+	host, port, err := net.SplitHostPort(address)
+	if err == nil && port == gcpSQLListenPort {
+		return net.JoinHostPort(host, gcpSQLProxyListenPort)
+	}
+	return address
+}
diff --git a/lib/srv/db/mysql/gcp_test.go b/lib/srv/db/mysql/gcp_test.go
index d1fdf9b7899d8..f7fe492cc7ff2 100644
--- a/lib/srv/db/mysql/gcp_test.go
+++ b/lib/srv/db/mysql/gcp_test.go
@@ -29,9 +29,10 @@ import (
 	sqladmin "google.golang.org/api/sqladmin/v1beta4"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
@@ -156,9 +157,12 @@ func Test_getGCPUserAndPassword(t *testing.T) {
 				Context:    ctx,
 				Clock:      clockwork.NewRealClock(),
 				Log:        slog.Default(),
+				GCPClients: &gcptest.Clients{GCPSQL: test.mockGCPClient},
 			}).(*Engine)
 
-			databaseUser, password, err := engine.getGCPUserAndPassword(ctx, sessionCtx, test.mockGCPClient)
+			connector, err := engine.newConnector(sessionCtx)
+			require.NoError(t, err)
+			databaseUser, password, err := connector.gcpAuth.getGCPUserAndPassword(ctx)
 			if test.wantError {
 				require.Error(t, err)
 			} else {
@@ -173,7 +177,7 @@ func Test_getGCPUserAndPassword(t *testing.T) {
 func makeAuthClient(t *testing.T) *authclient.Client {
 	t.Helper()
 
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "mysql-test",
 		Dir:         t.TempDir(),
 	})
@@ -184,7 +188,7 @@ func makeAuthClient(t *testing.T) *authclient.Client {
 	require.NoError(t, err)
 	t.Cleanup(func() { tlsServer.Close() })
 
-	authClient, err := tlsServer.NewClient(auth.TestServerID(types.RoleDatabase, "mysql-test"))
+	authClient, err := tlsServer.NewClient(authtest.TestServerID(types.RoleDatabase, "mysql-test"))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authClient.Close()) })
 
diff --git a/lib/srv/db/mysql/handshake.go b/lib/srv/db/mysql/handshake.go
new file mode 100644
index 0000000000000..0980a2d9d85bf
--- /dev/null
+++ b/lib/srv/db/mysql/handshake.go
@@ -0,0 +1,308 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/client"
+	"github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/go-mysql-org/go-mysql/server"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/srv/db/mysql/protocol"
+)
+
+const (
+	// magicProxyReply is sent from proxy to the agent if, and only if, the proxy receives the agent's indication that it would like to handshake.
+	// to indicate that the
+	// proxy supports a full MySQL handshake and is waiting for the agent to
+	// initiate it.
+	// TODO(gavin): DELETE IN 21.0.0
+	magicProxyReply = "ready-for-handshake"
+	// emptyPassword is used as a fake credential because auth is already handled via mTLS.
+	emptyPassword = ""
+	// clientNameParamName defines the application name parameter name.
+	// This is used to set the session context's user agent.
+	//
+	// https://dev.mysql.com/doc/refman/8.0/en/performance-schema-connection-attribute-tables.html
+	clientNameParamName = "_client_name"
+	// handshakeModeEnvVar overrides the default MySQL handshake mode for the
+	// proxy and/or agent.
+	// Only exact string enum values are supported, see [handshakeMode].
+	handshakeModeEnvVar = "TELEPORT_MYSQL_DB_HANDSHAKE_MODE"
+)
+
+// handshakeMode determines the MySQL handshake behavior of the proxy or agent.
+type handshakeMode string
+
+// handshakeModeLogKey is the slog attribute key for handshake mode.
+const handshakeModeLogKey = "handshake_mode"
+
+const (
+	// handshakeWhenSupported makes the agent or proxy perform a MySQL handshake
+	// only when the other party supports a MySQL handshake. Handshake support
+	// is determined via a magic "OK" packet value sent by the agent and a
+	// corresponding magic proxy reply:
+	// +-------------------+                +----------------------+
+	// |  Teleport Proxy   |                |  Teleport DB Agent   |
+	// +-------------------+                +----------------------+
+	//            |                                    |
+	//            |--- Connect (reverse tunnel) ------>|
+	//            |                                    |
+	//            |<----------- OK packet -------------|
+	//            |                                    |
+	//            |      (If "magic" OK packet)        |
+	//         +------------------------------------------+
+	//         |  |                                    |  |
+	//         |  |--- "magic" reply ----------------->|  |
+	//         |  |                                    |  |
+	//         |  |<----- Init MySQL handshake --------|  |
+	//         |                                          |
+	//         +------------------------------------------+
+	// In v20 we can be sure that the proxy will support MySQL handshakes, so
+	// the agent can stop sending the OK packet to initiate a handshake and
+	// instead initiate a partial handshake with the proxy, dial the real
+	// database, and then complete the MySQL handshake with by sending OK.
+	// Since the agent will no longer have to send the initial OK packet, we
+	// will no longer have to worry about an older proxy telling the real client
+	// that the connection is ready without the proxy having completed a
+	// MySQL handshake with the agent first.
+	// This will allow us to forward client capabilities without mangling
+	// connection error propagation to the real client.
+	handshakeWhenSupported handshakeMode = "when_supported"
+	// handshakeAlways makes the agent or proxy unconditionally attempt a MySQL
+	// handshake after the proxy dials the agent, without waiting for the magic
+	// OK packet / proxy reply.
+	handshakeAlways handshakeMode = "always"
+	// handshakeDisabled disables MySQL handshake on the proxy or agent.
+	handshakeDisabled handshakeMode = "disabled"
+)
+
+func getHandshakeMode() handshakeMode {
+	switch handshakeMode(os.Getenv(handshakeModeEnvVar)) {
+	case handshakeWhenSupported, "":
+		// the default setting without env var override
+		return handshakeWhenSupported
+	case handshakeAlways:
+		return handshakeAlways
+	default:
+		return handshakeDisabled
+	}
+}
+
+// waitForAgent waits for the agent to indicate to the proxy that the connection
+// is ready.
+func waitForAgent(ctx context.Context, log *slog.Logger, mode handshakeMode, serviceConn net.Conn, handshakeOpts ...client.Option) error {
+	log = log.With(handshakeModeLogKey, mode)
+	if err := serviceConn.SetReadDeadline(time.Now().Add(2 * defaults.DatabaseConnectTimeout)); err != nil {
+		return trace.Wrap(err)
+	}
+	defer serviceConn.SetReadDeadline(time.Time{})
+
+	switch mode {
+	case handshakeDisabled:
+		log.DebugContext(ctx, "Waiting for OK packet from the database agent")
+		_, err := waitForOKPacket(serviceConn)
+		return trace.Wrap(err)
+	case handshakeWhenSupported:
+		bufConn := protocol.NewBufferedConn(ctx, serviceConn)
+		serviceConn = bufConn
+		isHandshakeV10, err := protocol.IsHandshakeV10Packet(bufConn)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if isHandshakeV10 {
+			log.DebugContext(ctx, "Received a handshake v10 packet")
+		} else {
+			log.DebugContext(ctx, "Waiting for magic OK packet from the database agent")
+			pkt, err := waitForOKPacket(serviceConn)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if !isMagicOKResult(pkt) {
+				return nil
+			}
+			if err := sendMagicProxyReply(serviceConn); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	case handshakeAlways:
+	}
+
+	log.DebugContext(ctx, "Performing a MySQL handshake with the database agent")
+	return trace.Wrap(handshakeWithAgent(ctx, serviceConn, handshakeOpts...))
+}
+
+// isMagicOKResult returns true if the OK packet received from the agent has
+// non-zero affected rows.
+// This method can be deleted after agents are updated to always initiate a
+// MySQL handshake without negotiating one with the magic OK packet.
+// TODO(gavin): DELETE IN 21.0.0
+func isMagicOKResult(packet *protocol.OK) bool {
+	return packet != nil && packet.HasAffectedRows()
+}
+
+func sendMagicProxyReply(conn net.Conn) error {
+	if _, err := conn.Write([]byte{byte(len(magicProxyReply))}); err != nil {
+		return trace.Wrap(err)
+	}
+	_, err := io.Copy(conn, strings.NewReader(magicProxyReply))
+	return trace.Wrap(err)
+}
+
+func handshakeWithAgent(ctx context.Context, serviceConn net.Conn, options ...client.Option) error {
+	_, err := client.ConnectWithDialer(ctx, "tcp", "stubAddr",
+		"stubUser",
+		emptyPassword,
+		"stubDB",
+		func(_ context.Context, _, _ string) (net.Conn, error) {
+			return serviceConn, nil
+		},
+		options...,
+	)
+	return trace.Wrap(err)
+}
+
+// notifyProxy notifies the proxy that the connection is ready on the agent side.
+func notifyProxy(ctx context.Context, log *slog.Logger, mode handshakeMode, proxyConn *server.Conn) error {
+	log = log.With(handshakeModeLogKey, mode)
+	// no matter the path we take, the client will expect the sequence number to
+	// start with zero as we enter the command phase, and a mismatch could cause
+	// sequence number errors
+	defer proxyConn.ResetSequence()
+	switch mode {
+	case handshakeDisabled:
+		// Send back OK packet to indicate auth/connect success. At this point
+		// the original client should consider the connection phase completed.
+		log.DebugContext(ctx, "Notifying the proxy of connection success with an empty OK packet")
+		return trace.Wrap(proxyConn.WriteOK(nil))
+	case handshakeWhenSupported:
+		log.DebugContext(ctx, "Sending a magic OK packet to the proxy to request a MySQL handshake")
+		if err := proxyConn.WriteOK(newMagicOKResult()); err != nil {
+			return trace.Wrap(err)
+		}
+		proxyConn.ResetSequence()
+		bufConn := protocol.NewBufferedConn(ctx, proxyConn.Conn.Conn)
+		proxyConn.Conn.Conn = bufConn
+		const magicReplyTimeout = 5 * time.Second
+		log.DebugContext(ctx, "Waiting for magic reply from the proxy",
+			"timeout", magicReplyTimeout,
+		)
+		found, err := waitForMagicProxyReply(bufConn, magicReplyTimeout)
+		if err != nil {
+			log.DebugContext(ctx, "The proxy did not reply to the request for a MySQL handshake, assuming that this proxy does not support MySQL handshakes",
+				"error", err,
+			)
+			return nil
+		}
+		if !found {
+			return nil
+		}
+	case handshakeAlways:
+	}
+
+	log.DebugContext(ctx, "Performing a MySQL handshake with the proxy")
+	return trace.Wrap(handshakeWithProxy(proxyConn))
+}
+
+// newMagicOKResult is sent by the DB agent to tell the proxy to tell the proxy
+// that the agent would like to perform a MySQL handshake.
+// The proxy checks for the magic OK packet to determine if it should perform a
+// full MySQL handshake to forward the real client's attributes and,
+// eventually, capabilities.
+// This ceremony is required for backwards compatibility, since we
+// historically only had the proxy wait for an "ok" packet without doing a
+// MySQL protocol handshake with the agent.
+// Any non-zero value for the OK packet's affected rows will work.
+// TODO(gavin): DELETE IN 20.0.0
+func newMagicOKResult() *mysql.Result {
+	return &mysql.Result{AffectedRows: 42}
+}
+
+// waitForMagicProxyReply peeks into the connection looking for the proxy reply,
+// returning true and advancing its connection reader if, and only if, the proxy
+// reply is found.
+// If an older proxy doesn't send the reply, then the bytes we peek into
+// will be from the real client. We could block indefinitely until the real
+// client sends some commands, but that would delay the session start event.
+// Normally, clients like libmysql will send some startup commands anyway, but
+// by enforcing a timeout we can be sure the session start event will be emitted
+// even if the client doesn't send any commands.
+// This is out of an abundance of caution - I can't actually foresee a problem
+// with delaying session start until the client sends some bytes, since the
+// client will be unable to do anything with the session otherwise.
+// TODO(gavin): DELETE IN 20.0.0
+func waitForMagicProxyReply(conn protocol.BufferedConn, timeout time.Duration) (found bool, err error) {
+	if timeout > 0 {
+		if err := conn.SetReadDeadline(time.Now().Add(timeout)); err != nil {
+			return false, trace.Wrap(err)
+		}
+		defer conn.SetReadDeadline(time.Time{})
+	}
+	defer func() {
+		if err != nil && (errors.Is(err, os.ErrDeadlineExceeded) || errors.Is(err, io.EOF)) {
+			err = nil
+		}
+	}()
+	payloadLen, err := conn.Peek(1)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	wantBytes := []byte(magicProxyReply)
+	if int(payloadLen[0]) != len(wantBytes) {
+		return false, nil
+	}
+	buf, err := conn.Peek(len(wantBytes) + 1)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	if bytes.Equal(buf[1:], wantBytes) {
+		_, _ = conn.Discard(len(buf))
+		return true, nil
+	}
+	return false, nil
+}
+
+func handshakeWithProxy(proxyConn *server.Conn) error {
+	if err := proxyConn.SetReadDeadline(time.Now().Add(10 * time.Second)); err != nil {
+		return trace.Wrap(err)
+	}
+	defer proxyConn.SetReadDeadline(time.Time{})
+	if err := proxyConn.WriteInitialHandshake(); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := proxyConn.ReadHandshakeResponse(); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := proxyConn.WriteOK(nil); err != nil {
+		return trace.Wrap(err)
+	}
+	proxyConn.ResetSequence()
+	return nil
+}
diff --git a/lib/srv/db/mysql/handshake_test.go b/lib/srv/db/mysql/handshake_test.go
new file mode 100644
index 0000000000000..947c36f5aaf9e
--- /dev/null
+++ b/lib/srv/db/mysql/handshake_test.go
@@ -0,0 +1,290 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-mysql-org/go-mysql/client"
+	"github.com/go-mysql-org/go-mysql/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/srv/db/mysql/protocol"
+)
+
+func TestSendMagicProxyReply(t *testing.T) {
+	conn := &bufferedTestConn{}
+	err := sendMagicProxyReply(conn)
+	require.NoError(t, err)
+	got, err := io.ReadAll(conn)
+	require.NoError(t, err)
+	require.Equal(t, []byte("\x13ready-for-handshake"), got)
+}
+
+func TestWaitForMagicProxyReply(t *testing.T) {
+	ctx := t.Context()
+	tests := []struct {
+		desc       string
+		input      []byte
+		modifyConn func(t *testing.T, conn *fakeServerConn)
+		timeout    time.Duration
+		wantFound  bool
+		wantErr    error
+	}{
+		{
+			desc: "handles EOF when looking for length header",
+			modifyConn: func(t *testing.T, conn *fakeServerConn) {
+				conn.clt.Close()
+			},
+		},
+		{
+			desc:  "length header does not match",
+			input: []byte("\x12ready-for-handshake"),
+		},
+		{
+			desc:  "handles EOF when looking for payload",
+			input: []byte("\x13llama-lied"),
+			modifyConn: func(t *testing.T, conn *fakeServerConn) {
+				conn.clt.Close()
+			},
+		},
+		{
+			desc:  "payload doesnt match",
+			input: []byte("\x13llama-was-disguised"),
+		},
+		{
+			desc:      "found match",
+			input:     []byte("\x13ready-for-handshake"),
+			wantFound: true,
+		},
+		{
+			desc:    "handles timeout gracefully",
+			timeout: time.Millisecond * 100,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			conn := newFakeServerConn(t, test.input)
+			if test.modifyConn != nil {
+				test.modifyConn(t, conn)
+			}
+			bufConn := protocol.NewBufferedConn(ctx, conn)
+			found, err := waitForMagicProxyReply(bufConn, test.timeout)
+			if test.wantErr != nil {
+				require.ErrorIs(t, err, test.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, test.wantFound, found)
+			require.NoError(t, conn.clt.Close())
+			remaining, err := io.ReadAll(bufConn)
+			require.NoError(t, err)
+			if found {
+				require.Empty(t, remaining, "should discard the matched bytes")
+			} else {
+				want := test.input
+				if want == nil {
+					want = []byte{}
+				}
+				require.Equal(t, want, remaining, "should not advance the buffered conn reader if the proxy reply is not found")
+			}
+		})
+	}
+}
+
+func TestHandshakeModes(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		desc               string
+		agentHandshakeMode handshakeMode
+		wantAgentError     string
+		proxyHandshakeMode handshakeMode
+		wantProxyError     string
+		wantHandshake      bool
+	}{
+		{
+			agentHandshakeMode: handshakeDisabled,
+			proxyHandshakeMode: handshakeDisabled,
+		},
+		{
+			agentHandshakeMode: handshakeWhenSupported,
+			proxyHandshakeMode: handshakeDisabled,
+		},
+		{
+			agentHandshakeMode: handshakeDisabled,
+			proxyHandshakeMode: handshakeWhenSupported,
+		},
+		{
+			agentHandshakeMode: handshakeWhenSupported,
+			proxyHandshakeMode: handshakeWhenSupported,
+			wantHandshake:      true,
+		},
+		{
+			agentHandshakeMode: handshakeAlways,
+			proxyHandshakeMode: handshakeWhenSupported,
+			wantHandshake:      true,
+		},
+		{
+			agentHandshakeMode: handshakeAlways,
+			proxyHandshakeMode: handshakeAlways,
+			wantHandshake:      true,
+		},
+		// always and disabled are not compatible
+		{
+			agentHandshakeMode: handshakeAlways,
+			wantAgentError:     "EOF",
+			proxyHandshakeMode: handshakeDisabled,
+			wantProxyError:     "expected OK or ERR packet",
+		},
+		{
+			agentHandshakeMode: handshakeDisabled,
+			proxyHandshakeMode: handshakeAlways,
+			wantProxyError:     "invalid protocol",
+		},
+		// proxy has to be upgraded last, it cant be changed to always
+		// handshake until all supported agents will always handshake
+		{
+			agentHandshakeMode: handshakeWhenSupported,
+			proxyHandshakeMode: handshakeAlways,
+			wantProxyError:     "invalid protocol",
+		},
+	}
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("agent handshake %v proxy handshake %v", test.agentHandshakeMode, test.proxyHandshakeMode), func(t *testing.T) {
+			t.Parallel()
+			ctx := t.Context()
+			agentProxyConn, proxyAgentConn := net.Pipe()
+			var wg sync.WaitGroup
+			wg.Add(2)
+
+			// agent
+			var agentMySQLServer *server.Conn
+			go func() {
+				defer wg.Done()
+				defer agentProxyConn.Close()
+				agentMySQLServer = makeProxyConn(agentProxyConn)
+				log := slog.With(teleport.ComponentKey, teleport.ComponentDatabase)
+				err := notifyProxy(ctx, log, test.agentHandshakeMode, agentMySQLServer)
+				if test.wantAgentError != "" {
+					assert.ErrorContains(t, err, test.wantAgentError)
+					return
+				}
+				if !assert.NoError(t, err) {
+					return
+				}
+				if test.wantHandshake {
+					assert.NotEmpty(t, agentMySQLServer.Attributes())
+					assert.Equal(t, "llama", agentMySQLServer.Attributes()["species"])
+				} else {
+					assert.Empty(t, agentMySQLServer.Attributes())
+				}
+				assert.Zero(t, agentMySQLServer.Sequence)
+				assertEmptyConn(t, agentMySQLServer.Conn)
+			}()
+
+			// proxy
+			go func() {
+				defer wg.Done()
+				defer proxyAgentConn.Close()
+				log := slog.With(teleport.ComponentKey, teleport.ComponentProxy)
+				err := waitForAgent(ctx, log, test.proxyHandshakeMode, proxyAgentConn, func(c *client.Conn) error {
+					c.SetAttributes(map[string]string{"species": "llama"})
+					return nil
+				})
+				if test.wantProxyError != "" {
+					assert.ErrorContains(t, err, test.wantProxyError)
+					return
+				}
+				if !assert.NoError(t, err) {
+					return
+				}
+				assertEmptyConn(t, proxyAgentConn)
+			}()
+
+			wg.Wait()
+		})
+	}
+}
+
+func assertEmptyConn(t *testing.T, conn net.Conn) {
+	t.Helper()
+	conn.SetReadDeadline(time.Now().Add(100 * time.Millisecond))
+	defer conn.SetReadDeadline(time.Time{})
+	buf := make([]byte, 1)
+	n, _ := conn.Read(buf)
+	assert.Zero(t, n)
+}
+
+type bufferedTestConn struct {
+	net.Conn
+
+	buf bytes.Buffer
+}
+
+func (c *bufferedTestConn) Read(b []byte) (n int, err error) {
+	return c.buf.Read(b)
+}
+
+func (c *bufferedTestConn) Write(b []byte) (n int, err error) {
+	return c.buf.Write(b)
+}
+
+func newFakeServerConn(t *testing.T, input []byte) *fakeServerConn {
+	// we use a pipe just to closely resemble a real connection and simulate timeouts
+	clt, srv := net.Pipe()
+	t.Cleanup(func() {
+		clt.Close()
+		srv.Close()
+	})
+
+	return &fakeServerConn{
+		Conn: srv,
+		clt:  clt,
+		buf:  bytes.NewBuffer(input),
+	}
+}
+
+type fakeServerConn struct {
+	net.Conn
+	// reads beyond the buffered input may block until this end of the pipe is closed
+	clt net.Conn
+
+	buf     *bytes.Buffer
+	readErr error
+}
+
+func (c *fakeServerConn) Read(b []byte) (n int, err error) {
+	if c.readErr != nil {
+		return 0, c.readErr
+	}
+	return io.MultiReader(c.buf, c.Conn).Read(b)
+}
+
+func (c *fakeServerConn) Write(b []byte) (n int, err error) {
+	return c.buf.Write(b)
+}
diff --git a/lib/srv/db/mysql/healthcheck.go b/lib/srv/db/mysql/healthcheck.go
new file mode 100644
index 0000000000000..b7ae4fa6e6e8b
--- /dev/null
+++ b/lib/srv/db/mysql/healthcheck.go
@@ -0,0 +1,170 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"context"
+	"net"
+	"os"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+	"github.com/gravitational/teleport/lib/srv/db/mysql/protocol"
+)
+
+const (
+	// defaultHealthCheckUser is the user name that the health checker will
+	// attempt to authenticate as. It may be overridden with environment variable.
+	defaultHealthCheckUser = "teleport-healthchecker"
+	// healthCheckUserEnvVar is used to override the default health check user.
+	healthCheckUserEnvVar = "TELEPORT_UNSTABLE_MYSQL_DB_HEALTH_CHECK_DEFAULT_USER"
+)
+
+// getHealthCheckDBUser returns the user name to use for health checks.
+// The name can be sourced from environment variable, database config, or
+// the default health check user.
+func getHealthCheckDBUser(database types.Database) string {
+	user := defaultHealthCheckUser
+	if val := os.Getenv(healthCheckUserEnvVar); val != "" {
+		user = val
+	}
+	if admin := database.GetAdminUser(); admin.Name != "" {
+		user = admin.Name
+	}
+	if database.IsCloudSQL() {
+		return databaseUserToGCPServiceAccount(database, user)
+	}
+	return user
+}
+
+// NewHealthChecker creates a new [HealthChecker].
+func NewHealthChecker(ctx context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	return newHealthChecker(cfg)
+}
+
+func newHealthChecker(cfg healthchecks.HealthCheckerConfig) (*HealthChecker, error) {
+	databaseUser := getHealthCheckDBUser(cfg.Database)
+	cfg.Log = cfg.Log.With(
+		"db", cfg.Database.GetName(),
+		"db_user", databaseUser,
+	)
+	connector, err := newConnector(connectorConfig{
+		auth:         cfg.Auth,
+		authClient:   cfg.AuthClient,
+		clock:        cfg.Clock,
+		gcpClients:   cfg.GCPClients,
+		log:          cfg.Log,
+		database:     cfg.Database,
+		databaseName: "", // no default database is necessary
+		databaseUser: databaseUser,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &HealthChecker{
+		cfg:       cfg,
+		connector: connector,
+	}, nil
+}
+
+// HealthChecker provides health checks for a MySQL database. To avoid MySQL
+// host blocking due to aborted connections this health checker attempts to
+// authenticate as a user, but authentication failure is normal and expected
+// behavior when the health check user does not exist. Any failure after
+// successfully dialing the database endpoint is ignored, because database
+// health checks only check TCP connectivity.
+type HealthChecker struct {
+	cfg       healthchecks.HealthCheckerConfig
+	connector *connector
+}
+
+// CheckHealth checks the health of the target database.
+func (h *HealthChecker) CheckHealth(ctx context.Context) ([]string, error) {
+	if err := h.connect(ctx); err != nil {
+		if isDialError(err) {
+			// only return dial errors, because database health checks only
+			// check connectivity to the database endpoint.
+			return []string{h.getTargetAddress(ctx)}, trace.Wrap(err)
+		}
+		h.cfg.Log.DebugContext(ctx, "Failed to connect as health checker", "error", err)
+	}
+	return []string{h.getTargetAddress(ctx)}, nil
+}
+
+func (h *HealthChecker) connect(ctx context.Context) error {
+	// TODO(gavin): implement Teleport and GCP ephemeral client cert caching
+	certExpiry := h.cfg.Clock.Now().Add(time.Hour)
+	conn, err := h.connector.connect(ctx, certExpiry, h.readServerVersion)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_ = conn.Quit()
+	return nil
+}
+
+func (h *HealthChecker) readServerVersion(ctx context.Context, conn net.Conn) {
+	version, err := protocol.ReadMySQLVersion(ctx, conn)
+	if err != nil {
+		h.cfg.Log.WarnContext(ctx, "Failed to fetch the MySQL version",
+			"db", h.cfg.Database.GetName(),
+			"error", err,
+		)
+		return
+	}
+	if err := updateServerVersion(ctx,
+		h.cfg.Log,
+		h.cfg.Database,
+		version,
+		h.cfg.UpdateProxiedDatabase,
+	); err != nil {
+		if trace.IsNotFound(err) {
+			// not found error can occur if we fetch the version before the
+			// database has finished registering - we will retry later, ignore it
+			return
+		}
+		h.cfg.Log.WarnContext(ctx, "Failed to update the MySQL server version",
+			"error", err,
+		)
+	}
+}
+
+// GetProtocol returns the network protocol used for checking health.
+// This health checker only reports TCP dialing errors.
+func (h *HealthChecker) GetProtocol() types.TargetHealthProtocol {
+	return types.TargetHealthProtocolTCP
+}
+
+func (h *HealthChecker) getTargetAddress(ctx context.Context) string {
+	if h.cfg.Database.IsCloudSQL() {
+		requireSSL, err := h.connector.gcpAuth.checkSSLRequired(ctx)
+		if err != nil {
+			h.cfg.Log.DebugContext(ctx, "Failed to check database SSL requirement",
+				"error", err,
+			)
+		} else if requireSSL {
+			return getGCPTLSAddress(h.cfg.Database.GetURI())
+		}
+	}
+	return h.cfg.Database.GetURI()
+}
diff --git a/lib/srv/db/mysql/healthcheck_test.go b/lib/srv/db/mysql/healthcheck_test.go
new file mode 100644
index 0000000000000..4c6aeab794028
--- /dev/null
+++ b/lib/srv/db/mysql/healthcheck_test.go
@@ -0,0 +1,254 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mysql
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	sqladmin "google.golang.org/api/sqladmin/v1beta4"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/mocks"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+func Test_getTargetAddress(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		desc       string
+		dbURI      string
+		isCloudSQL bool
+		clients    fakeGCPClients
+		want       string
+	}{
+		{
+			desc:  "default",
+			dbURI: "example.com:3306",
+			want:  "example.com:3306",
+		},
+		{
+			desc:       "cloudsql db failed to get admin client",
+			dbURI:      "example.com:3306",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				getClientErr: trace.Errorf("failed to get Cloud SQL admin client"),
+			},
+			want: "example.com:3306",
+		},
+		{
+			desc:       "cloudsql db requires ssl",
+			dbURI:      "example.com:3306",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				client: &mocks.GCPSQLAdminClientMock{
+					DatabaseInstance: &sqladmin.DatabaseInstance{
+						Settings: &sqladmin.Settings{
+							IpConfiguration: &sqladmin.IpConfiguration{
+								RequireSsl: true,
+							},
+						},
+					},
+				},
+			},
+			want: "example.com:3307",
+		},
+		{
+			desc:       "cloudsql db non-default port is not overridden when ssl is required",
+			dbURI:      "example.com:1234",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				client: &mocks.GCPSQLAdminClientMock{
+					DatabaseInstance: &sqladmin.DatabaseInstance{
+						Settings: &sqladmin.Settings{
+							IpConfiguration: &sqladmin.IpConfiguration{
+								RequireSsl: true,
+							},
+						},
+					},
+				},
+			},
+			want: "example.com:1234",
+		},
+		{
+			desc:       "cloudsql db does not require ssl",
+			dbURI:      "example.com:3306",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				client: &mocks.GCPSQLAdminClientMock{
+					DatabaseInstance: &sqladmin.DatabaseInstance{
+						Settings: &sqladmin.Settings{
+							IpConfiguration: &sqladmin.IpConfiguration{
+								RequireSsl: false,
+							},
+						},
+					},
+				},
+			},
+			want: "example.com:3306",
+		},
+		{
+			desc:       "cloudsql db access denied to check ssl setting ",
+			dbURI:      "example.com:3306",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				client: &mocks.GCPSQLAdminClientMock{
+					GetDatabaseInstanceError: trace.AccessDenied("unauthorized"),
+				},
+			},
+			want: "example.com:3306",
+		},
+		{
+			desc:       "cloudsql db other error when checking ssl setting ",
+			dbURI:      "example.com:3306",
+			isCloudSQL: true,
+			clients: fakeGCPClients{
+				client: &mocks.GCPSQLAdminClientMock{
+					GetDatabaseInstanceError: trace.NotFound("not found"),
+				},
+			},
+			want: "example.com:3306",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			dbSpec := types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolMySQL,
+				URI:      test.dbURI,
+			}
+			if test.isCloudSQL {
+				dbSpec.GCP = types.GCPCloudSQL{
+					ProjectID:  "project-1",
+					InstanceID: "instance-1",
+				}
+			}
+			db, err := types.NewDatabaseV3(types.Metadata{
+				Name: "test",
+			}, dbSpec)
+			require.NoError(t, err)
+			checker, err := newHealthChecker(healthchecks.HealthCheckerConfig{
+				Auth:                  fakeAuth{},
+				AuthClient:            &authclient.Client{},
+				Clock:                 clockwork.NewRealClock(),
+				Database:              db,
+				GCPClients:            test.clients,
+				Log:                   slog.Default(),
+				UpdateProxiedDatabase: func(string, func(types.Database) error) error { return nil },
+			})
+			require.NoError(t, err)
+			got := checker.getTargetAddress(t.Context())
+			require.Equal(t, test.want, got)
+		})
+	}
+}
+
+func Test_getHealthCheckDBUser(t *testing.T) {
+	rdsDB, err := types.NewDatabaseV3(types.Metadata{
+		Name: "rds",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolMySQL,
+		URI:      "aurora-instance-1.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432",
+	})
+	require.NoError(t, err)
+	cloudSQL := makeGCPMySQLDatabase(t)
+
+	tests := []struct {
+		desc     string
+		database types.Database
+		env      string
+		admin    string
+		want     string
+	}{
+		{
+			desc:     "rds default",
+			database: rdsDB,
+			want:     "teleport-healthchecker",
+		},
+		{
+			desc:     "rds with env",
+			database: rdsDB,
+			env:      "env",
+			want:     "env",
+		},
+		{
+			desc:     "rds with admin",
+			database: rdsDB,
+			admin:    "admin",
+			want:     "admin",
+		},
+		{
+			desc:     "rds with env and admin uses admin",
+			database: rdsDB,
+			env:      "env",
+			admin:    "admin",
+			want:     "admin",
+		},
+		{
+			desc:     "gcp default",
+			database: cloudSQL,
+			want:     "teleport-healthchecker@project-1.iam.gserviceaccount.com",
+		},
+		{
+			desc:     "gcp with env",
+			database: cloudSQL,
+			env:      "env",
+			want:     "env@project-1.iam.gserviceaccount.com",
+		},
+		{
+			desc:     "gcp with admin",
+			database: cloudSQL,
+			admin:    "admin",
+			want:     "admin@project-1.iam.gserviceaccount.com",
+		},
+		{
+			desc:     "gcp with env and admin uses admin",
+			database: cloudSQL,
+			env:      "env",
+			admin:    "admin",
+			want:     "admin@project-1.iam.gserviceaccount.com",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Setenv(healthCheckUserEnvVar, test.env)
+			db := test.database.Copy()
+			db.Spec.AdminUser = &types.DatabaseAdminUser{Name: test.admin}
+			got := getHealthCheckDBUser(db)
+			require.Equal(t, test.want, got)
+		})
+	}
+}
+
+type fakeGCPClients struct {
+	healthchecks.GCPClients
+
+	getClientErr error
+	client       *mocks.GCPSQLAdminClientMock
+}
+
+func (f fakeGCPClients) GetSQLAdminClient(context.Context) (gcp.SQLAdminClient, error) {
+	return f.client, f.getClientErr
+}
diff --git a/lib/srv/db/mysql/protocol/fuzz_test.go b/lib/srv/db/mysql/protocol/fuzz_test.go
index 3eaec1dfb499b..d0f0489660477 100644
--- a/lib/srv/db/mysql/protocol/fuzz_test.go
+++ b/lib/srv/db/mysql/protocol/fuzz_test.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"io"
 	"net"
 	"testing"
 
@@ -146,6 +147,24 @@ func FuzzFetchMySQLVersion(f *testing.F) {
 	})
 }
 
+func FuzzIsHandshakeV10Packet(f *testing.F) {
+	f.Add([]byte{})
+	f.Add([]byte{0})
+	f.Add([]byte{0, 0, 0, 0, 0})
+	f.Add([]byte{0, 0, 0, 0, 10})
+	f.Fuzz(func(t *testing.T, packet []byte) {
+		ctx := context.Background()
+		conn := NewBufferedConn(ctx, &buffTestReader{reader: bytes.NewReader(packet)})
+		require.NotPanics(t, func() {
+			_, _ = IsHandshakeV10Packet(conn)
+		})
+		require.NotNil(t, conn)
+		got, err := io.ReadAll(conn)
+		require.NoError(t, err)
+		require.Equal(t, got, packet, "it should only peek into the conn without consuming bytes")
+	})
+}
+
 // buffTestReader is a fake reader used for test where read only
 // net.Conn is needed.
 type buffTestReader struct {
diff --git a/lib/srv/db/mysql/protocol/packet_test.go b/lib/srv/db/mysql/protocol/packet_test.go
index ac5dec6c83ec9..33b8405d5f298 100644
--- a/lib/srv/db/mysql/protocol/packet_test.go
+++ b/lib/srv/db/mysql/protocol/packet_test.go
@@ -26,7 +26,11 @@ import (
 	"testing"
 	"testing/iotest"
 
+	"github.com/go-mysql-org/go-mysql/mysql"
+	mysqlpacket "github.com/go-mysql-org/go-mysql/packet"
+	"github.com/go-mysql-org/go-mysql/server"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -471,6 +475,58 @@ func TestParsePacket(t *testing.T) {
 	}
 }
 
+func TestOKHasAffectedRows(t *testing.T) {
+	tests := []struct {
+		desc         string
+		affectedRows uint64
+		want         bool
+	}{
+		{
+			desc: "does not have affected rows",
+			want: false,
+		},
+		{
+			desc:         "has affected rows",
+			affectedRows: 42,
+			want:         true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			conn := &fakeConn{}
+			serverConn := &server.Conn{Conn: mysqlpacket.NewConn(conn)}
+			err := serverConn.WriteOK(&mysql.Result{AffectedRows: test.affectedRows})
+			require.NoError(t, err)
+			pkt, err := ParsePacket(conn)
+			require.NoError(t, err)
+			assert.Equal(t, &OK{
+				packet: packet{
+					bytes: []byte{
+						0x03, 0x00, 0x00, 0x00, // header
+						0x00, // type
+						byte(test.affectedRows),
+						0x00, // insert id
+					},
+				},
+			}, pkt)
+			assert.Equal(t, test.want, pkt.(*OK).HasAffectedRows())
+		})
+	}
+}
+
+type fakeConn struct {
+	net.Conn
+	buf bytes.Buffer
+}
+
+func (c *fakeConn) Read(b []byte) (n int, err error) {
+	return c.buf.Read(b)
+}
+
+func (c *fakeConn) Write(b []byte) (n int, err error) {
+	return c.buf.Write(b)
+}
+
 func isUnexpectedEOFError(err error) bool {
 	return errors.Is(trace.Unwrap(err), io.ErrUnexpectedEOF)
 }
diff --git a/lib/srv/db/mysql/protocol/response.go b/lib/srv/db/mysql/protocol/response.go
index 15966339abed4..cc86488ba5f82 100644
--- a/lib/srv/db/mysql/protocol/response.go
+++ b/lib/srv/db/mysql/protocol/response.go
@@ -28,6 +28,13 @@ import (
 // https://mariadb.com/kb/en/ok_packet/
 type OK struct {
 	packet
+
+	AffectedRows uint64
+}
+
+// HasAffectedRows returns true if the packet has non-zero affected rows.
+func (o *OK) HasAffectedRows() bool {
+	return o.packet.Bytes()[packetHeaderAndTypeSize] > 0
 }
 
 // Error represents the ERR packet.
diff --git a/lib/srv/db/mysql/protocol/version.go b/lib/srv/db/mysql/protocol/version.go
index f53df2975016c..90331b62ae6f7 100644
--- a/lib/srv/db/mysql/protocol/version.go
+++ b/lib/srv/db/mysql/protocol/version.go
@@ -25,6 +25,7 @@ import (
 	"errors"
 	"io"
 	"net"
+	"time"
 
 	"github.com/go-mysql-org/go-mysql/client"
 	"github.com/go-mysql-org/go-mysql/mysql"
@@ -41,15 +42,21 @@ func FetchMySQLVersionInternal(ctx context.Context, dialer client.Dialer, databa
 		return "", trace.ConnectionProblem(err, "failed to connect to MySQL")
 	}
 	defer conn.Close()
+	return ReadMySQLVersion(ctx, conn)
+}
 
+// ReadMySQLVersion tries to read the server version from initial handshake message.
+// Error is returned if MySQL returns ERR package.
+func ReadMySQLVersion(ctx context.Context, conn net.Conn) (string, error) {
 	// Set connection deadline if passed context has it.
 	if deadline, ok := ctx.Deadline(); ok {
 		if err := conn.SetReadDeadline(deadline); err != nil {
 			return "", trace.Wrap(err)
 		}
+		defer conn.SetReadDeadline(time.Time{})
 	}
 
-	connBuf := newBufferedConn(ctx, conn)
+	connBuf := NewBufferedConn(ctx, conn)
 	pkgType, err := connBuf.Peek(5)
 	if err != nil {
 		return "", trace.Wrap(err)
@@ -99,25 +106,49 @@ func readHandshakeError(connBuf io.Reader) (string, error) {
 	return "", trace.ConnectionProblem(errors.New("failed to fetch MySQL version"), "%s", errPackage.Error())
 }
 
-// connReader is a net.Conn wrapper with additional Peek() method.
-type connReader struct {
+// IsHandshakeV10Packet peeks into the conn and checks for a handshake v10 packet.
+// The results of this function are only meaningful during the connection phase
+// of the MySQL protocol. It is the caller's responsibility to only use this
+// function during the connection phase.
+// https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_connection_phase_packets_protocol_handshake_v10.html
+func IsHandshakeV10Packet(conn BufferedConn) (bool, error) {
+	pkgHeaderAndType, err := conn.Peek(packetHeaderAndTypeSize)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	const typeIdx = packetHeaderAndTypeSize - 1
+	return pkgHeaderAndType[typeIdx] == 10, nil
+}
+
+// BufferedConn is a net.Conn wrapper with additional Peek() method.
+type BufferedConn struct {
+	net.Conn
+
 	ctx    context.Context
 	reader *bufio.Reader
-	net.Conn
 }
 
-// newBufferedConn is a connReader constructor.
-func newBufferedConn(ctx context.Context, conn net.Conn) connReader {
-	return connReader{
+// NewBufferedConn wraps a [net.Conn] in a new [BufferedConn].
+func NewBufferedConn(ctx context.Context, conn net.Conn) BufferedConn {
+	return BufferedConn{
 		ctx:    ctx,
 		reader: bufio.NewReader(conn),
 		Conn:   conn,
 	}
 }
 
+// Discard discards n bytes from the reader.
+// It's basically a wrapper around (bufio.Reader).Discard()
+func (b BufferedConn) Discard(n int) (discarded int, err error) {
+	if err := b.ctx.Err(); err != nil {
+		return 0, err
+	}
+	return b.reader.Discard(n)
+}
+
 // Peek reads n bytes without advancing the reader.
 // It's basically a wrapper around (bufio.Reader).Peek()
-func (b connReader) Peek(n int) ([]byte, error) {
+func (b BufferedConn) Peek(n int) ([]byte, error) {
 	if err := b.ctx.Err(); err != nil {
 		return nil, err
 	}
@@ -125,7 +156,7 @@ func (b connReader) Peek(n int) ([]byte, error) {
 }
 
 // Read returns data from underlying buffer.
-func (b connReader) Read(p []byte) (int, error) {
+func (b BufferedConn) Read(p []byte) (int, error) {
 	if err := b.ctx.Err(); err != nil {
 		return 0, err
 	}
diff --git a/lib/srv/db/mysql/proxy.go b/lib/srv/db/mysql/proxy.go
index 21b449469f892..ab2f5fbf7828f 100644
--- a/lib/srv/db/mysql/proxy.go
+++ b/lib/srv/db/mysql/proxy.go
@@ -24,14 +24,13 @@ import (
 	"log/slog"
 	"net"
 	"runtime/debug"
-	"time"
 
+	"github.com/go-mysql-org/go-mysql/client"
 	"github.com/go-mysql-org/go-mysql/mysql"
 	"github.com/go-mysql-org/go-mysql/server"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/srv/db/common"
@@ -82,12 +81,12 @@ func (p *Proxy) HandleConnection(ctx context.Context, clientConn net.Conn) (err
 	// has a chance to close the connection from its side.
 	defer func() {
 		if r := recover(); r != nil {
-			p.Log.WarnContext(ctx, "Recovered in MySQL proxy while handling connectionv.", "from", clientConn.RemoteAddr(), "problem", r, "stack", debug.Stack())
+			p.Log.WarnContext(ctx, "Recovered in MySQL proxy while handling connection", "from", clientConn.RemoteAddr(), "problem", r, "stack", debug.Stack())
 			err = trace.BadParameter("failed to handle MySQL client connection")
 		}
 		if err != nil {
-			if writeErr := mysqlServer.WriteError(err); writeErr != nil {
-				p.Log.DebugContext(ctx, "Failed to send error to MySQL client.", "original_err", err.Error(), "error", writeErr)
+			if writeErr := mysqlServer.WriteError(trace.Unwrap(err)); writeErr != nil {
+				p.Log.DebugContext(ctx, "Failed to send error to MySQL client", "original_err", err.Error(), "error", writeErr)
 			}
 		}
 	}()
@@ -131,10 +130,24 @@ func (p *Proxy) HandleConnection(ctx context.Context, clientConn net.Conn) (err
 	// Before replying OK to the client which would make the client consider
 	// auth completed, wait for OK packet from db service indicating auth
 	// success.
-	err = p.waitForOK(mysqlServer, serviceConn)
+	err = waitForAgent(ctx, p.Log, getHandshakeMode(), serviceConn, func(c *client.Conn) error {
+		// forward (client & proxy) caps to get (client & proxy & agent) caps
+		// to the agent.
+		c.SetCapability(mysqlServer.Capability())
+		// forward attributes, notably: "_client_name" (user agent)
+		c.SetAttributes(mysqlServer.Attributes())
+		return nil
+	})
 	if err != nil {
+		p.Log.ErrorContext(ctx, "Failed to wait for agent connection notification",
+			"error", err,
+		)
 		return trace.Wrap(err)
 	}
+	// now tell the real client we are ready
+	if err := mysqlServer.WriteOK(nil); err != nil {
+		return trace.Wrap(err, "failed to write OK to real client")
+	}
 	// Auth has completed, the client enters command phase, start proxying
 	// all messages back-and-forth.
 	err = p.Service.Proxy(ctx, proxyCtx, tlsConn, serviceConn)
@@ -167,8 +180,10 @@ func getServerVersionFromCtx(ctx context.Context, configEngineVersion string) st
 // It's a no-op because authentication is done via mTLS.
 type credentialProvider struct{}
 
-func (p *credentialProvider) CheckUsername(_ string) (bool, error)         { return true, nil }
-func (p *credentialProvider) GetCredential(_ string) (string, bool, error) { return "", true, nil }
+func (p *credentialProvider) CheckUsername(_ string) (bool, error) { return true, nil }
+func (p *credentialProvider) GetCredential(_ string) (string, bool, error) {
+	return emptyPassword, true, nil
+}
 
 // makeServer creates a MySQL server from the accepted client connection that
 // provides access to various parts of the handshake.
@@ -241,31 +256,18 @@ func (p *Proxy) maybeReadProxyLine(ctx context.Context, conn *multiplexer.Conn)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	p.Log.DebugContext(ctx, "MySQL listener proxy-line.", "proxy_line", proxyLine)
+	p.Log.DebugContext(ctx, "MySQL listener proxy-line", "proxy_line", proxyLine)
 	return nil
 }
 
-// waitForOK waits for OK_PACKET from the database service which indicates
-// that auth on the other side completed successfully.
-func (p *Proxy) waitForOK(server *server.Conn, serviceConn net.Conn) error {
-	err := serviceConn.SetReadDeadline(time.Now().Add(2 * defaults.DatabaseConnectTimeout))
-	if err != nil {
-		return trace.Wrap(err)
-	}
+func waitForOKPacket(serviceConn net.Conn) (*protocol.OK, error) {
 	packet, err := protocol.ParsePacket(serviceConn)
 	if err != nil {
-		return trace.Wrap(err)
-	}
-	err = serviceConn.SetReadDeadline(time.Time{})
-	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	switch p := packet.(type) {
 	case *protocol.OK:
-		err = server.WriteOK(nil)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+		return p, nil
 	case *protocol.Error:
 		// There may be a difference in capabilities between client <--> proxy
 		// than there is between proxy <--> agent, most notably,
@@ -273,14 +275,10 @@ func (p *Proxy) waitForOK(server *server.Conn, serviceConn net.Conn) error {
 		// So rather than forwarding packet bytes directly, convert the error
 		// packet into MyError and write with respect to caps between
 		// client <--> proxy.
-		err = server.WriteError(mysql.NewError(p.Code, p.Message))
-		if err != nil {
-			return trace.Wrap(err)
-		}
+		return nil, trace.Wrap(mysql.NewError(p.Code, p.Message))
 	default:
-		return trace.BadParameter("expected OK or ERR packet, got %s", packet)
+		return nil, trace.BadParameter("expected OK or ERR packet, got %s", packet)
 	}
-	return nil
 }
 
 const (
diff --git a/lib/srv/db/mysql/sql/mariadb_activate_user.sql b/lib/srv/db/mysql/sql/mariadb_activate_user.sql
index 0041d291463fb..47bf0aa7f9a0e 100644
--- a/lib/srv/db/mysql/sql/mariadb_activate_user.sql
+++ b/lib/srv/db/mysql/sql/mariadb_activate_user.sql
@@ -1,10 +1,10 @@
-CREATE PROCEDURE teleport_activate_user(IN username VARCHAR(80), IN details JSON)
+CREATE PROCEDURE teleport_activate_user(IN username TEXT, IN details JSON)
 proc_label:BEGIN
     DECLARE is_auto_user INT DEFAULT 0;
     DECLARE is_active INT DEFAULT 0;
     DECLARE is_same_user INT DEFAULT 0;
     DECLARE role_index INT DEFAULT 0;
-    DECLARE cur_role VARCHAR(128) DEFAULT '';
+    DECLARE cur_role TEXT DEFAULT '';
     DECLARE cur_roles TEXT DEFAULT '';
     SET @roles = JSON_EXTRACT(details, "$.roles");
     SET @teleport_user = JSON_VALUE(details, "$.attributes.user");
@@ -72,11 +72,10 @@ proc_label:BEGIN
     CALL teleport_revoke_roles(username);
     SET role_index = 0;
     WHILE role_index < JSON_LENGTH(@roles) DO
-        SELECT JSON_EXTRACT(@roles, CONCAT('$[',role_index,']')) INTO cur_role;
+        SELECT JSON_UNQUOTE(JSON_EXTRACT(@roles, CONCAT('$[',role_index,']'))) INTO cur_role;
         SELECT role_index + 1 INTO role_index;
 
-        -- role extracted from JSON already has double quotes.
-        SET @sql := CONCAT_WS(' ', 'GRANT', cur_role, 'TO', QUOTE(@all_in_one_role));
+        SET @sql := CONCAT_WS(' ', 'GRANT', QUOTE(cur_role), 'TO', QUOTE(@all_in_one_role));
         PREPARE stmt FROM @sql;
         EXECUTE stmt;
         DEALLOCATE PREPARE stmt;
diff --git a/lib/srv/db/mysql/sql/mariadb_deactivate_user.sql b/lib/srv/db/mysql/sql/mariadb_deactivate_user.sql
index a43fbf0e831a0..4afe682db65f5 100644
--- a/lib/srv/db/mysql/sql/mariadb_deactivate_user.sql
+++ b/lib/srv/db/mysql/sql/mariadb_deactivate_user.sql
@@ -1,4 +1,4 @@
-CREATE PROCEDURE teleport_deactivate_user(IN username VARCHAR(80))
+CREATE PROCEDURE teleport_deactivate_user(IN username TEXT)
 BEGIN
     DECLARE is_active INT DEFAULT 0;
     SELECT COUNT(USER) INTO is_active FROM information_schema.processlist WHERE USER = username;
diff --git a/lib/srv/db/mysql/sql/mariadb_delete_user.sql b/lib/srv/db/mysql/sql/mariadb_delete_user.sql
index ce0741389d5f9..b92e8c6033403 100644
--- a/lib/srv/db/mysql/sql/mariadb_delete_user.sql
+++ b/lib/srv/db/mysql/sql/mariadb_delete_user.sql
@@ -1,7 +1,7 @@
-CREATE PROCEDURE teleport_delete_user(IN username VARCHAR(80))
+CREATE PROCEDURE teleport_delete_user(IN username TEXT)
 BEGIN
     -- Defaults to dropping user.
-    DECLARE state VARCHAR(5);
+    DECLARE state TEXT;
     DECLARE is_active INT DEFAULT 0;
     DECLARE view_count INT DEFAULT 0;
     DECLARE procedure_count INT DEFAULT 0;
diff --git a/lib/srv/db/mysql/sql/mariadb_revoke_roles.sql b/lib/srv/db/mysql/sql/mariadb_revoke_roles.sql
index 97801a1e8ac2b..79ce6265f7793 100644
--- a/lib/srv/db/mysql/sql/mariadb_revoke_roles.sql
+++ b/lib/srv/db/mysql/sql/mariadb_revoke_roles.sql
@@ -1,7 +1,7 @@
-CREATE PROCEDURE teleport_revoke_roles(IN username VARCHAR(80))
+CREATE PROCEDURE teleport_revoke_roles(IN username TEXT)
 BEGIN
-    DECLARE cur_user CHAR(128);
-    DECLARE cur_role CHAR(128);
+    DECLARE cur_user TEXT;
+    DECLARE cur_role TEXT;
     DECLARE done INT DEFAULT FALSE;
     -- Revoke all roles assigned to the all-in-one role, and all roles assigned
     -- to the username (expect 'teleport-auto-user')
diff --git a/lib/srv/db/mysql/sql/mysql_activate_user.sql b/lib/srv/db/mysql/sql/mysql_activate_user.sql
index 1df03c72b2e27..ebb346a914839 100644
--- a/lib/srv/db/mysql/sql/mysql_activate_user.sql
+++ b/lib/srv/db/mysql/sql/mysql_activate_user.sql
@@ -1,11 +1,11 @@
-CREATE PROCEDURE teleport_activate_user(IN username VARCHAR(32), IN details JSON)
+CREATE PROCEDURE teleport_activate_user(IN username TEXT, IN details JSON)
 proc_label:BEGIN
     DECLARE is_auto_user INT DEFAULT 0;
     DECLARE is_active INT DEFAULT 0;
     DECLARE is_same_user INT DEFAULT 0; 
     DECLARE are_roles_same INT DEFAULT 0; 
     DECLARE role_index INT DEFAULT 0;
-    DECLARE role VARCHAR(32) DEFAULT '';
+    DECLARE role TEXT DEFAULT '';
     DECLARE cur_roles TEXT DEFAULT '';
     SET @roles = details->"$.roles";
     SET @teleport_user = details->>"$.attributes.user";
@@ -57,11 +57,10 @@ proc_label:BEGIN
 
     -- Assign roles.
     WHILE role_index < JSON_LENGTH(@roles) DO
-        SELECT JSON_EXTRACT(@roles, CONCAT('$[',role_index,']')) INTO role;
+        SELECT JSON_UNQUOTE(JSON_EXTRACT(@roles, CONCAT('$[',role_index,']'))) INTO role;
         SELECT role_index + 1 INTO role_index;
 
-        -- role extracted from JSON already has double quotes.
-        SET @sql := CONCAT_WS(' ', 'GRANT', role, 'TO', QUOTE(username));
+        SET @sql := CONCAT_WS(' ', 'GRANT', QUOTE(role), 'TO', QUOTE(username));
         PREPARE stmt FROM @sql;
         EXECUTE stmt;
         DEALLOCATE PREPARE stmt;
diff --git a/lib/srv/db/mysql/sql/mysql_deactivate_user.sql b/lib/srv/db/mysql/sql/mysql_deactivate_user.sql
index 30a3aae3d7f99..4afe682db65f5 100644
--- a/lib/srv/db/mysql/sql/mysql_deactivate_user.sql
+++ b/lib/srv/db/mysql/sql/mysql_deactivate_user.sql
@@ -1,4 +1,4 @@
-CREATE PROCEDURE teleport_deactivate_user(IN username VARCHAR(32))
+CREATE PROCEDURE teleport_deactivate_user(IN username TEXT)
 BEGIN
     DECLARE is_active INT DEFAULT 0;
     SELECT COUNT(USER) INTO is_active FROM information_schema.processlist WHERE USER = username;
diff --git a/lib/srv/db/mysql/sql/mysql_delete_user.sql b/lib/srv/db/mysql/sql/mysql_delete_user.sql
index 3d8c6c0ca9fb6..4d5d45bca2161 100644
--- a/lib/srv/db/mysql/sql/mysql_delete_user.sql
+++ b/lib/srv/db/mysql/sql/mysql_delete_user.sql
@@ -1,7 +1,7 @@
-CREATE PROCEDURE teleport_delete_user(IN username VARCHAR(32))
+CREATE PROCEDURE teleport_delete_user(IN username TEXT)
 BEGIN
     -- Defaults to dropping user.
-    DECLARE state VARCHAR(5) DEFAULT 'TP003';
+    DECLARE state TEXT DEFAULT 'TP003';
     DECLARE is_active INT DEFAULT 0;
 
     -- Views and procedures rely on the definer to work correctly. Dropping the
diff --git a/lib/srv/db/mysql/sql/mysql_revoke_roles.sql b/lib/srv/db/mysql/sql/mysql_revoke_roles.sql
index b87150cee4b0f..71668b5ba51bd 100644
--- a/lib/srv/db/mysql/sql/mysql_revoke_roles.sql
+++ b/lib/srv/db/mysql/sql/mysql_revoke_roles.sql
@@ -1,6 +1,6 @@
-CREATE PROCEDURE teleport_revoke_roles(IN username VARCHAR(32))
+CREATE PROCEDURE teleport_revoke_roles(IN username TEXT)
 BEGIN
-    DECLARE role VARCHAR(32) DEFAULT '';
+    DECLARE role TEXT DEFAULT '';
     DECLARE done INT DEFAULT 0;
     DECLARE role_cursor CURSOR FOR SELECT FROM_USER FROM mysql.role_edges WHERE FROM_USER != 'teleport-auto-user' AND TO_USER = username;
     DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = 1;
diff --git a/lib/srv/db/mysql/test.go b/lib/srv/db/mysql/test.go
index 07f7eded81e9e..7b2d6049ac6da 100644
--- a/lib/srv/db/mysql/test.go
+++ b/lib/srv/db/mysql/test.go
@@ -38,6 +38,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestClientConn defines interface for client.Conn.
@@ -151,8 +152,7 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (sv
 		listener = tls.NewListener(listener, tlsConfig)
 	}
 
-	log := utils.NewSlogLoggerForTests().With(
-		teleport.ComponentKey, defaults.ProtocolMySQL,
+	log := logtest.With(teleport.ComponentKey, defaults.ProtocolMySQL,
 		"name", config.Name,
 	)
 	server := &TestServer{
diff --git a/lib/srv/db/objects/fetcher.go b/lib/srv/db/objects/fetcher.go
index af1887e021794..3be9f0513683f 100644
--- a/lib/srv/db/objects/fetcher.go
+++ b/lib/srv/db/objects/fetcher.go
@@ -26,7 +26,7 @@ import (
 	dbobjectv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1"
 	dbobjectimportrulev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobjectimportrule/v1"
 	"github.com/gravitational/teleport/api/types"
-	libcloud "github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/databaseobjectimportrule"
 )
@@ -40,7 +40,7 @@ type ImportRulesReader interface {
 type ObjectFetcherConfig struct {
 	ImportRules ImportRulesReader
 	Auth        common.Auth
-	GCPClients  libcloud.GCPClients
+	GCPClients  gcp.Clients
 	Log         *slog.Logger
 }
 
diff --git a/lib/srv/db/objects/objects.go b/lib/srv/db/objects/objects.go
index 4d1b4bd307389..937dc93108d68 100644
--- a/lib/srv/db/objects/objects.go
+++ b/lib/srv/db/objects/objects.go
@@ -29,7 +29,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/databaseobject"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 )
 
@@ -42,7 +42,7 @@ type Config struct {
 	DatabaseObjectClient *databaseobject.Client
 	ImportRules          ImportRulesReader
 	Auth                 common.Auth
-	GCPClients           cloud.GCPClients
+	GCPClients           gcp.Clients
 
 	// ScanInterval specifies how often the database is scanned.
 	// A higher ScanInterval reduces the load on the database and database agent,
diff --git a/lib/srv/db/opensearch/engine.go b/lib/srv/db/opensearch/engine.go
index 296133619f2c5..a3af2d9a69a27 100644
--- a/lib/srv/db/opensearch/engine.go
+++ b/lib/srv/db/opensearch/engine.go
@@ -21,7 +21,6 @@ package opensearch
 import (
 	"bufio"
 	"bytes"
-	"cmp"
 	"context"
 	"encoding/json"
 	"io"
@@ -33,10 +32,8 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
-	"golang.org/x/net/http/httpproxy"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
@@ -45,7 +42,6 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
 	"github.com/gravitational/teleport/lib/srv/db/elasticsearch"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 	libaws "github.com/gravitational/teleport/lib/utils/aws"
 )
@@ -400,32 +396,3 @@ func parseURI(uri string) (*url.URL, error) {
 	u.Scheme = "https"
 	return u, nil
 }
-
-// NewEndpointsResolver resolves an endpoint from DB URI.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	dbURL, err := parseURI(db.GetURI())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Not all of our DB engines respect http proxy env vars, but this one does.
-	// The endpoint resolved for TCP health checks should be the one that the
-	// agent will actually connect to, since often proxy env vars are set to
-	// accommodate self-imposed network restrictions that force external traffic
-	// to go through a proxy.
-	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
-	proxyURL, err := proxyFunc(dbURL)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if proxyURL != nil {
-		dbURL = proxyURL
-	}
-	host := dbURL.Hostname()
-	port := cmp.Or(dbURL.Port(), "443")
-	hostPort := net.JoinHostPort(host, port)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{hostPort}, nil
-	}), nil
-}
diff --git a/lib/srv/db/opensearch/healthcheck.go b/lib/srv/db/opensearch/healthcheck.go
new file mode 100644
index 0000000000000..bb989f361326b
--- /dev/null
+++ b/lib/srv/db/opensearch/healthcheck.go
@@ -0,0 +1,60 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package opensearch
+
+import (
+	"cmp"
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/net/http/httpproxy"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker resolves an endpoint from DB URI.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	dbURL, err := parseURI(cfg.Database.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Not all of our DB engines respect http proxy env vars, but this one does.
+	// The endpoint resolved for TCP health checks should be the one that the
+	// agent will actually connect to, since often proxy env vars are set to
+	// accommodate self-imposed network restrictions that force external traffic
+	// to go through a proxy.
+	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	proxyURL, err := proxyFunc(dbURL)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if proxyURL != nil {
+		dbURL = proxyURL
+	}
+	host := dbURL.Hostname()
+	port := cmp.Or(dbURL.Port(), "443")
+	hostPort := net.JoinHostPort(host, port)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{hostPort}, nil
+	}), nil
+}
diff --git a/lib/srv/db/opensearch/test.go b/lib/srv/db/opensearch/test.go
index 027b2528fa13d..4cae37f9466a3 100644
--- a/lib/srv/db/opensearch/test.go
+++ b/lib/srv/db/opensearch/test.go
@@ -33,8 +33,8 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestServerOption allows setting test server options.
@@ -72,7 +72,7 @@ func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (sv
 		listener:  config.Listener,
 		port:      port,
 		tlsConfig: tlsConfig,
-		log: utils.NewSlogLoggerForTests().With(
+		log: logtest.With(
 			teleport.ComponentKey, defaults.ProtocolOpenSearch,
 			"name", config.Name,
 		),
diff --git a/lib/srv/db/postgres/alloydb.go b/lib/srv/db/postgres/alloydb.go
new file mode 100644
index 0000000000000..7649576f1bb7e
--- /dev/null
+++ b/lib/srv/db/postgres/alloydb.go
@@ -0,0 +1,92 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package postgres
+
+import (
+	"encoding/binary"
+	"io"
+
+	"cloud.google.com/go/alloydb/connectors/apiv1beta/connectorspb"
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/gravitational/teleport"
+)
+
+// metadataExchangeAlloyDB performs metadata exchange.
+// Based on https://github.com/GoogleCloudPlatform/alloydb-go-connector/blob/1c0174b5d34a97798d3e9d68833e4bf31a4a209c/dialer.go#L491-L579
+func metadataExchangeAlloyDB(accessToken string, conn io.ReadWriter) error {
+	const alloyDBUserAgent = "teleport/" + teleport.Version
+
+	// send exchange request
+	req := &connectorspb.MetadataExchangeRequest{
+		UserAgent:   alloyDBUserAgent,
+		AuthType:    connectorspb.MetadataExchangeRequest_AUTO_IAM,
+		Oauth2Token: accessToken,
+	}
+	m, err := proto.Marshal(req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var buf []byte
+	buf = binary.BigEndian.AppendUint32(buf, uint32(len(m)))
+	buf = append(buf, m...)
+
+	_, err = conn.Write(buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// read response
+	buf = make([]byte, 4)
+	count, err := io.ReadFull(conn, buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if count != len(buf) {
+		return trace.BadParameter("expected to read 4 bytes, got %d", count)
+	}
+
+	respSize := binary.BigEndian.Uint32(buf)
+	const maxLen = 1 << 20 // 1MB
+	if respSize > maxLen {
+		return trace.BadParameter("response size %d exceeds maximum of %d", respSize, maxLen)
+	}
+
+	buf = make([]byte, respSize)
+	count, err = io.ReadFull(conn, buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if count != int(respSize) {
+		return trace.BadParameter("expected to read %v bytes, got %d", respSize, count)
+	}
+
+	// unmarshal
+	var mdxResp connectorspb.MetadataExchangeResponse
+	err = proto.Unmarshal(buf, &mdxResp)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// check
+	if mdxResp.GetResponseCode() != connectorspb.MetadataExchangeResponse_OK {
+		return trace.BadParameter("metadata exchange failed: %v, error: %s", mdxResp.GetResponseCode(), mdxResp.GetError())
+	}
+	return nil
+}
diff --git a/lib/srv/db/postgres/alloydb_test.go b/lib/srv/db/postgres/alloydb_test.go
new file mode 100644
index 0000000000000..90109b3a72409
--- /dev/null
+++ b/lib/srv/db/postgres/alloydb_test.go
@@ -0,0 +1,180 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package postgres
+
+import (
+	"encoding/binary"
+	"io"
+	"net"
+	"testing"
+
+	"cloud.google.com/go/alloydb/connectors/apiv1beta/connectorspb"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// TestMetadataExchangeAlloyDB tests the AlloyDB metadata exchange protocol.
+func TestMetadataExchangeAlloyDB(t *testing.T) {
+	t.Parallel()
+
+	// testToken is a fixed access token used for testing.
+	const testToken = "test-token"
+
+	// testCases defines the test scenarios.
+	testCases := []struct {
+		name string
+
+		// server represents the server-side of the metadata exchange.
+		// It reads the client's request, writes a response, and returns any
+		// unexpected errors that occurred during the process.
+		server func(conn net.Conn) error
+
+		wantErr string
+	}{
+		{
+			name: "all good",
+			server: func(conn net.Conn) error {
+				// Read the request from the client.
+				req, err := readRequest(conn)
+				if err != nil {
+					return trace.Wrap(err, "server failed to read request")
+				}
+
+				// Verify the request payload.
+				if req.GetOauth2Token() != testToken {
+					return trace.BadParameter("server expected different token, got %q", req.GetOauth2Token())
+				}
+
+				// Send a successful response.
+				return writeResponse(conn, &connectorspb.MetadataExchangeResponse{
+					ResponseCode: connectorspb.MetadataExchangeResponse_OK,
+				})
+			},
+			wantErr: "",
+		},
+		{
+			name: "server responds with error",
+			server: func(conn net.Conn) error {
+				// Read and discard the request from the client.
+				if _, err := readRequest(conn); err != nil {
+					return trace.Wrap(err)
+				}
+
+				// Send an error response.
+				return writeResponse(conn, &connectorspb.MetadataExchangeResponse{
+					ResponseCode: connectorspb.MetadataExchangeResponse_ERROR,
+				})
+			},
+			wantErr: "metadata exchange failed: ERROR",
+		},
+		{
+			name: "server sends malformed protobuf response",
+			server: func(conn net.Conn) error {
+				// Read and discard the request from the client.
+				if _, err := readRequest(conn); err != nil {
+					return trace.Wrap(err)
+				}
+
+				// Write a garbage response.
+				malformedResp := []byte("this-is-not-a-protobuf")
+				var buf []byte
+				buf = binary.BigEndian.AppendUint32(buf, uint32(len(malformedResp)))
+				buf = append(buf, malformedResp...)
+				_, err := conn.Write(buf)
+				return trace.Wrap(err)
+			},
+			wantErr: "cannot parse invalid wire-format data",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			clientSide, serverSide := net.Pipe()
+
+			errChan := make(chan error, 1)
+
+			// Run the mock server in a separate goroutine.
+			go func() {
+				errChan <- tc.server(serverSide)
+				_ = serverSide.Close()
+			}()
+
+			// Run the function under test.
+			clientErr := metadataExchangeAlloyDB(testToken, clientSide)
+
+			serverErr := <-errChan
+
+			// First, check if the mock server itself ran into an unexpected error.
+			require.NoError(t, serverErr, "mock server encountered an error")
+
+			// Then, assert the outcome from the client's perspective.
+			if tc.wantErr != "" {
+				require.Error(t, clientErr)
+				require.ErrorContains(t, clientErr, tc.wantErr)
+			} else {
+				require.NoError(t, clientErr)
+			}
+		})
+	}
+}
+
+// readRequest is a helper to read a length-prefixed protobuf message from the connection.
+func readRequest(conn io.Reader) (*connectorspb.MetadataExchangeRequest, error) {
+	// Read message length.
+	lenBuf := make([]byte, 4)
+	if _, err := io.ReadFull(conn, lenBuf); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	msgLen := binary.BigEndian.Uint32(lenBuf)
+
+	// A basic sanity check for the message length to avoid huge allocations.
+	const maxLen = 1 << 20 // 1MB
+	if msgLen > maxLen {
+		return nil, trace.BadParameter("message length %d exceeds maximum of %d", msgLen, maxLen)
+	}
+
+	// Read message body.
+	msgBuf := make([]byte, msgLen)
+	if _, err := io.ReadFull(conn, msgBuf); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Unmarshal.
+	var req connectorspb.MetadataExchangeRequest
+	if err := proto.Unmarshal(msgBuf, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &req, nil
+}
+
+// writeResponse is a helper to write a length-prefixed protobuf message to the connection.
+func writeResponse(conn io.Writer, resp *connectorspb.MetadataExchangeResponse) error {
+	// Marshal response.
+	m, err := proto.Marshal(resp)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Prepend length and write.
+	buf := make([]byte, 4+len(m))
+	binary.BigEndian.PutUint32(buf[:4], uint32(len(m)))
+	copy(buf[4:], m)
+
+	_, err = conn.Write(buf)
+	return trace.Wrap(err)
+}
diff --git a/lib/srv/db/postgres/connector.go b/lib/srv/db/postgres/connector.go
index dae31961ab6e6..f4c3df10a7ccf 100644
--- a/lib/srv/db/postgres/connector.go
+++ b/lib/srv/db/postgres/connector.go
@@ -18,28 +18,34 @@ package postgres
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net"
-	"slices"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/jackc/pgconn"
+	"github.com/jackc/pgproto3/v2"
 	"github.com/jackc/pgx/v4"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	libcloud "github.com/gravitational/teleport/lib/cloud"
+	gcputils "github.com/gravitational/teleport/api/utils/gcp"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/srv/db/cloud"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	discoverycommon "github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
 type connector struct {
 	auth       common.Auth
-	gcpClients libcloud.GCPClients
+	gcpClients gcp.Clients
 	log        *slog.Logger
 
 	certExpiry    time.Time
@@ -49,40 +55,26 @@ type connector struct {
 	startupParams map[string]string
 }
 
-// NewEndpointsResolver returns a health check target endpoint resolver.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	return newEndpointsResolver(db.GetURI())
-}
-
-func newEndpointsResolver(uri string) (endpoints.Resolver, error) {
-	config, err := pgconn.ParseConfig(fmt.Sprintf("postgres://%s", uri))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	addrs := make([]string, 0, len(config.Fallbacks)+1)
-	hostPort := net.JoinHostPort(config.Host, strconv.Itoa(int(config.Port)))
-	addrs = append(addrs, hostPort)
-	for _, fb := range config.Fallbacks {
-		hostPort := net.JoinHostPort(fb.Host, strconv.Itoa(int(fb.Port)))
-		// pgconn duplicates the host/port in its fallbacks for some reason, so
-		// we de-duplicate and preserve the fallback order
-		if !slices.Contains(addrs, hostPort) {
-			addrs = append(addrs, hostPort)
-		}
-	}
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return addrs, nil
-	}), nil
-}
+// alloyDBServerProxyPort is the non-configurable port on which the AlloyDB server-side proxy is listening.
+const alloyDBServerProxyPort = 5433
 
 func (c *connector) getConnectConfig(ctx context.Context) (*pgconn.Config, error) {
 	// The driver requires the config to be built by parsing the connection
 	// string so parse the basic template and then fill in the rest of
 	// parameters such as TLS configuration.
-	config, err := pgconn.ParseConfig(fmt.Sprintf("postgres://%s", c.database.GetURI()))
+	dbConfig := fmt.Sprintf("postgres://%s", c.database.GetURI())
+
+	// AlloyDB URI is not parseable by pgconn.ParseConfig. Construct a minimal config for parsing purposes.
+	// We will replace it with real hostname later.
+	if c.database.GetType() == types.DatabaseTypeAlloyDB {
+		dbConfig = fmt.Sprintf("postgres://placeholder:%v", alloyDBServerProxyPort)
+	}
+
+	config, err := pgconn.ParseConfig(dbConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	// TLS config will use client certificate for an onprem database or
 	// will contain RDS root certificate for RDS/Aurora.
 	config.TLSConfig, err = c.auth.GetTLSConfig(ctx, c.certExpiry, c.database, c.databaseUser)
@@ -121,7 +113,7 @@ func (c *connector) getConnectConfig(ctx context.Context) (*pgconn.Config, error
 			return nil, trace.Wrap(err)
 		}
 		// Get the client once for subsequent calls (it acquires a read lock).
-		gcpClient, err := c.gcpClients.GetGCPSQLAdminClient(ctx)
+		gcpClient, err := c.gcpClients.GetSQLAdminClient(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -145,6 +137,103 @@ func (c *connector) getConnectConfig(ctx context.Context) (*pgconn.Config, error
 				return nil, trace.Wrap(err)
 			}
 		}
+	case types.DatabaseTypeAlloyDB:
+		token, err := c.auth.GetAlloyDBAuthToken(ctx, c.databaseUser)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		adminClient, err := c.gcpClients.GetAlloyDBClient(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		pkey, err := c.auth.GenerateDatabaseClientKey(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		info, err := gcputils.ParseAlloyDBConnectionURI(c.database.GetURI())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		clientCert, rootCA, err := adminClient.GenerateClientCertificate(ctx, *info, c.certExpiry, pkey)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// construct custom TLS config suitable for AlloyDB
+		rootCAPool := x509.NewCertPool()
+		ok := rootCAPool.AppendCertsFromPEM([]byte(rootCA))
+		if !ok {
+			return nil, trace.BadParameter("failed to parse root certificate")
+		}
+
+		dbOpts := c.database.GetGCP().AlloyDB
+
+		if dbOpts.EndpointOverride != "" {
+			// respect override
+			config.Host = dbOpts.EndpointOverride
+			c.log.DebugContext(ctx, "Using database endpoint override", "address", config.Host)
+		} else {
+			// resolve the database address of particular type (public/private/PSC).
+			config.Host, err = adminClient.GetEndpointAddress(ctx, *info, dbOpts.EndpointType)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			c.log.DebugContext(ctx, "Resolved database endpoint address", "address", config.Host)
+		}
+
+		tlsConfig := &tls.Config{
+			Certificates: []tls.Certificate{*clientCert},
+			RootCAs:      rootCAPool,
+			ServerName:   config.Host,
+			MinVersion:   tls.VersionTLS13,
+			// copy from original config; only InsecureSkipVerify for now, we may want to expand this in the future.
+			InsecureSkipVerify: config.TLSConfig.InsecureSkipVerify,
+		}
+
+		// remove TLS config from pg client config; DialFunc will handle TLS on its own.
+		config.TLSConfig = nil
+		config.DialFunc = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			conn, err := net.DialTimeout(network, addr, defaults.DefaultIOTimeout)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			tlsConn := tls.Client(conn, tlsConfig)
+			err = tlsConn.HandshakeContext(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			err = metadataExchangeAlloyDB(token, tlsConn)
+			if err != nil {
+				_ = tlsConn.Close() // best effort
+
+				c.log.WarnContext(ctx, "Metadata exchange failed", "err", err)
+
+				// special case for "IAM check failed" error
+				if strings.Contains(err.Error(), `IAM check failed`) {
+					return nil, trace.AccessDenied(`Could not connect to database:
+
+  %v
+
+Make sure that AlloyDB user %q exists and has the following permissions:
+- alloydb.instances.connect
+- alloydb.users.login
+- serviceusage.services.use
+
+You can create a custom role with these permissions, or grant the following roles:
+- Cloud AlloyDB Database User
+- Cloud AlloyDB Client
+- Service Usage Consumer
+
+Note that IAM changes may take a few minutes to propagate.`, err, c.databaseUser)
+				}
+				return nil, trace.Wrap(err)
+			}
+			return tlsConn, nil
+		}
 	case types.DatabaseTypeAzure:
 		config.Password, err = c.auth.GetAzureAccessToken(ctx)
 		if err != nil {
@@ -171,6 +260,73 @@ func (c *connector) pgxConnect(ctx context.Context) (*pgx.Conn, error) {
 	return pgx.ConnectConfig(ctx, pgxConf)
 }
 
+func (c *connector) sendCancelRequest(ctx context.Context, cancelReq *pgproto3.CancelRequest) error {
+	// We can't use pgconn in this case because it always sends a startup message.
+	config, err := c.getConnectConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	address := net.JoinHostPort(config.Host, strconv.Itoa(int(config.Port)))
+
+	// allow config.DialFunc override from config
+	dialFunc := config.DialFunc
+	if dialFunc == nil {
+		dialer := net.Dialer{Timeout: defaults.DefaultIOTimeout}
+		dialFunc = dialer.DialContext
+	}
+
+	c.log.DebugContext(ctx, "Dialing database to cancel request", "address", address)
+	conn, err := dialFunc(ctx, "tcp", address)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// dialFunc may return a TLS connection, in which case the binary PostgreSQL protocol
+	// is already tunneled over TLS. Otherwise, negotiate a TLS upgrade before proceeding.
+	tlsConn, ok := conn.(*tls.Conn)
+	if !ok {
+		if config.TLSConfig == nil {
+			return trace.BadParameter("TLSConfig missing for non-TLS connection %v (this is a bug)", conn)
+		}
+		tlsConn, err = startPGWireTLS(conn, config.TLSConfig)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	frontend := pgproto3.NewFrontend(pgproto3.NewChunkReader(tlsConn), tlsConn)
+	if err = frontend.Send(cancelReq); err != nil {
+		return trace.Wrap(err)
+	}
+
+	response := make([]byte, 1)
+	if _, err := tlsConn.Read(response); !errors.Is(err, io.EOF) {
+		// server should close the connection after receiving cancel request.
+		return trace.Wrap(err)
+	}
+
+	c.log.DebugContext(ctx, "Cancel request sent successfully")
+	return nil
+}
+
+// startPGWireTLS is a helper func that upgrades upstream connection to TLS.
+// copied from github.com/jackc/pgconn.startTLS.
+func startPGWireTLS(conn net.Conn, tlsConfig *tls.Config) (*tls.Conn, error) {
+	frontend := pgproto3.NewFrontend(pgproto3.NewChunkReader(conn), conn)
+	if err := frontend.Send(&pgproto3.SSLRequest{}); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	response := make([]byte, 1)
+	if _, err := io.ReadFull(conn, response); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if response[0] != 'S' {
+		return nil, trace.Errorf("server refused TLS connection")
+	}
+	return tls.Client(conn, tlsConfig), nil
+}
+
 // withDefaultDatabase returns a copy of connector with databaseName switched to the default database, if one is available.
 func (c *connector) withDefaultDatabase() *connector {
 	copied := *c
diff --git a/lib/srv/db/postgres/engine.go b/lib/srv/db/postgres/engine.go
index f7b581b65792b..44e47f7e51e90 100644
--- a/lib/srv/db/postgres/engine.go
+++ b/lib/srv/db/postgres/engine.go
@@ -21,10 +21,8 @@ package postgres
 import (
 	"cmp"
 	"context"
-	"crypto/tls"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"io"
 	"log/slog"
 	"net"
@@ -33,7 +31,6 @@ import (
 	"github.com/jackc/pgconn"
 	"github.com/jackc/pgproto3/v2"
 
-	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
@@ -128,7 +125,13 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 		// Postgres cancel request message flow is unique:
 		// 1. No startup message is sent by the client.
 		// 2. The server closes the connection without responding to the client.
-		return trace.Wrap(e.handleCancelRequest(ctx, sessionCtx))
+		err = e.handleCancelRequest(ctx, sessionCtx)
+		if err != nil {
+			e.Log.WarnContext(e.Context, "Failed to handle cancel request.", "error", err)
+			return trace.Wrap(err)
+		}
+		e.Log.InfoContext(e.Context, "Cancel request handled.")
+		return nil
 	}
 	// Automatically create the database user if needed.
 	cancelAutoUserLease, err := e.GetUserProvisioner(e).Activate(ctx, sessionCtx)
@@ -520,55 +523,12 @@ func (e *Engine) newConnector(sessionCtx *common.Session) *connector {
 
 // handleCancelRequest handles a cancel request and returns immediately (closing the connection).
 func (e *Engine) handleCancelRequest(ctx context.Context, sessionCtx *common.Session) error {
-	config, err := pgconn.ParseConfig(fmt.Sprintf("postgres://%s", sessionCtx.Database.GetURI()))
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx.GetExpiry(), sessionCtx.Database, sessionCtx.DatabaseUser)
+	err := e.newConnector(sessionCtx).sendCancelRequest(ctx, e.cancelReq)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	// We can't use pgconn in this case because it always sends a
-	// startup message.
-	// Instead, use the pgconn config string parser for convenience and dial
-	// db host:port ourselves.
-	network, address := pgconn.NetworkAddress(config.Host, config.Port)
-	dialer := net.Dialer{Timeout: defaults.DefaultIOTimeout}
-	conn, err := dialer.DialContext(ctx, network, address)
-	if err != nil {
-		return common.ConvertConnectError(err, sessionCtx)
-	}
-	tlsConn, err := startPGWireTLS(conn, tlsConfig)
-	if err != nil {
-		return common.ConvertConnectError(err, sessionCtx)
-	}
-	frontend := pgproto3.NewFrontend(pgproto3.NewChunkReader(tlsConn), tlsConn)
-	if err = frontend.Send(e.cancelReq); err != nil {
-		return trace.Wrap(err)
-	}
-	response := make([]byte, 1)
-	if _, err := tlsConn.Read(response); !errors.Is(err, io.EOF) {
-		// server should close the connection after receiving cancel request.
-		return trace.Wrap(err)
-	}
-	return nil
-}
 
-// startPGWireTLS is a helper func that upgrades upstream connection to TLS.
-// copied from github.com/jackc/pgconn.startTLS.
-func startPGWireTLS(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error) {
-	frontend := pgproto3.NewFrontend(pgproto3.NewChunkReader(conn), conn)
-	if err := frontend.Send(&pgproto3.SSLRequest{}); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	response := make([]byte, 1)
-	if _, err := io.ReadFull(conn, response); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if response[0] != 'S' {
-		return nil, trace.Errorf("server refused TLS connection")
-	}
-	return tls.Client(conn, tlsConfig), nil
+	return common.ConvertConnectError(err, sessionCtx)
 }
 
 // formatParameters converts parameters from the Postgres wire message into
diff --git a/lib/srv/db/postgres/healthcheck.go b/lib/srv/db/postgres/healthcheck.go
new file mode 100644
index 0000000000000..83280e5fdf9ef
--- /dev/null
+++ b/lib/srv/db/postgres/healthcheck.go
@@ -0,0 +1,96 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package postgres
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"slices"
+	"strconv"
+
+	"github.com/gravitational/trace"
+	"github.com/jackc/pgconn"
+
+	"github.com/gravitational/teleport/api/types"
+	gcputils "github.com/gravitational/teleport/api/utils/gcp"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker returns an endpoint health checker.
+func NewHealthChecker(_ context.Context, config healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	// special handling for AlloyDB
+	if config.Database.GetType() == types.DatabaseTypeAlloyDB {
+		return newAlloyDBEndpointsResolver(config.Database, config.GCPClients)
+	}
+
+	resolver, err := newEndpointsResolver(config.Database.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return healthcheck.NewTargetDialer(resolver.Resolve), nil
+}
+
+func newAlloyDBEndpointsResolver(db types.Database, clients healthchecks.GCPClients) (healthcheck.HealthChecker, error) {
+	serverPort := strconv.Itoa(alloyDBServerProxyPort)
+
+	info, err := gcputils.ParseAlloyDBConnectionURI(db.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if db.GetGCP().AlloyDB.EndpointOverride != "" {
+		addr := net.JoinHostPort(db.GetGCP().AlloyDB.EndpointOverride, serverPort)
+		return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+			return []string{addr}, nil
+		}), nil
+	}
+
+	return healthcheck.NewTargetDialer(func(ctx context.Context) ([]string, error) {
+		adminClient, err := clients.GetAlloyDBClient(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		addr, err := adminClient.GetEndpointAddress(ctx, *info, db.GetGCP().AlloyDB.EndpointType)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return []string{net.JoinHostPort(addr, serverPort)}, nil
+	}), nil
+}
+
+func newEndpointsResolver(uri string) (healthcheck.EndpointsResolverFunc, error) {
+	config, err := pgconn.ParseConfig(fmt.Sprintf("postgres://%s", uri))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	addrs := make([]string, 0, len(config.Fallbacks)+1)
+	hostPort := net.JoinHostPort(config.Host, strconv.Itoa(int(config.Port)))
+	addrs = append(addrs, hostPort)
+	for _, fb := range config.Fallbacks {
+		hostPort := net.JoinHostPort(fb.Host, strconv.Itoa(int(fb.Port)))
+		// pgconn duplicates the host/port in its fallbacks for some reason, so
+		// we de-duplicate and preserve the fallback order
+		if !slices.Contains(addrs, hostPort) {
+			addrs = append(addrs, hostPort)
+		}
+	}
+	return func(context.Context) ([]string, error) {
+		return addrs, nil
+	}, nil
+}
diff --git a/lib/srv/db/postgres/sql/deactivate-user.sql b/lib/srv/db/postgres/sql/deactivate-user.sql
index f0119539c5e8a..78e0b3eacdc2d 100644
--- a/lib/srv/db/postgres/sql/deactivate-user.sql
+++ b/lib/srv/db/postgres/sql/deactivate-user.sql
@@ -9,7 +9,11 @@ BEGIN
         RAISE NOTICE 'User has active connections';
     ELSE
         -- Revoke all role memberships except teleport-auto-user group.
-        FOR role_ IN SELECT a.rolname FROM pg_roles a WHERE pg_has_role(username, a.oid, 'member') AND a.rolname NOT IN (username, 'teleport-auto-user')
+        FOR role_ IN
+        SELECT r.rolname
+        FROM pg_roles r
+        WHERE r.rolname NOT IN (username, 'teleport-auto-user') AND
+              r.oid IN (select m.roleid from pg_auth_members m where m.member = to_regrole(QUOTE_IDENT(username))::oid)
         LOOP
             EXECUTE FORMAT('REVOKE %I FROM %I', role_, username);
         END LOOP;
diff --git a/lib/srv/db/proxyserver.go b/lib/srv/db/proxyserver.go
index 0f68bbf1a1a4b..cbea0eabed41e 100644
--- a/lib/srv/db/proxyserver.go
+++ b/lib/srv/db/proxyserver.go
@@ -199,7 +199,7 @@ func (s *ProxyServer) ServePostgres(listener net.Listener) error {
 			defer clientConn.Close()
 			err := s.PostgresProxy().HandleConnection(s.closeCtx, clientConn)
 			if err != nil && !utils.IsOKNetworkError(err) {
-				s.log.WarnContext(s.closeCtx, "Failed to handle Postgres client connection.", "error", err)
+				s.log.ErrorContext(s.closeCtx, "Failed to handle Postgres client connection.", "error", err)
 			}
 		}()
 	}
@@ -519,7 +519,7 @@ func (s *ProxyServer) Authorize(ctx context.Context, tlsConn utils.TLSConn, para
 	if params.ClientIP != "" {
 		identity.LoginIP = params.ClientIP
 	}
-	cluster, err := s.cfg.Tunnel.GetSite(identity.RouteToCluster)
+	cluster, err := s.cfg.Tunnel.Cluster(ctx, identity.RouteToCluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/srv/db/redis/client.go b/lib/srv/db/redis/client.go
index 435ed79f6b472..63e7bd23d4bce 100644
--- a/lib/srv/db/redis/client.go
+++ b/lib/srv/db/redis/client.go
@@ -235,7 +235,7 @@ func memorydbIAMTokenFetchFunc(sessionCtx *common.Session, auth common.Auth) fet
 
 func awsIAMTokenFetchFunc(sessionCtx *common.Session, auth common.Auth) (fetchCredentialsFunc, error) {
 	switch sessionCtx.Database.GetType() {
-	case types.DatabaseTypeElastiCache:
+	case types.DatabaseTypeElastiCache, types.DatabaseTypeElastiCacheServerless:
 		return elasticacheIAMTokenFetchFunc(sessionCtx, auth), nil
 	case types.DatabaseTypeMemoryDB:
 		return memorydbIAMTokenFetchFunc(sessionCtx, auth), nil
diff --git a/lib/srv/db/redis/engine.go b/lib/srv/db/redis/engine.go
index 9192c8605f643..cadb16c6b16b9 100644
--- a/lib/srv/db/redis/engine.go
+++ b/lib/srv/db/redis/engine.go
@@ -47,7 +47,6 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/iam"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/srv/db/redis/connection"
 	"github.com/gravitational/teleport/lib/srv/db/redis/protocol"
 	"github.com/gravitational/teleport/lib/utils"
@@ -309,12 +308,12 @@ func (e *Engine) getNewClientFn(ctx context.Context, sessionCtx *common.Session)
 	}
 
 	return func(username, password string) (redis.UniversalClient, error) {
-		credenialsProvider, err := e.createCredentialsProvider(ctx, sessionCtx, username, password)
+		credentialsProvider, err := e.createCredentialsProvider(ctx, sessionCtx, username, password)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		redisClient, err := newClient(ctx, connectionOptions, tlsConfig, credenialsProvider)
+		redisClient, err := newClient(ctx, connectionOptions, tlsConfig, credentialsProvider)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -387,6 +386,10 @@ func (e *Engine) isAWSIAMAuthSupported(ctx context.Context, sessionCtx *common.S
 	dbUser := sessionCtx.DatabaseUser
 	ok, err := e.checkUserIAMAuthIsEnabled(ctx, sessionCtx, dbUser)
 	if err != nil {
+		if sessionCtx.Database.GetType() == types.DatabaseTypeElastiCacheServerless {
+			e.Log.DebugContext(e.Context, "Assuming IAM auth is enabled for user", "user", dbUser, "error", err)
+			return true
+		}
 		e.Log.DebugContext(e.Context, "Assuming IAM auth is not enabled for user.", "user", dbUser, "error", err)
 		return false
 	}
@@ -402,6 +405,8 @@ func checkDBSupportsIAMAuth(database types.Database) (bool, error) {
 		return iam.CheckElastiCacheSupportsIAMAuth(database)
 	case types.DatabaseTypeMemoryDB:
 		return iam.CheckMemoryDBSupportsIAMAuth(database)
+	case types.DatabaseTypeElastiCacheServerless:
+		return true, nil
 	default:
 		return false, nil
 	}
@@ -411,7 +416,7 @@ func checkDBSupportsIAMAuth(database types.Database) (bool, error) {
 // user has IAM auth enabled.
 func (e *Engine) checkUserIAMAuthIsEnabled(ctx context.Context, sessionCtx *common.Session, username string) (bool, error) {
 	switch sessionCtx.Database.GetType() {
-	case types.DatabaseTypeElastiCache:
+	case types.DatabaseTypeElastiCache, types.DatabaseTypeElastiCacheServerless:
 		return e.checkElastiCacheUserIAMAuthIsEnabled(ctx, sessionCtx.Database.GetAWS(), username)
 	case types.DatabaseTypeMemoryDB:
 		return e.checkMemoryDBUserIAMAuthIsEnabled(ctx, sessionCtx.Database.GetAWS(), username)
@@ -630,6 +635,9 @@ func getConnectionOptions(db types.Database) (*connection.Options, error) {
 			defaultMode = connection.Cluster
 		}
 
+	case types.DatabaseTypeElastiCacheServerless:
+		defaultMode = connection.Cluster
+
 	case types.DatabaseTypeMemoryDB:
 		if db.GetAWS().MemoryDB.EndpointType == apiawsutils.MemoryDBClusterEndpoint {
 			defaultMode = connection.Cluster
@@ -654,15 +662,3 @@ func getConnectionOptions(db types.Database) (*connection.Options, error) {
 func getHostPort(connOpts *connection.Options) string {
 	return net.JoinHostPort(connOpts.Address, connOpts.Port)
 }
-
-// NewEndpointsResolver resolves an endpoint from DB URI.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	connOpts, err := getConnectionOptions(db)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	hostPort := getHostPort(connOpts)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{hostPort}, nil
-	}), nil
-}
diff --git a/lib/srv/db/redis/healthcheck.go b/lib/srv/db/redis/healthcheck.go
new file mode 100644
index 0000000000000..2de71f4fb7817
--- /dev/null
+++ b/lib/srv/db/redis/healthcheck.go
@@ -0,0 +1,40 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package redis
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker resolves an endpoint from DB URI.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	connOpts, err := getConnectionOptions(cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	hostPort := getHostPort(connOpts)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{hostPort}, nil
+	}), nil
+}
diff --git a/lib/srv/db/redis/test.go b/lib/srv/db/redis/test.go
deleted file mode 100644
index 7a260f4ae3cc0..0000000000000
--- a/lib/srv/db/redis/test.go
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package redis
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/alicebob/miniredis/v2"
-	"github.com/gravitational/trace"
-	"github.com/redis/go-redis/v9"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/srv/db/common"
-)
-
-// Client alias for easier use.
-type Client = redis.Client
-
-// ClientOptionsParams is a struct for client configuration options.
-type ClientOptionsParams struct {
-	skipPing bool
-	timeout  time.Duration
-}
-
-// ClientOptions allows setting test client options.
-type ClientOptions func(*ClientOptionsParams)
-
-// SkipPing skips Redis server ping right after the connection is established.
-func SkipPing(skip bool) ClientOptions {
-	return func(ts *ClientOptionsParams) {
-		ts.skipPing = skip
-	}
-}
-
-// WithTimeout overrides test client's default timeout.
-func WithTimeout(timeout time.Duration) ClientOptions {
-	return func(ts *ClientOptionsParams) {
-		ts.timeout = timeout
-	}
-}
-
-// MakeTestClient returns Redis client connection according to the provided
-// parameters.
-func MakeTestClient(ctx context.Context, config common.TestClientConfig, opts ...ClientOptions) (*Client, error) {
-	tlsConfig, err := common.MakeTestClientTLSConfig(config)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	clientOptions := &ClientOptionsParams{
-		// set default timeout to 10 seconds for test clients.
-		timeout: 10 * time.Second,
-	}
-
-	for _, opt := range opts {
-		opt(clientOptions)
-	}
-
-	client := redis.NewClient(&redis.Options{
-		Addr:             config.Address,
-		TLSConfig:        tlsConfig,
-		DialTimeout:      clientOptions.timeout,
-		ReadTimeout:      clientOptions.timeout,
-		WriteTimeout:     clientOptions.timeout,
-		Protocol:         protocolV2,
-		DisableIndentity: true,
-	})
-
-	if !clientOptions.skipPing {
-		if err := client.Ping(ctx).Err(); err != nil {
-			_ = client.Close()
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	return client, nil
-}
-
-// TestServer is a test Redis server used in functional database
-// access tests. Internally is uses github.com/alicebob/miniredis to
-// simulate Redis server behavior.
-type TestServer struct {
-	cfg    common.TestServerConfig
-	server *miniredis.Miniredis
-
-	// password is the default user password.
-	// If set, AUTH must be sent first to get access to the server.
-	password string
-}
-
-// TestServerOption allows setting test server options.
-type TestServerOption func(*TestServer)
-
-// TestServerPassword sets the test Redis server password for default user.
-func TestServerPassword(password string) TestServerOption {
-	return func(ts *TestServer) {
-		ts.password = password
-	}
-}
-
-// NewTestServer returns a new instance of a test Redis server.
-func NewTestServer(t testing.TB, config common.TestServerConfig, opts ...TestServerOption) (*TestServer, error) {
-	tlsConfig, err := common.MakeTestServerTLSConfig(config)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	server := &TestServer{
-		cfg: config,
-	}
-
-	for _, opt := range opts {
-		opt(server)
-	}
-
-	// Create a new test Redis instance.
-	s := miniredis.NewMiniRedis()
-	if server.password != "" {
-		s.RequireAuth(server.password)
-	}
-
-	err = s.StartTLS(tlsConfig)
-	require.NoError(t, err)
-
-	t.Cleanup(s.Close)
-
-	server.server = s
-
-	return server, nil
-}
-
-// Port returns a port that test Redis instance is listening on.
-func (s *TestServer) Port() string {
-	return s.server.Port()
-}
diff --git a/lib/srv/db/redis/testing/test.go b/lib/srv/db/redis/testing/test.go
new file mode 100644
index 0000000000000..c1ccd22ccbc25
--- /dev/null
+++ b/lib/srv/db/redis/testing/test.go
@@ -0,0 +1,158 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package testing
+
+import (
+	"context"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/gravitational/trace"
+	"github.com/redis/go-redis/v9"
+
+	"github.com/gravitational/teleport/lib/srv/db/common"
+)
+
+// Client alias for easier use.
+type Client = redis.Client
+
+// ClientOptionsParams is a struct for client configuration options.
+type ClientOptionsParams struct {
+	skipPing bool
+	timeout  time.Duration
+}
+
+// ClientOptions allows setting test client options.
+type ClientOptions func(*ClientOptionsParams)
+
+// SkipPing skips Redis server ping right after the connection is established.
+func SkipPing(skip bool) ClientOptions {
+	return func(ts *ClientOptionsParams) {
+		ts.skipPing = skip
+	}
+}
+
+// WithTimeout overrides test client's default timeout.
+func WithTimeout(timeout time.Duration) ClientOptions {
+	return func(ts *ClientOptionsParams) {
+		ts.timeout = timeout
+	}
+}
+
+// MakeTestClient returns Redis client connection according to the provided
+// parameters.
+func MakeTestClient(ctx context.Context, config common.TestClientConfig, opts ...ClientOptions) (*Client, error) {
+	tlsConfig, err := common.MakeTestClientTLSConfig(config)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clientOptions := &ClientOptionsParams{
+		// set default timeout to 10 seconds for test clients.
+		timeout: 10 * time.Second,
+	}
+
+	for _, opt := range opts {
+		opt(clientOptions)
+	}
+
+	const protocolV2 = 2
+
+	client := redis.NewClient(&redis.Options{
+		Addr:             config.Address,
+		TLSConfig:        tlsConfig,
+		DialTimeout:      clientOptions.timeout,
+		ReadTimeout:      clientOptions.timeout,
+		WriteTimeout:     clientOptions.timeout,
+		Protocol:         protocolV2,
+		DisableIndentity: true,
+	})
+
+	if !clientOptions.skipPing {
+		if err := client.Ping(ctx).Err(); err != nil {
+			_ = client.Close()
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	return client, nil
+}
+
+// TestServer is a test Redis server used in functional database
+// access tests. Internally is uses github.com/alicebob/miniredis to
+// simulate Redis server behavior.
+type TestServer struct {
+	cfg    common.TestServerConfig
+	server *miniredis.Miniredis
+
+	// password is the default user password.
+	// If set, AUTH must be sent first to get access to the server.
+	password string
+}
+
+// TestServerOption allows setting test server options.
+type TestServerOption func(*TestServer)
+
+// TestServerPassword sets the test Redis server password for default user.
+func TestServerPassword(password string) TestServerOption {
+	return func(ts *TestServer) {
+		ts.password = password
+	}
+}
+
+// NewTestServer returns a new instance of a test Redis server.
+func NewTestServer(config common.TestServerConfig, opts ...TestServerOption) (*TestServer, error) {
+	tlsConfig, err := common.MakeTestServerTLSConfig(config)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	server := &TestServer{
+		cfg: config,
+	}
+
+	for _, opt := range opts {
+		opt(server)
+	}
+
+	// Create a new test Redis instance.
+	s := miniredis.NewMiniRedis()
+	if server.password != "" {
+		s.RequireAuth(server.password)
+	}
+
+	err = s.StartTLS(tlsConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	server.server = s
+
+	return server, nil
+}
+
+// Port returns a port that test Redis instance is listening on.
+func (s *TestServer) Port() string {
+	return s.server.Port()
+}
+
+func (s *TestServer) Close() error {
+	s.server.Close()
+	return nil
+}
diff --git a/lib/srv/db/server.go b/lib/srv/db/server.go
index 7d38ed017d58e..7321a41f16812 100644
--- a/lib/srv/db/server.go
+++ b/lib/srv/db/server.go
@@ -35,14 +35,16 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/authz"
-	clients "github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/healthcheck"
@@ -61,7 +63,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/dynamodb"
 	"github.com/gravitational/teleport/lib/srv/db/elasticsearch"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
 	"github.com/gravitational/teleport/lib/srv/db/mongodb"
 	"github.com/gravitational/teleport/lib/srv/db/mysql"
 	"github.com/gravitational/teleport/lib/srv/db/objects"
@@ -79,35 +81,34 @@ import (
 
 func init() {
 	common.RegisterEngine(cassandra.NewEngine, defaults.ProtocolCassandra)
+	common.RegisterEngine(clickhouse.NewEngine, defaults.ProtocolClickHouse)
+	common.RegisterEngine(clickhouse.NewEngine, defaults.ProtocolClickHouseHTTP)
+	common.RegisterEngine(dynamodb.NewEngine, defaults.ProtocolDynamoDB)
 	common.RegisterEngine(elasticsearch.NewEngine, defaults.ProtocolElasticsearch)
-	common.RegisterEngine(opensearch.NewEngine, defaults.ProtocolOpenSearch)
 	common.RegisterEngine(mongodb.NewEngine, defaults.ProtocolMongoDB)
 	common.RegisterEngine(mysql.NewEngine, defaults.ProtocolMySQL)
+	common.RegisterEngine(opensearch.NewEngine, defaults.ProtocolOpenSearch)
 	common.RegisterEngine(postgres.NewEngine, defaults.ProtocolPostgres, defaults.ProtocolCockroachDB)
 	common.RegisterEngine(redis.NewEngine, defaults.ProtocolRedis)
 	common.RegisterEngine(snowflake.NewEngine, defaults.ProtocolSnowflake)
-	common.RegisterEngine(sqlserver.NewEngine, defaults.ProtocolSQLServer)
-	common.RegisterEngine(dynamodb.NewEngine, defaults.ProtocolDynamoDB)
-	common.RegisterEngine(clickhouse.NewEngine, defaults.ProtocolClickHouse)
-	common.RegisterEngine(clickhouse.NewEngine, defaults.ProtocolClickHouseHTTP)
 	common.RegisterEngine(spanner.NewEngine, defaults.ProtocolSpanner)
+	common.RegisterEngine(sqlserver.NewEngine, defaults.ProtocolSQLServer)
 
 	objects.RegisterObjectFetcher(postgres.NewObjectFetcher, defaults.ProtocolPostgres)
 
-	endpoints.RegisterResolver(postgres.NewEndpointsResolver, defaults.ProtocolPostgres, defaults.ProtocolCockroachDB)
-	endpoints.RegisterResolver(mysql.NewEndpointsResolver, defaults.ProtocolMySQL)
-	endpoints.RegisterResolver(mongodb.NewEndpointsResolver, defaults.ProtocolMongoDB)
-
-	endpoints.RegisterResolver(cassandra.NewEndpointsResolver, defaults.ProtocolCassandra)
-	endpoints.RegisterResolver(clickhouse.NewNativeEndpointsResolver, defaults.ProtocolClickHouse)
-	endpoints.RegisterResolver(clickhouse.NewHTTPEndpointsResolver, defaults.ProtocolClickHouseHTTP)
-	endpoints.RegisterResolver(dynamodb.NewEndpointsResolver, defaults.ProtocolDynamoDB)
-	endpoints.RegisterResolver(elasticsearch.NewEndpointsResolver, defaults.ProtocolElasticsearch)
-	endpoints.RegisterResolver(opensearch.NewEndpointsResolver, defaults.ProtocolOpenSearch)
-	endpoints.RegisterResolver(redis.NewEndpointsResolver, defaults.ProtocolRedis)
-	endpoints.RegisterResolver(snowflake.NewEndpointsResolver, defaults.ProtocolSnowflake)
-	endpoints.RegisterResolver(spanner.NewEndpointsResolver, defaults.ProtocolSpanner)
-	endpoints.RegisterResolver(sqlserver.NewEndpointsResolver, defaults.ProtocolSQLServer)
+	healthchecks.RegisterHealthChecker(cassandra.NewHealthChecker, defaults.ProtocolCassandra)
+	healthchecks.RegisterHealthChecker(clickhouse.NewHTTPEndpointHealthChecker, defaults.ProtocolClickHouseHTTP)
+	healthchecks.RegisterHealthChecker(clickhouse.NewNativeEndpointHealthChecker, defaults.ProtocolClickHouse)
+	healthchecks.RegisterHealthChecker(dynamodb.NewHealthChecker, defaults.ProtocolDynamoDB)
+	healthchecks.RegisterHealthChecker(elasticsearch.NewHealthChecker, defaults.ProtocolElasticsearch)
+	healthchecks.RegisterHealthChecker(mongodb.NewHealthChecker, defaults.ProtocolMongoDB)
+	healthchecks.RegisterHealthChecker(mysql.NewHealthChecker, defaults.ProtocolMySQL)
+	healthchecks.RegisterHealthChecker(opensearch.NewHealthChecker, defaults.ProtocolOpenSearch)
+	healthchecks.RegisterHealthChecker(postgres.NewHealthChecker, defaults.ProtocolPostgres, defaults.ProtocolCockroachDB)
+	healthchecks.RegisterHealthChecker(redis.NewHealthChecker, defaults.ProtocolRedis)
+	healthchecks.RegisterHealthChecker(snowflake.NewHealthChecker, defaults.ProtocolSnowflake)
+	healthchecks.RegisterHealthChecker(spanner.NewHealthChecker, defaults.ProtocolSpanner)
+	healthchecks.RegisterHealthChecker(sqlserver.NewHealthChecker, defaults.ProtocolSQLServer)
 }
 
 // Config is the configuration for a database proxy server.
@@ -157,8 +158,10 @@ type Config struct {
 	Auth common.Auth
 	// CADownloader automatically downloads root certs for cloud hosted databases.
 	CADownloader CADownloader
-	// CloudClients creates cloud API clients.
-	CloudClients clients.Clients
+	// AzureClients provides Azure SDK clients.
+	AzureClients azure.Clients
+	// GCPClients provides GCP SDK clients.
+	GCPClients gcp.Clients
 	// AWSConfigProvider provides [aws.Config] for AWS SDK service clients.
 	AWSConfigProvider awsconfig.Provider
 	// AWSDatabaseFetcherFactory provides AWS database fetchers
@@ -215,12 +218,15 @@ func (c *Config) CheckAndSetDefaults(ctx context.Context) (err error) {
 	if c.NewAudit == nil {
 		c.NewAudit = common.NewAudit
 	}
-	if c.CloudClients == nil {
-		cloudClients, err := clients.NewClients()
+	if c.AzureClients == nil {
+		azureClients, err := azure.NewClients()
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		c.CloudClients = cloudClients
+		c.AzureClients = azureClients
+	}
+	if c.GCPClients == nil {
+		c.GCPClients = gcp.NewClients()
 	}
 	if c.AWSConfigProvider == nil {
 		provider, err := awsconfig.NewCache()
@@ -243,7 +249,8 @@ func (c *Config) CheckAndSetDefaults(ctx context.Context) (err error) {
 			AuthClient:        c.AuthClient,
 			AccessPoint:       c.AccessPoint,
 			Clock:             c.Clock,
-			Clients:           c.CloudClients,
+			AzureClients:      c.AzureClients,
+			GCPClients:        c.GCPClients,
 			AWSConfigProvider: c.AWSConfigProvider,
 		})
 		if err != nil {
@@ -320,7 +327,7 @@ func (c *Config) CheckAndSetDefaults(ctx context.Context) (err error) {
 			DatabaseObjectClient: c.AuthClient.DatabaseObjectsClient(),
 			ImportRules:          c.AuthClient,
 			Auth:                 c.Auth,
-			GCPClients:           c.CloudClients,
+			GCPClients:           c.GCPClients,
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -330,7 +337,7 @@ func (c *Config) CheckAndSetDefaults(ctx context.Context) (err error) {
 	if c.discoveryResourceChecker == nil {
 		c.discoveryResourceChecker, err = cloud.NewDiscoveryResourceChecker(cloud.DiscoveryResourceCheckerConfig{
 			ResourceMatchers:  c.ResourceMatchers,
-			AzureClients:      c.CloudClients,
+			AzureClients:      c.AzureClients,
 			AWSConfigProvider: c.AWSConfigProvider,
 			Context:           ctx,
 		})
@@ -519,12 +526,6 @@ func New(ctx context.Context, config Config) (*Server, error) {
 // startDatabase performs initialization actions for the provided database
 // such as starting dynamic labels and initializing CA certificate.
 func (s *Server) startDatabase(ctx context.Context, database types.Database) error {
-	if err := s.startHealthCheck(ctx, database); err != nil {
-		s.log.DebugContext(ctx, "Failed to start database health checker",
-			"db", database.GetName(),
-			"error", err,
-		)
-	}
 	// For cloud-hosted databases (RDS, Redshift, GCP), try to automatically
 	// download a CA certificate.
 	// TODO(r0mant): This should ideally become a part of cloud metadata service.
@@ -554,6 +555,13 @@ func (s *Server) startDatabase(ctx context.Context, database types.Database) err
 		// Log, but do not fail. We will fetch the version later.
 		s.log.WarnContext(ctx, "Failed to fetch the MySQL version.", "db", database.GetName(), "error", err)
 	}
+	// start health check after fetching MySQL version to avoid data race
+	if err := s.startHealthCheck(ctx, database); err != nil && !trace.IsNotImplemented(err) {
+		s.log.DebugContext(ctx, "Failed to start database health checker",
+			"db", database.GetName(),
+			"error", err,
+		)
+	}
 	// Heartbeat will periodically report the presence of this proxied database
 	// to the auth server.
 	if err := s.startHeartbeat(ctx, database); err != nil {
@@ -673,8 +681,8 @@ func (s *Server) stopDynamicLabels(name string) {
 func (s *Server) registerDatabase(ctx context.Context, database types.Database) error {
 	if err := s.startDatabase(ctx, database); err != nil {
 		// Cleanup in case database was initialized only partially.
-		if errStop := s.stopDatabase(ctx, database); errStop != nil {
-			return trace.NewAggregate(err, errStop)
+		if errUnregister := s.unregisterDatabase(ctx, database); errUnregister != nil {
+			return trace.NewAggregate(err, errUnregister)
 		}
 		return trace.Wrap(err)
 	}
@@ -691,10 +699,6 @@ func (s *Server) updateDatabase(ctx context.Context, database types.Database) er
 		return trace.Wrap(err)
 	}
 	if err := s.registerDatabase(ctx, database); err != nil {
-		// If we failed to re-register, don't keep proxying the old database.
-		if errUnregister := s.unregisterDatabase(ctx, database); errUnregister != nil {
-			return trace.NewAggregate(err, errUnregister)
-		}
 		return trace.Wrap(err)
 	}
 	return nil
@@ -721,10 +725,14 @@ func (s *Server) stopProxyingAndDeleteDatabase(ctx context.Context, database typ
 	if err := s.stopDatabase(ctx, database); err != nil {
 		return trace.Wrap(err)
 	}
-	// Heartbeat is stopped but if we don't remove this database server,
-	// it can linger for up to ~10m until its TTL expires.
-	if err := s.deleteDatabaseServer(ctx, database.GetName()); err != nil {
-		return trace.Wrap(err)
+	// stopping the upstream inventory heartbeat may incur a backend write
+	// to delete the heartbeat, which is unnecessary when updating a DB,
+	// since we will upsert a new heartbeat
+	if err := s.stopUpstreamInventoryHeartbeat(ctx, database); err != nil {
+		s.log.WarnContext(ctx, "Failed to stop upstream inventory database heartbeat",
+			"db", log.StringerAttr(database),
+			"error", err,
+		)
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -757,6 +765,16 @@ func (s *Server) getProxiedDatabase(name string) (types.Database, error) {
 	return s.copyDatabaseWithUpdatedLabelsLocked(db), nil
 }
 
+func (s *Server) updateProxiedDatabase(name string, doUpdate func(types.Database) error) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	db, found := s.proxiedDatabases[name]
+	if !found {
+		return trace.NotFound("%q not found among registered databases", name)
+	}
+	return trace.Wrap(doUpdate(db))
+}
+
 // copyDatabaseWithUpdatedLabelsLocked will inject updated dynamic and cloud labels into
 // a database object.
 // The caller must invoke an RLock on `s.mu` before calling this function.
@@ -781,7 +799,6 @@ func (s *Server) copyDatabaseWithUpdatedLabelsLocked(database types.Database) *t
 func (s *Server) startHeartbeat(ctx context.Context, database types.Database) error {
 	heartbeat, err := srv.NewDatabaseServerHeartbeat(srv.HeartbeatV2Config[*types.DatabaseServerV3]{
 		InventoryHandle: s.cfg.InventoryHandle,
-		Announcer:       s.cfg.AccessPoint,
 		GetResource:     s.getServerInfoFunc(database),
 		OnHeartbeat:     s.cfg.OnHeartbeat,
 	})
@@ -807,6 +824,34 @@ func (s *Server) stopHeartbeat(name string) error {
 	return heartbeat.Close()
 }
 
+// stopUpstreamInventoryHeartbeat stops the upstream inventory control stream
+// heartbeat for a single database.
+// https://github.com/gravitational/teleport/issues/50237
+func (s *Server) stopUpstreamInventoryHeartbeat(ctx context.Context, db types.Database) error {
+	if _, ok := s.cfg.InventoryHandle.GetSender(); ok {
+		select {
+		// get latest sender
+		case sender := <-s.cfg.InventoryHandle.Sender():
+			if sender.Hello().Capabilities.DatabaseHeartbeatGracefulStop {
+				err := sender.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+					Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
+					Name: db.GetName(),
+				})
+				return trace.Wrap(err)
+			}
+		case <-ctx.Done():
+			return trace.Wrap(ctx.Err())
+		}
+	}
+	// if upstream doesn't support graceful stop and we don't remove this
+	// database server, it can linger for up to ~10m until its TTL expires.
+	// TODO(gavin): DELETE IN 20.0.0
+	if err := s.deleteDatabaseServer(ctx, db.GetName()); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
 // getServerInfoFunc returns function that the heartbeater uses to report the
 // provided database to the auth server.
 //
@@ -1088,7 +1133,7 @@ func (s *Server) close(ctx context.Context) error {
 	}
 
 	// Close all cloud clients.
-	return trace.Wrap(s.cfg.CloudClients.Close())
+	return trace.Wrap(s.cfg.GCPClients.Close())
 }
 
 // Wait will block while the server is running.
@@ -1145,7 +1190,7 @@ func (s *Server) HandleConnection(conn net.Conn) {
 }
 
 func (s *Server) handleConnection(ctx context.Context, clientConn net.Conn) error {
-	sessionCtx, err := s.authorize(ctx)
+	sessionCtx, err := s.authorize(ctx, clientConn.RemoteAddr())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1277,7 +1322,7 @@ func (s *Server) createEngine(sessionCtx *common.Session, audit common.Audit) (c
 		Audit:             audit,
 		AuthClient:        s.cfg.AuthClient,
 		AWSConfigProvider: s.cfg.AWSConfigProvider,
-		GCPClients:        s.cfg.CloudClients,
+		GCPClients:        s.cfg.GCPClients,
 		Context:           s.connContext,
 		Clock:             s.cfg.Clock,
 		Log:               sessionCtx.Log,
@@ -1290,19 +1335,11 @@ func (s *Server) createEngine(sessionCtx *common.Session, audit common.Audit) (c
 				Clock:      s.cfg.Clock,
 			}
 		},
-		UpdateProxiedDatabase: func(name string, doUpdate func(types.Database) error) error {
-			s.mu.Lock()
-			defer s.mu.Unlock()
-			db, found := s.proxiedDatabases[name]
-			if !found {
-				return trace.NotFound("%q not found among registered databases", name)
-			}
-			return trace.Wrap(doUpdate(db))
-		},
+		UpdateProxiedDatabase: s.updateProxiedDatabase,
 	})
 }
 
-func (s *Server) authorize(ctx context.Context) (*common.Session, error) {
+func (s *Server) authorize(ctx context.Context, clientIP net.Addr) (*common.Session, error) {
 	// Only allow local and remote identities to proxy to a database.
 	userType, err := authz.UserFromContext(ctx)
 	if err != nil {
@@ -1351,6 +1388,7 @@ func (s *Server) authorize(ctx context.Context) (*common.Session, error) {
 		Log:                s.log.With("id", id, "db", database.GetName()),
 		LockTargets:        authContext.LockTargets(),
 		StartTime:          s.cfg.Clock.Now(),
+		ClientIP:           clientIP.String(),
 	}
 
 	s.log.DebugContext(ctx, "Created session context.", "session", sessionCtx)
@@ -1400,7 +1438,8 @@ func (s *Server) trackSession(ctx context.Context, sessionCtx *common.Session) e
 		ClusterName:  sessionCtx.ClusterName,
 		Login:        sessionCtx.Identity.GetUserMetadata().Login,
 		Participants: []types.Participant{{
-			User: sessionCtx.Identity.Username,
+			User:    sessionCtx.Identity.Username,
+			Cluster: sessionCtx.Identity.OriginClusterName,
 		}},
 		HostUser: sessionCtx.Identity.Username,
 		Created:  s.cfg.Clock.Now(),
@@ -1431,17 +1470,17 @@ func (s *Server) trackSession(ctx context.Context, sessionCtx *common.Session) e
 
 // startHealthCheck starts health checks for the database.
 func (s *Server) startHealthCheck(ctx context.Context, db types.Database) error {
-	resolver, err := s.getEndpointsResolver(ctx, db)
+	checker, err := s.getHealthChecker(ctx, db)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	err = s.cfg.healthCheckManager.AddTarget(healthcheck.Target{
+		HealthChecker: checker,
 		GetResource: func() types.ResourceWithLabels {
 			s.mu.RLock()
 			defer s.mu.RUnlock()
 			return s.copyDatabaseWithUpdatedLabelsLocked(db)
 		},
-		ResolverFn: resolver,
 	})
 	return trace.Wrap(err)
 }
@@ -1459,7 +1498,11 @@ func (s *Server) stopHealthCheck(db types.Database) error {
 // getTargetHealth returns the target health for the database.
 func (s *Server) getTargetHealth(ctx context.Context, db types.Database) types.TargetHealth {
 	if err := checkSupportsHealthChecks(db); err != nil {
-		return types.TargetHealth{}
+		return types.TargetHealth{
+			Status:           string(types.TargetHealthStatusUnknown),
+			TransitionReason: string(types.TargetHealthTransitionReasonDisabled),
+			Message:          err.Error(),
+		}
 	}
 
 	health, err := s.cfg.healthCheckManager.GetTargetHealth(db)
@@ -1486,22 +1529,32 @@ func (s *Server) getTargetHealth(ctx context.Context, db types.Database) types.T
 	}
 }
 
-// getEndpointsResolver gets a health check endpoint resolver for the database.
-func (s *Server) getEndpointsResolver(ctx context.Context, db types.Database) (healthcheck.EndpointsResolverFunc, error) {
-	resolver, err := endpoints.GetResolver(ctx, db, endpoints.ResolverBuilderConfig{
-		GCPClients: s.cfg.CloudClients,
+func (s *Server) getHealthChecker(ctx context.Context, db types.Database) (healthcheck.HealthChecker, error) {
+	if err := checkSupportsHealthChecks(db); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	s.mu.RLock()
+	db = s.copyDatabaseWithUpdatedLabelsLocked(db)
+	s.mu.RUnlock()
+	checker, err := healthchecks.GetHealthChecker(ctx, healthchecks.HealthCheckerConfig{
+		Auth:                  s.cfg.Auth,
+		AuthClient:            s.cfg.AuthClient,
+		Clock:                 s.cfg.Clock,
+		Database:              db,
+		GCPClients:            s.cfg.GCPClients,
+		Log:                   s.log,
+		UpdateProxiedDatabase: s.updateProxiedDatabase,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resolver.Resolve, nil
+	return checker, nil
 }
 
 // checkSupportsHealthChecks returns nil if the database supports health checks.
-// TODO(gavin): add resolvers for all database protocols that we support, then
-// remove this helper.
 func checkSupportsHealthChecks(db types.Database) error {
-	if !endpoints.IsRegistered(db) {
+	if !healthchecks.IsRegistered(db) {
 		return trace.NotImplemented("endpoint health checks for database protocol %q are not supported", db.GetProtocol())
 	}
 	return nil
diff --git a/lib/srv/db/server_test.go b/lib/srv/db/server_test.go
index 4991b95ed69f8..f9b2358e256de 100644
--- a/lib/srv/db/server_test.go
+++ b/lib/srv/db/server_test.go
@@ -49,24 +49,24 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/limiter"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/dynamodb"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
 	"github.com/gravitational/teleport/lib/srv/db/mysql"
 	"github.com/gravitational/teleport/lib/srv/db/snowflake"
 )
 
-func registerTestEndpointResolver(t *testing.T, builder endpoints.ResolverBuilder, names ...string) {
+func registerTestEndpointResolver(t *testing.T, builder healthchecks.HealthCheckerBuilder, names ...string) {
 	// prevent parallel tests from running with the modified endpoint resolver.
 	t.Setenv("registerTestEndpointResolver", "NO PARALLEL ALLOWED")
-	origBuilders, err := endpoints.GetResolverBuilders(names...)
+	origBuilders, err := healthchecks.GetHealthCheckBuilders(names...)
 	require.NoError(t, err, "trying to override a resolver that isn't registered")
-	endpoints.RegisterResolver(builder, names...)
+	healthchecks.RegisterHealthChecker(builder, names...)
 	t.Cleanup(func() {
 		for name, origBuilder := range origBuilders {
-			endpoints.RegisterResolver(origBuilder, name)
+			healthchecks.RegisterHealthChecker(origBuilder, name)
 		}
 	})
 }
@@ -710,12 +710,13 @@ func TestHealthCheck(t *testing.T) {
 		withSQLServer("sqlserver")(t, ctx, testCtx),
 		withAzureRedis("redis-azure", azureRedisToken)(t, ctx, testCtx),
 		withElastiCacheRedis("redis-elasticache", elastiCacheRedisToken, "7.0.0")(t, ctx, testCtx),
+		withElastiCacheServerlessRedis("redis-serverless-elasticache", elastiCacheServerlessRedisToken, "8.0.0")(t, ctx, testCtx),
 		withMemoryDBRedis("redis-memorydb", memorydbToken, "7.0")(t, ctx, testCtx),
 		withSelfHostedRedis("redis-self-hosted")(t, ctx, testCtx),
 		withSnowflake("snowflake")(t, ctx, testCtx),
 	}
 	for _, db := range databases {
-		require.True(t, endpoints.IsRegistered(db), "database %v does not have a registered endpoint resolver", db.GetName())
+		require.True(t, healthchecks.IsRegistered(db), "database %v does not have a registered endpoint resolver", db.GetName())
 	}
 	dynamoListenAddr := net.JoinHostPort("localhost", testCtx.dynamodb["dynamodb"].db.Port())
 	dynamoResolver := &fakeEndpointResolver{
@@ -734,8 +735,8 @@ func TestHealthCheck(t *testing.T) {
 			testCtx.snowflake["snowflake"].resource.GetURI(): snowflakeListenAddr,
 		},
 	}
-	registerTestEndpointResolver(t, dynamoResolver.build, defaults.ProtocolDynamoDB)
-	registerTestEndpointResolver(t, snowflakeResolver.build, defaults.ProtocolSnowflake)
+	registerTestEndpointResolver(t, dynamoResolver.newHealthChecker, defaults.ProtocolDynamoDB)
+	registerTestEndpointResolver(t, snowflakeResolver.newHealthChecker, defaults.ProtocolSnowflake)
 
 	testCtx.server = testCtx.setupDatabaseServer(ctx, t, agentParams{
 		Databases: databases,
@@ -755,38 +756,15 @@ func TestHealthCheck(t *testing.T) {
 	for _, db := range databases {
 		t.Run(db.GetName(), func(t *testing.T) {
 			t.Parallel()
-			waitForHealthStatus(t, ctx, db.GetName(), testCtx.authServer, types.TargetHealthStatusHealthy)
+			dbServer, err := testCtx.server.getServerInfo(ctx, db)
+			require.NoError(t, err)
+			require.EventuallyWithT(t, func(t *assert.CollectT) {
+				assert.Equal(t, types.TargetHealthStatusHealthy, dbServer.GetTargetHealthStatus())
+			}, 30*time.Second, time.Millisecond*250, "waiting for database %s to become healthy", db.GetName())
 		})
 	}
 }
 
-func waitForHealthStatus(t *testing.T, ctx context.Context, name string, serverGetter services.DatabaseServersGetter, want types.TargetHealthStatus) {
-	t.Helper()
-	timeout := 15 * time.Second
-	ctx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		servers, err := serverGetter.GetDatabaseServers(ctx, apidefaults.Namespace)
-		if !assert.NoError(t, err) {
-			return
-		}
-		var server types.DatabaseServer
-		for _, s := range servers {
-			if s.GetName() == name {
-				server = s
-				break
-			}
-		}
-		if server == nil {
-			assert.FailNowf(t, "failed to find db_server", "db_server=%s", name)
-			return
-		}
-		health := server.GetTargetHealth()
-		assert.Equal(t, string(want), health.Status)
-	}, timeout, time.Millisecond*250, "waiting for database %s to become healthy", name)
-}
-
 func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	out, err := healthcheckconfig.NewHealthCheckConfig(name,
@@ -810,19 +788,19 @@ func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.Health
 type fakeEndpointResolver struct {
 	t *testing.T
 	// builder is the builder that this fake resolver wraps.
-	builder endpoints.ResolverBuilder
+	builder func(ctx context.Context, db types.Database) (healthcheck.Resolver, error)
 	// rewrite is a map of host:port addresses to rewrite.
 	// The resolver asserts an error if an address is not found in this map.
 	rewrite map[string]string
 }
 
-func (f *fakeEndpointResolver) build(ctx context.Context, db types.Database, cfg endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
+func (f *fakeEndpointResolver) newHealthChecker(ctx context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
 	f.t.Helper()
-	resolver, err := f.builder(ctx, db, cfg)
+	resolver, err := f.builder(ctx, cfg.Database)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return endpoints.ResolverFn(func(ctx context.Context) ([]string, error) {
+	return healthcheck.NewTargetDialer(func(ctx context.Context) ([]string, error) {
 		f.t.Helper()
 		addrs, err := resolver.Resolve(ctx)
 		if err != nil {
diff --git a/lib/srv/db/snowflake/engine.go b/lib/srv/db/snowflake/engine.go
index 1c6d215e0cebd..b1cc160472e0b 100644
--- a/lib/srv/db/snowflake/engine.go
+++ b/lib/srv/db/snowflake/engine.go
@@ -21,7 +21,6 @@ package snowflake
 import (
 	"bufio"
 	"bytes"
-	"cmp"
 	"compress/gzip"
 	"context"
 	"crypto/tls"
@@ -42,7 +41,6 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -685,17 +683,3 @@ func parseURI(uri string) (*url.URL, error) {
 	snowflakeURL, err := url.Parse(uri)
 	return snowflakeURL, trace.Wrap(err)
 }
-
-// NewEndpointsResolver resolves an endpoint from DB URI.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	dbURL, err := parseURI(db.GetURI())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	host := dbURL.Hostname()
-	port := cmp.Or(dbURL.Port(), "443")
-	hostPort := net.JoinHostPort(host, port)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{hostPort}, nil
-	}), nil
-}
diff --git a/lib/srv/db/snowflake/healthcheck.go b/lib/srv/db/snowflake/healthcheck.go
new file mode 100644
index 0000000000000..9aa9950827ded
--- /dev/null
+++ b/lib/srv/db/snowflake/healthcheck.go
@@ -0,0 +1,54 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package snowflake
+
+import (
+	"cmp"
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewEndpointsResolver resolves an endpoint from DB URI.
+func NewEndpointsResolver(_ context.Context, db types.Database) (healthcheck.Resolver, error) {
+	dbURL, err := parseURI(db.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	host := dbURL.Hostname()
+	port := cmp.Or(dbURL.Port(), "443")
+	hostPort := net.JoinHostPort(host, port)
+	return healthcheck.EndpointsResolverFunc(func(context.Context) ([]string, error) {
+		return []string{hostPort}, nil
+	}), nil
+}
+
+// NewHealthChecker resolves an endpoint from DB URI.
+func NewHealthChecker(ctx context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	resolver, err := NewEndpointsResolver(ctx, cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return healthcheck.NewTargetDialer(resolver.Resolve), nil
+}
diff --git a/lib/srv/db/spanner/grpcserver.go b/lib/srv/db/spanner/grpcserver.go
index 05f5069960a41..d8166a80138cc 100644
--- a/lib/srv/db/spanner/grpcserver.go
+++ b/lib/srv/db/spanner/grpcserver.go
@@ -41,7 +41,6 @@ import (
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 )
 
 type upstream[T any] interface {
@@ -524,11 +523,3 @@ func (s *messageStatsHandler) HandleConn(_ context.Context, _ stats.ConnStats) {
 func getEndpoint(db types.Database) string {
 	return db.GetURI()
 }
-
-// NewEndpointsResolver returns an endpoint resolver.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	uri := getEndpoint(db)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{uri}, nil
-	}), nil
-}
diff --git a/lib/srv/db/spanner/healthcheck.go b/lib/srv/db/spanner/healthcheck.go
new file mode 100644
index 0000000000000..39bfc5feed861
--- /dev/null
+++ b/lib/srv/db/spanner/healthcheck.go
@@ -0,0 +1,34 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package spanner
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker returns an endpoint health checker.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	uri := getEndpoint(cfg.Database)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{uri}, nil
+	}), nil
+}
diff --git a/lib/srv/db/spanner/test.go b/lib/srv/db/spanner/test.go
deleted file mode 100644
index 5ff4a77900e18..0000000000000
--- a/lib/srv/db/spanner/test.go
+++ /dev/null
@@ -1,305 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package spanner
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-	"time"
-
-	"cloud.google.com/go/spanner"
-	"cloud.google.com/go/spanner/apiv1/spannerpb"
-	"github.com/google/uuid"
-	"github.com/gravitational/trace"
-	"google.golang.org/api/option"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/connectivity"
-	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/metadata"
-	"google.golang.org/protobuf/types/known/structpb"
-
-	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/tlsca"
-)
-
-// SpannerTestClient wraps a [spanner.Client] and provides direct access to the
-// underlying [grpc.ClientConn] of the client.
-type SpannerTestClient struct {
-	ClientConn *grpc.ClientConn
-	*spanner.Client
-}
-
-// WaitForConnectionState waits until the spanner client's underlying gRPC
-// connection transitions into the given state or the context expires.
-func (c *SpannerTestClient) WaitForConnectionState(ctx context.Context, wantState connectivity.State) error {
-	for {
-		s := c.ClientConn.GetState()
-		if s == wantState {
-			return nil
-		}
-		if s == connectivity.Shutdown {
-			return trace.Errorf("spanner test client connection has shutdown")
-		}
-		if !c.ClientConn.WaitForStateChange(ctx, s) {
-			return ctx.Err()
-		}
-	}
-}
-
-func MakeTestClient(ctx context.Context, config common.TestClientConfig) (*SpannerTestClient, error) {
-	return makeTestClient(ctx, config, false)
-}
-
-func makeTestClient(ctx context.Context, config common.TestClientConfig, useTLS bool) (*SpannerTestClient, error) {
-	databaseID, err := getDatabaseID(ctx, config.RouteToDatabase, config.AuthServer)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var transportOpt grpc.DialOption
-	if useTLS {
-		tlsCfg, err := common.MakeTestClientTLSConfig(config)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		transportOpt = grpc.WithTransportCredentials(credentials.NewTLS(tlsCfg))
-	} else {
-		transportOpt = grpc.WithTransportCredentials(insecure.NewCredentials())
-	}
-
-	cc, err := grpc.NewClient(config.Address, transportOpt)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	opts := []option.ClientOption{
-		option.WithGRPCConn(cc),
-		// client should not bring any GCP credentials
-		option.WithoutAuthentication(),
-	}
-
-	clientCfg := spanner.ClientConfig{
-		DisableNativeMetrics: true,
-		SessionPoolConfig:    spanner.DefaultSessionPoolConfig,
-	}
-	clt, err := spanner.NewClientWithConfig(ctx, databaseID, clientCfg, opts...)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &SpannerTestClient{
-		ClientConn: cc,
-		Client:     clt,
-	}, nil
-}
-
-func getDatabaseID(ctx context.Context, route tlsca.RouteToDatabase, getter services.DatabaseServersGetter) (string, error) {
-	const timeout = 10 * time.Second
-	const step = time.Second
-
-	var server types.DatabaseServer
-	var err error
-	ctx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	for {
-		server, err = getDBServer(ctx, route.ServiceName, getter)
-		if err == nil {
-			break
-		}
-		select {
-		case <-ctx.Done():
-			return "", trace.Wrap(err)
-		default:
-		}
-		time.Sleep(step)
-	}
-
-	gcp := server.GetDatabase().GetGCP()
-	id := fmt.Sprintf("projects/%s/instances/%s/databases/%s", gcp.ProjectID, gcp.InstanceID, route.Database)
-	return id, nil
-}
-
-func getDBServer(ctx context.Context, name string, getter services.DatabaseServersGetter) (types.DatabaseServer, error) {
-	servers, err := getter.GetDatabaseServers(ctx, apidefaults.Namespace)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	for _, s := range servers {
-		if s.GetName() == name {
-			return s, nil
-		}
-	}
-	return nil, trace.NotFound("db_server %q not found", name)
-}
-
-type TestServer struct {
-	srv      *grpc.Server
-	listener net.Listener
-	port     string
-	spannerpb.UnimplementedSpannerServer
-}
-
-func NewTestServer(config common.TestServerConfig) (tsrv *TestServer, err error) {
-	err = config.CheckAndSetDefaults()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer config.CloseOnError(&err)
-
-	tlsConfig, err := common.MakeTestServerTLSConfig(config)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	port, err := config.Port()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	checker := credentialChecker{expectToken: "Bearer " + config.AuthToken}
-	testServer := &TestServer{
-		srv: grpc.NewServer(
-			grpc.Creds(credentials.NewTLS(tlsConfig)),
-			grpc.ChainUnaryInterceptor(unaryAuthInterceptor(checker)),
-			grpc.ChainStreamInterceptor(streamingAuthInterceptor(checker)),
-		),
-		listener: config.Listener,
-		port:     port,
-	}
-	spannerpb.RegisterSpannerServer(testServer.srv, testServer)
-
-	return testServer, nil
-}
-
-func unaryAuthInterceptor(c credentialChecker) grpc.UnaryServerInterceptor {
-	return func(
-		ctx context.Context,
-		req interface{},
-		info *grpc.UnaryServerInfo,
-		handler grpc.UnaryHandler,
-	) (interface{}, error) {
-		if err := c.check(ctx); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return handler(ctx, req)
-	}
-}
-
-func streamingAuthInterceptor(c credentialChecker) grpc.StreamServerInterceptor {
-	return func(
-		srv interface{},
-		stream grpc.ServerStream,
-		info *grpc.StreamServerInfo,
-		handler grpc.StreamHandler,
-	) error {
-		if err := c.check(stream.Context()); err != nil {
-			return trace.Wrap(err)
-		}
-		return handler(srv, stream)
-	}
-}
-
-type credentialChecker struct {
-	expectToken string
-}
-
-func (c credentialChecker) check(ctx context.Context) error {
-	md, ok := metadata.FromIncomingContext(ctx)
-	if !ok {
-		return trace.AccessDenied("missing metadata")
-	}
-	tokens, ok := md["authorization"]
-	if !ok || len(tokens) < 1 {
-		return trace.AccessDenied("missing credentials in metadata")
-	}
-	if c.expectToken != tokens[0] {
-		return trace.AccessDenied("invalid RPC auth token. wanted: %q got: %q", c, tokens)
-	}
-	return nil
-}
-
-func (s *TestServer) Serve() error {
-	return s.srv.Serve(s.listener)
-}
-
-func (s *TestServer) Port() string {
-	return s.port
-}
-
-func (s *TestServer) Close() error {
-	s.srv.GracefulStop()
-	return nil
-}
-
-func (s *TestServer) BatchCreateSessions(ctx context.Context, req *spannerpb.BatchCreateSessionsRequest) (*spannerpb.BatchCreateSessionsResponse, error) {
-	tpl := req.SessionTemplate
-	if tpl == nil {
-		tpl = &spannerpb.Session{CreatorRole: "test"}
-	}
-	var sessions []*spannerpb.Session
-	for i := 0; i < int(req.SessionCount); i++ {
-		name := req.GetDatabase() + "/sessions/" + uuid.NewString()
-		sessions = append(sessions, &spannerpb.Session{
-			Name:        name,
-			Labels:      tpl.Labels,
-			CreatorRole: tpl.CreatorRole,
-			Multiplexed: tpl.Multiplexed,
-		})
-	}
-	res := &spannerpb.BatchCreateSessionsResponse{
-		Session: sessions,
-	}
-	return res, nil
-}
-
-func (s *TestServer) ExecuteStreamingSql(req *spannerpb.ExecuteSqlRequest, stream spannerpb.Spanner_ExecuteStreamingSqlServer) error {
-	q := strings.TrimSpace(strings.ToLower(req.GetSql()))
-	parts := strings.Split(q, " ")
-	if len(parts) != 2 || parts[0] != "select" {
-		return trace.BadParameter("test server only supports basic select statement")
-	}
-	_, err := strconv.ParseInt(parts[1], 10, 64)
-	if err != nil {
-		return trace.BadParameter("test server only supports selecting an int64")
-	}
-
-	return stream.Send(&spannerpb.PartialResultSet{
-		Metadata: &spannerpb.ResultSetMetadata{
-			RowType: &spannerpb.StructType{
-				Fields: []*spannerpb.StructType_Field{{
-					Name: "", // no column name
-					Type: &spannerpb.Type{
-						Code: spannerpb.TypeCode_INT64,
-					},
-				}},
-			},
-		},
-		Values: []*structpb.Value{
-			// integers get encoded as a string in base 10.
-			structpb.NewStringValue(parts[1]),
-		},
-	})
-}
diff --git a/lib/srv/db/spanner/testing/test.go b/lib/srv/db/spanner/testing/test.go
new file mode 100644
index 0000000000000..4b83f085a7e0e
--- /dev/null
+++ b/lib/srv/db/spanner/testing/test.go
@@ -0,0 +1,314 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package testing
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	"cloud.google.com/go/spanner"
+	"cloud.google.com/go/spanner/apiv1/spannerpb"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"google.golang.org/api/option"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv/db/common"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// SpannerTestClient wraps a [spanner.Client] and provides direct access to the
+// underlying [grpc.ClientConn] of the client.
+type SpannerTestClient struct {
+	ClientConn *grpc.ClientConn
+	*spanner.Client
+}
+
+// WaitForConnectionState waits until the spanner client's underlying gRPC
+// connection transitions into the given state or the context expires.
+func (c *SpannerTestClient) WaitForConnectionState(ctx context.Context, wantState connectivity.State) error {
+	for {
+		s := c.ClientConn.GetState()
+		if s == wantState {
+			return nil
+		}
+		if s == connectivity.Shutdown {
+			return trace.Errorf("spanner test client connection has shutdown")
+		}
+		if !c.ClientConn.WaitForStateChange(ctx, s) {
+			return ctx.Err()
+		}
+	}
+}
+
+func MakeTestClient(ctx context.Context, config common.TestClientConfig) (*SpannerTestClient, error) {
+	return makeTestClient(ctx, config, false)
+}
+
+func makeTestClient(ctx context.Context, config common.TestClientConfig, useTLS bool) (*SpannerTestClient, error) {
+	databaseID, err := getDatabaseID(ctx, config.RouteToDatabase, config.AuthServer)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var transportOpt grpc.DialOption
+	if useTLS {
+		tlsCfg, err := common.MakeTestClientTLSConfig(config)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		transportOpt = grpc.WithTransportCredentials(credentials.NewTLS(tlsCfg))
+	} else {
+		transportOpt = grpc.WithTransportCredentials(insecure.NewCredentials())
+	}
+
+	cc, err := grpc.NewClient(config.Address, transportOpt)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	opts := []option.ClientOption{
+		option.WithGRPCConn(cc),
+		// client should not bring any GCP credentials
+		option.WithoutAuthentication(),
+	}
+
+	clientCfg := spanner.ClientConfig{
+		DisableNativeMetrics: true,
+		SessionPoolConfig:    spanner.DefaultSessionPoolConfig,
+	}
+	clt, err := spanner.NewClientWithConfig(ctx, databaseID, clientCfg, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &SpannerTestClient{
+		ClientConn: cc,
+		Client:     clt,
+	}, nil
+}
+
+func getDatabaseID(ctx context.Context, route tlsca.RouteToDatabase, getter services.DatabaseServersGetter) (string, error) {
+	const timeout = 10 * time.Second
+	const step = time.Second
+
+	var server types.DatabaseServer
+	var err error
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	for {
+		server, err = getDBServer(ctx, route.ServiceName, getter)
+		if err == nil {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			return "", trace.Wrap(err)
+		default:
+		}
+		time.Sleep(step)
+	}
+
+	gcp := server.GetDatabase().GetGCP()
+	id := fmt.Sprintf("projects/%s/instances/%s/databases/%s", gcp.ProjectID, gcp.InstanceID, route.Database)
+	return id, nil
+}
+
+func getDBServer(ctx context.Context, name string, getter services.DatabaseServersGetter) (types.DatabaseServer, error) {
+	servers, err := getter.GetDatabaseServers(ctx, apidefaults.Namespace)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	for _, s := range servers {
+		if s.GetName() == name {
+			return s, nil
+		}
+	}
+	return nil, trace.NotFound("db_server %q not found", name)
+}
+
+type TestServer struct {
+	srv      *grpc.Server
+	listener net.Listener
+	port     string
+	spannerpb.UnimplementedSpannerServer
+}
+
+func NewTestServer(config common.TestServerConfig) (tsrv *TestServer, err error) {
+	err = config.CheckAndSetDefaults()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer config.CloseOnError(&err)
+
+	tlsConfig, err := common.MakeTestServerTLSConfig(config)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	port, err := config.Port()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	checker := credentialChecker{expectToken: "Bearer " + config.AuthToken}
+	testServer := &TestServer{
+		srv: grpc.NewServer(
+			grpc.Creds(credentials.NewTLS(tlsConfig)),
+			grpc.ChainUnaryInterceptor(unaryAuthInterceptor(checker)),
+			grpc.ChainStreamInterceptor(streamingAuthInterceptor(checker)),
+		),
+		listener: config.Listener,
+		port:     port,
+	}
+	spannerpb.RegisterSpannerServer(testServer.srv, testServer)
+
+	return testServer, nil
+}
+
+func unaryAuthInterceptor(c credentialChecker) grpc.UnaryServerInterceptor {
+	return func(
+		ctx context.Context,
+		req interface{},
+		info *grpc.UnaryServerInfo,
+		handler grpc.UnaryHandler,
+	) (interface{}, error) {
+		if err := c.check(ctx); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return handler(ctx, req)
+	}
+}
+
+func streamingAuthInterceptor(c credentialChecker) grpc.StreamServerInterceptor {
+	return func(
+		srv interface{},
+		stream grpc.ServerStream,
+		info *grpc.StreamServerInfo,
+		handler grpc.StreamHandler,
+	) error {
+		if err := c.check(stream.Context()); err != nil {
+			return trace.Wrap(err)
+		}
+		return handler(srv, stream)
+	}
+}
+
+type credentialChecker struct {
+	expectToken string
+}
+
+func (c credentialChecker) check(ctx context.Context) error {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return trace.AccessDenied("missing metadata")
+	}
+	tokens, ok := md["authorization"]
+	if !ok || len(tokens) < 1 {
+		return trace.AccessDenied("missing credentials in metadata")
+	}
+	if c.expectToken != tokens[0] {
+		return trace.AccessDenied("invalid RPC auth token. wanted: %q got: %q", c, tokens)
+	}
+	return nil
+}
+
+func (s *TestServer) Serve() error {
+	return s.srv.Serve(s.listener)
+}
+
+func (s *TestServer) Port() string {
+	return s.port
+}
+
+func (s *TestServer) Close() error {
+	s.srv.GracefulStop()
+	return nil
+}
+
+func (s *TestServer) CreateSession(ctx context.Context, req *spannerpb.CreateSessionRequest) (*spannerpb.Session, error) {
+	return &spannerpb.Session{
+		Name:        req.GetDatabase() + "/sessions/" + uuid.NewString(),
+		Labels:      req.GetSession().Labels,
+		CreatorRole: req.GetSession().CreatorRole,
+		Multiplexed: req.GetSession().Multiplexed,
+	}, nil
+}
+
+func (s *TestServer) BatchCreateSessions(ctx context.Context, req *spannerpb.BatchCreateSessionsRequest) (*spannerpb.BatchCreateSessionsResponse, error) {
+	tpl := req.SessionTemplate
+	if tpl == nil {
+		tpl = &spannerpb.Session{CreatorRole: "test"}
+	}
+	var sessions []*spannerpb.Session
+	for i := 0; i < int(req.SessionCount); i++ {
+		name := req.GetDatabase() + "/sessions/" + uuid.NewString()
+		sessions = append(sessions, &spannerpb.Session{
+			Name:        name,
+			Labels:      tpl.Labels,
+			CreatorRole: tpl.CreatorRole,
+			Multiplexed: tpl.Multiplexed,
+		})
+	}
+	res := &spannerpb.BatchCreateSessionsResponse{
+		Session: sessions,
+	}
+	return res, nil
+}
+
+func (s *TestServer) ExecuteStreamingSql(req *spannerpb.ExecuteSqlRequest, stream spannerpb.Spanner_ExecuteStreamingSqlServer) error {
+	q := strings.TrimSpace(strings.ToLower(req.GetSql()))
+	parts := strings.Split(q, " ")
+	if len(parts) != 2 || parts[0] != "select" {
+		return trace.BadParameter("test server only supports basic select statement")
+	}
+	_, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return trace.BadParameter("test server only supports selecting an int64")
+	}
+
+	return stream.Send(&spannerpb.PartialResultSet{
+		Metadata: &spannerpb.ResultSetMetadata{
+			RowType: &spannerpb.StructType{
+				Fields: []*spannerpb.StructType_Field{{
+					Name: "", // no column name
+					Type: &spannerpb.Type{
+						Code: spannerpb.TypeCode_INT64,
+					},
+				}},
+			},
+		},
+		Values: []*structpb.Value{
+			// integers get encoded as a string in base 10.
+			structpb.NewStringValue(parts[1]),
+		},
+	})
+}
diff --git a/lib/srv/db/spanner_test.go b/lib/srv/db/spanner_test.go
index 9b43b005abd75..5f52192f95348 100644
--- a/lib/srv/db/spanner_test.go
+++ b/lib/srv/db/spanner_test.go
@@ -27,15 +27,15 @@ import (
 	"time"
 
 	gspanner "cloud.google.com/go/spanner"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/connectivity"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/defaults"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/srv/db/common"
-	"github.com/gravitational/teleport/lib/srv/db/spanner"
+	spanner "github.com/gravitational/teleport/lib/srv/db/spanner/testing"
 )
 
 func TestAccessSpanner(t *testing.T) {
@@ -207,7 +207,7 @@ func TestAccessSpanner(t *testing.T) {
 }
 
 func TestAuditSpanner(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	const dbServiceName = "my-spanner"
 	testCtx := setupTestContext(ctx, t, withSpanner(dbServiceName, cloudSpannerAuthToken, func(db *types.DatabaseV3) {
 		db.SetStaticLabels(map[string]string{"foo": "bar"})
@@ -223,6 +223,7 @@ func TestAuditSpanner(t *testing.T) {
 	testCtx.createUserAndRole(ctx, t, userName, roleName, []string{allowedUser}, []string{types.Wildcard})
 
 	t.Run("access denied", func(t *testing.T) {
+		ctx := t.Context()
 		// authz isn't checked until RPCs are sent, so we can't fail here.
 		clt, localProxy, err := testCtx.spannerClient(ctx, userName, dbServiceName, deniedUser, "googlesql")
 		require.NoError(t, err)
@@ -231,53 +232,47 @@ func TestAuditSpanner(t *testing.T) {
 			_ = localProxy.Close()
 		})
 
-		require.NoError(t, clt.WaitForConnectionState(ctx, connectivity.Ready))
-		reconnectingCh := make(chan bool)
-		go func() {
-			// we should observe the connection leave the "ready" state after
-			// it gets an access denied error.
-			ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-			defer cancel()
-			reconnectingCh <- clt.ClientConn.WaitForStateChange(ctx, connectivity.Ready)
-		}()
-
-		row, err := pingSpanner(ctx, clt, 42)
-		require.Error(t, err)
-		require.ErrorContains(t, err, "access to db denied")
-		require.Nil(t, row)
-
-		ev := requireEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
-		dbStart1, ok := ev.(*events.DatabaseSessionStart)
-		require.True(t, ok)
-		require.Equal(t, "googlesql", dbStart1.DatabaseName)
-
-		require.True(t, <-reconnectingCh, "timed out waiting for the spanner client to reconnect")
-		row, err = pingSpanner(ctx, clt, 42)
-		require.Error(t, err)
-		require.ErrorContains(t, err, "access to db denied")
-		require.Nil(t, row)
+		sessionIDs := map[string]struct{}{}
+		for range 3 {
+			var startEvt *events.DatabaseSessionStart
+			require.EventuallyWithT(t, func(t *assert.CollectT) {
+				row, err := pingSpanner(ctx, clt, 42)
+				require.Error(t, err)
+				require.ErrorContains(t, err, "access to db denied")
+				require.Nil(t, row)
 
-		ev = requireEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
-		dbStart2, ok := ev.(*events.DatabaseSessionStart)
-		require.True(t, ok)
-		require.Equal(t, "googlesql", dbStart2.DatabaseName)
+				ev := requireEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
+				var ok bool
+				startEvt, ok = ev.(*events.DatabaseSessionStart)
+				require.True(t, ok)
+				require.Equal(t, "googlesql", startEvt.DatabaseName)
+			}, 10*time.Second, 200*time.Millisecond, "waiting for session failure")
 
-		// session start failure is sticky and causes the connection to shut
-		// down - a client should get the same error but Teleport shouldnt emit
-		// another start event for the same session, i.e. the client should be
-		// forced to reconnect for subsequent RPC attempts
-		require.NotEqual(t, dbStart1.SessionID, dbStart2.SessionID)
+			// session start failure is sticky and causes the connection to shut
+			// down - a client should get the same error but Teleport shouldnt emit
+			// another start event for the same session, i.e. the client should be
+			// forced to reconnect for subsequent RPC attempts
+			require.NotContains(t, sessionIDs, startEvt.SessionID, "session start failure should only be emitted once per connection")
+			sessionIDs[startEvt.SessionID] = struct{}{}
+		}
 
 		// make sure no other events get emitted, including RPC failures, since
 		// a session was never started successfully.
-		select {
-		case evt := <-testCtx.emitter.C():
-			require.FailNow(t, "an unexpected audit event was emitted", "got an audit event with code %v", evt.GetCode())
-		case <-time.After(1 * time.Second):
+		for {
+			select {
+			case evt := <-testCtx.emitter.C():
+				if evt.GetCode() == libevents.DatabaseSessionStartFailureCode {
+					continue
+				}
+				require.FailNow(t, "an unexpected audit event was emitted", "got an audit event with code %v", evt.GetCode())
+			default:
+				return
+			}
 		}
 	})
 
 	t.Run("successful flow", func(t *testing.T) {
+		ctx := t.Context()
 		clt, localProxy, err := testCtx.spannerClient(ctx, userName, dbServiceName, allowedUser, "googlesql")
 		require.NoError(t, err)
 		t.Cleanup(func() {
@@ -298,15 +293,20 @@ func TestAuditSpanner(t *testing.T) {
 		require.True(t, ok)
 		require.Equal(t, "googlesql", startEvt.DatabaseName)
 
-		rpcEvt := requireSpannerRPCEvent(t, testCtx)
-		require.Equal(t, "BatchCreateSessions", rpcEvt.Procedure)
-		require.Equal(t, "googlesql", rpcEvt.DatabaseName)
-		require.Equal(t, startEvt.SessionID, rpcEvt.SessionID)
-
-		rpcEvt = requireSpannerRPCEvent(t, testCtx)
-		require.Equal(t, "ExecuteStreamingSql", rpcEvt.Procedure)
-		require.Equal(t, "googlesql", rpcEvt.DatabaseName)
-		require.Equal(t, startEvt.SessionID, rpcEvt.SessionID)
+		eventsByProcedure := map[string][]*events.SpannerRPC{}
+		for range 3 {
+			rpcEvt := requireSpannerRPCEvent(t, testCtx)
+			eventsByProcedure[rpcEvt.Procedure] = append(eventsByProcedure[rpcEvt.Procedure], rpcEvt)
+		}
+		require.Contains(t, eventsByProcedure, "BatchCreateSessions")
+		require.Contains(t, eventsByProcedure, "CreateSession")
+		require.Contains(t, eventsByProcedure, "ExecuteStreamingSql")
+		for name, rpcEvts := range eventsByProcedure {
+			require.Len(t, rpcEvts, 1)
+			rpcEvt := rpcEvts[0]
+			require.Equal(t, "googlesql", rpcEvt.DatabaseName, "RPC %v database name should match what was requested", name)
+			require.Equal(t, startEvt.SessionID, rpcEvt.SessionID, "RPC %v session ID should match the start event session ID", name)
+		}
 
 		// Client disconnects.
 		clt.Close()
diff --git a/lib/srv/db/sqlserver/connect.go b/lib/srv/db/sqlserver/connect.go
index 148ed588da1e8..7a449a1cbc3fd 100644
--- a/lib/srv/db/sqlserver/connect.go
+++ b/lib/srv/db/sqlserver/connect.go
@@ -32,7 +32,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/kerberos"
-	"github.com/gravitational/teleport/lib/srv/db/endpoints"
 	"github.com/gravitational/teleport/lib/srv/db/sqlserver/protocol"
 )
 
@@ -176,15 +175,3 @@ func getHostPort(db types.Database) (string, string, error) {
 	}
 	return host, port, nil
 }
-
-// NewEndpointsResolver returns an endpoint resolver.
-func NewEndpointsResolver(_ context.Context, db types.Database, _ endpoints.ResolverBuilderConfig) (endpoints.Resolver, error) {
-	host, port, err := getHostPort(db)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	addr := net.JoinHostPort(host, port)
-	return endpoints.ResolverFn(func(context.Context) ([]string, error) {
-		return []string{addr}, nil
-	}), nil
-}
diff --git a/lib/srv/db/sqlserver/engine.go b/lib/srv/db/sqlserver/engine.go
index 397933b58f036..2bc64a8d74a18 100644
--- a/lib/srv/db/sqlserver/engine.go
+++ b/lib/srv/db/sqlserver/engine.go
@@ -29,9 +29,9 @@ import (
 
 	"github.com/gravitational/teleport/api/types/events"
 	libevents "github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/kerberos"
+	"github.com/gravitational/teleport/lib/srv/db/common/role"
 	"github.com/gravitational/teleport/lib/srv/db/sqlserver/protocol"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -247,10 +247,12 @@ func (e *Engine) checkAccess(ctx context.Context, sessionCtx *common.Session) er
 	}
 
 	state := sessionCtx.GetAccessState(authPref)
-	err = sessionCtx.Checker.CheckAccess(sessionCtx.Database, state,
-		services.NewDatabaseUserMatcher(sessionCtx.Database, sessionCtx.DatabaseUser),
-	)
-	if err != nil {
+	matchers := role.GetDatabaseRoleMatchers(role.RoleMatchersConfig{
+		Database:     sessionCtx.Database,
+		DatabaseUser: sessionCtx.DatabaseUser,
+		DatabaseName: sessionCtx.DatabaseName,
+	})
+	if err = sessionCtx.Checker.CheckAccess(sessionCtx.Database, state, matchers...); err != nil {
 		e.Audit.OnSessionStart(e.Context, sessionCtx, err)
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/db/sqlserver/engine_test.go b/lib/srv/db/sqlserver/engine_test.go
index 968215095d877..8fd6a65266b1d 100644
--- a/lib/srv/db/sqlserver/engine_test.go
+++ b/lib/srv/db/sqlserver/engine_test.go
@@ -88,6 +88,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -114,6 +115,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -141,6 +143,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionQueryEvent,
@@ -180,6 +183,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionQueryEvent,
@@ -209,6 +213,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -240,6 +245,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -258,6 +264,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -276,6 +283,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
@@ -294,6 +302,7 @@ func TestHandleConnectionAuditEvents(t *testing.T) {
 						DatabaseService:  "dummy",
 						DatabaseURI:      "uri",
 						DatabaseProtocol: "test",
+						DatabaseLabels:   map[string]string{"env": "prod"},
 					},
 					Metadata: events.Metadata{
 						Type: libevents.DatabaseSessionSQLServerRPCRequestEvent,
diff --git a/lib/srv/db/sqlserver/healthcheck.go b/lib/srv/db/sqlserver/healthcheck.go
new file mode 100644
index 0000000000000..774a277fd3ae3
--- /dev/null
+++ b/lib/srv/db/sqlserver/healthcheck.go
@@ -0,0 +1,41 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package sqlserver
+
+import (
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/healthcheck"
+	"github.com/gravitational/teleport/lib/srv/db/healthchecks"
+)
+
+// NewHealthChecker returns an endpoint health checker.
+func NewHealthChecker(_ context.Context, cfg healthchecks.HealthCheckerConfig) (healthcheck.HealthChecker, error) {
+	host, port, err := getHostPort(cfg.Database)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	addr := net.JoinHostPort(host, port)
+	return healthcheck.NewTargetDialer(func(context.Context) ([]string, error) {
+		return []string{addr}, nil
+	}), nil
+}
diff --git a/lib/srv/db/sqlserver/test.go b/lib/srv/db/sqlserver/test.go
index 2973a2d1f4649..91b2a26c1f64f 100644
--- a/lib/srv/db/sqlserver/test.go
+++ b/lib/srv/db/sqlserver/test.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/sqlserver/protocol"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // MakeTestClient returns SQL Server client used in tests.
@@ -133,8 +134,7 @@ func NewTestServer(config common.TestServerConfig) (svr *TestServer, err error)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	log := utils.NewSlogLoggerForTests().With(
-		teleport.ComponentKey, defaults.ProtocolSQLServer,
+	log := logtest.With(teleport.ComponentKey, defaults.ProtocolSQLServer,
 		"name", config.Name,
 	)
 	server := &TestServer{
diff --git a/lib/srv/db/watcher.go b/lib/srv/db/watcher.go
index 036aee8952922..5aa56ae5db2d8 100644
--- a/lib/srv/db/watcher.go
+++ b/lib/srv/db/watcher.go
@@ -26,6 +26,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	discovery "github.com/gravitational/teleport/lib/srv/discovery/common"
@@ -117,7 +118,12 @@ func (s *Server) startCloudWatcher(ctx context.Context) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	azureFetchers, err := dbfetchers.MakeAzureFetchers(s.cfg.CloudClients, s.cfg.AzureMatchers, "" /* discovery config */)
+	azureFetchers, err := dbfetchers.MakeAzureFetchers(ctx, func(ctx context.Context, integration string) (azure.Clients, error) {
+		if integration != "" {
+			return nil, trace.NotImplemented("db_service discovery does not support Azure OIDC authentication; use discovery_service instead.")
+		}
+		return s.cfg.AzureClients, nil
+	}, s.cfg.AzureMatchers, "" /* discovery config */)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -199,6 +205,14 @@ func (s *Server) onUpdate(ctx context.Context, database, _ types.Database) error
 	if s.monitoredDatabases.isResource_Locked(database) {
 		s.applyAWSResourceMatcherSettings(databaseCopy)
 	}
+
+	// Run DiscoveryResourceChecker after resource matchers are applied to make
+	// sure the correct AssumeRoleARN is used.
+	if s.monitoredDatabases.isDiscoveryResource_Locked(database) {
+		if err := s.cfg.discoveryResourceChecker.Check(ctx, databaseCopy); err != nil {
+			return trace.Wrap(err)
+		}
+	}
 	return s.updateDatabase(ctx, databaseCopy)
 }
 
diff --git a/lib/srv/db/watcher_test.go b/lib/srv/db/watcher_test.go
index bf62e6469e8bc..3f05278c47be8 100644
--- a/lib/srv/db/watcher_test.go
+++ b/lib/srv/db/watcher_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql"
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	elasticache "github.com/aws/aws-sdk-go-v2/service/elasticache"
 	"github.com/aws/aws-sdk-go-v2/service/memorydb"
 	"github.com/aws/aws-sdk-go-v2/service/opensearch"
@@ -39,11 +40,13 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	clients "github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
@@ -119,6 +122,25 @@ func TestWatcher(t *testing.T) {
 	// Both should be registered now.
 	assertReconciledResource(t, reconcileCh, types.Databases{db0, db1, db2})
 
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		servers, err := testCtx.authServer.GetDatabaseServers(ctx, apidefaults.Namespace)
+		if !assert.NoError(t, err) {
+			return
+		}
+		if !assert.Len(t, servers, 3) {
+			return
+		}
+		if !assert.Equal(t, "db0", servers[0].GetName()) {
+			return
+		}
+		wantDBs := types.Databases(types.DatabaseServers(servers).ToDatabases()).ToMap()
+		for _, db := range []types.Database{db0, db1, db2} {
+			if !assert.Contains(t, wantDBs, db.GetName()) {
+				return
+			}
+		}
+	}, 10*time.Second, 100*time.Millisecond, "waiting for database heartbeats to be registered")
+
 	// Update db2 URI so it gets re-registered.
 	db2.SetURI("localhost:2345")
 	err = testCtx.authServer.UpdateDatabase(ctx, db2)
@@ -142,6 +164,19 @@ func TestWatcher(t *testing.T) {
 
 	// Only static database should remain.
 	assertReconciledResource(t, reconcileCh, types.Databases{db0})
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		servers, err := testCtx.authServer.GetDatabaseServers(ctx, apidefaults.Namespace)
+		if !assert.NoError(t, err) {
+			return
+		}
+		if !assert.Len(t, servers, 1) {
+			return
+		}
+		if !assert.Equal(t, "db0", servers[0].GetName()) {
+			return
+		}
+	}, 10*time.Second, 100*time.Millisecond, "waiting for database heartbeats to be cleaned up")
 }
 
 // TestWatcherDynamicResource tests dynamic resource registration where the
@@ -183,6 +218,9 @@ func TestWatcherDynamicResource(t *testing.T) {
 					return trace.BadParameter("bad db")
 				},
 				"db5": func(_ context.Context, db types.Database) error {
+					if db.GetURI() == "evil-llama.com" {
+						return trace.BadParameter("bad database URI")
+					}
 					// Validate AssumeRoleARN and ExternalID matches above
 					// services.ResourceMatcherAWS,
 					meta := db.GetAWS()
@@ -289,7 +327,7 @@ func TestWatcherDynamicResource(t *testing.T) {
 		assertReconciledResource(t, reconcileCh, types.Databases{db0, db2, db4, db5, db6})
 	})
 
-	t.Run("discovery resource - fail check", func(t *testing.T) {
+	t.Run("discovery resource - fail check on create", func(t *testing.T) {
 		// Created a discovery service created database resource that fails the
 		// fakeDiscoveryResourceChecker.
 		dbFailCheck, err := makeDiscoveryDatabase("db-fail-check", map[string]string{"group": "a"}, withRDSURL)
@@ -299,6 +337,15 @@ func TestWatcherDynamicResource(t *testing.T) {
 		// dbFailCheck should not be proxied.
 		assertReconciledResource(t, reconcileCh, types.Databases{db0, db2, db4, db5, db6})
 	})
+
+	t.Run("discovery resource - fail check on update", func(t *testing.T) {
+		badDB := db5.Copy()
+		badDB.SetURI("evil-llama.com")
+		err = testCtx.authServer.UpdateDatabase(ctx, badDB)
+		require.NoError(t, err)
+		// update is rejected for failed URI check.
+		assertReconciledResource(t, reconcileCh, types.Databases{db0, db2, db4, db5, db6})
+	})
 }
 
 func setDiscoveryTypeLabel(r types.ResourceWithLabels, matcherType string) {
@@ -368,7 +415,7 @@ func TestWatcherCloudFetchers(t *testing.T) {
 				ExternalID:    "external-id",
 			},
 		}},
-		CloudClients: &clients.TestCloudClients{
+		AzureClients: &azuretest.Clients{
 			AzureSQLServer: azure.NewSQLClientByAPI(&azure.ARMSQLServerMock{
 				AllServers: []*armsql.Server{azSQLServer},
 			}),
@@ -472,6 +519,7 @@ func makeAzureSQLServer(t *testing.T, name, group string) (*armsql.Server, types
 }
 
 type fakeAWSClients struct {
+	ec2Client        db.EC2Client
 	ecClient         db.ElastiCacheClient
 	mdbClient        db.MemoryDBClient
 	openSearchClient db.OpenSearchClient
@@ -480,6 +528,10 @@ type fakeAWSClients struct {
 	rssClient        db.RSSClient
 }
 
+func (f fakeAWSClients) GetEC2Client(cfg aws.Config, optFns ...func(*ec2.Options)) db.EC2Client {
+	return f.ec2Client
+}
+
 func (f fakeAWSClients) GetElastiCacheClient(cfg aws.Config, optFns ...func(*elasticache.Options)) db.ElastiCacheClient {
 	return f.ecClient
 }
diff --git a/lib/srv/desktop/audit.go b/lib/srv/desktop/audit.go
index 9310079b540c2..ce6b3122cfead 100644
--- a/lib/srv/desktop/audit.go
+++ b/lib/srv/desktop/audit.go
@@ -28,6 +28,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	libevents "github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -47,6 +48,7 @@ type desktopSessionAuditor struct {
 	clusterName        string
 	desktopServiceUUID string
 
+	compactor  auditCompactor
 	auditCache sharedDirectoryAuditCache
 }
 
@@ -75,17 +77,16 @@ func (s *WindowsService) newSessionAuditor(
 	return &desktopSessionAuditor{
 		clock: s.cfg.Clock,
 
-		sessionID:   sessionID,
-		identity:    identity,
-		windowsUser: windowsUser,
-		desktop:     desktop,
-		enableNLA:   s.enableNLA,
-
+		sessionID:          sessionID,
+		identity:           identity,
+		windowsUser:        windowsUser,
+		desktop:            desktop,
+		enableNLA:          s.enableNLA,
 		startTime:          s.cfg.Clock.Now().UTC().Round(time.Millisecond),
 		clusterName:        s.clusterName,
 		desktopServiceUUID: s.cfg.Heartbeat.HostUUID,
-
-		auditCache: newSharedDirectoryAuditCache(),
+		compactor:          newAuditCompactor(3*time.Second, 10*time.Second, s.emit),
+		auditCache:         newSharedDirectoryAuditCache(),
 	}
 }
 
@@ -100,6 +101,7 @@ func (d *desktopSessionAuditor) makeSessionStart(err error) *events.WindowsDeskt
 			ClusterName: d.clusterName,
 			Time:        d.startTime,
 		},
+		CertMetadata:          new(events.WindowsCertificateMetadata),
 		UserMetadata:          userMetadata,
 		SessionMetadata:       d.getSessionMetadata(),
 		ConnectionMetadata:    d.getConnectionMetadata(),
@@ -122,6 +124,10 @@ func (d *desktopSessionAuditor) makeSessionStart(err error) *events.WindowsDeskt
 	return event
 }
 
+func (d *desktopSessionAuditor) teardown(ctx context.Context) {
+	d.compactor.flush(ctx)
+}
+
 func (d *desktopSessionAuditor) makeSessionEnd(recorded bool) *events.WindowsDesktopSessionEnd {
 	userMetadata := d.identity.GetUserMetadata()
 	userMetadata.Login = d.windowsUser
@@ -134,6 +140,7 @@ func (d *desktopSessionAuditor) makeSessionEnd(recorded bool) *events.WindowsDes
 		},
 		UserMetadata:          userMetadata,
 		SessionMetadata:       d.getSessionMetadata(),
+		ConnectionMetadata:    d.getConnectionMetadata(),
 		WindowsDesktopService: d.desktopServiceUUID,
 		DesktopAddr:           d.desktop.GetAddr(),
 		Domain:                d.desktop.GetDomain(),
@@ -145,7 +152,14 @@ func (d *desktopSessionAuditor) makeSessionEnd(recorded bool) *events.WindowsDes
 		Recorded:              recorded,
 
 		// There can only be 1 participant, desktop sessions are not join-able.
-		Participants: []string{userMetadata.User},
+		Participants: []string{
+			services.UsernameForCluster(
+				services.UsernameForClusterConfig{
+					User:              d.identity.Username,
+					OriginClusterName: d.identity.OriginClusterName,
+					LocalClusterName:  d.clusterName,
+				},
+			)},
 	}
 }
 
@@ -162,6 +176,7 @@ func (d *desktopSessionAuditor) makeClipboardSend(length int32) *events.DesktopC
 		ConnectionMetadata: d.getConnectionMetadata(),
 		DesktopAddr:        d.desktop.GetAddr(),
 		Length:             length,
+		DesktopName:        d.desktop.GetName(),
 	}
 }
 
@@ -178,6 +193,7 @@ func (d *desktopSessionAuditor) makeClipboardReceive(length int32) *events.Deskt
 		ConnectionMetadata: d.getConnectionMetadata(),
 		DesktopAddr:        d.desktop.GetAddr(),
 		Length:             length,
+		DesktopName:        d.desktop.GetName(),
 	}
 }
 
@@ -213,6 +229,7 @@ func (d *desktopSessionAuditor) onSharedDirectoryAnnounce(m tdp.SharedDirectoryA
 		DesktopAddr:   d.desktop.GetAddr(),
 		DirectoryName: m.Name,
 		DirectoryID:   m.DirectoryID,
+		DesktopName:   d.desktop.GetName(),
 	}
 }
 
@@ -243,6 +260,7 @@ func (d *desktopSessionAuditor) makeSharedDirectoryStart(m tdp.SharedDirectoryAc
 		DesktopAddr:        d.desktop.GetAddr(),
 		DirectoryName:      string(name),
 		DirectoryID:        m.DirectoryID,
+		DesktopName:        d.desktop.GetName(),
 	}
 }
 
@@ -291,6 +309,7 @@ func (d *desktopSessionAuditor) onSharedDirectoryReadRequest(m tdp.SharedDirecto
 		Path:          path,
 		Length:        m.Length,
 		Offset:        offset,
+		DesktopName:   d.desktop.GetName(),
 	}
 }
 
@@ -343,6 +362,7 @@ func (d *desktopSessionAuditor) makeSharedDirectoryReadResponse(m tdp.SharedDire
 		Path:               path,
 		Length:             m.ReadDataLength,
 		Offset:             offset,
+		DesktopName:        d.desktop.GetName(),
 	}
 }
 
@@ -393,6 +413,7 @@ func (d *desktopSessionAuditor) onSharedDirectoryWriteRequest(m tdp.SharedDirect
 		Path:          path,
 		Length:        m.WriteDataLength,
 		Offset:        offset,
+		DesktopName:   d.desktop.GetName(),
 	}
 }
 
@@ -444,6 +465,7 @@ func (d *desktopSessionAuditor) makeSharedDirectoryWriteResponse(m tdp.SharedDir
 		Path:               path,
 		Length:             m.BytesWritten,
 		Offset:             offset,
+		DesktopName:        d.desktop.GetName(),
 	}
 }
 
diff --git a/lib/srv/desktop/audit_compactor.go b/lib/srv/desktop/audit_compactor.go
new file mode 100644
index 0000000000000..4618c08d7069f
--- /dev/null
+++ b/lib/srv/desktop/audit_compactor.go
@@ -0,0 +1,282 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package desktop
+
+import (
+	"context"
+	"iter"
+	"maps"
+	"math"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/gravitational/teleport/api/types/events"
+)
+
+// fileOperationsKey uniquely identifies a set of common file operations
+type fileOperationsKey struct {
+	path        string
+	directoryID directoryID
+	write       bool
+}
+
+// fileOperationEvent is an abstraction of read/write events
+// so that we need only one compactor implementation.
+type fileOperationEvent interface {
+	Base() events.AuditEvent
+	IsWriteEvent() bool
+	GetDirectoryID() directoryID
+	GetPath() string
+	GetOffset() uint64
+	GetLength() uint64
+	SetLength(uint64)
+}
+
+// fileOperationsBucket identifies a set of reads/writes
+// to a particular file within some period of time.
+type fileOperationsBucket struct {
+	expireTime time.Time
+	events     []fileOperationEvent
+	timer      *time.Timer
+	done       chan struct{}
+}
+
+// auditCompactor retains read and write events to a given file for a period of time before
+// emitting them to the audit log. Once the timeout period expires, contiguous read/write events are
+// compacted into a single audit event and emitted.
+type auditCompactor struct {
+	// refreshInterval defines how long a bucket should wait for a subsequent
+	// file operation to arrive before compacting and emitting its audit event(s).
+	refreshInterval time.Duration
+	// maxDelayInterval defines the maximum length of time that a bucket should wait
+	// before before compacting and emitting its audit event(s)
+	// this prevents a slow trickle of read/write events within the refreshInterval from
+	// indefinitely delaying audit events from being emitted.
+	maxDelayInterval time.Duration
+	emitFn           func(context.Context, events.AuditEvent)
+	buckets          map[fileOperationsKey]*fileOperationsBucket
+	bucketsLock      sync.Mutex
+}
+
+func newAuditCompactor(refreshInterval, maxDelayInterval time.Duration, emitFn func(context.Context, events.AuditEvent)) auditCompactor {
+	return auditCompactor{
+		refreshInterval:  refreshInterval,
+		maxDelayInterval: maxDelayInterval,
+		emitFn:           emitFn,
+		buckets:          map[fileOperationsKey]*fileOperationsBucket{},
+	}
+}
+
+func (s *fileOperationsBucket) emitEvents(ctx context.Context, emitFn func(ctx context.Context, event events.AuditEvent)) {
+	for event := range s.compactEvents() {
+		emitFn(ctx, event.Base())
+	}
+}
+
+func (s *fileOperationsBucket) compactEvents() iter.Seq[fileOperationEvent] {
+	offsetMapping := map[uint64][]fileOperationEvent{}
+	for _, event := range s.events {
+		offsetMapping[event.GetOffset()] = append(offsetMapping[event.GetOffset()], event)
+	}
+
+	var finalEvents []fileOperationEvent
+	for len(offsetMapping) > 0 {
+		// Find the read/write event with the lowest offset
+		// so that we may greedily search for the longest
+		// contiguous segment we can produce.
+		smallestKey := slices.Min(slices.Collect(maps.Keys(offsetMapping)))
+		// The audit event at which we will begin our search.
+		event := offsetMapping[smallestKey][0]
+		// compact returns the longest slice of contiguous read/write audit events.
+		// It always a slice of at least length 1, containing the starting event.
+		sequentialEvents, sequenceLength := s.compact(event, offsetMapping)
+		// base is the first event in the sequence. We will mutate this
+		// event with the updated length and emit it.
+		base := sequentialEvents[0]
+
+		// Remove each event in this sequence from the map
+		for _, subsequent := range sequentialEvents {
+			offset := subsequent.GetOffset()
+			events := offsetMapping[offset]
+			deleteIdx := slices.Index(events, subsequent)
+			events = slices.Delete(events, deleteIdx, deleteIdx+1)
+			if len(events) > 0 {
+				offsetMapping[offset] = events
+			} else {
+				delete(offsetMapping, offset)
+			}
+		}
+		base.SetLength(sequenceLength)
+		finalEvents = append(finalEvents, base)
+	}
+
+	return slices.Values(finalEvents)
+}
+
+// compact finds the longest contiguous set of reads/writes following the given 'event'.
+func (s *fileOperationsBucket) compact(event fileOperationEvent, eventsByOffset map[uint64][]fileOperationEvent) ([]fileOperationEvent, uint64) {
+	eventLength := event.GetLength()
+	// Determine the offset at which the next contiguous segment must start.
+	offset := event.GetOffset() + eventLength
+	// Consult the map for any events with this offset.
+	// Skip events with length 0
+	if eventLength > 0 && len(eventsByOffset[offset]) > 0 {
+		// There may be multiple candidate segments to follow.
+		// Try each of them out and select the longest contiguous set of segments
+		var winner []fileOperationEvent
+		var maxLength uint64
+		for _, choice := range eventsByOffset[offset] {
+			// TODO: We could probably speed this up with memoization/dynamic programmming,
+			// but this code is fairly readable as-is and it's probably not likely that
+			// we'll end up with too many possible paths in production.
+			// Recursively evaluate each option.
+			option, length := s.compact(choice, eventsByOffset)
+			if length > maxLength {
+				winner = option
+				maxLength = length
+			}
+		}
+		return append([]fileOperationEvent{event}, winner...), maxLength + event.GetLength()
+	}
+	return []fileOperationEvent{event}, event.GetLength()
+}
+
+func (s *fileOperationsBucket) addEvent(event fileOperationEvent) {
+	s.events = append(s.events, event)
+}
+
+func (a *auditCompactor) handleEvent(ctx context.Context, event fileOperationEvent) {
+	// File Operations are grouped by directoryID, path, and read vs write
+	key := fileOperationsKey{
+		write:       event.IsWriteEvent(),
+		directoryID: event.GetDirectoryID(),
+		path:        event.GetPath(),
+	}
+
+	newBucket := true
+	a.bucketsLock.Lock()
+	defer a.bucketsLock.Unlock()
+
+	if bucket, exists := a.buckets[key]; exists {
+		// We're currently tracking this bucket
+		// Temporarily stop the timer (if possible)
+		alreadyFired := !bucket.timer.Stop()
+		if !alreadyFired {
+			// Update the current bucket. It is a continuation of the current bucket
+			// and the timer has not yet fired for it.
+			bucket.addEvent(event)
+			// Reset the timer either to the refresh interval, or until
+			// the buckets's expiration time
+			bucket.timer.Reset(time.Duration(math.Min(float64(a.refreshInterval), float64(time.Until(bucket.expireTime)))))
+			newBucket = false
+		} else {
+			// The timer has already fired. Stop tracking this bucket.
+			// A new bucket will be created below to handle this event.
+			delete(a.buckets, key)
+		}
+	}
+
+	// We need to create a new bucket due to one of the following:
+	//   - We are not tracking any such bucket yet.
+	//   - We were tracking this bucket but the timer has already fired.
+	if newBucket {
+		bucket := &fileOperationsBucket{
+			done:       make(chan struct{}),
+			expireTime: time.Now().Add(a.maxDelayInterval),
+			events:     []fileOperationEvent{event},
+		}
+		bucket.timer = time.AfterFunc(a.refreshInterval, func() {
+			// Close done channel so that the 'flush' function can
+			// verify that this goroutine has completed its work.
+			defer close(bucket.done)
+			a.bucketsLock.Lock()
+			delete(a.buckets, key)
+			a.bucketsLock.Unlock()
+			bucket.emitEvents(ctx, a.emitFn)
+
+		})
+		a.buckets[key] = bucket
+	}
+}
+
+// flush immediately compacts and emits audit events for all
+// unexpired buckets and blocks until completion.
+func (a *auditCompactor) flush(ctx context.Context) {
+	a.bucketsLock.Lock()
+	wait := []chan struct{}{}
+	for bucketKey, bucket := range a.buckets {
+		if bucket.timer.Stop() {
+			// If we successfully stop the timer before it fires,
+			// go ahead and emit the audit event.
+			bucket.emitEvents(ctx, a.emitFn)
+			delete(a.buckets, bucketKey)
+		} else {
+			// The timer was already firing, so wait until
+			// the emitFn as been executed by the underlying goroutine.
+			wait = append(wait, bucket.done)
+		}
+	}
+	// Unlock so that we may unblock timer functions.
+	a.bucketsLock.Unlock()
+	// Wait for pending timers to complete
+	// We use our own "done" channel rather than the timer's
+	// because we need to know that the timer's underlying goroutine.
+	for _, doneChan := range wait {
+		<-doneChan
+	}
+}
+
+// Adapters for current read/write audit events.
+
+type readEvent struct {
+	*events.DesktopSharedDirectoryRead
+}
+
+func toUint32(len uint64) uint32 {
+	return uint32(min(math.MaxUint32, len))
+}
+
+func (r *readEvent) SetLength(len uint64)        { r.Length = toUint32(len) }
+func (r *readEvent) GetLength() uint64           { return uint64(r.Length) }
+func (r *readEvent) GetOffset() uint64           { return r.Offset }
+func (r *readEvent) GetPath() string             { return r.Path }
+func (r *readEvent) IsWriteEvent() bool          { return true }
+func (r *readEvent) GetDirectoryID() directoryID { return directoryID(r.DirectoryID) }
+func (r *readEvent) Base() events.AuditEvent     { return r.DesktopSharedDirectoryRead }
+
+type writeEvent struct {
+	*events.DesktopSharedDirectoryWrite
+}
+
+func (r *writeEvent) SetLength(len uint64)        { r.Length = toUint32(len) }
+func (r *writeEvent) GetLength() uint64           { return uint64(r.Length) }
+func (r *writeEvent) GetOffset() uint64           { return r.Offset }
+func (r *writeEvent) GetPath() string             { return r.Path }
+func (r *writeEvent) IsWriteEvent() bool          { return false }
+func (r *writeEvent) GetDirectoryID() directoryID { return directoryID(r.DirectoryID) }
+func (r *writeEvent) Base() events.AuditEvent     { return r.DesktopSharedDirectoryWrite }
+
+func (a *auditCompactor) handleRead(ctx context.Context, event *events.DesktopSharedDirectoryRead) {
+	a.handleEvent(ctx, &readEvent{DesktopSharedDirectoryRead: event})
+}
+
+func (a *auditCompactor) handleWrite(ctx context.Context, event *events.DesktopSharedDirectoryWrite) {
+	a.handleEvent(ctx, &writeEvent{DesktopSharedDirectoryWrite: event})
+}
diff --git a/lib/srv/desktop/audit_compactor_test.go b/lib/srv/desktop/audit_compactor_test.go
new file mode 100644
index 0000000000000..1f3d4d6e8e3ce
--- /dev/null
+++ b/lib/srv/desktop/audit_compactor_test.go
@@ -0,0 +1,300 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package desktop
+
+import (
+	"context"
+	"math"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func newReadEvent(path string, directory directoryID, offset uint64, length uint32) *events.DesktopSharedDirectoryRead {
+	return &events.DesktopSharedDirectoryRead{
+		Path:        path,
+		DirectoryID: uint32(directory),
+		Offset:      offset,
+		Length:      length,
+	}
+}
+
+func newWriteEvent(path string, directory directoryID, offset uint64, length uint32) *events.DesktopSharedDirectoryWrite {
+	return &events.DesktopSharedDirectoryWrite{
+		Path:        path,
+		DirectoryID: uint32(directory),
+		Offset:      offset,
+		Length:      length,
+	}
+}
+
+func TestAuditCompactor(t *testing.T) {
+	auditEvents := []events.AuditEvent{}
+	eventsLock := sync.Mutex{}
+	const refreshInterval = 1 * time.Second
+	const maxDelayInterval = 3 * time.Second
+	compactor := &auditCompactor{
+		refreshInterval:  refreshInterval,
+		maxDelayInterval: maxDelayInterval,
+		emitFn: func(_ context.Context, event events.AuditEvent) {
+			eventsLock.Lock()
+			defer eventsLock.Unlock()
+			auditEvents = append(auditEvents, event)
+		},
+		buckets: map[fileOperationsKey]*fileOperationsBucket{},
+	}
+
+	t.Run("basic", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// Read sequence A
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 200, 100))
+			// Read sequence B
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			// Read sequence A continued
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 300, 200))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 500, 50))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 550, 90))
+
+			compactor.flush(ctx)
+			require.Len(t, auditEvents, 2)
+			// Should be compacted to 2 audit events
+			// Once compacted, audit events should inherit the timestamp of
+			// the first event in the stream
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 640))
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 200))
+		})
+
+	})
+
+	t.Run("overflow", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// Walk up to and beyond MaxUint32
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, math.MaxUint32-1))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, math.MaxUint32-1, 1))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, math.MaxUint32, 1))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, math.MaxUint32+1, 1))
+
+			compactor.flush(ctx)
+			require.Len(t, auditEvents, 1)
+			// We should emit a single audit event with the largest length that we can represent
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, math.MaxUint32))
+		})
+	})
+
+	t.Run("zero-length-event", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// Create two read events with zero length, but with differing
+			// error codes. Neither should get compacted, as zero length
+			// events are not eligible for compaction.
+			firstEvent := newReadEvent("foo", 1, 0, 0)
+			firstEvent.Error = "some error"
+
+			secondEvent := newReadEvent("foo", 1, 0, 0)
+			secondEvent.Error = "another error"
+
+			compactor.handleRead(ctx, firstEvent)
+			compactor.handleRead(ctx, secondEvent)
+
+			compactor.flush(ctx)
+			// events with length zero should be ignored (not compacted)
+			require.Len(t, auditEvents, 2)
+			assert.Contains(t, auditEvents, firstEvent)
+			assert.Contains(t, auditEvents, secondEvent)
+		})
+	})
+
+	t.Run("complex", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// Three separate reads (with different lengths) of the same file
+			// Read sequence A
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 200, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 300, 50))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 350, 75))
+
+			// Read sequence B
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 200, 150))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 350, 400))
+
+			// Read sequence C (does not start at 0)
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 200, 500))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 700, 500))
+
+			compactor.flush(ctx)
+			require.Len(t, auditEvents, 3)
+			// Should be compacted to 3 audit events
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 100, 325))
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 750))
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 1200))
+		})
+
+	})
+
+	t.Run("expirations", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// 2 sequential reads
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			time.Sleep(refreshInterval - time.Millisecond)
+			synctest.Wait()
+
+			// Should not be emitted yet refresh interval has not been exceeded
+			eventsLock.Lock()
+			assert.Empty(t, auditEvents)
+			eventsLock.Unlock()
+
+			// Complete the refreshInterval and we should have an event available
+			time.Sleep(time.Millisecond)
+			synctest.Wait()
+			eventsLock.Lock()
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 200))
+			eventsLock.Unlock()
+
+			// Continue submitting events just before the refresh interval.
+			// Not audit event should be submitted until maxDelayInterval is reached
+			auditEvents = auditEvents[:0]
+			var elapsedTime time.Duration
+			offset := uint64(200)
+			const length = uint32(100)
+
+			count := 0
+			for elapsedTime < maxDelayInterval {
+				compactor.handleRead(ctx, newReadEvent("foo", 1, offset, length))
+				time.Sleep(refreshInterval - time.Millisecond)
+				synctest.Wait()
+				elapsedTime += refreshInterval - time.Millisecond
+				offset += uint64(length)
+				count++
+			}
+			// maxDelay should be exeeded by now and we should have
+			// a single consolidated event
+			eventsLock.Lock()
+			require.Len(t, auditEvents, 1)
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 200, length*uint32(count)))
+			eventsLock.Unlock()
+
+		})
+
+	})
+
+	t.Run("mix-reads-writes", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// 3 sequential reads
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 200, 100))
+			// same file and directory, and looks sequential, but it's a write
+			compactor.handleWrite(ctx, newWriteEvent("foo", 1, 300, 50))
+			compactor.handleWrite(ctx, newWriteEvent("foo", 1, 350, 50))
+
+			compactor.flush(ctx)
+			require.Len(t, auditEvents, 2)
+			// Should be compacted to 2 audit events
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 300))
+			assert.Contains(t, auditEvents, newWriteEvent("foo", 1, 300, 100))
+		})
+	})
+
+	t.Run("mix-files-and-directories", func(t *testing.T) {
+		auditEvents = auditEvents[:0]
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			// Identical offsets and lengths, but different path and/or directoryID
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 2, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("bar", 1, 0, 100))
+
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("foo", 2, 100, 100))
+			compactor.handleRead(ctx, newReadEvent("bar", 1, 100, 100))
+
+			compactor.flush(ctx)
+			require.Len(t, auditEvents, 3)
+			// Should be compacted to 3 audit events
+			assert.Contains(t, auditEvents, newReadEvent("foo", 1, 0, 200))
+			assert.Contains(t, auditEvents, newReadEvent("foo", 2, 0, 200))
+			assert.Contains(t, auditEvents, newReadEvent("bar", 1, 0, 200))
+		})
+
+	})
+
+	t.Run("racy-flush", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			ctx := t.Context()
+			auditEvents := make(chan events.AuditEvent)
+			compactor.emitFn = func(_ context.Context, ae events.AuditEvent) {
+				auditEvents <- ae
+			}
+			// Identical offsets and lengths, but different path and/or directoryID
+			compactor.handleRead(ctx, newReadEvent("foo", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("bar", 1, 0, 100))
+			compactor.handleRead(ctx, newReadEvent("baz", 1, 0, 100))
+			time.Sleep(refreshInterval - 1*time.Nanosecond)
+			compactor.handleRead(ctx, newReadEvent("caz", 1, 0, 100))
+
+			// Timers should start firing
+			time.Sleep(1 * time.Nanosecond)
+			synctest.Wait()
+
+			flushDone := false
+			go func() {
+				compactor.flush(ctx)
+				flushDone = true
+			}()
+
+			expectedEvents := []events.AuditEvent{
+				newReadEvent("foo", 1, 0, 100),
+				newReadEvent("bar", 1, 0, 100),
+				newReadEvent("baz", 1, 0, 100),
+				newReadEvent("caz", 1, 0, 100),
+			}
+			for range len(expectedEvents) {
+				assert.False(t, flushDone)
+				assert.Contains(t, expectedEvents, <-auditEvents)
+				synctest.Wait()
+			}
+			assert.True(t, flushDone)
+		})
+	})
+}
diff --git a/lib/srv/desktop/audit_test.go b/lib/srv/desktop/audit_test.go
index bae777676ed1c..5dfdecbb038c2 100644
--- a/lib/srv/desktop/audit_test.go
+++ b/lib/srv/desktop/audit_test.go
@@ -80,10 +80,11 @@ func setup(desktop types.WindowsDesktop) (*tlsca.Identity, *desktopSessionAudito
 	}
 
 	id := &tlsca.Identity{
-		Username:     "foo",
-		Impersonator: "bar",
-		MFAVerified:  "mfa-id",
-		LoginIP:      "127.0.0.1",
+		Username:        "foo",
+		Impersonator:    "bar",
+		MFAVerified:     "mfa-id",
+		LoginIP:         "127.0.0.1",
+		TeleportCluster: s.clusterName,
 	}
 
 	d := &desktopSessionAuditor{
@@ -105,7 +106,6 @@ func setup(desktop types.WindowsDesktop) (*tlsca.Identity, *desktopSessionAudito
 }
 
 func TestSessionStartEvent(t *testing.T) {
-
 	id, audit := setup(testDesktop)
 
 	userMeta := id.GetUserMetadata()
@@ -127,6 +127,7 @@ func TestSessionStartEvent(t *testing.T) {
 			RemoteAddr: testDesktop.GetAddr(),
 			Protocol:   libevents.EventProtocolTDP,
 		},
+		CertMetadata: new(events.WindowsCertificateMetadata),
 		Status: events.Status{
 			Success: true,
 		},
@@ -169,7 +170,6 @@ func TestSessionStartEvent(t *testing.T) {
 }
 
 func TestSessionEndEvent(t *testing.T) {
-
 	id, audit := setup(testDesktop)
 
 	audit.clock.(*clockwork.FakeClock).Advance(30 * time.Second)
@@ -189,6 +189,11 @@ func TestSessionEndEvent(t *testing.T) {
 			SessionID: "sessionID",
 			WithMFA:   id.MFAVerified,
 		},
+		ConnectionMetadata: events.ConnectionMetadata{
+			LocalAddr:  id.LoginIP,
+			RemoteAddr: testDesktop.GetAddr(),
+			Protocol:   libevents.EventProtocolTDP,
+		},
 		WindowsDesktopService: audit.desktopServiceUUID,
 		DesktopAddr:           testDesktop.GetAddr(),
 		Domain:                testDesktop.GetDomain(),
@@ -283,6 +288,7 @@ func TestDesktopSharedDirectoryStartEvent(t *testing.T) {
 				DesktopAddr:   audit.desktop.GetAddr(),
 				DirectoryName: testDirName,
 				DirectoryID:   uint32(testDirectoryID),
+				DesktopName:   audit.desktop.GetName(),
 			}
 
 			expected := test.expected(baseEvent)
@@ -433,6 +439,7 @@ func TestDesktopSharedDirectoryReadEvent(t *testing.T) {
 				Path:          testFilePath,
 				Length:        testLength,
 				Offset:        testOffset,
+				DesktopName:   audit.desktop.GetName(),
 			}
 
 			require.Empty(t, cmp.Diff(test.expected(baseEvent), readEvent))
@@ -581,6 +588,7 @@ func TestDesktopSharedDirectoryWriteEvent(t *testing.T) {
 				Path:          testFilePath,
 				Length:        testLength,
 				Offset:        testOffset,
+				DesktopName:   audit.desktop.GetName(),
 			}
 
 			require.Empty(t, cmp.Diff(test.expected(baseEvent), writeEvent))
@@ -604,7 +612,6 @@ func fillReadRequestCache(cache *sharedDirectoryAuditCache, did directoryID) {
 // failed DesktopSharedDirectoryStart is emitted when the shared
 // directory audit cache is full.
 func TestDesktopSharedDirectoryStartEventAuditCacheMax(t *testing.T) {
-
 	id, audit := setup(testDesktop)
 
 	// Set the audit cache entry to the maximum allowable size
@@ -644,6 +651,7 @@ func TestDesktopSharedDirectoryStartEventAuditCacheMax(t *testing.T) {
 		DesktopAddr:   audit.desktop.GetAddr(),
 		DirectoryName: testDirName,
 		DirectoryID:   uint32(testDirectoryID),
+		DesktopName:   audit.desktop.GetName(),
 	}
 
 	require.Empty(t, cmp.Diff(expected, startEvent))
@@ -653,7 +661,6 @@ func TestDesktopSharedDirectoryStartEventAuditCacheMax(t *testing.T) {
 // failed DesktopSharedDirectoryRead is generated when the shared
 // directory audit cache is full.
 func TestDesktopSharedDirectoryReadEventAuditCacheMax(t *testing.T) {
-
 	id, audit := setup(testDesktop)
 
 	// Send a SharedDirectoryAnnounce
@@ -703,6 +710,7 @@ func TestDesktopSharedDirectoryReadEventAuditCacheMax(t *testing.T) {
 		Path:          testFilePath,
 		Length:        testLength,
 		Offset:        testOffset,
+		DesktopName:   audit.desktop.GetName(),
 	}
 
 	require.Empty(t, cmp.Diff(expected, readEvent))
@@ -712,7 +720,6 @@ func TestDesktopSharedDirectoryReadEventAuditCacheMax(t *testing.T) {
 // failed DesktopSharedDirectoryWrite is generated when the shared
 // directory audit cache is full.
 func TestDesktopSharedDirectoryWriteEventAuditCacheMax(t *testing.T) {
-
 	id, audit := setup(testDesktop)
 
 	audit.onSharedDirectoryAnnounce(tdp.SharedDirectoryAnnounce{
@@ -759,6 +766,7 @@ func TestDesktopSharedDirectoryWriteEventAuditCacheMax(t *testing.T) {
 		Path:          testFilePath,
 		Length:        testLength,
 		Offset:        testOffset,
+		DesktopName:   audit.desktop.GetName(),
 	}
 
 	require.Empty(t, cmp.Diff(expected, writeEvent))
diff --git a/lib/srv/desktop/discovery.go b/lib/srv/desktop/discovery.go
index 3ae2011128bff..e5646ce3fb0fb 100644
--- a/lib/srv/desktop/discovery.go
+++ b/lib/srv/desktop/discovery.go
@@ -37,7 +37,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/winpki"
 )
@@ -46,6 +45,10 @@ const (
 	// attrName is the name of an LDAP object.
 	attrName = "name"
 
+	// description is a description of an LDAP object.
+	attrDescription          = "description"
+	attrDescriptionMaxLength = 1024 // https://learn.microsoft.com/en-us/windows/win32/adschema/a-description
+
 	// attrCommonName is the common name of an LDAP object, or "CN".
 	attrCommonName = "cn"
 
@@ -66,20 +69,9 @@ const (
 
 	// attrDNSHostName is the DNS Host name of an LDAP object.
 	attrDNSHostName = "dNSHostName" // unusual capitalization is correct
-
-	// attrSAMAccountName is the SAM Account name of an LDAP object.
-	attrSAMAccountName = "sAMAccountName"
-
-	// attrSAMAccountType is the SAM Account type for an LDAP object.
-	attrSAMAccountType = "sAMAccountType"
 )
 
 const (
-	// AccountTypeUser is the SAM account type for user accounts.
-	// See https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype
-	// (SAM_USER_OBJECT)
-	AccountTypeUser = "805306368"
-
 	// ClassComputer is the object class for computers in Active Directory.
 	ClassComputer = "computer"
 
@@ -149,15 +141,18 @@ func (s *WindowsService) ldapSearchFilter(additionalFilters []string) string {
 
 // getDesktopsFromLDAP discovers Windows hosts via LDAP
 func (s *WindowsService) getDesktopsFromLDAP() map[string]types.WindowsDesktop {
-	// Check whether we've ever successfully initialized our LDAP client.
-	s.mu.Lock()
-	if !s.ldapInitialized {
-		s.cfg.Logger.DebugContext(s.closeCtx, "LDAP not ready, skipping discovery and attempting to reconnect")
-		s.mu.Unlock()
-		s.initializeLDAP()
+	tc, err := s.loadTLSConfigForLDAP()
+	if err != nil {
+		s.cfg.Logger.WarnContext(s.closeCtx, "could not request TLS certificate for LDAP discovery", "error", err)
 		return nil
 	}
-	s.mu.Unlock()
+
+	ldapClient, err := winpki.DialLDAP(s.closeCtx, s.getLDAPConfig(), tc)
+	if err != nil {
+		s.cfg.Logger.WarnContext(s.closeCtx, "could not dial LDAP server", "error", err)
+		return nil
+	}
+	defer ldapClient.Close()
 
 	result := make(map[string]types.WindowsDesktop)
 	for _, discoveryConfig := range s.cfg.Discovery {
@@ -168,18 +163,8 @@ func (s *WindowsService) getDesktopsFromLDAP() map[string]types.WindowsDesktop {
 		attrs = append(attrs, computerAttributes...)
 		attrs = append(attrs, discoveryConfig.LabelAttributes...)
 
-		entries, err := s.lc.ReadWithFilter(discoveryConfig.BaseDN, filter, attrs)
-		if trace.IsConnectionProblem(err) {
-			// If the connection was broken, re-initialize the LDAP client so that it's
-			// ready for the next reconcile loop. Return the last known set of desktops
-			// in this case, so that the reconciler doesn't delete the desktops it already
-			// knows about.
-			s.cfg.Logger.InfoContext(s.closeCtx, "LDAP connection error when searching for desktops, reinitializing client")
-			if err := s.initializeLDAP(); err != nil {
-				s.cfg.Logger.ErrorContext(s.closeCtx, "failed to reinitialize LDAP client, will retry on next reconcile", "error", err)
-			}
-			return s.lastDiscoveryResults
-		} else if err != nil {
+		entries, err := ldapClient.ReadWithFilter(discoveryConfig.BaseDN, filter, attrs)
+		if err != nil {
 			s.cfg.Logger.WarnContext(s.closeCtx, "could not discover Windows Desktops", "error", err)
 			return nil
 		}
@@ -259,6 +244,12 @@ func (s *WindowsService) lookupDesktop(ctx context.Context, hostname string) ([]
 	}
 
 	queryResolver := func(resolver *net.Resolver, resolverName string) chan []netip.Addr {
+		if resolver == nil {
+			ch := make(chan []netip.Addr)
+			close(ch)
+			return ch
+		}
+
 		ch := make(chan []netip.Addr, 1)
 		go func() {
 			tctx, cancel := context.WithTimeout(ctx, dnsQueryTimeout)
@@ -368,55 +359,73 @@ func (s *WindowsService) ldapEntryToWindowsDesktop(
 	// purge them if they stop being detected, and discovery of large Windows fleets can
 	// take a long time.
 	desktop.SetExpiry(s.cfg.Clock.Now().UTC().Add(apidefaults.ServerAnnounceTTL * 3))
+
+	description := entry.GetAttributeValue(attrDescription)
+	desktop.Metadata.Description = description[:min(len(description), attrDescriptionMaxLength)]
+
 	return desktop, nil
 }
 
 // startDynamicReconciler starts resource watcher and reconciler that registers/unregisters Windows desktops
-// according to the up-to-date list of dynamic Windows desktops resources.
-func (s *WindowsService) startDynamicReconciler(ctx context.Context) (*services.GenericWatcher[types.DynamicWindowsDesktop, readonly.DynamicWindowsDesktop], error) {
+// according to the up-to-date list of dynamic Windows desktop resources. The reconciler runs until the
+// provided context expires.
+func (s *WindowsService) startDynamicReconciler(ctx context.Context) error {
 	if len(s.cfg.ResourceMatchers) == 0 {
 		s.cfg.Logger.DebugContext(ctx, "Not starting dynamic desktop resource watcher.")
-		return nil, nil
-	}
-	s.cfg.Logger.DebugContext(ctx, "Starting dynamic desktop resource watcher.")
-	dynamicDesktopClient := s.cfg.AuthClient.DynamicDesktopClient()
-	watcher, err := services.NewDynamicWindowsDesktopWatcher(ctx, services.DynamicWindowsDesktopWatcherConfig{
-		DynamicWindowsDesktopGetter: dynamicDesktopClient,
-		ResourceWatcherConfig: services.ResourceWatcherConfig{
-			Component: teleport.ComponentWindowsDesktop,
-			Client:    s.cfg.AccessPoint,
-		},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil
 	}
+	// errCh is used to indicate whether the background reconciliation routine
+	// starts successfully
+	errCh := make(chan error)
 
-	currentResources := make(map[string]types.WindowsDesktop)
-	var newResources map[string]types.WindowsDesktop
-
-	reconciler, err := services.NewReconciler(services.ReconcilerConfig[types.WindowsDesktop]{
-		Matcher: func(desktop types.WindowsDesktop) bool {
-			return services.MatchResourceLabels(s.cfg.ResourceMatchers, desktop.GetAllLabels())
-		},
-		GetCurrentResources: func() map[string]types.WindowsDesktop {
-			return currentResources
-		},
-		GetNewResources: func() map[string]types.WindowsDesktop {
-			return newResources
-		},
-		OnCreate: s.upsertDesktop,
-		OnUpdate: s.updateDesktop,
-		OnDelete: s.deleteDesktop,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 	go func() {
-		defer s.cfg.Logger.DebugContext(ctx, "DynamicWindowsDesktop resource watcher done.")
+		s.cfg.Logger.DebugContext(ctx, "Starting dynamic desktop resource watcher.")
+		watcher, err := services.NewDynamicWindowsDesktopWatcher(ctx, services.DynamicWindowsDesktopWatcherConfig{
+			DynamicWindowsDesktopGetter: s.cfg.AccessPoint,
+			ResourceWatcherConfig: services.ResourceWatcherConfig{
+				Component: teleport.ComponentWindowsDesktop,
+				Client:    s.cfg.AccessPoint,
+			},
+		})
+		if err != nil {
+			errCh <- trace.Wrap(err)
+			return
+		}
+
 		defer watcher.Close()
+		defer s.cfg.Logger.DebugContext(ctx, "DynamicWindowsDesktop resource watcher done.")
+
+		currentResources := make(map[string]types.WindowsDesktop)
+		var newResources map[string]types.WindowsDesktop
+
+		reconciler, err := services.NewReconciler(services.ReconcilerConfig[types.WindowsDesktop]{
+			Matcher: func(desktop types.WindowsDesktop) bool {
+				return services.MatchResourceLabels(s.cfg.ResourceMatchers, desktop.GetAllLabels())
+			},
+			GetCurrentResources: func() map[string]types.WindowsDesktop { return currentResources },
+			GetNewResources:     func() map[string]types.WindowsDesktop { return newResources },
+			OnCreate:            s.upsertDesktop,
+			OnUpdate:            s.updateDesktop,
+			OnDelete:            s.deleteDesktop,
+		})
+		if err != nil {
+			errCh <- trace.Wrap(err)
+			return
+		}
+
+		// If we got here, the reconciler is running.
+		errCh <- nil
+
+		tickDuration := 5 * time.Minute
+		expiryDuration := tickDuration + 2*time.Minute
+
+		tick := s.cfg.Clock.NewTicker(tickDuration)
+		defer tick.Stop()
+
 		for {
 			select {
 			case desktops := <-watcher.ResourcesC:
+				start := s.cfg.Clock.Now()
 				newResources = make(map[string]types.WindowsDesktop)
 				for _, dynamicDesktop := range desktops {
 					desktop, err := s.toWindowsDesktop(dynamicDesktop)
@@ -424,6 +433,7 @@ func (s *WindowsService) startDynamicReconciler(ctx context.Context) (*services.
 						s.cfg.Logger.WarnContext(ctx, "Can't create desktop resource", "error", err)
 						continue
 					}
+					desktop.SetExpiry(s.cfg.Clock.Now().Add(expiryDuration))
 					newResources[dynamicDesktop.GetName()] = desktop
 				}
 				if err := reconciler.Reconcile(ctx); err != nil {
@@ -431,6 +441,20 @@ func (s *WindowsService) startDynamicReconciler(ctx context.Context) (*services.
 					continue
 				}
 				currentResources = newResources
+				s.cfg.Logger.DebugContext(ctx, "completed dynamic desktop reconciliation", "duration", s.cfg.Clock.Since(start), "count", len(newResources))
+			case <-tick.Chan():
+				start := s.cfg.Clock.Now()
+				newResources = make(map[string]types.WindowsDesktop)
+				for k, v := range currentResources {
+					newResources[k] = v.Copy()
+					newResources[k].SetExpiry(s.cfg.Clock.Now().Add(expiryDuration))
+				}
+				if err := reconciler.Reconcile(ctx); err != nil {
+					s.cfg.Logger.WarnContext(ctx, "Reconciliation failed, will retry", "error", err)
+					continue
+				}
+				currentResources = newResources
+				s.cfg.Logger.DebugContext(ctx, "completed dynamic desktop reconciliation", "duration", s.cfg.Clock.Since(start), "count", len(newResources))
 			case <-watcher.Done():
 				return
 			case <-ctx.Done():
@@ -438,15 +462,18 @@ func (s *WindowsService) startDynamicReconciler(ctx context.Context) (*services.
 			}
 		}
 	}()
-	return watcher, nil
+
+	return trace.Wrap(<-errCh, "could not start dynamic desktop reconciler")
 }
 
 func (s *WindowsService) toWindowsDesktop(dynamicDesktop types.DynamicWindowsDesktop) (*types.WindowsDesktopV3, error) {
 	width, height := dynamicDesktop.GetScreenSize()
+
 	desktopLabels := dynamicDesktop.GetAllLabels()
 	labels := make(map[string]string, len(desktopLabels)+1)
 	maps.Copy(labels, desktopLabels)
 	labels[types.OriginLabel] = types.OriginDynamic
+
 	return types.NewWindowsDesktopV3(dynamicDesktop.GetName(), labels, types.WindowsDesktopSpecV3{
 		Addr:   dynamicDesktop.GetAddr(),
 		Domain: dynamicDesktop.GetDomain(),
diff --git a/lib/srv/desktop/discovery_test.go b/lib/srv/desktop/discovery_test.go
index c96e3324babb7..b475a77f3d564 100644
--- a/lib/srv/desktop/discovery_test.go
+++ b/lib/srv/desktop/discovery_test.go
@@ -34,7 +34,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -150,8 +151,9 @@ func TestLabelsDomainControllers(t *testing.T) {
 func TestDNSErrors(t *testing.T) {
 	s := &WindowsService{
 		cfg: WindowsServiceConfig{
-			Logger: slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
-			Clock:  clockwork.NewRealClock(),
+			Logger:               slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
+			Clock:                clockwork.NewRealClock(),
+			ConnectedProxyGetter: reversetunnel.NewConnectedProxyGetter(),
 		},
 		dnsResolver: &net.Resolver{
 			PreferGo: true,
@@ -169,7 +171,7 @@ func TestDNSErrors(t *testing.T) {
 
 func TestDynamicWindowsDiscovery(t *testing.T) {
 	t.Parallel()
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: "test",
 		Dir:         t.TempDir(),
 	})
@@ -184,7 +186,7 @@ func TestDynamicWindowsDiscovery(t *testing.T) {
 		require.NoError(t, tlsServer.Close())
 	})
 
-	client, err := tlsServer.NewClient(auth.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
+	client, err := tlsServer.NewClient(authtest.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, client.Close())
@@ -226,10 +228,11 @@ func TestDynamicWindowsDiscovery(t *testing.T) {
 					Heartbeat: HeartbeatConfig{
 						HostUUID: "1234",
 					},
-					Logger:      slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
-					Clock:       clockwork.NewFakeClock(),
-					AuthClient:  client,
-					AccessPoint: client,
+					Logger:               slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
+					Clock:                clockwork.NewFakeClock(),
+					AuthClient:           client,
+					AccessPoint:          client,
+					ConnectedProxyGetter: reversetunnel.NewConnectedProxyGetter(),
 					ResourceMatchers: []services.ResourceMatcher{{
 						Labels: types.Labels{
 							"foo": {"bar"},
@@ -247,10 +250,9 @@ func TestDynamicWindowsDiscovery(t *testing.T) {
 					},
 				},
 			}
-			reconciler, err := s.startDynamicReconciler(ctx)
-			require.NoError(t, err)
+
+			require.NoError(t, s.startDynamicReconciler(t.Context()))
 			t.Cleanup(func() {
-				reconciler.Close()
 				require.NoError(t, authServer.AuthServer.DeleteAllWindowsDesktops(ctx))
 				var key string
 				for {
@@ -317,3 +319,84 @@ func TestDynamicWindowsDiscovery(t *testing.T) {
 		})
 	}
 }
+
+func TestDynamicWindowsDiscoveryExpiry(t *testing.T) {
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		ClusterName: "test",
+		Dir:         t.TempDir(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
+
+	tlsServer, err := authServer.NewTestTLSServer()
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
+
+	client, err := tlsServer.NewClient(authtest.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, client.Close()) })
+
+	dynamicWindowsClient := client.DynamicDesktopClient()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	clock := clockwork.NewFakeClock()
+	s := &WindowsService{
+		cfg: WindowsServiceConfig{
+			Heartbeat: HeartbeatConfig{
+				HostUUID: "1234",
+			},
+			Logger:      slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
+			Clock:       clock,
+			AuthClient:  client,
+			AccessPoint: client,
+			ResourceMatchers: []services.ResourceMatcher{{
+				Labels: types.Labels{
+					"foo": {"bar"},
+				},
+			}},
+		},
+		dnsResolver: &net.Resolver{
+			PreferGo: true,
+			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+				return nil, errors.New("this resolver always fails")
+			},
+		},
+	}
+
+	require.NoError(t, s.startDynamicReconciler(t.Context()))
+
+	desktop, err := types.NewDynamicWindowsDesktopV1("test", map[string]string{
+		"foo": "bar",
+	}, types.DynamicWindowsDesktopSpecV1{
+		Addr: "addr",
+	})
+	require.NoError(t, err)
+
+	_, err = dynamicWindowsClient.CreateDynamicWindowsDesktop(ctx, desktop)
+	require.NoError(t, err)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+		require.NoError(t, err)
+		require.Len(t, desktops, 1)
+		require.Equal(t, "test", desktops[0].GetName())
+	}, 5*time.Second, 50*time.Millisecond)
+
+	err = client.DeleteWindowsDesktop(ctx, s.cfg.Heartbeat.HostUUID, "test")
+	require.NoError(t, err)
+
+	desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.Empty(t, desktops)
+
+	clock.Advance(5 * time.Minute)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+		require.NoError(t, err)
+		require.Len(t, desktops, 1)
+		require.Equal(t, "test", desktops[0].GetName())
+	}, 5*time.Second, 50*time.Millisecond)
+}
diff --git a/lib/srv/desktop/rdp/rdpclient/.gitignore b/lib/srv/desktop/rdp/rdpclient/.gitignore
index 2af7a74b56535..66f2c965d6dc6 100644
--- a/lib/srv/desktop/rdp/rdpclient/.gitignore
+++ b/lib/srv/desktop/rdp/rdpclient/.gitignore
@@ -1 +1,2 @@
 /librdprs.h
+/librdpclient.h
diff --git a/lib/srv/desktop/rdp/rdpclient/build.rs b/lib/srv/desktop/rdp/rdpclient/build.rs
index 5c84d5f21d2b5..b79ca4d7bd259 100644
--- a/lib/srv/desktop/rdp/rdpclient/build.rs
+++ b/lib/srv/desktop/rdp/rdpclient/build.rs
@@ -14,11 +14,21 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+use std::time::SystemTime;
+
 fn main() {
+    let timestamp = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    let autogen_warning = format!("// Code generated by cbindgen at {timestamp}. DO NOT EDIT.");
+
     // the cwd of build scripts is the root of the crate.
     let bindings = cbindgen::Builder::new()
         .with_crate(".")
         .with_language(cbindgen::Language::C)
+        .with_autogen_warning(&autogen_warning)
         .generate()
         .unwrap();
 
@@ -31,5 +41,5 @@ fn main() {
     // target/arch-vendor-os/release/ so that the Go side can refer to it like
     // it refers to the .a, but the only way I found so far is to use
     // ${OUT_DIR}/../../ which isn't really guaranteed to work, afaict.
-    out.persist("librdprs.h").unwrap();
+    out.persist("librdpclient.h").unwrap();
 }
diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
index 0ad7b8d32fbfb..bbece70de9407 100644
--- a/lib/srv/desktop/rdp/rdpclient/client.go
+++ b/lib/srv/desktop/rdp/rdpclient/client.go
@@ -65,7 +65,7 @@ package rdpclient
 #cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
 #cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
 #cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm
-#include <librdprs.h>
+#include <librdpclient.h>
 */
 import "C"
 
@@ -190,9 +190,9 @@ func New(cfg Config) (*Client, error) {
 	return c, nil
 }
 
-// Run starts the rdp client and blocks until the client disconnects,
-// then ensures the cleanup is run.
-func (c *Client) Run(ctx context.Context) error {
+// Run starts the RDP client, using the provided user certificate and private key.
+// It blocks until the client disconnects, then ensures the cleanup is run.
+func (c *Client) Run(ctx context.Context, certDER, keyDER []byte) error {
 	// Create a handle to the client to pass to Rust.
 	// The handle is used to call back into this Client from Rust.
 	// Since the handle is created and deleted here, methods which
@@ -213,7 +213,7 @@ func (c *Client) Run(ctx context.Context) error {
 	rustRDPReturnCh := make(chan error, 1)
 	// Kick off rust RDP loop goroutine
 	go func() {
-		rustRDPReturnCh <- c.startRustRDP(ctx)
+		rustRDPReturnCh <- c.startRustRDP(ctx, certDER, keyDER)
 	}()
 
 	select {
@@ -253,8 +253,12 @@ func (c *Client) readClientSize() error {
 	for {
 		s, err := c.cfg.Conn.ReadClientScreenSpec()
 		if err != nil {
-			c.cfg.Logger.DebugContext(context.Background(), "Failed to read client screen spec", "error", err)
-			continue
+			if trace.IsBadParameter(err) {
+				c.cfg.Logger.DebugContext(context.Background(), "Failed to read client screen spec", "error", err)
+				continue
+			} else {
+				return err
+			}
 		}
 
 		if c.cfg.hasSizeOverride() {
@@ -287,17 +291,21 @@ func (c *Client) readClientSize() error {
 }
 
 func (c *Client) readClientKeyboardLayout() error {
+	msgType, err := c.cfg.Conn.NextMessageType()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if msgType != tdp.TypeClientKeyboardLayout {
+		c.cfg.Logger.DebugContext(context.Background(), "Client did not send keyboard layout")
+		return nil
+	}
 	msg, err := c.cfg.Conn.ReadMessage()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	k, ok := msg.(tdp.ClientKeyboardLayout)
 	if !ok {
-		c.cfg.Logger.DebugContext(context.Background(), "Client did not send keyboard layout")
-		if err := c.handleTDPInput(msg); err != nil {
-			return trace.Wrap(err)
-		}
-		return nil
+		return trace.BadParameter("Unexpected message %T", msg)
 	}
 	c.cfg.Logger.DebugContext(context.Background(), "Got RDP keyboard layout", "keyboard_layout", k.KeyboardLayout)
 	c.keyboardLayout = k.KeyboardLayout
@@ -308,15 +316,10 @@ func (c *Client) sendTDPAlert(message string, severity tdp.Severity) error {
 	return c.cfg.Conn.WriteMessage(tdp.Alert{Message: message, Severity: severity})
 }
 
-func (c *Client) startRustRDP(ctx context.Context) error {
+func (c *Client) startRustRDP(ctx context.Context, certDER, keyDER []byte) error {
 	c.cfg.Logger.InfoContext(ctx, "Rust RDP loop starting")
 	defer c.cfg.Logger.InfoContext(ctx, "Rust RDP loop finished")
 
-	userCertDER, userKeyDER, err := c.cfg.GenerateUserCert(ctx, c.username, c.cfg.CertTTL)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	// [username] need only be valid for the duration of
 	// C.client_run. It is copied on the Rust side and
 	// thus can be freed here.
@@ -341,14 +344,14 @@ func (c *Client) startRustRDP(ctx context.Context) error {
 	computerName := C.CString(c.cfg.ComputerName)
 	defer C.free(unsafe.Pointer(computerName))
 
-	cert_der, err := utils.UnsafeSliceData(userCertDER)
+	cert_der, err := utils.UnsafeSliceData(certDER)
 	if err != nil {
 		return trace.Wrap(err)
 	} else if cert_der == nil {
 		return trace.BadParameter("user cert was nil")
 	}
 
-	key_der, err := utils.UnsafeSliceData(userKeyDER)
+	key_der, err := utils.UnsafeSliceData(keyDER)
 	if err != nil {
 		return trace.Wrap(err)
 	} else if key_der == nil {
@@ -378,10 +381,10 @@ func (c *Client) startRustRDP(ctx context.Context) error {
 			go_computer_name: computerName,
 			go_kdc_addr:      kdcAddr,
 			// cert length and bytes.
-			cert_der_len: C.uint32_t(len(userCertDER)),
+			cert_der_len: C.uint32_t(len(certDER)),
 			cert_der:     (*C.uint8_t)(cert_der),
 			// key length and bytes.
-			key_der_len:             C.uint32_t(len(userKeyDER)),
+			key_der_len:             C.uint32_t(len(keyDER)),
 			key_der:                 (*C.uint8_t)(key_der),
 			screen_width:            C.uint16_t(c.requestedWidth),
 			screen_height:           C.uint16_t(c.requestedHeight),
@@ -493,7 +496,19 @@ func (c *Client) startInputStreaming(stopCh chan struct{}) error {
 			continue
 		}
 
-		c.UpdateClientActivity()
+		// If the message was due to user input, then we update client activity
+		// in order to refresh the client_idle_timeout checks.
+		//
+		// Note: we count some of the directory sharing messages as client activity
+		// because we don't want a session to be closed due to inactivity during a large
+		// file transfer.
+		switch msg.(type) {
+		case tdp.KeyboardButton, tdp.MouseMove, tdp.MouseButton, tdp.MouseWheel,
+			tdp.SharedDirectoryAnnounce, tdp.SharedDirectoryInfoResponse,
+			tdp.SharedDirectoryReadResponse, tdp.SharedDirectoryWriteResponse:
+
+			c.UpdateClientActivity()
+		}
 
 		if withheldResize != nil {
 			c.cfg.Logger.DebugContext(context.Background(), "Sending withheld screen size to client")
@@ -980,6 +995,13 @@ func cgo_handle_remote_copy(handle C.uintptr_t, data *C.uint8_t, length C.uint32
 // handleRemoteCopy is called from Rust when data is copied
 // on the remote desktop
 func (c *Client) handleRemoteCopy(data []byte) C.CGOErrCode {
+	// Ignore empty clipboard data to mitigate a part of a clipboard
+	// issue where sometimes the clipboard data is wiped.
+	if len(data) == 0 {
+		c.cfg.Logger.DebugContext(context.Background(), "Received empty clipboard data from Windows desktop, ignoring message")
+		return C.ErrCodeSuccess
+	}
+
 	c.cfg.Logger.DebugContext(context.Background(), "Received clipboard data from Windows desktop", "len", len(data))
 
 	if err := c.cfg.Conn.WriteMessage(tdp.ClipboardData(data)); err != nil {
diff --git a/lib/srv/desktop/rdp/rdpclient/client_common.go b/lib/srv/desktop/rdp/rdpclient/client_common.go
index 51a54308685c5..a3206304daa2d 100644
--- a/lib/srv/desktop/rdp/rdpclient/client_common.go
+++ b/lib/srv/desktop/rdp/rdpclient/client_common.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"image/png"
 	"log/slog"
-	"time"
 
 	"github.com/gravitational/trace"
 
@@ -46,10 +45,6 @@ type Config struct {
 	LicenseStore LicenseStore
 	HostID       string
 
-	// UserCertGenerator generates user certificates for RDP authentication.
-	GenerateUserCert GenerateUserCertFn
-	CertTTL          time.Duration
-
 	// AuthorizeFn is called to authorize a user connecting to a Windows desktop.
 	AuthorizeFn func(login string) error
 
@@ -90,24 +85,18 @@ type Config struct {
 	// KDCAddr is the address of Key Distribution Center.
 	// This is used to support RDP Network Level Authentication (NLA)
 	// when connecting to hosts enrolled in Active Directory.
-	// This filed is not used when AD is false.
+	// This field is not used when AD is false.
 	KDCAddr string
 
 	// AD indicates whether the desktop is part of an Active Directory domain.
 	AD bool
 }
 
-// GenerateUserCertFn generates user certificates for RDP authentication.
-type GenerateUserCertFn func(ctx context.Context, username string, ttl time.Duration) (certDER, keyDER []byte, err error)
-
 //nolint:unused // used in client.go that is behind desktop_access_rdp build flag
 func (c *Config) checkAndSetDefaults() error {
 	if c.Addr == "" {
 		return trace.BadParameter("missing Addr in rdpclient.Config")
 	}
-	if c.GenerateUserCert == nil {
-		return trace.BadParameter("missing GenerateUserCert in rdpclient.Config")
-	}
 	if c.Conn == nil {
 		return trace.BadParameter("missing Conn in rdpclient.Config")
 	}
diff --git a/lib/srv/desktop/rdp/rdpclient/client_fips.go b/lib/srv/desktop/rdp/rdpclient/client_fips.go
index d1c120db1cf78..2cca33323ab11 100644
--- a/lib/srv/desktop/rdp/rdpclient/client_fips.go
+++ b/lib/srv/desktop/rdp/rdpclient/client_fips.go
@@ -19,7 +19,7 @@
 package rdpclient
 
 /*
-#include <librdprs.h>
+#include <librdpclient.h>
 */
 import "C"
 
diff --git a/lib/srv/desktop/rdp/rdpclient/client_nop.go b/lib/srv/desktop/rdp/rdpclient/client_nop.go
index 68b6d61bc54a5..8f0ae11cff01d 100644
--- a/lib/srv/desktop/rdp/rdpclient/client_nop.go
+++ b/lib/srv/desktop/rdp/rdpclient/client_nop.go
@@ -41,9 +41,9 @@ func New(cfg Config) (*Client, error) {
 	return nil, errors.New("the real rdpclient.Client implementation was not included in this build")
 }
 
-// Run starts the rdp client and blocks until the client disconnects,
-// then runs the cleanup.
-func (c *Client) Run(ctx context.Context) error {
+// Run starts the RDP client, using the provided user certificate and private key.
+// It blocks until the client disconnects, then ensures the cleanup is run.
+func (c *Client) Run(ctx context.Context, certDER, keyDER []byte) error {
 	return errors.New("the real rdpclient.Client implementation was not included in this build")
 }
 
diff --git a/lib/srv/desktop/rdp/rdpclient/client_test.go b/lib/srv/desktop/rdp/rdpclient/client_test.go
new file mode 100644
index 0000000000000..2adbbf3555efc
--- /dev/null
+++ b/lib/srv/desktop/rdp/rdpclient/client_test.go
@@ -0,0 +1,115 @@
+/*
+ * *
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package rdpclient
+
+import (
+	"bytes"
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
+)
+
+type fakeConn struct {
+	bytes.Buffer
+	writer bytes.Buffer
+}
+
+func (f *fakeConn) Write(p []byte) (n int, err error) {
+	return f.writer.Write(p)
+}
+
+func (f *fakeConn) Close() error {
+	return nil
+}
+
+func (f *fakeConn) AddMessage(message tdp.Message) error {
+	msg, err := message.Encode()
+	if err != nil {
+		return err
+	}
+	_, err = f.Buffer.Write(msg)
+	return err
+}
+
+func TestClientNew_EOF(t *testing.T) {
+	f := fakeConn{}
+	err := f.AddMessage(tdp.ClientUsername{Username: "user"})
+	require.NoError(t, err)
+	conn := tdp.NewConn(&f)
+
+	_, err = New(createConfig(conn))
+	require.EqualError(t, err, "EOF")
+}
+
+func TestClientNew_NoKeyboardLayout(t *testing.T) {
+	f := fakeConn{}
+	err := f.AddMessage(tdp.ClientUsername{Username: "user"})
+	require.NoError(t, err)
+	err = f.AddMessage(tdp.ClientScreenSpec{
+		Width:  100,
+		Height: 100,
+	})
+	require.NoError(t, err)
+	err = f.AddMessage(tdp.ClientScreenSpec{
+		Width:  100,
+		Height: 100,
+	})
+	require.NoError(t, err)
+
+	conn := tdp.NewConn(&f)
+
+	_, err = New(createConfig(conn))
+	require.NoError(t, err)
+}
+
+func TestClientNew_KeyboardLayout(t *testing.T) {
+	f := fakeConn{}
+	err := f.AddMessage(tdp.ClientUsername{Username: "user"})
+	require.NoError(t, err)
+	err = f.AddMessage(tdp.ClientScreenSpec{
+		Width:  100,
+		Height: 100,
+	})
+	require.NoError(t, err)
+	err = f.AddMessage(tdp.ClientKeyboardLayout{})
+	require.NoError(t, err)
+	err = f.AddMessage(tdp.ClientScreenSpec{
+		Width:  100,
+		Height: 100,
+	})
+	require.NoError(t, err)
+
+	conn := tdp.NewConn(&f)
+
+	_, err = New(createConfig(conn))
+	require.NoError(t, err)
+}
+
+func createConfig(conn *tdp.Conn) Config {
+	return Config{
+		Addr:        "example.com",
+		AuthorizeFn: func(login string) error { return nil },
+		Conn:        conn,
+		Logger:      slog.Default(),
+	}
+}
diff --git a/lib/srv/desktop/rdp/rdpclient/src/client.rs b/lib/srv/desktop/rdp/rdpclient/src/client.rs
index 6808ea3b3dec7..5dd96b7d8f7f4 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/client.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/client.rs
@@ -503,12 +503,17 @@ impl Client {
         let mut pending_resize =
             Self::resize_manager_lock(pending_resize).map_err(ClientError::from)?;
         let pending_resize = pending_resize.pending_resize.take();
-        if let Some((width, height)) = pending_resize {
+        if let Some((initial_width, initial_height)) = pending_resize {
             // If there was a resize pending, perform it now.
             debug!(
                 "Pending resize for size [{:?}x{:?}] found, sending now",
-                width, height
+                initial_width, initial_height
             );
+            let (width, height) =
+                MonitorLayoutEntry::adjust_display_size(initial_width, initial_height);
+            if width != initial_width || height != initial_height {
+                debug!("Adjusted screen resize to [{:?}x{:?}]", width, height);
+            }
             let pdu: DisplayControlPdu = DisplayControlMonitorLayout::new_single_primary_monitor(
                 width,
                 height,
@@ -1369,6 +1374,12 @@ type RdpReadStream = Framed<TokioStream<ReadHalf<TlsStream<TokioTcpStream>>>>;
 type RdpWriteStream = Framed<TokioStream<WriteHalf<TlsStream<TokioTcpStream>>>>;
 
 fn create_config(params: &ConnectParams, pin: String, cgo_handle: CgoHandle) -> Config {
+    let initial_width = params.screen_width as u32;
+    let initial_height = params.screen_height as u32;
+    let (width, height) = MonitorLayoutEntry::adjust_display_size(initial_width, initial_height);
+    if width != initial_width || height != initial_height {
+        debug!("Adjusted screen size to [{:?}x{:?}]", width, height);
+    }
     Config {
         desktop_size: DesktopSize {
             width: params.screen_width,
@@ -1422,7 +1433,8 @@ fn create_config(params: &ConnectParams, pin: String, cgo_handle: CgoHandle) ->
         } else {
             PerformanceFlags::empty()
         },
-        desktop_scale_factor: 0,
+        // spec says that any value not in [100, 500] is ignored
+        desktop_scale_factor: 100,
         license_cache: Some(Arc::new(GoLicenseCache { cgo_handle })),
         hardware_id: Some(params.client_id),
     }
diff --git a/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs b/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
index f5e4acd4962fa..861fbcfd7df98 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
@@ -338,24 +338,27 @@ impl ScardBackend {
         req: DeviceControlRequest<ScardIoCtlCode>,
         call: TransmitCall,
     ) -> PduResult<()> {
-        let cmd =
-            CardCommand::<TRANSMIT_DATA_LIMIT>::try_from(&call.send_buffer).map_err(|err| {
-                pdu_other_err!(
-                    "",
-                    source:SmartcardBackendError(format!(
-                        "failed to parse smartcard command {:?}: {:?}",
-                        &call.send_buffer, err
-                    ))
-                )
-            })?;
+        let cmd = CardCommand::<TRANSMIT_DATA_LIMIT>::try_from(&call.send_buffer);
 
-        let card = self.contexts.get_card(&call.handle)?;
-        let resp = card.handle(cmd)?;
+        match cmd {
+            Ok(cmd) => {
+                let card = self.contexts.get_card(&call.handle)?;
+                let resp = card.handle(cmd)?;
 
-        self.send_device_control_response(
-            req,
-            TransmitReturn::new(ReturnCode::Success, None, resp.encode()),
-        )
+                self.send_device_control_response(
+                    req,
+                    TransmitReturn::new(ReturnCode::Success, None, resp.encode()),
+                )?;
+            }
+            Err(err) => {
+                warn!("error parsing smart card command: {:?} - {:?}", call, err);
+                self.send_device_control_response(
+                    req,
+                    TransmitReturn::new(ReturnCode::InvalidValue, None, Vec::new()),
+                )?;
+            }
+        }
+        Ok(())
     }
 
     fn handle_status(&mut self, req: DeviceControlRequest<ScardIoCtlCode>) -> PduResult<()> {
diff --git a/lib/srv/desktop/tdp/conn.go b/lib/srv/desktop/tdp/conn.go
index bdc95467785e1..171c39bda83a5 100644
--- a/lib/srv/desktop/tdp/conn.go
+++ b/lib/srv/desktop/tdp/conn.go
@@ -91,6 +91,19 @@ func (c *Conn) Close() error {
 	return err
 }
 
+// NextMessageType peaks at the next incoming message without
+// consuming it.
+func (c *Conn) NextMessageType() (MessageType, error) {
+	b, err := c.bufr.ReadByte()
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+	if err := c.bufr.UnreadByte(); err != nil {
+		return 0, trace.Wrap(err)
+	}
+	return MessageType(b), nil
+}
+
 // ReadMessage reads the next incoming message from the connection.
 func (c *Conn) ReadMessage() (Message, error) {
 	m, err := decode(c.bufr)
diff --git a/lib/srv/desktop/tdp/proto.go b/lib/srv/desktop/tdp/proto.go
index 391c6aadb486c..88f4a9d82f080 100644
--- a/lib/srv/desktop/tdp/proto.go
+++ b/lib/srv/desktop/tdp/proto.go
@@ -186,6 +186,8 @@ func decodeMessage(firstByte byte, in byteReader) (Message, error) {
 		return decodeSharedDirectoryTruncateRequest(in)
 	case TypeSharedDirectoryTruncateResponse:
 		return decodeSharedDirectoryTruncateResponse(in)
+	case TypeLatencyStats:
+		return decodeLatencyStats(in)
 	case TypePing:
 		return decodePing(in)
 	case TypeClientKeyboardLayout:
@@ -1653,6 +1655,17 @@ func (l LatencyStats) Encode() ([]byte, error) {
 	return buf.Bytes(), nil
 }
 
+func decodeLatencyStats(in io.Reader) (LatencyStats, error) {
+	var latencyStats LatencyStats
+	if err := binary.Read(in, binary.BigEndian, &latencyStats.ClientLatency); err != nil {
+		return latencyStats, trace.Wrap(err)
+	}
+	if err := binary.Read(in, binary.BigEndian, &latencyStats.ServerLatency); err != nil {
+		return latencyStats, trace.Wrap(err)
+	}
+	return latencyStats, nil
+}
+
 // Ping is used to measure the latency of the connection(s) between proxy and desktop (includes
 // latency between proxy and Windows Desktop Service and between WDS and desktop).
 type Ping struct {
diff --git a/lib/srv/desktop/windows_server.go b/lib/srv/desktop/windows_server.go
index 34301ede3ade9..0e018c0cc83c9 100644
--- a/lib/srv/desktop/windows_server.go
+++ b/lib/srv/desktop/windows_server.go
@@ -23,9 +23,11 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/asn1"
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"net"
 	"os"
 	"strconv"
@@ -41,14 +43,16 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/recorder"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/limiter"
-	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -58,7 +62,9 @@ import (
 	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/dns"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/slices"
 	"github.com/gravitational/teleport/lib/winpki"
 )
 
@@ -67,15 +73,6 @@ const (
 	// when resolving Windows Desktop hostnames
 	dnsDialTimeout = 5 * time.Second
 
-	// ldapDialTimeout is the timeout for dialing the LDAP server
-	// when making an initial connection
-	ldapDialTimeout = 15 * time.Second
-
-	// ldapRequestTimeout is the timeout for making LDAP requests.
-	// It is larger than the dial timeout because LDAP queries in large
-	// Active Directory environments may take longer to complete.
-	ldapRequestTimeout = 45 * time.Second
-
 	// windowsDesktopServiceCertTTL is the TTL for certificates issued to the
 	// Windows Desktop Service in order to authenticate with the LDAP server.
 	// It is set longer than the Windows certificates for users because it is
@@ -84,19 +81,15 @@ const (
 	windowsDesktopServiceCertTTL = 8 * time.Hour
 
 	// windowsUserCertTTL is the TTL for certificates issued to users connecting
-	// to Windows hosts. These certicates are generated on-demand for each session,
+	// to Windows hosts. These certificates are generated on-demand for each session,
 	// so the TTL is deliberately set to a small value to give enough time to establish
 	// a single session.
 	windowsUserCertTTL = 5 * time.Minute
 
-	// windowsDesktopServiceCertRetryInterval indicates how often to retry
-	// issuing an LDAP certificate if the operation fails.
-	windowsDesktopServiceCertRetryInterval = 10 * time.Minute
-
-	// ldapTimeoutRetryInterval indicates how often to retry LDAP initialization
-	// if it times out. It is set lower than windowsDesktopServiceCertRetryInterval
-	// because LDAP timeouts may indicate a temporary issue.
-	ldapTimeoutRetryInterval = 10 * time.Second
+	// tlsConfigCacheTTL is the TTL for the cached TLS config used for LDAP
+	// queries. It is set to half of the TTL of the certificate it is requesting
+	// for safety.
+	tlsConfigCacheTTL = windowsDesktopServiceCertTTL / 2
 )
 
 // computerAttributes are the attributes we fetch when discovering
@@ -104,6 +97,7 @@ const (
 // see: https://docs.microsoft.com/en-us/windows/win32/adschema/c-computer#windows-server-2012-attributes
 var computerAttributes = []string{
 	attrName,
+	attrDescription,
 	attrCommonName,
 	attrDistinguishedName,
 	attrDNSHostName,
@@ -123,14 +117,8 @@ type WindowsService struct {
 	middleware *auth.Middleware
 
 	ca *winpki.CertificateStoreClient
-	lc *winpki.LDAPClient
 
-	mu              sync.Mutex // mu protects the fields that follow
-	ldapConfigured  bool
-	ldapInitialized bool
-	ldapCertRenew   *time.Timer
-
-	// lastDisoveryResults stores the results of the most recent LDAP search
+	// lastDiscoveryResults stores the results of the most recent LDAP search
 	// when desktop discovery is enabled.
 	// no synchronization is necessary because this is only read/written from
 	// the reconciler goroutine.
@@ -155,6 +143,14 @@ type WindowsService struct {
 	// to domain-joined Windows hosts
 	enableNLA bool
 
+	// sidCache caches ActiveDirectory SID lookups
+	sidCache *utils.FnCache
+
+	// ldapTLSConfig is used as a cache for LDAP TLS config
+	ldapTLSConfig          *tls.Config
+	ldapTLSConfigExpiresAt time.Time
+	ldapTLSConfigMu        sync.Mutex
+
 	closeCtx context.Context
 	close    func()
 }
@@ -191,7 +187,7 @@ type WindowsServiceConfig struct {
 	ShowDesktopWallpaper bool
 	// LDAPConfig contains parameters for connecting to an LDAP server.
 	// LDAP functionality is disabled if Addr is empty.
-	winpki.LDAPConfig
+	servicecfg.LDAPConfig
 	// PKIDomain optionally configures a separate Active Directory domain
 	// for PKI operations. If empty, the domain from the LDAP config is used.
 	// This can be useful for cases where PKI is configured in a root domain
@@ -206,6 +202,8 @@ type WindowsServiceConfig struct {
 	Discovery []servicecfg.LDAPDiscoveryConfig
 	// DiscoveryInterval configures how frequently the discovery process runs.
 	DiscoveryInterval time.Duration
+	// PublishCRLInterval configures how frequently to publish CRLs.
+	PublishCRLInterval time.Duration
 	// Hostname of the Windows desktop service
 	Hostname string
 	// ConnectedProxyGetter gets the proxies teleport is connected to.
@@ -213,6 +211,9 @@ type WindowsServiceConfig struct {
 	Labels               map[string]string
 	// ResourceMatchers match dynamic Windows desktop resources.
 	ResourceMatchers []services.ResourceMatcher
+	// NLA indicates whether the client should perform Network Level Authentication
+	// (NLA) when initiating the RDP session.
+	NLA bool
 }
 
 // HeartbeatConfig contains the configuration for service heartbeats.
@@ -247,6 +248,7 @@ func (cfg *WindowsServiceConfig) checkAndSetDiscoveryDefaults() error {
 	}
 
 	cfg.DiscoveryInterval = cmp.Or(cfg.DiscoveryInterval, 5*time.Minute)
+	cfg.PublishCRLInterval = cmp.Or(cfg.PublishCRLInterval, 5*time.Minute)
 
 	return nil
 }
@@ -276,8 +278,8 @@ func (cfg *WindowsServiceConfig) CheckAndSetDefaults() error {
 	if err := cfg.Heartbeat.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
-	if cfg.LDAPConfig.Addr != "" {
-		if err := cfg.LDAPConfig.Check(); err != nil {
+	if cfg.LDAPConfig.Enabled() {
+		if err := cfg.LDAPConfig.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -289,6 +291,10 @@ func (cfg *WindowsServiceConfig) CheckAndSetDefaults() error {
 	cfg.Clock = cmp.Or(cfg.Clock, clockwork.NewRealClock())
 	cfg.ConnectedProxyGetter = cmp.Or(cfg.ConnectedProxyGetter, reversetunnel.NewConnectedProxyGetter())
 
+	if !cfg.LocateServer.Enabled && cfg.LocateServer.Site != "" {
+		cfg.Logger.WarnContext(context.Background(), "site is set, but locate_server is false. site will be ignored.")
+	}
+
 	return nil
 }
 
@@ -305,6 +311,17 @@ func (cfg *HeartbeatConfig) CheckAndSetDefaults() error {
 	return nil
 }
 
+func (s *WindowsService) getLDAPConfig() *winpki.LDAPConfig {
+	return &winpki.LDAPConfig{
+		Logger:       s.cfg.Logger,
+		Username:     s.cfg.LDAPConfig.Username,
+		SID:          s.cfg.LDAPConfig.SID,
+		Domain:       s.cfg.LDAPConfig.Domain,
+		Addr:         s.cfg.LDAPConfig.Addr,
+		LocateServer: winpki.LocateServer(s.cfg.LDAPConfig.LocateServer),
+	}
+}
+
 const insecureSkipVerifyWarning = "LDAP configuration specifies both a CA certificate and insecure_skip_verify. " +
 	"TLS connections to the LDAP server will not be verified. If this is intentional, disregard this warning."
 
@@ -354,6 +371,23 @@ func NewWindowsService(cfg WindowsServiceConfig) (*WindowsService, error) {
 	}
 
 	ctx, close := context.WithCancel(context.Background())
+
+	// Only initialize the username-to-SID cache if AD is being
+	// used. We can determine this by checking if LDAP is configured
+	var sidCache *utils.FnCache
+	if cfg.LDAPConfig.Enabled() {
+		var err error
+		sidCache, err = utils.NewFnCache(utils.FnCacheConfig{
+			TTL:     4 * time.Hour,
+			Clock:   cfg.Clock,
+			Context: ctx,
+		})
+		if err != nil {
+			close()
+			return nil, trace.Wrap(err)
+		}
+	}
+
 	s := &WindowsService{
 		cfg: cfg,
 		middleware: &auth.Middleware{
@@ -361,15 +395,12 @@ func NewWindowsService(cfg WindowsServiceConfig) (*WindowsService, error) {
 			AcceptedUsage: []string{teleport.UsageWindowsDesktopOnly},
 		},
 		dnsResolver: resolver,
-		lc:          winpki.NewLDAPClient(nil),
 		clusterName: clusterName.GetClusterName(),
 		closeCtx:    ctx,
 		close:       close,
 		auditCache:  newSharedDirectoryAuditCache(),
-
-		// For now, NLA is opt-in via an environment variable.
-		// We'll make it the default behavior in a future release.
-		enableNLA: os.Getenv("TELEPORT_ENABLE_RDP_NLA") == "yes",
+		enableNLA:   cfg.NLA,
+		sidCache:    sidCache,
 	}
 
 	s.ca = winpki.NewCertificateStoreClient(winpki.CertificateStoreConfig{
@@ -377,17 +408,11 @@ func NewWindowsService(cfg WindowsServiceConfig) (*WindowsService, error) {
 		Domain:      cmp.Or(s.cfg.PKIDomain, s.cfg.Domain),
 		Logger:      slog.Default(),
 		ClusterName: s.clusterName,
-		LC:          s.lc,
+		LC:          s.getLDAPConfig(),
 	})
 
-	if s.cfg.LDAPConfig.Addr != "" {
-		s.ldapConfigured = true
-		// initialize LDAP - if this fails it will automatically schedule a retry.
-		// we don't want to return an error in this case, because failure to start
-		// the service brings down the entire Teleport process
-		if err := s.initializeLDAP(); err != nil {
-			s.cfg.Logger.ErrorContext(ctx, "initializing LDAP client, will retry", "error", err)
-		}
+	if s.cfg.LDAPConfig.Enabled() {
+		go s.runCRLUpdateLoop()
 	}
 
 	ok := false
@@ -405,7 +430,7 @@ func NewWindowsService(cfg WindowsServiceConfig) (*WindowsService, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	if _, err := s.startDynamicReconciler(ctx); err != nil {
+	if err := s.startDynamicReconciler(ctx); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -419,60 +444,10 @@ func NewWindowsService(cfg WindowsServiceConfig) (*WindowsService, error) {
 		s.cfg.Logger.InfoContext(ctx, "desktop discovery via LDAP is disabled, set 'base_dn' to enable")
 	}
 
-	// if LDAP-based discovery is not enabled, but we have configured LDAP
-	// then it's important that we periodically try to use the LDAP connection
-	// to detect connection closure
-	if s.ldapConfigured && len(s.cfg.Discovery) == 0 {
-		s.startLDAPConnectionCheck(ctx)
-	}
-
 	ok = true
 	return s, nil
 }
 
-// startLDAPConnectionCheck starts a background process that
-// periodically reads from the LDAP connection in order to detect
-// connection closure, and reconnects if necessary.
-// This is useful when LDAP-based discovery is disabled, because without
-// discovery the connection goes idle and may be closed by the server.
-func (s *WindowsService) startLDAPConnectionCheck(ctx context.Context) {
-	s.cfg.Logger.DebugContext(ctx, "starting LDAP connection checker")
-	go func() {
-		t := s.cfg.Clock.NewTicker(5 * time.Minute)
-		defer t.Stop()
-
-		for {
-			select {
-			case <-t.Chan():
-				// First check if we have successfully initialized the LDAP client.
-				// If not, then do that now and return.
-				// (This mimics the check that is performed when LDAP discovery is enabled.)
-				s.mu.Lock()
-				if !s.ldapInitialized {
-					s.cfg.Logger.DebugContext(context.Background(), "LDAP not ready, attempting to reconnect")
-					s.mu.Unlock()
-					s.initializeLDAP()
-					return
-				}
-				s.mu.Unlock()
-
-				// If we have initialized the LDAP client, then try to use it to make sure we're still connected
-				// by attempting to read CAs in the NTAuth store (we know we have permissions to do so).
-				ntAuthDN := "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration," + winpki.DomainDN(s.cfg.LDAPConfig.Domain)
-				_, err := s.lc.Read(ntAuthDN, "certificationAuthority", []string{"cACertificate"})
-				if trace.IsConnectionProblem(err) {
-					s.cfg.Logger.DebugContext(ctx, "detected broken LDAP connection, will reconnect")
-					if err := s.initializeLDAP(); err != nil {
-						s.cfg.Logger.WarnContext(ctx, "failed to reconnect to LDAP", "error", err)
-					}
-				}
-			case <-ctx.Done():
-				return
-			}
-		}
-	}()
-}
-
 func (s *WindowsService) newSessionRecorder(recConfig types.SessionRecordingConfig, sessionID string) (libevents.SessionPreparerRecorder, error) {
 	return recorder.New(recorder.Config{
 		SessionID:    session.ID(sessionID),
@@ -490,7 +465,7 @@ func (s *WindowsService) newSessionRecorder(recConfig types.SessionRecordingConf
 	})
 }
 
-func (s *WindowsService) tlsConfigForLDAP() (*tls.Config, error) {
+func (s *WindowsService) issueNewTLSConfigForLDAP() (*tls.Config, error) {
 	// trim NETBIOS name from username
 	user := s.cfg.Username
 	if i := strings.LastIndex(s.cfg.Username, `\`); i != -1 {
@@ -540,83 +515,14 @@ func (s *WindowsService) tlsConfigForLDAP() (*tls.Config, error) {
 	return tc, nil
 }
 
-// initializeLDAP requests a TLS certificate from the auth server to be used for
-// authenticating with the LDAP server. If the certificate is obtained, and
-// authentication with the LDAP server succeeds, it schedules a renewal to take
-// place before the certificate expires. If we are unable to obtain a certificate
-// and authenticate with the LDAP server, then the operation will be automatically
-// retried.
-//
-// This method is safe for concurrent calls.
-func (s *WindowsService) initializeLDAP() error {
-	tc, err := s.tlsConfigForLDAP()
-	if trace.IsAccessDenied(err) && modules.GetModules().BuildType() == modules.BuildEnterprise {
-		s.cfg.Logger.WarnContext(context.Background(),
-			"Could not generate certificate for LDAPS. Ensure that the auth server is licensed for desktop access.")
-	}
-	if err != nil {
-		s.mu.Lock()
-		s.ldapInitialized = false
-		// in the case where we're not licensed for desktop access, we retry less frequently,
-		// since this is likely not an intermittent error that will resolve itself quickly
-		s.scheduleNextLDAPCertRenewalLocked(windowsDesktopServiceCertRetryInterval * 3)
-		s.mu.Unlock()
-		return trace.Wrap(err)
-	}
-
-	conn, err := ldap.DialURL(
-		"ldaps://"+s.cfg.Addr,
-		ldap.DialWithDialer(&net.Dialer{Timeout: ldapDialTimeout}),
-		ldap.DialWithTLSConfig(tc),
-	)
-	if err != nil {
-		s.mu.Lock()
-		s.ldapInitialized = false
-
-		// failures due to timeouts might be transient, so retry more frequently
-		retryAfter := windowsDesktopServiceCertRetryInterval
-		if errors.Is(err, context.DeadlineExceeded) {
-			retryAfter = ldapTimeoutRetryInterval
-		}
-
-		s.scheduleNextLDAPCertRenewalLocked(retryAfter)
-		s.mu.Unlock()
-		return trace.Wrap(err, "dial")
-	}
-
-	conn.SetTimeout(ldapRequestTimeout)
-	s.lc.SetClient(conn)
-
-	if err := s.ca.Update(s.closeCtx); err != nil {
-		return trace.Wrap(err)
-	}
-
-	s.mu.Lock()
-	s.ldapInitialized = true
-	s.scheduleNextLDAPCertRenewalLocked(windowsDesktopServiceCertTTL / 3)
-	s.mu.Unlock()
+// Close instructs the server to stop accepting new connections and abort all
+// established ones. Close does not wait for the connections to be finished.
+func (s *WindowsService) Close() error {
+	s.close()
 
 	return nil
 }
 
-// scheduleNextLDAPCertRenewalLocked schedules a renewal of our LDAP credentials
-// after some amount of time has elapsed. If an existing renewal is already
-// scheduled, it is canceled and this new one takes its place.
-//
-// The lock on s.mu MUST be held.
-func (s *WindowsService) scheduleNextLDAPCertRenewalLocked(after time.Duration) {
-	s.cfg.Logger.InfoContext(context.Background(), "scheduled next LDAP cert renewal", "duration", after)
-	if s.ldapCertRenew != nil {
-		s.ldapCertRenew.Reset(after)
-	} else {
-		s.ldapCertRenew = time.AfterFunc(after, func() {
-			if err := s.initializeLDAP(); err != nil {
-				s.cfg.Logger.ErrorContext(context.Background(), "couldn't renew certificate for LDAP auth", "error", err)
-			}
-		})
-	}
-}
-
 func (s *WindowsService) startServiceHeartbeat() error {
 	heartbeat, err := srv.NewHeartbeat(srv.HeartbeatConfig{
 		Context:         s.closeCtx,
@@ -682,20 +588,6 @@ func (s *WindowsService) startStaticHostHeartbeat(host servicecfg.WindowsHost) e
 	return nil
 }
 
-// Close instructs the server to stop accepting new connections and abort all
-// established ones. Close does not wait for the connections to be finished.
-func (s *WindowsService) Close() error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if s.ldapCertRenew != nil {
-		s.ldapCertRenew.Stop()
-	}
-	s.close()
-	s.lc.Close()
-	return nil
-}
-
 // Serve starts serving TLS connections for plainLis. plainLis should be a TCP
 // listener and Serve will handle TLS internally.
 func (s *WindowsService) Serve(plainLis net.Listener) error {
@@ -723,20 +615,6 @@ func (s *WindowsService) Serve(plainLis net.Listener) error {
 	}
 }
 
-func (s *WindowsService) readyForConnections() bool {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	// If LDAP was not configured, we assume all hosts are non-AD
-	// and the server can accept connections right away.
-	if !s.ldapConfigured {
-		return true
-	}
-
-	// If LDAP was configured, then we need to wait for it to be initialized
-	// before accepting connections.
-	return s.ldapInitialized
-}
-
 // handleConnection handles TLS connections from a Teleport proxy.
 // It authenticates and authorizes the connection, and then begins
 // translating the TDP messages from the proxy into native RDP.
@@ -753,15 +631,6 @@ func (s *WindowsService) handleConnection(proxyConn *tls.Conn) {
 		}
 	}
 
-	// don't handle connections until the LDAP initialization retry loop has succeeded
-	// (it would fail anyway, but this presents a better error to the user)
-	if !s.readyForConnections() {
-		const msg = "This service cannot accept connections until LDAP initialization has completed."
-		log.ErrorContext(context.Background(), msg)
-		sendTDPError(msg)
-		return
-	}
-
 	// Check connection limits.
 	remoteAddr, _, err := net.SplitHostPort(proxyConn.RemoteAddr().String())
 	if err != nil {
@@ -797,8 +666,19 @@ func (s *WindowsService) handleConnection(proxyConn *tls.Conn) {
 	desktopName := strings.TrimSuffix(proxyConn.ConnectionState().ServerName, SNISuffix)
 	log = log.With("desktop_name", desktopName)
 
-	desktops, err := s.cfg.AccessPoint.GetWindowsDesktops(ctx,
-		types.WindowsDesktopFilter{HostID: s.cfg.Heartbeat.HostUUID, Name: desktopName})
+	desktops, err := stream.Collect(clientutils.Resources(ctx,
+		func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktop, string, error) {
+			resp, err := s.cfg.AccessPoint.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+				WindowsDesktopFilter: types.WindowsDesktopFilter{HostID: s.cfg.Heartbeat.HostUUID, Name: desktopName},
+				Limit:                pageSize,
+				StartKey:             pageToken,
+			})
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			return resp.Desktops, resp.NextKey, nil
+		}))
 	if err != nil {
 		log.WarnContext(ctx, "Failed to fetch desktop by name", "error", err)
 		sendTDPError("Teleport failed to find the requested desktop in its database.")
@@ -937,27 +817,25 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 	}
 	log = log.With("computer_name", computerName)
 
-	kdcAddr := s.cfg.KDCAddr
-	if !desktop.NonAD() && kdcAddr == "" && s.cfg.LDAPConfig.Addr != "" {
-		if kdcAddr, err = utils.Host(s.cfg.LDAPConfig.Addr); err != nil {
-			return trace.Wrap(err, "KDC address is unspecified and LDAP address is invalid")
+	nla := s.enableNLA && !desktop.NonAD()
+
+	var kdcAddr string
+	if nla {
+		var err error
+		kdcAddr, err = s.getKDCAddress(ctx)
+		if err != nil {
+			return trace.Wrap(err, "getting KDC address")
 		}
 	}
 
-	nla := s.enableNLA && !desktop.NonAD()
-
 	log = log.With("kdc_addr", kdcAddr, "nla", nla)
 	log.InfoContext(context.Background(), "initiating RDP client")
 
 	//nolint:staticcheck // SA4023. False positive, depends on build tags.
 	rdpc, err := rdpclient.New(rdpclient.Config{
-		LicenseStore: s.cfg.LicenseStore,
-		HostID:       s.cfg.Heartbeat.HostUUID,
-		Logger:       log,
-		GenerateUserCert: func(ctx context.Context, username string, ttl time.Duration) (certDER, keyDER []byte, err error) {
-			return s.generateUserCert(ctx, username, ttl, desktop, createUsers, groups)
-		},
-		CertTTL:               windowsUserCertTTL,
+		LicenseStore:          s.cfg.LicenseStore,
+		HostID:                s.cfg.Heartbeat.HostUUID,
+		Logger:                log,
 		Addr:                  addr.String(),
 		ComputerName:          computerName,
 		KDCAddr:               kdcAddr,
@@ -978,6 +856,7 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 		windowsUser = rdpc.GetClientUsername()
 		audit.windowsUser = windowsUser
 	}
+
 	//nolint:staticcheck // SA4023. False positive, depends on build tags.
 	if err != nil {
 		startEvent := audit.makeSessionStart(err)
@@ -986,6 +865,12 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 		return trace.Wrap(err)
 	}
 
+	// Generate client certificates to be used for the RDP connection.
+	certDER, keyDER, err := s.generateUserCert(ctx, windowsUser, windowsUserCertTTL, desktop, createUsers, groups)
+	if err != nil {
+		return trace.Wrap(err, "could not generate client certificates for RDP")
+	}
+
 	if err := s.trackSession(ctx, &identity, windowsUser, string(sessionID), desktop); err != nil {
 		return trace.Wrap(err)
 	}
@@ -1004,6 +889,7 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 		LockTargets:           append(services.LockTargetsFromTLSIdentity(identity), types.LockTarget{WindowsDesktop: desktop.GetName()}),
 		Tracker:               rdpc,
 		TeleportUser:          identity.Username,
+		UserOriginClusterName: identity.OriginClusterName,
 		ServerID:              s.cfg.Heartbeat.HostUUID,
 		IdleTimeoutMessage:    netConfig.GetClientIdleTimeoutMessage(),
 		MessageWriter:         &monitorErrorSender{tdpConn: tdpConn},
@@ -1027,12 +913,21 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 	startEvent := audit.makeSessionStart(nil)
 	startEvent.AllowUserCreation = createUsers
 
+	// Parse some information about the cert, which we'll use in order to enhance
+	// the session start event.
+	userCert, err := x509.ParseCertificate(certDER)
+	if err != nil {
+		return trace.Wrap(err, "the user certificate for RDP is invalid")
+	}
+	populateCertMetadata(startEvent.CertMetadata, userCert)
+
 	s.record(ctx, recorder, startEvent)
 	s.emit(ctx, startEvent)
 
-	err = rdpc.Run(ctx)
+	err = rdpc.Run(ctx, certDER, keyDER)
 
 	// ctx may have been canceled, so emit with a separate context
+	audit.teardown(context.Background())
 	endEvent := audit.makeSessionEnd(recordSession)
 	s.record(context.Background(), recorder, endEvent)
 	s.emit(context.Background(), endEvent)
@@ -1040,6 +935,36 @@ func (s *WindowsService) connectRDP(ctx context.Context, log *slog.Logger, tdpCo
 	return trace.Wrap(err)
 }
 
+func populateCertMetadata(metadata *events.WindowsCertificateMetadata, cert *x509.Certificate) {
+	var enhancedKeyUsages []string
+	var upn string
+
+	for _, extension := range cert.Extensions {
+		if extension.Id.Equal(winpki.EnhancedKeyUsageExtensionOID) {
+			var oids []asn1.ObjectIdentifier
+			if _, err := asn1.Unmarshal(extension.Value, &oids); err == nil {
+				enhancedKeyUsages = make([]string, 0, len(oids))
+				for _, oid := range oids {
+					enhancedKeyUsages = append(enhancedKeyUsages, oid.String())
+				}
+			}
+		} else if extension.Id.Equal(winpki.SubjectAltNameExtensionOID) {
+			var san winpki.SubjectAltName[winpki.UPN]
+			if _, err := asn1.Unmarshal(extension.Value, &san); err == nil {
+				upn = san.OtherName.Value.Value
+			}
+		}
+	}
+
+	metadata.Subject = cert.Subject.String()
+	metadata.SerialNumber = cert.SerialNumber.String()
+	metadata.UPN = upn
+	metadata.CRLDistributionPoints = cert.CRLDistributionPoints
+	metadata.KeyUsage = int32(cert.KeyUsage)
+	metadata.ExtendedKeyUsage = slices.Map(cert.ExtKeyUsage, func(eku x509.ExtKeyUsage) int32 { return int32(eku) })
+	metadata.EnhancedKeyUsage = enhancedKeyUsages
+}
+
 func (s *WindowsService) makeTDPSendHandler(
 	ctx context.Context,
 	recorder libevents.SessionPreparerRecorder,
@@ -1160,9 +1085,11 @@ func (s *WindowsService) makeTDPReceiveHandler(
 				s.emit(ctx, errorEvent)
 			}
 		case tdp.SharedDirectoryReadResponse:
-			s.emit(ctx, audit.makeSharedDirectoryReadResponse(msg))
+			// shared directory audit events can be noisy, so we use a compactor
+			// to retain and delay them in an attempt to coalesce contiguous events
+			audit.compactor.handleRead(ctx, audit.makeSharedDirectoryReadResponse(msg))
 		case tdp.SharedDirectoryWriteResponse:
-			s.emit(ctx, audit.makeSharedDirectoryWriteResponse(msg))
+			audit.compactor.handleWrite(ctx, audit.makeSharedDirectoryWriteResponse(msg))
 		}
 	}
 }
@@ -1193,10 +1120,10 @@ func (s *WindowsService) staticHostHeartbeatInfo(host servicecfg.WindowsHost,
 ) func() (types.Resource, error) {
 	return func() (types.Resource, error) {
 		addr := host.Address.String()
+
 		labels := getHostLabels(addr)
-		for k, v := range host.Labels {
-			labels[k] = v
-		}
+		maps.Copy(labels, host.Labels)
+
 		name := host.Name
 		if name == "" {
 			var err error
@@ -1205,14 +1132,21 @@ func (s *WindowsService) staticHostHeartbeatInfo(host servicecfg.WindowsHost,
 				return nil, trace.Wrap(err)
 			}
 		}
+
 		labels[types.OriginLabel] = types.OriginConfigFile
 		labels[types.ADLabel] = strconv.FormatBool(host.AD)
+
+		var domain string
+		if host.AD {
+			domain = s.cfg.Domain
+		}
+
 		desktop, err := types.NewWindowsDesktopV3(
 			name,
 			labels,
 			types.WindowsDesktopSpecV3{
 				Addr:   addr,
-				Domain: s.cfg.Domain,
+				Domain: domain,
 				HostID: s.cfg.Heartbeat.HostUUID,
 				NonAD:  !host.AD,
 			})
@@ -1233,8 +1167,19 @@ func (s *WindowsService) staticHostHeartbeatInfo(host servicecfg.WindowsHost,
 // a very large number of desktops in the cluster, this may use up a lot of CPU
 // time.
 func (s *WindowsService) nameForStaticHost(addr string) (string, error) {
-	desktops, err := s.cfg.AccessPoint.GetWindowsDesktops(s.closeCtx,
-		types.WindowsDesktopFilter{})
+	desktops, err := stream.Collect(clientutils.Resources(s.closeCtx,
+		func(ctx context.Context, pageSize int, pageToken string) ([]types.WindowsDesktop, string, error) {
+			resp, err := s.cfg.AccessPoint.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+				Limit:          pageSize,
+				StartKey:       pageToken,
+				SearchKeywords: []string{addr},
+			})
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			return resp.Desktops, resp.NextKey, nil
+		}))
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -1272,35 +1217,34 @@ func timer() func() int64 {
 func (s *WindowsService) generateUserCert(ctx context.Context, username string, ttl time.Duration, desktop types.WindowsDesktop, createUsers bool, groups []string) (certDER, keyDER []byte, err error) {
 	var activeDirectorySID string
 	if !desktop.NonAD() {
-		// Find the user's SID
-		filter := winpki.CombineLDAPFilters([]string{
-			fmt.Sprintf("(%s=%s)", attrSAMAccountType, AccountTypeUser),
-			fmt.Sprintf("(%s=%s)", attrSAMAccountName, username),
+		// Use FnCache to fetch the SID, or load it from cache if we already have it
+		// The cache key is the username and domain combined to handle multi-domain setups
+		cacheKey := fmt.Sprintf("%s@%s", username, desktop.GetDomain())
+		sid, err := utils.FnCacheGet(ctx, s.sidCache, cacheKey, func(ctx context.Context) (string, error) {
+			tc, err := s.loadTLSConfigForLDAP()
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+
+			ldapClient, err := winpki.DialLDAP(ctx, s.getLDAPConfig(), tc)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			defer ldapClient.Close()
+
+			s.cfg.Logger.DebugContext(ctx, "querying LDAP for objectSid of Windows user", "username", username)
+			sid, err := ldapClient.GetActiveDirectorySID(ctx, username)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+
+			s.cfg.Logger.DebugContext(ctx, "Found objectSid for Windows user", "username", username)
+			return sid, nil
 		})
-		s.cfg.Logger.DebugContext(ctx, "querying LDAP for objectSid of Windows user", "username", username, "filter", filter)
-		domainDN := winpki.DomainDN(s.cfg.LDAPConfig.Domain)
-
-		entries, err := s.lc.ReadWithFilter(domainDN, filter, []string{winpki.AttrObjectSid})
-		// if LDAP-based desktop discovery is not enabled, there may not be enough
-		// traffic to keep the connection open. Attempt to open a new LDAP connection
-		// in this case.
-		if trace.IsConnectionProblem(err) {
-			s.initializeLDAP() // ignore error, this is a best effort attempt
-			entries, err = s.lc.ReadWithFilter(domainDN, filter, []string{winpki.AttrObjectSid})
-		}
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		if len(entries) == 0 {
-			return nil, nil, trace.NotFound("could not find Windows account %q", username)
-		} else if len(entries) > 1 {
-			s.cfg.Logger.WarnContext(ctx, "found multiple entries for user, taking the first", "username", username)
-		}
-		activeDirectorySID, err = winpki.ADSIDStringFromLDAPEntry(entries[0])
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-		s.cfg.Logger.DebugContext(ctx, "Found objectSid Windows user", "username", username)
+		activeDirectorySID = sid
 	}
 	return s.generateCredentials(ctx, generateCredentialsRequest{
 		username:           username,
@@ -1370,7 +1314,8 @@ func (s *WindowsService) trackSession(ctx context.Context, id *tlsca.Identity, w
 		ClusterName: s.clusterName,
 		Login:       windowsUser,
 		Participants: []types.Participant{{
-			User: id.Username,
+			User:    id.Username,
+			Cluster: id.OriginClusterName,
 		}},
 		HostUser: id.Username,
 		Created:  s.cfg.Clock.Now(),
@@ -1414,3 +1359,122 @@ func (m *monitorErrorSender) WriteString(s string) (n int, err error) {
 
 	return len(s), nil
 }
+
+// runCRLUpdateLoop publishes the Certificate Revocation List to the given
+// LDAP server. It continues to do so every 5 minutes (by default) to make sure it is present
+// and in the correct location.
+func (s *WindowsService) runCRLUpdateLoop() {
+	t := s.cfg.Clock.NewTicker(retryutils.SeventhJitter(s.cfg.PublishCRLInterval))
+	defer t.Stop()
+
+	for {
+		tlsConfig, err := s.loadTLSConfigForLDAP()
+		if err != nil {
+			s.cfg.Logger.ErrorContext(s.closeCtx, "failed to get TLS config for CRL update", "error", err)
+		}
+		if err := s.ca.Update(s.closeCtx, tlsConfig); err != nil && !errors.Is(err, context.Canceled) {
+			s.cfg.Logger.ErrorContext(s.closeCtx, "failed to publish CRL", "error", err)
+		}
+
+		select {
+		case <-s.closeCtx.Done():
+			return
+		case <-t.Chan():
+			continue
+		}
+	}
+}
+
+// getKDCAddress gets the KDC address that should be used for NLA in
+// this priority order:
+// 1. Explicitly specified kdc_address
+// 2. If enabled, using locate_server DNS lookups
+// 3. If all else fails, ldap's addr
+func (s *WindowsService) getKDCAddress(ctx context.Context) (string, error) {
+	if s.cfg.KDCAddr != "" {
+		if s.cfg.LocateServer.Enabled {
+			s.cfg.Logger.WarnContext(ctx, "Both locate_server and kdc_address are set, kdc_address takes priority", "kdc_address", s.cfg.KDCAddr)
+		} else {
+			s.cfg.Logger.DebugContext(ctx, "Using hardcoded KDC address", "kdc_address", s.cfg.KDCAddr)
+		}
+		return s.cfg.KDCAddr, nil
+	}
+
+	if !s.cfg.LocateServer.Enabled && s.cfg.LDAPConfig.Addr != "" {
+		kdcAddr, err := utils.Host(s.cfg.LDAPConfig.Addr)
+		if err != nil {
+			return "", trace.Wrap(err, "KDC address is unspecified, locate server is disabled, and LDAP address is invalid")
+		}
+		s.cfg.Logger.DebugContext(ctx, "locate_server and kdc_address unspecified, assuming that KDC is available on the same host as LDAP", "address", s.cfg.LDAPConfig.Addr)
+		return kdcAddr, nil
+	}
+
+	s.cfg.Logger.DebugContext(
+		ctx,
+		"Looking for KDC server",
+		"domain", s.cfg.Domain,
+		"site", s.cfg.LocateServer.Site,
+	)
+
+	// In development environments, the system's default resolver is unlikely to be
+	// able to resolve the Active Directory SRV records needed for server location,
+	// so we allow overriding the resolver. If the TELEPORT_KDC_RESOLVER parameter
+	// is not set, the default resolver will be used.
+	resolver := dns.NewResolver(ctx, os.Getenv("TELEPORT_KDC_RESOLVER"), s.cfg.Logger)
+
+	servers, err := dns.LocateServerBySRV(
+		ctx,
+		s.cfg.Domain,
+		s.cfg.LocateServer.Site,
+		resolver,
+		"kerberos",
+		"", // Use port returned by SRV record
+	)
+	if err != nil {
+		return "", trace.Wrap(err, "locating KDC server")
+	}
+
+	if len(servers) == 0 {
+		return "", trace.NotFound("no KDC servers found for domain %q", s.cfg.Domain)
+	}
+
+	var lastErr error
+	for _, server := range servers {
+		conn, err := net.DialTimeout("tcp", server, 5*time.Second)
+		if conn != nil {
+			conn.Close()
+		}
+
+		if err == nil {
+			s.cfg.Logger.InfoContext(ctx, "Found KDC server", "server", server)
+			return server, nil
+		}
+		lastErr = err
+
+		s.cfg.Logger.InfoContext(ctx, "Error connecting to KDC server, trying next available server", "server", server, "error", err)
+	}
+
+	return "", trace.NotFound("no KDC servers responded successfully for domain %q: %v", s.cfg.Domain, lastErr)
+}
+
+func (s *WindowsService) loadTLSConfigForLDAP() (*tls.Config, error) {
+	s.ldapTLSConfigMu.Lock()
+	defer s.ldapTLSConfigMu.Unlock()
+
+	// If there is a config that isn't expired, return it
+	if s.ldapTLSConfig != nil && s.cfg.Clock.Now().Before(s.ldapTLSConfigExpiresAt) {
+		s.cfg.Logger.DebugContext(s.closeCtx, "using TLS config from cache", "expires_at", s.ldapTLSConfigExpiresAt)
+		return s.ldapTLSConfig, nil
+	}
+
+	s.cfg.Logger.DebugContext(s.closeCtx, "cache expired, generating new TLS for LDAP", "expires_at", s.ldapTLSConfigExpiresAt)
+	cfg, err := s.issueNewTLSConfigForLDAP()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	s.ldapTLSConfig = cfg
+	s.ldapTLSConfigExpiresAt = s.cfg.Clock.Now().Add(tlsConfigCacheTTL)
+
+	return cfg, nil
+}
diff --git a/lib/srv/desktop/windows_server_test.go b/lib/srv/desktop/windows_server_test.go
index 0471ee0648abd..c6b04c3ea9ab4 100644
--- a/lib/srv/desktop/windows_server_test.go
+++ b/lib/srv/desktop/windows_server_test.go
@@ -21,10 +21,14 @@ package desktop
 import (
 	"context"
 	"crypto/rand"
+	"crypto/tls"
 	"crypto/x509"
+	"encoding/asn1"
+	"encoding/base32"
 	"io"
 	"log/slog"
 	"os"
+	"sync"
 	"testing"
 	"time"
 
@@ -33,12 +37,14 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
+	"github.com/gravitational/teleport/lib/tlsca"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 	"github.com/gravitational/teleport/lib/winpki"
 )
@@ -55,7 +61,7 @@ func TestConfigWildcardBaseDN(t *testing.T) {
 				BaseDN: "*",
 			},
 		},
-		LDAPConfig: winpki.LDAPConfig{
+		LDAPConfig: servicecfg.LDAPConfig{
 			Domain: "test.goteleport.com",
 		},
 	}
@@ -121,9 +127,7 @@ func TestGenerateCredentials(t *testing.T) {
 		domain      = "test.example.com"
 	)
 
-	testSid := "S-1-5-21-1329593140-2634913955-1900852804-500"
-
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		ClusterName: clusterName,
 		Dir:         t.TempDir(),
 	})
@@ -138,7 +142,18 @@ func TestGenerateCredentials(t *testing.T) {
 		require.NoError(t, tlsServer.Close())
 	})
 
-	client, err := tlsServer.NewClient(auth.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
+	ca, err := authServer.AuthServer.GetCertAuthorities(t.Context(), types.UserCA, false)
+	require.NoError(t, err)
+	require.Len(t, ca, 1)
+
+	keys := ca[0].GetActiveKeys()
+	require.Len(t, keys.TLS, 1)
+
+	cert, err := tlsca.ParseCertificatePEM(keys.TLS[0].Cert)
+	require.NoError(t, err)
+	commonName := base32.HexEncoding.EncodeToString(cert.SubjectKeyId) + "_" + clusterName
+
+	client, err := tlsServer.NewClient(authtest.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, client.Close())
@@ -147,75 +162,75 @@ func TestGenerateCredentials(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
+	testSID := "S-1-5-21-1329593140-2634913955-1900852804-500"
+
 	for _, test := range []struct {
 		name               string
 		activeDirectorySID string
-		cdp                string
-		configure          func(*WindowsServiceConfig)
 	}{
 		{
 			name:               "no ad sid",
 			activeDirectorySID: "",
-			cdp:                `ldap:///CN=test,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint`,
 		},
 		{
 			name:               "with ad sid",
-			activeDirectorySID: testSid,
-			cdp:                `ldap:///CN=test,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint`,
-		},
-		{
-			name:               "separate PKI domain",
-			activeDirectorySID: "",
-			configure:          func(cfg *WindowsServiceConfig) { cfg.PKIDomain = "pki.example.com" },
-			cdp:                `ldap:///CN=test,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=pki,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint`,
+			activeDirectorySID: testSID,
 		},
 	} {
-		w := &WindowsService{
-			clusterName: clusterName,
-			cfg: WindowsServiceConfig{
-				LDAPConfig: winpki.LDAPConfig{
-					Domain: domain,
-				},
-				AuthClient: client,
-			},
-		}
-		if test.configure != nil {
-			test.configure(&w.cfg)
-		}
-
-		certb, keyb, err := w.generateCredentials(ctx, generateCredentialsRequest{
-			username:           user,
-			domain:             domain,
-			ttl:                windowsUserCertTTL,
-			activeDirectorySID: test.activeDirectorySID,
-		})
-		require.NoError(t, err)
-		require.NotNil(t, certb)
-		require.NotNil(t, keyb)
-
-		cert, err := x509.ParseCertificate(certb)
-		require.NoError(t, err)
-		require.NotNil(t, cert)
-
-		require.Equal(t, user, cert.Subject.CommonName)
-		require.ElementsMatch(t, cert.CRLDistributionPoints, []string{test.cdp})
-
-		foundKeyUsage := false
-		foundAltName := false
-		foundAdUserMapping := false
-		for _, extension := range cert.Extensions {
-			switch {
-			case extension.Id.Equal(winpki.EnhancedKeyUsageExtensionOID):
-				foundKeyUsage = true
-			case extension.Id.Equal(winpki.SubjectAltNameExtensionOID):
-				foundAltName = true
-			case extension.Id.Equal(winpki.ADUserMappingExtensionOID):
-				foundAdUserMapping = true
+		t.Run(test.name, func(t *testing.T) {
+			certb, keyb, err := winpki.GenerateWindowsDesktopCredentials(ctx, client, &winpki.GenerateCredentialsRequest{
+				Username:           user,
+				Domain:             domain,
+				TTL:                5 * time.Minute,
+				ClusterName:        clusterName,
+				ActiveDirectorySID: test.activeDirectorySID,
+			})
+			require.NoError(t, err)
+			require.NotNil(t, certb)
+			require.NotNil(t, keyb)
+
+			cert, err := x509.ParseCertificate(certb)
+			require.NoError(t, err)
+			require.NotNil(t, cert)
+
+			require.Equal(t, user, cert.Subject.CommonName)
+			require.Contains(t, cert.CRLDistributionPoints,
+				`ldap:///CN=`+commonName+`,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint`)
+
+			foundKeyUsage := false
+			foundAltName := false
+			foundAdUserMapping := false
+			for _, extension := range cert.Extensions {
+				switch {
+				case extension.Id.Equal(winpki.EnhancedKeyUsageExtensionOID):
+					foundKeyUsage = true
+					var oids []asn1.ObjectIdentifier
+					_, err = asn1.Unmarshal(extension.Value, &oids)
+					require.NoError(t, err)
+					require.Len(t, oids, 2)
+					require.Contains(t, oids, winpki.ClientAuthenticationOID)
+					require.Contains(t, oids, winpki.SmartcardLogonOID)
+				case extension.Id.Equal(winpki.SubjectAltNameExtensionOID):
+					foundAltName = true
+					var san winpki.SubjectAltName[winpki.UPN]
+					_, err = asn1.Unmarshal(extension.Value, &san)
+					require.NoError(t, err)
+					require.Equal(t, winpki.UPNOtherNameOID, san.OtherName.OID)
+					require.Equal(t, user+"@"+domain, san.OtherName.Value.Value)
+				case extension.Id.Equal(winpki.ADUserMappingExtensionOID):
+					foundAdUserMapping = true
+					var adUserMapping winpki.SubjectAltName[winpki.ADSid]
+					_, err = asn1.Unmarshal(extension.Value, &adUserMapping)
+					require.NoError(t, err)
+					require.Equal(t, winpki.ADUserMappingInternalOID, adUserMapping.OtherName.OID)
+					require.Equal(t, []byte(testSID), adUserMapping.OtherName.Value.Value)
+
+				}
 			}
-		}
-		require.True(t, foundKeyUsage)
-		require.True(t, foundAltName)
-		require.Equal(t, test.activeDirectorySID != "", foundAdUserMapping)
+			require.True(t, foundKeyUsage)
+			require.True(t, foundAltName)
+			require.Equal(t, test.activeDirectorySID != "", foundAdUserMapping)
+		})
 	}
 }
 
@@ -374,3 +389,109 @@ func TestEmitsClipboardReceiveEvents(t *testing.T) {
 	require.Equal(t, audit.clusterName, cs.ClusterName)
 	require.Equal(t, start, cs.Time)
 }
+
+func TestLoadTLSConfigForLDAP(t *testing.T) {
+	authServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
+		ClusterName: "test-cluster",
+		Dir:         t.TempDir(),
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authServer.Close())
+	})
+
+	tlsServer, err := authServer.NewTestTLSServer()
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, tlsServer.Close())
+	})
+
+	client, err := tlsServer.NewClient(authtest.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, client.Close())
+	})
+
+	newWindowsService := func(clock clockwork.Clock, client *authclient.Client) *WindowsService {
+		return &WindowsService{
+			cfg: WindowsServiceConfig{
+				Clock:      clock,
+				AuthClient: client,
+				Logger:     slog.New(logutils.NewSlogTextHandler(io.Discard, logutils.SlogTextHandlerConfig{})),
+				LDAPConfig: servicecfg.LDAPConfig{
+					Domain:   "test.example.com",
+					Username: "test-user",
+					Addr:     "ldap.example.com:389",
+				},
+			},
+			closeCtx: context.Background(),
+		}
+	}
+
+	t.Run("returns cached config when not expired", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		s := newWindowsService(clock, nil)
+
+		expectedConfig := &tls.Config{MinVersion: tls.VersionTLS12}
+		s.ldapTLSConfig = expectedConfig
+		s.ldapTLSConfigExpiresAt = clock.Now().Add(1 * time.Hour)
+
+		config, err := s.loadTLSConfigForLDAP()
+		require.NoError(t, err)
+		require.Equal(t, expectedConfig, config)
+	})
+
+	t.Run("generates new config when cache is expired", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		s := newWindowsService(clock, client)
+
+		oldConfig := &tls.Config{MinVersion: tls.VersionTLS10}
+		s.ldapTLSConfig = oldConfig
+		s.ldapTLSConfigExpiresAt = clock.Now().Add(-1 * time.Hour)
+
+		config, err := s.loadTLSConfigForLDAP()
+		require.NoError(t, err)
+		require.NotNil(t, config)
+		require.NotEqual(t, oldConfig, config)
+
+		require.Equal(t, config, s.ldapTLSConfig)
+		require.True(t, s.ldapTLSConfigExpiresAt.After(clock.Now()))
+	})
+
+	t.Run("generates new config when cache is empty", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		s := newWindowsService(clock, client)
+
+		config, err := s.loadTLSConfigForLDAP()
+		require.NoError(t, err)
+		require.NotNil(t, config)
+
+		require.Equal(t, config, s.ldapTLSConfig)
+		require.Equal(t, clock.Now().Add(tlsConfigCacheTTL), s.ldapTLSConfigExpiresAt)
+	})
+
+	t.Run("handles concurrent requests", func(t *testing.T) {
+		clock := clockwork.NewFakeClock()
+		s := newWindowsService(clock, client)
+
+		s.ldapTLSConfig = &tls.Config{MinVersion: tls.VersionTLS10}
+		s.ldapTLSConfigExpiresAt = clock.Now().Add(-1 * time.Hour)
+
+		var wg sync.WaitGroup
+		configs := make([]*tls.Config, 5)
+		for i := range 5 {
+			wg.Add(1)
+			go func(idx int) {
+				defer wg.Done()
+				cfg, err := s.loadTLSConfigForLDAP()
+				require.NoError(t, err)
+				configs[idx] = cfg
+			}(i)
+		}
+		wg.Wait()
+
+		for _, cfg := range configs {
+			require.NotNil(t, cfg)
+		}
+	})
+}
diff --git a/lib/srv/discovery/access_graph_aws.go b/lib/srv/discovery/access_graph_aws.go
index e7698e0e02807..0a7c7ce5dccc7 100644
--- a/lib/srv/discovery/access_graph_aws.go
+++ b/lib/srv/discovery/access_graph_aws.go
@@ -73,10 +73,17 @@ const (
 // errNoAccessGraphFetchers is returned when there are no TAG fetchers.
 var errNoAccessGraphFetchers = errors.New("no Access Graph fetchers")
 
-func (s *Server) reconcileAccessGraph(ctx context.Context, currentTAGResources *aws_sync.Resources, stream accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient, features aws_sync.Features) error {
+func (s *Server) reconcileAccessGraph(
+	ctx context.Context,
+	currentTAGResources *aws_sync.Resources,
+	stream accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient,
+	features aws_sync.Features,
+	eksAuditLogWatcher *eksAuditLogWatcher,
+) error {
 	type fetcherResult struct {
-		result *aws_sync.Resources
-		err    error
+		fetcher *aws_sync.Fetcher
+		result  *aws_sync.Resources
+		err     error
 	}
 
 	allFetchers := s.getAllAWSSyncFetchers()
@@ -88,6 +95,8 @@ func (s *Server) reconcileAccessGraph(ctx context.Context, currentTAGResources *
 		if err := push(stream, upsert, toDel); err != nil {
 			s.Log.ErrorContext(ctx, "Error pushing empty resources to TAGs", "error", err)
 		}
+		// No clusters to fetch eks audit logs for.
+		eksAuditLogWatcher.Reconcile(ctx, nil)
 		return trace.Wrap(errNoAccessGraphFetchers)
 	}
 
@@ -110,21 +119,39 @@ func (s *Server) reconcileAccessGraph(ctx context.Context, currentTAGResources *
 				<-tokens
 			}()
 			result, err := fetcher.Poll(ctx, features)
-			resultsC <- fetcherResult{result, trace.Wrap(err)}
+			resultsC <- fetcherResult{fetcher, result, trace.Wrap(err)}
 		}()
 	}
 
 	results := make([]*aws_sync.Resources, 0, len(allFetchers))
+	auditLogClusters := make([]eksAuditLogCluster, 0, len(allFetchers))
 	errs := make([]error, 0, len(allFetchers))
 	// Collect the results from all fetchers.
 	// Each fetcher can return an error and a result.
 	for i := 0; i < len(allFetchers); i++ {
 		fetcherResult := <-resultsC
-		if fetcherResult.err != nil {
-			errs = append(errs, fetcherResult.err)
+		fetcher, result, err := fetcherResult.fetcher, fetcherResult.result, fetcherResult.err
+		if err != nil {
+			errs = append(errs, err)
 		}
-		if fetcherResult.result != nil {
-			results = append(results, fetcherResult.result)
+		if result == nil {
+			continue
+		}
+		results = append(results, result)
+		// If the fetcher is configured for EKS audit logs, see if any
+		// EKS clusters match the configured tags.
+		if fetcher.EKSAuditLogs == nil {
+			continue
+		}
+		for _, cluster := range result.EKSClusters {
+			clusterTags := make(map[string]string, len(cluster.Tags))
+			for _, tag := range cluster.Tags {
+				clusterTags[tag.GetKey()] = tag.GetValue().GetValue()
+			}
+			match, _, _ := services.MatchLabels(fetcher.EKSAuditLogs.Tags, clusterTags)
+			if match {
+				auditLogClusters = append(auditLogClusters, eksAuditLogCluster{fetcher, cluster})
+			}
 		}
 	}
 	// Aggregate all errors into a single error.
@@ -137,6 +164,10 @@ func (s *Server) reconcileAccessGraph(ctx context.Context, currentTAGResources *
 	upsert, toDel := aws_sync.ReconcileResults(currentTAGResources, result)
 	pushErr := push(stream, upsert, toDel)
 
+	// Send the updated list of clusters requiring audit logs to the fetcher.
+	// The fetcher reconciles this list against the last set sent.
+	eksAuditLogWatcher.Reconcile(ctx, auditLogClusters)
+
 	for _, fetcher := range allFetchers {
 		s.tagSyncStatus.syncFinished(fetcher, pushErr, s.clock.Now())
 	}
@@ -420,7 +451,7 @@ func (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-c
 	// Configure the poll interval
 	tickerInterval := defaultPollInterval
 	if s.Config.Matchers.AccessGraph != nil {
-		if s.Config.Matchers.AccessGraph.PollInterval > defaultPollInterval {
+		if s.Config.Matchers.AccessGraph.PollInterval >= defaultPollInterval {
 			tickerInterval = s.Config.Matchers.AccessGraph.PollInterval
 		} else {
 			s.Log.WarnContext(ctx,
@@ -431,11 +462,16 @@ func (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-c
 	}
 	s.Log.InfoContext(ctx, "Access graph service poll interval", "poll_interval", tickerInterval)
 
+	// Start the EKS audit log watcher that keeps track of the EKS audit log
+	// fetchers and updates them when Reconcile is called.
+	eksAuditLogWatcher := newEKSAuditLogWatcher(client, s.Log)
+	go eksAuditLogWatcher.Run(ctx)
+
 	currentTAGResources := &aws_sync.Resources{}
 	timer := time.NewTimer(tickerInterval)
 	defer timer.Stop()
 	for {
-		err := s.reconcileAccessGraph(ctx, currentTAGResources, stream, features)
+		err := s.reconcileAccessGraph(ctx, currentTAGResources, stream, features, eksAuditLogWatcher)
 		if errors.Is(err, errNoAccessGraphFetchers) {
 			// no fetchers, no need to continue.
 			// we will wait for the config to change and re-evaluate the fetchers
@@ -504,7 +540,7 @@ func (s *Server) initTAGAWSWatchers(ctx context.Context, cfg *Config) error {
 				// We will wait for the config to change and re-evaluate the fetchers
 				// before starting the sync.
 				if len(allFetchers) == 0 {
-					s.Log.DebugContext(ctx, "No AWS sync fetchers configured. Access graph sync will not be enabled.")
+					s.Log.DebugContext(ctx, "No AWS sync fetchers without CloudTrail configured. Access graph sync without CloudTrail will will not be enabled.")
 					select {
 					case <-ctx.Done():
 						return
@@ -514,7 +550,8 @@ func (s *Server) initTAGAWSWatchers(ctx context.Context, cfg *Config) error {
 					continue
 				}
 				// reset the currentTAGResources to force a full sync
-				if err := s.initializeAndWatchAccessGraph(ctx, reloadCh); errors.Is(err, errTAGFeatureNotEnabled) {
+				err := s.initializeAndWatchAccessGraph(ctx, reloadCh)
+				if errors.Is(err, errTAGFeatureNotEnabled) {
 					s.Log.WarnContext(ctx, "Access Graph specified in config, but the license does not include Teleport Identity Security. Access graph sync will not be enabled.")
 					break
 				} else if err != nil {
@@ -536,7 +573,7 @@ func (s *Server) initTAGAWSWatchers(ctx context.Context, cfg *Config) error {
 				// We will wait for the config to change and re-evaluate the fetchers
 				// before starting the sync.
 				if len(allFetchers) == 0 {
-					s.Log.DebugContext(ctx, "No AWS sync fetchers configured. Access graph sync will not be enabled.")
+					s.Log.DebugContext(ctx, "No AWS sync fetchers with CloudTrail configured. Access graph sync with CloudTrail will not be enabled.")
 					select {
 					case <-ctx.Done():
 						return
@@ -582,6 +619,10 @@ func (s *Server) accessGraphAWSFetchersFromMatchers(ctx context.Context, matcher
 				ExternalID: awsFetcher.AssumeRole.ExternalID,
 			}
 		}
+		var eksAuditLogs *aws_sync.EKSAuditLogs
+		if awsFetcher.EksAuditLogs != nil {
+			eksAuditLogs = &aws_sync.EKSAuditLogs{Tags: awsFetcher.EksAuditLogs.Tags}
+		}
 		fetcher, err := aws_sync.NewFetcher(
 			ctx,
 			aws_sync.Config{
@@ -592,6 +633,8 @@ func (s *Server) accessGraphAWSFetchersFromMatchers(ctx context.Context, matcher
 				Regions:             awsFetcher.Regions,
 				Integration:         awsFetcher.Integration,
 				DiscoveryConfigName: discoveryConfigName,
+				Log:                 s.Log,
+				EKSAuditLogs:        eksAuditLogs,
 			},
 		)
 		if err != nil {
@@ -853,7 +896,7 @@ func (s *Server) receiveTAGResumeFromStream(ctx context.Context, stream accessgr
 	return nil
 }
 
-func consumeTillErr(stream accessgraphv1alpha.AccessGraphService_AWSCloudTrailStreamClient) error {
+func consumeTillErr[Req any, Res any](stream grpc.BidiStreamingClient[Req, Res]) error {
 	for {
 		_, err := stream.Recv()
 		if err != nil {
@@ -864,7 +907,7 @@ func consumeTillErr(stream accessgraphv1alpha.AccessGraphService_AWSCloudTrailSt
 
 func getOptions(matcher *types.AccessGraphAWSSync) []awsconfig.OptionsFn {
 	opts := []awsconfig.OptionsFn{
-		awsconfig.WithCredentialsMaybeIntegration(matcher.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: matcher.Integration}),
 	}
 	if matcher.AssumeRole != nil {
 		opts = append(opts, awsconfig.WithAssumeRole(matcher.AssumeRole.RoleARN, matcher.AssumeRole.ExternalID))
@@ -1031,7 +1074,7 @@ func (s *Server) processSingleMessage(
 		// because the SQS message will be requeued after.
 		payload, err := downloadCloudTrailFile(ctx, s3Client, sqsEvent.S3Bucket, objectKey)
 		if err != nil {
-			s.Log.ErrorContext(ctx, "Failed to download and parse S3 object", "error", err, "message_payload", body, "nessage_id", aws.ToString(msg.MessageId))
+			s.Log.ErrorContext(ctx, "Failed to download and parse S3 object", "error", err, "message_payload", body, "message_id", aws.ToString(msg.MessageId))
 			return trace.Wrap(err)
 		}
 
diff --git a/lib/srv/discovery/access_graph_aws_test.go b/lib/srv/discovery/access_graph_aws_test.go
index 8e7a1e0eb4199..dff4fb5b4ddc8 100644
--- a/lib/srv/discovery/access_graph_aws_test.go
+++ b/lib/srv/discovery/access_graph_aws_test.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"io"
 	"log/slog"
 	"path/filepath"
@@ -58,10 +59,8 @@ func TestSQSPollEvents(t *testing.T) {
 
 	eventsC := make(chan payloadChannelMessage)
 	errC := make(chan error, 1)
-	wg := sync.WaitGroup{}
-	wg.Add(1)
 	go func() {
-		defer wg.Done()
+		defer close(errC)
 		err := s.pollEventsFromSQSFilesImpl(
 			ctx,
 			"accountID",
@@ -73,6 +72,11 @@ func TestSQSPollEvents(t *testing.T) {
 			},
 			eventsC,
 		)
+
+		if errors.Is(err, context.Canceled) {
+			return
+		}
+
 		errC <- err
 	}()
 
@@ -132,14 +136,16 @@ func TestSQSPollEvents(t *testing.T) {
 		}
 	}, time.Second*5, time.Millisecond, "expected all files to be downloaded")
 
-	require.Never(t, func() bool {
-		// Check that the message is not deleted from the queue.
-		return slices.Contains(fakeSQSQueue.getDeletedMessages(), "messageID4")
-	}, time.Second*2, time.Millisecond, "expected message to not be deleted from the queue")
-
 	// Clean up the goroutine.
 	cancel()
-	wg.Wait()
+
+	// Wait for the goroutine to exit.
+	require.NoError(t, <-errC)
+
+	// Assert that messageID4 was never deleted.
+	deleted := fakeSQSQueue.getDeletedMessages()
+	slices.Sort(deleted)
+	require.Equal(t, []string{"messageID1", "messageID2", "messageID3"}, deleted)
 }
 
 // fakeQueue is used to fake SNS+SQS combination on AWS.
diff --git a/lib/srv/discovery/common/database.go b/lib/srv/discovery/common/database.go
index c2015ab86bc87..2bb6d92b1b326 100644
--- a/lib/srv/discovery/common/database.go
+++ b/lib/srv/discovery/common/database.go
@@ -30,6 +30,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
 	memorydbtypes "github.com/aws/aws-sdk-go-v2/service/memorydb/types"
 	opensearchtypes "github.com/aws/aws-sdk-go-v2/service/opensearch/types"
@@ -877,6 +878,30 @@ func newElastiCacheDatabase(cluster *ectypes.ReplicationGroup, endpoint *ectypes
 	})
 }
 
+// NewDatabaseFromElastiCacheServerlessCache create a database resource from an
+// ElastiCache serverless cache.
+func NewDatabaseFromElastiCacheServerlessCache(cache *ectypes.ServerlessCache, extraLabels map[string]string) (types.Database, error) {
+	// The "reader" endpoint does not seem to be a read-only endpoint at all,
+	// (it can read and write) and only differs by port (primary:6379 vs reader:6380),
+	// therefore we ignore the reader endpoint and only create a database from the primary.
+	if cache.Endpoint == nil {
+		return nil, trace.BadParameter("missing ElastiCache Serverless cache endpoint")
+	}
+	metadata, err := MetadataFromElastiCacheServerlessCache(cache)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return types.NewDatabaseV3(setAWSDBName(types.Metadata{
+		Description: fmt.Sprintf("ElastiCache Serverless cache in %v", metadata.Region),
+		Labels:      addLabels(labelsFromAWSMetadata(metadata), extraLabels),
+	}, aws.ToString(cache.ServerlessCacheName)), types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolRedis,
+		URI:      fmt.Sprintf("%v:%v", aws.ToString(cache.Endpoint.Address), aws.ToInt32(cache.Endpoint.Port)),
+		AWS:      *metadata,
+	})
+}
+
 // NewDatabasesFromOpenSearchDomain creates database resources from an OpenSearch domain.
 func NewDatabasesFromOpenSearchDomain(domain *opensearchtypes.DomainStatus, tags []opensearchtypes.Tag) (types.Databases, error) {
 	var databases types.Databases
@@ -1180,6 +1205,23 @@ func MetadataFromElastiCacheCluster(cluster *ectypes.ReplicationGroup, endpointT
 	}, nil
 }
 
+// MetadataFromElastiCacheCluster creates AWS metadata for the provided
+// ElastiCache cluster.
+func MetadataFromElastiCacheServerlessCache(cache *ectypes.ServerlessCache) (*types.AWS, error) {
+	parsedARN, err := arn.Parse(aws.ToString(cache.ARN))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &types.AWS{
+		Region:    parsedARN.Region,
+		AccountID: parsedARN.AccountID,
+		ElastiCacheServerless: types.ElastiCacheServerless{
+			CacheName: aws.ToString(cache.ServerlessCacheName),
+		},
+	}, nil
+}
+
 // MetadataFromOpenSearchDomain creates AWS metadata for the provided OpenSearch domain.
 func MetadataFromOpenSearchDomain(domain *opensearchtypes.DomainStatus, endpointType string) (*types.AWS, error) {
 	parsedARN, err := arn.Parse(aws.ToString(domain.ARN))
@@ -1288,6 +1330,24 @@ func ExtraElastiCacheLabels(cluster *ectypes.ReplicationGroup, tags []ectypes.Ta
 	return addLabels(labels, libcloudaws.TagsToLabels(tags))
 }
 
+// ExtraElastiCacheServerlessLabels returns a list of extra labels for provided
+// ElastiCacheServerless cluster.
+func ExtraElastiCacheServerlessLabels(cache *ectypes.ServerlessCache, tags []ectypes.Tag, subnets map[string]ec2types.Subnet) map[string]string {
+	labels := make(map[string]string)
+	labels[types.DiscoveryLabelEngine] = aws.ToString(cache.Engine)
+	labels[types.DiscoveryLabelEngineVersion] = aws.ToString(cache.FullEngineVersion)
+	if subnets != nil {
+		for _, s := range cache.SubnetIds {
+			if subnet, ok := subnets[s]; ok {
+				labels[types.DiscoveryLabelVPCID] = aws.ToString(subnet.VpcId)
+				break
+			}
+		}
+	}
+	// Add AWS resource tags.
+	return addLabels(labels, libcloudaws.TagsToLabels(tags))
+}
+
 // ExtraMemoryDBLabels returns a list of extra labels for provided MemoryDB
 // cluster.
 func ExtraMemoryDBLabels(cluster *memorydbtypes.Cluster, tags []memorydbtypes.Tag, allSubnetGroups []memorydbtypes.SubnetGroup) map[string]string {
diff --git a/lib/srv/discovery/common/database_test.go b/lib/srv/discovery/common/database_test.go
index 694f836683e7a..49cfe1fa3766f 100644
--- a/lib/srv/discovery/common/database_test.go
+++ b/lib/srv/discovery/common/database_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql"
 	"github.com/aws/aws-sdk-go-v2/aws"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
 	memorydbtypes "github.com/aws/aws-sdk-go-v2/service/memorydb/types"
 	rdstypes "github.com/aws/aws-sdk-go-v2/service/rds/types"
@@ -1883,6 +1884,60 @@ func TestExtraElastiCacheLabels(t *testing.T) {
 	}
 }
 
+func TestExtraElastiCacheServerlessLabels(t *testing.T) {
+	cache := &ectypes.ServerlessCache{
+		ServerlessCacheName: aws.String("my-redis"),
+		Engine:              aws.String("redis"),
+		MajorEngineVersion:  aws.String("7"),
+		FullEngineVersion:   aws.String("7.1"),
+		SubnetIds:           []string{"subnet-a", "subnet-b"},
+	}
+	tags := []ectypes.Tag{
+		{Key: aws.String("key1"), Value: aws.String("value1")},
+		{Key: aws.String("key2"), Value: aws.String("value2")},
+	}
+
+	tests := []struct {
+		name         string
+		inputTags    []ectypes.Tag
+		inputSubnets map[string]ec2types.Subnet
+		expectLabels map[string]string
+	}{
+		{
+			name:      "all tags and vpc label",
+			inputTags: tags,
+			inputSubnets: map[string]ec2types.Subnet{
+				"subnet-x": {VpcId: aws.String("vpc1")},
+				"subnet-a": {VpcId: aws.String("vpc2")},
+				"subnet-b": {VpcId: aws.String("vpc2")},
+			},
+			expectLabels: map[string]string{
+				"key1":           "value1",
+				"key2":           "value2",
+				"engine":         "redis",
+				"engine-version": "7.1",
+				"vpc-id":         "vpc2",
+			},
+		},
+		{
+			name:         "no resource tags no vpc label",
+			inputTags:    nil,
+			inputSubnets: nil,
+			expectLabels: map[string]string{
+				"engine":         "redis",
+				"engine-version": "7.1",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actualLabels := ExtraElastiCacheServerlessLabels(cache, test.inputTags, test.inputSubnets)
+			require.Equal(t, test.expectLabels, actualLabels)
+		})
+	}
+}
+
 func TestExtraMemoryDBLabels(t *testing.T) {
 	cluster := &memorydbtypes.Cluster{
 		Name:            aws.String("my-cluster"),
@@ -2357,3 +2412,44 @@ func makeAzureResourceID(subID, group, provider, resourceName string) string {
 	return fmt.Sprintf("/subscriptions/%v/resourceGroups/%v/providers/%v/%v",
 		subID, group, provider, resourceName)
 }
+
+func TestNewDatabaseFromElastiCacheServerlessCache(t *testing.T) {
+	cache := &ectypes.ServerlessCache{
+		ARN:                 aws.String("arn:aws:elasticache:ca-central-1:123456789012:serverlesscache:my-cache"),
+		ServerlessCacheName: aws.String("my-cache"),
+		Status:              aws.String("available"),
+		UserGroupId:         aws.String("my-user-group"),
+		Endpoint: &ectypes.Endpoint{
+			Address: aws.String("my-cache-abc123.serverless.cac1.cache.amazonaws.com"),
+			Port:    aws.Int32(6379),
+		},
+	}
+	extraLabels := map[string]string{"key": "value"}
+
+	expected, err := types.NewDatabaseV3(types.Metadata{
+		Name:        "my-cache",
+		Description: "ElastiCache Serverless cache in ca-central-1",
+		Labels: map[string]string{
+			types.DiscoveryLabelAccountID: "123456789012",
+			types.CloudLabel:              types.CloudAWS,
+			types.DiscoveryLabelRegion:    "ca-central-1",
+			"key":                         "value",
+		},
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolRedis,
+		URI:      "my-cache-abc123.serverless.cac1.cache.amazonaws.com:6379",
+		AWS: types.AWS{
+			AccountID: "123456789012",
+			Region:    "ca-central-1",
+			ElastiCacheServerless: types.ElastiCacheServerless{
+				CacheName: "my-cache",
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	actual, err := NewDatabaseFromElastiCacheServerlessCache(cache, extraLabels)
+	require.NoError(t, err)
+	require.NotNil(t, actual)
+	require.Equal(t, expected, actual)
+}
diff --git a/lib/srv/discovery/config_test.go b/lib/srv/discovery/config_test.go
index 615c1852643a8..affd1c4680250 100644
--- a/lib/srv/discovery/config_test.go
+++ b/lib/srv/discovery/config_test.go
@@ -49,7 +49,8 @@ func TestConfigCheckAndSetDefaults(t *testing.T) {
 			errAssertFunc: require.NoError,
 			cfgChange:     func(c *Config) {},
 			postCheckAndSetDefaultsFunc: func(t *testing.T, c *Config) {
-				require.NotNil(t, c.CloudClients)
+				require.NotNil(t, c.initAzureClients)
+				require.NotNil(t, c.gcpClients)
 				require.NotNil(t, c.AWSConfigProvider)
 				require.NotNil(t, c.AWSDatabaseFetcherFactory)
 				require.NotNil(t, c.Log)
diff --git a/lib/srv/discovery/discovery.go b/lib/srv/discovery/discovery.go
index 584d129044aa8..457b55536ccaf 100644
--- a/lib/srv/discovery/discovery.go
+++ b/lib/srv/discovery/discovery.go
@@ -31,6 +31,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6"
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/account"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/eks"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
@@ -52,8 +53,9 @@ import (
 	"github.com/gravitational/teleport/api/types/usertasks"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/gcp"
 	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/services"
@@ -64,6 +66,7 @@ import (
 	azure_sync "github.com/gravitational/teleport/lib/srv/discovery/fetchers/azuresync"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers/db"
 	"github.com/gravitational/teleport/lib/srv/server"
+	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/aws/stsutils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 	libslices "github.com/gravitational/teleport/lib/utils/slices"
@@ -115,9 +118,6 @@ type gcpInstaller interface {
 
 // Config provides configuration for the discovery server.
 type Config struct {
-	// CloudClients is an interface for retrieving cloud clients.
-	CloudClients cloud.Clients
-
 	// AWSFetchersClients gets the AWS clients for the given region for the fetchers.
 	AWSFetchersClients fetchers.AWSClientGetter
 
@@ -131,6 +131,8 @@ type Config struct {
 
 	// GetEC2Client gets an AWS EC2 client for the given region.
 	GetEC2Client server.EC2ClientGetter
+	// GetAWSRegionsLister gets a client that is capable of listing AWS regions.
+	GetAWSRegionsLister server.RegionsListerGetter
 	// GetSSMClient gets an AWS SSM client for the given region.
 	GetSSMClient func(ctx context.Context, region string, opts ...awsconfig.OptionsFn) (server.SSMClient, error)
 	// IntegrationOnlyCredentials discards any Matcher that don't have an Integration.
@@ -189,6 +191,11 @@ type Config struct {
 	// jitter is a function which applies random jitter to a duration.
 	// It is used to add Expiration times to Resources that don't support Heartbeats (eg EICE Nodes).
 	jitter retryutils.Jitter
+
+	// initAzureClients initializes an instance of Azure clients with particular options.
+	initAzureClients func(opts ...azure.ClientsOption) (azure.Clients, error)
+	// gcpClients is a reference to GCP clients.
+	gcpClients gcp.Clients
 }
 
 // AccessGraphConfig represents TAG server config.
@@ -238,13 +245,15 @@ func (c *Config) CheckAndSetDefaults() error {
 		return trace.BadParameter(`the DiscoveryGroup name should be set for discovery server if
 kubernetes matchers are present.`)
 	}
-	if c.CloudClients == nil {
-		cloudClients, err := cloud.NewClients()
-		if err != nil {
-			return trace.Wrap(err, "unable to create cloud clients")
-		}
-		c.CloudClients = cloudClients
+
+	if c.initAzureClients == nil {
+		c.initAzureClients = azure.NewClients
 	}
+
+	if c.gcpClients == nil {
+		c.gcpClients = gcp.NewClients()
+	}
+
 	if c.AWSConfigProvider == nil {
 		provider, err := awsconfig.NewCache(
 			awsconfig.WithDefaults(
@@ -274,6 +283,16 @@ kubernetes matchers are present.`)
 			return ec2.NewFromConfig(cfg), nil
 		}
 	}
+	if c.GetAWSRegionsLister == nil {
+		c.GetAWSRegionsLister = func(ctx context.Context, opts ...awsconfig.OptionsFn) (account.ListRegionsAPIClient, error) {
+			region := "" // Account API is global, no region needed.
+			cfg, err := c.getAWSConfig(ctx, region, opts...)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return account.NewFromConfig(cfg), nil
+		}
+	}
 	if c.AWSFetchersClients == nil {
 		c.AWSFetchersClients = &awsFetchersClientsGetter{
 			Provider: awsconfig.ProviderFunc(c.getAWSConfig),
@@ -452,6 +471,9 @@ type Server struct {
 	// usageEventCache keeps track of which instances the server has emitted
 	// usage events for.
 	usageEventCache map[string]struct{}
+
+	// azureClientCache caches instances of integration-specific Azure clients.
+	azureClientCache *utils.FnCache
 }
 
 // New initializes a discovery Server
@@ -560,6 +582,26 @@ func (s *Server) startDynamicMatchersWatcher(ctx context.Context) error {
 	return nil
 }
 
+// publicProxyAddress returns the public proxy address to use for installation scripts.
+// This is only used if the matcher does not specify a ProxyAddress.
+// Example: proxy.example.com:3080 or proxy.example.com
+func (s *Server) publicProxyAddress(ctx context.Context) (string, error) {
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+	proxies, err := s.AccessPoint.GetProxies()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	for _, proxy := range proxies {
+		for _, proxyAddr := range proxy.GetPublicAddrs() {
+			if proxyAddr != "" {
+				return proxyAddr, nil
+			}
+		}
+	}
+
+	return "", trace.NotFound("could not find the public proxy address for server discovery")
+}
+
 // initAWSWatchers starts AWS resource watchers based on types provided.
 func (s *Server) initAWSWatchers(matchers []types.AWSMatcher) error {
 	var err error
@@ -568,7 +610,12 @@ func (s *Server) initAWSWatchers(matchers []types.AWSMatcher) error {
 		return matcherType == types.AWSMatcherEC2
 	})
 
-	s.staticServerAWSFetchers, err = server.MatchersToEC2InstanceFetchers(s.ctx, ec2Matchers, s.GetEC2Client, noDiscoveryConfig)
+	s.staticServerAWSFetchers, err = server.MatchersToEC2InstanceFetchers(s.ctx, server.MatcherToEC2FetcherParams{
+		Matchers:              ec2Matchers,
+		EC2ClientGetter:       s.GetEC2Client,
+		RegionsListerGetter:   s.GetAWSRegionsLister,
+		PublicProxyAddrGetter: s.publicProxyAddress,
+	})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -598,6 +645,7 @@ func (s *Server) initAWSWatchers(matchers []types.AWSMatcher) error {
 	}
 
 	lr, err := newLabelReconciler(&labelReconcilerConfig{
+		clock:       s.clock,
 		log:         s.Log,
 		accessPoint: s.AccessPoint,
 	})
@@ -687,7 +735,13 @@ func (s *Server) awsServerFetchersFromMatchers(ctx context.Context, matchers []t
 		return matcherType == types.AWSMatcherEC2
 	})
 
-	fetchers, err := server.MatchersToEC2InstanceFetchers(ctx, serverMatchers, s.GetEC2Client, discoveryConfigName)
+	fetchers, err := server.MatchersToEC2InstanceFetchers(ctx, server.MatcherToEC2FetcherParams{
+		Matchers:              serverMatchers,
+		EC2ClientGetter:       s.GetEC2Client,
+		RegionsListerGetter:   s.GetAWSRegionsLister,
+		DiscoveryConfigName:   discoveryConfigName,
+		PublicProxyAddrGetter: s.publicProxyAddress,
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -701,7 +755,7 @@ func (s *Server) azureServerFetchersFromMatchers(matchers []types.AzureMatcher,
 		return matcherType == types.AzureMatcherVM
 	})
 
-	return server.MatchersToAzureInstanceFetchers(s.Log, serverMatchers, s.CloudClients, discoveryConfigName)
+	return server.MatchersToAzureInstanceFetchers(s.Log, serverMatchers, s.getAzureClients, discoveryConfigName)
 }
 
 // gcpServerFetchersFromMatchers converts Matchers into a set of GCP Servers Fetchers.
@@ -711,17 +765,16 @@ func (s *Server) gcpServerFetchersFromMatchers(ctx context.Context, matchers []t
 	})
 
 	if len(serverMatchers) == 0 {
-		// We have an early exit here because GetGCPInstancesClient returns an error
+		// We have an early exit here because GetInstancesClient returns an error
 		// when there are no credentials in the environment.
 		return nil, nil
 	}
 
-	client, err := s.CloudClients.GetGCPInstancesClient(ctx)
+	client, err := s.gcpClients.GetInstancesClient(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	projectsClient, err := s.CloudClients.GetGCPProjectsClient(ctx)
+	projectsClient, err := s.gcpClients.GetProjectsClient(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -746,7 +799,7 @@ func (s *Server) databaseFetchersFromMatchers(matchers Matchers, discoveryConfig
 	// Azure
 	azureDatabaseMatchers, _ := splitMatchers(matchers.Azure, db.IsAzureMatcherType)
 	if len(azureDatabaseMatchers) > 0 {
-		databaseFetchers, err := db.MakeAzureFetchers(s.CloudClients, azureDatabaseMatchers, discoveryConfigName)
+		databaseFetchers, err := db.MakeAzureFetchers(s.ctx, s.getAzureClients, azureDatabaseMatchers, discoveryConfigName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -779,13 +832,54 @@ func (s *Server) kubeFetchersFromMatchers(matchers Matchers, discoveryConfigName
 	return result, nil
 }
 
+// getAzureClients returns an instance of AzureClients made to work with particular integration.
+// If integration argument is empty, ambient credentials will be used instead. This is the default mode.
+//
+// The returned instance is cached for a period of time, so subsequent calls may return the same object.
+func (s *Server) getAzureClients(ctx context.Context, integration string) (azure.Clients, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.azureClientCache == nil {
+		azureClientCache, err := utils.NewFnCache(utils.FnCacheConfig{
+			TTL:   time.Minute * 15,
+			Clock: s.clock,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		s.azureClientCache = azureClientCache
+	}
+
+	// sanity check: this shouldn't happen as matchers are pre-filtered when running in integration-credentials-only mode.
+	if integration == "" && s.IntegrationOnlyCredentials {
+		return nil, trace.BadParameter("cannot create Azure clients with ambient credentials due configuration (this is a bug)")
+	}
+
+	out, err := utils.FnCacheGet(ctx, s.azureClientCache, integration, func(ctx context.Context) (azure.Clients, error) {
+		var opts []azure.ClientsOption
+		if integration != "" {
+			opts = append(opts, azure.WithIntegrationCredentials(integration, s.AccessPoint))
+		}
+		azureClients, err := s.initAzureClients(opts...)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return azureClients, nil
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return out, nil
+}
+
 // initAzureWatchers starts Azure resource watchers based on types provided.
 func (s *Server) initAzureWatchers(ctx context.Context, matchers []types.AzureMatcher, discoveryConfigName string) error {
 	vmMatchers, otherMatchers := splitMatchers(matchers, func(matcherType string) bool {
 		return matcherType == types.AzureMatcherVM
 	})
 
-	s.staticServerAzureFetchers = server.MatchersToAzureInstanceFetchers(s.Log, vmMatchers, s.CloudClients, discoveryConfigName)
+	s.staticServerAzureFetchers = server.MatchersToAzureInstanceFetchers(s.Log, vmMatchers, s.getAzureClients, discoveryConfigName)
 
 	// VM watcher.
 	var err error
@@ -809,7 +903,7 @@ func (s *Server) initAzureWatchers(ctx context.Context, matchers []types.AzureMa
 
 	// Add kube fetchers.
 	for _, matcher := range otherMatchers {
-		subscriptions, err := s.getAzureSubscriptions(ctx, matcher.Subscriptions)
+		subscriptions, err := s.getAzureSubscriptions(ctx, matcher.Integration, matcher.Subscriptions)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -817,10 +911,15 @@ func (s *Server) initAzureWatchers(ctx context.Context, matchers []types.AzureMa
 			for _, t := range matcher.Types {
 				switch t {
 				case types.AzureMatcherKubernetes:
-					kubeClient, err := s.CloudClients.GetAzureKubernetesClient(subscription)
+					azureClients, err := s.getAzureClients(ctx, matcher.Integration)
+					if err != nil {
+						return trace.Wrap(err)
+					}
+					kubeClient, err := azureClients.GetKubernetesClient(ctx, subscription)
 					if err != nil {
 						return trace.Wrap(err)
 					}
+
 					fetcher, err := fetchers.NewAKSFetcher(fetchers.AKSFetcherConfig{
 						Client:              kubeClient,
 						Regions:             matcher.Regions,
@@ -828,6 +927,7 @@ func (s *Server) initAzureWatchers(ctx context.Context, matchers []types.AzureMa
 						ResourceGroups:      matcher.ResourceGroups,
 						Logger:              s.Log,
 						DiscoveryConfigName: discoveryConfigName,
+						Integration:         matcher.Integration,
 					})
 					if err != nil {
 						return trace.Wrap(err)
@@ -869,7 +969,7 @@ func (s *Server) initGCPServerWatcher(ctx context.Context, vmMatchers []types.GC
 
 // initGCPWatchers starts GCP resource watchers based on types provided.
 func (s *Server) initGCPWatchers(ctx context.Context, matchers []types.GCPMatcher, discoveryConfigName string) error {
-	// return early if there are no matchers as GetGCPGKEClient causes
+	// return early if there are no matchers as GetGKEClient causes
 	// an error if there are no credentials present
 
 	vmMatchers, otherMatchers := splitMatchers(matchers, func(matcherType string) bool {
@@ -887,11 +987,11 @@ func (s *Server) initGCPWatchers(ctx context.Context, matchers []types.GCPMatche
 		return nil
 	}
 
-	kubeClient, err := s.CloudClients.GetGCPGKEClient(ctx)
+	kubeClient, err := s.gcpClients.GetGKEClient(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	projectClient, err := s.CloudClients.GetGCPProjectsClient(ctx)
+	projectClient, err := s.gcpClients.GetProjectsClient(ctx)
 	if err != nil {
 		return trace.Wrap(err, "unable to create gcp project client")
 	}
@@ -1115,10 +1215,10 @@ func (s *Server) heartbeatEICEInstance(instances *server.EC2Instances) {
 }
 
 func (s *Server) handleEC2RemoteInstallation(instances *server.EC2Instances) error {
-	// TODO(gavin): support assume_role_arn for ec2.
 	ssmClient, err := s.GetSSMClient(s.ctx,
 		instances.Region,
-		awsconfig.WithCredentialsMaybeIntegration(instances.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: instances.Integration}),
+		awsconfig.WithAssumeRole(instances.AssumeRoleARN, instances.ExternalID),
 	)
 	if err != nil {
 		return trace.Wrap(err)
@@ -1322,11 +1422,18 @@ outer:
 }
 
 func (s *Server) handleAzureInstances(instances *server.AzureInstances) error {
-	client, err := s.CloudClients.GetAzureRunCommandClient(instances.SubscriptionID)
+	azureClients, err := s.getAzureClients(s.ctx, instances.Integration)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	runClient, err := azureClients.GetRunCommandClient(s.ctx, instances.SubscriptionID)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err := s.filterExistingAzureNodes(instances); err != nil {
+
+	err = s.filterExistingAzureNodes(instances)
+	if err != nil {
 		return trace.Wrap(err)
 	}
 	if len(instances.Instances) == 0 {
@@ -1335,14 +1442,12 @@ func (s *Server) handleAzureInstances(instances *server.AzureInstances) error {
 
 	s.Log.DebugContext(s.ctx, "Running Teleport installation on virtual machines", "subscription_id", instances.SubscriptionID, "vms", genAzureInstancesLogStr(instances.Instances))
 	req := server.AzureRunRequest{
-		Client:          client,
+		Client:          runClient,
 		Instances:       instances.Instances,
 		Region:          instances.Region,
 		ResourceGroup:   instances.ResourceGroup,
-		Params:          instances.Parameters,
-		ScriptName:      instances.ScriptName,
-		PublicProxyAddr: instances.PublicProxyAddr,
-		ClientID:        instances.ClientID,
+		InstallerParams: instances.InstallerParams,
+		ProxyAddrGetter: s.publicProxyAddress,
 	}
 	if err := s.azureInstaller.Run(s.ctx, req); err != nil {
 		return trace.Wrap(err)
@@ -1411,7 +1516,7 @@ outer:
 }
 
 func (s *Server) handleGCPInstances(instances *server.GCPInstances) error {
-	client, err := s.CloudClients.GetGCPInstancesClient(s.ctx)
+	client, err := s.gcpClients.GetInstancesClient(s.ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1428,14 +1533,13 @@ func (s *Server) handleGCPInstances(instances *server.GCPInstances) error {
 		return trace.Wrap(err, "finding algorithm for SSH key from ping response")
 	}
 	req := server.GCPRunRequest{
-		Client:          client,
-		Instances:       instances.Instances,
-		ProjectID:       instances.ProjectID,
-		Zone:            instances.Zone,
-		Params:          instances.Parameters,
-		ScriptName:      instances.ScriptName,
-		PublicProxyAddr: instances.PublicProxyAddr,
-		SSHKeyAlgo:      sshKeyAlgo,
+		Client:            client,
+		Instances:         instances.Instances,
+		ProjectID:         instances.ProjectID,
+		Zone:              instances.Zone,
+		InstallerParams:   instances.InstallerParams,
+		SSHKeyAlgo:        sshKeyAlgo,
+		PublicProxyGetter: s.publicProxyAddress,
 	}
 	if err := s.gcpInstaller.Run(s.ctx, req); err != nil {
 		return trace.Wrap(err)
@@ -1842,19 +1946,19 @@ func (s *Server) upsertDynamicMatchers(ctx context.Context, dc *discoveryconfig.
 	return nil
 }
 
-// discardUnsupportedMatchers drops any matcher that is not supported in the current DiscoveryService.
-// Discarded Matchers:
-// - when running in IntegrationOnlyCredentials mode, any Matcher that doesn't have an Integration is discarded.
 func (s *Server) discardUnsupportedMatchers(m *Matchers) {
-	if !s.IntegrationOnlyCredentials {
-		return
+	if s.IntegrationOnlyCredentials {
+		discardAmbientCredentialMatchers(s.ctx, s.Log, m)
 	}
+}
 
+// discardAmbientCredentialMatchers drops any matcher that depends on ambient credentials (and not integration).
+func discardAmbientCredentialMatchers(ctx context.Context, log *slog.Logger, m *Matchers) {
 	// Discard all matchers that don't have an Integration
 	validAWSMatchers := make([]types.AWSMatcher, 0, len(m.AWS))
 	for i, m := range m.AWS {
 		if m.Integration == "" {
-			s.Log.WarnContext(s.ctx, "Discarding AWS matcher - missing integration", "matcher_pos", i)
+			log.WarnContext(ctx, "Discarding AWS matcher - missing integration", "matcher_pos", i)
 			continue
 		}
 		validAWSMatchers = append(validAWSMatchers, m)
@@ -1862,17 +1966,21 @@ func (s *Server) discardUnsupportedMatchers(m *Matchers) {
 	m.AWS = validAWSMatchers
 
 	if len(m.GCP) > 0 {
-		s.Log.WarnContext(s.ctx, "Discarding GCP matchers - missing integration")
+		log.WarnContext(ctx, "Discarding GCP matchers - missing integration")
 		m.GCP = []types.GCPMatcher{}
 	}
 
-	if len(m.Azure) > 0 {
-		s.Log.WarnContext(s.ctx, "Discarding Azure matchers - missing integration")
-		m.Azure = []types.AzureMatcher{}
+	filtered := slices.DeleteFunc(m.Azure, func(matcher types.AzureMatcher) bool {
+		return matcher.Integration == ""
+	})
+	discarded := len(m.Azure) - len(filtered)
+	if discarded > 0 {
+		m.Azure = filtered
+		log.WarnContext(ctx, "Discarded Azure matchers without integration", "count", discarded)
 	}
 
 	if len(m.Kubernetes) > 0 {
-		s.Log.WarnContext(s.ctx, "Discarding Kubernetes matchers - missing integration")
+		log.WarnContext(ctx, "Discarding Kubernetes matchers - missing integration")
 		m.Kubernetes = []types.KubernetesMatcher{}
 	}
 }
@@ -1894,6 +2002,9 @@ func (s *Server) Stop() {
 			s.Log.WarnContext(s.ctx, "Dynamic matcher watcher closing error", "error", err)
 		}
 	}
+	if s.gcpClients != nil {
+		_ = s.gcpClients.Close()
+	}
 }
 
 // Wait will block while the server is running.
@@ -1905,10 +2016,14 @@ func (s *Server) Wait() error {
 	return nil
 }
 
-func (s *Server) getAzureSubscriptions(ctx context.Context, subs []string) ([]string, error) {
+func (s *Server) getAzureSubscriptions(ctx context.Context, integration string, subs []string) ([]string, error) {
 	subscriptionIds := subs
 	if slices.Contains(subs, types.Wildcard) {
-		subsClient, err := s.CloudClients.GetAzureSubscriptionClient()
+		azureClients, err := s.getAzureClients(ctx, integration)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		subsClient, err := azureClients.GetSubscriptionClient(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1926,6 +2041,7 @@ func (s *Server) initTeleportNodeWatcher() (err error) {
 			Logger:       s.Log,
 			Client:       s.AccessPoint,
 			MaxStaleness: time.Minute,
+			Clock:        s.clock,
 		},
 		NodesGetter: s.AccessPoint,
 	})
diff --git a/lib/srv/discovery/discovery_eks_test.go b/lib/srv/discovery/discovery_eks_test.go
new file mode 100644
index 0000000000000..eb2f83c60db7b
--- /dev/null
+++ b/lib/srv/discovery/discovery_eks_test.go
@@ -0,0 +1,476 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package discovery
+
+import (
+	"context"
+	"iter"
+	"maps"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/gravitational/teleport/api"
+	"github.com/gravitational/teleport/api/client/proto"
+	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/discoveryconfig"
+	"github.com/gravitational/teleport/api/types/header"
+	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/cloud/mocks"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func discoveryConfigWithAWSMatchers(t *testing.T, discoveryGroup string, m ...types.AWSMatcher) *discoveryconfig.DiscoveryConfig {
+	t.Helper()
+	discoveryConfigName := uuid.NewString()
+	discoveryConfig, err := discoveryconfig.NewDiscoveryConfig(
+		header.Metadata{Name: discoveryConfigName},
+		discoveryconfig.Spec{
+			DiscoveryGroup: discoveryGroup,
+			AWS:            m,
+		},
+	)
+	require.NoError(t, err)
+	return discoveryConfig
+}
+
+func awsMatcherForEKS(t *testing.T, integrationName string) types.AWSMatcher {
+	t.Helper()
+	return types.AWSMatcher{
+		Types:       []string{"eks"},
+		Regions:     []string{"us-west-2"},
+		Tags:        map[string]utils.Strings{"RunDiscover": {"Please"}},
+		Integration: integrationName,
+	}
+}
+
+func awsMatcherForEKSWithAppDiscovery(t *testing.T, integrationName string) types.AWSMatcher {
+	t.Helper()
+	matcher := awsMatcherForEKS(t, integrationName)
+	matcher.KubeAppDiscovery = true
+	return matcher
+}
+
+func TestDiscoveryServerEKS(t *testing.T) {
+	t.Parallel()
+	integrationName := "my-integration"
+	defaultDiscoveryGroup := "dc001"
+
+	eksMatcher := awsMatcherForEKS(t, integrationName)
+	discoveryConfigForUserTaskEKSTest := discoveryConfigWithAWSMatchers(t, defaultDiscoveryGroup, eksMatcher)
+
+	matcherWithAppDiscovery := awsMatcherForEKSWithAppDiscovery(t, integrationName)
+	matcherWithoutAppDiscovery := awsMatcherForEKS(t, integrationName)
+	discoveryConfigWithAndWithoutAppDiscovery := discoveryConfigWithAWSMatchers(t, defaultDiscoveryGroup, matcherWithAppDiscovery, matcherWithoutAppDiscovery)
+
+	awsOIDCIntegration, err := types.NewIntegrationAWSOIDC(types.Metadata{
+		Name: integrationName,
+	}, &types.AWSOIDCIntegrationSpecV1{
+		RoleARN: "arn:aws:iam::123456789012:role/teleport",
+	})
+	require.NoError(t, err)
+
+	for _, tt := range []struct {
+		name                      string
+		emitter                   *mockEmitter
+		eksClusters               []*ekstypes.Cluster
+		eksEnroller               eksClustersEnroller
+		discoveryConfig           *discoveryconfig.DiscoveryConfig
+		staticMatchers            Matchers
+		wantInstalledInstances    []string
+		wantDiscoveryConfigStatus *discoveryconfig.Status
+		userTasksDiscoverCheck    func(t *testing.T, existingTasks []*usertasksv1.UserTask)
+	}{
+		{
+			name: "multiple EKS clusters failed to autoenroll and user tasks are created",
+			eksClusters: []*ekstypes.Cluster{
+				{
+					Name:   aws.String("cluster01"),
+					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster01"),
+					Status: ekstypes.ClusterStatusActive,
+					Tags: map[string]string{
+						"RunDiscover": "Please",
+					},
+				},
+				{
+					Name:   aws.String("cluster02"),
+					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster02"),
+					Status: ekstypes.ClusterStatusActive,
+					Tags: map[string]string{
+						"RunDiscover": "Please",
+					},
+				},
+			},
+			eksEnroller: &mockEKSClusterEnroller{
+				resp: &integrationpb.EnrollEKSClustersResponse{
+					Results: []*integrationpb.EnrollEKSClusterResult{
+						{
+							EksClusterName: "cluster01",
+							Error:          "access endpoint is not reachable",
+							IssueType:      "eks-cluster-unreachable",
+						},
+						{
+							EksClusterName: "cluster02",
+							Error:          "access endpoint is not reachable",
+							IssueType:      "eks-cluster-unreachable",
+						},
+					},
+				},
+				err: nil,
+			},
+			emitter:                &mockEmitter{},
+			staticMatchers:         Matchers{},
+			discoveryConfig:        discoveryConfigForUserTaskEKSTest,
+			wantInstalledInstances: []string{},
+			userTasksDiscoverCheck: func(t *testing.T, existingTasks []*usertasksv1.UserTask) {
+				require.NotEmpty(t, existingTasks)
+				existingTask := existingTasks[0]
+
+				require.Equal(t, "OPEN", existingTask.GetSpec().State)
+				require.Equal(t, integrationName, existingTask.GetSpec().Integration)
+				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
+				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
+				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
+
+				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
+				require.Contains(t, taskClusters, "cluster01")
+				taskCluster := taskClusters["cluster01"]
+
+				require.Equal(t, "cluster01", taskCluster.Name)
+				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster.DiscoveryConfig)
+				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
+
+				require.Contains(t, taskClusters, "cluster02")
+				taskCluster2 := taskClusters["cluster02"]
+
+				require.Equal(t, "cluster02", taskCluster2.Name)
+				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster2.DiscoveryConfig)
+				require.Equal(t, defaultDiscoveryGroup, taskCluster2.DiscoveryGroup)
+			},
+		},
+		{
+			name: "multiple EKS clusters with different KubeAppDiscovery setting failed to autoenroll and user tasks are created",
+			eksClusters: []*ekstypes.Cluster{
+				{
+					Name:   aws.String("cluster01"),
+					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster01"),
+					Status: ekstypes.ClusterStatusActive,
+					Tags: map[string]string{
+						"RunDiscover": "Please",
+					},
+				},
+				{
+					Name:   aws.String("cluster02"),
+					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster02"),
+					Status: ekstypes.ClusterStatusActive,
+					Tags: map[string]string{
+						"RunDiscover": "Please",
+					},
+				},
+			},
+			eksEnroller: &mockEKSClusterEnroller{
+				resp: &integrationpb.EnrollEKSClustersResponse{
+					Results: []*integrationpb.EnrollEKSClusterResult{
+						{
+							EksClusterName: "cluster01",
+							Error:          "access endpoint is not reachable",
+							IssueType:      "eks-cluster-unreachable",
+						},
+						{
+							EksClusterName: "cluster02",
+							Error:          "access endpoint is not reachable",
+							IssueType:      "eks-cluster-unreachable",
+						},
+					},
+				},
+				err: nil,
+			},
+			emitter:                &mockEmitter{},
+			staticMatchers:         Matchers{},
+			discoveryConfig:        discoveryConfigWithAndWithoutAppDiscovery,
+			wantInstalledInstances: []string{},
+			userTasksDiscoverCheck: func(t *testing.T, existingTasks []*usertasksv1.UserTask) {
+				require.Len(t, existingTasks, 2)
+				existingTask := existingTasks[0]
+				if existingTask.Spec.DiscoverEks.AppAutoDiscover == false {
+					existingTask = existingTasks[1]
+				}
+
+				require.Equal(t, "OPEN", existingTask.GetSpec().State)
+				require.Equal(t, integrationName, existingTask.GetSpec().Integration)
+				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
+				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
+				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
+
+				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
+				require.Contains(t, taskClusters, "cluster01")
+				taskCluster := taskClusters["cluster01"]
+
+				require.Equal(t, "cluster01", taskCluster.Name)
+				require.Equal(t, discoveryConfigWithAndWithoutAppDiscovery.GetName(), taskCluster.DiscoveryConfig)
+				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				ctx, cancel := context.WithCancel(t.Context())
+				fakeConfigProvider := mocks.AWSConfigProvider{
+					OIDCIntegrationClient: &mocks.FakeOIDCIntegrationClient{
+						Integration: awsOIDCIntegration,
+					},
+				}
+
+				bk, err := memory.New(memory.Config{})
+				require.NoError(t, err)
+
+				mockAccessPoint := &mockAuthServer{
+					events:            local.NewEventsService(bk),
+					enrollEKSClusters: tt.eksEnroller.EnrollEKSClusters,
+					storeDiscoveryConfigs: map[string]*discoveryconfig.DiscoveryConfig{
+						tt.discoveryConfig.GetName(): tt.discoveryConfig,
+					},
+					storeUserTasks: map[string]*usertasksv1.UserTask{},
+				}
+
+				server, err := New(ctx, &Config{
+					AWSConfigProvider: &fakeConfigProvider,
+					AWSFetchersClients: &mockFetchersClients{
+						AWSConfigProvider: fakeConfigProvider,
+						eksClusters:       tt.eksClusters,
+					},
+					ClusterFeatures: func() proto.Features { return proto.Features{} },
+					AccessPoint:     mockAccessPoint,
+					Matchers:        Matchers{},
+					Emitter:         tt.emitter,
+					DiscoveryGroup:  defaultDiscoveryGroup,
+					Log:             logtest.NewLogger(),
+				})
+				require.NoError(t, err)
+
+				go func() {
+					assert.NoError(t, server.Start())
+				}()
+				defer t.Cleanup(server.Stop)
+
+				// Wait for the discovery server to complete one iteration of discovering resources
+				synctest.Wait()
+
+				// Start server shutdown.
+				cancel()
+
+				// Discovery usage events are reported.
+				require.NotEmpty(t, mockAccessPoint.usageEvents)
+
+				// Check the UserTasks created by the discovery server.
+				existingTasks := slices.Collect(maps.Values(mockAccessPoint.storeUserTasks))
+				tt.userTasksDiscoverCheck(t, existingTasks)
+			})
+		})
+	}
+}
+
+type mockAuthServer struct {
+	authclient.DiscoveryAccessPoint
+
+	storeDiscoveryConfigs map[string]*discoveryconfig.DiscoveryConfig
+	storeUserTasks        map[string]*usertasksv1.UserTask
+
+	events      types.Events
+	usageEvents []*proto.SubmitUsageEventRequest
+
+	enrollEKSClusters func(context.Context, *integrationpb.EnrollEKSClustersRequest, ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error)
+}
+
+type mockWatcher struct {
+	done     chan struct{}
+	events   chan types.Event
+	doneOnce sync.Once
+}
+
+func (w *mockWatcher) Events() <-chan types.Event {
+	return w.events
+}
+
+func (w *mockWatcher) Close() error {
+	w.doneOnce.Do(func() {
+		close(w.done)
+		close(w.events)
+	})
+	return nil
+}
+
+func (w *mockWatcher) Error() error {
+	return nil
+}
+
+func (w *mockWatcher) Done() <-chan struct{} {
+	return w.done
+}
+
+func (m *mockAuthServer) NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error) {
+	w := &mockWatcher{
+		done:   make(chan struct{}),
+		events: make(chan types.Event, 1),
+	}
+
+	w.events <- types.Event{
+		Type: types.OpInit,
+	}
+	return w, nil
+}
+
+func (m *mockAuthServer) Ping(context.Context) (proto.PingResponse, error) {
+	return proto.PingResponse{
+		ServerVersion: api.SemVer().String(),
+	}, nil
+}
+
+func (m *mockAuthServer) SubmitUsageEvent(ctx context.Context, req *proto.SubmitUsageEventRequest) error {
+	m.usageEvents = append(m.usageEvents, req)
+	return nil
+}
+
+func (m *mockAuthServer) ListDiscoveryConfigs(ctx context.Context, pageSize int, nextKey string) ([]*discoveryconfig.DiscoveryConfig, string, error) {
+	return slices.Collect(maps.Values(m.storeDiscoveryConfigs)), "", nil
+}
+
+func (m *mockAuthServer) UpdateDiscoveryConfigStatus(ctx context.Context, name string, status discoveryconfig.Status) (*discoveryconfig.DiscoveryConfig, error) {
+	dc, ok := m.storeDiscoveryConfigs[name]
+	if !ok {
+		return nil, trace.NotFound("discovery config %q not found", name)
+	}
+
+	dc.Status = status
+	m.storeDiscoveryConfigs[name] = dc
+
+	return dc, nil
+}
+
+func (m *mockAuthServer) GetKubernetesClusters(ctx context.Context) ([]types.KubeCluster, error) {
+	return nil, nil
+}
+
+func (m *mockAuthServer) ListKubernetesClusters(ctx context.Context, limit int, start string) ([]types.KubeCluster, string, error) {
+	return nil, "", nil
+}
+
+func (m *mockAuthServer) RangeKubernetesClusters(ctx context.Context, start, end string) iter.Seq2[types.KubeCluster, error] {
+	return func(yield func(types.KubeCluster, error) bool) {}
+}
+
+func (m *mockAuthServer) GetKubernetesServers(context.Context) ([]types.KubeServer, error) {
+	return nil, nil
+}
+
+func (m *mockAuthServer) GetDatabases(ctx context.Context) ([]types.Database, error) {
+	return nil, nil
+}
+
+func (m *mockAuthServer) ListDatabases(ctx context.Context, limit int, startKey string) ([]types.Database, string, error) {
+	return nil, "", nil
+}
+
+func (m *mockAuthServer) RangeDatabases(ctx context.Context, start, end string) iter.Seq2[types.Database, error] {
+	return stream.Empty[types.Database]()
+}
+
+func (m *mockAuthServer) CreateApp(ctx context.Context, _ types.Application) error {
+	return nil
+}
+
+func (m *mockAuthServer) GetApps(ctx context.Context) ([]types.Application, error) {
+	return nil, nil
+}
+
+func (m *mockAuthServer) ListApps(ctx context.Context, limit int, startKey string) ([]types.Application, string, error) {
+	return nil, "", nil
+}
+
+func (m *mockAuthServer) RangeApps(ctx context.Context, start, end string) iter.Seq2[types.Application, error] {
+	return func(yield func(types.Application, error) bool) {}
+}
+
+func (m *mockAuthServer) GetNodes(ctx context.Context, namespace string) ([]types.Server, error) {
+	return nil, nil
+}
+
+func (m *mockAuthServer) EnrollEKSClusters(ctx context.Context, req *integrationpb.EnrollEKSClustersRequest, opts ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
+	return m.enrollEKSClusters(ctx, req, opts...)
+}
+
+func (m *mockAuthServer) AcquireSemaphore(ctx context.Context, params types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error) {
+	return &types.SemaphoreLease{
+		Expires: time.Now().Add(10 * time.Minute),
+	}, nil
+}
+
+func (m *mockAuthServer) CancelSemaphoreLease(ctx context.Context, lease types.SemaphoreLease) error {
+	return nil
+}
+
+func (m *mockAuthServer) GetUserTask(ctx context.Context, name string) (*usertasksv1.UserTask, error) {
+	if task, ok := m.storeUserTasks[name]; ok {
+		return task, nil
+	}
+	return nil, trace.NotFound("user task %q not found", name)
+}
+
+func (m *mockAuthServer) UpsertUserTask(ctx context.Context, req *usertasksv1.UserTask) (*usertasksv1.UserTask, error) {
+	m.storeUserTasks[req.GetMetadata().GetName()] = req
+	return req, nil
+}
+
+type mockEKSClusterEnroller struct {
+	resp *integrationpb.EnrollEKSClustersResponse
+	err  error
+}
+
+func (m *mockEKSClusterEnroller) EnrollEKSClusters(ctx context.Context, req *integrationpb.EnrollEKSClustersRequest, opt ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
+	ret := &integrationpb.EnrollEKSClustersResponse{
+		Results: []*integrationpb.EnrollEKSClusterResult{},
+	}
+	// Filter out non-requested clusters.
+	for _, clusterName := range req.EksClusterNames {
+		for _, mockClusterResult := range m.resp.Results {
+			if clusterName == mockClusterResult.EksClusterName {
+				ret.Results = append(ret.Results, mockClusterResult)
+			}
+		}
+	}
+	return ret, m.err
+}
diff --git a/lib/srv/discovery/discovery_test.go b/lib/srv/discovery/discovery_test.go
index 07eb8aed07fe3..ecd2388e5d3c6 100644
--- a/lib/srv/discovery/discovery_test.go
+++ b/lib/srv/discovery/discovery_test.go
@@ -78,24 +78,32 @@ import (
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
+	"github.com/gravitational/teleport/lib/cloud/gcp/gcptest"
 	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	libevents "github.com/gravitational/teleport/lib/events"
+	libstream "github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers/db"
 	"github.com/gravitational/teleport/lib/srv/server"
 	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	libutils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
 func TestMain(m *testing.M) {
@@ -240,6 +248,18 @@ func TestDiscoveryServer(t *testing.T) {
 			},
 		}},
 	}
+	staticMatcherUsingManagedSSMDoc := Matchers{
+		AWS: []types.AWSMatcher{{
+			Types:   []string{"ec2"},
+			Regions: []string{"eu-central-1"},
+			Tags:    map[string]utils.Strings{"teleport": {"yes"}},
+			SSM:     &types.AWSSSM{DocumentName: "AWS-RunShellScript"},
+			Params: &types.InstallerParams{
+				InstallTeleport: true,
+				EnrollMode:      types.InstallParamEnrollMode_INSTALL_PARAM_ENROLL_MODE_SCRIPT,
+			},
+		}},
+	}
 
 	defaultDiscoveryConfig, err := discoveryconfig.NewDiscoveryConfig(
 		header.Metadata{Name: uuid.NewString()},
@@ -313,55 +333,14 @@ func TestDiscoveryServer(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	discoveryConfigForUserTaskEKSTestName := uuid.NewString()
-	discoveryConfigForUserTaskEKSTest, err := discoveryconfig.NewDiscoveryConfig(
-		header.Metadata{Name: discoveryConfigForUserTaskEKSTestName},
-		discoveryconfig.Spec{
-			DiscoveryGroup: defaultDiscoveryGroup,
-			AWS: []types.AWSMatcher{{
-				Types:       []string{"eks"},
-				Regions:     []string{"eu-west-2"},
-				Tags:        map[string]utils.Strings{"RunDiscover": {"Please"}},
-				Integration: "my-integration",
-			}},
-		},
-	)
-	require.NoError(t, err)
-
-	discoveryConfigWithAndWithoutAppDiscoveryTestName := uuid.NewString()
-	discoveryConfigWithAndWithoutAppDiscovery, err := discoveryconfig.NewDiscoveryConfig(
-		header.Metadata{Name: discoveryConfigWithAndWithoutAppDiscoveryTestName},
-		discoveryconfig.Spec{
-			DiscoveryGroup: defaultDiscoveryGroup,
-			AWS: []types.AWSMatcher{
-				{
-					Types:            []string{"eks"},
-					Regions:          []string{"eu-west-2"},
-					Tags:             map[string]utils.Strings{"EnableAppDiscovery": {"No"}},
-					Integration:      "my-integration",
-					KubeAppDiscovery: false,
-				},
-				{
-					Types:            []string{"eks"},
-					Regions:          []string{"eu-west-2"},
-					Tags:             map[string]utils.Strings{"EnableAppDiscovery": {"Yes"}},
-					Integration:      "my-integration",
-					KubeAppDiscovery: true,
-				},
-			},
-		},
-	)
-	require.NoError(t, err)
-
 	tcs := []struct {
-		name string
+		name          string
+		requiresProxy bool
 		// presentInstances is a list of servers already present in teleport.
 		presentInstances          []types.Server
 		foundEC2Instances         []ec2types.Instance
 		ssm                       *mockSSMClient
 		emitter                   *mockEmitter
-		eksClusters               []*ekstypes.Cluster
-		eksEnroller               eksClustersEnroller
 		discoveryConfig           *discoveryconfig.DiscoveryConfig
 		staticMatchers            Matchers
 		wantInstalledInstances    []string
@@ -415,6 +394,88 @@ func TestDiscoveryServer(t *testing.T) {
 			staticMatchers:         defaultStaticMatcher,
 			wantInstalledInstances: []string{"instance-id-1"},
 		},
+		{
+			name:             "no nodes present, 1 found, using the pre-defined SSM-RunShellScript",
+			requiresProxy:    true,
+			presentInstances: []types.Server{},
+			foundEC2Instances: []ec2types.Instance{
+				{
+					InstanceId: aws.String("instance-id-1"),
+					Tags: []ec2types.Tag{{
+						Key:   aws.String("env"),
+						Value: aws.String("dev"),
+					}},
+					State: &ec2types.InstanceState{
+						Name: ec2types.InstanceStateNameRunning,
+					},
+				},
+			},
+			ssm: &mockSSMClient{
+				commandOutput: &ssm.SendCommandOutput{
+					Command: &ssmtypes.Command{
+						CommandId: aws.String("command-id-1"),
+					},
+				},
+				invokeOutput: &ssm.GetCommandInvocationOutput{
+					Status:       ssmtypes.CommandInvocationStatusSuccess,
+					ResponseCode: 0,
+				},
+			},
+			emitter: &mockEmitter{
+				eventHandler: func(t *testing.T, ae events.AuditEvent, server *Server) {
+					t.Helper()
+					require.Equal(t, &events.SSMRun{
+						Metadata: events.Metadata{
+							Type: libevents.SSMRunEvent,
+							Code: libevents.SSMRunSuccessCode,
+						},
+						CommandID:  "command-id-1",
+						AccountID:  "owner",
+						InstanceID: "instance-id-1",
+						Region:     "eu-central-1",
+						ExitCode:   0,
+						Status:     string(ssmtypes.CommandInvocationStatusSuccess),
+					}, ae)
+				},
+			},
+			staticMatchers:         staticMatcherUsingManagedSSMDoc,
+			wantInstalledInstances: []string{"instance-id-1"},
+		},
+		{
+			name:             "fails if proxy address is not available when using AWS-RunShellScript",
+			requiresProxy:    false,
+			presentInstances: []types.Server{},
+			foundEC2Instances: []ec2types.Instance{
+				{
+					InstanceId: aws.String("instance-id-1"),
+					Tags: []ec2types.Tag{{
+						Key:   aws.String("env"),
+						Value: aws.String("dev"),
+					}},
+					State: &ec2types.InstanceState{
+						Name: ec2types.InstanceStateNameRunning,
+					},
+				},
+			},
+			ssm: &mockSSMClient{
+				commandOutput: &ssm.SendCommandOutput{
+					Command: &ssmtypes.Command{
+						CommandId: aws.String("command-id-1"),
+					},
+				},
+				invokeOutput: &ssm.GetCommandInvocationOutput{
+					Status:       ssmtypes.CommandInvocationStatusSuccess,
+					ResponseCode: 0,
+				},
+			},
+			emitter: &mockEmitter{
+				eventHandler: func(t *testing.T, ae events.AuditEvent, server *Server) {
+					t.Helper()
+				},
+			},
+			staticMatchers:         staticMatcherUsingManagedSSMDoc,
+			wantInstalledInstances: []string{},
+		},
 		{
 			name: "nodes present, instance filtered",
 			presentInstances: []types.Server{
@@ -718,139 +779,6 @@ func TestDiscoveryServer(t *testing.T) {
 				require.Equal(t, defaultDiscoveryGroup, taskInstance.DiscoveryGroup)
 			},
 		},
-		{
-			name:              "multiple EKS clusters failed to autoenroll and user tasks are created",
-			presentInstances:  []types.Server{},
-			foundEC2Instances: []ec2types.Instance{},
-			ssm:               &mockSSMClient{},
-			eksClusters: []*ekstypes.Cluster{
-				{
-					Name:   aws.String("cluster01"),
-					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster01"),
-					Status: ekstypes.ClusterStatusActive,
-					Tags: map[string]string{
-						"RunDiscover": "Please",
-					},
-				},
-				{
-					Name:   aws.String("cluster02"),
-					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster02"),
-					Status: ekstypes.ClusterStatusActive,
-					Tags: map[string]string{
-						"RunDiscover": "Please",
-					},
-				},
-			},
-			eksEnroller: &mockEKSClusterEnroller{
-				resp: &integrationpb.EnrollEKSClustersResponse{
-					Results: []*integrationpb.EnrollEKSClusterResult{
-						{
-							EksClusterName: "cluster01",
-							Error:          "access endpoint is not reachable",
-							IssueType:      "eks-cluster-unreachable",
-						},
-						{
-							EksClusterName: "cluster02",
-							Error:          "access endpoint is not reachable",
-							IssueType:      "eks-cluster-unreachable",
-						},
-					},
-				},
-				err: nil,
-			},
-			emitter:                &mockEmitter{},
-			staticMatchers:         Matchers{},
-			discoveryConfig:        discoveryConfigForUserTaskEKSTest,
-			wantInstalledInstances: []string{},
-			userTasksDiscoverCheck: func(t *testing.T, userTasksClt services.UserTasks) {
-				atLeastOneUserTask := 1
-				atLeastTwoTaskItems := 2
-				existingTasks := fetchAllUserTasks(t, userTasksClt, atLeastOneUserTask, atLeastTwoTaskItems)
-				existingTask := existingTasks[0]
-
-				require.Equal(t, "OPEN", existingTask.GetSpec().State)
-				require.Equal(t, "my-integration", existingTask.GetSpec().Integration)
-				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
-				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
-				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
-
-				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
-				require.Contains(t, taskClusters, "cluster01")
-				taskCluster := taskClusters["cluster01"]
-
-				require.Equal(t, "cluster01", taskCluster.Name)
-				require.Equal(t, discoveryConfigForUserTaskEKSTestName, taskCluster.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
-			},
-		},
-		{
-			name:              "multiple EKS clusters with different KubeAppDiscovery setting failed to autoenroll and user tasks are created",
-			presentInstances:  []types.Server{},
-			foundEC2Instances: []ec2types.Instance{},
-			ssm:               &mockSSMClient{},
-			eksClusters: []*ekstypes.Cluster{
-				{
-					Name:   aws.String("cluster01"),
-					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster01"),
-					Status: ekstypes.ClusterStatusActive,
-					Tags: map[string]string{
-						"EnableAppDiscovery": "Yes",
-					},
-				},
-				{
-					Name:   aws.String("cluster02"),
-					Arn:    aws.String("arn:aws:eks:us-west-2:123456789012:cluster/cluster02"),
-					Status: ekstypes.ClusterStatusActive,
-					Tags: map[string]string{
-						"EnableAppDiscovery": "No",
-					},
-				},
-			},
-			eksEnroller: &mockEKSClusterEnroller{
-				resp: &integrationpb.EnrollEKSClustersResponse{
-					Results: []*integrationpb.EnrollEKSClusterResult{
-						{
-							EksClusterName: "cluster01",
-							Error:          "access endpoint is not reachable",
-							IssueType:      "eks-cluster-unreachable",
-						},
-						{
-							EksClusterName: "cluster02",
-							Error:          "access endpoint is not reachable",
-							IssueType:      "eks-cluster-unreachable",
-						},
-					},
-				},
-				err: nil,
-			},
-			emitter:                &mockEmitter{},
-			staticMatchers:         Matchers{},
-			discoveryConfig:        discoveryConfigWithAndWithoutAppDiscovery,
-			wantInstalledInstances: []string{},
-			userTasksDiscoverCheck: func(t *testing.T, userTasksClt services.UserTasks) {
-				atLeastOneUserTask := 2
-				atLeastTwoTaskItems := 2
-				existingTasks := fetchAllUserTasks(t, userTasksClt, atLeastOneUserTask, atLeastTwoTaskItems)
-				existingTask := existingTasks[0]
-				if existingTask.Spec.DiscoverEks.AppAutoDiscover == false {
-					existingTask = existingTasks[1]
-				}
-
-				require.Equal(t, "OPEN", existingTask.GetSpec().State)
-				require.Equal(t, "my-integration", existingTask.GetSpec().Integration)
-				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
-				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
-				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
-
-				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
-				require.Contains(t, taskClusters, "cluster01")
-				taskCluster := taskClusters["cluster01"]
-
-				require.Equal(t, "cluster01", taskCluster.Name)
-				require.Equal(t, discoveryConfigWithAndWithoutAppDiscoveryTestName, taskCluster.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
-			},
-		},
 	}
 
 	for _, tc := range tcs {
@@ -870,12 +798,25 @@ func TestDiscoveryServer(t *testing.T) {
 			}
 
 			// Create and start test auth server.
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, testAuthServer.Close()) })
 
+			if tc.requiresProxy {
+				err = testAuthServer.AuthServer.UpsertProxy(ctx, &types.ServerV2{
+					Kind: types.KindProxy,
+					Metadata: types.Metadata{
+						Name: "proxy",
+					},
+					Spec: types.ServerSpecV2{
+						PublicAddrs: []string{"proxy.example.com:443"},
+					},
+				})
+				require.NoError(t, err)
+			}
+
 			awsOIDCIntegration, err := types.NewIntegrationAWSOIDC(types.Metadata{
 				Name: "my-integration",
 			}, &types.AWSOIDCIntegrationSpecV1{
@@ -896,7 +837,7 @@ func TestDiscoveryServer(t *testing.T) {
 			require.NoError(t, err)
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -906,7 +847,7 @@ func TestDiscoveryServer(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			logger := libutils.NewSlogLoggerForTests()
+			logger := logtest.NewLogger()
 
 			reporter := &mockUsageReporter{}
 			installer := &mockSSMInstaller{
@@ -920,11 +861,6 @@ func TestDiscoveryServer(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			var eksEnroller eksClustersEnroller = authClient.IntegrationAWSOIDCClient()
-			if tc.eksEnroller != nil {
-				eksEnroller = tc.eksEnroller
-			}
-
 			fakeConfigProvider := mocks.AWSConfigProvider{
 				OIDCIntegrationClient: tlsServer.Auth(),
 			}
@@ -938,11 +874,10 @@ func TestDiscoveryServer(t *testing.T) {
 				AWSConfigProvider: &fakeConfigProvider,
 				AWSFetchersClients: &mockFetchersClients{
 					AWSConfigProvider: fakeConfigProvider,
-					eksClusters:       tc.eksClusters,
 				},
 				ClusterFeatures:  func() proto.Features { return proto.Features{} },
-				KubernetesClient: fake.NewSimpleClientset(),
-				AccessPoint:      getDiscoveryAccessPointWithEKSEnroller(tlsServer.Auth(), authClient, eksEnroller),
+				KubernetesClient: fake.NewClientset(),
+				AccessPoint:      getDiscoveryAccessPointWithEKSEnroller(tlsServer.Auth(), authClient, authClient.IntegrationAWSOIDCClient()),
 				Matchers:         tc.staticMatchers,
 				Emitter:          tc.emitter,
 				Log:              logger,
@@ -1039,7 +974,7 @@ func fetchAllUserTasks(t *testing.T, userTasksClt services.UserTasks, minUserTas
 func TestDiscoveryServerConcurrency(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	logger := libutils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	defaultDiscoveryGroup := "dg01"
 	awsMatcher := types.AWSMatcher{
@@ -1060,8 +995,6 @@ func TestDiscoveryServerConcurrency(t *testing.T) {
 		},
 	}
 
-	testCloudClients := &cloud.TestCloudClients{}
-
 	ec2Client := &mockEC2Client{
 		output: &ec2.DescribeInstancesOutput{
 			Reservations: []ec2types.Reservation{
@@ -1091,7 +1024,7 @@ func TestDiscoveryServerConcurrency(t *testing.T) {
 	}
 
 	// Create and start test auth server.
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
@@ -1102,7 +1035,7 @@ func TestDiscoveryServerConcurrency(t *testing.T) {
 	t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 	// Auth client for discovery service.
-	identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+	identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 	authClient, err := tlsServer.NewClient(identity)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -1113,10 +1046,9 @@ func TestDiscoveryServerConcurrency(t *testing.T) {
 
 	// Create Server1
 	server1, err := New(authz.ContextWithUser(ctx, identity.I), &Config{
-		CloudClients:     testCloudClients,
 		GetEC2Client:     getEC2Client,
 		ClusterFeatures:  func() proto.Features { return proto.Features{} },
-		KubernetesClient: fake.NewSimpleClientset(),
+		KubernetesClient: fake.NewClientset(),
 		AccessPoint:      getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 		Matchers:         staticMatcher,
 		Emitter:          emitter,
@@ -1127,10 +1059,9 @@ func TestDiscoveryServerConcurrency(t *testing.T) {
 
 	// Create Server2
 	server2, err := New(authz.ContextWithUser(ctx, identity.I), &Config{
-		CloudClients:     testCloudClients,
 		GetEC2Client:     getEC2Client,
 		ClusterFeatures:  func() proto.Features { return proto.Features{} },
-		KubernetesClient: fake.NewSimpleClientset(),
+		KubernetesClient: fake.NewClientset(),
 		AccessPoint:      getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 		Matchers:         staticMatcher,
 		Emitter:          emitter,
@@ -1203,7 +1134,11 @@ func TestDiscoveryKubeServices(t *testing.T) {
 	mockKubeServices := []*corev1.Service{
 		newMockKubeService("service1", "ns1", "",
 			map[string]string{"test-label": "testval"},
-			map[string]string{types.DiscoveryPublicAddr: "custom.example.com", types.DiscoveryPathLabel: "foo/bar baz"},
+			map[string]string{
+				types.DiscoveryPublicAddr:  "custom.example.com",
+				types.DiscoveryPathLabel:   "foo/bar baz",
+				types.DiscoveryDescription: "example description",
+			},
 			[]corev1.ServicePort{{Port: 42, Name: "http", Protocol: corev1.ProtocolTCP}}),
 		newMockKubeService("service2", "ns2", "",
 			map[string]string{
@@ -1299,7 +1234,7 @@ func TestDiscoveryKubeServices(t *testing.T) {
 
 			ctx := context.Background()
 			// Create and start test auth server.
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -1310,7 +1245,7 @@ func TestDiscoveryKubeServices(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 			// Auth client for discovery service.
-			authClient, err := tlsServer.NewClient(auth.TestServerID(types.RoleDiscovery, "hostID"))
+			authClient, err := tlsServer.NewClient(authtest.TestServerID(types.RoleDiscovery, "hostID"))
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
 
@@ -1327,9 +1262,8 @@ func TestDiscoveryKubeServices(t *testing.T) {
 			discServer, err := New(
 				ctx,
 				&Config{
-					CloudClients:     &cloud.TestCloudClients{},
 					ClusterFeatures:  func() proto.Features { return proto.Features{} },
-					KubernetesClient: fake.NewSimpleClientset(objects...),
+					KubernetesClient: fake.NewClientset(objects...),
 					AccessPoint:      getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 					Matchers: Matchers{
 						Kubernetes: tt.kubernetesMatchers,
@@ -1341,9 +1275,7 @@ func TestDiscoveryKubeServices(t *testing.T) {
 
 			require.NoError(t, err)
 
-			t.Cleanup(func() {
-				discServer.Stop()
-			})
+			t.Cleanup(discServer.Stop)
 			go discServer.Start()
 
 			require.EventuallyWithT(t, func(t *assert.CollectT) {
@@ -1366,6 +1298,75 @@ func TestDiscoveryKubeServices(t *testing.T) {
 	}
 }
 
+// TestDiscoveryKubeServicesInterval tests that the poll interval is honored for Kube App Discovery.
+func TestDiscoveryKubeServicesInterval(t *testing.T) {
+	const mainDiscoveryGroup = "main"
+
+	mockKubeServices := []*corev1.Service{
+		newMockKubeService("service1", "ns1", "",
+			map[string]string{"test-label": "testval"},
+			nil,
+			[]corev1.ServicePort{{Port: 42, Name: "http", Protocol: corev1.ProtocolTCP}}),
+		newMockKubeService("service2", "ns2", "",
+			map[string]string{"test-label": "testval"},
+			nil,
+			[]corev1.ServicePort{{Port: 42, Name: "http", Protocol: corev1.ProtocolTCP}}),
+	}
+
+	// Kubernetes app discovery matcher
+	kubernetesMatchers := []types.KubernetesMatcher{
+		{
+			Types:      []string{"app"},
+			Namespaces: []string{types.Wildcard},
+			Labels:     map[string]utils.Strings{"test-label": {"testval"}},
+		},
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+
+		fakeKubeClient := fake.NewClientset(mockKubeServices[0])
+
+		bk, err := memory.New(memory.Config{})
+		require.NoError(t, err)
+		mockAccessPoint := &mockAuthServer{
+			events: local.NewEventsService(bk),
+		}
+
+		const pollInterval = 1 * time.Minute
+		discServer, err := New(ctx,
+			&Config{
+				ClusterFeatures:  func() proto.Features { return proto.Features{} },
+				KubernetesClient: fakeKubeClient,
+				AccessPoint:      mockAccessPoint,
+				Matchers: Matchers{
+					Kubernetes: kubernetesMatchers,
+				},
+				Emitter:        &mockEmitter{},
+				DiscoveryGroup: mainDiscoveryGroup,
+				PollInterval:   pollInterval,
+			})
+		require.NoError(t, err)
+
+		t.Cleanup(discServer.Stop)
+		go discServer.Start()
+
+		// Wait for discovery server to complete one iteration of discovering resources
+		synctest.Wait()
+
+		// Mock access point implementation does not actually create the app resource, but usage event is still logged
+		require.Len(t, mockAccessPoint.usageEvents, 1)
+
+		// Create new Kube service to be discovered by discServer
+		fakeKubeClient.CoreV1().Services("ns2").Create(ctx, mockKubeServices[1], v1.CreateOptions{})
+
+		time.Sleep(pollInterval)
+		synctest.Wait()
+
+		require.Len(t, mockAccessPoint.usageEvents, 2)
+	})
+}
+
 func TestDiscoveryInCloudKube(t *testing.T) {
 	t.Parallel()
 
@@ -1547,13 +1548,14 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 					Regions:        []string{types.Wildcard},
 					ResourceGroups: []string{types.Wildcard},
 					Subscriptions:  []string{"sub1"},
+					Integration:    "dummy-azure-integration",
 				},
 			},
 			expectedClustersToExistInAuth: []types.KubeCluster{
 				mustConvertEKSToKubeCluster(t, eksMockClusters[0], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup}),
 				mustConvertEKSToKubeCluster(t, eksMockClusters[1], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup}),
-				mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][0], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup}),
-				mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][1], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup}),
+				mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][0], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup, integration: "dummy-azure-integration"}),
+				mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][1], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup, integration: "dummy-azure-integration"}),
 			},
 			clustersNotUpdated: []string{mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][0], rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup}).GetName()},
 			wantEvents:         2,
@@ -1599,15 +1601,20 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			testCloudClients := &cloud.TestCloudClients{
-				AzureAKSClient: newPopulatedAKSMock(),
-				GCPGKE:         newPopulatedGCPMock(),
-				GCPProjects:    newPopulatedGCPProjectsMock(),
+			initAzureClients := func(opts ...azure.ClientsOption) (azure.Clients, error) {
+				return &azuretest.Clients{
+					AzureAKSClient: newPopulatedAKSMock(),
+				}, nil
+			}
+
+			gcpClients := &gcptest.Clients{
+				GCPGKE:      newPopulatedGCPMock(),
+				GCPProjects: newPopulatedGCPProjectsMock(),
 			}
 
 			ctx := context.Background()
 			// Create and start test auth server.
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -1618,7 +1625,7 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -1634,7 +1641,7 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 				require.NoError(t, r.Close())
 				require.NoError(t, w.Close())
 			})
-			logger := libutils.NewSlogLoggerForTests()
+			logger := logtest.NewLogger()
 
 			clustersNotUpdated := make(chan string, 10)
 			go func() {
@@ -1673,10 +1680,11 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 			discServer, err := New(
 				authz.ContextWithUser(ctx, identity.I),
 				&Config{
-					CloudClients:       testCloudClients,
+					initAzureClients:   initAzureClients,
+					gcpClients:         gcpClients,
 					AWSFetchersClients: mockedClients,
 					ClusterFeatures:    func() proto.Features { return proto.Features{} },
-					KubernetesClient:   fake.NewSimpleClientset(),
+					KubernetesClient:   fake.NewClientset(),
 					AccessPoint:        getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 					Matchers: Matchers{
 						AWS:   tc.awsMatchers,
@@ -1689,12 +1697,12 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 				})
 			require.NoError(t, err)
 
+			require.NoError(t, discServer.Start())
 			t.Cleanup(discServer.Stop)
-			go discServer.Start()
 
 			clustersNotUpdatedMap := sliceToSet(tc.clustersNotUpdated)
 			clustersFoundInAuth := false
-			require.Eventually(t, func() bool {
+			require.EventuallyWithT(t, func(c *assert.CollectT) {
 			loop:
 				for {
 					select {
@@ -1705,13 +1713,13 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 						delete(clustersNotUpdatedMap, cluster)
 					default:
 						kubeClusters, err := tlsServer.Auth().GetKubernetesClusters(ctx)
-						require.NoError(t, err)
+						require.NoError(c, err)
 						if len(kubeClusters) == len(tc.expectedClustersToExistInAuth) {
-							c1 := types.KubeClusters(kubeClusters).ToMap()
-							c2 := types.KubeClusters(tc.expectedClustersToExistInAuth).ToMap()
+							c1 := types.KubeClusters(tc.expectedClustersToExistInAuth).ToMap()
+							c2 := types.KubeClusters(kubeClusters).ToMap()
 							for k := range c1 {
 								if services.CompareResources(c1[k], c2[k]) != services.Equal {
-									return false
+									require.Equal(c, c1[k], c2[k], "expected no differences")
 								}
 							}
 							clustersFoundInAuth = true
@@ -1719,7 +1727,8 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 						break loop
 					}
 				}
-				return len(clustersNotUpdated) == 0 && clustersFoundInAuth
+				require.Empty(c, clustersNotUpdated)
+				require.True(c, clustersFoundInAuth)
 			}, 5*time.Second, 200*time.Millisecond)
 
 			require.ElementsMatch(t, tc.expectedAssumedRoles, mockedClients.STSClient.GetAssumedRoleARNs(), "roles incorrectly assumed")
@@ -1734,6 +1743,15 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 					return reporter.ResourceCreateEventCount() != 0
 				}, time.Second, 100*time.Millisecond)
 			}
+
+			// verify usage of integration credentials.
+			for _, matcher := range tc.azureMatchers {
+				require.NotNil(t, discServer.azureClientCache)
+				_, err = libutils.FnCacheGet(t.Context(), discServer.azureClientCache, matcher.Integration, func(ctx context.Context) (azure.Clients, error) {
+					return nil, trace.NotFound("cache key %q not found", matcher.Integration)
+				})
+				require.NoError(t, err)
+			}
 		})
 	}
 }
@@ -2056,6 +2074,11 @@ func mustConvertKubeServiceToApp(t *testing.T, discoveryGroup, protocol string,
 	app, err := services.NewApplicationFromKubeService(*kubeService, discoveryGroup, protocol, port)
 	require.NoError(t, err)
 	require.Equal(t, kubeService.Annotations[types.DiscoveryPublicAddr], app.GetPublicAddr())
+
+	if desc, ok := kubeService.Annotations[types.DiscoveryDescription]; ok {
+		require.Equal(t, desc, app.GetMetadata().Description)
+	}
+
 	if p, ok := kubeService.Annotations[types.DiscoveryPathLabel]; ok {
 		components := strings.Split(p, "/")
 		for i := range components {
@@ -2170,6 +2193,10 @@ func (m *mockGKEAPI) ListClusters(ctx context.Context, projectID string, locatio
 	return clusters, nil
 }
 
+type UserTaskLister interface {
+	ListUserTasks(ctx context.Context, pageSize int64, nextToken string, filters *usertasksv1.ListUserTasksFilters) ([]*usertasksv1.UserTask, string, error)
+}
+
 func TestDiscoveryDatabase(t *testing.T) {
 	const (
 		mainDiscoveryGroup  = "main"
@@ -2182,6 +2209,10 @@ func TestDiscoveryDatabase(t *testing.T) {
 	_, awsRedshiftDBWithDiscoveryConfig := makeRedshiftCluster(t, "aws-redshift", "us-east-1", rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup, discoveryConfigName: discoveryConfigName})
 	awsRDSInstance, awsRDSDB := makeRDSInstance(t, "aws-rds", "us-west-1", rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup})
 	azRedisResource, azRedisDB := makeAzureRedisServer(t, "az-redis", "sub1", "group1", "East US", rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup})
+
+	azRedisDBWithIntegration := azRedisDB.Copy()
+	rewriteCloudResource(t, azRedisDBWithIntegration, rewriteDiscoveryLabelsParams{integration: integrationName})
+
 	_, azRedisDBWithDiscoveryConfig := makeAzureRedisServer(t, "az-redis", "sub1", "group1", "East US", rewriteDiscoveryLabelsParams{discoveryGroup: mainDiscoveryGroup, discoveryConfigName: discoveryConfigName})
 
 	role := types.AssumeRole{RoleARN: "arn:aws:iam::123456789012:role/test-role", ExternalID: "test123"}
@@ -2210,7 +2241,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 		return dc
 	}
 
-	testCloudClients := &cloud.TestCloudClients{
+	azureClients := &azuretest.Clients{
 		AzureRedis: azure.NewRedisClientByAPI(&azure.ARMRedisMock{
 			Servers: []*armredis.ResourceInfo{azRedisResource},
 		}),
@@ -2228,9 +2259,9 @@ func TestDiscoveryDatabase(t *testing.T) {
 		azureMatchers                          []types.AzureMatcher
 		expectDatabases                        []types.Database
 		discoveryConfigs                       func(*testing.T) []*discoveryconfig.DiscoveryConfig
-		discoveryConfigStatusCheck             func(*testing.T, discoveryconfig.Status)
+		discoveryConfigStatusCheck             func(*assert.CollectT, discoveryconfig.Status)
 		discoveryConfigStatusExpectedResources int
-		userTasksCheck                         func(*testing.T, []*usertasksv1.UserTask)
+		userTasksCheck                         func(*testing.T, UserTaskLister)
 		wantEvents                             int
 	}{
 		{
@@ -2266,6 +2297,20 @@ func TestDiscoveryDatabase(t *testing.T) {
 			expectDatabases: []types.Database{azRedisDB},
 			wantEvents:      1,
 		},
+		{
+			name: "discover Azure database with integration",
+			azureMatchers: []types.AzureMatcher{{
+				Types:          []string{types.AzureMatcherRedis},
+				ResourceTags:   map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
+				Regions:        []string{types.Wildcard},
+				ResourceGroups: []string{types.Wildcard},
+				Subscriptions:  []string{"sub1"},
+				Integration:    integrationName,
+			}},
+			expectDatabases:             []types.Database{azRedisDBWithIntegration},
+			wantEvents:                  1,
+			integrationsOnlyCredentials: true,
+		},
 		{
 			name: "update existing database",
 			existingDatabases: []types.Database{
@@ -2429,7 +2474,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 				return []*discoveryconfig.DiscoveryConfig{dc1}
 			},
 			wantEvents: 1,
-			discoveryConfigStatusCheck: func(t *testing.T, s discoveryconfig.Status) {
+			discoveryConfigStatusCheck: func(t *assert.CollectT, s discoveryconfig.Status) {
 				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.Enrolled)
 				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.Found)
 				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsRds.Failed)
@@ -2463,7 +2508,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 			},
 			expectDatabases: []types.Database{},
 			wantEvents:      0,
-			discoveryConfigStatusCheck: func(t *testing.T, s discoveryconfig.Status) {
+			discoveryConfigStatusCheck: func(t *assert.CollectT, s discoveryconfig.Status) {
 				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsEks.Found)
 				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsEks.Enrolled)
 			},
@@ -2485,7 +2530,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 			},
 			expectDatabases: []types.Database{},
 			wantEvents:      0,
-			discoveryConfigStatusCheck: func(t *testing.T, s discoveryconfig.Status) {
+			discoveryConfigStatusCheck: func(t *assert.CollectT, s discoveryconfig.Status) {
 				require.Equal(t, "DISCOVERY_CONFIG_STATE_SYNCING", s.State)
 			},
 			discoveryConfigStatusExpectedResources: 0,
@@ -2505,9 +2550,18 @@ func TestDiscoveryDatabase(t *testing.T) {
 			},
 			expectDatabases: []types.Database{awsRDSDBWithIntegration},
 			wantEvents:      1,
-			userTasksCheck: func(t *testing.T, uts []*usertasksv1.UserTask) {
-				require.Len(t, uts, 1)
-				gotUserTask := uts[0]
+			userTasksCheck: func(t *testing.T, lister UserTaskLister) {
+				var gotUserTask *usertasksv1.UserTask
+				require.EventuallyWithT(t, func(t *assert.CollectT) {
+					uts, err := libstream.Collect(clientutils.Resources(context.Background(), func(ctx context.Context, i int, s string) ([]*usertasksv1.UserTask, string, error) {
+						return lister.ListUserTasks(ctx, int64(i), s, nil)
+					}))
+					require.NoError(t, err)
+					require.Len(t, uts, 1)
+
+					gotUserTask = uts[0]
+				}, 10*time.Second, 100*time.Millisecond)
+
 				require.Equal(t, "3ae76664-b54d-5b74-b59a-bd7bff3be053", gotUserTask.GetMetadata().GetName())
 				require.Equal(t, "OPEN", gotUserTask.GetSpec().GetState())
 				require.Equal(t, "discover-rds", gotUserTask.GetSpec().GetTaskType())
@@ -2538,7 +2592,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 			t.Cleanup(cancel)
 
 			// Create and start test auth server.
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -2566,7 +2620,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 			require.NoError(t, err)
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -2610,9 +2664,11 @@ func TestDiscoveryDatabase(t *testing.T) {
 						AWSConfigProvider: *fakeConfigProvider,
 						eksClusters:       []*ekstypes.Cluster{eksAWSResource},
 					},
-					CloudClients:              testCloudClients,
+					initAzureClients: func(opts ...azure.ClientsOption) (azure.Clients, error) {
+						return azureClients, nil
+					},
 					ClusterFeatures:           func() proto.Features { return proto.Features{} },
-					KubernetesClient:          fake.NewSimpleClientset(),
+					KubernetesClient:          fake.NewClientset(),
 					AccessPoint:               getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 					AWSDatabaseFetcherFactory: dbFetcherFactory,
 					AWSConfigProvider:         fakeConfigProvider,
@@ -2645,8 +2701,8 @@ func TestDiscoveryDatabase(t *testing.T) {
 				}, 1*time.Second, 100*time.Millisecond)
 			}
 
+			require.NoError(t, srv.Start())
 			t.Cleanup(srv.Stop)
-			go srv.Start()
 
 			select {
 			case <-waitForReconcile:
@@ -2660,52 +2716,42 @@ func TestDiscoveryDatabase(t *testing.T) {
 					cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 					cmpopts.IgnoreFields(types.DatabaseStatusV3{}, "CACert"),
 				))
-			case <-time.After(time.Second):
+			case <-time.After(10 * time.Second):
 				require.FailNow(t, "Didn't receive reconcile event after 1s")
 			}
 
 			if tc.wantEvents > 0 {
 				require.Eventually(t, func() bool {
 					return reporter.ResourceCreateEventCount() == tc.wantEvents
-				}, time.Second, 100*time.Millisecond)
+				}, 10*time.Second, 100*time.Millisecond)
 			} else {
 				require.Never(t, func() bool {
 					return reporter.ResourceCreateEventCount() != 0
-				}, time.Second, 100*time.Millisecond)
+				}, 10*time.Second, 100*time.Millisecond)
 			}
 
 			if tc.discoveryConfigStatusCheck != nil {
-				require.Eventually(t, func() bool {
+				require.EventuallyWithT(t, func(t *assert.CollectT) {
 					fakeClock.Advance(srv.PollInterval * 2)
 					dc, err := tlsServer.Auth().GetDiscoveryConfig(ctx, discoveryConfigName)
 					require.NoError(t, err)
-					if tc.discoveryConfigStatusExpectedResources != int(dc.Status.DiscoveredResources) {
-						return false
-					}
+					require.Equal(t, tc.discoveryConfigStatusExpectedResources, int(dc.Status.DiscoveredResources))
 
 					tc.discoveryConfigStatusCheck(t, dc.Status)
-					return true
-				}, time.Second, 100*time.Millisecond)
+				}, 10*time.Second, 100*time.Millisecond)
 
 			}
 			if tc.userTasksCheck != nil {
-				var userTasks []*usertasksv1.UserTask
-				var nextPage string
-				for {
-					filters := &usertasksv1.ListUserTasksFilters{
-						Integration: integrationName,
-					}
-					userTasksResp, nextPageResp, err := tlsServer.Auth().ListUserTasks(ctx, 0, nextPage, filters)
-					require.NoError(t, err)
-
-					userTasks = append(userTasks, userTasksResp...)
+				tc.userTasksCheck(t, tlsServer.Auth())
+			}
 
-					if nextPageResp == "" {
-						break
-					}
-					nextPage = nextPageResp
-				}
-				tc.userTasksCheck(t, userTasks)
+			// verify usage of integration credentials.
+			for _, matcher := range tc.azureMatchers {
+				require.NotNil(t, srv.azureClientCache)
+				_, err = libutils.FnCacheGet(t.Context(), srv.azureClientCache, matcher.Integration, func(ctx context.Context) (azure.Clients, error) {
+					return nil, trace.NotFound("cache key %q not found", matcher.Integration)
+				})
+				require.NoError(t, err)
 			}
 		})
 	}
@@ -2740,7 +2786,7 @@ func TestDiscoveryDatabaseRemovingDiscoveryConfigs(t *testing.T) {
 	t.Cleanup(cancel)
 
 	// Create and start test auth server.
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
@@ -2751,7 +2797,7 @@ func TestDiscoveryDatabaseRemovingDiscoveryConfigs(t *testing.T) {
 	t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 	// Auth client for discovery service.
-	identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+	identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 	authClient, err := tlsServer.NewClient(identity)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -2765,7 +2811,7 @@ func TestDiscoveryDatabaseRemovingDiscoveryConfigs(t *testing.T) {
 			AWSConfigProvider:         fakeConfigProvider,
 			AWSDatabaseFetcherFactory: dbFetcherFactory,
 			ClusterFeatures:           func() proto.Features { return proto.Features{} },
-			KubernetesClient:          fake.NewSimpleClientset(),
+			KubernetesClient:          fake.NewClientset(),
 			AccessPoint:               getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 			Matchers:                  Matchers{},
 			Emitter:                   authClient,
@@ -3007,17 +3053,33 @@ func (m *mockAzureInstaller) GetInstalledInstances() []string {
 func TestAzureVMDiscovery(t *testing.T) {
 	t.Parallel()
 
-	defaultDiscoveryGroup := "dc001"
+	const defaultDiscoveryGroup = "dc001"
+
+	const noIntegration = ""
+	const dummyIntegration = "dummy"
 
 	vmMatcherFn := func() Matchers {
 		return Matchers{
-			Azure: []types.AzureMatcher{{
-				Types:          []string{"vm"},
-				Subscriptions:  []string{"testsub"},
-				ResourceGroups: []string{"testrg"},
-				Regions:        []string{"westcentralus"},
-				ResourceTags:   types.Labels{"teleport": {"yes"}},
-			}},
+			Azure: []types.AzureMatcher{
+				{
+					Types:          []string{"vm"},
+					Subscriptions:  []string{"testsub"},
+					ResourceGroups: []string{"testrg"},
+					Regions:        []string{"westcentralus"},
+					ResourceTags:   types.Labels{"teleport": {"yes"}},
+					Params:         &types.InstallerParams{},
+					Integration:    noIntegration,
+				},
+				{
+					Types:          []string{"vm"},
+					Subscriptions:  []string{"testsub"},
+					ResourceGroups: []string{"testrg"},
+					Regions:        []string{"westcentralus"},
+					ResourceTags:   types.Labels{"teleport-integration": {"yes"}},
+					Params:         &types.InstallerParams{},
+					Integration:    dummyIntegration,
+				},
+			},
 		}
 	}
 
@@ -3034,128 +3096,88 @@ func TestAzureVMDiscovery(t *testing.T) {
 	)
 	require.NoError(t, err)
 
+	foundAzureVMs := func() []*armcompute.VirtualMachine {
+		return []*armcompute.VirtualMachine{
+			{
+				ID: aws.String((&arm.ResourceID{
+					SubscriptionID:    "testsub",
+					ResourceGroupName: "rg",
+					Name:              "testvm",
+				}).String()),
+				Name:     aws.String("testvm"),
+				Location: aws.String("westcentralus"),
+				Tags: map[string]*string{
+					"teleport": aws.String("yes"),
+				},
+				Properties: &armcompute.VirtualMachineProperties{
+					VMID: aws.String("test-vmid"),
+				},
+			},
+			{
+				ID: aws.String((&arm.ResourceID{
+					SubscriptionID:    "testsub",
+					ResourceGroupName: "rg",
+					Name:              "testvm-integration",
+				}).String()),
+				Name:     aws.String("testvm-integration"),
+				Location: aws.String("westcentralus"),
+				Tags: map[string]*string{
+					"teleport-integration": aws.String("yes"),
+				},
+				Properties: &armcompute.VirtualMachineProperties{
+					VMID: aws.String("test-vmid-integration"),
+				},
+			},
+		}
+	}
+
+	presentNode := &types.ServerV2{
+		Kind: types.KindNode,
+		Metadata: types.Metadata{
+			Name: "name",
+			Labels: map[string]string{
+				"teleport.internal/subscription-id": "testsub",
+				"teleport.internal/vm-id":           "test-vmid",
+			},
+			Namespace: defaults.Namespace,
+		},
+	}
+
+	presentNodeAlt := presentNode.DeepCopy().(*types.ServerV2)
+	presentNodeAlt.Metadata.Labels["teleport.internal/vm-id"] = "alternate-vmid"
+
 	tests := []struct {
-		name                   string
-		presentVMs             []types.Server
-		foundAzureVMs          []*armcompute.VirtualMachine
-		discoveryConfig        *discoveryconfig.DiscoveryConfig
-		staticMatchers         Matchers
-		wantInstalledInstances []string
+		name                     string
+		presentVMs               []types.Server
+		discoveryConfig          *discoveryconfig.DiscoveryConfig
+		staticMatchers           Matchers
+		wantInstalledInstances   []string
+		expectedIntegrationNames []string
 	}{
 		{
-			name:       "no nodes present, 1 found",
-			presentVMs: []types.Server{},
-			foundAzureVMs: []*armcompute.VirtualMachine{
-				{
-					ID: aws.String((&arm.ResourceID{
-						SubscriptionID:    "testsub",
-						ResourceGroupName: "rg",
-						Name:              "testvm",
-					}).String()),
-					Name:     aws.String("testvm"),
-					Location: aws.String("westcentralus"),
-					Tags: map[string]*string{
-						"teleport": aws.String("yes"),
-					},
-					Properties: &armcompute.VirtualMachineProperties{
-						VMID: aws.String("test-vmid"),
-					},
-				},
-			},
+			name:                   "no nodes present, 1 found",
+			presentVMs:             []types.Server{},
 			staticMatchers:         vmMatcherFn(),
-			wantInstalledInstances: []string{"testvm"},
+			wantInstalledInstances: []string{"testvm", "testvm-integration"},
 		},
 		{
-			name: "nodes present, instance filtered",
-			presentVMs: []types.Server{
-				&types.ServerV2{
-					Kind: types.KindNode,
-					Metadata: types.Metadata{
-						Name: "name",
-						Labels: map[string]string{
-							"teleport.internal/subscription-id": "testsub",
-							"teleport.internal/vm-id":           "test-vmid",
-						},
-						Namespace: defaults.Namespace,
-					},
-				},
-			},
-			staticMatchers: vmMatcherFn(),
-			foundAzureVMs: []*armcompute.VirtualMachine{
-				{
-					ID: aws.String((&arm.ResourceID{
-						SubscriptionID:    "testsub",
-						ResourceGroupName: "rg",
-						Name:              "testvm",
-					}).String()),
-					Location: aws.String("westcentralus"),
-					Tags: map[string]*string{
-						"teleport": aws.String("yes"),
-					},
-					Properties: &armcompute.VirtualMachineProperties{
-						VMID: aws.String("test-vmid"),
-					},
-				},
-			},
+			name:                   "nodes present, instance filtered",
+			presentVMs:             []types.Server{presentNode},
+			staticMatchers:         vmMatcherFn(),
+			wantInstalledInstances: []string{"testvm-integration"},
 		},
 		{
-			name: "nodes present, instance not filtered",
-			presentVMs: []types.Server{
-				&types.ServerV2{
-					Kind: types.KindNode,
-					Metadata: types.Metadata{
-						Name: "name",
-						Labels: map[string]string{
-							"teleport.internal/subscription-id": "testsub",
-							"teleport.internal/vm-id":           "alternate-vmid",
-						},
-						Namespace: defaults.Namespace,
-					},
-				},
-			},
-			staticMatchers: vmMatcherFn(),
-			foundAzureVMs: []*armcompute.VirtualMachine{
-				{
-					ID: aws.String((&arm.ResourceID{
-						SubscriptionID:    "testsub",
-						ResourceGroupName: "rg",
-						Name:              "testvm",
-					}).String()),
-					Name:     aws.String("testvm"),
-					Location: aws.String("westcentralus"),
-					Tags: map[string]*string{
-						"teleport": aws.String("yes"),
-					},
-					Properties: &armcompute.VirtualMachineProperties{
-						VMID: aws.String("test-vmid"),
-					},
-				},
-			},
-			wantInstalledInstances: []string{"testvm"},
+			name:                   "nodes present, instance not filtered",
+			presentVMs:             []types.Server{presentNodeAlt},
+			staticMatchers:         vmMatcherFn(),
+			wantInstalledInstances: []string{"testvm", "testvm-integration"},
 		},
 		{
-			name:       "no nodes present, 1 found using dynamic matchers",
-			presentVMs: []types.Server{},
-			foundAzureVMs: []*armcompute.VirtualMachine{
-				{
-					ID: aws.String((&arm.ResourceID{
-						SubscriptionID:    "testsub",
-						ResourceGroupName: "rg",
-						Name:              "testvm",
-					}).String()),
-					Name:     aws.String("testvm"),
-					Location: aws.String("westcentralus"),
-					Tags: map[string]*string{
-						"teleport": aws.String("yes"),
-					},
-					Properties: &armcompute.VirtualMachineProperties{
-						VMID: aws.String("test-vmid"),
-					},
-				},
-			},
+			name:                   "no nodes present, 1 found using dynamic matchers",
+			presentVMs:             []types.Server{},
 			discoveryConfig:        defaultDiscoveryConfig,
 			staticMatchers:         Matchers{},
-			wantInstalledInstances: []string{"testvm"},
+			wantInstalledInstances: []string{"testvm", "testvm-integration"},
 		},
 	}
 
@@ -3164,15 +3186,17 @@ func TestAzureVMDiscovery(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			testCloudClients := &cloud.TestCloudClients{
-				AzureVirtualMachines: &mockAzureClient{
-					vms: tc.foundAzureVMs,
-				},
-				AzureRunCommand: &mockAzureRunCommandClient{},
+			initAzureClients := func(opts ...azure.ClientsOption) (azure.Clients, error) {
+				return &azuretest.Clients{
+					AzureVirtualMachines: &mockAzureClient{
+						vms: foundAzureVMs(),
+					},
+					AzureRunCommand: &mockAzureRunCommandClient{},
+				}, nil
 			}
 
 			ctx := context.Background()
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -3183,7 +3207,7 @@ func TestAzureVMDiscovery(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -3193,7 +3217,8 @@ func TestAzureVMDiscovery(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			logger := libutils.NewSlogLoggerForTests()
+			logtest.InitLogger(func() bool { return true })
+			logger := logtest.NewLogger()
 
 			emitter := &mockEmitter{}
 			reporter := &mockUsageReporter{}
@@ -3202,9 +3227,9 @@ func TestAzureVMDiscovery(t *testing.T) {
 			}
 			tlsServer.Auth().SetUsageReporter(reporter)
 			server, err := New(authz.ContextWithUser(context.Background(), identity.I), &Config{
-				CloudClients:     testCloudClients,
+				initAzureClients: initAzureClients,
 				ClusterFeatures:  func() proto.Features { return proto.Features{} },
-				KubernetesClient: fake.NewSimpleClientset(),
+				KubernetesClient: fake.NewClientset(),
 				AccessPoint:      getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 				Matchers:         tc.staticMatchers,
 				Emitter:          emitter,
@@ -3226,22 +3251,28 @@ func TestAzureVMDiscovery(t *testing.T) {
 					server.muDynamicServerAzureFetchers.RLock()
 					defer server.muDynamicServerAzureFetchers.RUnlock()
 					return len(server.dynamicServerAzureFetchers) > 0
-				}, 1*time.Second, 100*time.Millisecond)
+				}, 1*time.Second, 50*time.Millisecond)
 			}
 
-			go server.Start()
+			require.NoError(t, server.Start())
 			t.Cleanup(server.Stop)
 
-			if len(tc.wantInstalledInstances) > 0 {
-				require.Eventually(t, func() bool {
-					instances := installer.GetInstalledInstances()
-					slices.Sort(instances)
-					return slices.Equal(tc.wantInstalledInstances, instances) && len(tc.wantInstalledInstances) == reporter.ResourceCreateEventCount()
-				}, 500*time.Millisecond, 50*time.Millisecond)
-			} else {
-				require.Never(t, func() bool {
-					return len(installer.GetInstalledInstances()) > 0 || reporter.ResourceCreateEventCount() > 0
-				}, 500*time.Millisecond, 50*time.Millisecond)
+			require.EventuallyWithT(t, func(c *assert.CollectT) {
+				require.ElementsMatch(c, tc.wantInstalledInstances, installer.GetInstalledInstances())
+
+				// all current tests install at least one VM, so this cannot be zero.
+				// multiple installations will trigger just one event.
+				const expectedEventCount = 1
+				require.Equal(c, expectedEventCount, reporter.ResourceCreateEventCount())
+			}, 500*time.Millisecond, 50*time.Millisecond)
+
+			// make sure azure client cache has expected entries
+			for _, integrationName := range tc.expectedIntegrationNames {
+				require.NotNil(t, server.azureClientCache)
+				_, err = libutils.FnCacheGet(t.Context(), server.azureClientCache, integrationName, func(ctx context.Context) (azure.Clients, error) {
+					return nil, trace.NotFound("cache key %q not found", integrationName)
+				})
+				require.NoError(t, err)
 			}
 		})
 
@@ -3387,6 +3418,7 @@ func TestGCPVMDiscovery(t *testing.T) {
 					ProjectIDs: []string{"*"},
 					Locations:  []string{"myzone"},
 					Labels:     types.Labels{"teleport": {"yes"}},
+					Params:     &types.InstallerParams{},
 				}},
 			},
 			wantInstalledInstances: []string{"myinstance1", "myinstance2"},
@@ -3472,7 +3504,7 @@ func TestGCPVMDiscovery(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			testCloudClients := &cloud.TestCloudClients{
+			gcpClients := &gcptest.Clients{
 				GCPInstances: &mockGCPClient{
 					vms: tc.foundGCPVMs,
 				},
@@ -3480,7 +3512,7 @@ func TestGCPVMDiscovery(t *testing.T) {
 			}
 
 			ctx := context.Background()
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -3491,7 +3523,7 @@ func TestGCPVMDiscovery(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -3501,7 +3533,7 @@ func TestGCPVMDiscovery(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			logger := libutils.NewSlogLoggerForTests()
+			logger := logtest.NewLogger()
 			emitter := &mockEmitter{}
 			reporter := &mockUsageReporter{}
 			installer := &mockGCPInstaller{
@@ -3509,9 +3541,9 @@ func TestGCPVMDiscovery(t *testing.T) {
 			}
 			tlsServer.Auth().SetUsageReporter(reporter)
 			server, err := New(authz.ContextWithUser(context.Background(), identity.I), &Config{
-				CloudClients:     testCloudClients,
+				gcpClients:       gcpClients,
 				ClusterFeatures:  func() proto.Features { return proto.Features{} },
-				KubernetesClient: fake.NewSimpleClientset(),
+				KubernetesClient: fake.NewClientset(),
 				AccessPoint:      getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 				Matchers:         tc.staticMatchers,
 				Emitter:          emitter,
@@ -3562,7 +3594,7 @@ func TestServer_onCreate(t *testing.T) {
 		Config: &Config{
 			DiscoveryGroup: "test-cluster",
 			AccessPoint:    accessPoint,
-			Log:            libutils.NewSlogLoggerForTests(),
+			Log:            logtest.NewLogger(),
 		},
 	}
 
@@ -3670,13 +3702,52 @@ func TestServer_onCreate(t *testing.T) {
 	})
 }
 
-func TestEmitUsageEvents(t *testing.T) {
+func TestDiscardAmbientCredentialMatchers(t *testing.T) {
 	t.Parallel()
-	testClients := cloud.TestCloudClients{
-		AzureVirtualMachines: &mockAzureClient{},
-		AzureRunCommand:      &mockAzureRunCommandClient{},
+
+	logger := logtest.NewLogger()
+
+	awsDrop := types.AWSMatcher{
+		Types:   []string{"ec2"},
+		Regions: []string{"us-west-1"},
+	}
+	awsKeep := types.AWSMatcher{
+		Types:       []string{"ec2"},
+		Regions:     []string{"us-west-2"},
+		Integration: "aws-int",
 	}
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+
+	azureDrop := types.AzureMatcher{
+		Subscriptions: []string{"dummy"},
+	}
+	azureKeep := types.AzureMatcher{
+		Subscriptions: []string{"dummy"},
+		Integration:   "azure-int",
+	}
+
+	matchers := Matchers{
+		AWS:   []types.AWSMatcher{awsDrop, awsKeep},
+		Azure: []types.AzureMatcher{azureDrop, azureKeep},
+		GCP: []types.GCPMatcher{
+			{ProjectIDs: []string{"proj"}},
+		},
+		Kubernetes: []types.KubernetesMatcher{
+			{Types: []string{"app"}},
+		},
+	}
+
+	discardAmbientCredentialMatchers(t.Context(), logger, &matchers)
+
+	require.Equal(t, []types.AWSMatcher{awsKeep}, matchers.AWS)
+	require.Equal(t, []types.AzureMatcher{azureKeep}, matchers.Azure)
+	require.Empty(t, matchers.GCP)
+	require.Empty(t, matchers.Kubernetes)
+}
+
+func TestEmitUsageEvents(t *testing.T) {
+	t.Parallel()
+
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
@@ -3687,7 +3758,7 @@ func TestEmitUsageEvents(t *testing.T) {
 	t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 	// Auth client for discovery service.
-	identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+	identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 	authClient, err := tlsServer.NewClient(identity)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -3696,7 +3767,6 @@ func TestEmitUsageEvents(t *testing.T) {
 	tlsServer.Auth().SetUsageReporter(reporter)
 
 	server, err := New(authz.ContextWithUser(context.Background(), identity.I), &Config{
-		CloudClients:    &testClients,
 		ClusterFeatures: func() proto.Features { return proto.Features{} },
 		AccessPoint:     getDiscoveryAccessPoint(tlsServer.Auth(), authClient),
 		Matchers: Matchers{
@@ -3732,26 +3802,6 @@ type eksClustersEnroller interface {
 	EnrollEKSClusters(context.Context, *integrationpb.EnrollEKSClustersRequest, ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error)
 }
 
-type mockEKSClusterEnroller struct {
-	resp *integrationpb.EnrollEKSClustersResponse
-	err  error
-}
-
-func (m *mockEKSClusterEnroller) EnrollEKSClusters(ctx context.Context, req *integrationpb.EnrollEKSClustersRequest, opt ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
-	ret := &integrationpb.EnrollEKSClustersResponse{
-		Results: []*integrationpb.EnrollEKSClusterResult{},
-	}
-	// Filter out non-requested clusters.
-	for _, clusterName := range req.EksClusterNames {
-		for _, mockClusterResult := range m.resp.Results {
-			if clusterName == mockClusterResult.EksClusterName {
-				ret.Results = append(ret.Results, mockClusterResult)
-			}
-		}
-	}
-	return ret, m.err
-}
-
 type combinedDiscoveryClient struct {
 	*auth.Server
 	eksClustersEnroller
@@ -3984,6 +4034,7 @@ func newPopulatedGCPProjectsMock() *mockProjectsAPI {
 }
 
 type fakeAWSClients struct {
+	ec2Client        db.EC2Client
 	ecClient         db.ElastiCacheClient
 	mdbClient        db.MemoryDBClient
 	openSearchClient db.OpenSearchClient
@@ -3992,6 +4043,10 @@ type fakeAWSClients struct {
 	rssClient        db.RSSClient
 }
 
+func (f fakeAWSClients) GetEC2Client(cfg aws.Config, optFns ...func(*ec2.Options)) db.EC2Client {
+	return f.ec2Client
+}
+
 func (f fakeAWSClients) GetElastiCacheClient(cfg aws.Config, optFns ...func(*elasticache.Options)) db.ElastiCacheClient {
 	return f.ecClient
 }
diff --git a/lib/srv/discovery/eks_audit_log_fetcher.go b/lib/srv/discovery/eks_audit_log_fetcher.go
new file mode 100644
index 0000000000000..83a8f778d6a61
--- /dev/null
+++ b/lib/srv/discovery/eks_audit_log_fetcher.go
@@ -0,0 +1,214 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package discovery
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"time"
+
+	cwltypes "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/types"
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/structpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+)
+
+// cloudwatchlogFetcher fetches cloudwatch logs for a given cluster, starting
+// at the given cursur position. This interface exists so tests can plug in a
+// fake fetcher and not need to stub out deeper AWS interfaces.
+type cloudwatchlogFetcher interface {
+	FetchEKSAuditLogs(
+		ctx context.Context,
+		cluster *accessgraphv1alpha.AWSEKSClusterV1,
+		cursor *accessgraphv1alpha.KubeAuditLogCursor,
+	) ([]cwltypes.FilteredLogEvent, error)
+}
+
+// eksAuditLogFetcher is a fetcher for EKS audit logs for a single cluster,
+// fetching the logs from AWS Cloud Watch Logs. It uses the grpc stream
+// to initiate the stream and possibly receive a resume state used to
+// synchronize the start point with a previous run fetching the logs.
+type eksAuditLogFetcher struct {
+	fetcher cloudwatchlogFetcher
+	cluster *accessgraphv1alpha.AWSEKSClusterV1
+	stream  accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient
+	log     *slog.Logger
+}
+
+func newEKSAuditLogFetcher(
+	fetcher cloudwatchlogFetcher,
+	cluster *accessgraphv1alpha.AWSEKSClusterV1,
+	stream accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient,
+	log *slog.Logger,
+) *eksAuditLogFetcher {
+	return &eksAuditLogFetcher{
+		fetcher: fetcher,
+		cluster: cluster,
+		stream:  stream,
+		log:     log,
+	}
+}
+
+// Run continuously polls AWS Cloud Watch Logs for Kubernetes apiserver
+// audit logs for the configured cluster. It feeds the logs retrieved to the
+// configured grpc stream, running until the given context is canceled.
+func (f *eksAuditLogFetcher) Run(ctx context.Context) error {
+	f.log = f.log.With("cluster", f.cluster.Arn)
+
+	cursor := initialCursor(f.cluster)
+	if err := f.sendTAGKubeAuditLogNewStream(ctx, cursor); err != nil {
+		return trace.Wrap(err)
+	}
+
+	cursor, err := f.receiveTAGKubeAuditLogResume(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for ctx.Err() == nil {
+		var events []*structpb.Struct
+		events, cursor = f.fetchLogs(ctx, cursor)
+
+		if len(events) == 0 {
+			select {
+			case <-ctx.Done():
+			case <-time.After(logPollInterval):
+			}
+			continue
+		}
+
+		if err := f.sendTAGKubeAuditLogEvents(ctx, events, cursor); err != nil {
+			return trace.Wrap(err)
+		}
+
+		f.log.DebugContext(ctx, "Sent KubeAuditLogEvents", "count", len(events),
+			"cursor_time", cursor.GetLastEventTime().AsTime())
+	}
+	return trace.Wrap(ctx.Err())
+}
+
+// fetchLogs fetches a batch of logs from AWS Cloud Watch Logs after the given
+// cursor position and unmarshals them into the protobuf Struct well-known
+// type.
+//
+// It returns the fetched log entries and a new cursor for the next call. If an
+// error occurs, it is logged, and the function returns nil logs and the
+// original input cursor. This allows the caller to retry the operation.
+func (f *eksAuditLogFetcher) fetchLogs(ctx context.Context, cursor *accessgraphv1alpha.KubeAuditLogCursor) ([]*structpb.Struct, *accessgraphv1alpha.KubeAuditLogCursor) {
+	awsEvents, err := f.fetcher.FetchEKSAuditLogs(ctx, f.cluster, cursor)
+	if err != nil {
+		if !errors.Is(err, context.Canceled) {
+			f.log.ErrorContext(ctx, "Failed to fetch EKS audit logs", "error", err)
+		}
+		return nil, cursor
+	}
+
+	if len(awsEvents) == 0 {
+		return nil, cursor
+	}
+
+	events := []*structpb.Struct{}
+	var awsEvent cwltypes.FilteredLogEvent
+	for _, awsEvent = range awsEvents {
+		// TODO(camscale): Track event sizes and don't go over protobuf message
+		// limit. newAccessGraphClient() sets the limit to 50MB
+		event := &structpb.Struct{}
+		m := protojson.UnmarshalOptions{}
+		err = m.Unmarshal([]byte(*awsEvent.Message), event)
+		if err != nil {
+			f.log.ErrorContext(ctx, "failed to protojson.Unmarshal", "error", err)
+			continue
+		}
+		events = append(events, event)
+	}
+	cursor = cursorFromEvent(f.cluster, awsEvent)
+
+	return events, cursor
+}
+
+func (f *eksAuditLogFetcher) sendTAGKubeAuditLogNewStream(ctx context.Context, cursor *accessgraphv1alpha.KubeAuditLogCursor) error {
+	err := f.stream.Send(
+		&accessgraphv1alpha.KubeAuditLogStreamRequest{
+			Action: &accessgraphv1alpha.KubeAuditLogStreamRequest_NewStream{
+				NewStream: &accessgraphv1alpha.KubeAuditLogNewStream{Initial: cursor},
+			},
+		},
+	)
+	if err != nil {
+		err = consumeTillErr(f.stream)
+		f.log.ErrorContext(ctx, "Failed to send accessgraph.KubeAuditLogNewStream", "error", err)
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (f *eksAuditLogFetcher) receiveTAGKubeAuditLogResume(ctx context.Context) (*accessgraphv1alpha.KubeAuditLogCursor, error) {
+	msg, err := f.stream.Recv()
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to receive KubeAuditLogStream resume state")
+	}
+
+	state := msg.GetResumeState()
+	if state == nil {
+		return nil, trace.BadParameter("AccessGraphService.KubeAuditLogStream did not return KubeAuditLogResumeState message")
+	}
+
+	f.log.InfoContext(ctx, "KubeAuditLogResumeState received", "state", state)
+	return state.Cursor, nil
+}
+
+func (f *eksAuditLogFetcher) sendTAGKubeAuditLogEvents(ctx context.Context, events []*structpb.Struct, cursor *accessgraphv1alpha.KubeAuditLogCursor) error {
+	err := f.stream.Send(
+		&accessgraphv1alpha.KubeAuditLogStreamRequest{
+			Action: &accessgraphv1alpha.KubeAuditLogStreamRequest_Events{
+				Events: &accessgraphv1alpha.KubeAuditLogEvents{Events: events, Cursor: cursor},
+			},
+		},
+	)
+	if err != nil {
+		err = consumeTillErr(f.stream)
+		f.log.ErrorContext(ctx, "Failed to send accessgraph.KubeAuditLogEvents", "error", err)
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func cursorFromEvent(cluster *accessgraphv1alpha.AWSEKSClusterV1, event cwltypes.FilteredLogEvent) *accessgraphv1alpha.KubeAuditLogCursor {
+	return &accessgraphv1alpha.KubeAuditLogCursor{
+		LogSource:     accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS,
+		ClusterId:     cluster.Arn,
+		EventId:       *event.EventId,
+		LastEventTime: timestamppb.New(time.UnixMilli(*event.Timestamp)),
+	}
+}
+
+// initialCursor returns a cursor for a EKS cluster that we have not previously
+// retrieved logs from, so there is no resume state. The cursor is set to
+// have logs retrieved back a standard amount of time.
+func initialCursor(cluster *accessgraphv1alpha.AWSEKSClusterV1) *accessgraphv1alpha.KubeAuditLogCursor {
+	return &accessgraphv1alpha.KubeAuditLogCursor{
+		LogSource:     accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS,
+		ClusterId:     cluster.Arn,
+		LastEventTime: timestamppb.New(time.Now().UTC().Add(-initialLogBacklog)),
+	}
+}
diff --git a/lib/srv/discovery/eks_audit_log_fetcher_test.go b/lib/srv/discovery/eks_audit_log_fetcher_test.go
new file mode 100644
index 0000000000000..90579f40d2198
--- /dev/null
+++ b/lib/srv/discovery/eks_audit_log_fetcher_test.go
@@ -0,0 +1,245 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package discovery
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	cwltypes "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/types"
+	"github.com/stretchr/testify/require"
+
+	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+	"github.com/gravitational/teleport/lib/utils/testutils/grpctest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+type eksAuditLogFetcherFixture struct {
+	ctx            context.Context
+	cancel         context.CancelFunc
+	server         kalsServer
+	fetcherErr     error
+	cluster        *accessgraphv1alpha.AWSEKSClusterV1
+	fakeLogFetcher *fakeCloudWatchLogFetcher
+}
+
+// Start the fixture. Must be called inside synctest bubble.
+func (f *eksAuditLogFetcherFixture) Start(t *testing.T) {
+	t.Helper()
+
+	f.ctx, f.cancel = context.WithCancel(t.Context())
+	tester := grpctest.NewGRPCTester[kalsRequest, kalsResponse](f.ctx)
+	f.server = tester.NewServerStream()
+	logger := slog.New(slog.DiscardHandler)
+	f.fakeLogFetcher = newFakeCloudWatchLogFetcher()
+	f.cluster = &accessgraphv1alpha.AWSEKSClusterV1{
+		Name: "cluster-name",
+		Arn:  "cluster-arn",
+	}
+	logFetcher := newEKSAuditLogFetcher(f.fakeLogFetcher, f.cluster, tester.NewClientStream(), logger)
+	go func() { f.fetcherErr = logFetcher.Run(f.ctx) }()
+}
+
+// End the fixture. Must be called inside synctest bubble.
+func (f *eksAuditLogFetcherFixture) End(t *testing.T) {
+	t.Helper()
+	f.cancel()
+	synctest.Wait()
+	require.ErrorIs(t, f.fetcherErr, context.Canceled)
+}
+
+func (f *eksAuditLogFetcherFixture) testInitializeNewStream(t *testing.T) {
+	t.Helper()
+
+	// Wait for a NewStream action, and verify it contains what we expect
+	msg, err := f.server.Recv()
+	require.NoError(t, err)
+	newStream := msg.GetNewStream()
+	require.NotNil(t, newStream)
+	cursor := newStream.GetInitial()
+	require.NotNil(t, cursor)
+	require.Equal(t, accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS, cursor.GetLogSource())
+	require.Equal(t, f.cluster.GetArn(), cursor.GetClusterId())
+
+	// Send back a ResumeState
+	err = f.server.Send(newKubeAuditLogResponseResumeState(cursor))
+	require.NoError(t, err)
+}
+
+// TestEKSAuditLogFetcher_NewStream_Unknown tests that when a new log stream
+// is set up for a cluster, logs start being fetched from the cursor returned
+// by the grpc service.
+func TestEKSAuditLogFetcher_NewStream(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		f := &eksAuditLogFetcherFixture{}
+		f.Start(t)
+		f.testInitializeNewStream(t)
+		f.End(t)
+	})
+}
+
+func TestEKSAuditLogFetcher_Batching(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		startTime := time.Now().UTC()
+		logEpoch := startTime.Add(-7 * 24 * time.Hour)
+		f := &eksAuditLogFetcherFixture{}
+		f.Start(t)
+		f.testInitializeNewStream(t)
+
+		f.fakeLogFetcher.events <- nil
+		// Wait for a polling loop to occur. As there are no logs left,
+		// the time should now be the synctest epoch plus the poll interval
+		time.Sleep(logPollInterval)
+		synctest.Wait()
+		require.Equal(t, startTime.Add(logPollInterval), time.Now().UTC())
+
+		// Wait for an Events action with the log listed. Verify the log and cursor.
+		f.fakeLogFetcher.events <- []cwltypes.FilteredLogEvent{
+			makeEvent(logEpoch, 0, "{}"),
+			makeEvent(logEpoch.Add(time.Second), 1, `{"log": "value"}`),
+		}
+		msg, err := f.server.Recv()
+		require.NoError(t, err)
+		events := msg.GetEvents()
+		require.NotNil(t, events)
+		require.Len(t, events.GetEvents(), 2)
+		require.Empty(t, events.GetEvents()[0].GetFields())
+		require.Len(t, events.GetEvents()[1].GetFields(), 1)
+		cursor := events.GetCursor()
+		require.NotNil(t, cursor)
+		require.Equal(t, accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS, cursor.GetLogSource())
+		require.Equal(t, f.cluster.GetArn(), cursor.GetClusterId())
+		require.Equal(t, "event-id-1", cursor.GetEventId())
+		require.Equal(t, logEpoch.Add(time.Second), cursor.GetLastEventTime().AsTime())
+
+		f.fakeLogFetcher.events <- []cwltypes.FilteredLogEvent{
+			makeEvent(logEpoch.Add(time.Second), 2, `{"log": "value2"}`),
+			makeEvent(logEpoch.Add(2*time.Second), 3, `{}`),
+		}
+		msg, err = f.server.Recv()
+		require.NoError(t, err)
+		events = msg.GetEvents()
+		require.NotNil(t, events)
+		require.Len(t, events.GetEvents(), 2)
+		require.Len(t, events.GetEvents()[0].GetFields(), 1)
+		require.Empty(t, events.GetEvents()[1].GetFields())
+		cursor = events.GetCursor()
+		require.NotNil(t, cursor)
+		require.Equal(t, accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS, cursor.GetLogSource())
+		require.Equal(t, f.cluster.GetArn(), cursor.GetClusterId())
+		require.Equal(t, "event-id-3", cursor.GetEventId())
+		require.Equal(t, logEpoch.Add(2*time.Second), cursor.GetLastEventTime().AsTime())
+
+		f.End(t)
+	})
+}
+
+func TestEKSAuditLogFetcher_ContinueOnError(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		startTime := time.Now().UTC()
+		logEpoch := startTime.Add(-7 * 24 * time.Hour)
+		f := &eksAuditLogFetcherFixture{}
+		f.Start(t)
+		f.testInitializeNewStream(t)
+
+		f.fakeLogFetcher.err <- errors.New("oh noes. something went wrong")
+		// Wait for a polling loop to occur. As there are no logs left,
+		// the time should now be the synctest epoch plus the poll interval
+		time.Sleep(logPollInterval)
+		synctest.Wait()
+		require.Equal(t, startTime.Add(logPollInterval), time.Now().UTC())
+
+		// Wait for an Events action with the log listed. Verify the log and cursor.
+		f.fakeLogFetcher.events <- []cwltypes.FilteredLogEvent{
+			makeEvent(logEpoch, 0, "{}"),
+			makeEvent(logEpoch.Add(time.Second), 1, `{"log": "value"}`),
+		}
+		msg, err := f.server.Recv()
+		require.NoError(t, err)
+		events := msg.GetEvents()
+		require.NotNil(t, events)
+		require.Len(t, events.GetEvents(), 2)
+		require.Empty(t, events.GetEvents()[0].GetFields())
+		require.Len(t, events.GetEvents()[1].GetFields(), 1)
+		cursor := events.GetCursor()
+		require.NotNil(t, cursor)
+		require.Equal(t, accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS, cursor.GetLogSource())
+		require.Equal(t, f.cluster.GetArn(), cursor.GetClusterId())
+		require.Equal(t, "event-id-1", cursor.GetEventId())
+		require.Equal(t, logEpoch.Add(time.Second), cursor.GetLastEventTime().AsTime())
+
+		f.End(t)
+	})
+}
+
+func newKubeAuditLogResponseResumeState(cursor *accessgraphv1alpha.KubeAuditLogCursor) *kalsResponse {
+	return &kalsResponse{
+		State: &accessgraphv1alpha.KubeAuditLogStreamResponse_ResumeState{
+			ResumeState: &accessgraphv1alpha.KubeAuditLogResumeState{
+				Cursor: cursor,
+			},
+		},
+	}
+}
+
+func makeEvent(t time.Time, id int, msg string) cwltypes.FilteredLogEvent {
+	return cwltypes.FilteredLogEvent{
+		EventId:       aws.String(fmt.Sprintf("event-id-%d", id)),
+		IngestionTime: aws.Int64(t.UnixMilli()),
+		Timestamp:     aws.Int64(t.UnixMilli()),
+		LogStreamName: aws.String("kube-apiserver-audit-12345678"),
+		Message:       aws.String(msg),
+	}
+}
+
+func newFakeCloudWatchLogFetcher() *fakeCloudWatchLogFetcher {
+	return &fakeCloudWatchLogFetcher{
+		events: make(chan []cwltypes.FilteredLogEvent),
+		err:    make(chan error),
+	}
+}
+
+// fakeCloudWatchLogFetcher is a cloudwatch log fetcher that waits on channels
+// for the data to return. This allows the unit under test to rendezvous with
+// the tests, allowing the tests to advance the state of the fetcher as it
+// needs.
+type fakeCloudWatchLogFetcher struct {
+	events chan []cwltypes.FilteredLogEvent
+	err    chan error
+}
+
+func (f *fakeCloudWatchLogFetcher) FetchEKSAuditLogs(
+	ctx context.Context,
+	cluster *accessgraphv1alpha.AWSEKSClusterV1,
+	cursor *accessgraphv1alpha.KubeAuditLogCursor,
+) ([]cwltypes.FilteredLogEvent, error) {
+	select {
+	case events := <-f.events:
+		return events, nil
+	case err := <-f.err:
+		return nil, err
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
diff --git a/lib/srv/discovery/eks_audit_log_watcher.go b/lib/srv/discovery/eks_audit_log_watcher.go
new file mode 100644
index 0000000000000..55e845a48baf3
--- /dev/null
+++ b/lib/srv/discovery/eks_audit_log_watcher.go
@@ -0,0 +1,266 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package discovery
+
+import (
+	"context"
+	"errors"
+	"iter"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+	aws_sync "github.com/gravitational/teleport/lib/srv/discovery/fetchers/aws-sync"
+)
+
+const (
+	// initialLogBacklog is how far back to start retrieving EKS audit logs
+	// for newly discovered clusters.
+	// TODO(camscale): define in config.
+	initialLogBacklog = 7 * 24 * time.Hour
+
+	// logPollInterval is the amount of time to sleep between fetching audit
+	// logs from Cloud Watch Logs for a cluster.
+	// TODO(camscale): perhaps define in config.
+	logPollInterval = 30 * time.Second
+)
+
+// eksAuditLogCluster is a cluster for which audit logs should be fetched and
+// the fetcher to use to do that. It is sent over a channel as a slice from
+// the AWS resource watcher (access_graph_aws.go) to the EKS audit log watcher
+// created here. For each one of these received, an asynchronous log fetcher
+// is spawned to fetch Kubernetes apiserver audit logs from Cloud Watch Logs
+// and sent to the grpc AccessGraphService via the KubeAuditLogStream rpc.
+type eksAuditLogCluster struct {
+	fetcher *aws_sync.Fetcher
+	cluster *accessgraphv1alpha.AWSEKSClusterV1
+}
+
+type eksAuditLogFetcherRunner interface {
+	Run(context.Context) error
+}
+
+// eksAuditLogWatcher is a watcher that waits for notifications on a channel
+// indicating what EKS clusters should have audit logs fetched, and reconciles
+// that against what is currently being fetched. Fetchers are started and
+// stopped in response to this reconcilliation.
+type eksAuditLogWatcher struct {
+	client             accessgraphv1alpha.AccessGraphServiceClient
+	log                *slog.Logger
+	auditLogClustersCh chan []eksAuditLogCluster
+
+	// Fetchers tracks the cluster IDs (ARN) of the clusters for which we
+	// have a fetcher running. The value is a CancelFunc that is called to
+	// stop the fetcher.
+	fetchers    map[string]context.CancelFunc
+	completedCh chan fetcherCompleted
+
+	// newFetcher is a function used to construct a new fetcher. It exists
+	// so tests can override it to not create real fetchers.
+	newFetcher func(
+		*aws_sync.Fetcher,
+		*accessgraphv1alpha.AWSEKSClusterV1,
+		accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient,
+		*slog.Logger,
+	) eksAuditLogFetcherRunner
+}
+
+func newEKSAuditLogWatcher(
+	client accessgraphv1alpha.AccessGraphServiceClient,
+	logger *slog.Logger,
+) *eksAuditLogWatcher {
+	return &eksAuditLogWatcher{
+		client:             client,
+		log:                logger,
+		auditLogClustersCh: make(chan []eksAuditLogCluster),
+		fetchers:           make(map[string]context.CancelFunc),
+		completedCh:        make(chan fetcherCompleted),
+	}
+}
+
+// fetcherCompleted captures the result of a completed eksAuditLogFetcher.
+type fetcherCompleted struct {
+	clusterID string
+	err       error
+}
+
+// Run starts a watcher by creating a KubeAuditLogStream on its grpc client. It
+// negotiates a configuration (currently a no-op) and starts a main loop
+// waiting for a list of clusters that it should run log fetchers for. As these
+// lists of clusters arrives, it reconciles it against the running log fetchers
+// and starts/stops log fetchers as required to match the given list. It
+// completes when the given context is done.
+//
+// If any errors occur initializing the grpc stream, it is returned and the
+// main loop is not run.
+func (w *eksAuditLogWatcher) Run(ctx context.Context) error {
+	w.log.InfoContext(ctx, "EKS Audit Log Watcher started")
+	defer w.log.InfoContext(ctx, "EKS Audit Log Watcher completed")
+
+	stream, err := w.client.KubeAuditLogStream(ctx)
+	if err != nil {
+		w.log.ErrorContext(ctx, "Failed to get access graph service KubeAuditLogStream", "error", err)
+		return trace.Wrap(err)
+	}
+
+	config := &accessgraphv1alpha.KubeAuditLogConfig{}
+	if err := sendTAGKubeAuditLogConfig(ctx, stream, config); err != nil {
+		w.log.ErrorContext(ctx, "Failed to send access graph config", "error", err)
+		return trace.Wrap(err)
+	}
+
+	config, err = receiveTAGKubeAuditLogConfig(ctx, stream)
+	if err != nil {
+		w.log.ErrorContext(ctx, "Failed to receive access graph config", "error", err)
+		return trace.Wrap(err)
+	}
+	w.log.InfoContext(ctx, "KubeAuditLogConfig received", "config", config)
+
+	// Loop waiting for EKS clusters we need to fetch audit logs for on
+	// s.awsKubeAuditLogClustersCh channel (from the resource syncer).
+	// Reconcile that list of clusters against what we know and start/stop
+	// any log fetchers necessary.
+	for {
+		select {
+		case clusters := <-w.auditLogClustersCh:
+			w.reconcile(ctx, clusters, stream)
+		case completed := <-w.completedCh:
+			w.complete(ctx, completed)
+		case <-ctx.Done():
+			return trace.Wrap(ctx.Err())
+		}
+	}
+}
+
+// Reconcile triggers a reconcilliation of currently running fetchers against
+// the given slice of clusters. The reconcilliation will stop any fetchers for
+// clusters not in the slice and start any fetchers for clusters in the slice
+// that are not running.
+//
+// If the given context is done before the clusters can be sent to the
+// reconcilliation goroutine, the context's error will be returned.
+func (w *eksAuditLogWatcher) Reconcile(ctx context.Context, clusters []eksAuditLogCluster) error {
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	case w.auditLogClustersCh <- clusters:
+	}
+
+	return nil
+}
+
+// reconcile compares the given slice of clusters against the currently running
+// log fetchers and stops any running fetchers not in the cluster slice and
+// starts a log fetcher for any cluster in the slice that does not have a
+// running log fetcher.
+//
+// Log fetchers that are started are initialized with the given grpc stream
+// over which they should send their audit logs.
+func (w *eksAuditLogWatcher) reconcile(ctx context.Context, clusters []eksAuditLogCluster, stream accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient) {
+	w.log.DebugContext(ctx, "Reconciling EKS audit log clusters", "new_count", len(clusters))
+
+	// Make a map of the discovered clusters, keyed by ARN so we can compare against
+	// the existing clusters we are fetching audit logs for.
+	discoveredClusters := make(map[string]eksAuditLogCluster)
+	for _, discovered := range clusters {
+		discoveredClusters[discovered.cluster.Arn] = discovered
+	}
+	// Stop any fetchers for clusters we are running fetcher for that discovery did not return.
+	for arn, fetcherCancel := range mapDifference(w.fetchers, discoveredClusters) {
+		w.log.InfoContext(ctx, "Stopping eksKubeAuditLogFetcher", "cluster", arn)
+		fetcherCancel()
+		// cleanup will happen when the fetcher finishes and is put on the completed channel.
+	}
+	// Start any new fetchers for clusters we are not running that discovery returned.
+	for arn, discovered := range mapDifference(discoveredClusters, w.fetchers) {
+		w.log.InfoContext(ctx, "Starting eksKubeAuditLogFetcher", "cluster", arn)
+		ctx, cancel := context.WithCancel(ctx)
+		var logFetcher eksAuditLogFetcherRunner
+		if w.newFetcher == nil {
+			logFetcher = newEKSAuditLogFetcher(discovered.fetcher, discovered.cluster, stream, w.log)
+		} else {
+			// the pluggable newFetcher is for testing purposes
+			logFetcher = w.newFetcher(discovered.fetcher, discovered.cluster, stream, w.log)
+		}
+		w.fetchers[arn] = cancel
+		go func() {
+			err := logFetcher.Run(ctx)
+			select {
+			case w.completedCh <- fetcherCompleted{arn, err}:
+			case <-ctx.Done():
+			}
+		}()
+	}
+}
+
+// complete cleans up the maintained list of running log fetchers, removing the
+// given completed fetcher, and logs the completion status of the fetcher.
+func (w *eksAuditLogWatcher) complete(ctx context.Context, completed fetcherCompleted) {
+	arn := completed.clusterID
+	if completed.err != nil && !errors.Is(completed.err, context.Canceled) {
+		w.log.ErrorContext(ctx, "eksKubeAuditLogFetcher completed with error", "cluster", arn, "error", completed.err)
+	} else {
+		w.log.InfoContext(ctx, "eksKubeAuditLogFetcher completed", "cluster", arn)
+	}
+	delete(w.fetchers, arn)
+}
+
+// mapDifference yields all keys and values of m1 where the key is not in m2. It
+// can be considered the set operation "mapDifference" - m1-m2, yielding all
+// elements of m1 not in m2.
+func mapDifference[K comparable, V1 any, V2 any](m1 map[K]V1, m2 map[K]V2) iter.Seq2[K, V1] {
+	return func(yield func(K, V1) bool) {
+		for k, v := range m1 {
+			if _, ok := m2[k]; !ok {
+				if !yield(k, v) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func sendTAGKubeAuditLogConfig(ctx context.Context, stream accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient, config *accessgraphv1alpha.KubeAuditLogConfig) error {
+	err := stream.Send(
+		&accessgraphv1alpha.KubeAuditLogStreamRequest{
+			Action: &accessgraphv1alpha.KubeAuditLogStreamRequest_Config{Config: config},
+		},
+	)
+	if err != nil {
+		err = consumeTillErr(stream)
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func receiveTAGKubeAuditLogConfig(ctx context.Context, stream accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient) (*accessgraphv1alpha.KubeAuditLogConfig, error) {
+	msg, err := stream.Recv()
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to receive KubeAuditLogStream config")
+	}
+
+	config := msg.GetConfig()
+	if config == nil {
+		return nil, trace.BadParameter("AccessGraphService.KubeAuditLogStream did not return KubeAuditLogConfig message")
+	}
+
+	return config, nil
+}
diff --git a/lib/srv/discovery/eks_audit_log_watcher_test.go b/lib/srv/discovery/eks_audit_log_watcher_test.go
new file mode 100644
index 0000000000000..7d604747527f2
--- /dev/null
+++ b/lib/srv/discovery/eks_audit_log_watcher_test.go
@@ -0,0 +1,210 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package discovery
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+	aws_sync "github.com/gravitational/teleport/lib/srv/discovery/fetchers/aws-sync"
+	"github.com/gravitational/teleport/lib/utils/testutils/grpctest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+type (
+	kalsRequest  = accessgraphv1alpha.KubeAuditLogStreamRequest
+	kalsResponse = accessgraphv1alpha.KubeAuditLogStreamResponse
+	kalsClient   = grpc.BidiStreamingClient[kalsRequest, kalsResponse]
+	kalsServer   = grpc.BidiStreamingServer[kalsRequest, kalsResponse]
+)
+
+func TestEKSAuditLogWatcher_Init(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(t.Context())
+
+		client := newFakeKubeAuditLogClient(ctx)
+		watcher := newEKSAuditLogWatcher(client, slog.New(slog.DiscardHandler))
+		var err error
+		go func() { err = watcher.Run(ctx) }()
+
+		// Receive a config request.
+		req, err := client.serverStream.Recv()
+		require.NoError(t, err)
+		require.NotNil(t, req.GetConfig())
+
+		// Send back a config response with the config we received.
+		err = client.serverStream.Send(newKubeAuditLogResponseConfig(req.GetConfig()))
+		require.NoError(t, err)
+
+		cancel()
+		synctest.Wait()
+		require.ErrorIs(t, err, context.Canceled)
+	})
+}
+
+func TestEKSAuditLogWatcher_Reconcile(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(t.Context())
+
+		fetcherTracker := newFakeFetcherTracker()
+		client := newFakeKubeAuditLogClient(ctx)
+		watcher := newEKSAuditLogWatcher(client, slog.New(slog.DiscardHandler))
+		watcher.newFetcher = fetcherTracker.newFetcher
+		var err error
+		go func() { err = watcher.Run(ctx) }()
+
+		// Receive a config request.
+		req, err := client.serverStream.Recv()
+		require.NoError(t, err)
+		require.NotNil(t, req.GetConfig())
+
+		// Send back a config response with the config we received.
+		err = client.serverStream.Send(newKubeAuditLogResponseConfig(req.GetConfig()))
+		require.NoError(t, err)
+
+		// Send a single cluster1 to the watcher to reconcile
+		cluster1 := &accessgraphv1alpha.AWSEKSClusterV1{Arn: "test-arn"}
+		fetcher1 := &aws_sync.Fetcher{}
+		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}})
+		synctest.Wait()
+
+		// Verify that a fetcher was started.
+		f1, ok := fetcherTracker.fetchers["test-arn"]
+		require.True(t, ok, "eksAuditLogFetcher not in fetcherTracker")
+		require.True(t, f1.runCalled, "fetcher Run() was not called")
+		require.Same(t, fetcher1, f1.fetcher)
+		require.Same(t, cluster1, f1.cluster)
+		require.Len(t, fetcherTracker.fetchers, 1)
+		require.Equal(t, 1, fetcherTracker.newCount)
+
+		// Add another cluster
+		cluster2 := &accessgraphv1alpha.AWSEKSClusterV1{Arn: "test-arn2"}
+		fetcher2 := &aws_sync.Fetcher{}
+		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}, {fetcher2, cluster2}})
+		synctest.Wait()
+
+		// Verify that a fetcher was started.
+		f2, ok := fetcherTracker.fetchers["test-arn2"]
+		require.True(t, ok, "eksAuditLogFetcher not in fetcherTracker")
+		require.True(t, f2.runCalled, "fetcher Run() was not called")
+		require.Same(t, fetcher2, f2.fetcher)
+		require.Same(t, cluster2, f2.cluster)
+		require.Len(t, fetcherTracker.fetchers, 2)
+		require.Equal(t, 2, fetcherTracker.newCount)
+
+		// Drop back to a single cluster
+		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}})
+		synctest.Wait()
+		require.Len(t, fetcherTracker.fetchers, 1)
+		require.Equal(t, 2, fetcherTracker.newCount)
+		require.True(t, f2.done)
+
+		// Send an empty cluster list. Should stop last fetcher
+		watcher.Reconcile(ctx, []eksAuditLogCluster{})
+		synctest.Wait()
+		require.Empty(t, fetcherTracker.fetchers)
+		require.Equal(t, 2, fetcherTracker.newCount)
+		require.True(t, f1.done)
+
+		cancel()
+		synctest.Wait()
+		require.ErrorIs(t, err, context.Canceled)
+	})
+}
+
+// fakeFetcherTracker keeps track of the fetchers created by an
+// eksAuditLogWatcher. It has a newFetcher method that can plug into a watcher
+// so that real fetchers are not created, and returns a fake fetcher for
+// testing purposes.
+type fakeFetcherTracker struct {
+	fetchers map[string]*fakeEksAuditLogFetcher
+	newCount int
+}
+
+func newFakeFetcherTracker() *fakeFetcherTracker {
+	return &fakeFetcherTracker{fetchers: make(map[string]*fakeEksAuditLogFetcher)}
+}
+
+// newFetcher plugs into eksAuditLogWatcher.newFetcher so that it creates fake
+// fetchers for testing purposes. We do not need real fetchers to test the
+// watcher.
+func (fft *fakeFetcherTracker) newFetcher(
+	fetcher *aws_sync.Fetcher,
+	cluster *accessgraphv1alpha.AWSEKSClusterV1,
+	stream accessgraphv1alpha.AccessGraphService_KubeAuditLogStreamClient,
+	log *slog.Logger,
+) eksAuditLogFetcherRunner {
+	f := &fakeEksAuditLogFetcher{
+		fetcher: fetcher,
+		cluster: cluster,
+		cleanup: func() { delete(fft.fetchers, cluster.Arn) },
+	}
+	fft.fetchers[cluster.Arn] = f
+	fft.newCount++
+	return f
+}
+
+type fakeEksAuditLogFetcher struct {
+	fetcher   *aws_sync.Fetcher
+	cluster   *accessgraphv1alpha.AWSEKSClusterV1
+	cleanup   func()
+	runCalled bool
+	done      bool
+}
+
+func (f *fakeEksAuditLogFetcher) Run(ctx context.Context) error {
+	f.runCalled = true // used in synctest bubble, no race
+	<-ctx.Done()
+	f.done = true
+	f.cleanup()
+	return ctx.Err()
+}
+
+func newKubeAuditLogResponseConfig(cfg *accessgraphv1alpha.KubeAuditLogConfig) *kalsResponse {
+	return &kalsResponse{
+		State: &accessgraphv1alpha.KubeAuditLogStreamResponse_Config{
+			Config: cfg,
+		},
+	}
+}
+
+func newFakeKubeAuditLogClient(ctx context.Context) *fakeKubeAuditLogClient {
+	tester := grpctest.NewGRPCTester[kalsRequest, kalsResponse](ctx)
+	return &fakeKubeAuditLogClient{
+		clientStream: tester.NewClientStream(),
+		serverStream: tester.NewServerStream(),
+	}
+}
+
+type fakeKubeAuditLogClient struct {
+	accessgraphv1alpha.AccessGraphServiceClient
+
+	clientStream kalsClient
+	serverStream kalsServer
+}
+
+// Implements KubeAuditLogStream grpc method on the client
+func (c *fakeKubeAuditLogClient) KubeAuditLogStream(ctx context.Context, opts ...grpc.CallOption) (kalsClient, error) {
+	return c.clientStream, nil
+}
diff --git a/lib/srv/discovery/fetchers/aks.go b/lib/srv/discovery/fetchers/aks.go
index 0acdc5ad5e353..f183b695d6ab0 100644
--- a/lib/srv/discovery/fetchers/aks.go
+++ b/lib/srv/discovery/fetchers/aks.go
@@ -51,6 +51,8 @@ type AKSFetcherConfig struct {
 	Logger *slog.Logger
 	// DiscoveryConfigName is the name of the DiscoveryConfig that created this Fetcher.
 	DiscoveryConfigName string
+	// Integration is the name of Azure integration used for auth.
+	Integration string
 }
 
 // CheckAndSetDefaults validates and sets the defaults values.
@@ -155,7 +157,7 @@ func (a *aksFetcher) Cloud() string {
 }
 
 func (a *aksFetcher) IntegrationName() string {
-	return ""
+	return a.Integration
 }
 
 func (a *aksFetcher) GetDiscoveryConfigName() string {
diff --git a/lib/srv/discovery/fetchers/aks_test.go b/lib/srv/discovery/fetchers/aks_test.go
index de9bc9fe2351d..72a85a55965e0 100644
--- a/lib/srv/discovery/fetchers/aks_test.go
+++ b/lib/srv/discovery/fetchers/aks_test.go
@@ -27,7 +27,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestAKSFetcher(t *testing.T) {
@@ -117,7 +117,7 @@ func TestAKSFetcher(t *testing.T) {
 				FilterLabels:   tt.args.filterLabels,
 				Regions:        tt.args.regions,
 				ResourceGroups: tt.args.resourceGroups,
-				Logger:         utils.NewSlogLoggerForTests(),
+				Logger:         logtest.NewLogger(),
 			}
 			fetcher, err := NewAKSFetcher(cfg)
 			require.NoError(t, err)
diff --git a/lib/srv/discovery/fetchers/aws-sync/aws-sync.go b/lib/srv/discovery/fetchers/aws-sync/aws-sync.go
index 655288295d928..fb3c026ad87ae 100644
--- a/lib/srv/discovery/fetchers/aws-sync/aws-sync.go
+++ b/lib/srv/discovery/fetchers/aws-sync/aws-sync.go
@@ -20,13 +20,16 @@ package aws_sync
 
 import (
 	"context"
+	"log/slog"
 	"reflect"
 	"sync"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/aws/aws-sdk-go-v2/service/kms"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
@@ -34,6 +37,7 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	usageeventsv1 "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
+	"github.com/gravitational/teleport/api/types"
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
 	"github.com/gravitational/teleport/lib/srv/server"
@@ -63,6 +67,11 @@ type Config struct {
 	Integration string
 	// DiscoveryConfigName if set, will be used to report the Discovery Config Status to the Auth Server.
 	DiscoveryConfigName string
+	// Log is the logger to use for logging.
+	Log *slog.Logger
+	// EKSAuditLogs if set specifies the EKS clusters for which apiserver audit logs
+	// should be fetched.
+	EKSAuditLogs *EKSAuditLogs
 
 	// awsClients provides AWS SDK clients.
 	awsClients awsClientProvider
@@ -73,6 +82,9 @@ func (c *Config) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing AWSConfigProvider")
 	}
 
+	if c.Log == nil {
+		c.Log = slog.Default()
+	}
 	if c.awsClients == nil {
 		c.awsClients = defaultAWSClients{}
 	}
@@ -119,6 +131,10 @@ type awsClientProvider interface {
 	getS3Client(cfg aws.Config, optFns ...func(*s3.Options)) s3Client
 	// getSTSClient provides an [stsClient].
 	getSTSClient(cfg aws.Config, optFns ...func(*sts.Options)) stsClient
+	// getKMSClient provides a [kmsClient].
+	getKMSClient(cfg aws.Config, optFns ...func(*kms.Options)) kmsClient
+	// getCloudWatchLogsClient provides a [cloudwatchlogs.FilterLogEventsAPIClient].
+	getCloudWatchLogsClient(cfg aws.Config, optFns ...func(*cloudwatchlogs.Options)) cloudwatchlogs.FilterLogEventsAPIClient
 }
 
 type defaultAWSClients struct{}
@@ -139,6 +155,14 @@ func (defaultAWSClients) getSTSClient(cfg aws.Config, optFns ...func(*sts.Option
 	return stsutils.NewFromConfig(cfg, optFns...)
 }
 
+func (defaultAWSClients) getKMSClient(cfg aws.Config, optFns ...func(*kms.Options)) kmsClient {
+	return kms.NewFromConfig(cfg, optFns...)
+}
+
+func (defaultAWSClients) getCloudWatchLogsClient(cfg aws.Config, optFns ...func(*cloudwatchlogs.Options)) cloudwatchlogs.FilterLogEventsAPIClient {
+	return cloudwatchlogs.NewFromConfig(cfg, optFns...)
+}
+
 // AssumeRole is the configuration for assuming an AWS role.
 type AssumeRole struct {
 	// RoleARN is the ARN of the role to assume.
@@ -147,6 +171,13 @@ type AssumeRole struct {
 	ExternalID string
 }
 
+// EKSAuditLogs is the configuration of which discovered EKS clusters should have
+// their apiserver audit logs fetched and sent to Access Graph.
+type EKSAuditLogs struct {
+	// Tags is a set of name/value tags that an EKS cluster must have for audit log fetching.
+	Tags types.Labels
+}
+
 // Fetcher is a fetcher that fetches AWS resources.
 type Fetcher struct {
 	Config
@@ -201,6 +232,8 @@ type Resources struct {
 	SAMLProviders []*accessgraphv1alpha.AWSSAMLProviderV1
 	// OIDCProviders is a list of OIDC providers.
 	OIDCProviders []*accessgraphv1alpha.AWSOIDCProviderV1
+	// KMSKeys is a list of KMS keys.
+	KMSKeys []*accessgraphv1alpha.AWSKMSKeyV1
 }
 
 func (r *Resources) count() int {
@@ -358,6 +391,11 @@ func (a *Fetcher) poll(ctx context.Context, features Features) (*Resources, erro
 		eGroup.Go(a.pollAWSOIDCProviders(ctx, result, collectErr))
 	}
 
+	// fetch AWS KMS keys, including HSM keys
+	if features.KMS {
+		eGroup.Go(a.pollAWSKMSKeys(ctx, result, collectErr))
+	}
+
 	if err := eGroup.Wait(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -368,7 +406,7 @@ func (a *Fetcher) poll(ctx context.Context, features Features) (*Resources, erro
 // with the v2 sdk.
 func (a *Fetcher) getAWSOptions() []awsconfig.OptionsFn {
 	opts := []awsconfig.OptionsFn{
-		awsconfig.WithCredentialsMaybeIntegration(a.Config.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: a.Config.Integration}),
 	}
 
 	if a.Config.AssumeRole != nil {
diff --git a/lib/srv/discovery/fetchers/aws-sync/cloudwatchlogs.go b/lib/srv/discovery/fetchers/aws-sync/cloudwatchlogs.go
new file mode 100644
index 0000000000000..f2fa18c975a1c
--- /dev/null
+++ b/lib/srv/discovery/fetchers/aws-sync/cloudwatchlogs.go
@@ -0,0 +1,102 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package aws_sync
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	cwltypes "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/types"
+	"github.com/gravitational/trace"
+
+	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+)
+
+// FetchEKSAuditLogs returns a slice of audit log events for the given cluster
+// starting from the given cursor.
+func (a *Fetcher) FetchEKSAuditLogs(ctx context.Context, cluster *accessgraphv1alpha.AWSEKSClusterV1, cursor *accessgraphv1alpha.KubeAuditLogCursor) ([]cwltypes.FilteredLogEvent, error) {
+	cfg, err := a.AWSConfigProvider.GetConfig(ctx, cluster.GetRegion(), a.getAWSOptions()...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	client := a.awsClients.getCloudWatchLogsClient(cfg)
+
+	// limit is not a hard limit - we may exceed it but won't get any more pages
+	// once reached.
+	var limit int32 = 500 // TODO(camscale): Consider making this a parameter
+	startTime := cursor.GetLastEventTime().AsTime().UTC()
+	input := &cloudwatchlogs.FilterLogEventsInput{
+		LogGroupName:        aws.String("/aws/eks/" + cluster.GetName() + "/cluster"),
+		LogStreamNamePrefix: aws.String("kube-apiserver-audit-"),
+		StartTime:           aws.Int64(startTime.UnixMilli()),
+		Limit:               aws.Int32(limit),
+	}
+
+	var result []cwltypes.FilteredLogEvent
+	for p := cloudwatchlogs.NewFilterLogEventsPaginator(client, input); p.HasMorePages(); {
+		output, err := p.NextPage(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		eventsAfterCursor := cwlEventsAfterCursor(output.Events, cursor)
+		if eventsAfterCursor != nil {
+			cursor = nil
+			result = append(result, eventsAfterCursor...)
+			if len(result) >= int(limit) {
+				break
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// cwlEventsAfterCursor returns the events from the given events after the
+// cursor. If the cursor was not found, but the timestamp of the cursor
+// was not passed, then nil is returned. In this case, the cursor is still
+// valid and should continue to be used to find the next event. Otherwise
+// a slice (possibly empty) is returned which means the cursor was consumed;
+// either the event ID in the cursor was found, or we passed the timestamp
+// of the cursor.
+// If the cursor is nil, the events are returned unfiltered.
+func cwlEventsAfterCursor(events []cwltypes.FilteredLogEvent, cursor *accessgraphv1alpha.KubeAuditLogCursor) []cwltypes.FilteredLogEvent {
+	// If we're not looking for events from a cursor position, just return all events.
+	if cursor == nil || cursor.GetEventId() == "" {
+		return events
+	}
+
+	startTime := cursor.GetLastEventTime().AsTime().UTC()
+	for i, event := range events {
+		// If we never saw cursor.EventId with the given timestamp,
+		// just return all the events.
+		if time.UnixMilli(*event.Timestamp).UTC().After(startTime) {
+			return events
+		}
+		if *event.EventId == cursor.GetEventId() {
+			return events[i+1:]
+		}
+	}
+	// The cursor was not found in the events, but it was not discarded as
+	// the timestamp on the events did not move past the cursor timestamp.
+	// A nil slice (as opposed to an empty slice) indicates this.
+	return nil
+}
diff --git a/lib/srv/discovery/fetchers/aws-sync/ec2.go b/lib/srv/discovery/fetchers/aws-sync/ec2.go
index 1587ef6624679..c3187147a84f2 100644
--- a/lib/srv/discovery/fetchers/aws-sync/ec2.go
+++ b/lib/srv/discovery/fetchers/aws-sync/ec2.go
@@ -30,7 +30,6 @@ import (
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
@@ -144,7 +143,6 @@ func awsInstanceToProtoInstance(instance ec2types.Instance, region string, accou
 		AccountId:             accountID,
 		Tags:                  tags,
 		LaunchTime:            awsTimeToProtoTime(instance.LaunchTime),
-		LastSyncTime:          timestamppb.Now(),
 	}
 }
 
@@ -204,7 +202,6 @@ func awsInstanceProfileToProtoInstanceProfile(profile iamtypes.InstanceProfile,
 		AccountId:           accountID,
 		Tags:                tags,
 		CreatedAt:           awsTimeToProtoTime(profile.CreateDate),
-		LastSyncTime:        timestamppb.Now(),
 	}
 	for _, role := range profile.Roles {
 		out.Roles = append(out.Roles, awsRoleToProtoRole(role, accountID))
diff --git a/lib/srv/discovery/fetchers/aws-sync/eks.go b/lib/srv/discovery/fetchers/aws-sync/eks.go
index 1fec520ae96fe..b4a0f6d42da27 100644
--- a/lib/srv/discovery/fetchers/aws-sync/eks.go
+++ b/lib/srv/discovery/fetchers/aws-sync/eks.go
@@ -27,7 +27,6 @@ import (
 	ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
@@ -201,14 +200,13 @@ func awsEKSClusterToProtoCluster(cluster *ekstypes.Cluster, region, accountID st
 	}
 
 	return &accessgraphv1alpha.AWSEKSClusterV1{
-		Name:         aws.ToString(cluster.Name),
-		Arn:          aws.ToString(cluster.Arn),
-		CreatedAt:    awsTimeToProtoTime(cluster.CreatedAt),
-		Status:       string(cluster.Status),
-		Region:       region,
-		AccountId:    accountID,
-		Tags:         tags,
-		LastSyncTime: timestamppb.Now(),
+		Name:      aws.ToString(cluster.Name),
+		Arn:       aws.ToString(cluster.Arn),
+		CreatedAt: awsTimeToProtoTime(cluster.CreatedAt),
+		Status:    string(cluster.Status),
+		Region:    region,
+		AccountId: accountID,
+		Tags:      tags,
 	}
 }
 
@@ -272,7 +270,6 @@ func awsAccessEntryToProtoAccessEntry(accessEntry *ekstypes.AccessEntry, cluster
 		Type:             aws.ToString(accessEntry.Type),
 		Tags:             tags,
 		AccountId:        accountID,
-		LastSyncTime:     timestamppb.Now(),
 	}
 }
 
@@ -322,6 +319,5 @@ func awsAssociatedAccessPolicy(policy ekstypes.AssociatedAccessPolicy, cluster *
 		PolicyArn:    aws.ToString(policy.PolicyArn),
 		Scope:        accessScope,
 		AccountId:    accountID,
-		LastSyncTime: timestamppb.Now(),
 	}
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/eks_test.go b/lib/srv/discovery/fetchers/aws-sync/eks_test.go
index e8cd55b767767..c0ceeacdb9a3e 100644
--- a/lib/srv/discovery/fetchers/aws-sync/eks_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/eks_test.go
@@ -219,9 +219,6 @@ func TestPollAWSEKSClusters(t *testing.T) {
 						return a.Key < b.Key
 					},
 				),
-				protocmp.IgnoreFields(&accessgraphv1alpha.AWSEKSClusterV1{}, "last_sync_time"),
-				protocmp.IgnoreFields(&accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1{}, "last_sync_time"),
-				protocmp.IgnoreFields(&accessgraphv1alpha.AWSEKSClusterAccessEntryV1{}, "last_sync_time"),
 			))
 		})
 	}
diff --git a/lib/srv/discovery/fetchers/aws-sync/features.go b/lib/srv/discovery/fetchers/aws-sync/features.go
index 3cddaab912946..51f482b48dd89 100644
--- a/lib/srv/discovery/fetchers/aws-sync/features.go
+++ b/lib/srv/discovery/fetchers/aws-sync/features.go
@@ -28,6 +28,7 @@ const (
 	awsS3        = awsNamespace + "/" + "s3"
 	awsRoles     = awsNamespace + "/" + "roles"
 	awsIDP       = awsNamespace + "/" + "idp"
+	awsKMS       = awsNamespace + "/" + "kms"
 )
 
 // Features is the list of supported resources by the server.
@@ -48,6 +49,8 @@ type Features struct {
 	S3 bool
 	// IDP enables sync of AWS IAM identity providers.
 	IDP bool
+	// KMS enables AWS KMS sync.
+	KMS bool
 }
 
 // BuildFeatures builds the feature flags based on supported types returned by Access Graph
@@ -72,6 +75,8 @@ func BuildFeatures(values ...string) Features {
 			features.Roles = true
 		case awsIDP:
 			features.IDP = true
+		case awsKMS:
+			features.KMS = true
 		}
 	}
 	return features
diff --git a/lib/srv/discovery/fetchers/aws-sync/groups.go b/lib/srv/discovery/fetchers/aws-sync/groups.go
index 47be4da6b47bd..b33e43338f72b 100644
--- a/lib/srv/discovery/fetchers/aws-sync/groups.go
+++ b/lib/srv/discovery/fetchers/aws-sync/groups.go
@@ -27,7 +27,6 @@ import (
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -126,13 +125,12 @@ func (a *Fetcher) fetchGroups(ctx context.Context) ([]*accessgraphv1alpha.AWSGro
 // awsGroupToProtoGroup converts an AWS IAM group to a proto group.
 func awsGroupToProtoGroup(group iamtypes.Group, accountID string) *accessgraphv1alpha.AWSGroupV1 {
 	return &accessgraphv1alpha.AWSGroupV1{
-		Name:         aws.ToString(group.GroupName),
-		Arn:          aws.ToString(group.Arn),
-		Path:         aws.ToString(group.Path),
-		GroupId:      aws.ToString(group.GroupId),
-		CreatedAt:    awsTimeToProtoTime(group.CreateDate),
-		AccountId:    accountID,
-		LastSyncTime: timestamppb.Now(),
+		Name:      aws.ToString(group.GroupName),
+		Arn:       aws.ToString(group.Arn),
+		Path:      aws.ToString(group.Path),
+		GroupId:   aws.ToString(group.GroupId),
+		CreatedAt: awsTimeToProtoTime(group.CreateDate),
+		AccountId: accountID,
 	}
 }
 
@@ -192,7 +190,6 @@ func awsGroupPolicyToProtoGroupPolicy(policy *iam.GetGroupPolicyOutput, accountI
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		Group:          group,
 		AccountId:      accountID,
-		LastSyncTime:   timestamppb.Now(),
 	}
 }
 
@@ -219,9 +216,8 @@ func (a *Fetcher) fetchGroupAttachedPolicies(ctx context.Context, group *accessg
 	)
 
 	rsp := &accessgraphv1alpha.AWSGroupAttachedPolicies{
-		Group:        group,
-		AccountId:    a.AccountID,
-		LastSyncTime: timestamppb.Now(),
+		Group:     group,
+		AccountId: a.AccountID,
 	}
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
diff --git a/lib/srv/discovery/fetchers/aws-sync/iam_test.go b/lib/srv/discovery/fetchers/aws-sync/iam_test.go
index 9e84d892a224f..01185a153e273 100644
--- a/lib/srv/discovery/fetchers/aws-sync/iam_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/iam_test.go
@@ -115,7 +115,6 @@ func TestAWSIAMPollSAMLProviders(t *testing.T) {
 		expected,
 		result.SAMLProviders,
 		protocmp.Transform(),
-		protocmp.IgnoreFields(&accessgraphv1alpha.AWSSAMLProviderV1{}, "last_sync_time"),
 	))
 }
 
@@ -266,7 +265,6 @@ func TestAWSIAMPollOIDCProviders(t *testing.T) {
 		expected,
 		result.OIDCProviders,
 		protocmp.Transform(),
-		protocmp.IgnoreFields(&accessgraphv1alpha.AWSOIDCProviderV1{}, "last_sync_time"),
 	))
 }
 
diff --git a/lib/srv/discovery/fetchers/aws-sync/idp.go b/lib/srv/discovery/fetchers/aws-sync/idp.go
index f1aa70db6189a..be9d4516a090e 100644
--- a/lib/srv/discovery/fetchers/aws-sync/idp.go
+++ b/lib/srv/discovery/fetchers/aws-sync/idp.go
@@ -26,7 +26,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/gravitational/trace"
 	samltypes "github.com/russellhaering/gosaml2/types"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -128,7 +127,6 @@ func awsSAMLProviderOutputToProto(arn string, accountID string, provider *iam.Ge
 		EntityId:            metadata.EntityID,
 		SsoUrls:             ssoURLs,
 		SigningCertificates: signingCerts,
-		LastSyncTime:        timestamppb.Now(),
 	}, nil
 }
 
@@ -197,13 +195,12 @@ func awsOIDCProviderOutputToProto(arn string, accountID string, provider *iam.Ge
 	}
 
 	return &accessgraphv1alpha.AWSOIDCProviderV1{
-		Arn:          arn,
-		CreatedAt:    awsTimeToProtoTime(provider.CreateDate),
-		Tags:         tags,
-		AccountId:    accountID,
-		ClientIds:    provider.ClientIDList,
-		Thumbprints:  provider.ThumbprintList,
-		Url:          aws.ToString(provider.Url),
-		LastSyncTime: timestamppb.Now(),
+		Arn:         arn,
+		CreatedAt:   awsTimeToProtoTime(provider.CreateDate),
+		Tags:        tags,
+		AccountId:   accountID,
+		ClientIds:   provider.ClientIDList,
+		Thumbprints: provider.ThumbprintList,
+		Url:         aws.ToString(provider.Url),
 	}, nil
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/kms.go b/lib/srv/discovery/fetchers/aws-sync/kms.go
new file mode 100644
index 0000000000000..fe054e7e6707d
--- /dev/null
+++ b/lib/srv/discovery/fetchers/aws-sync/kms.go
@@ -0,0 +1,250 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package aws_sync
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kms"
+	"github.com/aws/smithy-go"
+	"github.com/gravitational/trace"
+	"golang.org/x/sync/errgroup"
+
+	pb "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+)
+
+type kmsClient interface {
+	kms.ListKeysAPIClient
+	kms.ListResourceTagsAPIClient
+	kms.ListAliasesAPIClient
+	DescribeKey(ctx context.Context, params *kms.DescribeKeyInput, optFns ...func(*kms.Options)) (*kms.DescribeKeyOutput, error)
+	GetKeyPolicy(ctx context.Context, params *kms.GetKeyPolicyInput, optFns ...func(*kms.Options)) (*kms.GetKeyPolicyOutput, error)
+}
+
+// pollAWSKMSKeys returns a function that fetches AWS KMS keys, their aliases,
+// tags, and their inline key policy.
+func (a *Fetcher) pollAWSKMSKeys(ctx context.Context, result *Resources, collectErr func(error)) func() error {
+	return func() error {
+		var err error
+		result.KMSKeys, err = a.fetchKMSKeys(ctx)
+		if err != nil {
+			collectErr(trace.Wrap(err, "failed to fetch KMS keys"))
+		}
+		return nil
+	}
+}
+
+// fetchKMSKeys fetches AWS KMS keys, their aliases, tags, and their inline key
+// policy. Up to five regions are fetched concurrently.
+func (a *Fetcher) fetchKMSKeys(ctx context.Context) ([]*pb.AWSKMSKeyV1, error) {
+	var keys []*pb.AWSKMSKeyV1
+	var errs []error
+	var mu sync.Mutex
+
+	collectKeys := func(nextKeys []*pb.AWSKMSKeyV1, err error) {
+		mu.Lock()
+		defer mu.Unlock()
+		if err != nil {
+			errs = append(errs, err)
+		}
+		if nextKeys != nil {
+			keys = append(keys, nextKeys...)
+		}
+	}
+
+	errGroup := errgroup.Group{}
+	// Set the limit to 5 to avoid too many concurrent requests.
+	// This is a temporary solution until we have a better way to limit the
+	// number of concurrent requests.
+	errGroup.SetLimit(5)
+
+	for _, region := range a.Regions {
+		errGroup.Go(func() error {
+			awsCfg, err := a.AWSConfigProvider.GetConfig(ctx, region, a.getAWSOptions()...)
+			if err != nil {
+				collectKeys(nil, trace.Wrap(err))
+				return nil
+			}
+			client := a.awsClients.getKMSClient(awsCfg)
+			keys, err := a.fetchKMSKeysForRegion(ctx, client, region)
+			collectKeys(keys, err)
+			return nil
+		})
+	}
+
+	err := errGroup.Wait()
+	return keys, trace.NewAggregate(append(errs, err)...)
+}
+
+// fetchKMSKeysForRegion fetches all AWS KMS keys for a given region and
+// converts them to the Teleport protobuf representation. It is lenient with
+// errors on individual keys in order to continue fetching other keys. All
+// errors encountered are aggregated into a single error, except for pager
+// errors which cause an immediate return to avoid an endless loop.
+func (a *Fetcher) fetchKMSKeysForRegion(ctx context.Context, client kmsClient, region string) ([]*pb.AWSKMSKeyV1, error) {
+	input := &kms.ListKeysInput{}
+	opt := func(opt *kms.ListKeysPaginatorOptions) { opt.StopOnDuplicateToken = true }
+	pager := kms.NewListKeysPaginator(client, input, opt)
+
+	var keys []*pb.AWSKMSKeyV1
+	var errs []error
+	for pager.HasMorePages() {
+		page, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		for _, key := range page.Keys {
+			key, err := a.fetchKMSKey(ctx, client, aws.ToString(key.KeyId), region)
+			if err != nil {
+				errs = append(errs, err)
+			}
+			if key != nil {
+				keys = append(keys, key)
+			}
+		}
+	}
+	if len(errs) > 0 {
+		return keys, trace.NewAggregate(errs...)
+	}
+	return keys, nil
+}
+
+// fetchKMSKey fetches a single AWS KMS key and converts it to the Teleport
+// protobuf representation. It is lenient with errors on subqueries to fetch
+// tags, aliases and policies and aggregates them into a single error. This is
+// useful if permissions don't allow any of the subqueries.
+func (a *Fetcher) fetchKMSKey(ctx context.Context, client kmsClient, keyID string, region string) (*pb.AWSKMSKeyV1, error) {
+	input := &kms.DescribeKeyInput{KeyId: &keyID}
+	var errs []error
+	output, err := client.DescribeKey(ctx, input)
+	if err != nil {
+		a.handleKMSKeyError(ctx, keyID, err, &errs, "cannot describe KMS key")
+	}
+	result := awsToProtoKMSKey(output, a.AccountID, region, keyID)
+	result.Tags, err = getKMSTags(ctx, client, keyID)
+	if err != nil {
+		a.handleKMSKeyError(ctx, keyID, err, &errs, "cannot get tags for KMS key")
+	}
+	result.Aliases, err = getAliases(ctx, client, keyID)
+	if err != nil {
+		a.handleKMSKeyError(ctx, keyID, err, &errs, "cannot get aliases for KMS key")
+	}
+	result.PolicyDocument, err = getPolicy(ctx, client, keyID)
+	if err != nil {
+		a.handleKMSKeyError(ctx, keyID, err, &errs, "cannot get key policy for KMS key")
+	}
+	if len(errs) > 0 {
+		return result, trace.NewAggregate(errs...)
+	}
+	return result, nil
+}
+
+func (a *Fetcher) handleKMSKeyError(ctx context.Context, keyID string, err error, errs *[]error, msg string) {
+	if isAccessDeniedException(err) {
+		a.Log.WarnContext(ctx, "access denied: "+msg, "key_id", keyID) //nolint: sloglint // string literal requirement makes this unnecessarily verbose
+	} else {
+		*errs = append(*errs, trace.Wrap(err, "%s %q", msg, keyID))
+	}
+}
+
+func isAccessDeniedException(err error) bool {
+	var apiErr smithy.APIError
+	return errors.As(err, &apiErr) && apiErr.ErrorCode() == "AccessDeniedException"
+}
+
+// awsToProtoKMSKey converts an AWS KMS key as represented in the AWS client
+// library to the Teleport protobuf representation.
+func awsToProtoKMSKey(output *kms.DescribeKeyOutput, accountID, region, keyID string) *pb.AWSKMSKeyV1 {
+	if output == nil {
+		return &pb.AWSKMSKeyV1{
+			Arn:       fmt.Sprintf("arn:aws:kms:%s:%s:key/%s", region, accountID, keyID),
+			Region:    region,
+			AccountId: accountID,
+		}
+	}
+	var multiRegionType string
+	if cfg := output.KeyMetadata.MultiRegionConfiguration; cfg != nil {
+		multiRegionType = string(cfg.MultiRegionKeyType)
+	}
+	return &pb.AWSKMSKeyV1{
+		Arn:                aws.ToString(output.KeyMetadata.Arn),
+		CreatedAt:          awsTimeToProtoTime(output.KeyMetadata.CreationDate),
+		Region:             region,
+		AccountId:          accountID,
+		HsmClusterId:       aws.ToString(output.KeyMetadata.CloudHsmClusterId),
+		MultiRegionKeyType: multiRegionType,
+	}
+}
+
+// getKMSTags fetches tags for a KMS key. Potentially access rights to tags differ
+// to the key access rights as tags are sensitive when used for access control
+// via ABAC.
+func getKMSTags(ctx context.Context, client kmsClient, keyID string) ([]*pb.AWSTag, error) {
+	input := &kms.ListResourceTagsInput{KeyId: &keyID}
+	pager := kms.NewListResourceTagsPaginator(client, input)
+	var tags []*pb.AWSTag
+	for pager.HasMorePages() {
+		page, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to list tags for key %s", keyID)
+		}
+		for _, t := range page.Tags {
+			tag := &pb.AWSTag{
+				Key:   aws.ToString(t.TagKey),
+				Value: strPtrToWrapper(t.TagValue),
+			}
+			tags = append(tags, tag)
+		}
+	}
+	return tags, nil
+}
+
+// getAliases fetches aliases for a KMS key. Potentially access rights to
+// aliases differ to the key access rights as aliases are sensitive when used
+// for access control via ABAC.
+func getAliases(ctx context.Context, client kmsClient, keyID string) ([]string, error) {
+	input := &kms.ListAliasesInput{KeyId: &keyID}
+	pager := kms.NewListAliasesPaginator(client, input)
+	var aliases []string
+	for pager.HasMorePages() {
+		page, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to list aliases for key %s", keyID)
+		}
+		for _, alias := range page.Aliases {
+			aliases = append(aliases, aws.ToString(alias.AliasName))
+		}
+	}
+	return aliases, nil
+}
+
+// getPolicy fetches the attached key policy for a KMS key. There is always
+// exactly one key policy per KMS key called default.
+func getPolicy(ctx context.Context, client kmsClient, keyID string) ([]byte, error) {
+	input := &kms.GetKeyPolicyInput{KeyId: &keyID}
+	output, err := client.GetKeyPolicy(ctx, input)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to get key policy for key %s", keyID)
+	}
+	return []byte(aws.ToString(output.Policy)), nil
+}
diff --git a/lib/srv/discovery/fetchers/aws-sync/kms_test.go b/lib/srv/discovery/fetchers/aws-sync/kms_test.go
new file mode 100644
index 0000000000000..1ce00ee90127a
--- /dev/null
+++ b/lib/srv/discovery/fetchers/aws-sync/kms_test.go
@@ -0,0 +1,236 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package aws_sync
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/kms/types"
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+
+	pb "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
+	"github.com/gravitational/teleport/lib/cloud/mocks"
+)
+
+var kmsTests = []struct {
+	name       string
+	mockOutput map[string]mocks.KMSOutput
+	mockError  error
+}{
+	{
+		name: "single, simple key",
+		mockOutput: map[string]mocks.KMSOutput{
+			"key1": {
+				ARN:          "arn1",
+				CreationDate: time.Now(),
+			},
+		},
+	},
+	{
+		name: "key with tags, policy, multiple regions, aliases, hsm cluster",
+		mockOutput: map[string]mocks.KMSOutput{
+			"key1": {
+				ARN:          "arn1",
+				CreationDate: time.Now(),
+				Tags:         map[string]string{"key1": "value1"},
+				Policy:       "policy1",
+				Aliases:      []string{"alias1"},
+				MultiType:    types.MultiRegionKeyTypePrimary,
+				HSMClusterID: "hsm-cluster1",
+			},
+		},
+	},
+	{
+		name: "multiple keys",
+		mockOutput: map[string]mocks.KMSOutput{
+			"key1": {
+				ARN:          "arn1",
+				CreationDate: time.Now(),
+				Tags:         map[string]string{"key1": "value1"},
+				Policy:       "policy1",
+				Aliases:      []string{"alias1"},
+			},
+			"key2": {
+				ARN:          "arn2",
+				CreationDate: time.Now(),
+				MultiType:    types.MultiRegionKeyTypeReplica,
+				HSMClusterID: "hsm-cluster2",
+			},
+			"key3": {
+				ARN:          "arn3",
+				CreationDate: time.Now(),
+				HSMClusterID: "hsm-cluster3",
+			},
+		},
+	},
+	{
+		name:      "error listing keys",
+		mockError: errors.New("mock error"),
+	},
+	{
+		name: "multiple key errors",
+		mockOutput: map[string]mocks.KMSOutput{
+			"key1": {
+				ARN:          "arn1",
+				CreationDate: time.Now(),
+				Tags:         map[string]string{"key1": "value1"},
+				Policy:       "policy1",
+				Aliases:      []string{"alias1"},
+
+				DescribeKeyErr: errors.New("describeKey"),
+			},
+			"key2": {
+				ARN:          "arn2",
+				CreationDate: time.Now(),
+				MultiType:    types.MultiRegionKeyTypeReplica,
+				HSMClusterID: "hsm-cluster2",
+
+				TagsErr: errors.New("tags"),
+			},
+			"key3": {
+				ARN:          "arn3",
+				CreationDate: time.Now(),
+				HSMClusterID: "hsm-cluster3",
+
+				AliasesErr: errors.New("aliases"),
+			},
+			"key4": {
+				ARN:          "arn4",
+				CreationDate: time.Now(),
+				HSMClusterID: "hsm-cluster3",
+				Aliases:      []string{"alias1"},
+
+				PolicyErr: errors.New("policy"),
+			},
+		},
+	},
+}
+
+func TestPollAWSKMS(t *testing.T) {
+	const accountID = "12345678"
+	var regions = []string{"us-west-2"}
+	fetcherConfig := Config{
+		AccountID:         accountID,
+		Regions:           regions,
+		AWSConfigProvider: &mocks.AWSConfigProvider{},
+	}
+
+	for _, tt := range kmsTests {
+		t.Run(tt.name, func(t *testing.T) {
+			fetcher := &Fetcher{Config: fetcherConfig}
+			kmsClient := &mocks.KMSClient{Keys: tt.mockOutput, ListKeysErr: tt.mockError}
+			fetcher.awsClients = fakeAWSClients{kmsClient: kmsClient}
+			got := &Resources{}
+			var gotErr error
+			collectErr := func(err error) { gotErr = err }
+			pollFn := fetcher.pollAWSKMSKeys(context.Background(), got, collectErr)
+			err := pollFn()
+			require.NoError(t, err)
+			want, wantErr := kmsMockToProto(kmsClient, accountID, regions[0])
+			requireResourceEqual(t, want, got)
+			requireAggregateErrorEqual(t, wantErr, gotErr)
+		})
+	}
+}
+
+func requireResourceEqual(t *testing.T, want, got *Resources) {
+	tagCmp := func(a, b *pb.AWSTag) bool {
+		return a.Key < b.Key
+	}
+	opts := []cmp.Option{
+		protocmp.Transform(),
+		protocmp.SortRepeated(tagCmp),
+	}
+	require.Empty(t, cmp.Diff(want, got, opts...))
+}
+
+func requireAggregateErrorEqual(t *testing.T, want, got error) {
+	if want == nil {
+		require.NoError(t, got)
+		return
+	}
+	require.Error(t, got)
+	var wantAggregate, gotAggregate trace.Aggregate
+	require.ErrorAs(t, want, &wantAggregate)
+	require.ErrorAs(t, got, &gotAggregate)
+	require.Len(t, gotAggregate.Errors(), 1)
+	if !errors.As(wantAggregate.Errors()[0], &wantAggregate) {
+		return
+	}
+	require.ErrorAs(t, gotAggregate.Errors()[0], &gotAggregate)
+	wantLen := len(wantAggregate.Errors())
+	require.Len(t, gotAggregate.Errors(), wantLen)
+}
+
+func kmsMockToProto(c *mocks.KMSClient, accountID, region string) (*Resources, error) {
+	var errs []error
+	if c.ListKeysErr != nil {
+		return &Resources{}, trace.NewAggregate(c.ListKeysErr)
+	}
+
+	keyIDs := slices.Collect(maps.Keys(c.Keys))
+	slices.Sort(keyIDs)
+	var keys []*pb.AWSKMSKeyV1
+
+	for _, keyID := range keyIDs {
+		k, ok := c.Keys[keyID]
+		if !ok {
+			errs = append(errs, trace.Errorf("key %q not found", keyID))
+			continue
+		}
+		var tags []*pb.AWSTag
+		for key, val := range k.Tags {
+			tag := &pb.AWSTag{Key: key, Value: wrapperspb.String(val)}
+			tags = append(tags, tag)
+		}
+		key := &pb.AWSKMSKeyV1{
+			Arn:                k.ARN,
+			CreatedAt:          timestamppb.New(k.CreationDate),
+			AccountId:          accountID,
+			Region:             region,
+			HsmClusterId:       k.HSMClusterID,
+			PolicyDocument:     []byte(k.Policy),
+			Aliases:            k.Aliases,
+			Tags:               tags,
+			MultiRegionKeyType: string(k.MultiType),
+		}
+		if k.DescribeKeyErr != nil {
+			key.Arn = fmt.Sprintf("arn:aws:kms:%s:%s:key/%s", region, accountID, keyID)
+			key.CreatedAt = nil
+		}
+		keys = append(keys, key)
+		errs = append(errs, k.DescribeKeyErr, k.TagsErr, k.AliasesErr, k.PolicyErr)
+	}
+	err := trace.NewAggregate(errs...)
+	if err != nil {
+		err = trace.NewAggregate(err)
+	}
+	return &Resources{KMSKeys: keys}, err
+}
diff --git a/lib/srv/discovery/fetchers/aws-sync/merge.go b/lib/srv/discovery/fetchers/aws-sync/merge.go
index 6847243e13782..64c1dfed7fe74 100644
--- a/lib/srv/discovery/fetchers/aws-sync/merge.go
+++ b/lib/srv/discovery/fetchers/aws-sync/merge.go
@@ -51,6 +51,7 @@ func MergeResources(results ...*Resources) *Resources {
 		result.RDSDatabases = append(result.RDSDatabases, r.RDSDatabases...)
 		result.SAMLProviders = append(result.SAMLProviders, r.SAMLProviders...)
 		result.OIDCProviders = append(result.OIDCProviders, r.OIDCProviders...)
+		result.KMSKeys = append(result.KMSKeys, r.KMSKeys...)
 	}
 
 	deduplicateResources(result)
@@ -78,4 +79,5 @@ func deduplicateResources(result *Resources) {
 	result.RDSDatabases = deduplicateSlice(result.RDSDatabases, rdsDbKey)
 	result.SAMLProviders = deduplicateSlice(result.SAMLProviders, samlProvKey)
 	result.OIDCProviders = deduplicateSlice(result.OIDCProviders, oidcProvKey)
+	result.KMSKeys = deduplicateSlice(result.KMSKeys, kmsKeyKey)
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/policies.go b/lib/srv/discovery/fetchers/aws-sync/policies.go
index 72dd185787089..9071b57e26894 100644
--- a/lib/srv/discovery/fetchers/aws-sync/policies.go
+++ b/lib/srv/discovery/fetchers/aws-sync/policies.go
@@ -27,7 +27,6 @@ import (
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -142,6 +141,5 @@ func awsPolicyToProtoPolicy(policy iamtypes.Policy, policyDoc []byte, accountID
 		Tags:             tags,
 		PolicyDocument:   policyDoc,
 		AccountId:        accountID,
-		LastSyncTime:     timestamppb.Now(),
 	}
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/rds.go b/lib/srv/discovery/fetchers/aws-sync/rds.go
index 849bd5c71df0f..85a0f383e77ed 100644
--- a/lib/srv/discovery/fetchers/aws-sync/rds.go
+++ b/lib/srv/discovery/fetchers/aws-sync/rds.go
@@ -27,7 +27,6 @@ import (
 	rdstypes "github.com/aws/aws-sdk-go-v2/service/rds/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -120,9 +119,8 @@ func awsRDSInstanceToRDS(instance *rdstypes.DBInstance, region, accountID string
 			Engine:  aws.ToString(instance.Engine),
 			Version: aws.ToString(instance.EngineVersion),
 		},
-		IsCluster:    false,
-		ResourceId:   aws.ToString(instance.DbiResourceId),
-		LastSyncTime: timestamppb.Now(),
+		IsCluster:  false,
+		ResourceId: aws.ToString(instance.DbiResourceId),
 	}
 }
 
@@ -149,9 +147,8 @@ func awsRDSClusterToRDS(instance *rdstypes.DBCluster, region, accountID string)
 			Engine:  aws.ToString(instance.Engine),
 			Version: aws.ToString(instance.EngineVersion),
 		},
-		IsCluster:    true,
-		ResourceId:   aws.ToString(instance.DbClusterResourceId),
-		LastSyncTime: timestamppb.Now(),
+		IsCluster:  true,
+		ResourceId: aws.ToString(instance.DbClusterResourceId),
 	}
 }
 
diff --git a/lib/srv/discovery/fetchers/aws-sync/rds_test.go b/lib/srv/discovery/fetchers/aws-sync/rds_test.go
index 330486aafc862..6211212c6f002 100644
--- a/lib/srv/discovery/fetchers/aws-sync/rds_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/rds_test.go
@@ -23,7 +23,9 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/aws/aws-sdk-go-v2/service/kms"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
 	rdstypes "github.com/aws/aws-sdk-go-v2/service/rds/types"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
@@ -170,7 +172,6 @@ func TestPollAWSRDS(t *testing.T) {
 						return a.Key < b.Key
 					},
 				),
-				protocmp.IgnoreFields(&accessgraphv1alpha.AWSRDSDatabaseV1{}, "last_sync_time"),
 			),
 			)
 
@@ -223,6 +224,8 @@ type fakeAWSClients struct {
 	rdsClient rdsClient
 	s3Client  s3Client
 	stsClient stsClient
+	kmsClient kmsClient
+	cwlClient cloudwatchlogs.FilterLogEventsAPIClient
 }
 
 func (f fakeAWSClients) getIAMClient(cfg aws.Config, optFns ...func(*iam.Options)) iamClient {
@@ -240,3 +243,11 @@ func (f fakeAWSClients) getS3Client(cfg aws.Config, optFns ...func(*s3.Options))
 func (f fakeAWSClients) getSTSClient(cfg aws.Config, optFns ...func(*sts.Options)) stsClient {
 	return f.stsClient
 }
+
+func (f fakeAWSClients) getKMSClient(cfg aws.Config, optFns ...func(*kms.Options)) kmsClient {
+	return f.kmsClient
+}
+
+func (f fakeAWSClients) getCloudWatchLogsClient(cfg aws.Config, optFns ...func(*cloudwatchlogs.Options)) cloudwatchlogs.FilterLogEventsAPIClient {
+	return f.cwlClient
+}
diff --git a/lib/srv/discovery/fetchers/aws-sync/reconcile.go b/lib/srv/discovery/fetchers/aws-sync/reconcile.go
index d9bfc3330ce69..7ab3774e94bad 100644
--- a/lib/srv/discovery/fetchers/aws-sync/reconcile.go
+++ b/lib/srv/discovery/fetchers/aws-sync/reconcile.go
@@ -59,6 +59,7 @@ func ReconcileResults(old *Resources, new *Resources) (upsert, delete *accessgra
 		reconcile(old.RDSDatabases, new.RDSDatabases, rdsDbKey, rdsDbWrap),
 		reconcile(old.SAMLProviders, new.SAMLProviders, samlProvKey, samlProvWrap),
 		reconcile(old.OIDCProviders, new.OIDCProviders, oidcProvKey, oidcProvWrap),
+		reconcile(old.KMSKeys, new.KMSKeys, kmsKeyKey, kmsKeyWrap),
 	}
 	for _, res := range reconciledResources {
 		upsert.Resources = append(upsert.Resources, res.upsert.Resources...)
@@ -296,3 +297,11 @@ func oidcProvKey(provider *accessgraphv1alpha.AWSOIDCProviderV1) string {
 func oidcProvWrap(provider *accessgraphv1alpha.AWSOIDCProviderV1) *accessgraphv1alpha.AWSResource {
 	return &accessgraphv1alpha.AWSResource{Resource: &accessgraphv1alpha.AWSResource_OidcProvider{OidcProvider: provider}}
 }
+
+func kmsKeyKey(key *accessgraphv1alpha.AWSKMSKeyV1) string {
+	return fmt.Sprintf("%s;%s", key.AccountId, key.Arn)
+}
+
+func kmsKeyWrap(key *accessgraphv1alpha.AWSKMSKeyV1) *accessgraphv1alpha.AWSResource {
+	return &accessgraphv1alpha.AWSResource{Resource: &accessgraphv1alpha.AWSResource_KmsKey{KmsKey: key}}
+}
diff --git a/lib/srv/discovery/fetchers/aws-sync/roles.go b/lib/srv/discovery/fetchers/aws-sync/roles.go
index 1770c7f8c310e..60238d01d0821 100644
--- a/lib/srv/discovery/fetchers/aws-sync/roles.go
+++ b/lib/srv/discovery/fetchers/aws-sync/roles.go
@@ -29,7 +29,6 @@ import (
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -193,9 +192,8 @@ func (a *Fetcher) fetchRoleAttachedPolicies(ctx context.Context, role *accessgra
 	)
 
 	rsp := &accessgraphv1alpha.AWSRoleAttachedPolicies{
-		AwsRole:      role,
-		AccountId:    a.AccountID,
-		LastSyncTime: timestamppb.Now(),
+		AwsRole:   role,
+		AccountId: a.AccountID,
 	}
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
@@ -255,7 +253,6 @@ func awsRoleToProtoRole(role iamtypes.Role, accountID string) *accessgraphv1alph
 		RoleLastUsed:             lastTimeUsed,
 		Tags:                     tags,
 		PermissionsBoundary:      permissionsBoundary,
-		LastSyncTime:             timestamppb.Now(),
 	}
 }
 
@@ -265,6 +262,5 @@ func awsRolePolicyToProtoUserPolicy(policy *iam.GetRolePolicyOutput, role *acces
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		AwsRole:        role,
 		AccountId:      accountID,
-		LastSyncTime:   timestamppb.Now(),
 	}
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/s3.go b/lib/srv/discovery/fetchers/aws-sync/s3.go
index 15b42affdee2e..10a258f0daa00 100644
--- a/lib/srv/discovery/fetchers/aws-sync/s3.go
+++ b/lib/srv/discovery/fetchers/aws-sync/s3.go
@@ -30,7 +30,6 @@ import (
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 	awsregion "github.com/gravitational/teleport/lib/utils/aws/region"
@@ -133,9 +132,8 @@ func awsS3Bucket(name string,
 	accountID string,
 ) *accessgraphv1alpha.AWSS3BucketV1 {
 	s3 := &accessgraphv1alpha.AWSS3BucketV1{
-		Name:         name,
-		AccountId:    accountID,
-		LastSyncTime: timestamppb.Now(),
+		Name:      name,
+		AccountId: accountID,
 	}
 	if policy != nil {
 		s3.PolicyDocument = []byte(aws.ToString(policy.Policy))
diff --git a/lib/srv/discovery/fetchers/aws-sync/s3_test.go b/lib/srv/discovery/fetchers/aws-sync/s3_test.go
index ade779690b490..a403e5b45832f 100644
--- a/lib/srv/discovery/fetchers/aws-sync/s3_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/s3_test.go
@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport/api/types"
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
@@ -206,7 +205,6 @@ func TestPollAWSS3(t *testing.T) {
 						return a.Key < b.Key
 					},
 				),
-				protocmp.IgnoreFields(&accessgraphv1alpha.AWSS3BucketV1{}, "last_sync_time"),
 			),
 			)
 
@@ -233,7 +231,6 @@ func createAWSS3Bucket(name, accountID string, policyDocument []byte, isPublic b
 		AccountId:      accountID,
 		PolicyDocument: policyDocument,
 		IsPublic:       isPublic,
-		LastSyncTime:   timestamppb.New(lastSync),
 	}
 }
 
diff --git a/lib/srv/discovery/fetchers/aws-sync/users.go b/lib/srv/discovery/fetchers/aws-sync/users.go
index 4f0c552eede61..8a0a20e57d2aa 100644
--- a/lib/srv/discovery/fetchers/aws-sync/users.go
+++ b/lib/srv/discovery/fetchers/aws-sync/users.go
@@ -27,7 +27,6 @@ import (
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -166,7 +165,6 @@ func awsUserToProtoUser(user iamtypes.User, accountID string) *accessgraphv1alph
 		PasswordLastUsed:    awsTimeToProtoTime(user.PasswordLastUsed),
 		Tags:                tags,
 		PermissionsBoundary: permissionsBoundary,
-		LastSyncTime:        timestamppb.Now(),
 	}
 }
 
@@ -223,7 +221,6 @@ func awsUserPolicyToProtoUserPolicy(policy *iam.GetUserPolicyOutput, user *acces
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		User:           user,
 		AccountId:      accountID,
-		LastSyncTime:   timestamppb.Now(),
 	}
 }
 
@@ -249,9 +246,8 @@ func (a *Fetcher) fetchUserAttachedPolicies(ctx context.Context, user *accessgra
 	)
 
 	rsp := &accessgraphv1alpha.AWSUserAttachedPolicies{
-		User:         user,
-		AccountId:    a.AccountID,
-		LastSyncTime: timestamppb.Now(),
+		User:      user,
+		AccountId: a.AccountID,
 	}
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
@@ -273,8 +269,7 @@ func (a *Fetcher) fetchUserAttachedPolicies(ctx context.Context, user *accessgra
 
 func (a *Fetcher) fetchGroupsForUser(ctx context.Context, user *accessgraphv1alpha.AWSUserV1) (*accessgraphv1alpha.AWSUserGroupsV1, error) {
 	userGroups := &accessgraphv1alpha.AWSUserGroupsV1{
-		User:         user,
-		LastSyncTime: timestamppb.Now(),
+		User: user,
 	}
 
 	awsCfg, err := a.AWSConfigProvider.GetConfig(
diff --git a/lib/srv/discovery/fetchers/azuresync/azure-sync.go b/lib/srv/discovery/fetchers/azuresync/azure-sync.go
index 3f00071c9e679..84bca7cbec271 100644
--- a/lib/srv/discovery/fetchers/azuresync/azure-sync.go
+++ b/lib/srv/discovery/fetchers/azuresync/azure-sync.go
@@ -103,6 +103,9 @@ func NewFetcher(cfg Config, ctx context.Context) (*Fetcher, error) {
 			return nil, trace.Wrap(err)
 		}
 		azureIntegration := integration.GetAzureOIDCIntegrationSpec()
+		if azureIntegration == nil {
+			return nil, trace.BadParameter("expected %q to be an %q integration, was %q instead", integration.GetName(), types.IntegrationSubKindAzureOIDC, integration.GetSubKind())
+		}
 		cred, err = azidentity.NewClientAssertionCredential(azureIntegration.TenantID, azureIntegration.ClientID, func(ctx context.Context) (string, error) {
 			return cfg.OIDCCredentials.GenerateAzureOIDCToken(ctx, cfg.Integration)
 		}, nil)
diff --git a/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go b/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
index 261555b21578e..bb68d3f91e715 100644
--- a/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
+++ b/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
@@ -25,7 +25,11 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
 )
 
 type testRoleDefCli struct {
@@ -108,6 +112,108 @@ func newVm(id string, name string) *armcompute.VirtualMachine {
 	}
 }
 
+type mockOIDCCredentials struct {
+	integration types.Integration
+}
+
+func (m *mockOIDCCredentials) GenerateAzureOIDCToken(ctx context.Context, integration string) (string, error) {
+	return "oidc-token", nil
+}
+
+func (m *mockOIDCCredentials) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+	if m.integration == nil {
+		return nil, trace.NotFound("integration %q not found", name)
+	}
+	return m.integration, nil
+}
+
+func TestNewFetcher(t *testing.T) {
+	tests := []struct {
+		name            string
+		integrationName string
+		integration     types.Integration
+		wantErr         string
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name:            "valid azure integration",
+			integrationName: "azure",
+			integration: &types.IntegrationV1{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindIntegration,
+					SubKind: types.IntegrationSubKindAzureOIDC,
+					Version: types.V1,
+					Metadata: types.Metadata{
+						Name:      "azure",
+						Namespace: defaults.Namespace,
+					},
+				},
+				Spec: types.IntegrationSpecV1{
+					SubKindSpec: &types.IntegrationSpecV1_AzureOIDC{
+						AzureOIDC: &types.AzureOIDCIntegrationSpecV1{
+							ClientID: "baz-quux",
+							TenantID: "foo-bar",
+						},
+					},
+				},
+			},
+		},
+		{
+			name:            "integration not found",
+			integrationName: "azure",
+			integration:     nil,
+			wantErr:         `integration "azure" not found`,
+		},
+		{
+			name:            "invalid integration type",
+			integrationName: "azure",
+			integration: &types.IntegrationV1{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindIntegration,
+					SubKind: types.IntegrationSubKindAWSOIDC,
+					Version: types.V1,
+					Metadata: types.Metadata{
+						Name:      "azure",
+						Namespace: defaults.Namespace,
+					},
+				},
+				Spec: types.IntegrationSpecV1{
+					SubKindSpec: &types.IntegrationSpecV1_AWSOIDC{
+						AWSOIDC: &types.AWSOIDCIntegrationSpecV1{
+							RoleARN: "arn:aws:iam::123456789012:role/teleport",
+						},
+					},
+				},
+			},
+			wantErr: `expected "azure" to be an "azure-oidc" integration, was "aws-oidc" instead`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := NewFetcher(Config{
+				SubscriptionID:      "dummy-subscription-id",
+				Integration:         tt.integrationName,
+				DiscoveryConfigName: "dummy-discovery-config",
+				OIDCCredentials: &mockOIDCCredentials{
+					integration: tt.integration,
+				},
+			}, t.Context())
+
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				require.NotNil(t, f)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+				require.Nil(t, f)
+			}
+		})
+	}
+
+}
+
 func TestPoll(t *testing.T) {
 	roleDefs := []*armauthorization.RoleDefinition{
 		newRoleDef("id1", "name1"),
diff --git a/lib/srv/discovery/fetchers/azuresync/principals.go b/lib/srv/discovery/fetchers/azuresync/principals.go
index 073d6c4713e0c..996c778dfe0e2 100644
--- a/lib/srv/discovery/fetchers/azuresync/principals.go
+++ b/lib/srv/discovery/fetchers/azuresync/principals.go
@@ -22,7 +22,6 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 	"github.com/gravitational/teleport/lib/msgraph"
@@ -78,7 +77,6 @@ func fetchPrincipals(ctx context.Context, subscriptionID string, cli *msgraph.Cl
 		pbPrincipals = append(pbPrincipals, &accessgraphv1alpha.AzurePrincipal{
 			Id:             *res.dirObj.ID,
 			SubscriptionId: subscriptionID,
-			LastSyncTime:   timestamppb.Now(),
 			DisplayName:    *res.dirObj.DisplayName,
 			ObjectType:     res.metadata.objectType,
 		})
diff --git a/lib/srv/discovery/fetchers/azuresync/roleassignments.go b/lib/srv/discovery/fetchers/azuresync/roleassignments.go
index a97fe69727ef8..282b001ba7a09 100644
--- a/lib/srv/discovery/fetchers/azuresync/roleassignments.go
+++ b/lib/srv/discovery/fetchers/azuresync/roleassignments.go
@@ -24,7 +24,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2"
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -57,7 +56,6 @@ func fetchRoleAssignments(ctx context.Context, subscriptionID string, cli RoleAs
 		pbRoleAssign := &accessgraphv1alpha.AzureRoleAssignment{
 			Id:               *roleAssign.ID,
 			SubscriptionId:   subscriptionID,
-			LastSyncTime:     timestamppb.Now(),
 			PrincipalId:      *roleAssign.Properties.PrincipalID,
 			RoleDefinitionId: *roleAssign.Properties.RoleDefinitionID,
 			Scope:            *roleAssign.Properties.Scope,
diff --git a/lib/srv/discovery/fetchers/azuresync/roledefinitions.go b/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
index 485117f898b81..0b50fdde56742 100644
--- a/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
+++ b/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
@@ -24,7 +24,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2"
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 	"github.com/gravitational/teleport/lib/utils/slices"
@@ -69,7 +68,6 @@ func fetchRoleDefinitions(ctx context.Context, subscriptionID string, cli RoleDe
 			Id:             *roleDef.ID,
 			Name:           *roleDef.Properties.RoleName,
 			SubscriptionId: subscriptionID,
-			LastSyncTime:   timestamppb.Now(),
 			Permissions:    pbPerms,
 		}
 		pbRoleDefs = append(pbRoleDefs, pbRoleDef)
diff --git a/lib/srv/discovery/fetchers/azuresync/virtualmachines.go b/lib/srv/discovery/fetchers/azuresync/virtualmachines.go
index cf0d068db7b0c..e605125aa645b 100644
--- a/lib/srv/discovery/fetchers/azuresync/virtualmachines.go
+++ b/lib/srv/discovery/fetchers/azuresync/virtualmachines.go
@@ -23,7 +23,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6"
 	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accessgraphv1alpha "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha"
 )
@@ -52,7 +51,6 @@ func fetchVirtualMachines(ctx context.Context, subscriptionID string, cli Virtua
 		pbVm := accessgraphv1alpha.AzureVirtualMachine{
 			Id:             *vm.ID,
 			SubscriptionId: subscriptionID,
-			LastSyncTime:   timestamppb.Now(),
 			Name:           *vm.Name,
 		}
 		pbVms = append(pbVms, &pbVm)
diff --git a/lib/srv/discovery/fetchers/db/aws.go b/lib/srv/discovery/fetchers/db/aws.go
index 10a49173a5a3a..a4c3d7872e23c 100644
--- a/lib/srv/discovery/fetchers/db/aws.go
+++ b/lib/srv/discovery/fetchers/db/aws.go
@@ -21,6 +21,7 @@ package db
 import (
 	"context"
 	"fmt"
+	"iter"
 	"log/slog"
 
 	"github.com/gravitational/trace"
@@ -190,3 +191,26 @@ func (f *awsFetcher) String() string {
 	return fmt.Sprintf("awsFetcher(Type: %v, Region=%v, Labels=%v)",
 		f.cfg.Type, f.cfg.Region, f.cfg.Labels)
 }
+
+type awsPager[P, O any] interface {
+	HasMorePages() bool
+	NextPage(ctx context.Context, optFns ...func(O)) (P, error)
+}
+
+func pagesWithLimit[P, O any](ctx context.Context, p awsPager[P, O], log *slog.Logger) iter.Seq2[P, error] {
+	return func(yield func(page P, err error) bool) {
+		for i := uint(0); i < maxAWSPages && p.HasMorePages(); i++ {
+			page, err := p.NextPage(ctx)
+			if !yield(page, err) {
+				return
+			}
+		}
+		if !p.HasMorePages() {
+			return
+		}
+		log.DebugContext(ctx,
+			"Skipping AWS API response pages beyond max page limit",
+			"max_pages", maxAWSPages,
+		)
+	}
+}
diff --git a/lib/srv/discovery/fetchers/db/aws_docdb.go b/lib/srv/discovery/fetchers/db/aws_docdb.go
index 8632df542d7fb..f58b76ad1d4b2 100644
--- a/lib/srv/discovery/fetchers/db/aws_docdb.go
+++ b/lib/srv/discovery/fetchers/db/aws_docdb.go
@@ -20,6 +20,7 @@ package db
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
@@ -49,13 +50,13 @@ func (f *rdsDocumentDBFetcher) ComponentShortName() string {
 func (f *rdsDocumentDBFetcher) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	clt := cfg.awsClients.GetRDSClient(awsCfg)
-	clusters, err := f.getAllDBClusters(ctx, clt)
+	clusters, err := f.getAllDBClusters(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -87,7 +88,7 @@ func (f *rdsDocumentDBFetcher) GetDatabases(ctx context.Context, cfg *awsFetcher
 	return databases, nil
 }
 
-func (f *rdsDocumentDBFetcher) getAllDBClusters(ctx context.Context, clt RDSClient) ([]rdstypes.DBCluster, error) {
+func (f *rdsDocumentDBFetcher) getAllDBClusters(ctx context.Context, clt RDSClient, log *slog.Logger) ([]rdstypes.DBCluster, error) {
 	pager := rds.NewDescribeDBClustersPaginator(clt,
 		&rds.DescribeDBClustersInput{
 			Filters: rdsEngineFilter([]string{"docdb"}),
@@ -98,8 +99,7 @@ func (f *rdsDocumentDBFetcher) getAllDBClusters(ctx context.Context, clt RDSClie
 	)
 
 	var clusters []rdstypes.DBCluster
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
diff --git a/lib/srv/discovery/fetchers/db/aws_elasticache.go b/lib/srv/discovery/fetchers/db/aws_elasticache.go
index c5e417ed7c0f4..ad0b5b3809e83 100644
--- a/lib/srv/discovery/fetchers/db/aws_elasticache.go
+++ b/lib/srv/discovery/fetchers/db/aws_elasticache.go
@@ -20,8 +20,10 @@ package db
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/elasticache"
 	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
 	"github.com/gravitational/trace"
@@ -37,10 +39,16 @@ type ElastiCacheClient interface {
 	elasticache.DescribeCacheClustersAPIClient
 	elasticache.DescribeCacheSubnetGroupsAPIClient
 	elasticache.DescribeReplicationGroupsAPIClient
+	elasticache.DescribeServerlessCachesAPIClient
 
 	ListTagsForResource(ctx context.Context, in *elasticache.ListTagsForResourceInput, optFns ...func(*elasticache.Options)) (*elasticache.ListTagsForResourceOutput, error)
 }
 
+// EC2Client is a subset of the AWS EC2 API.
+type EC2Client interface {
+	ec2.DescribeSubnetsAPIClient
+}
+
 // newElastiCacheFetcher returns a new AWS fetcher for ElastiCache databases.
 func newElastiCacheFetcher(cfg awsFetcherConfig) (common.Fetcher, error) {
 	return newAWSFetcher(cfg, &elastiCachePlugin{})
@@ -59,13 +67,13 @@ func (f *elastiCachePlugin) ComponentShortName() string {
 func (f *elastiCachePlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	clt := cfg.awsClients.GetElastiCacheClient(awsCfg)
-	clusters, err := getElastiCacheClusters(ctx, clt)
+	clusters, err := getElastiCacheClusters(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -96,7 +104,7 @@ func (f *elastiCachePlugin) GetDatabases(ctx context.Context, cfg *awsFetcherCon
 
 	// Fetch more information to provide extra labels. Do not fail because some
 	// of these labels are missing.
-	allNodes, err := getElastiCacheNodes(ctx, clt)
+	allNodes, err := getElastiCacheNodes(ctx, clt, cfg.Logger)
 	if err != nil {
 		if trace.IsAccessDenied(err) {
 			cfg.Logger.DebugContext(ctx, "No permissions to describe nodes", "error", err)
@@ -104,7 +112,7 @@ func (f *elastiCachePlugin) GetDatabases(ctx context.Context, cfg *awsFetcherCon
 			cfg.Logger.InfoContext(ctx, "Failed to describe nodes", "error", err)
 		}
 	}
-	allSubnetGroups, err := getElastiCacheSubnetGroups(ctx, clt)
+	allSubnetGroups, err := getElastiCacheSubnetGroups(ctx, clt, cfg.Logger)
 	if err != nil {
 		if trace.IsAccessDenied(err) {
 			cfg.Logger.DebugContext(ctx, "No permissions to describe subnet groups", "error", err)
@@ -115,9 +123,8 @@ func (f *elastiCachePlugin) GetDatabases(ctx context.Context, cfg *awsFetcherCon
 
 	var databases types.Databases
 	for _, cluster := range eligibleClusters {
-		// Resource tags are not found in ectypes.ReplicationGroup but can
-		// be on obtained by ectypes.ListTagsForResource (one call per
-		// resource).
+		// Resource tags are not found in ectypes.ServerlessCache but can
+		// be obtained via ectypes.ListTagsForResource (one call per resource).
 		tags, err := getElastiCacheResourceTags(ctx, clt, cluster.ARN)
 		if err != nil {
 			if trace.IsAccessDenied(err) {
@@ -145,7 +152,7 @@ func (f *elastiCachePlugin) GetDatabases(ctx context.Context, cfg *awsFetcherCon
 }
 
 // getElastiCacheClusters fetches all ElastiCache replication groups.
-func getElastiCacheClusters(ctx context.Context, client ElastiCacheClient) ([]ectypes.ReplicationGroup, error) {
+func getElastiCacheClusters(ctx context.Context, client ElastiCacheClient, log *slog.Logger) ([]ectypes.ReplicationGroup, error) {
 	var out []ectypes.ReplicationGroup
 	pager := elasticache.NewDescribeReplicationGroupsPaginator(client,
 		&elasticache.DescribeReplicationGroupsInput{},
@@ -153,8 +160,7 @@ func getElastiCacheClusters(ctx context.Context, client ElastiCacheClient) ([]ec
 			opts.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
@@ -165,7 +171,7 @@ func getElastiCacheClusters(ctx context.Context, client ElastiCacheClient) ([]ec
 
 // getElastiCacheNodes fetches all ElastiCache nodes that associated with a
 // replication group.
-func getElastiCacheNodes(ctx context.Context, client ElastiCacheClient) ([]ectypes.CacheCluster, error) {
+func getElastiCacheNodes(ctx context.Context, client ElastiCacheClient, log *slog.Logger) ([]ectypes.CacheCluster, error) {
 	var out []ectypes.CacheCluster
 	pager := elasticache.NewDescribeCacheClustersPaginator(client,
 		&elasticache.DescribeCacheClustersInput{},
@@ -173,8 +179,7 @@ func getElastiCacheNodes(ctx context.Context, client ElastiCacheClient) ([]ectyp
 			opts.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
@@ -193,7 +198,7 @@ func getElastiCacheNodes(ctx context.Context, client ElastiCacheClient) ([]ectyp
 }
 
 // getElastiCacheSubnetGroups fetches all ElastiCache subnet groups.
-func getElastiCacheSubnetGroups(ctx context.Context, client ElastiCacheClient) ([]ectypes.CacheSubnetGroup, error) {
+func getElastiCacheSubnetGroups(ctx context.Context, client ElastiCacheClient, log *slog.Logger) ([]ectypes.CacheSubnetGroup, error) {
 	var out []ectypes.CacheSubnetGroup
 	pager := elasticache.NewDescribeCacheSubnetGroupsPaginator(client,
 		&elasticache.DescribeCacheSubnetGroupsInput{},
@@ -201,8 +206,7 @@ func getElastiCacheSubnetGroups(ctx context.Context, client ElastiCacheClient) (
 			opts.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
diff --git a/lib/srv/discovery/fetchers/db/aws_elasticache_serverless.go b/lib/srv/discovery/fetchers/db/aws_elasticache_serverless.go
new file mode 100644
index 0000000000000..9c356557efcbd
--- /dev/null
+++ b/lib/srv/discovery/fetchers/db/aws_elasticache_serverless.go
@@ -0,0 +1,164 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package db
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/aws/aws-sdk-go-v2/service/elasticache"
+	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	libcloudaws "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/srv/discovery/common"
+)
+
+// newElastiCacheServerlessFetcher returns a new AWS fetcher for ElastiCache Serverless databases.
+func newElastiCacheServerlessFetcher(cfg awsFetcherConfig) (common.Fetcher, error) {
+	return newAWSFetcher(cfg, &elastiCacheServerlessPlugin{})
+}
+
+// elastiCacheServerlessPlugin retrieves ElastiCache Serverless cache databases.
+type elastiCacheServerlessPlugin struct{}
+
+func (f *elastiCacheServerlessPlugin) ComponentShortName() string {
+	// (e)lasti(c)ache (s)erver(<)less
+	return "ecs<"
+}
+
+// GetDatabases returns ElastiCache Serverless Redis databases matching the watcher's selectors.
+func (f *elastiCacheServerlessPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
+	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
+		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	clt := cfg.awsClients.GetElastiCacheClient(awsCfg)
+	caches, err := getElastiCacheServerlessCaches(ctx, clt, cfg.Logger)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var eligibleCaches []ectypes.ServerlessCache
+	for _, cache := range caches {
+		if !libcloudaws.IsElastiCacheServerlessCacheSupported(&cache) {
+			cfg.Logger.DebugContext(ctx, "Skipping unsupported ElastiCache Serverless cache",
+				"cache_name", aws.ToString(cache.ServerlessCacheName),
+				"engine", aws.ToString(cache.Engine),
+			)
+			continue
+		}
+		if !libcloudaws.IsElastiCacheServerlessCacheAvailable(&cache) {
+			cfg.Logger.DebugContext(ctx, "Skipping unavailable ElastiCache Serverless cache",
+				"cache_name", aws.ToString(cache.ServerlessCacheName),
+				"status", aws.ToString(cache.Status),
+			)
+			continue
+		}
+		eligibleCaches = append(eligibleCaches, cache)
+	}
+
+	if len(eligibleCaches) == 0 {
+		return nil, nil
+	}
+
+	subnets, err := listAllSubnets(ctx, cfg.awsClients.GetEC2Client(awsCfg), cfg.Logger)
+	if err != nil {
+		if trace.IsAccessDenied(err) {
+			cfg.Logger.DebugContext(ctx, "No permissions to describe subnets", "error", err)
+		} else {
+			cfg.Logger.InfoContext(ctx, "Failed to describe subnets", "error", err)
+		}
+	}
+	var databases types.Databases
+	for _, cache := range eligibleCaches {
+		// Resource tags are not found in ectypes.ServerlessCache but can
+		// be obtained via ectypes.ListTagsForResource (one call per resource).
+		tags, err := getElastiCacheResourceTags(ctx, clt, cache.ARN)
+		if err != nil {
+			if trace.IsAccessDenied(err) {
+				cfg.Logger.DebugContext(ctx, "No permissions to list resource tags", "error", err)
+			} else {
+				cfg.Logger.InfoContext(ctx, "Failed to list resource tags for ElastiCache Serverless cache",
+					"cache_name", aws.ToString(cache.ServerlessCacheName),
+					"error", err,
+				)
+			}
+		}
+
+		extraLabels := common.ExtraElastiCacheServerlessLabels(&cache, tags, subnets)
+		if db, err := common.NewDatabaseFromElastiCacheServerlessCache(&cache, extraLabels); err != nil {
+			cfg.Logger.InfoContext(ctx, "Could not convert ElastiCache Serverless cache to database resource",
+				"cache_name", aws.ToString(cache.ServerlessCacheName),
+				"error", err,
+			)
+		} else {
+			databases = append(databases, db)
+		}
+	}
+	return databases, nil
+}
+
+// getElastiCacheServerlessCaches fetches all ElastiCache Serverless caches.
+func getElastiCacheServerlessCaches(ctx context.Context, client ElastiCacheClient, log *slog.Logger) ([]ectypes.ServerlessCache, error) {
+	var out []ectypes.ServerlessCache
+	pager := elasticache.NewDescribeServerlessCachesPaginator(client,
+		&elasticache.DescribeServerlessCachesInput{},
+		func(opts *elasticache.DescribeServerlessCachesPaginatorOptions) {
+			opts.StopOnDuplicateToken = true
+		},
+	)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
+		if err != nil {
+			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
+		}
+		out = append(out, page.ServerlessCaches...)
+	}
+	return out, nil
+}
+
+type subnetsByID map[string]ec2types.Subnet
+
+// listAllSubnets returns all subnets in the current region mapped by subnet ID.
+func listAllSubnets(ctx context.Context, client EC2Client, log *slog.Logger) (subnetsByID, error) {
+	out := subnetsByID{}
+	pager := ec2.NewDescribeSubnetsPaginator(client,
+		&ec2.DescribeSubnetsInput{},
+		func(opts *ec2.DescribeSubnetsPaginatorOptions) {
+			opts.StopOnDuplicateToken = true
+		},
+	)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
+		if err != nil {
+			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
+		}
+		for _, s := range page.Subnets {
+			out[aws.ToString(s.SubnetId)] = s
+		}
+	}
+	return out, nil
+}
diff --git a/lib/srv/discovery/fetchers/db/aws_elasticache_serverless_test.go b/lib/srv/discovery/fetchers/db/aws_elasticache_serverless_test.go
new file mode 100644
index 0000000000000..5d33d6d7689fb
--- /dev/null
+++ b/lib/srv/discovery/fetchers/db/aws_elasticache_serverless_test.go
@@ -0,0 +1,226 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	ectypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/cloud/mocks"
+	"github.com/gravitational/teleport/lib/srv/discovery/common"
+)
+
+func TestElastiCacheServerlessFetcher(t *testing.T) {
+	t.Parallel()
+	subnets := []ec2types.Subnet{
+		{SubnetId: aws.String("subnet-a"), VpcId: aws.String("vpc1")},
+		{SubnetId: aws.String("subnet-b"), VpcId: aws.String("vpc1")},
+		{SubnetId: aws.String("subnet-c"), VpcId: aws.String("vpc2")},
+		{SubnetId: aws.String("subnet-d"), VpcId: aws.String("vpc2")},
+	}
+	subnetMap := map[string]ec2types.Subnet{}
+	for _, s := range subnets {
+		subnetMap[*s.SubnetId] = s
+	}
+	elasticacheProd, elasticacheDatabaseProd, elasticacheProdTags := makeElastiCacheServerlessCache(t, "ec1", "us-east-1", "prod", subnetMap)
+	elasticacheDatabaseProdWithoutVPCLabel := elasticacheDatabaseProd.Copy()
+	{
+		labels := elasticacheDatabaseProdWithoutVPCLabel.GetAllLabels()
+		require.Contains(t, labels, types.DiscoveryLabelVPCID)
+		delete(labels, types.DiscoveryLabelVPCID)
+	}
+	elasticacheQA, elasticacheDatabaseQA, elasticacheQATags := makeElastiCacheServerlessCache(t, "ec2", "us-east-1", "qa", subnetMap, withElastiCacheServerlessEngine("valkey"))
+	elasticacheUnavailable, _, elasticacheUnavailableTags := makeElastiCacheServerlessCache(t, "ec4", "us-east-1", "prod", subnetMap, func(cache *ectypes.ServerlessCache) {
+		cache.Status = aws.String("deleting")
+	})
+	elasticacheUnsupported, _, elasticacheUnsupportedTags := makeElastiCacheServerlessCache(t, "ec5", "us-east-1", "prod", subnetMap, func(cache *ectypes.ServerlessCache) {
+		cache.Engine = aws.String("memcached")
+	})
+	elasticacheTagsByARN := map[string][]ectypes.Tag{
+		aws.ToString(elasticacheProd.ARN):        elasticacheProdTags,
+		aws.ToString(elasticacheQA.ARN):          elasticacheQATags,
+		aws.ToString(elasticacheUnavailable.ARN): elasticacheUnavailableTags,
+		aws.ToString(elasticacheUnsupported.ARN): elasticacheUnsupportedTags,
+	}
+
+	var paginatedCaches []ectypes.ServerlessCache
+	var paginatedDatabases types.Databases
+	for i := range maxAWSPages + 1 {
+		name := fmt.Sprintf("cache-%d", i)
+		cache, db, tags := makeElastiCacheServerlessCache(t, name, "us-east-1", "prod", subnetMap)
+		paginatedCaches = append(paginatedCaches, *cache)
+		paginatedDatabases = append(paginatedDatabases, db)
+		elasticacheTagsByARN[*cache.ARN] = tags
+	}
+
+	tests := []awsFetcherTest{
+		{
+			name: "fetch all",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets},
+					ecClient: &mocks.ElastiCacheClient{
+						Caches:    []ectypes.ServerlessCache{*elasticacheProd, *elasticacheQA},
+						TagsByARN: elasticacheTagsByARN,
+					}},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", wildcardLabels),
+			wantDatabases: types.Databases{elasticacheDatabaseProd, elasticacheDatabaseQA},
+		},
+		{
+			name: "limits max pages",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets},
+					ecClient: &mocks.ElastiCacheClient{
+						PaginateCaches: true,
+						Caches:         paginatedCaches,
+						TagsByARN:      elasticacheTagsByARN,
+					}},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", wildcardLabels),
+			wantDatabases: paginatedDatabases[:maxAWSPages],
+		},
+		{
+			name: "fetch prod",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets},
+					ecClient: &mocks.ElastiCacheClient{
+						Caches:    []ectypes.ServerlessCache{*elasticacheProd, *elasticacheQA},
+						TagsByARN: elasticacheTagsByARN,
+					},
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", envProdLabels),
+			wantDatabases: types.Databases{elasticacheDatabaseProd},
+		},
+		{
+			name: "skip unavailable",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets},
+					ecClient: &mocks.ElastiCacheClient{
+						Caches:    []ectypes.ServerlessCache{*elasticacheProd, *elasticacheUnavailable},
+						TagsByARN: elasticacheTagsByARN,
+					},
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", wildcardLabels),
+			wantDatabases: types.Databases{elasticacheDatabaseProd},
+		},
+		{
+			name: "skip unsupported",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets},
+					ecClient: &mocks.ElastiCacheClient{
+						Caches:    []ectypes.ServerlessCache{*elasticacheProd, *elasticacheUnsupported},
+						TagsByARN: elasticacheTagsByARN,
+					},
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", wildcardLabels),
+			wantDatabases: types.Databases{elasticacheDatabaseProd},
+		},
+		{
+			name: "skip vpc label on error listing subnets",
+			fetcherCfg: AWSFetcherFactoryConfig{
+				AWSClients: fakeAWSClients{
+					ec2Client: fakeEC2Client{subnets: subnets, fakeErr: errors.New("operation failed due to alpaca stampede")},
+					ecClient: &mocks.ElastiCacheClient{
+						Caches:    []ectypes.ServerlessCache{*elasticacheProd, *elasticacheUnsupported},
+						TagsByARN: elasticacheTagsByARN,
+					},
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(types.AWSMatcherElastiCacheServerless, "us-east-1", wildcardLabels),
+			wantDatabases: types.Databases{elasticacheDatabaseProdWithoutVPCLabel},
+		},
+	}
+	testAWSFetchers(t, tests...)
+}
+
+func makeElastiCacheServerlessCache(t *testing.T, name, region, env string, subnets map[string]ec2types.Subnet, opts ...func(*ectypes.ServerlessCache)) (*ectypes.ServerlessCache, types.Database, []ectypes.Tag) {
+	t.Helper()
+	cache := mocks.ElastiCacheServerless(name, region, opts...)
+
+	tags := []ectypes.Tag{{
+		Key:   aws.String("env"),
+		Value: aws.String(env),
+	}}
+
+	extraLabels := common.ExtraElastiCacheServerlessLabels(cache, tags, subnets)
+	database, err := common.NewDatabaseFromElastiCacheServerlessCache(cache, extraLabels)
+	require.NoError(t, err)
+	common.ApplyAWSDatabaseNameSuffix(database, types.AWSMatcherElastiCacheServerless)
+	return cache, database, tags
+}
+
+func withElastiCacheServerlessEngine(engine string) func(*ectypes.ServerlessCache) {
+	return func(cache *ectypes.ServerlessCache) {
+		cache.Engine = &engine
+	}
+}
+
+type fakeEC2Client struct {
+	subnets []ec2types.Subnet
+	fakeErr error
+}
+
+// Returns information about AWS VPC subnets.
+// This API supports pagination.
+func (f fakeEC2Client) DescribeSubnets(ctx context.Context, input *ec2.DescribeSubnetsInput, _ ...func(*ec2.Options)) (*ec2.DescribeSubnetsOutput, error) {
+	if f.fakeErr != nil {
+		return nil, f.fakeErr
+	}
+	if input.SubnetIds == nil {
+		token := aws.ToString(input.NextToken)
+		for i, subnet := range f.subnets {
+			if token != "" && aws.ToString(subnet.SubnetId) != token {
+				continue
+			}
+			out := &ec2.DescribeSubnetsOutput{
+				Subnets: []ec2types.Subnet{subnet},
+			}
+			if i+1 < len(f.subnets) {
+				out.NextToken = f.subnets[i+1].SubnetId
+			}
+			return out, nil
+		}
+		return &ec2.DescribeSubnetsOutput{}, nil
+	}
+	out := &ec2.DescribeSubnetsOutput{}
+	for _, subnet := range f.subnets {
+		if slices.Contains(input.SubnetIds, aws.ToString(subnet.SubnetId)) {
+			out.Subnets = append(out.Subnets, subnet)
+		}
+	}
+	return out, nil
+}
diff --git a/lib/srv/discovery/fetchers/db/aws_memorydb.go b/lib/srv/discovery/fetchers/db/aws_memorydb.go
index 92398f3191b74..6e42f65598c88 100644
--- a/lib/srv/discovery/fetchers/db/aws_memorydb.go
+++ b/lib/srv/discovery/fetchers/db/aws_memorydb.go
@@ -20,6 +20,7 @@ package db
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	memorydb "github.com/aws/aws-sdk-go-v2/service/memorydb"
@@ -56,13 +57,13 @@ func (f *memoryDBPlugin) ComponentShortName() string {
 func (f *memoryDBPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	clt := cfg.awsClients.GetMemoryDBClient(awsCfg)
-	clusters, err := getMemoryDBClusters(ctx, clt)
+	clusters, err := getMemoryDBClusters(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -91,7 +92,7 @@ func (f *memoryDBPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig
 
 	// Fetch more information to provide extra labels. Do not fail because some
 	// of these labels are missing.
-	allSubnetGroups, err := getMemoryDBSubnetGroups(ctx, clt)
+	allSubnetGroups, err := getMemoryDBSubnetGroups(ctx, clt, cfg.Logger)
 	if err != nil {
 		if trace.IsAccessDenied(err) {
 			cfg.Logger.DebugContext(ctx, "No permissions to describe subnet groups", "error", err)
@@ -129,7 +130,7 @@ func (f *memoryDBPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig
 }
 
 // getMemoryDBClusters fetches all MemoryDB clusters.
-func getMemoryDBClusters(ctx context.Context, client MemoryDBClient) ([]memorydbtypes.Cluster, error) {
+func getMemoryDBClusters(ctx context.Context, client MemoryDBClient, log *slog.Logger) ([]memorydbtypes.Cluster, error) {
 	var out []memorydbtypes.Cluster
 	pager := memorydb.NewDescribeClustersPaginator(client,
 		&memorydb.DescribeClustersInput{},
@@ -137,8 +138,7 @@ func getMemoryDBClusters(ctx context.Context, client MemoryDBClient) ([]memorydb
 			opts.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
@@ -148,14 +148,13 @@ func getMemoryDBClusters(ctx context.Context, client MemoryDBClient) ([]memorydb
 }
 
 // getMemoryDBSubnetGroups fetches all MemoryDB subnet groups.
-func getMemoryDBSubnetGroups(ctx context.Context, client MemoryDBClient) ([]memorydbtypes.SubnetGroup, error) {
+func getMemoryDBSubnetGroups(ctx context.Context, client MemoryDBClient, log *slog.Logger) ([]memorydbtypes.SubnetGroup, error) {
 	var out []memorydbtypes.SubnetGroup
 	pager := memorydb.NewDescribeSubnetGroupsPaginator(client,
 		&memorydb.DescribeSubnetGroupsInput{},
 		func(opts *memorydb.DescribeSubnetGroupsPaginatorOptions) { opts.StopOnDuplicateToken = true },
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
diff --git a/lib/srv/discovery/fetchers/db/aws_opensearch.go b/lib/srv/discovery/fetchers/db/aws_opensearch.go
index 2f729d0a203dc..09412ab301b1b 100644
--- a/lib/srv/discovery/fetchers/db/aws_opensearch.go
+++ b/lib/srv/discovery/fetchers/db/aws_opensearch.go
@@ -56,7 +56,7 @@ func (f *openSearchPlugin) ComponentShortName() string {
 func (f *openSearchPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/srv/discovery/fetchers/db/aws_rds.go b/lib/srv/discovery/fetchers/db/aws_rds.go
index 1dbe6c0380da1..6928f292843b5 100644
--- a/lib/srv/discovery/fetchers/db/aws_rds.go
+++ b/lib/srv/discovery/fetchers/db/aws_rds.go
@@ -60,13 +60,13 @@ func (f *rdsDBInstancesPlugin) ComponentShortName() string {
 func (f *rdsDBInstancesPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	clt := cfg.awsClients.GetRDSClient(awsCfg)
-	instances, err := getAllDBInstances(ctx, clt, maxAWSPages, cfg.Logger)
+	instances, err := getAllDBInstances(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -104,18 +104,18 @@ func (f *rdsDBInstancesPlugin) GetDatabases(ctx context.Context, cfg *awsFetcher
 
 // getAllDBInstances fetches all RDS instances using the provided client, up
 // to the specified max number of pages.
-func getAllDBInstances(ctx context.Context, clt RDSClient, maxPages int, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
-	return getAllDBInstancesWithFilters(ctx, clt, maxPages, rdsInstanceEngines(), rdsEmptyFilter(), logger)
+func getAllDBInstances(ctx context.Context, clt RDSClient, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
+	return getAllDBInstancesWithFilters(ctx, clt, rdsInstanceEngines(), rdsEmptyFilter(), logger)
 }
 
 // findDBInstancesForDBCluster returns the DBInstances associated with a given DB Cluster Identifier
-func findDBInstancesForDBCluster(ctx context.Context, clt RDSClient, maxPages int, dbClusterIdentifier string, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
-	return getAllDBInstancesWithFilters(ctx, clt, maxPages, auroraEngines(), rdsClusterIDFilter(dbClusterIdentifier), logger)
+func findDBInstancesForDBCluster(ctx context.Context, clt RDSClient, dbClusterIdentifier string, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
+	return getAllDBInstancesWithFilters(ctx, clt, auroraEngines(), rdsClusterIDFilter(dbClusterIdentifier), logger)
 }
 
 // getAllDBInstancesWithFilters fetches all RDS instances matching the filters using the provided client, up
 // to the specified max number of pages.
-func getAllDBInstancesWithFilters(ctx context.Context, clt RDSClient, maxPages int, engines []string, baseFilters []rdstypes.Filter, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
+func getAllDBInstancesWithFilters(ctx context.Context, clt RDSClient, engines []string, baseFilters []rdstypes.Filter, logger *slog.Logger) ([]rdstypes.DBInstance, error) {
 	var out []rdstypes.DBInstance
 	err := retryWithIndividualEngineFilters(ctx, logger, engines, func(engineFilters []rdstypes.Filter) error {
 		pager := rds.NewDescribeDBInstancesPaginator(clt,
@@ -127,8 +127,7 @@ func getAllDBInstancesWithFilters(ctx context.Context, clt RDSClient, maxPages i
 			},
 		)
 		var instances []rdstypes.DBInstance
-		for i := 0; i < maxPages && pager.HasMorePages(); i++ {
-			page, err := pager.NextPage(ctx)
+		for page, err := range pagesWithLimit(ctx, pager, logger) {
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -157,13 +156,13 @@ func (f *rdsAuroraClustersPlugin) ComponentShortName() string {
 func (f *rdsAuroraClustersPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	clt := cfg.awsClients.GetRDSClient(awsCfg)
-	clusters, err := getAllDBClusters(ctx, clt, maxAWSPages, cfg.Logger)
+	clusters, err := getAllDBClusters(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -186,7 +185,7 @@ func (f *rdsAuroraClustersPlugin) GetDatabases(ctx context.Context, cfg *awsFetc
 			continue
 		}
 
-		rdsDBInstances, err := findDBInstancesForDBCluster(ctx, clt, maxAWSPages, aws.ToString(cluster.DBClusterIdentifier), cfg.Logger)
+		rdsDBInstances, err := findDBInstancesForDBCluster(ctx, clt, aws.ToString(cluster.DBClusterIdentifier), cfg.Logger)
 		if err != nil || len(rdsDBInstances) == 0 {
 			cfg.Logger.WarnContext(ctx, "Could not fetch Member Instance for DB Cluster",
 				"instance", aws.ToString(cluster.DBClusterIdentifier),
@@ -208,7 +207,7 @@ func (f *rdsAuroraClustersPlugin) GetDatabases(ctx context.Context, cfg *awsFetc
 
 // getAllDBClusters fetches all RDS clusters using the provided client, up to
 // the specified max number of pages.
-func getAllDBClusters(ctx context.Context, clt RDSClient, maxPages int, logger *slog.Logger) ([]rdstypes.DBCluster, error) {
+func getAllDBClusters(ctx context.Context, clt RDSClient, logger *slog.Logger) ([]rdstypes.DBCluster, error) {
 	var out []rdstypes.DBCluster
 	err := retryWithIndividualEngineFilters(ctx, logger, auroraEngines(), func(filters []rdstypes.Filter) error {
 		pager := rds.NewDescribeDBClustersPaginator(clt,
@@ -221,8 +220,7 @@ func getAllDBClusters(ctx context.Context, clt RDSClient, maxPages int, logger *
 		)
 
 		var clusters []rdstypes.DBCluster
-		for i := 0; i < maxPages && pager.HasMorePages(); i++ {
-			page, err := pager.NextPage(ctx)
+		for page, err := range pagesWithLimit(ctx, pager, logger) {
 			if err != nil {
 				return trace.Wrap(err)
 			}
diff --git a/lib/srv/discovery/fetchers/db/aws_rds_proxy.go b/lib/srv/discovery/fetchers/db/aws_rds_proxy.go
index d297434e17200..05c1e602c7d12 100644
--- a/lib/srv/discovery/fetchers/db/aws_rds_proxy.go
+++ b/lib/srv/discovery/fetchers/db/aws_rds_proxy.go
@@ -20,6 +20,7 @@ package db
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
@@ -49,7 +50,7 @@ func (f *rdsDBProxyPlugin) ComponentShortName() string {
 func (f *rdsDBProxyPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -57,14 +58,14 @@ func (f *rdsDBProxyPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConf
 	clt := cfg.awsClients.GetRDSClient(awsCfg)
 	// Get a list of all RDS Proxies. Each RDS Proxy has one "default"
 	// endpoint.
-	rdsProxies, err := getRDSProxies(ctx, clt, maxAWSPages)
+	rdsProxies, err := getRDSProxies(ctx, clt, cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Get all RDS Proxy custom endpoints sorted by the name of the RDS Proxy
 	// that owns the custom endpoints.
-	customEndpointsByProxyName, err := getRDSProxyCustomEndpoints(ctx, clt, maxAWSPages)
+	customEndpointsByProxyName, err := getRDSProxyCustomEndpoints(ctx, clt, cfg.Logger)
 	if err != nil {
 		cfg.Logger.DebugContext(ctx, "Failed to get RDS Proxy endpoints", "error", err)
 	}
@@ -133,7 +134,7 @@ func (f *rdsDBProxyPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConf
 
 // getRDSProxies fetches all RDS Proxies using the provided client, up to the
 // specified max number of pages.
-func getRDSProxies(ctx context.Context, clt RDSClient, maxPages int) ([]rdstypes.DBProxy, error) {
+func getRDSProxies(ctx context.Context, clt RDSClient, log *slog.Logger) ([]rdstypes.DBProxy, error) {
 	pager := rds.NewDescribeDBProxiesPaginator(clt,
 		&rds.DescribeDBProxiesInput{},
 		func(dcpo *rds.DescribeDBProxiesPaginatorOptions) {
@@ -142,8 +143,7 @@ func getRDSProxies(ctx context.Context, clt RDSClient, maxPages int) ([]rdstypes
 	)
 
 	var rdsProxies []rdstypes.DBProxy
-	for i := 0; i < maxPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
@@ -154,7 +154,7 @@ func getRDSProxies(ctx context.Context, clt RDSClient, maxPages int) ([]rdstypes
 
 // getRDSProxyCustomEndpoints fetches all RDS Proxy custom endpoints using the
 // provided client.
-func getRDSProxyCustomEndpoints(ctx context.Context, clt RDSClient, maxPages int) (map[string][]rdstypes.DBProxyEndpoint, error) {
+func getRDSProxyCustomEndpoints(ctx context.Context, clt RDSClient, log *slog.Logger) (map[string][]rdstypes.DBProxyEndpoint, error) {
 	customEndpointsByProxyName := make(map[string][]rdstypes.DBProxyEndpoint)
 	pager := rds.NewDescribeDBProxyEndpointsPaginator(clt,
 		&rds.DescribeDBProxyEndpointsInput{},
@@ -162,8 +162,7 @@ func getRDSProxyCustomEndpoints(ctx context.Context, clt RDSClient, maxPages int
 			ddepo.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
 		}
diff --git a/lib/srv/discovery/fetchers/db/aws_rds_test.go b/lib/srv/discovery/fetchers/db/aws_rds_test.go
index 762bd37191ccd..1c727b9ce32d7 100644
--- a/lib/srv/discovery/fetchers/db/aws_rds_test.go
+++ b/lib/srv/discovery/fetchers/db/aws_rds_test.go
@@ -22,6 +22,7 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	elasticache "github.com/aws/aws-sdk-go-v2/service/elasticache"
 	memorydb "github.com/aws/aws-sdk-go-v2/service/memorydb"
 	opensearch "github.com/aws/aws-sdk-go-v2/service/opensearch"
@@ -311,6 +312,7 @@ func newRegionalFakeRDSClientProvider(cs map[string]RDSClient) fakeRegionalRDSCl
 }
 
 type fakeAWSClients struct {
+	ec2Client        EC2Client
 	ecClient         ElastiCacheClient
 	mdbClient        MemoryDBClient
 	openSearchClient OpenSearchClient
@@ -319,6 +321,10 @@ type fakeAWSClients struct {
 	rssClient        RSSClient
 }
 
+func (f fakeAWSClients) GetEC2Client(cfg aws.Config, optFns ...func(*ec2.Options)) EC2Client {
+	return f.ec2Client
+}
+
 func (f fakeAWSClients) GetElastiCacheClient(cfg aws.Config, optFns ...func(*elasticache.Options)) ElastiCacheClient {
 	return f.ecClient
 }
diff --git a/lib/srv/discovery/fetchers/db/aws_redshift.go b/lib/srv/discovery/fetchers/db/aws_redshift.go
index 351d438bf68e1..518f25d3fec50 100644
--- a/lib/srv/discovery/fetchers/db/aws_redshift.go
+++ b/lib/srv/discovery/fetchers/db/aws_redshift.go
@@ -20,6 +20,7 @@ package db
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/redshift"
@@ -49,12 +50,12 @@ type redshiftPlugin struct{}
 func (f *redshiftPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	clusters, err := getRedshiftClusters(ctx, cfg.awsClients.GetRedshiftClient(awsCfg))
+	clusters, err := getRedshiftClusters(ctx, cfg.awsClients.GetRedshiftClient(awsCfg), cfg.Logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -89,7 +90,7 @@ func (f *redshiftPlugin) ComponentShortName() string {
 
 // getRedshiftClusters fetches all Reshift clusters using the provided client,
 // up to the specified max number of pages
-func getRedshiftClusters(ctx context.Context, clt RedshiftClient) ([]redshifttypes.Cluster, error) {
+func getRedshiftClusters(ctx context.Context, clt RedshiftClient, log *slog.Logger) ([]redshifttypes.Cluster, error) {
 	pager := redshift.NewDescribeClustersPaginator(clt,
 		&redshift.DescribeClustersInput{},
 		func(dcpo *redshift.DescribeClustersPaginatorOptions) {
@@ -97,8 +98,7 @@ func getRedshiftClusters(ctx context.Context, clt RedshiftClient) ([]redshifttyp
 		},
 	)
 	var clusters []redshifttypes.Cluster
-	for pageNum := 0; pageNum < maxAWSPages && pager.HasMorePages(); pageNum++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, libcloudaws.ConvertRequestFailureError(err)
 		}
diff --git a/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go b/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
index 02cc5528e9683..fe867a9ca2444 100644
--- a/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
+++ b/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
@@ -65,7 +65,7 @@ func (f *redshiftServerlessPlugin) ComponentShortName() string {
 func (f *redshiftServerlessPlugin) GetDatabases(ctx context.Context, cfg *awsFetcherConfig) (types.Databases, error) {
 	awsCfg, err := cfg.AWSConfigProvider.GetConfig(ctx, cfg.Region,
 		awsconfig.WithAssumeRole(cfg.AssumeRole.RoleARN, cfg.AssumeRole.ExternalID),
-		awsconfig.WithCredentialsMaybeIntegration(cfg.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: cfg.Integration}),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -92,7 +92,7 @@ func (f *redshiftServerlessPlugin) GetDatabases(ctx context.Context, cfg *awsFet
 }
 
 func getDatabasesFromWorkgroups(ctx context.Context, client RSSClient, logger *slog.Logger) (types.Databases, []*workgroupWithTags, error) {
-	workgroups, err := getRSSWorkgroups(ctx, client)
+	workgroups, err := getRSSWorkgroups(ctx, client, logger)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -128,7 +128,7 @@ func getDatabasesFromWorkgroups(ctx context.Context, client RSSClient, logger *s
 }
 
 func getDatabasesFromVPCEndpoints(ctx context.Context, workgroups []*workgroupWithTags, client RSSClient, logger *slog.Logger) (types.Databases, error) {
-	endpoints, err := getRSSVPCEndpoints(ctx, client)
+	endpoints, err := getRSSVPCEndpoints(ctx, client, logger)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -186,7 +186,7 @@ func getRSSResourceTags(ctx context.Context, arn *string, client RSSClient, logg
 	return output.Tags
 }
 
-func getRSSWorkgroups(ctx context.Context, clt RSSClient) ([]rsstypes.Workgroup, error) {
+func getRSSWorkgroups(ctx context.Context, clt RSSClient, log *slog.Logger) ([]rsstypes.Workgroup, error) {
 	var out []rsstypes.Workgroup
 	pager := rss.NewListWorkgroupsPaginator(clt,
 		&rss.ListWorkgroupsInput{},
@@ -194,8 +194,7 @@ func getRSSWorkgroups(ctx context.Context, clt RSSClient) ([]rsstypes.Workgroup,
 			o.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, libcloudaws.ConvertRequestFailureError(err)
 		}
@@ -204,7 +203,7 @@ func getRSSWorkgroups(ctx context.Context, clt RSSClient) ([]rsstypes.Workgroup,
 	return out, nil
 }
 
-func getRSSVPCEndpoints(ctx context.Context, clt RSSClient) ([]rsstypes.EndpointAccess, error) {
+func getRSSVPCEndpoints(ctx context.Context, clt RSSClient, log *slog.Logger) ([]rsstypes.EndpointAccess, error) {
 	var out []rsstypes.EndpointAccess
 	pager := rss.NewListEndpointAccessPaginator(clt,
 		&rss.ListEndpointAccessInput{},
@@ -212,8 +211,7 @@ func getRSSVPCEndpoints(ctx context.Context, clt RSSClient) ([]rsstypes.Endpoint
 			o.StopOnDuplicateToken = true
 		},
 	)
-	for i := 0; i < maxAWSPages && pager.HasMorePages(); i++ {
-		page, err := pager.NextPage(ctx)
+	for page, err := range pagesWithLimit(ctx, pager, log) {
 		if err != nil {
 			return nil, libcloudaws.ConvertRequestFailureError(err)
 		}
diff --git a/lib/srv/discovery/fetchers/db/azure.go b/lib/srv/discovery/fetchers/db/azure.go
index a1674015af2e2..3e7924878a444 100644
--- a/lib/srv/discovery/fetchers/db/azure.go
+++ b/lib/srv/discovery/fetchers/db/azure.go
@@ -28,7 +28,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
-	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -46,7 +46,7 @@ type azureListClient[DBType comparable] interface {
 // functions that can be used by the common Azure fetcher.
 type azureFetcherPlugin[DBType comparable, ListClient azureListClient[DBType]] interface {
 	// GetListClient returns the azureListClient for the provided subscription.
-	GetListClient(cfg *azureFetcherConfig, subID string) (ListClient, error)
+	GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (ListClient, error)
 	// GetServerLocation returns the server location.
 	GetServerLocation(server DBType) string
 	// NewDatabaseFromServer creates a types.Database from provided server.
@@ -77,7 +77,7 @@ func newAzureFetcher[DBType comparable, ListClient azureListClient[DBType]](conf
 // azureFetcherConfig is the Azure database servers fetcher configuration.
 type azureFetcherConfig struct {
 	// AzureClients are the Azure API clients.
-	AzureClients cloud.AzureClients
+	AzureClients azure.Clients
 	// Type is the type of DB matcher, such as "mysql" or "postgres"
 	Type string
 	// Subscription is the Azure subscription selector.
@@ -93,6 +93,8 @@ type azureFetcherConfig struct {
 	regionSet map[string]struct{}
 	// DiscoveryConfigName is the name of the discovery config which originated the resource.
 	DiscoveryConfigName string
+	// Integration is the name of Azure integration used for auth.
+	Integration string
 }
 
 // regionMatches returns whether a given region matches the configured Regions selector
@@ -154,8 +156,7 @@ func (f *azureFetcher[DBType, ListClient]) FetcherType() string {
 
 // IntegrationName returns the integration name.
 func (f *azureFetcher[DBType, ListClient]) IntegrationName() string {
-	// There is currently no integration that supports Auto Discover for Azure resources.
-	return ""
+	return f.cfg.Integration
 }
 
 // GetDiscoveryConfigName is the name of the discovery config which originated the resource.
@@ -191,7 +192,7 @@ func (f *azureFetcher[DBType, ListClient]) getSubscriptions(ctx context.Context)
 	if f.cfg.Subscription != types.Wildcard {
 		return []string{f.cfg.Subscription}, nil
 	}
-	client, err := f.cfg.AzureClients.GetAzureSubscriptionClient()
+	client, err := f.cfg.AzureClients.GetSubscriptionClient(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -201,7 +202,7 @@ func (f *azureFetcher[DBType, ListClient]) getSubscriptions(ctx context.Context)
 
 // getDBServersInSubscription fetches Azure DB servers within a given subscription.
 func (f *azureFetcher[DBType, ListClient]) getDBServersInSubscription(ctx context.Context, subID string) ([]DBType, error) {
-	client, err := f.GetListClient(&f.cfg, subID)
+	client, err := f.GetListClient(ctx, &f.cfg, subID)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/srv/discovery/fetchers/db/azure_dbserver.go b/lib/srv/discovery/fetchers/db/azure_dbserver.go
index d4d8f11ffd6f7..ddcb4a1e932f3 100644
--- a/lib/srv/discovery/fetchers/db/azure_dbserver.go
+++ b/lib/srv/discovery/fetchers/db/azure_dbserver.go
@@ -42,13 +42,13 @@ func newAzurePostgresFetcher(config azureFetcherConfig) (common.Fetcher, error)
 // azureDBServerPlugin implements azureFetcherPlugin for MySQL and PostgreSQL.
 type azureDBServerPlugin struct{}
 
-func (p *azureDBServerPlugin) GetListClient(cfg *azureFetcherConfig, subID string) (azure.DBServersClient, error) {
+func (p *azureDBServerPlugin) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.DBServersClient, error) {
 	switch cfg.Type {
 	case types.AzureMatcherMySQL:
-		client, err := cfg.AzureClients.GetAzureMySQLClient(subID)
+		client, err := cfg.AzureClients.GetMySQLClient(ctx, subID)
 		return client, trace.Wrap(err)
 	case types.AzureMatcherPostgres:
-		client, err := cfg.AzureClients.GetAzurePostgresClient(subID)
+		client, err := cfg.AzureClients.GetPostgresClient(ctx, subID)
 		return client, trace.Wrap(err)
 	default:
 		return nil, trace.BadParameter("unknown matcher type %q", cfg.Type)
diff --git a/lib/srv/discovery/fetchers/db/azure_dbserver_test.go b/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
index 352e46d49b929..74164d454a5a4 100644
--- a/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
@@ -30,8 +30,8 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
@@ -74,7 +74,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 
 	tests := []struct {
 		name          string
-		inputClients  cloud.AzureClients
+		inputClients  azure.Clients
 		inputMatchers []types.AzureMatcher
 		wantDatabases types.Databases
 	}{
@@ -89,7 +89,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"env": []string{"prod"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQLPerSub: map[string]azure.DBServersClient{
 					subscription1: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 						DBServers: []*armmysql.Server{azMySQLServer1, azMySQLServer2, azMySQLServer3, azMySQLServer5},
@@ -127,7 +127,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"env": []string{"prod"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQLPerSub: map[string]azure.DBServersClient{
 					subscription1: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 						DBServers: []*armmysql.Server{azMySQLServer1},
@@ -167,7 +167,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"*": []string{"*"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQL: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 					DBServers: []*armmysql.Server{
 						azMySQLServer1,
@@ -201,7 +201,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"*": []string{"*"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQL: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 					DBServers: []*armmysql.Server{
 						azMySQLServer1,
@@ -236,7 +236,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"*": []string{"*"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQLPerSub: map[string]azure.DBServersClient{
 					subscription1: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 						DBServers: []*armmysql.Server{azMySQLServer1},
@@ -275,7 +275,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 					ResourceTags:   types.Labels{"*": []string{"*"}},
 				},
 			},
-			inputClients: &cloud.TestCloudClients{
+			inputClients: &azuretest.Clients{
 				AzureMySQL: azure.NewMySQLServersClient(&azure.ARMMySQLMock{
 					DBServers: []*armmysql.Server{
 						azMySQLServer1,
diff --git a/lib/srv/discovery/fetchers/db/azure_managed_sql.go b/lib/srv/discovery/fetchers/db/azure_managed_sql.go
index 4fa3aa7e4bc0a..55d4b84d91935 100644
--- a/lib/srv/discovery/fetchers/db/azure_managed_sql.go
+++ b/lib/srv/discovery/fetchers/db/azure_managed_sql.go
@@ -39,8 +39,8 @@ func newAzureManagedSQLServerFetcher(config azureFetcherConfig) (common.Fetcher,
 // SQL Servers.
 type azureManagedSQLServerFetcher struct{}
 
-func (f *azureManagedSQLServerFetcher) GetListClient(cfg *azureFetcherConfig, subID string) (azure.ManagedSQLServerClient, error) {
-	client, err := cfg.AzureClients.GetAzureManagedSQLServerClient(subID)
+func (f *azureManagedSQLServerFetcher) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.ManagedSQLServerClient, error) {
+	client, err := cfg.AzureClients.GetManagedSQLServerClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/azure_managed_sql_test.go b/lib/srv/discovery/fetchers/db/azure_managed_sql_test.go
index 1d4fee9670973..f8fb48ee57812 100644
--- a/lib/srv/discovery/fetchers/db/azure_managed_sql_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_managed_sql_test.go
@@ -27,11 +27,11 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestSQLManagedServerFetcher(t *testing.T) {
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	fetcher := &azureManagedSQLServerFetcher{}
 
 	t.Run("NewDatabaseFromServer", func(t *testing.T) {
diff --git a/lib/srv/discovery/fetchers/db/azure_mysql_flex.go b/lib/srv/discovery/fetchers/db/azure_mysql_flex.go
index 84dfdbe5201ab..ad9b6cb6be7ad 100644
--- a/lib/srv/discovery/fetchers/db/azure_mysql_flex.go
+++ b/lib/srv/discovery/fetchers/db/azure_mysql_flex.go
@@ -39,8 +39,8 @@ func newAzureMySQLFlexServerFetcher(config azureFetcherConfig) (common.Fetcher,
 type azureMySQLFlexServerFetcher struct{}
 
 // GetListClient returns a server-listing client for Azure MySQL Flexible server.
-func (f *azureMySQLFlexServerFetcher) GetListClient(cfg *azureFetcherConfig, subID string) (azure.MySQLFlexServersClient, error) {
-	client, err := cfg.AzureClients.GetAzureMySQLFlexServersClient(subID)
+func (f *azureMySQLFlexServerFetcher) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.MySQLFlexServersClient, error) {
+	client, err := cfg.AzureClients.GetMySQLFlexServersClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go b/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
index fa8ebf086ac71..0644640f72b45 100644
--- a/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
@@ -28,8 +28,8 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
@@ -45,7 +45,7 @@ func TestAzureMySQLFlexFetchers(t *testing.T) {
 		Regions:      []string{"eastus"},
 	}}
 
-	clients := &cloud.TestCloudClients{
+	clients := &azuretest.Clients{
 		AzureSubscriptionClient: azure.NewSubscriptionClient(&azure.ARMSubscriptionsMock{
 			Subscriptions: []*armsubscription.Subscription{azureSub},
 		}),
diff --git a/lib/srv/discovery/fetchers/db/azure_postgres_flex.go b/lib/srv/discovery/fetchers/db/azure_postgres_flex.go
index 97143b494f397..dd7c8f47c9459 100644
--- a/lib/srv/discovery/fetchers/db/azure_postgres_flex.go
+++ b/lib/srv/discovery/fetchers/db/azure_postgres_flex.go
@@ -39,8 +39,8 @@ func newAzurePostgresFlexServerFetcher(config azureFetcherConfig) (common.Fetche
 type azurePostgresFlexServerFetcher struct{}
 
 // GetListClient returns a server-listing client for Azure PostgreSQL Flexible server.
-func (f *azurePostgresFlexServerFetcher) GetListClient(cfg *azureFetcherConfig, subID string) (azure.PostgresFlexServersClient, error) {
-	client, err := cfg.AzureClients.GetAzurePostgresFlexServersClient(subID)
+func (f *azurePostgresFlexServerFetcher) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.PostgresFlexServersClient, error) {
+	client, err := cfg.AzureClients.GetPostgresFlexServersClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go b/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
index 3c2df60c2e0a4..8438eb9b7a66b 100644
--- a/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
@@ -28,8 +28,8 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
@@ -45,7 +45,7 @@ func TestAzurePostgresFlexFetchers(t *testing.T) {
 		Regions:      []string{"eastus"},
 	}}
 
-	clients := &cloud.TestCloudClients{
+	clients := &azuretest.Clients{
 		AzureSubscriptionClient: azure.NewSubscriptionClient(&azure.ARMSubscriptionsMock{
 			Subscriptions: []*armsubscription.Subscription{azureSub},
 		}),
diff --git a/lib/srv/discovery/fetchers/db/azure_redis.go b/lib/srv/discovery/fetchers/db/azure_redis.go
index a04879db42da7..1fe80c320dc1b 100644
--- a/lib/srv/discovery/fetchers/db/azure_redis.go
+++ b/lib/srv/discovery/fetchers/db/azure_redis.go
@@ -38,8 +38,8 @@ func newAzureRedisFetcher(config azureFetcherConfig) (common.Fetcher, error) {
 // azureRedisPlugin implements azureFetcherPlugin for Azure Redis.
 type azureRedisPlugin struct{}
 
-func (p *azureRedisPlugin) GetListClient(cfg *azureFetcherConfig, subID string) (azure.RedisClient, error) {
-	client, err := cfg.AzureClients.GetAzureRedisClient(subID)
+func (p *azureRedisPlugin) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.RedisClient, error) {
+	client, err := cfg.AzureClients.GetRedisClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/azure_redis_enterprise.go b/lib/srv/discovery/fetchers/db/azure_redis_enterprise.go
index 61a84580483e3..af4337ee25b29 100644
--- a/lib/srv/discovery/fetchers/db/azure_redis_enterprise.go
+++ b/lib/srv/discovery/fetchers/db/azure_redis_enterprise.go
@@ -37,8 +37,8 @@ func newAzureRedisEnterpriseFetcher(config azureFetcherConfig) (common.Fetcher,
 
 type azureRedisEnterprisePlugin struct{}
 
-func (p *azureRedisEnterprisePlugin) GetListClient(cfg *azureFetcherConfig, subID string) (azure.RedisEnterpriseClient, error) {
-	client, err := cfg.AzureClients.GetAzureRedisEnterpriseClient(subID)
+func (p *azureRedisEnterprisePlugin) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.RedisEnterpriseClient, error) {
+	client, err := cfg.AzureClients.GetRedisEnterpriseClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/azure_redis_test.go b/lib/srv/discovery/fetchers/db/azure_redis_test.go
index 2d460b80c1bf2..c5826bf56eef0 100644
--- a/lib/srv/discovery/fetchers/db/azure_redis_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_redis_test.go
@@ -29,8 +29,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
+	"github.com/gravitational/teleport/lib/cloud/azure/azuretest"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
@@ -53,7 +53,7 @@ func TestAzureRedisFetchers(t *testing.T) {
 		Regions:      []string{"eastus"},
 	}}
 
-	clients := &cloud.TestCloudClients{
+	clients := &azuretest.Clients{
 		AzureSubscriptionClient: azure.NewSubscriptionClient(&azure.ARMSubscriptionsMock{
 			Subscriptions: []*armsubscription.Subscription{azureSub},
 		}),
diff --git a/lib/srv/discovery/fetchers/db/azure_sql.go b/lib/srv/discovery/fetchers/db/azure_sql.go
index eebda757556cf..a05dcbbc811d1 100644
--- a/lib/srv/discovery/fetchers/db/azure_sql.go
+++ b/lib/srv/discovery/fetchers/db/azure_sql.go
@@ -38,8 +38,8 @@ func newAzureSQLServerFetcher(config azureFetcherConfig) (common.Fetcher, error)
 // azureSQLServerFetcher implements azureFetcherPlugin for Azure SQL Servers.
 type azureSQLServerFetcher struct{}
 
-func (f *azureSQLServerFetcher) GetListClient(cfg *azureFetcherConfig, subID string) (azure.SQLServerClient, error) {
-	client, err := cfg.AzureClients.GetAzureSQLServerClient(subID)
+func (f *azureSQLServerFetcher) GetListClient(ctx context.Context, cfg *azureFetcherConfig, subID string) (azure.SQLServerClient, error) {
+	client, err := cfg.AzureClients.GetSQLServerClient(ctx, subID)
 	return client, trace.Wrap(err)
 }
 
diff --git a/lib/srv/discovery/fetchers/db/db.go b/lib/srv/discovery/fetchers/db/db.go
index eca656ca067a9..6c0b70d2db6d3 100644
--- a/lib/srv/discovery/fetchers/db/db.go
+++ b/lib/srv/discovery/fetchers/db/db.go
@@ -25,17 +25,18 @@ import (
 	"slices"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/elasticache"
 	"github.com/aws/aws-sdk-go-v2/service/memorydb"
-	opensearch "github.com/aws/aws-sdk-go-v2/service/opensearch"
+	"github.com/aws/aws-sdk-go-v2/service/opensearch"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
 	"github.com/aws/aws-sdk-go-v2/service/redshift"
 	rss "github.com/aws/aws-sdk-go-v2/service/redshiftserverless"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/awsconfig"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
@@ -45,14 +46,15 @@ type makeAzureFetcherFunc func(azureFetcherConfig) (common.Fetcher, error)
 
 var (
 	makeAWSFetcherFuncs = map[string][]makeAWSFetcherFunc{
-		types.AWSMatcherRDS:                {newRDSDBInstancesFetcher, newRDSAuroraClustersFetcher},
-		types.AWSMatcherRDSProxy:           {newRDSDBProxyFetcher},
-		types.AWSMatcherRedshift:           {newRedshiftFetcher},
-		types.AWSMatcherRedshiftServerless: {newRedshiftServerlessFetcher},
-		types.AWSMatcherElastiCache:        {newElastiCacheFetcher},
-		types.AWSMatcherMemoryDB:           {newMemoryDBFetcher},
-		types.AWSMatcherOpenSearch:         {newOpenSearchFetcher},
-		types.AWSMatcherDocumentDB:         {newDocumentDBFetcher},
+		types.AWSMatcherRDS:                   {newRDSDBInstancesFetcher, newRDSAuroraClustersFetcher},
+		types.AWSMatcherRDSProxy:              {newRDSDBProxyFetcher},
+		types.AWSMatcherRedshift:              {newRedshiftFetcher},
+		types.AWSMatcherRedshiftServerless:    {newRedshiftServerlessFetcher},
+		types.AWSMatcherElastiCache:           {newElastiCacheFetcher},
+		types.AWSMatcherElastiCacheServerless: {newElastiCacheServerlessFetcher},
+		types.AWSMatcherMemoryDB:              {newMemoryDBFetcher},
+		types.AWSMatcherOpenSearch:            {newOpenSearchFetcher},
+		types.AWSMatcherDocumentDB:            {newDocumentDBFetcher},
 	}
 
 	makeAzureFetcherFuncs = map[string][]makeAzureFetcherFunc{
@@ -75,6 +77,8 @@ func IsAzureMatcherType(matcherType string) bool {
 
 // AWSClientProvider provides AWS service API clients.
 type AWSClientProvider interface {
+	// GetEC2Client provides an [EC2Client].
+	GetEC2Client(cfg aws.Config, optFns ...func(*ec2.Options)) EC2Client
 	// GetElastiCacheClient provides an [ElastiCacheClient].
 	GetElastiCacheClient(cfg aws.Config, optFns ...func(*elasticache.Options)) ElastiCacheClient
 	// GetMemoryDBClient provides an [MemoryDBClient].
@@ -91,6 +95,10 @@ type AWSClientProvider interface {
 
 type defaultAWSClients struct{}
 
+func (defaultAWSClients) GetEC2Client(cfg aws.Config, optFns ...func(*ec2.Options)) EC2Client {
+	return ec2.NewFromConfig(cfg, optFns...)
+}
+
 func (defaultAWSClients) GetElastiCacheClient(cfg aws.Config, optFns ...func(*elasticache.Options)) ElastiCacheClient {
 	return elasticache.NewFromConfig(cfg, optFns...)
 }
@@ -121,6 +129,9 @@ type AWSFetcherFactoryConfig struct {
 	AWSConfigProvider awsconfig.Provider
 	// AWSClients provides AWS SDK clients.
 	AWSClients AWSClientProvider
+
+	// Logger is the logger used by the factory and its fetchers.
+	Logger *slog.Logger
 }
 
 func (c *AWSFetcherFactoryConfig) checkAndSetDefaults() error {
@@ -130,6 +141,9 @@ func (c *AWSFetcherFactoryConfig) checkAndSetDefaults() error {
 	if c.AWSClients == nil {
 		c.AWSClients = defaultAWSClients{}
 	}
+	if c.Logger == nil {
+		c.Logger = slog.Default()
+	}
 	return nil
 }
 
@@ -167,6 +181,10 @@ func (f *AWSFetcherFactory) MakeFetchers(ctx context.Context, matchers []types.A
 
 			for _, makeFetcher := range makeFetchers {
 				for _, region := range matcher.Regions {
+					if region == types.Wildcard {
+						f.cfg.Logger.WarnContext(ctx, "AWS Database discovery does not support region discovery, remove the '*' from the regions field", "discovery_config", discoveryConfigName)
+						continue
+					}
 					fetcher, err := makeFetcher(awsFetcherConfig{
 						Type:                matcherType,
 						AssumeRole:          assumeRole,
@@ -189,8 +207,13 @@ func (f *AWSFetcherFactory) MakeFetchers(ctx context.Context, matchers []types.A
 }
 
 // MakeAzureFetchers creates new Azure database fetchers.
-func MakeAzureFetchers(clients cloud.AzureClients, matchers []types.AzureMatcher, discoveryConfigName string) (result []common.Fetcher, err error) {
+func MakeAzureFetchers(ctx context.Context, getAzureClients func(ctx context.Context, integration string) (azure.Clients, error), matchers []types.AzureMatcher, discoveryConfigName string) (result []common.Fetcher, err error) {
 	for _, matcher := range services.SimplifyAzureMatchers(matchers) {
+		azureClients, err := getAzureClients(ctx, matcher.Integration)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
 		for _, matcherType := range matcher.Types {
 			makeFetchers, found := makeAzureFetcherFuncs[matcherType]
 			if !found {
@@ -203,13 +226,14 @@ func MakeAzureFetchers(clients cloud.AzureClients, matchers []types.AzureMatcher
 				for _, sub := range matcher.Subscriptions {
 					for _, group := range matcher.ResourceGroups {
 						fetcher, err := makeFetcher(azureFetcherConfig{
-							AzureClients:        clients,
+							AzureClients:        azureClients,
 							Type:                matcherType,
 							Subscription:        sub,
 							ResourceGroup:       group,
 							Labels:              matcher.ResourceTags,
 							Regions:             matcher.Regions,
 							DiscoveryConfigName: discoveryConfigName,
+							Integration:         matcher.Integration,
 						})
 						if err != nil {
 							return nil, trace.Wrap(err)
diff --git a/lib/srv/discovery/fetchers/db/helpers_test.go b/lib/srv/discovery/fetchers/db/helpers_test.go
index 69b94ff9b0896..d9a254cc62e41 100644
--- a/lib/srv/discovery/fetchers/db/helpers_test.go
+++ b/lib/srv/discovery/fetchers/db/helpers_test.go
@@ -20,17 +20,25 @@ package db
 
 import (
 	"context"
+	"os"
 	"testing"
 
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
 var (
 	wildcardLabels = map[string]string{types.Wildcard: types.Wildcard}
 	envProdLabels  = map[string]string{"env": "prod"}
@@ -69,10 +77,15 @@ func mustMakeAWSFetchers(t *testing.T, cfg AWSFetcherFactoryConfig, matchers []t
 	return fetchers
 }
 
-func mustMakeAzureFetchers(t *testing.T, clients cloud.AzureClients, matchers []types.AzureMatcher) []common.Fetcher {
+func mustMakeAzureFetchers(t *testing.T, clients azure.Clients, matchers []types.AzureMatcher) []common.Fetcher {
 	t.Helper()
 
-	fetchers, err := MakeAzureFetchers(clients, matchers, "" /* discovery config */)
+	fetchers, err := MakeAzureFetchers(t.Context(), func(ctx context.Context, integration string) (azure.Clients, error) {
+		if integration != "" {
+			return nil, trace.NotImplemented("expected empty integration, got %q", integration)
+		}
+		return clients, nil
+	}, matchers, "" /* discovery config */)
 	require.NoError(t, err)
 	require.NotEmpty(t, fetchers)
 
diff --git a/lib/srv/discovery/fetchers/eks.go b/lib/srv/discovery/fetchers/eks.go
index 27dcbdd2d83fd..3b7497a274117 100644
--- a/lib/srv/discovery/fetchers/eks.go
+++ b/lib/srv/discovery/fetchers/eks.go
@@ -167,6 +167,10 @@ func MakeEKSFetchersFromAWSMatchers(logger *slog.Logger, clients AWSClientGetter
 			for _, region := range matcher.Regions {
 				switch t {
 				case types.AWSMatcherEKS:
+					if region == types.Wildcard {
+						logger.WarnContext(context.Background(), "EKS discovery does not support region discovery, remove the '*' from the regions field", "discovery_config", discoveryConfigName)
+						continue
+					}
 					fetcher, err := NewEKSFetcher(
 						EKSFetcherConfig{
 							ClientGetter:        clients,
@@ -738,7 +742,7 @@ func (a *eksFetcher) getAWSOpts() []awsconfig.OptionsFn {
 			a.AssumeRole.RoleARN,
 			a.AssumeRole.ExternalID,
 		),
-		awsconfig.WithCredentialsMaybeIntegration(a.Integration),
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: a.Integration}),
 	}
 }
 
diff --git a/lib/srv/discovery/fetchers/eks_test.go b/lib/srv/discovery/fetchers/eks_test.go
index ad8c8667d2862..5899cf35b667b 100644
--- a/lib/srv/discovery/fetchers/eks_test.go
+++ b/lib/srv/discovery/fetchers/eks_test.go
@@ -34,7 +34,7 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestEKSFetcher(t *testing.T) {
@@ -123,7 +123,7 @@ func TestEKSFetcher(t *testing.T) {
 				AssumeRole:   tt.assumeRole,
 				FilterLabels: tt.args.filterLabels,
 				Region:       tt.args.region,
-				Logger:       utils.NewSlogLoggerForTests(),
+				Logger:       logtest.NewLogger(),
 			}
 			fetcher, err := NewEKSFetcher(cfg)
 			require.NoError(t, err)
diff --git a/lib/srv/discovery/fetchers/gke_test.go b/lib/srv/discovery/fetchers/gke_test.go
index 96481bc9d6462..c33c1b261b839 100644
--- a/lib/srv/discovery/fetchers/gke_test.go
+++ b/lib/srv/discovery/fetchers/gke_test.go
@@ -29,7 +29,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestGKEFetcher(t *testing.T) {
@@ -136,7 +136,7 @@ func TestGKEFetcher(t *testing.T) {
 				FilterLabels:  tt.args.filterLabels,
 				Location:      tt.args.location,
 				ProjectID:     tt.args.projectID,
-				Logger:        utils.NewSlogLoggerForTests(),
+				Logger:        logtest.NewLogger(),
 			}
 			fetcher, err := NewGKEFetcher(context.Background(), cfg)
 			require.NoError(t, err)
diff --git a/lib/srv/discovery/fetchers/kube_services_test.go b/lib/srv/discovery/fetchers/kube_services_test.go
index 8e25447e4cdef..d0c68720eadca 100644
--- a/lib/srv/discovery/fetchers/kube_services_test.go
+++ b/lib/srv/discovery/fetchers/kube_services_test.go
@@ -43,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestKubeAppFetcher_Get(t *testing.T) {
@@ -292,7 +293,7 @@ func TestKubeAppFetcher_Get(t *testing.T) {
 				FilterLabels:     tt.matcherLabels,
 				Namespaces:       tt.matcherNamespaces,
 				ProtocolChecker:  tt.protoChecker,
-				Logger:           utils.NewSlogLoggerForTests(),
+				Logger:           logtest.NewLogger(),
 			})
 			require.NoError(t, err)
 
diff --git a/lib/srv/discovery/kube_integration_watcher.go b/lib/srv/discovery/kube_integration_watcher.go
index d5e371cbbb7d1..4306dd55e3cc2 100644
--- a/lib/srv/discovery/kube_integration_watcher.go
+++ b/lib/srv/discovery/kube_integration_watcher.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
 	"github.com/gravitational/teleport/lib/automaticupgrades/version"
+	iterstream "github.com/gravitational/teleport/lib/itertools/stream"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	libslices "github.com/gravitational/teleport/lib/utils/slices"
@@ -127,7 +128,7 @@ func (s *Server) startKubeIntegrationWatchers() error {
 					continue
 				}
 
-				existingClusters, err := clt.GetKubernetesClusters(s.ctx)
+				existingClusters, err := iterstream.Collect(clt.RangeKubernetesClusters(s.ctx, "", ""))
 				if err != nil {
 					s.Log.WarnContext(s.ctx, "Failed to get Kubernetes clusters from cache", "error", err)
 					continue
diff --git a/lib/srv/discovery/kube_integration_watcher_test.go b/lib/srv/discovery/kube_integration_watcher_test.go
index 717e31b0d595e..c6045037db720 100644
--- a/lib/srv/discovery/kube_integration_watcher_test.go
+++ b/lib/srv/discovery/kube_integration_watcher_test.go
@@ -43,13 +43,14 @@ import (
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers"
-	libutils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestServer_getKubeFetchers(t *testing.T) {
@@ -140,7 +141,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 	)
 
 	// Create and start test auth server.
-	testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir: t.TempDir(),
 	})
 	require.NoError(t, err)
@@ -345,7 +346,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 
 			ctx := context.Background()
 			// Create and start test auth server.
-			testAuthServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+			testAuthServer, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 				Dir: t.TempDir(),
 			})
 			require.NoError(t, err)
@@ -356,7 +357,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 			t.Cleanup(func() { require.NoError(t, tlsServer.Close()) })
 
 			// Auth client for discovery service.
-			identity := auth.TestServerID(types.RoleDiscovery, "hostID")
+			identity := authtest.TestServerID(types.RoleDiscovery, "hostID")
 			authClient, err := tlsServer.NewClient(identity)
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, authClient.Close()) })
@@ -406,7 +407,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 						AWS: tc.awsMatchers,
 					},
 					Emitter:        authClient,
-					Log:            libutils.NewSlogLoggerForTests(),
+					Log:            logtest.NewLogger(),
 					DiscoveryGroup: mainDiscoveryGroup,
 				})
 
@@ -520,6 +521,11 @@ func (m *mockIntegrationsTokenGenerator) GetProxies() ([]types.Server, error) {
 	return m.proxies, nil
 }
 
+// ListProxyServers returns a paginated list of registered proxies.
+func (m *mockIntegrationsTokenGenerator) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	return m.proxies, "", nil
+}
+
 // GenerateAWSOIDCToken generates a token to be used to execute an AWS OIDC Integration action.
 func (m *mockIntegrationsTokenGenerator) GenerateAWSOIDCToken(ctx context.Context, integration string) (string, error) {
 	return uuid.NewString(), nil
diff --git a/lib/srv/discovery/kube_services_watcher.go b/lib/srv/discovery/kube_services_watcher.go
index 9940734248588..83b88d8cf8b72 100644
--- a/lib/srv/discovery/kube_services_watcher.go
+++ b/lib/srv/discovery/kube_services_watcher.go
@@ -21,7 +21,6 @@ package discovery
 import (
 	"context"
 	"sync"
-	"time"
 
 	"github.com/gravitational/trace"
 
@@ -73,10 +72,11 @@ func (s *Server) startKubeAppsWatchers() error {
 
 	watcher, err := common.NewWatcher(s.ctx, common.WatcherConfig{
 		FetchersFn:     common.StaticFetchers(s.kubeAppsFetchers),
-		Interval:       5 * time.Minute,
 		Logger:         s.Log.With("kind", types.KindApp),
 		DiscoveryGroup: s.DiscoveryGroup,
+		Interval:       s.PollInterval,
 		Origin:         types.OriginDiscoveryKubernetes,
+		Clock:          s.clock,
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/srv/discovery/kube_watcher.go b/lib/srv/discovery/kube_watcher.go
index 20847f50f069e..8db90ccb07589 100644
--- a/lib/srv/discovery/kube_watcher.go
+++ b/lib/srv/discovery/kube_watcher.go
@@ -80,6 +80,7 @@ func (s *Server) startKubeWatchers() error {
 		DiscoveryGroup: s.DiscoveryGroup,
 		Interval:       s.PollInterval,
 		Origin:         types.OriginCloud,
+		Clock:          s.clock,
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/srv/exec.go b/lib/srv/exec.go
index 6728b27d5748b..7593a9f882585 100644
--- a/lib/srv/exec.go
+++ b/lib/srv/exec.go
@@ -39,10 +39,8 @@ import (
 
 	"github.com/gravitational/teleport"
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
-	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -81,7 +79,7 @@ type Exec interface {
 
 	// WaitForChild blocks until the child process has completed any required
 	// setup operations before proceeding with execution.
-	WaitForChild() error
+	WaitForChild(ctx context.Context) error
 
 	// Continue will resume execution of the process after it completes its
 	// pre-processing routine (placed in a cgroup).
@@ -102,10 +100,8 @@ func NewExecRequest(ctx *ServerContext, command string) (Exec, error) {
 		}, nil
 	}
 
-	// If this is a registered OpenSSH node or proxy recoding mode is
-	// enabled, execute the command on a remote host. This is used by
-	// in-memory forwarding nodes.
-	if types.IsOpenSSHNodeSubKind(ctx.ServerSubKind) || services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
+	// If this is a forwarding node, execute the command on a remote host.
+	if ctx.srv.Component() == teleport.ComponentForwardingNode {
 		return &remoteExec{
 			ctx:     ctx,
 			command: command,
@@ -228,12 +224,8 @@ func (e *localExec) Wait() *ExecResult {
 	return execResult
 }
 
-func (e *localExec) WaitForChild() error {
-	err := waitForSignal(e.Ctx.readyr, 20*time.Second)
-	closeErr := e.Ctx.readyr.Close()
-	// Set to nil so the close in the context doesn't attempt to re-close.
-	e.Ctx.readyr = nil
-	return trace.NewAggregate(err, closeErr)
+func (e *localExec) WaitForChild(ctx context.Context) error {
+	return e.Ctx.WaitForChild(ctx)
 }
 
 // Continue will resume execution of the process after it completes its
@@ -259,12 +251,12 @@ func (e *localExec) transformSecureCopy() error {
 	if err != nil {
 		e.Ctx.GetServer().EmitAuditEvent(e.Ctx.CancelContext(), &apievents.SFTP{
 			Metadata: apievents.Metadata{
-				Code: events.SCPDisallowedCode,
-				Type: events.SCPEvent,
+				Code: events.SFTPDisallowedCode,
+				Type: events.SFTPEvent,
 				Time: time.Now(),
 			},
 			UserMetadata:   e.Ctx.Identity.GetUserMetadata(),
-			ServerMetadata: e.Ctx.GetServer().TargetMetadata(),
+			ServerMetadata: e.Ctx.GetServer().EventMetadata(),
 			Error:          err.Error(),
 		})
 		return trace.Wrap(err)
@@ -311,31 +303,6 @@ func checkSCPAllowed(scx *ServerContext, command string) (bool, error) {
 	return true, trace.Wrap(scx.CheckFileCopyingAllowed())
 }
 
-// waitForSignal will wait 10 seconds for the other side of the pipe to signal, if not
-// received, it will stop waiting and exit.
-func waitForSignal(fd *os.File, timeout time.Duration) error {
-	waitCh := make(chan error, 1)
-	go func() {
-		// Reading from the file descriptor will block until it's closed.
-		_, err := fd.Read(make([]byte, 1))
-		if errors.Is(err, io.EOF) {
-			err = nil
-		}
-		waitCh <- err
-	}()
-
-	// Timeout if no signal has been sent within the provided duration.
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-
-	select {
-	case <-timer.C:
-		return trace.LimitExceeded("timed out waiting for continue signal")
-	case err := <-waitCh:
-		return err
-	}
-}
-
 // remoteExec is used to run an "exec" SSH request and return the result.
 type remoteExec struct {
 	command string
@@ -364,12 +331,12 @@ func (e *remoteExec) Start(ctx context.Context, ch ssh.Channel) (*ExecResult, er
 	if _, err := checkSCPAllowed(e.ctx, e.GetCommand()); err != nil {
 		e.ctx.GetServer().EmitAuditEvent(context.WithoutCancel(ctx), &apievents.SFTP{
 			Metadata: apievents.Metadata{
-				Code: events.SCPDisallowedCode,
-				Type: events.SCPEvent,
+				Code: events.SFTPDisallowedCode,
+				Type: events.SFTPEvent,
 				Time: time.Now(),
 			},
 			UserMetadata:   e.ctx.Identity.GetUserMetadata(),
-			ServerMetadata: e.ctx.GetServer().TargetMetadata(),
+			ServerMetadata: e.ctx.GetServer().EventMetadata(),
 			Error:          err.Error(),
 		})
 		return nil, trace.Wrap(err)
@@ -418,7 +385,7 @@ func (e *remoteExec) Wait() *ExecResult {
 	}
 }
 
-func (e *remoteExec) WaitForChild() error { return nil }
+func (e *remoteExec) WaitForChild(context.Context) error { return nil }
 
 // Continue does nothing for remote command execution.
 func (e *remoteExec) Continue() {}
@@ -435,7 +402,7 @@ func (e *remoteExec) PID() int {
 // instead of ctx.srv.
 func emitExecAuditEvent(ctx *ServerContext, cmd string, execErr error) {
 	// Create common fields for event.
-	serverMeta := ctx.GetServer().TargetMetadata()
+	serverMeta := ctx.GetServer().EventMetadata()
 	sessionMeta := ctx.GetSessionMetadata()
 	userMeta := ctx.Identity.GetUserMetadata()
 
@@ -533,10 +500,10 @@ func getDefaultEnvPath(uid string, loginDefsPath string) string {
 	f, err := utils.OpenFileAllowingUnsafeLinks(loginDefsPath)
 	if err != nil {
 		if uid == "0" {
-			slog.InfoContext(context.Background(), "Unable to open login.defs, returning default su path", "login_defs_path", loginDefsPath, "error", err, "default_path", defaultEnvRootPath)
+			slog.DebugContext(context.Background(), "Unable to open login.defs, returning default su path", "login_defs_path", loginDefsPath, "error", err, "default_path", defaultEnvRootPath)
 			return defaultEnvRootPath
 		}
-		slog.InfoContext(context.Background(), "Unable to open login.defs, returning default path", "login_defs_path", loginDefsPath, "error", err, "default_path", defaultEnvPath)
+		slog.DebugContext(context.Background(), "Unable to open login.defs, returning default path", "login_defs_path", loginDefsPath, "error", err, "default_path", defaultEnvPath)
 		return defaultEnvPath
 	}
 	defer f.Close()
diff --git a/lib/srv/exec_linux_test.go b/lib/srv/exec_linux_test.go
index 5e35f3e6b9f6c..77c47ba62185f 100644
--- a/lib/srv/exec_linux_test.go
+++ b/lib/srv/exec_linux_test.go
@@ -35,12 +35,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 func TestOSCommandPrep(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 
 	srv := newMockServer(t)
 	scx := newExecServerContext(t, srv)
@@ -84,6 +84,7 @@ func TestOSCommandPrep(t *testing.T) {
 		"TERM=xterm",
 		fmt.Sprintf("SSH_TTY=%v", scx.session.term.TTYName()),
 		"SSH_SESSION_ID=xxx",
+		"TELEPORT_SESSION=xxx",
 		"SSH_TELEPORT_HOST_UUID=testID",
 		"SSH_TELEPORT_CLUSTER_NAME=localhost",
 		"SSH_TELEPORT_USER=teleportUser",
@@ -204,7 +205,7 @@ func TestContinue(t *testing.T) {
 	}
 
 	// Wait for the child process to indicate its completed initialization.
-	require.NoError(t, scx.execRequest.WaitForChild())
+	require.NoError(t, scx.execRequest.WaitForChild(t.Context()))
 
 	// Signal to child that it may execute the requested program.
 	scx.execRequest.Continue()
diff --git a/lib/srv/exec_test.go b/lib/srv/exec_test.go
index 090bc8812fbed..d5b38453e38ef 100644
--- a/lib/srv/exec_test.go
+++ b/lib/srv/exec_test.go
@@ -33,13 +33,13 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // TestMain will re-execute Teleport to run a command if "exec" is passed to
 // it as an argument. Otherwise, it will run tests as normal.
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
 	// If the test is re-executing itself, execute the command that comes over
 	// the pipe.
@@ -64,8 +64,6 @@ func TestEmitExecAuditEvent(t *testing.T) {
 	rec, ok := scx.session.recorder.(*mockRecorder)
 	require.True(t, ok)
 
-	scx.GetServer().TargetMetadata()
-
 	expectedUsr, err := user.Current()
 	require.NoError(t, err)
 	expectedHostname := "testHost"
@@ -151,6 +149,7 @@ func newExecServerContext(t *testing.T, srv Server) *ServerContext {
 		term:     term,
 		emitter:  rec,
 		recorder: rec,
+		scx:      scx,
 	}
 	err = scx.SetSSHRequest(&ssh.Request{Type: sshutils.ExecRequest})
 	require.NoError(t, err)
diff --git a/lib/srv/forward/sftp.go b/lib/srv/forward/sftp.go
index 9aa93da548491..9e9a60a60bd79 100644
--- a/lib/srv/forward/sftp.go
+++ b/lib/srv/forward/sftp.go
@@ -94,7 +94,7 @@ func (p *SFTPProxy) Serve() error {
 			Code: events.SFTPSummaryCode,
 			Time: time.Now(),
 		},
-		ServerMetadata:  scx.GetServer().TargetMetadata(),
+		ServerMetadata:  scx.GetServer().EventMetadata(),
 		SessionMetadata: scx.GetSessionMetadata(),
 		UserMetadata:    scx.Identity.GetUserMetadata(),
 		ConnectionMetadata: apievents.ConnectionMetadata{
@@ -211,6 +211,12 @@ func (h *proxyHandlers) Filelist(req *sftp.Request) (_ sftp.ListerAt, err error)
 	return lister, nil
 }
 
+// RealPath canonicalizes a path name, including resolving ".." and
+// following symlinks. Required to implement [sftp.RealPathFileLister].
+func (h *proxyHandlers) RealPath(path string) (string, error) {
+	return h.remoteFS.RealPath(path)
+}
+
 func (h *proxyHandlers) sendSFTPEvent(req *sftp.Request, reqErr error) {
 	wd, err := h.remoteFS.Getwd()
 	if err != nil {
@@ -224,7 +230,7 @@ func (h *proxyHandlers) sendSFTPEvent(req *sftp.Request, reqErr error) {
 	} else if reqErr != nil {
 		h.logger.DebugContext(req.Context(), "failed handling SFTP request", "request", req.Method, "error", reqErr)
 	}
-	event.ServerMetadata = h.scx.GetServer().TargetMetadata()
+	event.ServerMetadata = h.scx.GetServer().EventMetadata()
 	event.SessionMetadata = h.scx.GetSessionMetadata()
 	event.UserMetadata = h.scx.Identity.GetUserMetadata()
 	event.ConnectionMetadata = apievents.ConnectionMetadata{
diff --git a/lib/srv/forward/sshserver.go b/lib/srv/forward/sshserver.go
index a70b37dce245a..416fde3915d5a 100644
--- a/lib/srv/forward/sshserver.go
+++ b/lib/srv/forward/sshserver.go
@@ -28,9 +28,9 @@ import (
 	"net"
 	"os"
 	"strings"
+	"sync"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	semconv "go.opentelemetry.io/otel/semconv/v1.10.0"
@@ -45,18 +45,19 @@ import (
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
-	"github.com/gravitational/teleport/lib/teleagent"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -83,8 +84,6 @@ import (
 type Server struct {
 	logger *slog.Logger
 
-	id string
-
 	// targetConn is the TCP connection to the remote host.
 	targetConn net.Conn
 
@@ -112,7 +111,7 @@ type Server struct {
 	identityContext srv.IdentityContext
 
 	// userAgent is the SSH user agent that was forwarded to the proxy.
-	userAgent teleagent.Agent
+	userAgent sshagent.Client
 
 	// agentlessSigner is used for client authentication when no SSH
 	// user agent is provided, ie when connecting to agentless nodes.
@@ -155,9 +154,9 @@ type Server struct {
 
 	clock clockwork.Clock
 
-	// hostUUID is the UUID of the underlying proxy that the forwarding server
+	// proxyUUID is the UUID of the underlying proxy that the forwarding server
 	// is running in.
-	hostUUID string
+	proxyUUID string
 
 	// closeContext and closeCancel are used to signal to the outside
 	// world that this server is closed
@@ -174,11 +173,7 @@ type Server struct {
 	// of starting spans.
 	tracerProvider oteltrace.TracerProvider
 
-	targetID, targetAddr, targetHostname string
-
 	// targetServer is the host that the connection is being established for.
-	// It **MUST** only be populated when the target is a teleport ssh server
-	// or an agentless server.
 	targetServer types.Server
 }
 
@@ -192,7 +187,7 @@ type ServerConfig struct {
 	// of the server being connected to, whether it is the local cluster or a
 	// remote cluster.
 	TargetClusterAccessPoint srv.AccessPoint
-	UserAgent                teleagent.Agent
+	UserAgent                sshagent.Client
 	TargetConn               net.Conn
 	SrcAddr                  net.Addr
 	DstAddr                  net.Addr
@@ -226,13 +221,13 @@ type ServerConfig struct {
 	// Clock is an optoinal clock to override default real time clock
 	Clock clockwork.Clock
 
-	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// FIPS mode means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	FIPS bool
 
-	// HostUUID is the UUID of the underlying proxy that the forwarding server
+	// ProxyUUID is the UUID of the underlying proxy that the forwarding server
 	// is running in.
-	HostUUID string
+	ProxyUUID string
 
 	// Emitter is audit events emitter
 	Emitter events.StreamEmitter
@@ -248,16 +243,8 @@ type ServerConfig struct {
 	// of starting spans.
 	TracerProvider oteltrace.TracerProvider
 
-	TargetID, TargetAddr, TargetHostname string
-
 	// TargetServer is the host that the connection is being established for.
-	// It **MUST** only be populated when the target is a teleport ssh server
-	// or an agentless server.
 	TargetServer types.Server
-
-	// IsAgentlessNode indicates whether the targetServer is a Node with an OpenSSH server (no teleport agent).
-	// This includes Nodes whose sub kind is OpenSSH and OpenSSHEphemeralKey.
-	IsAgentlessNode bool
 }
 
 // CheckDefaults makes sure all required parameters are passed in.
@@ -271,18 +258,20 @@ func (s *ServerConfig) CheckDefaults() error {
 	if s.DataDir == "" {
 		return trace.BadParameter("missing parameter DataDir")
 	}
-	if s.IsAgentlessNode {
-		if s.TargetServer == nil {
-			return trace.BadParameter("target server is required for agentless nodes")
+	if s.TargetServer == nil {
+		return trace.BadParameter("target server is required")
+	}
+	switch s.TargetServer.GetSubKind() {
+	case types.SubKindTeleportNode:
+		if s.UserAgent == nil {
+			return trace.BadParameter("user agent required for teleport nodes (agentless)")
 		}
-
-		if s.TargetServer.GetSubKind() == types.SubKindOpenSSHNode && s.AgentlessSigner == nil {
+	case types.SubKindOpenSSHNode:
+		if s.AgentlessSigner == nil {
 			return trace.BadParameter("agentless signer is required for OpenSSH Nodes")
 		}
-	}
-
-	if s.UserAgent == nil && !s.IsAgentlessNode {
-		return trace.BadParameter("user agent required for teleport nodes (agentless)")
+	case types.SubKindOpenSSHEICENode:
+		// agentless signer is set once the forwarding server is started.
 	}
 	if s.TargetConn == nil {
 		return trace.BadParameter("connection to target connection required")
@@ -335,7 +324,6 @@ func New(c ServerConfig) (*Server, error) {
 			"src_addr", c.SrcAddr.String(),
 			"dst_addr", c.DstAddr.String(),
 		),
-		id:              uuid.New().String(),
 		targetConn:      c.TargetConn,
 		serverConn:      utils.NewTrackingConn(serverConn),
 		clientConn:      clientConn,
@@ -348,14 +336,11 @@ func New(c ServerConfig) (*Server, error) {
 		authService:     c.LocalAuthClient,
 		dataDir:         c.DataDir,
 		clock:           c.Clock,
-		hostUUID:        c.HostUUID,
+		proxyUUID:       c.ProxyUUID,
 		StreamEmitter:   c.Emitter,
 		parentContext:   c.ParentContext,
 		lockWatcher:     c.LockWatcher,
 		tracerProvider:  c.TracerProvider,
-		targetID:        c.TargetID,
-		targetAddr:      c.TargetAddr,
-		targetHostname:  c.TargetHostname,
 		targetServer:    c.TargetServer,
 	}
 
@@ -401,21 +386,18 @@ func New(c ServerConfig) (*Server, error) {
 	return s, nil
 }
 
-// TargetMetadata returns metadata about the forwarding target.
-func (s *Server) TargetMetadata() apievents.ServerMetadata {
-	var subKind string
-	if s.targetServer != nil {
-		subKind = s.targetServer.GetSubKind()
-	}
-
+// EventMetadata returns metadata about the forwarding target.
+func (s *Server) EventMetadata() apievents.ServerMetadata {
+	serverInfo := s.GetInfo()
 	return apievents.ServerMetadata{
 		ServerVersion:   teleport.Version,
-		ServerNamespace: s.GetNamespace(),
-		ServerID:        s.targetID,
-		ServerAddr:      s.targetAddr,
-		ServerHostname:  s.targetHostname,
-		ForwardedBy:     s.hostUUID,
-		ServerSubKind:   subKind,
+		ServerNamespace: serverInfo.GetNamespace(),
+		ServerID:        serverInfo.GetName(),
+		ServerAddr:      serverInfo.GetAddr(),
+		ServerLabels:    serverInfo.GetAllLabels(),
+		ServerHostname:  serverInfo.GetHostname(),
+		ServerSubKind:   serverInfo.GetSubKind(),
+		ForwardedBy:     s.proxyUUID,
 	}
 }
 
@@ -430,15 +412,15 @@ func (s *Server) GetDataDir() string {
 	return s.dataDir
 }
 
-// ID returns the ID of the proxy that creates the in-memory forwarding server.
+// ID returns the UUID of the server targeted by the forwarding server.
 func (s *Server) ID() string {
-	return s.id
+	return s.targetServer.GetName()
 }
 
 // HostUUID is the UUID of the underlying proxy that the forwarding server
 // is running in.
 func (s *Server) HostUUID() string {
-	return s.hostUUID
+	return s.proxyUUID
 }
 
 // GetNamespace returns the namespace the forwarding server resides in.
@@ -470,8 +452,8 @@ func (s *Server) GetAccessPoint() srv.AccessPoint {
 
 // GetPAM returns the PAM configuration for a server. Because the forwarding
 // server runs in-memory, it does not support PAM.
-func (s *Server) GetPAM() (*servicecfg.PAMConfig, error) {
-	return nil, trace.BadParameter("PAM not supported by forwarding server")
+func (s *Server) GetPAM() *servicecfg.PAMConfig {
+	return &servicecfg.PAMConfig{Enabled: false}
 }
 
 // UseTunnel used to determine if this node has connected to this cluster
@@ -511,19 +493,35 @@ func (s *Server) GetSELinuxEnabled() bool {
 	return false
 }
 
-// GetInfo returns a services.Server that represents this server.
+// GetInfo returns a services.Server that represents the target server.
 func (s *Server) GetInfo() types.Server {
-	return &types.ServerV2{
+	// Only set the address for non-tunnel nodes.
+	var addr string
+	if !s.targetServer.GetUseTunnel() {
+		addr = s.targetServer.GetAddr()
+	}
+
+	srv := &types.ServerV2{
 		Kind:    types.KindNode,
+		SubKind: s.targetServer.GetSubKind(),
 		Version: types.V2,
 		Metadata: types.Metadata{
-			Name:      s.ID(),
-			Namespace: s.GetNamespace(),
+			Name:      s.targetServer.GetName(),
+			Namespace: s.targetServer.GetNamespace(),
+			Labels:    s.targetServer.GetLabels(),
 		},
 		Spec: types.ServerSpecV2{
-			Addr: s.AdvertiseAddr(),
+			CmdLabels:   types.LabelsToV2(s.targetServer.GetCmdLabels()),
+			Addr:        addr,
+			Hostname:    s.targetServer.GetHostname(),
+			UseTunnel:   s.useTunnel,
+			Version:     teleport.Version,
+			ProxyIDs:    s.targetServer.GetProxyIDs(),
+			PublicAddrs: s.targetServer.GetPublicAddrs(),
 		},
 	}
+
+	return srv
 }
 
 // Dial returns the client connection created by pipeAddrConn.
@@ -539,8 +537,8 @@ func (s *Server) GetClock() clockwork.Clock {
 // GetUserAccountingPaths returns the optional override of the utmp, wtmp, and btmp path.
 // These values are never set for the forwarding server because utmp, wtmp, and btmp
 // are updated by the target server and not the forwarding server.
-func (s *Server) GetUserAccountingPaths() (string, string, string) {
-	return "", "", ""
+func (s *Server) GetUserAccountingPaths() (string, string, string, string) {
+	return "", "", "", ""
 }
 
 // GetLockWatcher gets the server's lock watcher.
@@ -548,6 +546,17 @@ func (s *Server) GetLockWatcher() *services.LockWatcher {
 	return s.lockWatcher
 }
 
+// ChildLogConfig returns a noop log configuration since the forwarding server
+// does not spawn child processes.
+func (s *Server) ChildLogConfig() srv.ChildLogConfig {
+	return srv.ChildLogConfig{
+		ExecLogConfig: srv.ExecLogConfig{
+			Level: &slog.LevelVar{},
+		},
+		Writer: io.Discard,
+	}
+}
+
 func (s *Server) Serve() {
 	var (
 		succeeded bool
@@ -566,6 +575,10 @@ func (s *Server) Serve() {
 	config.KeyExchanges = s.kexAlgorithms
 	config.MACs = s.macAlgorithms
 
+	// Set the server version to Teleport to enable tracing and other Teleport
+	// specific features like joining.
+	config.ServerVersion = sshutils.SSHVersionPrefix
+
 	netConfig, err := s.GetAccessPoint().GetClusterNetworkingConfig(s.Context())
 	if err != nil {
 		s.logger.ErrorContext(s.Context(), "Unable to fetch cluster config", "error", err)
@@ -609,11 +622,14 @@ func (s *Server) Serve() {
 		return
 	}
 
-	if s.targetServer != nil && s.targetServer.IsOpenSSHNode() {
+	if s.targetServer.IsOpenSSHNode() {
 		// OpenSSH nodes don't support moderated sessions, send an error to
 		// the user and gracefully fail if the user is attempting to create one.
-		policySets := s.identityContext.UnstableSessionJoiningAccessChecker.SessionPolicySets()
-		evaluator := auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, s.identityContext.TeleportUser)
+		var policySets []*types.SessionTrackerPolicySet
+		if s.identityContext.UnstableSessionJoiningAccessChecker != nil {
+			policySets = s.identityContext.UnstableSessionJoiningAccessChecker.SessionPolicySets()
+		}
+		evaluator := moderation.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, s.identityContext.TeleportUser)
 		if evaluator.IsModerated() {
 			s.rejectChannel(chans, "Moderated sessions cannot be created for OpenSSH nodes")
 			sconn.Close()
@@ -797,7 +813,7 @@ func (s *Server) newRemoteClient(ctx context.Context, systemLogin string, netCon
 	// the correct host. It must occur in the list of principals presented by
 	// the remote server.
 	dstAddr := net.JoinHostPort(s.address, "0")
-	client, err := tracessh.NewClientConnWithDeadline(ctx, s.targetConn, dstAddr, clientConfig)
+	client, err := tracessh.NewClientWithTimeout(ctx, s.targetConn, dstAddr, clientConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -916,7 +932,7 @@ func (s *Server) handleForwardedTCPIPRequest(ctx context.Context, nch ssh.NewCha
 
 	// Create context for this channel. This context will be closed when
 	// forwarding is complete.
-	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext)
+	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext, nil)
 	if err != nil {
 		if err := nch.Reject(ssh.ConnectionFailed, "failed to open server context"); err != nil {
 			s.logger.ErrorContext(ctx, "Error rejecting forwarded-tcpip channel", "error", err)
@@ -987,8 +1003,23 @@ func (s *Server) handleGlobalRequest(ctx context.Context, req *ssh.Request) {
 		}
 		// Pass request on unchanged.
 	case teleport.SessionIDQueryRequest:
+		// TODO(Joerger): DELETE IN v20.0.0
+		// All v17+ servers set the session ID. v19+ clients stop checking.
+
 		// Reply true to session ID query requests, we will set new
-		// session IDs for new sessions
+		// session IDs for new sessions during the shel/exec channel
+		// request.
+		if err := req.Reply(true, nil); err != nil {
+			s.logger.WarnContext(ctx, "Failed to reply to session ID query request", "error", err)
+		}
+		return
+	case teleport.SessionIDQueryRequestV2:
+		// TODO(Joerger): DELETE IN v21.0.0
+		// clients should stop checking in v21, and servers should stop responding to the query in v22.
+
+		// Reply true to session ID query requests, we will set new
+		// session IDs for new sessions directly after accepting the
+		// session channel request.
 		if err := req.Reply(true, nil); err != nil {
 			s.logger.WarnContext(ctx, "Failed to reply to session ID query request", "error", err)
 		}
@@ -1025,8 +1056,8 @@ func (s *Server) checkTCPIPForwardRequest(ctx context.Context, r *ssh.Request) e
 	}
 
 	// RBAC checks are only necessary when connecting to an agentless node
-	if s.targetServer != nil && s.targetServer.IsOpenSSHNode() {
-		scx, err := srv.NewServerContext(s.Context(), s.connectionContext, s, s.identityContext)
+	if s.targetServer.IsOpenSSHNode() {
+		scx, err := srv.NewServerContext(s.Context(), s.connectionContext, s, s.identityContext, nil)
 		if err != nil {
 			return err
 		}
@@ -1089,7 +1120,7 @@ func (s *Server) handleChannel(ctx context.Context, nch ssh.NewChannel) {
 func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ch ssh.Channel, req *sshutils.DirectTCPIPReq) {
 	// Create context for this channel. This context will be closed when
 	// forwarding is complete.
-	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext)
+	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext, nil)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "Unable to create connection context", "error", err)
 		s.stderrWrite(ctx, ch, "Unable to create connection context.")
@@ -1108,7 +1139,7 @@ func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ch ssh.Channel, r
 	ch = scx.TrackActivity(ch)
 
 	// RBAC checks are only necessary when connecting to an agentless node
-	if s.targetServer != nil && s.targetServer.IsOpenSSHNode() {
+	if s.targetServer.IsOpenSSHNode() {
 		err = s.authHandlers.CheckPortForward(scx.DstAddr, scx, decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_LOCAL)
 		if err != nil {
 			s.stderrWrite(ctx, ch, err.Error())
@@ -1127,7 +1158,7 @@ func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ch ssh.Channel, r
 	}
 	defer conn.Close()
 
-	event := scx.GetPortForwardEvent(events.PortForwardEvent, events.PortForwardFailureCode, scx.DstAddr)
+	event := scx.GetPortForwardEvent(events.PortForwardEvent, events.PortForwardCode, scx.DstAddr)
 	if err := s.EmitAuditEvent(s.closeContext, &event); err != nil {
 		s.logger.WarnContext(ctx, "Failed to emit port forward event", "error", err)
 	}
@@ -1141,12 +1172,22 @@ func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ch ssh.Channel, r
 // the remote host. Once the session channel has been established, this function's loop handles
 // all the "exec", "subsystem" and "shell" requests.
 func (s *Server) handleSessionChannel(ctx context.Context, nch ssh.NewChannel) {
+	// sessionParams will not be passed by old clients (< v19) or OpenSSH clients.
+	sessionParams, err := tracessh.ParseSessionParams(nch.ExtraData())
+	if err != nil {
+		s.logger.ErrorContext(ctx, "Failed to parse request data", "data", string(nch.ExtraData()), "error", err)
+		if err := nch.Reject(ssh.ConnectionFailed, fmt.Sprintf("unable to accept channel: %v", err)); err != nil {
+			s.logger.WarnContext(ctx, "Failed to reject channel", "channel", nch.ChannelType(), "error", err)
+		}
+		return
+	}
+
 	// Create context for this channel. This context will be closed when the
 	// session request is complete.
 	// There is no need for the forwarding server to initiate disconnects,
 	// based on teleport business logic, because this logic is already
 	// done on the server's terminating side.
-	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext)
+	scx, err := srv.NewServerContext(ctx, s.connectionContext, s, s.identityContext, sessionParams)
 	if err != nil {
 		s.logger.WarnContext(ctx, "Server context setup failed", "error", err)
 		if err := nch.Reject(ssh.ConnectionFailed, fmt.Sprintf("server context setup failed: %v", err)); err != nil {
@@ -1163,11 +1204,52 @@ func (s *Server) handleSessionChannel(ctx context.Context, nch ssh.NewChannel) {
 	scx.SetAllowFileCopying(true)
 	defer scx.Close()
 
+	// If this is a Teleport node server, it should send the session ID
+	// right after the session channel is accepted. We should reuse this
+	// session ID and delegate session responsibilities (recordings, audit
+	// events, and session trackers) to avoid duplicates.
+	//
+	// Register handler to receive the current session ID before starting the session.
+	var newSessionIDFromServer chan string
+	if s.targetServer.GetSubKind() == types.SubKindTeleportNode {
+		// Check if the Teleport Node is outdated and won't actually send the session ID.
+		//
+		// TODO(Joerger): DELETE IN v20.0.0
+		// all v19+ servers set and share the session ID directly after accepting the session channel.
+		// clients should stop checking in v21, and servers should stop responding to the query in v22.
+		reply, payload, err := s.remoteClient.SendRequest(ctx, teleport.SessionIDQueryRequestV2, true, nil)
+		if err != nil {
+			s.logger.WarnContext(ctx, "Failed to send session ID query request", "error", err)
+		} else if !reply && len(payload) != 0 {
+			// If the target node replies with a payload, this means that the connection itself has been rejected,
+			// presumably due to an authz error, and the server is trying to communicate the error with the first
+			// req/chan received.
+			s.logger.WarnContext(ctx, "Remote session open failed", "error", err)
+			if err := nch.Reject(ssh.Prohibited, fmt.Sprintf("remote session open failed: %v", string(payload))); err != nil {
+				s.logger.WarnContext(ctx, "Failed to reject channel", "channel", nch.ChannelType(), "error", err)
+			}
+			return
+		}
+
+		if err == nil && reply {
+			newSessionIDFromServer = make(chan string, 1)
+			var receiveSessionIDOnce sync.Once
+			s.remoteClient.HandleSessionRequest(ctx, teleport.CurrentSessionIDRequest, func(ctx context.Context, req *ssh.Request) {
+				// Only handle the first request - only one is expected.
+				receiveSessionIDOnce.Do(func() {
+					newSessionIDFromServer <- string(req.Payload)
+				})
+			})
+		} else {
+			s.logger.WarnContext(ctx, "Failed to query session ID from target node. Ensure the targeted Teleport Node is upgraded to v19.0.0+ to avoid duplicate events due to mismatched session IDs.")
+		}
+	}
+
 	// Create a "session" channel on the remote host. Note that we
 	// create the remote session channel before accepting the local
 	// channel request; this allows us to propagate the rejection
 	// reason/message in the event the channel is rejected.
-	remoteSession, err := s.remoteClient.NewSession(ctx)
+	remoteSession, err := s.remoteClient.NewSessionWithParams(ctx, sessionParams)
 	if err != nil {
 		s.logger.WarnContext(ctx, "Remote session open failed", "error", err)
 		reason, msg := ssh.ConnectionFailed, fmt.Sprintf("remote session open failed: %v", err)
@@ -1182,6 +1264,38 @@ func (s *Server) handleSessionChannel(ctx context.Context, nch ssh.NewChannel) {
 	}
 	scx.RemoteSession = remoteSession
 
+	if newSessionIDFromServer != nil {
+		// Wait for the session ID to be reported by the target node.
+		select {
+		case sidString := <-newSessionIDFromServer:
+			sid, err := session.ParseID(sidString)
+			if err != nil {
+				s.logger.WarnContext(ctx, "Unable to parse session ID reported by target Teleport Node", "error", err)
+				if err := nch.Reject(ssh.ConnectionFailed, "target Teleport Node failed to report session ID"); err != nil {
+					s.logger.WarnContext(ctx, "Failed to reject channel", "channel", nch.ChannelType(), "error", err)
+				}
+				return
+			}
+			scx.SetNewSessionID(ctx, *sid)
+		case <-time.After(10 * time.Second):
+			s.logger.WarnContext(ctx, "Failed to receive session ID from target node. Ensure the targeted Teleport Node is upgraded to v19.0.0+ to avoid duplicate events due to mismatched session IDs.")
+			if err := nch.Reject(ssh.ConnectionFailed, "target Teleport Node failed to report session ID"); err != nil {
+				s.logger.WarnContext(ctx, "Failed to reject channel", "channel", nch.ChannelType(), "error", err)
+			}
+			return
+		case <-ctx.Done():
+			if err := nch.Reject(ssh.ConnectionFailed, "target Teleport Node failed to report session ID"); err != nil {
+				s.logger.WarnContext(ctx, "Failed to reject channel", "channel", nch.ChannelType(), "error", err)
+			}
+			return
+		}
+	} else {
+		// The target node is not expected to report session ID, either because it's
+		// outdated or an agentless node. Continue with a random session ID and ensure
+		// we create a new session tracker.
+		scx.SetNewSessionID(ctx, session.NewID())
+	}
+
 	// Accept the session channel request
 	ch, in, err := nch.Accept()
 	if err != nil {
@@ -1192,27 +1306,23 @@ func (s *Server) handleSessionChannel(ctx context.Context, nch ssh.NewChannel) {
 		return
 	}
 	scx.AddCloser(ch)
-
 	ch = scx.TrackActivity(ch)
 
+	// inform the client of the session ID that is going to be used in a new
+	// goroutine to reduce latency.
+	go func() {
+		sid := scx.GetNewSessionID()
+		s.logger.DebugContext(ctx, "Sending current session ID", "sid", sid)
+		_, err := ch.SendRequest(teleport.CurrentSessionIDRequest, false, []byte(sid))
+		if err != nil {
+			s.logger.DebugContext(ctx, "Failed to send the current session ID", "error", err)
+		}
+	}()
+
 	s.logger.DebugContext(ctx, "Opening session request", "target_addr", s.sconn.RemoteAddr(), "session_id", scx.ID())
 	defer s.logger.DebugContext(ctx, "Closing session request", "target_addr", s.sconn.RemoteAddr(), "session_id", scx.ID())
 
 	for {
-		// Update the context with the session ID.
-		err := scx.CreateOrJoinSession(ctx, s.sessionRegistry)
-		if err != nil {
-			s.logger.ErrorContext(ctx, "unable create or join session", "error", err)
-
-			// Write the error to channel and close it.
-			s.stderrWrite(ctx, ch, fmt.Sprintf("unable to update context: %v", err))
-			_, err := ch.SendRequest("exit-status", false, ssh.Marshal(struct{ C uint32 }{C: teleport.RemoteCommandFailure}))
-			if err != nil {
-				s.logger.ErrorContext(ctx, "Failed to send exit status", "error", err)
-			}
-			return
-		}
-
 		select {
 		case result := <-scx.SubsystemResultCh:
 			// Subsystem has finished executing, close the channel and session.
@@ -1292,7 +1402,7 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 			// to maintain interoperability with OpenSSH, agent forwarding requests
 			// should never fail, all errors should be logged and we should continue
 			// processing requests.
-			err := s.handleAgentForward(ch, req, scx)
+			err := s.handleAgentForward(ctx, ch, req, scx)
 			if err != nil {
 				scx.Logger.DebugContext(ctx, "failure forwarding agent", "error", err)
 			}
@@ -1327,7 +1437,7 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 		// to maintain interoperability with OpenSSH, agent forwarding requests
 		// should never fail, all errors should be logged and we should continue
 		// processing requests.
-		err := s.handleAgentForward(ch, req, scx)
+		err := s.handleAgentForward(ctx, ch, req, scx)
 		if err != nil {
 			scx.Logger.DebugContext(ctx, "failure forwarding agent", "error", err)
 		}
@@ -1345,9 +1455,9 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 	}
 }
 
-func (s *Server) handleAgentForward(ch ssh.Channel, req *ssh.Request, ctx *srv.ServerContext) error {
+func (s *Server) handleAgentForward(ctx context.Context, ch ssh.Channel, req *ssh.Request, scx *srv.ServerContext) error {
 	// Check if the user's RBAC role allows agent forwarding.
-	err := s.authHandlers.CheckAgentForward(ctx)
+	err := s.authHandlers.CheckAgentForward(scx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1356,21 +1466,21 @@ func (s *Server) handleAgentForward(ch ssh.Channel, req *ssh.Request, ctx *srv.S
 	// If no agent was forwarded to the proxy, create one now.
 	userAgent := s.userAgent
 	if userAgent == nil {
-		ctx.ConnectionContext.SetForwardAgent(true)
-		userAgent, err = ctx.StartAgentChannel()
+		scx.ConnectionContext.SetForwardAgent(true)
+		userAgent, err = scx.StartAgentChannel()
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		ctx.AddCloser(userAgent)
+		scx.AddCloser(userAgent)
 	}
 
-	err = agent.ForwardToAgent(ctx.RemoteClient.Client, userAgent)
+	err = agent.ForwardToAgent(scx.RemoteClient.Client, userAgent)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Make an "auth-agent-req@openssh.com" request on the remote host.
-	err = agent.RequestAgentForwarding(ctx.RemoteSession.Session)
+	err = sshagent.RequestAgentForwarding(ctx, scx.RemoteSession)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1493,7 +1603,7 @@ func (s *Server) handleSubsystem(ctx context.Context, ch ssh.Channel, req *ssh.R
 					Time: time.Now(),
 				},
 				UserMetadata:   serverContext.Identity.GetUserMetadata(),
-				ServerMetadata: serverContext.GetServer().TargetMetadata(),
+				ServerMetadata: serverContext.GetServer().EventMetadata(),
 				Error:          err.Error(),
 			})
 			return trace.Wrap(err)
diff --git a/lib/srv/forward/sshserver_test.go b/lib/srv/forward/sshserver_test.go
index 36eec86b3314d..cac12932e1668 100644
--- a/lib/srv/forward/sshserver_test.go
+++ b/lib/srv/forward/sshserver_test.go
@@ -23,20 +23,28 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"errors"
+	"net"
 	"os/user"
 	"sync/atomic"
 	"testing"
 
+	"github.com/google/uuid"
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestSignersWithSHA1Fallback(t *testing.T) {
@@ -219,7 +227,7 @@ func TestDirectTCPIP(t *testing.T) {
 			t.Parallel()
 
 			s := Server{
-				logger:          utils.NewSlogLoggerForTests(),
+				logger:          logtest.NewLogger(),
 				identityContext: srv.IdentityContext{Login: tt.login},
 			}
 
@@ -255,8 +263,9 @@ func TestCheckTCPIPForward(t *testing.T) {
 			t.Parallel()
 
 			s := Server{
-				logger:          utils.NewSlogLoggerForTests(),
+				logger:          logtest.NewLogger(),
 				identityContext: srv.IdentityContext{Login: tt.login},
+				targetServer:    &types.ServerV2{},
 			}
 			err := s.checkTCPIPForwardRequest(context.Background(),
 				&ssh.Request{
@@ -274,3 +283,203 @@ func TestCheckTCPIPForward(t *testing.T) {
 
 // TODO(atburke): Add test for handleForwardedTCPIPRequest once we have
 // infrastructure for higher-level tests here.
+
+func TestServerConfigCheckDefaults(t *testing.T) {
+	teleportNode, err := types.NewNode("teleport-node", "", types.ServerSpecV2{}, nil)
+	require.NoError(t, err)
+
+	openSSHNode, err := types.NewNode("openssh-node", types.SubKindOpenSSHNode, types.ServerSpecV2{
+		Addr:     "openssh.example.com:22",
+		Hostname: "openssh.example.com",
+	}, nil)
+	require.NoError(t, err)
+
+	openSSHEICENode, err := types.NewEICENode(types.ServerSpecV2{
+		Addr:     "openssheice.example.com:22",
+		Hostname: "openssheice.example.com",
+		CloudMetadata: &types.CloudMetadata{
+			AWS: &types.AWSInfo{
+				AccountID:   "123456789012",
+				InstanceID:  "i-123456789012",
+				Region:      "us-east-1",
+				VPCID:       "vpc-abcd",
+				SubnetID:    "subnet-123",
+				Integration: "teleportdev",
+			},
+		},
+	}, nil)
+	require.NoError(t, err)
+
+	for _, tt := range []struct {
+		name           string
+		modifyCfg      func(c *ServerConfig)
+		errorAssertion require.ErrorAssertionFunc
+	}{
+		{
+			name:      "no targetServer",
+			modifyCfg: func(c *ServerConfig) {},
+			errorAssertion: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "target server is required")
+			},
+		}, {
+			name: "Teleport Node",
+			modifyCfg: func(c *ServerConfig) {
+				c.TargetServer = teleportNode
+				c.UserAgent = &sshutils.AgentChannel{}
+			},
+			errorAssertion: require.NoError,
+		}, {
+			name: "Teleport Node no agent",
+			modifyCfg: func(c *ServerConfig) {
+				c.TargetServer = teleportNode
+			},
+			errorAssertion: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "user agent required")
+			},
+		}, {
+			name: "OpenSSH Node",
+			modifyCfg: func(c *ServerConfig) {
+				c.TargetServer = openSSHNode
+				c.AgentlessSigner = &sshutils.LegacySHA1Signer{}
+			},
+			errorAssertion: require.NoError,
+		}, {
+			name: "OpenSSH Node no signer",
+			modifyCfg: func(c *ServerConfig) {
+				c.TargetServer = openSSHNode
+			},
+			errorAssertion: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "agentless signer is required")
+			},
+		}, {
+			name: "OpenSSH EICE Node",
+			modifyCfg: func(c *ServerConfig) {
+				c.TargetServer = openSSHEICENode
+			},
+			errorAssertion: require.NoError,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			config := &ServerConfig{
+				LocalAuthClient:          &authclient.Client{},
+				TargetClusterAccessPoint: &authclient.Client{},
+				DataDir:                  "datadir",
+				TargetConn:               &net.UnixConn{},
+				SrcAddr:                  &net.IPAddr{},
+				DstAddr:                  &net.IPAddr{},
+				HostCertificate:          &sshutils.LegacySHA1Signer{},
+				Clock:                    clockwork.NewFakeClock(),
+				Emitter:                  &authclient.Client{},
+				LockWatcher:              &services.LockWatcher{},
+			}
+
+			tt.modifyCfg(config)
+
+			err := config.CheckDefaults()
+			tt.errorAssertion(t, err)
+		})
+	}
+}
+
+func TestEventMetadata(t *testing.T) {
+	nodeID := uuid.NewString()
+	proxyID := uuid.NewString()
+
+	for _, tt := range []struct {
+		name           string
+		subkind        string
+		spec           types.ServerSpecV2
+		labels         map[string]string
+		expectMetadata events.ServerMetadata
+	}{
+		{
+			name: "tunnel node",
+			labels: map[string]string{
+				"stcLabel": "stcResult",
+			},
+			spec: types.ServerSpecV2{
+				Addr: "127.0.0.1:3022",
+				CmdLabels: map[string]types.CommandLabelV2{
+					"cmdLabel": {Result: "cmdResult"},
+				},
+				Hostname:  "server01",
+				UseTunnel: true,
+			},
+			expectMetadata: events.ServerMetadata{
+				ServerVersion:   teleport.Version,
+				ServerID:        nodeID,
+				ServerNamespace: apidefaults.Namespace,
+				ServerAddr:      "",
+				ServerHostname:  "server01",
+				ServerLabels: map[string]string{
+					"stcLabel": "stcResult",
+					"cmdLabel": "cmdResult",
+				},
+				ServerSubKind: types.SubKindTeleportNode,
+				ForwardedBy:   proxyID,
+			},
+		}, {
+			name: "tunnel node",
+			labels: map[string]string{
+				"stcLabel": "stcResult",
+			},
+			spec: types.ServerSpecV2{
+				Addr: "127.0.0.1:3022",
+				CmdLabels: map[string]types.CommandLabelV2{
+					"cmdLabel": {Result: "cmdResult"},
+				},
+				Hostname: "server01",
+			},
+			expectMetadata: events.ServerMetadata{
+				ServerVersion:   teleport.Version,
+				ServerID:        nodeID,
+				ServerNamespace: apidefaults.Namespace,
+				ServerAddr:      "127.0.0.1:3022",
+				ServerHostname:  "server01",
+				ServerLabels: map[string]string{
+					"stcLabel": "stcResult",
+					"cmdLabel": "cmdResult",
+				},
+				ServerSubKind: types.SubKindTeleportNode,
+				ForwardedBy:   proxyID,
+			},
+		}, {
+			name:    "agentless node",
+			subkind: types.SubKindOpenSSHNode,
+			labels: map[string]string{
+				"stcLabel": "stcResult",
+			},
+			spec: types.ServerSpecV2{
+				Addr:     "openssh.example.com:22",
+				Hostname: "agentless-host",
+			},
+			expectMetadata: events.ServerMetadata{
+				ServerVersion:   teleport.Version,
+				ServerID:        nodeID,
+				ServerNamespace: apidefaults.Namespace,
+				ServerAddr:      "openssh.example.com:22",
+				ServerHostname:  "agentless-host",
+				ServerLabels: map[string]string{
+					"stcLabel": "stcResult",
+				},
+				ServerSubKind: types.SubKindOpenSSHNode,
+				ForwardedBy:   proxyID,
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			targetServer, err := types.NewNode(nodeID, tt.subkind, tt.spec, tt.labels)
+			require.NoError(t, err)
+
+			forwardSrv := &Server{
+				proxyUUID:    proxyID,
+				targetServer: targetServer,
+			}
+
+			require.EqualValues(t, tt.expectMetadata, forwardSrv.EventMetadata())
+		})
+	}
+}
diff --git a/lib/srv/forward/subsystem.go b/lib/srv/forward/subsystem.go
index b8ae7335d0966..0c76d3f2a2a25 100644
--- a/lib/srv/forward/subsystem.go
+++ b/lib/srv/forward/subsystem.go
@@ -164,7 +164,7 @@ func (r *remoteSubsystem) emitAuditEvent(ctx context.Context, err error) {
 			RemoteAddr: r.serverContext.RemoteClient.RemoteAddr().String(),
 		},
 		Name:           r.subsystemName,
-		ServerMetadata: r.serverContext.GetServer().TargetMetadata(),
+		ServerMetadata: r.serverContext.GetServer().EventMetadata(),
 	}
 
 	if err != nil {
@@ -237,6 +237,14 @@ func (r *remoteSFTPSubsystem) Wait() error {
 		err = trace.ConnectionProblem(nil, "context is closing")
 	}
 
+	var exitStatus int
+	if err != nil {
+		exitStatus = 1
+	}
+	r.subsystem.serverContext.SendExecResult(r.subsystem.ctx, srv.ExecResult{
+		Code: exitStatus,
+	})
+
 	// emit an event to the audit log with the result of execution
 	r.subsystem.emitAuditEvent(r.subsystem.ctx, err)
 	return trace.Wrap(err)
diff --git a/lib/srv/git/forward.go b/lib/srv/git/forward.go
index e0cc1b9a0181d..89df1b3b87c98 100644
--- a/lib/srv/git/forward.go
+++ b/lib/srv/git/forward.go
@@ -41,6 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
+	rsession "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -120,7 +121,7 @@ type ForwardServerConfig struct {
 	// MACAlgorithms is a list of message authentication codes (MAC) that
 	// the server supports. If omitted the defaults will be used.
 	MACAlgorithms []string
-	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// FIPS mode means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	FIPS bool
 
@@ -252,7 +253,6 @@ func NewForwardServer(cfg *ForwardServerConfig) (*ForwardServer, error) {
 		return nil, trace.Wrap(err)
 	}
 	return s, nil
-
 }
 
 // Serve starts an SSH server that forwards git commands.
@@ -373,7 +373,7 @@ func (s *ForwardServer) onConnection(ctx context.Context, ccx *sshutils.Connecti
 
 	// TODO(greedy52) decouple from srv.NewServerContext. We only need
 	// connection monitoring.
-	serverCtx, err := srv.NewServerContext(ctx, ccx, s, identityCtx)
+	serverCtx, err := srv.NewServerContext(ctx, ccx, s, identityCtx, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -399,11 +399,18 @@ func (s *ForwardServer) onChannel(ctx context.Context, ccx *sshutils.ConnectionC
 		return
 	}
 
+	// sessionParams will not be passed by old clients (< v19) or OpenSSH clients.
+	sessionParams, err := tracessh.ParseSessionParams(nch.ExtraData())
+	if err != nil {
+		s.reply.RejectWithAcceptError(ctx, nch, err)
+		return
+	}
+
 	if s.remoteClient == nil {
 		s.reply.RejectWithNewRemoteSessionError(ctx, nch, trace.NotFound("missing remote client"))
 		return
 	}
-	remoteSession, err := s.remoteClient.NewSession(ctx)
+	remoteSession, err := s.remoteClient.NewSessionWithParams(ctx, sessionParams)
 	if err != nil {
 		s.reply.RejectWithNewRemoteSessionError(ctx, nch, err)
 		return
@@ -451,6 +458,7 @@ type sessionContext struct {
 	channel       ssh.Channel
 	remoteSession *tracessh.Session
 	waitExec      chan error
+	sessionID     rsession.ID
 }
 
 func newSessionContext(serverCtx *srv.ServerContext, ch ssh.Channel, remoteSession *tracessh.Session) *sessionContext {
@@ -459,9 +467,17 @@ func newSessionContext(serverCtx *srv.ServerContext, ch ssh.Channel, remoteSessi
 		channel:       ch,
 		remoteSession: remoteSession,
 		waitExec:      make(chan error, 1),
+		sessionID:     rsession.NewID(),
 	}
 }
 
+func (c *sessionContext) GetSessionMetadata() apievents.SessionMetadata {
+	// Overwrite with our own session ID.
+	metadata := c.ServerContext.GetSessionMetadata()
+	metadata.SessionID = c.sessionID.String()
+	return metadata
+}
+
 // dispatch executes an incoming request. If successful, it returns the ok value
 // for the reply. Otherwise, it returns the error it encountered.
 func (s *ForwardServer) dispatch(ctx context.Context, sctx *sessionContext, req *ssh.Request) (bool, error) {
@@ -556,7 +572,7 @@ func (s *ForwardServer) makeGitCommandEvent(sctx *sessionContext, command string
 			RemoteAddr: sctx.ServerConn.RemoteAddr().String(),
 			LocalAddr:  sctx.ServerConn.LocalAddr().String(),
 		},
-		ServerMetadata: s.TargetMetadata(),
+		ServerMetadata: s.EventMetadata(),
 	}
 	if err != nil {
 		event.Metadata.Code = events.GitCommandFailureCode
@@ -616,7 +632,7 @@ func (s *ForwardServer) initRemoteConn(ctx context.Context, ccx *sshutils.Connec
 	clientConfig.KeyExchanges = s.cfg.KEXAlgorithms
 	clientConfig.MACs = s.cfg.MACAlgorithms
 
-	s.remoteClient, err = tracessh.NewClientConnWithDeadline(
+	s.remoteClient, err = tracessh.NewClientWithTimeout(
 		s.cfg.ParentContext,
 		s.cfg.TargetConn,
 		s.cfg.DstAddr.String(),
@@ -653,7 +669,7 @@ func makeRemoteSigner(ctx context.Context, cfg *ForwardServerConfig, identityCtx
 func (s *ForwardServer) Context() context.Context {
 	return s.cfg.ParentContext
 }
-func (s *ForwardServer) TargetMetadata() apievents.ServerMetadata {
+func (s *ForwardServer) EventMetadata() apievents.ServerMetadata {
 	return apievents.ServerMetadata{
 		ServerVersion:   teleport.Version,
 		ServerNamespace: s.cfg.TargetServer.GetNamespace(),
@@ -690,8 +706,8 @@ func (s *ForwardServer) GetAccessPoint() srv.AccessPoint {
 func (s *ForwardServer) GetDataDir() string {
 	return ""
 }
-func (s *ForwardServer) GetPAM() (*servicecfg.PAMConfig, error) {
-	return nil, trace.NotImplemented("not supported for git forward server")
+func (s *ForwardServer) GetPAM() *servicecfg.PAMConfig {
+	return &servicecfg.PAMConfig{Enabled: false}
 }
 func (s *ForwardServer) GetClock() clockwork.Clock {
 	return s.cfg.Clock
@@ -702,7 +718,7 @@ func (s *ForwardServer) UseTunnel() bool {
 func (s *ForwardServer) GetBPF() bpf.BPF {
 	return nil
 }
-func (s *ForwardServer) GetUserAccountingPaths() (utmp, wtmp, btmp string) {
+func (s *ForwardServer) GetUserAccountingPaths() (utmp, wtmp, btmp, wtmpdb string) {
 	return
 }
 func (s *ForwardServer) GetLockWatcher() *services.LockWatcher {
@@ -721,6 +737,17 @@ func (s *ForwardServer) GetSELinuxEnabled() bool {
 	return false
 }
 
+// ChildLogConfig returns a noop log configuration since the git forwarding server
+// does not spawn child processes.
+func (s *ForwardServer) ChildLogConfig() srv.ChildLogConfig {
+	return srv.ChildLogConfig{
+		ExecLogConfig: srv.ExecLogConfig{
+			Level: &slog.LevelVar{},
+		},
+		Writer: io.Discard,
+	}
+}
+
 type serverContextKey struct{}
 
 const (
diff --git a/lib/srv/git/forward_test.go b/lib/srv/git/forward_test.go
index 7a365988e4276..635a5b23e6b7d 100644
--- a/lib/srv/git/forward_test.go
+++ b/lib/srv/git/forward_test.go
@@ -51,10 +51,11 @@ import (
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -95,6 +96,7 @@ func TestForwardServer(t *testing.T) {
 				require.True(t, ok)
 				assert.Equal(t, libevents.GitCommandEvent, gitEvent.Metadata.Type)
 				assert.Equal(t, libevents.GitCommandCode, gitEvent.Metadata.Code)
+				assert.NotEmpty(t, gitEvent.SessionID)
 				assert.Equal(t, "alice", gitEvent.User)
 				assert.Equal(t, "0", gitEvent.CommandMetadata.ExitCode)
 				assert.Equal(t, "git-upload-pack", gitEvent.Service)
diff --git a/lib/srv/heartbeat_test.go b/lib/srv/heartbeat_test.go
index 4997558c0f868..a0908e927608a 100644
--- a/lib/srv/heartbeat_test.go
+++ b/lib/srv/heartbeat_test.go
@@ -71,6 +71,7 @@ func TestHeartbeatKeepAlive(t *testing.T) {
 						Name:      "1",
 					},
 					Spec: types.AppServerSpecV3{
+						App:      &types.AppV3{},
 						Hostname: "2",
 					},
 				}
diff --git a/lib/srv/heartbeatv2.go b/lib/srv/heartbeatv2.go
index db5c997d4a317..80a403ab868e1 100644
--- a/lib/srv/heartbeatv2.go
+++ b/lib/srv/heartbeatv2.go
@@ -27,9 +27,11 @@ import (
 	"github.com/gravitational/trace"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	gproto "google.golang.org/protobuf/proto"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	presencev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
@@ -172,6 +174,26 @@ func NewKubernetesServerHeartbeat(cfg HeartbeatV2Config[*types.KubernetesServerV
 	}), nil
 }
 
+// NewRelayServerHeartbeat creates a [HeartbeatV2] that advertises the presence
+// of a Relay service instance.
+func NewRelayServerHeartbeat(cfg HeartbeatV2Config[*presencev1.RelayServer], log *slog.Logger) (*HeartbeatV2, error) {
+	if err := cfg.Check(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	inner := &relayServerHeartbeatV2{
+		log:       log,
+		getServer: cfg.GetResource,
+	}
+
+	return newHeartbeatV2(cfg.InventoryHandle, inner, heartbeatV2Config{
+		onHeartbeatInner:           cfg.OnHeartbeat,
+		announceInterval:           cfg.AnnounceInterval,
+		disruptionAnnounceInterval: cfg.DisruptionAnnounceInterval,
+		pollInterval:               cfg.PollInterval,
+	}), nil
+}
+
 // hbv2TestEvent is a basic event type used to monitor/await
 // specific events within the HeartbeatV2 type's operations
 // during tests.
@@ -230,11 +252,6 @@ type HeartbeatV2 struct {
 	// all fields below this point are local variables for the
 	// background goroutine and not safe for access from anywhere
 	// else.
-
-	announceFailed error
-	fallbackFailed error
-	icsUnavailable error
-
 	announce      *interval.Interval
 	poll          *interval.Interval
 	degradedCheck *interval.Interval
@@ -295,17 +312,31 @@ func (c *heartbeatV2Config) SetDefaults() {
 	}
 }
 
-// noSenderErr is used to periodically trigger "degraded state" events when the control
+// noSenderError is used to periodically trigger "degraded state" events when the control
 // stream has no sender available.
-var noSenderErr = trace.Errorf("no control stream sender available")
+type noSenderError struct{}
 
-func (h *HeartbeatV2) run() {
-	// note: these errors are never actually displayed, but onHeartbeat expects an error,
-	// so we just allocate something reasonably descriptive once.
-	h.announceFailed = trace.Errorf("control stream heartbeat failed (variant=%T)", h.inner)
-	h.fallbackFailed = trace.Errorf("upsert fallback heartbeat failed (variant=%T)", h.inner)
-	h.icsUnavailable = trace.Errorf("ics unavailable for heartbeat (variant=%T)", h.inner)
+func (noSenderError) Error() string {
+	return "no control stream sender available"
+}
+
+// announceFailedError is used to periodically trigger "degraded state" events when announcing
+// fails.
+type announceFailedError struct{}
 
+func (e announceFailedError) Error() string {
+	return "control stream heartbeat failed"
+}
+
+// fallbackFailedError is used to periodically trigger "degraded state" events when the
+// fallback upsert failed
+type fallbackFailedError struct{}
+
+func (e fallbackFailedError) Error() string {
+	return "upsert fallback heartbeat failed"
+}
+
+func (h *HeartbeatV2) run() {
 	// set up interval for forced announcement (i.e. heartbeat even if state is unchanged).
 	h.announce = interval.New(interval.Config{
 		FirstDuration: retryutils.HalfJitter(h.announceInterval),
@@ -360,7 +391,7 @@ func (h *HeartbeatV2) run() {
 						h.testEvent(hbv2FallbackErr)
 						// announce failed, enter a backoff state.
 						h.fallbackBackoffTime = time.Now().Add(retryutils.SeventhJitter(h.fallbackBackoff))
-						h.onHeartbeat(h.fallbackFailed)
+						h.onHeartbeat(fallbackFailedError{})
 					}
 				} else {
 					h.testEvent(hbv2FallbackBackoff)
@@ -393,7 +424,7 @@ func (h *HeartbeatV2) run() {
 				// if we don't have fallback and/or aren't planning to hit the fallback
 				// soon, then we need to emit a heartbeat error in order to inform the
 				// rest of teleport that we are in a degraded state.
-				h.onHeartbeat(noSenderErr)
+				h.onHeartbeat(noSenderError{})
 			}
 		case ch := <-h.testAnnounce:
 			h.shouldAnnounce = true
@@ -447,7 +478,7 @@ func (h *HeartbeatV2) runWithSender(sender inventory.DownstreamSender) {
 				h.announceWaiters = nil
 			} else {
 				h.testEvent(hbv2AnnounceErr)
-				h.onHeartbeat(h.announceFailed)
+				h.onHeartbeat(announceFailedError{})
 			}
 		}
 
@@ -814,3 +845,64 @@ func (h *kubeServerHeartbeatV2) Announce(ctx context.Context, sender inventory.D
 	h.prev = server
 	return true
 }
+
+// relayServerHeartbeatV2 is a heartbeat driver for Relay heartbeats.
+type relayServerHeartbeatV2 struct {
+	log *slog.Logger
+	// getServer should return a relay_server item with no expiry. The value is
+	// checked against the previous relay_server with protobuf equality.
+	getServer func(ctx context.Context) (*presencev1.RelayServer, error)
+
+	last *presencev1.RelayServer
+}
+
+var _ heartbeatV2Driver = (*relayServerHeartbeatV2)(nil)
+
+// Poll implements [heartbeatV2Driver].
+func (h *relayServerHeartbeatV2) Poll(ctx context.Context) (changed bool) {
+	if h.last == nil {
+		return true
+	}
+
+	server, err := h.getServer(ctx)
+	if err != nil {
+		return false
+	}
+
+	return !gproto.Equal(h.last, server)
+}
+
+// SupportsFallback implements [heartbeatV2Driver].
+func (h *relayServerHeartbeatV2) SupportsFallback() bool {
+	return false
+}
+
+// FallbackAnnounce implements [heartbeatV2Driver].
+func (h *relayServerHeartbeatV2) FallbackAnnounce(ctx context.Context) (ok bool) {
+	return false
+}
+
+// Announce implements [heartbeatV2Driver].
+func (h *relayServerHeartbeatV2) Announce(ctx context.Context, sender inventory.DownstreamSender) (ok bool) {
+	if !sender.Hello().GetCapabilities().GetRelayServerHeartbeatsCleanup() {
+		return false
+	}
+
+	server, err := h.getServer(ctx)
+	if err != nil {
+		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
+			h.log.WarnContext(ctx, "Failed to get server value for Relay service announce", "error", err)
+		}
+		return false
+	}
+
+	if err := sender.Send(ctx, &proto.InventoryHeartbeat{RelayServer: gproto.CloneOf(server)}); err != nil {
+		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
+			h.log.WarnContext(ctx, "Failed to perform Relay service announce", "error", err)
+		}
+		return false
+	}
+
+	h.last = server
+	return true
+}
diff --git a/lib/srv/mcp/audit.go b/lib/srv/mcp/audit.go
new file mode 100644
index 0000000000000..814b9744a4a4e
--- /dev/null
+++ b/lib/srv/mcp/audit.go
@@ -0,0 +1,488 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/services"
+	appcommon "github.com/gravitational/teleport/lib/srv/app/common"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+type sessionAuditorConfig struct {
+	emitter    apievents.Emitter
+	logger     *slog.Logger
+	hostID     string
+	sessionCtx *SessionCtx
+	// TODO(greedy52) add recording support.
+	preparer events.SessionEventPreparer
+}
+
+func (c *sessionAuditorConfig) checkAndSetDefaults() error {
+	if c.emitter == nil {
+		return trace.BadParameter("missing emitter")
+	}
+	if c.hostID == "" {
+		return trace.BadParameter("missing hostID")
+	}
+	if c.sessionCtx == nil {
+		return trace.BadParameter("missing sessionCtx")
+	}
+	if c.preparer == nil {
+		return trace.BadParameter("missing preparer")
+	}
+	if c.logger == nil {
+		c.logger = slog.Default()
+	}
+	return nil
+}
+
+// sessionAuditor handles audit events for a session.
+type sessionAuditor struct {
+	sessionAuditorConfig
+
+	// pendingSessionStartEvent is used to delay sending the session start event
+	// until more metadata is received.
+	pendingSessionStartEvent *apievents.MCPSessionStart
+	mu                       sync.Mutex
+}
+
+func newSessionAuditor(cfg sessionAuditorConfig) (*sessionAuditor, error) {
+	if err := cfg.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &sessionAuditor{
+		sessionAuditorConfig: cfg,
+	}, nil
+}
+
+type eventOptions struct {
+	err    error
+	header http.Header
+}
+
+type eventOptionFunc func(*eventOptions)
+
+func newEventOptions(options ...eventOptionFunc) (opt eventOptions) {
+	for _, fn := range options {
+		if fn != nil {
+			fn(&opt)
+		}
+	}
+	return
+}
+
+func eventWithError(err error) eventOptionFunc {
+	return func(o *eventOptions) {
+		o.err = err
+	}
+}
+
+func eventWithHTTPResponseError(resp *http.Response, err error) eventOptionFunc {
+	return eventWithError(convertHTTPResponseErrorForAudit(resp, err))
+}
+
+func eventWithHeader(header http.Header) eventOptionFunc {
+	return func(o *eventOptions) {
+		o.header = headersForAudit(header)
+	}
+}
+
+func (a *sessionAuditor) shouldEmitEvent(method string) bool {
+	// Do not record discovery, ping calls.
+	switch method {
+	case mcputils.MethodPing,
+		mcputils.MethodResourcesList,
+		mcputils.MethodResourcesTemplatesList,
+		mcputils.MethodPromptsList,
+		mcputils.MethodToolsList:
+		return false
+	default:
+		return true
+	}
+}
+
+func (a *sessionAuditor) appendStartEvent(ctx context.Context, options ...eventOptionFunc) {
+	opts := newEventOptions(options...)
+
+	// Prepare it to have the correct index.
+	preparedEvent, err := a.preparer.PrepareSessionEvent(&apievents.MCPSessionStart{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionStartEvent,
+			events.MCPSessionStartCode,
+		),
+		ServerMetadata:     a.makeServerMetadata(),
+		SessionMetadata:    a.makeSessionMetadata(),
+		UserMetadata:       a.makeUserMetadata(),
+		ConnectionMetadata: a.makeConnectionMetadata(),
+		AppMetadata:        a.makeAppMetadata(),
+		EgressAuthType:     guessEgressAuthType(opts.header, a.sessionCtx.App.GetRewrite()),
+	})
+	if err != nil {
+		a.logger.ErrorContext(ctx, "failed to prepare session start event", "error", err)
+		return
+	}
+	event, ok := preparedEvent.GetAuditEvent().(*apievents.MCPSessionStart)
+	if !ok {
+		a.logger.ErrorContext(ctx, "failed to get session start event from prepared event")
+		return
+	}
+	a.mu.Lock()
+	a.pendingSessionStartEvent = event
+	a.mu.Unlock()
+}
+
+func (a *sessionAuditor) emitEndEvent(ctx context.Context, options ...eventOptionFunc) {
+	opts := newEventOptions(options...)
+
+	event := &apievents.MCPSessionEnd{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionEndEvent,
+			events.MCPSessionEndCode,
+		),
+		ServerMetadata:     a.makeServerMetadata(),
+		SessionMetadata:    a.makeSessionMetadata(),
+		UserMetadata:       a.makeUserMetadata(),
+		ConnectionMetadata: a.makeConnectionMetadata(),
+		AppMetadata:        a.makeAppMetadata(),
+		Status: apievents.Status{
+			Success: true,
+		},
+		Headers: wrappers.Traits(opts.header),
+	}
+
+	if opts.err != nil {
+		event.Metadata.Code = events.MCPSessionEndFailureCode
+		event.Status.Success = false
+		event.Status.Error = opts.err.Error()
+	}
+	a.flushAndEmitEvent(ctx, event)
+}
+
+func (a *sessionAuditor) emitNotificationEvent(ctx context.Context, msg *mcputils.JSONRPCNotification, options ...eventOptionFunc) {
+	opts := newEventOptions(options...)
+	if opts.err == nil && !a.shouldEmitEvent(msg.Method) {
+		return
+	}
+	event := &apievents.MCPSessionNotification{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionNotificationEvent,
+			events.MCPSessionNotificationCode,
+		),
+		SessionMetadata: a.makeSessionMetadata(),
+		UserMetadata:    a.makeUserMetadata(),
+		AppMetadata:     a.makeAppMetadata(),
+		Message: apievents.MCPJSONRPCMessage{
+			JSONRPC: msg.JSONRPC,
+			Method:  msg.Method,
+			Params:  msg.Params.GetEventParams(),
+		},
+		Status: apievents.Status{
+			Success: true,
+		},
+		Headers: wrappers.Traits(opts.header),
+	}
+	if opts.err != nil {
+		event.Metadata.Code = events.MCPSessionNotificationFailureCode
+		event.Status.Success = false
+		event.Status.Error = opts.err.Error()
+	}
+	a.flushAndEmitEvent(ctx, event)
+}
+
+func (a *sessionAuditor) emitRequestEvent(ctx context.Context, msg *mcputils.JSONRPCRequest, options ...eventOptionFunc) {
+	opts := newEventOptions(options...)
+	if opts.err == nil && !a.shouldEmitEvent(msg.Method) {
+		return
+	}
+	event := &apievents.MCPSessionRequest{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionRequestEvent,
+			events.MCPSessionRequestCode,
+		),
+		SessionMetadata: a.makeSessionMetadata(),
+		UserMetadata:    a.makeUserMetadata(),
+		AppMetadata:     a.makeAppMetadata(),
+		Status: apievents.Status{
+			Success: true,
+		},
+		Message: apievents.MCPJSONRPCMessage{
+			JSONRPC: msg.JSONRPC,
+			Method:  msg.Method,
+			ID:      msg.ID.String(),
+			Params:  msg.Params.GetEventParams(),
+		},
+		Headers: wrappers.Traits(opts.header),
+	}
+
+	if opts.err != nil {
+		event.Metadata.Code = events.MCPSessionRequestFailureCode
+		event.Status.Success = false
+		event.Status.Error = opts.err.Error()
+	}
+
+	// Initialize should be the first request. Let's not flush session start
+	// event yet but wait for the initialize result. Flush if request is
+	// anything else to avoid delaying.
+	if msg.Method == mcputils.MethodInitialize {
+		a.updatePendingSessionStartEventWithInitializeRequest(msg)
+		a.emitEvent(ctx, event)
+	} else {
+		a.flushAndEmitEvent(ctx, event)
+	}
+}
+
+func (a *sessionAuditor) emitListenSSEStreamEvent(ctx context.Context, options ...eventOptionFunc) {
+	opts := newEventOptions(options...)
+	event := &apievents.MCPSessionListenSSEStream{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionListenSSEStream,
+			events.MCPSessionListenSSEStreamCode,
+		),
+		SessionMetadata: a.makeSessionMetadata(),
+		UserMetadata:    a.makeUserMetadata(),
+		AppMetadata:     a.makeAppMetadata(),
+		Status: apievents.Status{
+			Success: true,
+		},
+		Headers: wrappers.Traits(opts.header),
+	}
+	if opts.err != nil {
+		event.Metadata.Code = events.MCPSessionListenSSEStreamFailureCode
+		event.Status.Success = false
+		event.Status.Error = opts.err.Error()
+	}
+	a.flushAndEmitEvent(ctx, event)
+}
+
+func (a *sessionAuditor) emitInvalidHTTPRequest(ctx context.Context, r *http.Request) {
+	body, _ := utils.GetAndReplaceRequestBody(r)
+	event := &apievents.MCPSessionInvalidHTTPRequest{
+		Metadata: a.makeEventMetadata(
+			events.MCPSessionInvalidHTTPRequest,
+			events.MCPSessionInvalidHTTPRequestCode,
+		),
+		SessionMetadata: a.makeSessionMetadata(),
+		UserMetadata:    a.makeUserMetadata(),
+		AppMetadata:     a.makeAppMetadata(),
+		Path:            r.URL.Path,
+		Method:          r.Method,
+		Body:            body,
+		RawQuery:        r.URL.RawQuery,
+		Headers:         wrappers.Traits(r.Header),
+	}
+	a.flushAndEmitEvent(ctx, event)
+}
+
+func (a *sessionAuditor) flush(ctx context.Context) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.pendingSessionStartEvent != nil {
+		if err := a.emitter.EmitAuditEvent(ctx, a.pendingSessionStartEvent); err != nil {
+			a.logger.ErrorContext(ctx, "failed to emit session start event", "error", err)
+		}
+		a.pendingSessionStartEvent = nil
+	}
+}
+
+func (a *sessionAuditor) flushAndEmitEvent(ctx context.Context, event apievents.AuditEvent) {
+	a.flush(ctx)
+	a.emitEvent(ctx, event)
+}
+
+func (a *sessionAuditor) emitEvent(ctx context.Context, event apievents.AuditEvent) {
+	preparedEvent, err := a.preparer.PrepareSessionEvent(event)
+	if err != nil {
+		a.logger.ErrorContext(ctx, "Failed to prepare event",
+			"error", err,
+			"event_type", event.GetType(),
+			"event_id", event.GetID(),
+		)
+		return
+	}
+	if err := a.emitter.EmitAuditEvent(ctx, preparedEvent.GetAuditEvent()); err != nil {
+		a.logger.ErrorContext(ctx, "Failed to emit audit event",
+			"error", err,
+			"event_type", event.GetType(),
+			"event_id", event.GetID(),
+		)
+	}
+}
+
+func (a *sessionAuditor) makeEventMetadata(eventType, eventCode string) apievents.Metadata {
+	return apievents.Metadata{
+		Type:        eventType,
+		Code:        eventCode,
+		ClusterName: a.sessionCtx.Identity.RouteToApp.ClusterName,
+	}
+}
+
+func (a *sessionAuditor) makeServerMetadata() apievents.ServerMetadata {
+	return apievents.ServerMetadata{
+		ServerVersion:   teleport.Version,
+		ServerID:        a.hostID,
+		ServerNamespace: apidefaults.Namespace,
+	}
+}
+
+func (a *sessionAuditor) makeConnectionMetadata() apievents.ConnectionMetadata {
+	return apievents.ConnectionMetadata{
+		RemoteAddr: a.sessionCtx.Identity.LoginIP,
+	}
+}
+
+func (a *sessionAuditor) makeAppMetadata() apievents.AppMetadata {
+	return apievents.AppMetadata{
+		AppURI:  a.sessionCtx.App.GetURI(),
+		AppName: a.sessionCtx.App.GetName(),
+	}
+}
+
+func (a *sessionAuditor) makeSessionMetadata() apievents.SessionMetadata {
+	return apievents.SessionMetadata{
+		SessionID:        a.sessionCtx.sessionID.String(),
+		WithMFA:          a.sessionCtx.Identity.MFAVerified,
+		PrivateKeyPolicy: string(a.sessionCtx.Identity.PrivateKeyPolicy),
+	}
+}
+
+func (a *sessionAuditor) makeUserMetadata() apievents.UserMetadata {
+	return a.sessionCtx.Identity.GetUserMetadata()
+}
+
+func (a *sessionAuditor) updatePendingSessionStartEvent(fn func(*apievents.MCPSessionStart)) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.pendingSessionStartEvent != nil {
+		fn(a.pendingSessionStartEvent)
+	}
+}
+
+func (a *sessionAuditor) updatePendingSessionStartEventWithInitializeRequest(msg *mcputils.JSONRPCRequest) {
+	// TODO(greedy52) avoid the Marshal when migrating to official SDK.
+	paramsData, err := json.Marshal(msg.Params)
+	if err != nil {
+		return
+	}
+	var params mcp.InitializeParams
+	if err := json.Unmarshal(paramsData, &params); err != nil {
+		return
+	}
+	a.updatePendingSessionStartEvent(func(sessionStartEvent *apievents.MCPSessionStart) {
+		sessionStartEvent.ProtocolVersion = params.ProtocolVersion
+		sessionStartEvent.ClientInfo = fmt.Sprintf("%s/%s", params.ClientInfo.Name, params.ClientInfo.Version)
+	})
+}
+
+func (a *sessionAuditor) updatePendingSessionStartEventWithInitializeResult(ctx context.Context, resp *mcputils.JSONRPCResponse) {
+	if initResult, err := resp.GetInitializeResult(); err == nil && initResult != nil {
+		a.updatePendingSessionStartEvent(func(sessionStartEvent *apievents.MCPSessionStart) {
+			sessionStartEvent.ServerInfo = fmt.Sprintf("%s/%s", initResult.ServerInfo.Name, initResult.ServerInfo.Version)
+		})
+	}
+
+	// We can flush now as we receive the result.
+	a.flush(ctx)
+}
+
+func (a *sessionAuditor) updatePendingSessionStartEventWithExternalSessionID(sessionID string) {
+	a.updatePendingSessionStartEvent(func(event *apievents.MCPSessionStart) {
+		event.McpSessionId = sessionID
+	})
+}
+
+var headersWithSecret = []string{
+	"Authorization",
+	"X-API-Key",
+}
+
+func headersForAudit(h http.Header) http.Header {
+	if h == nil {
+		return nil
+	}
+	ret := h.Clone()
+	for _, key := range appcommon.ReservedHeaders {
+		ret.Del(key)
+	}
+	for _, key := range headersWithSecret {
+		if len(ret.Values(key)) > 0 {
+			ret.Set(key, "<REDACTED>")
+		}
+	}
+	return ret
+}
+
+// guessEgressAuthType makes an educated guess on what kind of auth is used to
+// for the remote MCP server.
+func guessEgressAuthType(headerWithoutRewrite http.Header, rewrite *types.Rewrite) string {
+	if rewrite != nil {
+		testJWTTraits := map[string][]string{
+			"jwt": {"test", "jwt"},
+		}
+
+		var rewriteAuth bool
+		for _, rewrite := range rewrite.Headers {
+			if strings.EqualFold(rewrite.Name, "Authorization") {
+				rewriteAuth = true
+			}
+
+			// Check if any header value includes "{{internal.jwt}}".
+			if strings.Contains(rewrite.Value, "internal.jwt") {
+				// Apply fake traits just to be sure. The fake traits will
+				// result two values if applied successfully.
+				if interpolated, _ := services.ApplyValueTraits(rewrite.Value, testJWTTraits); len(interpolated) > 1 {
+					return "app-jwt"
+				}
+			}
+		}
+
+		// Auth header has be defined in the app definition but not using
+		// "{{internal.jwt}}".
+		if rewriteAuth {
+			return "app-defined"
+		}
+	}
+
+	// Reach here when app.Rewrite not overwriting auth. Check if Auth header is
+	// defined by the user.
+	if headerWithoutRewrite.Get("Authorization") != "" {
+		return "user-defined"
+	}
+
+	// No auth required for the remote MCP server or something we don't
+	// understand yet.
+	return "unknown"
+}
diff --git a/lib/srv/mcp/audit_test.go b/lib/srv/mcp/audit_test.go
new file mode 100644
index 0000000000000..0af785f3d8402
--- /dev/null
+++ b/lib/srv/mcp/audit_test.go
@@ -0,0 +1,124 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func Test_headersForAudit(t *testing.T) {
+	tests := []struct {
+		name  string
+		input http.Header
+		want  http.Header
+	}{
+		{
+			name:  "no header",
+			input: nil,
+			want:  nil,
+		},
+		{
+			name: "remove reserved header",
+			input: http.Header{
+				"X-Forwarded-For": []string{"hello"},
+				"Foo":             []string{"bar"},
+				"Alice":           []string{"bob", "charlie"},
+			},
+			want: http.Header{
+				"Foo":   []string{"bar"},
+				"Alice": []string{"bob", "charlie"},
+			},
+		},
+		{
+			name: "redact secrets",
+			input: http.Header{
+				"Authorization": []string{"Bearer secret"},
+				"X-Api-Key":     []string{"api-key"},
+				"Alice":         []string{"bob", "charlie"},
+			},
+			want: http.Header{
+				"Authorization": []string{"<REDACTED>"},
+				"X-Api-Key":     []string{"<REDACTED>"},
+				"Alice":         []string{"bob", "charlie"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, headersForAudit(tt.input))
+		})
+	}
+}
+
+func Test_guessEgressAuthType(t *testing.T) {
+	tests := []struct {
+		name         string
+		inputHeader  http.Header
+		inputRewrite *types.Rewrite
+		expect       string
+	}{
+		{
+			name:   "no header or rewrite",
+			expect: "unknown",
+		},
+		{
+			name: "user defined",
+			inputHeader: http.Header{
+				"Authorization": []string{"Bearer secret"},
+			},
+			inputRewrite: &types.Rewrite{
+				Headers: []*types.Header{{
+					Name:  "Some-Other-Header",
+					Value: "some-other-value",
+				}},
+			},
+			expect: "user-defined",
+		},
+		{
+			name: "app defined",
+			inputRewrite: &types.Rewrite{
+				Headers: []*types.Header{{
+					Name:  "Authorization",
+					Value: "Bearer abcdef",
+				}},
+			},
+			expect: "app-defined",
+		},
+		{
+			name: "app defined with Teleport JWT",
+			inputRewrite: &types.Rewrite{
+				Headers: []*types.Header{{
+					Name:  "Authorization",
+					Value: "Bearer {{internal.jwt}}",
+				}},
+			},
+			expect: "app-jwt",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expect, guessEgressAuthType(tt.inputHeader, tt.inputRewrite))
+		})
+	}
+}
diff --git a/lib/srv/mcp/demo.go b/lib/srv/mcp/demo.go
new file mode 100644
index 0000000000000..9d064aec5ead3
--- /dev/null
+++ b/lib/srv/mcp/demo.go
@@ -0,0 +1,220 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+const (
+	// DemoServerName is the name of the "Teleport Demo" MCP server.
+	DemoServerName = "teleport-mcp-demo"
+)
+
+// NewDemoServerApp returns the app definition for the "Teleport Demo" MCP
+// server.
+//
+// The purpose of the "Teleport Demo" MCP server is to provide a quick demo on
+// MCP access without the need for external environment setup on MCP
+// servers. This MCP server is in-memory only and uses stdio transport. Access
+// to this MCP server is the same as any other MCP server (`tsh`, RBAC, audit
+// events, etc.).
+func NewDemoServerApp() (types.Application, error) {
+	app, err := types.NewAppV3(types.Metadata{
+		Name:        DemoServerName,
+		Labels:      map[string]string{types.TeleportInternalResourceType: types.DemoResource},
+		Description: "A demo MCP server that shows current user and session information",
+	}, types.AppSpecV3{
+		URI: fmt.Sprintf("%s://%s", types.SchemeMCPStdio, DemoServerName),
+	})
+	return app, trace.Wrap(err)
+}
+
+func isDemoServerApp(app types.Application) bool {
+	labelValue, labelFound := app.GetLabel(types.TeleportInternalResourceType)
+	return labelFound && labelValue == types.DemoResource && app.GetName() == DemoServerName
+}
+
+func makeDemoServerRunner(ctx context.Context, session *sessionHandler) (stdioServerRunner, error) {
+	return makeInMemoryServerRunner(newDemoServer(ctx, session), session.logger)
+}
+
+func newDemoServer(_ context.Context, session *sessionHandler) *mcpserver.MCPServer {
+	demoServer := mcpserver.NewMCPServer(
+		"teleport-demo",
+		teleport.Version,
+	)
+
+	tools := []mcpserver.ServerTool{
+		{
+			Tool: mcp.NewTool(
+				"teleport_user_info",
+				mcp.WithDescription("Shows basic information about your Teleport user."),
+			),
+			Handler: makeUserInfoToolHandler(session),
+		},
+		{
+			Tool: mcp.NewTool(
+				"teleport_session_info",
+				mcp.WithDescription("Shows information about this MCP session."),
+			),
+			Handler: makeSessionInfoToolHandler(session),
+		},
+		{
+			Tool: mcp.NewTool(
+				"teleport_demo_info",
+				mcp.WithDescription("Shows information about this Teleport Demo MCP server."),
+			),
+			Handler: makeDemoInfoToolHandler(),
+		},
+	}
+
+	demoServer.AddTools(tools...)
+	return demoServer
+}
+
+func makeUserInfoToolHandler(session *sessionHandler) mcpserver.ToolHandlerFunc {
+	return func(_ context.Context, _ mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		data, err := json.Marshal(map[string]any{
+			"name":      session.AuthCtx.User.GetName(),
+			"user_kind": session.makeUserMetadata().UserKind.String(),
+			"roles":     session.AuthCtx.User.GetRoles(),
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return mcp.NewToolResultText(string(data)), nil
+	}
+}
+
+func makeSessionInfoToolHandler(session *sessionHandler) mcpserver.ToolHandlerFunc {
+	return func(_ context.Context, _ mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		data, err := json.Marshal(map[string]any{
+			"teleport_cluster":         session.Identity.RouteToApp.ClusterName,
+			"teleport_app_name":        session.App.GetName(),
+			"teleport_app_description": session.App.GetDescription(),
+			"mcp_transport_type":       types.GetMCPServerTransportType(session.App.GetURI()),
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return mcp.NewToolResultText(string(data)), nil
+	}
+}
+
+func makeDemoInfoToolHandler() mcpserver.ToolHandlerFunc {
+	text := `Teleport can provide secure connections to your MCP servers while
+improving both access control and visibility.
+
+This 'teleport-demo' MCP server is a demonstration that showcases how Teleport
+MCP access works.
+
+You can find this 'teleport-demo' server in the Teleport Web UI or by running
+'tsh mcp ls'.
+
+To connect to the demo server with stdio transport from your AI tool, use 'tsh
+mcp connect teleport-demo'. Or run 'tsh mcp config teleport-demo' for more
+configuration details.
+
+If you are an auditor, you can also find this MCP session and corresponding
+requests in the audit events.
+
+Available Tools from the demo server:
+- 'teleport_user_info': Shows basic information about your Teleport user.
+- 'teleport_session_info': Shows information about this MCP session.
+- 'teleport_demo_info' (this tool): Shows information about this Teleport Demo MCP server.
+
+You can restrict what tools a user can access by listing allowed MCP tools in
+the role spec 'role.allow.mcp.tools'.
+
+To learn more about enrolling MCP servers and additional reference materials, please visit:
+https://goteleport.com/docs/enroll-resources/mcp-access
+`
+	return func(_ context.Context, _ mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		return mcp.NewToolResultText(text), nil
+	}
+}
+
+type inMemoryServerRunner struct {
+	serverStdin    io.ReadCloser
+	serverStdout   io.WriteCloser
+	writeToServer  io.WriteCloser
+	readFromServer io.ReadCloser
+	mcpServer      *mcpserver.MCPServer
+	log            *slog.Logger
+}
+
+func makeInMemoryServerRunner(mcpServer *mcpserver.MCPServer, log *slog.Logger) (stdioServerRunner, error) {
+	if mcpServer == nil {
+		return nil, trace.BadParameter("mcpServer must not be nil")
+	}
+	if log == nil {
+		log = slog.Default()
+	}
+
+	serverStdin, writeToServer := io.Pipe()
+	readFromServer, serverStdout := io.Pipe()
+	return &inMemoryServerRunner{
+		serverStdin:    serverStdin,
+		serverStdout:   serverStdout,
+		writeToServer:  writeToServer,
+		readFromServer: readFromServer,
+		mcpServer:      mcpServer,
+		log:            log,
+	}, nil
+}
+
+func (s *inMemoryServerRunner) getStdinPipe() (io.WriteCloser, error) {
+	return s.writeToServer, nil
+}
+
+func (s *inMemoryServerRunner) getStdoutPipe() (io.ReadCloser, error) {
+	return s.readFromServer, nil
+}
+
+func (s *inMemoryServerRunner) run(ctx context.Context) error {
+	s.log.DebugContext(ctx, "Running in-memory MCP server")
+	defer s.log.DebugContext(ctx, "Finished running in-memory MCP server")
+	err := mcpserver.NewStdioServer(s.mcpServer).Listen(ctx, s.serverStdin, s.serverStdout)
+	if err != nil && !mcputils.IsOKCloseError(err) {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *inMemoryServerRunner) close() {
+	if err := s.writeToServer.Close(); err != nil {
+		s.log.DebugContext(context.Background(), "Failed to close pipe", "error", err)
+	}
+	if err := s.serverStdout.Close(); err != nil {
+		s.log.DebugContext(context.Background(), "Failed to close pipe", "error", err)
+	}
+}
diff --git a/lib/srv/mcp/helpers_test.go b/lib/srv/mcp/helpers_test.go
new file mode 100644
index 0000000000000..391b63d95bd1c
--- /dev/null
+++ b/lib/srv/mcp/helpers_test.go
@@ -0,0 +1,395 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	docker "github.com/docker/docker/client"
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/authz"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type setupTestContextOptions struct {
+	roleSet    services.RoleSet
+	app        types.Application
+	clientConn net.Conn
+}
+
+type setupTestContextOptionFunc func(*setupTestContextOptions)
+
+func withApp(app types.Application) setupTestContextOptionFunc {
+	return func(o *setupTestContextOptions) {
+		o.app = app
+	}
+}
+
+func withRole(role types.Role) setupTestContextOptionFunc {
+	return func(opts *setupTestContextOptions) {
+		opts.roleSet = append(opts.roleSet, role)
+	}
+}
+
+func withClientConn(conn net.Conn) setupTestContextOptionFunc {
+	return func(opts *setupTestContextOptions) {
+		opts.clientConn = conn
+	}
+}
+
+// withAdminRole assigns to ai_user a role that allows all MCP servers and their
+// tools.
+func withAdminRole(t *testing.T) setupTestContextOptionFunc {
+	t.Helper()
+	role := services.NewPresetMCPUserRole()
+	require.NoError(t, services.CheckAndSetDefaults(role))
+	return withRole(role)
+}
+
+// withProdReadOnlyRole assigns to the ai_user a role that allows MCP servers
+// with label env=prod and allows read-only tools.
+func withProdReadOnlyRole(t *testing.T) setupTestContextOptionFunc {
+	t.Helper()
+	role, err := types.NewRole("prod-read-only", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: map[string]apiutils.Strings{
+				"env": {"prod"},
+			},
+			MCP: &types.MCPPermissions{
+				Tools: []string{"^(get|read|list|search).*$"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	return withRole(role)
+}
+
+// withDenyToolsRole assigns to the ai_user a role that denies all MCP tools.
+func withDenyToolsRole(t *testing.T) setupTestContextOptionFunc {
+	t.Helper()
+	role, err := types.NewRole("deny-access", types.RoleSpecV6{
+		Deny: types.RoleConditions{
+			MCP: &types.MCPPermissions{
+				Tools: []string{types.Wildcard},
+			},
+		},
+	})
+	require.NoError(t, err)
+	return withRole(role)
+}
+
+func makeDualPipeNetConn(t *testing.T) (net.Conn, net.Conn) {
+	t.Helper()
+	clientSourceConn, clientDestConn, err := utils.DualPipeNetConn(
+		utils.MustParseAddr("127.0.0.1:1111"),
+		utils.MustParseAddr("127.0.0.1:2222"),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		clientSourceConn.Close()
+		clientDestConn.Close()
+	})
+	return clientSourceConn, clientDestConn
+}
+
+type testContext struct {
+	*SessionCtx
+
+	// clientSourceConn connects to SessionCtx.ClientConn.
+	clientSourceConn net.Conn
+}
+
+func setupTestContext(t *testing.T, applyOpts ...setupTestContextOptionFunc) testContext {
+	t.Helper()
+
+	var opts setupTestContextOptions
+	for _, applyOpt := range applyOpts {
+		applyOpt(&opts)
+	}
+
+	// Fake connection if not passed in.
+	var clientSourceConn, clientDestConn net.Conn
+	if opts.clientConn != nil {
+		clientDestConn = opts.clientConn
+	} else {
+		clientSourceConn, clientDestConn = makeDualPipeNetConn(t)
+	}
+
+	// App.
+	if opts.app == nil {
+		app, err := types.NewAppV3(types.Metadata{
+			Name: "my-mcp-server",
+			Labels: map[string]string{
+				"env": "prod",
+			},
+		}, types.AppSpecV3{
+			MCP: &types.MCP{
+				Command:       "npx",
+				Args:          []string{"my-mcp-server"},
+				RunAsHostUser: "my-user",
+			},
+		})
+		require.NoError(t, err)
+		opts.app = app
+	}
+
+	// SessionCtx.
+	sessionCtx := &SessionCtx{
+		ClientConn: clientDestConn,
+		App:        opts.app,
+		AuthCtx:    makeTestAuthContext(t, opts.roleSet, opts.app),
+	}
+	require.NoError(t, sessionCtx.checkAndSetDefaults())
+
+	return testContext{
+		clientSourceConn: clientSourceConn,
+		SessionCtx:       sessionCtx,
+	}
+}
+
+func makeTestAuthContext(t *testing.T, roleSet services.RoleSet, app types.Application) *authz.Context {
+	t.Helper()
+
+	user, err := types.NewUser("ai")
+	require.NoError(t, err)
+	user.SetRoles(slices.Collect(types.ResourceNames(roleSet)))
+
+	identity := authz.LocalUser{
+		Username: user.GetName(),
+		Identity: tlsca.Identity{
+			Username:   user.GetName(),
+			Groups:     user.GetRoles(),
+			Principals: user.GetLogins(),
+			Expires:    time.Now().Add(time.Hour),
+		},
+	}
+	if app != nil {
+		identity.Identity.RouteToApp.Name = app.GetName()
+		identity.Identity.RouteToApp.SessionID = "session-id-for+" + app.GetName()
+	}
+
+	accessInfo, err := services.AccessInfoFromLocalTLSIdentity(identity.Identity)
+	require.NoError(t, err)
+	checker := services.NewAccessCheckerWithRoleSet(accessInfo, "my-cluster", roleSet)
+	return &authz.Context{
+		User:     user,
+		Identity: identity,
+		Checker:  checker,
+	}
+}
+
+type requestBuilder struct {
+	idCounter int64
+}
+
+func (c *requestBuilder) makeRequestID() mcp.RequestId {
+	return mcp.NewRequestId(atomic.AddInt64(&c.idCounter, 1))
+}
+
+func (c *requestBuilder) makeToolsCallRequest(toolName string) *mcputils.JSONRPCRequest {
+	return &mcputils.JSONRPCRequest{
+		JSONRPC: mcp.JSONRPC_VERSION,
+		ID:      c.makeRequestID(),
+		Method:  mcputils.MethodToolsCall,
+		Params: mcputils.JSONRPCParams{
+			"name": toolName,
+		},
+	}
+}
+
+func (c *requestBuilder) makeToolsListRequest() *mcputils.JSONRPCRequest {
+	return &mcputils.JSONRPCRequest{
+		JSONRPC: mcp.JSONRPC_VERSION,
+		ID:      c.makeRequestID(),
+		Method:  mcputils.MethodToolsList,
+	}
+}
+
+func makeToolsCallResponse(t *testing.T, requestID mcp.RequestId, toolNames ...string) *mcputils.JSONRPCResponse {
+	t.Helper()
+	result := mcp.ListToolsResult{}
+	for _, toolName := range toolNames {
+		result.Tools = append(result.Tools, mcp.NewTool(toolName, mcp.WithDescription("description")))
+	}
+	resultJSON, err := json.Marshal(&result)
+	require.NoError(t, err)
+	return &mcputils.JSONRPCResponse{
+		JSONRPC: mcp.JSONRPC_VERSION,
+		ID:      requestID,
+		Result:  resultJSON,
+	}
+}
+
+type fakeAccessPoint struct {
+}
+
+func (f fakeAccessPoint) GetAuthPreference(context.Context) (types.AuthPreference, error) {
+	return types.DefaultAuthPreference(), nil
+}
+func (f fakeAccessPoint) GetClusterName(context.Context) (types.ClusterName, error) {
+	clusterName, err := types.NewClusterName(types.ClusterNameSpecV2{
+		ClusterName: "my-cluster",
+		ClusterID:   "my_cluster_id",
+	})
+	return clusterName, trace.Wrap(err)
+}
+
+func checkParamsHaveNameField(t *testing.T, params *apievents.Struct, wantName string) {
+	t.Helper()
+	require.NotNil(t, params)
+	require.NotNil(t, params.Fields)
+	value, ok := params.Fields["name"]
+	require.True(t, ok)
+	require.Equal(t, wantName, value.GetStringValue())
+}
+
+func checkToolsListResponse(t *testing.T, response mcp.JSONRPCMessage, wantID mcp.RequestId, wantTools []string) {
+	t.Helper()
+	// assume we don't know the internal type of response.
+	data, err := json.Marshal(response)
+	require.NoError(t, err)
+
+	var mcpResponse mcputils.JSONRPCResponse
+	require.NoError(t, json.Unmarshal(data, &mcpResponse))
+	require.Equal(t, wantID.String(), mcpResponse.ID.String())
+
+	var result mcp.ListToolsResult
+	require.NoError(t, json.Unmarshal(mcpResponse.Result, &result))
+	checkToolsListResult(t, &result, wantTools)
+}
+
+func checkToolsListResult(t *testing.T, result *mcp.ListToolsResult, wantTools []string) {
+	t.Helper()
+	require.NotNil(t, result)
+	var actualNames []string
+	for _, tool := range result.Tools {
+		actualNames = append(actualNames, tool.Name)
+	}
+	require.ElementsMatch(t, wantTools, actualNames)
+}
+
+func newDockerClient(t *testing.T) *docker.Client {
+	t.Helper()
+	dockerClient, err := docker.NewClientWithOpts(
+		docker.FromEnv,
+		docker.WithAPIVersionNegotiation(),
+		docker.WithTimeout(10*time.Second),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		dockerClient.Close()
+	})
+	return dockerClient
+}
+
+func findDockerContainer(ctx context.Context, dockerClient *docker.Client, containerName string) container.Summary {
+	containers, err := dockerClient.ContainerList(ctx, container.ListOptions{All: true})
+	if err != nil {
+		return container.Summary{}
+	}
+	for _, container := range containers {
+		if slices.Contains(container.Names, "/"+containerName) {
+			return container
+		}
+	}
+	return container.Summary{}
+}
+
+func findDockerContainerID(ctx context.Context, dockerClient *docker.Client, containerName string) string {
+	return findDockerContainer(ctx, dockerClient, containerName).ID
+}
+
+func forceRemoveContainer(t *testing.T, dockerClient *docker.Client, containerName string) {
+	if containerID := findDockerContainerID(context.Background(), dockerClient, containerName); containerID != "" {
+		if err := dockerClient.ContainerRemove(context.Background(), containerID, container.RemoveOptions{Force: true}); err != nil {
+			t.Log("Failed to remove container", err)
+		}
+	}
+}
+
+type mockAuthClient struct {
+}
+
+func (m mockAuthClient) GenerateAppToken(_ context.Context, req types.GenerateAppTokenRequest) (string, error) {
+	return "app-token-for-" + req.Username, nil
+}
+
+func checkSessionStartAndInitializeEvents(t *testing.T, events []apievents.AuditEvent, extraChecks ...func(*testing.T, *apievents.MCPSessionStart)) {
+	t.Helper()
+	// "notifications/initialized" may or may not slip in so just check the
+	// first two.
+	slices.SortFunc(events, func(a, b apievents.AuditEvent) int {
+		return cmp.Compare(a.GetIndex(), b.GetIndex())
+	})
+	require.GreaterOrEqual(t, len(events), 2)
+	sessionStart, ok := events[0].(*apievents.MCPSessionStart)
+	require.True(t, ok)
+	assert.Equal(t, "test-client/1.0.0", sessionStart.ClientInfo)
+	request, ok := events[1].(*apievents.MCPSessionRequest)
+	require.True(t, ok)
+	assert.Equal(t, string(mcp.MethodInitialize), request.Message.Method)
+
+	for _, check := range extraChecks {
+		check(t, sessionStart)
+	}
+}
+
+func checkSessionStartWithServerInfo(wantName, wantVersion string) func(*testing.T, *apievents.MCPSessionStart) {
+	return func(t *testing.T, sessionStart *apievents.MCPSessionStart) {
+		t.Helper()
+		require.Equal(t, wantName+"/"+wantVersion, sessionStart.ServerInfo)
+	}
+}
+func checkSessionStartWithEgressAuthType(wantEgress string) func(*testing.T, *apievents.MCPSessionStart) {
+	return func(t *testing.T, sessionStart *apievents.MCPSessionStart) {
+		t.Helper()
+		require.Equal(t, wantEgress, sessionStart.EgressAuthType)
+	}
+}
+func checkSessionStartHasExternalSessionID() func(*testing.T, *apievents.MCPSessionStart) {
+	return func(t *testing.T, sessionStart *apievents.MCPSessionStart) {
+		t.Helper()
+		require.NotEmpty(t, sessionStart.SessionID)
+	}
+}
diff --git a/lib/srv/mcp/http.go b/lib/srv/mcp/http.go
new file mode 100644
index 0000000000000..d2a9e94a61782
--- /dev/null
+++ b/lib/srv/mcp/http.go
@@ -0,0 +1,322 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
+	appcommon "github.com/gravitational/teleport/lib/srv/app/common"
+	"github.com/gravitational/teleport/lib/utils"
+	listenerutils "github.com/gravitational/teleport/lib/utils/listener"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+const (
+	mcpSessionIDHeader = "Mcp-Session-Id"
+)
+
+func (s *Server) serveHTTPConn(ctx context.Context, conn net.Conn, handler http.Handler) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	waitConn := utils.NewCloserConn(conn)
+	listener := listenerutils.NewSingleUseListener(waitConn)
+	go func() {
+		// Make sure connection is closed when ctx is canceled.
+		<-ctx.Done()
+		waitConn.Close()
+	}()
+
+	httpServer := &http.Server{
+		Handler: handler,
+		BaseContext: func(net.Listener) context.Context {
+			return ctx
+		},
+	}
+	if err := httpServer.Serve(listener); err != nil && !utils.IsOKNetworkError(err) {
+		return trace.Wrap(err)
+	}
+	waitConn.Wait()
+	return nil
+}
+
+func (s *Server) handleAuthErrHTTP(ctx context.Context, clientConn net.Conn, authErr error) error {
+	return trace.Wrap(s.serveHTTPConn(ctx, clientConn, http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		trace.WriteError(w, authErr)
+	})))
+}
+
+func (s *Server) handleStreamableHTTP(ctx context.Context, sessionCtx *SessionCtx) error {
+	session, err := s.getSessionHandlerWithJWT(ctx, sessionCtx)
+	if err != nil {
+		return trace.Wrap(err, "setting up session handler")
+	}
+	defer session.sessionAuditor.flush(s.cfg.ParentContext)
+
+	transport, err := s.makeStreamableHTTPTransport(session)
+	if err != nil {
+		return trace.Wrap(err, "setting up streamable http transport")
+	}
+
+	session.logger.DebugContext(ctx, "Started handling HTTP request")
+	defer session.logger.DebugContext(ctx, "Completed handling HTTP request")
+
+	delegate := reverseproxy.NewHeaderRewriter()
+	reverseProxy, err := reverseproxy.New(
+		reverseproxy.WithFlushInterval(100*time.Millisecond),
+		reverseproxy.WithRoundTripper(transport),
+		reverseproxy.WithLogger(session.logger),
+		reverseproxy.WithRewriter(appcommon.NewHeaderRewriter(delegate)),
+		reverseproxy.WithResponseModifier(func(resp *http.Response) error {
+			if resp.Request != nil {
+				// Nothing to modify for these.
+				if resp.Request.Method == http.MethodDelete ||
+					isWellKnownPath(resp.Request.URL.Path) {
+					return nil
+				}
+			}
+			return trace.Wrap(mcputils.ReplaceHTTPResponse(ctx, resp, newHTTPResponseReplacer(session)))
+		}),
+	)
+	if err != nil {
+		return trace.Wrap(err, "creating reverse proxy")
+	}
+
+	return trace.Wrap(s.serveHTTPConn(ctx, sessionCtx.ClientConn, reverseProxy))
+}
+
+func (s *Server) makeStreamableHTTPTransport(session *sessionHandler) (http.RoundTripper, error) {
+	targetURI, err := url.Parse(session.App.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	targetURI.Scheme = strings.TrimPrefix(targetURI.Scheme, "mcp+")
+
+	targetTransport, err := s.makeBasicHTTPTransport(session.App)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &streamableHTTPTransport{
+		sessionHandler:  session,
+		targetURI:       targetURI,
+		targetTransport: targetTransport,
+	}, nil
+}
+
+type streamableHTTPTransport struct {
+	*sessionHandler
+	targetURI       *url.URL
+	targetTransport http.RoundTripper
+}
+
+func (t *streamableHTTPTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	t.setExternalSessionID(r.Header)
+
+	switch r.Method {
+	case http.MethodDelete:
+		return t.handleSessionEndRequest(r)
+	case http.MethodGet:
+		if isWellKnownPath(r.URL.Path) {
+			// TODO(greedy52) we don't send audit for this but we should add
+			// this to recording if we support recording one day.
+			t.logger.DebugContext(r.Context(), "Passthrough HTTP request", "path", r.URL.Path)
+			resp, err := t.rewriteAndSendRequest(r)
+			return resp, trace.Wrap(err)
+		}
+
+		return t.handleListenSSEStreamRequest(r)
+	case http.MethodPost:
+		return t.handleMCPMessage(r)
+
+	default:
+		t.emitInvalidHTTPRequest(t.parentCtx, r)
+
+		statusText := http.StatusText(http.StatusMethodNotAllowed)
+		return &http.Response{
+			Request:    r,
+			Status:     statusText,
+			StatusCode: http.StatusMethodNotAllowed,
+			Body:       io.NopCloser(bytes.NewReader(nil)), // Body must not be nil.
+		}, nil
+	}
+}
+
+func (t *streamableHTTPTransport) setExternalSessionID(header http.Header) {
+	if id := header.Get(mcpSessionIDHeader); id != "" {
+		t.updatePendingSessionStartEventWithExternalSessionID(id)
+	}
+}
+
+func (t *streamableHTTPTransport) rewriteRequest(r *http.Request) *http.Request {
+	r = r.Clone(r.Context())
+	r.URL.Scheme = t.targetURI.Scheme
+	r.URL.Host = t.targetURI.Host
+
+	// Defaults to the endpoint defined in the app if client is not providing it.
+	// By spec, streamable HTTP should use a single endpoint except the
+	// ".well-known" used for OAuth.
+	// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http
+	if t.targetURI.Path != "" && (r.URL.Path == "" || r.URL.Path == "/") {
+		r.URL.Path = t.targetURI.Path
+	}
+
+	t.rewriteHTTPRequestHeaders(r)
+	return r
+}
+
+func (t *streamableHTTPTransport) rewriteAndSendRequest(r *http.Request) (*http.Response, error) {
+	rCopy := t.rewriteRequest(r)
+	return t.targetTransport.RoundTrip(rCopy)
+}
+
+func (t *streamableHTTPTransport) handleSessionEndRequest(r *http.Request) (*http.Response, error) {
+	resp, err := t.rewriteAndSendRequest(r)
+	t.emitEndEvent(t.parentCtx, eventWithHTTPResponseError(resp, err), eventWithHeader(r.Header))
+	return resp, trace.Wrap(err)
+}
+
+func (t *streamableHTTPTransport) handleListenSSEStreamRequest(r *http.Request) (*http.Response, error) {
+	resp, err := t.rewriteAndSendRequest(r)
+	t.emitListenSSEStreamEvent(t.parentCtx, eventWithHTTPResponseError(resp, err), eventWithHeader(r.Header))
+	return resp, trace.Wrap(err)
+}
+
+func (t *streamableHTTPTransport) handleMCPMessage(r *http.Request) (*http.Response, error) {
+	var baseMessage mcputils.BaseJSONRPCMessage
+	if reqBody, err := utils.GetAndReplaceRequestBody(r); err != nil {
+		t.emitInvalidHTTPRequest(t.parentCtx, r)
+		return nil, trace.BadParameter("invalid request body %v", err)
+	} else if err := json.Unmarshal(reqBody, &baseMessage); err != nil {
+		t.emitInvalidHTTPRequest(t.parentCtx, r)
+		return nil, trace.BadParameter("invalid request body %v", err)
+	}
+
+	switch {
+	case baseMessage.IsRequest():
+		mcpRequest := baseMessage.MakeRequest()
+		if errResp, authErr := t.sessionHandler.processClientRequest(r.Context(), mcpRequest); authErr != nil {
+			return t.handleRequestAuthError(r, mcpRequest, errResp, authErr)
+		}
+	case baseMessage.IsNotification():
+		t.sessionHandler.processClientNotification(r.Context(), baseMessage.MakeNotification())
+	default:
+		// Not sending it to the server if we don't understand it.
+		t.emitInvalidHTTPRequest(t.parentCtx, r)
+		return nil, trace.BadParameter("not a MCP request or notification")
+	}
+
+	resp, err := t.rewriteAndSendRequest(r)
+	// Prefer session ID from server response if present. For example,
+	// "initialize" request does not have an ID but the server response may have
+	// it.
+	if resp != nil {
+		t.setExternalSessionID(resp.Header)
+	}
+
+	// Take care of audit events after round trip.
+	respErrForAudit := convertHTTPResponseErrorForAudit(resp, err)
+	switch {
+	case baseMessage.IsRequest():
+		mcpRequest := baseMessage.MakeRequest()
+		// Only emit session start if "initialize" succeeded.
+		if mcpRequest.Method == mcputils.MethodInitialize && respErrForAudit == nil {
+			t.appendStartEvent(r.Context(), eventWithHeader(r.Header))
+		}
+		t.emitRequestEvent(r.Context(), mcpRequest, eventWithError(respErrForAudit), eventWithHeader(r.Header))
+	case baseMessage.IsNotification():
+		t.emitNotificationEvent(r.Context(), baseMessage.MakeNotification(), eventWithError(respErrForAudit), eventWithHeader(r.Header))
+	}
+	return resp, trace.Wrap(err)
+}
+
+func (t *streamableHTTPTransport) handleRequestAuthError(r *http.Request, mcpRequest *mcputils.JSONRPCRequest, errResp mcp.JSONRPCMessage, authErr error) (*http.Response, error) {
+	t.emitRequestEvent(t.parentCtx, mcpRequest, eventWithError(authErr), eventWithHeader(r.Header))
+
+	errRespAsBody, err := json.Marshal(errResp)
+	if err != nil {
+		// Should not happen. If it does, we are failing the request either way.
+		return nil, trace.Wrap(err)
+	}
+
+	httpResp := &http.Response{
+		Request:    r,
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(bytes.NewReader(errRespAsBody)),
+		Header:     make(http.Header),
+	}
+	httpResp.Header.Set("Content-Type", "application/json")
+	return httpResp, nil
+}
+
+func convertHTTPResponseErrorForAudit(resp *http.Response, err error) error {
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if resp == nil {
+		// Should not happen.
+		return trace.BadParameter("missing response")
+	}
+	if resp.StatusCode >= http.StatusOK && resp.StatusCode < http.StatusBadRequest {
+		return nil
+	}
+	if resp.Status == "" {
+		return trace.Errorf("HTTP %d %s", resp.StatusCode, http.StatusText(resp.StatusCode))
+	}
+	return trace.Errorf("HTTP %s", resp.Status)
+}
+
+// streamableHTTPResponseReplacer is a wrapper of sessionHandler to satisfy
+// mcputils.ServerMessageProcessor.
+type streamableHTTPResponseReplacer struct {
+	*sessionHandler
+}
+
+func newHTTPResponseReplacer(sessionHandler *sessionHandler) *streamableHTTPResponseReplacer {
+	return &streamableHTTPResponseReplacer{
+		sessionHandler: sessionHandler,
+	}
+}
+
+func (p *streamableHTTPResponseReplacer) ProcessResponse(ctx context.Context, resp *mcputils.JSONRPCResponse) mcp.JSONRPCMessage {
+	method, response := p.processServerResponse(ctx, resp)
+	if method == mcputils.MethodInitialize {
+		p.sessionAuditor.updatePendingSessionStartEventWithInitializeResult(ctx, resp)
+	}
+	return response
+}
+func (p *streamableHTTPResponseReplacer) ProcessNotification(ctx context.Context, notification *mcputils.JSONRPCNotification) mcp.JSONRPCMessage {
+	p.processServerNotification(ctx, notification)
+	return notification
+}
+
+func isWellKnownPath(urlPath string) bool {
+	return strings.HasPrefix(urlPath, "/.well-known/")
+}
diff --git a/lib/srv/mcp/http_test.go b/lib/srv/mcp/http_test.go
new file mode 100644
index 0000000000000..f4dbd2910e81e
--- /dev/null
+++ b/lib/srv/mcp/http_test.go
@@ -0,0 +1,246 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	libevents "github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/utils"
+	listenerutils "github.com/gravitational/teleport/lib/utils/listener"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+	sliceutils "github.com/gravitational/teleport/lib/utils/slices"
+)
+
+func Test_handleStreamableHTTP(t *testing.T) {
+	t.Parallel()
+
+	remoteMCPServer := mcpserver.NewStreamableHTTPServer(mcptest.NewServer())
+	remoteMCPHTTPServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/.well-known/oauth-authorization-server":
+			w.Write([]byte("{}"))
+			w.WriteHeader(http.StatusOK)
+		case r.URL.Path != "/mcp":
+			// Unhappy scenario.
+			w.WriteHeader(http.StatusNotFound)
+		case r.Header.Get("Authorization") != "Bearer app-token-for-ai":
+			// Verify rewrite headers.
+			w.WriteHeader(http.StatusUnauthorized)
+		default:
+			remoteMCPServer.ServeHTTP(w, r)
+		}
+	}))
+	t.Cleanup(remoteMCPHTTPServer.Close)
+
+	app, err := types.NewAppV3(types.Metadata{
+		Name: "test-http",
+	}, types.AppSpecV3{
+		URI: fmt.Sprintf("mcp+%s/mcp", remoteMCPHTTPServer.URL),
+		Rewrite: &types.Rewrite{
+			Headers: []*types.Header{{
+				Name:  "Authorization",
+				Value: "Bearer {{internal.jwt}}",
+			}},
+		},
+	})
+	require.NoError(t, err)
+
+	emitter := eventstest.MockRecorderEmitter{}
+	s, err := NewServer(ServerConfig{
+		Emitter:       &emitter,
+		ParentContext: t.Context(),
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+	require.NoError(t, err)
+
+	// Run MCP handler behind a listener.
+	var wg sync.WaitGroup
+	t.Cleanup(wg.Wait)
+	listener := listenerutils.NewInMemoryListener()
+	require.NoError(t, err)
+	defer listener.Close()
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				assert.True(t, utils.IsOKNetworkError(err))
+				return
+			}
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				defer conn.Close()
+				testCtx := setupTestContext(t, withAdminRole(t), withApp(app), withClientConn(conn))
+				testCtx.sessionID = "test-session-id" // use same session id
+				assert.NoError(t, s.HandleSession(t.Context(), testCtx.SessionCtx))
+			}()
+		}
+	}()
+
+	t.Run("success", func(t *testing.T) {
+		ctx := t.Context()
+		emitter.Reset()
+		mcpClientTransport, err := mcpclienttransport.NewStreamableHTTP(
+			"http://memory",
+			mcpclienttransport.WithHTTPBasicClient(listener.MakeHTTPClient()),
+			mcpclienttransport.WithContinuousListening(),
+		)
+		require.NoError(t, err)
+		client := mcpclient.NewClient(mcpClientTransport)
+		require.NoError(t, client.Start(ctx))
+
+		// Initialize client, then call a tool. Note that the order can be
+		// undeterministic as the listen request is sent from a go-routine by
+		// mcp-go client.
+		getEventCode := func(e apievents.AuditEvent) string {
+			return e.GetCode()
+		}
+		mcptest.MustInitializeClient(t, client)
+		mcptest.MustCallServerTool(t, client)
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			require.ElementsMatch(t, []string{
+				libevents.MCPSessionStartCode,
+				libevents.MCPSessionRequestCode, // "initialize"
+				libevents.MCPSessionNotificationCode,
+				libevents.MCPSessionListenSSEStreamCode,
+				libevents.MCPSessionRequestCode, // "tools/call"
+			}, sliceutils.Map(emitter.Events(), getEventCode))
+		}, 2*time.Second, time.Millisecond*100, "waiting for events")
+		checkSessionStartAndInitializeEvents(t, emitter.Events(),
+			checkSessionStartWithServerInfo("test-server", "1.0.0"),
+			checkSessionStartHasExternalSessionID(),
+			checkSessionStartWithEgressAuthType("app-jwt"),
+		)
+
+		// Close client and wait for end event.
+		require.NoError(t, client.Close())
+		require.EventuallyWithT(t, func(t *assert.CollectT) {
+			require.Equal(t, libevents.MCPSessionEndEvent, emitter.LastEvent().GetType())
+		}, 2*time.Second, time.Millisecond*100, "waiting for end event")
+	})
+
+	t.Run("endpoint not found", func(t *testing.T) {
+		ctx := t.Context()
+		emitter.Reset()
+		mcpClientTransport, err := mcpclienttransport.NewStreamableHTTP(
+			"http://memory/notfound",
+			mcpclienttransport.WithHTTPBasicClient(listener.MakeHTTPClient()),
+			mcpclienttransport.WithHTTPHeaders(map[string]string{
+				"test-header": "test-value",
+			}),
+		)
+		require.NoError(t, err)
+
+		// Initialize client should fail.
+		client := mcpclient.NewClient(mcpClientTransport)
+		_, err = mcptest.InitializeClient(ctx, client)
+		require.Error(t, err)
+
+		// Close client and verify failure event.
+		events := emitter.Events()
+		require.Len(t, events, 1)
+		lastEvent, ok := events[0].(*apievents.MCPSessionRequest)
+		require.True(t, ok)
+		require.Equal(t, libevents.MCPSessionRequestEvent, lastEvent.GetType())
+		require.Equal(t, libevents.MCPSessionRequestFailureCode, lastEvent.GetCode())
+		require.NotEmpty(t, lastEvent.Headers)
+		require.Equal(t, "test-value", http.Header(lastEvent.Headers).Get("test-header"))
+		require.False(t, lastEvent.Success)
+		require.Equal(t, "HTTP 404 Not Found", lastEvent.Error)
+	})
+
+	t.Run("unsupported method", func(t *testing.T) {
+		emitter.Reset()
+		httpClient := listener.MakeHTTPClient()
+		request, err := http.NewRequestWithContext(t.Context(), http.MethodOptions, "http://localhost/", nil)
+		require.NoError(t, err)
+		response, err := httpClient.Do(request)
+		require.NoError(t, err)
+		defer response.Body.Close()
+		require.Equal(t, http.StatusMethodNotAllowed, response.StatusCode)
+		require.Equal(t, libevents.MCPSessionInvalidHTTPRequest, emitter.LastEvent().GetType())
+	})
+
+	t.Run("passthrough well-known", func(t *testing.T) {
+		emitter.Reset()
+		httpClient := listener.MakeHTTPClient()
+		request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://localhost/.well-known/oauth-authorization-server", nil)
+		require.NoError(t, err)
+		response, err := httpClient.Do(request)
+		require.NoError(t, err)
+		defer response.Body.Close()
+		require.Equal(t, http.StatusOK, response.StatusCode)
+		// No audit events.
+		events := emitter.Events()
+		require.Empty(t, events)
+	})
+}
+
+func Test_handleAuthErrHTTP(t *testing.T) {
+	s, err := NewServer(ServerConfig{
+		Emitter:       &libevents.DiscardEmitter{},
+		ParentContext: t.Context(),
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+
+	require.NoError(t, err)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer listener.Close()
+	go func() {
+		conn, err := listener.Accept()
+		if err != nil {
+			assert.True(t, utils.IsOKNetworkError(err))
+			return
+		}
+		defer conn.Close()
+		s.handleAuthErrHTTP(t.Context(), conn, trace.AccessDenied("access denied"))
+	}()
+
+	mcpClientTransport, err := mcpclienttransport.NewStreamableHTTP(
+		fmt.Sprintf("http://%s", listener.Addr().String()),
+	)
+	require.NoError(t, err)
+	client := mcpclient.NewClient(mcpClientTransport)
+	_, err = mcptest.InitializeClient(t.Context(), client)
+	require.ErrorContains(t, err, "access denied")
+}
diff --git a/lib/srv/mcp/reporting.go b/lib/srv/mcp/reporting.go
new file mode 100644
index 0000000000000..4b35a9938d6d8
--- /dev/null
+++ b/lib/srv/mcp/reporting.go
@@ -0,0 +1,139 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"slices"
+
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+var (
+	setupErrors = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      "setup_errors_total",
+			Subsystem: "mcp",
+			Help:      "Number of errors encountered when setting up MCP sessions",
+		},
+		[]string{"transport"},
+	)
+
+	accumulatedSessions = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      "sessions_total",
+			Subsystem: "mcp",
+			Help:      "Number of accumulated MCP sessions",
+		},
+		[]string{"transport"},
+	)
+
+	activeSessions = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      "active_sessions_total",
+			Subsystem: "mcp",
+			Help:      "Number of active MCP sessions",
+		},
+		[]string{"transport"},
+	)
+
+	messagesFromClient = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      "messages_from_client_total",
+			Subsystem: "mcp",
+			Help:      "Number of messages received from the MCP client",
+		},
+		[]string{"transport", "type", "method"},
+	)
+
+	messagesFromServer = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: teleport.MetricNamespace,
+			Name:      "messages_from_server_total",
+			Subsystem: "mcp",
+			Help:      "Number of messages received from the MCP server",
+		},
+		[]string{"transport", "type", "method"},
+	)
+
+	allPrometheusCollectors = []prometheus.Collector{
+		setupErrors,
+		accumulatedSessions, activeSessions,
+		messagesFromClient, messagesFromServer,
+	}
+
+	// knownNotificationMethods is a list of known method names for notifications.
+	//
+	// The list is obtained by searching these in addition to mcp-go:
+	// - https://github.com/modelcontextprotocol/modelcontextprotocol
+	// - https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/index.ts
+	knownNotificationMethods = []string{
+		//nolint:misspell // "cancelled" is "UK" spelling but our linter is set to use US locale
+		"notifications/cancelled",
+		"notifications/initialized",
+		"notifications/message",
+		"notifications/progress",
+		mcputils.MethodNotificationPromptsListChanged,   // notifications/prompts/list_changed
+		mcputils.MethodNotificationResourcesListChanged, // notifications/resources/list_changed
+		mcputils.MethodNotificationResourceUpdated,      // notifications/resources/updated
+		mcputils.MethodNotificationToolsListChanged,     // notifications/tools/list_changed
+		mcputils.MethodNotificationRootsListChanged,     // notifications/roots/list_changed
+	}
+
+	// knownRequestMethods is a list of known method names for requests.
+	//
+	// The list is obtained by searching these in addition to mcp-go:
+	// - https://github.com/modelcontextprotocol/modelcontextprotocol
+	// - https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/index.ts
+	knownRequestMethods = []string{
+		mcputils.MethodInitialize,             // initialize
+		mcputils.MethodPing,                   // ping
+		mcputils.MethodResourcesList,          // resources/list
+		mcputils.MethodResourcesTemplatesList, // resources/templates/list
+		mcputils.MethodResourcesRead,          // resources/read
+		mcputils.MethodPromptsList,            // prompts/list
+		mcputils.MethodPromptsGet,             // prompts/get
+		mcputils.MethodToolsList,              // tools/list
+		mcputils.MethodToolsCall,              // tools/call
+		mcputils.MethodSetLogLevel,            // logging/setLevel
+		mcputils.MethodElicitationCreate,      // elicitation/create
+		mcputils.MethodListRoots,              // roots/list
+		mcputils.MethodSamplingCreateMessage,  // sampling/createMessage
+	}
+)
+
+func reportNotificationMethod(method string) string {
+	if slices.Contains(knownNotificationMethods, method) {
+		return method
+	}
+	return "unknown"
+}
+
+func reportRequestMethod(method string) string {
+	if slices.Contains(knownRequestMethods, method) {
+		return method
+	}
+	return "unknown"
+}
diff --git a/lib/srv/mcp/server.go b/lib/srv/mcp/server.go
new file mode 100644
index 0000000000000..73046fcae086a
--- /dev/null
+++ b/lib/srv/mcp/server.go
@@ -0,0 +1,246 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"log/slog"
+	"net"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+	"github.com/gravitational/teleport/lib/services"
+	appcommon "github.com/gravitational/teleport/lib/srv/app/common"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// AccessPoint defines functions that the MCP server requires from the caching
+// client to the Auth Server.
+type AccessPoint interface {
+	services.AuthPreferenceGetter
+	services.ClusterNameGetter
+}
+
+// AuthClient defines functions that the MCP server requires from the auth
+// client.
+type AuthClient interface {
+	appcommon.AppTokenGenerator
+}
+
+// ServerConfig is the config for the MCP forward server.
+type ServerConfig struct {
+	// Emitter is used for emitting audit events.
+	Emitter apievents.Emitter
+	// Log is the slog logger.
+	Log *slog.Logger
+	// ParentContext is parent's context for logging.
+	ParentContext context.Context
+	// HostID is the host ID of the teleport service.
+	HostID string
+	// AccessPoint is a caching client connected to the Auth Server.
+	AccessPoint AccessPoint
+	// AuthClient is a client directly connected to the Auth server.
+	AuthClient AuthClient
+	// EnableDemoServer enables the "Teleport Demo" MCP server.
+	EnableDemoServer bool
+	// CipherSuites is the list of TLS cipher suites that have been configured
+	// for this process.
+	CipherSuites []uint16
+
+	clock clockwork.Clock
+}
+
+// CheckAndSetDefaults checks values and sets defaults
+func (c *ServerConfig) CheckAndSetDefaults() error {
+	if c.Emitter == nil {
+		return trace.BadParameter("missing Emitter")
+	}
+	if c.ParentContext == nil {
+		return trace.BadParameter("missing ParentContext")
+	}
+	if c.HostID == "" {
+		return trace.BadParameter("missing HostID")
+	}
+	if c.AuthClient == nil {
+		return trace.BadParameter("missing AuthClient")
+	}
+	if c.AccessPoint == nil {
+		return trace.BadParameter("missing AccessPoint")
+	}
+	if len(c.CipherSuites) == 0 {
+		return trace.BadParameter("missing CipherSuites")
+	}
+	if c.Log == nil {
+		c.Log = slog.With(teleport.ComponentKey, teleport.ComponentMCP)
+	}
+	if c.clock == nil {
+		c.clock = clockwork.NewRealClock()
+	}
+	return nil
+}
+
+// Server handles forwarding client connections to MCP servers.
+type Server struct {
+	cfg ServerConfig
+
+	sessionCache *utils.FnCache
+}
+
+// NewServer creates a new Server.
+func NewServer(cfg ServerConfig) (*Server, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := metrics.RegisterPrometheusCollectors(allPrometheusCollectors...); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:         10 * time.Minute,
+		Context:     cfg.ParentContext,
+		Clock:       cfg.clock,
+		ReloadOnErr: true,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &Server{
+		cfg:          cfg,
+		sessionCache: cache,
+	}, nil
+}
+
+// HandleSession handles an authorized client connection.
+func (s *Server) HandleSession(ctx context.Context, sessionCtx *SessionCtx) error {
+	if err := sessionCtx.checkAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Metrics.
+	accumulatedSessions.WithLabelValues(sessionCtx.transport).Inc()
+	activeSessions.WithLabelValues(sessionCtx.transport).Inc()
+	defer activeSessions.WithLabelValues(sessionCtx.transport).Dec()
+
+	if s.cfg.EnableDemoServer && isDemoServerApp(sessionCtx.App) {
+		return trace.Wrap(s.handleStdio(ctx, sessionCtx, makeDemoServerRunner))
+	}
+	switch sessionCtx.transport {
+	case types.MCPTransportStdio:
+		return trace.Wrap(s.handleStdio(ctx, sessionCtx, makeExecServerRunner))
+	case types.MCPTransportSSE:
+		return trace.Wrap(s.handleStdioToSSE(ctx, sessionCtx))
+	case types.MCPTransportHTTP:
+		return trace.Wrap(s.handleStreamableHTTP(ctx, sessionCtx))
+	default:
+		return trace.BadParameter("unknown transport type: %v", sessionCtx.transport)
+	}
+}
+
+// HandleUnauthorizedConnection handles an unauthorized client connection.
+// This function has a hardcoded 30 seconds timeout in case the proper error
+// message cannot be delivered to the client.
+func (s *Server) HandleUnauthorizedConnection(ctx context.Context, clientConn net.Conn, app types.Application, authErr error) error {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*30)
+	defer cancel()
+	transportType := types.GetMCPServerTransportType(app.GetURI())
+	switch transportType {
+	case types.MCPTransportHTTP:
+		return trace.Wrap(s.handleAuthErrHTTP(ctx, clientConn, authErr))
+	default:
+		return trace.Wrap(s.handleAuthErrStdio(ctx, clientConn, authErr))
+	}
+}
+
+func (s *Server) makeSessionAuditor(ctx context.Context, sessionCtx *SessionCtx, logger *slog.Logger) (*sessionAuditor, error) {
+	clusterName, err := s.cfg.AccessPoint.GetClusterName(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	name := clusterName.GetClusterName()
+
+	preparer, err := events.NewPreparer(events.PreparerConfig{
+		SessionID:   sessionCtx.sessionID,
+		ServerID:    s.cfg.HostID,
+		Namespace:   apidefaults.Namespace,
+		Clock:       s.cfg.clock,
+		ClusterName: name,
+		StartTime:   s.cfg.clock.Now(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return newSessionAuditor(sessionAuditorConfig{
+		emitter:    s.cfg.Emitter,
+		logger:     logger,
+		hostID:     s.cfg.HostID,
+		preparer:   preparer,
+		sessionCtx: sessionCtx,
+	})
+}
+
+func (s *Server) makeSessionHandler(ctx context.Context, sessionCtx *SessionCtx) (*sessionHandler, error) {
+	// Some extra info for debugging purpose.
+	logger := s.cfg.Log.With(
+		"client_ip", sessionCtx.ClientConn.RemoteAddr(),
+		"app", sessionCtx.App.GetName(),
+		"app_uri", sessionCtx.App.GetURI(),
+		"user", sessionCtx.AuthCtx.User.GetName(),
+		"session_id", sessionCtx.sessionID,
+	)
+
+	sessionAuditor, err := s.makeSessionAuditor(ctx, sessionCtx, logger)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return newSessionHandler(sessionHandlerConfig{
+		SessionCtx:     sessionCtx,
+		sessionAuditor: sessionAuditor,
+		accessPoint:    s.cfg.AccessPoint,
+		logger:         logger,
+		parentCtx:      s.cfg.ParentContext,
+		clock:          s.cfg.clock,
+	})
+}
+
+func (s *Server) makeSessionHandlerWithJWT(ctx context.Context, sessionCtx *SessionCtx) (*sessionHandler, error) {
+	if err := sessionCtx.generateJWTAndTraits(ctx, s.cfg.AuthClient); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return s.makeSessionHandler(ctx, sessionCtx)
+}
+
+func (s *Server) getSessionHandlerWithJWT(ctx context.Context, sessionCtx *SessionCtx) (*sessionHandler, error) {
+	ttl := min(sessionCtx.Identity.Expires.Sub(s.cfg.clock.Now()), 10*time.Minute)
+	return utils.FnCacheGetWithTTL(ctx, s.sessionCache, sessionCtx.sessionID, ttl, func(ctx context.Context) (*sessionHandler, error) {
+		return s.makeSessionHandlerWithJWT(ctx, sessionCtx)
+	})
+}
diff --git a/lib/srv/mcp/session.go b/lib/srv/mcp/session.go
new file mode 100644
index 0000000000000..453b257ebf78f
--- /dev/null
+++ b/lib/srv/mcp/session.go
@@ -0,0 +1,341 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/lib/authz"
+	dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/session"
+	appcommon "github.com/gravitational/teleport/lib/srv/app/common"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+// SessionCtx contains basic information of an MCP session.
+type SessionCtx struct {
+	// ClientConn is the incoming client connection.
+	ClientConn net.Conn
+	// AuthCtx is the authorization context.
+	AuthCtx *authz.Context
+	// App is the MCP server application being accessed.
+	App types.Application
+	// Identity is the user identity.
+	Identity tlsca.Identity
+
+	// sessionID is the Teleport session ID.
+	//
+	// Note that for stdio-based MCP server, a new session ID is generated per
+	// connection instead of using the web session ID from the app route.
+	sessionID session.ID
+
+	// jwt is the jwt token signed for this identity by Auth server.
+	jwt string
+
+	// traitsForRewriteHeaders are user traits used for rewriting headers.
+	traitsForRewriteHeaders wrappers.Traits
+
+	// transport is the transport type of the MCP server.
+	transport string
+}
+
+func (c *SessionCtx) checkAndSetDefaults() error {
+	if c.ClientConn == nil {
+		return trace.BadParameter("missing ClientConn")
+	}
+	if c.AuthCtx == nil {
+		return trace.BadParameter("missing AuthCtx")
+	}
+	if c.App == nil {
+		return trace.BadParameter("missing App")
+	}
+	if c.Identity.Username == "" {
+		c.Identity = c.AuthCtx.Identity.GetIdentity()
+	}
+	if c.transport == "" {
+		c.transport = types.GetMCPServerTransportType(c.App.GetURI())
+	}
+	if c.sessionID == "" {
+		if types.MCPTransportHTTP == c.transport {
+			// A single HTTP request is handled at a time so take session ID
+			// from cert.
+			c.sessionID = session.ID(c.Identity.RouteToApp.SessionID)
+		}
+		if c.sessionID == "" {
+			c.sessionID = session.NewID()
+		}
+	}
+	return nil
+}
+
+func (c *SessionCtx) getAccessState(authPref types.AuthPreference) services.AccessState {
+	state := c.AuthCtx.Checker.GetAccessState(authPref)
+	state.MFAVerified = c.Identity.IsMFAVerified()
+	state.EnableDeviceVerification = true
+	state.DeviceVerified = dtauthz.IsTLSDeviceVerified(&c.Identity.DeviceExtensions)
+	state.IsBot = c.Identity.IsBot()
+	return state
+}
+
+func (c *SessionCtx) generateJWTAndTraits(ctx context.Context, auth AuthClient) (err error) {
+	c.jwt, c.traitsForRewriteHeaders, err = appcommon.GenerateJWTAndTraits(ctx, &c.Identity, c.App, auth)
+	return trace.Wrap(err)
+}
+
+type sessionHandlerConfig struct {
+	*SessionCtx
+	*sessionAuditor
+	accessPoint AccessPoint
+	logger      *slog.Logger
+	clock       clockwork.Clock
+	parentCtx   context.Context
+}
+
+func (c *sessionHandlerConfig) checkAndSetDefaults() error {
+	if c.SessionCtx == nil {
+		return trace.BadParameter("missing session")
+	}
+	if c.sessionAuditor == nil {
+		return trace.BadParameter("missing auditor")
+	}
+	if c.accessPoint == nil {
+		return trace.BadParameter("missing accessPoint")
+	}
+	if c.logger == nil {
+		c.logger = slog.Default()
+	}
+	if c.clock == nil {
+		c.clock = clockwork.NewRealClock()
+	}
+	if c.parentCtx == nil {
+		c.parentCtx = context.Background()
+	}
+	return nil
+}
+
+// sessionHandler provides common functions for handling an MCP session,
+// irrespective the transport type.
+type sessionHandler struct {
+	sessionHandlerConfig
+
+	idTracker   *mcputils.IDTracker
+	accessCache *utils.FnCache
+}
+
+func newSessionHandler(cfg sessionHandlerConfig) (*sessionHandler, error) {
+	if err := cfg.checkAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Usually we won't have more than a couple in flight messages but let's do
+	// 50 just in case. Also, it's ok to lose the ID. The tracked ID is
+	// currently used for tools/list filtering. In worst case we couldn't apply
+	// this filtering, tools/call will still be blocked.
+	idTracker, err := mcputils.NewIDTracker(50)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Cache access check like tool name for a small period of time.
+	accessCache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:   time.Minute * 10,
+		Clock: cfg.clock,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Always begins with session start event for single-connection sessions.
+	if cfg.sessionCtx.transport != types.MCPTransportHTTP {
+		cfg.sessionAuditor.appendStartEvent(cfg.parentCtx)
+	}
+
+	return &sessionHandler{
+		sessionHandlerConfig: cfg,
+		idTracker:            idTracker,
+		accessCache:          accessCache,
+	}, nil
+}
+
+func (s *sessionHandler) checkAccessToTool(ctx context.Context, toolName string) error {
+	authErr, err := utils.FnCacheGet(ctx, s.accessCache, toolName, func(ctx context.Context) (error, error) {
+		authPref, err := s.accessPoint.GetAuthPreference(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		matcher := &services.MCPToolMatcher{
+			Name: toolName,
+		}
+		authErr := s.AuthCtx.Checker.CheckAccess(s.App, s.getAccessState(authPref), matcher)
+		return trace.Wrap(authErr), nil
+	})
+	// Fails the check on either authErr or internal error.
+	return trace.NewAggregate(authErr, err)
+}
+
+// NOTE: the onClientXXX/onServerXXX functions and the close function below
+// provides helper to single-connection sessions and handles audit events.
+// The streamable-HTTP server handler does not use these function but uses
+// processClientXXX/processServerXXX functions directly instead and handles
+// audit events outside the sessionHandler. Ideally we should do some
+// refactoring to separate handler types.
+
+func (s *sessionHandler) close() {
+	s.sessionAuditor.flush(s.parentCtx)
+	if s.sessionCtx.transport != types.MCPTransportHTTP {
+		s.sessionAuditor.emitEndEvent(s.parentCtx)
+	}
+}
+
+func (s *sessionHandler) onClientNotification(serverRequestWriter mcputils.MessageWriter) mcputils.HandleNotificationFunc {
+	return func(ctx context.Context, notification *mcputils.JSONRPCNotification) error {
+		s.emitNotificationEvent(ctx, notification)
+		s.processClientNotification(ctx, notification)
+		return trace.Wrap(serverRequestWriter.WriteMessage(ctx, notification))
+	}
+}
+
+func (s *sessionHandler) onClientRequest(clientResponseWriter, serverRequestWriter mcputils.MessageWriter) mcputils.HandleRequestFunc {
+	return func(ctx context.Context, request *mcputils.JSONRPCRequest) error {
+		msg, authErr := s.processClientRequest(ctx, request)
+		s.emitRequestEvent(ctx, request, eventWithError(authErr))
+		if authErr != nil {
+			return trace.Wrap(clientResponseWriter.WriteMessage(ctx, msg))
+		}
+		return trace.Wrap(serverRequestWriter.WriteMessage(ctx, msg))
+	}
+}
+
+func (s *sessionHandler) onServerNotification(clientResponseWriter mcputils.MessageWriter) mcputils.HandleNotificationFunc {
+	return func(ctx context.Context, notification *mcputils.JSONRPCNotification) error {
+		s.processServerNotification(ctx, notification)
+		return trace.Wrap(clientResponseWriter.WriteMessage(ctx, notification))
+	}
+}
+
+func (s *sessionHandler) onServerResponse(clientResponseWriter mcputils.MessageWriter) mcputils.HandleResponseFunc {
+	return func(ctx context.Context, response *mcputils.JSONRPCResponse) error {
+		method, msgToClient := s.processServerResponse(ctx, response)
+		if method == mcputils.MethodInitialize {
+			s.sessionAuditor.updatePendingSessionStartEventWithInitializeResult(ctx, response)
+		}
+		return trace.Wrap(clientResponseWriter.WriteMessage(ctx, msgToClient))
+	}
+}
+
+func (s *sessionHandler) processClientRequest(ctx context.Context, req *mcputils.JSONRPCRequest) (mcp.JSONRPCMessage, error) {
+	messagesFromClient.WithLabelValues(s.transport, "request", reportRequestMethod(req.Method)).Inc()
+
+	// TODO(greedy52) add checks to ensure that the initialize request is the
+	// first request coming in (with the exception of the ping).
+	s.idTracker.PushRequest(req)
+	switch req.Method {
+	case mcputils.MethodToolsCall:
+		methodName, _ := req.Params.GetName()
+		if authErr := s.checkAccessToTool(ctx, methodName); authErr != nil {
+			return makeToolAccessDeniedResponse(req, authErr), trace.Wrap(authErr)
+		}
+	}
+	return req, nil
+}
+
+func (s *sessionHandler) processClientNotification(ctx context.Context, notification *mcputils.JSONRPCNotification) {
+	messagesFromClient.WithLabelValues(s.transport, "notification", reportNotificationMethod(notification.Method)).Inc()
+}
+
+func (s *sessionHandler) processServerResponse(ctx context.Context, response *mcputils.JSONRPCResponse) (string, mcp.JSONRPCMessage) {
+	method, _ := s.idTracker.PopByID(response.ID)
+	messagesFromServer.WithLabelValues(s.transport, "response", reportRequestMethod(method)).Inc()
+
+	switch method {
+	case mcputils.MethodToolsList:
+		return method, s.makeToolsCallResponse(ctx, response)
+	}
+	return method, response
+}
+
+func (s *sessionHandler) processServerNotification(ctx context.Context, notification *mcputils.JSONRPCNotification) {
+	s.logger.DebugContext(ctx, "Received server notification.", "method", notification.Method)
+	messagesFromServer.WithLabelValues(s.transport, "notification", reportNotificationMethod(notification.Method)).Inc()
+}
+
+func (s *sessionHandler) makeToolsCallResponse(ctx context.Context, resp *mcputils.JSONRPCResponse) mcp.JSONRPCMessage {
+	// Nothing to do, likely an error response.
+	if resp.Result == nil {
+		return resp
+	}
+
+	var listResult mcp.ListToolsResult
+	if err := json.Unmarshal(resp.Result, &listResult); err != nil {
+		return mcp.NewJSONRPCError(resp.ID, mcp.INTERNAL_ERROR, "failed to unmarshal tools/list response", err)
+	}
+
+	var allowed []mcp.Tool
+	for _, tool := range listResult.Tools {
+		if s.checkAccessToTool(ctx, tool.Name) == nil {
+			allowed = append(allowed, tool)
+		}
+	}
+
+	s.logger.DebugContext(ctx, "Received tools/list result", "received", len(listResult.Tools), "allowed", len(allowed))
+	listResult.Tools = allowed
+
+	return mcp.JSONRPCResponse{
+		JSONRPC: resp.JSONRPC,
+		ID:      resp.ID,
+		Result:  listResult,
+	}
+}
+
+func (s *sessionHandler) rewriteHTTPRequestHeaders(r *http.Request) {
+	// Add in JWT headers. By default, JWT is not put into "Authorization"
+	// headers since the auth token can also come from the client and Teleport
+	// just pass it through. If the remote MCP server does verify the auth token
+	// signed by Teleport, the server can take the token from the
+	// "teleport-jwt-assertion" header or use a rewrite setting to set the JWT
+	// as "Bearer" in "Authorization".
+	r.Header.Set(teleport.AppJWTHeader, s.jwt)
+	// Add headers from rewrite configuration.
+	rewriteHeaders := appcommon.AppRewriteHeaders(r.Context(), s.App.GetRewrite(), s.logger)
+	services.RewriteHeadersAndApplyValueTraits(r, rewriteHeaders, s.traitsForRewriteHeaders, s.logger)
+}
+
+func makeToolAccessDeniedResponse(msg *mcputils.JSONRPCRequest, authErr error) mcp.JSONRPCMessage {
+	return mcp.NewJSONRPCError(
+		msg.ID,
+		mcp.INVALID_PARAMS,
+		"RBAC is enforced by your Teleport roles. Contact your Teleport Admin for more details.",
+		authErr,
+	)
+}
diff --git a/lib/srv/mcp/session_test.go b/lib/srv/mcp/session_test.go
new file mode 100644
index 0000000000000..edc607adf946d
--- /dev/null
+++ b/lib/srv/mcp/session_test.go
@@ -0,0 +1,189 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	libevents "github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+type captureMessageWriter struct {
+	mu   sync.Mutex
+	msgs []mcp.JSONRPCMessage
+}
+
+func (c *captureMessageWriter) WriteMessage(_ context.Context, msg mcp.JSONRPCMessage) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.msgs = append(c.msgs, msg)
+	return nil
+}
+
+func (c *captureMessageWriter) messages() []mcp.JSONRPCMessage {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return slices.Clone(c.msgs)
+}
+
+func Test_sessionHandler(t *testing.T) {
+	tests := []struct {
+		name         string
+		setupOptions []setupTestContextOptionFunc
+		allowedTools []string
+		deniedTools  []string
+	}{
+		{
+			name:         "admin",
+			setupOptions: []setupTestContextOptionFunc{withAdminRole(t)},
+			allowedTools: []string{"search_files", "read_file", "write_file"},
+		},
+		{
+			name:         "readonly",
+			setupOptions: []setupTestContextOptionFunc{withProdReadOnlyRole(t)},
+			allowedTools: []string{"search_files", "read_file"},
+			deniedTools:  []string{"write_file"},
+		},
+		{
+			name: "no-access",
+			setupOptions: []setupTestContextOptionFunc{
+				withAdminRole(t),
+				withDenyToolsRole(t),
+			},
+			allowedTools: nil,
+			deniedTools:  []string{"search_files", "read_file", "write_file"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+			testCtx := setupTestContext(t, tt.setupOptions...)
+			mockEmitter := &eventstest.MockRecorderEmitter{}
+			requestBuilder := &requestBuilder{}
+			auditor, err := newSessionAuditor(sessionAuditorConfig{
+				emitter:    mockEmitter,
+				hostID:     "test-host-id",
+				sessionCtx: testCtx.SessionCtx,
+				preparer:   &libevents.NoOpPreparer{},
+			})
+			require.NoError(t, err)
+
+			handler, err := newSessionHandler(sessionHandlerConfig{
+				SessionCtx:     testCtx.SessionCtx,
+				sessionAuditor: auditor,
+				accessPoint:    fakeAccessPoint{},
+				parentCtx:      ctx,
+			})
+			require.NoError(t, err)
+
+			t.Run("notification", func(t *testing.T) {
+				msg := &mcputils.JSONRPCNotification{
+					JSONRPC: mcp.JSONRPC_VERSION,
+					Method:  "notifications/initialized",
+				}
+				capture := &captureMessageWriter{}
+				require.NoError(t, handler.onClientNotification(capture)(ctx, msg))
+				event := mockEmitter.LastEvent()
+				require.NotNil(t, event)
+				requestEvent, ok := event.(*apievents.MCPSessionNotification)
+				require.True(t, ok)
+				require.Equal(t, "notifications/initialized", requestEvent.Message.Method)
+				require.Equal(t, []mcp.JSONRPCMessage{msg}, capture.messages())
+			})
+
+			for _, allowedTool := range tt.allowedTools {
+				t.Run("allow tools call "+allowedTool, func(t *testing.T) {
+					clientReq := requestBuilder.makeToolsCallRequest(allowedTool)
+					clientCapture := &captureMessageWriter{}
+					serverCapture := &captureMessageWriter{}
+					require.NoError(t, handler.onClientRequest(clientCapture, serverCapture)(ctx, clientReq))
+
+					event := mockEmitter.LastEvent()
+					require.NotNil(t, event)
+					requestEvent, ok := event.(*apievents.MCPSessionRequest)
+					require.True(t, ok)
+					require.True(t, requestEvent.Success)
+					require.Equal(t, mcputils.MethodToolsCall, requestEvent.Message.Method)
+					checkParamsHaveNameField(t, requestEvent.Message.Params, allowedTool)
+
+					// Server receives the client's request.
+					require.Equal(t, []mcp.JSONRPCMessage{clientReq}, serverCapture.messages())
+					require.Empty(t, clientCapture.messages())
+				})
+			}
+
+			for _, deniedTool := range tt.deniedTools {
+				t.Run("deny tools call "+deniedTool, func(t *testing.T) {
+					clientReq := requestBuilder.makeToolsCallRequest(deniedTool)
+					clientCapture := &captureMessageWriter{}
+					serverCapture := &captureMessageWriter{}
+					require.NoError(t, handler.onClientRequest(clientCapture, serverCapture)(ctx, clientReq))
+
+					event := mockEmitter.LastEvent()
+					require.NotNil(t, event)
+					requestEvent, ok := event.(*apievents.MCPSessionRequest)
+					require.True(t, ok)
+					require.False(t, requestEvent.Success)
+					require.Equal(t, mcputils.MethodToolsCall, requestEvent.Message.Method)
+					checkParamsHaveNameField(t, requestEvent.Message.Params, deniedTool)
+
+					// Server does not receive the client's request. An error is
+					// sent to client.
+					require.Empty(t, serverCapture.messages())
+					clientMessages := clientCapture.messages()
+					require.Len(t, clientMessages, 1)
+					require.IsType(t, mcp.JSONRPCError{}, clientMessages[0])
+				})
+			}
+
+			t.Run("tools list", func(t *testing.T) {
+				mockEmitter.Reset()
+
+				// First make a request so the handler can track the method by ID.
+				clientReq := requestBuilder.makeToolsListRequest()
+				_, authErr := handler.processClientRequest(ctx, clientReq)
+				require.NoError(t, authErr)
+
+				// tools/list does not trigger audit event.
+				require.Nil(t, mockEmitter.LastEvent())
+
+				// make response from server to contain both allowed and denied
+				// tools then check only the allowed tools are present after the
+				// filtering.
+				allTools := append(tt.allowedTools, tt.deniedTools...)
+				serverResponse := makeToolsCallResponse(t, clientReq.ID, allTools...)
+				capture := &captureMessageWriter{}
+				require.NoError(t, handler.onServerResponse(capture)(ctx, serverResponse))
+				clientMessages := capture.messages()
+				require.Len(t, clientMessages, 1)
+				checkToolsListResponse(t, clientMessages[0], clientReq.ID, tt.allowedTools)
+			})
+		})
+	}
+}
diff --git a/lib/srv/mcp/sse.go b/lib/srv/mcp/sse.go
new file mode 100644
index 0000000000000..880900c495fc7
--- /dev/null
+++ b/lib/srv/mcp/sse.go
@@ -0,0 +1,162 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+// handleStdioToSSE proxies a stdio client connection to an SSE server.
+func (s *Server) handleStdioToSSE(ctx context.Context, sessionCtx *SessionCtx) error {
+	// The incoming context can be canceled by connection monitor.
+	// We create an extra cancel here to force stopping the handling of this
+	// connection, when either the client or the server reader finishes reading
+	// the stream.
+	ctx, stopHandling := context.WithCancel(ctx)
+	defer stopHandling()
+
+	baseURL, err := makeSSEBaseURI(sessionCtx.App)
+	if err != nil {
+		return trace.Wrap(err, "parsing SSE URI")
+	}
+
+	session, err := s.makeSessionHandlerWithJWT(ctx, sessionCtx)
+	if err != nil {
+		return trace.Wrap(err, "setting up session handler")
+	}
+	defer session.close()
+
+	// Use custom transport that adds extra headers including JWT.
+	httpTransport, err := s.makeSSEHTTPTransport(session)
+	if err != nil {
+		return trace.Wrap(err, "creating HTTP transport")
+	}
+
+	session.logger.InfoContext(ctx, "Started handling stdio to SSE session", "base_url", logutils.StringerAttr(baseURL))
+	defer session.logger.InfoContext(ctx, "Completed handling stdio to SSE session")
+
+	// Initialize SSE stream.
+	sseResponseReader, sseRequestWriter, err := mcputils.ConnectSSEServer(ctx, baseURL, httpTransport)
+	if err != nil {
+		setupErrors.WithLabelValues(sessionCtx.transport).Inc()
+		return trace.Wrap(err)
+	}
+	session.logger.DebugContext(ctx, "Received SSE endpoint", "endpoint_url", sseRequestWriter.GetEndpointURL())
+	if mcpSessionID := sseRequestWriter.GetSessionID(); mcpSessionID != "" {
+		session.updatePendingSessionStartEventWithExternalSessionID(mcpSessionID)
+	}
+
+	// Setup proxy. The SSE stream and the stdio client connection should
+	// maintain the same life cycle from this point.
+	stdoutLogger := session.logger.With("sse", "stdout")
+	clientResponseWriter := mcputils.NewSyncStdioMessageWriter(sessionCtx.ClientConn)
+	serverResponseReader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport:      sseResponseReader,
+		Logger:         stdoutLogger,
+		OnClose:        stopHandling,
+		OnParseError:   mcputils.LogAndIgnoreParseError(stdoutLogger),
+		OnNotification: session.onServerNotification(clientResponseWriter),
+		OnResponse:     session.onServerResponse(clientResponseWriter),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	go serverResponseReader.Run(ctx)
+
+	clientRequestReader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport:      mcputils.NewStdioReader(sessionCtx.ClientConn),
+		Logger:         session.logger.With("stdio", "stdin"),
+		OnClose:        stopHandling,
+		OnParseError:   mcputils.ReplyParseError(clientResponseWriter),
+		OnRequest:      session.onClientRequest(clientResponseWriter, sseRequestWriter),
+		OnNotification: session.onClientNotification(sseRequestWriter),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Wait until reader finishes.
+	clientRequestReader.Run(ctx)
+	return nil
+}
+
+func makeSSEBaseURI(app types.Application) (*url.URL, error) {
+	baseURL, err := url.Parse(app.GetURI())
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing SSE URI")
+	}
+	switch {
+	case strings.HasPrefix(app.GetURI(), types.SchemeMCPSSEHTTP):
+		baseURL.Scheme = "http"
+	case strings.HasPrefix(app.GetURI(), types.SchemeMCPSSEHTTPS):
+		baseURL.Scheme = "https"
+	default:
+		return nil, trace.BadParameter("unknown scheme type: %v", baseURL.Scheme)
+	}
+	return baseURL, nil
+}
+
+func (s *Server) makeBasicHTTPTransport(app types.Application) (http.RoundTripper, error) {
+	// Use similar settings from lib/srv/app/transport.go.
+	tr, err := defaults.Transport()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Add a timeout to control how long it takes to (start) getting a response
+	// from the target server.
+	tr.ResponseHeaderTimeout = time.Minute
+	tr.TLSClientConfig = utils.TLSConfig(s.cfg.CipherSuites)
+	tr.TLSClientConfig.InsecureSkipVerify = lib.IsInsecureDevMode() || app.GetInsecureSkipVerify()
+	return tr, nil
+}
+
+type sseHTTPTransport struct {
+	session         *sessionHandler
+	targetTransport http.RoundTripper
+}
+
+func (t *sseHTTPTransport) RoundTrip(r *http.Request) (resp *http.Response, err error) {
+	t.session.rewriteHTTPRequestHeaders(r)
+	return t.targetTransport.RoundTrip(r)
+}
+
+func (s *Server) makeSSEHTTPTransport(session *sessionHandler) (http.RoundTripper, error) {
+	targetTransport, err := s.makeBasicHTTPTransport(session.App)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &sseHTTPTransport{
+		session:         session,
+		targetTransport: targetTransport,
+	}, nil
+}
diff --git a/lib/srv/mcp/sse_test.go b/lib/srv/mcp/sse_test.go
new file mode 100644
index 0000000000000..8333ff445bffa
--- /dev/null
+++ b/lib/srv/mcp/sse_test.go
@@ -0,0 +1,106 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	libevents "github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+func Test_handleStdioToSSE(t *testing.T) {
+	sseServer := mcpserver.NewSSEServer(mcptest.NewServer())
+	sseServerWithAuth := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify rewrite headers.
+		if r.Header.Get("Authorization") != "Bearer app-token-for-ai" {
+			w.WriteHeader(http.StatusUnauthorized)
+		}
+		sseServer.ServeHTTP(w, r)
+	}))
+	t.Cleanup(sseServerWithAuth.Close)
+
+	app, err := types.NewAppV3(types.Metadata{
+		Name: "test-sse",
+	}, types.AppSpecV3{
+		URI: fmt.Sprintf("mcp+sse+%s", sseServerWithAuth.URL+"/sse"),
+		Rewrite: &types.Rewrite{
+			Headers: []*types.Header{{
+				Name:  "Authorization",
+				Value: "Bearer {{internal.jwt}}",
+			}},
+		},
+	})
+	require.NoError(t, err)
+
+	ctx := t.Context()
+	emitter := eventstest.MockRecorderEmitter{}
+	s, err := NewServer(ServerConfig{
+		Emitter:       &emitter,
+		ParentContext: ctx,
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+	require.NoError(t, err)
+
+	testCtx := setupTestContext(t, withAdminRole(t), withApp(app))
+	handleDoneCh := make(chan struct{}, 1)
+	go func() {
+		handlerErr := s.HandleSession(ctx, testCtx.SessionCtx)
+		handleDoneCh <- struct{}{}
+		assert.NoError(t, handlerErr)
+	}()
+
+	// Use a real client. Double check start event has the external MCP session
+	// ID.
+	stdioClient := mcptest.NewStdioClientFromConn(t, testCtx.clientSourceConn)
+
+	resp := mcptest.MustInitializeClient(t, stdioClient)
+	require.Equal(t, "test-server", resp.ServerInfo.Name)
+	checkSessionStartAndInitializeEvents(t, emitter.Events(),
+		checkSessionStartWithServerInfo("test-server", "1.0.0"),
+		checkSessionStartHasExternalSessionID(),
+		checkSessionStartWithEgressAuthType("app-jwt"),
+	)
+
+	// Make a tools call.
+	mcptest.MustCallServerTool(t, stdioClient)
+
+	// Now close the client.
+	stdioClient.Close()
+	select {
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for handler")
+	case <-handleDoneCh:
+	}
+	require.Equal(t, libevents.MCPSessionEndEvent, emitter.LastEvent().GetType())
+}
diff --git a/lib/srv/mcp/stdio.go b/lib/srv/mcp/stdio.go
new file mode 100644
index 0000000000000..29ecf64fbed52
--- /dev/null
+++ b/lib/srv/mcp/stdio.go
@@ -0,0 +1,273 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"os/exec"
+	"os/user"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	hostutils "github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/mcputils"
+)
+
+// handleAuthErrStdio starts a stdio message reader and replies with the auth
+// error regardless what message the reader receives (though the first message
+// is most likely client's initialize request). The reader handler quits right
+// after the auth error is delivered to client, by always returning an error to
+// the handler callbacks.
+func (s *Server) handleAuthErrStdio(ctx context.Context, clientConn net.Conn, authErr error) error {
+	logger := s.cfg.Log.With("client_ip", clientConn.RemoteAddr())
+	errMsg := mcp.NewJSONRPCError(mcp.NewRequestId(nil), mcp.INTERNAL_ERROR, authErr.Error(), nil)
+	writer := mcputils.NewStdioMessageWriter(clientConn)
+	reader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport: mcputils.NewStdioReader(clientConn),
+		Logger:    logger,
+		OnRequest: func(ctx context.Context, req *mcputils.JSONRPCRequest) error {
+			// Use request ID when available. Return auth error after writing
+			// back to client to stop the reader.
+			errMsg.ID = req.ID
+			return trace.NewAggregate(writer.WriteMessage(ctx, errMsg), authErr)
+		},
+		OnParseError: func(ctx context.Context, _ mcp.RequestId, _ error) error {
+			return trace.NewAggregate(writer.WriteMessage(ctx, errMsg), authErr)
+		},
+		OnNotification: func(ctx context.Context, _ *mcputils.JSONRPCNotification) error {
+			return trace.NewAggregate(writer.WriteMessage(ctx, errMsg), authErr)
+		},
+	})
+	if err != nil {
+		return trace.NewAggregate(authErr, err)
+	}
+	reader.Run(ctx)
+
+	// Returns the original auth error for caller to log the error and close the
+	// connection just to be safe.
+	return trace.Wrap(authErr)
+}
+
+// handleStdio handles a stdio connection.
+// makeMCPServer defaults to makeExecServerRunner to launch a command but can be
+// mocked for testing.
+func (s *Server) handleStdio(ctx context.Context, sessionCtx *SessionCtx, makeServerRunner makeStdioServerRunnerFunc) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	session, err := s.makeSessionHandler(ctx, sessionCtx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer session.close()
+
+	session.logger.InfoContext(ctx, "Started handling stdio session")
+	defer session.logger.InfoContext(ctx, "Completed handling stdio session")
+
+	serverRunner, err := makeServerRunner(ctx, session)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer serverRunner.close()
+
+	readFromServer, err := serverRunner.getStdoutPipe()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	writeToServer, err := serverRunner.getStdinPipe()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	clientResponseWriter := mcputils.NewSyncStdioMessageWriter(sessionCtx.ClientConn)
+	serverRequestWriter := mcputils.NewSyncStdioMessageWriter(writeToServer)
+
+	clientRequestReader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport: mcputils.NewStdioReader(sessionCtx.ClientConn),
+		Logger:    session.logger.With("stdio", "stdin"),
+		// make sure launched process is getting shut down when client is closed.
+		OnClose:        serverRunner.close,
+		OnParseError:   mcputils.ReplyParseError(clientResponseWriter),
+		OnRequest:      session.onClientRequest(clientResponseWriter, serverRequestWriter),
+		OnNotification: session.onClientNotification(serverRequestWriter),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	stdoutLogger := session.logger.With("stdio", "stdout")
+	serverResponseReader, err := mcputils.NewMessageReader(mcputils.MessageReaderConfig{
+		Transport:      mcputils.NewStdioReader(readFromServer),
+		Logger:         stdoutLogger,
+		OnClose:        serverRunner.close,
+		OnParseError:   mcputils.LogAndIgnoreParseError(stdoutLogger),
+		OnNotification: session.onServerNotification(clientResponseWriter),
+		OnResponse:     session.onServerResponse(clientResponseWriter),
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	go clientRequestReader.Run(ctx)
+	go serverResponseReader.Run(ctx)
+	return trace.Wrap(serverRunner.run(ctx))
+}
+
+// stdioServerRunner is an interface that represents a stdio-based MCP server to
+// be launched. Can be mocked for testing.
+type stdioServerRunner interface {
+	// getStdoutPipe returns an io.ReadCloser for reading responses from
+	// server's stdout.
+	getStdoutPipe() (io.ReadCloser, error)
+	// getStdinPipe returns an io.Writer for writing messages to server's
+	// stdin.
+	getStdinPipe() (io.WriteCloser, error)
+	// run starts the MCP server and blocks until it is shut down.
+	run(context.Context) error
+	// close shuts down the MCP server.
+	close()
+}
+
+type makeStdioServerRunnerFunc func(context.Context, *sessionHandler) (stdioServerRunner, error)
+
+// execServer is the real implementation for stdioServerRunner that launches an
+// exec.Command.
+type execServer struct {
+	cmd     *exec.Cmd
+	session *sessionHandler
+}
+
+func (s *execServer) getStdoutPipe() (io.ReadCloser, error) {
+	return s.cmd.StdoutPipe()
+}
+
+func (s *execServer) getStdinPipe() (io.WriteCloser, error) {
+	return s.cmd.StdinPipe()
+}
+
+func (s *execServer) run(context.Context) error {
+	if err := s.cmd.Start(); err != nil {
+		setupErrors.WithLabelValues(s.session.transport).Inc()
+		return trace.Wrap(err)
+	}
+
+	err := s.cmd.Wait()
+	s.session.logger.DebugContext(s.session.parentCtx, "Command exited",
+		"error", err,
+		"exit", s.cmd.ProcessState.ExitCode(),
+	)
+	if err != nil && !isOKExitError(err) {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *execServer) close() {
+	if err := s.cmd.Cancel(); err != nil && !isOKExitError(err) {
+		s.session.logger.WarnContext(s.session.parentCtx, "Failed to cancel command", "error", err)
+	}
+}
+
+func makeExecServerRunner(ctx context.Context, session *sessionHandler) (stdioServerRunner, error) {
+	mcpSpec := session.App.GetMCP()
+	if mcpSpec == nil {
+		return nil, trace.BadParameter("missing MCP spec")
+	}
+
+	logger := session.logger
+	logger.DebugContext(ctx, "Preparing command to execute",
+		"cmd", mcpSpec.Command,
+		"args", mcpSpec.Args,
+	)
+
+	cmdCtx, cmdCancel := context.WithCancel(ctx)
+	cmd := exec.CommandContext(cmdCtx, mcpSpec.Command, mcpSpec.Args...)
+	cmd.Stderr = mcputils.NewStderrLogWriter(ctx, logger, slog.LevelDebug)
+	// WaitDelay forces a SIGKILL if the process fails to exit 10 seconds after
+	// cmd.Cancel is called. See the WaitDelay doc for details.
+	cmd.WaitDelay = 10 * time.Second
+
+	// We put all shutdown procedures in cmd.Cancel because we are too lazy to
+	// make a separate function. Since cmd.Cancel can be called outside here by
+	// the server handler, we make sure 'cmdCancel' is called to cancel the
+	// command in that case.
+	//
+	// There is also a race where cmd.Cancel may be called before cmd.Process is
+	// available. To make sure the signal is sent, do not use sync.Once on the
+	// entire "cmd.Cancel". Instead, use sync.Once after cmd.Process non-nil
+	// check so we have a better chance to clean up.
+	signalOnce := sync.OnceValue(func() error {
+		// Use SIGINT for graceful shutdown since stdio servers are
+		// "interactive".
+		logger.DebugContext(ctx, "Sending SIGINT to command")
+		return trace.Wrap(cmd.Process.Signal(syscall.SIGINT))
+	})
+	cmd.Cancel = func() error {
+		logger.DebugContext(ctx, "Canceling command", "has_process", cmd.Process == nil)
+		cmdCancel()
+
+		if cmd.Process != nil {
+			return trace.Wrap(signalOnce())
+		}
+		return nil
+	}
+
+	// Set host user.
+	hostUser, err := user.Lookup(mcpSpec.RunAsHostUser)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := hostutils.MaybeSetCommandCredentialAsUser(ctx, cmd, hostUser, logger); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	mcpServer := &execServer{
+		cmd:     cmd,
+		session: session,
+	}
+	return mcpServer, nil
+}
+
+func isExitErrorSignal(exitErr error, signal syscall.Signal) bool {
+	var execExitError *exec.ExitError
+	if !errors.As(exitErr, &execExitError) {
+		return false
+	}
+	waitStatus, ok := execExitError.Sys().(syscall.WaitStatus)
+	if !ok {
+		return false
+	}
+	return waitStatus.Signaled() && waitStatus.Signal() == signal
+}
+
+func isOKExitError(exitError error) bool {
+	return errors.Is(exitError, context.Canceled) ||
+		errors.Is(exitError, os.ErrProcessDone) ||
+		// it's fine if the command is gracefully stopped by us.
+		isExitErrorSignal(exitError, syscall.SIGINT)
+}
diff --git a/lib/srv/mcp/stdio_test.go b/lib/srv/mcp/stdio_test.go
new file mode 100644
index 0000000000000..493d36770bb3a
--- /dev/null
+++ b/lib/srv/mcp/stdio_test.go
@@ -0,0 +1,346 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcp
+
+import (
+	"context"
+	"math/rand/v2"
+	"os"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+func Test_handleAuthErrStdio(t *testing.T) {
+	ctx := t.Context()
+	s, err := NewServer(ServerConfig{
+		Emitter:       &events.DiscardEmitter{},
+		ParentContext: ctx,
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+	require.NoError(t, err)
+
+	testCtx := setupTestContext(t, withAdminRole(t))
+
+	originalAuthErr := trace.AccessDenied("test access denied")
+	handlerDoneCh := make(chan struct{}, 1)
+	go func() {
+		handlerErr := s.HandleUnauthorizedConnection(ctx, testCtx.SessionCtx.ClientConn, testCtx.SessionCtx.App, originalAuthErr)
+		handlerDoneCh <- struct{}{}
+		require.ErrorIs(t, handlerErr, originalAuthErr)
+	}()
+
+	stdioClient := mcptest.NewStdioClientFromConn(t, testCtx.clientSourceConn)
+	_, err = mcptest.InitializeClient(ctx, stdioClient)
+	require.ErrorContains(t, err, originalAuthErr.Error())
+
+	select {
+	case <-time.After(time.Second * 10):
+		require.Fail(t, "timed out waiting for handler")
+	case <-handlerDoneCh:
+	}
+}
+
+func Test_handleStdio(t *testing.T) {
+	ctx := t.Context()
+	testCtx := setupTestContext(t, withAdminRole(t))
+	emitter := eventstest.MockRecorderEmitter{}
+	s, err := NewServer(ServerConfig{
+		Emitter:       &emitter,
+		ParentContext: ctx,
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+	require.NoError(t, err)
+
+	handlerDoneCh := make(chan struct{}, 1)
+	defer close(handlerDoneCh)
+	go func() {
+		// Use the demo server.
+		handlerErr := s.handleStdio(ctx, testCtx.SessionCtx, makeDemoServerRunner)
+		handlerDoneCh <- struct{}{}
+		require.NoError(t, handlerErr)
+	}()
+
+	// Use a real client.
+	stdioClient := mcptest.NewStdioClientFromConn(t, testCtx.clientSourceConn)
+
+	// Some basic tests on the demo server.
+	resp, err := mcptest.InitializeClient(ctx, stdioClient)
+	require.NoError(t, err)
+	require.Equal(t, "teleport-demo", resp.ServerInfo.Name)
+	checkSessionStartAndInitializeEvents(t, emitter.Events(), checkSessionStartWithServerInfo("teleport-demo", teleport.Version))
+
+	listToolsResult, err := stdioClient.ListTools(ctx, mcp.ListToolsRequest{})
+	require.NoError(t, err)
+	checkToolsListResult(t, listToolsResult, []string{
+		"teleport_user_info",
+		"teleport_session_info",
+		"teleport_demo_info",
+	})
+
+	callToolResult, err := stdioClient.CallTool(ctx, mcp.CallToolRequest{
+		Params: mcp.CallToolParams{
+			Name: "teleport_user_info",
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, callToolResult.Content, 1)
+
+	// Now close the client.
+	stdioClient.Close()
+	select {
+	case <-time.After(time.Second * 5):
+		require.Fail(t, "timed out waiting for handler")
+	case <-handlerDoneCh:
+	}
+	event := emitter.LastEvent()
+	_, ok := event.(*apievents.MCPSessionEnd)
+	require.True(t, ok)
+}
+
+// TestHandleSession_execMCPServer tests real server handler for stdio-based MCP
+// server but requires docker installed locally. It will run the "everything"
+// MCP server and "alpine".
+//
+// TELEPORT_MCP_TEST_DOCKER_WITH_HOST_USER needs to be set with a username to
+// run as for the docker command. To test running with ambient credential vs a
+// different user, run the test once with your current user as host user then
+// run one more time with sudo.
+func TestHandleSession_execMCPServer(t *testing.T) {
+	runAsHostUser := os.Getenv("TELEPORT_MCP_TEST_DOCKER_WITH_HOST_USER")
+	if runAsHostUser == "" {
+		t.Skip("This test requires docker and set TELEPORT_MCP_TEST_DOCKER_WITH_HOST_USER=<host_user_name> in your environment")
+	}
+
+	dockerClient := newDockerClient(t)
+	s, err := NewServer(ServerConfig{
+		Emitter:       &events.DiscardEmitter{},
+		ParentContext: t.Context(),
+		HostID:        "my-host-id",
+		AccessPoint:   fakeAccessPoint{},
+		CipherSuites:  utils.DefaultCipherSuites(),
+		AuthClient:    mockAuthClient{},
+	})
+	require.NoError(t, err)
+
+	containerShouldBeRemoved := func(t *testing.T, _ *testContext, containerName string) {
+		t.Helper()
+		require.Empty(t, findDockerContainerID(t.Context(), dockerClient, containerName))
+	}
+
+	connectAfterHandlerStart := func(t *testing.T, testCtx *testContext, containerName string) {
+		t.Helper()
+
+		stdioClient := mcptest.NewStdioClientFromConn(t, testCtx.clientSourceConn)
+		defer stdioClient.Close()
+
+		reqCtx, reqCancel := context.WithTimeout(t.Context(), time.Second*5)
+		defer reqCancel()
+		resp, err := mcptest.InitializeClient(reqCtx, stdioClient)
+		require.NoError(t, err)
+		require.Equal(t, "example-servers/everything", resp.ServerInfo.Name)
+
+		// Check container is running.
+		require.NotEmpty(t, findDockerContainerID(t.Context(), dockerClient, containerName))
+
+		// Note that some metrics may be incremented by other tests too so here
+		// just checking they are non-zero.
+		require.Positive(t, testutil.ToFloat64(accumulatedSessions.WithLabelValues(types.MCPTransportStdio)))
+		require.Positive(t, testutil.ToFloat64(activeSessions.WithLabelValues(types.MCPTransportStdio)))
+		require.Positive(t, testutil.ToFloat64(messagesFromClient.WithLabelValues(types.MCPTransportStdio, "request", "initialize")))
+		require.Positive(t, testutil.ToFloat64(messagesFromClient.WithLabelValues(types.MCPTransportStdio, "notification", "notifications/initialized")))
+		require.Positive(t, testutil.ToFloat64(messagesFromServer.WithLabelValues(types.MCPTransportStdio, "response", "initialize")))
+	}
+
+	tests := []struct {
+		name               string
+		cmd                string
+		checkHandlerError  require.ErrorAssertionFunc
+		dockerRunArgs      []string
+		cancelHandlerCtx   bool
+		afterHandlerStart  func(t *testing.T, testCtx *testContext, containerName string)
+		waitForHandlerExit time.Duration
+		afterHandlerStop   func(t *testing.T, testCtx *testContext, containerName string)
+	}{
+		{
+			// Verify initialize response from real everything server. Then
+			// close the transport to trigger shutdown
+			name:               "everything success",
+			cmd:                "docker",
+			dockerRunArgs:      []string{"mcp/everything"},
+			checkHandlerError:  require.NoError,
+			afterHandlerStart:  connectAfterHandlerStart,
+			waitForHandlerExit: time.Second * 5,
+			afterHandlerStop:   containerShouldBeRemoved,
+		},
+		{
+			// Make sure handler exits when handler context is canceled.
+			name:               "cancel handler context",
+			cmd:                "docker",
+			dockerRunArgs:      []string{"mcp/everything"},
+			checkHandlerError:  require.NoError,
+			cancelHandlerCtx:   true,
+			waitForHandlerExit: time.Second * 5,
+			afterHandlerStart:  connectAfterHandlerStart,
+			afterHandlerStop:   containerShouldBeRemoved,
+		},
+		{
+			// Randomly cancel the context to simulate a case where client
+			// disconnects while cmd is being set up, which may cause a race
+			// condition that leaves docker container behind:
+			// https://github.com/gravitational/teleport/issues/59768
+			//
+			// To restore the bug, use `sync.OnceValue` when creating the func for `cmd.Cancel`:
+			//   cmd.Cancel = sync.OnceValue(func() error {
+			//
+			// Run this test with -count=100 for better coverage.
+			name:          "random cancel handler context",
+			cmd:           "docker",
+			dockerRunArgs: []string{"mcp/everything"},
+			checkHandlerError: func(require.TestingT, error, ...interface{}) {
+				// Depends on the timing, this can return error or nil. So just ignore.
+			},
+			cancelHandlerCtx:   true,
+			waitForHandlerExit: time.Second * 15,
+			afterHandlerStart: func(t *testing.T, testCtx *testContext, containerName string) {
+				time.Sleep(time.Duration(rand.Uint32N(10000)) * time.Microsecond)
+			},
+			// Make sure the container is removed no matter the timing.
+			afterHandlerStop: containerShouldBeRemoved,
+		},
+		{
+			// Make sure handler is not blocked when command fails to start.
+			name:               "fail to start",
+			cmd:                "fail-to-start",
+			checkHandlerError:  require.Error,
+			waitForHandlerExit: time.Second * 5,
+			afterHandlerStop: func(t *testing.T, _ *testContext, _ string) {
+				require.Positive(t, testutil.ToFloat64(setupErrors.WithLabelValues(types.MCPTransportStdio)))
+			},
+		},
+		{
+			// Make sure handler is not blocked when command starts then fails
+			// right away.
+			name:               "error exit",
+			cmd:                "docker",
+			dockerRunArgs:      []string{"--some-unknown-flag"},
+			checkHandlerError:  require.Error,
+			waitForHandlerExit: time.Second * 5,
+			afterHandlerStop:   containerShouldBeRemoved,
+		},
+		{
+			// Make sure SIGKILL is sent when the MCP server traps SIGINT. This
+			// test will last more than 10 seconds to trigger the WaitDelay.
+			//
+			// Unfortunately, SIGKILL won't remove the docker container. So
+			// do not check containerShouldBeRemoved and just let the test do
+			// the cleanup. In the future, Teleport should either implement
+			// proper docker runtime (like how this test is using docker API) or
+			// introduce a proper shut down sequence (like systemctl stop).
+			name: "wait for SIGKILL",
+			cmd:  "docker",
+			dockerRunArgs: []string{
+				"alpine", "sh", "-c",
+				`trap "" INT; while :; do sleep 1; done`,
+			},
+			checkHandlerError: require.Error,
+			afterHandlerStart: func(t *testing.T, testCtx *testContext, containerName string) {
+				ctx := t.Context()
+				t.Log("waiting for docker container to spawn before killing client connection")
+				require.EventuallyWithT(t, func(t *assert.CollectT) {
+					require.NotEmpty(t, findDockerContainerID(ctx, dockerClient, containerName))
+				}, time.Second*5, time.Millisecond*100)
+				testCtx.clientSourceConn.Close()
+				t.Log("waiting 10 seconds for SIGKILL")
+			},
+			waitForHandlerExit: time.Second * 20,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			containerName := "teleport-test-mcp-" + path.Base(t.Name())
+			t.Cleanup(func() {
+				forceRemoveContainer(t, dockerClient, containerName)
+			})
+
+			args := tt.dockerRunArgs
+			if tt.cmd == "docker" {
+				args = append([]string{"run", "--name", containerName, "-i", "--rm"}, tt.dockerRunArgs...)
+			}
+
+			app, err := types.NewAppV3(types.Metadata{
+				Name: t.Name(),
+			}, types.AppSpecV3{
+				MCP: &types.MCP{
+					Command:       tt.cmd,
+					Args:          args,
+					RunAsHostUser: runAsHostUser,
+				},
+			})
+			require.NoError(t, err)
+
+			testCtx := setupTestContext(t, withAdminRole(t), withApp(app))
+			handlerCtx, handlerCtxCancel := context.WithCancel(t.Context())
+			defer handlerCtxCancel()
+			handlerErrChan := make(chan error, 1)
+			go func() {
+				handlerErrChan <- s.HandleSession(handlerCtx, testCtx.SessionCtx)
+			}()
+
+			if tt.afterHandlerStart != nil {
+				tt.afterHandlerStart(t, &testCtx, containerName)
+			}
+			if tt.cancelHandlerCtx {
+				handlerCtxCancel()
+			}
+
+			select {
+			case <-time.After(tt.waitForHandlerExit):
+				require.Fail(t, "timed out waiting for handler")
+			case handlerErr := <-handlerErrChan:
+				tt.checkHandlerError(t, handlerErr)
+			}
+
+			if tt.afterHandlerStop != nil {
+				tt.afterHandlerStop(t, &testCtx, containerName)
+			}
+		})
+	}
+}
diff --git a/lib/srv/mock.go b/lib/srv/mock.go
deleted file mode 100644
index 4c43600779512..0000000000000
--- a/lib/srv/mock.go
+++ /dev/null
@@ -1,434 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package srv
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"net"
-	"os"
-	"os/user"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport"
-	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
-	"github.com/gravitational/teleport/api/types"
-	apievents "github.com/gravitational/teleport/api/types/events"
-	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/backend/lite"
-	"github.com/gravitational/teleport/lib/bpf"
-	"github.com/gravitational/teleport/lib/events/eventstest"
-	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/services"
-	rsession "github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/sshca"
-	"github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/clocki"
-)
-
-func newTestServerContext(t *testing.T, srv Server, sessionJoiningRoleSet services.RoleSet, accessPermit *decisionpb.SSHAccessPermit) *ServerContext {
-	usr, err := user.Current()
-	require.NoError(t, err)
-
-	cert, err := apisshutils.ParseCertificate([]byte(fixtures.UserCertificateStandard))
-	require.NoError(t, err)
-
-	ident, err := sshca.DecodeIdentity(cert)
-	require.NoError(t, err)
-
-	sshConn := &mockSSHConn{}
-	sshConn.localAddr, _ = utils.ParseAddr("127.0.0.1:3022")
-	sshConn.remoteAddr, _ = utils.ParseAddr("10.0.0.5:4817")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	recConfig := types.DefaultSessionRecordingConfig()
-	recConfig.SetMode(types.RecordOff)
-	clusterName := "localhost"
-	_, connCtx := sshutils.NewConnectionContext(ctx, nil, &ssh.ServerConn{Conn: sshConn})
-	scx := &ServerContext{
-		Logger:                 utils.NewSlogLoggerForTests(),
-		ConnectionContext:      connCtx,
-		env:                    make(map[string]string),
-		SessionRecordingConfig: recConfig,
-		IsTestStub:             true,
-		ClusterName:            clusterName,
-		srv:                    srv,
-		sessionID:              rsession.NewID(),
-		Identity: IdentityContext{
-			UnmappedIdentity: ident,
-			Login:            usr.Username,
-			TeleportUser:     "teleportUser",
-			AccessPermit:     accessPermit,
-			// roles do not actually exist in mock backend, just need a non-nil
-			// session joining access checker to avoid panic
-			UnstableSessionJoiningAccessChecker: services.NewAccessCheckerWithRoleSet(
-				&services.AccessInfo{Roles: sessionJoiningRoleSet.RoleNames()}, clusterName, sessionJoiningRoleSet),
-		},
-		cancelContext: ctx,
-		cancel:        cancel,
-	}
-
-	err = scx.SetExecRequest(&localExec{Ctx: scx})
-	require.NoError(t, err)
-
-	scx.cmdr, scx.cmdw, err = os.Pipe()
-	require.NoError(t, err)
-
-	scx.contr, scx.contw, err = os.Pipe()
-	require.NoError(t, err)
-
-	scx.readyr, scx.readyw, err = os.Pipe()
-	require.NoError(t, err)
-
-	scx.killShellr, scx.killShellw, err = os.Pipe()
-	require.NoError(t, err)
-	scx.AddCloser(scx.killShellw)
-
-	// TODO (joerger): check the error coming from Close once the logic around
-	// closing open files has been fixed to fail with "close |1: file already closed".
-	// Note that outside of tests, we never check the error form scx.Close because this
-	// error is a part of normal execution currently.
-	t.Cleanup(func() { scx.Close() })
-
-	return scx
-}
-
-func newMockServer(t *testing.T) *mockServer {
-	ctx := context.Background()
-	clock := clockwork.NewFakeClock()
-
-	bk, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
-		Clock: clock,
-	})
-	require.NoError(t, err)
-
-	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
-		ClusterName: "localhost",
-	})
-	require.NoError(t, err)
-
-	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
-		StaticTokens: []types.ProvisionTokenV1{},
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, bk.Close())
-	})
-
-	authCfg := &auth.InitConfig{
-		Backend:        bk,
-		VersionStorage: auth.NewFakeTeleportVersion(),
-		Authority:      testauthority.New(),
-		ClusterName:    clusterName,
-		StaticTokens:   staticTokens,
-	}
-
-	authServer, err := auth.NewServer(authCfg, auth.WithClock(clock))
-	require.NoError(t, err)
-
-	return &mockServer{
-		auth:                authServer,
-		datadir:             t.TempDir(),
-		MockRecorderEmitter: &eventstest.MockRecorderEmitter{},
-		clock:               clock,
-	}
-}
-
-type mockServer struct {
-	*eventstest.MockRecorderEmitter
-	datadir   string
-	auth      *auth.Server
-	component string
-	clock     clocki.FakeClock
-	bpf       bpf.BPF
-}
-
-// ID is the unique ID of the server.
-func (m *mockServer) ID() string {
-	return "testID"
-}
-
-// HostUUID is the UUID of the underlying host. For the forwarding
-// server this is the proxy the forwarding server is running in.
-func (m *mockServer) HostUUID() string {
-	return "testHostUUID"
-}
-
-// GetNamespace returns the namespace the server was created in.
-func (m *mockServer) GetNamespace() string {
-	return "testNamespace"
-}
-
-// AdvertiseAddr is the publicly addressable address of this server.
-func (m *mockServer) AdvertiseAddr() string {
-	return "testAdvertiseAddr"
-}
-
-// Component is the type of server, forwarding or regular.
-func (m *mockServer) Component() string {
-	return m.component
-}
-
-// PermitUserEnvironment returns if reading environment variables upon
-// startup is allowed.
-func (m *mockServer) PermitUserEnvironment() bool {
-	return false
-}
-
-// GetAccessPoint returns an AccessPoint for this cluster.
-func (m *mockServer) GetAccessPoint() AccessPoint {
-	return m.auth
-}
-
-// GetDataDir returns data directory of the server
-func (m *mockServer) GetDataDir() string {
-	return m.datadir
-}
-
-// GetPAM returns PAM configuration for this server.
-func (m *mockServer) GetPAM() (*servicecfg.PAMConfig, error) {
-	return &servicecfg.PAMConfig{}, nil
-}
-
-// GetClock returns a clock setup for the server
-func (m *mockServer) GetClock() clockwork.Clock {
-	if m.clock != nil {
-		return m.clock
-	}
-	return clockwork.NewRealClock()
-}
-
-// GetInfo returns a services.Server that represents this server.
-func (m *mockServer) GetInfo() types.Server {
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "localhost"
-	}
-
-	return &types.ServerV2{
-		Kind:    types.KindNode,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name:      "",
-			Namespace: "",
-			Labels:    make(map[string]string),
-		},
-		Spec: types.ServerSpecV2{
-			CmdLabels: make(map[string]types.CommandLabelV2),
-			Addr:      "",
-			Hostname:  hostname,
-			UseTunnel: false,
-			Version:   teleport.Version,
-		},
-	}
-}
-
-func (m *mockServer) TargetMetadata() apievents.ServerMetadata {
-	return apievents.ServerMetadata{
-		ServerID:        "123",
-		ForwardedBy:     "abc",
-		ServerHostname:  "testHost",
-		ServerNamespace: "testNamespace",
-	}
-}
-
-// UseTunnel used to determine if this node has connected to this cluster
-// using reverse tunnel.
-func (m *mockServer) UseTunnel() bool {
-	return false
-}
-
-// GetBPF returns the BPF service used for enhanced session recording.
-func (m *mockServer) GetBPF() bpf.BPF {
-	if m.bpf != nil {
-		return m.bpf
-	}
-
-	return &bpf.NOP{}
-}
-
-// Context returns server shutdown context
-func (m *mockServer) Context() context.Context {
-	return context.Background()
-}
-
-// GetUserAccountingPaths returns the path of the user accounting database and log. Returns empty for system defaults.
-func (m *mockServer) GetUserAccountingPaths() (utmp, wtmp, btmp string) {
-	return "test", "test", "test"
-}
-
-// GetLockWatcher gets the server's lock watcher.
-func (m *mockServer) GetLockWatcher() *services.LockWatcher {
-	return nil
-}
-
-// GetCreateHostUser gets whether the server allows host user creation
-// or not
-func (m *mockServer) GetCreateHostUser() bool {
-	return false
-}
-
-// GetHostUsers
-func (m *mockServer) GetHostUsers() HostUsers {
-	return nil
-}
-
-// GetHostSudoers
-func (m *mockServer) GetHostSudoers() HostSudoers {
-	return &HostSudoersNotImplemented{}
-}
-
-// GetSELinuxEnabled
-func (m *mockServer) GetSELinuxEnabled() bool {
-	return false
-}
-
-// Implementation of ssh.Conn interface.
-type mockSSHConn struct {
-	remoteAddr net.Addr
-	localAddr  net.Addr
-}
-
-func (c *mockSSHConn) User() string {
-	return ""
-}
-
-func (c *mockSSHConn) SessionID() []byte {
-	return []byte{1, 2, 3}
-}
-
-func (c *mockSSHConn) ClientVersion() []byte {
-	return []byte{1}
-}
-
-func (c *mockSSHConn) ServerVersion() []byte {
-	return []byte{1}
-}
-
-func (c *mockSSHConn) RemoteAddr() net.Addr {
-	return c.remoteAddr
-}
-
-func (c *mockSSHConn) LocalAddr() net.Addr {
-	return c.localAddr
-}
-
-func (c *mockSSHConn) Close() error {
-	return nil
-}
-
-func (c *mockSSHConn) SendRequest(string, bool, []byte) (bool, []byte, error) {
-	return false, nil, nil
-}
-
-func (c *mockSSHConn) OpenChannel(string, []byte) (ssh.Channel, <-chan *ssh.Request, error) {
-	return nil, nil, nil
-}
-
-func (c *mockSSHConn) Wait() error {
-	return nil
-}
-
-type mockSSHChannel struct {
-	stdIn  io.ReadCloser
-	stdOut io.WriteCloser
-	stdErr io.ReadWriter
-}
-
-func newMockSSHChannel() ssh.Channel {
-	stdIn, stdOut := io.Pipe()
-	return &mockSSHChannel{
-		stdIn:  stdIn,
-		stdOut: stdOut,
-		stdErr: new(bytes.Buffer),
-	}
-}
-
-// Read reads up to len(data) bytes from the channel.
-func (c *mockSSHChannel) Read(data []byte) (int, error) {
-	return c.stdIn.Read(data)
-}
-
-// Write writes len(data) bytes to the channel.
-func (c *mockSSHChannel) Write(data []byte) (int, error) {
-	return c.stdOut.Write(data)
-}
-
-// Close signals end of channel use. No data may be sent after this
-// call.
-func (c *mockSSHChannel) Close() error {
-	return trace.NewAggregate(c.stdIn.Close(), c.stdOut.Close())
-}
-
-// CloseWrite signals the end of sending in-band
-// data. Requests may still be sent, and the other side may
-// still send data
-func (c *mockSSHChannel) CloseWrite() error {
-	return trace.NewAggregate(c.stdOut.Close())
-}
-
-// SendRequest sends a channel request.  If wantReply is true,
-// it will wait for a reply and return the result as a
-// boolean, otherwise the return value will be false. Channel
-// requests are out-of-band messages so they may be sent even
-// if the data stream is closed or blocked by flow control.
-// If the channel is closed before a reply is returned, io.EOF
-// is returned.
-func (c *mockSSHChannel) SendRequest(name string, wantReply bool, payload []byte) (bool, error) {
-	return true, nil
-}
-
-// Stderr returns an io.ReadWriter that writes to this channel
-// with the extended data type set to stderr. Stderr may
-// safely be read and written from a different goroutine than
-// Read and Write respectively.
-func (c *mockSSHChannel) Stderr() io.ReadWriter {
-	return c.stdErr
-}
-
-type fakeBPF struct {
-	bpf bpf.NOP
-}
-
-func (f fakeBPF) OpenSession(ctx *bpf.SessionContext) (uint64, error) {
-	return f.bpf.OpenSession(ctx)
-}
-
-func (f fakeBPF) CloseSession(ctx *bpf.SessionContext) error {
-	return f.bpf.CloseSession(ctx)
-}
-
-func (f fakeBPF) Close(restarting bool) error {
-	return f.bpf.Close(restarting)
-}
-
-func (f fakeBPF) Enabled() bool {
-	return true
-}
diff --git a/lib/srv/mock_test.go b/lib/srv/mock_test.go
new file mode 100644
index 0000000000000..e8160233b8fb4
--- /dev/null
+++ b/lib/srv/mock_test.go
@@ -0,0 +1,468 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package srv
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"os/user"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport"
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/bpf"
+	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	rsession "github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/sshca"
+	"github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/clocki"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func newTestServerContext(t *testing.T, srv Server, sessionJoiningRoleSet services.RoleSet, accessPermit *decisionpb.SSHAccessPermit) *ServerContext {
+	usr, err := user.Current()
+	require.NoError(t, err)
+
+	cert, err := apisshutils.ParseCertificate([]byte(fixtures.UserCertificateStandard))
+	require.NoError(t, err)
+
+	ident, err := sshca.DecodeIdentity(cert)
+	require.NoError(t, err)
+
+	sshConn := &mockSSHConn{}
+	sshConn.localAddr, _ = utils.ParseAddr("127.0.0.1:3022")
+	sshConn.remoteAddr, _ = utils.ParseAddr("10.0.0.5:4817")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	recConfig := types.DefaultSessionRecordingConfig()
+	recConfig.SetMode(types.RecordOff)
+	clusterName := "localhost"
+	_, connCtx := sshutils.NewConnectionContext(ctx, nil, &ssh.ServerConn{Conn: sshConn})
+	scx := &ServerContext{
+		newSessionID:           rsession.NewID(),
+		Logger:                 logtest.NewLogger(),
+		ConnectionContext:      connCtx,
+		env:                    make(map[string]string),
+		SessionRecordingConfig: recConfig,
+		IsTestStub:             true,
+		ClusterName:            clusterName,
+		srv:                    srv,
+		Identity: IdentityContext{
+			UnmappedIdentity: ident,
+			Login:            usr.Username,
+			TeleportUser:     "teleportUser",
+			AccessPermit:     accessPermit,
+			// roles do not actually exist in mock backend, just need a non-nil
+			// session joining access checker to avoid panic
+			UnstableSessionJoiningAccessChecker: services.NewAccessCheckerWithRoleSet(
+				&services.AccessInfo{Roles: sessionJoiningRoleSet.RoleNames()}, clusterName, sessionJoiningRoleSet),
+		},
+		cancelContext: ctx,
+		cancel:        cancel,
+		// If proxy forwarding is being used (proxy recording, agentless), then remote session must be set.
+		// Otherwise, this field is ignored.
+		RemoteSession: mockSSHSession(t),
+	}
+
+	err = scx.SetExecRequest(&localExec{Ctx: scx})
+	require.NoError(t, err)
+
+	scx.cmdr, scx.cmdw, err = os.Pipe()
+	require.NoError(t, err)
+
+	_, scx.logw, err = os.Pipe()
+	require.NoError(t, err)
+
+	scx.contr, scx.contw, err = os.Pipe()
+	require.NoError(t, err)
+
+	scx.readyr, scx.readyw, err = os.Pipe()
+	require.NoError(t, err)
+
+	scx.killShellr, scx.killShellw, err = os.Pipe()
+	require.NoError(t, err)
+	scx.AddCloser(scx.killShellw)
+
+	// TODO (joerger): check the error coming from Close once the logic around
+	// closing open files has been fixed to fail with "close |1: file already closed".
+	// Note that outside of tests, we never check the error form scx.Close because this
+	// error is a part of normal execution currently.
+	t.Cleanup(func() { scx.Close() })
+
+	return scx
+}
+
+func newMockServer(t *testing.T) *mockServer {
+	clock := clockwork.NewFakeClock()
+
+	bk, err := memory.New(memory.Config{
+		Clock: clock,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = bk.Close()
+	})
+
+	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
+		ClusterName: "localhost",
+	})
+	require.NoError(t, err)
+
+	staticTokens, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+		StaticTokens: []types.ProvisionTokenV1{},
+	})
+	require.NoError(t, err)
+
+	authCfg := &auth.InitConfig{
+		Backend:        bk,
+		VersionStorage: authtest.NewFakeTeleportVersion(),
+		Authority:      testauthority.New(),
+		ClusterName:    clusterName,
+		StaticTokens:   staticTokens,
+		HostUUID:       uuid.NewString(),
+	}
+
+	authServer, err := auth.NewServer(authCfg, authtest.WithClock(clock))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authServer.Close())
+	})
+
+	return &mockServer{
+		auth:                authServer,
+		datadir:             t.TempDir(),
+		MockRecorderEmitter: &eventstest.MockRecorderEmitter{},
+		clock:               clock,
+		component:           teleport.ComponentNode,
+	}
+}
+
+type mockServer struct {
+	*eventstest.MockRecorderEmitter
+	info      types.Server
+	datadir   string
+	auth      *auth.Server
+	component string
+	clock     clocki.FakeClock
+	bpf       bpf.BPF
+}
+
+// ID is the unique ID of the server.
+func (m *mockServer) ID() string {
+	return "testID"
+}
+
+// HostUUID is the UUID of the underlying host. For the forwarding
+// server this is the proxy the forwarding server is running in.
+func (m *mockServer) HostUUID() string {
+	return "testHostUUID"
+}
+
+// GetNamespace returns the namespace the server was created in.
+func (m *mockServer) GetNamespace() string {
+	return "testNamespace"
+}
+
+// AdvertiseAddr is the publicly addressable address of this server.
+func (m *mockServer) AdvertiseAddr() string {
+	return "testAdvertiseAddr"
+}
+
+// Component is the type of server, forwarding or regular.
+func (m *mockServer) Component() string {
+	return m.component
+}
+
+// PermitUserEnvironment returns if reading environment variables upon
+// startup is allowed.
+func (m *mockServer) PermitUserEnvironment() bool {
+	return false
+}
+
+// GetAccessPoint returns an AccessPoint for this cluster.
+func (m *mockServer) GetAccessPoint() AccessPoint {
+	return m.auth
+}
+
+// GetDataDir returns data directory of the server
+func (m *mockServer) GetDataDir() string {
+	return m.datadir
+}
+
+// GetPAM returns PAM configuration for this server.
+func (m *mockServer) GetPAM() *servicecfg.PAMConfig {
+	return &servicecfg.PAMConfig{Enabled: false}
+}
+
+// GetClock returns a clock setup for the server
+func (m *mockServer) GetClock() clockwork.Clock {
+	if m.clock != nil {
+		return m.clock
+	}
+	return clockwork.NewRealClock()
+}
+
+// setInfo overrides the default result of [mockServer.GetInfo]. Necessary in order to
+// correctly test the behavior of local node rbac that expects specific server attributes.
+func (m *mockServer) setInfo(server types.Server) {
+	m.info = server
+}
+
+// GetInfo returns a services.Server that represents this server.
+func (m *mockServer) GetInfo() types.Server {
+	if m.info != nil {
+		return m.info
+	}
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = "localhost"
+	}
+
+	return &types.ServerV2{
+		Kind:    types.KindNode,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:      "",
+			Namespace: "",
+			Labels:    make(map[string]string),
+		},
+		Spec: types.ServerSpecV2{
+			CmdLabels: make(map[string]types.CommandLabelV2),
+			Addr:      "",
+			Hostname:  hostname,
+			UseTunnel: false,
+			Version:   teleport.Version,
+		},
+	}
+}
+
+func (m *mockServer) EventMetadata() apievents.ServerMetadata {
+	return apievents.ServerMetadata{
+		ServerID:        "123",
+		ForwardedBy:     "abc",
+		ServerHostname:  "testHost",
+		ServerNamespace: "testNamespace",
+	}
+}
+
+// UseTunnel used to determine if this node has connected to this cluster
+// using reverse tunnel.
+func (m *mockServer) UseTunnel() bool {
+	return false
+}
+
+// GetBPF returns the BPF service used for enhanced session recording.
+func (m *mockServer) GetBPF() bpf.BPF {
+	if m.bpf != nil {
+		return m.bpf
+	}
+
+	return &bpf.NOP{}
+}
+
+// Context returns server shutdown context
+func (m *mockServer) Context() context.Context {
+	return context.Background()
+}
+
+// GetUserAccountingPaths returns the path of the user accounting database and log. Returns empty for system defaults.
+func (m *mockServer) GetUserAccountingPaths() (utmp, wtmp, btmp, wtmpdb string) {
+	return "test", "test", "test", "test"
+}
+
+// GetLockWatcher gets the server's lock watcher.
+func (m *mockServer) GetLockWatcher() *services.LockWatcher {
+	return nil
+}
+
+// GetCreateHostUser gets whether the server allows host user creation
+// or not
+func (m *mockServer) GetCreateHostUser() bool {
+	return false
+}
+
+// GetHostUsers
+func (m *mockServer) GetHostUsers() HostUsers {
+	return nil
+}
+
+// GetHostSudoers
+func (m *mockServer) GetHostSudoers() HostSudoers {
+	return &HostSudoersNotImplemented{}
+}
+
+// GetSELinuxEnabled
+func (m *mockServer) GetSELinuxEnabled() bool {
+	return false
+}
+
+// ChildLogConfig returns a noop log configuration.
+func (m *mockServer) ChildLogConfig() ChildLogConfig {
+	return ChildLogConfig{
+		ExecLogConfig: ExecLogConfig{
+			Level: &slog.LevelVar{},
+		},
+		Writer: io.Discard,
+	}
+}
+
+// Implementation of ssh.Conn interface.
+type mockSSHConn struct {
+	remoteAddr net.Addr
+	localAddr  net.Addr
+}
+
+func (c *mockSSHConn) User() string {
+	return ""
+}
+
+func (c *mockSSHConn) SessionID() []byte {
+	return []byte{1, 2, 3}
+}
+
+func (c *mockSSHConn) ClientVersion() []byte {
+	return []byte{1}
+}
+
+func (c *mockSSHConn) ServerVersion() []byte {
+	return []byte{1}
+}
+
+func (c *mockSSHConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+func (c *mockSSHConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *mockSSHConn) Close() error {
+	return nil
+}
+
+func (c *mockSSHConn) SendRequest(string, bool, []byte) (bool, []byte, error) {
+	return false, nil, nil
+}
+
+func (c *mockSSHConn) OpenChannel(string, []byte) (ssh.Channel, <-chan *ssh.Request, error) {
+	return nil, nil, nil
+}
+
+func (c *mockSSHConn) Wait() error {
+	return nil
+}
+
+type mockSSHChannel struct {
+	stdIn  io.ReadCloser
+	stdOut io.WriteCloser
+	stdErr io.ReadWriter
+}
+
+func newMockSSHChannel() ssh.Channel {
+	stdIn, stdOut := io.Pipe()
+	return &mockSSHChannel{
+		stdIn:  stdIn,
+		stdOut: stdOut,
+		stdErr: new(bytes.Buffer),
+	}
+}
+
+// Read reads up to len(data) bytes from the channel.
+func (c *mockSSHChannel) Read(data []byte) (int, error) {
+	return c.stdIn.Read(data)
+}
+
+// Write writes len(data) bytes to the channel.
+func (c *mockSSHChannel) Write(data []byte) (int, error) {
+	return c.stdOut.Write(data)
+}
+
+// Close signals end of channel use. No data may be sent after this
+// call.
+func (c *mockSSHChannel) Close() error {
+	return trace.NewAggregate(c.stdIn.Close(), c.stdOut.Close())
+}
+
+// CloseWrite signals the end of sending in-band
+// data. Requests may still be sent, and the other side may
+// still send data
+func (c *mockSSHChannel) CloseWrite() error {
+	return trace.NewAggregate(c.stdOut.Close())
+}
+
+// SendRequest sends a channel request.  If wantReply is true,
+// it will wait for a reply and return the result as a
+// boolean, otherwise the return value will be false. Channel
+// requests are out-of-band messages so they may be sent even
+// if the data stream is closed or blocked by flow control.
+// If the channel is closed before a reply is returned, io.EOF
+// is returned.
+func (c *mockSSHChannel) SendRequest(name string, wantReply bool, payload []byte) (bool, error) {
+	return true, nil
+}
+
+// Stderr returns an io.ReadWriter that writes to this channel
+// with the extended data type set to stderr. Stderr may
+// safely be read and written from a different goroutine than
+// Read and Write respectively.
+func (c *mockSSHChannel) Stderr() io.ReadWriter {
+	return c.stdErr
+}
+
+type fakeBPF struct {
+	bpf bpf.NOP
+}
+
+func (f fakeBPF) OpenSession(ctx *bpf.SessionContext) (uint64, error) {
+	return f.bpf.OpenSession(ctx)
+}
+
+func (f fakeBPF) CloseSession(ctx *bpf.SessionContext) error {
+	return f.bpf.CloseSession(ctx)
+}
+
+func (f fakeBPF) Close(restarting bool) error {
+	return f.bpf.Close(restarting)
+}
+
+func (f fakeBPF) Enabled() bool {
+	return true
+}
diff --git a/lib/srv/monitor.go b/lib/srv/monitor.go
index 58a8cae6d5bb1..3c3303b6de9e5 100644
--- a/lib/srv/monitor.go
+++ b/lib/srv/monitor.go
@@ -60,11 +60,16 @@ type TrackingConn interface {
 	Close() error
 }
 
+type ConnectionMonitorAccessPoint interface {
+	GetAuthPreference(ctx context.Context) (types.AuthPreference, error)
+	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
+}
+
 // ConnectionMonitorConfig contains dependencies required by
 // the ConnectionMonitor.
 type ConnectionMonitorConfig struct {
 	// AccessPoint is used to retrieve cluster configuration.
-	AccessPoint AccessPoint
+	AccessPoint ConnectionMonitorAccessPoint
 	// LockWatcher ensures lock information is up to date.
 	LockWatcher *services.LockWatcher
 	// Clock is a clock, realtime or fixed in tests.
@@ -189,6 +194,7 @@ func (c *ConnectionMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Con
 		Clock:                 c.cfg.Clock,
 		ServerID:              c.cfg.ServerID,
 		TeleportUser:          identity.Username,
+		UserOriginClusterName: identity.OriginClusterName,
 		Emitter:               c.cfg.Emitter,
 		EmitterContext:        c.cfg.EmitterContext,
 		Logger:                c.cfg.Logger,
@@ -228,6 +234,8 @@ type MonitorConfig struct {
 	Login string
 	// TeleportUser is a teleport user name
 	TeleportUser string
+	// UserOriginClusterName is the Teleport Cluster name the user belongs to.
+	UserOriginClusterName string
 	// ServerID is a session server ID
 	ServerID string
 	// Emitter is events emitter
@@ -288,15 +296,19 @@ func StartMonitor(cfg MonitorConfig) error {
 	w := &Monitor{
 		MonitorConfig: cfg,
 	}
-	// If an applicable lock is already in force, close the connection immediately.
-	if lockErr := w.LockWatcher.CheckLockInForce(w.LockingMode, w.LockTargets...); lockErr != nil {
-		w.handleLockInForce(lockErr)
-		return nil
-	}
+	// If an applicable lock is already in force, close the connection immediately. The subscription is
+	// created first to prevent any races with CheckLockInForce and new locks being created.
 	lockWatch, err := w.LockWatcher.Subscribe(w.Context, w.LockTargets...)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+
+	if lockErr := w.LockWatcher.CheckLockInForce(w.LockingMode, w.LockTargets...); lockErr != nil {
+		w.handleLockInForce(lockErr)
+		_ = lockWatch.Close()
+		return nil
+	}
+
 	go func() {
 		w.start(lockWatch)
 		if w.MonitorCloseChannel != nil {
@@ -461,8 +473,9 @@ func (w *Monitor) emitDisconnectEvent(reason string) error {
 			Code: events.ClientDisconnectCode,
 		},
 		UserMetadata: apievents.UserMetadata{
-			Login: w.Login,
-			User:  w.TeleportUser,
+			Login:           w.Login,
+			User:            w.TeleportUser,
+			UserClusterName: w.UserOriginClusterName,
 		},
 		ConnectionMetadata: apievents.ConnectionMetadata{
 			LocalAddr:  w.Conn.LocalAddr().String(),
diff --git a/lib/srv/monitor_test.go b/lib/srv/monitor_test.go
index b0aa71c7f49fd..fb32e1a5b686e 100644
--- a/lib/srv/monitor_test.go
+++ b/lib/srv/monitor_test.go
@@ -33,15 +33,15 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
-func newTestMonitor(ctx context.Context, t *testing.T, asrv *auth.TestAuthServer, mut ...func(*MonitorConfig)) (*mockTrackingConn, *eventstest.ChannelEmitter, MonitorConfig) {
+func newTestMonitor(ctx context.Context, t *testing.T, asrv *authtest.AuthServer, mut ...func(*MonitorConfig)) (*mockTrackingConn, *eventstest.ChannelEmitter, MonitorConfig) {
 	ctx, cancel := context.WithCancel(ctx)
 	t.Cleanup(cancel)
 
@@ -54,7 +54,7 @@ func newTestMonitor(ctx context.Context, t *testing.T, asrv *auth.TestAuthServer
 		EmitterContext: ctx,
 		Clock:          asrv.Clock(),
 		Tracker:        &mockActivityTracker{asrv.Clock()},
-		Logger:         utils.NewSlogLoggerForTests(),
+		Logger:         logtest.NewLogger(),
 		LockWatcher:    asrv.LockWatcher,
 		LockTargets:    []types.LockTarget{{User: "test-user"}},
 		LockingMode:    constants.LockingModeBestEffort,
@@ -72,7 +72,7 @@ func TestConnectionMonitorLockInForce(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	asrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	asrv, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
@@ -87,7 +87,7 @@ func TestConnectionMonitorLockInForce(t *testing.T) {
 		Emitter:        emitter,
 		EmitterContext: ctx,
 		Clock:          asrv.Clock(),
-		Logger:         utils.NewSlogLoggerForTests(),
+		Logger:         logtest.NewLogger(),
 		LockWatcher:    asrv.LockWatcher,
 		ServerID:       "test",
 	})
@@ -164,7 +164,7 @@ func TestMonitorLockInForce(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	asrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	asrv, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
@@ -212,7 +212,7 @@ func TestMonitorStaleLocks(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	asrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	asrv, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
@@ -262,7 +262,7 @@ func TestMonitorStaleLocks(t *testing.T) {
 }
 
 func TestWritesDisconnectMessage(t *testing.T) {
-	asrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	asrv, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
@@ -318,7 +318,7 @@ func TestMonitorDisconnectExpiredCertBeforeTimeNow(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	asrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+	asrv, err := authtest.NewAuthServer(authtest.AuthServerConfig{
 		Dir:   t.TempDir(),
 		Clock: clockwork.NewFakeClock(),
 	})
diff --git a/lib/srv/reexec.go b/lib/srv/reexec.go
index 87bb2d3f81359..dd9a62c016eb8 100644
--- a/lib/srv/reexec.go
+++ b/lib/srv/reexec.go
@@ -19,7 +19,6 @@
 package srv
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -35,6 +34,7 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -55,6 +55,8 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/envutils"
+	"github.com/gravitational/teleport/lib/utils/host"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
 	"github.com/gravitational/teleport/lib/utils/uds"
 )
 
@@ -66,6 +68,9 @@ const (
 	// CommandFile is used to pass the command and arguments that the
 	// child process should execute from the parent process.
 	CommandFile FileFD = 3 + iota
+	// LogFile is used to emit logs from the child process to the parent
+	// process.
+	LogFile
 	// ContinueFile is used to communicate to the child process that
 	// it can continue after the parent process assigns a cgroup to the
 	// child process.
@@ -99,6 +104,9 @@ func fdName(f FileFD) string {
 // ExecCommand contains the payload to "teleport exec" which will be used to
 // construct and execute a shell.
 type ExecCommand struct {
+	// LogConfig is the log configuration for the child process.
+	LogConfig ExecLogConfig `json:"log_config"`
+
 	// Command is the command to execute. If an interactive session is being
 	// requested, will be empty. If a subsystem is requested, it will contain
 	// the subsystem name.
@@ -166,6 +174,21 @@ type ExecCommand struct {
 	SetSELinuxContext bool `json:"set_selinux_context"`
 }
 
+// ExecLogConfig represents all the logging configuration data that
+// needs to be passed to the child.
+type ExecLogConfig struct {
+	// Level is the log level to use.
+	Level *slog.LevelVar
+	// Format defines the output format. Possible values are 'text' and 'json'.
+	Format string
+	// ExtraFields lists the output fields from KnownFormatFields. Example format: [timestamp, component, caller].
+	ExtraFields []string
+	// EnableColors dictates if output should be colored when Format is set to "text".
+	EnableColors bool
+	// Padding to use for various components when Format is set to "text".
+	Padding int
+}
+
 // PAMConfig represents all the configuration data that needs to be passed to the child.
 type PAMConfig struct {
 	// UsePAMAuth specifies whether to trigger the "auth" PAM modules from the
@@ -181,11 +204,8 @@ type PAMConfig struct {
 
 // UaccMetadata contains information the child needs from the parent for user accounting.
 type UaccMetadata struct {
-	// The hostname of the node.
-	Hostname string `json:"hostname"`
-
 	// RemoteAddr is the address of the remote host.
-	RemoteAddr [4]int32 `json:"remote_addr"`
+	RemoteAddr utils.NetAddr `json:"remote_addr"`
 
 	// UtmpPath is the path of the system utmp database.
 	UtmpPath string `json:"utmp_path,omitempty"`
@@ -195,6 +215,9 @@ type UaccMetadata struct {
 
 	// BtmpPath is the path of the system btmp log.
 	BtmpPath string `json:"btmp_path,omitempty"`
+
+	// WtmpdbPath is the path of the system wtmpdb database.
+	WtmpdbPath string `json:"wtmpdb_path,omitempty"`
 }
 
 // RunCommand reads in the command to run from the parent process (over a
@@ -202,7 +225,7 @@ type UaccMetadata struct {
 // system state related to the process and/or thread for PAM and SELinux.
 // The process should exit after this function returns so the potentially
 // modified process and/or thread isn't used with a non-standard state.
-func RunCommand() (errw io.Writer, code int, err error) {
+func RunCommand() (code int, err error) {
 	ctx := context.Background()
 
 	// SIGQUIT is used by teleport to initiate graceful shutdown, waiting for
@@ -211,23 +234,32 @@ func RunCommand() (errw io.Writer, code int, err error) {
 	// ignore SIGQUIT signals.
 	signal.Ignore(syscall.SIGQUIT)
 
-	// errorWriter is used to return any error message back to the client. By
-	// default, it writes to stdout, but if a TTY is allocated, it will write
-	// to it instead.
-	errorWriter := os.Stdout
+	// If the command fails to launch, write the error to stdout for the parent process
+	// to digest. If we have a terminal, write it there for the user to see as well.
+	var tty *os.File
+	defer func() {
+		if err != nil && code == teleport.RemoteCommandFailure {
+			var w io.Writer = os.Stdout
+			if tty != nil {
+				w = io.MultiWriter(os.Stdout, tty)
+			}
+
+			fmt.Fprintf(w, "Failed to launch: %v.\r\n", err)
+		}
+	}()
 
 	// Parent sends the command payload in the third file descriptor.
 	cmdfd := os.NewFile(CommandFile, fdName(CommandFile))
 	if cmdfd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("command pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("command pipe not found")
 	}
 	contfd := os.NewFile(ContinueFile, fdName(ContinueFile))
 	if contfd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("continue pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("continue pipe not found")
 	}
 	readyfd := os.NewFile(ReadyFile, fdName(ReadyFile))
 	if readyfd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("ready pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("ready pipe not found")
 	}
 
 	// Ensure that the ready signal is sent if a failure causes execution
@@ -242,15 +274,17 @@ func RunCommand() (errw io.Writer, code int, err error) {
 
 	terminatefd := os.NewFile(TerminateFile, fdName(TerminateFile))
 	if terminatefd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("terminate pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("terminate pipe not found")
 	}
 
 	// Read in the command payload.
 	var c ExecCommand
 	if err := json.NewDecoder(cmdfd).Decode(&c); err != nil {
-		return io.Discard, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
+	initLogger("reexec", c.LogConfig)
+
 	auditdMsg := auditd.Message{
 		SystemUser:   c.Login,
 		TeleportUser: c.Username,
@@ -278,18 +312,14 @@ func RunCommand() (errw io.Writer, code int, err error) {
 		}
 	}()
 
-	var tty *os.File
-	uaccEnabled := false
-
 	// If a terminal was requested, file descriptor 7 always points to the
 	// TTY. Extract it and set the controlling TTY. Otherwise, connect
 	// std{in,out,err} directly.
 	if c.Terminal {
 		tty = os.NewFile(TTYFile, fdName(TTYFile))
 		if tty == nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("tty not found")
+			return teleport.RemoteCommandFailure, trace.BadParameter("tty not found")
 		}
-		errorWriter = tty
 	}
 
 	// If PAM is enabled, open a PAM context. This has to be done before anything
@@ -327,7 +357,7 @@ func RunCommand() (errw io.Writer, code int, err error) {
 			Stderr: stderr,
 		})
 		if err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+			return teleport.RemoteCommandFailure, trace.Wrap(err)
 		}
 		defer pamContext.Close()
 
@@ -335,67 +365,55 @@ func RunCommand() (errw io.Writer, code int, err error) {
 		pamEnvironment = pamContext.Environment()
 	}
 
-	// Set SELinux context for the child process if SELinux support is
-	// enabled so the child process will be running with the correct SELinux
-	// user, role and domain.
-	if c.SetSELinuxContext {
-		seContext, err := selinux.UserContext(c.Login)
-		if err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to get SELinux context of login user")
-		}
-
-		// SetExecLabel changes the SELinux exec context for the
-		// calling thread only, so we need to ensure that is the
-		// thread that will create the child. We don't ever unlock
-		// the thread as we're exiting after the child exits, and
-		// we want to avoid another goroutine getting denied due to
-		// running on this thread with a different (likely much more
-		// restrictive)SELinux context.
-		runtime.LockOSThread()
-		if err := ocselinux.SetExecLabel(seContext); err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set SELinux context")
-		}
-	}
-
 	// Alert the parent process that the child process has completed any setup operations,
 	// and that we are now waiting for the continue signal before proceeding. This is needed
 	// to ensure that PAM changing the cgroup doesn't bypass enhanced recording.
 	if err := readyfd.Close(); err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 	readyfd = nil
+	uaccHandler := uacc.NewUserAccountHandler(uacc.UaccConfig{
+		UtmpFile:   c.UaccMetadata.UtmpPath,
+		WtmpFile:   c.UaccMetadata.WtmpPath,
+		BtmpFile:   c.UaccMetadata.BtmpPath,
+		WtmpdbFile: c.UaccMetadata.WtmpdbPath,
+	})
 
 	localUser, err := user.Lookup(c.Login)
 	if err != nil {
-		if uaccErr := uacc.LogFailedLogin(c.UaccMetadata.BtmpPath, c.Login, c.UaccMetadata.Hostname, c.UaccMetadata.RemoteAddr); uaccErr != nil {
-			slog.DebugContext(ctx, "uacc unsupported", "error", uaccErr)
+		if uaccErr := uaccHandler.FailedLogin(c.Login, &c.UaccMetadata.RemoteAddr); uaccErr != nil {
+			slog.DebugContext(ctx, "unable to write failed login attempt to uacc", "error", uaccErr)
 		}
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	if c.Terminal {
-		err = uacc.Open(c.UaccMetadata.UtmpPath, c.UaccMetadata.WtmpPath, c.Login, c.UaccMetadata.Hostname, c.UaccMetadata.RemoteAddr, tty)
-		// uacc support is best-effort, only enable it if Open is successful.
-		// Currently, there is no way to log this error out-of-band with the
-		// command output, so for now we essentially ignore it.
+		uaccSession, err := uaccHandler.OpenSession(tty, c.Login, &c.UaccMetadata.RemoteAddr)
 		if err == nil {
-			uaccEnabled = true
+			defer func() {
+				if closeErr := uaccSession.Close(); closeErr != nil {
+					slog.DebugContext(ctx, "failed to close uacc session", "error", closeErr)
+				}
+			}()
 		} else {
-			slog.DebugContext(ctx, "uacc unsupported", "error", err)
+			// uacc support is best-effort, only enable it if OpenSession is successful.
+			// Currently, there is no way to log this error out-of-band with the
+			// command output, so for now we essentially ignore it.
+			slog.DebugContext(ctx, "failed to open uacc session", "error", err)
 		}
 	}
 
 	// Build the actual command that will launch the shell.
 	cmd, err := buildCommand(&c, localUser, tty, pamEnvironment)
 	if err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	// Wait until the continue signal is received from Teleport signaling that
 	// the child process has been placed in a cgroup.
-	err = waitForSignal(contfd, 10*time.Second)
+	err = waitForSignal(ctx, contfd, 10*time.Second)
 	if err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	// If we're planning on changing credentials, we should first park an
@@ -412,7 +430,7 @@ func RunCommand() (errw io.Writer, code int, err error) {
 			cmd.SysProcAttr.Credential,
 			c.Login, &systemUser{u: localUser})
 		if err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+			return teleport.RemoteCommandFailure, trace.Wrap(err)
 		}
 	}
 
@@ -420,23 +438,38 @@ func RunCommand() (errw io.Writer, code int, err error) {
 		slog.WarnContext(ctx, "failed to adjust OOM score", "error", err)
 	}
 
+	// Set SELinux context for the child process if SELinux support is
+	// enabled so the child process will be running with the correct SELinux
+	// user, role and domain.
+	if c.SetSELinuxContext {
+		seContext, err := selinux.UserContext(c.Login)
+		if err != nil {
+			return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to get SELinux context of login user")
+		}
+
+		// SetExecLabel changes the SELinux exec context for the
+		// calling thread only, so we need to ensure that is the
+		// thread that will create the child. We don't ever unlock
+		// the thread as we're exiting after the child exits, and
+		// we want to avoid another goroutine getting denied due to
+		// running on this thread with a different (likely much more
+		// restrictive)SELinux context.
+		runtime.LockOSThread()
+		if err := ocselinux.SetExecLabel(seContext); err != nil {
+			return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set SELinux context")
+		}
+	}
+
 	// Start the command.
 	if err := cmd.Start(); err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	parkerCancel()
 
 	err = waitForShell(terminatefd, cmd)
 
-	if uaccEnabled {
-		uaccErr := uacc.Close(c.UaccMetadata.UtmpPath, c.UaccMetadata.WtmpPath, tty)
-		if uaccErr != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(uaccErr)
-		}
-	}
-
-	return errorWriter, exitCode(err), trace.Wrap(err)
+	return exitCode(err), trace.Wrap(err)
 }
 
 // waitForShell waits either for the command to return or the kill signal from the parent Teleport process.
@@ -569,34 +602,32 @@ func (o *osWrapper) startNewParker(ctx context.Context, credential *syscall.Cred
 
 const rootDirectory = "/"
 
-func RunNetworking() (errw io.Writer, code int, err error) {
+func RunNetworking() (code int, err error) {
 	// SIGQUIT is used by teleport to initiate graceful shutdown, waiting for
 	// existing exec sessions to close before ending the process. For this to
 	// work when closing the entire teleport process group, exec sessions must
 	// ignore SIGQUIT signals.
 	signal.Ignore(syscall.SIGQUIT)
 
-	// errorWriter is used to return any error message back to the client.
-	// Use stderr so that it's not forwarded to the remote client.
-	errorWriter := os.Stderr
-
 	// Parent sends the command payload in the third file descriptor.
 	cmdfd := os.NewFile(CommandFile, fdName(CommandFile))
 	if cmdfd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("command pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("command pipe not found")
 	}
 
 	terminatefd := os.NewFile(TerminateFile, fdName(TerminateFile))
 	if terminatefd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("terminate pipe not found")
+		return teleport.RemoteCommandFailure, trace.BadParameter("terminate pipe not found")
 	}
 
 	// Read in the command payload.
 	var c ExecCommand
 	if err := json.NewDecoder(cmdfd).Decode(&c); err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
+	initLogger("networking", c.LogConfig)
+
 	// If PAM is enabled, open a PAM context. This has to be done before anything
 	// else because PAM is sometimes used to create the local user used for
 	// networking requests.
@@ -615,7 +646,7 @@ func RunNetworking() (errw io.Writer, code int, err error) {
 			Env: c.PAMConfig.Environment,
 		})
 		if err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+			return teleport.RemoteCommandFailure, trace.Wrap(err)
 		}
 		defer pamContext.Close()
 
@@ -627,12 +658,12 @@ func RunNetworking() (errw io.Writer, code int, err error) {
 	// done with the user's permissions.
 	localUser, err := user.Lookup(c.Login)
 	if err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.NotFound("%s", err)
+		return teleport.RemoteCommandFailure, trace.NotFound("%s", err)
 	}
 
-	cred, err := getCmdCredential(localUser)
+	cred, err := host.GetHostUserCredential(localUser)
 	if err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	if os.Getuid() != int(cred.Uid) || os.Getgid() != int(cred.Gid) {
@@ -642,14 +673,14 @@ func RunNetworking() (errw io.Writer, code int, err error) {
 				groups[i] = int(g)
 			}
 			if err := unix.Setgroups(groups); err != nil {
-				return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set groups for networking process")
+				return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set groups for networking process")
 			}
 		}
 		if err := unix.Setgid(int(cred.Gid)); err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set gid for networking process")
+			return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set gid for networking process")
 		}
 		if err := unix.Setuid(int(cred.Uid)); err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set uid for networking process")
+			return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set uid for networking process")
 		}
 	}
 
@@ -668,28 +699,28 @@ func RunNetworking() (errw io.Writer, code int, err error) {
 	for _, kv := range pamEnvironment {
 		key, value, ok := strings.Cut(strings.TrimSpace(kv), "=")
 		if !ok {
-			return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("bad environment variable from PAM, expected format \"key=value\" but got %q", kv)
+			return teleport.RemoteCommandFailure, trace.BadParameter("bad environment variable from PAM, expected format \"key=value\" but got %q", kv)
 		}
 		if err := os.Setenv(key, value); err != nil {
-			return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+			return teleport.RemoteCommandFailure, trace.Wrap(err)
 		}
 	}
 
 	// Ensure that the working directory is one that the local user has access to.
 	if err := os.Chdir(workingDir); err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set working directory for networking process: %s", workingDir)
+		return teleport.RemoteCommandFailure, trace.Wrap(err, "failed to set working directory for networking process: %s", workingDir)
 	}
 
 	// Build request listener from first extra file that was passed to command.
 	ffd := os.NewFile(FirstExtraFile, "listener")
 	if ffd == nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.BadParameter("missing socket fd")
+		return teleport.RemoteCommandFailure, trace.BadParameter("missing socket fd")
 	}
 
 	parentConn, err := uds.FromFile(ffd)
 	_ = ffd.Close()
 	if err != nil {
-		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
+		return teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -724,7 +755,7 @@ func RunNetworking() (errw io.Writer, code int, err error) {
 		if err != nil {
 			if utils.IsOKNetworkError(err) {
 				// parent connection closed, process should exit.
-				return errorWriter, teleport.RemoteCommandSuccess, nil
+				return teleport.RemoteCommandSuccess, nil
 			}
 			writeErrorToConn(parentConn, trace.Wrap(err, "error reading networking request from parent"))
 			continue
@@ -911,7 +942,7 @@ func getConnFile(conn net.Conn) (*os.File, error) {
 }
 
 // runCheckHomeDir checks if the active user's $HOME dir exists and is accessible.
-func runCheckHomeDir() (errw io.Writer, code int, err error) {
+func runCheckHomeDir() (code int, err error) {
 	code = teleport.RemoteCommandSuccess
 	if err := hasAccessibleHomeDir(); err != nil {
 		switch {
@@ -924,11 +955,11 @@ func runCheckHomeDir() (errw io.Writer, code int, err error) {
 		}
 	}
 
-	return io.Discard, code, nil
+	return code, nil
 }
 
 // runPark does nothing, forever.
-func runPark() (errw io.Writer, code int, err error) {
+func runPark() (code int, err error) {
 	// Do not replace this with an empty select because there are no other
 	// goroutines running so it will panic.
 	for {
@@ -940,25 +971,30 @@ func runPark() (errw io.Writer, code int, err error) {
 // allows Run{Command,Forward} to use defers and makes sure error messages
 // are consistent across both.
 func RunAndExit(commandType string) {
-	var w io.Writer
 	var code int
 	var err error
 
 	switch commandType {
 	case teleport.ExecSubCommand:
-		w, code, err = RunCommand()
+		code, err = RunCommand()
 	case teleport.NetworkingSubCommand:
-		w, code, err = RunNetworking()
+		code, err = RunNetworking()
 	case teleport.CheckHomeDirSubCommand:
-		w, code, err = runCheckHomeDir()
+		code, err = runCheckHomeDir()
 	case teleport.ParkSubCommand:
-		w, code, err = runPark()
+		code, err = runPark()
 	default:
-		w, code, err = os.Stderr, teleport.RemoteCommandFailure, fmt.Errorf("unknown command type: %v", commandType)
+		code, err = teleport.RemoteCommandFailure, fmt.Errorf("unknown command type: %v", commandType)
 	}
 	if err != nil {
-		s := fmt.Sprintf("Failed to launch: %v.\r\n", err)
-		io.Copy(w, bytes.NewBufferString(s))
+		// The "operation not permitted" error is expected from a variety of operations if the
+		// teleport process is running as a non-root user and is trying to spawn a process for
+		// a different OS user.
+		if strings.Contains(err.Error(), "operation not permitted") {
+			slog.ErrorContext(context.Background(), "Failed to launch subprocess, is Teleport running as root?", "command_type", commandType, "err", err)
+		} else {
+			slog.ErrorContext(context.Background(), "Failed to launch subprocess", "command_type", commandType, "err", err)
+		}
 	}
 	os.Exit(code)
 }
@@ -1102,7 +1138,9 @@ func buildCommand(c *ExecCommand, localUser *user.User, tty *os.File, pamEnviron
 		path := filepath.Join(localUser.HomeDir, ".tsh", "environment")
 		userEnvs, err := readUserEnv(localUser, path)
 		if err != nil {
-			slog.WarnContext(context.Background(), "Could not read user environment", "error", err)
+			if !trace.IsNotFound(err) {
+				slog.WarnContext(context.Background(), "Could not read user environment", "error", err)
+			}
 		} else {
 			env.AddFullUnique(userEnvs...)
 		}
@@ -1180,26 +1218,10 @@ func buildCommand(c *ExecCommand, localUser *user.User, tty *os.File, pamEnviron
 	// workaround this, the credentials struct is only set if the credentials
 	// are different from the process itself. If the credentials are not, simply
 	// pick up the ambient credentials of the process.
-	credential, err := getCmdCredential(localUser)
-	if err != nil {
+	if err := host.MaybeSetCommandCredentialAsUser(context.Background(), &cmd, localUser, slog.Default()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if os.Getuid() != int(credential.Uid) || os.Getgid() != int(credential.Gid) {
-		cmd.SysProcAttr.Credential = credential
-		slog.DebugContext(context.Background(), "Creating process",
-			"uid", credential.Uid,
-			"gid", credential.Gid,
-			"groups", credential.Groups,
-		)
-	} else {
-		slog.DebugContext(context.Background(), "Creating process with ambient credentials",
-			"uid", credential.Uid,
-			"gid", credential.Gid,
-			"groups", credential.Groups,
-		)
-	}
-
 	// Perform OS-specific tweaks to the command.
 	if isReexec {
 		reexecCommandOSTweaks(&cmd)
@@ -1242,7 +1264,6 @@ func ConfigureCommand(ctx *ServerContext, extraFiles ...*os.File) (*exec.Cmd, er
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	executableDir, _ := filepath.Split(executable)
 
 	// The channel/request type determines the subcommand to execute.
 	var subCommand string
@@ -1265,10 +1286,10 @@ func ConfigureCommand(ctx *ServerContext, extraFiles ...*os.File) (*exec.Cmd, er
 	cmd := &exec.Cmd{
 		Path: executable,
 		Args: args,
-		Dir:  executableDir,
 		Env:  *env,
 		ExtraFiles: []*os.File{
 			ctx.cmdr,
+			ctx.logw,
 			ctx.contr,
 			ctx.readyw,
 			ctx.killShellr,
@@ -1318,6 +1339,13 @@ func coerceHomeDirError(usr *user.User, err error) error {
 	return err
 }
 
+// accessibleHomeDirMu is locked by [hasAccessibleHomeDir] to avoid race
+// conditions between different goroutines while manipulating the global state
+// of the process' working directory. This should be made into a more general
+// global lock if we ever end up relying on this sort of temporary chdir in more
+// places (but we really should not).
+var accessibleHomeDirMu sync.Mutex
+
 // hasAccessibleHomeDir checks if the current user has access to an existing home directory.
 func hasAccessibleHomeDir() error {
 	// this should usually be fetching a cached value
@@ -1335,12 +1363,20 @@ func hasAccessibleHomeDir() error {
 		return trace.BadParameter("%q is not a directory", currentUser.HomeDir)
 	}
 
-	cwd, err := os.Getwd()
+	accessibleHomeDirMu.Lock()
+	defer accessibleHomeDirMu.Unlock()
+
+	cwd, err := os.Open(".")
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	// make sure we return to the original working directory
-	defer os.Chdir(cwd)
+	defer cwd.Close()
+
+	// make sure we return to the original working directory; we ought to panic
+	// if this fails but nothing should actually depend on the working directory
+	// (which is why we can afford to just change it without additional
+	// synchronization here) so we just let it slide
+	defer cwd.Chdir()
 
 	// attemping to cd into the target directory is the easiest, cross-platform way to test
 	// whether or not the current user has access
@@ -1378,7 +1414,7 @@ func CheckHomeDir(localUser *user.User) (bool, error) {
 		return false, trace.Wrap(err)
 	}
 
-	credential, err := getCmdCredential(localUser)
+	credential, err := host.GetHostUserCredential(localUser)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
@@ -1435,50 +1471,60 @@ func (o *osWrapper) newParker(ctx context.Context, credential syscall.Credential
 	return nil
 }
 
-// getCmdCredentials parses the uid, gid, and groups of the
-// given user into a credential object for a command to use.
-func getCmdCredential(localUser *user.User) (*syscall.Credential, error) {
-	uid, err := strconv.ParseUint(localUser.Uid, 10, 32)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	gid, err := strconv.ParseUint(localUser.Gid, 10, 32)
-	if err != nil {
-		return nil, trace.Wrap(err)
+// waitForSignal will wait for the other side of the pipe to signal, if not
+// received, it will stop waiting and exit.
+func waitForSignal(ctx context.Context, fd *os.File, timeout time.Duration) error {
+	waitCh := make(chan error, 1)
+	go func() {
+		// Reading from the file descriptor will block until it's closed.
+		_, err := fd.Read(make([]byte, 1))
+		if errors.Is(err, io.EOF) {
+			err = nil
+		}
+		waitCh <- err
+	}()
+
+	// Timeout if no signal has been sent within the provided duration.
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err(), "got context error while waiting for continue signal")
+	case <-timer.C:
+		return trace.LimitExceeded("timed out waiting for continue signal")
+	case err := <-waitCh:
+		return trace.Wrap(err)
 	}
+}
 
-	if runtime.GOOS == "darwin" {
-		// on macOS we should rely on the list of groups managed by the system
-		// (the use of setgroups is "highly discouraged", as per the setgroups
-		// man page in macOS 13.5)
-		return &syscall.Credential{
-			Uid:         uint32(uid),
-			Gid:         uint32(gid),
-			NoSetGroups: true,
-		}, nil
+func initLogger(name string, cfg ExecLogConfig) {
+	logWriter := os.NewFile(LogFile, fdName(LogFile))
+	if logWriter == nil {
+		return
 	}
 
-	// Lookup supplementary groups for the user.
-	userGroups, err := localUser.GroupIds()
+	fields, err := logutils.ValidateFields(cfg.ExtraFields)
 	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	groups := make([]uint32, 0)
-	for _, sgid := range userGroups {
-		igid, err := strconv.ParseUint(sgid, 10, 32)
-		if err != nil {
-			slog.WarnContext(context.Background(), "Cannot interpret user group", "user_group", sgid)
-		} else {
-			groups = append(groups, uint32(igid))
-		}
-	}
-	if len(groups) == 0 {
-		groups = append(groups, uint32(gid))
+		return
 	}
 
-	return &syscall.Credential{
-		Uid:    uint32(uid),
-		Gid:    uint32(gid),
-		Groups: groups,
-	}, nil
+	switch cfg.Format {
+	case "text", "":
+		logger := slog.New(logutils.NewSlogTextHandler(logWriter, logutils.SlogTextHandlerConfig{
+			Level:            cfg.Level,
+			EnableColors:     cfg.EnableColors,
+			ConfiguredFields: fields,
+			Padding:          cfg.Padding,
+		}))
+		slog.SetDefault(logger.With(teleport.ComponentKey, name))
+	case "json":
+		logger := slog.New(logutils.NewSlogJSONHandler(logWriter, logutils.SlogJSONHandlerConfig{
+			Level:            cfg.Level,
+			ConfiguredFields: fields,
+		}))
+		slog.SetDefault(logger.With(teleport.ComponentKey, name))
+	default:
+		return
+	}
 }
diff --git a/lib/srv/reexec_test.go b/lib/srv/reexec_test.go
index 33179e4a093a4..baf8350fd679a 100644
--- a/lib/srv/reexec_test.go
+++ b/lib/srv/reexec_test.go
@@ -44,11 +44,11 @@ import (
 	"github.com/gravitational/teleport"
 	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshutils/networking"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
-	"github.com/gravitational/teleport/lib/teleagent"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 type stubUser struct {
@@ -216,9 +216,9 @@ func TestNetworkingCommand(t *testing.T) {
 // for a user different than the one running a node (which we need to run
 // as root to create).
 func TestRootNetworkingCommand(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 
-	login := utils.GenerateLocalUsername(t)
+	login := testutils.GenerateLocalUsername(t)
 	_, err := host.UserAdd(login, nil, host.UserOpts{})
 	require.NoError(t, err)
 	t.Cleanup(func() {
@@ -316,18 +316,16 @@ func testAgentForward(ctx context.Context, t *testing.T, proc *networking.Proces
 	err = keyring.Add(testKey)
 	require.NoError(t, err)
 
-	teleAgent := teleagent.NewServer(func() (teleagent.Agent, error) {
-		return teleagent.NopCloser(keyring), nil
-	})
+	agentServer := sshagent.NewServer(sshagent.NewStaticClientGetter(keyring))
 
 	// Forward the agent over the networking process.
 	listener, err := proc.ListenAgent(ctx)
 	require.NoError(t, err)
-	teleAgent.SetListener(listener)
+	agentServer.SetListener(listener)
 
-	go teleAgent.Serve()
+	go agentServer.Serve()
 	t.Cleanup(func() {
-		teleAgent.Close()
+		agentServer.Close()
 	})
 
 	agentConn, err := net.Dial(listener.Addr().Network(), listener.Addr().String())
@@ -350,7 +348,7 @@ func testX11Forward(ctx context.Context, t *testing.T, proc *networking.Process,
 	}
 	require.NoError(t, err)
 
-	cred, err := getCmdCredential(localUser)
+	cred, err := host.GetHostUserCredential(localUser)
 	require.NoError(t, err)
 
 	// Create a temporary xauth file path belonging to the user.
@@ -417,7 +415,11 @@ func testX11Forward(ctx context.Context, t *testing.T, proc *networking.Process,
 }
 
 func TestRootCheckHomeDir(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
+
+	// this test manipulates global state, ensure we're not going to run it in
+	// parallel with something else
+	t.Setenv("foo", "bar")
 
 	tmp := t.TempDir()
 	require.NoError(t, os.Chmod(filepath.Dir(tmp), 0777))
@@ -433,7 +435,7 @@ func TestRootCheckHomeDir(t *testing.T) {
 	_, err := os.Create(file)
 	require.NoError(t, err)
 
-	login := utils.GenerateLocalUsername(t)
+	login := testutils.GenerateLocalUsername(t)
 	_, err = host.UserAdd(login, nil, host.UserOpts{Home: home})
 	require.NoError(t, err)
 	t.Cleanup(func() {
@@ -486,7 +488,7 @@ func changeHomeDir(t *testing.T, username, home string) {
 }
 
 func TestRootOpenFileAsUser(t *testing.T) {
-	utils.RequireRoot(t)
+	testutils.RequireRoot(t)
 	euid := os.Geteuid()
 	egid := os.Getegid()
 
diff --git a/lib/srv/regular/proxy.go b/lib/srv/regular/proxy.go
index f9bb078e3f9f4..7956a7e20bb30 100644
--- a/lib/srv/regular/proxy.go
+++ b/lib/srv/regular/proxy.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/proxy"
 	"github.com/gravitational/teleport/lib/srv"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -172,13 +173,13 @@ func newProxySubsys(ctx context.Context, serverContext *srv.ServerContext, srv *
 		)
 		req.clusterName = serverContext.Identity.RouteToCluster
 	}
-	if req.clusterName != "" && srv.proxyTun != nil {
-		checker, err := srv.tunnelWithAccessChecker(serverContext)
+	if req.clusterName != "" && srv.proxyClusterGetter != nil {
+		checker, err := srv.clusterGetterWithAccessChecker(serverContext)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		if _, err := checker.GetSite(req.clusterName); err != nil {
+		if _, err := checker.Cluster(ctx, req.clusterName); err != nil {
 			return nil, trace.BadParameter("invalid format for proxy request: unknown cluster %q", req.clusterName)
 		}
 	}
@@ -251,8 +252,10 @@ func (t *proxySubsys) proxyToHost(ctx context.Context, ch ssh.Channel, clientSrc
 
 	signer := agentless.SignerFromSSHIdentity(identity.UnmappedIdentity, authClient, t.clusterName, identity.TeleportUser)
 
-	aGetter := t.ctx.StartAgentChannel
-	conn, err := t.router.DialHost(ctx, clientSrcAddr, clientDstAddr, t.host, t.port, t.clusterName, t.ctx.Identity.UnstableClusterAccessChecker, aGetter, signer)
+	aGetter := func() (sshagent.Client, error) {
+		return t.ctx.StartAgentChannel()
+	}
+	conn, err := t.router.DialHost(ctx, identity.UnmappedIdentity.ScopePin, clientSrcAddr, clientDstAddr, t.host, t.port, t.clusterName, t.ctx.Identity.UnstableClusterAccessChecker, aGetter, signer)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/regular/sftp.go b/lib/srv/regular/sftp.go
index 79a05e78bf6fd..c47278b382872 100644
--- a/lib/srv/regular/sftp.go
+++ b/lib/srv/regular/sftp.go
@@ -30,7 +30,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
 
@@ -77,7 +77,7 @@ func (s *sftpSubsys) Start(ctx context.Context,
 				Time: time.Now(),
 			},
 			UserMetadata:   serverCtx.Identity.GetUserMetadata(),
-			ServerMetadata: serverCtx.GetServer().TargetMetadata(),
+			ServerMetadata: serverCtx.GetServer().EventMetadata(),
 			Error:          srv.ErrNodeFileCopyingNotPermitted.Error(),
 		})
 		return srv.ErrNodeFileCopyingNotPermitted
@@ -106,7 +106,7 @@ func (s *sftpSubsys) Start(ctx context.Context,
 	defer auditPipeIn.Close()
 
 	// Create child process to handle SFTP connection
-	execRequest, err := srv.NewExecRequest(serverCtx, teleport.SFTPSubsystem)
+	execRequest, err := srv.NewExecRequest(serverCtx, teleport.SFTPSubCommand)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -168,7 +168,7 @@ func (s *sftpSubsys) Start(ctx context.Context,
 		defer auditPipeOut.Close()
 
 		// Create common fields for events
-		serverMeta := serverCtx.GetServer().TargetMetadata()
+		serverMeta := serverCtx.GetServer().EventMetadata()
 		sessionMeta := serverCtx.GetSessionMetadata()
 		userMeta := serverCtx.Identity.GetUserMetadata()
 		connectionMeta := apievents.ConnectionMetadata{
diff --git a/lib/srv/regular/sites.go b/lib/srv/regular/sites.go
index 029ca982af845..7ce8218d88262 100644
--- a/lib/srv/regular/sites.go
+++ b/lib/srv/regular/sites.go
@@ -54,19 +54,19 @@ func (t *proxySitesSubsys) Wait() error {
 // service.Site structures, and writes it serialized as JSON back to the SSH client
 func (t *proxySitesSubsys) Start(ctx context.Context, sconn *ssh.ServerConn, ch ssh.Channel, req *ssh.Request, serverContext *srv.ServerContext) error {
 	t.srv.logger.DebugContext(ctx, "starting proxysites subsystem", "server_context", serverContext)
-	checker, err := t.srv.tunnelWithAccessChecker(serverContext)
+	checker, err := t.srv.clusterGetterWithAccessChecker(serverContext)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	remoteSites, err := checker.GetSites()
+	clusters, err := checker.Clusters(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// build an arary of services.Site structures:
-	retval := make([]types.Site, 0, len(remoteSites))
-	for _, s := range remoteSites {
+	retval := make([]types.Site, 0, len(clusters))
+	for _, s := range clusters {
 		retval = append(retval, types.Site{
 			Name:          s.GetName(),
 			Status:        s.GetStatus(),
diff --git a/lib/srv/regular/sshserver.go b/lib/srv/regular/sshserver.go
index f1e452c55b0e9..546333b656731 100644
--- a/lib/srv/regular/sshserver.go
+++ b/lib/srv/regular/sshserver.go
@@ -54,25 +54,28 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/bpf"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/inventory"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/proxy"
+	"github.com/gravitational/teleport/lib/relaytunnel"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/scopes"
 	authorizedkeysreporter "github.com/gravitational/teleport/lib/secretsscanner/authorizedkeys"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/srv/ingress"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/sshutils/networking"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
-	"github.com/gravitational/teleport/lib/teleagent"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/hostid"
 )
 
 // Server implements SSH server that uses configuration backend and
@@ -103,10 +106,10 @@ type Server struct {
 	// cloudLabels are the labels imported from a cloud provider.
 	cloudLabels labels.Importer
 
-	proxyMode        bool
-	proxyTun         reversetunnelclient.Tunnel
-	proxyAccessPoint authclient.ReadProxyAccessPoint
-	peerAddr         string
+	proxyMode          bool
+	proxyClusterGetter reversetunnelclient.ClusterGetter
+	proxyAccessPoint   authclient.ReadProxyAccessPoint
+	peerAddr           string
 
 	advertiseAddr   *utils.NetAddr
 	proxyPublicAddr utils.NetAddr
@@ -166,7 +169,7 @@ type Server struct {
 	// requesting connections to it come over a reverse tunnel.
 	useTunnel bool
 
-	// fips means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// fips means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	fips bool
 
@@ -185,6 +188,9 @@ type Server struct {
 	// btmpPath is the path to the user accounting failed login log.
 	btmpPath string
 
+	// wtmpdbPath is the path to the wtmpdb database file.
+	wtmpdbPath string
+
 	// allowTCPForwarding indicates whether the ssh server is allowed to offer
 	// TCP port forwarding.
 	allowTCPForwarding bool
@@ -202,6 +208,11 @@ type Server struct {
 	// connectedProxyGetter gets the proxies teleport is connected to.
 	connectedProxyGetter *reversetunnel.ConnectedProxyGetter
 
+	// relayInfoGetter gets the Relay group and Relay host IDs that this
+	// Teleport instance is connected to. The returned data must be owned by the
+	// caller (i.e. it should be a copy).
+	relayInfoGetter relaytunnel.GetRelayInfoFunc
+
 	// createHostUser configures whether a host should allow host user
 	// creation
 	createHostUser bool
@@ -244,17 +255,25 @@ type Server struct {
 
 	// enableSELinux configures whether SELinux support is enable or not.
 	enableSELinux bool
+
+	// scope is the scope the server is constrained to
+	scope string
+
+	// childLogConfig is the log config for child processes.
+	childLogConfig *srv.ChildLogConfig
 }
 
-// TargetMetadata returns metadata about the server.
-func (s *Server) TargetMetadata() apievents.ServerMetadata {
+// EventMetadata returns metadata about the server.
+func (s *Server) EventMetadata() apievents.ServerMetadata {
+	serverInfo := s.GetInfo()
 	return apievents.ServerMetadata{
 		ServerVersion:   teleport.Version,
-		ServerNamespace: s.GetNamespace(),
-		ServerID:        s.ID(),
-		ServerAddr:      s.Addr(),
-		ServerLabels:    s.getAllLabels(),
-		ServerHostname:  s.hostname,
+		ServerNamespace: serverInfo.GetNamespace(),
+		ServerID:        serverInfo.GetName(),
+		ServerAddr:      serverInfo.GetAddr(),
+		ServerLabels:    serverInfo.GetAllLabels(),
+		ServerHostname:  serverInfo.GetHostname(),
+		ServerSubKind:   serverInfo.GetSubKind(),
 	}
 }
 
@@ -277,13 +296,13 @@ func (s *Server) GetAccessPoint() srv.AccessPoint {
 }
 
 // GetUserAccountingPaths returns the optional override of the utmp, wtmp, and btmp paths.
-func (s *Server) GetUserAccountingPaths() (string, string, string) {
-	return s.utmpPath, s.wtmpPath, s.btmpPath
+func (s *Server) GetUserAccountingPaths() (utmp string, wtmp string, btmp string, wtmpdb string) {
+	return s.utmpPath, s.wtmpPath, s.btmpPath, s.wtmpdbPath
 }
 
 // GetPAM returns the PAM configuration for this server.
-func (s *Server) GetPAM() (*servicecfg.PAMConfig, error) {
-	return s.pamConfig, nil
+func (s *Server) GetPAM() *servicecfg.PAMConfig {
+	return s.pamConfig
 }
 
 // UseTunnel used to determine if this node has connected to this cluster
@@ -335,6 +354,26 @@ func (s *Server) GetSELinuxEnabled() bool {
 	return s.enableSELinux
 }
 
+// GetProxyMode returns whether the server is started in SSH proxying mode.
+func (s *Server) GetProxyMode() bool {
+	return s.proxyMode
+}
+
+// ChildLogConfig returns the child log config.
+func (s *Server) ChildLogConfig() srv.ChildLogConfig {
+	if s.childLogConfig != nil {
+		return *s.childLogConfig
+	}
+
+	// return a noop log configuration
+	return srv.ChildLogConfig{
+		ExecLogConfig: srv.ExecLogConfig{
+			Level: &slog.LevelVar{},
+		},
+		Writer: io.Discard,
+	}
+}
+
 // ServerOption is a functional option passed to the server
 type ServerOption func(s *Server) error
 
@@ -442,11 +481,12 @@ func (s *Server) HandleConnection(conn net.Conn) {
 }
 
 // SetUserAccountingPaths is a functional server option to override the user accounting database and log path.
-func SetUserAccountingPaths(utmpPath, wtmpPath, btmpPath string) ServerOption {
+func SetUserAccountingPaths(utmpPath, wtmpPath, btmpPath, wtmpdbPath string) ServerOption {
 	return func(s *Server) error {
 		s.utmpPath = utmpPath
 		s.wtmpPath = wtmpPath
 		s.btmpPath = btmpPath
+		s.wtmpdbPath = wtmpdbPath
 		return nil
 	}
 }
@@ -469,13 +509,13 @@ func SetRotationGetter(getter services.RotationGetter) ServerOption {
 }
 
 // SetProxyMode starts this server in SSH proxying mode
-func SetProxyMode(peerAddr string, tsrv reversetunnelclient.Tunnel, ap authclient.ReadProxyAccessPoint, router *proxy.Router) ServerOption {
+func SetProxyMode(peerAddr string, clusterGetter reversetunnelclient.ClusterGetter, ap authclient.ReadProxyAccessPoint, router *proxy.Router) ServerOption {
 	return func(s *Server) error {
 		// always set proxy mode to true,
 		// because in some tests reverse tunnel is disabled,
 		// but proxy is still used without it.
 		s.proxyMode = true
-		s.proxyTun = tsrv
+		s.proxyClusterGetter = clusterGetter
 		s.proxyAccessPoint = ap
 		s.peerAddr = peerAddr
 		s.router = router
@@ -680,6 +720,15 @@ func SetConnectedProxyGetter(getter *reversetunnel.ConnectedProxyGetter) ServerO
 	}
 }
 
+// SetRelayInfoGetter sets the function used to get the relay tunnel client info
+// to fill in the server heartbeat.
+func SetRelayInfoGetter(getter relaytunnel.GetRelayInfoFunc) ServerOption {
+	return func(s *Server) error {
+		s.relayInfoGetter = getter
+		return nil
+	}
+}
+
 // SetInventoryControlHandle sets the server's downstream inventory control
 // handle.
 func SetInventoryControlHandle(handle inventory.DownstreamHandle) ServerOption {
@@ -739,6 +788,40 @@ func SetPublicAddrs(addrs []utils.NetAddr) ServerOption {
 	}
 }
 
+// SetScope sets the server's scope.
+func SetScope(scope string) ServerOption {
+	return func(s *Server) error {
+		if scope == "" {
+			s.scope = ""
+			return nil
+		}
+
+		if err := scopes.WeakValidate(scope); err != nil {
+			return trace.Wrap(err)
+		}
+		s.scope = scope
+		return nil
+	}
+}
+
+// SetChildLogConfig sets the config that will be used to handle logs
+// from child processes.
+func SetChildLogConfig(cfg *servicecfg.Config) ServerOption {
+	return func(s *Server) error {
+		s.childLogConfig = &srv.ChildLogConfig{
+			ExecLogConfig: srv.ExecLogConfig{
+				Level:        cfg.LoggerLevel,
+				Format:       strings.ToLower(cfg.LogConfig.Format),
+				ExtraFields:  cfg.LogConfig.ExtraFields,
+				EnableColors: cfg.LogConfig.EnableColors,
+				Padding:      cfg.LogConfig.Padding,
+			},
+			Writer: cfg.LogWriter,
+		}
+		return nil
+	}
+}
+
 // New returns an unstarted server
 func New(
 	ctx context.Context,
@@ -752,25 +835,19 @@ func New(
 	auth authclient.ClientI,
 	options ...ServerOption,
 ) (*Server, error) {
-	// read the host UUID:
-	uuid, err := hostid.ReadOrCreateFile(dataDir)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	ctx, cancel := context.WithCancel(ctx)
 	s := &Server{
 		addr:               addr,
 		authService:        authService,
 		hostname:           hostname,
 		proxyPublicAddr:    proxyPublicAddr,
-		uuid:               uuid,
 		cancel:             cancel,
 		ctx:                ctx,
 		clock:              clockwork.NewRealClock(),
 		dataDir:            dataDir,
 		allowTCPForwarding: true,
 	}
+	var err error
 	s.limiter, err = limiter.NewLimiter(limiter.Config{})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -788,6 +865,10 @@ func New(
 		}
 	}
 
+	if s.uuid == "" {
+		return nil, trace.BadParameter("server UUID must be set using SetUUID")
+	}
+
 	// TODO(klizhentas): replace function arguments with struct
 	if s.StreamEmitter == nil {
 		return nil, trace.BadParameter("setup valid Emitter parameter using SetEmitter")
@@ -932,13 +1013,13 @@ func (s *Server) getNamespace() string {
 	return types.ProcessNamespace(s.namespace)
 }
 
-func (s *Server) tunnelWithAccessChecker(ctx *srv.ServerContext) (reversetunnelclient.Tunnel, error) {
+func (s *Server) clusterGetterWithAccessChecker(ctx *srv.ServerContext) (reversetunnelclient.ClusterGetter, error) {
 	clusterName, err := s.GetAccessPoint().GetClusterName(s.ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return reversetunnelclient.NewTunnelWithRoles(s.proxyTun, clusterName.GetClusterName(), ctx.Identity.UnstableClusterAccessChecker, s.proxyAccessPoint), nil
+	return reversetunnelclient.NewClusterGetterWithRoles(s.proxyClusterGetter, clusterName.GetClusterName(), ctx.Identity.UnstableClusterAccessChecker, s.proxyAccessPoint), nil
 }
 
 // startAuthorizedKeysManager starts the authorized keys manager.
@@ -1073,18 +1154,6 @@ func (s *Server) getDynamicLabels() map[string]types.CommandLabelV2 {
 	return types.LabelsToV2(s.dynamicLabels.Get())
 }
 
-// getAllLabels return a combination of static and dynamic labels.
-func (s *Server) getAllLabels() map[string]string {
-	lmap := make(map[string]string)
-	for key, value := range s.getStaticLabels() {
-		lmap[key] = value
-	}
-	for key, cmd := range s.getDynamicLabels() {
-		lmap[key] = cmd.Result
-	}
-	return lmap
-}
-
 // GetInfo returns a services.Server that represents this server.
 func (s *Server) GetInfo() types.Server {
 	return s.getBasicInfo()
@@ -1097,24 +1166,35 @@ func (s *Server) getBasicInfo() *types.ServerV2 {
 		addr = s.AdvertiseAddr()
 	}
 
+	var relayGroup string
+	var relayIDs []string
+	if s.relayInfoGetter != nil {
+		// relayInfoGetter returns a copy of the slice, so we can move it in the
+		// protobuf message
+		relayGroup, relayIDs = s.relayInfoGetter()
+	}
 	srv := &types.ServerV2{
 		Kind:    types.KindNode,
 		Version: types.V2,
+		Scope:   s.scope,
 		Metadata: types.Metadata{
 			Name:      s.ID(),
 			Namespace: s.getNamespace(),
 			Labels:    s.getStaticLabels(),
 		},
 		Spec: types.ServerSpecV2{
-			CmdLabels: s.getDynamicLabels(),
-			Addr:      addr,
-			Hostname:  s.hostname,
-			UseTunnel: s.useTunnel,
-			Version:   teleport.Version,
-			ProxyIDs:  s.connectedProxyGetter.GetProxyIDs(),
+			CmdLabels:  s.getDynamicLabels(),
+			Addr:       addr,
+			Hostname:   s.hostname,
+			UseTunnel:  s.useTunnel,
+			Version:    teleport.Version,
+			ProxyIDs:   s.connectedProxyGetter.GetProxyIDs(),
+			RelayGroup: relayGroup,
+			RelayIds:   relayIDs,
 		},
 	}
 	srv.SetPublicAddrs(utils.NetAddrsToStrings(s.publicAddrs))
+	srv.SetComponentFeatures(componentfeatures.ForSSHServer(s))
 
 	return srv
 }
@@ -1201,7 +1281,7 @@ func (s *Server) getNetworkingProcess(scx *srv.ServerContext) (*networking.Proce
 // the server connection is closed.
 func (s *Server) startNetworkingProcess(scx *srv.ServerContext) (*networking.Process, error) {
 	// Create context for the networking process.
-	nsctx, err := srv.NewServerContext(context.Background(), scx.ConnectionContext, s, scx.Identity)
+	nsctx, err := srv.NewServerContext(context.Background(), scx.ConnectionContext, s, scx.Identity, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1260,8 +1340,23 @@ func (s *Server) HandleRequest(ctx context.Context, ccx *sshutils.ConnectionCont
 			}
 		}
 	case teleport.SessionIDQueryRequest:
+		// TODO(Joerger): DELETE IN v20.0.0
+		// All v17+ servers set the session ID. v19+ clients stop checking.
+
 		// Reply true to session ID query requests, we will set new
-		// session IDs for new sessions
+		// session IDs for new sessions during the shel/exec channel
+		// request.
+		if err := r.Reply(true, nil); err != nil {
+			s.logger.WarnContext(ctx, "Failed to reply to session ID query request", "error", err)
+		}
+		return
+	case teleport.SessionIDQueryRequestV2:
+		// TODO(Joerger): DELETE IN v21.0.0
+		// clients should stop checking in v21, and servers should stop responding to the query in v22.
+
+		// Reply true to session ID query requests, we will set new
+		// session IDs for new sessions directly after accepting the
+		// session channel request.
 		if err := r.Reply(true, nil); err != nil {
 			s.logger.WarnContext(ctx, "Failed to reply to session ID query request", "error", err)
 		}
@@ -1386,7 +1481,7 @@ func (s *Server) HandleNewChan(ctx context.Context, ccx *sshutils.ConnectionCont
 				s.rejectChannel(ctx, nch, ssh.ConnectionFailed, fmt.Sprintf("unable to accept channel: %v", err))
 				return
 			}
-			go s.handleSessionRequests(ctx, ccx, identityContext, ch, requests)
+			go s.handleSessionRequests(ctx, ccx, identityContext, nil, ch, requests)
 			return
 		default:
 			s.rejectChannel(ctx, nch, ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %v", channelType))
@@ -1429,6 +1524,15 @@ func (s *Server) HandleNewChan(ctx context.Context, ccx *sshutils.ConnectionCont
 			}
 			decr = d
 		}
+
+		// SessionParams are not passed by old clients (<v19) or OpenSSH clients.
+		sessionParams, err := tracessh.ParseSessionParams(nch.ExtraData())
+		if err != nil {
+			s.logger.ErrorContext(ctx, "Failed to parse request data", "data", string(nch.ExtraData()), "error", err)
+			s.rejectChannel(ctx, nch, ssh.ConnectionFailed, fmt.Sprintf("unable to accept channel: %v", err))
+			return
+		}
+
 		ch, requests, err := nch.Accept()
 		if err != nil {
 			s.logger.WarnContext(ctx, "Unable to accept channel", "error", err)
@@ -1439,7 +1543,7 @@ func (s *Server) HandleNewChan(ctx context.Context, ccx *sshutils.ConnectionCont
 			return
 		}
 		go func() {
-			s.handleSessionRequests(ctx, ccx, identityContext, ch, requests)
+			s.handleSessionRequests(ctx, ccx, identityContext, sessionParams, ch, requests)
 			if decr != nil {
 				decr()
 			}
@@ -1509,7 +1613,7 @@ func (w *stderrWriter) WriteString(s string) (int, error) {
 func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ccx *sshutils.ConnectionContext, identityContext srv.IdentityContext, channel ssh.Channel, req *sshutils.DirectTCPIPReq) {
 	// Create context for this channel. This context will be closed when
 	// forwarding is complete.
-	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext)
+	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext, nil)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "Unable to create connection context", "error", err)
 		s.writeStderr(ctx, channel, "Unable to create connection context.")
@@ -1571,7 +1675,7 @@ func (s *Server) handleDirectTCPIPRequest(ctx context.Context, ccx *sshutils.Con
 // handleSessionRequests handles out of band session requests once the session
 // channel has been created this function's loop handles all the "exec",
 // "subsystem" and "shell" requests.
-func (s *Server) handleSessionRequests(ctx context.Context, ccx *sshutils.ConnectionContext, identityContext srv.IdentityContext, ch ssh.Channel, in <-chan *ssh.Request) {
+func (s *Server) handleSessionRequests(ctx context.Context, ccx *sshutils.ConnectionContext, identityContext srv.IdentityContext, sessionParams *tracessh.SessionParams, ch ssh.Channel, in <-chan *ssh.Request) {
 	netConfig, err := s.GetAccessPoint().GetClusterNetworkingConfig(ctx)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "Unable to fetch cluster networking config", "error", err)
@@ -1581,7 +1685,7 @@ func (s *Server) handleSessionRequests(ctx context.Context, ccx *sshutils.Connec
 
 	// Create context for this channel. This context will be closed when the
 	// session request is complete.
-	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext, func(cfg *srv.MonitorConfig) {
+	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext, sessionParams, func(cfg *srv.MonitorConfig) {
 		cfg.IdleTimeoutMessage = netConfig.GetClientIdleTimeoutMessage()
 		cfg.MessageWriter = &stderrWriter{writer: func(msg string) { s.writeStderr(ctx, ch, msg) }}
 	})
@@ -1601,6 +1705,27 @@ func (s *Server) handleSessionRequests(ctx context.Context, ccx *sshutils.Connec
 
 	trackingChan := scx.TrackActivity(ch)
 
+	// If we are creating a new session (not joining a session), prepare a new session
+	// ID and inform the client.
+	//
+	// Note: If this is an old client (<v19), the join sid has not yet propagated
+	// from env vars. There is no harm in sending the ephemeral session ID anyways
+	// as clients should ignore the reported session ID when joining a session.
+	if scx.GetSessionParams().JoinSessionID == "" {
+		sid := session.NewID()
+		scx.SetNewSessionID(ctx, sid)
+
+		// inform the client of the session ID that is going to be used in a new
+		// goroutine to reduce latency.
+		go func() {
+			s.logger.DebugContext(ctx, "Sending current session ID", "sid", sid)
+			_, err := ch.SendRequest(teleport.CurrentSessionIDRequest, false, []byte(sid))
+			if err != nil {
+				s.logger.DebugContext(ctx, "Failed to send the current session ID", "error", err)
+			}
+		}()
+	}
+
 	// The keep-alive loop will keep pinging the remote server and after it has
 	// missed a certain number of keep-alive requests it will cancel the
 	// closeContext which signals the server to shutdown.
@@ -1615,21 +1740,6 @@ func (s *Server) handleSessionRequests(ctx context.Context, ccx *sshutils.Connec
 	})
 
 	for {
-		// update scx with the session ID:
-		if !s.proxyMode {
-			err := scx.CreateOrJoinSession(ctx, s.reg)
-			if err != nil {
-				scx.Logger.ErrorContext(ctx, "Unable to update context", "error", err)
-
-				// write the error to channel and close it
-				s.writeStderr(ctx, trackingChan, fmt.Sprintf("unable to update context: %v", err))
-				_, err := trackingChan.SendRequest("exit-status", false, ssh.Marshal(struct{ C uint32 }{C: teleport.RemoteCommandFailure}))
-				if err != nil {
-					scx.Logger.ErrorContext(ctx, "Failed to send exit status", "error", err)
-				}
-				return
-			}
-		}
 		select {
 		case creq := <-scx.SubsystemResultCh:
 			// this means that subsystem has finished executing and
@@ -1740,10 +1850,15 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 		case teleport.ForceTerminateRequest:
 			return s.termHandlers.HandleForceTerminate(ch, req, serverContext)
 		case sshutils.EnvRequest, tracessh.EnvsRequest:
-		case constants.FileTransferDecision:
-			return s.termHandlers.HandleFileTransferDecision(ctx, ch, req, serverContext)
 			// We ignore all SSH setenv requests for join-only principals.
 			// SSH will send them anyway but it seems fine to silently drop them.
+		case constants.InitiateFileTransfer:
+			if mode := serverContext.GetSessionParams().JoinMode; mode != types.SessionPeerMode {
+				return trace.AccessDenied("attempted file transfer in %s mode", mode)
+			}
+			return s.termHandlers.HandleFileTransferRequest(ctx, ch, req, serverContext)
+		case constants.FileTransferDecision:
+			return s.termHandlers.HandleFileTransferDecision(ctx, ch, req, serverContext)
 		case sshutils.SubsystemRequest:
 			return s.handleSubsystem(ctx, ch, req, serverContext)
 		case sshutils.AgentForwardRequest:
@@ -1855,7 +1970,9 @@ func (s *Server) serveAgent(ctx context.Context, scx *srv.ServerContext) error {
 
 	// start an agent server on a unix socket.  each incoming connection
 	// will result in a separate agent request.
-	agentServer := teleagent.NewServer(scx.Parent().StartAgentChannel)
+	agentServer := sshagent.NewServer(func() (sshagent.Client, error) {
+		return scx.Parent().StartAgentChannel()
+	})
 	agentServer.SetListener(listener)
 	scx.Parent().AddCloser(agentServer)
 	scx.Parent().SetEnv(teleport.SSHAuthSock, listener.Addr().String())
@@ -2078,7 +2195,7 @@ func (s *Server) handleVersionRequest(ctx context.Context, req *ssh.Request) {
 func (s *Server) handleProxyJump(ctx context.Context, ccx *sshutils.ConnectionContext, identityContext srv.IdentityContext, ch ssh.Channel, req sshutils.DirectTCPIPReq) {
 	// Create context for this channel. This context will be closed when the
 	// session request is complete.
-	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext)
+	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext, nil)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "Unable to create connection context", "error", err)
 		s.writeStderr(ctx, ch, "Unable to create connection context.")
@@ -2212,7 +2329,7 @@ func (s *Server) createForwardingContext(ctx context.Context, ccx *sshutils.Conn
 	}
 
 	// Create context for this request.
-	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext)
+	scx, err := srv.NewServerContext(ctx, ccx, s, identityContext, nil)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -2421,7 +2538,7 @@ func (s *Server) parseSubsystemRequest(ctx context.Context, req *ssh.Request, se
 					Time: time.Now(),
 				},
 				UserMetadata:   serverContext.Identity.GetUserMetadata(),
-				ServerMetadata: serverContext.GetServer().TargetMetadata(),
+				ServerMetadata: serverContext.GetServer().EventMetadata(),
 				Error:          err.Error(),
 			})
 			return nil, trace.Wrap(err)
diff --git a/lib/srv/regular/sshserver_test.go b/lib/srv/regular/sshserver_test.go
index bd1643461b03e..ee19d56274353 100644
--- a/lib/srv/regular/sshserver_test.go
+++ b/lib/srv/regular/sshserver_test.go
@@ -26,6 +26,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"log/slog"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -34,6 +35,7 @@ import (
 	"os/exec"
 	"os/user"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -60,6 +62,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/bpf"
@@ -75,9 +78,11 @@ import (
 	"github.com/gravitational/teleport/lib/services/readonly"
 	sess "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // teleportTestUser is additional user used for tests
@@ -91,7 +96,7 @@ var wildcardAllow = types.Labels{
 // TestMain will re-execute Teleport to run a command if "exec" is passed to
 // it as an argument. Otherwise it will run tests as normal.
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
 	if srv.IsReexec() {
 		srv.RunAndExit(os.Args[1])
@@ -118,33 +123,41 @@ type sshTestFixture struct {
 	signer  ssh.Signer
 	user    string
 	clock   *clockwork.FakeClock
-	testSrv *auth.TestServer
+	testSrv *authtest.Server
 }
 
 func newFixture(t *testing.T) *sshTestFixture {
-	return newCustomFixture(t, func(*auth.TestServerConfig) {})
+	return newCustomFixture(t, func(*authtest.ServerConfig) {})
 }
 
 func newFixtureWithoutDiskBasedLogging(t testing.TB, sshOpts ...ServerOption) *sshTestFixture {
 	t.Helper()
 
-	f := newCustomFixture(t, func(cfg *auth.TestServerConfig) {
+	f := newCustomFixture(t, func(cfg *authtest.ServerConfig) {
 		cfg.Auth.AuditLog = events.NewDiscardAuditLog()
 	}, sshOpts...)
 
-	// use a sync recording mode because the disk-based uploader
+	// disable recording because the disk-based uploader
 	// that runs in the background introduces races with test cleanup
 	recConfig := types.DefaultSessionRecordingConfig()
-	recConfig.SetMode(types.RecordAtNodeSync)
-	_, err := f.testSrv.Auth().UpsertSessionRecordingConfig(context.Background(), recConfig)
+	recConfig.SetMode(types.RecordOff)
+	_, err := f.testSrv.Auth().UpsertSessionRecordingConfig(t.Context(), recConfig)
 	require.NoError(t, err)
 
 	return f
 }
 
+func (f *sshTestFixture) SSHClientConfig() *ssh.ClientConfig {
+	return &ssh.ClientConfig{
+		User:            f.user,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(f.up.certSigner)},
+		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
+	}
+}
+
 func (f *sshTestFixture) newSSHClient(ctx context.Context, t testing.TB, user *user.User) *tracessh.Client {
 	// set up SSH client using the user private key for signing
-	up, err := newUpack(f.testSrv, user.Username, []string{user.Username}, wildcardAllow)
+	up, err := newUpack(ctx, f.testSrv, user.Username, []string{user.Username}, wildcardAllow)
 	require.NoError(t, err)
 
 	// set up an agent server and a client that uses agent for forwarding
@@ -171,16 +184,30 @@ func (f *sshTestFixture) newSSHClient(ctx context.Context, t testing.TB, user *u
 	return client
 }
 
-func newCustomFixture(t testing.TB, mutateCfg func(*auth.TestServerConfig), sshOpts ...ServerOption) *sshTestFixture {
-	ctx := context.Background()
+func setChildLogConfigForTest() ServerOption {
+	return func(s *Server) error {
+		level := new(slog.LevelVar)
+		level.Set(slog.LevelDebug)
+		s.childLogConfig = &srv.ChildLogConfig{
+			ExecLogConfig: srv.ExecLogConfig{
+				Level: level,
+			},
+			Writer: os.Stderr,
+		}
+		return nil
+	}
+}
+
+func newCustomFixture(t testing.TB, mutateCfg func(*authtest.ServerConfig), sshOpts ...ServerOption) *sshTestFixture {
+	ctx := t.Context()
 
 	u, err := user.Current()
 	require.NoError(t, err)
 
 	clock := clockwork.NewFakeClock()
 
-	serverCfg := auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+	serverCfg := authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			ClusterName: "localhost",
 			Dir:         t.TempDir(),
 			Clock:       clock,
@@ -188,13 +215,13 @@ func newCustomFixture(t testing.TB, mutateCfg func(*auth.TestServerConfig), sshO
 	}
 	mutateCfg(&serverCfg)
 
-	testServer, err := auth.NewTestServer(serverCfg)
+	testServer, err := authtest.NewTestServer(serverCfg)
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, testServer.Shutdown(ctx)) })
+	t.Cleanup(func() { require.NoError(t, testServer.Close()) })
 
 	signer := newSigner(t, ctx, testServer)
 	nodeID := uuid.New().String()
-	nodeClient, err := testServer.NewClient(auth.TestIdentity{
+	nodeClient, err := testServer.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: nodeID,
@@ -221,21 +248,14 @@ func newCustomFixture(t testing.TB, mutateCfg func(*auth.TestServerConfig), sshO
 		SetNamespace(apidefaults.Namespace),
 		SetEmitter(nodeClient),
 		SetPAMConfig(&servicecfg.PAMConfig{Enabled: false}),
-		SetLabels(
-			map[string]string{"foo": "bar"},
-			services.CommandLabels{
-				"baz": &types.CommandLabelV2{
-					Period:  types.NewDuration(time.Second),
-					Command: []string{"expr", "1", "+", "3"},
-				},
-			}, nil,
-		),
+		SetLabels(map[string]string{"foo": "bar"}, nil, nil),
 		SetBPF(&bpf.NOP{}),
 		SetClock(clock),
 		SetLockWatcher(lockWatcher),
 		SetX11ForwardingConfig(&x11.ServerConfig{}),
 		SetSessionController(sessionController),
 		SetStoragePresenceService(testServer.AuthServer.AuthServer.PresenceInternal),
+		setChildLogConfigForTest(),
 	}
 
 	serverOptions = append(serverOptions, sshOpts...)
@@ -266,10 +286,10 @@ func newCustomFixture(t testing.TB, mutateCfg func(*auth.TestServerConfig), sshO
 	sshSrvAddress := sshSrv.Addr()
 	_, sshSrvPort, err := net.SplitHostPort(sshSrvAddress)
 	require.NoError(t, err)
-	sshSrvHostPort := fmt.Sprintf("%v:%v", testServer.ClusterName(), sshSrvPort)
+	sshSrvHostPort := net.JoinHostPort(testServer.ClusterName(), sshSrvPort)
 
 	// set up SSH client using the user private key for signing
-	up, err := newUpack(testServer, u.Username, []string{u.Username}, wildcardAllow)
+	up, err := newUpack(t.Context(), testServer, u.Username, []string{u.Username}, wildcardAllow)
 	require.NoError(t, err)
 
 	// set up an agent server and a client that uses agent for forwarding
@@ -348,10 +368,8 @@ func TestTerminalSizeRequest(t *testing.T) {
 		// initiating the client request for the window size to prevent flakiness.
 		require.EventuallyWithT(t, func(t *assert.CollectT) {
 			size, err := f.ssh.srv.termHandlers.SessionRegistry.GetTerminalSize(sessionID)
-			if assert.NoError(t, err) {
-				return
-			}
-			assert.Empty(t, cmp.Diff(expectedSize, size, cmp.AllowUnexported(term.Winsize{})))
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(expectedSize, *size, cmp.AllowUnexported(term.Winsize{})))
 		}, 10*time.Second, 100*time.Millisecond)
 
 		// Send a request for the window size now that we know the window change
@@ -452,9 +470,19 @@ loop:
 // events for networking requests.
 // See https://github.com/gravitational/teleport/issues/48728.
 func TestSessionAuditLog(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	t.Parallel()
-	f := newFixtureWithoutDiskBasedLogging(t)
+
+	f := newCustomFixture(t, func(cfg *authtest.ServerConfig) {
+		cfg.Auth.AuditLog = events.NewDiscardAuditLog()
+	})
+
+	// use a sync recording mode because the disk-based uploader
+	// that runs in the background introduces races with test cleanup
+	recConfig := types.DefaultSessionRecordingConfig()
+	recConfig.SetMode(types.RecordAtNodeSync)
+	_, err := f.testSrv.Auth().UpsertSessionRecordingConfig(t.Context(), recConfig)
+	require.NoError(t, err)
 
 	// Set up a mock emitter so we can capture audit events.
 	emitter := eventstest.NewChannelEmitter(32)
@@ -481,16 +509,6 @@ func TestSessionAuditLog(t *testing.T) {
 	_, err = f.testSrv.Auth().UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	nextEvent := func() apievents.AuditEvent {
-		select {
-		case event := <-emitter.C():
-			return event
-		case <-time.After(time.Second):
-			require.Fail(t, "timed out waiting for event")
-		}
-		return nil
-	}
-
 	// Start a new session
 	se, err := f.ssh.clt.NewSession(ctx)
 	require.NoError(t, err)
@@ -499,23 +517,23 @@ func TestSessionAuditLog(t *testing.T) {
 	err = se.Shell(ctx)
 	require.NoError(t, err)
 
-	e := nextEvent()
+	e := <-emitter.C()
 	startEvent, ok := e.(*apievents.SessionStart)
 	require.True(t, ok, "expected SessionStart event but got event of type %T", e)
 	require.NotEmpty(t, startEvent.SessionID, "expected non empty sessionID")
 	sessionID := startEvent.SessionID
 
 	// Request agent forwarding, no individual event emitted.
-	err = agent.RequestAgentForwarding(se.Session)
+	err = sshagent.RequestAgentForwarding(ctx, se)
 	require.NoError(t, err)
 
 	// Request x11 forwarding, event should be emitted immediately.
 	clientXAuthEntry, err := x11.NewFakeXAuthEntry(x11.Display{})
 	require.NoError(t, err)
-	err = x11.RequestForwarding(se.Session, clientXAuthEntry)
+	err = x11.RequestForwarding(ctx, se, clientXAuthEntry)
 	require.NoError(t, err)
 
-	x11Event := nextEvent()
+	x11Event := <-emitter.C()
 	require.IsType(t, &apievents.X11Forward{}, x11Event, "expected X11Forward event but got event of tgsype %T", x11Event)
 
 	// LOCAL PORT FORWARDING
@@ -529,10 +547,10 @@ func TestSessionAuditLog(t *testing.T) {
 	// Each locally forwarded dial should result in a new "start" event and each closed connection should result in a "stop"
 	// event. Note that we don't know what port the server will forward the connection on, so we don't have an easy way to validate the
 	// event's addr field.
-	localConn, err := f.ssh.clt.DialContext(context.Background(), "tcp", nonForwardServer.Listener.Addr().String())
+	localConn, err := f.ssh.clt.DialContext(t.Context(), "tcp", nonForwardServer.Listener.Addr().String())
 	require.NoError(t, err)
 
-	e = nextEvent()
+	e = <-emitter.C()
 	localForwardStart, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, events.PortForwardLocalEvent, localForwardStart.GetType())
@@ -541,7 +559,7 @@ func TestSessionAuditLog(t *testing.T) {
 
 	// closed connections should result in PortForwardLocal stop events
 	localConn.Close()
-	e = nextEvent()
+	e = <-emitter.C()
 	localForwardStop, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, events.PortForwardLocalEvent, localForwardStop.GetType())
@@ -553,7 +571,7 @@ func TestSessionAuditLog(t *testing.T) {
 	listener, err := f.ssh.clt.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
-	e = nextEvent()
+	e = <-emitter.C()
 	remoteForwardStart, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, listener.Addr().String(), remoteForwardStart.Addr)
@@ -573,14 +591,14 @@ func TestSessionAuditLog(t *testing.T) {
 	// addr field.
 	remoteConn, err := net.Dial("tcp", listener.Addr().String())
 	require.NoError(t, err)
-	e = nextEvent()
+	e = <-emitter.C()
 	remoteConnStart, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, events.PortForwardRemoteConnEvent, remoteConnStart.GetType())
 	require.Equal(t, events.PortForwardCode, remoteConnStart.GetCode())
 
 	remoteConn.Close()
-	e = nextEvent()
+	e = <-emitter.C()
 	remoteConnStop, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, events.PortForwardRemoteConnEvent, remoteConnStop.GetType())
@@ -588,7 +606,7 @@ func TestSessionAuditLog(t *testing.T) {
 
 	// Closing the server (and therefore the listener) should generate an PortForwardRemote stop event
 	remoteForwardServer.Close()
-	e = nextEvent()
+	e = <-emitter.C()
 	remoteForwardStop, ok := e.(*apievents.PortForward)
 	require.True(t, ok, "expected PortForward event but got event of type %T", e)
 	require.Equal(t, events.PortForwardRemoteEvent, remoteForwardStop.GetType())
@@ -598,26 +616,26 @@ func TestSessionAuditLog(t *testing.T) {
 	// End the session. Session leave, data, and end events should be emitted.
 	se.Close()
 
-	e = nextEvent()
+	e = <-emitter.C()
 	leaveEvent, ok := e.(*apievents.SessionLeave)
 	require.True(t, ok, "expected SessionLeave event but got event of type %T", e)
 	require.Equal(t, sessionID, leaveEvent.SessionID)
 
-	e = nextEvent()
+	e = <-emitter.C()
 	dataEvent, ok := e.(*apievents.SessionData)
 	require.True(t, ok, "expected SessionData event but got event of type %T", e)
 	require.Equal(t, sessionID, dataEvent.SessionID)
 
-	e = nextEvent()
+	e = <-emitter.C()
 	endEvent, ok := e.(*apievents.SessionEnd)
 	require.True(t, ok, "expected SessionEnd event but got event of type %T", e)
 	require.Equal(t, sessionID, endEvent.SessionID)
 }
 
-func newProxyClient(t *testing.T, testSvr *auth.TestServer) (*authclient.Client, string) {
+func newProxyClient(t *testing.T, testSvr *authtest.Server) (*authclient.Client, string) {
 	// create proxy client used in some tests
 	proxyID := uuid.New().String()
-	proxyClient, err := testSvr.NewClient(auth.TestIdentity{
+	proxyClient, err := testSvr.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleProxy,
 			Username: proxyID,
@@ -627,9 +645,9 @@ func newProxyClient(t *testing.T, testSvr *auth.TestServer) (*authclient.Client,
 	return proxyClient, proxyID
 }
 
-func newNodeClient(t *testing.T, testSvr *auth.TestServer) (*authclient.Client, string) {
+func newNodeClient(t *testing.T, testSvr *authtest.Server) (*authclient.Client, string) {
 	nodeID := uuid.New().String()
-	nodeClient, err := testSvr.NewClient(auth.TestIdentity{
+	nodeClient, err := testSvr.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: nodeID,
@@ -650,8 +668,8 @@ func startReadAll(r io.Reader) <-chan []byte {
 	return ch
 }
 
-func waitForBytes(ch <-chan []byte) ([]byte, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+func waitForBytes(ctx context.Context, ch <-chan []byte) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 
 	select {
@@ -671,7 +689,7 @@ func TestInactivityTimeout(t *testing.T) {
 	//  * a running SSH server configured with a given disconnection message
 	//  * a client connected to the SSH server,
 	//  * an SSH session running over the client connection
-	mutateCfg := func(cfg *auth.TestServerConfig) {
+	mutateCfg := func(cfg *authtest.ServerConfig) {
 		networkCfg := types.DefaultClusterNetworkingConfig()
 		networkCfg.SetClientIdleTimeout(5 * time.Second)
 		networkCfg.SetClientIdleTimeoutMessage(timeoutMessage)
@@ -703,7 +721,7 @@ func TestInactivityTimeout(t *testing.T) {
 			"Timed out waiting for session to finish")
 
 		// Expect that the idle timeout has been delivered via stderr
-		text, err := waitForBytes(stdErrCh)
+		text, err := waitForBytes(t.Context(), stdErrCh)
 		require.NoError(t, err)
 		require.Equal(t, timeoutMessage, string(text))
 	}
@@ -714,7 +732,7 @@ func TestInactivityTimeout(t *testing.T) {
 		// If all goes well, the client will be closed by the time cleanup happens,
 		// so change the assertion on closing the client to expect it to fail
 		f.ssh.assertCltClose = require.Error
-		se, err := f.ssh.clt.NewSession(context.Background())
+		se, err := f.ssh.clt.NewSessionWithParams(t.Context(), nil)
 		require.NoError(t, err)
 		t.Cleanup(func() { require.NoError(t, err) })
 		waitForTimeout(t, f, se)
@@ -726,7 +744,7 @@ func TestInactivityTimeout(t *testing.T) {
 		// If all goes well, the client will be closed by the time cleanup happens,
 		// so change the assertion on closing the client to expect it to fail
 		f.ssh.assertCltClose = require.Error
-		se, err := f.ssh.clt.NewSession(context.Background())
+		se, err := f.ssh.clt.NewSessionWithParams(t.Context(), nil)
 		require.NoError(t, err)
 		t.Cleanup(func() { require.NoError(t, err) })
 
@@ -756,7 +774,7 @@ func TestInactivityTimeout(t *testing.T) {
 
 func TestLockInForce(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 	f := newFixtureWithoutDiskBasedLogging(t)
 
 	// If all goes well, the client will be closed by the time cleanup happens,
@@ -778,24 +796,44 @@ func TestLockInForce(t *testing.T) {
 		Target: types.LockTarget{Login: f.user},
 	})
 	require.NoError(t, err)
+
+	watcher := f.ssh.srv.GetLockWatcher()
+	sub, err := watcher.Subscribe(ctx, lock.Target())
+	require.NoError(t, err)
+
 	require.NoError(t, f.testSrv.Auth().UpsertLock(ctx, lock))
 
-	// When I let the session idle (with the clock running at approx 10x speed)...
-	sessionHasFinished := func() bool {
-		f.clock.Advance(1 * time.Second)
+	// Wait for the lock to appear before proceeding.
+	timeout := time.After(20 * time.Second)
+	for wait := true; wait; {
 		select {
-		case <-endCh:
-			return true
-		default:
-			return false
+		case evt := <-sub.Events():
+			if evt.Type != types.OpPut {
+				continue
+			}
+
+			eventLock, ok := evt.Resource.(types.Lock)
+			require.True(t, ok)
+			require.Empty(t, cmp.Diff(lock.Target(), eventLock.Target()))
+			wait = false
+		case <-sub.Done():
+			t.Fatalf("lock subscription terminated unexpectedly %v", sub.Error())
+		case <-timeout:
+			t.Fatal("timed out waiting for lock target event")
 		}
 	}
-	require.Eventually(t, sessionHasFinished, 10*time.Second, 100*time.Millisecond,
-		"Timed out waiting for session to finish")
+	require.NoError(t, sub.Close())
+
+	// Expect the session to eventually be terminated because of the lock.
+	select {
+	case <-endCh:
+	case <-time.After(15 * time.Second):
+		t.Fatal("timed out waiting for session to finish")
+	}
 
 	// Expect the lock-in-force message to have been delivered via stderr.
 	lockInForceMsg := services.LockInForceAccessDenied(lock).Error()
-	text, err := waitForBytes(stdErrCh)
+	text, err := waitForBytes(t.Context(), stdErrCh)
 	require.NoError(t, err)
 	require.Equal(t, lockInForceMsg, string(text))
 
@@ -850,7 +888,7 @@ func setPortForwarding(t *testing.T, ctx context.Context, f *sshTestFixture, leg
 // channel to the target address. The "direct-tcpip" channel is what port
 // forwarding is built upon.
 func TestDirectTCPIP(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	setup := func(t *testing.T) (*sshTestFixture, *httptest.Server, *url.URL) {
 		f := newFixtureWithoutDiskBasedLogging(t)
@@ -877,7 +915,7 @@ func TestDirectTCPIP(t *testing.T) {
 		httpClient := http.Client{
 			Transport: &http.Transport{
 				Dial: func(network string, addr string) (net.Conn, error) {
-					return f.ssh.clt.DialContext(context.Background(), "tcp", u.Host)
+					return f.ssh.clt.DialContext(t.Context(), "tcp", u.Host)
 				},
 			},
 		}
@@ -910,7 +948,7 @@ func TestDirectTCPIP(t *testing.T) {
 		httpClient := http.Client{
 			Transport: &http.Transport{
 				Dial: func(network string, addr string) (net.Conn, error) {
-					return clientConn.DialContext(context.Background(), "tcp", u.Host)
+					return clientConn.DialContext(t.Context(), "tcp", u.Host)
 				},
 			},
 		}
@@ -938,7 +976,7 @@ func TestDirectTCPIP(t *testing.T) {
 		httpClient := http.Client{
 			Transport: &http.Transport{
 				Dial: func(network string, addr string) (net.Conn, error) {
-					return clientConn.DialContext(context.Background(), "tcp", u.Host)
+					return clientConn.DialContext(t.Context(), "tcp", u.Host)
 				},
 			},
 		}
@@ -955,7 +993,7 @@ func TestDirectTCPIP(t *testing.T) {
 
 		// Ensure that ssh client using SessionJoinPrincipal as Login, cannot
 		// connect using "direct-tcpip".
-		ctx := context.Background()
+		ctx := t.Context()
 		cliUsingSessionJoin := f.newSSHClient(ctx, t, &user.User{Username: teleport.SSHSessionJoinPrincipal})
 		httpClientUsingSessionJoin := http.Client{
 			Transport: &http.Transport{
@@ -974,8 +1012,6 @@ func TestDirectTCPIP(t *testing.T) {
 // "tcpip-forward" request and do remote port forwarding.
 func TestTCPIPForward(t *testing.T) {
 	t.Parallel()
-	hostname, err := os.Hostname()
-	require.NoError(t, err)
 	tests := []struct {
 		name        string
 		listenAddr  string
@@ -992,10 +1028,6 @@ func TestTCPIPForward(t *testing.T) {
 			name:       "ip address",
 			listenAddr: "127.0.0.1:0",
 		},
-		{
-			name:       "hostname",
-			listenAddr: hostname + ":0",
-		},
 		{
 			name:        "remote deny",
 			listenAddr:  "localhost:0",
@@ -1018,11 +1050,11 @@ func TestTCPIPForward(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			f := newFixtureWithoutDiskBasedLogging(t)
-			setPortForwarding(t, context.Background(), f, tc.legacyAllow, tc.remoteAllow, tc.localAllow)
+			setPortForwarding(t, t.Context(), f, tc.legacyAllow, tc.remoteAllow, tc.localAllow)
 
 			// create a new client connection to the node which will have its permissions
 			// calculated with the updated rules.
-			clientConn, err := tracessh.Dial(context.Background(), "tcp", f.ssh.srvAddress, f.ssh.cltConfig)
+			clientConn, err := tracessh.Dial(t.Context(), "tcp", f.ssh.srvAddress, f.ssh.cltConfig)
 			require.NoError(t, err)
 			defer clientConn.Close()
 
@@ -1044,7 +1076,7 @@ func TestTCPIPForward(t *testing.T) {
 			ts.Start()
 
 			// Dial the test server over the SSH connection.
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 			t.Cleanup(cancel)
 			req, err := http.NewRequestWithContext(ctx, http.MethodGet, ts.URL, nil)
 			require.NoError(t, err)
@@ -1066,7 +1098,7 @@ func TestTCPIPForward(t *testing.T) {
 		// Ensure that ssh client using SessionJoinPrincipal as Login, cannot
 		// connect using "tcpip-forward".
 		f := newFixtureWithoutDiskBasedLogging(t)
-		ctx := context.Background()
+		ctx := t.Context()
 		cliUsingSessionJoin := f.newSSHClient(ctx, t, &user.User{Username: teleport.SSHSessionJoinPrincipal})
 		_, err := cliUsingSessionJoin.Listen("tcp", "127.0.0.1:0")
 		require.ErrorContains(t, err, "ssh: tcpip-forward request denied by peer")
@@ -1108,7 +1140,7 @@ func TestAgentForwardPermission(t *testing.T) {
 	t.Parallel()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// make sure the role does not allow agent forwarding
 	roleName := services.RoleNameForUser(f.user)
@@ -1133,7 +1165,7 @@ func TestAgentForwardPermission(t *testing.T) {
 
 	// to interoperate with OpenSSH, requests for agent forwarding always succeed.
 	// however that does not mean the users agent will actually be forwarded.
-	require.NoError(t, agent.RequestAgentForwarding(se.Session))
+	require.NoError(t, sshagent.RequestAgentForwarding(ctx, se))
 
 	// the output of env, we should not see SSH_AUTH_SOCK in the output
 	output, err := se.Output(ctx, "env")
@@ -1148,7 +1180,7 @@ func TestMaxSessions(t *testing.T) {
 
 	const maxSessions int64 = 2
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 	// make sure the role does not allow agent forwarding
 	roleName := services.RoleNameForUser(f.user)
 	role, err := f.testSrv.Auth().GetRole(ctx, roleName)
@@ -1190,7 +1222,7 @@ func TestMaxSessions(t *testing.T) {
 func TestExecLongCommand(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// Get the path to where the "echo" command is on disk.
 	echoPath, err := exec.LookPath("echo")
@@ -1210,7 +1242,7 @@ func TestExecLongCommand(t *testing.T) {
 func TestOpenExecSessionSetsSession(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	se, err := f.ssh.clt.NewSession(ctx)
 	require.NoError(t, err)
@@ -1228,7 +1260,7 @@ func TestAgentForward(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
 
-	ctx := context.Background()
+	ctx := t.Context()
 	roleName := services.RoleNameForUser(f.user)
 	role, err := f.testSrv.Auth().GetRole(ctx, roleName)
 	require.NoError(t, err)
@@ -1242,7 +1274,7 @@ func TestAgentForward(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { se.Close() })
 
-	err = agent.RequestAgentForwarding(se.Session)
+	err = sshagent.RequestAgentForwarding(ctx, se)
 	require.NoError(t, err)
 
 	// prepare to send virtual "keyboard input" into the shell:
@@ -1322,7 +1354,7 @@ func TestAgentForward(t *testing.T) {
 
 // TestX11Forward tests x11 forwarding via unix sockets
 func TestX11Forward(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	if os.Getenv("TELEPORT_XAUTH_TEST") == "" {
 		t.Skip("Skipping test as xauth is not enabled")
 	}
@@ -1382,7 +1414,7 @@ func TestX11Forward(t *testing.T) {
 // echoing XServer requests received back to the client. Returns the Display opened on the
 // session, which is set in $DISPLAY.
 func x11EchoSession(ctx context.Context, t *testing.T, clt *tracessh.Client) x11.Display {
-	se, err := clt.NewSession(context.Background())
+	se, err := clt.NewSessionWithParams(ctx, nil)
 	require.NoError(t, err)
 	t.Cleanup(func() { se.Close() })
 
@@ -1432,7 +1464,7 @@ func x11EchoSession(ctx context.Context, t *testing.T, clt *tracessh.Client) x11
 	// Client requests x11 forwarding for the server session.
 	clientXAuthEntry, err := x11.NewFakeXAuthEntry(x11.Display{})
 	require.NoError(t, err)
-	err = x11.RequestForwarding(se.Session, clientXAuthEntry)
+	err = x11.RequestForwarding(ctx, se, clientXAuthEntry)
 	require.NoError(t, err)
 
 	// prepare to send virtual "keyboard input" into the shell:
@@ -1515,21 +1547,14 @@ func TestAllowedUsers(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
 
-	up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
-	sshConfig := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
+	sshConfig := f.SSHClientConfig()
 
-	client, err := tracessh.Dial(context.Background(), "tcp", f.ssh.srv.Addr(), sshConfig)
+	client, err := tracessh.Dial(t.Context(), "tcp", f.ssh.srv.Addr(), sshConfig)
 	require.NoError(t, err)
 	require.NoError(t, client.Close())
 
 	// now remove OS user from valid principals
-	up, err = newUpack(f.testSrv, f.user, []string{"otheruser"}, wildcardAllow)
+	up, err := newUpack(t.Context(), f.testSrv, f.user, []string{"otheruser"}, wildcardAllow)
 	require.NoError(t, err)
 
 	sshConfig = &ssh.ClientConfig{
@@ -1538,13 +1563,24 @@ func TestAllowedUsers(t *testing.T) {
 		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
 	}
 
-	_, err = tracessh.Dial(context.Background(), "tcp", f.ssh.srv.Addr(), sshConfig)
+	_, err = tracessh.Dial(t.Context(), "tcp", f.ssh.srv.Addr(), sshConfig)
 	require.Error(t, err)
 }
 
 func TestAllowedLabels(t *testing.T) {
 	t.Parallel()
-	f := newFixtureWithoutDiskBasedLogging(t)
+	f := newFixtureWithoutDiskBasedLogging(t,
+		SetLabels(
+			map[string]string{"foo": "bar"},
+			services.CommandLabels{
+				"baz": &types.CommandLabelV2{
+					Period:  types.NewDuration(time.Second),
+					Command: []string{"expr", "1", "+", "3"},
+				},
+			},
+			nil,
+		),
+	)
 
 	tests := []struct {
 		desc       string
@@ -1579,7 +1615,7 @@ func TestAllowedLabels(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			up, err := newUpack(f.testSrv, f.user, []string{f.user}, tt.inLabelMap)
+			up, err := newUpack(t.Context(), f.testSrv, f.user, []string{f.user}, tt.inLabelMap)
 			require.NoError(t, err)
 
 			sshConfig := &ssh.ClientConfig{
@@ -1588,7 +1624,7 @@ func TestAllowedLabels(t *testing.T) {
 				HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
 			}
 
-			_, err = tracessh.Dial(context.Background(), "tcp", f.ssh.srv.Addr(), sshConfig)
+			_, err = tracessh.Dial(t.Context(), "tcp", f.ssh.srv.Addr(), sshConfig)
 			if tt.outError {
 				require.Error(t, err)
 			} else {
@@ -1601,7 +1637,7 @@ func TestAllowedLabels(t *testing.T) {
 func TestInvalidSessionID(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	session, err := f.ssh.clt.NewSession(ctx)
 	require.NoError(t, err)
@@ -1615,7 +1651,7 @@ func TestInvalidSessionID(t *testing.T) {
 
 func TestSessionHijack(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 	_, err := user.Lookup(teleportTestUser)
 	if err != nil {
 		t.Skipf("user %v is not found, skipping test", teleportTestUser)
@@ -1623,25 +1659,7 @@ func TestSessionHijack(t *testing.T) {
 
 	f := newFixtureWithoutDiskBasedLogging(t)
 
-	// user 1 has access to the server
-	up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
-	// login with first user
-	sshConfig := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
-
-	client, err := tracessh.Dial(ctx, "tcp", f.ssh.srv.Addr(), sshConfig)
-	require.NoError(t, err)
-	defer func() {
-		err := client.Close()
-		require.NoError(t, err)
-	}()
-
-	se, err := client.NewSession(ctx)
+	se, err := f.ssh.clt.NewSession(ctx)
 	require.NoError(t, err)
 	defer se.Close()
 
@@ -1653,7 +1671,7 @@ func TestSessionHijack(t *testing.T) {
 	require.NoError(t, err)
 
 	// user 2 does not have s.user as a listed principal
-	up2, err := newUpack(f.testSrv, teleportTestUser, []string{teleportTestUser}, wildcardAllow)
+	up2, err := newUpack(t.Context(), f.testSrv, teleportTestUser, []string{teleportTestUser}, wildcardAllow)
 	require.NoError(t, err)
 
 	sshConfig2 := &ssh.ClientConfig{
@@ -1683,7 +1701,7 @@ func TestSessionHijack(t *testing.T) {
 
 // testClient dials targetAddr via proxyAddr and executes 2+3 command
 func testClient(t *testing.T, f *sshTestFixture, proxyAddr, targetAddr, remoteAddr string, sshConfig *ssh.ClientConfig) {
-	ctx := context.Background()
+	ctx := t.Context()
 	// Connect to node using registered address
 	client, err := tracessh.Dial(ctx, "tcp", proxyAddr, sshConfig)
 	require.NoError(t, err)
@@ -1718,7 +1736,7 @@ func testClient(t *testing.T, f *sshTestFixture, proxyAddr, targetAddr, remoteAd
 	defer pipeNetConn.Close()
 
 	// Open SSH connection via TCP
-	conn, chans, reqs, err := tracessh.NewClientConn(
+	conn, chans, reqs, err := tracessh.NewClientConnWithTimeout(
 		ctx,
 		pipeNetConn,
 		f.ssh.srv.Addr(),
@@ -1757,7 +1775,7 @@ func TestProxyRoundRobin(t *testing.T) {
 	t.Parallel()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	proxyClient, _ := newProxyClient(t, f.testSrv)
 	nodeClient, _ := newNodeClient(t, f.testSrv)
@@ -1795,7 +1813,7 @@ func TestProxyRoundRobin(t *testing.T) {
 	router, err := libproxy.NewRouter(libproxy.RouterConfig{
 		ClusterName:      f.testSrv.ClusterName(),
 		LocalAccessPoint: proxyClient,
-		SiteGetter:       reverseTunnelServer,
+		ClusterGetter:    reverseTunnelServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -1820,6 +1838,7 @@ func TestProxyRoundRobin(t *testing.T) {
 		"",
 		utils.NetAddr{},
 		proxyClient,
+		SetUUID(uuid.NewString()),
 		SetProxyMode("", reverseTunnelServer, proxyClient, router),
 		SetEmitter(nodeClient),
 		SetNamespace(apidefaults.Namespace),
@@ -1828,15 +1847,12 @@ func TestProxyRoundRobin(t *testing.T) {
 		SetClock(f.clock),
 		SetLockWatcher(lockWatcher),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	)
 	require.NoError(t, err)
 	require.NoError(t, proxy.Start())
 	defer proxy.Close()
 
-	// set up SSH client using the user private key for signing
-	up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
 	resolver := func(context.Context) (*utils.NetAddr, types.ProxyListenerMode, error) {
 		return &utils.NetAddr{Addr: reverseTunnelAddress.Addr, AddrNetwork: "tcp"}, types.ProxyListenerMode_Separate, nil
 	}
@@ -1846,7 +1862,7 @@ func TestProxyRoundRobin(t *testing.T) {
 		Client:      proxyClient,
 		AccessPoint: proxyClient,
 		AuthMethods: []ssh.AuthMethod{ssh.PublicKeys(f.signer)},
-		HostUUID:    fmt.Sprintf("%v.%v", hostID, f.testSrv.ClusterName()),
+		HostUUID:    hostID + "." + f.testSrv.ClusterName(),
 		Cluster:     "remote",
 	})
 	require.NoError(t, err)
@@ -1860,7 +1876,7 @@ func TestProxyRoundRobin(t *testing.T) {
 		Client:      proxyClient,
 		AccessPoint: proxyClient,
 		AuthMethods: []ssh.AuthMethod{ssh.PublicKeys(f.signer)},
-		HostUUID:    fmt.Sprintf("%v.%v", hostID, f.testSrv.ClusterName()),
+		HostUUID:    hostID + "." + f.testSrv.ClusterName(),
 		Cluster:     "remote",
 	})
 	require.NoError(t, err)
@@ -1869,25 +1885,31 @@ func TestProxyRoundRobin(t *testing.T) {
 	require.NoError(t, err)
 	defer pool2.Stop()
 
-	sshConfig := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
-
-	_, err = newUpack(f.testSrv, "user1", []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
+	sshConfig := f.SSHClientConfig()
 
-	for i := 0; i < 3; i++ {
-		testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), sshConfig)
+	var wg sync.WaitGroup
+	for range 3 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), sshConfig)
+		}()
 	}
 
+	wg.Wait()
+
 	// close first connection, and test it again
 	pool1.Stop()
 
-	for i := 0; i < 3; i++ {
-		testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), sshConfig)
+	for range 3 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), sshConfig)
+		}()
 	}
+
+	wg.Wait()
 }
 
 // TestProxyDirectAccess tests direct access via proxy bypassing
@@ -1896,7 +1918,7 @@ func TestProxyDirectAccess(t *testing.T) {
 	t.Parallel()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	listener, _ := mustListen(t)
 	proxyClient, _ := newProxyClient(t, f.testSrv)
@@ -1933,7 +1955,7 @@ func TestProxyDirectAccess(t *testing.T) {
 	router, err := libproxy.NewRouter(libproxy.RouterConfig{
 		ClusterName:      f.testSrv.ClusterName(),
 		LocalAccessPoint: proxyClient,
-		SiteGetter:       reverseTunnelServer,
+		ClusterGetter:    reverseTunnelServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -1958,6 +1980,7 @@ func TestProxyDirectAccess(t *testing.T) {
 		"",
 		utils.NetAddr{},
 		proxyClient,
+		SetUUID(uuid.NewString()),
 		SetProxyMode("", reverseTunnelServer, proxyClient, router),
 		SetEmitter(nodeClient),
 		SetNamespace(apidefaults.Namespace),
@@ -1966,31 +1989,19 @@ func TestProxyDirectAccess(t *testing.T) {
 		SetClock(f.clock),
 		SetLockWatcher(lockWatcher),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	)
 	require.NoError(t, err)
 	require.NoError(t, proxy.Start())
 	defer proxy.Close()
 
-	// set up SSH client using the user private key for signing
-	up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
-	sshConfig := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
-
-	_, err = newUpack(f.testSrv, "user1", []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
-	testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), sshConfig)
+	testClient(t, f, proxy.Addr(), f.ssh.srvAddress, f.ssh.srv.Addr(), f.SSHClientConfig())
 }
 
 // TestPTY requests PTY for an interactive session
 func TestPTY(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
 
@@ -2009,7 +2020,7 @@ func TestPTY(t *testing.T) {
 // a "env" request.
 func TestEnv(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
 
@@ -2027,7 +2038,7 @@ func TestEnv(t *testing.T) {
 // a "envs@goteleport.com" request.
 func TestEnvs(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
 
@@ -2054,7 +2065,7 @@ func TestEnvs(t *testing.T) {
 // requests do not terminate the session.
 func TestUnknownRequest(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
 
@@ -2079,7 +2090,7 @@ func TestNoAuth(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
 
-	_, err := tracessh.Dial(context.Background(), "tcp", f.ssh.srv.Addr(), &ssh.ClientConfig{})
+	_, err := tracessh.Dial(t.Context(), "tcp", f.ssh.srv.Addr(), &ssh.ClientConfig{})
 	require.Error(t, err)
 }
 
@@ -2091,21 +2102,16 @@ func TestPasswordAuth(t *testing.T) {
 		Auth:            []ssh.AuthMethod{ssh.Password("")},
 		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
 	}
-	_, err := tracessh.Dial(context.Background(), "tcp", f.ssh.srv.Addr(), config)
+	_, err := tracessh.Dial(t.Context(), "tcp", f.ssh.srv.Addr(), config)
 	require.Error(t, err)
 }
 
 func TestClientDisconnect(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
-	config := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(f.up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
-	clt, err := tracessh.Dial(ctx, "tcp", f.ssh.srv.Addr(), config)
+	clt, err := tracessh.Dial(ctx, "tcp", f.ssh.srv.Addr(), f.SSHClientConfig())
 	require.NoError(t, err)
 	require.NotNil(t, clt)
 
@@ -2118,7 +2124,7 @@ func TestClientDisconnect(t *testing.T) {
 func TestLimiter(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	getConns := func(t *testing.T, limiter *limiter.Limiter, token string, num int64) func() bool {
 		return func() bool {
@@ -2172,6 +2178,7 @@ func TestLimiter(t *testing.T) {
 		"",
 		utils.NetAddr{},
 		nodeClient,
+		SetUUID(uuid.NewString()),
 		SetLimiter(limiter),
 		SetEmitter(nodeClient),
 		SetNamespace(apidefaults.Namespace),
@@ -2180,17 +2187,14 @@ func TestLimiter(t *testing.T) {
 		SetClock(f.clock),
 		SetLockWatcher(lockWatcher),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	)
 	require.NoError(t, err)
 	require.NoError(t, srv.Start())
 
 	defer srv.Close()
 
-	config := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(f.up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
+	config := f.SSHClientConfig()
 
 	clt0, err := tracessh.Dial(ctx, "tcp", srv.Addr(), config)
 	require.NoError(t, err)
@@ -2256,7 +2260,7 @@ func TestServerAliveInterval(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
 
-	ok, _, err := f.ssh.clt.SendRequest(context.Background(), teleport.KeepAliveReqType, true, nil)
+	ok, _, err := f.ssh.clt.SendRequest(t.Context(), teleport.KeepAliveReqType, true, nil)
 	require.NoError(t, err)
 	require.True(t, ok)
 }
@@ -2265,7 +2269,7 @@ func TestServerAliveInterval(t *testing.T) {
 // cluster-details@goteleport.com request.
 func TestGlobalRequestClusterDetails(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
+	ctx := t.Context()
 
 	cases := []struct {
 		name     string
@@ -2316,7 +2320,7 @@ func TestGlobalRequestClusterDetails(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			f := newCustomFixture(t, func(*auth.TestServerConfig) {}, SetFIPS(tt.fips))
+			f := newCustomFixture(t, func(*authtest.ServerConfig) {}, SetFIPS(tt.fips))
 			recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{Mode: tt.mode})
 			require.NoError(t, err)
 
@@ -2370,11 +2374,11 @@ func newRawNode(t *testing.T, authSrv *auth.Server) *rawNode {
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPub, err := auth.PrivateKeyToPublicKeyTLS(priv)
+	tlsPub, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	// Create host key and certificate for node.
-	certs, err := authSrv.GenerateHostCerts(context.Background(),
+	certs, err := authSrv.GenerateHostCerts(t.Context(),
 		&proto.HostCertsRequest{
 			HostID:               "raw-node",
 			NodeName:             "raw-node",
@@ -2383,7 +2387,7 @@ func newRawNode(t *testing.T, authSrv *auth.Server) *rawNode {
 			DNSNames:             []string{hostname},
 			PublicSSHKey:         pub,
 			PublicTLSKey:         tlsPub,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	signer, err := sshutils.NewSigner(priv, certs.SSH)
@@ -2526,7 +2530,7 @@ func startGatheringErrors(ctx context.Context, errCh <-chan error) <-chan []erro
 // requireNoErrors waits for any aggregated errors to appear on the supplied channel
 // and asserts that the aggregation is empty
 func requireNoErrors(t *testing.T, errsCh <-chan []error) {
-	timeoutCtx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	timeoutCtx, cancel := context.WithTimeout(t.Context(), 1*time.Second)
 	defer cancel()
 
 	select {
@@ -2540,7 +2544,7 @@ func requireNoErrors(t *testing.T, errsCh <-chan []error) {
 
 // TestParseSubsystemRequest verifies parseSubsystemRequest accepts the correct subsystems in depending on the runtime configuration.
 func TestParseSubsystemRequest(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// start a listener to accept connections; this will be needed for the proxy test to pass, otherwise nothing will be there to handle the call.
 	agentlessListener, err := net.Listen("tcp", "localhost:0")
@@ -2575,7 +2579,7 @@ func TestParseSubsystemRequest(t *testing.T) {
 	getNonProxySession := func() func() *tracessh.Session {
 		f := newFixtureWithoutDiskBasedLogging(t, SetAllowFileCopying(true))
 		return func() *tracessh.Session {
-			se, err := f.ssh.clt.NewSession(context.Background())
+			se, err := f.ssh.clt.NewSessionWithParams(t.Context(), nil)
 			require.NoError(t, err)
 			t.Cleanup(func() { _ = se.Close() })
 			return se
@@ -2622,7 +2626,7 @@ func TestParseSubsystemRequest(t *testing.T) {
 		router, err := libproxy.NewRouter(libproxy.RouterConfig{
 			ClusterName:      f.testSrv.ClusterName(),
 			LocalAccessPoint: proxyClient,
-			SiteGetter:       reverseTunnelServer,
+			ClusterGetter:    reverseTunnelServer,
 			TracerProvider:   tracing.NoopProvider(),
 		})
 		require.NoError(t, err)
@@ -2647,6 +2651,7 @@ func TestParseSubsystemRequest(t *testing.T) {
 			"",
 			utils.NetAddr{},
 			proxyClient,
+			SetUUID(uuid.NewString()),
 			SetProxyMode("", reverseTunnelServer, proxyClient, router),
 			SetEmitter(nodeClient),
 			SetNamespace(apidefaults.Namespace),
@@ -2655,24 +2660,15 @@ func TestParseSubsystemRequest(t *testing.T) {
 			SetClock(f.clock),
 			SetLockWatcher(lockWatcher),
 			SetSessionController(sessionController),
+			setChildLogConfigForTest(),
 		)
 		require.NoError(t, err)
 		require.NoError(t, proxy.Start())
 		t.Cleanup(func() { _ = proxy.Close() })
 
-		// set up SSH client using the user private key for signing
-		up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-		require.NoError(t, err)
-
 		return func() *tracessh.Session {
-			sshConfig := &ssh.ClientConfig{
-				User:            f.user,
-				Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-				HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-			}
-
 			// Connect SSH client to proxy
-			client, err := tracessh.Dial(ctx, "tcp", proxy.Addr(), sshConfig)
+			client, err := tracessh.Dial(ctx, "tcp", proxy.Addr(), f.SSHClientConfig())
 
 			require.NoError(t, err)
 			t.Cleanup(func() { _ = client.Close() })
@@ -2793,7 +2789,7 @@ func TestX11ProxySupport(t *testing.T) {
 	cltConfig.HostKeyCallback = ssh.InsecureIgnoreHostKey()
 
 	// Perform ssh handshake and setup client for X11 test server.
-	cltConn, chs, reqs, err := tracessh.NewClientConn(ctx, netConn, node.addr, &cltConfig)
+	cltConn, chs, reqs, err := tracessh.NewClientConnWithTimeout(ctx, netConn, node.addr, &cltConfig)
 	require.NoError(t, err)
 	clt := tracessh.NewClient(cltConn, chs, reqs)
 
@@ -2845,7 +2841,7 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 	t.Parallel()
 
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	listener, _ := mustListen(t)
 	proxyClient, _ := newProxyClient(t, f.testSrv)
@@ -2881,7 +2877,7 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 	router, err := libproxy.NewRouter(libproxy.RouterConfig{
 		ClusterName:      f.testSrv.ClusterName(),
 		LocalAccessPoint: proxyClient,
-		SiteGetter:       reverseTunnelServer,
+		ClusterGetter:    reverseTunnelServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -2906,6 +2902,7 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 		"",
 		utils.NetAddr{},
 		proxyClient,
+		SetUUID(uuid.NewString()),
 		SetProxyMode("", reverseTunnelServer, proxyClient, router),
 		SetEmitter(nodeClient),
 		SetNamespace(apidefaults.Namespace),
@@ -2914,26 +2911,14 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 		SetClock(f.clock),
 		SetLockWatcher(lockWatcher),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	)
 	require.NoError(t, err)
 	require.NoError(t, proxy.Start())
 	defer proxy.Close()
 
-	// set up SSH client using the user private key for signing
-	up, err := newUpack(f.testSrv, f.user, []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
-	sshConfig := &ssh.ClientConfig{
-		User:            f.user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(up.certSigner)},
-		HostKeyCallback: ssh.FixedHostKey(f.signer.PublicKey()),
-	}
-
-	_, err = newUpack(f.testSrv, "user1", []string{f.user}, wildcardAllow)
-	require.NoError(t, err)
-
 	// Connect SSH client to proxy
-	client, err := tracessh.Dial(ctx, "tcp", proxy.Addr(), sshConfig)
+	client, err := tracessh.Dial(ctx, "tcp", proxy.Addr(), f.SSHClientConfig())
 
 	require.NoError(t, err)
 	defer client.Close()
@@ -2972,8 +2957,7 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 	defer pipeNetConn.Close()
 
 	// Open SSH connection via proxy subsystem's TCP tunnel
-	conn, chans, reqs, err := tracessh.NewClientConn(ctx, pipeNetConn,
-		f.ssh.srv.Addr(), sshConfig)
+	conn, chans, reqs, err := tracessh.NewClientConnWithTimeout(ctx, pipeNetConn, f.ssh.srv.Addr(), f.SSHClientConfig())
 	require.NoError(t, err)
 	defer conn.Close()
 
@@ -2997,7 +2981,7 @@ func TestIgnorePuTTYSimpleChannel(t *testing.T) {
 func TestHandlePuTTYWinadj(t *testing.T) {
 	t.Parallel()
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	se, err := f.ssh.clt.NewSession(ctx)
 	require.NoError(t, err)
@@ -3015,10 +2999,10 @@ func TestHandlePuTTYWinadj(t *testing.T) {
 	require.Equal(t, "hello once more\n", string(out))
 }
 
-func TestTargetMetadata(t *testing.T) {
-	ctx := context.Background()
-	testServer, err := auth.NewTestServer(auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+func TestEventMetadata(t *testing.T) {
+	ctx := t.Context()
+	testServer, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			ClusterName: "localhost",
 			Dir:         t.TempDir(),
 			Clock:       clockwork.NewFakeClock(),
@@ -3027,7 +3011,7 @@ func TestTargetMetadata(t *testing.T) {
 	require.NoError(t, err)
 
 	nodeID := uuid.New().String()
-	nodeClient, err := testServer.NewClient(auth.TestIdentity{
+	nodeClient, err := testServer.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: nodeID,
@@ -3067,6 +3051,7 @@ func TestTargetMetadata(t *testing.T) {
 		SetLockWatcher(lockWatcher),
 		SetX11ForwardingConfig(&x11.ServerConfig{}),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	}
 
 	sshSrv, err := New(
@@ -3082,7 +3067,7 @@ func TestTargetMetadata(t *testing.T) {
 		serverOptions...)
 	require.NoError(t, err)
 
-	metadata := sshSrv.TargetMetadata()
+	metadata := sshSrv.EventMetadata()
 	require.Equal(t, nodeID, metadata.ServerID)
 	require.Equal(t, apidefaults.Namespace, metadata.ServerNamespace)
 	require.Empty(t, metadata.ServerAddr)
@@ -3116,8 +3101,7 @@ type upack struct {
 	certSigner ssh.Signer
 }
 
-func newUpack(testSvr *auth.TestServer, username string, allowedLogins []string, allowedLabels types.Labels) (*upack, error) {
-	ctx := context.Background()
+func newUpack(ctx context.Context, testSvr *authtest.Server, username string, allowedLogins []string, allowedLabels types.Labels) (*upack, error) {
 	auth := testSvr.Auth()
 	upriv, upub, err := testauthority.New().GenerateKeyPair()
 	if err != nil {
@@ -3235,13 +3219,13 @@ func newCertAuthorityWatcher(ctx context.Context, t *testing.T, client types.Eve
 }
 
 // newSigner creates a new SSH signer that can be used by the Server.
-func newSigner(t testing.TB, ctx context.Context, testServer *auth.TestServer) ssh.Signer {
+func newSigner(t testing.TB, ctx context.Context, testServer *authtest.Server) ssh.Signer {
 	t.Helper()
 
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPub, err := auth.PrivateKeyToPublicKeyTLS(priv)
+	tlsPub, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	certs, err := testServer.Auth().GenerateHostCerts(ctx,
@@ -3251,7 +3235,7 @@ func newSigner(t testing.TB, ctx context.Context, testServer *auth.TestServer) s
 			Role:         types.RoleNode,
 			PublicSSHKey: pub,
 			PublicTLSKey: tlsPub,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	// set up user CA and set up a user that has access to the server
@@ -3276,7 +3260,7 @@ const maxPipeSize = 65536 + 1
 
 func TestHostUserCreationProxy(t *testing.T) {
 	f := newFixtureWithoutDiskBasedLogging(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	proxyClient, _ := newProxyClient(t, f.testSrv)
 	nodeClient, _ := newNodeClient(t, f.testSrv)
@@ -3314,7 +3298,7 @@ func TestHostUserCreationProxy(t *testing.T) {
 	router, err := libproxy.NewRouter(libproxy.RouterConfig{
 		ClusterName:      f.testSrv.ClusterName(),
 		LocalAccessPoint: proxyClient,
-		SiteGetter:       reverseTunnelServer,
+		ClusterGetter:    reverseTunnelServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -3339,6 +3323,7 @@ func TestHostUserCreationProxy(t *testing.T) {
 		"",
 		utils.NetAddr{},
 		proxyClient,
+		SetUUID(uuid.NewString()),
 		SetProxyMode("", reverseTunnelServer, proxyClient, router),
 		SetEmitter(nodeClient),
 		SetNamespace(apidefaults.Namespace),
@@ -3347,6 +3332,7 @@ func TestHostUserCreationProxy(t *testing.T) {
 		SetClock(f.clock),
 		SetLockWatcher(lockWatcher),
 		SetSessionController(sessionController),
+		setChildLogConfigForTest(),
 	)
 	require.NoError(t, err)
 
@@ -3550,3 +3536,125 @@ func (f *fakeHostUsersBackend) UserExists(name string) error {
 func (f *fakeHostUsersBackend) SetHostUserDeletionGrace(grace time.Duration) {
 	f.functionCalled("SetHostUserDeletionGrace")
 }
+
+func TestServerInfo(t *testing.T) {
+	scope := "/aa"
+	f := newFixtureWithoutDiskBasedLogging(t, SetScope(scope))
+	require.Equal(t, f.ssh.srv.scope, scope)
+	info, err := f.ssh.srv.getServerInfo(t.Context())
+	require.NoError(t, err)
+	require.Equal(t, scope, info.Scope)
+}
+
+func TestSessionParams(t *testing.T) {
+	f := newFixtureWithoutDiskBasedLogging(t)
+	ctx := t.Context()
+
+	// Start one session that can be used to test joining in the test cases below.
+	se, err := f.ssh.clt.NewSession(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, se.Close()) })
+	require.NoError(t, se.Shell(ctx))
+	sessions, err := f.ssh.srv.termHandlers.SessionRegistry.SessionTrackerService.GetActiveSessionTrackers(ctx)
+	require.NoError(t, err)
+	require.Len(t, sessions, 1)
+	joinSID := sessions[0].GetSessionID()
+
+	for _, baseCase := range []struct {
+		name   string
+		params *tracessh.SessionParams
+	}{
+		{
+			name: "new session",
+			params: &tracessh.SessionParams{
+				Reason:  "For science.",
+				Invited: []string{"Esqueleto"},
+			},
+		}, {
+			name: "join session",
+			params: &tracessh.SessionParams{
+				JoinSessionID: joinSID,
+				JoinMode:      types.SessionObserverMode,
+			},
+		},
+	} {
+		t.Run(baseCase.name, func(t *testing.T) {
+			envVars := map[string]string{
+				teleport.EnvSSHSessionReason: baseCase.params.Reason,
+				sshutils.SessionEnvVar:       baseCase.params.JoinSessionID,
+				teleport.EnvSSHJoinMode:      string(baseCase.params.JoinMode),
+			}
+			if baseCase.params.Invited != nil {
+				invitedJSON, err := json.Marshal(baseCase.params.Invited)
+				require.NoError(t, err)
+				envVars[teleport.EnvSSHSessionInvited] = string(invitedJSON)
+			}
+
+			for _, sessionCase := range []struct {
+				name    string
+				params  *tracessh.SessionParams
+				envVars map[string]string
+			}{
+				{
+					// TODO(Joerger): DELETE IN v20.0.0 - params are needed to join a session.
+					name:    "env vars only", // v18- client
+					params:  nil,
+					envVars: envVars,
+				}, {
+					// TODO(Joerger): DELETE IN v20.0.0 - only params are needed to join a session.
+					name:    "params and env vars", // v19 client
+					params:  baseCase.params,
+					envVars: envVars,
+				}, {
+					name:   "params only", // v20+ client
+					params: baseCase.params,
+				},
+			} {
+				t.Run(sessionCase.name, func(t *testing.T) {
+					sidC := make(chan string)
+					err := f.ssh.clt.HandleSessionRequest(ctx, teleport.CurrentSessionIDRequest, func(ctx context.Context, req *ssh.Request) {
+						sidC <- string(req.Payload)
+					})
+					require.NoError(t, err)
+
+					se, err := f.ssh.clt.NewSessionWithParams(ctx, sessionCase.params)
+					require.NoError(t, err)
+					t.Cleanup(func() { require.NoError(t, se.Close()) })
+
+					// If this isn't a join session, wait for the server to send the session ID.
+					sid := baseCase.params.JoinSessionID
+					if sid == "" {
+						select {
+						case sid = <-sidC:
+						case <-time.After(time.Second):
+							t.Fatalf("Failed to received session ID from server")
+						}
+					}
+
+					if sessionCase.envVars != nil {
+						err := se.SetEnvs(ctx, sessionCase.envVars)
+						require.NoError(t, err)
+					}
+
+					require.NoError(t, se.Shell(ctx))
+
+					sessionTracker, err := f.ssh.srv.termHandlers.SessionRegistry.SessionTrackerService.GetSessionTracker(ctx, sid)
+					require.NoError(t, err)
+
+					require.Equal(t, baseCase.params.Invited, sessionTracker.GetInvited())
+					require.Equal(t, baseCase.params.Reason, sessionTracker.GetReason())
+
+					participants := sessionTracker.GetParticipants()
+					if baseCase.params.JoinSessionID != "" {
+						require.Equal(t, baseCase.params.JoinSessionID, sid, "Expected to join session %q, but got a new session ID instead", baseCase.params.JoinSessionID)
+						require.Len(t, participants, 2)
+						require.Equal(t, string(baseCase.params.JoinMode), participants[1].Mode)
+					} else {
+						require.Len(t, participants, 1)
+						require.Equal(t, string(types.SessionPeerMode), participants[0].Mode)
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/lib/srv/regular/sshserver_unix_test.go b/lib/srv/regular/sshserver_unix_test.go
index ba70ba94e9060..d3df3afe3f929 100644
--- a/lib/srv/regular/sshserver_unix_test.go
+++ b/lib/srv/regular/sshserver_unix_test.go
@@ -29,15 +29,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 // BenchmarkRootExecCommand measures performance of running multiple exec requests
 // over a single ssh connection. The same test is run with and without host user
 // creation support to catch any performance degradation caused by user provisioning.
 func BenchmarkRootExecCommand(b *testing.B) {
-	utils.RequireRoot(b)
+	testutils.RequireRoot(b)
 
 	b.ReportAllocs()
 
@@ -66,14 +66,14 @@ func BenchmarkRootExecCommand(b *testing.B) {
 			for b.Loop() {
 				username := f.user
 				if test.createUser {
-					username = utils.GenerateLocalUsername(b)
+					username = testutils.GenerateLocalUsername(b)
 					b.Cleanup(func() { _, _ = host.UserDel(username) })
 				}
 
-				_, err := newUpack(f.testSrv, username, []string{username, f.user}, wildcardAllow)
+				_, err := newUpack(b.Context(), f.testSrv, username, []string{username, f.user}, wildcardAllow)
 				require.NoError(b, err)
 
-				clt := f.newSSHClient(context.Background(), b, &user.User{Username: username})
+				clt := f.newSSHClient(b.Context(), b, &user.User{Username: username})
 
 				executeCommand(b, clt, "uptime", 10)
 			}
diff --git a/lib/srv/server/azure_installer.go b/lib/srv/server/azure_installer.go
index e372224ed66d6..c646aa7bb949c 100644
--- a/lib/srv/server/azure_installer.go
+++ b/lib/srv/server/azure_installer.go
@@ -20,14 +20,12 @@ package server
 
 import (
 	"context"
-	"crypto/rand"
-	"fmt"
-	"net/url"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6"
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
 
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/cloud/azure"
 )
@@ -43,18 +41,21 @@ type AzureInstaller struct {
 type AzureRunRequest struct {
 	Client          azure.RunCommandClient
 	Instances       []*armcompute.VirtualMachine
-	Params          []string
+	InstallerParams *types.InstallerParams
+	ProxyAddrGetter func(context.Context) (string, error)
 	Region          string
 	ResourceGroup   string
-	ScriptName      string
-	PublicProxyAddr string
-	ClientID        string
 }
 
 // Run runs a command on a set of virtual machines and then blocks until the
 // commands have completed.
 func (ai *AzureInstaller) Run(ctx context.Context, req AzureRunRequest) error {
-	script, err := getInstallerScript(req.ScriptName, req.PublicProxyAddr, req.ClientID)
+	// Azure treats scripts with the same content as the same invocation and
+	// won't run them more than once. This is fine when the installer script
+	// succeeds, but it makes troubleshooting much harder when it fails. To
+	// work around this, we generate a random string and append it as a comment
+	// to the script, forcing Azure to see each invocation as unique.
+	script, err := installerScript(ctx, req.InstallerParams, withNonceComment(), withProxyAddrGetter(req.ProxyAddrGetter))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -70,7 +71,6 @@ func (ai *AzureInstaller) Run(ctx context.Context, req AzureRunRequest) error {
 				Region:        req.Region,
 				ResourceGroup: req.ResourceGroup,
 				VMName:        azure.StringVal(inst.Name),
-				Parameters:    req.Params,
 				Script:        script,
 			}
 			return trace.Wrap(req.Client.Run(ctx, runRequest))
@@ -78,26 +78,3 @@ func (ai *AzureInstaller) Run(ctx context.Context, req AzureRunRequest) error {
 	}
 	return trace.Wrap(g.Wait())
 }
-
-func getInstallerScript(installerName, publicProxyAddr, clientID string) (string, error) {
-	installerURL, err := url.Parse(fmt.Sprintf("https://%s/v1/webapi/scripts/installer/%v", publicProxyAddr, installerName))
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	if clientID != "" {
-		q := installerURL.Query()
-		q.Set("azure-client-id", clientID)
-		installerURL.RawQuery = q.Encode()
-	}
-
-	// Azure treats scripts with the same content as the same invocation and
-	// won't run them more than once. This is fine when the installer script
-	// succeeds, but it makes troubleshooting much harder when it fails. To
-	// work around this, we generate a random string and append it as a comment
-	// to the script, forcing Azure to see each invocation as unique.
-	nonce := make([]byte, 8)
-	// No big deal if rand.Read fails, the script is still valid.
-	_, _ = rand.Read(nonce)
-	script := fmt.Sprintf("curl -s -L %s| bash -s $@ #%x", installerURL, nonce)
-	return script, nil
-}
diff --git a/lib/srv/server/azure_watcher.go b/lib/srv/server/azure_watcher.go
index 7eee7afecb036..c2175c15e039b 100644
--- a/lib/srv/server/azure_watcher.go
+++ b/lib/srv/server/azure_watcher.go
@@ -46,24 +46,18 @@ type AzureInstances struct {
 	SubscriptionID string
 	// ResourceGroup is the resource group for the instances.
 	ResourceGroup string
-	// ScriptName is the name of the script to execute on the instances to
-	// install Teleport.
-	ScriptName string
-	// PublicProxyAddr is the address of the proxy the discovered node should use
-	// to connect to the cluster.
-	PublicProxyAddr string
-	// Parameters are the parameters passed to the installation script.
-	Parameters []string
+	// InstallerParams are the installer parameters used for installation.
+	InstallerParams *types.InstallerParams
 	// Instances is a list of discovered Azure virtual machines.
 	Instances []*armcompute.VirtualMachine
-	// ClientID is the client ID of the managed identity to use for installation.
-	ClientID string
+	// Integration is the optional name of the integration to use for auth.
+	Integration string
 }
 
 // MakeEvents generates MakeEvents for these instances.
 func (instances *AzureInstances) MakeEvents() map[string]*usageeventsv1.ResourceCreateEvent {
 	resourceType := types.DiscoveredResourceNode
-	if instances.ScriptName == installers.InstallerScriptNameAgentless {
+	if instances.InstallerParams != nil && instances.InstallerParams.ScriptName == installers.InstallerScriptNameAgentless {
 		resourceType = types.DiscoveredResourceAgentlessNode
 	}
 	events := make(map[string]*usageeventsv1.ResourceCreateEvent, len(instances.Instances))
@@ -77,9 +71,7 @@ func (instances *AzureInstances) MakeEvents() map[string]*usageeventsv1.Resource
 	return events
 }
 
-type azureClientGetter interface {
-	GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error)
-}
+type azureClientGetter func(ctx context.Context, integration string) (azure.Clients, error)
 
 // NewAzureWatcher creates a new Azure watcher instance.
 func NewAzureWatcher(ctx context.Context, fetchersFn func() []Fetcher, opts ...Option) (*Watcher, error) {
@@ -100,7 +92,7 @@ func NewAzureWatcher(ctx context.Context, fetchersFn func() []Fetcher, opts ...O
 }
 
 // MatchersToAzureInstanceFetchers converts a list of Azure VM Matchers into a list of Azure VM Fetchers.
-func MatchersToAzureInstanceFetchers(logger *slog.Logger, matchers []types.AzureMatcher, clients azureClientGetter, discoveryConfigName string) []Fetcher {
+func MatchersToAzureInstanceFetchers(logger *slog.Logger, matchers []types.AzureMatcher, getClient azureClientGetter, discoveryConfigName string) []Fetcher {
 	ret := make([]Fetcher, 0)
 	for _, matcher := range matchers {
 		for _, subscription := range matcher.Subscriptions {
@@ -109,7 +101,7 @@ func MatchersToAzureInstanceFetchers(logger *slog.Logger, matchers []types.Azure
 					Matcher:             matcher,
 					Subscription:        subscription,
 					ResourceGroup:       resourceGroup,
-					AzureClientGetter:   clients,
+					AzureClientGetter:   getClient,
 					DiscoveryConfigName: discoveryConfigName,
 					Logger:              logger,
 				})
@@ -126,48 +118,36 @@ type azureFetcherConfig struct {
 	ResourceGroup       string
 	AzureClientGetter   azureClientGetter
 	DiscoveryConfigName string
-	Integration         string
 	Logger              *slog.Logger
 }
 
 type azureInstanceFetcher struct {
+	InstallerParams     *types.InstallerParams
 	AzureClientGetter   azureClientGetter
 	Regions             []string
 	Subscription        string
 	ResourceGroup       string
 	Labels              types.Labels
-	Parameters          map[string]string
-	ClientID            string
 	DiscoveryConfigName string
 	Integration         string
 	Logger              *slog.Logger
 }
 
 func newAzureInstanceFetcher(cfg azureFetcherConfig) *azureInstanceFetcher {
-	ret := &azureInstanceFetcher{
+	return &azureInstanceFetcher{
+		InstallerParams:     cfg.Matcher.Params,
 		AzureClientGetter:   cfg.AzureClientGetter,
 		Regions:             cfg.Matcher.Regions,
 		Subscription:        cfg.Subscription,
 		ResourceGroup:       cfg.ResourceGroup,
 		Labels:              cfg.Matcher.ResourceTags,
 		DiscoveryConfigName: cfg.DiscoveryConfigName,
-		Integration:         cfg.Integration,
+		Integration:         cfg.Matcher.Integration,
 		Logger:              cfg.Logger,
 	}
-
-	if cfg.Matcher.Params != nil {
-		ret.Parameters = map[string]string{
-			"token":           cfg.Matcher.Params.JoinToken,
-			"scriptName":      cfg.Matcher.Params.ScriptName,
-			"publicProxyAddr": cfg.Matcher.Params.PublicProxyAddr,
-		}
-		ret.ClientID = cfg.Matcher.Params.Azure.ClientID
-	}
-
-	return ret
 }
 
-func (*azureInstanceFetcher) GetMatchingInstances(_ []types.Server, _ bool) ([]Instances, error) {
+func (*azureInstanceFetcher) GetMatchingInstances(_ context.Context, _ []types.Server, _ bool) ([]Instances, error) {
 	return nil, trace.NotImplemented("not implemented for azure fetchers")
 }
 
@@ -188,7 +168,12 @@ type resourceGroupLocation struct {
 
 // GetInstances fetches all Azure virtual machines matching configured filters.
 func (f *azureInstanceFetcher) GetInstances(ctx context.Context, _ bool) ([]Instances, error) {
-	client, err := f.AzureClientGetter.GetAzureVirtualMachinesClient(f.Subscription)
+	azureClients, err := f.AzureClientGetter(ctx, f.IntegrationName())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	client, err := azureClients.GetVirtualMachinesClient(ctx, f.Subscription)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -250,10 +235,8 @@ func (f *azureInstanceFetcher) GetInstances(ctx context.Context, _ bool) ([]Inst
 			Region:          batchGroup.location,
 			ResourceGroup:   batchGroup.resourceGroup,
 			Instances:       vms,
-			ScriptName:      f.Parameters["scriptName"],
-			PublicProxyAddr: f.Parameters["publicProxyAddr"],
-			Parameters:      []string{f.Parameters["token"]},
-			ClientID:        f.ClientID,
+			Integration:     f.Integration,
+			InstallerParams: f.InstallerParams,
 		}})
 	}
 
diff --git a/lib/srv/server/azure_watcher_test.go b/lib/srv/server/azure_watcher_test.go
index 1c9850b2f23d7..2c45ee7df244e 100644
--- a/lib/srv/server/azure_watcher_test.go
+++ b/lib/srv/server/azure_watcher_test.go
@@ -29,26 +29,25 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type mockClients struct {
-	cloud.AzureClients
+	azure.Clients
 
-	azureClient azure.VirtualMachinesClient
+	vmClient azure.VirtualMachinesClient
 }
 
-func (c *mockClients) GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error) {
-	return c.azureClient, nil
+func (c *mockClients) GetVirtualMachinesClient(ctx context.Context, subscription string) (azure.VirtualMachinesClient, error) {
+	return c.vmClient, nil
 }
 
 func TestAzureWatcher(t *testing.T) {
 	t.Parallel()
 
 	clients := mockClients{
-		azureClient: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
+		vmClient: azure.NewVirtualMachinesClientByAPI(&azure.ARMComputeMock{
 			VirtualMachines: map[string][]*armcompute.VirtualMachine{
 				"rg1": {
 					{
@@ -149,7 +148,7 @@ func TestAzureWatcher(t *testing.T) {
 		},
 	}
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	for _, tc := range tests {
 		tc.matcher.Types = []string{"vm"}
 		tc.matcher.Subscriptions = []string{"sub1"}
@@ -158,7 +157,9 @@ func TestAzureWatcher(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			t.Cleanup(cancel)
 			watcher, err := NewAzureWatcher(ctx, func() []Fetcher {
-				return MatchersToAzureInstanceFetchers(logger, []types.AzureMatcher{tc.matcher}, &clients, "" /* discovery config */)
+				return MatchersToAzureInstanceFetchers(logger, []types.AzureMatcher{tc.matcher}, func(ctx context.Context, integration string) (azure.Clients, error) {
+					return &clients, nil
+				}, "" /* discovery config */)
 			})
 			require.NoError(t, err)
 
diff --git a/lib/srv/server/ec2_watcher.go b/lib/srv/server/ec2_watcher.go
index d189f628aa11c..751a041859143 100644
--- a/lib/srv/server/ec2_watcher.go
+++ b/lib/srv/server/ec2_watcher.go
@@ -21,10 +21,13 @@ package server
 import (
 	"context"
 	"log/slog"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/account"
+	accounttypes "github.com/aws/aws-sdk-go-v2/service/account/types"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/gravitational/trace"
@@ -67,6 +70,10 @@ type EC2Instances struct {
 	// Integration is the integration used to fetch the Instance and should be used to access it.
 	// Might be empty for instances that didn't use an Integration.
 	Integration string
+	// AssumeRoleARN is the ARN of the role to assume while installing.
+	AssumeRoleARN string
+	// ExternalID is the external ID to use when assuming a role.
+	ExternalID string
 
 	// DiscoveryConfigName is the DiscoveryConfig name which originated this Run Request.
 	// Empty if using static matchers (coming from the `teleport.yaml`).
@@ -193,55 +200,57 @@ func NewEC2Watcher(ctx context.Context, fetchersFn func() []Fetcher, missedRotat
 // EC2ClientGetter gets an AWS EC2 client for the given region.
 type EC2ClientGetter func(ctx context.Context, region string, opts ...awsconfig.OptionsFn) (ec2.DescribeInstancesAPIClient, error)
 
+// RegionsListerGetter gets a list of AWS regions.
+type RegionsListerGetter func(ctx context.Context, opts ...awsconfig.OptionsFn) (account.ListRegionsAPIClient, error)
+
+// MatcherToEC2FetcherParams contains parameters for converting AWS EC2 Matchers
+// into AWS EC2 Fetchers.
+type MatcherToEC2FetcherParams struct {
+	// Matchers is a list of AWS EC2 Matchers.
+	Matchers []types.AWSMatcher
+	// EC2ClientGetter gets an AWS EC2.
+	EC2ClientGetter EC2ClientGetter
+	// RegionsListerGetter gets a client that is capable of listing AWS regions.
+	RegionsListerGetter RegionsListerGetter
+	// DiscoveryConfigName is the name of the DiscoveryConfig that contains the matchers.
+	// Empty if using static matchers (coming from the `teleport.yaml`).
+	DiscoveryConfigName string
+	// PublicProxyAddrGetter returns the public proxy address to use for installation scripts.
+	// This is only used if the matcher does not specify a ProxyAddress.
+	// Example: proxy.example.com:3080 or proxy.example.com
+	PublicProxyAddrGetter func(context.Context) (string, error)
+}
+
 // MatchersToEC2InstanceFetchers converts a list of AWS EC2 Matchers into a list of AWS EC2 Fetchers.
-func MatchersToEC2InstanceFetchers(ctx context.Context, matchers []types.AWSMatcher, getEC2Client EC2ClientGetter, discoveryConfigName string) ([]Fetcher, error) {
+func MatchersToEC2InstanceFetchers(ctx context.Context, matcherParams MatcherToEC2FetcherParams) ([]Fetcher, error) {
 	ret := []Fetcher{}
-	for _, matcher := range matchers {
-		for _, region := range matcher.Regions {
-			// TODO(gavin): support assume_role_arn for ec2.
-			ec2Client, err := getEC2Client(ctx, region,
-				awsconfig.WithCredentialsMaybeIntegration(matcher.Integration),
-			)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			fetcher := newEC2InstanceFetcher(ec2FetcherConfig{
-				Matcher:             matcher,
-				Region:              region,
-				Document:            matcher.SSM.DocumentName,
-				EC2Client:           ec2Client,
-				Labels:              matcher.Tags,
-				Integration:         matcher.Integration,
-				DiscoveryConfigName: discoveryConfigName,
-				EnrollMode:          matcher.Params.EnrollMode,
-			})
-			ret = append(ret, fetcher)
-		}
+	for _, matcher := range matcherParams.Matchers {
+		fetcher := newEC2InstanceFetcher(ec2FetcherConfig{
+			Matcher:               matcher,
+			ProxyPublicAddrGetter: matcherParams.PublicProxyAddrGetter,
+			EC2ClientGetter:       matcherParams.EC2ClientGetter,
+			RegionsListerGetter:   matcherParams.RegionsListerGetter,
+			DiscoveryConfigName:   matcherParams.DiscoveryConfigName,
+		})
+		ret = append(ret, fetcher)
 	}
 	return ret, nil
 }
 
 type ec2FetcherConfig struct {
-	Matcher             types.AWSMatcher
-	Region              string
-	Document            string
-	EC2Client           ec2.DescribeInstancesAPIClient
-	Labels              types.Labels
-	Integration         string
-	DiscoveryConfigName string
-	EnrollMode          types.InstallParamEnrollMode
+	Matcher types.AWSMatcher
+	// ProxyPublicAddrGetter returns the public proxy address to use for installation scripts.
+	// This is only used if the matcher does not specify a ProxyAddress.
+	// Example: proxy.example.com:3080 or proxy.example.com
+	ProxyPublicAddrGetter func(ctx context.Context) (string, error)
+	EC2ClientGetter       EC2ClientGetter
+	RegionsListerGetter   RegionsListerGetter
+	DiscoveryConfigName   string
 }
 
 type ec2InstanceFetcher struct {
-	Filters             []ec2types.Filter
-	EC2                 ec2.DescribeInstancesAPIClient
-	Region              string
-	DocumentName        string
-	Parameters          map[string]string
-	Integration         string
-	DiscoveryConfigName string
-	EnrollMode          types.InstallParamEnrollMode
+	ec2FetcherConfig
+	Filters []ec2types.Filter
 
 	// cachedInstances keeps all of the ec2 instances that were matched
 	// in the last run of GetInstances for use as a cache with
@@ -278,6 +287,7 @@ type cachedInstanceKey struct {
 	instanceID string
 }
 
+// SSM Run Command parameters for the TeleportDiscoveryInstaller SSM Document.
 const (
 	// ParamToken is the name of the invite token parameter sent in the SSM Document
 	ParamToken = "token"
@@ -285,6 +295,15 @@ const (
 	ParamScriptName = "scriptName"
 	// ParamSSHDConfigPath is the path to the OpenSSH config file sent in the SSM Document
 	ParamSSHDConfigPath = "sshdConfigPath"
+	// ParamEnvVars is a parameter that contains environment variables to set before running the installation script.
+	ParamEnvVars = "env"
+)
+
+// SSM Run Command parameters for the AWS-RunShellScript managed SSM Document.
+const (
+	// ParamCommands is the name of the commands parameter sent in the SSM Document.
+	// This is a list of strings, which contain the command to execute.
+	ParamCommands = "commands"
 )
 
 // awsEC2APIChunkSize is the max number of instances SSM will send commands to at a time
@@ -299,59 +318,79 @@ func newEC2InstanceFetcher(cfg ec2FetcherConfig) *ec2InstanceFetcher {
 		Values: []string{string(ec2types.InstanceStateNameRunning)},
 	}}
 
-	if _, ok := cfg.Labels["*"]; !ok {
-		for key, val := range cfg.Labels {
+	if _, ok := cfg.Matcher.Tags[types.Wildcard]; !ok {
+		for key, val := range cfg.Matcher.Tags {
 			tagFilters = append(tagFilters, ec2types.Filter{
 				Name:   aws.String("tag:" + key),
 				Values: val,
 			})
 		}
 	} else {
-		slog.DebugContext(context.Background(), "Not setting any tag filters as there is a '*:...' tag present and AWS doesnt allow globbing on keys")
-	}
-	var parameters map[string]string
-	if cfg.Matcher.Params == nil {
-		cfg.Matcher.Params = &types.InstallerParams{}
+		slog.DebugContext(context.Background(), "Not setting any tag filters as there is a '*:...' tag present and AWS doesn't allow globbing on keys")
 	}
-	if cfg.Matcher.Params.InstallTeleport {
-		parameters = map[string]string{
-			ParamToken:      cfg.Matcher.Params.JoinToken,
-			ParamScriptName: cfg.Matcher.Params.ScriptName,
-		}
-	} else {
-		parameters = map[string]string{
-			ParamToken:          cfg.Matcher.Params.JoinToken,
-			ParamScriptName:     cfg.Matcher.Params.ScriptName,
-			ParamSSHDConfigPath: cfg.Matcher.Params.SSHDConfig,
-		}
+
+	if cfg.Matcher.AssumeRole == nil {
+		cfg.Matcher.AssumeRole = &types.AssumeRole{}
 	}
 
-	fetcherConfig := ec2InstanceFetcher{
-		EC2:                 cfg.EC2Client,
-		Filters:             tagFilters,
-		Region:              cfg.Region,
-		DocumentName:        cfg.Document,
-		Parameters:          parameters,
-		Integration:         cfg.Integration,
-		DiscoveryConfigName: cfg.DiscoveryConfigName,
-		EnrollMode:          cfg.EnrollMode,
+	return &ec2InstanceFetcher{
+		ec2FetcherConfig: cfg,
+		Filters:          tagFilters,
 		cachedInstances: &instancesCache{
 			instances: map[cachedInstanceKey]struct{}{},
 		},
 	}
-	return &fetcherConfig
+}
+
+func ssmRunCommandParametersForCustomDocuments(cfg ec2FetcherConfig) map[string]string {
+	if cfg.Matcher.Params == nil {
+		cfg.Matcher.Params = &types.InstallerParams{}
+	}
+
+	parameters := map[string]string{
+		ParamToken:      cfg.Matcher.Params.JoinToken,
+		ParamScriptName: cfg.Matcher.Params.ScriptName,
+	}
+
+	envVars := envVarsFromInstallerParams(cfg.Matcher.Params)
+	if len(envVars) > 0 {
+		parameters[ParamEnvVars] = strings.Join(envVars, " ")
+	}
+
+	if !cfg.Matcher.Params.InstallTeleport {
+		parameters[ParamSSHDConfigPath] = cfg.Matcher.Params.SSHDConfig
+	}
+
+	return parameters
+}
+
+func ssmRunCommandParameters(ctx context.Context, cfg ec2FetcherConfig) (map[string]string, error) {
+	if cfg.Matcher.SSM.DocumentName == types.AWSSSMDocumentRunShellScript {
+		// When using the pre-defined SSM Document AWS-RunShellScript, only the commands parameter is required.
+		// It contains the full installation script that will be executed on the instance.
+		script, err := installerScript(ctx, cfg.Matcher.Params, withProxyAddrGetter(cfg.ProxyPublicAddrGetter))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return map[string]string{
+			ParamCommands: script,
+		}, nil
+	}
+
+	// For custom SSM Documents, scriptName, token and env are required.
+	return ssmRunCommandParametersForCustomDocuments(cfg), nil
 }
 
 // GetMatchingInstances returns a list of EC2 instances from a list of matching Teleport nodes
-func (f *ec2InstanceFetcher) GetMatchingInstances(nodes []types.Server, rotation bool) ([]Instances, error) {
-	insts := EC2Instances{
-		Region:              f.Region,
-		DocumentName:        f.DocumentName,
-		Parameters:          f.Parameters,
-		Rotation:            rotation,
-		Integration:         f.Integration,
-		DiscoveryConfigName: f.DiscoveryConfigName,
+func (f *ec2InstanceFetcher) GetMatchingInstances(ctx context.Context, nodes []types.Server, rotation bool) ([]Instances, error) {
+	ssmRunParams, err := ssmRunCommandParameters(ctx, f.ec2FetcherConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
+
+	instancesByRegion := make(map[string]EC2Instances)
+
 	for _, node := range nodes {
 		// Heartbeating and expiration keeps Teleport Agents up to date, no need to consider those nodes.
 		// Agentless and EICE Nodes don't heartbeat, so they must be manually managed by the DiscoveryService.
@@ -359,7 +398,7 @@ func (f *ec2InstanceFetcher) GetMatchingInstances(nodes []types.Server, rotation
 			continue
 		}
 		region, ok := node.GetLabel(types.AWSInstanceRegion)
-		if !ok || region != f.Region {
+		if !ok {
 			continue
 		}
 		instID, ok := node.GetLabel(types.AWSInstanceIDLabel)
@@ -374,49 +413,145 @@ func (f *ec2InstanceFetcher) GetMatchingInstances(nodes []types.Server, rotation
 		if !f.cachedInstances.exists(accountID, instID) {
 			continue
 		}
-		if insts.AccountID == "" {
-			insts.AccountID = accountID
-		}
 
+		if _, ok := instancesByRegion[region]; !ok {
+			instancesByRegion[region] = EC2Instances{
+				Region:              region,
+				DocumentName:        f.Matcher.SSM.DocumentName,
+				Parameters:          ssmRunParams,
+				Rotation:            rotation,
+				Integration:         f.Matcher.Integration,
+				DiscoveryConfigName: f.DiscoveryConfigName,
+				AccountID:           accountID,
+			}
+		}
+		insts := instancesByRegion[region]
 		insts.Instances = append(insts.Instances, EC2Instance{
 			InstanceID: instID,
 		})
+
+		instancesByRegion[region] = insts
 	}
 
-	if len(insts.Instances) == 0 {
+	if len(instancesByRegion) == 0 {
 		return nil, trace.NotFound("no ec2 instances found")
 	}
 
-	return chunkInstances(insts), nil
+	return chunkInstances(instancesByRegion), nil
 }
 
-func chunkInstances(insts EC2Instances) []Instances {
+// chunkInstances splits instances into chunks of 50.
+// This is required because SSM SendCommand API calls only accept up to 50 instance IDs at a time.
+func chunkInstances(instancesByRegion map[string]EC2Instances) []Instances {
 	var instColl []Instances
-	for i := 0; i < len(insts.Instances); i += awsEC2APIChunkSize {
-		end := i + awsEC2APIChunkSize
-		if end > len(insts.Instances) {
-			end = len(insts.Instances)
-		}
-		inst := EC2Instances{
-			AccountID:           insts.AccountID,
-			Region:              insts.Region,
-			DocumentName:        insts.DocumentName,
-			Parameters:          insts.Parameters,
-			Instances:           insts.Instances[i:end],
-			Rotation:            insts.Rotation,
-			Integration:         insts.Integration,
-			DiscoveryConfigName: insts.DiscoveryConfigName,
+	for _, insts := range instancesByRegion {
+		for i := 0; i < len(insts.Instances); i += awsEC2APIChunkSize {
+			end := i + awsEC2APIChunkSize
+			if end > len(insts.Instances) {
+				end = len(insts.Instances)
+			}
+			inst := EC2Instances{
+				AccountID:           insts.AccountID,
+				Region:              insts.Region,
+				DocumentName:        insts.DocumentName,
+				Parameters:          insts.Parameters,
+				Instances:           insts.Instances[i:end],
+				Rotation:            insts.Rotation,
+				Integration:         insts.Integration,
+				DiscoveryConfigName: insts.DiscoveryConfigName,
+			}
+			instColl = append(instColl, Instances{EC2: &inst})
 		}
-		instColl = append(instColl, Instances{EC2: &inst})
 	}
 	return instColl
 }
 
+func (f *ec2InstanceFetcher) matcherRegions(ctx context.Context, awsOpts []awsconfig.OptionsFn) ([]string, error) {
+	if !f.Matcher.IsRegionWildcard() {
+		return f.Matcher.Regions, nil
+	}
+
+	regionsListerClient, err := f.RegionsListerGetter(ctx, awsOpts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	paginator := account.NewListRegionsPaginator(regionsListerClient, &account.ListRegionsInput{
+		RegionOptStatusContains: []accounttypes.RegionOptStatus{
+			accounttypes.RegionOptStatusEnabled,
+			accounttypes.RegionOptStatusEnabledByDefault,
+		},
+	})
+
+	var enabledRegions []string
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+		if err != nil {
+			convertedErr := libcloudaws.ConvertRequestFailureError(err)
+			if trace.IsAccessDenied(convertedErr) {
+				return nil, trace.BadParameter("Missing account:ListRegions permission in IAM Role, which is required to iterate over all regions. " +
+					"Add this permission to the IAM Role, or enumerate all the regions in the AWS matcher.")
+			}
+			return nil, convertedErr
+		}
+
+		for _, region := range page.Regions {
+			enabledRegions = append(enabledRegions, aws.ToString(region.RegionName))
+		}
+	}
+
+	return enabledRegions, nil
+}
+
 // GetInstances fetches all EC2 instances matching configured filters.
 func (f *ec2InstanceFetcher) GetInstances(ctx context.Context, rotation bool) ([]Instances, error) {
-	var instances []Instances
+	ssmRunParams, err := ssmRunCommandParameters(ctx, f.ec2FetcherConfig)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	f.cachedInstances.clear()
-	paginator := ec2.NewDescribeInstancesPaginator(f.EC2, &ec2.DescribeInstancesInput{
+	var allInstances []Instances
+
+	awsOpts := []awsconfig.OptionsFn{
+		awsconfig.WithCredentialsMaybeIntegration(awsconfig.IntegrationMetadata{Name: f.Matcher.Integration}),
+	}
+
+	if f.Matcher.AssumeRole != nil {
+		awsOpts = append(awsOpts, awsconfig.WithAssumeRole(f.Matcher.AssumeRole.RoleARN, f.Matcher.AssumeRole.ExternalID))
+	}
+
+	regions, err := f.matcherRegions(ctx, awsOpts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	for _, region := range regions {
+		regionInstances, err := f.getInstancesInRegion(ctx, rotation, region, awsOpts, ssmRunParams)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		allInstances = append(allInstances, regionInstances...)
+	}
+
+	if len(allInstances) == 0 {
+		return nil, trace.NotFound("no ec2 instances found")
+	}
+
+	return allInstances, nil
+}
+
+// getInstancesInRegion fetches all EC2 instances in a given region.
+func (f *ec2InstanceFetcher) getInstancesInRegion(ctx context.Context, rotation bool, region string, awsOpts []awsconfig.OptionsFn, ssmRunParams map[string]string) ([]Instances, error) {
+	ec2Client, err := f.EC2ClientGetter(ctx, region, awsOpts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var instances []Instances
+
+	paginator := ec2.NewDescribeInstancesPaginator(ec2Client, &ec2.DescribeInstancesInput{
 		Filters: f.Filters,
 	})
 
@@ -435,14 +570,16 @@ func (f *ec2InstanceFetcher) GetInstances(ctx context.Context, rotation bool) ([
 				ownerID := aws.ToString(res.OwnerId)
 				inst := EC2Instances{
 					AccountID:           ownerID,
-					Region:              f.Region,
-					DocumentName:        f.DocumentName,
+					Region:              region,
+					DocumentName:        f.Matcher.SSM.DocumentName,
 					Instances:           ToEC2Instances(res.Instances[i:end]),
-					Parameters:          f.Parameters,
+					Parameters:          ssmRunParams,
 					Rotation:            rotation,
-					Integration:         f.Integration,
+					Integration:         f.Matcher.Integration,
+					AssumeRoleARN:       f.Matcher.AssumeRole.RoleARN,
+					ExternalID:          f.Matcher.AssumeRole.ExternalID,
 					DiscoveryConfigName: f.DiscoveryConfigName,
-					EnrollMode:          f.EnrollMode,
+					EnrollMode:          f.Matcher.Params.EnrollMode,
 				}
 				for _, ec2inst := range res.Instances[i:end] {
 					f.cachedInstances.add(ownerID, aws.ToString(ec2inst.InstanceId))
@@ -452,10 +589,6 @@ func (f *ec2InstanceFetcher) GetInstances(ctx context.Context, rotation bool) ([
 		}
 	}
 
-	if len(instances) == 0 {
-		return nil, trace.NotFound("no ec2 instances found")
-	}
-
 	return instances, nil
 }
 
@@ -467,5 +600,5 @@ func (f *ec2InstanceFetcher) GetDiscoveryConfigName() string {
 // IntegrationName identifies the integration name whose credentials were used to fetch the resources.
 // Might be empty when the fetcher is using ambient credentials.
 func (f *ec2InstanceFetcher) IntegrationName() string {
-	return f.Integration
+	return f.Matcher.Integration
 }
diff --git a/lib/srv/server/ec2_watcher_test.go b/lib/srv/server/ec2_watcher_test.go
index cb479a20631bb..fb56bd5815e4b 100644
--- a/lib/srv/server/ec2_watcher_test.go
+++ b/lib/srv/server/ec2_watcher_test.go
@@ -20,12 +20,16 @@ package server
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/account"
+	accounttypes "github.com/aws/aws-sdk-go-v2/service/account/types"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
 	usageeventsv1 "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
@@ -54,6 +58,19 @@ func (m *mockEC2Client) DescribeInstances(ctx context.Context, input *ec2.Descri
 	return &output, nil
 }
 
+type mockAWSAccountClient struct {
+	output        *account.ListRegionsOutput
+	responseError error
+}
+
+func (m *mockAWSAccountClient) ListRegions(ctx context.Context, input *account.ListRegionsInput, opts ...func(*account.Options)) (*account.ListRegionsOutput, error) {
+	if m.responseError != nil {
+		return nil, m.responseError
+	}
+
+	return m.output, nil
+}
+
 func instanceMatches(inst ec2types.Instance, filters []ec2types.Filter) bool {
 	allMatched := true
 	for _, filter := range filters {
@@ -83,9 +100,11 @@ func TestNewEC2InstanceFetcherTags(t *testing.T) {
 		{
 			name: "with glob key",
 			config: ec2FetcherConfig{
-				Labels: types.Labels{
-					"*":     []string{},
-					"hello": []string{"other"},
+				Matcher: types.AWSMatcher{
+					Tags: types.Labels{
+						"*":     []string{},
+						"hello": []string{"other"},
+					},
 				},
 			},
 			expectedFilters: []ec2types.Filter{
@@ -98,8 +117,10 @@ func TestNewEC2InstanceFetcherTags(t *testing.T) {
 		{
 			name: "with no glob key",
 			config: ec2FetcherConfig{
-				Labels: types.Labels{
-					"hello": []string{"other"},
+				Matcher: types.AWSMatcher{
+					Tags: types.Labels{
+						"hello": []string{"other"},
+					},
 				},
 			},
 			expectedFilters: []ec2types.Filter{
@@ -123,7 +144,6 @@ func TestNewEC2InstanceFetcherTags(t *testing.T) {
 
 func TestEC2Watcher(t *testing.T) {
 	t.Parallel()
-	client := &mockEC2Client{}
 	matchers := []types.AWSMatcher{
 		{
 			Params: &types.InstallerParams{
@@ -151,8 +171,27 @@ func TestEC2Watcher(t *testing.T) {
 			Integration: "my-aws-integration",
 			SSM:         &types.AWSSSM{},
 		},
+		{
+			Params:  &types.InstallerParams{},
+			Types:   []string{"EC2"},
+			Regions: []string{"us-west-2"},
+			Tags:    map[string]utils.Strings{"env": {"dev"}},
+			SSM:     &types.AWSSSM{},
+			AssumeRole: &types.AssumeRole{
+				RoleARN: "alternate-role-arn",
+			},
+		},
+		{
+			Params:  &types.InstallerParams{},
+			Types:   []string{"EC2"},
+			Regions: []string{"*"},
+			Tags:    map[string]utils.Strings{"teleport": {"yes"}},
+			SSM:     &types.AWSSSM{},
+			AssumeRole: &types.AssumeRole{
+				RoleARN: "implicit-region",
+			},
+		},
 	}
-	ctx := context.Background()
 
 	present := ec2types.Instance{
 		InstanceId: aws.String("instance-present"),
@@ -190,8 +229,29 @@ func TestEC2Watcher(t *testing.T) {
 			Name: ec2types.InstanceStateNameRunning,
 		},
 	}
+	altAccountPresent := ec2types.Instance{
+		InstanceId: aws.String("alternate-instance"),
+		Tags: []ec2types.Tag{{
+			Key:   aws.String("env"),
+			Value: aws.String("dev"),
+		}},
+		State: &ec2types.InstanceState{
+			Name: ec2types.InstanceStateNameRunning,
+		},
+	}
+
+	instanceImplicitRegion := ec2types.Instance{
+		InstanceId: aws.String("instance-implicit-region"),
+		Tags: []ec2types.Tag{{
+			Key:   aws.String("teleport"),
+			Value: aws.String("yes"),
+		}},
+		State: &ec2types.InstanceState{
+			Name: ec2types.InstanceStateNameRunning,
+		},
+	}
 
-	output := ec2.DescribeInstancesOutput{
+	ec2DescribeInstancesOutNoAssumeRole := ec2.DescribeInstancesOutput{
 		Reservations: []ec2types.Reservation{{
 			Instances: []ec2types.Instance{
 				present,
@@ -223,41 +283,152 @@ func TestEC2Watcher(t *testing.T) {
 			},
 		}},
 	}
-	client.output = &output
+	ec2DescribeInstancesOutAlternateAssumeRole := ec2.DescribeInstancesOutput{
+		Reservations: []ec2types.Reservation{{
+			Instances: []ec2types.Instance{
+				altAccountPresent,
+				{
+					InstanceId: aws.String("alternate-absent"),
+					Tags: []ec2types.Tag{{
+						Key:   aws.String("env"),
+						Value: aws.String("prod"),
+					}},
+					State: &ec2types.InstanceState{
+						Name: ec2types.InstanceStateNameRunning,
+					},
+				},
+			},
+		}},
+	}
+	ec2DescribeInstancesOutOnlyImplicitRegions := ec2.DescribeInstancesOutput{
+		Reservations: []ec2types.Reservation{{
+			Instances: []ec2types.Instance{instanceImplicitRegion},
+		}},
+	}
+
+	ec2ClientOutputsByRole := map[string]*ec2.DescribeInstancesOutput{
+		"":                   &ec2DescribeInstancesOutNoAssumeRole,
+		"alternate-role-arn": &ec2DescribeInstancesOutAlternateAssumeRole,
+		"implicit-region":    &ec2DescribeInstancesOutOnlyImplicitRegions,
+	}
+
+	ec2ClientGetter := func(ctx context.Context, region string, opts ...awsconfig.OptionsFn) (ec2.DescribeInstancesAPIClient, error) {
+		assumedRoles := awsconfig.AssumedRoles(opts...)
+		var roleARN string
+
+		for _, assumedRole := range assumedRoles {
+			roleARN = assumedRole.RoleARN
+		}
+
+		return &mockEC2Client{
+			output: ec2ClientOutputsByRole[roleARN],
+		}, nil
+	}
+
+	regionsListerGetter := func(ctx context.Context, opts ...awsconfig.OptionsFn) (account.ListRegionsAPIClient, error) {
+		return &mockAWSAccountClient{
+			output: &account.ListRegionsOutput{
+				Regions: []accounttypes.Region{
+					{RegionName: aws.String("eu-south-1")},
+					{RegionName: aws.String("eu-south-2")},
+				},
+			},
+		}, nil
+	}
 
-	const noDiscoveryConfig = ""
 	fetchersFn := func() []Fetcher {
-		fetchers, err := MatchersToEC2InstanceFetchers(ctx, matchers, func(ctx context.Context, region string, opts ...awsconfig.OptionsFn) (ec2.DescribeInstancesAPIClient, error) {
-			return client, nil
-		}, noDiscoveryConfig)
+		fetchers, err := MatchersToEC2InstanceFetchers(t.Context(), MatcherToEC2FetcherParams{
+			Matchers: matchers,
+			PublicProxyAddrGetter: func(ctx context.Context) (string, error) {
+				return "proxy.example.com:3080", nil
+			},
+			EC2ClientGetter:     ec2ClientGetter,
+			RegionsListerGetter: regionsListerGetter,
+		})
 		require.NoError(t, err)
 
 		return fetchers
 	}
-	watcher, err := NewEC2Watcher(ctx, fetchersFn, make(<-chan []types.Server))
+	watcher, err := NewEC2Watcher(t.Context(), fetchersFn, make(<-chan []types.Server))
 	require.NoError(t, err)
 
 	go watcher.Run()
 
-	result := <-watcher.InstancesC
-	require.Equal(t, EC2Instances{
-		Region:     "us-west-2",
-		Instances:  []EC2Instance{toEC2Instance(present)},
-		Parameters: map[string]string{"token": "", "scriptName": ""},
-	}, *result.EC2)
-	result = <-watcher.InstancesC
-	require.Equal(t, EC2Instances{
-		Region:     "us-west-2",
-		Instances:  []EC2Instance{toEC2Instance(presentOther)},
-		Parameters: map[string]string{"token": "", "scriptName": ""},
-	}, *result.EC2)
-	result = <-watcher.InstancesC
-	require.Equal(t, EC2Instances{
-		Region:      "us-west-2",
-		Instances:   []EC2Instance{toEC2Instance(presentForEICE)},
-		Parameters:  map[string]string{"token": "", "scriptName": "", "sshdConfigPath": ""},
-		Integration: "my-aws-integration",
-	}, *result.EC2)
+	expectedInstances := []EC2Instances{
+		{
+			Region:     "us-west-2",
+			Instances:  []EC2Instance{toEC2Instance(present)},
+			Parameters: map[string]string{"token": "", "scriptName": ""},
+		},
+		{
+			Region:     "us-west-2",
+			Instances:  []EC2Instance{toEC2Instance(presentOther)},
+			Parameters: map[string]string{"token": "", "scriptName": ""},
+		},
+		{
+			Region:      "us-west-2",
+			Instances:   []EC2Instance{toEC2Instance(presentForEICE)},
+			Parameters:  map[string]string{"token": "", "scriptName": "", "sshdConfigPath": ""},
+			Integration: "my-aws-integration",
+		},
+		{
+			Region:        "us-west-2",
+			Instances:     []EC2Instance{toEC2Instance(altAccountPresent)},
+			Parameters:    map[string]string{"token": "", "scriptName": "", "sshdConfigPath": ""},
+			AssumeRoleARN: "alternate-role-arn",
+		},
+		{
+			Region:        "eu-south-1",
+			Instances:     []EC2Instance{toEC2Instance(instanceImplicitRegion)},
+			Parameters:    map[string]string{"token": "", "scriptName": "", "sshdConfigPath": ""},
+			AssumeRoleARN: "implicit-region",
+		},
+		{
+			Region:        "eu-south-2",
+			Instances:     []EC2Instance{toEC2Instance(instanceImplicitRegion)},
+			Parameters:    map[string]string{"token": "", "scriptName": "", "sshdConfigPath": ""},
+			AssumeRoleARN: "implicit-region",
+		},
+	}
+
+	for _, instances := range expectedInstances {
+		select {
+		case result := <-watcher.InstancesC:
+			require.NotNil(t, result.EC2)
+			require.Equal(t, instances, *result.EC2)
+		case <-t.Context().Done():
+			require.Fail(t, "context canceled")
+		}
+	}
+
+	select {
+	case inst := <-watcher.InstancesC:
+		require.Fail(t, "unexpected instance: %v", inst)
+	default:
+	}
+}
+
+func TestMatchersToEC2InstanceFetchers(t *testing.T) {
+	ec2ClientGetter := func(ctx context.Context, region string, opts ...awsconfig.OptionsFn) (ec2.DescribeInstancesAPIClient, error) {
+		return nil, errors.New("ec2 client getter invocation must not fail when creating fetchers")
+	}
+
+	matchers := []types.AWSMatcher{{
+		Params: &types.InstallerParams{
+			InstallTeleport: true,
+		},
+		Types:   []string{"EC2"},
+		Regions: []string{"us-west-2"},
+		Tags:    map[string]utils.Strings{"*": {"*"}},
+		SSM:     &types.AWSSSM{},
+	}}
+
+	fetchers, err := MatchersToEC2InstanceFetchers(t.Context(), MatcherToEC2FetcherParams{
+		Matchers:        matchers,
+		EC2ClientGetter: ec2ClientGetter,
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, fetchers)
 }
 
 func TestConvertEC2InstancesToServerInfos(t *testing.T) {
@@ -416,3 +587,128 @@ func TestToEC2Instances(t *testing.T) {
 		})
 	}
 }
+
+func TestSSMRunCommandParameters(t *testing.T) {
+	for _, tt := range []struct {
+		name           string
+		cfg            ec2FetcherConfig
+		errCheck       require.ErrorAssertionFunc
+		expectedParams map[string]string
+	}{
+		{
+			name: "using custom ssm document",
+			cfg: ec2FetcherConfig{
+				Matcher: types.AWSMatcher{
+					Params: &types.InstallerParams{
+						InstallTeleport: true,
+						JoinToken:       "my-token",
+						ScriptName:      "default-installer",
+					},
+					SSM: &types.AWSSSM{
+						DocumentName: "TeleportDiscoveryInstaller",
+					},
+				},
+			},
+			errCheck: require.NoError,
+			expectedParams: map[string]string{
+				"token":      "my-token",
+				"scriptName": "default-installer",
+			},
+		},
+		{
+			name: "using custom ssm document without agentless install",
+			cfg: ec2FetcherConfig{
+				Matcher: types.AWSMatcher{
+					Params: &types.InstallerParams{
+						InstallTeleport: false,
+						JoinToken:       "my-token",
+						ScriptName:      "default-agentless-installer",
+						SSHDConfig:      "/etc/ssh/sshd_config",
+					},
+					SSM: &types.AWSSSM{
+						DocumentName: "TeleportDiscoveryInstaller",
+					},
+				},
+			},
+			errCheck: require.NoError,
+			expectedParams: map[string]string{
+				"token":          "my-token",
+				"scriptName":     "default-agentless-installer",
+				"sshdConfigPath": "/etc/ssh/sshd_config",
+			},
+		},
+		{
+			name: "using pre-defined AWS document",
+			cfg: ec2FetcherConfig{
+				Matcher: types.AWSMatcher{
+					Params: &types.InstallerParams{
+						InstallTeleport: true,
+						JoinToken:       "my-token",
+						ScriptName:      "default-installer",
+					},
+					SSM: &types.AWSSSM{
+						DocumentName: "AWS-RunShellScript",
+					},
+				},
+				ProxyPublicAddrGetter: func(ctx context.Context) (string, error) {
+					return "proxy.example.com", nil
+				},
+			},
+			errCheck: require.NoError,
+			expectedParams: map[string]string{
+				"commands": "curl -s -L https://proxy.example.com/v1/webapi/scripts/installer/default-installer | bash -s my-token",
+			},
+		},
+		{
+			name: "using pre-defined AWS document with env vars defined",
+			cfg: ec2FetcherConfig{
+				Matcher: types.AWSMatcher{
+					Params: &types.InstallerParams{
+						InstallTeleport: true,
+						JoinToken:       "my-token",
+						ScriptName:      "default-installer",
+						Suffix:          "cluster-green",
+					},
+					SSM: &types.AWSSSM{
+						DocumentName: "AWS-RunShellScript",
+					},
+				},
+				ProxyPublicAddrGetter: func(ctx context.Context) (string, error) {
+					return "proxy.example.com", nil
+				},
+			},
+			errCheck: require.NoError,
+			expectedParams: map[string]string{
+				"commands": "export TELEPORT_INSTALL_SUFFIX=cluster-green; curl -s -L https://proxy.example.com/v1/webapi/scripts/installer/default-installer | bash -s my-token",
+			},
+		},
+		{
+			name: "error if using AWS-RunShellScript but proxy addr is not yet available",
+			cfg: ec2FetcherConfig{
+				Matcher: types.AWSMatcher{
+					Params: &types.InstallerParams{
+						InstallTeleport: true,
+						JoinToken:       "my-token",
+						ScriptName:      "default-installer",
+						Suffix:          "cluster-green",
+					},
+					SSM: &types.AWSSSM{
+						DocumentName: "AWS-RunShellScript",
+					},
+				},
+				ProxyPublicAddrGetter: func(ctx context.Context) (string, error) {
+					return "", trace.NotFound("proxy is not yet available")
+				},
+			},
+			errCheck: require.Error,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ssmRunCommandParameters(t.Context(), tt.cfg)
+			tt.errCheck(t, err)
+			if tt.expectedParams != nil {
+				require.Equal(t, tt.expectedParams, got)
+			}
+		})
+	}
+}
diff --git a/lib/srv/server/gcp_installer.go b/lib/srv/server/gcp_installer.go
index 54c0935c6f3e2..ec7d1eb39b612 100644
--- a/lib/srv/server/gcp_installer.go
+++ b/lib/srv/server/gcp_installer.go
@@ -20,12 +20,11 @@ package server
 
 import (
 	"context"
-	"fmt"
-	"strings"
 
 	"github.com/gravitational/trace"
 	"golang.org/x/sync/errgroup"
 
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
@@ -41,19 +40,23 @@ type GCPInstaller struct {
 // GCPRunRequest combines parameters for running commands on a set of GCP
 // virtual machines.
 type GCPRunRequest struct {
-	Client          gcp.InstancesClient
-	Instances       []*gcpimds.Instance
-	Params          []string
-	Zone            string
-	ProjectID       string
-	ScriptName      string
-	PublicProxyAddr string
-	SSHKeyAlgo      cryptosuites.Algorithm
+	Client            gcp.InstancesClient
+	Instances         []*gcpimds.Instance
+	InstallerParams   *types.InstallerParams
+	Zone              string
+	ProjectID         string
+	SSHKeyAlgo        cryptosuites.Algorithm
+	PublicProxyGetter func(context.Context) (string, error)
 }
 
 // Run runs a command on a set of virtual machines and then blocks until the
 // commands have completed.
 func (gi *GCPInstaller) Run(ctx context.Context, req GCPRunRequest) error {
+	script, err := installerScript(ctx, req.InstallerParams, withProxyAddrGetter(req.PublicProxyGetter))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	g, ctx := errgroup.WithContext(ctx)
 	// Somewhat arbitrary limit to make sure Teleport doesn't have to install
 	// hundreds of nodes at once.
@@ -69,11 +72,7 @@ func (gi *GCPInstaller) Run(ctx context.Context, req GCPRunRequest) error {
 					Zone:      inst.Zone,
 					Name:      inst.Name,
 				},
-				Script: getGCPInstallerScript(
-					req.ScriptName,
-					req.PublicProxyAddr,
-					req.Params,
-				),
+				Script:     script,
 				SSHKeyAlgo: req.SSHKeyAlgo,
 			}
 			return trace.Wrap(gcp.RunCommand(ctx, &runRequest))
@@ -81,11 +80,3 @@ func (gi *GCPInstaller) Run(ctx context.Context, req GCPRunRequest) error {
 	}
 	return trace.Wrap(g.Wait())
 }
-
-func getGCPInstallerScript(installerName, publicProxyAddr string, params []string) string {
-	return fmt.Sprintf("curl -s -L https://%s/v1/webapi/scripts/installer/%s | bash -s %s",
-		publicProxyAddr,
-		installerName,
-		strings.Join(params, " "),
-	)
-}
diff --git a/lib/srv/server/gcp_watcher.go b/lib/srv/server/gcp_watcher.go
index 8c4396c856610..c9ff8fd3c9b59 100644
--- a/lib/srv/server/gcp_watcher.go
+++ b/lib/srv/server/gcp_watcher.go
@@ -43,14 +43,8 @@ type GCPInstances struct {
 	Zone string
 	// ProjectID is the instances' project ID.
 	ProjectID string
-	// ScriptName is the name of the script to execute on the instances to
-	// install Teleport.
-	ScriptName string
-	// PublicProxyAddr is the address of the proxy the discovered node should use
-	// to connect to the cluster.
-	PublicProxyAddr string
-	// Parameters are the parameters passed to the installation script
-	Parameters []string
+	// InstallerParams are the installer parameters used for installation.
+	InstallerParams *types.InstallerParams
 	// Instances is a list of discovered GCP virtual machines.
 	Instances []*gcpimds.Instance
 }
@@ -58,7 +52,7 @@ type GCPInstances struct {
 // MakeEvents generates MakeEvents for these instances.
 func (instances *GCPInstances) MakeEvents() map[string]*usageeventsv1.ResourceCreateEvent {
 	resourceType := types.DiscoveredResourceNode
-	if instances.ScriptName == installers.InstallerScriptNameAgentless {
+	if instances.InstallerParams.ScriptName == installers.InstallerScriptNameAgentless {
 		resourceType = types.DiscoveredResourceAgentlessNode
 	}
 	events := make(map[string]*usageeventsv1.ResourceCreateEvent, len(instances.Instances))
@@ -117,20 +111,21 @@ type gcpFetcherConfig struct {
 }
 
 type gcpInstanceFetcher struct {
+	InstallerParams     *types.InstallerParams
 	GCP                 gcp.InstancesClient
 	ProjectIDs          []string
 	Zones               []string
 	ProjectID           string
 	ServiceAccounts     []string
 	Labels              types.Labels
-	Parameters          map[string]string
 	projectsClient      gcp.ProjectsClient
 	DiscoveryConfigName string
 	Integration         string
 }
 
 func newGCPInstanceFetcher(cfg gcpFetcherConfig) *gcpInstanceFetcher {
-	fetcher := &gcpInstanceFetcher{
+	return &gcpInstanceFetcher{
+		InstallerParams:     cfg.Matcher.Params,
 		GCP:                 cfg.GCPClient,
 		Zones:               cfg.Matcher.Locations,
 		ProjectIDs:          cfg.Matcher.ProjectIDs,
@@ -140,17 +135,9 @@ func newGCPInstanceFetcher(cfg gcpFetcherConfig) *gcpInstanceFetcher {
 		Integration:         cfg.Integration,
 		DiscoveryConfigName: cfg.DiscoveryConfigName,
 	}
-	if cfg.Matcher.Params != nil {
-		fetcher.Parameters = map[string]string{
-			"token":           cfg.Matcher.Params.JoinToken,
-			"scriptName":      cfg.Matcher.Params.ScriptName,
-			"publicProxyAddr": cfg.Matcher.Params.PublicProxyAddr,
-		}
-	}
-	return fetcher
 }
 
-func (*gcpInstanceFetcher) GetMatchingInstances(_ []types.Server, _ bool) ([]Instances, error) {
+func (*gcpInstanceFetcher) GetMatchingInstances(_ context.Context, _ []types.Server, _ bool) ([]Instances, error) {
 	return nil, trace.NotImplemented("not implemented for gcp fetchers")
 }
 
@@ -199,12 +186,10 @@ func (f *gcpInstanceFetcher) GetInstances(ctx context.Context, _ bool) ([]Instan
 		for zone, vms := range vmsByZone {
 			if len(vms) > 0 {
 				instances = append(instances, Instances{GCP: &GCPInstances{
+					InstallerParams: f.InstallerParams,
 					ProjectID:       projectID,
 					Zone:            zone,
 					Instances:       vms,
-					ScriptName:      f.Parameters["scriptName"],
-					PublicProxyAddr: f.Parameters["publicProxyAddr"],
-					Parameters:      []string{f.Parameters["token"]},
 				}})
 			}
 		}
diff --git a/lib/srv/server/installer/autodiscover.go b/lib/srv/server/installer/autodiscover.go
index 930b096f8360f..9b9d391629b91 100644
--- a/lib/srv/server/installer/autodiscover.go
+++ b/lib/srv/server/installer/autodiscover.go
@@ -68,6 +68,16 @@ type AutoDiscoverNodeInstallerConfig struct {
 	// Eg, example.platform.sh
 	ProxyPublicAddr string
 
+	// InstallationManagedByTeleportUpdateWithSuffix indicates that a suffix was used to install teleport by teleport-update.
+	// When set, this command will use non-default file system paths:
+	// - teleport binary is located at: /opt/teleport/<suffix>/bin/teleport
+	// - systemd unit is located at: /etc/systemd/system/teleport_<suffix>.service
+	// - configuration must be written to: /etc/teleport_<suffix>.yaml
+	// - data directory must be set to: /var/lib/teleport_<suffix>
+	//
+	// This is in accordance with the teleport-update behavior.
+	InstallationManagedByTeleportUpdateWithSuffix string
+
 	// TeleportPackage contains the teleport package name.
 	// Allowed values: teleport, teleport-ent, teleport-ent-fips
 	TeleportPackage string
@@ -142,6 +152,13 @@ func (c *AutoDiscoverNodeInstallerConfig) checkAndSetDefaults() error {
 		c.autoUpgradesChannelURL = "https://" + c.ProxyPublicAddr + "/v1/webapi/automaticupgrades/channel/default"
 	}
 
+	if c.InstallationManagedByTeleportUpdateWithSuffix != "" {
+		// Only update it if not already set by the caller (only tests set it).
+		if c.binariesLocation.Teleport == "" {
+			c.binariesLocation.Teleport = filepath.Join(c.fsRootPrefix, "opt", "teleport", c.InstallationManagedByTeleportUpdateWithSuffix, "bin", "teleport")
+		}
+	}
+
 	c.binariesLocation.CheckAndSetDefaults()
 
 	if len(c.imdsProviders) == 0 {
@@ -211,6 +228,16 @@ var imdsClientTypeToJoinMethod = map[types.InstanceMetadataType]types.JoinMethod
 
 // Install teleport in the current system.
 func (ani *AutoDiscoverNodeInstaller) Install(ctx context.Context) error {
+	if ani.InstallationManagedByTeleportUpdateWithSuffix != "" {
+		slog.InfoContext(ctx, "Using non-default path for teleport installation",
+			"suffix", ani.InstallationManagedByTeleportUpdateWithSuffix,
+			"teleport_binary", ani.binariesLocation.Teleport,
+			"systemd_unit", ani.buildTeleportSystemdUnitName(),
+			"configuration_file", ani.buildTeleportConfigurationPath(),
+			"data_directory", ani.buildTeleportDataDirPath(),
+		)
+	}
+
 	// Ensure only one installer is running by locking the same file as the script installers.
 	lockFile := ani.buildAbsoluteFilePath(exclusiveInstallFileLock)
 	unlockFn, err := utils.FSTryWriteLock(lockFile)
@@ -233,6 +260,13 @@ func (ani *AutoDiscoverNodeInstaller) Install(ctx context.Context) error {
 	// In the new autoupdate install flow, teleport-update should have already
 	// taken care of installing teleport.
 	if _, err := os.Stat(ani.binariesLocation.Teleport); err != nil {
+		// If teleport is not present and the installation is managed by teleport-update,
+		// then this is an error because teleport-update should have installed it.
+		// This prevents the installer from installing teleport in a different version and/or location than the one managed by teleport-update.
+		if ani.InstallationManagedByTeleportUpdateWithSuffix != "" {
+			return trace.BadParameter("teleport binary not found, ensure teleport-update installed it correctly: %v", err)
+		}
+
 		ani.Logger.InfoContext(ctx, "Installing teleport")
 		if err := ani.installTeleportFromRepo(ctx); err != nil {
 			return trace.Wrap(err)
@@ -264,13 +298,15 @@ func (ani *AutoDiscoverNodeInstaller) Install(ctx context.Context) error {
 // - teleport was just installed and teleport.service is inactive
 // - teleport was already installed but the service is failing
 func (ani *AutoDiscoverNodeInstaller) enableAndRestartTeleportService(ctx context.Context) error {
-	systemctlEnableNowCMD := exec.CommandContext(ctx, ani.binariesLocation.Systemctl, "enable", "teleport")
+	serviceName := ani.buildTeleportSystemdUnitName()
+
+	systemctlEnableNowCMD := exec.CommandContext(ctx, ani.binariesLocation.Systemctl, "enable", serviceName)
 	systemctlEnableNowCMDOutput, err := systemctlEnableNowCMD.CombinedOutput()
 	if err != nil {
 		return trace.Wrap(err, string(systemctlEnableNowCMDOutput))
 	}
 
-	systemctlRestartCMD := exec.CommandContext(ctx, ani.binariesLocation.Systemctl, "restart", "teleport")
+	systemctlRestartCMD := exec.CommandContext(ctx, ani.binariesLocation.Systemctl, "restart", serviceName)
 	systemctlRestartCMDOutput, err := systemctlRestartCMD.CombinedOutput()
 	if err != nil {
 		return trace.Wrap(err, string(systemctlRestartCMDOutput))
@@ -303,9 +339,13 @@ func (ani *AutoDiscoverNodeInstaller) configureTeleportNode(ctx context.Context,
 		return trace.BadParameter("Unsupported cloud provider: %v", imdsClient.GetType())
 	}
 
-	teleportYamlConfigurationPath := ani.buildAbsoluteFilePath(defaults.ConfigFilePath)
+	dataDirForNode := ani.buildTeleportDataDirPath()
+
+	teleportYamlConfigurationPath := ani.buildTeleportConfigurationPath()
 	teleportYamlConfigurationPathNew := teleportYamlConfigurationPath + teleportYamlConfigNewExtension
+
 	teleportNodeConfigureArgs := []string{"node", "configure", "--output=file://" + teleportYamlConfigurationPathNew,
+		fmt.Sprintf(`--data-dir=%s`, shsprintf.EscapeDefaultContext(dataDirForNode)),
 		fmt.Sprintf(`--proxy=%s`, shsprintf.EscapeDefaultContext(ani.ProxyPublicAddr)),
 		fmt.Sprintf(`--join-method=%s`, shsprintf.EscapeDefaultContext(string(joinMethod))),
 		fmt.Sprintf(`--token=%s`, shsprintf.EscapeDefaultContext(ani.TokenName)),
@@ -553,6 +593,32 @@ func (ani *AutoDiscoverNodeInstaller) buildAbsoluteFilePath(path string) string
 	return filepath.Join(ani.fsRootPrefix, path)
 }
 
+func (ani *AutoDiscoverNodeInstaller) buildTeleportConfigurationPath() string {
+	filePath := defaults.ConfigFilePath
+	if ani.InstallationManagedByTeleportUpdateWithSuffix != "" {
+		fileName := "teleport_" + ani.InstallationManagedByTeleportUpdateWithSuffix + ".yaml"
+		filePath = filepath.Join(filepath.Dir(defaults.ConfigFilePath), fileName)
+	}
+	return ani.buildAbsoluteFilePath(filePath)
+}
+
+func (ani *AutoDiscoverNodeInstaller) buildTeleportDataDirPath() string {
+	dataDirPath := defaults.DataDir
+	if ani.InstallationManagedByTeleportUpdateWithSuffix != "" {
+		dataDirName := "teleport_" + ani.InstallationManagedByTeleportUpdateWithSuffix
+		dataDirPath = filepath.Join(filepath.Dir(defaults.DataDir), dataDirName)
+	}
+	return ani.buildAbsoluteFilePath(dataDirPath)
+}
+
+func (ani *AutoDiscoverNodeInstaller) buildTeleportSystemdUnitName() string {
+	if ani.InstallationManagedByTeleportUpdateWithSuffix != "" {
+		return "teleport_" + ani.InstallationManagedByTeleportUpdateWithSuffix
+	}
+
+	return "teleport"
+}
+
 // linuxDistribution reads the current file system to detect the Linux Distro and Version of the current system.
 //
 // https://www.freedesktop.org/software/systemd/man/latest/os-release.html
diff --git a/lib/srv/server/installer/autodiscover_test.go b/lib/srv/server/installer/autodiscover_test.go
index 6c70173b91514..231fc546684cf 100644
--- a/lib/srv/server/installer/autodiscover_test.go
+++ b/lib/srv/server/installer/autodiscover_test.go
@@ -21,6 +21,7 @@ package installer
 import (
 	"context"
 	"io/fs"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -99,6 +100,55 @@ func (m *mockGCPInstanceGetter) GetInstanceTags(ctx context.Context, req *gcp.In
 	return nil, trace.NotImplemented("not implemented")
 }
 
+func TestAutoDiscoverNode_CheckAndSetDefaults(t *testing.T) {
+	mockIMDSProviders := []func(ctx context.Context) (imds.Client, error){
+		func(ctx context.Context) (imds.Client, error) { return nil, nil },
+	}
+	for _, tt := range []struct {
+		name     string
+		initial  *AutoDiscoverNodeInstallerConfig
+		expected *AutoDiscoverNodeInstallerConfig
+	}{
+		{
+			name: "teleport binary location uses /opt/teleport if suffix is used",
+			initial: &AutoDiscoverNodeInstallerConfig{
+				InstallationManagedByTeleportUpdateWithSuffix: "example-suffix",
+				ProxyPublicAddr:   "proxy.example.com",
+				RepositoryChannel: "stable/rolling",
+				TeleportPackage:   "teleport",
+				imdsProviders:     mockIMDSProviders,
+			},
+			expected: &AutoDiscoverNodeInstallerConfig{
+				InstallationManagedByTeleportUpdateWithSuffix: "example-suffix",
+				ProxyPublicAddr:        "proxy.example.com",
+				RepositoryChannel:      "stable/rolling",
+				TeleportPackage:        "teleport",
+				Logger:                 slog.Default(),
+				autoUpgradesChannelURL: "https://proxy.example.com/v1/webapi/automaticupgrades/channel/default",
+				fsRootPrefix:           "/",
+				imdsProviders:          mockIMDSProviders,
+				binariesLocation: packagemanager.BinariesLocation{
+					Teleport:         "/opt/teleport/example-suffix/bin/teleport",
+					Systemctl:        "systemctl",
+					AptGet:           "apt-get",
+					AptKey:           "apt-key",
+					Rpm:              "rpm",
+					Yum:              "yum",
+					YumConfigManager: "yum-config-manager",
+					Zypper:           "zypper",
+				},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			conf := tt.initial
+			err := conf.checkAndSetDefaults()
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, conf)
+		})
+	}
+}
+
 func TestAutoDiscoverNode(t *testing.T) {
 	ctx := context.Background()
 
@@ -171,6 +221,22 @@ func TestAutoDiscoverNode(t *testing.T) {
 			_, err := NewAutoDiscoverNodeInstaller(installerConfig)
 			require.Error(t, err)
 		})
+		t.Run("binary and config paths are non-default when using a suffix", func(t *testing.T) {
+			installerConfig := &AutoDiscoverNodeInstallerConfig{
+				RepositoryChannel: "stable/rolling",
+				AutoUpgrades:      false,
+				ProxyPublicAddr:   "proxy.example.com",
+				TeleportPackage:   "teleport-ent-fips",
+				TokenName:         "my-token",
+				AzureClientID:     "azure-client-id",
+				InstallationManagedByTeleportUpdateWithSuffix: "example-suffix",
+			}
+
+			ani, err := NewAutoDiscoverNodeInstaller(installerConfig)
+			require.NoError(t, err)
+
+			require.Equal(t, "/opt/teleport/example-suffix/bin/teleport", ani.binariesLocation.Teleport)
+		})
 	})
 
 	t.Run("well known distros", func(t *testing.T) {
@@ -236,6 +302,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 					mockBins["teleport"].Expect("node",
 						"configure",
 						"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+						"--data-dir="+testTempDir+"/var/lib/teleport",
 						"--proxy=proxy.example.com",
 						"--join-method=azure",
 						"--token=my-token",
@@ -262,6 +329,77 @@ func TestAutoDiscoverNode(t *testing.T) {
 		}
 	})
 
+	t.Run("using a teleport-update managed installation with suffix", func(t *testing.T) {
+		distroConfig := wellKnownOS["ubuntu"]["24.04"]
+
+		proxyServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			// We only expect calls to the automatic upgrade default channel's version endpoint.
+			w.WriteHeader(http.StatusNotImplemented)
+			w.Write([]byte("not available\n"))
+		}))
+		t.Cleanup(func() {
+			proxyServer.Close()
+		})
+		proxyPublicAddr := proxyServer.Listener.Addr().String()
+
+		testTempDir := t.TempDir()
+
+		setupDirsForTest(t, testTempDir, distroConfig)
+
+		installerConfig := &AutoDiscoverNodeInstallerConfig{
+			RepositoryChannel: "stable/rolling",
+			AutoUpgrades:      true,
+			ProxyPublicAddr:   proxyPublicAddr,
+			TeleportPackage:   "teleport-ent",
+			TokenName:         "my-token",
+			AzureClientID:     "azure-client-id",
+			InstallationManagedByTeleportUpdateWithSuffix: "example-suffix",
+
+			fsRootPrefix:           testTempDir,
+			imdsProviders:          mockIMDSProviders,
+			binariesLocation:       binariesLocation,
+			aptPublicKeyEndpoint:   mockRepoKeys.URL,
+			autoUpgradesChannelURL: proxyServer.URL,
+		}
+
+		teleportInstaller, err := NewAutoDiscoverNodeInstaller(installerConfig)
+		require.NoError(t, err)
+
+		// One of the first things the install command does is to check if teleport is already installed.
+		// If so, it stops the installation with success.
+		// Given that we are mocking the binary, it means it already exists and as such, the installation will stop.
+		// To prevent that, we must rename the file, call `<pakageManager> install teleport` and rename it back.
+		//teleportInitialPath := mockBins["teleport"].Path
+		//teleportHiddenPath := teleportInitialPath + "-hidden"
+		//require.NoError(t, os.Rename(teleportInitialPath, teleportHiddenPath))
+
+		mockBins["teleport"].Expect("node",
+			"configure",
+			"--output=file://"+testTempDir+"/etc/teleport_example-suffix.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport_example-suffix",
+			"--proxy="+proxyPublicAddr,
+			"--join-method=azure",
+			"--token=my-token",
+			"--labels=teleport.internal/region=eastus,teleport.internal/resource-group=TestGroup,teleport.internal/subscription-id=5187AF11-3581-4AB6-A654-59405CD40C44,teleport.internal/vm-id=ED7DAC09-6E73-447F-BD18-AF4D1196C1E4",
+			"--azure-client-id=azure-client-id",
+		).AndCallFunc(func(c *bintest.Call) {
+			// create a teleport.yaml configuration file
+			require.NoError(t, os.WriteFile(testTempDir+"/etc/teleport_example-suffix.yaml.new", []byte("teleport.yaml configuration bytes"), 0o644))
+			c.Exit(0)
+		})
+
+		mockBins["systemctl"].Expect("enable", "teleport_example-suffix")
+		mockBins["systemctl"].Expect("restart", "teleport_example-suffix")
+
+		require.NoError(t, teleportInstaller.Install(ctx))
+
+		for binName, mockBin := range mockBins {
+			require.True(t, mockBin.Check(t), "mismatch between expected invocations and actual calls for %q", binName)
+		}
+		require.FileExists(t, testTempDir+"/etc/teleport_example-suffix.yaml")
+		require.FileExists(t, testTempDir+"/etc/teleport_example-suffix.yaml.discover")
+	})
+
 	t.Run("with automatic upgrades", func(t *testing.T) {
 		distroConfig := wellKnownOS["ubuntu"]["24.04"]
 
@@ -314,6 +452,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy="+proxyPublicAddr,
 			"--join-method=azure",
 			"--token=my-token",
@@ -395,6 +534,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy=proxy.example.com",
 			"--join-method=gcp",
 			"--token=my-token",
@@ -499,6 +639,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy=proxy.example.com",
 			"--join-method=azure",
 			"--token=my-token",
@@ -563,6 +704,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy=proxy.example.com",
 			"--join-method=azure",
 			"--token=my-token",
@@ -625,6 +767,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy=proxy.example.com",
 			"--join-method=azure",
 			"--token=my-token",
@@ -687,6 +830,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 		mockBins["teleport"].Expect("node",
 			"configure",
 			"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+			"--data-dir="+testTempDir+"/var/lib/teleport",
 			"--proxy=proxy.example.com",
 			"--join-method=azure",
 			"--token=my-token",
@@ -715,6 +859,7 @@ func TestAutoDiscoverNode(t *testing.T) {
 			mockBins["teleport"].Expect("node",
 				"configure",
 				"--output=file://"+testTempDir+"/etc/teleport.yaml.new",
+				"--data-dir="+testTempDir+"/var/lib/teleport",
 				"--proxy=proxy.example.com",
 				"--join-method=azure",
 				"--token=my-token",
diff --git a/lib/srv/server/installer/defaultinstallers.go b/lib/srv/server/installer/defaultinstallers.go
index 42f70c243e6db..f7cd6097f9819 100644
--- a/lib/srv/server/installer/defaultinstallers.go
+++ b/lib/srv/server/installer/defaultinstallers.go
@@ -39,7 +39,7 @@ curl -sSf "$INSTALL_SCRIPT_URL" -o "$TEMP_INSTALLER_SCRIPT"
 
 chmod +x "$TEMP_INSTALLER_SCRIPT"
 
-sudo "$TEMP_INSTALLER_SCRIPT" || (echo "The install script ($TEMP_INSTALLER_SCRIPT) returned a non-zero exit code" && exit 1)
+sudo -E "$TEMP_INSTALLER_SCRIPT" || (echo "The install script ($TEMP_INSTALLER_SCRIPT) returned a non-zero exit code" && exit 1)
 rm "$TEMP_INSTALLER_SCRIPT"`
 )
 
@@ -59,11 +59,15 @@ var (
 			"\n\n",
 		),
 	)
+	// Note: if we add namespacing support, we will need to edit this script to use the namespaced full path
 	configureTeleport = `
 echo "Configuring the Teleport agent"
 
 set +x
-sudo teleport ` + strings.Join(argsList, " ") + " $@"
+TELEPORT_BINARY=/usr/local/bin/teleport
+[ -z "${TELEPORT_INSTALL_SUFFIX:-}" ] || TELEPORT_BINARY=/opt/teleport/${TELEPORT_INSTALL_SUFFIX}/bin/teleport
+
+sudo -E "$TELEPORT_BINARY" ` + strings.Join(argsList, " ") + " $@"
 
 	argsList = []string{
 		"install", "autodiscover-node",
diff --git a/lib/srv/server/installer/defaultinstallers_test.go b/lib/srv/server/installer/defaultinstallers_test.go
index 6507a81ef5050..82930095dda95 100644
--- a/lib/srv/server/installer/defaultinstallers_test.go
+++ b/lib/srv/server/installer/defaultinstallers_test.go
@@ -42,14 +42,17 @@ curl -sSf "$INSTALL_SCRIPT_URL" -o "$TEMP_INSTALLER_SCRIPT"
 
 chmod +x "$TEMP_INSTALLER_SCRIPT"
 
-sudo "$TEMP_INSTALLER_SCRIPT" || (echo "The install script ($TEMP_INSTALLER_SCRIPT) returned a non-zero exit code" && exit 1)
+sudo -E "$TEMP_INSTALLER_SCRIPT" || (echo "The install script ($TEMP_INSTALLER_SCRIPT) returned a non-zero exit code" && exit 1)
 rm "$TEMP_INSTALLER_SCRIPT"
 
 
 echo "Configuring the Teleport agent"
 
 set +x
-sudo teleport install autodiscover-node --public-proxy-addr=teleport.example.com:443 --teleport-package=teleport-ent --repo-channel=stable/cloud --auto-upgrade=true --azure-client-id= $@`
+TELEPORT_BINARY=/usr/local/bin/teleport
+[ -z "${TELEPORT_INSTALL_SUFFIX:-}" ] || TELEPORT_BINARY=/opt/teleport/${TELEPORT_INSTALL_SUFFIX}/bin/teleport
+
+sudo -E "$TELEPORT_BINARY" install autodiscover-node --public-proxy-addr=teleport.example.com:443 --teleport-package=teleport-ent --repo-channel=stable/cloud --auto-upgrade=true --azure-client-id= $@`
 
 // TestNewDefaultInstaller is a minimal
 func TestNewDefaultInstaller(t *testing.T) {
diff --git a/lib/srv/server/installer_script.go b/lib/srv/server/installer_script.go
new file mode 100644
index 0000000000000..d793b8cfed86c
--- /dev/null
+++ b/lib/srv/server/installer_script.go
@@ -0,0 +1,154 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package server
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"net/url"
+	"path"
+	"strings"
+
+	"github.com/google/safetext/shsprintf"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// envVarsFromInstallerParams converts InstallerParams into a list of environment variables, in the form of KEY=value.
+// The output can be used as is without further escaping in scripts.
+func envVarsFromInstallerParams(params *types.InstallerParams) []string {
+	var envVars []string
+
+	// InstallSuffix and UpdateGroup only contains alphanumeric characters and hyphens.
+	// Escape them anyway as another layer of safety.
+	if params.Suffix != "" {
+		safeInstallSuffix := shsprintf.EscapeDefaultContext(params.Suffix)
+		envVars = append(envVars, "TELEPORT_INSTALL_SUFFIX="+safeInstallSuffix)
+	}
+	if params.UpdateGroup != "" {
+		safeUpdateGroup := shsprintf.EscapeDefaultContext(params.UpdateGroup)
+		envVars = append(envVars, "TELEPORT_UPDATE_GROUP="+safeUpdateGroup)
+	}
+
+	if params.HTTPProxySettings != nil {
+		if params.HTTPProxySettings.HTTPProxy != "" {
+			safeHTTPProxy := shsprintf.EscapeDefaultContext(params.HTTPProxySettings.HTTPProxy)
+			envVars = append(envVars, "HTTP_PROXY="+safeHTTPProxy)
+		}
+		if params.HTTPProxySettings.HTTPSProxy != "" {
+			safeHTTPSProxy := shsprintf.EscapeDefaultContext(params.HTTPProxySettings.HTTPSProxy)
+			envVars = append(envVars, "HTTPS_PROXY="+safeHTTPSProxy)
+		}
+		if params.HTTPProxySettings.NoProxy != "" {
+			safeNoProxy := shsprintf.EscapeDefaultContext(params.HTTPProxySettings.NoProxy)
+			envVars = append(envVars, "NO_PROXY="+safeNoProxy)
+		}
+	}
+
+	return envVars
+}
+
+type scriptOption func(*scriptOptions) *scriptOptions
+type scriptOptions struct {
+	addNonceComment bool
+	proxyAddr       proxyGetter
+}
+
+// Azure treats scripts with the same content as the same invocation and
+// won't run them more than once. This is fine when the installer script
+// succeeds, but it makes troubleshooting much harder when it fails. To
+// work around this, we generate a random string and append it as a comment
+// to the script, forcing Azure to see each invocation as unique.
+func withNonceComment() scriptOption {
+	return func(opts *scriptOptions) *scriptOptions {
+		opts.addNonceComment = true
+		return opts
+	}
+}
+
+type proxyGetter func(context.Context) (string, error)
+
+func withProxyAddrGetter(f proxyGetter) scriptOption {
+	return func(opts *scriptOptions) *scriptOptions {
+		opts.proxyAddr = f
+		return opts
+	}
+}
+
+func proxyAddress(ctx context.Context, proxyAddr string, getter proxyGetter) (string, error) {
+	if proxyAddr != "" {
+		return proxyAddr, nil
+	}
+
+	if getter != nil {
+		return getter(ctx)
+	}
+
+	return "", trace.BadParameter("proxy address is missing from the matcher and there is no available Proxy Service yet")
+}
+
+func installerScript(ctx context.Context, params *types.InstallerParams, opts ...scriptOption) (string, error) {
+	scriptOptions := &scriptOptions{}
+	for _, opt := range opts {
+		scriptOptions = opt(scriptOptions)
+	}
+
+	if params == nil {
+		return "", trace.BadParameter("installation parameters must not be nil")
+	}
+
+	proxyAddr, err := proxyAddress(ctx, params.PublicProxyAddr, scriptOptions.proxyAddr)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	scriptURLQuery := url.Values{}
+	if params.Azure != nil && params.Azure.ClientID != "" {
+		scriptURLQuery.Set("azure-client-id", shsprintf.EscapeDefaultContext(params.Azure.ClientID))
+	}
+
+	scriptURL := url.URL{
+		Scheme:   "https",
+		Host:     proxyAddr,
+		Path:     path.Join("v1", "webapi", "scripts", "installer", shsprintf.EscapeDefaultContext(params.ScriptName)),
+		RawQuery: scriptURLQuery.Encode(),
+	}
+
+	installationScript := fmt.Sprintf("curl -s -L %s | bash -s %s",
+		scriptURL.String(),
+		shsprintf.EscapeDefaultContext(params.JoinToken),
+	)
+
+	envVars := envVarsFromInstallerParams(params)
+	if len(envVars) > 0 {
+		installationScript = fmt.Sprintf("export %s; %s", strings.Join(envVars, " "), installationScript)
+	}
+
+	if scriptOptions.addNonceComment {
+		bytes := make([]byte, 8)
+		rand.Read(bytes)
+
+		installationScript = installationScript + " # " + hex.EncodeToString(bytes)
+	}
+
+	return installationScript, nil
+}
diff --git a/lib/srv/server/installer_script_test.go b/lib/srv/server/installer_script_test.go
new file mode 100644
index 0000000000000..8a8900cc75a33
--- /dev/null
+++ b/lib/srv/server/installer_script_test.go
@@ -0,0 +1,190 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestInstallerScript(t *testing.T) {
+	basicParams := func() *types.InstallerParams {
+		return &types.InstallerParams{
+			PublicProxyAddr: "proxy.example.com:443",
+			ScriptName:      "scriptName",
+			JoinToken:       "my-token",
+		}
+	}
+	for _, tt := range []struct {
+		name                   string
+		req                    func() *types.InstallerParams
+		withOptions            []scriptOption
+		errCheck               require.ErrorAssertionFunc
+		expectedScript         string
+		expectedScriptContains string
+	}{
+		{
+			name:           "basic",
+			req:            basicParams,
+			errCheck:       require.NoError,
+			expectedScript: "curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+		{
+			name:                   "with nonce to ensure script is unique",
+			req:                    basicParams,
+			withOptions:            []scriptOption{withNonceComment()},
+			errCheck:               require.NoError,
+			expectedScriptContains: "curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token # ",
+		},
+		{
+			name: "with azure clientid",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.Azure = &types.AzureInstallerParams{
+					ClientID: "my-id",
+				}
+				return req
+			},
+			withOptions:            []scriptOption{withNonceComment()},
+			errCheck:               require.NoError,
+			expectedScriptContains: "curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName?azure-client-id=my-id | bash -s my-token # ",
+		},
+		{
+			name: "with suffix installation",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.Suffix = "suffix"
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: "export TELEPORT_INSTALL_SUFFIX=suffix; curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+		{
+			name: "with update group",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.UpdateGroup = "updateGroup"
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: "export TELEPORT_UPDATE_GROUP=updateGroup; curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+		{
+			name: "with install suffix and update group",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.Suffix = "suffix"
+				req.UpdateGroup = "updateGroup"
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: "export TELEPORT_INSTALL_SUFFIX=suffix TELEPORT_UPDATE_GROUP=updateGroup; curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+		{
+			name: "missing public proxy address but getter was set up",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.PublicProxyAddr = ""
+				return req
+			},
+			withOptions: []scriptOption{
+				withProxyAddrGetter(func(ctx context.Context) (string, error) {
+					return "proxy2.example.com", nil
+				}),
+			},
+			errCheck:       require.NoError,
+			expectedScript: "curl -s -L https://proxy2.example.com/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+		{
+			name: "proxy addr is missing but getter returns an error",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.PublicProxyAddr = ""
+				return req
+			},
+			withOptions: []scriptOption{
+				withProxyAddrGetter(func(ctx context.Context) (string, error) {
+					return "", trace.NotFound("proxy service is not yet running")
+				}),
+			},
+			errCheck: require.Error,
+		},
+		{
+			name: "proxy addr is missing and getter is missing",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.PublicProxyAddr = ""
+				return req
+			},
+			errCheck: require.Error,
+		},
+		{
+			name: "with join token that needs escaping",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.JoinToken = "token$(sh)"
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: "curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s token\\$\\(sh\\)",
+		},
+		{
+			name: "with script name that needs escaping",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.ScriptName = "scriptName$(sh)"
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: `curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName%5C$%5C%28sh%5C%29 | bash -s my-token`,
+		},
+		{
+			name: "with HTTP Proxy settings set",
+			req: func() *types.InstallerParams {
+				req := basicParams()
+				req.HTTPProxySettings = &types.HTTPProxySettings{
+					HTTPSProxy: "http://local-squid:3128",
+					HTTPProxy:  "http://local-squid:3128",
+					NoProxy:    "http://intranet.local",
+				}
+				return req
+			},
+			errCheck:       require.NoError,
+			expectedScript: "export HTTP_PROXY=http://local-squid:3128 HTTPS_PROXY=http://local-squid:3128 NO_PROXY=http://intranet.local; curl -s -L https://proxy.example.com:443/v1/webapi/scripts/installer/scriptName | bash -s my-token",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			script, err := installerScript(t.Context(), tt.req(), tt.withOptions...)
+			tt.errCheck(t, err)
+
+			if tt.expectedScriptContains != "" {
+				require.Contains(t, script, tt.expectedScriptContains)
+			}
+
+			if tt.expectedScript != "" {
+				require.Equal(t, tt.expectedScript, script)
+			}
+		})
+	}
+}
diff --git a/lib/srv/server/ssm_install.go b/lib/srv/server/ssm_install.go
index 6c977a4b38be1..6cc5a2b5cec65 100644
--- a/lib/srv/server/ssm_install.go
+++ b/lib/srv/server/ssm_install.go
@@ -35,15 +35,23 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/usertasks"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	libevents "github.com/gravitational/teleport/lib/events"
 )
 
-// waiterTimedOutErrorMessage is the error message returned by the AWS SDK command
-// executed waiter when it times out.
-const waiterTimedOutErrorMessage = "exceeded max wait time for CommandExecuted waiter"
+const (
+	// waiterTimedOutErrorMessage is the error message returned by the AWS SDK command
+	// executed waiter when it times out.
+	waiterTimedOutErrorMessage = "exceeded max wait time for CommandExecuted waiter"
+
+	// waiterTransitionedToFailureErrorMessage is the error message returned by the AWS SDK command
+	//nolint:misspell // ignore Cancelled and Cancelling
+	// executed waiter when the command state transitions to one of Cancelled, TimedOut, Failed or Cancelling.
+	waiterTransitionedToFailureErrorMessage = "waiter state transitioned to Failure"
+)
 
 // SSMClient is the subset of the AWS SSM API required for EC2 discovery.
 type SSMClient interface {
@@ -210,16 +218,25 @@ func (si *SSMInstaller) Run(ctx context.Context, req SSMRunRequest) error {
 		Parameters:   params,
 	})
 	if err != nil {
-		invalidParamErrorMessage := fmt.Sprintf("InvalidParameters: document %s does not support parameters", req.DocumentName)
-		_, hasSSHDConfigParam := params[ParamSSHDConfigPath]
-		if !strings.Contains(err.Error(), invalidParamErrorMessage) || !hasSSHDConfigParam {
+		// This might happen when teleport sends Parameters that are not part of the Document.
+		const invalidParamErrorMessage = "InvalidParameters"
+		if !strings.Contains(err.Error(), invalidParamErrorMessage) {
 			return trace.Wrap(err)
 		}
 
-		// This might happen when teleport sends Parameters that are not part of the Document.
-		// One example is when it uses the default SSM Document awslib.EC2DiscoverySSMDocument
-		// and Parameters include "sshdConfigPath" (only sent when installTeleport=false).
-		//
+		// The env param was added in v18.2.x, so older versions of the Document will reject it.
+		// Handle this error gracefully and ask the user to update the SSM Document.
+		_, hasEnvParam := params[ParamEnvVars]
+		if hasEnvParam {
+			return trace.BadParameter("%q param is missing in the SSM Document %s (%s), refer to https://goteleport.com/docs/enroll-resources/auto-discovery/servers/ec2-discovery/ec2-discovery-manual/ to update the document to the latest version: %v", ParamEnvVars, req.DocumentName, req.Region, err)
+		}
+
+		// The sshdConfigPath param only exists for non-agent installations of teleport (ie, openssh agents).
+		// If the SSM Document does not support the sshdConfigPath param, but it was sent, the command will fail with an InvalidParameters error.
+		_, hasSSHDConfigParam := params[ParamSSHDConfigPath]
+		if !hasSSHDConfigParam {
+			return trace.Wrap(err)
+		}
 		// As a best effort, we try to call ssm.SendCommand again but this time without the "sshdConfigPath" param
 		// We must not remove the Param "sshdConfigPath" beforehand because customers might be using custom SSM Documents for ec2 auto discovery.
 		delete(params, ParamSSHDConfigPath)
@@ -364,25 +381,29 @@ func (si *SSMInstaller) describeSSMAgentState(ctx context.Context, req SSMRunReq
 	return ret, nil
 }
 
-// skipAWSWaitErr is used to ignore the error returned from
-// Wait if it times out, as this can represent one of several different errors which
-// are handled by checking the command invocation after calling this
-// to get more information about the error.
-func skipAWSWaitErr(err error) error {
-	if err != nil && err.Error() == waiterTimedOutErrorMessage {
-		return nil
-	}
-	return trace.Wrap(err)
-}
-
 func (si *SSMInstaller) checkCommand(ctx context.Context, req SSMRunRequest, commandID, instanceID *string, instanceName string) error {
 	err := si.getWaiter(req.SSM).Wait(ctx, &ssm.GetCommandInvocationInput{
 		CommandId:  commandID,
 		InstanceId: instanceID,
 		// 100 seconds to match v1 sdk waiter default.
 	}, 100*time.Second)
+	switch {
+	case err == nil:
+		// Command executed successfully.
 
-	if err := skipAWSWaitErr(err); err != nil {
+	case err.Error() == waiterTransitionedToFailureErrorMessage:
+		//nolint:misspell // ignore Cancelled and Cancelling
+		// When the command invocation state is one of Cancelled, TimedOut, Failed or Cancelling,
+		// the waiter returns the error message above.
+		// Ignoring this error allows us to get the actual command status to report it.
+
+	case err.Error() == waiterTimedOutErrorMessage:
+		// When the Waiter times out, it returns the error message above.
+		// The command might still be Pending or InProgress.
+		// Ignoring this error allows us to report that status back to the user.
+
+	default:
+		// For every other unknown error, return the error.
 		return trace.Wrap(err)
 	}
 
@@ -449,6 +470,12 @@ func (si *SSMInstaller) checkCommand(ctx context.Context, req SSMRunRequest, com
 }
 
 func (si *SSMInstaller) getInvocationSteps(ctx context.Context, req SSMRunRequest, commandID, instanceID *string) ([]string, error) {
+	if req.DocumentName == types.AWSSSMDocumentRunShellScript {
+		// The AWS-RunShellScript pre-defined SSM Document has no defined steps, only params.
+		// Return early, preventing a call to ssm:ListCommandInvocations.
+		return []string{""}, nil
+	}
+
 	// ssm:ListCommandInvocations is used to list the actual steps because users might be using a custom SSM Document.
 	listCommandInvocationResp, err := req.SSM.ListCommandInvocations(ctx, &ssm.ListCommandInvocationsInput{
 		CommandId:  commandID,
diff --git a/lib/srv/server/ssm_install_test.go b/lib/srv/server/ssm_install_test.go
index e7f498f9edbf6..b698f99db9ec1 100644
--- a/lib/srv/server/ssm_install_test.go
+++ b/lib/srv/server/ssm_install_test.go
@@ -21,6 +21,7 @@ package server
 import (
 	"context"
 	"fmt"
+	"slices"
 	"testing"
 	"time"
 
@@ -37,6 +38,7 @@ import (
 type mockSSMClient struct {
 	SSMClient
 	commandOutput          *ssm.SendCommandOutput
+	waiterTimeout          bool
 	commandInvokeOutput    map[string]*ssm.GetCommandInvocationOutput
 	describeOutput         *ssm.DescribeInstanceInformationOutput
 	listCommandInvocations *ssm.ListCommandInvocationsOutput
@@ -44,10 +46,17 @@ type mockSSMClient struct {
 
 const docWithoutSSHDConfigPathParam = "ssmdocument-without-sshdConfigPath-param"
 
+const docWithoutEnvParam = "ssmdocument-without-env-param"
+
 func (sm *mockSSMClient) SendCommand(_ context.Context, input *ssm.SendCommandInput, _ ...func(*ssm.Options)) (*ssm.SendCommandOutput, error) {
 	if _, hasExtraParam := input.Parameters["sshdConfigPath"]; hasExtraParam && aws.ToString(input.DocumentName) == docWithoutSSHDConfigPathParam {
 		return nil, fmt.Errorf("InvalidParameters: document %s does not support parameters", docWithoutSSHDConfigPathParam)
 	}
+
+	if _, hasExtraParam := input.Parameters["env"]; hasExtraParam && aws.ToString(input.DocumentName) == docWithoutEnvParam {
+		return nil, fmt.Errorf("InvalidParameters: document %s does not support parameters", docWithoutEnvParam)
+	}
+
 	return sm.commandOutput, nil
 }
 
@@ -73,9 +82,20 @@ func (sm *mockSSMClient) ListCommandInvocations(_ context.Context, input *ssm.Li
 }
 
 func (sm *mockSSMClient) Wait(ctx context.Context, params *ssm.GetCommandInvocationInput, maxWaitDur time.Duration, optFns ...func(*ssm.CommandExecutedWaiterOptions)) error {
-	if sm.commandOutput.Command.Status == ssmtypes.CommandStatusFailed {
+	if sm.waiterTimeout {
 		return trace.Errorf(waiterTimedOutErrorMessage)
 	}
+
+	var failureStates = []ssmtypes.CommandStatus{
+		ssmtypes.CommandStatusCancelled,
+		ssmtypes.CommandStatusFailed,
+		ssmtypes.CommandStatusTimedOut,
+		ssmtypes.CommandStatusCancelling,
+	}
+
+	if slices.Contains(failureStates, sm.commandOutput.Command.Status) {
+		return trace.Errorf(waiterTransitionedToFailureErrorMessage)
+	}
 	return nil
 }
 
@@ -95,6 +115,7 @@ func TestSSMInstaller(t *testing.T) {
 		client                *mockSSMClient
 		req                   SSMRunRequest
 		expectedInstallations []*SSMInstallationResult
+		expectedRunErrCheck   require.ErrorAssertionFunc
 		name                  string
 	}{
 		{
@@ -194,6 +215,38 @@ func TestSSMInstaller(t *testing.T) {
 				SSMDocumentName: "ssmdocument-without-sshdConfigPath-param",
 			}},
 		},
+		{
+			name: "params do not include env",
+			req: SSMRunRequest{
+				Instances: []EC2Instance{
+					{InstanceID: "instance-id-1"},
+				},
+				DocumentName: docWithoutEnvParam,
+				Params:       map[string]string{"env": "FOO=bar BAZ=qux"},
+				Region:       "eu-central-1",
+				AccountID:    "account-id",
+			},
+			client: &mockSSMClient{
+				commandOutput: &ssm.SendCommandOutput{
+					Command: &ssmtypes.Command{
+						CommandId: aws.String("command-id-1"),
+					},
+				},
+				commandInvokeOutput: map[string]*ssm.GetCommandInvocationOutput{
+					"downloadContent": {
+						Status:       ssmtypes.CommandInvocationStatusSuccess,
+						ResponseCode: 0,
+					},
+					"runShellScript": {
+						Status:       ssmtypes.CommandInvocationStatusSuccess,
+						ResponseCode: 0,
+					},
+				},
+			},
+			expectedRunErrCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(tt, err, "update the document")
+			},
+		},
 		{
 			name: "ssm run failed in download content",
 			req: SSMRunRequest{
@@ -210,6 +263,7 @@ func TestSSMInstaller(t *testing.T) {
 				commandOutput: &ssm.SendCommandOutput{
 					Command: &ssmtypes.Command{
 						CommandId: aws.String("command-id-1"),
+						Status:    ssmtypes.CommandStatusFailed,
 					},
 				},
 				commandInvokeOutput: map[string]*ssm.GetCommandInvocationOutput{
@@ -242,6 +296,55 @@ func TestSSMInstaller(t *testing.T) {
 				SSMDocumentName: "ssmdocument",
 			}},
 		},
+		{
+			name: "ssm run takes too long, and waiter times out",
+			req: SSMRunRequest{
+				DocumentName: document,
+				Instances: []EC2Instance{
+					{InstanceID: "instance-id-1"},
+				},
+				IntegrationName: "aws-1",
+				Params:          map[string]string{"token": "abcdefg"},
+				Region:          "eu-central-1",
+				AccountID:       "account-id",
+			},
+			client: &mockSSMClient{
+				waiterTimeout: true,
+				commandOutput: &ssm.SendCommandOutput{
+					Command: &ssmtypes.Command{
+						CommandId: aws.String("command-id-1"),
+						Status:    ssmtypes.CommandStatusInProgress,
+					},
+				},
+				commandInvokeOutput: map[string]*ssm.GetCommandInvocationOutput{
+					"downloadContent": {
+						Status:                ssmtypes.CommandInvocationStatusInProgress,
+						StandardErrorContent:  aws.String("downloading..."),
+						StandardOutputContent: aws.String(""),
+					},
+				},
+			},
+			expectedInstallations: []*SSMInstallationResult{{
+				IntegrationName: "aws-1",
+				SSMRunEvent: &events.SSMRun{
+					Metadata: events.Metadata{
+						Type: libevent.SSMRunEvent,
+						Code: libevent.SSMRunFailCode,
+					},
+					CommandID:      "command-id-1",
+					InstanceID:     "instance-id-1",
+					AccountID:      "account-id",
+					Region:         "eu-central-1",
+					ExitCode:       -1,
+					Status:         string(ssmtypes.CommandInvocationStatusInProgress),
+					StandardOutput: "",
+					StandardError:  "downloading...",
+					InvocationURL:  "https://eu-central-1.console.aws.amazon.com/systems-manager/run-command/command-id-1/instance-id-1",
+				},
+				IssueType:       "ec2-ssm-script-failure",
+				SSMDocumentName: "ssmdocument",
+			}},
+		},
 		{
 			name: "ssm run failed in run shell script",
 			req: SSMRunRequest{
@@ -257,6 +360,7 @@ func TestSSMInstaller(t *testing.T) {
 				commandOutput: &ssm.SendCommandOutput{
 					Command: &ssmtypes.Command{
 						CommandId: aws.String("command-id-1"),
+						Status:    ssmtypes.CommandStatusFailed,
 					},
 				},
 				commandInvokeOutput: map[string]*ssm.GetCommandInvocationOutput{
@@ -524,7 +628,11 @@ func TestSSMInstaller(t *testing.T) {
 			require.NoError(t, err)
 
 			err = inst.Run(ctx, tc.req)
-			require.NoError(t, err)
+			if tc.expectedRunErrCheck != nil {
+				tc.expectedRunErrCheck(t, err)
+			} else {
+				require.NoError(t, err)
+			}
 
 			require.ElementsMatch(t, tc.expectedInstallations, installationResultsCollector.installations)
 		})
diff --git a/lib/srv/server/watcher.go b/lib/srv/server/watcher.go
index 53409171c2ba0..f4bbb28dc36b9 100644
--- a/lib/srv/server/watcher.go
+++ b/lib/srv/server/watcher.go
@@ -42,7 +42,7 @@ type Fetcher interface {
 	GetInstances(ctx context.Context, rotation bool) ([]Instances, error)
 	// GetMatchingInstances finds Instances from the list of nodes
 	// that the fetcher matches.
-	GetMatchingInstances(nodes []types.Server, rotation bool) ([]Instances, error)
+	GetMatchingInstances(ctx context.Context, nodes []types.Server, rotation bool) ([]Instances, error)
 	// GetDiscoveryConfigName returns the DiscoveryConfig name that created this fetcher.
 	// Empty for Fetchers created from `teleport.yaml/discovery_service.aws.<Matcher>` matchers.
 	GetDiscoveryConfigName() string
@@ -129,7 +129,7 @@ func (w *Watcher) Run() {
 		select {
 		case insts := <-w.missedRotation:
 			for _, fetcher := range w.fetchersFn() {
-				w.sendInstancesOrLogError(fetcher.GetMatchingInstances(insts, true))
+				w.sendInstancesOrLogError(fetcher.GetMatchingInstances(w.ctx, insts, true))
 			}
 
 		case <-pollTimer.Chan():
diff --git a/lib/srv/sess.go b/lib/srv/sess.go
index ac2d8f41dfca3..464176db3012f 100644
--- a/lib/srv/sess.go
+++ b/lib/srv/sess.go
@@ -26,9 +26,6 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"os"
-	"os/user"
-	"path/filepath"
 	"slices"
 	"strconv"
 	"sync"
@@ -50,7 +47,7 @@ import (
 	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
@@ -58,9 +55,7 @@ import (
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/services"
 	rsession "github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/utils"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 const sessionRecorderID = "session-recorder"
@@ -356,48 +351,21 @@ func (s *SessionRegistry) UpsertHostUser(identityContext IdentityContext, obtain
 	return true, userCloser, nil
 }
 
-// OpenSession either joins an existing active session or starts a new session.
+// OpenSession either starts a new session.
 func (s *SessionRegistry) OpenSession(ctx context.Context, ch ssh.Channel, scx *ServerContext) error {
-	session := scx.getSession()
-	if session != nil && !session.isStopped() {
-		scx.Logger.InfoContext(ctx, "Joining existing session", "session_id", session.id)
-		mode := types.SessionParticipantMode(scx.env[teleport.EnvSSHJoinMode])
-		if mode == "" {
-			mode = types.SessionPeerMode
-		}
-
-		switch mode {
-		case types.SessionModeratorMode, types.SessionObserverMode, types.SessionPeerMode:
-		default:
-			return trace.BadParameter("Unrecognized session participant mode: %v", mode)
-		}
-
-		// Update the in-memory data structure that a party member has joined.
-		if err := session.join(ch, scx, mode); err != nil {
-			return trace.Wrap(err)
-		}
-
-		return nil
-	}
-
 	if scx.JoinOnly {
 		return trace.AccessDenied("join-only mode was used to create this connection but attempted to create a new session.")
 	}
 
-	sid := scx.SessionID()
-	if sid.IsZero() {
-		return trace.BadParameter("session ID is not set")
-	}
-
 	// This logic allows concurrent request to create a new session
 	// to fail, what is ok because we should never have this condition
-	sess, p, err := newSession(ctx, sid, s, scx, ch, sessionTypeInteractive)
+	sess, p, err := newSession(ctx, s, scx, ch, sessionTypeInteractive)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	scx.setSession(ctx, sess, ch)
+	scx.setSession(ctx, sess)
 	s.addSession(sess)
-	scx.Logger.InfoContext(ctx, "Creating interactive session", "session_id", sid)
+	scx.Logger.InfoContext(ctx, "Creating interactive session", "session_id", sess.id)
 
 	// Start an interactive session (TTY attached). Close the session if an error
 	// occurs, otherwise it will be closed by the callee.
@@ -408,26 +376,46 @@ func (s *SessionRegistry) OpenSession(ctx context.Context, ch ssh.Channel, scx *
 	return nil
 }
 
-// OpenExecSession opens a non-interactive exec session.
-func (s *SessionRegistry) OpenExecSession(ctx context.Context, channel ssh.Channel, scx *ServerContext) error {
-	sessionID := scx.SessionID()
+// JoinSession joins an existing interactive session.
+func (s *SessionRegistry) JoinSession(ctx context.Context, ch ssh.Channel, scx *ServerContext, sid string, mode types.SessionParticipantMode) error {
+	// make sure whatever session is requested is a valid session
+	id, err := rsession.ParseID(sid)
+	if err != nil {
+		return trace.BadParameter("invalid session ID %s", sid)
+	}
 
-	if sessionID.IsZero() {
-		sessionID = rsession.NewID()
-		scx.Logger.Log(ctx, logutils.TraceLevel, "Session not found, creating a new session", "session_id", sessionID)
-	} else {
-		// Use passed session ID. Assist uses this "feature" to record
-		// the execution output.
-		scx.Logger.Log(ctx, logutils.TraceLevel, "Session found, reusing it", "session_id", sessionID)
+	session, ok := s.findSession(*id)
+	if !ok || session.isStopped() {
+		return trace.NotFound("session not found or no longer running")
 	}
 
+	scx.Logger.InfoContext(ctx, "Joining existing session", "session_id", session.id)
+
+	switch mode {
+	case types.SessionModeratorMode, types.SessionObserverMode, types.SessionPeerMode:
+	default:
+		return trace.BadParameter("Unrecognized session participant mode: %q", mode)
+	}
+
+	scx.setSession(ctx, session)
+
+	// Update the in-memory data structure that a party member has joined.
+	if err := session.join(ch, scx, mode); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// OpenExecSession opens a non-interactive exec session.
+func (s *SessionRegistry) OpenExecSession(ctx context.Context, channel ssh.Channel, scx *ServerContext) error {
 	// This logic allows concurrent request to create a new session
 	// to fail, what is ok because we should never have this condition.
-	sess, _, err := newSession(ctx, sessionID, s, scx, channel, sessionTypeNonInteractive)
+	sess, _, err := newSession(ctx, s, scx, channel, sessionTypeNonInteractive)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	scx.Logger.InfoContext(ctx, "Creating exec session", "session_id", sessionID)
+	scx.Logger.InfoContext(ctx, "Creating exec session", "session_id", sess.id)
 
 	approved, err := s.isApprovedFileTransfer(scx)
 	if err != nil {
@@ -449,7 +437,7 @@ func (s *SessionRegistry) OpenExecSession(ctx context.Context, channel ssh.Chann
 
 	// Start a non-interactive session (TTY attached). Close the session if an error
 	// occurs, otherwise it will be closed by the callee.
-	scx.setSession(ctx, sess, channel)
+	scx.setSession(ctx, sess)
 
 	err = sess.startExec(ctx, channel, scx)
 	if err != nil {
@@ -490,11 +478,10 @@ func (s *SessionRegistry) GetTerminalSize(sessionID string) (*term.Winsize, erro
 }
 
 func (s *SessionRegistry) isApprovedFileTransfer(scx *ServerContext) (bool, error) {
-	// If the TELEPORT_MODERATED_SESSION_ID environment variable was not
-	// set, return not approved and no error. This means the file
-	// transfer came from a non-moderated session. sessionID will be
-	// passed after a moderated session approval process has completed.
-	sessID, _ := scx.GetEnv(string(sftp.ModeratedSessionID))
+	// If the ModeratedSessionID param was not provided, return not approved
+	// and no error. This means the file transfer came from a non-moderated session.
+	// sessionID will be passed after a moderated session approval process has completed.
+	sessID := scx.GetSessionParams().ModeratedSessionID
 	if sessID == "" {
 		return false, nil
 	}
@@ -624,8 +611,23 @@ func (s *SessionRegistry) notifyFileTransferRequestUnderLock(req *FileTransferRe
 func (s *SessionRegistry) NotifyWinChange(ctx context.Context, params rsession.TerminalParams, scx *ServerContext) error {
 	session := scx.getSession()
 	if session == nil {
-		s.logger.DebugContext(ctx, "Unable to update window size, no session found in context.")
-		return nil
+		sessParams := scx.GetSessionParams()
+		if sessParams.JoinSessionID == "" {
+			s.logger.DebugContext(ctx, "Unable to update window size, no session found in context.")
+			return nil
+		}
+
+		id, err := rsession.ParseID(sessParams.JoinSessionID)
+		if err != nil {
+			return trace.BadParameter("invalid session ID %s", sessParams.JoinSessionID)
+		}
+
+		var ok bool
+		session, ok = s.findSession(*id)
+		if !ok {
+			s.logger.DebugContext(ctx, "Unable to update window size, no session found in context.")
+			return nil
+		}
 	}
 
 	// Build the resize event.
@@ -706,9 +708,14 @@ func (s *SessionRegistry) broadcastResult(sid rsession.ID, r ExecResult) error {
 // in order to start and join sessions.
 type SessionAccessEvaluator interface {
 	IsModerated() bool
-	FulfilledFor(participants []auth.SessionAccessContext) (bool, auth.PolicyOptions, error)
+	FulfilledFor(participants []moderation.SessionAccessContext) (bool, moderation.PolicyOptions, error)
 	PrettyRequirementsList() string
-	CanJoin(user auth.SessionAccessContext) []types.SessionParticipantMode
+	CanJoin(user moderation.SessionAccessContext) []types.SessionParticipantMode
+}
+
+type sessionInitiatorInfo struct {
+	user    string
+	cluster string
 }
 
 // session struct describes an active (in progress) SSH session. These sessions
@@ -770,7 +777,7 @@ type session struct {
 
 	tracker *SessionTracker
 
-	initiator string
+	initiator sessionInitiatorInfo
 
 	scx *ServerContext
 
@@ -803,12 +810,22 @@ const (
 )
 
 // newSession creates a new session with a given ID within a given context.
-func newSession(ctx context.Context, id rsession.ID, r *SessionRegistry, scx *ServerContext, ch ssh.Channel, sessType sessionType) (*session, *party, error) {
+func newSession(ctx context.Context, r *SessionRegistry, scx *ServerContext, ch ssh.Channel, sessType sessionType) (*session, *party, error) {
+	var sessionRecordingMode constants.SessionRecordingMode
+	switch {
+	case scx.Identity.AccessPermit != nil:
+		sessionRecordingMode = constants.SessionRecordingMode(scx.Identity.AccessPermit.SessionRecordingMode)
+	case scx.Identity.ProxyingPermit != nil:
+		sessionRecordingMode = scx.Identity.ProxyingPermit.SessionRecordingMode
+	default:
+		return nil, nil, trace.BadParameter("session creation only supported in context of ssh access or proxying permit")
+	}
+
 	serverSessions.Inc()
 	startTime := time.Now().UTC()
 	rsess := rsession.Session{
 		Kind: types.SSHSessionKind,
-		ID:   id,
+		ID:   scx.GetNewSessionID(),
 		TerminalParams: rsession.TerminalParams{
 			W: teleport.DefaultTerminalWidth,
 			H: teleport.DefaultTerminalHeight,
@@ -833,33 +850,45 @@ func newSession(ctx context.Context, id rsession.ID, r *SessionRegistry, scx *Se
 		rsess.TerminalParams.H = int(winsize.Height)
 	}
 
-	policySets := scx.Identity.UnstableSessionJoiningAccessChecker.SessionPolicySets()
-	access := auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, scx.Identity.TeleportUser)
+	var policySets []*types.SessionTrackerPolicySet
+	if scx.Identity.UnstableSessionJoiningAccessChecker != nil {
+		policySets = scx.Identity.UnstableSessionJoiningAccessChecker.SessionPolicySets()
+	}
+
+	access := moderation.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, scx.Identity.TeleportUser)
 	sess := &session{
 		logger: slog.With(
 			teleport.ComponentKey, teleport.Component(teleport.ComponentSession, r.Srv.Component()),
-			"session_id", id,
+			"session_id", rsess.ID,
 		),
-		id:                             id,
-		registry:                       r,
-		parties:                        make(map[rsession.ID]*party),
-		participants:                   make(map[rsession.ID]*party),
-		login:                          scx.Identity.Login,
-		stopC:                          make(chan struct{}),
-		startTime:                      startTime,
-		emitter:                        scx.srv,
-		serverCtx:                      scx.srv.Context(),
-		access:                         &access,
-		scx:                            scx,
-		presenceEnabled:                scx.Identity.UnmappedIdentity.MFAVerified != "",
-		io:                             NewTermManager(),
-		doneCh:                         make(chan struct{}),
-		initiator:                      scx.Identity.TeleportUser,
-		displayParticipantRequirements: utils.AsBool(scx.env[teleport.EnvSSHSessionDisplayParticipantRequirements]),
-		serverMeta:                     scx.srv.TargetMetadata(),
-	}
-
-	sess.io.OnWriteError = sess.onWriteError
+		id:              rsess.ID,
+		registry:        r,
+		parties:         make(map[rsession.ID]*party),
+		participants:    make(map[rsession.ID]*party),
+		login:           scx.Identity.Login,
+		stopC:           make(chan struct{}),
+		startTime:       startTime,
+		emitter:         scx.srv,
+		serverCtx:       scx.srv.Context(),
+		access:          &access,
+		scx:             scx,
+		presenceEnabled: scx.Identity.UnmappedIdentity.MFAVerified != "",
+		io:              NewTermManager(),
+		doneCh:          make(chan struct{}),
+		initiator: sessionInitiatorInfo{
+			user:    scx.Identity.TeleportUser,
+			cluster: scx.Identity.OriginClusterName,
+		},
+		displayParticipantRequirements: scx.GetSessionParams().DisplayParticipantRequirements,
+		serverMeta:                     scx.srv.EventMetadata(),
+	}
+
+	sess.io.OnWriteError = sess.onWriteErrorCallback(sessionRecordingMode)
+
+	// Nodes discard events in cases when proxies are already recording them.
+	if !sess.shouldHandleRecording() {
+		sess.emitter = events.NewDiscardAuditLog()
+	}
 
 	go func() {
 		if _, open := <-sess.io.TerminateNotifier(); open {
@@ -883,7 +912,7 @@ func newSession(ctx context.Context, id rsession.ID, r *SessionRegistry, scx *Se
 		return nil, nil, trace.Wrap(err)
 	}
 
-	sess.recorder, err = newRecorder(sess, scx)
+	sess.recorder, err = newRecorder(sess, scx, sessType)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -1041,15 +1070,10 @@ func (s *session) emitSessionStartEvent(ctx *ServerContext) {
 			RemoteAddr: ctx.ServerConn.RemoteAddr().String(),
 			Protocol:   events.EventProtocolSSH,
 		},
-		SessionRecording: s.sessionRecordingMode(),
+		SessionRecording: s.sessionRecordingLocation(),
 		InitialCommand:   initialCommand,
-		Reason:           s.scx.env[teleport.EnvSSHSessionReason],
-	}
-
-	if invitedUsers := s.scx.env[teleport.EnvSSHSessionInvited]; invitedUsers != "" {
-		if err := json.Unmarshal([]byte(invitedUsers), &sessionStartEvent.Invited); err != nil {
-			s.logger.WarnContext(ctx.srv.Context(), "Failed to parse invited users", "error", err)
-		}
+		Reason:           s.scx.GetSessionParams().Reason,
+		Invited:          s.scx.GetSessionParams().Invited,
 	}
 
 	if s.term != nil {
@@ -1153,20 +1177,14 @@ func (s *session) emitSessionLeaveEventUnderLock(ctx *ServerContext) {
 		SessionMetadata: s.scx.GetSessionMetadata(),
 		UserMetadata:    ctx.Identity.GetUserMetadata(),
 	}
-	preparedEvent, err := s.Recorder().PrepareSessionEvent(sessionLeaveEvent)
-	if err == nil {
-		if err := s.recordEvent(ctx.srv.Context(), preparedEvent); err != nil {
-			s.logger.WarnContext(ctx.srv.Context(), "Failed to record session leave event.", "error", err)
-		}
-		if err := s.emitAuditEvent(ctx.srv.Context(), preparedEvent.GetAuditEvent()); err != nil {
-			s.logger.WarnContext(ctx.srv.Context(), "Failed to emit session leave event.", "error", err)
-		}
-	} else {
-		s.logger.WarnContext(ctx.srv.Context(), "Failed to set up session leave event - event will not be recorded.", "error", err)
+	preparedEvent, prepareErr := s.Recorder().PrepareSessionEvent(sessionLeaveEvent)
+	if prepareErr != nil {
+		s.logger.WarnContext(ctx.srv.Context(), "Failed to set up session leave event - event will not be recorded.", "error", prepareErr)
 	}
-
 	// Notify all members of the party that a new member has left over the
-	// "x-teleport-event" channel.
+	// "x-teleport-event" channel. This has to be done after preparing the event
+	// (to capture any changes by PrepareSessionEvent) but before emitting the
+	// event (to prevent a race on sessionLeaveEvent).
 	for _, p := range s.parties {
 		eventPayload, err := utils.FastMarshal(sessionLeaveEvent)
 		if err != nil {
@@ -1183,6 +1201,14 @@ func (s *session) emitSessionLeaveEventUnderLock(ctx *ServerContext) {
 		}
 		s.logger.DebugContext(ctx.srv.Context(), "Sent session leave event to party.", "party", p)
 	}
+	if prepareErr == nil {
+		if err := s.recordEvent(ctx.srv.Context(), preparedEvent); err != nil {
+			s.logger.WarnContext(ctx.srv.Context(), "Failed to record session leave event.", "error", err)
+		}
+		if err := s.emitAuditEvent(ctx.srv.Context(), preparedEvent.GetAuditEvent()); err != nil {
+			s.logger.WarnContext(ctx.srv.Context(), "Failed to emit session leave event.", "error", err)
+		}
+	}
 }
 
 // emitSessionEndEvent emits a session end event.
@@ -1213,17 +1239,31 @@ func (s *session) emitSessionEndEvent() {
 		Interactive:       s.term != nil,
 		StartTime:         start,
 		EndTime:           end,
-		SessionRecording:  s.sessionRecordingMode(),
+		SessionRecording:  s.sessionRecordingLocation(),
 	}
 
 	for _, p := range s.participants {
-		sessionEndEvent.Participants = append(sessionEndEvent.Participants, p.user)
+		username := services.UsernameForCluster(
+			services.UsernameForClusterConfig{
+				User:              p.user,
+				OriginClusterName: p.originCluster,
+				LocalClusterName:  ctx.ClusterName,
+			},
+		)
+		sessionEndEvent.Participants = append(sessionEndEvent.Participants, username)
 	}
 
 	// If there are 0 participants, this is an exec session.
 	// Use the user from the session context.
 	if len(s.participants) == 0 {
-		sessionEndEvent.Participants = []string{s.scx.Identity.TeleportUser}
+		username := services.UsernameForCluster(
+			services.UsernameForClusterConfig{
+				User:              s.scx.Identity.TeleportUser,
+				OriginClusterName: s.scx.Identity.OriginClusterName,
+				LocalClusterName:  ctx.ClusterName,
+			},
+		)
+		sessionEndEvent.Participants = []string{username}
 	}
 
 	preparedEvent, err := s.Recorder().PrepareSessionEvent(sessionEndEvent)
@@ -1239,7 +1279,11 @@ func (s *session) emitSessionEndEvent() {
 	}
 }
 
-func (s *session) sessionRecordingMode() string {
+func (s *session) shouldHandleRecording() bool {
+	return s.scx.ShouldHandleSessionRecording()
+}
+
+func (s *session) sessionRecordingLocation() string {
 	sessionRecMode := s.scx.SessionRecordingConfig.GetMode()
 	subKind := s.serverMeta.ServerSubKind
 
@@ -1393,42 +1437,26 @@ func (s *session) startInteractive(ctx context.Context, scx *ServerContext, p *p
 	// Open a BPF recording session. If BPF was not configured, not available,
 	// or running in a recording proxy, OpenSession is a NOP.
 	sessionContext := &bpf.SessionContext{
-		Context:        scx.srv.Context(),
-		PID:            s.term.PID(),
-		Emitter:        s.emitter,
-		Namespace:      scx.srv.GetNamespace(),
-		SessionID:      s.id.String(),
-		ServerID:       scx.srv.HostUUID(),
-		ServerHostname: scx.srv.GetInfo().GetHostname(),
-		Login:          scx.Identity.Login,
-		User:           scx.Identity.TeleportUser,
-		Events:         eventsMap,
+		Context:               scx.srv.Context(),
+		PID:                   s.term.PID(),
+		Emitter:               s.emitter,
+		Namespace:             scx.srv.GetNamespace(),
+		SessionID:             s.id.String(),
+		ServerID:              scx.srv.ID(),
+		ServerHostname:        scx.srv.GetInfo().GetHostname(),
+		Login:                 scx.Identity.Login,
+		User:                  scx.Identity.TeleportUser,
+		UserOriginClusterName: scx.Identity.OriginClusterName,
+		UserRoles:             scx.Identity.MappedRoles,
+		UserTraits:            scx.Identity.Traits,
+		Events:                eventsMap,
+	}
+
+	if err := s.term.WaitForChild(ctx); err != nil {
+		return trace.Wrap(err)
 	}
 
 	bpfService := scx.srv.GetBPF()
-
-	// Only wait for the child to be "ready" if BPF is enabled. This is required
-	// because PAM might inadvertently move the child process to another cgroup
-	// by invoking systemd. If this happens, then the cgroup filter used by BPF
-	// will be looking for events in the wrong cgroup and no events will be captured.
-	// However, unconditionally waiting for the child to be ready results in PAM
-	// deadlocking because stdin/stdout/stderr which it uses to relay details from
-	// PAM auth modules are not properly copied until _after_ the shell request is
-	// replied to.
-	if bpfService.Enabled() {
-		if err := s.term.WaitForChild(); err != nil {
-			s.logger.ErrorContext(ctx, "Child process never became ready.", "error", err)
-			return trace.Wrap(err)
-		}
-	} else {
-		// Clean up the read half of the pipe, and set it to nil so that when the
-		// ServerContext is closed it doesn't attempt to a second close.
-		if err := s.scx.readyr.Close(); err != nil {
-			s.logger.ErrorContext(ctx, "Failed closing child ready pipe", "error", err)
-		}
-		s.scx.readyr = nil
-	}
-
 	if cgroupID, err := bpfService.OpenSession(sessionContext); err != nil {
 		s.logger.ErrorContext(ctx, "Failed to open enhanced recording (interactive) session.", "error", err)
 		return trace.Wrap(err)
@@ -1494,12 +1522,13 @@ func (s *session) startTerminal(ctx context.Context, scx *ServerContext) error {
 
 	// allocate a terminal or take the one previously allocated via a
 	// separate "allocate TTY" SSH request
-	var err error
 	if s.term = scx.GetTerm(); s.term != nil {
 		scx.SetTerm(nil)
-	} else if s.term, err = NewTerminal(scx); err != nil {
+	} else if term, err := NewTerminal(scx); err != nil {
 		s.logger.InfoContext(ctx, "Unable to allocate new terminal.", "error", err)
 		return trace.Wrap(err)
+	} else {
+		s.term = term
 	}
 
 	if err := s.term.Run(ctx); err != nil {
@@ -1512,16 +1541,28 @@ func (s *session) startTerminal(ctx context.Context, scx *ServerContext) error {
 
 // newRecorder creates a new [events.SessionPreparerRecorder] to be used as the recorder
 // of the passed in session.
-func newRecorder(s *session, ctx *ServerContext) (events.SessionPreparerRecorder, error) {
-	// Nodes discard events in cases when proxies are already recording them.
-	if s.registry.Srv.Component() == teleport.ComponentNode &&
-		services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
+func newRecorder(s *session, ctx *ServerContext, sessType sessionType) (events.SessionPreparerRecorder, error) {
+	// determine session recording mode. in theory we could choose to only do this in the unhappy
+	// path since thats the only place we use it, but we do it here to ensure that any test coverage
+	// we have for this code will always enforce its permit requirements.
+	var sessionRecordingMode constants.SessionRecordingMode
+	switch {
+	case ctx.Identity.AccessPermit != nil:
+		sessionRecordingMode = constants.SessionRecordingMode(ctx.Identity.AccessPermit.SessionRecordingMode)
+	case ctx.Identity.ProxyingPermit != nil:
+		sessionRecordingMode = ctx.Identity.ProxyingPermit.SessionRecordingMode
+	default:
+		return nil, trace.BadParameter("session recorder creation only supported in context of ssh access or proxying permit")
+	}
+
+	// Don't record on the Node when the proxy forwarding node is already recording.
+	if !s.shouldHandleRecording() {
 		s.logger.DebugContext(s.serverCtx, "Session will be recorded at proxy.")
 		return events.WithNoOpPreparer(events.NewDiscardRecorder()), nil
 	}
 
 	// Don't record non-interactive sessions when enhanced recording is disabled.
-	if ctx.GetTerm() == nil && !ctx.srv.GetBPF().Enabled() {
+	if sessType == sessionTypeNonInteractive && !ctx.srv.GetBPF().Enabled() {
 		return events.WithNoOpPreparer(events.NewDiscardRecorder()), nil
 	}
 
@@ -1540,7 +1581,7 @@ func newRecorder(s *session, ctx *ServerContext) (events.SessionPreparerRecorder
 		Context: ctx.srv.Context(),
 	})
 	if err != nil {
-		switch constants.SessionRecordingMode(ctx.Identity.AccessPermit.SessionRecordingMode) {
+		switch sessionRecordingMode {
 		case constants.SessionRecordingModeBestEffort:
 			s.logger.WarnContext(
 				s.serverCtx, "Failed to initialize session recording, disabling it for this session.",
@@ -1595,20 +1636,20 @@ func (s *session) startExec(ctx context.Context, channel ssh.Channel, scx *Serve
 	// Open a BPF recording session. If BPF was not configured, not available,
 	// or running in a recording proxy, OpenSession is a NOP.
 	sessionContext := &bpf.SessionContext{
-		Context:        scx.srv.Context(),
-		PID:            scx.execRequest.PID(),
-		Emitter:        s.emitter,
-		Namespace:      scx.srv.GetNamespace(),
-		SessionID:      string(s.id),
-		ServerID:       scx.srv.HostUUID(),
-		ServerHostname: scx.srv.GetInfo().GetHostname(),
-		Login:          scx.Identity.Login,
-		User:           scx.Identity.TeleportUser,
-		Events:         eventsMap,
-	}
-
-	if err := execRequest.WaitForChild(); err != nil {
-		s.logger.ErrorContext(ctx, "Child process never became ready.", "error", err)
+		Context:               scx.srv.Context(),
+		PID:                   scx.execRequest.PID(),
+		Emitter:               s.emitter,
+		Namespace:             scx.srv.GetNamespace(),
+		SessionID:             string(s.id),
+		ServerID:              scx.srv.ID(),
+		ServerHostname:        scx.srv.GetInfo().GetHostname(),
+		Login:                 scx.Identity.Login,
+		User:                  scx.Identity.TeleportUser,
+		UserOriginClusterName: scx.Identity.OriginClusterName,
+		Events:                eventsMap,
+	}
+
+	if err := execRequest.WaitForChild(ctx); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -1789,7 +1830,7 @@ func (s *session) checkPresence(ctx context.Context) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	for _, participant := range tracker.GetParticipants() {
-		if participant.User == s.initiator {
+		if participant.User == s.initiator.user && participant.Cluster == s.initiator.cluster {
 			continue
 		}
 
@@ -1829,16 +1870,21 @@ type FileTransferRequest struct {
 }
 
 func (s *session) checkIfFileTransferApproved(req *FileTransferRequest) (bool, error) {
-	var participants []auth.SessionAccessContext
+	var participants []moderation.SessionAccessContext
 
 	for _, party := range req.approvers {
-		if party.ctx.Identity.TeleportUser == s.initiator {
+		if party.ctx.Identity.TeleportUser == s.initiator.user && party.ctx.Identity.OriginClusterName == s.initiator.cluster {
 			continue
 		}
 
-		participants = append(participants, auth.SessionAccessContext{
+		var roles []types.Role
+		if party.ctx.Identity.UnstableSessionJoiningAccessChecker != nil {
+			roles = party.ctx.Identity.UnstableSessionJoiningAccessChecker.Roles()
+		}
+
+		participants = append(participants, moderation.SessionAccessContext{
 			Username: party.ctx.Identity.TeleportUser,
-			Roles:    party.ctx.Identity.UnstableSessionJoiningAccessChecker.Roles(),
+			Roles:    roles,
 			Mode:     party.mode,
 		})
 	}
@@ -1851,59 +1897,6 @@ func (s *session) checkIfFileTransferApproved(req *FileTransferRequest) (bool, e
 	return isApproved, nil
 }
 
-// newFileTransferRequest takes FileTransferParams and creates a new fileTransferRequest struct
-func (s *session) newFileTransferRequest(params *rsession.FileTransferRequestParams) (*FileTransferRequest, error) {
-	location, err := s.expandFileTransferRequestPath(params.Location)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	req := FileTransferRequest{
-		ID:        uuid.New().String(),
-		Requester: params.Requester,
-		Location:  location,
-		Filename:  params.Filename,
-		Download:  params.Download,
-		approvers: make(map[string]*party),
-	}
-
-	return &req, nil
-}
-
-func (s *session) expandFileTransferRequestPath(p string) (string, error) {
-	expanded := filepath.Clean(p)
-	dir := filepath.Dir(expanded)
-
-	tildePrefixed := dir == "~"
-	noBaseDir := dir == "."
-	if tildePrefixed || noBaseDir {
-		localUser, err := user.Lookup(s.login)
-		if err != nil {
-			return "", trace.Wrap(err)
-		}
-
-		exists, err := CheckHomeDir(localUser)
-		if err != nil {
-			return "", trace.Wrap(err)
-		}
-		homeDir := localUser.HomeDir
-		if !exists {
-			homeDir = string(os.PathSeparator)
-		}
-
-		if tildePrefixed {
-			// expand home dir to make an absolute path
-			expanded = filepath.Join(homeDir, expanded[2:])
-		} else {
-			// if no directories are specified SFTP will assume the file
-			// to be in the user's home dir
-			expanded = filepath.Join(homeDir, expanded)
-		}
-	}
-
-	return expanded, nil
-}
-
 // addFileTransferRequest will create a new file transfer request and add it to the current session's fileTransferRequests map
 // and broadcast the appropriate string to the session.
 func (s *session) addFileTransferRequest(params *rsession.FileTransferRequestParams, scx *ServerContext) error {
@@ -1917,18 +1910,21 @@ func (s *session) addFileTransferRequest(params *rsession.FileTransferRequestPar
 		return trace.BadParameter("no source file is set for the upload")
 	}
 
-	req, err := s.newFileTransferRequest(params)
-	if err != nil {
-		return trace.Wrap(err)
+	s.fileTransferReq = &FileTransferRequest{
+		ID:        uuid.New().String(),
+		Requester: params.Requester,
+		Location:  params.Location,
+		Filename:  params.Filename,
+		Download:  params.Download,
+		approvers: make(map[string]*party),
 	}
-	s.fileTransferReq = req
 
 	if params.Download {
 		s.BroadcastMessage("User %s would like to download: %s", params.Requester, params.Location)
 	} else {
 		s.BroadcastMessage("User %s would like to upload %s to: %s", params.Requester, params.Filename, params.Location)
 	}
-	err = s.registry.notifyFileTransferRequestUnderLock(s.fileTransferReq, FileTransferUpdate, scx)
+	err := s.registry.notifyFileTransferRequestUnderLock(s.fileTransferReq, FileTransferUpdate, scx)
 
 	return trace.Wrap(err)
 }
@@ -2012,24 +2008,30 @@ func (s *session) denyFileTransferRequest(params *rsession.FileTransferDecisionP
 // checkIfStartUnderLock determines if any moderation policies associated with
 // the session are satisfied.
 // Must be called under session Lock.
-func (s *session) checkIfStartUnderLock() (bool, auth.PolicyOptions, error) {
-	var participants []auth.SessionAccessContext
+func (s *session) checkIfStartUnderLock() (bool, moderation.PolicyOptions, error) {
+	var participants []moderation.SessionAccessContext
 
 	for _, party := range s.parties {
-		if party.ctx.Identity.TeleportUser == s.initiator {
+		if party.ctx.Identity.TeleportUser == s.initiator.user &&
+			party.ctx.Identity.OriginClusterName == s.initiator.cluster {
 			continue
 		}
 
-		participants = append(participants, auth.SessionAccessContext{
+		var roles []types.Role
+		if party.ctx.Identity.UnstableSessionJoiningAccessChecker != nil {
+			roles = party.ctx.Identity.UnstableSessionJoiningAccessChecker.Roles()
+		}
+
+		participants = append(participants, moderation.SessionAccessContext{
 			Username: party.ctx.Identity.TeleportUser,
-			Roles:    party.ctx.Identity.UnstableSessionJoiningAccessChecker.Roles(),
+			Roles:    roles,
 			Mode:     party.mode,
 		})
 	}
 
 	shouldStart, policyOptions, err := s.access.FulfilledFor(participants)
 	if err != nil {
-		return false, auth.PolicyOptions{}, trace.Wrap(err)
+		return false, moderation.PolicyOptions{}, trace.Wrap(err)
 	}
 
 	return shouldStart, policyOptions, nil
@@ -2154,10 +2156,15 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 }
 
 func (s *session) join(ch ssh.Channel, scx *ServerContext, mode types.SessionParticipantMode) error {
-	if scx.Identity.TeleportUser != s.initiator {
-		accessContext := auth.SessionAccessContext{
+	if scx.Identity.TeleportUser != s.initiator.user || scx.Identity.OriginClusterName != s.initiator.cluster {
+		var roles []types.Role
+		if scx.Identity.UnstableSessionJoiningAccessChecker != nil {
+			roles = scx.Identity.UnstableSessionJoiningAccessChecker.Roles()
+		}
+
+		accessContext := moderation.SessionAccessContext{
 			Username: scx.Identity.TeleportUser,
-			Roles:    scx.Identity.UnstableSessionJoiningAccessChecker.Roles(),
+			Roles:    roles,
 		}
 
 		modes := s.access.CanJoin(accessContext)
@@ -2183,6 +2190,7 @@ func (s *session) join(ch ssh.Channel, scx *ServerContext, mode types.SessionPar
 	participant := &types.Participant{
 		ID:         p.id.String(),
 		User:       p.user,
+		Cluster:    p.originCluster,
 		Mode:       string(p.mode),
 		LastActive: time.Now().UTC(),
 	}
@@ -2209,19 +2217,20 @@ func (s *session) getParties() (parties []*party) {
 type party struct {
 	sync.Mutex
 
-	log        *slog.Logger
-	login      string
-	user       string
-	serverID   string
-	site       string
-	id         rsession.ID
-	s          *session
-	sconn      *ssh.ServerConn
-	ch         ssh.Channel
-	ctx        *ServerContext
-	lastActive time.Time
-	mode       types.SessionParticipantMode
-	closeOnce  sync.Once
+	log           *slog.Logger
+	login         string
+	user          string
+	originCluster string
+	serverID      string
+	site          string
+	id            rsession.ID
+	s             *session
+	sconn         *ssh.ServerConn
+	ch            ssh.Channel
+	ctx           *ServerContext
+	lastActive    time.Time
+	mode          types.SessionParticipantMode
+	closeOnce     sync.Once
 }
 
 func newParty(s *session, mode types.SessionParticipantMode, ch ssh.Channel, ctx *ServerContext) *party {
@@ -2231,16 +2240,17 @@ func newParty(s *session, mode types.SessionParticipantMode, ch ssh.Channel, ctx
 			teleport.ComponentKey, teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
 			"party_id", pid,
 		),
-		user:     ctx.Identity.TeleportUser,
-		login:    ctx.Identity.Login,
-		serverID: s.registry.Srv.ID(),
-		site:     ctx.ServerConn.RemoteAddr().String(),
-		id:       rsession.NewID(),
-		ch:       ch,
-		ctx:      ctx,
-		s:        s,
-		sconn:    ctx.ServerConn,
-		mode:     mode,
+		user:          ctx.Identity.TeleportUser,
+		originCluster: ctx.Identity.OriginClusterName,
+		login:         ctx.Identity.Login,
+		serverID:      s.registry.Srv.ID(),
+		site:          ctx.ServerConn.RemoteAddr().String(),
+		id:            rsession.NewID(),
+		ch:            ch,
+		ctx:           ctx,
+		s:             s,
+		sconn:         ctx.ServerConn,
+		mode:          mode,
 	}
 }
 
@@ -2304,40 +2314,34 @@ func (s *session) trackSession(ctx context.Context, teleportUser string, policyS
 		Kind:         string(types.SSHSessionKind),
 		State:        types.SessionState_SessionStatePending,
 		Hostname:     s.serverMeta.ServerHostname,
-		Address:      s.serverMeta.ServerID,
+		Address:      s.scx.srv.ID(),
 		ClusterName:  s.scx.ClusterName,
 		Login:        s.login,
 		HostUser:     teleportUser,
-		Reason:       s.scx.env[teleport.EnvSSHSessionReason],
 		HostPolicies: policySet,
 		Created:      s.registry.clock.Now().UTC(),
 		Participants: []types.Participant{
 			{
 				ID:         p.id.String(),
 				User:       p.user,
+				Cluster:    p.originCluster,
 				Mode:       string(p.mode),
 				LastActive: s.registry.clock.Now().UTC(),
 			},
 		},
-		HostID:         s.registry.Srv.ID(),
+		HostID:         s.registry.Srv.HostUUID(),
 		TargetSubKind:  s.serverMeta.ServerSubKind,
 		InitialCommand: initialCommand,
+		Reason:         s.scx.GetSessionParams().Reason,
+		Invited:        s.scx.GetSessionParams().Invited,
 	}
 
-	if invitedUsers := s.scx.env[teleport.EnvSSHSessionInvited]; invitedUsers != "" {
-		if err := json.Unmarshal([]byte(invitedUsers), &trackerSpec.Invited); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
+	// Don't propagate the session tracker to the backend if:
+	// - this is a Teleport Node and proxy recording mode is turned on (tracking is handled by the proxy forwarding node)
+	// - this is a non-interactive session
+	// - the session was initiated by a bot
 	svc := s.registry.SessionTrackerService
-	// Only propagate the session tracker when the recording mode and component are in sync
-	// AND the sesssion is interactive
-	// AND the session was not initiated by a bot
-	if (s.registry.Srv.Component() == teleport.ComponentNode && services.IsRecordAtProxy(s.scx.SessionRecordingConfig.GetMode())) ||
-		(s.registry.Srv.Component() == teleport.ComponentProxy && !services.IsRecordAtProxy(s.scx.SessionRecordingConfig.GetMode())) ||
-		sessType == sessionTypeNonInteractive ||
-		s.scx.Identity.BotName != "" {
+	if !s.shouldHandleRecording() || sessType == sessionTypeNonInteractive || s.scx.Identity.BotName != "" {
 		svc = nil
 	}
 
@@ -2403,22 +2407,24 @@ func (s *session) recordEvent(ctx context.Context, event apievents.PreparedSessi
 	}
 }
 
-// onWriteError defines the `OnWriteError` `TermManager` callback.
-func (s *session) onWriteError(idString string, err error) {
-	if idString == sessionRecorderID {
-		switch constants.SessionRecordingMode(s.scx.Identity.AccessPermit.SessionRecordingMode) {
-		case constants.SessionRecordingModeBestEffort:
-			s.logger.WarnContext(s.serverCtx, "Failed to write to session recorder, disabling session recording.")
-			// Send inside a goroutine since the callback is called from inside
-			// the writer.
-			go s.BroadcastSystemMessage(sessionRecordingWarningMessage)
-		default:
-			s.logger.ErrorContext(s.serverCtx, "Failed to write to session recorder, stopping session.")
-			// stop in goroutine to avoid deadlock
-			go func() {
-				s.BroadcastSystemMessage(sessionRecordingErrorMessage)
-				s.Stop()
-			}()
+// onWriteErrorCallback builds the `OnWriteError` `TermManager` callback.
+func (s *session) onWriteErrorCallback(sessionRecordingMode constants.SessionRecordingMode) func(idString string, err error) {
+	return func(idString string, err error) {
+		if idString == sessionRecorderID {
+			switch sessionRecordingMode {
+			case constants.SessionRecordingModeBestEffort:
+				s.logger.WarnContext(s.serverCtx, "Failed to write to session recorder, disabling session recording.")
+				// Send inside a goroutine since the callback is called from inside
+				// the writer.
+				go s.BroadcastSystemMessage(sessionRecordingWarningMessage)
+			default:
+				s.logger.ErrorContext(s.serverCtx, "Failed to write to session recorder, stopping session.")
+				// stop in goroutine to avoid deadlock
+				go func() {
+					s.BroadcastSystemMessage(sessionRecordingErrorMessage)
+					s.Stop()
+				}()
+			}
 		}
 	}
 }
diff --git a/lib/srv/sess_test.go b/lib/srv/sess_test.go
index 9fd84ac6602be..505f9f6a43a99 100644
--- a/lib/srv/sess_test.go
+++ b/lib/srv/sess_test.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto/ed25519"
 	"io"
+	"maps"
 	"net"
 	"os/user"
 	"slices"
@@ -46,15 +47,16 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	rsession "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/sshutils/sftp"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestIsApprovedFileTransfer(t *testing.T) {
 	// set enterprise for tests
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	srv := newMockServer(t)
 	srv.component = teleport.ComponentNode
 
@@ -163,7 +165,7 @@ func TestIsApprovedFileTransfer(t *testing.T) {
 
 			// new exec request context
 			scx := newTestServerContext(t, reg.Srv, accessRoleSet, &decisionpb.SSHAccessPermit{})
-			scx.SetEnv(string(sftp.ModeratedSessionID), sess.ID())
+			scx.SetEnv(sftp.EnvModeratedSessionID, sess.ID())
 			result, err := reg.isApprovedFileTransfer(scx)
 			if err != nil {
 				require.Equal(t, tt.expectedError, err.Error())
@@ -192,7 +194,7 @@ func TestSession_newRecorder(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	isNotSessionWriter := func(t require.TestingT, i interface{}, i2 ...interface{}) {
 		require.NotNil(t, i)
@@ -201,74 +203,63 @@ func TestSession_newRecorder(t *testing.T) {
 	}
 
 	cases := []struct {
-		desc         string
-		sess         *session
-		sctx         *ServerContext
-		errAssertion require.ErrorAssertionFunc
-		recAssertion require.ValueAssertionFunc
+		desc           string
+		sctx           *ServerContext
+		noninteractive bool
+		errAssertion   require.ErrorAssertionFunc
+		recAssertion   require.ValueAssertionFunc
 	}{
 		{
 			desc: "discard-stream-when-proxy-recording",
-			sess: &session{
-				id:     "test",
-				logger: logger,
-				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
-					SessionRegistryConfig: SessionRegistryConfig{
-						Srv: &mockServer{
-							component: teleport.ComponentNode,
-						},
-					},
-				},
-			},
+
 			sctx: &ServerContext{
 				SessionRecordingConfig: proxyRecording,
-				term:                   &terminal{},
+				srv: &mockServer{
+					component: teleport.ComponentNode,
+				},
+				Identity: IdentityContext{
+					AccessPermit: &decisionpb.SSHAccessPermit{},
+				},
 			},
 			errAssertion: require.NoError,
 			recAssertion: isNotSessionWriter,
 		},
 		{
-			desc: "discard-stream--when-proxy-sync-recording",
-			sess: &session{
-				id:     "test",
-				logger: logger,
-				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
-					SessionRegistryConfig: SessionRegistryConfig{
-						Srv: &mockServer{
-							component: teleport.ComponentNode,
-						},
-					},
+			desc: "discard-stream-when-proxy-sync-recording",
+			sctx: &ServerContext{
+				SessionRecordingConfig: proxyRecordingSync,
+				srv: &mockServer{
+					component: teleport.ComponentNode,
+				},
+				Identity: IdentityContext{
+					AccessPermit: &decisionpb.SSHAccessPermit{},
 				},
 			},
+			errAssertion: require.NoError,
+			recAssertion: isNotSessionWriter,
+		},
+		{
+			desc:           "discard-stream-when-non-interactive-non-bpf",
+			noninteractive: true,
 			sctx: &ServerContext{
 				SessionRecordingConfig: proxyRecordingSync,
-				term:                   &terminal{},
+				srv: &mockServer{
+					component: teleport.ComponentNode,
+				},
+				Identity: IdentityContext{
+					AccessPermit: &decisionpb.SSHAccessPermit{},
+				},
 			},
 			errAssertion: require.NoError,
 			recAssertion: isNotSessionWriter,
 		},
 		{
 			desc: "strict-err-new-audit-writer-fails",
-			sess: &session{
-				id:     "test",
-				logger: logger,
-				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
-					SessionRegistryConfig: SessionRegistryConfig{
-						Srv: &mockServer{
-							component: teleport.ComponentNode,
-						},
-					},
-				},
-			},
 			sctx: &ServerContext{
 				SessionRecordingConfig: nodeRecordingSync,
 				srv: &mockServer{
 					component: teleport.ComponentNode,
 				},
-				term: &terminal{},
 				Identity: IdentityContext{
 					AccessPermit: &decisionpb.SSHAccessPermit{
 						SessionRecordingMode: string(constants.SessionRecordingModeStrict),
@@ -280,18 +271,6 @@ func TestSession_newRecorder(t *testing.T) {
 		},
 		{
 			desc: "best-effort-err-new-audit-writer-succeeds",
-			sess: &session{
-				id:     "test",
-				logger: logger,
-				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
-					SessionRegistryConfig: SessionRegistryConfig{
-						Srv: &mockServer{
-							component: teleport.ComponentNode,
-						},
-					},
-				},
-			},
 			sctx: &ServerContext{
 				ClusterName:            "test",
 				SessionRecordingConfig: nodeRecordingSync,
@@ -304,7 +283,6 @@ func TestSession_newRecorder(t *testing.T) {
 						SessionRecordingMode: string(constants.SessionRecordingModeBestEffort),
 					},
 				},
-				term: &terminal{},
 			},
 			errAssertion: require.NoError,
 			recAssertion: func(t require.TestingT, i interface{}, _ ...interface{}) {
@@ -316,26 +294,17 @@ func TestSession_newRecorder(t *testing.T) {
 		},
 		{
 			desc: "audit-writer",
-			sess: &session{
-				id:     "test",
-				logger: logger,
-				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
-					SessionRegistryConfig: SessionRegistryConfig{
-						Srv: &mockServer{
-							component: teleport.ComponentNode,
-						},
-					},
-				},
-			},
 			sctx: &ServerContext{
 				ClusterName:            "test",
 				SessionRecordingConfig: nodeRecordingSync,
 				srv: &mockServer{
 					MockRecorderEmitter: &eventstest.MockRecorderEmitter{},
 					datadir:             t.TempDir(),
+					component:           teleport.ComponentNode,
+				},
+				Identity: IdentityContext{
+					AccessPermit: &decisionpb.SSHAccessPermit{},
 				},
-				term: &terminal{},
 			},
 			errAssertion: require.NoError,
 			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
@@ -349,7 +318,24 @@ func TestSession_newRecorder(t *testing.T) {
 
 	for _, tt := range cases {
 		t.Run(tt.desc, func(t *testing.T) {
-			rec, err := newRecorder(tt.sess, tt.sctx)
+			sess := &session{
+				id:     "test",
+				logger: logger,
+				registry: &SessionRegistry{
+					logger: logtest.NewLogger(),
+					SessionRegistryConfig: SessionRegistryConfig{
+						Srv: tt.sctx.srv,
+					},
+				},
+				scx: tt.sctx,
+			}
+
+			sessType := sessionTypeInteractive
+			if tt.noninteractive {
+				sessType = sessionTypeNonInteractive
+			}
+
+			rec, err := newRecorder(sess, tt.sctx, sessType)
 			tt.errAssertion(t, err)
 			tt.recAssertion(t, rec)
 		})
@@ -359,7 +345,7 @@ func TestSession_newRecorder(t *testing.T) {
 func TestSession_emitAuditEvent(t *testing.T) {
 	t.Parallel()
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	t.Run("FallbackConcurrency", func(t *testing.T) {
 		srv := newMockServer(t)
@@ -643,7 +629,7 @@ func TestNonInteractiveSession(t *testing.T) {
 
 // TestStopUnstarted tests that a session may be stopped before it launches.
 func TestStopUnstarted(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	srv := newMockServer(t)
 	srv.component = teleport.ComponentNode
 
@@ -702,9 +688,9 @@ func TestParties(t *testing.T) {
 	// Create a session with 3 parties
 	sess, _ := testOpenSession(t, reg, nil, &decisionpb.SSHAccessPermit{})
 	require.Len(t, sess.getParties(), 1)
-	testJoinSession(t, reg, sess)
+	testJoinSession(t, reg, sess.ID())
 	require.Len(t, sess.getParties(), 2)
-	testJoinSession(t, reg, sess)
+	testJoinSession(t, reg, sess.ID())
 	require.Len(t, sess.getParties(), 3)
 
 	// If a party leaves, the session should remove the party and continue.
@@ -746,7 +732,7 @@ func TestParties(t *testing.T) {
 	regClock.BlockUntil(2)
 
 	// If a party connects to the lingering session, it will continue.
-	testJoinSession(t, reg, sess)
+	testJoinSession(t, reg, sess.ID())
 	require.Len(t, sess.getParties(), 1)
 
 	// advance clock and give lingerAndDie goroutine a second to complete.
@@ -766,10 +752,9 @@ func TestParties(t *testing.T) {
 	require.Eventually(t, sess.isStopped, time.Second*5, time.Millisecond*500)
 }
 
-func testJoinSession(t *testing.T, reg *SessionRegistry, sess *session) {
+func testJoinSession(t *testing.T, reg *SessionRegistry, sid string) {
 	scx := newTestServerContext(t, reg.Srv, nil, &decisionpb.SSHAccessPermit{})
 	sshChanOpen := newMockSSHChannel()
-	scx.setSession(t.Context(), sess, sshChanOpen)
 
 	// Open a new session
 	go func() {
@@ -777,7 +762,7 @@ func testJoinSession(t *testing.T, reg *SessionRegistry, sess *session) {
 		io.ReadAll(sshChanOpen)
 	}()
 
-	err := reg.OpenSession(t.Context(), sshChanOpen, scx)
+	err := reg.JoinSession(t.Context(), sshChanOpen, scx, sid, types.SessionPeerMode)
 	require.NoError(t, err)
 }
 
@@ -836,26 +821,18 @@ func TestSessionRecordingModes(t *testing.T) {
 			require.Eventually(t, sess.isStopped, time.Second*5, time.Millisecond*500)
 
 			// Wait until server receives all non-print events.
-			checkEventsReceived := func() bool {
-				expectedEventTypes := []string{
-					events.SessionStartEvent,
-					events.SessionLeaveEvent,
-					events.SessionEndEvent,
-				}
-
-				emittedEvents := srv.Events()
-				if len(emittedEvents) != len(expectedEventTypes) {
-					return false
-				}
-
+			require.EventuallyWithT(t, func(t *assert.CollectT) {
 				// Events can appear in different orders. Use a set to track.
-				eventsNotReceived := utils.StringsSet(expectedEventTypes)
-				for _, e := range emittedEvents {
+				eventsNotReceived := map[string]struct{}{
+					events.SessionStartEvent: {},
+					events.SessionLeaveEvent: {},
+					events.SessionEndEvent:   {},
+				}
+				for _, e := range srv.Events() {
 					delete(eventsNotReceived, e.GetType())
 				}
-				return len(eventsNotReceived) == 0
-			}
-			require.Eventually(t, checkEventsReceived, time.Second*5, time.Millisecond*500, "Some events are not received.")
+				assert.Empty(t, slices.Collect(maps.Keys(eventsNotReceived)))
+			}, time.Second*5, time.Millisecond*500, "Some events not received")
 		})
 	}
 }
@@ -965,8 +942,8 @@ func TestTrackingSession(t *testing.T) {
 			},
 		},
 		{
-			name:          "proxy with proxy recording mode",
-			component:     teleport.ComponentProxy,
+			name:          "forwarding node with proxy recording mode",
+			component:     teleport.ComponentForwardingNode,
 			recordingMode: types.RecordAtProxy,
 			interactive:   true,
 			assertion:     require.NoError,
@@ -975,13 +952,13 @@ func TestTrackingSession(t *testing.T) {
 			},
 		},
 		{
-			name:          "proxy with node recording mode",
-			component:     teleport.ComponentProxy,
+			name:          "forwarding node with node recording mode (agentless)",
+			component:     teleport.ComponentForwardingNode,
 			recordingMode: types.RecordAtNode,
 			interactive:   true,
 			assertion:     require.NoError,
 			createAssertion: func(t *testing.T, count int) {
-				require.Equal(t, 0, count)
+				require.Equal(t, 1, count)
 			},
 		},
 		{
@@ -1056,9 +1033,9 @@ func TestTrackingSession(t *testing.T) {
 
 			sess := &session{
 				id:     rsession.NewID(),
-				logger: utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "test-session"),
+				logger: logtest.With(teleport.ComponentKey, "test-session"),
 				registry: &SessionRegistry{
-					logger: utils.NewSlogLoggerForTests(),
+					logger: logtest.NewLogger(),
 					SessionRegistryConfig: SessionRegistryConfig{
 						Srv:                   srv,
 						SessionTrackerService: trackingService,
@@ -1178,7 +1155,7 @@ func TestSessionRecordingMode(t *testing.T) {
 				},
 			}
 
-			gotMode := sess.sessionRecordingMode()
+			gotMode := sess.sessionRecordingLocation()
 			require.Equal(t, tt.expectedMode, gotMode)
 		})
 	}
@@ -1189,7 +1166,7 @@ func TestCloseProxySession(t *testing.T) {
 	defer cancel()
 
 	srv := newMockServer(t)
-	srv.component = teleport.ComponentProxy
+	srv.component = teleport.ComponentForwardingNode
 
 	reg, err := NewSessionRegistry(SessionRegistryConfig{
 		Srv:                   srv,
@@ -1237,7 +1214,7 @@ func TestCloseRemoteSession(t *testing.T) {
 	defer cancel()
 
 	srv := newMockServer(t)
-	srv.component = teleport.ComponentProxy
+	srv.component = teleport.ComponentForwardingNode
 
 	// init a session registry
 	reg, _ := NewSessionRegistry(SessionRegistryConfig{
@@ -1568,7 +1545,7 @@ func TestUpsertHostUser(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			registry := SessionRegistry{
-				logger: utils.NewSlogLoggerForTests(),
+				logger: logtest.NewLogger(),
 				SessionRegistryConfig: SessionRegistryConfig{
 					Srv: &fakeServer{createHostUser: c.createHostUser},
 				},
@@ -1658,7 +1635,7 @@ func TestWriteSudoersFile(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			registry := SessionRegistry{
-				logger: utils.NewSlogLoggerForTests(),
+				logger: logtest.NewLogger(),
 				SessionRegistryConfig: SessionRegistryConfig{
 					Srv: &fakeServer{hostSudoers: c.hostSudoers},
 				},
diff --git a/lib/srv/session_control.go b/lib/srv/session_control.go
index 88459466f7412..afc2099764d50 100644
--- a/lib/srv/session_control.go
+++ b/lib/srv/session_control.go
@@ -221,6 +221,10 @@ func WebSessionController(controller *SessionController) func(ctx context.Contex
 			UnmappedRoles:                       unmappedIdentity.Roles,
 			ActiveRequests:                      unmappedIdentity.ActiveRequests,
 			Impersonator:                        unmappedIdentity.Impersonator,
+			// Web sessions are always local to the cluster they authenticated to.
+			OriginClusterName: clusterName.GetClusterName(),
+			MappedRoles:       accessChecker.RoleNames(),
+			Traits:            accessChecker.Traits(),
 		}
 		ctx, err = controller.AcquireSessionContext(ctx, identity, localAddr, remoteAddr)
 		return ctx, trace.Wrap(err)
diff --git a/lib/srv/session_control_test.go b/lib/srv/session_control_test.go
index bca60bbf254b0..4c3c981bdcda3 100644
--- a/lib/srv/session_control_test.go
+++ b/lib/srv/session_control_test.go
@@ -23,6 +23,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
@@ -37,6 +38,7 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/sshca"
 )
 
@@ -87,22 +89,24 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	emitter := &eventstest.MockRecorderEmitter{}
 
-	minimalCfg := SessionControllerConfig{
-		Semaphores: mockSemaphores{},
-		AccessPoint: mockAccessPoint{
-			authPreference: &types.AuthPreferenceV2{
-				Spec: types.AuthPreferenceSpecV2{},
-			},
-			clusterName: &types.ClusterNameV2{
-				Spec: types.ClusterNameSpecV2{
-					ClusterName: "llama",
+	minimalCfg := func() SessionControllerConfig {
+		return SessionControllerConfig{
+			Semaphores: mockSemaphores{},
+			AccessPoint: mockAccessPoint{
+				authPreference: &types.AuthPreferenceV2{
+					Spec: types.AuthPreferenceSpecV2{},
+				},
+				clusterName: &types.ClusterNameV2{
+					Spec: types.ClusterNameSpecV2{
+						ClusterName: "llama",
+					},
 				},
 			},
-		},
-		LockEnforcer: mockLockEnforcer{},
-		Emitter:      emitter,
-		Component:    teleport.ComponentNode,
-		ServerID:     "1234",
+			LockEnforcer: mockLockEnforcer{},
+			Emitter:      emitter,
+			Component:    teleport.ComponentNode,
+			ServerID:     "1234",
+		}
 	}
 
 	minimalIdentity := IdentityContext{
@@ -117,7 +121,7 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 	}
 
 	cfgWithDeviceMode := func(mode string) SessionControllerConfig {
-		cfg := minimalCfg
+		cfg := minimalCfg()
 		authPref, _ := cfg.AccessPoint.GetAuthPreference(context.Background())
 		authPref.(*types.AuthPreferenceV2).Spec.DeviceTrust = &types.DeviceTrust{
 			Mode: mode,
@@ -133,6 +137,14 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 		idCtx.UnmappedIdentity.DeviceCredentialID = "credentialid1"
 		return idCtx
 	}
+	botIdentity := func() IdentityContext {
+		ident := *minimalIdentity.UnmappedIdentity
+		idCtx := minimalIdentity
+		idCtx.UnmappedIdentity = &ident
+		idCtx.UnmappedIdentity.BotName = "wall-e"
+		idCtx.UnmappedIdentity.BotInstanceID = uuid.NewString()
+		return idCtx
+	}
 	assertTrustedDeviceRequired := func(t *testing.T, _ context.Context, err error, _ *eventstest.MockRecorderEmitter) {
 		assert.ErrorContains(t, err, "device", "AcquireSessionContext returned an unexpected error")
 		assert.True(t, trace.IsAccessDenied(err), "AcquireSessionContext returned an error other than trace.AccessDeniedError: %T", err)
@@ -428,6 +440,22 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				assert.NoError(t, err, "AcquireSessionContext returned an unexpected error")
 			},
 		},
+		{
+			name:      "device extensions enforced for bot",
+			buildType: modules.BuildEnterprise,
+			cfg:       cfgWithDeviceMode(constants.DeviceTrustModeRequired),
+			identity:  botIdentity(),
+			assertion: assertTrustedDeviceRequired,
+		},
+		{
+			name:      "device extensions not enforced for bot with mode=required-for-humans",
+			buildType: modules.BuildEnterprise,
+			cfg:       cfgWithDeviceMode(constants.DeviceTrustModeRequiredForHumans),
+			identity:  botIdentity(),
+			assertion: func(t *testing.T, _ context.Context, err error, _ *eventstest.MockRecorderEmitter) {
+				assert.NoError(t, err, "AcquireSessionContext returned an unexpected error")
+			},
+		},
 	}
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
@@ -438,7 +466,7 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 			if buildType == "" {
 				buildType = modules.BuildOSS
 			}
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: buildType,
 			})
 
diff --git a/lib/srv/sessiontracker_test.go b/lib/srv/sessiontracker_test.go
index 792ee9bcbe12e..3f32ba3dde674 100644
--- a/lib/srv/sessiontracker_test.go
+++ b/lib/srv/sessiontracker_test.go
@@ -265,7 +265,7 @@ func (m *mockSessiontrackerService) RemoveSessionTracker(ctx context.Context, se
 	return trace.NotImplemented("")
 }
 
-func (m *mockSessiontrackerService) UpdatePresence(ctx context.Context, sessionID, user string) error {
+func (m *mockSessiontrackerService) UpdatePresence(_ context.Context, _, _, _ string) error {
 	return trace.NotImplemented("")
 }
 
diff --git a/lib/srv/statichostuser_test.go b/lib/srv/statichostuser_test.go
index 011e510d2ec20..e4ef1bd92a3aa 100644
--- a/lib/srv/statichostuser_test.go
+++ b/lib/srv/statichostuser_test.go
@@ -31,7 +31,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/userprovisioning"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 type mockEvents struct {
@@ -325,7 +325,7 @@ func TestStaticHostUserHandler(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 			t.Cleanup(cancel)
 
-			utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+			testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 				Name: "event sender",
 				Task: func(ctx context.Context) error {
 					sendEvents(ctx, events, tc.events)
diff --git a/lib/srv/term.go b/lib/srv/term.go
index 37eaabf8bb692..1231c8ad8dbdf 100644
--- a/lib/srv/term.go
+++ b/lib/srv/term.go
@@ -38,8 +38,6 @@ import (
 
 	"github.com/gravitational/teleport"
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
 	rsession "github.com/gravitational/teleport/lib/session"
 )
 
@@ -65,7 +63,7 @@ type Terminal interface {
 
 	// WaitForChild blocks until the child process has completed any required
 	// setup operations before proceeding with execution.
-	WaitForChild() error
+	WaitForChild(ctx context.Context) error
 
 	// Continue will resume execution of the process after it completes its
 	// pre-processing routine (placed in a cgroup).
@@ -120,7 +118,7 @@ func NewTerminal(ctx *ServerContext) (Terminal, error) {
 
 	// If this is not a Teleport node, find out what mode the cluster is in and
 	// return the correct terminal.
-	if types.IsOpenSSHNodeSubKind(ctx.ServerSubKind) || services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
+	if ctx.srv.Component() == teleport.ComponentForwardingNode {
 		return newRemoteTerminal(ctx)
 	}
 	return newLocalTerminal(ctx)
@@ -259,12 +257,8 @@ func (t *terminal) Wait() (*ExecResult, error) {
 	}, nil
 }
 
-func (t *terminal) WaitForChild() error {
-	err := waitForSignal(t.serverContext.readyr, 20*time.Second)
-	closeErr := t.serverContext.readyr.Close()
-	// Set to nil so the close in the context doesn't attempt to re-close.
-	t.serverContext.readyr = nil
-	return trace.NewAggregate(err, closeErr)
+func (t *terminal) WaitForChild(ctx context.Context) error {
+	return t.serverContext.WaitForChild(ctx)
 }
 
 // Continue will resume execution of the process after it completes its
@@ -369,12 +363,12 @@ func (t *terminal) closeTTY() error {
 func (t *terminal) closePTY() {
 	defer t.log.DebugContext(t.serverContext.CancelContext(), "Closed PTY")
 
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
 	// wait until all copying is over (all participants have left)
 	t.wg.Wait()
 
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
 	if t.pty == nil {
 		return
 	}
@@ -619,7 +613,7 @@ func (t *remoteTerminal) Wait() (*ExecResult, error) {
 	}, nil
 }
 
-func (t *remoteTerminal) WaitForChild() error {
+func (t *remoteTerminal) WaitForChild(context.Context) error {
 	return nil
 }
 
@@ -718,13 +712,17 @@ func (t *remoteTerminal) windowChange(ctx context.Context, w int, h int) error {
 	return trace.Wrap(t.session.WindowChange(ctx, h, w))
 }
 
-// prepareRemoteSession prepares the more session for execution.
+// prepareRemoteSession prepares the remote session with env vars provided by the forwarding server or client.
 func (t *remoteTerminal) prepareRemoteSession(ctx context.Context, session *tracessh.Session, scx *ServerContext) {
 	envs := map[string]string{
 		teleport.SSHTeleportUser:        scx.Identity.TeleportUser,
 		teleport.SSHTeleportHostUUID:    scx.srv.ID(),
 		teleport.SSHTeleportClusterName: scx.ClusterName,
-		teleport.SSHSessionID:           string(scx.SessionID()),
+		teleport.SSHSessionID:           scx.SessionID(),
+	}
+
+	if scx.GetSessionParams().WebProxyAddr != "" {
+		envs[teleport.SSHSessionWebProxyAddr] = scx.GetSessionParams().WebProxyAddr
 	}
 
 	if err := session.SetEnvs(ctx, envs); err != nil {
diff --git a/lib/srv/term_test.go b/lib/srv/term_test.go
index 78ec3b4128f38..cdc24b55a56c7 100644
--- a/lib/srv/term_test.go
+++ b/lib/srv/term_test.go
@@ -121,7 +121,7 @@ func TestTerminal_KillUnderlyingShell(t *testing.T) {
 	}()
 
 	// Wait for the child process to indicate its completed initialization.
-	require.NoError(t, scx.execRequest.WaitForChild())
+	require.NoError(t, scx.execRequest.WaitForChild(ctx))
 
 	// Continue execution
 	scx.execRequest.Continue()
diff --git a/lib/srv/termhandlers.go b/lib/srv/termhandlers.go
index 6a7810d67ebe6..3ce3425074b1c 100644
--- a/lib/srv/termhandlers.go
+++ b/lib/srv/termhandlers.go
@@ -123,11 +123,19 @@ func (t *TermHandlers) HandleShell(ctx context.Context, ch ssh.Channel, req *ssh
 	if err := scx.SetExecRequest(execRequest); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := t.SessionRegistry.OpenSession(ctx, ch, scx); err != nil {
-		return trace.Wrap(err)
+
+	if joinSid := scx.GetSessionParams().JoinSessionID; joinSid != "" {
+		err := t.SessionRegistry.JoinSession(ctx, ch, scx, joinSid, scx.GetSessionParams().JoinMode)
+
+		// TODO(Joerger): DELETE IN 20.0.0 - v19+ only set TELEPORT_SESSION
+		// when they want to join a session. Always return an error instead
+		// of ignoring the client provided session ID and creating a new session.
+		if !trace.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
 	}
 
-	return nil
+	return t.SessionRegistry.OpenSession(ctx, ch, scx)
 }
 
 // HandleFileTransferDecision handles requests of type "file-transfer-decision@goteleport.com" which will
diff --git a/lib/srv/termmanager.go b/lib/srv/termmanager.go
index ddb0d1f3bbc88..4656060ad0365 100644
--- a/lib/srv/termmanager.go
+++ b/lib/srv/termmanager.go
@@ -124,11 +124,13 @@ func (g *TermManager) writeToClients(p []byte) {
 		// writeToClients is called with the lock held, so we need to release it
 		// before calling OnWriteError to avoid a deadlock if OnWriteError
 		// calls DeleteWriter/DeleteReader.
-		g.mu.Unlock()
-		for _, deleteWriter := range toDelete {
-			g.OnWriteError(deleteWriter.key, deleteWriter.err)
-		}
-		g.mu.Lock()
+		func() {
+			g.mu.Unlock()
+			defer g.mu.Lock()
+			for _, deleteWriter := range toDelete {
+				g.OnWriteError(deleteWriter.key, deleteWriter.err)
+			}
+		}()
 	}
 }
 
diff --git a/lib/srv/transport/transportv1/transport.go b/lib/srv/transport/transportv1/transport.go
index 88cfb5a3c15d2..cb5217a5f45f6 100644
--- a/lib/srv/transport/transportv1/transport.go
+++ b/lib/srv/transport/transportv1/transport.go
@@ -35,13 +35,13 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/gravitational/teleport"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
 	"github.com/gravitational/teleport/api/types"
 	streamutils "github.com/gravitational/teleport/api/utils/grpc/stream"
 	"github.com/gravitational/teleport/lib/agentless"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -49,7 +49,7 @@ import (
 // Dialer is the interface that groups basic dialing methods.
 type Dialer interface {
 	DialSite(ctx context.Context, cluster string, clientSrcAddr, clientDstAddr net.Addr) (net.Conn, error)
-	DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter teleagent.Getter, singer agentless.SignerCreator) (net.Conn, error)
+	DialHost(ctx context.Context, scopePin *scopesv1.Pin, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter sshagent.ClientGetter, singer agentless.SignerCreator) (net.Conn, error)
 	DialWindowsDesktop(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, desktopName, cluster string, clusterAccessChecker func(types.RemoteCluster) error) (net.Conn, error)
 }
 
@@ -69,7 +69,7 @@ type ServerConfig struct {
 	// Dialer is used to establish remote connections.
 	Dialer Dialer
 	// SignerFn is used to create an [ssh.Signer] for an authenticated connection.
-	SignerFn func(authzCtx *authz.Context, clusterName string) agentless.SignerCreator
+	SignerFn func(authzCtx *authz.ScopedContext, clusterName string) agentless.SignerCreator
 	// ConnectionMonitor is used to monitor the connection for activity and terminate it
 	// when conditions are met.
 	ConnectionMonitor ConnectionMonitor
@@ -77,10 +77,10 @@ type ServerConfig struct {
 	LocalAddr net.Addr
 
 	// agentGetterFn used by tests to serve the agent directly
-	agentGetterFn func(rw io.ReadWriter) teleagent.Getter
+	agentGetterFn func(rw io.ReadWriter) sshagent.ClientGetter
 
 	// authzContextFn used by tests to inject an access checker
-	authzContextFn func(info credentials.AuthInfo) (*authz.Context, error)
+	authzContextFn func(info credentials.AuthInfo) (*authz.ScopedContext, error)
 }
 
 // CheckAndSetDefaults ensures required parameters are set
@@ -99,21 +99,26 @@ func (c *ServerConfig) CheckAndSetDefaults() error {
 	}
 
 	if c.agentGetterFn == nil {
-		c.agentGetterFn = func(rw io.ReadWriter) teleagent.Getter {
-			return func() (teleagent.Agent, error) {
-				return teleagent.NopCloser(agent.NewClient(rw)), nil
-			}
+		c.agentGetterFn = func(rw io.ReadWriter) sshagent.ClientGetter {
+			return sshagent.NewStaticClientGetter(agent.NewClient(rw))
 		}
 	}
 
 	if c.authzContextFn == nil {
-		c.authzContextFn = func(info credentials.AuthInfo) (*authz.Context, error) {
-			identityInfo, ok := info.(auth.IdentityInfo)
+		c.authzContextFn = func(info credentials.AuthInfo) (*authz.ScopedContext, error) {
+			identityInfo, ok := info.(interface {
+				ScopedAuthzContext() (ctx *authz.ScopedContext, ok bool)
+			})
 			if !ok {
 				return nil, trace.AccessDenied("client is not authenticated")
 			}
 
-			return identityInfo.AuthContext, nil
+			ctx, ok := identityInfo.ScopedAuthzContext()
+			if !ok {
+				return nil, trace.AccessDenied("missing required authz context")
+			}
+
+			return ctx, nil
 		}
 	}
 
@@ -273,29 +278,43 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 	// create a reader/writer for SSH Agent protocol
 	agentStreamRW, err := streamutils.NewReadWriter(agentStream)
 	if err != nil {
-		return trace.Wrap(err, "failed constructing ssh agent streamer")
+		return trace.Wrap(err, "creating ssh agent stream")
 	}
 	defer agentStreamRW.Close()
 
 	// create a reader/writer for SSH protocol
 	sshStreamRW, err := streamutils.NewReadWriter(sshStream)
 	if err != nil {
-		return trace.Wrap(err, "failed constructing ssh streamer")
+		return trace.Wrap(err, "creating ssh stream")
 	}
 
 	clientDst, err := getDestinationAddress(p.Addr, s.cfg.LocalAddr)
 	if err != nil {
-		return trace.Wrap(err, "could get not client destination address; listener address %q, client source address %q", s.cfg.LocalAddr.String(), p.Addr.String())
+		return trace.Wrap(err, "retrieving destination address; listener address %q, client source address %q", s.cfg.LocalAddr.String(), p.Addr.String())
 	}
 
 	signer := s.cfg.SignerFn(authzContext, req.DialTarget.Cluster)
-	hostConn, err := s.cfg.Dialer.DialHost(ctx, p.Addr, clientDst, host, port, req.DialTarget.Cluster, authzContext.Checker.CheckAccessToRemoteCluster, s.cfg.agentGetterFn(agentStreamRW), signer)
+
+	checkAccessToRemoteCluster := func(types.RemoteCluster) error {
+		return trace.AccessDenied("scoped identities do not support cross-cluster access")
+	}
+
+	if unscopedCtx, ok := authzContext.UnscopedContext(); ok {
+		checkAccessToRemoteCluster = unscopedCtx.Checker.CheckAccessToRemoteCluster
+	}
+
+	var scopePin *scopesv1.Pin
+	if pin, ok := authzContext.CheckerContext.ScopePin(); ok {
+		scopePin = pin
+	}
+
+	hostConn, err := s.cfg.Dialer.DialHost(ctx, scopePin, p.Addr, clientDst, host, port, req.DialTarget.Cluster, checkAccessToRemoteCluster, s.cfg.agentGetterFn(agentStreamRW), signer)
 	if err != nil {
 		// Return ambiguous errors unadorned so that clients can detect them easily.
 		if errors.Is(err, teleport.ErrNodeIsAmbiguous) {
 			return trace.Wrap(err)
 		}
-		return trace.Wrap(err, "failed to dial target host")
+		return trace.Wrap(err)
 	}
 
 	// ensure the connection to the target host
@@ -311,9 +330,17 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 
 	// monitor the user connection
 	conn := streamutils.NewConn(sshStreamRW, p.Addr, targetAddr)
-	monitorCtx, userConn, err := s.cfg.ConnectionMonitor.MonitorConn(ctx, authzContext, conn)
-	if err != nil {
-		return trace.Wrap(err)
+	var monitorCtx context.Context
+	var userConn net.Conn
+	if unscopedCtx, ok := authzContext.UnscopedContext(); ok {
+		monitorCtx, userConn, err = s.cfg.ConnectionMonitor.MonitorConn(ctx, unscopedCtx, conn)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	} else {
+		// TODO(fspmarshall/scopes): implement connection monitoring for scoped identities
+		userConn = conn
+		monitorCtx = ctx
 	}
 
 	// send back the cluster details to alert the other side that
@@ -429,11 +456,16 @@ func (s *Service) ProxyWindowsDesktopSession(stream transportv1pb.TransportServi
 		return trace.BadParameter("failed to find peer")
 	}
 
-	authzContext, err := s.cfg.authzContextFn(p.AuthInfo)
+	scopedAuthzContext, err := s.cfg.authzContextFn(p.AuthInfo)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
+	authzContext, ok := scopedAuthzContext.UnscopedContext()
+	if !ok {
+		return trace.AccessDenied("scoped identities are not supported for windows desktop connections")
+	}
+
 	// Wait for the first request to arrive with the dial request.
 	req, err := stream.Recv()
 	if err != nil {
diff --git a/lib/srv/transport/transportv1/transport_test.go b/lib/srv/transport/transportv1/transport_test.go
index d40b2c2d9ee70..7b11414371215 100644
--- a/lib/srv/transport/transportv1/transport_test.go
+++ b/lib/srv/transport/transportv1/transport_test.go
@@ -39,6 +39,7 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"
 
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
@@ -47,12 +48,13 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	os.Exit(m.Run())
 }
@@ -119,7 +121,7 @@ func (f fakeDialer) DialSite(ctx context.Context, clusterName string, clientSrcA
 	return conn, nil
 }
 
-func (f fakeDialer) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter teleagent.Getter, singer agentless.SignerCreator) (_ net.Conn, err error) {
+func (f fakeDialer) DialHost(ctx context.Context, scopePin *scopesv1.Pin, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter sshagent.ClientGetter, singer agentless.SignerCreator) (_ net.Conn, err error) {
 	key := fmt.Sprintf("%s.%s.%s", host, port, cluster)
 	conn, ok := f.hostConns[key]
 	if !ok {
@@ -241,7 +243,7 @@ func newServer(t *testing.T, cfg ServerConfig) testPack {
 	}
 }
 
-func fakeSigner(authzCtx *authz.Context, clusterName string) agentless.SignerCreator {
+func fakeSigner(authzCtx *authz.ScopedContext, clusterName string) agentless.SignerCreator {
 	return func(_ context.Context, _ agentless.LocalAccessPoint, _ agentless.CertGenerator) (ssh.Signer, error) {
 		return nil, nil
 	}
@@ -276,7 +278,7 @@ func TestService_GetClusterDetails(t *testing.T) {
 			t.Parallel()
 			srv := newServer(t, ServerConfig{
 				Dialer:            fakeDialer{},
-				Logger:            utils.NewSlogLoggerForTests(),
+				Logger:            logtest.NewLogger(),
 				FIPS:              test.FIPS,
 				SignerFn:          fakeSigner,
 				ConnectionMonitor: fakeMonitor{},
@@ -359,7 +361,7 @@ func TestService_ProxyCluster(t *testing.T) {
 						cluster: conn,
 					},
 				},
-				Logger:            utils.NewSlogLoggerForTests(),
+				Logger:            logtest.NewLogger(),
 				SignerFn:          fakeSigner,
 				ConnectionMonitor: fakeMonitor{},
 				LocalAddr:         utils.MustParseAddr("127.0.0.1:4242"),
@@ -511,15 +513,15 @@ func TestService_ProxySSH_Errors(t *testing.T) {
 				},
 				SignerFn:          fakeSigner,
 				ConnectionMonitor: fakeMonitor{},
-				Logger:            utils.NewSlogLoggerForTests(),
+				Logger:            logtest.NewLogger(),
 				LocalAddr:         utils.MustParseAddr("127.0.0.1:4242"),
-				authzContextFn: func(info credentials.AuthInfo) (*authz.Context, error) {
+				authzContextFn: func(info credentials.AuthInfo) (*authz.ScopedContext, error) {
 					checker, err := test.checkerFn(info)
 					if err != nil {
 						return nil, trace.Wrap(err)
 					}
 
-					return &authz.Context{Checker: checker}, nil
+					return authz.ScopedContextFromUnscopedContext(&authz.Context{Checker: checker}), nil
 				},
 			})
 
@@ -574,11 +576,11 @@ func TestService_ProxySSH(t *testing.T) {
 	srv := newServer(t, ServerConfig{
 		Dialer:            sshSrv,
 		SignerFn:          fakeSigner,
-		Logger:            utils.NewSlogLoggerForTests(),
+		Logger:            logtest.NewLogger(),
 		LocalAddr:         utils.MustParseAddr("127.0.0.1:4242"),
 		ConnectionMonitor: fakeMonitor{},
-		agentGetterFn: func(rw io.ReadWriter) teleagent.Getter {
-			return func() (teleagent.Agent, error) {
+		agentGetterFn: func(rw io.ReadWriter) sshagent.ClientGetter {
+			return func() (sshagent.Client, error) {
 				srw, ok := rw.(*streamutils.ReadWriter)
 				if !ok {
 					return nil, trace.BadParameter("rw must be a streamutils.ReadWriter")
@@ -589,8 +591,8 @@ func TestService_ProxySSH(t *testing.T) {
 				}, nil
 			}
 		},
-		authzContextFn: func(info credentials.AuthInfo) (*authz.Context, error) {
-			return &authz.Context{Checker: fakeChecker{}}, nil
+		authzContextFn: func(info credentials.AuthInfo) (*authz.ScopedContext, error) {
+			return authz.ScopedContextFromUnscopedContext(&authz.Context{Checker: fakeChecker{}}), nil
 		},
 	})
 
@@ -819,15 +821,15 @@ func TestService_ProxyWindowsDesktopSession(t *testing.T) {
 				},
 				SignerFn:          fakeSigner,
 				ConnectionMonitor: fakeMonitor{},
-				Logger:            utils.NewSlogLoggerForTests(),
+				Logger:            logtest.NewLogger(),
 				LocalAddr:         utils.MustParseAddr("127.0.0.1:4243"),
-				authzContextFn: func(info credentials.AuthInfo) (*authz.Context, error) {
+				authzContextFn: func(info credentials.AuthInfo) (*authz.ScopedContext, error) {
 					checker, err := test.checkerFn(info)
 					if err != nil {
 						return nil, trace.Wrap(err)
 					}
 
-					return &authz.Context{Checker: checker}, nil
+					return authz.ScopedContextFromUnscopedContext(&authz.Context{Checker: checker}), nil
 				},
 			})
 
@@ -955,7 +957,7 @@ func (s *sshServer) DialSite(ctx context.Context, clusterName string, clientSrcA
 // nil and is of type testAgent, then the server will serve its keyring
 // over the underlying [streamutils.ReadWriter] so that tests can exercise
 // ssh agent multiplexing.
-func (s *sshServer) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter teleagent.Getter, singer agentless.SignerCreator) (_ net.Conn, err error) {
+func (s *sshServer) DialHost(ctx context.Context, scopePin *scopesv1.Pin, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, clusterAccessChecker func(types.RemoteCluster) error, agentGetter sshagent.ClientGetter, singer agentless.SignerCreator) (_ net.Conn, err error) {
 	conn, err := s.dial()
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/srv/uacc/uacc.go b/lib/srv/uacc/uacc.go
new file mode 100644
index 0000000000000..c3be7ad07c04c
--- /dev/null
+++ b/lib/srv/uacc/uacc.go
@@ -0,0 +1,193 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// Package uacc implements user accounting on Linux systems. There are two
+// supported backends, utmp and wtmpdb. Operations in this package attempt to use
+// all available backends and succeed if at least one backend succeeds.
+//
+// # utmp
+//
+// utmp is the classic Unix user accounting system. Current sessions are logged in
+// the utmp file, session history is logged in the wtmp file, and failed logins are
+// logged in the btmp file (or their *tmpx counterparts, the file format is
+// identical on Linux). Teleport writes to the *tmp files via the libc API in
+// <utmp.h>.
+//
+// # wtmpdb
+//
+// [wtmpdb] is the Y2038-safe successor to utmp. Session history is logged in the
+// wtmp.db sqlite database. Teleport writes to wtmpdb with sqlite directly instead
+// of using libwtmpdb.
+//
+// [wtmpdb]: https://github.com/thkukuk/wtmpdb
+package uacc
+
+import (
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+)
+
+// UserAccountHandler handles user accounting across multiple backends.
+type UserAccountHandler struct {
+	utmp   *UtmpBackend
+	wtmpdb *WtmpdbBackend
+}
+
+// UaccConfig configures NewUserAccounting.
+type UaccConfig struct {
+	// WtmpdbFile is the path to an alternate wtmpdb database.
+	WtmpdbFile string
+	// UtmpFile is the path to an alternate utmp file.
+	UtmpFile string
+	// WtmpFile is the path to an alternate wtmp file.
+	WtmpFile string
+	// BtmpFile is the path to an alternate btmp file.
+	BtmpFile string
+}
+
+// NewUserAccountHandler creates a new UserAccountHandler.
+func NewUserAccountHandler(cfg UaccConfig) *UserAccountHandler {
+	uacc := &UserAccountHandler{}
+	ctx := context.Background()
+	//nolint:staticcheck // SA4023 Always non-nil error on non-Linux hosts
+	utmp, utmpErr := NewUtmpBackend(cfg.UtmpFile, cfg.WtmpFile, cfg.BtmpFile)
+	//nolint:staticcheck // SA4023 Always non-nil error on non-Linux hosts
+	if utmpErr == nil {
+		uacc.utmp = utmp
+		slog.DebugContext(ctx, "utmp user accounting is active")
+	}
+	wtmpdb, wtmpdbErr := NewWtmpdbBackend(cfg.WtmpdbFile)
+	if wtmpdbErr == nil {
+		uacc.wtmpdb = wtmpdb
+		slog.DebugContext(ctx, "wtmpdb user accounting is active")
+	}
+	if uacc.utmp == nil && uacc.wtmpdb == nil {
+		slog.DebugContext(
+			ctx, "no user accounting backends are available, sessions will not be logged locally",
+			"utmp_error", utmpErr, "wtmpdb_error", wtmpdbErr,
+		)
+	}
+	return uacc
+}
+
+// Session represents a login session. It must be closed when the session is finished.
+type Session struct {
+	uacc      *UserAccountHandler
+	utmpKey   string
+	wtmpdbKey *int64
+}
+
+// OpenSession opens a new login session. It will attempt to open a session
+// with all backends and will succeed if at least one backend succeeds.
+func (uacc *UserAccountHandler) OpenSession(tty *os.File, username string, remote net.Addr) (*Session, error) {
+	if uacc.utmp == nil && uacc.wtmpdb == nil {
+		return &Session{}, nil
+	}
+
+	loginTime := time.Now()
+	ttyFullName, err := os.Readlink(tty.Name())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	ttyName := strings.TrimPrefix(ttyFullName, "/dev/")
+
+	var anySucceeded bool
+	session := &Session{
+		uacc: uacc,
+	}
+	var errors []error
+	if uacc.utmp != nil {
+		//nolint:staticcheck // SA4023 Always non-nil error on non-Linux hosts
+		if err := uacc.utmp.Login(ttyName, username, remote, loginTime); err == nil {
+			anySucceeded = true
+			session.utmpKey = ttyName
+		} else {
+			errors = append(errors, err)
+		}
+	}
+	if uacc.wtmpdb != nil {
+		key, err := uacc.wtmpdb.Login(ttyName, username, remote, loginTime)
+		if err == nil {
+			anySucceeded = true
+			session.wtmpdbKey = &key
+		} else {
+			errors = append(errors, err)
+		}
+	}
+	if !anySucceeded {
+		return nil, trace.NewAggregate(errors...)
+	}
+	return session, nil
+}
+
+// Close closes the login session. It will attempt to close the session
+// on all backends and will succeed if at least one backend succeeds.
+func (session *Session) Close() error {
+	if session.utmpKey == "" && session.wtmpdbKey == nil {
+		return nil
+	}
+
+	logoutTime := time.Now()
+	var anySucceeded bool
+	var errors []error
+	if session.utmpKey != "" {
+		utmp := session.uacc.utmp
+		if utmp == nil {
+			return trace.BadParameter("utmp not supported")
+		}
+		//nolint:staticcheck // SA4023 Always non-nil error on non-Linux hosts
+		if err := utmp.Logout(session.utmpKey, logoutTime); err == nil {
+			anySucceeded = true
+		} else {
+			errors = append(errors, err)
+		}
+	}
+	if session.wtmpdbKey != nil {
+		wtmpdb := session.uacc.wtmpdb
+		if wtmpdb == nil {
+			return trace.BadParameter("wtmpdb not supported")
+		}
+		if err := wtmpdb.Logout(*session.wtmpdbKey, logoutTime); err == nil {
+			anySucceeded = true
+		} else {
+			errors = append(errors, err)
+		}
+	}
+	if !anySucceeded {
+		return trace.NewAggregate(errors...)
+	}
+	return nil
+}
+
+// FailedLogin logs a failed login attempt.
+func (uacc *UserAccountHandler) FailedLogin(username string, remote net.Addr) error {
+	if uacc.utmp != nil {
+		//nolint:staticcheck // SA4023 Always non-nil error on non-Linux hosts
+		if err := uacc.utmp.FailedLogin(username, remote, time.Now()); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	// wtmpdb doesn't log failed logins.
+	return nil
+}
diff --git a/lib/srv/uacc/uacc.h b/lib/srv/uacc/uacc.h
index 74d2b738783fe..9058e85118b92 100644
--- a/lib/srv/uacc/uacc.h
+++ b/lib/srv/uacc/uacc.h
@@ -134,9 +134,7 @@ static int uacc_add_utmp_entry(const char *utmp_path, const char *wtmp_path, con
         return status;
     }
     updwtmp(wtmp_file, &entry);
-    if (errno != 0) {
-        return status_from_errno();
-    }
+    // updwtmp doesn't report errors, per the c standard we can't trust errno here.
     return 0;
 }
 
@@ -197,9 +195,7 @@ static int uacc_mark_utmp_entry_dead(const char *utmp_path, const char *wtmp_pat
         return status;
     }
     updwtmp(wtmp_file, &log_entry);
-    if (errno != 0) {
-        return status_from_errno();
-    }
+    // updwtmp doesn't report errors, per the c standard we can't trust errno here.
     return 0;
 }
 
@@ -267,9 +263,7 @@ static int uacc_add_btmp_entry(const char *btmp_path, const char *username,
     memcpy(&entry.ut_addr_v6, remote_addr_v6, sizeof(int32_t) * 4);
 
     updwtmp(file, &entry);
-    if (errno != 0) {
-        return status_from_errno();
-    }
+    // updwtmp doesn't report errors, per the c standard we can't trust errno here.
     return 0;
 }
 
diff --git a/lib/srv/uacc/uacc_linux.go b/lib/srv/uacc/uacc_linux.go
deleted file mode 100644
index 0282606a08071..0000000000000
--- a/lib/srv/uacc/uacc_linux.go
+++ /dev/null
@@ -1,329 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-/*
-Package uacc concerns itself with updating the user account database and log on nodes
-that a client connects to with an interactive session.
-*/
-package uacc
-
-// #include <stdlib.h>
-// #include "uacc.h"
-import "C"
-
-import (
-	"os"
-	"strings"
-	"sync"
-	"time"
-	"unsafe"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// Due to thread safety design in glibc we must serialize all access to the accounting database.
-var accountDb sync.Mutex
-
-// Max hostname length as defined by glibc.
-const hostMaxLen = 255
-
-// Max username length as defined by glibc.
-const userMaxLen = 32
-
-const uaccPathErrMaxLength = 4096
-
-// Sometimes the _UTMP_PATH and _WTMP_PATH macros from glibc are bad, this seems to depend on distro.
-// I asked around on IRC, no one really knows why. I suspect it's another
-// archaic remnant of old Unix days and that a cleanup is long overdue.
-//
-// In the meantime, we just try to resolve from these paths instead.
-
-const (
-	utmpFilePath = "/var/run/utmp"
-	wtmpFilePath = "/var/log/wtmp"
-	// wtmpAltFilePath exists only because on some system the path is different.
-	// It's being used when the wtmp path is not provided and the wtmpFilePath doesn't exist.
-	wtmpAltFilePath = "/var/run/wtmp"
-	btmpFilePath    = "/var/log/btmp"
-)
-
-// Open writes a new entry to the utmp database with a tag of `USER_PROCESS`.
-// This should be called when an interactive session is started.
-//
-// `username`: Name of the user the interactive session is running under.
-// `hostname`: Name of the system the user is logged into.
-// `remote`: IPv6 address of the remote host.
-// `tty`: Pointer to the tty stream
-func Open(utmpPath, wtmpPath string, username, hostname string, remote [4]int32, tty *os.File) error {
-	ttyName, err := os.Readlink(tty.Name())
-	if err != nil {
-		return trace.Errorf("failed to resolve soft proc tty link: %v", err)
-	}
-
-	// String parameter validation.
-	if len(username) > userMaxLen {
-		return trace.BadParameter("username length exceeds OS limits")
-	}
-	if len(hostname) > hostMaxLen {
-		return trace.BadParameter("hostname length exceeds OS limits")
-	}
-	if len(ttyName) > (int)(C.max_len_tty_name()-1) {
-		return trace.BadParameter("tty name length exceeds OS limits")
-	}
-
-	utmpPath, wtmpPath = getDefaultPaths(utmpPath, wtmpPath)
-	// Convert Go strings into C strings that we can pass over ffi.
-	cUtmpPath := C.CString(utmpPath)
-	defer C.free(unsafe.Pointer(cUtmpPath))
-
-	cWtmpPath := C.CString(wtmpPath)
-	defer C.free(unsafe.Pointer(cWtmpPath))
-
-	cUsername := C.CString(username)
-	defer C.free(unsafe.Pointer(cUsername))
-	cHostname := C.CString(hostname)
-	defer C.free(unsafe.Pointer(cHostname))
-	cTtyName := C.CString(strings.TrimPrefix(ttyName, "/dev/"))
-	defer C.free(unsafe.Pointer(cTtyName))
-	cIDName := C.CString(strings.TrimPrefix(ttyName, "/dev/pts/"))
-	defer C.free(unsafe.Pointer(cIDName))
-
-	// Convert IPv6 array into C integer format.
-	cIP := convertIPToC(remote)
-	secondsElapsed, microsFraction := cTimestamp()
-
-	accountDb.Lock()
-	defer accountDb.Unlock()
-	var uaccPathErr [uaccPathErrMaxLength]C.char
-	status, errno := C.uacc_add_utmp_entry(cUtmpPath, cWtmpPath, cUsername, cHostname, &cIP[0], cTtyName, cIDName, secondsElapsed, microsFraction, &uaccPathErr[0])
-
-	switch status {
-	case C.UACC_UTMP_MISSING_PERMISSIONS:
-		return trace.AccessDenied("missing permissions to write to utmp/wtmp")
-	case C.UACC_UTMP_WRITE_ERROR:
-		return trace.AccessDenied("failed to add entry to utmp database")
-	case C.UACC_UTMP_FAILED_OPEN:
-		return trace.AccessDenied("failed to open user account database, code: %d", errno)
-	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
-		return trace.BadParameter("failed to select file")
-	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
-		return trace.NotFound("user accounting files are missing from the system, running in a container?")
-	default:
-		return decodeUnknownError(int(status), uaccPathErr)
-	}
-}
-
-// Close marks an entry in the utmp database as DEAD_PROCESS.
-// This should be called when an interactive session exits.
-//
-// The `ttyName` parameter must be the name of the TTY including the `/dev/` prefix.
-func Close(utmpPath, wtmpPath string, tty *os.File) error {
-	ttyName, err := os.Readlink(tty.Name())
-	if err != nil {
-		return trace.Errorf("failed to resolve soft proc tty link: %v", err)
-	}
-
-	// String parameter validation.
-	if len(ttyName) > (int)(C.max_len_tty_name()-1) {
-		return trace.BadParameter("tty name length exceeds OS limits")
-	}
-
-	utmpPath, wtmpPath = getDefaultPaths(utmpPath, wtmpPath)
-
-	// Convert Go strings into C strings that we can pass over ffi.
-	cUtmpPath := C.CString(utmpPath)
-	defer C.free(unsafe.Pointer(cUtmpPath))
-	cWtmpPath := C.CString(wtmpPath)
-	defer C.free(unsafe.Pointer(cWtmpPath))
-
-	cTtyName := C.CString(strings.TrimPrefix(ttyName, "/dev/"))
-	defer C.free(unsafe.Pointer(cTtyName))
-
-	timestamp := time.Now()
-	secondsElapsed := (C.int32_t)(timestamp.Unix())
-	microsFraction := (C.int32_t)((timestamp.UnixNano() % int64(time.Second)) / int64(time.Microsecond))
-
-	accountDb.Lock()
-	defer accountDb.Unlock()
-	var uaccPathErr [uaccPathErrMaxLength]C.char
-	status, errno := C.uacc_mark_utmp_entry_dead(cUtmpPath, cWtmpPath, cTtyName, secondsElapsed, microsFraction, &uaccPathErr[0])
-
-	switch status {
-	case C.UACC_UTMP_MISSING_PERMISSIONS:
-		return trace.AccessDenied("missing permissions to write to utmp/wtmp")
-	case C.UACC_UTMP_WRITE_ERROR:
-		return trace.AccessDenied("failed to add entry to utmp database")
-	case C.UACC_UTMP_READ_ERROR:
-		return trace.AccessDenied("failed to read and search utmp database")
-	case C.UACC_UTMP_FAILED_OPEN:
-		return trace.AccessDenied("failed to open user account database, code: %d", errno)
-	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
-		return trace.BadParameter("failed to select file")
-	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
-		return trace.NotFound("user accounting files are missing from the system, running in a container?")
-	default:
-		return decodeUnknownError(int(status), uaccPathErr)
-	}
-}
-
-// getDefaultPaths sets the default paths for utmp and wtmp files if passed empty.
-// This function always returns both paths, even if they don't exist in the system.
-func getDefaultPaths(utmpPath, wtmpPath string) (string, string) {
-	if utmpPath == "" {
-		utmpPath = utmpFilePath
-	}
-
-	if wtmpPath == "" {
-		// Check where wtmp is located.
-		if utils.FileExists(wtmpFilePath) {
-			wtmpPath = wtmpFilePath
-		} else {
-			wtmpPath = wtmpAltFilePath
-		}
-	}
-
-	return utmpPath, wtmpPath
-}
-
-// getDefaultBtmpPaths sets the default paths for the btmp file if passed empty.
-// This function always returns a path, even if it doesn't exist in the system.
-func getDefaultBtmpPath(btmpPath string) string {
-	if btmpPath == "" {
-		return btmpFilePath
-	}
-	return btmpPath
-}
-
-// UserWithPtyInDatabase checks the user accounting database for the existence of an USER_PROCESS entry with the given username.
-func UserWithPtyInDatabase(utmpPath string, username string) error {
-	if len(username) > userMaxLen {
-		return trace.BadParameter("username length exceeds OS limits")
-	}
-
-	// Convert Go strings into C strings that we can pass over ffi.
-	var cUtmpPath *C.char
-	if len(utmpPath) > 0 {
-		cUtmpPath = C.CString(utmpPath)
-		defer C.free(unsafe.Pointer(cUtmpPath))
-	}
-	cUsername := C.CString(username)
-	defer C.free(unsafe.Pointer(cUsername))
-
-	accountDb.Lock()
-	defer accountDb.Unlock()
-	var uaccPathErr [uaccPathErrMaxLength]C.char
-	status, errno := C.uacc_has_entry_with_user(cUtmpPath, cUsername, &uaccPathErr[0])
-
-	switch status {
-	case C.UACC_UTMP_FAILED_OPEN:
-		return trace.AccessDenied("failed to open user account database, code: %d", errno)
-	case C.UACC_UTMP_ENTRY_DOES_NOT_EXIST:
-		return trace.NotFound("user not found")
-	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
-		return trace.BadParameter("failed to select file")
-	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
-		return trace.NotFound("user accounting files are missing from the system, running in a container?")
-	default:
-		return decodeUnknownError(int(status), uaccPathErr)
-	}
-}
-
-// LogFailedLogin writes a new entry to the btmp failed login log.
-// This should be called when an interactive session fails due to a missing
-// local user.
-//
-// `username`: Name of the user the interactive session is running under.
-// `hostname`: Name of the system the user is logged into.
-// `remote`: IPv6 address of the remote host.
-func LogFailedLogin(btmpPath, username, hostname string, remote [4]int32) error {
-	// String parameter validation.
-	if len(username) > userMaxLen {
-		return trace.BadParameter("username length exceeds OS limits")
-	}
-	if len(hostname) > hostMaxLen {
-		return trace.BadParameter("hostname length exceeds OS limits")
-	}
-
-	btmpPath = getDefaultBtmpPath(btmpPath)
-	// Convert Go strings into C strings that we can pass over ffi.
-	cBtmpPath := C.CString(btmpPath)
-	defer C.free(unsafe.Pointer(cBtmpPath))
-	cUsername := C.CString(username)
-	defer C.free(unsafe.Pointer(cUsername))
-	cHostname := C.CString(hostname)
-	defer C.free(unsafe.Pointer(cHostname))
-
-	// Convert IPv6 array into C integer format.
-	cIP := convertIPToC(remote)
-
-	secondsElapsed, microsFraction := cTimestamp()
-
-	accountDb.Lock()
-	defer accountDb.Unlock()
-	var uaccPathErr [uaccPathErrMaxLength]C.char
-	status, errno := C.uacc_add_btmp_entry(cBtmpPath, cUsername, cHostname, &cIP[0], secondsElapsed, microsFraction, &uaccPathErr[0])
-	switch status {
-	case C.UACC_UTMP_MISSING_PERMISSIONS:
-		return trace.AccessDenied("missing permissions to write to btmp")
-	case C.UACC_UTMP_WRITE_ERROR:
-		return trace.AccessDenied("failed to add entry to btmp")
-	case C.UACC_UTMP_FAILED_OPEN:
-		return trace.AccessDenied("failed to open user account database, code: %d", errno)
-	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
-		return trace.BadParameter("failed to select file")
-	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
-		return trace.NotFound("user accounting files are missing from the system, running in a container?")
-	default:
-		return decodeUnknownError(int(status), uaccPathErr)
-	}
-}
-
-func convertIPToC(remote [4]int32) [4]C.int32_t {
-	var cIP [4]C.int32_t
-	for i := 0; i < 4; i++ {
-		cIP[i] = (C.int32_t)(remote[i])
-	}
-	return cIP
-}
-
-func cTimestamp() (C.int32_t, C.int32_t) {
-	timestamp := time.Now()
-	secondsElapsed := (C.int32_t)(timestamp.Unix())
-	microsFraction := (C.int32_t)((timestamp.UnixNano() % int64(time.Second)) / int64(time.Microsecond))
-	return secondsElapsed, microsFraction
-}
-
-func decodeUnknownError(status int, rawUaccPathErr [uaccPathErrMaxLength]C.char) error {
-	if status == 0 {
-		return nil
-	}
-
-	uaccPathErrBytes := make([]byte, 0, uaccPathErrMaxLength)
-	for _, char := range rawUaccPathErr {
-		uaccPathErrBytes = append(uaccPathErrBytes, (byte)(char))
-	}
-	uaccPathErr := string(uaccPathErrBytes)
-
-	if uaccPathErr != "" {
-		return trace.Errorf("unknown error with code %d and data %v", status, uaccPathErr)
-	}
-
-	return trace.Errorf("unknown error with code %d", status)
-}
diff --git a/lib/srv/uacc/uacc_stub.go b/lib/srv/uacc/uacc_stub.go
deleted file mode 100644
index a4090708c031c..0000000000000
--- a/lib/srv/uacc/uacc_stub.go
+++ /dev/null
@@ -1,54 +0,0 @@
-//go:build !linux
-
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-/*
-Package uacc concerns itself with updating the user account database and log on nodes
-that a client connects to with an interactive session.
-
-This is a stub version that doesn't do anything and exists purely for compatibility purposes with systems we don't support.
-
-We do not support macOS yet because they introduced ASL for user accounting with Mac OS X 10.6 (Snow Leopard)
-and integrating with that takes additional effort.
-*/
-package uacc
-
-import (
-	"os"
-)
-
-// Open is a stub function.
-func Open(utmpPath, wtmpPath string, username, hostname string, remote [4]int32, tty *os.File) error {
-	return nil
-}
-
-// Close is a stub function.
-func Close(utmpPath, wtmpPath string, tty *os.File) error {
-	return nil
-}
-
-// UserWithPtyInDatabase is a stub function.
-func UserWithPtyInDatabase(utmpPath string, username string) error {
-	return nil
-}
-
-// LogFailedLogin is a stub function.
-func LogFailedLogin(btmpPath, username, hostname string, remote [4]int32) error {
-	return nil
-}
diff --git a/lib/srv/uacc/uacc_utils.go b/lib/srv/uacc/uacc_utils.go
deleted file mode 100644
index 90270f08a546d..0000000000000
--- a/lib/srv/uacc/uacc_utils.go
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package uacc
-
-import (
-	"encoding/binary"
-	"net"
-
-	"github.com/gravitational/trace"
-)
-
-// PrepareAddr parses and transforms a net.Addr into a format usable by other uacc functions.
-func PrepareAddr(addr net.Addr) ([4]int32, error) {
-	stringIP, _, err := net.SplitHostPort(addr.String())
-	if err != nil {
-		return [4]int32{}, trace.Wrap(err)
-	}
-	ip := net.ParseIP(stringIP)
-	rawV6 := ip.To16()
-
-	// this case can occur if the net.Addr isn't in an expected IP format, in that case, ignore it
-	// we have to guard against this because the net.Addr internal format is implementation specific
-	if rawV6 == nil {
-		return [4]int32{}, nil
-	}
-
-	groupedV6 := [4]int32{}
-	for i := range groupedV6 {
-		// some bit magic to convert the byte array into 4 32 bit integers
-		groupedV6[i] = int32(binary.LittleEndian.Uint32(rawV6[i*4 : (i+1)*4]))
-	}
-	return groupedV6, nil
-}
diff --git a/lib/srv/uacc/utmp_linux.go b/lib/srv/uacc/utmp_linux.go
new file mode 100644
index 0000000000000..9fc80d0771944
--- /dev/null
+++ b/lib/srv/uacc/utmp_linux.go
@@ -0,0 +1,345 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+Package uacc concerns itself with updating the user account database and log on nodes
+that a client connects to with an interactive session.
+*/
+package uacc
+
+// #include <stdlib.h>
+// #include "uacc.h"
+import "C"
+
+import (
+	"encoding/binary"
+	"net"
+	"strings"
+	"sync"
+	"time"
+	"unsafe"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// Due to thread safety design in glibc we must serialize all access to the accounting database.
+var accountDb sync.Mutex
+
+// Max hostname length as defined by glibc.
+const hostMaxLen = 255
+
+// Max username length as defined by glibc.
+const userMaxLen = 32
+
+const uaccPathErrMaxLength = 4096
+
+// Sometimes the _UTMP_PATH and _WTMP_PATH macros from glibc are bad, this seems to depend on distro.
+// I asked around on IRC, no one really knows why. I suspect it's another
+// archaic remnant of old Unix days and that a cleanup is long overdue.
+//
+// In the meantime, we just try to resolve from these paths instead.
+
+const (
+	defaultUtmpFilePath = "/var/run/utmp"
+	defaultWtmpFilePath = "/var/log/wtmp"
+	// wtmpAltFilePath exists only because on some system the path is different.
+	// It's being used when the wtmp path is not provided and the wtmpFilePath doesn't exist.
+	wtmpAltFilePath     = "/var/run/wtmp"
+	defaultBtmpFilePath = "/var/log/btmp"
+
+	// utmpx equivalents of the above paths.
+	defaultUtmpxFilePath = "/var/run/utmpx"
+	defaultWtmpxFilePath = "/var/log/wtmpx"
+	wtmpxAltFilePath     = "/var/run/wtmpx"
+	defaultBtmpxFilePath = "/var/log/btmpx"
+)
+
+// UtmpBackend handles user accounting with a utmp(x) system.
+type UtmpBackend struct {
+	utmpPath string
+	wtmpPath string
+	btmpPath string
+}
+
+func getTargetFile(candidates ...string) (string, error) {
+	for _, candidate := range candidates {
+		if utils.FileExists(candidate) {
+			return candidate, nil
+		}
+	}
+	return "", trace.BadParameter("no target files exist")
+}
+
+// NewUtmpBackend creates a new utmp(x) backend.
+func NewUtmpBackend(utmpFile, wtmpFile, btmpFile string) (*UtmpBackend, error) {
+	utmp, err := getTargetFile(utmpFile, defaultUtmpxFilePath, defaultUtmpFilePath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	wtmp, err := getTargetFile(wtmpFile, defaultWtmpxFilePath, wtmpxAltFilePath, defaultWtmpFilePath, wtmpAltFilePath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	btmp, err := getTargetFile(btmpFile, defaultBtmpxFilePath, defaultBtmpFilePath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &UtmpBackend{
+		utmpPath: utmp,
+		wtmpPath: wtmp,
+		btmpPath: btmp,
+	}, nil
+}
+
+// Login creates a new session entry for the given user.
+func (u *UtmpBackend) Login(ttyName, username string, remote net.Addr, ts time.Time) error {
+	// String parameter validation.
+	if len(username) > userMaxLen {
+		return trace.BadParameter("username length exceeds OS limits")
+	}
+	addr := utils.FromAddr(remote)
+	if len(addr.Host()) > hostMaxLen {
+		return trace.BadParameter("hostname length exceeds OS limits")
+	}
+	if len(ttyName) > (int)(C.max_len_tty_name()-1) {
+		return trace.BadParameter("tty name length exceeds OS limits")
+	}
+
+	// Convert Go strings into C strings that we can pass over ffi.
+	cUtmpPath := C.CString(u.utmpPath)
+	defer C.free(unsafe.Pointer(cUtmpPath))
+
+	cWtmpPath := C.CString(u.wtmpPath)
+	defer C.free(unsafe.Pointer(cWtmpPath))
+
+	cUsername := C.CString(username)
+	defer C.free(unsafe.Pointer(cUsername))
+	cHostname := C.CString(addr.Host())
+	defer C.free(unsafe.Pointer(cHostname))
+	cTtyName := C.CString(strings.TrimPrefix(ttyName, "/dev/"))
+	defer C.free(unsafe.Pointer(cTtyName))
+	cIDName := C.CString(strings.TrimPrefix(ttyName, "/dev/pts/"))
+	defer C.free(unsafe.Pointer(cIDName))
+
+	// Convert IPv6 array into C integer format.
+	remoteIP, err := prepareAddr(remote)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	cIP := convertIPToC(remoteIP)
+	secondsElapsed, microsFraction := cTimestamp(ts)
+
+	accountDb.Lock()
+	defer accountDb.Unlock()
+	var uaccPathErr [uaccPathErrMaxLength]C.char
+	status, errno := C.uacc_add_utmp_entry(cUtmpPath, cWtmpPath, cUsername, cHostname, &cIP[0], cTtyName, cIDName, secondsElapsed, microsFraction, &uaccPathErr[0])
+
+	switch status {
+	case C.UACC_UTMP_MISSING_PERMISSIONS:
+		return trace.AccessDenied("missing permissions to write to utmp/wtmp")
+	case C.UACC_UTMP_WRITE_ERROR:
+		return trace.AccessDenied("failed to add entry to utmp database")
+	case C.UACC_UTMP_FAILED_OPEN:
+		return trace.AccessDenied("failed to open user account database, code: %d", errno)
+	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
+		return trace.BadParameter("failed to select file")
+	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
+		return trace.NotFound("user accounting files are missing from the system, running in a container?")
+	default:
+		return decodeUnknownError(int(status), uaccPathErr)
+	}
+}
+
+// Logout marks the user corresponding to the given tty name as logged out.
+func (u *UtmpBackend) Logout(ttyName string, ts time.Time) error {
+	// String parameter validation.
+	if len(ttyName) > (int)(C.max_len_tty_name()-1) {
+		return trace.BadParameter("tty name length exceeds OS limits")
+	}
+
+	// Convert Go strings into C strings that we can pass over ffi.
+	cUtmpPath := C.CString(u.utmpPath)
+	defer C.free(unsafe.Pointer(cUtmpPath))
+	cWtmpPath := C.CString(u.wtmpPath)
+	defer C.free(unsafe.Pointer(cWtmpPath))
+
+	cTtyName := C.CString(strings.TrimPrefix(ttyName, "/dev/"))
+	defer C.free(unsafe.Pointer(cTtyName))
+	secondsElapsed, microsFraction := cTimestamp(ts)
+
+	accountDb.Lock()
+	defer accountDb.Unlock()
+	var uaccPathErr [uaccPathErrMaxLength]C.char
+	status, errno := C.uacc_mark_utmp_entry_dead(cUtmpPath, cWtmpPath, cTtyName, secondsElapsed, microsFraction, &uaccPathErr[0])
+
+	switch status {
+	case C.UACC_UTMP_MISSING_PERMISSIONS:
+		return trace.AccessDenied("missing permissions to write to utmp/wtmp")
+	case C.UACC_UTMP_WRITE_ERROR:
+		return trace.AccessDenied("failed to add entry to utmp database")
+	case C.UACC_UTMP_READ_ERROR:
+		return trace.AccessDenied("failed to read and search utmp database")
+	case C.UACC_UTMP_FAILED_OPEN:
+		return trace.AccessDenied("failed to open user account database, code: %d", errno)
+	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
+		return trace.BadParameter("failed to select file")
+	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
+		return trace.NotFound("user accounting files are missing from the system, running in a container?")
+	default:
+		return decodeUnknownError(int(status), uaccPathErr)
+	}
+}
+
+// FailedLogin logs a failed login attempt.
+func (u *UtmpBackend) FailedLogin(username string, remote net.Addr, ts time.Time) error {
+	// String parameter validation.
+	if len(username) > userMaxLen {
+		return trace.BadParameter("username length exceeds OS limits")
+	}
+	addr := utils.FromAddr(remote)
+	if len(addr.Host()) > hostMaxLen {
+		return trace.BadParameter("hostname length exceeds OS limits")
+	}
+
+	// Convert Go strings into C strings that we can pass over ffi.
+	cBtmpPath := C.CString(u.btmpPath)
+	defer C.free(unsafe.Pointer(cBtmpPath))
+	cUsername := C.CString(username)
+	defer C.free(unsafe.Pointer(cUsername))
+	cHostname := C.CString(addr.Host())
+	defer C.free(unsafe.Pointer(cHostname))
+
+	// Convert IPv6 array into C integer format.
+	remoteIP, err := prepareAddr(remote)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	cIP := convertIPToC(remoteIP)
+
+	secondsElapsed, microsFraction := cTimestamp(ts)
+
+	accountDb.Lock()
+	defer accountDb.Unlock()
+	var uaccPathErr [uaccPathErrMaxLength]C.char
+	status, errno := C.uacc_add_btmp_entry(cBtmpPath, cUsername, cHostname, &cIP[0], secondsElapsed, microsFraction, &uaccPathErr[0])
+	switch status {
+	case C.UACC_UTMP_MISSING_PERMISSIONS:
+		return trace.AccessDenied("missing permissions to write to btmp")
+	case C.UACC_UTMP_WRITE_ERROR:
+		return trace.AccessDenied("failed to add entry to btmp")
+	case C.UACC_UTMP_FAILED_OPEN:
+		return trace.AccessDenied("failed to open user account database, code: %d", errno)
+	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
+		return trace.BadParameter("failed to select file")
+	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
+		return trace.NotFound("user accounting files are missing from the system, running in a container?")
+	default:
+		return decodeUnknownError(int(status), uaccPathErr)
+	}
+}
+
+// IsUserInFile checks if the given user has been logged in a specific file.
+func (u *UtmpBackend) IsUserInFile(utmpFile string, username string) (bool, error) {
+	if len(username) > userMaxLen {
+		return false, trace.BadParameter("username length exceeds OS limits")
+	}
+
+	// Convert Go strings into C strings that we can pass over ffi.
+	var cUtmpPath *C.char
+	if len(utmpFile) > 0 {
+		cUtmpPath = C.CString(utmpFile)
+		defer C.free(unsafe.Pointer(cUtmpPath))
+	}
+	cUsername := C.CString(username)
+	defer C.free(unsafe.Pointer(cUsername))
+
+	accountDb.Lock()
+	defer accountDb.Unlock()
+	var uaccPathErr [uaccPathErrMaxLength]C.char
+	status, errno := C.uacc_has_entry_with_user(cUtmpPath, cUsername, &uaccPathErr[0])
+
+	switch status {
+	case C.UACC_UTMP_FAILED_OPEN:
+		return false, trace.AccessDenied("failed to open user account database, code: %d", errno)
+	case C.UACC_UTMP_ENTRY_DOES_NOT_EXIST:
+		return false, nil
+	case C.UACC_UTMP_FAILED_TO_SELECT_FILE:
+		return false, trace.BadParameter("failed to select file")
+	case C.UACC_UTMP_PATH_DOES_NOT_EXIST:
+		return false, trace.NotFound("user accounting files are missing from the system, running in a container?")
+	default:
+		return status == 0, decodeUnknownError(int(status), uaccPathErr)
+	}
+}
+
+func convertIPToC(remote [4]int32) [4]C.int32_t {
+	var cIP [4]C.int32_t
+	for i := range 4 {
+		cIP[i] = (C.int32_t)(remote[i])
+	}
+	return cIP
+}
+
+// prepareAddr parses and transforms a net.Addr into a format usable by other uacc functions.
+func prepareAddr(addr net.Addr) ([4]int32, error) {
+	stringIP, _, err := net.SplitHostPort(addr.String())
+	if err != nil {
+		return [4]int32{}, trace.Wrap(err)
+	}
+	ip := net.ParseIP(stringIP)
+	rawV6 := ip.To16()
+
+	// this case can occur if the net.Addr isn't in an expected IP format, in that case, ignore it
+	// we have to guard against this because the net.Addr internal format is implementation specific
+	if rawV6 == nil {
+		return [4]int32{}, nil
+	}
+
+	groupedV6 := [4]int32{}
+	for i := range groupedV6 {
+		// some bit magic to convert the byte array into 4 32 bit integers
+		groupedV6[i] = int32(binary.LittleEndian.Uint32(rawV6[i*4 : (i+1)*4]))
+	}
+	return groupedV6, nil
+}
+
+func cTimestamp(ts time.Time) (C.int32_t, C.int32_t) {
+	secondsElapsed := (C.int32_t)(ts.Unix())
+	microsFraction := (C.int32_t)((ts.UnixNano() % int64(time.Second)) / int64(time.Microsecond))
+	return secondsElapsed, microsFraction
+}
+
+func decodeUnknownError(status int, rawUaccPathErr [uaccPathErrMaxLength]C.char) error {
+	if status == 0 {
+		return nil
+	}
+
+	uaccPathErrBytes := make([]byte, 0, uaccPathErrMaxLength)
+	for _, char := range rawUaccPathErr {
+		uaccPathErrBytes = append(uaccPathErrBytes, (byte)(char))
+	}
+	uaccPathErr := string(uaccPathErrBytes)
+
+	if uaccPathErr != "" {
+		return trace.Errorf("unknown error with code %d and data %v", status, uaccPathErr)
+	}
+
+	return trace.Errorf("unknown error with code %d", status)
+}
diff --git a/lib/srv/uacc/utmp_other.go b/lib/srv/uacc/utmp_other.go
new file mode 100644
index 0000000000000..6aa0f006a77c4
--- /dev/null
+++ b/lib/srv/uacc/utmp_other.go
@@ -0,0 +1,48 @@
+//go:build !linux
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package uacc
+
+import (
+	"net"
+	"time"
+
+	"github.com/gravitational/trace"
+)
+
+type UtmpBackend struct{}
+
+func NewUtmpBackend(utmpFile, wtmpFile, btmpFile string) (*UtmpBackend, error) {
+	return nil, trace.NotImplemented("utmp is linux only")
+}
+
+func (u *UtmpBackend) Login(_, _ string, _ net.Addr, _ time.Time) error {
+	return trace.NotImplemented("utmp is linux only")
+}
+
+func (u *UtmpBackend) Logout(_ string, _ time.Time) error {
+	return trace.NotImplemented("utmp is linux only")
+}
+
+func (u *UtmpBackend) FailedLogin(_ string, _ net.Addr, _ time.Time) error {
+	return trace.NotImplemented("utmp is linux only")
+}
+
+func (u *UtmpBackend) IsUserInFile(_ string, _ string) (bool, error) {
+	return false, trace.NotImplemented("utmp is linux only")
+}
diff --git a/lib/srv/uacc/utmp_test.go b/lib/srv/uacc/utmp_test.go
new file mode 100644
index 0000000000000..d0de8eb19286e
--- /dev/null
+++ b/lib/srv/uacc/utmp_test.go
@@ -0,0 +1,95 @@
+//go:build linux
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package uacc
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func assertUserPresence(t *testing.T, utmp *UtmpBackend, file, username string, present bool) {
+	inFile, err := utmp.IsUserInFile(file, username)
+	assert.NoError(t, err)
+	assert.Equal(t, present, inFile)
+}
+
+func touchFile(t *testing.T, name string) {
+	file, err := os.OpenFile(name, os.O_RDONLY|os.O_CREATE, 0644)
+	require.NoError(t, err)
+	require.NoError(t, file.Close())
+}
+
+func makeUtmpBackend(t *testing.T) *UtmpBackend {
+	tmpDir := t.TempDir()
+	utmpFile := filepath.Join(tmpDir, "utmp")
+	wtmpFile := filepath.Join(tmpDir, "wtmp")
+	btmpFile := filepath.Join(tmpDir, "btmp")
+	touchFile(t, utmpFile)
+	touchFile(t, wtmpFile)
+	touchFile(t, btmpFile)
+
+	utmp, err := NewUtmpBackend(utmpFile, wtmpFile, btmpFile)
+	require.NoError(t, err)
+	return utmp
+}
+
+func TestUtmp(t *testing.T) {
+	t.Parallel()
+	utmp := makeUtmpBackend(t)
+	remote := &utils.NetAddr{
+		AddrNetwork: "tcp",
+		Addr:        "123.456.789.012:0",
+	}
+	const goodUser = "good-user"
+	assert.NoError(t, utmp.Login("pts/99", goodUser, remote, time.Now()))
+	assertUserPresence(t, utmp, utmp.utmpPath, goodUser, true)
+	assertUserPresence(t, utmp, utmp.wtmpPath, goodUser, true)
+	assertUserPresence(t, utmp, utmp.btmpPath, goodUser, false)
+	assert.NoError(t, utmp.Logout("pts/99", time.Now()))
+
+	const badUser = "bad-user"
+	assert.NoError(t, utmp.FailedLogin(badUser, remote, time.Now()))
+	assertUserPresence(t, utmp, utmp.utmpPath, badUser, false)
+	assertUserPresence(t, utmp, utmp.wtmpPath, badUser, false)
+	assertUserPresence(t, utmp, utmp.btmpPath, badUser, true)
+}
+
+func TestUtmpUsernameLength(t *testing.T) {
+	t.Parallel()
+	utmp := makeUtmpBackend(t)
+
+	// A 33 character long username.
+	username := strings.Repeat("a", 33)
+	err := utmp.Login("pts/99", username, &utils.NetAddr{Addr: "0.0.0.0:0"}, time.Now())
+	require.True(t, trace.IsBadParameter(err))
+
+	// A 32 character long username.
+	username = strings.Repeat("a", 32)
+	err = utmp.Login("pts/99", username, &utils.NetAddr{Addr: "0.0.0.0:0"}, time.Now())
+	require.False(t, trace.IsBadParameter(err))
+}
diff --git a/lib/srv/uacc/wtmpdb.go b/lib/srv/uacc/wtmpdb.go
new file mode 100644
index 0000000000000..c4b059bfd3de2
--- /dev/null
+++ b/lib/srv/uacc/wtmpdb.go
@@ -0,0 +1,103 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package uacc
+
+import (
+	"database/sql"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/mattn/go-sqlite3"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// defaultWtmpdbPath is the default location of the wtmpdb db file.
+const defaultWtmpdbPath = "/var/lib/wtmpdb/wtmp.db"
+
+// userProcess is the wtmpdb entry type for user sessions.
+const userProcess = 3
+
+// WtmpdbBackend handles user accounting on systems with wtmpdb.
+type WtmpdbBackend struct {
+	db *sql.DB
+}
+
+// NewWtmpdbBackend creates a new wtmpdb backend.
+func NewWtmpdbBackend(dbPath string) (*WtmpdbBackend, error) {
+	if dbPath == "" {
+		dbPath = defaultWtmpdbPath
+	}
+	if !utils.FileExists(dbPath) {
+		return nil, trace.NotFound("no wtmpdb at %q", dbPath)
+	}
+	db, err := sql.Open("sqlite3", dbPath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &WtmpdbBackend{db: db}, nil
+}
+
+// Login creates a new session entry for the given user.
+func (w *WtmpdbBackend) Login(ttyName, username string, remote net.Addr, ts time.Time) (int64, error) {
+	// Schema: https://github.com/thkukuk/wtmpdb?tab=readme-ov-file#database
+	stmt, err := w.db.Prepare("INSERT INTO wtmp(Type, User, Login, TTY, RemoteHost) VALUES(?,?,?,?,?)")
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+	defer stmt.Close()
+	addr := utils.FromAddr(remote)
+	result, err := stmt.Exec(userProcess, username, ts.UnixMicro(), ttyName, addr.Host())
+	if err != nil {
+		if errors.Is(err, sqlite3.ErrReadonly) {
+			return 0, trace.AccessDenied("cannot write to wtmpdb file, is Teleport running as root?")
+		}
+		return 0, trace.Wrap(err)
+	}
+	id, err := result.LastInsertId()
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+	return id, nil
+}
+
+// Logout marks the user corresponding to the given id (returned from Login) as logged out.
+func (w *WtmpdbBackend) Logout(id int64, ts time.Time) error {
+	stmt, err := w.db.Prepare("UPDATE wtmp SET Logout = ? WHERE ID = ?")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer stmt.Close()
+	_, err = stmt.Exec(ts.UnixMicro(), id)
+	return trace.Wrap(err)
+}
+
+// IsUserLoggedIn checks if the given user has an active session.
+func (w *WtmpdbBackend) IsUserLoggedIn(username string) (bool, error) {
+	stmt, err := w.db.Prepare("SELECT COUNT(1) FROM wtmp WHERE User = ? AND Logout IS NULL")
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer stmt.Close()
+	var count int
+	if err := stmt.QueryRow(username).Scan(&count); err != nil {
+		return false, nil
+	}
+	return count != 0, nil
+}
diff --git a/lib/srv/uacc/wtmpdb_test.go b/lib/srv/uacc/wtmpdb_test.go
new file mode 100644
index 0000000000000..ea665ea739c21
--- /dev/null
+++ b/lib/srv/uacc/wtmpdb_test.go
@@ -0,0 +1,83 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package uacc
+
+import (
+	"database/sql"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func assertDBEntry(t *testing.T, db *sql.DB, key int64, expectUsername, expectTTY, expectAddr string, expectLoginTime, expectLogoutTime time.Time) {
+	var user string
+	var tty, remoteHost sql.NullString
+	var wtmpType, loginTs, logoutTs sql.NullInt64
+	assert.NoError(t,
+		db.QueryRow("SELECT Type, User, Login, TTY, RemoteHost, Logout FROM wtmp WHERE ID = ?", key).
+			Scan(&wtmpType, &user, &loginTs, &tty, &remoteHost, &logoutTs),
+	)
+	assert.Equal(t, int64(userProcess), wtmpType.Int64)
+	assert.Equal(t, expectUsername, user)
+	assert.Equal(t, expectTTY, tty.String)
+	assert.Equal(t, expectAddr, remoteHost.String)
+	assert.Equal(t, expectLoginTime.UnixMicro(), loginTs.Int64)
+	assert.Equal(t, expectLogoutTime.UnixMicro(), logoutTs.Int64)
+}
+
+func TestWtmpdb(t *testing.T) {
+	t.Parallel()
+	// Create database.
+	dbFile := filepath.Join(t.TempDir(), "wtmp.db")
+	db, err := sql.Open("sqlite3", dbFile)
+	require.NoError(t, err)
+	// Schema: https://github.com/thkukuk/wtmpdb/blob/272b109f5b3bdfb3008604461b4ddbff03c28b77/lib/sqlite.c#L128
+	_, err = db.Exec("CREATE TABLE IF NOT EXISTS wtmp(ID INTEGER PRIMARY KEY, Type INTEGER, User TEXT NOT NULL, Login INTEGER, Logout INTEGER, TTY TEXT, RemoteHost TEXT, Service TEXT) STRICT;")
+	require.NoError(t, err)
+
+	wtmpdb, err := NewWtmpdbBackend(dbFile)
+	require.NoError(t, err)
+
+	// Log a user in.
+	remote := &utils.NetAddr{
+		AddrNetwork: "tcp",
+		Addr:        "123.456.789.012",
+	}
+	loginTime := time.Now()
+	key, err := wtmpdb.Login("pts/99", "testuser", remote, loginTime)
+	require.NoError(t, err)
+	require.NotEmpty(t, key)
+
+	// Check that user was logged.
+	assertDBEntry(t, wtmpdb.db, key, "testuser", "pts/99", remote.Addr, loginTime, time.Unix(0, 0))
+	isUserLoggedIn, err := wtmpdb.IsUserLoggedIn("testuser")
+	require.NoError(t, err)
+	require.True(t, isUserLoggedIn)
+
+	// Check that logout is logged.
+	logoutTime := loginTime.Add(time.Hour)
+	require.NoError(t, wtmpdb.Logout(key, logoutTime))
+	assertDBEntry(t, wtmpdb.db, key, "testuser", "pts/99", remote.Addr, loginTime, logoutTime)
+	isUserLoggedIn, err = wtmpdb.IsUserLoggedIn("testuser")
+	require.NoError(t, err)
+	require.False(t, isUserLoggedIn)
+}
diff --git a/lib/srv/usermgmt.go b/lib/srv/usermgmt.go
index 0c874be7553c6..d47061858c738 100644
--- a/lib/srv/usermgmt.go
+++ b/lib/srv/usermgmt.go
@@ -131,8 +131,8 @@ type HostUsersBackend interface {
 	LookupGroup(group string) (*user.Group, error)
 	// LookupGroupByID retrieves a group by its ID.
 	LookupGroupByID(gid string) (*user.Group, error)
-	// SetUserGroups sets a user's groups, replacing their existing groups.
-	SetUserGroups(name string, groups []string) error
+	// UpdateUser sets a user's groups and default shell, replacing their existing groups.
+	UpdateUser(name string, groups []string, defaultShell string) error
 	// CreateGroup creates a group on a host.
 	CreateGroup(group string, gid string) error
 	// CreateUser creates a user on a host.
@@ -143,6 +143,8 @@ type HostUsersBackend interface {
 	CreateHomeDirectory(userHome string, uid, gid string) error
 	// GetDefaultHomeDirectory returns the default home directory path for the given user
 	GetDefaultHomeDirectory(name string) (string, error)
+	// IsUsingShell returns whether or not the given user is currently using the given shell.
+	IsUsingShell(username, shell string) (bool, error)
 	// RemoveExpirations removes any sort of password or account expiration from the user
 	// that may have been placed by password policies.
 	RemoveExpirations(name string) error
@@ -315,7 +317,7 @@ func (u *HostUserManagement) updateUser(hostUser HostUser, ui *decisionpb.HostUs
 	}
 
 	return trace.Wrap(u.doWithUserLock(func(_ types.SemaphoreLease) error {
-		return trace.Wrap(u.backend.SetUserGroups(hostUser.Name, ui.Groups))
+		return trace.Wrap(u.backend.UpdateUser(hostUser.Name, ui.Groups, ui.Shell))
 	}))
 }
 
@@ -495,10 +497,26 @@ func (u *HostUserManagement) UpsertUser(name string, ui *decisionpb.HostUsersInf
 		return closer, nil
 	}
 
-	if groups != nil {
-		if err := u.updateUser(*hostUser, ui); err != nil {
-			return nil, trace.Wrap(err)
+	// nothing to update
+	if groups == nil && ui.Shell == "" {
+		return closer, nil
+	}
+
+	if groups == nil {
+		// only bother checking the user's current shell if we aren't already
+		// updating their groups
+		usingShell, err := u.backend.IsUsingShell(name, ui.Shell)
+		if err != nil {
+			log.WarnContext(u.ctx, "Failed to check user's default shell", "error", err)
 		}
+
+		if usingShell {
+			return closer, nil
+		}
+	}
+
+	if err := u.updateUser(*hostUser, ui); err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	// attempt to remove password expirations from managed users if they've been added
@@ -515,12 +533,12 @@ func (u *HostUserManagement) doWithUserLock(f func(types.SemaphoreLease) error)
 				SemaphoreKind: types.SemaphoreKindHostUserModification,
 				SemaphoreName: "host_user_modification",
 				MaxLeases:     1,
-				Expires:       time.Now().Add(userLeaseDuration),
 			},
 			Retry: retryutils.LinearConfig{
 				Step: time.Second * 5,
 				Max:  time.Minute,
 			},
+			TTL: userLeaseDuration,
 		})
 
 	if err != nil {
diff --git a/lib/srv/usermgmt_linux.go b/lib/srv/usermgmt_linux.go
index b1c6ed22c416c..667675301d30b 100644
--- a/lib/srv/usermgmt_linux.go
+++ b/lib/srv/usermgmt_linux.go
@@ -101,9 +101,9 @@ func (*HostUsersProvisioningBackend) LookupGroupByID(gid string) (*user.Group, e
 	return user.LookupGroupId(gid)
 }
 
-// SetUserGroups sets a user's groups, replacing their existing groups.
-func (*HostUsersProvisioningBackend) SetUserGroups(name string, groups []string) error {
-	_, err := host.SetUserGroups(name, groups)
+// UpdateUser sets a user's groups and default shell, replacing their existing groups.
+func (*HostUsersProvisioningBackend) UpdateUser(name string, groups []string, defaultShell string) error {
+	_, err := host.UserUpdate(name, groups, defaultShell)
 	return trace.Wrap(err)
 }
 
@@ -113,6 +113,21 @@ func (*HostUsersProvisioningBackend) GetAllUsers() ([]string, error) {
 	return users, err
 }
 
+// IsUsingShell returns whether or not the given user is already using the given shell.
+func (*HostUsersProvisioningBackend) IsUsingShell(username, shell string) (bool, error) {
+	currentShell, err := host.UserShell(username)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	shellPath, err := exec.LookPath(shell)
+	if err != nil {
+		return false, trace.WrapWithMessage(err, "could not find path for shell %q", shell)
+	}
+
+	return shellPath == currentShell, nil
+}
+
 // CreateGroup creates a group on a host
 func (*HostUsersProvisioningBackend) CreateGroup(name string, gid string) error {
 	_, err := host.GroupAdd(name, gid)
diff --git a/lib/srv/usermgmt_test.go b/lib/srv/usermgmt_test.go
index 7d64c3952f832..6c9aec5fd0c3a 100644
--- a/lib/srv/usermgmt_test.go
+++ b/lib/srv/usermgmt_test.go
@@ -34,8 +34,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services/local"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/host"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type testHostUserBackend struct {
@@ -49,19 +49,22 @@ type testHostUserBackend struct {
 	userUID map[string]string
 	// userGID: user -> gid
 	userGID map[string]string
+	// userShells: user -> shell path
+	userShells map[string]string
 
-	setUserGroupsCalls       int
+	updateUserCalls          int
 	createHomeDirectoryCalls int
 	groupDatabaseErr         error
 }
 
 func newTestUserMgmt() *testHostUserBackend {
 	return &testHostUserBackend{
-		users:   map[string][]string{},
-		groups:  map[string]string{},
-		sudoers: map[string]string{},
-		userUID: map[string]string{},
-		userGID: map[string]string{},
+		users:      map[string][]string{},
+		groups:     map[string]string{},
+		sudoers:    map[string]string{},
+		userUID:    map[string]string{},
+		userGID:    map[string]string{},
+		userShells: map[string]string{},
 	}
 }
 
@@ -111,12 +114,16 @@ func (tm *testHostUserBackend) LookupGroupByID(gid string) (*user.Group, error)
 	return nil, user.UnknownGroupIdError(gid)
 }
 
-func (tm *testHostUserBackend) SetUserGroups(name string, groups []string) error {
-	tm.setUserGroupsCalls++
+func (tm *testHostUserBackend) UpdateUser(name string, groups []string, defaultShell string) error {
+	tm.updateUserCalls++
 	if _, ok := tm.users[name]; !ok {
 		return trace.NotFound("User %q doesn't exist", name)
 	}
+
 	tm.users[name] = groups
+	if defaultShell != "" {
+		tm.userShells[name] = defaultShell
+	}
 	return nil
 }
 
@@ -158,6 +165,11 @@ func (tm *testHostUserBackend) CreateUser(user string, groups []string, opts hos
 	tm.users[user] = groups
 	tm.userUID[user] = opts.UID
 	tm.userGID[user] = opts.GID
+
+	if opts.Shell == "" {
+		opts.Shell = "/usr/bin/sh"
+	}
+	tm.userShells[user] = opts.Shell
 	return nil
 }
 
@@ -175,6 +187,10 @@ func (tm *testHostUserBackend) GetDefaultHomeDirectory(user string) (string, err
 	return "", nil
 }
 
+func (tm *testHostUserBackend) IsUsingShell(user, shell string) (bool, error) {
+	return tm.userShells[user] == shell, nil
+}
+
 // RemoveSudoersFile implements HostUsersBackend
 func (tm *testHostUserBackend) RemoveSudoersFile(user string) error {
 	delete(tm.sudoers, user)
@@ -263,11 +279,11 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 	users := HostUserManagement{
 		backend: backend,
 		storage: pres,
-		log:     utils.NewSlogLoggerForTests(),
+		log:     logtest.NewLogger(),
 	}
 	sudoers := HostSudoersManagement{
 		backend: backend,
-		log:     utils.NewSlogLoggerForTests(),
+		log:     logtest.NewLogger(),
 	}
 
 	closer, err := users.UpsertUser("bob", &decisionpb.HostUsersInfo{
@@ -290,7 +306,7 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 		users := HostUserManagement{
 			backend: backend,
 			storage: pres,
-			log:     utils.NewSlogLoggerForTests(),
+			log:     logtest.NewLogger(),
 		}
 		// test user already exists but teleport-service group has not yet
 		// been created
@@ -331,7 +347,7 @@ func TestUserMgmt_DeleteAllTeleportSystemUsers(t *testing.T) {
 	users := HostUserManagement{
 		backend:   mgmt,
 		storage:   pres,
-		log:       utils.NewSlogLoggerForTests(),
+		log:       logtest.NewLogger(),
 		userGrace: 0,
 	}
 
@@ -357,7 +373,7 @@ func TestUserMgmt_DeleteAllTeleportSystemUsers(t *testing.T) {
 	users = HostUserManagement{
 		backend: newTestUserMgmt(),
 		storage: pres,
-		log:     utils.NewSlogLoggerForTests(),
+		log:     logtest.NewLogger(),
 	}
 	// teleport-system group doesnt exist, DeleteAllUsers will return nil, instead of erroring
 	require.NoError(t, users.DeleteAllUsers())
@@ -425,7 +441,7 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	closer, err := users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportDropGroup)
 
@@ -435,15 +451,15 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportDropGroup)
 
-	// Upsert again with same groups should not call SetUserGroups.
+	// Upsert again with same groups should not call UpdateUser.
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportDropGroup)
 
@@ -452,7 +468,7 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 
 	// Updates with INSECURE_DROP mode should convert the managed user
@@ -461,7 +477,7 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportKeepGroup)
 }
@@ -481,7 +497,7 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	closer, err := users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportKeepGroup)
 
@@ -491,7 +507,7 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportKeepGroup)
 
@@ -499,7 +515,7 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportKeepGroup)
 
@@ -508,7 +524,7 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportDropGroup), backend.users["alice"])
 
 	// Updates with KEEP mode should convert the ephemeral user
@@ -517,7 +533,7 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.Equal(t, 1, backend.createHomeDirectoryCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportDropGroup)
@@ -537,7 +553,7 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	closer, err := users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportStaticGroup), backend.users["alice"])
 
 	// Update user with new groups.
@@ -545,14 +561,14 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportStaticGroup), backend.users["alice"])
 
 	// Upsert again with same groups should not call SetUserGroups.
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportStaticGroup), backend.users["alice"])
 
 	// Do not convert to KEEP.
@@ -560,7 +576,7 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(slices.Clone(allGroups[2:]), types.TeleportStaticGroup), backend.users["alice"])
 
 	// Do not convert to INSECURE_DROP.
@@ -568,7 +584,7 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(slices.Clone(allGroups[2:]), types.TeleportStaticGroup), backend.users["alice"])
 }
 
@@ -589,7 +605,7 @@ func Test_DontManageExistingUser(t *testing.T) {
 	closer, err := users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, allGroups, backend.users["alice"])
 
 	// Update user in KEEP mode
@@ -597,7 +613,7 @@ func Test_DontManageExistingUser(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, allGroups, backend.users["alice"])
 
 	// Update static user
@@ -605,7 +621,7 @@ func Test_DontManageExistingUser(t *testing.T) {
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, allGroups, backend.users["alice"])
 }
 
@@ -647,7 +663,7 @@ func Test_DontUpdateUnmanagedUsers(t *testing.T) {
 			closer, err := users.UpsertUser("alice", tc.userinfo)
 			assert.ErrorIs(t, err, errUnmanagedUser)
 			assert.Equal(t, nil, closer)
-			assert.Zero(t, backend.setUserGroupsCalls)
+			assert.Zero(t, backend.updateUserCalls)
 			assert.ElementsMatch(t, allGroups[2:], backend.users["alice"])
 		})
 	}
@@ -673,7 +689,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	closer, err := users.UpsertUser("alice-keep", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 1, backend.updateUserCalls)
 	// slice off the end because teleport-system should be explicitly excluded
 	assert.ElementsMatch(t, allGroups[:2], backend.users["alice-keep"])
 	assert.NotContains(t, backend.users["alice-keep"], types.TeleportDropGroup)
@@ -683,7 +699,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	closer, err = users.UpsertUser("alice-static", &userinfo, TakeOwnershipIfUserExists(true))
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.Contains(t, backend.users["alice-static"], "foo")
 	assert.Contains(t, backend.users["alice-static"], types.TeleportStaticGroup)
 	assert.NotContains(t, backend.users["alice-static"], types.TeleportKeepGroup)
@@ -694,7 +710,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	closer, err = users.UpsertUser("alice-drop", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.Empty(t, backend.users["alice-drop"])
 
 	// Don't assign teleport-keep to users created in DROP mode
@@ -702,7 +718,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	closer, err = users.UpsertUser("bob", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.ElementsMatch(t, []string{"foo", types.TeleportDropGroup}, backend.users["bob"])
 	assert.NotContains(t, backend.users["bob"], types.TeleportKeepGroup)
 }
@@ -715,7 +731,7 @@ func initBackend(t *testing.T, groups []string) (HostUserManagement, *testHostUs
 	users := HostUserManagement{
 		backend: backend,
 		storage: pres,
-		log:     utils.NewSlogLoggerForTests(),
+		log:     logtest.NewLogger(),
 	}
 
 	for _, group := range groups {
@@ -733,7 +749,7 @@ func TestCreateUserWithExistingPrimaryGroup(t *testing.T) {
 	users := HostUserManagement{
 		backend: backend,
 		storage: pres,
-		log:     utils.NewSlogLoggerForTests(),
+		log:     logtest.NewLogger(),
 	}
 
 	existingGroups := []string{"alice", "simon"}
@@ -750,21 +766,21 @@ func TestCreateUserWithExistingPrimaryGroup(t *testing.T) {
 	closer, err := users.UpsertUser("bob", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group defined in userinfo.Groups, but not yet on the host
 	userinfo.Groups = []string{"fred"}
 	closer, err = users.UpsertUser("fred", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group defined in userinfo.Groups that already exists on the host
 	userinfo.Groups = []string{"alice"}
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group that already exists on the host but is not defined in userinfo.Groups
 	userinfo.Groups = []string{""}
@@ -772,7 +788,7 @@ func TestCreateUserWithExistingPrimaryGroup(t *testing.T) {
 	assert.True(t, trace.IsAlreadyExists(err))
 	assert.Contains(t, err.Error(), "conflicts with an existing group")
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 }
 
 func TestHostUsersResolveGroups(t *testing.T) {
@@ -1094,7 +1110,7 @@ func TestHostUsersResolveGroups(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			log := utils.NewSlogLoggerForTests()
+			log := logtest.NewLogger()
 			groups, err := ResolveGroups(log, c.hostUser, c.ui, c.takeOwnership)
 			if c.expectErr == nil {
 				assert.NoError(t, err)
@@ -1127,7 +1143,7 @@ func TestRegressionGroupErrorDoesNotPanic(t *testing.T) {
 	closer, err := users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
-	assert.Zero(t, backend.setUserGroupsCalls)
+	assert.Zero(t, backend.updateUserCalls)
 	assert.ElementsMatch(t, append(userinfo.Groups, types.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], types.TeleportDropGroup)
 
@@ -1135,3 +1151,48 @@ func TestRegressionGroupErrorDoesNotPanic(t *testing.T) {
 	_, err = users.UpsertUser("alice", &userinfo)
 	require.Error(t, err)
 }
+
+func TestIsUserShell(t *testing.T) {
+	allGroups := []string{"foo", "bar", "baz"}
+	users, backend := initBackend(t, allGroups)
+	userinfo := decisionpb.HostUsersInfo{
+		Groups: slices.Clone(allGroups[:2]),
+		Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
+	}
+
+	// no shell defined, create with default
+	closer, err := users.UpsertUser("alice", &userinfo)
+	assert.NoError(t, err)
+	assert.Equal(t, nil, closer)
+	hasShell, err := backend.IsUsingShell("alice", "/usr/bin/sh")
+	require.NoError(t, err)
+	require.True(t, hasShell)
+
+	// shell defined, create with shell
+	userinfo.Shell = "/usr/bin/bash"
+	closer, err = users.UpsertUser("bob", &userinfo)
+	assert.NoError(t, err)
+	assert.Equal(t, nil, closer)
+	hasShell, err = backend.IsUsingShell("bob", "/usr/bin/bash")
+	require.NoError(t, err)
+	require.True(t, hasShell)
+
+	// shell defined but unchanged, do nothing on update
+	closer, err = users.UpsertUser("bob", &userinfo)
+	assert.NoError(t, err)
+	assert.Equal(t, nil, closer)
+	hasShell, err = backend.IsUsingShell("bob", "/usr/bin/bash")
+	require.NoError(t, err)
+	require.True(t, hasShell)
+	require.Equal(t, 0, backend.updateUserCalls)
+
+	// shell defined and changed, update user
+	userinfo.Shell = "/usr/bin/zsh"
+	closer, err = users.UpsertUser("bob", &userinfo)
+	assert.NoError(t, err)
+	assert.Equal(t, nil, closer)
+	hasShell, err = backend.IsUsingShell("bob", "/usr/bin/zsh")
+	require.NoError(t, err)
+	require.True(t, hasShell)
+	require.Equal(t, 1, backend.updateUserCalls)
+}
diff --git a/lib/sshagent/client.go b/lib/sshagent/client.go
new file mode 100644
index 0000000000000..bfb15d62f2853
--- /dev/null
+++ b/lib/sshagent/client.go
@@ -0,0 +1,151 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package sshagent
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
+
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
+)
+
+// Client extends the [agent.ExtendedAgent] interface with an [io.Closer].
+type Client interface {
+	agent.ExtendedAgent
+	io.Closer
+}
+
+// ClientGetter is a function used to get a new agent client.
+type ClientGetter = func() (Client, error)
+
+type client struct {
+	agent.ExtendedAgent
+	conn io.Closer
+}
+
+// NewClient creates a new SSH Agent client with an open connection using
+// the provided connection function. The resulting connection can be any
+// [io.ReadWriteCloser], such as a [net.Conn] or [ssh.Channel].
+func NewClient(connect func() (io.ReadWriteCloser, error)) (Client, error) {
+	conn, err := connect()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &client{
+		ExtendedAgent: agent.NewClient(conn),
+		conn:          conn,
+	}, nil
+}
+
+// NewSystemAgentClient creates a new SSH Agent client with an open connection
+// to the system agent, advertised by SSH_AUTH_SOCK or other system parameters.
+func NewSystemAgentClient() (Client, error) {
+	return NewClient(DialSystemAgent)
+}
+
+// NewStaticClient creates a new SSH Agent client for the given static agent.
+func NewStaticClient(agentClient agent.ExtendedAgent) Client {
+	return &client{
+		ExtendedAgent: agentClient,
+	}
+}
+
+// NewStaticClientGetter returns a [ClientGetter] for a static agent client.
+func NewStaticClientGetter(agentClient agent.ExtendedAgent) ClientGetter {
+	return func() (Client, error) {
+		return &client{
+			ExtendedAgent: agentClient,
+		}, nil
+	}
+}
+
+// Close the agent client and prevent further requests.
+func (c *client) Close() error {
+	if c.conn == nil {
+		return nil
+	}
+	err := c.conn.Close()
+	return trace.Wrap(err)
+}
+
+const channelType = "auth-agent@openssh.com"
+
+// ServeChannelRequests routes agent channel requests to a new agent
+// connection retrieved from the provided getter.
+//
+// This method differs from [agent.ForwardToAgent] in that each agent
+// forwarding channel is handled with a new connection to the forward
+// agent, rather than sharing a single long-lived connection.
+//
+// Specifically, this is necessary for Windows' named pipe ssh agent
+// implementation, as the named pipe connection can be disrupted after
+// signature requests. This issue may be resolved directly by the
+// [agent] library once https://github.com/golang/go/issues/61383
+// is addressed.
+func ServeChannelRequests(ctx context.Context, client *ssh.Client, getForwardAgent ClientGetter) error {
+	channels := client.HandleChannelOpen(channelType)
+	if channels == nil {
+		return errors.New("agent forwarding channel already open")
+	}
+
+	go func() {
+		for ch := range channels {
+			channel, reqs, err := ch.Accept()
+			if err != nil {
+				continue
+			}
+
+			go ssh.DiscardRequests(reqs)
+
+			forwardAgent, err := getForwardAgent()
+			if err != nil {
+				_ = channel.Close()
+				slog.ErrorContext(ctx, "failed to connect to forwarded agent", "err", err)
+				continue
+			}
+
+			go func() {
+				defer channel.Close()
+				defer forwardAgent.Close()
+				if err := agent.ServeAgent(forwardAgent, channel); err != nil && !errors.Is(err, io.EOF) {
+					slog.ErrorContext(ctx, "unexpected error serving forwarded agent", "err", err)
+				}
+			}()
+		}
+	}()
+	return nil
+}
+
+// RequestAgentForwarding sets up agent forwarding for the session.
+// ForwardToAgent or ForwardToRemote should be called to route
+// the authentication requests.
+func RequestAgentForwarding(ctx context.Context, session *tracessh.Session) error {
+	ok, err := session.SendRequest(ctx, "auth-agent-req@openssh.com", true, nil)
+	if err != nil {
+		return trace.Wrap(err)
+	} else if !ok {
+		return trace.Errorf("agent forwarding request denied")
+	}
+	return nil
+}
diff --git a/lib/sshagent/client_test.go b/lib/sshagent/client_test.go
new file mode 100644
index 0000000000000..294295ff47ea4
--- /dev/null
+++ b/lib/sshagent/client_test.go
@@ -0,0 +1,133 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package sshagent_test
+
+import (
+	"context"
+	"io"
+	"net"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh/agent"
+
+	"github.com/gravitational/teleport/lib/sshagent"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TestSSHAgentClient(t *testing.T) {
+	keyring, ok := agent.NewKeyring().(agent.ExtendedAgent)
+	require.True(t, ok)
+
+	agentDir := t.TempDir()
+	agentPath := filepath.Join(agentDir, "agent.sock")
+	startAgentServer := func() (stop func()) {
+		l, err := net.Listen("unix", agentPath)
+		require.NoError(t, err)
+
+		// create a context to close existing connections on server shutdown.
+		serveCtx, serveCancel := context.WithCancel(t.Context())
+
+		// Track open connections.
+		var connWg sync.WaitGroup
+
+		connWg.Add(1)
+		go func() {
+			defer connWg.Done()
+			for {
+				conn, err := l.Accept()
+				if err != nil {
+					assert.True(t, utils.IsUseOfClosedNetworkError(err))
+					return
+				}
+
+				closeConn := func() {
+					conn.Close()
+					connWg.Done()
+				}
+
+				// Close the connection early if the server is stopped.
+				connNotClosed := context.AfterFunc(serveCtx, closeConn)
+
+				connWg.Add(1)
+				go func() {
+					defer func() {
+						if connNotClosed() {
+							closeConn()
+						}
+					}()
+					agent.ServeAgent(keyring, conn)
+				}()
+			}
+		}()
+
+		// Close the listener, stop serving, and wait for all open client
+		// connections to close.
+		stopServer := func() {
+			l.Close()
+			serveCancel()
+			connWg.Wait()
+		}
+
+		return stopServer
+	}
+
+	stopServer := startAgentServer()
+	t.Cleanup(stopServer)
+
+	clientConnect := func() (io.ReadWriteCloser, error) {
+		return net.Dial("unix", agentPath)
+	}
+	clientGetter := func() (sshagent.Client, error) {
+		return sshagent.NewClient(clientConnect)
+	}
+
+	// Get a new agent client and make successful requests.
+	agentClient, err := clientGetter()
+	require.NoError(t, err)
+	_, err = agentClient.List()
+	require.NoError(t, err)
+
+	// Close the server and all client connections, client should fail.
+	stopServer()
+	_, err = agentClient.List()
+	// TODO(Joerger): Ideally we would check for the error (io.EOF),
+	// but the agent library isn't properly wrapping its errors.
+	require.Error(t, err)
+
+	// Getting a new client should fail.
+	_, err = clientGetter()
+	require.Error(t, err)
+
+	// Re-open the server. Get a new agent client connection.
+	stopServer = startAgentServer()
+	t.Cleanup(stopServer)
+
+	agentClient, err = clientGetter()
+	require.NoError(t, err)
+	_, err = agentClient.List()
+	require.NoError(t, err)
+
+	// Close the client, it should return an error when receiving requests.
+	err = agentClient.Close()
+	require.NoError(t, err)
+	_, err = agentClient.List()
+	require.Error(t, err)
+}
diff --git a/lib/sshagent/clientconn_unix.go b/lib/sshagent/clientconn_unix.go
new file mode 100644
index 0000000000000..7610d7cc84b99
--- /dev/null
+++ b/lib/sshagent/clientconn_unix.go
@@ -0,0 +1,43 @@
+//go:build unix
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sshagent
+
+import (
+	"io"
+	"net"
+	"os"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+)
+
+// DialSystemAgent connects to the SSH agent advertised by SSH_AUTH_SOCK.
+func DialSystemAgent() (io.ReadWriteCloser, error) {
+	socketPath := os.Getenv(teleport.SSHAuthSock)
+	if socketPath == "" {
+		return nil, trace.NotFound("no system agent advertised by SSH_AUTH_SOCK")
+	}
+
+	conn, err := net.Dial("unix", socketPath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return conn, nil
+}
diff --git a/lib/sshagent/clientconn_windows.go b/lib/sshagent/clientconn_windows.go
new file mode 100644
index 0000000000000..7c8fb6c7725f0
--- /dev/null
+++ b/lib/sshagent/clientconn_windows.go
@@ -0,0 +1,265 @@
+//go:build windows
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sshagent
+
+import (
+	"context"
+	"encoding/binary"
+	"encoding/hex"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"os/exec"
+	"os/user"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/Microsoft/go-winio"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+)
+
+const namedPipe = `\\.\pipe\openssh-ssh-agent`
+
+// DialSystemAgent connects to the SSH agent listening on a Windows named pipe.
+// If connecting to a named pipe fails and we're in a Cygwin environment, a
+// connection to the Cygwin SSH agent advertised by SSH_AUTH_SOCK will be attempted.
+//
+// This is behind a build flag because winio.DialPipe is only available on Windows.
+func DialSystemAgent() (io.ReadWriteCloser, error) {
+	conn, err := winio.DialPipe(namedPipe, nil)
+	if err == nil {
+		return conn, nil
+	}
+
+	// MSYSTEM is used to specify what Cygwin environment is used;
+	// if it exists, there's a very good chance we're in a Cygwin
+	// environment
+	msys := os.Getenv("MSYSTEM")
+	socketPath := os.Getenv(teleport.SSHAuthSock)
+	if msys != "" && socketPath != "" {
+		conn, err := dialCygwin(socketPath)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return conn, nil
+	}
+
+	return nil, trace.Wrap(err)
+}
+
+// SIDs that are computer or domain SIDs start with this prefix.
+const wellKnownSIDPrefix = "S-1-5-"
+
+var (
+	// Format of the contents of a file created by Cygwin 'ssh-agent'.
+	// After '!<socket >', the listening port is specified, followed by
+	// an optional 's ' that is sometimes set depending on the implementation,
+	// ending with a GUID which is used as a shared secret when handshaking
+	// with the SSH agent.
+	// example:
+	// !<socket >51463 s 043B28B0-30D7E90E-027C556A-314067F9
+	cygwinSocket = regexp.MustCompile(`!<socket >(\d+) (s )?([A-Fa-f0-9-]+)`)
+	// format of an output line from Cygwin 'ps'
+	// example:
+	//       PID    PPID    PGID     WINPID   TTY         UID    STIME COMMAND
+	//      1634    1540    1634       7356     ?      197608 14:31:52 /usr/bin/ps
+	psLine = regexp.MustCompile(`(?m)^\s+\d+\s+\d+\s+\d+\s+\d+\s+\?\s+(\d+)`)
+)
+
+// attempt to connect a Cygwin SSH agent socket. Some code adapted from
+// https://github.com/abourget/secrets-bridge/blob/master/pkg/agentfwd/agentconn_windows.go
+func dialCygwin(socket string) (net.Conn, error) {
+	// the "socket" is actually a file Cygwin uses to communicate what the
+	// actual socket is and the parameters for the handshake
+	contents, err := os.ReadFile(socket)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sockMatches := cygwinSocket.FindStringSubmatch(string(contents))
+	if len(sockMatches) != 4 {
+		return nil, trace.Errorf("could not find necessary information in Cygwin socket file")
+	}
+	port := sockMatches[1]
+	if sockMatches[2] != "s " {
+		return nil, trace.NotImplemented("dialing mysysgit ssh-agent sockets is not supported")
+	}
+	key := sockMatches[3]
+
+	u, err := user.Current()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var uid uint32
+	var unsureOfUID bool
+	if !strings.HasPrefix(u.Uid, wellKnownSIDPrefix) {
+		// the format of the SID isn't supported, fallback to getting
+		// the UID from 'ps'
+		uid, err = getCygwinUIDFromPS()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	} else {
+		// Attempt to get a Cygwin UID from a Windows SID. Details of
+		// UID -> SID mapping here: https://cygwin.com/cygwin-ug-net/ntsec.html
+		sidParts := strings.Split(u.Uid, "-")
+		if len(sidParts) == 4 {
+			// well-known SIDs in the NT_AUTHORITY domain of the S-1-5-RID type
+			u, err := strconv.ParseUint(sidParts[3], 10, 32)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			uid = uint32(u)
+		} else if len(sidParts) == 5 {
+			// other well-known SIDs that aren't groups
+			x, err := strconv.ParseUint(sidParts[3], 10, 32)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			rid, err := strconv.ParseUint(sidParts[4], 10, 32)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			uid = uint32(0x1000*x + rid)
+		} else if len(sidParts) == 8 {
+			// SIDs from the local machine's SAM, the machine's primary
+			// domain, or a trusted domain of the machine's primary domain
+			u, err := strconv.ParseUint(sidParts[7], 10, 32)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			uid = uint32(u)
+			unsureOfUID = true
+		} else {
+			// the format of the SID isn't supported, fallback to getting
+			// the UID from 'ps'
+			uid, err = getCygwinUIDFromPS()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+	}
+
+	// dial socket and complete handshake
+	var conn net.Conn
+	if !unsureOfUID {
+		// we're confident in what the Cygwin UID is, only make one attempt
+		// at establishing a connection
+		conn, err = attemptCygwinHandshake(port, key, uid)
+		if err == nil {
+			return conn, nil
+		}
+	} else {
+		// the Cygwin UID could be built a few different ways; attempt
+		// with all UIDs until one succeeds
+		cygwinRIDNums := []uint32{0x30000, 0x100000, 0x80000000}
+		for _, num := range cygwinRIDNums {
+			conn, err = attemptCygwinHandshake(port, key, num+uid)
+			if err == nil {
+				return conn, nil
+			}
+		}
+
+		// none of those UIDs worked, fallback to getting UID from 'ps'
+		uid, err = getCygwinUIDFromPS()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		conn, err = attemptCygwinHandshake(port, key, uid)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	return conn, nil
+}
+
+// use Cygwin 'ps' binary to get the Cygwin UID of the current user
+func getCygwinUIDFromPS() (uint32, error) {
+	psOutput, err := exec.Command("ps").Output()
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+	psMatches := psLine.FindStringSubmatch(string(psOutput))
+	if len(psMatches) != 2 {
+		return 0, trace.Errorf("UID not found in Cygwin ps output")
+	}
+	uid, err := strconv.ParseUint(psMatches[1], 10, 32)
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	return uint32(uid), nil
+}
+
+// connect to a listening socket of a Cygwin SSH agent and attempt to
+// preform a successful handshake with it. Handshake details here:
+// https://stackoverflow.com/questions/23086038/what-mechanism-is-used-by-msys-cygwin-to-emulate-unix-domain-sockets
+func attemptCygwinHandshake(port, key string, uid uint32) (net.Conn, error) {
+	slog.DebugContext(context.Background(), "[KEY AGENT] attempting a handshake with Cygwin ssh-agent socket", "port", port, "uid", uid)
+
+	conn, err := net.Dial("tcp", "localhost:"+port)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// 1. send hex-decoded GUID in little endian
+	keyBuf := make([]byte, 0, 16)
+	dst := make([]byte, 4)
+	// handle each part of the GUID in order
+	for i := 8; i <= len(key); i += 9 {
+		_, err := hex.Decode(dst, []byte(key)[i-8:i])
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		dst[0], dst[1], dst[2], dst[3] = dst[3], dst[2], dst[1], dst[0]
+		keyBuf = append(keyBuf, dst...)
+	}
+
+	if _, err = conn.Write(keyBuf); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// 2. server echoes the same bytes, read them
+	if _, err = conn.Read(keyBuf); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// 3. send PID, Cygwin UID and Cygwin GID of the calling process
+	pidsUids := make([]byte, 12)
+	pid := os.Getpid()
+	gid := pid // for cygwin's AF_UNIX -> AF_INET, pid = gid
+	binary.LittleEndian.PutUint32(pidsUids, uint32(pid))
+	binary.LittleEndian.PutUint32(pidsUids[4:], uid)
+	binary.LittleEndian.PutUint32(pidsUids[8:], uint32(gid))
+	if _, err = conn.Write(pidsUids); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// 4. server echoes the same bytes, read them
+	if _, err = conn.Read(pidsUids); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return conn, nil
+}
diff --git a/lib/sshagent/doc.go b/lib/sshagent/doc.go
new file mode 100644
index 0000000000000..8e21ffed121b9
--- /dev/null
+++ b/lib/sshagent/doc.go
@@ -0,0 +1,17 @@
+// Copyright 2025 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package sshagent provides methods for connecting to and interfacing
+// with SSH agents, for purposes such as key storage and agent forwarding.
+package sshagent
diff --git a/lib/sshagent/server.go b/lib/sshagent/server.go
new file mode 100644
index 0000000000000..8376a17c22d9c
--- /dev/null
+++ b/lib/sshagent/server.go
@@ -0,0 +1,153 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package sshagent
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"time"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh/agent"
+
+	"github.com/gravitational/teleport/lib/utils"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// Server is an SSH agent server implementation.
+type Server struct {
+	getAgent ClientGetter
+	listener net.Listener
+	Path     string
+	Dir      string
+}
+
+// NewServer returns a new [Server].
+func NewServer(agentClient ClientGetter) *Server {
+	return &Server{getAgent: agentClient}
+}
+
+func (a *Server) SetListener(l net.Listener) {
+	a.listener = l
+	a.Path = l.Addr().String()
+	a.Dir = filepath.Dir(a.Path)
+}
+
+// ListenUnixSocket starts listening on a new unix socket.
+func (a *Server) ListenUnixSocket(sockDir, sockName string, _ *user.User) error {
+	// Create a temp directory to hold the agent socket.
+	sockDir, err := os.MkdirTemp(os.TempDir(), sockDir+"-")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	sockPath := filepath.Join(sockDir, sockName)
+	l, err := net.Listen("unix", sockPath)
+	if err != nil {
+		a.Close()
+		return trace.Wrap(err)
+	}
+
+	a.SetListener(l)
+	return nil
+}
+
+// Serve starts serving on the listener, assumes that Listen was called before
+func (a *Server) Serve() error {
+	if a.listener == nil {
+		return trace.BadParameter("Serve needs a Listen call first")
+	}
+
+	ctx := context.Background()
+	var tempDelay time.Duration // how long to sleep on accept failure
+	for {
+		conn, err := a.listener.Accept()
+		if err != nil {
+			var neterr net.Error
+			if !errors.As(err, &neterr) {
+				return trace.Wrap(err, "unknown error")
+			}
+			if utils.IsUseOfClosedNetworkError(neterr) {
+				return nil
+			}
+			if !neterr.Timeout() {
+				slog.ErrorContext(ctx, "Got non-timeout error", "error", err)
+				return trace.Wrap(err)
+			}
+			if tempDelay == 0 {
+				tempDelay = 5 * time.Millisecond
+			} else {
+				tempDelay *= 2
+			}
+			if max := 1 * time.Second; tempDelay > max {
+				tempDelay = max
+			}
+			slog.ErrorContext(ctx, "Got timeout error - backing off", "delay_time", tempDelay, "error", err)
+			time.Sleep(tempDelay)
+			continue
+		}
+		tempDelay = 0
+
+		// get an agent instance for serving this conn
+		instance, err := a.getAgent()
+		if err != nil {
+			slog.ErrorContext(ctx, "Failed to get agent", "error", err)
+			return trace.Wrap(err)
+		}
+
+		// serve agent protocol against conn in a
+		// separate goroutine.
+		go func() {
+			defer instance.Close()
+			if err := agent.ServeAgent(instance, conn); err != nil && !errors.Is(err, io.EOF) {
+				slog.ErrorContext(ctx, "Serving agent terminated unexpectedly", "error", err)
+			}
+		}()
+	}
+}
+
+// Close closes listener and stops serving agent
+func (a *Server) Close() error {
+	var errors []error
+	if a.listener != nil {
+		slog.DebugContext(context.Background(), "AgentServer is closing",
+			"listen_addr", logutils.StringerAttr(a.listener.Addr()),
+		)
+		if err := a.listener.Close(); err != nil {
+			errors = append(errors, trace.ConvertSystemError(err))
+		}
+	}
+	if a.Path != "" {
+		if err := os.Remove(a.Path); err != nil {
+			errors = append(errors, trace.ConvertSystemError(err))
+		}
+	}
+	if a.Dir != "" {
+		if err := os.RemoveAll(a.Dir); err != nil {
+			errors = append(errors, trace.ConvertSystemError(err))
+		}
+	}
+	return trace.NewAggregate(errors...)
+}
diff --git a/lib/sshca/identity.go b/lib/sshca/identity.go
index 400a5b37573ae..017516b01bce0 100644
--- a/lib/sshca/identity.go
+++ b/lib/sshca/identity.go
@@ -28,9 +28,11 @@ import (
 
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
+	"google.golang.org/protobuf/encoding/protojson"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
@@ -66,6 +68,11 @@ type Identity struct {
 
 	// Username is teleport username
 	Username string
+
+	// ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+	// set, the Roles field must not be set.
+	ScopePin *scopesv1.Pin
+
 	// Impersonator is set when a user requests certificate for another user
 	Impersonator string
 	// PermitX11Forwarding permits X11 forwarding for this cert
@@ -116,6 +123,8 @@ type Identity struct {
 	// BotInstanceID is the unique identifier for the bot instance, if this is a
 	// Machine ID bot. It is empty for human users.
 	BotInstanceID string
+	// JoinToken is the name of the join token used by the bot to join, if any.
+	JoinToken string
 	// AllowedResourceIDs lists the resources the user should be able to access.
 	AllowedResourceIDs []types.ResourceID
 	// ConnectionDiagnosticID references the ConnectionDiagnostic that we should use to append traces when testing a Connection.
@@ -135,6 +144,8 @@ type Identity struct {
 	// GitHubUsername indicates the GitHub username identified by the GitHub
 	// connector.
 	GitHubUsername string
+	// AgentScope is the scope this identity belongs to.
+	AgentScope string
 }
 
 // Encode encodes the identity into an ssh certificate. Note that the returned certificate is incomplete
@@ -178,8 +189,20 @@ func (i *Identity) Encode(certFormat string) (*ssh.Certificate, error) {
 		cert.Permissions.Extensions[utils.CertExtensionAuthority] = i.ClusterName
 	}
 
+	if i.AgentScope != "" {
+		cert.Permissions.Extensions[teleport.CertExtensionAgentScope] = i.AgentScope
+	}
+
 	// --- user extensions ---
 
+	if i.ScopePin != nil {
+		pin, err := protojson.Marshal(i.ScopePin)
+		if err != nil {
+			return nil, trace.Errorf("failed to marshal scope pin for ssh cert encoding: %w", err)
+		}
+		cert.Permissions.Extensions[teleport.CertExtensionScopePin] = string(pin)
+	}
+
 	if i.PermitX11Forwarding {
 		cert.Permissions.Extensions[teleport.CertExtensionPermitX11Forwarding] = ""
 	}
@@ -216,6 +239,9 @@ func (i *Identity) Encode(certFormat string) (*ssh.Certificate, error) {
 	if i.BotInstanceID != "" {
 		cert.Permissions.Extensions[teleport.CertExtensionBotInstanceID] = i.BotInstanceID
 	}
+	if i.JoinToken != "" {
+		cert.Permissions.Extensions[teleport.CertExtensionJoinToken] = i.JoinToken
+	}
 	if len(i.AllowedResourceIDs) != 0 {
 		requestedResourcesStr, err := types.ResourceIDsToString(i.AllowedResourceIDs)
 		if err != nil {
@@ -332,6 +358,11 @@ func (i *Identity) GetValidBefore() time.Time {
 	return validBefore
 }
 
+// IsBot returns whether this identity belongs to a bot.
+func (id *Identity) IsBot() bool {
+	return id.BotName != ""
+}
+
 // DecodeIdentity decodes an ssh certificate into an identity.
 func DecodeIdentity(cert *ssh.Certificate) (*Identity, error) {
 	ident := &Identity{
@@ -378,6 +409,15 @@ func DecodeIdentity(cert *ssh.Certificate) (*Identity, error) {
 
 	// --- user extensions ---
 
+	if v, ok := takeExtension(teleport.CertExtensionScopePin); ok {
+		var pin scopesv1.Pin
+		if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal([]byte(v), &pin); err != nil {
+			return nil, trace.BadParameter("failed to unmarshal value %q for extension %q as scope pin: %v", v, teleport.CertExtensionScopePin, err)
+		}
+		ident.ScopePin = &pin
+	}
+
+	ident.AgentScope = takeValue(teleport.CertExtensionAgentScope)
 	ident.PermitX11Forwarding = takeBool(teleport.CertExtensionPermitX11Forwarding)
 	ident.PermitAgentForwarding = takeBool(teleport.CertExtensionPermitAgentForwarding)
 	ident.PermitPortForwarding = takeBool(teleport.CertExtensionPermitPortForwarding)
@@ -406,6 +446,7 @@ func DecodeIdentity(cert *ssh.Certificate) (*Identity, error) {
 
 	ident.BotName = takeValue(teleport.CertExtensionBotName)
 	ident.BotInstanceID = takeValue(teleport.CertExtensionBotInstanceID)
+	ident.JoinToken = takeValue(teleport.CertExtensionJoinToken)
 
 	if v, ok := takeExtension(teleport.CertExtensionAllowedResources); ok {
 		resourceIDs, err := types.ResourceIDsFromString(v)
diff --git a/lib/sshca/identity_test.go b/lib/sshca/identity_test.go
index fe42bec5fccad..bbd45db43230f 100644
--- a/lib/sshca/identity_test.go
+++ b/lib/sshca/identity_test.go
@@ -26,8 +26,10 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
+	"google.golang.org/protobuf/testing/protocmp"
 
 	"github.com/gravitational/teleport/api/constants"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/api/utils/keys"
@@ -36,12 +38,20 @@ import (
 
 func TestIdentityConversion(t *testing.T) {
 	ident := &Identity{
-		ValidAfter:              1,
-		ValidBefore:             2,
-		CertType:                ssh.UserCert,
-		ClusterName:             "some-cluster",
-		SystemRole:              types.RoleNode,
-		Username:                "user",
+		ValidAfter:  1,
+		ValidBefore: 2,
+		CertType:    ssh.UserCert,
+		ClusterName: "some-cluster",
+		SystemRole:  types.RoleNode,
+		Username:    "user",
+		ScopePin: &scopesv1.Pin{
+			Scope: "/foo",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/": {
+					Roles: []string{"role1", "role2"},
+				},
+			},
+		},
 		Impersonator:            "impersonator",
 		Principals:              []string{"login1", "login2"},
 		PermitX11Forwarding:     true,
@@ -66,9 +76,10 @@ func TestIdentityConversion(t *testing.T) {
 		Generation:    3,
 		BotName:       "bot",
 		BotInstanceID: "instance",
+		JoinToken:     "join-token",
 		AllowedResourceIDs: []types.ResourceID{{
 			ClusterName:     "cluster",
-			Kind:            types.KindKubePod, // must use a kube resource kind for parsing of sub-resource to work correctly
+			Kind:            "kube:ns:pods", // must use a kube resource kind with ns for parsing of sub-resource to work correctly.
 			Name:            "name",
 			SubResourceName: "sub/sub",
 		}},
@@ -79,6 +90,7 @@ func TestIdentityConversion(t *testing.T) {
 		DeviceCredentialID:     "cred",
 		GitHubUserID:           "github",
 		GitHubUsername:         "ghuser",
+		AgentScope:             "/foo",
 	}
 
 	ignores := []string{
@@ -91,6 +103,12 @@ func TestIdentityConversion(t *testing.T) {
 		"ResourceID.XXX_NoUnkeyedLiteral",
 		"ResourceID.XXX_unrecognized",
 		"ResourceID.XXX_sizecache",
+		"Pin.XXX_NoUnkeyedLiteral",
+		"Pin.XXX_unrecognized",
+		"Pin.XXX_sizecache",
+		"PinnedAssignments.XXX_NoUnkeyedLiteral",
+		"PinnedAssignments.XXX_unrecognized",
+		"PinnedAssignments.XXX_sizecache",
 	}
 
 	require.True(t, testutils.ExhaustiveNonEmpty(ident, ignores...), "empty=%+v", testutils.FindAllEmpty(ident, ignores...))
@@ -101,5 +119,5 @@ func TestIdentityConversion(t *testing.T) {
 	ident2, err := DecodeIdentity(cert)
 	require.NoError(t, err)
 
-	require.Empty(t, cmp.Diff(ident, ident2))
+	require.Empty(t, cmp.Diff(ident, ident2, protocmp.Transform()))
 }
diff --git a/lib/sshca/sshca.go b/lib/sshca/sshca.go
index 95f3c1fb7a17e..dbc22643a3fa1 100644
--- a/lib/sshca/sshca.go
+++ b/lib/sshca/sshca.go
@@ -26,6 +26,7 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/lib/scopes"
 )
 
 // Authority implements minimal key-management facility for generating OpenSSH
@@ -48,9 +49,9 @@ type HostCertificateRequest struct {
 	// PublicHostKey is the public key of the host
 	PublicHostKey []byte
 	// HostID is used by Teleport to uniquely identify a node within a cluster (this is used to help infill
-	// Identity.Princiapals and is not a standalone cert field).
+	// Identity.Principals and is not a standalone cert field).
 	HostID string
-	// NodeName is the DNS name of the node (this is used to help infill Identity.Princiapals and is not a
+	// NodeName is the DNS name of the node (this is used to help infill Identity.Principals and is not a
 	// standalone cert field).
 	NodeName string
 	// TTL defines how long a certificate is valid for
@@ -78,6 +79,11 @@ func (r *HostCertificateRequest) Check() error {
 	if err := r.Identity.SystemRole.Check(); err != nil {
 		return trace.Wrap(err)
 	}
+	if r.Identity.AgentScope != "" {
+		if err := scopes.StrongValidate(r.Identity.AgentScope); err != nil {
+			return trace.Wrap(err)
+		}
+	}
 
 	return nil
 }
@@ -107,6 +113,11 @@ func (r *UserCertificateRequest) CheckAndSetDefaults() error {
 	if len(r.Identity.Principals) == 0 {
 		return trace.BadParameter("ssh user identity missing allowed logins")
 	}
+
+	if r.Identity.ScopePin != nil && len(r.Identity.Roles) != 0 {
+		return trace.BadParameter("ssh user identity cannot have both scope pin and roles set")
+	}
+
 	if r.Identity.ValidBefore != 0 {
 		return trace.BadParameter("ValidBefore should not be set in user cert requests (derived from TTL)")
 	}
diff --git a/lib/sshutils/ctx.go b/lib/sshutils/ctx.go
index 005df55825aec..3adfbe9d25737 100644
--- a/lib/sshutils/ctx.go
+++ b/lib/sshutils/ctx.go
@@ -31,7 +31,6 @@ import (
 	"golang.org/x/crypto/ssh/agent"
 
 	"github.com/gravitational/teleport/lib/sshutils/networking"
-	"github.com/gravitational/teleport/lib/teleagent"
 )
 
 // ConnectionContext manages connection-level state.
@@ -109,16 +108,16 @@ func NewConnectionContext(ctx context.Context, nconn net.Conn, sconn *ssh.Server
 	return ctx, ccx
 }
 
-// agentChannel implements the extended teleteleagent.Agent interface,
-// allowing the underlying ssh.Channel to be closed when the agent
-// is no longer needed.
-type agentChannel struct {
+// AgentChannel implements the [agent.ExtendedAgent] and [io.Closer]
+// interfaces, allowing the underlying ssh.Channel to be closed when
+// the agent is no longer needed.
+type AgentChannel struct {
 	agent.ExtendedAgent
 	ch ssh.Channel
 }
 
 // Close closes the agent channel.
-func (a *agentChannel) Close() error {
+func (a *AgentChannel) Close() error {
 	// For graceful teardown, close the write part of the channel first. This
 	// will send "EOF" packet (type 96) to the other side which will drain and
 	// close the channel.
@@ -139,7 +138,7 @@ func (a *agentChannel) Close() error {
 // StartAgentChannel sets up a new agent forwarding channel against this connection.  The channel
 // is automatically closed when either ConnectionContext, or the supplied context.Context
 // gets canceled.
-func (c *ConnectionContext) StartAgentChannel() (teleagent.Agent, error) {
+func (c *ConnectionContext) StartAgentChannel() (*AgentChannel, error) {
 	// refuse to start an agent if forwardAgent has not yet been set.
 	if !c.GetForwardAgent() {
 		return nil, trace.AccessDenied("agent forwarding has not been requested")
@@ -150,7 +149,7 @@ func (c *ConnectionContext) StartAgentChannel() (teleagent.Agent, error) {
 		return nil, trace.Wrap(err)
 	}
 	go ssh.DiscardRequests(reqC)
-	return &agentChannel{
+	return &AgentChannel{
 		ExtendedAgent: agent.NewClient(ch),
 		ch:            ch,
 	}, nil
diff --git a/lib/sshutils/ctx_test.go b/lib/sshutils/ctx_test.go
index a22acd4babe19..b476bf68cb988 100644
--- a/lib/sshutils/ctx_test.go
+++ b/lib/sshutils/ctx_test.go
@@ -26,7 +26,7 @@ import (
 )
 
 func TestAgentChannelClose(t *testing.T) {
-	aChannel := agentChannel{
+	aChannel := AgentChannel{
 		ch: &mockChannel{
 			ReadWriter: fakeReaderWriter{},
 		},
diff --git a/lib/sshutils/networking/networking.go b/lib/sshutils/networking/networking.go
index c91b3241607d0..86457ae0c5b6d 100644
--- a/lib/sshutils/networking/networking.go
+++ b/lib/sshutils/networking/networking.go
@@ -123,9 +123,6 @@ func NewProcess(ctx context.Context, cmd *exec.Cmd) (*Process, error) {
 	defer remoteFD.Close()
 	cmd.ExtraFiles = append(cmd.ExtraFiles, remoteFD)
 
-	// Propagate stderr from the spawned Teleport process to log any errors.
-	cmd.Stderr = os.Stderr
-
 	proc := &Process{
 		cmd:  cmd,
 		conn: localConn,
diff --git a/lib/sshutils/scp/scp_test.go b/lib/sshutils/scp/scp_test.go
index 820b6807df41b..826ac9bdde35b 100644
--- a/lib/sshutils/scp/scp_test.go
+++ b/lib/sshutils/scp/scp_test.go
@@ -36,10 +36,11 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -49,7 +50,7 @@ func TestSend(t *testing.T) {
 	atime := testNow.Add(1 * time.Second)
 	dirModtime := testNow.Add(2 * time.Second)
 	dirAtime := testNow.Add(3 * time.Second)
-	logger := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "send")
+	logger := logtest.With(teleport.ComponentKey, "send")
 	testCases := []struct {
 		desc   string
 		config Config
@@ -113,7 +114,7 @@ func TestReceive(t *testing.T) {
 	atime := testNow.Add(1 * time.Second)
 	dirModtime := testNow.Add(2 * time.Second)
 	dirAtime := testNow.Add(3 * time.Second)
-	logger := utils.NewSlogLoggerForTests().With(teleport.ComponentKey, "recv")
+	logger := logtest.With(teleport.ComponentKey, "recv")
 	testCases := []struct {
 		desc       string
 		config     Config
@@ -236,7 +237,7 @@ func TestSCPFailsIfNoSource(t *testing.T) {
 //
 // See https://github.com/gravitational/teleport/issues/5497
 func TestReceiveIntoExistingDirectory(t *testing.T) {
-	logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+	logger := logtest.With("test", t.Name())
 	config := newTargetConfigWithFS("dir",
 		Flags{PreserveAttrs: true, Recursive: true},
 		newTestFS(logger, newDir("dir")),
@@ -279,7 +280,7 @@ func TestReceiveIntoExistingDirectory(t *testing.T) {
 //
 // See https://github.com/gravitational/teleport/issues/5695
 func TestReceiveIntoNonExistingDirectoryFailsWithCorrectMessage(t *testing.T) {
-	logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+	logger := logtest.With("test", t.Name())
 	// Target configuration with no existing directory
 	root := t.TempDir()
 	config := newTargetConfigWithFS(filepath.Join(root, "dir"),
@@ -307,7 +308,7 @@ func TestReceiveIntoNonExistingDirectoryFailsWithCorrectMessage(t *testing.T) {
 // TestCopyIntoNestedNonExistingDirectoriesDoesNotCreateIntermediateDirectories validates that copying a directory
 // into a remote '/path/to/remote' where '/path/to' does not exist causes an error.
 func TestCopyIntoNestedNonExistingDirectoriesDoesNotCreateIntermediateDirectories(t *testing.T) {
-	logger := utils.NewSlogLoggerForTests().With("test", t.Name())
+	logger := logtest.With("test", t.Name())
 
 	config := newTargetConfig("non-existing/remote_dir", Flags{Recursive: true})
 	sourceFS := newTestFS(logger, newDir("dir"))
diff --git a/lib/sshutils/server.go b/lib/sshutils/server.go
index 2d8f7cb85d4bc..6f73ffbfd61df 100644
--- a/lib/sshutils/server.go
+++ b/lib/sshutils/server.go
@@ -92,7 +92,7 @@ type Server struct {
 	// they are a valid certificate. Used in tests.
 	insecureSkipHostValidation bool
 
-	// fips means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// fips means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	fips bool
 
diff --git a/lib/sshutils/server_test.go b/lib/sshutils/server_test.go
index 7b95d3ced55c0..27c8ae34d644e 100644
--- a/lib/sshutils/server_test.go
+++ b/lib/sshutils/server_test.go
@@ -33,10 +33,11 @@ import (
 
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/cert"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/sshutils/sftp/http.go b/lib/sshutils/sftp/http.go
index 33f5bc60c0b9c..806afb2a67168 100644
--- a/lib/sshutils/sftp/http.go
+++ b/lib/sshutils/sftp/http.go
@@ -34,13 +34,11 @@ import (
 	"github.com/gravitational/teleport/lib/httplib"
 )
 
-type contextKey string
-
 const (
-	// ModeratedSessionID is an optional parameter sent during SCP requests to specify which moderated session
+	// EnvModeratedSessionID is an optional env var parameter sent during SCP requests to specify which moderated session
 	// to check for valid FileTransferRequests
 	// used as a value in the file transfer context and env var for exec session
-	ModeratedSessionID contextKey = "TELEPORT_MODERATED_SESSION_ID"
+	EnvModeratedSessionID = "TELEPORT_MODERATED_SESSION_ID"
 )
 
 var errDirsNotSupported = trace.BadParameter("directories are not supported when transferring files over HTTP")
@@ -173,6 +171,17 @@ func (h *httpFS) Getwd() (string, error) {
 	return "", nil
 }
 
+func (h *httpFS) RealPath(path string) (string, error) {
+	return path, nil
+}
+
+func (h *httpFS) Close() error {
+	if h.reader != nil {
+		return trace.Wrap(h.reader.Close())
+	}
+	return nil
+}
+
 type nopWriteCloser struct {
 	io.Writer
 }
diff --git a/lib/sshutils/sftp/local.go b/lib/sshutils/sftp/local.go
index e738c63949605..fcfc88f9d744e 100644
--- a/lib/sshutils/sftp/local.go
+++ b/lib/sshutils/sftp/local.go
@@ -54,11 +54,11 @@ func (l localFS) ReadDir(path string) ([]os.FileInfo, error) {
 		if err != nil {
 			return nil, err
 		}
-		// if the file is a symlink, return the info of the linked file
-		if info.Mode().Type()&os.ModeSymlink != 0 {
-			info, err = os.Stat(filepath.Join(path, info.Name()))
-			if err != nil {
-				return nil, err
+		// If the file is a valid symlink, return the info of the linked file.
+		if info.Mode()&os.ModeSymlink != 0 {
+			resolvedInfo, err := os.Stat(filepath.Join(path, info.Name()))
+			if err == nil {
+				info = resolvedInfo
 			}
 		}
 
@@ -142,3 +142,21 @@ func (l localFS) Readlink(name string) (string, error) {
 func (l localFS) Getwd() (string, error) {
 	return os.Getwd()
 }
+
+func (l localFS) RealPath(path string) (string, error) {
+	return Realpath(path)
+}
+
+func (l localFS) Close() error {
+	return nil
+}
+
+// RealPath canonicalizes a path name, including resolving ".." and
+// following symlinks.
+func Realpath(path string) (string, error) {
+	path, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	return filepath.EvalSymlinks(path)
+}
diff --git a/lib/sshutils/sftp/local_test.go b/lib/sshutils/sftp/local_test.go
new file mode 100644
index 0000000000000..3735c6deab0f1
--- /dev/null
+++ b/lib/sshutils/sftp/local_test.go
@@ -0,0 +1,84 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package sftp
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRealpath(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	dir := filepath.Join(root, "a")
+	require.NoError(t, os.Mkdir(dir, 0o755))
+	file := filepath.Join(dir, "foo.txt")
+	require.NoError(t, os.WriteFile(file, []byte("foo"), 0o644))
+	symlink := filepath.Join(dir, "sym")
+	require.NoError(t, os.Symlink(root, symlink))
+
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+	fileRelativeToHere, err := filepath.Rel(wd, file)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name     string
+		path     string
+		expected string
+	}{
+		{
+			name:     "absolute path",
+			path:     file,
+			expected: file,
+		},
+		{
+			name:     "relative path",
+			path:     fileRelativeToHere,
+			expected: file,
+		},
+		{
+			name:     "follow symlink",
+			path:     filepath.Join(symlink, "a", "foo.txt"),
+			expected: file,
+		},
+		{
+			name:     "current dir",
+			path:     ".",
+			expected: wd,
+		},
+		{
+			name:     "empty",
+			path:     "",
+			expected: wd,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// On Mac, temp dirs are under an extra hidden /private dir.
+			expected, err := filepath.EvalSymlinks(tc.expected)
+			require.NoError(t, err)
+			out, err := Realpath(tc.path)
+			assert.NoError(t, err)
+			assert.Equal(t, expected, out)
+		})
+	}
+}
diff --git a/lib/sshutils/sftp/parse.go b/lib/sshutils/sftp/parse.go
index eefa0ad30cf82..2ee6652fa9ba6 100644
--- a/lib/sshutils/sftp/parse.go
+++ b/lib/sshutils/sftp/parse.go
@@ -19,6 +19,10 @@
 package sftp
 
 import (
+	"net"
+	"os"
+	"regexp"
+	"strconv"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -26,12 +30,12 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-// Destination is a remote SFTP destination to copy to or from.
-type Destination struct {
-	// Login is an optional login username
+// Target is an SFTP destination to copy to or from.
+type Target struct {
+	// Login is a login username.
 	Login string
-	// Host is a host to copy to/from
-	Host *utils.NetAddr
+	// Addr is the host and port to copy to/from. If nil, target is a local path.
+	Addr *utils.NetAddr
 	// Path is a path to copy to/from.
 	// An empty path name is valid, and it refers to the user's default directory (usually
 	// the user's home directory).
@@ -39,23 +43,65 @@ type Destination struct {
 	Path string
 }
 
-// ParseDestination takes a string representing a remote resource for SFTP
-// to download/upload in the form "[user@]host:[path]" and parses it into
+// AddrString gets the target address, or the empty string if not set.
+func (t Target) AddrString() string {
+	if t.Addr != nil {
+		return t.Addr.String()
+	}
+	return ""
+}
+
+var windowsDrivePattern = regexp.MustCompile(`^[A-Z]:\\`)
+
+// IsRemotePath checks if a path refers to a location on a remote host.
+func IsRemotePath(input string) bool {
+	// Windows paths are always local; check here so we don't confuse the drive
+	// name for a host.
+	if windowsDrivePattern.MatchString(input) {
+		return false
+	}
+	colonIndex := strings.Index(input, ":")
+	if colonIndex == -1 {
+		// Can't be remote without a colon.
+		return false
+	}
+	slashIndex := strings.Index(input, string(os.PathSeparator))
+	// On Unix, colons are valid in path names, so check if the first colon is
+	// part of the path.
+	//
+	// If we get something like "foo:bar", we have no way to tell if that's local
+	// path "foo:bar" or remote path "bar" on host "foo". We'll assume it's the
+	// host:path variant, as the other can also be written as "./foo:bar".
+	return slashIndex == -1 || colonIndex < slashIndex
+}
+
+// ParseTarget takes a string representing a resource for SFTP
+// to download/upload in the form "[[user@]host:]path" and parses it into
 // a structured form.
 //
+// Examples of valid targets:
+//   - "/abs/or/rel/path"
+//   - "host:/abs/or/rel/path"
+//   - "user@host:/abs/or/rel/path"
+//
 // See https://tools.ietf.org/html/draft-ietf-secsh-filexfer-09#page-14, 'File Names'
 // section about details on file names.
-func ParseDestination(input string) (*Destination, error) {
-	firstColonIdx := strings.Index(input, ":")
-	// if there are no colons, no path is specified
-	if firstColonIdx == -1 {
-		return nil, trace.BadParameter("%q is missing a path, use form [user@]host:[path]", input)
+func ParseTarget(input string, port int) (Target, error) {
+	if !IsRemotePath(input) {
+		if !strings.Contains(input, "@") {
+			return Target{
+				Path: input,
+			}, nil
+		}
+		// user@host, this is missing a path.
+		return Target{}, trace.BadParameter("%q is missing a path, use form [[user@]host:]path", input)
 	}
+	firstColonIdx := strings.Index(input, ":")
 	hostStartIdx := strings.LastIndex(input[:firstColonIdx], "@")
 	// if a login exists and the path begins right after the login ends,
 	// no host is specified
 	if hostStartIdx != -1 && hostStartIdx+1 == firstColonIdx {
-		return nil, trace.BadParameter("%q is missing a host, use form [user@]host:[path]", input)
+		return Target{}, trace.BadParameter("%q is missing a host, use form [[user@]host:]path", input)
 	}
 
 	var login string
@@ -81,7 +127,7 @@ func ParseDestination(input string) (*Destination, error) {
 	if afterLogin[0] == '[' {
 		ipv6Host, hostEndIdx, err := parseIPv6Host(input, hostStartIdx)
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return Target{}, trace.Wrap(err)
 		}
 		if ipv6Host != nil {
 			host = ipv6Host
@@ -94,9 +140,11 @@ func ParseDestination(input string) (*Destination, error) {
 		var err error
 		host, err = utils.ParseAddr(input[hostStartIdx:firstColonIdx])
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return Target{}, trace.Wrap(err)
 		}
 	}
+	// Add port. Trim brackets first for ipv6 addresses as JoinHostPort will re-add them.
+	host.Addr = net.JoinHostPort(strings.Trim(host.Host(), "[]"), strconv.Itoa(port))
 
 	// if there is nothing after the host the path defaults to "."
 	path := "."
@@ -104,9 +152,9 @@ func ParseDestination(input string) (*Destination, error) {
 		path = input[pathStartIdx:]
 	}
 
-	return &Destination{
+	return Target{
 		Login: login,
-		Host:  host,
+		Addr:  host,
 		Path:  path,
 	}, nil
 }
@@ -128,7 +176,7 @@ func parseIPv6Host(input string, start int) (*utils.NetAddr, int, error) {
 	}
 	// if there's nothing after ']' then the path is missing
 	if len(hostStr) <= rbraceIdx+2 {
-		return nil, 0, trace.BadParameter("%q is missing a path, use form [user@]host:[path]", input)
+		return nil, 0, trace.BadParameter("%q is missing a path, use form [[user@]host:]path", input)
 	}
 
 	maybeAddr := hostStr[:rbraceIdx+1]
@@ -141,3 +189,49 @@ func parseIPv6Host(input string, start int) (*utils.NetAddr, int, error) {
 	// (including the trailing ']') and a ':'
 	return host, start + rbraceIdx + 1 + 1, nil
 }
+
+// Sources is a list of paths to copy from either a local or remote host.
+type Sources struct {
+	// Login is a login username.
+	Login string
+	// Addr is the host and port to copy to/from. If nil, target is a local path.
+	Addr *utils.NetAddr
+	// Paths are the paths to copy from.
+	Paths []string
+}
+
+// AddrString gets the target address, or the empty string if not set.
+func (s Sources) AddrString() string {
+	if s.Addr != nil {
+		return s.Addr.String()
+	}
+	return ""
+}
+
+// ParseSources parses a list of strings representing resources for SFTP to
+// download into a structured form (same format as [ParseTarget]).
+func ParseSources(rawSources []string, port int) (Sources, error) {
+	if len(rawSources) == 0 {
+		return Sources{}, trace.BadParameter("at least one source required")
+	}
+	firstSource, err := ParseTarget(rawSources[0], port)
+	if err != nil {
+		return Sources{}, trace.Wrap(err)
+	}
+	sources := Sources{
+		Login: firstSource.Login,
+		Addr:  firstSource.Addr,
+		Paths: []string{firstSource.Path},
+	}
+	for _, rawSource := range rawSources[1:] {
+		source, err := ParseTarget(rawSource, port)
+		if err != nil {
+			return Sources{}, trace.Wrap(err)
+		}
+		if source.Login != sources.Login || source.AddrString() != sources.AddrString() {
+			return Sources{}, trace.BadParameter("sources must all have the same user and host")
+		}
+		sources.Paths = append(sources.Paths, source.Path)
+	}
+	return sources, nil
+}
diff --git a/lib/sshutils/sftp/parse_test.go b/lib/sshutils/sftp/parse_test.go
index bdab9cafc997c..f34292f6b168a 100644
--- a/lib/sshutils/sftp/parse_test.go
+++ b/lib/sshutils/sftp/parse_test.go
@@ -23,6 +23,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/utils"
@@ -31,16 +32,16 @@ import (
 var parseTestCases = []struct {
 	name     string
 	in       string
-	dest     Destination
+	dest     Target
 	errCheck require.ErrorAssertionFunc
 }{
 	{
 		name: "full spec of the remote destination",
 		in:   "root@remote.host:/etc/nginx.conf",
-		dest: Destination{
+		dest: Target{
 			Login: "root",
-			Host: &utils.NetAddr{
-				Addr:        "remote.host",
+			Addr: &utils.NetAddr{
+				Addr:        "remote.host:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/etc/nginx.conf",
@@ -49,9 +50,9 @@ var parseTestCases = []struct {
 	{
 		name: "spec with just the remote host",
 		in:   "remote.host:/etc/nginx.co:nf",
-		dest: Destination{
-			Host: &utils.NetAddr{
-				Addr:        "remote.host",
+		dest: Target{
+			Addr: &utils.NetAddr{
+				Addr:        "remote.host:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/etc/nginx.co:nf",
@@ -60,9 +61,9 @@ var parseTestCases = []struct {
 	{
 		name: "ipv6 remote destination address",
 		in:   "[::1]:/etc/nginx.co:nf",
-		dest: Destination{
-			Host: &utils.NetAddr{
-				Addr:        "[::1]",
+		dest: Target{
+			Addr: &utils.NetAddr{
+				Addr:        "[::1]:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/etc/nginx.co:nf",
@@ -71,10 +72,10 @@ var parseTestCases = []struct {
 	{
 		name: "full spec of the remote destination using ipv4 address",
 		in:   "root@123.123.123.123:/var/www/html/",
-		dest: Destination{
+		dest: Target{
 			Login: "root",
-			Host: &utils.NetAddr{
-				Addr:        "123.123.123.123",
+			Addr: &utils.NetAddr{
+				Addr:        "123.123.123.123:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/var/www/html/",
@@ -83,10 +84,10 @@ var parseTestCases = []struct {
 	{
 		name: "target location using wildcard",
 		in:   "myusername@myremotehost.com:/home/hope/*",
-		dest: Destination{
+		dest: Target{
 			Login: "myusername",
-			Host: &utils.NetAddr{
-				Addr:        "myremotehost.com",
+			Addr: &utils.NetAddr{
+				Addr:        "myremotehost.com:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/home/hope/*",
@@ -95,10 +96,10 @@ var parseTestCases = []struct {
 	{
 		name: "complex login",
 		in:   "complex@example.com@remote.com:/anything.txt",
-		dest: Destination{
+		dest: Target{
 			Login: "complex@example.com",
-			Host: &utils.NetAddr{
-				Addr:        "remote.com",
+			Addr: &utils.NetAddr{
+				Addr:        "remote.com:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/anything.txt",
@@ -107,10 +108,10 @@ var parseTestCases = []struct {
 	{
 		name: "implicit user's home directory",
 		in:   "root@remote.host:",
-		dest: Destination{
+		dest: Target{
 			Login: "root",
-			Host: &utils.NetAddr{
-				Addr:        "remote.host",
+			Addr: &utils.NetAddr{
+				Addr:        "remote.host:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: ".",
@@ -119,9 +120,9 @@ var parseTestCases = []struct {
 	{
 		name: "no login and '@' in path",
 		in:   "remote.host:/some@file",
-		dest: Destination{
-			Host: &utils.NetAddr{
-				Addr:        "remote.host",
+		dest: Target{
+			Addr: &utils.NetAddr{
+				Addr:        "remote.host:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/some@file",
@@ -130,9 +131,9 @@ var parseTestCases = []struct {
 	{
 		name: "no login, '@' and ':' in path",
 		in:   "remote.host:/some@remote:file",
-		dest: Destination{
-			Host: &utils.NetAddr{
-				Addr:        "remote.host",
+		dest: Target{
+			Addr: &utils.NetAddr{
+				Addr:        "remote.host:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/some@remote:file",
@@ -141,10 +142,10 @@ var parseTestCases = []struct {
 	{
 		name: "complex login, IPv6 addr and ':' in path",
 		in:   "complex@user@[::1]:/remote:file",
-		dest: Destination{
+		dest: Target{
 			Login: "complex@user",
-			Host: &utils.NetAddr{
-				Addr:        "[::1]",
+			Addr: &utils.NetAddr{
+				Addr:        "[::1]:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/remote:file",
@@ -153,10 +154,10 @@ var parseTestCases = []struct {
 	{
 		name: "filename with timestamp",
 		in:   "user@server.com:/tmp/user-2022-03-10T09:49:23-98cd2a03/file.txt",
-		dest: Destination{
+		dest: Target{
 			Login: "user",
-			Host: &utils.NetAddr{
-				Addr:        "server.com",
+			Addr: &utils.NetAddr{
+				Addr:        "server.com:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "/tmp/user-2022-03-10T09:49:23-98cd2a03/file.txt",
@@ -165,10 +166,10 @@ var parseTestCases = []struct {
 	{
 		name: "filename with '@' suffix",
 		in:   "user@server:file@",
-		dest: Destination{
+		dest: Target{
 			Login: "user",
-			Host: &utils.NetAddr{
-				Addr:        "server",
+			Addr: &utils.NetAddr{
+				Addr:        "server:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "file@",
@@ -177,10 +178,10 @@ var parseTestCases = []struct {
 	{
 		name: "filename with IPv6 address",
 		in:   "user@server:file[::1]name",
-		dest: Destination{
+		dest: Target{
 			Login: "user",
-			Host: &utils.NetAddr{
-				Addr:        "server",
+			Addr: &utils.NetAddr{
+				Addr:        "server:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "file[::1]name",
@@ -189,10 +190,10 @@ var parseTestCases = []struct {
 	{
 		name: "IPv6 address and filename with IPv6 address",
 		in:   "user@[::1]:file[::1]name",
-		dest: Destination{
+		dest: Target{
 			Login: "user",
-			Host: &utils.NetAddr{
-				Addr:        "[::1]",
+			Addr: &utils.NetAddr{
+				Addr:        "[::1]:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "file[::1]name",
@@ -201,27 +202,34 @@ var parseTestCases = []struct {
 	{
 		name: "IPv6 address and filename with IPv6 address and '@'s",
 		in:   "user@[::1]:file@[::1]@name",
-		dest: Destination{
+		dest: Target{
 			Login: "user",
-			Host: &utils.NetAddr{
-				Addr:        "[::1]",
+			Addr: &utils.NetAddr{
+				Addr:        "[::1]:8080",
 				AddrNetwork: "tcp",
 			},
 			Path: "file@[::1]@name",
 		},
 	},
+	{
+		name: "path only",
+		in:   "path/to/somewhere",
+		dest: Target{
+			Path: "path/to/somewhere",
+		},
+	},
 	{
 		name: "missing path",
 		in:   "user@server",
-		errCheck: func(t require.TestingT, err error, i ...interface{}) {
-			require.EqualError(t, err, fmt.Sprintf("%q is missing a path, use form [user@]host:[path]", i[0]))
+		errCheck: func(t require.TestingT, err error, i ...any) {
+			require.EqualError(t, err, fmt.Sprintf("%q is missing a path, use form [[user@]host:]path", i[0]))
 		},
 	},
 	{
 		name: "missing host",
 		in:   "user@:/foo",
-		errCheck: func(t require.TestingT, err error, i ...interface{}) {
-			require.EqualError(t, err, fmt.Sprintf("%q is missing a host, use form [user@]host:[path]", i[0]))
+		errCheck: func(t require.TestingT, err error, i ...any) {
+			require.EqualError(t, err, fmt.Sprintf("%q is missing a host, use form [[user@]host:]path", i[0]))
 		},
 	},
 	{
@@ -241,21 +249,21 @@ var parseTestCases = []struct {
 	{
 		name: "missing path with IPv6 addr",
 		in:   "[user]@[::1]",
-		errCheck: func(t require.TestingT, err error, i ...interface{}) {
-			require.EqualError(t, err, fmt.Sprintf("%q is missing a path, use form [user@]host:[path]", i[0]))
+		errCheck: func(t require.TestingT, err error, i ...any) {
+			require.EqualError(t, err, fmt.Sprintf("%q is missing a path, use form [[user@]host:]path", i[0]))
 		},
 	},
 }
 
-func TestParseDestination(t *testing.T) {
+func TestParseTarget(t *testing.T) {
 	t.Parallel()
 
 	for _, tt := range parseTestCases {
 		t.Run(tt.name, func(t *testing.T) {
-			resp, err := ParseDestination(tt.in)
+			resp, err := ParseTarget(tt.in, 8080)
 			if tt.errCheck == nil {
 				require.NoError(t, err)
-				require.Empty(t, cmp.Diff(resp, &tt.dest))
+				require.Empty(t, cmp.Diff(resp, tt.dest))
 			} else {
 				tt.errCheck(t, err, tt.in)
 			}
@@ -263,12 +271,121 @@ func TestParseDestination(t *testing.T) {
 	}
 }
 
-func FuzzParseDestination(f *testing.F) {
+func FuzzParseTarget(f *testing.F) {
 	for _, tt := range parseTestCases {
 		f.Add(tt.in)
 	}
 
 	f.Fuzz(func(t *testing.T, input string) {
-		_, _ = ParseDestination(input)
+		_, _ = ParseTarget(input, 8080)
 	})
 }
+
+func TestParseSources(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name            string
+		inputSources    []string
+		assert          assert.ErrorAssertionFunc
+		expectedSources Sources
+	}{
+		{
+			name:         "ok one source",
+			inputSources: []string{"alice@foo:/path/to/thing"},
+			assert:       assert.NoError,
+			expectedSources: Sources{
+				Login: "alice",
+				Addr:  utils.MustParseAddr("foo:8080"),
+				Paths: []string{"/path/to/thing"},
+			},
+		},
+		{
+			name:         "ok multiple sources",
+			inputSources: []string{"alice@foo:/path/one", "alice@foo:/path/two"},
+			assert:       assert.NoError,
+			expectedSources: Sources{
+				Login: "alice",
+				Addr:  utils.MustParseAddr("foo:8080"),
+				Paths: []string{"/path/one", "/path/two"},
+			},
+		},
+		{
+			name:   "no sources",
+			assert: assert.Error,
+		},
+		{
+			name:         "sources from different hosts",
+			inputSources: []string{"alice@foo:/path", "/local/path"},
+			assert:       assert.Error,
+		},
+		{
+			name:         "sources with different logins",
+			inputSources: []string{"alice@foo:/path/one", "bob@foo:/path/two"},
+			assert:       assert.Error,
+		},
+	}
+	for _, tc := range tests {
+		sources, err := ParseSources(tc.inputSources, 8080)
+		tc.assert(t, err)
+		assert.Equal(t, tc.expectedSources, sources)
+	}
+}
+
+func TestIsRemotePath(t *testing.T) {
+	t.Parallel()
+	accept := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "remote path",
+			input: "foo:path/to/bar",
+		},
+		{
+			name:  "remote path with user",
+			input: "user@foo:/path/to/bar",
+		},
+		{
+			name:  "empty path",
+			input: "foo:",
+		},
+		{
+			name:  "remote with no slashes",
+			input: "foo:bar",
+		},
+		{
+			name:  "fake Windows path",
+			input: `foo:\valid\unix\file\name\weirdly`,
+		},
+	}
+	for _, tc := range accept {
+		t.Run("accept "+tc.name, func(t *testing.T) {
+			require.True(t, IsRemotePath(tc.input))
+		})
+	}
+	reject := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "local path",
+			input: "path/to/bar",
+		},
+		{
+			name:  "Windows absolute path",
+			input: `C:\path\to\bar`,
+		},
+		{
+			name:  "local path with colon",
+			input: "/foo:bar",
+		},
+		{
+			name: "empty path",
+		},
+	}
+	for _, tc := range reject {
+		t.Run("reject "+tc.name, func(t *testing.T) {
+			require.False(t, IsRemotePath(tc.input))
+		})
+	}
+}
diff --git a/lib/sshutils/sftp/remote.go b/lib/sshutils/sftp/remote.go
index 272045fad7f6a..d1108c3fb4dc4 100644
--- a/lib/sshutils/sftp/remote.go
+++ b/lib/sshutils/sftp/remote.go
@@ -19,16 +19,24 @@
 package sftp
 
 import (
+	"context"
+	"io"
 	"os"
 	portablepath "path"
+	"strings"
 
+	"github.com/gravitational/trace"
 	"github.com/pkg/sftp"
+
+	"github.com/gravitational/teleport"
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 )
 
 // RemoteFS provides API for accessing the files on
 // the local file system
 type RemoteFS struct {
 	*sftp.Client
+	session io.Closer
 }
 
 // NewRemoteFilesystem creates a new FileSystem over SFTP.
@@ -36,6 +44,67 @@ func NewRemoteFilesystem(c *sftp.Client) *RemoteFS {
 	return &RemoteFS{Client: c}
 }
 
+// OpenRemoteFilesystem opens a new remote file system on the given ssh client.
+func OpenRemoteFilesystem(ctx context.Context, sshClient *tracessh.Client, moderatedSessionID string) (fs *RemoteFS, openErr error) {
+	s, err := sshClient.NewSession(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer func() {
+		if openErr != nil {
+			s.Close()
+		}
+	}()
+
+	// File transfers in a moderated session require this variable
+	// to check for approval on the ssh server
+	// TODO(Joerger): DELETE IN v20.0.0 - moderated session ID is provided
+	// in the session channel params above instead of indirectly through env vars.
+	if moderatedSessionID != "" {
+		s.Setenv(ctx, EnvModeratedSessionID, moderatedSessionID)
+	}
+
+	pe, err := s.StderrPipe()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := s.RequestSubsystem(ctx, teleport.SFTPSubsystem); err != nil {
+		// If the subsystem request failed and a generic error is
+		// returned, return the session's stderr as the error if it's
+		// non-empty, as the session's stderr may have a more useful
+		// error message. String comparison is only used here because
+		// the error is not exported.
+		if strings.Contains(err.Error(), "ssh: subsystem request failed") {
+			var sb strings.Builder
+			if n, _ := io.Copy(&sb, pe); n > 0 {
+				return nil, trace.Errorf("%s", sb.String())
+			}
+		}
+		return nil, trace.Wrap(err)
+	}
+	pw, err := s.StdinPipe()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	pr, err := s.StdoutPipe()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sftpClient, err := sftp.NewClientPipe(pr, pw,
+		// Use concurrent stream to speed up transfer on slow networks as described in
+		// https://github.com/gravitational/teleport/issues/20579
+		sftp.UseConcurrentReads(true),
+		sftp.UseConcurrentWrites(true),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &RemoteFS{
+		Client:  sftpClient,
+		session: s,
+	}, nil
+}
+
 func (r *RemoteFS) Type() string {
 	return "remote"
 }
@@ -46,11 +115,11 @@ func (r *RemoteFS) ReadDir(path string) ([]os.FileInfo, error) {
 		return nil, err
 	}
 	for i := range fileInfos {
-		// if the file is a symlink, return the info of the linked file
-		if fileInfos[i].Mode().Type()&os.ModeSymlink != 0 {
-			fileInfos[i], err = r.Stat(portablepath.Join(path, fileInfos[i].Name()))
-			if err != nil {
-				return nil, err
+		// If the file is a valid symlink, return the info of the linked file.
+		if fileInfos[i].Mode()&os.ModeSymlink != 0 {
+			resolvedInfo, err := r.Stat(portablepath.Join(path, fileInfos[i].Name()))
+			if err == nil {
+				fileInfos[i] = resolvedInfo
 			}
 		}
 	}
@@ -77,3 +146,11 @@ func (r *RemoteFS) Mkdir(path string) error {
 func (r *RemoteFS) Readlink(name string) (string, error) {
 	return r.Client.ReadLink(name)
 }
+
+func (r *RemoteFS) Close() error {
+	var sessionErr error
+	if r.session != nil {
+		sessionErr = r.session.Close()
+	}
+	return trace.NewAggregate(sessionErr, r.Client.Close())
+}
diff --git a/lib/sshutils/sftp/sftp.go b/lib/sshutils/sftp/sftp.go
index 69b1146ba23e8..1caa048cf5da1 100644
--- a/lib/sshutils/sftp/sftp.go
+++ b/lib/sshutils/sftp/sftp.go
@@ -20,7 +20,6 @@
 package sftp
 
 import (
-	"cmp"
 	"context"
 	"errors"
 	"fmt"
@@ -38,9 +37,9 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/pkg/sftp"
 	"github.com/schollz/progressbar/v3"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/sshutils/scp"
 )
@@ -77,32 +76,69 @@ const (
 	MethodReadlink = "Readlink"
 )
 
-// Options control aspects of a file transfer
-type Options struct {
-	// Recursive indicates recursive file transfer
+// FileTransferRequest holds the settings for an SFTP file transfer.
+type FileTransferRequest struct {
+	// Sources is the source paths, local or remtoe.
+	Sources Sources
+	// Destination is the destination path, local or remote.
+	Destination Target
+	// DialHost opens an SSH client to the given address.
+	DialHost func(ctx context.Context, login, addr string) (*tracessh.Client, error)
+	// Recursive indicates recursive file transfer.
 	Recursive bool
 	// PreserveAttrs preserves access and modification times
-	// from the original file
+	// from the original file.
 	PreserveAttrs bool
-	// Quiet indicates whether progress should be displayed.
-	Quiet bool
 	// ProgressWriter is used to write the progress output.
 	ProgressWriter io.Writer
-}
-
-// Config describes the settings of a file transfer
-type Config struct {
-	srcPaths []string
-	dstPath  string
-	srcFS    FileSystem
-	dstFS    FileSystem
-	opts     Options
-
 	// ProgressStream is a callback to return a read/writer for printing the progress
 	// (used only on the client)
 	ProgressStream func(fileInfo os.FileInfo) io.ReadWriter
 	// Log optionally specifies the logger
 	Log *slog.Logger
+	// HTTPReader is a reader for downloads from an HTTP server.
+	HTTPReader io.ReadCloser
+	// HTTPWriter is a writer for uploads to an HTTP server.
+	HTTPWriter http.ResponseWriter
+	// Size is the size of the file for HTTP transfers.
+	Size int64
+	// ModeratedSessionID is the optional ID of a moderated session.
+	ModeratedSessionID string
+
+	srcFS FileSystem
+	dstFS FileSystem
+}
+
+func (req *FileTransferRequest) checkAndSetDefaults() error {
+	if len(req.Sources.Paths) == 0 {
+		return trace.BadParameter("missing sources")
+	}
+	if req.Sources.Addr != nil && req.Sources.Login == "" {
+		return trace.BadParameter("missing login for source host")
+	}
+	if req.Destination.Addr != nil && req.Destination.Login == "" {
+		return trace.BadParameter("missing login for destination host")
+	}
+	if (req.Sources.Addr != nil || req.Destination.Addr != nil) && req.DialHost == nil {
+		return trace.BadParameter("request has a remote target but DialHost is not set")
+	}
+
+	if req.Log == nil {
+		req.Log = slog.Default()
+	}
+	req.Log = req.Log.With(
+		teleport.ComponentKey, "SFTP",
+		"src_paths", req.Sources.Paths,
+		"dst_path", req.Destination,
+		"recursive", req.Recursive,
+		"preserve_attrs", req.PreserveAttrs,
+	)
+	if req.ProgressWriter != nil && req.ProgressStream == nil {
+		req.ProgressStream = func(fileInfo os.FileInfo) io.ReadWriter {
+			return newProgressBar(fileInfo.Size(), fileInfo.Name(), req.ProgressWriter)
+		}
+	}
+	return nil
 }
 
 // File is the file interface required for [FileSystem].
@@ -120,6 +156,7 @@ type File interface {
 // Note: errors returned by a FileSystem should not be `trace.Wrap()`ed so the
 // sftp package can parse os errors.
 type FileSystem interface {
+	io.Closer
 	// Type returns whether the filesystem is "local" or "remote".
 	Type() string
 	// Glob returns matching files of a glob pattern.
@@ -160,69 +197,32 @@ type FileSystem interface {
 	Readlink(name string) (string, error)
 	// Getwd gets the current working directory.
 	Getwd() (string, error)
-}
-
-// CreateUploadConfig returns a Config ready to upload files over SFTP.
-func CreateUploadConfig(src []string, dst string, opts Options) (*Config, error) {
-	for _, srcPath := range src {
-		if srcPath == "" {
-			return nil, trace.BadParameter("source path is empty")
-		}
-	}
-	if dst == "" {
-		return nil, trace.BadParameter("destination path is empty")
-	}
-
-	c := &Config{
-		srcPaths: src,
-		dstPath:  dst,
-		srcFS:    &localFS{},
-		dstFS:    &RemoteFS{},
-		opts:     opts,
-	}
-	c.setDefaults()
-
-	return c, nil
-}
-
-// CreateDownloadConfig returns a Config ready to download files over SFTP.
-func CreateDownloadConfig(src, dst string, opts Options) (*Config, error) {
-	if src == "" {
-		return nil, trace.BadParameter("source path is empty")
-	}
-	if dst == "" {
-		return nil, trace.BadParameter("destination path is empty")
-	}
-
-	c := &Config{
-		srcPaths: []string{src},
-		dstPath:  dst,
-		srcFS:    &RemoteFS{},
-		dstFS:    &localFS{},
-		opts:     opts,
-	}
-	c.setDefaults()
-
-	return c, nil
+	// RealPath canonicalizes a path name, including resolving ".." and
+	// following symlinks.
+	RealPath(path string) (string, error)
 }
 
 // HTTPTransferRequest describes file transfer request over HTTP.
 type HTTPTransferRequest struct {
 	// Src is the source file name
-	Src string
+	Src Target
 	// Dst is the destination file name
-	Dst string
+	Dst Target
 	// HTTPRequest is where the source file will be read from for
 	// file upload transfers
 	HTTPRequest *http.Request
 	// HTTPResponse is where the destination file will be written to for
 	// file download transfers
 	HTTPResponse http.ResponseWriter
+	// DialHost opens an SSH client to the given address.
+	DialHost func(ctx context.Context, login, addr string) (*tracessh.Client, error)
+	// ModeratedSessionID is the optional ID of a moderated session.
+	ModeratedSessionID string
 }
 
-// CreateHTTPUploadConfig returns a Config ready to upload a file from
+// CreateHTTPUploadRequest returns a FileTransferRequest ready to upload a file from
 // a HTTP request over SFTP.
-func CreateHTTPUploadConfig(req HTTPTransferRequest) (*Config, error) {
+func CreateHTTPUploadRequest(req HTTPTransferRequest) (*FileTransferRequest, error) {
 	if err := req.checkDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -235,25 +235,23 @@ func CreateHTTPUploadConfig(req HTTPTransferRequest) (*Config, error) {
 	if err != nil {
 		return nil, trace.Errorf("failed to parse Content-Length header: %w", err)
 	}
-
-	c := &Config{
-		srcPaths: []string{req.Src},
-		dstPath:  req.Dst,
-		srcFS: &httpFS{
-			reader:   req.HTTPRequest.Body,
-			fileName: req.Src,
-			fileSize: fileSize,
+	return &FileTransferRequest{
+		Sources: Sources{
+			Login: req.Src.Login,
+			Addr:  req.Src.Addr,
+			Paths: []string{req.Src.Path},
 		},
-		dstFS: &RemoteFS{},
-	}
-	c.setDefaults()
-
-	return c, nil
+		Destination:        req.Dst,
+		DialHost:           req.DialHost,
+		HTTPReader:         req.HTTPRequest.Body,
+		Size:               fileSize,
+		ModeratedSessionID: req.ModeratedSessionID,
+	}, nil
 }
 
-// CreateHTTPDownloadConfig returns a Config ready to download a file
+// CreateHTTPDownloadRequest returns a FileTransferRequest ready to download a file
 // from over SFTP and write it to a HTTP response.
-func CreateHTTPDownloadConfig(req HTTPTransferRequest) (*Config, error) {
+func CreateHTTPDownloadRequest(req HTTPTransferRequest) (*FileTransferRequest, error) {
 	if err := req.checkDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -261,154 +259,96 @@ func CreateHTTPDownloadConfig(req HTTPTransferRequest) (*Config, error) {
 		return nil, trace.BadParameter("HTTP response is empty")
 	}
 
-	c := &Config{
-		srcPaths: []string{req.Src},
-		dstPath:  req.Dst,
-		srcFS:    &RemoteFS{},
-		dstFS: &httpFS{
-			writer:   req.HTTPResponse,
-			fileName: req.Dst,
+	return &FileTransferRequest{
+		Sources: Sources{
+			Login: req.Src.Login,
+			Addr:  req.Src.Addr,
+			Paths: []string{req.Src.Path},
 		},
-	}
-	c.setDefaults()
-
-	return c, nil
+		Destination:        req.Dst,
+		DialHost:           req.DialHost,
+		HTTPWriter:         req.HTTPResponse,
+		ModeratedSessionID: req.ModeratedSessionID,
+	}, nil
 }
 
 func (h HTTPTransferRequest) checkDefaults() error {
-	if h.Src == "" {
+	if h.Src.Path == "" {
 		return trace.BadParameter("source path is empty")
 	}
-	if h.Dst == "" {
+	if h.Dst.Path == "" {
 		return trace.BadParameter("destination path is empty")
 	}
 	return nil
 }
 
-// setDefaults sets default values
-func (c *Config) setDefaults() {
-	logger := c.Log
-	if logger == nil {
-		logger = slog.Default()
-	}
-	c.Log = logger.With(
-		teleport.ComponentKey, "SFTP",
-		"src_paths", c.srcPaths,
-		"dst_path", c.dstPath,
-		"recursive", c.opts.Recursive,
-		"preserve_attrs", c.opts.PreserveAttrs,
-	)
-
-	if !c.opts.Quiet {
-		c.ProgressStream = func(fileInfo os.FileInfo) io.ReadWriter {
-			return NewProgressBar(fileInfo.Size(), fileInfo.Name(), cmp.Or(c.opts.ProgressWriter, io.Writer(os.Stdout)))
-		}
-	}
-}
-
 // TransferFiles transfers files from the configured source paths to the
 // configured destination path over SFTP or HTTP depending on the Config.
-func (c *Config) TransferFiles(ctx context.Context, sshClient *ssh.Client) error {
-	s, err := sshClient.NewSession()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer s.Close()
-
-	// File transfers in a moderated session require this variable
-	// to check for approval on the ssh server
-	if moderatedSessionID, ok := ctx.Value(ModeratedSessionID).(string); ok {
-		s.Setenv(string(ModeratedSessionID), moderatedSessionID)
-	}
-
-	pe, err := s.StderrPipe()
-	if err != nil {
+func TransferFiles(ctx context.Context, req *FileTransferRequest) error {
+	if err := req.checkAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := s.RequestSubsystem(teleport.SFTPSubsystem); err != nil {
-		// If the subsystem request failed and a generic error is
-		// returned, return the session's stderr as the error if it's
-		// non-empty, as the session's stderr may have a more useful
-		// error message. String comparison is only used here because
-		// the error is not exported.
-		if strings.Contains(err.Error(), "ssh: subsystem request failed") {
-			var sb strings.Builder
-			if n, _ := io.Copy(&sb, pe); n > 0 {
-				return trace.Wrap(errors.New(sb.String()))
-			}
+	// Set up file systems.
+	switch {
+	case req.srcFS != nil:
+	case req.HTTPReader != nil:
+		if len(req.Sources.Paths) > 1 {
+			return trace.BadParameter("only one source allowed for http filesystems")
 		}
-		return trace.Wrap(err)
-	}
-	pw, err := s.StdinPipe()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	pr, err := s.StdoutPipe()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	sftpClient, err := sftp.NewClientPipe(pr, pw,
-		// Use concurrent stream to speed up transfer on slow networks as described in
-		// https://github.com/gravitational/teleport/issues/20579
-		sftp.UseConcurrentReads(true),
-		sftp.UseConcurrentWrites(true),
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := c.initFS(sftpClient); err != nil {
-		return trace.Wrap(err)
-	}
-
-	transferErr := c.transfer(ctx)
-	closeErr := sftpClient.Close()
-	if transferErr != nil {
-		return trace.Wrap(transferErr)
-	}
-
-	return trace.Wrap(closeErr)
-}
-
-// initFS ensures the source and destination filesystems are ready to transfer
-func (c *Config) initFS(client *sftp.Client) error {
-	var haveRemoteFS bool
-	srcFS, srcOK := c.srcFS.(*RemoteFS)
-	if srcOK {
-		srcFS.Client = client
-		haveRemoteFS = true
-	}
-	dstFS, dstOK := c.dstFS.(*RemoteFS)
-	if dstOK {
-		dstFS.Client = client
-		haveRemoteFS = true
-	}
-	// this will only happen in tests
-	if !haveRemoteFS {
-		return nil
-	}
-
-	return trace.Wrap(c.expandPaths(srcOK, dstOK))
-}
-
-func (c *Config) expandPaths(srcIsRemote, dstIsRemote bool) (err error) {
-	if srcIsRemote {
-		for i, srcPath := range c.srcPaths {
-			c.srcPaths[i], err = expandPath(srcPath)
+		req.srcFS = &httpFS{
+			reader:   req.HTTPReader,
+			fileName: req.Sources.Paths[0],
+			fileSize: req.Size,
+		}
+	case req.Sources.Addr != nil:
+		sshClient, err := req.DialHost(ctx, req.Sources.Login, req.Sources.Addr.String())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		req.srcFS, err = OpenRemoteFilesystem(ctx, sshClient, req.ModeratedSessionID)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		for i, srcPath := range req.Sources.Paths {
+			expandedPath, err := ExpandHomeDir(srcPath)
 			if err != nil {
 				return trace.Wrap(err)
 			}
+			req.Sources.Paths[i] = expandedPath
 		}
+	default:
+		req.srcFS = localFS{}
 	}
+	defer req.srcFS.Close()
 
-	if dstIsRemote {
-		c.dstPath, err = expandPath(c.dstPath)
+	switch {
+	case req.dstFS != nil:
+	case req.HTTPWriter != nil:
+		req.dstFS = &httpFS{
+			writer:   req.HTTPWriter,
+			fileName: req.Destination.Path,
+			fileSize: req.Size,
+		}
+	case req.Destination.Addr != nil:
+		sshClient, err := req.DialHost(ctx, req.Destination.Login, req.Destination.Addr.String())
 		if err != nil {
 			return trace.Wrap(err)
 		}
+		req.dstFS, err = OpenRemoteFilesystem(ctx, sshClient, req.ModeratedSessionID)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		expandedPath, err := ExpandHomeDir(req.Destination.Path)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		req.Destination.Path = expandedPath
+	default:
+		req.dstFS = localFS{}
 	}
+	defer req.dstFS.Close()
 
-	return nil
+	return trace.Wrap(transfer(ctx, req))
 }
 
 // PathExpansionError is an [error] indicating that
@@ -421,27 +361,28 @@ func (p PathExpansionError) Error() string {
 	return fmt.Sprintf("expanding remote ~user paths is not supported, specify an absolute path instead of %q", p.path)
 }
 
-func expandPath(pathStr string) (string, error) {
+// ExpandHomeDir evaluates the home directory ('~') in a path.
+func ExpandHomeDir(pathStr string) (string, error) {
 	pfxLen, ok := homeDirPrefixLen(pathStr)
 	if !ok {
 		return pathStr, nil
 	}
 
-	// Removing the home dir prefix would mean returning an empty string,
-	// which is supported by SFTP but won't be as clear in logs or audit
-	// events. Since the SFTP server will be rooted at the user's home
-	// directory, "." and "" are equivalent in this context.
-	if pathStr == "~" {
-		return ".", nil
-	}
 	if pfxLen == 1 && len(pathStr) > 1 {
 		return "", trace.Wrap(PathExpansionError{path: pathStr})
 	}
 
 	// if an SFTP path is not absolute, it is assumed to start at the user's
 	// home directory so just strip the prefix and let the SFTP server
-	// figure out the correct remote path
-	return pathStr[pfxLen:], nil
+	// figure out the correct remote path.
+	trimmedPath := pathStr[pfxLen:]
+	// Returning an empty string is supported by SFTP but won't be as clear in
+	// logs or audit events. Since the SFTP server will be rooted at the user's
+	// home directory, "." and "" are equivalent in this context.
+	if trimmedPath == "" {
+		return ".", nil
+	}
+	return trimmedPath, nil
 }
 
 // homeDirPrefixLen returns the length of a set of characters that
@@ -465,17 +406,17 @@ func homeDirPrefixLen(path string) (int, bool) {
 }
 
 // transfer performs file transfers
-func (c *Config) transfer(ctx context.Context) error {
+func transfer(ctx context.Context, req *FileTransferRequest) error {
 	// get info of source files and ensure appropriate options were passed
-	matchedPaths := make([]string, 0, len(c.srcPaths))
-	fileInfos := make([]os.FileInfo, 0, len(c.srcPaths))
-	for _, srcPath := range c.srcPaths {
+	matchedPaths := make([]string, 0, len(req.Sources.Paths))
+	fileInfos := make([]os.FileInfo, 0, len(req.Sources.Paths))
+	for _, srcPath := range req.Sources.Paths {
 		// This source path may or may not contain a glob pattern, but
 		// try and glob just in case. It is also possible the user
 		// specified a file path containing glob pattern characters but
 		// means the literal path without globbing, in which case we'll
 		// use the raw source path as the sole match below.
-		matches, err := c.srcFS.Glob(srcPath)
+		matches, err := req.srcFS.Glob(srcPath)
 		if err != nil {
 			return trace.Wrap(err, "error matching glob pattern %q", srcPath)
 		}
@@ -491,11 +432,11 @@ func (c *Config) transfer(ctx context.Context) error {
 		matchedPaths = append(matchedPaths, matches...)
 
 		for _, match := range matches {
-			fi, err := c.srcFS.Stat(match)
+			fi, err := req.srcFS.Stat(match)
 			if err != nil {
-				return trace.Wrap(err, "could not access %s path %q", c.srcFS.Type(), match)
+				return trace.Wrap(err, "could not access %s path %q", req.srcFS.Type(), match)
 			}
-			if fi.IsDir() && !c.opts.Recursive {
+			if fi.IsDir() && !req.Recursive {
 				// Note: Using an error constructor included in lib/client.IsErrorResolvableWithRelogin,
 				// e.g. BadParameter, will lead to relogin attempt and a completely obscure error message.
 				return trace.Wrap(&NonRecursiveDirectoryTransferError{Path: match})
@@ -506,35 +447,35 @@ func (c *Config) transfer(ctx context.Context) error {
 
 	// validate destination path and create it if necessary
 	var dstIsDir bool
-	c.dstPath = path.Clean(c.dstPath)
-	dstInfo, err := c.dstFS.Stat(c.dstPath)
+	req.Destination.Path = path.Clean(req.Destination.Path)
+	dstInfo, err := req.dstFS.Stat(req.Destination.Path)
 	if err != nil {
 		if !errors.Is(err, os.ErrNotExist) {
-			return trace.NotFound("error accessing %s path %q: %v", c.dstFS.Type(), c.dstPath, err)
+			return trace.NotFound("error accessing %s path %q: %v", req.dstFS.Type(), req.Destination.Path, err)
 		}
 		// if there are multiple source paths and the destination path
 		// doesn't exist, create it as a directory
 		if len(matchedPaths) > 1 {
-			if err := c.dstFS.Mkdir(c.dstPath); err != nil {
-				return trace.Errorf("error creating %s directory %q: %w", c.dstFS.Type(), c.dstPath, err)
+			if err := req.dstFS.Mkdir(req.Destination.Path); err != nil {
+				return trace.Errorf("error creating %s directory %q: %w", req.dstFS.Type(), req.Destination.Path, err)
 			}
-			if err := c.dstFS.Chmod(c.dstPath, defaults.DirectoryPermissions); err != nil {
-				return trace.Errorf("error setting permissions of %s directory %q: %w", c.dstFS.Type(), c.dstPath, err)
+			if err := req.dstFS.Chmod(req.Destination.Path, defaults.DirectoryPermissions); err != nil {
+				return trace.Errorf("error setting permissions of %s directory %q: %w", req.dstFS.Type(), req.Destination.Path, err)
 			}
 			dstIsDir = true
 		}
 	} else if len(matchedPaths) > 1 && !dstInfo.IsDir() {
 		// if there are multiple source paths, ensure the destination path
 		// is a directory
-		if len(matchedPaths) != len(c.srcPaths) {
+		if len(matchedPaths) != len(req.Sources.Paths) {
 			return trace.BadParameter("%s file %q is not a directory, but multiple source files were matched by a glob pattern",
-				c.dstFS.Type(),
-				c.dstPath,
+				req.dstFS.Type(),
+				req.Destination.Path,
 			)
 		} else {
 			return trace.BadParameter("%s file %q is not a directory, but multiple source files were specified",
-				c.dstFS.Type(),
-				c.dstPath,
+				req.dstFS.Type(),
+				req.Destination.Path,
 			)
 		}
 	} else if dstInfo.IsDir() {
@@ -542,17 +483,17 @@ func (c *Config) transfer(ctx context.Context) error {
 	}
 
 	for i, fi := range fileInfos {
-		dstPath := c.dstPath
+		dstPath := req.Destination.Path
 		if dstIsDir || fi.IsDir() {
 			dstPath = path.Join(dstPath, fi.Name())
 		}
 
 		if fi.IsDir() {
-			if err := c.transferDir(ctx, dstPath, matchedPaths[i], fi); err != nil {
+			if err := transferDir(ctx, req, dstPath, matchedPaths[i], fi, nil); err != nil {
 				return trace.Wrap(err)
 			}
 		} else {
-			if err := c.transferFile(ctx, dstPath, matchedPaths[i], fi); err != nil {
+			if err := transferFile(ctx, req, dstPath, matchedPaths[i], fi); err != nil {
 				return trace.Wrap(err)
 			}
 		}
@@ -562,20 +503,37 @@ func (c *Config) transfer(ctx context.Context) error {
 }
 
 // transferDir transfers a directory
-func (c *Config) transferDir(ctx context.Context, dstPath, srcPath string, srcFileInfo os.FileInfo) error {
-	c.Log.DebugContext(ctx, "transferring contents of directory", "source_fs", c.srcFS.Type(), "source_path", srcPath, "dest_fs", c.dstFS.Type(), "dest_path", dstPath)
+func transferDir(ctx context.Context, req *FileTransferRequest, dstPath, srcPath string, srcFileInfo os.FileInfo, visited map[string]struct{}) error {
+	if visited == nil {
+		visited = make(map[string]struct{})
+	}
+	realSrcPath, err := req.srcFS.RealPath(srcPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if _, ok := visited[realSrcPath]; ok {
+		req.Log.DebugContext(ctx, "symlink loop detected, directory will be skipped", "link", srcPath, "target", realSrcPath)
+		return nil
+	}
+	visited[realSrcPath] = struct{}{}
+	req.Log.DebugContext(ctx, "transferring contents of directory",
+		"source_fs", req.srcFS.Type(),
+		"source_path", srcPath,
+		"dest_fs", req.dstFS.Type(),
+		"dest_path", dstPath,
+	)
 
-	err := c.dstFS.Mkdir(dstPath)
+	err = req.dstFS.Mkdir(dstPath)
 	if err != nil && !errors.Is(err, os.ErrExist) {
-		return trace.Errorf("error creating %s directory %q: %w", c.dstFS.Type(), dstPath, err)
+		return trace.Errorf("error creating %s directory %q: %w", req.dstFS.Type(), dstPath, err)
 	}
-	if err := c.dstFS.Chmod(dstPath, srcFileInfo.Mode()); err != nil {
-		return trace.Errorf("error setting permissions of %s directory %q: %w", c.dstFS.Type(), dstPath, err)
+	if err := req.dstFS.Chmod(dstPath, srcFileInfo.Mode()); err != nil {
+		return trace.Errorf("error setting permissions of %s directory %q: %w", req.dstFS.Type(), dstPath, err)
 	}
 
-	infos, err := c.srcFS.ReadDir(srcPath)
+	infos, err := req.srcFS.ReadDir(srcPath)
 	if err != nil {
-		return trace.Errorf("error reading %s directory %q: %w", c.srcFS.Type(), srcPath, err)
+		return trace.Errorf("error reading %s directory %q: %w", req.srcFS.Type(), srcPath, err)
 	}
 
 	for _, info := range infos {
@@ -583,11 +541,11 @@ func (c *Config) transferDir(ctx context.Context, dstPath, srcPath string, srcFi
 		lSubPath := path.Join(srcPath, info.Name())
 
 		if info.IsDir() {
-			if err := c.transferDir(ctx, dstSubPath, lSubPath, info); err != nil {
+			if err := transferDir(ctx, req, dstSubPath, lSubPath, info, visited); err != nil {
 				return trace.Wrap(err)
 			}
 		} else {
-			if err := c.transferFile(ctx, dstSubPath, lSubPath, info); err != nil {
+			if err := transferFile(ctx, req, dstSubPath, lSubPath, info); err != nil {
 				return trace.Wrap(err)
 			}
 		}
@@ -595,10 +553,10 @@ func (c *Config) transferDir(ctx context.Context, dstPath, srcPath string, srcFi
 
 	// set modification and access times last so creating sub dirs/files
 	// doesn't update the times
-	if c.opts.PreserveAttrs {
-		err := c.dstFS.Chtimes(dstPath, getAtime(srcFileInfo), srcFileInfo.ModTime())
+	if req.PreserveAttrs {
+		err := req.dstFS.Chtimes(dstPath, getAtime(srcFileInfo), srcFileInfo.ModTime())
 		if err != nil {
-			return trace.Errorf("error changing times of %s directory %q: %w", c.dstFS.Type(), dstPath, err)
+			return trace.Errorf("error changing times of %s directory %q: %w", req.dstFS.Type(), dstPath, err)
 		}
 	}
 
@@ -606,28 +564,33 @@ func (c *Config) transferDir(ctx context.Context, dstPath, srcPath string, srcFi
 }
 
 // transferFile transfers a file
-func (c *Config) transferFile(ctx context.Context, dstPath, srcPath string, srcFileInfo os.FileInfo) error {
-	c.Log.DebugContext(ctx, "transferring file", "source_fs", c.srcFS.Type(), "source_file", srcPath, "dest_fs", c.dstFS.Type(), "dest_file", dstPath)
+func transferFile(ctx context.Context, req *FileTransferRequest, dstPath, srcPath string, srcFileInfo os.FileInfo) error {
+	req.Log.DebugContext(ctx, "transferring file",
+		"source_fs", req.srcFS.Type(),
+		"source_file", srcPath,
+		"dest_fs", req.dstFS.Type(),
+		"dest_file", dstPath,
+	)
 
-	srcFile, err := c.srcFS.Open(srcPath)
+	srcFile, err := req.srcFS.Open(srcPath)
 	if err != nil {
-		return trace.Errorf("error opening %s file %q: %w", c.srcFS.Type(), srcPath, err)
+		return trace.Errorf("error opening %s file %q: %w", req.srcFS.Type(), srcPath, err)
 	}
 	defer srcFile.Close()
 
-	dstFile, err := c.dstFS.Create(dstPath, srcFileInfo.Size())
+	dstFile, err := req.dstFS.Create(dstPath, srcFileInfo.Size())
 	if err != nil {
-		return trace.Errorf("error creating %s file %q: %w", c.dstFS.Type(), dstPath, err)
+		return trace.Errorf("error creating %s file %q: %w", req.dstFS.Type(), dstPath, err)
 	}
 	defer dstFile.Close()
 
-	if err := c.dstFS.Chmod(dstPath, srcFileInfo.Mode()); err != nil {
-		return trace.Errorf("error setting permissions of %s file %q: %w", c.dstFS.Type(), dstPath, err)
+	if err := req.dstFS.Chmod(dstPath, srcFileInfo.Mode()); err != nil {
+		return trace.Errorf("error setting permissions of %s file %q: %w", req.dstFS.Type(), dstPath, err)
 	}
 
 	var progressBar io.ReadWriter
-	if c.ProgressStream != nil {
-		progressBar = c.ProgressStream(srcFileInfo)
+	if req.ProgressStream != nil {
+		progressBar = req.ProgressStream(srcFileInfo)
 	}
 
 	reader, writer := prepareStreams(ctx, srcFile, dstFile, progressBar)
@@ -638,28 +601,28 @@ func (c *Config) transferFile(ctx context.Context, dstPath, srcPath string, srcF
 	n, err := io.Copy(writer, reader)
 	if err != nil {
 		return trace.Errorf("error copying %s file %q to %s file %q: %w",
-			c.srcFS.Type(),
+			req.srcFS.Type(),
 			srcPath,
-			c.dstFS.Type(),
+			req.dstFS.Type(),
 			dstPath,
 			err,
 		)
 	}
-	if n != srcFileInfo.Size() {
+	if n < srcFileInfo.Size() {
 		return trace.Errorf("error copying %s file %q to %s file %q: short write: wrote %d bytes, expected to write %d bytes",
-			c.srcFS.Type(),
+			req.srcFS.Type(),
 			srcPath,
-			c.dstFS.Type(),
+			req.dstFS.Type(),
 			dstPath,
 			n,
 			srcFileInfo.Size(),
 		)
 	}
 
-	if c.opts.PreserveAttrs {
-		err := c.dstFS.Chtimes(dstPath, getAtime(srcFileInfo), srcFileInfo.ModTime())
+	if req.PreserveAttrs {
+		err := req.dstFS.Chtimes(dstPath, getAtime(srcFileInfo), srcFileInfo.ModTime())
 		if err != nil {
-			return trace.Errorf("error changing times of %s file %q: %w", c.dstFS.Type(), dstPath, err)
+			return trace.Errorf("error changing times of %s file %q: %w", req.dstFS.Type(), dstPath, err)
 		}
 	}
 
@@ -732,11 +695,35 @@ func getAtime(fi os.FileInfo) time.Time {
 	return scp.GetAtime(fi)
 }
 
-// NewProgressBar returns a new progress bar that writes to writer.
-func NewProgressBar(size int64, desc string, writer io.Writer) *progressbar.ProgressBar {
+// unboundedProgressBar is a wrapper for a progress bar that increases its max
+// value when its internal count gets too big, instead of failing.
+type unboundedProgressBar struct {
+	pb *progressbar.ProgressBar
+}
+
+func (u *unboundedProgressBar) checkMax(n int) {
+	state := u.pb.State()
+	newNum := state.CurrentNum + int64(n)
+	if newNum > state.Max {
+		u.pb.ChangeMax64(newNum)
+	}
+}
+
+func (u *unboundedProgressBar) Read(p []byte) (int, error) {
+	u.checkMax(len(p))
+	return u.pb.Read(p)
+}
+
+func (u *unboundedProgressBar) Write(p []byte) (int, error) {
+	u.checkMax(len(p))
+	return u.pb.Write(p)
+}
+
+// newProgressBar returns a new progress bar that writes to writer.
+func newProgressBar(size int64, desc string, writer io.Writer) *unboundedProgressBar {
 	// this is necessary because progressbar.DefaultBytes doesn't allow
 	// the caller to specify a writer
-	return progressbar.NewOptions64(
+	return &unboundedProgressBar{pb: progressbar.NewOptions64(
 		size,
 		progressbar.OptionSetDescription(desc),
 		progressbar.OptionSetWriter(writer),
@@ -750,7 +737,7 @@ func NewProgressBar(size int64, desc string, writer io.Writer) *progressbar.Prog
 		progressbar.OptionSpinnerType(14),
 		progressbar.OptionFullWidth(),
 		progressbar.OptionSetRenderBlankState(true),
-	)
+	)}
 }
 
 // NonRecursiveDirectoryTransferError is returned when an attempt is made
diff --git a/lib/sshutils/sftp/sftp_test.go b/lib/sshutils/sftp/sftp_test.go
index cbd7050f4aa4e..64485ce0b4123 100644
--- a/lib/sshutils/sftp/sftp_test.go
+++ b/lib/sshutils/sftp/sftp_test.go
@@ -43,35 +43,35 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const fileMaxSize = 1000
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
-func TestUpload(t *testing.T) {
+func TestTransferFiles(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
 		name            string
-		srcPaths        []string
+		req             *FileTransferRequest
 		globbedSrcPaths []string
-		dstPath         string
-		opts            Options
 		files           []string
 		errCheck        require.ErrorAssertionFunc
 	}{
 		{
 			name: "one file",
-			srcPaths: []string{
-				"file",
-			},
-			dstPath: "copied-file",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"file"},
+				},
+				Destination: Target{
+					Path: "copied-file",
+				},
 				PreserveAttrs: true,
 			},
 			files: []string{
@@ -80,11 +80,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "one file to dir",
-			srcPaths: []string{
-				"file",
-			},
-			dstPath: "dst/",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"file"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 				PreserveAttrs: true,
 			},
 			files: []string{
@@ -94,11 +96,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "one dir",
-			srcPaths: []string{
-				"src/",
-			},
-			dstPath: "dir/",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"src/"},
+				},
+				Destination: Target{
+					Path: "dir/",
+				},
 				PreserveAttrs: true,
 				Recursive:     true,
 			},
@@ -108,12 +112,16 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "two files dst doesn't exist",
-			srcPaths: []string{
-				"src/file1",
-				"src/file2",
-			},
-			dstPath: "dst/",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"src/file1",
+						"src/file2",
+					},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 				PreserveAttrs: true,
 			},
 			files: []string{
@@ -123,12 +131,16 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "two files dst does exist",
-			srcPaths: []string{
-				"src/file1",
-				"src/file2",
-			},
-			dstPath: "dst/",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"src/file1",
+						"src/file2",
+					},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 				PreserveAttrs: true,
 			},
 			files: []string{
@@ -139,11 +151,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "nested dirs",
-			srcPaths: []string{
-				"s",
-			},
-			dstPath: "dst/",
-			opts: Options{
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"s"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 				PreserveAttrs: true,
 				Recursive:     true,
 			},
@@ -159,8 +173,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "globbed files dst doesn't exist",
-			srcPaths: []string{
-				"glob*",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"glob*"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 			},
 			globbedSrcPaths: []string{
 				"globS",
@@ -168,7 +187,6 @@ func TestUpload(t *testing.T) {
 				"globT",
 				"globB",
 			},
-			dstPath: "dst/",
 			files: []string{
 				"globS",
 				"globA",
@@ -178,8 +196,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "globbed files dst does exist",
-			srcPaths: []string{
-				"glob*",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"glob*"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 			},
 			globbedSrcPaths: []string{
 				"globS",
@@ -187,7 +210,6 @@ func TestUpload(t *testing.T) {
 				"globT",
 				"globB",
 			},
-			dstPath: "dst/",
 			files: []string{
 				"globS",
 				"globA",
@@ -198,9 +220,16 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "multiple glob patterns",
-			srcPaths: []string{
-				"glob*",
-				"*stuff",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"glob*",
+						"*stuff",
+					},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 			},
 			globbedSrcPaths: []string{
 				"globS",
@@ -210,7 +239,6 @@ func TestUpload(t *testing.T) {
 				"mystuff",
 				"yourstuff",
 			},
-			dstPath: "dst/",
 			files: []string{
 				"globS",
 				"globA",
@@ -223,10 +251,17 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "multiple glob patterns with normal path",
-			srcPaths: []string{
-				"glob*",
-				"file",
-				"*stuff",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"glob*",
+						"file",
+						"*stuff",
+					},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 			},
 			globbedSrcPaths: []string{
 				"globS",
@@ -237,7 +272,6 @@ func TestUpload(t *testing.T) {
 				"mystuff",
 				"yourstuff",
 			},
-			dstPath: "dst/",
 			files: []string{
 				"globS",
 				"globA",
@@ -250,10 +284,16 @@ func TestUpload(t *testing.T) {
 			},
 		},
 		{
-			name: "recursive glob pattern with normal path",
-			srcPaths: []string{
-				"glob*",
-				"file",
+			name: "recursive glob pattern",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"glob*"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
+				Recursive:     true,
+				PreserveAttrs: true,
 			},
 			globbedSrcPaths: []string{
 				"globS",
@@ -261,12 +301,42 @@ func TestUpload(t *testing.T) {
 				"globT",
 				"globB",
 				"globfile",
-				"file",
 			},
-			dstPath: "dst/",
-			opts: Options{
-				Recursive:     true,
+			files: []string{
+				"globS/",
+				"globS/file",
+				"globA/",
+				"globA/file",
+				"globT/",
+				"globT/file",
+				"globB/",
+				"globB/file",
+				"globfile",
+				"dst/",
+			},
+		},
+		{
+			name: "recursive glob pattern with normal path",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"glob*",
+						"file",
+					},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 				PreserveAttrs: true,
+				Recursive:     true,
+			},
+			globbedSrcPaths: []string{
+				"globS",
+				"globA",
+				"globT",
+				"globB",
+				"globfile",
+				"file",
 			},
 			files: []string{
 				"globS/",
@@ -284,12 +354,18 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "multiple src dst not dir",
-			srcPaths: []string{
-				"uno",
-				"dos",
-				"tres",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{
+						"uno",
+						"dos",
+						"tres",
+					},
+				},
+				Destination: Target{
+					Path: "dst_file",
+				},
 			},
-			dstPath: "dst_file",
 			files: []string{
 				"uno",
 				"dos",
@@ -302,10 +378,14 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "multiple matches from src dst not dir",
-			srcPaths: []string{
-				"glob*",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"glob*"},
+				},
+				Destination: Target{
+					Path: "dst_file",
+				},
 			},
-			dstPath: "dst_file",
 			files: []string{
 				"glob1",
 				"glob2",
@@ -318,10 +398,14 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "src dir with recursive not passed",
-			srcPaths: []string{
-				"src/",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"src/"},
+				},
+				Destination: Target{
+					Path: "dst/",
+				},
 			},
-			dstPath: "dst/",
 			files: []string{
 				"src/",
 			},
@@ -332,8 +416,13 @@ func TestUpload(t *testing.T) {
 		},
 		{
 			name: "non-existent src file",
-			srcPaths: []string{
-				"idontexist",
+			req: &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{"idontexist"},
+				},
+				Destination: Target{
+					Path: "whocares",
+				},
 			},
 			errCheck: func(t require.TestingT, err error, i ...interface{}) {
 				require.ErrorIs(t, err, os.ErrNotExist)
@@ -353,208 +442,23 @@ func TestUpload(t *testing.T) {
 					createFile(t, filepath.Join(tempDir, file))
 				}
 			}
-			for i := range tt.srcPaths {
-				tt.srcPaths[i] = filepath.Join(tempDir, tt.srcPaths[i])
-			}
-			for i := range tt.globbedSrcPaths {
-				tt.globbedSrcPaths[i] = filepath.Join(tempDir, tt.globbedSrcPaths[i])
-			}
-			tt.dstPath = filepath.Join(tempDir, tt.dstPath)
-
-			cfg, err := CreateUploadConfig(tt.srcPaths, tt.dstPath, tt.opts)
-			require.NoError(t, err)
-			// use all local filesystems to avoid SSH overhead
-			cfg.dstFS = &localFS{}
-			err = cfg.initFS(nil)
-			require.NoError(t, err)
-
-			ctx := context.Background()
-			err = cfg.transfer(ctx)
-			if tt.errCheck == nil {
-				require.NoError(t, err)
-				srcPaths := tt.srcPaths
-				if len(tt.globbedSrcPaths) != 0 {
-					srcPaths = tt.globbedSrcPaths
-				}
-				checkTransfer(t, tt.opts.PreserveAttrs, tt.dstPath, srcPaths...)
-			} else {
-				tt.errCheck(t, err, tempDir)
-			}
-		})
-	}
-}
-
-func TestDownload(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name            string
-		srcPath         string
-		globbedSrcPaths []string
-		dstPath         string
-		opts            Options
-		files           []string
-		errCheck        require.ErrorAssertionFunc
-	}{
-		{
-			name:    "one file",
-			srcPath: "file",
-			dstPath: "copied-file",
-			opts: Options{
-				PreserveAttrs: true,
-			},
-			files: []string{
-				"file",
-			},
-		},
-		{
-			name:    "one dir",
-			srcPath: "src/",
-			dstPath: "dst/",
-			opts: Options{
-				PreserveAttrs: true,
-				Recursive:     true,
-			},
-			files: []string{
-				"src/",
-				"dst/",
-			},
-		},
-		{
-			name:    "nested dirs",
-			srcPath: "s",
-			dstPath: "dst/",
-			opts: Options{
-				PreserveAttrs: true,
-				Recursive:     true,
-			},
-			files: []string{
-				"s/",
-				"s/file",
-				"s/r/",
-				"s/r/file",
-				"s/r/c/",
-				"s/r/c/file",
-				"dst/",
-			},
-		},
-		{
-			name:    "globbed files dst doesn't exist",
-			srcPath: "glob*",
-			globbedSrcPaths: []string{
-				"globS",
-				"globA",
-				"globT",
-				"globB",
-			},
-			dstPath: "dst/",
-			files: []string{
-				"globS",
-				"globA",
-				"globT",
-				"globB",
-			},
-		},
-		{
-			name:    "globbed files dst does exist",
-			srcPath: "glob*",
-			globbedSrcPaths: []string{
-				"globS",
-				"globA",
-				"globT",
-				"globB",
-			},
-			dstPath: "dst/",
-			files: []string{
-				"globS",
-				"globA",
-				"globT",
-				"globB",
-				"dst/",
-			},
-		},
-		{
-			name:    "recursive glob pattern",
-			srcPath: "glob*",
-			globbedSrcPaths: []string{
-				"globS",
-				"globA",
-				"globT",
-				"globB",
-				"globfile",
-			},
-			dstPath: "dst/",
-			opts: Options{
-				Recursive:     true,
-				PreserveAttrs: true,
-			},
-			files: []string{
-				"globS/",
-				"globS/file",
-				"globA/",
-				"globA/file",
-				"globT/",
-				"globT/file",
-				"globB/",
-				"globB/file",
-				"globfile",
-				"dst/",
-			},
-		},
-		{
-			name:    "src dir with recursive not passed",
-			srcPath: "src/",
-			dstPath: "dst/",
-			files: []string{
-				"src/",
-			},
-			errCheck: func(t require.TestingT, err error, i ...interface{}) {
-				require.EqualError(t, err, fmt.Sprintf(`"%s/src" is a directory, but the recursive option was not passed`, i[0]))
-			},
-		},
-		{
-			name:    "non-existent src file",
-			srcPath: "idontexist",
-			errCheck: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorIs(t, err, os.ErrNotExist)
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// create necessary files
-			tempDir := t.TempDir()
-			for _, file := range tt.files {
-				// if path ends in slash, create dir
-				if strings.HasSuffix(file, string(filepath.Separator)) {
-					createDir(t, filepath.Join(tempDir, file))
-				} else {
-					createFile(t, filepath.Join(tempDir, file))
-				}
+			for i, src := range tt.req.Sources.Paths {
+				tt.req.Sources.Paths[i] = filepath.Join(tempDir, src)
 			}
-			tt.srcPath = filepath.Join(tempDir, tt.srcPath)
 			for i := range tt.globbedSrcPaths {
 				tt.globbedSrcPaths[i] = filepath.Join(tempDir, tt.globbedSrcPaths[i])
 			}
-			tt.dstPath = filepath.Join(tempDir, tt.dstPath)
-
-			cfg, err := CreateDownloadConfig(tt.srcPath, tt.dstPath, tt.opts)
-			require.NoError(t, err)
-			// use all local filesystems to avoid SSH overhead
-			cfg.srcFS = &localFS{}
-			err = cfg.initFS(nil)
-			require.NoError(t, err)
+			tt.req.Destination.Path = filepath.Join(tempDir, tt.req.Destination.Path)
 
 			ctx := context.Background()
-			err = cfg.transfer(ctx)
+			err := TransferFiles(ctx, tt.req)
 			if tt.errCheck == nil {
 				require.NoError(t, err)
-				srcPaths := []string{tt.srcPath}
+				srcPaths := tt.req.Sources.Paths
 				if len(tt.globbedSrcPaths) != 0 {
 					srcPaths = tt.globbedSrcPaths
 				}
-				checkTransfer(t, tt.opts.PreserveAttrs, tt.dstPath, srcPaths...)
+				checkTransfer(t, tt.req.PreserveAttrs, tt.req.Destination.Path, srcPaths...)
 			} else {
 				tt.errCheck(t, err, tempDir)
 			}
@@ -586,7 +490,11 @@ func TestHomeDirExpansion(t *testing.T) {
 			path:         "~",
 			expandedPath: ".",
 		},
-
+		{
+			name:         "tilde slash",
+			path:         "~/",
+			expandedPath: ".",
+		},
 		{
 			name: "~user path",
 			path: "~user/foo",
@@ -598,7 +506,7 @@ func TestHomeDirExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			expanded, err := expandPath(tt.path)
+			expanded, err := ExpandHomeDir(tt.path)
 			if tt.errCheck == nil {
 				require.NoError(t, err)
 				require.Equal(t, tt.expandedPath, expanded)
@@ -619,20 +527,122 @@ func TestCopyingSymlinkedFile(t *testing.T) {
 	require.NoError(t, err)
 
 	dstPath := filepath.Join(tempDir, "dst")
-	cfg, err := CreateDownloadConfig(linkPath, dstPath, Options{})
-	require.NoError(t, err)
-	// use all local filesystems to avoid SSH overhead
-	cfg.srcFS = &localFS{}
-	err = cfg.initFS(nil)
-	require.NoError(t, err)
+	req := &FileTransferRequest{
+		Sources: Sources{
+			Paths: []string{linkPath},
+		},
+		Destination: Target{
+			Path: dstPath,
+		},
+	}
 
-	ctx := context.Background()
-	err = cfg.transfer(ctx)
+	err = TransferFiles(t.Context(), req)
 	require.NoError(t, err)
 
 	checkTransfer(t, false, dstPath, linkPath)
 }
 
+type mockFile struct {
+	File
+	altDataSource io.Reader
+}
+
+func (m *mockFile) Read(p []byte) (int, error) {
+	return m.altDataSource.Read(p)
+}
+
+type mockFS struct {
+	localFS
+	fileAccesses map[string]int
+	altData      io.Reader
+}
+
+func (m *mockFS) Open(path string) (File, error) {
+	if m.fileAccesses == nil {
+		m.fileAccesses = make(map[string]int)
+	}
+	realPath, err := m.localFS.RealPath(path)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	m.fileAccesses[realPath]++
+	file, err := m.localFS.Open(path)
+	if err != nil || m.altData == nil {
+		return file, err
+	}
+	return &mockFile{
+		File:          file,
+		altDataSource: m.altData,
+	}, nil
+}
+
+func TestRecursiveSymlinks(t *testing.T) {
+	// Create files and symlinks.
+	root := t.TempDir()
+	t.Chdir(root)
+	srcDir := filepath.Join(root, "a")
+	createDir(t, filepath.Join(srcDir, "b/c"))
+	fileA := "a/a.txt"
+	fileB := "a/b/b.txt"
+	fileC := "a/b/c/c.txt"
+	for _, file := range []string{fileA, fileB, fileC} {
+		createFile(t, filepath.Join(root, file))
+	}
+	require.NoError(t, os.Symlink(srcDir, filepath.Join(srcDir, "abs_link")))
+	require.NoError(t, os.Symlink("..", filepath.Join(srcDir, "b/rel_link")))
+
+	tests := []struct {
+		name   string
+		srcDir string
+	}{
+		{
+			name:   "absolute",
+			srcDir: srcDir,
+		},
+		{
+			name:   "relative",
+			srcDir: filepath.Base(srcDir),
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Perform the transfer.
+			dstDir := filepath.Join(root, "dst")
+			t.Cleanup(func() { os.RemoveAll(dstDir) })
+
+			srcFS := &mockFS{fileAccesses: make(map[string]int)}
+			req := &FileTransferRequest{
+				Sources: Sources{
+					Paths: []string{tc.srcDir},
+				},
+				Destination: Target{
+					Path: dstDir,
+				},
+				Recursive: true,
+				srcFS:     srcFS,
+			}
+			require.NoError(t, TransferFiles(t.Context(), req))
+
+			// Check results. Don't use checkTransfer() as the directories will not have
+			// matching sizes (the symlinks that aren't copied over).
+			for _, file := range []string{fileA, fileB, fileC} {
+				srcFile, err := srcFS.RealPath(filepath.Join(filepath.Dir(tc.srcDir), file))
+				require.NoError(t, err)
+				srcInfo, err := os.Stat(srcFile)
+				require.NoError(t, err)
+				dstFile, err := srcFS.RealPath(filepath.Join(dstDir, file))
+				require.NoError(t, err)
+				dstInfo, err := os.Stat(dstFile)
+				require.NoError(t, err)
+				compareFiles(t, false, dstInfo, srcInfo, dstFile, srcFile)
+				// Check that the file was only opened once.
+				accesses := srcFS.fileAccesses[srcFile]
+				require.Equal(t, 1, accesses, "file %q was opened %d times", srcFile, accesses)
+			}
+		})
+	}
+}
+
 func TestHTTPUpload(t *testing.T) {
 	t.Parallel()
 
@@ -654,17 +664,21 @@ func TestHTTPUpload(t *testing.T) {
 	require.NoError(t, err)
 	req.Header.Set("Content-Length", strconv.FormatInt(fi.Size(), 10))
 
-	cfg, err := CreateHTTPUploadConfig(
+	transferReq, err := CreateHTTPUploadRequest(
 		HTTPTransferRequest{
-			Src:         "source",
-			Dst:         dst,
+			Src: Target{
+				Path: "source",
+			},
+			Dst: Target{
+				Path: dst,
+			},
 			HTTPRequest: req,
 		},
 	)
 	require.NoError(t, err)
-	cfg.dstFS = &localFS{}
+	transferReq.dstFS = &localFS{}
 
-	err = cfg.transfer(req.Context())
+	err = TransferFiles(t.Context(), transferReq)
 	require.NoError(t, err)
 
 	srcContents, err := os.ReadFile(src)
@@ -691,17 +705,20 @@ func TestHTTPDownload(t *testing.T) {
 	require.NoError(t, err)
 
 	w := httptest.NewRecorder()
-	cfg, err := CreateHTTPDownloadConfig(
+	transferReq, err := CreateHTTPDownloadRequest(
 		HTTPTransferRequest{
-			Src:          src,
-			Dst:          "/home/robots.txt",
+			Src: Target{
+				Path: src,
+			},
+			Dst: Target{
+				Path: "/home/robots.txt",
+			},
 			HTTPResponse: w,
 		},
 	)
 	require.NoError(t, err)
-	cfg.srcFS = &localFS{}
 
-	err = cfg.transfer(context.Background())
+	err = TransferFiles(t.Context(), transferReq)
 	require.NoError(t, err)
 
 	data, err := io.ReadAll(w.Body)
@@ -714,6 +731,36 @@ func TestHTTPDownload(t *testing.T) {
 	require.Empty(t, cmp.Diff(`attachment;filename="robots.txt"`, w.Header().Get("Content-Disposition")))
 }
 
+func TestTransferUnexpectedLargerFile(t *testing.T) {
+	t.Parallel()
+	tempDir := t.TempDir()
+	srcFile := filepath.Join(tempDir, "in")
+	require.NoError(t, os.WriteFile(srcFile, []byte("original file data\n"), 0o755))
+	dstFile := filepath.Join(tempDir, "out")
+	srcFileReader, err := os.Open(srcFile)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, srcFileReader.Close()) })
+
+	srcFS := &mockFS{altData: io.MultiReader(srcFileReader, strings.NewReader("extra data\n"))}
+	req := &FileTransferRequest{
+		Sources: Sources{
+			Paths: []string{srcFile},
+		},
+		Destination: Target{
+			Path: dstFile,
+		},
+		// Ensure progress bar is created.
+		ProgressWriter: io.Discard,
+		srcFS:          srcFS,
+	}
+	require.NoError(t, TransferFiles(t.Context(), req))
+
+	require.FileExists(t, dstFile)
+	dstFileData, err := os.ReadFile(dstFile)
+	require.NoError(t, err)
+	require.Equal(t, "original file data\nextra data\n", string(dstFileData))
+}
+
 func createFile(t *testing.T, path string) {
 	dir := filepath.Dir(path)
 	if dir != path {
@@ -1079,6 +1126,19 @@ func TestHandleFilelist(t *testing.T) {
 		}
 	}
 
+	// Add a broken symlink.
+	brokenSymlinkName := "broken-symlink"
+	brokenSymlink := filepath.Join(root, brokenSymlinkName)
+	brokenTarget := filepath.Join(root, "this-file-does-not-exist")
+	require.NoError(t, os.Symlink(brokenTarget, brokenSymlink))
+	symlinkStat, err := os.Lstat(brokenSymlink)
+	require.NoError(t, err)
+	statMap[brokenSymlinkName] = fileInfo{
+		name: brokenSymlinkName,
+		mode: symlinkStat.Mode(),
+		size: int64(len(brokenTarget)),
+	}
+
 	tests := []struct {
 		name           string
 		req            *sftp.Request
@@ -1136,7 +1196,7 @@ func TestHandleFilelist(t *testing.T) {
 				if assert.True(t, ok, "unexpected file %q", fi.Name()) {
 					assert.Equal(t, entry.Name(), fi.Name())
 					assert.Equal(t, entry.Size(), fi.Size(), fi.Name())
-					assert.Equal(t, entry.Mode(), fi.Mode(), fi.Name())
+					assert.Equal(t, entry.Mode(), fi.Mode(), "%s: expected mode 0o%o, got mode 0o%o", fi.Name(), entry.Mode(), fi.Mode())
 				}
 			}
 		})
diff --git a/lib/sshutils/x11/forward.go b/lib/sshutils/x11/forward.go
index 0a67a01e418a2..1ced770891436 100644
--- a/lib/sshutils/x11/forward.go
+++ b/lib/sshutils/x11/forward.go
@@ -25,6 +25,8 @@ import (
 
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
+
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 )
 
 const (
@@ -55,14 +57,14 @@ type ForwardRequestPayload struct {
 // authProto and authCookie are required to set up authentication with the Server. screenNumber is used
 // by the server to determine which screen should be connected to for X11 forwarding. singleConnection is
 // an optional argument to request X11 forwarding for a single connection.
-func RequestForwarding(sess *ssh.Session, xauthEntry *XAuthEntry) error {
+func RequestForwarding(ctx context.Context, sess *tracessh.Session, xauthEntry *XAuthEntry) error {
 	payload := ForwardRequestPayload{
 		AuthProtocol: xauthEntry.Proto,
 		AuthCookie:   xauthEntry.Cookie,
 		ScreenNumber: uint32(xauthEntry.Display.ScreenNumber),
 	}
 
-	ok, err := sess.SendRequest(ForwardRequest, true, ssh.Marshal(payload))
+	ok, err := sess.SendRequest(ctx, ForwardRequest, true, ssh.Marshal(payload))
 	if err != nil {
 		return trace.Wrap(err)
 	} else if !ok {
diff --git a/lib/tbot/bot/bot.go b/lib/tbot/bot/bot.go
new file mode 100644
index 0000000000000..989019d679469
--- /dev/null
+++ b/lib/tbot/bot/bot.go
@@ -0,0 +1,498 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+import (
+	"context"
+	"sync/atomic"
+	"time"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/webclient"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	apitracing "github.com/gravitational/teleport/api/observability/tracing"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/carotation"
+	"github.com/gravitational/teleport/lib/tbot/internal/heartbeat"
+	"github.com/gravitational/teleport/lib/tbot/internal/identity"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/bot")
+
+// Bot runs a collection of services/outputs to generate and renew credentials
+// on behalf of non-human actors (i.e. machines and workloads).
+type Bot struct {
+	cfg     Config
+	started atomic.Bool
+}
+
+// New creates a Bot with the given configuration. Call Run to run the bot in
+// long-running "daemon" mode, or OneShot to generate outputs once and then exit.
+func New(cfg Config) (*Bot, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Bot{cfg: cfg}, nil
+}
+
+// Run the bot until the given context is canceled.
+func (b *Bot) Run(ctx context.Context) (err error) {
+	ctx, span := tracer.Start(ctx, "Bot/Run")
+	defer func() { apitracing.EndSpan(span, err) }()
+
+	if b.checkStarted(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	registry := readyz.NewRegistry()
+
+	services, closer, err := b.buildServices(ctx, registry)
+	defer closer()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, handle := range services {
+		// If the service builder called ServiceDependencies.GetStatusReporter,
+		// we take that as a promise that the service's Run method will report
+		// statuses. Otherwise we will not include the service in heartbeats or
+		// the `/readyz` endpoint.
+		if handle.statusReporter.used {
+			handle.statusReporter.reporter = registry.AddService(handle.serviceType, handle.name)
+		}
+	}
+
+	b.cfg.Logger.InfoContext(ctx, "Initialization complete. Starting services")
+
+	group, groupCtx := errgroup.WithContext(ctx)
+	for _, handle := range services {
+		handle := handle
+		log := b.cfg.Logger.With("service", handle.name)
+
+		group.Go(func() error {
+			log.InfoContext(groupCtx, "Starting service")
+
+			err := handle.service.Run(groupCtx)
+			if err != nil {
+				log.ErrorContext(ctx, "Service exited with error", "error", err)
+				return trace.Wrap(err, "service(%s)", handle.name)
+			}
+
+			log.InfoContext(groupCtx, "Service exited")
+			return nil
+		})
+	}
+	return group.Wait()
+}
+
+// OneShot runs the bot in "one shot" mode to generate outputs once and then exits.
+func (b *Bot) OneShot(ctx context.Context) (err error) {
+	ctx, span := tracer.Start(ctx, "Bot/OneShot")
+	defer func() { apitracing.EndSpan(span, err) }()
+
+	if b.checkStarted(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	registry := readyz.NewRegistry()
+
+	services, closer, err := b.buildServices(ctx, registry)
+	defer closer()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Filter out the services that don't support oneshot mode.
+	oneShotServices := make([]*serviceHandle, 0, len(services))
+	for _, handle := range services {
+		handle := handle
+		if _, ok := handle.service.(OneShotService); !ok {
+			b.cfg.Logger.InfoContext(ctx,
+				"Service does not support oneshot mode, will not run",
+				"service", handle.name,
+			)
+			continue
+		}
+
+		// Add oneshot services to the registry.
+		handle.statusReporter.reporter = registry.AddService(handle.serviceType, handle.name)
+		oneShotServices = append(oneShotServices, handle)
+	}
+
+	group, groupCtx := errgroup.WithContext(ctx)
+	for _, handle := range oneShotServices {
+		handle := handle
+		log := b.cfg.Logger.With("service", handle.name)
+
+		group.Go(func() error {
+			log.DebugContext(groupCtx, "Running service in oneshot mode")
+
+			err := handle.service.(OneShotService).OneShot(groupCtx)
+			if err != nil {
+				log.ErrorContext(ctx, "Service exited with error", "error", err)
+				handle.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+				return trace.Wrap(err, "service(%s)", handle.name)
+			}
+
+			log.InfoContext(groupCtx, "Service finished")
+			handle.statusReporter.Report(readyz.Healthy)
+			return nil
+		})
+	}
+	return group.Wait()
+}
+
+func (b *Bot) checkStarted() error {
+	if b.started.CompareAndSwap(false, true) {
+		return nil
+	}
+	return trace.BadParameter("bot has already been started")
+}
+
+func (b *Bot) buildServices(ctx context.Context, registry *readyz.Registry) ([]*serviceHandle, func(), error) {
+	startedAt := time.Now().UTC()
+
+	handles := make([]*serviceHandle, 0, len(b.cfg.Services))
+	closeFn := func() {
+		for _, h := range handles {
+			if h.closeFn != nil {
+				h.closeFn()
+			}
+		}
+	}
+
+	// Build internal services and dependencies.
+	reloadBroadcaster := b.buildReloadBroadcaster(ctx)
+
+	resolver, err := b.buildResolver(ctx)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building resolver")
+	}
+
+	clientBuilder, err := b.buildClientBuilder(resolver)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building client builder")
+	}
+
+	identityService, identityServiceHandle, err := b.buildIdentityService(
+		ctx,
+		reloadBroadcaster,
+		clientBuilder,
+	)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building identity service")
+	}
+	handles = append(handles, identityServiceHandle)
+
+	heartbeatService, err := b.buildHeartbeatService(
+		identityService,
+		startedAt,
+		registry,
+	)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building heartbeat service")
+	}
+	handles = append(handles, heartbeatService)
+
+	caRotationService, err := b.buildCARotationService(
+		reloadBroadcaster,
+		identityService,
+	)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building CA rotation service")
+	}
+	handles = append(handles, caRotationService)
+
+	proxyPinger, err := b.buildProxyPinger(identityService)
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building proxy pinger")
+	}
+
+	identityGenerator, err := identityService.GetGenerator()
+	if err != nil {
+		return nil, closeFn, trace.Wrap(err, "building identity generator")
+	}
+
+	// Build user services.
+	for idx, builder := range b.cfg.Services {
+		reloadCh, unsubscribe := reloadBroadcaster.Subscribe()
+
+		handle := &serviceHandle{
+			closeFn:        unsubscribe,
+			statusReporter: &statusReporter{},
+		}
+		handle.serviceType, handle.name = builder.GetTypeAndName()
+
+		var err error
+		handle.service, err = builder.Build(ServiceDependencies{
+			Client:             identityService.GetClient(),
+			Resolver:           resolver,
+			ClientBuilder:      clientBuilder,
+			IdentityGenerator:  identityGenerator,
+			ProxyPinger:        proxyPinger,
+			BotIdentity:        identityService.GetIdentity,
+			BotIdentityReadyCh: identityService.Ready(),
+			ReloadCh:           reloadCh,
+			StatusRegistry:     registry,
+			GetStatusReporter: func() readyz.Reporter {
+				handle.statusReporter.used = true
+				return handle.statusReporter
+			},
+			Logger: b.cfg.Logger.With(
+				teleport.ComponentKey,
+				teleport.Component(teleport.ComponentTBot, "svc", handle.name),
+			),
+		})
+		if err != nil {
+			return nil, closeFn, trace.Wrap(err, "building service [%d]", idx)
+		}
+
+		handles = append(handles, handle)
+	}
+	return handles, closeFn, nil
+}
+
+func (b *Bot) buildReloadBroadcaster(ctx context.Context) *internal.ChannelBroadcaster {
+	broadcaster := internal.NewChannelBroadcaster()
+	if b.cfg.ReloadCh != nil {
+		go func() {
+			for {
+				select {
+				case <-b.cfg.ReloadCh:
+					broadcaster.Broadcast()
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+	}
+	return broadcaster
+}
+
+func (b *Bot) buildResolver(ctx context.Context) (reversetunnelclient.Resolver, error) {
+	if b.cfg.Connection.StaticProxyAddress {
+		return reversetunnelclient.StaticResolver(
+			b.cfg.Connection.Address,
+
+			// If the user has indicated they want tbot to prefer using the proxy
+			// address they have configured, we use a static resolver set to this
+			// address. We also assume that they have TLS routing/multiplexing
+			// enabled, since otherwise we'd need them to manually configure an
+			// an entry for each kind of address.
+			types.ProxyListenerMode_Multiplex,
+		), nil
+	}
+
+	return reversetunnelclient.CachingResolver(
+		ctx,
+		reversetunnelclient.WebClientResolver(&webclient.Config{
+			Context:   ctx,
+			ProxyAddr: b.cfg.Connection.Address,
+			Insecure:  b.cfg.Connection.Insecure,
+		}),
+		nil, /* clock */
+	)
+}
+
+func (b *Bot) buildClientBuilder(resolver reversetunnelclient.Resolver) (*client.Builder, error) {
+	return client.NewBuilder(client.BuilderConfig{
+		Connection: b.cfg.Connection,
+		Resolver:   resolver,
+		Logger: b.cfg.Logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, "client"),
+		),
+		Metrics: b.cfg.ClientMetrics,
+	})
+}
+
+func (b *Bot) buildIdentityService(
+	ctx context.Context,
+	reloadBroadcaster *internal.ChannelBroadcaster,
+	clientBuilder *client.Builder,
+) (*identity.Service, *serviceHandle, error) {
+	handle := &serviceHandle{
+		serviceType:    "internal/identity",
+		name:           "identity",
+		statusReporter: &statusReporter{used: true},
+	}
+
+	reloadCh, unsubscribe := reloadBroadcaster.Subscribe()
+	identityService, err := identity.NewService(identity.Config{
+		Connection:      b.cfg.Connection,
+		Onboarding:      b.cfg.Onboarding,
+		Destination:     b.cfg.InternalStorage,
+		TTL:             b.cfg.CredentialLifetime.TTL,
+		RenewalInterval: b.cfg.CredentialLifetime.RenewalInterval,
+		FIPS:            b.cfg.FIPS,
+		Logger: b.cfg.Logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, handle.name),
+		),
+		ClientBuilder:  clientBuilder,
+		ReloadCh:       reloadCh,
+		StatusReporter: handle.statusReporter,
+	})
+	if err != nil {
+		unsubscribe()
+		return nil, nil, trace.Wrap(err, "building identity service")
+	}
+
+	handle.service = identityService
+	handle.closeFn = func() {
+		if err := identityService.Close(); err != nil {
+			b.cfg.Logger.ErrorContext(
+				ctx,
+				"Failed to close bot identity service",
+				"error", err,
+			)
+		}
+		unsubscribe()
+	}
+
+	if err := identityService.Initialize(ctx); err != nil {
+		handle.closeFn()
+		return nil, nil, trace.Wrap(err, "initializing identity service")
+	}
+	return identityService, handle, nil
+}
+
+func (b *Bot) buildHeartbeatService(
+	identityService *identity.Service,
+	startedAt time.Time,
+	statusRegistry *readyz.Registry,
+) (*serviceHandle, error) {
+	handle := &serviceHandle{
+		serviceType:    "internal/heartbeat",
+		name:           "heartbeat",
+		statusReporter: &statusReporter{used: true},
+	}
+
+	var err error
+	handle.service, err = heartbeat.NewService(heartbeat.Config{
+		Interval:           30 * time.Minute,
+		RetryLimit:         5,
+		Client:             machineidv1.NewBotInstanceServiceClient(identityService.GetClient().GetConnection()),
+		BotIdentityReadyCh: identityService.Ready(),
+		StartedAt:          startedAt,
+		JoinMethod:         b.cfg.Onboarding.JoinMethod,
+		Logger: b.cfg.Logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, handle.name),
+		),
+		StatusReporter: handle.statusReporter,
+		StatusRegistry: statusRegistry,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return handle, nil
+}
+
+func (b *Bot) buildProxyPinger(identityService *identity.Service) (connection.ProxyPinger, error) {
+	return internal.NewCachingProxyPinger(internal.CachingProxyPingerConfig{
+		Connection: b.cfg.Connection,
+		Client:     identityService.GetClient(),
+		Logger: b.cfg.Logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, "proxy-pinger"),
+		),
+	})
+}
+
+func (b *Bot) buildCARotationService(
+	reloadBroadcaster *internal.ChannelBroadcaster,
+	identityService *identity.Service,
+) (*serviceHandle, error) {
+	handle := &serviceHandle{
+		serviceType:    "internal/ca-rotation",
+		name:           "ca-rotation",
+		statusReporter: &statusReporter{used: true},
+	}
+
+	var err error
+	handle.service, err = carotation.NewService(carotation.Config{
+		BroadcastFn:        reloadBroadcaster.Broadcast,
+		Client:             identityService.GetClient(),
+		GetBotIdentityFn:   identityService.GetIdentity,
+		BotIdentityReadyCh: identityService.Ready(),
+		Logger: b.cfg.Logger.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, handle.name),
+		),
+		StatusReporter: handle.statusReporter,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return handle, nil
+}
+
+// serviceHandle contains a built service, its type/name, close function, and a
+// pointer to its status reporter - so we can automatically report statuses for
+// oneshot services.
+type serviceHandle struct {
+	serviceType, name string
+	service           Service
+	statusReporter    *statusReporter
+	closeFn           func()
+}
+
+// statusReporter wraps readyz.Reporter to break a circular dependency where:
+//
+//   - We need a status reporter to build a service
+//   - We must register the service in order to get the status reporter
+//   - We may not want to register the service in one-shot mode if it does not
+//     implement OneShotService
+//   - We can only know whether the service implements OneShotService after
+//     we've built it
+//
+// This wrapper allows us to defer the actual registration until we know whether
+// the service implements OneShotService.
+type statusReporter struct {
+	used     bool
+	reporter readyz.Reporter
+}
+
+func (r *statusReporter) Report(status readyz.Status) {
+	if r.reporter != nil {
+		r.reporter.Report(status)
+	}
+}
+
+func (r *statusReporter) ReportReason(status readyz.Status, reason string) {
+	if r.reporter != nil {
+		r.reporter.ReportReason(status, reason)
+	}
+}
diff --git a/lib/tbot/bot/config.go b/lib/tbot/bot/config.go
new file mode 100644
index 0000000000000..2b502acfb71fd
--- /dev/null
+++ b/lib/tbot/bot/config.go
@@ -0,0 +1,117 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+import (
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
+
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+)
+
+// Config contains the core bot's configuration. The tbot binary's configuration
+// file format is handled by the lib/tbot/config package.
+type Config struct {
+	// Kind identifies whether the bot is running in the tbot binary or embedded
+	// in another component.
+	Kind Kind
+
+	// Connection controls how the bot connects to the cluster.
+	Connection connection.Config
+
+	// Onboarding controls how the bot authenticates and joins the cluster.
+	Onboarding onboarding.Config
+
+	// InternalStorage is the destination to which the bot's internal state and
+	// certificates will be written.
+	InternalStorage destination.Destination
+
+	// CredentialLifetime controls the TTL and renewal interval of the bot's
+	// internal credentials.
+	CredentialLifetime CredentialLifetime
+
+	// FIPS controls whether the bot will run in a mode designed to comply with
+	// Federal Information Processing Standards.
+	FIPS bool
+
+	// Logger to which errors and messages will be written.
+	Logger *slog.Logger
+
+	// ReloadCh can be used to trigger a reload its certificates, etc.
+	ReloadCh <-chan struct{}
+
+	// Services contains constructors that will be called to create the bot's
+	// services.
+	Services []ServiceBuilder
+
+	// ClientMetrics will be used to record the bot's API client metrics.
+	ClientMetrics *prometheus.ClientMetrics
+}
+
+// CheckAndSetDefaults validates the configuration and sets any default values.
+func (c *Config) CheckAndSetDefaults() error {
+	if err := c.Connection.Validate(); err != nil {
+		return trace.Wrap(err, "validating connection")
+	}
+	if c.InternalStorage == nil {
+		c.InternalStorage = destination.NewMemory()
+	}
+	if c.CredentialLifetime.IsEmpty() {
+		c.CredentialLifetime = DefaultCredentialLifetime
+	}
+	if c.Logger == nil {
+		c.Logger = slog.Default()
+	}
+	return nil
+}
+
+// UnmarshalConfigContext is passed to the UnmarshalConfig method implemented by
+// service config structs. It provides a way to unmarshal fields that may be
+// dynamically registered (like the Kubernetes Secret Destination, which is only
+// available if you import the k8s package) without maintaining a global registry.
+type UnmarshalConfigContext = internal.UnmarshalConfigContext
+
+// Kind identifies whether the bot is running in the tbot binary or embedded
+// in another component
+type Kind machineidv1.BotKind
+
+const (
+	// KindUnspecified means no bot kind was given.
+	KindUnspecified = Kind(machineidv1.BotKind_BOT_KIND_UNSPECIFIED)
+
+	// KindTbot means the bot is running in the tbot binary.
+	KindTbot = Kind(machineidv1.BotKind_BOT_KIND_TBOT)
+
+	// KindTerraformProvider means the bot is embedded in one of our Terraform
+	// providers.
+	KindTerraformProvider = Kind(machineidv1.BotKind_BOT_KIND_TERRAFORM_PROVIDER)
+
+	// KindKubernetesOperator means the bot is embedded in our Kubernetes
+	// operator.
+	KindKubernetesOperator = Kind(machineidv1.BotKind_BOT_KIND_KUBERNETES_OPERATOR)
+
+	// KindTctl means the bot is embedded in tctl.
+	KindTctl = Kind(machineidv1.BotKind_BOT_KIND_TCTL)
+)
diff --git a/lib/tbot/bot/connection/config.go b/lib/tbot/bot/connection/config.go
new file mode 100644
index 0000000000000..191e6e86aaacf
--- /dev/null
+++ b/lib/tbot/bot/connection/config.go
@@ -0,0 +1,109 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package connection
+
+import (
+	"github.com/gravitational/trace"
+)
+
+// Config controls how the bot will connect to the Teleport cluster.
+type Config struct {
+	// Address contains the address string.
+	Address string
+
+	// AddressKind is the kind of address the user provided (i.e. auth server or
+	// proxy).
+	AddressKind AddressKind
+
+	// AuthServerAddressMode controls the behavior of when a proxy address is
+	// given as an auth server address.
+	AuthServerAddressMode AuthServerAddressMode
+
+	// StaticProxyAddress means the given proxy address will be used as-is
+	// rather than using an address discovered by pinging the proxy or auth
+	// server.
+	//
+	// In tbot, it is controlled using the `TBOT_USE_PROXY_ADDR` env var.
+	StaticProxyAddress bool
+
+	// Insecure allows the bot to trust the auth server or proxy certificate on
+	// first connection without verifying them. It is not recommended for use in
+	// production.
+	Insecure bool
+}
+
+// Validate the connection configuration.
+func (cfg *Config) Validate() error {
+	if cfg.Address == "" {
+		return trace.BadParameter("Address is required")
+	}
+
+	switch cfg.AddressKind {
+	case AddressKindProxy, AddressKindAuth:
+	default:
+		return trace.BadParameter("unsupported address kind: %s", cfg.AddressKind)
+	}
+
+	switch cfg.AuthServerAddressMode {
+	case AllowProxyAsAuthServer, WarnIfAuthServerIsProxy, AuthServerMustBeAuthServer:
+	default:
+		return trace.BadParameter("unsupported auth server address mode: %d", cfg.AuthServerAddressMode)
+	}
+
+	if cfg.StaticProxyAddress && cfg.AddressKind != AddressKindProxy {
+		return trace.BadParameter("static proxy address requested (e.g. via the TBOT_USE_PROXY_ADDR environment variable) but no explicit proxy address was configured")
+	}
+
+	return nil
+}
+
+// AddressKind describes the type of address the user provided.
+type AddressKind string
+
+const (
+	// AddressKindUnspecified means the user did not provide an address.
+	AddressKindUnspecified AddressKind = ""
+
+	// AddressKindProxy means the user provided the `--proxy-server` flag or
+	// `proxy_server` config option.
+	AddressKindProxy AddressKind = "proxy"
+
+	// AddressKindAuth means the user provided the `--auth-server` flag or
+	// `auth_server` config option.
+	AddressKindAuth AddressKind = "auth"
+)
+
+// AuthServerAddressMode controls the behavior when a proxy address is given
+// as an auth server address.
+type AuthServerAddressMode int
+
+const (
+	// AuthServerMustBeAuthServer means that only an actual auth server address
+	// may be given.
+	AuthServerMustBeAuthServer AuthServerAddressMode = iota
+
+	// WarnIfAuthServerIsProxy means that a proxy address will be accepted as an
+	// auth server address, but we will log a warning that this is going away in
+	// v19.
+	WarnIfAuthServerIsProxy
+
+	// AllowProxyAsAuthServer means that a proxy address will be accepted as an
+	// auth server address.
+	AllowProxyAsAuthServer
+)
diff --git a/lib/tbot/bot/connection/ping.go b/lib/tbot/bot/connection/ping.go
new file mode 100644
index 0000000000000..f63e39ee9dc87
--- /dev/null
+++ b/lib/tbot/bot/connection/ping.go
@@ -0,0 +1,73 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package connection
+
+import (
+	"context"
+	"net"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client/webclient"
+)
+
+// ProxyPinger can be used to ping the proxy or auth server to discover connection
+// information (e.g. whether TLS routing is enabled).
+type ProxyPinger interface {
+	// Ping the proxy.
+	Ping(ctx context.Context) (*ProxyPong, error)
+}
+
+// ProxyPong is the response of a proxy ping request.
+type ProxyPong struct {
+	*webclient.PingResponse
+
+	// StaticProxyAddress is the user-configured proxy address when the user
+	// requests their given address is preferred over pinging the proxy or auth
+	// server.
+	StaticProxyAddress string
+}
+
+// ProxyWebAddr returns the address to use to connect to the proxy web port.
+// In TLS routing mode, this address should be used for most/all connections.
+// This function takes into account the TBOT_USE_PROXY_ADDR environment
+// variable, which can be used to force the use of the proxy address explicitly
+// provided by the user rather than use the one fetched from the proxy ping.
+func (p *ProxyPong) ProxyWebAddr() (string, error) {
+	if p.StaticProxyAddress != "" {
+		return p.StaticProxyAddress, nil
+	}
+	return p.Proxy.SSH.PublicAddr, nil
+}
+
+// ProxySSHAddr returns the address to use to connect to the proxy SSH service.
+// Includes potential override via TBOT_USE_PROXY_ADDR.
+func (p *ProxyPong) ProxySSHAddr() (string, error) {
+	if p.Proxy.TLSRoutingEnabled && p.StaticProxyAddress != "" {
+		return p.StaticProxyAddress, nil
+	}
+	// SSHProxyHostPort returns the host and port to use to connect to the
+	// proxy's SSH service. If TLS routing is enabled, this will return the
+	// proxy's web address, if not, the proxy SSH listener.
+	host, port, err := p.Proxy.SSHProxyHostPort()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return net.JoinHostPort(host, port), nil
+}
diff --git a/lib/tbot/bot/credential_lifetime.go b/lib/tbot/bot/credential_lifetime.go
new file mode 100644
index 0000000000000..53f1b6bcaaf58
--- /dev/null
+++ b/lib/tbot/bot/credential_lifetime.go
@@ -0,0 +1,140 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+// DefaultCredentialLifetime are the default TTL and RenewalInterval values for
+// the bot's credentials.
+var DefaultCredentialLifetime = CredentialLifetime{
+	TTL:             60 * time.Minute,
+	RenewalInterval: 20 * time.Minute,
+}
+
+// CredentialLifetime contains configuration for how long credentials will
+// last (TTL) and the frequency at which they'll be renewed (RenewalInterval).
+//
+// It's a member on the BotConfig and service/output config structs, marked with
+// the `inline` YAML tag so its fields become individual fields in the YAML
+// config format.
+type CredentialLifetime struct {
+	TTL             time.Duration `yaml:"credential_ttl,omitempty"`
+	RenewalInterval time.Duration `yaml:"renewal_interval,omitempty"`
+
+	// SkipMaxTTLValidation is used by services that do not abide by standard
+	// teleport credential lifetime limits to override the check that the
+	// user specified TTL is less than the max TTL. For example, X509 SVIDs can
+	// be issued with a lifetime of up to 2 weeks.
+	SkipMaxTTLValidation bool `yaml:"-"`
+}
+
+// IsEmpty returns whether none of the fields is set (i.e. it is unconfigured).
+func (l CredentialLifetime) IsEmpty() bool {
+	// We don't care about this field being set when checking empty state.
+	l.SkipMaxTTLValidation = false
+	return l == CredentialLifetime{}
+}
+
+// Validate checks whether the combination of the fields is valid.
+func (l CredentialLifetime) Validate(oneShot bool) error {
+	if l.IsEmpty() {
+		return nil
+	}
+
+	if l.TTL == 0 || l.RenewalInterval == 0 {
+		return trace.BadParameter("credential_ttl and renewal_interval must both be specified if either is")
+	}
+
+	if l.TTL < 0 {
+		return trace.BadParameter("credential_ttl must be positive")
+	}
+
+	if l.RenewalInterval < 0 {
+		return trace.BadParameter("renewal_interval must be positive")
+	}
+
+	if l.TTL < l.RenewalInterval && !oneShot {
+		return SuboptimalCredentialTTLError{
+			msg: "Credential TTL is shorter than the renewal interval. This is likely an invalid configuration. Increase the credential TTL or decrease the renewal interval",
+			details: map[string]any{
+				"ttl":      l.TTL,
+				"interval": l.RenewalInterval,
+			},
+		}
+	}
+
+	if !l.SkipMaxTTLValidation && l.TTL > defaults.MaxRenewableCertTTL {
+		return SuboptimalCredentialTTLError{
+			msg: "Requested certificate TTL exceeds the maximum TTL allowed and will likely be reduced by the Teleport server",
+			details: map[string]any{
+				"requested_ttl": l.TTL,
+				"maximum_ttl":   defaults.MaxRenewableCertTTL,
+			},
+		}
+	}
+
+	return nil
+}
+
+// SuboptimalCredentialTTLError is returned from CredentialLifetime.Validate
+// when the user has set CredentialTTL to something unusual that we can work
+// around (e.g. if they exceed MaxRenewableCertTTL the server will reduce it)
+// rather than rejecting their configuration.
+//
+// In the future, these probably *should* be hard failures - but that would be
+// a breaking change.
+type SuboptimalCredentialTTLError struct {
+	msg     string
+	details map[string]any
+}
+
+// Error satisfies the error interface.
+func (e SuboptimalCredentialTTLError) Error() string {
+	if len(e.details) == 0 {
+		return e.msg
+	}
+	parts := make([]string, 0, len(e.details))
+	for k, v := range e.details {
+		parts = append(parts, fmt.Sprintf("%s=%v", k, v))
+	}
+	return fmt.Sprintf("%s (%s)", e.msg, strings.Join(parts, ", "))
+}
+
+// Message returns the error message without details.
+func (e SuboptimalCredentialTTLError) Message() string {
+	return e.msg
+}
+
+// LogLabels returns the error's details as a slice that can be passed as the
+// varadic args parameter to log functions.
+func (e SuboptimalCredentialTTLError) LogLabels() []any {
+	labels := make([]any, 0, len(e.details)*2)
+	for k, v := range e.details {
+		labels = append(labels, k, v)
+	}
+	return labels
+}
diff --git a/lib/tbot/bot/credential_lifetime_test.go b/lib/tbot/bot/credential_lifetime_test.go
new file mode 100644
index 0000000000000..e23cda7a4c5a5
--- /dev/null
+++ b/lib/tbot/bot/credential_lifetime_test.go
@@ -0,0 +1,74 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+func TestCredentialLifetimeValidate(t *testing.T) {
+	testCases := map[string]struct {
+		cfg     bot.CredentialLifetime
+		oneShot bool
+		error   string
+	}{
+		"partial config": {
+			cfg:   bot.CredentialLifetime{TTL: 1 * time.Minute},
+			error: "credential_ttl and renewal_interval must both be specified if either is",
+		},
+		"negative TTL": {
+			cfg:   bot.CredentialLifetime{TTL: -time.Minute, RenewalInterval: time.Minute},
+			error: "credential_ttl must be positive",
+		},
+		"negative renewal interval": {
+			cfg:   bot.CredentialLifetime{TTL: time.Minute, RenewalInterval: -time.Minute},
+			error: "renewal_interval must be positive",
+		},
+		"TTL less than renewal interval": {
+			cfg:   bot.CredentialLifetime{TTL: time.Minute, RenewalInterval: 2 * time.Minute},
+			error: "TTL is shorter than the renewal interval",
+		},
+		"TTL less than renewal interval (one-shot)": {
+			cfg:     bot.CredentialLifetime{TTL: time.Minute, RenewalInterval: 2 * time.Minute},
+			oneShot: true,
+			error:   "",
+		},
+		"TTL too long": {
+			cfg:   bot.CredentialLifetime{TTL: defaults.MaxRenewableCertTTL * 2, RenewalInterval: time.Minute},
+			error: "TTL exceeds the maximum TTL allowed",
+		},
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := tc.cfg.Validate(tc.oneShot)
+
+			if tc.error == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, tc.error)
+			}
+		})
+	}
+}
diff --git a/lib/tbot/bot/destination.go b/lib/tbot/bot/destination.go
deleted file mode 100644
index ab1d6b4310106..0000000000000
--- a/lib/tbot/bot/destination.go
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package bot
-
-import (
-	"context"
-	"fmt"
-)
-
-// Destination can persist renewable certificates.
-type Destination interface {
-	// Init attempts to initialize this destination for use. Init should be
-	// idempotent and may write informational log messages if resources are
-	// created.
-	// This must be called before Read or Write.
-	Init(ctx context.Context, subdirs []string) error
-
-	// Verify is run before renewals to check for any potential problems with
-	// the destination. These errors may be informational (logged warnings) or
-	// return an error that may potentially terminate the process.
-	Verify(keys []string) error
-
-	// Write stores data to the destination with the given name.
-	Write(ctx context.Context, name string, data []byte) error
-
-	// Read fetches data from the destination with a given name.
-	Read(ctx context.Context, name string) ([]byte, error)
-
-	// TryLock attempts to lock a destination. This is non-blocking, and will
-	// return an error if it is not possible to lock the destination.
-	// TryLock should be used to lock a destination so it cannot be used by
-	// multiple processes of tbot concurrently.
-	TryLock() (func() error, error)
-
-	// CheckAndSetDefaults validates the configuration and sets any defaults.
-	//
-	// This must be called before other methods on Destination can be called.
-	CheckAndSetDefaults() error
-
-	// MarshalYAML enables the yaml package to correctly marshal the Destination
-	// as YAML including the type header.
-	MarshalYAML() (interface{}, error)
-
-	// IsPersistent indicates whether this destination is persistent.
-	// This is true for most production destinations, but will be false for
-	// Nop or Memory destinations.
-	IsPersistent() bool
-
-	// Stringer so that Destination's implements fmt.Stringer which allows for
-	// better logging.
-	fmt.Stringer
-}
diff --git a/lib/tbot/bot/destination/bound_keypair_adapter.go b/lib/tbot/bot/destination/bound_keypair_adapter.go
new file mode 100644
index 0000000000000..e7ad3702a1bf4
--- /dev/null
+++ b/lib/tbot/bot/destination/bound_keypair_adapter.go
@@ -0,0 +1,53 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+)
+
+// BoundKeypairBotFSAdapter is an adapter to use bot destinations with the FS
+// abstraction for bound keypair joining. This allows keypair and state storage
+// to be written to all supported bot destination types.
+type BoundKeypairDestinationAdapter struct {
+	destination Destination
+}
+
+func (f *BoundKeypairDestinationAdapter) Read(ctx context.Context, name string) ([]byte, error) {
+	bytes, err := f.destination.Read(ctx, name)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return bytes, nil
+}
+
+func (f *BoundKeypairDestinationAdapter) Write(ctx context.Context, name string, data []byte) error {
+	return trace.Wrap(f.destination.Write(ctx, name, data))
+}
+
+// NewBoundkeypairDestinationAdapter creates a new destination adapter for bound
+// keypair loading and storage.
+func NewBoundkeypairDestinationAdapter(d Destination) *BoundKeypairDestinationAdapter {
+	return &BoundKeypairDestinationAdapter{
+		destination: d,
+	}
+}
diff --git a/lib/tbot/bot/destination/destination.go b/lib/tbot/bot/destination/destination.go
new file mode 100644
index 0000000000000..7e4107da71a9c
--- /dev/null
+++ b/lib/tbot/bot/destination/destination.go
@@ -0,0 +1,78 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+	"fmt"
+
+	"go.opentelemetry.io/otel"
+
+	"github.com/gravitational/teleport"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var (
+	log    = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentTBot)
+	tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/bot/destination")
+)
+
+// Destination can persist renewable certificates.
+type Destination interface {
+	// Init attempts to initialize this destination for use. Init should be
+	// idempotent and may write informational log messages if resources are
+	// created.
+	// This must be called before Read or Write.
+	Init(ctx context.Context, subdirs []string) error
+
+	// Verify is run before renewals to check for any potential problems with
+	// the destination. These errors may be informational (logged warnings) or
+	// return an error that may potentially terminate the process.
+	Verify(keys []string) error
+
+	// Write stores data to the destination with the given name.
+	Write(ctx context.Context, name string, data []byte) error
+
+	// Read fetches data from the destination with a given name.
+	Read(ctx context.Context, name string) ([]byte, error)
+
+	// TryLock attempts to lock a destination. This is non-blocking, and will
+	// return an error if it is not possible to lock the destination.
+	// TryLock should be used to lock a destination so it cannot be used by
+	// multiple processes of tbot concurrently.
+	TryLock() (func() error, error)
+
+	// CheckAndSetDefaults validates the configuration and sets any defaults.
+	//
+	// This must be called before other methods on Destination can be called.
+	CheckAndSetDefaults() error
+
+	// MarshalYAML enables the yaml package to correctly marshal the Destination
+	// as YAML including the type header.
+	MarshalYAML() (interface{}, error)
+
+	// IsPersistent indicates whether this destination is persistent.
+	// This is true for most production destinations, but will be false for
+	// Nop or Memory destinations.
+	IsPersistent() bool
+
+	// Stringer so that Destination's implements fmt.Stringer which allows for
+	// better logging.
+	fmt.Stringer
+}
diff --git a/lib/tbot/bot/destination/directory.go b/lib/tbot/bot/destination/directory.go
new file mode 100644
index 0000000000000..99cb8a81d4611
--- /dev/null
+++ b/lib/tbot/bot/destination/directory.go
@@ -0,0 +1,489 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/user"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel/attribute"
+	oteltrace "go.opentelemetry.io/otel/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const DirectoryType = "directory"
+
+// Directory is a Destination that writes to the local filesystem
+type Directory struct {
+	Path     string               `yaml:"path,omitempty"`
+	Symlinks botfs.SymlinksMode   `yaml:"symlinks,omitempty"`
+	ACLs     botfs.ACLMode        `yaml:"acls,omitempty"`
+	Readers  []*botfs.ACLSelector `yaml:"readers,omitempty"`
+
+	// aclsEnabled is set during `Init()` if new-style ACLs are requested and
+	// the ACL test succeeds. When true, ACLs will be corrected on-the-fly
+	// during `Write()`.
+	aclsEnabled bool
+}
+
+func (dd *Directory) UnmarshalYAML(node *yaml.Node) error {
+	// Accept either a string path or a full struct (allowing for options in
+	// the future, e.g. configuring permissions, etc):
+	//   directory: /foo
+	// or:
+	//   directory:
+	//     path: /foo
+	//     some_future_option: bar
+
+	var path string
+	if err := node.Decode(&path); err == nil {
+		dd.Path = path
+		return nil
+	}
+
+	// Shenanigans to prevent UnmarshalYAML from recursing back to this
+	// override (we want to use standard unmarshal behavior for the full
+	// struct)
+	type rawDirectory Directory
+	return trace.Wrap(node.Decode((*rawDirectory)(dd)))
+}
+
+func (dd *Directory) CheckAndSetDefaults() error {
+	if dd.Path == "" {
+		return trace.BadParameter("destination path must not be empty")
+	}
+
+	for i, reader := range dd.Readers {
+		if err := reader.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err, "reader entry %d is invalid", i)
+		}
+	}
+
+	switch dd.Symlinks {
+	case "":
+		// We default to SymlinksTrySecure. It's become apparent that the
+		// kernel version alone is not usually enough information to know that
+		// secure symlinks is supported by the OS. In future, we should aim to
+		// perform a more definitive test.
+		dd.Symlinks = botfs.SymlinksTrySecure
+	case botfs.SymlinksInsecure, botfs.SymlinksTrySecure:
+		// valid
+	case botfs.SymlinksSecure:
+		if !botfs.HasSecureWriteSupport() {
+			return trace.BadParameter("symlink mode %q not supported on this system", dd.Symlinks)
+		}
+	default:
+		return trace.BadParameter("invalid symlinks mode: %q", dd.Symlinks)
+	}
+
+	aclsSupported := botfs.HasACLSupport()
+	switch dd.ACLs {
+	case "":
+		if aclsSupported {
+			// Unlike openat2(), we can't ever depend on ACLs being available.
+			// We'll only ever try to use them, end users can opt-in to a hard
+			// ACL check if they wish.
+			dd.ACLs = botfs.ACLTry
+		} else {
+			// if aclsSupported == false here, we know it will never work, so
+			// don't bother trying.
+			dd.ACLs = botfs.ACLOff
+		}
+	case botfs.ACLOff, botfs.ACLTry:
+		// valid
+	case botfs.ACLRequired:
+		if !aclsSupported {
+			return trace.BadParameter("acls mode %q not supported on this system", dd.ACLs)
+		}
+	default:
+		return trace.BadParameter("invalid acls mode: %q", dd.ACLs)
+	}
+
+	return nil
+}
+
+// mkdir attempts to make the given directory with extra logging.
+func mkdir(p string) error {
+	stat, err := os.Stat(p)
+	if trace.IsNotFound(err) {
+		if err := os.MkdirAll(p, botfs.DefaultDirMode); err != nil {
+			if errors.Is(err, fs.ErrPermission) {
+				return trace.Wrap(err, "Teleport does not have permission to write to %v. Ensure that you are running as a user with appropriate permissions.", p)
+			}
+			return trace.Wrap(err)
+		}
+
+		log.InfoContext(
+			context.TODO(),
+			"Created directory",
+			"path", p,
+		)
+	} else if err != nil {
+		// this can occur if we are unable to read the data dir
+		if errors.Is(err, fs.ErrPermission) {
+			return trace.Wrap(err, "Teleport does not have permission to access: %v. Ensure that you are running as a user with appropriate permissions.", p)
+		}
+		return trace.Wrap(err)
+	} else if !stat.IsDir() {
+		return trace.BadParameter("Path %q already exists and is not a directory", p)
+	}
+
+	return nil
+}
+
+func (dd *Directory) Init(ctx context.Context, subdirs []string) error {
+	// Create the directory if needed.
+	if err := mkdir(dd.Path); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Check for ACL configuration and test to ensure support.
+	if len(dd.Readers) > 0 && dd.ACLs != botfs.ACLOff {
+		// Run a test to ensure we can actually make use of them.
+		if err := botfs.TestACL(dd.Path, dd.Readers); err != nil {
+			if dd.ACLs == botfs.ACLRequired {
+				return trace.Wrap(err, "ACLs were marked as required but the "+
+					"write test failed. Remove `acls: required` or resolve the "+
+					"underlying issue.")
+			}
+
+			const msg = "ACLs were requested but could not be configured, they " +
+				"will be disabled. To resolve this warning, ensure ACLs are " +
+				"supported and the directory is owned by the bot user, or " +
+				"remove any configured readers to disable ACLs"
+			log.WarnContext(
+				ctx,
+				msg,
+				"path", dd.Path,
+				"error", err,
+				"readers", dd.Readers,
+			)
+
+			dd.aclsEnabled = false
+		} else {
+			dd.aclsEnabled = true
+			log.InfoContext(
+				ctx,
+				"ACL test succeeded and will be configured at runtime",
+				"path", dd.Path,
+				"readers", len(dd.Readers),
+			)
+		}
+	}
+
+	if dd.aclsEnabled {
+		// Correct the base directory ACLs. Note that no default ACL is
+		// configured; we manage each file/subdirectory ACL manually.
+		if err := dd.verifyAndCorrectACL(ctx, ""); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	for _, dir := range subdirs {
+		if err := mkdir(path.Join(dd.Path, dir)); err != nil {
+			return trace.Wrap(err)
+		}
+
+		if dd.aclsEnabled {
+			if err := dd.verifyAndCorrectACL(ctx, dir); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// verifyLegacyACLs performs minor runtime verification of legacy-style ACLs,
+// where it is _not_ assumed that the destination is owned by the bot user.
+// This will not attempt to correct any issues, but will cause a hard failure if
+// `acls: required` is configured and issues are detected.
+func (dd *Directory) verifyLegacyACLs(keys []string) error {
+	currentUser, err := user.Current()
+	if err != nil {
+		// user.Current will fail if the user id does not exist in /etc/passwd
+		// as is the case with some containerized environments.
+		// TODO(noah): Switch to os.Getuid / handling UIDs directly.
+		if dd.ACLs == botfs.ACLRequired {
+			return trace.Wrap(err, "determining current user")
+		}
+		log.WarnContext(
+			context.TODO(),
+			"Unable to determine current user, ACLs will not be checked. To silence this warning, set ACL mode to `off`.",
+			"path", dd.Path,
+			"error", err,
+		)
+		return nil
+	}
+
+	errors := []error{}
+	for _, key := range keys {
+		path := filepath.Join(dd.Path, key)
+
+		errors = append(errors, botfs.VerifyLegacyACL(path, &botfs.ACLOptions{
+			BotUser: currentUser,
+		}))
+	}
+
+	// Unlike new-style ACLs, we'll allow hard fails here: we don't expect to
+	// be able to manage legacy ACLs at runtime and need to depend on them being
+	// correct from the start, so hard fails at this stage make sense.
+	aggregate := trace.NewAggregate(errors...)
+	if dd.ACLs == botfs.ACLRequired {
+		// Hard fail if ACLs are specifically requested and there are errors.
+		return aggregate
+	}
+
+	if aggregate != nil {
+		log.WarnContext(
+			context.TODO(),
+			"Destination has unexpected ACLs",
+			"path", dd.Path,
+			"errors", aggregate,
+		)
+	}
+
+	return nil
+}
+
+func (dd *Directory) Verify(keys []string) error {
+	// Preflight: Warn on common misconfigurations where any kind of ACL
+	// management will be impossible.
+	if dd.ACLs == botfs.ACLOff {
+		if len(dd.Readers) > 0 {
+			log.InfoContext(
+				context.TODO(),
+				"Readers are configured but ACLs are disabled for this destination. No ACLs will be managed or verified.",
+				"path", dd.Path,
+			)
+		}
+		return nil
+	}
+
+	if !botfs.HasACLSupport() {
+		if dd.ACLs == botfs.ACLRequired {
+			return trace.BadParameter("ACLs are marked as required for destination %s but are not supported on this platform. Set `acls: off` to resolve this error.", dd.Path)
+		}
+
+		if len(dd.Readers) > 0 {
+			log.WarnContext(
+				context.TODO(),
+				"Readers are configured but this platform does not support filesystem ACLs. ACL management will be disabled.",
+				"path", dd.Path,
+			)
+		}
+	}
+
+	stat, err := os.Stat(dd.Path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Note: os.Getuid() returns -1 on Windows, but we've implicitly eliminated
+	// that as an option with the `botfs.HasACLSupport()` check above.
+	ownedByBot, err := botfs.IsOwnedBy(stat, os.Getuid())
+	if trace.IsNotImplemented(err) {
+		// If file owners aren't supported, ACLs certainly aren't. Just bail.
+		// (Subject to change if we ever try to support Windows ACLs.)
+		if dd.ACLs == botfs.ACLRequired {
+			return trace.NotImplemented("unable to determine file ownership on this platform but ACLs were marked as required, cannot continue")
+		}
+
+		log.WarnContext(
+			context.TODO(),
+			"unable to determine file ownership on this platform, ACL verification will be skipped",
+			"path", dd.Path,
+			"error", err,
+		)
+
+		return nil
+	} else if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Check for new-style ACL configuration. These explicitly require
+	// destinations to be owned by the bot user. This is somewhat arbitrarily
+	// here instead of in Init() and will run before each write attempt.
+	if len(dd.Readers) > 0 {
+		if !ownedByBot {
+			const msg = "This destination is not owned by the bot user so ACLs " +
+				"will not be enforced. To silence this warning, fix destination " +
+				"file ownership or remove configured `readers`"
+			log.WarnContext(
+				context.TODO(),
+				msg,
+				"path", dd.Path,
+			)
+
+			return nil
+		}
+
+		return nil
+	}
+
+	// For legacy ACLs, make sure it's worth warning about them. If the
+	// destination is owned by the bot (implying the user is not trying to use
+	// ACLs), just bail.
+	if ownedByBot {
+		return nil
+	}
+
+	return trace.Wrap(dd.verifyLegacyACLs(keys))
+}
+
+// verifyAndCorrectACL performs validation and attempts correction on new-style
+// ACLs when configured.
+//
+//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
+func (dd *Directory) verifyAndCorrectACL(ctx context.Context, subpath string) error {
+	p := filepath.Join(dd.Path, subpath)
+
+	// As a sanity check, try to ensure the resulting path is (lexically) a
+	// child of this destination.
+	if !strings.HasPrefix(p, filepath.Clean(dd.Path)) {
+		return trace.BadParameter("path %s is not a child of destination %s", p, dd.Path)
+	}
+
+	log.DebugContext(ctx, "verifying ACL", "path", p)
+	issues, err := botfs.VerifyACL(p, dd.Readers)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// If issues exist, attempt remediation. As the test during `Init()`
+	// passed, regardless of ACL mode (try, required), treat all errors here
+	// as hard failures.
+	if len(issues) > 0 {
+		if err := botfs.ConfigureACL(p, dd.Readers); err != nil {
+			return trace.Wrap(err, "unable to fix misconfigured ACL at path %s with issues %v", p, issues)
+		}
+
+		log.InfoContext(
+			ctx,
+			"corrected ACLs on destination file",
+			"destination", dd.Path,
+			"path", subpath,
+			"issues", issues,
+		)
+	}
+
+	return nil
+}
+
+func (dd *Directory) Write(ctx context.Context, name string, data []byte) error {
+	_, span := tracer.Start(
+		ctx,
+		"Directory/Write",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	// If there are any parent directories, attempt to mkdir them again in case
+	// things have drifted since `Init()` was run. We don't bother with secure
+	// botfs.Create() since it's a no-op for directory creation.
+	if dir, _ := filepath.Split(name); dir != "" {
+		dirPath := filepath.Join(dd.Path, dir)
+		if err := mkdir(dirPath); err != nil {
+			return trace.Wrap(err, "creating directory %q", dirPath)
+		}
+	}
+
+	path := filepath.Join(dd.Path, name)
+
+	// We can't configure permissions on a file that doesn't exist, so attempt
+	// to read the file first to determine if it exists, and create it if
+	// necessary.
+	_, err := botfs.Read(path, dd.Symlinks)
+	if trace.IsNotFound(err) {
+		log.DebugContext(ctx, "file is missing, creating to apply permissions", "path", path)
+		if err := botfs.Create(path, false, dd.Symlinks); err != nil {
+			return trace.Wrap(err)
+		}
+	} else if err != nil {
+		return trace.Wrap(err, "reading %q", path)
+	}
+
+	if dd.aclsEnabled {
+		// Sequentially check all subdirectory ACLs.
+		dirs := strings.Split(name, string(os.PathSeparator))
+		for i := 1; i < len(dirs); i++ {
+			// note: filepath.Join() will call `filepath.Clean()` on each result
+			if err := dd.verifyAndCorrectACL(ctx, filepath.Join(dirs[:i]...)); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+
+		if err := dd.verifyAndCorrectACL(ctx, name); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return trace.Wrap(botfs.Write(path, data, dd.Symlinks), "writing %q", path)
+}
+
+func (dd *Directory) Read(ctx context.Context, name string) ([]byte, error) {
+	_, span := tracer.Start(
+		ctx,
+		"Directory/Read",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	artifactPath := filepath.Join(dd.Path, name)
+	data, err := botfs.Read(artifactPath, dd.Symlinks)
+	if err != nil {
+		return nil, trace.Wrap(err, "reading %q", artifactPath)
+	}
+
+	return data, nil
+}
+
+func (dd *Directory) String() string {
+	return fmt.Sprintf("%s: %s", DirectoryType, dd.Path)
+}
+
+func (dd *Directory) TryLock() (func() error, error) {
+	// TryLock should only be used for bot data directory and not for
+	// destinations until an investigation on how locks will play with
+	// ACLs has been completed.
+	lockPath := filepath.Join(dd.Path, "lock")
+	unlock, err := utils.FSTryWriteLock(lockPath)
+	return unlock, trace.Wrap(err, "locking %q", lockPath)
+}
+
+func (dm *Directory) MarshalYAML() (any, error) {
+	type raw Directory
+	return encoding.WithTypeHeader((*raw)(dm), DirectoryType)
+}
+
+func (dd *Directory) IsPersistent() bool {
+	return true
+}
diff --git a/lib/tbot/bot/destination/directory_test.go b/lib/tbot/bot/destination/directory_test.go
new file mode 100644
index 0000000000000..6d61bc2404dfc
--- /dev/null
+++ b/lib/tbot/bot/destination/directory_test.go
@@ -0,0 +1,160 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TestDestinationDirectory_Lock(t *testing.T) {
+	dd := &Directory{
+		Path:     t.TempDir(),
+		Symlinks: botfs.SymlinksInsecure,
+		ACLs:     botfs.ACLOff,
+	}
+
+	// Successful lock
+	unlock, err := dd.TryLock()
+	require.NoError(t, err)
+
+	// Another lock should fail
+	_, err = dd.TryLock()
+	require.ErrorIs(t, err, utils.ErrUnsuccessfulLockTry)
+
+	// Release the lock
+	require.NoError(t, unlock())
+
+	// Trying to lock again should succeed
+	unlock, err = dd.TryLock()
+	require.NoError(t, err)
+
+	// Release the lock
+	require.NoError(t, unlock())
+}
+
+func TestDestinationDirectory_YAML(t *testing.T) {
+	tests := []testYAMLCase[Directory]{
+		{
+			name: "full",
+			in: Directory{
+				Path:     "/my/path",
+				ACLs:     botfs.ACLRequired,
+				Symlinks: botfs.SymlinksSecure,
+			},
+		},
+		{
+			name: "minimal",
+			in: Directory{
+				Path: "/my/path",
+			},
+		},
+		{
+			name: "acl readers",
+			in: Directory{
+				Path: "/my/path",
+				ACLs: botfs.ACLRequired,
+				Readers: []*botfs.ACLSelector{
+					{
+						User: "foo",
+					},
+					{
+						Group: "123",
+					},
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestDestinationDirectory_ACLs(t *testing.T) {
+	if !botfs.HasACLSupport() {
+		t.Skipf("ACLs not supported on this host")
+	}
+
+	ctx := context.Background()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test")
+
+	dd := Directory{
+		Path: path,
+		ACLs: botfs.ACLRequired,
+		Readers: []*botfs.ACLSelector{
+			{
+				// We explicitly want to support nonexistent UIDs, so we'll pick
+				// an arbitrary UID we don't expect to exist. This particular
+				// value is outside the usual reserved ranges documented by
+				// Debian:
+				// https://www.debian.org/doc/debian-policy/ch-opersys.html#uid-and-gid-classes
+				User: "59123",
+			},
+		},
+	}
+	require.NoError(t, dd.CheckAndSetDefaults())
+
+	err := dd.Init(ctx, []string{"foo"})
+	if trace.IsNotImplemented(err) {
+		t.Skipf("ACLs were unexpectedly not supported: %+v", err)
+	}
+
+	require.NoError(t, err)
+
+	// An ACL should be configured for the root directory
+	issues, err := botfs.VerifyACL(path, dd.Readers)
+	require.NoError(t, err)
+	require.Empty(t, issues)
+
+	// Create an empty file to simulate an artifact. We explicitly want to
+	// observe ACL problems from a file created out-of-band, so that Write() can
+	// attempt to fix them.
+	artifactPath := filepath.Join(path, "foo", "bar")
+	f, err := os.Create(artifactPath)
+	require.NoError(t, err)
+	f.Close()
+
+	issues, err = botfs.VerifyACL(artifactPath, dd.Readers)
+	require.NoError(t, err)
+
+	// note, lib/tbot/botfs's TestCompareACL tests the specifics of an empty ACL
+	require.NotEmpty(t, issues)
+
+	err = dd.Write(ctx, "foo/bar", []byte("hello world"))
+	require.NoError(t, err)
+
+	// The previous issues should now be resolved.
+	issues, err = botfs.VerifyACL(artifactPath, dd.Readers)
+	require.NoError(t, err)
+	require.Empty(t, issues)
+
+	// Finally, try writing to a completely separate path to ensure Write()
+	// initializes new files with a sane ACL.
+	require.NoError(t, dd.Write(ctx, "baz", []byte("example")))
+	issues, err = botfs.VerifyACL(filepath.Join(path, "baz"), dd.Readers)
+	require.NoError(t, err)
+	require.Empty(t, issues)
+}
diff --git a/lib/tbot/bot/destination/helpers_test.go b/lib/tbot/bot/destination/helpers_test.go
new file mode 100644
index 0000000000000..16b7add998cbc
--- /dev/null
+++ b/lib/tbot/bot/destination/helpers_test.go
@@ -0,0 +1,61 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := bytes.NewBuffer(nil)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			// Now test unmarshalling to see if we get the same object back
+			decoder := yaml.NewDecoder(b)
+			var unmarshalled T
+			require.NoError(t, decoder.Decode(&unmarshalled))
+			require.Equal(t, tt.in, unmarshalled, "unmarshalling did not result in same object as input")
+		})
+	}
+}
diff --git a/lib/tbot/bot/destination/memory.go b/lib/tbot/bot/destination/memory.go
new file mode 100644
index 0000000000000..2a082c471d774
--- /dev/null
+++ b/lib/tbot/bot/destination/memory.go
@@ -0,0 +1,139 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel/attribute"
+	oteltrace "go.opentelemetry.io/otel/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const MemoryType = "memory"
+
+// NewMemory returns an initialized and ready to use memory destination.
+func NewMemory() *Memory {
+	mem := &Memory{}
+	mem.CheckAndSetDefaults()
+	return mem
+}
+
+// Memory is a memory certificate Destination
+type Memory struct {
+	store map[string][]byte `yaml:"-"`
+	// mutex protects store in case other routines want to read its content
+	mutex sync.RWMutex
+}
+
+func (dm *Memory) UnmarshalYAML(node *yaml.Node) error {
+	// Accept either a bool or a raw (in this case empty) struct
+	//   memory: {}
+	// or:
+	//   memory: true
+
+	var boolVal bool
+	if err := node.Decode(&boolVal); err == nil {
+		if !boolVal {
+			return trace.BadParameter("memory must not be false (leave unset to disable)")
+		}
+		return nil
+	}
+
+	type rawMemory Memory
+	return trace.Wrap(node.Decode((*rawMemory)(dm)))
+}
+
+func (dm *Memory) CheckAndSetDefaults() error {
+	// Initialize the store but only if it is nil. This allows the memory
+	// destination to persist across multiple "Starts" of a bot.
+	if dm.store == nil {
+		dm.store = make(map[string][]byte)
+	}
+
+	return nil
+}
+
+func (dm *Memory) Init(_ context.Context, subdirs []string) error {
+	// Nothing to do.
+	return nil
+}
+
+func (dm *Memory) Verify(keys []string) error {
+	// Nothing to do.
+	return nil
+}
+
+func (dm *Memory) Write(ctx context.Context, name string, data []byte) error {
+	_, span := tracer.Start(
+		ctx,
+		"Memory/Write",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	dm.mutex.Lock()
+	defer dm.mutex.Unlock()
+	dm.store[name] = data
+
+	return nil
+}
+
+func (dm *Memory) Read(ctx context.Context, name string) ([]byte, error) {
+	_, span := tracer.Start(
+		ctx,
+		"Memory/Read",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	dm.mutex.RLock()
+	defer dm.mutex.RUnlock()
+	b, ok := dm.store[name]
+	if !ok {
+		return nil, trace.NotFound("not found: %s", name)
+	}
+
+	return b, nil
+}
+
+func (dm *Memory) String() string {
+	return MemoryType
+}
+
+func (dm *Memory) TryLock() (func() error, error) {
+	// As this is purely in-memory, no locking behavior is required for the
+	// Destination.
+	return func() error {
+		return nil
+	}, nil
+}
+
+func (dm *Memory) MarshalYAML() (any, error) {
+	type raw Memory
+	return encoding.WithTypeHeader((*raw)(dm), MemoryType)
+}
+
+func (dm *Memory) IsPersistent() bool {
+	return false
+}
diff --git a/lib/tbot/bot/destination/nop.go b/lib/tbot/bot/destination/nop.go
new file mode 100644
index 0000000000000..3a71b5629beb8
--- /dev/null
+++ b/lib/tbot/bot/destination/nop.go
@@ -0,0 +1,87 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package destination
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const NopType = "nop"
+
+// Nop does nothing! Useful for odd scenarios where a destination
+// has to be returned but there is none to return.
+type Nop struct{}
+
+// CheckAndSetDefaults does nothing! It is necessary to implement the
+// Destination interface.
+func (dm *Nop) CheckAndSetDefaults() error {
+	return nil
+}
+
+// Init does nothing! It is necessary to implement the Destination interface.
+func (dm *Nop) Init(_ context.Context, subdirs []string) error {
+	// Nothing to do.
+	return nil
+}
+
+// Verify does nothing! It is necessary to implement the Destination interface.
+func (dm *Nop) Verify(keys []string) error {
+	// Nothing to do.
+	return nil
+}
+
+// Write does nothing! It is necessary to implement the Destination interface.
+func (dm *Nop) Write(_ context.Context, name string, data []byte) error {
+	// Nothing to do.
+	return nil
+}
+
+// Read does nothing, it behaves as if the requested artifact could not be
+// found! It is necessary to implement the Destination interface.
+func (dm *Nop) Read(_ context.Context, name string) ([]byte, error) {
+	// Nothing to do.
+	return nil, trace.NotFound("reading from a nop destination results in no data")
+}
+
+// String returns a human-readable string that describes this instance.
+func (dm *Nop) String() string {
+	return NopType
+}
+
+// TryLock does nothing! It is necessary to implement the Destination interface.
+func (dm *Nop) TryLock() (func() error, error) {
+	return func() error {
+		return nil
+	}, nil
+}
+
+// MarshalYAML enables the yaml package to correctly marshal the Destination
+// as YAML including the type header.
+func (dm *Nop) MarshalYAML() (any, error) {
+	type raw Nop
+	return encoding.WithTypeHeader((*raw)(dm), NopType)
+}
+
+func (dm *Nop) IsPersistent() bool {
+	return false
+}
diff --git a/lib/tbot/config/testdata/TestDestinationDirectory_YAML/acl_readers.golden b/lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/acl_readers.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDestinationDirectory_YAML/acl_readers.golden
rename to lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/acl_readers.golden
diff --git a/lib/tbot/config/testdata/TestDestinationDirectory_YAML/full.golden b/lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDestinationDirectory_YAML/full.golden
rename to lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestDestinationDirectory_YAML/minimal.golden b/lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDestinationDirectory_YAML/minimal.golden
rename to lib/tbot/bot/destination/testdata/TestDestinationDirectory_YAML/minimal.golden
diff --git a/lib/tbot/bot/file_description.go b/lib/tbot/bot/file_description.go
new file mode 100644
index 0000000000000..4778af6502462
--- /dev/null
+++ b/lib/tbot/bot/file_description.go
@@ -0,0 +1,30 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+// FileDescription is a minimal spec needed to create an empty end-user-owned
+// file with bot-writable ACLs during `tbot init`.
+type FileDescription struct {
+	// Name is the name of the file or directory to create.
+	Name string
+
+	// IsDir designates whether this describes a subdirectory inside the
+	// Destination.
+	IsDir bool
+}
diff --git a/lib/tbot/bot/onboarding/config.go b/lib/tbot/bot/onboarding/config.go
new file mode 100644
index 0000000000000..e88c138c1a92e
--- /dev/null
+++ b/lib/tbot/bot/onboarding/config.go
@@ -0,0 +1,255 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package onboarding
+
+import (
+	"context"
+	"encoding/base64"
+	"log/slog"
+	"os"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// SupportedJoinMethods are the supported methods by which bots may join the
+// cluster.
+var SupportedJoinMethods = []string{
+	string(types.JoinMethodAzure),
+	string(types.JoinMethodAzureDevops),
+	string(types.JoinMethodBitbucket),
+	string(types.JoinMethodCircleCI),
+	string(types.JoinMethodGCP),
+	string(types.JoinMethodGitHub),
+	string(types.JoinMethodGitLab),
+	string(types.JoinMethodIAM),
+	string(types.JoinMethodKubernetes),
+	string(types.JoinMethodSpacelift),
+	string(types.JoinMethodToken),
+	string(types.JoinMethodTPM),
+	string(types.JoinMethodTerraformCloud),
+	string(types.JoinMethodOracle),
+	string(types.JoinMethodBoundKeypair),
+	string(types.JoinMethodEnv0),
+}
+
+const (
+	// registrationSecretEnv is an environment variable that contains a
+	// registration secret for bound keypair joining.
+	registrationSecretEnv = "TBOT_REGISTRATION_SECRET"
+
+	// BoundKeypairStaticKeyEnv is an env var that if set, contains a base64
+	// encoded private key (with a nested PEM encoded private key).
+	BoundKeypairStaticKeyEnv = "TBOT_BOUND_KEYPAIR_STATIC_KEY"
+)
+
+// AzureOnboardingConfig holds configuration relevant to the "azure" join method.
+type AzureOnboardingConfig struct {
+	// ClientID of the managed identity to use. Required if the VM has more
+	// than one assigned identity.
+	ClientID string `yaml:"client_id,omitempty"`
+}
+
+// TerraformOnboardingConfig contains parameters for the "terraform" join method
+type TerraformOnboardingConfig struct {
+	// TokenTag is the name of the tag configured via the environment variable
+	// `TERRAFORM_WORKLOAD_IDENTITY_AUDIENCE(_$TAG)`. If unset, the untagged
+	// variant is used.
+	AudienceTag string `yaml:"audience_tag,omitempty"`
+}
+
+// GitlabOnboardingConfig holds configuration relevant to the "gitlab" join method.
+type GitlabOnboardingConfig struct {
+	// TokenEnvVarName is the name of the environment variable that contains the
+	// GitLab ID token. This can be useful to override in cases where a single
+	// gitlab job needs to authenticate to multiple Teleport clusters.
+	TokenEnvVarName string `yaml:"token_env_var_name,omitempty"`
+}
+
+// BoundKeypairOnboardingConfig contains parameters for the `bound_keypair` join
+// method
+type BoundKeypairOnboardingConfig struct {
+	// RegistrationSecretValue is the name of the initial joining secret, if
+	// any. If not specified, a keypair must be created using `tbot keypair
+	// create` and registered with Teleport in advance. This can either be a
+	// static value or an absolute path to a file containing the secret value.
+	RegistrationSecretValue string `yaml:"registration_secret,omitempty"`
+
+	// RegistrationSecretPath is a path to a registration secret to be read from
+	// a file.
+	RegistrationSecretPath string `yaml:"registration_secret_path,omitempty"`
+
+	// StaticPrivateKeyPath is a static private key, containing either a path to
+	// a private key file. Unlike keys managed automatically in the bot storage,
+	// this will be treated as immutable. It must be preregistered, does not
+	// support rotation, and must be used with a token in `insecure` recovery
+	// mode.
+	StaticPrivateKeyPath string `yaml:"static_private_key_path,omitempty"`
+}
+
+// RegistrationSecret returns the registration secret, if set. If the value
+// appears to be an absolute filepath and points to a real file on the system,
+// the contents of that file will be returned; otherwise, the literal value is
+// returned. If `TBOT_REGISTRATION_SECRET` is set and neither explicit config
+// value is set (CLI, YAML) that value will be returned.
+func (c *BoundKeypairOnboardingConfig) RegistrationSecret() (string, error) {
+	if c.RegistrationSecretValue != "" && c.RegistrationSecretPath != "" {
+		return "", trace.BadParameter("only one of 'registration_secret' and 'registration_secret_path' may be set")
+	}
+
+	env, envExists := os.LookupEnv(registrationSecretEnv)
+
+	switch {
+	case c.RegistrationSecretPath != "":
+		if envExists {
+			slog.WarnContext(
+				context.Background(),
+				"'registration_secret_path' in tbot's configuration will override the value set in the environment",
+				"env", registrationSecretEnv,
+				"path", c.RegistrationSecretPath,
+			)
+		}
+
+		bytes, err := os.ReadFile(c.RegistrationSecretPath)
+		if err != nil {
+			return "", trace.ConvertSystemError(err)
+		}
+
+		slog.DebugContext(context.Background(), "loading registration secret from file", "path", c.RegistrationSecretPath)
+
+		return strings.TrimSpace(string(bytes)), nil
+	case c.RegistrationSecretValue != "":
+		if envExists {
+			slog.WarnContext(
+				context.Background(),
+				"'registration_secret' in tbot's configuration will override the value set in the environment",
+				"env", registrationSecretEnv,
+			)
+		}
+
+		slog.DebugContext(context.Background(), "using registration secret from config file or CLI")
+
+		return c.RegistrationSecretValue, nil
+	case envExists:
+		slog.DebugContext(context.Background(), "using registration secret from environment", "env", registrationSecretEnv)
+		return env, nil
+	default:
+		return "", nil
+	}
+}
+
+// StaticPrivateKeyBytes returns a statically configured private key for bound
+// keypair joining. If not nil, this value should be used as an immutable
+// `StaticClientState` instead of a traditional `FSClientState` which would
+// otherwise mutably write to the bot storage directory. These static keys do
+// not support rotation or join state verification.
+//
+// Users can either configure `static_private_key_path` in the bound keypair
+// onboarding config, or by inserting a base64-encoded private key (in PEM
+// format) into the `TBOT_BOUND_KEYPAIR_STATIC_KEY` environment variable. The
+// configuration value supersedes the environment variable if both are set.
+func (c *BoundKeypairOnboardingConfig) StaticPrivateKeyBytes() ([]byte, error) {
+	if c.StaticPrivateKeyPath != "" {
+		bytes, err := os.ReadFile(c.StaticPrivateKeyPath)
+		if err != nil {
+			return nil, trace.Wrap(err, "reading static key from %s", c.StaticPrivateKeyPath)
+		}
+
+		return bytes, nil
+	}
+
+	if env, envExists := os.LookupEnv(BoundKeypairStaticKeyEnv); envExists {
+		bytes, err := base64.StdEncoding.DecodeString(env)
+		if err != nil {
+			return nil, trace.Wrap(err, "decoding private key from environment")
+		}
+
+		return bytes, nil
+	}
+
+	return nil, nil
+}
+
+// Config contains values relevant to how the bot authenticates with
+// and joins the Teleport cluster.
+type Config struct {
+	// TokenValue is either the token needed to join the auth server, or a path pointing to a file
+	// that contains the token
+	//
+	// You should use Token() instead - this has to be an exported field for YAML unmarshaling
+	// to work correctly, but this could be a path instead of a token
+	TokenValue string `yaml:"token,omitempty"`
+
+	// CAPath is an optional path to a CA certificate.
+	CAPath string `yaml:"ca_path,omitempty"`
+
+	// CAPins is a list of certificate authority pins, used to validate the
+	// connection to the Teleport auth server.
+	CAPins []string `yaml:"ca_pins,omitempty"`
+
+	// JoinMethod is the method the bot should use to exchange a token for the
+	// initial certificate
+	JoinMethod types.JoinMethod `yaml:"join_method"`
+
+	// Azure holds configuration relevant to the azure joining method.
+	Azure AzureOnboardingConfig `yaml:"azure,omitempty"`
+
+	// Terraform holds configuration relevant to the `terraform` join method.
+	Terraform TerraformOnboardingConfig `yaml:"terraform,omitempty"`
+
+	// Gitlab holds configuration relevant to the `gitlab` join method.
+	Gitlab GitlabOnboardingConfig `yaml:"gitlab,omitempty"`
+
+	// BoundKeypair holds configuration relevant to the `bound_keypair` join method
+	BoundKeypair BoundKeypairOnboardingConfig `yaml:"bound_keypair,omitempty"`
+}
+
+// HasToken gives the ability to check if there has been a token value stored
+// in the config
+func (conf *Config) HasToken() bool {
+	return conf.TokenValue != ""
+}
+
+// SetToken stores the value for --token or auth_token in the config
+//
+// In the case of the token value pointing to a file, this allows us to
+// fetch the value of the token when it's needed (when connecting for the first time)
+// instead of trying to read the file every time that teleport is launched.
+// This means we can allow temporary token files that are removed after teleport has
+// successfully connected the first time.
+func (conf *Config) SetToken(token string) {
+	conf.TokenValue = token
+}
+
+// Token returns token needed to join the auth server
+//
+// If the value stored points to a file, it will attempt to read the token value from the file
+// and return an error if it wasn't successful
+// If the value stored doesn't point to a file, it'll return the value stored
+func (conf *Config) Token() (string, error) {
+	token, err := utils.TryReadValueAsFile(conf.TokenValue)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return token, nil
+}
diff --git a/lib/tbot/bot/service.go b/lib/tbot/bot/service.go
new file mode 100644
index 0000000000000..4b216117aff7d
--- /dev/null
+++ b/lib/tbot/bot/service.go
@@ -0,0 +1,228 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"golang.org/x/sync/errgroup"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// Service is a long-running sub-component of tbot.
+type Service interface {
+	// String returns a human-readable name for the service that can be used
+	// in logging. It should identify the type of the service and any top
+	// level configuration that could distinguish it from a same-type service.
+	String() string
+	// Run starts the service and blocks until the service exits. It should
+	// return a nil error if the service exits successfully and an error
+	// if it is unable to proceed. It should exit gracefully if the context
+	// is canceled.
+	Run(ctx context.Context) error
+}
+
+// OneShotService is a [Service] that offers a mode in which it runs a single
+// time and then exits. This aligns with the `--oneshot` mode of tbot.
+type OneShotService interface {
+	Service
+	// OneShot runs the service once and then exits. It should return a nil
+	// error if the service exits successfully and an error if it is unable
+	// to proceed. It should exit gracefully if the context is canceled.
+	OneShot(ctx context.Context) error
+}
+
+// ServiceDependencies will be constructed by the bot and passed to each service
+// constructor.
+type ServiceDependencies struct {
+	// Client that can be used to interact with the auth server.
+	Client *apiclient.Client
+
+	// Resolver that can be used to look up proxy addresses.
+	Resolver reversetunnelclient.Resolver
+
+	// Logger to which errors and messages can be written, with its component
+	// set to the name of the service.
+	Logger *slog.Logger
+
+	// ProxyPinger can be used to ping the proxy or auth server to discover
+	// connection information (e.g. whether TLS routing is enabled).
+	ProxyPinger connection.ProxyPinger
+
+	// IdentityGenerator can be used to generate "impersonated" identities.
+	IdentityGenerator *identity.Generator
+
+	// ClientBuilder can be used to build new API clients from impersonated
+	// identities.
+	ClientBuilder *client.Builder
+
+	// BotIdentity is a function that can be called to get the bot's internal
+	// identity.
+	BotIdentity func() *identity.Identity
+
+	// BotIdentityReadyCh is a channel on which the service can receive to block
+	// until the bot's internal identity has been renewed for the first time.
+	BotIdentityReadyCh <-chan struct{}
+
+	// ReloadCh is a channel on which the service can receive notifications that
+	// it's time to reload their certificates (e.g. following a CA rotation).
+	ReloadCh <-chan struct{}
+
+	// GetStatusReporter returns the reporter to which the service should report
+	// its health.
+	//
+	// If a ServiceBuilder calls GetStatusReporter the service's Run method *MUST*
+	// call Report or ReportReason (or if using internal.RunOnInterval pass it the
+	// reporter) otherwise it will delay the initial heartbeat and the `/readyz`
+	// endpoint will return 503.
+	//
+	// You do not have to do this in your service's OneShot method as the bot
+	// will automatically report oneshot service status based on its return value.
+	GetStatusReporter func() readyz.Reporter
+
+	// StatusRegistry can be used to read the health of the bot's services.
+	StatusRegistry readyz.ReadOnlyRegistry
+}
+
+// ServiceBuilder will be used by the bot to create a service.
+type ServiceBuilder interface {
+	// GetTypeAndName returns the service type and name.
+	GetTypeAndName() (string, string)
+
+	// Build the service using the given dependencies.
+	Build(ServiceDependencies) (Service, error)
+}
+
+// NewServiceBuilder creates a ServiceBuilder with the given service type, name
+// and build function.
+func NewServiceBuilder(
+	serviceType, name string,
+	buildFn func(ServiceDependencies) (Service, error),
+) ServiceBuilder {
+	if name == "" {
+		// The tbot binary will set default service names, so name could only
+		// realistically be empty if the bot were embedded somewhere else (e.g.
+		// the Terraform provider) in which case a randomly generated name is
+		// better than nothing.
+		//
+		// We do not handle the error from CryptoRandHex because the underlying
+		// call to rand.Read will never fail.
+		suffix, _ := utils.CryptoRandomHex(4)
+		name = fmt.Sprintf("%s-%s", serviceType, suffix)
+	}
+	return &serviceBuilder{
+		serviceType: serviceType,
+		name:        name,
+		buildFn:     buildFn,
+	}
+}
+
+type serviceBuilder struct {
+	serviceType, name string
+	buildFn           func(ServiceDependencies) (Service, error)
+}
+
+func (b *serviceBuilder) GetTypeAndName() (string, string)                { return b.serviceType, b.name }
+func (b *serviceBuilder) Build(deps ServiceDependencies) (Service, error) { return b.buildFn(deps) }
+
+// ServicePair combines two related Services.
+type ServicePair struct{ primary, secondary Service }
+
+// NewServicePair combines two related Services, the "primary" and its supporting
+// "secondary" service.
+func NewServicePair(primary, secondary Service) *ServicePair {
+	return &ServicePair{
+		primary:   primary,
+		secondary: secondary,
+	}
+}
+
+// String calls the primary service's String method.
+func (s *ServicePair) String() string {
+	return s.primary.String()
+}
+
+// Run the services in-parallel.
+func (s *ServicePair) Run(ctx context.Context) error {
+	group, groupCtx := errgroup.WithContext(ctx)
+	group.Go(func() error {
+		return s.primary.Run(groupCtx)
+	})
+	group.Go(func() error {
+		return s.secondary.Run(groupCtx)
+	})
+	return group.Wait()
+}
+
+// OneShotServicePair combines two related OneShotServices.
+type OneShotServicePair struct {
+	*ServicePair
+
+	primary, secondary OneShotService
+}
+
+// NewOneShotServicePair combines two related OneShotServices, the "primary" and
+// its supporting "secondary" service.
+func NewOneShotServicePair(primary, secondary OneShotService) *OneShotServicePair {
+	return &OneShotServicePair{
+		ServicePair: NewServicePair(primary, secondary),
+		primary:     primary,
+		secondary:   secondary,
+	}
+}
+
+// OneShot runs the services' OneShot methods in-parallel.
+func (s *OneShotServicePair) OneShot(ctx context.Context) error {
+	group, groupCtx := errgroup.WithContext(ctx)
+	group.Go(func() error {
+		return s.primary.OneShot(groupCtx)
+	})
+	group.Go(func() error {
+		return s.secondary.OneShot(groupCtx)
+	})
+	return group.Wait()
+}
+
+// NewNopService returns a service with the given name that does nothing at all.
+func NewNopService(name string) NopService {
+	return NopService{name: name}
+}
+
+// NopService is a service that does nothing at all.
+type NopService struct{ name string }
+
+func (n NopService) String() string { return n.name }
+
+// Run blocks until the given context is canceled.
+func (NopService) Run(ctx context.Context) error {
+	<-ctx.Done()
+	return nil
+}
+
+// OneShot returns nil immediately.
+func (NopService) OneShot(context.Context) error { return nil }
diff --git a/lib/tbot/bot/workload_identity.go b/lib/tbot/bot/workload_identity.go
new file mode 100644
index 0000000000000..c25931ccefdf8
--- /dev/null
+++ b/lib/tbot/bot/workload_identity.go
@@ -0,0 +1,49 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package bot
+
+import "github.com/gravitational/trace"
+
+// WorkloadIdentitySelector allows the user to select which WorkloadIdentity
+// resource should be used.
+//
+// Only one of Name or Labels can be set.
+type WorkloadIdentitySelector struct {
+	// Name is the name of a specific WorkloadIdentity resource.
+	Name string `yaml:"name"`
+	// Labels is a set of labels that the WorkloadIdentity resource must have.
+	Labels map[string][]string `yaml:"labels,omitempty"`
+}
+
+// CheckAndSetDefaults checks the WorkloadIdentitySelector values and sets any
+// defaults.
+func (s *WorkloadIdentitySelector) CheckAndSetDefaults() error {
+	switch {
+	case s.Name == "" && len(s.Labels) == 0:
+		return trace.BadParameter("one of ['name', 'labels'] must be set")
+	case s.Name != "" && len(s.Labels) > 0:
+		return trace.BadParameter("at most one of ['name', 'labels'] can be set")
+	}
+	for k, v := range s.Labels {
+		if len(v) == 0 {
+			return trace.BadParameter("labels[%s]: must have at least one value", k)
+		}
+	}
+	return nil
+}
diff --git a/lib/tbot/botfs/botfs.go b/lib/tbot/botfs/botfs.go
index dd834200836bd..6007f04859dda 100644
--- a/lib/tbot/botfs/botfs.go
+++ b/lib/tbot/botfs/botfs.go
@@ -66,12 +66,7 @@ const (
 
 	// ACLRequired enables ACL support and fails if ACLs are unavailable.
 	ACLRequired ACLMode = "required"
-)
-
-// OpenMode is a mode for opening files.
-type OpenMode int
 
-const (
 	// DefaultMode is the preferred permissions mode for bot files.
 	DefaultMode fs.FileMode = 0600
 
@@ -79,16 +74,32 @@ const (
 	// Directories need the execute bit set for most operations on their
 	// contents to succeed.
 	DefaultDirMode fs.FileMode = 0700
+)
 
-	// ReadMode is the mode with which files should be opened for reading and
-	// writing.
-	ReadMode OpenMode = OpenMode(os.O_CREATE | os.O_RDONLY)
+// OpenFlags is a bitmask containing flags passed to `open()`
+type OpenFlags int
 
-	// WriteMode is the mode with which files should be opened specifically
+const (
+	// ReadFlags contains `open()` flags to be used when opening files for
+	// reading. The file will be created if it does not exist, and reads should
+	// return an empty byte array.
+	ReadFlags = iota
+
+	// WriteFlags is the mode with which files should be opened specifically
 	// for writing.
-	WriteMode OpenMode = OpenMode(os.O_CREATE | os.O_WRONLY | os.O_TRUNC)
+	WriteFlags
 )
 
+// Flags returns opening flags for this OpenFlags variant.
+func (f OpenFlags) Flags() int {
+	switch f {
+	case WriteFlags:
+		return os.O_CREATE | os.O_WRONLY | os.O_TRUNC
+	default:
+		return os.O_RDONLY
+	}
+}
+
 // ACLOptions contains parameters needed to configure ACLs
 type ACLOptions struct {
 	// BotUser is the bot user that should have write access to this entry
@@ -124,10 +135,10 @@ func (s *ACLSelector) CheckAndSetDefaults() error {
 	return nil
 }
 
-// openStandard attempts to open the given path for reading and writing with
-// O_CREATE set.
-func openStandard(path string, mode OpenMode) (*os.File, error) {
-	file, err := os.OpenFile(path, int(mode), DefaultMode)
+// openStandard attempts to open the given path. The file may be writable
+// depending on the provided `OpenFlags` value.
+func openStandard(path string, flags OpenFlags) (*os.File, error) {
+	file, err := os.OpenFile(path, flags.Flags(), DefaultMode)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -146,7 +157,7 @@ func createStandard(path string, isDir bool) error {
 		return nil
 	}
 
-	f, err := openStandard(path, WriteMode)
+	f, err := openStandard(path, WriteFlags)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/tbot/botfs/fs_linux.go b/lib/tbot/botfs/fs_linux.go
index ff1ae6e7239db..fe20fc85796a7 100644
--- a/lib/tbot/botfs/fs_linux.go
+++ b/lib/tbot/botfs/fs_linux.go
@@ -28,7 +28,6 @@ import (
 	"io/fs"
 	"os"
 	"os/user"
-	"path/filepath"
 	"strconv"
 	"sync"
 	"syscall"
@@ -62,45 +61,62 @@ const modeACLNone fs.FileMode = 0
 // missingSyscallWarning is used to reduce log spam when a syscall is missing.
 var missingSyscallWarning sync.Once
 
-// openSecure opens the given path for writing (with O_CREAT, mode 0600)
-// with the RESOLVE_NO_SYMLINKS flag set.
-func openSecure(path string, mode OpenMode) (*os.File, error) {
+// openSecure opens the given path for either reading or writing with the
+// RESOLVE_NO_SYMLINKS flag set.
+func openSecure(path string, flags OpenFlags) (*os.File, error) {
+	var mode uint64
+	if flags != ReadFlags {
+		// openat2() with a nonzero mode will raise EINVAL unless O_CREATE or
+		// O_TMPFILE is set, so only set this in non-read mode.
+		mode = uint64(DefaultMode.Perm())
+	}
+
 	how := unix.OpenHow{
-		// Equivalent to 0600. Unfortunately it's not worth reusing our
-		// default file mode constant here.
-		Mode:    unix.O_RDONLY | unix.S_IRUSR | unix.S_IWUSR,
-		Flags:   uint64(mode),
+		Mode:    mode,
+		Flags:   uint64(flags.Flags()) | unix.O_CLOEXEC,
 		Resolve: unix.RESOLVE_NO_SYMLINKS,
 	}
 
-	fd, err := unix.Openat2(unix.AT_FDCWD, path, &how)
-	if err != nil {
-		// note: returning the original error here for comparison purposes
-		return nil, err
-	}
+	for {
+		fd, err := unix.Openat2(unix.AT_FDCWD, path, &how)
+		if errors.Is(err, syscall.EINTR) {
+			// Per the stdlib's implementation, EINTR errors should be ignored
+			// and retried.
+			continue
+		} else if err != nil {
+			// note: returning the original error here for comparison purposes
+			return nil, err
+		}
+
+		file := os.NewFile(uintptr(fd), path)
+		if file == nil {
+			// Probably useless since this implies the fd itself is invalid, but
+			// attempt to close the fd anyway.
+			_ = unix.Close(fd)
+			return nil, os.ErrInvalid
+		}
 
-	// os.File.Close() appears to close wrapped files sanely, so rely on that
-	// rather than relying on callers to use unix.Close(fd)
-	return os.NewFile(uintptr(fd), filepath.Base(path)), nil
+		return file, nil
+	}
 }
 
 // openSymlinks mode opens the file for read or write using the given symlink
 // mode, potentially failing or logging a warning if symlinks can't be
 // secured.
-func openSymlinksMode(path string, mode OpenMode, symlinksMode SymlinksMode) (*os.File, error) {
+func openSymlinksMode(path string, flags OpenFlags, symlinksMode SymlinksMode) (*os.File, error) {
 	var file *os.File
 	var err error
 
 	switch symlinksMode {
 	case SymlinksSecure:
-		file, err = openSecure(path, mode)
+		file, err = openSecure(path, flags)
 		if errors.Is(err, unix.ENOSYS) {
 			return nil, trace.Errorf("openSecure failed due to missing syscall; configure `symlinks: insecure` for %q", path)
 		} else if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	case SymlinksTrySecure:
-		file, err = openSecure(path, mode)
+		file, err = openSecure(path, flags)
 		if errors.Is(err, unix.ENOSYS) {
 			missingSyscallWarning.Do(func() {
 				log.DebugContext(
@@ -110,7 +126,7 @@ func openSymlinksMode(path string, mode OpenMode, symlinksMode SymlinksMode) (*o
 				)
 			})
 
-			file, err = openStandard(path, mode)
+			file, err = openStandard(path, flags)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -118,7 +134,7 @@ func openSymlinksMode(path string, mode OpenMode, symlinksMode SymlinksMode) (*o
 			return nil, trace.Wrap(err)
 		}
 	case SymlinksInsecure:
-		file, err = openStandard(path, mode)
+		file, err = openStandard(path, flags)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -144,7 +160,7 @@ func createSecure(path string, isDir bool) error {
 		return nil
 	}
 
-	f, err := openSecure(path, WriteMode)
+	f, err := openSecure(path, WriteFlags)
 	if errors.Is(err, unix.ENOSYS) {
 		// bubble up the original error for comparison
 		return err
@@ -217,7 +233,7 @@ func Create(path string, isDir bool, symlinksMode SymlinksMode) error {
 
 // Read reads the contents of the given file into memory.
 func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
-	file, err := openSymlinksMode(path, ReadMode, symlinksMode)
+	file, err := openSymlinksMode(path, ReadFlags, symlinksMode)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -234,7 +250,7 @@ func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
 
 // Write stores the given data to the file at the given path.
 func Write(path string, data []byte, symlinksMode SymlinksMode) error {
-	file, err := openSymlinksMode(path, WriteMode, symlinksMode)
+	file, err := openSymlinksMode(path, WriteFlags, symlinksMode)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/tbot/botfs/fs_unix.go b/lib/tbot/botfs/fs_unix.go
index 5e8596f5e2f5f..71d56f8b72516 100644
--- a/lib/tbot/botfs/fs_unix.go
+++ b/lib/tbot/botfs/fs_unix.go
@@ -60,7 +60,7 @@ func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
 		})
 	}
 
-	file, err := openStandard(path, ReadMode)
+	file, err := openStandard(path, ReadFlags)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -90,7 +90,7 @@ func Write(path string, data []byte, symlinksMode SymlinksMode) error {
 		})
 	}
 
-	file, err := openStandard(path, WriteMode)
+	file, err := openStandard(path, WriteFlags)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/tbot/botfs/fs_windows.go b/lib/tbot/botfs/fs_windows.go
index 75b72ce2a6a9a..298566a465c15 100644
--- a/lib/tbot/botfs/fs_windows.go
+++ b/lib/tbot/botfs/fs_windows.go
@@ -61,7 +61,7 @@ func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
 		})
 	}
 
-	file, err := openStandard(path, ReadMode)
+	file, err := openStandard(path, ReadFlags)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -91,7 +91,7 @@ func Write(path string, data []byte, symlinksMode SymlinksMode) error {
 		})
 	}
 
-	file, err := openStandard(path, WriteMode)
+	file, err := openStandard(path, WriteFlags)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/tbot/cli/cli.go b/lib/tbot/cli/cli.go
index c85ebbef47f87..38d06368a08c5 100644
--- a/lib/tbot/cli/cli.go
+++ b/lib/tbot/cli/cli.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -195,6 +196,8 @@ func LoadConfigWithMutators(globals *GlobalArgs, mutators ...ConfigMutator) (*co
 		return nil, trace.Wrap(err)
 	}
 
+	cfg.AuthServerAddressMode = connection.WarnIfAuthServerIsProxy
+
 	return cfg, nil
 }
 
diff --git a/lib/tbot/cli/cli_test.go b/lib/tbot/cli/cli_test.go
index 27b47ebe85f54..77b2f2c351bd0 100644
--- a/lib/tbot/cli/cli_test.go
+++ b/lib/tbot/cli/cli_test.go
@@ -26,7 +26,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -66,19 +68,19 @@ func TestConfigCLIOnlySample(t *testing.T) {
 	require.Equal(t, legacy.CAPins, cfg.Onboarding.CAPins)
 
 	// Storage is still default
-	storageImpl, ok := cfg.Storage.Destination.(*config.DestinationDirectory)
+	storageImpl, ok := cfg.Storage.Destination.(*destination.Directory)
 	require.True(t, ok)
 	require.Equal(t, config.GetDefaultStoragePath(), storageImpl.Path)
 
 	// A single default Destination should exist
 	require.Len(t, cfg.Services, 1)
 	output := cfg.Services[0]
-	identOutput, ok := output.(*config.IdentityOutput)
+	identOutput, ok := output.(*identity.OutputConfig)
 	require.True(t, ok)
 
 	destImpl := identOutput.GetDestination()
 	require.NoError(t, err)
-	destImplReal, ok := destImpl.(*config.DestinationDirectory)
+	destImplReal, ok := destImpl.(*destination.Directory)
 	require.True(t, ok)
 
 	require.Equal(t, legacy.DestinationDir, destImplReal.Path)
diff --git a/lib/tbot/cli/copy_binaries.go b/lib/tbot/cli/copy_binaries.go
new file mode 100644
index 0000000000000..e639866fa4956
--- /dev/null
+++ b/lib/tbot/cli/copy_binaries.go
@@ -0,0 +1,47 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cli
+
+// CopyBinariesCommand includes fields for `tbot copy-binaries`
+type CopyBinariesCommand struct {
+	*genericExecutorHandler[CopyBinariesCommand]
+
+	// IncludeFDPass specifies whether or not `fdpass-teleport` should be
+	// copied.
+	IncludeFDPass bool
+
+	// DestinationDir is the directory into which the tbot binary (and
+	// optionally fdpass) should be written.
+	DestinationDir string
+}
+
+// NewCopyBinariesCommand initializes the `tbot copy-binaries` subcommand and
+// its fields.
+func NewCopyBinariesCommand(app KingpinClause, action func(*CopyBinariesCommand) error) *CopyBinariesCommand {
+	cmd := app.Command("copy-binaries", "Copies this tbot binary to a given destination")
+	cmd.Interspersed(true)
+
+	c := &CopyBinariesCommand{}
+	c.genericExecutorHandler = newGenericExecutorHandler(cmd, c, action)
+
+	cmd.Flag("include-fdpass", "If set, also copy `fdpass-teleport`. It must be available in the same path as `tbot`.").BoolVar(&c.IncludeFDPass)
+	cmd.Arg("destination-dir", "The destination path to write the copy of the tbot binary").Required().StringVar(&c.DestinationDir)
+
+	return c
+}
diff --git a/lib/tbot/cli/keypair_create.go b/lib/tbot/cli/keypair_create.go
index 69df80948ac4f..2044db4177d34 100644
--- a/lib/tbot/cli/keypair_create.go
+++ b/lib/tbot/cli/keypair_create.go
@@ -18,16 +18,31 @@
 
 package cli
 
-import "github.com/gravitational/teleport"
+import (
+	"io"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
 
 // KeypairCreateCommand handles `tbot keypair create`
 type KeypairCreateCommand struct {
 	*genericExecutorHandler[KeypairCreateCommand]
 
-	ProxyServer string
-	Storage     string
-	Overwrite   bool
-	Format      string
+	ProxyServer   string
+	Storage       string
+	Overwrite     bool
+	Format        string
+	Static        bool
+	StaticKeyPath string
+
+	// GetSuite is an optional function to fetch crypto suites. Used to override
+	// in tests, may be nil.
+	GetSuite cryptosuites.GetSuiteFunc
+
+	// Writer is an optional writer to which output from this command should be
+	// written. If nil, stdout is used. Used in tests.
+	Writer io.Writer
 }
 
 // NewKeypairCreateCommand initializes the `keypair create` command and returns
@@ -38,10 +53,12 @@ func NewKeypairCreateCommand(parentCmd KingpinClause, action func(*KeypairCreate
 	c := &KeypairCreateCommand{}
 	c.genericExecutorHandler = newGenericExecutorHandler(cmd, c, action)
 
-	cmd.Flag("storage", "An internal storage URI to write the keypair, such as file:///var/lib/teleport/bot").Required().StringVar(&c.Storage)
+	cmd.Flag("storage", "An internal storage URI to write the keypair, such as file:///var/lib/teleport/bot").StringVar(&c.Storage)
 	cmd.Flag("proxy-server", "The proxy server, which will be pinged to determine the current cryptographic suite in use").Required().StringVar(&c.ProxyServer)
 	cmd.Flag("overwrite", "If set, overwrite any existing keypair. If unset and a keypair already exists, its key will be printed for use.").BoolVar(&c.Overwrite)
 	cmd.Flag("format", "Output format, one of: text, json").Default(teleport.Text).EnumVar(&c.Format, teleport.Text, teleport.JSON)
+	cmd.Flag("static", "If set, create a static private key instead of writing a mutable key into bot storage. If --static-key-path is unset, the key will be printed to the terminal.").BoolVar(&c.Static)
+	cmd.Flag("static-key-path", "If set, writes the static private key to a file.").StringVar(&c.StaticKeyPath)
 
 	return c
 }
diff --git a/lib/tbot/cli/start_application.go b/lib/tbot/cli/start_application.go
index eb3c2a4507655..a0a0c63c40e2b 100644
--- a/lib/tbot/cli/start_application.go
+++ b/lib/tbot/cli/start_application.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
 )
 
 // ApplicationCommand implements `tbot start application` and
@@ -67,7 +68,7 @@ func (c *ApplicationCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger)
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.ApplicationOutput{
+	cfg.Services = append(cfg.Services, &application.OutputConfig{
 		Destination:           dest,
 		AppName:               c.AppName,
 		SpecificTLSExtensions: c.SpecificTLSExtensions,
diff --git a/lib/tbot/cli/start_application_proxy.go b/lib/tbot/cli/start_application_proxy.go
new file mode 100644
index 0000000000000..0310fe9e3d544
--- /dev/null
+++ b/lib/tbot/cli/start_application_proxy.go
@@ -0,0 +1,65 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cli
+
+import (
+	"fmt"
+	"log/slog"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+)
+
+// ApplicationProxyCommand implements `tbot start application-proxy` and
+// `tbot configure application-proxy`.
+type ApplicationProxyCommand struct {
+	*sharedStartArgs
+	*genericMutatorHandler
+
+	Listen string
+}
+
+// NewApplicationProxyCommand initializes flags for an app proxy command and
+// returns a struct to contain the parse result.
+func NewApplicationProxyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode CommandMode) *ApplicationProxyCommand {
+	cmd := parentCmd.Command("application-proxy", fmt.Sprintf("%s tbot with an application proxy.", mode)).Alias("app-proxy")
+
+	c := &ApplicationProxyCommand{}
+	c.sharedStartArgs = newSharedStartArgs(cmd)
+	c.genericMutatorHandler = newGenericMutatorHandler(cmd, c, action)
+
+	cmd.Flag("listen", "A socket URI, such as tcp://0.0.0.0:8080").Required().StringVar(&c.Listen)
+
+	return c
+}
+
+func (c *ApplicationProxyCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error {
+	if err := c.sharedStartArgs.ApplyConfig(cfg, l); err != nil {
+		return trace.Wrap(err)
+	}
+
+	cfg.Services = append(cfg.Services, &application.ProxyServiceConfig{
+		Listen: c.Listen,
+	})
+
+	return nil
+}
diff --git a/lib/tbot/cli/start_application_proxy_test.go b/lib/tbot/cli/start_application_proxy_test.go
new file mode 100644
index 0000000000000..612a3c0979757
--- /dev/null
+++ b/lib/tbot/cli/start_application_proxy_test.go
@@ -0,0 +1,56 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+)
+
+// TestApplicationTunnelCommand tests that the ApplicationProxyCommand
+// properly parses its arguments and applies as expected onto a BotConfig.
+func TestApplicationProxyCommand(t *testing.T) {
+	testStartConfigureCommand(t, NewApplicationProxyCommand, []startConfigureTestCase{
+		{
+			name: "success",
+			args: []string{
+				"start",
+				"application-proxy",
+				"--token=foo",
+				"--join-method=github",
+				"--proxy-server=example.com:443",
+				"--listen=tcp://0.0.0.0:8000",
+			},
+			assertConfig: func(t *testing.T, cfg *config.BotConfig) {
+				require.Len(t, cfg.Services, 1)
+
+				// It must configure an app tunnel service
+				svc := cfg.Services[0]
+				appSvc, ok := svc.(*application.ProxyServiceConfig)
+				require.True(t, ok)
+
+				require.Equal(t, "tcp://0.0.0.0:8000", appSvc.Listen)
+			},
+		},
+	})
+}
diff --git a/lib/tbot/cli/start_application_test.go b/lib/tbot/cli/start_application_test.go
index 1d0b562621af1..ceaaaeab859fb 100644
--- a/lib/tbot/cli/start_application_test.go
+++ b/lib/tbot/cli/start_application_test.go
@@ -23,7 +23,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
 )
 
 // TestApplicationCommand tests that the ApplicationCommand properly parses its
@@ -45,13 +47,13 @@ func TestApplicationCommand(t *testing.T) {
 			assertConfig: func(t *testing.T, cfg *config.BotConfig) {
 				// It must configure a app output with a directory destination.
 				svc := cfg.Services[0]
-				appSvc, ok := svc.(*config.ApplicationOutput)
+				appSvc, ok := svc.(*application.OutputConfig)
 				require.True(t, ok)
 
 				require.Equal(t, "foo", appSvc.AppName)
 				require.True(t, appSvc.SpecificTLSExtensions)
 
-				dir, ok := appSvc.Destination.(*config.DestinationDirectory)
+				dir, ok := appSvc.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 			},
diff --git a/lib/tbot/cli/start_application_tunnel.go b/lib/tbot/cli/start_application_tunnel.go
index 3c005f4ca1cea..e96c33f39ea1c 100644
--- a/lib/tbot/cli/start_application_tunnel.go
+++ b/lib/tbot/cli/start_application_tunnel.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
 )
 
 // ApplicationTunnelCommand implements `tbot start application-tunnel` and
@@ -60,7 +61,7 @@ func (c *ApplicationTunnelCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Lo
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.ApplicationTunnelService{
+	cfg.Services = append(cfg.Services, &application.TunnelConfig{
 		Listen:  c.Listen,
 		AppName: c.AppName,
 	})
diff --git a/lib/tbot/cli/start_application_tunnel_test.go b/lib/tbot/cli/start_application_tunnel_test.go
index 049c18d9864a6..01e1cbe30b9c5 100644
--- a/lib/tbot/cli/start_application_tunnel_test.go
+++ b/lib/tbot/cli/start_application_tunnel_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
 )
 
 // TestApplicationTunnelCommand tests that the ApplicationTunnelCommand
@@ -46,7 +47,7 @@ func TestApplicationTunnelCommand(t *testing.T) {
 
 				// It must configure an app tunnel service
 				svc := cfg.Services[0]
-				appSvc, ok := svc.(*config.ApplicationTunnelService)
+				appSvc, ok := svc.(*application.TunnelConfig)
 				require.True(t, ok)
 
 				require.Equal(t, "foo", appSvc.AppName)
diff --git a/lib/tbot/cli/start_database.go b/lib/tbot/cli/start_database.go
index 794f72a18f243..3465c5cd4423b 100644
--- a/lib/tbot/cli/start_database.go
+++ b/lib/tbot/cli/start_database.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
 )
 
 // DatabaseCommand implements `tbot start database` and
@@ -51,7 +52,7 @@ func NewDatabaseCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode
 	c.sharedDestinationArgs = newSharedDestinationArgs(cmd)
 	c.genericMutatorHandler = newGenericMutatorHandler(cmd, c, action)
 
-	cmd.Flag("format", "The database output format if necessary").Default("").EnumVar(&c.Format, config.SupportedDatabaseFormatStrings()...)
+	cmd.Flag("format", "The database output format if necessary").Default("").EnumVar(&c.Format, database.SupportedDatabaseFormatStrings()...)
 	cmd.Flag("service", "The database service name").Required().StringVar(&c.Service)
 	cmd.Flag("username", "The database user name").Required().StringVar(&c.Username)
 	cmd.Flag("database", "The name of the database available in the requested database service").Required().StringVar(&c.Database)
@@ -69,9 +70,9 @@ func (c *DatabaseCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) err
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.DatabaseOutput{
+	cfg.Services = append(cfg.Services, &database.OutputConfig{
 		Destination: dest,
-		Format:      config.DatabaseFormat(c.Format),
+		Format:      database.DatabaseFormat(c.Format),
 		Username:    c.Username,
 		Database:    c.Database,
 		Service:     c.Service,
diff --git a/lib/tbot/cli/start_database_test.go b/lib/tbot/cli/start_database_test.go
index 89008d623ace8..b596106cd18ae 100644
--- a/lib/tbot/cli/start_database_test.go
+++ b/lib/tbot/cli/start_database_test.go
@@ -23,7 +23,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
 )
 
 // TestDatabaseCommand tests that the DatabaseCommand properly parses its
@@ -49,15 +51,15 @@ func TestDatabaseCommand(t *testing.T) {
 
 				// It must configure a database output with a directory destination.
 				svc := cfg.Services[0]
-				db, ok := svc.(*config.DatabaseOutput)
+				db, ok := svc.(*database.OutputConfig)
 				require.True(t, ok)
 
 				require.Equal(t, "foo", db.Service)
 				require.Equal(t, "bar", db.Username)
 				require.Equal(t, "baz", db.Database)
-				require.Equal(t, config.TLSDatabaseFormat, db.Format)
+				require.Equal(t, database.TLSDatabaseFormat, db.Format)
 
-				dir, ok := db.Destination.(*config.DestinationDirectory)
+				dir, ok := db.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 			},
diff --git a/lib/tbot/cli/start_database_tunnel.go b/lib/tbot/cli/start_database_tunnel.go
index 44f119d9381ce..3c1f635bdaa9a 100644
--- a/lib/tbot/cli/start_database_tunnel.go
+++ b/lib/tbot/cli/start_database_tunnel.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
 )
 
 // DatabaseTunnelCommand implements `tbot start database-tunnel` and
@@ -63,7 +64,7 @@ func (c *DatabaseTunnelCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logge
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.DatabaseTunnelService{
+	cfg.Services = append(cfg.Services, &database.TunnelConfig{
 		Listen:   c.Listen,
 		Username: c.Username,
 		Database: c.Database,
diff --git a/lib/tbot/cli/start_database_tunnel_test.go b/lib/tbot/cli/start_database_tunnel_test.go
index 7e15dc5fe2782..ceaaba459b32e 100644
--- a/lib/tbot/cli/start_database_tunnel_test.go
+++ b/lib/tbot/cli/start_database_tunnel_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
 )
 
 // TestDatabaseTunnelCommand tests that the DatabaseTunnelCommand
@@ -48,7 +49,7 @@ func TestDatabaseTunnelCommand(t *testing.T) {
 
 				// It must configure a db tunnel service
 				svc := cfg.Services[0]
-				db, ok := svc.(*config.DatabaseTunnelService)
+				db, ok := svc.(*database.TunnelConfig)
 				require.True(t, ok)
 
 				require.Equal(t, "tcp://0.0.0.0:8000", db.Listen)
diff --git a/lib/tbot/cli/start_identity.go b/lib/tbot/cli/start_identity.go
index 49fd188e383d5..90870f3b8173c 100644
--- a/lib/tbot/cli/start_identity.go
+++ b/lib/tbot/cli/start_identity.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 )
 
 // IdentityCommand implements `tbot start identity` and
@@ -67,7 +68,7 @@ func (c *IdentityCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) err
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.IdentityOutput{
+	cfg.Services = append(cfg.Services, &identity.OutputConfig{
 		Destination:  dest,
 		Cluster:      c.Cluster,
 		AllowReissue: c.AllowReissue,
diff --git a/lib/tbot/cli/start_identity_test.go b/lib/tbot/cli/start_identity_test.go
index 646c11ecfb3fa..01721636e9f91 100644
--- a/lib/tbot/cli/start_identity_test.go
+++ b/lib/tbot/cli/start_identity_test.go
@@ -25,7 +25,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 )
 
 // TestIdentityCommand tests that the IdentityCommand properly parses its arguments
@@ -62,7 +64,7 @@ func TestIdentityCommand(t *testing.T) {
 				require.Equal(t, "0.0.0.0:8080", cfg.DiagAddr)
 				require.Equal(t, "example.com:443", cfg.ProxyServer)
 
-				dir, ok := cfg.Storage.Destination.(*config.DestinationDirectory)
+				dir, ok := cfg.Storage.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/foo", dir.Path)
 
@@ -70,10 +72,10 @@ func TestIdentityCommand(t *testing.T) {
 
 				// It must configure an identity output with a directory destination.
 				svc := cfg.Services[0]
-				ident, ok := svc.(*config.IdentityOutput)
+				ident, ok := svc.(*identity.OutputConfig)
 				require.True(t, ok)
 
-				dir, ok = ident.Destination.(*config.DestinationDirectory)
+				dir, ok = ident.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 				require.True(t, ident.AllowReissue)
diff --git a/lib/tbot/cli/start_kubernetes.go b/lib/tbot/cli/start_kubernetes.go
index 4a22fd5d9d842..8258faea96a4e 100644
--- a/lib/tbot/cli/start_kubernetes.go
+++ b/lib/tbot/cli/start_kubernetes.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
 )
 
 // KubernetesCommand implements `tbot start kubernetes` and
@@ -67,7 +68,7 @@ func (c *KubernetesCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) e
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.KubernetesOutput{
+	cfg.Services = append(cfg.Services, &k8s.OutputV1Config{
 		Destination:       dest,
 		KubernetesCluster: c.KubernetesCluster,
 		DisableExecPlugin: c.DisableExecPlugin,
diff --git a/lib/tbot/cli/start_kubernetes_test.go b/lib/tbot/cli/start_kubernetes_test.go
index 183ae805b3b0d..bbe4fad192014 100644
--- a/lib/tbot/cli/start_kubernetes_test.go
+++ b/lib/tbot/cli/start_kubernetes_test.go
@@ -23,7 +23,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
 )
 
 // TestKubernetesCommand tests that the KubernetesCommand properly parses its
@@ -47,13 +49,13 @@ func TestKubernetesCommand(t *testing.T) {
 
 				// It must configure a kubernetes output with a directory destination.
 				svc := cfg.Services[0]
-				k8s, ok := svc.(*config.KubernetesOutput)
+				k8s, ok := svc.(*k8s.OutputV1Config)
 				require.True(t, ok)
 
 				require.Equal(t, "demo", k8s.KubernetesCluster)
 				require.True(t, k8s.DisableExecPlugin)
 
-				dir, ok := k8s.Destination.(*config.DestinationDirectory)
+				dir, ok := k8s.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 			},
diff --git a/lib/tbot/cli/start_kubernetes_v2.go b/lib/tbot/cli/start_kubernetes_v2.go
index c58979f2e35b9..00caac1b7a4bc 100644
--- a/lib/tbot/cli/start_kubernetes_v2.go
+++ b/lib/tbot/cli/start_kubernetes_v2.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
 )
 
 // KubernetesV2Command implements `tbot start kubernetes` and
@@ -72,9 +73,9 @@ func (c *KubernetesV2Command) ApplyConfig(cfg *config.BotConfig, l *slog.Logger)
 		return trace.Wrap(err)
 	}
 
-	selectors := []*config.KubernetesSelector{}
+	selectors := []*k8s.KubernetesSelector{}
 	for _, name := range c.KubernetesClusterNames {
-		selectors = append(selectors, &config.KubernetesSelector{
+		selectors = append(selectors, &k8s.KubernetesSelector{
 			Name: name,
 		})
 	}
@@ -85,7 +86,7 @@ func (c *KubernetesV2Command) ApplyConfig(cfg *config.BotConfig, l *slog.Logger)
 			return trace.Wrap(err)
 		}
 
-		selectors = append(selectors, &config.KubernetesSelector{
+		selectors = append(selectors, &k8s.KubernetesSelector{
 			Labels: labels,
 		})
 	}
@@ -94,7 +95,7 @@ func (c *KubernetesV2Command) ApplyConfig(cfg *config.BotConfig, l *slog.Logger)
 		return trace.BadParameter("at least one name-selector or label-selector must be provided")
 	}
 
-	cfg.Services = append(cfg.Services, &config.KubernetesV2Output{
+	cfg.Services = append(cfg.Services, &k8s.OutputV2Config{
 		Destination:       dest,
 		DisableExecPlugin: c.DisableExecPlugin,
 		Selectors:         selectors,
diff --git a/lib/tbot/cli/start_kubernetes_v2_test.go b/lib/tbot/cli/start_kubernetes_v2_test.go
index 0c0302980732d..3a222b8fafe9d 100644
--- a/lib/tbot/cli/start_kubernetes_v2_test.go
+++ b/lib/tbot/cli/start_kubernetes_v2_test.go
@@ -23,7 +23,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
 )
 
 // TestKubernetesV2Command tests that the KubernetesCommand properly parses its
@@ -49,12 +51,12 @@ func TestKubernetesV2Command(t *testing.T) {
 
 				// It must configure a kubernetes output with a directory destination.
 				svc := cfg.Services[0]
-				k8s, ok := svc.(*config.KubernetesV2Output)
+				k8s, ok := svc.(*k8s.OutputV2Config)
 				require.True(t, ok)
 
 				require.True(t, k8s.DisableExecPlugin)
 
-				dir, ok := k8s.Destination.(*config.DestinationDirectory)
+				dir, ok := k8s.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
diff --git a/lib/tbot/cli/start_legacy.go b/lib/tbot/cli/start_legacy.go
index 7a392d3632aa4..abc4a3ee54417 100644
--- a/lib/tbot/cli/start_legacy.go
+++ b/lib/tbot/cli/start_legacy.go
@@ -30,7 +30,10 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 )
 
 // LegacyDestinationDirArgs is an embeddable struct that provides legacy-style
@@ -72,8 +75,8 @@ func (a *LegacyDestinationDirArgs) ApplyConfig(cfg *config.BotConfig, l *slog.Lo
 		// When using the CLI --destination-dir we configure an Identity type
 		// output for that directory.
 		cfg.Services = []config.ServiceConfig{
-			&config.IdentityOutput{
-				Destination: &config.DestinationDirectory{
+			&identity.OutputConfig{
+				Destination: &destination.Directory{
 					Path: a.DestinationDir,
 				},
 			},
@@ -129,6 +132,13 @@ type LegacyCommand struct {
 	// If not set, no diagnostics listener is created.
 	DiagAddr string
 
+	// DiagSocketForUpdater specifies the diagnostics http service address that
+	// should be exposed to the updater via UNIX domain socket.
+	DiagSocketForUpdater string
+
+	// PIDFile is the path to the PID file. If not set, no PID file will be created.
+	PIDFile string
+
 	oneshotSetByUser bool
 }
 
@@ -137,7 +147,7 @@ type LegacyCommand struct {
 func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode CommandMode) *LegacyCommand {
 	joinMethodList := fmt.Sprintf(
 		"(%s)",
-		strings.Join(config.SupportedJoinMethods, ", "),
+		strings.Join(onboarding.SupportedJoinMethods, ", "),
 	)
 
 	c := &LegacyCommand{
@@ -152,9 +162,11 @@ func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode C
 	c.cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&c.CAPins)
 	c.cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&c.CertificateTTL)
 	c.cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&c.RenewalInterval)
-	c.cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&c.JoinMethod, config.SupportedJoinMethods...)
+	c.cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&c.JoinMethod, onboarding.SupportedJoinMethods...)
 	c.cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&c.oneshotSetByUser).BoolVar(&c.Oneshot)
 	c.cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&c.DiagAddr)
+	c.cmd.Flag("diag-socket-for-updater", "If set, run the diagnostics service on the specified socket path for teleport-update to consume.").Hidden().StringVar(&c.DiagSocketForUpdater)
+	c.cmd.Flag("pid-file", "Full path to the PID file. By default no PID file will be created.").StringVar(&c.PIDFile)
 
 	return c
 }
@@ -239,7 +251,7 @@ func (c *LegacyCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error
 	// situation where different fields become set weirdly due to struct
 	// merging)
 	if c.Token != "" || c.JoinMethod != "" || len(c.CAPins) > 0 {
-		if !reflect.DeepEqual(cfg.Onboarding, config.OnboardingConfig{}) {
+		if !reflect.DeepEqual(cfg.Onboarding, onboarding.Config{}) {
 			// To be safe, warn about possible confusion.
 			log.WarnContext(
 				context.TODO(),
@@ -250,7 +262,7 @@ func (c *LegacyCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error
 			)
 		}
 
-		cfg.Onboarding = config.OnboardingConfig{
+		cfg.Onboarding = onboarding.Config{
 			CAPins:     c.CAPins,
 			JoinMethod: types.JoinMethod(c.JoinMethod),
 		}
@@ -270,5 +282,8 @@ func (c *LegacyCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error
 		cfg.DiagAddr = c.DiagAddr
 	}
 
+	cfg.DiagSocketForUpdater = c.DiagSocketForUpdater
+	cfg.PIDFile = c.PIDFile
+
 	return nil
 }
diff --git a/lib/tbot/cli/start_legacy_test.go b/lib/tbot/cli/start_legacy_test.go
index 11aad07d230bc..4456332d85d8f 100644
--- a/lib/tbot/cli/start_legacy_test.go
+++ b/lib/tbot/cli/start_legacy_test.go
@@ -25,7 +25,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 )
 
 // TestLegacyCommand tests that the LegacyCommand properly parses its arguments
@@ -46,6 +48,8 @@ func TestLegacyCommand(t *testing.T) {
 				"--data-dir=/foo",
 				"--destination-dir=/bar",
 				"--auth-server=example.com:3024",
+				"--pid-file=/run/tbot.pid",
+				"--diag-socket-for-updater=/var/lib/teleport/bot/debug.sock",
 			},
 			assertConfig: func(t *testing.T, cfg *config.BotConfig) {
 				token, err := cfg.Onboarding.Token()
@@ -59,8 +63,10 @@ func TestLegacyCommand(t *testing.T) {
 				require.True(t, cfg.Oneshot)
 				require.Equal(t, "0.0.0.0:8080", cfg.DiagAddr)
 				require.Equal(t, "example.com:3024", cfg.AuthServer)
+				require.Equal(t, "/run/tbot.pid", cfg.PIDFile)
+				require.Equal(t, "/var/lib/teleport/bot/debug.sock", cfg.DiagSocketForUpdater)
 
-				dir, ok := cfg.Storage.Destination.(*config.DestinationDirectory)
+				dir, ok := cfg.Storage.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/foo", dir.Path)
 
@@ -68,10 +74,10 @@ func TestLegacyCommand(t *testing.T) {
 
 				// It must configure an identity output with a directory destination.
 				svc := cfg.Services[0]
-				ident, ok := svc.(*config.IdentityOutput)
+				ident, ok := svc.(*identity.OutputConfig)
 				require.True(t, ok)
 
-				dir, ok = ident.Destination.(*config.DestinationDirectory)
+				dir, ok = ident.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 			},
diff --git a/lib/tbot/cli/start_multiplexer.go b/lib/tbot/cli/start_multiplexer.go
new file mode 100644
index 0000000000000..0385ec6e6df15
--- /dev/null
+++ b/lib/tbot/cli/start_multiplexer.go
@@ -0,0 +1,87 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cli
+
+import (
+	"fmt"
+	"log/slog"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
+)
+
+// SSHMultiplexerCommand implements `tbot start ssh-multiplexer` and
+// `tbot configure ssh-multiplexer`.
+type SSHMultiplexerCommand struct {
+	*sharedStartArgs
+	*sharedDestinationArgs
+	*genericMutatorHandler
+
+	// EnableResumption toggles session resumption. It is only set on the target
+	// bot config if `enableResumptionSetByUser` is true.
+	EnableResumption          bool
+	enableResumptionSetByUser bool
+
+	ProxyCommand       []string
+	ProxyTemplatesPath string
+}
+
+// NewSSHMultiplexerCommand initializes the command and flags for kubernetes outputs
+// and returns a struct to contain the parse result.
+func NewSSHMultiplexerCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode CommandMode) *SSHMultiplexerCommand {
+	cmd := parentCmd.Command("ssh-multiplexer", fmt.Sprintf("%s tbot with an SSH Multiplexer service.", mode))
+
+	c := &SSHMultiplexerCommand{}
+	c.sharedStartArgs = newSharedStartArgs(cmd)
+	c.sharedDestinationArgs = newSharedDestinationArgs(cmd)
+	c.genericMutatorHandler = newGenericMutatorHandler(cmd, c, action)
+
+	cmd.Flag("enable-resumption", "If set, disables SSH session resumption.").IsSetByUser(&c.enableResumptionSetByUser).BoolVar(&c.EnableResumption)
+	cmd.Flag("proxy-command", "The command to run as the SSH ProxyCommand, such as `fdpass-teleport`. Defaults to this tbot binary. Repeatable to add additional args.").StringsVar(&c.ProxyCommand)
+	cmd.Flag("proxy-templates-path", "A path to a proxy template config file. Optional.").StringVar(&c.ProxyTemplatesPath)
+
+	return c
+}
+
+func (c *SSHMultiplexerCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error {
+	if err := c.sharedStartArgs.ApplyConfig(cfg, l); err != nil {
+		return trace.Wrap(err)
+	}
+
+	dest, err := c.BuildDestination()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	multiplexer := &ssh.MultiplexerConfig{
+		Destination:        dest,
+		ProxyCommand:       c.ProxyCommand,
+		ProxyTemplatesPath: c.ProxyTemplatesPath,
+	}
+	if c.enableResumptionSetByUser {
+		multiplexer.EnableResumption = &c.EnableResumption
+	}
+
+	cfg.Services = append(cfg.Services, multiplexer)
+
+	return nil
+}
diff --git a/lib/tbot/cli/start_multiplexer_test.go b/lib/tbot/cli/start_multiplexer_test.go
new file mode 100644
index 0000000000000..6a5b3e17af8de
--- /dev/null
+++ b/lib/tbot/cli/start_multiplexer_test.go
@@ -0,0 +1,84 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
+)
+
+func TestSSHMultiplexerCommand(t *testing.T) {
+	testStartConfigureCommand(t, NewSSHMultiplexerCommand, []startConfigureTestCase{
+		{
+			name: "success",
+			args: []string{
+				"start",
+				"ssh-multiplexer",
+				"--destination=/foo",
+				"--proxy-command=fdpass-teleport",
+				"--proxy-command=foo",
+				"--no-enable-resumption",
+				"--proxy-templates-path=/bar.yaml",
+			},
+			assertConfig: func(t *testing.T, cfg *config.BotConfig) {
+				require.Len(t, cfg.Services, 1)
+
+				svc := cfg.Services[0]
+				mx, ok := svc.(*ssh.MultiplexerConfig)
+				require.True(t, ok)
+
+				dir, ok := mx.Destination.(*destination.Directory)
+				require.True(t, ok)
+				require.Equal(t, "/foo", dir.Path)
+
+				require.False(t, mx.SessionResumptionEnabled())
+				require.Equal(t, []string{"fdpass-teleport", "foo"}, mx.ProxyCommand)
+				require.Equal(t, "/bar.yaml", mx.ProxyTemplatesPath)
+			},
+		},
+		{
+			name: "minimal",
+			args: []string{
+				"start",
+				"ssh-multiplexer",
+				"--destination=/foo",
+			},
+			assertConfig: func(t *testing.T, cfg *config.BotConfig) {
+				require.Len(t, cfg.Services, 1)
+
+				svc := cfg.Services[0]
+				mx, ok := svc.(*ssh.MultiplexerConfig)
+				require.True(t, ok)
+
+				dir, ok := mx.Destination.(*destination.Directory)
+				require.True(t, ok)
+				require.Equal(t, "/foo", dir.Path)
+
+				require.True(t, mx.SessionResumptionEnabled())
+				require.Empty(t, mx.ProxyCommand)
+				require.Empty(t, mx.ProxyTemplatesPath)
+			},
+		},
+	})
+}
diff --git a/lib/tbot/cli/start_shared.go b/lib/tbot/cli/start_shared.go
index a817235af682a..d6c2ced21495b 100644
--- a/lib/tbot/cli/start_shared.go
+++ b/lib/tbot/cli/start_shared.go
@@ -30,7 +30,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
 	"github.com/gravitational/teleport/lib/tbot/config"
 )
@@ -106,17 +107,22 @@ func (a *AuthProxyArgs) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error
 type sharedStartArgs struct {
 	*AuthProxyArgs
 
-	JoinMethod        string
-	Token             string
-	CAPins            []string
-	CertificateTTL    time.Duration
-	RenewalInterval   time.Duration
-	Storage           string
-	InitialJoinSecret string
-	Keypair           string
-
-	Oneshot  bool
-	DiagAddr string
+	JoiningURI             string
+	JoinMethod             string
+	Token                  string
+	CAPins                 []string
+	CertificateTTL         time.Duration
+	RenewalInterval        time.Duration
+	Storage                string
+	RegistrationSecret     string
+	RegistrationSecretPath string
+	StaticKeyPath          string
+	Keypair                string
+
+	Oneshot              bool
+	DiagAddr             string
+	DiagSocketForUpdater string
+	PIDFile              string
 
 	oneshotSetByUser bool
 }
@@ -128,18 +134,22 @@ func newSharedStartArgs(cmd *kingpin.CmdClause) *sharedStartArgs {
 
 	joinMethodList := fmt.Sprintf(
 		"(%s)",
-		strings.Join(config.SupportedJoinMethods, ", "),
+		strings.Join(onboarding.SupportedJoinMethods, ", "),
 	)
-
 	cmd.Flag("token", "A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.").Envar(TokenEnvVar).StringVar(&args.Token)
 	cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&args.CAPins)
 	cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&args.CertificateTTL)
 	cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&args.RenewalInterval)
-	cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&args.JoinMethod, config.SupportedJoinMethods...)
+	cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&args.JoinMethod, onboarding.SupportedJoinMethods...)
 	cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&args.oneshotSetByUser).BoolVar(&args.Oneshot)
 	cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&args.DiagAddr)
 	cmd.Flag("storage", "A destination URI for tbot's internal storage, e.g. file:///foo/bar").StringVar(&args.Storage)
-	cmd.Flag("initial-join-secret", "For bound keypair joining, specifies an initial joining secret.").StringVar(&args.InitialJoinSecret)
+	cmd.Flag("registration-secret", "For bound keypair joining, specifies a registration secret for use at first join.").StringVar(&args.RegistrationSecret)
+	cmd.Flag("registration-secret-path", "For bound keypair joining, specifies a file containing a registration secret for use at first join.").StringVar(&args.RegistrationSecretPath)
+	cmd.Flag("static-key-path", "For bound keypair joining, specifies a path to a static key.").StringVar(&args.StaticKeyPath)
+	cmd.Flag("join-uri", "An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.").StringVar(&args.JoiningURI)
+	cmd.Flag("diag-socket-for-updater", "If set, run the diagnostics service on the specified socket path for teleport-update to consume.").Hidden().StringVar(&args.DiagSocketForUpdater)
+	cmd.Flag("pid-file", "Full path to the PID file. By default no PID file will be created.").StringVar(&args.PIDFile)
 
 	return args
 }
@@ -147,6 +157,10 @@ func newSharedStartArgs(cmd *kingpin.CmdClause) *sharedStartArgs {
 func (s *sharedStartArgs) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) error {
 	// Note: Debug, FIPS, and Insecure are included from globals.
 
+	if s.JoiningURI != "" {
+		cfg.JoinURI = s.JoiningURI
+	}
+
 	if s.AuthProxyArgs != nil {
 		if err := s.AuthProxyArgs.ApplyConfig(cfg, l); err != nil {
 			return trace.Wrap(err)
@@ -220,7 +234,7 @@ func (s *sharedStartArgs) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) err
 	// situation where different fields become set weirdly due to struct
 	// merging)
 	if s.Token != "" || s.JoinMethod != "" || len(s.CAPins) > 0 {
-		if !reflect.DeepEqual(cfg.Onboarding, config.OnboardingConfig{}) {
+		if !reflect.DeepEqual(cfg.Onboarding, onboarding.Config{}) {
 			// To be safe, warn about possible confusion.
 			l.WarnContext(
 				context.TODO(),
@@ -231,21 +245,32 @@ func (s *sharedStartArgs) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) err
 			)
 		}
 
-		cfg.Onboarding = config.OnboardingConfig{
+		cfg.Onboarding = onboarding.Config{
 			CAPins:     s.CAPins,
 			JoinMethod: types.JoinMethod(s.JoinMethod),
 		}
 		cfg.Onboarding.SetToken(s.Token)
 	}
 
-	if s.JoinMethod != string(types.JoinMethodBoundKeypair) && s.InitialJoinSecret != "" {
-		return trace.BadParameter("--initial-join-secret and --keypair are only valid with --join-method=%s", types.JoinMethodBoundKeypair)
+	if s.JoinMethod != string(types.JoinMethodBoundKeypair) && s.RegistrationSecret != "" {
+		return trace.BadParameter("--registration-secret is only valid with --join-method=%s", types.JoinMethodBoundKeypair)
 	}
 
-	if s.InitialJoinSecret != "" {
-		cfg.Onboarding.BoundKeypair.InitialJoinSecret = s.InitialJoinSecret
+	if s.RegistrationSecret != "" {
+		cfg.Onboarding.BoundKeypair.RegistrationSecretValue = s.RegistrationSecret
 	}
 
+	if s.RegistrationSecretPath != "" {
+		cfg.Onboarding.BoundKeypair.RegistrationSecretPath = s.RegistrationSecretPath
+	}
+
+	if s.StaticKeyPath != "" {
+		cfg.Onboarding.BoundKeypair.StaticPrivateKeyPath = s.StaticKeyPath
+	}
+
+	cfg.DiagSocketForUpdater = s.DiagSocketForUpdater
+	cfg.PIDFile = s.PIDFile
+
 	return nil
 }
 
@@ -270,7 +295,7 @@ func newSharedDestinationArgs(cmd *kingpin.CmdClause) *sharedDestinationArgs {
 	return args
 }
 
-func (s *sharedDestinationArgs) BuildDestination() (bot.Destination, error) {
+func (s *sharedDestinationArgs) BuildDestination() (destination.Destination, error) {
 	dest, err := config.DestinationFromURI(s.Destination)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -280,7 +305,7 @@ func (s *sharedDestinationArgs) BuildDestination() (bot.Destination, error) {
 		// These flags are only supported on directory destinations, so ensure
 		// that's what was built.
 
-		dd, ok := dest.(*config.DestinationDirectory)
+		dd, ok := dest.(*destination.Directory)
 		if !ok {
 			return nil, trace.BadParameter("--reader-user and --reader-group are only compatible with file destinations")
 		}
diff --git a/lib/tbot/cli/start_shared_test.go b/lib/tbot/cli/start_shared_test.go
index e1b4252edf9a0..b4bf6bc6d3d03 100644
--- a/lib/tbot/cli/start_shared_test.go
+++ b/lib/tbot/cli/start_shared_test.go
@@ -26,8 +26,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/tbot/config"
 )
 
 func TestSharedStartArgs(t *testing.T) {
@@ -44,6 +44,8 @@ func TestSharedStartArgs(t *testing.T) {
 		"--diag-addr=0.0.0.0:8080",
 		"--storage=file:///foo/bar",
 		"--proxy-server=example.teleport.sh:443",
+		"--pid-file=/run/tbot.pid",
+		"--diag-socket-for-updater=/var/lib/teleport/bot/debug.sock",
 	})
 	require.NoError(t, err)
 
@@ -56,6 +58,8 @@ func TestSharedStartArgs(t *testing.T) {
 	require.Equal(t, "0.0.0.0:8080", args.DiagAddr)
 	require.Equal(t, "file:///foo/bar", args.Storage)
 	require.Equal(t, "example.teleport.sh:443", args.ProxyServer)
+	require.Equal(t, "/run/tbot.pid", args.PIDFile)
+	require.Equal(t, "/var/lib/teleport/bot/debug.sock", args.DiagSocketForUpdater)
 
 	// Convert these args to a BotConfig.
 	cfg, err := LoadConfigWithMutators(&GlobalArgs{}, args)
@@ -72,7 +76,7 @@ func TestSharedStartArgs(t *testing.T) {
 	require.True(t, cfg.Oneshot)
 	require.Equal(t, "0.0.0.0:8080", cfg.DiagAddr)
 
-	dir, ok := cfg.Storage.Destination.(*config.DestinationDirectory)
+	dir, ok := cfg.Storage.Destination.(*destination.Directory)
 	require.True(t, ok)
 	require.Equal(t, "/foo/bar", dir.Path)
 }
@@ -98,7 +102,7 @@ func TestSharedDestinationArgs(t *testing.T) {
 	dest, err := args.BuildDestination()
 	require.NoError(t, err)
 
-	dd, ok := dest.(*config.DestinationDirectory)
+	dd, ok := dest.(*destination.Directory)
 	require.True(t, ok)
 
 	require.ElementsMatch(t, dd.Readers, []*botfs.ACLSelector{
diff --git a/lib/tbot/cli/start_spiffe_svid.go b/lib/tbot/cli/start_spiffe_svid.go
index e2bf7413524e3..2e546e4cb527e 100644
--- a/lib/tbot/cli/start_spiffe_svid.go
+++ b/lib/tbot/cli/start_spiffe_svid.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/legacyspiffe"
 )
 
 // SPIFFESVIDCommand implements `tbot start spiffe-svid` and
@@ -73,12 +74,12 @@ func (c *SPIFFESVIDCommand) ApplyConfig(cfg *config.BotConfig, l *slog.Logger) e
 		return trace.Wrap(err)
 	}
 
-	cfg.Services = append(cfg.Services, &config.SPIFFESVIDOutput{
+	cfg.Services = append(cfg.Services, &legacyspiffe.SVIDOutputConfig{
 		Destination: dest,
-		SVID: config.SVIDRequest{
+		SVID: legacyspiffe.SVIDRequest{
 			Path: c.SVIDPath,
 			Hint: c.SVIDHint,
-			SANS: config.SVIDRequestSANs{
+			SANS: legacyspiffe.SVIDRequestSANs{
 				DNS: c.DNSSANs,
 				IP:  c.IPSANs,
 			},
diff --git a/lib/tbot/cli/start_spiffe_svid_test.go b/lib/tbot/cli/start_spiffe_svid_test.go
index 94528318f5518..ebab36ea44c8c 100644
--- a/lib/tbot/cli/start_spiffe_svid_test.go
+++ b/lib/tbot/cli/start_spiffe_svid_test.go
@@ -23,7 +23,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/legacyspiffe"
 )
 
 // TestSPIFFESVIDCommand tests that the SPIFFESVIDCommand properly parses its
@@ -52,7 +54,7 @@ func TestSPIFFESVIDCommand(t *testing.T) {
 
 				// It must configure a SPIFFE output with a directory destination.
 				svc := cfg.Services[0]
-				spiffe, ok := svc.(*config.SPIFFESVIDOutput)
+				spiffe, ok := svc.(*legacyspiffe.SVIDOutputConfig)
 				require.True(t, ok)
 
 				require.True(t, spiffe.IncludeFederatedTrustBundles)
@@ -65,7 +67,7 @@ func TestSPIFFESVIDCommand(t *testing.T) {
 				require.ElementsMatch(t, sans.DNS, []string{"foo.example.com", "bar.example.com"})
 				require.ElementsMatch(t, sans.IP, []string{"192.168.1.1", "192.168.1.2"})
 
-				dir, ok := spiffe.Destination.(*config.DestinationDirectory)
+				dir, ok := spiffe.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 			},
diff --git a/lib/tbot/cli/start_workload_identity_api.go b/lib/tbot/cli/start_workload_identity_api.go
index 5c4dc28615ab0..ab1d6684a5311 100644
--- a/lib/tbot/cli/start_workload_identity_api.go
+++ b/lib/tbot/cli/start_workload_identity_api.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 // WorkloadIdentityAPICommand implements `tbot start workload-identity-api` and
@@ -78,7 +79,7 @@ func (c *WorkloadIdentityAPICommand) ApplyConfig(cfg *config.BotConfig, l *slog.
 		return trace.Wrap(err)
 	}
 
-	svc := &config.WorkloadIdentityAPIService{
+	svc := &workloadidentity.WorkloadAPIConfig{
 		Listen: c.Listen,
 	}
 
diff --git a/lib/tbot/cli/start_workload_identity_api_test.go b/lib/tbot/cli/start_workload_identity_api_test.go
index eba95ca23e470..b18d4f4c1533b 100644
--- a/lib/tbot/cli/start_workload_identity_api_test.go
+++ b/lib/tbot/cli/start_workload_identity_api_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 func TestNewWorkloadIdentityAPICommand(t *testing.T) {
@@ -41,7 +42,7 @@ func TestNewWorkloadIdentityAPICommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityAPIService)
+				wis, ok := svc.(*workloadidentity.WorkloadAPIConfig)
 				require.True(t, ok)
 				require.Equal(t, "tcp://0.0.0.0:8080", wis.Listen)
 				require.Equal(t, map[string][]string{
@@ -65,7 +66,7 @@ func TestNewWorkloadIdentityAPICommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityAPIService)
+				wis, ok := svc.(*workloadidentity.WorkloadAPIConfig)
 				require.True(t, ok)
 				require.Equal(t, "unix:///opt/workload.sock", wis.Listen)
 				require.Equal(t, "jim", wis.Selector.Name)
diff --git a/lib/tbot/cli/start_workload_identity_aws_ra.go b/lib/tbot/cli/start_workload_identity_aws_ra.go
index db250831ccfb6..2010efb1478b5 100644
--- a/lib/tbot/cli/start_workload_identity_aws_ra.go
+++ b/lib/tbot/cli/start_workload_identity_aws_ra.go
@@ -26,6 +26,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/awsra"
 )
 
 // WorkloadIdentityAWSRACommand implements `tbot start workload-identity-aws-ra`
@@ -138,7 +139,7 @@ func (c *WorkloadIdentityAWSRACommand) ApplyConfig(cfg *config.BotConfig, l *slo
 		return trace.Wrap(err)
 	}
 
-	svc := &config.WorkloadIdentityAWSRAService{
+	svc := &awsra.Config{
 		Destination:            dest,
 		RoleARN:                c.RoleARN,
 		ProfileARN:             c.ProfileARN,
diff --git a/lib/tbot/cli/start_workload_identity_aws_ra_test.go b/lib/tbot/cli/start_workload_identity_aws_ra_test.go
index 0b4e974b88091..677864c65ed77 100644
--- a/lib/tbot/cli/start_workload_identity_aws_ra_test.go
+++ b/lib/tbot/cli/start_workload_identity_aws_ra_test.go
@@ -22,7 +22,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/awsra"
 )
 
 func TestWorkloadIdentityAWSRACommand(t *testing.T) {
@@ -48,10 +50,10 @@ func TestWorkloadIdentityAWSRACommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityAWSRAService)
+				wis, ok := svc.(*awsra.Config)
 				require.True(t, ok)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
@@ -95,10 +97,10 @@ func TestWorkloadIdentityAWSRACommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityAWSRAService)
+				wis, ok := svc.(*awsra.Config)
 				require.True(t, ok)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
diff --git a/lib/tbot/cli/start_workload_identity_jwt.go b/lib/tbot/cli/start_workload_identity_jwt.go
index c287802f60c84..05e60c65ecc68 100644
--- a/lib/tbot/cli/start_workload_identity_jwt.go
+++ b/lib/tbot/cli/start_workload_identity_jwt.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 // WorkloadIdentityJWTCommand implements `tbot start workload-identity-jwt` and
@@ -83,7 +84,7 @@ func (c *WorkloadIdentityJWTCommand) ApplyConfig(cfg *config.BotConfig, l *slog.
 		return trace.Wrap(err)
 	}
 
-	svc := &config.WorkloadIdentityJWTService{
+	svc := &workloadidentity.JWTOutputConfig{
 		Destination: dest,
 		Audiences:   c.Audiences,
 	}
diff --git a/lib/tbot/cli/start_workload_identity_jwt_test.go b/lib/tbot/cli/start_workload_identity_jwt_test.go
index f00b1bff2af84..66df93d5fc272 100644
--- a/lib/tbot/cli/start_workload_identity_jwt_test.go
+++ b/lib/tbot/cli/start_workload_identity_jwt_test.go
@@ -21,7 +21,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 func TestWorkloadIdentityJWTCommand(t *testing.T) {
@@ -42,10 +44,10 @@ func TestWorkloadIdentityJWTCommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityJWTService)
+				wis, ok := svc.(*workloadidentity.JWTOutputConfig)
 				require.True(t, ok)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
@@ -74,10 +76,10 @@ func TestWorkloadIdentityJWTCommand(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityJWTService)
+				wis, ok := svc.(*workloadidentity.JWTOutputConfig)
 				require.True(t, ok)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
diff --git a/lib/tbot/cli/start_workload_identity_x509.go b/lib/tbot/cli/start_workload_identity_x509.go
index 50f8ec2d6de20..495e7da8ad3fc 100644
--- a/lib/tbot/cli/start_workload_identity_x509.go
+++ b/lib/tbot/cli/start_workload_identity_x509.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 // WorkloadIdentityX509Command implements `tbot start workload-identity-x509` and
@@ -81,7 +82,7 @@ func (c *WorkloadIdentityX509Command) ApplyConfig(cfg *config.BotConfig, l *slog
 		return trace.Wrap(err)
 	}
 
-	svc := &config.WorkloadIdentityX509Service{
+	svc := &workloadidentity.X509OutputConfig{
 		Destination:                  dest,
 		IncludeFederatedTrustBundles: c.IncludeFederatedTrustBundles,
 	}
diff --git a/lib/tbot/cli/start_workload_identity_x509_test.go b/lib/tbot/cli/start_workload_identity_x509_test.go
index 3335d6f4f473b..3cb1f779bb3b6 100644
--- a/lib/tbot/cli/start_workload_identity_x509_test.go
+++ b/lib/tbot/cli/start_workload_identity_x509_test.go
@@ -21,7 +21,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 )
 
 func TestWorkloadIdentityX509Command(t *testing.T) {
@@ -42,11 +44,11 @@ func TestWorkloadIdentityX509Command(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityX509Service)
+				wis, ok := svc.(*workloadidentity.X509OutputConfig)
 				require.True(t, ok)
 				require.True(t, wis.IncludeFederatedTrustBundles)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
@@ -72,11 +74,11 @@ func TestWorkloadIdentityX509Command(t *testing.T) {
 				require.Len(t, cfg.Services, 1)
 
 				svc := cfg.Services[0]
-				wis, ok := svc.(*config.WorkloadIdentityX509Service)
+				wis, ok := svc.(*workloadidentity.X509OutputConfig)
 				require.True(t, ok)
 				require.True(t, wis.IncludeFederatedTrustBundles)
 
-				dir, ok := wis.Destination.(*config.DestinationDirectory)
+				dir, ok := wis.Destination.(*destination.Directory)
 				require.True(t, ok)
 				require.Equal(t, "/bar", dir.Path)
 
diff --git a/lib/tbot/client/builder.go b/lib/tbot/client/builder.go
new file mode 100644
index 0000000000000..fa7e1dd6883fc
--- /dev/null
+++ b/lib/tbot/client/builder.go
@@ -0,0 +1,83 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package client
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+)
+
+// NewBuilder creates a new Builder.
+func NewBuilder(cfg BuilderConfig) (*Builder, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Builder{cfg: cfg}, nil
+}
+
+// BuilderConfig contains the configuration options for a Builder.
+type BuilderConfig struct {
+	// Connection contains the address etc. used to dial a connection to the
+	// auth server.
+	Connection connection.Config
+
+	// Resolver that will be used to find the address of a proxy server.
+	Resolver reversetunnelclient.Resolver
+
+	// Logger to which log messages will be written.
+	Logger *slog.Logger
+
+	// Metrics will record gRPC client metrics.
+	Metrics *prometheus.ClientMetrics
+}
+
+func (cfg *BuilderConfig) CheckAndSetDefaults() error {
+	if err := cfg.Connection.Validate(); err != nil {
+		return trace.Wrap(err)
+	}
+	if cfg.Resolver == nil {
+		return trace.BadParameter("Resolver is required")
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	return nil
+}
+
+// Builder provides a convenient way to create a client for a given identity
+// such as when services need to impersonate the a role to fetch a resource.
+type Builder struct{ cfg BuilderConfig }
+
+// Build a client for the given identity.
+func (b *Builder) Build(ctx context.Context, id Identity) (*client.Client, error) {
+	return New(ctx, Config{
+		Identity:   id,
+		Connection: b.cfg.Connection,
+		Resolver:   b.cfg.Resolver,
+		Logger:     b.cfg.Logger,
+		Metrics:    b.cfg.Metrics,
+	})
+}
diff --git a/lib/tbot/client/client.go b/lib/tbot/client/client.go
new file mode 100644
index 0000000000000..9230a4c79882c
--- /dev/null
+++ b/lib/tbot/client/client.go
@@ -0,0 +1,242 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// Package client wraps the api/client package to implement tbot's connection
+// logic.
+//
+// tbot supports two methods of dialing a gRPC connection to an auth server:
+//
+//  1. Via a direct TLS connection to the auth server itself
+//  2. Via an SSH tunnel through a proxy server
+//
+// Both methods support client-side HTTP and SOCKS5 proxies, and method #2
+// supports "TLS Routing" (via ALPN) and our "websocket upgrade" trick for
+// traversing L7 load balancers that break ALPN.
+//
+// This is a subset of the methods offered by the api/client package. In the
+// future, we may wish to add support for more of these methods, but many are
+// unnecessarily complex for tbot's use-cases.
+//
+// If you start tbot with the `proxy_server` config option or `--proxy-server`
+// flag, client.New will return a gRPC client *without* testing the connection.
+//
+// In other words: client.New will not return an error if the proxy or auth
+// server is down, which is desirable because it allows us to start tbot in a
+// "degraded" mode and retry the connection in the background.
+//
+// In previous versions of tbot, there was no way to explicitly provide the
+// address of a proxy server. Instead, you could either put a proxy or auth
+// server address in the `auth_server` option or `--auth-server` flag and tbot
+// would try both connection methods.
+//
+// For backward compatibility, if you provide `auth_server` or `--auth-server`
+// in major versions earlier than v19, client.New will test the connection and
+// return an error if the proxy or auth server is unavailable. So in order for
+// tbot to run in degraded mode, you must use `proxy_server` or `--proxy-server`.
+//
+// As tbot is also embedded in our Kubernetes operator and `tctl terraform env`
+// which both support providing an auth server or proxy address using the same
+// field, this package allows you to opt-in to the previous behavior by setting
+// Config.AuthServerAddressMode to AllowProxyAsAuthServer.
+package client
+
+import (
+	"context"
+	"crypto/tls"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	grpcprom "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/crypto/ssh"
+	"google.golang.org/grpc"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/breaker"
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+)
+
+// Identity provides the TLS and SSH credentials required to dial a connection.
+type Identity interface {
+	// TLSConfig returns the bot's TLS configuration.
+	TLSConfig() (*tls.Config, error)
+
+	// SSHClientConfig returns the bot's SSH client configuration.
+	SSHClientConfig() (*ssh.ClientConfig, error)
+}
+
+// Config contains options used to create the API client.
+type Config struct {
+	// Connection contains the address etc. used to dial a connection to the
+	// auth server.
+	Connection connection.Config
+
+	// Identity that will provide the TLS and SSH credentials.
+	Identity Identity
+
+	// Resolver that will be used to find the address of a proxy server.
+	Resolver reversetunnelclient.Resolver
+
+	// Logger to which log messages will be written.
+	Logger *slog.Logger
+
+	// Metrics will record gRPC client metrics.
+	Metrics *grpcprom.ClientMetrics
+}
+
+// CheckAndSetDefaults checks whether required config options have been provided
+// and sets defaults.
+func (c *Config) CheckAndSetDefaults() error {
+	if err := c.Connection.Validate(); err != nil {
+		return err
+	}
+	if c.Identity == nil {
+		return trace.BadParameter("identity is required")
+	}
+	if c.Resolver == nil {
+		return trace.BadParameter("resolver is required")
+	}
+	if c.Logger == nil {
+		c.Logger = slog.Default()
+	}
+	return nil
+}
+
+// New creates an API client. See the package documentation for more information.
+func New(ctx context.Context, cfg Config) (*client.Client, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// If the address is known to be a proxy, dial without testing the
+	// connection.
+	if cfg.Connection.AddressKind == connection.AddressKindProxy {
+		return dialViaProxy(ctx, cfg)
+	}
+
+	// If it is known to be an auth server (i.e. we do not support falling back
+	// to treating it as a proxy), dial without testing the connection.
+	if cfg.Connection.AuthServerAddressMode == connection.AuthServerMustBeAuthServer {
+		return dialDirectly(ctx, cfg)
+	}
+
+	// If the address is thought to be an auth server, try to dial it directly.
+	clt, directErr := dialDirectly(ctx, cfg)
+	if directErr == nil {
+		// Send a ping to test the connection.
+		if _, directErr = clt.Ping(ctx); directErr == nil {
+			return clt, nil
+		} else {
+			_ = clt.Close()
+		}
+	}
+
+	// If the direct connection failed, try to connect to it as a proxy.
+	clt, proxyErr := dialViaProxy(ctx, cfg)
+	if proxyErr == nil {
+		// Send a ping to test the connection.
+		if _, proxyErr = clt.Ping(ctx); proxyErr == nil {
+			if cfg.Connection.AuthServerAddressMode == connection.WarnIfAuthServerIsProxy {
+				cfg.Logger.WarnContext(ctx,
+					"Support for providing a proxy address via the 'auth_server' configuration option or '--auth-server' flag is deprecated and will be removed in v19. Use 'proxy_server' or '--proxy-server' instead.",
+				)
+			}
+			return clt, nil
+		} else {
+			_ = clt.Close()
+		}
+	}
+
+	return nil, trace.NewAggregate(
+		trace.Wrap(directErr, "failed direct dial to auth server"),
+		trace.Wrap(proxyErr, "failed dial to auth server through reverse tunnel"),
+	)
+}
+
+func dialViaProxy(ctx context.Context, cfg Config) (*client.Client, error) {
+	tlsConfig, err := cfg.Identity.TLSConfig()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshConfig, err := cfg.Identity.SSHClientConfig()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
+		Resolver:              cfg.Resolver,
+		ClientConfig:          sshConfig,
+		Log:                   cfg.Logger,
+		InsecureSkipTLSVerify: cfg.Connection.Insecure,
+		GetClusterCAs:         client.ClusterCAsFromCertPool(tlsConfig.RootCAs),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return client.New(ctx, client.Config{
+		DialInBackground: true,
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		Dialer:                   dialer,
+		DialOpts:                 dialOpts(cfg),
+		CircuitBreakerConfig:     circuitBreakerConfig(),
+		InsecureAddressDiscovery: cfg.Connection.Insecure,
+	})
+}
+
+func dialDirectly(ctx context.Context, cfg Config) (*client.Client, error) {
+	tlsConfig, err := cfg.Identity.TLSConfig()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return client.New(ctx, client.Config{
+		DialInBackground: true,
+		Addrs:            []string{cfg.Connection.Address},
+		Credentials: []client.Credentials{
+			client.LoadTLS(tlsConfig),
+		},
+		DialOpts:                 dialOpts(cfg),
+		CircuitBreakerConfig:     circuitBreakerConfig(),
+		InsecureAddressDiscovery: cfg.Connection.Insecure,
+	})
+}
+
+func dialOpts(cfg Config) []grpc.DialOption {
+	opts := []grpc.DialOption{
+		metadata.WithUserAgentFromTeleportComponent(teleport.ComponentTBot),
+	}
+	if cfg.Metrics != nil {
+		opts = append(opts,
+			grpc.WithChainUnaryInterceptor(cfg.Metrics.UnaryClientInterceptor()),
+			grpc.WithChainStreamInterceptor(cfg.Metrics.StreamClientInterceptor()),
+		)
+	}
+	return opts
+}
+
+func circuitBreakerConfig() breaker.Config {
+	cfg := breaker.DefaultBreakerConfig(clockwork.NewRealClock())
+	cfg.TrippedErrorMessage = "Unable to communicate with the Teleport Auth Service"
+	return cfg
+}
diff --git a/lib/tbot/config/config.go b/lib/tbot/config/config.go
index bab79bcdbea9e..d071c22437f7f 100644
--- a/lib/tbot/config/config.go
+++ b/lib/tbot/config/config.go
@@ -26,18 +26,30 @@ import (
 	"fmt"
 	"io"
 	"net/url"
+	"os"
 	"slices"
 	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
-	"go.opentelemetry.io/otel"
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/awsra"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	"github.com/gravitational/teleport/lib/tbot/services/example"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/tbot/services/legacyspiffe"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -47,142 +59,36 @@ const (
 	DefaultRenewInterval  = 20 * time.Minute
 )
 
-var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/config")
-
-var SupportedJoinMethods = []string{
-	string(types.JoinMethodAzure),
-	string(types.JoinMethodAzureDevops),
-	string(types.JoinMethodBitbucket),
-	string(types.JoinMethodCircleCI),
-	string(types.JoinMethodGCP),
-	string(types.JoinMethodGitHub),
-	string(types.JoinMethodGitLab),
-	string(types.JoinMethodIAM),
-	string(types.JoinMethodKubernetes),
-	string(types.JoinMethodSpacelift),
-	string(types.JoinMethodToken),
-	string(types.JoinMethodTPM),
-	string(types.JoinMethodTerraformCloud),
-	string(types.JoinMethodBoundKeypair),
-}
-
 var log = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentTBot)
 
-// AzureOnboardingConfig holds configuration relevant to the "azure" join method.
-type AzureOnboardingConfig struct {
-	// ClientID of the managed identity to use. Required if the VM has more
-	// than one assigned identity.
-	ClientID string `yaml:"client_id,omitempty"`
-}
-
-// TerraformOnboardingConfig contains parameters for the "terraform" join method
-type TerraformOnboardingConfig struct {
-	// TokenTag is the name of the tag configured via the environment variable
-	// `TERRAFORM_WORKLOAD_IDENTITY_AUDIENCE(_$TAG)`. If unset, the untagged
-	// variant is used.
-	AudienceTag string `yaml:"audience_tag,omitempty"`
-}
-
-// GitlabOnboardingConfig holds configuration relevant to the "gitlab" join method.
-type GitlabOnboardingConfig struct {
-	// TokenEnvVarName is the name of the environment variable that contains the
-	// GitLab ID token. This can be useful to override in cases where a single
-	// gitlab job needs to authenticate to multiple Teleport clusters.
-	TokenEnvVarName string `yaml:"token_env_var_name,omitempty"`
-}
-
-// BoundKeypairOnboardingConfig contains parameters for the `bound_keypair` join
-// method
-type BoundKeypairOnboardingConfig struct {
-	// InitialJoinSecret is the name of the initial joining secret, if any. If
-	// not specified, a keypair must be created using `tbot keypair create` and
-	// registered with Teleport in advance.
-	InitialJoinSecret string
-}
-
-// OnboardingConfig contains values relevant to how the bot authenticates with
-// the Teleport cluster.
-type OnboardingConfig struct {
-	// TokenValue is either the token needed to join the auth server, or a path pointing to a file
-	// that contains the token
-	//
-	// You should use Token() instead - this has to be an exported field for YAML unmarshaling
-	// to work correctly, but this could be a path instead of a token
-	TokenValue string `yaml:"token,omitempty"`
-
-	// CAPath is an optional path to a CA certificate.
-	CAPath string `yaml:"ca_path,omitempty"`
-
-	// CAPins is a list of certificate authority pins, used to validate the
-	// connection to the Teleport auth server.
-	CAPins []string `yaml:"ca_pins,omitempty"`
-
-	// JoinMethod is the method the bot should use to exchange a token for the
-	// initial certificate
-	JoinMethod types.JoinMethod `yaml:"join_method"`
-
-	// Azure holds configuration relevant to the azure joining method.
-	Azure AzureOnboardingConfig `yaml:"azure,omitempty"`
-
-	// Terraform holds configuration relevant to the `terraform` join method.
-	Terraform TerraformOnboardingConfig `yaml:"terraform,omitempty"`
-
-	// Gitlab holds configuration relevant to the `gitlab` join method.
-	Gitlab GitlabOnboardingConfig `yaml:"gitlab,omitempty"`
-
-	// BoundKeypair holds configuration relevant to the `bound_keypair` join method
-	BoundKeypair BoundKeypairOnboardingConfig `yaml:"bound_keypair,omitempty"`
-}
-
-// HasToken gives the ability to check if there has been a token value stored
-// in the config
-func (conf *OnboardingConfig) HasToken() bool {
-	return conf.TokenValue != ""
-}
-
-// SetToken stores the value for --token or auth_token in the config
-//
-// In the case of the token value pointing to a file, this allows us to
-// fetch the value of the token when it's needed (when connecting for the first time)
-// instead of trying to read the file every time that teleport is launched.
-// This means we can allow temporary token files that are removed after teleport has
-// successfully connected the first time.
-func (conf *OnboardingConfig) SetToken(token string) {
-	conf.TokenValue = token
-}
-
-// Token returns token needed to join the auth server
-//
-// If the value stored points to a file, it will attempt to read the token value from the file
-// and return an error if it wasn't successful
-// If the value stored doesn't point to a file, it'll return the value stored
-func (conf *OnboardingConfig) Token() (string, error) {
-	token, err := utils.TryReadValueAsFile(conf.TokenValue)
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	return token, nil
-}
-
 // BotConfig is the bot's root config object.
 // This is currently at version "v2".
 type BotConfig struct {
-	Version    Version          `yaml:"version"`
-	Onboarding OnboardingConfig `yaml:"onboarding,omitempty"`
-	Storage    *StorageConfig   `yaml:"storage,omitempty"`
+	Version    Version           `yaml:"version"`
+	Onboarding onboarding.Config `yaml:"onboarding,omitempty"`
+	Storage    *StorageConfig    `yaml:"storage,omitempty"`
 	// Deprecated: Use Services
 	Outputs  ServiceConfigs `yaml:"outputs,omitempty"`
 	Services ServiceConfigs `yaml:"services,omitempty"`
 
-	Debug      bool   `yaml:"debug"`
-	AuthServer string `yaml:"auth_server,omitempty"`
-	// ProxyServer is the teleport proxy address. Unlike `AuthServer` this must
-	// explicitly point to a Teleport proxy.
-	// Example: "example.teleport.sh:443"
-	ProxyServer        string             `yaml:"proxy_server,omitempty"`
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-	Oneshot            bool               `yaml:"oneshot"`
+	Debug       bool   `yaml:"debug"`
+	AuthServer  string `yaml:"auth_server,omitempty"`
+	ProxyServer string `yaml:"proxy_server,omitempty"`
+
+	// AuthServerAddressMode controls whether it's permissible to provide a
+	// proxy server address as an auth server address. This is unsupported in
+	// the tbot binary as of v19, but we maintain support for cases where tbot
+	// is embedded in a binary which does not differentiate between address types
+	// such as tctl or the Kubernetes operator.
+	AuthServerAddressMode connection.AuthServerAddressMode `yaml:"-"`
+
+	// JoinURI is a joining URI, used to supply connection and authentication
+	// parameters in a single bundle. If set, the value is parsed and merged on
+	// top of the existing configuration during `CheckAndSetDefaults()`.
+	JoinURI string `yaml:"join_uri,omitempty"`
+
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+	Oneshot            bool                   `yaml:"oneshot"`
 	// FIPS instructs `tbot` to run in a mode designed to comply with FIPS
 	// regulations. This means the bot should:
 	// - Refuse to run if not compiled with boringcrypto
@@ -194,44 +100,60 @@ type BotConfig struct {
 	// If not set, no diagnostics listener is created.
 	DiagAddr string `yaml:"diag_addr,omitempty"`
 
+	// DiagSocketForUpdater specifies the path to the diagnostics http service socket that
+	// should be exposed to the updater.
+	DiagSocketForUpdater string `yaml:"-"`
+
+	// PIDFile is the path to the PID file that should be created by the bot.
+	PIDFile string `yaml:"-"`
+
 	// ReloadCh allows a channel to be injected into the bot to trigger a
 	// renewal.
 	ReloadCh <-chan struct{} `yaml:"-"`
 
+	// Testing is set in unit tests to attach a faux service which exposes the
+	// bot's underlying identity and client so we can make assertions on it.
+	Testing bool `yaml:"-"`
+
 	// Insecure configures the bot to trust the certificates from the Auth Server or Proxy on first connect without verification.
 	// Do not use in production.
 	Insecure bool `yaml:"insecure,omitempty"`
 }
 
-type AddressKind string
-
-const (
-	AddressKindUnspecified AddressKind = ""
-	AddressKindProxy       AddressKind = "proxy"
-	AddressKindAuth        AddressKind = "auth"
-)
+// ConnectionConfig creates a connection.Config from the user's configuration.
+func (conf *BotConfig) ConnectionConfig() connection.Config {
+	cc := connection.Config{
+		Insecure:              conf.Insecure,
+		AuthServerAddressMode: conf.AuthServerAddressMode,
+		StaticProxyAddress:    shouldUseProxyAddr(),
+	}
 
-// Address returns the address to the auth server, either directly or via
-// a proxy, and the kind of address it is.
-func (conf *BotConfig) Address() (string, AddressKind) {
 	switch {
-	case conf.AuthServer != "" && conf.ProxyServer != "":
-		// This is an error case that should be prevented by the validation.
-		return "", AddressKindUnspecified
 	case conf.ProxyServer != "":
-		return conf.ProxyServer, AddressKindProxy
+		cc.Address = conf.ProxyServer
+		cc.AddressKind = connection.AddressKindProxy
 	case conf.AuthServer != "":
-		return conf.AuthServer, AddressKindAuth
-	default:
-		return "", AddressKindUnspecified
+		cc.Address = conf.AuthServer
+		cc.AddressKind = connection.AddressKindAuth
 	}
+
+	return cc
 }
 
-func (conf *BotConfig) CipherSuites() []uint16 {
-	if conf.FIPS {
-		return defaults.FIPSCipherSuites
-	}
-	return utils.DefaultCipherSuites()
+// useProxyAddrEnv is an environment variable which can be set to
+// force `tbot` to prefer using the proxy address explicitly provided by the
+// user over the one fetched from the proxy ping. This is only intended to work
+// in cases where TLS routing is enabled, and is intended to support cases where
+// the Proxy is accessible from multiple addresses, and the one included in the
+// ProxyPing is incorrect.
+const useProxyAddrEnv = "TBOT_USE_PROXY_ADDR"
+
+// shouldUseProxyAddr returns true if the TBOT_USE_PROXY_ADDR environment
+// variable is set to "yes". More generally, this indicates that the user wishes
+// for tbot to prefer using the proxy address that has been explicitly provided
+// by the user rather than the one fetched via a discovery process (e.g ping).
+func shouldUseProxyAddr() bool {
+	return os.Getenv(useProxyAddrEnv) == "yes"
 }
 
 func (conf *BotConfig) UnmarshalYAML(node *yaml.Node) error {
@@ -275,8 +197,11 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		return trace.Wrap(err)
 	}
 
-	// We've migrated Outputs to Services, so copy all Outputs to Services.
+	// We've migrated Outputs to Services, so move all Outputs to Services.
 	conf.Services = append(conf.Services, conf.Outputs...)
+	conf.Outputs = nil
+
+	namer := newServiceNamer()
 	for i, service := range conf.Services {
 		if err := service.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err, "validating service[%d]", i)
@@ -284,19 +209,29 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		if err := service.GetCredentialLifetime().Validate(conf.Oneshot); err != nil {
 			return trace.Wrap(err, "validating service[%d]", i)
 		}
+
+		name, err := namer.pickName(service.Type(), service.GetName())
+		switch {
+		case err != nil:
+			return trace.Wrap(err, "validating service[%d]", i)
+		case name != service.GetName():
+			service.SetName(name)
+		}
 	}
 
 	destinationPaths := map[string]int{}
-	addDestinationToKnownPaths := func(d bot.Destination) {
+	addDestinationToKnownPaths := func(d destination.Destination) {
 		switch d := d.(type) {
-		case *DestinationDirectory:
+		case *destination.Directory:
 			destinationPaths[fmt.Sprintf("file://%s", d.Path)]++
-		case *DestinationKubernetesSecret:
+		case *k8s.SecretDestination:
 			destinationPaths[fmt.Sprintf("kubernetes-secret://%s", d.Name)]++
 		}
 	}
 	for _, svc := range conf.Services {
-		v, ok := svc.(interface{ GetDestination() bot.Destination })
+		v, ok := svc.(interface {
+			GetDestination() destination.Destination
+		})
 		if ok {
 			addDestinationToKnownPaths(v.GetDestination())
 		}
@@ -329,7 +264,7 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 	// Therefore, we need to check its valid here, but enforce its presence
 	// elsewhere.
 	if conf.Onboarding.JoinMethod != types.JoinMethodUnspecified {
-		if !slices.Contains(SupportedJoinMethods, string(conf.Onboarding.JoinMethod)) {
+		if !slices.Contains(onboarding.SupportedJoinMethods, string(conf.Onboarding.JoinMethod)) {
 			return trace.BadParameter("unrecognized join method: %q", conf.Onboarding.JoinMethod)
 		}
 	}
@@ -350,7 +285,7 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 	}
 
 	// Validate CertificateTTL and RenewalInterval options
-	var ttlErr SuboptimalCredentialTTLError
+	var ttlErr bot.SuboptimalCredentialTTLError
 	err := conf.CredentialLifetime.Validate(conf.Oneshot)
 	switch {
 	case errors.As(err, &ttlErr):
@@ -358,7 +293,7 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		// just reject the configuration in a future release.
 		//
 		//nolint:sloglint // msg cannot be constant
-		log.WarnContext(context.TODO(), ttlErr.msg, ttlErr.LogLabels()...)
+		log.WarnContext(context.TODO(), ttlErr.Message(), ttlErr.LogLabels()...)
 	case err != nil:
 		return err
 	}
@@ -374,7 +309,16 @@ type ServiceConfig interface {
 	// GetCredentialLifetime returns the service's custom certificate TTL and
 	// RenewalInterval. It's used for validation purposes; services that do not
 	// support these options should return the zero value.
-	GetCredentialLifetime() CredentialLifetime
+	GetCredentialLifetime() bot.CredentialLifetime
+
+	// GetName returns the service's given name. Initially the name chosen by
+	// the user, but after BotConfig.CheckAndSetDefaults is called it may be
+	// our automatically generated name.
+	GetName() string
+
+	// SetName is called by BotConfig.CheckAndSetDefaults to assign the service
+	// a new name if the user didn't specify one.
+	SetName(string)
 }
 
 // ServiceConfigs assists polymorphic unmarshaling of a slice of ServiceConfigs.
@@ -382,6 +326,7 @@ type ServiceConfigs []ServiceConfig
 
 func (o *ServiceConfigs) UnmarshalYAML(node *yaml.Node) error {
 	var out []ServiceConfig
+	var unmarshalContext unmarshalConfigContext
 	for _, node := range node.Content {
 		header := struct {
 			Type string `yaml:"type"`
@@ -391,98 +336,110 @@ func (o *ServiceConfigs) UnmarshalYAML(node *yaml.Node) error {
 		}
 
 		switch header.Type {
-		case ExampleServiceType:
-			v := &ExampleService{}
+		case example.ServiceType:
+			v := &example.Config{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case SPIFFEWorkloadAPIServiceType:
-			v := &SPIFFEWorkloadAPIService{}
+		case legacyspiffe.WorkloadAPIServiceType:
+			v := &legacyspiffe.WorkloadAPIConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case DatabaseTunnelServiceType:
-			v := &DatabaseTunnelService{}
+		case database.TunnelServiceType:
+			v := &database.TunnelConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case SSHMultiplexerServiceType:
-			v := &SSHMultiplexerService{}
-			if err := node.Decode(v); err != nil {
+		case ssh.MultiplexerServiceType:
+			v := &ssh.MultiplexerConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case KubernetesOutputType:
-			v := &KubernetesOutput{}
-			if err := node.Decode(v); err != nil {
+		case k8s.OutputV1ServiceType:
+			v := &k8s.OutputV1Config{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case KubernetesV2OutputType:
-			v := &KubernetesV2Output{}
-			if err := node.Decode(v); err != nil {
+		case k8s.OutputV2ServiceType:
+			v := &k8s.OutputV2Config{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case SPIFFESVIDOutputType:
-			v := &SPIFFESVIDOutput{}
+		case k8s.ArgoCDOutputServiceType:
+			v := &k8s.ArgoCDOutputConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case SSHHostOutputType:
-			v := &SSHHostOutput{}
-			if err := node.Decode(v); err != nil {
+		case legacyspiffe.SVIDOutputServiceType:
+			v := &legacyspiffe.SVIDOutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case ApplicationOutputType:
-			v := &ApplicationOutput{}
-			if err := node.Decode(v); err != nil {
+		case ssh.HostOutputServiceType:
+			v := &ssh.HostOutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case DatabaseOutputType:
-			v := &DatabaseOutput{}
-			if err := node.Decode(v); err != nil {
+		case application.OutputServiceType:
+			v := &application.OutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case IdentityOutputType:
-			v := &IdentityOutput{}
-			if err := node.Decode(v); err != nil {
+		case database.OutputServiceType:
+			v := &database.OutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case ApplicationTunnelServiceType:
-			v := &ApplicationTunnelService{}
-			if err := node.Decode(v); err != nil {
+		case identity.OutputServiceType:
+			v := &identity.OutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case WorkloadIdentityX509OutputType:
-			v := &WorkloadIdentityX509Service{}
+		case application.TunnelServiceType:
+			v := &application.TunnelConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case WorkloadIdentityAPIServiceType:
-			v := &WorkloadIdentityAPIService{}
-			if err := node.Decode(v); err != nil {
+		case workloadidentity.X509OutputServiceType:
+			v := &workloadidentity.X509OutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case WorkloadIdentityJWTOutputType:
-			v := &WorkloadIdentityJWTService{}
+		case workloadidentity.WorkloadAPIServiceType:
+			v := &workloadidentity.WorkloadAPIConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
 			out = append(out, v)
-		case WorkloadIdentityAWSRAType:
-			v := &WorkloadIdentityAWSRAService{}
+		case workloadidentity.JWTOutputServiceType:
+			v := &workloadidentity.JWTOutputConfig{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case awsra.ServiceType:
+			v := &awsra.Config{}
+			if err := v.UnmarshalConfig(unmarshalContext, node); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case application.ProxyServiceType:
+			v := &application.ProxyServiceConfig{}
 			if err := node.Decode(v); err != nil {
 				return trace.Wrap(err)
 			}
@@ -496,21 +453,11 @@ func (o *ServiceConfigs) UnmarshalYAML(node *yaml.Node) error {
 	return nil
 }
 
-func withTypeHeader[T any](payload T, payloadType string) (interface{}, error) {
-	header := struct {
-		Type    string `yaml:"type"`
-		Payload T      `yaml:",inline"`
-	}{
-		Type:    payloadType,
-		Payload: payload,
-	}
-
-	return header, nil
+type unmarshalConfigContext struct {
+	internal.DefaultDestinationUnmarshaler
 }
 
-// unmarshalDestination takes a *yaml.Node and produces a bot.Destination by
-// considering the `type` field.
-func unmarshalDestination(node *yaml.Node) (bot.Destination, error) {
+func (ctx unmarshalConfigContext) UnmarshalDestination(node *yaml.Node) (destination.Destination, error) {
 	header := struct {
 		Type string `yaml:"type"`
 	}{}
@@ -519,35 +466,23 @@ func unmarshalDestination(node *yaml.Node) (bot.Destination, error) {
 	}
 
 	switch header.Type {
-	case DestinationMemoryType:
-		v := &DestinationMemory{}
-		if err := node.Decode(v); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return v, nil
-	case DestinationDirectoryType:
-		v := &DestinationDirectory{}
-		if err := node.Decode(v); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return v, nil
-	case DestinationKubernetesSecretType:
-		v := &DestinationKubernetesSecret{}
+	case k8s.SecretDestinationType:
+		v := &k8s.SecretDestination{}
 		if err := node.Decode(v); err != nil {
 			return nil, trace.Wrap(err)
 		}
 		return v, nil
 	default:
-		return nil, trace.BadParameter("unrecognized destination type (%s)", header.Type)
+		return ctx.DefaultDestinationUnmarshaler.UnmarshalDestination(node)
 	}
 }
 
 // Initable represents any ServiceConfig which is compatible with
 // `tbot init`.
 type Initable interface {
-	GetDestination() bot.Destination
+	GetDestination() destination.Destination
 	Init(ctx context.Context) error
-	Describe() []FileDescription
+	Describe() []bot.FileDescription
 }
 
 func (conf *BotConfig) GetInitables() []Initable {
@@ -561,8 +496,8 @@ func (conf *BotConfig) GetInitables() []Initable {
 }
 
 // DestinationFromURI parses a URI from the input string and returns a matching
-// bot.Destination implementation, if possible.
-func DestinationFromURI(uriString string) (bot.Destination, error) {
+// destination.Destination implementation, if possible.
+func DestinationFromURI(uriString string) (destination.Destination, error) {
 	uri, err := url.Parse(uriString)
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing --data-dir")
@@ -576,7 +511,7 @@ func DestinationFromURI(uriString string) (bot.Destination, error) {
 		}
 		// TODO(strideynet): eventually we can allow for URI query parameters
 		// to be used to configure symlinks/acl protection.
-		return &DestinationDirectory{
+		return &destination.Directory{
 			Path: uri.Path,
 		}, nil
 	case "memory":
@@ -585,27 +520,21 @@ func DestinationFromURI(uriString string) (bot.Destination, error) {
 				"memory-backed data storage should not have host or path specified",
 			)
 		}
-		return &DestinationMemory{}, nil
+		return &destination.Memory{}, nil
 	case "kubernetes-secret":
-		if uri.Host != "" {
-			return nil, trace.BadParameter(
-				"kubernetes-secret scheme should not be specified with host",
-			)
-		}
 		if uri.Path == "" {
 			return nil, trace.BadParameter(
 				"kubernetes-secret scheme should have a path specified",
 			)
 		}
 		// kubernetes-secret:///my-secret
-		// TODO(noah): Eventually we'll support namespace in the host part of
-		// the URI. For now, we'll default to the namespace tbot is running in.
 
 		// Path will be prefixed with '/' so we'll strip it off.
 		secretName := strings.TrimPrefix(uri.Path, "/")
 
-		return &DestinationKubernetesSecret{
-			Name: secretName,
+		return &k8s.SecretDestination{
+			Name:      secretName,
+			Namespace: uri.Host,
 		}, nil
 	default:
 		return nil, trace.BadParameter(
@@ -662,7 +591,7 @@ func ReadConfig(reader io.ReadSeeker, manualMigration bool) (*BotConfig, error)
 	case V1, "":
 		if !manualMigration {
 			log.WarnContext(
-				context.TODO(), "Deprecated config version (V1) detected. Attempting to perform an on-the-fly in-memory migration to latest version. Please persist the config migration by following the guidance at https://goteleport.com/docs/reference/machine-id/v14-upgrade-guide/")
+				context.TODO(), "Deprecated config version (V1) detected. Attempting to perform an on-the-fly in-memory migration to latest version. Please persist the config migration using `tbot migrate`.")
 		}
 		config := &configV1{}
 		if err := decoder.Decode(config); err != nil {
@@ -672,7 +601,7 @@ func ReadConfig(reader io.ReadSeeker, manualMigration bool) (*BotConfig, error)
 		if err != nil {
 			return nil, trace.WithUserMessage(
 				trace.Wrap(err, "migrating v1 config"),
-				"Failed to migrate. See https://goteleport.com/docs/reference/machine-id/v14-upgrade-guide/",
+				"Failed to migrate. Please contact Teleport support or use https://goteleport.com/docs/reference/machine-id/configuration/ to manually migrate your configuration.",
 			)
 		}
 		return latestConfig, nil
@@ -690,101 +619,3 @@ func ReadConfig(reader io.ReadSeeker, manualMigration bool) (*BotConfig, error)
 		return nil, trace.BadParameter("unrecognized config version %q", version.Version)
 	}
 }
-
-// CredentialLifetime contains configuration for how long credentials will
-// last (TTL) and the frequency at which they'll be renewed (RenewalInterval).
-//
-// It's a member on the BotConfig and service/output config structs, marked with
-// the `inline` YAML tag so its fields become individual fields in the YAML
-// config format.
-type CredentialLifetime struct {
-	TTL             time.Duration `yaml:"credential_ttl,omitempty"`
-	RenewalInterval time.Duration `yaml:"renewal_interval,omitempty"`
-	// skipMaxTTLValidation is used by services that do not abide by standard
-	// teleport credential lifetime limits to override the check that the
-	// user specified TTL is less than the max TTL. For example, X509 SVIDs can
-	// be issued with a lifetime of up to 2 weeks.
-	skipMaxTTLValidation bool
-}
-
-// IsEmpty returns whether none of the fields is set (i.e. it is unconfigured).
-func (l CredentialLifetime) IsEmpty() bool {
-	// We don't care about this field being set when checking empty state.
-	l.skipMaxTTLValidation = false
-	return l == CredentialLifetime{}
-}
-
-// Validate checks whether the combination of the fields is valid.
-func (l CredentialLifetime) Validate(oneShot bool) error {
-	if l.IsEmpty() {
-		return nil
-	}
-
-	if l.TTL == 0 || l.RenewalInterval == 0 {
-		return trace.BadParameter("credential_ttl and renewal_interval must both be specified if either is")
-	}
-
-	if l.TTL < 0 {
-		return trace.BadParameter("credential_ttl must be positive")
-	}
-
-	if l.RenewalInterval < 0 {
-		return trace.BadParameter("renewal_interval must be positive")
-	}
-
-	if l.TTL < l.RenewalInterval && !oneShot {
-		return SuboptimalCredentialTTLError{
-			msg: "Credential TTL is shorter than the renewal interval. This is likely an invalid configuration. Increase the credential TTL or decrease the renewal interval",
-			details: map[string]any{
-				"ttl":      l.TTL,
-				"interval": l.RenewalInterval,
-			},
-		}
-	}
-
-	if !l.skipMaxTTLValidation && l.TTL > defaults.MaxRenewableCertTTL {
-		return SuboptimalCredentialTTLError{
-			msg: "Requested certificate TTL exceeds the maximum TTL allowed and will likely be reduced by the Teleport server",
-			details: map[string]any{
-				"requested_ttl": l.TTL,
-				"maximum_ttl":   defaults.MaxRenewableCertTTL,
-			},
-		}
-	}
-
-	return nil
-}
-
-// SuboptimalCredentialTTLError is returned from CredentialLifetime.Validate
-// when the user has set CredentialTTL to something unusual that we can work
-// around (e.g. if they exceed MaxRenewableCertTTL the server will reduce it)
-// rather than rejecting their configuration.
-//
-// In the future, these probably *should* be hard failures - but that would be
-// a breaking change.
-type SuboptimalCredentialTTLError struct {
-	msg     string
-	details map[string]any
-}
-
-// Error satisfies the error interface.
-func (e SuboptimalCredentialTTLError) Error() string {
-	if len(e.details) == 0 {
-		return e.msg
-	}
-	parts := make([]string, 0, len(e.details))
-	for k, v := range e.details {
-		parts = append(parts, fmt.Sprintf("%s=%v", k, v))
-	}
-	return fmt.Sprintf("%s (%s)", e.msg, strings.Join(parts, ", "))
-}
-
-// LogLabels returns the error's details as a slice that can be passed as the
-// varadic args parameter to log functions.
-func (e SuboptimalCredentialTTLError) LogLabels() []any {
-	labels := make([]any, 0, len(e.details)*2)
-	for k, v := range e.details {
-		labels = append(labels, k, v)
-	}
-	return labels
-}
diff --git a/lib/tbot/config/config_storage.go b/lib/tbot/config/config_storage.go
index 11237a0492187..0d120f73573d7 100644
--- a/lib/tbot/config/config_storage.go
+++ b/lib/tbot/config/config_storage.go
@@ -25,7 +25,7 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 )
 
 var defaultStoragePath = filepath.Join(defaults.DataDir, "bot")
@@ -34,12 +34,12 @@ var defaultStoragePath = filepath.Join(defaults.DataDir, "bot")
 // storage.
 type StorageConfig struct {
 	// Destination's yaml is handled by MarshalYAML/UnmarshalYAML
-	Destination bot.Destination
+	Destination destination.Destination
 }
 
 func (sc *StorageConfig) CheckAndSetDefaults() error {
 	if sc.Destination == nil {
-		sc.Destination = &DestinationDirectory{
+		sc.Destination = &destination.Directory{
 			Path: defaultStoragePath,
 		}
 	}
@@ -54,7 +54,7 @@ func (sc *StorageConfig) MarshalYAML() (interface{}, error) {
 
 func (sc *StorageConfig) UnmarshalYAML(node *yaml.Node) error {
 	// Effectively inlines the destination
-	dest, err := unmarshalDestination(node)
+	dest, err := unmarshalConfigContext{}.UnmarshalDestination(node)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/tbot/config/config_test.go b/lib/tbot/config/config_test.go
index 5d4eff9af406a..54cc82899177b 100644
--- a/lib/tbot/config/config_test.go
+++ b/lib/tbot/config/config_test.go
@@ -30,9 +30,17 @@ import (
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/example"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/tbot/services/legacyspiffe"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
+	"github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 )
 
@@ -52,16 +60,16 @@ func TestConfigFile(t *testing.T) {
 	require.Equal(t, "foo", token)
 	require.ElementsMatch(t, []string{"sha256:abc123"}, cfg.Onboarding.CAPins)
 
-	_, ok := cfg.Storage.Destination.(*DestinationMemory)
+	_, ok := cfg.Storage.Destination.(*destination.Memory)
 	require.True(t, ok)
 
 	require.Len(t, cfg.Services, 1)
 	output := cfg.Services[0]
-	identOutput, ok := output.(*IdentityOutput)
+	identOutput, ok := output.(*identity.OutputConfig)
 	require.True(t, ok)
 
 	destImpl := identOutput.GetDestination()
-	destImplReal, ok := destImpl.(*DestinationDirectory)
+	destImplReal, ok := destImpl.(*destination.Directory)
 	require.True(t, ok)
 	require.Equal(t, "/tmp/foo", destImplReal.Path)
 
@@ -105,36 +113,36 @@ outputs:
 func TestDestinationFromURI(t *testing.T) {
 	tests := []struct {
 		in      string
-		want    bot.Destination
+		want    destination.Destination
 		wantErr bool
 	}{
 		{
 			in: "/absolute/dir",
-			want: &DestinationDirectory{
+			want: &destination.Directory{
 				Path: "/absolute/dir",
 			},
 		},
 		{
 			in: "relative/dir",
-			want: &DestinationDirectory{
+			want: &destination.Directory{
 				Path: "relative/dir",
 			},
 		},
 		{
 			in: "./relative/dir",
-			want: &DestinationDirectory{
+			want: &destination.Directory{
 				Path: "./relative/dir",
 			},
 		},
 		{
 			in: "file:///absolute/dir",
-			want: &DestinationDirectory{
+			want: &destination.Directory{
 				Path: "/absolute/dir",
 			},
 		},
 		{
 			in: "file:/absolute/dir",
-			want: &DestinationDirectory{
+			want: &destination.Directory{
 				Path: "/absolute/dir",
 			},
 		},
@@ -144,7 +152,7 @@ func TestDestinationFromURI(t *testing.T) {
 		},
 		{
 			in:   "memory://",
-			want: &DestinationMemory{},
+			want: &destination.Memory{},
 		},
 		{
 			in:      "memory://foo/bar",
@@ -156,17 +164,21 @@ func TestDestinationFromURI(t *testing.T) {
 		},
 		{
 			in: "kubernetes-secret:///my-secret",
-			want: &DestinationKubernetesSecret{
+			want: &k8s.SecretDestination{
 				Name: "my-secret",
 			},
 		},
 		{
-			in: "kubernetes-secret://my-secret",
-			want: &DestinationKubernetesSecret{
-				Name: "my-secret",
-			},
+			in:      "kubernetes-secret://my-secret",
 			wantErr: true,
 		},
+		{
+			in: "kubernetes-secret://my-namespace/my-secret",
+			want: &k8s.SecretDestination{
+				Name:      "my-secret",
+				Namespace: "my-namespace",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.in, func(t *testing.T) {
@@ -192,16 +204,16 @@ func TestBotConfig_YAML(t *testing.T) {
 			in: BotConfig{
 				Version: V2,
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path:     "/bot/storage",
 						ACLs:     botfs.ACLTry,
 						Symlinks: botfs.SymlinksSecure,
 					},
 				},
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: "gitlab",
 					TokenValue: "my-gitlab-token",
-					Gitlab: GitlabOnboardingConfig{
+					Gitlab: onboarding.GitlabOnboardingConfig{
 						TokenEnvVarName: "MY_CUSTOM_ENV_VAR",
 					},
 				},
@@ -210,113 +222,120 @@ func TestBotConfig_YAML(t *testing.T) {
 				Oneshot:    true,
 				AuthServer: "example.teleport.sh:443",
 				DiagAddr:   "127.0.0.1:1337",
-				CredentialLifetime: CredentialLifetime{
+				CredentialLifetime: bot.CredentialLifetime{
 					TTL:             time.Minute,
 					RenewalInterval: time.Second * 30,
 				},
 				Outputs: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/bot/output",
 						},
 						Roles:   []string{"editor"},
 						Cluster: "example.teleport.sh",
 					},
-					&IdentityOutput{
-						Destination: &DestinationMemory{},
+					&identity.OutputConfig{
+						Destination: &destination.Memory{},
 					},
-					&IdentityOutput{
-						Destination: &DestinationKubernetesSecret{
+					&identity.OutputConfig{
+						Destination: &k8s.SecretDestination{
 							Name: "my-secret",
 						},
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
 				},
 				Services: []ServiceConfig{
-					&SPIFFEWorkloadAPIService{
+					&legacyspiffe.WorkloadAPIConfig{
 						Listen: "unix:///var/run/spiffe.sock",
-						SVIDs: []SVIDRequestWithRules{
+						SVIDs: []legacyspiffe.SVIDRequestWithRules{
 							{
-								SVIDRequest: SVIDRequest{
+								SVIDRequest: legacyspiffe.SVIDRequest{
 									Path: "/bar",
 									Hint: "my hint",
-									SANS: SVIDRequestSANs{
+									SANS: legacyspiffe.SVIDRequestSANs{
 										DNS: []string{"foo.bar"},
 										IP:  []string{"10.0.0.1"},
 									},
 								},
-								Rules: []SVIDRequestRule{
+								Rules: []legacyspiffe.SVIDRequestRule{
 									{
-										Unix: SVIDRequestRuleUnix{
+										Unix: legacyspiffe.SVIDRequestRuleUnix{
 											PID: ptr(100),
 											UID: ptr(1000),
 											GID: ptr(1234),
 										},
 									},
 									{
-										Unix: SVIDRequestRuleUnix{
+										Unix: legacyspiffe.SVIDRequestRuleUnix{
 											PID: ptr(100),
 										},
 									},
 								},
 							},
 						},
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
-					&ExampleService{
+					&example.Config{
 						Message: "llama",
 					},
-					&SSHMultiplexerService{
-						Destination: &DestinationDirectory{
+					&ssh.MultiplexerConfig{
+						Destination: &destination.Directory{
 							Path: "/bot/output",
 						},
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
-					&ApplicationTunnelService{
+					&application.TunnelConfig{
 						Listen:  "tcp://127.0.0.1:123",
 						Roles:   []string{"access"},
 						AppName: "my-app",
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
+							TTL:             30 * time.Second,
+							RenewalInterval: 15 * time.Second,
+						},
+					},
+					&application.ProxyServiceConfig{
+						Listen: "tcp://127.0.0.1:8080",
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
-					&WorkloadIdentityX509Service{
-						Destination: &DestinationDirectory{
+					&workloadidentity.X509OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/an/output/path",
 						},
-						Selector: WorkloadIdentitySelector{
+						Selector: bot.WorkloadIdentitySelector{
 							Name: "my-workload-identity",
 						},
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
-					&WorkloadIdentityAPIService{
+					&workloadidentity.WorkloadAPIConfig{
 						Listen: "tcp://127.0.0.1:123",
-						Selector: WorkloadIdentitySelector{
+						Selector: bot.WorkloadIdentitySelector{
 							Name: "my-workload-identity",
 						},
-						CredentialLifetime: CredentialLifetime{
+						CredentialLifetime: bot.CredentialLifetime{
 							TTL:             30 * time.Second,
 							RenewalInterval: 15 * time.Second,
 						},
 					},
-					&WorkloadIdentityJWTService{
-						Destination: &DestinationDirectory{
+					&workloadidentity.JWTOutputConfig{
+						Destination: &destination.Directory{
 							Path: "/an/output/path",
 						},
-						Selector: WorkloadIdentitySelector{
+						Selector: bot.WorkloadIdentitySelector{
 							Name: "my-workload-identity",
 						},
 						Audiences: []string{"audience1", "audience2"},
@@ -329,13 +348,13 @@ func TestBotConfig_YAML(t *testing.T) {
 			in: BotConfig{
 				Version:    V2,
 				AuthServer: "example.teleport.sh:443",
-				CredentialLifetime: CredentialLifetime{
+				CredentialLifetime: bot.CredentialLifetime{
 					TTL:             time.Minute,
 					RenewalInterval: time.Second * 30,
 				},
 				Outputs: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationMemory{},
+					&identity.OutputConfig{
+						Destination: &destination.Memory{},
 					},
 				},
 			},
@@ -345,13 +364,13 @@ func TestBotConfig_YAML(t *testing.T) {
 			in: BotConfig{
 				Version:     V2,
 				ProxyServer: "example.teleport.sh:443",
-				CredentialLifetime: CredentialLifetime{
+				CredentialLifetime: bot.CredentialLifetime{
 					TTL:             time.Minute,
 					RenewalInterval: time.Second * 30,
 				},
 				Outputs: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationMemory{},
+					&identity.OutputConfig{
+						Destination: &destination.Memory{},
 					},
 				},
 			},
@@ -396,7 +415,7 @@ func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
 func TestBotConfig_InsecureWithCAPins(t *testing.T) {
 	cfg := &BotConfig{
 		Insecure: true,
-		Onboarding: OnboardingConfig{
+		Onboarding: onboarding.Config{
 			CAPins: []string{"123"},
 		},
 	}
@@ -407,7 +426,7 @@ func TestBotConfig_InsecureWithCAPins(t *testing.T) {
 func TestBotConfig_InsecureWithCAPath(t *testing.T) {
 	cfg := &BotConfig{
 		Insecure: true,
-		Onboarding: OnboardingConfig{
+		Onboarding: onboarding.Config{
 			CAPath: "/tmp/invalid-path/some.crt",
 		},
 	}
@@ -418,7 +437,7 @@ func TestBotConfig_InsecureWithCAPath(t *testing.T) {
 func TestBotConfig_WithCAPathAndCAPins(t *testing.T) {
 	cfg := &BotConfig{
 		Insecure: false,
-		Onboarding: OnboardingConfig{
+		Onboarding: onboarding.Config{
 			CAPath: "/tmp/invalid-path/some.crt",
 			CAPins: []string{"123"},
 		},
@@ -432,9 +451,9 @@ func TestBotConfig_ServicePartialCredentialLifetime(t *testing.T) {
 		Version:    V2,
 		AuthServer: "example.teleport.sh:443",
 		Services: []ServiceConfig{
-			&IdentityOutput{
-				CredentialLifetime: CredentialLifetime{TTL: 5 * time.Minute},
-				Destination:        &DestinationMemory{},
+			&identity.OutputConfig{
+				CredentialLifetime: bot.CredentialLifetime{TTL: 5 * time.Minute},
+				Destination:        &destination.Memory{},
 			},
 		},
 	}
@@ -446,9 +465,9 @@ func TestBotConfig_ServiceInvalidCredentialLifetime(t *testing.T) {
 		Version:    V2,
 		AuthServer: "example.teleport.sh:443",
 		Services: []ServiceConfig{
-			&IdentityOutput{
-				CredentialLifetime: CredentialLifetime{TTL: 5 * time.Minute},
-				Destination:        &DestinationMemory{},
+			&identity.OutputConfig{
+				CredentialLifetime: bot.CredentialLifetime{TTL: 5 * time.Minute},
+				Destination:        &destination.Memory{},
 			},
 		},
 	}
@@ -480,51 +499,6 @@ credential_ttl: 10m
 	})
 }
 
-func TestCredentialLifetimeValidate(t *testing.T) {
-	testCases := map[string]struct {
-		cfg     CredentialLifetime
-		oneShot bool
-		error   string
-	}{
-		"partial config": {
-			cfg:   CredentialLifetime{TTL: 1 * time.Minute},
-			error: "credential_ttl and renewal_interval must both be specified if either is",
-		},
-		"negative TTL": {
-			cfg:   CredentialLifetime{TTL: -time.Minute, RenewalInterval: time.Minute},
-			error: "credential_ttl must be positive",
-		},
-		"negative renewal interval": {
-			cfg:   CredentialLifetime{TTL: time.Minute, RenewalInterval: -time.Minute},
-			error: "renewal_interval must be positive",
-		},
-		"TTL less than renewal interval": {
-			cfg:   CredentialLifetime{TTL: time.Minute, RenewalInterval: 2 * time.Minute},
-			error: "TTL is shorter than the renewal interval",
-		},
-		"TTL less than renewal interval (one-shot)": {
-			cfg:     CredentialLifetime{TTL: time.Minute, RenewalInterval: 2 * time.Minute},
-			oneShot: true,
-			error:   "",
-		},
-		"TTL too long": {
-			cfg:   CredentialLifetime{TTL: defaults.MaxRenewableCertTTL * 2, RenewalInterval: time.Minute},
-			error: "TTL exceeds the maximum TTL allowed",
-		},
-	}
-	for name, tc := range testCases {
-		t.Run(name, func(t *testing.T) {
-			err := tc.cfg.Validate(tc.oneShot)
-
-			if tc.error == "" {
-				require.NoError(t, err)
-			} else {
-				require.ErrorContains(t, err, tc.error)
-			}
-		})
-	}
-}
-
 // TestBotConfig_Base64 ensures that config can be read from bas64 encoded YAML
 func TestBotConfig_Base64(t *testing.T) {
 	tests := []struct {
@@ -538,12 +512,12 @@ func TestBotConfig_Base64(t *testing.T) {
 			expected: BotConfig{
 				Version:     V2,
 				ProxyServer: "example.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: "token",
 					TokenValue: "my-token",
 				},
 				Services: []ServiceConfig{
-					&ApplicationTunnelService{
+					&application.TunnelConfig{
 						Listen:  "tcp://127.0.0.1:8080",
 						AppName: "testapp",
 					},
@@ -556,12 +530,12 @@ func TestBotConfig_Base64(t *testing.T) {
 			expected: BotConfig{
 				Version:    V2,
 				AuthServer: "example.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: "token",
 					TokenValue: "my-token",
 				},
 				Services: []ServiceConfig{
-					&ApplicationTunnelService{
+					&application.TunnelConfig{
 						Listen:  "tcp://127.0.0.1:8080",
 						AppName: "testapp",
 					},
@@ -578,3 +552,5 @@ func TestBotConfig_Base64(t *testing.T) {
 		})
 	}
 }
+
+func ptr[T any](v T) *T { return &v }
diff --git a/lib/tbot/config/destination_bound_keypair_adapter.go b/lib/tbot/config/destination_bound_keypair_adapter.go
deleted file mode 100644
index bebd82e2a38e9..0000000000000
--- a/lib/tbot/config/destination_bound_keypair_adapter.go
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-// BoundKeypairBotFSAdapter is an adapter to use bot destinations with the FS
-// abstraction for bound keypair joining. This allows keypair and state storage
-// to be written to all supported bot destination types.
-type BoundKeypairDestinationAdapter struct {
-	destination bot.Destination
-}
-
-func (f *BoundKeypairDestinationAdapter) Read(ctx context.Context, name string) ([]byte, error) {
-	bytes, err := f.destination.Read(ctx, name)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return bytes, nil
-}
-
-func (f *BoundKeypairDestinationAdapter) Write(ctx context.Context, name string, data []byte) error {
-	return trace.Wrap(f.destination.Write(ctx, name, data))
-}
-
-// NewBoundkeypairDestinationAdapter creates a new destination adapter for bound
-// keypair loading and storage.
-func NewBoundkeypairDestinationAdapter(d bot.Destination) *BoundKeypairDestinationAdapter {
-	return &BoundKeypairDestinationAdapter{
-		destination: d,
-	}
-}
diff --git a/lib/tbot/config/destination_directory.go b/lib/tbot/config/destination_directory.go
deleted file mode 100644
index 85c8e1733b9d8..0000000000000
--- a/lib/tbot/config/destination_directory.go
+++ /dev/null
@@ -1,485 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"os/user"
-	"path"
-	"path/filepath"
-	"strings"
-
-	"github.com/gravitational/trace"
-	"go.opentelemetry.io/otel/attribute"
-	oteltrace "go.opentelemetry.io/otel/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-const DestinationDirectoryType = "directory"
-
-// DestinationDirectory is a Destination that writes to the local filesystem
-type DestinationDirectory struct {
-	Path     string               `yaml:"path,omitempty"`
-	Symlinks botfs.SymlinksMode   `yaml:"symlinks,omitempty"`
-	ACLs     botfs.ACLMode        `yaml:"acls,omitempty"`
-	Readers  []*botfs.ACLSelector `yaml:"readers,omitempty"`
-
-	// aclsEnabled is set during `Init()` if new-style ACLs are requested and
-	// the ACL test succeeds. When true, ACLs will be corrected on-the-fly
-	// during `Write()`.
-	aclsEnabled bool
-}
-
-func (dd *DestinationDirectory) UnmarshalYAML(node *yaml.Node) error {
-	// Accept either a string path or a full struct (allowing for options in
-	// the future, e.g. configuring permissions, etc):
-	//   directory: /foo
-	// or:
-	//   directory:
-	//     path: /foo
-	//     some_future_option: bar
-
-	var path string
-	if err := node.Decode(&path); err == nil {
-		dd.Path = path
-		return nil
-	}
-
-	// Shenanigans to prevent UnmarshalYAML from recursing back to this
-	// override (we want to use standard unmarshal behavior for the full
-	// struct)
-	type rawDirectory DestinationDirectory
-	return trace.Wrap(node.Decode((*rawDirectory)(dd)))
-}
-
-func (dd *DestinationDirectory) CheckAndSetDefaults() error {
-	if dd.Path == "" {
-		return trace.BadParameter("destination path must not be empty")
-	}
-
-	for i, reader := range dd.Readers {
-		if err := reader.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err, "reader entry %d is invalid", i)
-		}
-	}
-
-	switch dd.Symlinks {
-	case "":
-		// We default to SymlinksTrySecure. It's become apparent that the
-		// kernel version alone is not usually enough information to know that
-		// secure symlinks is supported by the OS. In future, we should aim to
-		// perform a more definitive test.
-		dd.Symlinks = botfs.SymlinksTrySecure
-	case botfs.SymlinksInsecure, botfs.SymlinksTrySecure:
-		// valid
-	case botfs.SymlinksSecure:
-		if !botfs.HasSecureWriteSupport() {
-			return trace.BadParameter("symlink mode %q not supported on this system", dd.Symlinks)
-		}
-	default:
-		return trace.BadParameter("invalid symlinks mode: %q", dd.Symlinks)
-	}
-
-	aclsSupported := botfs.HasACLSupport()
-	switch dd.ACLs {
-	case "":
-		if aclsSupported {
-			// Unlike openat2(), we can't ever depend on ACLs being available.
-			// We'll only ever try to use them, end users can opt-in to a hard
-			// ACL check if they wish.
-			dd.ACLs = botfs.ACLTry
-		} else {
-			// if aclsSupported == false here, we know it will never work, so
-			// don't bother trying.
-			dd.ACLs = botfs.ACLOff
-		}
-	case botfs.ACLOff, botfs.ACLTry:
-		// valid
-	case botfs.ACLRequired:
-		if !aclsSupported {
-			return trace.BadParameter("acls mode %q not supported on this system", dd.ACLs)
-		}
-	default:
-		return trace.BadParameter("invalid acls mode: %q", dd.ACLs)
-	}
-
-	return nil
-}
-
-// mkdir attempts to make the given directory with extra logging.
-func mkdir(p string) error {
-	stat, err := os.Stat(p)
-	if trace.IsNotFound(err) {
-		if err := os.MkdirAll(p, botfs.DefaultDirMode); err != nil {
-			if errors.Is(err, fs.ErrPermission) {
-				return trace.Wrap(err, "Teleport does not have permission to write to %v. Ensure that you are running as a user with appropriate permissions.", p)
-			}
-			return trace.Wrap(err)
-		}
-
-		log.InfoContext(
-			context.TODO(),
-			"Created directory",
-			"path", p,
-		)
-	} else if err != nil {
-		// this can occur if we are unable to read the data dir
-		if errors.Is(err, fs.ErrPermission) {
-			return trace.Wrap(err, "Teleport does not have permission to access: %v. Ensure that you are running as a user with appropriate permissions.", p)
-		}
-		return trace.Wrap(err)
-	} else if !stat.IsDir() {
-		return trace.BadParameter("Path %q already exists and is not a directory", p)
-	}
-
-	return nil
-}
-
-func (dd *DestinationDirectory) Init(ctx context.Context, subdirs []string) error {
-	// Create the directory if needed.
-	if err := mkdir(dd.Path); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Check for ACL configuration and test to ensure support.
-	if len(dd.Readers) > 0 && dd.ACLs != botfs.ACLOff {
-		// Run a test to ensure we can actually make use of them.
-		if err := botfs.TestACL(dd.Path, dd.Readers); err != nil {
-			if dd.ACLs == botfs.ACLRequired {
-				return trace.Wrap(err, "ACLs were marked as required but the "+
-					"write test failed. Remove `acls: required` or resolve the "+
-					"underlying issue.")
-			}
-
-			const msg = "ACLs were requested but could not be configured, they " +
-				"will be disabled. To resolve this warning, ensure ACLs are " +
-				"supported and the directory is owned by the bot user, or " +
-				"remove any configured readers to disable ACLs"
-			log.WarnContext(
-				ctx,
-				msg,
-				"path", dd.Path,
-				"error", err,
-				"readers", dd.Readers,
-			)
-
-			dd.aclsEnabled = false
-		} else {
-			dd.aclsEnabled = true
-			log.InfoContext(
-				ctx,
-				"ACL test succeeded and will be configured at runtime",
-				"path", dd.Path,
-				"readers", len(dd.Readers),
-			)
-		}
-	}
-
-	if dd.aclsEnabled {
-		// Correct the base directory ACLs. Note that no default ACL is
-		// configured; we manage each file/subdirectory ACL manually.
-		if err := dd.verifyAndCorrectACL(ctx, ""); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	for _, dir := range subdirs {
-		if err := mkdir(path.Join(dd.Path, dir)); err != nil {
-			return trace.Wrap(err)
-		}
-
-		if dd.aclsEnabled {
-			if err := dd.verifyAndCorrectACL(ctx, dir); err != nil {
-				return trace.Wrap(err)
-			}
-		}
-	}
-
-	return nil
-}
-
-// verifyLegacyACLs performs minor runtime verification of legacy-style ACLs,
-// where it is _not_ assumed that the destination is owned by the bot user.
-// This will not attempt to correct any issues, but will cause a hard failure if
-// `acls: required` is configured and issues are detected.
-func (dd *DestinationDirectory) verifyLegacyACLs(keys []string) error {
-	currentUser, err := user.Current()
-	if err != nil {
-		// user.Current will fail if the user id does not exist in /etc/passwd
-		// as is the case with some containerized environments.
-		// TODO(noah): Switch to os.Getuid / handling UIDs directly.
-		if dd.ACLs == botfs.ACLRequired {
-			return trace.Wrap(err, "determining current user")
-		}
-		log.WarnContext(
-			context.TODO(),
-			"Unable to determine current user, ACLs will not be checked. To silence this warning, set ACL mode to `off`.",
-			"path", dd.Path,
-			"error", err,
-		)
-		return nil
-	}
-
-	errors := []error{}
-	for _, key := range keys {
-		path := filepath.Join(dd.Path, key)
-
-		errors = append(errors, botfs.VerifyLegacyACL(path, &botfs.ACLOptions{
-			BotUser: currentUser,
-		}))
-	}
-
-	// Unlike new-style ACLs, we'll allow hard fails here: we don't expect to
-	// be able to manage legacy ACLs at runtime and need to depend on them being
-	// correct from the start, so hard fails at this stage make sense.
-	aggregate := trace.NewAggregate(errors...)
-	if dd.ACLs == botfs.ACLRequired {
-		// Hard fail if ACLs are specifically requested and there are errors.
-		return aggregate
-	}
-
-	if aggregate != nil {
-		log.WarnContext(
-			context.TODO(),
-			"Destination has unexpected ACLs",
-			"path", dd.Path,
-			"errors", aggregate,
-		)
-	}
-
-	return nil
-}
-
-func (dd *DestinationDirectory) Verify(keys []string) error {
-	// Preflight: Warn on common misconfigurations where any kind of ACL
-	// management will be impossible.
-	if dd.ACLs == botfs.ACLOff {
-		if len(dd.Readers) > 0 {
-			log.InfoContext(
-				context.TODO(),
-				"Readers are configured but ACLs are disabled for this destination. No ACLs will be managed or verified.",
-				"path", dd.Path,
-			)
-		}
-		return nil
-	}
-
-	if !botfs.HasACLSupport() {
-		if dd.ACLs == botfs.ACLRequired {
-			return trace.BadParameter("ACLs are marked as required for destination %s but are not supported on this platform. Set `acls: off` to resolve this error.", dd.Path)
-		}
-
-		if len(dd.Readers) > 0 {
-			log.WarnContext(
-				context.TODO(),
-				"Readers are configured but this platform does not support filesystem ACLs. ACL management will be disabled.",
-				"path", dd.Path,
-			)
-		}
-	}
-
-	stat, err := os.Stat(dd.Path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Note: os.Getuid() returns -1 on Windows, but we've implicitly eliminated
-	// that as an option with the `botfs.HasACLSupport()` check above.
-	ownedByBot, err := botfs.IsOwnedBy(stat, os.Getuid())
-	if trace.IsNotImplemented(err) {
-		// If file owners aren't supported, ACLs certainly aren't. Just bail.
-		// (Subject to change if we ever try to support Windows ACLs.)
-		if dd.ACLs == botfs.ACLRequired {
-			return trace.NotImplemented("unable to determine file ownership on this platform but ACLs were marked as required, cannot continue")
-		}
-
-		log.WarnContext(
-			context.TODO(),
-			"unable to determine file ownership on this platform, ACL verification will be skipped",
-			"path", dd.Path,
-			"error", err,
-		)
-
-		return nil
-	} else if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Check for new-style ACL configuration. These explicitly require
-	// destinations to be owned by the bot user. This is somewhat arbitrarily
-	// here instead of in Init() and will run before each write attempt.
-	if len(dd.Readers) > 0 {
-		if !ownedByBot {
-			const msg = "This destination is not owned by the bot user so ACLs " +
-				"will not be enforced. To silence this warning, fix destination " +
-				"file ownership or remove configured `readers`"
-			log.WarnContext(
-				context.TODO(),
-				msg,
-				"path", dd.Path,
-			)
-
-			return nil
-		}
-
-		return nil
-	}
-
-	// For legacy ACLs, make sure it's worth warning about them. If the
-	// destination is owned by the bot (implying the user is not trying to use
-	// ACLs), just bail.
-	if ownedByBot {
-		return nil
-	}
-
-	return trace.Wrap(dd.verifyLegacyACLs(keys))
-}
-
-// verifyAndCorrectACL performs validation and attempts correction on new-style
-// ACLs when configured.
-//
-//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
-func (dd *DestinationDirectory) verifyAndCorrectACL(ctx context.Context, subpath string) error {
-	p := filepath.Join(dd.Path, subpath)
-
-	// As a sanity check, try to ensure the resulting path is (lexically) a
-	// child of this destination.
-	if !strings.HasPrefix(p, filepath.Clean(dd.Path)) {
-		return trace.BadParameter("path %s is not a child of destination %s", p, dd.Path)
-	}
-
-	log.DebugContext(ctx, "verifying ACL", "path", p)
-	issues, err := botfs.VerifyACL(p, dd.Readers)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// If issues exist, attempt remediation. As the test during `Init()`
-	// passed, regardless of ACL mode (try, required), treat all errors here
-	// as hard failures.
-	if len(issues) > 0 {
-		if err := botfs.ConfigureACL(p, dd.Readers); err != nil {
-			return trace.Wrap(err, "unable to fix misconfigured ACL at path %s with issues %v", p, issues)
-		}
-
-		log.InfoContext(
-			ctx,
-			"corrected ACLs on destination file",
-			"destination", dd.Path,
-			"path", subpath,
-			"issues", issues,
-		)
-	}
-
-	return nil
-}
-
-func (dd *DestinationDirectory) Write(ctx context.Context, name string, data []byte) error {
-	_, span := tracer.Start(
-		ctx,
-		"DestinationDirectory/Write",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	// If there are any parent directories, attempt to mkdir them again in case
-	// things have drifted since `Init()` was run. We don't bother with secure
-	// botfs.Create() since it's a no-op for directory creation.
-	if dir, _ := filepath.Split(name); dir != "" {
-		if err := mkdir(filepath.Join(dd.Path, dir)); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	path := filepath.Join(dd.Path, name)
-
-	// We can't configure permissions on a file that doesn't exist, so attempt
-	// to read the file first to determine if it exists, and create it if
-	// necessary.
-	_, err := botfs.Read(path, dd.Symlinks)
-	if trace.IsNotFound(err) {
-		log.DebugContext(ctx, "file is missing, creating to apply permissions", "path", path)
-		if err := botfs.Create(path, false, dd.Symlinks); err != nil {
-			return trace.Wrap(err)
-		}
-	} else if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if dd.aclsEnabled {
-		// Sequentially check all subdirectory ACLs.
-		dirs := strings.Split(name, string(os.PathSeparator))
-		for i := 1; i < len(dirs); i++ {
-			// note: filepath.Join() will call `filepath.Clean()` on each result
-			if err := dd.verifyAndCorrectACL(ctx, filepath.Join(dirs[:i]...)); err != nil {
-				return trace.Wrap(err)
-			}
-		}
-
-		if err := dd.verifyAndCorrectACL(ctx, name); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return trace.Wrap(botfs.Write(path, data, dd.Symlinks))
-}
-
-func (dd *DestinationDirectory) Read(ctx context.Context, name string) ([]byte, error) {
-	_, span := tracer.Start(
-		ctx,
-		"DestinationDirectory/Read",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	data, err := botfs.Read(filepath.Join(dd.Path, name), dd.Symlinks)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return data, nil
-}
-
-func (dd *DestinationDirectory) String() string {
-	return fmt.Sprintf("%s: %s", DestinationDirectoryType, dd.Path)
-}
-
-func (dd *DestinationDirectory) TryLock() (func() error, error) {
-	// TryLock should only be used for bot data directory and not for
-	// destinations until an investigation on how locks will play with
-	// ACLs has been completed.
-	unlock, err := utils.FSTryWriteLock(filepath.Join(dd.Path, "lock"))
-	return unlock, trace.Wrap(err)
-}
-
-func (dm *DestinationDirectory) MarshalYAML() (interface{}, error) {
-	type raw DestinationDirectory
-	return withTypeHeader((*raw)(dm), DestinationDirectoryType)
-}
-
-func (dd *DestinationDirectory) IsPersistent() bool {
-	return true
-}
diff --git a/lib/tbot/config/destination_directory_test.go b/lib/tbot/config/destination_directory_test.go
deleted file mode 100644
index d0b78257f0198..0000000000000
--- a/lib/tbot/config/destination_directory_test.go
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func TestDestinationDirectory_Lock(t *testing.T) {
-	dd := &DestinationDirectory{
-		Path:     t.TempDir(),
-		Symlinks: botfs.SymlinksInsecure,
-		ACLs:     botfs.ACLOff,
-	}
-
-	// Successful lock
-	unlock, err := dd.TryLock()
-	require.NoError(t, err)
-
-	// Another lock should fail
-	_, err = dd.TryLock()
-	require.ErrorIs(t, err, utils.ErrUnsuccessfulLockTry)
-
-	// Release the lock
-	require.NoError(t, unlock())
-
-	// Trying to lock again should succeed
-	unlock, err = dd.TryLock()
-	require.NoError(t, err)
-
-	// Release the lock
-	require.NoError(t, unlock())
-}
-
-func TestDestinationDirectory_YAML(t *testing.T) {
-	tests := []testYAMLCase[DestinationDirectory]{
-		{
-			name: "full",
-			in: DestinationDirectory{
-				Path:     "/my/path",
-				ACLs:     botfs.ACLRequired,
-				Symlinks: botfs.SymlinksSecure,
-			},
-		},
-		{
-			name: "minimal",
-			in: DestinationDirectory{
-				Path: "/my/path",
-			},
-		},
-		{
-			name: "acl readers",
-			in: DestinationDirectory{
-				Path: "/my/path",
-				ACLs: botfs.ACLRequired,
-				Readers: []*botfs.ACLSelector{
-					{
-						User: "foo",
-					},
-					{
-						Group: "123",
-					},
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestDestinationDirectory_ACLs(t *testing.T) {
-	if !botfs.HasACLSupport() {
-		t.Skipf("ACLs not supported on this host")
-	}
-
-	ctx := context.Background()
-	dir := t.TempDir()
-	path := filepath.Join(dir, "test")
-
-	dd := DestinationDirectory{
-		Path: path,
-		ACLs: botfs.ACLRequired,
-		Readers: []*botfs.ACLSelector{
-			{
-				// We explicitly want to support nonexistent UIDs, so we'll pick
-				// an arbitrary UID we don't expect to exist. This particular
-				// value is outside the usual reserved ranges documented by
-				// Debian:
-				// https://www.debian.org/doc/debian-policy/ch-opersys.html#uid-and-gid-classes
-				User: "59123",
-			},
-		},
-	}
-	require.NoError(t, dd.CheckAndSetDefaults())
-
-	err := dd.Init(ctx, []string{"foo"})
-	if trace.IsNotImplemented(err) {
-		t.Skipf("ACLs were unexpectedly not supported: %+v", err)
-	}
-
-	require.NoError(t, err)
-
-	// An ACL should be configured for the root directory
-	issues, err := botfs.VerifyACL(path, dd.Readers)
-	require.NoError(t, err)
-	require.Empty(t, issues)
-
-	// Create an empty file to simulate an artifact. We explicitly want to
-	// observe ACL problems from a file created out-of-band, so that Write() can
-	// attempt to fix them.
-	artifactPath := filepath.Join(path, "foo", "bar")
-	f, err := os.Create(artifactPath)
-	require.NoError(t, err)
-	f.Close()
-
-	issues, err = botfs.VerifyACL(artifactPath, dd.Readers)
-	require.NoError(t, err)
-
-	// note, lib/tbot/botfs's TestCompareACL tests the specifics of an empty ACL
-	require.NotEmpty(t, issues)
-
-	err = dd.Write(ctx, "foo/bar", []byte("hello world"))
-	require.NoError(t, err)
-
-	// The previous issues should now be resolved.
-	issues, err = botfs.VerifyACL(artifactPath, dd.Readers)
-	require.NoError(t, err)
-	require.Empty(t, issues)
-
-	// Finally, try writing to a completely separate path to ensure Write()
-	// initializes new files with a sane ACL.
-	require.NoError(t, dd.Write(ctx, "baz", []byte("example")))
-	issues, err = botfs.VerifyACL(filepath.Join(path, "baz"), dd.Readers)
-	require.NoError(t, err)
-	require.Empty(t, issues)
-}
diff --git a/lib/tbot/config/destination_kubernetes_secret.go b/lib/tbot/config/destination_kubernetes_secret.go
deleted file mode 100644
index 57eb78fc78cc9..0000000000000
--- a/lib/tbot/config/destination_kubernetes_secret.go
+++ /dev/null
@@ -1,293 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"sync"
-
-	"github.com/gravitational/trace"
-	"go.opentelemetry.io/otel/attribute"
-	oteltrace "go.opentelemetry.io/otel/trace"
-	corev1 "k8s.io/api/core/v1"
-	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	applyconfigv1 "k8s.io/client-go/applyconfigurations/core/v1"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/tools/clientcmd"
-)
-
-const DestinationKubernetesSecretType = "kubernetes_secret"
-const kubernetesNamespaceEnv = "POD_NAMESPACE"
-
-type DestinationKubernetesSecret struct {
-	// Name is the name the Kubernetes Secret that should be created and written
-	// to.
-	Name string `yaml:"name"`
-	// Labels is a set of labels to apply to the output Kubernetes secret.
-	// When configured, these labels will overwrite any existing labels on the
-	// secret.
-	Labels map[string]string `yaml:"labels,omitempty"`
-
-	mu          sync.Mutex
-	namespace   string
-	k8s         kubernetes.Interface
-	initialized bool
-}
-
-func (dks *DestinationKubernetesSecret) getSecret(ctx context.Context) (*corev1.Secret, error) {
-	secret, err := dks.k8s.CoreV1().Secrets(dks.namespace).Get(ctx, dks.Name, v1.GetOptions{})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// This will be nil out of Kubernetes if it hasn't had any values provided.
-	// Replace with an initialized map so code using this function does not
-	// need to worry about writing/reading from a nil map.
-	if secret.Data == nil {
-		secret.Data = map[string][]byte{}
-	}
-	return secret, nil
-}
-
-func (dks *DestinationKubernetesSecret) secretTemplate() *corev1.Secret {
-	return &corev1.Secret{
-		Type: corev1.SecretTypeOpaque,
-		ObjectMeta: v1.ObjectMeta{
-			Name:      dks.Name,
-			Namespace: dks.namespace,
-			Labels:    dks.Labels,
-		},
-		Data: map[string][]byte{},
-	}
-}
-
-func (dks *DestinationKubernetesSecret) upsertSecret(ctx context.Context, secret *corev1.Secret, dryRun bool) error {
-	apply := applyconfigv1.Secret(dks.Name, dks.namespace).
-		WithData(secret.Data).
-		WithResourceVersion(secret.ResourceVersion).
-		WithType(secret.Type)
-
-	// If user has configured labels, we overwrite the labels on the secret.
-	if len(dks.Labels) > 0 {
-		apply = apply.
-			WithLabels(dks.Labels)
-	}
-
-	applyOpts := v1.ApplyOptions{
-		FieldManager: "tbot",
-	}
-	if dryRun {
-		applyOpts.DryRun = []string{"All"}
-	}
-
-	_, err := dks.k8s.CoreV1().Secrets(dks.namespace).Apply(ctx, apply, applyOpts)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (dks *DestinationKubernetesSecret) Verify(_ []string) error {
-	return nil
-}
-
-func (dks *DestinationKubernetesSecret) TryLock() (func() error, error) {
-	// No locking support currently implemented. Users will need to be cautious
-	// to not point two tbots to the same secret.
-	return func() error { return nil }, nil
-}
-
-func (dks *DestinationKubernetesSecret) CheckAndSetDefaults() error {
-	if dks.Name == "" {
-		return trace.BadParameter("name must not be empty")
-	}
-
-	return nil
-}
-
-func (dks *DestinationKubernetesSecret) Init(ctx context.Context, subdirs []string) error {
-	dks.mu.Lock()
-	defer dks.mu.Unlock()
-	if dks.initialized == true {
-		return trace.BadParameter("destination has already been initialized")
-	}
-
-	if dks.namespace == "" {
-		dks.namespace = os.Getenv(kubernetesNamespaceEnv)
-		if dks.namespace == "" {
-			return trace.BadParameter("unable to detect namespace from %s environment variable", kubernetesNamespaceEnv)
-		}
-	}
-
-	if len(subdirs) > 0 {
-		return trace.BadParameter("kubernetes_secret destination does not support subdirectories")
-	}
-
-	// If no k8s client is injected, we attempt to create one from the
-	// environment.
-	if dks.k8s == nil {
-		// BuildConfigFromFlags falls back to InClusterConfig if both params
-		// are empty. This means KUBECONFIG takes precedence.
-		clientCfg, err := clientcmd.BuildConfigFromFlags("", os.Getenv("KUBECONFIG"))
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		dks.k8s, err = kubernetes.NewForConfig(clientCfg)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	// Perform an initial dry-run attempt of applying the secret. This ensures
-	// that we have the appropriate RBAC before proceeding, but avoids creating
-	// a secret which will remain empty if something goes wrong later in the
-	// credential generation.
-	secret, err := dks.getSecret(ctx)
-	if err != nil {
-		if !kubeerrors.IsNotFound(err) {
-			return trace.Wrap(err)
-		}
-		secret = dks.secretTemplate()
-	}
-	if err := dks.upsertSecret(ctx, secret, true); err != nil {
-		return trace.Wrap(err)
-	}
-
-	dks.initialized = true
-	return nil
-}
-
-func (dks *DestinationKubernetesSecret) Write(ctx context.Context, name string, data []byte) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"DestinationKubernetesSecret/Write",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	dks.mu.Lock()
-	defer dks.mu.Unlock()
-	if dks.initialized == false {
-		return trace.BadParameter("destination has not been initialized")
-	}
-
-	secret, err := dks.getSecret(ctx)
-	if err != nil {
-		if !kubeerrors.IsNotFound(err) {
-			return trace.Wrap(err)
-		}
-		log.WarnContext(
-			ctx,
-			"Kubernetes secret missing on attempt to write data. One will be created.",
-			"secret_name", dks.Name,
-			"secret_namespace", dks.namespace,
-		)
-		// If the secret doesn't exist, we create it on write - this is ensures
-		// that we can recover if the secret is deleted between renewal loops.
-		secret = dks.secretTemplate()
-	}
-
-	secret.Data[name] = data
-
-	err = dks.upsertSecret(ctx, secret, false)
-	return trace.Wrap(err)
-}
-
-// WriteMany allows you to write multiple artifacts to a destination at once.
-// This should be atomic, meaning all artifacts are written or none are. Any
-// artifacts that are not specified will be removed from the destination.
-func (dks *DestinationKubernetesSecret) WriteMany(ctx context.Context, toWrite map[string][]byte) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"DestinationKubernetesSecret/WriteMany",
-	)
-	defer span.End()
-
-	dks.mu.Lock()
-	defer dks.mu.Unlock()
-	if dks.initialized == false {
-		return trace.BadParameter("destination has not been initialized")
-	}
-
-	secret, err := dks.getSecret(ctx)
-	if err != nil {
-		if !kubeerrors.IsNotFound(err) {
-			return trace.Wrap(err)
-		}
-		log.WarnContext(
-			ctx,
-			"Kubernetes secret missing on attempt to write data. One will be created.",
-			"secret_name", dks.Name,
-			"secret_namespace", dks.namespace,
-		)
-		// If the secret doesn't exist, we create it on write - this is ensures
-		// that we can recover if the secret is deleted between renewal loops.
-		secret = dks.secretTemplate()
-	}
-
-	secret.Data = toWrite
-
-	err = dks.upsertSecret(ctx, secret, false)
-	return trace.Wrap(err)
-}
-
-func (dks *DestinationKubernetesSecret) Read(ctx context.Context, name string) ([]byte, error) {
-	ctx, span := tracer.Start(
-		ctx,
-		"DestinationKubernetesSecret/Read",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	dks.mu.Lock()
-	defer dks.mu.Unlock()
-	if dks.initialized == false {
-		return nil, trace.BadParameter("destination has not been initialized")
-	}
-
-	secret, err := dks.getSecret(ctx)
-	if err != nil {
-		if kubeerrors.IsNotFound(err) {
-			return nil, trace.NotFound("secret could not be found")
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	data, ok := secret.Data[name]
-	if !ok {
-		return nil, trace.NotFound("key %q cannot be found in secret data", name)
-	}
-
-	return data, nil
-}
-
-func (dks *DestinationKubernetesSecret) String() string {
-	return fmt.Sprintf("%s: %s", DestinationKubernetesSecretType, dks.Name)
-}
-
-func (dks *DestinationKubernetesSecret) MarshalYAML() (interface{}, error) {
-	type raw DestinationKubernetesSecret
-	return withTypeHeader((*raw)(dks), DestinationKubernetesSecretType)
-}
-
-func (dks *DestinationKubernetesSecret) IsPersistent() bool {
-	return true
-}
diff --git a/lib/tbot/config/destination_kubernetes_secret_test.go b/lib/tbot/config/destination_kubernetes_secret_test.go
deleted file mode 100644
index f79a8301392ef..0000000000000
--- a/lib/tbot/config/destination_kubernetes_secret_test.go
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/kubernetes/fake"
-	core "k8s.io/client-go/testing"
-)
-
-func TestDestinationKubernetesSecret(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "test-namespace")
-
-	// Hack a reactor into the Kubernetes client-go fake client set as it
-	// doesn't currently support Apply :)
-	// https://github.com/kubernetes/kubernetes/issues/99953
-	fakeClientSet := func(objects ...runtime.Object) *fake.Clientset {
-		f := fake.NewSimpleClientset(objects...)
-		f.PrependReactor("patch", "secrets", func(action core.Action) (handled bool, ret runtime.Object, err error) {
-			pa := action.(core.PatchAction)
-			if pa.GetPatchType() == types.ApplyPatchType {
-				react := core.ObjectReaction(f.Tracker())
-				_, _, err := react(
-					core.NewGetAction(pa.GetResource(), pa.GetNamespace(), pa.GetName()),
-				)
-				if kubeerrors.IsNotFound(err) {
-					_, _, err = react(
-						core.NewCreateAction(pa.GetResource(), pa.GetNamespace(), &corev1.Secret{
-							ObjectMeta: metav1.ObjectMeta{
-								Name:      pa.GetName(),
-								Namespace: pa.GetNamespace(),
-							},
-						}),
-					)
-					if err != nil {
-						return false, nil, err
-					}
-				}
-				return react(action)
-			}
-			return false, nil, nil
-		})
-		return f
-	}
-
-	tests := []struct {
-		name string
-		dest *DestinationKubernetesSecret
-
-		wantErr string
-	}{
-		{
-			name: "no existing secret",
-			dest: &DestinationKubernetesSecret{
-				Name: "my-secret",
-				k8s:  fakeClientSet(),
-			},
-		},
-		{
-			name: "labels",
-			dest: &DestinationKubernetesSecret{
-				Name: "my-secret",
-				Labels: map[string]string{
-					"key": "value",
-					"bar": "baz",
-				},
-				k8s: fakeClientSet(),
-			},
-		},
-		{
-			name: "existing secret",
-			dest: &DestinationKubernetesSecret{
-				Name: "my-secret",
-				k8s: fakeClientSet(&corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "my-secret",
-						Namespace: "test-namespace",
-					},
-				}),
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			require.NoError(t, tt.dest.Init(ctx, []string{}))
-
-			// Test individual write
-			require.NoError(t, tt.dest.Write(ctx, "artifact-a", []byte("data-a")))
-			require.NoError(t, tt.dest.Write(ctx, "artifact-b", []byte("data-b")))
-			aData, err := tt.dest.Read(ctx, "artifact-a")
-			require.NoError(t, err)
-			require.Equal(t, []byte("data-a"), aData)
-			bData, err := tt.dest.Read(ctx, "artifact-b")
-			require.NoError(t, err)
-			require.Equal(t, []byte("data-b"), bData)
-
-			// Test write many
-			require.NoError(t, tt.dest.WriteMany(ctx, map[string][]byte{
-				"artifact-a": []byte("data-c"),
-				"artifact-b": []byte("data-d"),
-			}))
-			aData, err = tt.dest.Read(ctx, "artifact-a")
-			require.NoError(t, err)
-			require.Equal(t, []byte("data-c"), aData)
-			bData, err = tt.dest.Read(ctx, "artifact-b")
-			require.NoError(t, err)
-			require.Equal(t, []byte("data-d"), bData)
-
-			// Check labels have been set
-			secret, err := tt.dest.k8s.CoreV1().Secrets("test-namespace").Get(ctx, tt.dest.Name, metav1.GetOptions{})
-			require.NoError(t, err)
-			require.Equal(t, tt.dest.Labels, secret.Labels)
-		})
-	}
-}
-
-func TestDestinationKubernetesSecret_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*DestinationKubernetesSecret]{
-		{
-			name: "valid",
-			in: func() *DestinationKubernetesSecret {
-				return &DestinationKubernetesSecret{
-					Name: "my-secret",
-				}
-			},
-		},
-		{
-			name: "missing name",
-			in: func() *DestinationKubernetesSecret {
-				return &DestinationKubernetesSecret{
-					Name: "",
-				}
-			},
-			wantErr: "name must not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
-
-func TestDestinationKubernetesSecret_YAML(t *testing.T) {
-	tests := []testYAMLCase[*DestinationKubernetesSecret]{
-		{
-			name: "full",
-			in: &DestinationKubernetesSecret{
-				Name: "my-secret",
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestDestinationKubernetesSecret_String(t *testing.T) {
-	require.Equal(t, "kubernetes_secret: my-secret", (&DestinationKubernetesSecret{Name: "my-secret"}).String())
-}
diff --git a/lib/tbot/config/destination_memory.go b/lib/tbot/config/destination_memory.go
deleted file mode 100644
index ce4f3a9151e9a..0000000000000
--- a/lib/tbot/config/destination_memory.go
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"sync"
-
-	"github.com/gravitational/trace"
-	"go.opentelemetry.io/otel/attribute"
-	oteltrace "go.opentelemetry.io/otel/trace"
-	"gopkg.in/yaml.v3"
-)
-
-const DestinationMemoryType = "memory"
-
-// DestinationMemory is a memory certificate Destination
-type DestinationMemory struct {
-	store map[string][]byte `yaml:"-"`
-	// mutex protects store in case other routines want to read its content
-	mutex sync.RWMutex
-}
-
-func (dm *DestinationMemory) UnmarshalYAML(node *yaml.Node) error {
-	// Accept either a bool or a raw (in this case empty) struct
-	//   memory: {}
-	// or:
-	//   memory: true
-
-	var boolVal bool
-	if err := node.Decode(&boolVal); err == nil {
-		if !boolVal {
-			return trace.BadParameter("memory must not be false (leave unset to disable)")
-		}
-		return nil
-	}
-
-	type rawMemory DestinationMemory
-	return trace.Wrap(node.Decode((*rawMemory)(dm)))
-}
-
-func (dm *DestinationMemory) CheckAndSetDefaults() error {
-	dm.store = make(map[string][]byte)
-
-	return nil
-}
-
-func (dm *DestinationMemory) Init(_ context.Context, subdirs []string) error {
-	// Nothing to do.
-	return nil
-}
-
-func (dm *DestinationMemory) Verify(keys []string) error {
-	// Nothing to do.
-	return nil
-}
-
-func (dm *DestinationMemory) Write(ctx context.Context, name string, data []byte) error {
-	_, span := tracer.Start(
-		ctx,
-		"DestinationMemory/Write",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	dm.mutex.Lock()
-	defer dm.mutex.Unlock()
-	dm.store[name] = data
-
-	return nil
-}
-
-func (dm *DestinationMemory) Read(ctx context.Context, name string) ([]byte, error) {
-	_, span := tracer.Start(
-		ctx,
-		"DestinationMemory/Read",
-		oteltrace.WithAttributes(attribute.String("name", name)),
-	)
-	defer span.End()
-
-	dm.mutex.RLock()
-	defer dm.mutex.RUnlock()
-	b, ok := dm.store[name]
-	if !ok {
-		return nil, trace.NotFound("not found: %s", name)
-	}
-
-	return b, nil
-}
-
-func (dm *DestinationMemory) String() string {
-	return DestinationMemoryType
-}
-
-func (dm *DestinationMemory) TryLock() (func() error, error) {
-	// As this is purely in-memory, no locking behavior is required for the
-	// Destination.
-	return func() error {
-		return nil
-	}, nil
-}
-
-func (dm *DestinationMemory) MarshalYAML() (interface{}, error) {
-	type raw DestinationMemory
-	return withTypeHeader((*raw)(dm), DestinationMemoryType)
-}
-
-func (dm *DestinationMemory) IsPersistent() bool {
-	return false
-}
diff --git a/lib/tbot/config/destination_nop.go b/lib/tbot/config/destination_nop.go
deleted file mode 100644
index e5682ab4e6a7d..0000000000000
--- a/lib/tbot/config/destination_nop.go
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-)
-
-const DestinationNopType = "nop"
-
-// DestinationNop does nothing! Useful for odd scenarios where a destination
-// has to be returned but there is none to return.
-type DestinationNop struct{}
-
-// CheckAndSetDefaults does nothing! It is necessary to implement the
-// Destination interface.
-func (dm *DestinationNop) CheckAndSetDefaults() error {
-	return nil
-}
-
-// Init does nothing! It is necessary to implement the Destination interface.
-func (dm *DestinationNop) Init(_ context.Context, subdirs []string) error {
-	// Nothing to do.
-	return nil
-}
-
-// Verify does nothing! It is necessary to implement the Destination interface.
-func (dm *DestinationNop) Verify(keys []string) error {
-	// Nothing to do.
-	return nil
-}
-
-// Write does nothing! It is necessary to implement the Destination interface.
-func (dm *DestinationNop) Write(_ context.Context, name string, data []byte) error {
-	// Nothing to do.
-	return nil
-}
-
-// Read does nothing, it behaves as if the requested artifact could not be
-// found! It is necessary to implement the Destination interface.
-func (dm *DestinationNop) Read(_ context.Context, name string) ([]byte, error) {
-	// Nothing to do.
-	return nil, trace.NotFound("reading from a nop destination results in no data")
-}
-
-// String returns a human-readable string that describes this instance.
-func (dm *DestinationNop) String() string {
-	return DestinationNopType
-}
-
-// TryLock does nothing! It is necessary to implement the Destination interface.
-func (dm *DestinationNop) TryLock() (func() error, error) {
-	return func() error {
-		return nil
-	}, nil
-}
-
-// MarshalYAML enables the yaml package to correctly marshal the Destination
-// as YAML including the type header.
-func (dm *DestinationNop) MarshalYAML() (interface{}, error) {
-	type raw DestinationNop
-	return withTypeHeader((*raw)(dm), DestinationNopType)
-}
-
-func (dm *DestinationNop) IsPersistent() bool {
-	return false
-}
diff --git a/lib/tbot/config/migrate.go b/lib/tbot/config/migrate.go
index 2db890bd8d712..925bfeff37ed6 100644
--- a/lib/tbot/config/migrate.go
+++ b/lib/tbot/config/migrate.go
@@ -26,14 +26,21 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
 )
 
 type destinationMixinV1 struct {
-	Directory *DestinationDirectory `yaml:"directory"`
-	Memory    *DestinationMemory    `yaml:"memory"`
+	Directory *destination.Directory `yaml:"directory"`
+	Memory    *destination.Memory    `yaml:"memory"`
 }
 
-func (c *destinationMixinV1) migrate() (bot.Destination, error) {
+func (c *destinationMixinV1) migrate() (destination.Destination, error) {
 	switch {
 	case c.Memory != nil && c.Directory != nil:
 		return nil, trace.BadParameter("both 'memory' and 'directory' cannot be specified")
@@ -263,7 +270,7 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 				break
 			}
 		}
-		return &ApplicationOutput{
+		return &application.OutputConfig{
 			Destination:           dest,
 			Roles:                 c.Roles,
 			AppName:               c.App,
@@ -277,28 +284,28 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 		); err != nil {
 			return nil, trace.Wrap(err, "validating template configs")
 		}
-		format := UnspecifiedDatabaseFormat
+		format := database.UnspecifiedDatabaseFormat
 		for _, templateConfig := range c.Configs {
 			if templateConfig.Mongo != nil {
-				if format != UnspecifiedDatabaseFormat {
+				if format != database.UnspecifiedDatabaseFormat {
 					return nil, trace.BadParameter("multiple candidate formats for database output")
 				}
-				format = MongoDatabaseFormat
+				format = database.MongoDatabaseFormat
 			}
 			if templateConfig.Cockroach != nil {
-				if format != UnspecifiedDatabaseFormat {
+				if format != database.UnspecifiedDatabaseFormat {
 					return nil, trace.BadParameter("multiple candidate formats for database output")
 				}
-				format = CockroachDatabaseFormat
+				format = database.CockroachDatabaseFormat
 			}
 			if templateConfig.TLS != nil {
-				if format != UnspecifiedDatabaseFormat {
+				if format != database.UnspecifiedDatabaseFormat {
 					return nil, trace.BadParameter("multiple candidate formats for database output")
 				}
-				format = TLSDatabaseFormat
+				format = database.TLSDatabaseFormat
 			}
 		}
-		return &DatabaseOutput{
+		return &database.OutputConfig{
 			Destination: dest,
 			Roles:       c.Roles,
 			Format:      format,
@@ -314,7 +321,7 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 		); err != nil {
 			return nil, trace.Wrap(err, "validating template configs")
 		}
-		return &KubernetesOutput{
+		return &k8s.OutputV1Config{
 			Destination:       dest,
 			Roles:             c.Roles,
 			KubernetesCluster: c.KubernetesCluster,
@@ -336,7 +343,7 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 				break
 			}
 		}
-		return &SSHHostOutput{
+		return &ssh.HostOutputConfig{
 			Destination: dest,
 			Roles:       c.Roles,
 			Principals:  principals,
@@ -349,7 +356,7 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 		); err != nil {
 			return nil, trace.Wrap(err, "validating template configs")
 		}
-		return &IdentityOutput{
+		return &identity.OutputConfig{
 			Destination: dest,
 			Roles:       c.Roles,
 			Cluster:     c.Cluster,
@@ -358,14 +365,14 @@ func (c *configV1Destination) migrate() (ServiceConfig, error) {
 }
 
 type configV1 struct {
-	Onboarding      OnboardingConfig `yaml:"onboarding"`
-	Debug           bool             `yaml:"debug"`
-	AuthServer      string           `yaml:"auth_server"`
-	CertificateTTL  time.Duration    `yaml:"certificate_ttl"`
-	RenewalInterval time.Duration    `yaml:"renewal_interval"`
-	Oneshot         bool             `yaml:"oneshot"`
-	FIPS            bool             `yaml:"fips"`
-	DiagAddr        string           `yaml:"diag_addr"`
+	Onboarding      onboarding.Config `yaml:"onboarding"`
+	Debug           bool              `yaml:"debug"`
+	AuthServer      string            `yaml:"auth_server"`
+	CertificateTTL  time.Duration     `yaml:"certificate_ttl"`
+	RenewalInterval time.Duration     `yaml:"renewal_interval"`
+	Oneshot         bool              `yaml:"oneshot"`
+	FIPS            bool              `yaml:"fips"`
+	DiagAddr        string            `yaml:"diag_addr"`
 
 	Destinations  []configV1Destination `yaml:"destinations"`
 	StorageConfig *storageConfigV1      `yaml:"storage"`
@@ -405,7 +412,7 @@ func (c *configV1) migrate() (*BotConfig, error) {
 		Onboarding: c.Onboarding,
 		Debug:      c.Debug,
 		AuthServer: c.AuthServer,
-		CredentialLifetime: CredentialLifetime{
+		CredentialLifetime: bot.CredentialLifetime{
 			TTL:             c.CertificateTTL,
 			RenewalInterval: c.RenewalInterval,
 		},
diff --git a/lib/tbot/config/migrate_test.go b/lib/tbot/config/migrate_test.go
index db87a895b2e38..a7d272f3f3f74 100644
--- a/lib/tbot/config/migrate_test.go
+++ b/lib/tbot/config/migrate_test.go
@@ -26,7 +26,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
 )
 
 func TestMigrate(t *testing.T) {
@@ -110,12 +118,12 @@ destinations:
 				AuthServer: "example.teleport.sh:443",
 				Oneshot:    true,
 				Debug:      true,
-				CredentialLifetime: CredentialLifetime{
+				CredentialLifetime: bot.CredentialLifetime{
 					RenewalInterval: time.Minute * 10,
 					TTL:             time.Minute * 30,
 				},
 				DiagAddr: "127.0.0.1:621",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "my-token",
 					CAPins: []string{
@@ -123,56 +131,56 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path:     "/path/storage",
 						ACLs:     botfs.ACLRequired,
 						Symlinks: botfs.SymlinksSecure,
 					},
 				},
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/path/destination",
 						},
 						Roles: []string{"foo"},
 					},
-					&ApplicationOutput{
-						Destination:           &DestinationMemory{},
+					&application.OutputConfig{
+						Destination:           &destination.Memory{},
 						AppName:               "my-app",
 						SpecificTLSExtensions: true,
 					},
-					&ApplicationOutput{
-						Destination: &DestinationMemory{},
+					&application.OutputConfig{
+						Destination: &destination.Memory{},
 						AppName:     "my-app",
 					},
-					&KubernetesOutput{
-						Destination:       &DestinationMemory{},
+					&k8s.OutputV1Config{
+						Destination:       &destination.Memory{},
 						KubernetesCluster: "my-kubernetes-cluster",
 					},
-					&DatabaseOutput{
-						Destination: &DestinationMemory{},
+					&database.OutputConfig{
+						Destination: &destination.Memory{},
 						Service:     "my-db-service",
 						Database:    "the-db",
 						Username:    "alice",
-						Format:      UnspecifiedDatabaseFormat,
+						Format:      database.UnspecifiedDatabaseFormat,
 					},
-					&DatabaseOutput{
-						Destination: &DestinationMemory{},
+					&database.OutputConfig{
+						Destination: &destination.Memory{},
 						Service:     "my-db-service",
-						Format:      MongoDatabaseFormat,
+						Format:      database.MongoDatabaseFormat,
 					},
-					&DatabaseOutput{
-						Destination: &DestinationMemory{},
+					&database.OutputConfig{
+						Destination: &destination.Memory{},
 						Service:     "my-db-service",
-						Format:      TLSDatabaseFormat,
+						Format:      database.TLSDatabaseFormat,
 					},
-					&DatabaseOutput{
-						Destination: &DestinationMemory{},
+					&database.OutputConfig{
+						Destination: &destination.Memory{},
 						Service:     "my-db-service",
-						Format:      CockroachDatabaseFormat,
+						Format:      database.CockroachDatabaseFormat,
 					},
-					&SSHHostOutput{
-						Destination: &DestinationMemory{},
+					&ssh.HostOutputConfig{
+						Destination: &destination.Memory{},
 						Roles:       []string{"foo"},
 						Principals:  []string{"example.com", "second.example.com"},
 					},
@@ -202,16 +210,16 @@ destinations:
 				AuthServer: "example.teleport.sh:443",
 				Oneshot:    true,
 				Debug:      true,
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodGitHub,
 					TokenValue: "my-token",
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationMemory{},
+					Destination: &destination.Memory{},
 				},
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path:     "/path/example",
 							Symlinks: "try-secure",
 						},
@@ -243,16 +251,16 @@ destinations:
 				AuthServer: "example.teleport.sh:443",
 				Oneshot:    true,
 				Debug:      true,
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodGitHub,
 					TokenValue: "my-token",
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationMemory{},
+					Destination: &destination.Memory{},
 				},
 				Services: ServiceConfigs{
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path:     "/path/example",
 							Symlinks: "try-secure",
 						},
@@ -285,16 +293,16 @@ destinations:
 				AuthServer: "example.teleport.sh:443",
 				Oneshot:    true,
 				Debug:      true,
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodGitHub,
 					TokenValue: "my-token",
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationMemory{},
+					Destination: &destination.Memory{},
 				},
 				Services: ServiceConfigs{
-					&ApplicationOutput{
-						Destination: &DestinationDirectory{
+					&application.OutputConfig{
+						Destination: &destination.Directory{
 							Path:     "/path/example",
 							Symlinks: "try-secure",
 						},
@@ -322,7 +330,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "auth.example.com:3025",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "00000000000000000000000000000000",
 					CAPins: []string{
@@ -330,13 +338,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 					},
@@ -365,7 +373,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -373,13 +381,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&DatabaseOutput{
-						Destination: &DestinationDirectory{
+					&database.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						Service:  "example-server",
@@ -415,7 +423,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -423,16 +431,16 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&DatabaseOutput{
-						Destination: &DestinationDirectory{
+					&database.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
-						Format:   MongoDatabaseFormat,
+						Format:   database.MongoDatabaseFormat,
 						Service:  "example-server",
 						Username: "alice",
 						Database: "example",
@@ -465,7 +473,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -473,16 +481,16 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&DatabaseOutput{
-						Destination: &DestinationDirectory{
+					&database.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
-						Format:   CockroachDatabaseFormat,
+						Format:   database.CockroachDatabaseFormat,
 						Service:  "example-server",
 						Username: "alice",
 						Database: "example",
@@ -515,7 +523,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -523,16 +531,16 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&DatabaseOutput{
-						Destination: &DestinationDirectory{
+					&database.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
-						Format:   TLSDatabaseFormat,
+						Format:   database.TLSDatabaseFormat,
 						Service:  "example-server",
 						Username: "alice",
 						Database: "example",
@@ -569,27 +577,27 @@ oneshot: false
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "example.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "1234abcd5678efgh9",
 					CAPins: []string{
 						"sha256:1234abcd5678efgh910ijklmnop",
 					},
 				},
-				CredentialLifetime: CredentialLifetime{
+				CredentialLifetime: bot.CredentialLifetime{
 					RenewalInterval: DefaultRenewInterval,
 					TTL:             DefaultCertificateTTL,
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path:     "/var/lib/teleport/bot",
 						Symlinks: "secure",
 						ACLs:     "try",
 					},
 				},
 				Services: ServiceConfigs{
-					&SSHHostOutput{
-						Destination: &DestinationDirectory{
+					&ssh.HostOutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						Principals: []string{"nodename.my.domain.com"},
@@ -615,7 +623,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -623,13 +631,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&ApplicationOutput{
-						Destination: &DestinationDirectory{
+					&application.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						AppName: "grafana-example",
@@ -658,7 +666,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -666,13 +674,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&ApplicationOutput{
-						Destination: &DestinationDirectory{
+					&application.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						AppName:               "grafana-example",
@@ -699,7 +707,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 					CAPins: []string{
@@ -707,13 +715,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						KubernetesCluster: "example-k8s-cluster",
@@ -733,7 +741,7 @@ onboarding:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodToken,
 					TokenValue: "abcd123-insecure-do-not-use-this",
 				},
@@ -769,12 +777,12 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleport.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					JoinMethod: types.JoinMethodIAM,
 					TokenValue: "iam-token-kube",
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path:     "/var/lib/teleport/bot",
 						Symlinks: botfs.SymlinksInsecure,
 						ACLs:     botfs.ACLOff,
@@ -782,15 +790,15 @@ destinations:
 				},
 				Debug: true,
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path:     "/opt/machine-id",
 							Symlinks: botfs.SymlinksInsecure,
 							ACLs:     botfs.ACLOff,
 						},
 					},
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path:     "/opt/machine-id/tools",
 							Symlinks: botfs.SymlinksInsecure,
 							ACLs:     botfs.ACLOff,
@@ -816,14 +824,14 @@ destinations:
 			wantOutput: &BotConfig{
 				Version: V2,
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path:     "/var/tmp/teleport/bot",
 						Symlinks: botfs.SymlinksInsecure,
 					},
 				},
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path:     "/var/tmp/machine-id",
 							Symlinks: botfs.SymlinksInsecure,
 						},
@@ -852,17 +860,17 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "teleportvm.example.com:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					TokenValue: "redacted",
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&DatabaseOutput{
-						Destination: &DestinationDirectory{
+					&database.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						Roles:    []string{"access"},
@@ -891,7 +899,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "redacted.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					TokenValue: "redacted-scanner-token",
 					JoinMethod: types.JoinMethodIAM,
 					CAPins: []string{
@@ -899,13 +907,13 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/opt/machine-id",
 						},
 						KubernetesCluster: "devops",
@@ -949,7 +957,7 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "redacted.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					TokenValue: "redacted-argocd-token",
 					JoinMethod: types.JoinMethodIAM,
 					CAPins: []string{
@@ -957,41 +965,41 @@ destinations:
 					},
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/bot",
 					},
 				},
 				Services: ServiceConfigs{
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/mount/redacted-prod-global",
 							ACLs: botfs.ACLOff,
 						},
 						KubernetesCluster: "redacted-prod-global",
 					},
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/mount/redacted-prod-au",
 							ACLs: botfs.ACLOff,
 						},
 						KubernetesCluster: "redacted-prod-au",
 					},
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/mount/redacted-prod-eu2",
 							ACLs: botfs.ACLOff,
 						},
 						KubernetesCluster: "redacted-prod-eu2",
 					},
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/mount/redacted-prod-ca",
 							ACLs: botfs.ACLOff,
 						},
 						KubernetesCluster: "redacted-prod-ca",
 					},
-					&KubernetesOutput{
-						Destination: &DestinationDirectory{
+					&k8s.OutputV1Config{
+						Destination: &destination.Directory{
 							Path: "/mount/redacted-prod-us",
 							ACLs: botfs.ACLOff,
 						},
@@ -1032,32 +1040,32 @@ destinations:
 			wantOutput: &BotConfig{
 				Version:    V2,
 				AuthServer: "redacted.teleport.sh:443",
-				Onboarding: OnboardingConfig{
+				Onboarding: onboarding.Config{
 					TokenValue: "redacted",
 					JoinMethod: types.JoinMethodToken,
 				},
 				Storage: &StorageConfig{
-					Destination: &DestinationDirectory{
+					Destination: &destination.Directory{
 						Path: "/var/lib/teleport/tbot",
 					},
 				},
 				Services: ServiceConfigs{
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/path/to/role1_creds",
 							ACLs: botfs.ACLRequired,
 						},
 						Roles: []string{"role1"},
 					},
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/path/to/role2_creds",
 							ACLs: botfs.ACLRequired,
 						},
 						Roles: []string{"role2"},
 					},
-					&IdentityOutput{
-						Destination: &DestinationDirectory{
+					&identity.OutputConfig{
+						Destination: &destination.Directory{
 							Path: "/path/to/roleN_creds",
 							ACLs: botfs.ACLRequired,
 						},
diff --git a/lib/tbot/config/naming.go b/lib/tbot/config/naming.go
new file mode 100644
index 0000000000000..845b35728a36d
--- /dev/null
+++ b/lib/tbot/config/naming.go
@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/gravitational/trace"
+)
+
+// reservedServiceNames are the service names reserved for internal use.
+var reservedServiceNames = map[string]struct{}{
+	"ca-rotation":               {},
+	"crl-cache":                 {},
+	"heartbeat":                 {},
+	"identity":                  {},
+	"spiffe-trust-bundle-cache": {},
+}
+
+var invalidServiceNameRegex = regexp.MustCompile(`[^a-z\d_\-+]`)
+
+type serviceNamer struct {
+	usedNames          map[string]struct{}
+	countByServiceType map[string]int
+}
+
+func newServiceNamer() *serviceNamer {
+	return &serviceNamer{
+		usedNames:          make(map[string]struct{}),
+		countByServiceType: make(map[string]int),
+	}
+}
+
+// pickName checks the user-chosen name is valid (e.g. not reserved for internal
+// use or containing illegal characters) if one is given. If no name is given,
+// it will generate a name based on the service type with a counter suffix.
+func (n *serviceNamer) pickName(serviceType, name string) (string, error) {
+	n.countByServiceType[serviceType]++
+
+	if name == "" {
+		name = fmt.Sprintf(
+			"%s-%d",
+			invalidServiceNameRegex.ReplaceAllString(serviceType, "-"),
+			n.countByServiceType[serviceType],
+		)
+		if _, ok := n.usedNames[name]; ok {
+			return "", trace.BadParameter("service name %q conflicts with an automatically generated service name", name)
+		}
+	} else {
+		if _, ok := n.usedNames[name]; ok {
+			return "", trace.BadParameter("service name %q used more than once", name)
+		}
+		if _, ok := reservedServiceNames[name]; ok {
+			return "", trace.BadParameter("service name %q is reserved for internal use", name)
+		}
+		if invalidServiceNameRegex.MatchString(name) {
+			return "", trace.BadParameter("invalid service name: %q, may only contain lowercase letters, numbers, hyphens, underscores, or plus symbols", name)
+		}
+	}
+
+	n.usedNames[name] = struct{}{}
+	return name, nil
+}
diff --git a/lib/tbot/config/naming_test.go b/lib/tbot/config/naming_test.go
new file mode 100644
index 0000000000000..b2108a936b52f
--- /dev/null
+++ b/lib/tbot/config/naming_test.go
@@ -0,0 +1,83 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestServiceNamer(t *testing.T) {
+	t.Parallel()
+
+	t.Run("success", func(t *testing.T) {
+		namer := newServiceNamer()
+
+		// Chosen name is used.
+		name, err := namer.pickName("type/1", "foo")
+		require.NoError(t, err)
+		assert.Equal(t, "foo", name)
+
+		// Next name in the "sequence" for that service type is used.
+		t12, err := namer.pickName("type/1", "")
+		require.NoError(t, err)
+		assert.Equal(t, "type-1-2", t12)
+
+		// First name in sequence for new service type is used.
+		t21, err := namer.pickName("type/2", "")
+		require.NoError(t, err)
+		assert.Equal(t, "type-2-1", t21)
+	})
+
+	t.Run("reserved name", func(t *testing.T) {
+		namer := newServiceNamer()
+
+		_, err := namer.pickName("foo", "heartbeat")
+		require.ErrorContains(t, err, `service name "heartbeat" is reserved for internal use`)
+	})
+
+	t.Run("invalid name", func(t *testing.T) {
+		namer := newServiceNamer()
+
+		_, err := namer.pickName("foo", "hello, world")
+		require.ErrorContains(t, err, `invalid service name: "hello, world", may only contain lowercase letters, numbers, hyphens, underscores, or plus symbols`)
+	})
+
+	t.Run("named used twice", func(t *testing.T) {
+		namer := newServiceNamer()
+
+		_, err := namer.pickName("foo", "bar")
+		require.NoError(t, err)
+
+		_, err = namer.pickName("foo", "bar")
+		require.ErrorContains(t, err, `service name "bar" used more than once`)
+	})
+
+	t.Run("chosen name conflicts with generated name", func(t *testing.T) {
+		namer := newServiceNamer()
+
+		_, err := namer.pickName("foo", "foo-2")
+		require.NoError(t, err)
+
+		_, err = namer.pickName("foo", "")
+		require.ErrorContains(t, err, `service name "foo-2" conflicts with an automatically generated service name`)
+	})
+}
diff --git a/lib/tbot/config/output.go b/lib/tbot/config/output.go
deleted file mode 100644
index 276e813e151a7..0000000000000
--- a/lib/tbot/config/output.go
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-// extractOutputDestination performs surgery on yaml.Node to unmarshal a
-// destination and then remove key/values from the yaml.Node that specify
-// the destination. This *hack* allows us to have the bot.Destination as a
-// field directly on an Output without needing a struct to wrap it for
-// polymorphic unmarshaling.
-//
-// If there's no destination in the provided yaml node, then this will return
-// nil, nil.
-func extractOutputDestination(node *yaml.Node) (bot.Destination, error) {
-	for i, subNode := range node.Content {
-		if subNode.Value == "destination" {
-			// Next node will be the contents
-			dest, err := unmarshalDestination(node.Content[i+1])
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			// Remove key and contents from root node
-			node.Content = append(node.Content[:i], node.Content[i+2:]...)
-			return dest, nil
-		}
-	}
-	return nil, nil
-}
-
-func validateOutputDestination(dest bot.Destination) error {
-	if dest == nil {
-		return trace.BadParameter("no destination configured for output")
-	}
-	if err := dest.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating configured destination")
-	}
-	return nil
-}
diff --git a/lib/tbot/config/output_test.go b/lib/tbot/config/output_test.go
deleted file mode 100644
index 72f946f5fde23..0000000000000
--- a/lib/tbot/config/output_test.go
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-type checkAndSetDefaulter interface {
-	CheckAndSetDefaults() error
-}
-
-type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
-	name string
-	in   func() T
-
-	// want specifies the desired state of the checkAndSetDefaulter after
-	// check and set defaults has been run. If want is nil, the Output is
-	// compared to its initial state.
-	want    checkAndSetDefaulter
-	wantErr string
-}
-
-func memoryDestForTest() bot.Destination {
-	return &DestinationMemory{store: map[string][]byte{}}
-}
-
-func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
-	t.Helper()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := tt.in()
-			err := got.CheckAndSetDefaults()
-			if tt.wantErr != "" {
-				require.ErrorContains(t, err, tt.wantErr)
-				return
-			}
-
-			want := tt.want
-			if want == nil {
-				want = tt.in()
-			}
-			require.NoError(t, err)
-			require.Equal(t, want, got)
-		})
-	}
-}
diff --git a/lib/tbot/config/service_application.go b/lib/tbot/config/service_application.go
deleted file mode 100644
index cd4148d702910..0000000000000
--- a/lib/tbot/config/service_application.go
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-var (
-	_ ServiceConfig = &ApplicationOutput{}
-	_ Initable      = &ApplicationOutput{}
-)
-
-const ApplicationOutputType = "application"
-
-type ApplicationOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Roles is the list of roles to request for the generated credentials.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-
-	AppName string `yaml:"app_name"`
-
-	// SpecificTLSExtensions creates additional outputs named `tls.crt`,
-	// `tls.key` and `tls.cas`. This is unneeded for most clients which can
-	// be configured with specific paths to use, but exists for compatibility.
-	SpecificTLSExtensions bool `yaml:"specific_tls_naming"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *ApplicationOutput) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-func (o *ApplicationOutput) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if o.AppName == "" {
-		return trace.BadParameter("app_name must not be empty")
-	}
-
-	return nil
-}
-
-func (o *ApplicationOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *ApplicationOutput) Describe() []FileDescription {
-	out := []FileDescription{
-		{
-			Name: IdentityFilePath,
-		},
-		{
-			Name: HostCAPath,
-		},
-		{
-			Name: UserCAPath,
-		},
-		{
-			Name: DatabaseCAPath,
-		},
-	}
-	if o.SpecificTLSExtensions {
-		out = append(out, []FileDescription{
-			{
-				Name: DefaultTLSPrefix + ".crt",
-			},
-			{
-				Name: DefaultTLSPrefix + ".key",
-			},
-			{
-				Name: DefaultTLSPrefix + ".cas",
-			},
-		}...)
-	}
-	return out
-}
-
-func (o *ApplicationOutput) MarshalYAML() (interface{}, error) {
-	type raw ApplicationOutput
-	return withTypeHeader((*raw)(o), ApplicationOutputType)
-}
-
-func (o *ApplicationOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw ApplicationOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *ApplicationOutput) Type() string {
-	return ApplicationOutputType
-}
-
-func (o *ApplicationOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_application_test.go b/lib/tbot/config/service_application_test.go
deleted file mode 100644
index 8788a1a44b78e..0000000000000
--- a/lib/tbot/config/service_application_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestApplicationOutput_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[ApplicationOutput]{
-		{
-			name: "full",
-			in: ApplicationOutput{
-				Destination: dest,
-				Roles:       []string{"access"},
-				AppName:     "my-app",
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: ApplicationOutput{
-				Destination: dest,
-				AppName:     "my-app",
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestApplicationOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*ApplicationOutput]{
-		{
-			name: "valid",
-			in: func() *ApplicationOutput {
-				return &ApplicationOutput{
-					Destination: memoryDestForTest(),
-					Roles:       []string{"access"},
-					AppName:     "app",
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *ApplicationOutput {
-				return &ApplicationOutput{
-					Destination: nil,
-					AppName:     "app",
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing app_name",
-			in: func() *ApplicationOutput {
-				return &ApplicationOutput{
-					Destination: memoryDestForTest(),
-				}
-			},
-			wantErr: "app_name must not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_application_tunnel.go b/lib/tbot/config/service_application_tunnel.go
deleted file mode 100644
index ede5b1a4ac44f..0000000000000
--- a/lib/tbot/config/service_application_tunnel.go
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"net"
-	"net/url"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-)
-
-var (
-	_ ServiceConfig = &ApplicationTunnelService{}
-)
-
-const ApplicationTunnelServiceType = "application-tunnel"
-
-// ApplicationTunnelService opens an authenticated tunnel for Application
-// Access.
-type ApplicationTunnelService struct {
-	// Listen is the address on which database tunnel should listen. Example:
-	// - "tcp://127.0.0.1:3306"
-	// - "tcp://0.0.0.0:3306
-	Listen string `yaml:"listen"`
-	// Roles is the list of roles to request for the tunnel.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-	// AppName should be the name of the application as registered in Teleport
-	// that you wish to tunnel to.
-	AppName string `yaml:"app_name"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-
-	// Listener overrides "listen" and directly provides an opened listener to
-	// use.
-	Listener net.Listener `yaml:"-"`
-}
-
-func (s *ApplicationTunnelService) Type() string {
-	return ApplicationTunnelServiceType
-}
-
-func (s *ApplicationTunnelService) MarshalYAML() (interface{}, error) {
-	type raw ApplicationTunnelService
-	return withTypeHeader((*raw)(s), ApplicationTunnelServiceType)
-}
-
-func (s *ApplicationTunnelService) UnmarshalYAML(node *yaml.Node) error {
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw ApplicationTunnelService
-	if err := node.Decode((*raw)(s)); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (s *ApplicationTunnelService) CheckAndSetDefaults() error {
-	switch {
-	case s.Listen == "" && s.Listener == nil:
-		return trace.BadParameter("listen: should not be empty")
-	case s.AppName == "":
-		return trace.BadParameter("app_name: should not be empty")
-	}
-	if _, err := url.Parse(s.Listen); err != nil {
-		return trace.Wrap(err, "parsing listen")
-	}
-	return nil
-}
-
-func (o *ApplicationTunnelService) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_application_tunnel_test.go b/lib/tbot/config/service_application_tunnel_test.go
deleted file mode 100644
index 2443bbb550a68..0000000000000
--- a/lib/tbot/config/service_application_tunnel_test.go
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestApplicationTunnelService_YAML(t *testing.T) {
-	t.Parallel()
-
-	tests := []testYAMLCase[ApplicationTunnelService]{
-		{
-			name: "full",
-			in: ApplicationTunnelService{
-				Listen:  "tcp://0.0.0.0:3621",
-				AppName: "my-app",
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestApplicationTunnelService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*ApplicationTunnelService]{
-		{
-			name: "valid",
-			in: func() *ApplicationTunnelService {
-				return &ApplicationTunnelService{
-					Listen:  "tcp://0.0.0.0:3621",
-					Roles:   []string{"role1", "role2"},
-					AppName: "my-app",
-				}
-			},
-			wantErr: "",
-		},
-		{
-			name: "missing listen",
-			in: func() *ApplicationTunnelService {
-				return &ApplicationTunnelService{
-					Roles:   []string{"role1", "role2"},
-					AppName: "my-app",
-				}
-			},
-			wantErr: "listen: should not be empty",
-		},
-		{
-			name: "listen not url",
-			in: func() *ApplicationTunnelService {
-				return &ApplicationTunnelService{
-					Listen:  "\x00",
-					Roles:   []string{"role1", "role2"},
-					AppName: "my-app",
-				}
-			},
-			wantErr: "parsing listen",
-		},
-		{
-			name: "missing app name",
-			in: func() *ApplicationTunnelService {
-				return &ApplicationTunnelService{
-					Listen: "tcp://0.0.0.0:3621",
-					Roles:  []string{"role1", "role2"},
-				}
-			},
-			wantErr: "app_name: should not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_client_credential.go b/lib/tbot/config/service_client_credential.go
deleted file mode 100644
index f685aa7100c99..0000000000000
--- a/lib/tbot/config/service_client_credential.go
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"crypto/tls"
-	"sync"
-	"time"
-
-	"github.com/gravitational/trace"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-)
-
-const UnstableClientCredentialOutputType = "unstable_client_credential"
-
-var (
-	_ ServiceConfig      = &UnstableClientCredentialOutput{}
-	_ client.Credentials = &UnstableClientCredentialOutput{}
-)
-
-// UnstableClientCredentialOutput is an experimental tbot output which is
-// compatible with the client.Credential interface. This allows tbot to be
-// used as an in-memory source of credentials for the Teleport API client and
-// removes the need to write credentials to a filesystem.
-//
-// Unstable: no API stability promises are made for this struct and its methods.
-// Available configuration options may change and the signatures of methods may
-// be modified. This output is currently part of an experiment and could be
-// removed in a future release.
-type UnstableClientCredentialOutput struct {
-	mu     sync.Mutex
-	facade *identity.Facade
-	ready  chan struct{}
-}
-
-// Ready returns a channel which closes when the Output is ready to be used
-// as a client credential. Using this as a credential before Ready closes is
-// unsupported.
-func (o *UnstableClientCredentialOutput) Ready() <-chan struct{} {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.ready == nil {
-		o.ready = make(chan struct{})
-		if o.facade != nil {
-			close(o.ready)
-		}
-	}
-	return o.ready
-}
-
-// Dialer implements the client.Credential interface. It does nothing.
-func (o *UnstableClientCredentialOutput) Dialer(c client.Config) (client.ContextDialer, error) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	return nil, trace.NotImplemented("no dialer")
-}
-
-// TLSConfig implements the client.Credential interface and return the
-// tls.Config from the underlying identity.Facade.
-func (o *UnstableClientCredentialOutput) TLSConfig() (*tls.Config, error) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.facade == nil {
-		return nil, trace.BadParameter("credentials not yet ready")
-	}
-	return o.facade.TLSConfig()
-}
-
-// SSHClientConfig implements the client.Credential interface and return the
-// ssh.ClientConfig from the underlying identity.Facade.
-func (o *UnstableClientCredentialOutput) SSHClientConfig() (*ssh.ClientConfig, error) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.facade == nil {
-		return nil, trace.BadParameter("credentials not yet ready")
-	}
-	return o.facade.SSHClientConfig()
-}
-
-// Expiry returns the credential expiry.
-func (o *UnstableClientCredentialOutput) Expiry() (time.Time, bool) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.facade == nil {
-		return time.Time{}, false
-	}
-	return o.facade.Expiry()
-}
-
-// Facade returns the underlying facade
-func (o *UnstableClientCredentialOutput) Facade() (*identity.Facade, error) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.facade == nil {
-		return nil, trace.BadParameter("credentials not yet ready")
-	}
-	return o.facade, nil
-}
-
-// SetOrUpdateFacade sets up the underlying facade or updates it if it has
-// already been created.
-func (o *UnstableClientCredentialOutput) SetOrUpdateFacade(id *identity.Identity) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	if o.facade == nil {
-		if o.ready != nil {
-			close(o.ready)
-		}
-		o.facade = identity.NewFacade(false, false, id)
-		return
-	}
-	o.facade.Set(id)
-}
-
-// CheckAndSetDefaults implements the Destination interface and does nothing in
-// this implementation.
-func (o *UnstableClientCredentialOutput) CheckAndSetDefaults() error {
-	return nil
-}
-
-// MarshalYAML enables the yaml package to correctly marshal the Destination
-// as YAML including the type header.
-func (o *UnstableClientCredentialOutput) MarshalYAML() (interface{}, error) {
-	type raw UnstableClientCredentialOutput
-	return withTypeHeader((*raw)(o), UnstableClientCredentialOutputType)
-}
-
-// Type returns a human readable description of this output.
-func (o *UnstableClientCredentialOutput) Type() string {
-	return UnstableClientCredentialOutputType
-}
-
-func (o *UnstableClientCredentialOutput) GetCredentialLifetime() CredentialLifetime {
-	return CredentialLifetime{}
-}
diff --git a/lib/tbot/config/service_database.go b/lib/tbot/config/service_database.go
deleted file mode 100644
index 205e5df49f3c7..0000000000000
--- a/lib/tbot/config/service_database.go
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"slices"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const DatabaseOutputType = "database"
-
-// DatabaseFormat specifies if any special behavior should be invoked when
-// producing artifacts. This allows for databases/clients that require unique
-// formats or paths to be used.
-type DatabaseFormat string
-
-const (
-	// UnspecifiedDatabaseFormat is the unset value and the default. This
-	// should work for most databases.
-	UnspecifiedDatabaseFormat DatabaseFormat = ""
-	// TLSDatabaseFormat is for databases that require specifically named
-	// outputs: tls.key, tls.crt and tls.cas
-	TLSDatabaseFormat DatabaseFormat = "tls"
-	// MongoDatabaseFormat indicates credentials should be generated which
-	// are compatible with MongoDB.
-	// This outputs `mongo.crt` and `mongo.cas`.
-	MongoDatabaseFormat DatabaseFormat = "mongo"
-	// CockroachDatabaseFormat indicates credentials should be generated which
-	// are compatible with CockroachDB.
-	// This outputs `cockroach/node.key`, `cockroach/node.crt` and
-	// `cockroach/ca.crt`.
-	CockroachDatabaseFormat DatabaseFormat = "cockroach"
-)
-
-const (
-	// DefaultMongoPrefix is the default prefix in generated MongoDB certs.
-	DefaultMongoPrefix = "mongo"
-	// DefaultTLSPrefix is the default prefix in generated TLS certs.
-	DefaultTLSPrefix        = "tls"
-	DefaultCockroachDirName = "cockroach"
-)
-
-var databaseFormats = []DatabaseFormat{
-	UnspecifiedDatabaseFormat,
-	TLSDatabaseFormat,
-	MongoDatabaseFormat,
-	CockroachDatabaseFormat,
-}
-
-var (
-	_ ServiceConfig = &DatabaseOutput{}
-	_ Initable      = &DatabaseOutput{}
-)
-
-// DatabaseOutput produces credentials which can be used to connect to a
-// database through teleport.
-type DatabaseOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Roles is the list of roles to request for the generated credentials.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-
-	// Formats specifies if any special behavior should be invoked when
-	// producing artifacts. An empty value is supported by most database,
-	// but CockroachDB and MongoDB require this value to be set to
-	// `mongo` and `cockroach` respectively.
-	Format DatabaseFormat `yaml:"format,omitempty"`
-	// Service is the service name of the Teleport database. Generally this is
-	// the name of the Teleport resource. This field is required for all types
-	// of database.
-	Service string `yaml:"service"`
-	// Database is the name of the database to request access to.
-	Database string `yaml:"database,omitempty"`
-	// Username is the database username to request access as.
-	Username string `yaml:"username,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *DatabaseOutput) Init(ctx context.Context) error {
-	subDirs := []string{}
-	if o.Format == CockroachDatabaseFormat {
-		subDirs = append(subDirs, DefaultCockroachDirName)
-	}
-	return trace.Wrap(o.Destination.Init(ctx, subDirs))
-}
-
-func (o *DatabaseOutput) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if o.Service == "" {
-		return trace.BadParameter("service must not be empty")
-	}
-
-	if !slices.Contains(databaseFormats, o.Format) {
-		return trace.BadParameter("unrecognized format (%s)", o.Format)
-	}
-
-	return nil
-}
-
-func (o *DatabaseOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *DatabaseOutput) Describe() []FileDescription {
-	fds := []FileDescription{
-		{
-			Name: IdentityFilePath,
-		},
-		{
-			Name: HostCAPath,
-		},
-		{
-			Name: UserCAPath,
-		},
-		{
-			Name: DatabaseCAPath,
-		},
-	}
-	switch o.Format {
-	case MongoDatabaseFormat:
-		fds = append(fds, []FileDescription{
-			{
-				Name: DefaultMongoPrefix + ".crt",
-			},
-			{
-				Name: DefaultMongoPrefix + ".cas",
-			},
-		}...)
-	case CockroachDatabaseFormat:
-		fds = append(fds, []FileDescription{
-			{
-				Name:  DefaultCockroachDirName,
-				IsDir: true,
-			},
-		}...)
-	case TLSDatabaseFormat:
-		fds = append(fds, []FileDescription{
-			{
-				Name: DefaultTLSPrefix + ".crt",
-			},
-			{
-				Name: DefaultTLSPrefix + ".key",
-			},
-			{
-				Name: DefaultTLSPrefix + ".cas",
-			},
-		}...)
-	}
-
-	return fds
-}
-
-func (o *DatabaseOutput) MarshalYAML() (interface{}, error) {
-	type raw DatabaseOutput
-	return withTypeHeader((*raw)(o), DatabaseOutputType)
-}
-
-func (o *DatabaseOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw DatabaseOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *DatabaseOutput) Type() string {
-	return DatabaseOutputType
-}
-
-func (o *DatabaseOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
-
-// SupportedDatabaseFormatStrings returns a constant list of all valid
-// DatabaseFormat values as strings.
-func SupportedDatabaseFormatStrings() (ret []string) {
-	for _, v := range databaseFormats {
-		ret = append(ret, string(v))
-	}
-
-	return
-}
diff --git a/lib/tbot/config/service_database_test.go b/lib/tbot/config/service_database_test.go
deleted file mode 100644
index 7318017d5c411..0000000000000
--- a/lib/tbot/config/service_database_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestDatabaseOutput_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[DatabaseOutput]{
-		{
-			name: "full",
-			in: DatabaseOutput{
-				Destination: dest,
-				Roles:       []string{"access"},
-				Format:      TLSDatabaseFormat,
-				Service:     "my-database-service",
-				Database:    "my-database",
-				Username:    "my-username",
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: DatabaseOutput{
-				Destination: dest,
-				Service:     "my-database-service",
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestDatabaseOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*DatabaseOutput]{
-		{
-			name: "valid",
-			in: func() *DatabaseOutput {
-				return &DatabaseOutput{
-					Destination: memoryDestForTest(),
-					Roles:       []string{"access"},
-					Database:    "db",
-					Service:     "service",
-					Username:    "username",
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *DatabaseOutput {
-				return &DatabaseOutput{
-					Destination: nil,
-					Service:     "service",
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing service",
-			in: func() *DatabaseOutput {
-				return &DatabaseOutput{
-					Destination: memoryDestForTest(),
-				}
-			},
-			wantErr: "service must not be empty",
-		},
-		{
-			name: "invalid format",
-			in: func() *DatabaseOutput {
-				return &DatabaseOutput{
-					Destination: memoryDestForTest(),
-					Service:     "service",
-					Format:      "no-such-format",
-				}
-			},
-			wantErr: "unrecognized format (no-such-format)",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_database_tunnel.go b/lib/tbot/config/service_database_tunnel.go
deleted file mode 100644
index 0e68563980a8e..0000000000000
--- a/lib/tbot/config/service_database_tunnel.go
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"net"
-	"net/url"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-)
-
-const DatabaseTunnelServiceType = "database-tunnel"
-
-// DatabaseTunnelService opens an authenticated tunnel for Database Access.
-type DatabaseTunnelService struct {
-	// Listen is the address on which database tunnel should listen. Example:
-	// - "tcp://127.0.0.1:3306"
-	// - "tcp://0.0.0.0:3306
-	Listen string `yaml:"listen"`
-	// Roles is the list of roles to request for the tunnel.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-	// Service is the service name of the Teleport database. Generally this is
-	// the name of the Teleport resource. This field is required for all types
-	// of database.
-	Service string `yaml:"service"`
-	// Database is the name of the database to proxy to.
-	Database string `yaml:"database"`
-	// Username is the database username to proxy as.
-	Username string `yaml:"username"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-
-	// Listener overrides "listen" and directly provides an opened listener to
-	// use.
-	Listener net.Listener `yaml:"-"`
-}
-
-func (s *DatabaseTunnelService) Type() string {
-	return DatabaseTunnelServiceType
-}
-
-func (s *DatabaseTunnelService) MarshalYAML() (interface{}, error) {
-	type raw DatabaseTunnelService
-	return withTypeHeader((*raw)(s), DatabaseTunnelServiceType)
-}
-
-func (s *DatabaseTunnelService) UnmarshalYAML(node *yaml.Node) error {
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw DatabaseTunnelService
-	if err := node.Decode((*raw)(s)); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (s *DatabaseTunnelService) CheckAndSetDefaults() error {
-	switch {
-	case s.Listen == "" && s.Listener == nil:
-		return trace.BadParameter("listen: should not be empty")
-	case s.Service == "":
-		return trace.BadParameter("service: should not be empty")
-	case s.Database == "":
-		return trace.BadParameter("database: should not be empty")
-	case s.Username == "":
-		return trace.BadParameter("username: should not be empty")
-	}
-	if _, err := url.Parse(s.Listen); err != nil {
-		return trace.Wrap(err, "parsing listen")
-	}
-	return nil
-}
-
-func (s *DatabaseTunnelService) GetCredentialLifetime() CredentialLifetime {
-	return s.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_database_tunnel_test.go b/lib/tbot/config/service_database_tunnel_test.go
deleted file mode 100644
index 28d08d10634ca..0000000000000
--- a/lib/tbot/config/service_database_tunnel_test.go
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestDatabaseTunnelService_YAML(t *testing.T) {
-	t.Parallel()
-
-	tests := []testYAMLCase[DatabaseTunnelService]{
-		{
-			name: "full",
-			in: DatabaseTunnelService{
-				Listen:   "tcp://0.0.0.0:3621",
-				Roles:    []string{"role1", "role2"},
-				Service:  "service",
-				Database: "database",
-				Username: "username",
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestDatabaseTunnelService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*DatabaseTunnelService]{
-		{
-			name: "valid",
-			in: func() *DatabaseTunnelService {
-				return &DatabaseTunnelService{
-					Listen:   "tcp://0.0.0.0:3621",
-					Roles:    []string{"role1", "role2"},
-					Service:  "service",
-					Database: "database",
-					Username: "username",
-				}
-			},
-			wantErr: "",
-		},
-		{
-			name: "missing listen",
-			in: func() *DatabaseTunnelService {
-				return &DatabaseTunnelService{
-					Roles:    []string{"role1", "role2"},
-					Service:  "service",
-					Database: "database",
-					Username: "username",
-				}
-			},
-			wantErr: "listen: should not be empty",
-		},
-		{
-			name: "missing service",
-			in: func() *DatabaseTunnelService {
-				return &DatabaseTunnelService{
-					Listen:   "tcp://0.0.0.0:3621",
-					Roles:    []string{"role1", "role2"},
-					Database: "database",
-					Username: "username",
-				}
-			},
-			wantErr: "service: should not be empty",
-		},
-		{
-			name: "missing database",
-			in: func() *DatabaseTunnelService {
-				return &DatabaseTunnelService{
-					Listen:   "tcp://0.0.0.0:3621",
-					Roles:    []string{"role1", "role2"},
-					Service:  "service",
-					Username: "username",
-				}
-			},
-			wantErr: "database: should not be empty",
-		},
-		{
-			name: "missing username",
-			in: func() *DatabaseTunnelService {
-				return &DatabaseTunnelService{
-					Listen:   "tcp://0.0.0.0:3621",
-					Roles:    []string{"role1", "role2"},
-					Service:  "service",
-					Database: "database",
-				}
-			},
-			wantErr: "username: should not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_example.go b/lib/tbot/config/service_example.go
deleted file mode 100644
index 7a09dd38b9cbd..0000000000000
--- a/lib/tbot/config/service_example.go
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-)
-
-const ExampleServiceType = "example"
-
-// ExampleService is a temporary example service for testing purposes. It is
-// not intended to be used and exists to demonstrate how a user configurable
-// service integrates with the tbot service manager.
-type ExampleService struct {
-	Message string `yaml:"message"`
-}
-
-func (s *ExampleService) Type() string {
-	return ExampleServiceType
-}
-
-func (s *ExampleService) MarshalYAML() (interface{}, error) {
-	type raw ExampleService
-	return withTypeHeader((*raw)(s), ExampleServiceType)
-}
-
-func (s *ExampleService) UnmarshalYAML(node *yaml.Node) error {
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw ExampleService
-	if err := node.Decode((*raw)(s)); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (s *ExampleService) CheckAndSetDefaults() error {
-	if s.Message == "" {
-		return trace.BadParameter("message: should not be empty")
-	}
-	return nil
-}
-
-func (s *ExampleService) GetCredentialLifetime() CredentialLifetime {
-	return CredentialLifetime{}
-}
diff --git a/lib/tbot/config/service_identity.go b/lib/tbot/config/service_identity.go
deleted file mode 100644
index 8d51fd43564db..0000000000000
--- a/lib/tbot/config/service_identity.go
+++ /dev/null
@@ -1,201 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/ssh"
-)
-
-const IdentityOutputType = "identity"
-
-const (
-	// HostCAPath is the default filename for the host CA certificate
-	HostCAPath = "teleport-host-ca.crt"
-
-	// UserCAPath is the default filename for the user CA certificate
-	UserCAPath = "teleport-user-ca.crt"
-
-	// DatabaseCAPath is the default filename for the database CA
-	// certificate
-	DatabaseCAPath = "teleport-database-ca.crt"
-
-	IdentityFilePath = "identity"
-)
-
-// SSHConfigMode controls whether to write an ssh_config file to the
-// destination directory.
-type SSHConfigMode string
-
-const (
-	// SSHConfigModeNone will default to SSHConfigModeOn.
-	SSHConfigModeNone SSHConfigMode = ""
-	// SSHConfigModeOff will not write an ssh_config file. This is useful where
-	// you do not want to use SSH functionality and would like to avoid
-	// pinging the proxy.
-	SSHConfigModeOff SSHConfigMode = "off"
-	// SSHConfigModeOn will write an ssh_config file to the destination
-	// directory.
-	// Causes the generation of:
-	// - ssh_config
-	// - known_hosts
-	SSHConfigModeOn SSHConfigMode = "on"
-)
-
-var (
-	_ ServiceConfig = &IdentityOutput{}
-	_ Initable      = &IdentityOutput{}
-)
-
-// IdentityOutput produces credentials which can be used with `tsh`, `tctl`,
-// `openssh` and most SSH compatible tooling. It can also be used with the
-// Teleport API and things which use the API client (e.g the terraform provider)
-//
-// It cannot be used to connect to Applications, Databases or Kubernetes
-// Clusters.
-type IdentityOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Roles is the list of roles to request for the generated credentials.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-
-	// Cluster allows certificates to be generated for a leaf cluster of the
-	// cluster that the bot is connected to. These certificates can be used
-	// to directly connect to a Teleport proxy of that leaf cluster, or used
-	// with the root cluster's proxy which will forward the request to the
-	// leaf cluster.
-	// For now, only SSH is supported.
-	Cluster string `yaml:"cluster,omitempty"`
-
-	// SSHConfigMode controls whether to write an ssh_config file to the
-	// destination directory. Defaults to SSHConfigModeOn.
-	SSHConfigMode SSHConfigMode `yaml:"ssh_config,omitempty"`
-
-	// AllowReissue controls whether the generated credentials can be used to
-	// reissue further credentials (e.g to produce a certificate for application
-	// access). It is recommended to leave this disabled to prevent the scope of
-	// issued credentials from being increased, however, it can be useful in
-	// scenarios where credentials are desired to be reissued in a dynamic way.
-	//
-	// Defaults to false.
-	AllowReissue bool `yaml:"allow_reissue,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *IdentityOutput) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-func (o *IdentityOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *IdentityOutput) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if _, ok := o.Destination.(*DestinationDirectory); !ok {
-		// If destDir is unset, we're not using a filesystem destination and
-		// ssh_config will not be sensible. Log a note and bail early without
-		// writing ssh_config. (Future users of k8s secrets will need to bring
-		// their own config, we can't predict where paths will be in practice.)
-		log.InfoContext(
-			context.TODO(),
-			"Note: no ssh_config will be written for non-filesystem destination",
-			"destination", o.Destination,
-		)
-	}
-
-	switch o.SSHConfigMode {
-	case SSHConfigModeNone:
-		log.DebugContext(context.Background(), "Defaulting to SSHConfigModeOn")
-		o.SSHConfigMode = SSHConfigModeOn
-	case SSHConfigModeOff, SSHConfigModeOn:
-	default:
-		return trace.BadParameter("ssh_config: unrecognized value %q", o.SSHConfigMode)
-	}
-
-	return nil
-}
-
-func (o *IdentityOutput) Describe() []FileDescription {
-	var fds = []FileDescription{
-		{
-			Name: IdentityFilePath,
-		},
-		{
-			Name: HostCAPath,
-		},
-		{
-			Name: UserCAPath,
-		},
-		{
-			Name: DatabaseCAPath,
-		},
-	}
-	if o.SSHConfigMode == SSHConfigModeOn {
-		fds = append(fds, FileDescription{
-			Name: ssh.KnownHostsName,
-		})
-		if _, ok := o.Destination.(*DestinationDirectory); ok {
-			fds = append(fds, FileDescription{
-				Name: ssh.ConfigName,
-			})
-		}
-	}
-
-	return fds
-}
-
-func (o *IdentityOutput) MarshalYAML() (interface{}, error) {
-	type raw IdentityOutput
-	return withTypeHeader((*raw)(o), IdentityOutputType)
-}
-
-func (o *IdentityOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw IdentityOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *IdentityOutput) Type() string {
-	return IdentityOutputType
-}
-
-func (o *IdentityOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_identity_test.go b/lib/tbot/config/service_identity_test.go
deleted file mode 100644
index 287c4cb4fc01e..0000000000000
--- a/lib/tbot/config/service_identity_test.go
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestIdentityOutput_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[IdentityOutput]{
-		{
-			name: "full",
-			in: IdentityOutput{
-				Destination:   dest,
-				Roles:         []string{"access"},
-				Cluster:       "leaf.example.com",
-				SSHConfigMode: SSHConfigModeOff,
-				AllowReissue:  true,
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: IdentityOutput{
-				Destination: dest,
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestIdentityOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*IdentityOutput]{
-		{
-			name: "valid",
-			in: func() *IdentityOutput {
-				return &IdentityOutput{
-					Destination:   memoryDestForTest(),
-					Roles:         []string{"access"},
-					SSHConfigMode: SSHConfigModeOn,
-				}
-			},
-		},
-		{
-			name: "ssh config mode defaults",
-			in: func() *IdentityOutput {
-				return &IdentityOutput{
-					Destination: memoryDestForTest(),
-				}
-			},
-			want: &IdentityOutput{
-				Destination:   memoryDestForTest(),
-				SSHConfigMode: SSHConfigModeOn,
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *IdentityOutput {
-				return &IdentityOutput{
-					Destination: nil,
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "invalid ssh config mode",
-			in: func() *IdentityOutput {
-				return &IdentityOutput{
-					Destination:   memoryDestForTest(),
-					SSHConfigMode: "invalid",
-				}
-			},
-			wantErr: "ssh_config: unrecognized value \"invalid\"",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_kubernetes.go b/lib/tbot/config/service_kubernetes.go
deleted file mode 100644
index 09a7572bba49a..0000000000000
--- a/lib/tbot/config/service_kubernetes.go
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-var (
-	_ ServiceConfig = &KubernetesOutput{}
-	_ Initable      = &KubernetesOutput{}
-)
-
-const KubernetesOutputType = "kubernetes"
-
-// KubernetesOutput produces credentials which can be used to connect to a
-// Kubernetes Cluster through teleport.
-type KubernetesOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Roles is the list of roles to request for the generated credentials.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-
-	// KubernetesCluster is the name of the Kubernetes cluster in Teleport.
-	// This is named a little more verbosely to avoid conflicting with the
-	// name of the Teleport cluster to use.
-	KubernetesCluster string `yaml:"kubernetes_cluster"`
-
-	// DisableExecPlugin disables the default behavior of using `tbot` as a
-	// `kubectl` credentials exec plugin. This is useful in environments where
-	// `tbot` may not exist on the system that will consume the outputted
-	// kubeconfig. It does mean that kubectl will not be able to automatically
-	// refresh the credentials within an individual invocation.
-	DisableExecPlugin bool `yaml:"disable_exec_plugin"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *KubernetesOutput) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if o.KubernetesCluster == "" {
-		return trace.BadParameter("kubernetes_cluster must not be empty")
-	}
-	return nil
-}
-
-func (o *KubernetesOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *KubernetesOutput) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-func (o *KubernetesOutput) Describe() []FileDescription {
-	// Based on tbot.KubernetesOutputService.Render
-	return []FileDescription{
-		{
-			Name: "kubeconfig.yaml",
-		},
-		{
-			Name: IdentityFilePath,
-		},
-		{
-			Name: HostCAPath,
-		},
-		{
-			Name: UserCAPath,
-		},
-		{
-			Name: DatabaseCAPath,
-		},
-	}
-}
-
-func (o *KubernetesOutput) MarshalYAML() (interface{}, error) {
-	type raw KubernetesOutput
-	return withTypeHeader((*raw)(o), KubernetesOutputType)
-}
-
-func (o *KubernetesOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw KubernetesOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *KubernetesOutput) Type() string {
-	return KubernetesOutputType
-}
-
-func (o *KubernetesOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_kubernetes_test.go b/lib/tbot/config/service_kubernetes_test.go
deleted file mode 100644
index 034e67eca9139..0000000000000
--- a/lib/tbot/config/service_kubernetes_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestKubernetesOutput_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[KubernetesOutput]{
-		{
-			name: "full",
-			in: KubernetesOutput{
-				Destination:       dest,
-				Roles:             []string{"access"},
-				KubernetesCluster: "k8s.example.com",
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: KubernetesOutput{
-				Destination:       dest,
-				KubernetesCluster: "k8s.example.com",
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestKubernetesOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*KubernetesOutput]{
-		{
-			name: "valid",
-			in: func() *KubernetesOutput {
-				return &KubernetesOutput{
-					Destination:       memoryDestForTest(),
-					Roles:             []string{"access"},
-					KubernetesCluster: "my-cluster",
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *KubernetesOutput {
-				return &KubernetesOutput{
-					Destination:       nil,
-					KubernetesCluster: "my-cluster",
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing kubernetes_config",
-			in: func() *KubernetesOutput {
-				return &KubernetesOutput{
-					Destination: memoryDestForTest(),
-				}
-			},
-			wantErr: "kubernetes_cluster must not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_kubernetes_v2.go b/lib/tbot/config/service_kubernetes_v2.go
deleted file mode 100644
index eb0b651dd6ce2..0000000000000
--- a/lib/tbot/config/service_kubernetes_v2.go
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-var (
-	_ ServiceConfig = &KubernetesV2Output{}
-	_ Initable      = &KubernetesV2Output{}
-)
-
-const KubernetesV2OutputType = "kubernetes/v2"
-
-// KubernetesOutput produces credentials which can be used to connect to a
-// Kubernetes Cluster through teleport.
-type KubernetesV2Output struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-
-	// DisableExecPlugin disables the default behavior of using `tbot` as a
-	// `kubectl` credentials exec plugin. This is useful in environments where
-	// `tbot` may not exist on the system that will consume the outputted
-	// kubeconfig. It does mean that kubectl will not be able to automatically
-	// refresh the credentials within an individual invocation.
-	DisableExecPlugin bool `yaml:"disable_exec_plugin,omitempty"`
-
-	// Selectors is a list of selectors for path-based routing. Multiple
-	// selectors can be used to generate an output containing all matches.
-	Selectors []*KubernetesSelector `yaml:"selectors,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *KubernetesV2Output) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if len(o.Selectors) == 0 {
-		return trace.BadParameter("at least one selector must be provided")
-	}
-
-	for _, s := range o.Selectors {
-		if err := s.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return trace.Wrap(o.Destination.CheckAndSetDefaults())
-}
-
-func (o *KubernetesV2Output) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *KubernetesV2Output) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-func (o *KubernetesV2Output) Describe() []FileDescription {
-	// Based on tbot.KubernetesOutputService.Render
-	return []FileDescription{
-		{
-			Name: "kubeconfig.yaml",
-		},
-		{
-			Name: IdentityFilePath,
-		},
-		{
-			Name: HostCAPath,
-		},
-	}
-}
-
-func (o *KubernetesV2Output) MarshalYAML() (interface{}, error) {
-	type raw KubernetesV2Output
-	return withTypeHeader((*raw)(o), KubernetesV2OutputType)
-}
-
-func (o *KubernetesV2Output) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw KubernetesV2Output
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *KubernetesV2Output) Type() string {
-	return KubernetesV2OutputType
-}
-
-// KubernetesSelector allows querying for a Kubernetes cluster to include either
-// by its name or labels.
-type KubernetesSelector struct {
-	Name string `yaml:"name,omitempty"`
-
-	Labels map[string]string `yaml:"labels,omitempty"`
-}
-
-func (s *KubernetesSelector) CheckAndSetDefaults() error {
-	if s.Name == "" && len(s.Labels) == 0 {
-		return trace.BadParameter("selectors: one of 'name' and 'labels' must be specified")
-	}
-
-	if s.Name != "" && len(s.Labels) > 0 {
-		return trace.BadParameter("selectors: only one of 'name' and 'labels' may be specified")
-	}
-
-	if s.Labels == nil {
-		s.Labels = map[string]string{}
-	}
-
-	return nil
-}
-
-func (s *KubernetesSelector) UnmarshalYAML(value *yaml.Node) error {
-	// A custom unmarshaler so Labels is consistently initialized to not-nil.
-	// Primarily needed for tests.
-	type temp KubernetesSelector
-	out := temp{
-		Labels: make(map[string]string),
-	}
-
-	if err := value.Decode(&out); err != nil {
-		return err
-	}
-
-	*s = KubernetesSelector(out)
-	return nil
-}
-
-func (o *KubernetesV2Output) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_kubernetes_v2_test.go b/lib/tbot/config/service_kubernetes_v2_test.go
deleted file mode 100644
index 65fbb60c32755..0000000000000
--- a/lib/tbot/config/service_kubernetes_v2_test.go
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestKubernetesV2Output_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[KubernetesV2Output]{
-		{
-			name: "full",
-			in: KubernetesV2Output{
-				Destination:       dest,
-				DisableExecPlugin: true,
-				Selectors: []*KubernetesSelector{
-					{
-						Name: "foo",
-
-						// Unfortunately we have to manually initialize every
-						// map if we want tests to pass. Otherwise we'd need to
-						// support CheckAndSetDefaults() in testYAML() which
-						// breaks a ton of tests that didn't expect to have to
-						// compare initialized structs.
-						Labels: map[string]string{},
-					},
-					{
-						Labels: map[string]string{
-							"foo": "bar",
-						},
-					},
-				},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: KubernetesV2Output{
-				Destination: dest,
-				Selectors: []*KubernetesSelector{
-					{
-						Name:   "foo",
-						Labels: map[string]string{},
-					},
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestKubernetesV2Output_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*KubernetesV2Output]{
-		{
-			name: "valid_name",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: memoryDestForTest(),
-					Selectors: []*KubernetesSelector{
-						{Name: "foo", Labels: map[string]string{}},
-					},
-				}
-			},
-		},
-		{
-			name: "valid_label",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: memoryDestForTest(),
-					Selectors: []*KubernetesSelector{
-						{Labels: map[string]string{
-							"foo": "bar",
-						}},
-					},
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: nil,
-					Selectors: []*KubernetesSelector{
-						{Name: "foo"},
-					},
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing selectors",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: memoryDestForTest(),
-				}
-			},
-			wantErr: "at least one selector must be provided",
-		},
-		{
-			name: "empty selector",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: memoryDestForTest(),
-					Selectors: []*KubernetesSelector{
-						{},
-					},
-				}
-			},
-			wantErr: "selectors: one of 'name' and 'labels' must be specified",
-		},
-		{
-			name: "both name and label in selector",
-			in: func() *KubernetesV2Output {
-				return &KubernetesV2Output{
-					Destination: memoryDestForTest(),
-					Selectors: []*KubernetesSelector{
-						{
-							Name: "foo",
-							Labels: map[string]string{
-								"foo": "bar",
-							},
-						},
-					},
-				}
-			},
-			wantErr: "selectors: only one of 'name' and 'labels' may be specified",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_spiffe_svid.go b/lib/tbot/config/service_spiffe_svid.go
deleted file mode 100644
index 5e208a35074e5..0000000000000
--- a/lib/tbot/config/service_spiffe_svid.go
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-	"log/slog"
-	"net"
-	"strings"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const SPIFFESVIDOutputType = "spiffe-svid"
-
-// Based on the default paths listed in
-// https://github.com/spiffe/spiffe-helper/blob/main/README.md
-const (
-	SVIDPEMPath            = "svid.pem"
-	SVIDKeyPEMPath         = "svid_key.pem"
-	SVIDTrustBundlePEMPath = "svid_bundle.pem"
-	SVIDCRLPemPath         = "svid_crl.pem"
-)
-
-// SVIDRequestSANs is the configuration for the SANs of a single SVID request.
-type SVIDRequestSANs struct {
-	// DNS is the list of DNS names that are requested to be included in the SVID.
-	DNS []string `yaml:"dns,omitempty"`
-	// IP is the list of IP addresses that are requested to be included in the SVID.
-	// These can be IPv4 or IPv6 addresses.
-	IP []string `yaml:"ip,omitempty"`
-}
-
-// SVIDRequest is the configuration for a single SVID request.
-type SVIDRequest struct {
-	// Path is the SPIFFE ID path of the SVID. It should be prefixed with "/".
-	Path string `yaml:"path,omitempty"`
-	// Hint is the hint for the SVID that will be provided to consumers of the
-	// SVID to help them identify it.
-	Hint string `yaml:"hint,omitempty"`
-	// SANS is the Subject Alternative Names that are requested to be included
-	// in the SVID.
-	SANS SVIDRequestSANs `yaml:"sans,omitempty"`
-}
-
-func (o SVIDRequest) LogValue() slog.Value {
-	return slog.GroupValue(
-		slog.String("path", o.Path),
-		slog.String("hint", o.Hint),
-		slog.Any("dns_sans", o.SANS.DNS),
-		slog.Any("ip_sans", o.SANS.IP),
-	)
-}
-
-// CheckAndSetDefaults checks the SVIDRequest values and sets any defaults.
-func (o *SVIDRequest) CheckAndSetDefaults() error {
-	switch {
-	case o.Path == "":
-		return trace.BadParameter("svid.path: should not be empty")
-	case !strings.HasPrefix(o.Path, "/"):
-		return trace.BadParameter("svid.path: should be prefixed with /")
-	}
-	for i, stringIP := range o.SANS.IP {
-		ip := net.ParseIP(stringIP)
-		if ip == nil {
-			return trace.BadParameter(
-				"ip_sans[%d]: invalid IP address %q", i, stringIP,
-			)
-		}
-	}
-	return nil
-}
-
-var (
-	_ ServiceConfig = &SPIFFESVIDOutput{}
-	_ Initable      = &SPIFFESVIDOutput{}
-)
-
-// JWTSVID the configuration for a single JWT SVID request as part of the SPIFFE
-// SVID output.
-type JWTSVID struct {
-	// FileName is the name of the artifact/file the JWT should be written to.
-	FileName string `yaml:"file_name"`
-	// Audience is the audience of the JWT.
-	Audience string `yaml:"audience"`
-}
-
-func (o JWTSVID) CheckAndSetDefaults() error {
-	switch {
-	case o.Audience == "":
-		return trace.BadParameter("audience: should not be empty")
-	case o.FileName == "":
-		return trace.BadParameter("name: should not be empty")
-	}
-	return nil
-}
-
-// SPIFFESVIDOutput is the configuration for the SPIFFE SVID output.
-// Emulates the output of https://github.com/spiffe/spiffe-helper
-type SPIFFESVIDOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination                  bot.Destination `yaml:"destination"`
-	SVID                         SVIDRequest     `yaml:"svid"`
-	IncludeFederatedTrustBundles bool            `yaml:"include_federated_trust_bundles,omitempty"`
-	// JWTs is an optional list of audiences and file names to write JWT SVIDs
-	// to.
-	JWTs []JWTSVID `yaml:"jwts,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-// Init initializes the destination.
-func (o *SPIFFESVIDOutput) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-// GetDestination returns the destination.
-func (o *SPIFFESVIDOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
-func (o *SPIFFESVIDOutput) CheckAndSetDefaults() error {
-	if err := o.SVID.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating svid")
-	}
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	for i, jwt := range o.JWTs {
-		if err := jwt.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err, "validating jwts[%d]", i)
-		}
-	}
-	return nil
-}
-
-// Describe returns the file descriptions for the SPIFFE SVID output.
-func (o *SPIFFESVIDOutput) Describe() []FileDescription {
-	fds := []FileDescription{
-		{
-			Name: SVIDPEMPath,
-		},
-		{
-			Name: SVIDKeyPEMPath,
-		},
-		{
-			Name: SVIDTrustBundlePEMPath,
-		},
-	}
-	for _, jwt := range o.JWTs {
-		fds = append(fds, FileDescription{Name: jwt.FileName})
-	}
-	return nil
-}
-
-func (o *SPIFFESVIDOutput) Type() string {
-	return SPIFFESVIDOutputType
-}
-
-// MarshalYAML marshals the SPIFFESVIDOutput into YAML.
-func (o *SPIFFESVIDOutput) MarshalYAML() (interface{}, error) {
-	type raw SPIFFESVIDOutput
-	return withTypeHeader((*raw)(o), SPIFFESVIDOutputType)
-}
-
-// UnmarshalYAML unmarshals the SPIFFESVIDOutput from YAML.
-func (o *SPIFFESVIDOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw SPIFFESVIDOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *SPIFFESVIDOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_spiffe_svid_test.go b/lib/tbot/config/service_spiffe_svid_test.go
deleted file mode 100644
index 44190da0cf8f1..0000000000000
--- a/lib/tbot/config/service_spiffe_svid_test.go
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestSPIFFESVIDOutput_YAML(t *testing.T) {
-	t.Parallel()
-
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[SPIFFESVIDOutput]{
-		{
-			name: "full",
-			in: SPIFFESVIDOutput{
-				Destination: dest,
-				SVID: SVIDRequest{
-					Path: "/foo",
-					Hint: "hint",
-					SANS: SVIDRequestSANs{
-						DNS: []string{"example.com"},
-						IP:  []string{"10.0.0.1", "10.42.0.1"},
-					},
-				},
-				IncludeFederatedTrustBundles: true,
-				JWTs: []JWTSVID{
-					{
-						Audience: "example.com",
-						FileName: "foo",
-					},
-					{
-						Audience: "2.example.com",
-						FileName: "bar",
-					},
-				},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: SPIFFESVIDOutput{
-				Destination: dest,
-				SVID: SVIDRequest{
-					Path: "/foo",
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestSPIFFESVIDOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*SPIFFESVIDOutput]{
-		{
-			name: "valid",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "/foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-					JWTs: []JWTSVID{
-						{
-							FileName: "foo",
-							Audience: "example.com",
-						},
-					},
-				}
-			},
-		},
-		{
-			name: "missing jwt name",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "/foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-					JWTs: []JWTSVID{
-						{
-							Audience: "example.com",
-						},
-					},
-				}
-			},
-			wantErr: "name: should not be empty",
-		},
-		{
-			name: "missing jwt audience",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "/foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-					JWTs: []JWTSVID{
-						{
-							FileName: "foo",
-						},
-					},
-				}
-			},
-			wantErr: "audience: should not be empty",
-		},
-		{
-			name: "missing destination",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: nil,
-					SVID: SVIDRequest{
-						Path: "/foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing path",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-				}
-			},
-			wantErr: "svid.path: should not be empty",
-		},
-		{
-			name: "path missing leading slash",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"10.0.0.1"},
-						},
-					},
-				}
-			},
-			wantErr: "svid.path: should be prefixed with /",
-		},
-		{
-			name: "invalid ip",
-			in: func() *SPIFFESVIDOutput {
-				return &SPIFFESVIDOutput{
-					Destination: memoryDestForTest(),
-					SVID: SVIDRequest{
-						Path: "/foo",
-						Hint: "hint",
-						SANS: SVIDRequestSANs{
-							DNS: []string{"example.com"},
-							IP:  []string{"thisisntanip"},
-						},
-					},
-				}
-			},
-			wantErr: "ip_sans[0]: invalid IP address",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_spiffe_workload_api.go b/lib/tbot/config/service_spiffe_workload_api.go
deleted file mode 100644
index c5e0917bf0666..0000000000000
--- a/lib/tbot/config/service_spiffe_workload_api.go
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"log/slog"
-	"time"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-)
-
-const SPIFFEWorkloadAPIServiceType = "spiffe-workload-api"
-
-// SVIDRequestWithRules is the configuration for a single SVID along with the
-// workload attestation rules that must be passed by a workload for this SVID
-// to be issued to it.
-type SVIDRequestWithRules struct {
-	SVIDRequest `yaml:",inline"`
-	// Rules is a list of workload attestation rules. At least one rule must be
-	// satisfied for the SVID to be issued to a workload.
-	//
-	// If no rules are specified, the SVID will be issued to all workloads that
-	// connect to this listener.
-	Rules []SVIDRequestRule `yaml:"rules,omitempty"`
-}
-
-// SVIDRequestRuleUnix is a workload attestation ruleset for workloads that
-// connect via Unix domain sockets.
-type SVIDRequestRuleUnix struct {
-	// PID is the process ID that a process must have to be issued this SVID.
-	//
-	// If unspecified, the process ID is not checked.
-	PID *int `yaml:"pid,omitempty"`
-	// UID is the user ID that a process must have to be issued this SVID.
-	//
-	// If unspecified, the user ID is not checked.
-	UID *int `yaml:"uid,omitempty"`
-	// GID is the primary group ID that a process must have to be issued this
-	// SVID.
-	//
-	// If unspecified, the primary group ID is not checked.
-	GID *int `yaml:"gid,omitempty"`
-}
-
-// SVIDRequestRuleKubernetes is a workload attestation ruleset for workloads
-// that connect via Unix domain sockets and are running in a Kubernetes pod.
-//
-// Requires the "kubernetes" attestor to be enabled.
-//
-// Fields should be a subset of workloadattest.KubernetesAttestation.
-type SVIDRequestRuleKubernetes struct {
-	// Namespace is the Kubernetes namespace that a workload must be running in
-	// to be issued this SVID.
-	// If unspecified, the namespace is not checked.
-	Namespace string `yaml:"namespace,omitempty"`
-	// ServiceAccount is the Kubernetes service account that a workload must be
-	// running as to be issued this SVID.
-	// If unspecified, the service account is not checked.
-	ServiceAccount string `yaml:"service_account,omitempty"`
-	// PodName is the Kubernetes pod name that a workload must be running in to
-	// be issued this SVID.
-	// If unspecified, the pod name is not checked.
-	PodName string `yaml:"pod_name,omitempty"`
-}
-
-// SVIDRequestRule is an individual workload attestation rule. All values
-// specified within the rule must be satisfied for the rule itself to pass.
-type SVIDRequestRule struct {
-	// Unix is the workload attestation ruleset for workloads that connect via
-	// Unix domain sockets. If any value here is set, the rule will not pass
-	// unless the workload is connecting via a Unix domain socket.
-	Unix SVIDRequestRuleUnix `yaml:"unix"`
-	// Kubernetes is the workload attestation ruleset for workloads that connect
-	// via the Unix domain socket and are running in a Kubernetes pod.
-	// The "kubernetes" attestor must be enabled or these rules will fail.
-	Kubernetes SVIDRequestRuleKubernetes `yaml:"kubernetes"`
-}
-
-func (o SVIDRequestRule) LogValue() slog.Value {
-	var unixAttrs []any
-	if o.Unix.PID != nil {
-		unixAttrs = append(unixAttrs, slog.Int("pid", *o.Unix.PID))
-	}
-	if o.Unix.GID != nil {
-		unixAttrs = append(unixAttrs, slog.Int("gid", *o.Unix.GID))
-	}
-	if o.Unix.UID != nil {
-		unixAttrs = append(unixAttrs, slog.Int("uid", *o.Unix.UID))
-	}
-	return slog.GroupValue(
-		slog.Group("unix", unixAttrs...),
-	)
-}
-
-// SPIFFEWorkloadAPIService is the configuration for the SPIFFE Workload API
-// service.
-type SPIFFEWorkloadAPIService struct {
-	// Listen is the address on which the SPIFFE Workload API server should
-	// listen. This should either be prefixed with "unix://" or "tcp://".
-	Listen string `yaml:"listen"`
-	// SVIDs is the list of SVIDs that the SPIFFE Workload API server should
-	// provide.
-	SVIDs []SVIDRequestWithRules `yaml:"svids"`
-	// Attestors is the configuration for the workload attestation process.
-	Attestors workloadattest.Config `yaml:"attestors"`
-	// JWTSVIDTTL specifies how long that JWT SVIDs issued by this SPIFFE
-	// Workload API server are valid for. If unspecified, this falls back to
-	// the globally configured default.
-	JWTSVIDTTL time.Duration `yaml:"jwt_svid_ttl,omitempty"`
-
-	// CredentialLifetime contains configuration for how long X.509 SVIDs will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (s *SPIFFEWorkloadAPIService) Type() string {
-	return SPIFFEWorkloadAPIServiceType
-}
-
-func (s *SPIFFEWorkloadAPIService) MarshalYAML() (interface{}, error) {
-	type raw SPIFFEWorkloadAPIService
-	return withTypeHeader((*raw)(s), SPIFFEWorkloadAPIServiceType)
-}
-
-func (s *SPIFFEWorkloadAPIService) UnmarshalYAML(node *yaml.Node) error {
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw SPIFFEWorkloadAPIService
-	if err := node.Decode((*raw)(s)); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (s *SPIFFEWorkloadAPIService) CheckAndSetDefaults() error {
-	if s.Listen == "" {
-		return trace.BadParameter("listen: should not be empty")
-	}
-	if len(s.SVIDs) == 0 {
-		return trace.BadParameter("svids: should not be empty")
-	}
-	for i, svid := range s.SVIDs {
-		if err := svid.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err, "validating svid[%d]", i)
-		}
-	}
-	if err := s.Attestors.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating attestor")
-	}
-	return nil
-}
-
-func (o *SPIFFEWorkloadAPIService) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_spiffe_workload_api_test.go b/lib/tbot/config/service_spiffe_workload_api_test.go
deleted file mode 100644
index c6ee67c692ab0..0000000000000
--- a/lib/tbot/config/service_spiffe_workload_api_test.go
+++ /dev/null
@@ -1,239 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-)
-
-func ptr[T any](v T) *T {
-	return &v
-}
-
-func TestSPIFFEWorkloadAPIService_YAML(t *testing.T) {
-	t.Parallel()
-
-	tests := []testYAMLCase[SPIFFEWorkloadAPIService]{
-		{
-			name: "full",
-			in: SPIFFEWorkloadAPIService{
-				Listen:     "unix:///var/run/spiffe.sock",
-				JWTSVIDTTL: time.Minute * 5,
-				Attestors: workloadattest.Config{
-					Kubernetes: workloadattest.KubernetesAttestorConfig{
-						Enabled: true,
-						Kubelet: workloadattest.KubeletClientConfig{
-							SecurePort: 12345,
-							TokenPath:  "/path/to/token",
-							CAPath:     "/path/to/ca.pem",
-							SkipVerify: true,
-							Anonymous:  true,
-						},
-					},
-				},
-				SVIDs: []SVIDRequestWithRules{
-					{
-						SVIDRequest: SVIDRequest{
-							Path: "/foo",
-							Hint: "hint",
-							SANS: SVIDRequestSANs{
-								DNS: []string{"example.com"},
-								IP:  []string{"10.0.0.1", "10.42.0.1"},
-							},
-						},
-						Rules: []SVIDRequestRule{
-							{
-								Unix: SVIDRequestRuleUnix{
-									PID: ptr(100),
-									UID: ptr(1000),
-									GID: ptr(1234),
-								},
-							},
-							{
-								Unix: SVIDRequestRuleUnix{
-									PID: ptr(100),
-								},
-								Kubernetes: SVIDRequestRuleKubernetes{
-									Namespace:      "my-namespace",
-									PodName:        "my-pod",
-									ServiceAccount: "service-account",
-								},
-							},
-						},
-					},
-				},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: SPIFFEWorkloadAPIService{
-				Listen: "unix:///var/run/spiffe.sock",
-				SVIDs: []SVIDRequestWithRules{
-					{
-						SVIDRequest: SVIDRequest{
-							Path: "/foo",
-						},
-					},
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestSPIFFEWorkloadAPIService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*SPIFFEWorkloadAPIService]{
-		{
-			name: "valid",
-			in: func() *SPIFFEWorkloadAPIService {
-				return &SPIFFEWorkloadAPIService{
-					JWTSVIDTTL: time.Minute,
-					Listen:     "unix:///var/run/spiffe.sock",
-					SVIDs: []SVIDRequestWithRules{
-						{
-							SVIDRequest: SVIDRequest{
-								Path: "/foo",
-								Hint: "hint",
-								SANS: SVIDRequestSANs{
-									DNS: []string{"example.com"},
-									IP:  []string{"10.0.0.1", "10.42.0.1"},
-								},
-							},
-						},
-					},
-				}
-			},
-			want: &SPIFFEWorkloadAPIService{
-				JWTSVIDTTL: time.Minute,
-				Listen:     "unix:///var/run/spiffe.sock",
-				SVIDs: []SVIDRequestWithRules{
-					{
-						SVIDRequest: SVIDRequest{
-							Path: "/foo",
-							Hint: "hint",
-							SANS: SVIDRequestSANs{
-								DNS: []string{"example.com"},
-								IP:  []string{"10.0.0.1", "10.42.0.1"},
-							},
-						},
-					},
-				},
-				Attestors: workloadattest.Config{
-					Unix: workloadattest.UnixAttestorConfig{
-						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
-					},
-				},
-			},
-		},
-		{
-			name: "missing path",
-			in: func() *SPIFFEWorkloadAPIService {
-				return &SPIFFEWorkloadAPIService{
-					Listen: "unix:///var/run/spiffe.sock",
-					SVIDs: []SVIDRequestWithRules{
-						{
-							SVIDRequest: SVIDRequest{
-								Path: "",
-								Hint: "hint",
-								SANS: SVIDRequestSANs{
-									DNS: []string{"example.com"},
-									IP:  []string{"10.0.0.1", "10.42.0.1"},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErr: "svid.path: should not be empty",
-		},
-		{
-			name: "path missing leading slash",
-			in: func() *SPIFFEWorkloadAPIService {
-				return &SPIFFEWorkloadAPIService{
-					Listen: "unix:///var/run/spiffe.sock",
-					SVIDs: []SVIDRequestWithRules{
-						{
-							SVIDRequest: SVIDRequest{
-								Path: "foo",
-								Hint: "hint",
-								SANS: SVIDRequestSANs{
-									DNS: []string{"example.com"},
-									IP:  []string{"10.0.0.1", "10.42.0.1"},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErr: "svid.path: should be prefixed with /",
-		},
-		{
-			name: "missing listen addr",
-			in: func() *SPIFFEWorkloadAPIService {
-				return &SPIFFEWorkloadAPIService{
-					Listen: "",
-					SVIDs: []SVIDRequestWithRules{
-						{
-							SVIDRequest: SVIDRequest{
-								Path: "foo",
-								Hint: "hint",
-								SANS: SVIDRequestSANs{
-									DNS: []string{"example.com"},
-									IP:  []string{"10.0.0.1", "10.42.0.1"},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErr: "listen: should not be empty",
-		},
-		{
-			name: "invalid ip",
-			in: func() *SPIFFEWorkloadAPIService {
-				return &SPIFFEWorkloadAPIService{
-					Listen: "unix:///var/run/spiffe.sock",
-					SVIDs: []SVIDRequestWithRules{
-						{
-							SVIDRequest: SVIDRequest{
-								Path: "/foo",
-								Hint: "hint",
-								SANS: SVIDRequestSANs{
-									DNS: []string{"example.com"},
-									IP:  []string{"invalid ip"},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErr: "ip_sans[0]: invalid IP address",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_ssh_host.go b/lib/tbot/config/service_ssh_host.go
deleted file mode 100644
index 7729cfc0a8c06..0000000000000
--- a/lib/tbot/config/service_ssh_host.go
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const SSHHostOutputType = "ssh_host"
-
-const (
-	// SSHHostCertPath is the default filename prefix for the SSH host
-	// certificate
-	SSHHostCertPath = "ssh_host"
-
-	// SSHHostCertSuffix is the suffix appended to the generated host certificate.
-	SSHHostCertSuffix = "-cert.pub"
-
-	// SSHHostUserCASuffix is the suffix appended to the user CA file.
-	SSHHostUserCASuffix = "-user-ca.pub"
-)
-
-var (
-	_ ServiceConfig = &SSHHostOutput{}
-	_ Initable      = &SSHHostOutput{}
-)
-
-// SSHHostOutput generates a host certificate signed by the Teleport CA. This
-// can be used to allow OpenSSH server to be trusted by Teleport SSH clients.
-type SSHHostOutput struct {
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Roles is the list of roles to request for the generated credentials.
-	// If empty, it defaults to all the bot's roles.
-	Roles []string `yaml:"roles,omitempty"`
-
-	// Principals is a list of principals to request for the host cert.
-	Principals []string `yaml:"principals"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (o *SSHHostOutput) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-func (o *SSHHostOutput) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *SSHHostOutput) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if len(o.Principals) == 0 {
-		return trace.BadParameter("at least one principal must be specified")
-	}
-
-	return nil
-}
-
-func (o *SSHHostOutput) Describe() []FileDescription {
-	return []FileDescription{
-		{
-			Name: SSHHostCertPath,
-		},
-		{
-			Name: SSHHostCertPath + SSHHostCertSuffix,
-		},
-		{
-			Name: SSHHostCertPath + SSHHostUserCASuffix,
-		},
-	}
-}
-
-func (o *SSHHostOutput) MarshalYAML() (interface{}, error) {
-	type raw SSHHostOutput
-	return withTypeHeader((*raw)(o), SSHHostOutputType)
-}
-
-func (o *SSHHostOutput) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw SSHHostOutput
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *SSHHostOutput) Type() string {
-	return SSHHostOutputType
-}
-
-func (o *SSHHostOutput) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_ssh_host_test.go b/lib/tbot/config/service_ssh_host_test.go
deleted file mode 100644
index 5b1ba9f817fbf..0000000000000
--- a/lib/tbot/config/service_ssh_host_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-)
-
-func TestSSHHostOutput_YAML(t *testing.T) {
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[SSHHostOutput]{
-		{
-			name: "full",
-			in: SSHHostOutput{
-				Destination: dest,
-				Roles:       []string{"access"},
-				Principals:  []string{"host.example.com"},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: SSHHostOutput{
-				Destination: dest,
-				Principals:  []string{"host.example.com"},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestSSHHostOutput_CheckAndSetDefaults(t *testing.T) {
-	tests := []testCheckAndSetDefaultsCase[*SSHHostOutput]{
-		{
-			name: "valid",
-			in: func() *SSHHostOutput {
-				return &SSHHostOutput{
-					Destination: memoryDestForTest(),
-					Roles:       []string{"access"},
-					Principals:  []string{"host.example.com"},
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *SSHHostOutput {
-				return &SSHHostOutput{
-					Destination: nil,
-					Principals:  []string{"host.example.com"},
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing principals",
-			in: func() *SSHHostOutput {
-				return &SSHHostOutput{
-					Destination: memoryDestForTest(),
-				}
-			},
-			wantErr: "at least one principal must be specified",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_ssh_multiplexer.go b/lib/tbot/config/service_ssh_multiplexer.go
deleted file mode 100644
index 3d538647518cc..0000000000000
--- a/lib/tbot/config/service_ssh_multiplexer.go
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-// SSHMultiplexerServiceType is the type of the `ssh-proxy` service.
-const SSHMultiplexerServiceType = "ssh-multiplexer"
-
-// SSHMultiplexerService is the configuration for the `ssh-proxy` service
-type SSHMultiplexerService struct {
-	// Destination is where the config and tunnel should be written to. It
-	// should be a DestinationDirectory.
-	Destination bot.Destination `yaml:"destination"`
-	// EnableResumption controls whether to enable session resumption for the
-	// SSH proxy.
-	// Call `SessionResumptionEnabled` to get the value with defaults applied.
-	EnableResumption *bool `yaml:"enable_resumption"`
-	// ProxyTemplatesPath is the path to the directory containing the templates
-	// for the SSH proxy.
-	// This field is optional, if not provided, no templates will be used.
-	// This file is loaded once on start, so changes to the templates will
-	// require a restart of tbot.
-	ProxyTemplatesPath string `yaml:"proxy_templates_path"`
-	// ProxyCommand is the base command to configure OpenSSH to invoke to
-	// connect to the SSH multiplexer. The path to the socket and the target
-	// will be automatically appended.
-	// Optional: If not provided, it will default to the `tbot` binary.
-	ProxyCommand []string `yaml:"proxy_command,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-func (s *SSHMultiplexerService) SessionResumptionEnabled() bool {
-	if s.EnableResumption == nil {
-		return true
-	}
-	return *s.EnableResumption
-}
-
-func (s *SSHMultiplexerService) Type() string {
-	return SSHMultiplexerServiceType
-}
-
-func (s *SSHMultiplexerService) MarshalYAML() (interface{}, error) {
-	type raw SSHMultiplexerService
-	return withTypeHeader((*raw)(s), SSHMultiplexerServiceType)
-}
-
-func (s *SSHMultiplexerService) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw SSHMultiplexerService
-	if err := node.Decode((*raw)(s)); err != nil {
-		return trace.Wrap(err)
-	}
-	s.Destination = dest
-	return nil
-}
-
-func (s *SSHMultiplexerService) CheckAndSetDefaults() error {
-	if s.Destination == nil {
-		return trace.BadParameter("destination: must be specified")
-	}
-	_, ok := s.Destination.(*DestinationDirectory)
-	if !ok {
-		return trace.BadParameter("destination: must be of type `directory`")
-	}
-	if err := validateOutputDestination(s.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (o *SSHMultiplexerService) GetCredentialLifetime() CredentialLifetime {
-	return o.CredentialLifetime
-}
diff --git a/lib/tbot/config/service_ssh_multiplexer_test.go b/lib/tbot/config/service_ssh_multiplexer_test.go
deleted file mode 100644
index 29c2100f09c90..0000000000000
--- a/lib/tbot/config/service_ssh_multiplexer_test.go
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-)
-
-func TestSSHMultiplexerService_YAML(t *testing.T) {
-	t.Parallel()
-
-	tests := []testYAMLCase[SSHMultiplexerService]{
-		{
-			name: "full",
-			in: SSHMultiplexerService{
-				Destination: &DestinationDirectory{
-					Path: "/opt/machine-id",
-				},
-				EnableResumption:   ptr[bool](true),
-				ProxyTemplatesPath: "/etc/teleport/templates",
-				ProxyCommand:       []string{"rusty-boi"},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestSSHMultiplexerService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*SSHMultiplexerService]{
-		{
-			name: "valid",
-			in: func() *SSHMultiplexerService {
-				return &SSHMultiplexerService{
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-		},
-		{
-			name: "missing destination",
-			in: func() *SSHMultiplexerService {
-				return &SSHMultiplexerService{
-					Destination: nil,
-				}
-			},
-			wantErr: "destination: must be specified",
-		},
-		{
-			name: "wrong destination type",
-			in: func() *SSHMultiplexerService {
-				return &SSHMultiplexerService{
-					Destination: &DestinationMemory{},
-				}
-			},
-			wantErr: "destination: must be of type `directory`",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_workload_identity_api.go b/lib/tbot/config/service_workload_identity_api.go
deleted file mode 100644
index dd0890422e227..0000000000000
--- a/lib/tbot/config/service_workload_identity_api.go
+++ /dev/null
@@ -1,88 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-)
-
-const WorkloadIdentityAPIServiceType = "workload-identity-api"
-
-var (
-	_ ServiceConfig = &WorkloadIdentityAPIService{}
-)
-
-// WorkloadIdentityAPIService is the configuration for the
-// WorkloadIdentityAPIService
-type WorkloadIdentityAPIService struct {
-	// Listen is the address on which the SPIFFE Workload API server should
-	// listen. This should either be prefixed with "unix://" or "tcp://".
-	Listen string `yaml:"listen"`
-	// Attestors is the configuration for the workload attestation process.
-	Attestors workloadattest.Config `yaml:"attestors"`
-	// Selector is the selector for the WorkloadIdentity resource that
-	// will be used to issue WICs.
-	Selector WorkloadIdentitySelector `yaml:"selector"`
-
-	// CredentialLifetime contains configuration for how long X.509 SVIDs will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
-func (o *WorkloadIdentityAPIService) CheckAndSetDefaults() error {
-	if o.Listen == "" {
-		return trace.BadParameter("listen: should not be empty")
-	}
-	if err := o.Attestors.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating attestor")
-	}
-	if err := o.Selector.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating selector")
-	}
-	return nil
-}
-
-// Type returns the type of the service.
-func (o *WorkloadIdentityAPIService) Type() string {
-	return WorkloadIdentityAPIServiceType
-}
-
-// MarshalYAML marshals the WorkloadIdentityOutput into YAML.
-func (o *WorkloadIdentityAPIService) MarshalYAML() (interface{}, error) {
-	type raw WorkloadIdentityAPIService
-	return withTypeHeader((*raw)(o), WorkloadIdentityAPIServiceType)
-}
-
-// UnmarshalYAML unmarshals the WorkloadIdentityOutput from YAML.
-func (o *WorkloadIdentityAPIService) UnmarshalYAML(node *yaml.Node) error {
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw WorkloadIdentityAPIService
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (o *WorkloadIdentityAPIService) GetCredentialLifetime() CredentialLifetime {
-	lt := o.CredentialLifetime
-	lt.skipMaxTTLValidation = true
-	return lt
-}
diff --git a/lib/tbot/config/service_workload_identity_api_test.go b/lib/tbot/config/service_workload_identity_api_test.go
deleted file mode 100644
index 6569eb34f9b83..0000000000000
--- a/lib/tbot/config/service_workload_identity_api_test.go
+++ /dev/null
@@ -1,158 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-)
-
-func TestWorkloadIdentityAPIService_YAML(t *testing.T) {
-	t.Parallel()
-
-	tests := []testYAMLCase[WorkloadIdentityAPIService]{
-		{
-			name: "full",
-			in: WorkloadIdentityAPIService{
-				Listen: "tcp://0.0.0.0:4040",
-				Attestors: workloadattest.Config{
-					Kubernetes: workloadattest.KubernetesAttestorConfig{
-						Enabled: true,
-						Kubelet: workloadattest.KubeletClientConfig{
-							SecurePort: 12345,
-							TokenPath:  "/path/to/token",
-							CAPath:     "/path/to/ca.pem",
-							SkipVerify: true,
-							Anonymous:  true,
-						},
-					},
-				},
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: WorkloadIdentityAPIService{
-				Listen: "tcp://0.0.0.0:4040",
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*WorkloadIdentityAPIService]{
-		{
-			name: "valid",
-			in: func() *WorkloadIdentityAPIService {
-				return &WorkloadIdentityAPIService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Listen: "tcp://0.0.0.0:4040",
-				}
-			},
-			want: &WorkloadIdentityAPIService{
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				Listen: "tcp://0.0.0.0:4040",
-				Attestors: workloadattest.Config{
-					Unix: workloadattest.UnixAttestorConfig{
-						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
-					},
-				},
-			},
-		},
-		{
-			name: "valid with labels",
-			in: func() *WorkloadIdentityAPIService {
-				return &WorkloadIdentityAPIService{
-					Selector: WorkloadIdentitySelector{
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Listen: "tcp://0.0.0.0:4040",
-				}
-			},
-			want: &WorkloadIdentityAPIService{
-				Selector: WorkloadIdentitySelector{
-					Labels: map[string][]string{
-						"key": {"value"},
-					},
-				},
-				Listen: "tcp://0.0.0.0:4040",
-				Attestors: workloadattest.Config{
-					Unix: workloadattest.UnixAttestorConfig{
-						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
-					},
-				},
-			},
-		},
-		{
-			name: "missing selectors",
-			in: func() *WorkloadIdentityAPIService {
-				return &WorkloadIdentityAPIService{
-					Selector: WorkloadIdentitySelector{},
-					Listen:   "tcp://0.0.0.0:4040",
-				}
-			},
-			wantErr: "one of ['name', 'labels'] must be set",
-		},
-		{
-			name: "too many selectors",
-			in: func() *WorkloadIdentityAPIService {
-				return &WorkloadIdentityAPIService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Listen: "tcp://0.0.0.0:4040",
-				}
-			},
-			wantErr: "at most one of ['name', 'labels'] can be set",
-		},
-		{
-			name: "missing listen",
-			in: func() *WorkloadIdentityAPIService {
-				return &WorkloadIdentityAPIService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-				}
-			},
-			wantErr: "listen: should not be empty",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_workload_identity_aws_ra.go b/lib/tbot/config/service_workload_identity_aws_ra.go
deleted file mode 100644
index aefc1ee00b6b7..0000000000000
--- a/lib/tbot/config/service_workload_identity_aws_ra.go
+++ /dev/null
@@ -1,194 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"context"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws/arn"
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/api/utils/aws"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const (
-	WorkloadIdentityAWSRAType        = "workload-identity-aws-roles-anywhere"
-	defaultAWSSessionDuration        = 6 * time.Hour
-	maxAWSSessionDuration            = 12 * time.Hour
-	defaultAWSSessionRenewalInterval = 1 * time.Hour
-)
-
-var (
-	_ ServiceConfig = &WorkloadIdentityAWSRAService{}
-	_ Initable      = &WorkloadIdentityAWSRAService{}
-)
-
-// WorkloadIdentityAWSRAService is the configuration for the
-// WorkloadIdentityAWSRAService
-type WorkloadIdentityAWSRAService struct {
-	// Selector is the selector for the WorkloadIdentity resource that will be
-	// used to issue WICs.
-	Selector WorkloadIdentitySelector `yaml:"selector"`
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-
-	// RoleARN is the ARN of the role to assume.
-	// Example: `arn:aws:iam::123456789012:role/example-role`
-	// Required.
-	RoleARN string `yaml:"role_arn"`
-	// ProfileARN is the ARN of the Roles Anywhere profile to use.
-	// Example: `arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000`
-	// Required.
-	ProfileARN string `yaml:"profile_arn"`
-	// TrustAnchorARN is the ARN of the Roles Anywhere trust anchor to use.
-	// Example: `arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000`
-	// Required.
-	TrustAnchorARN string `yaml:"trust_anchor_arn"`
-	// Region is the AWS region to use.
-	// Example: `us-east-1`
-	// Must be set here or in the environment or AWS config using the
-	// `AWS_REGION` environment variable. If set here, this will override the
-	// environment or AWS config.
-	Region string `yaml:"region"`
-
-	// SessionDuration is the duration of the resulting AWS session and
-	// credentials. This may be up to 12 hours. When unset, this defaults to
-	// 6 hours.
-	SessionDuration time.Duration `yaml:"session_duration"`
-	// SessionRenewalInterval is the interval at which the session should be
-	// renewed. This should be less than the session duration. When unset, this
-	// defaults to 1 hour.
-	SessionRenewalInterval time.Duration `yaml:"session_renewal_interval"`
-
-	// CredentialProfileName is the name of the AWS credentials profile to
-	// write to. If unspecified, the profile will be named "default".
-	CredentialProfileName string `yaml:"credential_profile_name,omitempty"`
-
-	// ArtifactName is the name of the artifact to write to. This is the
-	// filename of the file that will be written to the destination. This is
-	// by default "aws_credentials".
-	ArtifactName string `yaml:"artifact_name,omitempty"`
-	// OverwriteCredentialFile is a flag that indicates whether the output
-	// should overwrite the existing credentials file rather than merging with
-	// it.
-	OverwriteCredentialFile bool `yaml:"overwrite_credential_file,omitempty"`
-
-	// EndpointOverride is the endpoint to use for the AWS Roles Anywhere service.
-	// This is designed to be leveraged by tests and unset in production
-	// circumstances.
-	EndpointOverride string `yaml:"-"`
-}
-
-// Init initializes the destination.
-func (o *WorkloadIdentityAWSRAService) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-// CheckAndSetDefaults checks the WorkloadIdentityAWSRAService values and sets any defaults.
-func (o *WorkloadIdentityAWSRAService) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if err := o.Selector.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating selector")
-	}
-
-	switch {
-	case o.RoleARN == "":
-		return trace.BadParameter("role_arn: must be set")
-	case o.ProfileARN == "":
-		return trace.BadParameter("profile_arn: must be set")
-	case o.TrustAnchorARN == "":
-		return trace.BadParameter("trust_anchor_arn: must be set")
-	}
-	if _, err := arn.Parse(o.RoleARN); err != nil {
-		return trace.Wrap(err, "parsing role_arn")
-	}
-	if _, err := arn.Parse(o.ProfileARN); err != nil {
-		return trace.Wrap(err, "parsing profile_arn")
-	}
-	if _, err := arn.Parse(o.TrustAnchorARN); err != nil {
-		return trace.Wrap(err, "parsing trust_anchor_arn")
-	}
-	if o.Region != "" {
-		if err := aws.IsValidRegion(o.Region); err != nil {
-			return trace.Wrap(err, "validating region")
-		}
-	}
-
-	if o.SessionDuration == 0 {
-		o.SessionDuration = defaultAWSSessionDuration
-	}
-	if o.SessionDuration > maxAWSSessionDuration {
-		return trace.BadParameter("session_duration: must be less than or equal to 12 hours")
-	}
-	if o.SessionRenewalInterval == 0 {
-		o.SessionRenewalInterval = defaultAWSSessionRenewalInterval
-	}
-	if o.SessionRenewalInterval >= o.SessionDuration {
-		return trace.BadParameter("session_renewal_interval: must be less than session_duration")
-	}
-
-	return nil
-}
-
-// Describe returns the file descriptions for the WorkloadIdentityJWTService.
-func (o *WorkloadIdentityAWSRAService) Describe() []FileDescription {
-	fds := []FileDescription{
-		{
-			Name: JWTSVIDPath,
-		},
-	}
-	return fds
-}
-
-func (o *WorkloadIdentityAWSRAService) Type() string {
-	return WorkloadIdentityAWSRAType
-}
-
-// MarshalYAML marshals the WorkloadIdentityJWTService into YAML.
-func (o *WorkloadIdentityAWSRAService) MarshalYAML() (interface{}, error) {
-	type raw WorkloadIdentityAWSRAService
-	return withTypeHeader((*raw)(o), WorkloadIdentityAWSRAType)
-}
-
-// UnmarshalYAML unmarshals the WorkloadIdentityJWTService from YAML.
-func (o *WorkloadIdentityAWSRAService) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw WorkloadIdentityAWSRAService
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-// GetDestination returns the destination.
-func (o *WorkloadIdentityAWSRAService) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *WorkloadIdentityAWSRAService) GetCredentialLifetime() CredentialLifetime {
-	return CredentialLifetime{}
-}
diff --git a/lib/tbot/config/service_workload_identity_aws_ra_test.go b/lib/tbot/config/service_workload_identity_aws_ra_test.go
deleted file mode 100644
index 1c55a0501aaf9..0000000000000
--- a/lib/tbot/config/service_workload_identity_aws_ra_test.go
+++ /dev/null
@@ -1,326 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-)
-
-func TestWorkloadIdentityAWSRAService_YAML(t *testing.T) {
-	t.Parallel()
-
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[WorkloadIdentityAWSRAService]{
-		{
-			name: "full",
-			in: WorkloadIdentityAWSRAService{
-				Destination: dest,
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				SessionDuration:         time.Minute * 59,
-				SessionRenewalInterval:  time.Minute * 29,
-				RoleARN:                 "arn:aws:iam::123456789012:role/example-role",
-				TrustAnchorARN:          "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-				ProfileARN:              "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-				Region:                  "us-east-1",
-				CredentialProfileName:   "my-profile",
-				ArtifactName:            "my-artifact.toml",
-				OverwriteCredentialFile: true,
-			},
-		},
-		{
-			name: "simple",
-			in: WorkloadIdentityAWSRAService{
-				Destination: dest,
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				SessionDuration:        time.Minute * 59,
-				SessionRenewalInterval: time.Minute * 29,
-				RoleARN:                "arn:aws:iam::123456789012:role/example-role",
-				TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-				ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-				Region:                 "us-east-1",
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestWorkloadIdentityAWSRAService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*WorkloadIdentityAWSRAService]{
-		{
-			name: "valid",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			want: &WorkloadIdentityAWSRAService{
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				Destination: &DestinationDirectory{
-					Path:     "/opt/machine-id",
-					ACLs:     botfs.ACLOff,
-					Symlinks: botfs.SymlinksInsecure,
-				},
-				SessionDuration:        defaultAWSSessionDuration,
-				SessionRenewalInterval: defaultAWSSessionRenewalInterval,
-				RoleARN:                "arn:aws:iam::123456789012:role/example-role",
-				TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-				ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-				Region:                 "us-east-1",
-			},
-		},
-		{
-			name: "valid with labels",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					SessionDuration:        1 * time.Hour,
-					SessionRenewalInterval: 30 * time.Minute,
-					RoleARN:                "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:                 "us-east-1",
-				}
-			},
-		},
-		{
-			name: "missing selectors",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "one of ['name', 'labels'] must be set",
-		},
-		{
-			name: "too many selectors",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "at most one of ['name', 'labels'] can be set",
-		},
-		{
-			name: "missing destination",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Destination: nil,
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-		{
-			name: "missing role_arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "role_arn: must be set",
-		},
-		{
-			name: "missing trust_anchor_arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:    "arn:aws:iam::123456789012:role/example-role",
-					ProfileARN: "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:     "us-east-1",
-				}
-			},
-			wantErr: "trust_anchor_arn: must be set",
-		},
-		{
-			name: "missing profile_arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "profile_arn: must be set",
-		},
-		{
-			name: "invalid role arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "foo",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "arn: invalid prefix",
-		},
-		{
-			name: "invalid trust anchor arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "foo",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "arn: invalid prefix",
-		},
-		{
-			name: "invalid profile arn",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "foo",
-					Region:         "us-east-1",
-				}
-			},
-			wantErr: "arn: invalid prefix",
-		},
-		{
-			name: "invalid region",
-			in: func() *WorkloadIdentityAWSRAService {
-				return &WorkloadIdentityAWSRAService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
-					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
-					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
-					Region:         "us-east-1!!!!",
-				}
-			},
-			wantErr: "validating region",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_workload_identity_jwt.go b/lib/tbot/config/service_workload_identity_jwt.go
deleted file mode 100644
index a46063380d363..0000000000000
--- a/lib/tbot/config/service_workload_identity_jwt.go
+++ /dev/null
@@ -1,116 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const WorkloadIdentityJWTOutputType = "workload-identity-jwt"
-
-var (
-	_ ServiceConfig = &WorkloadIdentityJWTService{}
-	_ Initable      = &WorkloadIdentityJWTService{}
-)
-
-// WorkloadIdentityJWTService is the configuration for the WorkloadIdentityJWTService
-type WorkloadIdentityJWTService struct {
-	// Selector is the selector for the WorkloadIdentity resource that will be
-	// used to issue WICs.
-	Selector WorkloadIdentitySelector `yaml:"selector"`
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// Audiences is the list of audiences that the JWT should be valid for.
-	Audiences []string
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-// Init initializes the destination.
-func (o *WorkloadIdentityJWTService) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-// CheckAndSetDefaults checks the WorkloadIdentityJWTService values and sets any defaults.
-func (o *WorkloadIdentityJWTService) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if err := o.Selector.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating selector")
-	}
-	if len(o.Audiences) == 0 {
-		return trace.BadParameter("audiences: must have at least one value")
-	}
-	return nil
-}
-
-// JWTSVIDPath is the name of the artifact that a JWT SVID will be written to.
-const JWTSVIDPath = "jwt_svid"
-
-// Describe returns the file descriptions for the WorkloadIdentityJWTService.
-func (o *WorkloadIdentityJWTService) Describe() []FileDescription {
-	fds := []FileDescription{
-		{
-			Name: JWTSVIDPath,
-		},
-	}
-	return fds
-}
-
-func (o *WorkloadIdentityJWTService) Type() string {
-	return WorkloadIdentityJWTOutputType
-}
-
-// MarshalYAML marshals the WorkloadIdentityJWTService into YAML.
-func (o *WorkloadIdentityJWTService) MarshalYAML() (interface{}, error) {
-	type raw WorkloadIdentityJWTService
-	return withTypeHeader((*raw)(o), WorkloadIdentityJWTOutputType)
-}
-
-// UnmarshalYAML unmarshals the WorkloadIdentityJWTService from YAML.
-func (o *WorkloadIdentityJWTService) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw WorkloadIdentityJWTService
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-// GetDestination returns the destination.
-func (o *WorkloadIdentityJWTService) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-func (o *WorkloadIdentityJWTService) GetCredentialLifetime() CredentialLifetime {
-	lt := o.CredentialLifetime
-	lt.skipMaxTTLValidation = true
-	return lt
-}
diff --git a/lib/tbot/config/service_workload_identity_jwt_test.go b/lib/tbot/config/service_workload_identity_jwt_test.go
deleted file mode 100644
index 0cb31e9030e77..0000000000000
--- a/lib/tbot/config/service_workload_identity_jwt_test.go
+++ /dev/null
@@ -1,153 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-)
-
-func TestWorkloadIdentityJWTService_YAML(t *testing.T) {
-	t.Parallel()
-
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[WorkloadIdentityJWTService]{
-		{
-			name: "full",
-			in: WorkloadIdentityJWTService{
-				Destination: dest,
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				Audiences: []string{"audience1", "audience2"},
-				CredentialLifetime: CredentialLifetime{
-					TTL:             time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestWorkloadIdentityJWTService_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*WorkloadIdentityJWTService]{
-		{
-			name: "valid",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					Audiences: []string{"audience1", "audience2"},
-				}
-			},
-		},
-		{
-			name: "valid with labels",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Selector: WorkloadIdentitySelector{
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					Audiences: []string{"audience1", "audience2"},
-				}
-			},
-		},
-		{
-			name: "missing audience",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-			wantErr: "audiences: must have at least one value",
-		},
-		{
-			name: "missing selectors",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Selector: WorkloadIdentitySelector{},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					Audiences: []string{"audience1", "audience2"},
-				}
-			},
-			wantErr: "one of ['name', 'labels'] must be set",
-		},
-		{
-			name: "too many selectors",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-					Audiences: []string{"audience1", "audience2"},
-				}
-			},
-			wantErr: "at most one of ['name', 'labels'] can be set",
-		},
-		{
-			name: "missing destination",
-			in: func() *WorkloadIdentityJWTService {
-				return &WorkloadIdentityJWTService{
-					Destination: nil,
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Audiences: []string{"audience1", "audience2"},
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/service_workload_identity_x509.go b/lib/tbot/config/service_workload_identity_x509.go
deleted file mode 100644
index 80fd9d9a2885a..0000000000000
--- a/lib/tbot/config/service_workload_identity_x509.go
+++ /dev/null
@@ -1,149 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-const WorkloadIdentityX509OutputType = "workload-identity-x509"
-
-var (
-	_ ServiceConfig = &WorkloadIdentityX509Service{}
-	_ Initable      = &WorkloadIdentityX509Service{}
-)
-
-// WorkloadIdentitySelector allows the user to select which WorkloadIdentity
-// resource should be used.
-//
-// Only one of Name or Labels can be set.
-type WorkloadIdentitySelector struct {
-	// Name is the name of a specific WorkloadIdentity resource.
-	Name string `yaml:"name"`
-	// Labels is a set of labels that the WorkloadIdentity resource must have.
-	Labels map[string][]string `yaml:"labels,omitempty"`
-}
-
-// CheckAndSetDefaults checks the WorkloadIdentitySelector values and sets any
-// defaults.
-func (s *WorkloadIdentitySelector) CheckAndSetDefaults() error {
-	switch {
-	case s.Name == "" && len(s.Labels) == 0:
-		return trace.BadParameter("one of ['name', 'labels'] must be set")
-	case s.Name != "" && len(s.Labels) > 0:
-		return trace.BadParameter("at most one of ['name', 'labels'] can be set")
-	}
-	for k, v := range s.Labels {
-		if len(v) == 0 {
-			return trace.BadParameter("labels[%s]: must have at least one value", k)
-		}
-	}
-	return nil
-}
-
-// WorkloadIdentityX509Service is the configuration for the WorkloadIdentityX509Service
-// Emulates the output of https://github.com/spiffe/spiffe-helper
-type WorkloadIdentityX509Service struct {
-	// Selector is the selector for the WorkloadIdentity resource that will be
-	// used to issue WICs.
-	Selector WorkloadIdentitySelector `yaml:"selector"`
-	// Destination is where the credentials should be written to.
-	Destination bot.Destination `yaml:"destination"`
-	// IncludeFederatedTrustBundles controls whether to include federated trust
-	// bundles in the output.
-	IncludeFederatedTrustBundles bool `yaml:"include_federated_trust_bundles,omitempty"`
-
-	// CredentialLifetime contains configuration for how long credentials will
-	// last and the frequency at which they'll be renewed.
-	CredentialLifetime CredentialLifetime `yaml:",inline"`
-}
-
-// Init initializes the destination.
-func (o *WorkloadIdentityX509Service) Init(ctx context.Context) error {
-	return trace.Wrap(o.Destination.Init(ctx, []string{}))
-}
-
-// GetDestination returns the destination.
-func (o *WorkloadIdentityX509Service) GetDestination() bot.Destination {
-	return o.Destination
-}
-
-// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
-func (o *WorkloadIdentityX509Service) CheckAndSetDefaults() error {
-	if err := validateOutputDestination(o.Destination); err != nil {
-		return trace.Wrap(err)
-	}
-	if err := o.Selector.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating selector")
-	}
-	return nil
-}
-
-// Describe returns the file descriptions for the WorkloadIdentityX509Service.
-func (o *WorkloadIdentityX509Service) Describe() []FileDescription {
-	fds := []FileDescription{
-		{
-			Name: SVIDPEMPath,
-		},
-		{
-			Name: SVIDKeyPEMPath,
-		},
-		{
-			Name: SVIDTrustBundlePEMPath,
-		},
-		{
-			Name: SVIDCRLPemPath,
-		},
-	}
-	return fds
-}
-
-func (o *WorkloadIdentityX509Service) Type() string {
-	return WorkloadIdentityX509OutputType
-}
-
-// MarshalYAML marshals the WorkloadIdentityX509Service into YAML.
-func (o *WorkloadIdentityX509Service) MarshalYAML() (interface{}, error) {
-	type raw WorkloadIdentityX509Service
-	return withTypeHeader((*raw)(o), WorkloadIdentityX509OutputType)
-}
-
-// UnmarshalYAML unmarshals the WorkloadIdentityX509Service from YAML.
-func (o *WorkloadIdentityX509Service) UnmarshalYAML(node *yaml.Node) error {
-	dest, err := extractOutputDestination(node)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// Alias type to remove UnmarshalYAML to avoid recursion
-	type raw WorkloadIdentityX509Service
-	if err := node.Decode((*raw)(o)); err != nil {
-		return trace.Wrap(err)
-	}
-	o.Destination = dest
-	return nil
-}
-
-func (o *WorkloadIdentityX509Service) GetCredentialLifetime() CredentialLifetime {
-	lt := o.CredentialLifetime
-	lt.skipMaxTTLValidation = true
-	return lt
-}
diff --git a/lib/tbot/config/service_workload_identity_x509_test.go b/lib/tbot/config/service_workload_identity_x509_test.go
deleted file mode 100644
index a1a9286833978..0000000000000
--- a/lib/tbot/config/service_workload_identity_x509_test.go
+++ /dev/null
@@ -1,138 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-)
-
-func TestWorkloadIdentityX509Service_YAML(t *testing.T) {
-	t.Parallel()
-
-	dest := &DestinationMemory{}
-	tests := []testYAMLCase[WorkloadIdentityX509Service]{
-		{
-			name: "full",
-			in: WorkloadIdentityX509Service{
-				Destination: dest,
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-				IncludeFederatedTrustBundles: true,
-				CredentialLifetime: CredentialLifetime{
-					TTL:             1 * time.Minute,
-					RenewalInterval: 30 * time.Second,
-				},
-			},
-		},
-		{
-			name: "minimal",
-			in: WorkloadIdentityX509Service{
-				Destination: dest,
-				Selector: WorkloadIdentitySelector{
-					Name: "my-workload-identity",
-				},
-			},
-		},
-	}
-	testYAML(t, tests)
-}
-
-func TestWorkloadIdentityX509Service_CheckAndSetDefaults(t *testing.T) {
-	t.Parallel()
-
-	tests := []testCheckAndSetDefaultsCase[*WorkloadIdentityX509Service]{
-		{
-			name: "valid",
-			in: func() *WorkloadIdentityX509Service {
-				return &WorkloadIdentityX509Service{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-		},
-		{
-			name: "valid with labels",
-			in: func() *WorkloadIdentityX509Service {
-				return &WorkloadIdentityX509Service{
-					Selector: WorkloadIdentitySelector{
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-		},
-		{
-			name: "missing selectors",
-			in: func() *WorkloadIdentityX509Service {
-				return &WorkloadIdentityX509Service{
-					Selector: WorkloadIdentitySelector{},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-			wantErr: "one of ['name', 'labels'] must be set",
-		},
-		{
-			name: "too many selectors",
-			in: func() *WorkloadIdentityX509Service {
-				return &WorkloadIdentityX509Service{
-					Selector: WorkloadIdentitySelector{
-						Name: "my-workload-identity",
-						Labels: map[string][]string{
-							"key": {"value"},
-						},
-					},
-					Destination: &DestinationDirectory{
-						Path:     "/opt/machine-id",
-						ACLs:     botfs.ACLOff,
-						Symlinks: botfs.SymlinksInsecure,
-					},
-				}
-			},
-			wantErr: "at most one of ['name', 'labels'] can be set",
-		},
-		{
-			name: "missing destination",
-			in: func() *WorkloadIdentityX509Service {
-				return &WorkloadIdentityX509Service{
-					Destination: nil,
-				}
-			},
-			wantErr: "no destination configured for output",
-		},
-	}
-	testCheckAndSetDefaults(t, tests)
-}
diff --git a/lib/tbot/config/systemd/systemd.tmpl b/lib/tbot/config/systemd/systemd.tmpl
new file mode 100644
index 0000000000000..95ea44848d254
--- /dev/null
+++ b/lib/tbot/config/systemd/systemd.tmpl
@@ -0,0 +1,19 @@
+# Generated by `tbot`
+[Unit]
+Description={{ .UnitName }} - Teleport Machine & Workload Identity Service
+After=network.target
+
+[Service]
+Type=simple
+User={{ .User }}
+Group={{ .Group }}
+Restart=always
+RestartSec=5
+Environment="TELEPORT_ANONYMOUS_TELEMETRY={{ if .AnonymousTelemetry }}1{{ else }}0{{ end }}"
+ExecStart={{ .TBotPath }} start -c {{ .ConfigPath }}{{ with .DiagSocketForUpdater }} --diag-socket-for-updater={{ . }}{{ end }} --pid-file=/run/{{ .UnitName }}.pid
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/run/{{ .UnitName }}.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target
diff --git a/lib/tbot/config/systemd/template.go b/lib/tbot/config/systemd/template.go
new file mode 100644
index 0000000000000..1c4af6fb57c25
--- /dev/null
+++ b/lib/tbot/config/systemd/template.go
@@ -0,0 +1,50 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package systemd
+
+import (
+	_ "embed"
+	"text/template"
+)
+
+var (
+	//go:embed systemd.tmpl
+	templateData string
+
+	// Template is the systemd unit template for tbot..
+	Template = template.Must(template.New("").Parse(templateData))
+)
+
+// TemplateParams are the parameters for the systemd unit template.
+type TemplateParams struct {
+	// UnitName is the name of the systemd unit.
+	UnitName string
+	// User is the user to run the service as.
+	User string
+	// Group is the group to run the service as.
+	Group string
+	// AnonymousTelemetry is whether to enable anonymous telemetry.
+	AnonymousTelemetry bool
+	// ConfigPath is the path to the tbot config file.
+	ConfigPath string
+	// TBotPath is the path to the tbot binary.
+	TBotPath string
+	// DiagSocketForUpdater is the path to the diag socket for the updater.
+	DiagSocketForUpdater string
+}
diff --git a/lib/tbot/config/template.go b/lib/tbot/config/template.go
index 7fc3dfa417312..220e6d9f69f91 100644
--- a/lib/tbot/config/template.go
+++ b/lib/tbot/config/template.go
@@ -47,14 +47,3 @@ const (
 	// certificates
 	TemplateSSHHostCertName = "ssh_host_cert"
 )
-
-// FileDescription is a minimal spec needed to create an empty end-user-owned
-// file with bot-writable ACLs during `tbot init`.
-type FileDescription struct {
-	// Name is the name of the file or directory to create.
-	Name string
-
-	// IsDir designates whether this describes a subdirectory inside the
-	// Destination.
-	IsDir bool
-}
diff --git a/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden b/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden
index d3f6da0fd8713..9a34580d96b7a 100644
--- a/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden
+++ b/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden
@@ -66,8 +66,6 @@ services:
     destination:
       type: directory
       path: /bot/output
-    enable_resumption: null
-    proxy_templates_path: ""
     credential_ttl: 30s
     renewal_interval: 15s
   - type: application-tunnel
@@ -77,6 +75,11 @@ services:
     app_name: my-app
     credential_ttl: 30s
     renewal_interval: 15s
+  - type: application-proxy
+    listen: tcp://127.0.0.1:8080
+    credential_lifetime:
+      credential_ttl: 30s
+      renewal_interval: 15s
   - type: workload-identity-x509
     selector:
       name: my-workload-identity
diff --git a/lib/tbot/config/testdata/TestDestinationKubernetesSecret_YAML/full.golden b/lib/tbot/config/testdata/TestDestinationKubernetesSecret_YAML/full.golden
deleted file mode 100644
index cbb776b05b068..0000000000000
--- a/lib/tbot/config/testdata/TestDestinationKubernetesSecret_YAML/full.golden
+++ /dev/null
@@ -1,2 +0,0 @@
-type: kubernetes_secret
-name: my-secret
diff --git a/lib/tbot/config/testdata/TestKubernetesV2Output_YAML/full.golden b/lib/tbot/config/testdata/TestKubernetesV2Output_YAML/full.golden
deleted file mode 100644
index 6ff75ac6b8d50..0000000000000
--- a/lib/tbot/config/testdata/TestKubernetesV2Output_YAML/full.golden
+++ /dev/null
@@ -1,10 +0,0 @@
-type: kubernetes/v2
-destination:
-  type: memory
-disable_exec_plugin: true
-selectors:
-  - name: foo
-  - labels:
-      foo: bar
-credential_ttl: 1m0s
-renewal_interval: 30s
diff --git a/lib/tbot/config/uri.go b/lib/tbot/config/uri.go
new file mode 100644
index 0000000000000..42c106b3adfe7
--- /dev/null
+++ b/lib/tbot/config/uri.go
@@ -0,0 +1,213 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"context"
+	"log/slog"
+	"net/url"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+)
+
+const (
+	// URISchemePrefix is the prefix for
+	URISchemePrefix = "tbot"
+)
+
+type JoinURIParams struct {
+	// AddressKind is the type of joining address, i.e. proxy or auth.
+	AddressKind connection.AddressKind
+
+	// JoinMethod is the join method to use when joining, in combination with
+	// the token name.
+	JoinMethod types.JoinMethod
+
+	// Token is the token name to use when joining
+	Token string
+
+	// JoinMethodParameter is an optional parameter to pass to the join method.
+	// Its specific meaning depends on the join method in use.
+	JoinMethodParameter string
+
+	// Address is either an auth or proxy address, depending on the configured
+	// AddressKind. It includes the port.
+	Address string
+}
+
+// applyValueOrError sets the target `target` to the value `value`, but only if
+// the current value is that type's zero value, or if the current value is equal
+// to the desired value. If not, an error is returned per the error message
+// string and arguments. This can be used to ensure existing values will not be
+// overwritten.
+func applyValueOrError[T comparable](target *T, value T, errMsg string, errArgs ...any) error {
+	var zero T
+	switch *target {
+	case zero:
+		*target = value
+		return nil
+	case value:
+		return nil
+	}
+
+	return trace.BadParameter(errMsg, errArgs...)
+}
+
+// ApplyToConfig applies parameters from a parsed joining URI to the given bot
+// config. This is designed to be applied to a configuration that has already
+// been loaded - but not yet validated - and returns an error if any fields in
+// the URI will conflict with those already set in the existing configuration.
+func (p *JoinURIParams) ApplyToConfig(cfg *BotConfig) error {
+	var errors []error
+
+	if cfg.AuthServer != "" {
+		errors = append(errors, trace.BadParameter("URI conflicts with configured field: auth_server"))
+	} else if cfg.ProxyServer != "" {
+		errors = append(errors, trace.BadParameter("URI conflicts with configured field: proxy_server"))
+	} else {
+		switch p.AddressKind {
+		case connection.AddressKindAuth:
+			cfg.AuthServer = p.Address
+		default:
+			// this parameter should not be unspecified due to checks in
+			// ParseJoinURI, so we'll assume proxy.
+			cfg.ProxyServer = p.Address
+		}
+	}
+
+	errors = append(errors, applyValueOrError(
+		&cfg.Onboarding.JoinMethod, p.JoinMethod,
+		"URI joining method %q conflicts with configured field: onboarding.join_method", p.JoinMethod))
+
+	if cfg.Onboarding.TokenValue != "" {
+		errors = append(errors, trace.BadParameter("URI conflicts with configured field: onboarding.token"))
+	} else {
+		cfg.Onboarding.SetToken(p.Token)
+	}
+
+	// The join method parameter maps to a method-specific field when set.
+	if param := p.JoinMethodParameter; param != "" {
+		switch p.JoinMethod {
+		case types.JoinMethodAzure:
+			errors = append(errors, applyValueOrError(
+				&cfg.Onboarding.Azure.ClientID, param,
+				"URI join method parameter %q conflicts with configured field: onboarding.azure.client_id",
+				param))
+		case types.JoinMethodTerraformCloud:
+			errors = append(errors, applyValueOrError(
+				&cfg.Onboarding.Terraform.AudienceTag, param,
+				"URI join method parameter %q conflicts with configured field: onboarding.terraform.audience_tag", param))
+		case types.JoinMethodGitLab:
+			errors = append(errors, applyValueOrError(
+				&cfg.Onboarding.Gitlab.TokenEnvVarName, param,
+				"URI join method parameter %q conflicts with configured field: onboarding.gitlab.token_env_var_name", param))
+		case types.JoinMethodBoundKeypair:
+			errors = append(errors, applyValueOrError(
+				&cfg.Onboarding.BoundKeypair.RegistrationSecretValue, param,
+				"URI join method parameter %q conflicts with configured field: onboarding.bound_keypair.registration_secret", param))
+		default:
+			slog.WarnContext(
+				context.Background(),
+				"ignoring join method parameter for unsupported join method",
+				"join_method", p.JoinMethod,
+			)
+		}
+	}
+
+	return trace.NewAggregate(errors...)
+}
+
+// MapURLSafeJoinMethod converts a URL safe join method name to a defined join
+// method constant.
+func MapURLSafeJoinMethod(name string) (types.JoinMethod, error) {
+	// When given a join method name that is already URL safe, just return it.
+	if slices.Contains(onboarding.SupportedJoinMethods, name) {
+		return types.JoinMethod(name), nil
+	}
+
+	// Various join methods contain underscores ("_") which are not valid
+	// characters in URL schemes, and must be mapped from something valid.
+	switch name {
+	case "bound-keypair", "boundkeypair":
+		return types.JoinMethodBoundKeypair, nil
+	case "azure-devops", "azuredevops":
+		return types.JoinMethodAzureDevops, nil
+	case "terraform-cloud", "terraformcloud":
+		return types.JoinMethodTerraformCloud, nil
+	default:
+		return types.JoinMethodUnspecified, trace.BadParameter("unsupported join method %q", name)
+	}
+}
+
+// ParseJoinURI parses a joining URI from its string form. It returns an error
+// if the input URI is malformed, missing parameters, or references an unknown
+// or invalid join method or connection type.
+func ParseJoinURI(s string) (*JoinURIParams, error) {
+	uri, err := url.Parse(s)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing joining URI")
+	}
+
+	schemeParts := strings.SplitN(uri.Scheme, "+", 3)
+	if len(schemeParts) != 3 {
+		return nil, trace.BadParameter("unsupported joining URI scheme: %q", uri.Scheme)
+	}
+
+	if schemeParts[0] != URISchemePrefix {
+		return nil, trace.BadParameter(
+			"unsupported joining URI scheme %q: scheme prefix must be %q",
+			uri.Scheme, URISchemePrefix)
+	}
+
+	var kind connection.AddressKind
+	switch schemeParts[1] {
+	case string(connection.AddressKindProxy):
+		kind = connection.AddressKindProxy
+	case string(connection.AddressKindAuth):
+		kind = connection.AddressKindAuth
+	default:
+		return nil, trace.BadParameter(
+			"unsupported joining URI scheme %q: address kind must be one of [%q, %q], got: %q",
+			uri.Scheme, connection.AddressKindProxy, connection.AddressKindAuth, schemeParts[1])
+	}
+
+	joinMethod, err := MapURLSafeJoinMethod(schemeParts[2])
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if uri.User == nil {
+		return nil, trace.BadParameter("invalid joining URI: must contain join token in user field")
+	}
+
+	param, _ := uri.User.Password()
+	return &JoinURIParams{
+		AddressKind:         kind,
+		JoinMethod:          joinMethod,
+		Token:               uri.User.Username(),
+		JoinMethodParameter: param,
+		Address:             uri.Host,
+	}, nil
+}
diff --git a/lib/tbot/config/uri_test.go b/lib/tbot/config/uri_test.go
new file mode 100644
index 0000000000000..e3e65f0926d42
--- /dev/null
+++ b/lib/tbot/config/uri_test.go
@@ -0,0 +1,239 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package config
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+)
+
+func TestParseJoinURI(t *testing.T) {
+	tests := []struct {
+		uri         string
+		expect      *JoinURIParams
+		expectError require.ErrorAssertionFunc
+	}{
+		{
+			uri: "tbot+proxy+token://asdf@example.com:1234",
+			expect: &JoinURIParams{
+				AddressKind:         connection.AddressKindProxy,
+				Token:               "asdf",
+				JoinMethod:          types.JoinMethodToken,
+				Address:             "example.com:1234",
+				JoinMethodParameter: "",
+			},
+		},
+		{
+			uri: "tbot+auth+bound-keypair://token:param@example.com",
+			expect: &JoinURIParams{
+				AddressKind:         connection.AddressKindAuth,
+				Token:               "token",
+				JoinMethod:          types.JoinMethodBoundKeypair,
+				Address:             "example.com",
+				JoinMethodParameter: "param",
+			},
+		},
+		{
+			uri: "",
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "unsupported joining URI scheme")
+			},
+		},
+		{
+			uri: "tbot+foo+token://example.com",
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "address kind must be one of")
+			},
+		},
+		{
+			uri: "tbot+proxy+bar://example.com",
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "unsupported join method")
+			},
+		},
+		{
+			uri: "https://example.com",
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "unsupported joining URI scheme")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.uri, func(t *testing.T) {
+			parsed, err := ParseJoinURI(tt.uri)
+			if tt.expectError == nil {
+				require.NoError(t, err)
+			} else {
+				tt.expectError(t, err)
+			}
+
+			require.Empty(t, cmp.Diff(parsed, tt.expect))
+		})
+	}
+}
+
+func TestJoinURIApplyToConfig(t *testing.T) {
+	tests := []struct {
+		uri          string
+		inputConfig  *BotConfig
+		expectConfig *BotConfig
+		expectError  require.ErrorAssertionFunc
+	}{
+		{
+			uri:         "tbot+proxy+token://asdf@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "asdf",
+					JoinMethod: types.JoinMethodToken,
+				},
+				ProxyServer: "example.com:1234",
+			},
+		},
+		{
+			uri:         "tbot+proxy+bound-keypair://some-token:secret@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "some-token",
+					JoinMethod: types.JoinMethodBoundKeypair,
+					BoundKeypair: onboarding.BoundKeypairOnboardingConfig{
+						RegistrationSecretValue: "secret",
+					},
+				},
+				ProxyServer: "example.com:1234",
+			},
+		},
+		{
+			uri:         "tbot+auth+azure://some-token:client-id@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "some-token",
+					JoinMethod: types.JoinMethodAzure,
+					Azure: onboarding.AzureOnboardingConfig{
+						ClientID: "client-id",
+					},
+				},
+				AuthServer: "example.com:1234",
+			},
+		},
+		{
+			uri:         "tbot+auth+gitlab://some-token:var-name@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "some-token",
+					JoinMethod: types.JoinMethodGitLab,
+					Gitlab: onboarding.GitlabOnboardingConfig{
+						TokenEnvVarName: "var-name",
+					},
+				},
+				AuthServer: "example.com:1234",
+			},
+		},
+		{
+			uri:         "tbot+auth+azure-devops://some-token@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "some-token",
+					JoinMethod: types.JoinMethodAzureDevops,
+				},
+				AuthServer: "example.com:1234",
+			},
+		},
+		{
+			uri:         "tbot+auth+terraform-cloud://some-token:tag@example.com:1234",
+			inputConfig: &BotConfig{},
+			expectConfig: &BotConfig{
+				Onboarding: onboarding.Config{
+					TokenValue: "some-token",
+					JoinMethod: types.JoinMethodTerraformCloud,
+					Terraform: onboarding.TerraformOnboardingConfig{
+						AudienceTag: "tag",
+					},
+				},
+				AuthServer: "example.com:1234",
+			},
+		},
+		{
+			uri: "tbot+proxy+token://asdf@example.com:1234",
+			inputConfig: &BotConfig{
+				AuthServer: "example.com",
+			},
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "URI conflicts with configured field: auth_server")
+			},
+		},
+		{
+			uri: "tbot+auth+token://asdf@example.com:1234",
+			inputConfig: &BotConfig{
+				ProxyServer: "example.com",
+			},
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "URI conflicts with configured field: proxy_server")
+			},
+		},
+		{
+			uri: "tbot+auth+bound-keypair://asdf:secret@example.com:1234",
+			inputConfig: &BotConfig{
+				ProxyServer: "example.com",
+				Onboarding: onboarding.Config{
+					TokenValue: "token",
+					JoinMethod: types.JoinMethodBoundKeypair,
+					BoundKeypair: onboarding.BoundKeypairOnboardingConfig{
+						RegistrationSecretValue: "secret2",
+					},
+				},
+			},
+			expectError: func(tt require.TestingT, err error, i ...any) {
+				require.ErrorContains(tt, err, "field: onboarding.token")
+				require.ErrorContains(tt, err, "field: onboarding.bound_keypair.registration_secret")
+				require.ErrorContains(tt, err, "field: proxy_server")
+
+				// Note: join method is already bound_keypair so no error will
+				// be raised for that field.
+				require.NotContains(tt, err.Error(), "field: join_method")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.uri, func(t *testing.T) {
+			parsed, err := ParseJoinURI(tt.uri)
+			require.NoError(t, err)
+
+			err = parsed.ApplyToConfig(tt.inputConfig)
+			if tt.expectError != nil {
+				tt.expectError(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expectConfig, tt.inputConfig)
+			}
+		})
+	}
+}
diff --git a/lib/tbot/identity/generator.go b/lib/tbot/identity/generator.go
new file mode 100644
index 0000000000000..3e65f562636c8
--- /dev/null
+++ b/lib/tbot/identity/generator.go
@@ -0,0 +1,406 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"cmp"
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel"
+	"golang.org/x/crypto/ssh"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/identity")
+
+// GeneratorConfig contains the configuration options for a Generator.
+type GeneratorConfig struct {
+	// Client that will be used to request identity certificates.
+	Client *apiclient.Client
+
+	// Logger to which errors and messages will be written. Can be overridden
+	// on a per-call basis by passing WithLogger.
+	Logger *slog.Logger
+
+	// BotIdentity is a Facade containing the bot's internal identity.
+	BotIdentity *Facade
+
+	// FIPS controls whether FIPS mode is enabled.
+	FIPS bool
+
+	// Insecure controls whether the generated identity TLS config verifies
+	// host certificate authenticity, etc.
+	Insecure bool
+}
+
+// CheckAndSetDefaults checks whether the configuration is valid and sets any
+// default values.
+func (cfg *GeneratorConfig) CheckAndSetDefaults() error {
+	switch {
+	case cfg.Client == nil:
+		return trace.BadParameter("Client is required")
+	case cfg.BotIdentity == nil:
+		return trace.BadParameter("BotIdentity is required")
+	}
+
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+
+	return nil
+}
+
+// NewGenerator creates a new Generator with the given configuration.
+func NewGenerator(cfg GeneratorConfig) (*Generator, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, err
+	}
+	return &Generator{
+		client:      cfg.Client,
+		logger:      cfg.Logger,
+		botIdentity: cfg.BotIdentity,
+		fips:        cfg.FIPS,
+		insecure:    cfg.Insecure,
+	}, nil
+}
+
+// Generator can be used by tbot's services to generate non-renewable identities
+// scoped to the requested roles, TTL, etc.
+type Generator struct {
+	client         *apiclient.Client
+	logger         *slog.Logger
+	botIdentity    *Facade
+	fips, insecure bool
+}
+
+type generateOpts struct {
+	roles                []string
+	ttl, renewalInterval time.Duration
+	currentIdentity      *Identity
+	logger               *slog.Logger
+	requestModifiers     []func(*proto.UserCertsRequest)
+}
+
+// GenerateOption allows you to customize aspects of the generated identity.
+type GenerateOption func(*generateOpts)
+
+// WithRoles sets the roles the generated identity should include.
+//
+// Generally, if the user did not specify any roles, it's best to leave this
+// empty and rely on the default behavior (of fetching all the bot's available
+// roles). If WithCurrentIdentity is provided, we'll default to using the roles
+// in its TLS certificate to avoid re-fetching them.
+func WithRoles(roles []string) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.roles = roles
+	}
+}
+
+// WithLifetime sets the requested time-to-live of the certificate, along with
+// a hint of how frequently it will be renewed - the latter is used for logging
+// purposes only.
+func WithLifetime(ttl, renewalInterval time.Duration) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.ttl = ttl
+		opts.renewalInterval = renewalInterval
+	}
+}
+
+// WithCurrentIdentity sets the identity on which the generated identity will be
+// based. This largely just affects the default roles and cluster name.
+//
+// If you do not provide WithCurrentIdentity, the bot's internal identity will
+// be used. Note: you should *not* explicitly pass the bot's internal identity.
+func WithCurrentIdentity(identity *Identity) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.currentIdentity = identity
+	}
+}
+
+// WithCurrentIdentityFacade is a variant of WithCurrentIdentity which allows
+// you to pass a Facade for convenience.
+func WithCurrentIdentityFacade(facade *Facade) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.currentIdentity = facade.Get()
+	}
+}
+
+// WithLogger allows you to override the logger.
+func WithLogger(logger *slog.Logger) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.logger = logger
+	}
+}
+
+// WithKubernetesCluster sets the KubernetesCluster field on the certificates
+// request.
+func WithKubernetesCluster(name string) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.requestModifiers = append(opts.requestModifiers, func(req *proto.UserCertsRequest) {
+			req.KubernetesCluster = name
+		})
+	}
+}
+
+// WithRouteToApp sets the RouteToApp field on the certificates request.
+func WithRouteToApp(route proto.RouteToApp) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.requestModifiers = append(opts.requestModifiers, func(req *proto.UserCertsRequest) {
+			req.RouteToApp = route
+		})
+	}
+}
+
+// WithRouteToDatabase sets the RouteToDatabase field on the certificates
+// request.
+func WithRouteToDatabase(route proto.RouteToDatabase) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.requestModifiers = append(opts.requestModifiers, func(req *proto.UserCertsRequest) {
+			req.RouteToDatabase = route
+		})
+	}
+}
+
+// WithReissuableRoleImpersonation sets the WithReissuableRoleImpersonation
+// field on the certificates request.
+func WithReissuableRoleImpersonation(allow bool) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.requestModifiers = append(opts.requestModifiers, func(req *proto.UserCertsRequest) {
+			req.ReissuableRoleImpersonation = allow
+		})
+	}
+}
+
+// WithRouteToCluster sets the RouteToCluster field on the certificates request.
+func WithRouteToCluster(cluster string) GenerateOption {
+	return func(opts *generateOpts) {
+		opts.requestModifiers = append(opts.requestModifiers, func(req *proto.UserCertsRequest) {
+			req.RouteToCluster = cluster
+		})
+	}
+}
+
+// GenerateFacade calls Generate and wraps the resulting Identity in a Facade
+// for easy use in API clients, etc.
+func (g *Generator) GenerateFacade(ctx context.Context, opts ...GenerateOption) (*Facade, error) {
+	id, err := g.Generate(ctx, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return NewFacade(g.fips, g.insecure, id), nil
+}
+
+// Generate a non-renewable identity with the given roles, TTL, etc.
+func (g *Generator) Generate(ctx context.Context, opts ...GenerateOption) (*Identity, error) {
+	ctx, span := tracer.Start(ctx, "Generator/Generate")
+	defer span.End()
+
+	o := &generateOpts{}
+	for _, fn := range opts {
+		fn(o)
+	}
+
+	log := cmp.Or(o.logger, g.logger)
+
+	if len(o.roles) == 0 {
+		if o.currentIdentity != nil {
+			// If the caller provided an impersonated identity, take its roles.
+			o.roles = o.currentIdentity.TLSIdentity.Groups
+		} else {
+			// Otherwise, fetch the bot identity's default roles.
+			var err error
+			if o.roles, err = g.botDefaultRoles(ctx); err != nil {
+				return nil, trace.Wrap(err, "fetching default roles")
+			}
+			log.DebugContext(ctx, "No roles configured, using all roles available.", "roles", o.roles)
+		}
+	}
+
+	if o.currentIdentity == nil {
+		o.currentIdentity = g.botIdentity.Get()
+	}
+
+	req := proto.UserCertsRequest{
+		Username:       o.currentIdentity.X509Cert.Subject.CommonName,
+		Expires:        time.Now().Add(o.ttl),
+		RoleRequests:   o.roles,
+		RouteToCluster: o.currentIdentity.ClusterName,
+
+		// Make sure to specify this is an impersonated cert request. If unset,
+		// auth cannot differentiate renewable vs impersonated requests when
+		// len(roleRequests) == 0.
+		UseRoleRequests: true,
+	}
+
+	for _, fn := range o.requestModifiers {
+		fn(&req)
+	}
+
+	keyPurpose := cryptosuites.BotImpersonatedIdentity
+	if req.RouteToDatabase.ServiceName != "" {
+		// We still used RSA for all database clients, all other bot
+		// impersonated identities can use ECDSA.
+		keyPurpose = cryptosuites.DatabaseClient
+	}
+
+	// Generate a fresh keypair for the impersonated identity. We don't care to
+	// reuse keys here, constantly rotate private keys to limit their effective
+	// lifetime.
+	key, err := cryptosuites.GenerateKey(ctx,
+		cryptosuites.GetCurrentSuiteFromAuthPreference(g.client),
+		keyPurpose)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshPub, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	req.SSHPublicKey = ssh.MarshalAuthorizedKey(sshPub)
+
+	req.TLSPublicKey, err = keys.MarshalPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// First, ask the auth server to generate a new set of certs with a new
+	// expiration date.
+	certs, err := g.client.GenerateUserCerts(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// The root CA included with the returned user certs will only contain the
+	// Teleport User CA. We'll also need the host CA for future API calls.
+	localCA, err := g.client.GetClusterCACert(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	caCerts, err := tlsca.ParseCertificatePEMs(localCA.TLSCA)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Append the host CAs from the auth server.
+	for _, cert := range caCerts {
+		pemBytes, err := tlsca.MarshalCertificatePEM(cert)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		certs.TLSCACerts = append(certs.TLSCACerts, pemBytes)
+	}
+
+	// Do not trust SSH CA certs as returned by GenerateUserCerts() with an
+	// impersonated identity. It only returns the SSH UserCA in this context,
+	// but we also need the HostCA and can't directly set `includeHostCA` as
+	// part of the UserCertsRequest.
+	// Instead, copy the SSHCACerts from the primary identity.
+	certs.SSHCACerts = o.currentIdentity.SSHCACertBytes
+
+	privateKeyPEM, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	newIdentity, err := ReadIdentityFromStore(&LoadIdentityParams{
+		PrivateKeyBytes: privateKeyPEM,
+		PublicKeyBytes:  req.SSHPublicKey,
+	}, certs)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	warnOnEarlyExpiration(
+		ctx,
+		log,
+		newIdentity,
+		o.ttl,
+		o.renewalInterval,
+	)
+
+	return newIdentity, nil
+}
+
+func (g *Generator) botDefaultRoles(ctx context.Context) ([]string, error) {
+	role, err := g.client.GetRole(ctx, g.botIdentity.Get().X509Cert.Subject.CommonName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	conditions := role.GetImpersonateConditions(types.Allow)
+	return conditions.Roles, nil
+}
+
+// warnOnEarlyExpiration logs a warning if the given identity is likely to
+// expire problematically early. This can happen if either the configured TTL is
+// less than the renewal interval, or if the server returns certs valid for a
+// shorter-than-expected period of time.
+// This assumes the identity was just renewed, for the purposes of calculating
+// TTLs, and may log false positive warnings if the time delta is large; the
+// time calculations include a 1m buffer to mitigate this.
+func warnOnEarlyExpiration(
+	ctx context.Context,
+	log *slog.Logger,
+	ident *Identity,
+	ttl, renewalInterval time.Duration,
+) {
+	// Calculate a rough TTL, assuming this was called shortly after the
+	// identity was returned. We'll add a minute buffer to compensate and avoid
+	// superfluous warning messages.
+	effectiveTTL := time.Until(ident.TLSIdentity.Expires) + time.Minute
+
+	if effectiveTTL < ttl {
+		l := log.With(
+			"requested_ttl", ttl,
+			"renewal_interval", renewalInterval,
+			"effective_ttl", effectiveTTL,
+			"expires", ident.TLSIdentity.Expires,
+			"roles", ident.TLSIdentity.Groups,
+		)
+
+		// TODO(timothyb89): we can technically fetch our individual roles
+		// without explicit permission, and could determine which role in
+		// particular limited the TTL.
+
+		if effectiveTTL < renewalInterval {
+			//nolint:sloglint // multiline string is actually constant
+			l.WarnContext(ctx, "The server returned an identity shorter than "+
+				"expected and below the configured renewal interval, probably "+
+				"due to a `max_session_ttl` configured on a server-side role. "+
+				"Unless corrected, the credentials will be invalid for some "+
+				"period until renewal.")
+		} else {
+			//nolint:sloglint // multiline string is actually constant
+			l.WarnContext(ctx, "The server returned an identity shorter than "+
+				"the requested TTL, probably due to a `max_session_ttl` "+
+				"configured on a server-side role. It may not remain valid as "+
+				"long as expected.")
+		}
+	}
+}
diff --git a/lib/tbot/identity/identity.go b/lib/tbot/identity/identity.go
index 644d812f89862..a25969b8255f5 100644
--- a/lib/tbot/identity/identity.go
+++ b/lib/tbot/identity/identity.go
@@ -23,16 +23,19 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
+	"log/slog"
 	"strings"
+	"time"
 
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tlsca"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -279,7 +282,7 @@ func parseSSHIdentity(
 // VerifyWrite attempts to write to the .write-test artifact inside the given
 // destination. It should be called before attempting a renewal to help ensure
 // we won't then fail to save the identity.
-func VerifyWrite(ctx context.Context, dest bot.Destination) error {
+func VerifyWrite(ctx context.Context, dest destination.Destination) error {
 	return trace.Wrap(dest.Write(ctx, WriteTestKey, []byte{}))
 }
 
@@ -299,7 +302,7 @@ func ListKeys(kinds ...ArtifactKind) []string {
 }
 
 // SaveIdentity saves a bot identity to a destination.
-func SaveIdentity(ctx context.Context, id *Identity, d bot.Destination, kinds ...ArtifactKind) error {
+func SaveIdentity(ctx context.Context, id *Identity, d destination.Destination, kinds ...ArtifactKind) error {
 	for _, artifact := range GetArtifacts() {
 		// Only store artifacts matching one of the set kinds.
 		if !artifact.Matches(kinds...) {
@@ -318,7 +321,7 @@ func SaveIdentity(ctx context.Context, id *Identity, d bot.Destination, kinds ..
 }
 
 // LoadIdentity loads a bot identity from a destination.
-func LoadIdentity(ctx context.Context, d bot.Destination, kinds ...ArtifactKind) (*Identity, error) {
+func LoadIdentity(ctx context.Context, d destination.Destination, kinds ...ArtifactKind) (*Identity, error) {
 	var certs proto.Certs
 	var params LoadIdentityParams
 
@@ -375,3 +378,50 @@ func LoadIdentity(ctx context.Context, d bot.Destination, kinds ...ArtifactKind)
 
 	return ReadIdentityFromStore(&params, &certs)
 }
+
+// LogValue implements slog.LogValuer.
+func (i *Identity) LogValue() slog.Value {
+	failedToDescribe := slog.StringValue("failed-to-describe")
+
+	cert := i.X509Cert
+	if cert == nil {
+		log.WarnContext(context.TODO(), "Attempted to describe TLS identity without TLS credentials.")
+		return failedToDescribe
+	}
+
+	tlsIdent, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
+	if err != nil {
+		log.WarnContext(context.TODO(), "Bot TLS certificate can not be parsed as an identity", "error", err)
+		return failedToDescribe
+	}
+
+	var principals []string
+	for _, principal := range tlsIdent.Principals {
+		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
+			principals = append(principals, principal)
+		}
+	}
+
+	botDesc := ""
+	if tlsIdent.BotInstanceID != "" {
+		botDesc = fmt.Sprintf(", id=%s", tlsIdent.BotInstanceID)
+	}
+
+	duration := cert.NotAfter.Sub(cert.NotBefore)
+	description := fmt.Sprintf(
+		"%s%s | valid: after=%v, before=%v, duration=%s | kind=tls, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
+		tlsIdent.BotName,
+		botDesc,
+		cert.NotBefore.Format(time.RFC3339),
+		cert.NotAfter.Format(time.RFC3339),
+		duration,
+		tlsIdent.Renewable,
+		tlsIdent.DisallowReissue,
+		tlsIdent.Groups,
+		principals,
+		tlsIdent.Generation,
+	)
+	return slog.StringValue(description)
+}
+
+var _ slog.LogValuer = (*Identity)(nil)
diff --git a/lib/tbot/identity/identity_facade.go b/lib/tbot/identity/identity_facade.go
index 59010840b3a0d..b7a81b446ca70 100644
--- a/lib/tbot/identity/identity_facade.go
+++ b/lib/tbot/identity/identity_facade.go
@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
@@ -212,7 +211,7 @@ func (f *Facade) Expiry() (time.Time, bool) {
 	if len(f.identity.TLSCert.Certificate) == 0 {
 		return time.Time{}, false
 	}
-	cert, _, err := keys.X509Certificate(f.identity.TLSCert.Certificate[0])
+	cert, err := x509.ParseCertificate(f.identity.TLSCert.Certificate[0])
 	if err != nil {
 		return time.Time{}, false
 	}
diff --git a/lib/tbot/identity_test.go b/lib/tbot/identity_test.go
index 544541cf194d6..29fbbbb05bed6 100644
--- a/lib/tbot/identity_test.go
+++ b/lib/tbot/identity_test.go
@@ -28,7 +28,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/identity"
 )
 
@@ -37,7 +37,7 @@ func TestLoadEmptyIdentity(t *testing.T) {
 
 	ctx := context.Background()
 	dir := t.TempDir()
-	dest := config.DestinationDirectory{
+	dest := destination.Directory{
 		Path: dir,
 	}
 	require.NoError(t, dest.CheckAndSetDefaults())
diff --git a/lib/tbot/internal/alpn_proxy_middleware.go b/lib/tbot/internal/alpn_proxy_middleware.go
new file mode 100644
index 0000000000000..8a3f8eae6e55e
--- /dev/null
+++ b/lib/tbot/internal/alpn_proxy_middleware.go
@@ -0,0 +1,46 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/lib/srv/alpnproxy"
+)
+
+var _ alpnproxy.LocalProxyMiddleware = (*ALPNProxyMiddleware)(nil)
+
+type ALPNProxyMiddleware struct {
+	OnNewConnectionFunc func(ctx context.Context, lp *alpnproxy.LocalProxy) error
+	OnStartFunc         func(ctx context.Context, lp *alpnproxy.LocalProxy) error
+}
+
+func (a ALPNProxyMiddleware) OnNewConnection(ctx context.Context, lp *alpnproxy.LocalProxy) error {
+	if a.OnNewConnectionFunc != nil {
+		return a.OnNewConnectionFunc(ctx, lp)
+	}
+	return nil
+}
+
+func (a ALPNProxyMiddleware) OnStart(ctx context.Context, lp *alpnproxy.LocalProxy) error {
+	if a.OnStartFunc != nil {
+		return a.OnStartFunc(ctx, lp)
+	}
+	return nil
+}
diff --git a/lib/tbot/internal/alpn_upgrade_cache.go b/lib/tbot/internal/alpn_upgrade_cache.go
new file mode 100644
index 0000000000000..2044c9592896b
--- /dev/null
+++ b/lib/tbot/internal/alpn_upgrade_cache.go
@@ -0,0 +1,95 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/sync/singleflight"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+)
+
+// NewALPNUpgradeCache creates a new ALPNUpgradeCache with the given logger.
+func NewALPNUpgradeCache(log *slog.Logger) *ALPNUpgradeCache {
+	if log == nil {
+		log = slog.Default()
+	}
+	return &ALPNUpgradeCache{log: log}
+}
+
+// ALPNUpgradeCache can be used to determine whether an ALPN upgrade request is
+// required.
+type ALPNUpgradeCache struct {
+	log *slog.Logger
+
+	mu    sync.Mutex
+	cache map[string]bool
+	group singleflight.Group
+}
+
+// IsUpgradeRequired determines whether an ALPN upgrade request is required and
+// caches the result.
+func (a *ALPNUpgradeCache) IsUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error) {
+	key := fmt.Sprintf("%s-%t", addr, insecure)
+
+	a.mu.Lock()
+	if a.cache == nil {
+		a.cache = make(map[string]bool)
+	}
+	v, ok := a.cache[key]
+	if ok {
+		a.mu.Unlock()
+		return v, nil
+	}
+	a.mu.Unlock()
+
+	val, err, _ := a.group.Do(key, func() (any, error) {
+		// Recheck the cache in case we've just missed a previous group
+		// completing
+		a.mu.Lock()
+		v, ok := a.cache[key]
+		if ok {
+			a.mu.Unlock()
+			return v, nil
+		}
+		a.mu.Unlock()
+
+		// Ok, now we know for sure that the work hasn't already been done or
+		// isn't in flight, we can complete it.
+		a.log.DebugContext(ctx, "Testing ALPN upgrade necessary", "addr", addr, "insecure", insecure)
+		v = apiclient.IsALPNConnUpgradeRequired(ctx, addr, insecure)
+		a.log.DebugContext(ctx, "Tested ALPN upgrade necessary", "addr", addr, "insecure", insecure, "result", v)
+		if err := ctx.Err(); err != nil {
+			// Check for case where false is returned because client canceled ctx.
+			// We don't want to cache this result.
+			return v, trace.Wrap(err)
+		}
+
+		a.mu.Lock()
+		a.cache[key] = v
+		a.mu.Unlock()
+		return v, nil
+	})
+	return val.(bool), err
+}
diff --git a/lib/tbot/internal/caching_proxy_pinger.go b/lib/tbot/internal/caching_proxy_pinger.go
new file mode 100644
index 0000000000000..5942e088e1606
--- /dev/null
+++ b/lib/tbot/internal/caching_proxy_pinger.go
@@ -0,0 +1,122 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/webclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+)
+
+// CachingProxyPingerConfig is the configuration for CachingProxyPinger.
+type CachingProxyPingerConfig struct {
+	Connection connection.Config
+	Client     *client.Client
+	Logger     *slog.Logger
+}
+
+func (cfg *CachingProxyPingerConfig) CheckAndSetDefaults() error {
+	if err := cfg.Connection.Validate(); err != nil {
+		return trace.Wrap(err)
+	}
+	if cfg.Client == nil {
+		return trace.BadParameter("Client is required")
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	return nil
+}
+
+// NewCachingProxyPinger creates a new CachingProxyPinger with the given configuration.
+func NewCachingProxyPinger(cfg CachingProxyPingerConfig) (*CachingProxyPinger, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &CachingProxyPinger{
+		connCfg: cfg.Connection,
+		client:  cfg.Client,
+		logger:  cfg.Logger,
+	}, nil
+}
+
+// CachingProxyPinger pings the proxy server for connection information caches
+// the result indefinitely. If the user has configured an auth server address,
+// it will be pinged via gRPC to get the proxy address.
+type CachingProxyPinger struct {
+	connCfg connection.Config
+	client  *client.Client
+	logger  *slog.Logger
+
+	mu          sync.Mutex
+	cachedValue *connection.ProxyPong
+}
+
+// Ping the proxy for connection information.
+func (c *CachingProxyPinger) Ping(ctx context.Context) (*connection.ProxyPong, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.cachedValue != nil {
+		return c.cachedValue, nil
+	}
+
+	var addr string
+	switch c.connCfg.AddressKind {
+	case connection.AddressKindProxy:
+		// Use the proxy address as-is.
+		addr = c.connCfg.Address
+	case connection.AddressKindAuth:
+		// Ping the auth server to determine the proxy address.
+		authPong, err := c.client.Ping(ctx)
+		if err != nil {
+			c.logger.DebugContext(ctx, "Failed to ping auth server", "error", err)
+			return nil, trace.Wrap(err)
+		}
+		addr = authPong.ProxyPublicAddr
+	default:
+		return nil, trace.BadParameter("unsupported address kind: %v", c.connCfg.AddressKind)
+	}
+
+	c.logger.DebugContext(ctx, "Pinging proxy", "addr", addr)
+	res, err := webclient.Find(&webclient.Config{
+		Context:   ctx,
+		ProxyAddr: addr,
+		Insecure:  c.connCfg.Insecure,
+	})
+	if err != nil {
+		c.logger.ErrorContext(ctx, "Failed to ping proxy", "error", err)
+		return nil, trace.Wrap(err)
+	}
+	c.logger.DebugContext(ctx, "Successfully pinged proxy", "pong", res)
+
+	c.cachedValue = &connection.ProxyPong{PingResponse: res}
+	if c.connCfg.AddressKind == connection.AddressKindProxy && c.connCfg.StaticProxyAddress {
+		c.cachedValue.StaticProxyAddress = addr
+	}
+	return c.cachedValue, nil
+}
+
+var _ connection.ProxyPinger = (*CachingProxyPinger)(nil)
diff --git a/lib/tbot/internal/carotation/service.go b/lib/tbot/internal/carotation/service.go
new file mode 100644
index 0000000000000..4cce58f2aadf2
--- /dev/null
+++ b/lib/tbot/internal/carotation/service.go
@@ -0,0 +1,303 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package carotation
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+const caRotationRetryBackoff = time.Second * 2
+
+// Config contains configuration options for the CA Rotation service.
+type Config struct {
+	// BroadcastFn is a function that will be called to broadcast that a
+	// rotation has taken place.
+	BroadcastFn func()
+
+	// Client that will be used to watch the rotations stream.
+	Client *client.Client
+
+	// GetBotIdentityFn will be called to get the bot's internal identity.
+	GetBotIdentityFn func() *identity.Identity
+
+	// BotIdentityReadyCh is a channel that will be received from to block until
+	// the bot's internal identity has been renewed.
+	BotIdentityReadyCh <-chan struct{}
+
+	// StatusReporter is used to report the service's health.
+	StatusReporter readyz.Reporter
+
+	// Logger to which errors and messages will be written.
+	Logger *slog.Logger
+}
+
+func (cfg *Config) CheckAndSetDefaults() error {
+	if cfg.BroadcastFn == nil {
+		return trace.BadParameter("BroadcastFn is required")
+	}
+	if cfg.Client == nil {
+		return trace.BadParameter("Client is required")
+	}
+	if cfg.GetBotIdentityFn == nil {
+		return trace.BadParameter("GetBotIdentityFn is required")
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	if cfg.StatusReporter == nil {
+		cfg.StatusReporter = readyz.NoopReporter()
+	}
+	return nil
+}
+
+// NewService creates a new CA Rotation service.
+func NewService(cfg Config) (*Service, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Service{cfg: cfg}, nil
+}
+
+// Service watches for CA rotations in the cluster, and triggers a renewal when
+// it detects a relevant CA rotation.
+//
+// See https://github.com/gravitational/teleport/blob/1aa38f4bc56997ba13b26a1ef1b4da7a3a078930/lib/auth/rotate.go#L135
+// for server side details of how a CA rotation takes place.
+//
+// We can leverage the existing renewal system to fetch new certificates and
+// CAs.
+//
+// We need to force a renewal for the following transitions:
+//   - Init -> Update Clients: So we can receive a set of certificates issued by
+//     the new CA, and trust both the old and new CA.
+//   - Update Clients, Update Servers -> Rollback: So we can receive a set of
+//     certificates issued by the old CA, and stop trusting the new CA.
+//   - Update Servers -> Standby: So we can stop trusting the old CA.
+type Service struct {
+	cfg Config
+}
+
+func (s *Service) String() string { return "ca-rotation" }
+
+// Run continually triggers `watchCARotations` until the context is canceled.
+// This allows the watcher to be re-established if an error occurs.
+//
+// Run also manages debouncing the renewals across multiple watch attempts.
+func (s *Service) Run(ctx context.Context) error {
+	rd := debouncer{
+		f:              s.cfg.BroadcastFn,
+		debouncePeriod: time.Second * 10,
+	}
+	jitter := retryutils.DefaultJitter
+
+	if s.cfg.BotIdentityReadyCh != nil {
+		select {
+		case <-s.cfg.BotIdentityReadyCh:
+		default:
+			s.cfg.Logger.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-s.cfg.BotIdentityReadyCh:
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	}
+
+	for {
+		err := s.watchCARotations(ctx, rd.attempt)
+		if ctx.Err() != nil {
+			return nil
+		}
+
+		backoffPeriod := jitter(caRotationRetryBackoff)
+
+		// If the error is due to the client being replaced with a new client
+		// as part of the credentials renewal. Ignore it, and immediately begin
+		// watching again with the new client. We can safely check for Canceled
+		// here, because if the context was actually canceled, it would've
+		// been caught in the error check immediately following watchCARotations
+		var statusErr interface {
+			GRPCStatus() *status.Status
+		}
+		isCancelledErr := errors.As(err, &statusErr) && statusErr.GRPCStatus().Code() == codes.Canceled
+		if isCancelledErr {
+			s.cfg.Logger.DebugContext(ctx, "CA watcher detected client closing. Waiting to rewatch", "wait", backoffPeriod)
+		} else if err != nil {
+			s.cfg.StatusReporter.Report(readyz.Unhealthy)
+			s.cfg.Logger.ErrorContext(ctx, "Error occurred whilst watching CA rotations. Waiting to retry", "wait", backoffPeriod, "error", err)
+		}
+
+		select {
+		case <-ctx.Done():
+			s.cfg.Logger.WarnContext(ctx, "Context canceled during backoff for CA rotation watcher. Aborting")
+			return nil
+		case <-time.After(backoffPeriod):
+		}
+	}
+}
+
+// watchCARotations establishes a watcher for CA rotations in the cluster, and
+// attempts to trigger a renewal via the debounced reload channel when it
+// detects the entry into an important rotation phase.
+func (s *Service) watchCARotations(ctx context.Context, queueReload func()) error {
+	s.cfg.Logger.DebugContext(ctx, "Attempting to establish watch for CA events")
+
+	ident := s.cfg.GetBotIdentityFn()
+	clusterName := ident.ClusterName
+	watcher, err := s.cfg.Client.NewWatcher(ctx, types.Watch{
+		Kinds: []types.WatchKind{{
+			Kind: types.KindCertAuthority,
+			Filter: types.CertAuthorityFilter{
+				types.HostCA:     clusterName,
+				types.UserCA:     clusterName,
+				types.DatabaseCA: clusterName,
+			}.IntoMap(),
+		}},
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer watcher.Close()
+
+	for {
+		select {
+		case event := <-watcher.Events():
+			// OpInit is a special case omitted by the Watcher when the
+			// connection succeeds.
+			if event.Type == types.OpInit {
+				s.cfg.StatusReporter.Report(readyz.Healthy)
+				s.cfg.Logger.InfoContext(ctx, "Started watching for CA rotations")
+				continue
+			}
+
+			ignoreReason := filterCAEvent(ctx, s.cfg.Logger, event, clusterName)
+			if ignoreReason != "" {
+				s.cfg.Logger.DebugContext(ctx, "Ignoring CA event", "reason", ignoreReason)
+				continue
+			}
+
+			// We need to debounce here, as multiple events will be received if
+			// the user is rotating multiple CAs at once.
+			s.cfg.Logger.InfoContext(ctx, "CA Rotation step detected; queueing renewal")
+			queueReload()
+		case <-watcher.Done():
+			if err := watcher.Error(); err != nil {
+				return trace.Wrap(err)
+			}
+			return nil
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+// filterCAEvent returns a reason why an event should be ignored or an empty
+// string is a renewal is needed.
+func filterCAEvent(ctx context.Context, log *slog.Logger, event types.Event, clusterName string) string {
+	if event.Type != types.OpPut {
+		return "type not PUT"
+	}
+	ca, ok := event.Resource.(types.CertAuthority)
+	if !ok {
+		return fmt.Sprintf("event resource was not CertAuthority (%T)", event.Resource)
+	}
+	log.DebugContext(ctx, "Filtering CA", "ca", ca, "ca_kind", ca.GetKind(), "ca_sub_kind", ca.GetSubKind())
+
+	// We want to update for all phases but init and update_servers
+	phase := ca.GetRotation().Phase
+	if slices.Contains([]string{
+		"", types.RotationPhaseInit, types.RotationPhaseUpdateServers,
+	}, phase) {
+		return fmt.Sprintf("skipping due to phase '%s'", phase)
+	}
+
+	// Skip anything not from our cluster
+	if ca.GetClusterName() != clusterName {
+		return fmt.Sprintf(
+			"skipping due to cluster name of CA: was '%s', wanted '%s'",
+			ca.GetClusterName(),
+			clusterName,
+		)
+	}
+
+	// We want to skip anything that is not host, user, or db
+	if !slices.Contains([]string{
+		string(types.HostCA),
+		string(types.UserCA),
+		string(types.DatabaseCA),
+	}, ca.GetSubKind()) {
+		return fmt.Sprintf("skipping due to CA kind '%s'", ca.GetSubKind())
+	}
+
+	return ""
+}
+
+// debouncer accepts a duration, and a function. When `attempt` is called on
+// debouncer, it waits the duration, ignoring further attempts during this
+// period, before calling the provided function.
+//
+// This allows us to handle multiple events arriving within a short period, and
+// attempts to reduce the risk of the server going away during a renewal by
+// deferring the renewal until after the server-side elements of the rotation
+// have occurred.
+type debouncer struct {
+	mu    sync.Mutex
+	timer *time.Timer
+
+	// debouncePeriod is the amount of time that debouncer should wait from an
+	// initial trigger before triggering `f`, and in that time ignore further
+	// attempts.
+	debouncePeriod time.Duration
+
+	// f is the function that should be called by the debouncer.
+	f func()
+}
+
+func (rd *debouncer) attempt() {
+	rd.mu.Lock()
+	defer rd.mu.Unlock()
+
+	if rd.timer != nil {
+		return
+	}
+
+	rd.timer = time.AfterFunc(rd.debouncePeriod, func() {
+		rd.mu.Lock()
+		defer rd.mu.Unlock()
+		rd.timer = nil
+
+		rd.f()
+	})
+}
diff --git a/lib/tbot/internal/carotation/service_test.go b/lib/tbot/internal/carotation/service_test.go
new file mode 100644
index 0000000000000..f44d7c7394e32
--- /dev/null
+++ b/lib/tbot/internal/carotation/service_test.go
@@ -0,0 +1,144 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package carotation
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+func Test_filterCAEvent(t *testing.T) {
+	clusterName := "example.com"
+	createCertAuthority := func(t *testing.T, modifier func(spec *types.CertAuthoritySpecV2)) types.CertAuthority {
+		t.Helper()
+		validSpec := types.CertAuthoritySpecV2{
+			ClusterName: clusterName,
+			Type:        "host",
+			Rotation: &types.Rotation{
+				Phase: "update_clients",
+			},
+		}
+
+		if modifier != nil {
+			modifier(&validSpec)
+		}
+
+		ca, err := types.NewCertAuthority(validSpec)
+		require.NoError(t, err)
+		return ca
+	}
+
+	tests := []struct {
+		name                 string
+		event                types.Event
+		expectedIgnoreReason string
+	}{
+		{
+			name: "valid host CA rotation",
+			event: types.Event{
+				Type:     types.OpPut,
+				Resource: createCertAuthority(t, nil),
+			},
+		},
+		{
+			name: "valid user CA rotation",
+			event: types.Event{
+				Type: types.OpPut,
+				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
+					spec.Type = "user"
+				}),
+			},
+		},
+		{
+			name: "valid DB CA rotation",
+			event: types.Event{
+				Type: types.OpPut,
+				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
+					spec.Type = "db"
+				}),
+			},
+		},
+		{
+			name: "wrong type",
+			event: types.Event{
+				Type:     types.OpDelete,
+				Resource: createCertAuthority(t, nil),
+			},
+			expectedIgnoreReason: "type not PUT",
+		},
+		{
+			name: "wrong underlying resource",
+			event: types.Event{
+				Type:     types.OpPut,
+				Resource: &types.Namespace{},
+			},
+			expectedIgnoreReason: "event resource was not CertAuthority (*types.Namespace)",
+		},
+		{
+			name: "wrong phase",
+			event: types.Event{
+				Type: types.OpPut,
+				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
+					spec.Rotation.Phase = "init"
+				}),
+			},
+			expectedIgnoreReason: "skipping due to phase 'init'",
+		},
+		{
+			name: "wrong cluster name",
+			event: types.Event{
+				Type: types.OpPut,
+				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
+					spec.ClusterName = "wrong"
+				}),
+			},
+			expectedIgnoreReason: "skipping due to cluster name of CA: was 'wrong', wanted 'example.com'",
+		},
+		{
+			name: "wrong CA type",
+			event: types.Event{
+				Type: types.OpPut,
+				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
+					spec.Type = "jwt"
+				}),
+			},
+			expectedIgnoreReason: "skipping due to CA kind 'jwt'",
+		},
+	}
+
+	ctx := context.Background()
+	log := logtest.NewLogger()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ignoreReason := filterCAEvent(ctx, log, tt.event, clusterName)
+			require.Equal(t, tt.expectedIgnoreReason, ignoreReason)
+		})
+	}
+}
diff --git a/lib/tbot/internal/channel_broadcaster.go b/lib/tbot/internal/channel_broadcaster.go
new file mode 100644
index 0000000000000..aded3dfe8b895
--- /dev/null
+++ b/lib/tbot/internal/channel_broadcaster.go
@@ -0,0 +1,71 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import "sync"
+
+// NewChannelBroadcaster creates a ChannelBroadcaster.
+func NewChannelBroadcaster() *ChannelBroadcaster {
+	return &ChannelBroadcaster{
+		chanSet: map[chan struct{}]struct{}{},
+	}
+}
+
+// ChannelBroadcaster implements a simple pub/sub system for notifying services
+// of an event (e.g. a CA rotation).
+type ChannelBroadcaster struct {
+	mu      sync.Mutex
+	chanSet map[chan struct{}]struct{}
+}
+
+// Subscribe returns a channel you can receive events from. You must call the
+// unsubscribe function to free resources when you no longer want to receive
+// notifications.
+func (cb *ChannelBroadcaster) Subscribe() (<-chan struct{}, func()) {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+
+	ch := make(chan struct{}, 1)
+	cb.chanSet[ch] = struct{}{}
+
+	// Returns a function that should be called to unsubscribe the channel
+	return ch, func() {
+		cb.mu.Lock()
+		defer cb.mu.Unlock()
+		_, ok := cb.chanSet[ch]
+		if ok {
+			delete(cb.chanSet, ch)
+			close(ch)
+		}
+	}
+}
+
+// Broadcast a notification to all subscribers.
+func (cb *ChannelBroadcaster) Broadcast() {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+	for ch := range cb.chanSet {
+		select {
+		case ch <- struct{}{}:
+			// Successfully sent notification
+		default:
+			// Channel already has valued queued
+		}
+	}
+}
diff --git a/lib/tbot/internal/channel_broadcaster_test.go b/lib/tbot/internal/channel_broadcaster_test.go
new file mode 100644
index 0000000000000..73c2301cd51b8
--- /dev/null
+++ b/lib/tbot/internal/channel_broadcaster_test.go
@@ -0,0 +1,58 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/internal"
+)
+
+func TestChannelBroadcaster(t *testing.T) {
+	cb := internal.NewChannelBroadcaster()
+	sub1, unsubscribe1 := cb.Subscribe()
+	t.Cleanup(unsubscribe1)
+	sub2, unsubscribe2 := cb.Subscribe()
+	t.Cleanup(unsubscribe2)
+
+	cb.Broadcast()
+	require.NotEmpty(t, sub1)
+	require.NotEmpty(t, sub2)
+
+	// remove value from sub1 to check that if sub2 is full broadcasting still
+	// works
+	<-sub1
+	cb.Broadcast()
+	require.NotEmpty(t, sub1)
+
+	// empty out both channels and ensure unsubscribing means they no longer
+	// receive values
+	<-sub1
+	<-sub2
+	unsubscribe1()
+	unsubscribe2()
+	cb.Broadcast()
+	require.Empty(t, sub1)
+	require.Empty(t, sub2)
+
+	// ensure unsubscribing twice doesn't cause panic
+	unsubscribe1()
+}
diff --git a/lib/tbot/internal/constants.go b/lib/tbot/internal/constants.go
new file mode 100644
index 0000000000000..8c8c0ca8574ca
--- /dev/null
+++ b/lib/tbot/internal/constants.go
@@ -0,0 +1,60 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+const (
+	// HostCAPath is the default filename for the host CA certificate
+	HostCAPath = "teleport-host-ca.crt"
+
+	// UserCAPath is the default filename for the user CA certificate
+	UserCAPath = "teleport-user-ca.crt"
+
+	// DatabaseCAPath is the default filename for the database CA
+	// certificate
+	DatabaseCAPath = "teleport-database-ca.crt"
+
+	// JWTSVIDPath is the name of the artifact that a JWT SVID will be written to.
+	JWTSVIDPath = "jwt_svid"
+
+	// IdentityFilePath is the name of the artifact that the identity will be written to.
+	IdentityFilePath = "identity"
+
+	// DefaultTLSPrefix is the default prefix in generated TLS certs.
+	DefaultTLSPrefix = "tls"
+
+	// RenewalRetryLimit is the number of permissible consecutive
+	// failures in renewing credentials before the loop exits fatally.
+	RenewalRetryLimit = 5
+)
+
+// Based on the default paths listed in
+// https://github.com/spiffe/spiffe-helper/blob/main/README.md
+const (
+	SVIDPEMPath            = "svid.pem"
+	SVIDKeyPEMPath         = "svid_key.pem"
+	SVIDTrustBundlePEMPath = "svid_bundle.pem"
+	SVIDCRLPemPath         = "svid_crl.pem"
+)
+
+const (
+	// PEMBlockTypePrivateKey is the PEM block type for a PKCS 8 encoded private key.
+	PEMBlockTypePrivateKey = "PRIVATE KEY"
+	// PEMBlockTypeCertificate is the PEM block type for a DER encoded certificate.
+	PEMBlockTypeCertificate = "CERTIFICATE"
+)
diff --git a/lib/tbot/internal/destination.go b/lib/tbot/internal/destination.go
new file mode 100644
index 0000000000000..2e19982f18bd8
--- /dev/null
+++ b/lib/tbot/internal/destination.go
@@ -0,0 +1,137 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"io"
+	"slices"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+// UnmarshalConfigContext is passed to the UnmarshalConfig method implemented by
+// service config structs. It provides a way to unmarshal fields that may be
+// dynamically registered (like the Kubernetes Secret Destination, which is only
+// available if you import the k8s package) without maintaining a global registry.
+type UnmarshalConfigContext interface {
+	DestinationUnmarshaler
+}
+
+// DefaultDestinationUnmarshaler implements the DestinationUnmarshaler interface
+// using only the built-in destinations (Memory and Directory). Other destinations
+// with heavy dependencies (e.g. Kubernetes Secrets) must be handled in the outer
+// tbot/config package to avoid bloat for consumers of the bot package.
+//
+// It's separate from the tbot/config package's implementation so that it can
+// be used in service tests.
+type DefaultDestinationUnmarshaler struct{}
+
+// UnmarshalDestination implements DestinationUnmarshaler.
+func (DefaultDestinationUnmarshaler) UnmarshalDestination(node *yaml.Node) (destination.Destination, error) {
+	header := struct {
+		Type string `yaml:"type"`
+	}{}
+	if err := node.Decode(&header); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	switch header.Type {
+	case destination.MemoryType:
+		v := &destination.Memory{}
+		if err := node.Decode(v); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return v, nil
+	case destination.DirectoryType:
+		v := &destination.Directory{}
+		if err := node.Decode(v); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return v, nil
+	default:
+		return nil, trace.BadParameter("unrecognized destination type (%s)", header.Type)
+	}
+}
+
+type DestinationUnmarshaler interface {
+	UnmarshalDestination(node *yaml.Node) (destination.Destination, error)
+}
+
+// ExtractOutputDestination performs surgery on yaml.Node to unmarshal a
+// destination and then remove key/values from the yaml.Node that specify
+// the destination. This *hack* allows us to have the destination.Destination
+// as a field directly on an Output without needing a struct to wrap it for
+// polymorphic unmarshaling.
+//
+// If there's no destination in the provided yaml node, then this will return
+// nil, nil.
+func ExtractOutputDestination(unmarshaler DestinationUnmarshaler, node *yaml.Node) (destination.Destination, error) {
+	for i, subNode := range node.Content {
+		if subNode.Value == "destination" {
+			// Next node will be the contents
+			dest, err := unmarshaler.UnmarshalDestination(node.Content[i+1])
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			// Remove key and contents from root node
+			node.Content = slices.Delete(node.Content, i, i+2)
+			return dest, nil
+		}
+	}
+	return nil, nil
+}
+
+// UnmarshalYAMLConfig is a convenience method for unmarshaling YAML into a
+// config struct of type T. If *T implements the UnmarshalConfig method, it
+// will be called with the DefaultDestinationUnmarshaler - otherwise it will
+// be unmarshaled with UnmarshalYAML (or the default unmarshaling).
+//
+// It is mainly intended for use in tests.
+func UnmarshalYAMLConfig[T any](reader io.Reader) (*T, error) {
+	decoder := yaml.NewDecoder(reader)
+
+	var (
+		target    T
+		targetPtr any = &target
+		err       error
+	)
+	if cu, ok := targetPtr.(configUnmarshaler); ok {
+		err = decoder.Decode(&unmarshalConfigWrapper{cu})
+	} else {
+		err = decoder.Decode(&target)
+	}
+
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &target, nil
+}
+
+type configUnmarshaler interface {
+	UnmarshalConfig(UnmarshalConfigContext, *yaml.Node) error
+}
+
+type unmarshalConfigWrapper struct{ unmarshaler configUnmarshaler }
+
+func (w *unmarshalConfigWrapper) UnmarshalYAML(node *yaml.Node) error {
+	return w.unmarshaler.UnmarshalConfig(DefaultDestinationUnmarshaler{}, node)
+}
diff --git a/lib/tbot/internal/diagnostics/service.go b/lib/tbot/internal/diagnostics/service.go
new file mode 100644
index 0000000000000..2529a75965406
--- /dev/null
+++ b/lib/tbot/internal/diagnostics/service.go
@@ -0,0 +1,170 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package diagnostics
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/pprof"
+	"os"
+
+	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+// ServiceBuilder returns a builder for the diagnostics service.
+func ServiceBuilder(cfg Config) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		return NewService(cfg, deps.StatusRegistry)
+	}
+	return bot.NewServiceBuilder("internal/diagnostics", "diagnostics", buildFn)
+}
+
+// Config contains configuration for the diagnostics service.
+type Config struct {
+	Address      string
+	Network      string
+	PProfEnabled bool
+	Logger       *slog.Logger
+}
+
+func (cfg *Config) CheckAndSetDefaults() error {
+	if cfg.Address == "" {
+		return trace.BadParameter("Address is required")
+	}
+	if cfg.Network == "" {
+		cfg.Network = "tcp"
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	return nil
+}
+
+// NewService creates a new diagnostics service.
+func NewService(cfg Config, registry readyz.ReadOnlyRegistry) (*Service, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if registry == nil {
+		return nil, trace.BadParameter("registry is required")
+	}
+	return &Service{
+		log:            cfg.Logger,
+		diagAddr:       cfg.Address,
+		diagNetwork:    cfg.Network,
+		pprofEnabled:   cfg.PProfEnabled,
+		statusRegistry: registry,
+	}, nil
+}
+
+// Service is a [bot.Service] that exposes diagnostics endpoints. It's only
+// started when a --diag-addr is provided.
+type Service struct {
+	log            *slog.Logger
+	diagAddr       string
+	diagNetwork    string
+	pprofEnabled   bool
+	statusRegistry readyz.ReadOnlyRegistry
+}
+
+func (s *Service) String() string {
+	return "diagnostics"
+}
+
+func (s *Service) Run(ctx context.Context) error {
+	s.log.InfoContext(
+		ctx,
+		"diagnostics service will be starting",
+		"addr", s.diagAddr,
+	)
+	mux := http.NewServeMux()
+	mux.Handle("/metrics", promhttp.Handler())
+	// Only expose pprof when `-d` is provided.
+	if s.pprofEnabled {
+		s.log.InfoContext(ctx, "debug mode enabled, profiling endpoints will be served on the diagnostics service.")
+		mux.HandleFunc("/debug/pprof/", pprof.Index)
+		mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+		mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+		mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+		mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	}
+	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		msg := "404 - Not Found\n\nI'm a little tbot,\nshort and stout,\nthe page you seek,\nis not about.\n\nYou can find out more information about the diagnostics service at https://goteleport.com/docs/reference/machine-id/diagnostics-service/"
+		_, _ = w.Write([]byte(msg))
+	}))
+	mux.Handle("/livez", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("OK"))
+	}))
+	mux.Handle("/readyz", readyz.HTTPHandler(s.statusRegistry))
+	mux.Handle("/readyz/", readyz.HTTPHandler(s.statusRegistry))
+	srv := http.Server{
+		Addr:              s.diagAddr,
+		Handler:           mux,
+		ReadTimeout:       apidefaults.DefaultIOTimeout,
+		ReadHeaderTimeout: defaults.ReadHeadersTimeout,
+		WriteTimeout:      apidefaults.DefaultIOTimeout,
+		IdleTimeout:       apidefaults.DefaultIdleTimeout,
+	}
+	go func() {
+		<-ctx.Done()
+		if err := srv.Close(); err != nil {
+			s.log.WarnContext(ctx, "Failed to close HTTP server", "error", err)
+		}
+	}()
+
+	// When the process exits, the socket files are left behind (to cover
+	// forking scenarios). To guarantee there won't be errors like "address
+	// already in use", delete the file before starting the listener.
+	if s.diagNetwork == "unix" {
+		s.log.DebugContext(ctx, "Cleaning up socket file", "path", s.diagAddr)
+		if err := trace.ConvertSystemError(os.Remove(s.diagAddr)); err != nil && !trace.IsNotFound(err) {
+			s.log.WarnContext(ctx, "Failed to cleanup existing socket file", "error", err)
+		}
+	}
+
+	listener, err := net.Listen(s.diagNetwork, s.diagAddr)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// The default behavior for unix listeners is to delete the file when the
+	// listener closes (unlinking). However, if the process forks, the file
+	// descriptor will be gone when its parent process exits, causing the new
+	// listener to have no socket file.
+	if unixListener, ok := listener.(*net.UnixListener); ok {
+		unixListener.SetUnlinkOnClose(false)
+	}
+
+	if err := srv.Serve(listener); !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+
+	return nil
+}
diff --git a/lib/tbot/internal/encoding/type_header.go b/lib/tbot/internal/encoding/type_header.go
new file mode 100644
index 0000000000000..16363d2d5874e
--- /dev/null
+++ b/lib/tbot/internal/encoding/type_header.go
@@ -0,0 +1,31 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package encoding
+
+// WithTypeHeader wraps the given T to add a type header for YAML serialization.
+func WithTypeHeader[T any](payload T, payloadType string) (any, error) {
+	header := struct {
+		Type    string `yaml:"type"`
+		Payload T      `yaml:",inline"`
+	}{
+		Type:    payloadType,
+		Payload: payload,
+	}
+	return header, nil
+}
diff --git a/lib/tbot/internal/heartbeat/service.go b/lib/tbot/internal/heartbeat/service.go
new file mode 100644
index 0000000000000..936065c0f41a7
--- /dev/null
+++ b/lib/tbot/internal/heartbeat/service.go
@@ -0,0 +1,300 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package heartbeat
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"runtime"
+	"sort"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+const (
+	// Maximum amount of time we'll wait for services to report their initial
+	// status before sending the first heartbeat.
+	serviceHealthMaxWait = 30 * time.Second
+
+	// Maximum amount of time the one-shot heartbeat can take once the bot has
+	// started shutting down.
+	shutdownHeartbeatTimeout = 5 * time.Second
+)
+
+// Client for the heartbeat service.
+type Client interface {
+	SubmitHeartbeat(
+		ctx context.Context, in *machineidv1pb.SubmitHeartbeatRequest, opts ...grpc.CallOption,
+	) (*machineidv1pb.SubmitHeartbeatResponse, error)
+}
+
+// Config for the heartbeat service.
+type Config struct {
+	// BotKind identifies whether the bot is running in the tbot binary or
+	// embedded in another component
+	BotKind machineidv1pb.BotKind
+
+	// Interval controls how frequently heartbeats are submitted.
+	Interval time.Duration
+
+	// RetryLimit is the maximum number of times we'll retry sending a heartbeat.
+	RetryLimit int
+
+	// Client that will be used to submit heartbeats.
+	Client Client
+
+	// Logger to which errors and messages will be written.
+	Logger *slog.Logger
+
+	// JoinMethod is the bot join method that will be reported.
+	JoinMethod types.JoinMethod
+
+	// StartedAt is the time at which the bot was started.
+	StartedAt time.Time
+
+	// BotIdentityReadyCh is a channel that the service will receive from to
+	// block until the bot's internal identity is ready.
+	BotIdentityReadyCh <-chan struct{}
+
+	// StatusReporter is used to report the service's health.
+	StatusReporter readyz.Reporter
+
+	// StatusRegistry is used to fetch the current service statuses when
+	// submitting a heartbeat.
+	StatusRegistry *readyz.Registry
+}
+
+// CheckAndSetDefaults checks the service configuration and sets any default values.
+func (cfg *Config) CheckAndSetDefaults() error {
+	switch {
+	case cfg.Interval == 0:
+		return trace.BadParameter("Interval is required")
+	case cfg.RetryLimit == 0:
+		return trace.BadParameter("RetryLimit is required")
+	case cfg.Client == nil:
+		return trace.BadParameter("Client is required")
+	case cfg.JoinMethod == "":
+		return trace.BadParameter("JoinMethod is required")
+	case cfg.StatusRegistry == nil:
+		return trace.BadParameter("StatusRegistry is required")
+	}
+	if cfg.StartedAt.IsZero() {
+		cfg.StartedAt = time.Now()
+	}
+	return nil
+}
+
+// NewService creates the heartbeat service.
+func NewService(cfg Config) (*Service, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Service{cfg: cfg}, nil
+}
+
+// Service implements bot heartbeating.
+type Service struct{ cfg Config }
+
+// Run the service in long-running mode, submitting heartbeats periodically.
+func (s *Service) Run(ctx context.Context) error {
+	// Wait for service health before sending our first heartbeat. Otherwise, we
+	// might report all services as "initializing" for the first ~30 minutes our
+	// bot is running.
+	if shuttingDown := s.waitForServiceHealth(ctx); shuttingDown {
+		return nil
+	}
+
+	isStartup := true
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:    s.String(),
+		Name:       "submit-heartbeat",
+		Log:        s.cfg.Logger,
+		Interval:   s.cfg.Interval,
+		RetryLimit: s.cfg.RetryLimit,
+		F: func(ctx context.Context) error {
+			err := s.heartbeat(ctx, false, isStartup)
+			// TODO(noah): Remove NotImplemented check at V18 assuming V17 first
+			// major with heartbeating.
+			if trace.IsNotImplemented(err) {
+				s.cfg.Logger.DebugContext(
+					ctx,
+					"Cluster does not support Bot Instance heartbeats",
+				)
+				return nil
+			}
+			if err != nil {
+				return trace.Wrap(err, "submitting heartbeat")
+			}
+			isStartup = false
+			return nil
+		},
+		IdentityReadyCh: s.cfg.BotIdentityReadyCh,
+		StatusReporter:  s.cfg.StatusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+// OneShot submits one heartbeat and then exits.
+func (s *Service) OneShot(ctx context.Context) error {
+	// Wait for services to report their health before sending the heartbeat.
+	shuttingDown := s.waitForServiceHealth(ctx)
+
+	if shuttingDown {
+		// If the outer context has been canceled (likely because another
+		// service has return an error) we'll create a new one detached from
+		// the cancellation to try to send the heartbeat.
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(
+			context.WithoutCancel(ctx),
+			shutdownHeartbeatTimeout,
+		)
+		defer cancel()
+	}
+
+	err := s.heartbeat(ctx, true, true)
+	// Ignore not implemented as this is likely confusing.
+	// TODO(noah): Remove NotImplemented check at V18 assuming V17 first major
+	// with heartbeating.
+	if err != nil && !trace.IsNotImplemented(err) {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// String implements fmt.Stringer.
+func (s *Service) String() string { return "heartbeat" }
+
+func (s *Service) waitForServiceHealth(ctx context.Context) (shuttingDown bool) {
+	// We must report our own status to avoid blocking ourselves!
+	s.cfg.StatusReporter.Report(readyz.Healthy)
+
+	select {
+	case <-s.cfg.StatusRegistry.AllServicesReported():
+		// All services have reported their status, we're ready!
+		return false
+	case <-time.After(serviceHealthMaxWait):
+		// It's taking too long, give up and start sending heartbeats.
+		return false
+	case <-ctx.Done():
+		// The outer context has been canceled (e.g. another service has exited
+		// or the process has received SIGINT).
+		return true
+	}
+}
+
+func (s *Service) heartbeat(ctx context.Context, isOneShot, isStartup bool) error {
+	s.cfg.Logger.DebugContext(ctx, "Sending heartbeat")
+	hostName, err := os.Hostname()
+	if err != nil {
+		s.cfg.Logger.WarnContext(ctx, "Failed to determine hostname for heartbeat", "error", err)
+	}
+
+	now := time.Now()
+	hb := &machineidv1pb.BotInstanceStatusHeartbeat{
+		RecordedAt:   timestamppb.New(now),
+		Hostname:     hostName,
+		IsStartup:    isStartup,
+		Uptime:       durationpb.New(now.Sub(s.cfg.StartedAt)),
+		OneShot:      isOneShot,
+		JoinMethod:   string(s.cfg.JoinMethod),
+		Version:      teleport.Version,
+		Architecture: runtime.GOARCH,
+		Os:           runtime.GOOS,
+		Kind:         s.cfg.BotKind,
+	}
+
+	status := s.cfg.StatusRegistry.OverallStatus()
+	serviceHealth := make([]*machineidv1pb.BotInstanceServiceHealth, 0, len(status.Services))
+	for name, serviceStatus := range status.Services {
+		serviceHealth = append(serviceHealth, statusToServiceHealth(name, serviceStatus))
+	}
+
+	// Sort the services by name to make tests deterministic.
+	sort.Slice(serviceHealth, func(a, b int) bool {
+		return serviceHealth[a].Service.Name < serviceHealth[b].Service.Name
+	})
+
+	_, err = s.cfg.Client.SubmitHeartbeat(ctx, &machineidv1pb.SubmitHeartbeatRequest{
+		Heartbeat:     hb,
+		ServiceHealth: serviceHealth,
+	})
+	if err != nil {
+		return trace.Wrap(err, "submitting heartbeat")
+	}
+
+	s.cfg.Logger.InfoContext(ctx, "Sent heartbeat", "data", hb.String())
+	return nil
+}
+
+func statusToServiceHealth(name string, status *readyz.ServiceStatus) *machineidv1pb.BotInstanceServiceHealth {
+	health := &machineidv1pb.BotInstanceServiceHealth{
+		Service: &machineidv1pb.BotInstanceServiceIdentifier{
+			Name: trimString(name, 64),
+			Type: status.ServiceType,
+		},
+	}
+
+	switch status.Status {
+	case readyz.Initializing:
+		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+	case readyz.Healthy:
+		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+	case readyz.Unhealthy:
+		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+	}
+
+	if status.Reason != "" {
+		reason := trimString(status.Reason, 256)
+		health.Reason = &reason
+	}
+
+	if status.UpdatedAt != nil {
+		health.UpdatedAt = timestamppb.New(*status.UpdatedAt)
+	}
+
+	return health
+}
+
+func trimString(s string, maxBytes int) string {
+	if len(s) <= maxBytes {
+		return s
+	}
+
+	// Trim the string to maxBytes, honoring rune boundaries for non-ASCII text.
+	byteCount := 0
+	for i, r := range s {
+		runeSize := len(string(r))
+		if byteCount+runeSize > maxBytes {
+			return s[:i]
+		}
+		byteCount += runeSize
+	}
+	return s
+}
diff --git a/lib/tbot/internal/heartbeat/service_test.go b/lib/tbot/internal/heartbeat/service_test.go
new file mode 100644
index 0000000000000..1f758cb244e54
--- /dev/null
+++ b/lib/tbot/internal/heartbeat/service_test.go
@@ -0,0 +1,188 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package heartbeat
+
+import (
+	"context"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type fakeHeartbeatSubmitter struct {
+	ch chan *machineidv1pb.SubmitHeartbeatRequest
+}
+
+func (f *fakeHeartbeatSubmitter) SubmitHeartbeat(
+	ctx context.Context, in *machineidv1pb.SubmitHeartbeatRequest, opts ...grpc.CallOption,
+) (*machineidv1pb.SubmitHeartbeatResponse, error) {
+	f.ch <- in
+	return &machineidv1pb.SubmitHeartbeatResponse{}, nil
+}
+
+func TestHeartbeatService(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		log := logtest.NewLogger()
+		ctx, cancel := context.WithCancel(t.Context())
+		t.Cleanup(cancel)
+
+		fhs := &fakeHeartbeatSubmitter{
+			ch: make(chan *machineidv1pb.SubmitHeartbeatRequest, 2),
+		}
+
+		reg := readyz.NewRegistry()
+
+		svcA := reg.AddService("a", "a")
+		svcB := reg.AddService("b", strings.Repeat("b", 200))
+
+		svc, err := NewService(Config{
+			Interval:       time.Second,
+			RetryLimit:     3,
+			Client:         fhs,
+			StartedAt:      time.Now().Add(-1 * time.Hour),
+			Logger:         log,
+			JoinMethod:     types.JoinMethodGitHub,
+			StatusReporter: reg.AddService("internal/heartbeat", "heartbeat"),
+			StatusRegistry: reg,
+			BotKind:        machineidv1pb.BotKind_BOT_KIND_TBOT,
+		})
+		require.NoError(t, err)
+
+		hostName, err := os.Hostname()
+		require.NoError(t, err)
+
+		errCh := make(chan error, 1)
+		go func() {
+			errCh <- svc.Run(ctx)
+		}()
+
+		synctest.Wait()
+		select {
+		case <-fhs.ch:
+			t.Fatal("should not have received a heartbeat until all services have reported their status")
+		default:
+		}
+
+		svcA.ReportReason(readyz.Unhealthy, "no more bananas")
+		svcB.ReportReason(readyz.Unhealthy, strings.Repeat("b", 300))
+
+		want := &machineidv1pb.SubmitHeartbeatRequest{
+			Heartbeat: &machineidv1pb.BotInstanceStatusHeartbeat{
+				Hostname:     hostName,
+				IsStartup:    true,
+				OneShot:      false,
+				Uptime:       durationpb.New(time.Hour),
+				Version:      teleport.Version,
+				Architecture: runtime.GOARCH,
+				Os:           runtime.GOOS,
+				JoinMethod:   string(types.JoinMethodGitHub),
+				Kind:         machineidv1pb.BotKind_BOT_KIND_TBOT,
+			},
+			ServiceHealth: []*machineidv1pb.BotInstanceServiceHealth{
+				{
+					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+						Name: "a",
+						Type: "a",
+					},
+					Reason:    ptr("no more bananas"),
+					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+					UpdatedAt: timestamppb.New(time.Now()),
+				},
+				// Check limits were applied on user-controlled or dynamic fields.
+				{
+					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+						Name: strings.Repeat("b", 64),
+						Type: "b",
+					},
+					Reason:    ptr(strings.Repeat("b", 256)),
+					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+					UpdatedAt: timestamppb.New(time.Now()),
+				},
+				{
+					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+						Name: "heartbeat",
+						Type: "internal/heartbeat",
+					},
+					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
+					UpdatedAt: timestamppb.New(time.Now()),
+				},
+			},
+		}
+
+		compare := func(t *testing.T, want, got *machineidv1pb.SubmitHeartbeatRequest) {
+			t.Helper()
+
+			assert.Empty(t,
+				cmp.Diff(want, got,
+					protocmp.Transform(),
+					protocmp.IgnoreFields(&machineidv1pb.BotInstanceStatusHeartbeat{}, "recorded_at"),
+				),
+			)
+		}
+
+		synctest.Wait()
+		select {
+		case got := <-fhs.ch:
+			compare(t, want, got)
+		default:
+			t.Fatal("no heartbeat received")
+		}
+
+		time.Sleep(1 * time.Second)
+		synctest.Wait()
+
+		select {
+		case got := <-fhs.ch:
+			want.Heartbeat.IsStartup = false
+			want.Heartbeat.Uptime = durationpb.New(time.Hour + time.Second)
+			compare(t, want, got)
+		default:
+			t.Fatal("no heartbeat received")
+		}
+
+		cancel()
+		assert.NoError(t, <-errCh)
+	})
+}
+
+func ptr[T any](v T) *T { return &v }
diff --git a/lib/tbot/internal/identity/service.go b/lib/tbot/internal/identity/service.go
new file mode 100644
index 0000000000000..f6c4de42d08b3
--- /dev/null
+++ b/lib/tbot/internal/identity/service.go
@@ -0,0 +1,812 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"log/slog"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth/join/boundkeypair"
+	"github.com/gravitational/teleport/lib/auth/state"
+	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/join/joinclient"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/internal/identity")
+
+// Config contains configuration and dependencies for the bot identity service.
+type Config struct {
+	Connection  connection.Config
+	Onboarding  onboarding.Config
+	Destination destination.Destination
+
+	TTL             time.Duration
+	RenewalInterval time.Duration
+
+	FIPS bool
+
+	Logger         *slog.Logger
+	ReloadCh       <-chan struct{}
+	ClientBuilder  *client.Builder
+	StatusReporter readyz.Reporter
+}
+
+func (cfg *Config) CheckAndSetDefaults() error {
+	if err := cfg.Connection.Validate(); err != nil {
+		return trace.Wrap(err)
+	}
+	if cfg.TTL <= 0 {
+		return trace.BadParameter("TTL is required")
+	}
+	if cfg.RenewalInterval <= 0 {
+		return trace.BadParameter("RenewalInterval is required")
+	}
+	if cfg.ClientBuilder == nil {
+		return trace.BadParameter("ClientBuilder is required")
+	}
+	if cfg.Destination == nil {
+		cfg.Destination = destination.NewMemory()
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	if cfg.StatusReporter == nil {
+		cfg.StatusReporter = readyz.NoopReporter()
+	}
+	return nil
+}
+
+// NewService creates a new bot identity service.
+func NewService(cfg Config) (*Service, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &Service{
+		cfg:           cfg,
+		log:           cfg.Logger,
+		clientBuilder: cfg.ClientBuilder,
+	}, nil
+}
+
+// botIdentityRenewalRetryLimit is the number of permissible consecutive
+// failures in renewing the bot identity before the loop exits fatally.
+const botIdentityRenewalRetryLimit = 7
+
+// Service is a [bot.Service] that handles renewing the bot's identity.
+// It renews the bot's identity periodically and when receiving a broadcasted
+// reload signal.
+type Service struct {
+	log           *slog.Logger
+	cfg           Config
+	clientBuilder *client.Builder
+
+	mu              sync.Mutex
+	client          *apiclient.Client
+	facade          *identity.Facade
+	initialized     chan struct{}
+	initializedOnce sync.Once
+}
+
+// GetIdentity returns the current Bot identity.
+func (s *Service) GetIdentity() *identity.Identity {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.facade.Get()
+}
+
+// GetClient returns the facaded client for the Bot identity for use by other
+// components of `tbot`. Consumers should not call `Close` on the client.
+func (s *Service) GetClient() *apiclient.Client {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.client
+}
+
+func (s *Service) GetGenerator() (*identity.Generator, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return identity.NewGenerator(identity.GeneratorConfig{
+		Client:      s.client,
+		BotIdentity: s.facade,
+		FIPS:        s.cfg.FIPS,
+		Insecure:    s.cfg.Connection.Insecure,
+		Logger: s.log.With(
+			teleport.ComponentKey,
+			teleport.Component(teleport.ComponentTBot, "identity-generator"),
+		),
+	})
+}
+
+// Ready returns a channel that will be closed when the initial identity renewal
+// process has completed. It provides a way to "block" startup of services that
+// cannot gracefully handle the API client being unavailable.
+func (s *Service) Ready() <-chan struct{} {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.initialized == nil {
+		s.initialized = make(chan struct{})
+	}
+
+	return s.initialized
+}
+
+// IsReady returns whether the initial identity renewal process has completed.
+func (s *Service) IsReady() bool {
+	select {
+	case <-s.Ready():
+		return true
+	default:
+		return false
+	}
+}
+
+// String returns a human-readable name of the service.
+func (s *Service) String() string {
+	return "identity"
+}
+
+func hasTokenChanged(configTokenBytes, identityBytes []byte) bool {
+	if len(configTokenBytes) == 0 || len(identityBytes) == 0 {
+		return false
+	}
+
+	return !bytes.Equal(identityBytes, configTokenBytes)
+}
+
+// loadIdentityFromStore attempts to load a persisted identity from a store.
+//
+// If the persisted identity does not match the onboarding profile/join token,
+// a nil identity will be returned. If the identity certificate has expired, the
+// bool return value will be false.
+func (s *Service) loadIdentityFromStore(ctx context.Context, store destination.Destination) (*identity.Identity, bool) {
+	ctx, span := tracer.Start(ctx, "identityService/loadIdentityFromStore")
+	defer span.End()
+	s.log.InfoContext(ctx, "Loading existing bot identity from store", "store", store)
+
+	loadedIdent, err := identity.LoadIdentity(ctx, store, identity.BotKinds()...)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			s.log.InfoContext(ctx, "No existing bot identity found in store")
+			return nil, false
+		} else {
+			s.log.WarnContext(
+				ctx,
+				"Failed to load existing bot identity from store",
+				"error", err,
+			)
+			return nil, false
+		}
+	}
+
+	// Determine if the token configured in the onboarding matches the
+	// one used to produce the credentials loaded from disk.
+	if s.cfg.Onboarding.HasToken() {
+		if token, err := s.cfg.Onboarding.Token(); err == nil {
+			sha := sha256.Sum256([]byte(token))
+			configTokenHashBytes := []byte(hex.EncodeToString(sha[:]))
+			if hasTokenChanged(loadedIdent.TokenHashBytes, configTokenHashBytes) {
+				s.log.InfoContext(ctx, "Bot identity loaded from store does not match configured token")
+				// If the token has changed, do not return the loaded
+				// identity.
+				return nil, false
+			}
+		} else {
+			// we failed to get the newly configured token to compare to,
+			// we'll assume the last good credentials written to disk should
+			// still be used.
+			s.log.WarnContext(
+				ctx,
+				"There was an error loading the configured token to compare to existing identity. Identity loaded from store will be tried",
+				"error", err,
+			)
+		}
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Loaded existing bot identity from store",
+		"identity", loadedIdent,
+	)
+
+	now := time.Now().UTC()
+	valid := true
+	if now.After(loadedIdent.X509Cert.NotAfter) {
+		valid = false
+		s.log.WarnContext(
+			ctx,
+			"Identity loaded from store is expired, it will not be used",
+			"not_after", loadedIdent.X509Cert.NotAfter.Format(time.RFC3339),
+			"current_time", now.Format(time.RFC3339),
+		)
+	} else if now.Before(loadedIdent.X509Cert.NotBefore) {
+		valid = false
+		s.log.WarnContext(
+			ctx,
+			"Identity loaded from store is not yet valid, it will not be used. Confirm that the system time is correct",
+			"not_before", loadedIdent.X509Cert.NotBefore.Format(time.RFC3339),
+			"current_time", now.Format(time.RFC3339),
+		)
+	}
+
+	return loadedIdent, valid
+}
+
+// Initialize sets up the bot identity at startup. This process has a few
+// steps to it.
+//
+// First, we attempt to load an existing identity from the configured storage.
+// This is ignored if we know that the onboarding settings have changed.
+//
+// If the identity is found, and seems valid, we attempt to renew using this
+// identity to give us a fresh set of certificates.
+//
+// If there is no identity, or the identity is invalid, we'll join using the
+// configured onboarding settings.
+func (s *Service) Initialize(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "identityService/Initialize")
+	defer span.End()
+
+	s.log.InfoContext(ctx, "Initializing bot identity")
+	loadedIdent, valid := s.loadIdentityFromStore(ctx, s.cfg.Destination)
+	if !valid {
+		if !s.cfg.Onboarding.HasToken() {
+			// If there's no pre-existing identity (or it has expired) and the
+			// configuration contains no join token, we cannot do anything.
+			return trace.BadParameter(
+				"no existing identity found on disk or join token configured",
+			)
+		}
+		s.log.InfoContext(
+			ctx,
+			"Bot was unable to load a valid existing identity from the store, will attempt to join using configured token",
+		)
+	}
+
+	var (
+		newIdentity *identity.Identity
+		err         error
+	)
+	if loadedIdent == nil {
+		// If there was no identity already on-disk, or it did not match the
+		// onboarding profile / join token, try to join from scratch.
+		//
+		// If this fails, tbot will exit because we cannot proceed with no
+		// identity at all.
+		if newIdentity, err = botIdentityFromToken(ctx, s.log, s.cfg, nil); err != nil {
+			return trace.Wrap(err, "joining with token")
+		}
+	} else {
+		if valid {
+			// If the identity is valid (not expired), try to renew it.
+			newIdentity, err = renewIdentity(ctx, s.log, s.cfg, s.clientBuilder, loadedIdent)
+		} else {
+			// If the identity has expired, try to join again from scratch.
+			newIdentity, err = botIdentityFromToken(ctx, s.log, s.cfg, nil)
+		}
+
+		// If there was an identity on-disk from a previous run, but renewing it
+		// or re-joining fails, tbot will continue running using the (possibly
+		// expired) existing identity.
+		//
+		// In long-running mode, the Run method will retry the renewal process
+		// in case connectivity to the auth server has been restored etc. In the
+		// meantime, some services may be able to continue operating with cached
+		// data.
+		//
+		// In one-shot mode, the OneShot method will make a ping RPC to test the
+		// connection and exit immediately if the connection is unavailable.
+		if err != nil {
+			facade := identity.NewFacade(s.cfg.FIPS, s.cfg.Connection.Insecure, loadedIdent)
+			client, clientErr := s.clientBuilder.Build(ctx, facade)
+			if clientErr != nil {
+				return trace.Wrap(clientErr)
+			}
+
+			s.mu.Lock()
+			s.facade = facade
+			s.client = client
+			s.mu.Unlock()
+
+			s.log.ErrorContext(ctx, "Failed to renew bot identity. Will attempt to proceed with the old identity, API calls may fail", "error", err)
+			return nil
+		}
+	}
+
+	// We successfully renewed the bot identity!
+	s.log.InfoContext(ctx, "Fetched new bot identity", "identity", newIdentity)
+	if err := identity.SaveIdentity(ctx, newIdentity, s.cfg.Destination, identity.BotKinds()...); err != nil {
+		return trace.Wrap(err)
+	}
+
+	facade := identity.NewFacade(s.cfg.FIPS, s.cfg.Connection.Insecure, newIdentity)
+	c, err := s.clientBuilder.Build(ctx, facade)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.mu.Lock()
+	s.client = c
+	s.facade = facade
+	s.mu.Unlock()
+
+	s.unblockWaiters()
+
+	s.log.InfoContext(ctx, "Identity initialized successfully")
+	return nil
+}
+
+func (s *Service) Close() error {
+	c := s.GetClient()
+	if c == nil {
+		return nil
+	}
+	return trace.Wrap(c.Close())
+}
+
+func (s *Service) OneShot(ctx context.Context) error {
+	if _, err := s.GetClient().Ping(ctx); err != nil {
+		return trace.Wrap(err, "testing auth service connection")
+	}
+	return nil
+}
+
+func (s *Service) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "identityService/Run")
+	defer span.End()
+
+	// Determine where the bot should write its internal data (renewable cert
+	// etc)
+	storageDestination := s.cfg.Destination
+
+	if s.IsReady() {
+		s.cfg.StatusReporter.Report(readyz.Healthy)
+	} else {
+		// Keep retrying renewal if it failed on startup.
+		retry, err := retryutils.NewRetryV2(retryutils.RetryV2Config{
+			Driver: retryutils.NewExponentialDriver(1 * time.Second),
+			Max:    1 * time.Minute,
+			Jitter: retryutils.HalfJitter,
+		})
+		if err != nil {
+			return trace.Wrap(err, "creating retry")
+		}
+
+		for {
+			retry.Inc()
+
+			s.log.InfoContext(ctx, "Unable to renew bot identity on startup. Waiting to retry", "wait", retry.Duration())
+
+			select {
+			case <-retry.After():
+			case <-ctx.Done():
+				return nil
+			}
+
+			if err := s.renew(ctx, storageDestination); err == nil {
+				s.unblockWaiters()
+				break
+			}
+		}
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Beginning bot identity renewal loop",
+		"ttl", s.cfg.TTL,
+		"interval", s.cfg.RenewalInterval,
+	)
+
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service: s.String(),
+		Name:    "bot-identity-renewal",
+		F: func(ctx context.Context) error {
+			return s.renew(ctx, storageDestination)
+		},
+		Interval:           s.cfg.RenewalInterval,
+		RetryLimit:         botIdentityRenewalRetryLimit,
+		Log:                s.log,
+		ReloadCh:           s.cfg.ReloadCh,
+		WaitBeforeFirstRun: true,
+		StatusReporter:     s.cfg.StatusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *Service) renew(
+	ctx context.Context,
+	botDestination destination.Destination,
+) error {
+	ctx, span := tracer.Start(ctx, "identityService/renew")
+	defer span.End()
+
+	currentIdentity := s.facade.Get()
+	// Make sure we can still write to the bot's destination.
+	if err := identity.VerifyWrite(ctx, botDestination); err != nil {
+		return trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
+	}
+
+	newIdentity, err := renewIdentity(ctx, s.log, s.cfg, s.clientBuilder, currentIdentity)
+	if err != nil {
+		return trace.Wrap(err, "renewing identity")
+	}
+
+	s.log.InfoContext(ctx, "Fetched new bot identity", "identity", newIdentity)
+	s.facade.Set(newIdentity)
+
+	if err := identity.SaveIdentity(ctx, newIdentity, botDestination, identity.BotKinds()...); err != nil {
+		return trace.Wrap(err, "saving new identity")
+	}
+	s.log.DebugContext(ctx, "Bot identity persisted", "identity", newIdentity)
+
+	return nil
+}
+
+func (s *Service) unblockWaiters() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.initialized == nil {
+		s.initialized = make(chan struct{})
+	}
+
+	s.initializedOnce.Do(func() { close(s.initialized) })
+}
+
+// renewIdentity attempts to renew an existing bot identity. "Renewal" in this
+// case means one of two things:
+//
+//  1. If using an explicitly renewable identity (i.e. `token` joining),
+//     certificates will be renewed directly via Auth using the formal renewal
+//     process.
+//
+//     If the existing identity is expired, this will fail and cannot be
+//     recovered.
+//
+//  2. For all other join methods, a "lightweight renewal" is performed. The
+//     existing client is used to authenticate the request and prove ownership
+//     of the existing bot instance ID, but otherwise the delegated joining
+//     ceremony is performed as usual.
+//
+//     If the existing identity appears to be expired (`time.Now()` >
+//     `NotAfter`), the existing auth client will be discarded and the bot will
+//     try to join without it. This will result in a new bot instance ID.
+func renewIdentity(
+	ctx context.Context,
+	log *slog.Logger,
+	cfg Config,
+	clientBuilder *client.Builder,
+	oldIdentity *identity.Identity,
+) (*identity.Identity, error) {
+	ctx, span := tracer.Start(ctx, "renewIdentity")
+	defer span.End()
+	// Explicitly create a new client - this guarantees that requests will be
+	// made with the most recent identity and that a connection associated with
+	// an old identity will not be used.
+	facade := identity.NewFacade(cfg.FIPS, cfg.Connection.Insecure, oldIdentity)
+	authClient, err := clientBuilder.Build(ctx, facade)
+	if err != nil {
+		return nil, trace.Wrap(err, "creating auth client")
+	}
+	defer authClient.Close()
+
+	if oldIdentity.TLSIdentity.Renewable {
+		// When using a renewable join method, we use GenerateUserCerts to
+		// request a new certificate using our current identity.
+		newIdentity, err := botIdentityFromAuth(
+			ctx, log, oldIdentity, authClient, cfg.TTL,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "renewing identity using GenerateUserCert")
+		}
+		return newIdentity, nil
+	}
+
+	// Note: This simple expiration check is probably not the best possible
+	// solution to determine when to discard an existing identity: the client
+	// could have severe clock drift, or there could be non-expiry related
+	// reasons that an identity should be thrown out. We may improve this
+	// discard logic in the future if we determine we're still creating  excess
+	// bot instances.
+	now := time.Now()
+	if expiry, ok := facade.Expiry(); !ok || now.After(expiry) {
+		slog.WarnContext(
+			ctx,
+			"The bot identity appears to be expired and will not be used to "+
+				"authenticate the identity renewal. If it is possible to "+
+				"rejoin, a new bot instance will be created. If this occurs "+
+				"repeatedly, ensure the local machine's clock is properly "+
+				"synchronized, the certificate TTL is adjusted to your "+
+				"environment, and that no external issues will prevent "+
+				"the bot from renewing its identity on schedule.",
+			"now", now,
+			"expiry", expiry,
+			"ttl", cfg.TTL,
+			"renewal_interval", cfg.RenewalInterval,
+		)
+
+		newIdentity, err := botIdentityFromToken(ctx, log, cfg, nil)
+		if err != nil {
+			return nil, trace.Wrap(err, "renewing identity using Register without existing auth client")
+		}
+		return newIdentity, nil
+	}
+
+	newIdentity, err := botIdentityFromToken(ctx, log, cfg, authClient)
+	if err != nil {
+		return nil, trace.Wrap(err, "renewing identity using Register with existing auth client")
+	}
+	return newIdentity, nil
+}
+
+// botIdentityFromAuth uses an existing identity to request a new from the auth
+// server using GenerateUserCerts. This only works for renewable join types.
+func botIdentityFromAuth(
+	ctx context.Context,
+	log *slog.Logger,
+	ident *identity.Identity,
+	client *apiclient.Client,
+	ttl time.Duration,
+) (*identity.Identity, error) {
+	ctx, span := tracer.Start(ctx, "botIdentityFromAuth")
+	defer span.End()
+	log.InfoContext(ctx, "Fetching bot identity using existing bot identity")
+
+	if ident == nil || client == nil {
+		return nil, trace.BadParameter("renewIdentityWithAuth must be called with non-nil client and identity")
+	}
+
+	// Always generate a new key when refreshing the identity. This limits
+	// usefulness of compromised keys to the lifetime of their associated cert,
+	// and allows for new keys to follow any changes to the signature algorithm
+	// suite.
+	key, err := cryptosuites.GenerateKey(ctx,
+		cryptosuites.GetCurrentSuiteFromAuthPreference(client),
+		cryptosuites.HostIdentity)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	privateKeyPEM, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshPub := ssh.MarshalAuthorizedKey(sshPubKey)
+	tlsPub, err := keys.MarshalPublicKey(key.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Ask the auth server to generate a new set of certs with a new
+	// expiration date.
+	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
+		SSHPublicKey: sshPub,
+		TLSPublicKey: tlsPub,
+		Username:     ident.X509Cert.Subject.CommonName,
+		Expires:      time.Now().Add(ttl),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "calling GenerateUserCerts")
+	}
+
+	newIdentity, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
+		PrivateKeyBytes: privateKeyPEM,
+		PublicKeyBytes:  sshPub,
+		TokenHashBytes:  ident.TokenHashBytes,
+	}, certs)
+	if err != nil {
+		return nil, trace.Wrap(err, "reading renewed identity")
+	}
+
+	return newIdentity, nil
+}
+
+func initBoundKeypairClientState(
+	ctx context.Context,
+	log *slog.Logger,
+	cfg Config,
+	joinSecret string,
+) (boundkeypair.ClientState, error) {
+	staticKey, err := cfg.Onboarding.BoundKeypair.StaticPrivateKeyBytes()
+	if err != nil {
+		log.WarnContext(
+			ctx,
+			"Could not load the configured bound keypair static key, will attempt to fall back to a standard filesystem keypair",
+			"error", err,
+		)
+	} else if staticKey != nil {
+		log.InfoContext(ctx, "A static keypair was configured and will be used instead of mutable internal key storage")
+		return boundkeypair.NewStaticClientState(staticKey), nil
+	}
+
+	adapter := destination.NewBoundkeypairDestinationAdapter(cfg.Destination)
+	state, err := boundkeypair.LoadClientState(ctx, adapter)
+	if trace.IsNotFound(err) && joinSecret != "" {
+		log.InfoContext(ctx, "No existing client state found, will attempt "+
+			"to join with provided registration secret")
+		state = boundkeypair.NewEmptyFSClientState(adapter)
+	} else if err != nil {
+		log.ErrorContext(ctx, "Could not complete bound keypair joining as "+
+			"no local credentials are available and no registration secret "+
+			"was provided. To continue, either generate a keypair with "+
+			"`tbot keypair create` and register it with Teleport, or "+
+			"generate a registration secret in Teleport and provide it with "+
+			"the `--registration-secret` flag.")
+		return nil, trace.Wrap(err, "loading bound keypair client state")
+	}
+
+	return state, nil
+}
+
+// botIdentityFromToken uses a join token to request a bot identity from an auth
+// server using auth.Register.
+//
+// The authClient parameter is optional - if provided - this will be used for
+// the request. This saves the overhead of trying to create a new client as
+// part of the join process and allows us to preserve the bot instance id.
+func botIdentityFromToken(
+	ctx context.Context,
+	log *slog.Logger,
+	cfg Config,
+	authClient *apiclient.Client,
+) (*identity.Identity, error) {
+	_, span := tracer.Start(ctx, "botIdentityFromToken")
+	defer span.End()
+
+	log.InfoContext(ctx, "Fetching bot identity using token")
+
+	token, err := cfg.Onboarding.Token()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cipherSuites := utils.DefaultCipherSuites()
+	if cfg.FIPS {
+		cipherSuites = defaults.FIPSCipherSuites
+	}
+
+	expires := time.Now().Add(cfg.TTL)
+	params := joinclient.JoinParams{
+		Token: token,
+		ID: state.IdentityID{
+			Role: types.RoleBot,
+		},
+		JoinMethod: cfg.Onboarding.JoinMethod,
+		Expires:    &expires,
+
+		// Below options are effectively ignored if AuthClient is not-nil
+		Insecure:           cfg.Connection.Insecure,
+		CAPins:             cfg.Onboarding.CAPins,
+		CAPath:             cfg.Onboarding.CAPath,
+		FIPS:               cfg.FIPS,
+		GetHostCredentials: libclient.HostCredentials,
+		CipherSuites:       cipherSuites,
+	}
+	if authClient != nil {
+		params.AuthClient = authClient
+	}
+
+	switch cfg.Connection.AddressKind {
+	case connection.AddressKindAuth:
+		parsed, err := utils.ParseAddr(cfg.Connection.Address)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to parse addr")
+		}
+		params.AuthServers = []utils.NetAddr{*parsed}
+	case connection.AddressKindProxy:
+		parsed, err := utils.ParseAddr(cfg.Connection.Address)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to parse addr")
+		}
+		params.ProxyServer = *parsed
+	default:
+		return nil, trace.BadParameter("unsupported address kind: %v", cfg.Connection.AddressKind)
+	}
+
+	// Only set during bound keypair joining, but used both before and after.
+	var boundKeypairState boundkeypair.ClientState
+
+	switch params.JoinMethod {
+	case types.JoinMethodAzure:
+		params.AzureParams = joinclient.AzureParams{
+			ClientID: cfg.Onboarding.Azure.ClientID,
+		}
+	case types.JoinMethodTerraformCloud:
+		params.TerraformCloudAudienceTag = cfg.Onboarding.Terraform.AudienceTag
+	case types.JoinMethodGitLab:
+		params.GitlabParams = joinclient.GitlabParams{
+			EnvVarName: cfg.Onboarding.Gitlab.TokenEnvVarName,
+		}
+	case types.JoinMethodBoundKeypair:
+		joinSecret, err := cfg.Onboarding.BoundKeypair.RegistrationSecret()
+		if err != nil {
+			return nil, trace.Wrap(err, "loading registration secret from disk")
+		}
+
+		boundKeypairState, err = initBoundKeypairClientState(ctx, log, cfg, joinSecret)
+		if err != nil {
+			return nil, trace.Wrap(err, "initializing bound keypair client state")
+		}
+
+		params.BoundKeypairParams = boundKeypairState.ToJoinParams(boundkeypair.ClientParams{
+			RegistrationSecret: joinSecret,
+		})
+	}
+
+	result, err := joinclient.Join(ctx, params)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if boundKeypairState != nil {
+		if err := boundKeypairState.UpdateFromRegisterResult(result); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if err := boundKeypairState.Store(ctx); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	privateKeyPEM, err := keys.MarshalPrivateKey(result.PrivateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshPub, err := ssh.NewPublicKey(result.PrivateKey.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sha := sha256.Sum256([]byte(params.Token))
+	tokenHash := hex.EncodeToString(sha[:])
+	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
+		PrivateKeyBytes: privateKeyPEM,
+		PublicKeyBytes:  ssh.MarshalAuthorizedKey(sshPub),
+		TokenHashBytes:  []byte(tokenHash),
+	}, result.Certs)
+	return ident, trace.Wrap(err)
+}
diff --git a/lib/tbot/internal/listener.go b/lib/tbot/internal/listener.go
new file mode 100644
index 0000000000000..e7fb8a8949d02
--- /dev/null
+++ b/lib/tbot/internal/listener.go
@@ -0,0 +1,82 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"log/slog"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+
+	"github.com/gravitational/trace"
+)
+
+func CreateListener(ctx context.Context, log *slog.Logger, addr string) (net.Listener, error) {
+	parsed, err := url.Parse(addr)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing %q", addr)
+	}
+
+	switch parsed.Scheme {
+	// If no scheme is provided, default to TCP.
+	case "tcp", "":
+		return net.Listen("tcp", parsed.Host)
+	case "unix":
+		absPath, err := filepath.Abs(parsed.Path)
+		if err != nil {
+			return nil, trace.Wrap(err, "resolving absolute path for %q", parsed.Path)
+		}
+
+		// Remove the file if it already exists. This is necessary to handle
+		// unclean exits.
+		if err := os.Remove(absPath); err != nil && !os.IsNotExist(err) {
+			log.WarnContext(ctx, "Failed to remove existing socket file", "error", err)
+		}
+
+		l, err := net.ListenUnix("unix", &net.UnixAddr{
+			Net:  "unix",
+			Name: absPath,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err, "creating unix socket %q", absPath)
+		}
+
+		// On Unix systems, you must have read and write permissions for the
+		// socket to connect to it. The execute permission on the directories
+		// containing the socket must also be granted. This is different to when
+		// we write output artifacts which only require the consumer to have
+		// read access.
+		//
+		// We set the socket perm to 777. Instead of controlling access via
+		// the socket file directly, users will either:
+		// - Configure Unix Workload Attestation to restrict access to specific
+		//   PID/UID/GID combinations.
+		// - Configure the filesystem permissions of the directory containing
+		//   the socket.
+		if err := os.Chmod(absPath, os.ModePerm); err != nil {
+			return nil, trace.Wrap(err, "setting permissions on unix socket %q", absPath)
+		}
+
+		return l, nil
+	default:
+		return nil, trace.BadParameter("unsupported scheme %q", parsed.Scheme)
+	}
+}
diff --git a/lib/tbot/internal/loop.go b/lib/tbot/internal/loop.go
new file mode 100644
index 0000000000000..316a389451396
--- /dev/null
+++ b/lib/tbot/internal/loop.go
@@ -0,0 +1,220 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"log/slog"
+	"math"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+var (
+	LoopIterationsCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tbot_task_iterations_total",
+			Help: "Number of task iteration attempts, not counting retries",
+		}, []string{"service", "name"},
+	)
+	LoopIterationsSuccessCounter = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:    "tbot_task_iterations_successful",
+			Help:    "Histogram of task iterations that ultimately succeeded, bucketed by number of retries before success",
+			Buckets: []float64{0, 1, 2, 3, 4, 5},
+		}, []string{"service", "name"},
+	)
+	LoopIterationsFailureCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tbot_task_iterations_failed",
+			Help: "Number of task iterations that ultimately failed, not counting retries",
+		}, []string{"service", "name"},
+	)
+	LoopIterationTime = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:    "tbot_task_iteration_duration_seconds",
+			Help:    "Time between beginning and ultimate end of one task iteration regardless of outcome, including all retries",
+			Buckets: prometheus.ExponentialBuckets(0.1, 1.75, 6),
+		}, []string{"service", "name"},
+	)
+)
+
+type RunOnIntervalConfig struct {
+	Service string
+	Name    string
+	F       func(ctx context.Context) error
+	Clock   clockwork.Clock
+	// ReloadCh allows the task to be triggered immediately, ideal for handling
+	// CA rotations or a manual signal from a user.
+	// ReloadCh can be nil, in which case, the task will only run on the
+	// interval.
+	ReloadCh             <-chan struct{}
+	Log                  *slog.Logger
+	Interval             time.Duration
+	RetryLimit           int
+	ExitOnRetryExhausted bool
+	WaitBeforeFirstRun   bool
+	// IdentityReadyCh allows the service to wait until the internal bot identity
+	// renewal has completed before running, to avoid spamming the logs if the
+	// service doesn't support gracefully degrading when there is no API client
+	// available.
+	IdentityReadyCh <-chan struct{}
+	StatusReporter  readyz.Reporter
+}
+
+func (cfg *RunOnIntervalConfig) CheckAndSetDefaults() error {
+	switch {
+	case cfg.Interval <= 0:
+		return trace.BadParameter("interval must be greater than 0")
+	case cfg.RetryLimit < 0:
+		return trace.BadParameter("retryLimit must be greater than or equal to 0")
+	case cfg.Log == nil:
+		return trace.BadParameter("log is required")
+	case cfg.F == nil:
+		return trace.BadParameter("f is required")
+	case cfg.Name == "":
+		return trace.BadParameter("name is required")
+	}
+
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	if cfg.StatusReporter == nil {
+		cfg.StatusReporter = readyz.NoopReporter()
+	}
+
+	return nil
+}
+
+// RunOnInterval runs a function on a given interval, with retries and jitter.
+//
+// TODO(noah): Emit Prometheus metrics for:
+// - Time of next attempt
+func RunOnInterval(ctx context.Context, cfg RunOnIntervalConfig) error {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return err
+	}
+
+	log := cfg.Log.With("task", cfg.Name)
+
+	if cfg.IdentityReadyCh != nil {
+		select {
+		case <-cfg.IdentityReadyCh:
+		default:
+			log.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-cfg.IdentityReadyCh:
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	}
+
+	ticker := cfg.Clock.NewTicker(cfg.Interval)
+	defer ticker.Stop()
+	jitter := retryutils.DefaultJitter
+	firstRun := true
+	for {
+		if !firstRun || (firstRun && cfg.WaitBeforeFirstRun) {
+			select {
+			case <-ctx.Done():
+				return nil
+			case <-ticker.Chan():
+			case <-cfg.ReloadCh:
+			}
+		}
+		firstRun = false
+
+		LoopIterationsCounter.WithLabelValues(cfg.Service, cfg.Name).Inc()
+		startTime := time.Now()
+
+		var err error
+		for attempt := 1; attempt <= cfg.RetryLimit; attempt++ {
+			log.InfoContext(
+				ctx,
+				"Attempting task",
+				"attempt", attempt,
+				"retry_limit", cfg.RetryLimit,
+			)
+			err = cfg.F(ctx)
+			if err == nil {
+				cfg.StatusReporter.Report(readyz.Healthy)
+				LoopIterationsSuccessCounter.WithLabelValues(cfg.Service, cfg.Name).Observe(float64(attempt - 1))
+				break
+			}
+
+			if attempt != cfg.RetryLimit {
+				// exponentially back off with jitter, starting at 1 second.
+				backoffTime := time.Second * time.Duration(math.Pow(2, float64(attempt-1)))
+				backoffTime = jitter(backoffTime)
+				cfg.Log.WarnContext(
+					ctx,
+					"Task failed. Backing off and retrying",
+					"attempt", attempt,
+					"retry_limit", cfg.RetryLimit,
+					"backoff", backoffTime,
+					"error", err,
+				)
+				select {
+				case <-ctx.Done():
+					// Note: will discard metric update for this loop. It
+					// probably won't be collected if we're shutting down,
+					// anyway.
+					return nil
+				case <-cfg.Clock.After(backoffTime):
+				}
+			}
+		}
+
+		LoopIterationTime.WithLabelValues(cfg.Service, cfg.Name).Observe(time.Since(startTime).Seconds())
+
+		if err != nil {
+			cfg.StatusReporter.ReportReason(readyz.Unhealthy, err.Error())
+			LoopIterationsFailureCounter.WithLabelValues(cfg.Service, cfg.Name).Inc()
+
+			if cfg.ExitOnRetryExhausted {
+				log.ErrorContext(
+					ctx,
+					"All retry attempts exhausted. Exiting",
+					"error", err,
+					"retry_limit", cfg.RetryLimit,
+				)
+				return trace.Wrap(err)
+			}
+			log.WarnContext(
+				ctx,
+				"All retry attempts exhausted. Will wait for next interval",
+				"retry_limit", cfg.RetryLimit,
+				"interval", cfg.Interval,
+			)
+		} else {
+			log.InfoContext(
+				ctx,
+				"Task succeeded. Waiting interval",
+				"interval", cfg.Interval,
+			)
+		}
+	}
+}
diff --git a/lib/tbot/internal/loop_test.go b/lib/tbot/internal/loop_test.go
new file mode 100644
index 0000000000000..34505f7ef820f
--- /dev/null
+++ b/lib/tbot/internal/loop_test.go
@@ -0,0 +1,112 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+func Test_RunOnInterval(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	taskCh := make(chan struct{}, 3)
+	log := logtest.NewLogger()
+	clock := clockwork.NewFakeClock()
+	cfg := RunOnIntervalConfig{
+		Name:  "test",
+		Clock: clock,
+		Log:   log,
+		F: func(ctx context.Context) error {
+			taskCh <- struct{}{}
+			return nil
+		},
+		RetryLimit: 3,
+		Interval:   time.Minute * 10,
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.NoError(t, RunOnInterval(ctx, cfg))
+	}()
+
+	// Wait for three iterations to have been completed.
+	for i := 0; i < 3; i++ {
+		<-taskCh
+		clock.Advance(time.Minute * 11)
+	}
+
+	// Cancel the ctx and make sure RunOnInterval returns
+	cancel()
+	wg.Wait()
+}
+
+func Test_RunOnInterval_failureExit(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	callCount := atomic.Int64{}
+
+	log := logtest.NewLogger()
+	testErr := fmt.Errorf("test error")
+	cfg := RunOnIntervalConfig{
+		Name:  "test",
+		Clock: clockwork.NewRealClock(),
+		Log:   log,
+		F: func(ctx context.Context) error {
+			callCount.Add(1)
+			return testErr
+		},
+		RetryLimit:           2,
+		Interval:             time.Second,
+		ExitOnRetryExhausted: true,
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.ErrorIs(t, RunOnInterval(ctx, cfg), testErr)
+	}()
+
+	wg.Wait()
+	assert.Equal(t, int64(2), callCount.Load())
+}
diff --git a/lib/tbot/internal/output.go b/lib/tbot/internal/output.go
new file mode 100644
index 0000000000000..4345ff9923be4
--- /dev/null
+++ b/lib/tbot/internal/output.go
@@ -0,0 +1,301 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/client/identityfile"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/internal")
+
+// NewBotConfigWriter returns a new BotConfigWriter that writes to the given
+// Destination.
+func NewBotConfigWriter(ctx context.Context, dest destination.Destination, subPath string) *BotConfigWriter {
+	return &BotConfigWriter{
+		ctx:     ctx,
+		dest:    dest,
+		subpath: subPath,
+	}
+}
+
+// BotConfigWriter is a trivial adapter to use the identityfile package with
+// bot destinations.
+type BotConfigWriter struct {
+	ctx context.Context
+
+	// dest is the Destination that will handle writing of files.
+	dest destination.Destination
+
+	// subpath is the subdirectory within the Destination to which the files
+	// should be written.
+	subpath string
+}
+
+// WriteFile writes the file to the Destination. Only the basename of the path
+// is used. Specified permissions are ignored.
+func (b *BotConfigWriter) WriteFile(name string, data []byte, _ os.FileMode) error {
+	p := filepath.Base(name)
+	if b.subpath != "" {
+		p = filepath.Join(b.subpath, p)
+	}
+
+	return trace.Wrap(b.dest.Write(b.ctx, p, data))
+}
+
+// Remove removes files. This is a dummy implementation that always returns not found.
+func (b *BotConfigWriter) Remove(name string) error {
+	return &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
+}
+
+// Stat checks file status. This implementation always returns not found.
+func (b *BotConfigWriter) Stat(name string) (fs.FileInfo, error) {
+	return nil, &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
+}
+
+// ReadFile reads a given file. This implementation always returns not found.
+func (b *BotConfigWriter) ReadFile(name string) ([]byte, error) {
+	return nil, &os.PathError{Op: "read", Path: name, Err: os.ErrNotExist}
+}
+
+// compile-time assertion that the BotConfigWriter implements the
+// identityfile.ConfigWriter interface
+var _ identityfile.ConfigWriter = (*BotConfigWriter)(nil)
+
+// WriteTLSCAs writes the three "main" TLS CAs to disk.
+//
+// TODO(noah): This is largely a copy of templateTLSCAs. We should reconsider
+// which CAs are actually worth writing for each type of service because
+// it seems inefficient to write the "Database" CA for a Kubernetes output.
+func WriteTLSCAs(ctx context.Context, dest destination.Destination, hostCAs, userCAs, databaseCAs []types.CertAuthority) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"WriteTLSCAs",
+	)
+	defer span.End()
+
+	// Note: This implementation mirrors tctl's current behavior. I've noticed
+	// that mariadb at least does not seem to like being passed more than one
+	// CA so there may be some compat issues to address in the future for the
+	// rare case where a CA rotation is in progress.
+	if err := dest.Write(ctx, HostCAPath, concatCACerts(hostCAs)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := dest.Write(ctx, UserCAPath, concatCACerts(userCAs)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := dest.Write(ctx, DatabaseCAPath, concatCACerts(databaseCAs)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// concatCACerts borrow's identityfile's CA cert concat method.
+func concatCACerts(cas []types.CertAuthority) []byte {
+	trusted := authclient.AuthoritiesToTrustedCerts(cas)
+
+	var caCerts []byte
+	for _, ca := range trusted {
+		for _, cert := range ca.TLSCertificates {
+			caCerts = append(caCerts, cert...)
+		}
+	}
+
+	return caCerts
+}
+
+func WriteIdentityFile(
+	ctx context.Context, log *slog.Logger, keyRing *client.KeyRing, dest destination.Destination,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"writeIdentityFile",
+	)
+	defer span.End()
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: IdentityFilePath,
+		Writer:     NewBotConfigWriter(ctx, dest, ""),
+		KeyRing:    keyRing,
+		Format:     identityfile.FormatFile,
+
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.DebugContext(ctx, "Wrote identity file", "files", files)
+	return nil
+}
+
+// WriteIdentityFileTLS writes the identity file in TLS format according to the
+// core identityfile.Write method. This isn't usually needed but can be
+// useful when writing out TLS certificates with alternative prefix and file
+// extensions for application compatibility reasons.
+func WriteIdentityFileTLS(
+	ctx context.Context, log *slog.Logger, keyRing *client.KeyRing, dest destination.Destination,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"WriteIdentityFileTLS",
+	)
+	defer span.End()
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: DefaultTLSPrefix,
+		Writer:     NewBotConfigWriter(ctx, dest, ""),
+		KeyRing:    keyRing,
+		Format:     identityfile.FormatTLS,
+
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.DebugContext(ctx, "Wrote TLS identity files", "files", files)
+	return nil
+}
+
+// NewClientKeyRing returns a sane client.KeyRing for the given bot identity.
+func NewClientKeyRing(ident *identity.Identity, hostCAs []types.CertAuthority) (*client.KeyRing, error) {
+	pk, err := keys.ParsePrivateKey(ident.PrivateKeyBytes)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &client.KeyRing{
+		KeyRingIndex: client.KeyRingIndex{
+			ClusterName: ident.ClusterName,
+		},
+		// tbot identities use a single private key for SSH and TLS.
+		SSHPrivateKey: pk,
+		TLSPrivateKey: pk,
+		Cert:          ident.CertBytes,
+		TLSCert:       ident.TLSCertBytes,
+		TrustedCerts:  authclient.AuthoritiesToTrustedCerts(hostCAs),
+
+		// Note: these fields are never used or persisted with identity files,
+		// so we won't bother to set them. (They may need to be reconstituted
+		// on tsh's end based on cert fields, though.)
+		KubeTLSCredentials: make(map[string]client.TLSCredential),
+		DBTLSCredentials:   make(map[string]client.TLSCredential),
+	}, nil
+}
+
+// ChooseOneResource chooses one matched resource by name, or tries to choose
+// one resource by unambiguous "discovered name".
+func ChooseOneResource[T types.ResourceWithLabels](resources []T, name, resDesc string) (T, error) {
+	for _, r := range resources {
+		if r.GetName() == name {
+			return r, nil
+		}
+	}
+
+	// look for an unambiguous "discovered name" match as a fallback.
+	var matches []T
+	for _, r := range resources {
+		discoveredName, ok := r.GetLabel(types.DiscoveredNameLabel)
+		if ok && discoveredName == name {
+			matches = append(matches, r)
+		}
+	}
+	switch len(matches) {
+	case 0:
+		var out T
+		return out, trace.NotFound("%s %q not found", resDesc, name)
+	case 1:
+		return matches[0], nil
+	default:
+		var out T
+		errMsg := formatAmbiguousMessage(name, resDesc, matches)
+		return out, trace.BadParameter("%s", errMsg)
+	}
+}
+
+// formatAmbiguousMessage formats a generic error message that describes an ambiguous
+// auto-discovered resource name match error.
+func formatAmbiguousMessage[T types.ResourceWithLabels](name, resDesc string, matches []T) string {
+	matchedNames := make([]string, 0, len(matches))
+	for _, match := range matches {
+		matchedNames = append(matchedNames, match.GetName())
+	}
+	slices.Sort(matchedNames)
+	return fmt.Sprintf(`%q matches multiple auto-discovered %ss:
+%v
+
+Use the full resource name that was generated by the Teleport Discovery service`,
+		name, resDesc, strings.Join(matchedNames, "\n"))
+}
+
+// MakeNameOrDiscoveredNamePredicate returns a predicate that matches resources
+// by name or by "discovered name" label.
+func MakeNameOrDiscoveredNamePredicate(name string) string {
+	matchName := fmt.Sprintf("name == %q", name)
+	matchDiscoveredName := fmt.Sprintf("labels[%q] == %q",
+		types.DiscoveredNameLabel, name,
+	)
+	return fmt.Sprintf("(%v) || (%v)",
+		matchName, matchDiscoveredName,
+	)
+}
+
+func GetClusterNames(
+	ctx context.Context, client *apiclient.Client, connectedClusterName string,
+) ([]string, error) {
+	allClusterNames := []string{connectedClusterName}
+
+	leafClusters, err := client.GetRemoteClusters(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	for _, lc := range leafClusters {
+		allClusterNames = append(allClusterNames, lc.GetName())
+	}
+
+	return allClusterNames, nil
+}
diff --git a/lib/tbot/internal/sds/handler.go b/lib/tbot/internal/sds/handler.go
new file mode 100644
index 0000000000000..ab7c2fb4e791f
--- /dev/null
+++ b/lib/tbot/internal/sds/handler.go
@@ -0,0 +1,668 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package sds
+
+import (
+	"context"
+	"encoding/pem"
+	"errors"
+	"io"
+	"log/slog"
+	"maps"
+	"slices"
+	"time"
+
+	corev3pb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	tlsv3pb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	discoveryv3pb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	"github.com/gravitational/trace"
+	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
+	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/anypb"
+
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// The following constants allow querying this API for SVIDs and trust bundles
+// without knowing their names. These special values are relied upon by tools
+// like Istio.
+const (
+	// EnvoyDefaultSVIDName indicates that the first available SVID should be
+	// returned.
+	EnvoyDefaultSVIDName = "default"
+	// EnvoyDefaultBundleName indicates that the default trust bundle should be
+	// returned, e.g the one for the trust domain that the workload is part of.
+	EnvoyDefaultBundleName = "ROOTCA"
+	// EnvoyAllBundlesName indicates that all available trust bundles,
+	// including federated ones, should be returned.
+	EnvoyAllBundlesName = "ALL"
+)
+
+// BundleSetGetter is an interface for retrieving trust bundle sets.
+type BundleSetGetter interface {
+	GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error)
+}
+
+// SVIDFetcher is a function type for fetching X509 SVIDs.
+type SVIDFetcher func(ctx context.Context, localBundle *spiffebundle.Bundle) ([]*workloadpb.X509SVID, error)
+
+// ClientAuthenticator is a function type that authenticates clients and returns
+// a logger and SVID fetcher for the authenticated client.
+type ClientAuthenticator func(ctx context.Context) (*slog.Logger, SVIDFetcher, error)
+
+// HandlerConfig contains the configuration for creating a new SDS handler.
+type HandlerConfig struct {
+	Logger              *slog.Logger
+	RenewalInterval     time.Duration
+	TrustBundleCache    BundleSetGetter
+	ClientAuthenticator ClientAuthenticator
+}
+
+// CheckAndSetDefaults validates the HandlerConfig and sets default values.
+func (cfg *HandlerConfig) CheckAndSetDefaults() error {
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	if cfg.RenewalInterval <= 0 {
+		return trace.BadParameter("RenewalInterval must be positive")
+	}
+	if cfg.TrustBundleCache == nil {
+		return trace.BadParameter("TrustBundleCache is required")
+	}
+	if cfg.ClientAuthenticator == nil {
+		return trace.BadParameter("ClientAuthenticator is required")
+	}
+	return nil
+}
+
+// Handler implements an Envoy SDS API.
+//
+// This effectively replaces the Workload API for Envoy, but functions in a
+// very similar way.
+type Handler struct {
+	log                 *slog.Logger
+	renewalInterval     time.Duration
+	trustBundleCache    BundleSetGetter
+	clientAuthenticator ClientAuthenticator
+}
+
+// NewHandler creates a new SDS handler with the provided configuration.
+func NewHandler(cfg HandlerConfig) (*Handler, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err, "validating handler config")
+	}
+
+	return &Handler{
+		log:                 cfg.Logger,
+		renewalInterval:     cfg.RenewalInterval,
+		trustBundleCache:    cfg.TrustBundleCache,
+		clientAuthenticator: cfg.ClientAuthenticator,
+	}, nil
+}
+
+// FetchSecrets implements
+// envoy.service.secret.v3/SecretDiscoveryService.FetchSecrets.
+// This should return the current SVIDs and trust bundles.
+//
+// See:
+// - DiscoveryRequest - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryrequest
+// - DiscoveryResponse - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryresponse
+func (h *Handler) FetchSecrets(
+	ctx context.Context,
+	req *discoveryv3pb.DiscoveryRequest,
+) (*discoveryv3pb.DiscoveryResponse, error) {
+	if err := enforceMinimumEnvoyVersion(req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	log, fetchSVIDs, err := h.clientAuthenticator(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "authenticating client")
+	}
+
+	log.DebugContext(
+		ctx,
+		"SecretDiscoveryService.FetchSecrets request received from workload",
+		slog.Group("req", "resource_names", req.ResourceNames),
+	)
+	defer log.DebugContext(ctx, "SecretDiscoveryService.FetchSecrets request handled")
+
+	bundleSet, err := h.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting trust bundle set")
+	}
+
+	svids, err := fetchSVIDs(ctx, bundleSet.Local)
+	if err != nil {
+		return nil, trace.Wrap(err, "fetching X509 SVIDs")
+	}
+
+	return h.generateResponse(
+		bundleSet,
+		svids,
+		req,
+	)
+}
+
+// StreamSecrets implements
+// envoy.service.secret.v3/SecretDiscoveryService.StreamSecrets.
+// This should return the current SVIDs and CAs, and stream any future updates.
+//
+// This is a little more complex than one might expect since Envoy provides
+// an ACK/NACK mechanism to indicate that the config included within a response
+// was successfully applied.
+//
+// From the docs on the request version_info field:
+//
+//	The version_info provided in the request messages will be the
+//	version_info received with the most recent successfully processed
+//	response or empty on the first request. It is expected that no new
+//	request is sent after a response is received until the Envoy
+//	instance is ready to ACK/NACK the new configuration. ACK/NACK takes
+//	place by returning the new API config version as applied or the
+//	previous API config version respectively.
+//
+// From the docs on the DiscoveryRequest.response_nonce field:
+//
+//	nonce corresponding to DiscoveryResponse being ACK/NACKed. See above
+//	discussion on version_info and the DiscoveryResponse nonce comment
+//
+// From the docs on the DiscoveryResponse.nonce field:
+//
+//	For gRPC based subscriptions, the nonce provides a way to explicitly ack a
+//	specific DiscoveryResponse in a following DiscoveryRequest. Additional
+//	messages may have been sent by Envoy to the management server for the
+//	previous version on the stream prior to this DiscoveryResponse, that were
+//	unprocessed at response send time. The nonce allows the management server to
+//	ignore any further DiscoveryRequests for the previous version until a
+//	DiscoveryRequest bearing the nonce.
+//
+// See also:
+// - DiscoveryRequest - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryrequest
+// - DiscoveryResponse - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryresponse
+//
+// TODO: We could probably be smarter about how we handle the version e.g,
+// do we need to send another response if we're just going to send identical
+// certificates ??
+func (h *Handler) StreamSecrets(
+	srv secretv3pb.SecretDiscoveryService_StreamSecretsServer,
+) error {
+	ctx := srv.Context()
+	log, fetchSVIDs, err := h.clientAuthenticator(ctx)
+	if err != nil {
+		return trace.Wrap(err, "authenticating client")
+	}
+
+	log.DebugContext(
+		ctx,
+		"SecretDiscoveryService.StreamSecrets stream started",
+	)
+	defer log.DebugContext(ctx, "SecretDiscoveryService.FetchSecrets stream finished")
+
+	bundleSet, err := h.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting trust bundle set")
+	}
+
+	// Push incoming messages into a chan for the main loop to handle
+	recvCh := make(chan *discoveryv3pb.DiscoveryRequest, 1)
+	recvErrCh := make(chan error, 1)
+	go func() {
+		for {
+			req, err := srv.Recv()
+			if err != nil {
+				// It's worth noting that we'll receive an IOF/Canceled error
+				// here once the main goroutine has exited or the client goes
+				// away.
+				select {
+				case recvErrCh <- err:
+				default:
+				}
+				return
+			}
+			recvCh <- req
+		}
+	}()
+
+	renewalTimer := time.NewTimer(h.renewalInterval)
+	// Stop the timer immediately so we can start timing after the first
+	// response is sent.
+	renewalTimer.Stop()
+	defer renewalTimer.Stop()
+
+	// Track the last response and last request to allow us to handle ACK/NACK
+	// and versioning.
+	var (
+		lastResp *discoveryv3pb.DiscoveryResponse
+		lastReq  *discoveryv3pb.DiscoveryRequest
+		svids    []*workloadpb.X509SVID
+	)
+	for {
+		select {
+		case err := <-recvErrCh:
+			// If we receive an error from the read side, we should exit.
+			// This error could be an EOF/Canceled error if the client
+			// goes away.
+			if errors.Is(err, io.EOF) || errors.Is(err, context.Canceled) {
+				return nil
+			}
+			return trace.Wrap(err)
+		case newReq := <-recvCh:
+			log.DebugContext(
+				ctx,
+				"Received StreamSecrets DiscoveryRequest",
+				slog.Group(
+					"req",
+					"resource_names", newReq.ResourceNames,
+					"version_info", newReq.VersionInfo,
+					"response_nonce", newReq.ResponseNonce,
+					"node_id", newReq.Node.GetId(),
+				),
+			)
+
+			shouldRespond := true
+
+			// If we've sent a response, then this request ought to be a reply
+			// We should check the nonces/versions to ensure it's successfully
+			// applied
+			if lastResp != nil {
+				// Envoy can send an "ErrorDetails" which indicates that the
+				// previously sent response could not be applied.
+				if newReq.ErrorDetail != nil {
+					log.WarnContext(
+						ctx,
+						"Envoy was unable to apply previous discovery response",
+						"error", newReq.ErrorDetail.Message,
+					)
+				}
+
+				if lastResp.Nonce != newReq.ResponseNonce {
+					log.WarnContext(
+						ctx,
+						"Envoy sent a nonce which does not match the last response, ignoring request",
+						"want", lastResp.Nonce,
+						"got", newReq.ResponseNonce,
+					)
+					// We want to ignore this request because it's been sent
+					// before Envoy has processed our last response.
+					continue
+				}
+
+				// Since we've already sent them a response, we should only
+				// respond again if they've changed what they've requested.
+				shouldRespond = !elementsMatch(
+					lastReq.ResourceNames, newReq.ResourceNames,
+				)
+				// TODO(noah): SPIRE's implementation seems to check the last
+				// requests resource names - but I wonder if it makes more sense
+				// to compare the requests resource names against those sent in
+				// the last response.
+			}
+
+			lastReq = newReq
+			if !shouldRespond {
+				continue
+			}
+
+		case <-bundleSet.Stale():
+			newBundleSet, err := h.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err, "getting trust bundle set")
+			}
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the "local" trust domain's CA has changed, we need to
+				// reissue the SVIDs.
+				svids = nil
+			}
+			bundleSet = newBundleSet
+		case <-renewalTimer.C:
+			// Handle renewal time!
+			log.DebugContext(ctx, "Renewing SVIDs for StreamSecrets stream")
+		}
+
+		// Fetch the SVIDs if necessary
+		if svids == nil {
+			svids, err = fetchSVIDs(ctx, bundleSet.Local)
+			if err != nil {
+				return trace.Wrap(err, "fetching X509 SVIDs")
+			}
+		}
+
+		resp, err := h.generateResponse(
+			bundleSet, svids, lastReq,
+		)
+		if err != nil {
+			return trace.Wrap(err, "generating response")
+		}
+
+		// Decorate the generated response with the stream ACK/NACK and
+		// versioning fields.
+		nonce, err := utils.CryptoRandomHex(4)
+		if err != nil {
+			return trace.Wrap(err, "generating nonce")
+		}
+		resp.Nonce = nonce
+		resp.VersionInfo = time.Now().UTC().Format(time.RFC3339Nano)
+		if err := srv.Send(resp); err != nil {
+			return trace.Wrap(err, "sending response")
+		}
+		lastResp = resp
+		log.DebugContext(
+			ctx,
+			"Sent StreamSecrets DiscoveryResponse",
+			slog.Group(
+				"resp",
+				"resources_len", len(resp.Resources),
+				"nonce", resp.Nonce,
+				"version_info", resp.VersionInfo,
+			),
+		)
+
+		renewalTimer.Reset(h.renewalInterval)
+	}
+}
+
+// DeltaSecrets implements
+// envoy.service.secret.v3/SecretDiscoveryService.DeltaSecrets.
+// We do not implement this method.
+func (h *Handler) DeltaSecrets(
+	_ secretv3pb.SecretDiscoveryService_DeltaSecretsServer,
+) error {
+	return status.Error(
+		codes.Unimplemented,
+		"method not implemented",
+	)
+}
+
+// generateResponse generates a DiscoveryResponse for the given bundle set, SVIDs, and request.
+func (h *Handler) generateResponse(
+	bundleSet *workloadidentity.BundleSet,
+	svids []*workloadpb.X509SVID,
+	req *discoveryv3pb.DiscoveryRequest,
+) (*discoveryv3pb.DiscoveryResponse, error) {
+	// names holds all names requested by the client
+	// if this is nothing, we assume they want everything available to them.
+	// it's worth keeping in mind that there's some special names we need to
+	// handle.
+	names := map[string]bool{}
+	for _, name := range req.ResourceNames {
+		// Ignore empty string
+		if name != "" {
+			names[name] = true
+		}
+	}
+	returnAll := len(names) == 0
+
+	var resources []*anypb.Any
+	for i, svid := range svids {
+		// Now we need to filter the SVIDs down to those requested by the
+		// client.
+		// There's a special case here, if they've requested the default SVID,
+		// we want to ensure that the first SVID is returned and its name
+		// overrridden.
+
+		switch {
+		case returnAll || names[svid.SpiffeId]:
+			secret, err := newTLSV3Certificate(svid, "")
+			if err != nil {
+				return nil, trace.Wrap(err, "creating TLS certificate")
+			}
+			resources = append(resources, secret)
+			delete(names, svid.SpiffeId)
+		case names[EnvoyDefaultSVIDName] && i == 0:
+			secret, err := newTLSV3Certificate(svid, EnvoyDefaultSVIDName)
+			if err != nil {
+				return nil, trace.Wrap(err, "creating TLS certificate")
+			}
+			resources = append(resources, secret)
+			delete(names, EnvoyDefaultSVIDName)
+		}
+	}
+
+	// Convert trust bundle to SDS validator type.
+	switch {
+	case returnAll || names[bundleSet.Local.TrustDomain().IDString()]:
+		// If this name was explicitly specified or no names were specified,
+		// we use the proper trust domain ID as the resource name.
+		validator, err := newTLSV3ValidationContext(
+			[]*spiffebundle.Bundle{
+				bundleSet.Local,
+			}, bundleSet.Local.TrustDomain().IDString(),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating TLS validation context")
+		}
+		resources = append(resources, validator)
+		delete(names, bundleSet.Local.TrustDomain().IDString())
+	case names[EnvoyDefaultBundleName]:
+		// If they've requested the default bundle, we send the connected trust
+		// domain's bundle - but - we override the name to match what they
+		// expect.
+		validator, err := newTLSV3ValidationContext(
+			[]*spiffebundle.Bundle{
+				bundleSet.Local,
+			}, EnvoyDefaultBundleName,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating TLS validation context")
+		}
+		resources = append(resources, validator)
+		delete(names, EnvoyDefaultBundleName)
+	case names[EnvoyAllBundlesName]:
+		// Return all the trust bundles as part of a single validation context.
+		// We'll also override the name to match what they requested.
+		bundles := slices.Collect(maps.Values(bundleSet.Federated))
+		bundles = append(bundles, bundleSet.Local)
+		validator, err := newTLSV3ValidationContext(
+			bundles, EnvoyAllBundlesName,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating TLS validation context")
+		}
+		resources = append(resources, validator)
+		delete(names, EnvoyAllBundlesName)
+	}
+
+	if returnAll {
+		for _, bundle := range bundleSet.Federated {
+			validator, err := newTLSV3ValidationContext(
+				[]*spiffebundle.Bundle{
+					bundle,
+				}, bundle.TrustDomain().IDString(),
+			)
+			if err != nil {
+				return nil, trace.Wrap(err, "creating TLS validation context")
+			}
+			resources = append(resources, validator)
+		}
+	} else {
+		// For any remaining names, see if they match any federated trust bundles.
+		for name := range maps.Keys(names) {
+			var found *spiffebundle.Bundle
+			for _, bundle := range bundleSet.Federated {
+				if name == bundle.TrustDomain().IDString() {
+					found = bundle
+					break
+				}
+			}
+			if found != nil {
+				validator, err := newTLSV3ValidationContext(
+					[]*spiffebundle.Bundle{
+						found,
+					}, found.TrustDomain().IDString(),
+				)
+				if err != nil {
+					return nil, trace.Wrap(err, "creating TLS validation context")
+				}
+				resources = append(resources, validator)
+				delete(names, name)
+			}
+		}
+	}
+
+	// If any names are left-over, we've not been able to service them so
+	// we should return an explicit error rather than omitting data.
+	if len(names) > 0 {
+		return nil, trace.BadParameter("unknown resource names: %v", slices.Collect(maps.Keys(names)))
+	}
+
+	return &discoveryv3pb.DiscoveryResponse{
+		// Copy in requested type from req
+		TypeUrl:   req.TypeUrl,
+		Resources: resources,
+	}, nil
+}
+
+// elementsMatch compares two string slices for equality, ignoring order.
+func elementsMatch(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	seen := map[string]bool{}
+	for _, v := range a {
+		seen[v] = true
+	}
+	for _, v := range b {
+		if !seen[v] {
+			return false
+		}
+	}
+	return true
+}
+
+// enforceMinimumEnvoyVersion ensures that the client is running a minimum version of Envoy.
+func enforceMinimumEnvoyVersion(req *discoveryv3pb.DiscoveryRequest) error {
+	// Envoy 1.18 introduced the SPIFFE specific tls context validator - so
+	// that's our minimum supported version.
+	buildVersion := req.Node.GetUserAgentBuildVersion()
+	// If not specified, let's assume that it's recent enough.
+	if buildVersion == nil {
+		return nil
+	}
+	if buildVersion.Version.MajorNumber > 1 {
+		return nil
+	}
+	if buildVersion.Version.MinorNumber >= 18 {
+		return nil
+	}
+	return trace.BadParameter("minimum supported version of envoy supported by the tbot SDS API is 1.18")
+}
+
+// newTLSV3Certificate creates a new TLS certificate secret for the given SVID.
+func newTLSV3Certificate(
+	svid *workloadpb.X509SVID, overrideResourceName string,
+) (*anypb.Any, error) {
+	// noah: This section of code does not currently support intermediate
+	// certificates, but, we don't currently use them.
+	certBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: svid.X509Svid,
+	})
+	privateKeyBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: svid.X509SvidKey,
+	})
+
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#envoy-v3-api-msg-extensions-transport-sockets-tls-v3-tlscertificate
+	secret := &tlsv3pb.Secret{
+		Name: svid.SpiffeId,
+		Type: &tlsv3pb.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3pb.TlsCertificate{
+				CertificateChain: &corev3pb.DataSource{
+					Specifier: &corev3pb.DataSource_InlineBytes{
+						// Must be appended PEM-wrapped X509 certificates
+						InlineBytes: certBytes,
+					},
+				},
+				PrivateKey: &corev3pb.DataSource{
+					Specifier: &corev3pb.DataSource_InlineBytes{
+						// Must be PKCS8 PEM-wrapped private key
+						InlineBytes: privateKeyBytes,
+					},
+				},
+			},
+		},
+	}
+	if overrideResourceName != "" {
+		secret.Name = overrideResourceName
+	}
+
+	return anypb.New(secret)
+}
+
+const envoySPIFFECertValidator = "envoy.tls.cert_validator.spiffe"
+
+// newTLSV3ValidationContext creates a new TLS validation context for the given bundles.
+func newTLSV3ValidationContext(
+	bundles []*spiffebundle.Bundle, resourceName string,
+) (*anypb.Any, error) {
+	var trustDomains []*tlsv3pb.SPIFFECertValidatorConfig_TrustDomain
+	for _, bundle := range bundles {
+		caBytes, err := bundle.X509Bundle().Marshal()
+		if err != nil {
+			return nil, trace.Wrap(err, "marshaling trust bundle")
+		}
+
+		// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto#extensions-transport-sockets-tls-v3-spiffecertvalidatorconfig-trustdomain
+		trustDomain := &tlsv3pb.SPIFFECertValidatorConfig_TrustDomain{
+			// From API reference:
+			//   Note that this must not have "spiffe://" prefix.
+			Name: bundle.TrustDomain().Name(),
+			TrustBundle: &corev3pb.DataSource{
+				Specifier: &corev3pb.DataSource_InlineBytes{
+					// Must be concatenated PEM-wrapped X509 certificates
+					InlineBytes: caBytes,
+				},
+			},
+		}
+		trustDomains = append(trustDomains, trustDomain)
+	}
+
+	// Generate the typed config for the SPIFFE TLS cert validator extension
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto
+	extConfig, err := anypb.New(&tlsv3pb.SPIFFECertValidatorConfig{
+		TrustDomains: trustDomains,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-certificatevalidationcontext
+	secret := &tlsv3pb.Secret{
+		// We intentionally use the full IDString here in contrast to the
+		// short name used in the TrustDomain config block.
+		Name: resourceName,
+		Type: &tlsv3pb.Secret_ValidationContext{
+			ValidationContext: &tlsv3pb.CertificateValidationContext{
+				// We use a custom validation context for SPIFFE to provide
+				// greater usability than a plain TLS CA.
+				CustomValidatorConfig: &corev3pb.TypedExtensionConfig{
+					Name:        envoySPIFFECertValidator,
+					TypedConfig: extConfig,
+				},
+			},
+		},
+	}
+
+	return anypb.New(secret)
+}
diff --git a/lib/tbot/internal/sds/handler_test.go b/lib/tbot/internal/sds/handler_test.go
new file mode 100644
index 0000000000000..4460ad6967bbb
--- /dev/null
+++ b/lib/tbot/internal/sds/handler_test.go
@@ -0,0 +1,195 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package sds
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/pem"
+	"log/slog"
+	"os"
+	"testing"
+	"time"
+
+	discoveryv3pb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	"github.com/google/go-cmp/cmp"
+	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
+	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type mockTrustBundleCache struct {
+	currentBundle *workloadidentity.BundleSet
+}
+
+func (m *mockTrustBundleCache) GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error) {
+	return m.currentBundle, nil
+}
+
+// TestSDS_FetchSecrets performs a unit-test over the FetchSecrets method.
+// It tests the generation of the DiscoveryResponses and that authentication
+// is enforced.
+func TestSDS_FetchSecrets(t *testing.T) {
+	log := logtest.NewLogger()
+	ctx := context.Background()
+
+	td, err := spiffeid.TrustDomainFromString("example.com")
+	require.NoError(t, err)
+
+	b, _ := pem.Decode([]byte(fixtures.TLSCACertPEM))
+	require.NotNil(t, b, "Decode failed")
+	ca, err := x509.ParseCertificate(b.Bytes)
+	require.NoError(t, err)
+
+	clientAuthenticator := func(ctx context.Context) (*slog.Logger, SVIDFetcher, error) {
+		return log, func(ctx context.Context, localBundle *spiffebundle.Bundle) ([]*workloadpb.X509SVID, error) {
+			return []*workloadpb.X509SVID{
+				{
+					SpiffeId:    "spiffe://example.com/default",
+					X509Svid:    []byte("CERT-spiffe://example.com/default"),
+					X509SvidKey: []byte("KEY-spiffe://example.com/default"),
+					Bundle:      workloadidentity.MarshalX509Bundle(localBundle.X509Bundle()),
+				},
+				{
+					SpiffeId:    "spiffe://example.com/second",
+					X509Svid:    []byte("CERT-spiffe://example.com/second"),
+					X509SvidKey: []byte("KEY-spiffe://example.com/second"),
+					Bundle:      workloadidentity.MarshalX509Bundle(localBundle.X509Bundle()),
+				},
+			}, nil
+		}, nil
+	}
+
+	bundle := spiffebundle.New(td)
+	bundle.AddX509Authority(ca)
+
+	federatedBundle := spiffebundle.New(spiffeid.RequireTrustDomainFromString("federated.example.com"))
+	federatedBundle.AddX509Authority(ca)
+
+	mockBundleCache := &mockTrustBundleCache{
+		currentBundle: &workloadidentity.BundleSet{
+			Local: bundle,
+			Federated: map[string]*spiffebundle.Bundle{
+				"federated.example.com": federatedBundle,
+			},
+		},
+	}
+
+	tests := []struct {
+		name string
+
+		resourceNames []string
+
+		wantErr string
+	}{
+		{
+			name:          "all",
+			resourceNames: []string{},
+		},
+		{
+			name: "specific svid",
+			resourceNames: []string{
+				"spiffe://example.com/second",
+			},
+		},
+		{
+			name: "specific ca",
+			resourceNames: []string{
+				"spiffe://example.com",
+			},
+		},
+		{
+			name: "specific ca federated",
+			resourceNames: []string{
+				"spiffe://federated.example.com",
+			},
+		},
+		{
+			name: "special default",
+			resourceNames: []string{
+				EnvoyDefaultSVIDName,
+			},
+		},
+		{
+			name: "special ROOTCA",
+			resourceNames: []string{
+				EnvoyDefaultBundleName,
+			},
+		},
+		{
+			name: "special ALL",
+			resourceNames: []string{
+				EnvoyAllBundlesName,
+			},
+		},
+		{
+			name:          "no results",
+			resourceNames: []string{"spiffe://example.com/not-matching"},
+			wantErr:       "unknown resource names: [spiffe://example.com/not-matching]",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sdsHandler, err := NewHandler(HandlerConfig{
+				Logger:              log,
+				RenewalInterval:     time.Minute,
+				TrustBundleCache:    mockBundleCache,
+				ClientAuthenticator: clientAuthenticator,
+			})
+			require.NoError(t, err)
+
+			req := &discoveryv3pb.DiscoveryRequest{
+				TypeUrl:       "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
+				ResourceNames: tt.resourceNames,
+			}
+
+			res, err := sdsHandler.FetchSecrets(ctx, req)
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			if golden.ShouldSet() {
+				resBytes, err := protojson.MarshalOptions{
+					Multiline: true,
+				}.Marshal(res)
+				require.NoError(t, err)
+				golden.Set(t, resBytes)
+			}
+
+			want := &discoveryv3pb.DiscoveryResponse{}
+			require.NoError(t, protojson.UnmarshalOptions{}.Unmarshal(golden.Get(t), want))
+			require.Empty(t, cmp.Diff(res, want, protocmp.Transform()))
+		})
+	}
+}
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/all.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/all.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/all.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/all.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/special_ALL.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_ALL.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/special_ALL.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_ALL.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/special_ROOTCA.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_ROOTCA.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/special_ROOTCA.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_ROOTCA.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/special_default.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_default.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/special_default.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/special_default.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/specific_ca.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_ca.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/specific_ca.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_ca.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/specific_ca_federated.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_ca_federated.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/specific_ca_federated.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_ca_federated.golden
diff --git a/lib/tbot/testdata/TestSDS_FetchSecrets/specific_svid.golden b/lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_svid.golden
similarity index 100%
rename from lib/tbot/testdata/TestSDS_FetchSecrets/specific_svid.golden
rename to lib/tbot/internal/sds/testdata/TestSDS_FetchSecrets/specific_svid.golden
diff --git a/lib/tbot/loop.go b/lib/tbot/loop.go
deleted file mode 100644
index a5a9f7776909a..0000000000000
--- a/lib/tbot/loop.go
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"log/slog"
-	"math"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/prometheus/client_golang/prometheus"
-
-	"github.com/gravitational/teleport/api/utils/retryutils"
-)
-
-var (
-	loopIterationsCounter = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "tbot_task_iterations_total",
-			Help: "Number of task iteration attempts, not counting retries",
-		}, []string{"service", "name"},
-	)
-	loopIterationsSuccessCounter = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name:    "tbot_task_iterations_successful",
-			Help:    "Histogram of task iterations that ultimately succeeded, bucketed by number of retries before success",
-			Buckets: []float64{0, 1, 2, 3, 4, 5},
-		}, []string{"service", "name"},
-	)
-	loopIterationsFailureCounter = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "tbot_task_iterations_failed",
-			Help: "Number of task iterations that ultimately failed, not counting retries",
-		}, []string{"service", "name"},
-	)
-	loopIterationTime = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name:    "tbot_task_iteration_duration_seconds",
-			Help:    "Time between beginning and ultimate end of one task iteration regardless of outcome, including all retries",
-			Buckets: prometheus.ExponentialBuckets(0.1, 1.75, 6),
-		}, []string{"service", "name"},
-	)
-)
-
-type runOnIntervalConfig struct {
-	service string
-	name    string
-	f       func(ctx context.Context) error
-	clock   clockwork.Clock
-	// reloadCh allows the task to be triggered immediately, ideal for handling
-	// CA rotations or a manual signal from a user.
-	// reloadCh can be nil, in which case, the task will only run on the
-	// interval.
-	reloadCh             chan struct{}
-	log                  *slog.Logger
-	interval             time.Duration
-	retryLimit           int
-	exitOnRetryExhausted bool
-	waitBeforeFirstRun   bool
-}
-
-// runOnInterval runs a function on a given interval, with retries and jitter.
-//
-// TODO(noah): Emit Prometheus metrics for:
-// - Time of next attempt
-func runOnInterval(ctx context.Context, cfg runOnIntervalConfig) error {
-	switch {
-	case cfg.interval <= 0:
-		return trace.BadParameter("interval must be greater than 0")
-	case cfg.retryLimit < 0:
-		return trace.BadParameter("retryLimit must be greater than or equal to 0")
-	case cfg.log == nil:
-		return trace.BadParameter("log is required")
-	case cfg.f == nil:
-		return trace.BadParameter("f is required")
-	case cfg.name == "":
-		return trace.BadParameter("name is required")
-	}
-
-	log := cfg.log.With("task", cfg.name)
-
-	if cfg.clock == nil {
-		cfg.clock = clockwork.NewRealClock()
-	}
-
-	ticker := cfg.clock.NewTicker(cfg.interval)
-	defer ticker.Stop()
-	jitter := retryutils.DefaultJitter
-	firstRun := true
-	for {
-		if !firstRun || (firstRun && cfg.waitBeforeFirstRun) {
-			select {
-			case <-ctx.Done():
-				return nil
-			case <-ticker.Chan():
-			case <-cfg.reloadCh:
-			}
-		}
-		firstRun = false
-
-		loopIterationsCounter.WithLabelValues(cfg.service, cfg.name).Inc()
-		startTime := time.Now()
-
-		var err error
-		for attempt := 1; attempt <= cfg.retryLimit; attempt++ {
-			log.InfoContext(
-				ctx,
-				"Attempting task",
-				"attempt", attempt,
-				"retry_limit", cfg.retryLimit,
-			)
-			err = cfg.f(ctx)
-			if err == nil {
-				loopIterationsSuccessCounter.WithLabelValues(cfg.service, cfg.name).Observe(float64(attempt - 1))
-				break
-			}
-
-			if attempt != cfg.retryLimit {
-				// exponentially back off with jitter, starting at 1 second.
-				backoffTime := time.Second * time.Duration(math.Pow(2, float64(attempt-1)))
-				backoffTime = jitter(backoffTime)
-				cfg.log.WarnContext(
-					ctx,
-					"Task failed. Backing off and retrying",
-					"attempt", attempt,
-					"retry_limit", cfg.retryLimit,
-					"backoff", backoffTime,
-					"error", err,
-				)
-				select {
-				case <-ctx.Done():
-					// Note: will discard metric update for this loop. It
-					// probably won't be collected if we're shutting down,
-					// anyway.
-					return nil
-				case <-cfg.clock.After(backoffTime):
-				}
-			}
-		}
-
-		loopIterationTime.WithLabelValues(cfg.service, cfg.name).Observe(time.Since(startTime).Seconds())
-
-		if err != nil {
-			loopIterationsFailureCounter.WithLabelValues(cfg.service, cfg.name).Inc()
-
-			if cfg.exitOnRetryExhausted {
-				log.ErrorContext(
-					ctx,
-					"All retry attempts exhausted. Exiting",
-					"error", err,
-					"retry_limit", cfg.retryLimit,
-				)
-				return trace.Wrap(err)
-			}
-			log.WarnContext(
-				ctx,
-				"All retry attempts exhausted. Will wait for next interval",
-				"retry_limit", cfg.retryLimit,
-				"interval", cfg.interval,
-			)
-		} else {
-			log.InfoContext(
-				ctx,
-				"Task succeeded. Waiting interval",
-				"interval", cfg.interval,
-			)
-		}
-	}
-}
diff --git a/lib/tbot/loop_test.go b/lib/tbot/loop_test.go
deleted file mode 100644
index f6778583b2a45..0000000000000
--- a/lib/tbot/loop_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/assert"
-
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func Test_runOnInterval(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	taskCh := make(chan struct{}, 3)
-	log := utils.NewSlogLoggerForTests()
-	clock := clockwork.NewFakeClock()
-	cfg := runOnIntervalConfig{
-		name:  "test",
-		clock: clock,
-		log:   log,
-		f: func(ctx context.Context) error {
-			taskCh <- struct{}{}
-			return nil
-		},
-		retryLimit: 3,
-		interval:   time.Minute * 10,
-	}
-
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		assert.NoError(t, runOnInterval(ctx, cfg))
-	}()
-
-	// Wait for three iterations to have been completed.
-	for i := 0; i < 3; i++ {
-		<-taskCh
-		clock.Advance(time.Minute * 11)
-	}
-
-	// Cancel the ctx and make sure runOnInterval returns
-	cancel()
-	wg.Wait()
-}
-
-func Test_runOnInterval_failureExit(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	callCount := atomic.Int64{}
-
-	log := utils.NewSlogLoggerForTests()
-	testErr := fmt.Errorf("test error")
-	cfg := runOnIntervalConfig{
-		name:  "test",
-		clock: clockwork.NewRealClock(),
-		log:   log,
-		f: func(ctx context.Context) error {
-			callCount.Add(1)
-			return testErr
-		},
-		retryLimit:           2,
-		interval:             time.Second,
-		exitOnRetryExhausted: true,
-	}
-
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		assert.ErrorIs(t, runOnInterval(ctx, cfg), testErr)
-	}()
-
-	wg.Wait()
-	assert.Equal(t, int64(2), callCount.Load())
-}
diff --git a/lib/tbot/output_utils.go b/lib/tbot/output_utils.go
deleted file mode 100644
index b9fa598e7e201..0000000000000
--- a/lib/tbot/output_utils.go
+++ /dev/null
@@ -1,514 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"fmt"
-	"io/fs"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/gravitational/trace"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/constants"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/client/identityfile"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tlsca"
-)
-
-const renewalRetryLimit = 5
-
-// newBotConfigWriter returns a new BotConfigWriter that writes to the given
-// Destination.
-func newBotConfigWriter(ctx context.Context, dest bot.Destination, subPath string) *BotConfigWriter {
-	return &BotConfigWriter{
-		ctx:     ctx,
-		dest:    dest,
-		subpath: subPath,
-	}
-}
-
-// BotConfigWriter is a trivial adapter to use the identityfile package with
-// bot destinations.
-type BotConfigWriter struct {
-	ctx context.Context
-
-	// dest is the Destination that will handle writing of files.
-	dest bot.Destination
-
-	// subpath is the subdirectory within the Destination to which the files
-	// should be written.
-	subpath string
-}
-
-// WriteFile writes the file to the Destination. Only the basename of the path
-// is used. Specified permissions are ignored.
-func (b *BotConfigWriter) WriteFile(name string, data []byte, _ os.FileMode) error {
-	p := filepath.Base(name)
-	if b.subpath != "" {
-		p = filepath.Join(b.subpath, p)
-	}
-
-	return trace.Wrap(b.dest.Write(b.ctx, p, data))
-}
-
-// Remove removes files. This is a dummy implementation that always returns not found.
-func (b *BotConfigWriter) Remove(name string) error {
-	return &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
-}
-
-// Stat checks file status. This implementation always returns not found.
-func (b *BotConfigWriter) Stat(name string) (fs.FileInfo, error) {
-	return nil, &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
-}
-
-// ReadFile reads a given file. This implementation always returns not found.
-func (b *BotConfigWriter) ReadFile(name string) ([]byte, error) {
-	return nil, &os.PathError{Op: "read", Path: name, Err: os.ErrNotExist}
-}
-
-// compile-time assertion that the BotConfigWriter implements the
-// identityfile.ConfigWriter interface
-var _ identityfile.ConfigWriter = (*BotConfigWriter)(nil)
-
-// NewClientKeyRing returns a sane client.KeyRing for the given bot identity.
-func NewClientKeyRing(ident *identity.Identity, hostCAs []types.CertAuthority) (*client.KeyRing, error) {
-	pk, err := keys.ParsePrivateKey(ident.PrivateKeyBytes)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &client.KeyRing{
-		KeyRingIndex: client.KeyRingIndex{
-			ClusterName: ident.ClusterName,
-		},
-		// tbot identities use a single private key for SSH and TLS.
-		SSHPrivateKey: pk,
-		TLSPrivateKey: pk,
-		Cert:          ident.CertBytes,
-		TLSCert:       ident.TLSCertBytes,
-		TrustedCerts:  authclient.AuthoritiesToTrustedCerts(hostCAs),
-
-		// Note: these fields are never used or persisted with identity files,
-		// so we won't bother to set them. (They may need to be reconstituted
-		// on tsh's end based on cert fields, though.)
-		KubeTLSCredentials: make(map[string]client.TLSCredential),
-		DBTLSCredentials:   make(map[string]client.TLSCredential),
-	}, nil
-}
-
-func writeIdentityFile(
-	ctx context.Context, log *slog.Logger, keyRing *client.KeyRing, dest bot.Destination,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"writeIdentityFile",
-	)
-	defer span.End()
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: config.IdentityFilePath,
-		Writer:     newBotConfigWriter(ctx, dest, ""),
-		KeyRing:    keyRing,
-		Format:     identityfile.FormatFile,
-
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	log.DebugContext(ctx, "Wrote identity file", "files", files)
-	return nil
-}
-
-// writeIdentityFileTLS writes the identity file in TLS format according to the
-// core identityfile.Write method. This isn't usually needed but can be
-// useful when writing out TLS certificates with alternative prefix and file
-// extensions for application compatibility reasons.
-func writeIdentityFileTLS(
-	ctx context.Context, log *slog.Logger, keyRing *client.KeyRing, dest bot.Destination,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"writeIdentityFileTLS",
-	)
-	defer span.End()
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: config.DefaultTLSPrefix,
-		Writer:     newBotConfigWriter(ctx, dest, ""),
-		KeyRing:    keyRing,
-		Format:     identityfile.FormatTLS,
-
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	log.DebugContext(ctx, "Wrote TLS identity files", "files", files)
-	return nil
-}
-
-// concatCACerts borrow's identityfile's CA cert concat method.
-func concatCACerts(cas []types.CertAuthority) []byte {
-	trusted := authclient.AuthoritiesToTrustedCerts(cas)
-
-	var caCerts []byte
-	for _, ca := range trusted {
-		for _, cert := range ca.TLSCertificates {
-			caCerts = append(caCerts, cert...)
-		}
-	}
-
-	return caCerts
-}
-
-// writeTLSCAs writes the three "main" TLS CAs to disk.
-// TODO(noah): This is largely a copy of templateTLSCAs. We should reconsider
-// which CAs are actually worth writing for each type of service because
-// it seems inefficient to write the "Database" CA for a Kubernetes output.
-func writeTLSCAs(ctx context.Context, dest bot.Destination, hostCAs, userCAs, databaseCAs []types.CertAuthority) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"writeTLSCAs",
-	)
-	defer span.End()
-
-	// Note: This implementation mirrors tctl's current behavior. I've noticed
-	// that mariadb at least does not seem to like being passed more than one
-	// CA so there may be some compat issues to address in the future for the
-	// rare case where a CA rotation is in progress.
-	if err := dest.Write(ctx, config.HostCAPath, concatCACerts(hostCAs)); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := dest.Write(ctx, config.UserCAPath, concatCACerts(userCAs)); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := dest.Write(ctx, config.DatabaseCAPath, concatCACerts(databaseCAs)); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-// describeTLSIdentity generates an informational message about the given
-// TLS identity, appropriate for user-facing log messages.
-func describeTLSIdentity(ctx context.Context, log *slog.Logger, ident *identity.Identity) string {
-	failedToDescribe := "failed-to-describe"
-	cert := ident.X509Cert
-	if cert == nil {
-		log.WarnContext(ctx, "Attempted to describe TLS identity without TLS credentials.")
-		return failedToDescribe
-	}
-
-	tlsIdent, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
-	if err != nil {
-		log.WarnContext(ctx, "Bot TLS certificate can not be parsed as an identity", "error", err)
-		return failedToDescribe
-	}
-
-	var principals []string
-	for _, principal := range tlsIdent.Principals {
-		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
-			principals = append(principals, principal)
-		}
-	}
-
-	botDesc := ""
-	if tlsIdent.BotInstanceID != "" {
-		botDesc = fmt.Sprintf(", id=%s", tlsIdent.BotInstanceID)
-	}
-
-	duration := cert.NotAfter.Sub(cert.NotBefore)
-	return fmt.Sprintf(
-		"%s%s | valid: after=%v, before=%v, duration=%s | kind=tls, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
-		tlsIdent.BotName,
-		botDesc,
-		cert.NotBefore.Format(time.RFC3339),
-		cert.NotAfter.Format(time.RFC3339),
-		duration,
-		tlsIdent.Renewable,
-		tlsIdent.DisallowReissue,
-		tlsIdent.Groups,
-		principals,
-		tlsIdent.Generation,
-	)
-}
-
-// identityConfigurator is a function that alters a cert request
-type identityConfigurator = func(req *proto.UserCertsRequest)
-
-// generateIdentity uses an identity to retrieve an impersonated identity.
-// The `configurator` function, if not nil, can be used to add additional
-// requests to the certificate request, for example to add `RouteToDatabase`
-// and similar fields, however in that case it must be called with an
-// impersonated identity that already has the relevant permissions, much like
-// `tsh (app|db|kube) login` is already used to generate an additional set of
-// certs.
-func generateIdentity(
-	ctx context.Context,
-	client *authclient.Client,
-	currentIdentity *identity.Identity,
-	roles []string,
-	ttl time.Duration,
-	configurator identityConfigurator,
-) (*identity.Identity, error) {
-	ctx, span := tracer.Start(ctx, "generateIdentity")
-	defer span.End()
-
-	// TODO: enforce expiration > renewal period (by what margin?)
-	//   This should be ignored if a renewal has been triggered manually or
-	//   by a CA rotation.
-
-	req := proto.UserCertsRequest{
-		Username:       currentIdentity.X509Cert.Subject.CommonName,
-		Expires:        time.Now().Add(ttl),
-		RoleRequests:   roles,
-		RouteToCluster: currentIdentity.ClusterName,
-
-		// Make sure to specify this is an impersonated cert request. If unset,
-		// auth cannot differentiate renewable vs impersonated requests when
-		// len(roleRequests) == 0.
-		UseRoleRequests: true,
-	}
-
-	if configurator != nil {
-		configurator(&req)
-	}
-
-	keyPurpose := cryptosuites.BotImpersonatedIdentity
-	if req.RouteToDatabase.ServiceName != "" {
-		// We still used RSA for all database clients, all other bot
-		// impersonated identities can use ECDSA.
-		keyPurpose = cryptosuites.DatabaseClient
-	}
-
-	// Generate a fresh keypair for the impersonated identity. We don't care to
-	// reuse keys here, constantly rotate private keys to limit their effective
-	// lifetime.
-	key, err := cryptosuites.GenerateKey(ctx,
-		cryptosuites.GetCurrentSuiteFromAuthPreference(client),
-		keyPurpose)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	sshPub, err := ssh.NewPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	req.SSHPublicKey = ssh.MarshalAuthorizedKey(sshPub)
-
-	req.TLSPublicKey, err = keys.MarshalPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// First, ask the auth server to generate a new set of certs with a new
-	// expiration date.
-	certs, err := client.GenerateUserCerts(ctx, req)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// The root CA included with the returned user certs will only contain the
-	// Teleport User CA. We'll also need the host CA for future API calls.
-	localCA, err := client.GetClusterCACert(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	caCerts, err := tlsca.ParseCertificatePEMs(localCA.TLSCA)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Append the host CAs from the auth server.
-	for _, cert := range caCerts {
-		pemBytes, err := tlsca.MarshalCertificatePEM(cert)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		certs.TLSCACerts = append(certs.TLSCACerts, pemBytes)
-	}
-
-	// Do not trust SSH CA certs as returned by GenerateUserCerts() with an
-	// impersonated identity. It only returns the SSH UserCA in this context,
-	// but we also need the HostCA and can't directly set `includeHostCA` as
-	// part of the UserCertsRequest.
-	// Instead, copy the SSHCACerts from the primary identity.
-	certs.SSHCACerts = currentIdentity.SSHCACertBytes
-
-	privateKeyPEM, err := keys.MarshalPrivateKey(key)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	newIdentity, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: privateKeyPEM,
-		PublicKeyBytes:  req.SSHPublicKey,
-	}, certs)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return newIdentity, nil
-}
-
-// warnOnEarlyExpiration logs a warning if the given identity is likely to
-// expire problematically early. This can happen if either the configured TTL is
-// less than the renewal interval, or if the server returns certs valid for a
-// shorter-than-expected period of time.
-// This assumes the identity was just renewed, for the purposes of calculating
-// TTLs, and may log false positive warnings if the time delta is large; the
-// time calculations include a 1m buffer to mitigate this.
-func warnOnEarlyExpiration(
-	ctx context.Context,
-	log *slog.Logger,
-	ident *identity.Identity,
-	lifetime config.CredentialLifetime,
-) {
-	// Calculate a rough TTL, assuming this was called shortly after the
-	// identity was returned. We'll add a minute buffer to compensate and avoid
-	// superfluous warning messages.
-	effectiveTTL := time.Until(ident.TLSIdentity.Expires) + time.Minute
-
-	if effectiveTTL < lifetime.TTL {
-		l := log.With(
-			"requested_ttl", lifetime.TTL,
-			"renewal_interval", lifetime.RenewalInterval,
-			"effective_ttl", effectiveTTL,
-			"expires", ident.TLSIdentity.Expires,
-			"roles", ident.TLSIdentity.Groups,
-		)
-
-		// TODO(timothyb89): we can technically fetch our individual roles
-		// without explicit permission, and could determine which role in
-		// particular limited the TTL.
-
-		if effectiveTTL < lifetime.RenewalInterval {
-			//nolint:sloglint // multiline string is actually constant
-			l.WarnContext(ctx, "The server returned an identity shorter than "+
-				"expected and below the configured renewal interval, probably "+
-				"due to a `max_session_ttl` configured on a server-side role. "+
-				"Unless corrected, the credentials will be invalid for some "+
-				"period until renewal.")
-		} else {
-			//nolint:sloglint // multiline string is actually constant
-			l.WarnContext(ctx, "The server returned an identity shorter than "+
-				"the requested TTL, probably due to a `max_session_ttl` "+
-				"configured on a server-side role. It may not remain valid as "+
-				"long as expected.")
-		}
-	}
-}
-
-// fetchDefaultRoles requests the bot's own role from the auth server and
-// extracts its full list of allowed roles.
-func fetchDefaultRoles(ctx context.Context, roleGetter services.RoleGetter, identity *identity.Identity) ([]string, error) {
-	role, err := roleGetter.GetRole(ctx, identity.X509Cert.Subject.CommonName)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	conditions := role.GetImpersonateConditions(types.Allow)
-	return conditions.Roles, nil
-}
-
-// chooseOneResource chooses one matched resource by name, or tries to choose
-// one resource by unambiguous "discovered name".
-func chooseOneResource[T types.ResourceWithLabels](resources []T, name, resDesc string) (T, error) {
-	for _, r := range resources {
-		if r.GetName() == name {
-			return r, nil
-		}
-	}
-
-	// look for an unambiguous "discovered name" match as a fallback.
-	var matches []T
-	for _, r := range resources {
-		discoveredName, ok := r.GetLabel(types.DiscoveredNameLabel)
-		if ok && discoveredName == name {
-			matches = append(matches, r)
-		}
-	}
-	switch len(matches) {
-	case 0:
-		var out T
-		return out, trace.NotFound("%s %q not found", resDesc, name)
-	case 1:
-		return matches[0], nil
-	default:
-		var out T
-		errMsg := formatAmbiguousMessage(name, resDesc, matches)
-		return out, trace.BadParameter("%s", errMsg)
-	}
-}
-
-// formatAmbiguousMessage formats a generic error message that describes an ambiguous
-// auto-discovered resource name match error.
-func formatAmbiguousMessage[T types.ResourceWithLabels](name, resDesc string, matches []T) string {
-	matchedNames := make([]string, 0, len(matches))
-	for _, match := range matches {
-		matchedNames = append(matchedNames, match.GetName())
-	}
-	slices.Sort(matchedNames)
-	return fmt.Sprintf(`%q matches multiple auto-discovered %ss:
-%v
-
-Use the full resource name that was generated by the Teleport Discovery service`,
-		name, resDesc, strings.Join(matchedNames, "\n"))
-}
-
-// makeNameOrDiscoveredNamePredicate returns a predicate that matches resources
-// by name or by "discovered name" label.
-func makeNameOrDiscoveredNamePredicate(name string) string {
-	matchName := fmt.Sprintf("name == %q", name)
-	matchDiscoveredName := fmt.Sprintf("labels[%q] == %q",
-		types.DiscoveredNameLabel, name,
-	)
-	return fmt.Sprintf("(%v) || (%v)",
-		matchName, matchDiscoveredName,
-	)
-}
diff --git a/lib/tbot/readyz/http.go b/lib/tbot/readyz/http.go
new file mode 100644
index 0000000000000..139c88b0c3490
--- /dev/null
+++ b/lib/tbot/readyz/http.go
@@ -0,0 +1,86 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package readyz
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+)
+
+// ReadOnlyRegistry is a version of the Registry which can only be read from,
+// not reported to.
+type ReadOnlyRegistry interface {
+	ServiceStatus(name string) (*ServiceStatus, bool)
+	OverallStatus() *OverallStatus
+}
+
+// HTTPHandler returns an HTTP handler that implements tbot's
+// /readyz(/{service}) endpoints.
+func HTTPHandler(reg ReadOnlyRegistry) http.Handler {
+	mux := http.NewServeMux()
+
+	mux.Handle("/readyz/{service}", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+
+		status, ok := reg.ServiceStatus(r.PathValue("service"))
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			if err := writeJSON(w, struct {
+				Error string `json:"error"`
+			}{
+				fmt.Sprintf("Service named %q not found.", r.PathValue("service")),
+			}); err != nil {
+				slog.ErrorContext(r.Context(), "Failed to write response", "error", err)
+			}
+			return
+		}
+
+		w.WriteHeader(status.Status.HTTPStatusCode())
+		if err := writeJSON(w, status); err != nil {
+			slog.ErrorContext(r.Context(), "Failed to write response", "error", err)
+		}
+	}))
+
+	mux.Handle("/readyz", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		status := reg.OverallStatus()
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status.Status.HTTPStatusCode())
+
+		if err := writeJSON(w, status); err != nil {
+			slog.ErrorContext(r.Context(), "Failed to write response", "error", err)
+		}
+	}))
+
+	return mux
+}
+
+func writeJSON(w io.Writer, v any) error {
+	output, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return err
+	}
+	if _, err := w.Write(output); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/lib/tbot/readyz/readyz.go b/lib/tbot/readyz/readyz.go
new file mode 100644
index 0000000000000..e3df4861ce846
--- /dev/null
+++ b/lib/tbot/readyz/readyz.go
@@ -0,0 +1,182 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package readyz
+
+import (
+	"os"
+	"sync"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+)
+
+// NewRegistry returns a Registry to track the health of tbot's services.
+func NewRegistry(opts ...NewRegistryOpt) *Registry {
+	r := &Registry{
+		clock:    clockwork.NewRealClock(),
+		services: make(map[string]*ServiceStatus),
+		notifyCh: make(chan struct{}),
+	}
+	for _, opt := range opts {
+		opt(r)
+	}
+	return r
+}
+
+// NewRegistryOpt can be passed to NewRegistry to provide optional configuration.
+type NewRegistryOpt func(r *Registry)
+
+// WithClock sets the registry's clock.
+func WithClock(clock clockwork.Clock) NewRegistryOpt {
+	return func(r *Registry) { r.clock = clock }
+}
+
+// Registry tracks the status/health of tbot's services.
+type Registry struct {
+	clock clockwork.Clock
+
+	mu       sync.Mutex
+	services map[string]*ServiceStatus
+	reported int
+	notifyCh chan struct{}
+}
+
+// AddService adds a service to the registry so that its health will be reported
+// from our readyz endpoints. It returns a Reporter the service can use to report
+// status changes.
+//
+// Note: you should add all of your services before any service reports its status
+// otherwise AllServicesReported will unblock too early.
+func (r *Registry) AddService(serviceType, name string) Reporter {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	// TODO(boxofrad): If you add the same service multiple times, you could end
+	// up unblocking AllServicesReported prematurely. The impact is low, it just
+	// means we'd send a heartbeat sooner than is desirable, but we should panic
+	// or return an error from this method instead.
+	status, ok := r.services[name]
+	if !ok {
+		status = &ServiceStatus{ServiceType: serviceType}
+		r.services[name] = status
+	}
+
+	return &reporter{
+		mu:     &r.mu,
+		clock:  r.clock,
+		status: status,
+		notify: sync.OnceFunc(r.maybeNotifyLocked),
+	}
+}
+
+// ServiceStatus reads the named service's status. The bool value will be false
+// if the service has not been registered.
+func (r *Registry) ServiceStatus(name string) (*ServiceStatus, bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if status, ok := r.services[name]; ok {
+		return status.Clone(), true
+	}
+
+	return nil, false
+}
+
+// OverallStatus returns tbot's overall status when taking service statuses into
+// account.
+func (r *Registry) OverallStatus() *OverallStatus {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	status := Healthy
+	services := make(map[string]*ServiceStatus, len(r.services))
+
+	for name, svc := range r.services {
+		services[name] = svc.Clone()
+
+		if svc.Status != Healthy {
+			status = Unhealthy
+		}
+	}
+
+	return &OverallStatus{
+		Status:   status,
+		PID:      os.Getpid(),
+		Services: services,
+	}
+}
+
+// AllServicesReported returns a channel you can receive from to be notified
+// when all registered services have reported their initial status. It provides
+// a way for us to hold the initial heartbeat until after the initial flurry of
+// activity.
+func (r *Registry) AllServicesReported() <-chan struct{} { return r.notifyCh }
+
+// maybeNotifyLocked unblocks the AllServicesReported channel if all services
+// have reported their initial status. It's called by each of the Reporters the
+// first time you report a status.
+//
+// Caller must be holding r.mu.
+func (r *Registry) maybeNotifyLocked() {
+	r.reported++
+
+	if r.reported != len(r.services) {
+		return
+	}
+
+	select {
+	case <-r.notifyCh:
+	default:
+		close(r.notifyCh)
+	}
+}
+
+// ServiceStatus is a snapshot of the service's status.
+type ServiceStatus struct {
+	// Status of the service.
+	Status Status `json:"status"`
+
+	// Reason string describing why the service has its current status.
+	Reason string `json:"reason,omitempty"`
+
+	// UpdatedAt is the time at which the service's status last changed.
+	UpdatedAt *time.Time `json:"updated_at"`
+
+	// ServiceType is exposed in bot heartbeats, but not the `/readyz` endpoint.
+	ServiceType string `json:"-"`
+}
+
+// Clone the status to avoid data races.
+func (s *ServiceStatus) Clone() *ServiceStatus {
+	clone := *s
+	return &clone
+}
+
+// OverallStatus is tbot's overall aggregate status.
+type OverallStatus struct {
+	// Status of tbot overall. If any service isn't Healthy, the overall status
+	// will be Unhealthy.
+	Status Status `json:"status"`
+
+	// PID is the process PID.
+	PID int `json:"pid"`
+
+	// Services contains the service-specific statuses.
+	Services map[string]*ServiceStatus `json:"services"`
+}
diff --git a/lib/tbot/readyz/readyz_test.go b/lib/tbot/readyz/readyz_test.go
new file mode 100644
index 0000000000000..50d7d8807766f
--- /dev/null
+++ b/lib/tbot/readyz/readyz_test.go
@@ -0,0 +1,187 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package readyz_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+func TestReadyz(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now().UTC().Truncate(time.Second)
+	clock := clockwork.NewFakeClockAt(now)
+
+	reg := readyz.NewRegistry(readyz.WithClock(clock))
+
+	a := reg.AddService("svc", "a")
+	b := reg.AddService("svc", "b")
+
+	srv := httptest.NewServer(readyz.HTTPHandler(reg))
+	srv.URL = srv.URL + "/readyz"
+	t.Cleanup(srv.Close)
+
+	t.Run("initial state - overall", func(t *testing.T) {
+		rsp, err := http.Get(srv.URL)
+		require.NoError(t, err)
+		defer rsp.Body.Close()
+
+		require.Equal(t, http.StatusServiceUnavailable, rsp.StatusCode)
+
+		var response readyz.OverallStatus
+		err = json.NewDecoder(rsp.Body).Decode(&response)
+		require.NoError(t, err)
+
+		require.Equal(t,
+			readyz.OverallStatus{
+				Status: readyz.Unhealthy,
+				Services: map[string]*readyz.ServiceStatus{
+					"a": {Status: readyz.Initializing},
+					"b": {Status: readyz.Initializing},
+				},
+				PID: os.Getpid(),
+			},
+			response,
+		)
+	})
+
+	t.Run("individual service", func(t *testing.T) {
+		a.ReportReason(readyz.Unhealthy, "database is down")
+
+		rsp, err := http.Get(srv.URL + "/a")
+		require.NoError(t, err)
+		defer rsp.Body.Close()
+
+		require.Equal(t, http.StatusServiceUnavailable, rsp.StatusCode)
+
+		var response readyz.ServiceStatus
+		err = json.NewDecoder(rsp.Body).Decode(&response)
+		require.NoError(t, err)
+
+		require.Equal(t,
+			readyz.ServiceStatus{
+				Status:    readyz.Unhealthy,
+				Reason:    "database is down",
+				UpdatedAt: &now,
+			},
+			response,
+		)
+	})
+
+	t.Run("mixed state", func(t *testing.T) {
+		a.Report(readyz.Healthy)
+		b.ReportReason(readyz.Unhealthy, "database is down")
+
+		rsp, err := http.Get(srv.URL)
+		require.NoError(t, err)
+		defer rsp.Body.Close()
+
+		require.Equal(t, http.StatusServiceUnavailable, rsp.StatusCode)
+
+		var response readyz.OverallStatus
+		err = json.NewDecoder(rsp.Body).Decode(&response)
+		require.NoError(t, err)
+
+		require.Equal(t,
+			readyz.OverallStatus{
+				Status: readyz.Unhealthy,
+				Services: map[string]*readyz.ServiceStatus{
+					"a": {Status: readyz.Healthy, UpdatedAt: &now},
+					"b": {Status: readyz.Unhealthy, Reason: "database is down", UpdatedAt: &now},
+				},
+				PID: os.Getpid(),
+			},
+			response,
+		)
+	})
+
+	t.Run("all healthy", func(t *testing.T) {
+		a.Report(readyz.Healthy)
+		b.Report(readyz.Healthy)
+
+		rsp, err := http.Get(srv.URL)
+		require.NoError(t, err)
+		defer rsp.Body.Close()
+
+		require.Equal(t, http.StatusOK, rsp.StatusCode)
+
+		var response readyz.OverallStatus
+		err = json.NewDecoder(rsp.Body).Decode(&response)
+		require.NoError(t, err)
+
+		require.Equal(t,
+			readyz.OverallStatus{
+				Status: readyz.Healthy,
+				Services: map[string]*readyz.ServiceStatus{
+					"a": {Status: readyz.Healthy, UpdatedAt: &now},
+					"b": {Status: readyz.Healthy, UpdatedAt: &now},
+				},
+				PID: os.Getpid(),
+			},
+			response,
+		)
+	})
+
+	t.Run("unknown service", func(t *testing.T) {
+		rsp, err := http.Get(srv.URL + "/foo")
+		require.NoError(t, err)
+		defer rsp.Body.Close()
+
+		require.Equal(t, http.StatusNotFound, rsp.StatusCode)
+	})
+}
+
+func TestAllServicesReported(t *testing.T) {
+	reg := readyz.NewRegistry()
+
+	a := reg.AddService("svc", "a")
+	b := reg.AddService("svc", "b")
+
+	select {
+	case <-reg.AllServicesReported():
+		t.Fatal("AllServicesReported should be blocked")
+	default:
+	}
+
+	a.Report(readyz.Healthy)
+
+	select {
+	case <-reg.AllServicesReported():
+		t.Fatal("AllServicesReported should be blocked")
+	default:
+	}
+
+	b.Report(readyz.Unhealthy)
+
+	select {
+	case <-reg.AllServicesReported():
+	default:
+		t.Fatal("AllServicesReported should not be blocked")
+	}
+}
diff --git a/lib/tbot/readyz/reporter.go b/lib/tbot/readyz/reporter.go
new file mode 100644
index 0000000000000..7a8d2ff8e7224
--- /dev/null
+++ b/lib/tbot/readyz/reporter.go
@@ -0,0 +1,69 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package readyz
+
+import (
+	"sync"
+
+	"github.com/jonboulle/clockwork"
+)
+
+// Reporter can be used by a service to report its status.
+type Reporter interface {
+	// Report the service's status.
+	Report(status Status)
+
+	// ReportReason reports the service's status including reason/description text.
+	ReportReason(status Status, reason string)
+}
+
+type reporter struct {
+	mu     *sync.Mutex
+	status *ServiceStatus
+	clock  clockwork.Clock
+	notify func()
+}
+
+func (r *reporter) Report(status Status) {
+	r.ReportReason(status, "")
+}
+
+func (r *reporter) ReportReason(status Status, reason string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.status.Status = status
+	r.status.Reason = reason
+
+	updatedAt := r.clock.Now()
+	r.status.UpdatedAt = &updatedAt
+
+	r.notify()
+}
+
+// NoopReporter returns a no-op Reporter that can be used when no real reporter
+// is available (e.g. in tests).
+func NoopReporter() Reporter {
+	return noopReporter{}
+}
+
+type noopReporter struct{}
+
+func (noopReporter) Report(Status)               {}
+func (noopReporter) ReportReason(Status, string) {}
diff --git a/lib/tbot/readyz/status.go b/lib/tbot/readyz/status.go
new file mode 100644
index 0000000000000..3d226c67023b6
--- /dev/null
+++ b/lib/tbot/readyz/status.go
@@ -0,0 +1,85 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package readyz
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+// Status describes the healthiness of a service or tbot overall.
+type Status uint
+
+const (
+	// Initializing means no status has been reported for the service.
+	Initializing Status = iota
+
+	// Healthy means the service is healthy and ready to serve traffic or it has
+	// recently succeeded generating an output.
+	Healthy
+
+	// Unhealthy means the service is failing to serve traffic or generate output.
+	Unhealthy
+)
+
+// String implements fmt.Stringer.
+func (s Status) String() string {
+	switch s {
+	case Initializing:
+		return "initializing"
+	case Healthy:
+		return "healthy"
+	case Unhealthy:
+		return "unhealthy"
+	default:
+		return "<unknown status>"
+	}
+}
+
+// MarshalJSON implements json.Marshaler.
+func (s Status) MarshalJSON() ([]byte, error) {
+	return json.Marshal(s.String())
+}
+
+// MarshalJSON implements json.Unmarshaler.
+func (s *Status) UnmarshalJSON(j []byte) error {
+	var str string
+	if err := json.Unmarshal(j, &str); err != nil {
+		return err
+	}
+	switch str {
+	case "healthy":
+		*s = Healthy
+	case "unhealthy":
+		*s = Unhealthy
+	default:
+		*s = Initializing
+	}
+	return nil
+}
+
+// HTTPStatusCode returns the HTTP response code that represents this status.
+func (s Status) HTTPStatusCode() int {
+	switch s {
+	case Healthy:
+		return http.StatusOK
+	default:
+		return http.StatusServiceUnavailable
+	}
+}
diff --git a/lib/tbot/service_application_output.go b/lib/tbot/service_application_output.go
deleted file mode 100644
index bd0b7585b84c4..0000000000000
--- a/lib/tbot/service_application_output.go
+++ /dev/null
@@ -1,261 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"fmt"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-
-	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-)
-
-// ApplicationOutputService generates the artifacts necessary to connect to a
-// HTTP or TCP application using Teleport.
-type ApplicationOutputService struct {
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.ApplicationOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-}
-
-func (s *ApplicationOutputService) String() string {
-	return fmt.Sprintf("application-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *ApplicationOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *ApplicationOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *ApplicationOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"ApplicationOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	var err error
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-		if err != nil {
-			return trace.Wrap(err, "fetching default roles")
-		}
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	routeToApp, _, err := getRouteToApp(
-		ctx,
-		s.getBotIdentity(),
-		impersonatedClient,
-		s.cfg.AppName,
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	routedIdentity, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		id,
-		roles,
-		effectiveLifetime.TTL,
-		func(req *proto.UserCertsRequest) {
-			req.RouteToApp = routeToApp
-		},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	s.log.InfoContext(
-		ctx,
-		"Generated identity for app",
-		"app_name", routeToApp.Name,
-	)
-
-	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// TODO(noah): It's likely the Application output does not really need to
-	// output these CAs - but - for backwards compat reasons, we output them.
-	// Revisit this at a later date and make a call.
-	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	return trace.Wrap(s.render(ctx, routedIdentity, hostCAs, userCAs, databaseCAs), "rendering")
-}
-
-func (s *ApplicationOutputService) render(
-	ctx context.Context,
-	routedIdentity *identity.Identity,
-	hostCAs, userCAs, databaseCAs []types.CertAuthority,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"ApplicationOutputService/render",
-	)
-	defer span.End()
-
-	keyRing, err := NewClientKeyRing(routedIdentity, hostCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := writeIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "writing identity file")
-	}
-	if err := identity.SaveIdentity(
-		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
-	); err != nil {
-		return trace.Wrap(err, "persisting identity")
-	}
-
-	if s.cfg.SpecificTLSExtensions {
-		if err := writeIdentityFileTLS(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
-			return trace.Wrap(err, "writing specific tls extension files")
-		}
-	}
-
-	return trace.Wrap(writeTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs))
-}
-
-func getRouteToApp(
-	ctx context.Context,
-	botIdentity *identity.Identity,
-	client *authclient.Client,
-	appName string,
-) (proto.RouteToApp, types.Application, error) {
-	ctx, span := tracer.Start(ctx, "getRouteToApp")
-	defer span.End()
-
-	app, err := getApp(ctx, client, appName)
-	if err != nil {
-		return proto.RouteToApp{}, nil, trace.Wrap(err)
-	}
-
-	// TODO(noah): Now that app session ids are no longer being retrieved,
-	// we can begin to cache the routeToApp rather than regenerating this
-	// on each renew in the ApplicationTunnelSvc
-	routeToApp := proto.RouteToApp{
-		Name:        app.GetName(),
-		PublicAddr:  app.GetPublicAddr(),
-		ClusterName: botIdentity.ClusterName,
-	}
-
-	return routeToApp, app, nil
-}
-
-func getApp(ctx context.Context, clt *authclient.Client, appName string) (types.Application, error) {
-	ctx, span := tracer.Start(ctx, "getApp")
-	defer span.End()
-
-	servers, err := apiclient.GetAllResources[types.AppServer](ctx, clt, &proto.ListResourcesRequest{
-		Namespace:           defaults.Namespace,
-		ResourceType:        types.KindAppServer,
-		PredicateExpression: fmt.Sprintf(`name == "%s"`, appName),
-		Limit:               1,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var apps []types.Application
-	for _, server := range servers {
-		apps = append(apps, server.GetApp())
-	}
-	apps = types.DeduplicateApps(apps)
-
-	if len(apps) == 0 {
-		return nil, trace.BadParameter("app %q not found", appName)
-	}
-
-	return apps[0], nil
-}
diff --git a/lib/tbot/service_application_tunnel.go b/lib/tbot/service_application_tunnel.go
deleted file mode 100644
index 4d91c7b9b92e6..0000000000000
--- a/lib/tbot/service_application_tunnel.go
+++ /dev/null
@@ -1,253 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"crypto/tls"
-	"fmt"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/srv/alpnproxy"
-	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// ApplicationTunnelService is a service that listens on a socket and forwards
-// traffic to an application registered in Teleport Application Access. It is
-// an authenticating tunnel and will automatically issue and renew certificates
-// as needed.
-type ApplicationTunnelService struct {
-	botCfg         *config.BotConfig
-	cfg            *config.ApplicationTunnelService
-	proxyPingCache *proxyPingCache
-	log            *slog.Logger
-	resolver       reversetunnelclient.Resolver
-	botClient      *authclient.Client
-	getBotIdentity getBotIdentityFn
-}
-
-func (s *ApplicationTunnelService) Run(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "ApplicationTunnelService/Run")
-	defer span.End()
-
-	l := s.cfg.Listener
-	if l == nil {
-		s.log.DebugContext(ctx, "Opening listener for application tunnel", "listen", s.cfg.Listen)
-		var err error
-		l, err = createListener(ctx, s.log, s.cfg.Listen)
-		if err != nil {
-			return trace.Wrap(err, "opening listener")
-		}
-		defer func() {
-			if err := l.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
-				s.log.ErrorContext(ctx, "Failed to close listener", "error", err)
-			}
-		}()
-	}
-
-	lpCfg, err := s.buildLocalProxyConfig(ctx)
-	if err != nil {
-		return trace.Wrap(err, "building local proxy config")
-	}
-	lpCfg.Listener = l
-
-	lp, err := alpnproxy.NewLocalProxy(lpCfg)
-	if err != nil {
-		return trace.Wrap(err, "creating local proxy")
-	}
-	defer func() {
-		if err := lp.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Failed to close local proxy", "error", err)
-		}
-	}()
-	// Closed further down.
-
-	// lp.Start will block and continues to block until lp.Close() is called.
-	// Despite taking a context, it will not exit until the first connection is
-	// made after the context is canceled.
-	var errCh = make(chan error, 1)
-	go func() {
-		errCh <- lp.Start(ctx)
-	}()
-	s.log.InfoContext(ctx, "Listening for connections.", "address", l.Addr().String())
-
-	select {
-	case <-ctx.Done():
-		return nil
-	case err := <-errCh:
-		return trace.Wrap(err, "local proxy failed")
-	}
-}
-
-func alpnProtocolForApp(app types.Application) common.Protocol {
-	if app.IsTCP() {
-		return common.ProtocolTCP
-	}
-	return common.ProtocolHTTP
-}
-
-// buildLocalProxyConfig initializes the service, fetching any initial information and setting
-// up the localproxy.
-func (s *ApplicationTunnelService) buildLocalProxyConfig(ctx context.Context) (lpCfg alpnproxy.LocalProxyConfig, err error) {
-	ctx, span := tracer.Start(ctx, "ApplicationTunnelService/buildLocalProxyConfig")
-	defer span.End()
-
-	// Determine the roles to use for the impersonated app access user. We fall
-	// back to all the roles the bot has if none are configured.
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botClient, s.getBotIdentity())
-		if err != nil {
-			return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "fetching default roles")
-		}
-		s.log.DebugContext(ctx, "No roles configured, using all roles available.", "roles", roles)
-	}
-
-	proxyPing, err := s.proxyPingCache.ping(ctx)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "pinging proxy")
-	}
-	proxyAddr, err := proxyPing.proxyWebAddr()
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "determining proxy web addr")
-	}
-
-	s.log.DebugContext(ctx, "Issuing initial certificate for local proxy.")
-	appCert, app, err := s.issueCert(ctx, roles)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
-	}
-	s.log.DebugContext(ctx, "Issued initial certificate for local proxy.")
-
-	middleware := alpnProxyMiddleware{
-		onNewConnection: func(ctx context.Context, lp *alpnproxy.LocalProxy) error {
-			ctx, span := tracer.Start(ctx, "ApplicationTunnelService/OnNewConnection")
-			defer span.End()
-
-			if err := lp.CheckCertExpiry(ctx); err != nil {
-				s.log.InfoContext(ctx, "Certificate for tunnel needs reissuing.", "reason", err.Error())
-				cert, _, err := s.issueCert(ctx, roles)
-				if err != nil {
-					return trace.Wrap(err, "issuing cert")
-				}
-				lp.SetCert(*cert)
-			}
-			return nil
-		},
-	}
-
-	lpConfig := alpnproxy.LocalProxyConfig{
-		Middleware: middleware,
-
-		RemoteProxyAddr:    proxyAddr,
-		ParentContext:      ctx,
-		Protocols:          []common.Protocol{alpnProtocolForApp(app)},
-		Cert:               *appCert,
-		InsecureSkipVerify: s.botCfg.Insecure,
-	}
-	if client.IsALPNConnUpgradeRequired(
-		ctx,
-		proxyAddr,
-		s.botCfg.Insecure,
-	) {
-		lpConfig.ALPNConnUpgradeRequired = true
-		// If ALPN Conn Upgrade will be used, we need to set the cluster CAs
-		// to validate the Proxy's auth issued host cert.
-		lpConfig.RootCAs = s.getBotIdentity().TLSCAPool
-	}
-
-	return lpConfig, nil
-}
-
-func (s *ApplicationTunnelService) issueCert(
-	ctx context.Context,
-	roles []string,
-) (*tls.Certificate, types.Application, error) {
-	ctx, span := tracer.Start(ctx, "ApplicationTunnelService/issueCert")
-	defer span.End()
-
-	// Right now we have to redetermine the route to app each time as the
-	// session ID may need to change. Once v17 hits, this will be automagically
-	// calculated by the auth server on cert generation, and we can fetch the
-	// routeToApp once.
-	impersonatedIdentity, err := generateIdentity(
-		ctx,
-		s.botClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	impersonatedClient, err := clientForFacade(
-		ctx,
-		s.log,
-		s.botCfg,
-		identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, impersonatedIdentity),
-		s.resolver,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	defer func() {
-		if err := impersonatedClient.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Failed to close impersonated client.", "error", err)
-		}
-	}()
-	route, app, err := getRouteToApp(ctx, s.getBotIdentity(), impersonatedClient, s.cfg.AppName)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	s.log.DebugContext(ctx, "Requesting issuance of certificate for tunnel proxy.")
-	routedIdent, err := generateIdentity(
-		ctx,
-		s.botClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		func(req *proto.UserCertsRequest) {
-			req.RouteToApp = route
-		})
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	s.log.InfoContext(ctx, "Certificate issued for tunnel proxy.")
-
-	return routedIdent.TLSCert, app, nil
-}
-
-// String returns a human-readable string that can uniquely identify the
-// service.
-func (s *ApplicationTunnelService) String() string {
-	return fmt.Sprintf("%s:%s:%s", config.ApplicationTunnelServiceType, s.cfg.Listen, s.cfg.AppName)
-}
diff --git a/lib/tbot/service_application_tunnel_test.go b/lib/tbot/service_application_tunnel_test.go
deleted file mode 100644
index 78cf65604357a..0000000000000
--- a/lib/tbot/service_application_tunnel_test.go
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func TestE2E_ApplicationTunnelService(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	// Spin up a test HTTP server
-	wantStatus := http.StatusTeapot
-	wantBody := []byte("hello this is a test")
-	httpSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(wantStatus)
-		w.Write(wantBody)
-	}))
-	t.Cleanup(httpSrv.Close)
-
-	// Make a new auth server.
-	appName := "my-test-app"
-	process := testenv.MakeTestServer(
-		t,
-		defaultTestServerOpts(t, log),
-		testenv.WithConfig(func(cfg *servicecfg.Config) {
-			cfg.Apps.Enabled = true
-			cfg.Apps.Apps = []servicecfg.App{
-				{
-					Name: appName,
-					URI:  httpSrv.URL,
-				},
-			}
-		}),
-	)
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	// Create role that allows the bot to access the app.
-	role, err := types.NewRole("app-access", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			AppLabels: types.Labels{
-				"*": apiutils.Strings{"*"},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	botListener, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		botListener.Close()
-	})
-
-	// Prepare the bot config
-	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
-	botConfig := defaultBotConfig(
-		t, process, onboarding, config.ServiceConfigs{
-			&config.ApplicationTunnelService{
-				Listener: botListener,
-				AppName:  appName,
-			},
-		},
-		defaultBotConfigOpts{
-			useAuthServer: true,
-			// insecure required as the db tunnel will connect to proxies
-			// self-signed.
-			insecure: true,
-		},
-	)
-	botConfig.Oneshot = false
-	b := New(botConfig, log)
-
-	// Spin up goroutine for bot to run in
-	ctx, cancel := context.WithCancel(ctx)
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := b.Run(ctx)
-		assert.NoError(t, err, "bot should not exit with error")
-		cancel()
-	}()
-	t.Cleanup(func() {
-		// Shut down bot and make sure it exits.
-		cancel()
-		wg.Wait()
-	})
-
-	// We can't predict exactly when the tunnel will be ready so we use
-	// EventuallyWithT to retry.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		proxyUrl := url.URL{
-			Scheme: "http",
-			Host:   botListener.Addr().String(),
-		}
-		resp, err := http.Get(proxyUrl.String())
-		if !assert.NoError(t, err) {
-			return
-		}
-		defer resp.Body.Close()
-		assert.Equal(t, wantStatus, resp.StatusCode)
-		body, err := io.ReadAll(resp.Body)
-		if !assert.NoError(t, err) {
-			return
-		}
-		assert.Equal(t, wantBody, body)
-	}, 10*time.Second, 100*time.Millisecond)
-}
diff --git a/lib/tbot/service_bot_identity.go b/lib/tbot/service_bot_identity.go
deleted file mode 100644
index 28409093a5204..0000000000000
--- a/lib/tbot/service_bot_identity.go
+++ /dev/null
@@ -1,542 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"log/slog"
-	"sync"
-	"time"
-
-	"github.com/gravitational/trace"
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/join"
-	"github.com/gravitational/teleport/lib/auth/join/boundkeypair"
-	"github.com/gravitational/teleport/lib/auth/state"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// botIdentityRenewalRetryLimit is the number of permissible consecutive
-// failures in renewing the bot identity before the loop exits fatally.
-const botIdentityRenewalRetryLimit = 7
-
-// identityService is a [bot.Service] that handles renewing the bot's identity.
-// It renews the bot's identity periodically and when receiving a broadcasted
-// reload signal.
-//
-// It does not offer a [bot.OneShotService] implementation as the Bot's identity
-// is renewed automatically during initialization.
-type identityService struct {
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-	cfg               *config.BotConfig
-	resolver          reversetunnelclient.Resolver
-
-	mu     sync.Mutex
-	client *authclient.Client
-	facade *identity.Facade
-}
-
-// GetIdentity returns the current Bot identity.
-func (s *identityService) GetIdentity() *identity.Identity {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.facade.Get()
-}
-
-// GetClient returns the facaded client for the Bot identity for use by other
-// components of `tbot`. Consumers should not call `Close` on the client.
-func (s *identityService) GetClient() *authclient.Client {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.client
-}
-
-// String returns a human-readable name of the service.
-func (s *identityService) String() string {
-	return "identity"
-}
-
-func hasTokenChanged(configTokenBytes, identityBytes []byte) bool {
-	if len(configTokenBytes) == 0 || len(identityBytes) == 0 {
-		return false
-	}
-
-	return !bytes.Equal(identityBytes, configTokenBytes)
-}
-
-// loadIdentityFromStore attempts to load a persisted identity from a store.
-// It then checks:
-// - This identity against the configured onboarding profile.
-// - This identity is not expired
-// If any checks fail, it will not return the loaded identity.
-func (s *identityService) loadIdentityFromStore(ctx context.Context, store bot.Destination) *identity.Identity {
-	ctx, span := tracer.Start(ctx, "identityService/loadIdentityFromStore")
-	defer span.End()
-	s.log.InfoContext(ctx, "Loading existing bot identity from store", "store", store)
-
-	loadedIdent, err := identity.LoadIdentity(ctx, store, identity.BotKinds()...)
-	if err != nil {
-		if trace.IsNotFound(err) {
-			s.log.InfoContext(ctx, "No existing bot identity found in store")
-			return nil
-		} else {
-			s.log.WarnContext(
-				ctx,
-				"Failed to load existing bot identity from store",
-				"error", err,
-			)
-			return nil
-		}
-	}
-
-	// Determine if the token configured in the onboarding matches the
-	// one used to produce the credentials loaded from disk.
-	if s.cfg.Onboarding.HasToken() {
-		if token, err := s.cfg.Onboarding.Token(); err == nil {
-			sha := sha256.Sum256([]byte(token))
-			configTokenHashBytes := []byte(hex.EncodeToString(sha[:]))
-			if hasTokenChanged(loadedIdent.TokenHashBytes, configTokenHashBytes) {
-				s.log.InfoContext(ctx, "Bot identity loaded from store does not match configured token")
-				// If the token has changed, do not return the loaded
-				// identity.
-				return nil
-			}
-		} else {
-			// we failed to get the newly configured token to compare to,
-			// we'll assume the last good credentials written to disk should
-			// still be used.
-			s.log.WarnContext(
-				ctx,
-				"There was an error loading the configured token to compare to existing identity. Identity loaded from store will be tried",
-				"error", err,
-			)
-		}
-	}
-
-	s.log.InfoContext(
-		ctx,
-		"Loaded existing bot identity from store",
-		"identity", describeTLSIdentity(ctx, s.log, loadedIdent),
-	)
-
-	now := time.Now().UTC()
-	if now.After(loadedIdent.X509Cert.NotAfter) {
-		s.log.WarnContext(
-			ctx,
-			"Identity loaded from store is expired, it will not be used",
-			"not_after", loadedIdent.X509Cert.NotAfter.Format(time.RFC3339),
-			"current_time", now.Format(time.RFC3339),
-		)
-		return nil
-	} else if now.Before(loadedIdent.X509Cert.NotBefore) {
-		s.log.WarnContext(
-			ctx,
-			"Identity loaded from store is not yet valid, it will not be used. Confirm that the system time is correct",
-			"not_before", loadedIdent.X509Cert.NotBefore.Format(time.RFC3339),
-			"current_time", now.Format(time.RFC3339),
-		)
-		return nil
-	}
-
-	return loadedIdent
-}
-
-// Initialize sets up the bot identity at startup. This process has a few
-// steps to it.
-//
-// First, we attempt to load an existing identity from the configured storage.
-// This is ignored if we know that the onboarding settings have changed.
-//
-// If the identity is found, and seems valid, we attempt to renew using this
-// identity to give us a fresh set of certificates.
-//
-// If there is no identity, or the identity is invalid, we'll join using the
-// configured onboarding settings.
-func (s *identityService) Initialize(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "identityService/Initialize")
-	defer span.End()
-
-	s.log.InfoContext(ctx, "Initializing bot identity")
-	// nil will be returned if no identity can be found in store or
-	// the identity in the store is no longer relevant or valid.
-	loadedIdent := s.loadIdentityFromStore(ctx, s.cfg.Storage.Destination)
-	if loadedIdent == nil {
-		if !s.cfg.Onboarding.HasToken() {
-			// There's no loaded identity to work with, and they've not
-			// configured  a token to use to request an identity :(
-			return trace.BadParameter(
-				"no existing identity found on disk or join token configured",
-			)
-		}
-		s.log.InfoContext(
-			ctx,
-			"Bot was unable to load a valid existing identity from the store, will attempt to join using configured token",
-		)
-	}
-
-	var err error
-	var newIdentity *identity.Identity
-	if loadedIdent != nil {
-		newIdentity, err = renewIdentity(ctx, s.log, s.cfg, s.resolver, loadedIdent)
-		if err != nil {
-			return trace.Wrap(err, "renewing identity using loaded identity")
-		}
-	} else {
-		// TODO(noah): If the above renewal fails, do we want to try joining
-		// instead? Is there a sane amount of times to try renewing before
-		// giving up and rejoining?
-		newIdentity, err = botIdentityFromToken(ctx, s.log, s.cfg, nil)
-		if err != nil {
-			return trace.Wrap(err, "joining with token")
-		}
-	}
-
-	s.log.InfoContext(ctx, "Fetched new bot identity", "identity", describeTLSIdentity(ctx, s.log, newIdentity))
-	if err := identity.SaveIdentity(ctx, newIdentity, s.cfg.Storage.Destination, identity.BotKinds()...); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Create the facaded client we can share with other components of tbot.
-	facade := identity.NewFacade(s.cfg.FIPS, s.cfg.Insecure, newIdentity)
-	c, err := clientForFacade(ctx, s.log, s.cfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	s.mu.Lock()
-	s.client = c
-	s.facade = facade
-	s.mu.Unlock()
-
-	s.log.InfoContext(ctx, "Identity initialized successfully")
-	return nil
-}
-
-func (s *identityService) Close() error {
-	c := s.GetClient()
-	if c == nil {
-		return nil
-	}
-	return trace.Wrap(c.Close())
-}
-
-func (s *identityService) Run(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "identityService/Run")
-	defer span.End()
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	// Determine where the bot should write its internal data (renewable cert
-	// etc)
-	storageDestination := s.cfg.Storage.Destination
-
-	s.log.InfoContext(
-		ctx,
-		"Beginning bot identity renewal loop",
-		"ttl", s.cfg.CredentialLifetime.TTL,
-		"interval", s.cfg.CredentialLifetime.RenewalInterval,
-	)
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service: s.String(),
-		name:    "bot-identity-renewal",
-		f: func(ctx context.Context) error {
-			return s.renew(ctx, storageDestination)
-		},
-		interval:             s.cfg.CredentialLifetime.RenewalInterval,
-		exitOnRetryExhausted: true,
-		retryLimit:           botIdentityRenewalRetryLimit,
-		log:                  s.log,
-		reloadCh:             reloadCh,
-		waitBeforeFirstRun:   true,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *identityService) renew(
-	ctx context.Context,
-	botDestination bot.Destination,
-) error {
-	ctx, span := tracer.Start(ctx, "identityService/renew")
-	defer span.End()
-
-	currentIdentity := s.facade.Get()
-	// Make sure we can still write to the bot's destination.
-	if err := identity.VerifyWrite(ctx, botDestination); err != nil {
-		return trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
-	}
-
-	newIdentity, err := renewIdentity(ctx, s.log, s.cfg, s.resolver, currentIdentity)
-	if err != nil {
-		return trace.Wrap(err, "renewing identity")
-	}
-
-	s.log.InfoContext(ctx, "Fetched new bot identity", "identity", describeTLSIdentity(ctx, s.log, newIdentity))
-	s.facade.Set(newIdentity)
-
-	if err := identity.SaveIdentity(ctx, newIdentity, botDestination, identity.BotKinds()...); err != nil {
-		return trace.Wrap(err, "saving new identity")
-	}
-	s.log.DebugContext(ctx, "Bot identity persisted", "identity", describeTLSIdentity(ctx, s.log, newIdentity))
-
-	return nil
-}
-
-func renewIdentity(
-	ctx context.Context,
-	log *slog.Logger,
-	botCfg *config.BotConfig,
-	resolver reversetunnelclient.Resolver,
-	oldIdentity *identity.Identity,
-) (*identity.Identity, error) {
-	ctx, span := tracer.Start(ctx, "renewIdentity")
-	defer span.End()
-	// Explicitly create a new client - this guarantees that requests will be
-	// made with the most recent identity and that a connection associated with
-	// an old identity will not be used.
-	facade := identity.NewFacade(botCfg.FIPS, botCfg.Insecure, oldIdentity)
-	authClient, err := clientForFacade(ctx, log, botCfg, facade, resolver)
-	if err != nil {
-		return nil, trace.Wrap(err, "creating auth client")
-	}
-	defer authClient.Close()
-
-	if oldIdentity.TLSIdentity.Renewable {
-		// When using a renewable join method, we use GenerateUserCerts to
-		// request a new certificate using our current identity.
-		newIdentity, err := botIdentityFromAuth(
-			ctx, log, oldIdentity, authClient, botCfg.CredentialLifetime.TTL,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "renewing identity using GenerateUserCert")
-		}
-		return newIdentity, nil
-	}
-
-	newIdentity, err := botIdentityFromToken(ctx, log, botCfg, authClient)
-	if err != nil {
-		return nil, trace.Wrap(err, "renewing identity using Register")
-	}
-	return newIdentity, nil
-}
-
-// botIdentityFromAuth uses an existing identity to request a new from the auth
-// server using GenerateUserCerts. This only works for renewable join types.
-func botIdentityFromAuth(
-	ctx context.Context,
-	log *slog.Logger,
-	ident *identity.Identity,
-	client *authclient.Client,
-	ttl time.Duration,
-) (*identity.Identity, error) {
-	ctx, span := tracer.Start(ctx, "botIdentityFromAuth")
-	defer span.End()
-	log.InfoContext(ctx, "Fetching bot identity using existing bot identity")
-
-	if ident == nil || client == nil {
-		return nil, trace.BadParameter("renewIdentityWithAuth must be called with non-nil client and identity")
-	}
-
-	// Always generate a new key when refreshing the identity. This limits
-	// usefulness of compromised keys to the lifetime of their associated cert,
-	// and allows for new keys to follow any changes to the signature algorithm
-	// suite.
-	key, err := cryptosuites.GenerateKey(ctx,
-		cryptosuites.GetCurrentSuiteFromAuthPreference(client),
-		cryptosuites.HostIdentity)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	privateKeyPEM, err := keys.MarshalPrivateKey(key)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	sshPubKey, err := ssh.NewPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	sshPub := ssh.MarshalAuthorizedKey(sshPubKey)
-	tlsPub, err := keys.MarshalPublicKey(key.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Ask the auth server to generate a new set of certs with a new
-	// expiration date.
-	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
-		SSHPublicKey: sshPub,
-		TLSPublicKey: tlsPub,
-		Username:     ident.X509Cert.Subject.CommonName,
-		Expires:      time.Now().Add(ttl),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "calling GenerateUserCerts")
-	}
-
-	newIdentity, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: privateKeyPEM,
-		PublicKeyBytes:  sshPub,
-		TokenHashBytes:  ident.TokenHashBytes,
-	}, certs)
-	if err != nil {
-		return nil, trace.Wrap(err, "reading renewed identity")
-	}
-
-	return newIdentity, nil
-}
-
-// botIdentityFromToken uses a join token to request a bot identity from an auth
-// server using auth.Register.
-//
-// The authClient parameter is optional - if provided - this will be used for
-// the request. This saves the overhead of trying to create a new client as
-// part of the join process and allows us to preserve the bot instance id.
-func botIdentityFromToken(
-	ctx context.Context,
-	log *slog.Logger,
-	cfg *config.BotConfig,
-	authClient *authclient.Client,
-) (*identity.Identity, error) {
-	_, span := tracer.Start(ctx, "botIdentityFromToken")
-	defer span.End()
-
-	log.InfoContext(ctx, "Fetching bot identity using token")
-
-	token, err := cfg.Onboarding.Token()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	expires := time.Now().Add(cfg.CredentialLifetime.TTL)
-	params := join.RegisterParams{
-		Token: token,
-		ID: state.IdentityID{
-			Role: types.RoleBot,
-		},
-		JoinMethod: cfg.Onboarding.JoinMethod,
-		Expires:    &expires,
-
-		// Below options are effectively ignored if AuthClient is not-nil
-		Insecure:           cfg.Insecure,
-		CAPins:             cfg.Onboarding.CAPins,
-		CAPath:             cfg.Onboarding.CAPath,
-		FIPS:               cfg.FIPS,
-		GetHostCredentials: client.HostCredentials,
-		CipherSuites:       cfg.CipherSuites(),
-	}
-	if authClient != nil {
-		params.AuthClient = authClient
-	}
-
-	addr, addrKind := cfg.Address()
-	switch addrKind {
-	case config.AddressKindAuth:
-		parsed, err := utils.ParseAddr(addr)
-		if err != nil {
-			return nil, trace.Wrap(err, "failed to parse addr")
-		}
-		params.AuthServers = []utils.NetAddr{*parsed}
-	case config.AddressKindProxy:
-		parsed, err := utils.ParseAddr(addr)
-		if err != nil {
-			return nil, trace.Wrap(err, "failed to parse addr")
-		}
-		params.ProxyServer = *parsed
-	default:
-		return nil, trace.BadParameter("unsupported address kind: %v", addrKind)
-	}
-
-	// Only set during bound keypair joining, but used both before and after.
-	var boundKeypairAdapter boundkeypair.FS
-	var boundKeypairState *boundkeypair.ClientState
-
-	switch params.JoinMethod {
-	case types.JoinMethodAzure:
-		params.AzureParams = join.AzureParams{
-			ClientID: cfg.Onboarding.Azure.ClientID,
-		}
-	case types.JoinMethodTerraformCloud:
-		params.TerraformCloudAudienceTag = cfg.Onboarding.Terraform.AudienceTag
-	case types.JoinMethodGitLab:
-		params.GitlabParams = join.GitlabParams{
-			EnvVarName: cfg.Onboarding.Gitlab.TokenEnvVarName,
-		}
-	case types.JoinMethodBoundKeypair:
-		joinSecret := cfg.Onboarding.BoundKeypair.InitialJoinSecret
-
-		boundKeypairAdapter = config.NewBoundkeypairDestinationAdapter(cfg.Storage.Destination)
-		boundKeypairState, err = boundkeypair.LoadClientState(ctx, boundKeypairAdapter)
-		if trace.IsNotFound(err) && joinSecret != "" {
-			return nil, trace.NotImplemented("no existing client state was found and join secrets are not yet supported")
-		} else if err != nil {
-			return nil, trace.Wrap(err, "loading bound keypair client state")
-		}
-
-		params.BoundKeypairParams = boundKeypairState.ToJoinParams(joinSecret)
-	}
-
-	result, err := join.Register(ctx, params)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if boundKeypairState != nil {
-		if err := boundKeypairState.UpdateFromRegisterResult(result); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		log.DebugContext(ctx, "updating bound keypair client state")
-
-		if err := boundkeypair.StoreClientState(ctx, boundKeypairAdapter, boundKeypairState); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	privateKeyPEM, err := keys.MarshalPrivateKey(result.PrivateKey)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	sshPub, err := ssh.NewPublicKey(result.PrivateKey.Public())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	sha := sha256.Sum256([]byte(params.Token))
-	tokenHash := hex.EncodeToString(sha[:])
-	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: privateKeyPEM,
-		PublicKeyBytes:  ssh.MarshalAuthorizedKey(sshPub),
-		TokenHashBytes:  []byte(tokenHash),
-	}, result.Certs)
-	return ident, trace.Wrap(err)
-}
diff --git a/lib/tbot/service_ca_rotation.go b/lib/tbot/service_ca_rotation.go
deleted file mode 100644
index c5d51658da245..0000000000000
--- a/lib/tbot/service_ca_rotation.go
+++ /dev/null
@@ -1,277 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"slices"
-	"sync"
-	"time"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-)
-
-// debouncer accepts a duration, and a function. When `attempt` is called on
-// debouncer, it waits the duration, ignoring further attempts during this
-// period, before calling the provided function.
-//
-// This allows us to handle multiple events arriving within a short period, and
-// attempts to reduce the risk of the server going away during a renewal by
-// deferring the renewal until after the server-side elements of the rotation
-// have occurred.
-type debouncer struct {
-	mu    sync.Mutex
-	timer *time.Timer
-
-	// debouncePeriod is the amount of time that debouncer should wait from an
-	// initial trigger before triggering `f`, and in that time ignore further
-	// attempts.
-	debouncePeriod time.Duration
-
-	// f is the function that should be called by the debouncer.
-	f func()
-}
-
-func (rd *debouncer) attempt() {
-	rd.mu.Lock()
-	defer rd.mu.Unlock()
-
-	if rd.timer != nil {
-		return
-	}
-
-	rd.timer = time.AfterFunc(rd.debouncePeriod, func() {
-		rd.mu.Lock()
-		defer rd.mu.Unlock()
-		rd.timer = nil
-
-		rd.f()
-	})
-}
-
-type channelBroadcaster struct {
-	mu      sync.Mutex
-	chanSet map[chan struct{}]struct{}
-}
-
-func (cb *channelBroadcaster) subscribe() (ch chan struct{}, unsubscribe func()) {
-	cb.mu.Lock()
-	defer cb.mu.Unlock()
-	ch = make(chan struct{}, 1)
-	cb.chanSet[ch] = struct{}{}
-	// Returns a function that should be called to unsubscribe the channel
-	return ch, func() {
-		cb.mu.Lock()
-		defer cb.mu.Unlock()
-		_, ok := cb.chanSet[ch]
-		if ok {
-			delete(cb.chanSet, ch)
-			close(ch)
-		}
-	}
-}
-
-func (cb *channelBroadcaster) broadcast() {
-	cb.mu.Lock()
-	defer cb.mu.Unlock()
-	for ch := range cb.chanSet {
-		select {
-		case ch <- struct{}{}:
-			// Successfully sent notification
-		default:
-			// Channel already has valued queued
-		}
-	}
-}
-
-const caRotationRetryBackoff = time.Second * 2
-
-// caRotationService watches for CA rotations in the cluster, and
-// triggers a renewal when it detects a relevant CA rotation.
-//
-// See https://github.com/gravitational/teleport/blob/1aa38f4bc56997ba13b26a1ef1b4da7a3a078930/lib/auth/rotate.go#L135
-// for server side details of how a CA rotation takes place.
-//
-// We can leverage the existing renewal system to fetch new certificates and
-// CAs.
-//
-// We need to force a renewal for the following transitions:
-//   - Init -> Update Clients: So we can receive a set of certificates issued by
-//     the new CA, and trust both the old and new CA.
-//   - Update Clients, Update Servers -> Rollback: So we can receive a set of
-//     certificates issued by the old CA, and stop trusting the new CA.
-//   - Update Servers -> Standby: So we can stop trusting the old CA.
-type caRotationService struct {
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-	botClient         *authclient.Client
-	getBotIdentity    getBotIdentityFn
-}
-
-func (s *caRotationService) String() string {
-	return "ca-rotation"
-}
-
-// Run continually triggers `watchCARotations` until the context is
-// canceled. This allows the watcher to be re-established if an error occurs.
-//
-// Run also manages debouncing the renewals across multiple watch
-// attempts.
-func (s *caRotationService) Run(ctx context.Context) error {
-	rd := debouncer{
-		f:              s.reloadBroadcaster.broadcast,
-		debouncePeriod: time.Second * 10,
-	}
-	jitter := retryutils.DefaultJitter
-
-	for {
-		err := s.watchCARotations(ctx, rd.attempt)
-		if ctx.Err() != nil {
-			return nil
-		}
-
-		backoffPeriod := jitter(caRotationRetryBackoff)
-
-		// If the error is due to the client being replaced with a new client
-		// as part of the credentials renewal. Ignore it, and immediately begin
-		// watching again with the new client. We can safely check for Canceled
-		// here, because if the context was actually canceled, it would've
-		// been caught in the error check immediately following watchCARotations
-		var statusErr interface {
-			GRPCStatus() *status.Status
-		}
-		isCancelledErr := errors.As(err, &statusErr) && statusErr.GRPCStatus().Code() == codes.Canceled
-		if isCancelledErr {
-			s.log.DebugContext(ctx, "CA watcher detected client closing. Waiting to rewatch", "wait", backoffPeriod)
-		} else if err != nil {
-			s.log.ErrorContext(ctx, "Error occurred whilst watching CA rotations. Waiting to retry", "wait", backoffPeriod, "error", err)
-		}
-
-		select {
-		case <-ctx.Done():
-			s.log.WarnContext(ctx, "Context canceled during backoff for CA rotation watcher. Aborting")
-			return nil
-		case <-time.After(backoffPeriod):
-		}
-	}
-}
-
-// watchCARotations establishes a watcher for CA rotations in the cluster, and
-// attempts to trigger a renewal via the debounced reload channel when it
-// detects the entry into an important rotation phase.
-func (s *caRotationService) watchCARotations(ctx context.Context, queueReload func()) error {
-	s.log.DebugContext(ctx, "Attempting to establish watch for CA events")
-
-	ident := s.getBotIdentity()
-	clusterName := ident.ClusterName
-	watcher, err := s.botClient.NewWatcher(ctx, types.Watch{
-		Kinds: []types.WatchKind{{
-			Kind: types.KindCertAuthority,
-			Filter: types.CertAuthorityFilter{
-				types.HostCA:     clusterName,
-				types.UserCA:     clusterName,
-				types.DatabaseCA: clusterName,
-			}.IntoMap(),
-		}},
-	})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer watcher.Close()
-
-	for {
-		select {
-		case event := <-watcher.Events():
-			// OpInit is a special case omitted by the Watcher when the
-			// connection succeeds.
-			if event.Type == types.OpInit {
-				s.log.InfoContext(ctx, "Started watching for CA rotations")
-				continue
-			}
-
-			ignoreReason := filterCAEvent(ctx, s.log, event, clusterName)
-			if ignoreReason != "" {
-				s.log.DebugContext(ctx, "Ignoring CA event", "reason", ignoreReason)
-				continue
-			}
-
-			// We need to debounce here, as multiple events will be received if
-			// the user is rotating multiple CAs at once.
-			s.log.InfoContext(ctx, "CA Rotation step detected; queueing renewal")
-			queueReload()
-		case <-watcher.Done():
-			if err := watcher.Error(); err != nil {
-				return trace.Wrap(err)
-			}
-			return nil
-		case <-ctx.Done():
-			return nil
-		}
-	}
-}
-
-// filterCAEvent returns a reason why an event should be ignored or an empty
-// string is a renewal is needed.
-func filterCAEvent(ctx context.Context, log *slog.Logger, event types.Event, clusterName string) string {
-	if event.Type != types.OpPut {
-		return "type not PUT"
-	}
-	ca, ok := event.Resource.(types.CertAuthority)
-	if !ok {
-		return fmt.Sprintf("event resource was not CertAuthority (%T)", event.Resource)
-	}
-	log.DebugContext(ctx, "Filtering CA", "ca", ca, "ca_kind", ca.GetKind(), "ca_sub_kind", ca.GetSubKind())
-
-	// We want to update for all phases but init and update_servers
-	phase := ca.GetRotation().Phase
-	if slices.Contains([]string{
-		"", types.RotationPhaseInit, types.RotationPhaseUpdateServers,
-	}, phase) {
-		return fmt.Sprintf("skipping due to phase '%s'", phase)
-	}
-
-	// Skip anything not from our cluster
-	if ca.GetClusterName() != clusterName {
-		return fmt.Sprintf(
-			"skipping due to cluster name of CA: was '%s', wanted '%s'",
-			ca.GetClusterName(),
-			clusterName,
-		)
-	}
-
-	// We want to skip anything that is not host, user, or db
-	if !slices.Contains([]string{
-		string(types.HostCA),
-		string(types.UserCA),
-		string(types.DatabaseCA),
-	}, ca.GetSubKind()) {
-		return fmt.Sprintf("skipping due to CA kind '%s'", ca.GetSubKind())
-	}
-
-	return ""
-}
diff --git a/lib/tbot/service_ca_rotation_test.go b/lib/tbot/service_ca_rotation_test.go
deleted file mode 100644
index e90c6a0a3b21a..0000000000000
--- a/lib/tbot/service_ca_rotation_test.go
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-func Test_filterCAEvent(t *testing.T) {
-	clusterName := "example.com"
-	createCertAuthority := func(t *testing.T, modifier func(spec *types.CertAuthoritySpecV2)) types.CertAuthority {
-		t.Helper()
-		validSpec := types.CertAuthoritySpecV2{
-			ClusterName: clusterName,
-			Type:        "host",
-			Rotation: &types.Rotation{
-				Phase: "update_clients",
-			},
-		}
-
-		if modifier != nil {
-			modifier(&validSpec)
-		}
-
-		ca, err := types.NewCertAuthority(validSpec)
-		require.NoError(t, err)
-		return ca
-	}
-
-	tests := []struct {
-		name                 string
-		event                types.Event
-		expectedIgnoreReason string
-	}{
-		{
-			name: "valid host CA rotation",
-			event: types.Event{
-				Type:     types.OpPut,
-				Resource: createCertAuthority(t, nil),
-			},
-		},
-		{
-			name: "valid user CA rotation",
-			event: types.Event{
-				Type: types.OpPut,
-				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
-					spec.Type = "user"
-				}),
-			},
-		},
-		{
-			name: "valid DB CA rotation",
-			event: types.Event{
-				Type: types.OpPut,
-				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
-					spec.Type = "db"
-				}),
-			},
-		},
-		{
-			name: "wrong type",
-			event: types.Event{
-				Type:     types.OpDelete,
-				Resource: createCertAuthority(t, nil),
-			},
-			expectedIgnoreReason: "type not PUT",
-		},
-		{
-			name: "wrong underlying resource",
-			event: types.Event{
-				Type:     types.OpPut,
-				Resource: &types.Namespace{},
-			},
-			expectedIgnoreReason: "event resource was not CertAuthority (*types.Namespace)",
-		},
-		{
-			name: "wrong phase",
-			event: types.Event{
-				Type: types.OpPut,
-				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
-					spec.Rotation.Phase = "init"
-				}),
-			},
-			expectedIgnoreReason: "skipping due to phase 'init'",
-		},
-		{
-			name: "wrong cluster name",
-			event: types.Event{
-				Type: types.OpPut,
-				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
-					spec.ClusterName = "wrong"
-				}),
-			},
-			expectedIgnoreReason: "skipping due to cluster name of CA: was 'wrong', wanted 'example.com'",
-		},
-		{
-			name: "wrong CA type",
-			event: types.Event{
-				Type: types.OpPut,
-				Resource: createCertAuthority(t, func(spec *types.CertAuthoritySpecV2) {
-					spec.Type = "jwt"
-				}),
-			},
-			expectedIgnoreReason: "skipping due to CA kind 'jwt'",
-		},
-	}
-
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ignoreReason := filterCAEvent(ctx, log, tt.event, clusterName)
-			require.Equal(t, tt.expectedIgnoreReason, ignoreReason)
-		})
-	}
-}
-
-func TestChannelBroadcaster(t *testing.T) {
-	cb := channelBroadcaster{chanSet: map[chan struct{}]struct{}{}}
-	sub1, unsubscribe1 := cb.subscribe()
-	t.Cleanup(unsubscribe1)
-	sub2, unsubscribe2 := cb.subscribe()
-	t.Cleanup(unsubscribe2)
-
-	cb.broadcast()
-	require.NotEmpty(t, sub1)
-	require.NotEmpty(t, sub2)
-
-	// remove value from sub1 to check that if sub2 is full broadcasting still
-	// works
-	<-sub1
-	cb.broadcast()
-	require.NotEmpty(t, sub1)
-
-	// empty out both channels and ensure unsubscribing means they no longer
-	// receive values
-	<-sub1
-	<-sub2
-	unsubscribe1()
-	unsubscribe2()
-	cb.broadcast()
-	require.Empty(t, sub1)
-	require.Empty(t, sub2)
-
-	// ensure unsubscribing twice doesn't cause panic
-	unsubscribe1()
-}
diff --git a/lib/tbot/service_client_credential.go b/lib/tbot/service_client_credential.go
deleted file mode 100644
index 837705395dbdc..0000000000000
--- a/lib/tbot/service_client_credential.go
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-)
-
-// ClientCredentialOutputService produces credentials which can be used to
-// connect to Teleport's API or SSH.
-type ClientCredentialOutputService struct {
-	// botAuthClient should be an auth client using the bots internal identity.
-	// This will not have any roles impersonated and should only be used to
-	// fetch CAs.
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.UnstableClientCredentialOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-}
-
-func (s *ClientCredentialOutputService) String() string {
-	return "client-credential-output"
-}
-
-func (s *ClientCredentialOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *ClientCredentialOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   s.botCfg.CredentialLifetime.RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *ClientCredentialOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"ClientCredentialOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return trace.Wrap(err, "fetching default roles")
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		s.botCfg.CredentialLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-
-	s.cfg.SetOrUpdateFacade(id)
-	return nil
-}
diff --git a/lib/tbot/service_database_output.go b/lib/tbot/service_database_output.go
deleted file mode 100644
index 5295500908b77..0000000000000
--- a/lib/tbot/service_database_output.go
+++ /dev/null
@@ -1,310 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"fmt"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/client/identityfile"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-)
-
-// DatabaseOutputService generates the artifacts necessary to connect to a
-// database using Teleport.
-type DatabaseOutputService struct {
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.DatabaseOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-}
-
-func (s *DatabaseOutputService) String() string {
-	return fmt.Sprintf("database-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *DatabaseOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *DatabaseOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *DatabaseOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"DatabaseOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	var err error
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-		if err != nil {
-			return trace.Wrap(err, "fetching default roles")
-		}
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	route, err := getRouteToDatabase(
-		ctx,
-		s.log,
-		impersonatedClient,
-		s.cfg.Service,
-		s.cfg.Username,
-		s.cfg.Database,
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	routedIdentity, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		id,
-		roles,
-		effectiveLifetime.TTL,
-		func(req *proto.UserCertsRequest) {
-			req.RouteToDatabase = route
-		},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	s.log.InfoContext(
-		ctx,
-		"Generated identity for database",
-		"db_service", route.ServiceName,
-	)
-
-	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// TODO(noah): It's likely the Database output does not really need to
-	// output all these CAs - but - for backwards compat reasons, we output them.
-	// Revisit this at a later date and make a call.
-	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	return trace.Wrap(s.render(ctx, routedIdentity, hostCAs, userCAs, databaseCAs), "rendering")
-}
-
-func (s *DatabaseOutputService) render(
-	ctx context.Context,
-	routedIdentity *identity.Identity,
-	hostCAs, userCAs, databaseCAs []types.CertAuthority,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"DatabaseOutputService/render",
-	)
-	defer span.End()
-
-	keyRing, err := NewClientKeyRing(routedIdentity, hostCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := writeTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := writeIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "writing identity file")
-	}
-	if err := identity.SaveIdentity(
-		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
-	); err != nil {
-		return trace.Wrap(err, "persisting identity")
-	}
-
-	switch s.cfg.Format {
-	case config.MongoDatabaseFormat:
-		if err := writeMongoDatabaseFiles(
-			ctx, s.log, routedIdentity, databaseCAs, s.cfg.Destination,
-		); err != nil {
-			return trace.Wrap(err, "writing cockroach database files")
-		}
-	case config.CockroachDatabaseFormat:
-		if err := writeCockroachDatabaseFiles(
-			ctx, s.log, routedIdentity, databaseCAs, s.cfg.Destination,
-		); err != nil {
-			return trace.Wrap(err, "writing cockroach database files")
-		}
-	case config.TLSDatabaseFormat:
-		if err := writeIdentityFileTLS(
-			ctx, s.log, keyRing, s.cfg.Destination,
-		); err != nil {
-			return trace.Wrap(err, "writing tls database format files")
-		}
-	}
-
-	return nil
-}
-
-func writeCockroachDatabaseFiles(
-	ctx context.Context,
-	log *slog.Logger,
-	routedIdentity *identity.Identity,
-	databaseCAs []types.CertAuthority,
-	dest bot.Destination,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"writeCockroachDatabaseFiles",
-	)
-	defer span.End()
-
-	// Cockroach format specifically uses database CAs rather than hostCAs
-	keyRing, err := NewClientKeyRing(routedIdentity, databaseCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: config.DefaultCockroachDirName,
-		Writer:     newBotConfigWriter(ctx, dest, config.DefaultCockroachDirName),
-		KeyRing:    keyRing,
-		Format:     identityfile.FormatCockroach,
-
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	log.DebugContext(ctx, "Wrote CockroachDB files", "files", files)
-	return nil
-}
-
-func writeMongoDatabaseFiles(
-	ctx context.Context,
-	log *slog.Logger,
-	routedIdentity *identity.Identity,
-	databaseCAs []types.CertAuthority,
-	dest bot.Destination,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"writeMongoDatabaseFiles",
-	)
-	defer span.End()
-
-	// Mongo format specifically uses database CAs rather than hostCAs
-	keyRing, err := NewClientKeyRing(routedIdentity, databaseCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: config.DefaultMongoPrefix,
-		Writer:     newBotConfigWriter(ctx, dest, ""),
-		KeyRing:    keyRing,
-		Format:     identityfile.FormatMongo,
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	log.DebugContext(ctx, "Wrote MongoDB identity files", "files", files)
-	return nil
-}
-
-// chooseOneDatabase chooses one matched database by name, or tries to choose
-// one database by unambiguous "discovered name".
-func chooseOneDatabase(databases []types.Database, name string) (types.Database, error) {
-	return chooseOneResource(databases, name, "database")
-}
diff --git a/lib/tbot/service_database_tunnel.go b/lib/tbot/service_database_tunnel.go
deleted file mode 100644
index 28beee1a1df9c..0000000000000
--- a/lib/tbot/service_database_tunnel.go
+++ /dev/null
@@ -1,300 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"crypto/tls"
-	"fmt"
-	"log/slog"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/srv/alpnproxy"
-	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-var _ alpnproxy.LocalProxyMiddleware = (*alpnProxyMiddleware)(nil)
-
-type alpnProxyMiddleware struct {
-	onNewConnection func(ctx context.Context, lp *alpnproxy.LocalProxy) error
-	onStart         func(ctx context.Context, lp *alpnproxy.LocalProxy) error
-}
-
-func (a alpnProxyMiddleware) OnNewConnection(ctx context.Context, lp *alpnproxy.LocalProxy) error {
-	if a.onNewConnection != nil {
-		return a.onNewConnection(ctx, lp)
-	}
-	return nil
-}
-
-func (a alpnProxyMiddleware) OnStart(ctx context.Context, lp *alpnproxy.LocalProxy) error {
-	if a.onStart != nil {
-		return a.onStart(ctx, lp)
-	}
-	return nil
-}
-
-// DatabaseTunnelService is a service that listens on a local port and forwards
-// connections to a remote database service. It is an authenticating tunnel and
-// will automatically issue and renew certificates as needed.
-type DatabaseTunnelService struct {
-	botCfg         *config.BotConfig
-	cfg            *config.DatabaseTunnelService
-	proxyPingCache *proxyPingCache
-	log            *slog.Logger
-	resolver       reversetunnelclient.Resolver
-	botClient      *authclient.Client
-	getBotIdentity getBotIdentityFn
-}
-
-// buildLocalProxyConfig initializes the service, fetching any initial information and setting
-// up the localproxy.
-func (s *DatabaseTunnelService) buildLocalProxyConfig(ctx context.Context) (lpCfg alpnproxy.LocalProxyConfig, err error) {
-	ctx, span := tracer.Start(ctx, "DatabaseTunnelService/buildLocalProxyConfig")
-	defer span.End()
-
-	// Determine the roles to use for the impersonated db access user. We fall
-	// back to all the roles the bot has if none are configured.
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botClient, s.getBotIdentity())
-		if err != nil {
-			return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "fetching default roles")
-		}
-		s.log.DebugContext(ctx, "No roles configured, using all roles available.", "roles", roles)
-	}
-
-	proxyPing, err := s.proxyPingCache.ping(ctx)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "pinging proxy")
-	}
-	proxyAddr, err := proxyPing.proxyWebAddr()
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "determining proxy web address")
-	}
-
-	// Fetch information about the database and then issue the initial
-	// certificate. We issue the initial certificate to allow us to fail faster.
-	// We cache the routeToDatabase as these will not change during the lifetime
-	// of the service and this reduces the time needed to issue a new
-	// certificate.
-	s.log.DebugContext(ctx, "Determining route to database.")
-	routeToDatabase, err := s.getRouteToDatabaseWithImpersonation(ctx, roles)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
-	}
-	s.log.DebugContext(
-		ctx,
-		"Identified route to database.",
-		"service_name", routeToDatabase.ServiceName,
-		"protocol", routeToDatabase.Protocol,
-		"database", routeToDatabase.Database,
-		"username", routeToDatabase.Username,
-	)
-
-	s.log.DebugContext(ctx, "Issuing initial certificate for local proxy.")
-	dbCert, err := s.issueCert(ctx, routeToDatabase, roles)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
-	}
-	s.log.DebugContext(ctx, "Issued initial certificate for local proxy.")
-
-	middleware := alpnProxyMiddleware{
-		onNewConnection: func(ctx context.Context, lp *alpnproxy.LocalProxy) error {
-			ctx, span := tracer.Start(ctx, "DatabaseTunnelService/OnNewConnection")
-			defer span.End()
-
-			// Check if the certificate needs reissuing, if so, reissue.
-			if err := lp.CheckDBCert(ctx, tlsca.RouteToDatabase{
-				ServiceName: routeToDatabase.ServiceName,
-				Protocol:    routeToDatabase.Protocol,
-				Database:    routeToDatabase.Database,
-				Username:    routeToDatabase.Username,
-			}); err != nil {
-				s.log.InfoContext(ctx, "Certificate for tunnel needs reissuing.", "reason", err.Error())
-				cert, err := s.issueCert(ctx, routeToDatabase, roles)
-				if err != nil {
-					return trace.Wrap(err, "issuing cert")
-				}
-				lp.SetCert(*cert)
-			}
-			return nil
-		},
-	}
-
-	alpnProtocol, err := common.ToALPNProtocol(routeToDatabase.Protocol)
-	if err != nil {
-		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
-
-	}
-	lpConfig := alpnproxy.LocalProxyConfig{
-		Middleware: middleware,
-
-		RemoteProxyAddr:    proxyAddr,
-		ParentContext:      ctx,
-		Protocols:          []common.Protocol{alpnProtocol},
-		Cert:               *dbCert,
-		InsecureSkipVerify: s.botCfg.Insecure,
-	}
-	if client.IsALPNConnUpgradeRequired(
-		ctx,
-		proxyAddr,
-		s.botCfg.Insecure,
-	) {
-		lpConfig.ALPNConnUpgradeRequired = true
-		// If ALPN Conn Upgrade will be used, we need to set the cluster CAs
-		// to validate the Proxy's auth issued host cert.
-		lpConfig.RootCAs = s.getBotIdentity().TLSCAPool
-	}
-
-	return lpConfig, nil
-}
-
-func (s *DatabaseTunnelService) Run(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "DatabaseTunnelService/Run")
-	defer span.End()
-
-	l := s.cfg.Listener
-	if l == nil {
-		s.log.DebugContext(ctx, "Opening listener for database tunnel.", "listen", s.cfg.Listen)
-		var err error
-		l, err = createListener(ctx, s.log, s.cfg.Listen)
-		if err != nil {
-			return trace.Wrap(err, "opening listener")
-		}
-		defer func() {
-			if err := l.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
-				s.log.ErrorContext(ctx, "Failed to close listener", "error", err)
-			}
-		}()
-	}
-
-	lpCfg, err := s.buildLocalProxyConfig(ctx)
-	if err != nil {
-		return trace.Wrap(err, "building local proxy config")
-	}
-	lpCfg.Listener = l
-
-	lp, err := alpnproxy.NewLocalProxy(lpCfg)
-	if err != nil {
-		return trace.Wrap(err, "creating local proxy")
-	}
-	defer func() {
-		if err := lp.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Failed to close local proxy", "error", err)
-		}
-	}()
-	// Closed further down.
-
-	// lp.Start will block and continues to block until lp.Close() is called.
-	// Despite taking a context, it will not exit until the first connection is
-	// made after the context is canceled.
-	var errCh = make(chan error, 1)
-	go func() {
-		errCh <- lp.Start(ctx)
-	}()
-	s.log.InfoContext(ctx, "Listening for connections.", "address", l.Addr().String())
-
-	select {
-	case <-ctx.Done():
-		return nil
-	case err := <-errCh:
-		return trace.Wrap(err, "local proxy failed")
-	}
-}
-
-// getRouteToDatabaseWithImpersonation fetches the route to the database with
-// impersonation of roles. This ensures that the user's selected roles actually
-// grant access to the database.
-func (s *DatabaseTunnelService) getRouteToDatabaseWithImpersonation(ctx context.Context, roles []string) (proto.RouteToDatabase, error) {
-	ctx, span := tracer.Start(ctx, "DatabaseTunnelService/getRouteToDatabaseWithImpersonation")
-	defer span.End()
-
-	impersonatedIdentity, err := generateIdentity(
-		ctx,
-		s.botClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return proto.RouteToDatabase{}, trace.Wrap(err)
-	}
-
-	impersonatedClient, err := clientForFacade(
-		ctx,
-		s.log,
-		s.botCfg,
-		identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, impersonatedIdentity),
-		s.resolver,
-	)
-	if err != nil {
-		return proto.RouteToDatabase{}, trace.Wrap(err)
-	}
-	defer func() {
-		if err := impersonatedClient.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Failed to close impersonated client.", "error", err)
-		}
-	}()
-
-	return getRouteToDatabase(ctx, s.log, impersonatedClient, s.cfg.Service, s.cfg.Username, s.cfg.Database)
-}
-
-func (s *DatabaseTunnelService) issueCert(
-	ctx context.Context,
-	route proto.RouteToDatabase,
-	roles []string,
-) (*tls.Certificate, error) {
-	ctx, span := tracer.Start(ctx, "DatabaseTunnelService/issueCert")
-	defer span.End()
-
-	s.log.DebugContext(ctx, "Requesting issuance of certificate for tunnel proxy.")
-	ident, err := generateIdentity(
-		ctx,
-		s.botClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		func(req *proto.UserCertsRequest) {
-			req.RouteToDatabase = route
-		})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	s.log.InfoContext(ctx, "Certificate issued for tunnel proxy.")
-
-	return ident.TLSCert, nil
-}
-
-// String returns a human-readable string that can uniquely identify the
-// service.
-func (s *DatabaseTunnelService) String() string {
-	return fmt.Sprintf("%s:%s:%s", config.DatabaseTunnelServiceType, s.cfg.Listen, s.cfg.Service)
-}
diff --git a/lib/tbot/service_diagnostics.go b/lib/tbot/service_diagnostics.go
deleted file mode 100644
index 2a78e684bbd0a..0000000000000
--- a/lib/tbot/service_diagnostics.go
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"errors"
-	"log/slog"
-	"net/http"
-	"net/http/pprof"
-
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-
-	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/lib/defaults"
-)
-
-// diagnosticsService is a [bot.Service] that exposes diagnostics endpoints.
-// It's only started when a --diag-addr is provided.
-type diagnosticsService struct {
-	log          *slog.Logger
-	diagAddr     string
-	pprofEnabled bool
-}
-
-func (s *diagnosticsService) String() string {
-	return "diagnostics"
-}
-
-func (s *diagnosticsService) Run(ctx context.Context) error {
-	s.log.InfoContext(
-		ctx,
-		"diagnostics service will be starting",
-		"addr", s.diagAddr,
-	)
-	mux := http.NewServeMux()
-	mux.Handle("/metrics", promhttp.Handler())
-	// Only expose pprof when `-d` is provided.
-	if s.pprofEnabled {
-		s.log.InfoContext(ctx, "debug mode enabled, profiling endpoints will be served on the diagnostics service.")
-		mux.HandleFunc("/debug/pprof/", pprof.Index)
-		mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-		mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-		mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-		mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	}
-	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusNotFound)
-		msg := "404 - Not Found\n\nI'm a little tbot,\nshort and stout,\nthe page you seek,\nis not about.\n\nYou can find out more information about the diagnostics service at https://goteleport.com/docs/reference/machine-id/diagnostics-service/"
-		_, _ = w.Write([]byte(msg))
-	}))
-	mux.Handle("/livez", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("OK"))
-	}))
-	mux.Handle("/readyz", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// TODO(noah): Eventually this should diverge from /livez and report
-		// the readiness status from each sub-service, with an error status if
-		// any of them are not ready.
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("OK"))
-	}))
-	srv := http.Server{
-		Addr:              s.diagAddr,
-		Handler:           mux,
-		ReadTimeout:       apidefaults.DefaultIOTimeout,
-		ReadHeaderTimeout: defaults.ReadHeadersTimeout,
-		WriteTimeout:      apidefaults.DefaultIOTimeout,
-		IdleTimeout:       apidefaults.DefaultIdleTimeout,
-	}
-	go func() {
-		<-ctx.Done()
-		if err := srv.Close(); err != nil {
-			s.log.WarnContext(ctx, "Failed to close HTTP server", "error", err)
-		}
-	}()
-
-	if err := srv.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
-		return err
-	}
-
-	return nil
-}
diff --git a/lib/tbot/service_example.go b/lib/tbot/service_example.go
deleted file mode 100644
index c550c52d9f24f..0000000000000
--- a/lib/tbot/service_example.go
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"github.com/gravitational/teleport/lib/tbot/config"
-)
-
-// ExampleService is a temporary example service for testing purposes. It is
-// not intended to be used and exists to demonstrate how a user configurable
-// service integrates with the tbot service manager.
-type ExampleService struct {
-	cfg     *config.ExampleService
-	Message string `yaml:"message"`
-}
-
-func (s *ExampleService) Run(ctx context.Context) error {
-	for {
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-time.After(time.Second * 5):
-			fmt.Println("Example Service prints message:", s.Message)
-		}
-	}
-}
-
-func (s *ExampleService) String() string {
-	return fmt.Sprintf("%s:%s", config.ExampleServiceType, s.Message)
-}
diff --git a/lib/tbot/service_heartbeat.go b/lib/tbot/service_heartbeat.go
deleted file mode 100644
index 5edecbe6b1e38..0000000000000
--- a/lib/tbot/service_heartbeat.go
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"runtime"
-	"time"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/grpc"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/gravitational/teleport"
-	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
-	"github.com/gravitational/teleport/lib/tbot/config"
-)
-
-type heartbeatSubmitter interface {
-	SubmitHeartbeat(
-		ctx context.Context, in *machineidv1pb.SubmitHeartbeatRequest, opts ...grpc.CallOption,
-	) (*machineidv1pb.SubmitHeartbeatResponse, error)
-}
-
-type heartbeatService struct {
-	now                func() time.Time
-	log                *slog.Logger
-	botCfg             *config.BotConfig
-	startedAt          time.Time
-	heartbeatSubmitter heartbeatSubmitter
-	interval           time.Duration
-	retryLimit         int
-}
-
-func (s *heartbeatService) heartbeat(ctx context.Context, isStartup bool) error {
-	s.log.DebugContext(ctx, "Sending heartbeat")
-	hostName, err := os.Hostname()
-	if err != nil {
-		s.log.WarnContext(ctx, "Failed to determine hostname for heartbeat", "error", err)
-	}
-
-	hb := &machineidv1pb.BotInstanceStatusHeartbeat{
-		RecordedAt:   timestamppb.New(s.now()),
-		Hostname:     hostName,
-		IsStartup:    isStartup,
-		Uptime:       durationpb.New(s.now().Sub(s.startedAt)),
-		OneShot:      s.botCfg.Oneshot,
-		JoinMethod:   string(s.botCfg.Onboarding.JoinMethod),
-		Version:      teleport.Version,
-		Architecture: runtime.GOARCH,
-		Os:           runtime.GOOS,
-	}
-
-	_, err = s.heartbeatSubmitter.SubmitHeartbeat(ctx, &machineidv1pb.SubmitHeartbeatRequest{
-		Heartbeat: hb,
-	})
-	if err != nil {
-		return trace.Wrap(err, "submitting heartbeat")
-	}
-
-	s.log.InfoContext(ctx, "Sent heartbeat", "data", hb.String())
-	return nil
-}
-
-func (s *heartbeatService) OneShot(ctx context.Context) error {
-	err := s.heartbeat(ctx, true)
-	// Ignore not implemented as this is likely confusing.
-	// TODO(noah): Remove NotImplemented check at V18 assuming V17 first major
-	// with heartbeating.
-	if err != nil && !trace.IsNotImplemented(err) {
-		return trace.Wrap(err)
-	}
-	return nil
-}
-
-func (s *heartbeatService) Run(ctx context.Context) error {
-	isStartup := true
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "submit-heartbeat",
-		log:        s.log,
-		interval:   s.interval,
-		retryLimit: s.retryLimit,
-		f: func(ctx context.Context) error {
-			err := s.heartbeat(ctx, isStartup)
-			// TODO(noah): Remove NotImplemented check at V18 assuming V17 first
-			// major with heartbeating.
-			if trace.IsNotImplemented(err) {
-				s.log.DebugContext(
-					ctx,
-					"Cluster does not support Bot Instance heartbeats",
-				)
-				return nil
-			}
-			if err != nil {
-				return trace.Wrap(err, "submitting heartbeat")
-			}
-			isStartup = false
-			return nil
-		},
-	})
-	return trace.Wrap(err)
-}
-
-func (s *heartbeatService) String() string {
-	return "heartbeat"
-}
diff --git a/lib/tbot/service_heartbeat_test.go b/lib/tbot/service_heartbeat_test.go
deleted file mode 100644
index c51039c88dd92..0000000000000
--- a/lib/tbot/service_heartbeat_test.go
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"os"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/gravitational/teleport"
-	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-type fakeHeartbeatSubmitter struct {
-	ch chan *machineidv1pb.SubmitHeartbeatRequest
-}
-
-func (f *fakeHeartbeatSubmitter) SubmitHeartbeat(
-	ctx context.Context, in *machineidv1pb.SubmitHeartbeatRequest, opts ...grpc.CallOption,
-) (*machineidv1pb.SubmitHeartbeatResponse, error) {
-	f.ch <- in
-	return &machineidv1pb.SubmitHeartbeatResponse{}, nil
-}
-
-func TestHeartbeatService(t *testing.T) {
-	t.Parallel()
-
-	log := utils.NewSlogLoggerForTests()
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	fhs := &fakeHeartbeatSubmitter{
-		ch: make(chan *machineidv1pb.SubmitHeartbeatRequest, 2),
-	}
-	svc := heartbeatService{
-		now: func() time.Time {
-			return time.Date(2024, time.April, 1, 12, 0, 0, 0, time.UTC)
-		},
-		log: log,
-		botCfg: &config.BotConfig{
-			Oneshot: false,
-			Onboarding: config.OnboardingConfig{
-				JoinMethod: types.JoinMethodGitHub,
-			},
-		},
-		startedAt:          time.Date(2024, time.April, 1, 11, 0, 0, 0, time.UTC),
-		heartbeatSubmitter: fhs,
-		interval:           time.Second,
-		retryLimit:         3,
-	}
-
-	hostName, err := os.Hostname()
-	require.NoError(t, err)
-
-	errCh := make(chan error, 1)
-	go func() {
-		errCh <- svc.Run(ctx)
-	}()
-
-	got := <-fhs.ch
-	want := &machineidv1pb.SubmitHeartbeatRequest{
-		Heartbeat: &machineidv1pb.BotInstanceStatusHeartbeat{
-			RecordedAt:   timestamppb.New(svc.now()),
-			Hostname:     hostName,
-			IsStartup:    true,
-			OneShot:      false,
-			Uptime:       durationpb.New(time.Hour),
-			Version:      teleport.Version,
-			Architecture: runtime.GOARCH,
-			Os:           runtime.GOOS,
-			JoinMethod:   string(types.JoinMethodGitHub),
-		},
-	}
-	assert.Empty(t, cmp.Diff(want, got, protocmp.Transform()))
-
-	got = <-fhs.ch
-	want.Heartbeat.IsStartup = false
-	assert.Empty(t, cmp.Diff(want, got, protocmp.Transform()))
-
-	cancel()
-	assert.NoError(t, <-errCh)
-}
diff --git a/lib/tbot/service_identity_output.go b/lib/tbot/service_identity_output.go
deleted file mode 100644
index a14d60e84e1d2..0000000000000
--- a/lib/tbot/service_identity_output.go
+++ /dev/null
@@ -1,428 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"path/filepath"
-	"strings"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
-	"github.com/gravitational/teleport/lib/config/openssh"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/ssh"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// IdentityOutputService produces credentials which can be used to connect to
-// Teleport's API or SSH.
-type IdentityOutputService struct {
-	// botAuthClient should be an auth client using the bots internal identity.
-	// This will not have any roles impersonated and should only be used to
-	// fetch CAs.
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.IdentityOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	proxyPingCache    *proxyPingCache
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-	// executablePath is called to get the path to the tbot executable.
-	// Usually this is os.Executable
-	executablePath   func() (string, error)
-	alpnUpgradeCache *alpnProxyConnUpgradeRequiredCache
-}
-
-func (s *IdentityOutputService) String() string {
-	return fmt.Sprintf("identity-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *IdentityOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *IdentityOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *IdentityOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"IdentityOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	var err error
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-		if err != nil {
-			return trace.Wrap(err, "fetching default roles")
-		}
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		effectiveLifetime.TTL,
-		func(req *proto.UserCertsRequest) {
-			req.ReissuableRoleImpersonation = s.cfg.AllowReissue
-		},
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	if s.cfg.Cluster != "" {
-		id, err = generateIdentity(
-			ctx,
-			s.botAuthClient,
-			id,
-			roles,
-			cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-			func(req *proto.UserCertsRequest) {
-				req.RouteToCluster = s.cfg.Cluster
-				req.ReissuableRoleImpersonation = s.cfg.AllowReissue
-			},
-		)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := s.render(ctx, id, hostCAs, userCAs, databaseCAs); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if s.cfg.SSHConfigMode == config.SSHConfigModeOn {
-		clusterNames, err := getClusterNames(ctx, impersonatedClient, id.ClusterName)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		proxyPing, err := s.proxyPingCache.ping(ctx)
-		if err != nil {
-			return trace.Wrap(err, "pinging proxy")
-		}
-		if err := renderSSHConfig(
-			ctx,
-			s.log,
-			proxyPing,
-			clusterNames,
-			s.cfg.Destination,
-			s.botAuthClient,
-			s.executablePath,
-			s.alpnUpgradeCache,
-			s.botCfg,
-		); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return nil
-}
-
-func (s *IdentityOutputService) render(
-	ctx context.Context,
-	id *identity.Identity,
-	hostCAs, userCAs, databaseCAs []types.CertAuthority,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"IdentityOutputService/render",
-	)
-	defer span.End()
-
-	keyRing, err := NewClientKeyRing(id, hostCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := writeTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs); err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := writeIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "writing identity file")
-	}
-	if err := identity.SaveIdentity(
-		ctx, id, s.cfg.Destination, identity.DestinationKinds()...,
-	); err != nil {
-		return trace.Wrap(err, "persisting identity")
-	}
-
-	return nil
-}
-
-type certAuthGetter interface {
-	GetCertAuthority(
-		ctx context.Context,
-		id types.CertAuthID,
-		includeSigningKeys bool,
-	) (types.CertAuthority, error)
-}
-
-type alpnTester interface {
-	isUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error)
-}
-
-func renderSSHConfig(
-	ctx context.Context,
-	log *slog.Logger,
-	proxyPing *proxyPingResponse,
-	clusterNames []string,
-	dest bot.Destination,
-	certAuthGetter certAuthGetter,
-	getExecutablePath func() (string, error),
-	alpnTester alpnTester,
-	botCfg *config.BotConfig,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"renderSSHConfig",
-	)
-	defer span.End()
-
-	proxyAddr, err := proxyPing.proxySSHAddr()
-	if err != nil {
-		return trace.Wrap(err, "determining proxy ssh addr")
-	}
-	proxyHost, proxyPort, err := utils.SplitHostPort(proxyAddr)
-	if err != nil {
-		return trace.BadParameter(
-			"proxy %+v has no usable public address: %v",
-			proxyAddr, err,
-		)
-	}
-
-	// We'll write known_hosts regardless of Destination type, it's still
-	// useful alongside a manually-written ssh_config.
-	knownHosts, clusterKnownHosts, err := ssh.GenerateKnownHosts(
-		ctx,
-		certAuthGetter,
-		clusterNames,
-		proxyHost,
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := dest.Write(
-		ctx, ssh.KnownHostsName, []byte(knownHosts),
-	); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// We only want to proceed further if we have a directory destination
-	destDirectory, ok := dest.(*config.DestinationDirectory)
-	if !ok {
-		return nil
-	}
-
-	// Backend note: Prefer to use absolute paths for filesystem backends.
-	// If the backend is something else, use "". ssh_config will generate with
-	// paths relative to the Destination. This doesn't work with ssh in
-	// practice so adjusting the config for impossible-to-determine-in-advance
-	// Destination backends is left as an exercise to the user.
-	absDestPath, err := filepath.Abs(destDirectory.Path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	executablePath, err := getExecutablePath()
-	if errors.Is(err, autoupdate.ErrUnstableExecutable) {
-		log.WarnContext(ctx, "ssh_config will be created with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
-	} else if err != nil {
-		return trace.Wrap(err)
-	}
-
-	var sshConfigBuilder strings.Builder
-	knownHostsPath := filepath.Join(absDestPath, ssh.KnownHostsName)
-	identityFilePath := filepath.Join(absDestPath, identity.PrivateKeyKey)
-	certificateFilePath := filepath.Join(absDestPath, identity.SSHCertKey)
-
-	// Test if ALPN upgrade is required, this will only be necessary if we
-	// are using TLS routing.
-	connUpgradeRequired := false
-	if proxyPing.Proxy.TLSRoutingEnabled {
-		connUpgradeRequired, err = alpnTester.isUpgradeRequired(
-			ctx, proxyAddr, botCfg.Insecure,
-		)
-		if err != nil {
-			return trace.Wrap(err, "determining if ALPN upgrade is required")
-		}
-	}
-
-	// Generate SSH config
-	if err := openssh.WriteSSHConfig(&sshConfigBuilder, &openssh.SSHConfigParameters{
-		AppName:             openssh.TbotApp,
-		ClusterNames:        clusterNames,
-		KnownHostsPath:      knownHostsPath,
-		IdentityFilePath:    identityFilePath,
-		CertificateFilePath: certificateFilePath,
-		ProxyHost:           proxyHost,
-		ProxyPort:           proxyPort,
-		ExecutablePath:      executablePath,
-		DestinationDir:      absDestPath,
-
-		PureTBotProxyCommand: true,
-		Insecure:             botCfg.Insecure,
-		FIPS:                 botCfg.FIPS,
-		TLSRouting:           proxyPing.Proxy.TLSRoutingEnabled,
-		ConnectionUpgrade:    connUpgradeRequired,
-		// Session resumption is enabled by default, this can be
-		// configurable at a later date if we discover reasons for this to
-		// be disabled.
-		Resume: true,
-	}); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Generate the per cluster files
-	for _, clusterName := range clusterNames {
-		sshConfigName := fmt.Sprintf("%s.%s", clusterName, ssh.ConfigName)
-		knownHostsName := fmt.Sprintf("%s.%s", clusterName, ssh.KnownHostsName)
-		knownHostsPath := filepath.Join(absDestPath, knownHostsName)
-
-		sb := &strings.Builder{}
-		if err := openssh.WriteClusterSSHConfig(sb, &openssh.ClusterSSHConfigParameters{
-			AppName:             openssh.TbotApp,
-			ClusterName:         clusterName,
-			KnownHostsPath:      knownHostsPath,
-			IdentityFilePath:    identityFilePath,
-			CertificateFilePath: certificateFilePath,
-			ProxyHost:           proxyHost,
-			ProxyPort:           proxyPort,
-			ExecutablePath:      executablePath,
-			DestinationDir:      absDestPath,
-
-			Insecure:          botCfg.Insecure,
-			FIPS:              botCfg.FIPS,
-			TLSRouting:        proxyPing.Proxy.TLSRoutingEnabled,
-			ConnectionUpgrade: connUpgradeRequired,
-			// Session resumption is enabled by default, this can be
-			// configurable at a later date if we discover reasons for this to
-			// be disabled.
-			Resume: true,
-		}); err != nil {
-			return trace.Wrap(err)
-		}
-		if err := destDirectory.Write(ctx, sshConfigName, []byte(sb.String())); err != nil {
-			return trace.Wrap(err)
-		}
-
-		knownHosts, ok := clusterKnownHosts[clusterName]
-		if !ok {
-			log.WarnContext(
-				ctx,
-				"No generated known_hosts for cluster, will skip",
-				"cluster", clusterName,
-			)
-			continue
-		}
-		if err := destDirectory.Write(ctx, knownHostsName, []byte(knownHosts)); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	if err := destDirectory.Write(ctx, ssh.ConfigName, []byte(sshConfigBuilder.String())); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-func getClusterNames(
-	ctx context.Context, client *authclient.Client, connectedClusterName string,
-) ([]string, error) {
-	allClusterNames := []string{connectedClusterName}
-
-	leafClusters, err := client.GetRemoteClusters(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	for _, lc := range leafClusters {
-		allClusterNames = append(allClusterNames, lc.GetName())
-	}
-
-	return allClusterNames, nil
-}
diff --git a/lib/tbot/service_identity_output_test.go b/lib/tbot/service_identity_output_test.go
deleted file mode 100644
index 35d9007e09932..0000000000000
--- a/lib/tbot/service_identity_output_test.go
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/client/webclient"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/ssh"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/testutils/golden"
-)
-
-const (
-	// mockProxyAddr is the address of the mock proxy server, used in tests
-	mockProxyAddr    = "tele.blackmesa.gov:443"
-	mockProxySSHAddr = "tele.blackmesa.gov:3023"
-	// mockRemoteClusterName is the remote cluster name used for the mock auth
-	// client
-	mockRemoteClusterName = "tele.aperture.labs"
-)
-
-type mockCertAuthorityGetter struct {
-	remoteClusterName string
-	clusterName       string
-}
-
-func (p *mockCertAuthorityGetter) GetCertAuthority(
-	ctx context.Context, id types.CertAuthID, loadKeys bool,
-) (types.CertAuthority, error) {
-	if !slices.Contains([]string{p.clusterName, p.remoteClusterName}, id.DomainName) {
-		return nil, trace.NotFound("specified id %q not found", id)
-	}
-	if loadKeys {
-		return nil, trace.BadParameter("unexpected loading of key")
-	}
-
-	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
-		// Pretend to be the correct type.
-		Type:        id.Type,
-		ClusterName: id.DomainName,
-		ActiveKeys: types.CAKeySet{
-			TLS: []*types.TLSKeyPair{
-				{
-					Cert: []byte(fixtures.TLSCACertPEM),
-					Key:  []byte(fixtures.TLSCAKeyPEM),
-				},
-			},
-			SSH: []*types.SSHKeyPair{
-				// Two of these to ensure that both are written to known hosts
-				{
-					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
-					PublicKey:  []byte(fixtures.SSHCAPublicKey),
-				},
-				{
-					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
-					PublicKey:  []byte(fixtures.SSHCAPublicKey),
-				},
-			},
-		},
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return ca, nil
-}
-
-func (p *mockCertAuthorityGetter) GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error) {
-	// We'll just wrap GetCertAuthority()'s dummy CA.
-	ca, err := p.GetCertAuthority(ctx, types.CertAuthID{
-		// Just pretend to be whichever type of CA was requested.
-		Type:       caType,
-		DomainName: p.clusterName,
-	}, false)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return []types.CertAuthority{ca}, nil
-}
-
-type mockALPNConnTester struct {
-	isALPNUpgradeRequired bool
-}
-
-func (p *mockALPNConnTester) isUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error) {
-	return p.isALPNUpgradeRequired, nil
-}
-
-func Test_renderSSHConfig(t *testing.T) {
-	tests := []struct {
-		Name        string
-		TLSRouting  bool
-		ALPNUpgrade bool
-	}{
-		{
-			Name:        "no tls routing, no alpn upgrade",
-			TLSRouting:  false,
-			ALPNUpgrade: false,
-		},
-		{
-			Name:        "no tls routing, alpn upgrade",
-			TLSRouting:  false,
-			ALPNUpgrade: true,
-		},
-		{
-			Name:        "tls routing, no alpn upgrade",
-			TLSRouting:  true,
-			ALPNUpgrade: false,
-		},
-		{
-			Name:        "tls routing, alpn upgrade",
-			TLSRouting:  true,
-			ALPNUpgrade: true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.Name, func(t *testing.T) {
-			dir := t.TempDir()
-
-			// identity is passed in, but not used.
-			dest := &config.DestinationDirectory{
-				Path:     dir,
-				Symlinks: botfs.SymlinksInsecure,
-				ACLs:     botfs.ACLOff,
-			}
-
-			err := renderSSHConfig(
-				context.Background(),
-				utils.NewSlogLoggerForTests(),
-				&proxyPingResponse{
-					PingResponse: &webclient.PingResponse{
-						ClusterName: mockClusterName,
-						Proxy: webclient.ProxySettings{
-							TLSRoutingEnabled: tc.TLSRouting,
-							SSH: webclient.SSHProxySettings{
-								PublicAddr:    mockProxyAddr,
-								SSHPublicAddr: mockProxySSHAddr,
-							},
-						},
-					},
-				},
-				[]string{mockClusterName, mockRemoteClusterName},
-				dest,
-				&mockCertAuthorityGetter{
-					remoteClusterName: mockRemoteClusterName,
-					clusterName:       mockClusterName,
-				},
-				fakeGetExecutablePath,
-				&mockALPNConnTester{
-					isALPNUpgradeRequired: tc.ALPNUpgrade,
-				},
-				&config.BotConfig{},
-			)
-			require.NoError(t, err)
-
-			replaceTestDir := func(b []byte) []byte {
-				return bytes.ReplaceAll(b, []byte(dir), []byte("/test/dir"))
-			}
-
-			knownHostBytes, err := os.ReadFile(filepath.Join(dir, ssh.KnownHostsName))
-			require.NoError(t, err)
-			knownHostBytes = replaceTestDir(knownHostBytes)
-			sshConfigBytes, err := os.ReadFile(filepath.Join(dir, ssh.ConfigName))
-			require.NoError(t, err)
-			sshConfigBytes = replaceTestDir(sshConfigBytes)
-			if golden.ShouldSet() {
-				golden.SetNamed(t, "known_hosts", knownHostBytes)
-				golden.SetNamed(t, "ssh_config", sshConfigBytes)
-			}
-			require.Equal(
-				t, string(golden.GetNamed(t, "known_hosts")), string(knownHostBytes),
-			)
-			require.Equal(
-				t, string(golden.GetNamed(t, "ssh_config")), string(sshConfigBytes),
-			)
-
-			for clusterType, clusterName := range map[string]string{
-				"local":  mockClusterName,
-				"remote": mockRemoteClusterName,
-			} {
-				clusterKnownHostBytes, err := os.ReadFile(
-					filepath.Join(dir, fmt.Sprintf("%s.%s", clusterName, ssh.KnownHostsName)),
-				)
-				require.NoError(t, err)
-				clusterKnownHostBytes = replaceTestDir(clusterKnownHostBytes)
-				clusterSSHConfigBytes, err := os.ReadFile(
-					filepath.Join(dir, fmt.Sprintf("%s.%s", clusterName, ssh.ConfigName)),
-				)
-				require.NoError(t, err)
-				clusterSSHConfigBytes = replaceTestDir(clusterSSHConfigBytes)
-
-				configGolden := fmt.Sprintf("%s_cluster_ssh_config", clusterType)
-				knownHostsGolden := fmt.Sprintf("%s_cluster_known_hosts", clusterType)
-				if golden.ShouldSet() {
-					golden.SetNamed(t, knownHostsGolden, clusterKnownHostBytes)
-					golden.SetNamed(t, configGolden, clusterSSHConfigBytes)
-				}
-				require.Equal(
-					t, string(golden.GetNamed(t, knownHostsGolden)), string(clusterKnownHostBytes),
-				)
-				require.Equal(
-					t, string(golden.GetNamed(t, configGolden)), string(clusterSSHConfigBytes),
-				)
-			}
-		})
-	}
-}
diff --git a/lib/tbot/service_kubernetes_output.go b/lib/tbot/service_kubernetes_output.go
deleted file mode 100644
index ba101d539ade6..0000000000000
--- a/lib/tbot/service_kubernetes_output.go
+++ /dev/null
@@ -1,472 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net"
-	"path/filepath"
-
-	"github.com/gravitational/trace"
-	"k8s.io/client-go/tools/clientcmd"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-
-	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/kube/kubeconfig"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
-)
-
-const defaultKubeconfigPath = "kubeconfig.yaml"
-
-// KubernetesOutputService produces credentials which can be used to connect to
-// a Kubernetes Cluster through teleport.
-type KubernetesOutputService struct {
-	// botAuthClient should be an auth client using the bots internal identity.
-	// This will not have any roles impersonated and should only be used to
-	// fetch CAs.
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.KubernetesOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	proxyPingCache    *proxyPingCache
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-	// executablePath is called to get the path to the tbot executable.
-	// Usually this is os.Executable
-	executablePath func() (string, error)
-}
-
-func (s *KubernetesOutputService) String() string {
-	return fmt.Sprintf("kubernetes-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *KubernetesOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *KubernetesOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *KubernetesOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"KubernetesOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	var err error
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-		if err != nil {
-			return trace.Wrap(err, "fetching default roles")
-		}
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	kc, err := getKubeCluster(ctx, impersonatedClient, s.cfg.KubernetesCluster)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// make sure the output matches the fully resolved kube cluster name,
-	// since it may have been just a "discovered name".
-	kubeClusterName := kc.GetName()
-	// Note: the Teleport server does attempt to verify k8s cluster names
-	// and will fail to generate certs if the cluster doesn't exist or is
-	// offline.
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	routedIdentity, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		id,
-		roles,
-		effectiveLifetime.TTL,
-		func(req *proto.UserCertsRequest) {
-			req.KubernetesCluster = kubeClusterName
-		},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	s.log.InfoContext(
-		ctx,
-		"Generated identity for Kubernetes cluster",
-		"kubernetes_cluster",
-		kubeClusterName,
-		"identity", describeTLSIdentity(ctx, s.log, routedIdentity),
-	)
-
-	// Ping the proxy to resolve connection addresses.
-	proxyPong, err := s.proxyPingCache.ping(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	clusterAddr, tlsServerName, err := selectKubeConnectionMethod(proxyPong)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// TODO(noah): It's likely the Kubernetes output does not really need to
-	// output these CAs - but - for backwards compat reasons, we output them.
-	// Revisit this at a later date and make a call.
-	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	keyRing, err := NewClientKeyRing(routedIdentity, hostCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	status := &kubernetesStatus{
-		clusterAddr:           clusterAddr,
-		tlsServerName:         tlsServerName,
-		credentials:           keyRing,
-		teleportClusterName:   proxyPong.ClusterName,
-		kubernetesClusterName: kubeClusterName,
-	}
-
-	return s.render(ctx, status, routedIdentity, hostCAs, userCAs, databaseCAs)
-}
-
-func (s *KubernetesOutputService) render(
-	ctx context.Context,
-	status *kubernetesStatus,
-	routedIdentity *identity.Identity,
-	hostCAs, userCAs, databaseCAs []types.CertAuthority,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"KubernetesOutputService/render",
-	)
-	defer span.End()
-
-	if err := writeIdentityFile(ctx, s.log, status.credentials, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "writing identity file")
-	}
-	if err := identity.SaveIdentity(
-		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
-	); err != nil {
-		return trace.Wrap(err, "persisting identity")
-	}
-	// In exec plugin mode, we write the credentials to disk and write a
-	// kubeconfig that execs `tbot` to load those credentials.
-
-	// We only support directory mode for this since the exec plugin needs
-	// to know the path to read the credentials from, and this is
-	// unpredictable with other types of destination.
-	destinationDir, isDirectoryDest := s.cfg.Destination.(*config.DestinationDirectory)
-	if !s.cfg.DisableExecPlugin {
-		if !isDirectoryDest {
-			slog.InfoContext(
-				ctx,
-				"Kubernetes template will be rendered without exec plugin because destination is not a directory. Explicitly set `disable_exec_plugin: true` in the output to suppress this message",
-				"destination", logutils.StringerAttr(s.cfg.Destination))
-			s.cfg.DisableExecPlugin = true
-		}
-	}
-
-	var err error
-	var kubeCfg *clientcmdapi.Config
-	if s.cfg.DisableExecPlugin {
-		// If they've disabled the exec plugin, we just write the credentials
-		// directly into the kubeconfig.
-		kubeCfg, err = generateKubeConfigWithoutPlugin(status)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	} else {
-		executablePath, err := s.executablePath()
-		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
-			s.log.WarnContext(ctx, "Kubernetes template will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
-		} else if err != nil {
-			return trace.Wrap(err)
-		}
-
-		kubeCfg, err = generateKubeConfigWithPlugin(status, destinationDir.Path, executablePath)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	yamlCfg, err := clientcmd.Write(*kubeCfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := s.cfg.Destination.Write(ctx, defaultKubeconfigPath, yamlCfg); err != nil {
-		return trace.Wrap(err, "writing kubeconfig")
-	}
-
-	return trace.Wrap(writeTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs))
-}
-
-// kubernetesStatus holds teleport client information necessary to populate a
-// kubeconfig.
-type kubernetesStatus struct {
-	clusterAddr           string
-	teleportClusterName   string
-	kubernetesClusterName string
-	tlsServerName         string
-	credentials           *client.KeyRing
-}
-
-func generateKubeConfigWithoutPlugin(ks *kubernetesStatus) (*clientcmdapi.Config, error) {
-	config := clientcmdapi.NewConfig()
-
-	contextName := kubeconfig.ContextName(ks.teleportClusterName, ks.kubernetesClusterName)
-	// Configure the cluster.
-	clusterCAs, err := ks.credentials.RootClusterCAs()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	cas := bytes.Join(clusterCAs, []byte("\n"))
-	if len(cas) == 0 {
-		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
-	}
-	config.Clusters[contextName] = &clientcmdapi.Cluster{
-		Server:                   ks.clusterAddr,
-		CertificateAuthorityData: cas,
-		TLSServerName:            ks.tlsServerName,
-	}
-
-	config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
-		ClientCertificateData: ks.credentials.TLSCert,
-		ClientKeyData:         ks.credentials.TLSPrivateKey.PrivateKeyPEM(),
-	}
-
-	// Last, create a context linking the cluster to the auth info.
-	config.Contexts[contextName] = &clientcmdapi.Context{
-		Cluster:  contextName,
-		AuthInfo: contextName,
-	}
-	config.CurrentContext = contextName
-
-	return config, nil
-}
-
-// generateKubeConfigWithPlugin creates a Kubernetes config object with the given cluster
-// config.
-func generateKubeConfigWithPlugin(ks *kubernetesStatus, destPath string, executablePath string) (*clientcmdapi.Config, error) {
-	config := clientcmdapi.NewConfig()
-
-	// Implementation note: tsh/kube.go generates a kubeconfig with all
-	// available clusters. This isn't especially useful in Machine ID when
-	// there's _at most_ one cluster we have permission to access for this
-	// Destination's set of certs, so instead of fetching all the k8s clusters
-	// and adding everything, we'll just stick with the single cluster name in
-	// our config file.
-	// Otherwise, we adapt this from lib/kube/kubeconfig/kubeconfig.go's
-	// Update(), but don't support env vars, insecure mode, or identity files.
-	// We do still implement `tbot kube credentials` to help client apps
-	// take better advantage of certificate renewals.
-
-	contextName := kubeconfig.ContextName(ks.teleportClusterName, ks.kubernetesClusterName)
-
-	// Configure the cluster.
-	clusterCAs, err := ks.credentials.RootClusterCAs()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	cas := bytes.Join(clusterCAs, []byte("\n"))
-	if len(cas) == 0 {
-		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
-	}
-	config.Clusters[contextName] = &clientcmdapi.Cluster{
-		Server:                   ks.clusterAddr,
-		CertificateAuthorityData: cas,
-		TLSServerName:            ks.tlsServerName,
-	}
-
-	absDestPath, err := filepath.Abs(destPath)
-	if err != nil {
-		return nil, trace.Wrap(err, "determining absolute path for destination")
-	}
-
-	// Configure the auth info.
-	execArgs := []string{"kube", "credentials",
-		fmt.Sprintf("--destination-dir=%s", absDestPath),
-	}
-	config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
-		Exec: &clientcmdapi.ExecConfig{
-			APIVersion: "client.authentication.k8s.io/v1beta1",
-			Command:    executablePath,
-			Args:       execArgs,
-		},
-	}
-
-	// Last, create a context linking the cluster to the auth info.
-	config.Contexts[contextName] = &clientcmdapi.Context{
-		Cluster:  contextName,
-		AuthInfo: contextName,
-	}
-	config.CurrentContext = contextName
-
-	return config, nil
-}
-
-// chooseOneKubeCluster chooses one matched kube cluster by name, or tries to
-// choose one kube cluster by unambiguous "discovered name".
-func chooseOneKubeCluster(clusters []types.KubeCluster, name string) (types.KubeCluster, error) {
-	return chooseOneResource(clusters, name, "kubernetes cluster")
-}
-
-func getKubeCluster(ctx context.Context, clt apiclient.GetResourcesClient, name string) (types.KubeCluster, error) {
-	ctx, span := tracer.Start(ctx, "getKubeCluster")
-	defer span.End()
-
-	servers, err := apiclient.GetAllResources[types.KubeServer](ctx, clt, &proto.ListResourcesRequest{
-		Namespace:           defaults.Namespace,
-		ResourceType:        types.KindKubeServer,
-		PredicateExpression: makeNameOrDiscoveredNamePredicate(name),
-		Limit:               int32(defaults.DefaultChunkSize),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var clusters []types.KubeCluster
-	for _, server := range servers {
-		clusters = append(clusters, server.GetCluster())
-	}
-
-	clusters = types.DeduplicateKubeClusters(clusters)
-	cluster, err := chooseOneKubeCluster(clusters, name)
-	return cluster, trace.Wrap(err)
-}
-
-// selectKubeConnectionMethod determines the address and SNI that should be
-// put into the kubeconfig file.
-func selectKubeConnectionMethod(proxyPong *proxyPingResponse) (
-	clusterAddr string, sni string, err error,
-) {
-	// First we check for TLS routing. If this is enabled, we use the Proxy's
-	// PublicAddr, and we must also specify a special SNI.
-	//
-	// Even if KubePublicAddr is specified, we still use the general
-	// PublicAddr when using TLS routing.
-	if proxyPong.Proxy.TLSRoutingEnabled {
-		addr, err := proxyPong.proxyWebAddr()
-		if err != nil {
-			return "", "", trace.Wrap(err)
-		}
-		host, _, err := net.SplitHostPort(addr)
-		if err != nil {
-			return "", "", trace.Wrap(err, "parsing proxy public_addr")
-		}
-
-		return fmt.Sprintf("https://%s", addr), client.GetKubeTLSServerName(host), nil
-	}
-
-	// Next, we try to use the KubePublicAddr.
-	if proxyPong.Proxy.Kube.PublicAddr != "" {
-		return fmt.Sprintf("https://%s", proxyPong.Proxy.Kube.PublicAddr), "", nil
-	}
-
-	// Finally, we fall back to the main proxy PublicAddr with the port from
-	// KubeListenAddr.
-	if proxyPong.Proxy.Kube.ListenAddr != "" {
-		host, _, err := net.SplitHostPort(proxyPong.Proxy.SSH.PublicAddr)
-		if err != nil {
-			return "", "", trace.Wrap(err, "parsing proxy public_addr")
-		}
-
-		_, port, err := net.SplitHostPort(proxyPong.Proxy.Kube.ListenAddr)
-		if err != nil {
-			return "", "", trace.Wrap(err, "parsing proxy kube_listen_addr")
-		}
-
-		return fmt.Sprintf("https://%s:%s", host, port), "", nil
-	}
-
-	return "", "", trace.BadParameter("unable to determine kubernetes address")
-}
diff --git a/lib/tbot/service_kubernetes_output_test.go b/lib/tbot/service_kubernetes_output_test.go
deleted file mode 100644
index 36ce0b15327b8..0000000000000
--- a/lib/tbot/service_kubernetes_output_test.go
+++ /dev/null
@@ -1,319 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/client/webclient"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/testutils/golden"
-)
-
-// Fairly ugly hardcoded certs to use in the generation so that the tests are
-// deterministic.
-var (
-	tlsCert = []byte(`-----BEGIN CERTIFICATE-----
-MIIDfDCCAmSgAwIBAgIQP/jI85sqjDWDTd9qF0V5qjANBgkqhkiG9w0BAQsFADBA
-MRUwEwYDVQQKEwxUZWxlcG9ydCBPU1MxJzAlBgNVBAMTHnRlbGVwb3J0LmxvY2Fs
-aG9zdC5sb2NhbGRvbWFpbjAeFw0yNDA0MDIxNDA5MjZaFw0yNDA0MDIxNTEwMjZa
-MHMxGzAZBgNVBAkTEnRlbGUuYmxhY2ttZXNhLmdvdjENMAsGA1UEERMEbnVsbDER
-MA8GA1UEAxMIYm90LXRlc3QxDjAMBgUrzg8BARMDZm9vMQ4wDAYFK84PAQITA2Jh
-cjESMBAGBSvODwEDEwdleGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAr8WfEDOq1TN0bT0SGEtEuDrRaf+VudmbypHokewy46md9XB3gQWbin9N
-/5tyNdbFsWsDgDIyXP3Ube0ubcPYlcsCNtgCvK4qd3RyRvxY5lOfS1pZESPEtvO/
-sxEu6E3O0ofcwq4uKenHuf1EUQuVD6WxABUOaOs2/3aahmYy4SnKNUsM2/l1XrcI
-0ekvB0h10nXUC4VJS4sKGzGzThD308ia/bgDSXc0fiUwZPB5TLn7lScuisi+8JSs
-qWccknXonGEEtism7FNi+mseV1ahzjEbRM/kfFwZ0H+ekz3CdnsmkND0FmxB9WTf
-5PwG8oXM42QJkwuEIu+8Q/VVSSFe4wIDAQABoz8wPTAOBgNVHQ8BAf8EBAMCBaAw
-HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwDQYJ
-KoZIhvcNAQELBQADggEBAEZYzIS0tx+Yn+cEfS83hpL1jELq9C8V3PTC6y44kjAK
-i85Mx+ridYq0ddMdV/91JZ5t1Rqde4LSYUVUP6q/Ukih0mx/I3z2Siwp/YjpOu6x
-SZXakjGnt5pCCa/t1NcVNSrqQpLQ8bJ0mruRiNawrKo3/ge57rgidnBFcOv3zV5t
-BIkYjQJK2YVYcJjJ68olXzpCEw5hTZ9fw42fs2TORHHrPNUAzPf3Qdrzi03hrvhd
-p6nYNA18b6ggygkcRU2MRte5E+/2ABYiwRklwJWNIMQJJHyZAW8Dyws0E2e+B3w+
-7/SYPyeKOlt7foD7z0XM2Kw9ndurJq97AWfkcnrZwbQ=
------END CERTIFICATE-----`)
-
-	keyPEM = []byte(`-----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEAr8WfEDOq1TN0bT0SGEtEuDrRaf+VudmbypHokewy46md9XB3
-gQWbin9N/5tyNdbFsWsDgDIyXP3Ube0ubcPYlcsCNtgCvK4qd3RyRvxY5lOfS1pZ
-ESPEtvO/sxEu6E3O0ofcwq4uKenHuf1EUQuVD6WxABUOaOs2/3aahmYy4SnKNUsM
-2/l1XrcI0ekvB0h10nXUC4VJS4sKGzGzThD308ia/bgDSXc0fiUwZPB5TLn7lScu
-isi+8JSsqWccknXonGEEtism7FNi+mseV1ahzjEbRM/kfFwZ0H+ekz3CdnsmkND0
-FmxB9WTf5PwG8oXM42QJkwuEIu+8Q/VVSSFe4wIDAQABAoIBACvb8vnW+pyibz3G
-zFoVhfs2agS6CsFKJE6io9atinE2ZLzWqGsgXBRt+ad7QT9f7Qp9Om1lmR2NFNGt
-KjWndcbC1jWbJuuvxdbyzoUZ+JDYctoZnDnjo/VG0yG6eurqZ14vGo3Vap14wSaO
-pNpYOoSiAo2Ts3nIn3uVO6+nlrCKFBWiIMMvJ4L89vSCXyI/5kpwCURxpYeYJrQb
-Jzi4TsN0ViYqf6XNfhRCSD+Fk9km2e6zsPIuWyfPrtGx1cA2UeAjnjKK9IS9qkAy
-632T63X6M5kWtirIHM/r/IbdSj+lxGCMqnsSgNYILQv5sNkjgjwlkKl182w5l3CZ
-TkjyLPkCgYEA0guhs3KBqM4ASDzQI3+h5GTGA87ITb0B/TcitElPQ+u3PLypwz9u
-KzS9BHMpaWPWIOJzYRAjb8BDldyCcAhmyr5lv7O/ezRmgGD9NPV66IE5AX9nKVNS
-PhJTNiYPSH7g4zO3K4sd5397YunRZzAxgsVWzu7E2gUrJSCsf0nL77UCgYEA1jpg
-mJbSGYVrYEyQmt6YjHnwcLiNTJDPbcn27g0LmcRbq9SfIva/IfZaf0ru8b9c8QNM
-WMag57WGQghS2B7698GvlwF+nKXXZDjCZ4z6+Efi/T5uHL5VDcpHE4yqdZG42hTW
-m+K4wl4Z6B50xGC/mJlxzB6je4qBM9Zsn8wSwzcCgYEAk5O0kv4a9111eUuw+aAN
-QQlEzxwUQ/pOUXjRm1X+qTwOTFBJ/nKslxLA00WOjQumQQiaBFJwc23kjoCV7N0a
-S8ymdKB4IrpYYk7C2Ni4+G8CfHjlJHX0TMRXTq5DAq6Sl0+YnLFr22EIciDSDewg
-fT7llRLRoFUNUVK5n91buhkCgYEAwqUEA2B1wQ6Cg1rNwIkjne9lUWW9rKWecqig
-naZoteu9RyDG/qOnAhquGx5ggHJY5fsTMU44AI/kTrb1Xry3Vsk62z9WZMoiLEOO
-Dzv/A/t8+I/yyFb/PKpfbhnO/0fJ5wwr+jNDoAaUD10sxwkIzIQO62GjNKqhvhHD
-XGW1Xn0CgYEAzULAI9ij/q5S+GMyYj1xLCU4qxBpU/04nE+PfSSmfv8Ma34uh4QM
-nRDcZHBqZYNRDt5zNvRTjgwJi4iHGwSB+D4SIYGb0ioTI2MOS2F7zBDyl8FXp7dT
-3TSKronwoWYoLSisqnn/s8iN1M9RJA9pyIy7FTVwq59XL3NoetISuKc=
------END RSA PRIVATE KEY-----`)
-)
-
-const (
-	mockClusterName = "tele.blackmesa.gov"
-)
-
-// fakeGetExecutablePath can be injected into outputs to ensure they output the
-// same path in tests across multiple systems.
-func fakeGetExecutablePath() (string, error) {
-	return "/path/to/tbot", nil
-}
-
-// TestKubernetesOutputService_render renders the Kubernetes template and
-// compares it to the saved golden result.
-// TODO(noah): Evaluate if test should run at higher level to capture some
-// fetching.
-func TestKubernetesOutputService_render(t *testing.T) {
-	k8sCluster := "example"
-
-	// We need a fixed cert/key pair here for the golden files testing
-	// to behave properly.
-	id := &identity.Identity{
-		PrivateKeyBytes: keyPEM,
-		TLSCertBytes:    tlsCert,
-		ClusterName:     mockClusterName,
-	}
-
-	tests := []struct {
-		name              string
-		useRelativePath   bool
-		disableExecPlugin bool
-	}{
-		{
-			name: "absolute path",
-		},
-		{
-			name:            "relative path",
-			useRelativePath: true,
-		},
-		{
-			name:              "exec plugin disabled",
-			disableExecPlugin: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dir := t.TempDir()
-
-			dest := &config.DestinationDirectory{
-				Path:     dir,
-				Symlinks: botfs.SymlinksInsecure,
-				ACLs:     botfs.ACLOff,
-			}
-			if tt.useRelativePath {
-				wd, err := os.Getwd()
-				require.NoError(t, err)
-				relativePath, err := filepath.Rel(wd, dir)
-				require.NoError(t, err)
-				dest.Path = relativePath
-			}
-
-			svc := KubernetesOutputService{
-				cfg: &config.KubernetesOutput{
-					KubernetesCluster: k8sCluster,
-					DisableExecPlugin: tt.disableExecPlugin,
-					Destination:       dest,
-				},
-				executablePath: fakeGetExecutablePath,
-				log:            utils.NewSlogLoggerForTests(),
-			}
-
-			keyRing, err := NewClientKeyRing(
-				id,
-				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
-			)
-			require.NoError(t, err)
-			status := &kubernetesStatus{
-				kubernetesClusterName: k8sCluster,
-				teleportClusterName:   mockClusterName,
-				tlsServerName:         client.GetKubeTLSServerName(mockClusterName),
-				credentials:           keyRing,
-				clusterAddr:           fmt.Sprintf("https://%s:443", mockClusterName),
-			}
-
-			err = svc.render(
-				context.Background(),
-				status,
-				id,
-				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
-				[]types.CertAuthority{},
-				[]types.CertAuthority{},
-			)
-			require.NoError(t, err)
-
-			kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, defaultKubeconfigPath))
-			require.NoError(t, err)
-			kubeconfigBytes = bytes.ReplaceAll(kubeconfigBytes, []byte(dir), []byte("/test/dir"))
-
-			if golden.ShouldSet() {
-				golden.SetNamed(t, "kubeconfig.yaml", kubeconfigBytes)
-			}
-			require.Equal(
-				t, string(golden.GetNamed(t, "kubeconfig.yaml")), string(kubeconfigBytes),
-			)
-		})
-	}
-}
-
-func Test_selectKubeConnectionMethod(t *testing.T) {
-	tests := []struct {
-		name string
-
-		proxyPing *webclient.PingResponse
-		wantAddr  string
-		wantSNI   string
-	}{
-		{
-			// Copied from my real Teleport Cloud webapi/ping
-			name: "TLS Routing",
-			proxyPing: &webclient.PingResponse{
-				Proxy: webclient.ProxySettings{
-					Kube: webclient.KubeProxySettings{
-						Enabled:    true,
-						ListenAddr: "0.0.0.0:3080",
-					},
-					SSH: webclient.SSHProxySettings{
-						ListenAddr:       "0.0.0.0:3080",
-						TunnelListenAddr: "0.0.0.0:3080",
-						WebListenAddr:    "0.0.0.0:3080",
-						PublicAddr:       "noah.teleport.sh:443",
-					},
-					TLSRoutingEnabled: true,
-				},
-				ClusterName: "noah.teleport.sh",
-			},
-			wantAddr: "https://noah.teleport.sh:443",
-			wantSNI:  "kube-teleport-proxy-alpn.noah.teleport.sh",
-		},
-		{
-			name: "KubePublicAddr specified",
-			proxyPing: &webclient.PingResponse{
-				Proxy: webclient.ProxySettings{
-					Kube: webclient.KubeProxySettings{
-						Enabled:    true,
-						ListenAddr: "0.0.0.0:1337",
-						PublicAddr: "kube.example.com:1337",
-					},
-					SSH: webclient.SSHProxySettings{
-						ListenAddr:       "0.0.0.0:3023",
-						TunnelListenAddr: "0.0.0.0:3024",
-						WebListenAddr:    "0.0.0.0:3080",
-						PublicAddr:       "cluster.example.com:443",
-						SSHPublicAddr:    "cluster.example.com:3023",
-						TunnelPublicAddr: "cluster.example.com:3024",
-					},
-					TLSRoutingEnabled: false,
-				},
-				ClusterName: "cluster.example.com",
-			},
-			wantAddr: "https://kube.example.com:1337",
-		},
-		{
-			// https://github.com/gravitational/teleport/issues/19811
-			name: "Falls back to Kube ListenAddr Port with PublicAddr",
-			proxyPing: &webclient.PingResponse{
-				Proxy: webclient.ProxySettings{
-					Kube: webclient.KubeProxySettings{
-						Enabled:    true,
-						ListenAddr: "0.0.0.0:3026",
-					},
-					SSH: webclient.SSHProxySettings{
-						ListenAddr:       "[::]:3023",
-						TunnelListenAddr: "0.0.0.0:3024",
-						WebListenAddr:    "0.0.0.0:3080",
-						PublicAddr:       "cluster.example.com:5443",
-						SSHPublicAddr:    "cluster.example.com:3023",
-						TunnelPublicAddr: "cluster.example.com:3024",
-					},
-					TLSRoutingEnabled: false,
-				},
-				ClusterName: "cluster.example.com",
-			},
-			wantAddr: "https://cluster.example.com:3026",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			addr, sni, err := selectKubeConnectionMethod(&proxyPingResponse{
-				PingResponse: tt.proxyPing,
-			})
-			require.NoError(t, err)
-			require.Equal(t, tt.wantAddr, addr)
-			require.Equal(t, tt.wantSNI, sni)
-		})
-	}
-}
-
-func fakeCA(t *testing.T, caType types.CertAuthType, clusterName string) types.CertAuthority {
-	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
-		// Pretend to be the correct type.
-		Type:        caType,
-		ClusterName: clusterName,
-		ActiveKeys: types.CAKeySet{
-			TLS: []*types.TLSKeyPair{
-				{
-					Cert: []byte(fixtures.TLSCACertPEM),
-					Key:  []byte(fixtures.TLSCAKeyPEM),
-				},
-			},
-			SSH: []*types.SSHKeyPair{
-				// Two of these to ensure that both are written to known hosts
-				{
-					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
-					PublicKey:  []byte(fixtures.SSHCAPublicKey),
-				},
-				{
-					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
-					PublicKey:  []byte(fixtures.SSHCAPublicKey),
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	return ca
-}
diff --git a/lib/tbot/service_kubernetes_v2_output.go b/lib/tbot/service_kubernetes_v2_output.go
deleted file mode 100644
index 5da5caecf261d..0000000000000
--- a/lib/tbot/service_kubernetes_v2_output.go
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"log/slog"
-	"path/filepath"
-
-	"github.com/gravitational/trace"
-	"k8s.io/client-go/tools/clientcmd"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-
-	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/kube/kubeconfig"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
-)
-
-// KubernetesOutputService produces credentials which can be used to connect to
-// a Kubernetes Cluster through teleport.
-type KubernetesV2OutputService struct {
-	// botAuthClient should be an auth client using the bots internal identity.
-	// This will not have any roles impersonated and should only be used to
-	// fetch CAs.
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.KubernetesV2Output
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	proxyPingCache    *proxyPingCache
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-	// executablePath is called to get the path to the tbot executable.
-	// Usually this is os.Executable
-	executablePath func() (string, error)
-}
-
-func (s *KubernetesV2OutputService) String() string {
-	return fmt.Sprintf("kubernetes-v2-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *KubernetesV2OutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *KubernetesV2OutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	return trace.Wrap(runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	}))
-}
-
-func (s *KubernetesV2OutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"KubernetesV2OutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return trace.Wrap(err, "fetching default roles")
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		effectiveLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	clusters, err := fetchAllMatchingKubeClusters(ctx, impersonatedClient, s.cfg.Selectors)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	var clusterNames []string
-	for _, c := range clusters {
-		clusterNames = append(clusterNames, c.GetName())
-	}
-
-	clusterNames = utils.Deduplicate(clusterNames)
-
-	s.log.InfoContext(
-		ctx,
-		"Generated identity for Kubernetes access",
-		"matched_cluster_count", len(clusterNames),
-		"identity", describeTLSIdentity(ctx, s.log, id),
-	)
-
-	// Ping the proxy to resolve connection addresses.
-	proxyPong, err := s.proxyPingCache.ping(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	clusterAddr, tlsServerName, err := selectKubeConnectionMethod(proxyPong)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	keyRing, err := NewClientKeyRing(id, hostCAs)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	status := &kubernetesStatusV2{
-		clusterAddr:            clusterAddr,
-		tlsServerName:          tlsServerName,
-		credentials:            keyRing,
-		teleportClusterName:    proxyPong.ClusterName,
-		kubernetesClusterNames: clusterNames,
-	}
-
-	return trace.Wrap(s.render(ctx, status, id, hostCAs))
-}
-
-// kubernetesStatus holds teleport client information necessary to populate a
-// kubeconfig.
-type kubernetesStatusV2 struct {
-	clusterAddr            string
-	teleportClusterName    string
-	tlsServerName          string
-	credentials            *client.KeyRing
-	kubernetesClusterNames []string
-}
-
-// queryKubeClustersByLabels fetches a list of Kubernetes clusters matching the
-// given label selector.
-func queryKubeClustersByLabels(ctx context.Context, clt apiclient.GetResourcesClient, labels map[string]string) ([]types.KubeCluster, error) {
-	ctx, span := tracer.Start(ctx, "queryKubeClustersByLabels")
-	defer span.End()
-
-	servers, err := apiclient.GetAllResources[types.KubeServer](ctx, clt, &proto.ListResourcesRequest{
-		Namespace:    defaults.Namespace,
-		ResourceType: types.KindKubeServer,
-		Labels:       labels,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var clusters []types.KubeCluster
-	for _, server := range servers {
-		clusters = append(clusters, server.GetCluster())
-	}
-
-	return clusters, nil
-}
-
-// fetchAllMatchingKubeClusters returns a list of all clusters matching the
-// given selectors.
-func fetchAllMatchingKubeClusters(ctx context.Context, clt apiclient.GetResourcesClient, selectors []*config.KubernetesSelector) ([]types.KubeCluster, error) {
-	ctx, span := tracer.Start(ctx, "findAllMatchingKubeClusters")
-	defer span.End()
-
-	clusters := []types.KubeCluster{}
-	for _, selector := range selectors {
-		if selector.Name != "" {
-			cluster, err := getKubeCluster(ctx, clt, selector.Name)
-			if err != nil {
-				// Clusters explicitly named should be a hard fail.
-				return nil, trace.Wrap(err, "unable to fetch cluster %q by name", selector.Name)
-			}
-
-			clusters = append(clusters, cluster)
-			continue
-		}
-
-		labeledClusters, err := queryKubeClustersByLabels(ctx, clt, selector.Labels)
-		if err != nil {
-			// TODO: should this be a hard error, or should we log it and
-			// attempt to fetch all clusters? (Or should users be able to
-			// select hard fail behavior with a config option?)
-			// (Hard fail may be more relevant to named clusters.)
-			// (There may be some value in a configurable hard fail if 0
-			// clusters are returned.)
-			return nil, trace.Wrap(err, "unable to fetch clusters with labels %v", selector.Labels)
-		}
-
-		clusters = append(clusters, labeledClusters...)
-	}
-
-	return clusters, nil
-}
-
-func (s *KubernetesV2OutputService) render(
-	ctx context.Context,
-	status *kubernetesStatusV2,
-	routedIdentity *identity.Identity,
-	hostCAs []types.CertAuthority,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"KubernetesOutputService/render",
-	)
-	defer span.End()
-
-	if err := writeIdentityFile(ctx, s.log, status.credentials, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "writing identity file")
-	}
-	if err := identity.SaveIdentity(
-		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
-	); err != nil {
-		return trace.Wrap(err, "persisting identity")
-	}
-
-	// In exec plugin mode, we write the credentials to disk and write a
-	// kubeconfig that execs `tbot` to load those credentials.
-
-	// We only support directory mode for this since the exec plugin needs
-	// to know the path to read the credentials from, and this is
-	// unpredictable with other types of destination.
-	destinationDir, isDirectoryDest := s.cfg.Destination.(*config.DestinationDirectory)
-	if !s.cfg.DisableExecPlugin {
-		if !isDirectoryDest {
-			slog.InfoContext(
-				ctx,
-				"Kubernetes template will be rendered without exec plugin because destination is not a directory. Explicitly set `disable_exec_plugin: true` in the output to suppress this message",
-				"destination", logutils.StringerAttr(s.cfg.Destination))
-			s.cfg.DisableExecPlugin = true
-		}
-	}
-
-	var err error
-	var kubeCfg *clientcmdapi.Config
-	if s.cfg.DisableExecPlugin {
-		// If they've disabled the exec plugin, we just write the credentials
-		// directly into the kubeconfig.
-		kubeCfg, err = generateKubeConfigV2WithoutPlugin(status)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	} else {
-		executablePath, err := s.executablePath()
-		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
-			s.log.WarnContext(ctx, "Kubernetes template will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
-		} else if err != nil {
-			return trace.Wrap(err)
-		}
-
-		kubeCfg, err = generateKubeConfigV2WithPlugin(status, destinationDir.Path, executablePath)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	yamlCfg, err := clientcmd.Write(*kubeCfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := s.cfg.Destination.Write(ctx, defaultKubeconfigPath, yamlCfg); err != nil {
-		return trace.Wrap(err, "writing kubeconfig")
-	}
-
-	if err := s.cfg.Destination.Write(ctx, config.HostCAPath, concatCACerts(hostCAs)); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-// encodePathComponent appropriate base64 encodes an input string for path-based
-// routing use.
-func encodePathComponent(input string) string {
-	return base64.RawURLEncoding.EncodeToString([]byte(input))
-}
-
-// generateKubeConfigWithPlugin creates a Kubernetes config object with the
-// given cluster config, using the `tbot kube credentials` auth helper plugin to
-// fetch refreshed certificate data at runtime.
-func generateKubeConfigV2WithPlugin(ks *kubernetesStatusV2, destPath string, executablePath string) (*clientcmdapi.Config, error) {
-	config := clientcmdapi.NewConfig()
-
-	// Implementation note: tsh/kube.go generates a kubeconfig with all
-	// available clusters. This isn't especially useful in Machine ID when
-	// there's _at most_ one cluster we have permission to access for this
-	// Destination's set of certs, so instead of fetching all the k8s clusters
-	// and adding everything, we'll just stick with the single cluster name in
-	// our config file.
-	// Otherwise, we adapt this from lib/kube/kubeconfig/kubeconfig.go's
-	// Update(), but don't support env vars, insecure mode, or identity files.
-	// We do still implement `tbot kube credentials` to help client apps
-	// take better advantage of certificate renewals.
-
-	// Configure the cluster.
-	clusterCAs, err := ks.credentials.RootClusterCAs()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	cas := bytes.Join(clusterCAs, []byte("\n"))
-	if len(cas) == 0 {
-		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
-	}
-
-	absDestPath, err := filepath.Abs(destPath)
-	if err != nil {
-		return nil, trace.Wrap(err, "determining absolute path for destination")
-	}
-
-	// Configure primary user/AuthInfo.
-	execArgs := []string{"kube", "credentials",
-		fmt.Sprintf("--destination-dir=%s", absDestPath),
-	}
-	config.AuthInfos[ks.teleportClusterName] = &clientcmdapi.AuthInfo{
-		Exec: &clientcmdapi.ExecConfig{
-			APIVersion: "client.authentication.k8s.io/v1beta1",
-			Command:    executablePath,
-			Args:       execArgs,
-		},
-	}
-
-	for i, cluster := range ks.kubernetesClusterNames {
-		contextName := kubeconfig.ContextName(ks.teleportClusterName, cluster)
-
-		suffix := fmt.Sprintf("/v1/teleport/%s/%s", encodePathComponent(ks.teleportClusterName), encodePathComponent(cluster))
-		config.Clusters[contextName] = &clientcmdapi.Cluster{
-			Server:        ks.clusterAddr + suffix,
-			TLSServerName: ks.tlsServerName,
-
-			// TODO: consider using CertificateAuthority (path) here to avoid
-			// duplication. This branch (with plugin) already requires a file
-			// destination so we can assume the CA is available.
-			CertificateAuthorityData: cas,
-		}
-
-		// Link the context to the main user.
-		config.Contexts[contextName] = &clientcmdapi.Context{
-			Cluster:  contextName,
-			AuthInfo: ks.teleportClusterName,
-		}
-
-		// Always set the current context to the first-matched cluster. This
-		// won't be perfectly consistent if the first selector uses labels, so
-		// we may want to consider some way to flag an explicitly default
-		// context.
-		if i == 0 {
-			config.CurrentContext = contextName
-		}
-	}
-
-	return config, nil
-}
-
-func generateKubeConfigV2WithoutPlugin(ks *kubernetesStatusV2) (*clientcmdapi.Config, error) {
-	config := clientcmdapi.NewConfig()
-
-	// Configure the cluster.
-	clusterCAs, err := ks.credentials.RootClusterCAs()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	cas := bytes.Join(clusterCAs, []byte("\n"))
-	if len(cas) == 0 {
-		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
-	}
-
-	// Create a global AuthInfo for this cluster.
-	config.AuthInfos[ks.teleportClusterName] = &clientcmdapi.AuthInfo{
-		ClientCertificateData: ks.credentials.TLSCert,
-		ClientKeyData:         ks.credentials.TLSPrivateKey.PrivateKeyPEM(),
-	}
-
-	for i, cluster := range ks.kubernetesClusterNames {
-		contextName := kubeconfig.ContextName(ks.teleportClusterName, cluster)
-
-		suffix := fmt.Sprintf("/v1/teleport/%s/%s", encodePathComponent(ks.teleportClusterName), encodePathComponent(cluster))
-		config.Clusters[contextName] = &clientcmdapi.Cluster{
-			Server:                   ks.clusterAddr + suffix,
-			TLSServerName:            ks.tlsServerName,
-			CertificateAuthorityData: cas,
-		}
-
-		// Link the context to the main AuthInfo/user.
-		config.Contexts[contextName] = &clientcmdapi.Context{
-			Cluster:  contextName,
-			AuthInfo: ks.teleportClusterName,
-		}
-
-		if i == 0 {
-			config.CurrentContext = contextName
-		}
-	}
-
-	return config, nil
-}
diff --git a/lib/tbot/service_kubernetes_v2_output_test.go b/lib/tbot/service_kubernetes_v2_output_test.go
deleted file mode 100644
index 7e8d5012f560e..0000000000000
--- a/lib/tbot/service_kubernetes_v2_output_test.go
+++ /dev/null
@@ -1,310 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tbot/botfs"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/testutils/golden"
-)
-
-// fakeKubeServerClient provides a minimal implementation of
-// ServerWithRoles.ListResources() that applies real filters to a known set of
-// resources. Useful for testing against more complex queries.
-type fakeKubeServerClient struct {
-	apiclient.GetResourcesClient
-
-	availableKubeServers []types.KubeServer
-}
-
-func (f fakeKubeServerClient) GetResources(ctx context.Context, req *proto.ListResourcesRequest) (*proto.ListResourcesResponse, error) {
-	var matched []types.KubeServer
-
-	filter := services.MatchResourceFilter{
-		ResourceKind:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
-	}
-
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		filter.PredicateExpression = expression
-	}
-
-	for _, server := range f.availableKubeServers {
-		switch match, err := services.MatchResourceByFilters(server, filter, nil /* ignore dup matches  */); {
-		case err != nil:
-			return nil, trace.Wrap(err)
-		case match:
-			matched = append(matched, server)
-		}
-	}
-
-	out := make([]*proto.PaginatedResource, 0, len(matched))
-	for _, match := range matched {
-		server, ok := match.(*types.KubernetesServerV3)
-		if !ok {
-			return nil, trace.BadParameter("invalid type %T, expected *types.KubernetesServerV3", server)
-		}
-		out = append(out, &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubernetesServer{KubernetesServer: server}})
-	}
-
-	return &proto.ListResourcesResponse{Resources: out}, nil
-}
-
-// newTestKubeServer creates a minimal KubeServer appropriate for use with
-// `fakeKubeServerClient`.
-func newTestKubeServer(t *testing.T, name string, labels map[string]string) types.KubeServer {
-	t.Helper()
-
-	server, err := types.NewKubernetesServerV3(types.Metadata{
-		Name:   name,
-		Labels: labels,
-	}, types.KubernetesServerSpecV3{
-		HostID: name,
-		Cluster: &types.KubernetesClusterV3{
-			Metadata: types.Metadata{
-				Name:   name,
-				Labels: labels,
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	return server
-}
-
-func TestKubernetesV2OutputService_fetch(t *testing.T) {
-	servers := []types.KubeServer{
-		newTestKubeServer(t, "a", map[string]string{}),
-		newTestKubeServer(t, "b", map[string]string{"foo": "1"}),
-		newTestKubeServer(t, "c", map[string]string{"foo": "1", "bar": "2"}),
-		newTestKubeServer(t, "d", map[string]string{"bar": "2"}),
-	}
-
-	client := &fakeKubeServerClient{
-		availableKubeServers: servers,
-	}
-
-	tests := []struct {
-		name                 string
-		selectors            []*config.KubernetesSelector
-		expectError          require.ErrorAssertionFunc
-		expectedClusterNames []string
-	}{
-		{
-			name: "matches by name",
-			selectors: []*config.KubernetesSelector{
-				{
-					Name: "a",
-				},
-				{
-					Name: "c",
-				},
-			},
-			expectedClusterNames: []string{"a", "c"},
-		},
-		{
-			name: "errors when direct lookup fails",
-			selectors: []*config.KubernetesSelector{
-				{
-					Name: "nonexistent",
-				},
-			},
-			expectError: func(tt require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(t, err, "unable to fetch cluster \"nonexistent\" by name")
-			},
-		},
-		{
-			name: "matches with simple label selector",
-			selectors: []*config.KubernetesSelector{
-				{
-					Labels: map[string]string{
-						"foo": "1",
-					},
-				},
-			},
-			expectedClusterNames: []string{"b", "c"},
-		},
-		{
-			name: "matches with complex label selector",
-			selectors: []*config.KubernetesSelector{
-				{
-					Labels: map[string]string{
-						"foo": "1",
-						"bar": "2",
-					},
-				},
-			},
-			expectedClusterNames: []string{"c"},
-		},
-		{
-			name: "matches with multiple selectors",
-			selectors: []*config.KubernetesSelector{
-				{
-					Labels: map[string]string{
-						"foo": "1",
-					},
-				},
-				{
-					Labels: map[string]string{
-						"bar": "2",
-					},
-				},
-				{
-					Name: "a",
-				},
-			},
-			expectedClusterNames: []string{"a", "b", "c", "d"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			matches, err := fetchAllMatchingKubeClusters(context.Background(), client, tt.selectors)
-			if tt.expectError != nil {
-				tt.expectError(t, err)
-			} else {
-				require.NoError(t, err)
-
-				var names []string
-				for _, match := range matches {
-					names = append(names, match.GetName())
-				}
-
-				// `generate()` dedupes downstream, so we'll replicate that
-				// here, otherwise we might see duplicates if some label
-				// selectors overlap.
-				names = apiutils.Deduplicate(names)
-
-				require.ElementsMatch(t, tt.expectedClusterNames, names)
-			}
-		})
-	}
-}
-
-// TestKubernetesV2OutputService_render renders the Kubernetes template and
-// compares it to the saved golden result.
-func TestKubernetesV2OutputService_render(t *testing.T) {
-	// We need a fixed cert/key pair here for the golden files testing
-	// to behave properly.
-	id := &identity.Identity{
-		PrivateKeyBytes: keyPEM,
-		TLSCertBytes:    tlsCert,
-		ClusterName:     mockClusterName,
-	}
-
-	tests := []struct {
-		name              string
-		useRelativePath   bool
-		disableExecPlugin bool
-	}{
-		{
-			name: "absolute path",
-		},
-		{
-			name:            "relative path",
-			useRelativePath: true,
-		},
-		{
-			name:              "exec plugin disabled",
-			disableExecPlugin: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dir := t.TempDir()
-
-			dest := &config.DestinationDirectory{
-				Path:     dir,
-				Symlinks: botfs.SymlinksInsecure,
-				ACLs:     botfs.ACLOff,
-			}
-			if tt.useRelativePath {
-				wd, err := os.Getwd()
-				require.NoError(t, err)
-				relativePath, err := filepath.Rel(wd, dir)
-				require.NoError(t, err)
-				dest.Path = relativePath
-			}
-
-			svc := KubernetesV2OutputService{
-				cfg: &config.KubernetesV2Output{
-					DisableExecPlugin: tt.disableExecPlugin,
-					Destination:       dest,
-				},
-				executablePath: fakeGetExecutablePath,
-				log:            utils.NewSlogLoggerForTests(),
-			}
-
-			keyRing, err := NewClientKeyRing(
-				id,
-				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
-			)
-			require.NoError(t, err)
-			status := &kubernetesStatusV2{
-				kubernetesClusterNames: []string{"a", "b", "c"},
-				teleportClusterName:    mockClusterName,
-				tlsServerName:          client.GetKubeTLSServerName(mockClusterName),
-				credentials:            keyRing,
-				clusterAddr:            fmt.Sprintf("https://%s:443", mockClusterName),
-			}
-
-			err = svc.render(
-				context.Background(),
-				status,
-				id,
-				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
-			)
-			require.NoError(t, err)
-
-			kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, defaultKubeconfigPath))
-			require.NoError(t, err)
-			kubeconfigBytes = bytes.ReplaceAll(kubeconfigBytes, []byte(dir), []byte("/test/dir"))
-
-			if golden.ShouldSet() {
-				golden.SetNamed(t, "kubeconfig.yaml", kubeconfigBytes)
-			}
-			require.Equal(
-				t, string(golden.GetNamed(t, "kubeconfig.yaml")), string(kubeconfigBytes),
-			)
-		})
-	}
-}
diff --git a/lib/tbot/service_spiffe_svid_output.go b/lib/tbot/service_spiffe_svid_output.go
deleted file mode 100644
index eb1ac9f3d00d0..0000000000000
--- a/lib/tbot/service_spiffe_svid_output.go
+++ /dev/null
@@ -1,408 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"crypto"
-	"crypto/x509"
-	"encoding/pem"
-	"fmt"
-	"log/slog"
-	"math"
-	"time"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/durationpb"
-
-	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
-	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-)
-
-const (
-	// pemPrivateKey is the PEM block type for a PKCS 8 encoded private key.
-	pemPrivateKey = "PRIVATE KEY"
-	// pemCertificate is the PEM block type for a DER encoded certificate.
-	pemCertificate = "CERTIFICATE"
-)
-
-// SPIFFESVIDOutputService is a service that generates and writes X509 SPIFFE
-// SVIDs to a destination. It produces an output compatible with the
-// `spiffe-helper` tool.
-type SPIFFESVIDOutputService struct {
-	botAuthClient  *authclient.Client
-	botCfg         *config.BotConfig
-	cfg            *config.SPIFFESVIDOutput
-	getBotIdentity getBotIdentityFn
-	log            *slog.Logger
-	resolver       reversetunnelclient.Resolver
-	// trustBundleCache is the cache of trust bundles. It only needs to be
-	// provided when running in daemon mode.
-	trustBundleCache *workloadidentity.TrustBundleCache
-}
-
-func (s *SPIFFESVIDOutputService) String() string {
-	return fmt.Sprintf("spiffe-svid-output (%s)", s.cfg.Destination.String())
-}
-
-func (s *SPIFFESVIDOutputService) OneShot(ctx context.Context) error {
-	res, privateKey, jwtSVIDs, err := s.requestSVID(ctx)
-	if err != nil {
-		return trace.Wrap(err, "requesting SVID")
-	}
-	bundleSet, err := workloadidentity.FetchInitialBundleSet(
-		ctx,
-		s.log,
-		s.botAuthClient.SPIFFEFederationServiceClient(),
-		s.botAuthClient.TrustClient(),
-		s.cfg.IncludeFederatedTrustBundles,
-		s.getBotIdentity().ClusterName,
-	)
-	if err != nil {
-		return trace.Wrap(err, "fetching trust bundle set")
-
-	}
-	return s.render(ctx, bundleSet, res, privateKey, jwtSVIDs)
-}
-
-func (s *SPIFFESVIDOutputService) Run(ctx context.Context) error {
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "getting trust bundle set")
-	}
-
-	jitter := retryutils.DefaultJitter
-	var res *machineidv1pb.SignX509SVIDsResponse
-	var privateKey crypto.Signer
-	var jwtSVIDs map[string]string
-	var failures int
-	firstRun := make(chan struct{}, 1)
-	firstRun <- struct{}{}
-	for {
-		var retryAfter <-chan time.Time
-		if failures > 0 {
-			backoffTime := time.Second * time.Duration(math.Pow(2, float64(failures-1)))
-			if backoffTime > time.Minute {
-				backoffTime = time.Minute
-			}
-			backoffTime = jitter(backoffTime)
-			s.log.WarnContext(
-				ctx,
-				"Last attempt to generate output failed, will retry",
-				"retry_after", backoffTime,
-				"failures", failures,
-			)
-			retryAfter = time.After(time.Duration(failures) * time.Second)
-		}
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-retryAfter:
-			s.log.InfoContext(ctx, "Retrying")
-		case <-bundleSet.Stale():
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err, "getting trust bundle set")
-			}
-			s.log.InfoContext(ctx, "Trust bundle set has been updated")
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the local trust domain CA has changed, we need to reissue
-				// the SVID.
-				res = nil
-				privateKey = nil
-			}
-			bundleSet = newBundleSet
-		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
-			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
-			res = nil
-			privateKey = nil
-		case <-firstRun:
-		}
-
-		if res == nil || privateKey == nil {
-			var err error
-			res, privateKey, jwtSVIDs, err = s.requestSVID(ctx)
-			if err != nil {
-				s.log.ErrorContext(ctx, "Failed to request SVID", "error", err)
-				failures++
-				continue
-			}
-		}
-		if err := s.render(ctx, bundleSet, res, privateKey, jwtSVIDs); err != nil {
-			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
-			failures++
-			continue
-		}
-		failures = 0
-	}
-}
-
-func (s *SPIFFESVIDOutputService) requestSVID(
-	ctx context.Context,
-) (
-	*machineidv1pb.SignX509SVIDsResponse,
-	crypto.Signer,
-	map[string]string,
-	error,
-) {
-	ctx, span := tracer.Start(
-		ctx,
-		"SPIFFESVIDOutputService/requestSVID",
-	)
-	defer span.End()
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err, "fetching roles")
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		effectiveLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err, "generating identity")
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	res, privateKey, err := generateSVID(
-		ctx,
-		impersonatedClient,
-		[]config.SVIDRequest{s.cfg.SVID},
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-	)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err, "generating X509 SVID")
-	}
-
-	jwtSvids, err := generateJWTSVIDs(
-		ctx,
-		impersonatedClient,
-		s.cfg.SVID,
-		s.cfg.JWTs,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err, "generating JWT SVIDs")
-	}
-
-	return res, privateKey, jwtSvids, nil
-}
-
-func (s *SPIFFESVIDOutputService) render(
-	ctx context.Context,
-	bundleSet *workloadidentity.BundleSet,
-	res *machineidv1pb.SignX509SVIDsResponse,
-	privateKey crypto.Signer,
-	jwtSVIDs map[string]string,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"SPIFFESVIDOutputService/render",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Rendering output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	privPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  pemPrivateKey,
-		Bytes: privBytes,
-	})
-
-	if len(res.Svids) != 1 {
-		return trace.BadParameter("expected 1 SVID, got %d", len(res.Svids))
-
-	}
-	svid := res.Svids[0]
-	if err := s.cfg.Destination.Write(ctx, config.SVIDKeyPEMPath, privPEM); err != nil {
-		return trace.Wrap(err, "writing svid key")
-	}
-
-	certPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  pemCertificate,
-		Bytes: svid.Certificate,
-	})
-	if err := s.cfg.Destination.Write(ctx, config.SVIDPEMPath, certPEM); err != nil {
-		return trace.Wrap(err, "writing svid certificate")
-	}
-
-	trustBundleBytes, err := bundleSet.Local.X509Bundle().Marshal()
-	if err != nil {
-		return trace.Wrap(err, "marshaling local trust bundle")
-	}
-
-	if s.cfg.IncludeFederatedTrustBundles {
-		for _, federatedBundle := range bundleSet.Federated {
-			federatedBundleBytes, err := federatedBundle.X509Bundle().Marshal()
-			if err != nil {
-				return trace.Wrap(err, "marshaling federated trust bundle (%s)", federatedBundle.TrustDomain().Name())
-			}
-			trustBundleBytes = append(trustBundleBytes, federatedBundleBytes...)
-		}
-	}
-
-	if err := s.cfg.Destination.Write(
-		ctx, config.SVIDTrustBundlePEMPath, trustBundleBytes,
-	); err != nil {
-		return trace.Wrap(err, "writing svid trust bundle")
-	}
-
-	for fileName, jwt := range jwtSVIDs {
-		if err := s.cfg.Destination.Write(ctx, fileName, []byte(jwt)); err != nil {
-			return trace.Wrap(err, "writing JWT SVID")
-		}
-	}
-
-	return nil
-}
-
-func generateJWTSVIDs(
-	ctx context.Context,
-	clt *authclient.Client,
-	svid config.SVIDRequest,
-	reqs []config.JWTSVID,
-	ttl time.Duration,
-) (map[string]string, error) {
-	ctx, span := tracer.Start(
-		ctx,
-		"generateJWTSVIDs",
-	)
-	defer span.End()
-
-	requestedAudiences := map[string]bool{}
-	for _, jwt := range reqs {
-		requestedAudiences[jwt.Audience] = true
-	}
-
-	jwtReqs := make([]*machineidv1pb.JWTSVIDRequest, 0, len(requestedAudiences))
-	for audience := range requestedAudiences {
-		jwtReqs = append(jwtReqs, &machineidv1pb.JWTSVIDRequest{
-			Audiences:    []string{audience},
-			Ttl:          durationpb.New(ttl),
-			SpiffeIdPath: svid.Path,
-		})
-	}
-
-	if len(jwtReqs) == 0 {
-		return nil, nil
-	}
-
-	jwtRes, err := clt.WorkloadIdentityServiceClient().SignJWTSVIDs(ctx, &machineidv1pb.SignJWTSVIDsRequest{
-		Svids: jwtReqs,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "requesting JWT SVIDs")
-	}
-
-	jwtFiles := map[string]string{}
-	for _, req := range reqs {
-		for _, jwtSVID := range jwtRes.Svids {
-			if len(jwtSVID.Audiences) == 1 && jwtSVID.Audiences[0] == req.Audience {
-				jwtFiles[req.FileName] = jwtSVID.Jwt
-				break
-			}
-		}
-	}
-	return jwtFiles, nil
-}
-
-// generateSVID generates the pre-requisites and makes a SVID generation RPC
-// call.
-func generateSVID(
-	ctx context.Context,
-	clt *authclient.Client,
-	reqs []config.SVIDRequest,
-	ttl time.Duration,
-) (*machineidv1pb.SignX509SVIDsResponse, crypto.Signer, error) {
-	ctx, span := tracer.Start(
-		ctx,
-		"generateSVID",
-	)
-	defer span.End()
-	privateKey, err := cryptosuites.GenerateKey(ctx,
-		cryptosuites.GetCurrentSuiteFromAuthPreference(clt),
-		cryptosuites.BotSVID)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	pubBytes, err := x509.MarshalPKIXPublicKey(privateKey.Public())
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	svids := make([]*machineidv1pb.SVIDRequest, 0, len(reqs))
-	for _, req := range reqs {
-		svids = append(svids, &machineidv1pb.SVIDRequest{
-			PublicKey:    pubBytes,
-			SpiffeIdPath: req.Path,
-			DnsSans:      req.SANS.DNS,
-			IpSans:       req.SANS.IP,
-			Hint:         req.Hint,
-			Ttl:          durationpb.New(ttl),
-		})
-	}
-
-	res, err := clt.WorkloadIdentityServiceClient().SignX509SVIDs(ctx,
-		&machineidv1pb.SignX509SVIDsRequest{
-			Svids: svids,
-		},
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	return res, privateKey, nil
-}
diff --git a/lib/tbot/service_spiffe_workload_api.go b/lib/tbot/service_spiffe_workload_api.go
deleted file mode 100644
index 9fe85e684e0f6..0000000000000
--- a/lib/tbot/service_spiffe_workload_api.go
+++ /dev/null
@@ -1,897 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"crypto/x509"
-	"fmt"
-	"log/slog"
-	"math/big"
-	"net"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
-	"github.com/gravitational/trace"
-	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
-	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
-	"github.com/spiffe/go-spiffe/v2/spiffeid"
-	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
-	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/peer"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/structpb"
-
-	"github.com/gravitational/teleport"
-	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/observability/metrics"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-	"github.com/gravitational/teleport/lib/uds"
-)
-
-// SPIFFEWorkloadAPIService implements a gRPC server that fulfills the SPIFFE
-// Workload API specification. It provides X509 SVIDs and trust bundles to
-// workloads that connect over the configured listener.
-//
-// Sources:
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_Endpoint.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
-type SPIFFEWorkloadAPIService struct {
-	workloadpb.UnimplementedSpiffeWorkloadAPIServer
-
-	svcIdentity      *config.UnstableClientCredentialOutput
-	botCfg           *config.BotConfig
-	cfg              *config.SPIFFEWorkloadAPIService
-	log              *slog.Logger
-	resolver         reversetunnelclient.Resolver
-	trustBundleCache *workloadidentity.TrustBundleCache
-
-	// client holds the impersonated client for the service
-	client           *authclient.Client
-	attestor         *workloadattest.Attestor
-	localTrustDomain spiffeid.TrustDomain
-}
-
-// setup initializes the service, performing tasks such as determining the
-// trust domain, fetching the initial trust bundle and creating an impersonated
-// client.
-func (s *SPIFFEWorkloadAPIService) setup(ctx context.Context) (err error) {
-	ctx, span := tracer.Start(ctx, "SPIFFEWorkloadAPIService/setup")
-	defer span.End()
-
-	// Wait for the impersonated identity to be ready for us to consume here.
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-time.After(10 * time.Second):
-		return trace.BadParameter("timeout waiting for identity to be ready")
-	case <-s.svcIdentity.Ready():
-	}
-	facade, err := s.svcIdentity.Facade()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	client, err := clientForFacade(
-		ctx, s.log, s.botCfg, facade, s.resolver,
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	s.client = client
-	// Closure is managed by the caller if this function succeeds. But if it
-	// fails, we need to close the client.
-	defer func() {
-		if err != nil {
-			client.Close()
-		}
-	}()
-
-	td, err := spiffeid.TrustDomainFromString(facade.Get().ClusterName)
-	if err != nil {
-		return trace.Wrap(err, "parsing trust domain name")
-	}
-	s.localTrustDomain = td
-
-	s.attestor, err = workloadattest.NewAttestor(s.log, s.cfg.Attestors)
-	if err != nil {
-		return trace.Wrap(err, "setting up workload attestation")
-	}
-
-	return nil
-}
-
-func createListener(ctx context.Context, log *slog.Logger, addr string) (net.Listener, error) {
-	parsed, err := url.Parse(addr)
-	if err != nil {
-		return nil, trace.Wrap(err, "parsing %q", addr)
-	}
-
-	switch parsed.Scheme {
-	// If no scheme is provided, default to TCP.
-	case "tcp", "":
-		return net.Listen("tcp", parsed.Host)
-	case "unix":
-		absPath, err := filepath.Abs(parsed.Path)
-		if err != nil {
-			return nil, trace.Wrap(err, "resolving absolute path for %q", parsed.Path)
-		}
-
-		// Remove the file if it already exists. This is necessary to handle
-		// unclean exits.
-		if err := os.Remove(absPath); err != nil && !os.IsNotExist(err) {
-			log.WarnContext(ctx, "Failed to remove existing socket file", "error", err)
-		}
-
-		l, err := net.ListenUnix("unix", &net.UnixAddr{
-			Net:  "unix",
-			Name: absPath,
-		})
-		if err != nil {
-			return nil, trace.Wrap(err, "creating unix socket", absPath)
-		}
-
-		// On Unix systems, you must have read and write permissions for the
-		// socket to connect to it. The execute permission on the directories
-		// containing the socket must also be granted. This is different to when
-		// we write output artifacts which only require the consumer to have
-		// read access.
-		//
-		// We set the socket perm to 777. Instead of controlling access via
-		// the socket file directly, users will either:
-		// - Configure Unix Workload Attestation to restrict access to specific
-		//   PID/UID/GID combinations.
-		// - Configure the filesystem permissions of the directory containing
-		//   the socket.
-		if err := os.Chmod(absPath, os.ModePerm); err != nil {
-			return nil, trace.Wrap(err, "setting permissions on unix socket", absPath)
-		}
-
-		return l, nil
-	default:
-		return nil, trace.BadParameter("unsupported scheme %q", parsed.Scheme)
-	}
-}
-
-func (s *SPIFFEWorkloadAPIService) Run(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "SPIFFEWorkloadAPIService/Run")
-	defer span.End()
-
-	s.log.DebugContext(ctx, "Starting pre-run initialization")
-	if err := s.setup(ctx); err != nil {
-		return trace.Wrap(err)
-	}
-	defer s.client.Close()
-	s.log.DebugContext(ctx, "Completed pre-run initialization")
-
-	srvMetrics := metrics.CreateGRPCServerMetrics(
-		true, prometheus.Labels{
-			teleport.TagServer: "tbot-spiffe-workload-api",
-		},
-	)
-	if err := metrics.RegisterPrometheusCollectors(srvMetrics); err != nil {
-		return trace.Wrap(err)
-	}
-	srv := grpc.NewServer(
-		grpc.Creds(
-			// SPEC (SPIFFE_Workload_endpoint) 3. Transport:
-			// - Transport Layer Security MUST NOT be required
-			// TODO(noah): We should optionally provide TLS support here down
-			// the road.
-			uds.NewTransportCredentials(insecure.NewCredentials()),
-		),
-		grpc.ChainUnaryInterceptor(
-			recovery.UnaryServerInterceptor(),
-			srvMetrics.UnaryServerInterceptor(),
-		),
-		grpc.ChainStreamInterceptor(
-			recovery.StreamServerInterceptor(),
-			srvMetrics.StreamServerInterceptor(),
-		),
-		grpc.StatsHandler(otelgrpc.NewServerHandler()),
-		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
-	)
-	workloadpb.RegisterSpiffeWorkloadAPIServer(srv, s)
-	sdsHandler := &spiffeSDSHandler{
-		log:              s.log,
-		botCfg:           s.botCfg,
-		trustBundleCache: s.trustBundleCache,
-		clientAuthenticator: func(ctx context.Context) (*slog.Logger, svidFetcher, error) {
-			log, attrs, err := s.authenticateClient(ctx)
-			if err != nil {
-				return log, nil, trace.Wrap(err, "authenticating client")
-			}
-			fetchSVIDs := func(
-				ctx context.Context,
-				localBundle *spiffebundle.Bundle,
-			) ([]*workloadpb.X509SVID, error) {
-				return s.fetchX509SVIDs(
-					ctx,
-					log,
-					localBundle,
-					filterSVIDRequests(ctx, log, s.cfg.SVIDs, attrs),
-				)
-			}
-			return log, fetchSVIDs, nil
-		},
-	}
-	secretv3pb.RegisterSecretDiscoveryServiceServer(srv, sdsHandler)
-
-	lis, err := createListener(ctx, s.log, s.cfg.Listen)
-	if err != nil {
-		return trace.Wrap(err, "creating listener")
-	}
-	defer func() {
-		if err := lis.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Encountered error closing listener", "error", err)
-		}
-	}()
-	s.log.InfoContext(ctx, "Listener opened for Workload API endpoint", "addr", lis.Addr().String())
-	if lis.Addr().Network() == "tcp" {
-		s.log.WarnContext(
-			ctx, "Workload API endpoint listening on a TCP port. Ensure that only intended hosts can reach this port!",
-		)
-	}
-
-	// Set off the long running tasks in an errgroup
-	eg, egCtx := errgroup.WithContext(ctx)
-	eg.Go(func() error {
-		// Start the gRPC server
-		return srv.Serve(lis)
-	})
-	eg.Go(func() error {
-		// Shutdown the server when the context is canceled
-		<-egCtx.Done()
-		s.log.DebugContext(ctx, "Shutting down Workload API endpoint")
-		srv.Stop()
-		s.log.InfoContext(ctx, "Shut down Workload API endpoint")
-		return nil
-	})
-
-	return trace.Wrap(eg.Wait())
-}
-
-// serialString returns a human-readable colon-separated string of the serial
-// number in hex.
-func serialString(serial *big.Int) string {
-	hex := serial.Text(16)
-	if len(hex)%2 == 1 {
-		hex = "0" + hex
-	}
-
-	out := strings.Builder{}
-	for i := 0; i < len(hex); i += 2 {
-		if i != 0 {
-			out.WriteString(":")
-		}
-		out.WriteString(hex[i : i+2])
-	}
-	return out.String()
-}
-
-// fetchX509SVIDs fetches the X.509 SVIDs for the bot's configured SVIDs and
-// returns them in the SPIFFE Workload API format.
-func (s *SPIFFEWorkloadAPIService) fetchX509SVIDs(
-	ctx context.Context,
-	log *slog.Logger,
-	localBundle *spiffebundle.Bundle,
-	svidRequests []config.SVIDRequest,
-) ([]*workloadpb.X509SVID, error) {
-	ctx, span := tracer.Start(ctx, "SPIFFEWorkloadAPIService/fetchX509SVIDs")
-	defer span.End()
-
-	// TODO(noah): We should probably take inspiration from SPIRE agent's
-	// behavior of pre-fetching the SVIDs rather than doing this for
-	// every request.
-	res, privateKey, err := generateSVID(
-		ctx,
-		s.client,
-		svidRequests,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// Convert the private key to PKCS#8 format as per SPIFFE spec.
-	pkcs8PrivateKey, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	marshaledBundle := workloadidentity.MarshalX509Bundle(localBundle.X509Bundle())
-
-	// Convert responses from the Teleport API to the SPIFFE Workload API
-	// format.
-	svids := make([]*workloadpb.X509SVID, len(res.Svids))
-	for i, svidRes := range res.Svids {
-		svids[i] = &workloadpb.X509SVID{
-			// Required. The SPIFFE ID of the SVID in this entry
-			SpiffeId: svidRes.SpiffeId,
-			// Required. ASN.1 DER encoded certificate chain. MAY include
-			// intermediates, the leaf certificate (or SVID itself) MUST come first.
-			X509Svid: svidRes.Certificate,
-			// Required. ASN.1 DER encoded PKCS#8 private key. MUST be unencrypted.
-			X509SvidKey: pkcs8PrivateKey,
-			// Required. ASN.1 DER encoded X.509 bundle for the trust domain.
-			Bundle: marshaledBundle,
-			Hint:   svidRes.Hint,
-		}
-		cert, err := x509.ParseCertificate(svidRes.Certificate)
-		if err != nil {
-			return nil, trace.Wrap(err, "parsing issued svid received from server")
-		}
-		// Log a message which correlates with the audit log entry and can
-		// provide additional metadata about the client.
-		log.InfoContext(ctx,
-			"Issued SVID for workload",
-			slog.Group("svid",
-				"type", "x509",
-				"spiffe_id", svidRes.SpiffeId,
-				"serial_number", serialString(cert.SerialNumber),
-				"hint", svidRes.Hint,
-				"not_after", cert.NotAfter,
-				"not_before", cert.NotBefore,
-				"dns_sans", cert.DNSNames,
-				"ip_sans", cert.IPAddresses,
-			),
-		)
-	}
-
-	return svids, nil
-}
-
-// filterSVIDRequests filters the SVID requests based on the workload
-// attestation.
-//
-// TODO(noah): In a future PR, we need to totally refactor this to a more
-// flexible rules engine otherwise this is going to get absurdly large as
-// we add more types. Ideally, something that would be compatible with a
-// predicate language would be great.
-func filterSVIDRequests(
-	ctx context.Context,
-	log *slog.Logger,
-	svidRequests []config.SVIDRequestWithRules,
-	att *attrs.WorkloadAttrs,
-) []config.SVIDRequest {
-	var filtered []config.SVIDRequest
-	for _, req := range svidRequests {
-		log := log.With("svid", req.SVIDRequest)
-		// If no rules are configured, default to allow.
-		if len(req.Rules) == 0 {
-			log.DebugContext(
-				ctx,
-				"No rules configured for SVID. SVID will be issued",
-			)
-			filtered = append(filtered, req.SVIDRequest)
-			continue
-		}
-
-		// Otherwise, evaluate all the rules, looking for one matching rule.
-		match := false
-		for _, rule := range req.Rules {
-			log := log.With("rule", rule)
-			logMismatch := func(field string, want any, got any) {
-				log.DebugContext(
-					ctx,
-					"Rule did not match workload attestation",
-					"field", field,
-					"want", want,
-					"got", got,
-				)
-			}
-			logNotAttested := func(requiredAttestor string) {
-				log.DebugContext(
-					ctx,
-					"Workload did not complete attestation required for this rule",
-					"required_attestor", requiredAttestor,
-				)
-			}
-			log.DebugContext(
-				ctx,
-				"Evaluating rule against workload attestation",
-			)
-			if rule.Unix.UID != nil {
-				if !att.GetUnix().GetAttested() {
-					logNotAttested("unix")
-					continue
-				}
-				if *rule.Unix.UID != int(att.GetUnix().GetUid()) {
-					logMismatch("unix.uid", *rule.Unix.UID, att.GetUnix().GetUid())
-					continue
-				}
-				// Rule field matched!
-			}
-			if rule.Unix.PID != nil {
-				if !att.GetUnix().GetAttested() {
-					logNotAttested("unix")
-					continue
-				}
-				if *rule.Unix.PID != int(att.GetUnix().GetPid()) {
-					logMismatch("unix.pid", *rule.Unix.PID, att.GetUnix().GetPid())
-					continue
-				}
-				// Rule field matched!
-			}
-			if rule.Unix.GID != nil {
-				if !att.GetUnix().GetAttested() {
-					logNotAttested("unix")
-					continue
-				}
-				if *rule.Unix.GID != int(att.GetUnix().GetGid()) {
-					logMismatch("unix.gid", *rule.Unix.GID, att.GetUnix().GetGid())
-					continue
-				}
-				// Rule field matched!
-			}
-			if rule.Kubernetes.Namespace != "" {
-				if !att.GetKubernetes().GetAttested() {
-					logNotAttested("kubernetes")
-					continue
-				}
-				if rule.Kubernetes.Namespace != att.GetKubernetes().GetNamespace() {
-					logMismatch("kubernetes.namespace", rule.Kubernetes.Namespace, att.GetKubernetes().GetNamespace())
-					continue
-				}
-				// Rule field matched!
-			}
-			if rule.Kubernetes.PodName != "" {
-				if !att.GetKubernetes().GetAttested() {
-					logNotAttested("kubernetes")
-					continue
-				}
-				if rule.Kubernetes.PodName != att.GetKubernetes().GetPodName() {
-					logMismatch("kubernetes.pod_name", rule.Kubernetes.PodName, att.GetKubernetes().GetPodName())
-					continue
-				}
-				// Rule field matched!
-			}
-			if rule.Kubernetes.ServiceAccount != "" {
-				if !att.GetKubernetes().GetAttested() {
-					logNotAttested("kubernetes")
-					continue
-				}
-				if rule.Kubernetes.ServiceAccount != att.GetKubernetes().GetServiceAccount() {
-					logMismatch("kubernetes.service_account", rule.Kubernetes.ServiceAccount, att.GetKubernetes().GetServiceAccount())
-					continue
-				}
-				// Rule field matched!
-			}
-
-			log.DebugContext(
-				ctx,
-				"Rule matched workload attestation. SVID will be issued",
-			)
-			match = true
-			filtered = append(filtered, req.SVIDRequest)
-			break
-		}
-		if !match {
-			log.DebugContext(
-				ctx,
-				"No rules matched workload attestation. SVID will not be issued",
-			)
-		}
-	}
-	return filtered
-}
-
-func (s *SPIFFEWorkloadAPIService) authenticateClient(
-	ctx context.Context,
-) (*slog.Logger, *attrs.WorkloadAttrs, error) {
-	p, ok := peer.FromContext(ctx)
-	if !ok {
-		return nil, nil, trace.BadParameter("peer not found in context")
-	}
-	log := s.log
-
-	if p.Addr.String() != "" {
-		log = log.With(
-			slog.String("remote_addr", p.Addr.String()),
-		)
-	}
-
-	authInfo, ok := p.AuthInfo.(uds.AuthInfo)
-	// We expect Creds to be nil/unset if the client is connecting via TCP and
-	// therefore there is no workload attestation that can be completed.
-	if !ok || authInfo.Creds == nil {
-		return log, nil, nil
-	}
-
-	// For a UDS, sometimes we are unable to determine the PID of the calling
-	// workload. This can happen if the caller is calling from another process
-	// namespace. In this case, Creds will be non-nil but the PID will be 0.
-	//
-	// We should fail softly here as there could be SVIDs that do not require
-	// workload attestation.
-	if authInfo.Creds.PID == 0 {
-		log.DebugContext(
-			ctx, "Failed to determine the PID of the calling workload. TBot may be running in a different process namespace to the workload. Workload attestation will not be completed.")
-		return log, nil, nil
-	}
-
-	att, err := s.attestor.Attest(ctx, authInfo.Creds.PID)
-	if err != nil {
-		// Fail softly as there may be SVIDs configured that don't require any
-		// workload attestation and we should still issue those.
-		log.ErrorContext(
-			ctx,
-			"Workload attestation failed",
-			"error", err,
-			"pid", authInfo.Creds.PID,
-		)
-		return log, nil, nil
-	}
-	log = log.With("workload", att)
-
-	return log, att, nil
-}
-
-// FetchX509SVID generates and returns the X.509 SVIDs available to a workload.
-// It is a streaming RPC, and sends renewed SVIDs to the client before they
-// expire.
-// Implements the SPIFFE Workload API FetchX509SVID method.
-func (s *SPIFFEWorkloadAPIService) FetchX509SVID(
-	_ *workloadpb.X509SVIDRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchX509SVIDServer,
-) error {
-	ctx := srv.Context()
-
-	log, creds, err := s.authenticateClient(ctx)
-	if err != nil {
-		return trace.Wrap(err, "authenticating client")
-	}
-
-	log.InfoContext(ctx, "FetchX509SVID stream opened by workload")
-	defer log.InfoContext(ctx, "FetchX509SVID stream has closed")
-
-	// Before we issue the SVIDs to the workload, we need to complete workload
-	// attestation and determine which SVIDs to issue.
-	svidReqs := filterSVIDRequests(ctx, log, s.cfg.SVIDs, creds)
-
-	// The SPIFFE Workload API (5.2.1):
-	//
-	//   If the client is not entitled to receive any X509-SVIDs, then the
-	//   server SHOULD respond with the "PermissionDenied" gRPC status code (see
-	//   the Error Codes section in the SPIFFE Workload Endpoint specification
-	//   for more information). Under such a case, the client MAY attempt to
-	//   reconnect with another call to the FetchX509SVID RPC after a backoff.
-	if len(svidReqs) == 0 {
-		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
-		s.attestor.Failed(ctx, creds)
-		return status.Error(
-			codes.PermissionDenied,
-			"workload did not pass attestation for any SVIDs",
-		)
-	}
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	var svids []*workloadpb.X509SVID
-	for {
-		log.InfoContext(ctx, "Starting to issue X509 SVIDs to workload")
-
-		// Fetch SVIDs if necessary.
-		if svids == nil {
-			svids, err = s.fetchX509SVIDs(ctx, log, bundleSet.Local, svidReqs)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-		}
-		err = srv.Send(&workloadpb.X509SVIDResponse{
-			Svids:            svids,
-			FederatedBundles: bundleSet.EncodedX509Bundles(false),
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		log.DebugContext(
-			ctx, "Finished issuing SVIDs to workload. Waiting for next renewal interval or CA rotation",
-		)
-
-		select {
-		case <-ctx.Done():
-			log.DebugContext(ctx, "Context closed, stopping SVID stream")
-			return nil
-		case <-bundleSet.Stale():
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			log.DebugContext(ctx, "Federated trust bundles have been updated, renewing SVIDs")
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the "local" trust domain's CA has changed, we need to
-				// reissue the SVIDs.
-				svids = nil
-			}
-			bundleSet = newBundleSet
-			continue
-		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
-			log.DebugContext(ctx, "Renewal interval reached, renewing SVIDs")
-			svids = nil
-			continue
-		}
-	}
-}
-
-// FetchX509Bundles returns the trust bundle for the trust domain. It is a
-// streaming RPC, and will send rotated trust bundles to the client for as long
-// as the client is connected.
-// Implements the SPIFFE Workload API FetchX509SVID method.
-func (s *SPIFFEWorkloadAPIService) FetchX509Bundles(
-	_ *workloadpb.X509BundlesRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchX509BundlesServer,
-) error {
-	ctx := srv.Context()
-	s.log.InfoContext(ctx, "FetchX509Bundles stream opened by workload")
-	defer s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
-
-	for {
-		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		s.log.InfoContext(ctx, "Sending X.509 trust bundles to workload")
-		err = srv.Send(&workloadpb.X509BundlesResponse{
-			Bundles: bundleSet.EncodedX509Bundles(true),
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-bundleSet.Stale():
-		}
-	}
-}
-
-const defaultJWTSVIDTTL = time.Minute * 5
-
-// FetchJWTSVID implements the SPIFFE Workload API FetchJWTSVID method.
-// See The SPIFFE Workload API (6.2.1).
-func (s *SPIFFEWorkloadAPIService) FetchJWTSVID(
-	ctx context.Context,
-	req *workloadpb.JWTSVIDRequest,
-) (*workloadpb.JWTSVIDResponse, error) {
-	log, creds, err := s.authenticateClient(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "authenticating client")
-	}
-
-	log.InfoContext(ctx, "FetchJWTSVID request received from workload")
-	defer log.InfoContext(ctx, "FetchJWTSVID request handled")
-	if req.SpiffeId == "" {
-		log = log.With("requested_spiffe_id", req.SpiffeId)
-	}
-
-	// The SPIFFE Workload API (6.2.1):
-	// > The JWTSVIDRequest request message contains a mandatory audience field,
-	// > which MUST contain the value to embed in the audience claim of the
-	// > returned JWT-SVIDs.
-	if len(req.Audience) == 0 {
-		return nil, trace.BadParameter("audience: must have at least one value")
-	}
-
-	svidReqs := filterSVIDRequests(ctx, log, s.cfg.SVIDs, creds)
-	// The SPIFFE Workload API (6.2.1):
-	// > If the client is not authorized for any identities, or not authorized
-	// > for the specific identity requested via the spiffe_id field, then the
-	// > server SHOULD respond with the "PermissionDenied" gRPC status code.
-	if len(svidReqs) == 0 {
-		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
-		s.attestor.Failed(ctx, creds)
-		return nil, status.Error(
-			codes.PermissionDenied,
-			"workload did not pass attestation for any SVIDs",
-		)
-	}
-
-	// The SPIFFE Workload API (6.2.1):
-	// > The spiffe_id field is optional, and is used to request a JWT-SVID for
-	// > a specific SPIFFE ID. If unspecified, the server MUST return JWT-SVIDs
-	// > for all identities authorized for the client.
-	if req.SpiffeId != "" {
-		requestedSPIFFEID, err := spiffeid.FromString(req.SpiffeId)
-		if err != nil {
-			return nil, trace.Wrap(err, "parsing requested SPIFFE ID")
-		}
-		if requestedSPIFFEID.TrustDomain() != s.localTrustDomain {
-			return nil, trace.BadParameter("requested SPIFFE ID is not in the local trust domain")
-		}
-		// Search through available SVIDs to find the one that matches the
-		// requested SPIFFE ID.
-		found := false
-		for _, svidReq := range svidReqs {
-			spiffeID, err := spiffeid.FromPath(s.localTrustDomain, svidReq.Path)
-			if err != nil {
-				return nil, trace.Wrap(err, "parsing SPIFFE ID from path %q", svidReq.Path)
-			}
-			if spiffeID.String() == req.SpiffeId {
-				found = true
-				svidReqs = []config.SVIDRequest{svidReq}
-				break
-			}
-		}
-		if !found {
-			log.ErrorContext(ctx, "Workload is not authorized for the specifically requested SPIFFE ID", "requested_spiffe_id", req.SpiffeId)
-			return nil, status.Error(
-				codes.PermissionDenied,
-				"workload is not authorized for requested SPIFFE ID",
-			)
-		}
-	}
-
-	// Allow users to manually override the TTL for JWT-SVIDs produced by this
-	// service.
-	ttl := cmp.Or(s.cfg.JWTSVIDTTL, defaultJWTSVIDTTL)
-
-	reqs := make([]*machineidv1pb.JWTSVIDRequest, 0, len(svidReqs))
-	for _, svidReq := range svidReqs {
-		reqs = append(reqs, &machineidv1pb.JWTSVIDRequest{
-			SpiffeIdPath: svidReq.Path,
-			Audiences:    req.Audience,
-			Ttl:          durationpb.New(ttl),
-			Hint:         svidReq.Hint,
-		})
-	}
-
-	res, err := s.client.WorkloadIdentityServiceClient().SignJWTSVIDs(ctx, &machineidv1pb.SignJWTSVIDsRequest{
-		Svids: reqs,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "requesting signed JWT-SVIDs from Teleport")
-	}
-
-	out := &workloadpb.JWTSVIDResponse{}
-	for _, resSVID := range res.Svids {
-		out.Svids = append(out.Svids, &workloadpb.JWTSVID{
-			SpiffeId: resSVID.SpiffeId,
-			Svid:     resSVID.Jwt,
-			Hint:     resSVID.Hint,
-		})
-		log.InfoContext(ctx,
-			"Issued SVID for workload",
-			slog.Group("svid",
-				"type", "jwt",
-				"spiffe_id", resSVID.SpiffeId,
-				"jti", resSVID.Jti,
-				"hint", resSVID.Hint,
-				"audiences", resSVID.Audiences,
-			),
-		)
-	}
-
-	return out, nil
-}
-
-// FetchJWTBundles implements the SPIFFE Workload API FetchJWTBundles method.
-// See The SPIFFE Workload API (6.2.2).
-func (s *SPIFFEWorkloadAPIService) FetchJWTBundles(
-	_ *workloadpb.JWTBundlesRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchJWTBundlesServer,
-) error {
-	ctx := srv.Context()
-	s.log.InfoContext(ctx, "FetchJWTBundles stream started by workload")
-	defer s.log.InfoContext(ctx, "FetchJWTBundles stream ended")
-
-	for {
-		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		s.log.InfoContext(ctx, "Sending JWT trust bundles to workload")
-
-		// The SPIFFE Workload API (6.2.2):
-		// > The returned bundles are encoded as a standard JWK Set as defined
-		// > by RFC 7517 containing the JWT-SVID signing keys for the trust
-		// > domain. These keys may only represent a subset of the keys present
-		// > in the SPIFFE trust bundle for the trust domain. The server MUST
-		// > NOT include keys with other uses in the returned JWT bundles.
-		bundles, err := bundleSet.MarshaledJWKSBundles(true)
-		if err != nil {
-			return trace.Wrap(err, "marshaling bundles as JWKS")
-		}
-		err = srv.Send(&workloadpb.JWTBundlesResponse{
-			Bundles: bundles,
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-bundleSet.Stale():
-		}
-	}
-}
-
-// ValidateJWTSVID implements the SPIFFE Workload API ValidateJWTSVID method.
-// See The SPIFFE Workload API (6.2.3).
-func (s *SPIFFEWorkloadAPIService) ValidateJWTSVID(
-	ctx context.Context,
-	req *workloadpb.ValidateJWTSVIDRequest,
-) (*workloadpb.ValidateJWTSVIDResponse, error) {
-	s.log.InfoContext(ctx, "ValidateJWTSVID request received from workload")
-	defer s.log.InfoContext(ctx, "ValidateJWTSVID request handled")
-
-	// The SPIFFE Workload API (6.2.3):
-	// > All fields in the ValidateJWTSVIDRequest and ValidateJWTSVIDResponse
-	// > message are mandatory.
-	switch {
-	case req.Audience == "":
-		return nil, trace.BadParameter("audience: must be set")
-	case req.Svid == "":
-		return nil, trace.BadParameter("svid: must be set")
-	}
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	svid, err := jwtsvid.ParseAndValidate(
-		req.Svid, bundleSet, []string{req.Audience},
-	)
-	if err != nil {
-		return nil, trace.Wrap(err, "validating JWT SVID")
-	}
-
-	claims, err := structpb.NewStruct(svid.Claims)
-	if err != nil {
-		return nil, trace.Wrap(err, "marshaling claims")
-	}
-
-	return &workloadpb.ValidateJWTSVIDResponse{
-		SpiffeId: svid.ID.String(),
-		Claims:   claims,
-	}, nil
-}
-
-// String returns a human-readable string that can uniquely identify the
-// service.
-func (s *SPIFFEWorkloadAPIService) String() string {
-	return fmt.Sprintf("%s:%s", config.SPIFFEWorkloadAPIServiceType, s.cfg.Listen)
-}
diff --git a/lib/tbot/service_spiffe_workload_api_sds.go b/lib/tbot/service_spiffe_workload_api_sds.go
deleted file mode 100644
index ac1706df9782c..0000000000000
--- a/lib/tbot/service_spiffe_workload_api_sds.go
+++ /dev/null
@@ -1,621 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"encoding/pem"
-	"errors"
-	"io"
-	"log/slog"
-	"maps"
-	"slices"
-	"time"
-
-	corev3pb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
-	tlsv3pb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
-	discoveryv3pb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
-	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
-	"github.com/gravitational/trace"
-	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
-	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/anypb"
-
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// The following constants allow querying this API for SVIDs and trust bundles
-// without knowing their names. These special values are relied upon by tools
-// like Istio.
-const (
-	// envoyDefaultSVIDName indicates that the first available SVID should be
-	// returned.
-	envoyDefaultSVIDName = "default"
-	// envoyDefaultBundleName indicates that the default trust bundle should be
-	// returned, e.g the one for the trust domain that the workload is part of.
-	envoyDefaultBundleName = "ROOTCA"
-	// envoyAllBundlesName indicates that all available trust bundles,
-	// including federated ones, should be returned.
-	envoyAllBundlesName = "ALL"
-)
-
-type bundleSetGetter interface {
-	GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error)
-}
-
-type svidFetcher func(ctx context.Context, localBundle *spiffebundle.Bundle) ([]*workloadpb.X509SVID, error)
-
-// spiffeSDSHandler implements an Envoy SDS API.
-//
-// This effectively replaces the Workload API for Envoy, but functions in a
-// very similar way.
-type spiffeSDSHandler struct {
-	log              *slog.Logger
-	botCfg           *config.BotConfig
-	trustBundleCache bundleSetGetter
-
-	clientAuthenticator func(ctx context.Context) (*slog.Logger, svidFetcher, error)
-}
-
-// FetchSecrets implements
-// envoy.service.secret.v3/SecretDiscoveryService.FetchSecrets.
-// This should return the current SVIDs and trust bundles.
-//
-// See:
-// - DiscoveryRequest - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryrequest
-// - DiscoveryResponse - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryresponse
-func (s *spiffeSDSHandler) FetchSecrets(
-	ctx context.Context,
-	req *discoveryv3pb.DiscoveryRequest,
-) (*discoveryv3pb.DiscoveryResponse, error) {
-	if err := enforceMinimumEnvoyVersion(req); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	log, fetchSVIDs, err := s.clientAuthenticator(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "authenticating client")
-	}
-
-	log.DebugContext(
-		ctx,
-		"SecretDiscoveryService.FetchSecrets request received from workload",
-		slog.Group("req", "resource_names", req.ResourceNames),
-	)
-	defer log.DebugContext(ctx, "SecretDiscoveryService.FetchSecrets request handled")
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "getting trust bundle set")
-	}
-
-	svids, err := fetchSVIDs(ctx, bundleSet.Local)
-	if err != nil {
-		return nil, trace.Wrap(err, "fetching X509 SVIDs")
-	}
-
-	return s.generateResponse(
-		bundleSet,
-		svids,
-		req,
-	)
-}
-
-// StreamSecrets implements
-// envoy.service.secret.v3/SecretDiscoveryService.StreamSecrets.
-// This should return the current SVIDs and CAs, and stream any future updates.
-//
-// This is a little more complex than one might expect since Envoy provides
-// an ACK/NACK mechanism to indicate that the config included within a response
-// was successfully applied.
-//
-// From the docs on the request version_info field:
-//
-//	The version_info provided in the request messages will be the
-//	version_info received with the most recent successfully processed
-//	response or empty on the first request. It is expected that no new
-//	request is sent after a response is received until the Envoy
-//	instance is ready to ACK/NACK the new configuration. ACK/NACK takes
-//	place by returning the new API config version as applied or the
-//	previous API config version respectively.
-//
-// From the docs on the DiscoveryRequest.response_nonce field:
-//
-//	nonce corresponding to DiscoveryResponse being ACK/NACKed. See above
-//	discussion on version_info and the DiscoveryResponse nonce comment
-//
-// From the docs on the DiscoveryResponse.nonce field:
-//
-//	For gRPC based subscriptions, the nonce provides a way to explicitly ack a
-//	specific DiscoveryResponse in a following DiscoveryRequest. Additional
-//	messages may have been sent by Envoy to the management server for the
-//	previous version on the stream prior to this DiscoveryResponse, that were
-//	unprocessed at response send time. The nonce allows the management server to
-//	ignore any further DiscoveryRequests for the previous version until a
-//	DiscoveryRequest bearing the nonce.
-//
-// See also:
-// - DiscoveryRequest - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryrequest
-// - DiscoveryResponse - https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/discovery/v3/discovery.proto#service-discovery-v3-discoveryresponse
-//
-// TODO: We could probably be smarter about how we handle the version e.g,
-// do we need to send another response if we're just going to send identical
-// certificates ??
-func (s *spiffeSDSHandler) StreamSecrets(
-	srv secretv3pb.SecretDiscoveryService_StreamSecretsServer,
-) error {
-	ctx := srv.Context()
-	log, fetchSVIDs, err := s.clientAuthenticator(ctx)
-	if err != nil {
-		return trace.Wrap(err, "authenticating client")
-	}
-
-	log.DebugContext(
-		ctx,
-		"SecretDiscoveryService.StreamSecrets stream started",
-	)
-	defer log.DebugContext(ctx, "SecretDiscoveryService.FetchSecrets stream finished")
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "getting trust bundle set")
-	}
-
-	// Push incoming messages into a chan for the main loop to handle
-	recvCh := make(chan *discoveryv3pb.DiscoveryRequest, 1)
-	recvErrCh := make(chan error, 1)
-	go func() {
-		for {
-			req, err := srv.Recv()
-			if err != nil {
-				// It's worth noting that we'll receive an IOF/Canceled error
-				// here once the main goroutine has exited or the client goes
-				// away.
-				select {
-				case recvErrCh <- err:
-				default:
-				}
-				return
-			}
-			recvCh <- req
-		}
-	}()
-
-	renewalTimer := time.NewTimer(s.botCfg.CredentialLifetime.RenewalInterval)
-	// Stop the timer immediately so we can start timing after the first
-	// response is sent.
-	renewalTimer.Stop()
-	defer renewalTimer.Stop()
-
-	// Track the last response and last request to allow us to handle ACK/NACK
-	// and versioning.
-	var (
-		lastResp *discoveryv3pb.DiscoveryResponse
-		lastReq  *discoveryv3pb.DiscoveryRequest
-		svids    []*workloadpb.X509SVID
-	)
-	for {
-		select {
-		case err := <-recvErrCh:
-			// If we receive an error from the read side, we should exit.
-			// This error could be an EOF/Canceled error if the client
-			// goes away.
-			if errors.Is(err, io.EOF) || errors.Is(err, context.Canceled) {
-				return nil
-			}
-			return trace.Wrap(err)
-		case newReq := <-recvCh:
-			log.DebugContext(
-				ctx,
-				"Received StreamSecrets DiscoveryRequest",
-				slog.Group(
-					"req",
-					"resource_names", newReq.ResourceNames,
-					"version_info", newReq.VersionInfo,
-					"response_nonce", newReq.ResponseNonce,
-					"node_id", newReq.Node.GetId(),
-				),
-			)
-
-			shouldRespond := true
-
-			// If we've sent a response, then this request ought to be a reply
-			// We should check the nonces/versions to ensure it's successfully
-			// applied
-			if lastResp != nil {
-				// Envoy can send an "ErrorDetails" which indicates that the
-				// previously sent response could not be applied.
-				if newReq.ErrorDetail != nil {
-					log.WarnContext(
-						ctx,
-						"Envoy was unable to apply previous discovery response",
-						"error", newReq.ErrorDetail.Message,
-					)
-				}
-
-				if lastResp.Nonce != newReq.ResponseNonce {
-					log.WarnContext(
-						ctx,
-						"Envoy sent a nonce which does not match the last response, ignoring request",
-						"want", lastResp.Nonce,
-						"got", newReq.ResponseNonce,
-					)
-					// We want to ignore this request because it's been sent
-					// before Envoy has processed our last response.
-					continue
-				}
-
-				// Since we've already sent them a response, we should only
-				// respond again if they've changed what they've requested.
-				shouldRespond = !elementsMatch(
-					lastReq.ResourceNames, newReq.ResourceNames,
-				)
-				// TODO(noah): SPIRE's implementation seems to check the last
-				// requests resource names - but I wonder if it makes more sense
-				// to compare the requests resource names against those sent in
-				// the last response.
-			}
-
-			lastReq = newReq
-			if !shouldRespond {
-				continue
-			}
-
-		case <-bundleSet.Stale():
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err, "getting trust bundle set")
-			}
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the "local" trust domain's CA has changed, we need to
-				// reissue the SVIDs.
-				svids = nil
-			}
-			bundleSet = newBundleSet
-		case <-renewalTimer.C:
-			// Handle renewal time!
-			log.DebugContext(ctx, "Renewing SVIDs for StreamSecrets stream")
-		}
-
-		// Fetch the SVIDs if necessary
-		if svids == nil {
-			svids, err = fetchSVIDs(ctx, bundleSet.Local)
-			if err != nil {
-				return trace.Wrap(err, "fetching X509 SVIDs")
-			}
-		}
-
-		resp, err := s.generateResponse(
-			bundleSet, svids, lastReq,
-		)
-		if err != nil {
-			return trace.Wrap(err, "generating response")
-		}
-
-		// Decorate the generated response with the stream ACK/NACK and
-		// versioning fields.
-		nonce, err := utils.CryptoRandomHex(4)
-		if err != nil {
-			return trace.Wrap(err, "generating nonce")
-		}
-		resp.Nonce = nonce
-		resp.VersionInfo = time.Now().UTC().Format(time.RFC3339Nano)
-		if err := srv.Send(resp); err != nil {
-			return trace.Wrap(err, "sending response")
-		}
-		lastResp = resp
-		log.DebugContext(
-			ctx,
-			"Sent StreamSecrets DiscoveryResponse",
-			slog.Group(
-				"resp",
-				"resources_len", len(resp.Resources),
-				"nonce", resp.Nonce,
-				"version_info", resp.VersionInfo,
-			),
-		)
-
-		renewalTimer.Reset(s.botCfg.CredentialLifetime.RenewalInterval)
-	}
-}
-
-// elementsMatch compares two string slices for equality, ignoring order.
-func elementsMatch(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	seen := map[string]bool{}
-	for _, v := range a {
-		seen[v] = true
-	}
-	for _, v := range b {
-		if !seen[v] {
-			return false
-		}
-	}
-	return true
-}
-
-func (s *spiffeSDSHandler) generateResponse(
-	bundleSet *workloadidentity.BundleSet,
-	svids []*workloadpb.X509SVID,
-	req *discoveryv3pb.DiscoveryRequest,
-) (*discoveryv3pb.DiscoveryResponse, error) {
-	// names holds all names requested by the client
-	// if this is nothing, we assume they want everything available to them.
-	// it's worth keeping in mind that there's some special names we need to
-	// handle.
-	names := map[string]bool{}
-	for _, name := range req.ResourceNames {
-		// Ignore empty string
-		if name != "" {
-			names[name] = true
-		}
-	}
-	returnAll := len(names) == 0
-
-	var resources []*anypb.Any
-	for i, svid := range svids {
-		// Now we need to filter the SVIDs down to those requested by the
-		// client.
-		// There's a special case here, if they've requested the default SVID,
-		// we want to ensure that the first SVID is returned and its name
-		// overrridden.
-
-		switch {
-		case returnAll || names[svid.SpiffeId]:
-			secret, err := newTLSV3Certificate(svid, "")
-			if err != nil {
-				return nil, trace.Wrap(err, "creating TLS certificate")
-			}
-			resources = append(resources, secret)
-			delete(names, svid.SpiffeId)
-		case names[envoyDefaultSVIDName] && i == 0:
-			secret, err := newTLSV3Certificate(svid, envoyDefaultSVIDName)
-			if err != nil {
-				return nil, trace.Wrap(err, "creating TLS certificate")
-			}
-			resources = append(resources, secret)
-			delete(names, envoyDefaultSVIDName)
-		}
-	}
-
-	// Convert trust bundle to SDS validator type.
-	switch {
-	case returnAll || names[bundleSet.Local.TrustDomain().IDString()]:
-		// If this name was explicitly specified or no names were specified,
-		// we use the proper trust domain ID as the resource name.
-		validator, err := newTLSV3ValidationContext(
-			[]*spiffebundle.Bundle{
-				bundleSet.Local,
-			}, bundleSet.Local.TrustDomain().IDString(),
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "creating TLS validation context")
-		}
-		resources = append(resources, validator)
-		delete(names, bundleSet.Local.TrustDomain().IDString())
-	case names[envoyDefaultBundleName]:
-		// If they've requested the default bundle, we send the connected trust
-		// domain's bundle - but - we override the name to match what they
-		// expect.
-		validator, err := newTLSV3ValidationContext(
-			[]*spiffebundle.Bundle{
-				bundleSet.Local,
-			}, envoyDefaultBundleName,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "creating TLS validation context")
-		}
-		resources = append(resources, validator)
-		delete(names, envoyDefaultBundleName)
-	case names[envoyAllBundlesName]:
-		// Return all the trust bundles as part of a single validation context.
-		// We'll also override the name to match what they requested.
-		bundles := slices.Collect(maps.Values(bundleSet.Federated))
-		bundles = append(bundles, bundleSet.Local)
-		validator, err := newTLSV3ValidationContext(
-			bundles, envoyAllBundlesName,
-		)
-		if err != nil {
-			return nil, trace.Wrap(err, "creating TLS validation context")
-		}
-		resources = append(resources, validator)
-		delete(names, envoyAllBundlesName)
-	}
-
-	if returnAll {
-		for _, bundle := range bundleSet.Federated {
-			validator, err := newTLSV3ValidationContext(
-				[]*spiffebundle.Bundle{
-					bundle,
-				}, bundle.TrustDomain().IDString(),
-			)
-			if err != nil {
-				return nil, trace.Wrap(err, "creating TLS validation context")
-			}
-			resources = append(resources, validator)
-		}
-	} else {
-		// For any remaining names, see if they match any federated trust bundles.
-		for name := range maps.Keys(names) {
-			var found *spiffebundle.Bundle
-			for _, bundle := range bundleSet.Federated {
-				if name == bundle.TrustDomain().IDString() {
-					found = bundle
-					break
-				}
-			}
-			if found != nil {
-				validator, err := newTLSV3ValidationContext(
-					[]*spiffebundle.Bundle{
-						found,
-					}, found.TrustDomain().IDString(),
-				)
-				if err != nil {
-					return nil, trace.Wrap(err, "creating TLS validation context")
-				}
-				resources = append(resources, validator)
-				delete(names, name)
-			}
-		}
-	}
-
-	// If any names are left-over, we've not been able to service them so
-	// we should return an explicit error rather than omitting data.
-	if len(names) > 0 {
-		return nil, trace.BadParameter("unknown resource names: %v", slices.Collect(maps.Keys(names)))
-	}
-
-	return &discoveryv3pb.DiscoveryResponse{
-		// Copy in requested type from req
-		TypeUrl:   req.TypeUrl,
-		Resources: resources,
-	}, nil
-}
-
-func enforceMinimumEnvoyVersion(req *discoveryv3pb.DiscoveryRequest) error {
-	// Envoy 1.18 introduced the SPIFFE specific tls context validator - so
-	// that's our minimum supported version.
-	buildVersion := req.Node.GetUserAgentBuildVersion()
-	// If not specified, let's assume that it's recent enough.
-	if buildVersion == nil {
-		return nil
-	}
-	if buildVersion.Version.MajorNumber > 1 {
-		return nil
-	}
-	if buildVersion.Version.MinorNumber >= 18 {
-		return nil
-	}
-	return trace.BadParameter("minimum supported version of envoy supported by the tbot SDS API is 1.18")
-}
-
-func newTLSV3Certificate(
-	svid *workloadpb.X509SVID, overrideResourceName string,
-) (*anypb.Any, error) {
-	// noah: This section of code does not currently support intermediate
-	// certificates, but, we don't currently use them.
-	certBytes := pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: svid.X509Svid,
-	})
-	privateKeyBytes := pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: svid.X509SvidKey,
-	})
-
-	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#envoy-v3-api-msg-extensions-transport-sockets-tls-v3-tlscertificate
-	secret := &tlsv3pb.Secret{
-		Name: svid.SpiffeId,
-		Type: &tlsv3pb.Secret_TlsCertificate{
-			TlsCertificate: &tlsv3pb.TlsCertificate{
-				CertificateChain: &corev3pb.DataSource{
-					Specifier: &corev3pb.DataSource_InlineBytes{
-						// Must be appended PEM-wrapped X509 certificates
-						InlineBytes: certBytes,
-					},
-				},
-				PrivateKey: &corev3pb.DataSource{
-					Specifier: &corev3pb.DataSource_InlineBytes{
-						// Must be PKCS8 PEM-wrapped private key
-						InlineBytes: privateKeyBytes,
-					},
-				},
-			},
-		},
-	}
-	if overrideResourceName != "" {
-		secret.Name = overrideResourceName
-	}
-
-	return anypb.New(secret)
-}
-
-const envoySPIFFECertValidator = "envoy.tls.cert_validator.spiffe"
-
-func newTLSV3ValidationContext(
-	bundles []*spiffebundle.Bundle, resourceName string,
-) (*anypb.Any, error) {
-	var trustDomains []*tlsv3pb.SPIFFECertValidatorConfig_TrustDomain
-	for _, bundle := range bundles {
-		caBytes, err := bundle.X509Bundle().Marshal()
-		if err != nil {
-			return nil, trace.Wrap(err, "marshaling trust bundle")
-		}
-
-		// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto#extensions-transport-sockets-tls-v3-spiffecertvalidatorconfig-trustdomain
-		trustDomain := &tlsv3pb.SPIFFECertValidatorConfig_TrustDomain{
-			// From API reference:
-			//   Note that this must not have “spiffe://” prefix.
-			Name: bundle.TrustDomain().Name(),
-			TrustBundle: &corev3pb.DataSource{
-				Specifier: &corev3pb.DataSource_InlineBytes{
-					// Must be concatenated PEM-wrapped X509 certificates
-					InlineBytes: caBytes,
-				},
-			},
-		}
-		trustDomains = append(trustDomains, trustDomain)
-	}
-
-	// Generate the typed config for the SPIFFE TLS cert validator extension
-	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto
-	extConfig, err := anypb.New(&tlsv3pb.SPIFFECertValidatorConfig{
-		TrustDomains: trustDomains,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-certificatevalidationcontext
-	secret := &tlsv3pb.Secret{
-		// We intentionally use the full IDString here in contrast to the
-		// short name used in the TrustDomain config block.
-		Name: resourceName,
-		Type: &tlsv3pb.Secret_ValidationContext{
-			ValidationContext: &tlsv3pb.CertificateValidationContext{
-				// We use a custom validation context for SPIFFE to provide
-				// greater usability than a plain TLS CA.
-				CustomValidatorConfig: &corev3pb.TypedExtensionConfig{
-					Name:        envoySPIFFECertValidator,
-					TypedConfig: extConfig,
-				},
-			},
-		},
-	}
-
-	return anypb.New(secret)
-}
-
-// DeltaSecrets implements
-// envoy.service.secret.v3/SecretDiscoveryService.DeltaSecrets.
-// We do not implement this method.
-func (s *spiffeSDSHandler) DeltaSecrets(
-	_ secretv3pb.SecretDiscoveryService_DeltaSecretsServer,
-) error {
-	return status.Error(
-		codes.Unimplemented,
-		"method not implemented",
-	)
-}
diff --git a/lib/tbot/service_spiffe_workload_api_sds_test.go b/lib/tbot/service_spiffe_workload_api_sds_test.go
deleted file mode 100644
index 0eb826d36a364..0000000000000
--- a/lib/tbot/service_spiffe_workload_api_sds_test.go
+++ /dev/null
@@ -1,413 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/pem"
-	"log/slog"
-	"os"
-	"path"
-	"path/filepath"
-	"testing"
-	"time"
-
-	tlsv3pb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
-	discoveryv3pb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
-	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
-	"github.com/google/go-cmp/cmp"
-	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
-	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
-	"github.com/spiffe/go-spiffe/v2/spiffeid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/protobuf/encoding/protojson"
-	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/anypb"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/testutils/golden"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-type mockTrustBundleCache struct {
-	currentBundle *workloadidentity.BundleSet
-}
-
-func (m *mockTrustBundleCache) GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error) {
-	return m.currentBundle, nil
-}
-
-// TestSDS_FetchSecrets performs a unit-test over the FetchSecrets method.
-// It tests the generation of the DiscoveryResponses and that authentication
-// is enforced.
-func TestSDS_FetchSecrets(t *testing.T) {
-	log := utils.NewSlogLoggerForTests()
-	ctx := context.Background()
-
-	td, err := spiffeid.TrustDomainFromString("example.com")
-	require.NoError(t, err)
-
-	b, _ := pem.Decode([]byte(fixtures.TLSCACertPEM))
-	require.NotNil(t, b, "Decode failed")
-	ca, err := x509.ParseCertificate(b.Bytes)
-	require.NoError(t, err)
-
-	clientAuthenticator := func(ctx context.Context) (*slog.Logger, svidFetcher, error) {
-		return log, func(ctx context.Context, localBundle *spiffebundle.Bundle) ([]*workloadpb.X509SVID, error) {
-			return []*workloadpb.X509SVID{
-				{
-					SpiffeId:    "spiffe://example.com/default",
-					X509Svid:    []byte("CERT-spiffe://example.com/default"),
-					X509SvidKey: []byte("KEY-spiffe://example.com/default"),
-					Bundle:      workloadidentity.MarshalX509Bundle(localBundle.X509Bundle()),
-				},
-				{
-					SpiffeId:    "spiffe://example.com/second",
-					X509Svid:    []byte("CERT-spiffe://example.com/second"),
-					X509SvidKey: []byte("KEY-spiffe://example.com/second"),
-					Bundle:      workloadidentity.MarshalX509Bundle(localBundle.X509Bundle()),
-				},
-			}, nil
-		}, nil
-	}
-
-	bundle := spiffebundle.New(td)
-	bundle.AddX509Authority(ca)
-
-	federatedBundle := spiffebundle.New(spiffeid.RequireTrustDomainFromString("federated.example.com"))
-	federatedBundle.AddX509Authority(ca)
-
-	mockBundleCache := &mockTrustBundleCache{
-		currentBundle: &workloadidentity.BundleSet{
-			Local: bundle,
-			Federated: map[string]*spiffebundle.Bundle{
-				"federated.example.com": federatedBundle,
-			},
-		},
-	}
-	botConfig := &config.BotConfig{
-		CredentialLifetime: config.CredentialLifetime{
-			RenewalInterval: time.Minute,
-		},
-	}
-
-	tests := []struct {
-		name string
-
-		svids         []config.SVIDRequestWithRules
-		resourceNames []string
-
-		wantErr string
-	}{
-		{
-			name:          "all",
-			resourceNames: []string{},
-		},
-		{
-			name: "specific svid",
-			resourceNames: []string{
-				"spiffe://example.com/second",
-			},
-		},
-		{
-			name: "specific ca",
-			resourceNames: []string{
-				"spiffe://example.com",
-			},
-		},
-		{
-			name: "specific ca federated",
-			resourceNames: []string{
-				"spiffe://federated.example.com",
-			},
-		},
-		{
-			name: "special default",
-			resourceNames: []string{
-				envoyDefaultSVIDName,
-			},
-		},
-		{
-			name: "special ROOTCA",
-			resourceNames: []string{
-				envoyDefaultBundleName,
-			},
-		},
-		{
-			name: "special ALL",
-			resourceNames: []string{
-				envoyAllBundlesName,
-			},
-		},
-		{
-			name:          "no results",
-			resourceNames: []string{"spiffe://example.com/not-matching"},
-			wantErr:       "unknown resource names: [spiffe://example.com/not-matching]",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sds := &spiffeSDSHandler{
-				log:    log,
-				botCfg: botConfig,
-
-				trustBundleCache:    mockBundleCache,
-				clientAuthenticator: clientAuthenticator,
-			}
-
-			req := &discoveryv3pb.DiscoveryRequest{
-				TypeUrl:       "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
-				ResourceNames: tt.resourceNames,
-			}
-
-			res, err := sds.FetchSecrets(ctx, req)
-			if tt.wantErr != "" {
-				require.ErrorContains(t, err, tt.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			if golden.ShouldSet() {
-				resBytes, err := protojson.MarshalOptions{
-					Multiline: true,
-				}.Marshal(res)
-				require.NoError(t, err)
-				golden.Set(t, resBytes)
-			}
-
-			want := &discoveryv3pb.DiscoveryResponse{}
-			require.NoError(t, protojson.UnmarshalOptions{}.Unmarshal(golden.Get(t), want))
-			require.Empty(t, cmp.Diff(res, want, protocmp.Transform()))
-		})
-	}
-}
-
-// Test_E2E_SPIFFE_SDS is an end-to-end test of Workload ID's ability
-// to issue a SPIFFE SVID to a workload connecting via the SDS API
-func Test_E2E_SPIFFE_SDS(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping test in short mode")
-	}
-	t.Parallel()
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	// Make a new auth server.
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	// Create a role that allows the bot to issue a SPIFFE SVID.
-	role, err := types.NewRole("spiffe-issuer", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			SPIFFE: []*types.SPIFFERoleCondition{
-				{
-					Path: "/*",
-					DNSSANs: []string{
-						"*",
-					},
-					IPSANs: []string{
-						"0.0.0.0/0",
-					},
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	pid := os.Getpid()
-
-	tempDir := t.TempDir()
-	socketPath := "unix://" + path.Join(tempDir, "sock")
-	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
-	botConfig := defaultBotConfig(
-		t, process, onboarding, config.ServiceConfigs{
-			&config.SPIFFEWorkloadAPIService{
-				Listen: socketPath,
-				SVIDs: []config.SVIDRequestWithRules{
-					// Intentionally unmatching PID to ensure this SVID
-					// is not issued.
-					{
-						SVIDRequest: config.SVIDRequest{
-							Path: "/bar",
-						},
-						Rules: []config.SVIDRequestRule{
-							{
-								Unix: config.SVIDRequestRuleUnix{
-									PID: ptr(0),
-								},
-							},
-						},
-					},
-					// SVID with rule that matches on PID.
-					{
-						SVIDRequest: config.SVIDRequest{
-							Path: "/foo",
-							Hint: "hint",
-							SANS: config.SVIDRequestSANs{
-								DNS: []string{"example.com"},
-								IP:  []string{"10.0.0.1"},
-							},
-						},
-						Rules: []config.SVIDRequestRule{
-							{
-								Unix: config.SVIDRequestRuleUnix{
-									PID: &pid,
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		},
-	)
-	botConfig.Oneshot = false
-	b := New(botConfig, log)
-
-	// Run bot in the background for the remainder of the test.
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
-		Name: "bot",
-		Task: b.Run,
-	})
-
-	// Wait for the socket to come up.
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := os.Stat(filepath.Join(tempDir, "sock"))
-		assert.NoError(t, err)
-	}, 10*time.Second, 100*time.Millisecond)
-
-	conn, err := grpc.NewClient(
-		socketPath,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-	)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		conn.Close()
-	})
-
-	client := secretv3pb.NewSecretDiscoveryServiceClient(conn)
-	stream, err := client.StreamSecrets(ctx)
-	require.NoError(t, err)
-
-	// Request all secrets.
-	typeUrl := "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
-	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
-		TypeUrl:       typeUrl,
-		ResourceNames: []string{},
-	})
-	require.NoError(t, err)
-
-	resp, err := stream.Recv()
-	require.NoError(t, err)
-	assert.NotEmpty(t, resp.VersionInfo)
-	assert.NotEmpty(t, resp.Nonce)
-	assert.Equal(t, typeUrl, resp.TypeUrl)
-	// We should expect to find two resources within the response
-	assert.Len(t, resp.Resources, 2)
-	// There's no specific order we should expect, so we'll need to assert that
-	// each actually exists
-
-	// First check we got our certificate...
-	checkSVID := func(secret *tlsv3pb.Secret) {
-		tlsCert := secret.GetTlsCertificate()
-		require.NotNil(t, tlsCert)
-		require.NotNil(t, tlsCert.CertificateChain)
-		tlsCertBytes := tlsCert.CertificateChain.GetInlineBytes()
-		require.NotEmpty(t, tlsCertBytes)
-		require.NotNil(t, tlsCert.PrivateKey)
-		privateKeyBytes := tlsCert.PrivateKey.GetInlineBytes()
-		require.NotEmpty(t, privateKeyBytes)
-		goTLSCert, err := tls.X509KeyPair(tlsCertBytes, privateKeyBytes)
-		require.NoError(t, err)
-		// Sanity check we generated an ECDSA key (testenv cluster uses
-		// balanced-v1 algorithm suite)
-		require.IsType(t, &ecdsa.PrivateKey{}, goTLSCert.PrivateKey)
-	}
-	checkSVID(findSecret(t, resp.Resources, "spiffe://root/foo"))
-
-	// Now check we got the CA
-	caSecret := findSecret(t, resp.Resources, "spiffe://root")
-	validationContext := caSecret.GetValidationContext()
-	require.NotNil(t, validationContext.CustomValidatorConfig)
-	require.Equal(t, envoySPIFFECertValidator, validationContext.CustomValidatorConfig.Name)
-	spiffeValidatorConfig := &tlsv3pb.SPIFFECertValidatorConfig{}
-	require.NoError(t, validationContext.CustomValidatorConfig.TypedConfig.UnmarshalTo(spiffeValidatorConfig))
-	require.Len(t, spiffeValidatorConfig.TrustDomains, 1)
-	require.Equal(t, "root", spiffeValidatorConfig.TrustDomains[0].Name)
-	block, _ := pem.Decode(spiffeValidatorConfig.TrustDomains[0].TrustBundle.GetInlineBytes())
-	require.Equal(t, "CERTIFICATE", block.Type)
-	x509Cert, err := x509.ParseCertificate(block.Bytes)
-	require.NoError(t, err)
-	// Sanity check we generated an ECDSA key (testenv cluster uses balanced-v1
-	// algorithm suite)
-	require.IsType(t, &ecdsa.PublicKey{}, x509Cert.PublicKey)
-
-	// We should send the response ACK we expect envoy to send.
-	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
-		TypeUrl:       typeUrl,
-		VersionInfo:   resp.VersionInfo,
-		ResponseNonce: resp.Nonce,
-		ResourceNames: []string{},
-	})
-	require.NoError(t, err)
-
-	// Try specifying a specific resource
-	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
-		TypeUrl: typeUrl,
-		ResourceNames: []string{
-			"spiffe://root/foo",
-		},
-		VersionInfo:   resp.VersionInfo,
-		ResponseNonce: resp.Nonce,
-	})
-	require.NoError(t, err)
-
-	resp, err = stream.Recv()
-	require.NoError(t, err)
-	assert.NotEmpty(t, resp.VersionInfo)
-	assert.NotEmpty(t, resp.Nonce)
-	assert.Len(t, resp.Resources, 1)
-	checkSVID(findSecret(t, resp.Resources, "spiffe://root/foo"))
-}
-
-func findSecret(t *testing.T, resources []*anypb.Any, name string) *tlsv3pb.Secret {
-	for _, a := range resources {
-		secret := &tlsv3pb.Secret{}
-		require.NoError(t, a.UnmarshalTo(secret))
-		if secret.Name == name {
-			return secret
-		}
-	}
-	return nil
-}
diff --git a/lib/tbot/service_spiffe_workload_api_test.go b/lib/tbot/service_spiffe_workload_api_test.go
deleted file mode 100644
index 4facf252fd4eb..0000000000000
--- a/lib/tbot/service_spiffe_workload_api_test.go
+++ /dev/null
@@ -1,628 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"net"
-	"os"
-	"path"
-	"sync"
-	"testing"
-	"time"
-
-	gocmp "github.com/google/go-cmp/cmp"
-	"github.com/spiffe/go-spiffe/v2/spiffeid"
-	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
-	"github.com/spiffe/go-spiffe/v2/workloadapi"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func ptr[T any](v T) *T {
-	return &v
-}
-
-func TestSPIFFEWorkloadAPIService_filterSVIDRequests(t *testing.T) {
-	// This test is more for overall behavior. Use the _field test for
-	// each individual field.
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-	tests := []struct {
-		name string
-		att  *workloadidentityv1pb.WorkloadAttrs
-		in   []config.SVIDRequestWithRules
-		want []config.SVIDRequest
-	}{
-		{
-			name: "no rules",
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/bar",
-					},
-				},
-			},
-			want: []config.SVIDRequest{
-				{
-					Path: "/foo",
-				},
-				{
-					Path: "/bar",
-				},
-			},
-		},
-		{
-			name: "no rules with attestation",
-			att: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Uid:      1000,
-					Gid:      1001,
-					Pid:      1002,
-				},
-			},
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/bar",
-					},
-				},
-			},
-			want: []config.SVIDRequest{
-				{
-					Path: "/foo",
-				},
-				{
-					Path: "/bar",
-				},
-			},
-		},
-		{
-			name: "no rules with attestation",
-			att: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					// We don't expect that workloadattest will ever return
-					// Attested: false and include UID/PID/GID but we want to
-					// ensure we handle this by failing regardless.
-					Attested: false,
-					Uid:      1000,
-					Gid:      1001,
-					Pid:      1002,
-				},
-			},
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1000),
-							},
-						},
-					},
-				},
-			},
-			want: nil,
-		},
-		{
-			name: "no matching rules with attestation",
-			att: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Uid:      1000,
-					Gid:      1001,
-					Pid:      1002,
-				},
-			},
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1000),
-								PID: ptr(1),
-							},
-						},
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								GID: ptr(1),
-							},
-						},
-					},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/bar",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1),
-							},
-						},
-					},
-				},
-			},
-			want: nil,
-		},
-		{
-			name: "no matching rules without attestation",
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								PID: ptr(1),
-							},
-						},
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								GID: ptr(1),
-							},
-						},
-					},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/bar",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1),
-							},
-						},
-					},
-				},
-			},
-			want: nil,
-		},
-		{
-			name: "some matching rules with uds",
-			att: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Uid:      1000,
-					Gid:      1001,
-					Pid:      1002,
-				},
-			},
-			in: []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/fizz",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1),
-							},
-						},
-					},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-					Rules: []config.SVIDRequestRule{},
-				},
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/bar",
-					},
-					Rules: []config.SVIDRequestRule{
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1000),
-								GID: ptr(1500),
-							},
-						},
-						{
-							Unix: config.SVIDRequestRuleUnix{
-								UID: ptr(1000),
-								PID: ptr(1002),
-							},
-						},
-					},
-				},
-			},
-			want: []config.SVIDRequest{
-				{
-					Path: "/foo",
-				},
-				{
-					Path: "/bar",
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := filterSVIDRequests(ctx, log, tt.in, attrs.FromWorkloadAttrs(tt.att))
-			assert.Empty(t, gocmp.Diff(tt.want, got))
-		})
-	}
-}
-
-func TestSPIFFEWorkloadAPIService_filterSVIDRequests_field(t *testing.T) {
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-	tests := []struct {
-		field       string
-		matching    *workloadidentityv1pb.WorkloadAttrs
-		nonMatching *workloadidentityv1pb.WorkloadAttrs
-		rule        config.SVIDRequestRule
-	}{
-		{
-			field: "unix.pid",
-			rule: config.SVIDRequestRule{
-				Unix: config.SVIDRequestRuleUnix{
-					PID: ptr(1000),
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Pid:      1000,
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Pid:      200,
-				},
-			},
-		},
-		{
-			field: "unix.uid",
-			rule: config.SVIDRequestRule{
-				Unix: config.SVIDRequestRuleUnix{
-					UID: ptr(1000),
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Uid:      1000,
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Uid:      200,
-				},
-			},
-		},
-		{
-			field: "unix.gid",
-			rule: config.SVIDRequestRule{
-				Unix: config.SVIDRequestRuleUnix{
-					GID: ptr(1000),
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Gid:      1000,
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
-					Attested: true,
-					Gid:      200,
-				},
-			},
-		},
-		{
-			field: "unix.namespace",
-			rule: config.SVIDRequestRule{
-				Kubernetes: config.SVIDRequestRuleKubernetes{
-					Namespace: "foo",
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested:  true,
-					Namespace: "foo",
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested:  true,
-					Namespace: "bar",
-				},
-			},
-		},
-		{
-			field: "kubernetes.service_account",
-			rule: config.SVIDRequestRule{
-				Kubernetes: config.SVIDRequestRuleKubernetes{
-					ServiceAccount: "foo",
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested:       true,
-					ServiceAccount: "foo",
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested:       true,
-					ServiceAccount: "bar",
-				},
-			},
-		},
-		{
-			field: "kubernetes.pod_name",
-			rule: config.SVIDRequestRule{
-				Kubernetes: config.SVIDRequestRuleKubernetes{
-					PodName: "foo",
-				},
-			},
-			matching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested: true,
-					PodName:  "foo",
-				},
-			},
-			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
-				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
-					Attested: true,
-					PodName:  "bar",
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.field, func(t *testing.T) {
-			rules := []config.SVIDRequestWithRules{
-				{
-					SVIDRequest: config.SVIDRequest{
-						Path: "/foo",
-					},
-					Rules: []config.SVIDRequestRule{tt.rule},
-				},
-			}
-			t.Run("matching", func(t *testing.T) {
-				assert.Len(t, filterSVIDRequests(ctx, log, rules, attrs.FromWorkloadAttrs(tt.matching)), 1)
-			})
-			t.Run("non-matching", func(t *testing.T) {
-				assert.Empty(t, filterSVIDRequests(ctx, log, rules, attrs.FromWorkloadAttrs(tt.nonMatching)))
-			})
-		})
-	}
-}
-
-// TestBotSPIFFEWorkloadAPI is an end-to-end test of Workload ID's ability to
-// issue a SPIFFE SVID to a workload connecting via the SPIFFE Workload API.
-func TestBotSPIFFEWorkloadAPI(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	// Make a new auth server.
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	// Create a role that allows the bot to issue a SPIFFE SVID.
-	role, err := types.NewRole("spiffe-issuer", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			SPIFFE: []*types.SPIFFERoleCondition{
-				{
-					Path: "/*",
-					DNSSANs: []string{
-						"*",
-					},
-					IPSANs: []string{
-						"0.0.0.0/0",
-					},
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	pid := os.Getpid()
-
-	tempDir := t.TempDir()
-	socketPath := "unix://" + path.Join(tempDir, "spiffe.sock")
-	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
-	botConfig := defaultBotConfig(
-		t, process, onboarding, config.ServiceConfigs{
-			&config.SPIFFEWorkloadAPIService{
-				Listen: socketPath,
-				SVIDs: []config.SVIDRequestWithRules{
-					// Intentionally unmatching PID to ensure this SVID
-					// is not issued.
-					{
-						SVIDRequest: config.SVIDRequest{
-							Path: "/bar",
-						},
-						Rules: []config.SVIDRequestRule{
-							{
-								Unix: config.SVIDRequestRuleUnix{
-									PID: ptr(0),
-								},
-							},
-						},
-					},
-					// SVID with rule that matches on PID.
-					{
-						SVIDRequest: config.SVIDRequest{
-							Path: "/foo",
-							Hint: "hint",
-							SANS: config.SVIDRequestSANs{
-								DNS: []string{"example.com"},
-								IP:  []string{"10.0.0.1"},
-							},
-						},
-						Rules: []config.SVIDRequestRule{
-							{
-								Unix: config.SVIDRequestRuleUnix{
-									PID: &pid,
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		},
-	)
-	botConfig.Oneshot = false
-	b := New(botConfig, log)
-
-	// Spin up goroutine for bot to run in
-	botCtx, cancelBot := context.WithCancel(ctx)
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := b.Run(botCtx)
-		assert.NoError(t, err, "bot should not exit with error")
-		cancelBot()
-	}()
-	t.Cleanup(func() {
-		// Shut down bot and make sure it exits.
-		cancelBot()
-		wg.Wait()
-	})
-
-	t.Run("X509", func(t *testing.T) {
-		t.Parallel()
-
-		// This has a little flexibility internally in terms of waiting for the
-		// socket to come up, so we don't need a manual sleep/retry here.
-		source, err := workloadapi.NewX509Source(
-			ctx,
-			workloadapi.WithClientOptions(workloadapi.WithAddr(socketPath)),
-		)
-		require.NoError(t, err)
-		defer source.Close()
-
-		svid, err := source.GetX509SVID()
-		require.NoError(t, err)
-
-		// SVID has successfully been issued. We can now assert that it's correct.
-		require.Equal(t, "spiffe://root/foo", svid.ID.String())
-		cert := svid.Certificates[0]
-		require.Equal(t, "spiffe://root/foo", cert.URIs[0].String())
-		require.True(t, net.IPv4(10, 0, 0, 1).Equal(cert.IPAddresses[0]))
-		require.Equal(t, []string{"example.com"}, cert.DNSNames)
-		require.WithinRange(
-			t,
-			cert.NotAfter,
-			cert.NotBefore.Add(time.Hour-time.Minute),
-			cert.NotBefore.Add(time.Hour+time.Minute),
-		)
-	})
-
-	t.Run("JWT", func(t *testing.T) {
-		t.Parallel()
-
-		source, err := workloadapi.NewJWTSource(
-			ctx,
-			workloadapi.WithClientOptions(workloadapi.WithAddr(socketPath)),
-		)
-		require.NoError(t, err)
-		defer source.Close()
-
-		validateSVID := func(
-			t *testing.T,
-			svid *jwtsvid.SVID,
-			wantAudience string,
-		) {
-			t.Helper()
-			// First, check the response fields
-			require.Equal(t, "spiffe://root/foo", svid.ID.String())
-			require.Equal(t, "hint", svid.Hint)
-
-			// Validate "locally" that the SVID is correct.
-			validatedSVID, err := jwtsvid.ParseAndValidate(
-				svid.Marshal(),
-				source,
-				[]string{wantAudience},
-			)
-			require.NoError(t, err)
-			require.Equal(t, svid.Claims, validatedSVID.Claims)
-			require.Equal(t, svid.ID, validatedSVID.ID)
-
-			// Validate "remotely" that the SVID is correct using the Workload
-			// API.
-			validatedSVID, err = workloadapi.ValidateJWTSVID(
-				ctx,
-				svid.Marshal(),
-				wantAudience,
-				workloadapi.WithAddr(socketPath),
-			)
-			require.NoError(t, err)
-			require.Equal(t, svid.Claims, validatedSVID.Claims)
-			require.Equal(t, svid.ID, validatedSVID.ID)
-		}
-
-		svids, err := source.FetchJWTSVIDs(ctx, jwtsvid.Params{
-			Audience:       "example.com",
-			ExtraAudiences: []string{"2.example.com"},
-			Subject:        spiffeid.RequireFromString("spiffe://root/foo"),
-		})
-		require.NoError(t, err)
-		require.Len(t, svids, 1)
-		validateSVID(t, svids[0], "2.example.com")
-
-		// Try again with no specified subject (e.g receive all)
-		svids, err = source.FetchJWTSVIDs(ctx, jwtsvid.Params{
-			Audience: "example.com",
-		})
-		require.NoError(t, err)
-		require.Len(t, svids, 1)
-		validateSVID(t, svids[0], "example.com")
-	})
-}
diff --git a/lib/tbot/service_ssh_host_output.go b/lib/tbot/service_ssh_host_output.go
deleted file mode 100644
index f0dfcfc023241..0000000000000
--- a/lib/tbot/service_ssh_host_output.go
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"fmt"
-	"log/slog"
-	"strings"
-
-	"github.com/gravitational/trace"
-	"google.golang.org/protobuf/types/known/durationpb"
-
-	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/client/identityfile"
-	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-)
-
-type SSHHostOutputService struct {
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.SSHHostOutput
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-}
-
-func (s *SSHHostOutputService) String() string {
-	return fmt.Sprintf("ssh-host (%s)", s.cfg.Destination.String())
-}
-
-func (s *SSHHostOutputService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-func (s *SSHHostOutputService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *SSHHostOutputService) generate(ctx context.Context) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"SSHHostOutputService/generate",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Generating output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	var err error
-	roles := s.cfg.Roles
-	if len(roles) == 0 {
-		roles, err = fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-		if err != nil {
-			return trace.Wrap(err, "fetching default roles")
-		}
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		effectiveLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating identity")
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-	clusterName := facade.Get().ClusterName
-
-	// generate a keypair
-	key, err := cryptosuites.GenerateKey(ctx,
-		cryptosuites.GetCurrentSuiteFromAuthPreference(s.botAuthClient),
-		cryptosuites.HostSSH)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	privKey, err := keys.NewPrivateKey(key)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// For now, we'll reuse the bot's regular TTL, and hostID and nodeName are
-	// left unset.
-	res, err := impersonatedClient.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
-		Key:         privKey.MarshalSSHPublicKey(),
-		HostId:      "",
-		NodeName:    "",
-		Principals:  s.cfg.Principals,
-		ClusterName: clusterName,
-		Role:        string(types.RoleNode),
-		Ttl:         durationpb.New(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL),
-	},
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	keyRing := &client.KeyRing{
-		SSHPrivateKey: privKey,
-		Cert:          res.SshCertificate,
-	}
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: config.SSHHostCertPath,
-		Writer:     newBotConfigWriter(ctx, s.cfg.Destination, ""),
-		KeyRing:    keyRing,
-		Format:     identityfile.FormatOpenSSH,
-
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	exportedCAs, err := exportSSHUserCAs(userCAs, clusterName)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	userCAPath := config.SSHHostCertPath + config.SSHHostUserCASuffix
-	if err := s.cfg.Destination.Write(ctx, userCAPath, []byte(exportedCAs)); err != nil {
-		return trace.Wrap(err)
-	}
-
-	files = append(files, userCAPath)
-
-	s.log.DebugContext(
-		ctx,
-		"Wrote OpenSSH host cert files",
-		"files", files,
-	)
-
-	return nil
-}
-
-const (
-	// sshHostTrimPrefix is the prefix that should be removed from the generated
-	// SSH CA.
-	sshHostTrimPrefix = "cert-authority "
-)
-
-// exportSSHUserCAs generates SSH CAs.
-func exportSSHUserCAs(cas []types.CertAuthority, localAuthName string) (string, error) {
-	var exported string
-
-	for _, ca := range cas {
-		// Don't export trusted CAs.
-		if ca.GetClusterName() != localAuthName {
-			continue
-		}
-
-		for _, key := range ca.GetTrustedSSHKeyPairs() {
-			s, err := sshutils.MarshalAuthorizedKeysFormat(ca.GetClusterName(), key.PublicKey)
-			if err != nil {
-				return "", trace.Wrap(err)
-			}
-
-			// remove "cert-authority "
-			s = strings.TrimPrefix(s, sshHostTrimPrefix)
-
-			exported += s
-		}
-	}
-
-	return exported, nil
-}
diff --git a/lib/tbot/service_ssh_multiplexer.go b/lib/tbot/service_ssh_multiplexer.go
deleted file mode 100644
index 8de5e76467ead..0000000000000
--- a/lib/tbot/service_ssh_multiplexer.go
+++ /dev/null
@@ -1,876 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"bufio"
-	"bytes"
-	"cmp"
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/prometheus/client_golang/prometheus"
-	oteltrace "go.opentelemetry.io/otel/trace"
-	"golang.org/x/crypto/ssh/agent"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/grpc"
-
-	proxyclient "github.com/gravitational/teleport/api/client/proxy"
-	"github.com/gravitational/teleport/api/observability/tracing"
-	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
-	libclient "github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/config/openssh"
-	"github.com/gravitational/teleport/lib/observability/metrics"
-	"github.com/gravitational/teleport/lib/resumption"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/ssh"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/uds"
-)
-
-const (
-	sshMuxSocketName = "v1.sock"
-	agentSocketName  = "agent.sock"
-)
-
-var (
-	muxReqsStartedCounter = prometheus.NewCounter(
-		prometheus.CounterOpts{
-			Name: "tbot_ssh_multiplexer_requests_started_total",
-			Help: "Number of requests completed by the multiplexer",
-		},
-	)
-	muxReqsHandledCounter = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "tbot_ssh_multiplexer_requests_handled_total",
-			Help: "Number of requests completed by the multiplexer",
-		}, []string{"status"},
-	)
-	muxReqsInflightGauge = prometheus.NewGauge(
-		prometheus.GaugeOpts{
-			Name: "tbot_ssh_multiplexer_requests_in_flight",
-			Help: "Number of SSH connections currently being handled by the multiplexer",
-		},
-	)
-)
-
-// SSHMultiplexerService is a long-lived local SSH proxy. It listens on a local Unix
-// socket and has a special client with support for FDPassing with OpenSSH.
-// It places an emphasis on high performance.
-type SSHMultiplexerService struct {
-	alpnUpgradeCache *alpnProxyConnUpgradeRequiredCache
-	// botAuthClient should be an auth client using the bots internal identity.
-	// This will not have any roles impersonated and should only be used to
-	// fetch CAs.
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.SSHMultiplexerService
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	proxyPingCache    *proxyPingCache
-	reloadBroadcaster *channelBroadcaster
-	resolver          reversetunnelclient.Resolver
-
-	// Fields below here are initialized by the service itself on startup.
-	identity *identity.Facade
-
-	agentMu sync.Mutex
-	agent   agent.ExtendedAgent
-}
-
-// writeIfChanged reads the artifact first to determine if it has changed
-// before writing to it. This avoids truncating the file during another
-// processes read.
-//
-// TODO(noah): Replace this with proper atomic writing.
-// https://github.com/gravitational/teleport/issues/25462
-func writeIfChanged(ctx context.Context, dest bot.Destination, log *slog.Logger, path string, data []byte) error {
-	existingData, err := dest.Read(ctx, path)
-	if err != nil {
-		log.DebugContext(
-			ctx,
-			"Error occurred reading artifact for change-check, will write",
-			"path", path,
-			"error", err,
-		)
-		return dest.Write(ctx, path, data)
-	}
-
-	if bytes.Equal(existingData, data) {
-		log.DebugContext(
-			ctx,
-			"Artifact unchanged, not writing",
-			"path", path,
-		)
-		return nil
-	}
-	log.DebugContext(
-		ctx,
-		"Artifact changed, will write",
-		"path", path,
-	)
-
-	return dest.Write(ctx, path, data)
-}
-
-func (s *SSHMultiplexerService) writeArtifacts(
-	ctx context.Context,
-	proxyHost string,
-	authClient *authclient.Client,
-) error {
-	dest := s.cfg.Destination.(*config.DestinationDirectory)
-
-	clusterNames, err := getClusterNames(ctx, authClient, s.identity.Get().ClusterName)
-	if err != nil {
-		return trace.Wrap(err, "fetching cluster names")
-	}
-
-	// Generate known hosts
-	knownHosts, _, err := ssh.GenerateKnownHosts(
-		ctx,
-		s.botAuthClient,
-		clusterNames,
-		proxyHost,
-	)
-	if err != nil {
-		return trace.Wrap(err, "generating known hosts")
-	}
-	if err := writeIfChanged(
-		ctx, dest, s.log, ssh.KnownHostsName, []byte(knownHosts),
-	); err != nil {
-		return trace.Wrap(err, "writing %s", ssh.KnownHostsName)
-	}
-
-	// Generate SSH config
-	proxyCommand := s.cfg.ProxyCommand
-	if len(proxyCommand) == 0 {
-		executablePath, err := autoupdate.StableExecutable()
-		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
-			s.log.WarnContext(ctx, "SSH multiplexer proxy command will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
-		} else if err != nil {
-			return trace.Wrap(err, "determining executable path")
-		}
-		proxyCommand = []string{
-			executablePath,
-			"ssh-multiplexer-proxy-command",
-		}
-	}
-
-	absPath, err := filepath.Abs(dest.Path)
-	if err != nil {
-		return trace.Wrap(err, "determining absolute path for destination")
-	}
-
-	var sshConfigBuilder strings.Builder
-	err = openssh.WriteMuxedSSHConfig(&sshConfigBuilder, &openssh.MuxedSSHConfigParameters{
-		AppName:         openssh.TbotApp,
-		ClusterNames:    clusterNames,
-		KnownHostsPath:  filepath.Join(absPath, ssh.KnownHostsName),
-		ProxyCommand:    proxyCommand,
-		MuxSocketPath:   filepath.Join(absPath, sshMuxSocketName),
-		AgentSocketPath: filepath.Join(absPath, agentSocketName),
-	})
-	if err != nil {
-		return trace.Wrap(err, "generating SSH config")
-	}
-	sshConfBytes := []byte(sshConfigBuilder.String())
-	if err := writeIfChanged(
-		ctx, dest, s.log, ssh.ConfigName, sshConfBytes,
-	); err != nil {
-		return trace.Wrap(err, "writing %s", ssh.ConfigName)
-	}
-
-	return nil
-}
-
-func (s *SSHMultiplexerService) setup(ctx context.Context) (
-	_ *authclient.Client,
-	_ *cyclingHostDialClient,
-	proxyHost string,
-	_ *libclient.TSHConfig,
-	_ error,
-) {
-	// Register service metrics. Expected to always work.
-	if err := metrics.RegisterPrometheusCollectors(
-		muxReqsStartedCounter,
-		muxReqsHandledCounter,
-		muxReqsInflightGauge,
-	); err != nil {
-		return nil, nil, "", nil, trace.Wrap(err)
-	}
-
-	if err := s.cfg.Destination.Init(ctx, []string{}); err != nil {
-		return nil, nil, "", nil, trace.Wrap(err, "initializing destination")
-	}
-
-	// Load in any proxy templates if a path to them has been provided.
-	tshConfig := &libclient.TSHConfig{}
-	if s.cfg.ProxyTemplatesPath != "" {
-		s.log.InfoContext(ctx, "Loading proxy templates", "path", s.cfg.ProxyTemplatesPath)
-		var err error
-		tshConfig, err = libclient.LoadTSHConfig(s.cfg.ProxyTemplatesPath)
-		if err != nil {
-			return nil, nil, "", nil, trace.Wrap(err, "loading proxy templates")
-		}
-		for _, t := range tshConfig.ProxyTemplates {
-			s.log.DebugContext(
-				ctx,
-				"Loaded proxy template",
-				"template", t.Template,
-				"proxy", t.Proxy,
-				"host", t.Host,
-				"cluster", t.Cluster,
-				"query", t.Query,
-				"search", t.Search,
-			)
-		}
-	}
-
-	// Generate our initial identity and write the artifacts to the destination.
-	id, err := s.generateIdentity(ctx)
-	if err != nil {
-		return nil, nil, "", nil, trace.Wrap(err, "generating initial identity")
-	}
-	s.identity = identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-
-	sshConfig, err := s.identity.SSHClientConfig()
-	if err != nil {
-		return nil, nil, "", nil, trace.Wrap(err)
-	}
-
-	// Ping the proxy and determine if we need to upgrade the connection.
-	proxyPing, err := s.proxyPingCache.ping(ctx)
-	if err != nil {
-		return nil, nil, "", nil, trace.Wrap(err)
-	}
-	proxyAddr, err := proxyPing.proxySSHAddr()
-	if err != nil {
-		return nil, nil, "", nil, trace.Wrap(err, "determining proxy ssh addr")
-	}
-	proxyHost, _, err = utils.SplitHostPort(proxyAddr)
-	if err != nil {
-		return nil, nil, "", nil, trace.BadParameter(
-			"proxy %+v has no usable public address: %v",
-			proxyAddr, err,
-		)
-	}
-
-	connUpgradeRequired := false
-	if proxyPing.Proxy.TLSRoutingEnabled {
-		connUpgradeRequired, err = s.alpnUpgradeCache.isUpgradeRequired(
-			ctx, proxyAddr, s.botCfg.Insecure,
-		)
-		if err != nil {
-			return nil, nil, "", nil, trace.Wrap(err, "determining if ALPN upgrade is required")
-		}
-	}
-
-	// Create Proxy and Auth clients
-	proxyClient := newCyclingHostDialClient(100, proxyclient.ClientConfig{
-		ProxyAddress:      proxyAddr,
-		TLSRoutingEnabled: proxyPing.Proxy.TLSRoutingEnabled,
-		TLSConfigFunc: func(cluster string) (*tls.Config, error) {
-			cfg, err := s.identity.TLSConfig()
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			// The facade TLS config is tailored toward connections to the Auth service.
-			// Override the server name to be the proxy and blank out the next protos to
-			// avoid hitting the proxy web listener.
-			cfg.ServerName = proxyHost
-			cfg.NextProtos = nil
-			return cfg, nil
-		},
-		UnaryInterceptors: []grpc.UnaryClientInterceptor{
-			clientMetrics.UnaryClientInterceptor(),
-			interceptors.GRPCClientUnaryErrorInterceptor,
-		},
-		StreamInterceptors: []grpc.StreamClientInterceptor{
-			clientMetrics.StreamClientInterceptor(),
-			interceptors.GRPCClientStreamErrorInterceptor,
-		},
-		SSHConfig:               sshConfig,
-		InsecureSkipVerify:      s.botCfg.Insecure,
-		ALPNConnUpgradeRequired: connUpgradeRequired,
-	})
-
-	authClient, err := clientForFacade(
-		ctx, s.log, s.botCfg, s.identity, s.resolver,
-	)
-	if err != nil {
-		return nil, nil, "", nil, trace.Wrap(err)
-	}
-
-	return authClient, proxyClient, proxyHost, tshConfig, nil
-}
-
-// generateIdentity generates our impersonated identity which we will write to
-// the destination.
-func (s *SSHMultiplexerService) generateIdentity(ctx context.Context) (*identity.Identity, error) {
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return nil, trace.Wrap(err, "fetching default roles")
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err, "generating identity")
-	}
-
-	newAgent := agent.NewKeyring()
-	err = newAgent.Add(agent.AddedKey{
-		PrivateKey:   id.PrivateKey,
-		Certificate:  id.SSHCert,
-		LifetimeSecs: 0,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "adding identity to agent")
-	}
-	// There's a bug with Paramiko and older versions of OpenSSH that requires
-	// that the bare key also be included in the agent or the key with the
-	// certificate will not be used.
-	// See the following: https://bugzilla.mindrot.org/show_bug.cgi?id=2550
-	err = newAgent.Add(agent.AddedKey{
-		PrivateKey:   id.PrivateKey,
-		Certificate:  nil,
-		LifetimeSecs: 0,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err, "adding bare key to agent")
-	}
-
-	s.agentMu.Lock()
-	s.agent = newAgent.(agent.ExtendedAgent)
-	s.agentMu.Unlock()
-
-	return id, nil
-}
-
-func (s *SSHMultiplexerService) identityRenewalLoop(
-	ctx context.Context, proxyHost string, authClient *authclient.Client,
-) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service: s.String(),
-		name:    "identity-renewal",
-		f: func(ctx context.Context) error {
-			id, err := s.generateIdentity(ctx)
-			if err != nil {
-				return trace.Wrap(err, "generating identity")
-			}
-			s.identity.Set(id)
-			return s.writeArtifacts(ctx, proxyHost, authClient)
-		},
-		interval:   cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *SSHMultiplexerService) Run(ctx context.Context) (err error) {
-	ctx, span := tracer.Start(
-		ctx,
-		"SSHMultiplexerService/Run",
-	)
-	defer func() { tracing.EndSpan(span, err) }()
-
-	authClient, hostDialer, proxyHost, tshConfig, err := s.setup(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer authClient.Close()
-
-	dest := s.cfg.Destination.(*config.DestinationDirectory)
-	absPath, err := filepath.Abs(dest.Path)
-	if err != nil {
-		return trace.Wrap(err, "determining absolute path for destination")
-	}
-	muxListenerAddr := url.URL{Scheme: "unix", Path: filepath.Join(absPath, sshMuxSocketName)}
-	muxListener, err := createListener(
-		ctx,
-		s.log,
-		muxListenerAddr.String(),
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer muxListener.Close()
-
-	agentListenerAddr := url.URL{Scheme: "unix", Path: filepath.Join(absPath, agentSocketName)}
-	agentListener, err := createListener(
-		ctx,
-		s.log,
-		agentListenerAddr.String(),
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer agentListener.Close()
-
-	eg, egCtx := errgroup.WithContext(ctx)
-	// Handle main mux listener
-	eg.Go(func() error {
-		defer context.AfterFunc(egCtx, func() { _ = muxListener.Close() })()
-		for {
-			downstream, err := muxListener.Accept()
-			if err != nil {
-				if utils.IsUseOfClosedNetworkError(err) {
-					return nil
-				}
-
-				s.log.WarnContext(
-					egCtx,
-					"Error encountered accepting mux connection, sleeping and continuing",
-					"error",
-					err,
-				)
-				select {
-				case <-egCtx.Done():
-					return nil
-				case <-time.After(50 * time.Millisecond):
-				}
-
-				continue
-			}
-
-			go func() {
-				muxReqsStartedCounter.Inc()
-				muxReqsInflightGauge.Inc()
-				defer muxReqsInflightGauge.Dec()
-
-				err := s.handleConn(
-					egCtx, tshConfig, authClient, hostDialer, proxyHost, downstream,
-				)
-
-				var status string
-				switch {
-				case err != nil && !errors.Is(err, context.Canceled):
-					status = "ERROR"
-					s.log.WarnContext(egCtx, "Mux handler exited with error", "error", err)
-				default:
-					status = "OK"
-				}
-				muxReqsHandledCounter.WithLabelValues(status).Inc()
-			}()
-		}
-	})
-	// Handle agent listener
-	eg.Go(func() error {
-		defer context.AfterFunc(egCtx, func() { _ = agentListener.Close() })()
-		for {
-			conn, err := agentListener.Accept()
-			if err != nil {
-				if utils.IsUseOfClosedNetworkError(err) {
-					return nil
-				}
-
-				s.log.WarnContext(
-					egCtx,
-					"Error encountered accepting agent connection, sleeping and continuing",
-					"error",
-					err,
-				)
-				select {
-				case <-egCtx.Done():
-					return nil
-				case <-time.After(50 * time.Millisecond):
-				}
-
-				continue
-			}
-
-			go func() {
-				defer context.AfterFunc(egCtx, func() { _ = conn.Close() })()
-				s.agentMu.Lock()
-				currentAgent := s.agent
-				s.agentMu.Unlock()
-
-				s.log.DebugContext(egCtx, "Serving agent connection")
-				//nolint:staticcheck // SA4023. ServeAgent always returns a non-nil error. This is fine.
-				err := agent.ServeAgent(currentAgent, conn)
-				if err != nil && !utils.IsOKNetworkError(err) {
-					s.log.WarnContext(
-						egCtx,
-						"Error encountered serving agent connection",
-						"error",
-						err,
-					)
-				}
-			}()
-
-		}
-	})
-	// Handle identity renewal
-	eg.Go(func() error {
-		return s.identityRenewalLoop(egCtx, proxyHost, authClient)
-	})
-
-	return eg.Wait()
-}
-
-func (s *SSHMultiplexerService) handleConn(
-	ctx context.Context,
-	tshConfig *libclient.TSHConfig,
-	authClient *authclient.Client,
-	hostDialer *cyclingHostDialClient,
-	proxyHost string,
-	downstream net.Conn,
-) (err error) {
-	ctx, span := tracer.Start(
-		ctx,
-		"SSHMultiplexerService/handleConn",
-		oteltrace.WithNewRoot(),
-	)
-	defer func() { tracing.EndSpan(span, err) }()
-	defer func() {
-		if err := downstream.Close(); err != nil && !utils.IsOKNetworkError(err) {
-			s.log.DebugContext(ctx, "Error closing downstream connection", "error", err)
-		}
-	}()
-
-	var stderr *os.File
-	defer func() {
-		if stderr == nil {
-			return
-		}
-		defer stderr.Close()
-		if err != nil {
-			fmt.Fprintln(stderr, err)
-		}
-	}()
-
-	var req string
-	// here we try receiving a file descriptor to use for error output, which
-	// should be mapped to OpenSSH's own stderr (or /dev/null)
-	if un, _ := downstream.(*net.UnixConn); un != nil {
-		b := make([]byte, 1)
-		fds := make([]*os.File, 1)
-
-		n, fdn, err := uds.ReadWithFDs(un, b, fds)
-		if err != nil {
-			return trace.Wrap(err, "reading request")
-		}
-		if fdn > 0 {
-			s.log.DebugContext(ctx, "Received stderr file descriptor from client for error reporting")
-			stderr = fds[0]
-		}
-		// this approach works because we know that req must be at least one
-		// byte at the end (as it must end with a NUL)
-		req = string(b[:n])
-	}
-
-	// The first thing downstream will send is the multiplexing request which is
-	// in the "[host]:[port]|[cluster_name]\x00" format.
-	// The "|[cluster_name]" section is optional and if omitted, the cluster
-	// associated with the bot will be used.
-	//
-	// We choose this format because | is not an acceptable character in
-	// hostnames or ports through OpenSSH.
-	// https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
-	buf := bufio.NewReader(downstream)
-	if !strings.HasSuffix(req, "\x00") {
-		r, err := buf.ReadString('\x00')
-		if err != nil {
-			return trace.Wrap(err, "reading request")
-		}
-		req += r
-	}
-	req = req[:len(req)-1] // Drop the NUL.
-
-	// Split by | to pull out the optionally specified cluster name.
-	// TODO(noah): When we need to add another parameter in future, we should
-	// roll this API to v2 and use a more extensible format.
-	splitReq := strings.Split(req, "|")
-	if len(splitReq) > 2 {
-		return trace.BadParameter(
-			"malformed request, expected at most 2 fields, got %d: %q",
-			len(splitReq), req,
-		)
-	}
-
-	host, port, err := utils.SplitHostPort(splitReq[0])
-	if err != nil {
-		return trace.Wrap(err, "malformed request %q", req)
-	}
-
-	clusterName := s.identity.Get().ClusterName
-	if len(splitReq) > 1 {
-		clusterName = splitReq[1]
-	}
-
-	log := s.log.With(
-		slog.Group("req",
-			"host", host,
-			"port", port,
-			"cluster_name", clusterName,
-		),
-	)
-	log.InfoContext(ctx, "Received multiplexing request")
-
-	expanded, matched := tshConfig.ProxyTemplates.Apply(
-		net.JoinHostPort(host, port),
-	)
-	if matched {
-		log.DebugContext(
-			ctx,
-			"Proxy templated matched",
-			"populated_template", expanded,
-		)
-		if expanded.Cluster != "" {
-			clusterName = expanded.Cluster
-		}
-
-		if expanded.Host != "" {
-			host = expanded.Host
-		}
-	}
-
-	var target string
-	if expanded == nil || (len(expanded.Search) == 0 && expanded.Query == "") {
-		host = cleanTargetHost(host, proxyHost, clusterName)
-		target = net.JoinHostPort(host, port)
-	} else {
-		node, err := resolveTargetHostWithClient(ctx, authClient.APIClient, expanded.Search, expanded.Query)
-		if err != nil {
-			return trace.Wrap(err, "resolving target host")
-		}
-
-		log.DebugContext(
-			ctx,
-			"Found matching SSH host",
-			"host_uuid", node.GetName(),
-			"host_name", node.GetHostname(),
-		)
-
-		target = net.JoinHostPort(node.GetName(), "0")
-	}
-
-	// We need the agent to support proxy recording mode.
-	s.agentMu.Lock()
-	currentAgent := s.agent
-	s.agentMu.Unlock()
-
-	upstream, _, err := hostDialer.DialHost(ctx, target, clusterName, currentAgent)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if s.cfg.SessionResumptionEnabled() {
-		log.DebugContext(ctx, "Enabling session resumption")
-		upstream, err = resumption.WrapSSHClientConn(
-			ctx,
-			upstream,
-			func(ctx context.Context, hostID string) (net.Conn, error) {
-				log.DebugContext(ctx, "Resuming connection")
-				// if the connection is being resumed, it means that
-				// we didn't need the agent in the first place as proxy
-				// recording mode does not require it.
-				var noAgent agent.ExtendedAgent
-				conn, _, err := hostDialer.DialHost(
-					ctx, net.JoinHostPort(hostID, "0"), clusterName, noAgent,
-				)
-				return conn, err
-			})
-		if err != nil {
-			return trace.Wrap(err, "wrapping conn for session resumption")
-		}
-	}
-	defer func() {
-		if err := upstream.Close(); err != nil && !utils.IsOKNetworkError(err) {
-			s.log.DebugContext(ctx, "Error closing upstream connection", "error", err)
-		}
-	}()
-
-	defer context.AfterFunc(ctx, func() {
-		if err := trace.NewAggregate(
-			upstream.Close(),
-			downstream.Close(),
-		); err != nil {
-			s.log.DebugContext(ctx, "Error closing connections", "error", err)
-		}
-	})()
-
-	log.InfoContext(ctx, "Proxying connection for multiplexing request")
-	startedProxying := time.Now()
-
-	// once the connection is actually started we should stop writing to the
-	// client's stderr
-	if stderr != nil {
-		_ = stderr.Close()
-		stderr = nil
-	}
-
-	errCh := make(chan error, 2)
-	go func() {
-		defer upstream.Close()
-		defer downstream.Close()
-		// Drain the buffer we used to read in the request in case it read in more
-		// than just the initial request.
-		drained, _ := buf.Peek(buf.Buffered())
-		if _, err := upstream.Write(drained); err != nil {
-			errCh <- trace.Wrap(err, "draining request buffer upstream")
-			return
-		}
-		_, err := io.Copy(upstream, downstream)
-		if utils.IsOKNetworkError(err) {
-			err = nil
-		}
-		errCh <- trace.Wrap(err, "downstream->upstream")
-	}()
-
-	go func() {
-		defer upstream.Close()
-		defer downstream.Close()
-		_, err := io.Copy(downstream, upstream)
-		if utils.IsOKNetworkError(err) {
-			err = nil
-		}
-		errCh <- trace.Wrap(err, "upstream->downstream")
-	}()
-
-	err = trace.NewAggregate(<-errCh, <-errCh)
-	log.InfoContext(
-		ctx,
-		"Finished proxying connection multiplexing request",
-		"proxied_duration", time.Since(startedProxying),
-	)
-	return err
-}
-
-func (s *SSHMultiplexerService) String() string {
-	return config.SSHMultiplexerServiceType
-}
-
-type hostDialer interface {
-	DialHost(ctx context.Context, target string, cluster string, keyring agent.ExtendedAgent) (net.Conn, proxyclient.ClusterDetails, error)
-	Close() error
-}
-
-// cyclingHostDialClient handles cycling through proxy clients every configured
-// number of connections. This prevents a single client being overwhelmed.
-type cyclingHostDialClient struct {
-	max          int32
-	hostDialerFn func(ctx context.Context) (hostDialer, error)
-
-	mu         sync.Mutex
-	started    int32
-	currentClt *refCountProxyClient
-}
-
-type refCountProxyClient struct {
-	clt      hostDialer
-	refCount atomic.Int32
-}
-
-func (r *refCountProxyClient) release() {
-	if r == nil {
-		return
-	}
-	if r.refCount.Add(-1) <= 0 {
-		go r.clt.Close()
-	}
-}
-
-type refCountConn struct {
-	net.Conn
-	parent atomic.Pointer[refCountProxyClient]
-}
-
-func (r *refCountConn) Close() error {
-	// Swap operation ensures that this conn only releases the ref to its
-	// underlying client once, even if Close is called multiple times.
-	defer r.parent.Swap(nil).release()
-	return trace.Wrap(r.Conn.Close())
-}
-
-func newCyclingHostDialClient(max int32, config proxyclient.ClientConfig) *cyclingHostDialClient {
-	return &cyclingHostDialClient{
-		max: max,
-		hostDialerFn: func(ctx context.Context) (hostDialer, error) {
-			return proxyclient.NewClient(ctx, config)
-		},
-	}
-}
-
-func (s *cyclingHostDialClient) DialHost(ctx context.Context, target string, cluster string, keyring agent.ExtendedAgent) (net.Conn, proxyclient.ClusterDetails, error) {
-	s.mu.Lock()
-	if s.currentClt == nil {
-		clt, err := s.hostDialerFn(ctx)
-		if err != nil {
-			s.mu.Unlock()
-			return nil, proxyclient.ClusterDetails{}, trace.Wrap(err)
-		}
-		s.currentClt = &refCountProxyClient{clt: clt}
-		// cyclingHostDialClient holds a reference while the refCountProxyClient
-		// is "live"
-		s.currentClt.refCount.Add(1)
-		s.started = 0
-	}
-
-	currentClt := s.currentClt
-	s.started++
-	if s.started >= s.max {
-		// the reference owned by cyclingHostDialClient is transferred to currentClt
-		s.currentClt = nil
-	} else {
-		currentClt.refCount.Add(1)
-	}
-	s.mu.Unlock()
-
-	innerConn, details, err := currentClt.clt.DialHost(ctx, target, cluster, keyring)
-	if err != nil {
-		currentClt.release()
-		return nil, details, trace.Wrap(err)
-	}
-
-	wrappedConn := &refCountConn{
-		Conn: innerConn,
-	}
-	wrappedConn.parent.Store(currentClt)
-	return wrappedConn, details, nil
-}
diff --git a/lib/tbot/service_ssh_multiplexer_test.go b/lib/tbot/service_ssh_multiplexer_test.go
deleted file mode 100644
index 90490e2336c08..0000000000000
--- a/lib/tbot/service_ssh_multiplexer_test.go
+++ /dev/null
@@ -1,179 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"golang.org/x/crypto/ssh/agent"
-
-	proxyclient "github.com/gravitational/teleport/api/client/proxy"
-)
-
-type mockConn struct {
-	mu     sync.Mutex
-	closed bool
-	net.Conn
-}
-
-func (mc *mockConn) Close() error {
-	mc.mu.Lock()
-	defer mc.mu.Unlock()
-	mc.closed = true
-	mc.Conn.Close()
-	return nil
-}
-
-type mockHostDialer struct {
-	t      *testing.T
-	mu     sync.Mutex
-	closed bool
-	conns  []*mockConn
-}
-
-func (m *mockHostDialer) DialHost(
-	_ context.Context, _ string, _ string, _ agent.ExtendedAgent,
-) (net.Conn, proxyclient.ClusterDetails, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.closed {
-		m.t.Errorf("attempt to dial on closed host dialer")
-		return nil, proxyclient.ClusterDetails{}, fmt.Errorf("closed")
-	}
-	conn := &mockConn{
-		Conn: &net.TCPConn{},
-	}
-	m.conns = append(m.conns, conn)
-	return conn, proxyclient.ClusterDetails{}, nil
-}
-
-func (m *mockHostDialer) Close() error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.closed = true
-	return nil
-}
-
-type mockHostDialerTracker struct {
-	t           *testing.T
-	mu          sync.Mutex
-	hostDialers []*mockHostDialer
-}
-
-func (m *mockHostDialerTracker) New(_ context.Context) (hostDialer, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	hostDialer := &mockHostDialer{t: m.t}
-	m.hostDialers = append(m.hostDialers, hostDialer)
-	return hostDialer, nil
-}
-
-func (m *mockHostDialerTracker) count() (open int, closed int) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	for _, conn := range m.hostDialers {
-		conn.mu.Lock()
-		connClosed := conn.closed
-		conn.mu.Unlock()
-
-		if connClosed {
-			closed++
-		} else {
-			open++
-		}
-	}
-	return open, closed
-
-}
-
-func TestCyclingHostDialClient(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	tracker := &mockHostDialerTracker{}
-	cycler := &cyclingHostDialClient{
-		max:          5,
-		hostDialerFn: tracker.New,
-	}
-
-	var conns []net.Conn
-	for i := 0; i < 10; i++ {
-		conn, _, err := cycler.DialHost(ctx, "", "", nil)
-		assert.NoError(t, err)
-		conns = append(conns, conn)
-	}
-
-	openDialers, closedDialers := tracker.count()
-	assert.Equal(t, 2, openDialers)
-	assert.Equal(t, 0, closedDialers)
-
-	// Close the first connection, it should not close any dialer.
-	_ = conns[0].Close()
-	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		openDialers, closedDialers = tracker.count()
-		assert.Equal(t, 2, openDialers)
-		assert.Equal(t, 0, closedDialers)
-	}, time.Second, 100*time.Millisecond)
-
-	// Close the next 4 connections, it should close the first dialer.
-	for i := 1; i < 5; i++ {
-		_ = conns[i].Close()
-	}
-	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		openDialers, closedDialers = tracker.count()
-		assert.Equal(t, 1, openDialers)
-		assert.Equal(t, 1, closedDialers)
-	}, time.Second, 100*time.Millisecond)
-
-	// Close the next 5 connections, it should close the second dialer.
-	for i := 5; i < 10; i++ {
-		_ = conns[i].Close()
-	}
-	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		openDialers, closedDialers = tracker.count()
-		assert.Equal(t, 0, openDialers)
-		assert.Equal(t, 2, closedDialers)
-	}, time.Second, 100*time.Millisecond)
-
-	// Now we want to validate a weirder case, let's create 4 connections,
-	// close them and then create a fifth.
-	for i := 0; i < 4; i++ {
-		conn, _, err := cycler.DialHost(ctx, "", "", nil)
-		assert.NoError(t, err)
-		_ = conn.Close()
-	}
-	conn, _, err := cycler.DialHost(ctx, "", "", nil)
-	assert.NoError(t, err)
-	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		openDialers, closedDialers = tracker.count()
-		assert.Equal(t, 1, openDialers)
-		assert.Equal(t, 2, closedDialers)
-	}, time.Second, 100*time.Millisecond)
-	_ = conn.Close()
-	assert.EventuallyWithT(t, func(t *assert.CollectT) {
-		openDialers, closedDialers = tracker.count()
-		assert.Equal(t, 0, openDialers)
-		assert.Equal(t, 3, closedDialers)
-	}, time.Second, 100*time.Millisecond)
-}
diff --git a/lib/tbot/service_ssh_multiplexer_unix.go b/lib/tbot/service_ssh_multiplexer_unix.go
deleted file mode 100644
index a9be90827ce65..0000000000000
--- a/lib/tbot/service_ssh_multiplexer_unix.go
+++ /dev/null
@@ -1,79 +0,0 @@
-//go:build unix
-
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"os"
-	"syscall"
-
-	"github.com/gravitational/trace"
-)
-
-// ConnectToSSHMultiplex connects to the SSH multiplexer and sends the target
-// to the multiplexer. It then returns the connection to the SSH multiplexer
-// over stdout.
-func ConnectToSSHMultiplex(ctx context.Context, socketPath string, target string, stdout *os.File) error {
-	outConn, err := net.FileConn(stdout)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer outConn.Close()
-	outUnix, ok := outConn.(*net.UnixConn)
-	if !ok {
-		return trace.BadParameter("expected stdout to be %T, got %T", outUnix, outConn)
-	}
-
-	c, err := new(net.Dialer).DialContext(ctx, "unix", socketPath)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer c.Close()
-
-	if _, err := fmt.Fprint(c, target, "\x00"); err != nil {
-		return trace.Wrap(err)
-	}
-
-	rawC, err := c.(*net.UnixConn).SyscallConn()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	var innerErr error
-	if controlErr := rawC.Control(func(fd uintptr) {
-		// We have to write something in order to send a control message so
-		// we just write NUL.
-		_, _, innerErr = outUnix.WriteMsgUnix(
-			[]byte{0},
-			syscall.UnixRights(int(fd)),
-			nil,
-		)
-	}); controlErr != nil {
-		return trace.Wrap(controlErr)
-	}
-	if innerErr != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
diff --git a/lib/tbot/service_ssh_multiplexer_windows.go b/lib/tbot/service_ssh_multiplexer_windows.go
deleted file mode 100644
index 437616a9fc2e7..0000000000000
--- a/lib/tbot/service_ssh_multiplexer_windows.go
+++ /dev/null
@@ -1,35 +0,0 @@
-//go:build windows
-
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package tbot
-
-import (
-	"context"
-	"os"
-
-	"github.com/gravitational/trace"
-)
-
-// ConnectToSSHMultiplex connects to the SSH multiplexer and sends the target
-// to the multiplexer. It then returns the connection to the SSH multiplexer
-// over stdout.
-func ConnectToSSHMultiplex(ctx context.Context, socketPath string, target string, stdout *os.File) error {
-	return trace.NotImplemented("SSH Multiplexing not supported on Windows.")
-}
diff --git a/lib/tbot/service_workload_identity_api.go b/lib/tbot/service_workload_identity_api.go
deleted file mode 100644
index 1d7c28bdfc1f0..0000000000000
--- a/lib/tbot/service_workload_identity_api.go
+++ /dev/null
@@ -1,702 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"crypto/x509"
-	"fmt"
-	"log/slog"
-	"time"
-
-	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
-	"github.com/gravitational/trace"
-	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
-	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
-	"github.com/spiffe/go-spiffe/v2/spiffeid"
-	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
-	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/peer"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/structpb"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/observability/metrics"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
-	"github.com/gravitational/teleport/lib/uds"
-)
-
-// WorkloadIdentityAPIService implements a gRPC server that fulfills the SPIFFE
-// Workload API specification. It provides X509 SVIDs and trust bundles to
-// workloads that connect over the configured listener.
-//
-// Sources:
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_Endpoint.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md
-// - https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
-type WorkloadIdentityAPIService struct {
-	workloadpb.UnimplementedSpiffeWorkloadAPIServer
-
-	svcIdentity      *config.UnstableClientCredentialOutput
-	botCfg           *config.BotConfig
-	cfg              *config.WorkloadIdentityAPIService
-	log              *slog.Logger
-	resolver         reversetunnelclient.Resolver
-	trustBundleCache *workloadidentity.TrustBundleCache
-	crlCache         *workloadidentity.CRLCache
-
-	// client holds the impersonated client for the service
-	client           *authclient.Client
-	attestor         *workloadattest.Attestor
-	localTrustDomain spiffeid.TrustDomain
-}
-
-// setup initializes the service, performing tasks such as determining the
-// trust domain, fetching the initial trust bundle and creating an impersonated
-// client.
-func (s *WorkloadIdentityAPIService) setup(ctx context.Context) (err error) {
-	ctx, span := tracer.Start(ctx, "WorkloadIdentityAPIService/setup")
-	defer span.End()
-
-	// Wait for the impersonated identity to be ready for us to consume here.
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-time.After(10 * time.Second):
-		return trace.BadParameter("timeout waiting for identity to be ready")
-	case <-s.svcIdentity.Ready():
-	}
-	facade, err := s.svcIdentity.Facade()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	client, err := clientForFacade(
-		ctx, s.log, s.botCfg, facade, s.resolver,
-	)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	s.client = client
-	// Closure is managed by the caller if this function succeeds. But if it
-	// fails, we need to close the client.
-	defer func() {
-		if err != nil {
-			client.Close()
-		}
-	}()
-
-	td, err := spiffeid.TrustDomainFromString(facade.Get().ClusterName)
-	if err != nil {
-		return trace.Wrap(err, "parsing trust domain name")
-	}
-	s.localTrustDomain = td
-
-	s.attestor, err = workloadattest.NewAttestor(s.log, s.cfg.Attestors)
-	if err != nil {
-		return trace.Wrap(err, "setting up workload attestation")
-	}
-
-	return nil
-}
-
-func (s *WorkloadIdentityAPIService) Run(ctx context.Context) error {
-	ctx, span := tracer.Start(ctx, "WorkloadIdentityAPIService/Run")
-	defer span.End()
-
-	s.log.DebugContext(ctx, "Starting pre-run initialization")
-	if err := s.setup(ctx); err != nil {
-		return trace.Wrap(err)
-	}
-	defer s.client.Close()
-	s.log.DebugContext(ctx, "Completed pre-run initialization")
-
-	srvMetrics := metrics.CreateGRPCServerMetrics(
-		true, prometheus.Labels{
-			teleport.TagServer: "tbot-workload-identity-api",
-		},
-	)
-	if err := metrics.RegisterPrometheusCollectors(srvMetrics); err != nil {
-		return trace.Wrap(err)
-	}
-	srv := grpc.NewServer(
-		grpc.Creds(
-			// SPEC (SPIFFE_Workload_endpoint) 3. Transport:
-			// - Transport Layer Security MUST NOT be required
-			// TODO(noah): We should optionally provide TLS support here down
-			// the road.
-			uds.NewTransportCredentials(insecure.NewCredentials()),
-		),
-		grpc.ChainUnaryInterceptor(
-			recovery.UnaryServerInterceptor(),
-			srvMetrics.UnaryServerInterceptor(),
-		),
-		grpc.ChainStreamInterceptor(
-			recovery.StreamServerInterceptor(),
-			srvMetrics.StreamServerInterceptor(),
-		),
-		grpc.StatsHandler(otelgrpc.NewServerHandler()),
-		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
-	)
-	workloadpb.RegisterSpiffeWorkloadAPIServer(srv, s)
-	sdsHandler := &spiffeSDSHandler{
-		log:              s.log,
-		botCfg:           s.botCfg,
-		trustBundleCache: s.trustBundleCache,
-		clientAuthenticator: func(ctx context.Context) (*slog.Logger, svidFetcher, error) {
-			log, attrs, err := s.authenticateClient(ctx)
-			if err != nil {
-				return log, nil, trace.Wrap(err, "authenticating client")
-			}
-
-			fetchSVIDs := func(
-				ctx context.Context,
-				localBundle *spiffebundle.Bundle,
-			) ([]*workloadpb.X509SVID, error) {
-				return s.fetchX509SVIDs(ctx, log, localBundle, attrs)
-			}
-
-			return log, fetchSVIDs, nil
-		},
-	}
-	secretv3pb.RegisterSecretDiscoveryServiceServer(srv, sdsHandler)
-
-	lis, err := createListener(ctx, s.log, s.cfg.Listen)
-	if err != nil {
-		return trace.Wrap(err, "creating listener")
-	}
-	defer func() {
-		if err := lis.Close(); err != nil {
-			s.log.ErrorContext(ctx, "Encountered error closing listener", "error", err)
-		}
-	}()
-	s.log.InfoContext(ctx, "Listener opened for Workload API endpoint", "addr", lis.Addr().String())
-	if lis.Addr().Network() == "tcp" {
-		s.log.WarnContext(
-			ctx, "Workload API endpoint listening on a TCP port. Ensure that only intended hosts can reach this port!",
-		)
-	}
-
-	// Set off the long running tasks in an errgroup
-	eg, egCtx := errgroup.WithContext(ctx)
-	eg.Go(func() error {
-		// Start the gRPC server
-		return srv.Serve(lis)
-	})
-	eg.Go(func() error {
-		// Shutdown the server when the context is canceled
-		<-egCtx.Done()
-		s.log.DebugContext(ctx, "Shutting down Workload API endpoint")
-		srv.Stop()
-		s.log.InfoContext(ctx, "Shut down Workload API endpoint")
-		return nil
-	})
-
-	return trace.Wrap(eg.Wait())
-}
-
-func (s *WorkloadIdentityAPIService) authenticateClient(
-	ctx context.Context,
-) (*slog.Logger, *attrs.WorkloadAttrs, error) {
-	p, ok := peer.FromContext(ctx)
-	if !ok {
-		return nil, nil, trace.BadParameter("peer not found in context")
-	}
-	log := s.log
-
-	if p.Addr.String() != "" {
-		log = log.With(
-			slog.String("remote_addr", p.Addr.String()),
-		)
-	}
-
-	authInfo, ok := p.AuthInfo.(uds.AuthInfo)
-	// We expect Creds to be nil/unset if the client is connecting via TCP and
-	// therefore there is no workload attestation that can be completed.
-	if !ok || authInfo.Creds == nil {
-		return log, nil, nil
-	}
-
-	// For a UDS, sometimes we are unable to determine the PID of the calling
-	// workload. This can happen if the caller is calling from another process
-	// namespace. In this case, Creds will be non-nil but the PID will be 0.
-	//
-	// We should fail softly here as there could be SVIDs that do not require
-	// workload attestation.
-	if authInfo.Creds.PID == 0 {
-		log.DebugContext(
-			ctx, "Failed to determine the PID of the calling workload. TBot may be running in a different process namespace to the workload. Workload attestation will not be completed.")
-		return log, nil, nil
-	}
-
-	att, err := s.attestor.Attest(ctx, authInfo.Creds.PID)
-	if err != nil {
-		// Fail softly as there may be SVIDs configured that don't require any
-		// workload attestation and we should still issue those.
-		log.ErrorContext(
-			ctx,
-			"Workload attestation failed",
-			"error", err,
-			"pid", authInfo.Creds.PID,
-		)
-		return log, nil, nil
-	}
-	log = log.With("workload", att)
-
-	return log, att, nil
-}
-
-// FetchX509SVID generates and returns the X.509 SVIDs available to a workload.
-// It is a streaming RPC, and sends renewed SVIDs to the client before they
-// expire.
-// Implements the SPIFFE Workload API FetchX509SVID method.
-func (s *WorkloadIdentityAPIService) FetchX509SVID(
-	_ *workloadpb.X509SVIDRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchX509SVIDServer,
-) error {
-	ctx := srv.Context()
-
-	log, creds, err := s.authenticateClient(ctx)
-	if err != nil {
-		return trace.Wrap(err, "authenticating client")
-	}
-
-	log.InfoContext(ctx, "FetchX509SVID stream opened by workload")
-	defer log.InfoContext(ctx, "FetchX509SVID stream has closed")
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "fetching trust bundle set from cache")
-	}
-	crlSet, err := s.crlCache.GetCRLSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "fetching CRL set from cache")
-	}
-
-	var svids []*workloadpb.X509SVID
-	for {
-		log.InfoContext(ctx, "Starting to issue X509 SVIDs to workload")
-
-		// Fetch SVIDs if necessary.
-		if svids == nil {
-			svids, err = s.fetchX509SVIDs(ctx, log, bundleSet.Local, creds)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			// The SPIFFE Workload API (5.2.1):
-			//
-			//   If the client is not entitled to receive any X509-SVIDs, then the
-			//   server SHOULD respond with the "PermissionDenied" gRPC status code (see
-			//   the Error Codes section in the SPIFFE Workload Endpoint specification
-			//   for more information). Under such a case, the client MAY attempt to
-			//   reconnect with another call to the FetchX509SVID RPC after a backoff.
-			if len(svids) == 0 {
-				log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
-				return status.Error(
-					codes.PermissionDenied,
-					"workload did not pass attestation for any SVIDs",
-				)
-			}
-
-		}
-
-		resp := &workloadpb.X509SVIDResponse{
-			Svids:            svids,
-			FederatedBundles: bundleSet.EncodedX509Bundles(false),
-		}
-		if len(crlSet.LocalCRL) > 0 {
-			resp.Crl = [][]byte{crlSet.LocalCRL}
-		}
-
-		err = srv.Send(resp)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		log.DebugContext(
-			ctx, "Finished issuing SVIDs to workload. Waiting for next renewal interval or CA rotation",
-		)
-
-		select {
-		case <-ctx.Done():
-			log.DebugContext(ctx, "Context closed, stopping SVID stream")
-			return nil
-		case <-bundleSet.Stale():
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			log.DebugContext(ctx, "Federated trust bundles have been updated, renewing SVIDs")
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the "local" trust domain's CA has changed, we need to
-				// reissue the SVIDs.
-				svids = nil
-			}
-			bundleSet = newBundleSet
-			continue
-		case <-crlSet.Stale():
-			newCRLSet, err := s.crlCache.GetCRLSet(ctx)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			log.DebugContext(ctx, "CRL set has been updated, distributing to client")
-			crlSet = newCRLSet
-			continue
-		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
-			log.DebugContext(ctx, "Renewal interval reached, renewing SVIDs")
-			svids = nil
-			continue
-		}
-	}
-}
-
-// FetchX509Bundles returns the trust bundle for the trust domain. It is a
-// streaming RPC, and will send rotated trust bundles to the client for as long
-// as the client is connected.
-// Implements the SPIFFE Workload API FetchX509SVID method.
-func (s *WorkloadIdentityAPIService) FetchX509Bundles(
-	_ *workloadpb.X509BundlesRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchX509BundlesServer,
-) error {
-	ctx := srv.Context()
-	s.log.InfoContext(ctx, "FetchX509Bundles stream opened by workload")
-	defer s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
-
-	for {
-		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-		if err != nil {
-			return trace.Wrap(err, "fetching trust bundle set from cache")
-		}
-		crlSet, err := s.crlCache.GetCRLSet(ctx)
-		if err != nil {
-			return trace.Wrap(err, "fetching CRL set from cache")
-		}
-
-		s.log.InfoContext(ctx, "Sending X.509 trust bundles to workload")
-		resp := &workloadpb.X509BundlesResponse{
-			Bundles: bundleSet.EncodedX509Bundles(true),
-		}
-		if len(crlSet.LocalCRL) > 0 {
-			resp.Crl = [][]byte{crlSet.LocalCRL}
-		}
-		err = srv.Send(resp)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-bundleSet.Stale():
-			s.log.DebugContext(ctx, "Trust bundle set has been updated, distributing to client")
-		case <-crlSet.Stale():
-			s.log.DebugContext(ctx, "CRL set has been updated, distributing to client")
-		}
-	}
-}
-
-// fetchX509SVIDs fetches the X.509 SVIDs for the bot's configured SVIDs and
-// returns them in the SPIFFE Workload API format.
-func (s *WorkloadIdentityAPIService) fetchX509SVIDs(
-	ctx context.Context,
-	log *slog.Logger,
-	localBundle *spiffebundle.Bundle,
-	attest *attrs.WorkloadAttrs,
-) ([]*workloadpb.X509SVID, error) {
-	ctx, span := tracer.Start(ctx, "WorkloadIdentityAPIService/fetchX509SVIDs")
-	defer span.End()
-
-	creds, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
-		ctx,
-		log,
-		s.client,
-		s.cfg.Selector,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		attest,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if len(creds) == 0 {
-		s.attestor.Failed(ctx, attest)
-	}
-
-	// Convert the private key to PKCS#8 format as per SPIFFE spec.
-	pkcs8PrivateKey, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	marshaledBundle := workloadidentity.MarshalX509Bundle(localBundle.X509Bundle())
-
-	// Convert responses from the Teleport API to the SPIFFE Workload API
-	// format.
-	svids := make([]*workloadpb.X509SVID, len(creds))
-	for i, cred := range creds {
-		var svid bytes.Buffer
-		svid.Write(cred.GetX509Svid().GetCert())
-		for _, c := range cred.GetX509Svid().Chain {
-			svid.Write(c)
-		}
-		svids[i] = &workloadpb.X509SVID{
-			// Required. The SPIFFE ID of the SVID in this entry
-			SpiffeId: cred.SpiffeId,
-			// Required. ASN.1 DER encoded certificate chain. MAY include
-			// intermediates, the leaf certificate (or SVID itself) MUST come first.
-			X509Svid: svid.Bytes(),
-			// Required. ASN.1 DER encoded PKCS#8 private key. MUST be unencrypted.
-			X509SvidKey: pkcs8PrivateKey,
-			// Required. ASN.1 DER encoded X.509 bundle for the trust domain.
-			Bundle: marshaledBundle,
-			Hint:   cred.Hint,
-		}
-		// Log a message which correlates with the audit log entry and can
-		// provide additional metadata about the client.
-		log.InfoContext(ctx,
-			"Issued Workload Identity Credential",
-			slog.Group("credential",
-				"type", "x509-svid",
-				"spiffe_id", cred.SpiffeId,
-				"serial_number", cred.GetX509Svid().GetSerialNumber(),
-				"hint", cred.Hint,
-				"expires_at", cred.ExpiresAt,
-				"ttl", cred.Ttl,
-				"workload_identity_name", cred.WorkloadIdentityName,
-				"workload_identity_revision", cred.WorkloadIdentityRevision,
-			),
-		)
-	}
-
-	return svids, nil
-}
-
-// FetchJWTSVID implements the SPIFFE Workload API FetchJWTSVID method.
-// See The SPIFFE Workload API (6.2.1).
-func (s *WorkloadIdentityAPIService) FetchJWTSVID(
-	ctx context.Context,
-	req *workloadpb.JWTSVIDRequest,
-) (*workloadpb.JWTSVIDResponse, error) {
-	log, attr, err := s.authenticateClient(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "authenticating client")
-	}
-
-	log.InfoContext(ctx, "FetchJWTSVID request received from workload")
-	defer log.InfoContext(ctx, "FetchJWTSVID request handled")
-	if req.SpiffeId == "" {
-		log = log.With("requested_spiffe_id", req.SpiffeId)
-	}
-
-	// The SPIFFE Workload API (6.2.1):
-	// > The JWTSVIDRequest request message contains a mandatory audience field,
-	// > which MUST contain the value to embed in the audience claim of the
-	// > returned JWT-SVIDs.
-	if len(req.Audience) == 0 {
-		return nil, trace.BadParameter("audience: must have at least one value")
-	}
-
-	creds, err := workloadidentity.IssueJWTWorkloadIdentity(
-		ctx,
-		log,
-		s.client,
-		s.cfg.Selector,
-		req.Audience,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		attr,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// The SPIFFE Workload API (6.2.1):
-	// > If the client is not authorized for any identities, or not authorized
-	// > for the specific identity requested via the spiffe_id field, then the
-	// > server SHOULD respond with the "PermissionDenied" gRPC status code.
-	if len(creds) == 0 {
-		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
-		s.attestor.Failed(ctx, attr)
-		return nil, status.Error(
-			codes.PermissionDenied,
-			"workload did not pass attestation for any SVIDs",
-		)
-	}
-
-	svids := []*workloadpb.JWTSVID{}
-	for _, cred := range creds {
-		svids = append(svids, &workloadpb.JWTSVID{
-			SpiffeId: cred.SpiffeId,
-			Svid:     cred.GetJwtSvid().GetJwt(),
-			Hint:     cred.Hint,
-		})
-		log.InfoContext(ctx,
-			"Issued Workload Identity Credential",
-			slog.Group("credential",
-				"type", "jwt-svid",
-				"spiffe_id", cred.SpiffeId,
-				"jti", cred.GetJwtSvid().GetJti(),
-				"hint", cred.Hint,
-				"expires_at", cred.ExpiresAt,
-				"ttl", cred.Ttl,
-				"audiences", req.Audience,
-			),
-		)
-	}
-
-	// The SPIFFE Workload API (6.2.1):
-	// > The spiffe_id field is optional, and is used to request a JWT-SVID for
-	// > a specific SPIFFE ID. If unspecified, the server MUST return JWT-SVIDs
-	// > for all identities authorized for the client.
-	// TODO(noah): We should optimize here by making the Teleport
-	// WorkloadIdentityIssuance API aware of the requested SPIFFE ID. Theres's
-	// no point signing a credential to just bin it here...
-	if req.SpiffeId != "" {
-		requestedSPIFFEID, err := spiffeid.FromString(req.SpiffeId)
-		if err != nil {
-			return nil, trace.Wrap(err, "parsing requested SPIFFE ID")
-		}
-		if requestedSPIFFEID.TrustDomain() != s.localTrustDomain {
-			return nil, trace.BadParameter("requested SPIFFE ID is not in the local trust domain")
-		}
-
-		// Search through available SVIDs to find the one that matches the
-		// requested SPIFFE ID.
-		found := false
-		for _, svid := range svids {
-			if svid.SpiffeId == req.SpiffeId {
-				found = true
-				svids = []*workloadpb.JWTSVID{svid}
-				break
-			}
-		}
-		if !found {
-			log.ErrorContext(ctx, "Workload is not authorized for the specifically requested SPIFFE ID", "requested_spiffe_id", req.SpiffeId)
-			return nil, status.Error(
-				codes.PermissionDenied,
-				"workload is not authorized for requested SPIFFE ID",
-			)
-		}
-	}
-
-	return &workloadpb.JWTSVIDResponse{
-		Svids: svids,
-	}, nil
-}
-
-// FetchJWTBundles implements the SPIFFE Workload API FetchJWTBundles method.
-// See The SPIFFE Workload API (6.2.2).
-func (s *WorkloadIdentityAPIService) FetchJWTBundles(
-	_ *workloadpb.JWTBundlesRequest,
-	srv workloadpb.SpiffeWorkloadAPI_FetchJWTBundlesServer,
-) error {
-	ctx := srv.Context()
-	s.log.InfoContext(ctx, "FetchJWTBundles stream started by workload")
-	defer s.log.InfoContext(ctx, "FetchJWTBundles stream ended")
-
-	for {
-		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		s.log.InfoContext(ctx, "Sending JWT trust bundles to workload")
-
-		// The SPIFFE Workload API (6.2.2):
-		// > The returned bundles are encoded as a standard JWK Set as defined
-		// > by RFC 7517 containing the JWT-SVID signing keys for the trust
-		// > domain. These keys may only represent a subset of the keys present
-		// > in the SPIFFE trust bundle for the trust domain. The server MUST
-		// > NOT include keys with other uses in the returned JWT bundles.
-		bundles, err := bundleSet.MarshaledJWKSBundles(true)
-		if err != nil {
-			return trace.Wrap(err, "marshaling bundles as JWKS")
-		}
-		err = srv.Send(&workloadpb.JWTBundlesResponse{
-			Bundles: bundles,
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-bundleSet.Stale():
-		}
-	}
-}
-
-// ValidateJWTSVID implements the SPIFFE Workload API ValidateJWTSVID method.
-// See The SPIFFE Workload API (6.2.3).
-func (s *WorkloadIdentityAPIService) ValidateJWTSVID(
-	ctx context.Context,
-	req *workloadpb.ValidateJWTSVIDRequest,
-) (*workloadpb.ValidateJWTSVIDResponse, error) {
-	s.log.InfoContext(ctx, "ValidateJWTSVID request received from workload")
-	defer s.log.InfoContext(ctx, "ValidateJWTSVID request handled")
-
-	// The SPIFFE Workload API (6.2.3):
-	// > All fields in the ValidateJWTSVIDRequest and ValidateJWTSVIDResponse
-	// > message are mandatory.
-	switch {
-	case req.Audience == "":
-		return nil, trace.BadParameter("audience: must be set")
-	case req.Svid == "":
-		return nil, trace.BadParameter("svid: must be set")
-	}
-
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	svid, err := jwtsvid.ParseAndValidate(
-		req.Svid, bundleSet, []string{req.Audience},
-	)
-	if err != nil {
-		return nil, trace.Wrap(err, "validating JWT SVID")
-	}
-
-	claims, err := structpb.NewStruct(svid.Claims)
-	if err != nil {
-		return nil, trace.Wrap(err, "marshaling claims")
-	}
-
-	return &workloadpb.ValidateJWTSVIDResponse{
-		SpiffeId: svid.ID.String(),
-		Claims:   claims,
-	}, nil
-}
-
-// String returns a human-readable string that can uniquely identify the
-// service.
-func (s *WorkloadIdentityAPIService) String() string {
-	return fmt.Sprintf("%s:%s", config.WorkloadIdentityAPIServiceType, s.cfg.Listen)
-}
diff --git a/lib/tbot/service_workload_identity_api_test.go b/lib/tbot/service_workload_identity_api_test.go
deleted file mode 100644
index d73925ee2de77..0000000000000
--- a/lib/tbot/service_workload_identity_api_test.go
+++ /dev/null
@@ -1,199 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"context"
-	"crypto/x509"
-	"fmt"
-	"net/url"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-
-	"github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
-	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
-	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
-	"github.com/spiffe/go-spiffe/v2/workloadapi"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func TestBotWorkloadIdentityAPI(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	setWorkloadIdentityX509CAOverride(ctx, t, process)
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			WorkloadIdentityLabels: map[string]apiutils.Strings{
-				"foo": []string{"bar"},
-			},
-			Rules: []types.Rule{
-				{
-					Resources: []string{types.KindWorkloadIdentity},
-					Verbs:     []string{types.VerbRead, types.VerbList},
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
-		Kind:    types.KindWorkloadIdentity,
-		Version: types.V1,
-		Metadata: &headerv1.Metadata{
-			Name: "foo-bar-bizz",
-			Labels: map[string]string{
-				"foo": "bar",
-			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
-				Id: "/valid/{{ user.bot_name }}/{{ workload.unix.pid }}",
-			},
-		},
-	}
-	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-			WorkloadIdentity: workloadIdentity,
-		})
-	require.NoError(t, err)
-
-	tmpDir := t.TempDir()
-	listenAddr := url.URL{
-		Scheme: "unix",
-		Path:   filepath.Join(tmpDir, "workload.sock"),
-	}
-	onboarding, _ := makeBot(t, rootClient, "api", role.GetName())
-	botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-		&config.WorkloadIdentityAPIService{
-			Selector: config.WorkloadIdentitySelector{
-				Name: workloadIdentity.GetMetadata().GetName(),
-			},
-			Listen: listenAddr.String(),
-		},
-	}, defaultBotConfigOpts{
-		useAuthServer: true,
-		insecure:      true,
-	})
-	botConfig.Oneshot = false
-	b := New(botConfig, log)
-
-	// Spin up goroutine for bot to run in
-	botCtx, cancelBot := context.WithCancel(ctx)
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := b.Run(botCtx)
-		assert.NoError(t, err, "bot should not exit with error")
-		cancelBot()
-	}()
-	t.Cleanup(func() {
-		// Shut down bot and make sure it exits.
-		cancelBot()
-		wg.Wait()
-	})
-
-	// This has a little flexibility internally in terms of waiting for the
-	// socket to come up, so we don't need a manual sleep/retry here.
-	client, err := workloadapi.New(ctx, workloadapi.WithAddr(listenAddr.String()))
-	require.NoError(t, err)
-
-	source, err := workloadapi.NewX509Source(
-		ctx,
-		workloadapi.WithClient(client),
-	)
-	require.NoError(t, err)
-	defer source.Close()
-
-	// Test FetchX509SVID
-	svid, err := source.GetX509SVID()
-	require.NoError(t, err)
-
-	expectedSPIFFEID := fmt.Sprintf("spiffe://root/valid/api/%d", os.Getpid())
-	require.Equal(t, expectedSPIFFEID, svid.ID.String())
-	// the override includes a chain with a single certificate
-	require.Len(t, svid.Certificates, 2)
-	require.Equal(t, expectedSPIFFEID, svid.Certificates[0].URIs[0].String())
-	_, _, err = x509svid.Verify(svid.Certificates, source)
-	require.NoError(t, err)
-
-	// Test FetchX509Bundles
-	set, err := client.FetchX509Bundles(ctx)
-	require.NoError(t, err)
-	_, _, err = x509svid.Verify(svid.Certificates, set)
-	require.NoError(t, err)
-
-	// Test FetchJWTSVID
-	jwtSVID, err := client.FetchJWTSVID(ctx, jwtsvid.Params{
-		Audience: "example.com",
-	})
-	require.NoError(t, err)
-
-	// Check against ValidateJWTSVID
-	parsed, err := client.ValidateJWTSVID(ctx, jwtSVID.Marshal(), "example.com")
-	require.NoError(t, err)
-	require.Equal(t, expectedSPIFFEID, parsed.ID.String())
-	// Perform local validation with bundles from FetchJWTBundles
-	jwtBundles, err := client.FetchJWTBundles(ctx)
-	require.NoError(t, err)
-	_, err = jwtsvid.ParseAndValidate(jwtSVID.Marshal(), jwtBundles, []string{"example.com"})
-	require.NoError(t, err)
-
-	// Check CRL is delivered - we have to manually craft the client for this
-	// since the current go-spiffe SDK doesn't support this.
-	// TODO(noah): I'll raise some changes upstream to add CRL field support to
-	// the go-spiffe SDK, and then we can remove this code.
-	conn, err := grpc.NewClient(
-		listenAddr.String(),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-	)
-	require.NoError(t, err)
-	spiffeWorkloadAPI := workload.NewSpiffeWorkloadAPIClient(conn)
-	stream, err := spiffeWorkloadAPI.FetchX509SVID(ctx, &workload.X509SVIDRequest{})
-	require.NoError(t, err)
-
-	resp, err := stream.Recv()
-	require.NoError(t, err)
-	require.Len(t, resp.Crl, 1)
-	crl, err := x509.ParseRevocationList(resp.Crl[0])
-	require.NoError(t, err)
-	require.Empty(t, crl.RevokedCertificateEntries)
-	tb, ok := set.Get(svid.ID.TrustDomain())
-	require.True(t, ok)
-	require.NoError(t, crl.CheckSignatureFrom(tb.X509Authorities()[0]))
-}
diff --git a/lib/tbot/service_workload_identity_aws_ra.go b/lib/tbot/service_workload_identity_aws_ra.go
deleted file mode 100644
index 5cf33b0331533..0000000000000
--- a/lib/tbot/service_workload_identity_aws_ra.go
+++ /dev/null
@@ -1,307 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"crypto"
-	"crypto/x509"
-	"fmt"
-	"log/slog"
-	"time"
-
-	"github.com/gravitational/trace"
-	awsspiffe "github.com/spiffe/aws-spiffe-workload-helper"
-	"github.com/spiffe/aws-spiffe-workload-helper/vendoredaws"
-	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
-	"gopkg.in/ini.v1"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-)
-
-// WorkloadIdentityAWSRAService is a service that retrieves X.509 certificates
-// and exchanges them for AWS credentials using the AWS Roles Anywhere service.
-type WorkloadIdentityAWSRAService struct {
-	botAuthClient     *authclient.Client
-	botCfg            *config.BotConfig
-	cfg               *config.WorkloadIdentityAWSRAService
-	getBotIdentity    getBotIdentityFn
-	log               *slog.Logger
-	resolver          reversetunnelclient.Resolver
-	reloadBroadcaster *channelBroadcaster
-}
-
-// String returns a human-readable description of the service.
-func (s *WorkloadIdentityAWSRAService) String() string {
-	return fmt.Sprintf("workload-identity-aws-roles-anywhere (%s)", s.cfg.Destination.String())
-}
-
-// OneShot runs the service once, generating the output and writing it to the
-// destination, before exiting.
-func (s *WorkloadIdentityAWSRAService) OneShot(ctx context.Context) error {
-	return s.generate(ctx)
-}
-
-// Run runs the service in a loop, generating the output and writing it to the
-// destination at regular intervals.
-func (s *WorkloadIdentityAWSRAService) Run(ctx context.Context) error {
-	reloadCh, unsubscribe := s.reloadBroadcaster.subscribe()
-	defer unsubscribe()
-
-	err := runOnInterval(ctx, runOnIntervalConfig{
-		service:    s.String(),
-		name:       "output-renewal",
-		f:          s.generate,
-		interval:   s.cfg.SessionRenewalInterval,
-		retryLimit: renewalRetryLimit,
-		log:        s.log,
-		reloadCh:   reloadCh,
-	})
-	return trace.Wrap(err)
-}
-
-func (s *WorkloadIdentityAWSRAService) generate(ctx context.Context) error {
-	res, privateKey, err := s.requestSVID(ctx)
-	if err != nil {
-		return trace.Wrap(err, "requesting SVID")
-	}
-	pkcs8, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return trace.Wrap(err, "marshaling private key")
-	}
-	certWithChain := new(bytes.Buffer)
-	_, _ = certWithChain.Write(res.GetX509Svid().GetCert())
-	// If external PKI is configured, we need to append the chain to the leaf
-	// certificate before calling x509svid.ParseRaw.
-	for _, cert := range res.GetX509Svid().GetChain() {
-		_, _ = certWithChain.Write(cert)
-	}
-	svid, err := x509svid.ParseRaw(certWithChain.Bytes(), pkcs8)
-	if err != nil {
-		return trace.Wrap(err, "parsing x509 svid")
-	}
-
-	s.log.InfoContext(
-		ctx,
-		"Exchanging SVID for AWS credentials",
-		"spiffe_id", svid.ID.String(),
-		"role_arn", s.cfg.RoleARN,
-		"profile_arn", s.cfg.ProfileARN,
-		"trust_anchor_arn", s.cfg.TrustAnchorARN,
-	)
-	creds, err := s.exchangeSVID(svid)
-	if err != nil {
-		return trace.Wrap(err, "exchanging SVID via Roles Anywhere")
-	}
-	s.log.InfoContext(
-		ctx,
-		"Exchanged SVID for AWS credentials",
-		"aws_credentials_expiry", creds.Expiration,
-	)
-
-	return s.renderAWSCreds(ctx, creds)
-}
-
-// exchangeSVID will exchange the X.509 SVID for AWS credentials using the
-// AWS Roles Anywhere service.
-func (s *WorkloadIdentityAWSRAService) exchangeSVID(
-	svid *x509svid.SVID,
-) (*vendoredaws.CredentialProcessOutput, error) {
-	signer := &awsspiffe.X509SVIDSigner{
-		SVID: svid,
-	}
-	algo, err := signer.SignatureAlgorithm()
-	if err != nil {
-		return nil, trace.Wrap(err, "getting signature algorithm")
-	}
-
-	credentials, err := vendoredaws.GenerateCredentials(&vendoredaws.CredentialsOpts{
-		RoleArn:           s.cfg.RoleARN,
-		ProfileArnStr:     s.cfg.ProfileARN,
-		Region:            s.cfg.Region,
-		TrustAnchorArnStr: s.cfg.TrustAnchorARN,
-		SessionDuration:   int(s.cfg.SessionDuration.Seconds()),
-		Endpoint:          s.cfg.EndpointOverride,
-	}, signer, algo)
-	if err != nil {
-		return nil, trace.Wrap(err, "exchanging credentials")
-	}
-
-	return &credentials, nil
-}
-
-func (s *WorkloadIdentityAWSRAService) requestSVID(
-	ctx context.Context,
-) (
-	*workloadidentityv1pb.Credential,
-	crypto.Signer,
-	error,
-) {
-	ctx, span := tracer.Start(
-		ctx,
-		"WorkloadIdentityAWSRAService/requestSVID",
-	)
-	defer span.End()
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "fetching roles")
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		// We only need this to issue the X509 SVID, so we don't need the full
-		// lifetime.
-		time.Minute*10,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	x509Credentials, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
-		ctx,
-		s.log,
-		impersonatedClient,
-		s.cfg.Selector,
-		// We only use this SVID to exchange for AWS credentials, so we don't
-		// need the full lifetime.
-		time.Minute*10,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "generating X509 SVID")
-	}
-	var x509Credential *workloadidentityv1pb.Credential
-	switch len(x509Credentials) {
-	case 0:
-		return nil, nil, trace.BadParameter("no X509 SVIDs returned")
-	case 1:
-		x509Credential = x509Credentials[0]
-	default:
-		// We could eventually implement some kind of hint selection mechanism
-		// to pick the "right" one.
-		received := make([]string, 0, len(x509Credentials))
-		for _, cred := range x509Credentials {
-			received = append(received,
-				fmt.Sprintf(
-					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
-				),
-			)
-		}
-		return nil, nil, trace.BadParameter(
-			"multiple X509 SVIDs received: %v", received,
-		)
-	}
-
-	return x509Credential, privateKey, nil
-}
-
-func loadExistingAWSCredentialFile(
-	ctx context.Context, dest bot.Destination, artifactName string,
-) (*ini.File, error) {
-	// Load the existing credential file if it exists so we can merge with
-	// it.
-	data, err := dest.Read(ctx, artifactName)
-	if err != nil {
-		if trace.IsNotFound(err) {
-			return ini.Empty(), nil
-		}
-		return nil, trace.Wrap(err, "reading existing credentials")
-	}
-
-	f, err := ini.Load(data)
-	if err != nil {
-		return nil, trace.Wrap(err, "parsing existing credentials")
-	}
-	return f, nil
-}
-
-// render will write the AWS credentials to the AWS CLI configuration file.
-// See https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html
-func (s *WorkloadIdentityAWSRAService) renderAWSCreds(
-	ctx context.Context,
-	creds *vendoredaws.CredentialProcessOutput,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"renderAWSCreds",
-	)
-	defer span.End()
-
-	expiresAt, err := time.Parse(time.RFC3339, creds.Expiration)
-	if err != nil {
-		return fmt.Errorf("parsing expiration time: %w", err)
-	}
-
-	artifactName := cmp.Or(s.cfg.ArtifactName, "aws_credentials")
-
-	f := ini.Empty()
-	if !s.cfg.OverwriteCredentialFile {
-		var err error
-		f, err = loadExistingAWSCredentialFile(
-			ctx, s.cfg.Destination, artifactName,
-		)
-		if err != nil {
-			return trace.Wrap(err, "loading existing credentials")
-		}
-	}
-
-	// "default" is the special profile name that the AWS CLI/SDK will read by
-	// default.
-	profileName := cmp.Or(s.cfg.CredentialProfileName, "default")
-	sec := f.Section(profileName)
-	sec.Key("aws_secret_access_key").SetValue(creds.SecretAccessKey)
-	sec.Key("aws_access_key_id").SetValue(creds.AccessKeyId)
-	sec.Key("aws_session_token").SetValue(creds.SessionToken)
-	sec.Key("expiration").SetValue(
-		fmt.Sprintf("%d", expiresAt.UnixMilli()),
-	)
-
-	b := &bytes.Buffer{}
-	_, err = f.WriteTo(b)
-	if err != nil {
-		return trace.Wrap(err, "writing credentials to buffer")
-	}
-
-	err = s.cfg.Destination.Write(ctx, artifactName, b.Bytes())
-	if err != nil {
-		return trace.Wrap(err, "writing credentials to destination")
-	}
-	return nil
-}
diff --git a/lib/tbot/service_workload_identity_aws_ra_test.go b/lib/tbot/service_workload_identity_aws_ra_test.go
deleted file mode 100644
index b718f0dbe1540..0000000000000
--- a/lib/tbot/service_workload_identity_aws_ra_test.go
+++ /dev/null
@@ -1,338 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-package tbot
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/spiffe/aws-spiffe-workload-helper/vendoredaws"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/testutils/golden"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func Test_renderAWSCreds(t *testing.T) {
-	creds := &vendoredaws.CredentialProcessOutput{
-		AccessKeyId:     "AKIAIOSFODNN7EXAMPLEAKID",
-		SessionToken:    "AQoDYXdzEJrtyWJ4NjK7PiEXAMPLEST",
-		SecretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLESAK",
-		Expiration:      "2028-07-27T04:36:55Z",
-	}
-	ctx := context.Background()
-
-	tests := []struct {
-		name         string
-		cfg          *config.WorkloadIdentityAWSRAService
-		artifactName string
-		existingData []byte
-	}{
-		{
-			name:         "normal",
-			cfg:          &config.WorkloadIdentityAWSRAService{},
-			artifactName: "aws_credentials",
-		},
-		{
-			name:         "merge with existing data",
-			cfg:          &config.WorkloadIdentityAWSRAService{},
-			artifactName: "aws_credentials",
-			existingData: []byte(`[foo]
-aws_secret_access_key=existing
-aws_access_key_id=existing
-aws_session_token=existing`),
-		},
-		{
-			name:         "replace with existing data",
-			cfg:          &config.WorkloadIdentityAWSRAService{},
-			artifactName: "aws_credentials",
-			existingData: []byte(`[default]
-aws_secret_access_key=existing
-aws_access_key_id=existing
-aws_session_token=existing`),
-		},
-		{
-			name: "with artifact name override",
-			cfg: &config.WorkloadIdentityAWSRAService{
-				ArtifactName: "foo-xyzzy",
-			},
-			artifactName: "foo-xyzzy",
-		},
-		{
-			name: "with named profile",
-			cfg: &config.WorkloadIdentityAWSRAService{
-				CredentialProfileName: "test-profile",
-			},
-			artifactName: "aws_credentials",
-		},
-		{
-			name: "overwrite existing data",
-			cfg: &config.WorkloadIdentityAWSRAService{
-				CredentialProfileName:   "test-profile",
-				OverwriteCredentialFile: true,
-			},
-			artifactName: "aws_credentials",
-			existingData: []byte(`[foo]
-aws_secret_access_key=existing
-aws_access_key_id=existing
-aws_session_token=existing
-`),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dest := &config.DestinationMemory{}
-			require.NoError(t, dest.CheckAndSetDefaults())
-			require.NoError(t, dest.Init(ctx, []string{}))
-
-			if len(tt.existingData) > 0 {
-				require.NoError(t, dest.Write(ctx, tt.artifactName, tt.existingData))
-			}
-
-			tt.cfg.Destination = dest
-			svc := &WorkloadIdentityAWSRAService{
-				cfg: tt.cfg,
-			}
-
-			err := svc.renderAWSCreds(ctx, creds)
-			require.NoError(t, err)
-
-			got, err := dest.Read(ctx, tt.artifactName)
-			require.NoError(t, err)
-
-			if golden.ShouldSet() {
-				golden.Set(t, got)
-			}
-			require.Equal(t, golden.Get(t), got)
-		})
-	}
-}
-
-type mockCreateSessionInputBody struct {
-	DurationSeconds int `json:"durationSeconds"`
-}
-
-func TestBotWorkloadIdentityAWSRA(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	tests := []struct {
-		name        string
-		externalPKI bool
-	}{
-		{
-			name: "no external pki",
-		},
-		{
-			name:        "external pki",
-			externalPKI: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-			if tt.externalPKI {
-				setWorkloadIdentityX509CAOverride(ctx, t, process)
-			}
-			spiffeCA, err := process.GetAuthServer().
-				GetCertAuthority(ctx, types.CertAuthID{
-					DomainName: "root",
-					Type:       types.SPIFFECA,
-				}, false)
-			require.NoError(t, err)
-			spiffeCAX509KeyPairs := spiffeCA.GetTrustedTLSKeyPairs()
-			require.Len(t, spiffeCAX509KeyPairs, 1)
-			spiffeCACert, err := tlsca.ParseCertificatePEM(spiffeCAX509KeyPairs[0].Cert)
-			require.NoError(t, err)
-			rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-			roleArn := "arn:aws:iam::123456789012:role/example-role"
-			trustAnchorArn := "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000"
-			profileArn := "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000"
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				assert.Equal(t, "/sessions", r.URL.Path)
-				assert.Equal(t, http.MethodPost, r.Method)
-
-				// Check query parameter inputs
-				// The AWS documentation "lies" about these inputs using the JSON body
-				// - the rolesanywhere API client in
-				//  `aws/rolesanywhere-credential-helper` uses query parameters for
-				// these.
-				assert.Equal(t, roleArn, r.URL.Query().Get("roleArn"))
-				assert.Equal(t, trustAnchorArn, r.URL.Query().Get("trustAnchorArn"))
-				assert.Equal(t, profileArn, r.URL.Query().Get("profileArn"))
-
-				// Check JSON body inputs
-				body := &mockCreateSessionInputBody{}
-				assert.NoError(t, json.NewDecoder(r.Body).Decode(body))
-				assert.Equal(t, int((2 * time.Hour).Seconds()), body.DurationSeconds)
-
-				// Validate the X-Amz-X509 header contains the valid (and correct) SVID
-				derString := r.Header.Get("X-Amz-X509")
-				assert.NotEmpty(t, derString)
-				derBytes, err := base64.StdEncoding.DecodeString(derString)
-				assert.NoError(t, err)
-				cert, err := x509.ParseCertificate(derBytes)
-				assert.NoError(t, err)
-				assert.Len(t, cert.URIs, 1)
-				assert.Equal(t, "spiffe://root/ra-test", cert.URIs[0].String())
-
-				// Validate the X-Amz-X509-Chain header contains the valid chain
-				chainString := r.Header.Get("X-Amz-X509-Chain")
-				if tt.externalPKI {
-					require.NotEmpty(t, chainString)
-					// If there were multiple certs in the chain, we'd need to
-					// split by comma first since:
-					//
-					// > The X-Amz-X509-Chain header MUST be encoded as
-					// > comma-delimited, base64-encoded DER
-					//
-					// But since we only expect a single item in the chain here
-					// we can just decode it.
-					chainBytes, err := base64.StdEncoding.DecodeString(chainString)
-					assert.NoError(t, err)
-					chainCert, err := x509.ParseCertificate(chainBytes)
-					assert.NoError(t, err)
-					// Check this matches the actual CA we setup.
-					assert.True(t, chainCert.Equal(spiffeCACert))
-				} else {
-					require.Empty(t, chainString)
-				}
-
-				// Validate the authorization header exists. We rely on the AWS SDK to
-				// actually produce the signature, and, validating this signature would
-				// introduce significant complexity to this test - so this is omitted.
-				authz := r.Header.Get("Authorization")
-				assert.NotEmpty(t, authz)
-
-				// Send mocked response
-				_, _ = w.Write([]byte(`{
-			"credentialSet":[
-			  {
-				"assumedRoleUser": {
-				"arn": "arn:aws:iam::123456789012:role/example-role",
-				"assumedRoleId": "assumedRoleId"
-				},
-				"credentials":{
-				  "accessKeyId": "accessKeyId",
-				  "expiration": "2028-07-27T04:36:55Z",
-				  "secretAccessKey": "secretAccessKey",
-				  "sessionToken": "sessionToken"
-				},
-				"packedPolicySize": 10,
-				"roleArn": "arn:aws:iam::123456789012:role/example-role",
-				"sourceIdentity": "sourceIdentity"
-			  }
-			],
-			"subjectArn": "arn:aws:rolesanywhere:us-east-1:000000000000:subject/41cl0bae-6783-40d4-ab20-65dc5d922e45"
-		  }`))
-			}))
-			t.Cleanup(srv.Close)
-
-			role, err := types.NewRole("issue-foo", types.RoleSpecV6{
-				Allow: types.RoleConditions{
-					WorkloadIdentityLabels: map[string]apiutils.Strings{
-						"foo": []string{"bar"},
-					},
-					Rules: []types.Rule{
-						{
-							Resources: []string{types.KindWorkloadIdentity},
-							Verbs:     []string{types.VerbRead, types.VerbList},
-						},
-					},
-				},
-			})
-			require.NoError(t, err)
-			role, err = rootClient.UpsertRole(ctx, role)
-			require.NoError(t, err)
-
-			workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
-				Kind:    types.KindWorkloadIdentity,
-				Version: types.V1,
-				Metadata: &headerv1.Metadata{
-					Name: "foo-bar-bizz",
-					Labels: map[string]string{
-						"foo": "bar",
-					},
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
-						Id: "/ra-test",
-					},
-				},
-			}
-			workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-				CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-					WorkloadIdentity: workloadIdentity,
-				})
-			require.NoError(t, err)
-
-			tmpDir := t.TempDir()
-			onboarding, _ := makeBot(t, rootClient, "ra-test", role.GetName())
-			botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-				&config.WorkloadIdentityAWSRAService{
-					Selector: config.WorkloadIdentitySelector{
-						Name: workloadIdentity.GetMetadata().GetName(),
-					},
-					Destination: &config.DestinationDirectory{
-						Path: tmpDir,
-					},
-					RoleARN:                roleArn,
-					ProfileARN:             profileArn,
-					TrustAnchorARN:         trustAnchorArn,
-					Region:                 "us-east-1",
-					SessionDuration:        2 * time.Hour,
-					SessionRenewalInterval: 30 * time.Minute,
-					EndpointOverride:       srv.URL,
-				},
-			}, defaultBotConfigOpts{
-				useAuthServer: true,
-				insecure:      true,
-			})
-
-			botConfig.Oneshot = true
-			b := New(botConfig, log)
-			// Run Bot with 10 second timeout to catch hangs.
-			ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-			t.Cleanup(cancel)
-			require.NoError(t, b.Run(ctx))
-
-			got, err := os.ReadFile(filepath.Join(tmpDir, "aws_credentials"))
-			require.NoError(t, err)
-			if golden.ShouldSet() {
-				golden.Set(t, got)
-			}
-			require.Equal(t, string(golden.Get(t)), string(got))
-		})
-	}
-}
diff --git a/lib/tbot/service_workload_identity_jwt.go b/lib/tbot/service_workload_identity_jwt.go
deleted file mode 100644
index 2d31f0060ca3c..0000000000000
--- a/lib/tbot/service_workload_identity_jwt.go
+++ /dev/null
@@ -1,255 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"cmp"
-	"context"
-	"fmt"
-	"log/slog"
-	"math"
-	"time"
-
-	"github.com/gravitational/trace"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-)
-
-// WorkloadIdentityJWTService is a service that retrieves JWT workload identity
-// credentials for WorkloadIdentity resources.
-type WorkloadIdentityJWTService struct {
-	botAuthClient  *authclient.Client
-	botCfg         *config.BotConfig
-	cfg            *config.WorkloadIdentityJWTService
-	getBotIdentity getBotIdentityFn
-	log            *slog.Logger
-	resolver       reversetunnelclient.Resolver
-	// trustBundleCache is the cache of trust bundles. It only needs to be
-	// provided when running in daemon mode.
-	trustBundleCache *workloadidentity.TrustBundleCache
-}
-
-// String returns a human-readable description of the service.
-func (s *WorkloadIdentityJWTService) String() string {
-	return fmt.Sprintf("workload-identity-jwt (%s)", s.cfg.Destination.String())
-}
-
-// OneShot runs the service once, generating the output and writing it to the
-// destination, before exiting.
-func (s *WorkloadIdentityJWTService) OneShot(ctx context.Context) error {
-	res, err := s.requestJWTSVID(ctx)
-	if err != nil {
-		return trace.Wrap(err, "requesting JWT SVID")
-	}
-	return s.render(ctx, res)
-}
-
-// Run runs the service in daemon mode, periodically generating the output and
-// writing it to the destination.
-func (s *WorkloadIdentityJWTService) Run(ctx context.Context) error {
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "getting trust bundle set")
-	}
-
-	jitter := retryutils.DefaultJitter
-	var cred *workloadidentityv1pb.Credential
-	var failures int
-	firstRun := make(chan struct{}, 1)
-	firstRun <- struct{}{}
-	for {
-		var retryAfter <-chan time.Time
-		if failures > 0 {
-			backoffTime := time.Second * time.Duration(math.Pow(2, float64(failures-1)))
-			if backoffTime > time.Minute {
-				backoffTime = time.Minute
-			}
-			backoffTime = jitter(backoffTime)
-			s.log.WarnContext(
-				ctx,
-				"Last attempt to generate output failed, will retry",
-				"retry_after", backoffTime,
-				"failures", failures,
-			)
-			retryAfter = time.After(time.Duration(failures) * time.Second)
-		}
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-retryAfter:
-			s.log.InfoContext(ctx, "Retrying")
-		case <-bundleSet.Stale():
-			// We don't actually write this bundle out at the moment, but, we
-			// still track it so we know when to reissue the JWT SVID.
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err, "getting trust bundle set")
-			}
-			s.log.InfoContext(ctx, "Trust bundle set has been updated")
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the local trust domain CA has changed, we need to reissue
-				// the SVID.
-				cred = nil
-			}
-			bundleSet = newBundleSet
-		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
-			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
-			cred = nil
-		case <-firstRun:
-		}
-
-		if cred == nil {
-			var err error
-			cred, err = s.requestJWTSVID(ctx)
-			if err != nil {
-				s.log.ErrorContext(ctx, "Failed to request JWT SVID", "error", err)
-				failures++
-				continue
-			}
-		}
-		if err := s.render(ctx, cred); err != nil {
-			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
-			failures++
-			continue
-		}
-		failures = 0
-	}
-}
-
-func (s *WorkloadIdentityJWTService) requestJWTSVID(
-	ctx context.Context,
-) (
-	*workloadidentityv1pb.Credential,
-	error,
-) {
-	ctx, span := tracer.Start(
-		ctx,
-		"WorkloadIdentityJWTService/requestJWTSVID",
-	)
-	defer span.End()
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return nil, trace.Wrap(err, "fetching roles")
-	}
-
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err, "generating identity")
-	}
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	credentials, err := workloadidentity.IssueJWTWorkloadIdentity(
-		ctx,
-		s.log,
-		impersonatedClient,
-		s.cfg.Selector,
-		s.cfg.Audiences,
-		effectiveLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err, "generating JWT SVID")
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	var credential *workloadidentityv1pb.Credential
-	switch len(credentials) {
-	case 0:
-		return nil, trace.BadParameter("no JWT SVIDs returned")
-	case 1:
-		credential = credentials[0]
-	default:
-		// We could eventually implement some kind of hint selection mechanism
-		// to pick the "right" one.
-		received := make([]string, 0, len(credentials))
-		for _, cred := range credentials {
-			received = append(received,
-				fmt.Sprintf(
-					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
-				),
-			)
-		}
-		return nil, trace.BadParameter(
-			"multiple JWT SVIDs received: %v", received,
-		)
-	}
-
-	return credential, nil
-}
-
-func (s *WorkloadIdentityJWTService) render(
-	ctx context.Context,
-	cred *workloadidentityv1pb.Credential,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"WorkloadIdentityJWTService/render",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Rendering output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	if err := s.cfg.Destination.Write(
-		ctx, config.JWTSVIDPath, []byte(cred.GetJwtSvid().GetJwt()),
-	); err != nil {
-		return trace.Wrap(err, "writing jwt svid")
-	}
-
-	s.log.InfoContext(
-		ctx,
-		"Successfully wrote JWT workload identity credential to destination",
-		"workload_identity", workloadidentity.WorkloadIdentityLogValue(cred),
-		"destination", s.cfg.Destination.String(),
-	)
-	return nil
-}
diff --git a/lib/tbot/service_workload_identity_jwt_test.go b/lib/tbot/service_workload_identity_jwt_test.go
deleted file mode 100644
index abb785171dac6..0000000000000
--- a/lib/tbot/service_workload_identity_jwt_test.go
+++ /dev/null
@@ -1,149 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
-	"github.com/stretchr/testify/require"
-
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func TestBotWorkloadIdentityJWT(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			WorkloadIdentityLabels: map[string]apiutils.Strings{
-				"foo": []string{"bar"},
-			},
-			Rules: []types.Rule{
-				{
-					Resources: []string{types.KindWorkloadIdentity},
-					Verbs:     []string{types.VerbRead, types.VerbList},
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
-		Kind:    types.KindWorkloadIdentity,
-		Version: types.V1,
-		Metadata: &headerv1.Metadata{
-			Name: "foo-bar-bizz",
-			Labels: map[string]string{
-				"foo": "bar",
-			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
-				Id: "/valid/{{ user.bot_name }}",
-			},
-		},
-	}
-	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-			WorkloadIdentity: workloadIdentity,
-		})
-	require.NoError(t, err)
-
-	t.Run("By Name", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		onboarding, _ := makeBot(t, rootClient, "by-name", role.GetName())
-		botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-			&config.WorkloadIdentityJWTService{
-				Selector: config.WorkloadIdentitySelector{
-					Name: workloadIdentity.GetMetadata().GetName(),
-				},
-				Destination: &config.DestinationDirectory{
-					Path: tmpDir,
-				},
-				Audiences: []string{"example", "foo"},
-			},
-		}, defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		})
-		botConfig.Oneshot = true
-		b := New(botConfig, log)
-		// Run Bot with 10 second timeout to catch hangs.
-		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-		defer cancel()
-		require.NoError(t, b.Run(ctx))
-
-		jwtBytes, err := os.ReadFile(filepath.Join(tmpDir, config.JWTSVIDPath))
-		require.NoError(t, err)
-		jwt, err := jwtsvid.ParseInsecure(string(jwtBytes), []string{"example"})
-		require.NoError(t, err)
-		require.Equal(t, "spiffe://root/valid/by-name", jwt.ID.String())
-		require.Equal(t, []string{"example", "foo"}, jwt.Audience)
-	})
-	t.Run("By Labels", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		onboarding, _ := makeBot(t, rootClient, "by-labels", role.GetName())
-		botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-			&config.WorkloadIdentityJWTService{
-				Selector: config.WorkloadIdentitySelector{
-					Labels: map[string][]string{
-						"foo": {"bar"},
-					},
-				},
-				Destination: &config.DestinationDirectory{
-					Path: tmpDir,
-				},
-				Audiences: []string{"example"},
-			},
-		}, defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		})
-		botConfig.Oneshot = true
-		b := New(botConfig, log)
-		// Run Bot with 10 second timeout to catch hangs.
-		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-		defer cancel()
-		require.NoError(t, b.Run(ctx))
-
-		jwtBytes, err := os.ReadFile(filepath.Join(tmpDir, config.JWTSVIDPath))
-		require.NoError(t, err)
-		jwt, err := jwtsvid.ParseInsecure(string(jwtBytes), []string{"example"})
-		require.NoError(t, err)
-		require.Equal(t, "spiffe://root/valid/by-labels", jwt.ID.String())
-		require.Equal(t, []string{"example"}, jwt.Audience)
-	})
-}
diff --git a/lib/tbot/service_workload_identity_x509.go b/lib/tbot/service_workload_identity_x509.go
deleted file mode 100644
index 5aa5511a543e1..0000000000000
--- a/lib/tbot/service_workload_identity_x509.go
+++ /dev/null
@@ -1,347 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"crypto"
-	"crypto/x509"
-	"encoding/pem"
-	"fmt"
-	"log/slog"
-	"math"
-	"time"
-
-	"github.com/gravitational/trace"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
-)
-
-// WorkloadIdentityX509Service is a service that retrieves X.509 certificates
-// for WorkloadIdentity resources.
-type WorkloadIdentityX509Service struct {
-	botAuthClient  *authclient.Client
-	botCfg         *config.BotConfig
-	cfg            *config.WorkloadIdentityX509Service
-	getBotIdentity getBotIdentityFn
-	log            *slog.Logger
-	resolver       reversetunnelclient.Resolver
-	// trustBundleCache is the cache of trust bundles. It only needs to be
-	// provided when running in daemon mode.
-	trustBundleCache *workloadidentity.TrustBundleCache
-	crlCache         *workloadidentity.CRLCache
-}
-
-// String returns a human-readable description of the service.
-func (s *WorkloadIdentityX509Service) String() string {
-	return fmt.Sprintf("workload-identity-x509 (%s)", s.cfg.Destination.String())
-}
-
-// OneShot runs the service once, generating the output and writing it to the
-// destination, before exiting.
-func (s *WorkloadIdentityX509Service) OneShot(ctx context.Context) error {
-	res, privateKey, err := s.requestSVID(ctx)
-	if err != nil {
-		return trace.Wrap(err, "requesting SVID")
-	}
-	bundleSet, err := workloadidentity.FetchInitialBundleSet(
-		ctx,
-		s.log,
-		s.botAuthClient.SPIFFEFederationServiceClient(),
-		s.botAuthClient.TrustClient(),
-		s.cfg.IncludeFederatedTrustBundles,
-		s.getBotIdentity().ClusterName,
-	)
-	if err != nil {
-		return trace.Wrap(err, "fetching trust bundle set")
-	}
-	crlSet, err := workloadidentity.FetchCRLSet(
-		ctx,
-		s.botAuthClient.WorkloadIdentityRevocationServiceClient(),
-	)
-	if err != nil {
-		return trace.Wrap(err, "fetching CRL set")
-	}
-
-	return s.render(ctx, bundleSet, res, privateKey, crlSet)
-}
-
-// Run runs the service in daemon mode, periodically generating the output and
-// writing it to the destination.
-func (s *WorkloadIdentityX509Service) Run(ctx context.Context) error {
-	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "getting trust bundle set")
-	}
-	crlSet, err := s.crlCache.GetCRLSet(ctx)
-	if err != nil {
-		return trace.Wrap(err, "getting CRL set from cache")
-	}
-
-	jitter := retryutils.DefaultJitter
-	var x509Cred *workloadidentityv1pb.Credential
-	var privateKey crypto.Signer
-	var failures int
-	firstRun := make(chan struct{}, 1)
-	firstRun <- struct{}{}
-	for {
-		var retryAfter <-chan time.Time
-		if failures > 0 {
-			backoffTime := time.Second * time.Duration(math.Pow(2, float64(failures-1)))
-			if backoffTime > time.Minute {
-				backoffTime = time.Minute
-			}
-			backoffTime = jitter(backoffTime)
-			s.log.WarnContext(
-				ctx,
-				"Last attempt to generate output failed, will retry",
-				"retry_after", backoffTime,
-				"failures", failures,
-			)
-			retryAfter = time.After(time.Duration(failures) * time.Second)
-		}
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-retryAfter:
-			s.log.InfoContext(ctx, "Retrying")
-		case <-bundleSet.Stale():
-			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
-			if err != nil {
-				return trace.Wrap(err, "getting trust bundle set")
-			}
-			s.log.InfoContext(ctx, "Trust bundle set has been updated, will regenerate output")
-			if !newBundleSet.Local.Equal(bundleSet.Local) {
-				// If the local trust domain CA has changed, we need to reissue
-				// the SVID.
-				x509Cred = nil
-				privateKey = nil
-			}
-			bundleSet = newBundleSet
-		case <-crlSet.Stale():
-			newCRLSet, err := s.crlCache.GetCRLSet(ctx)
-			if err != nil {
-				return trace.Wrap(err, "getting CRL set from cache")
-			}
-			crlSet = newCRLSet
-			s.log.DebugContext(ctx, "CRL set has been updated, will regenerate output")
-		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
-			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
-			x509Cred = nil
-			privateKey = nil
-		case <-firstRun:
-		}
-
-		if x509Cred == nil || privateKey == nil {
-			var err error
-			x509Cred, privateKey, err = s.requestSVID(ctx)
-			if err != nil {
-				s.log.ErrorContext(ctx, "Failed to request SVID", "error", err)
-				failures++
-				continue
-			}
-		}
-		if err := s.render(
-			ctx, bundleSet, x509Cred, privateKey, crlSet,
-		); err != nil {
-			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
-			failures++
-			continue
-		}
-		failures = 0
-	}
-}
-
-func (s *WorkloadIdentityX509Service) requestSVID(
-	ctx context.Context,
-) (
-	*workloadidentityv1pb.Credential,
-	crypto.Signer,
-	error,
-) {
-	ctx, span := tracer.Start(
-		ctx,
-		"WorkloadIdentityX509Service/requestSVID",
-	)
-	defer span.End()
-
-	roles, err := fetchDefaultRoles(ctx, s.botAuthClient, s.getBotIdentity())
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "fetching roles")
-	}
-
-	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime)
-	id, err := generateIdentity(
-		ctx,
-		s.botAuthClient,
-		s.getBotIdentity(),
-		roles,
-		effectiveLifetime.TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "generating identity")
-	}
-
-	warnOnEarlyExpiration(ctx, s.log.With("output", s), id, effectiveLifetime)
-
-	// create a client that uses the impersonated identity, so that when we
-	// fetch information, we can ensure access rights are enforced.
-	facade := identity.NewFacade(s.botCfg.FIPS, s.botCfg.Insecure, id)
-	impersonatedClient, err := clientForFacade(ctx, s.log, s.botCfg, facade, s.resolver)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	defer impersonatedClient.Close()
-
-	x509Credentials, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
-		ctx,
-		s.log,
-		impersonatedClient,
-		s.cfg.Selector,
-		cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).TTL,
-		nil,
-	)
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "generating X509 SVID")
-	}
-	var x509Credential *workloadidentityv1pb.Credential
-	switch len(x509Credentials) {
-	case 0:
-		return nil, nil, trace.BadParameter("no X509 SVIDs returned")
-	case 1:
-		x509Credential = x509Credentials[0]
-	default:
-		// We could eventually implement some kind of hint selection mechanism
-		// to pick the "right" one.
-		received := make([]string, 0, len(x509Credentials))
-		for _, cred := range x509Credentials {
-			received = append(received,
-				fmt.Sprintf(
-					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
-				),
-			)
-		}
-		return nil, nil, trace.BadParameter(
-			"multiple X509 SVIDs received: %v", received,
-		)
-	}
-
-	return x509Credential, privateKey, nil
-}
-
-func (s *WorkloadIdentityX509Service) render(
-	ctx context.Context,
-	bundleSet *workloadidentity.BundleSet,
-	x509Cred *workloadidentityv1pb.Credential,
-	privateKey crypto.Signer,
-	crlSet *workloadidentity.CRLSet,
-) error {
-	ctx, span := tracer.Start(
-		ctx,
-		"WorkloadIdentityX509Service/render",
-	)
-	defer span.End()
-	s.log.InfoContext(ctx, "Rendering output")
-
-	// Check the ACLs. We can't fix them, but we can warn if they're
-	// misconfigured. We'll need to precompute a list of keys to check.
-	// Note: This may only log a warning, depending on configuration.
-	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
-		return trace.Wrap(err)
-	}
-	// Ensure this destination is also writable. This is a hard fail if
-	// ACLs are misconfigured, regardless of configuration.
-	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
-		return trace.Wrap(err, "verifying destination")
-	}
-
-	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	privPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  pemPrivateKey,
-		Bytes: privBytes,
-	})
-
-	if err := s.cfg.Destination.Write(ctx, config.SVIDKeyPEMPath, privPEM); err != nil {
-		return trace.Wrap(err, "writing svid key")
-	}
-
-	var certPEM bytes.Buffer
-	pem.Encode(&certPEM, &pem.Block{
-		Type:  pemCertificate,
-		Bytes: x509Cred.GetX509Svid().GetCert(),
-	})
-	for _, c := range x509Cred.GetX509Svid().GetChain() {
-		pem.Encode(&certPEM, &pem.Block{
-			Type:  pemCertificate,
-			Bytes: c,
-		})
-	}
-	if err := s.cfg.Destination.Write(ctx, config.SVIDPEMPath, certPEM.Bytes()); err != nil {
-		return trace.Wrap(err, "writing svid certificate")
-	}
-
-	trustBundleBytes, err := bundleSet.Local.X509Bundle().Marshal()
-	if err != nil {
-		return trace.Wrap(err, "marshaling local trust bundle")
-	}
-
-	if s.cfg.IncludeFederatedTrustBundles {
-		for _, federatedBundle := range bundleSet.Federated {
-			federatedBundleBytes, err := federatedBundle.X509Bundle().Marshal()
-			if err != nil {
-				return trace.Wrap(err, "marshaling federated trust bundle (%s)", federatedBundle.TrustDomain().Name())
-			}
-			trustBundleBytes = append(trustBundleBytes, federatedBundleBytes...)
-		}
-	}
-
-	if err := s.cfg.Destination.Write(
-		ctx, config.SVIDTrustBundlePEMPath, trustBundleBytes,
-	); err != nil {
-		return trace.Wrap(err, "writing svid trust bundle")
-	}
-
-	crlBytes := crlSet.Marshal()
-	if len(crlBytes) > 0 {
-		if err := s.cfg.Destination.Write(ctx, config.SVIDCRLPemPath, crlBytes); err != nil {
-			return trace.Wrap(err, "writing CRL")
-		}
-	}
-
-	s.log.InfoContext(
-		ctx,
-		"Successfully wrote X509 workload identity credential to destination",
-		"workload_identity", workloadidentity.WorkloadIdentityLogValue(x509Cred),
-		"destination", s.cfg.Destination.String(),
-	)
-	return nil
-}
diff --git a/lib/tbot/service_workload_identity_x509_test.go b/lib/tbot/service_workload_identity_x509_test.go
deleted file mode 100644
index a7541c2466663..0000000000000
--- a/lib/tbot/service_workload_identity_x509_test.go
+++ /dev/null
@@ -1,225 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package tbot
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/pem"
-	"os"
-	"path"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
-	"github.com/spiffe/go-spiffe/v2/spiffeid"
-	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
-	"github.com/stretchr/testify/require"
-
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/types"
-	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/service"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
-)
-
-func TestBotWorkloadIdentityX509(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	setWorkloadIdentityX509CAOverride(ctx, t, process)
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
-
-	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			WorkloadIdentityLabels: map[string]apiutils.Strings{
-				"foo": []string{"bar"},
-			},
-			Rules: []types.Rule{
-				{
-					Resources: []string{types.KindWorkloadIdentity},
-					Verbs:     []string{types.VerbRead, types.VerbList},
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	role, err = rootClient.UpsertRole(ctx, role)
-	require.NoError(t, err)
-
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
-		Kind:    types.KindWorkloadIdentity,
-		Version: types.V1,
-		Metadata: &headerv1.Metadata{
-			Name: "foo-bar-bizz",
-			Labels: map[string]string{
-				"foo": "bar",
-			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
-				Id: "/valid/{{ user.bot_name }}",
-			},
-		},
-	}
-	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-			WorkloadIdentity: workloadIdentity,
-		})
-	require.NoError(t, err)
-
-	checkCRL := func(t *testing.T, tmpDir string, bundle *x509bundle.Bundle) {
-		crlPEM, err := os.ReadFile(filepath.Join(tmpDir, config.SVIDCRLPemPath))
-		require.NoError(t, err)
-		crlBytes, _ := pem.Decode(crlPEM)
-		crl, err := x509.ParseRevocationList(crlBytes.Bytes)
-		require.NoError(t, err)
-		require.NoError(t, crl.CheckSignatureFrom(bundle.X509Authorities()[0]))
-	}
-
-	t.Run("By Name", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		onboarding, _ := makeBot(t, rootClient, "by-name", role.GetName())
-		botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-			&config.WorkloadIdentityX509Service{
-				Selector: config.WorkloadIdentitySelector{
-					Name: workloadIdentity.GetMetadata().GetName(),
-				},
-				Destination: &config.DestinationDirectory{
-					Path: tmpDir,
-				},
-			},
-		}, defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		})
-		botConfig.Oneshot = true
-		b := New(botConfig, log)
-		// Run Bot with 10 second timeout to catch hangs.
-		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-		defer cancel()
-		require.NoError(t, b.Run(ctx))
-
-		svid, err := x509svid.Load(
-			path.Join(tmpDir, config.SVIDPEMPath),
-			path.Join(tmpDir, config.SVIDKeyPEMPath),
-		)
-		require.NoError(t, err)
-		require.Equal(t, "spiffe://root/valid/by-name", svid.ID.String())
-		// the override includes a chain with a single certificate
-		require.Len(t, svid.Certificates, 2)
-
-		// Validate the trust bundle was written to disk, and, that our SVID
-		// appears valid according to the trust bundle.
-		td := spiffeid.RequireTrustDomainFromString("root")
-		bundle, err := x509bundle.Load(
-			td, filepath.Join(tmpDir, config.SVIDTrustBundlePEMPath),
-		)
-		require.NoError(t, err)
-		_, _, err = x509svid.Verify(svid.Certificates, bundle)
-		require.NoError(t, err)
-
-		checkCRL(t, tmpDir, bundle)
-	})
-	t.Run("By Labels", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		onboarding, _ := makeBot(t, rootClient, "by-labels", role.GetName())
-		botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
-			&config.WorkloadIdentityX509Service{
-				Selector: config.WorkloadIdentitySelector{
-					Labels: map[string][]string{
-						"foo": {"bar"},
-					},
-				},
-				Destination: &config.DestinationDirectory{
-					Path: tmpDir,
-				},
-			},
-		}, defaultBotConfigOpts{
-			useAuthServer: true,
-			insecure:      true,
-		})
-		botConfig.Oneshot = true
-		b := New(botConfig, log)
-		// Run Bot with 10 second timeout to catch hangs.
-		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
-		defer cancel()
-		require.NoError(t, b.Run(ctx))
-
-		svid, err := x509svid.Load(
-			path.Join(tmpDir, config.SVIDPEMPath),
-			path.Join(tmpDir, config.SVIDKeyPEMPath),
-		)
-		require.NoError(t, err)
-		require.Equal(t, "spiffe://root/valid/by-labels", svid.ID.String())
-
-		// Validate the trust bundle was written to disk, and, that our SVID
-		// appears valid according to the trust bundle.
-		td := spiffeid.RequireTrustDomainFromString("root")
-		bundle, err := x509bundle.Load(
-			td, filepath.Join(tmpDir, config.SVIDTrustBundlePEMPath),
-		)
-		require.NoError(t, err)
-		_, _, err = x509svid.Verify(svid.Certificates, bundle)
-		require.NoError(t, err)
-
-		checkCRL(t, tmpDir, bundle)
-	})
-}
-
-func setWorkloadIdentityX509CAOverride(ctx context.Context, t *testing.T, process *service.TeleportProcess) {
-	const loadKeysFalse = false
-	spiffeCA, err := process.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{
-		DomainName: "root",
-		Type:       types.SPIFFECA,
-	}, loadKeysFalse)
-	require.NoError(t, err)
-
-	spiffeCAX509KeyPairs := spiffeCA.GetTrustedTLSKeyPairs()
-	require.Len(t, spiffeCAX509KeyPairs, 1)
-	spiffeCACert, err := tlsca.ParseCertificatePEM(spiffeCAX509KeyPairs[0].Cert)
-	require.NoError(t, err)
-
-	// this is a bit of a hack: by adding the self-signed CA certificate to the
-	// override chain we distribute a nonempty chain that we can test for, but
-	// all validations will continue working and it's technically not a broken
-	// intermediate chain (just a bit of a useless one)
-
-	// (this is an unsynced write but we know that nothing is issuing
-	// certificates just yet)
-	process.GetAuthServer().SetWorkloadIdentityX509CAOverrideGetter(&staticOverrideGetter{chain: [][]byte{spiffeCACert.Raw}})
-}
-
-type staticOverrideGetter struct {
-	chain [][]byte
-}
-
-var _ services.WorkloadIdentityX509CAOverrideGetter = (*staticOverrideGetter)(nil)
-
-// GetWorkloadIdentityX509CAOverride implements [services.WorkloadIdentityX509CAOverrideGetter].
-func (m *staticOverrideGetter) GetWorkloadIdentityX509CAOverride(ctx context.Context, name string, ca *tlsca.CertAuthority) (*tlsca.CertAuthority, [][]byte, error) {
-	return ca, m.chain, nil
-}
diff --git a/lib/tbot/services/application/application.go b/lib/tbot/services/application/application.go
new file mode 100644
index 0000000000000..c2f6534470952
--- /dev/null
+++ b/lib/tbot/services/application/application.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/application")
diff --git a/lib/tbot/services/application/helpers_test.go b/lib/tbot/services/application/helpers_test.go
new file mode 100644
index 0000000000000..95af6a16ad170
--- /dev/null
+++ b/lib/tbot/services/application/helpers_test.go
@@ -0,0 +1,176 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+// makeBot creates a server-side bot and returns joining parameters.
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
+	ctx := context.TODO()
+	t.Helper()
+
+	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: roles,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	require.NoError(t, err)
+	tok, err := types.NewProvisionTokenFromSpec(
+		tokenName,
+		time.Now().Add(10*time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles:   []types.SystemRole{types.RoleBot},
+			BotName: b.Metadata.Name,
+		})
+	require.NoError(t, err)
+	err = client.CreateToken(ctx, tok)
+	require.NoError(t, err)
+
+	return &onboarding.Config{
+		TokenValue: tok.GetName(),
+		JoinMethod: types.JoinMethodToken,
+	}, b
+}
+
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		if err := testenv.WithClusterName("root")(o); err != nil {
+			return err
+		}
+		if err := testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{AddrNetwork: "tcp", Addr: net.JoinHostPort("localhost", strconv.Itoa(cfg.Proxy.WebAddr.Port(0)))},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+		})(o); err != nil {
+			return err
+		}
+		return nil
+	}
+}
diff --git a/lib/tbot/services/application/output_config.go b/lib/tbot/services/application/output_config.go
new file mode 100644
index 0000000000000..a7e900b6a4f40
--- /dev/null
+++ b/lib/tbot/services/application/output_config.go
@@ -0,0 +1,148 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const OutputServiceType = "application"
+
+type OutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	AppName string `yaml:"app_name"`
+
+	// SpecificTLSExtensions creates additional outputs named `tls.crt`,
+	// `tls.key` and `tls.cas`. This is unneeded for most clients which can
+	// be configured with specific paths to use, but exists for compatibility.
+	SpecificTLSExtensions bool `yaml:"specific_tls_naming"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+func (o *OutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+func (o *OutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating configured destination")
+	}
+	if o.AppName == "" {
+		return trace.BadParameter("app_name must not be empty")
+	}
+
+	return nil
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *OutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *OutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (o *OutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *OutputConfig) Describe() []bot.FileDescription {
+	out := []bot.FileDescription{
+		{
+			Name: internal.IdentityFilePath,
+		},
+		{
+			Name: internal.HostCAPath,
+		},
+		{
+			Name: internal.UserCAPath,
+		},
+		{
+			Name: internal.DatabaseCAPath,
+		},
+	}
+	if o.SpecificTLSExtensions {
+		out = append(out, []bot.FileDescription{
+			{
+				Name: internal.DefaultTLSPrefix + ".crt",
+			},
+			{
+				Name: internal.DefaultTLSPrefix + ".key",
+			},
+			{
+				Name: internal.DefaultTLSPrefix + ".cas",
+			},
+		}...)
+	}
+	return out
+}
+
+func (o *OutputConfig) MarshalYAML() (any, error) {
+	type raw OutputConfig
+	return encoding.WithTypeHeader((*raw)(o), OutputServiceType)
+}
+
+func (o *OutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *OutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw OutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *OutputConfig) Type() string {
+	return OutputServiceType
+}
+
+func (o *OutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/application/output_config_test.go b/lib/tbot/services/application/output_config_test.go
new file mode 100644
index 0000000000000..106d8da76786e
--- /dev/null
+++ b/lib/tbot/services/application/output_config_test.go
@@ -0,0 +1,88 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestApplicationOutput_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[OutputConfig]{
+		{
+			name: "full",
+			in: OutputConfig{
+				Destination: dest,
+				Roles:       []string{"access"},
+				AppName:     "my-app",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: OutputConfig{
+				Destination: dest,
+				AppName:     "my-app",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestApplicationOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*OutputConfig]{
+		{
+			name: "valid",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+					Roles:       []string{"access"},
+					AppName:     "app",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: nil,
+					AppName:     "app",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing app_name",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+				}
+			},
+			wantErr: "app_name must not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/application/output_service.go b/lib/tbot/services/application/output_service.go
new file mode 100644
index 0000000000000..77fc6e383c5e8
--- /dev/null
+++ b/lib/tbot/services/application/output_service.go
@@ -0,0 +1,268 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+func OutputServiceBuilder(cfg *OutputConfig, defaultCredentialLifetime bot.CredentialLifetime) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &OutputService{
+			botAuthClient:             deps.Client,
+			getBotIdentity:            deps.BotIdentity,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			reloadCh:                  deps.ReloadCh,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(OutputServiceType, cfg.Name, buildFn)
+}
+
+// OutputService generates the artifacts necessary to connect to a
+// HTTP or TCP application using Teleport.
+type OutputService struct {
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *OutputConfig
+	getBotIdentity            func() *identity.Identity
+	log                       *slog.Logger
+	reloadCh                  <-chan struct{}
+	statusReporter            readyz.Reporter
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+}
+
+func (s *OutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("application-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *OutputService) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *OutputService) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *OutputService) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	}
+	id, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	routeToApp, _, err := getRouteToApp(
+		ctx,
+		s.getBotIdentity(),
+		impersonatedClient,
+		s.cfg.AppName,
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	routedIdentity, err := s.identityGenerator.Generate(ctx, append(identityOpts,
+		identity.WithCurrentIdentityFacade(id),
+		identity.WithRouteToApp(routeToApp),
+	)...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Generated identity for app",
+		"app_name", routeToApp.Name,
+	)
+
+	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// TODO(noah): It's likely the Application output does not really need to
+	// output these CAs - but - for backwards compat reasons, we output them.
+	// Revisit this at a later date and make a call.
+	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(s.render(ctx, routedIdentity, hostCAs, userCAs, databaseCAs), "rendering")
+}
+
+func (s *OutputService) render(
+	ctx context.Context,
+	routedIdentity *identity.Identity,
+	hostCAs, userCAs, databaseCAs []types.CertAuthority,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/render",
+	)
+	defer span.End()
+
+	keyRing, err := internal.NewClientKeyRing(routedIdentity, hostCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := internal.WriteIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "writing identity file")
+	}
+	if err := identity.SaveIdentity(
+		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
+	); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	if s.cfg.SpecificTLSExtensions {
+		if err := internal.WriteIdentityFileTLS(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
+			return trace.Wrap(err, "writing specific tls extension files")
+		}
+	}
+
+	return trace.Wrap(internal.WriteTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs))
+}
+
+func getRouteToApp(
+	ctx context.Context,
+	botIdentity *identity.Identity,
+	client *apiclient.Client,
+	appName string,
+) (proto.RouteToApp, types.Application, error) {
+	ctx, span := tracer.Start(ctx, "getRouteToApp")
+	defer span.End()
+
+	app, err := getApp(ctx, client, appName)
+	if err != nil {
+		return proto.RouteToApp{}, nil, trace.Wrap(err)
+	}
+
+	// TODO(noah): Now that app session ids are no longer being retrieved,
+	// we can begin to cache the routeToApp rather than regenerating this
+	// on each renew in the ApplicationTunnelSvc
+	routeToApp := proto.RouteToApp{
+		Name:        app.GetName(),
+		PublicAddr:  app.GetPublicAddr(),
+		ClusterName: botIdentity.ClusterName,
+	}
+
+	return routeToApp, app, nil
+}
+
+func getApp(ctx context.Context, clt *apiclient.Client, appName string) (types.Application, error) {
+	ctx, span := tracer.Start(ctx, "getApp")
+	defer span.End()
+
+	servers, err := apiclient.GetAllResources[types.AppServer](ctx, clt, &proto.ListResourcesRequest{
+		Namespace:           defaults.Namespace,
+		ResourceType:        types.KindAppServer,
+		PredicateExpression: fmt.Sprintf(`name == "%s"`, appName),
+		Limit:               1,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var apps []types.Application
+	for _, server := range servers {
+		apps = append(apps, server.GetApp())
+	}
+	apps = types.DeduplicateApps(apps)
+
+	if len(apps) == 0 {
+		return nil, trace.BadParameter("app %q not found", appName)
+	}
+
+	return apps[0], nil
+}
diff --git a/lib/tbot/services/application/proxy_config.go b/lib/tbot/services/application/proxy_config.go
new file mode 100644
index 0000000000000..17c4942fb25ca
--- /dev/null
+++ b/lib/tbot/services/application/proxy_config.go
@@ -0,0 +1,103 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"net"
+	"net/url"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+// ProxyServiceType is the type string for the ProxyService, used within the
+// service header to indicate the service type.
+const ProxyServiceType = "application-proxy"
+
+// ProxyServiceConfig is the configuration for the ProxyService.
+type ProxyServiceConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	// Optional.
+	Name string `yaml:"name,omitempty"`
+	// Listen is the address on which application proxy should listen. Example:
+	// - "tcp://127.0.0.1:8080"
+	// - "tcp://0.0.0.0:8080"
+	Listen string `yaml:"listen"`
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed. For the application
+	// proxy, this is primarily an internal detail.
+	CredentialLifetime bot.CredentialLifetime `yaml:"credential_lifetime,omitempty"`
+	// Listener overrides "listen" and directly provides an opened listener to
+	// use. Primarily used for testing.
+	Listener net.Listener `yaml:"-"`
+}
+
+// GetName returns the user-given name of the service for reporting.
+func (c *ProxyServiceConfig) GetName() string {
+	return c.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *ProxyServiceConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Type returns the type of the service.
+func (c *ProxyServiceConfig) Type() string {
+	return ProxyServiceType
+}
+
+// MarshalYAML overrides the YAML representation of the service.
+func (c *ProxyServiceConfig) MarshalYAML() (any, error) {
+	type raw ProxyServiceConfig
+	return encoding.WithTypeHeader((*raw)(c), ProxyServiceType)
+}
+
+// UnmarshalYAML is used to override the YAML unmarshaling of the service.
+func (c *ProxyServiceConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw ProxyServiceConfig
+	if err := node.Decode((*raw)(c)); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// CheckAndSetDefaults checks the user-provided configuration against validation
+// rules and sets any default values.
+func (c *ProxyServiceConfig) CheckAndSetDefaults() error {
+	switch {
+	case c.Listen == "" && c.Listener == nil:
+		return trace.BadParameter("listen: should not be empty")
+	}
+
+	if _, err := url.Parse(c.Listen); err != nil {
+		return trace.Wrap(err, "parsing listen")
+	}
+
+	return nil
+}
+
+// GetCredentialLifetime returns the embedded CredentialLifetime.
+func (c *ProxyServiceConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return c.CredentialLifetime
+}
diff --git a/lib/tbot/services/application/proxy_config_test.go b/lib/tbot/services/application/proxy_config_test.go
new file mode 100644
index 0000000000000..d9aac77d6039f
--- /dev/null
+++ b/lib/tbot/services/application/proxy_config_test.go
@@ -0,0 +1,78 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+func TestProxyServiceConfig_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[ProxyServiceConfig]{
+		{
+			name: "full",
+			in: ProxyServiceConfig{
+				Name:   "foo",
+				Listen: "tcp://0.0.0.0:3621",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestProxyServiceConfig_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*ProxyServiceConfig]{
+		{
+			name: "valid",
+			in: func() *ProxyServiceConfig {
+				return &ProxyServiceConfig{
+					Listen: "tcp://0.0.0.0:3621",
+				}
+			},
+			wantErr: "",
+		},
+		{
+			name: "missing listen",
+			in: func() *ProxyServiceConfig {
+				return &ProxyServiceConfig{}
+			},
+			wantErr: "listen: should not be empty",
+		},
+		{
+			name: "listen not url",
+			in: func() *ProxyServiceConfig {
+				return &ProxyServiceConfig{
+					Listen: "\x00",
+				}
+			},
+			wantErr: "parsing listen",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/application/proxy_service.go b/lib/tbot/services/application/proxy_service.go
new file mode 100644
index 0000000000000..5a7ae14b41444
--- /dev/null
+++ b/lib/tbot/services/application/proxy_service.go
@@ -0,0 +1,377 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"cmp"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// ProxyServiceBuilder returns the service builder used to construct the
+// ProxyService during bot startup.
+func ProxyServiceBuilder(
+	cfg *ProxyServiceConfig,
+	connCfg connection.Config,
+	defaultCredentialLifetime bot.CredentialLifetime,
+	alpnUpgradeCache *internal.ALPNUpgradeCache,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &ProxyService{
+			connCfg:                   connCfg,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			getBotIdentity:            deps.BotIdentity,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			proxyPinger:               deps.ProxyPinger,
+			botClient:                 deps.Client,
+			cfg:                       cfg,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			alpnUpgradeCache:          alpnUpgradeCache,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(ProxyServiceType, cfg.Name, buildFn)
+}
+
+// ProxyService presents a http_proxy compatible proxy on a listener which will
+// forward traffic to applications through Teleport. Unlike the TunnelService
+// it is protocol aware and does not support TCP applications.
+type ProxyService struct {
+	connCfg                   connection.Config
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *ProxyServiceConfig
+	proxyPinger               connection.ProxyPinger
+	log                       *slog.Logger
+	botClient                 *apiclient.Client
+	getBotIdentity            func() *identity.Identity
+	botIdentityReadyCh        <-chan struct{}
+	statusReporter            readyz.Reporter
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+	alpnUpgradeCache          *internal.ALPNUpgradeCache
+
+	cache               *utils.FnCache
+	proxyAddr           string
+	alpnUpgradeRequired bool
+}
+
+// Run runs the service until the context is closed or an error occurs.
+func (s *ProxyService) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "ProxyService/Run")
+	defer span.End()
+
+	l := s.cfg.Listener
+	if l == nil {
+		s.log.DebugContext(
+			ctx, "Opening listener for application proxy",
+			"listen", s.cfg.Listen,
+		)
+		var err error
+		l, err = internal.CreateListener(ctx, s.log, s.cfg.Listen)
+		if err != nil {
+			return trace.Wrap(err, "opening listener")
+		}
+		defer func() {
+			if err := l.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+				s.log.ErrorContext(ctx, "Failed to close listener", "error", err)
+			}
+		}()
+	}
+
+	// Initialize the fnCache
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	fnCache, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL: effectiveLifetime.RenewalInterval,
+	})
+	if err != nil {
+		return trace.Wrap(err, "initializing cache")
+	}
+	s.cache = fnCache
+
+	// Ping the Teleport Proxy
+	proxyPing, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return trace.Wrap(err, "pinging upstream proxy")
+	}
+
+	// Retrieve the Proxy Address to use for the upstream request
+	proxyAddr, err := proxyPing.ProxyWebAddr()
+	if err != nil {
+		return trace.Wrap(err, "determining proxy address from ping response")
+	}
+	s.proxyAddr = proxyAddr
+
+	// Check if ALPN upgrade will be required to pass client certificate to the
+	// proxy.
+	s.alpnUpgradeRequired, err = s.alpnUpgradeCache.IsUpgradeRequired(
+		ctx, proxyAddr, s.connCfg.Insecure,
+	)
+	if err != nil {
+		return trace.Wrap(err, "testing if ALPN connection upgrade is required")
+	}
+
+	httpSrv := http.Server{
+		ReadTimeout:       apidefaults.DefaultIOTimeout,
+		ReadHeaderTimeout: defaults.ReadHeadersTimeout,
+		WriteTimeout:      apidefaults.DefaultIOTimeout,
+		IdleTimeout:       apidefaults.DefaultIdleTimeout,
+		BaseContext: func(net.Listener) context.Context {
+			// Use the main context which controls the service being stopped as
+			// the base context for all incoming requests.
+			return ctx
+		},
+	}
+	httpSrv.Handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		err := s.handleProxyRequest(w, req)
+		if err != nil {
+			trace.WriteError(w, err)
+			s.log.ErrorContext(
+				req.Context(), "Encountered an error while proxying request",
+				"error", err,
+			)
+			return
+		}
+	})
+	s.log.InfoContext(ctx, "Finished initializing")
+
+	var errCh = make(chan error, 1)
+	go func() {
+		s.log.DebugContext(ctx, "Starting proxy request handler goroutine")
+		errCh <- httpSrv.Serve(l)
+	}()
+	s.log.InfoContext(
+		ctx, "Listening for proxy connections",
+		"address", l.Addr().String(),
+	)
+	s.statusReporter.Report(readyz.Healthy)
+
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(httpSrv.Close(), "closing http server")
+	case err := <-errCh:
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return trace.Wrap(err, "local proxy failed")
+	}
+}
+
+// String returns a human friendly representation of the service.
+func (s *ProxyService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s", ProxyServiceType, s.cfg.Listen),
+	)
+}
+
+// issueCert issues a role-impersonated app-routed X509 certificate
+func (s *ProxyService) issueCert(
+	ctx context.Context,
+	appName string,
+) (*tls.Certificate, types.Application, error) {
+	ctx, span := tracer.Start(ctx, "ProxyService/issueCert")
+	defer span.End()
+
+	// TODO(noah): At a later date, we should consider running a background
+	// goroutine that maintains a role-impersonated client. We should probably
+	// make this a generic helper since we have a few services that do this now.
+	// This will avoid the need to create and destroy a client for each new
+	// upstream.
+
+	// Right now we have to redetermine the route to app each time as the
+	// session ID may need to change. Once v17 hits, this will be automagically
+	// calculated by the auth server on cert generation, and we can fetch the
+	// routeToApp once.
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	}
+	impersonatedIdentity, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	impersonatedClient, err := s.clientBuilder.Build(ctx, impersonatedIdentity)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	defer func() {
+		if err := impersonatedClient.Close(); err != nil {
+			s.log.ErrorContext(
+				ctx, "Failed to close impersonated client",
+				"error", err,
+			)
+		}
+	}()
+	route, app, err := getRouteToApp(
+		ctx, s.getBotIdentity(), impersonatedClient, appName,
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	routedIdent, err := s.identityGenerator.Generate(
+		ctx, append(identityOpts, identity.WithRouteToApp(route))...,
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return routedIdent.TLSCert, app, nil
+}
+
+// handleProxyRequest handles incoming HTTP requests to the server.
+//
+// This roughly implements HTTP proxying as defined within RFC2616.
+// On receiving a HTTP request, we determine the upstream target application
+// from the Host header, and issue a certificate for that application. The proxy
+// then makes the upstream request to the Teleport Proxy for that application.
+//
+// It does not support HTTP "tunneling" as defined by RFC2616 via the CONNECT
+// method. CONNECT requests are rejected with a 501 Not Implemented response.
+//
+// We currently do not account for HTTP/2 support because we have an unencrypted
+// listener. By default, http.Server will only support HTTP/2 if TLS is enabled.
+// At a later date, we could add support for h2c with prior-knowledge, but this
+// would introduce significant additional complexity to this proxy - so we shall
+// defer until there is a demonstrated need.
+func (s *ProxyService) handleProxyRequest(w http.ResponseWriter, req *http.Request) error {
+	ctx := req.Context()
+	s.log.DebugContext(
+		ctx, "Received request to proxy",
+		"url", req.URL.String(),
+		"host", req.Host,
+		"method", req.Method,
+		"remote_addr", req.RemoteAddr,
+	)
+
+	// Pre-emptively block CONNECT requests as we do not currently support them
+	// but, proxying them forward as normal requests would make it difficult for
+	// us to introduce CONNECT support later without breaking compat.
+	if req.Method == http.MethodConnect {
+		return trace.NotImplemented("proxy does not support CONNECT method")
+	}
+
+	// net/http implements RFC7230 5.3 correctly, and will prefer the host
+	// specified within an absolute-form request-target over the Host header
+	// when setting req.Host - which means we can safely use req.Host here.
+	appName := req.Host
+
+	var appCert *tls.Certificate
+	var err error
+	appCert, err = utils.FnCacheGet(
+		ctx,
+		s.cache,
+		appName,
+		func(ctx context.Context) (*tls.Certificate, error) {
+			s.log.InfoContext(
+				ctx, "Issuing app cert",
+				"app", appName,
+			)
+			cert, _, err := s.issueCert(ctx, appName)
+			return cert, err
+		})
+	if err != nil {
+		return trace.Wrap(err, "fetching certificate")
+	}
+
+	// TODO(noah): We could cache the httpClient itself for each upstream, this
+	// would potentially allow performance improvements by caching connections.
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{
+			Certificates:       []tls.Certificate{*appCert},
+			InsecureSkipVerify: s.botClient.Config().InsecureSkipVerify,
+		},
+	}
+	// Inject the ALPN upgrade dialer if required.
+	if s.alpnUpgradeRequired {
+		transport.DialContext = apiclient.NewALPNDialer(apiclient.ALPNDialerConfig{
+			ALPNConnUpgradeRequired: true,
+			TLSConfig: &tls.Config{
+				InsecureSkipVerify: s.botClient.Config().InsecureSkipVerify,
+				NextProtos:         []string{string(common.ProtocolHTTP)},
+			},
+		}).DialContext
+	}
+	httpClient := &http.Client{
+		Transport: transport,
+	}
+
+	// Build the Application Request
+	upstreamReq := req.Clone(req.Context())
+	// For now, we redirect all requests to the proxy web's address. However,
+	// it would be a potential improvement for us to switch to fetching the
+	// public address from the App resource. This would reduce the chance of
+	// breakage if the Proxy is eventually modified to consider SNI. The problem
+	// with doing this is that the public address does not include a port, which
+	// we could guess from the Proxy's public web address.
+	upstreamReq.Host = s.proxyAddr
+	upstreamReq.URL.Host = s.proxyAddr
+	upstreamReq.URL.Scheme = "https"
+	// RequestURI must be empty when making client requests.
+	upstreamReq.RequestURI = ""
+	// TODO: Are there any headers we should override, add, or remove on the
+	// upstream request?
+
+	// Execute the upstream request
+	resp, err := httpClient.Do(upstreamReq)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	// Prepare and send the response back to the client
+	// Copy headers first.
+	for key, values := range resp.Header {
+		for _, value := range values {
+			w.Header().Set(key, value)
+		}
+	}
+	// Send status code and then copy the body.
+	w.WriteHeader(resp.StatusCode)
+	if _, err := io.Copy(w, resp.Body); err != nil {
+		return trace.Wrap(err, "copying response body")
+	}
+
+	return nil
+}
diff --git a/lib/tbot/services/application/proxy_service_test.go b/lib/tbot/services/application/proxy_service_test.go
new file mode 100644
index 0000000000000..3d7fadac39e7d
--- /dev/null
+++ b/lib/tbot/services/application/proxy_service_test.go
@@ -0,0 +1,292 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+// Struct to encapsulate the request the HTTP Test Server got.
+// It contains the request and the extracted body, since the default golang HTTP Server closes the body io stream.
+type proxyReqRes struct {
+	request *http.Request
+	body    []byte
+}
+
+func TestE2E_ApplicationProxyService(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	log := logtest.NewLogger()
+
+	// Spin up a test HTTP server
+	receivedRequestsCh := make(chan proxyReqRes, 1)
+
+	// Spin up 2 servers
+	httpSrvA := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Capture the requestBody
+		requestBody, err := io.ReadAll(r.Body)
+		if err != nil {
+			return
+		}
+
+		// Copy the request and the received body into the channel.
+		// We do this because the default http server closes the body io stream to clear the memory.
+		receivedRequestsCh <- proxyReqRes{
+			request: r,
+			body:    requestBody,
+		}
+
+		w.Header().Set("X-From-Server", "server-a-header-value")
+		w.WriteHeader(http.StatusTeapot)
+		w.Write([]byte("hello from server a"))
+	}))
+	t.Cleanup(httpSrvA.Close)
+
+	httpSrvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Capture the requestBody
+		requestBody, err := io.ReadAll(r.Body)
+		if err != nil {
+			return
+		}
+
+		// Copy the request and the received body into the channel.
+		// We do this because the default http server closes the body io stream to clear the memory.
+		receivedRequestsCh <- proxyReqRes{
+			request: r,
+			body:    requestBody,
+		}
+		w.Header().Set("X-From-Server", "server-b-header-value")
+		w.WriteHeader(http.StatusTeapot)
+		w.Write([]byte("hello from server b"))
+	}))
+	t.Cleanup(httpSrvB.Close)
+
+	// Make a new auth server.
+	appNameA := "app-a"
+	appNameB := "app-b"
+
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Apps.Enabled = true
+			cfg.Apps.Apps = []servicecfg.App{
+				{
+					Name: appNameA,
+					URI:  httpSrvA.URL,
+				},
+				{
+					Name: appNameB,
+					URI:  httpSrvB.URL,
+				},
+			}
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	// Create role that allows the bot to access the app.
+	role, err := types.NewRole("app-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(t.Context(), role)
+	require.NoError(t, err)
+
+	botListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		botListener.Close()
+	})
+
+	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
+
+	proxyAddr, err := process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	proxyServiceConfig := &ProxyServiceConfig{
+		Listen:   "localhost:12345",
+		Listener: botListener,
+	}
+
+	connCfg := connection.Config{
+		Address:     proxyAddr.Addr,
+		AddressKind: connection.AddressKindProxy,
+		Insecure:    true,
+	}
+	alpnUpgradeCache := internal.NewALPNUpgradeCache(log)
+	b, err := bot.New(bot.Config{
+		Connection: connCfg,
+		Logger:     log,
+		Onboarding: *onboarding,
+		Services: []bot.ServiceBuilder{
+			ProxyServiceBuilder(
+				proxyServiceConfig,
+				connCfg,
+				bot.DefaultCredentialLifetime,
+				alpnUpgradeCache,
+			),
+		},
+	})
+	require.NoError(t, err)
+
+	// Spin up goroutine for bot to run in
+	ctx, cancel := context.WithCancel(ctx)
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := b.Run(ctx)
+		assert.NoError(t, err, "bot should not exit with error")
+		cancel()
+	}()
+	t.Cleanup(func() {
+		// Shut down bot and make sure it exits.
+		cancel()
+		wg.Wait()
+	})
+
+	httpClient := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(&url.URL{
+				Scheme: "http",
+				Host:   botListener.Addr().String(),
+			}),
+		},
+	}
+
+	// We can't predict exactly when the tunnel will be ready so we use
+	// EventuallyWithT to retry.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		requestUrl, _ := url.Parse("http://" + appNameA)
+		request := &http.Request{
+			URL: requestUrl,
+		}
+		resp, err := httpClient.Do(request)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer resp.Body.Close()
+		// Drain channel since we don't care to much about this first request.
+		<-receivedRequestsCh
+	}, 10*time.Second, 1*time.Second)
+
+	// Request A
+	outgoingReqA := &http.Request{
+		Method: http.MethodPost,
+		Body:   io.NopCloser(bytes.NewReader([]byte("hello from client"))),
+		Header: http.Header{
+			"X-From-Client": []string{"client-header-value"},
+		},
+		URL: &url.URL{
+			Scheme:   "http",
+			Host:     appNameA,
+			Path:     "/some/path",
+			RawQuery: "queryParam=value-a",
+		},
+	}
+	outgoingReqA = outgoingReqA.WithContext(ctx)
+	resp, err := httpClient.Do(outgoingReqA)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	// Assert server received the request we sent
+	proxyRequestResponseA := <-receivedRequestsCh
+	serverGotReqA := proxyRequestResponseA.request
+	require.NotNil(t, serverGotReqA)
+	require.Equal(t, http.MethodPost, serverGotReqA.Method)
+	require.Equal(t, "client-header-value", serverGotReqA.Header.Get("X-From-Client"))
+	require.Equal(t, outgoingReqA.URL.Path, serverGotReqA.URL.Path)
+	require.Equal(t, "hello from client", string(proxyRequestResponseA.body))
+	require.Equal(t, "value-a", serverGotReqA.URL.Query().Get("queryParam"))
+
+	// Assert client receives the response the server sent
+	require.Equal(t, http.StatusTeapot, resp.StatusCode)
+	require.Equal(t, "server-a-header-value", resp.Header.Get("X-From-Server"))
+	respBody, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "hello from server a", string(respBody))
+
+	// Request B
+	outgoingReqB := &http.Request{
+		Method: http.MethodPost,
+		Body:   io.NopCloser(bytes.NewReader([]byte("hello from client"))),
+		Header: http.Header{
+			"X-From-Client": []string{"client-header-value"},
+		},
+		URL: &url.URL{
+			Scheme:   "http",
+			Host:     appNameB,
+			Path:     "/some/path",
+			RawQuery: "queryParam=value-b",
+		},
+	}
+	outgoingReqB = outgoingReqB.WithContext(ctx)
+	resp, err = httpClient.Do(outgoingReqB)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	// Assert server received the request we sent
+	proxyRequestResponseB := <-receivedRequestsCh
+	serverGotReqB := proxyRequestResponseB.request
+	require.NotNil(t, serverGotReqB)
+	require.Equal(t, http.MethodPost, serverGotReqB.Method)
+	require.Equal(t, "client-header-value", serverGotReqB.Header.Get("X-From-Client"))
+	require.Equal(t, outgoingReqB.URL.Path, serverGotReqB.URL.Path)
+	require.Equal(t, "hello from client", string(proxyRequestResponseB.body))
+	require.Equal(t, "value-b", serverGotReqB.URL.Query().Get("queryParam"))
+
+	// Assert client receives the response the server sent
+	require.Equal(t, http.StatusTeapot, resp.StatusCode)
+	require.Equal(t, "server-b-header-value", resp.Header.Get("X-From-Server"))
+	respBody, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "hello from server b", string(respBody))
+}
diff --git a/lib/tbot/config/testdata/TestApplicationOutput_YAML/full.golden b/lib/tbot/services/application/testdata/TestApplicationOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestApplicationOutput_YAML/full.golden
rename to lib/tbot/services/application/testdata/TestApplicationOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestApplicationOutput_YAML/minimal.golden b/lib/tbot/services/application/testdata/TestApplicationOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestApplicationOutput_YAML/minimal.golden
rename to lib/tbot/services/application/testdata/TestApplicationOutput_YAML/minimal.golden
diff --git a/lib/tbot/config/testdata/TestApplicationTunnelService_YAML/full.golden b/lib/tbot/services/application/testdata/TestApplicationTunnelService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestApplicationTunnelService_YAML/full.golden
rename to lib/tbot/services/application/testdata/TestApplicationTunnelService_YAML/full.golden
diff --git a/lib/tbot/services/application/testdata/TestProxyServiceConfig_YAML/full.golden b/lib/tbot/services/application/testdata/TestProxyServiceConfig_YAML/full.golden
new file mode 100644
index 0000000000000..9cde026244e07
--- /dev/null
+++ b/lib/tbot/services/application/testdata/TestProxyServiceConfig_YAML/full.golden
@@ -0,0 +1,6 @@
+type: application-proxy
+name: foo
+listen: tcp://0.0.0.0:3621
+credential_lifetime:
+  credential_ttl: 1m0s
+  renewal_interval: 30s
diff --git a/lib/tbot/services/application/tunnel_config.go b/lib/tbot/services/application/tunnel_config.go
new file mode 100644
index 0000000000000..1882f3ed8969f
--- /dev/null
+++ b/lib/tbot/services/application/tunnel_config.go
@@ -0,0 +1,102 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"net"
+	"net/url"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const TunnelServiceType = "application-tunnel"
+
+// TunnelConfig opens an authenticated tunnel for Application
+// Access.
+type TunnelConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Listen is the address on which database tunnel should listen. Example:
+	// - "tcp://127.0.0.1:3306"
+	// - "tcp://0.0.0.0:3306
+	Listen string `yaml:"listen"`
+	// Roles is the list of roles to request for the tunnel.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+	// AppName should be the name of the application as registered in Teleport
+	// that you wish to tunnel to.
+	AppName string `yaml:"app_name"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+
+	// Listener overrides "listen" and directly provides an opened listener to
+	// use.
+	Listener net.Listener `yaml:"-"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *TunnelConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *TunnelConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (s *TunnelConfig) Type() string {
+	return TunnelServiceType
+}
+
+func (s *TunnelConfig) MarshalYAML() (any, error) {
+	type raw TunnelConfig
+	return encoding.WithTypeHeader((*raw)(s), TunnelServiceType)
+}
+
+func (s *TunnelConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw TunnelConfig
+	if err := node.Decode((*raw)(s)); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *TunnelConfig) CheckAndSetDefaults() error {
+	switch {
+	case s.Listen == "" && s.Listener == nil:
+		return trace.BadParameter("listen: should not be empty")
+	case s.AppName == "":
+		return trace.BadParameter("app_name: should not be empty")
+	}
+	if _, err := url.Parse(s.Listen); err != nil {
+		return trace.Wrap(err, "parsing listen")
+	}
+	return nil
+}
+
+func (o *TunnelConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/application/tunnel_config_test.go b/lib/tbot/services/application/tunnel_config_test.go
new file mode 100644
index 0000000000000..c53ff8d5d0566
--- /dev/null
+++ b/lib/tbot/services/application/tunnel_config_test.go
@@ -0,0 +1,95 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+func TestApplicationTunnelService_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[TunnelConfig]{
+		{
+			name: "full",
+			in: TunnelConfig{
+				Listen:  "tcp://0.0.0.0:3621",
+				AppName: "my-app",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestApplicationTunnelService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*TunnelConfig]{
+		{
+			name: "valid",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:  "tcp://0.0.0.0:3621",
+					Roles:   []string{"role1", "role2"},
+					AppName: "my-app",
+				}
+			},
+			wantErr: "",
+		},
+		{
+			name: "missing listen",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Roles:   []string{"role1", "role2"},
+					AppName: "my-app",
+				}
+			},
+			wantErr: "listen: should not be empty",
+		},
+		{
+			name: "listen not url",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:  "\x00",
+					Roles:   []string{"role1", "role2"},
+					AppName: "my-app",
+				}
+			},
+			wantErr: "parsing listen",
+		},
+		{
+			name: "missing app name",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen: "tcp://0.0.0.0:3621",
+					Roles:  []string{"role1", "role2"},
+				}
+			},
+			wantErr: "app_name: should not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/application/tunnel_service.go b/lib/tbot/services/application/tunnel_service.go
new file mode 100644
index 0000000000000..3098b0afa89ce
--- /dev/null
+++ b/lib/tbot/services/application/tunnel_service.go
@@ -0,0 +1,277 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"cmp"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TunnelServiceBuilder(
+	cfg *TunnelConfig,
+	connCfg connection.Config,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &TunnelService{
+			connCfg:                   connCfg,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			getBotIdentity:            deps.BotIdentity,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			proxyPinger:               deps.ProxyPinger,
+			botClient:                 deps.Client,
+			cfg:                       cfg,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(TunnelServiceType, cfg.Name, buildFn)
+}
+
+// TunnelService is a service that listens on a socket and forwards
+// traffic to an application registered in Teleport Application Access. It is
+// an authenticating tunnel and will automatically issue and renew certificates
+// as needed.
+type TunnelService struct {
+	connCfg                   connection.Config
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *TunnelConfig
+	proxyPinger               connection.ProxyPinger
+	log                       *slog.Logger
+	botClient                 *apiclient.Client
+	getBotIdentity            func() *identity.Identity
+	botIdentityReadyCh        <-chan struct{}
+	statusReporter            readyz.Reporter
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+}
+
+func (s *TunnelService) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "TunnelService/Run")
+	defer span.End()
+
+	l := s.cfg.Listener
+	if l == nil {
+		s.log.DebugContext(ctx, "Opening listener for application tunnel", "listen", s.cfg.Listen)
+		var err error
+		l, err = internal.CreateListener(ctx, s.log, s.cfg.Listen)
+		if err != nil {
+			return trace.Wrap(err, "opening listener")
+		}
+		defer func() {
+			if err := l.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+				s.log.ErrorContext(ctx, "Failed to close listener", "error", err)
+			}
+		}()
+	}
+
+	lpCfg, err := s.buildLocalProxyConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err, "building local proxy config")
+	}
+	lpCfg.Listener = l
+
+	lp, err := alpnproxy.NewLocalProxy(lpCfg)
+	if err != nil {
+		return trace.Wrap(err, "creating local proxy")
+	}
+	defer func() {
+		if err := lp.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Failed to close local proxy", "error", err)
+		}
+	}()
+	// Closed further down.
+
+	// lp.Start will block and continues to block until lp.Close() is called.
+	// Despite taking a context, it will not exit until the first connection is
+	// made after the context is canceled.
+	var errCh = make(chan error, 1)
+	go func() {
+		errCh <- lp.Start(ctx)
+	}()
+	s.log.InfoContext(ctx, "Listening for connections.", "address", l.Addr().String())
+
+	s.statusReporter.Report(readyz.Healthy)
+
+	select {
+	case <-ctx.Done():
+		return nil
+	case err := <-errCh:
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return trace.Wrap(err, "local proxy failed")
+	}
+}
+
+func alpnProtocolForApp(app types.Application) common.Protocol {
+	if app.IsTCP() {
+		return common.ProtocolTCP
+	}
+	return common.ProtocolHTTP
+}
+
+// buildLocalProxyConfig initializes the service, fetching any initial information and setting
+// up the localproxy.
+func (s *TunnelService) buildLocalProxyConfig(ctx context.Context) (lpCfg alpnproxy.LocalProxyConfig, err error) {
+	ctx, span := tracer.Start(ctx, "TunnelService/buildLocalProxyConfig")
+	defer span.End()
+
+	if s.botIdentityReadyCh != nil {
+		select {
+		case <-s.botIdentityReadyCh:
+		default:
+			s.log.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-s.botIdentityReadyCh:
+			case <-ctx.Done():
+				return alpnproxy.LocalProxyConfig{}, ctx.Err()
+			}
+		}
+	}
+
+	proxyPing, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "pinging proxy")
+	}
+	proxyAddr, err := proxyPing.ProxyWebAddr()
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "determining proxy web addr")
+	}
+
+	s.log.DebugContext(ctx, "Issuing initial certificate for local proxy.")
+	appCert, app, err := s.issueCert(ctx)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
+	}
+	s.log.DebugContext(ctx, "Issued initial certificate for local proxy.")
+
+	middleware := internal.ALPNProxyMiddleware{
+		OnNewConnectionFunc: func(ctx context.Context, lp *alpnproxy.LocalProxy) error {
+			ctx, span := tracer.Start(ctx, "TunnelService/OnNewConnection")
+			defer span.End()
+
+			if err := lp.CheckCertExpiry(ctx); err != nil {
+				s.log.InfoContext(ctx, "Certificate for tunnel needs reissuing.", "reason", err.Error())
+				cert, _, err := s.issueCert(ctx)
+				if err != nil {
+					return trace.Wrap(err, "issuing cert")
+				}
+				lp.SetCert(*cert)
+			}
+			return nil
+		},
+	}
+
+	lpConfig := alpnproxy.LocalProxyConfig{
+		Middleware: middleware,
+
+		RemoteProxyAddr:    proxyAddr,
+		ParentContext:      ctx,
+		Protocols:          []common.Protocol{alpnProtocolForApp(app)},
+		Cert:               *appCert,
+		InsecureSkipVerify: s.connCfg.Insecure,
+	}
+	if apiclient.IsALPNConnUpgradeRequired(
+		ctx,
+		proxyAddr,
+		s.connCfg.Insecure,
+	) {
+		lpConfig.ALPNConnUpgradeRequired = true
+		// If ALPN Conn Upgrade will be used, we need to set the cluster CAs
+		// to validate the Proxy's auth issued host cert.
+		lpConfig.RootCAs = s.getBotIdentity().TLSCAPool
+	}
+
+	return lpConfig, nil
+}
+
+func (s *TunnelService) issueCert(
+	ctx context.Context,
+) (*tls.Certificate, types.Application, error) {
+	ctx, span := tracer.Start(ctx, "TunnelService/issueCert")
+	defer span.End()
+
+	// Right now we have to redetermine the route to app each time as the
+	// session ID may need to change. Once v17 hits, this will be automagically
+	// calculated by the auth server on cert generation, and we can fetch the
+	// routeToApp once.
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	}
+	impersonatedIdentity, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	impersonatedClient, err := s.clientBuilder.Build(ctx, impersonatedIdentity)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	defer func() {
+		if err := impersonatedClient.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Failed to close impersonated client.", "error", err)
+		}
+	}()
+	route, app, err := getRouteToApp(ctx, s.getBotIdentity(), impersonatedClient, s.cfg.AppName)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	s.log.DebugContext(ctx, "Requesting issuance of certificate for tunnel proxy.")
+	routedIdent, err := s.identityGenerator.Generate(ctx, append(identityOpts, identity.WithRouteToApp(route))...)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	s.log.InfoContext(ctx, "Certificate issued for tunnel proxy.")
+
+	return routedIdent.TLSCert, app, nil
+}
+
+// String returns a human-readable string that can uniquely identify the
+// service.
+func (s *TunnelService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s:%s", TunnelServiceType, s.cfg.Listen, s.cfg.AppName),
+	)
+}
diff --git a/lib/tbot/services/application/tunnel_service_test.go b/lib/tbot/services/application/tunnel_service_test.go
new file mode 100644
index 0000000000000..8e74c6d2c1961
--- /dev/null
+++ b/lib/tbot/services/application/tunnel_service_test.go
@@ -0,0 +1,162 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package application
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestE2E_ApplicationTunnelService(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	// Spin up a test HTTP server
+	wantStatus := http.StatusTeapot
+	wantBody := []byte("hello this is a test")
+	httpSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(wantStatus)
+		w.Write(wantBody)
+	}))
+	t.Cleanup(httpSrv.Close)
+
+	// Make a new auth server.
+	appName := "my-test-app"
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Apps.Enabled = true
+			cfg.Apps.Apps = []servicecfg.App{
+				{
+					Name: appName,
+					URI:  httpSrv.URL,
+				},
+			}
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	// Create role that allows the bot to access the app.
+	role, err := types.NewRole("app-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(t.Context(), role)
+	require.NoError(t, err)
+
+	botListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		botListener.Close()
+	})
+
+	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
+
+	proxyAddr, err := process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	connCfg := connection.Config{
+		Address:     proxyAddr.Addr,
+		AddressKind: connection.AddressKindProxy,
+		Insecure:    true,
+	}
+	b, err := bot.New(bot.Config{
+		Connection: connCfg,
+		Logger:     log,
+		Onboarding: *onboarding,
+		Services: []bot.ServiceBuilder{
+			TunnelServiceBuilder(
+				&TunnelConfig{
+					Listener: botListener,
+					AppName:  appName,
+				},
+				connCfg,
+				bot.DefaultCredentialLifetime,
+			),
+		},
+	})
+	require.NoError(t, err)
+
+	// Spin up goroutine for bot to run in
+	ctx, cancel := context.WithCancel(ctx)
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := b.Run(ctx)
+		assert.NoError(t, err, "bot should not exit with error")
+		cancel()
+	}()
+	t.Cleanup(func() {
+		// Shut down bot and make sure it exits.
+		cancel()
+		wg.Wait()
+	})
+
+	// We can't predict exactly when the tunnel will be ready so we use
+	// EventuallyWithT to retry.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		proxyUrl := url.URL{
+			Scheme: "http",
+			Host:   botListener.Addr().String(),
+		}
+		resp, err := http.Get(proxyUrl.String())
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer resp.Body.Close()
+		assert.Equal(t, wantStatus, resp.StatusCode)
+		body, err := io.ReadAll(resp.Body)
+		if !assert.NoError(t, err) {
+			return
+		}
+		assert.Equal(t, wantBody, body)
+	}, 10*time.Second, 100*time.Millisecond)
+}
diff --git a/lib/tbot/services/awsra/config.go b/lib/tbot/services/awsra/config.go
new file mode 100644
index 0000000000000..c6434d1bda353
--- /dev/null
+++ b/lib/tbot/services/awsra/config.go
@@ -0,0 +1,212 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/api/utils/aws"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	ServiceType                      = "workload-identity-aws-roles-anywhere"
+	DefaultAWSSessionDuration        = 6 * time.Hour
+	MaxAWSSessionDuration            = 12 * time.Hour
+	DefaultAWSSessionRenewalInterval = 1 * time.Hour
+)
+
+// Config is the configuration for the Workload Identity AWS Roles Anywhere service.
+type Config struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Selector is the selector for the WorkloadIdentity resource that will be
+	// used to issue WICs.
+	Selector bot.WorkloadIdentitySelector `yaml:"selector"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+
+	// RoleARN is the ARN of the role to assume.
+	// Example: `arn:aws:iam::123456789012:role/example-role`
+	// Required.
+	RoleARN string `yaml:"role_arn"`
+	// ProfileARN is the ARN of the Roles Anywhere profile to use.
+	// Example: `arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000`
+	// Required.
+	ProfileARN string `yaml:"profile_arn"`
+	// TrustAnchorARN is the ARN of the Roles Anywhere trust anchor to use.
+	// Example: `arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000`
+	// Required.
+	TrustAnchorARN string `yaml:"trust_anchor_arn"`
+	// Region is the AWS region to use.
+	// Example: `us-east-1`
+	// Must be set here or in the environment or AWS config using the
+	// `AWS_REGION` environment variable. If set here, this will override the
+	// environment or AWS config.
+	Region string `yaml:"region"`
+
+	// SessionDuration is the duration of the resulting AWS session and
+	// credentials. This may be up to 12 hours. When unset, this defaults to
+	// 6 hours.
+	SessionDuration time.Duration `yaml:"session_duration"`
+	// SessionRenewalInterval is the interval at which the session should be
+	// renewed. This should be less than the session duration. When unset, this
+	// defaults to 1 hour.
+	SessionRenewalInterval time.Duration `yaml:"session_renewal_interval"`
+
+	// CredentialProfileName is the name of the AWS credentials profile to
+	// write to. If unspecified, the profile will be named "default".
+	CredentialProfileName string `yaml:"credential_profile_name,omitempty"`
+
+	// ArtifactName is the name of the artifact to write to. This is the
+	// filename of the file that will be written to the destination. This is
+	// by default "aws_credentials".
+	ArtifactName string `yaml:"artifact_name,omitempty"`
+	// OverwriteCredentialFile is a flag that indicates whether the output
+	// should overwrite the existing credentials file rather than merging with
+	// it.
+	OverwriteCredentialFile bool `yaml:"overwrite_credential_file,omitempty"`
+
+	// ClientOverride is designed to be leveraged by tests and unset in
+	// production circumstances.
+	ClientOverride utils.HTTPDoClient `yaml:"-"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *Config) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *Config) SetName(name string) {
+	o.Name = name
+}
+
+// Init initializes the destination.
+func (o *Config) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+// CheckAndSetDefaults checks the WorkloadIdentityAWSRAService values and sets any defaults.
+func (o *Config) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	if err := o.Selector.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating selector")
+	}
+
+	switch {
+	case o.RoleARN == "":
+		return trace.BadParameter("role_arn: must be set")
+	case o.ProfileARN == "":
+		return trace.BadParameter("profile_arn: must be set")
+	case o.TrustAnchorARN == "":
+		return trace.BadParameter("trust_anchor_arn: must be set")
+	}
+	if _, err := arn.Parse(o.RoleARN); err != nil {
+		return trace.Wrap(err, "parsing role_arn")
+	}
+	if _, err := arn.Parse(o.ProfileARN); err != nil {
+		return trace.Wrap(err, "parsing profile_arn")
+	}
+	if _, err := arn.Parse(o.TrustAnchorARN); err != nil {
+		return trace.Wrap(err, "parsing trust_anchor_arn")
+	}
+	if o.Region != "" {
+		if err := aws.IsValidRegion(o.Region); err != nil {
+			return trace.Wrap(err, "validating region")
+		}
+	}
+
+	if o.SessionDuration == 0 {
+		o.SessionDuration = DefaultAWSSessionDuration
+	}
+	if o.SessionDuration > MaxAWSSessionDuration {
+		return trace.BadParameter("session_duration: must be less than or equal to 12 hours")
+	}
+	if o.SessionRenewalInterval == 0 {
+		o.SessionRenewalInterval = DefaultAWSSessionRenewalInterval
+	}
+	if o.SessionRenewalInterval >= o.SessionDuration {
+		return trace.BadParameter("session_renewal_interval: must be less than session_duration")
+	}
+
+	return nil
+}
+
+// Describe returns the file descriptions for the service.
+func (o *Config) Describe() []bot.FileDescription {
+	// TODO: this is wrong/has been copy pasted from the JWT-SVID output.
+	fds := []bot.FileDescription{
+		{
+			Name: internal.JWTSVIDPath,
+		},
+	}
+	return fds
+}
+
+func (o *Config) Type() string {
+	return ServiceType
+}
+
+// MarshalYAML marshals the WorkloadIdentityJWTService into YAML.
+func (o *Config) MarshalYAML() (any, error) {
+	type raw Config
+	return encoding.WithTypeHeader((*raw)(o), ServiceType)
+}
+
+func (o *Config) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *Config) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw Config
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+// GetDestination returns the destination.
+func (o *Config) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *Config) GetCredentialLifetime() bot.CredentialLifetime {
+	return bot.CredentialLifetime{}
+}
diff --git a/lib/tbot/services/awsra/config_test.go b/lib/tbot/services/awsra/config_test.go
new file mode 100644
index 0000000000000..0c5a67f5ee065
--- /dev/null
+++ b/lib/tbot/services/awsra/config_test.go
@@ -0,0 +1,328 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package awsra
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+)
+
+func TestWorkloadIdentityAWSRAService_YAML(t *testing.T) {
+	t.Parallel()
+
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[Config]{
+		{
+			name: "full",
+			in: Config{
+				Destination: dest,
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				SessionDuration:         time.Minute * 59,
+				SessionRenewalInterval:  time.Minute * 29,
+				RoleARN:                 "arn:aws:iam::123456789012:role/example-role",
+				TrustAnchorARN:          "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+				ProfileARN:              "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+				Region:                  "us-east-1",
+				CredentialProfileName:   "my-profile",
+				ArtifactName:            "my-artifact.toml",
+				OverwriteCredentialFile: true,
+			},
+		},
+		{
+			name: "simple",
+			in: Config{
+				Destination: dest,
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				SessionDuration:        time.Minute * 59,
+				SessionRenewalInterval: time.Minute * 29,
+				RoleARN:                "arn:aws:iam::123456789012:role/example-role",
+				TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+				ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+				Region:                 "us-east-1",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestWorkloadIdentityAWSRAService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*Config]{
+		{
+			name: "valid",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			want: &Config{
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				Destination: &destination.Directory{
+					Path:     "/opt/machine-id",
+					ACLs:     botfs.ACLOff,
+					Symlinks: botfs.SymlinksInsecure,
+				},
+				SessionDuration:        DefaultAWSSessionDuration,
+				SessionRenewalInterval: DefaultAWSSessionRenewalInterval,
+				RoleARN:                "arn:aws:iam::123456789012:role/example-role",
+				TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+				ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+				Region:                 "us-east-1",
+			},
+		},
+		{
+			name: "valid with labels",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					SessionDuration:        1 * time.Hour,
+					SessionRenewalInterval: 30 * time.Minute,
+					RoleARN:                "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN:         "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:             "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:                 "us-east-1",
+				}
+			},
+		},
+		{
+			name: "missing selectors",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "one of ['name', 'labels'] must be set",
+		},
+		{
+			name: "too many selectors",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "at most one of ['name', 'labels'] can be set",
+		},
+		{
+			name: "missing destination",
+			in: func() *Config {
+				return &Config{
+					Destination: nil,
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing role_arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "role_arn: must be set",
+		},
+		{
+			name: "missing trust_anchor_arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:    "arn:aws:iam::123456789012:role/example-role",
+					ProfileARN: "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:     "us-east-1",
+				}
+			},
+			wantErr: "trust_anchor_arn: must be set",
+		},
+		{
+			name: "missing profile_arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "profile_arn: must be set",
+		},
+		{
+			name: "invalid role arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "foo",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "arn: invalid prefix",
+		},
+		{
+			name: "invalid trust anchor arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "foo",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "arn: invalid prefix",
+		},
+		{
+			name: "invalid profile arn",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "foo",
+					Region:         "us-east-1",
+				}
+			},
+			wantErr: "arn: invalid prefix",
+		},
+		{
+			name: "invalid region",
+			in: func() *Config {
+				return &Config{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					RoleARN:        "arn:aws:iam::123456789012:role/example-role",
+					TrustAnchorARN: "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000",
+					ProfileARN:     "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000",
+					Region:         "us-east-1!!!!",
+				}
+			},
+			wantErr: "validating region",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/awsra/helpers_test.go b/lib/tbot/services/awsra/helpers_test.go
new file mode 100644
index 0000000000000..b1ba32a45820f
--- /dev/null
+++ b/lib/tbot/services/awsra/helpers_test.go
@@ -0,0 +1,213 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+func setWorkloadIdentityX509CAOverride(ctx context.Context, t *testing.T, process *service.TeleportProcess) {
+	const loadKeysFalse = false
+	spiffeCA, err := process.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{
+		DomainName: "root",
+		Type:       types.SPIFFECA,
+	}, loadKeysFalse)
+	require.NoError(t, err)
+
+	spiffeCAX509KeyPairs := spiffeCA.GetTrustedTLSKeyPairs()
+	require.Len(t, spiffeCAX509KeyPairs, 1)
+	spiffeCACert, err := tlsca.ParseCertificatePEM(spiffeCAX509KeyPairs[0].Cert)
+	require.NoError(t, err)
+
+	// this is a bit of a hack: by adding the self-signed CA certificate to the
+	// override chain we distribute a nonempty chain that we can test for, but
+	// all validations will continue working and it's technically not a broken
+	// intermediate chain (just a bit of a useless one)
+
+	// (this is an unsynced write but we know that nothing is issuing
+	// certificates just yet)
+	process.GetAuthServer().SetWorkloadIdentityX509CAOverrideGetter(&staticOverrideGetter{chain: [][]byte{spiffeCACert.Raw}})
+}
+
+type staticOverrideGetter struct {
+	chain [][]byte
+}
+
+var _ services.WorkloadIdentityX509CAOverrideGetter = (*staticOverrideGetter)(nil)
+
+// GetWorkloadIdentityX509CAOverride implements [services.WorkloadIdentityX509CAOverrideGetter].
+func (m *staticOverrideGetter) GetWorkloadIdentityX509CAOverride(ctx context.Context, name string, ca *tlsca.CertAuthority) (*tlsca.CertAuthority, [][]byte, error) {
+	return ca, m.chain, nil
+}
+
+// makeBot creates a server-side bot and returns joining parameters.
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
+	ctx := context.TODO()
+	t.Helper()
+
+	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: roles,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	require.NoError(t, err)
+	tok, err := types.NewProvisionTokenFromSpec(
+		tokenName,
+		time.Now().Add(10*time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles:   []types.SystemRole{types.RoleBot},
+			BotName: b.Metadata.Name,
+		})
+	require.NoError(t, err)
+	err = client.CreateToken(ctx, tok)
+	require.NoError(t, err)
+
+	return &onboarding.Config{
+		TokenValue: tok.GetName(),
+		JoinMethod: types.JoinMethodToken,
+	}, b
+}
+
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		if err := testenv.WithClusterName("root")(o); err != nil {
+			return err
+		}
+		if err := testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{AddrNetwork: "tcp", Addr: net.JoinHostPort("localhost", strconv.Itoa(cfg.Proxy.WebAddr.Port(0)))},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+		})(o); err != nil {
+			return err
+		}
+		return nil
+	}
+}
diff --git a/lib/tbot/services/awsra/service.go b/lib/tbot/services/awsra/service.go
new file mode 100644
index 0000000000000..877156ddc8774
--- /dev/null
+++ b/lib/tbot/services/awsra/service.go
@@ -0,0 +1,327 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package awsra
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
+	"go.opentelemetry.io/otel"
+	"gopkg.in/ini.v1"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+)
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/awsra")
+
+func ServiceBuilder(cfg *Config) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &Service{
+			cfg:                cfg,
+			botAuthClient:      deps.Client,
+			botIdentityReadyCh: deps.BotIdentityReadyCh,
+			reloadCh:           deps.ReloadCh,
+			identityGenerator:  deps.IdentityGenerator,
+			clientBuilder:      deps.ClientBuilder,
+			log:                deps.Logger,
+			statusReporter:     deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(ServiceType, cfg.Name, buildFn)
+}
+
+// Service is a service that retrieves X.509 certificates and exchanges them for
+// AWS credentials using the AWS Roles Anywhere service.
+type Service struct {
+	botAuthClient      *apiclient.Client
+	botIdentityReadyCh <-chan struct{}
+	cfg                *Config
+	log                *slog.Logger
+	statusReporter     readyz.Reporter
+	reloadCh           <-chan struct{}
+	identityGenerator  *identity.Generator
+	clientBuilder      *client.Builder
+}
+
+// String returns a human-readable description of the service.
+func (s *Service) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("workload-identity-aws-roles-anywhere (%s)", s.cfg.Destination.String()),
+	)
+}
+
+// OneShot runs the service once, generating the output and writing it to the
+// destination, before exiting.
+func (s *Service) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+// Run runs the service in a loop, generating the output and writing it to the
+// destination at regular intervals.
+func (s *Service) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        s.cfg.SessionRenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *Service) generate(ctx context.Context) error {
+	res, privateKey, err := s.requestSVID(ctx)
+	if err != nil {
+		return trace.Wrap(err, "requesting SVID")
+	}
+	pkcs8, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return trace.Wrap(err, "marshaling private key")
+	}
+	certWithChain := new(bytes.Buffer)
+	_, _ = certWithChain.Write(res.GetX509Svid().GetCert())
+	// If external PKI is configured, we need to append the chain to the leaf
+	// certificate before calling x509svid.ParseRaw.
+	for _, cert := range res.GetX509Svid().GetChain() {
+		_, _ = certWithChain.Write(cert)
+	}
+	svid, err := x509svid.ParseRaw(certWithChain.Bytes(), pkcs8)
+	if err != nil {
+		return trace.Wrap(err, "parsing x509 svid")
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Exchanging SVID for AWS credentials",
+		"spiffe_id", svid.ID.String(),
+		"role_arn", s.cfg.RoleARN,
+		"profile_arn", s.cfg.ProfileARN,
+		"trust_anchor_arn", s.cfg.TrustAnchorARN,
+	)
+	creds, err := s.exchangeSVID(ctx, svid)
+	if err != nil {
+		return trace.Wrap(err, "exchanging SVID via Roles Anywhere")
+	}
+	s.log.InfoContext(
+		ctx,
+		"Exchanged SVID for AWS credentials",
+		"aws_credentials_expiry", creds.Expiration,
+	)
+
+	return s.renderAWSCreds(ctx, creds)
+}
+
+// exchangeSVID will exchange the X.509 SVID for AWS credentials using the
+// AWS Roles Anywhere service.
+func (s *Service) exchangeSVID(
+	ctx context.Context,
+	svid *x509svid.SVID,
+) (*createsession.CreateSessionResponse, error) {
+	seconds := int(s.cfg.SessionDuration.Seconds())
+	req := createsession.CreateSessionRequest{
+		TrustAnchorARN:  s.cfg.TrustAnchorARN,
+		ProfileARN:      s.cfg.ProfileARN,
+		RoleARN:         s.cfg.RoleARN,
+		RegionOverride:  s.cfg.Region,
+		DurationSeconds: &seconds,
+		PrivateKey:      svid.PrivateKey,
+		Certificate:     svid.Certificates[0],
+		HTTPClient:      s.cfg.ClientOverride,
+	}
+	if len(svid.Certificates) > 1 {
+		req.IntermediateCertificates = svid.Certificates[1:]
+	}
+
+	res, err := createsession.CreateSession(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err, "exchanging credentials")
+	}
+
+	return res, nil
+}
+
+func (s *Service) requestSVID(
+	ctx context.Context,
+) (
+	*workloadidentityv1pb.Credential,
+	crypto.Signer,
+	error,
+) {
+	ctx, span := tracer.Start(
+		ctx,
+		"WorkloadIdentityAWSRAService/requestSVID",
+	)
+	defer span.End()
+
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		// We only need this to issue the X509 SVID, so we don't need the full
+		// lifetime.
+		identity.WithLifetime(time.Minute*10, 0),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "generating identity")
+	}
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	x509Credentials, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
+		ctx,
+		s.log,
+		impersonatedClient,
+		s.cfg.Selector,
+		// We only use this SVID to exchange for AWS credentials, so we don't
+		// need the full lifetime.
+		time.Minute*10,
+		nil,
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "generating X509 SVID")
+	}
+	var x509Credential *workloadidentityv1pb.Credential
+	switch len(x509Credentials) {
+	case 0:
+		return nil, nil, trace.BadParameter("no X509 SVIDs returned")
+	case 1:
+		x509Credential = x509Credentials[0]
+	default:
+		// We could eventually implement some kind of hint selection mechanism
+		// to pick the "right" one.
+		received := make([]string, 0, len(x509Credentials))
+		for _, cred := range x509Credentials {
+			received = append(received,
+				fmt.Sprintf(
+					"%s:%s",
+					cred.WorkloadIdentityName,
+					cred.SpiffeId,
+				),
+			)
+		}
+		return nil, nil, trace.BadParameter(
+			"multiple X509 SVIDs received: %v", received,
+		)
+	}
+
+	return x509Credential, privateKey, nil
+}
+
+func loadExistingAWSCredentialFile(
+	ctx context.Context, dest destination.Destination, artifactName string,
+) (*ini.File, error) {
+	// Load the existing credential file if it exists so we can merge with
+	// it.
+	data, err := dest.Read(ctx, artifactName)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return ini.Empty(), nil
+		}
+		return nil, trace.Wrap(err, "reading existing credentials")
+	}
+
+	f, err := ini.Load(data)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing existing credentials")
+	}
+	return f, nil
+}
+
+// render will write the AWS credentials to the AWS CLI configuration file.
+// See https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html
+func (s *Service) renderAWSCreds(
+	ctx context.Context,
+	creds *createsession.CreateSessionResponse,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"renderAWSCreds",
+	)
+	defer span.End()
+
+	expiresAt, err := time.Parse(time.RFC3339, creds.Expiration)
+	if err != nil {
+		return fmt.Errorf("parsing expiration time: %w", err)
+	}
+
+	artifactName := cmp.Or(s.cfg.ArtifactName, "aws_credentials")
+
+	f := ini.Empty()
+	if !s.cfg.OverwriteCredentialFile {
+		var err error
+		f, err = loadExistingAWSCredentialFile(
+			ctx, s.cfg.Destination, artifactName,
+		)
+		if err != nil {
+			return trace.Wrap(err, "loading existing credentials")
+		}
+	}
+
+	// "default" is the special profile name that the AWS CLI/SDK will read by
+	// default.
+	profileName := cmp.Or(s.cfg.CredentialProfileName, "default")
+	sec := f.Section(profileName)
+	sec.Key("aws_secret_access_key").SetValue(creds.SecretAccessKey)
+	sec.Key("aws_access_key_id").SetValue(creds.AccessKeyID)
+	sec.Key("aws_session_token").SetValue(creds.SessionToken)
+	sec.Key("expiration").SetValue(
+		fmt.Sprintf("%d", expiresAt.UnixMilli()),
+	)
+
+	b := &bytes.Buffer{}
+	_, err = f.WriteTo(b)
+	if err != nil {
+		return trace.Wrap(err, "writing credentials to buffer")
+	}
+
+	err = s.cfg.Destination.Write(ctx, artifactName, b.Bytes())
+	if err != nil {
+		return trace.Wrap(err, "writing credentials to destination")
+	}
+	return nil
+}
diff --git a/lib/tbot/services/awsra/service_test.go b/lib/tbot/services/awsra/service_test.go
new file mode 100644
index 0000000000000..3151fabfb6729
--- /dev/null
+++ b/lib/tbot/services/awsra/service_test.go
@@ -0,0 +1,369 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package awsra
+
+import (
+	"bytes"
+	"context"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func Test_renderAWSCreds(t *testing.T) {
+	creds := &createsession.CreateSessionResponse{
+		AccessKeyID:     "AKIAIOSFODNN7EXAMPLEAKID",
+		SessionToken:    "AQoDYXdzEJrtyWJ4NjK7PiEXAMPLEST",
+		SecretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLESAK",
+		Expiration:      "2028-07-27T04:36:55Z",
+	}
+	ctx := context.Background()
+
+	tests := []struct {
+		name         string
+		cfg          *Config
+		artifactName string
+		existingData []byte
+	}{
+		{
+			name:         "normal",
+			cfg:          &Config{},
+			artifactName: "aws_credentials",
+		},
+		{
+			name:         "merge with existing data",
+			cfg:          &Config{},
+			artifactName: "aws_credentials",
+			existingData: []byte(`[foo]
+aws_secret_access_key=existing
+aws_access_key_id=existing
+aws_session_token=existing`),
+		},
+		{
+			name:         "replace with existing data",
+			cfg:          &Config{},
+			artifactName: "aws_credentials",
+			existingData: []byte(`[default]
+aws_secret_access_key=existing
+aws_access_key_id=existing
+aws_session_token=existing`),
+		},
+		{
+			name: "with artifact name override",
+			cfg: &Config{
+				ArtifactName: "foo-xyzzy",
+			},
+			artifactName: "foo-xyzzy",
+		},
+		{
+			name: "with named profile",
+			cfg: &Config{
+				CredentialProfileName: "test-profile",
+			},
+			artifactName: "aws_credentials",
+		},
+		{
+			name: "overwrite existing data",
+			cfg: &Config{
+				CredentialProfileName:   "test-profile",
+				OverwriteCredentialFile: true,
+			},
+			artifactName: "aws_credentials",
+			existingData: []byte(`[foo]
+aws_secret_access_key=existing
+aws_access_key_id=existing
+aws_session_token=existing
+`),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dest := &destination.Memory{}
+			require.NoError(t, dest.CheckAndSetDefaults())
+			require.NoError(t, dest.Init(ctx, []string{}))
+
+			if len(tt.existingData) > 0 {
+				require.NoError(t, dest.Write(ctx, tt.artifactName, tt.existingData))
+			}
+
+			tt.cfg.Destination = dest
+			svc := &Service{
+				cfg: tt.cfg,
+			}
+
+			err := svc.renderAWSCreds(ctx, creds)
+			require.NoError(t, err)
+
+			got, err := dest.Read(ctx, tt.artifactName)
+			require.NoError(t, err)
+
+			if golden.ShouldSet() {
+				golden.Set(t, got)
+			}
+			require.Equal(t, golden.Get(t), got)
+		})
+	}
+}
+
+type createSessionRequestBody struct {
+	ProfileARN      string `json:"profileArn"`
+	RoleARN         string `json:"roleArn"`
+	TrustAnchorARN  string `json:"trustAnchorArn"`
+	RoleSessionName string `json:"roleSessionName,omitempty"`
+	DurationSeconds int    `json:"durationSeconds"`
+}
+
+type mockClientDoFunc func(req *http.Request) (*http.Response, error)
+
+func (m mockClientDoFunc) Do(req *http.Request) (*http.Response, error) {
+	return m(req)
+}
+
+func TestBotWorkloadIdentityAWSRA(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	tests := []struct {
+		name        string
+		externalPKI bool
+	}{
+		{
+			name: "no external pki",
+		},
+		{
+			name:        "external pki",
+			externalPKI: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				require.NoError(t, process.Close())
+				require.NoError(t, process.Wait())
+			})
+
+			if tt.externalPKI {
+				setWorkloadIdentityX509CAOverride(ctx, t, process)
+			}
+			spiffeCA, err := process.GetAuthServer().
+				GetCertAuthority(ctx, types.CertAuthID{
+					DomainName: "root",
+					Type:       types.SPIFFECA,
+				}, false)
+			require.NoError(t, err)
+			spiffeCAX509KeyPairs := spiffeCA.GetTrustedTLSKeyPairs()
+			require.Len(t, spiffeCAX509KeyPairs, 1)
+			spiffeCACert, err := tlsca.ParseCertificatePEM(spiffeCAX509KeyPairs[0].Cert)
+			require.NoError(t, err)
+			rootClient, err := testenv.NewDefaultAuthClient(process)
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = rootClient.Close() })
+			roleArn := "arn:aws:iam::123456789012:role/example-role"
+			trustAnchorArn := "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/0000000-0000-0000-0000-000000000000"
+			profileArn := "arn:aws:rolesanywhere:us-east-1:123456789012:profile/0000000-0000-0000-0000-00000000000"
+			client := mockClientDoFunc(func(r *http.Request) (*http.Response, error) {
+				assert.Equal(t, "rolesanywhere.us-east-1.amazonaws.com", r.Host)
+				assert.Equal(t, "/sessions", r.URL.Path)
+				assert.Equal(t, http.MethodPost, r.Method)
+
+				// Check JSON body inputs
+				body := &createSessionRequestBody{}
+				assert.NoError(t, json.NewDecoder(r.Body).Decode(body))
+				assert.Equal(t, roleArn, body.RoleARN)
+				assert.Equal(t, trustAnchorArn, body.TrustAnchorARN)
+				assert.Equal(t, profileArn, body.ProfileARN)
+				assert.Equal(t, int((2 * time.Hour).Seconds()), body.DurationSeconds)
+
+				// Validate the X-Amz-X509 header contains the valid (and correct) SVID
+				derString := r.Header.Get("X-Amz-X509")
+				assert.NotEmpty(t, derString)
+				derBytes, err := base64.StdEncoding.DecodeString(derString)
+				assert.NoError(t, err)
+				cert, err := x509.ParseCertificate(derBytes)
+				assert.NoError(t, err)
+				assert.Len(t, cert.URIs, 1)
+				assert.Equal(t, "spiffe://root/ra-test", cert.URIs[0].String())
+
+				// Validate the X-Amz-X509-Chain header contains the valid chain
+				chainString := r.Header.Get("X-Amz-X509-Chain")
+				if tt.externalPKI {
+					require.NotEmpty(t, chainString)
+					// If there were multiple certs in the chain, we'd need to
+					// split by comma first since:
+					//
+					// > The X-Amz-X509-Chain header MUST be encoded as
+					// > comma-delimited, base64-encoded DER
+					//
+					// But since we only expect a single item in the chain here
+					// we can just decode it.
+					chainBytes, err := base64.StdEncoding.DecodeString(chainString)
+					assert.NoError(t, err)
+					chainCert, err := x509.ParseCertificate(chainBytes)
+					assert.NoError(t, err)
+					// Check this matches the actual CA we setup.
+					assert.True(t, chainCert.Equal(spiffeCACert))
+				} else {
+					require.Empty(t, chainString)
+				}
+
+				// Validate the authorization header exists. We rely on the AWS SDK to
+				// actually produce the signature, and, validating this signature would
+				// introduce significant complexity to this test - so this is omitted.
+				authz := r.Header.Get("Authorization")
+				assert.NotEmpty(t, authz)
+
+				resp := &http.Response{
+					StatusCode: http.StatusCreated,
+					Body: io.NopCloser(bytes.NewReader([]byte(`{
+					  "credentialSet":[
+					    {
+						  "assumedRoleUser": {
+						  "arn": "arn:aws:iam::123456789012:role/example-role",
+						  "assumedRoleId": "assumedRoleId"
+						  },
+						  "credentials":{
+						    "accessKeyId": "accessKeyId",
+						    "expiration": "2028-07-27T04:36:55Z",
+						    "secretAccessKey": "secretAccessKey",
+						    "sessionToken": "sessionToken"
+						  },
+						  "packedPolicySize": 10,
+						  "roleArn": "arn:aws:iam::123456789012:role/example-role",
+						  "sourceIdentity": "sourceIdentity"
+					    }
+					  ],
+					  "subjectArn": "arn:aws:rolesanywhere:us-east-1:000000000000:subject/41cl0bae-6783-40d4-ab20-65dc5d922e45"
+				    }`))),
+				}
+				return resp, nil
+			})
+
+			role, err := types.NewRole("issue-foo", types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					WorkloadIdentityLabels: map[string]apiutils.Strings{
+						"foo": []string{"bar"},
+					},
+					Rules: []types.Rule{
+						{
+							Resources: []string{types.KindWorkloadIdentity},
+							Verbs:     []string{types.VerbRead, types.VerbList},
+						},
+					},
+				},
+			})
+			require.NoError(t, err)
+			role, err = rootClient.UpsertRole(ctx, role)
+			require.NoError(t, err)
+
+			workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+				Kind:    types.KindWorkloadIdentity,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "foo-bar-bizz",
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+						Id: "/ra-test",
+					},
+				},
+			}
+			workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
+				CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+					WorkloadIdentity: workloadIdentity,
+				})
+			require.NoError(t, err)
+
+			tmpDir := t.TempDir()
+
+			proxyAddr, err := process.ProxyWebAddr()
+			require.NoError(t, err)
+
+			connCfg := connection.Config{
+				Address:     proxyAddr.Addr,
+				AddressKind: connection.AddressKindProxy,
+				Insecure:    true,
+			}
+
+			onboarding, _ := makeBot(t, rootClient, "ra-test", role.GetName())
+			b, err := bot.New(bot.Config{
+				Connection: connCfg,
+				Logger:     log,
+				Onboarding: *onboarding,
+				Services: []bot.ServiceBuilder{
+					ServiceBuilder(
+						&Config{
+							Selector: bot.WorkloadIdentitySelector{
+								Name: workloadIdentity.GetMetadata().GetName(),
+							},
+							Destination: &destination.Directory{
+								Path: tmpDir,
+							},
+							RoleARN:                roleArn,
+							ProfileARN:             profileArn,
+							TrustAnchorARN:         trustAnchorArn,
+							Region:                 "us-east-1",
+							SessionDuration:        2 * time.Hour,
+							SessionRenewalInterval: 30 * time.Minute,
+							ClientOverride:         client,
+						},
+					),
+				},
+			})
+			require.NoError(t, err)
+
+			// Run Bot with 10 second timeout to catch hangs.
+			ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+			t.Cleanup(cancel)
+			require.NoError(t, b.OneShot(ctx))
+
+			got, err := os.ReadFile(filepath.Join(tmpDir, "aws_credentials"))
+			require.NoError(t, err)
+			if golden.ShouldSet() {
+				golden.Set(t, got)
+			}
+			require.Equal(t, string(golden.Get(t)), string(got))
+		})
+	}
+}
diff --git a/lib/tbot/testdata/TestBotWorkloadIdentityAWSRA/external_pki.golden b/lib/tbot/services/awsra/testdata/TestBotWorkloadIdentityAWSRA/external_pki.golden
similarity index 100%
rename from lib/tbot/testdata/TestBotWorkloadIdentityAWSRA/external_pki.golden
rename to lib/tbot/services/awsra/testdata/TestBotWorkloadIdentityAWSRA/external_pki.golden
diff --git a/lib/tbot/testdata/TestBotWorkloadIdentityAWSRA/no_external_pki.golden b/lib/tbot/services/awsra/testdata/TestBotWorkloadIdentityAWSRA/no_external_pki.golden
similarity index 100%
rename from lib/tbot/testdata/TestBotWorkloadIdentityAWSRA/no_external_pki.golden
rename to lib/tbot/services/awsra/testdata/TestBotWorkloadIdentityAWSRA/no_external_pki.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityAWSRAService_YAML/full.golden b/lib/tbot/services/awsra/testdata/TestWorkloadIdentityAWSRAService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityAWSRAService_YAML/full.golden
rename to lib/tbot/services/awsra/testdata/TestWorkloadIdentityAWSRAService_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityAWSRAService_YAML/simple.golden b/lib/tbot/services/awsra/testdata/TestWorkloadIdentityAWSRAService_YAML/simple.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityAWSRAService_YAML/simple.golden
rename to lib/tbot/services/awsra/testdata/TestWorkloadIdentityAWSRAService_YAML/simple.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/merge_with_existing_data.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/merge_with_existing_data.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/merge_with_existing_data.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/merge_with_existing_data.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/normal.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/normal.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/normal.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/normal.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/overwrite_existing_data.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/overwrite_existing_data.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/overwrite_existing_data.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/overwrite_existing_data.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/replace_with_existing_data.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/replace_with_existing_data.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/replace_with_existing_data.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/replace_with_existing_data.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/with_artifact_name_override.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/with_artifact_name_override.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/with_artifact_name_override.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/with_artifact_name_override.golden
diff --git a/lib/tbot/testdata/Test_renderAWSCreds/with_named_profile.golden b/lib/tbot/services/awsra/testdata/Test_renderAWSCreds/with_named_profile.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderAWSCreds/with_named_profile.golden
rename to lib/tbot/services/awsra/testdata/Test_renderAWSCreds/with_named_profile.golden
diff --git a/lib/tbot/services/clientcredentials/client_credential.go b/lib/tbot/services/clientcredentials/client_credential.go
new file mode 100644
index 0000000000000..8a46886f74697
--- /dev/null
+++ b/lib/tbot/services/clientcredentials/client_credential.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package clientcredentials
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/clientcredentials")
diff --git a/lib/tbot/services/clientcredentials/config.go b/lib/tbot/services/clientcredentials/config.go
new file mode 100644
index 0000000000000..aebe229097428
--- /dev/null
+++ b/lib/tbot/services/clientcredentials/config.go
@@ -0,0 +1,168 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package clientcredentials
+
+import (
+	"crypto/tls"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const ServiceType = "unstable_client_credential"
+
+var (
+	_ client.Credentials = &UnstableConfig{}
+)
+
+// UnstableConfig is an experimental tbot output which is compatible with the
+// client.Credential interface. This allows tbot to be used as an in-memory
+// source of credentials for the Teleport API client and removes the need to
+// write credentials to a filesystem.
+//
+// Unstable: no API stability promises are made for this struct and its methods.
+// Available configuration options may change and the signatures of methods may
+// be modified. This output is currently part of an experiment and could be
+// removed in a future release.
+type UnstableConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+
+	mu     sync.Mutex
+	facade *identity.Facade
+	ready  chan struct{}
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *UnstableConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *UnstableConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Ready returns a channel which closes when the Output is ready to be used
+// as a client credential. Using this as a credential before Ready closes is
+// unsupported.
+func (o *UnstableConfig) Ready() <-chan struct{} {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.ready == nil {
+		o.ready = make(chan struct{})
+		if o.facade != nil {
+			close(o.ready)
+		}
+	}
+	return o.ready
+}
+
+// Dialer implements the client.Credential interface. It does nothing.
+func (o *UnstableConfig) Dialer(c client.Config) (client.ContextDialer, error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	return nil, trace.NotImplemented("no dialer")
+}
+
+// TLSConfig implements the client.Credential interface and return the
+// tls.Config from the underlying identity.Facade.
+func (o *UnstableConfig) TLSConfig() (*tls.Config, error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.facade == nil {
+		return nil, trace.BadParameter("credentials not yet ready")
+	}
+	return o.facade.TLSConfig()
+}
+
+// SSHClientConfig implements the client.Credential interface and return the
+// ssh.ClientConfig from the underlying identity.Facade.
+func (o *UnstableConfig) SSHClientConfig() (*ssh.ClientConfig, error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.facade == nil {
+		return nil, trace.BadParameter("credentials not yet ready")
+	}
+	return o.facade.SSHClientConfig()
+}
+
+// Expiry returns the credential expiry.
+func (o *UnstableConfig) Expiry() (time.Time, bool) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.facade == nil {
+		return time.Time{}, false
+	}
+	return o.facade.Expiry()
+}
+
+// Facade returns the underlying facade
+func (o *UnstableConfig) Facade() (*identity.Facade, error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.facade == nil {
+		return nil, trace.BadParameter("credentials not yet ready")
+	}
+	return o.facade, nil
+}
+
+// SetOrUpdateFacade sets up the underlying facade or updates it if it has
+// already been created.
+func (o *UnstableConfig) SetOrUpdateFacade(id *identity.Identity) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.facade == nil {
+		if o.ready != nil {
+			close(o.ready)
+		}
+		o.facade = identity.NewFacade(false, false, id)
+		return
+	}
+	o.facade.Set(id)
+}
+
+// CheckAndSetDefaults checks and sets default values for the configuration.
+func (o *UnstableConfig) CheckAndSetDefaults() error {
+	return nil
+}
+
+// MarshalYAML enables the yaml package to correctly marshal the config
+// as YAML including the type header.
+func (o *UnstableConfig) MarshalYAML() (any, error) {
+	type raw UnstableConfig
+	return encoding.WithTypeHeader((*raw)(o), ServiceType)
+}
+
+// Type returns a human readable description of this output.
+func (o *UnstableConfig) Type() string {
+	return ServiceType
+}
+
+// GetCredentialLifetime returns the credential lifetime configuration.
+func (o *UnstableConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return bot.CredentialLifetime{}
+}
diff --git a/lib/tbot/services/clientcredentials/service.go b/lib/tbot/services/clientcredentials/service.go
new file mode 100644
index 0000000000000..5e7f66b1c1282
--- /dev/null
+++ b/lib/tbot/services/clientcredentials/service.go
@@ -0,0 +1,136 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package clientcredentials
+
+import (
+	"cmp"
+	"context"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+// ServiceBuilder creates a new client credential service with the given
+// configuration.
+//
+// Note: when using the client credentials service to provide credentials to
+// another service (e.g. the SPIFFE Workload API service) use NewSidecar instead.
+func ServiceBuilder(cfg *UnstableConfig, credentialLifetime bot.CredentialLifetime) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &Service{
+			botAuthClient:      deps.Client,
+			botIdentityReadyCh: deps.BotIdentityReadyCh,
+			credentialLifetime: credentialLifetime,
+			cfg:                cfg,
+			reloadCh:           deps.ReloadCh,
+			identityGenerator:  deps.IdentityGenerator,
+			log:                deps.Logger,
+			statusReporter:     deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(ServiceType, cfg.Name, buildFn)
+}
+
+// NewSidecar creates a client credential service intended to provide credentials
+// to another service.
+func NewSidecar(deps bot.ServiceDependencies, credentialLifetime bot.CredentialLifetime) (*Service, *UnstableConfig) {
+	cfg := &UnstableConfig{}
+	svc := &Service{
+		botAuthClient:      deps.Client,
+		botIdentityReadyCh: deps.BotIdentityReadyCh,
+		credentialLifetime: credentialLifetime,
+		cfg:                cfg,
+		reloadCh:           deps.ReloadCh,
+		identityGenerator:  deps.IdentityGenerator,
+		statusReporter:     readyz.NoopReporter(),
+		log:                deps.Logger,
+	}
+	return svc, cfg
+}
+
+// Service produces credentials which can be used to connect to Teleport's API or SSH.
+type Service struct {
+	// botAuthClient should be an auth client using the bots internal identity.
+	// This will not have any roles impersonated and should only be used to
+	// fetch CAs.
+	botAuthClient      *apiclient.Client
+	botIdentityReadyCh <-chan struct{}
+	credentialLifetime bot.CredentialLifetime
+	cfg                *UnstableConfig
+	log                *slog.Logger
+	statusReporter     readyz.Reporter
+	reloadCh           <-chan struct{}
+	identityGenerator  *identity.Generator
+}
+
+func (s *Service) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		"client-credential-output",
+	)
+}
+
+func (s *Service) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *Service) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        s.credentialLifetime.RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *Service) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"Service/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	id, err := s.identityGenerator.Generate(ctx,
+		identity.WithLifetime(s.credentialLifetime.TTL, s.credentialLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+
+	s.cfg.SetOrUpdateFacade(id)
+	return nil
+}
diff --git a/lib/tbot/services/database/database.go b/lib/tbot/services/database/database.go
new file mode 100644
index 0000000000000..d02f4493c3bbd
--- /dev/null
+++ b/lib/tbot/services/database/database.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/database")
diff --git a/lib/tbot/database_access.go b/lib/tbot/services/database/database_access.go
similarity index 90%
rename from lib/tbot/database_access.go
rename to lib/tbot/services/database/database_access.go
index 43397d2b95f76..9e73a6466462f 100644
--- a/lib/tbot/database_access.go
+++ b/lib/tbot/services/database/database_access.go
@@ -1,6 +1,6 @@
 /*
  * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
+ * Copyright (C) 2025  Gravitational, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package tbot
+package database
 
 import (
 	"context"
@@ -28,18 +28,18 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
 	libdefaults "github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tbot/internal"
 )
 
-func getDatabase(ctx context.Context, clt *authclient.Client, name string) (types.Database, error) {
+func getDatabase(ctx context.Context, clt *apiclient.Client, name string) (types.Database, error) {
 	ctx, span := tracer.Start(ctx, "getDatabase")
 	defer span.End()
 
 	servers, err := apiclient.GetAllResources[types.DatabaseServer](ctx, clt, &proto.ListResourcesRequest{
 		Namespace:           defaults.Namespace,
 		ResourceType:        types.KindDatabaseServer,
-		PredicateExpression: makeNameOrDiscoveredNamePredicate(name),
+		PredicateExpression: internal.MakeNameOrDiscoveredNamePredicate(name),
 		Limit:               int32(defaults.DefaultChunkSize),
 	})
 	if err != nil {
@@ -59,7 +59,7 @@ func getDatabase(ctx context.Context, clt *authclient.Client, name string) (type
 func getRouteToDatabase(
 	ctx context.Context,
 	log *slog.Logger,
-	client *authclient.Client,
+	client *apiclient.Client,
 	service string,
 	username string,
 	database string,
diff --git a/lib/tbot/services/database/database_access_test.go b/lib/tbot/services/database/database_access_test.go
new file mode 100644
index 0000000000000..3c661c9286e80
--- /dev/null
+++ b/lib/tbot/services/database/database_access_test.go
@@ -0,0 +1,77 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestChooseOneDatabase(t *testing.T) {
+	t.Parallel()
+	fooDB1 := newMockDiscoveredDB(t, "foo-rds-us-west-1-123456789012", "foo")
+	fooDB2 := newMockDiscoveredDB(t, "foo-rds-us-west-2-123456789012", "foo")
+	barDB := newMockDiscoveredDB(t, "bar-rds-us-west-1-123456789012", "bar")
+	tests := []struct {
+		desc      string
+		databases []types.Database
+		dbSvc     string
+		wantDB    types.Database
+		wantErr   string
+	}{
+		{
+			desc:      "by exact name match",
+			databases: []types.Database{fooDB1, fooDB2, barDB},
+			dbSvc:     "bar-rds-us-west-1-123456789012",
+			wantDB:    barDB,
+		},
+		{
+			desc:      "by unambiguous discovered name match",
+			databases: []types.Database{fooDB1, fooDB2, barDB},
+			dbSvc:     "bar",
+			wantDB:    barDB,
+		},
+		{
+			desc:      "ambiguous discovered name matches is an error",
+			databases: []types.Database{fooDB1, fooDB2, barDB},
+			dbSvc:     "foo",
+			wantErr:   `"foo" matches multiple auto-discovered databases`,
+		},
+		{
+			desc:      "no match is an error",
+			databases: []types.Database{fooDB1, fooDB2, barDB},
+			dbSvc:     "xxx",
+			wantErr:   `database "xxx" not found`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			gotDB, err := chooseOneDatabase(test.databases, test.dbSvc)
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.wantDB, gotDB)
+		})
+	}
+}
diff --git a/lib/tbot/services/database/helpers_test.go b/lib/tbot/services/database/helpers_test.go
new file mode 100644
index 0000000000000..d7a1e66816b37
--- /dev/null
+++ b/lib/tbot/services/database/helpers_test.go
@@ -0,0 +1,121 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+func newMockDiscoveredDB(t *testing.T, name, discoveredName string) *types.DatabaseV3 {
+	t.Helper()
+	db, err := types.NewDatabaseV3(types.Metadata{
+		Name: name,
+		Labels: map[string]string{
+			types.OriginLabel:         types.OriginCloud,
+			types.DiscoveredNameLabel: discoveredName,
+		},
+	}, types.DatabaseSpecV3{
+		Protocol: "mysql",
+		URI:      "example.com:1234",
+	})
+	require.NoError(t, err)
+	return db
+}
diff --git a/lib/tbot/services/database/output_config.go b/lib/tbot/services/database/output_config.go
new file mode 100644
index 0000000000000..6d506107df829
--- /dev/null
+++ b/lib/tbot/services/database/output_config.go
@@ -0,0 +1,231 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"context"
+	"slices"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const OutputServiceType = "database"
+
+// DatabaseFormat specifies if any special behavior should be invoked when
+// producing artifacts. This allows for databases/clients that require unique
+// formats or paths to be used.
+type DatabaseFormat string
+
+const (
+	// UnspecifiedDatabaseFormat is the unset value and the default. This
+	// should work for most databases.
+	UnspecifiedDatabaseFormat DatabaseFormat = ""
+	// TLSDatabaseFormat is for databases that require specifically named
+	// outputs: tls.key, tls.crt and tls.cas
+	TLSDatabaseFormat DatabaseFormat = "tls"
+	// MongoDatabaseFormat indicates credentials should be generated which
+	// are compatible with MongoDB.
+	// This outputs `mongo.crt` and `mongo.cas`.
+	MongoDatabaseFormat DatabaseFormat = "mongo"
+	// CockroachDatabaseFormat indicates credentials should be generated which
+	// are compatible with CockroachDB.
+	// This outputs `cockroach/node.key`, `cockroach/node.crt` and
+	// `cockroach/ca.crt`.
+	CockroachDatabaseFormat DatabaseFormat = "cockroach"
+)
+
+const (
+	// DefaultMongoPrefix is the default prefix in generated MongoDB certs.
+	DefaultMongoPrefix      = "mongo"
+	DefaultCockroachDirName = "cockroach"
+)
+
+var databaseFormats = []DatabaseFormat{
+	UnspecifiedDatabaseFormat,
+	TLSDatabaseFormat,
+	MongoDatabaseFormat,
+	CockroachDatabaseFormat,
+}
+
+// OutputConfig produces credentials which can be used to connect to a database
+// through teleport.
+type OutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Formats specifies if any special behavior should be invoked when
+	// producing artifacts. An empty value is supported by most database,
+	// but CockroachDB and MongoDB require this value to be set to
+	// `mongo` and `cockroach` respectively.
+	Format DatabaseFormat `yaml:"format,omitempty"`
+	// Service is the service name of the Teleport database. Generally this is
+	// the name of the Teleport resource. This field is required for all types
+	// of database.
+	Service string `yaml:"service"`
+	// Database is the name of the database to request access to.
+	Database string `yaml:"database,omitempty"`
+	// Username is the database username to request access as.
+	Username string `yaml:"username,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *OutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *OutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (o *OutputConfig) Init(ctx context.Context) error {
+	subDirs := []string{}
+	if o.Format == CockroachDatabaseFormat {
+		subDirs = append(subDirs, DefaultCockroachDirName)
+	}
+	return trace.Wrap(o.Destination.Init(ctx, subDirs))
+}
+
+func (o *OutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+
+	if o.Service == "" {
+		return trace.BadParameter("service must not be empty")
+	}
+
+	if !slices.Contains(databaseFormats, o.Format) {
+		return trace.BadParameter("unrecognized format (%s)", o.Format)
+	}
+
+	return nil
+}
+
+func (o *OutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *OutputConfig) Describe() []bot.FileDescription {
+	fds := []bot.FileDescription{
+		{
+			Name: internal.IdentityFilePath,
+		},
+		{
+			Name: internal.HostCAPath,
+		},
+		{
+			Name: internal.UserCAPath,
+		},
+		{
+			Name: internal.DatabaseCAPath,
+		},
+	}
+	switch o.Format {
+	case MongoDatabaseFormat:
+		fds = append(fds, []bot.FileDescription{
+			{
+				Name: DefaultMongoPrefix + ".crt",
+			},
+			{
+				Name: DefaultMongoPrefix + ".cas",
+			},
+		}...)
+	case CockroachDatabaseFormat:
+		fds = append(fds, []bot.FileDescription{
+			{
+				Name:  DefaultCockroachDirName,
+				IsDir: true,
+			},
+		}...)
+	case TLSDatabaseFormat:
+		fds = append(fds, []bot.FileDescription{
+			{
+				Name: internal.DefaultTLSPrefix + ".crt",
+			},
+			{
+				Name: internal.DefaultTLSPrefix + ".key",
+			},
+			{
+				Name: internal.DefaultTLSPrefix + ".cas",
+			},
+		}...)
+	}
+
+	return fds
+}
+
+func (o *OutputConfig) MarshalYAML() (any, error) {
+	type raw OutputConfig
+	return encoding.WithTypeHeader((*raw)(o), OutputServiceType)
+}
+
+func (o *OutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *OutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw OutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *OutputConfig) Type() string {
+	return OutputServiceType
+}
+
+func (o *OutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
+
+// SupportedDatabaseFormatStrings returns a constant list of all valid
+// DatabaseFormat values as strings.
+func SupportedDatabaseFormatStrings() (ret []string) {
+	for _, v := range databaseFormats {
+		ret = append(ret, string(v))
+	}
+
+	return
+}
diff --git a/lib/tbot/services/database/output_config_test.go b/lib/tbot/services/database/output_config_test.go
new file mode 100644
index 0000000000000..45203c92df6d1
--- /dev/null
+++ b/lib/tbot/services/database/output_config_test.go
@@ -0,0 +1,104 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestDatabaseOutput_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[OutputConfig]{
+		{
+			name: "full",
+			in: OutputConfig{
+				Destination: dest,
+				Roles:       []string{"access"},
+				Format:      TLSDatabaseFormat,
+				Service:     "my-database-service",
+				Database:    "my-database",
+				Username:    "my-username",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: OutputConfig{
+				Destination: dest,
+				Service:     "my-database-service",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestDatabaseOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*OutputConfig]{
+		{
+			name: "valid",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+					Roles:       []string{"access"},
+					Database:    "db",
+					Service:     "service",
+					Username:    "username",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: nil,
+					Service:     "service",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing service",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+				}
+			},
+			wantErr: "service must not be empty",
+		},
+		{
+			name: "invalid format",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+					Service:     "service",
+					Format:      "no-such-format",
+				}
+			},
+			wantErr: "unrecognized format (no-such-format)",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/database/output_service.go b/lib/tbot/services/database/output_service.go
new file mode 100644
index 0000000000000..fa95c65a303fd
--- /dev/null
+++ b/lib/tbot/services/database/output_service.go
@@ -0,0 +1,316 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client/identityfile"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+func OutputServiceBuilder(cfg *OutputConfig, defaultCredentialLifetime bot.CredentialLifetime) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &OutputService{
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			reloadCh:                  deps.ReloadCh,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(OutputServiceType, cfg.Name, buildFn)
+}
+
+// OutputService generates the artifacts necessary to connect to a
+// database using Teleport.
+type OutputService struct {
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *OutputConfig
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+}
+
+func (s *OutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("database-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *OutputService) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *OutputService) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *OutputService) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	}
+	id, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	route, err := getRouteToDatabase(
+		ctx,
+		s.log,
+		impersonatedClient,
+		s.cfg.Service,
+		s.cfg.Username,
+		s.cfg.Database,
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	routedIdentity, err := s.identityGenerator.Generate(ctx, append(identityOpts,
+		identity.WithCurrentIdentityFacade(id),
+		identity.WithRouteToDatabase(route),
+	)...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Generated identity for database",
+		"db_service", route.ServiceName,
+	)
+
+	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// TODO(noah): It's likely the Database output does not really need to
+	// output all these CAs - but - for backwards compat reasons, we output them.
+	// Revisit this at a later date and make a call.
+	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(s.render(ctx, routedIdentity, hostCAs, userCAs, databaseCAs), "rendering")
+}
+
+func (s *OutputService) render(
+	ctx context.Context,
+	routedIdentity *identity.Identity,
+	hostCAs, userCAs, databaseCAs []types.CertAuthority,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/render",
+	)
+	defer span.End()
+
+	keyRing, err := internal.NewClientKeyRing(routedIdentity, hostCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := internal.WriteTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := internal.WriteIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "writing identity file")
+	}
+	if err := identity.SaveIdentity(
+		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
+	); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	switch s.cfg.Format {
+	case MongoDatabaseFormat:
+		if err := writeMongoDatabaseFiles(
+			ctx, s.log, routedIdentity, databaseCAs, s.cfg.Destination,
+		); err != nil {
+			return trace.Wrap(err, "writing cockroach database files")
+		}
+	case CockroachDatabaseFormat:
+		if err := writeCockroachDatabaseFiles(
+			ctx, s.log, routedIdentity, databaseCAs, s.cfg.Destination,
+		); err != nil {
+			return trace.Wrap(err, "writing cockroach database files")
+		}
+	case TLSDatabaseFormat:
+		if err := internal.WriteIdentityFileTLS(
+			ctx, s.log, keyRing, s.cfg.Destination,
+		); err != nil {
+			return trace.Wrap(err, "writing tls database format files")
+		}
+	}
+
+	return nil
+}
+
+func writeCockroachDatabaseFiles(
+	ctx context.Context,
+	log *slog.Logger,
+	routedIdentity *identity.Identity,
+	databaseCAs []types.CertAuthority,
+	dest destination.Destination,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"writeCockroachDatabaseFiles",
+	)
+	defer span.End()
+
+	// Cockroach format specifically uses database CAs rather than hostCAs
+	keyRing, err := internal.NewClientKeyRing(routedIdentity, databaseCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: DefaultCockroachDirName,
+		Writer:     internal.NewBotConfigWriter(ctx, dest, DefaultCockroachDirName),
+		KeyRing:    keyRing,
+		Format:     identityfile.FormatCockroach,
+
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.DebugContext(ctx, "Wrote CockroachDB files", "files", files)
+	return nil
+}
+
+func writeMongoDatabaseFiles(
+	ctx context.Context,
+	log *slog.Logger,
+	routedIdentity *identity.Identity,
+	databaseCAs []types.CertAuthority,
+	dest destination.Destination,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"writeMongoDatabaseFiles",
+	)
+	defer span.End()
+
+	// Mongo format specifically uses database CAs rather than hostCAs
+	keyRing, err := internal.NewClientKeyRing(routedIdentity, databaseCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: DefaultMongoPrefix,
+		Writer:     internal.NewBotConfigWriter(ctx, dest, ""),
+		KeyRing:    keyRing,
+		Format:     identityfile.FormatMongo,
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.DebugContext(ctx, "Wrote MongoDB identity files", "files", files)
+	return nil
+}
+
+// chooseOneDatabase chooses one matched database by name, or tries to choose
+// one database by unambiguous "discovered name".
+func chooseOneDatabase(databases []types.Database, name string) (types.Database, error) {
+	return internal.ChooseOneResource(databases, name, "database")
+}
diff --git a/lib/tbot/config/testdata/TestDatabaseOutput_YAML/full.golden b/lib/tbot/services/database/testdata/TestDatabaseOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDatabaseOutput_YAML/full.golden
rename to lib/tbot/services/database/testdata/TestDatabaseOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestDatabaseOutput_YAML/minimal.golden b/lib/tbot/services/database/testdata/TestDatabaseOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDatabaseOutput_YAML/minimal.golden
rename to lib/tbot/services/database/testdata/TestDatabaseOutput_YAML/minimal.golden
diff --git a/lib/tbot/config/testdata/TestDatabaseTunnelService_YAML/full.golden b/lib/tbot/services/database/testdata/TestDatabaseTunnelService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestDatabaseTunnelService_YAML/full.golden
rename to lib/tbot/services/database/testdata/TestDatabaseTunnelService_YAML/full.golden
diff --git a/lib/tbot/services/database/tunnel_config.go b/lib/tbot/services/database/tunnel_config.go
new file mode 100644
index 0000000000000..6f89611a7fc41
--- /dev/null
+++ b/lib/tbot/services/database/tunnel_config.go
@@ -0,0 +1,110 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"net"
+	"net/url"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const TunnelServiceType = "database-tunnel"
+
+// TunnelConfig opens an authenticated tunnel for Database Access.
+type TunnelConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Listen is the address on which database tunnel should listen. Example:
+	// - "tcp://127.0.0.1:3306"
+	// - "tcp://0.0.0.0:3306
+	Listen string `yaml:"listen"`
+	// Roles is the list of roles to request for the tunnel.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+	// Service is the service name of the Teleport database. Generally this is
+	// the name of the Teleport resource. This field is required for all types
+	// of database.
+	Service string `yaml:"service"`
+	// Database is the name of the database to proxy to.
+	Database string `yaml:"database"`
+	// Username is the database username to proxy as.
+	Username string `yaml:"username"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+
+	// Listener overrides "listen" and directly provides an opened listener to
+	// use.
+	Listener net.Listener `yaml:"-"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *TunnelConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *TunnelConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (s *TunnelConfig) Type() string {
+	return TunnelServiceType
+}
+
+func (s *TunnelConfig) MarshalYAML() (any, error) {
+	type raw TunnelConfig
+	return encoding.WithTypeHeader((*raw)(s), TunnelServiceType)
+}
+
+func (s *TunnelConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw TunnelConfig
+	if err := node.Decode((*raw)(s)); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *TunnelConfig) CheckAndSetDefaults() error {
+	switch {
+	case s.Listen == "" && s.Listener == nil:
+		return trace.BadParameter("listen: should not be empty")
+	case s.Service == "":
+		return trace.BadParameter("service: should not be empty")
+	case s.Database == "":
+		return trace.BadParameter("database: should not be empty")
+	case s.Username == "":
+		return trace.BadParameter("username: should not be empty")
+	}
+	if _, err := url.Parse(s.Listen); err != nil {
+		return trace.Wrap(err, "parsing listen")
+	}
+	return nil
+}
+
+func (s *TunnelConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return s.CredentialLifetime
+}
diff --git a/lib/tbot/services/database/tunnel_config_test.go b/lib/tbot/services/database/tunnel_config_test.go
new file mode 100644
index 0000000000000..9177572a3b737
--- /dev/null
+++ b/lib/tbot/services/database/tunnel_config_test.go
@@ -0,0 +1,117 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+func TestDatabaseTunnelService_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[TunnelConfig]{
+		{
+			name: "full",
+			in: TunnelConfig{
+				Listen:   "tcp://0.0.0.0:3621",
+				Roles:    []string{"role1", "role2"},
+				Service:  "service",
+				Database: "database",
+				Username: "username",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestDatabaseTunnelService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*TunnelConfig]{
+		{
+			name: "valid",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:   "tcp://0.0.0.0:3621",
+					Roles:    []string{"role1", "role2"},
+					Service:  "service",
+					Database: "database",
+					Username: "username",
+				}
+			},
+			wantErr: "",
+		},
+		{
+			name: "missing listen",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Roles:    []string{"role1", "role2"},
+					Service:  "service",
+					Database: "database",
+					Username: "username",
+				}
+			},
+			wantErr: "listen: should not be empty",
+		},
+		{
+			name: "missing service",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:   "tcp://0.0.0.0:3621",
+					Roles:    []string{"role1", "role2"},
+					Database: "database",
+					Username: "username",
+				}
+			},
+			wantErr: "service: should not be empty",
+		},
+		{
+			name: "missing database",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:   "tcp://0.0.0.0:3621",
+					Roles:    []string{"role1", "role2"},
+					Service:  "service",
+					Username: "username",
+				}
+			},
+			wantErr: "database: should not be empty",
+		},
+		{
+			name: "missing username",
+			in: func() *TunnelConfig {
+				return &TunnelConfig{
+					Listen:   "tcp://0.0.0.0:3621",
+					Roles:    []string{"role1", "role2"},
+					Service:  "service",
+					Database: "database",
+				}
+			},
+			wantErr: "username: should not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/database/tunnel_service.go b/lib/tbot/services/database/tunnel_service.go
new file mode 100644
index 0000000000000..deb83171cf41c
--- /dev/null
+++ b/lib/tbot/services/database/tunnel_service.go
@@ -0,0 +1,309 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package database
+
+import (
+	"cmp"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy"
+	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TunnelServiceBuilder(
+	cfg *TunnelConfig,
+	connCfg connection.Config,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &TunnelService{
+			connCfg:                   connCfg,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			proxyPinger:               deps.ProxyPinger,
+			botClient:                 deps.Client,
+			getBotIdentity:            deps.BotIdentity,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(TunnelServiceType, cfg.Name, buildFn)
+}
+
+// TunnelService is a service that listens on a local port and forwards
+// connections to a remote database service. It is an authenticating tunnel and
+// will automatically issue and renew certificates as needed.
+type TunnelService struct {
+	connCfg                   connection.Config
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *TunnelConfig
+	proxyPinger               connection.ProxyPinger
+	log                       *slog.Logger
+	botClient                 *apiclient.Client
+	getBotIdentity            func() *identity.Identity
+	botIdentityReadyCh        <-chan struct{}
+	statusReporter            readyz.Reporter
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+}
+
+// buildLocalProxyConfig initializes the service, fetching any initial information and setting
+// up the localproxy.
+func (s *TunnelService) buildLocalProxyConfig(ctx context.Context) (lpCfg alpnproxy.LocalProxyConfig, err error) {
+	ctx, span := tracer.Start(ctx, "TunnelService/buildLocalProxyConfig")
+	defer span.End()
+
+	if s.botIdentityReadyCh != nil {
+		select {
+		case <-s.botIdentityReadyCh:
+		default:
+			s.log.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-s.botIdentityReadyCh:
+			case <-ctx.Done():
+				return alpnproxy.LocalProxyConfig{}, ctx.Err()
+			}
+		}
+	}
+
+	proxyPing, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "pinging proxy")
+	}
+	proxyAddr, err := proxyPing.ProxyWebAddr()
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err, "determining proxy web address")
+	}
+
+	// Fetch information about the database and then issue the initial
+	// certificate. We issue the initial certificate to allow us to fail faster.
+	// We cache the routeToDatabase as these will not change during the lifetime
+	// of the service and this reduces the time needed to issue a new
+	// certificate.
+	s.log.DebugContext(ctx, "Determining route to database.")
+	routeToDatabase, err := s.getRouteToDatabaseWithImpersonation(ctx)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
+	}
+	s.log.DebugContext(
+		ctx,
+		"Identified route to database.",
+		"service_name", routeToDatabase.ServiceName,
+		"protocol", routeToDatabase.Protocol,
+		"database", routeToDatabase.Database,
+		"username", routeToDatabase.Username,
+	)
+
+	s.log.DebugContext(ctx, "Issuing initial certificate for local proxy.")
+	dbCert, err := s.issueCert(ctx, routeToDatabase)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
+	}
+	s.log.DebugContext(ctx, "Issued initial certificate for local proxy.")
+
+	middleware := internal.ALPNProxyMiddleware{
+		OnNewConnectionFunc: func(ctx context.Context, lp *alpnproxy.LocalProxy) error {
+			ctx, span := tracer.Start(ctx, "TunnelService/OnNewConnection")
+			defer span.End()
+
+			// Check if the certificate needs reissuing, if so, reissue.
+			if err := lp.CheckDBCert(ctx, tlsca.RouteToDatabase{
+				ServiceName: routeToDatabase.ServiceName,
+				Protocol:    routeToDatabase.Protocol,
+				Database:    routeToDatabase.Database,
+				Username:    routeToDatabase.Username,
+			}); err != nil {
+				s.log.InfoContext(ctx, "Certificate for tunnel needs reissuing.", "reason", err.Error())
+				cert, err := s.issueCert(ctx, routeToDatabase)
+				if err != nil {
+					return trace.Wrap(err, "issuing cert")
+				}
+				lp.SetCert(*cert)
+			}
+			return nil
+		},
+	}
+
+	alpnProtocol, err := common.ToALPNProtocol(routeToDatabase.Protocol)
+	if err != nil {
+		return alpnproxy.LocalProxyConfig{}, trace.Wrap(err)
+
+	}
+	lpConfig := alpnproxy.LocalProxyConfig{
+		Middleware: middleware,
+
+		RemoteProxyAddr:    proxyAddr,
+		ParentContext:      ctx,
+		Protocols:          []common.Protocol{alpnProtocol},
+		Cert:               *dbCert,
+		InsecureSkipVerify: s.connCfg.Insecure,
+	}
+	if apiclient.IsALPNConnUpgradeRequired(
+		ctx,
+		proxyAddr,
+		s.connCfg.Insecure,
+	) {
+		lpConfig.ALPNConnUpgradeRequired = true
+		// If ALPN Conn Upgrade will be used, we need to set the cluster CAs
+		// to validate the Proxy's auth issued host cert.
+		lpConfig.RootCAs = s.getBotIdentity().TLSCAPool
+	}
+
+	return lpConfig, nil
+}
+
+func (s *TunnelService) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "TunnelService/Run")
+	defer span.End()
+
+	l := s.cfg.Listener
+	if l == nil {
+		s.log.DebugContext(ctx, "Opening listener for database tunnel.", "listen", s.cfg.Listen)
+		var err error
+		l, err = internal.CreateListener(ctx, s.log, s.cfg.Listen)
+		if err != nil {
+			return trace.Wrap(err, "opening listener")
+		}
+		defer func() {
+			if err := l.Close(); err != nil && !utils.IsUseOfClosedNetworkError(err) {
+				s.log.ErrorContext(ctx, "Failed to close listener", "error", err)
+			}
+		}()
+	}
+
+	lpCfg, err := s.buildLocalProxyConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err, "building local proxy config")
+	}
+	lpCfg.Listener = l
+
+	lp, err := alpnproxy.NewLocalProxy(lpCfg)
+	if err != nil {
+		return trace.Wrap(err, "creating local proxy")
+	}
+	defer func() {
+		if err := lp.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Failed to close local proxy", "error", err)
+		}
+	}()
+	// Closed further down.
+
+	// lp.Start will block and continues to block until lp.Close() is called.
+	// Despite taking a context, it will not exit until the first connection is
+	// made after the context is canceled.
+	var errCh = make(chan error, 1)
+	go func() {
+		errCh <- lp.Start(ctx)
+	}()
+	s.log.InfoContext(ctx, "Listening for connections.", "address", l.Addr().String())
+
+	s.statusReporter.Report(readyz.Healthy)
+
+	select {
+	case <-ctx.Done():
+		return nil
+	case err := <-errCh:
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return trace.Wrap(err, "local proxy failed")
+	}
+}
+
+// getRouteToDatabaseWithImpersonation fetches the route to the database with
+// impersonation of roles. This ensures that the user's selected roles actually
+// grant access to the database.
+func (s *TunnelService) getRouteToDatabaseWithImpersonation(ctx context.Context) (proto.RouteToDatabase, error) {
+	ctx, span := tracer.Start(ctx, "TunnelService/getRouteToDatabaseWithImpersonation")
+	defer span.End()
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	impersonatedIdentity, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return proto.RouteToDatabase{}, trace.Wrap(err)
+	}
+
+	impersonatedClient, err := s.clientBuilder.Build(ctx, impersonatedIdentity)
+	if err != nil {
+		return proto.RouteToDatabase{}, trace.Wrap(err)
+	}
+	defer func() {
+		if err := impersonatedClient.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Failed to close impersonated client.", "error", err)
+		}
+	}()
+
+	return getRouteToDatabase(ctx, s.log, impersonatedClient, s.cfg.Service, s.cfg.Username, s.cfg.Database)
+}
+
+func (s *TunnelService) issueCert(
+	ctx context.Context,
+	route proto.RouteToDatabase,
+) (*tls.Certificate, error) {
+	ctx, span := tracer.Start(ctx, "TunnelService/issueCert")
+	defer span.End()
+
+	s.log.DebugContext(ctx, "Requesting issuance of certificate for tunnel proxy.")
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	ident, err := s.identityGenerator.Generate(ctx,
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+		identity.WithRouteToDatabase(route),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	s.log.InfoContext(ctx, "Certificate issued for tunnel proxy.")
+
+	return ident.TLSCert, nil
+}
+
+// String returns a human-readable string that can uniquely identify the
+// service.
+func (s *TunnelService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s:%s", TunnelServiceType, s.cfg.Listen, s.cfg.Service),
+	)
+}
diff --git a/lib/tbot/services/example/config.go b/lib/tbot/services/example/config.go
new file mode 100644
index 0000000000000..174234e4f33ee
--- /dev/null
+++ b/lib/tbot/services/example/config.go
@@ -0,0 +1,67 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package example
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const ServiceType = "example"
+
+// Config is a temporary example service for testing purposes. It is not
+// intended to be used and exists to demonstrate how a user configurable
+// service integrates with the tbot service manager.
+type Config struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name    string `yaml:"name,omitempty"`
+	Message string `yaml:"message"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (s *Config) GetName() string {
+	return s.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *Config) SetName(name string) {
+	o.Name = name
+}
+
+func (s *Config) Type() string {
+	return ServiceType
+}
+
+func (s *Config) MarshalYAML() (any, error) {
+	type raw Config
+	return encoding.WithTypeHeader((*raw)(s), ServiceType)
+}
+
+func (s *Config) CheckAndSetDefaults() error {
+	if s.Message == "" {
+		return trace.BadParameter("message: should not be empty")
+	}
+	return nil
+}
+
+func (s *Config) GetCredentialLifetime() bot.CredentialLifetime {
+	return bot.CredentialLifetime{}
+}
diff --git a/lib/tbot/services/example/service.go b/lib/tbot/services/example/service.go
new file mode 100644
index 0000000000000..4c4a00f3fcf9b
--- /dev/null
+++ b/lib/tbot/services/example/service.go
@@ -0,0 +1,66 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package example
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+// ServiceBuilder returns an example service builder.
+func ServiceBuilder(cfg *Config) bot.ServiceBuilder {
+	buildFn := func(bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &Service{cfg: cfg}, nil
+	}
+	return bot.NewServiceBuilder(ServiceType, cfg.Name, buildFn)
+}
+
+// Service is a temporary example service for testing purposes. It is not
+// intended to be used and exists to demonstrate how a user configurable
+// service integrates with the tbot service manager.
+type Service struct {
+	cfg *Config
+}
+
+func (s *Service) Run(ctx context.Context) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(time.Second * 5):
+			fmt.Println("Example Service prints message:", s.cfg.Message)
+		}
+	}
+}
+
+func (s *Service) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s", ServiceType, s.cfg.Message),
+	)
+}
diff --git a/lib/tbot/services/identity/helpers_test.go b/lib/tbot/services/identity/helpers_test.go
new file mode 100644
index 0000000000000..64070a53a6b90
--- /dev/null
+++ b/lib/tbot/services/identity/helpers_test.go
@@ -0,0 +1,104 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
diff --git a/lib/tbot/services/identity/identity.go b/lib/tbot/services/identity/identity.go
new file mode 100644
index 0000000000000..eb7cfc7d84ea7
--- /dev/null
+++ b/lib/tbot/services/identity/identity.go
@@ -0,0 +1,31 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"go.opentelemetry.io/otel"
+
+	"github.com/gravitational/teleport"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var (
+	tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/identity")
+	log    = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentTBot)
+)
diff --git a/lib/tbot/services/identity/output.go b/lib/tbot/services/identity/output.go
new file mode 100644
index 0000000000000..916c7e240dc71
--- /dev/null
+++ b/lib/tbot/services/identity/output.go
@@ -0,0 +1,429 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"path/filepath"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
+	"github.com/gravitational/teleport/lib/config/openssh"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/ssh"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func OutputServiceBuilder(
+	cfg *OutputConfig,
+	alpnUpgradeCache *internal.ALPNUpgradeCache,
+	defaultCredentialLifetime bot.CredentialLifetime,
+	insecure, fips bool,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &OutputService{
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			insecure:                  insecure,
+			fips:                      fips,
+			cfg:                       cfg,
+			reloadCh:                  deps.ReloadCh,
+			executablePath:            autoupdate.StableExecutable,
+			alpnUpgradeCache:          alpnUpgradeCache,
+			proxyPinger:               deps.ProxyPinger,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(OutputServiceType, cfg.Name, buildFn)
+}
+
+// OutputService produces credentials which can be used to connect to
+// Teleport's API or SSH.
+type OutputService struct {
+	// botAuthClient should be an auth client using the bots internal identity.
+	// This will not have any roles impersonated and should only be used to
+	// fetch CAs.
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	defaultCredentialLifetime bot.CredentialLifetime
+	insecure, fips            bool
+	cfg                       *OutputConfig
+	log                       *slog.Logger
+	proxyPinger               connection.ProxyPinger
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+	// executablePath is called to get the path to the tbot executable.
+	// Usually this is os.Executable
+	executablePath    func() (string, error)
+	alpnUpgradeCache  *internal.ALPNUpgradeCache
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+func (s *OutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("identity-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *OutputService) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *OutputService) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *OutputService) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithReissuableRoleImpersonation(s.cfg.AllowReissue),
+		identity.WithLogger(s.log),
+	}
+	id, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	if s.cfg.Cluster != "" {
+		id, err = s.identityGenerator.GenerateFacade(ctx, append(identityOpts,
+			identity.WithCurrentIdentityFacade(id),
+			identity.WithRouteToCluster(s.cfg.Cluster),
+		)...)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := s.render(ctx, id.Get(), hostCAs, userCAs, databaseCAs); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if s.cfg.SSHConfigMode == SSHConfigModeOn {
+		clusterNames, err := internal.GetClusterNames(ctx, impersonatedClient, id.Get().ClusterName)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		proxyPing, err := s.proxyPinger.Ping(ctx)
+		if err != nil {
+			return trace.Wrap(err, "pinging proxy")
+		}
+		if err := renderSSHConfig(
+			ctx,
+			s.log,
+			proxyPing,
+			clusterNames,
+			s.cfg.Destination,
+			s.botAuthClient,
+			s.executablePath,
+			s.alpnUpgradeCache,
+			s.insecure,
+			s.fips,
+		); err != nil {
+			return trace.Wrap(err, "rendering OpenSSH configuration files")
+		}
+	}
+
+	return nil
+}
+
+func (s *OutputService) render(
+	ctx context.Context,
+	id *identity.Identity,
+	hostCAs, userCAs, databaseCAs []types.CertAuthority,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputService/render",
+	)
+	defer span.End()
+
+	keyRing, err := internal.NewClientKeyRing(id, hostCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := internal.WriteTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := internal.WriteIdentityFile(ctx, s.log, keyRing, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "writing identity file")
+	}
+	if err := identity.SaveIdentity(
+		ctx, id, s.cfg.Destination, identity.DestinationKinds()...,
+	); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	return nil
+}
+
+type certAuthGetter interface {
+	GetCertAuthority(
+		ctx context.Context,
+		id types.CertAuthID,
+		includeSigningKeys bool,
+	) (types.CertAuthority, error)
+}
+
+type alpnTester interface {
+	IsUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error)
+}
+
+func renderSSHConfig(
+	ctx context.Context,
+	log *slog.Logger,
+	proxyPing *connection.ProxyPong,
+	clusterNames []string,
+	dest destination.Destination,
+	certAuthGetter certAuthGetter,
+	getExecutablePath func() (string, error),
+	alpnTester alpnTester,
+	insecure, fips bool,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"renderSSHConfig",
+	)
+	defer span.End()
+
+	proxyAddr, err := proxyPing.ProxySSHAddr()
+	if err != nil {
+		return trace.Wrap(err, "determining proxy ssh addr")
+	}
+	proxyHost, proxyPort, err := utils.SplitHostPort(proxyAddr)
+	if err != nil {
+		return trace.BadParameter(
+			"proxy %+v has no usable public address: %v",
+			proxyAddr, err,
+		)
+	}
+
+	// We'll write known_hosts regardless of Destination type, it's still
+	// useful alongside a manually-written ssh_config.
+	knownHosts, clusterKnownHosts, err := ssh.GenerateKnownHosts(
+		ctx,
+		certAuthGetter,
+		clusterNames,
+		proxyHost,
+	)
+	if err != nil {
+		return trace.Wrap(err, "generating known_hosts")
+	}
+
+	if err := dest.Write(
+		ctx, ssh.KnownHostsName, []byte(knownHosts),
+	); err != nil {
+		return trace.Wrap(err, "writing known_hosts to destination")
+	}
+
+	// We only want to proceed further if we have a directory destination
+	destDirectory, ok := dest.(*destination.Directory)
+	if !ok {
+		return nil
+	}
+
+	// Backend note: Prefer to use absolute paths for filesystem backends.
+	// If the backend is something else, use "". ssh_config will generate with
+	// paths relative to the Destination. This doesn't work with ssh in
+	// practice so adjusting the config for impossible-to-determine-in-advance
+	// Destination backends is left as an exercise to the user.
+	absDestPath, err := filepath.Abs(destDirectory.Path)
+	if err != nil {
+		return trace.Wrap(err, "determining absolute path")
+	}
+
+	executablePath, err := getExecutablePath()
+	if errors.Is(err, autoupdate.ErrUnstableExecutable) {
+		log.WarnContext(ctx, "ssh_config will be created with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
+	} else if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var sshConfigBuilder strings.Builder
+	knownHostsPath := filepath.Join(absDestPath, ssh.KnownHostsName)
+	identityFilePath := filepath.Join(absDestPath, identity.PrivateKeyKey)
+	certificateFilePath := filepath.Join(absDestPath, identity.SSHCertKey)
+
+	// Test if ALPN upgrade is required, this will only be necessary if we
+	// are using TLS routing.
+	connUpgradeRequired := false
+	if proxyPing.Proxy.TLSRoutingEnabled {
+		connUpgradeRequired, err = alpnTester.IsUpgradeRequired(
+			ctx, proxyAddr, insecure,
+		)
+		if err != nil {
+			return trace.Wrap(err, "determining if ALPN upgrade is required")
+		}
+	}
+
+	// Generate SSH config
+	if err := openssh.WriteSSHConfig(&sshConfigBuilder, &openssh.SSHConfigParameters{
+		AppName:             openssh.TbotApp,
+		ClusterNames:        clusterNames,
+		KnownHostsPath:      knownHostsPath,
+		IdentityFilePath:    identityFilePath,
+		CertificateFilePath: certificateFilePath,
+		ProxyHost:           proxyHost,
+		ProxyPort:           proxyPort,
+		ExecutablePath:      executablePath,
+		DestinationDir:      absDestPath,
+
+		PureTBotProxyCommand: true,
+		Insecure:             insecure,
+		FIPS:                 fips,
+		TLSRouting:           proxyPing.Proxy.TLSRoutingEnabled,
+		ConnectionUpgrade:    connUpgradeRequired,
+		// Session resumption is enabled by default, this can be
+		// configurable at a later date if we discover reasons for this to
+		// be disabled.
+		Resume: true,
+	}); err != nil {
+		return trace.Wrap(err, "generating global ssh_config")
+	}
+
+	// Generate the per cluster files
+	for _, clusterName := range clusterNames {
+		sshConfigName := fmt.Sprintf("%s.%s", clusterName, ssh.ConfigName)
+		knownHostsName := fmt.Sprintf("%s.%s", clusterName, ssh.KnownHostsName)
+		knownHostsPath := filepath.Join(absDestPath, knownHostsName)
+
+		sb := &strings.Builder{}
+		if err := openssh.WriteClusterSSHConfig(sb, &openssh.ClusterSSHConfigParameters{
+			AppName:             openssh.TbotApp,
+			ClusterName:         clusterName,
+			KnownHostsPath:      knownHostsPath,
+			IdentityFilePath:    identityFilePath,
+			CertificateFilePath: certificateFilePath,
+			ProxyHost:           proxyHost,
+			ProxyPort:           proxyPort,
+			ExecutablePath:      executablePath,
+			DestinationDir:      absDestPath,
+
+			Insecure:          insecure,
+			FIPS:              fips,
+			TLSRouting:        proxyPing.Proxy.TLSRoutingEnabled,
+			ConnectionUpgrade: connUpgradeRequired,
+			// Session resumption is enabled by default, this can be
+			// configurable at a later date if we discover reasons for this to
+			// be disabled.
+			Resume: true,
+		}); err != nil {
+			return trace.Wrap(err, "generating ssh_config for cluster %q", clusterName)
+		}
+		if err := destDirectory.Write(ctx, sshConfigName, []byte(sb.String())); err != nil {
+			return trace.Wrap(err, "writing ssh_config for cluster %q", clusterName)
+		}
+
+		knownHosts, ok := clusterKnownHosts[clusterName]
+		if !ok {
+			log.WarnContext(
+				ctx,
+				"No generated known_hosts for cluster, will skip",
+				"cluster", clusterName,
+			)
+			continue
+		}
+		if err := destDirectory.Write(ctx, knownHostsName, []byte(knownHosts)); err != nil {
+			return trace.Wrap(err, "writing known_hosts for cluster %q", clusterName)
+		}
+	}
+
+	if err := destDirectory.Write(ctx, ssh.ConfigName, []byte(sshConfigBuilder.String())); err != nil {
+		return trace.Wrap(err, "writing global ssh_config")
+	}
+
+	return nil
+}
diff --git a/lib/tbot/services/identity/output_config.go b/lib/tbot/services/identity/output_config.go
new file mode 100644
index 0000000000000..6adb4b48e6b49
--- /dev/null
+++ b/lib/tbot/services/identity/output_config.go
@@ -0,0 +1,207 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+	"github.com/gravitational/teleport/lib/tbot/ssh"
+)
+
+const (
+	OutputServiceType = "identity"
+	IdentityFilePath  = internal.IdentityFilePath
+)
+
+// SSHConfigMode controls whether to write an ssh_config file to the
+// destination directory.
+type SSHConfigMode string
+
+const (
+	// SSHConfigModeNone will default to SSHConfigModeOn.
+	SSHConfigModeNone SSHConfigMode = ""
+	// SSHConfigModeOff will not write an ssh_config file. This is useful where
+	// you do not want to use SSH functionality and would like to avoid
+	// pinging the proxy.
+	SSHConfigModeOff SSHConfigMode = "off"
+	// SSHConfigModeOn will write an ssh_config file to the destination
+	// directory.
+	// Causes the generation of:
+	// - ssh_config
+	// - known_hosts
+	SSHConfigModeOn SSHConfigMode = "on"
+)
+
+// OutputConfig produces credentials which can be used with `tsh`, `tctl`,
+// `openssh` and most SSH compatible tooling. It can also be used with the
+// Teleport API and things which use the API client (e.g the terraform provider)
+//
+// It cannot be used to connect to Applications, Databases or Kubernetes
+// Clusters.
+type OutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Cluster allows certificates to be generated for a leaf cluster of the
+	// cluster that the bot is connected to. These certificates can be used
+	// to directly connect to a Teleport proxy of that leaf cluster, or used
+	// with the root cluster's proxy which will forward the request to the
+	// leaf cluster.
+	// For now, only SSH is supported.
+	Cluster string `yaml:"cluster,omitempty"`
+
+	// SSHConfigMode controls whether to write an ssh_config file to the
+	// destination directory. Defaults to SSHConfigModeOn.
+	SSHConfigMode SSHConfigMode `yaml:"ssh_config,omitempty"`
+
+	// AllowReissue controls whether the generated credentials can be used to
+	// reissue further credentials (e.g to produce a certificate for application
+	// access). It is recommended to leave this disabled to prevent the scope of
+	// issued credentials from being increased, however, it can be useful in
+	// scenarios where credentials are desired to be reissued in a dynamic way.
+	//
+	// Defaults to false.
+	AllowReissue bool `yaml:"allow_reissue,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *OutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *OutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (o *OutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+func (o *OutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *OutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+
+	if _, ok := o.Destination.(*destination.Directory); !ok {
+		// If destDir is unset, we're not using a filesystem destination and
+		// ssh_config will not be sensible. Log a note and bail early without
+		// writing ssh_config. (Future users of k8s secrets will need to bring
+		// their own config, we can't predict where paths will be in practice.)
+		log.InfoContext(
+			context.TODO(),
+			"Note: no ssh_config will be written for non-filesystem destination",
+			"destination", o.Destination,
+		)
+	}
+
+	switch o.SSHConfigMode {
+	case SSHConfigModeNone:
+		log.DebugContext(context.Background(), "Defaulting to SSHConfigModeOn")
+		o.SSHConfigMode = SSHConfigModeOn
+	case SSHConfigModeOff, SSHConfigModeOn:
+	default:
+		return trace.BadParameter("ssh_config: unrecognized value %q", o.SSHConfigMode)
+	}
+
+	return nil
+}
+
+func (o *OutputConfig) Describe() []bot.FileDescription {
+	var fds = []bot.FileDescription{
+		{
+			Name: internal.IdentityFilePath,
+		},
+		{
+			Name: internal.HostCAPath,
+		},
+		{
+			Name: internal.UserCAPath,
+		},
+		{
+			Name: internal.DatabaseCAPath,
+		},
+	}
+	if o.SSHConfigMode == SSHConfigModeOn {
+		fds = append(fds, bot.FileDescription{
+			Name: ssh.KnownHostsName,
+		})
+		if _, ok := o.Destination.(*destination.Directory); ok {
+			fds = append(fds, bot.FileDescription{
+				Name: ssh.ConfigName,
+			})
+		}
+	}
+
+	return fds
+}
+
+func (o *OutputConfig) MarshalYAML() (any, error) {
+	type raw OutputConfig
+	return encoding.WithTypeHeader((*raw)(o), OutputServiceType)
+}
+
+func (o *OutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *OutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw OutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *OutputConfig) Type() string {
+	return OutputServiceType
+}
+
+func (o *OutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/identity/output_config_test.go b/lib/tbot/services/identity/output_config_test.go
new file mode 100644
index 0000000000000..6b688b59e194f
--- /dev/null
+++ b/lib/tbot/services/identity/output_config_test.go
@@ -0,0 +1,101 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestIdentityOutput_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[OutputConfig]{
+		{
+			name: "full",
+			in: OutputConfig{
+				Destination:   dest,
+				Roles:         []string{"access"},
+				Cluster:       "leaf.example.com",
+				SSHConfigMode: SSHConfigModeOff,
+				AllowReissue:  true,
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: OutputConfig{
+				Destination: dest,
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestIdentityOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*OutputConfig]{
+		{
+			name: "valid",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination:   destination.NewMemory(),
+					Roles:         []string{"access"},
+					SSHConfigMode: SSHConfigModeOn,
+				}
+			},
+		},
+		{
+			name: "ssh config mode defaults",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: destination.NewMemory(),
+				}
+			},
+			want: &OutputConfig{
+				Destination:   destination.NewMemory(),
+				SSHConfigMode: SSHConfigModeOn,
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination: nil,
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "invalid ssh config mode",
+			in: func() *OutputConfig {
+				return &OutputConfig{
+					Destination:   destination.NewMemory(),
+					SSHConfigMode: "invalid",
+				}
+			},
+			wantErr: "ssh_config: unrecognized value \"invalid\"",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/identity/output_test.go b/lib/tbot/services/identity/output_test.go
new file mode 100644
index 0000000000000..30467d05db2c8
--- /dev/null
+++ b/lib/tbot/services/identity/output_test.go
@@ -0,0 +1,247 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package identity
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/webclient"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/ssh"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+const (
+	mockClusterName = "tele.blackmesa.gov"
+	// mockProxyAddr is the address of the mock proxy server, used in tests
+	mockProxyAddr    = "tele.blackmesa.gov:443"
+	mockProxySSHAddr = "tele.blackmesa.gov:3023"
+	// mockRemoteClusterName is the remote cluster name used for the mock auth
+	// client
+	mockRemoteClusterName = "tele.aperture.labs"
+)
+
+// fakeGetExecutablePath can be injected into outputs to ensure they output the
+// same path in tests across multiple systems.
+func fakeGetExecutablePath() (string, error) {
+	return "/path/to/tbot", nil
+}
+
+type mockCertAuthorityGetter struct {
+	remoteClusterName string
+	clusterName       string
+}
+
+func (p *mockCertAuthorityGetter) GetCertAuthority(
+	ctx context.Context, id types.CertAuthID, loadKeys bool,
+) (types.CertAuthority, error) {
+	if !slices.Contains([]string{p.clusterName, p.remoteClusterName}, id.DomainName) {
+		return nil, trace.NotFound("specified id %q not found", id)
+	}
+	if loadKeys {
+		return nil, trace.BadParameter("unexpected loading of key")
+	}
+
+	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+		// Pretend to be the correct type.
+		Type:        id.Type,
+		ClusterName: id.DomainName,
+		ActiveKeys: types.CAKeySet{
+			TLS: []*types.TLSKeyPair{
+				{
+					Cert: []byte(fixtures.TLSCACertPEM),
+					Key:  []byte(fixtures.TLSCAKeyPEM),
+				},
+			},
+			SSH: []*types.SSHKeyPair{
+				// Two of these to ensure that both are written to known hosts
+				{
+					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
+					PublicKey:  []byte(fixtures.SSHCAPublicKey),
+				},
+				{
+					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
+					PublicKey:  []byte(fixtures.SSHCAPublicKey),
+				},
+			},
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return ca, nil
+}
+
+func (p *mockCertAuthorityGetter) GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error) {
+	// We'll just wrap GetCertAuthority()'s dummy CA.
+	ca, err := p.GetCertAuthority(ctx, types.CertAuthID{
+		// Just pretend to be whichever type of CA was requested.
+		Type:       caType,
+		DomainName: p.clusterName,
+	}, false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return []types.CertAuthority{ca}, nil
+}
+
+type mockALPNConnTester struct {
+	isALPNUpgradeRequired bool
+}
+
+func (p *mockALPNConnTester) IsUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error) {
+	return p.isALPNUpgradeRequired, nil
+}
+
+func Test_renderSSHConfig(t *testing.T) {
+	tests := []struct {
+		Name        string
+		TLSRouting  bool
+		ALPNUpgrade bool
+	}{
+		{
+			Name:        "no tls routing, no alpn upgrade",
+			TLSRouting:  false,
+			ALPNUpgrade: false,
+		},
+		{
+			Name:        "no tls routing, alpn upgrade",
+			TLSRouting:  false,
+			ALPNUpgrade: true,
+		},
+		{
+			Name:        "tls routing, no alpn upgrade",
+			TLSRouting:  true,
+			ALPNUpgrade: false,
+		},
+		{
+			Name:        "tls routing, alpn upgrade",
+			TLSRouting:  true,
+			ALPNUpgrade: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.Name, func(t *testing.T) {
+			dir := t.TempDir()
+
+			// identity is passed in, but not used.
+			dest := &destination.Directory{
+				Path:     dir,
+				Symlinks: botfs.SymlinksInsecure,
+				ACLs:     botfs.ACLOff,
+			}
+
+			err := renderSSHConfig(
+				context.Background(),
+				logtest.NewLogger(),
+				&connection.ProxyPong{
+					PingResponse: &webclient.PingResponse{
+						ClusterName: mockClusterName,
+						Proxy: webclient.ProxySettings{
+							TLSRoutingEnabled: tc.TLSRouting,
+							SSH: webclient.SSHProxySettings{
+								PublicAddr:    mockProxyAddr,
+								SSHPublicAddr: mockProxySSHAddr,
+							},
+						},
+					},
+				},
+				[]string{mockClusterName, mockRemoteClusterName},
+				dest,
+				&mockCertAuthorityGetter{
+					remoteClusterName: mockRemoteClusterName,
+					clusterName:       mockClusterName,
+				},
+				fakeGetExecutablePath,
+				&mockALPNConnTester{
+					isALPNUpgradeRequired: tc.ALPNUpgrade,
+				},
+				false, // insecure
+				false, // fips
+			)
+			require.NoError(t, err)
+
+			replaceTestDir := func(b []byte) []byte {
+				return bytes.ReplaceAll(b, []byte(dir), []byte("/test/dir"))
+			}
+
+			knownHostBytes, err := os.ReadFile(filepath.Join(dir, ssh.KnownHostsName))
+			require.NoError(t, err)
+			knownHostBytes = replaceTestDir(knownHostBytes)
+			sshConfigBytes, err := os.ReadFile(filepath.Join(dir, ssh.ConfigName))
+			require.NoError(t, err)
+			sshConfigBytes = replaceTestDir(sshConfigBytes)
+			if golden.ShouldSet() {
+				golden.SetNamed(t, "known_hosts", knownHostBytes)
+				golden.SetNamed(t, "ssh_config", sshConfigBytes)
+			}
+			require.Equal(
+				t, string(golden.GetNamed(t, "known_hosts")), string(knownHostBytes),
+			)
+			require.Equal(
+				t, string(golden.GetNamed(t, "ssh_config")), string(sshConfigBytes),
+			)
+
+			for clusterType, clusterName := range map[string]string{
+				"local":  mockClusterName,
+				"remote": mockRemoteClusterName,
+			} {
+				clusterKnownHostBytes, err := os.ReadFile(
+					filepath.Join(dir, fmt.Sprintf("%s.%s", clusterName, ssh.KnownHostsName)),
+				)
+				require.NoError(t, err)
+				clusterKnownHostBytes = replaceTestDir(clusterKnownHostBytes)
+				clusterSSHConfigBytes, err := os.ReadFile(
+					filepath.Join(dir, fmt.Sprintf("%s.%s", clusterName, ssh.ConfigName)),
+				)
+				require.NoError(t, err)
+				clusterSSHConfigBytes = replaceTestDir(clusterSSHConfigBytes)
+
+				configGolden := fmt.Sprintf("%s_cluster_ssh_config", clusterType)
+				knownHostsGolden := fmt.Sprintf("%s_cluster_known_hosts", clusterType)
+				if golden.ShouldSet() {
+					golden.SetNamed(t, knownHostsGolden, clusterKnownHostBytes)
+					golden.SetNamed(t, configGolden, clusterSSHConfigBytes)
+				}
+				require.Equal(
+					t, string(golden.GetNamed(t, knownHostsGolden)), string(clusterKnownHostBytes),
+				)
+				require.Equal(
+					t, string(golden.GetNamed(t, configGolden)), string(clusterSSHConfigBytes),
+				)
+			}
+		})
+	}
+}
diff --git a/lib/tbot/config/testdata/TestIdentityOutput_YAML/full.golden b/lib/tbot/services/identity/testdata/TestIdentityOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestIdentityOutput_YAML/full.golden
rename to lib/tbot/services/identity/testdata/TestIdentityOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestIdentityOutput_YAML/minimal.golden b/lib/tbot/services/identity/testdata/TestIdentityOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestIdentityOutput_YAML/minimal.golden
rename to lib/tbot/services/identity/testdata/TestIdentityOutput_YAML/minimal.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_alpn_upgrade/ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/no_tls_routing,_no_alpn_upgrade/ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/local_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/remote_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_alpn_upgrade/ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/local_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_known_hosts.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/remote_cluster_ssh_config.golden
diff --git a/lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/ssh_config.golden b/lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/ssh_config.golden
similarity index 100%
rename from lib/tbot/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/ssh_config.golden
rename to lib/tbot/services/identity/testdata/Test_renderSSHConfig/tls_routing,_no_alpn_upgrade/ssh_config.golden
diff --git a/lib/tbot/services/k8s/argocd_output.go b/lib/tbot/services/k8s/argocd_output.go
new file mode 100644
index 0000000000000..4a00670a70819
--- /dev/null
+++ b/lib/tbot/services/k8s/argocd_output.go
@@ -0,0 +1,460 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"maps"
+	"strconv"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/gravitational/trace"
+	corev1 "k8s.io/api/core/v1"
+	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+// ArgoCDServiceBuilder builds a new ArgoCDOutput.
+func ArgoCDServiceBuilder(cfg *ArgoCDOutputConfig, opts ...ArgoCDServiceOption) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		svc := &ArgoCDOutput{
+			cfg:                       cfg,
+			defaultCredentialLifetime: bot.DefaultCredentialLifetime,
+			proxyPinger:               deps.ProxyPinger,
+			client:                    deps.Client,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			reloadCh:                  deps.ReloadCh,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+
+		for _, opt := range opts {
+			opt.applyToArgoOutput(svc)
+		}
+
+		// If no k8s client is provided, we attempt to create one from the
+		// environment.
+		if svc.k8s == nil {
+			var err error
+			if svc.k8s, err = newKubernetesClient(); err != nil {
+				return nil, trace.Wrap(err, "creating Kubernetes client")
+			}
+		}
+
+		if svc.alpnUpgradeCache == nil {
+			svc.alpnUpgradeCache = internal.NewALPNUpgradeCache(svc.log)
+		}
+
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(ArgoCDOutputServiceType, cfg.Name, buildFn)
+}
+
+// ArgoCDServiceOption is an option that can be provided to customize the service.
+type ArgoCDServiceOption interface{ applyToArgoOutput(*ArgoCDOutput) }
+
+func (opt DefaultCredentialLifetimeOption) applyToArgoOutput(o *ArgoCDOutput) {
+	o.defaultCredentialLifetime = opt.lifetime
+}
+
+func (opt KubernetesClientOption) applyToArgoOutput(o *ArgoCDOutput) { o.k8s = opt.client }
+func (opt InsecureOption) applyToArgoOutput(o *ArgoCDOutput)         { o.insecure = opt.insecure }
+func (opt ALPNUpgradeCacheOption) applyToArgoOutput(o *ArgoCDOutput) { o.alpnUpgradeCache = opt.cache }
+
+// ArgoCDOutput registers Kubernetes clusters with ArgoCD by writing their
+// details and the client certificate, etc. as Kubernetes secrets.
+type ArgoCDOutput struct {
+	cfg                       *ArgoCDOutputConfig
+	defaultCredentialLifetime bot.CredentialLifetime
+	k8s                       kubernetes.Interface
+
+	log            *slog.Logger
+	statusReporter readyz.Reporter
+	reloadCh       <-chan struct{}
+
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+	proxyPinger       connection.ProxyPinger
+
+	client             *apiclient.Client
+	botIdentityReadyCh <-chan struct{}
+	alpnUpgradeCache   *internal.ALPNUpgradeCache
+	insecure           bool
+}
+
+// String returns the human-readable representation of the service that will be
+// used in logs and the `/readyz` endpoints.
+func (s *ArgoCDOutput) String() string {
+	if s.cfg.Name != "" {
+		return s.cfg.Name
+	}
+	var selectors []string
+	for _, s := range s.cfg.Selectors {
+		selectors = append(selectors, s.String())
+	}
+	return fmt.Sprintf("kubernetes-argo-cd-output (%s)", strings.Join(selectors, ", "))
+}
+
+// Run periodically refreshes the cluster credentials.
+func (s *ArgoCDOutput) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service: s.String(),
+		Name:    "output-renewal",
+		F: func(ctx context.Context) error {
+			err := s.generate(ctx)
+
+			// If the Teleport proxy is behind a TLS-terminating load balancer,
+			// generate will return a NotImplemented error. We return nil here
+			// because we do not want to RunOnInterval to retry.
+			//
+			// While we could have generate return nil in this case instead, we
+			// do want to surface it as a hard error in one-shot mode.
+			if trace.IsNotImplemented(err) {
+				s.log.ErrorContext(ctx, "Failed to generate Argo CD cluster credentials", "error", err)
+				return nil
+			}
+
+			return err
+		},
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+// OneShot generates cluster credentials once and exits.
+func (s *ArgoCDOutput) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *ArgoCDOutput) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"ArgoCDOutput/generate",
+	)
+	defer span.End()
+
+	clusters, err := s.discoverClusters(ctx)
+	if err != nil {
+		return trace.Wrap(err, "discovering clusters")
+	}
+
+	var errors []error
+	for _, cluster := range clusters {
+		secret, err := s.renderSecret(cluster)
+		if err != nil {
+			errors = append(errors, trace.Wrap(err, "rendering cluster secret"))
+			continue
+		}
+		if err := s.writeSecret(ctx, secret); err != nil {
+			errors = append(errors, trace.Wrap(err, "writing cluster secret"))
+			continue
+		}
+	}
+	return trace.NewAggregate(errors...)
+}
+
+func (s *ArgoCDOutput) discoverClusters(ctx context.Context) ([]*argoClusterCredentials, error) {
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating identity")
+	}
+
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	matches, err := fetchAllMatchingKubeClusters(ctx, impersonatedClient, s.cfg.Selectors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Copy clusters into a map to deduplicate by name.
+	clusters := make(map[string]types.KubeCluster)
+	for _, m := range matches {
+		clusters[m.cluster.GetName()] = m.cluster
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Generated identity for Kubernetes access",
+		"matched_cluster_count", len(clusters),
+		"identity", id.Get(),
+	)
+	proxyPong, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "pinging proxy to determine connection pathway")
+	}
+
+	proxyAddr, kubeSNI, err := selectKubeConnectionMethod(proxyPong)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if proxyPong.Proxy.TLSRoutingEnabled {
+		required, err := s.alpnUpgradeCache.IsUpgradeRequired(ctx, proxyAddr, s.insecure)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if required {
+			return nil, trace.NotImplemented(
+				"Teleport proxy %q appears to be behind a TLS-terminating load balancer that does not support ALPN. "+
+					"The %q service does not support this configuration, but you may be able to work around it by "+
+					"running a local proxy with `tbot proxy kube` and configuring the cluster in Argo CD manually.",
+				proxyAddr,
+				ArgoCDOutputServiceType,
+			)
+		}
+	}
+
+	hostCAs, err := s.client.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	keyRing, err := internal.NewClientKeyRing(id.Get(), hostCAs)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clusterCAs, err := keyRing.RootClusterCAs()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	caBytes := bytes.Join(clusterCAs, []byte("\n"))
+	if len(caBytes) == 0 {
+		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
+	}
+
+	credentials := make([]*argoClusterCredentials, 0, len(clusters))
+	for _, cluster := range clusters {
+		credentials = append(credentials, &argoClusterCredentials{
+			teleportClusterName: proxyPong.ClusterName,
+			kubeClusterName:     cluster.GetName(),
+			kubeClusterLabels:   cluster.GetAllLabels(),
+			addr: fmt.Sprintf(
+				"%s/v1/teleport/%s/%s",
+				proxyAddr,
+				encodePathComponent(proxyPong.ClusterName),
+				encodePathComponent(cluster.GetName()),
+			),
+			tlsClientConfig: argoTLSClientConfig{
+				CAData:     caBytes,
+				CertData:   keyRing.TLSCert,
+				KeyData:    keyRing.TLSPrivateKey.PrivateKeyPEM(),
+				ServerName: kubeSNI,
+			},
+			botName: id.Get().TLSIdentity.BotName,
+		})
+	}
+	return credentials, nil
+}
+
+type argoClusterCredentials struct {
+	teleportClusterName string
+	kubeClusterName     string
+	kubeClusterLabels   map[string]string
+	addr                string
+	tlsClientConfig     argoTLSClientConfig
+	botName             string
+}
+
+type argoTLSClientConfig struct {
+	CAData     []byte `json:"caData"`
+	CertData   []byte `json:"certData"`
+	KeyData    []byte `json:"keyData"`
+	ServerName string `json:"serverName,omitempty"`
+}
+
+func (s *ArgoCDOutput) renderSecret(cluster *argoClusterCredentials) (*corev1.Secret, error) {
+	labels := map[string]string{
+		"argocd.argoproj.io/secret-type": "cluster",
+	}
+	for k, v := range s.cfg.SecretLabels {
+		// Do not overwrite any of "our" labels.
+		if _, ok := labels[k]; ok {
+			continue
+		}
+		v, err := renderTemplate(v, cluster)
+		if err != nil {
+			return nil, trace.Wrap(err, "templating secret label %q", k)
+		}
+		if v != "" {
+			labels[k] = v
+		}
+	}
+
+	annotations := map[string]string{
+		"teleport.dev/bot-name":                cluster.botName,
+		"teleport.dev/kubernetes-cluster-name": cluster.kubeClusterName,
+		"teleport.dev/updated":                 time.Now().Format(time.RFC3339),
+		"teleport.dev/tbot-version":            teleport.Version,
+		"teleport.dev/teleport-cluster-name":   cluster.teleportClusterName,
+	}
+	for k, v := range s.cfg.SecretAnnotations {
+		// Do not overwrite any of "our" annotations.
+		if _, ok := annotations[k]; !ok {
+			annotations[k] = v
+		}
+	}
+
+	configJSON, err := json.Marshal(struct {
+		TLSClientConfig argoTLSClientConfig `json:"tlsClientConfig"`
+	}{cluster.tlsClientConfig})
+	if err != nil {
+		return nil, trace.Wrap(err, "marshaling cluster credentials")
+	}
+
+	name, err := renderTemplate(s.cfg.ClusterNameTemplate, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err, "templating cluster name")
+	}
+
+	data := map[string][]byte{
+		"name":   []byte(name),
+		"server": []byte(cluster.addr),
+		"config": configJSON,
+	}
+
+	if s.cfg.Project != "" {
+		data["project"] = []byte(s.cfg.Project)
+	}
+
+	if len(s.cfg.Namespaces) != 0 {
+		data["namespaces"] = []byte(strings.Join(s.cfg.Namespaces, ","))
+		data["clusterResources"] = []byte(strconv.FormatBool(s.cfg.ClusterResources))
+	}
+
+	return &corev1.Secret{
+		Type: corev1.SecretTypeOpaque,
+		ObjectMeta: v1.ObjectMeta{
+			Name:        s.secretName(cluster),
+			Namespace:   s.cfg.SecretNamespace,
+			Labels:      labels,
+			Annotations: annotations,
+		},
+		Data: data,
+	}, nil
+}
+
+func (s *ArgoCDOutput) secretName(cluster *argoClusterCredentials) string {
+	h := sha256.New()
+	_, _ = h.Write([]byte(cluster.teleportClusterName))
+	_, _ = h.Write([]byte(cluster.kubeClusterName))
+	return fmt.Sprintf("%s.%x", s.cfg.SecretNamePrefix, h.Sum(nil)[:8])
+}
+
+func (s *ArgoCDOutput) writeSecret(ctx context.Context, secret *corev1.Secret) error {
+	fullName := fmt.Sprintf("%s/%s", secret.GetNamespace(), secret.GetName())
+	client := s.k8s.CoreV1().Secrets(secret.GetNamespace())
+
+	existing, err := client.Get(ctx, secret.GetName(), v1.GetOptions{})
+	if kubeerrors.IsNotFound(err) {
+		// Secret is new, create it.
+		if _, err := client.Create(ctx, secret, v1.CreateOptions{
+			FieldManager: "tbot",
+		}); err != nil {
+			return trace.Wrap(err, "creating secret: %s", fullName)
+		}
+		return nil
+	} else if err != nil {
+		// Failed to read the secret.
+		return trace.Wrap(err, "reading secret: %s", fullName)
+	}
+
+	// Secret exists, update it.
+	secret.SetResourceVersion(secret.ResourceVersion)
+
+	annotations := make(map[string]string)
+	maps.Copy(annotations, existing.Annotations)
+	maps.Copy(annotations, secret.Annotations)
+	secret.SetAnnotations(annotations)
+
+	// We use Update rather than Apply or Patch here because Argo CD will also
+	// write to the secret (e.g. to add its own annotations or edit the config)
+	// so it's likely we'd need to "force" apply our changes anyway.
+	if _, err := client.Update(ctx, secret, v1.UpdateOptions{
+		FieldManager: "tbot",
+	}); err != nil {
+		return trace.Wrap(err, "updating secret: %s", fullName)
+	}
+	return nil
+}
+
+func renderTemplate(temp string, cluster *argoClusterCredentials) (string, error) {
+	if temp == "" {
+		return "", nil
+	}
+
+	tmpl, err := template.New("").Parse(temp)
+	if err != nil {
+		return "", trace.BadParameter("failed to parse template, error: %v", err)
+	}
+
+	tmplVars := struct {
+		ClusterName string
+		KubeName    string
+		Labels      map[string]string
+	}{
+		ClusterName: cluster.teleportClusterName,
+		KubeName:    cluster.kubeClusterName,
+		Labels:      cluster.kubeClusterLabels,
+	}
+
+	var b bytes.Buffer
+	if err = tmpl.Execute(&b, tmplVars); err != nil {
+		return "", trace.BadParameter("failed to execute template, error: %v", err)
+	}
+	return b.String(), nil
+}
diff --git a/lib/tbot/services/k8s/argocd_output_config.go b/lib/tbot/services/k8s/argocd_output_config.go
new file mode 100644
index 0000000000000..987bc25ad0b1e
--- /dev/null
+++ b/lib/tbot/services/k8s/argocd_output_config.go
@@ -0,0 +1,185 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"cmp"
+	"os"
+
+	"github.com/gravitational/trace"
+	"k8s.io/apimachinery/pkg/api/validation"
+
+	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const ArgoCDOutputServiceType = "kubernetes/argo-cd"
+
+var defaultContextNameTemplate = kubeconfig.ContextName("{{.ClusterName}}", "{{.KubeName}}")
+
+// ArgoCDOutputConfig contains configuration for the service that registers
+// Kubernetes cluster credentials in Argo CD.
+//
+// See: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters
+type ArgoCDOutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+
+	// Selectors is a list of selectors used to determine which Kubernetes
+	// clusters will be registered in Argo CD.
+	Selectors []*KubernetesSelector `yaml:"selectors,omitempty"`
+
+	// SecretNamespace is the namespace to which cluster secrets will be written.
+	// By default, it will use the `POD_NAMESPACE` environment variable, or if
+	// that is empty: "default".
+	SecretNamespace string `yaml:"secret_namespace,omitempty"`
+
+	// SecretNamePrefix is the prefix that will be applied to Kubernetes secret
+	// names. The rest of the name will be derived from the name of the target
+	// cluster. Defaults to: "teleport.argocd-cluster".
+	SecretNamePrefix string `yaml:"secret_name_prefix,omitempty"`
+
+	// SecretLabels is a set of labels that will be applied to the created
+	// Kubernetes secrets (in addition to the labels added for Argo's benefit).
+	//
+	// Label values can be "text/template" strings with the following variables:
+	//
+	//   - {{.ClusterName}} - Name of the Teleport cluster
+	//   - {{.KubeName}} - Name of the Kubernetes cluster resource
+	//   - {{.Labels}} - Map of labels applied to the Kubernetes cluster
+	// 	   resource that can be indexed using `{{index .Labels "key"}}`
+	//
+	// If the label value is empty, the label will not be added to the secret.
+	SecretLabels map[string]string `yaml:"secret_labels,omitempty"`
+
+	// SecretLabels is a set of annotations that will be applied to the created
+	// Kubernetes secrets (in addition to tbot's own annotations).
+	SecretAnnotations map[string]string `yaml:"secret_annotations,omitempty"`
+
+	// Project is the Argo CD project with which the Kubernetes cluster
+	// credentials will be associated.
+	Project string `yaml:"project,omitempty"`
+
+	// Namespaces are the Kubernetes namespaces the created Argo CD cluster
+	// credentials will be allowed to operate on.
+	Namespaces []string `yaml:"namespaces,omitempty"`
+
+	// ClusterResources determines whether the created Argo CD cluster
+	// credentials will be allowed to operate on cluster-scoped resources (only
+	// when Namespaces is non-empty).
+	ClusterResources bool `yaml:"cluster_resources,omitempty"`
+
+	// ClusterNameTemplate determines the format of cluster names in Argo CD.
+	// It is a "text/template" string that supports the following variables:
+	//
+	//   - {{.ClusterName}} - Name of the Teleport cluster
+	//   - {{.KubeName}} - Name of the Kubernetes cluster resource
+	//   - {{.Labels}} - Map of labels applied to the Kubernetes cluster
+	// 	   resource that can be indexed using {{index .Labels "key"}}
+	//
+	// By default, the following template will be used: "{{.ClusterName}}-{{.KubeName}}".
+	ClusterNameTemplate string `yaml:"cluster_name_template,omitempty"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *ArgoCDOutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *ArgoCDOutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+// CheckAndSetDefaults validates the service configuration and sets any default
+// values.
+func (o *ArgoCDOutputConfig) CheckAndSetDefaults() error {
+	if len(o.Selectors) == 0 {
+		return trace.BadParameter("at least one selector is required")
+	}
+	for idx, selector := range o.Selectors {
+		if err := selector.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err, "validating selectors[%d]", idx)
+		}
+	}
+
+	o.SecretNamespace = cmp.Or(
+		o.SecretNamespace,
+		os.Getenv(kubernetesNamespaceEnv),
+		"default",
+	)
+
+	if o.SecretNamePrefix == "" {
+		o.SecretNamePrefix = "teleport.argocd-cluster"
+	} else {
+		if len(validation.NameIsDNSSubdomain(o.SecretNamePrefix, true)) != 0 {
+			return trace.BadParameter("secret_name_prefix may only include lowercase letters, numbers, '-' and '.' characters")
+		}
+	}
+
+	for idx, ns := range o.Namespaces {
+		if ns == "" {
+			return trace.BadParameter("namespaces[%d] cannot be blank", idx)
+		}
+		if len(validation.ValidateNamespaceName(ns, false)) != 0 {
+			return trace.BadParameter("namespaces[%d] is not a valid namespace name", idx)
+		}
+	}
+
+	if o.ClusterResources && len(o.Namespaces) == 0 {
+		return trace.BadParameter("cluster_resources is only applicable if namespaces is also set")
+	}
+
+	if o.ClusterNameTemplate == "" {
+		o.ClusterNameTemplate = defaultContextNameTemplate
+	} else {
+		if _, err := renderTemplate(o.ClusterNameTemplate, &argoClusterCredentials{}); err != nil {
+			return trace.BadParameter("cluster_name_template is invalid: %v", err)
+		}
+	}
+
+	for k, v := range o.SecretLabels {
+		if _, err := renderTemplate(v, &argoClusterCredentials{}); err != nil {
+			return trace.BadParameter("secret_labels[%q] is invalid: %v", k, err)
+		}
+	}
+
+	return nil
+}
+
+// Type returns the service type string.
+func (s *ArgoCDOutputConfig) Type() string {
+	return ArgoCDOutputServiceType
+}
+
+// MarshalYAML marshals the configuration to YAML.
+func (s *ArgoCDOutputConfig) MarshalYAML() (any, error) {
+	type raw ArgoCDOutputConfig
+	return encoding.WithTypeHeader((*raw)(s), ArgoCDOutputServiceType)
+}
+
+// GetCredentialLifetime returns the service's credential lifetime.
+func (o *ArgoCDOutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/k8s/argocd_output_config_test.go b/lib/tbot/services/k8s/argocd_output_config_test.go
new file mode 100644
index 0000000000000..ca908c16df337
--- /dev/null
+++ b/lib/tbot/services/k8s/argocd_output_config_test.go
@@ -0,0 +1,245 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+func TestArgoCDOutput_YAML(t *testing.T) {
+	tests := []testYAMLCase[ArgoCDOutputConfig]{
+		{
+			name: "full",
+			in: ArgoCDOutputConfig{
+				Name: "my-argo-service",
+				Selectors: []*KubernetesSelector{
+					{
+						Name:   "foo",
+						Labels: map[string]string{},
+					},
+					{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+				SecretNamespace:  "argocd",
+				SecretNamePrefix: "my-argo-cluster-",
+				SecretLabels: map[string]string{
+					"my-label": "value",
+				},
+				SecretAnnotations: map[string]string{
+					"my-annotation": "value",
+				},
+				Project:             "super-secret-project",
+				Namespaces:          []string{"prod", "dev"},
+				ClusterResources:    true,
+				ClusterNameTemplate: "{{.KubeName}}",
+			},
+		},
+		{
+			name: "minimal",
+			in: ArgoCDOutputConfig{
+				Selectors: []*KubernetesSelector{
+					{
+						Name:   "foo",
+						Labels: map[string]string{},
+					},
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestArgoCDConfig_CheckAndSetDefaults(t *testing.T) {
+	t.Setenv("POD_NAMESPACE", "my-pod-namespace")
+
+	tests := []testCheckAndSetDefaultsCase[*ArgoCDOutputConfig]{
+		{
+			name: "valid_with_name_selector",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Name: "foo", Labels: make(map[string]string)},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+		},
+		{
+			name: "valid_with_labels",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+		},
+		{
+			name: "no_selectors",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors:           []*KubernetesSelector{},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "at least one selector is required",
+		},
+		{
+			name: "invalid_selectors",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "one of 'name' and 'labels' must be specified",
+		},
+		{
+			name: "invalid_secret_name_prefix",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "NOT VALID",
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "secret_name_prefix may only include lowercase letters, numbers, '-' and '.' characters",
+		},
+		{
+			name: "empty_namespace",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					Namespaces:          []string{""},
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "namespaces[0] cannot be blank",
+		},
+		{
+			name: "invalid_namespaces",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					Namespaces:          []string{"foo,"},
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "namespaces[0] is not a valid namespace name",
+		},
+		{
+			name: "cluster_resources_but_no_namespaces",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					Namespaces:          []string{},
+					ClusterResources:    true,
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "cluster_resources is only applicable if namespaces is also set",
+		},
+		{
+			name: "invalid cluster_name_template",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:     "argocd",
+					SecretNamePrefix:    "argo-cluster",
+					ClusterNameTemplate: "{{.InvalidVariable}}",
+				}
+			},
+			wantErr: "can't evaluate field InvalidVariable",
+		},
+		{
+			name: "invalid secret_labels template",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+					SecretNamespace:  "argocd",
+					SecretNamePrefix: "argo-cluster",
+					SecretLabels: map[string]string{
+						"foo": "{{.InvalidVariable}}",
+					},
+					ClusterNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "can't evaluate field InvalidVariable",
+		},
+		{
+			name: "defaults",
+			in: func() *ArgoCDOutputConfig {
+				return &ArgoCDOutputConfig{
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{"foo": "bar"}},
+					},
+				}
+			},
+			want: &ArgoCDOutputConfig{
+				Selectors: []*KubernetesSelector{
+					{Labels: map[string]string{"foo": "bar"}},
+				},
+				SecretNamespace:     "my-pod-namespace",
+				SecretNamePrefix:    "teleport.argocd-cluster",
+				ClusterNameTemplate: "{{.ClusterName}}-{{.KubeName}}",
+			},
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/k8s/argocd_output_test.go b/lib/tbot/services/k8s/argocd_output_test.go
new file mode 100644
index 0000000000000..94fcf7fe84594
--- /dev/null
+++ b/lib/tbot/services/k8s/argocd_output_test.go
@@ -0,0 +1,243 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"encoding/json"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestArgoCDOutput_String(t *testing.T) {
+	t.Parallel()
+
+	svc := &ArgoCDOutput{
+		cfg: &ArgoCDOutputConfig{
+			Selectors: []*KubernetesSelector{
+				{Name: "cluster-1"},
+				{Name: "cluster-2"},
+				{
+					Labels: map[string]string{
+						"env":    "prod",
+						"region": "eu",
+					},
+				},
+			},
+		},
+	}
+	require.Equal(t, "kubernetes-argo-cd-output (name=cluster-1, name=cluster-2, labels={env=prod, region=eu})", svc.String())
+}
+
+func TestArgoCDOutput_EndToEnd(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	log := logtest.NewLogger()
+
+	// Spin up a test server.
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithProxyKube(),
+		testenv.WithAuthConfig(func(auth *servicecfg.AuthConfig) {
+			auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+		}),
+	)
+	require.NoError(t, err)
+
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+
+	registerCluster := func(t *testing.T, name string) {
+		t.Helper()
+
+		kubeCluster, err := types.NewKubernetesClusterV3(
+			types.Metadata{
+				Name:   name,
+				Labels: map[string]string{"department": "engineering"},
+			},
+			types.KubernetesClusterSpecV3{},
+		)
+		require.NoError(t, err)
+
+		kubeServer, err := types.NewKubernetesServerV3FromCluster(kubeCluster, "host", "1234")
+		require.NoError(t, err)
+
+		_, err = rootClient.UpsertKubernetesServer(ctx, kubeServer)
+		require.NoError(t, err)
+	}
+
+	// Register a kubernetes cluster.
+	registerCluster(t, "kube-cluster-1")
+
+	// Create a role giving the bot access to the kubernetes cluster.
+	role, err := types.NewRole("bot-role", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			KubernetesLabels: types.Labels{"*": []string{"*"}},
+			KubeGroups:       []string{"system:masters"},
+			KubeUsers:        []string{"kubernetes-user"},
+		},
+	})
+	require.NoError(t, err)
+
+	_, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	// Create the service.
+	k8s := fake.NewClientset()
+	service := ArgoCDServiceBuilder(
+		&ArgoCDOutputConfig{
+			SecretNamePrefix: "my-cluster",
+			SecretNamespace:  "argocd",
+			SecretLabels: map[string]string{
+				"team":               "billing",
+				"cluster-department": `{{ index .Labels "department" }}`,
+				"non-existent":       `{{ index .Labels "non-existent" }}`,
+			},
+			SecretAnnotations: map[string]string{
+				"managed-by": "ninjas",
+			},
+			Selectors: []*KubernetesSelector{
+				{Labels: map[string]string{"department": "engineering"}},
+			},
+			Project:          "my-argo-project",
+			Namespaces:       []string{"prod", "dev"},
+			ClusterResources: true,
+		},
+		WithKubernetesClient(k8s),
+	)
+
+	proxyAddr, err := process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	onboarding, _ := makeBot(t, rootClient, "argo-bot", role.GetName())
+
+	botConfig := bot.Config{
+		InternalStorage: destination.NewMemory(),
+		Connection: connection.Config{
+			Address:     proxyAddr.Addr,
+			AddressKind: connection.AddressKindProxy,
+			Insecure:    true,
+		},
+		Logger:     log,
+		Onboarding: *onboarding,
+		Services:   []bot.ServiceBuilder{service},
+	}
+
+	// Run the bot in one-shot mode.
+	b, err := bot.New(botConfig)
+	require.NoError(t, err)
+	require.NoError(t, b.OneShot(ctx))
+
+	// Expect the cluster credentials to have been written to a secret.
+	list, err := k8s.CoreV1().
+		Secrets("argocd").
+		List(ctx, metav1.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, list.Items, 1)
+
+	secret := list.Items[0]
+
+	// Check we apply the secret name prefix.
+	require.True(t, strings.HasPrefix(secret.Name, "my-cluster"))
+
+	// Check we set the correct labels on the secret.
+	require.Equal(t,
+		map[string]string{
+			"argocd.argoproj.io/secret-type": "cluster",
+			"team":                           "billing",
+			"cluster-department":             "engineering",
+		},
+		secret.Labels,
+	)
+
+	// Check the name and other top-level fields.
+	expectedData := map[string]string{
+		"name":             "root-kube-cluster-1",
+		"project":          "my-argo-project",
+		"namespaces":       "prod,dev",
+		"clusterResources": "true",
+	}
+	for k, v := range expectedData {
+		require.Equal(t, v, string(secret.Data[k]))
+	}
+
+	// Check the server addr.
+	server := string(secret.Data["server"])
+	serverURL, err := url.Parse(server)
+	require.NoError(t, err)
+
+	_, port, _ := strings.Cut(proxyAddr.Addr, ":")
+	require.Equal(t, port, serverURL.Port())
+	require.Equal(t, "/v1/teleport/cm9vdA/a3ViZS1jbHVzdGVyLTE", serverURL.Path)
+
+	// Check the config.
+	var config map[string]any
+	require.NoError(t, json.Unmarshal(secret.Data["config"], &config))
+
+	tlsConfig := config["tlsClientConfig"].(map[string]any)
+	require.Equal(t,
+		"kube-teleport-proxy-alpn.teleport.cluster.local",
+		tlsConfig["serverName"],
+	)
+
+	// Check the CA Certificates, Client Certificate, and Private Key were set.
+	require.NotEmpty(t, tlsConfig["caData"])
+	require.NotEmpty(t, tlsConfig["certData"])
+	require.NotEmpty(t, tlsConfig["keyData"])
+
+	expectedAnnotations := map[string]string{
+		"teleport.dev/bot-name":                "argo-bot",
+		"teleport.dev/kubernetes-cluster-name": "kube-cluster-1",
+		"teleport.dev/tbot-version":            teleport.Version,
+		"teleport.dev/teleport-cluster-name":   "root",
+		"managed-by":                           "ninjas",
+	}
+	for k, v := range expectedAnnotations {
+		require.Equal(t, v, secret.Annotations[k])
+	}
+
+	// Add another cluster and run the bot again.
+	registerCluster(t, "kube-cluster-2")
+
+	b, err = bot.New(botConfig)
+	require.NoError(t, err)
+	require.NoError(t, b.OneShot(ctx))
+
+	// Expect another secret to have been written.
+	list, err = k8s.CoreV1().
+		Secrets("argocd").
+		List(ctx, metav1.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, list.Items, 2)
+}
diff --git a/lib/tbot/services/k8s/helpers_test.go b/lib/tbot/services/k8s/helpers_test.go
new file mode 100644
index 0000000000000..9decf3f149487
--- /dev/null
+++ b/lib/tbot/services/k8s/helpers_test.go
@@ -0,0 +1,188 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"log/slog"
+	"net"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+func newMockDiscoveredKubeCluster(t *testing.T, name, discoveredName string) *types.KubernetesClusterV3 {
+	t.Helper()
+	kubeCluster, err := types.NewKubernetesClusterV3(
+		types.Metadata{
+			Name: name,
+			Labels: map[string]string{
+				types.OriginLabel:         types.OriginCloud,
+				types.DiscoveredNameLabel: discoveredName,
+			},
+		},
+		types.KubernetesClusterSpecV3{},
+	)
+	require.NoError(t, err)
+	return kubeCluster
+}
+
+// makeBot creates a server-side bot and returns joining parameters.
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
+	ctx := t.Context()
+	t.Helper()
+
+	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: roles,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	require.NoError(t, err)
+	tok, err := types.NewProvisionTokenFromSpec(
+		tokenName,
+		time.Now().Add(10*time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles:   []types.SystemRole{types.RoleBot},
+			BotName: b.Metadata.Name,
+		})
+	require.NoError(t, err)
+	err = client.CreateToken(ctx, tok)
+	require.NoError(t, err)
+
+	return &onboarding.Config{
+		TokenValue: tok.GetName(),
+		JoinMethod: types.JoinMethodToken,
+	}, b
+}
+
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		testenv.WithClusterName("root")(o)
+		testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{AddrNetwork: "tcp", Addr: net.JoinHostPort("localhost", strconv.Itoa(cfg.Proxy.WebAddr.Port(0)))},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+		})(o)
+
+		return nil
+	}
+}
diff --git a/lib/tbot/services/k8s/k8s.go b/lib/tbot/services/k8s/k8s.go
new file mode 100644
index 0000000000000..f5d894e69f49f
--- /dev/null
+++ b/lib/tbot/services/k8s/k8s.go
@@ -0,0 +1,67 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"go.opentelemetry.io/otel"
+	"k8s.io/client-go/kubernetes"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+var (
+	tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/k8s")
+	log    = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentTBot)
+)
+
+// WithDefaultCredentialLifetime sets the service's default credential lifetime.
+func WithDefaultCredentialLifetime(lifetime bot.CredentialLifetime) DefaultCredentialLifetimeOption {
+	return DefaultCredentialLifetimeOption{lifetime}
+}
+
+// DefaultCredentialLifetimeOption is returned from WithDefaultCredentialLifetime.
+type DefaultCredentialLifetimeOption struct{ lifetime bot.CredentialLifetime }
+
+// WithKubernetesClient sets the service's Kubernetes client. It's used in tests.
+func WithKubernetesClient(k8s kubernetes.Interface) KubernetesClientOption {
+	return KubernetesClientOption{k8s}
+}
+
+// KubernetesClientOption is returned from WithKubernetesClient.
+type KubernetesClientOption struct{ client kubernetes.Interface }
+
+// WithInsecure controls whether the service will verify proxy certificates.
+func WithInsecure(insecure bool) InsecureOption {
+	return InsecureOption{insecure}
+}
+
+// InsecureOption is returned from WithInsecure.
+type InsecureOption struct{ insecure bool }
+
+// WithALPNUpgradeCache sets the service's ALPN upgrade cache so that it can be
+// shared with other services.
+func WithALPNUpgradeCache(cache *internal.ALPNUpgradeCache) ALPNUpgradeCacheOption {
+	return ALPNUpgradeCacheOption{cache}
+}
+
+// ALPNUpgradeCacheOption is returned from WithALPNUpgradeCache.
+type ALPNUpgradeCacheOption struct{ cache *internal.ALPNUpgradeCache }
diff --git a/lib/tbot/services/k8s/output_v1.go b/lib/tbot/services/k8s/output_v1.go
new file mode 100644
index 0000000000000..086680dc1f337
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v1.go
@@ -0,0 +1,492 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"path/filepath"
+
+	"github.com/gravitational/trace"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
+	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+const defaultKubeconfigPath = "kubeconfig.yaml"
+
+func OutputV1ServiceBuilder(cfg *OutputV1Config, opts ...OutputV1Option) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &OutputV1Service{
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: bot.DefaultCredentialLifetime,
+			cfg:                       cfg,
+			proxyPinger:               deps.ProxyPinger,
+			reloadCh:                  deps.ReloadCh,
+			executablePath:            autoupdate.StableExecutable,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		for _, opt := range opts {
+			opt.applyToV1Output(svc)
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(OutputV1ServiceType, cfg.Name, buildFn)
+}
+
+// OutputV1Option is an option that can be provided to customize the service.
+type OutputV1Option interface{ applyToV1Output(*OutputV1Service) }
+
+func (opt DefaultCredentialLifetimeOption) applyToV1Output(o *OutputV1Service) {
+	o.defaultCredentialLifetime = opt.lifetime
+}
+
+// OutputV1Service produces credentials which can be used to connect to
+// a Kubernetes Cluster through teleport.
+type OutputV1Service struct {
+	// botAuthClient should be an auth client using the bots internal identity.
+	// This will not have any roles impersonated and should only be used to
+	// fetch CAs.
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *OutputV1Config
+	log                       *slog.Logger
+	proxyPinger               connection.ProxyPinger
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+	// executablePath is called to get the path to the tbot executable.
+	// Usually this is os.Executable
+	executablePath func() (string, error)
+
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+func (s *OutputV1Service) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("kubernetes-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *OutputV1Service) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *OutputV1Service) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *OutputV1Service) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputV1Service/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	identityOpts := []identity.GenerateOption{
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	}
+	id, err := s.identityGenerator.GenerateFacade(ctx, identityOpts...)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	kc, err := getKubeCluster(ctx, impersonatedClient, s.cfg.KubernetesCluster)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// make sure the output matches the fully resolved kube cluster name,
+	// since it may have been just a "discovered name".
+	kubeClusterName := kc.GetName()
+	// Note: the Teleport server does attempt to verify k8s cluster names
+	// and will fail to generate certs if the cluster doesn't exist or is
+	// offline.
+
+	routedIdentity, err := s.identityGenerator.Generate(ctx, append(identityOpts,
+		identity.WithCurrentIdentityFacade(id),
+		identity.WithKubernetesCluster(kubeClusterName),
+	)...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Generated identity for Kubernetes cluster",
+		"kubernetes_cluster",
+		kubeClusterName,
+		"identity", routedIdentity,
+	)
+
+	// Ping the proxy to resolve connection addresses.
+	proxyPong, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	clusterAddr, tlsServerName, err := selectKubeConnectionMethod(proxyPong)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// TODO(noah): It's likely the Kubernetes output does not really need to
+	// output these CAs - but - for backwards compat reasons, we output them.
+	// Revisit this at a later date and make a call.
+	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	keyRing, err := internal.NewClientKeyRing(routedIdentity, hostCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	status := &kubernetesStatus{
+		clusterAddr:           clusterAddr,
+		tlsServerName:         tlsServerName,
+		credentials:           keyRing,
+		teleportClusterName:   proxyPong.ClusterName,
+		kubernetesClusterName: kubeClusterName,
+	}
+
+	return s.render(ctx, status, routedIdentity, hostCAs, userCAs, databaseCAs)
+}
+
+func (s *OutputV1Service) render(
+	ctx context.Context,
+	status *kubernetesStatus,
+	routedIdentity *identity.Identity,
+	hostCAs, userCAs, databaseCAs []types.CertAuthority,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputV1Service/render",
+	)
+	defer span.End()
+
+	if err := internal.WriteIdentityFile(ctx, s.log, status.credentials, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "writing identity file")
+	}
+	if err := identity.SaveIdentity(
+		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
+	); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+	// In exec plugin mode, we write the credentials to disk and write a
+	// kubeconfig that execs `tbot` to load those credentials.
+
+	// We only support directory mode for this since the exec plugin needs
+	// to know the path to read the credentials from, and this is
+	// unpredictable with other types of destination.
+	destinationDir, isDirectoryDest := s.cfg.Destination.(*destination.Directory)
+	if !s.cfg.DisableExecPlugin {
+		if !isDirectoryDest {
+			slog.InfoContext(
+				ctx,
+				"Kubernetes template will be rendered without exec plugin because destination is not a directory. Explicitly set `disable_exec_plugin: true` in the output to suppress this message",
+				"destination", logutils.StringerAttr(s.cfg.Destination))
+			s.cfg.DisableExecPlugin = true
+		}
+	}
+
+	var err error
+	var kubeCfg *clientcmdapi.Config
+	if s.cfg.DisableExecPlugin {
+		// If they've disabled the exec plugin, we just write the credentials
+		// directly into the kubeconfig.
+		kubeCfg, err = generateKubeConfigWithoutPlugin(status)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	} else {
+		executablePath, err := s.executablePath()
+		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
+			s.log.WarnContext(ctx, "Kubernetes template will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
+		} else if err != nil {
+			return trace.Wrap(err)
+		}
+
+		kubeCfg, err = generateKubeConfigWithPlugin(status, destinationDir.Path, executablePath)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	yamlCfg, err := clientcmd.Write(*kubeCfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := s.cfg.Destination.Write(ctx, defaultKubeconfigPath, yamlCfg); err != nil {
+		return trace.Wrap(err, "writing kubeconfig")
+	}
+
+	return trace.Wrap(internal.WriteTLSCAs(ctx, s.cfg.Destination, hostCAs, userCAs, databaseCAs))
+}
+
+// kubernetesStatus holds teleport client information necessary to populate a
+// kubeconfig.
+type kubernetesStatus struct {
+	clusterAddr           string
+	teleportClusterName   string
+	kubernetesClusterName string
+	tlsServerName         string
+	credentials           *libclient.KeyRing
+}
+
+func generateKubeConfigWithoutPlugin(ks *kubernetesStatus) (*clientcmdapi.Config, error) {
+	config := clientcmdapi.NewConfig()
+
+	contextName := kubeconfig.ContextName(ks.teleportClusterName, ks.kubernetesClusterName)
+	// Configure the cluster.
+	clusterCAs, err := ks.credentials.RootClusterCAs()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cas := bytes.Join(clusterCAs, []byte("\n"))
+	if len(cas) == 0 {
+		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
+	}
+	config.Clusters[contextName] = &clientcmdapi.Cluster{
+		Server:                   ks.clusterAddr,
+		CertificateAuthorityData: cas,
+		TLSServerName:            ks.tlsServerName,
+	}
+
+	config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
+		ClientCertificateData: ks.credentials.TLSCert,
+		ClientKeyData:         ks.credentials.TLSPrivateKey.PrivateKeyPEM(),
+	}
+
+	// Last, create a context linking the cluster to the auth info.
+	config.Contexts[contextName] = &clientcmdapi.Context{
+		Cluster:  contextName,
+		AuthInfo: contextName,
+	}
+	config.CurrentContext = contextName
+
+	return config, nil
+}
+
+// generateKubeConfigWithPlugin creates a Kubernetes config object with the given cluster
+// config.
+func generateKubeConfigWithPlugin(ks *kubernetesStatus, destPath string, executablePath string) (*clientcmdapi.Config, error) {
+	config := clientcmdapi.NewConfig()
+
+	// Implementation note: tsh/kube.go generates a kubeconfig with all
+	// available clusters. This isn't especially useful in Machine ID when
+	// there's _at most_ one cluster we have permission to access for this
+	// Destination's set of certs, so instead of fetching all the k8s clusters
+	// and adding everything, we'll just stick with the single cluster name in
+	// our config file.
+	// Otherwise, we adapt this from lib/kube/kubeconfig/kubeconfig.go's
+	// Update(), but don't support env vars, insecure mode, or identity files.
+	// We do still implement `tbot kube credentials` to help client apps
+	// take better advantage of certificate renewals.
+
+	contextName := kubeconfig.ContextName(ks.teleportClusterName, ks.kubernetesClusterName)
+
+	// Configure the cluster.
+	clusterCAs, err := ks.credentials.RootClusterCAs()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cas := bytes.Join(clusterCAs, []byte("\n"))
+	if len(cas) == 0 {
+		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
+	}
+	config.Clusters[contextName] = &clientcmdapi.Cluster{
+		Server:                   ks.clusterAddr,
+		CertificateAuthorityData: cas,
+		TLSServerName:            ks.tlsServerName,
+	}
+
+	absDestPath, err := filepath.Abs(destPath)
+	if err != nil {
+		return nil, trace.Wrap(err, "determining absolute path for destination")
+	}
+
+	// Configure the auth info.
+	execArgs := []string{"kube", "credentials",
+		fmt.Sprintf("--destination-dir=%s", absDestPath),
+	}
+	config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
+		Exec: &clientcmdapi.ExecConfig{
+			APIVersion: "client.authentication.k8s.io/v1beta1",
+			Command:    executablePath,
+			Args:       execArgs,
+		},
+	}
+
+	// Last, create a context linking the cluster to the auth info.
+	config.Contexts[contextName] = &clientcmdapi.Context{
+		Cluster:  contextName,
+		AuthInfo: contextName,
+	}
+	config.CurrentContext = contextName
+
+	return config, nil
+}
+
+// chooseOneKubeCluster chooses one matched kube cluster by name, or tries to
+// choose one kube cluster by unambiguous "discovered name".
+func chooseOneKubeCluster(clusters []types.KubeCluster, name string) (types.KubeCluster, error) {
+	return internal.ChooseOneResource(clusters, name, "kubernetes cluster")
+}
+
+func getKubeCluster(ctx context.Context, clt apiclient.GetResourcesClient, name string) (types.KubeCluster, error) {
+	ctx, span := tracer.Start(ctx, "getKubeCluster")
+	defer span.End()
+
+	servers, err := apiclient.GetAllResources[types.KubeServer](ctx, clt, &proto.ListResourcesRequest{
+		Namespace:           defaults.Namespace,
+		ResourceType:        types.KindKubeServer,
+		PredicateExpression: internal.MakeNameOrDiscoveredNamePredicate(name),
+		Limit:               int32(defaults.DefaultChunkSize),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var clusters []types.KubeCluster
+	for _, server := range servers {
+		clusters = append(clusters, server.GetCluster())
+	}
+
+	clusters = types.DeduplicateKubeClusters(clusters)
+	cluster, err := chooseOneKubeCluster(clusters, name)
+	return cluster, trace.Wrap(err)
+}
+
+// selectKubeConnectionMethod determines the address and SNI that should be
+// put into the kubeconfig file.
+func selectKubeConnectionMethod(proxyPong *connection.ProxyPong) (
+	clusterAddr string, sni string, err error,
+) {
+	// First we check for TLS routing. If this is enabled, we use the Proxy's
+	// PublicAddr, and we must also specify a special SNI.
+	//
+	// Even if KubePublicAddr is specified, we still use the general
+	// PublicAddr when using TLS routing.
+	if proxyPong.Proxy.TLSRoutingEnabled {
+		addr, err := proxyPong.ProxyWebAddr()
+		if err != nil {
+			return "", "", trace.Wrap(err)
+		}
+		host, _, err := net.SplitHostPort(addr)
+		if err != nil {
+			return "", "", trace.Wrap(err, "parsing proxy public_addr")
+		}
+
+		return fmt.Sprintf("https://%s", addr), libclient.GetKubeTLSServerName(host), nil
+	}
+
+	// Next, we try to use the KubePublicAddr.
+	if proxyPong.Proxy.Kube.PublicAddr != "" {
+		return fmt.Sprintf("https://%s", proxyPong.Proxy.Kube.PublicAddr), "", nil
+	}
+
+	// Finally, we fall back to the main proxy PublicAddr with the port from
+	// KubeListenAddr.
+	if proxyPong.Proxy.Kube.ListenAddr != "" {
+		host, _, err := net.SplitHostPort(proxyPong.Proxy.SSH.PublicAddr)
+		if err != nil {
+			return "", "", trace.Wrap(err, "parsing proxy public_addr")
+		}
+
+		_, port, err := net.SplitHostPort(proxyPong.Proxy.Kube.ListenAddr)
+		if err != nil {
+			return "", "", trace.Wrap(err, "parsing proxy kube_listen_addr")
+		}
+
+		return fmt.Sprintf("https://%s:%s", host, port), "", nil
+	}
+
+	return "", "", trace.BadParameter("unable to determine kubernetes address")
+}
diff --git a/lib/tbot/services/k8s/output_v1_config.go b/lib/tbot/services/k8s/output_v1_config.go
new file mode 100644
index 0000000000000..993ba8029e608
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v1_config.go
@@ -0,0 +1,143 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const OutputV1ServiceType = "kubernetes"
+
+// OutputV1Config produces credentials which can be used to connect to a
+// Kubernetes Cluster through teleport.
+type OutputV1Config struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// KubernetesCluster is the name of the Kubernetes cluster in Teleport.
+	// This is named a little more verbosely to avoid conflicting with the
+	// name of the Teleport cluster to use.
+	KubernetesCluster string `yaml:"kubernetes_cluster"`
+
+	// DisableExecPlugin disables the default behavior of using `tbot` as a
+	// `kubectl` credentials exec plugin. This is useful in environments where
+	// `tbot` may not exist on the system that will consume the outputted
+	// kubeconfig. It does mean that kubectl will not be able to automatically
+	// refresh the credentials within an individual invocation.
+	DisableExecPlugin bool `yaml:"disable_exec_plugin"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *OutputV1Config) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *OutputV1Config) SetName(name string) {
+	o.Name = name
+}
+
+func (o *OutputV1Config) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	if o.KubernetesCluster == "" {
+		return trace.BadParameter("kubernetes_cluster must not be empty")
+	}
+	return nil
+}
+
+func (o *OutputV1Config) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *OutputV1Config) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+func (o *OutputV1Config) Describe() []bot.FileDescription {
+	return []bot.FileDescription{
+		{
+			Name: "kubeconfig.yaml",
+		},
+		{
+			Name: internal.IdentityFilePath,
+		},
+		{
+			Name: internal.HostCAPath,
+		},
+		{
+			Name: internal.UserCAPath,
+		},
+		{
+			Name: internal.DatabaseCAPath,
+		},
+	}
+}
+
+func (o *OutputV1Config) MarshalYAML() (any, error) {
+	type raw OutputV1Config
+	return encoding.WithTypeHeader((*raw)(o), OutputV1ServiceType)
+}
+
+func (o *OutputV1Config) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *OutputV1Config) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw OutputV1Config
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *OutputV1Config) Type() string {
+	return OutputV1ServiceType
+}
+
+func (o *OutputV1Config) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/k8s/output_v1_config_test.go b/lib/tbot/services/k8s/output_v1_config_test.go
new file mode 100644
index 0000000000000..7eb47ec29b21f
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v1_config_test.go
@@ -0,0 +1,88 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestKubernetesOutput_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[OutputV1Config]{
+		{
+			name: "full",
+			in: OutputV1Config{
+				Destination:       dest,
+				Roles:             []string{"access"},
+				KubernetesCluster: "k8s.example.com",
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: OutputV1Config{
+				Destination:       dest,
+				KubernetesCluster: "k8s.example.com",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestKubernetesOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*OutputV1Config]{
+		{
+			name: "valid",
+			in: func() *OutputV1Config {
+				return &OutputV1Config{
+					Destination:       destination.NewMemory(),
+					Roles:             []string{"access"},
+					KubernetesCluster: "my-cluster",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *OutputV1Config {
+				return &OutputV1Config{
+					Destination:       nil,
+					KubernetesCluster: "my-cluster",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing kubernetes_config",
+			in: func() *OutputV1Config {
+				return &OutputV1Config{
+					Destination: destination.NewMemory(),
+				}
+			},
+			wantErr: "kubernetes_cluster must not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/k8s/output_v1_test.go b/lib/tbot/services/k8s/output_v1_test.go
new file mode 100644
index 0000000000000..2a67002ef7664
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v1_test.go
@@ -0,0 +1,372 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/webclient"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+// Fairly ugly hardcoded certs to use in the generation so that the tests are
+// deterministic.
+var (
+	tlsCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDfDCCAmSgAwIBAgIQP/jI85sqjDWDTd9qF0V5qjANBgkqhkiG9w0BAQsFADBA
+MRUwEwYDVQQKEwxUZWxlcG9ydCBPU1MxJzAlBgNVBAMTHnRlbGVwb3J0LmxvY2Fs
+aG9zdC5sb2NhbGRvbWFpbjAeFw0yNDA0MDIxNDA5MjZaFw0yNDA0MDIxNTEwMjZa
+MHMxGzAZBgNVBAkTEnRlbGUuYmxhY2ttZXNhLmdvdjENMAsGA1UEERMEbnVsbDER
+MA8GA1UEAxMIYm90LXRlc3QxDjAMBgUrzg8BARMDZm9vMQ4wDAYFK84PAQITA2Jh
+cjESMBAGBSvODwEDEwdleGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAr8WfEDOq1TN0bT0SGEtEuDrRaf+VudmbypHokewy46md9XB3gQWbin9N
+/5tyNdbFsWsDgDIyXP3Ube0ubcPYlcsCNtgCvK4qd3RyRvxY5lOfS1pZESPEtvO/
+sxEu6E3O0ofcwq4uKenHuf1EUQuVD6WxABUOaOs2/3aahmYy4SnKNUsM2/l1XrcI
+0ekvB0h10nXUC4VJS4sKGzGzThD308ia/bgDSXc0fiUwZPB5TLn7lScuisi+8JSs
+qWccknXonGEEtism7FNi+mseV1ahzjEbRM/kfFwZ0H+ekz3CdnsmkND0FmxB9WTf
+5PwG8oXM42QJkwuEIu+8Q/VVSSFe4wIDAQABoz8wPTAOBgNVHQ8BAf8EBAMCBaAw
+HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwDQYJ
+KoZIhvcNAQELBQADggEBAEZYzIS0tx+Yn+cEfS83hpL1jELq9C8V3PTC6y44kjAK
+i85Mx+ridYq0ddMdV/91JZ5t1Rqde4LSYUVUP6q/Ukih0mx/I3z2Siwp/YjpOu6x
+SZXakjGnt5pCCa/t1NcVNSrqQpLQ8bJ0mruRiNawrKo3/ge57rgidnBFcOv3zV5t
+BIkYjQJK2YVYcJjJ68olXzpCEw5hTZ9fw42fs2TORHHrPNUAzPf3Qdrzi03hrvhd
+p6nYNA18b6ggygkcRU2MRte5E+/2ABYiwRklwJWNIMQJJHyZAW8Dyws0E2e+B3w+
+7/SYPyeKOlt7foD7z0XM2Kw9ndurJq97AWfkcnrZwbQ=
+-----END CERTIFICATE-----`)
+
+	keyPEM = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAr8WfEDOq1TN0bT0SGEtEuDrRaf+VudmbypHokewy46md9XB3
+gQWbin9N/5tyNdbFsWsDgDIyXP3Ube0ubcPYlcsCNtgCvK4qd3RyRvxY5lOfS1pZ
+ESPEtvO/sxEu6E3O0ofcwq4uKenHuf1EUQuVD6WxABUOaOs2/3aahmYy4SnKNUsM
+2/l1XrcI0ekvB0h10nXUC4VJS4sKGzGzThD308ia/bgDSXc0fiUwZPB5TLn7lScu
+isi+8JSsqWccknXonGEEtism7FNi+mseV1ahzjEbRM/kfFwZ0H+ekz3CdnsmkND0
+FmxB9WTf5PwG8oXM42QJkwuEIu+8Q/VVSSFe4wIDAQABAoIBACvb8vnW+pyibz3G
+zFoVhfs2agS6CsFKJE6io9atinE2ZLzWqGsgXBRt+ad7QT9f7Qp9Om1lmR2NFNGt
+KjWndcbC1jWbJuuvxdbyzoUZ+JDYctoZnDnjo/VG0yG6eurqZ14vGo3Vap14wSaO
+pNpYOoSiAo2Ts3nIn3uVO6+nlrCKFBWiIMMvJ4L89vSCXyI/5kpwCURxpYeYJrQb
+Jzi4TsN0ViYqf6XNfhRCSD+Fk9km2e6zsPIuWyfPrtGx1cA2UeAjnjKK9IS9qkAy
+632T63X6M5kWtirIHM/r/IbdSj+lxGCMqnsSgNYILQv5sNkjgjwlkKl182w5l3CZ
+TkjyLPkCgYEA0guhs3KBqM4ASDzQI3+h5GTGA87ITb0B/TcitElPQ+u3PLypwz9u
+KzS9BHMpaWPWIOJzYRAjb8BDldyCcAhmyr5lv7O/ezRmgGD9NPV66IE5AX9nKVNS
+PhJTNiYPSH7g4zO3K4sd5397YunRZzAxgsVWzu7E2gUrJSCsf0nL77UCgYEA1jpg
+mJbSGYVrYEyQmt6YjHnwcLiNTJDPbcn27g0LmcRbq9SfIva/IfZaf0ru8b9c8QNM
+WMag57WGQghS2B7698GvlwF+nKXXZDjCZ4z6+Efi/T5uHL5VDcpHE4yqdZG42hTW
+m+K4wl4Z6B50xGC/mJlxzB6je4qBM9Zsn8wSwzcCgYEAk5O0kv4a9111eUuw+aAN
+QQlEzxwUQ/pOUXjRm1X+qTwOTFBJ/nKslxLA00WOjQumQQiaBFJwc23kjoCV7N0a
+S8ymdKB4IrpYYk7C2Ni4+G8CfHjlJHX0TMRXTq5DAq6Sl0+YnLFr22EIciDSDewg
+fT7llRLRoFUNUVK5n91buhkCgYEAwqUEA2B1wQ6Cg1rNwIkjne9lUWW9rKWecqig
+naZoteu9RyDG/qOnAhquGx5ggHJY5fsTMU44AI/kTrb1Xry3Vsk62z9WZMoiLEOO
+Dzv/A/t8+I/yyFb/PKpfbhnO/0fJ5wwr+jNDoAaUD10sxwkIzIQO62GjNKqhvhHD
+XGW1Xn0CgYEAzULAI9ij/q5S+GMyYj1xLCU4qxBpU/04nE+PfSSmfv8Ma34uh4QM
+nRDcZHBqZYNRDt5zNvRTjgwJi4iHGwSB+D4SIYGb0ioTI2MOS2F7zBDyl8FXp7dT
+3TSKronwoWYoLSisqnn/s8iN1M9RJA9pyIy7FTVwq59XL3NoetISuKc=
+-----END RSA PRIVATE KEY-----`)
+)
+
+const (
+	mockClusterName = "tele.blackmesa.gov"
+)
+
+// fakeGetExecutablePath can be injected into outputs to ensure they output the
+// same path in tests across multiple systems.
+func fakeGetExecutablePath() (string, error) {
+	return "/path/to/tbot", nil
+}
+
+// TestKubernetesOutputService_render renders the Kubernetes template and
+// compares it to the saved golden result.
+// TODO(noah): Evaluate if test should run at higher level to capture some
+// fetching.
+func TestKubernetesOutputService_render(t *testing.T) {
+	k8sCluster := "example"
+
+	// We need a fixed cert/key pair here for the golden files testing
+	// to behave properly.
+	id := &identity.Identity{
+		PrivateKeyBytes: keyPEM,
+		TLSCertBytes:    tlsCert,
+		ClusterName:     mockClusterName,
+	}
+
+	tests := []struct {
+		name              string
+		useRelativePath   bool
+		disableExecPlugin bool
+	}{
+		{
+			name: "absolute path",
+		},
+		{
+			name:            "relative path",
+			useRelativePath: true,
+		},
+		{
+			name:              "exec plugin disabled",
+			disableExecPlugin: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+
+			dest := &destination.Directory{
+				Path:     dir,
+				Symlinks: botfs.SymlinksInsecure,
+				ACLs:     botfs.ACLOff,
+			}
+			if tt.useRelativePath {
+				wd, err := os.Getwd()
+				require.NoError(t, err)
+				relativePath, err := filepath.Rel(wd, dir)
+				require.NoError(t, err)
+				dest.Path = relativePath
+			}
+
+			svc := OutputV1Service{
+				cfg: &OutputV1Config{
+					KubernetesCluster: k8sCluster,
+					DisableExecPlugin: tt.disableExecPlugin,
+					Destination:       dest,
+				},
+				executablePath: fakeGetExecutablePath,
+				log:            logtest.NewLogger(),
+			}
+
+			keyRing, err := internal.NewClientKeyRing(
+				id,
+				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
+			)
+			require.NoError(t, err)
+			status := &kubernetesStatus{
+				kubernetesClusterName: k8sCluster,
+				teleportClusterName:   mockClusterName,
+				tlsServerName:         client.GetKubeTLSServerName(mockClusterName),
+				credentials:           keyRing,
+				clusterAddr:           fmt.Sprintf("https://%s:443", mockClusterName),
+			}
+
+			err = svc.render(
+				context.Background(),
+				status,
+				id,
+				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
+				[]types.CertAuthority{},
+				[]types.CertAuthority{},
+			)
+			require.NoError(t, err)
+
+			kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, defaultKubeconfigPath))
+			require.NoError(t, err)
+			kubeconfigBytes = bytes.ReplaceAll(kubeconfigBytes, []byte(dir), []byte("/test/dir"))
+
+			if golden.ShouldSet() {
+				golden.SetNamed(t, "kubeconfig.yaml", kubeconfigBytes)
+			}
+			require.Equal(
+				t, string(golden.GetNamed(t, "kubeconfig.yaml")), string(kubeconfigBytes),
+			)
+		})
+	}
+}
+
+func Test_selectKubeConnectionMethod(t *testing.T) {
+	tests := []struct {
+		name string
+
+		proxyPing *webclient.PingResponse
+		wantAddr  string
+		wantSNI   string
+	}{
+		{
+			// Copied from my real Teleport Cloud webapi/ping
+			name: "TLS Routing",
+			proxyPing: &webclient.PingResponse{
+				Proxy: webclient.ProxySettings{
+					Kube: webclient.KubeProxySettings{
+						Enabled:    true,
+						ListenAddr: "0.0.0.0:3080",
+					},
+					SSH: webclient.SSHProxySettings{
+						ListenAddr:       "0.0.0.0:3080",
+						TunnelListenAddr: "0.0.0.0:3080",
+						WebListenAddr:    "0.0.0.0:3080",
+						PublicAddr:       "noah.teleport.sh:443",
+					},
+					TLSRoutingEnabled: true,
+				},
+				ClusterName: "noah.teleport.sh",
+			},
+			wantAddr: "https://noah.teleport.sh:443",
+			wantSNI:  "kube-teleport-proxy-alpn.noah.teleport.sh",
+		},
+		{
+			name: "KubePublicAddr specified",
+			proxyPing: &webclient.PingResponse{
+				Proxy: webclient.ProxySettings{
+					Kube: webclient.KubeProxySettings{
+						Enabled:    true,
+						ListenAddr: "0.0.0.0:1337",
+						PublicAddr: "kube.example.com:1337",
+					},
+					SSH: webclient.SSHProxySettings{
+						ListenAddr:       "0.0.0.0:3023",
+						TunnelListenAddr: "0.0.0.0:3024",
+						WebListenAddr:    "0.0.0.0:3080",
+						PublicAddr:       "cluster.example.com:443",
+						SSHPublicAddr:    "cluster.example.com:3023",
+						TunnelPublicAddr: "cluster.example.com:3024",
+					},
+					TLSRoutingEnabled: false,
+				},
+				ClusterName: "cluster.example.com",
+			},
+			wantAddr: "https://kube.example.com:1337",
+		},
+		{
+			// https://github.com/gravitational/teleport/issues/19811
+			name: "Falls back to Kube ListenAddr Port with PublicAddr",
+			proxyPing: &webclient.PingResponse{
+				Proxy: webclient.ProxySettings{
+					Kube: webclient.KubeProxySettings{
+						Enabled:    true,
+						ListenAddr: "0.0.0.0:3026",
+					},
+					SSH: webclient.SSHProxySettings{
+						ListenAddr:       "[::]:3023",
+						TunnelListenAddr: "0.0.0.0:3024",
+						WebListenAddr:    "0.0.0.0:3080",
+						PublicAddr:       "cluster.example.com:5443",
+						SSHPublicAddr:    "cluster.example.com:3023",
+						TunnelPublicAddr: "cluster.example.com:3024",
+					},
+					TLSRoutingEnabled: false,
+				},
+				ClusterName: "cluster.example.com",
+			},
+			wantAddr: "https://cluster.example.com:3026",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			addr, sni, err := selectKubeConnectionMethod(&connection.ProxyPong{
+				PingResponse: tt.proxyPing,
+			})
+			require.NoError(t, err)
+			require.Equal(t, tt.wantAddr, addr)
+			require.Equal(t, tt.wantSNI, sni)
+		})
+	}
+}
+
+func fakeCA(t *testing.T, caType types.CertAuthType, clusterName string) types.CertAuthority {
+	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+		// Pretend to be the correct type.
+		Type:        caType,
+		ClusterName: clusterName,
+		ActiveKeys: types.CAKeySet{
+			TLS: []*types.TLSKeyPair{
+				{
+					Cert: []byte(fixtures.TLSCACertPEM),
+					Key:  []byte(fixtures.TLSCAKeyPEM),
+				},
+			},
+			SSH: []*types.SSHKeyPair{
+				// Two of these to ensure that both are written to known hosts
+				{
+					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
+					PublicKey:  []byte(fixtures.SSHCAPublicKey),
+				},
+				{
+					PrivateKey: []byte(fixtures.SSHCAPrivateKey),
+					PublicKey:  []byte(fixtures.SSHCAPublicKey),
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	return ca
+}
+
+func TestChooseOneKubeCluster(t *testing.T) {
+	t.Parallel()
+
+	fooKube1 := newMockDiscoveredKubeCluster(t, "foo-eks-us-west-1-123456789012", "foo")
+	fooKube2 := newMockDiscoveredKubeCluster(t, "foo-eks-us-west-2-123456789012", "foo")
+	barKube := newMockDiscoveredKubeCluster(t, "bar-eks-us-west-1-123456789012", "bar")
+	tests := []struct {
+		desc            string
+		clusters        []types.KubeCluster
+		kubeSvc         string
+		wantKubeCluster types.KubeCluster
+		wantErr         string
+	}{
+		{
+			desc:            "by exact name match",
+			clusters:        []types.KubeCluster{fooKube1, fooKube2, barKube},
+			kubeSvc:         "bar-eks-us-west-1-123456789012",
+			wantKubeCluster: barKube,
+		},
+		{
+			desc:            "by unambiguous discovered name match",
+			clusters:        []types.KubeCluster{fooKube1, fooKube2, barKube},
+			kubeSvc:         "bar",
+			wantKubeCluster: barKube,
+		},
+		{
+			desc:     "ambiguous discovered name matches is an error",
+			clusters: []types.KubeCluster{fooKube1, fooKube2, barKube},
+			kubeSvc:  "foo",
+			wantErr:  `"foo" matches multiple auto-discovered kubernetes clusters`,
+		},
+		{
+			desc:     "no match is an error",
+			clusters: []types.KubeCluster{fooKube1, fooKube2, barKube},
+			kubeSvc:  "xxx",
+			wantErr:  `kubernetes cluster "xxx" not found`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			gotKube, err := chooseOneKubeCluster(test.clusters, test.kubeSvc)
+			if test.wantErr != "" {
+				require.ErrorContains(t, err, test.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.wantKubeCluster, gotKube)
+		})
+	}
+}
diff --git a/lib/tbot/services/k8s/output_v2.go b/lib/tbot/services/k8s/output_v2.go
new file mode 100644
index 0000000000000..02e5237af6e2b
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v2.go
@@ -0,0 +1,565 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/url"
+	"path/filepath"
+
+	"github.com/gravitational/trace"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
+	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	kuberelay "github.com/gravitational/teleport/lib/kube/relay"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+func OutputV2ServiceBuilder(cfg *OutputV2Config, opts ...OutputV2Option) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &OutputV2Service{
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: bot.DefaultCredentialLifetime,
+			cfg:                       cfg,
+			proxyPinger:               deps.ProxyPinger,
+			reloadCh:                  deps.ReloadCh,
+			executablePath:            autoupdate.StableExecutable,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		for _, opt := range opts {
+			opt.applyToV2Output(svc)
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(OutputV2ServiceType, cfg.Name, buildFn)
+}
+
+// OutputV1Option is an option that can be provided to customize the service.
+type OutputV2Option interface{ applyToV2Output(*OutputV2Service) }
+
+func (opt DefaultCredentialLifetimeOption) applyToV2Output(o *OutputV2Service) {
+	o.defaultCredentialLifetime = opt.lifetime
+}
+
+// OutputV2Service produces credentials which can be used to connect to a
+// Kubernetes Cluster through teleport.
+type OutputV2Service struct {
+	// botAuthClient should be an auth client using the bots internal identity.
+	// This will not have any roles impersonated and should only be used to
+	// fetch CAs.
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *OutputV2Config
+	log                       *slog.Logger
+	proxyPinger               connection.ProxyPinger
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+	// executablePath is called to get the path to the tbot executable.
+	// Usually this is os.Executable
+	executablePath    func() (string, error)
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+func (s *OutputV2Service) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("kubernetes-v2-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *OutputV2Service) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *OutputV2Service) Run(ctx context.Context) error {
+	return trace.Wrap(internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	}))
+}
+
+func (s *OutputV2Service) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputV2Service/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	matches, err := fetchAllMatchingKubeClusters(ctx, impersonatedClient, s.cfg.Selectors)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var clusterNames []string
+	for _, m := range matches {
+		clusterNames = append(clusterNames, m.cluster.GetName())
+	}
+	defaultNamespaces := map[string]string{}
+	for _, m := range matches {
+		if m.selector.DefaultNamespace != "" {
+			if _, ok := defaultNamespaces[m.cluster.GetName()]; ok {
+				s.log.WarnContext(
+					ctx,
+					"Multiple selectors match the same cluster with different default namespaces configured, last definition will take priority",
+					"cluster", m.cluster.GetName(),
+				)
+			}
+			defaultNamespaces[m.cluster.GetName()] = m.selector.DefaultNamespace
+		}
+	}
+
+	clusterNames = utils.Deduplicate(clusterNames)
+
+	s.log.InfoContext(
+		ctx,
+		"Generated identity for Kubernetes access",
+		"matched_cluster_count", len(clusterNames),
+		"identity", id.Get(),
+	)
+
+	// Ping the proxy to resolve connection addresses.
+	proxyPong, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	clusterAddr, tlsServerName, err := selectKubeConnectionMethod(proxyPong)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	hostCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	keyRing, err := internal.NewClientKeyRing(id.Get(), hostCAs)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	status := &kubernetesStatusV2{
+		credentials:            keyRing,
+		teleportClusterName:    proxyPong.ClusterName,
+		kubernetesClusterNames: clusterNames,
+		defaultNamespaces:      defaultNamespaces,
+	}
+
+	if s.cfg.RelayAddress == "" {
+		status.clusterAddr = clusterAddr
+		status.tlsServerNameFunc = func(teleportClusterName, kubeClusterName string) string {
+			return tlsServerName
+		}
+	} else {
+		status.clusterAddr = (&url.URL{
+			Scheme: "https",
+			Host:   s.cfg.RelayAddress,
+		}).String()
+		status.tlsServerNameFunc = kuberelay.FullSNIForKubeCluster
+	}
+
+	return trace.Wrap(s.render(ctx, status, id.Get(), hostCAs))
+}
+
+// kubernetesStatus holds teleport client information necessary to populate a
+// kubeconfig.
+type kubernetesStatusV2 struct {
+	clusterAddr            string
+	teleportClusterName    string
+	tlsServerNameFunc      func(teleportClusterName, kubeClusterName string) string
+	credentials            *libclient.KeyRing
+	kubernetesClusterNames []string
+	// defaultNamespace is map of the cluster name to the default namespace
+	// which should be used for that cluster.
+	defaultNamespaces map[string]string
+}
+
+func (s kubernetesStatusV2) tlsServerName(teleportClusterName, kubeClusterName string) string {
+	if s.tlsServerNameFunc == nil {
+		return ""
+	}
+
+	return s.tlsServerNameFunc(teleportClusterName, kubeClusterName)
+}
+
+// queryKubeClustersByLabels fetches a list of Kubernetes clusters matching the
+// given label selector.
+func queryKubeClustersByLabels(ctx context.Context, clt apiclient.GetResourcesClient, labels map[string]string) ([]types.KubeCluster, error) {
+	ctx, span := tracer.Start(ctx, "queryKubeClustersByLabels")
+	defer span.End()
+
+	servers, err := apiclient.GetAllResources[types.KubeServer](ctx, clt, &proto.ListResourcesRequest{
+		Namespace:    defaults.Namespace,
+		ResourceType: types.KindKubeServer,
+		Labels:       labels,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var clusters []types.KubeCluster
+	for _, server := range servers {
+		clusters = append(clusters, server.GetCluster())
+	}
+
+	return clusters, nil
+}
+
+type selectorMatch struct {
+	selector *KubernetesSelector
+	cluster  types.KubeCluster
+}
+
+// fetchAllMatchingKubeClusters returns a list of all clusters matching the
+// given selectors.
+func fetchAllMatchingKubeClusters(ctx context.Context, clt apiclient.GetResourcesClient, selectors []*KubernetesSelector) ([]selectorMatch, error) {
+	ctx, span := tracer.Start(ctx, "findAllMatchingKubeClusters")
+	defer span.End()
+
+	matches := []selectorMatch{}
+	for _, selector := range selectors {
+		if selector.Name != "" {
+			cluster, err := getKubeCluster(ctx, clt, selector.Name)
+			if err != nil {
+				// Clusters explicitly named should be a hard fail.
+				return nil, trace.Wrap(err, "unable to fetch cluster %q by name", selector.Name)
+			}
+
+			matches = append(matches, selectorMatch{
+				selector: selector,
+				cluster:  cluster,
+			})
+			continue
+		}
+
+		labeledClusters, err := queryKubeClustersByLabels(ctx, clt, selector.Labels)
+		if err != nil {
+			// TODO: should this be a hard error, or should we log it and
+			// attempt to fetch all clusters? (Or should users be able to
+			// select hard fail behavior with a config option?)
+			// (Hard fail may be more relevant to named clusters.)
+			// (There may be some value in a configurable hard fail if 0
+			// clusters are returned.)
+			return nil, trace.Wrap(err, "unable to fetch clusters with labels %v", selector.Labels)
+		}
+		for _, cluster := range labeledClusters {
+			matches = append(matches, selectorMatch{
+				selector: selector,
+				cluster:  cluster,
+			})
+		}
+	}
+
+	return matches, nil
+}
+
+func (s *OutputV2Service) render(
+	ctx context.Context,
+	status *kubernetesStatusV2,
+	routedIdentity *identity.Identity,
+	hostCAs []types.CertAuthority,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"OutputV2Service/render",
+	)
+	defer span.End()
+
+	if err := internal.WriteIdentityFile(ctx, s.log, status.credentials, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "writing identity file")
+	}
+	if err := identity.SaveIdentity(
+		ctx, routedIdentity, s.cfg.Destination, identity.DestinationKinds()...,
+	); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	// In exec plugin mode, we write the credentials to disk and write a
+	// kubeconfig that execs `tbot` to load those credentials.
+
+	// We only support directory mode for this since the exec plugin needs
+	// to know the path to read the credentials from, and this is
+	// unpredictable with other types of destination.
+	destinationDir, isDirectoryDest := s.cfg.Destination.(*destination.Directory)
+	if !s.cfg.DisableExecPlugin {
+		if !isDirectoryDest {
+			slog.InfoContext(
+				ctx,
+				"Kubernetes template will be rendered without exec plugin because destination is not a directory. Explicitly set `disable_exec_plugin: true` in the output to suppress this message",
+				"destination", logutils.StringerAttr(s.cfg.Destination))
+			s.cfg.DisableExecPlugin = true
+		}
+	}
+
+	var err error
+	var kubeCfg *clientcmdapi.Config
+	if s.cfg.DisableExecPlugin {
+		// If they've disabled the exec plugin, we just write the credentials
+		// directly into the kubeconfig.
+		kubeCfg, err = s.generateKubeConfigV2WithoutPlugin(status)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	} else {
+		executablePath, err := s.executablePath()
+		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
+			s.log.WarnContext(ctx, "Kubernetes template will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
+		} else if err != nil {
+			return trace.Wrap(err)
+		}
+
+		kubeCfg, err = s.generateKubeConfigV2WithPlugin(status, destinationDir.Path, executablePath)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	yamlCfg, err := clientcmd.Write(*kubeCfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := s.cfg.Destination.Write(ctx, defaultKubeconfigPath, yamlCfg); err != nil {
+		return trace.Wrap(err, "writing kubeconfig")
+	}
+
+	if err := s.cfg.Destination.Write(ctx, internal.HostCAPath, concatCACerts(hostCAs)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// encodePathComponent appropriate base64 encodes an input string for path-based
+// routing use.
+func encodePathComponent(input string) string {
+	return base64.RawURLEncoding.EncodeToString([]byte(input))
+}
+
+// generateKubeConfigWithPlugin creates a Kubernetes config object with the
+// given cluster config, using the `tbot kube credentials` auth helper plugin to
+// fetch refreshed certificate data at runtime.
+func (o *OutputV2Service) generateKubeConfigV2WithPlugin(ks *kubernetesStatusV2, destPath string, executablePath string) (*clientcmdapi.Config, error) {
+	config := clientcmdapi.NewConfig()
+
+	// Implementation note: tsh/kube.go generates a kubeconfig with all
+	// available clusters. This isn't especially useful in Machine ID when
+	// there's _at most_ one cluster we have permission to access for this
+	// Destination's set of certs, so instead of fetching all the k8s clusters
+	// and adding everything, we'll just stick with the single cluster name in
+	// our config file.
+	// Otherwise, we adapt this from lib/kube/kubeconfig/kubeconfig.go's
+	// Update(), but don't support env vars, insecure mode, or identity files.
+	// We do still implement `tbot kube credentials` to help client apps
+	// take better advantage of certificate renewals.
+
+	// Configure the cluster.
+	clusterCAs, err := ks.credentials.RootClusterCAs()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cas := bytes.Join(clusterCAs, []byte("\n"))
+	if len(cas) == 0 {
+		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
+	}
+
+	absDestPath, err := filepath.Abs(destPath)
+	if err != nil {
+		return nil, trace.Wrap(err, "determining absolute path for destination")
+	}
+
+	// Configure primary user/AuthInfo.
+	execArgs := []string{"kube", "credentials",
+		fmt.Sprintf("--destination-dir=%s", absDestPath),
+	}
+	config.AuthInfos[ks.teleportClusterName] = &clientcmdapi.AuthInfo{
+		Exec: &clientcmdapi.ExecConfig{
+			APIVersion: "client.authentication.k8s.io/v1beta1",
+			Command:    executablePath,
+			Args:       execArgs,
+		},
+	}
+
+	for i, cluster := range ks.kubernetesClusterNames {
+		contextName, err := kubeconfig.ContextNameFromTemplate(o.cfg.ContextNameTemplate, ks.teleportClusterName, cluster)
+		if err != nil {
+			return nil, trace.Wrap(err, "templating context name")
+		}
+
+		suffix := fmt.Sprintf("/v1/teleport/%s/%s", encodePathComponent(ks.teleportClusterName), encodePathComponent(cluster))
+		config.Clusters[contextName] = &clientcmdapi.Cluster{
+			Server:        ks.clusterAddr + suffix,
+			TLSServerName: ks.tlsServerName(ks.teleportClusterName, cluster),
+
+			// TODO: consider using CertificateAuthority (path) here to avoid
+			// duplication. This branch (with plugin) already requires a file
+			// destination so we can assume the CA is available.
+			CertificateAuthorityData: cas,
+		}
+
+		// Link the context to the main user.
+		config.Contexts[contextName] = &clientcmdapi.Context{
+			Cluster:  contextName,
+			AuthInfo: ks.teleportClusterName,
+		}
+		if ns, ok := ks.defaultNamespaces[cluster]; ok {
+			config.Contexts[contextName].Namespace = ns
+		}
+
+		// Always set the current context to the first-matched cluster. This
+		// won't be perfectly consistent if the first selector uses labels, so
+		// we may want to consider some way to flag an explicitly default
+		// context.
+		if i == 0 {
+			config.CurrentContext = contextName
+		}
+	}
+
+	return config, nil
+}
+
+func (o *OutputV2Service) generateKubeConfigV2WithoutPlugin(ks *kubernetesStatusV2) (*clientcmdapi.Config, error) {
+	config := clientcmdapi.NewConfig()
+
+	// Configure the cluster.
+	clusterCAs, err := ks.credentials.RootClusterCAs()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cas := bytes.Join(clusterCAs, []byte("\n"))
+	if len(cas) == 0 {
+		return nil, trace.BadParameter("TLS trusted CAs missing in provided credentials")
+	}
+
+	// Create a global AuthInfo for this cluster.
+	config.AuthInfos[ks.teleportClusterName] = &clientcmdapi.AuthInfo{
+		ClientCertificateData: ks.credentials.TLSCert,
+		ClientKeyData:         ks.credentials.TLSPrivateKey.PrivateKeyPEM(),
+	}
+
+	for i, cluster := range ks.kubernetesClusterNames {
+		contextName, err := kubeconfig.ContextNameFromTemplate(o.cfg.ContextNameTemplate, ks.teleportClusterName, cluster)
+		if err != nil {
+			return nil, trace.Wrap(err, "templating context name")
+		}
+
+		suffix := fmt.Sprintf("/v1/teleport/%s/%s", encodePathComponent(ks.teleportClusterName), encodePathComponent(cluster))
+		config.Clusters[contextName] = &clientcmdapi.Cluster{
+			Server:                   ks.clusterAddr + suffix,
+			TLSServerName:            ks.tlsServerName(ks.teleportClusterName, cluster),
+			CertificateAuthorityData: cas,
+		}
+
+		// Link the context to the main AuthInfo/user.
+		config.Contexts[contextName] = &clientcmdapi.Context{
+			Cluster:  contextName,
+			AuthInfo: ks.teleportClusterName,
+		}
+		if ns, ok := ks.defaultNamespaces[cluster]; ok {
+			config.Contexts[contextName].Namespace = ns
+		}
+
+		if i == 0 {
+			config.CurrentContext = contextName
+		}
+	}
+
+	return config, nil
+}
+
+// concatCACerts borrow's identityfile's CA cert concat method.
+func concatCACerts(cas []types.CertAuthority) []byte {
+	trusted := authclient.AuthoritiesToTrustedCerts(cas)
+
+	var caCerts []byte
+	for _, ca := range trusted {
+		for _, cert := range ca.TLSCertificates {
+			caCerts = append(caCerts, cert...)
+		}
+	}
+
+	return caCerts
+}
diff --git a/lib/tbot/services/k8s/output_v2_config.go b/lib/tbot/services/k8s/output_v2_config.go
new file mode 100644
index 0000000000000..c9a0c732f6113
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v2_config.go
@@ -0,0 +1,228 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const OutputV2ServiceType = "kubernetes/v2"
+
+// OutputV2Config produces credentials which can be used to connect to a
+// Kubernetes Cluster through teleport.
+type OutputV2Config struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+
+	// DisableExecPlugin disables the default behavior of using `tbot` as a
+	// `kubectl` credentials exec plugin. This is useful in environments where
+	// `tbot` may not exist on the system that will consume the outputted
+	// kubeconfig. It does mean that kubectl will not be able to automatically
+	// refresh the credentials within an individual invocation.
+	DisableExecPlugin bool `yaml:"disable_exec_plugin,omitempty"`
+
+	// Selectors is a list of selectors for path-based routing. Multiple
+	// selectors can be used to generate an output containing all matches.
+	Selectors []*KubernetesSelector `yaml:"selectors,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+
+	// ContextNameTemplate determines the format of context names in the
+	// generated kubeconfig. It is a "text/template" string that supports the
+	// following variables:
+	//
+	//   - {{.ClusterName}} - Name of the Teleport cluster
+	//   - {{.KubeName}} - Name of the Kubernetes cluster resource
+	//
+	// By default, the following template will be used: "{{.ClusterName}}-{{.KubeName}}".
+	ContextNameTemplate string `yaml:"context_name_template,omitempty"`
+
+	// RelayAddress specifies the address of a relay transport server to use in
+	// the generated Kubernetes config file.
+	RelayAddress string `yaml:"relay_server,omitempty"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *OutputV2Config) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *OutputV2Config) SetName(name string) {
+	o.Name = name
+}
+
+func (o *OutputV2Config) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+
+	if len(o.Selectors) == 0 {
+		return trace.BadParameter("at least one selector must be provided")
+	}
+
+	for _, s := range o.Selectors {
+		if err := s.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if o.ContextNameTemplate == "" {
+		o.ContextNameTemplate = defaultContextNameTemplate
+	} else {
+		if _, err := kubeconfig.ContextNameFromTemplate(o.ContextNameTemplate, "", ""); err != nil {
+			return trace.BadParameter("context_name_template is invalid: %v", err)
+		}
+	}
+
+	return trace.Wrap(o.Destination.CheckAndSetDefaults())
+}
+
+func (o *OutputV2Config) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *OutputV2Config) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+func (o *OutputV2Config) Describe() []bot.FileDescription {
+	return []bot.FileDescription{
+		{
+			Name: "kubeconfig.yaml",
+		},
+		{
+			Name: internal.IdentityFilePath,
+		},
+		{
+			Name: internal.HostCAPath,
+		},
+	}
+}
+
+func (o *OutputV2Config) MarshalYAML() (any, error) {
+	type raw OutputV2Config
+	return encoding.WithTypeHeader((*raw)(o), OutputV2ServiceType)
+}
+
+func (o *OutputV2Config) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *OutputV2Config) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw OutputV2Config
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *OutputV2Config) Type() string {
+	return OutputV2ServiceType
+}
+
+// KubernetesSelector allows querying for a Kubernetes cluster to include either
+// by its name or labels.
+type KubernetesSelector struct {
+	Name string `yaml:"name,omitempty"`
+
+	Labels map[string]string `yaml:"labels,omitempty"`
+
+	// DefaultNamespace specifies the default namespace that should be set in
+	// the resulting kubeconfig context for clusters yielded by this selector.
+	DefaultNamespace string `yaml:"default_namespace,omitempty"`
+}
+
+// String returns a human-readable representation of the selector for logs.
+func (s *KubernetesSelector) String() string {
+	switch {
+	case s.Name != "":
+		return fmt.Sprintf("name=%s", s.Name)
+	case len(s.Labels) != 0:
+		labels := make([]string, 0, len(s.Labels))
+		for k, v := range s.Labels {
+			labels = append(labels, k+"="+v)
+		}
+		slices.Sort(labels)
+		return fmt.Sprintf("labels={%s}", strings.Join(labels, ", "))
+	default:
+		return "<empty selector>"
+	}
+}
+
+func (s *KubernetesSelector) CheckAndSetDefaults() error {
+	if s.Name == "" && len(s.Labels) == 0 {
+		return trace.BadParameter("selectors: one of 'name' and 'labels' must be specified")
+	}
+
+	if s.Name != "" && len(s.Labels) > 0 {
+		return trace.BadParameter("selectors: only one of 'name' and 'labels' may be specified")
+	}
+
+	if s.Labels == nil {
+		s.Labels = map[string]string{}
+	}
+
+	return nil
+}
+
+func (s *KubernetesSelector) UnmarshalYAML(value *yaml.Node) error {
+	// A custom unmarshaler so Labels is consistently initialized to not-nil.
+	// Primarily needed for tests.
+	type temp KubernetesSelector
+	out := temp{
+		Labels: make(map[string]string),
+	}
+
+	if err := value.Decode(&out); err != nil {
+		return err
+	}
+
+	*s = KubernetesSelector(out)
+	return nil
+}
+
+func (o *OutputV2Config) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/k8s/output_v2_config_test.go b/lib/tbot/services/k8s/output_v2_config_test.go
new file mode 100644
index 0000000000000..f739473be8a8f
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v2_config_test.go
@@ -0,0 +1,175 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestKubernetesV2Output_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[OutputV2Config]{
+		{
+			name: "full",
+			in: OutputV2Config{
+				Destination:       dest,
+				DisableExecPlugin: true,
+				Selectors: []*KubernetesSelector{
+					{
+						Name: "foo",
+
+						// Unfortunately we have to manually initialize every
+						// map if we want tests to pass. Otherwise we'd need to
+						// support CheckAndSetDefaults() in testYAML() which
+						// breaks a ton of tests that didn't expect to have to
+						// compare initialized structs.
+						Labels: map[string]string{},
+					},
+					{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+						DefaultNamespace: "foo-namespace",
+					},
+				},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+				ContextNameTemplate: "{{.KubeName}}",
+			},
+		},
+		{
+			name: "minimal",
+			in: OutputV2Config{
+				Destination: dest,
+				Selectors: []*KubernetesSelector{
+					{
+						Name:   "foo",
+						Labels: map[string]string{},
+					},
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestKubernetesV2Output_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*OutputV2Config]{
+		{
+			name: "valid_name",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: destination.NewMemory(),
+					Selectors: []*KubernetesSelector{
+						{Name: "foo", Labels: map[string]string{}},
+					},
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+		},
+		{
+			name: "valid_label",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: destination.NewMemory(),
+					Selectors: []*KubernetesSelector{
+						{Labels: map[string]string{
+							"foo": "bar",
+						}},
+					},
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: nil,
+					Selectors: []*KubernetesSelector{
+						{Name: "foo"},
+					},
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing selectors",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination:         destination.NewMemory(),
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "at least one selector must be provided",
+		},
+		{
+			name: "empty selector",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: destination.NewMemory(),
+					Selectors: []*KubernetesSelector{
+						{},
+					},
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "selectors: one of 'name' and 'labels' must be specified",
+		},
+		{
+			name: "both name and label in selector",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: destination.NewMemory(),
+					Selectors: []*KubernetesSelector{
+						{
+							Name: "foo",
+							Labels: map[string]string{
+								"foo": "bar",
+							},
+						},
+					},
+					ContextNameTemplate: "{{.KubeName}}",
+				}
+			},
+			wantErr: "selectors: only one of 'name' and 'labels' may be specified",
+		},
+		{
+			name: "invalid context_name_template",
+			in: func() *OutputV2Config {
+				return &OutputV2Config{
+					Destination: destination.NewMemory(),
+					Selectors: []*KubernetesSelector{
+						{Name: "foo", Labels: map[string]string{}},
+					},
+					ContextNameTemplate: "{{.InvalidVariable}}",
+				}
+			},
+			wantErr: "can't evaluate field InvalidVariable",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/k8s/output_v2_test.go b/lib/tbot/services/k8s/output_v2_test.go
new file mode 100644
index 0000000000000..2cc0380d3b297
--- /dev/null
+++ b/lib/tbot/services/k8s/output_v2_test.go
@@ -0,0 +1,338 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+// fakeKubeServerClient provides a minimal implementation of
+// ServerWithRoles.ListResources() that applies real filters to a known set of
+// resources. Useful for testing against more complex queries.
+type fakeKubeServerClient struct {
+	apiclient.GetResourcesClient
+
+	availableKubeServers []types.KubeServer
+}
+
+func (f fakeKubeServerClient) GetResources(ctx context.Context, req *proto.ListResourcesRequest) (*proto.ListResourcesResponse, error) {
+	var matched []types.KubeServer
+
+	filter := services.MatchResourceFilter{
+		ResourceKind:   req.ResourceType,
+		Labels:         req.Labels,
+		SearchKeywords: req.SearchKeywords,
+	}
+
+	if req.PredicateExpression != "" {
+		expression, err := services.NewResourceExpression(req.PredicateExpression)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		filter.PredicateExpression = expression
+	}
+
+	for _, server := range f.availableKubeServers {
+		switch match, err := services.MatchResourceByFilters(server, filter, nil /* ignore dup matches  */); {
+		case err != nil:
+			return nil, trace.Wrap(err)
+		case match:
+			matched = append(matched, server)
+		}
+	}
+
+	out := make([]*proto.PaginatedResource, 0, len(matched))
+	for _, match := range matched {
+		server, ok := match.(*types.KubernetesServerV3)
+		if !ok {
+			return nil, trace.BadParameter("invalid type %T, expected *types.KubernetesServerV3", server)
+		}
+		out = append(out, &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubernetesServer{KubernetesServer: server}})
+	}
+
+	return &proto.ListResourcesResponse{Resources: out}, nil
+}
+
+// newTestKubeServer creates a minimal KubeServer appropriate for use with
+// `fakeKubeServerClient`.
+func newTestKubeServer(t *testing.T, name string, labels map[string]string) types.KubeServer {
+	t.Helper()
+
+	server, err := types.NewKubernetesServerV3(types.Metadata{
+		Name:   name,
+		Labels: labels,
+	}, types.KubernetesServerSpecV3{
+		HostID: name,
+		Cluster: &types.KubernetesClusterV3{
+			Metadata: types.Metadata{
+				Name:   name,
+				Labels: labels,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	return server
+}
+
+func TestKubernetesV2OutputService_fetch(t *testing.T) {
+	servers := []types.KubeServer{
+		newTestKubeServer(t, "a", map[string]string{}),
+		newTestKubeServer(t, "b", map[string]string{"foo": "1"}),
+		newTestKubeServer(t, "c", map[string]string{"foo": "1", "bar": "2"}),
+		newTestKubeServer(t, "d", map[string]string{"bar": "2"}),
+	}
+
+	client := &fakeKubeServerClient{
+		availableKubeServers: servers,
+	}
+
+	tests := []struct {
+		name                 string
+		selectors            []*KubernetesSelector
+		expectError          require.ErrorAssertionFunc
+		expectedClusterNames []string
+		wantNamespaces       map[string]string
+	}{
+		{
+			name: "matches by name",
+			selectors: []*KubernetesSelector{
+				{
+					Name:             "a",
+					DefaultNamespace: "a selector",
+				},
+				{
+					Name: "c",
+				},
+			},
+			expectedClusterNames: []string{"a", "c"},
+			wantNamespaces: map[string]string{
+				"a": "a selector",
+			},
+		},
+		{
+			name: "errors when direct lookup fails",
+			selectors: []*KubernetesSelector{
+				{
+					Name: "nonexistent",
+				},
+			},
+			expectError: func(tt require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(t, err, "unable to fetch cluster \"nonexistent\" by name")
+			},
+		},
+		{
+			name: "matches with simple label selector",
+			selectors: []*KubernetesSelector{
+				{
+					Labels: map[string]string{
+						"foo": "1",
+					},
+					DefaultNamespace: "my-namespace",
+				},
+			},
+			expectedClusterNames: []string{"b", "c"},
+			wantNamespaces: map[string]string{
+				"b": "my-namespace",
+				"c": "my-namespace",
+			},
+		},
+		{
+			name: "matches with complex label selector",
+			selectors: []*KubernetesSelector{
+				{
+					Labels: map[string]string{
+						"foo": "1",
+						"bar": "2",
+					},
+				},
+			},
+			expectedClusterNames: []string{"c"},
+			wantNamespaces:       map[string]string{},
+		},
+		{
+			name: "matches with multiple selectors",
+			selectors: []*KubernetesSelector{
+				{
+					Labels: map[string]string{
+						"foo": "1",
+					},
+					DefaultNamespace: "bar",
+				},
+				{
+					Labels: map[string]string{
+						"bar": "2",
+					},
+				},
+				{
+					Name: "a",
+				},
+			},
+			expectedClusterNames: []string{"a", "b", "c", "d"},
+			wantNamespaces: map[string]string{
+				"b": "bar",
+				"c": "bar",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matches, err := fetchAllMatchingKubeClusters(context.Background(), client, tt.selectors)
+			if tt.expectError != nil {
+				tt.expectError(t, err)
+			} else {
+				require.NoError(t, err)
+
+				var names []string
+				for _, match := range matches {
+					names = append(names, match.cluster.GetName())
+				}
+
+				// `generate()` dedupes downstream, so we'll replicate that
+				// here, otherwise we might see duplicates if some label
+				// selectors overlap.
+				names = apiutils.Deduplicate(names)
+				assert.ElementsMatch(t, tt.expectedClusterNames, names)
+				namespaces := make(map[string]string)
+				for _, match := range matches {
+					if match.selector.DefaultNamespace != "" {
+						namespaces[match.cluster.GetName()] = match.selector.DefaultNamespace
+					}
+				}
+				assert.Equal(t, tt.wantNamespaces, namespaces)
+			}
+		})
+	}
+}
+
+// TestKubernetesV2OutputService_render renders the Kubernetes template and
+// compares it to the saved golden result.
+func TestKubernetesV2OutputService_render(t *testing.T) {
+	// We need a fixed cert/key pair here for the golden files testing
+	// to behave properly.
+	id := &identity.Identity{
+		PrivateKeyBytes: keyPEM,
+		TLSCertBytes:    tlsCert,
+		ClusterName:     mockClusterName,
+	}
+
+	tests := []struct {
+		name              string
+		useRelativePath   bool
+		disableExecPlugin bool
+	}{
+		{
+			name: "absolute path",
+		},
+		{
+			name:            "relative path",
+			useRelativePath: true,
+		},
+		{
+			name:              "exec plugin disabled",
+			disableExecPlugin: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+
+			dest := &destination.Directory{
+				Path:     dir,
+				Symlinks: botfs.SymlinksInsecure,
+				ACLs:     botfs.ACLOff,
+			}
+			if tt.useRelativePath {
+				wd, err := os.Getwd()
+				require.NoError(t, err)
+				relativePath, err := filepath.Rel(wd, dir)
+				require.NoError(t, err)
+				dest.Path = relativePath
+			}
+
+			svc := OutputV2Service{
+				cfg: &OutputV2Config{
+					DisableExecPlugin: tt.disableExecPlugin,
+					Destination:       dest,
+				},
+				executablePath: fakeGetExecutablePath,
+				log:            logtest.NewLogger(),
+			}
+
+			keyRing, err := internal.NewClientKeyRing(
+				id,
+				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
+			)
+			require.NoError(t, err)
+			mockSNI := client.GetKubeTLSServerName(mockClusterName)
+			status := &kubernetesStatusV2{
+				kubernetesClusterNames: []string{"a", "b", "c"},
+				defaultNamespaces: map[string]string{
+					"a": "namespace-a",
+				},
+				teleportClusterName: mockClusterName,
+				tlsServerNameFunc:   func(teleportClusterName, kubeClusterName string) string { return mockSNI },
+				credentials:         keyRing,
+				clusterAddr:         fmt.Sprintf("https://%s:443", mockClusterName),
+			}
+
+			err = svc.render(
+				context.Background(),
+				status,
+				id,
+				[]types.CertAuthority{fakeCA(t, types.HostCA, mockClusterName)},
+			)
+			require.NoError(t, err)
+
+			kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, defaultKubeconfigPath))
+			require.NoError(t, err)
+			kubeconfigBytes = bytes.ReplaceAll(kubeconfigBytes, []byte(dir), []byte("/test/dir"))
+
+			if golden.ShouldSet() {
+				golden.SetNamed(t, "kubeconfig.yaml", kubeconfigBytes)
+			}
+			require.Equal(
+				t, string(golden.GetNamed(t, "kubeconfig.yaml")), string(kubeconfigBytes),
+			)
+		})
+	}
+}
diff --git a/lib/tbot/services/k8s/secret_destination.go b/lib/tbot/services/k8s/secret_destination.go
new file mode 100644
index 0000000000000..41effe7346c53
--- /dev/null
+++ b/lib/tbot/services/k8s/secret_destination.go
@@ -0,0 +1,317 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"go.opentelemetry.io/otel/attribute"
+	oteltrace "go.opentelemetry.io/otel/trace"
+	corev1 "k8s.io/api/core/v1"
+	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	applyconfigv1 "k8s.io/client-go/applyconfigurations/core/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const SecretDestinationType = "kubernetes_secret"
+const kubernetesNamespaceEnv = "POD_NAMESPACE"
+
+type SecretDestination struct {
+	// Name is the name the Kubernetes Secret that should be created and written
+	// to.
+	Name string `yaml:"name"`
+	// Labels is a set of labels to apply to the output Kubernetes secret.
+	// When configured, these labels will overwrite any existing labels on the
+	// secret.
+	Labels map[string]string `yaml:"labels,omitempty"`
+	// Namespace to write the Kubernetes Secret to. If not specified, it
+	// defaults to the value of the POD_NAMESPACE environment variable.
+	//
+	// When using the Helm chart, you'll need to additionally grant the tbot
+	// service account permissions to read/write to the other namespace.
+	Namespace string `yaml:"namespace,omitempty"`
+
+	mu          sync.Mutex
+	k8s         kubernetes.Interface
+	initialized bool
+}
+
+func (dks *SecretDestination) getSecret(ctx context.Context) (*corev1.Secret, error) {
+	secret, err := dks.k8s.CoreV1().Secrets(dks.Namespace).Get(ctx, dks.Name, v1.GetOptions{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// This will be nil out of Kubernetes if it hasn't had any values provided.
+	// Replace with an initialized map so code using this function does not
+	// need to worry about writing/reading from a nil map.
+	if secret.Data == nil {
+		secret.Data = map[string][]byte{}
+	}
+	return secret, nil
+}
+
+func (dks *SecretDestination) secretTemplate() *corev1.Secret {
+	return &corev1.Secret{
+		Type: corev1.SecretTypeOpaque,
+		ObjectMeta: v1.ObjectMeta{
+			Name:      dks.Name,
+			Namespace: dks.Namespace,
+			Labels:    dks.Labels,
+		},
+		Data: map[string][]byte{},
+	}
+}
+
+func (dks *SecretDestination) upsertSecret(ctx context.Context, secret *corev1.Secret, dryRun bool) error {
+	apply := applyconfigv1.Secret(dks.Name, dks.Namespace).
+		WithData(secret.Data).
+		WithResourceVersion(secret.ResourceVersion).
+		WithType(secret.Type)
+
+	// If user has configured labels, we overwrite the labels on the secret.
+	if len(dks.Labels) > 0 {
+		apply = apply.
+			WithLabels(dks.Labels)
+	}
+
+	applyOpts := v1.ApplyOptions{
+		FieldManager: "tbot",
+	}
+	if dryRun {
+		applyOpts.DryRun = []string{"All"}
+	}
+
+	_, err := dks.k8s.CoreV1().Secrets(dks.Namespace).Apply(ctx, apply, applyOpts)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (dks *SecretDestination) Verify(_ []string) error {
+	return nil
+}
+
+func (dks *SecretDestination) TryLock() (func() error, error) {
+	// No locking support currently implemented. Users will need to be cautious
+	// to not point two tbots to the same secret.
+	return func() error { return nil }, nil
+}
+
+func (dks *SecretDestination) CheckAndSetDefaults() error {
+	if dks.Name == "" {
+		return trace.BadParameter("name must not be empty")
+	}
+
+	return nil
+}
+
+func (dks *SecretDestination) Init(ctx context.Context, subdirs []string) error {
+	dks.mu.Lock()
+	defer dks.mu.Unlock()
+	if dks.initialized == true {
+		return trace.BadParameter("destination has already been initialized")
+	}
+
+	if dks.Namespace == "" {
+		log.DebugContext(
+			ctx,
+			"No explicit namespace provided for Kubernetes secret destination, attempting to detect from environment",
+		)
+		dks.Namespace = os.Getenv(kubernetesNamespaceEnv)
+		if dks.Namespace == "" {
+			return trace.BadParameter("unable to detect namespace from %s environment variable", kubernetesNamespaceEnv)
+		}
+	}
+
+	if len(subdirs) > 0 {
+		return trace.BadParameter("kubernetes_secret destination does not support subdirectories")
+	}
+
+	// If no k8s client is injected, we attempt to create one from the
+	// environment.
+	if dks.k8s == nil {
+		var err error
+		if dks.k8s, err = newKubernetesClient(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	// Perform an initial dry-run attempt of applying the secret. This ensures
+	// that we have the appropriate RBAC before proceeding, but avoids creating
+	// a secret which will remain empty if something goes wrong later in the
+	// credential generation.
+	secret, err := dks.getSecret(ctx)
+	if err != nil {
+		if !kubeerrors.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+		secret = dks.secretTemplate()
+	}
+	if err := dks.upsertSecret(ctx, secret, true); err != nil {
+		return trace.Wrap(err)
+	}
+
+	dks.initialized = true
+	return nil
+}
+
+func (dks *SecretDestination) Write(ctx context.Context, name string, data []byte) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"SecretDestination/Write",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	dks.mu.Lock()
+	defer dks.mu.Unlock()
+	if dks.initialized == false {
+		return trace.BadParameter("destination has not been initialized")
+	}
+
+	secret, err := dks.getSecret(ctx)
+	if err != nil {
+		if !kubeerrors.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+		log.WarnContext(
+			ctx,
+			"Kubernetes secret missing on attempt to write data. One will be created.",
+			"secret_name", dks.Name,
+			"secret_namespace", dks.Namespace,
+		)
+		// If the secret doesn't exist, we create it on write - this is ensures
+		// that we can recover if the secret is deleted between renewal loops.
+		secret = dks.secretTemplate()
+	}
+
+	secret.Data[name] = data
+
+	err = dks.upsertSecret(ctx, secret, false)
+	return trace.Wrap(err)
+}
+
+// WriteMany allows you to write multiple artifacts to a destination at once.
+// This should be atomic, meaning all artifacts are written or none are. Any
+// artifacts that are not specified will be removed from the destination.
+func (dks *SecretDestination) WriteMany(ctx context.Context, toWrite map[string][]byte) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"SecretDestination/WriteMany",
+	)
+	defer span.End()
+
+	dks.mu.Lock()
+	defer dks.mu.Unlock()
+	if dks.initialized == false {
+		return trace.BadParameter("destination has not been initialized")
+	}
+
+	secret, err := dks.getSecret(ctx)
+	if err != nil {
+		if !kubeerrors.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+		log.WarnContext(
+			ctx,
+			"Kubernetes secret missing on attempt to write data. One will be created.",
+			"secret_name", dks.Name,
+			"secret_namespace", dks.Namespace,
+		)
+		// If the secret doesn't exist, we create it on write - this is ensures
+		// that we can recover if the secret is deleted between renewal loops.
+		secret = dks.secretTemplate()
+	}
+
+	secret.Data = toWrite
+
+	err = dks.upsertSecret(ctx, secret, false)
+	return trace.Wrap(err)
+}
+
+func (dks *SecretDestination) Read(ctx context.Context, name string) ([]byte, error) {
+	ctx, span := tracer.Start(
+		ctx,
+		"SecretDestination/Read",
+		oteltrace.WithAttributes(attribute.String("name", name)),
+	)
+	defer span.End()
+
+	dks.mu.Lock()
+	defer dks.mu.Unlock()
+	if dks.initialized == false {
+		return nil, trace.BadParameter("destination has not been initialized")
+	}
+
+	secret, err := dks.getSecret(ctx)
+	if err != nil {
+		if kubeerrors.IsNotFound(err) {
+			return nil, trace.NotFound("secret could not be found")
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	data, ok := secret.Data[name]
+	if !ok {
+		return nil, trace.NotFound("key %q cannot be found in secret data", name)
+	}
+
+	return data, nil
+}
+
+func (dks *SecretDestination) String() string {
+	return fmt.Sprintf(
+		"%s: %s/%s",
+		SecretDestinationType,
+		dks.Namespace,
+		dks.Name,
+	)
+}
+
+func (dks *SecretDestination) MarshalYAML() (any, error) {
+	type raw SecretDestination
+	return encoding.WithTypeHeader((*raw)(dks), SecretDestinationType)
+}
+
+func (dks *SecretDestination) IsPersistent() bool {
+	return true
+}
+
+func newKubernetesClient() (*kubernetes.Clientset, error) {
+	// BuildConfigFromFlags falls back to InClusterConfig if both params
+	// are empty. This means KUBECONFIG takes precedence.
+	clientCfg, err := clientcmd.BuildConfigFromFlags("", os.Getenv("KUBECONFIG"))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	k8s, err := kubernetes.NewForConfig(clientCfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return k8s, nil
+}
diff --git a/lib/tbot/services/k8s/secret_destination_test.go b/lib/tbot/services/k8s/secret_destination_test.go
new file mode 100644
index 0000000000000..f523b255ef4da
--- /dev/null
+++ b/lib/tbot/services/k8s/secret_destination_test.go
@@ -0,0 +1,167 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package k8s
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestDestinationKubernetesSecret(t *testing.T) {
+	defaultNamespace := "test-namespace"
+	t.Setenv("POD_NAMESPACE", defaultNamespace)
+
+	tests := []struct {
+		name          string
+		dest          *SecretDestination
+		wantNamespace string
+
+		wantErr string
+	}{
+		{
+			name: "no existing secret",
+			dest: &SecretDestination{
+				Name: "my-secret",
+				k8s:  fake.NewClientset(),
+			},
+			wantNamespace: defaultNamespace,
+		},
+		{
+			name: "no existing secret with explicit namespace",
+			dest: &SecretDestination{
+				Name:      "my-secret",
+				Namespace: "my-other-namespace",
+				k8s:       fake.NewClientset(),
+			},
+			wantNamespace: "my-other-namespace",
+		},
+		{
+			name: "labels",
+			dest: &SecretDestination{
+				Name: "my-secret",
+				Labels: map[string]string{
+					"key": "value",
+					"bar": "baz",
+				},
+				k8s: fake.NewClientset(),
+			},
+			wantNamespace: defaultNamespace,
+		},
+		{
+			name: "existing secret",
+			dest: &SecretDestination{
+				Name: "my-secret",
+				k8s: fake.NewClientset(&corev1.Secret{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "my-secret",
+						Namespace: "test-namespace",
+					},
+				}),
+			},
+			wantNamespace: defaultNamespace,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			require.NoError(t, tt.dest.Init(ctx, []string{}))
+
+			// Test individual write
+			require.NoError(t, tt.dest.Write(ctx, "artifact-a", []byte("data-a")))
+			require.NoError(t, tt.dest.Write(ctx, "artifact-b", []byte("data-b")))
+			aData, err := tt.dest.Read(ctx, "artifact-a")
+			require.NoError(t, err)
+			require.Equal(t, []byte("data-a"), aData)
+			bData, err := tt.dest.Read(ctx, "artifact-b")
+			require.NoError(t, err)
+			require.Equal(t, []byte("data-b"), bData)
+
+			// Test write many
+			require.NoError(t, tt.dest.WriteMany(ctx, map[string][]byte{
+				"artifact-a": []byte("data-c"),
+				"artifact-b": []byte("data-d"),
+			}))
+			aData, err = tt.dest.Read(ctx, "artifact-a")
+			require.NoError(t, err)
+			require.Equal(t, []byte("data-c"), aData)
+			bData, err = tt.dest.Read(ctx, "artifact-b")
+			require.NoError(t, err)
+			require.Equal(t, []byte("data-d"), bData)
+
+			// Check labels have been set
+			secret, err := tt.dest.k8s.CoreV1().
+				Secrets(tt.wantNamespace).
+				Get(ctx, tt.dest.Name, metav1.GetOptions{})
+			require.NoError(t, err)
+			require.Equal(t, tt.dest.Labels, secret.Labels)
+		})
+	}
+}
+
+func TestDestinationKubernetesSecret_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*SecretDestination]{
+		{
+			name: "valid",
+			in: func() *SecretDestination {
+				return &SecretDestination{
+					Name: "my-secret",
+				}
+			},
+		},
+		{
+			name: "missing name",
+			in: func() *SecretDestination {
+				return &SecretDestination{}
+			},
+			wantErr: "name must not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
+
+func TestDestinationKubernetesSecret_YAML(t *testing.T) {
+	tests := []testYAMLCase[*SecretDestination]{
+		{
+			name: "full",
+			in: &SecretDestination{
+				Name:      "my-secret",
+				Namespace: "my-namespace",
+				Labels: map[string]string{
+					"key": "value",
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestDestinationKubernetesSecret_String(t *testing.T) {
+	require.Equal(
+		t,
+		"kubernetes_secret: foo/my-secret",
+		(&SecretDestination{Namespace: "foo", Name: "my-secret"}).String(),
+	)
+}
diff --git a/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/full.golden b/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/full.golden
new file mode 100644
index 0000000000000..d8bfadc3db414
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/full.golden
@@ -0,0 +1,20 @@
+type: kubernetes/argo-cd
+name: my-argo-service
+credential_ttl: 1m0s
+renewal_interval: 30s
+selectors:
+  - name: foo
+  - labels:
+      foo: bar
+secret_namespace: argocd
+secret_name_prefix: my-argo-cluster-
+secret_labels:
+  my-label: value
+secret_annotations:
+  my-annotation: value
+project: super-secret-project
+namespaces:
+  - prod
+  - dev
+cluster_resources: true
+cluster_name_template: '{{.KubeName}}'
diff --git a/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/minimal.golden b/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..a2fbedb367a4f
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestArgoCDOutput_YAML/minimal.golden
@@ -0,0 +1,3 @@
+type: kubernetes/argo-cd
+selectors:
+  - name: foo
diff --git a/lib/tbot/services/k8s/testdata/TestDestinationKubernetesSecret_YAML/full.golden b/lib/tbot/services/k8s/testdata/TestDestinationKubernetesSecret_YAML/full.golden
new file mode 100644
index 0000000000000..44ea53f59d695
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestDestinationKubernetesSecret_YAML/full.golden
@@ -0,0 +1,5 @@
+type: kubernetes_secret
+name: my-secret
+labels:
+  key: value
+namespace: my-namespace
diff --git a/lib/tbot/testdata/TestKubernetesOutputService_render/absolute_path/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/absolute_path/kubeconfig.yaml.golden
similarity index 100%
rename from lib/tbot/testdata/TestKubernetesOutputService_render/absolute_path/kubeconfig.yaml.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/absolute_path/kubeconfig.yaml.golden
diff --git a/lib/tbot/testdata/TestKubernetesOutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
similarity index 100%
rename from lib/tbot/testdata/TestKubernetesOutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
diff --git a/lib/tbot/testdata/TestKubernetesOutputService_render/relative_path/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/relative_path/kubeconfig.yaml.golden
similarity index 100%
rename from lib/tbot/testdata/TestKubernetesOutputService_render/relative_path/kubeconfig.yaml.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesOutputService_render/relative_path/kubeconfig.yaml.golden
diff --git a/lib/tbot/config/testdata/TestKubernetesOutput_YAML/full.golden b/lib/tbot/services/k8s/testdata/TestKubernetesOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestKubernetesOutput_YAML/full.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestKubernetesOutput_YAML/minimal.golden b/lib/tbot/services/k8s/testdata/TestKubernetesOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestKubernetesOutput_YAML/minimal.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesOutput_YAML/minimal.golden
diff --git a/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden
new file mode 100644
index 0000000000000..a87afbb6d8a51
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden
@@ -0,0 +1,46 @@
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+contexts:
+- context:
+    cluster: tele.blackmesa.gov-a
+    namespace: namespace-a
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- context:
+    cluster: tele.blackmesa.gov-b
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- context:
+    cluster: tele.blackmesa.gov-c
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+current-context: tele.blackmesa.gov-a
+kind: Config
+preferences: {}
+users:
+- name: tele.blackmesa.gov
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      args:
+      - kube
+      - credentials
+      - --destination-dir=/test/dir
+      command: /path/to/tbot
+      env: null
+      provideClusterInfo: false
diff --git a/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
new file mode 100644
index 0000000000000..6fb36894ec876
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
@@ -0,0 +1,39 @@
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+contexts:
+- context:
+    cluster: tele.blackmesa.gov-a
+    namespace: namespace-a
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- context:
+    cluster: tele.blackmesa.gov-b
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- context:
+    cluster: tele.blackmesa.gov-c
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+current-context: tele.blackmesa.gov-a
+kind: Config
+preferences: {}
+users:
+- name: tele.blackmesa.gov
+  user:
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURmRENDQW1TZ0F3SUJBZ0lRUC9qSTg1c3FqRFdEVGQ5cUYwVjVxakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB5TkRBME1ESXhOREE1TWpaYUZ3MHlOREEwTURJeE5URXdNalphCk1ITXhHekFaQmdOVkJBa1RFblJsYkdVdVlteGhZMnR0WlhOaExtZHZkakVOTUFzR0ExVUVFUk1FYm5Wc2JERVIKTUE4R0ExVUVBeE1JWW05MExYUmxjM1F4RGpBTUJnVXJ6ZzhCQVJNRFptOXZNUTR3REFZRks4NFBBUUlUQTJKaApjakVTTUJBR0JTdk9Ed0VERXdkbGVHRnRjR3hsTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCCkNnS0NBUUVBcjhXZkVET3ExVE4wYlQwU0dFdEV1RHJSYWYrVnVkbWJ5cEhva2V3eTQ2bWQ5WEIzZ1FXYmluOU4KLzV0eU5kYkZzV3NEZ0RJeVhQM1ViZTB1YmNQWWxjc0NOdGdDdks0cWQzUnlSdnhZNWxPZlMxcFpFU1BFdHZPLwpzeEV1NkUzTzBvZmN3cTR1S2VuSHVmMUVVUXVWRDZXeEFCVU9hT3MyLzNhYWhtWXk0U25LTlVzTTIvbDFYcmNJCjBla3ZCMGgxMG5YVUM0VkpTNHNLR3pHelRoRDMwOGlhL2JnRFNYYzBmaVV3WlBCNVRMbjdsU2N1aXNpKzhKU3MKcVdjY2tuWG9uR0VFdGlzbTdGTmkrbXNlVjFhaHpqRWJSTS9rZkZ3WjBIK2VrejNDZG5zbWtORDBGbXhCOVdUZgo1UHdHOG9YTTQyUUprd3VFSXUrOFEvVlZTU0ZlNHdJREFRQUJvejh3UFRBT0JnTlZIUThCQWY4RUJBTUNCYUF3CkhRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBd0RRWUoKS29aSWh2Y05BUUVMQlFBRGdnRUJBRVpZeklTMHR4K1luK2NFZlM4M2hwTDFqRUxxOUM4VjNQVEM2eTQ0a2pBSwppODVNeCtyaWRZcTBkZE1kVi85MUpaNXQxUnFkZTRMU1lVVlVQNnEvVWtpaDBteC9JM3oyU2l3cC9ZanBPdTZ4ClNaWGFrakdudDVwQ0NhL3QxTmNWTlNycVFwTFE4YkowbXJ1UmlOYXdyS28zL2dlNTdyZ2lkbkJGY092M3pWNXQKQklrWWpRSksyWVZZY0pqSjY4b2xYenBDRXc1aFRaOWZ3NDJmczJUT1JISHJQTlVBelBmM1FkcnppMDNocnZoZApwNm5ZTkExOGI2Z2d5Z2tjUlUyTVJ0ZTVFKy8yQUJZaXdSa2x3SldOSU1RSkpIeVpBVzhEeXdzMEUyZStCM3crCjcvU1lQeWVLT2x0N2ZvRDd6MFhNMkt3OW5kdXJKcTk3QVdma2Nuclp3YlE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBcjhXZkVET3ExVE4wYlQwU0dFdEV1RHJSYWYrVnVkbWJ5cEhva2V3eTQ2bWQ5WEIzCmdRV2JpbjlOLzV0eU5kYkZzV3NEZ0RJeVhQM1ViZTB1YmNQWWxjc0NOdGdDdks0cWQzUnlSdnhZNWxPZlMxcFoKRVNQRXR2Ty9zeEV1NkUzTzBvZmN3cTR1S2VuSHVmMUVVUXVWRDZXeEFCVU9hT3MyLzNhYWhtWXk0U25LTlVzTQoyL2wxWHJjSTBla3ZCMGgxMG5YVUM0VkpTNHNLR3pHelRoRDMwOGlhL2JnRFNYYzBmaVV3WlBCNVRMbjdsU2N1CmlzaSs4SlNzcVdjY2tuWG9uR0VFdGlzbTdGTmkrbXNlVjFhaHpqRWJSTS9rZkZ3WjBIK2VrejNDZG5zbWtORDAKRm14QjlXVGY1UHdHOG9YTTQyUUprd3VFSXUrOFEvVlZTU0ZlNHdJREFRQUJBb0lCQUN2Yjh2blcrcHlpYnozRwp6Rm9WaGZzMmFnUzZDc0ZLSkU2aW85YXRpbkUyWkx6V3FHc2dYQlJ0K2FkN1FUOWY3UXA5T20xbG1SMk5GTkd0CktqV25kY2JDMWpXYkp1dXZ4ZGJ5em9VWitKRFljdG9abkRuam8vVkcweUc2ZXVycVoxNHZHbzNWYXAxNHdTYU8KcE5wWU9vU2lBbzJUczNuSW4zdVZPNitubHJDS0ZCV2lJTU12SjRMODl2U0NYeUkvNWtwd0NVUnhwWWVZSnJRYgpKemk0VHNOMFZpWXFmNlhOZmhSQ1NEK0ZrOWttMmU2enNQSXVXeWZQcnRHeDFjQTJVZUFqbmpLSzlJUzlxa0F5CjYzMlQ2M1g2TTVrV3RpcklITS9yL0liZFNqK2x4R0NNcW5zU2dOWUlMUXY1c05ramdqd2xrS2wxODJ3NWwzQ1oKVGtqeUxQa0NnWUVBMGd1aHMzS0JxTTRBU0R6UUkzK2g1R1RHQTg3SVRiMEIvVGNpdEVsUFErdTNQTHlwd3o5dQpLelM5QkhNcGFXUFdJT0p6WVJBamI4QkRsZHlDY0FobXlyNWx2N08vZXpSbWdHRDlOUFY2NklFNUFYOW5LVk5TClBoSlROaVlQU0g3ZzR6TzNLNHNkNTM5N1l1blJaekF4Z3NWV3p1N0UyZ1VySlNDc2Ywbkw3N1VDZ1lFQTFqcGcKbUpiU0dZVnJZRXlRbXQ2WWpIbndjTGlOVEpEUGJjbjI3ZzBMbWNSYnE5U2ZJdmEvSWZaYWYwcnU4YjljOFFOTQpXTWFnNTdXR1FnaFMyQjc2OThHdmx3RituS1hYWkRqQ1o0ejYrRWZpL1Q1dUhMNVZEY3BIRTR5cWRaRzQyaFRXCm0rSzR3bDRaNkI1MHhHQy9tSmx4ekI2amU0cUJNOVpzbjh3U3d6Y0NnWUVBazVPMGt2NGE5MTExZVV1dythQU4KUVFsRXp4d1VRL3BPVVhqUm0xWCtxVHdPVEZCSi9uS3NseExBMDBXT2pRdW1RUWlhQkZKd2MyM2tqb0NWN04wYQpTOHltZEtCNElycFlZazdDMk5pNCtHOENmSGpsSkhYMFRNUlhUcTVEQXE2U2wwK1luTEZyMjJFSWNpRFNEZXdnCmZUN2xsUkxSb0ZVTlVWSzVuOTFidWhrQ2dZRUF3cVVFQTJCMXdRNkNnMXJOd0lram5lOWxVV1c5cktXZWNxaWcKbmFab3RldTlSeURHL3FPbkFocXVHeDVnZ0hKWTVmc1RNVTQ0QUkva1RyYjFYcnkzVnNrNjJ6OVdaTW9pTEVPTwpEenYvQS90OCtJL3l5RmIvUEtwZmJobk8vMGZKNXd3citqTkRvQWFVRDEwc3h3a0l6SVFPNjJHak5LcWh2aEhEClhHVzFYbjBDZ1lFQXpVTEFJOWlqL3E1UytHTXlZajF4TENVNHF4QnBVLzA0bkUrUGZTU21mdjhNYTM0dWg0UU0KblJEY1pIQnFaWU5SRHQ1ek52UlRqZ3dKaTRpSEd3U0IrRDRTSVlHYjBpb1RJMk1PUzJGN3pCRHlsOEZYcDdkVAozVFNLcm9ud29XWW9MU2lzcW5uL3M4aU4xTTlSSkE5cHlJeTdGVFZ3cTU5WEwzTm9ldElTdUtjPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
diff --git a/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden
new file mode 100644
index 0000000000000..a87afbb6d8a51
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden
@@ -0,0 +1,46 @@
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
+    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+contexts:
+- context:
+    cluster: tele.blackmesa.gov-a
+    namespace: namespace-a
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-a
+- context:
+    cluster: tele.blackmesa.gov-b
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-b
+- context:
+    cluster: tele.blackmesa.gov-c
+    user: tele.blackmesa.gov
+  name: tele.blackmesa.gov-c
+current-context: tele.blackmesa.gov-a
+kind: Config
+preferences: {}
+users:
+- name: tele.blackmesa.gov
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      args:
+      - kube
+      - credentials
+      - --destination-dir=/test/dir
+      command: /path/to/tbot
+      env: null
+      provideClusterInfo: false
diff --git a/lib/tbot/services/k8s/testdata/TestKubernetesV2Output_YAML/full.golden b/lib/tbot/services/k8s/testdata/TestKubernetesV2Output_YAML/full.golden
new file mode 100644
index 0000000000000..79551f169be41
--- /dev/null
+++ b/lib/tbot/services/k8s/testdata/TestKubernetesV2Output_YAML/full.golden
@@ -0,0 +1,12 @@
+type: kubernetes/v2
+destination:
+  type: memory
+disable_exec_plugin: true
+selectors:
+  - name: foo
+  - labels:
+      foo: bar
+    default_namespace: foo-namespace
+credential_ttl: 1m0s
+renewal_interval: 30s
+context_name_template: '{{.KubeName}}'
diff --git a/lib/tbot/config/testdata/TestKubernetesV2Output_YAML/minimal.golden b/lib/tbot/services/k8s/testdata/TestKubernetesV2Output_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestKubernetesV2Output_YAML/minimal.golden
rename to lib/tbot/services/k8s/testdata/TestKubernetesV2Output_YAML/minimal.golden
diff --git a/lib/tbot/services/legacyspiffe/helpers_test.go b/lib/tbot/services/legacyspiffe/helpers_test.go
new file mode 100644
index 0000000000000..44f5cc04331a0
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/helpers_test.go
@@ -0,0 +1,169 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+// makeBot creates a server-side bot and returns joining parameters.
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
+	ctx := context.TODO()
+	t.Helper()
+
+	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: roles,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	require.NoError(t, err)
+	tok, err := types.NewProvisionTokenFromSpec(
+		tokenName,
+		time.Now().Add(10*time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles:   []types.SystemRole{types.RoleBot},
+			BotName: b.Metadata.Name,
+		})
+	require.NoError(t, err)
+	err = client.CreateToken(ctx, tok)
+	require.NoError(t, err)
+
+	return &onboarding.Config{
+		TokenValue: tok.GetName(),
+		JoinMethod: types.JoinMethodToken,
+	}, b
+}
+
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		if err := testenv.WithClusterName("root")(o); err != nil {
+			return err
+		}
+		if err := testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{AddrNetwork: "tcp", Addr: net.JoinHostPort("localhost", strconv.Itoa(cfg.Proxy.WebAddr.Port(0)))},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+		})(o); err != nil {
+			return err
+		}
+		return nil
+	}
+}
diff --git a/lib/tbot/services/legacyspiffe/legacyspiffe.go b/lib/tbot/services/legacyspiffe/legacyspiffe.go
new file mode 100644
index 0000000000000..9c91721cb6804
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/legacyspiffe.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/legacyspiffe")
diff --git a/lib/tbot/services/legacyspiffe/svid_output.go b/lib/tbot/services/legacyspiffe/svid_output.go
new file mode 100644
index 0000000000000..29414f3d28f94
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/svid_output.go
@@ -0,0 +1,420 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"cmp"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"log/slog"
+	"math"
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+)
+
+func SVIDOutputServiceBuilder(
+	cfg *SVIDOutputConfig,
+	trustBundleCache TrustBundleGetter,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &SVIDOutputService{
+			botAuthClient:             deps.Client,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			getBotIdentity:            deps.BotIdentity,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			trustBundleCache:          trustBundleCache,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(SVIDOutputServiceType, cfg.Name, buildFn)
+}
+
+// SVIDOutputService is a service that generates and writes X509 SPIFFE
+// SVIDs to a destination. It produces an output compatible with the
+// `spiffe-helper` tool.
+type SVIDOutputService struct {
+	botAuthClient             *apiclient.Client
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *SVIDOutputConfig
+	getBotIdentity            func() *identity.Identity
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	// trustBundleCache is the cache of trust bundles. It only needs to be
+	// provided when running in daemon mode.
+	trustBundleCache  TrustBundleGetter
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+func (s *SVIDOutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("spiffe-svid-output (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *SVIDOutputService) OneShot(ctx context.Context) error {
+	res, privateKey, jwtSVIDs, err := s.requestSVID(ctx)
+	if err != nil {
+		return trace.Wrap(err, "requesting SVID")
+	}
+	bundleSet, err := workloadidentity.FetchInitialBundleSet(
+		ctx,
+		s.log,
+		s.botAuthClient.SPIFFEFederationServiceClient(),
+		s.botAuthClient.TrustClient(),
+		s.cfg.IncludeFederatedTrustBundles,
+		s.getBotIdentity().ClusterName,
+	)
+	if err != nil {
+		return trace.Wrap(err, "fetching trust bundle set")
+
+	}
+	return s.render(ctx, bundleSet, res, privateKey, jwtSVIDs)
+}
+
+func (s *SVIDOutputService) Run(ctx context.Context) error {
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting trust bundle set")
+	}
+
+	jitter := retryutils.DefaultJitter
+	var res *machineidv1pb.SignX509SVIDsResponse
+	var privateKey crypto.Signer
+	var jwtSVIDs map[string]string
+	var failures int
+	firstRun := make(chan struct{}, 1)
+	firstRun <- struct{}{}
+	for {
+		var retryAfter <-chan time.Time
+		if failures > 0 {
+			s.statusReporter.Report(readyz.Unhealthy)
+			backoffTime := min(time.Second*time.Duration(math.Pow(2, float64(failures-1))), time.Minute)
+			backoffTime = jitter(backoffTime)
+			s.log.WarnContext(
+				ctx,
+				"Last attempt to generate output failed, will retry",
+				"retry_after", backoffTime,
+				"failures", failures,
+			)
+			retryAfter = time.After(time.Duration(failures) * time.Second)
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-retryAfter:
+			s.log.InfoContext(ctx, "Retrying")
+		case <-bundleSet.Stale():
+			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err, "getting trust bundle set")
+			}
+			s.log.InfoContext(ctx, "Trust bundle set has been updated")
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the local trust domain CA has changed, we need to reissue
+				// the SVID.
+				res = nil
+				privateKey = nil
+			}
+			bundleSet = newBundleSet
+		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval):
+			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
+			res = nil
+			privateKey = nil
+		case <-firstRun:
+		}
+
+		if res == nil || privateKey == nil {
+			var err error
+			res, privateKey, jwtSVIDs, err = s.requestSVID(ctx)
+			if err != nil {
+				s.log.ErrorContext(ctx, "Failed to request SVID", "error", err)
+				failures++
+				continue
+			}
+		}
+		if err := s.render(ctx, bundleSet, res, privateKey, jwtSVIDs); err != nil {
+			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
+			failures++
+			continue
+		}
+		s.statusReporter.Report(readyz.Healthy)
+		failures = 0
+	}
+}
+
+func (s *SVIDOutputService) requestSVID(
+	ctx context.Context,
+) (
+	*machineidv1pb.SignX509SVIDsResponse,
+	crypto.Signer,
+	map[string]string,
+	error,
+) {
+	ctx, span := tracer.Start(
+		ctx,
+		"SVIDOutputService/requestSVID",
+	)
+	defer span.End()
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err, "generating identity")
+	}
+
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	res, privateKey, err := generateSVID(
+		ctx,
+		impersonatedClient,
+		[]SVIDRequest{s.cfg.SVID},
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL,
+	)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err, "generating X509 SVID")
+	}
+
+	jwtSvids, err := generateJWTSVIDs(
+		ctx,
+		impersonatedClient,
+		s.cfg.SVID,
+		s.cfg.JWTs,
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err, "generating JWT SVIDs")
+	}
+
+	return res, privateKey, jwtSvids, nil
+}
+
+func (s *SVIDOutputService) render(
+	ctx context.Context,
+	bundleSet *workloadidentity.BundleSet,
+	res *machineidv1pb.SignX509SVIDsResponse,
+	privateKey crypto.Signer,
+	jwtSVIDs map[string]string,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"SVIDOutputService/render",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Rendering output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	privPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  internal.PEMBlockTypePrivateKey,
+		Bytes: privBytes,
+	})
+
+	if len(res.Svids) != 1 {
+		return trace.BadParameter("expected 1 SVID, got %d", len(res.Svids))
+
+	}
+	svid := res.Svids[0]
+	if err := s.cfg.Destination.Write(ctx, internal.SVIDKeyPEMPath, privPEM); err != nil {
+		return trace.Wrap(err, "writing svid key")
+	}
+
+	certPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  internal.PEMBlockTypeCertificate,
+		Bytes: svid.Certificate,
+	})
+	if err := s.cfg.Destination.Write(ctx, internal.SVIDPEMPath, certPEM); err != nil {
+		return trace.Wrap(err, "writing svid certificate")
+	}
+
+	trustBundleBytes, err := bundleSet.Local.X509Bundle().Marshal()
+	if err != nil {
+		return trace.Wrap(err, "marshaling local trust bundle")
+	}
+
+	if s.cfg.IncludeFederatedTrustBundles {
+		for _, federatedBundle := range bundleSet.Federated {
+			federatedBundleBytes, err := federatedBundle.X509Bundle().Marshal()
+			if err != nil {
+				return trace.Wrap(err, "marshaling federated trust bundle (%s)", federatedBundle.TrustDomain().Name())
+			}
+			trustBundleBytes = append(trustBundleBytes, federatedBundleBytes...)
+		}
+	}
+
+	if err := s.cfg.Destination.Write(
+		ctx, internal.SVIDTrustBundlePEMPath, trustBundleBytes,
+	); err != nil {
+		return trace.Wrap(err, "writing svid trust bundle")
+	}
+
+	for fileName, jwt := range jwtSVIDs {
+		if err := s.cfg.Destination.Write(ctx, fileName, []byte(jwt)); err != nil {
+			return trace.Wrap(err, "writing JWT SVID")
+		}
+	}
+
+	return nil
+}
+
+func generateJWTSVIDs(
+	ctx context.Context,
+	clt *apiclient.Client,
+	svid SVIDRequest,
+	reqs []JWTSVID,
+	ttl time.Duration,
+) (map[string]string, error) {
+	ctx, span := tracer.Start(
+		ctx,
+		"generateJWTSVIDs",
+	)
+	defer span.End()
+
+	requestedAudiences := map[string]bool{}
+	for _, jwt := range reqs {
+		requestedAudiences[jwt.Audience] = true
+	}
+
+	jwtReqs := make([]*machineidv1pb.JWTSVIDRequest, 0, len(requestedAudiences))
+	for audience := range requestedAudiences {
+		jwtReqs = append(jwtReqs, &machineidv1pb.JWTSVIDRequest{
+			Audiences:    []string{audience},
+			Ttl:          durationpb.New(ttl),
+			SpiffeIdPath: svid.Path,
+		})
+	}
+
+	if len(jwtReqs) == 0 {
+		return nil, nil
+	}
+
+	jwtRes, err := clt.WorkloadIdentityServiceClient().SignJWTSVIDs(ctx, &machineidv1pb.SignJWTSVIDsRequest{
+		Svids: jwtReqs,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "requesting JWT SVIDs")
+	}
+
+	jwtFiles := map[string]string{}
+	for _, req := range reqs {
+		for _, jwtSVID := range jwtRes.Svids {
+			if len(jwtSVID.Audiences) == 1 && jwtSVID.Audiences[0] == req.Audience {
+				jwtFiles[req.FileName] = jwtSVID.Jwt
+				break
+			}
+		}
+	}
+	return jwtFiles, nil
+}
+
+// generateSVID generates the pre-requisites and makes a SVID generation RPC
+// call.
+func generateSVID(
+	ctx context.Context,
+	clt *apiclient.Client,
+	reqs []SVIDRequest,
+	ttl time.Duration,
+) (*machineidv1pb.SignX509SVIDsResponse, crypto.Signer, error) {
+	ctx, span := tracer.Start(
+		ctx,
+		"generateSVID",
+	)
+	defer span.End()
+	privateKey, err := cryptosuites.GenerateKey(ctx,
+		cryptosuites.GetCurrentSuiteFromAuthPreference(clt),
+		cryptosuites.BotSVID)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	pubBytes, err := x509.MarshalPKIXPublicKey(privateKey.Public())
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	svids := make([]*machineidv1pb.SVIDRequest, 0, len(reqs))
+	for _, req := range reqs {
+		svids = append(svids, &machineidv1pb.SVIDRequest{
+			PublicKey:    pubBytes,
+			SpiffeIdPath: req.Path,
+			DnsSans:      req.SANS.DNS,
+			IpSans:       req.SANS.IP,
+			Hint:         req.Hint,
+			Ttl:          durationpb.New(ttl),
+		})
+	}
+
+	res, err := clt.WorkloadIdentityServiceClient().SignX509SVIDs(ctx,
+		&machineidv1pb.SignX509SVIDsRequest{
+			Svids: svids,
+		},
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return res, privateKey, nil
+}
diff --git a/lib/tbot/services/legacyspiffe/svid_output_config.go b/lib/tbot/services/legacyspiffe/svid_output_config.go
new file mode 100644
index 0000000000000..663968bb987ab
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/svid_output_config.go
@@ -0,0 +1,212 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"context"
+	"log/slog"
+	"net"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const SVIDOutputServiceType = "spiffe-svid"
+
+// SVIDRequestSANs is the configuration for the SANs of a single SVID request.
+type SVIDRequestSANs struct {
+	// DNS is the list of DNS names that are requested to be included in the SVID.
+	DNS []string `yaml:"dns,omitempty"`
+	// IP is the list of IP addresses that are requested to be included in the SVID.
+	// These can be IPv4 or IPv6 addresses.
+	IP []string `yaml:"ip,omitempty"`
+}
+
+// SVIDRequest is the configuration for a single SVID request.
+type SVIDRequest struct {
+	// Path is the SPIFFE ID path of the SVID. It should be prefixed with "/".
+	Path string `yaml:"path,omitempty"`
+	// Hint is the hint for the SVID that will be provided to consumers of the
+	// SVID to help them identify it.
+	Hint string `yaml:"hint,omitempty"`
+	// SANS is the Subject Alternative Names that are requested to be included
+	// in the SVID.
+	SANS SVIDRequestSANs `yaml:"sans,omitempty"`
+}
+
+func (o SVIDRequest) LogValue() slog.Value {
+	return slog.GroupValue(
+		slog.String("path", o.Path),
+		slog.String("hint", o.Hint),
+		slog.Any("dns_sans", o.SANS.DNS),
+		slog.Any("ip_sans", o.SANS.IP),
+	)
+}
+
+// CheckAndSetDefaults checks the SVIDRequest values and sets any defaults.
+func (o *SVIDRequest) CheckAndSetDefaults() error {
+	switch {
+	case o.Path == "":
+		return trace.BadParameter("svid.path: should not be empty")
+	case !strings.HasPrefix(o.Path, "/"):
+		return trace.BadParameter("svid.path: should be prefixed with /")
+	}
+	for i, stringIP := range o.SANS.IP {
+		ip := net.ParseIP(stringIP)
+		if ip == nil {
+			return trace.BadParameter(
+				"ip_sans[%d]: invalid IP address %q", i, stringIP,
+			)
+		}
+	}
+	return nil
+}
+
+// JWTSVID the configuration for a single JWT SVID request as part of the SPIFFE
+// SVID output.
+type JWTSVID struct {
+	// FileName is the name of the artifact/file the JWT should be written to.
+	FileName string `yaml:"file_name"`
+	// Audience is the audience of the JWT.
+	Audience string `yaml:"audience"`
+}
+
+func (o JWTSVID) CheckAndSetDefaults() error {
+	switch {
+	case o.Audience == "":
+		return trace.BadParameter("audience: should not be empty")
+	case o.FileName == "":
+		return trace.BadParameter("name: should not be empty")
+	}
+	return nil
+}
+
+// SVIDOutputConfig is the configuration for the SPIFFE SVID output.
+// Emulates the output of https://github.com/spiffe/spiffe-helper
+type SVIDOutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination                  destination.Destination `yaml:"destination"`
+	SVID                         SVIDRequest             `yaml:"svid"`
+	IncludeFederatedTrustBundles bool                    `yaml:"include_federated_trust_bundles,omitempty"`
+	// JWTs is an optional list of audiences and file names to write JWT SVIDs
+	// to.
+	JWTs []JWTSVID `yaml:"jwts,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *SVIDOutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *SVIDOutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Init initializes the destination.
+func (o *SVIDOutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+// GetDestination returns the destination.
+func (o *SVIDOutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
+func (o *SVIDOutputConfig) CheckAndSetDefaults() error {
+	if err := o.SVID.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating svid")
+	}
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	for i, jwt := range o.JWTs {
+		if err := jwt.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err, "validating jwts[%d]", i)
+		}
+	}
+	return nil
+}
+
+// Describe returns the file descriptions for the SPIFFE SVID output.
+func (o *SVIDOutputConfig) Describe() []bot.FileDescription {
+	fds := []bot.FileDescription{
+		{
+			Name: internal.SVIDPEMPath,
+		},
+		{
+			Name: internal.SVIDKeyPEMPath,
+		},
+		{
+			Name: internal.SVIDTrustBundlePEMPath,
+		},
+	}
+	for _, jwt := range o.JWTs {
+		fds = append(fds, bot.FileDescription{Name: jwt.FileName})
+	}
+	return nil
+}
+
+func (o *SVIDOutputConfig) Type() string {
+	return SVIDOutputServiceType
+}
+
+// MarshalYAML marshals the SPIFFESVIDOutput into YAML.
+func (o *SVIDOutputConfig) MarshalYAML() (any, error) {
+	type raw SVIDOutputConfig
+	return encoding.WithTypeHeader((*raw)(o), SVIDOutputServiceType)
+}
+
+func (o *SVIDOutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *SVIDOutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw SVIDOutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *SVIDOutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/legacyspiffe/svid_output_config_test.go b/lib/tbot/services/legacyspiffe/svid_output_config_test.go
new file mode 100644
index 0000000000000..184e49887605e
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/svid_output_config_test.go
@@ -0,0 +1,214 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestSPIFFESVIDOutput_YAML(t *testing.T) {
+	t.Parallel()
+
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[SVIDOutputConfig]{
+		{
+			name: "full",
+			in: SVIDOutputConfig{
+				Destination: dest,
+				SVID: SVIDRequest{
+					Path: "/foo",
+					Hint: "hint",
+					SANS: SVIDRequestSANs{
+						DNS: []string{"example.com"},
+						IP:  []string{"10.0.0.1", "10.42.0.1"},
+					},
+				},
+				IncludeFederatedTrustBundles: true,
+				JWTs: []JWTSVID{
+					{
+						Audience: "example.com",
+						FileName: "foo",
+					},
+					{
+						Audience: "2.example.com",
+						FileName: "bar",
+					},
+				},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: SVIDOutputConfig{
+				Destination: dest,
+				SVID: SVIDRequest{
+					Path: "/foo",
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestSPIFFESVIDOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*SVIDOutputConfig]{
+		{
+			name: "valid",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "/foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+					JWTs: []JWTSVID{
+						{
+							FileName: "foo",
+							Audience: "example.com",
+						},
+					},
+				}
+			},
+		},
+		{
+			name: "missing jwt name",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "/foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+					JWTs: []JWTSVID{
+						{
+							Audience: "example.com",
+						},
+					},
+				}
+			},
+			wantErr: "name: should not be empty",
+		},
+		{
+			name: "missing jwt audience",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "/foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+					JWTs: []JWTSVID{
+						{
+							FileName: "foo",
+						},
+					},
+				}
+			},
+			wantErr: "audience: should not be empty",
+		},
+		{
+			name: "missing destination",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: nil,
+					SVID: SVIDRequest{
+						Path: "/foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing path",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+				}
+			},
+			wantErr: "svid.path: should not be empty",
+		},
+		{
+			name: "path missing leading slash",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"10.0.0.1"},
+						},
+					},
+				}
+			},
+			wantErr: "svid.path: should be prefixed with /",
+		},
+		{
+			name: "invalid ip",
+			in: func() *SVIDOutputConfig {
+				return &SVIDOutputConfig{
+					Destination: destination.NewMemory(),
+					SVID: SVIDRequest{
+						Path: "/foo",
+						Hint: "hint",
+						SANS: SVIDRequestSANs{
+							DNS: []string{"example.com"},
+							IP:  []string{"thisisntanip"},
+						},
+					},
+				}
+			},
+			wantErr: "ip_sans[0]: invalid IP address",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/testdata/TestSPIFFESVIDOutput_YAML/full.golden b/lib/tbot/services/legacyspiffe/testdata/TestSPIFFESVIDOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSPIFFESVIDOutput_YAML/full.golden
rename to lib/tbot/services/legacyspiffe/testdata/TestSPIFFESVIDOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestSPIFFESVIDOutput_YAML/minimal.golden b/lib/tbot/services/legacyspiffe/testdata/TestSPIFFESVIDOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSPIFFESVIDOutput_YAML/minimal.golden
rename to lib/tbot/services/legacyspiffe/testdata/TestSPIFFESVIDOutput_YAML/minimal.golden
diff --git a/lib/tbot/config/testdata/TestSPIFFEWorkloadAPIService_YAML/full.golden b/lib/tbot/services/legacyspiffe/testdata/TestSPIFFEWorkloadAPIService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSPIFFEWorkloadAPIService_YAML/full.golden
rename to lib/tbot/services/legacyspiffe/testdata/TestSPIFFEWorkloadAPIService_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestSPIFFEWorkloadAPIService_YAML/minimal.golden b/lib/tbot/services/legacyspiffe/testdata/TestSPIFFEWorkloadAPIService_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSPIFFEWorkloadAPIService_YAML/minimal.golden
rename to lib/tbot/services/legacyspiffe/testdata/TestSPIFFEWorkloadAPIService_YAML/minimal.golden
diff --git a/lib/tbot/services/legacyspiffe/workload_api.go b/lib/tbot/services/legacyspiffe/workload_api.go
new file mode 100644
index 0000000000000..b5ddbec8aefab
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/workload_api.go
@@ -0,0 +1,884 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"cmp"
+	"context"
+	"crypto/x509"
+	"fmt"
+	"log/slog"
+	"math/big"
+	"strings"
+	"time"
+
+	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	"github.com/gravitational/trace"
+	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
+	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+	grpcmetrics "github.com/gravitational/teleport/lib/observability/metrics/grpc"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/sds"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/services/clientcredentials"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+	"github.com/gravitational/teleport/lib/uds"
+)
+
+func WorkloadAPIServiceBuilder(
+	cfg *WorkloadAPIConfig,
+	trustBundleCache TrustBundleGetter,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		sidecar, credential := clientcredentials.NewSidecar(deps, defaultCredentialLifetime)
+		svc := &WorkloadAPIService{
+			svcIdentity:               credential,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			trustBundleCache:          trustBundleCache,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return bot.NewServicePair(svc, sidecar), nil
+	}
+	return bot.NewServiceBuilder(WorkloadAPIServiceType, cfg.Name, buildFn)
+}
+
+type TrustBundleGetter interface {
+	GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error)
+}
+
+// WorkloadAPIService implements a gRPC server that fulfills the SPIFFE
+// Workload API specification. It provides X509 SVIDs and trust bundles to
+// workloads that connect over the configured listener.
+//
+// Sources:
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_Endpoint.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
+type WorkloadAPIService struct {
+	workloadpb.UnimplementedSpiffeWorkloadAPIServer
+
+	svcIdentity               *clientcredentials.UnstableConfig
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *WorkloadAPIConfig
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	trustBundleCache          TrustBundleGetter
+	clientBuilder             *client.Builder
+
+	// client holds the impersonated client for the service
+	client           *apiclient.Client
+	attestor         *workloadattest.Attestor
+	localTrustDomain spiffeid.TrustDomain
+}
+
+// setup initializes the service, performing tasks such as determining the
+// trust domain, fetching the initial trust bundle and creating an impersonated
+// client.
+func (s *WorkloadAPIService) setup(ctx context.Context) (err error) {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/setup")
+	defer span.End()
+
+	// Wait for the impersonated identity to be ready for us to consume here.
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(10 * time.Second):
+		return trace.BadParameter("timeout waiting for identity to be ready")
+	case <-s.svcIdentity.Ready():
+	}
+	facade, err := s.svcIdentity.Facade()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	client, err := s.clientBuilder.Build(ctx, facade)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.client = client
+	// Closure is managed by the caller if this function succeeds. But if it
+	// fails, we need to close the client.
+	defer func() {
+		if err != nil {
+			client.Close()
+		}
+	}()
+
+	td, err := spiffeid.TrustDomainFromString(facade.Get().ClusterName)
+	if err != nil {
+		return trace.Wrap(err, "parsing trust domain name")
+	}
+	s.localTrustDomain = td
+
+	s.attestor, err = workloadattest.NewAttestor(s.log, s.cfg.Attestors)
+	if err != nil {
+		return trace.Wrap(err, "setting up workload attestation")
+	}
+
+	return nil
+}
+
+func (s *WorkloadAPIService) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/Run")
+	defer span.End()
+
+	s.log.DebugContext(ctx, "Starting pre-run initialization")
+	if err := s.setup(ctx); err != nil {
+		return trace.Wrap(err)
+	}
+	defer s.client.Close()
+	s.log.DebugContext(ctx, "Completed pre-run initialization")
+
+	srvMetrics := grpcmetrics.CreateGRPCServerMetrics(
+		true, prometheus.Labels{
+			teleport.TagServer: "tbot-spiffe-workload-api",
+		},
+	)
+	if err := metrics.RegisterPrometheusCollectors(srvMetrics); err != nil {
+		return trace.Wrap(err)
+	}
+	srv := grpc.NewServer(
+		grpc.Creds(
+			// SPEC (SPIFFE_Workload_endpoint) 3. Transport:
+			// - Transport Layer Security MUST NOT be required
+			// TODO(noah): We should optionally provide TLS support here down
+			// the road.
+			uds.NewTransportCredentials(insecure.NewCredentials()),
+		),
+		grpc.ChainUnaryInterceptor(
+			recovery.UnaryServerInterceptor(),
+			srvMetrics.UnaryServerInterceptor(),
+		),
+		grpc.ChainStreamInterceptor(
+			recovery.StreamServerInterceptor(),
+			srvMetrics.StreamServerInterceptor(),
+		),
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
+		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
+	)
+	workloadpb.RegisterSpiffeWorkloadAPIServer(srv, s)
+	sdsHandler, err := sds.NewHandler(sds.HandlerConfig{
+		Logger:           s.log,
+		RenewalInterval:  s.defaultCredentialLifetime.RenewalInterval,
+		TrustBundleCache: s.trustBundleCache,
+		ClientAuthenticator: func(ctx context.Context) (*slog.Logger, sds.SVIDFetcher, error) {
+			log, attrs, err := s.authenticateClient(ctx)
+			if err != nil {
+				return log, nil, trace.Wrap(err, "authenticating client")
+			}
+			fetchSVIDs := func(
+				ctx context.Context,
+				localBundle *spiffebundle.Bundle,
+			) ([]*workloadpb.X509SVID, error) {
+				return s.fetchX509SVIDs(
+					ctx,
+					log,
+					localBundle,
+					filterSVIDRequests(ctx, log, s.cfg.SVIDs, attrs),
+				)
+			}
+			return log, fetchSVIDs, nil
+		},
+	})
+	if err != nil {
+		return trace.Wrap(err, "creating SDS handler")
+	}
+	secretv3pb.RegisterSecretDiscoveryServiceServer(srv, sdsHandler)
+
+	lis, err := internal.CreateListener(ctx, s.log, s.cfg.Listen)
+	if err != nil {
+		return trace.Wrap(err, "creating listener")
+	}
+	defer func() {
+		if err := lis.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Encountered error closing listener", "error", err)
+		}
+	}()
+	s.log.InfoContext(ctx, "Listener opened for Workload API endpoint", "addr", lis.Addr().String())
+	if lis.Addr().Network() == "tcp" {
+		s.log.WarnContext(
+			ctx, "Workload API endpoint listening on a TCP port. Ensure that only intended hosts can reach this port!",
+		)
+	}
+
+	// Set off the long running tasks in an errgroup
+	eg, egCtx := errgroup.WithContext(ctx)
+	eg.Go(func() error {
+		// Start the gRPC server
+		return srv.Serve(lis)
+	})
+	eg.Go(func() error {
+		// Shutdown the server when the context is canceled
+		<-egCtx.Done()
+		s.log.DebugContext(ctx, "Shutting down Workload API endpoint")
+		srv.Stop()
+		s.log.InfoContext(ctx, "Shut down Workload API endpoint")
+		return nil
+	})
+
+	s.statusReporter.Report(readyz.Healthy)
+	if err := eg.Wait(); err != nil {
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return trace.Wrap(eg.Wait())
+	}
+	return nil
+}
+
+// serialString returns a human-readable colon-separated string of the serial
+// number in hex.
+func serialString(serial *big.Int) string {
+	hex := serial.Text(16)
+	if len(hex)%2 == 1 {
+		hex = "0" + hex
+	}
+
+	out := strings.Builder{}
+	for i := 0; i < len(hex); i += 2 {
+		if i != 0 {
+			out.WriteString(":")
+		}
+		out.WriteString(hex[i : i+2])
+	}
+	return out.String()
+}
+
+// fetchX509SVIDs fetches the X.509 SVIDs for the bot's configured SVIDs and
+// returns them in the SPIFFE Workload API format.
+func (s *WorkloadAPIService) fetchX509SVIDs(
+	ctx context.Context,
+	log *slog.Logger,
+	localBundle *spiffebundle.Bundle,
+	svidRequests []SVIDRequest,
+) ([]*workloadpb.X509SVID, error) {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/fetchX509SVIDs")
+	defer span.End()
+
+	// TODO(noah): We should probably take inspiration from SPIRE agent's
+	// behavior of pre-fetching the SVIDs rather than doing this for
+	// every request.
+	res, privateKey, err := generateSVID(
+		ctx,
+		s.client,
+		svidRequests,
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Convert the private key to PKCS#8 format as per SPIFFE spec.
+	pkcs8PrivateKey, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	marshaledBundle := workloadidentity.MarshalX509Bundle(localBundle.X509Bundle())
+
+	// Convert responses from the Teleport API to the SPIFFE Workload API
+	// format.
+	svids := make([]*workloadpb.X509SVID, len(res.Svids))
+	for i, svidRes := range res.Svids {
+		svids[i] = &workloadpb.X509SVID{
+			// Required. The SPIFFE ID of the SVID in this entry
+			SpiffeId: svidRes.SpiffeId,
+			// Required. ASN.1 DER encoded certificate chain. MAY include
+			// intermediates, the leaf certificate (or SVID itself) MUST come first.
+			X509Svid: svidRes.Certificate,
+			// Required. ASN.1 DER encoded PKCS#8 private key. MUST be unencrypted.
+			X509SvidKey: pkcs8PrivateKey,
+			// Required. ASN.1 DER encoded X.509 bundle for the trust domain.
+			Bundle: marshaledBundle,
+			Hint:   svidRes.Hint,
+		}
+		cert, err := x509.ParseCertificate(svidRes.Certificate)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing issued svid received from server")
+		}
+		// Log a message which correlates with the audit log entry and can
+		// provide additional metadata about the client.
+		log.InfoContext(ctx,
+			"Issued SVID for workload",
+			slog.Group("svid",
+				"type", "x509",
+				"spiffe_id", svidRes.SpiffeId,
+				"serial_number", serialString(cert.SerialNumber),
+				"hint", svidRes.Hint,
+				"not_after", cert.NotAfter,
+				"not_before", cert.NotBefore,
+				"dns_sans", cert.DNSNames,
+				"ip_sans", cert.IPAddresses,
+			),
+		)
+	}
+
+	return svids, nil
+}
+
+// filterSVIDRequests filters the SVID requests based on the workload
+// attestation.
+//
+// TODO(noah): In a future PR, we need to totally refactor this to a more
+// flexible rules engine otherwise this is going to get absurdly large as
+// we add more types. Ideally, something that would be compatible with a
+// predicate language would be great.
+func filterSVIDRequests(
+	ctx context.Context,
+	log *slog.Logger,
+	svidRequests []SVIDRequestWithRules,
+	att *attrs.WorkloadAttrs,
+) []SVIDRequest {
+	var filtered []SVIDRequest
+	for _, req := range svidRequests {
+		log := log.With("svid", req.SVIDRequest)
+		// If no rules are configured, default to allow.
+		if len(req.Rules) == 0 {
+			log.DebugContext(
+				ctx,
+				"No rules configured for SVID. SVID will be issued",
+			)
+			filtered = append(filtered, req.SVIDRequest)
+			continue
+		}
+
+		// Otherwise, evaluate all the rules, looking for one matching rule.
+		match := false
+		for _, rule := range req.Rules {
+			log := log.With("rule", rule)
+			logMismatch := func(field string, want any, got any) {
+				log.DebugContext(
+					ctx,
+					"Rule did not match workload attestation",
+					"field", field,
+					"want", want,
+					"got", got,
+				)
+			}
+			logNotAttested := func(requiredAttestor string) {
+				log.DebugContext(
+					ctx,
+					"Workload did not complete attestation required for this rule",
+					"required_attestor", requiredAttestor,
+				)
+			}
+			log.DebugContext(
+				ctx,
+				"Evaluating rule against workload attestation",
+			)
+			if rule.Unix.UID != nil {
+				if !att.GetUnix().GetAttested() {
+					logNotAttested("unix")
+					continue
+				}
+				if *rule.Unix.UID != int(att.GetUnix().GetUid()) {
+					logMismatch("unix.uid", *rule.Unix.UID, att.GetUnix().GetUid())
+					continue
+				}
+				// Rule field matched!
+			}
+			if rule.Unix.PID != nil {
+				if !att.GetUnix().GetAttested() {
+					logNotAttested("unix")
+					continue
+				}
+				if *rule.Unix.PID != int(att.GetUnix().GetPid()) {
+					logMismatch("unix.pid", *rule.Unix.PID, att.GetUnix().GetPid())
+					continue
+				}
+				// Rule field matched!
+			}
+			if rule.Unix.GID != nil {
+				if !att.GetUnix().GetAttested() {
+					logNotAttested("unix")
+					continue
+				}
+				if *rule.Unix.GID != int(att.GetUnix().GetGid()) {
+					logMismatch("unix.gid", *rule.Unix.GID, att.GetUnix().GetGid())
+					continue
+				}
+				// Rule field matched!
+			}
+			if rule.Kubernetes.Namespace != "" {
+				if !att.GetKubernetes().GetAttested() {
+					logNotAttested("kubernetes")
+					continue
+				}
+				if rule.Kubernetes.Namespace != att.GetKubernetes().GetNamespace() {
+					logMismatch("kubernetes.namespace", rule.Kubernetes.Namespace, att.GetKubernetes().GetNamespace())
+					continue
+				}
+				// Rule field matched!
+			}
+			if rule.Kubernetes.PodName != "" {
+				if !att.GetKubernetes().GetAttested() {
+					logNotAttested("kubernetes")
+					continue
+				}
+				if rule.Kubernetes.PodName != att.GetKubernetes().GetPodName() {
+					logMismatch("kubernetes.pod_name", rule.Kubernetes.PodName, att.GetKubernetes().GetPodName())
+					continue
+				}
+				// Rule field matched!
+			}
+			if rule.Kubernetes.ServiceAccount != "" {
+				if !att.GetKubernetes().GetAttested() {
+					logNotAttested("kubernetes")
+					continue
+				}
+				if rule.Kubernetes.ServiceAccount != att.GetKubernetes().GetServiceAccount() {
+					logMismatch("kubernetes.service_account", rule.Kubernetes.ServiceAccount, att.GetKubernetes().GetServiceAccount())
+					continue
+				}
+				// Rule field matched!
+			}
+
+			log.DebugContext(
+				ctx,
+				"Rule matched workload attestation. SVID will be issued",
+			)
+			match = true
+			filtered = append(filtered, req.SVIDRequest)
+			break
+		}
+		if !match {
+			log.DebugContext(
+				ctx,
+				"No rules matched workload attestation. SVID will not be issued",
+			)
+		}
+	}
+	return filtered
+}
+
+func (s *WorkloadAPIService) authenticateClient(
+	ctx context.Context,
+) (*slog.Logger, *attrs.WorkloadAttrs, error) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return nil, nil, trace.BadParameter("peer not found in context")
+	}
+	log := s.log
+
+	if p.Addr.String() != "" {
+		log = log.With(
+			slog.String("remote_addr", p.Addr.String()),
+		)
+	}
+
+	authInfo, ok := p.AuthInfo.(uds.AuthInfo)
+	// We expect Creds to be nil/unset if the client is connecting via TCP and
+	// therefore there is no workload attestation that can be completed.
+	if !ok || authInfo.Creds == nil {
+		return log, nil, nil
+	}
+
+	// For a UDS, sometimes we are unable to determine the PID of the calling
+	// workload. This can happen if the caller is calling from another process
+	// namespace. In this case, Creds will be non-nil but the PID will be 0.
+	//
+	// We should fail softly here as there could be SVIDs that do not require
+	// workload attestation.
+	if authInfo.Creds.PID == 0 {
+		log.DebugContext(
+			ctx, "Failed to determine the PID of the calling workload. TBot may be running in a different process namespace to the workload. Workload attestation will not be completed.")
+		return log, nil, nil
+	}
+
+	att, err := s.attestor.Attest(ctx, authInfo.Creds.PID)
+	if err != nil {
+		// Fail softly as there may be SVIDs configured that don't require any
+		// workload attestation and we should still issue those.
+		log.ErrorContext(
+			ctx,
+			"Workload attestation failed",
+			"error", err,
+			"pid", authInfo.Creds.PID,
+		)
+		return log, nil, nil
+	}
+	log = log.With("workload", att)
+
+	return log, att, nil
+}
+
+// FetchX509SVID generates and returns the X.509 SVIDs available to a workload.
+// It is a streaming RPC, and sends renewed SVIDs to the client before they
+// expire.
+// Implements the SPIFFE Workload API FetchX509SVID method.
+func (s *WorkloadAPIService) FetchX509SVID(
+	_ *workloadpb.X509SVIDRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchX509SVIDServer,
+) error {
+	ctx := srv.Context()
+
+	log, creds, err := s.authenticateClient(ctx)
+	if err != nil {
+		return trace.Wrap(err, "authenticating client")
+	}
+
+	log.InfoContext(ctx, "FetchX509SVID stream opened by workload")
+	defer log.InfoContext(ctx, "FetchX509SVID stream has closed")
+
+	// Before we issue the SVIDs to the workload, we need to complete workload
+	// attestation and determine which SVIDs to issue.
+	svidReqs := filterSVIDRequests(ctx, log, s.cfg.SVIDs, creds)
+
+	// The SPIFFE Workload API (5.2.1):
+	//
+	//   If the client is not entitled to receive any X509-SVIDs, then the
+	//   server SHOULD respond with the "PermissionDenied" gRPC status code (see
+	//   the Error Codes section in the SPIFFE Workload Endpoint specification
+	//   for more information). Under such a case, the client MAY attempt to
+	//   reconnect with another call to the FetchX509SVID RPC after a backoff.
+	if len(svidReqs) == 0 {
+		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
+		s.attestor.Failed(ctx, creds)
+		return status.Error(
+			codes.PermissionDenied,
+			"workload did not pass attestation for any SVIDs",
+		)
+	}
+
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var svids []*workloadpb.X509SVID
+	for {
+		log.InfoContext(ctx, "Starting to issue X509 SVIDs to workload")
+
+		// Fetch SVIDs if necessary.
+		if svids == nil {
+			svids, err = s.fetchX509SVIDs(ctx, log, bundleSet.Local, svidReqs)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		err = srv.Send(&workloadpb.X509SVIDResponse{
+			Svids:            svids,
+			FederatedBundles: bundleSet.EncodedX509Bundles(false),
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		log.DebugContext(
+			ctx, "Finished issuing SVIDs to workload. Waiting for next renewal interval or CA rotation",
+		)
+
+		select {
+		case <-ctx.Done():
+			log.DebugContext(ctx, "Context closed, stopping SVID stream")
+			return nil
+		case <-bundleSet.Stale():
+			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			log.DebugContext(ctx, "Federated trust bundles have been updated, renewing SVIDs")
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the "local" trust domain's CA has changed, we need to
+				// reissue the SVIDs.
+				svids = nil
+			}
+			bundleSet = newBundleSet
+			continue
+		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval):
+			log.DebugContext(ctx, "Renewal interval reached, renewing SVIDs")
+			svids = nil
+			continue
+		}
+	}
+}
+
+// FetchX509Bundles returns the trust bundle for the trust domain. It is a
+// streaming RPC, and will send rotated trust bundles to the client for as long
+// as the client is connected.
+// Implements the SPIFFE Workload API FetchX509SVID method.
+func (s *WorkloadAPIService) FetchX509Bundles(
+	_ *workloadpb.X509BundlesRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchX509BundlesServer,
+) error {
+	ctx := srv.Context()
+	s.log.InfoContext(ctx, "FetchX509Bundles stream opened by workload")
+	defer s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
+
+	for {
+		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		s.log.InfoContext(ctx, "Sending X.509 trust bundles to workload")
+		err = srv.Send(&workloadpb.X509BundlesResponse{
+			Bundles: bundleSet.EncodedX509Bundles(true),
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-bundleSet.Stale():
+		}
+	}
+}
+
+const defaultJWTSVIDTTL = time.Minute * 5
+
+// FetchJWTSVID implements the SPIFFE Workload API FetchJWTSVID method.
+// See The SPIFFE Workload API (6.2.1).
+func (s *WorkloadAPIService) FetchJWTSVID(
+	ctx context.Context,
+	req *workloadpb.JWTSVIDRequest,
+) (*workloadpb.JWTSVIDResponse, error) {
+	log, creds, err := s.authenticateClient(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "authenticating client")
+	}
+
+	log.InfoContext(ctx, "FetchJWTSVID request received from workload")
+	defer log.InfoContext(ctx, "FetchJWTSVID request handled")
+	if req.SpiffeId == "" {
+		log = log.With("requested_spiffe_id", req.SpiffeId)
+	}
+
+	// The SPIFFE Workload API (6.2.1):
+	// > The JWTSVIDRequest request message contains a mandatory audience field,
+	// > which MUST contain the value to embed in the audience claim of the
+	// > returned JWT-SVIDs.
+	if len(req.Audience) == 0 {
+		return nil, trace.BadParameter("audience: must have at least one value")
+	}
+
+	svidReqs := filterSVIDRequests(ctx, log, s.cfg.SVIDs, creds)
+	// The SPIFFE Workload API (6.2.1):
+	// > If the client is not authorized for any identities, or not authorized
+	// > for the specific identity requested via the spiffe_id field, then the
+	// > server SHOULD respond with the "PermissionDenied" gRPC status code.
+	if len(svidReqs) == 0 {
+		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
+		s.attestor.Failed(ctx, creds)
+		return nil, status.Error(
+			codes.PermissionDenied,
+			"workload did not pass attestation for any SVIDs",
+		)
+	}
+
+	// The SPIFFE Workload API (6.2.1):
+	// > The spiffe_id field is optional, and is used to request a JWT-SVID for
+	// > a specific SPIFFE ID. If unspecified, the server MUST return JWT-SVIDs
+	// > for all identities authorized for the client.
+	if req.SpiffeId != "" {
+		requestedSPIFFEID, err := spiffeid.FromString(req.SpiffeId)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing requested SPIFFE ID")
+		}
+		if requestedSPIFFEID.TrustDomain() != s.localTrustDomain {
+			return nil, trace.BadParameter("requested SPIFFE ID is not in the local trust domain")
+		}
+		// Search through available SVIDs to find the one that matches the
+		// requested SPIFFE ID.
+		found := false
+		for _, svidReq := range svidReqs {
+			spiffeID, err := spiffeid.FromPath(s.localTrustDomain, svidReq.Path)
+			if err != nil {
+				return nil, trace.Wrap(err, "parsing SPIFFE ID from path %q", svidReq.Path)
+			}
+			if spiffeID.String() == req.SpiffeId {
+				found = true
+				svidReqs = []SVIDRequest{svidReq}
+				break
+			}
+		}
+		if !found {
+			log.ErrorContext(ctx, "Workload is not authorized for the specifically requested SPIFFE ID", "requested_spiffe_id", req.SpiffeId)
+			return nil, status.Error(
+				codes.PermissionDenied,
+				"workload is not authorized for requested SPIFFE ID",
+			)
+		}
+	}
+
+	// Allow users to manually override the TTL for JWT-SVIDs produced by this
+	// service.
+	ttl := cmp.Or(s.cfg.JWTSVIDTTL, defaultJWTSVIDTTL)
+
+	reqs := make([]*machineidv1pb.JWTSVIDRequest, 0, len(svidReqs))
+	for _, svidReq := range svidReqs {
+		reqs = append(reqs, &machineidv1pb.JWTSVIDRequest{
+			SpiffeIdPath: svidReq.Path,
+			Audiences:    req.Audience,
+			Ttl:          durationpb.New(ttl),
+			Hint:         svidReq.Hint,
+		})
+	}
+
+	res, err := s.client.WorkloadIdentityServiceClient().SignJWTSVIDs(ctx, &machineidv1pb.SignJWTSVIDsRequest{
+		Svids: reqs,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "requesting signed JWT-SVIDs from Teleport")
+	}
+
+	out := &workloadpb.JWTSVIDResponse{}
+	for _, resSVID := range res.Svids {
+		out.Svids = append(out.Svids, &workloadpb.JWTSVID{
+			SpiffeId: resSVID.SpiffeId,
+			Svid:     resSVID.Jwt,
+			Hint:     resSVID.Hint,
+		})
+		log.InfoContext(ctx,
+			"Issued SVID for workload",
+			slog.Group("svid",
+				"type", "jwt",
+				"spiffe_id", resSVID.SpiffeId,
+				"jti", resSVID.Jti,
+				"hint", resSVID.Hint,
+				"audiences", resSVID.Audiences,
+			),
+		)
+	}
+
+	return out, nil
+}
+
+// FetchJWTBundles implements the SPIFFE Workload API FetchJWTBundles method.
+// See The SPIFFE Workload API (6.2.2).
+func (s *WorkloadAPIService) FetchJWTBundles(
+	_ *workloadpb.JWTBundlesRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchJWTBundlesServer,
+) error {
+	ctx := srv.Context()
+	s.log.InfoContext(ctx, "FetchJWTBundles stream started by workload")
+	defer s.log.InfoContext(ctx, "FetchJWTBundles stream ended")
+
+	for {
+		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		s.log.InfoContext(ctx, "Sending JWT trust bundles to workload")
+
+		// The SPIFFE Workload API (6.2.2):
+		// > The returned bundles are encoded as a standard JWK Set as defined
+		// > by RFC 7517 containing the JWT-SVID signing keys for the trust
+		// > domain. These keys may only represent a subset of the keys present
+		// > in the SPIFFE trust bundle for the trust domain. The server MUST
+		// > NOT include keys with other uses in the returned JWT bundles.
+		bundles, err := bundleSet.MarshaledJWKSBundles(true)
+		if err != nil {
+			return trace.Wrap(err, "marshaling bundles as JWKS")
+		}
+		err = srv.Send(&workloadpb.JWTBundlesResponse{
+			Bundles: bundles,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-bundleSet.Stale():
+		}
+	}
+}
+
+// ValidateJWTSVID implements the SPIFFE Workload API ValidateJWTSVID method.
+// See The SPIFFE Workload API (6.2.3).
+func (s *WorkloadAPIService) ValidateJWTSVID(
+	ctx context.Context,
+	req *workloadpb.ValidateJWTSVIDRequest,
+) (*workloadpb.ValidateJWTSVIDResponse, error) {
+	s.log.InfoContext(ctx, "ValidateJWTSVID request received from workload")
+	defer s.log.InfoContext(ctx, "ValidateJWTSVID request handled")
+
+	// The SPIFFE Workload API (6.2.3):
+	// > All fields in the ValidateJWTSVIDRequest and ValidateJWTSVIDResponse
+	// > message are mandatory.
+	switch {
+	case req.Audience == "":
+		return nil, trace.BadParameter("audience: must be set")
+	case req.Svid == "":
+		return nil, trace.BadParameter("svid: must be set")
+	}
+
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	svid, err := jwtsvid.ParseAndValidate(
+		req.Svid, bundleSet, []string{req.Audience},
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating JWT SVID")
+	}
+
+	claims, err := structpb.NewStruct(svid.Claims)
+	if err != nil {
+		return nil, trace.Wrap(err, "marshaling claims")
+	}
+
+	return &workloadpb.ValidateJWTSVIDResponse{
+		SpiffeId: svid.ID.String(),
+		Claims:   claims,
+	}, nil
+}
+
+// String returns a human-readable string that can uniquely identify the
+// service.
+func (s *WorkloadAPIService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s", WorkloadAPIServiceType, s.cfg.Listen),
+	)
+}
diff --git a/lib/tbot/services/legacyspiffe/workload_api_config.go b/lib/tbot/services/legacyspiffe/workload_api_config.go
new file mode 100644
index 0000000000000..87f7b1b2f2450
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/workload_api_config.go
@@ -0,0 +1,186 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+)
+
+const WorkloadAPIServiceType = "spiffe-workload-api"
+
+// SVIDRequestWithRules is the configuration for a single SVID along with the
+// workload attestation rules that must be passed by a workload for this SVID
+// to be issued to it.
+type SVIDRequestWithRules struct {
+	SVIDRequest `yaml:",inline"`
+	// Rules is a list of workload attestation rules. At least one rule must be
+	// satisfied for the SVID to be issued to a workload.
+	//
+	// If no rules are specified, the SVID will be issued to all workloads that
+	// connect to this listener.
+	Rules []SVIDRequestRule `yaml:"rules,omitempty"`
+}
+
+// SVIDRequestRuleUnix is a workload attestation ruleset for workloads that
+// connect via Unix domain sockets.
+type SVIDRequestRuleUnix struct {
+	// PID is the process ID that a process must have to be issued this SVID.
+	//
+	// If unspecified, the process ID is not checked.
+	PID *int `yaml:"pid,omitempty"`
+	// UID is the user ID that a process must have to be issued this SVID.
+	//
+	// If unspecified, the user ID is not checked.
+	UID *int `yaml:"uid,omitempty"`
+	// GID is the primary group ID that a process must have to be issued this
+	// SVID.
+	//
+	// If unspecified, the primary group ID is not checked.
+	GID *int `yaml:"gid,omitempty"`
+}
+
+// SVIDRequestRuleKubernetes is a workload attestation ruleset for workloads
+// that connect via Unix domain sockets and are running in a Kubernetes pod.
+//
+// Requires the "kubernetes" attestor to be enabled.
+//
+// Fields should be a subset of workloadattest.KubernetesAttestation.
+type SVIDRequestRuleKubernetes struct {
+	// Namespace is the Kubernetes namespace that a workload must be running in
+	// to be issued this SVID.
+	// If unspecified, the namespace is not checked.
+	Namespace string `yaml:"namespace,omitempty"`
+	// ServiceAccount is the Kubernetes service account that a workload must be
+	// running as to be issued this SVID.
+	// If unspecified, the service account is not checked.
+	ServiceAccount string `yaml:"service_account,omitempty"`
+	// PodName is the Kubernetes pod name that a workload must be running in to
+	// be issued this SVID.
+	// If unspecified, the pod name is not checked.
+	PodName string `yaml:"pod_name,omitempty"`
+}
+
+// SVIDRequestRule is an individual workload attestation rule. All values
+// specified within the rule must be satisfied for the rule itself to pass.
+type SVIDRequestRule struct {
+	// Unix is the workload attestation ruleset for workloads that connect via
+	// Unix domain sockets. If any value here is set, the rule will not pass
+	// unless the workload is connecting via a Unix domain socket.
+	Unix SVIDRequestRuleUnix `yaml:"unix"`
+	// Kubernetes is the workload attestation ruleset for workloads that connect
+	// via the Unix domain socket and are running in a Kubernetes pod.
+	// The "kubernetes" attestor must be enabled or these rules will fail.
+	Kubernetes SVIDRequestRuleKubernetes `yaml:"kubernetes"`
+}
+
+func (o SVIDRequestRule) LogValue() slog.Value {
+	var unixAttrs []any
+	if o.Unix.PID != nil {
+		unixAttrs = append(unixAttrs, slog.Int("pid", *o.Unix.PID))
+	}
+	if o.Unix.GID != nil {
+		unixAttrs = append(unixAttrs, slog.Int("gid", *o.Unix.GID))
+	}
+	if o.Unix.UID != nil {
+		unixAttrs = append(unixAttrs, slog.Int("uid", *o.Unix.UID))
+	}
+	return slog.GroupValue(
+		slog.Group("unix", unixAttrs...),
+	)
+}
+
+// WorkloadAPIConfig is the configuration for the SPIFFE Workload API service.
+type WorkloadAPIConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Listen is the address on which the SPIFFE Workload API server should
+	// listen. This should either be prefixed with "unix://" or "tcp://".
+	Listen string `yaml:"listen"`
+	// SVIDs is the list of SVIDs that the SPIFFE Workload API server should
+	// provide.
+	SVIDs []SVIDRequestWithRules `yaml:"svids"`
+	// Attestors is the configuration for the workload attestation process.
+	Attestors workloadattest.Config `yaml:"attestors"`
+	// JWTSVIDTTL specifies how long that JWT SVIDs issued by this SPIFFE
+	// Workload API server are valid for. If unspecified, this falls back to
+	// the globally configured default.
+	JWTSVIDTTL time.Duration `yaml:"jwt_svid_ttl,omitempty"`
+
+	// CredentialLifetime contains configuration for how long X.509 SVIDs will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *WorkloadAPIConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *WorkloadAPIConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (s *WorkloadAPIConfig) Type() string {
+	return WorkloadAPIServiceType
+}
+
+func (s *WorkloadAPIConfig) MarshalYAML() (any, error) {
+	type raw WorkloadAPIConfig
+	return encoding.WithTypeHeader((*raw)(s), WorkloadAPIServiceType)
+}
+
+func (s *WorkloadAPIConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw WorkloadAPIConfig
+	if err := node.Decode((*raw)(s)); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *WorkloadAPIConfig) CheckAndSetDefaults() error {
+	if s.Listen == "" {
+		return trace.BadParameter("listen: should not be empty")
+	}
+	if len(s.SVIDs) == 0 {
+		return trace.BadParameter("svids: should not be empty")
+	}
+	for i, svid := range s.SVIDs {
+		if err := svid.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err, "validating svid[%d]", i)
+		}
+	}
+	if err := s.Attestors.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating attestor")
+	}
+	return nil
+}
+
+func (o *WorkloadAPIConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/legacyspiffe/workload_api_config_test.go b/lib/tbot/services/legacyspiffe/workload_api_config_test.go
new file mode 100644
index 0000000000000..a6d6bccc1347f
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/workload_api_config_test.go
@@ -0,0 +1,240 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+)
+
+func ptr[T any](v T) *T {
+	return &v
+}
+
+func TestSPIFFEWorkloadAPIService_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[WorkloadAPIConfig]{
+		{
+			name: "full",
+			in: WorkloadAPIConfig{
+				Listen:     "unix:///var/run/spiffe.sock",
+				JWTSVIDTTL: time.Minute * 5,
+				Attestors: workloadattest.Config{
+					Kubernetes: workloadattest.KubernetesAttestorConfig{
+						Enabled: true,
+						Kubelet: workloadattest.KubeletClientConfig{
+							SecurePort: 12345,
+							TokenPath:  "/path/to/token",
+							CAPath:     "/path/to/ca.pem",
+							SkipVerify: true,
+							Anonymous:  true,
+						},
+					},
+				},
+				SVIDs: []SVIDRequestWithRules{
+					{
+						SVIDRequest: SVIDRequest{
+							Path: "/foo",
+							Hint: "hint",
+							SANS: SVIDRequestSANs{
+								DNS: []string{"example.com"},
+								IP:  []string{"10.0.0.1", "10.42.0.1"},
+							},
+						},
+						Rules: []SVIDRequestRule{
+							{
+								Unix: SVIDRequestRuleUnix{
+									PID: ptr(100),
+									UID: ptr(1000),
+									GID: ptr(1234),
+								},
+							},
+							{
+								Unix: SVIDRequestRuleUnix{
+									PID: ptr(100),
+								},
+								Kubernetes: SVIDRequestRuleKubernetes{
+									Namespace:      "my-namespace",
+									PodName:        "my-pod",
+									ServiceAccount: "service-account",
+								},
+							},
+						},
+					},
+				},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: WorkloadAPIConfig{
+				Listen: "unix:///var/run/spiffe.sock",
+				SVIDs: []SVIDRequestWithRules{
+					{
+						SVIDRequest: SVIDRequest{
+							Path: "/foo",
+						},
+					},
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestSPIFFEWorkloadAPIService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*WorkloadAPIConfig]{
+		{
+			name: "valid",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					JWTSVIDTTL: time.Minute,
+					Listen:     "unix:///var/run/spiffe.sock",
+					SVIDs: []SVIDRequestWithRules{
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1", "10.42.0.1"},
+								},
+							},
+						},
+					},
+				}
+			},
+			want: &WorkloadAPIConfig{
+				JWTSVIDTTL: time.Minute,
+				Listen:     "unix:///var/run/spiffe.sock",
+				SVIDs: []SVIDRequestWithRules{
+					{
+						SVIDRequest: SVIDRequest{
+							Path: "/foo",
+							Hint: "hint",
+							SANS: SVIDRequestSANs{
+								DNS: []string{"example.com"},
+								IP:  []string{"10.0.0.1", "10.42.0.1"},
+							},
+						},
+					},
+				},
+				Attestors: workloadattest.Config{
+					Unix: workloadattest.UnixAttestorConfig{
+						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
+					},
+				},
+			},
+		},
+		{
+			name: "missing path",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Listen: "unix:///var/run/spiffe.sock",
+					SVIDs: []SVIDRequestWithRules{
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1", "10.42.0.1"},
+								},
+							},
+						},
+					},
+				}
+			},
+			wantErr: "svid.path: should not be empty",
+		},
+		{
+			name: "path missing leading slash",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Listen: "unix:///var/run/spiffe.sock",
+					SVIDs: []SVIDRequestWithRules{
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1", "10.42.0.1"},
+								},
+							},
+						},
+					},
+				}
+			},
+			wantErr: "svid.path: should be prefixed with /",
+		},
+		{
+			name: "missing listen addr",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Listen: "",
+					SVIDs: []SVIDRequestWithRules{
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1", "10.42.0.1"},
+								},
+							},
+						},
+					},
+				}
+			},
+			wantErr: "listen: should not be empty",
+		},
+		{
+			name: "invalid ip",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Listen: "unix:///var/run/spiffe.sock",
+					SVIDs: []SVIDRequestWithRules{
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"invalid ip"},
+								},
+							},
+						},
+					},
+				}
+			},
+			wantErr: "ip_sans[0]: invalid IP address",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/legacyspiffe/workload_api_test.go b/lib/tbot/services/legacyspiffe/workload_api_test.go
new file mode 100644
index 0000000000000..39d3327794a32
--- /dev/null
+++ b/lib/tbot/services/legacyspiffe/workload_api_test.go
@@ -0,0 +1,899 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package legacyspiffe
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"net"
+	"os"
+	"path"
+	"sync"
+	"testing"
+	"time"
+
+	tlsv3pb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	discoveryv3pb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	gocmp "github.com/google/go-cmp/cmp"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/types/known/anypb"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	libtestutils "github.com/gravitational/teleport/lib/utils/testutils"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestFilterSVIDRequests(t *testing.T) {
+	// This test is more for overall behavior. Use the _field test for
+	// each individual field.
+	ctx := context.Background()
+	log := logtest.NewLogger()
+	tests := []struct {
+		name string
+		att  *workloadidentityv1pb.WorkloadAttrs
+		in   []SVIDRequestWithRules
+		want []SVIDRequest
+	}{
+		{
+			name: "no rules",
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/bar",
+					},
+				},
+			},
+			want: []SVIDRequest{
+				{
+					Path: "/foo",
+				},
+				{
+					Path: "/bar",
+				},
+			},
+		},
+		{
+			name: "no rules with attestation",
+			att: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Uid:      1000,
+					Gid:      1001,
+					Pid:      1002,
+				},
+			},
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/bar",
+					},
+				},
+			},
+			want: []SVIDRequest{
+				{
+					Path: "/foo",
+				},
+				{
+					Path: "/bar",
+				},
+			},
+		},
+		{
+			name: "no rules with attestation",
+			att: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					// We don't expect that workloadattest will ever return
+					// Attested: false and include UID/PID/GID but we want to
+					// ensure we handle this by failing regardless.
+					Attested: false,
+					Uid:      1000,
+					Gid:      1001,
+					Pid:      1002,
+				},
+			},
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1000),
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "no matching rules with attestation",
+			att: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Uid:      1000,
+					Gid:      1001,
+					Pid:      1002,
+				},
+			},
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1000),
+								PID: ptr(1),
+							},
+						},
+						{
+							Unix: SVIDRequestRuleUnix{
+								GID: ptr(1),
+							},
+						},
+					},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/bar",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1),
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "no matching rules without attestation",
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								PID: ptr(1),
+							},
+						},
+						{
+							Unix: SVIDRequestRuleUnix{
+								GID: ptr(1),
+							},
+						},
+					},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/bar",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1),
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "some matching rules with uds",
+			att: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Uid:      1000,
+					Gid:      1001,
+					Pid:      1002,
+				},
+			},
+			in: []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/fizz",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1),
+							},
+						},
+					},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+					Rules: []SVIDRequestRule{},
+				},
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/bar",
+					},
+					Rules: []SVIDRequestRule{
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1000),
+								GID: ptr(1500),
+							},
+						},
+						{
+							Unix: SVIDRequestRuleUnix{
+								UID: ptr(1000),
+								PID: ptr(1002),
+							},
+						},
+					},
+				},
+			},
+			want: []SVIDRequest{
+				{
+					Path: "/foo",
+				},
+				{
+					Path: "/bar",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := filterSVIDRequests(ctx, log, tt.in, attrs.FromWorkloadAttrs(tt.att))
+			assert.Empty(t, gocmp.Diff(tt.want, got))
+		})
+	}
+}
+
+func TestFilterSVIDRequests_field(t *testing.T) {
+	ctx := context.Background()
+	log := logtest.NewLogger()
+	tests := []struct {
+		field       string
+		matching    *workloadidentityv1pb.WorkloadAttrs
+		nonMatching *workloadidentityv1pb.WorkloadAttrs
+		rule        SVIDRequestRule
+	}{
+		{
+			field: "unix.pid",
+			rule: SVIDRequestRule{
+				Unix: SVIDRequestRuleUnix{
+					PID: ptr(1000),
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Pid:      1000,
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Pid:      200,
+				},
+			},
+		},
+		{
+			field: "unix.uid",
+			rule: SVIDRequestRule{
+				Unix: SVIDRequestRuleUnix{
+					UID: ptr(1000),
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Uid:      1000,
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Uid:      200,
+				},
+			},
+		},
+		{
+			field: "unix.gid",
+			rule: SVIDRequestRule{
+				Unix: SVIDRequestRuleUnix{
+					GID: ptr(1000),
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Gid:      1000,
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+					Attested: true,
+					Gid:      200,
+				},
+			},
+		},
+		{
+			field: "unix.namespace",
+			rule: SVIDRequestRule{
+				Kubernetes: SVIDRequestRuleKubernetes{
+					Namespace: "foo",
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested:  true,
+					Namespace: "foo",
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested:  true,
+					Namespace: "bar",
+				},
+			},
+		},
+		{
+			field: "kubernetes.service_account",
+			rule: SVIDRequestRule{
+				Kubernetes: SVIDRequestRuleKubernetes{
+					ServiceAccount: "foo",
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested:       true,
+					ServiceAccount: "foo",
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested:       true,
+					ServiceAccount: "bar",
+				},
+			},
+		},
+		{
+			field: "kubernetes.pod_name",
+			rule: SVIDRequestRule{
+				Kubernetes: SVIDRequestRuleKubernetes{
+					PodName: "foo",
+				},
+			},
+			matching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested: true,
+					PodName:  "foo",
+				},
+			},
+			nonMatching: &workloadidentityv1pb.WorkloadAttrs{
+				Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+					Attested: true,
+					PodName:  "bar",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.field, func(t *testing.T) {
+			rules := []SVIDRequestWithRules{
+				{
+					SVIDRequest: SVIDRequest{
+						Path: "/foo",
+					},
+					Rules: []SVIDRequestRule{tt.rule},
+				},
+			}
+			t.Run("matching", func(t *testing.T) {
+				assert.Len(t, filterSVIDRequests(ctx, log, rules, attrs.FromWorkloadAttrs(tt.matching)), 1)
+			})
+			t.Run("non-matching", func(t *testing.T) {
+				assert.Empty(t, filterSVIDRequests(ctx, log, rules, attrs.FromWorkloadAttrs(tt.nonMatching)))
+			})
+		})
+	}
+}
+
+// TestBotSPIFFEWorkloadAPI is an end-to-end test of Workload ID's ability to
+// issue a SPIFFE SVID to a workload connecting via the SPIFFE Workload API.
+func TestBotSPIFFEWorkloadAPI(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	// Make a new auth server.
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+	// Create a role that allows the bot to issue a SPIFFE SVID.
+	role, err := types.NewRole("spiffe-issuer", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			SPIFFE: []*types.SPIFFERoleCondition{
+				{
+					Path: "/*",
+					DNSSANs: []string{
+						"*",
+					},
+					IPSANs: []string{
+						"0.0.0.0/0",
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	pid := os.Getpid()
+
+	tempDir := t.TempDir()
+	socketPath := "unix://" + path.Join(tempDir, "spiffe.sock")
+
+	proxyAddr, err := process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	connCfg := connection.Config{
+		Address:     proxyAddr.Addr,
+		AddressKind: connection.AddressKindProxy,
+		Insecure:    true,
+	}
+
+	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
+
+	trustBundleCache := workloadidentity.NewTrustBundleCacheFacade()
+
+	b, err := bot.New(bot.Config{
+		Connection:      connCfg,
+		Logger:          log,
+		Onboarding:      *onboarding,
+		InternalStorage: destination.NewMemory(),
+		Services: []bot.ServiceBuilder{
+			trustBundleCache.Builder(),
+			WorkloadAPIServiceBuilder(
+				&WorkloadAPIConfig{
+					Listen: socketPath,
+					SVIDs: []SVIDRequestWithRules{
+						// Intentionally unmatching PID to ensure this SVID
+						// is not issued.
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/bar",
+							},
+							Rules: []SVIDRequestRule{
+								{
+									Unix: SVIDRequestRuleUnix{
+										PID: ptr(0),
+									},
+								},
+							},
+						},
+						// SVID with rule that matches on PID.
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1"},
+								},
+							},
+							Rules: []SVIDRequestRule{
+								{
+									Unix: SVIDRequestRuleUnix{
+										PID: &pid,
+									},
+								},
+							},
+						},
+					},
+					Attestors: workloadattest.Config{
+						Unix: workloadattest.UnixAttestorConfig{
+							BinaryHashMaxSizeBytes: workloadattest.TestBinaryHashMaxBytes,
+						},
+					},
+				},
+				trustBundleCache,
+				bot.DefaultCredentialLifetime,
+			),
+		},
+	})
+	require.NoError(t, err)
+
+	// Spin up goroutine for bot to run in
+	botCtx, cancelBot := context.WithCancel(ctx)
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := b.Run(botCtx)
+		assert.NoError(t, err, "bot should not exit with error")
+		cancelBot()
+	}()
+	t.Cleanup(func() {
+		// Shut down bot and make sure it exits.
+		cancelBot()
+		wg.Wait()
+	})
+
+	t.Run("X509", func(t *testing.T) {
+		t.Parallel()
+
+		// This has a little flexibility internally in terms of waiting for the
+		// socket to come up, so we don't need a manual sleep/retry here.
+		source, err := workloadapi.NewX509Source(
+			ctx,
+			workloadapi.WithClientOptions(workloadapi.WithAddr(socketPath)),
+		)
+		require.NoError(t, err)
+		defer source.Close()
+
+		svid, err := source.GetX509SVID()
+		require.NoError(t, err)
+
+		// SVID has successfully been issued. We can now assert that it's correct.
+		require.Equal(t, "spiffe://root/foo", svid.ID.String())
+		cert := svid.Certificates[0]
+		require.Equal(t, "spiffe://root/foo", cert.URIs[0].String())
+		require.True(t, net.IPv4(10, 0, 0, 1).Equal(cert.IPAddresses[0]))
+		require.Equal(t, []string{"example.com"}, cert.DNSNames)
+		require.WithinRange(
+			t,
+			cert.NotAfter,
+			cert.NotBefore.Add(time.Hour-time.Minute),
+			cert.NotBefore.Add(time.Hour+time.Minute),
+		)
+	})
+
+	t.Run("JWT", func(t *testing.T) {
+		t.Parallel()
+
+		source, err := workloadapi.NewJWTSource(
+			ctx,
+			workloadapi.WithClientOptions(workloadapi.WithAddr(socketPath)),
+		)
+		require.NoError(t, err)
+		defer source.Close()
+
+		validateSVID := func(
+			t *testing.T,
+			svid *jwtsvid.SVID,
+			wantAudience string,
+		) {
+			t.Helper()
+			// First, check the response fields
+			require.Equal(t, "spiffe://root/foo", svid.ID.String())
+			require.Equal(t, "hint", svid.Hint)
+
+			// Validate "locally" that the SVID is correct.
+			validatedSVID, err := jwtsvid.ParseAndValidate(
+				svid.Marshal(),
+				source,
+				[]string{wantAudience},
+			)
+			require.NoError(t, err)
+			require.Equal(t, svid.Claims, validatedSVID.Claims)
+			require.Equal(t, svid.ID, validatedSVID.ID)
+
+			// Validate "remotely" that the SVID is correct using the Workload
+			// API.
+			validatedSVID, err = workloadapi.ValidateJWTSVID(
+				ctx,
+				svid.Marshal(),
+				wantAudience,
+				workloadapi.WithAddr(socketPath),
+			)
+			require.NoError(t, err)
+			require.Equal(t, svid.Claims, validatedSVID.Claims)
+			require.Equal(t, svid.ID, validatedSVID.ID)
+		}
+
+		svids, err := source.FetchJWTSVIDs(ctx, jwtsvid.Params{
+			Audience:       "example.com",
+			ExtraAudiences: []string{"2.example.com"},
+			Subject:        spiffeid.RequireFromString("spiffe://root/foo"),
+		})
+		require.NoError(t, err)
+		require.Len(t, svids, 1)
+		validateSVID(t, svids[0], "2.example.com")
+
+		// Try again with no specified subject (e.g receive all)
+		svids, err = source.FetchJWTSVIDs(ctx, jwtsvid.Params{
+			Audience: "example.com",
+		})
+		require.NoError(t, err)
+		require.Len(t, svids, 1)
+		validateSVID(t, svids[0], "example.com")
+	})
+}
+
+// Test_E2E_SPIFFE_SDS is an end-to-end test of Workload ID's ability
+// to issue a SPIFFE SVID to a workload connecting via the SDS API
+func Test_E2E_SPIFFE_SDS(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test in short mode")
+	}
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	// Make a new auth server.
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+
+	// Create a role that allows the bot to issue a SPIFFE SVID.
+	role, err := types.NewRole("spiffe-issuer", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			SPIFFE: []*types.SPIFFERoleCondition{
+				{
+					Path: "/*",
+					DNSSANs: []string{
+						"*",
+					},
+					IPSANs: []string{
+						"0.0.0.0/0",
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	pid := os.Getpid()
+
+	tempDir := t.TempDir()
+	socketPath := "unix://" + path.Join(tempDir, "sock")
+
+	proxyAddr, err := process.ProxyWebAddr()
+	require.NoError(t, err)
+
+	connCfg := connection.Config{
+		Address:     proxyAddr.Addr,
+		AddressKind: connection.AddressKindProxy,
+		Insecure:    true,
+	}
+
+	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
+
+	// Create a trust bundle cache
+	trustBundleCache := workloadidentity.NewTrustBundleCacheFacade()
+
+	b, err := bot.New(bot.Config{
+		Connection:      connCfg,
+		Logger:          log,
+		Onboarding:      *onboarding,
+		InternalStorage: destination.NewMemory(),
+		Services: []bot.ServiceBuilder{
+			trustBundleCache.Builder(),
+			WorkloadAPIServiceBuilder(
+				&WorkloadAPIConfig{
+					Listen: socketPath,
+					SVIDs: []SVIDRequestWithRules{
+						// Intentionally unmatching PID to ensure this SVID
+						// is not issued.
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/bar",
+							},
+							Rules: []SVIDRequestRule{
+								{
+									Unix: SVIDRequestRuleUnix{
+										PID: ptr(0),
+									},
+								},
+							},
+						},
+						// SVID with rule that matches on PID.
+						{
+							SVIDRequest: SVIDRequest{
+								Path: "/foo",
+								Hint: "hint",
+								SANS: SVIDRequestSANs{
+									DNS: []string{"example.com"},
+									IP:  []string{"10.0.0.1"},
+								},
+							},
+							Rules: []SVIDRequestRule{
+								{
+									Unix: SVIDRequestRuleUnix{
+										PID: &pid,
+									},
+								},
+							},
+						},
+					},
+					Attestors: workloadattest.Config{
+						Unix: workloadattest.UnixAttestorConfig{
+							BinaryHashMaxSizeBytes: workloadattest.TestBinaryHashMaxBytes,
+						},
+					},
+				},
+				trustBundleCache,
+				bot.DefaultCredentialLifetime,
+			),
+		},
+	})
+	require.NoError(t, err)
+
+	// Run bot in the background for the remainder of the test.
+	libtestutils.RunTestBackgroundTask(ctx, t, &libtestutils.TestBackgroundTask{
+		Name: "bot",
+		Task: func(ctx context.Context) error {
+			return b.Run(ctx)
+		},
+	})
+
+	// Wait for the socket to come up.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		_, err := os.Stat(path.Join(tempDir, "sock"))
+		assert.NoError(t, err)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	conn, err := grpc.NewClient(
+		socketPath,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		conn.Close()
+	})
+
+	client := secretv3pb.NewSecretDiscoveryServiceClient(conn)
+	stream, err := client.StreamSecrets(ctx)
+	require.NoError(t, err)
+
+	// Request all secrets.
+	typeUrl := "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
+	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
+		TypeUrl:       typeUrl,
+		ResourceNames: []string{},
+	})
+	require.NoError(t, err)
+
+	resp, err := stream.Recv()
+	require.NoError(t, err)
+	assert.NotEmpty(t, resp.VersionInfo)
+	assert.NotEmpty(t, resp.Nonce)
+	assert.Equal(t, typeUrl, resp.TypeUrl)
+	// We should expect to find two resources within the response
+	assert.Len(t, resp.Resources, 2)
+	// There's no specific order we should expect, so we'll need to assert that
+	// each actually exists
+
+	// First check we got our certificate...
+	checkSVID := func(secret *tlsv3pb.Secret) {
+		tlsCert := secret.GetTlsCertificate()
+		require.NotNil(t, tlsCert)
+		require.NotNil(t, tlsCert.CertificateChain)
+		tlsCertBytes := tlsCert.CertificateChain.GetInlineBytes()
+		require.NotEmpty(t, tlsCertBytes)
+		require.NotNil(t, tlsCert.PrivateKey)
+		privateKeyBytes := tlsCert.PrivateKey.GetInlineBytes()
+		require.NotEmpty(t, privateKeyBytes)
+		goTLSCert, err := tls.X509KeyPair(tlsCertBytes, privateKeyBytes)
+		require.NoError(t, err)
+		// Sanity check we generated an ECDSA key (testenv cluster uses
+		// balanced-v1 algorithm suite)
+		require.IsType(t, &ecdsa.PrivateKey{}, goTLSCert.PrivateKey)
+	}
+	checkSVID(findSecret(t, resp.Resources, "spiffe://root/foo"))
+
+	// Now check we got the CA
+	caSecret := findSecret(t, resp.Resources, "spiffe://root")
+	validationContext := caSecret.GetValidationContext()
+	require.NotNil(t, validationContext.CustomValidatorConfig)
+	require.Equal(t, "envoy.tls.cert_validator.spiffe", validationContext.CustomValidatorConfig.Name)
+	spiffeValidatorConfig := &tlsv3pb.SPIFFECertValidatorConfig{}
+	require.NoError(t, validationContext.CustomValidatorConfig.TypedConfig.UnmarshalTo(spiffeValidatorConfig))
+	require.Len(t, spiffeValidatorConfig.TrustDomains, 1)
+	require.Equal(t, "root", spiffeValidatorConfig.TrustDomains[0].Name)
+	block, _ := pem.Decode(spiffeValidatorConfig.TrustDomains[0].TrustBundle.GetInlineBytes())
+	require.Equal(t, "CERTIFICATE", block.Type)
+	x509Cert, err := x509.ParseCertificate(block.Bytes)
+	require.NoError(t, err)
+	// Sanity check we generated an ECDSA key (testenv cluster uses balanced-v1
+	// algorithm suite)
+	require.IsType(t, &ecdsa.PublicKey{}, x509Cert.PublicKey)
+
+	// We should send the response ACK we expect envoy to send.
+	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
+		TypeUrl:       typeUrl,
+		VersionInfo:   resp.VersionInfo,
+		ResponseNonce: resp.Nonce,
+		ResourceNames: []string{},
+	})
+	require.NoError(t, err)
+
+	// Try specifying a specific resource
+	err = stream.Send(&discoveryv3pb.DiscoveryRequest{
+		TypeUrl: typeUrl,
+		ResourceNames: []string{
+			"spiffe://root/foo",
+		},
+		VersionInfo:   resp.VersionInfo,
+		ResponseNonce: resp.Nonce,
+	})
+	require.NoError(t, err)
+
+	resp, err = stream.Recv()
+	require.NoError(t, err)
+	assert.NotEmpty(t, resp.VersionInfo)
+	assert.NotEmpty(t, resp.Nonce)
+	assert.Len(t, resp.Resources, 1)
+	checkSVID(findSecret(t, resp.Resources, "spiffe://root/foo"))
+}
+
+func findSecret(t *testing.T, resources []*anypb.Any, name string) *tlsv3pb.Secret {
+	for _, a := range resources {
+		secret := &tlsv3pb.Secret{}
+		require.NoError(t, a.UnmarshalTo(secret))
+		if secret.Name == name {
+			return secret
+		}
+	}
+	return nil
+}
diff --git a/lib/tbot/services/ssh/helpers_test.go b/lib/tbot/services/ssh/helpers_test.go
new file mode 100644
index 0000000000000..983d5cfc01f2e
--- /dev/null
+++ b/lib/tbot/services/ssh/helpers_test.go
@@ -0,0 +1,108 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+func ptr[T any](v T) *T {
+	return &v
+}
diff --git a/lib/tbot/services/ssh/host_output.go b/lib/tbot/services/ssh/host_output.go
new file mode 100644
index 0000000000000..429531e5d1ec7
--- /dev/null
+++ b/lib/tbot/services/ssh/host_output.go
@@ -0,0 +1,246 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/client/identityfile"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+)
+
+func HostOutputServiceBuilder(cfg *HostOutputConfig, defaultCredentialLifetime bot.CredentialLifetime) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &HostOutputService{
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			reloadCh:                  deps.ReloadCh,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(HostOutputServiceType, cfg.Name, buildFn)
+}
+
+type HostOutputService struct {
+	defaultCredentialLifetime bot.CredentialLifetime
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	cfg                       *HostOutputConfig
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+	identityGenerator         *identity.Generator
+	clientBuilder             *client.Builder
+}
+
+func (s *HostOutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("ssh-host (%s)", s.cfg.Destination.String()),
+	)
+}
+
+func (s *HostOutputService) OneShot(ctx context.Context) error {
+	return s.generate(ctx)
+}
+
+func (s *HostOutputService) Run(ctx context.Context) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service:         s.String(),
+		Name:            "output-renewal",
+		F:               s.generate,
+		Interval:        cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit:      internal.RenewalRetryLimit,
+		Log:             s.log,
+		ReloadCh:        s.reloadCh,
+		IdentityReadyCh: s.botIdentityReadyCh,
+		StatusReporter:  s.statusReporter,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *HostOutputService) generate(ctx context.Context) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"HostOutputService/generate",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Generating output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithRoles(s.cfg.Roles),
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return trace.Wrap(err, "generating identity")
+	}
+
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+	clusterName := id.Get().ClusterName
+
+	// generate a keypair
+	key, err := cryptosuites.GenerateKey(ctx,
+		cryptosuites.GetCurrentSuiteFromAuthPreference(s.botAuthClient),
+		cryptosuites.HostSSH)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	privKey, err := keys.NewPrivateKey(key)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// For now, we'll reuse the bot's regular TTL, and hostID and nodeName are
+	// left unset.
+	res, err := impersonatedClient.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+		Key:         privKey.MarshalSSHPublicKey(),
+		HostId:      "",
+		NodeName:    "",
+		Principals:  s.cfg.Principals,
+		ClusterName: clusterName,
+		Role:        string(types.RoleNode),
+		Ttl:         durationpb.New(cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL),
+	},
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	keyRing := &libclient.KeyRing{
+		SSHPrivateKey: privKey,
+		Cert:          res.SshCertificate,
+	}
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: SSHHostCertPath,
+		Writer:     internal.NewBotConfigWriter(ctx, s.cfg.Destination, ""),
+		KeyRing:    keyRing,
+		Format:     identityfile.FormatOpenSSH,
+
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	userCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.UserCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	exportedCAs, err := exportSSHUserCAs(userCAs, clusterName)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	userCAPath := SSHHostCertPath + SSHHostUserCASuffix
+	if err := s.cfg.Destination.Write(ctx, userCAPath, []byte(exportedCAs)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	files = append(files, userCAPath)
+
+	s.log.DebugContext(
+		ctx,
+		"Wrote OpenSSH host cert files",
+		"files", files,
+	)
+
+	return nil
+}
+
+const (
+	// sshHostTrimPrefix is the prefix that should be removed from the generated
+	// SSH CA.
+	sshHostTrimPrefix = "cert-authority "
+)
+
+// exportSSHUserCAs generates SSH CAs.
+func exportSSHUserCAs(cas []types.CertAuthority, localAuthName string) (string, error) {
+	var exported string
+
+	for _, ca := range cas {
+		// Don't export trusted CAs.
+		if ca.GetClusterName() != localAuthName {
+			continue
+		}
+
+		for _, key := range ca.GetTrustedSSHKeyPairs() {
+			s, err := sshutils.MarshalAuthorizedKeysFormat(ca.GetClusterName(), key.PublicKey)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+
+			// remove "cert-authority "
+			s = strings.TrimPrefix(s, sshHostTrimPrefix)
+
+			exported += s
+		}
+	}
+
+	return exported, nil
+}
diff --git a/lib/tbot/services/ssh/host_output_config.go b/lib/tbot/services/ssh/host_output_config.go
new file mode 100644
index 0000000000000..92f180b30e5db
--- /dev/null
+++ b/lib/tbot/services/ssh/host_output_config.go
@@ -0,0 +1,141 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const HostOutputServiceType = "ssh_host"
+
+const (
+	// SSHHostCertPath is the default filename prefix for the SSH host
+	// certificate
+	SSHHostCertPath = "ssh_host"
+
+	// SSHHostCertSuffix is the suffix appended to the generated host certificate.
+	SSHHostCertSuffix = "-cert.pub"
+
+	// SSHHostUserCASuffix is the suffix appended to the user CA file.
+	SSHHostUserCASuffix = "-user-ca.pub"
+)
+
+// HostOutputConfig generates a host certificate signed by the Teleport CA. This
+// can be used to allow OpenSSH server to be trusted by Teleport SSH clients.
+type HostOutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Principals is a list of principals to request for the host cert.
+	Principals []string `yaml:"principals"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *HostOutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *HostOutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (o *HostOutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+func (o *HostOutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *HostOutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	if len(o.Principals) == 0 {
+		return trace.BadParameter("at least one principal must be specified")
+	}
+
+	return nil
+}
+
+func (o *HostOutputConfig) Describe() []bot.FileDescription {
+	return []bot.FileDescription{
+		{
+			Name: SSHHostCertPath,
+		},
+		{
+			Name: SSHHostCertPath + SSHHostCertSuffix,
+		},
+		{
+			Name: SSHHostCertPath + SSHHostUserCASuffix,
+		},
+	}
+}
+
+func (o *HostOutputConfig) MarshalYAML() (any, error) {
+	type raw HostOutputConfig
+	return encoding.WithTypeHeader((*raw)(o), HostOutputServiceType)
+}
+
+func (o *HostOutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *HostOutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw HostOutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *HostOutputConfig) Type() string {
+	return HostOutputServiceType
+}
+
+func (o *HostOutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/ssh/host_output_config_test.go b/lib/tbot/services/ssh/host_output_config_test.go
new file mode 100644
index 0000000000000..fd9b128c3e510
--- /dev/null
+++ b/lib/tbot/services/ssh/host_output_config_test.go
@@ -0,0 +1,88 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+)
+
+func TestSSHHostOutput_YAML(t *testing.T) {
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[HostOutputConfig]{
+		{
+			name: "full",
+			in: HostOutputConfig{
+				Destination: dest,
+				Roles:       []string{"access"},
+				Principals:  []string{"host.example.com"},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: HostOutputConfig{
+				Destination: dest,
+				Principals:  []string{"host.example.com"},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestSSHHostOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*HostOutputConfig]{
+		{
+			name: "valid",
+			in: func() *HostOutputConfig {
+				return &HostOutputConfig{
+					Destination: destination.NewMemory(),
+					Roles:       []string{"access"},
+					Principals:  []string{"host.example.com"},
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *HostOutputConfig {
+				return &HostOutputConfig{
+					Destination: nil,
+					Principals:  []string{"host.example.com"},
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing principals",
+			in: func() *HostOutputConfig {
+				return &HostOutputConfig{
+					Destination: destination.NewMemory(),
+				}
+			},
+			wantErr: "at least one principal must be specified",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/ssh/multiplexer.go b/lib/tbot/services/ssh/multiplexer.go
new file mode 100644
index 0000000000000..131a88036be03
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer.go
@@ -0,0 +1,928 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"bufio"
+	"bytes"
+	"cmp"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/gravitational/trace"
+	grpcprom "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus"
+	"github.com/prometheus/client_golang/prometheus"
+	oteltrace "go.opentelemetry.io/otel/trace"
+	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	proxyclient "github.com/gravitational/teleport/api/client/proxy"
+	"github.com/gravitational/teleport/api/observability/tracing"
+	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
+	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
+	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/config/openssh"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+	"github.com/gravitational/teleport/lib/resumption"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/ssh"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/uds"
+)
+
+const (
+	sshMuxSocketName = "v1.sock"
+	agentSocketName  = "agent.sock"
+)
+
+var (
+	muxReqsStartedCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "tbot_ssh_multiplexer_requests_started_total",
+			Help: "Number of requests completed by the multiplexer",
+		},
+	)
+	muxReqsHandledCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tbot_ssh_multiplexer_requests_handled_total",
+			Help: "Number of requests completed by the multiplexer",
+		}, []string{"status"},
+	)
+	muxReqsInflightGauge = prometheus.NewGauge(
+		prometheus.GaugeOpts{
+			Name: "tbot_ssh_multiplexer_requests_in_flight",
+			Help: "Number of SSH connections currently being handled by the multiplexer",
+		},
+	)
+)
+
+func MultiplexerServiceBuilder(
+	cfg *MultiplexerConfig,
+	alpnUpgradeCache *internal.ALPNUpgradeCache,
+	connCfg connection.Config,
+	defaultCredentialLifetime bot.CredentialLifetime,
+	clientMetrics *grpcprom.ClientMetrics,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &MultiplexerService{
+			alpnUpgradeCache:          alpnUpgradeCache,
+			botAuthClient:             deps.Client,
+			botIdentityReadyCh:        deps.BotIdentityReadyCh,
+			connCfg:                   connCfg,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			proxyPinger:               deps.ProxyPinger,
+			clientMetrics:             clientMetrics,
+			reloadCh:                  deps.ReloadCh,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(MultiplexerServiceType, cfg.Name, buildFn)
+}
+
+// MultiplexerService is a long-lived local SSH proxy. It listens on a local Unix
+// socket and has a special client with support for FDPassing with OpenSSH.
+// It places an emphasis on high performance.
+type MultiplexerService struct {
+	alpnUpgradeCache *internal.ALPNUpgradeCache
+	// botAuthClient should be an auth client using the bots internal identity.
+	// This will not have any roles impersonated and should only be used to
+	// fetch CAs.
+	botAuthClient             *apiclient.Client
+	botIdentityReadyCh        <-chan struct{}
+	connCfg                   connection.Config
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *MultiplexerConfig
+	log                       *slog.Logger
+	proxyPinger               connection.ProxyPinger
+	clientMetrics             *grpcprom.ClientMetrics
+	statusReporter            readyz.Reporter
+	reloadCh                  <-chan struct{}
+
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+
+	// Fields below here are initialized by the service itself on startup.
+	identity *identity.Facade
+
+	agentMu sync.Mutex
+	agent   agent.ExtendedAgent
+}
+
+// writeIfChanged reads the artifact first to determine if it has changed
+// before writing to it. This avoids truncating the file during another
+// processes read.
+//
+// TODO(noah): Replace this with proper atomic writing.
+// https://github.com/gravitational/teleport/issues/25462
+func writeIfChanged(ctx context.Context, dest destination.Destination, log *slog.Logger, path string, data []byte) error {
+	existingData, err := dest.Read(ctx, path)
+	if err != nil {
+		log.DebugContext(
+			ctx,
+			"Error occurred reading artifact for change-check, will write",
+			"path", path,
+			"error", err,
+		)
+		return dest.Write(ctx, path, data)
+	}
+
+	if bytes.Equal(existingData, data) {
+		log.DebugContext(
+			ctx,
+			"Artifact unchanged, not writing",
+			"path", path,
+		)
+		return nil
+	}
+	log.DebugContext(
+		ctx,
+		"Artifact changed, will write",
+		"path", path,
+	)
+
+	return dest.Write(ctx, path, data)
+}
+
+func (s *MultiplexerService) writeArtifacts(
+	ctx context.Context,
+	proxyHost string,
+	authClient *apiclient.Client,
+) error {
+	dest := s.cfg.Destination.(*destination.Directory)
+
+	clusterNames, err := internal.GetClusterNames(ctx, authClient, s.identity.Get().ClusterName)
+	if err != nil {
+		return trace.Wrap(err, "fetching cluster names")
+	}
+
+	// Generate known hosts
+	knownHosts, _, err := ssh.GenerateKnownHosts(
+		ctx,
+		s.botAuthClient,
+		clusterNames,
+		proxyHost,
+	)
+	if err != nil {
+		return trace.Wrap(err, "generating known hosts")
+	}
+	if err := writeIfChanged(
+		ctx, dest, s.log, ssh.KnownHostsName, []byte(knownHosts),
+	); err != nil {
+		return trace.Wrap(err, "writing %s", ssh.KnownHostsName)
+	}
+
+	// Generate SSH config
+	proxyCommand := s.cfg.ProxyCommand
+	if len(proxyCommand) == 0 {
+		executablePath, err := autoupdate.StableExecutable()
+		if errors.Is(err, autoupdate.ErrUnstableExecutable) {
+			s.log.WarnContext(ctx, "SSH multiplexer proxy command will be rendered with an unstable path to the tbot executable. Please reinstall tbot with Managed Updates to prevent instability.")
+		} else if err != nil {
+			return trace.Wrap(err, "determining executable path")
+		}
+		proxyCommand = []string{
+			executablePath,
+			"ssh-multiplexer-proxy-command",
+		}
+	}
+
+	absPath, err := filepath.Abs(dest.Path)
+	if err != nil {
+		return trace.Wrap(err, "determining absolute path for destination")
+	}
+
+	var sshConfigBuilder strings.Builder
+	err = openssh.WriteMuxedSSHConfig(&sshConfigBuilder, &openssh.MuxedSSHConfigParameters{
+		AppName:         openssh.TbotApp,
+		ClusterNames:    clusterNames,
+		KnownHostsPath:  filepath.Join(absPath, ssh.KnownHostsName),
+		ProxyCommand:    proxyCommand,
+		MuxSocketPath:   filepath.Join(absPath, sshMuxSocketName),
+		AgentSocketPath: filepath.Join(absPath, agentSocketName),
+	})
+	if err != nil {
+		return trace.Wrap(err, "generating SSH config")
+	}
+	sshConfBytes := []byte(sshConfigBuilder.String())
+	if err := writeIfChanged(
+		ctx, dest, s.log, ssh.ConfigName, sshConfBytes,
+	); err != nil {
+		return trace.Wrap(err, "writing %s", ssh.ConfigName)
+	}
+
+	return nil
+}
+
+func (s *MultiplexerService) setup(ctx context.Context) (
+	_ *apiclient.Client,
+	_ *cyclingHostDialClient,
+	proxyHost string,
+	_ *libclient.TSHConfig,
+	_ error,
+) {
+	if s.botIdentityReadyCh != nil {
+		select {
+		case <-s.botIdentityReadyCh:
+		default:
+			s.log.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-s.botIdentityReadyCh:
+			case <-ctx.Done():
+				return nil, nil, "", nil, ctx.Err()
+			}
+		}
+	}
+
+	// Register service metrics. Expected to always work.
+	if err := metrics.RegisterPrometheusCollectors(
+		muxReqsStartedCounter,
+		muxReqsHandledCounter,
+		muxReqsInflightGauge,
+	); err != nil {
+		return nil, nil, "", nil, trace.Wrap(err)
+	}
+
+	if err := s.cfg.Destination.Init(ctx, []string{}); err != nil {
+		return nil, nil, "", nil, trace.Wrap(err, "initializing destination")
+	}
+
+	// Load in any proxy templates if a path to them has been provided.
+	tshConfig := &libclient.TSHConfig{}
+	if s.cfg.ProxyTemplatesPath != "" {
+		s.log.InfoContext(ctx, "Loading proxy templates", "path", s.cfg.ProxyTemplatesPath)
+		var err error
+		tshConfig, err = libclient.LoadTSHConfig(s.cfg.ProxyTemplatesPath)
+		if err != nil {
+			return nil, nil, "", nil, trace.Wrap(err, "loading proxy templates")
+		}
+		for _, t := range tshConfig.ProxyTemplates {
+			s.log.DebugContext(
+				ctx,
+				"Loaded proxy template",
+				"template", t.Template,
+				"proxy", t.Proxy,
+				"host", t.Host,
+				"cluster", t.Cluster,
+				"query", t.Query,
+				"search", t.Search,
+			)
+		}
+	}
+
+	// Generate our initial identity and write the artifacts to the destination.
+	id, err := s.generateIdentity(ctx)
+	if err != nil {
+		return nil, nil, "", nil, trace.Wrap(err, "generating initial identity")
+	}
+	s.identity = id
+
+	sshConfig, err := s.identity.SSHClientConfig()
+	if err != nil {
+		return nil, nil, "", nil, trace.Wrap(err)
+	}
+
+	// Ping the proxy and determine if we need to upgrade the connection.
+	proxyPing, err := s.proxyPinger.Ping(ctx)
+	if err != nil {
+		return nil, nil, "", nil, trace.Wrap(err)
+	}
+	proxyAddr, err := proxyPing.ProxySSHAddr()
+	if err != nil {
+		return nil, nil, "", nil, trace.Wrap(err, "determining proxy ssh addr")
+	}
+	proxyHost, _, err = utils.SplitHostPort(proxyAddr)
+	if err != nil {
+		return nil, nil, "", nil, trace.BadParameter(
+			"proxy %+v has no usable public address: %v",
+			proxyAddr, err,
+		)
+	}
+
+	connUpgradeRequired := false
+	if proxyPing.Proxy.TLSRoutingEnabled {
+		connUpgradeRequired, err = s.alpnUpgradeCache.IsUpgradeRequired(
+			ctx, proxyAddr, s.connCfg.Insecure,
+		)
+		if err != nil {
+			return nil, nil, "", nil, trace.Wrap(err, "determining if ALPN upgrade is required")
+		}
+	}
+
+	// Create Proxy and Auth clients
+	proxyClient := newCyclingHostDialClient(100, proxyclient.ClientConfig{
+		ProxyAddress:      proxyAddr,
+		RelayAddress:      s.cfg.RelayAddress,
+		TLSRoutingEnabled: proxyPing.Proxy.TLSRoutingEnabled,
+		TLSConfigFunc: func(cluster string) (*tls.Config, error) {
+			cfg, err := s.identity.TLSConfig()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			// The facade TLS config is tailored toward connections to the Auth service.
+			// Override the server name to be the proxy and blank out the next protos to
+			// avoid hitting the proxy web listener.
+			cfg.ServerName = proxyHost
+			cfg.NextProtos = nil
+			return cfg, nil
+		},
+		UnaryInterceptors: []grpc.UnaryClientInterceptor{
+			s.clientMetrics.UnaryClientInterceptor(),
+			interceptors.GRPCClientUnaryErrorInterceptor,
+		},
+		StreamInterceptors: []grpc.StreamClientInterceptor{
+			s.clientMetrics.StreamClientInterceptor(),
+			interceptors.GRPCClientStreamErrorInterceptor,
+		},
+		SSHConfig:               sshConfig,
+		InsecureSkipVerify:      s.connCfg.Insecure,
+		ALPNConnUpgradeRequired: connUpgradeRequired,
+	})
+
+	authClient, err := s.clientBuilder.Build(ctx, s.identity)
+	if err != nil {
+		return nil, nil, "", nil, trace.Wrap(err)
+	}
+
+	return authClient, proxyClient, proxyHost, tshConfig, nil
+}
+
+// generateIdentity generates our impersonated identity which we will write to
+// the destination.
+func (s *MultiplexerService) generateIdentity(ctx context.Context) (*identity.Facade, error) {
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	facade, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating identity")
+	}
+	id := facade.Get()
+
+	newAgent := agent.NewKeyring()
+	err = newAgent.Add(agent.AddedKey{
+		PrivateKey:   id.PrivateKey,
+		Certificate:  id.SSHCert,
+		LifetimeSecs: 0,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "adding identity to agent")
+	}
+	// There's a bug with Paramiko and older versions of OpenSSH that requires
+	// that the bare key also be included in the agent or the key with the
+	// certificate will not be used.
+	// See the following: https://bugzilla.mindrot.org/show_bug.cgi?id=2550
+	err = newAgent.Add(agent.AddedKey{
+		PrivateKey:   id.PrivateKey,
+		Certificate:  nil,
+		LifetimeSecs: 0,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "adding bare key to agent")
+	}
+
+	s.agentMu.Lock()
+	s.agent = newAgent.(agent.ExtendedAgent)
+	s.agentMu.Unlock()
+
+	return facade, nil
+}
+
+func (s *MultiplexerService) identityRenewalLoop(
+	ctx context.Context, proxyHost string, authClient *apiclient.Client,
+) error {
+	err := internal.RunOnInterval(ctx, internal.RunOnIntervalConfig{
+		Service: s.String(),
+		Name:    "identity-renewal",
+		F: func(ctx context.Context) error {
+			id, err := s.generateIdentity(ctx)
+			if err != nil {
+				return trace.Wrap(err, "generating identity")
+			}
+			s.identity.Set(id.Get())
+			return s.writeArtifacts(ctx, proxyHost, authClient)
+		},
+		Interval:   cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval,
+		RetryLimit: internal.RenewalRetryLimit,
+		Log:        s.log,
+		ReloadCh:   s.reloadCh,
+	})
+	return trace.Wrap(err)
+}
+
+func (s *MultiplexerService) Run(ctx context.Context) (err error) {
+	ctx, span := tracer.Start(
+		ctx,
+		"MultiplexerService/Run",
+	)
+	defer func() { tracing.EndSpan(span, err) }()
+
+	authClient, hostDialer, proxyHost, tshConfig, err := s.setup(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer authClient.Close()
+
+	dest := s.cfg.Destination.(*destination.Directory)
+	absPath, err := filepath.Abs(dest.Path)
+	if err != nil {
+		return trace.Wrap(err, "determining absolute path for destination")
+	}
+	muxListenerAddr := url.URL{Scheme: "unix", Path: filepath.Join(absPath, sshMuxSocketName)}
+	muxListener, err := internal.CreateListener(
+		ctx,
+		s.log,
+		muxListenerAddr.String(),
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer muxListener.Close()
+
+	agentListenerAddr := url.URL{Scheme: "unix", Path: filepath.Join(absPath, agentSocketName)}
+	agentListener, err := internal.CreateListener(
+		ctx,
+		s.log,
+		agentListenerAddr.String(),
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer agentListener.Close()
+
+	eg, egCtx := errgroup.WithContext(ctx)
+	// Handle main mux listener
+	eg.Go(func() error {
+		defer context.AfterFunc(egCtx, func() { _ = muxListener.Close() })()
+		for {
+			downstream, err := muxListener.Accept()
+			if err != nil {
+				if utils.IsUseOfClosedNetworkError(err) {
+					return nil
+				}
+
+				s.log.WarnContext(
+					egCtx,
+					"Error encountered accepting mux connection, sleeping and continuing",
+					"error",
+					err,
+				)
+				select {
+				case <-egCtx.Done():
+					return nil
+				case <-time.After(50 * time.Millisecond):
+				}
+
+				continue
+			}
+
+			go func() {
+				muxReqsStartedCounter.Inc()
+				muxReqsInflightGauge.Inc()
+				defer muxReqsInflightGauge.Dec()
+
+				err := s.handleConn(
+					egCtx, tshConfig, authClient, hostDialer, proxyHost, downstream,
+				)
+
+				var status string
+				switch {
+				case err != nil && !errors.Is(err, context.Canceled):
+					status = "ERROR"
+					s.log.WarnContext(egCtx, "Mux handler exited with error", "error", err)
+				default:
+					status = "OK"
+				}
+				muxReqsHandledCounter.WithLabelValues(status).Inc()
+			}()
+		}
+	})
+	// Handle agent listener
+	eg.Go(func() error {
+		defer context.AfterFunc(egCtx, func() { _ = agentListener.Close() })()
+		for {
+			conn, err := agentListener.Accept()
+			if err != nil {
+				if utils.IsUseOfClosedNetworkError(err) {
+					return nil
+				}
+
+				s.log.WarnContext(
+					egCtx,
+					"Error encountered accepting agent connection, sleeping and continuing",
+					"error",
+					err,
+				)
+				select {
+				case <-egCtx.Done():
+					return nil
+				case <-time.After(50 * time.Millisecond):
+				}
+
+				continue
+			}
+
+			go func() {
+				defer context.AfterFunc(egCtx, func() { _ = conn.Close() })()
+				s.agentMu.Lock()
+				currentAgent := s.agent
+				s.agentMu.Unlock()
+
+				s.log.DebugContext(egCtx, "Serving agent connection")
+				//nolint:staticcheck // SA4023. ServeAgent always returns a non-nil error. This is fine.
+				err := agent.ServeAgent(currentAgent, conn)
+				if err != nil && !utils.IsOKNetworkError(err) {
+					s.log.WarnContext(
+						egCtx,
+						"Error encountered serving agent connection",
+						"error",
+						err,
+					)
+				}
+			}()
+
+		}
+	})
+	// Handle identity renewal
+	eg.Go(func() error {
+		return s.identityRenewalLoop(egCtx, proxyHost, authClient)
+	})
+
+	s.statusReporter.Report(readyz.Healthy)
+
+	if err := eg.Wait(); err != nil {
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return err
+	}
+	return nil
+}
+
+func (s *MultiplexerService) handleConn(
+	ctx context.Context,
+	tshConfig *libclient.TSHConfig,
+	authClient *apiclient.Client,
+	hostDialer *cyclingHostDialClient,
+	proxyHost string,
+	downstream net.Conn,
+) (err error) {
+	ctx, span := tracer.Start(
+		ctx,
+		"MultiplexerService/handleConn",
+		oteltrace.WithNewRoot(),
+	)
+	defer func() { tracing.EndSpan(span, err) }()
+	defer func() {
+		if err := downstream.Close(); err != nil && !utils.IsOKNetworkError(err) {
+			s.log.DebugContext(ctx, "Error closing downstream connection", "error", err)
+		}
+	}()
+
+	var stderr *os.File
+	defer func() {
+		if stderr == nil {
+			return
+		}
+		defer stderr.Close()
+		if err != nil {
+			fmt.Fprintln(stderr, err)
+		}
+	}()
+
+	var req string
+	// here we try receiving a file descriptor to use for error output, which
+	// should be mapped to OpenSSH's own stderr (or /dev/null)
+	if un, _ := downstream.(*net.UnixConn); un != nil {
+		b := make([]byte, 1)
+		fds := make([]*os.File, 1)
+
+		n, fdn, err := uds.ReadWithFDs(un, b, fds)
+		if err != nil {
+			return trace.Wrap(err, "reading request")
+		}
+		if fdn > 0 {
+			s.log.DebugContext(ctx, "Received stderr file descriptor from client for error reporting")
+			stderr = fds[0]
+		}
+		// this approach works because we know that req must be at least one
+		// byte at the end (as it must end with a NUL)
+		req = string(b[:n])
+	}
+
+	// The first thing downstream will send is the multiplexing request which is
+	// in the "[host]:[port]|[cluster_name]\x00" format.
+	// The "|[cluster_name]" section is optional and if omitted, the cluster
+	// associated with the bot will be used.
+	//
+	// We choose this format because | is not an acceptable character in
+	// hostnames or ports through OpenSSH.
+	// https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
+	buf := bufio.NewReader(downstream)
+	if !strings.HasSuffix(req, "\x00") {
+		r, err := buf.ReadString('\x00')
+		if err != nil {
+			return trace.Wrap(err, "reading request")
+		}
+		req += r
+	}
+	req = req[:len(req)-1] // Drop the NUL.
+
+	// Split by | to pull out the optionally specified cluster name.
+	// TODO(noah): When we need to add another parameter in future, we should
+	// roll this API to v2 and use a more extensible format.
+	splitReq := strings.Split(req, "|")
+	if len(splitReq) > 2 {
+		return trace.BadParameter(
+			"malformed request, expected at most 2 fields, got %d: %q",
+			len(splitReq), req,
+		)
+	}
+
+	host, port, err := utils.SplitHostPort(splitReq[0])
+	if err != nil {
+		return trace.Wrap(err, "malformed request %q", req)
+	}
+
+	clusterName := s.identity.Get().ClusterName
+	if len(splitReq) > 1 {
+		clusterName = splitReq[1]
+	}
+
+	log := s.log.With(
+		slog.Group("req",
+			"host", host,
+			"port", port,
+			"cluster_name", clusterName,
+		),
+	)
+	log.InfoContext(ctx, "Received multiplexing request")
+
+	expanded, matched := tshConfig.ProxyTemplates.Apply(
+		net.JoinHostPort(host, port),
+	)
+	if matched {
+		log.DebugContext(
+			ctx,
+			"Proxy templated matched",
+			"populated_template", expanded,
+		)
+		if expanded.Cluster != "" {
+			clusterName = expanded.Cluster
+		}
+
+		if expanded.Host != "" {
+			host = expanded.Host
+		}
+	}
+
+	var target string
+	if expanded == nil || (len(expanded.Search) == 0 && expanded.Query == "") {
+		host = cleanTargetHost(host, proxyHost, clusterName)
+		target = net.JoinHostPort(host, port)
+	} else {
+		node, err := resolveTargetHostWithClient(ctx, authClient, expanded.Search, expanded.Query)
+		if err != nil {
+			return trace.Wrap(err, "resolving target host")
+		}
+
+		log.DebugContext(
+			ctx,
+			"Found matching SSH host",
+			"host_uuid", node.GetName(),
+			"host_name", node.GetHostname(),
+		)
+
+		target = net.JoinHostPort(node.GetName(), "0")
+	}
+
+	// We need the agent to support proxy recording mode.
+	s.agentMu.Lock()
+	currentAgent := s.agent
+	s.agentMu.Unlock()
+
+	upstream, _, err := hostDialer.DialHost(ctx, target, clusterName, currentAgent)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if s.cfg.SessionResumptionEnabled() {
+		log.DebugContext(ctx, "Enabling session resumption")
+		upstream, err = resumption.WrapSSHClientConn(
+			ctx,
+			upstream,
+			func(ctx context.Context, hostID string) (net.Conn, error) {
+				log.DebugContext(ctx, "Resuming connection")
+				// if the connection is being resumed, it means that
+				// we didn't need the agent in the first place as proxy
+				// recording mode does not require it.
+				var noAgent agent.ExtendedAgent
+				conn, _, err := hostDialer.DialHost(
+					ctx, net.JoinHostPort(hostID, "0"), clusterName, noAgent,
+				)
+				return conn, err
+			})
+		if err != nil {
+			return trace.Wrap(err, "wrapping conn for session resumption")
+		}
+	}
+	defer func() {
+		if err := upstream.Close(); err != nil && !utils.IsOKNetworkError(err) {
+			s.log.DebugContext(ctx, "Error closing upstream connection", "error", err)
+		}
+	}()
+
+	defer context.AfterFunc(ctx, func() {
+		if err := trace.NewAggregate(
+			upstream.Close(),
+			downstream.Close(),
+		); err != nil {
+			s.log.DebugContext(ctx, "Error closing connections", "error", err)
+		}
+	})()
+
+	log.InfoContext(ctx, "Proxying connection for multiplexing request")
+	startedProxying := time.Now()
+
+	// once the connection is actually started we should stop writing to the
+	// client's stderr
+	if stderr != nil {
+		_ = stderr.Close()
+		stderr = nil
+	}
+
+	errCh := make(chan error, 2)
+	go func() {
+		defer upstream.Close()
+		defer downstream.Close()
+		// Drain the buffer we used to read in the request in case it read in more
+		// than just the initial request.
+		drained, _ := buf.Peek(buf.Buffered())
+		if _, err := upstream.Write(drained); err != nil {
+			errCh <- trace.Wrap(err, "draining request buffer upstream")
+			return
+		}
+		_, err := io.Copy(upstream, downstream)
+		if utils.IsOKNetworkError(err) {
+			err = nil
+		}
+		errCh <- trace.Wrap(err, "downstream->upstream")
+	}()
+
+	go func() {
+		defer upstream.Close()
+		defer downstream.Close()
+		_, err := io.Copy(downstream, upstream)
+		if utils.IsOKNetworkError(err) {
+			err = nil
+		}
+		errCh <- trace.Wrap(err, "upstream->downstream")
+	}()
+
+	err = trace.NewAggregate(<-errCh, <-errCh)
+	log.InfoContext(
+		ctx,
+		"Finished proxying connection multiplexing request",
+		"proxied_duration", time.Since(startedProxying),
+	)
+	return err
+}
+
+func (s *MultiplexerService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		MultiplexerServiceType,
+	)
+}
+
+type hostDialer interface {
+	DialHost(ctx context.Context, target string, cluster string, keyring agent.ExtendedAgent) (net.Conn, proxyclient.ClusterDetails, error)
+	Close() error
+}
+
+// cyclingHostDialClient handles cycling through proxy clients every configured
+// number of connections. This prevents a single client being overwhelmed.
+type cyclingHostDialClient struct {
+	max          int32
+	hostDialerFn func(ctx context.Context) (hostDialer, error)
+
+	mu         sync.Mutex
+	started    int32
+	currentClt *refCountProxyClient
+}
+
+type refCountProxyClient struct {
+	clt      hostDialer
+	refCount atomic.Int32
+}
+
+func (r *refCountProxyClient) release() {
+	if r == nil {
+		return
+	}
+	if r.refCount.Add(-1) <= 0 {
+		go r.clt.Close()
+	}
+}
+
+type refCountConn struct {
+	net.Conn
+	parent atomic.Pointer[refCountProxyClient]
+}
+
+func (r *refCountConn) Close() error {
+	// Swap operation ensures that this conn only releases the ref to its
+	// underlying client once, even if Close is called multiple times.
+	defer r.parent.Swap(nil).release()
+	return trace.Wrap(r.Conn.Close())
+}
+
+func newCyclingHostDialClient(max int32, config proxyclient.ClientConfig) *cyclingHostDialClient {
+	return &cyclingHostDialClient{
+		max: max,
+		hostDialerFn: func(ctx context.Context) (hostDialer, error) {
+			return proxyclient.NewClient(ctx, config)
+		},
+	}
+}
+
+func (s *cyclingHostDialClient) DialHost(ctx context.Context, target string, cluster string, keyring agent.ExtendedAgent) (net.Conn, proxyclient.ClusterDetails, error) {
+	s.mu.Lock()
+	if s.currentClt == nil {
+		clt, err := s.hostDialerFn(ctx)
+		if err != nil {
+			s.mu.Unlock()
+			return nil, proxyclient.ClusterDetails{}, trace.Wrap(err)
+		}
+		s.currentClt = &refCountProxyClient{clt: clt}
+		// cyclingHostDialClient holds a reference while the refCountProxyClient
+		// is "live"
+		s.currentClt.refCount.Add(1)
+		s.started = 0
+	}
+
+	currentClt := s.currentClt
+	s.started++
+	if s.started >= s.max {
+		// the reference owned by cyclingHostDialClient is transferred to currentClt
+		s.currentClt = nil
+	} else {
+		currentClt.refCount.Add(1)
+	}
+	s.mu.Unlock()
+
+	innerConn, details, err := currentClt.clt.DialHost(ctx, target, cluster, keyring)
+	if err != nil {
+		currentClt.release()
+		return nil, details, trace.Wrap(err)
+	}
+
+	wrappedConn := &refCountConn{
+		Conn: innerConn,
+	}
+	wrappedConn.parent.Store(currentClt)
+	return wrappedConn, details, nil
+}
diff --git a/lib/tbot/services/ssh/multiplexer_config.go b/lib/tbot/services/ssh/multiplexer_config.go
new file mode 100644
index 0000000000000..5f4bc912c09da
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer_config.go
@@ -0,0 +1,125 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+// MultiplexerServiceType is the type of the `ssh-proxy` service.
+const MultiplexerServiceType = "ssh-multiplexer"
+
+// MultiplexerConfig is the configuration for the `ssh-proxy` service
+type MultiplexerConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Destination is where the config and tunnel should be written to. It
+	// should be a Directory.
+	Destination destination.Destination `yaml:"destination"`
+	// EnableResumption controls whether to enable session resumption for the
+	// SSH proxy.
+	// Call `SessionResumptionEnabled` to get the value with defaults applied.
+	EnableResumption *bool `yaml:"enable_resumption,omitempty"`
+	// ProxyTemplatesPath is the path to the directory containing the templates
+	// for the SSH proxy.
+	// This field is optional, if not provided, no templates will be used.
+	// This file is loaded once on start, so changes to the templates will
+	// require a restart of tbot.
+	ProxyTemplatesPath string `yaml:"proxy_templates_path,omitempty"`
+	// ProxyCommand is the base command to configure OpenSSH to invoke to
+	// connect to the SSH multiplexer. The path to the socket and the target
+	// will be automatically appended.
+	// Optional: If not provided, it will default to the `tbot` binary.
+	ProxyCommand []string `yaml:"proxy_command,omitempty"`
+	// RelayAddress specifies the address of a relay transport server to use for
+	// all the SSH connections going through this mux.
+	RelayAddress string `yaml:"relay_server,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *MultiplexerConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *MultiplexerConfig) SetName(name string) {
+	o.Name = name
+}
+
+func (s *MultiplexerConfig) SessionResumptionEnabled() bool {
+	if s.EnableResumption == nil {
+		return true
+	}
+	return *s.EnableResumption
+}
+
+func (s *MultiplexerConfig) Type() string {
+	return MultiplexerServiceType
+}
+
+func (s *MultiplexerConfig) MarshalYAML() (any, error) {
+	type raw MultiplexerConfig
+	return encoding.WithTypeHeader((*raw)(s), MultiplexerServiceType)
+}
+
+func (o *MultiplexerConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *MultiplexerConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw MultiplexerConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (s *MultiplexerConfig) CheckAndSetDefaults() error {
+	if s.Destination == nil {
+		return trace.BadParameter("destination: must be specified")
+	}
+	_, ok := s.Destination.(*destination.Directory)
+	if !ok {
+		return trace.BadParameter("destination: must be of type `directory`")
+	}
+	if err := s.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	return nil
+}
+
+func (o *MultiplexerConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	return o.CredentialLifetime
+}
diff --git a/lib/tbot/services/ssh/multiplexer_config_test.go b/lib/tbot/services/ssh/multiplexer_config_test.go
new file mode 100644
index 0000000000000..476a4a112b2b1
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer_config_test.go
@@ -0,0 +1,89 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+)
+
+func TestSSHMultiplexerService_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[MultiplexerConfig]{
+		{
+			name: "full",
+			in: MultiplexerConfig{
+				Destination: &destination.Directory{
+					Path: "/opt/machine-id",
+				},
+				EnableResumption:   ptr(true),
+				ProxyTemplatesPath: "/etc/teleport/templates",
+				ProxyCommand:       []string{"rusty-boi"},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestSSHMultiplexerService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*MultiplexerConfig]{
+		{
+			name: "valid",
+			in: func() *MultiplexerConfig {
+				return &MultiplexerConfig{
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *MultiplexerConfig {
+				return &MultiplexerConfig{
+					Destination: nil,
+				}
+			},
+			wantErr: "destination: must be specified",
+		},
+		{
+			name: "wrong destination type",
+			in: func() *MultiplexerConfig {
+				return &MultiplexerConfig{
+					Destination: &destination.Memory{},
+				}
+			},
+			wantErr: "destination: must be of type `directory`",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/ssh/multiplexer_test.go b/lib/tbot/services/ssh/multiplexer_test.go
new file mode 100644
index 0000000000000..2632b179c6cac
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer_test.go
@@ -0,0 +1,179 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/crypto/ssh/agent"
+
+	proxyclient "github.com/gravitational/teleport/api/client/proxy"
+)
+
+type mockConn struct {
+	mu     sync.Mutex
+	closed bool
+	net.Conn
+}
+
+func (mc *mockConn) Close() error {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+	mc.closed = true
+	mc.Conn.Close()
+	return nil
+}
+
+type mockHostDialer struct {
+	t      *testing.T
+	mu     sync.Mutex
+	closed bool
+	conns  []*mockConn
+}
+
+func (m *mockHostDialer) DialHost(
+	_ context.Context, _ string, _ string, _ agent.ExtendedAgent,
+) (net.Conn, proxyclient.ClusterDetails, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		m.t.Errorf("attempt to dial on closed host dialer")
+		return nil, proxyclient.ClusterDetails{}, fmt.Errorf("closed")
+	}
+	conn := &mockConn{
+		Conn: &net.TCPConn{},
+	}
+	m.conns = append(m.conns, conn)
+	return conn, proxyclient.ClusterDetails{}, nil
+}
+
+func (m *mockHostDialer) Close() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.closed = true
+	return nil
+}
+
+type mockHostDialerTracker struct {
+	t           *testing.T
+	mu          sync.Mutex
+	hostDialers []*mockHostDialer
+}
+
+func (m *mockHostDialerTracker) New(_ context.Context) (hostDialer, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	hostDialer := &mockHostDialer{t: m.t}
+	m.hostDialers = append(m.hostDialers, hostDialer)
+	return hostDialer, nil
+}
+
+func (m *mockHostDialerTracker) count() (open int, closed int) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, conn := range m.hostDialers {
+		conn.mu.Lock()
+		connClosed := conn.closed
+		conn.mu.Unlock()
+
+		if connClosed {
+			closed++
+		} else {
+			open++
+		}
+	}
+	return open, closed
+
+}
+
+func TestCyclingHostDialClient(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	tracker := &mockHostDialerTracker{}
+	cycler := &cyclingHostDialClient{
+		max:          5,
+		hostDialerFn: tracker.New,
+	}
+
+	var conns []net.Conn
+	for i := 0; i < 10; i++ {
+		conn, _, err := cycler.DialHost(ctx, "", "", nil)
+		assert.NoError(t, err)
+		conns = append(conns, conn)
+	}
+
+	openDialers, closedDialers := tracker.count()
+	assert.Equal(t, 2, openDialers)
+	assert.Equal(t, 0, closedDialers)
+
+	// Close the first connection, it should not close any dialer.
+	_ = conns[0].Close()
+	assert.EventuallyWithT(t, func(t *assert.CollectT) {
+		openDialers, closedDialers = tracker.count()
+		assert.Equal(t, 2, openDialers)
+		assert.Equal(t, 0, closedDialers)
+	}, time.Second, 100*time.Millisecond)
+
+	// Close the next 4 connections, it should close the first dialer.
+	for i := 1; i < 5; i++ {
+		_ = conns[i].Close()
+	}
+	assert.EventuallyWithT(t, func(t *assert.CollectT) {
+		openDialers, closedDialers = tracker.count()
+		assert.Equal(t, 1, openDialers)
+		assert.Equal(t, 1, closedDialers)
+	}, time.Second, 100*time.Millisecond)
+
+	// Close the next 5 connections, it should close the second dialer.
+	for i := 5; i < 10; i++ {
+		_ = conns[i].Close()
+	}
+	assert.EventuallyWithT(t, func(t *assert.CollectT) {
+		openDialers, closedDialers = tracker.count()
+		assert.Equal(t, 0, openDialers)
+		assert.Equal(t, 2, closedDialers)
+	}, time.Second, 100*time.Millisecond)
+
+	// Now we want to validate a weirder case, let's create 4 connections,
+	// close them and then create a fifth.
+	for i := 0; i < 4; i++ {
+		conn, _, err := cycler.DialHost(ctx, "", "", nil)
+		assert.NoError(t, err)
+		_ = conn.Close()
+	}
+	conn, _, err := cycler.DialHost(ctx, "", "", nil)
+	assert.NoError(t, err)
+	assert.EventuallyWithT(t, func(t *assert.CollectT) {
+		openDialers, closedDialers = tracker.count()
+		assert.Equal(t, 1, openDialers)
+		assert.Equal(t, 2, closedDialers)
+	}, time.Second, 100*time.Millisecond)
+	_ = conn.Close()
+	assert.EventuallyWithT(t, func(t *assert.CollectT) {
+		openDialers, closedDialers = tracker.count()
+		assert.Equal(t, 0, openDialers)
+		assert.Equal(t, 3, closedDialers)
+	}, time.Second, 100*time.Millisecond)
+}
diff --git a/lib/tbot/services/ssh/multiplexer_unix.go b/lib/tbot/services/ssh/multiplexer_unix.go
new file mode 100644
index 0000000000000..ac9f9a6c4a414
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer_unix.go
@@ -0,0 +1,79 @@
+//go:build unix
+
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"syscall"
+
+	"github.com/gravitational/trace"
+)
+
+// ConnectToSSHMultiplex connects to the SSH multiplexer and sends the target
+// to the multiplexer. It then returns the connection to the SSH multiplexer
+// over stdout.
+func ConnectToSSHMultiplex(ctx context.Context, socketPath string, target string, stdout *os.File) error {
+	outConn, err := net.FileConn(stdout)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer outConn.Close()
+	outUnix, ok := outConn.(*net.UnixConn)
+	if !ok {
+		return trace.BadParameter("expected stdout to be %T, got %T", outUnix, outConn)
+	}
+
+	c, err := new(net.Dialer).DialContext(ctx, "unix", socketPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer c.Close()
+
+	if _, err := fmt.Fprint(c, target, "\x00"); err != nil {
+		return trace.Wrap(err)
+	}
+
+	rawC, err := c.(*net.UnixConn).SyscallConn()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var innerErr error
+	if controlErr := rawC.Control(func(fd uintptr) {
+		// We have to write something in order to send a control message so
+		// we just write NUL.
+		_, _, innerErr = outUnix.WriteMsgUnix(
+			[]byte{0},
+			syscall.UnixRights(int(fd)),
+			nil,
+		)
+	}); controlErr != nil {
+		return trace.Wrap(controlErr)
+	}
+	if innerErr != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
diff --git a/lib/tbot/services/ssh/multiplexer_windows.go b/lib/tbot/services/ssh/multiplexer_windows.go
new file mode 100644
index 0000000000000..9440c0c9b84b8
--- /dev/null
+++ b/lib/tbot/services/ssh/multiplexer_windows.go
@@ -0,0 +1,35 @@
+//go:build windows
+
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import (
+	"context"
+	"os"
+
+	"github.com/gravitational/trace"
+)
+
+// ConnectToSSHMultiplex connects to the SSH multiplexer and sends the target
+// to the multiplexer. It then returns the connection to the SSH multiplexer
+// over stdout.
+func ConnectToSSHMultiplex(ctx context.Context, socketPath string, target string, stdout *os.File) error {
+	return trace.NotImplemented("SSH Multiplexing not supported on Windows.")
+}
diff --git a/lib/tbot/services/ssh/ssh.go b/lib/tbot/services/ssh/ssh.go
new file mode 100644
index 0000000000000..5f52232cd9bcc
--- /dev/null
+++ b/lib/tbot/services/ssh/ssh.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ssh
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/ssh")
diff --git a/lib/tbot/ssh_proxy.go b/lib/tbot/services/ssh/ssh_proxy.go
similarity index 98%
rename from lib/tbot/ssh_proxy.go
rename to lib/tbot/services/ssh/ssh_proxy.go
index 3a048f6a43570..553a1896b4af0 100644
--- a/lib/tbot/ssh_proxy.go
+++ b/lib/tbot/services/ssh/ssh_proxy.go
@@ -14,7 +14,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-package tbot
+package ssh
 
 import (
 	"context"
@@ -38,8 +38,8 @@ import (
 	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/identityfile"
 	"github.com/gravitational/teleport/lib/resumption"
-	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -276,7 +276,7 @@ func resolveTargetHostWithClient(
 }
 
 func parseIdentity(destPath, proxy, cluster string, insecure, fips bool) (*identity.Facade, agent.ExtendedAgent, error) {
-	identityPath := filepath.Join(destPath, config.IdentityFilePath)
+	identityPath := filepath.Join(destPath, internal.IdentityFilePath)
 	keyRing, err := identityfile.KeyRingFromIdentityFile(identityPath, proxy, cluster)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
diff --git a/lib/tbot/config/testdata/TestSSHHostOutput_YAML/full.golden b/lib/tbot/services/ssh/testdata/TestSSHHostOutput_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSSHHostOutput_YAML/full.golden
rename to lib/tbot/services/ssh/testdata/TestSSHHostOutput_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestSSHHostOutput_YAML/minimal.golden b/lib/tbot/services/ssh/testdata/TestSSHHostOutput_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSSHHostOutput_YAML/minimal.golden
rename to lib/tbot/services/ssh/testdata/TestSSHHostOutput_YAML/minimal.golden
diff --git a/lib/tbot/config/testdata/TestSSHMultiplexerService_YAML/full.golden b/lib/tbot/services/ssh/testdata/TestSSHMultiplexerService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestSSHMultiplexerService_YAML/full.golden
rename to lib/tbot/services/ssh/testdata/TestSSHMultiplexerService_YAML/full.golden
diff --git a/lib/tbot/services/workloadidentity/helpers_test.go b/lib/tbot/services/workloadidentity/helpers_test.go
new file mode 100644
index 0000000000000..dc0726ac45b38
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/helpers_test.go
@@ -0,0 +1,213 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package workloadidentity
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := new(bytes.Buffer)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(&tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			unmarshaled, err := internal.UnmarshalYAMLConfig[T](b)
+			require.NoError(t, err)
+			require.Equal(t, tt.in, *unmarshaled, "unmarshaling did not result in same object as input")
+		})
+	}
+}
+
+type checkAndSetDefaulter interface {
+	CheckAndSetDefaults() error
+}
+
+type testCheckAndSetDefaultsCase[T checkAndSetDefaulter] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the checkAndSetDefaulter after
+	// check and set defaults has been run. If want is nil, the Output is
+	// compared to its initial state.
+	want    checkAndSetDefaulter
+	wantErr string
+}
+
+func testCheckAndSetDefaults[T checkAndSetDefaulter](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	t.Helper()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
+
+func setWorkloadIdentityX509CAOverride(ctx context.Context, t *testing.T, process *service.TeleportProcess) {
+	const loadKeysFalse = false
+	spiffeCA, err := process.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{
+		DomainName: "root",
+		Type:       types.SPIFFECA,
+	}, loadKeysFalse)
+	require.NoError(t, err)
+
+	spiffeCAX509KeyPairs := spiffeCA.GetTrustedTLSKeyPairs()
+	require.Len(t, spiffeCAX509KeyPairs, 1)
+	spiffeCACert, err := tlsca.ParseCertificatePEM(spiffeCAX509KeyPairs[0].Cert)
+	require.NoError(t, err)
+
+	// this is a bit of a hack: by adding the self-signed CA certificate to the
+	// override chain we distribute a nonempty chain that we can test for, but
+	// all validations will continue working and it's technically not a broken
+	// intermediate chain (just a bit of a useless one)
+
+	// (this is an unsynced write but we know that nothing is issuing
+	// certificates just yet)
+	process.GetAuthServer().SetWorkloadIdentityX509CAOverrideGetter(&staticOverrideGetter{chain: [][]byte{spiffeCACert.Raw}})
+}
+
+type staticOverrideGetter struct {
+	chain [][]byte
+}
+
+var _ services.WorkloadIdentityX509CAOverrideGetter = (*staticOverrideGetter)(nil)
+
+// GetWorkloadIdentityX509CAOverride implements [services.WorkloadIdentityX509CAOverrideGetter].
+func (m *staticOverrideGetter) GetWorkloadIdentityX509CAOverride(ctx context.Context, name string, ca *tlsca.CertAuthority) (*tlsca.CertAuthority, [][]byte, error) {
+	return ca, m.chain, nil
+}
+
+// makeBot creates a server-side bot and returns joining parameters.
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
+	ctx := context.TODO()
+	t.Helper()
+
+	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+		Bot: &machineidv1pb.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: name,
+			},
+			Spec: &machineidv1pb.BotSpec{
+				Roles: roles,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
+	require.NoError(t, err)
+	tok, err := types.NewProvisionTokenFromSpec(
+		tokenName,
+		time.Now().Add(10*time.Minute),
+		types.ProvisionTokenSpecV2{
+			Roles:   []types.SystemRole{types.RoleBot},
+			BotName: b.Metadata.Name,
+		})
+	require.NoError(t, err)
+	err = client.CreateToken(ctx, tok)
+	require.NoError(t, err)
+
+	return &onboarding.Config{
+		TokenValue: tok.GetName(),
+		JoinMethod: types.JoinMethodToken,
+	}, b
+}
+
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		if err := testenv.WithClusterName("root")(o); err != nil {
+			return err
+		}
+		if err := testenv.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Logger = log
+			cfg.Proxy.PublicAddrs = []utils.NetAddr{
+				{AddrNetwork: "tcp", Addr: net.JoinHostPort("localhost", strconv.Itoa(cfg.Proxy.WebAddr.Port(0)))},
+			}
+			cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{
+				cfg.Proxy.ReverseTunnelListenAddr,
+			}
+		})(o); err != nil {
+			return err
+		}
+		return nil
+	}
+}
diff --git a/lib/tbot/services/workloadidentity/jwt_output.go b/lib/tbot/services/workloadidentity/jwt_output.go
new file mode 100644
index 0000000000000..1cf4fc75c2ff4
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/jwt_output.go
@@ -0,0 +1,274 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"log/slog"
+	"math"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+)
+
+func JWTOutputServiceBuilder(
+	cfg *JWTOutputConfig,
+	trustBundleCache TrustBundleGetter,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &JWTOutputService{
+			botAuthClient:             deps.Client,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			getBotIdentity:            deps.BotIdentity,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			trustBundleCache:          trustBundleCache,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(JWTOutputServiceType, cfg.Name, buildFn)
+}
+
+// JWTOutputService is a service that retrieves JWT workload identity
+// credentials for WorkloadIdentity resources.
+type JWTOutputService struct {
+	botAuthClient             *apiclient.Client
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *JWTOutputConfig
+	getBotIdentity            func() *identity.Identity
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	// trustBundleCache is the cache of trust bundles. It only needs to be
+	// provided when running in daemon mode.
+	trustBundleCache  TrustBundleGetter
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+// String returns a human-readable description of the service.
+func (s *JWTOutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("workload-identity-jwt (%s)", s.cfg.Destination.String()),
+	)
+}
+
+// OneShot runs the service once, generating the output and writing it to the
+// destination, before exiting.
+func (s *JWTOutputService) OneShot(ctx context.Context) error {
+	res, err := s.requestJWTSVID(ctx)
+	if err != nil {
+		return trace.Wrap(err, "requesting JWT SVID")
+	}
+	return s.render(ctx, res)
+}
+
+// Run runs the service in daemon mode, periodically generating the output and
+// writing it to the destination.
+func (s *JWTOutputService) Run(ctx context.Context) error {
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting trust bundle set")
+	}
+
+	jitter := retryutils.DefaultJitter
+	var cred *workloadidentityv1pb.Credential
+	var failures int
+	firstRun := make(chan struct{}, 1)
+	firstRun <- struct{}{}
+	for {
+		var retryAfter <-chan time.Time
+		if failures > 0 {
+			s.statusReporter.Report(readyz.Unhealthy)
+			backoffTime := min(time.Second*time.Duration(math.Pow(2, float64(failures-1))), time.Minute)
+			backoffTime = jitter(backoffTime)
+			s.log.WarnContext(
+				ctx,
+				"Last attempt to generate output failed, will retry",
+				"retry_after", backoffTime,
+				"failures", failures,
+			)
+			retryAfter = time.After(time.Duration(failures) * time.Second)
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-retryAfter:
+			s.log.InfoContext(ctx, "Retrying")
+		case <-bundleSet.Stale():
+			// We don't actually write this bundle out at the moment, but, we
+			// still track it so we know when to reissue the JWT SVID.
+			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err, "getting trust bundle set")
+			}
+			s.log.InfoContext(ctx, "Trust bundle set has been updated")
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the local trust domain CA has changed, we need to reissue
+				// the SVID.
+				cred = nil
+			}
+			bundleSet = newBundleSet
+		case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).RenewalInterval):
+			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
+			cred = nil
+		case <-firstRun:
+		}
+
+		if cred == nil {
+			var err error
+			cred, err = s.requestJWTSVID(ctx)
+			if err != nil {
+				s.log.ErrorContext(ctx, "Failed to request JWT SVID", "error", err)
+				failures++
+				continue
+			}
+		}
+		if err := s.render(ctx, cred); err != nil {
+			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
+			failures++
+			continue
+		}
+		s.statusReporter.Report(readyz.Healthy)
+		failures = 0
+	}
+}
+
+func (s *JWTOutputService) requestJWTSVID(
+	ctx context.Context,
+) (
+	*workloadidentityv1pb.Credential,
+	error,
+) {
+	ctx, span := tracer.Start(
+		ctx,
+		"JWTOutputService/requestJWTSVID",
+	)
+	defer span.End()
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating identity")
+	}
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	credentials, err := workloadidentity.IssueJWTWorkloadIdentity(
+		ctx,
+		s.log,
+		impersonatedClient,
+		s.cfg.Selector,
+		s.cfg.Audiences,
+		effectiveLifetime.TTL,
+		nil,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating JWT SVID")
+	}
+
+	var credential *workloadidentityv1pb.Credential
+	switch len(credentials) {
+	case 0:
+		return nil, trace.BadParameter("no JWT SVIDs returned")
+	case 1:
+		credential = credentials[0]
+	default:
+		// We could eventually implement some kind of hint selection mechanism
+		// to pick the "right" one.
+		received := make([]string, 0, len(credentials))
+		for _, cred := range credentials {
+			received = append(received,
+				fmt.Sprintf(
+					"%s:%s",
+					cred.WorkloadIdentityName,
+					cred.SpiffeId,
+				),
+			)
+		}
+		return nil, trace.BadParameter(
+			"multiple JWT SVIDs received: %v", received,
+		)
+	}
+
+	return credential, nil
+}
+
+func (s *JWTOutputService) render(
+	ctx context.Context,
+	cred *workloadidentityv1pb.Credential,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"JWTOutputService/render",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Rendering output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	if err := s.cfg.Destination.Write(
+		ctx, internal.JWTSVIDPath, []byte(cred.GetJwtSvid().GetJwt()),
+	); err != nil {
+		return trace.Wrap(err, "writing jwt svid")
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Successfully wrote JWT workload identity credential to destination",
+		"workload_identity", workloadidentity.WorkloadIdentityLogValue(cred),
+		"destination", s.cfg.Destination.String(),
+	)
+	return nil
+}
diff --git a/lib/tbot/services/workloadidentity/jwt_output_config.go b/lib/tbot/services/workloadidentity/jwt_output_config.go
new file mode 100644
index 0000000000000..0af5b54c4674e
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/jwt_output_config.go
@@ -0,0 +1,133 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const JWTOutputServiceType = "workload-identity-jwt"
+
+// X509OutputConfig is the configuration for the Workload Identity JWT output
+// service.
+type JWTOutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Selector is the selector for the WorkloadIdentity resource that will be
+	// used to issue WICs.
+	Selector bot.WorkloadIdentitySelector `yaml:"selector"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// Audiences is the list of audiences that the JWT should be valid for.
+	Audiences []string
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o JWTOutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *JWTOutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Init initializes the destination.
+func (o *JWTOutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+// CheckAndSetDefaults checks the WorkloadIdentityJWTService values and sets any defaults.
+func (o *JWTOutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	if err := o.Selector.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating selector")
+	}
+	if len(o.Audiences) == 0 {
+		return trace.BadParameter("audiences: must have at least one value")
+	}
+	return nil
+}
+
+// JWTSVIDPath is the name of the artifact that a JWT SVID will be written to.
+const JWTSVIDPath = "jwt_svid"
+
+// Describe returns the file descriptions for the WorkloadIdentityJWTService.
+func (o *JWTOutputConfig) Describe() []bot.FileDescription {
+	fds := []bot.FileDescription{
+		{
+			Name: internal.JWTSVIDPath,
+		},
+	}
+	return fds
+}
+
+func (o *JWTOutputConfig) Type() string {
+	return JWTOutputServiceType
+}
+
+// MarshalYAML marshals the WorkloadIdentityJWTService into YAML.
+func (o *JWTOutputConfig) MarshalYAML() (any, error) {
+	type raw JWTOutputConfig
+	return encoding.WithTypeHeader((*raw)(o), JWTOutputServiceType)
+}
+
+func (o *JWTOutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *JWTOutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw JWTOutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+// GetDestination returns the destination.
+func (o *JWTOutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+func (o *JWTOutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	lt := o.CredentialLifetime
+	lt.SkipMaxTTLValidation = true
+	return lt
+}
diff --git a/lib/tbot/services/workloadidentity/jwt_output_config_test.go b/lib/tbot/services/workloadidentity/jwt_output_config_test.go
new file mode 100644
index 0000000000000..03e0a7a315f6e
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/jwt_output_config_test.go
@@ -0,0 +1,155 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+)
+
+func TestWorkloadIdentityJWTService_YAML(t *testing.T) {
+	t.Parallel()
+
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[JWTOutputConfig]{
+		{
+			name: "full",
+			in: JWTOutputConfig{
+				Destination: dest,
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				Audiences: []string{"audience1", "audience2"},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestWorkloadIdentityJWTService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*JWTOutputConfig]{
+		{
+			name: "valid",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					Audiences: []string{"audience1", "audience2"},
+				}
+			},
+		},
+		{
+			name: "valid with labels",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					Audiences: []string{"audience1", "audience2"},
+				}
+			},
+		},
+		{
+			name: "missing audience",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+			wantErr: "audiences: must have at least one value",
+		},
+		{
+			name: "missing selectors",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Selector: bot.WorkloadIdentitySelector{},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					Audiences: []string{"audience1", "audience2"},
+				}
+			},
+			wantErr: "one of ['name', 'labels'] must be set",
+		},
+		{
+			name: "too many selectors",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+					Audiences: []string{"audience1", "audience2"},
+				}
+			},
+			wantErr: "at most one of ['name', 'labels'] can be set",
+		},
+		{
+			name: "missing destination",
+			in: func() *JWTOutputConfig {
+				return &JWTOutputConfig{
+					Destination: nil,
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Audiences: []string{"audience1", "audience2"},
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/workloadidentity/jwt_output_test.go b/lib/tbot/services/workloadidentity/jwt_output_test.go
new file mode 100644
index 0000000000000..cff91ddb2398d
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/jwt_output_test.go
@@ -0,0 +1,191 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestBotWorkloadIdentityJWT(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			WorkloadIdentityLabels: map[string]apiutils.Strings{
+				"foo": []string{"bar"},
+			},
+			Rules: []types.Rule{
+				{
+					Resources: []string{types.KindWorkloadIdentity},
+					Verbs:     []string{types.VerbRead, types.VerbList},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "foo-bar-bizz",
+			Labels: map[string]string{
+				"foo": "bar",
+			},
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id: "/valid/{{ user.bot_name }}",
+			},
+		},
+	}
+	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
+		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+			WorkloadIdentity: workloadIdentity,
+		})
+	require.NoError(t, err)
+
+	t.Run("By Name", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		onboarding, _ := makeBot(t, rootClient, "by-name", role.GetName())
+
+		proxyAddr, err := process.ProxyWebAddr()
+		require.NoError(t, err)
+
+		connCfg := connection.Config{
+			Address:     proxyAddr.Addr,
+			AddressKind: connection.AddressKindProxy,
+			Insecure:    true,
+		}
+
+		b, err := bot.New(bot.Config{
+			Connection: connCfg,
+			Logger:     log,
+			Onboarding: *onboarding,
+			Services: []bot.ServiceBuilder{
+				JWTOutputServiceBuilder(
+					&JWTOutputConfig{
+						Selector: bot.WorkloadIdentitySelector{
+							Name: workloadIdentity.GetMetadata().GetName(),
+						},
+						Destination: &destination.Directory{
+							Path: tmpDir,
+						},
+						Audiences: []string{"example", "foo"},
+					},
+					nil, // trustBundleCache
+					bot.DefaultCredentialLifetime,
+				),
+			},
+		})
+		require.NoError(t, err)
+
+		// Run Bot with 10 second timeout to catch hangs.
+		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+		defer cancel()
+		require.NoError(t, b.OneShot(ctx))
+
+		jwtBytes, err := os.ReadFile(filepath.Join(tmpDir, internal.JWTSVIDPath))
+		require.NoError(t, err)
+		jwt, err := jwtsvid.ParseInsecure(string(jwtBytes), []string{"example"})
+		require.NoError(t, err)
+		require.Equal(t, "spiffe://root/valid/by-name", jwt.ID.String())
+		require.Equal(t, []string{"example", "foo"}, jwt.Audience)
+	})
+	t.Run("By Labels", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		onboarding, _ := makeBot(t, rootClient, "by-labels", role.GetName())
+
+		authAddr, err := process.AuthAddr()
+		require.NoError(t, err)
+
+		connCfg := connection.Config{
+			Address:     authAddr.Addr,
+			AddressKind: connection.AddressKindAuth,
+			Insecure:    true,
+		}
+
+		b, err := bot.New(bot.Config{
+			Connection: connCfg,
+			Logger:     log,
+			Onboarding: *onboarding,
+			Services: []bot.ServiceBuilder{
+				JWTOutputServiceBuilder(
+					&JWTOutputConfig{
+						Selector: bot.WorkloadIdentitySelector{
+							Labels: map[string][]string{
+								"foo": {"bar"},
+							},
+						},
+						Destination: &destination.Directory{
+							Path: tmpDir,
+						},
+						Audiences: []string{"example"},
+					},
+					nil, // trustBundleCache
+					bot.DefaultCredentialLifetime,
+				),
+			},
+		})
+		require.NoError(t, err)
+
+		// Run Bot with 10 second timeout to catch hangs.
+		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+		defer cancel()
+		require.NoError(t, b.OneShot(ctx))
+
+		jwtBytes, err := os.ReadFile(filepath.Join(tmpDir, internal.JWTSVIDPath))
+		require.NoError(t, err)
+		jwt, err := jwtsvid.ParseInsecure(string(jwtBytes), []string{"example"})
+		require.NoError(t, err)
+		require.Equal(t, "spiffe://root/valid/by-labels", jwt.ID.String())
+		require.Equal(t, []string{"example"}, jwt.Audience)
+	})
+}
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/full.golden b/lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityAPIService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/full.golden
rename to lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityAPIService_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/minimal.golden b/lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityAPIService_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/minimal.golden
rename to lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityAPIService_YAML/minimal.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityJWTService_YAML/full.golden b/lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityJWTService_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityJWTService_YAML/full.golden
rename to lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityJWTService_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityX509Service_YAML/full.golden b/lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityX509Service_YAML/full.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityX509Service_YAML/full.golden
rename to lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityX509Service_YAML/full.golden
diff --git a/lib/tbot/config/testdata/TestWorkloadIdentityX509Service_YAML/minimal.golden b/lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityX509Service_YAML/minimal.golden
similarity index 100%
rename from lib/tbot/config/testdata/TestWorkloadIdentityX509Service_YAML/minimal.golden
rename to lib/tbot/services/workloadidentity/testdata/TestWorkloadIdentityX509Service_YAML/minimal.golden
diff --git a/lib/tbot/services/workloadidentity/workload_api.go b/lib/tbot/services/workloadidentity/workload_api.go
new file mode 100644
index 0000000000000..2dc7bacb98cf9
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/workload_api.go
@@ -0,0 +1,800 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"crypto/x509"
+	"fmt"
+	"log/slog"
+	"time"
+
+	secretv3pb "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	"github.com/gravitational/trace"
+	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
+	workloadpb "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/observability/metrics"
+	grpcmetrics "github.com/gravitational/teleport/lib/observability/metrics/grpc"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/sds"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/services/clientcredentials"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+	"github.com/gravitational/teleport/lib/uds"
+)
+
+func WorkloadAPIServiceBuilder(
+	cfg *WorkloadAPIConfig,
+	trustBundleCache TrustBundleGetter,
+	crlCache CRLGetter,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		sidecar, credential := clientcredentials.NewSidecar(deps, defaultCredentialLifetime)
+		svc := &WorkloadAPIService{
+			svcIdentity:               credential,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			trustBundleCache:          trustBundleCache,
+			crlCache:                  crlCache,
+			clientBuilder:             deps.ClientBuilder,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return bot.NewServicePair(svc, sidecar), nil
+	}
+	return bot.NewServiceBuilder(WorkloadAPIServiceType, cfg.Name, buildFn)
+}
+
+// WorkloadAPIService implements a gRPC server that fulfills the SPIFFE
+// Workload API specification. It provides X509 SVIDs and trust bundles to
+// workloads that connect over the configured listener.
+//
+// Sources:
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_Endpoint.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md
+// - https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
+type WorkloadAPIService struct {
+	workloadpb.UnimplementedSpiffeWorkloadAPIServer
+
+	svcIdentity               *clientcredentials.UnstableConfig
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *WorkloadAPIConfig
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	trustBundleCache          TrustBundleGetter
+	crlCache                  CRLGetter
+	clientBuilder             *client.Builder
+
+	// client holds the impersonated client for the service
+	client           *apiclient.Client
+	attestor         *workloadattest.Attestor
+	localTrustDomain spiffeid.TrustDomain
+}
+
+// setup initializes the service, performing tasks such as determining the
+// trust domain, fetching the initial trust bundle and creating an impersonated
+// client.
+func (s *WorkloadAPIService) setup(ctx context.Context) (err error) {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/setup")
+	defer span.End()
+
+	// Wait for the impersonated identity to be ready for us to consume here.
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(10 * time.Second):
+		return trace.BadParameter("timeout waiting for identity to be ready")
+	case <-s.svcIdentity.Ready():
+	}
+	facade, err := s.svcIdentity.Facade()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	client, err := s.clientBuilder.Build(ctx, facade)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.client = client
+	// Closure is managed by the caller if this function succeeds. But if it
+	// fails, we need to close the client.
+	defer func() {
+		if err != nil {
+			client.Close()
+		}
+	}()
+
+	td, err := spiffeid.TrustDomainFromString(facade.Get().ClusterName)
+	if err != nil {
+		return trace.Wrap(err, "parsing trust domain name")
+	}
+	s.localTrustDomain = td
+
+	s.attestor, err = workloadattest.NewAttestor(s.log, s.cfg.Attestors)
+	if err != nil {
+		return trace.Wrap(err, "setting up workload attestation")
+	}
+
+	return nil
+}
+
+func (s *WorkloadAPIService) Run(ctx context.Context) error {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/Run")
+	defer span.End()
+
+	s.log.DebugContext(ctx, "Starting pre-run initialization")
+	if err := s.setup(ctx); err != nil {
+		return trace.Wrap(err)
+	}
+	defer s.client.Close()
+	s.log.DebugContext(ctx, "Completed pre-run initialization")
+
+	srvMetrics := grpcmetrics.CreateGRPCServerMetrics(
+		true, prometheus.Labels{
+			teleport.TagServer: "tbot-workload-identity-api",
+		},
+	)
+	if err := metrics.RegisterPrometheusCollectors(srvMetrics); err != nil {
+		return trace.Wrap(err)
+	}
+	srv := grpc.NewServer(
+		grpc.Creds(
+			// SPEC (SPIFFE_Workload_endpoint) 3. Transport:
+			// - Transport Layer Security MUST NOT be required
+			// TODO(noah): We should optionally provide TLS support here down
+			// the road.
+			uds.NewTransportCredentials(insecure.NewCredentials()),
+		),
+		grpc.ChainUnaryInterceptor(
+			recovery.UnaryServerInterceptor(),
+			srvMetrics.UnaryServerInterceptor(),
+		),
+		grpc.ChainStreamInterceptor(
+			recovery.StreamServerInterceptor(),
+			srvMetrics.StreamServerInterceptor(),
+		),
+		grpc.StatsHandler(otelgrpc.NewServerHandler()),
+		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
+	)
+	workloadpb.RegisterSpiffeWorkloadAPIServer(srv, s)
+	sdsHandler, err := sds.NewHandler(sds.HandlerConfig{
+		Logger:           s.log,
+		RenewalInterval:  s.defaultCredentialLifetime.RenewalInterval,
+		TrustBundleCache: s.trustBundleCache,
+		ClientAuthenticator: func(ctx context.Context) (*slog.Logger, sds.SVIDFetcher, error) {
+			log, attrs, err := s.authenticateClient(ctx)
+			if err != nil {
+				return log, nil, trace.Wrap(err, "authenticating client")
+			}
+
+			fetchSVIDs := func(
+				ctx context.Context,
+				localBundle *spiffebundle.Bundle,
+			) ([]*workloadpb.X509SVID, error) {
+				return s.fetchX509SVIDs(ctx, log, localBundle, attrs)
+			}
+
+			return log, fetchSVIDs, nil
+		},
+	})
+	if err != nil {
+		return trace.Wrap(err, "creating SDS handler")
+	}
+	secretv3pb.RegisterSecretDiscoveryServiceServer(srv, sdsHandler)
+
+	lis, err := internal.CreateListener(ctx, s.log, s.cfg.Listen)
+	if err != nil {
+		return trace.Wrap(err, "creating listener")
+	}
+	defer func() {
+		if err := lis.Close(); err != nil {
+			s.log.ErrorContext(ctx, "Encountered error closing listener", "error", err)
+		}
+	}()
+	s.log.InfoContext(ctx, "Listener opened for Workload API endpoint", "addr", lis.Addr().String())
+	if lis.Addr().Network() == "tcp" {
+		s.log.WarnContext(
+			ctx, "Workload API endpoint listening on a TCP port. Ensure that only intended hosts can reach this port!",
+		)
+	}
+
+	// Set off the long running tasks in an errgroup
+	eg, egCtx := errgroup.WithContext(ctx)
+	eg.Go(func() error {
+		// Start the gRPC server
+		return srv.Serve(lis)
+	})
+	eg.Go(func() error {
+		// Shutdown the server when the context is canceled
+		<-egCtx.Done()
+		s.log.DebugContext(ctx, "Shutting down Workload API endpoint")
+		srv.Stop()
+		s.log.InfoContext(ctx, "Shut down Workload API endpoint")
+		return nil
+	})
+
+	s.statusReporter.Report(readyz.Healthy)
+	if err := eg.Wait(); err != nil {
+		s.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (s *WorkloadAPIService) authenticateClient(
+	ctx context.Context,
+) (*slog.Logger, *attrs.WorkloadAttrs, error) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return nil, nil, trace.BadParameter("peer not found in context")
+	}
+	log := s.log
+
+	if p.Addr.String() != "" {
+		log = log.With(
+			slog.String("remote_addr", p.Addr.String()),
+		)
+	}
+
+	authInfo, ok := p.AuthInfo.(uds.AuthInfo)
+	// We expect Creds to be nil/unset if the client is connecting via TCP and
+	// therefore there is no workload attestation that can be completed.
+	if !ok || authInfo.Creds == nil {
+		return log, nil, nil
+	}
+
+	// For a UDS, sometimes we are unable to determine the PID of the calling
+	// workload. This can happen if the caller is calling from another process
+	// namespace. In this case, Creds will be non-nil but the PID will be 0.
+	//
+	// We should fail softly here as there could be SVIDs that do not require
+	// workload attestation.
+	if authInfo.Creds.PID == 0 {
+		log.DebugContext(
+			ctx, "Failed to determine the PID of the calling workload. TBot may be running in a different process namespace to the workload. Workload attestation will not be completed.")
+		return log, nil, nil
+	}
+
+	att, err := s.attestor.Attest(ctx, authInfo.Creds.PID)
+	if err != nil {
+		// Fail softly as there may be SVIDs configured that don't require any
+		// workload attestation and we should still issue those.
+		log.ErrorContext(
+			ctx,
+			"Workload attestation failed",
+			"error", err,
+			"pid", authInfo.Creds.PID,
+		)
+		return log, nil, nil
+	}
+	log = log.With("workload", att)
+
+	return log, att, nil
+}
+
+// FetchX509SVID generates and returns the X.509 SVIDs available to a workload.
+// It is a streaming RPC, and sends renewed SVIDs to the client before they
+// expire.
+// Implements the SPIFFE Workload API FetchX509SVID method.
+func (s *WorkloadAPIService) FetchX509SVID(
+	_ *workloadpb.X509SVIDRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchX509SVIDServer,
+) (err error) {
+	ctx := srv.Context()
+
+	log, creds, err := s.authenticateClient(ctx)
+	if err != nil {
+		return trace.Wrap(err, "authenticating client")
+	}
+
+	log.InfoContext(ctx, "FetchX509SVID stream opened by workload")
+	defer func() {
+		if err != nil {
+			s.log.ErrorContext(
+				ctx,
+				"FetchX509SVID stream closed with error",
+				"err", err,
+			)
+			return
+		}
+		s.log.InfoContext(ctx, "FetchX509SVID stream has closed")
+	}()
+
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "fetching trust bundle set from cache")
+	}
+	crlSet, err := s.crlCache.GetCRLSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "fetching CRL set from cache")
+	}
+	renewalInterval := cmp.Or(
+		s.cfg.CredentialLifetime, s.defaultCredentialLifetime,
+	).RenewalInterval
+
+	var svids []*workloadpb.X509SVID
+	renewalTimer := time.NewTimer(renewalInterval)
+	defer renewalTimer.Stop()
+	for {
+		log.InfoContext(ctx, "Starting to issue X509 SVIDs to workload")
+
+		// Fetch SVIDs if necessary.
+		if svids == nil {
+			svids, err = s.fetchX509SVIDs(ctx, log, bundleSet.Local, creds)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			// Reset our renewal timer to renew these freshly fetched SVIDs
+			// renewal_interval from now.
+			renewalTimer.Reset(renewalInterval)
+
+			// The SPIFFE Workload API (5.2.1):
+			//
+			//   If the client is not entitled to receive any X509-SVIDs, then the
+			//   server SHOULD respond with the "PermissionDenied" gRPC status code (see
+			//   the Error Codes section in the SPIFFE Workload Endpoint specification
+			//   for more information). Under such a case, the client MAY attempt to
+			//   reconnect with another call to the FetchX509SVID RPC after a backoff.
+			if len(svids) == 0 {
+				log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
+				return status.Error(
+					codes.PermissionDenied,
+					"workload did not pass attestation for any SVIDs",
+				)
+			}
+		}
+
+		resp := &workloadpb.X509SVIDResponse{
+			Svids:            svids,
+			FederatedBundles: bundleSet.EncodedX509Bundles(false),
+		}
+		if len(crlSet.LocalCRL) > 0 {
+			resp.Crl = [][]byte{crlSet.LocalCRL}
+		}
+
+		err = srv.Send(resp)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		log.DebugContext(
+			ctx, "Finished issuing SVIDs to workload. Waiting for next renewal interval or CA rotation",
+		)
+
+		select {
+		case <-ctx.Done():
+			log.DebugContext(ctx, "Context closed, stopping SVID stream")
+			return nil
+		case <-bundleSet.Stale():
+			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			log.DebugContext(ctx, "Federated trust bundles have been updated, renewing SVIDs")
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the "local" trust domain's CA has changed, we need to
+				// reissue the SVIDs.
+				svids = nil
+			}
+			bundleSet = newBundleSet
+			continue
+		case <-crlSet.Stale():
+			newCRLSet, err := s.crlCache.GetCRLSet(ctx)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			log.DebugContext(ctx, "CRL set has been updated, distributing to client")
+			crlSet = newCRLSet
+			continue
+		case <-renewalTimer.C:
+			log.DebugContext(ctx, "Renewal interval reached, renewing SVIDs")
+			svids = nil
+			continue
+		}
+	}
+}
+
+// FetchX509Bundles returns the trust bundle for the trust domain. It is a
+// streaming RPC, and will send rotated trust bundles to the client for as long
+// as the client is connected.
+// Implements the SPIFFE Workload API FetchX509SVID method.
+func (s *WorkloadAPIService) FetchX509Bundles(
+	_ *workloadpb.X509BundlesRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchX509BundlesServer,
+) (err error) {
+	ctx := srv.Context()
+	s.log.InfoContext(ctx, "FetchX509Bundles stream opened by workload")
+	defer func() {
+		if err != nil {
+			s.log.ErrorContext(
+				ctx,
+				"FetchX509Bundles stream closed with error",
+				"err", err,
+			)
+			return
+		}
+		s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
+	}()
+
+	for {
+		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+		if err != nil {
+			return trace.Wrap(err, "fetching trust bundle set from cache")
+		}
+		crlSet, err := s.crlCache.GetCRLSet(ctx)
+		if err != nil {
+			return trace.Wrap(err, "fetching CRL set from cache")
+		}
+
+		s.log.InfoContext(ctx, "Sending X.509 trust bundles to workload")
+		resp := &workloadpb.X509BundlesResponse{
+			Bundles: bundleSet.EncodedX509Bundles(true),
+		}
+		if len(crlSet.LocalCRL) > 0 {
+			resp.Crl = [][]byte{crlSet.LocalCRL}
+		}
+		err = srv.Send(resp)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-bundleSet.Stale():
+			s.log.DebugContext(ctx, "Trust bundle set has been updated, distributing to client")
+		case <-crlSet.Stale():
+			s.log.DebugContext(ctx, "CRL set has been updated, distributing to client")
+		}
+	}
+}
+
+// fetchX509SVIDs fetches the X.509 SVIDs for the bot's configured SVIDs and
+// returns them in the SPIFFE Workload API format.
+func (s *WorkloadAPIService) fetchX509SVIDs(
+	ctx context.Context,
+	log *slog.Logger,
+	localBundle *spiffebundle.Bundle,
+	attest *attrs.WorkloadAttrs,
+) ([]*workloadpb.X509SVID, error) {
+	ctx, span := tracer.Start(ctx, "WorkloadAPIService/fetchX509SVIDs")
+	defer span.End()
+
+	creds, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
+		ctx,
+		log,
+		s.client,
+		s.cfg.Selector,
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL,
+		attest,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(creds) == 0 {
+		s.attestor.Failed(ctx, attest)
+	}
+
+	// Convert the private key to PKCS#8 format as per SPIFFE spec.
+	pkcs8PrivateKey, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	marshaledBundle := workloadidentity.MarshalX509Bundle(localBundle.X509Bundle())
+
+	// Convert responses from the Teleport API to the SPIFFE Workload API
+	// format.
+	svids := make([]*workloadpb.X509SVID, len(creds))
+	for i, cred := range creds {
+		var svid bytes.Buffer
+		svid.Write(cred.GetX509Svid().GetCert())
+		for _, c := range cred.GetX509Svid().Chain {
+			svid.Write(c)
+		}
+		svids[i] = &workloadpb.X509SVID{
+			// Required. The SPIFFE ID of the SVID in this entry
+			SpiffeId: cred.SpiffeId,
+			// Required. ASN.1 DER encoded certificate chain. MAY include
+			// intermediates, the leaf certificate (or SVID itself) MUST come first.
+			X509Svid: svid.Bytes(),
+			// Required. ASN.1 DER encoded PKCS#8 private key. MUST be unencrypted.
+			X509SvidKey: pkcs8PrivateKey,
+			// Required. ASN.1 DER encoded X.509 bundle for the trust domain.
+			Bundle: marshaledBundle,
+			Hint:   cred.Hint,
+		}
+		// Log a message which correlates with the audit log entry and can
+		// provide additional metadata about the client.
+		log.InfoContext(ctx,
+			"Issued Workload Identity Credential",
+			slog.Group("credential",
+				"type", "x509-svid",
+				"spiffe_id", cred.SpiffeId,
+				"serial_number", cred.GetX509Svid().GetSerialNumber(),
+				"hint", cred.Hint,
+				"expires_at", cred.ExpiresAt,
+				"ttl", cred.Ttl,
+				"workload_identity_name", cred.WorkloadIdentityName,
+				"workload_identity_revision", cred.WorkloadIdentityRevision,
+			),
+		)
+	}
+
+	return svids, nil
+}
+
+// FetchJWTSVID implements the SPIFFE Workload API FetchJWTSVID method.
+// See The SPIFFE Workload API (6.2.1).
+func (s *WorkloadAPIService) FetchJWTSVID(
+	ctx context.Context,
+	req *workloadpb.JWTSVIDRequest,
+) (res *workloadpb.JWTSVIDResponse, err error) {
+	log, attr, err := s.authenticateClient(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "authenticating client")
+	}
+
+	log.InfoContext(ctx, "FetchJWTSVID request received from workload")
+	defer func() {
+		if err != nil {
+			s.log.ErrorContext(
+				ctx,
+				"FetchJWTSVID request handling failed",
+				"err", err,
+			)
+			return
+		}
+		s.log.InfoContext(ctx, "FetchJWTSVID request handled")
+	}()
+	if req.SpiffeId == "" {
+		log = log.With("requested_spiffe_id", req.SpiffeId)
+	}
+
+	// The SPIFFE Workload API (6.2.1):
+	// > The JWTSVIDRequest request message contains a mandatory audience field,
+	// > which MUST contain the value to embed in the audience claim of the
+	// > returned JWT-SVIDs.
+	if len(req.Audience) == 0 {
+		return nil, trace.BadParameter("audience: must have at least one value")
+	}
+
+	creds, err := workloadidentity.IssueJWTWorkloadIdentity(
+		ctx,
+		log,
+		s.client,
+		s.cfg.Selector,
+		req.Audience,
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL,
+		attr,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// The SPIFFE Workload API (6.2.1):
+	// > If the client is not authorized for any identities, or not authorized
+	// > for the specific identity requested via the spiffe_id field, then the
+	// > server SHOULD respond with the "PermissionDenied" gRPC status code.
+	if len(creds) == 0 {
+		log.ErrorContext(ctx, "Workload did not pass attestation for any SVIDs")
+		s.attestor.Failed(ctx, attr)
+		return nil, status.Error(
+			codes.PermissionDenied,
+			"workload did not pass attestation for any SVIDs",
+		)
+	}
+
+	svids := []*workloadpb.JWTSVID{}
+	for _, cred := range creds {
+		svids = append(svids, &workloadpb.JWTSVID{
+			SpiffeId: cred.SpiffeId,
+			Svid:     cred.GetJwtSvid().GetJwt(),
+			Hint:     cred.Hint,
+		})
+		log.InfoContext(ctx,
+			"Issued Workload Identity Credential",
+			slog.Group("credential",
+				"type", "jwt-svid",
+				"spiffe_id", cred.SpiffeId,
+				"jti", cred.GetJwtSvid().GetJti(),
+				"hint", cred.Hint,
+				"expires_at", cred.ExpiresAt,
+				"ttl", cred.Ttl,
+				"audiences", req.Audience,
+			),
+		)
+	}
+
+	// The SPIFFE Workload API (6.2.1):
+	// > The spiffe_id field is optional, and is used to request a JWT-SVID for
+	// > a specific SPIFFE ID. If unspecified, the server MUST return JWT-SVIDs
+	// > for all identities authorized for the client.
+	// TODO(noah): We should optimize here by making the Teleport
+	// WorkloadIdentityIssuance API aware of the requested SPIFFE ID. Theres's
+	// no point signing a credential to just bin it here...
+	if req.SpiffeId != "" {
+		requestedSPIFFEID, err := spiffeid.FromString(req.SpiffeId)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing requested SPIFFE ID")
+		}
+		if requestedSPIFFEID.TrustDomain() != s.localTrustDomain {
+			return nil, trace.BadParameter("requested SPIFFE ID is not in the local trust domain")
+		}
+
+		// Search through available SVIDs to find the one that matches the
+		// requested SPIFFE ID.
+		found := false
+		for _, svid := range svids {
+			if svid.SpiffeId == req.SpiffeId {
+				found = true
+				svids = []*workloadpb.JWTSVID{svid}
+				break
+			}
+		}
+		if !found {
+			log.ErrorContext(ctx, "Workload is not authorized for the specifically requested SPIFFE ID", "requested_spiffe_id", req.SpiffeId)
+			return nil, status.Error(
+				codes.PermissionDenied,
+				"workload is not authorized for requested SPIFFE ID",
+			)
+		}
+	}
+
+	return &workloadpb.JWTSVIDResponse{
+		Svids: svids,
+	}, nil
+}
+
+// FetchJWTBundles implements the SPIFFE Workload API FetchJWTBundles method.
+// See The SPIFFE Workload API (6.2.2).
+func (s *WorkloadAPIService) FetchJWTBundles(
+	_ *workloadpb.JWTBundlesRequest,
+	srv workloadpb.SpiffeWorkloadAPI_FetchJWTBundlesServer,
+) (err error) {
+	ctx := srv.Context()
+	s.log.InfoContext(ctx, "FetchJWTBundles stream started by workload")
+	defer func() {
+		if err != nil {
+			s.log.ErrorContext(
+				ctx,
+				"FetchJWTBundles stream closed with error",
+				"err", err,
+			)
+			return
+		}
+		s.log.InfoContext(ctx, "FetchJWTBundles stream has closed")
+	}()
+
+	for {
+		bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		s.log.InfoContext(ctx, "Sending JWT trust bundles to workload")
+
+		// The SPIFFE Workload API (6.2.2):
+		// > The returned bundles are encoded as a standard JWK Set as defined
+		// > by RFC 7517 containing the JWT-SVID signing keys for the trust
+		// > domain. These keys may only represent a subset of the keys present
+		// > in the SPIFFE trust bundle for the trust domain. The server MUST
+		// > NOT include keys with other uses in the returned JWT bundles.
+		bundles, err := bundleSet.MarshaledJWKSBundles(true)
+		if err != nil {
+			return trace.Wrap(err, "marshaling bundles as JWKS")
+		}
+		err = srv.Send(&workloadpb.JWTBundlesResponse{
+			Bundles: bundles,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-bundleSet.Stale():
+		}
+	}
+}
+
+// ValidateJWTSVID implements the SPIFFE Workload API ValidateJWTSVID method.
+// See The SPIFFE Workload API (6.2.3).
+func (s *WorkloadAPIService) ValidateJWTSVID(
+	ctx context.Context,
+	req *workloadpb.ValidateJWTSVIDRequest,
+) (res *workloadpb.ValidateJWTSVIDResponse, err error) {
+	s.log.InfoContext(ctx, "ValidateJWTSVID request received from workload")
+	defer func() {
+		if err != nil {
+			s.log.ErrorContext(
+				ctx,
+				"ValidateJWTSVID request handling failed",
+				"err", err,
+			)
+			return
+		}
+		s.log.InfoContext(ctx, "ValidateJWTSVID request handled")
+	}()
+	// The SPIFFE Workload API (6.2.3):
+	// > All fields in the ValidateJWTSVIDRequest and ValidateJWTSVIDResponse
+	// > message are mandatory.
+	switch {
+	case req.Audience == "":
+		return nil, trace.BadParameter("audience: must be set")
+	case req.Svid == "":
+		return nil, trace.BadParameter("svid: must be set")
+	}
+
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	svid, err := jwtsvid.ParseAndValidate(
+		req.Svid, bundleSet, []string{req.Audience},
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "validating JWT SVID")
+	}
+
+	claims, err := structpb.NewStruct(svid.Claims)
+	if err != nil {
+		return nil, trace.Wrap(err, "marshaling claims")
+	}
+
+	return &workloadpb.ValidateJWTSVIDResponse{
+		SpiffeId: svid.ID.String(),
+		Claims:   claims,
+	}, nil
+}
+
+// String returns a human-readable string that can uniquely identify the
+// service.
+func (s *WorkloadAPIService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("%s:%s", WorkloadAPIServiceType, s.cfg.Listen),
+	)
+}
diff --git a/lib/tbot/services/workloadidentity/workload_api_config.go b/lib/tbot/services/workloadidentity/workload_api_config.go
new file mode 100644
index 0000000000000..d3e69fb89fc63
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/workload_api_config.go
@@ -0,0 +1,97 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+)
+
+const WorkloadAPIServiceType = "workload-identity-api"
+
+// WorkloadAPIConfig is the configuration for the Workload Identity API service.
+type WorkloadAPIConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Listen is the address on which the SPIFFE Workload API server should
+	// listen. This should either be prefixed with "unix://" or "tcp://".
+	Listen string `yaml:"listen"`
+	// Attestors is the configuration for the workload attestation process.
+	Attestors workloadattest.Config `yaml:"attestors"`
+	// Selector is the selector for the WorkloadIdentity resource that
+	// will be used to issue WICs.
+	Selector bot.WorkloadIdentitySelector `yaml:"selector"`
+
+	// CredentialLifetime contains configuration for how long X.509 SVIDs will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
+func (o *WorkloadAPIConfig) CheckAndSetDefaults() error {
+	if o.Listen == "" {
+		return trace.BadParameter("listen: should not be empty")
+	}
+	if err := o.Attestors.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating attestor")
+	}
+	if err := o.Selector.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating selector")
+	}
+	return nil
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o *WorkloadAPIConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *WorkloadAPIConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Type returns the type of the service.
+func (o *WorkloadAPIConfig) Type() string {
+	return WorkloadAPIServiceType
+}
+
+// MarshalYAML marshals the WorkloadIdentityOutput into YAML.
+func (o *WorkloadAPIConfig) MarshalYAML() (any, error) {
+	type raw WorkloadAPIConfig
+	return encoding.WithTypeHeader((*raw)(o), WorkloadAPIServiceType)
+}
+
+// UnmarshalYAML unmarshals the WorkloadIdentityOutput from YAML.
+func (o *WorkloadAPIConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw WorkloadAPIConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (o *WorkloadAPIConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	lt := o.CredentialLifetime
+	lt.SkipMaxTTLValidation = true
+	return lt
+}
diff --git a/lib/tbot/services/workloadidentity/workload_api_config_test.go b/lib/tbot/services/workloadidentity/workload_api_config_test.go
new file mode 100644
index 0000000000000..22063e844b167
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/workload_api_config_test.go
@@ -0,0 +1,159 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+)
+
+func TestWorkloadIdentityAPIService_YAML(t *testing.T) {
+	t.Parallel()
+
+	tests := []testYAMLCase[WorkloadAPIConfig]{
+		{
+			name: "full",
+			in: WorkloadAPIConfig{
+				Listen: "tcp://0.0.0.0:4040",
+				Attestors: workloadattest.Config{
+					Kubernetes: workloadattest.KubernetesAttestorConfig{
+						Enabled: true,
+						Kubelet: workloadattest.KubeletClientConfig{
+							SecurePort: 12345,
+							TokenPath:  "/path/to/token",
+							CAPath:     "/path/to/ca.pem",
+							SkipVerify: true,
+							Anonymous:  true,
+						},
+					},
+				},
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: WorkloadAPIConfig{
+				Listen: "tcp://0.0.0.0:4040",
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*WorkloadAPIConfig]{
+		{
+			name: "valid",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Listen: "tcp://0.0.0.0:4040",
+				}
+			},
+			want: &WorkloadAPIConfig{
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				Listen: "tcp://0.0.0.0:4040",
+				Attestors: workloadattest.Config{
+					Unix: workloadattest.UnixAttestorConfig{
+						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
+					},
+				},
+			},
+		},
+		{
+			name: "valid with labels",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Listen: "tcp://0.0.0.0:4040",
+				}
+			},
+			want: &WorkloadAPIConfig{
+				Selector: bot.WorkloadIdentitySelector{
+					Labels: map[string][]string{
+						"key": {"value"},
+					},
+				},
+				Listen: "tcp://0.0.0.0:4040",
+				Attestors: workloadattest.Config{
+					Unix: workloadattest.UnixAttestorConfig{
+						BinaryHashMaxSizeBytes: workloadattest.DefaultBinaryHashMaxBytes,
+					},
+				},
+			},
+		},
+		{
+			name: "missing selectors",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{},
+					Listen:   "tcp://0.0.0.0:4040",
+				}
+			},
+			wantErr: "one of ['name', 'labels'] must be set",
+		},
+		{
+			name: "too many selectors",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Listen: "tcp://0.0.0.0:4040",
+				}
+			},
+			wantErr: "at most one of ['name', 'labels'] can be set",
+		},
+		{
+			name: "missing listen",
+			in: func() *WorkloadAPIConfig {
+				return &WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+				}
+			},
+			wantErr: "listen: should not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/workloadidentity/workload_api_test.go b/lib/tbot/services/workloadidentity/workload_api_test.go
new file mode 100644
index 0000000000000..19fa40ebd33ec
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/workload_api_test.go
@@ -0,0 +1,245 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/spiffe/go-spiffe/v2/proto/spiffe/workload"
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestBotWorkloadIdentityAPI(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	log := logtest.NewLogger()
+
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	setWorkloadIdentityX509CAOverride(ctx, t, process)
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			WorkloadIdentityLabels: map[string]apiutils.Strings{
+				"foo": []string{"bar"},
+			},
+			Rules: []types.Rule{
+				{
+					Resources: []string{types.KindWorkloadIdentity},
+					Verbs:     []string{types.VerbRead, types.VerbList},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "foo-bar-bizz",
+			Labels: map[string]string{
+				"foo": "bar",
+			},
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id: "/valid/{{ user.bot_name }}/{{ workload.unix.pid }}",
+			},
+		},
+	}
+	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
+		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+			WorkloadIdentity: workloadIdentity,
+		})
+	require.NoError(t, err)
+
+	tmpDir := t.TempDir()
+	listenAddr := url.URL{
+		Scheme: "unix",
+		Path:   filepath.Join(tmpDir, "workload.sock"),
+	}
+	onboarding, _ := makeBot(t, rootClient, "api", role.GetName())
+
+	authAddr, err := process.AuthAddr()
+	require.NoError(t, err)
+
+	connCfg := connection.Config{
+		Address:     authAddr.Addr,
+		AddressKind: connection.AddressKindAuth,
+		Insecure:    true,
+	}
+	require.NoError(t, err)
+
+	trustBundleCache := workloadidentity.NewTrustBundleCacheFacade()
+	crlCache := workloadidentity.NewCRLCacheFacade()
+
+	b, err := bot.New(bot.Config{
+		Connection: connCfg,
+		Logger:     log,
+		Onboarding: *onboarding,
+		Services: []bot.ServiceBuilder{
+			trustBundleCache.Builder(),
+			crlCache.Builder(),
+			WorkloadAPIServiceBuilder(
+				&WorkloadAPIConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: workloadIdentity.GetMetadata().GetName(),
+					},
+					Listen: listenAddr.String(),
+					Attestors: workloadattest.Config{
+						Unix: workloadattest.UnixAttestorConfig{
+							BinaryHashMaxSizeBytes: workloadattest.TestBinaryHashMaxBytes,
+						},
+					},
+				},
+				trustBundleCache,
+				crlCache,
+				bot.DefaultCredentialLifetime,
+			),
+		},
+	})
+	require.NoError(t, err)
+
+	// Spin up goroutine for bot to run in
+	botCtx, cancelBot := context.WithCancel(ctx)
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := b.Run(botCtx)
+		assert.NoError(t, err, "bot should not exit with error")
+		cancelBot()
+	}()
+	t.Cleanup(func() {
+		// Shut down bot and make sure it exits.
+		cancelBot()
+		wg.Wait()
+	})
+
+	// Wait for the socket to be ready before trying to connect. The SPIFFE SDK
+	// and gRPC should handle this for us, but we've seen this test flake in CI.
+	require.Eventually(t, func() bool {
+		_, err := os.Stat(listenAddr.String())
+		return err != nil
+	}, 5*time.Second, 100*time.Millisecond, "socket not ready within 5s")
+
+	client, err := workloadapi.New(ctx, workloadapi.WithAddr(listenAddr.String()))
+	require.NoError(t, err)
+
+	source, err := workloadapi.NewX509Source(
+		ctx,
+		workloadapi.WithClient(client),
+	)
+	require.NoError(t, err)
+	defer source.Close()
+
+	// Test FetchX509SVID
+	svid, err := source.GetX509SVID()
+	require.NoError(t, err)
+
+	expectedSPIFFEID := fmt.Sprintf("spiffe://root/valid/api/%d", os.Getpid())
+	require.Equal(t, expectedSPIFFEID, svid.ID.String())
+	// the override includes a chain with a single certificate
+	require.Len(t, svid.Certificates, 2)
+	require.Equal(t, expectedSPIFFEID, svid.Certificates[0].URIs[0].String())
+	_, _, err = x509svid.Verify(svid.Certificates, source)
+	require.NoError(t, err)
+
+	// Test FetchX509Bundles
+	set, err := client.FetchX509Bundles(ctx)
+	require.NoError(t, err)
+	_, _, err = x509svid.Verify(svid.Certificates, set)
+	require.NoError(t, err)
+
+	// Test FetchJWTSVID
+	jwtSVID, err := client.FetchJWTSVID(ctx, jwtsvid.Params{
+		Audience: "example.com",
+	})
+	require.NoError(t, err)
+
+	// Check against ValidateJWTSVID
+	parsed, err := client.ValidateJWTSVID(ctx, jwtSVID.Marshal(), "example.com")
+	require.NoError(t, err)
+	require.Equal(t, expectedSPIFFEID, parsed.ID.String())
+	// Perform local validation with bundles from FetchJWTBundles
+	jwtBundles, err := client.FetchJWTBundles(ctx)
+	require.NoError(t, err)
+	_, err = jwtsvid.ParseAndValidate(jwtSVID.Marshal(), jwtBundles, []string{"example.com"})
+	require.NoError(t, err)
+
+	// Check CRL is delivered - we have to manually craft the client for this
+	// since the current go-spiffe SDK doesn't support this.
+	// TODO(noah): I'll raise some changes upstream to add CRL field support to
+	// the go-spiffe SDK, and then we can remove this code.
+	conn, err := grpc.NewClient(
+		listenAddr.String(),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	require.NoError(t, err)
+	spiffeWorkloadAPI := workload.NewSpiffeWorkloadAPIClient(conn)
+	stream, err := spiffeWorkloadAPI.FetchX509SVID(ctx, &workload.X509SVIDRequest{})
+	require.NoError(t, err)
+
+	resp, err := stream.Recv()
+	require.NoError(t, err)
+	require.Len(t, resp.Crl, 1)
+	crl, err := x509.ParseRevocationList(resp.Crl[0])
+	require.NoError(t, err)
+	require.Empty(t, crl.RevokedCertificateEntries)
+	tb, ok := set.Get(svid.ID.TrustDomain())
+	require.True(t, ok)
+	require.NoError(t, crl.CheckSignatureFrom(tb.X509Authorities()[0]))
+}
diff --git a/lib/tbot/services/workloadidentity/workloadidentity.go b/lib/tbot/services/workloadidentity/workloadidentity.go
new file mode 100644
index 0000000000000..5b9415fac5c7c
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/workloadidentity.go
@@ -0,0 +1,23 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package workloadidentity
+
+import "go.opentelemetry.io/otel"
+
+var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot/services/workloadidentity")
diff --git a/lib/tbot/services/workloadidentity/x509_output.go b/lib/tbot/services/workloadidentity/x509_output.go
new file mode 100644
index 0000000000000..bdc012d7ece06
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/x509_output.go
@@ -0,0 +1,383 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"log/slog"
+	"math"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/client"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
+	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
+)
+
+type TrustBundleGetter interface {
+	GetBundleSet(ctx context.Context) (*workloadidentity.BundleSet, error)
+}
+
+type CRLGetter interface {
+	GetCRLSet(ctx context.Context) (*workloadidentity.CRLSet, error)
+}
+
+func X509OutputServiceBuilder(
+	cfg *X509OutputConfig,
+	trustBundleCache TrustBundleGetter,
+	crlCache CRLGetter,
+	defaultCredentialLifetime bot.CredentialLifetime,
+) bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		if err := cfg.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		svc := &X509OutputService{
+			botAuthClient:             deps.Client,
+			defaultCredentialLifetime: defaultCredentialLifetime,
+			cfg:                       cfg,
+			getBotIdentity:            deps.BotIdentity,
+			identityGenerator:         deps.IdentityGenerator,
+			clientBuilder:             deps.ClientBuilder,
+			trustBundleCache:          trustBundleCache,
+			crlCache:                  crlCache,
+			log:                       deps.Logger,
+			statusReporter:            deps.GetStatusReporter(),
+		}
+		return svc, nil
+	}
+	return bot.NewServiceBuilder(X509OutputServiceType, cfg.Name, buildFn)
+}
+
+// X509OutputService is a service that retrieves X.509 certificates
+// for WorkloadIdentity resources.
+type X509OutputService struct {
+	botAuthClient             *apiclient.Client
+	defaultCredentialLifetime bot.CredentialLifetime
+	cfg                       *X509OutputConfig
+	getBotIdentity            func() *identity.Identity
+	log                       *slog.Logger
+	statusReporter            readyz.Reporter
+	// trustBundleCache is the cache of trust bundles. It only needs to be
+	// provided when running in daemon mode.
+	trustBundleCache  TrustBundleGetter
+	crlCache          CRLGetter
+	identityGenerator *identity.Generator
+	clientBuilder     *client.Builder
+}
+
+// String returns a human-readable description of the service.
+func (s *X509OutputService) String() string {
+	return cmp.Or(
+		s.cfg.Name,
+		fmt.Sprintf("workload-identity-x509 (%s)", s.cfg.Destination.String()),
+	)
+}
+
+// OneShot runs the service once, generating the output and writing it to the
+// destination, before exiting.
+func (s *X509OutputService) OneShot(ctx context.Context) error {
+	res, privateKey, err := s.requestSVID(ctx)
+	if err != nil {
+		return trace.Wrap(err, "requesting SVID")
+	}
+	bundleSet, err := workloadidentity.FetchInitialBundleSet(
+		ctx,
+		s.log,
+		s.botAuthClient.SPIFFEFederationServiceClient(),
+		s.botAuthClient.TrustClient(),
+		s.cfg.IncludeFederatedTrustBundles,
+		s.getBotIdentity().ClusterName,
+	)
+	if err != nil {
+		return trace.Wrap(err, "fetching trust bundle set")
+	}
+	crlSet, err := workloadidentity.FetchCRLSet(
+		ctx,
+		s.botAuthClient.WorkloadIdentityRevocationServiceClient(),
+	)
+	if err != nil {
+		return trace.Wrap(err, "fetching CRL set")
+	}
+
+	return s.render(ctx, bundleSet, res, privateKey, crlSet)
+}
+
+// Run runs the service in daemon mode, periodically generating the output and
+// writing it to the destination.
+func (s *X509OutputService) Run(ctx context.Context) error {
+	bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting trust bundle set")
+	}
+	crlSet, err := s.crlCache.GetCRLSet(ctx)
+	if err != nil {
+		return trace.Wrap(err, "getting CRL set from cache")
+	}
+	renewalInterval := cmp.Or(
+		s.cfg.CredentialLifetime, s.defaultCredentialLifetime,
+	).RenewalInterval
+
+	jitter := retryutils.DefaultJitter
+	var x509Cred *workloadidentityv1pb.Credential
+	var privateKey crypto.Signer
+	var failures int
+	firstRun := make(chan struct{}, 1)
+	firstRun <- struct{}{}
+	renewalTimer := time.NewTimer(renewalInterval)
+	defer renewalTimer.Stop()
+	for {
+		var retryAfter <-chan time.Time
+		if failures > 0 {
+			s.statusReporter.Report(readyz.Unhealthy)
+			backoffTime := min(time.Second*time.Duration(math.Pow(2, float64(failures-1))), time.Minute)
+			backoffTime = jitter(backoffTime)
+			s.log.WarnContext(
+				ctx,
+				"Last attempt to generate output failed, will retry",
+				"retry_after", backoffTime,
+				"failures", failures,
+			)
+			retryAfter = time.After(time.Duration(failures) * time.Second)
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-retryAfter:
+			s.log.InfoContext(ctx, "Retrying")
+		case <-bundleSet.Stale():
+			newBundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
+			if err != nil {
+				return trace.Wrap(err, "getting trust bundle set")
+			}
+			s.log.InfoContext(ctx, "Trust bundle set has been updated, will regenerate output")
+			if !newBundleSet.Local.Equal(bundleSet.Local) {
+				// If the local trust domain CA has changed, we need to reissue
+				// the SVID.
+				x509Cred = nil
+				privateKey = nil
+			}
+			bundleSet = newBundleSet
+		case <-crlSet.Stale():
+			newCRLSet, err := s.crlCache.GetCRLSet(ctx)
+			if err != nil {
+				return trace.Wrap(err, "getting CRL set from cache")
+			}
+			crlSet = newCRLSet
+			s.log.DebugContext(ctx, "CRL set has been updated, will regenerate output")
+		case <-renewalTimer.C:
+			s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
+			x509Cred = nil
+			privateKey = nil
+		case <-firstRun:
+		}
+
+		if x509Cred == nil || privateKey == nil {
+			var err error
+			x509Cred, privateKey, err = s.requestSVID(ctx)
+			if err != nil {
+				s.log.ErrorContext(ctx, "Failed to request SVID", "error", err)
+				failures++
+				continue
+			}
+			// Reset the renewal timer to the configured interval.
+			renewalTimer.Reset(renewalInterval)
+		}
+		if err := s.render(
+			ctx, bundleSet, x509Cred, privateKey, crlSet,
+		); err != nil {
+			s.log.ErrorContext(ctx, "Failed to render output", "error", err)
+			failures++
+			continue
+		}
+		s.statusReporter.Report(readyz.Healthy)
+		failures = 0
+	}
+}
+
+func (s *X509OutputService) requestSVID(
+	ctx context.Context,
+) (
+	*workloadidentityv1pb.Credential,
+	crypto.Signer,
+	error,
+) {
+	ctx, span := tracer.Start(
+		ctx,
+		"X509OutputService/requestSVID",
+	)
+	defer span.End()
+
+	effectiveLifetime := cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime)
+	id, err := s.identityGenerator.GenerateFacade(ctx,
+		identity.WithLifetime(effectiveLifetime.TTL, effectiveLifetime.RenewalInterval),
+		identity.WithLogger(s.log),
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "generating identity")
+	}
+
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err := s.clientBuilder.Build(ctx, id)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	defer impersonatedClient.Close()
+
+	x509Credentials, privateKey, err := workloadidentity.IssueX509WorkloadIdentity(
+		ctx,
+		s.log,
+		impersonatedClient,
+		s.cfg.Selector,
+		cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL,
+		nil,
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "generating X509 SVID")
+	}
+	var x509Credential *workloadidentityv1pb.Credential
+	switch len(x509Credentials) {
+	case 0:
+		return nil, nil, trace.BadParameter("no X509 SVIDs returned")
+	case 1:
+		x509Credential = x509Credentials[0]
+	default:
+		// We could eventually implement some kind of hint selection mechanism
+		// to pick the "right" one.
+		received := make([]string, 0, len(x509Credentials))
+		for _, cred := range x509Credentials {
+			received = append(received,
+				fmt.Sprintf(
+					"%s:%s",
+					cred.WorkloadIdentityName,
+					cred.SpiffeId,
+				),
+			)
+		}
+		return nil, nil, trace.BadParameter(
+			"multiple X509 SVIDs received: %v", received,
+		)
+	}
+
+	return x509Credential, privateKey, nil
+}
+
+func (s *X509OutputService) render(
+	ctx context.Context,
+	bundleSet *workloadidentity.BundleSet,
+	x509Cred *workloadidentityv1pb.Credential,
+	privateKey crypto.Signer,
+	crlSet *workloadidentity.CRLSet,
+) error {
+	ctx, span := tracer.Start(
+		ctx,
+		"X509OutputService/render",
+	)
+	defer span.End()
+	s.log.InfoContext(ctx, "Rendering output")
+
+	// Check the ACLs. We can't fix them, but we can warn if they're
+	// misconfigured. We'll need to precompute a list of keys to check.
+	// Note: This may only log a warning, depending on configuration.
+	if err := s.cfg.Destination.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		return trace.Wrap(err)
+	}
+	// Ensure this destination is also writable. This is a hard fail if
+	// ACLs are misconfigured, regardless of configuration.
+	if err := identity.VerifyWrite(ctx, s.cfg.Destination); err != nil {
+		return trace.Wrap(err, "verifying destination")
+	}
+
+	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	privPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  internal.PEMBlockTypePrivateKey,
+		Bytes: privBytes,
+	})
+
+	if err := s.cfg.Destination.Write(ctx, internal.SVIDKeyPEMPath, privPEM); err != nil {
+		return trace.Wrap(err, "writing svid key")
+	}
+
+	var certPEM bytes.Buffer
+	pem.Encode(&certPEM, &pem.Block{
+		Type:  internal.PEMBlockTypeCertificate,
+		Bytes: x509Cred.GetX509Svid().GetCert(),
+	})
+	for _, c := range x509Cred.GetX509Svid().GetChain() {
+		pem.Encode(&certPEM, &pem.Block{
+			Type:  internal.PEMBlockTypeCertificate,
+			Bytes: c,
+		})
+	}
+	if err := s.cfg.Destination.Write(ctx, internal.SVIDPEMPath, certPEM.Bytes()); err != nil {
+		return trace.Wrap(err, "writing svid certificate")
+	}
+
+	trustBundleBytes, err := bundleSet.Local.X509Bundle().Marshal()
+	if err != nil {
+		return trace.Wrap(err, "marshaling local trust bundle")
+	}
+
+	if s.cfg.IncludeFederatedTrustBundles {
+		for _, federatedBundle := range bundleSet.Federated {
+			federatedBundleBytes, err := federatedBundle.X509Bundle().Marshal()
+			if err != nil {
+				return trace.Wrap(err, "marshaling federated trust bundle (%s)", federatedBundle.TrustDomain().Name())
+			}
+			trustBundleBytes = append(trustBundleBytes, federatedBundleBytes...)
+		}
+	}
+
+	if err := s.cfg.Destination.Write(
+		ctx, internal.SVIDTrustBundlePEMPath, trustBundleBytes,
+	); err != nil {
+		return trace.Wrap(err, "writing svid trust bundle")
+	}
+
+	crlBytes := crlSet.Marshal()
+	if len(crlBytes) > 0 {
+		if err := s.cfg.Destination.Write(ctx, internal.SVIDCRLPemPath, crlBytes); err != nil {
+			return trace.Wrap(err, "writing CRL")
+		}
+	}
+
+	s.log.InfoContext(
+		ctx,
+		"Successfully wrote X509 workload identity credential to destination",
+		"workload_identity", workloadidentity.WorkloadIdentityLogValue(x509Cred),
+		"destination", s.cfg.Destination.String(),
+	)
+	return nil
+}
diff --git a/lib/tbot/services/workloadidentity/x509_output_config.go b/lib/tbot/services/workloadidentity/x509_output_config.go
new file mode 100644
index 0000000000000..cc2f7b186b0b2
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/x509_output_config.go
@@ -0,0 +1,137 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/encoding"
+)
+
+const X509OutputServiceType = "workload-identity-x509"
+
+// X509OutputConfig is the configuration for the Workload Identity x509 output
+// service. // Emulates the output of https://github.com/spiffe/spiffe-helper
+type X509OutputConfig struct {
+	// Name of the service for logs and the /readyz endpoint.
+	Name string `yaml:"name,omitempty"`
+	// Selector is the selector for the WorkloadIdentity resource that will be
+	// used to issue WICs.
+	Selector bot.WorkloadIdentitySelector `yaml:"selector"`
+	// Destination is where the credentials should be written to.
+	Destination destination.Destination `yaml:"destination"`
+	// IncludeFederatedTrustBundles controls whether to include federated trust
+	// bundles in the output.
+	IncludeFederatedTrustBundles bool `yaml:"include_federated_trust_bundles,omitempty"`
+
+	// CredentialLifetime contains configuration for how long credentials will
+	// last and the frequency at which they'll be renewed.
+	CredentialLifetime bot.CredentialLifetime `yaml:",inline"`
+}
+
+// GetName returns the user-given name of the service, used for validation purposes.
+func (o X509OutputConfig) GetName() string {
+	return o.Name
+}
+
+// SetName sets the service's name to an automatically generated one.
+func (o *X509OutputConfig) SetName(name string) {
+	o.Name = name
+}
+
+// Init initializes the destination.
+func (o *X509OutputConfig) Init(ctx context.Context) error {
+	return trace.Wrap(o.Destination.Init(ctx, []string{}))
+}
+
+// GetDestination returns the destination.
+func (o *X509OutputConfig) GetDestination() destination.Destination {
+	return o.Destination
+}
+
+// CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
+func (o *X509OutputConfig) CheckAndSetDefaults() error {
+	if o.Destination == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := o.Destination.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating destination")
+	}
+	if err := o.Selector.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating selector")
+	}
+	return nil
+}
+
+// Describe returns the file descriptions for the WorkloadIdentityX509Service.
+func (o *X509OutputConfig) Describe() []bot.FileDescription {
+	fds := []bot.FileDescription{
+		{
+			Name: internal.SVIDPEMPath,
+		},
+		{
+			Name: internal.SVIDKeyPEMPath,
+		},
+		{
+			Name: internal.SVIDTrustBundlePEMPath,
+		},
+		{
+			Name: internal.SVIDCRLPemPath,
+		},
+	}
+	return fds
+}
+
+func (o *X509OutputConfig) Type() string {
+	return X509OutputServiceType
+}
+
+// MarshalYAML marshals the WorkloadIdentityX509Service into YAML.
+func (o *X509OutputConfig) MarshalYAML() (any, error) {
+	type raw X509OutputConfig
+	return encoding.WithTypeHeader((*raw)(o), X509OutputServiceType)
+}
+
+func (o *X509OutputConfig) UnmarshalYAML(*yaml.Node) error {
+	return trace.NotImplemented("unmarshaling %T with UnmarshalYAML is not supported, use UnmarshalConfig instead", o)
+}
+
+func (o *X509OutputConfig) UnmarshalConfig(ctx bot.UnmarshalConfigContext, node *yaml.Node) error {
+	dest, err := internal.ExtractOutputDestination(ctx, node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid getting our "not implemented" error
+	type raw X509OutputConfig
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *X509OutputConfig) GetCredentialLifetime() bot.CredentialLifetime {
+	lt := o.CredentialLifetime
+	lt.SkipMaxTTLValidation = true
+	return lt
+}
diff --git a/lib/tbot/services/workloadidentity/x509_output_config_test.go b/lib/tbot/services/workloadidentity/x509_output_config_test.go
new file mode 100644
index 0000000000000..0a238fa2f977c
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/x509_output_config_test.go
@@ -0,0 +1,140 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+)
+
+func TestWorkloadIdentityX509Service_YAML(t *testing.T) {
+	t.Parallel()
+
+	dest := &destination.Memory{}
+	tests := []testYAMLCase[X509OutputConfig]{
+		{
+			name: "full",
+			in: X509OutputConfig{
+				Destination: dest,
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+				IncludeFederatedTrustBundles: true,
+				CredentialLifetime: bot.CredentialLifetime{
+					TTL:             1 * time.Minute,
+					RenewalInterval: 30 * time.Second,
+				},
+			},
+		},
+		{
+			name: "minimal",
+			in: X509OutputConfig{
+				Destination: dest,
+				Selector: bot.WorkloadIdentitySelector{
+					Name: "my-workload-identity",
+				},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestWorkloadIdentityX509Service_CheckAndSetDefaults(t *testing.T) {
+	t.Parallel()
+
+	tests := []testCheckAndSetDefaultsCase[*X509OutputConfig]{
+		{
+			name: "valid",
+			in: func() *X509OutputConfig {
+				return &X509OutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+		},
+		{
+			name: "valid with labels",
+			in: func() *X509OutputConfig {
+				return &X509OutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+		},
+		{
+			name: "missing selectors",
+			in: func() *X509OutputConfig {
+				return &X509OutputConfig{
+					Selector: bot.WorkloadIdentitySelector{},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+			wantErr: "one of ['name', 'labels'] must be set",
+		},
+		{
+			name: "too many selectors",
+			in: func() *X509OutputConfig {
+				return &X509OutputConfig{
+					Selector: bot.WorkloadIdentitySelector{
+						Name: "my-workload-identity",
+						Labels: map[string][]string{
+							"key": {"value"},
+						},
+					},
+					Destination: &destination.Directory{
+						Path:     "/opt/machine-id",
+						ACLs:     botfs.ACLOff,
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				}
+			},
+			wantErr: "at most one of ['name', 'labels'] can be set",
+		},
+		{
+			name: "missing destination",
+			in: func() *X509OutputConfig {
+				return &X509OutputConfig{
+					Destination: nil,
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/services/workloadidentity/x509_output_test.go b/lib/tbot/services/workloadidentity/x509_output_test.go
new file mode 100644
index 0000000000000..b9bd6e464f354
--- /dev/null
+++ b/lib/tbot/services/workloadidentity/x509_output_test.go
@@ -0,0 +1,232 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package workloadidentity
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/pem"
+	"os"
+	"path"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestBotWorkloadIdentityX509(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	setWorkloadIdentityX509CAOverride(ctx, t, process)
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	role, err := types.NewRole("issue-foo", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			WorkloadIdentityLabels: map[string]apiutils.Strings{
+				"foo": []string{"bar"},
+			},
+			Rules: []types.Rule{
+				{
+					Resources: []string{types.KindWorkloadIdentity},
+					Verbs:     []string{types.VerbRead, types.VerbList},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	role, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: "foo-bar-bizz",
+			Labels: map[string]string{
+				"foo": "bar",
+			},
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id: "/valid/{{ user.bot_name }}",
+			},
+		},
+	}
+	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
+		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+			WorkloadIdentity: workloadIdentity,
+		})
+	require.NoError(t, err)
+
+	checkCRL := func(t *testing.T, tmpDir string, bundle *x509bundle.Bundle) {
+		crlPEM, err := os.ReadFile(filepath.Join(tmpDir, internal.SVIDCRLPemPath))
+		require.NoError(t, err)
+		crlBytes, _ := pem.Decode(crlPEM)
+		crl, err := x509.ParseRevocationList(crlBytes.Bytes)
+		require.NoError(t, err)
+		require.NoError(t, crl.CheckSignatureFrom(bundle.X509Authorities()[0]))
+	}
+
+	t.Run("By Name", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		onboarding, _ := makeBot(t, rootClient, "by-name", role.GetName())
+
+		proxyAddr, err := process.ProxyWebAddr()
+		require.NoError(t, err)
+
+		connCfg := connection.Config{
+			Address:     proxyAddr.Addr,
+			AddressKind: connection.AddressKindProxy,
+			Insecure:    true,
+		}
+
+		b, err := bot.New(bot.Config{
+			Connection: connCfg,
+			Logger:     log,
+			Onboarding: *onboarding,
+			Services: []bot.ServiceBuilder{
+				X509OutputServiceBuilder(
+					&X509OutputConfig{
+						Selector: bot.WorkloadIdentitySelector{
+							Name: workloadIdentity.GetMetadata().GetName(),
+						},
+						Destination: &destination.Directory{
+							Path: tmpDir,
+						},
+					},
+					nil, // trustBundleCache
+					nil, // crlCache
+					bot.DefaultCredentialLifetime,
+				),
+			},
+		})
+		require.NoError(t, err)
+
+		// Run Bot with 10 second timeout to catch hangs.
+		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+		defer cancel()
+		require.NoError(t, b.OneShot(ctx))
+
+		svid, err := x509svid.Load(
+			path.Join(tmpDir, internal.SVIDPEMPath),
+			path.Join(tmpDir, internal.SVIDKeyPEMPath),
+		)
+		require.NoError(t, err)
+		require.Equal(t, "spiffe://root/valid/by-name", svid.ID.String())
+		// the override includes a chain with a single certificate
+		require.Len(t, svid.Certificates, 2)
+
+		// Validate the trust bundle was written to disk, and, that our SVID
+		// appears valid according to the trust bundle.
+		td := spiffeid.RequireTrustDomainFromString("root")
+		bundle, err := x509bundle.Load(
+			td, filepath.Join(tmpDir, internal.SVIDTrustBundlePEMPath),
+		)
+		require.NoError(t, err)
+		_, _, err = x509svid.Verify(svid.Certificates, bundle)
+		require.NoError(t, err)
+
+		checkCRL(t, tmpDir, bundle)
+	})
+	t.Run("By Labels", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		onboarding, _ := makeBot(t, rootClient, "by-labels", role.GetName())
+
+		proxyAddr, err := process.ProxyWebAddr()
+		require.NoError(t, err)
+
+		connCfg := connection.Config{
+			Address:     proxyAddr.Addr,
+			AddressKind: connection.AddressKindProxy,
+			Insecure:    true,
+		}
+
+		b, err := bot.New(bot.Config{
+			Connection: connCfg,
+			Logger:     log,
+			Onboarding: *onboarding,
+			Services: []bot.ServiceBuilder{
+				X509OutputServiceBuilder(
+					&X509OutputConfig{
+						Selector: bot.WorkloadIdentitySelector{
+							Labels: map[string][]string{
+								"foo": {"bar"},
+							},
+						},
+						Destination: &destination.Directory{
+							Path: tmpDir,
+						},
+					},
+					nil,                           // trustBundleCache
+					nil,                           // crlCache
+					bot.DefaultCredentialLifetime, // defaultCredentialLifetime
+				),
+			},
+		})
+		require.NoError(t, err)
+
+		// Run Bot with 10 second timeout to catch hangs.
+		ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+		defer cancel()
+		require.NoError(t, b.OneShot(ctx))
+
+		svid, err := x509svid.Load(
+			path.Join(tmpDir, internal.SVIDPEMPath),
+			path.Join(tmpDir, internal.SVIDKeyPEMPath),
+		)
+		require.NoError(t, err)
+		require.Equal(t, "spiffe://root/valid/by-labels", svid.ID.String())
+
+		// Validate the trust bundle was written to disk, and, that our SVID
+		// appears valid according to the trust bundle.
+		td := spiffeid.RequireTrustDomainFromString("root")
+		bundle, err := x509bundle.Load(
+			td, filepath.Join(tmpDir, internal.SVIDTrustBundlePEMPath),
+		)
+		require.NoError(t, err)
+		_, _, err = x509svid.Verify(svid.Certificates, bundle)
+		require.NoError(t, err)
+
+		checkCRL(t, tmpDir, bundle)
+	})
+}
diff --git a/lib/tbot/tbot.go b/lib/tbot/tbot.go
index b3cde8c9afb46..aaba54081fbed 100644
--- a/lib/tbot/tbot.go
+++ b/lib/tbot/tbot.go
@@ -21,79 +21,58 @@ package tbot
 import (
 	"context"
 	"errors"
-	"fmt"
 	"log/slog"
-	"net"
-	"os"
+	"runtime"
 	"sync"
-	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
-	"golang.org/x/sync/errgroup"
-	"golang.org/x/sync/singleflight"
-	"google.golang.org/grpc"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/client/webclient"
-	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
-	"github.com/gravitational/teleport/api/metadata"
+	apiclient "github.com/gravitational/teleport/api/client"
 	apitracing "github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/observability/metrics"
-	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	grpcmetrics "github.com/gravitational/teleport/lib/observability/metrics/grpc"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/internal/diagnostics"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/awsra"
+	"github.com/gravitational/teleport/lib/tbot/services/clientcredentials"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	"github.com/gravitational/teleport/lib/tbot/services/example"
+	identitysvc "github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/tbot/services/legacyspiffe"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
+	workloadidentitysvc "github.com/gravitational/teleport/lib/tbot/services/workloadidentity"
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/process"
 )
 
 var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tbot")
 
-var clientMetrics = metrics.CreateGRPCClientMetrics(
+var clientMetrics = grpcmetrics.CreateGRPCClientMetrics(
 	false,
 	prometheus.Labels{},
 )
 
-const componentTBot = "tbot"
-
-// Service is a long-running sub-component of tbot.
-type Service interface {
-	// String returns a human-readable name for the service that can be used
-	// in logging. It should identify the type of the service and any top
-	// level configuration that could distinguish it from a same-type service.
-	String() string
-	// Run starts the service and blocks until the service exits. It should
-	// return a nil error if the service exits successfully and an error
-	// if it is unable to proceed. It should exit gracefully if the context
-	// is canceled.
-	Run(ctx context.Context) error
-}
-
-// OneShotService is a [Service] that offers a mode in which it runs a single
-// time and then exits. This aligns with the `--oneshot` mode of tbot.
-type OneShotService interface {
-	Service
-	// OneShot runs the service once and then exits. It should return a nil
-	// error if the service exits successfully and an error if it is unable
-	// to proceed. It should exit gracefully if the context is canceled.
-	OneShot(ctx context.Context) error
-}
-
 type Bot struct {
 	cfg     *config.BotConfig
 	log     *slog.Logger
 	modules modules.Modules
 
-	mu             sync.Mutex
-	started        bool
-	botIdentitySvc *identityService
+	mu       sync.Mutex
+	started  bool
+	identity getBotIdentityFn
+	client   *apiclient.Client
 }
 
 func New(cfg *config.BotConfig, log *slog.Logger) *Bot {
@@ -122,24 +101,40 @@ func (b *Bot) markStarted() error {
 
 type getBotIdentityFn func() *identity.Identity
 
-// BotIdentity returns the bot's own identity. This will return nil if the bot
-// has not been started.
-func (b *Bot) BotIdentity() *identity.Identity {
-	return b.botIdentitySvc.GetIdentity()
+// getBotIdentity returns the bot's own identity. This will return nil if the
+// bot has not been started.
+func (b *Bot) getBotIdentity() *identity.Identity {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.identity()
+}
+
+// getClient returns the bot's API client. This will return nil if the bot has
+// not been started.
+func (b *Bot) getClient() *apiclient.Client {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.client
 }
 
 func (b *Bot) Run(ctx context.Context) (err error) {
 	ctx, span := tracer.Start(ctx, "Bot/Run")
 	defer func() { apitracing.EndSpan(span, err) }()
-	startedAt := time.Now()
+
+	b.log.InfoContext(
+		ctx, "Initializing tbot",
+		"version", versionLogValue(),
+	)
 
 	if err := metrics.RegisterPrometheusCollectors(
 		metrics.BuildCollector(),
 		clientMetrics,
-		loopIterationsCounter,
-		loopIterationsSuccessCounter,
-		loopIterationsFailureCounter,
-		loopIterationTime,
+		internal.LoopIterationsCounter,
+		internal.LoopIterationsSuccessCounter,
+		internal.LoopIterationsFailureCounter,
+		internal.LoopIterationTime,
 	); err != nil {
 		return trace.Wrap(err)
 	}
@@ -162,521 +157,165 @@ func (b *Bot) Run(ctx context.Context) (err error) {
 		return trace.Wrap(err)
 	}
 
-	addr, addrKind := b.cfg.Address()
-	var resolver reversetunnelclient.Resolver
-	if shouldUseProxyAddr() {
-		if addrKind != config.AddressKindProxy {
-			return trace.BadParameter("TBOT_USE_PROXY_ADDR requires that a proxy address is set using --proxy-server or proxy_server")
-		}
-		// If the user has indicated they want tbot to prefer using the proxy
-		// address they have configured, we use a static resolver set to this
-		// address. We also assume that they have TLS routing/multiplexing
-		// enabled, since otherwise we'd need them to manually configure an
-		// an entry for each kind of address.
-		resolver = reversetunnelclient.StaticResolver(
-			addr, types.ProxyListenerMode_Multiplex,
-		)
-	} else {
-		resolver, err = reversetunnelclient.CachingResolver(
-			ctx,
-			reversetunnelclient.WebClientResolver(&webclient.Config{
-				Context:   ctx,
-				ProxyAddr: addr,
-				Insecure:  b.cfg.Insecure,
-			}),
-			nil /* clock */)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
+	alpnUpgradeCache := internal.NewALPNUpgradeCache(b.log)
 
-	// Create an error group to manage all the services lifetimes.
-	eg, egCtx := errgroup.WithContext(ctx)
-	var services []Service
+	var services []bot.ServiceBuilder
 
-	// ReloadBroadcaster allows multiple entities to trigger a reload of
-	// all services. This allows os signals and other events such as CA
-	// rotations to trigger appropriate renewals.
-	reloadBroadcaster := &channelBroadcaster{
-		chanSet: map[chan struct{}]struct{}{},
-	}
-	// Trigger reloads from an configured reload channel.
-	if b.cfg.ReloadCh != nil {
-		// We specifically do not use the error group here as we do not want
-		// this goroutine to block the bot from exiting.
-		go func() {
-			for {
-				select {
-				case <-egCtx.Done():
-					return
-				case <-b.cfg.ReloadCh:
-					reloadBroadcaster.broadcast()
-				}
-			}
-		}()
+	if b.cfg.DiagAddr != "" {
+		services = append(services,
+			diagnostics.ServiceBuilder(diagnostics.Config{
+				Address: b.cfg.DiagAddr,
+				Logger: b.log.With(
+					teleport.ComponentKey,
+					teleport.Component(teleport.ComponentTBot, "diagnostics"),
+				),
+				PProfEnabled: b.cfg.Debug,
+			}),
+		)
 	}
 
-	b.botIdentitySvc = &identityService{
-		cfg:               b.cfg,
-		reloadBroadcaster: reloadBroadcaster,
-		resolver:          resolver,
-		log: b.log.With(
-			teleport.ComponentKey, teleport.Component(componentTBot, "identity"),
-		),
-	}
-	// Initialize bot's own identity. This will load from disk, or fetch a new
-	// identity, and perform an initial renewal if necessary.
-	if err := b.botIdentitySvc.Initialize(ctx); err != nil {
-		return trace.Wrap(err)
+	if b.cfg.DiagSocketForUpdater != "" {
+		services = append(services,
+			diagnostics.ServiceBuilder(diagnostics.Config{
+				Address: b.cfg.DiagSocketForUpdater,
+				Network: "unix",
+				Logger: b.log.With(
+					teleport.ComponentKey,
+					teleport.Component(teleport.ComponentTBot, "diagnostics-updater"),
+				),
+			}),
+		)
 	}
-	defer func() {
-		if err := b.botIdentitySvc.Close(); err != nil {
-			b.log.ErrorContext(
-				ctx,
-				"Failed to close bot identity service",
-				"error", err,
-			)
-		}
-	}()
-	services = append(services, b.botIdentitySvc)
 
-	authPingCache := &authPingCache{
-		client: b.botIdentitySvc.GetClient(),
-		log:    b.log,
-	}
-	proxyPingCache := &proxyPingCache{
-		authPingCache: authPingCache,
-		botCfg:        b.cfg,
-		log:           b.log,
-	}
-	alpnUpgradeCache := &alpnProxyConnUpgradeRequiredCache{
-		botCfg: b.cfg,
-		log:    b.log,
+	// create the new pid file only after started successfully
+	if b.cfg.PIDFile != "" {
+		if err := process.CreateLockedPIDFile(b.cfg.PIDFile); err != nil {
+			return trace.Wrap(err, "creating pidfile")
+		}
 	}
 
-	// Setup all other services
-	if b.cfg.DiagAddr != "" {
-		services = append(services, &diagnosticsService{
-			diagAddr:     b.cfg.DiagAddr,
-			pprofEnabled: b.cfg.Debug,
-			log: b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "diagnostics"),
-			),
-		})
-	}
+	// This faux service allows us to get the bot's internal identity and client
+	// for tests, without exposing them on the core bot.Bot struct.
+	if b.cfg.Testing {
+		services = append(services,
+			bot.NewServiceBuilder("internal/client-fetcher", "client-fetcher",
+				func(deps bot.ServiceDependencies) (bot.Service, error) {
+					b.mu.Lock()
+					defer b.mu.Unlock()
 
-	services = append(services, &heartbeatService{
-		now:       time.Now,
-		botCfg:    b.cfg,
-		startedAt: startedAt,
-		log: b.log.With(
-			teleport.ComponentKey, teleport.Component(componentTBot, "heartbeat"),
-		),
-		heartbeatSubmitter: machineidv1pb.NewBotInstanceServiceClient(
-			b.botIdentitySvc.GetClient().GetConnection(),
-		),
-		interval:   time.Minute * 30,
-		retryLimit: 5,
-	})
+					b.identity = deps.BotIdentity
+					b.client = deps.Client
 
-	services = append(services, &caRotationService{
-		getBotIdentity: b.botIdentitySvc.GetIdentity,
-		botClient:      b.botIdentitySvc.GetClient(),
-		log: b.log.With(
-			teleport.ComponentKey, teleport.Component(componentTBot, "ca-rotation"),
-		),
-		reloadBroadcaster: reloadBroadcaster,
-	})
+					return bot.NewNopService("client-fetcher"), nil
+				}),
+		)
+	}
 
 	// We only want to create this service if it's needed by a dependent
 	// service.
-	var trustBundleCache *workloadidentity.TrustBundleCache
-	setupTrustBundleCache := func() (*workloadidentity.TrustBundleCache, error) {
+	var trustBundleCache *workloadidentity.TrustBundleCacheFacade
+	setupTrustBundleCache := func() *workloadidentity.TrustBundleCacheFacade {
+		if b.cfg.Oneshot {
+			return nil
+		}
 		if trustBundleCache != nil {
-			return trustBundleCache, nil
+			return trustBundleCache
 		}
+		trustBundleCache = workloadidentity.NewTrustBundleCacheFacade()
+		services = append(services, trustBundleCache.Builder())
+		return trustBundleCache
+	}
 
-		var err error
-		trustBundleCache, err = workloadidentity.NewTrustBundleCache(workloadidentity.TrustBundleCacheConfig{
-			FederationClient: b.botIdentitySvc.GetClient().SPIFFEFederationServiceClient(),
-			TrustClient:      b.botIdentitySvc.GetClient().TrustClient(),
-			EventsClient:     b.botIdentitySvc.GetClient(),
-			ClusterName:      b.botIdentitySvc.GetIdentity().ClusterName,
-			Logger: b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "spiffe-trust-bundle-cache"),
-			),
-		})
-		if err != nil {
-			return nil, trace.Wrap(err)
+	var crlCache *workloadidentity.CRLCacheFacade
+	setupCRLCache := func() *workloadidentity.CRLCacheFacade {
+		if b.cfg.Oneshot {
+			return nil
 		}
-		services = append(services, trustBundleCache)
-		return trustBundleCache, nil
-	}
-	var crlCache *workloadidentity.CRLCache
-	setupCRLCache := func() (*workloadidentity.CRLCache, error) {
 		if crlCache != nil {
-			return crlCache, nil
-		}
-
-		var err error
-		crlCache, err = workloadidentity.NewCRLCache(workloadidentity.CRLCacheConfig{
-			RevocationsClient: b.botIdentitySvc.GetClient().WorkloadIdentityRevocationServiceClient(),
-			Logger: b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "crl-cache"),
-			),
-		})
-		if err != nil {
-			return nil, trace.Wrap(err)
+			return crlCache
 		}
-		services = append(services, crlCache)
-		return crlCache, nil
+		crlCache = workloadidentity.NewCRLCacheFacade()
+		services = append(services, crlCache.Builder())
+		return crlCache
 	}
 
 	// Append any services configured by the user
 	for _, svcCfg := range b.cfg.Services {
 		// Convert the service config into the actual service type.
 		switch svcCfg := svcCfg.(type) {
-		case *config.SPIFFEWorkloadAPIService:
+		case *legacyspiffe.WorkloadAPIConfig:
 			b.log.WarnContext(
 				ctx,
 				"The 'spiffe-workload-api' service is deprecated and will be removed in Teleport V19.0.0. See https://goteleport.com/docs/reference/workload-identity/configuration-resource-migration/ for further information.",
 			)
-			clientCredential := &config.UnstableClientCredentialOutput{}
-			svcIdentity := &ClientCredentialOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               clientCredential,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-			}
-			svcIdentity.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(
-					componentTBot, "svc", svcIdentity.String(),
-				),
-			)
-			services = append(services, svcIdentity)
-
-			tbCache, err := setupTrustBundleCache()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			svc := &SPIFFEWorkloadAPIService{
-				svcIdentity:      clientCredential,
-				botCfg:           b.cfg,
-				cfg:              svcCfg,
-				resolver:         resolver,
-				trustBundleCache: tbCache,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.DatabaseTunnelService:
-			svc := &DatabaseTunnelService{
-				getBotIdentity: b.botIdentitySvc.GetIdentity,
-				proxyPingCache: proxyPingCache,
-				botClient:      b.botIdentitySvc.GetClient(),
-				resolver:       resolver,
-				botCfg:         b.cfg,
-				cfg:            svcCfg,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.ExampleService:
-			services = append(services, &ExampleService{
-				cfg: svcCfg,
-			})
-		case *config.SSHMultiplexerService:
-			svc := &SSHMultiplexerService{
-				alpnUpgradeCache:  alpnUpgradeCache,
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				proxyPingCache:    proxyPingCache,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.KubernetesOutput:
-			svc := &KubernetesOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				proxyPingCache:    proxyPingCache,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-				executablePath:    autoupdate.StableExecutable,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.KubernetesV2Output:
-			svc := &KubernetesV2OutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				proxyPingCache:    proxyPingCache,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-				executablePath:    autoupdate.StableExecutable,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.SPIFFESVIDOutput:
-			b.log.WarnContext(
-				ctx,
-				"The 'spiffe-svid' service is deprecated and will be removed in Teleport V19.0.0. See https://goteleport.com/docs/reference/workload-identity/configuration-resource-migration/ for further information.",
-			)
-			svc := &SPIFFESVIDOutputService{
-				botAuthClient:  b.botIdentitySvc.GetClient(),
-				botCfg:         b.cfg,
-				cfg:            svcCfg,
-				getBotIdentity: b.botIdentitySvc.GetIdentity,
-				resolver:       resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			if !b.cfg.Oneshot {
-				tbCache, err := setupTrustBundleCache()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-				svc.trustBundleCache = tbCache
-			}
-			services = append(services, svc)
-		case *config.SSHHostOutput:
-			svc := &SSHHostOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.ApplicationOutput:
-			svc := &ApplicationOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.DatabaseOutput:
-			svc := &DatabaseOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.IdentityOutput:
-			svc := &IdentityOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-				resolver:          resolver,
-				executablePath:    autoupdate.StableExecutable,
-				alpnUpgradeCache:  alpnUpgradeCache,
-				proxyPingCache:    proxyPingCache,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.UnstableClientCredentialOutput:
-			svc := &ClientCredentialOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.ApplicationTunnelService:
-			svc := &ApplicationTunnelService{
-				getBotIdentity: b.botIdentitySvc.GetIdentity,
-				proxyPingCache: proxyPingCache,
-				botClient:      b.botIdentitySvc.GetClient(),
-				resolver:       resolver,
-				botCfg:         b.cfg,
-				cfg:            svcCfg,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.WorkloadIdentityX509Service:
-			svc := &WorkloadIdentityX509Service{
-				botAuthClient:  b.botIdentitySvc.GetClient(),
-				botCfg:         b.cfg,
-				cfg:            svcCfg,
-				getBotIdentity: b.botIdentitySvc.GetIdentity,
-				resolver:       resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			if !b.cfg.Oneshot {
-				tbCache, err := setupTrustBundleCache()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-				svc.trustBundleCache = tbCache
-				crlCache, err := setupCRLCache()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-				svc.crlCache = crlCache
-			}
-			services = append(services, svc)
-		case *config.WorkloadIdentityJWTService:
-			svc := &WorkloadIdentityJWTService{
-				botAuthClient:  b.botIdentitySvc.GetClient(),
-				botCfg:         b.cfg,
-				cfg:            svcCfg,
-				getBotIdentity: b.botIdentitySvc.GetIdentity,
-				resolver:       resolver,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			if !b.cfg.Oneshot {
-				tbCache, err := setupTrustBundleCache()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-				svc.trustBundleCache = tbCache
-			}
-			services = append(services, svc)
-		case *config.WorkloadIdentityAPIService:
-			clientCredential := &config.UnstableClientCredentialOutput{}
-			svcIdentity := &ClientCredentialOutputService{
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				botCfg:            b.cfg,
-				cfg:               clientCredential,
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-			}
-			svcIdentity.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(
-					componentTBot, "svc", svcIdentity.String(),
-				),
-			)
-			services = append(services, svcIdentity)
-
-			tbCache, err := setupTrustBundleCache()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			crlCache, err := setupCRLCache()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			svc := &WorkloadIdentityAPIService{
-				svcIdentity:      clientCredential,
-				botCfg:           b.cfg,
-				cfg:              svcCfg,
-				resolver:         resolver,
-				trustBundleCache: tbCache,
-				crlCache:         crlCache,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
-		case *config.WorkloadIdentityAWSRAService:
-			svc := &WorkloadIdentityAWSRAService{
-				botCfg:            b.cfg,
-				cfg:               svcCfg,
-				resolver:          resolver,
-				botAuthClient:     b.botIdentitySvc.GetClient(),
-				getBotIdentity:    b.botIdentitySvc.GetIdentity,
-				reloadBroadcaster: reloadBroadcaster,
-			}
-			svc.log = b.log.With(
-				teleport.ComponentKey, teleport.Component(componentTBot, "svc", svc.String()),
-			)
-			services = append(services, svc)
+			services = append(services, legacyspiffe.WorkloadAPIServiceBuilder(svcCfg, setupTrustBundleCache(), b.cfg.CredentialLifetime))
+		case *database.TunnelConfig:
+			services = append(services, database.TunnelServiceBuilder(svcCfg, b.cfg.ConnectionConfig(), b.cfg.CredentialLifetime))
+		case *example.Config:
+			services = append(services, example.ServiceBuilder(svcCfg))
+		case *ssh.MultiplexerConfig:
+			services = append(services, ssh.MultiplexerServiceBuilder(svcCfg, alpnUpgradeCache, b.cfg.ConnectionConfig(), b.cfg.CredentialLifetime, clientMetrics))
+		case *k8s.OutputV1Config:
+			services = append(services, k8s.OutputV1ServiceBuilder(svcCfg, k8s.WithDefaultCredentialLifetime(b.cfg.CredentialLifetime)))
+		case *k8s.OutputV2Config:
+			services = append(services, k8s.OutputV2ServiceBuilder(svcCfg, k8s.WithDefaultCredentialLifetime(b.cfg.CredentialLifetime)))
+		case *k8s.ArgoCDOutputConfig:
+			services = append(services, k8s.ArgoCDServiceBuilder(
+				svcCfg,
+				k8s.WithDefaultCredentialLifetime(b.cfg.CredentialLifetime),
+				k8s.WithInsecure(b.cfg.ConnectionConfig().Insecure),
+				k8s.WithALPNUpgradeCache(alpnUpgradeCache),
+			))
+		case *legacyspiffe.SVIDOutputConfig:
+			services = append(services, legacyspiffe.SVIDOutputServiceBuilder(svcCfg, setupTrustBundleCache(), b.cfg.CredentialLifetime))
+		case *ssh.HostOutputConfig:
+			services = append(services, ssh.HostOutputServiceBuilder(svcCfg, b.cfg.CredentialLifetime))
+		case *application.OutputConfig:
+			services = append(services, application.OutputServiceBuilder(svcCfg, b.cfg.CredentialLifetime))
+		case *database.OutputConfig:
+			services = append(services, database.OutputServiceBuilder(svcCfg, b.cfg.CredentialLifetime))
+		case *identitysvc.OutputConfig:
+			services = append(services, identitysvc.OutputServiceBuilder(svcCfg, alpnUpgradeCache, b.cfg.CredentialLifetime, b.cfg.Insecure, b.cfg.FIPS))
+		case *clientcredentials.UnstableConfig:
+			services = append(services, clientcredentials.ServiceBuilder(svcCfg, b.cfg.CredentialLifetime))
+		case *application.TunnelConfig:
+			services = append(services, application.TunnelServiceBuilder(svcCfg, b.cfg.ConnectionConfig(), b.cfg.CredentialLifetime))
+		case *application.ProxyServiceConfig:
+			services = append(services, application.ProxyServiceBuilder(svcCfg, b.cfg.ConnectionConfig(), b.cfg.CredentialLifetime, alpnUpgradeCache))
+		case *workloadidentitysvc.X509OutputConfig:
+			services = append(services, workloadidentitysvc.X509OutputServiceBuilder(svcCfg, setupTrustBundleCache(), setupCRLCache(), b.cfg.CredentialLifetime))
+		case *workloadidentitysvc.JWTOutputConfig:
+			services = append(services, workloadidentitysvc.JWTOutputServiceBuilder(svcCfg, setupTrustBundleCache(), b.cfg.CredentialLifetime))
+		case *workloadidentitysvc.WorkloadAPIConfig:
+			services = append(services, workloadidentitysvc.WorkloadAPIServiceBuilder(svcCfg, setupTrustBundleCache(), setupCRLCache(), b.cfg.CredentialLifetime))
+		case *awsra.Config:
+			services = append(services, awsra.ServiceBuilder(svcCfg))
 		default:
 			return trace.BadParameter("unknown service type: %T", svcCfg)
 		}
 	}
 
-	b.log.InfoContext(ctx, "Initialization complete. Starting services")
-	// Start services
-	for _, svc := range services {
-		svc := svc
-		log := b.log.With("service", svc.String())
-
-		if b.cfg.Oneshot {
-			svc, ok := svc.(OneShotService)
-			// We ignore services with no one-shot implementation
-			if !ok {
-				log.DebugContext(ctx, "Service does not support oneshot mode, ignoring")
-				continue
-			}
-			eg.Go(func() error {
-				log.InfoContext(ctx, "Running service in oneshot mode")
-				err := svc.OneShot(egCtx)
-				if err != nil {
-					log.ErrorContext(
-						egCtx, "Service exited with error", "error", err,
-					)
-					return trace.Wrap(err, "service(%s)", svc.String())
-				}
-				log.InfoContext(ctx, "Service finished")
-				return nil
-			})
-		} else {
-			eg.Go(func() error {
-				log.InfoContext(ctx, "Starting service")
-				err := svc.Run(egCtx)
-				if err != nil {
-					log.ErrorContext(
-						egCtx, "Service exited with error", "error", err,
-					)
-					return trace.Wrap(err, "service(%s)", svc.String())
-				}
-				log.InfoContext(ctx, "Service exited")
-				return nil
-			})
-		}
+	bt, err := bot.New(bot.Config{
+		Kind:               bot.KindTbot,
+		Connection:         b.cfg.ConnectionConfig(),
+		Onboarding:         b.cfg.Onboarding,
+		InternalStorage:    b.cfg.Storage.Destination,
+		CredentialLifetime: b.cfg.CredentialLifetime,
+		FIPS:               b.cfg.FIPS,
+		Logger:             b.log,
+		ReloadCh:           b.cfg.ReloadCh,
+		Services:           services,
+		ClientMetrics:      clientMetrics,
+	})
+	if err != nil {
+		return trace.Wrap(err)
 	}
 
-	return eg.Wait()
+	if b.cfg.Oneshot {
+		return bt.OneShot(ctx)
+	} else {
+		return bt.Run(ctx)
+	}
 }
 
 // preRunChecks returns an unlock function which must be deferred.
@@ -686,15 +325,23 @@ func (b *Bot) preRunChecks(ctx context.Context) (_ func() error, err error) {
 	ctx, span := tracer.Start(ctx, "Bot/preRunChecks")
 	defer func() { apitracing.EndSpan(span, err) }()
 
-	_, addrKind := b.cfg.Address()
-	switch addrKind {
-	case config.AddressKindUnspecified:
+	if b.cfg.JoinURI != "" {
+		parsed, err := config.ParseJoinURI(b.cfg.JoinURI)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing joining URI")
+		}
+
+		if err := parsed.ApplyToConfig(b.cfg); err != nil {
+			return nil, trace.Wrap(err, "applying joining URI to bot config")
+		}
+	}
+
+	connCfg := b.cfg.ConnectionConfig()
+	switch connCfg.AddressKind {
+	case connection.AddressKindUnspecified:
 		return nil, trace.BadParameter(
 			"either a proxy or auth address must be set using --proxy-server, --auth-server or configuration",
 		)
-	case config.AddressKindAuth:
-		// TODO(noah): DELETE IN V17.0.0
-		b.log.WarnContext(ctx, "We recently introduced the ability to explicitly configure the address of the Teleport Proxy using --proxy-server. We recommend switching to this if you currently provide the address of the Proxy to --auth-server.")
 	}
 
 	// Ensure they have provided a join method.
@@ -770,249 +417,10 @@ func checkDestinations(ctx context.Context, cfg *config.BotConfig) error {
 	return nil
 }
 
-// clientForFacade creates a new auth client from the given
-// facade. Note that depending on the connection address given, this may
-// attempt to connect via the proxy and therefore requires both SSH and TLS
-// credentials.
-func clientForFacade(
-	ctx context.Context,
-	log *slog.Logger,
-	cfg *config.BotConfig,
-	facade *identity.Facade,
-	resolver reversetunnelclient.Resolver) (_ *authclient.Client, err error) {
-	ctx, span := tracer.Start(ctx, "clientForFacade")
-	defer func() { apitracing.EndSpan(span, err) }()
-
-	tlsConfig, err := facade.TLSConfig()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	sshConfig, err := facade.SSHClientConfig()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	addr, _ := cfg.Address()
-	parsedAddr, err := utils.ParseAddr(addr)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
-		Resolver:              resolver,
-		ClientConfig:          sshConfig,
-		Log:                   log,
-		InsecureSkipTLSVerify: cfg.Insecure,
-		GetClusterCAs:         client.ClusterCAsFromCertPool(tlsConfig.RootCAs),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	authClientConfig := &authclient.Config{
-		TLS: tlsConfig,
-		SSH: sshConfig,
-		// TODO(noah): It'd be ideal to distinguish the proxy addr and auth addr
-		// here to avoid pointlessly hitting the address as an auth server.
-		AuthServers: []utils.NetAddr{*parsedAddr},
-		Log:         log,
-		Insecure:    cfg.Insecure,
-		ProxyDialer: dialer,
-		DialOpts: []grpc.DialOption{
-			metadata.WithUserAgentFromTeleportComponent(teleport.ComponentTBot),
-			grpc.WithChainUnaryInterceptor(clientMetrics.UnaryClientInterceptor()),
-			grpc.WithChainStreamInterceptor(clientMetrics.StreamClientInterceptor()),
-		},
-	}
-
-	c, err := authclient.Connect(ctx, authClientConfig)
-	return c, trace.Wrap(err)
-}
-
-type authPingCache struct {
-	client *authclient.Client
-	log    *slog.Logger
-
-	mu          sync.RWMutex
-	cachedValue *proto.PingResponse
-}
-
-func (a *authPingCache) ping(ctx context.Context) (proto.PingResponse, error) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if a.cachedValue != nil {
-		return *a.cachedValue, nil
-	}
-
-	a.log.DebugContext(ctx, "Pinging auth server.")
-	res, err := a.client.Ping(ctx)
-	if err != nil {
-		a.log.ErrorContext(ctx, "Failed to ping auth server.", "error", err)
-		return proto.PingResponse{}, trace.Wrap(err)
-	}
-	a.cachedValue = &res
-	a.log.DebugContext(ctx, "Successfully pinged auth server.", "pong", res)
-
-	return *a.cachedValue, nil
-}
-
-type proxyPingCache struct {
-	authPingCache *authPingCache
-	botCfg        *config.BotConfig
-	log           *slog.Logger
-
-	mu          sync.RWMutex
-	cachedValue *proxyPingResponse
-}
-
-func (p *proxyPingCache) ping(ctx context.Context) (*proxyPingResponse, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if p.cachedValue != nil {
-		return p.cachedValue, nil
-	}
-
-	// Determine the Proxy address to use.
-	addr, addrKind := p.botCfg.Address()
-	switch addrKind {
-	case config.AddressKindAuth:
-		// If the address is an auth address, ping auth to determine proxy addr.
-		authPong, err := p.authPingCache.ping(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		addr = authPong.ProxyPublicAddr
-	case config.AddressKindProxy:
-		// If the address is a proxy address, use it directly.
-	default:
-		return nil, trace.BadParameter("unsupported address kind: %v", addrKind)
-	}
-
-	p.log.DebugContext(ctx, "Pinging proxy.", "addr", addr)
-	res, err := webclient.Find(&webclient.Config{
-		Context:   ctx,
-		ProxyAddr: addr,
-		Insecure:  p.botCfg.Insecure,
-	})
-	if err != nil {
-		p.log.ErrorContext(ctx, "Failed to ping proxy.", "error", err)
-		return nil, trace.Wrap(err)
-	}
-	p.log.DebugContext(ctx, "Successfully pinged proxy.", "pong", res)
-	p.cachedValue = &proxyPingResponse{
-		PingResponse:        res,
-		configuredProxyAddr: p.botCfg.ProxyServer,
-	}
-
-	return p.cachedValue, nil
-}
-
-type proxyPingResponse struct {
-	*webclient.PingResponse
-	configuredProxyAddr string
-}
-
-// useProxyAddrEnv is an environment variable which can be set to
-// force `tbot` to prefer using the proxy address explicitly provided by the
-// user over the one fetched from the proxy ping. This is only intended to work
-// in cases where TLS routing is enabled, and is intended to support cases where
-// the Proxy is accessible from multiple addresses, and the one included in the
-// ProxyPing is incorrect.
-const useProxyAddrEnv = "TBOT_USE_PROXY_ADDR"
-
-// shouldUseProxyAddr returns true if the TBOT_USE_PROXY_ADDR environment
-// variable is set to "yes". More generally, this indicates that the user wishes
-// for tbot to prefer using the proxy address that has been explicitly provided
-// by the user rather than the one fetched via a discovery process (e.g ping).
-func shouldUseProxyAddr() bool {
-	return os.Getenv(useProxyAddrEnv) == "yes"
-}
-
-// proxyWebAddr returns the address to use to connect to the proxy web port.
-// In TLS routing mode, this address should be used for most/all connections.
-// This function takes into account the TBOT_USE_PROXY_ADDR environment
-// variable, which can be used to force the use of the proxy address explicitly
-// provided by the user rather than use the one fetched from the proxy ping.
-func (p *proxyPingResponse) proxyWebAddr() (string, error) {
-	if shouldUseProxyAddr() {
-		if p.configuredProxyAddr == "" {
-			return "", trace.BadParameter("TBOT_USE_PROXY_ADDR set but no explicit proxy address configured")
-		}
-		return p.configuredProxyAddr, nil
-	}
-	return p.Proxy.SSH.PublicAddr, nil
-}
-
-// proxySSHAddr returns the address to use to connect to the proxy SSH service.
-// Includes potential override via TBOT_USE_PROXY_ADDR.
-func (p *proxyPingResponse) proxySSHAddr() (string, error) {
-	if p.Proxy.TLSRoutingEnabled && shouldUseProxyAddr() {
-		// If using TLS routing, we should use the manually overridden address
-		// for the proxy web port.
-		if p.configuredProxyAddr == "" {
-			return "", trace.BadParameter("TBOT_USE_PROXY_ADDR set but no explicit proxy address configured")
-		}
-		return p.configuredProxyAddr, nil
-	}
-	// SSHProxyHostPort returns the host and port to use to connect to the
-	// proxy's SSH service. If TLS routing is enabled, this will return the
-	// proxy's web address, if not, the proxy SSH listener.
-	host, port, err := p.Proxy.SSHProxyHostPort()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return net.JoinHostPort(host, port), nil
-}
-
-type alpnProxyConnUpgradeRequiredCache struct {
-	botCfg *config.BotConfig
-	log    *slog.Logger
-
-	mu    sync.Mutex
-	cache map[string]bool
-	group singleflight.Group
-}
-
-func (a *alpnProxyConnUpgradeRequiredCache) isUpgradeRequired(ctx context.Context, addr string, insecure bool) (bool, error) {
-	key := fmt.Sprintf("%s-%t", addr, insecure)
-
-	a.mu.Lock()
-	if a.cache == nil {
-		a.cache = make(map[string]bool)
-	}
-	v, ok := a.cache[key]
-	if ok {
-		a.mu.Unlock()
-		return v, nil
-	}
-	a.mu.Unlock()
-
-	val, err, _ := a.group.Do(key, func() (interface{}, error) {
-		// Recheck the cache in case we've just missed a previous group
-		// completing
-		a.mu.Lock()
-		v, ok := a.cache[key]
-		if ok {
-			a.mu.Unlock()
-			return v, nil
-		}
-		a.mu.Unlock()
-
-		// Ok, now we know for sure that the work hasn't already been done or
-		// isn't in flight, we can complete it.
-		a.log.DebugContext(ctx, "Testing ALPN upgrade necessary", "addr", addr, "insecure", insecure)
-		v = client.IsALPNConnUpgradeRequired(ctx, addr, insecure)
-		a.log.DebugContext(ctx, "Tested ALPN upgrade necessary", "addr", addr, "insecure", insecure, "result", v)
-		if err := ctx.Err(); err != nil {
-			// Check for case where false is returned because client canceled ctx.
-			// We don't want to cache this result.
-			return v, trace.Wrap(err)
-		}
-
-		a.mu.Lock()
-		a.cache[key] = v
-		a.mu.Unlock()
-		return v, nil
-	})
-	return val.(bool), err
+func versionLogValue() slog.Value {
+	return slog.GroupValue(
+		slog.String("teleport", teleport.Version),
+		slog.String("teleport_git", teleport.Gitref),
+		slog.String("go", runtime.Version()),
+	)
 }
diff --git a/lib/tbot/tbot_test.go b/lib/tbot/tbot_test.go
index 78774ca19f57c..da07b61084db8 100644
--- a/lib/tbot/tbot_test.go
+++ b/lib/tbot/tbot_test.go
@@ -24,7 +24,9 @@ import (
 	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/rsa"
+	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net"
 	"os"
@@ -32,6 +34,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -42,6 +45,8 @@ import (
 	"golang.org/x/crypto/ssh/agent"
 	"golang.org/x/crypto/ssh/knownhosts"
 
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/constants"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -50,26 +55,40 @@ import (
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/postgres"
 	apisshutils "github.com/gravitational/teleport/lib/sshutils"
-	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	identitysvc "github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	sshsvc "github.com/gravitational/teleport/lib/tbot/services/ssh"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
-	os.Exit(m.Run())
+	logtest.InitLogger(testing.Verbose)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 type defaultBotConfigOpts struct {
@@ -79,9 +98,9 @@ type defaultBotConfigOpts struct {
 	insecure bool
 }
 
-func defaultTestServerOpts(t *testing.T, log *slog.Logger) testenv.TestServerOptFunc {
-	return func(o *testenv.TestServersOpts) {
-		testenv.WithClusterName(t, "root")(o)
+func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
+	return func(o *testenv.TestServersOpts) error {
+		testenv.WithClusterName("root")(o)
 		testenv.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Logger = log
 			cfg.Proxy.PublicAddrs = []utils.NetAddr{
@@ -91,11 +110,13 @@ func defaultTestServerOpts(t *testing.T, log *slog.Logger) testenv.TestServerOpt
 				cfg.Proxy.ReverseTunnelListenAddr,
 			}
 		})(o)
+
+		return nil
 	}
 }
 
 // makeBot creates a server-side bot and returns joining parameters.
-func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*config.OnboardingConfig, *machineidv1pb.Bot) {
+func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) (*onboarding.Config, *machineidv1pb.Bot) {
 	ctx := context.TODO()
 	t.Helper()
 
@@ -126,7 +147,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	err = client.CreateToken(ctx, tok)
 	require.NoError(t, err)
 
-	return &config.OnboardingConfig{
+	return &onboarding.Config{
 		TokenValue: tok.GetName(),
 		JoinMethod: types.JoinMethodToken,
 	}, b
@@ -141,7 +162,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 func defaultBotConfig(
 	t *testing.T,
 	process *service.TeleportProcess,
-	onboarding *config.OnboardingConfig,
+	onboarding *onboarding.Config,
 	serviceConfigs config.ServiceConfigs,
 	opts defaultBotConfigOpts,
 ) *config.BotConfig {
@@ -153,16 +174,18 @@ func defaultBotConfig(
 	}
 
 	cfg := &config.BotConfig{
-		AuthServer: authServer,
-		Onboarding: *onboarding,
+		AuthServer:            authServer,
+		AuthServerAddressMode: connection.WarnIfAuthServerIsProxy,
+		Onboarding:            *onboarding,
 		Storage: &config.StorageConfig{
-			Destination: &config.DestinationMemory{},
+			Destination: &destination.Memory{},
 		},
 		Oneshot: true,
 		// Set insecure so the bot will trust the Proxy's webapi default signed
 		// certs.
 		Insecure: opts.insecure,
 		Services: serviceConfigs,
+		Testing:  true,
 	}
 
 	require.NoError(t, cfg.CheckAndSetDefaults())
@@ -180,7 +203,7 @@ func defaultBotConfig(
 func TestBot(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Make a new auth server.
 	const (
@@ -196,12 +219,20 @@ func TestBot(t *testing.T) {
 		kubeClusterDiscoveredName     = "test-kube-cluster"
 	)
 
-	process := testenv.MakeTestServer(
-		t,
-		defaultTestServerOpts(t, log),
-		testenv.WithProxyKube(t),
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithProxyKube(),
 	)
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 	clusterName := process.Config.Auth.ClusterName.GetClusterName()
 
 	// Register an application server so the bot can request certs for it.
@@ -302,49 +333,49 @@ func TestBot(t *testing.T) {
 		t, rootClient, "test", defaultRoles...,
 	)
 
-	identityOutput := &config.IdentityOutput{
-		Destination: &config.DestinationMemory{},
+	identityOutput := &identitysvc.OutputConfig{
+		Destination: &destination.Memory{},
 	}
-	identityOutputWithRoles := &config.IdentityOutput{
-		Destination: &config.DestinationMemory{},
+	identityOutputWithRoles := &identitysvc.OutputConfig{
+		Destination: &destination.Memory{},
 		Roles:       []string{mainRole},
 	}
-	identityOutputWithReissue := &config.IdentityOutput{
-		Destination:  &config.DestinationMemory{},
+	identityOutputWithReissue := &identitysvc.OutputConfig{
+		Destination:  &destination.Memory{},
 		AllowReissue: true,
 	}
-	appOutput := &config.ApplicationOutput{
-		Destination: &config.DestinationMemory{},
+	appOutput := &application.OutputConfig{
+		Destination: &destination.Memory{},
 		AppName:     appName,
 	}
-	dbOutput := &config.DatabaseOutput{
-		Destination: &config.DestinationMemory{},
+	dbOutput := &database.OutputConfig{
+		Destination: &destination.Memory{},
 		Service:     databaseServiceName,
 		Database:    databaseName,
 		Username:    databaseUsername,
 	}
-	dbDiscoveredNameOutput := &config.DatabaseOutput{
-		Destination: &config.DestinationMemory{},
+	dbDiscoveredNameOutput := &database.OutputConfig{
+		Destination: &destination.Memory{},
 		Service:     databaseServiceDiscoveredName,
 		Database:    databaseName,
 		Username:    databaseUsername,
 	}
-	kubeOutput := &config.KubernetesOutput{
+	kubeOutput := &k8s.OutputV1Config{
 		// DestinationDirectory required or output will fail.
-		Destination: &config.DestinationDirectory{
+		Destination: &destination.Directory{
 			Path: t.TempDir(),
 		},
 		KubernetesCluster: kubeClusterName,
 	}
-	kubeDiscoveredNameOutput := &config.KubernetesOutput{
+	kubeDiscoveredNameOutput := &k8s.OutputV1Config{
 		// DestinationDirectory required or output will fail.
-		Destination: &config.DestinationDirectory{
+		Destination: &destination.Directory{
 			Path: t.TempDir(),
 		},
 		KubernetesCluster: kubeClusterDiscoveredName,
 	}
-	sshHostOutput := &config.SSHHostOutput{
-		Destination: &config.DestinationMemory{},
+	sshHostOutput := &sshsvc.HostOutputConfig{
+		Destination: &destination.Memory{},
 		Principals:  []string{hostPrincipal},
 	}
 	botConfig := defaultBotConfig(
@@ -370,7 +401,7 @@ func TestBot(t *testing.T) {
 	t.Run("bot identity", func(t *testing.T) {
 		// Some rough checks to ensure the bot identity used follows our
 		// expected rules for bot identities.
-		botIdent := b.BotIdentity()
+		botIdent := b.getBotIdentity()
 		tlsIdent, err := tlsca.FromSubject(
 			botIdent.X509Cert.Subject, botIdent.X509Cert.NotAfter,
 		)
@@ -531,13 +562,13 @@ func requireValidOutputTLSIdent(t *testing.T, ident *tlsca.Identity, wantRoles [
 	require.Equal(t, wantRoles, ident.Groups)
 }
 
-func tlsIdentFromDest(ctx context.Context, t *testing.T, dest bot.Destination) *tlsca.Identity {
+func tlsIdentFromDest(ctx context.Context, t *testing.T, dest destination.Destination) *tlsca.Identity {
 	t.Helper()
 	keyBytes, err := dest.Read(ctx, identity.PrivateKeyKey)
 	require.NoError(t, err)
 	certBytes, err := dest.Read(ctx, identity.TLSCertKey)
 	require.NoError(t, err)
-	hostCABytes, err := dest.Read(ctx, config.HostCAPath)
+	hostCABytes, err := dest.Read(ctx, internal.HostCAPath)
 	require.NoError(t, err)
 	_, tlsIdent, _, _, _, err := identity.ParseTLSIdentity(keyBytes, certBytes, [][]byte{hostCABytes})
 	require.NoError(t, err)
@@ -551,11 +582,18 @@ func tlsIdentFromDest(ctx context.Context, t *testing.T, dest bot.Destination) *
 func TestBot_ResumeFromStorage(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Make a new auth server.
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	// Create bot user and join token
 	botParams, _ := makeBot(t, rootClient, "test", "access")
@@ -569,7 +607,7 @@ func TestBot_ResumeFromStorage(t *testing.T) {
 
 	// Use a destination directory to ensure locking behaves correctly and
 	// the bot isn't left in a locked state.
-	directoryDest := &config.DestinationDirectory{
+	directoryDest := &destination.Directory{
 		Path:     t.TempDir(),
 		Symlinks: botfs.SymlinksInsecure,
 		ACLs:     botfs.ACLOff,
@@ -592,141 +630,279 @@ func TestBot_ResumeFromStorage(t *testing.T) {
 	require.NoError(t, thirdBot.Run(ctx))
 }
 
-func TestBot_InsecureViaProxy(t *testing.T) {
+func TestBot_IdentityRenewalFails(t *testing.T) {
 	t.Parallel()
+
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
+
+	// This test asserts that we can continue running (and recover) even when
+	// identity renewal fails on-startup.
+	//
+	// How it works:
+	//
+	// We run a TCP proxy in front of the real Teleport proxy that can be set to
+	// immediately close connections.
+	//
+	// We publish that address in TunnelPublicAddrs but put the *real* address
+	// in tbot's config so that we allow requests to the `/webapi/find` endpoint
+	// through as-is, without needing to sniff the ALPN protocols or something.
+	//
+	// This is necessary because tbot's resolver caches errors, so if we blocked
+	// the connection to that HTTP endpoint, we'd need to wait for the cache to
+	// expire.
+	proxy := newFailureProxy(t)
 
 	// Make a new auth server.
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(),
+		func(o *testenv.TestServersOpts) error {
+			defaultTestServerOpts(log)(o)
+
+			testenv.WithConfig(func(cfg *servicecfg.Config) {
+				cfg.Proxy.TunnelPublicAddrs = []utils.NetAddr{*utils.MustParseAddr(proxy.addr())}
+			})(o)
+			return nil
+		},
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	// Create bot user and join token
 	botParams, _ := makeBot(t, rootClient, "test", "access")
-
-	botConfig := defaultBotConfig(t, process, botParams, config.ServiceConfigs{},
-		defaultBotConfigOpts{
-			useAuthServer: false,
-			insecure:      true,
-		},
+	botConfig := defaultBotConfig(t,
+		process,
+		botParams,
+		config.ServiceConfigs{},
+		defaultBotConfigOpts{insecure: true},
 	)
-	// Use a destination directory to ensure locking behaves correctly and
-	// the bot isn't left in a locked state.
-	directoryDest := &config.DestinationDirectory{
+
+	dest := &destination.Directory{
 		Path:     t.TempDir(),
 		Symlinks: botfs.SymlinksInsecure,
 		ACLs:     botfs.ACLOff,
 	}
-	botConfig.Storage.Destination = directoryDest
+	botConfig.Storage.Destination = dest
+
+	// Configure our failure proxy to send traffic to the real proxy
+	tunnelAddr, err := process.ProxyTunnelAddr()
+	require.NoError(t, err)
+	proxy.dst = tunnelAddr.String()
+	go proxy.run(t)
+
+	botConfig.ProxyServer = tunnelAddr.String()
+	botConfig.AuthServer = ""
 
 	// Run the bot a first time
 	firstBot := New(botConfig, log)
 	require.NoError(t, firstBot.Run(ctx))
-}
 
-func TestChooseOneResource(t *testing.T) {
-	t.Parallel()
-	t.Run("database", testChooseOneDatabase)
-	t.Run("kube cluster", testChooseOneKubeCluster)
+	// Block connections. Running the bot should now fail.
+	proxy.setFailing(true)
+	secondBot := New(botConfig, log)
+	require.ErrorContains(t, secondBot.Run(ctx), "Error while dialing")
+
+	// Drain the notification channel so we can listen for new connections.
+	select {
+	case <-proxy.notif:
+	default:
+	}
+
+	// Run it again in long-running mode, and it should eventually succeed once
+	// the network partition has healed.
+	botConfig.Oneshot = false
+	outputDest := newWriteNotifier(&destination.Memory{})
+	require.NoError(t, outputDest.CheckAndSetDefaults())
+	botConfig.Services = append(botConfig.Services, &identitysvc.OutputConfig{
+		Destination: outputDest,
+	})
+	thirdBot := New(botConfig, log)
+
+	ctx, cancel := context.WithCancel(ctx)
+	t.Cleanup(cancel)
+	go thirdBot.Run(ctx)
+
+	// Wait for at least one failed connection, then heal the network partition.
+	select {
+	case <-proxy.notif:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for connection")
+	}
+
+	// Wait for the client to be available.
+	var client *client.Client
+	require.Eventually(t, func() bool {
+		client = thirdBot.getClient()
+		return client != nil
+	}, 5*time.Second, 100*time.Millisecond, "timeout waiting for client to become available")
+
+	t.Log("Healing network partition")
+	proxy.setFailing(false)
+
+	// We must reset gRPC's connection backoff, otherwise it'll keep returning
+	// the cached error.
+	client.GetConnection().ResetConnectBackoff()
+
+	// Wait for the destination to be written to.
+	select {
+	case <-outputDest.ch:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for output to be written")
+	}
 }
 
-func testChooseOneDatabase(t *testing.T) {
-	t.Parallel()
-	fooDB1 := newMockDiscoveredDB(t, "foo-rds-us-west-1-123456789012", "foo")
-	fooDB2 := newMockDiscoveredDB(t, "foo-rds-us-west-2-123456789012", "foo")
-	barDB := newMockDiscoveredDB(t, "bar-rds-us-west-1-123456789012", "bar")
-	tests := []struct {
-		desc      string
-		databases []types.Database
-		dbSvc     string
-		wantDB    types.Database
-		wantErr   string
-	}{
-		{
-			desc:      "by exact name match",
-			databases: []types.Database{fooDB1, fooDB2, barDB},
-			dbSvc:     "bar-rds-us-west-1-123456789012",
-			wantDB:    barDB,
-		},
-		{
-			desc:      "by unambiguous discovered name match",
-			databases: []types.Database{fooDB1, fooDB2, barDB},
-			dbSvc:     "bar",
-			wantDB:    barDB,
-		},
-		{
-			desc:      "ambiguous discovered name matches is an error",
-			databases: []types.Database{fooDB1, fooDB2, barDB},
-			dbSvc:     "foo",
-			wantErr:   `"foo" matches multiple auto-discovered databases`,
-		},
-		{
-			desc:      "no match is an error",
-			databases: []types.Database{fooDB1, fooDB2, barDB},
-			dbSvc:     "xxx",
-			wantErr:   `database "xxx" not found`,
-		},
+func newWriteNotifier(dst destination.Destination) *writeNotifier {
+	return &writeNotifier{
+		Destination: dst,
+		ch:          make(chan struct{}, 1),
 	}
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			gotDB, err := chooseOneDatabase(test.databases, test.dbSvc)
-			if test.wantErr != "" {
-				require.ErrorContains(t, err, test.wantErr)
-				return
+}
+
+type writeNotifier struct {
+	destination.Destination
+
+	ch chan struct{}
+}
+
+func (w writeNotifier) Write(ctx context.Context, name string, data []byte) error {
+	if name != identity.WriteTestKey {
+		defer func() {
+			select {
+			case w.ch <- struct{}{}:
+			default:
 			}
-			require.NoError(t, err)
-			require.Equal(t, test.wantDB, gotDB)
-		})
+		}()
 	}
+	return w.Destination.Write(ctx, name, data)
 }
 
-func testChooseOneKubeCluster(t *testing.T) {
-	fooKube1 := newMockDiscoveredKubeCluster(t, "foo-eks-us-west-1-123456789012", "foo")
-	fooKube2 := newMockDiscoveredKubeCluster(t, "foo-eks-us-west-2-123456789012", "foo")
-	barKube := newMockDiscoveredKubeCluster(t, "bar-eks-us-west-1-123456789012", "bar")
-	tests := []struct {
-		desc            string
-		clusters        []types.KubeCluster
-		kubeSvc         string
-		wantKubeCluster types.KubeCluster
-		wantErr         string
-	}{
-		{
-			desc:            "by exact name match",
-			clusters:        []types.KubeCluster{fooKube1, fooKube2, barKube},
-			kubeSvc:         "bar-eks-us-west-1-123456789012",
-			wantKubeCluster: barKube,
-		},
-		{
-			desc:            "by unambiguous discovered name match",
-			clusters:        []types.KubeCluster{fooKube1, fooKube2, barKube},
-			kubeSvc:         "bar",
-			wantKubeCluster: barKube,
-		},
-		{
-			desc:     "ambiguous discovered name matches is an error",
-			clusters: []types.KubeCluster{fooKube1, fooKube2, barKube},
-			kubeSvc:  "foo",
-			wantErr:  `"foo" matches multiple auto-discovered kubernetes clusters`,
-		},
-		{
-			desc:     "no match is an error",
-			clusters: []types.KubeCluster{fooKube1, fooKube2, barKube},
-			kubeSvc:  "xxx",
-			wantErr:  `kubernetes cluster "xxx" not found`,
-		},
+type failureProxy struct {
+	dst     string
+	lis     net.Listener
+	failing atomic.Bool
+	notif   chan struct{}
+}
+
+func newFailureProxy(t *testing.T) *failureProxy {
+	t.Helper()
+
+	lis, err := net.Listen("tcp", ":0")
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		if err := lis.Close(); err != nil {
+			t.Logf("failed to close listener: %v", err)
+		}
+	})
+
+	return &failureProxy{
+		lis:   lis,
+		notif: make(chan struct{}, 1),
 	}
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			gotKube, err := chooseOneKubeCluster(test.clusters, test.kubeSvc)
-			if test.wantErr != "" {
-				require.ErrorContains(t, err, test.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			require.Equal(t, test.wantKubeCluster, gotKube)
-		})
+}
+
+func (f *failureProxy) run(t *testing.T) {
+	t.Helper()
+
+	for {
+		conn, err := f.lis.Accept()
+		if errors.Is(err, net.ErrClosed) {
+			return
+		}
+		if err != nil {
+			t.Logf("accept failed: %v", err)
+			continue
+		}
+
+		select {
+		case f.notif <- struct{}{}:
+		default:
+		}
+
+		go f.handleConn(t, conn)
+	}
+}
+
+func (f *failureProxy) handleConn(t *testing.T, conn net.Conn) {
+	defer func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("failed to close connection: %v", err)
+		}
+	}()
+
+	// If we're failing, just close the connection immediately.
+	if f.failing.Load() {
+		return
 	}
+
+	upstream, err := net.Dial("tcp", f.dst)
+	if err != nil {
+		t.Logf("failed to dial upstream: %v", err)
+		return
+	}
+
+	done := make(chan struct{}, 1)
+	pipe := func(dst io.Writer, src io.Reader) {
+		_, _ = io.Copy(dst, src)
+		done <- struct{}{}
+	}
+
+	go pipe(upstream, conn)
+	go pipe(conn, upstream)
+
+	<-done
+}
+
+func (f *failureProxy) addr() string {
+	return f.lis.Addr().String()
+}
+
+func (f *failureProxy) setFailing(failing bool) {
+	f.failing.Store(failing)
+}
+
+func TestBot_InsecureViaProxy(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	// Make a new auth server.
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	// Create bot user and join token
+	botParams, _ := makeBot(t, rootClient, "test", "access")
+
+	botConfig := defaultBotConfig(t, process, botParams, config.ServiceConfigs{},
+		defaultBotConfigOpts{
+			useAuthServer: false,
+			insecure:      true,
+		},
+	)
+	// Use a destination directory to ensure locking behaves correctly and
+	// the bot isn't left in a locked state.
+	directoryDest := &destination.Directory{
+		Path:     t.TempDir(),
+		Symlinks: botfs.SymlinksInsecure,
+		ACLs:     botfs.ACLOff,
+	}
+	botConfig.Storage.Destination = directoryDest
+
+	// Run the bot a first time
+	firstBot := New(botConfig, log)
+	require.NoError(t, firstBot.Run(ctx))
 }
 
 func newMockDiscoveredDB(t *testing.T, name, discoveredName string) *types.DatabaseV3 {
@@ -764,11 +940,18 @@ func newMockDiscoveredKubeCluster(t *testing.T, name, discoveredName string) *ty
 func TestBotDatabaseTunnel(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Make a new auth server.
-	process := testenv.MakeTestServer(t, defaultTestServerOpts(t, log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(), defaultTestServerOpts(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	// Make fake postgres server and add a database access instance to expose
 	// it.
@@ -816,7 +999,7 @@ func TestBotDatabaseTunnel(t *testing.T) {
 	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
 	botConfig := defaultBotConfig(
 		t, process, onboarding, config.ServiceConfigs{
-			&config.DatabaseTunnelService{
+			&database.TunnelConfig{
 				Listener: botListener,
 				Service:  "test-database",
 				Database: "mydb",
@@ -866,7 +1049,7 @@ func TestBotDatabaseTunnel(t *testing.T) {
 func TestBotSSHMultiplexer(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	currentUser, err := user.Current()
 	require.NoError(t, err)
@@ -880,18 +1063,22 @@ func TestBotSSHMultiplexer(t *testing.T) {
 	})
 
 	// Make a new auth server with SSH agent
-	process := testenv.MakeTestServer(
-		t,
-		defaultTestServerOpts(t, log),
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
 		testenv.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = true
-			cfg.SSH.Addr = utils.NetAddr{
-				AddrNetwork: "tcp",
-				Addr:        testenv.NewTCPListener(t, service.ListenerNodeSSH, &cfg.FileDescriptors),
-			}
 		}),
 	)
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	// Create role that allows the bot to access the database.
 	role, err := types.NewRole("ssh-access", types.RoleSpecV6{
@@ -910,8 +1097,8 @@ func TestBotSSHMultiplexer(t *testing.T) {
 	onboarding, _ := makeBot(t, rootClient, "test", role.GetName())
 	botConfig := defaultBotConfig(
 		t, process, onboarding, config.ServiceConfigs{
-			&config.SSHMultiplexerService{
-				Destination: &config.DestinationDirectory{
+			&sshsvc.MultiplexerConfig{
+				Destination: &destination.Directory{
 					Path: tmpDir,
 				},
 			},
@@ -951,6 +1138,24 @@ func TestBotSSHMultiplexer(t *testing.T) {
 		}
 	}, 10*time.Second, 100*time.Millisecond)
 
+	// We need to wait for the agent to be fully connected to the Proxy
+	// (e.g. visible in the reverse tunnel server) otherwise dials to it may
+	// result in "direct dialing to nodes not found in inventory is not
+	// supported".
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rts, err := process.GetReverseTunnelServer()
+		require.NoError(t, err)
+		cluster, err := rts.Cluster(ctx, "root")
+		require.NoError(t, err)
+		nw, err := cluster.NodeWatcher()
+		require.NoError(t, err)
+		got, err := nw.CurrentResourcesWithFilter(ctx, func(r readonly.Server) bool {
+			return r.GetHostname() == "server01"
+		})
+		require.NoError(t, err)
+		require.Len(t, got, 1)
+	}, 10*time.Second, 100*time.Millisecond)
+
 	targets := []string{
 		"server01.root:0\x00",      // Old style target without cluster
 		"server01.root:0|root\x00", // New style target with cluster
@@ -1005,3 +1210,123 @@ func TestBotSSHMultiplexer(t *testing.T) {
 		})
 	}
 }
+
+func TestBotDeviceTrust(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	// Start a test server with `device.trust.mode="required-for-humans"`.
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithAuthConfig(func(cfg *servicecfg.AuthConfig) {
+			cfg.Preference.SetDeviceTrust(&types.DeviceTrust{
+				Mode: constants.DeviceTrustModeRequiredForHumans,
+			})
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	// Run a bot with an identity output.
+	onboarding, _ := makeBot(t, rootClient, "test", "access")
+	botConfig := defaultBotConfig(
+		t, process, onboarding,
+		config.ServiceConfigs{
+			&identitysvc.OutputConfig{
+				Destination: &destination.Memory{},
+			},
+		},
+		defaultBotConfigOpts{
+			useAuthServer: true,
+			insecure:      true,
+		},
+	)
+
+	// If we're able to successfully run the bot, it means we could:
+	//
+	// 	1. Join the cluster
+	// 	2. Request an user certificate to "impersonate" the bot's roles
+	b := New(botConfig, log)
+	require.NoError(t, b.Run(ctx))
+
+	// Run it again to check renewing the bot's internal identity works too.
+	b = New(botConfig, log)
+	require.NoError(t, b.Run(ctx))
+}
+
+// TestBotJoiningURI ensures configured joining URIs work in place of
+// traditional YAML onboarding config.
+func TestBotJoiningURI(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := logtest.NewLogger()
+
+	process, err := testenv.NewTeleportProcess(
+		t.TempDir(),
+		defaultTestServerOpts(log),
+		testenv.WithProxyKube(),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	role, err := types.NewRole("role", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			AppLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
+		},
+	})
+	require.NoError(t, err)
+	_, err = rootClient.UpsertRole(ctx, role)
+	require.NoError(t, err)
+
+	botParams, _ := makeBot(t, rootClient, "test", "role")
+	cfg := &config.BotConfig{
+		JoinURI: fmt.Sprintf(
+			"tbot+proxy+%s://%s@%s",
+			botParams.JoinMethod,
+			botParams.TokenValue,
+			process.Config.Proxy.WebAddr.String(),
+		),
+		Storage: &config.StorageConfig{
+			Destination: &destination.Memory{},
+		},
+		Services: config.ServiceConfigs{
+			&identitysvc.OutputConfig{
+				Destination: &destination.Memory{},
+			},
+		},
+		Oneshot:  true,
+		Insecure: true,
+		Testing:  true,
+	}
+	require.NoError(t, cfg.CheckAndSetDefaults())
+
+	bot := New(cfg, log)
+	require.NoError(t, bot.Run(ctx))
+
+	// Perform some cursory checks on the identity to make sure a cert bundle
+	// was actually produced.
+	id := bot.getBotIdentity()
+	tlsIdent, err := tlsca.FromSubject(
+		id.X509Cert.Subject, id.X509Cert.NotAfter,
+	)
+	require.NoError(t, err)
+	require.Equal(t, "test", tlsIdent.BotName)
+}
diff --git a/lib/tbot/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden b/lib/tbot/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden
deleted file mode 100644
index 12f013ddf6d1b..0000000000000
--- a/lib/tbot/testdata/TestKubernetesV2OutputService_render/absolute_path/kubeconfig.yaml.golden
+++ /dev/null
@@ -1,45 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-contexts:
-- context:
-    cluster: tele.blackmesa.gov-a
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- context:
-    cluster: tele.blackmesa.gov-b
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- context:
-    cluster: tele.blackmesa.gov-c
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-current-context: tele.blackmesa.gov-a
-kind: Config
-preferences: {}
-users:
-- name: tele.blackmesa.gov
-  user:
-    exec:
-      apiVersion: client.authentication.k8s.io/v1beta1
-      args:
-      - kube
-      - credentials
-      - --destination-dir=/test/dir
-      command: /path/to/tbot
-      env: null
-      provideClusterInfo: false
diff --git a/lib/tbot/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden b/lib/tbot/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
deleted file mode 100644
index c70f37cdad66d..0000000000000
--- a/lib/tbot/testdata/TestKubernetesV2OutputService_render/exec_plugin_disabled/kubeconfig.yaml.golden
+++ /dev/null
@@ -1,38 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-contexts:
-- context:
-    cluster: tele.blackmesa.gov-a
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- context:
-    cluster: tele.blackmesa.gov-b
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- context:
-    cluster: tele.blackmesa.gov-c
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-current-context: tele.blackmesa.gov-a
-kind: Config
-preferences: {}
-users:
-- name: tele.blackmesa.gov
-  user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURmRENDQW1TZ0F3SUJBZ0lRUC9qSTg1c3FqRFdEVGQ5cUYwVjVxakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB5TkRBME1ESXhOREE1TWpaYUZ3MHlOREEwTURJeE5URXdNalphCk1ITXhHekFaQmdOVkJBa1RFblJsYkdVdVlteGhZMnR0WlhOaExtZHZkakVOTUFzR0ExVUVFUk1FYm5Wc2JERVIKTUE4R0ExVUVBeE1JWW05MExYUmxjM1F4RGpBTUJnVXJ6ZzhCQVJNRFptOXZNUTR3REFZRks4NFBBUUlUQTJKaApjakVTTUJBR0JTdk9Ed0VERXdkbGVHRnRjR3hsTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCCkNnS0NBUUVBcjhXZkVET3ExVE4wYlQwU0dFdEV1RHJSYWYrVnVkbWJ5cEhva2V3eTQ2bWQ5WEIzZ1FXYmluOU4KLzV0eU5kYkZzV3NEZ0RJeVhQM1ViZTB1YmNQWWxjc0NOdGdDdks0cWQzUnlSdnhZNWxPZlMxcFpFU1BFdHZPLwpzeEV1NkUzTzBvZmN3cTR1S2VuSHVmMUVVUXVWRDZXeEFCVU9hT3MyLzNhYWhtWXk0U25LTlVzTTIvbDFYcmNJCjBla3ZCMGgxMG5YVUM0VkpTNHNLR3pHelRoRDMwOGlhL2JnRFNYYzBmaVV3WlBCNVRMbjdsU2N1aXNpKzhKU3MKcVdjY2tuWG9uR0VFdGlzbTdGTmkrbXNlVjFhaHpqRWJSTS9rZkZ3WjBIK2VrejNDZG5zbWtORDBGbXhCOVdUZgo1UHdHOG9YTTQyUUprd3VFSXUrOFEvVlZTU0ZlNHdJREFRQUJvejh3UFRBT0JnTlZIUThCQWY4RUJBTUNCYUF3CkhRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBd0RRWUoKS29aSWh2Y05BUUVMQlFBRGdnRUJBRVpZeklTMHR4K1luK2NFZlM4M2hwTDFqRUxxOUM4VjNQVEM2eTQ0a2pBSwppODVNeCtyaWRZcTBkZE1kVi85MUpaNXQxUnFkZTRMU1lVVlVQNnEvVWtpaDBteC9JM3oyU2l3cC9ZanBPdTZ4ClNaWGFrakdudDVwQ0NhL3QxTmNWTlNycVFwTFE4YkowbXJ1UmlOYXdyS28zL2dlNTdyZ2lkbkJGY092M3pWNXQKQklrWWpRSksyWVZZY0pqSjY4b2xYenBDRXc1aFRaOWZ3NDJmczJUT1JISHJQTlVBelBmM1FkcnppMDNocnZoZApwNm5ZTkExOGI2Z2d5Z2tjUlUyTVJ0ZTVFKy8yQUJZaXdSa2x3SldOSU1RSkpIeVpBVzhEeXdzMEUyZStCM3crCjcvU1lQeWVLT2x0N2ZvRDd6MFhNMkt3OW5kdXJKcTk3QVdma2Nuclp3YlE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBcjhXZkVET3ExVE4wYlQwU0dFdEV1RHJSYWYrVnVkbWJ5cEhva2V3eTQ2bWQ5WEIzCmdRV2JpbjlOLzV0eU5kYkZzV3NEZ0RJeVhQM1ViZTB1YmNQWWxjc0NOdGdDdks0cWQzUnlSdnhZNWxPZlMxcFoKRVNQRXR2Ty9zeEV1NkUzTzBvZmN3cTR1S2VuSHVmMUVVUXVWRDZXeEFCVU9hT3MyLzNhYWhtWXk0U25LTlVzTQoyL2wxWHJjSTBla3ZCMGgxMG5YVUM0VkpTNHNLR3pHelRoRDMwOGlhL2JnRFNYYzBmaVV3WlBCNVRMbjdsU2N1CmlzaSs4SlNzcVdjY2tuWG9uR0VFdGlzbTdGTmkrbXNlVjFhaHpqRWJSTS9rZkZ3WjBIK2VrejNDZG5zbWtORDAKRm14QjlXVGY1UHdHOG9YTTQyUUprd3VFSXUrOFEvVlZTU0ZlNHdJREFRQUJBb0lCQUN2Yjh2blcrcHlpYnozRwp6Rm9WaGZzMmFnUzZDc0ZLSkU2aW85YXRpbkUyWkx6V3FHc2dYQlJ0K2FkN1FUOWY3UXA5T20xbG1SMk5GTkd0CktqV25kY2JDMWpXYkp1dXZ4ZGJ5em9VWitKRFljdG9abkRuam8vVkcweUc2ZXVycVoxNHZHbzNWYXAxNHdTYU8KcE5wWU9vU2lBbzJUczNuSW4zdVZPNitubHJDS0ZCV2lJTU12SjRMODl2U0NYeUkvNWtwd0NVUnhwWWVZSnJRYgpKemk0VHNOMFZpWXFmNlhOZmhSQ1NEK0ZrOWttMmU2enNQSXVXeWZQcnRHeDFjQTJVZUFqbmpLSzlJUzlxa0F5CjYzMlQ2M1g2TTVrV3RpcklITS9yL0liZFNqK2x4R0NNcW5zU2dOWUlMUXY1c05ramdqd2xrS2wxODJ3NWwzQ1oKVGtqeUxQa0NnWUVBMGd1aHMzS0JxTTRBU0R6UUkzK2g1R1RHQTg3SVRiMEIvVGNpdEVsUFErdTNQTHlwd3o5dQpLelM5QkhNcGFXUFdJT0p6WVJBamI4QkRsZHlDY0FobXlyNWx2N08vZXpSbWdHRDlOUFY2NklFNUFYOW5LVk5TClBoSlROaVlQU0g3ZzR6TzNLNHNkNTM5N1l1blJaekF4Z3NWV3p1N0UyZ1VySlNDc2Ywbkw3N1VDZ1lFQTFqcGcKbUpiU0dZVnJZRXlRbXQ2WWpIbndjTGlOVEpEUGJjbjI3ZzBMbWNSYnE5U2ZJdmEvSWZaYWYwcnU4YjljOFFOTQpXTWFnNTdXR1FnaFMyQjc2OThHdmx3RituS1hYWkRqQ1o0ejYrRWZpL1Q1dUhMNVZEY3BIRTR5cWRaRzQyaFRXCm0rSzR3bDRaNkI1MHhHQy9tSmx4ekI2amU0cUJNOVpzbjh3U3d6Y0NnWUVBazVPMGt2NGE5MTExZVV1dythQU4KUVFsRXp4d1VRL3BPVVhqUm0xWCtxVHdPVEZCSi9uS3NseExBMDBXT2pRdW1RUWlhQkZKd2MyM2tqb0NWN04wYQpTOHltZEtCNElycFlZazdDMk5pNCtHOENmSGpsSkhYMFRNUlhUcTVEQXE2U2wwK1luTEZyMjJFSWNpRFNEZXdnCmZUN2xsUkxSb0ZVTlVWSzVuOTFidWhrQ2dZRUF3cVVFQTJCMXdRNkNnMXJOd0lram5lOWxVV1c5cktXZWNxaWcKbmFab3RldTlSeURHL3FPbkFocXVHeDVnZ0hKWTVmc1RNVTQ0QUkva1RyYjFYcnkzVnNrNjJ6OVdaTW9pTEVPTwpEenYvQS90OCtJL3l5RmIvUEtwZmJobk8vMGZKNXd3citqTkRvQWFVRDEwc3h3a0l6SVFPNjJHak5LcWh2aEhEClhHVzFYbjBDZ1lFQXpVTEFJOWlqL3E1UytHTXlZajF4TENVNHF4QnBVLzA0bkUrUGZTU21mdjhNYTM0dWg0UU0KblJEY1pIQnFaWU5SRHQ1ek52UlRqZ3dKaTRpSEd3U0IrRDRTSVlHYjBpb1RJMk1PUzJGN3pCRHlsOEZYcDdkVAozVFNLcm9ud29XWW9MU2lzcW5uL3M4aU4xTTlSSkE5cHlJeTdGVFZ3cTU5WEwzTm9ldElTdUtjPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
diff --git a/lib/tbot/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden b/lib/tbot/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden
deleted file mode 100644
index 12f013ddf6d1b..0000000000000
--- a/lib/tbot/testdata/TestKubernetesV2OutputService_render/relative_path/kubeconfig.yaml.golden
+++ /dev/null
@@ -1,45 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/YQ
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yg
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLakNDQWhLZ0F3SUJBZ0lRSnRKREpaWkJrZy9hZk04ZDJaSkNUakFOQmdrcWhraUc5dzBCQVFzRkFEQkEKTVJVd0V3WURWUVFLRXd4VVpXeGxjRzl5ZENCUFUxTXhKekFsQmdOVkJBTVRIblJsYkdWd2IzSjBMbXh2WTJGcwphRzl6ZEM1c2IyTmhiR1J2YldGcGJqQWVGdzB4TnpBMU1Ea3hPVFF3TXpaYUZ3MHlOekExTURjeE9UUXdNelphCk1FQXhGVEFUQmdOVkJBb1RERlJsYkdWd2IzSjBJRTlUVXpFbk1DVUdBMVVFQXhNZWRHVnNaWEJ2Y25RdWJHOWoKWVd4b2IzTjBMbXh2WTJGc1pHOXRZV2x1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQwpBUUVBdUtGTGFmMmlJSS94RFIrbTJZajZQblVFYStxenF3eHNkTFVqbnVuRlphQVhHK2habTRNbDgwU0NpQmdJCmdUSFFsSnlMSWtUdHVSb0g1YWVNeXoxRVJVQ3RpaTRac1RxRHJqalV5YnhQNHIrNEhWWDZtMzRzNmh3RXI4RmkKZnRzOXBNcDRpUzN0UWd1UmMyOGdQZERvL1Q2VnJKVFZZVWZVVXNORFJ0SXJsQjVPOWlncXFMbnVhWTllcUdpNApQVXgwRzB3UllKcFJ5d29qOEcwSWtwZlFUaVgrQ0FDN2R0NXdzN1pybkdxQ05CTEdpNWJHc2FNbXB0VmJzU0VwCjFUZW5udEY1NFYxaVI0OUlWNUpxRGhtMVMwSG1rbGVvSnpLZGMrNnNQL3hOZXB6OVBKenVGOWQ5TnViVExXZ0IKc0syOFlJdGNtV0hkSFhEL09EeFZhZWhSandJREFRQUJveUF3SGpBT0JnTlZIUThCQWY4RUJBTUNCNEF3REFZRApWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQVZVNnNOQmRqNzZzYUh3T3hHU2RuRXFRCm8ydE11UjNtc1NNNEY2d0ZLMlVrS2Vwc0Q3Q1lJZi9Qek5TTlVxQTVKSUVVVmVNcUd5aUh1QWJVNEM2NTVuVDEKSXlKWDFELytyNzNzU3A1amJJcFFtMnhvUUdabmo2Zy9LbHR3OE9TT0F3K0RzTUYvUExWcW9XSnAwN3U2ZXcvbQpOeFdzSktjWjVrK3E0ZU14Y2k5bUtSSEhxc3F1V0tYelFsVVJNTkZJK21HYUZ3cktNNGRtemFSMEJFYytpbFN4ClFxVXZRNzRzbXNMSyt6aE5pa21namxHQzVvYjlnOFhraFZBa0pNQWgycmI5b25ETmlSbDY4aUFnY3pQODhtWHUKdk4vbzk4ZHlwenNQeFhtdzZ0a0RxSVJQVUFVYmg0NjVybFk1c0tNbVJnWGkyclVmbC9RVjVuYm96VW8vSFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
-    server: https://tele.blackmesa.gov:443/v1/teleport/dGVsZS5ibGFja21lc2EuZ292/Yw
-    tls-server-name: kube-teleport-proxy-alpn.tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-contexts:
-- context:
-    cluster: tele.blackmesa.gov-a
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-a
-- context:
-    cluster: tele.blackmesa.gov-b
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-b
-- context:
-    cluster: tele.blackmesa.gov-c
-    user: tele.blackmesa.gov
-  name: tele.blackmesa.gov-c
-current-context: tele.blackmesa.gov-a
-kind: Config
-preferences: {}
-users:
-- name: tele.blackmesa.gov
-  user:
-    exec:
-      apiVersion: client.authentication.k8s.io/v1beta1
-      args:
-      - kube
-      - credentials
-      - --destination-dir=/test/dir
-      command: /path/to/tbot
-      env: null
-      provideClusterInfo: false
diff --git a/lib/tbot/tshwrap/wrap.go b/lib/tbot/tshwrap/wrap.go
index 38447ce57b19d..4cf5c786b7156 100644
--- a/lib/tbot/tshwrap/wrap.go
+++ b/lib/tbot/tshwrap/wrap.go
@@ -32,9 +32,10 @@ import (
 	"github.com/gravitational/teleport/api/identityfile"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
 	"github.com/gravitational/teleport/lib/tlsca"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
@@ -127,15 +128,15 @@ func (w *Wrapper) Exec(env map[string]string, args ...string) error {
 }
 
 type destinationHolder interface {
-	GetDestination() bot.Destination
+	GetDestination() destination.Destination
 }
 
 // GetDestinationDirectory attempts to select an unambiguous destination, either
 // from CLI or YAML config. It returns an error if the selected destination is
 // invalid. Note that CLI destinations will not be validated.
-func GetDestinationDirectory(cliDestinationPath string, botConfig *config.BotConfig) (*config.DestinationDirectory, error) {
+func GetDestinationDirectory(cliDestinationPath string, botConfig *config.BotConfig) (*destination.Directory, error) {
 	if cliDestinationPath != "" {
-		d := &config.DestinationDirectory{
+		d := &destination.Directory{
 			Path: cliDestinationPath,
 		}
 		if err := d.CheckAndSetDefaults(); err != nil {
@@ -157,10 +158,10 @@ func GetDestinationDirectory(cliDestinationPath string, botConfig *config.BotCon
 	} else if len(destinationHolders) > 1 {
 		return nil, trace.BadParameter("the config file contains multiple outputs and services; a --destination-dir must be specified")
 	}
-	destination := destinationHolders[0].GetDestination()
-	destinationDir, ok := destination.(*config.DestinationDirectory)
+	dest := destinationHolders[0].GetDestination()
+	destinationDir, ok := dest.(*destination.Directory)
 	if !ok {
-		return nil, trace.BadParameter("destination %s must be a directory", destination)
+		return nil, trace.BadParameter("destination %s must be a directory", dest)
 	}
 
 	return destinationDir, nil
@@ -191,9 +192,9 @@ func GetEnvForTSH(destPath string) (map[string]string, error) {
 
 	// We don't want to provide a fallback for CAs since it would be ambiguous,
 	// so we'll specify them exactly.
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA))] = filepath.Join(destPath, config.UserCAPath)
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA))] = filepath.Join(destPath, config.HostCAPath)
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA))] = filepath.Join(destPath, config.DatabaseCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA))] = filepath.Join(destPath, internal.UserCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA))] = filepath.Join(destPath, internal.HostCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA))] = filepath.Join(destPath, internal.DatabaseCAPath)
 
 	return env, nil
 }
diff --git a/lib/tbot/tshwrap/wrap_test.go b/lib/tbot/tshwrap/wrap_test.go
index 2e4b81d7d0648..1e2654613240f 100644
--- a/lib/tbot/tshwrap/wrap_test.go
+++ b/lib/tbot/tshwrap/wrap_test.go
@@ -28,8 +28,11 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/internal"
+	identitysvc "github.com/gravitational/teleport/lib/tbot/services/identity"
 )
 
 // TestGetEnvForTSH ensures we generate a valid minimum subset of environment
@@ -42,9 +45,9 @@ func TestGetEnvForTSH(t *testing.T) {
 		client.VirtualPathEnvName(client.VirtualPathDatabase, nil): filepath.Join(p, identity.TLSCertKey),
 		client.VirtualPathEnvName(client.VirtualPathAppCert, nil):  filepath.Join(p, identity.TLSCertKey),
 
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA)):     filepath.Join(p, config.UserCAPath),
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA)):     filepath.Join(p, config.HostCAPath),
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA)): filepath.Join(p, config.DatabaseCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA)):     filepath.Join(p, internal.UserCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA)):     filepath.Join(p, internal.HostCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA)): filepath.Join(p, internal.DatabaseCAPath),
 	}
 
 	env, err := GetEnvForTSH(p)
@@ -57,9 +60,9 @@ func TestGetEnvForTSH(t *testing.T) {
 func TestGetDestinationDirectory(t *testing.T) {
 	config := func(outputCount int) *config.BotConfig {
 		cfg := &config.BotConfig{}
-		for i := 0; i < outputCount; i++ {
-			cfg.Services = append(cfg.Services, &config.IdentityOutput{
-				Destination: &config.DestinationDirectory{
+		for i := range outputCount {
+			cfg.Services = append(cfg.Services, &identitysvc.OutputConfig{
+				Destination: &destination.Directory{
 					Path: fmt.Sprintf("/from-bot-config%d", i),
 				},
 			})
diff --git a/lib/tbot/workloadidentity/crl_cache.go b/lib/tbot/workloadidentity/crl_cache.go
index 22bb6c0300253..c8bcd22d50915 100644
--- a/lib/tbot/workloadidentity/crl_cache.go
+++ b/lib/tbot/workloadidentity/crl_cache.go
@@ -29,6 +29,8 @@ import (
 	"github.com/gravitational/trace"
 
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
 )
 
 // CRLSet is a collection of CRLs.
@@ -66,11 +68,65 @@ func (b *CRLSet) Stale() <-chan struct{} {
 	return b.stale
 }
 
+// NewCRLCacheFacade creates a new TrustBundleCacheFacade.
+func NewCRLCacheFacade() *CRLCacheFacade {
+	return &CRLCacheFacade{ready: make(chan struct{})}
+}
+
+// CRLCacheFacade wraps a CRLCache to provide lazy initialization using its
+// BuildService method. It allows you to create a cache and pass it to service
+// builders before it has been initialized by running the bot.
+type CRLCacheFacade struct {
+	mu       sync.Mutex
+	ready    chan struct{}
+	crlCache *CRLCache
+}
+
+// Builder returns a bot.ServiceBuilder to build the CRLCache once when the bot
+// starts up.
+func (f *CRLCacheFacade) Builder() bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		f.mu.Lock()
+		defer f.mu.Unlock()
+
+		if f.crlCache == nil {
+			var err error
+			f.crlCache, err = NewCRLCache(CRLCacheConfig{
+				RevocationsClient: deps.Client.WorkloadIdentityRevocationServiceClient(),
+				Logger:            deps.Logger,
+				StatusReporter:    deps.GetStatusReporter(),
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			close(f.ready)
+		}
+
+		return f.crlCache, nil
+	}
+	return bot.NewServiceBuilder("internal/crl-cache", "crl-cache", buildFn)
+}
+
+func (m *CRLCacheFacade) GetCRLSet(ctx context.Context) (*CRLSet, error) {
+	select {
+	case <-m.ready:
+		m.mu.Lock()
+		cache := m.crlCache
+		m.mu.Unlock()
+
+		return cache.GetCRLSet(ctx)
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
 // CRLCache streams CRLs from the revocations service and caches them. It
 // provides a mechanism to inform consumers when a new CRL is available.
 type CRLCache struct {
-	revocationsClient workloadidentityv1pb.WorkloadIdentityRevocationServiceClient
-	logger            *slog.Logger
+	revocationsClient  workloadidentityv1pb.WorkloadIdentityRevocationServiceClient
+	logger             *slog.Logger
+	botIdentityReadyCh <-chan struct{}
+	statusReporter     readyz.Reporter
 
 	mu     sync.Mutex
 	crlSet *CRLSet
@@ -80,8 +136,10 @@ type CRLCache struct {
 
 // CRLCacheConfig is the configuration for a CRLCache.
 type CRLCacheConfig struct {
-	RevocationsClient workloadidentityv1pb.WorkloadIdentityRevocationServiceClient
-	Logger            *slog.Logger
+	RevocationsClient  workloadidentityv1pb.WorkloadIdentityRevocationServiceClient
+	Logger             *slog.Logger
+	BotIdentityReadyCh <-chan struct{}
+	StatusReporter     readyz.Reporter
 }
 
 // NewCRLCache creates a new CRLCache.
@@ -92,10 +150,15 @@ func NewCRLCache(cfg CRLCacheConfig) (*CRLCache, error) {
 	case cfg.Logger == nil:
 		return nil, trace.BadParameter("missing Logger")
 	}
+	if cfg.StatusReporter == nil {
+		cfg.StatusReporter = readyz.NoopReporter()
+	}
 	return &CRLCache{
-		revocationsClient: cfg.RevocationsClient,
-		logger:            cfg.Logger,
-		initialized:       make(chan struct{}),
+		revocationsClient:  cfg.RevocationsClient,
+		logger:             cfg.Logger,
+		botIdentityReadyCh: cfg.BotIdentityReadyCh,
+		statusReporter:     cfg.StatusReporter,
+		initialized:        make(chan struct{}),
 	}, nil
 }
 
@@ -106,6 +169,19 @@ func (m *CRLCache) String() string {
 }
 
 func (m *CRLCache) Run(ctx context.Context) error {
+	if m.botIdentityReadyCh != nil {
+		select {
+		case <-m.botIdentityReadyCh:
+		default:
+			m.logger.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-m.botIdentityReadyCh:
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	}
+
 	for {
 		m.logger.InfoContext(
 			ctx,
@@ -131,6 +207,7 @@ func (m *CRLCache) Run(ctx context.Context) error {
 				"error", err,
 				"backoff", trustBundleInitFailureBackoff,
 			)
+			m.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
 		}
 		select {
 		case <-ctx.Done():
@@ -152,6 +229,7 @@ func (m *CRLCache) watch(ctx context.Context) error {
 		return trace.Wrap(err, "opening CRL stream")
 	}
 
+	m.statusReporter.Report(readyz.Healthy)
 	for {
 		res, err := stream.Recv()
 		if err != nil {
diff --git a/lib/tbot/workloadidentity/issue.go b/lib/tbot/workloadidentity/issue.go
index 661ca2366f2ee..fb347e849e693 100644
--- a/lib/tbot/workloadidentity/issue.go
+++ b/lib/tbot/workloadidentity/issue.go
@@ -26,10 +26,10 @@ import (
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	apiclient "github.com/gravitational/teleport/api/client"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity/attrs"
 )
 
@@ -81,7 +81,7 @@ func IssueX509WorkloadIdentity(
 	ctx context.Context,
 	log *slog.Logger,
 	clt authClient,
-	workloadIdentity config.WorkloadIdentitySelector,
+	workloadIdentity bot.WorkloadIdentitySelector,
 	ttl time.Duration,
 	attest *attrs.WorkloadAttrs,
 ) ([]*workloadidentityv1pb.Credential, crypto.Signer, error) {
@@ -182,8 +182,8 @@ func labelsToSelectors(in map[string][]string) []*workloadidentityv1pb.LabelSele
 func IssueJWTWorkloadIdentity(
 	ctx context.Context,
 	log *slog.Logger,
-	clt *authclient.Client,
-	workloadIdentity config.WorkloadIdentitySelector,
+	clt *apiclient.Client,
+	workloadIdentity bot.WorkloadIdentitySelector,
 	audiences []string,
 	ttl time.Duration,
 	attest *attrs.WorkloadAttrs,
diff --git a/lib/tbot/workloadidentity/trust_bundle_cache.go b/lib/tbot/workloadidentity/trust_bundle_cache.go
index 962597c798000..21644b33be31f 100644
--- a/lib/tbot/workloadidentity/trust_bundle_cache.go
+++ b/lib/tbot/workloadidentity/trust_bundle_cache.go
@@ -40,6 +40,8 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/readyz"
 )
 
 var tracer = otel.Tracer("github.com/gravitational/teleport/lib/spiffe")
@@ -170,12 +172,14 @@ type eventsWatcher interface {
 // preferable to serve the last-good value than to disrupt subscribed workloads
 // ability to communicate.
 type TrustBundleCache struct {
-	federationClient machineidv1pb.SPIFFEFederationServiceClient
-	trustClient      trustv1.TrustServiceClient
-	eventsClient     eventsWatcher
-	clusterName      string
+	federationClient   machineidv1pb.SPIFFEFederationServiceClient
+	trustClient        trustv1.TrustServiceClient
+	eventsClient       eventsWatcher
+	clusterName        string
+	botIdentityReadyCh <-chan struct{}
 
-	logger *slog.Logger
+	logger         *slog.Logger
+	statusReporter readyz.Reporter
 
 	mu        sync.RWMutex
 	bundleSet *BundleSet
@@ -191,11 +195,73 @@ func (m *TrustBundleCache) String() string {
 
 // TrustBundleCacheConfig is the configuration for a TrustBundleCache.
 type TrustBundleCacheConfig struct {
-	FederationClient machineidv1pb.SPIFFEFederationServiceClient
-	TrustClient      trustv1.TrustServiceClient
-	EventsClient     eventsWatcher
-	ClusterName      string
-	Logger           *slog.Logger
+	FederationClient   machineidv1pb.SPIFFEFederationServiceClient
+	TrustClient        trustv1.TrustServiceClient
+	EventsClient       eventsWatcher
+	ClusterName        string
+	Logger             *slog.Logger
+	BotIdentityReadyCh <-chan struct{}
+	StatusReporter     readyz.Reporter
+}
+
+// TrustBundleCacheFacade wraps a TrustBundleCache to provide lazy initialization
+// using its BuildService method. It allows you to create a cache and pass it to
+// service builders before it has been initialized by running the bot.
+type TrustBundleCacheFacade struct {
+	mu          sync.Mutex
+	ready       chan struct{}
+	bundleCache *TrustBundleCache
+}
+
+// NewTrustBundleCacheFacade creates a new TrustBundleCacheFacade.
+func NewTrustBundleCacheFacade() *TrustBundleCacheFacade {
+	return &TrustBundleCacheFacade{ready: make(chan struct{})}
+}
+
+// Builder returns a bot.ServiceBuilder to build the TrustBundleCache when the
+// bot starts up.
+func (f *TrustBundleCacheFacade) Builder() bot.ServiceBuilder {
+	buildFn := func(deps bot.ServiceDependencies) (bot.Service, error) {
+		f.mu.Lock()
+		defer f.mu.Unlock()
+
+		if f.bundleCache == nil {
+			var err error
+			f.bundleCache, err = NewTrustBundleCache(TrustBundleCacheConfig{
+				FederationClient:   deps.Client.SPIFFEFederationServiceClient(),
+				TrustClient:        deps.Client.TrustClient(),
+				EventsClient:       deps.Client,
+				ClusterName:        deps.BotIdentity().ClusterName,
+				BotIdentityReadyCh: deps.BotIdentityReadyCh,
+				Logger:             deps.Logger,
+				StatusReporter:     deps.GetStatusReporter(),
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			close(f.ready)
+		}
+		return f.bundleCache, nil
+	}
+
+	return bot.NewServiceBuilder(
+		"internal/spiffe-trust-bundle-cache",
+		"spiffe-trust-bundle-cache",
+		buildFn,
+	)
+}
+
+func (f *TrustBundleCacheFacade) GetBundleSet(ctx context.Context) (*BundleSet, error) {
+	select {
+	case <-f.ready:
+		f.mu.Lock()
+		cache := f.bundleCache
+		f.mu.Unlock()
+
+		return cache.GetBundleSet(ctx)
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
 }
 
 // NewTrustBundleCache creates a new TrustBundleCache.
@@ -212,22 +278,43 @@ func NewTrustBundleCache(cfg TrustBundleCacheConfig) (*TrustBundleCache, error)
 	case cfg.Logger == nil:
 		return nil, trace.BadParameter("missing Logger")
 	}
+	if cfg.StatusReporter == nil {
+		cfg.StatusReporter = readyz.NoopReporter()
+	}
 	return &TrustBundleCache{
-		federationClient: cfg.FederationClient,
-		trustClient:      cfg.TrustClient,
-		eventsClient:     cfg.EventsClient,
-		clusterName:      cfg.ClusterName,
-		logger:           cfg.Logger,
-		initialized:      make(chan struct{}),
+		federationClient:   cfg.FederationClient,
+		trustClient:        cfg.TrustClient,
+		eventsClient:       cfg.EventsClient,
+		clusterName:        cfg.ClusterName,
+		logger:             cfg.Logger,
+		botIdentityReadyCh: cfg.BotIdentityReadyCh,
+		statusReporter:     cfg.StatusReporter,
+		initialized:        make(chan struct{}),
 	}, nil
 }
 
-const trustBundleInitFailureBackoff = 10 * time.Second
+const (
+	trustBundleInitFailureBackoff = 10 * time.Second
+	trustBundleInitTimeout        = 30 * time.Second
+)
 
 // Run initializes the cache and begins watching for events. It will block until
 // the context is canceled, at which point it will return nil.
 // Implements the tbot Service interface.
 func (m *TrustBundleCache) Run(ctx context.Context) error {
+	if m.botIdentityReadyCh != nil {
+		select {
+		case <-m.botIdentityReadyCh:
+		default:
+			m.logger.InfoContext(ctx, "Waiting for internal bot identity to be renewed before running")
+			select {
+			case <-m.botIdentityReadyCh:
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	}
+
 	for {
 		m.logger.InfoContext(
 			ctx,
@@ -243,6 +330,7 @@ func (m *TrustBundleCache) Run(ctx context.Context) error {
 				"error", err,
 				"backoff", trustBundleInitFailureBackoff,
 			)
+			m.statusReporter.ReportReason(readyz.Unhealthy, err.Error())
 		}
 		select {
 		case <-ctx.Done():
@@ -285,16 +373,27 @@ func (m *TrustBundleCache) watch(ctx context.Context) error {
 	}()
 
 	select {
-	case <-ctx.Done():
-		return ctx.Err()
 	case event := <-watcher.Events():
 		if event.Type != types.OpInit {
 			return trace.BadParameter("unexpected event type: %v", event.Type)
 		}
+		// When we receive the init event, we know the watcher is now active
+		// and we can begin streaming events.
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(trustBundleInitTimeout):
+		// If we don't explicitly time out here, then we'd "block" silently
+		// waiting for the init op to come through - which can be confusing to
+		// end users. This can happen if the auth cache fails to init. So
+		// instead, we give up after a reasonable amount of time and try again
+		// after a backoff.
+		return trace.LimitExceeded("timeout waiting for watcher init")
 	case <-watcher.Done():
 		return trace.Wrap(watcher.Error(), "watcher closed before initialization")
 	}
 
+	m.statusReporter.Report(readyz.Healthy)
+
 	// Now that we know our watcher is streaming events, we can fetch the
 	// current point-in-time list of resources.
 	bundleSet, err := FetchInitialBundleSet(
diff --git a/lib/tbot/workloadidentity/trust_bundle_cache_test.go b/lib/tbot/workloadidentity/trust_bundle_cache_test.go
index b8de1603298fc..e4e50217a13d6 100644
--- a/lib/tbot/workloadidentity/trust_bundle_cache_test.go
+++ b/lib/tbot/workloadidentity/trust_bundle_cache_test.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/x509/pkix"
+	"os"
 	"testing"
 	"time"
 
@@ -40,9 +41,14 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
 func TestBundleSet_Clone(t *testing.T) {
 	t.Parallel()
 
@@ -159,7 +165,7 @@ func makeSPIFFEBundle(t *testing.T, td string) *spiffebundle.Bundle {
 func TestTrustBundleCache_Run(t *testing.T) {
 	t.Parallel()
 
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
diff --git a/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go b/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
index 652467b7a4b0a..0f4ae802872c7 100644
--- a/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
@@ -35,6 +35,7 @@ import (
 
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestDockerAttestor(t *testing.T) {
@@ -78,7 +79,7 @@ func TestDockerAttestor(t *testing.T) {
 			Enabled: true,
 			Addr:    "unix://" + lis.Addr().String(),
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 
 	attestor.rootPath = t.TempDir()
diff --git a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
index 19eeaa2a27250..3edc32a5de15a 100644
--- a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
@@ -42,11 +42,12 @@ import (
 
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestKubernetesAttestor_Attest(t *testing.T) {
 	t.Parallel()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 	ctx := context.Background()
 
 	mockToken := "FOOBARBUZZ"
diff --git a/lib/tbot/workloadidentity/workloadattest/podman/client_test.go b/lib/tbot/workloadidentity/workloadattest/podman/client_test.go
index 32b3547384d78..7b3254226326f 100644
--- a/lib/tbot/workloadidentity/workloadattest/podman/client_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/podman/client_test.go
@@ -29,7 +29,8 @@ import (
 )
 
 func TestClient(t *testing.T) {
-	server := podman.NewTestServer(t,
+	server, err := podman.NewFakeServer(
+		t.TempDir(),
 		podman.WithContainer(podman.Container{
 			ID:   "container-1234",
 			Name: "web-server",
@@ -45,6 +46,14 @@ func TestClient(t *testing.T) {
 			Labels: map[string]string{"technology": "node.js"},
 		}),
 	)
+	require.NoError(t, err)
+
+	server.Start()
+	t.Cleanup(func() {
+		if err := server.Close(); err != nil {
+			t.Logf("failed to close http server: %v", err)
+		}
+	})
 
 	client, err := podman.NewClient(server.Addr())
 	require.NoError(t, err)
diff --git a/lib/tbot/workloadidentity/workloadattest/podman/fake_server.go b/lib/tbot/workloadidentity/workloadattest/podman/fake_server.go
new file mode 100644
index 0000000000000..a68cba443961d
--- /dev/null
+++ b/lib/tbot/workloadidentity/workloadattest/podman/fake_server.go
@@ -0,0 +1,128 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package podman
+
+import (
+	"encoding/json"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
+// FakeServer is a fake implementation of the Podman REST API that can be used
+// in tests.
+type FakeServer struct {
+	srv        *http.Server
+	lis        net.Listener
+	addr       string
+	containers map[string]*Container
+	pods       map[string]*Pod
+}
+
+// NewFakeServer creates a test server. Call Start to run the server and Close to stop it.
+func NewFakeServer(socketAddr string, opts ...TestServerOption) (*FakeServer, error) {
+	lis, err := net.Listen("unix", filepath.Join(socketAddr, "podman.sock"))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	s := &FakeServer{
+		containers: make(map[string]*Container),
+		pods:       make(map[string]*Pod),
+		addr:       "unix://" + lis.Addr().String(),
+		lis:        lis,
+	}
+	for _, opt := range opts {
+		opt(s)
+	}
+
+	s.srv = &http.Server{
+		Handler: s,
+	}
+
+	return s, nil
+}
+
+func (s *FakeServer) Start() {
+	go func() { _ = s.srv.Serve(s.lis) }()
+}
+
+func (s *FakeServer) Close() error {
+	return trace.Wrap(s.srv.Close())
+}
+
+// ServeHTTP satisfies the http.Handler interface.
+func (s *FakeServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	path, hasPrefix := strings.CutPrefix(r.URL.Path, "/v4.0.0/libpod")
+	if !hasPrefix {
+		http.NotFound(w, r)
+		return
+	}
+
+	path, hasSuffix := strings.CutSuffix(path, "/json")
+	if !hasSuffix {
+		http.NotFound(w, r)
+		return
+	}
+
+	if id, hasPrefix := strings.CutPrefix(path, "/containers/"); hasPrefix {
+		container, ok := s.containers[id]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(container)
+		return
+	}
+
+	if id, hasPrefix := strings.CutPrefix(path, "/pods/"); hasPrefix {
+		pod, ok := s.pods[id]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(pod)
+		return
+	}
+
+	http.NotFound(w, r)
+}
+
+// Addr returns the address on which the test server can be reached.
+func (s *FakeServer) Addr() string { return s.addr }
+
+// TestServerOption configures the test server.
+type TestServerOption func(*FakeServer)
+
+// WithContainer adds a container to the test server's mock data.
+func WithContainer(c Container) TestServerOption {
+	return func(s *FakeServer) {
+		s.containers[c.ID] = &c
+	}
+}
+
+// WithPod adds a pod to the test server's mock data.
+func WithPod(p Pod) TestServerOption {
+	return func(s *FakeServer) {
+		s.pods[p.ID] = &p
+	}
+}
diff --git a/lib/tbot/workloadidentity/workloadattest/podman/test_server.go b/lib/tbot/workloadidentity/workloadattest/podman/test_server.go
deleted file mode 100644
index 0849293488b55..0000000000000
--- a/lib/tbot/workloadidentity/workloadattest/podman/test_server.go
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package podman
-
-import (
-	"encoding/json"
-	"net"
-	"net/http"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestServer is a fake implementation of the Podman REST API that can be used
-// in tests.
-type TestServer struct {
-	addr       string
-	containers map[string]*Container
-	pods       map[string]*Pod
-}
-
-// NewTestServer creates a test server that will run until the test exits.
-func NewTestServer(t *testing.T, opts ...TestServerOption) *TestServer {
-	t.Helper()
-
-	s := &TestServer{
-		containers: make(map[string]*Container),
-		pods:       make(map[string]*Pod),
-	}
-	for _, opt := range opts {
-		opt(s)
-	}
-
-	lis, err := net.Listen("unix", filepath.Join(t.TempDir(), "podman.sock"))
-	require.NoError(t, err)
-	s.addr = "unix://" + lis.Addr().String()
-
-	httpServer := &http.Server{Handler: s}
-	go func() { _ = httpServer.Serve(lis) }()
-
-	t.Cleanup(func() {
-		if err := httpServer.Close(); err != nil {
-			t.Logf("failed to close http server: %v", err)
-		}
-	})
-
-	return s
-}
-
-// ServeHTTP satisfies the http.Handler interface.
-func (s *TestServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	path, hasPrefix := strings.CutPrefix(r.URL.Path, "/v4.0.0/libpod")
-	if !hasPrefix {
-		http.NotFound(w, r)
-		return
-	}
-
-	path, hasSuffix := strings.CutSuffix(path, "/json")
-	if !hasSuffix {
-		http.NotFound(w, r)
-		return
-	}
-
-	if id, hasPrefix := strings.CutPrefix(path, "/containers/"); hasPrefix {
-		container, ok := s.containers[id]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		_ = json.NewEncoder(w).Encode(container)
-		return
-	}
-
-	if id, hasPrefix := strings.CutPrefix(path, "/pods/"); hasPrefix {
-		pod, ok := s.pods[id]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		_ = json.NewEncoder(w).Encode(pod)
-		return
-	}
-
-	http.NotFound(w, r)
-}
-
-// Addr returns the address on which the test server can be reached.
-func (s *TestServer) Addr() string { return s.addr }
-
-// TestServerOption configures the test server.
-type TestServerOption func(*TestServer)
-
-// WithContainer adds a container to the test server's mock data.
-func WithContainer(c Container) TestServerOption {
-	return func(s *TestServer) {
-		s.containers[c.ID] = &c
-	}
-}
-
-// WithPod adds a pod to the test server's mock data.
-func WithPod(p Pod) TestServerOption {
-	return func(s *TestServer) {
-		s.pods[p.ID] = &p
-	}
-}
diff --git a/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go b/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
index 9dbdafc6b851c..629614da53e04 100644
--- a/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
@@ -33,10 +33,12 @@ import (
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest/podman"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestPodmanAttestor(t *testing.T) {
-	server := podman.NewTestServer(t,
+	server, err := podman.NewFakeServer(
+		t.TempDir(),
 		podman.WithContainer(podman.Container{
 			ID:   "d54768c18894b931db6f6876f6be2178d8a8b34fc3485659fda78fe86af3e08b",
 			Name: "web-server",
@@ -52,13 +54,21 @@ func TestPodmanAttestor(t *testing.T) {
 			Labels: map[string]string{"department": "marketing"},
 		}),
 	)
+	require.NoError(t, err)
+
+	server.Start()
+	t.Cleanup(func() {
+		if err := server.Close(); err != nil {
+			t.Logf("failed to close http server: %v", err)
+		}
+	})
 
 	attestor := NewPodmanAttestor(
 		PodmanAttestorConfig{
 			Enabled: true,
 			Addr:    server.Addr(),
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 
 	attestor.rootPath = t.TempDir()
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
index 5d0d6c05ad6fe..e178542664129 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
@@ -36,7 +36,7 @@ import (
 
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest/sigstore"
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest/sigstore/sigstoretest"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 var loopbackPrefixes = []string{"127.0.0.1/8", "::1/128"}
@@ -49,7 +49,7 @@ func TestDiscovery_SimpleSigning(t *testing.T) {
 		fmt.Sprintf("%s/simple-signing:v1", registry),
 		"sha256:21c76c650023cac8d753af4cb591e6f7450c6e2b499b5751d4a21e26e2fc5012",
 		sigstore.DiscoveryConfig{
-			Logger:                        utils.NewSlogLoggerForTests(),
+			Logger:                        logtest.NewLogger(),
 			AllowedPrivateNetworkPrefixes: loopbackPrefixes,
 		},
 	)
@@ -128,7 +128,7 @@ func TestDiscovery_Attestations(t *testing.T) {
 		fmt.Sprintf("%s/attestations:v1", registry),
 		"sha256:32c91fcdf8b41ef78cf63e7be080a366597fd5a748480f5d2a6dc0cff5203807",
 		sigstore.DiscoveryConfig{
-			Logger:                        utils.NewSlogLoggerForTests(),
+			Logger:                        logtest.NewLogger(),
 			AllowedPrivateNetworkPrefixes: loopbackPrefixes,
 		},
 	)
@@ -168,7 +168,7 @@ func TestDiscovery_InfiniteRedirects(t *testing.T) {
 		fmt.Sprintf("%s/foo:v1", regURL.Host),
 		"sha256:32c91fcdf8b41ef78cf63e7be080a366597fd5a748480f5d2a6dc0cff5203807",
 		sigstore.DiscoveryConfig{
-			Logger:                        utils.NewSlogLoggerForTests(),
+			Logger:                        logtest.NewLogger(),
 			AllowedPrivateNetworkPrefixes: loopbackPrefixes,
 		},
 	)
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore_test.go b/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
index 45175113cdda0..50edf26bcb71d 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
@@ -32,7 +32,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity/workloadattest/sigstore/sigstoretest"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 var loopbackPrefixes = []string{"127.0.0.1/8", "::1/128"}
@@ -118,7 +118,7 @@ func TestSigstoreAttestor_Attest_WithCredentials(t *testing.T) {
 			CredentialsPath:               dockerConfigFile,
 			AllowedPrivateNetworkPrefixes: loopbackPrefixes,
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 	require.NoError(t, err)
 
@@ -151,7 +151,7 @@ func TestSigstoreAttestor_Attest_Caching(t *testing.T) {
 			Enabled:                       true,
 			AllowedPrivateNetworkPrefixes: loopbackPrefixes,
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 	require.NoError(t, err)
 
diff --git a/lib/tbot/workloadidentity/workloadattest/systemd_linux_test.go b/lib/tbot/workloadidentity/workloadattest/systemd_linux_test.go
index e2ec800006d17..98410a4e24253 100644
--- a/lib/tbot/workloadidentity/workloadattest/systemd_linux_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/systemd_linux_test.go
@@ -29,7 +29,7 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestSystemdAttestor_Success(t *testing.T) {
@@ -37,7 +37,7 @@ func TestSystemdAttestor_Success(t *testing.T) {
 		SystemdAttestorConfig{
 			Enabled: true,
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 
 	attestor.dbusDialer = func(context.Context) (dbusConn, error) {
@@ -59,7 +59,7 @@ func TestSystemdAttestor_NonService(t *testing.T) {
 		SystemdAttestorConfig{
 			Enabled: true,
 		},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 
 	attestor.dbusDialer = func(context.Context) (dbusConn, error) {
diff --git a/lib/tbot/workloadidentity/workloadattest/unix.go b/lib/tbot/workloadidentity/workloadattest/unix.go
index a7b0a2aaa8b04..6e12de5d16c5c 100644
--- a/lib/tbot/workloadidentity/workloadattest/unix.go
+++ b/lib/tbot/workloadidentity/workloadattest/unix.go
@@ -25,6 +25,7 @@ import (
 	"errors"
 	"io"
 	"log/slog"
+	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/shirou/gopsutil/v4/process"
@@ -35,6 +36,18 @@ import (
 // DefaultBinaryHashMaxBytes is default value for BinaryHashMaxSizeBytes.
 const DefaultBinaryHashMaxBytes = 1 << 30 // 1GiB
 
+// TestBinaryHashMaxBytes is a more suitable value for BinaryHashMaxSizeBytes
+// in tests. Reading `/proc/<pid>/exe` relies on inode stability, and in GitHub
+// Actions we've observed read stalls likely caused by overlayfs or debugfs.
+const TestBinaryHashMaxBytes = 1 << 12 // 4KiB
+
+// BinaryHashReadTimeout is the maximum amount of time we will wait to read
+// a process's executable to calculate its checksum. In normal circumstances
+// we should never reach this timeout, but reading `/proc/<pid>/exe` depends
+// on inode stability, so it's possible to encounter read stalls if there is
+// a network or overlay filesystem involved.
+const BinaryHashReadTimeout = 15 * time.Second
+
 // UnixAttestorConfig holds the configuration for the Unix workload attestor.
 type UnixAttestorConfig struct {
 	// BinaryHashMaxSize is the maximum number of bytes that will be read from
@@ -149,22 +162,51 @@ func (a *UnixAttestor) Attest(ctx context.Context, pid int) (*workloadidentityv1
 		att.BinaryPath = &path
 	}
 
-	exe, err := a.os.OpenExe(ctx, p)
+	if hash := a.hashBinary(ctx, p); hash != "" {
+		att.BinaryHash = &hash
+	}
+
+	return att, nil
+}
+
+func (a *UnixAttestor) hashBinary(ctx context.Context, proc *process.Process) string {
+	exe, err := a.os.OpenExe(ctx, proc)
 	if err != nil {
 		a.log.ErrorContext(ctx, "Failed to open workload executable for hashing", "error", err)
-		return att, nil
+		return ""
 	}
 	defer func() { _ = exe.Close() }()
 
-	hash := sha256.New()
-	if _, err := copyAtMost(hash, exe, a.cfg.BinaryHashMaxSizeBytes); err != nil {
-		a.log.ErrorContext(ctx, "Failed to hash workload executable", "error", err)
-		return att, nil
+	// Read the workload executable to calculate a checksum. We do this in a
+	// goroutine in case of read stalls (e.g. due to the executable being on
+	// a network or overlay filesystem). If this happens, the goroutine will
+	// terminate when we close the file descriptor (see defer statement above).
+	type sumResult struct {
+		sum string
+		err error
+	}
+	resCh := make(chan sumResult, 1)
+	go func() {
+		hash := sha256.New()
+		if _, err := copyAtMost(hash, exe, a.cfg.BinaryHashMaxSizeBytes); err == nil {
+			resCh <- sumResult{sum: hex.EncodeToString(hash.Sum(nil))}
+		} else {
+			resCh <- sumResult{err: err}
+		}
+	}()
+
+	select {
+	case res := <-resCh:
+		if res.err != nil {
+			a.log.ErrorContext(ctx, "Failed to hash workload executable", "error", err)
+		}
+		return res.sum
+	case <-time.After(BinaryHashReadTimeout):
+		a.log.ErrorContext(ctx, "Timeout reading workload executable. If this happens frequently, it could be due to the workload executable being on a network or overlay filesystem, you may also consider lowering `attestors.unix.binary_hash_max_size_bytes`.")
+	case <-ctx.Done():
 	}
-	sum := hex.EncodeToString(hash.Sum(nil))
-	att.BinaryHash = &sum
 
-	return att, nil
+	return ""
 }
 
 // copyAtMost copies at most n bytes from src to dst. If src contains more than
diff --git a/lib/tbot/workloadidentity/workloadattest/unix_test.go b/lib/tbot/workloadidentity/workloadattest/unix_test.go
index 6447aebfe11e5..125ce526fbdb4 100644
--- a/lib/tbot/workloadidentity/workloadattest/unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/unix_test.go
@@ -35,7 +35,7 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestUnixAttestor_Attest(t *testing.T) {
@@ -48,7 +48,7 @@ func TestUnixAttestor_Attest(t *testing.T) {
 
 	attestor := NewUnixAttestor(
 		UnixAttestorConfig{BinaryHashMaxSizeBytes: -1},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 	attestor.os = testOS{
 		exePath: func(context.Context, *process.Process) (string, error) {
@@ -83,7 +83,7 @@ func TestUnixAttestor_BinaryTooLarge(t *testing.T) {
 
 	attestor := NewUnixAttestor(
 		UnixAttestorConfig{BinaryHashMaxSizeBytes: 1024},
-		utils.NewSlogLoggerForTests(),
+		logtest.NewLogger(),
 	)
 	attestor.os = testOS{
 		exePath: func(context.Context, *process.Process) (string, error) {
diff --git a/lib/tbot/workloadidentity/workloadattest/workloadattest_test.go b/lib/tbot/workloadidentity/workloadattest/workloadattest_test.go
new file mode 100644
index 0000000000000..f0be8bd2dd6ec
--- /dev/null
+++ b/lib/tbot/workloadidentity/workloadattest/workloadattest_test.go
@@ -0,0 +1,30 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package workloadattest
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
diff --git a/lib/teleagent/agent.go b/lib/teleagent/agent.go
deleted file mode 100644
index 81077ccae6093..0000000000000
--- a/lib/teleagent/agent.go
+++ /dev/null
@@ -1,189 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package teleagent
-
-import (
-	"context"
-	"errors"
-	"io"
-	"log/slog"
-	"net"
-	"os"
-	"os/user"
-	"path/filepath"
-	"time"
-
-	"github.com/gravitational/trace"
-	"golang.org/x/crypto/ssh/agent"
-
-	"github.com/gravitational/teleport/lib/utils"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
-)
-
-// Agent extends the agent.ExtendedAgent interface.
-// APIs which accept this interface promise to
-// call `Close()` when they are done using the
-// supplied agent.
-type Agent interface {
-	agent.ExtendedAgent
-	io.Closer
-}
-
-// nopCloser wraps an agent.Agent in the extended
-// Agent interface by adding a NOP closer.
-type nopCloser struct {
-	agent.ExtendedAgent
-}
-
-func (n nopCloser) Close() error { return nil }
-
-// NopCloser wraps an agent.Agent with a NOP closer, allowing it
-// to be passed to APIs which expect the extended agent interface.
-func NopCloser(std agent.ExtendedAgent) Agent {
-	return nopCloser{std}
-}
-
-// Getter is a function used to get an agent instance.
-type Getter func() (Agent, error)
-
-// AgentServer is implementation of SSH agent server
-type AgentServer struct {
-	getAgent Getter
-	listener net.Listener
-	Path     string
-	Dir      string
-}
-
-// NewServer returns new instance of agent server
-func NewServer(getter Getter) *AgentServer {
-	return &AgentServer{getAgent: getter}
-}
-
-func (a *AgentServer) SetListener(l net.Listener) {
-	a.listener = l
-	a.Path = l.Addr().String()
-	a.Dir = filepath.Dir(a.Path)
-}
-
-// ListenUnixSocket starts listening on a new unix socket.
-func (a *AgentServer) ListenUnixSocket(sockDir, sockName string, _ *user.User) error {
-	// Create a temp directory to hold the agent socket.
-	sockDir, err := os.MkdirTemp(os.TempDir(), sockDir+"-")
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	sockPath := filepath.Join(sockDir, sockName)
-	l, err := net.Listen("unix", sockPath)
-	if err != nil {
-		a.Close()
-		return trace.Wrap(err)
-	}
-
-	a.SetListener(l)
-	return nil
-}
-
-// Serve starts serving on the listener, assumes that Listen was called before
-func (a *AgentServer) Serve() error {
-	if a.listener == nil {
-		return trace.BadParameter("Serve needs a Listen call first")
-	}
-
-	ctx := context.Background()
-	var tempDelay time.Duration // how long to sleep on accept failure
-	for {
-		conn, err := a.listener.Accept()
-		if err != nil {
-			var neterr net.Error
-			if !errors.As(err, &neterr) {
-				return trace.Wrap(err, "unknown error")
-			}
-			if utils.IsUseOfClosedNetworkError(neterr) {
-				return nil
-			}
-			if !neterr.Timeout() {
-				slog.ErrorContext(ctx, "Got non-timeout error", "error", err)
-				return trace.Wrap(err)
-			}
-			if tempDelay == 0 {
-				tempDelay = 5 * time.Millisecond
-			} else {
-				tempDelay *= 2
-			}
-			if max := 1 * time.Second; tempDelay > max {
-				tempDelay = max
-			}
-			slog.ErrorContext(ctx, "Got timeout error - backing off", "delay_time", tempDelay, "error", err)
-			time.Sleep(tempDelay)
-			continue
-		}
-		tempDelay = 0
-
-		// get an agent instance for serving this conn
-		instance, err := a.getAgent()
-		if err != nil {
-			slog.ErrorContext(ctx, "Failed to get agent", "error", err)
-			return trace.Wrap(err)
-		}
-
-		// serve agent protocol against conn in a
-		// separate goroutine.
-		go func() {
-			defer instance.Close()
-			if err := agent.ServeAgent(instance, conn); err != nil && !errors.Is(err, io.EOF) {
-				slog.ErrorContext(ctx, "Serving agent terminated unexpectedly", "error", err)
-			}
-		}()
-	}
-}
-
-// ListenAndServe is similar http.ListenAndServe
-func (a *AgentServer) ListenAndServe(addr utils.NetAddr) error {
-	l, err := net.Listen(addr.AddrNetwork, addr.Addr)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	a.listener = l
-	return a.Serve()
-}
-
-// Close closes listener and stops serving agent
-func (a *AgentServer) Close() error {
-	var errors []error
-	if a.listener != nil {
-		slog.DebugContext(context.Background(), "AgentServer is closing",
-			"listen_addr", logutils.StringerAttr(a.listener.Addr()),
-		)
-		if err := a.listener.Close(); err != nil {
-			errors = append(errors, trace.ConvertSystemError(err))
-		}
-	}
-	if a.Path != "" {
-		if err := os.Remove(a.Path); err != nil {
-			errors = append(errors, trace.ConvertSystemError(err))
-		}
-	}
-	if a.Dir != "" {
-		if err := os.RemoveAll(a.Dir); err != nil {
-			errors = append(errors, trace.ConvertSystemError(err))
-		}
-	}
-	return trace.NewAggregate(errors...)
-}
diff --git a/lib/teleterm/api/uri/uri.go b/lib/teleterm/api/uri/uri.go
index 5bf71fa816e8f..8e0826a39276b 100644
--- a/lib/teleterm/api/uri/uri.go
+++ b/lib/teleterm/api/uri/uri.go
@@ -230,6 +230,12 @@ func (r ResourceURI) AppendDBServer(id string) ResourceURI {
 	return r
 }
 
+// AppendKubeServer appends kube_server segment to the URI
+func (r ResourceURI) AppendKubeServer(id string) ResourceURI {
+	r.path = fmt.Sprintf("%v/kube_servers/%v", r.path, id)
+	return r
+}
+
 // AppendLeafCluster appends leaf cluster segment to the URI if name is not empty.
 func (r ResourceURI) AppendLeafCluster(name string) ResourceURI {
 	if name == "" {
diff --git a/lib/teleterm/apiserver/apiserver.go b/lib/teleterm/apiserver/apiserver.go
index 42916c94b571a..06034927b0619 100644
--- a/lib/teleterm/apiserver/apiserver.go
+++ b/lib/teleterm/apiserver/apiserver.go
@@ -27,10 +27,12 @@ import (
 	"github.com/gravitational/trace"
 	"google.golang.org/grpc"
 
+	autoupdateapi "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/auto_update/v1"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	vnetapi "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/teleterm/apiserver/handler"
+	"github.com/gravitational/teleport/lib/teleterm/autoupdate"
 	"github.com/gravitational/teleport/lib/teleterm/vnet"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -63,6 +65,14 @@ func New(cfg Config) (*APIServer, error) {
 		return nil, trace.Wrap(err)
 	}
 
+	autoupdateService, err := autoupdate.New(autoupdate.Config{
+		ClusterProvider:    cfg.Daemon,
+		InsecureSkipVerify: cfg.InsecureSkipVerify,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	// Create the listener, set up the server.
 
 	ls, err := newListener(cfg.HostAddr, cfg.ListeningC)
@@ -77,6 +87,7 @@ func New(cfg Config) (*APIServer, error) {
 
 	api.RegisterTerminalServiceServer(grpcServer, serviceHandler)
 	vnetapi.RegisterVnetServiceServer(grpcServer, vnetService)
+	autoupdateapi.RegisterAutoUpdateServiceServer(grpcServer, autoupdateService)
 
 	return &APIServer{
 		Config:      cfg,
diff --git a/lib/teleterm/apiserver/handler/handler_access_requests.go b/lib/teleterm/apiserver/handler/handler_access_requests.go
index 9cb6ab1c95851..234d597ed2e1c 100644
--- a/lib/teleterm/apiserver/handler/handler_access_requests.go
+++ b/lib/teleterm/apiserver/handler/handler_access_requests.go
@@ -26,6 +26,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	accesslistv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1"
+	"github.com/gravitational/teleport/api/types"
 	accesslistv1conv "github.com/gravitational/teleport/api/types/accesslist/convert/v1"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
@@ -174,15 +175,7 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 		}
 	}
 
-	requestedResourceIDs := make([]*api.ResourceID, 0, len(req.GetRequestedResourceIDs()))
-	for _, r := range req.GetRequestedResourceIDs() {
-		requestedResourceIDs = append(requestedResourceIDs, &api.ResourceID{
-			ClusterName:     r.ClusterName,
-			Kind:            r.Kind,
-			Name:            r.Name,
-			SubResourceName: r.SubResourceName,
-		})
-	}
+	requestedResourceIDs := req.GetRequestedResourceIDs()
 	resources := make([]*api.Resource, len(requestedResourceIDs))
 	for i, r := range requestedResourceIDs {
 		details := req.ResourceDetails[resourceIDToString(r)]
@@ -200,6 +193,11 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 		}
 	}
 
+	dryRunEnrichment := req.GetDryRunEnrichment()
+	if dryRunEnrichment == nil {
+		dryRunEnrichment = &types.AccessRequestDryRunEnrichment{}
+	}
+
 	return &api.AccessRequest{
 		Id:                      req.GetName(),
 		State:                   req.GetState().String(),
@@ -212,18 +210,19 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 		Reviews:                 reviews,
 		SuggestedReviewers:      req.GetSuggestedReviewers(),
 		ThresholdNames:          thresholdNames,
-		ResourceIds:             requestedResourceIDs,
 		Resources:               resources,
 		PromotedAccessListTitle: req.GetPromotedAccessListTitle(),
 		AssumeStartTime:         getProtoTimestamp(req.GetAssumeStartTime()),
 		MaxDuration:             timestamppb.New(req.GetMaxDuration()),
 		RequestTtl:              timestamppb.New(req.Expiry()),
 		SessionTtl:              timestamppb.New(req.GetSessionTLL()),
+		ReasonMode:              string(dryRunEnrichment.ReasonMode),
+		ReasonPrompts:           dryRunEnrichment.ReasonPrompts,
 	}
 }
 
 // resourceIDToString marshals a ResourceID to a string.
-func resourceIDToString(id *api.ResourceID) string {
+func resourceIDToString(id types.ResourceID) string {
 	if id.SubResourceName == "" {
 		return fmt.Sprintf("/%s/%s/%s", id.ClusterName, id.Kind, id.Name)
 	}
diff --git a/lib/teleterm/apiserver/handler/handler_auth.go b/lib/teleterm/apiserver/handler/handler_auth.go
index 5fdba5f9f595c..32d51d54fe9f8 100644
--- a/lib/teleterm/apiserver/handler/handler_auth.go
+++ b/lib/teleterm/apiserver/handler/handler_auth.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/teleport"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/teleterm/api/uri"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -40,10 +41,6 @@ func (s *Handler) Login(ctx context.Context, req *api.LoginRequest) (*api.EmptyR
 		return nil, trace.BadParameter("cluster URI must be a root URI")
 	}
 
-	if err = s.DaemonService.ClearCachedClientsForRoot(cluster.URI); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	if req.Params == nil {
 		return nil, trace.BadParameter("missing login parameters")
 	}
@@ -61,6 +58,13 @@ func (s *Handler) Login(ctx context.Context, req *api.LoginRequest) (*api.EmptyR
 		return nil, trace.BadParameter("unsupported login parameters")
 	}
 
+	// Clear the cache after login, not before.
+	// During a re-login, another thread might try to retrieve a client from the cache.
+	// Because the cache is empty, it could initialize a new client using the previous certificate.
+	if err = s.DaemonService.ClearCachedClientsForRoot(cluster.URI); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	return &api.EmptyResponse{}, nil
 }
 
@@ -91,21 +95,28 @@ func (s *Handler) LoginPasswordless(stream api.TerminalService_LoginPasswordless
 	// daemon.Service.ResolveClusterURI.
 	clusterClient.MFAPromptConstructor = nil
 
-	if err := s.DaemonService.ClearCachedClientsForRoot(cluster.URI); err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Start the prompt flow.
 	if err := cluster.PasswordlessLogin(stream.Context(), stream); err != nil {
 		return trace.Wrap(err)
 	}
 
-	return nil
+	// Clear the cache after login, not before.
+	// During a re-login, another thread might try to retrieve a client from the cache.
+	// Because the cache is empty, it could initialize a new client using the previous certificate.
+	err = s.DaemonService.ClearCachedClientsForRoot(cluster.URI)
+	return trace.Wrap(err)
 }
 
-// Logout logs a user out from a cluster
+// Logout logs the user out of the cluster and cleans up associated resources.
+// Optionally removes the profile.
+// This operation is idempotent and can be safely invoked multiple times.
 func (s *Handler) Logout(ctx context.Context, req *api.LogoutRequest) (*api.EmptyResponse, error) {
-	if err := s.DaemonService.ClusterLogout(ctx, req.ClusterUri); err != nil {
+	clusterURI, err := uri.Parse(req.GetClusterUri())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err = s.DaemonService.ClusterLogout(ctx, clusterURI, req.RemoveProfile); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/apiserver/handler/handler_clusters.go b/lib/teleterm/apiserver/handler/handler_clusters.go
index 2dac4b9e511d0..8d25d1a5c1297 100644
--- a/lib/teleterm/apiserver/handler/handler_clusters.go
+++ b/lib/teleterm/apiserver/handler/handler_clusters.go
@@ -22,9 +22,11 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport/api/constants"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
+	"github.com/gravitational/teleport/lib/teleterm/api/uri"
 	"github.com/gravitational/teleport/lib/teleterm/clusters"
 )
 
@@ -70,15 +72,6 @@ func (s *Handler) AddCluster(ctx context.Context, req *api.AddClusterRequest) (*
 	return newAPIRootCluster(cluster), nil
 }
 
-// RemoveCluster removes a cluster from local system
-func (s *Handler) RemoveCluster(ctx context.Context, req *api.RemoveClusterRequest) (*api.EmptyResponse, error) {
-	if err := s.DaemonService.RemoveCluster(ctx, req.ClusterUri); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &api.EmptyResponse{}, nil
-}
-
 // GetCluster returns a cluster
 func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*api.Cluster, error) {
 	cluster, _, err := s.DaemonService.ResolveClusterWithDetails(ctx, req.ClusterUri)
@@ -91,6 +84,17 @@ func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*
 	return apiRootClusterWithDetails, trace.Wrap(err)
 }
 
+// ClearStaleClusterClients closes root and leaf cluster clients that use outdated TLS certificates.
+func (s *Handler) ClearStaleClusterClients(_ context.Context, req *api.ClearStaleClusterClientsRequest) (*api.ClearStaleClusterClientsResponse, error) {
+	parsed, err := uri.Parse(req.RootClusterUri)
+	if err != nil {
+		return &api.ClearStaleClusterClientsResponse{}, trace.Wrap(err)
+	}
+
+	err = s.DaemonService.ClearStaleCachedClientsForRoot(parsed)
+	return &api.ClearStaleClusterClientsResponse{}, trace.Wrap(err)
+}
+
 func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 	loggedInUser := cluster.GetLoggedInUser()
 
@@ -101,10 +105,10 @@ func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 		Connected: cluster.Connected(),
 		LoggedInUser: &api.LoggedInUser{
 			Name:            loggedInUser.Name,
-			SshLogins:       loggedInUser.SSHLogins,
 			Roles:           loggedInUser.Roles,
 			ActiveRequests:  loggedInUser.ActiveRequests,
 			IsDeviceTrusted: cluster.HasDeviceTrustExtensions(),
+			ValidUntil:      timestamppb.New(loggedInUser.ValidUntil),
 		},
 		SsoHost: cluster.SSOHost,
 	}
@@ -155,9 +159,8 @@ func newAPILeafCluster(leaf clusters.LeafCluster) *api.Cluster {
 		Connected: leaf.Connected,
 		Leaf:      true,
 		LoggedInUser: &api.LoggedInUser{
-			Name:      leaf.LoggedInUser.Name,
-			SshLogins: leaf.LoggedInUser.SSHLogins,
-			Roles:     leaf.LoggedInUser.Roles,
+			Name:  leaf.LoggedInUser.Name,
+			Roles: leaf.LoggedInUser.Roles,
 		},
 	}
 }
diff --git a/lib/teleterm/apiserver/handler/handler_databases.go b/lib/teleterm/apiserver/handler/handler_databases.go
index 016f5d905144a..30fc0e6274433 100644
--- a/lib/teleterm/apiserver/handler/handler_databases.go
+++ b/lib/teleterm/apiserver/handler/handler_databases.go
@@ -74,6 +74,9 @@ func (s *Handler) ListDatabaseServers(ctx context.Context, req *api.ListDatabase
 func newAPIDatabase(db clusters.Database) *api.Database {
 	apiLabels := makeAPILabels(ui.MakeLabelsWithoutInternalPrefixes(db.GetAllLabels()))
 
+	// ignore potential (and unlikely) errors
+	gcpProjectID, _ := db.GetGCPProjectID()
+
 	return &api.Database{
 		Uri:      db.URI.String(),
 		Name:     db.GetName(),
@@ -82,9 +85,11 @@ func newAPIDatabase(db clusters.Database) *api.Database {
 		Type:     db.GetType(),
 		Labels:   apiLabels,
 		TargetHealth: &api.TargetHealth{
-			Status: db.TargetHealth.Status,
-			Error:  db.TargetHealth.TransitionError,
+			Status:  db.TargetHealth.Status,
+			Error:   db.TargetHealth.TransitionError,
+			Message: db.TargetHealth.Message,
 		},
+		GcpProjectId: gcpProjectID,
 	}
 }
 
@@ -94,8 +99,9 @@ func newAPIDatabaseServer(dbServer clusters.DatabaseServer) *api.DatabaseServer
 		Hostname: dbServer.GetHostname(),
 		HostId:   dbServer.GetHostID(),
 		TargetHealth: &api.TargetHealth{
-			Status: dbServer.GetTargetHealth().Status,
-			Error:  dbServer.GetTargetHealth().TransitionError,
+			Status:  dbServer.GetTargetHealth().Status,
+			Error:   dbServer.GetTargetHealth().TransitionError,
+			Message: dbServer.GetTargetHealth().Message,
 		},
 	}
 }
diff --git a/lib/teleterm/apiserver/handler/handler_kubes.go b/lib/teleterm/apiserver/handler/handler_kubes.go
index b77f4b9281226..1ddc0f64bf215 100644
--- a/lib/teleterm/apiserver/handler/handler_kubes.go
+++ b/lib/teleterm/apiserver/handler/handler_kubes.go
@@ -56,6 +56,21 @@ func (s *Handler) ListKubernetesResources(ctx context.Context, req *api.ListKube
 	return response, nil
 }
 
+// ListKubernetesServers returns a paginated list of Kubernetes servers (resource kind "kube_server").
+func (s *Handler) ListKubernetesServers(ctx context.Context, req *api.ListKubernetesServersRequest) (*api.ListKubernetesServersResponse, error) {
+	resp, err := s.DaemonService.ListKubernetesServers(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	response := &api.ListKubernetesServersResponse{
+		NextPageToken: resp.NextKey,
+	}
+	for _, server := range resp.Servers {
+		response.Resources = append(response.Resources, newAPIKubeServer(server))
+	}
+	return response, nil
+}
+
 func newAPIKube(kube clusters.Kube) *api.Kube {
 	staticLabels := kube.KubernetesCluster.GetStaticLabels()
 	dynamicLabels := kube.KubernetesCluster.GetDynamicLabels()
@@ -67,6 +82,11 @@ func newAPIKube(kube clusters.Kube) *api.Kube {
 		Name:   kube.KubernetesCluster.GetName(),
 		Uri:    kube.URI.String(),
 		Labels: apiLabels,
+		TargetHealth: &api.TargetHealth{
+			Status:  kube.TargetHealth.Status,
+			Error:   kube.TargetHealth.TransitionError,
+			Message: kube.TargetHealth.Message,
+		},
 	}
 }
 
@@ -82,3 +102,16 @@ func newApiKubeResource(resource *types.KubernetesResourceV1, kubeCluster string
 		Cluster:   kubeCluster,
 	}
 }
+
+func newAPIKubeServer(server clusters.KubeServer) *api.KubeServer {
+	return &api.KubeServer{
+		Uri:      server.URI.String(),
+		Hostname: server.GetHostname(),
+		HostId:   server.GetHostID(),
+		TargetHealth: &api.TargetHealth{
+			Status:  server.GetTargetHealth().Status,
+			Error:   server.GetTargetHealth().TransitionError,
+			Message: server.GetTargetHealth().Message,
+		},
+	}
+}
diff --git a/lib/teleterm/apiserver/handler/handler_unified_resources.go b/lib/teleterm/apiserver/handler/handler_unified_resources.go
index 11c95e305df88..8073ebfed0f2b 100644
--- a/lib/teleterm/apiserver/handler/handler_unified_resources.go
+++ b/lib/teleterm/apiserver/handler/handler_unified_resources.go
@@ -132,5 +132,6 @@ func newAPIServer(server clusters.Server) *api.Server {
 		Addr:     server.GetAddr(),
 		SubKind:  server.GetSubKind(),
 		Labels:   apiLabels,
+		Logins:   server.Logins,
 	}
 }
diff --git a/lib/teleterm/autoupdate/service.go b/lib/teleterm/autoupdate/service.go
new file mode 100644
index 0000000000000..f124d8904618d
--- /dev/null
+++ b/lib/teleterm/autoupdate/service.go
@@ -0,0 +1,160 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package autoupdate
+
+import (
+	"context"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/gravitational/teleport/api/client/webclient"
+	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/auto_update/v1"
+	"github.com/gravitational/teleport/lib/autoupdate"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/teleterm/clusters"
+)
+
+const pingTimeout = 5 * time.Second
+
+// Service implements gRPC service for autoupdate.
+type Service struct {
+	api.UnimplementedAutoUpdateServiceServer
+
+	cfg Config
+}
+
+// New creates an instance of Service.
+func New(cfg Config) (*Service, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &Service{
+		cfg: cfg,
+	}, nil
+}
+
+// Config contains configuration of the Service.
+type Config struct {
+	ClusterProvider ClusterProvider
+	// InsecureSkipVerify signifies whether webclient.Find is going to verify the identity of the proxy service.
+	InsecureSkipVerify bool
+}
+
+// ClusterProvider allows listing clusters.
+type ClusterProvider interface {
+	// ListRootClusters returns a list of root clusters.
+	ListRootClusters(ctx context.Context) ([]*clusters.Cluster, error)
+}
+
+// CheckAndSetDefaults checks and sets the defaults.
+func (c *Config) CheckAndSetDefaults() error {
+	if c.ClusterProvider == nil {
+		return trace.BadParameter("missing ClusterProvider")
+	}
+
+	return nil
+}
+
+// GetClusterVersions returns client tools versions for all clusters.
+func (s *Service) GetClusterVersions(ctx context.Context, _ *api.GetClusterVersionsRequest) (*api.GetClusterVersionsResponse, error) {
+	rootClusters, err := s.cfg.ClusterProvider.ListRootClusters(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	reachableClusters := make([]*api.ClusterVersionInfo, 0, len(rootClusters))
+	unreachableClusters := make([]*api.UnreachableCluster, 0, len(rootClusters))
+	mu := sync.Mutex{}
+
+	group, groupCtx := errgroup.WithContext(ctx)
+	// Arbitrary limit allowing 10 concurrent calls.
+	group.SetLimit(10)
+
+	for _, cluster := range rootClusters {
+		group.Go(func() error {
+			ping, pingErr := s.pingCluster(groupCtx, cluster)
+			if pingErr != nil {
+				mu.Lock()
+				unreachableClusters = append(unreachableClusters, &api.UnreachableCluster{
+					ClusterUri:   cluster.URI.String(),
+					ErrorMessage: pingErr.Error(),
+				})
+				mu.Unlock()
+				return nil
+			}
+
+			mu.Lock()
+			reachableClusters = append(reachableClusters, &api.ClusterVersionInfo{
+				ClusterUri:      cluster.URI.String(),
+				ToolsAutoUpdate: ping.AutoUpdate.ToolsAutoUpdate,
+				ToolsVersion:    ping.AutoUpdate.ToolsVersion,
+				MinToolsVersion: ping.MinClientVersion,
+			})
+			mu.Unlock()
+			return nil
+		})
+	}
+
+	err = group.Wait()
+	return &api.GetClusterVersionsResponse{
+		ReachableClusters:   reachableClusters,
+		UnreachableClusters: unreachableClusters,
+	}, trace.Wrap(err)
+}
+
+func (s *Service) pingCluster(ctx context.Context, cluster *clusters.Cluster) (*webclient.PingResponse, error) {
+	find, err := webclient.Find(&webclient.Config{
+		Context:   ctx,
+		ProxyAddr: cluster.WebProxyAddr,
+		Insecure:  s.cfg.InsecureSkipVerify,
+		Timeout:   pingTimeout,
+	})
+	return find, trace.Wrap(err)
+}
+
+// GetDownloadBaseUrl returns base URL for downloading Teleport packages.
+func (s *Service) GetDownloadBaseUrl(_ context.Context, _ *api.GetDownloadBaseUrlRequest) (*api.GetDownloadBaseUrlResponse, error) {
+	baseURL, err := resolveBaseURL()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &api.GetDownloadBaseUrlResponse{
+		BaseUrl: baseURL,
+	}, trace.Wrap(err)
+}
+
+// resolveBaseURL generates the base URL using the same logic as the teleport/lib/autoupdate/tools package.
+func resolveBaseURL() (string, error) {
+	envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar)
+	if envBaseURL != "" {
+		// TODO(gzdunek): Validate if it's correct URL.
+		return envBaseURL, nil
+	}
+
+	m := modules.GetModules()
+	if m.BuildType() == modules.BuildOSS {
+		return "", trace.BadParameter("Client tools updates are disabled as they are licensed under AGPL. To use Community Edition builds or custom binaries, set the 'TELEPORT_CDN_BASE_URL' environment variable.")
+	}
+
+	return autoupdate.DefaultBaseURL, nil
+}
diff --git a/lib/teleterm/clusters/cluster.go b/lib/teleterm/clusters/cluster.go
index c16bc61aaad18..3085bbe343536 100644
--- a/lib/teleterm/clusters/cluster.go
+++ b/lib/teleterm/clusters/cluster.go
@@ -21,6 +21,7 @@ package clusters
 import (
 	"context"
 	"log/slog"
+	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
@@ -63,6 +64,8 @@ type Cluster struct {
 	clock clockwork.Clock
 	// SSOHost is the host of the SSO provider used to log in.
 	SSOHost string
+	// WebProxyAddr is the host:port the web proxy can be accessed at.
+	WebProxyAddr string
 }
 
 type ClusterWithDetails struct {
@@ -310,6 +313,7 @@ func (c *Cluster) GetLoggedInUser() LoggedInUser {
 		SSHLogins:      c.status.Logins,
 		Roles:          c.status.Roles,
 		ActiveRequests: c.status.ActiveRequests,
+		ValidUntil:     c.status.ValidUntil,
 	}
 }
 
@@ -351,6 +355,8 @@ type LoggedInUser struct {
 	Roles []string
 	// ActiveRequests is the user active requests
 	ActiveRequests []string
+	// ValidUntil is expiration time of the certificate.
+	ValidUntil time.Time
 }
 
 // AddMetadataToRetryableError is Connect's equivalent of client.RetryWithRelogin. By adding the
@@ -388,8 +394,28 @@ func UserTypeFromString(userType types.UserType) (api.LoggedInUser_UserType, err
 
 // Server describes an SSH node.
 type Server struct {
-	// URI is the database URI
+	// URI is the cluster URI
 	URI uri.ResourceURI
+	// Subset of logins allowed by the certificate and RBAC rules.
+	Logins []string
 
 	types.Server
 }
+
+// SaveProfileAndPreserveSiteName wraps [client.TeleportClient.SaveProfile]. It restores the original site name before
+// saving the profile.
+//
+// It's needed because teleterm/clusters.Storage.loadProfileStatusAndClusterKey overwrites the profile's site name so that
+// the cluster client is created for the cluster specified in the URI rather than the one stored in the profile.
+// This adjustment is only relevant for Connect and should not be persisted.
+func SaveProfileAndPreserveSiteName(clusterClient *client.TeleportClient, makeCurrent bool) error {
+	profile, err := clusterClient.GetProfile(clusterClient.WebProxyAddr)
+	if err != nil && !trace.IsNotFound(err) {
+		return trace.Wrap(err)
+	}
+	if profile != nil {
+		clusterClient.SiteName = profile.SiteName
+	}
+	err = clusterClient.SaveProfile(makeCurrent)
+	return trace.Wrap(err)
+}
diff --git a/lib/teleterm/clusters/cluster_access_requests.go b/lib/teleterm/clusters/cluster_access_requests.go
index de054ebd9b59b..dc90d6e3a0ad3 100644
--- a/lib/teleterm/clusters/cluster_access_requests.go
+++ b/lib/teleterm/clusters/cluster_access_requests.go
@@ -234,7 +234,7 @@ func (c *Cluster) AssumeRole(ctx context.Context, rootClient *client.ClusterClie
 		return trace.Wrap(err)
 	}
 
-	err = c.clusterClient.SaveProfile(true)
+	err = SaveProfileAndPreserveSiteName(c.clusterClient, true)
 	return trace.Wrap(err)
 }
 
diff --git a/lib/teleterm/clusters/cluster_apps.go b/lib/teleterm/clusters/cluster_apps.go
index 102bcb06b0d43..b6e61d1269b53 100644
--- a/lib/teleterm/clusters/cluster_apps.go
+++ b/lib/teleterm/clusters/cluster_apps.go
@@ -81,15 +81,6 @@ func GetApp(ctx context.Context, authClient authclient.ClientI, appName string)
 
 // ReissueAppCert issue new certificates for the app and saves them to disk.
 func (c *Cluster) ReissueAppCert(ctx context.Context, clusterClient *client.ClusterClient, routeToApp proto.RouteToApp) (tls.Certificate, error) {
-	// Refresh the certs to account for clusterClient.SiteName pointing at a leaf cluster.
-	err := clusterClient.ReissueUserCerts(ctx, client.CertCacheKeep, client.ReissueParams{
-		RouteToCluster: c.clusterClient.SiteName,
-		AccessRequests: c.status.ActiveRequests,
-	})
-	if err != nil {
-		return tls.Certificate{}, trace.Wrap(err)
-	}
-
 	result, err := clusterClient.IssueUserCertsWithMFA(ctx, client.ReissueParams{
 		RouteToCluster: c.clusterClient.SiteName,
 		RouteToApp:     routeToApp,
diff --git a/lib/teleterm/clusters/cluster_auth.go b/lib/teleterm/clusters/cluster_auth.go
index ebbb1e271ddbe..9f576e31b3bb8 100644
--- a/lib/teleterm/clusters/cluster_auth.go
+++ b/lib/teleterm/clusters/cluster_auth.go
@@ -53,7 +53,7 @@ func (c *Cluster) SyncAuthPreference(ctx context.Context) (*webclient.WebConfigA
 		c.Logger.DebugContext(ctx, "Got ping response", "response", string(pingResponseJSON))
 	}
 
-	if err := c.clusterClient.SaveProfile(false); err != nil {
+	if err := SaveProfileAndPreserveSiteName(c.clusterClient, false); err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/clusters/cluster_databases.go b/lib/teleterm/clusters/cluster_databases.go
index 639ab98e29f54..32b6a7bc00e29 100644
--- a/lib/teleterm/clusters/cluster_databases.go
+++ b/lib/teleterm/clusters/cluster_databases.go
@@ -45,7 +45,7 @@ type Database struct {
 	URI uri.ResourceURI
 	types.Database
 	// TargetHealth describes the health status of network connectivity
-	// of the db_server that is serving this database.
+	// reported from an agent (db_service) that is proxying this database.
 	TargetHealth types.TargetHealth
 }
 
@@ -95,15 +95,6 @@ func (c *Cluster) reissueDBCerts(ctx context.Context, clusterClient *client.Clus
 		return tls.Certificate{}, trace.BadParameter("the username must be present")
 	}
 
-	// Refresh the certs to account for clusterClient.SiteName pointing at a leaf cluster.
-	err := clusterClient.ReissueUserCerts(ctx, client.CertCacheKeep, client.ReissueParams{
-		RouteToCluster: c.clusterClient.SiteName,
-		AccessRequests: c.status.ActiveRequests,
-	})
-	if err != nil {
-		return tls.Certificate{}, trace.Wrap(err)
-	}
-
 	result, err := clusterClient.IssueUserCertsWithMFA(ctx, client.ReissueParams{
 		RouteToCluster:  c.clusterClient.SiteName,
 		RouteToDatabase: client.RouteToDatabaseToProto(routeToDatabase),
@@ -180,7 +171,7 @@ type GetDatabaseServersResponse struct {
 
 // NewDBCLICmdBuilder creates a dbcmd.CLICommandBuilder with provided cluster,
 // db route, and options.
-func NewDBCLICmdBuilder(cluster *Cluster, routeToDb tlsca.RouteToDatabase, options ...dbcmd.ConnectCommandFunc) *dbcmd.CLICommandBuilder {
+func NewDBCLICmdBuilder(cluster *Cluster, routeToDb tlsca.RouteToDatabase, getDatabaseFunc dbcmd.GetDatabaseFunc, options ...dbcmd.ConnectCommandFunc) (*dbcmd.CLICommandBuilder, error) {
 	return dbcmd.NewCmdBuilder(
 		cluster.clusterClient,
 		&cluster.status,
@@ -192,6 +183,7 @@ func NewDBCLICmdBuilder(cluster *Cluster, routeToDb tlsca.RouteToDatabase, optio
 		// generating correct CA paths. We use dbcmd.WithNoTLS here which means that the CA paths aren't
 		// included in the returned CLI command.
 		cluster.Name,
+		getDatabaseFunc,
 		options...,
 	)
 }
diff --git a/lib/teleterm/clusters/cluster_file_transfer.go b/lib/teleterm/clusters/cluster_file_transfer.go
index 5047476c1f683..9ace30c909ebc 100644
--- a/lib/teleterm/clusters/cluster_file_transfer.go
+++ b/lib/teleterm/clusters/cluster_file_transfer.go
@@ -28,24 +28,38 @@ import (
 
 	"github.com/gravitational/trace"
 
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 type FileTransferProgressSender = func(progress *api.FileTransferProgress) error
 
 func (c *Cluster) TransferFile(ctx context.Context, clt *client.ClusterClient, request *api.FileTransferRequest, sendProgress FileTransferProgressSender) error {
-	config, err := getSftpConfig(request)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	config.ProgressStream = func(fileInfo os.FileInfo) io.ReadWriter {
-		return newFileTransferProgress(fileInfo.Size(), sendProgress)
+	sftpReq := &sftp.FileTransferRequest{
+		Sources: sftp.Sources{
+			Paths: []string{request.GetSource()},
+		},
+		Destination: sftp.Target{
+			Path: request.GetDestination(),
+		},
+		DialHost: func(ctx context.Context, login, addr string) (*tracessh.Client, error) {
+			nodeClient, err := c.clusterClient.ConnectToNode(ctx, clt, client.NodeDetails{
+				Addr:    addr,
+				Cluster: c.Name,
+			}, request.Login)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return nodeClient.Client, nil
+		},
+		ProgressStream: func(fileInfo os.FileInfo) io.ReadWriter {
+			return newFileTransferProgress(fileInfo.Size(), sendProgress)
+		},
 	}
-
 	// TODO(ravicious): Move URI parsing to the outermost layer.
 	// https://github.com/gravitational/teleport/issues/15953
 	serverURI := uri.New(request.GetServerUri())
@@ -53,9 +67,20 @@ func (c *Cluster) TransferFile(ctx context.Context, clt *client.ClusterClient, r
 	if serverUUID == "" {
 		return trace.BadParameter("server URI does not include server UUID")
 	}
+	serverAddr := &utils.NetAddr{Addr: serverUUID + ":0"}
+	switch request.GetDirection() {
+	case api.FileTransferDirection_FILE_TRANSFER_DIRECTION_DOWNLOAD:
+		sftpReq.Sources.Addr = serverAddr
+		sftpReq.Sources.Login = request.GetLogin()
+	case api.FileTransferDirection_FILE_TRANSFER_DIRECTION_UPLOAD:
+		sftpReq.Destination.Addr = serverAddr
+		sftpReq.Destination.Login = request.GetLogin()
+	default:
+		return trace.BadParameter("Unexpected file transfer direction: %q", request.GetDirection())
+	}
 
-	err = AddMetadataToRetryableError(ctx, func() error {
-		err := c.clusterClient.TransferFiles(ctx, clt, request.GetLogin(), serverUUID+":0", config)
+	err := AddMetadataToRetryableError(ctx, func() error {
+		err := c.clusterClient.TransferFiles(ctx, sftpReq)
 		if errors.As(err, new(*sftp.NonRecursiveDirectoryTransferError)) {
 			return trace.Errorf("transferring directories through Teleport Connect is not supported at the moment, please use tsh scp -r")
 		}
@@ -64,17 +89,6 @@ func (c *Cluster) TransferFile(ctx context.Context, clt *client.ClusterClient, r
 	return trace.Wrap(err)
 }
 
-func getSftpConfig(request *api.FileTransferRequest) (*sftp.Config, error) {
-	switch request.GetDirection() {
-	case api.FileTransferDirection_FILE_TRANSFER_DIRECTION_DOWNLOAD:
-		return sftp.CreateDownloadConfig(request.GetSource(), request.GetDestination(), sftp.Options{})
-	case api.FileTransferDirection_FILE_TRANSFER_DIRECTION_UPLOAD:
-		return sftp.CreateUploadConfig([]string{request.GetSource()}, request.GetDestination(), sftp.Options{})
-	default:
-		return nil, trace.BadParameter("Unexpected file transfer direction: %q", request.GetDirection())
-	}
-}
-
 func newFileTransferProgress(fileSize int64, sendProgress FileTransferProgressSender) io.ReadWriter {
 	return &fileTransferProgress{
 		sendProgress: sendProgress,
diff --git a/lib/teleterm/clusters/cluster_gateways.go b/lib/teleterm/clusters/cluster_gateways.go
index 24135d447ad6a..d84189e4b81fd 100644
--- a/lib/teleterm/clusters/cluster_gateways.go
+++ b/lib/teleterm/clusters/cluster_gateways.go
@@ -146,6 +146,7 @@ func (c *Cluster) createKubeGateway(ctx context.Context, params CreateGatewayPar
 		Cert:                          cert,
 		Insecure:                      c.clusterClient.InsecureSkipVerify,
 		WebProxyAddr:                  c.clusterClient.WebProxyAddr,
+		RelayAddr:                     c.clusterClient.RelayAddr,
 		Logger:                        c.Logger,
 		TCPPortAllocator:              params.TCPPortAllocator,
 		OnExpiredCert:                 params.OnExpiredCert,
diff --git a/lib/teleterm/clusters/cluster_kubes.go b/lib/teleterm/clusters/cluster_kubes.go
index 0609b1a238db6..51a4d38053541 100644
--- a/lib/teleterm/clusters/cluster_kubes.go
+++ b/lib/teleterm/clusters/cluster_kubes.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
 	kubeclient "github.com/gravitational/teleport/lib/client/kube"
@@ -41,19 +42,22 @@ type Kube struct {
 	URI uri.ResourceURI
 
 	KubernetesCluster types.KubeCluster
+
+	// TargetHealth is the health of the Kubernetes cluster.
+	TargetHealth types.TargetHealth
+}
+
+// KubeServer (kube_server) describes a Kubernetes heartbeat signal
+// reported from an agent (kubernetes_service) that is proxying
+// the Kubernetes cluster.
+type KubeServer struct {
+	// URI is the kube_server URI
+	URI uri.ResourceURI
+	types.KubeServer
 }
 
 // reissueKubeCert issue new certificates for kube cluster and saves them to disk.
 func (c *Cluster) reissueKubeCert(ctx context.Context, clusterClient *client.ClusterClient, kubeCluster string) (tls.Certificate, error) {
-	// Refresh the certs to account for clusterClient.SiteName pointing at a leaf cluster.
-	err := clusterClient.ReissueUserCerts(ctx, client.CertCacheKeep, client.ReissueParams{
-		RouteToCluster: c.clusterClient.SiteName,
-		AccessRequests: c.status.ActiveRequests,
-	})
-	if err != nil {
-		return tls.Certificate{}, trace.Wrap(err)
-	}
-
 	result, err := clusterClient.IssueUserCertsWithMFA(
 		ctx, client.ReissueParams{
 			RouteToCluster:    c.clusterClient.SiteName,
@@ -114,3 +118,29 @@ func (c *Cluster) getKube(ctx context.Context, authClient authclient.ClientI, ku
 	}
 	return nil, trace.NotFound("kubernetes cluster %q not found", kubeCluster)
 }
+
+// ListKubernetesServers returns a paginated list of Kubernetes servers (resource kind "kube_server").
+func (c *Cluster) ListKubernetesServers(ctx context.Context, params *api.ListResourcesParams, authClient authclient.ClientI) (*ListKubernetesServersResponse, error) {
+	page, err := listResources[types.KubeServer](ctx, params, authClient, types.KindKubeServer)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	results := make([]KubeServer, 0, len(page.Resources))
+	for _, server := range page.Resources {
+		results = append(results, KubeServer{
+			URI:        c.URI.AppendKubeServer(server.GetName()),
+			KubeServer: server,
+		})
+	}
+
+	return &ListKubernetesServersResponse{
+		Servers: results,
+		NextKey: page.NextKey,
+	}, nil
+}
+
+type ListKubernetesServersResponse struct {
+	Servers []KubeServer
+	NextKey string
+}
diff --git a/lib/teleterm/clusters/storage.go b/lib/teleterm/clusters/storage.go
index ef1fb983e20a9..af45d283d87d1 100644
--- a/lib/teleterm/clusters/storage.go
+++ b/lib/teleterm/clusters/storage.go
@@ -120,7 +120,9 @@ func (s *Storage) Remove(ctx context.Context, profileName string) error {
 // https://github.com/gravitational/teleport/issues/13278
 func (s *Storage) Add(ctx context.Context, webProxyAddress string) (*Cluster, *client.TeleportClient, error) {
 	profiles, err := s.ListProfileNames()
-	if err != nil {
+	// If the tsh directory does not exist, [client.ProfileStore.SaveProfile] will
+	// create it.
+	if err != nil && !trace.IsNotFound(err) {
 		return nil, nil, trace.Wrap(err)
 	}
 
@@ -169,6 +171,13 @@ func (s *Storage) addCluster(ctx context.Context, webProxyAddress string) (*Clus
 		return nil, nil, trace.Wrap(err)
 	}
 
+	// There's an incorrect default in api/profile.profileFromFile - an empty SiteName is replaced with the profile name.
+	// A profile name is not the same thing as a site name, and they differ when the proxy hostname is different
+	// from the cluster name.
+	// Using this incorrect site name causes login failures in `tsh`, so we proactively set SiteName to the root cluster
+	// name instead.
+	clusterClient.SiteName = pingResponse.ClusterName
+
 	clusterLog := s.Logger.With("cluster", clusterURI)
 
 	pingResponseJSON, err := json.Marshal(pingResponse)
@@ -191,6 +200,7 @@ func (s *Storage) addCluster(ctx context.Context, webProxyAddress string) (*Clus
 		clusterClient: clusterClient,
 		clock:         s.Clock,
 		Logger:        clusterLog,
+		WebProxyAddr:  clusterClient.WebProxyAddr,
 	}, clusterClient, nil
 }
 
@@ -212,6 +222,11 @@ func (s *Storage) fromProfile(profileName, leafClusterName string) (*Cluster, *c
 		clusterNameForKey = leafClusterName
 		clusterURI = clusterURI.AppendLeafCluster(leafClusterName)
 		cfg.SiteName = leafClusterName
+	} else {
+		// Reset SiteName as it may reference a leaf cluster (the cluster can be changed
+		// through "tsh login <leaf>").
+		// The correct root cluster value will be set in loadProfileStatusAndClusterKey.
+		cfg.SiteName = ""
 	}
 
 	clusterClient, err := client.NewClient(cfg)
@@ -228,6 +243,7 @@ func (s *Storage) fromProfile(profileName, leafClusterName string) (*Cluster, *c
 		clock:         s.Clock,
 		statusError:   err,
 		Logger:        s.Logger.With("cluster", clusterURI),
+		WebProxyAddr:  clusterClient.WebProxyAddr,
 	}
 	if status != nil {
 		cluster.status = *status
@@ -241,7 +257,7 @@ func (s *Storage) loadProfileStatusAndClusterKey(clusterClient *client.TeleportC
 	status := &client.ProfileStatus{}
 
 	// load profile status if key exists
-	_, err := clusterClient.LocalAgent().GetKeyRing(clusterNameForKey)
+	key, err := clusterClient.LocalAgent().GetKeyRing(clusterNameForKey)
 	if err != nil {
 		if trace.IsNotFound(err) {
 			s.Logger.InfoContext(context.Background(), "No keys found for cluster", "cluster", clusterNameForKey)
@@ -250,15 +266,53 @@ func (s *Storage) loadProfileStatusAndClusterKey(clusterClient *client.TeleportC
 		}
 	}
 
-	if err == nil && clusterClient.Username != "" {
-		status, err = clusterClient.ProfileStatus()
+	// If the key exists, and clusterClient is a root cluster client,
+	// extract the name from the key.
+	// We don't use SiteName from the profile as it can be changed
+	// through "tsh login <leaf>", so we would return a client that incorrectly
+	// points to the leaf cluster.
+	if err == nil && clusterClient.Config.SiteName == "" {
+		var rootClusterName string
+		rootClusterName, err = key.RootClusterName()
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		clusterClient.Config.SiteName = rootClusterName
+		clusterClient.SiteName = rootClusterName
+	}
+
+	// TODO(gzdunek): If the key doesn't exist, we should still try to read
+	// the profile status.
+	// This creates an inconsistency in how the profile is interpreted after running
+	//`tsh logout --proxy=... --user=...`  by `tsh status` versus Connect.
+	//
+	// tsh will still show a profile that includes the username, while Connect
+	// receives an empty profile status and therefore has no username.
+	// Fixing this requires updating how ClusterLifecycleManager detects logouts.
+	// Right now it assumes that a logout results in an empty username.
+	// After the fix, the username would still be present, so we'll need to rely on
+	// a different field of LoggedInUser (or introduce a new one) to determine logout
+	// state reliably.
+	if err != nil || clusterClient.Username == "" {
+		return status, nil
+	}
 
-		if err := clusterClient.LoadKeyForCluster(context.Background(), status.Cluster); err != nil {
+	status, err = clusterClient.ProfileStatus()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Load SSH key for the cluster indicated in the profile.
+	// Skip if the profile is empty, the key cannot be found, or the key isn't supported as an agent key.
+	err = clusterClient.LoadKeyForCluster(context.Background(), status.Cluster)
+	if err != nil {
+		if !trace.IsNotFound(err) && !trace.IsConnectionProblem(err) && !trace.IsCompareFailed(err) {
 			return nil, trace.Wrap(err)
 		}
+		s.Logger.InfoContext(context.Background(), "Could not load key for cluster into the local agent",
+			"cluster", status.Cluster,
+			"error", err,
+		)
 	}
 
 	return status, nil
diff --git a/lib/teleterm/cmd/db.go b/lib/teleterm/cmd/db.go
index 144d386224c38..8b0f121a96970 100644
--- a/lib/teleterm/cmd/db.go
+++ b/lib/teleterm/cmd/db.go
@@ -65,6 +65,13 @@ func newDBCLICommandWithExecer(ctx context.Context, cluster *clusters.Cluster, g
 	var getDatabaseError error
 	var database types.Database
 
+	getDatabaseFunc := func(ctx context.Context, _ *client.TeleportClient, _ string) (types.Database, error) {
+		getDatabaseOnce.Do(func() {
+			database, getDatabaseError = cluster.GetDatabase(ctx, authClient, gateway.TargetURI())
+		})
+		return database, trace.Wrap(getDatabaseError)
+	}
+
 	opts := []dbcmd.ConnectCommandFunc{
 		dbcmd.WithLogger(gateway.Log()),
 		dbcmd.WithLocalProxy(gateway.LocalAddress(), gateway.LocalPortInt(), ""),
@@ -72,12 +79,6 @@ func newDBCLICommandWithExecer(ctx context.Context, cluster *clusters.Cluster, g
 		dbcmd.WithTolerateMissingCLIClient(),
 		dbcmd.WithExecer(execer),
 		dbcmd.WithOracleOpts(true /* can use TCP */, true /* has TCP servers */),
-		dbcmd.WithGetDatabaseFunc(func(ctx context.Context, _ *client.TeleportClient, _ string) (types.Database, error) {
-			getDatabaseOnce.Do(func() {
-				database, getDatabaseError = cluster.GetDatabase(ctx, authClient, gateway.TargetURI())
-			})
-			return database, trace.Wrap(getDatabaseError)
-		}),
 	}
 
 	switch gateway.Protocol() {
@@ -91,12 +92,20 @@ func newDBCLICommandWithExecer(ctx context.Context, cluster *clusters.Cluster, g
 
 	previewOpts := append(opts, dbcmd.WithPrintFormat())
 
-	execCmd, err := clusters.NewDBCLICmdBuilder(cluster, routeToDb, opts...).GetConnectCommand(ctx)
+	execCmdBuilder, err := clusters.NewDBCLICmdBuilder(cluster, routeToDb, getDatabaseFunc, opts...)
+	if err != nil {
+		return Cmds{}, trace.Wrap(err)
+	}
+	execCmd, err := execCmdBuilder.GetConnectCommand(ctx)
 	if err != nil {
 		return Cmds{}, trace.Wrap(err)
 	}
 
-	previewCmd, err := clusters.NewDBCLICmdBuilder(cluster, routeToDb, previewOpts...).GetConnectCommand(ctx)
+	previewCmdBuilder, err := clusters.NewDBCLICmdBuilder(cluster, routeToDb, getDatabaseFunc, previewOpts...)
+	if err != nil {
+		return Cmds{}, trace.Wrap(err)
+	}
+	previewCmd, err := previewCmdBuilder.GetConnectCommand(ctx)
 	if err != nil {
 		return Cmds{}, trace.Wrap(err)
 	}
diff --git a/lib/teleterm/cmd/db_test.go b/lib/teleterm/cmd/db_test.go
index 68f7a82fdcec4..4843268dd6b34 100644
--- a/lib/teleterm/cmd/db_test.go
+++ b/lib/teleterm/cmd/db_test.go
@@ -72,14 +72,6 @@ func (m fakeDatabaseGateway) LocalPortInt() int             { return 8888 }
 func (m fakeDatabaseGateway) LocalPort() string             { return "8888" }
 
 func TestNewDBCLICommand(t *testing.T) {
-	// TODO mock other types
-	authClient := &mockAuthClient{
-		database: &types.DatabaseV3{
-			Spec: types.DatabaseSpecV3{
-				Protocol: types.DatabaseProtocolMongoDB,
-			},
-		},
-	}
 
 	testCases := []struct {
 		name                  string
@@ -87,30 +79,55 @@ func TestNewDBCLICommand(t *testing.T) {
 		argsCount             int
 		protocol              string
 		checkCmds             func(*testing.T, fakeDatabaseGateway, Cmds)
+		database              *types.DatabaseV3
 	}{
 		{
 			name:                  "empty name",
 			protocol:              defaults.ProtocolMongoDB,
 			targetSubresourceName: "",
 			checkCmds:             checkMongoCmds,
+			database: &types.DatabaseV3{
+				Spec: types.DatabaseSpecV3{
+					Protocol: types.DatabaseProtocolMongoDB,
+				},
+			},
 		},
 		{
 			name:                  "with name",
 			protocol:              defaults.ProtocolMongoDB,
 			targetSubresourceName: "bar",
 			checkCmds:             checkMongoCmds,
+			database: &types.DatabaseV3{
+				Spec: types.DatabaseSpecV3{
+					Protocol: types.DatabaseProtocolMongoDB,
+				},
+			},
 		},
 		{
 			name:                  "custom handling of DynamoDB does not blow up",
 			targetSubresourceName: "bar",
 			protocol:              defaults.ProtocolDynamoDB,
 			checkCmds:             checkArgsNotEmpty,
+			database: &types.DatabaseV3{
+				Spec: types.DatabaseSpecV3{
+					Protocol: types.DatabaseTypeDynamoDB,
+				},
+			},
 		},
 		{
 			name:                  "custom handling of Spanner does not blow up",
 			targetSubresourceName: "bar",
 			protocol:              defaults.ProtocolSpanner,
 			checkCmds:             checkArgsNotEmpty,
+			database: &types.DatabaseV3{
+				Spec: types.DatabaseSpecV3{
+					Protocol: types.DatabaseTypeSpanner,
+					GCP: types.GCPCloudSQL{
+						ProjectID:  "proj",
+						InstanceID: "inst",
+					},
+				},
+			},
 		},
 	}
 
@@ -126,6 +143,7 @@ func TestNewDBCLICommand(t *testing.T) {
 				protocol:        tc.protocol,
 			}
 
+			authClient := &mockAuthClient{database: tc.database}
 			cmds, err := newDBCLICommandWithExecer(context.Background(), &cluster, mockGateway, fakeExec{}, authClient)
 			require.NoError(t, err)
 
diff --git a/lib/teleterm/daemon/config.go b/lib/teleterm/daemon/config.go
index a8b87de4af022..ee758d72e8cff 100644
--- a/lib/teleterm/daemon/config.go
+++ b/lib/teleterm/daemon/config.go
@@ -95,7 +95,7 @@ type ClientCache interface {
 	Get(ctx context.Context, profileName, leafClusterName string) (*client.ClusterClient, error)
 	// ClearForRoot closes and removes clients from the cache
 	// for the root cluster and its leaf clusters.
-	ClearForRoot(profileName string) error
+	ClearForRoot(profileName string, opts ...clientcache.ClearOption) error
 	// Clear closes and removes all clients.
 	Clear() error
 }
diff --git a/lib/teleterm/daemon/daemon.go b/lib/teleterm/daemon/daemon.go
index 5d33e8c42db54..83c8757b4f711 100644
--- a/lib/teleterm/daemon/daemon.go
+++ b/lib/teleterm/daemon/daemon.go
@@ -40,6 +40,7 @@ import (
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/client/clientcache"
 	"github.com/gravitational/teleport/lib/client/sso"
 	dtauthn "github.com/gravitational/teleport/lib/devicetrust/authn"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
@@ -267,26 +268,6 @@ func (s *Service) newDesktopSession(desktopURI uri.ResourceURI, login string) (*
 	return session, cleanup, nil
 }
 
-// RemoveCluster removes cluster
-func (s *Service) RemoveCluster(ctx context.Context, uri string) error {
-	cluster, _, err := s.ResolveCluster(uri)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if cluster.Connected() {
-		if err := cluster.Logout(ctx); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	if err := s.cfg.Storage.Remove(ctx, cluster.ProfileName); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
 // NewClusterClient is a wrapper on ResolveClusterURI that can be passed as an argument to
 // s.cfg.CreateClientCacheFunc.
 func (s *Service) NewClusterClient(ctx context.Context, profileName, leafClusterName string) (*client.TeleportClient, error) {
@@ -349,22 +330,30 @@ func (s *Service) ResolveClusterWithDetails(ctx context.Context, uri string) (*c
 	return withDetails, clusterClient, nil
 }
 
-// ClusterLogout logs a user out from the cluster
-func (s *Service) ClusterLogout(ctx context.Context, uri string) error {
-	cluster, _, err := s.ResolveCluster(uri)
-	if err != nil {
+// ClusterLogout logs the user out of the cluster and cleans up associated resources.
+// Optionally removes the profile.
+// This operation is idempotent and can be safely invoked multiple times.
+func (s *Service) ClusterLogout(ctx context.Context, uri uri.ResourceURI, removeProfile bool) error {
+	cluster, _, err := s.ResolveClusterURI(uri)
+	if err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
-
-	if err := cluster.Logout(ctx); err != nil {
-		return trace.Wrap(err)
+	if err == nil {
+		if err = cluster.Logout(ctx); err != nil {
+			return trace.Wrap(err)
+		}
+		if removeProfile {
+			if err = s.cfg.Storage.Remove(ctx, cluster.ProfileName); err != nil {
+				return trace.Wrap(err)
+			}
+		}
 	}
 
-	if err := s.StopHeadlessWatcher(uri); err != nil && !trace.IsNotFound(err) {
+	if err = s.StopHeadlessWatcher(uri.String()); err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
 
-	return trace.Wrap(s.ClearCachedClientsForRoot(cluster.URI))
+	return trace.Wrap(s.ClearCachedClientsForRoot(uri))
 }
 
 // CreateGateway creates a gateway to given targetURI
@@ -875,12 +864,12 @@ func (s *Service) AssumeRole(ctx context.Context, req *api.AssumeRoleRequest) er
 	defer s.gatewaysMu.RUnlock()
 	for _, gw := range s.gateways {
 		targetURI := gw.TargetURI()
-		if !targetURI.IsKube() && targetURI.GetRootClusterURI() != cluster.URI {
+		if !targetURI.IsKube() || targetURI.GetRootClusterURI() != cluster.URI {
 			continue
 		}
 		kubeGw, err := gateway.AsKube(gw)
 		if err != nil {
-			s.cfg.Logger.ErrorContext(ctx, "Could not clear certs for kube when assuming request", "error", err, "target_uri", targetURI)
+			return trace.Wrap(err)
 		}
 		kubeGw.ClearCerts()
 	}
@@ -924,6 +913,27 @@ func (s *Service) ListKubernetesResources(ctx context.Context, clusterURI uri.Re
 	return resources, trace.Wrap(err)
 }
 
+// ListKubernetesServers returns a paginated list of Kubernetes servers (resource kind "kube_server").
+func (s *Service) ListKubernetesServers(ctx context.Context, req *api.ListKubernetesServersRequest) (*clusters.ListKubernetesServersResponse, error) {
+	clusterURI, err := uri.Parse(req.GetClusterUri())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cluster, _, err := s.ResolveClusterURI(clusterURI)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	proxyClient, err := s.GetCachedClient(ctx, clusterURI)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	response, err := cluster.ListKubernetesServers(ctx, req.GetParams(), proxyClient.CurrentCluster())
+	return response, trace.Wrap(err)
+}
+
 // ListDatabaseServers returns a paginated list of database servers (resource kind "db_server").
 func (s *Service) ListDatabaseServers(ctx context.Context, req *api.ListDatabaseServersRequest) (*clusters.GetDatabaseServersResponse, error) {
 	clusterURI, err := uri.Parse(req.GetClusterUri())
@@ -1274,6 +1284,14 @@ func (s *Service) ClearCachedClientsForRoot(clusterURI uri.ResourceURI) error {
 	return trace.Wrap(s.clientCache.ClearForRoot(profileName))
 }
 
+// ClearStaleCachedClientsForRoot closes and removes clients from the cache
+// for the root cluster and its leaf clusters, if their cert is outdated.
+func (s *Service) ClearStaleCachedClientsForRoot(clusterURI uri.ResourceURI) error {
+	profileName := clusterURI.GetProfileName()
+	err := s.clientCache.ClearForRoot(profileName, clientcache.WithClearingOnlyClientsWithStaleCert())
+	return trace.Wrap(err)
+}
+
 // SetSharedDirectoryForDesktopSession opens a directory for a desktop session and enables file system operations for it.
 // If there is no active desktop session associated with the specified desktop_uri and login,
 // an error is returned.
diff --git a/lib/teleterm/gateway/config.go b/lib/teleterm/gateway/config.go
index 65cba427771a8..beabe969f347b 100644
--- a/lib/teleterm/gateway/config.go
+++ b/lib/teleterm/gateway/config.go
@@ -69,6 +69,9 @@ type Config struct {
 	Username string
 	// WebProxyAddr
 	WebProxyAddr string
+	// RelayAddr, if set, is the address of the Relay service that should be
+	// used by protocols that support using a Relay.
+	RelayAddr string
 	// Logger is a component logger
 	Logger *slog.Logger
 	// TCPPortAllocator creates listeners on the given ports. This interface lets us avoid occupying
diff --git a/lib/teleterm/gateway/kube.go b/lib/teleterm/gateway/kube.go
index 8827cb04fb85d..c9b6987fd2260 100644
--- a/lib/teleterm/gateway/kube.go
+++ b/lib/teleterm/gateway/kube.go
@@ -142,25 +142,46 @@ func (k *kube) makeALPNLocalProxyForKube(cas map[string]tls.Certificate) error {
 	}
 	k.middleware = middleware
 
-	webProxyHost, err := utils.Host(k.cfg.WebProxyAddr)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	if k.cfg.RelayAddr != "" {
+		k.localProxy, err = alpnproxy.NewLocalProxy(
+			alpnproxy.LocalProxyConfig{
+				RemoteProxyAddr: k.cfg.RelayAddr,
+				// connectivity to a relay is secured by internal CAs, the
+				// insecure option makes no sense
+				InsecureSkipVerify: false,
+				Listener:           listener,
+				ParentContext:      k.closeContext,
+				Clock:              k.cfg.Clock,
+				// the relay does not support TLS terminators
+				ALPNConnUpgradeRequired: false,
+			},
+			alpnproxy.WithHTTPMiddleware(middleware),
+			alpnproxy.WithClusterCAs(k.closeContext, k.cfg.RootClusterCACertPoolFunc),
+		)
+		if err != nil {
+			return trace.NewAggregate(err, listener.Close())
+		}
+	} else {
+		webProxyHost, err := utils.Host(k.cfg.WebProxyAddr)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	k.localProxy, err = alpnproxy.NewLocalProxy(alpnproxy.LocalProxyConfig{
-		InsecureSkipVerify:      k.cfg.Insecure,
-		RemoteProxyAddr:         k.cfg.WebProxyAddr,
-		Listener:                listener,
-		ParentContext:           k.closeContext,
-		Clock:                   k.cfg.Clock,
-		ALPNConnUpgradeRequired: k.cfg.TLSRoutingConnUpgradeRequired,
-	},
-		alpnproxy.WithHTTPMiddleware(middleware),
-		alpnproxy.WithSNI(client.GetKubeTLSServerName(webProxyHost)),
-		alpnproxy.WithClusterCAs(k.closeContext, k.cfg.RootClusterCACertPoolFunc),
-	)
-	if err != nil {
-		return trace.NewAggregate(err, listener.Close())
+		k.localProxy, err = alpnproxy.NewLocalProxy(alpnproxy.LocalProxyConfig{
+			InsecureSkipVerify:      k.cfg.Insecure,
+			RemoteProxyAddr:         k.cfg.WebProxyAddr,
+			Listener:                listener,
+			ParentContext:           k.closeContext,
+			Clock:                   k.cfg.Clock,
+			ALPNConnUpgradeRequired: k.cfg.TLSRoutingConnUpgradeRequired,
+		},
+			alpnproxy.WithHTTPMiddleware(middleware),
+			alpnproxy.WithSNI(client.GetKubeTLSServerName(webProxyHost)),
+			alpnproxy.WithClusterCAs(k.closeContext, k.cfg.RootClusterCACertPoolFunc),
+		)
+		if err != nil {
+			return trace.NewAggregate(err, listener.Close())
+		}
 	}
 	return nil
 }
@@ -177,6 +198,7 @@ func (k *kube) makeKubeMiddleware() (alpnproxy.LocalProxyHTTPMiddleware, error)
 		Clock:        k.cfg.Clock,
 		Logger:       k.cfg.Logger,
 		CloseContext: k.closeContext,
+		Relay:        k.cfg.RelayAddr != "",
 	})
 
 	return middleware, nil
@@ -213,26 +235,21 @@ func (k *kube) writeKubeconfig(key *keys.PrivateKey, cas map[string]tls.Certific
 		return trace.BadParameter("could not parse CA certificate for cluster %q", k.cfg.ClusterName)
 	}
 
+	// XXX(espadolini): just like [kubeconfig.UpdateConfig], this assumes that
+	// the profile name is exactly the same as the hostname of the Proxy web
+	// address
+	profileName, err := utils.Host(k.cfg.WebProxyAddr)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	values := &kubeconfig.LocalProxyValues{
-		// Ideally tc.KubeClusterAddr() should be used for
-		// TeleportKubeClusterAddr here.
-		//
-		// Kube cluster address is used as server address when `tsh kube login`
-		// adds cluster entries in the default kubeconfig. When creating
-		// kubeconfig for a local proxy, TeleportKubeClusterAddr is mainly used
-		// to identify which clusters in the kubeconfig belong to the current
-		// tsh profile, in case the default kubeconfig has other clusters. It
-		// also serves as a reference so that the server address of a cluster
-		// in the kubeconfig of `tsh proxy kube` and `tsh kube login` are the
-		// same.
-		//
-		// In this case here, since the kubeconfig for the local proxy is only
-		// for a single kube cluster and it is not created from the default
-		// kubeconfig, specifying the correct kube cluster address is not
-		// necessary.
-		//
-		// In most cases, tc.KubeClusterAddr() is the same as
-		// k.cfg.WebProxyAddr anyway.
+		TeleportProfileName: profileName,
+		// Ideally TeleportKubeClusterAddr would be set to tc.KubeClusterAddr()
+		// here, but this is for the local proxy and it's only used for
+		// compatibility with older versions of tsh to keep track of and clean
+		// up kubeconfig items associated to a given profile, which should not
+		// be needed since the introduction of the profile name extension.
 		TeleportKubeClusterAddr: "https://" + k.cfg.WebProxyAddr,
 		LocalProxyURL:           "http://" + k.forwardProxy.GetAddr(),
 		ClientKeyData:           key.PrivateKeyPEM(),
diff --git a/lib/teleterm/services/desktop/desktop.go b/lib/teleterm/services/desktop/desktop.go
index 2ae2e1cc065f4..57a192eb76a90 100644
--- a/lib/teleterm/services/desktop/desktop.go
+++ b/lib/teleterm/services/desktop/desktop.go
@@ -130,9 +130,12 @@ func (s *Session) Start(ctx context.Context, stream grpc.BidiStreamingServer[api
 		return trace.Wrap(err)
 	}
 
-	downstreamRW, err := streamutils.NewReadWriter(&clientStream{
-		stream: stream,
-	})
+	downstreamRW, err := streamutils.NewReadWriter(
+		&clientStream{
+			stream: stream,
+		},
+		streamutils.WithDisabledChunking(),
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/teleterm/services/unifiedresources/unifiedresources.go b/lib/teleterm/services/unifiedresources/unifiedresources.go
index 55238fd5ebfed..6f825869435e3 100644
--- a/lib/teleterm/services/unifiedresources/unifiedresources.go
+++ b/lib/teleterm/services/unifiedresources/unifiedresources.go
@@ -27,6 +27,7 @@ import (
 	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/teleterm/clusters"
 )
 
@@ -37,6 +38,7 @@ var supportedResourceKinds = []string{
 	types.KindApp,
 	types.KindSAMLIdPServiceProvider,
 	types.KindWindowsDesktop,
+	types.KindMCP,
 }
 
 func List(ctx context.Context, cluster *clusters.Cluster, client apiclient.ListUnifiedResourcesClient, req *proto.ListUnifiedResourcesRequest) (*ListResponse, error) {
@@ -66,10 +68,15 @@ func List(ctx context.Context, cluster *clusters.Cluster, client apiclient.ListU
 		requiresRequest := enrichedResource.RequiresRequest
 		switch r := enrichedResource.ResourceWithLabels.(type) {
 		case types.Server:
+			logins, err := libclient.CalculateSSHLogins(cluster.GetLoggedInUser().SSHLogins, enrichedResource.Logins)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
 			response.Resources = append(response.Resources, UnifiedResource{
 				Server: &clusters.Server{
 					URI:    cluster.URI.AppendServer(r.GetName()),
 					Server: r,
+					Logins: logins,
 				},
 				RequiresRequest: requiresRequest,
 			})
@@ -114,13 +121,18 @@ func List(ctx context.Context, cluster *clusters.Cluster, client apiclient.ListU
 			})
 		case types.KubeServer:
 			kubeCluster := r.GetCluster()
-			response.Resources = append(response.Resources, UnifiedResource{
+			ur := UnifiedResource{
 				Kube: &clusters.Kube{
 					URI:               cluster.URI.AppendKube(kubeCluster.GetName()),
 					KubernetesCluster: kubeCluster,
 				},
 				RequiresRequest: requiresRequest,
-			})
+			}
+			targetHealth := r.GetTargetHealth()
+			if targetHealth != nil {
+				ur.Kube.TargetHealth = *targetHealth
+			}
+			response.Resources = append(response.Resources, ur)
 		case types.WindowsDesktop:
 			response.Resources = append(response.Resources, UnifiedResource{
 				WindowsDesktop: &clusters.WindowsDesktop{
diff --git a/lib/teleterm/services/unifiedresources/unififedresources_test.go b/lib/teleterm/services/unifiedresources/unififedresources_test.go
index ac7b7a3adf655..052448980d191 100644
--- a/lib/teleterm/services/unifiedresources/unififedresources_test.go
+++ b/lib/teleterm/services/unifiedresources/unififedresources_test.go
@@ -96,13 +96,32 @@ func TestUnifiedResourcesList(t *testing.T) {
 		})
 	require.NoError(t, err)
 
+	mcp, err := types.NewAppServerV3(types.Metadata{
+		Name: "test-mcp",
+	}, types.AppServerSpecV3{
+		HostID: uuid.New().String(),
+		App: &types.AppV3{
+			Metadata: types.Metadata{
+				Name: "test-mcp",
+			},
+			Spec: types.AppSpecV3{
+				MCP: &types.MCP{
+					Command:       "test",
+					RunAsHostUser: "test",
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
 	mockedResources := []*proto.PaginatedResource{
-		{Resource: &proto.PaginatedResource_Node{Node: node.(*types.ServerV2)}},
+		{Resource: &proto.PaginatedResource_Node{Node: node.(*types.ServerV2)}, Logins: []string{"ec2-user"}},
 		{Resource: &proto.PaginatedResource_DatabaseServer{DatabaseServer: database}},
 		{Resource: &proto.PaginatedResource_KubernetesServer{KubernetesServer: kube}},
 		{Resource: &proto.PaginatedResource_AppServer{AppServer: app}},
 		{Resource: &proto.PaginatedResource_SAMLIdPServiceProvider{SAMLIdPServiceProvider: samlSP.(*types.SAMLIdPServiceProviderV1)}},
 		{Resource: &proto.PaginatedResource_WindowsDesktop{WindowsDesktop: windowsDesktop}},
+		{Resource: &proto.PaginatedResource_AppServer{AppServer: mcp}},
 	}
 	mockedNextKey := "nextKey"
 
@@ -117,6 +136,7 @@ func TestUnifiedResourcesList(t *testing.T) {
 	require.Equal(t, UnifiedResource{Server: &clusters.Server{
 		URI:    uri.NewClusterURI(cluster.ProfileName).AppendServer(node.GetName()),
 		Server: node,
+		Logins: nil, // because the cluster has no SSH logins
 	}}, response.Resources[0])
 
 	require.Equal(t, UnifiedResource{Database: &clusters.Database{
@@ -147,6 +167,13 @@ func TestUnifiedResourcesList(t *testing.T) {
 		WindowsDesktop: windowsDesktop,
 	}}, response.Resources[5])
 
+	require.Equal(t, UnifiedResource{App: &clusters.App{
+		FQDN:     "test-mcp.",
+		URI:      uri.NewClusterURI(cluster.ProfileName).AppendApp(mcp.GetName()),
+		AWSRoles: aws.Roles{},
+		App:      mcp.GetApp(),
+	}}, response.Resources[6])
+
 	require.Equal(t, mockedNextKey, response.NextKey)
 }
 
diff --git a/lib/teleterm/vnet/service.go b/lib/teleterm/vnet/service.go
index 0233a2c6da798..12f18e80a6ad8 100644
--- a/lib/teleterm/vnet/service.go
+++ b/lib/teleterm/vnet/service.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
+	"os"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -29,9 +30,12 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/teleport/api/types"
 	prehogv1alpha "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	apiteleterm "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1"
+	diagv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/diag/v1"
 	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
@@ -40,6 +44,7 @@ import (
 	"github.com/gravitational/teleport/lib/teleterm/daemon"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 	"github.com/gravitational/teleport/lib/vnet"
+	"github.com/gravitational/teleport/lib/vnet/diag"
 )
 
 var log = logutils.NewPackageLogger(teleport.ComponentKey, "term:vnet")
@@ -90,6 +95,7 @@ type Config struct {
 	// reporting.
 	InstallationID string
 	Clock          clockwork.Clock
+	profilePath    string
 }
 
 // CheckAndSetDefaults checks and sets the defaults
@@ -110,6 +116,10 @@ func (c *Config) CheckAndSetDefaults() error {
 		c.Clock = clockwork.NewRealClock()
 	}
 
+	if c.profilePath == "" {
+		c.profilePath = profile.FullProfilePath(os.Getenv(types.HomeEnvVar))
+	}
+
 	return nil
 }
 
@@ -211,13 +221,8 @@ func (s *Service) Stop(ctx context.Context, req *api.StopRequest) (*api.StopResp
 	return &api.StopResponse{}, nil
 }
 
-// ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-// includes the proxy service hostnames and custom DNS zones configured in vnet_config.
-//
-// This is fetched exactly the same way the VNet process fetches the DNS zones
-// but may be slightly out of sync with the OS configuration if the admin
-// process hasn't configured a recent change yet.
-func (s *Service) ListDNSZones(ctx context.Context, req *api.ListDNSZonesRequest) (*api.ListDNSZonesResponse, error) {
+// GetServiceInfo returns info about the running VNet service.
+func (s *Service) GetServiceInfo(ctx context.Context, _ *api.GetServiceInfoRequest) (*api.GetServiceInfoResponse, error) {
 	// Acquire the lock just to check the status of the service. We don't want the actual process of
 	// listing DNS zones to block the user from performing other operations.
 	s.mu.Lock()
@@ -225,18 +230,97 @@ func (s *Service) ListDNSZones(ctx context.Context, req *api.ListDNSZonesRequest
 		s.mu.Unlock()
 		return nil, trace.CompareFailed("VNet is not running")
 	}
-	osConfigProvider := s.vnetProcess.GetOSConfigProvider()
+	unifiedClusterConfigProvider := s.vnetProcess.GetUnifiedClusterConfigProvider()
 	s.mu.Unlock()
 
-	targetOSConfig, err := osConfigProvider.GetTargetOSConfiguration(ctx)
+	unifiedClusterConfig, err := unifiedClusterConfigProvider.GetUnifiedClusterConfig(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &api.ListDNSZonesResponse{
-		DnsZones: targetOSConfig.GetDnsZones(),
+
+	sshConfigChecker, err := diag.NewSSHConfigChecker(s.cfg.profilePath)
+	if err != nil {
+		return nil, trace.Wrap(err, "building SSH config checker")
+	}
+	_, sshConfigured, err := sshConfigChecker.OpenSSHConfigIncludesVNetSSHConfig()
+	if err != nil && !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err, "checking SSH configuration")
+	}
+
+	return &api.GetServiceInfoResponse{
+		AppDnsZones:       unifiedClusterConfig.AppDNSZones(),
+		Clusters:          unifiedClusterConfig.ClusterNames,
+		SshConfigured:     sshConfigured,
+		VnetSshConfigPath: sshConfigChecker.VNetSSHConfigPath,
 	}, nil
 }
 
+// RunDiagnostics runs a set of heuristics to determine if VNet actually works
+// on the device. It requires VNet to be started.
+func (s *Service) RunDiagnostics(ctx context.Context, req *api.RunDiagnosticsRequest) (*api.RunDiagnosticsResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.status != statusRunning {
+		return nil, trace.CompareFailed("VNet is not running")
+	}
+
+	if s.networkStackInfo.InterfaceName == "" {
+		return nil, trace.BadParameter("no interface name, this is a bug")
+	}
+
+	if s.networkStackInfo.Ipv6Prefix == "" {
+		return nil, trace.BadParameter("no IPv6 prefix, this is a bug")
+	}
+
+	nsa := &diagv1.NetworkStackAttempt{}
+	if ns, err := s.getNetworkStack(ctx); err != nil {
+		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR
+		nsa.Error = err.Error()
+	} else {
+		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK
+		nsa.NetworkStack = ns
+	}
+
+	diagChecks, err := s.platformDiagChecks(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	report, err := diag.GenerateReport(ctx, diag.ReportPrerequisites{
+		Clock:               s.cfg.Clock,
+		NetworkStackAttempt: nsa,
+		DiagChecks:          diagChecks,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &api.RunDiagnosticsResponse{
+		Report: report,
+	}, nil
+}
+
+func (s *Service) getNetworkStack(ctx context.Context) (*diagv1.NetworkStack, error) {
+	unifiedClusterConfig, err := s.vnetProcess.GetUnifiedClusterConfigProvider().GetUnifiedClusterConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &diagv1.NetworkStack{
+		InterfaceName:  s.networkStackInfo.InterfaceName,
+		Ipv6Prefix:     s.networkStackInfo.Ipv6Prefix,
+		Ipv4CidrRanges: unifiedClusterConfig.IPv4CidrRanges,
+		DnsZones:       unifiedClusterConfig.AllDNSZones(),
+	}, nil
+}
+
+// AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+// connections to Teleport SSH servers through VNet.
+func (s *Service) AutoConfigureSSH(ctx context.Context, _ *api.AutoConfigureSSHRequest) (*api.AutoConfigureSSHResponse, error) {
+	err := vnet.AutoConfigureOpenSSH(ctx, s.cfg.profilePath)
+	return nil, trace.Wrap(err)
+}
+
 func (s *Service) stopLocked() error {
 	if s.status == statusClosed {
 		return trace.CompareFailed("VNet service has been closed")
@@ -390,6 +474,43 @@ func (p *clientApplication) ReissueAppCert(ctx context.Context, appInfo *vnetv1.
 	return cert, nil
 }
 
+// UserTLSCert returns the user TLS certificate for the given profile.
+func (p *clientApplication) UserTLSCert(ctx context.Context, profileName string) (tls.Certificate, error) {
+	// We don't have easy access to the user TLS cert from here, the only way
+	// I've found is to reach through the ProxyClient as this does below.
+	clusterClient, err := p.getCachedClient(ctx, profileName, "")
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err)
+	}
+	clientConfig, err := clusterClient.ProxyClient.ClientConfig(ctx, "")
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err, "getting user client config")
+	}
+	if len(clientConfig.Credentials) < 1 {
+		return tls.Certificate{}, trace.Errorf("user client config has no credentials")
+	}
+	cred := clientConfig.Credentials[0]
+	tlsConfig, err := cred.TLSConfig()
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err, "getting user TLS config")
+	}
+	switch {
+	case len(tlsConfig.Certificates) > 0:
+		return tlsConfig.Certificates[0], nil
+	case tlsConfig.GetClientCertificate != nil:
+		// This is the actual path we currently take at the time of writing,
+		// api/client.configureTLS always sets tlsConfig.GetClientCertificate
+		// and unsets tlsConfig.Certificates.
+		tlsCert, err := tlsConfig.GetClientCertificate(nil)
+		if err != nil {
+			return tls.Certificate{}, trace.Wrap(err, "getting client TLS certificate")
+		}
+		return *tlsCert, nil
+	default:
+		return tls.Certificate{}, trace.Errorf("user TLS config has no certificates")
+	}
+}
+
 // GetDialOptions returns ALPN dial options for the profile.
 func (p *clientApplication) GetDialOptions(ctx context.Context, profileName string) (*vnetv1.DialOptions, error) {
 	cluster, tc, err := p.daemonService.ResolveClusterURI(uri.NewClusterURI(profileName))
@@ -402,20 +523,32 @@ func (p *clientApplication) GetDialOptions(ctx context.Context, profileName stri
 		AlpnConnUpgradeRequired: tc.TLSRoutingConnUpgradeRequired,
 		InsecureSkipVerify:      p.insecureSkipVerify,
 	}
-	if dialOpts.AlpnConnUpgradeRequired {
-		dialOpts.RootClusterCaCertPool, err = tc.RootClusterCACertPoolPEM(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err, "loading root cluster CA cert pool")
-		}
+	dialOpts.RootClusterCaCertPool, err = tc.RootClusterCACertPoolPEM(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "loading root cluster CA cert pool")
 	}
 	return dialOpts, nil
 }
 
-// OnNewConnection submits a usage event once per clientApplication lifetime.
-// That is, if a user makes multiple connections to a single app, OnNewConnection submits a single
+// OnNewSSHSession submits a usage event for a new SSH session.
+func (p *clientApplication) OnNewSSHSession(ctx context.Context, profileName, targetClusterName string) {
+	// Enqueue the event from a separate goroutine since we don't care about errors anyway and we also
+	// don't want to slow down VNet connections.
+	go func() {
+		// Not passing ctx to ReportSSHSession since ctx is tied to the
+		// lifetime of a short-lived API call, inheriting the context could
+		// interrupt reporting.
+		if err := p.usageReporter.ReportSSHSession(profileName, targetClusterName); err != nil {
+			log.ErrorContext(ctx, "Failed to submit SSH usage event")
+		}
+	}()
+}
+
+// OnNewAppConnection submits an app usage event once per clientApplication lifetime.
+// That is, if a user makes multiple connections to a single app, OnNewAppConnection submits a single
 // event. This is to mimic how Connect submits events for its app gateways. This lets us compare
 // popularity of VNet and app gateways.
-func (p *clientApplication) OnNewConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
+func (p *clientApplication) OnNewAppConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
 	// Enqueue the event from a separate goroutine since we don't care about errors anyway and we also
 	// don't want to slow down VNet connections.
 	go func() {
@@ -423,9 +556,8 @@ func (p *clientApplication) OnNewConnection(ctx context.Context, appKey *vnetv1.
 
 		// Not passing ctx to ReportApp since ctx is tied to the lifetime of the connection.
 		// If it's a short-lived connection, inheriting its context would interrupt reporting.
-		err := p.usageReporter.ReportApp(uri)
-		if err != nil {
-			log.ErrorContext(ctx, "Failed to submit usage event", "app", uri, "error", err)
+		if err := p.usageReporter.ReportApp(uri); err != nil {
+			log.ErrorContext(ctx, "Failed to submit app usage event", "app", uri, "error", err)
 		}
 	}()
 
@@ -487,6 +619,7 @@ func (p *clientApplication) OnInvalidLocalPort(ctx context.Context, appInfo *vne
 
 type usageReporter interface {
 	ReportApp(uri.ResourceURI) error
+	ReportSSHSession(profileName, rootClusterName string) error
 	Stop()
 }
 
@@ -556,6 +689,51 @@ func newDaemonUsageReporter(cfg daemonUsageReporterConfig) (*daemonUsageReporter
 	}, nil
 }
 
+// ReportSSHSession adds an event for a new SSH session to the events queue.
+// It reports a new event for each new SSH session, in contrast to ReportApp
+// which only reports each unique app once, to align with how Connect reports
+// usage events for SSH sessions.
+func (r *daemonUsageReporter) ReportSSHSession(profileName, rootClusterName string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.closed.Load() {
+		return trace.CompareFailed("usage reporter has been stopped")
+	}
+
+	rootClusterURI := uri.NewClusterURI(profileName)
+	_, tc, err := r.cfg.ClientCache.ResolveClusterURI(rootClusterURI)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	clusterID, ok := r.cfg.ClusterIDCache.Load(rootClusterURI)
+	if !ok {
+		return trace.NotFound("cluster ID for %q not found", rootClusterURI)
+	}
+
+	log.DebugContext(context.Background(), "Reporting SSH usage event", "profile", profileName, "root_cluster", rootClusterName)
+	if err := r.cfg.EventConsumer.ReportUsageEvent(&apiteleterm.ReportUsageEventRequest{
+		AuthClusterId: clusterID,
+		PrehogReq: &prehogv1alpha.SubmitConnectEventRequest{
+			DistinctId: r.cfg.InstallationID,
+			Timestamp:  timestamppb.Now(),
+			Event: &prehogv1alpha.SubmitConnectEventRequest_ProtocolUse{
+				ProtocolUse: &prehogv1alpha.ConnectProtocolUseEvent{
+					ClusterName:   rootClusterName,
+					UserName:      tc.Username,
+					Protocol:      "ssh",
+					Origin:        "vnet",
+					AccessThrough: "vnet",
+				},
+			},
+		},
+	}); err != nil {
+		return trace.Wrap(err, "adding SSH usage event to queue")
+	}
+	return nil
+}
+
 // ReportApp adds an event related to the given app to the events queue, if the app wasn't reported
 // already. Only one invocation of ReportApp can be in flight at a time.
 func (r *daemonUsageReporter) ReportApp(appURI uri.ResourceURI) error {
@@ -597,9 +775,9 @@ func (r *daemonUsageReporter) ReportApp(appURI uri.ResourceURI) error {
 		return trace.NotFound("cluster ID for %q not found", rootClusterURI)
 	}
 
-	log.DebugContext(ctx, "Reporting usage event", "app", appURI.String())
+	log.DebugContext(ctx, "Reporting app usage event", "app", appURI.String())
 
-	err = r.cfg.EventConsumer.ReportUsageEvent(&apiteleterm.ReportUsageEventRequest{
+	if err := r.cfg.EventConsumer.ReportUsageEvent(&apiteleterm.ReportUsageEventRequest{
 		AuthClusterId: clusterID,
 		PrehogReq: &prehogv1alpha.SubmitConnectEventRequest{
 			DistinctId: r.cfg.InstallationID,
@@ -614,9 +792,8 @@ func (r *daemonUsageReporter) ReportApp(appURI uri.ResourceURI) error {
 				},
 			},
 		},
-	})
-	if err != nil {
-		return trace.Wrap(err, "adding usage event to queue")
+	}); err != nil {
+		return trace.Wrap(err, "adding app usage event to queue")
 	}
 
 	r.reportedApps[appURI.String()] = struct{}{}
@@ -643,7 +820,12 @@ func (r *daemonUsageReporter) Stop() {
 type disabledTelemetryUsageReporter struct{}
 
 func (r *disabledTelemetryUsageReporter) ReportApp(appURI uri.ResourceURI) error {
-	log.DebugContext(context.Background(), "Skipping usage event, usage reporting is turned off", "app", appURI.String())
+	log.DebugContext(context.Background(), "Skipping app usage event, usage reporting is turned off", "app", appURI.String())
+	return nil
+}
+
+func (r *disabledTelemetryUsageReporter) ReportSSHSession(profileName, rootClusterName string) error {
+	log.DebugContext(context.Background(), "Skipping SSH usage event, usage reporting is turned off", "profile", profileName, "root_cluster", rootClusterName)
 	return nil
 }
 
diff --git a/lib/teleterm/vnet/service_darwin.go b/lib/teleterm/vnet/service_darwin.go
index 707d26d70a43b..221350086ac5d 100644
--- a/lib/teleterm/vnet/service_darwin.go
+++ b/lib/teleterm/vnet/service_darwin.go
@@ -21,38 +21,10 @@ import (
 
 	"github.com/gravitational/trace"
 
-	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1"
-	diagv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/diag/v1"
 	"github.com/gravitational/teleport/lib/vnet/diag"
 )
 
-// RunDiagnostics runs a set of heuristics to determine if VNet actually works on the device, that
-// is receives network traffic and DNS queries. RunDiagnostics requires VNet to be started.
-func (s *Service) RunDiagnostics(ctx context.Context, req *api.RunDiagnosticsRequest) (*api.RunDiagnosticsResponse, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if s.status != statusRunning {
-		return nil, trace.CompareFailed("VNet is not running")
-	}
-
-	if s.networkStackInfo.InterfaceName == "" {
-		return nil, trace.BadParameter("no interface name, this is a bug")
-	}
-
-	if s.networkStackInfo.Ipv6Prefix == "" {
-		return nil, trace.BadParameter("no IPv6 prefix, this is a bug")
-	}
-
-	nsa := &diagv1.NetworkStackAttempt{}
-	if ns, err := s.getNetworkStack(ctx); err != nil {
-		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR
-		nsa.Error = err.Error()
-	} else {
-		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK
-		nsa.NetworkStack = ns
-	}
-
+func (s *Service) platformDiagChecks(ctx context.Context) ([]diag.DiagCheck, error) {
 	routeConflictDiag, err := diag.NewRouteConflictDiag(&diag.RouteConflictConfig{
 		VnetIfaceName: s.networkStackInfo.InterfaceName,
 		Routing:       &diag.DarwinRouting{},
@@ -62,29 +34,15 @@ func (s *Service) RunDiagnostics(ctx context.Context, req *api.RunDiagnosticsReq
 		return nil, trace.Wrap(err)
 	}
 
-	report, err := diag.GenerateReport(ctx, diag.ReportPrerequisites{
-		Clock:               s.cfg.Clock,
-		NetworkStackAttempt: nsa,
-		DiagChecks:          []diag.DiagCheck{routeConflictDiag},
+	sshDiag, err := diag.NewSSHDiag(&diag.SSHConfig{
+		ProfilePath: s.cfg.profilePath,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.RunDiagnosticsResponse{
-		Report: report,
-	}, nil
-}
-
-func (s *Service) getNetworkStack(ctx context.Context) (*diagv1.NetworkStack, error) {
-	targetOSConfig, err := s.vnetProcess.GetOSConfigProvider().GetTargetOSConfiguration(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &diagv1.NetworkStack{
-		InterfaceName:  s.networkStackInfo.InterfaceName,
-		Ipv6Prefix:     s.networkStackInfo.Ipv6Prefix,
-		Ipv4CidrRanges: targetOSConfig.GetIpv4CidrRanges(),
-		DnsZones:       targetOSConfig.GetDnsZones(),
+	return []diag.DiagCheck{
+		routeConflictDiag,
+		sshDiag,
 	}, nil
 }
diff --git a/lib/teleterm/vnet/service_other.go b/lib/teleterm/vnet/service_other.go
new file mode 100644
index 0000000000000..e710809f91ffd
--- /dev/null
+++ b/lib/teleterm/vnet/service_other.go
@@ -0,0 +1,29 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build !darwin && !windows
+
+package vnet
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/lib/vnet/diag"
+)
+
+func (s *Service) platformDiagChecks(ctx context.Context) ([]diag.DiagCheck, error) {
+	return nil, nil
+}
diff --git a/lib/teleterm/vnet/service_test.go b/lib/teleterm/vnet/service_test.go
index 58fba75e2afe9..b97c73acdcfdf 100644
--- a/lib/teleterm/vnet/service_test.go
+++ b/lib/teleterm/vnet/service_test.go
@@ -77,6 +77,11 @@ func TestDaemonUsageReporter(t *testing.T) {
 	err = usageReporter.ReportApp(clusterWithoutClusterID.AppendApp("bar"))
 	require.ErrorIs(t, err, trace.NotFound("cluster ID for \"/clusters/no-cluster-id\" not found"))
 	require.Equal(t, 1, eventConsumer.EventCount())
+
+	// Verify that reporting an SSH session works.
+	err = usageReporter.ReportSSHSession(validCluster.GetProfileName(), "foo")
+	require.NoError(t, err)
+	require.Equal(t, 2, eventConsumer.EventCount())
 }
 
 func TestDaemonUsageReporter_Stop(t *testing.T) {
diff --git a/lib/teleterm/vnet/service_windows.go b/lib/teleterm/vnet/service_windows.go
new file mode 100644
index 0000000000000..d41fe2ee00f7d
--- /dev/null
+++ b/lib/teleterm/vnet/service_windows.go
@@ -0,0 +1,48 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/vnet/diag"
+)
+
+func (s *Service) platformDiagChecks(ctx context.Context) ([]diag.DiagCheck, error) {
+	routeConflictDiag, err := diag.NewRouteConflictDiag(&diag.RouteConflictConfig{
+		VnetIfaceName: s.networkStackInfo.InterfaceName,
+		Routing:       &diag.WindowsRouting{},
+		Interfaces:    &diag.NetInterfaces{},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshDiag, err := diag.NewSSHDiag(&diag.SSHConfig{
+		ProfilePath: s.cfg.profilePath,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return []diag.DiagCheck{
+		routeConflictDiag,
+		sshDiag,
+	}, nil
+}
diff --git a/lib/terminal/ansi.go b/lib/terminal/ansi.go
new file mode 100644
index 0000000000000..efbe6f729292c
--- /dev/null
+++ b/lib/terminal/ansi.go
@@ -0,0 +1,235 @@
+/**
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terminal
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+
+	"github.com/hinshun/vt10x"
+)
+
+// VtStateToANSI converts a terminal state to an ANSI escape sequence string,
+// including both the primary and alternate screen buffers.
+// It handles terminal modes, colors, cursor position, and other settings.
+func VtStateToANSI(buf *bytes.Buffer, state vt10x.TerminalState) {
+	// Initialize the terminal
+	buf.WriteString("\x1b[!p") // Soft reset (DECSTR)
+	buf.WriteString("\x1b[2J") // Clear screen
+	buf.WriteString("\x1b[H")  // Home cursor
+
+	// Set terminal size
+	fmt.Fprintf(buf, "\x1b[8;%d;%dt", state.Rows, state.Cols)
+
+	if state.Title != "" {
+		fmt.Fprintf(buf, "\x1b]0;%s\x07", state.Title)
+	}
+
+	// Apply terminal mode settings
+	writeMode(buf, "?7", state.Wrap)         // Line wrap
+	writeMode(buf, "4", state.Insert)        // Insert mode
+	writeMode(buf, "?6", state.Origin)       // Origin mode
+	writeMode(buf, "?5", state.ReverseVideo) // Reverse video
+
+	// Configure tab stops
+	buf.WriteString("\x1b[3g") // Clear all tab stops
+	for _, col := range state.TabStops {
+		fmt.Fprintf(buf, "\x1b[%dG", col+1)
+		buf.WriteString("\x1bH")
+	}
+
+	// Set scroll region (if not default)
+	if state.ScrollTop != 0 || state.ScrollBottom != state.Rows-1 {
+		fmt.Fprintf(buf, "\x1b[%d;%dr", state.ScrollTop+1, state.ScrollBottom+1)
+	}
+
+	// Handle alternate screen mode
+	if state.AltScreen {
+		// Render background buffer first (will be hidden by alternate screen)
+		renderBuffer(buf, state.AlternateBuffer)
+
+		// Save the current cursor position
+		fmt.Fprintf(buf, "\x1b[%d;%dH", state.SavedCursorY+1, state.SavedCursorX+1)
+
+		// Switch to alternate screen
+		buf.WriteString("\x1b[?1049h")
+		buf.WriteString("\x1b[2J") // Clear the alternate screen
+		buf.WriteString("\x1b[H")  // Home cursor
+
+		// Render the primary buffer on the alternate screen
+		renderBuffer(buf, state.PrimaryBuffer)
+	} else {
+		renderBuffer(buf, state.PrimaryBuffer)
+	}
+
+	// Set cursor position and visibility
+	fmt.Fprintf(buf, "\x1b[%d;%dH", state.CursorY+1, state.CursorX+1)
+	writeMode(buf, "?25", state.CursorVisible)
+}
+
+func writeMode(buf *bytes.Buffer, mode string, enabled bool) {
+	if enabled {
+		fmt.Fprintf(buf, "\x1b[%sh", mode)
+	} else {
+		fmt.Fprintf(buf, "\x1b[%sl", mode)
+	}
+}
+
+func renderBuffer(buf *bytes.Buffer, buffer [][]vt10x.Glyph) {
+	buf.WriteString("\x1b[0m") // Reset all attributes
+
+	// Track last rendered attributes to minimize escape sequences
+	lastFG := vt10x.DefaultFG
+	lastBG := vt10x.DefaultBG
+
+	var lastMode int16 = -1
+
+	for y := 0; y < len(buffer); y++ {
+		isEmpty := true
+		for x := 0; x < len(buffer[y]); x++ {
+			if buffer[y][x].Char != 0 && buffer[y][x].Char != ' ' {
+				isEmpty = false
+				break
+			}
+		}
+
+		if isEmpty {
+			continue
+		}
+
+		fmt.Fprintf(buf, "\x1b[%d;1H", y+1)
+
+		for x := 0; x < len(buffer[y]); x++ {
+			glyph := buffer[y][x]
+			var codes []string
+
+			// Handle reverse video by swapping colors
+			fg, bg := glyph.FG, glyph.BG
+			if vt10x.IsReverse(glyph.Mode) {
+				fg, bg = bg, fg
+			}
+
+			// Rebuild text attributes if mode changed
+			if glyph.Mode != lastMode {
+				// Only reset if we had attributes before, and they're different now
+				// (not just going from no attributes to some attributes)
+				if lastMode > 0 && glyph.Mode != lastMode {
+					codes = append(codes, "0")
+					lastFG = vt10x.DefaultFG
+					lastBG = vt10x.DefaultBG
+				}
+
+				if vt10x.IsBold(glyph.Mode) {
+					codes = append(codes, "1")
+				}
+				if vt10x.IsUnderline(glyph.Mode) {
+					codes = append(codes, "4")
+				}
+				if vt10x.IsItalic(glyph.Mode) {
+					codes = append(codes, "3")
+				}
+				if vt10x.IsBlink(glyph.Mode) {
+					codes = append(codes, "5")
+				}
+				lastMode = glyph.Mode
+			}
+
+			// Update foreground color if changed
+			if fg != lastFG {
+				// Only emit color codes if it's not the default color
+				if fg != vt10x.DefaultFG {
+					codes = append(codes, colorToANSI(fg, true)...)
+				} else if lastFG != vt10x.DefaultFG && bg == vt10x.DefaultBG {
+					// Only emit default foreground if we're not also changing background
+					// (if background is changing, we can rely on it being more specific)
+					codes = append(codes, colorToANSI(fg, true)...)
+				}
+				lastFG = fg
+			}
+
+			// Update background color if changed
+			if bg != lastBG {
+				// Only emit color codes if it's not the default color
+				if bg != vt10x.DefaultBG {
+					codes = append(codes, colorToANSI(bg, false)...)
+				} else if lastBG != vt10x.DefaultBG {
+					// Changing from non-default to default
+					codes = append(codes, colorToANSI(bg, false)...)
+				}
+				lastBG = bg
+			}
+
+			// Emit escape sequence if any attributes changed
+			if len(codes) > 0 {
+				buf.WriteString("\x1b[")
+				buf.WriteString(strings.Join(codes, ";"))
+				buf.WriteString("m")
+			}
+
+			// Write character (space for null character)
+			if glyph.Char == 0 {
+				buf.WriteRune(' ')
+			} else {
+				buf.WriteRune(glyph.Char)
+			}
+		}
+	}
+
+	buf.WriteString("\x1b[0m") // Reset attributes at end
+}
+
+func colorToANSI(color vt10x.Color, isForeground bool) []string {
+	baseCode := 30
+	if !isForeground {
+		baseCode = 40
+	}
+
+	// Default color
+	if (isForeground && color == vt10x.DefaultFG) || (!isForeground && color == vt10x.DefaultBG) {
+		return []string{fmt.Sprintf("%d", baseCode+9)}
+	}
+
+	// Basic 16 colors
+	if color < 16 {
+		if color < 8 {
+			return []string{fmt.Sprintf("%d", baseCode+int(color))}
+		}
+		return []string{fmt.Sprintf("%d", baseCode+60+int(color)-8)}
+	}
+
+	// 256 color palette
+	if color < 256 {
+		prefix := "38"
+		if !isForeground {
+			prefix = "48"
+		}
+		return []string{prefix, "5", fmt.Sprintf("%d", color)}
+	}
+
+	r := (color >> 16) & 0xFF
+	g := (color >> 8) & 0xFF
+	b := color & 0xFF
+
+	prefix := "38"
+	if !isForeground {
+		prefix = "48"
+	}
+
+	return []string{prefix, "2", fmt.Sprintf("%d", r), fmt.Sprintf("%d", g), fmt.Sprintf("%d", b)}
+}
diff --git a/lib/terminal/ansi_test.go b/lib/terminal/ansi_test.go
new file mode 100644
index 0000000000000..864156f76fc92
--- /dev/null
+++ b/lib/terminal/ansi_test.go
@@ -0,0 +1,236 @@
+/**
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terminal
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/hinshun/vt10x"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestTerminalStateToANSI(t *testing.T) {
+	tests := []struct {
+		name   string
+		setup  func(vt vt10x.Terminal)
+		width  int
+		height int
+	}{
+		{
+			name:   "BasicText",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Hello, World!"))
+			},
+		},
+		{
+			name:   "Colors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[31mRed\x1b[0m \x1b[42mGreen BG\x1b[0m"))
+			},
+		},
+		{
+			name:   "256Colors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[38;5;196mColor 196\x1b[0m")) // 256 color foreground
+				vt.Write([]byte("\x1b[48;5;21m BG 21 \x1b[0m"))    // 256 color background
+			},
+		},
+		{
+			name:   "RGBColors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[38;2;255;128;64mRGB Text\x1b[0m")) // RGB foreground color
+			},
+		},
+		{
+			name:   "TextAttributes",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[1mBold\x1b[0m "))
+				vt.Write([]byte("\x1b[3mItalic\x1b[0m "))
+				vt.Write([]byte("\x1b[4mUnderline\x1b[0m "))
+				vt.Write([]byte("\x1b[5mBlink\x1b[0m"))
+			},
+		},
+		{
+			name:   "CursorPosition",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Line 1\n"))
+				vt.Write([]byte("Line 2\n"))
+				vt.Write([]byte("\x1b[5;10H")) // Move cursor to (5, 10)
+				vt.Write([]byte("At 5,10"))
+			},
+		},
+		{
+			name:   "AlternateScreen",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Primary buffer text"))
+				vt.Write([]byte("\x1b[?1049h")) // Switch to alternate screen
+				vt.Write([]byte("Alternate buffer text"))
+			},
+		},
+		{
+			name:   "AlternateScreenSwitch",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Main screen\n"))
+				vt.Write([]byte("\x1b[2;5H"))
+				vt.Write([]byte("Position saved"))
+
+				vt.Write([]byte("\x1b[?1049h")) // Switch to alternate screen
+				vt.Write([]byte("\x1b[2J\x1b[H"))
+				vt.Write([]byte("Alt screen content"))
+
+				vt.Write([]byte("\x1b[?1049l")) // Switch back to main screen
+			},
+		},
+		{
+			name:   "ScrollRegion",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[5;20r")) // Set scroll region from line 5 to 20
+				vt.Write([]byte("Text in scroll region"))
+			},
+		},
+		{
+			name:   "TabStops",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				// Set some tab stops
+				vt.Write([]byte("\x1b[3g"))
+				vt.Write([]byte("\x1b[10G\x1bH"))
+				vt.Write([]byte("\x1b[20G\x1bH"))
+				vt.Write([]byte("\x1b[30G\x1bH"))
+				vt.Write([]byte("\x1b[1G"))
+				vt.Write([]byte("A\tB\tC\tD"))
+			},
+		},
+		{
+			name:   "Title",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				// Set terminal title
+				vt.Write([]byte("\x1b]0;Teleport\x07"))
+				vt.Write([]byte("Content"))
+			},
+		},
+		{
+			name:   "Modes",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[?7h"))  // Enable line wrap
+				vt.Write([]byte("\x1b[4h"))   // Enable insert mode
+				vt.Write([]byte("\x1b[?6h"))  // Enable origin mode
+				vt.Write([]byte("\x1b[?5h"))  // Enable reverse video
+				vt.Write([]byte("\x1b[?25l")) // Hide cursor
+			},
+		},
+		{
+			name:   "ComplexBufferSwap",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[31mRed text in main\x1b[0m\n"))
+				vt.Write([]byte("\x1b[1mBold main text\x1b[0m\n"))
+				vt.Write([]byte("\x1b[3;15H"))    // Move cursor to (3, 15)
+				vt.Write([]byte("\x1b[?1049h"))   // Switch to alternate screen
+				vt.Write([]byte("\x1b[2J\x1b[H")) // Clear and home cursor in alternate screen
+				vt.Write([]byte("\x1b[32mGreen in alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[4mUnderlined alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[5;20H")) // Move cursor to (5, 20)
+			},
+		},
+		{
+			name:   "ReverseVideo",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[7mReversed text\x1b[0m"))
+				vt.Write([]byte(" Normal"))
+			},
+		},
+		{
+			name:   "MultilineWithColors",
+			width:  80,
+			height: 10,
+			setup: func(vt vt10x.Terminal) {
+				lines := []string{
+					"\x1b[31mLine 1 Red\x1b[0m",
+					"\x1b[32mLine 2 Green\x1b[0m",
+					"\x1b[33mLine 3 Yellow\x1b[0m",
+					"\x1b[34mLine 4 Blue\x1b[0m",
+					"\x1b[35mLine 5 Magenta\x1b[0m",
+				}
+
+				for _, line := range lines {
+					vt.Write([]byte(line + "\n"))
+				}
+			},
+		},
+		{
+			name:   "EmptyGlyphs",
+			width:  10,
+			height: 5,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("A"))
+				vt.Write([]byte("\x1b[1;5H")) // Move cursor to (1, 5)
+				vt.Write([]byte("B"))
+				vt.Write([]byte("\x1b[3;3H")) // Move cursor to (3, 3)
+				vt.Write([]byte("C"))
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			vt := vt10x.New(vt10x.WithSize(tt.width, tt.height))
+
+			tt.setup(vt)
+
+			var buf bytes.Buffer
+			state := vt.DumpState()
+			VtStateToANSI(&buf, state)
+
+			if golden.ShouldSet() {
+				golden.Set(t, buf.Bytes())
+			}
+
+			require.Equal(t, string(golden.Get(t)), buf.String())
+		})
+	}
+}
diff --git a/lib/terminal/svg.go b/lib/terminal/svg.go
new file mode 100644
index 0000000000000..b8c4fe24a8d3f
--- /dev/null
+++ b/lib/terminal/svg.go
@@ -0,0 +1,337 @@
+/**
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terminal
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+
+	"github.com/hinshun/vt10x"
+)
+
+const (
+	fontSize   = 14.0
+	lineHeight = 1.2
+	charRatio  = 0.602 // Menlo mono font character width/height ratio
+)
+
+// VtToSvg converts a terminal state to an SVG representation
+func VtToSvg(terminal vt10x.Terminal) []byte {
+	var buf bytes.Buffer
+
+	cols, rows := terminal.Size()
+
+	charWidthPx := fontSize * charRatio
+	rowHeightPx := fontSize * lineHeight
+	pixelWidth := int((float64(cols) + 2.0) * charWidthPx)
+	pixelHeight := int((float64(rows) + 1.0) * rowHeightPx)
+
+	closeHeader := writeSVGHeader(&buf, pixelWidth, pixelHeight)
+
+	var cursor *cursorPos
+	if terminal.CursorVisible() {
+		c := terminal.Cursor()
+		cursor = &cursorPos{x: c.X, y: c.Y}
+	}
+
+	renderBackgrounds(&buf, terminal, charWidthPx, rowHeightPx, cursor)
+	renderText(&buf, terminal, charWidthPx, rowHeightPx, cursor)
+
+	buf.WriteString(closeHeader())
+
+	return buf.Bytes()
+}
+
+// writeSVGHeader writes the SVG header and styles to the buffer.
+// It returns a function that closes the SVG tags when called.
+func writeSVGHeader(buf *bytes.Buffer, width, height int) func() string {
+	xOffset := fontSize * 0.6
+	yOffset := fontSize * lineHeight * 0.5
+
+	fmt.Fprintf(buf, `<svg xmlns="http://www.w3.org/2000/svg" width="%d" height="%d" font-size="%.0f" class="terminal">`,
+		width, height, fontSize)
+	fmt.Fprintf(buf, `<rect width="100%%" height="100%%" class="bg-default"/><svg x="%.1f" y="%.1f">`,
+		xOffset, yOffset)
+
+	return func() string {
+		return "</svg></svg>"
+	}
+}
+
+func renderBackgrounds(buf *bytes.Buffer, terminal vt10x.Terminal, charWidthPx, rowHeightPx float64, cursor *cursorPos) {
+	type bgRect struct {
+		x, y, w, h float64
+		color      vt10x.Color
+	}
+	var rects []bgRect
+
+	cols, rows := terminal.Size()
+	for y := range rows {
+		yPos := float64(y) * rowHeightPx
+		var currentRect *bgRect
+
+		for x := range cols {
+			glyph := terminal.Cell(x, y)
+			attrs := getTextAttrs(glyph, cursor, x, y)
+
+			if attrs.background == vt10x.DefaultBG {
+				currentRect = nil
+				continue
+			}
+
+			xPos := float64(x) * charWidthPx
+
+			if currentRect != nil && currentRect.color == attrs.background && currentRect.y == yPos {
+				currentRect.w += charWidthPx
+			} else {
+				newRect := bgRect{
+					x:     xPos,
+					y:     yPos,
+					w:     charWidthPx,
+					h:     rowHeightPx,
+					color: attrs.background,
+				}
+				rects = append(rects, newRect)
+				currentRect = &rects[len(rects)-1]
+			}
+		}
+	}
+
+	if len(rects) > 0 {
+		buf.WriteString(`<g shape-rendering="crispEdges">`)
+		for _, rect := range rects {
+			fmt.Fprintf(buf, `<rect x="%.1f" y="%.1f" width="%.1f" height="%.1f"`,
+				rect.x, rect.y, rect.w, rect.h)
+
+			if rect.color < 16 {
+				fmt.Fprintf(buf, ` class="bg-%d"`, rect.color)
+			} else {
+				fmt.Fprintf(buf, ` style="fill:%s"`, colorToHex(rect.color))
+			}
+
+			buf.WriteString("/>")
+		}
+		buf.WriteString("</g>")
+	}
+}
+
+func renderText(buf *bytes.Buffer, terminal vt10x.Terminal, charWidthPx, rowHeightPx float64, cursor *cursorPos) {
+	buf.WriteString(`<text>`)
+
+	cols, rows := terminal.Size()
+	for y := range rows {
+		// Check if the entire row has any non-space content
+		hasContent := false
+		for x := range cols {
+			glyph := terminal.Cell(x, y)
+			isCursor := cursor != nil && cursor.x == x && cursor.y == y
+			if (glyph.Char != 0 && glyph.Char != ' ') || isCursor {
+				hasContent = true
+				break
+			}
+		}
+
+		if !hasContent {
+			continue
+		}
+
+		yPos := float64(y) * rowHeightPx
+		fmt.Fprintf(buf, `<tspan y="%.1f" dy="1em">`, yPos)
+
+		col := 0
+		for col < cols {
+			glyph := terminal.Cell(col, y)
+			isCursor := cursor != nil && cursor.x == col && cursor.y == y
+
+			// Skip spaces completely (unless it's the cursor position)
+			if glyph.Char == ' ' || (glyph.Char == 0 && !isCursor) {
+				col++
+				continue
+			}
+
+			startCol := col
+			attrs := getTextAttrs(glyph, cursor, col, y)
+			var text strings.Builder
+
+			// Collect consecutive non-space characters with same attributes
+			for col < cols {
+				currentGlyph := terminal.Cell(col, y)
+				currentIsCursor := cursor != nil && cursor.x == col && cursor.y == y
+
+				// Stop if we hit a space or null (unless cursor)
+				if currentGlyph.Char == ' ' || (currentGlyph.Char == 0 && !currentIsCursor) {
+					break
+				}
+
+				// Stop if attributes change
+				currentAttrs := getTextAttrs(currentGlyph, cursor, col, y)
+				if currentAttrs != attrs {
+					break
+				}
+
+				// Add the character
+				charToRender := currentGlyph.Char
+				if currentIsCursor && charToRender == 0 {
+					charToRender = ' '
+				}
+
+				switch charToRender {
+				case '\'':
+					text.WriteString("&#39;")
+				case '"':
+					text.WriteString("&quot;")
+				case '&':
+					text.WriteString("&amp;")
+				case '>':
+					text.WriteString("&gt;")
+				case '<':
+					text.WriteString("&lt;")
+				default:
+					text.WriteRune(charToRender)
+				}
+
+				col++
+			}
+
+			xPos := float64(startCol) * charWidthPx
+			fmt.Fprintf(buf, `<tspan x="%.1f"`, xPos)
+
+			var classes []string
+			var style string
+
+			if attrs.foreground == vt10x.DefaultFG {
+				// No class needed for default foreground
+			} else if attrs.foreground < 16 {
+				classes = append(classes, fmt.Sprintf("fg-%d", attrs.foreground))
+			} else {
+				style = fmt.Sprintf("fill:%s", colorToHex(attrs.foreground))
+			}
+
+			if attrs.bold {
+				classes = append(classes, "b")
+			}
+			if attrs.italic {
+				classes = append(classes, "i")
+			}
+			if attrs.underline {
+				classes = append(classes, "u")
+			}
+
+			if len(classes) > 0 {
+				buf.WriteString(` class="`)
+				buf.WriteString(strings.Join(classes, " "))
+				buf.WriteString(`"`)
+			}
+
+			if style != "" {
+				buf.WriteString(` style="`)
+				buf.WriteString(style)
+				buf.WriteString(`"`)
+			}
+
+			buf.WriteString(`>`)
+			buf.WriteString(text.String())
+			buf.WriteString(`</tspan>`)
+		}
+
+		buf.WriteString("</tspan>")
+	}
+
+	buf.WriteString("</text>")
+}
+
+func colorToHex(color vt10x.Color) string {
+	if color < 256 {
+		var r, g, b uint8
+
+		if color >= 232 {
+			gray := uint8((color-232)*10 + 8)
+			r, g, b = gray, gray, gray
+		} else if color >= 16 {
+			c := color - 16
+			r = uint8((c / 36) * 51)
+			g = uint8(((c % 36) / 6) * 51)
+			b = uint8((c % 6) * 51)
+		} else {
+			return "#000000"
+		}
+
+		return fmt.Sprintf("#%02x%02x%02x", r, g, b)
+	}
+
+	r := (color >> 16) & 0xFF
+	g := (color >> 8) & 0xFF
+	b := color & 0xFF
+
+	return fmt.Sprintf("#%02x%02x%02x", r, g, b)
+}
+
+type cursorPos struct {
+	x, y int
+}
+
+type textAttrs struct {
+	foreground vt10x.Color
+	background vt10x.Color
+	bold       bool
+	italic     bool
+	underline  bool
+}
+
+func getTextAttrs(glyph vt10x.Glyph, cursor *cursorPos, x, y int) textAttrs {
+	fg := glyph.FG
+	bg := glyph.BG
+	mode := glyph.Mode
+
+	isCursor := cursor != nil && cursor.x == x && cursor.y == y
+
+	if vt10x.IsBold(mode) && fg < 8 { // Brighten foreground if bold
+		fg = fg + 8
+	}
+
+	if vt10x.IsBlink(mode) && bg < 8 { // Brighten background if blink
+		bg = bg + 8
+	}
+
+	// inverse if either reverse mode OR cursor, but not both
+	shouldInverse := vt10x.IsReverse(mode) != isCursor
+
+	if shouldInverse {
+		newFg := bg
+		newBg := fg
+
+		if newFg == vt10x.DefaultBG {
+			newFg = vt10x.Color(0)
+		}
+		if newBg == vt10x.DefaultFG {
+			newBg = vt10x.Color(7)
+		}
+
+		fg = newFg
+		bg = newBg
+	}
+
+	return textAttrs{
+		foreground: fg,
+		background: bg,
+		bold:       vt10x.IsBold(mode),
+		italic:     vt10x.IsItalic(mode),
+		underline:  vt10x.IsUnderline(mode),
+	}
+}
diff --git a/lib/terminal/svg_test.go b/lib/terminal/svg_test.go
new file mode 100644
index 0000000000000..8d8749d17903b
--- /dev/null
+++ b/lib/terminal/svg_test.go
@@ -0,0 +1,331 @@
+/**
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package terminal
+
+import (
+	"testing"
+
+	"github.com/hinshun/vt10x"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestTerminalStateToSVG(t *testing.T) {
+	tests := []struct {
+		name   string
+		setup  func(vt vt10x.Terminal)
+		width  int
+		height int
+	}{
+		{
+			name:   "BasicText",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Hello, World!"))
+			},
+		},
+		{
+			name:   "Colors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[31mRed\x1b[0m \x1b[42mGreen BG\x1b[0m"))
+			},
+		},
+		{
+			name:   "256Colors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[38;5;196mColor 196\x1b[0m"))
+				vt.Write([]byte("\x1b[48;5;21m BG 21 \x1b[0m"))
+			},
+		},
+		{
+			name:   "RGBColors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[38;2;255;128;64mRGB Text\x1b[0m"))
+			},
+		},
+		{
+			name:   "TextAttributes",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[1mBold\x1b[0m "))
+				vt.Write([]byte("\x1b[3mItalic\x1b[0m "))
+				vt.Write([]byte("\x1b[4mUnderline\x1b[0m "))
+				vt.Write([]byte("\x1b[5mBlink\x1b[0m"))
+			},
+		},
+		{
+			name:   "CursorPosition",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Line 1\n"))
+				vt.Write([]byte("Line 2\n"))
+				vt.Write([]byte("\x1b[5;10H"))
+				vt.Write([]byte("At 5,10"))
+			},
+		},
+		{
+			name:   "AlternateScreen",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Primary buffer text"))
+				vt.Write([]byte("\x1b[?1049h"))
+				vt.Write([]byte("Alternate buffer text"))
+			},
+		},
+		{
+			name:   "AlternateScreenSwitch",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Main screen\n"))
+				vt.Write([]byte("\x1b[2;5H"))
+				vt.Write([]byte("Position saved"))
+
+				vt.Write([]byte("\x1b[?1049h"))
+				vt.Write([]byte("\x1b[2J\x1b[H"))
+				vt.Write([]byte("Alt screen content"))
+
+				vt.Write([]byte("\x1b[?1049l"))
+			},
+		},
+		{
+			name:   "SpecialCharacters",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte(`<tag> & "quotes" 'apostrophes'`))
+			},
+		},
+		{
+			name:   "ReverseVideo",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[7mReversed text\x1b[0m"))
+				vt.Write([]byte(" Normal"))
+			},
+		},
+		{
+			name:   "MultilineWithColors",
+			width:  80,
+			height: 10,
+			setup: func(vt vt10x.Terminal) {
+				lines := []string{
+					"\x1b[31mLine 1 Red\x1b[0m",
+					"\x1b[32mLine 2 Green\x1b[0m",
+					"\x1b[33mLine 3 Yellow\x1b[0m",
+					"\x1b[34mLine 4 Blue\x1b[0m",
+					"\x1b[35mLine 5 Magenta\x1b[0m",
+				}
+
+				for _, line := range lines {
+					vt.Write([]byte(line + "\n"))
+				}
+			},
+		},
+		{
+			name:   "EmptyGlyphs",
+			width:  10,
+			height: 5,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("A"))
+				vt.Write([]byte("\x1b[1;5H"))
+				vt.Write([]byte("B"))
+				vt.Write([]byte("\x1b[3;3H"))
+				vt.Write([]byte("C"))
+			},
+		},
+		{
+			name:   "ComplexBufferSwap",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[31mRed text in main\x1b[0m\n"))
+				vt.Write([]byte("\x1b[1mBold main text\x1b[0m\n"))
+				vt.Write([]byte("\x1b[3;15H"))
+				vt.Write([]byte("\x1b[?1049h"))
+				vt.Write([]byte("\x1b[2J\x1b[H"))
+				vt.Write([]byte("\x1b[32mGreen in alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[4mUnderlined alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[5;20H"))
+			},
+		},
+		{
+			name:   "SVGStructure",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("Test"))
+			},
+		},
+		{
+			name:   "BackgroundRects",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[41mRed BG\x1b[0m \x1b[42mGreen BG\x1b[0m"))
+			},
+		},
+		{
+			name:   "ExtendedBackgroundColors",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[48;5;196mExtended BG\x1b[0m"))
+			},
+		},
+		{
+			name:   "CombinedAttributes",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[1;3;4mBold Italic Underline\x1b[0m"))
+			},
+		},
+		{
+			name:   "EmptyLines",
+			width:  80,
+			height: 5,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("First line\n\n\nFourth line"))
+			},
+		},
+		{
+			name:   "SpacedText",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("A"))
+				vt.Write([]byte("\x1b[1;10H"))
+				vt.Write([]byte("B"))
+				vt.Write([]byte("\x1b[1;20H"))
+				vt.Write([]byte("C"))
+			},
+		},
+		{
+			name:   "ComplexBufferSwapMain",
+			width:  80,
+			height: 24,
+			setup: func(vt vt10x.Terminal) {
+				vt.Write([]byte("\x1b[31mRed text in main\x1b[0m\n"))
+				vt.Write([]byte("\x1b[1mBold main text\x1b[0m\n"))
+				vt.Write([]byte("\x1b[3;15H"))
+				vt.Write([]byte("\x1b[?1049h"))
+				vt.Write([]byte("\x1b[2J\x1b[H"))
+				vt.Write([]byte("\x1b[32mGreen in alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[4mUnderlined alt\x1b[0m\n"))
+				vt.Write([]byte("\x1b[5;20H"))
+				vt.Write([]byte("\x1b[?1049l")) // Switch back to main
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			vt := vt10x.New(vt10x.WithSize(tt.width, tt.height))
+
+			tt.setup(vt)
+
+			svg := string(VtToSvg(vt))
+
+			if golden.ShouldSet() {
+				golden.Set(t, []byte(svg))
+			}
+
+			require.Equal(t, string(golden.Get(t)), svg)
+		})
+	}
+}
+
+func TestColorToHex(t *testing.T) {
+	tests := []struct {
+		name     string
+		color    vt10x.Color
+		expected string
+	}{
+		{
+			name:     "Basic color (< 16)",
+			color:    vt10x.Color(5),
+			expected: "#000000",
+		},
+		{
+			name:     "256 color palette - low",
+			color:    vt10x.Color(16),
+			expected: "#000000",
+		},
+		{
+			name:     "256 color palette - red",
+			color:    vt10x.Color(196),
+			expected: "#ff0000",
+		},
+		{
+			name:     "256 color palette - green",
+			color:    vt10x.Color(46),
+			expected: "#00ff00",
+		},
+		{
+			name:     "256 color palette - blue",
+			color:    vt10x.Color(21),
+			expected: "#0000ff",
+		},
+		{
+			name:     "256 color palette - mixed",
+			color:    vt10x.Color(123),
+			expected: "#66ffff",
+		},
+		{
+			name:     "Grayscale - start",
+			color:    vt10x.Color(232),
+			expected: "#080808",
+		},
+		{
+			name:     "Grayscale - middle",
+			color:    vt10x.Color(243),
+			expected: "#767676",
+		},
+		{
+			name:     "Grayscale - end",
+			color:    vt10x.Color(255),
+			expected: "#eeeeee",
+		},
+		{
+			name:     "RGB color",
+			color:    vt10x.Color(0xFF8040),
+			expected: "#ff8040",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := colorToHex(tt.color)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/256Colors.golden b/lib/terminal/testdata/TestTerminalStateToANSI/256Colors.golden
new file mode 100644
index 0000000000000..e7b618d76427c
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/256Colors.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHColor 196 BG 21                                                                 [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreen.golden b/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreen.golden
new file mode 100644
index 0000000000000..40c3c9626e1ca
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreen.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHPrimary buffer text                                                             [?1049h                   Alternate buffer text                                        [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreenSwitch.golden b/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreenSwitch.golden
new file mode 100644
index 0000000000000..7f8e8327343c9
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/AlternateScreenSwitch.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHMain screen                                                                         Position saved                                                              [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/BasicText.golden b/lib/terminal/testdata/TestTerminalStateToANSI/BasicText.golden
new file mode 100644
index 0000000000000..e7ca8f48d8649
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/BasicText.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHHello, World!                                                                   [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/Colors.golden b/lib/terminal/testdata/TestTerminalStateToANSI/Colors.golden
new file mode 100644
index 0000000000000..03868c9508d4f
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/Colors.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHRed Green BG                                                                    [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/ComplexBufferSwap.golden b/lib/terminal/testdata/TestTerminalStateToANSI/ComplexBufferSwap.golden
new file mode 100644
index 0000000000000..85b86616f543d
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/ComplexBufferSwap.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHRed text in main                                                                                Bold main text                                                  [?1049hGreen in alt                                                                                Underlined alt                                                      [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/CursorPosition.golden b/lib/terminal/testdata/TestTerminalStateToANSI/CursorPosition.golden
new file mode 100644
index 0000000000000..93c0a66370d98
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/CursorPosition.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHLine 1                                                                                Line 2                                                                             At 5,10                                                                [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/EmptyGlyphs.golden b/lib/terminal/testdata/TestTerminalStateToANSI/EmptyGlyphs.golden
new file mode 100644
index 0000000000000..b816d217ff173
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/EmptyGlyphs.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHA   B       C       [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/Modes.golden b/lib/terminal/testdata/TestTerminalStateToANSI/Modes.golden
new file mode 100644
index 0000000000000..f0c6fd26ed38f
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/Modes.golden
@@ -0,0 +1 @@
+[!p[?7h[?6h[?5hHHHHHHHHH[?25l
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/MultilineWithColors.golden b/lib/terminal/testdata/TestTerminalStateToANSI/MultilineWithColors.golden
new file mode 100644
index 0000000000000..74bf2d755e744
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/MultilineWithColors.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHLine 1 Red                                                                                Line 2 Green                                                                                Line 3 Yellow                                                                                Line 4 Blue                                                                                Line 5 Magenta                    [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/RGBColors.golden b/lib/terminal/testdata/TestTerminalStateToANSI/RGBColors.golden
new file mode 100644
index 0000000000000..5e1946b842420
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/RGBColors.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHRGB Text                                                                        [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/ReverseVideo.golden b/lib/terminal/testdata/TestTerminalStateToANSI/ReverseVideo.golden
new file mode 100644
index 0000000000000..95d14a05bf222
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/ReverseVideo.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHReversed text Normal                                                            [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/ScrollRegion.golden b/lib/terminal/testdata/TestTerminalStateToANSI/ScrollRegion.golden
new file mode 100644
index 0000000000000..0ffb8e50c2237
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/ScrollRegion.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHText in scroll region                                                           [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/TabStops.golden b/lib/terminal/testdata/TestTerminalStateToANSI/TabStops.golden
new file mode 100644
index 0000000000000..9d53a3d111c1e
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/TabStops.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHA        B         C         D                                                  [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/TextAttributes.golden b/lib/terminal/testdata/TestTerminalStateToANSI/TextAttributes.golden
new file mode 100644
index 0000000000000..5a94a1ee470a1
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/TextAttributes.golden
@@ -0,0 +1 @@
+[!p[?7h[?6l[?5lHHHHHHHHHBold Italic Underline Blink                                                     [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToANSI/Title.golden b/lib/terminal/testdata/TestTerminalStateToANSI/Title.golden
new file mode 100644
index 0000000000000..2bec36734c4fc
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToANSI/Title.golden
@@ -0,0 +1 @@
+[!p]0;Teleport[?7h[?6l[?5lHHHHHHHHHContent                                                                         [?25h
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/256Colors.golden b/lib/terminal/testdata/TestTerminalStateToSVG/256Colors.golden
new file mode 100644
index 0000000000000..8a242f77b60f5
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/256Colors.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="75.9" y="0.0" width="59.0" height="16.8" style="fill:#0000ff"/><rect x="134.8" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" style="fill:#ff0000">Color</tspan><tspan x="50.6" style="fill:#ff0000">196</tspan><tspan x="84.3">BG</tspan><tspan x="109.6">21</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreen.golden b/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreen.golden
new file mode 100644
index 0000000000000..56e222dd352e5
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreen.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="337.1" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="160.1">Alternate</tspan><tspan x="244.4">buffer</tspan><tspan x="303.4">text</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreenSwitch.golden b/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreenSwitch.golden
new file mode 100644
index 0000000000000..424ea5055cb30
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/AlternateScreenSwitch.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="151.7" y="16.8" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Main</tspan><tspan x="42.1">screen</tspan></tspan><tspan y="16.8" dy="1em"><tspan x="33.7">Position</tspan><tspan x="109.6">saved</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/BackgroundRects.golden b/lib/terminal/testdata/TestTerminalStateToSVG/BackgroundRects.golden
new file mode 100644
index 0000000000000..6807688b7e79a
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/BackgroundRects.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="0.0" y="0.0" width="50.6" height="16.8" class="bg-1"/><rect x="59.0" y="0.0" width="67.4" height="16.8" class="bg-2"/><rect x="126.4" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Red</tspan><tspan x="33.7">BG</tspan><tspan x="59.0">Green</tspan><tspan x="109.6">BG</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/BasicText.golden b/lib/terminal/testdata/TestTerminalStateToSVG/BasicText.golden
new file mode 100644
index 0000000000000..ddb794744f4e0
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/BasicText.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="109.6" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Hello,</tspan><tspan x="59.0">World!</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/Colors.golden b/lib/terminal/testdata/TestTerminalStateToSVG/Colors.golden
new file mode 100644
index 0000000000000..fd8952c7c673c
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/Colors.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="33.7" y="0.0" width="67.4" height="16.8" class="bg-2"/><rect x="101.1" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="fg-1">Red</tspan><tspan x="33.7">Green</tspan><tspan x="84.3">BG</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/CombinedAttributes.golden b/lib/terminal/testdata/TestTerminalStateToSVG/CombinedAttributes.golden
new file mode 100644
index 0000000000000..7d319eb804a74
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/CombinedAttributes.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="177.0" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="b i u">Bold</tspan><tspan x="42.1" class="b i u">Italic</tspan><tspan x="101.1" class="b i u">Underline</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwap.golden b/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwap.golden
new file mode 100644
index 0000000000000..1226de7e58ad0
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwap.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="160.1" y="67.2" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="fg-2">Green</tspan><tspan x="50.6" class="fg-2">in</tspan><tspan x="75.9" class="fg-2">alt</tspan></tspan><tspan y="16.8" dy="1em"><tspan x="101.1" class="u">Underlined</tspan><tspan x="193.8" class="u">alt</tspan></tspan><tspan y="67.2" dy="1em"></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwapMain.golden b/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwapMain.golden
new file mode 100644
index 0000000000000..d3d25c0a2b40d
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/ComplexBufferSwapMain.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="118.0" y="33.6" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="fg-1">Red</tspan><tspan x="33.7" class="fg-1">text</tspan><tspan x="75.9" class="fg-1">in</tspan><tspan x="101.1" class="fg-1">main</tspan></tspan><tspan y="16.8" dy="1em"><tspan x="134.8" class="b">Bold</tspan><tspan x="177.0" class="b">main</tspan><tspan x="219.1" class="b">text</tspan></tspan><tspan y="33.6" dy="1em"></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/CursorPosition.golden b/lib/terminal/testdata/TestTerminalStateToSVG/CursorPosition.golden
new file mode 100644
index 0000000000000..3fb9b974d430b
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/CursorPosition.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="134.8" y="67.2" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Line</tspan><tspan x="42.1">1</tspan></tspan><tspan y="16.8" dy="1em"><tspan x="50.6">Line</tspan><tspan x="92.7">2</tspan></tspan><tspan y="67.2" dy="1em"><tspan x="75.9">At</tspan><tspan x="101.1">5,10</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/EmptyGlyphs.golden b/lib/terminal/testdata/TestTerminalStateToSVG/EmptyGlyphs.golden
new file mode 100644
index 0000000000000..0f6dd83cde4dd
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/EmptyGlyphs.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="101" height="100" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="25.3" y="33.6" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">A</tspan><tspan x="33.7">B</tspan></tspan><tspan y="33.6" dy="1em"><tspan x="16.9">C</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/EmptyLines.golden b/lib/terminal/testdata/TestTerminalStateToSVG/EmptyLines.golden
new file mode 100644
index 0000000000000..ae81ae303adbd
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/EmptyLines.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="100" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="177.0" y="50.4" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">First</tspan><tspan x="50.6">line</tspan></tspan><tspan y="50.4" dy="1em"><tspan x="84.3">Fourth</tspan><tspan x="143.3">line</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/ExtendedBackgroundColors.golden b/lib/terminal/testdata/TestTerminalStateToSVG/ExtendedBackgroundColors.golden
new file mode 100644
index 0000000000000..894a19d443035
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/ExtendedBackgroundColors.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="0.0" y="0.0" width="92.7" height="16.8" style="fill:#ff0000"/><rect x="92.7" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Extended</tspan><tspan x="75.9">BG</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/MultilineWithColors.golden b/lib/terminal/testdata/TestTerminalStateToSVG/MultilineWithColors.golden
new file mode 100644
index 0000000000000..6d195ef2d8b32
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/MultilineWithColors.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="184" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="505.7" y="84.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="fg-1">Line</tspan><tspan x="42.1" class="fg-1">1</tspan><tspan x="59.0" class="fg-1">Red</tspan></tspan><tspan y="16.8" dy="1em"><tspan x="84.3" class="fg-2">Line</tspan><tspan x="126.4" class="fg-2">2</tspan><tspan x="143.3" class="fg-2">Green</tspan></tspan><tspan y="33.6" dy="1em"><tspan x="185.4" class="fg-3">Line</tspan><tspan x="227.6" class="fg-3">3</tspan><tspan x="244.4" class="fg-3">Yellow</tspan></tspan><tspan y="50.4" dy="1em"><tspan x="295.0" class="fg-4">Line</tspan><tspan x="337.1" class="fg-4">4</tspan><tspan x="354.0" class="fg-4">Blue</tspan></tspan><tspan y="67.2" dy="1em"><tspan x="387.7" class="fg-5">Line</tspan><tspan x="429.8" class="fg-5">5</tspan><tspan x="446.7" class="fg-5">Magenta</tspan></tspan><tspan y="84.0" dy="1em"></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/RGBColors.golden b/lib/terminal/testdata/TestTerminalStateToSVG/RGBColors.golden
new file mode 100644
index 0000000000000..893d52b0602cf
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/RGBColors.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="67.4" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" style="fill:#ff8040">RGB</tspan><tspan x="33.7" style="fill:#ff8040">Text</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/ReverseVideo.golden b/lib/terminal/testdata/TestTerminalStateToSVG/ReverseVideo.golden
new file mode 100644
index 0000000000000..6abd37f07206c
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/ReverseVideo.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="168.6" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Reversed</tspan><tspan x="75.9">text</tspan><tspan x="118.0">Normal</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/SVGStructure.golden b/lib/terminal/testdata/TestTerminalStateToSVG/SVGStructure.golden
new file mode 100644
index 0000000000000..c52c2aa15714f
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/SVGStructure.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="33.7" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">Test</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/SpacedText.golden b/lib/terminal/testdata/TestTerminalStateToSVG/SpacedText.golden
new file mode 100644
index 0000000000000..0881f59e7f737
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/SpacedText.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="168.6" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">A</tspan><tspan x="75.9">B</tspan><tspan x="160.1">C</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/SpecialCharacters.golden b/lib/terminal/testdata/TestTerminalStateToSVG/SpecialCharacters.golden
new file mode 100644
index 0000000000000..947bebc70280b
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/SpecialCharacters.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="252.8" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0">&lt;tag&gt;</tspan><tspan x="50.6">&amp;</tspan><tspan x="67.4">&quot;quotes&quot;</tspan><tspan x="143.3">&#39;apostrophes&#39;</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terminal/testdata/TestTerminalStateToSVG/TextAttributes.golden b/lib/terminal/testdata/TestTerminalStateToSVG/TextAttributes.golden
new file mode 100644
index 0000000000000..0514da008f649
--- /dev/null
+++ b/lib/terminal/testdata/TestTerminalStateToSVG/TextAttributes.golden
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="691" height="420" font-size="14" class="terminal"><rect width="100%" height="100%" class="bg-default"/><svg x="8.4" y="8.4"><g shape-rendering="crispEdges"><rect x="227.6" y="0.0" width="8.4" height="16.8" class="bg-7"/></g><text><tspan y="0.0" dy="1em"><tspan x="0.0" class="b">Bold</tspan><tspan x="42.1" class="i">Italic</tspan><tspan x="101.1" class="u">Underline</tspan><tspan x="185.4">Blink</tspan></tspan></text></svg></svg>
\ No newline at end of file
diff --git a/lib/terraformcloud/terraform.go b/lib/terraformcloud/terraform.go
deleted file mode 100644
index dca4441ff493e..0000000000000
--- a/lib/terraformcloud/terraform.go
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package terraformcloud
-
-import (
-	"github.com/zitadel/oidc/v3/pkg/oidc"
-
-	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-)
-
-// IDTokenClaims
-// See the following for the structure:
-// https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens
-type IDTokenClaims struct {
-	oidc.TokenClaims
-	// Sub provides some information about the Spacelift run that generated this
-	// token.
-	// organization:<org name>:project:<project name>:workspace:<workspace name>:run_phase:<phase>
-	Sub string `json:"sub"`
-
-	// OrganizationID is the ID of the HCP Terraform organization
-	OrganizationID string `json:"terraform_organization_id"`
-	// OrganizationName is the human-readable name of the HCP Terraform organization
-	OrganizationName string `json:"terraform_organization_name"`
-	// ProjectID is the ID of the HCP Terraform project
-	ProjectID string `json:"terraform_project_id"`
-	// ProjectName is the human-readable name of the HCP Terraform project
-	ProjectName string `json:"terraform_project_name"`
-	// WorkspaceID is the ID of the HCP Terraform project
-	WorkspaceID string `json:"terraform_workspace_id"`
-	// WorkspaceName is the human-readable name of the HCP Terraform workspace
-	WorkspaceName string `json:"terraform_workspace_name"`
-	// FullWorkspace is the full path to the workspace, e.g. `organization:<name>:project:<name>:workspace:<name>`
-	FullWorkspace string `json:"terraform_full_workspace"`
-	// RunID is the ID of the run the token was generated for.
-	RunID string `json:"terraform_run_id"`
-	// RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`
-	RunPhase string `json:"terraform_run_phase"`
-}
-
-func (c *IDTokenClaims) GetSubject() string {
-	return c.Sub
-}
-
-// JoinAttrs returns the protobuf representation of the attested identity.
-// This is used for auditing and for evaluation of WorkloadIdentity rules and
-// templating.
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsTerraformCloud {
-	return &workloadidentityv1pb.JoinAttrsTerraformCloud{
-		Sub:              c.Sub,
-		OrganizationName: c.OrganizationName,
-		ProjectName:      c.ProjectName,
-		WorkspaceName:    c.WorkspaceName,
-		FullWorkspace:    c.FullWorkspace,
-		RunId:            c.RunID,
-		RunPhase:         c.RunPhase,
-	}
-}
diff --git a/lib/tfgen/internal/reflect_legacy.go b/lib/tfgen/internal/reflect_legacy.go
new file mode 100644
index 0000000000000..35c1aa2e3f3fc
--- /dev/null
+++ b/lib/tfgen/internal/reflect_legacy.go
@@ -0,0 +1,208 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// LegacyProtoMessage is the interface satisfied by protobuf v1 and gogo-proto
+// structs.
+type LegacyProtoMessage interface{ ProtoMessage() }
+
+// ReflectLegacy uses Go's reflect package to walk the given message and
+// discover its attributes. This is suitable for legacy/gogo-proto resources.
+func ReflectLegacy(message LegacyProtoMessage) (*Message, error) {
+	msg := reflect.ValueOf(message)
+	if msg.Kind() == reflect.Pointer {
+		msg = msg.Elem()
+	}
+	return reflectMessageLegacy(msg)
+}
+
+func reflectMessageLegacy(value reflect.Value) (*Message, error) {
+	msgType := value.Type()
+
+	var msg Message
+	for i := range msgType.NumField() {
+		fieldType := msgType.Field(i)
+		fieldName := fieldType.Name
+
+		// Skip over protobuf internal fields.
+		if strings.HasPrefix(fieldName, "XXX_") {
+			continue
+		}
+
+		// Derive the field name from the JSON tag.
+		jsonTag := fieldType.Tag.Get("json")
+		if jsonTag != "" {
+			fieldName, _, _ = strings.Cut(jsonTag, ",")
+			if fieldName == "-" {
+				continue
+			}
+		}
+
+		fieldValue, err := reflectValueLegacy(value.Field(i))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if fieldValue == nil {
+			continue
+		}
+
+		if fieldType.Anonymous {
+			// Handle embedded struct fields.
+			msg.Attributes = append(msg.Attributes, fieldValue.Message().Attributes...)
+		} else {
+			msg.Attributes = append(msg.Attributes, Attribute{
+				Name:  fieldName,
+				Value: fieldValue,
+			})
+		}
+	}
+
+	return &msg, nil
+}
+
+func reflectValueLegacy(value reflect.Value) (*Value, error) {
+	if value.Kind() == reflect.Pointer {
+		// Special case: if field is not populated at all, we simply don't emit
+		// it as an attribute.
+		if value.IsNil() {
+			return nil, nil
+		}
+
+		// Dereference pointer.
+		value = value.Elem()
+	}
+
+	// Handle custom types.
+	switch v := value.Interface().(type) {
+	case []byte:
+		return &Value{
+			Type:  TypeBytes,
+			Value: v,
+		}, nil
+	case time.Time:
+		return &Value{
+			Type:  TypeTimestamp,
+			Value: v,
+		}, nil
+	case types.Duration:
+		return &Value{
+			Type:  TypeDuration,
+			Value: time.Duration(v),
+		}, nil
+	case types.BoolOption:
+		return &Value{
+			Type:  TypeBool,
+			Value: v.Value,
+		}, nil
+	}
+
+	switch value.Kind() {
+	case reflect.Struct:
+		message, err := reflectMessageLegacy(value)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &Value{
+			Type:  TypeMessage,
+			Value: message,
+		}, nil
+	case reflect.Map:
+		return reflectMapLegacy(value)
+	case reflect.Slice:
+		return reflectSliceLegacy(value)
+	case reflect.String:
+		return &Value{
+			Type:  TypeString,
+			Value: value.String(),
+		}, nil
+	case reflect.Bool:
+		return &Value{
+			Type:  TypeBool,
+			Value: value.Bool(),
+		}, nil
+	case reflect.Int32, reflect.Int64:
+		return &Value{
+			Type:  TypeInt,
+			Value: int(value.Int()),
+		}, nil
+	case reflect.Uint32, reflect.Uint64:
+		return &Value{
+			Type:  TypeInt,
+			Value: int(value.Uint()),
+		}, nil
+	case reflect.Float32, reflect.Float64:
+		return &Value{
+			Type:  TypeFloat,
+			Value: value.Float(),
+		}, nil
+	}
+
+	return nil, trace.NotImplemented("field type %s not supported", value.Kind())
+}
+
+func reflectSliceLegacy(value reflect.Value) (*Value, error) {
+	elems := make([]*Value, value.Len())
+	for i := range value.Len() {
+		val, err := reflectValueLegacy(value.Index(i))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		elems[i] = val
+	}
+
+	return &Value{
+		Type: TypeList,
+		Value: &ListValue{
+			Elems: elems,
+		},
+	}, nil
+}
+
+func reflectMapLegacy(value reflect.Value) (*Value, error) {
+	elems := make(map[any]*Value)
+	iter := value.MapRange()
+	for iter.Next() {
+		key, err := reflectValueLegacy(iter.Key())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		val, err := reflectValueLegacy(iter.Value())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		elems[key.Value] = val
+	}
+
+	return &Value{
+		Type: TypeMap,
+		Value: &MapValue{
+			Elems: elems,
+		},
+	}, nil
+}
diff --git a/lib/tfgen/internal/reflect_legacy_test.go b/lib/tfgen/internal/reflect_legacy_test.go
new file mode 100644
index 0000000000000..f508a4367fafa
--- /dev/null
+++ b/lib/tfgen/internal/reflect_legacy_test.go
@@ -0,0 +1,114 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tfgen/internal"
+)
+
+func TestReflectLegacy(t *testing.T) {
+	now := time.Now().UTC()
+
+	token, err := types.NewProvisionTokenFromSpec(
+		"my-token",
+		now,
+		types.ProvisionTokenSpecV2{
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "my-bot",
+			JoinMethod: types.JoinMethodGitHub,
+			GitHub: &types.ProvisionTokenSpecV2GitHub{
+				Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+					{
+						Repository: "gravitational/teleport",
+					},
+				},
+			},
+			SuggestedLabels: types.Labels{
+				"foo": {"bar", "baz"},
+			},
+		},
+	)
+	require.NoError(t, err)
+
+	expected := &internal.Message{
+		Attributes: []internal.Attribute{
+			attribute("kind", stringVal(types.KindToken)),
+			attribute("sub_kind", stringVal("")),
+			attribute("version", stringVal(types.V2)),
+			attribute("metadata",
+				messageVal(
+					attribute("name", stringVal("my-token")),
+					attribute("description", stringVal("")),
+					attribute("labels", mapVal(nil)),
+					attribute("expires", timestampVal(now)),
+					attribute("revision", stringVal("")),
+				),
+			),
+			attribute("spec",
+				messageVal(
+					attribute("roles", listVal(stringVal("Bot"))),
+					attribute("allow", listVal()),
+					attribute("aws_iid_ttl", durationVal(0)),
+					attribute("join_method", stringVal("github")),
+					attribute("bot_name", stringVal("my-bot")),
+					attribute("suggested_labels",
+						mapVal(
+							map[any]*internal.Value{
+								"foo": listVal(stringVal("bar"), stringVal("baz")),
+							},
+						),
+					),
+					attribute("github",
+						messageVal(
+							attribute("allow",
+								listVal(
+									messageVal(
+										attribute("sub", stringVal("")),
+										attribute("repository", stringVal("gravitational/teleport")),
+										attribute("repository_owner", stringVal("")),
+										attribute("workflow", stringVal("")),
+										attribute("environment", stringVal("")),
+										attribute("actor", stringVal("")),
+										attribute("ref", stringVal("")),
+										attribute("ref_type", stringVal("")),
+									),
+								),
+							),
+							attribute("enterprise_server_host", stringVal("")),
+							attribute("enterprise_slug", stringVal("")),
+							attribute("static_jwks", stringVal("")),
+						),
+					),
+					attribute("suggested_agent_matcher_labels", mapVal(nil)),
+				),
+			),
+		},
+	}
+
+	output, err := internal.ReflectLegacy(token.(internal.LegacyProtoMessage))
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected, output))
+}
diff --git a/lib/tfgen/internal/reflect_modern.go b/lib/tfgen/internal/reflect_modern.go
new file mode 100644
index 0000000000000..00693ef47818e
--- /dev/null
+++ b/lib/tfgen/internal/reflect_modern.go
@@ -0,0 +1,212 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import (
+	"time"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// ReflectModern uses the modern protoreflect package to walk the given message
+// and discover its attributes. This is suitable for RFD 153-style resources.
+func ReflectModern(message proto.Message) (*Message, error) {
+	return reflectMessageModern(message.ProtoReflect())
+}
+
+func reflectMessageModern(
+	value protoreflect.Message,
+) (*Message, error) {
+	desc := value.Descriptor()
+	fields := desc.Fields()
+
+	var msg Message
+	for i := range fields.Len() {
+		fieldDesc := fields.Get(i)
+		fieldValue := value.Get(fieldDesc)
+
+		value, err := reflectValueModern(fieldValue, fieldDesc)
+		if err != nil {
+			return nil, trace.Wrap(err, "reflecting field: %s", fieldDesc.Name())
+		}
+
+		msg.Attributes = append(msg.Attributes, Attribute{
+			Name:  fieldDesc.TextName(),
+			Value: value,
+		})
+	}
+
+	return &msg, nil
+}
+
+func reflectValueModern(
+	value protoreflect.Value,
+	desc protoreflect.FieldDescriptor,
+) (*Value, error) {
+	if desc.IsList() {
+		return reflectListModern(value.List(), desc)
+	}
+	if desc.IsMap() {
+		return reflectMapModern(value.Map(), desc)
+	}
+	return reflectValueInnerModern(value, desc)
+}
+
+func reflectValueInnerModern(
+	value protoreflect.Value,
+	desc protoreflect.FieldDescriptor,
+) (*Value, error) {
+	switch desc.Kind() {
+	case protoreflect.BoolKind:
+		return &Value{
+			Type:  TypeBool,
+			Value: value.Bool(),
+		}, nil
+	case protoreflect.StringKind, protoreflect.EnumKind:
+		return &Value{
+			Type:  TypeString,
+			Value: value.String(),
+		}, nil
+	case protoreflect.Int32Kind, protoreflect.Int64Kind,
+		protoreflect.Sint32Kind, protoreflect.Sint64Kind,
+		protoreflect.Sfixed32Kind, protoreflect.Sfixed64Kind:
+		return &Value{
+			Type:  TypeInt,
+			Value: int(value.Int()),
+		}, nil
+	case protoreflect.Uint32Kind, protoreflect.Uint64Kind,
+		protoreflect.Fixed32Kind, protoreflect.Fixed64Kind:
+		return &Value{
+			Type:  TypeInt,
+			Value: int(value.Uint()),
+		}, nil
+	case protoreflect.FloatKind, protoreflect.DoubleKind:
+		return &Value{
+			Type:  TypeFloat,
+			Value: value.Float(),
+		}, nil
+	case protoreflect.BytesKind:
+		return &Value{
+			Type:  TypeBytes,
+			Value: value.Bytes(),
+		}, nil
+	case protoreflect.MessageKind:
+		switch desc.Message().FullName() {
+		case googleProtobufTimestamp:
+			return reflectTimestampModern(value.Message())
+		case googleProtobufDuration:
+			return reflectDurationModern(value.Message())
+		}
+
+		message, err := reflectMessageModern(value.Message())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &Value{
+			Type:  TypeMessage,
+			Value: message,
+		}, nil
+	}
+	return nil, trace.NotImplemented("unsupported field kind: %s", desc.Kind())
+}
+
+func reflectListModern(
+	value protoreflect.List,
+	desc protoreflect.FieldDescriptor,
+) (*Value, error) {
+	elems := make([]*Value, value.Len())
+	for i := range value.Len() {
+		val, err := reflectValueInnerModern(value.Get(i), desc)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		elems[i] = val
+	}
+
+	return &Value{
+		Type: TypeList,
+		Value: &ListValue{
+			Elems: elems,
+		},
+	}, nil
+}
+
+func reflectMapModern(
+	value protoreflect.Map,
+	desc protoreflect.FieldDescriptor,
+) (*Value, error) {
+	elems := make(map[any]*Value, value.Len())
+
+	var err error
+	value.Range(func(key protoreflect.MapKey, value protoreflect.Value) bool {
+		var v *Value
+		if v, err = reflectValueModern(value, desc.MapValue()); err != nil {
+			return false
+		}
+		elems[key.Interface()] = v
+		return true
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &Value{
+		Type: TypeMap,
+		Value: &MapValue{
+			Elems: elems,
+		},
+	}, nil
+}
+
+func reflectTimestampModern(value protoreflect.Message) (*Value, error) {
+	ts, ok := value.Interface().(*timestamppb.Timestamp)
+	if !ok {
+		return nil, trace.BadParameter("expected timestamp, got: %T", value)
+	}
+
+	t := ts.AsTime()
+	if !ts.IsValid() {
+		t = time.Time{}
+	}
+
+	return &Value{
+		Type:  TypeTimestamp,
+		Value: t,
+	}, nil
+}
+
+func reflectDurationModern(value protoreflect.Message) (*Value, error) {
+	dur, ok := value.Interface().(*durationpb.Duration)
+	if !ok {
+		return nil, trace.BadParameter("expected duration, got: %T", value)
+	}
+	return &Value{
+		Type:  TypeDuration,
+		Value: dur.AsDuration(),
+	}, nil
+}
+
+var (
+	googleProtobufTimestamp = protoreflect.FullName("google.protobuf.Timestamp")
+	googleProtobufDuration  = protoreflect.FullName("google.protobuf.Duration")
+)
diff --git a/lib/tfgen/internal/reflect_modern_test.go b/lib/tfgen/internal/reflect_modern_test.go
new file mode 100644
index 0000000000000..d7355357fe4ae
--- /dev/null
+++ b/lib/tfgen/internal/reflect_modern_test.go
@@ -0,0 +1,112 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tfgen/internal"
+)
+
+func TestReflectModern(t *testing.T) {
+	now := time.Now().UTC()
+
+	input := &machineidv1.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name:        "my-bot",
+			Description: "hello",
+			Expires:     timestamppb.New(now),
+			Labels:      map[string]string{"foo": "bar"},
+		},
+		Spec: &machineidv1.BotSpec{
+			Roles: []string{"foo"},
+			Traits: []*machineidv1.Trait{
+				{
+					Name:   "logins",
+					Values: []string{"root", "ubuntu"},
+				},
+			},
+			MaxSessionTtl: durationpb.New(1 * time.Hour),
+		},
+	}
+
+	expected := &internal.Message{
+		Attributes: []internal.Attribute{
+			attribute("kind", stringVal("bot")),
+			attribute("sub_kind", stringVal("")),
+			attribute("version", stringVal(types.V1)),
+			attribute("metadata",
+				messageVal(
+					attribute("name", stringVal("my-bot")),
+					attribute("namespace", stringVal("")),
+					attribute("description", stringVal("hello")),
+					attribute("labels",
+						mapVal(
+							map[any]*internal.Value{
+								"foo": stringVal("bar"),
+							},
+						),
+					),
+					attribute("expires", timestampVal(now)),
+					attribute("revision", stringVal("")),
+				),
+			),
+			attribute("spec",
+				messageVal(
+					attribute("roles", listVal(stringVal("foo"))),
+					attribute("traits",
+						listVal(
+							messageVal(
+								attribute("name", stringVal("logins")),
+								attribute("values",
+									listVal(
+										stringVal("root"),
+										stringVal("ubuntu"),
+									),
+								),
+							),
+						),
+					),
+					attribute("max_session_ttl", durationVal(1*time.Hour)),
+				),
+			),
+			attribute("status",
+				messageVal(
+					attribute("user_name", stringVal("")),
+					attribute("role_name", stringVal("")),
+				),
+			),
+		},
+	}
+
+	output, err := internal.ReflectModern(input)
+	require.NoError(t, err)
+	require.Empty(t, cmp.Diff(expected, output))
+}
diff --git a/lib/tfgen/internal/types.go b/lib/tfgen/internal/types.go
new file mode 100644
index 0000000000000..a35a08f0dc39b
--- /dev/null
+++ b/lib/tfgen/internal/types.go
@@ -0,0 +1,209 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal
+
+import "time"
+
+// Type is our internal representation of a field value data type.
+type Type uint16
+
+const (
+	TypeUnknown Type = iota
+	TypeMessage
+	TypeList
+	TypeMap
+	TypeBool
+	TypeString
+	TypeInt
+	TypeFloat
+	TypeBytes
+	TypeTimestamp
+	TypeDuration
+)
+
+// String implements fmt.Stringer.
+func (t Type) String() string {
+	switch t {
+	case TypeMessage:
+		return "message"
+	case TypeList:
+		return "list"
+	case TypeMap:
+		return "map"
+	case TypeBool:
+		return "bool"
+	case TypeString:
+		return "string"
+	case TypeInt:
+		return "int"
+	case TypeFloat:
+		return "float"
+	case TypeBytes:
+		return "bytes"
+	case TypeTimestamp:
+		return "timestamp"
+	case TypeDuration:
+		return "duration"
+	default:
+		return "<unknown>"
+	}
+}
+
+// Message represents a protobuf message/struct.
+type Message struct {
+	// Attributes of the message.
+	Attributes []Attribute
+}
+
+// Attribute of a message.
+type Attribute struct {
+	// Name of the attribute.
+	Name string
+
+	// Value of the attribute.
+	Value *Value
+}
+
+// Value is a tuple of data type and value.
+type Value struct {
+	// Type of value.
+	Type Type
+
+	// Value itself (check Type before casting).
+	Value any
+}
+
+// ListValue represents a list/slice.
+type ListValue struct {
+	// Elems contains the list values.
+	Elems []*Value
+}
+
+// MapValue represents a map.
+type MapValue struct {
+	// Elems contains the map values.
+	Elems map[any]*Value
+}
+
+// List returns the value as a ListValue, or an empty ListValue if it isn't one.
+func (v *Value) List() *ListValue {
+	if v.Type != TypeList {
+		return &ListValue{}
+	}
+	if l, ok := v.Value.(*ListValue); ok {
+		return l
+	}
+	return &ListValue{}
+}
+
+// Map returns the value as a MapValue, or an empty MapValue if it isn't one.
+func (v *Value) Map() *MapValue {
+	if v.Type != TypeMap {
+		return &MapValue{}
+	}
+	if m, ok := v.Value.(*MapValue); ok {
+		return m
+	}
+	return &MapValue{}
+}
+
+// Message returns the value as a Message, or an empty Message if it isn't one.
+func (v *Value) Message() *Message {
+	if v.Type != TypeMessage {
+		return &Message{}
+	}
+	if m, ok := v.Value.(*Message); ok {
+		return m
+	}
+	return &Message{}
+}
+
+// Bool returns the value as a boolean, or false if it isn't one.
+func (v *Value) Bool() bool {
+	if v.Type != TypeBool {
+		return false
+	}
+	b, _ := v.Value.(bool)
+	return b
+}
+
+// Int returns the value as a integer, or 0 if it isn't one.
+func (v *Value) Int() int {
+	if v.Type != TypeInt {
+		return 0
+	}
+	i, _ := v.Value.(int)
+	return i
+}
+
+// Float returns the value as a float64, or 0 if it isn't one.
+func (v *Value) Float() float64 {
+	if v.Type != TypeFloat {
+		return 0
+	}
+	f, _ := v.Value.(float64)
+	return f
+}
+
+// String returns the value as a string, or "" if it isn't one.
+func (v *Value) String() string {
+	if v.Type != TypeString {
+		return ""
+	}
+	s, _ := v.Value.(string)
+	return s
+}
+
+// Bytes returns the value as a []byte, or nil if it isn't one.
+func (v *Value) Bytes() []byte {
+	if v.Type != TypeBytes {
+		return nil
+	}
+	b, _ := v.Value.([]byte)
+	return b
+}
+
+// Timestamp returns the value as a time.Time, or the zero value if it isn't one.
+func (v *Value) Timestamp() time.Time {
+	if v.Type != TypeTimestamp {
+		return time.Time{}
+	}
+	t, _ := v.Value.(time.Time)
+	return t
+}
+
+// Duration returns the value as a time.Duration, or the zero value if it isn't one.
+func (v *Value) Duration() time.Duration {
+	if v.Type != TypeDuration {
+		return 0
+	}
+	d, _ := v.Value.(time.Duration)
+	return d
+}
+
+// AttributeNamed returns a message attribute with the given name, or nil if no
+// such attribute exists.
+func (m *Message) AttributeNamed(name string) *Attribute {
+	for _, a := range m.Attributes {
+		if a.Name == name {
+			return &a
+		}
+	}
+	return nil
+}
diff --git a/lib/tfgen/internal/types_test.go b/lib/tfgen/internal/types_test.go
new file mode 100644
index 0000000000000..0ab0bcc9fff0a
--- /dev/null
+++ b/lib/tfgen/internal/types_test.go
@@ -0,0 +1,86 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package internal_test
+
+import (
+	"time"
+
+	"github.com/gravitational/teleport/lib/tfgen/internal"
+)
+
+func attribute(name string, value *internal.Value) internal.Attribute {
+	return internal.Attribute{
+		Name:  name,
+		Value: value,
+	}
+}
+
+func messageVal(attributes ...internal.Attribute) *internal.Value {
+	return &internal.Value{
+		Type: internal.TypeMessage,
+		Value: &internal.Message{
+			Attributes: attributes,
+		},
+	}
+}
+
+func stringVal(s string) *internal.Value {
+	return &internal.Value{
+		Type:  internal.TypeString,
+		Value: s,
+	}
+}
+
+func timestampVal(t time.Time) *internal.Value {
+	return &internal.Value{
+		Type:  internal.TypeTimestamp,
+		Value: t,
+	}
+}
+
+func durationVal(t time.Duration) *internal.Value {
+	return &internal.Value{
+		Type:  internal.TypeDuration,
+		Value: t,
+	}
+}
+
+func mapVal(elems map[any]*internal.Value) *internal.Value {
+	if elems == nil {
+		elems = make(map[any]*internal.Value)
+	}
+	return &internal.Value{
+		Type: internal.TypeMap,
+		Value: &internal.MapValue{
+			Elems: elems,
+		},
+	}
+}
+
+func listVal(elems ...*internal.Value) *internal.Value {
+	if elems == nil {
+		elems = []*internal.Value{}
+	}
+	return &internal.Value{
+		Type: internal.TypeList,
+		Value: &internal.ListValue{
+			Elems: elems,
+		},
+	}
+}
diff --git a/lib/tfgen/options.go b/lib/tfgen/options.go
new file mode 100644
index 0000000000000..d9ac59ba7a9ce
--- /dev/null
+++ b/lib/tfgen/options.go
@@ -0,0 +1,79 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tfgen
+
+import "github.com/gravitational/teleport/lib/tfgen/internal"
+
+// GenerateOpt is an optional argument that can be passed to customize the
+// behavior of Generate.
+type GenerateOpt func(*generateOpts)
+
+// WithFieldTransform applies a transformation to the given field. It is used
+// when our Terraform representation of the field diverges from the protobuf
+// structure (see: transform.BotTraits for an example).
+//
+// name is the dot-syntax path to the field (e.g. `spec.traits`).
+func WithFieldTransform(name string, transform Transform) GenerateOpt {
+	return func(o *generateOpts) { o.fieldTransforms[name] = transform }
+}
+
+// Transform that can be used to change the Terraform representation of a field.
+type Transform func(*internal.Value) (*internal.Value, error)
+
+// WithFieldComment adds a comment above the given field.
+//
+// If the field is unpopulated, its zero value will be emitted so that the
+// comment is preserved.
+//
+// name is the dot-syntax path to the field (e.g. `spec.traits`).
+//
+// Note: currently only single-line comments on fields within the spec and
+// metadata objects are supported. You cannot add comments to top-level fields
+// such as version, sub_kind, or the metadata and spec fields themselves. You
+// also cannot add comments to objects within a list or map.
+func WithFieldComment(name, comment string) GenerateOpt {
+	return func(o *generateOpts) { o.fieldComments[name] = comment }
+}
+
+// WithResourceType overrides the Terraform resource type. By default, the type
+// will be "teleport_<kind>".
+func WithResourceType(typeName string) GenerateOpt {
+	return func(o *generateOpts) { o.resourceType = typeName }
+}
+
+// WithResourceName overrides the Terraform resource name. By default, the name
+// will be taken from the resource's metadata.
+func WithResourceName(name string) GenerateOpt {
+	return func(o *generateOpts) { o.resourceName = name }
+}
+
+type generateOpts struct {
+	resourceType string
+	resourceName string
+
+	fieldTransforms map[string]Transform
+	fieldComments   map[string]string
+}
+
+func newGenerateOpts() *generateOpts {
+	return &generateOpts{
+		fieldTransforms: make(map[string]Transform),
+		fieldComments:   make(map[string]string),
+	}
+}
diff --git a/lib/tfgen/testdata/TestGenerate_AccessMonitoringRule.golden b/lib/tfgen/testdata/TestGenerate_AccessMonitoringRule.golden
new file mode 100644
index 0000000000000..e7ad0687e1a3b
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_AccessMonitoringRule.golden
@@ -0,0 +1,37 @@
+resource "teleport_access_monitoring_rule" "monitoring-rule" {
+  version = "v1"
+
+  metadata = {
+    name = "monitoring-rule"
+  }
+
+  spec = {
+    subjects  = ["access_request"]
+    condition = "access_request.spec.roles.contains(\"your_role_name\")"
+    notification = {
+      name       = "slack"
+      recipients = ["#your-slack-channel"]
+    }
+    automatic_review = {
+      integration = "builtin"
+      decision    = "APPROVED"
+    }
+    desired_state = "reviewed"
+    schedules = {
+      default = {
+        time = {
+          shifts = [{
+            end     = "23:59"
+            start   = "00:00"
+            weekday = "Monday"
+            }, {
+            end     = "23:59"
+            start   = "00:00"
+            weekday = "Tuesday"
+          }]
+          timezone = "America/Los_Angeles"
+        }
+      }
+    }
+  }
+}
diff --git a/lib/tfgen/testdata/TestGenerate_Bot.golden b/lib/tfgen/testdata/TestGenerate_Bot.golden
new file mode 100644
index 0000000000000..be1b83608484d
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_Bot.golden
@@ -0,0 +1,14 @@
+resource "teleport_bot" "gha-gravitational-teleport" {
+  version = "v1"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles = ["gravitational-teleport-kube-access"]
+    traits = {
+      kubernetes_groups = ["system:masters", "viewers"]
+    }
+  }
+}
diff --git a/lib/tfgen/testdata/TestGenerate_OIDCConnector.golden b/lib/tfgen/testdata/TestGenerate_OIDCConnector.golden
new file mode 100644
index 0000000000000..2179cab70772b
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_OIDCConnector.golden
@@ -0,0 +1,19 @@
+resource "teleport_oidc" "connector" {
+  version = "v3"
+
+  metadata = {
+    name = "connector"
+  }
+
+  spec = {
+    client_id     = "some-client"
+    client_secret = "some-secret"
+    claims_to_roles = [{
+      claim = "foo"
+      roles = ["baz"]
+      value = "bar"
+    }]
+    redirect_url = ["https://some-url"]
+    max_age      = "1s"
+  }
+}
diff --git a/lib/tfgen/testdata/TestGenerate_Role.golden b/lib/tfgen/testdata/TestGenerate_Role.golden
new file mode 100644
index 0000000000000..8e1245eb33211
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_Role.golden
@@ -0,0 +1,24 @@
+resource "teleport_role" "gravitational-teleport-kube-access" {
+  version = "v8"
+
+  metadata = {
+    name = "gravitational-teleport-kube-access"
+    # Remember to add some labels!
+    labels = {}
+  }
+
+  spec = {
+    allow = {
+      node_labels = {
+        bar  = ["baz"]
+        team = ["a", "b", "c"]
+      }
+      kubernetes_groups = ["{{internal.kubernetes_groups}}"]
+      kubernetes_users  = ["{{internal.kubernetes_users}}"]
+      kubernetes_labels = {
+        env    = ["staging", "dev"]
+        region = ["eu-west-1"]
+      }
+    }
+  }
+}
diff --git a/lib/tfgen/testdata/TestGenerate_Token.golden b/lib/tfgen/testdata/TestGenerate_Token.golden
new file mode 100644
index 0000000000000..b53d005ea6aaf
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_Token.golden
@@ -0,0 +1,19 @@
+resource "teleport_provision_token" "github-gravitational-teleport" {
+  version = "v2"
+
+  metadata = {
+    name = "github-gravitational-teleport"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    join_method = "github"
+    bot_name    = "gha-gravitational-teleport"
+    github = {
+      allow = [{
+        repository       = "graviational/teleport"
+        repository_owner = "gravitational"
+      }]
+    }
+  }
+}
diff --git a/lib/tfgen/testdata/TestGenerate_User.golden b/lib/tfgen/testdata/TestGenerate_User.golden
new file mode 100644
index 0000000000000..b8650ca391f26
--- /dev/null
+++ b/lib/tfgen/testdata/TestGenerate_User.golden
@@ -0,0 +1,13 @@
+resource "teleport_user" "bob" {
+  version = "v2"
+
+  metadata = {
+    name = "bob"
+  }
+
+  spec = {
+    traits = {
+      kubernetes_groups = ["viewers"]
+    }
+  }
+}
diff --git a/lib/tfgen/tfgen.go b/lib/tfgen/tfgen.go
new file mode 100644
index 0000000000000..71f7dd750676f
--- /dev/null
+++ b/lib/tfgen/tfgen.go
@@ -0,0 +1,400 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tfgen
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/hcl/v2/hclsyntax"
+	"github.com/hashicorp/hcl/v2/hclwrite"
+	"github.com/zclconf/go-cty/cty"
+	"google.golang.org/protobuf/proto"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tfgen/internal"
+)
+
+// Resource for which Terraform configuration can be generated. It's a subset of
+// the common methods between types.Resource and types.Resource153.
+type Resource interface {
+	GetKind() string
+	GetSubKind() string
+	GetVersion() string
+}
+
+// Generate Terraform configuration for the given resource protobuf message, so
+// that it can be used in IaC-first wizards. You can pass opts to customize the
+// output (e.g to add field comments, or change the Terraform resource type).
+//
+// This method broadly tries to match the behavior of our protoc-gen-terraform
+// plugin.
+//
+// If the resource uses the modern protobuf package (google.golang.org/protobuf)
+// we will use the protoreflect method to discover its fields. Field names will
+// be taken from the field's TextName.
+//
+// If the resource uses the legacy protobuf package and github.com/gogo/protobuf
+// extensions, we will use Go's reflect package to discover its fields. Field
+// names will be taken from the struct member's JSON tag.
+//
+// Note: This method may be incomplete! Especially for legacy structs that use
+// custom field types. If you find a resource for which the generated Terraform
+// isn't valid, please reach out to @boxofrad.
+func Generate(resource Resource, opts ...GenerateOpt) ([]byte, error) {
+	o := newGenerateOpts()
+	for _, fn := range opts {
+		fn(o)
+	}
+	file := hclwrite.NewEmptyFile()
+	if err := generateResource(resource, file, o); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return hclwrite.Format(file.Bytes()), nil
+}
+
+func generateResource(
+	resource Resource,
+	file *hclwrite.File,
+	opts *generateOpts,
+) error {
+	resourceType := opts.resourceType
+	if resourceType == "" {
+		resourceType = fmt.Sprintf("teleport_%s", resource.GetKind())
+	}
+
+	resourceName := opts.resourceName
+	if resourceName == "" {
+		if v, ok := resource.(interface {
+			GetMetadata() *headerv1.Metadata
+		}); ok {
+			resourceName = v.GetMetadata().GetName()
+		}
+		if v, ok := resource.(interface {
+			GetMetadata() types.Metadata
+		}); ok {
+			resourceName = v.GetMetadata().Name
+		}
+	}
+
+	resourceBlock := file.Body().AppendNewBlock(
+		"resource",
+		[]string{resourceType, resourceName},
+	)
+
+	// Top level fields: version and sub_kind.
+	if v := resource.GetVersion(); v != "" {
+		resourceBlock.Body().SetAttributeValue("version", cty.StringVal(v))
+	}
+	if v := resource.GetSubKind(); v != "" {
+		resourceBlock.Body().SetAttributeValue("sub_kind", cty.StringVal(v))
+	}
+	resourceBlock.Body().AppendNewline()
+
+	msg, err := reflectMessage(resource)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Metadata object.
+	if v := msg.AttributeNamed("metadata"); v != nil {
+		tokens := messageToTokens(fieldPath{"metadata"}, v.Value, opts)
+		if tokens != nil {
+			resourceBlock.Body().SetAttributeRaw("metadata", tokens)
+		}
+	}
+	resourceBlock.Body().AppendNewline()
+
+	// Spec object.
+	if v := msg.AttributeNamed("spec"); v != nil {
+		tokens := messageToTokens(fieldPath{"spec"}, v.Value, opts)
+		if tokens != nil {
+			resourceBlock.Body().SetAttributeRaw("spec", tokens)
+		}
+	}
+	return nil
+}
+
+func reflectMessage(msg any) (*internal.Message, error) {
+	switch m := msg.(type) {
+	case proto.Message:
+		return internal.ReflectModern(m)
+	case internal.LegacyProtoMessage:
+		return internal.ReflectLegacy(m)
+	default:
+		return nil, trace.BadParameter("resource must be a protobuf message, was a %T", msg)
+	}
+}
+
+// messageToTokens converts a message/struct to a collection of HCL tokens.
+//
+// We operate directly on tokens here, rather than converting the message to a
+// cty object and allowing hclwrite to generate the tokens, because we want to
+// be able to inject comments above fields.
+func messageToTokens(
+	path fieldPath,
+	val *internal.Value,
+	opts *generateOpts,
+) hclwrite.Tokens {
+	var tokens hclwrite.Tokens
+	for _, attr := range val.Message().Attributes {
+		fieldPath := append(path, attr.Name)
+		comment, hasComment := opts.fieldComments[fieldPath.String()]
+
+		valueTokens := valueToTokens(
+			fieldPath,
+			attr.Value,
+			opts,
+			hasComment, /* emitZeroValue - render the zero value if there's comment on the field */
+		)
+
+		if valueTokens == nil {
+			continue
+		}
+
+		if hasComment {
+			tokens = append(tokens, commentToTokens(comment)...)
+		}
+		tokens = append(tokens, assignmentToTokens(attr.Name, valueTokens)...)
+		tokens = append(tokens, newlineToken())
+	}
+
+	if len(tokens) == 0 {
+		return nil
+	}
+
+	return braceTokens(tokens)
+}
+
+// commentToTokens converts a comment string to a set of HCL tokens.
+func commentToTokens(comment string) hclwrite.Tokens {
+	return hclwrite.Tokens{
+		&hclwrite.Token{
+			Type:  hclsyntax.TokenComment,
+			Bytes: append([]byte(`# `), []byte(comment)...),
+		},
+		newlineToken(),
+	}
+}
+
+// newlineToken represent a single newline character.
+func newlineToken() *hclwrite.Token {
+	return &hclwrite.Token{
+		Type:  hclsyntax.TokenNewline,
+		Bytes: []byte("\n"),
+	}
+}
+
+// assignmentToTokens generates tokens for a field assignment statement.
+func assignmentToTokens(name string, valueTokens hclwrite.Tokens) hclwrite.Tokens {
+	var tokens hclwrite.Tokens
+	tokens = append(tokens, hclwrite.TokensForIdentifier(name)...)
+	tokens = append(tokens, &hclwrite.Token{
+		Type:  hclsyntax.TokenEqual,
+		Bytes: []byte(` = `),
+	})
+	return append(tokens, valueTokens...)
+}
+
+// braceTokens wraps the given set of tokens in a set of curly braces (e.g. for
+// an object body).
+func braceTokens(inner hclwrite.Tokens) hclwrite.Tokens {
+	return append(
+		hclwrite.Tokens{
+			&hclwrite.Token{
+				Type:  hclsyntax.TokenOBrace,
+				Bytes: []byte(`{`),
+			},
+			newlineToken(),
+		},
+		append(
+			inner,
+			&hclwrite.Token{
+				Type:  hclsyntax.TokenCBrace,
+				Bytes: []byte("}"),
+			},
+		)...,
+	)
+}
+
+// valueToTokens converts the given value to a set of HCL tokens.
+//
+// If the value is a message, we will call messageToTokens so we can inject
+// comments above the message fields.
+func valueToTokens(
+	path fieldPath,
+	val *internal.Value,
+	opts *generateOpts,
+	emitZeroVal bool,
+) hclwrite.Tokens {
+	if val.Type == internal.TypeMessage {
+		return messageToTokens(path, val, opts)
+	}
+
+	ctyVal := valueToCty(path, val, opts, emitZeroVal)
+	if ctyVal == cty.NilVal {
+		return nil
+	}
+	return hclwrite.TokensForValue(ctyVal)
+}
+
+// valueToCty converts a given value to cty so that we can generate HCL tokens
+// from it.
+func valueToCty(
+	path fieldPath,
+	val *internal.Value,
+	opts *generateOpts,
+	emitZeroVal bool,
+) cty.Value {
+	// If there's a transformation on this field, apply it.
+	if transform, ok := opts.fieldTransforms[path.String()]; ok {
+		var err error
+		if val, err = transform(val); err != nil {
+			return cty.StringVal(fmt.Sprintf("<transformation failed, error: %v>", err))
+		}
+	}
+
+	switch val.Type {
+	case internal.TypeBool:
+		boolVal := val.Bool()
+		if !boolVal && !emitZeroVal {
+			return cty.NilVal
+		}
+		return cty.BoolVal(boolVal)
+
+	case internal.TypeString:
+		stringVal := val.String()
+		if stringVal == "" && !emitZeroVal {
+			return cty.NilVal
+		}
+		return cty.StringVal(stringVal)
+
+	case internal.TypeBytes:
+		bytesVal := val.Bytes()
+		if bytesVal == nil && !emitZeroVal {
+			return cty.NilVal
+		}
+		// protoc-gen-terraform naively converts bytes into strings without
+		// validating the contents is UTF-8, so we'll copy that behavior for
+		// compatibility - but really we should base64 encode it instead.
+		return cty.StringVal(string(bytesVal))
+
+	case internal.TypeInt:
+		intVal := val.Int()
+		if intVal == 0 && !emitZeroVal {
+			return cty.NilVal
+		}
+		// Note: we may truncate large uint64 values, but we don't use them!
+		return cty.NumberIntVal(int64(intVal))
+
+	case internal.TypeFloat:
+		floatVal := val.Float()
+		if floatVal == 0 && !emitZeroVal {
+			return cty.NilVal
+		}
+		return cty.NumberFloatVal(floatVal)
+
+	case internal.TypeList:
+		listVal := val.List()
+		if len(listVal.Elems) == 0 {
+			if emitZeroVal {
+				return cty.ListValEmpty(cty.NilType)
+			}
+			return cty.NilVal
+		}
+		elems := make([]cty.Value, 0, len(listVal.Elems))
+		for idx, elem := range listVal.Elems {
+			value := valueToCty(
+				append(path, fmt.Sprintf("[%d]", idx)),
+				elem,
+				opts,
+				false, /* emitZeroVal */
+			)
+			if value == cty.NilVal {
+				continue
+			}
+			elems = append(elems, value)
+		}
+		return cty.ListVal(elems)
+
+	case internal.TypeMap:
+		mapVal := val.Map()
+		if len(mapVal.Elems) == 0 {
+			if emitZeroVal {
+				return cty.MapValEmpty(cty.NilType)
+			}
+			return cty.NilVal
+		}
+		elems := make(map[string]cty.Value, len(mapVal.Elems))
+		for k, v := range mapVal.Elems {
+			key := fmt.Sprintf("%v", k)
+			value := valueToCty(
+				append(path, fmt.Sprintf("[%q]", key)),
+				v,
+				opts,
+				false, /* emitZeroVal */
+			)
+			if value == cty.NilVal {
+				continue
+			}
+			elems[key] = value
+		}
+		return cty.MapVal(elems)
+
+	case internal.TypeDuration:
+		durVal := val.Duration()
+		if durVal == 0 && !emitZeroVal {
+			return cty.NilVal
+		}
+		return cty.StringVal(durVal.String())
+
+	case internal.TypeTimestamp:
+		tsVal := val.Timestamp()
+		if tsVal.IsZero() && !emitZeroVal {
+			return cty.NilVal
+		}
+		return cty.StringVal(tsVal.Format(time.RFC3339))
+
+	case internal.TypeMessage:
+		// Note: this branch will only be reached for messages inside a list or
+		// map, other messages will be handled by messageToTokens.
+		messageVal := val.Message()
+		attrs := make(map[string]cty.Value)
+		for _, attr := range messageVal.Attributes {
+			if val := valueToCty(
+				append(path, attr.Name),
+				attr.Value,
+				opts,
+				false, /* emitZeroVal */
+			); val != cty.NilVal {
+				attrs[attr.Name] = val
+			}
+		}
+		return cty.ObjectVal(attrs)
+	default:
+		return cty.StringVal(fmt.Sprintf("<unknown value type: %s>", val.Type))
+	}
+}
+
+type fieldPath []string
+
+func (p fieldPath) String() string { return strings.Join(p, ".") }
diff --git a/lib/tfgen/tfgen_test.go b/lib/tfgen/tfgen_test.go
new file mode 100644
index 0000000000000..ee03b4bd0cf42
--- /dev/null
+++ b/lib/tfgen/tfgen_test.go
@@ -0,0 +1,209 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package tfgen_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/types/wrappers"
+	"github.com/gravitational/teleport/lib/tfgen"
+	"github.com/gravitational/teleport/lib/tfgen/transform"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestGenerate_Role(t *testing.T) {
+	t.Parallel()
+
+	goldenTest(t, &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V8,
+		Metadata: types.Metadata{
+			Name: "gravitational-teleport-kube-access",
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				KubernetesLabels: types.Labels{
+					"env":    []string{"staging", "dev"},
+					"region": []string{"eu-west-1"},
+				},
+				NodeLabels: types.Labels{
+					"foo":  []string{},
+					"bar":  []string{"baz"},
+					"team": []string{"a", "b", "c"},
+				},
+				KubeGroups: []string{"{{internal.kubernetes_groups}}"},
+				KubeUsers:  []string{"{{internal.kubernetes_users}}"},
+			},
+		},
+	},
+		tfgen.WithFieldComment("metadata.labels", "Remember to add some labels!"))
+}
+
+func TestGenerate_Bot(t *testing.T) {
+	t.Parallel()
+
+	goldenTest(t,
+		&machineidv1.Bot{
+			Kind:    types.KindBot,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "gha-gravitational-teleport",
+			},
+			Spec: &machineidv1.BotSpec{
+				Roles: []string{"gravitational-teleport-kube-access"},
+				Traits: []*machineidv1.Trait{
+					{
+						Name:   "kubernetes_groups",
+						Values: []string{"system:masters", "viewers"},
+					},
+				},
+			},
+		},
+		tfgen.WithFieldTransform("spec.traits", transform.BotTraits),
+	)
+}
+
+func TestGenerate_Token(t *testing.T) {
+	t.Parallel()
+
+	goldenTest(t,
+		&types.ProvisionTokenV2{
+			Kind:    types.KindToken,
+			Version: types.V2,
+			Metadata: types.Metadata{
+				Name: "github-gravitational-teleport",
+			},
+			Spec: types.ProvisionTokenSpecV2{
+				BotName:    "gha-gravitational-teleport",
+				Roles:      []types.SystemRole{types.RoleBot},
+				JoinMethod: types.JoinMethodGitHub,
+				GitHub: &types.ProvisionTokenSpecV2GitHub{
+					Allow: []*types.ProvisionTokenSpecV2GitHub_Rule{
+						{
+							Repository:      "graviational/teleport",
+							RepositoryOwner: "gravitational",
+						},
+					},
+				},
+			},
+		},
+		tfgen.WithResourceType("teleport_provision_token"),
+	)
+}
+
+func TestGenerate_AccessMonitoringRule(t *testing.T) {
+	t.Parallel()
+
+	goldenTest(t,
+		&accessmonitoringrulesv1.AccessMonitoringRule{
+			Kind:    types.KindAccessMonitoringRule,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: "monitoring-rule",
+			},
+			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				Subjects:     []string{"access_request"},
+				Condition:    `access_request.spec.roles.contains("your_role_name")`,
+				DesiredState: types.AccessMonitoringRuleStateReviewed,
+				Notification: &accessmonitoringrulesv1.Notification{
+					Name:       "slack",
+					Recipients: []string{"#your-slack-channel"},
+				},
+				AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					Integration: "builtin",
+					Decision:    "APPROVED",
+				},
+				Schedules: map[string]*accessmonitoringrulesv1.Schedule{
+					"default": {
+						Time: &accessmonitoringrulesv1.TimeSchedule{
+							Timezone: "America/Los_Angeles",
+							Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
+								{
+									Weekday: "Monday",
+									Start:   "00:00",
+									End:     "23:59",
+								},
+								{
+									Weekday: "Tuesday",
+									Start:   "00:00",
+									End:     "23:59",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	)
+}
+
+func TestGenerate_User(t *testing.T) {
+	t.Parallel()
+
+	user, err := types.NewUser("bob")
+	require.NoError(t, err)
+
+	user.SetTraits(map[string][]string{
+		"kubernetes_groups": []string{"viewers"},
+	})
+
+	goldenTest(t, user)
+}
+
+func TestGenerate_OIDCConnector(t *testing.T) {
+	t.Parallel()
+
+	connector, err := types.NewOIDCConnector("connector", types.OIDCConnectorSpecV3{
+		ClientID:     "some-client",
+		ClientSecret: "some-secret",
+		ClaimsToRoles: []types.ClaimMapping{
+			{Claim: "foo", Value: "bar", Roles: []string{"baz"}},
+		},
+		RedirectURLs: wrappers.Strings{"https://some-url"},
+		MaxAge:       &types.MaxAge{Value: types.NewDuration(1 * time.Second)},
+	})
+	require.NoError(t, err)
+
+	goldenTest(t, connector)
+}
+
+func goldenTest(t *testing.T, resource tfgen.Resource, opts ...tfgen.GenerateOpt) {
+	t.Helper()
+
+	tf, err := tfgen.Generate(resource, opts...)
+	require.NoError(t, err)
+
+	if golden.ShouldSet() {
+		golden.Set(t, tf)
+	}
+	require.Empty(t,
+		cmp.Diff(
+			string(golden.Get(t)),
+			string(tf),
+		),
+	)
+}
diff --git a/lib/tfgen/transform/machineid.go b/lib/tfgen/transform/machineid.go
new file mode 100644
index 0000000000000..03ba1c29a7263
--- /dev/null
+++ b/lib/tfgen/transform/machineid.go
@@ -0,0 +1,59 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package transform
+
+import "github.com/gravitational/teleport/lib/tfgen/internal"
+
+// BotTraits transforms the standard representation of a slice of
+// machineidv1.Trait values into the map[string][]string form we
+// expect in the Terraform provider.
+//
+// Before:
+//
+//	[{name = "logins", values = ["root", "ubuntu"]}]
+//
+// After:
+//
+//	{logins = ["root", "ubuntu"]}
+//
+// Example usage:
+//
+//	tfgen.Generate(bot, tfgen.WithFieldTransform("spec.traits", transform.BotTraits))
+func BotTraits(value *internal.Value) (*internal.Value, error) {
+	traitsMap := make(map[any]*internal.Value)
+
+	for _, elem := range value.List().Elems {
+		message := elem.Message()
+
+		name := message.AttributeNamed("name").Value.String()
+		values := message.AttributeNamed("values").Value.List()
+
+		traitsMap[name] = &internal.Value{
+			Type:  internal.TypeList,
+			Value: values,
+		}
+	}
+
+	return &internal.Value{
+		Type: internal.TypeMap,
+		Value: &internal.MapValue{
+			Elems: traitsMap,
+		},
+	}, nil
+}
diff --git a/lib/tlsca/ca.go b/lib/tlsca/ca.go
index 34f85e3bf057e..a0a2e6ee6ba65 100644
--- a/lib/tlsca/ca.go
+++ b/lib/tlsca/ca.go
@@ -27,11 +27,13 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
+	"encoding/base32"
 	"encoding/pem"
 	"fmt"
 	"math/big"
 	"net"
 	"os"
+	"slices"
 	"strconv"
 	"time"
 
@@ -40,12 +42,14 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 
 	"github.com/gravitational/teleport"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/scopes/pinning"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
@@ -117,6 +121,11 @@ type Identity struct {
 	// Username is the name of the user (for end-users/bots) or the Host ID (for
 	// Teleport processes).
 	Username string
+	// ScopePin is an optional pin that ties the certificate to a specific scope and set of scoped roles. When
+	// set, the Groups field must not be set.
+	ScopePin *scopesv1.Pin
+	// AgentScope is the scope this identity belongs to.
+	AgentScope string
 	// Impersonator is a username of a user impersonating this user
 	Impersonator string
 	// Groups is a list of groups (Teleport roles) encoded in the identity
@@ -192,6 +201,9 @@ type Identity struct {
 	// BotInstanceID is a unique identifier for Machine ID bots that is
 	// persisted through renewals.
 	BotInstanceID string
+	// JoinToken contains the name of the join token used when a Machine ID bot
+	// joins. It is empty for other identity types.
+	JoinToken string
 	// AllowedResourceIDs lists the resources the identity should be allowed to
 	// access.
 	AllowedResourceIDs []types.ResourceID
@@ -210,6 +222,10 @@ type Identity struct {
 	// JoinAttributes holds the attributes that resulted from the
 	// Bot/Agent join process.
 	JoinAttributes *workloadidentityv1pb.JoinAttrs
+
+	// OriginClusterName is the name of the cluster where the identity is
+	// authenticated.
+	OriginClusterName string
 }
 
 // RouteToApp holds routing information for applications.
@@ -354,6 +370,7 @@ func (id *Identity) GetEventIdentity() events.Identity {
 
 	return events.Identity{
 		User:                    id.Username,
+		ScopePin:                pinning.ToEventsPin(id.ScopePin),
 		Impersonator:            id.Impersonator,
 		Roles:                   id.Groups,
 		Usage:                   id.Usage,
@@ -382,6 +399,7 @@ func (id *Identity) GetEventIdentity() events.Identity {
 		DeviceExtensions:        devExts,
 		BotName:                 id.BotName,
 		BotInstanceID:           id.BotInstanceID,
+		JoinToken:               id.JoinToken,
 	}
 }
 
@@ -390,8 +408,15 @@ func (id *Identity) CheckAndSetDefaults() error {
 	if id.Username == "" {
 		return trace.BadParameter("missing identity username")
 	}
-	if len(id.Groups) == 0 {
-		return trace.BadParameter("missing identity groups")
+	if len(id.Groups) == 0 && id.ScopePin == nil {
+		return trace.BadParameter("missing identity groups or scope pin")
+	}
+
+	// Set the origin cluster name to the teleport cluster name.
+	// OriginClusterName is never encoded in the certificate
+	// so we set it to cert's TeleportCluster.
+	if id.OriginClusterName == "" {
+		id.OriginClusterName = id.TeleportCluster
 	}
 
 	return nil
@@ -580,6 +605,17 @@ var (
 
 	// ADStatusOID is an extension OID used to indicate that we're connecting to AD-joined desktop.
 	ADStatusOID = asn1.ObjectIdentifier{1, 3, 9999, 2, 22}
+
+	// JoinTokenOID is an extension OID that contains the name of the join token
+	// used when a bot joins.
+	JoinTokenASN1ExtensionOID = asn1.ObjectIdentifier{1, 3, 9999, 2, 23}
+
+	// ScopePinASN1ExtensionOID is an extension OID that contains the scope pin
+	// used to tie the certificate to a specific scope and set of scoped roles.
+	ScopePinASN1ExtensionOID = asn1.ObjectIdentifier{1, 3, 9999, 2, 24}
+	// AgentScopeASN1ExtensionOID is an extension OID that contains the agent scope
+	// used to tie the certificate to a spec
+	AgentScopeASN1ExtensionOID = asn1.ObjectIdentifier{1, 3, 9999, 2, 25}
 )
 
 // Device Trust OIDs.
@@ -886,6 +922,35 @@ func (id *Identity) Subject() (pkix.Name, error) {
 			})
 	}
 
+	if id.JoinToken != "" {
+		subject.ExtraNames = append(subject.ExtraNames,
+			pkix.AttributeTypeAndValue{
+				Type:  JoinTokenASN1ExtensionOID,
+				Value: id.JoinToken,
+			})
+	}
+
+	if id.ScopePin != nil {
+		pin, err := protojson.Marshal(id.ScopePin)
+		if err != nil {
+			return pkix.Name{}, trace.Errorf("failed to encode scope pin: %w", err)
+		}
+
+		subject.ExtraNames = append(subject.ExtraNames,
+			pkix.AttributeTypeAndValue{
+				Type:  ScopePinASN1ExtensionOID,
+				Value: string(pin),
+			})
+	}
+
+	if id.AgentScope != "" {
+		subject.ExtraNames = append(subject.ExtraNames,
+			pkix.AttributeTypeAndValue{
+				Type:  AgentScopeASN1ExtensionOID,
+				Value: id.AgentScope,
+			})
+	}
+
 	if id.UserType != "" {
 		subject.ExtraNames = append(subject.ExtraNames,
 			pkix.AttributeTypeAndValue{
@@ -1173,6 +1238,23 @@ func FromSubject(subject pkix.Name, expires time.Time) (*Identity, error) {
 			if ok {
 				id.BotInstanceID = val
 			}
+		case attr.Type.Equal(JoinTokenASN1ExtensionOID):
+			val, ok := attr.Value.(string)
+			if ok {
+				id.JoinToken = val
+			}
+		case attr.Type.Equal(ScopePinASN1ExtensionOID):
+			val, ok := attr.Value.(string)
+			if ok {
+				var pin scopesv1.Pin
+				if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal([]byte(val), &pin); err != nil {
+					return nil, trace.Errorf("failed to unmarshal scope pin: %w", err)
+				}
+				id.ScopePin = &pin
+			}
+		case attr.Type.Equal(AgentScopeASN1ExtensionOID):
+			id.AgentScope = attr.Value.(string)
+
 		case attr.Type.Equal(AllowedResourcesASN1ExtensionOID):
 			allowedResourcesStr, ok := attr.Value.(string)
 			if ok {
@@ -1244,11 +1326,20 @@ func (id Identity) GetUserMetadata() events.UserMetadata {
 		}
 	}
 
-	userKind := events.UserKind_USER_KIND_HUMAN
-	if id.BotName != "" {
+	_, systemRoleCheckErr := types.NewTeleportRoles(id.Groups)
+	var userKind events.UserKind
+	switch {
+	case id.BotName != "":
 		userKind = events.UserKind_USER_KIND_BOT
+	case len(id.SystemRoles) > 0 || systemRoleCheckErr == nil && len(id.Groups) > 0:
+		userKind = events.UserKind_USER_KIND_SYSTEM
+	default:
+		userKind = events.UserKind_USER_KIND_HUMAN
+	}
+	userTeleportCluster := id.OriginClusterName
+	if userTeleportCluster == "" {
+		userTeleportCluster = id.TeleportCluster
 	}
-
 	return events.UserMetadata{
 		User:              id.Username,
 		Impersonator:      id.Impersonator,
@@ -1260,6 +1351,9 @@ func (id Identity) GetUserMetadata() events.UserMetadata {
 		TrustedDevice:     device,
 		BotName:           id.BotName,
 		BotInstanceID:     id.BotInstanceID,
+		UserRoles:         slices.Clone(id.Groups),
+		UserTraits:        id.Traits.Clone(),
+		UserClusterName:   userTeleportCluster,
 	}
 }
 
@@ -1279,6 +1373,11 @@ func (id *Identity) IsMFAVerified() bool {
 	return id.MFAVerified != "" || id.PrivateKeyPolicy.MFAVerified()
 }
 
+// IsBot returns whether this identity belongs to a bot.
+func (id *Identity) IsBot() bool {
+	return id.BotName != ""
+}
+
 // CertificateRequest is a X.509 signing certificate request
 type CertificateRequest struct {
 	// Clock is a clock used to get current or test time
@@ -1310,7 +1409,7 @@ func (c *CertificateRequest) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing parameter PublicKey")
 	}
 	if c.Subject.CommonName == "" {
-		return trace.BadParameter("missing parameter Subject.Common name")
+		return trace.BadParameter("missing parameter Subject.CommonName")
 	}
 	if c.NotAfter.IsZero() {
 		return trace.BadParameter("missing parameter NotAfter")
@@ -1345,6 +1444,7 @@ func (ca *CertAuthority) GenerateCertificate(req CertificateRequest) ([]byte, er
 		"dns_names", req.DNSNames,
 		"key_usage", req.KeyUsage,
 		"common_name", req.Subject.CommonName,
+		"issuer_skid", base32.HexEncoding.EncodeToString(ca.Cert.SubjectKeyId),
 	)
 
 	template := &x509.Certificate{
diff --git a/lib/tlsca/ca_test.go b/lib/tlsca/ca_test.go
index 62e86012b3528..094acbb565a35 100644
--- a/lib/tlsca/ca_test.go
+++ b/lib/tlsca/ca_test.go
@@ -37,7 +37,9 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 
 	"github.com/gravitational/teleport"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/cryptosuites"
@@ -118,6 +120,54 @@ func TestPrincipals(t *testing.T) {
 	}
 }
 
+// TestScopePin verifies the encoding/decoding of the scope pin field.
+func TestScopePin(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	expires := clock.Now().Add(1 * time.Hour)
+
+	ca, err := FromKeys([]byte(fixtures.TLSCACertPEM), []byte(fixtures.TLSCAKeyPEM))
+	require.NoError(t, err)
+
+	privateKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.ECDSAP256)
+	require.NoError(t, err)
+
+	identity := Identity{
+		Username: "alice@example.com",
+		ScopePin: &scopesv1.Pin{
+			Scope: "/foo",
+			Assignments: map[string]*scopesv1.PinnedAssignments{
+				"/": {
+					Roles: []string{"r1"},
+				},
+				"/foo": {
+					Roles: []string{"r2"},
+				},
+			},
+		},
+	}
+
+	subj, err := identity.Subject()
+	require.NoError(t, err)
+	require.NotNil(t, subj)
+
+	certBytes, err := ca.GenerateCertificate(CertificateRequest{
+		Clock:     clock,
+		PublicKey: privateKey.Public(),
+		Subject:   subj,
+		NotAfter:  expires,
+	})
+	require.NoError(t, err)
+
+	cert, err := ParseCertificatePEM(certBytes)
+	require.NoError(t, err)
+
+	parsed, err := FromSubject(cert.Subject, expires)
+	require.NoError(t, err)
+	require.NotNil(t, parsed)
+
+	require.Empty(t, cmp.Diff(parsed.ScopePin, identity.ScopePin, protocmp.Transform()))
+}
+
 func TestRenewableIdentity(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	expires := clock.Now().Add(1 * time.Hour)
@@ -230,6 +280,7 @@ func TestKubeExtensions(t *testing.T) {
 		KubernetesUsers:   []string{"IAM#alice@example.com"},
 		KubernetesCluster: "kube-cluster",
 		TeleportCluster:   "tele-cluster",
+		OriginClusterName: "tele-cluster",
 		RouteToDatabase: RouteToDatabase{
 			ServiceName: "postgres-rds",
 			Protocol:    "postgres",
@@ -269,11 +320,12 @@ func TestDatabaseExtensions(t *testing.T) {
 
 	expires := clock.Now().Add(time.Hour)
 	identity := Identity{
-		Username:        "alice@example.com",
-		Groups:          []string{"admin"},
-		Impersonator:    "bob@example.com",
-		Usage:           []string{teleport.UsageDatabaseOnly},
-		TeleportCluster: "tele-cluster",
+		Username:          "alice@example.com",
+		Groups:            []string{"admin"},
+		Impersonator:      "bob@example.com",
+		Usage:             []string{teleport.UsageDatabaseOnly},
+		TeleportCluster:   "tele-cluster",
+		OriginClusterName: "tele-cluster",
 		RouteToDatabase: RouteToDatabase{
 			ServiceName: "postgres-rds",
 			Protocol:    "postgres",
@@ -325,8 +377,9 @@ func TestAzureExtensions(t *testing.T) {
 			Name:          "azure-app",
 			AzureIdentity: "azure-identity-3",
 		},
-		TeleportCluster: "tele-cluster",
-		Expires:         expires,
+		TeleportCluster:   "tele-cluster",
+		OriginClusterName: "tele-cluster",
+		Expires:           expires,
 	}
 
 	subj, err := identity.Subject()
@@ -466,8 +519,9 @@ func TestGCPExtensions(t *testing.T) {
 			Name:              "GCP-app",
 			GCPServiceAccount: "acct-3@example-123456.iam.gserviceaccount.com",
 		},
-		TeleportCluster: "tele-cluster",
-		Expires:         expires,
+		TeleportCluster:   "tele-cluster",
+		OriginClusterName: "tele-cluster",
+		Expires:           expires,
 	}
 
 	subj, err := identity.Subject()
@@ -552,6 +606,42 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 				UserKind: apievents.UserKind_USER_KIND_HUMAN,
 			},
 		},
+		{
+			name: "user metadata for auth system role",
+			identity: Identity{
+				Username: "system.teleport.name",
+				Groups:   []string{string(types.RoleAuth)},
+			},
+			want: apievents.UserMetadata{
+				User:      "system.teleport.name",
+				UserRoles: []string{string(types.RoleAuth)},
+				UserKind:  apievents.UserKind_USER_KIND_SYSTEM,
+			},
+		},
+		{
+			name: "user metadata for discovery system role",
+			identity: Identity{
+				Username: "system.teleport.name",
+				Groups:   []string{string(types.RoleDiscovery)},
+			},
+			want: apievents.UserMetadata{
+				User:      "system.teleport.name",
+				UserKind:  apievents.UserKind_USER_KIND_SYSTEM,
+				UserRoles: []string{string(types.RoleDiscovery)},
+			},
+		},
+		{
+			name: "user metadata for okta system role",
+			identity: Identity{
+				Username: "system.teleport.name",
+				Groups:   []string{string(types.RoleOkta)},
+			},
+			want: apievents.UserMetadata{
+				User:      "system.teleport.name",
+				UserKind:  apievents.UserKind_USER_KIND_SYSTEM,
+				UserRoles: []string{string(types.RoleOkta)},
+			},
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/lib/tlsca/parsegen.go b/lib/tlsca/parsegen.go
index bbdb19010d139..e867c2ed86266 100644
--- a/lib/tlsca/parsegen.go
+++ b/lib/tlsca/parsegen.go
@@ -92,8 +92,8 @@ func GenerateSelfSignedCAWithConfig(config GenerateCAConfig) (certPEM []byte, er
 	// signed by the same private key and having the same subject (happens in tests)
 	config.Entity.SerialNumber = serialNumber.String()
 
-	// Note: KeyUsageCRLSign is set only to generate empty CRLs for Desktop
-	// Access authentication with Windows.
+	// Note: KeyUsageCRLSign is set only to generate empty CRLs for
+	// desktop and database access on Windows
 	keyUsage := x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign | x509.KeyUsageCRLSign
 	if _, isRSA := config.Signer.Public().(*rsa.PublicKey); isRSA {
 		// The KeyEncipherment bit is necessary for RSA key exchanges
diff --git a/lib/tpm/tpm.go b/lib/tpm/tpm.go
index 6175efdedb018..887234038610c 100644
--- a/lib/tpm/tpm.go
+++ b/lib/tpm/tpm.go
@@ -36,9 +36,9 @@ import (
 
 var tracer = otel.Tracer("github.com/gravitational/teleport/lib/tpm")
 
-// serialString converts a serial number into a readable colon-delimited hex
+// SerialString converts a serial number into a readable colon-delimited hex
 // string thats user-readable e.g ab:ab:ab:ff:ff:ff
-func serialString(serial *big.Int) string {
+func SerialString(serial *big.Int) string {
 	hex := serial.Text(16)
 
 	out := strings.Builder{}
@@ -60,11 +60,11 @@ func serialString(serial *big.Int) string {
 	return out.String()
 }
 
-// hashEKPub hashes the public part of an EK key. The key is hashed with SHA256,
+// HashEKPub hashes the public part of an EK key. The key is hashed with SHA256,
 // and returned as a hexadecimal string.
-func hashEKPub(pkixPublicKey []byte) (string, error) {
+func HashEKPub(pkixPublicKey []byte) string {
 	hashed := sha256.Sum256(pkixPublicKey)
-	return fmt.Sprintf("%x", hashed), nil
+	return fmt.Sprintf("%x", hashed)
 }
 
 // QueryRes is the result of the TPM query performed by Query.
@@ -140,15 +140,12 @@ func QueryWithTPM(
 		return nil, trace.Wrap(err)
 	}
 	data.EKPub = ekPub
-	data.EKPubHash, err = hashEKPub(ekPub)
-	if err != nil {
-		return nil, trace.Wrap(err, "hashing ekpub")
-	}
+	data.EKPubHash = HashEKPub(ekPub)
 
 	if eks[0].Certificate != nil {
 		data.EKCert = &QueryEKCert{
 			Raw:          eks[0].Certificate.Raw,
-			SerialNumber: serialString(eks[0].Certificate.SerialNumber),
+			SerialNumber: SerialString(eks[0].Certificate.SerialNumber),
 		}
 	}
 	log.DebugContext(ctx, "Successfully queried TPM", "data", data)
diff --git a/lib/tpm/validate.go b/lib/tpm/validate.go
index 126133d31e644..cee3e0d43a080 100644
--- a/lib/tpm/validate.go
+++ b/lib/tpm/validate.go
@@ -23,7 +23,6 @@ import (
 	"crypto"
 	"crypto/subtle"
 	"crypto/x509"
-	"log/slog"
 
 	"github.com/google/go-attestation/attest"
 	"github.com/gravitational/trace"
@@ -83,9 +82,7 @@ func (c *ValidatedTPM) JoinAttrs() *workloadidentityv1pb.JoinAttrsTPM {
 // the client to solve in a credential activation ceremony. This allows us to
 // verify that the client possesses the TPM corresponding to the EK public key
 // or certificate presented by the client.
-func Validate(
-	ctx context.Context, log *slog.Logger, params ValidateParams,
-) (*ValidatedTPM, error) {
+func Validate(ctx context.Context, params ValidateParams) (*ValidatedTPM, error) {
 	ctx, span := tracer.Start(ctx, "Validate")
 	defer span.End()
 
@@ -107,12 +104,9 @@ func Validate(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	validated.EKPubHash, err = hashEKPub(ekPubPKIX)
-	if err != nil {
-		return validated, trace.Wrap(err, "hashing EK public key")
-	}
+	validated.EKPubHash = HashEKPub(ekPubPKIX)
 	if ekCert != nil {
-		validated.EKCertSerial = serialString(ekCert.SerialNumber)
+		validated.EKCertSerial = SerialString(ekCert.SerialNumber)
 	}
 
 	if params.AllowedCAs != nil {
diff --git a/lib/usagereporter/teleport/aggregating/reporter.go b/lib/usagereporter/teleport/aggregating/reporter.go
index 4f7ed64cebce7..b77364453364b 100644
--- a/lib/usagereporter/teleport/aggregating/reporter.go
+++ b/lib/usagereporter/teleport/aggregating/reporter.go
@@ -209,6 +209,8 @@ func convertUserKind(v1AlphaUserKind prehogv1alpha.UserKind) prehogv1.UserKind {
 		return prehogv1.UserKind_USER_KIND_BOT
 	case prehogv1alpha.UserKind_USER_KIND_HUMAN:
 		return prehogv1.UserKind_USER_KIND_HUMAN
+	case prehogv1alpha.UserKind_USER_KIND_SYSTEM:
+		return prehogv1.UserKind_USER_KIND_SYSTEM
 	default:
 		return prehogv1.UserKind_USER_KIND_UNSPECIFIED
 	}
@@ -423,6 +425,9 @@ Ingest:
 				userRecord(te.UserName, te.UserKind).AppTcpSessions++
 			case usagereporter.SAMLIdPSessionType:
 				userRecord(te.UserName, prehogv1alpha.UserKind_USER_KIND_HUMAN).SamlIdpSessions++
+			case usagereporter.MCPAppSessionType:
+				// TODO(greedy52) switch to MCPSessions when it's available.
+				userRecord(te.UserName, te.UserKind).AppSessions++
 			}
 		case *usagereporter.KubeRequestEvent:
 			userRecord(te.UserName, te.UserKind).KubeRequests++
diff --git a/lib/usagereporter/teleport/audit.go b/lib/usagereporter/teleport/audit.go
index 4ddf98dff7ac6..bb3206289fb1b 100644
--- a/lib/usagereporter/teleport/audit.go
+++ b/lib/usagereporter/teleport/audit.go
@@ -31,6 +31,9 @@ const (
 	// TCPSessionType is the session_type in tp.session.start for TCP
 	// Application Access.
 	TCPSessionType = "app_tcp"
+	// MCPAppSessionType is the session_type in tp.session.start for MCP
+	// Access via App access.
+	MCPAppSessionType = "app_mcp"
 	// PortSessionType is the session_type in tp.session.start for SSH or Kube
 	// port forwarding.
 	//
@@ -55,6 +58,8 @@ func prehogUserKindFromEventKind(eventsKind apievents.UserKind) prehogv1a.UserKi
 		return prehogv1a.UserKind_USER_KIND_BOT
 	case apievents.UserKind_USER_KIND_HUMAN:
 		return prehogv1a.UserKind_USER_KIND_HUMAN
+	case apievents.UserKind_USER_KIND_SYSTEM:
+		return prehogv1a.UserKind_USER_KIND_SYSTEM
 	default:
 		return prehogv1a.UserKind_USER_KIND_UNSPECIFIED
 	}
@@ -369,6 +374,20 @@ func ConvertAuditEvent(event apievents.AuditEvent) Anonymizable {
 			UserName:    e.User,
 			SessionType: string(SAMLIdPSessionType),
 		}
+	case *apievents.MCPSessionStart:
+		return &SessionStartEvent{
+			UserName:    e.User,
+			SessionType: MCPAppSessionType,
+			UserKind:    prehogUserKindFromEventKind(e.UserKind),
+			Mcp: &prehogv1a.SessionStartMCPMetadata{
+				Transport:       types.GetMCPServerTransportType(e.AppURI),
+				ProtocolVersion: e.ProtocolVersion,
+				IngressAuthType: e.IngressAuthType,
+				EgressAuthType:  e.EgressAuthType,
+				ClientName:      e.ClientInfo,
+				ServerName:      e.ServerInfo,
+			},
+		}
 	}
 
 	return nil
diff --git a/lib/usagereporter/teleport/audit_test.go b/lib/usagereporter/teleport/audit_test.go
index 4a63f10b13615..76d67f5e1e4b5 100644
--- a/lib/usagereporter/teleport/audit_test.go
+++ b/lib/usagereporter/teleport/audit_test.go
@@ -277,6 +277,41 @@ func TestConvertAuditEvent(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "MCPSessionStart",
+			event: &apievents.MCPSessionStart{
+				UserMetadata: apievents.UserMetadata{User: "alice"},
+				AppMetadata: apievents.AppMetadata{
+					AppName: "mcp-everything",
+					AppURI:  "mcp+http://localhost:12345/mcp",
+				},
+				IngressAuthType: "ingress-auth",
+				EgressAuthType:  "egress-auth",
+				ClientInfo:      "client/1.0.0",
+				ServerInfo:      "server/1.0.0",
+				ProtocolVersion: "protocol-version",
+			},
+			expected: &SessionStartEvent{
+				SessionType: MCPAppSessionType,
+				UserName:    "alice",
+				Mcp: &prehogv1a.SessionStartMCPMetadata{
+					Transport:       "Streamable HTTP",
+					ProtocolVersion: "protocol-version",
+					ClientName:      "client/1.0.0",
+					ServerName:      "server/1.0.0",
+					IngressAuthType: "ingress-auth",
+					EgressAuthType:  "egress-auth",
+				},
+			},
+			expectedAnonymized: &prehogv1a.SubmitEventRequest{
+				Event: &prehogv1a.SubmitEventRequest_SessionStartV2{
+					SessionStartV2: &prehogv1a.SessionStartEvent{
+						SessionType: MCPAppSessionType,
+						UserName:    anonymizer.AnonymizeString("alice"),
+					},
+				},
+			},
+		},
 	}
 
 	for _, tt := range cases {
diff --git a/lib/usagereporter/teleport/types.go b/lib/usagereporter/teleport/types.go
index eaa7cee59f023..c768f6a063690 100644
--- a/lib/usagereporter/teleport/types.go
+++ b/lib/usagereporter/teleport/types.go
@@ -209,6 +209,10 @@ func integrationEnrollMetadataToPrehog(u *usageeventsv1.IntegrationEnrollMetadat
 		prehogKind = prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT
 	case usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES:
 		prehogKind = prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES
+	case usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD:
+		prehogKind = prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD
+	case usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES:
+		prehogKind = prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES
 	default:
 		prehogKind = prehogv1a.IntegrationEnrollKind(u.Kind)
 	}
@@ -308,6 +312,102 @@ func (u *UIIntegrationEnrollStepEvent) Anonymize(a utils.Anonymizer) prehogv1a.S
 	}
 }
 
+// UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+// a section (e.g. "Advanced Options") in an integration setup wizard.
+type UIIntegrationEnrollSectionOpenEvent prehogv1a.UIIntegrationEnrollSectionOpenEvent
+
+func (u *UIIntegrationEnrollSectionOpenEvent) CheckAndSetDefaults() error {
+	return trace.Wrap(validateIntegrationEnrollMetadata(u.Metadata))
+}
+
+func (u *UIIntegrationEnrollSectionOpenEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent{
+			UiIntegrationEnrollSectionOpenEvent: &prehogv1a.UIIntegrationEnrollSectionOpenEvent{
+				Metadata: &prehogv1a.IntegrationEnrollMetadata{
+					Id:       u.Metadata.Id,
+					Kind:     u.Metadata.Kind,
+					UserName: a.AnonymizeString(u.Metadata.UserName),
+				},
+				Step:    u.Step,
+				Section: u.Section,
+			},
+		},
+	}
+}
+
+// UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+// field in an integration setup wizard.
+type UIIntegrationEnrollFieldCompleteEvent prehogv1a.UIIntegrationEnrollFieldCompleteEvent
+
+func (u *UIIntegrationEnrollFieldCompleteEvent) CheckAndSetDefaults() error {
+	return trace.Wrap(validateIntegrationEnrollMetadata(u.Metadata))
+}
+
+func (u *UIIntegrationEnrollFieldCompleteEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent{
+			UiIntegrationEnrollFieldCompleteEvent: &prehogv1a.UIIntegrationEnrollFieldCompleteEvent{
+				Metadata: &prehogv1a.IntegrationEnrollMetadata{
+					Id:       u.Metadata.Id,
+					Kind:     u.Metadata.Kind,
+					UserName: a.AnonymizeString(u.Metadata.UserName),
+				},
+				Step:  u.Step,
+				Field: u.Field,
+			},
+		},
+	}
+}
+
+// UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+// IaC (e.g. Terraform) code in an integration setup wizard.
+type UIIntegrationEnrollCodeCopyEvent prehogv1a.UIIntegrationEnrollCodeCopyEvent
+
+func (u *UIIntegrationEnrollCodeCopyEvent) CheckAndSetDefaults() error {
+	return trace.Wrap(validateIntegrationEnrollMetadata(u.Metadata))
+}
+
+func (u *UIIntegrationEnrollCodeCopyEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent{
+			UiIntegrationEnrollCodeCopyEvent: &prehogv1a.UIIntegrationEnrollCodeCopyEvent{
+				Metadata: &prehogv1a.IntegrationEnrollMetadata{
+					Id:       u.Metadata.Id,
+					Kind:     u.Metadata.Kind,
+					UserName: a.AnonymizeString(u.Metadata.UserName),
+				},
+				Step: u.Step,
+				Type: u.Type,
+			},
+		},
+	}
+}
+
+// UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+// documentation, etc. in an integration setup wizard.
+type UIIntegrationEnrollLinkClickEvent prehogv1a.UIIntegrationEnrollLinkClickEvent
+
+func (u *UIIntegrationEnrollLinkClickEvent) CheckAndSetDefaults() error {
+	return trace.Wrap(validateIntegrationEnrollMetadata(u.Metadata))
+}
+
+func (u *UIIntegrationEnrollLinkClickEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollLinkClickEvent{
+			UiIntegrationEnrollLinkClickEvent: &prehogv1a.UIIntegrationEnrollLinkClickEvent{
+				Metadata: &prehogv1a.IntegrationEnrollMetadata{
+					Id:       u.Metadata.Id,
+					Kind:     u.Metadata.Kind,
+					UserName: a.AnonymizeString(u.Metadata.UserName),
+				},
+				Step: u.Step,
+				Link: u.Link,
+			},
+		},
+	}
+}
+
 // UIBannerClickEvent is a UI event sent when a banner is clicked.
 type UIBannerClickEvent prehogv1a.UIBannerClickEvent
 
@@ -1475,6 +1575,50 @@ func ConvertUsageEvent(event *usageeventsv1.UsageEventOneOf, userMD UserMetadata
 			return nil, trace.Wrap(err)
 		}
 
+		return ret, nil
+	case *usageeventsv1.UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent:
+		ret := &UIIntegrationEnrollSectionOpenEvent{
+			Metadata: integrationEnrollMetadataToPrehog(e.UiIntegrationEnrollSectionOpenEvent.Metadata, userMD),
+			Step:     prehogv1a.IntegrationEnrollStep(e.UiIntegrationEnrollSectionOpenEvent.Step),
+			Section:  prehogv1a.IntegrationEnrollSection(e.UiIntegrationEnrollSectionOpenEvent.Section),
+		}
+		if err := ret.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return ret, nil
+	case *usageeventsv1.UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent:
+		ret := &UIIntegrationEnrollFieldCompleteEvent{
+			Metadata: integrationEnrollMetadataToPrehog(e.UiIntegrationEnrollFieldCompleteEvent.Metadata, userMD),
+			Step:     prehogv1a.IntegrationEnrollStep(e.UiIntegrationEnrollFieldCompleteEvent.Step),
+			Field:    prehogv1a.IntegrationEnrollField(e.UiIntegrationEnrollFieldCompleteEvent.Field),
+		}
+		if err := ret.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return ret, nil
+	case *usageeventsv1.UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent:
+		ret := &UIIntegrationEnrollCodeCopyEvent{
+			Metadata: integrationEnrollMetadataToPrehog(e.UiIntegrationEnrollCodeCopyEvent.Metadata, userMD),
+			Step:     prehogv1a.IntegrationEnrollStep(e.UiIntegrationEnrollCodeCopyEvent.Step),
+			Type:     prehogv1a.IntegrationEnrollCodeType(e.UiIntegrationEnrollCodeCopyEvent.Type),
+		}
+		if err := ret.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return ret, nil
+	case *usageeventsv1.UsageEventOneOf_UiIntegrationEnrollLinkClickEvent:
+		ret := &UIIntegrationEnrollLinkClickEvent{
+			Metadata: integrationEnrollMetadataToPrehog(e.UiIntegrationEnrollLinkClickEvent.Metadata, userMD),
+			Step:     prehogv1a.IntegrationEnrollStep(e.UiIntegrationEnrollLinkClickEvent.Step),
+			Link:     e.UiIntegrationEnrollLinkClickEvent.Link,
+		}
+		if err := ret.CheckAndSetDefaults(); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
 		return ret, nil
 	case *usageeventsv1.UsageEventOneOf_UiDiscoverStartedEvent:
 		ret := &UIDiscoverStartedEvent{
diff --git a/lib/usagereporter/teleport/usagereporter_test.go b/lib/usagereporter/teleport/usagereporter_test.go
index 70da7cb177975..b2858c3b98e57 100644
--- a/lib/usagereporter/teleport/usagereporter_test.go
+++ b/lib/usagereporter/teleport/usagereporter_test.go
@@ -296,6 +296,98 @@ func TestConvertUsageEvent(t *testing.T) {
 				},
 			}},
 		},
+		{
+			name: "integration enroll section open event",
+			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent{
+				UiIntegrationEnrollSectionOpenEvent: &usageeventsv1.UIIntegrationEnrollSectionOpenEvent{
+					Metadata: &usageeventsv1.IntegrationEnrollMetadata{Id: "someid", Kind: usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES},
+					Step:     usageeventsv1.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB,
+					Section:  usageeventsv1.IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS,
+				},
+			}},
+			identityUsername: "myuser",
+			errCheck:         require.NoError,
+			expected: &prehogv1a.SubmitEventRequest{Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollSectionOpenEvent{
+				UiIntegrationEnrollSectionOpenEvent: &prehogv1a.UIIntegrationEnrollSectionOpenEvent{
+					Metadata: &prehogv1a.IntegrationEnrollMetadata{
+						Id:       "someid",
+						UserName: expectedAnonymizedUserString,
+						Kind:     prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES,
+					},
+					Step:    prehogv1a.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB,
+					Section: prehogv1a.IntegrationEnrollSection_INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS,
+				},
+			}},
+		},
+		{
+			name: "integration enroll field complete event",
+			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent{
+				UiIntegrationEnrollFieldCompleteEvent: &usageeventsv1.UIIntegrationEnrollFieldCompleteEvent{
+					Metadata: &usageeventsv1.IntegrationEnrollMetadata{Id: "someid", Kind: usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES},
+					Step:     usageeventsv1.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB,
+					Field:    usageeventsv1.IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL,
+				},
+			}},
+			identityUsername: "myuser",
+			errCheck:         require.NoError,
+			expected: &prehogv1a.SubmitEventRequest{Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollFieldCompleteEvent{
+				UiIntegrationEnrollFieldCompleteEvent: &prehogv1a.UIIntegrationEnrollFieldCompleteEvent{
+					Metadata: &prehogv1a.IntegrationEnrollMetadata{
+						Id:       "someid",
+						UserName: expectedAnonymizedUserString,
+						Kind:     prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES,
+					},
+					Step:  prehogv1a.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB,
+					Field: prehogv1a.IntegrationEnrollField_INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL,
+				},
+			}},
+		},
+		{
+			name: "integration enroll code copy event",
+			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent{
+				UiIntegrationEnrollCodeCopyEvent: &usageeventsv1.UIIntegrationEnrollCodeCopyEvent{
+					Metadata: &usageeventsv1.IntegrationEnrollMetadata{Id: "someid", Kind: usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES},
+					Step:     usageeventsv1.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW,
+					Type:     usageeventsv1.IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM,
+				},
+			}},
+			identityUsername: "myuser",
+			errCheck:         require.NoError,
+			expected: &prehogv1a.SubmitEventRequest{Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollCodeCopyEvent{
+				UiIntegrationEnrollCodeCopyEvent: &prehogv1a.UIIntegrationEnrollCodeCopyEvent{
+					Metadata: &prehogv1a.IntegrationEnrollMetadata{
+						Id:       "someid",
+						UserName: expectedAnonymizedUserString,
+						Kind:     prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES,
+					},
+					Step: prehogv1a.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW,
+					Type: prehogv1a.IntegrationEnrollCodeType_INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM,
+				},
+			}},
+		},
+		{
+			name: "integration enroll link click event",
+			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollLinkClickEvent{
+				UiIntegrationEnrollLinkClickEvent: &usageeventsv1.UIIntegrationEnrollLinkClickEvent{
+					Metadata: &usageeventsv1.IntegrationEnrollMetadata{Id: "someid", Kind: usageeventsv1.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES},
+					Step:     usageeventsv1.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW,
+					Link:     "https://link-to-docs",
+				},
+			}},
+			identityUsername: "myuser",
+			errCheck:         require.NoError,
+			expected: &prehogv1a.SubmitEventRequest{Event: &prehogv1a.SubmitEventRequest_UiIntegrationEnrollLinkClickEvent{
+				UiIntegrationEnrollLinkClickEvent: &prehogv1a.UIIntegrationEnrollLinkClickEvent{
+					Metadata: &prehogv1a.IntegrationEnrollMetadata{
+						Id:       "someid",
+						UserName: expectedAnonymizedUserString,
+						Kind:     prehogv1a.IntegrationEnrollKind_INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES,
+					},
+					Step: prehogv1a.IntegrationEnrollStep_INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW,
+					Link: "https://link-to-docs",
+				},
+			}},
+		},
 		{
 			name: "discover deploy service event",
 			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiDiscoverDeployServiceEvent{
diff --git a/lib/usagereporter/web/userevent.go b/lib/usagereporter/web/userevent.go
index dc087c209233e..df926a768706e 100644
--- a/lib/usagereporter/web/userevent.go
+++ b/lib/usagereporter/web/userevent.go
@@ -64,9 +64,13 @@ const (
 	uiDiscoverTestConnectionEvent                     = "tp.ui.discover.testConnection"
 	uiDiscoverCompletedEvent                          = "tp.ui.discover.completed"
 
-	uiIntegrationEnrollStartEvent    = "tp.ui.integrationEnroll.start"
-	uiIntegrationEnrollCompleteEvent = "tp.ui.integrationEnroll.complete"
-	uiIntegrationEnrollStepEvent     = "tp.ui.integrationEnroll.step"
+	uiIntegrationEnrollStartEvent         = "tp.ui.integrationEnroll.start"
+	uiIntegrationEnrollCompleteEvent      = "tp.ui.integrationEnroll.complete"
+	uiIntegrationEnrollStepEvent          = "tp.ui.integrationEnroll.step"
+	uiIntegrationEnrollSectionOpenEvent   = "tp.ui.integrationEnroll.sectionOpen"
+	uiIntegrationEnrollFieldCompleteEvent = "tp.ui.integrationEnroll.fieldComplete"
+	uiIntegrationEnrollCodeCopyEvent      = "tp.ui.integrationEnroll.codeCopy"
+	uiIntegrationEnrollLinkClickEvent     = "tp.ui.integrationEnroll.linkClick"
 
 	uiCallToActionClickEvent = "tp.ui.callToAction.click"
 
@@ -95,6 +99,8 @@ var eventsWithDataRequired = []string{
 	uiIntegrationEnrollStartEvent,
 	uiIntegrationEnrollCompleteEvent,
 	uiIntegrationEnrollStepEvent,
+	uiIntegrationEnrollSectionOpenEvent,
+	uiIntegrationEnrollFieldCompleteEvent,
 	uiDiscoverCreateDiscoveryConfigEvent,
 	uiAccessGraphCrownJewelDiffViewEvent,
 }
@@ -318,6 +324,110 @@ func ConvertUserEventRequestToUsageEvent(req CreateUserEventRequest) (*usageeven
 				},
 			},
 		}}, nil
+	case uiIntegrationEnrollSectionOpenEvent:
+		eventData := struct {
+			ID      string `json:"id"`
+			Kind    string `json:"kind"`
+			Step    string `json:"step"`
+			Section string `json:"section"`
+		}{}
+		if err := json.Unmarshal([]byte(*req.EventData), &eventData); err != nil {
+			return nil, trace.BadParameter("eventData is invalid: %v", err)
+		}
+
+		kindEnum, ok := usageeventsv1.IntegrationEnrollKind_value[eventData.Kind]
+		if !ok {
+			return nil, trace.BadParameter("invalid integration enroll kind %s", eventData.Kind)
+		}
+
+		return &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollSectionOpenEvent{
+			UiIntegrationEnrollSectionOpenEvent: &usageeventsv1.UIIntegrationEnrollSectionOpenEvent{
+				Metadata: &usageeventsv1.IntegrationEnrollMetadata{
+					Id:   eventData.ID,
+					Kind: usageeventsv1.IntegrationEnrollKind(kindEnum),
+				},
+				Step:    usageeventsv1.IntegrationEnrollStep(usageeventsv1.IntegrationEnrollStep_value[eventData.Step]),
+				Section: usageeventsv1.IntegrationEnrollSection(usageeventsv1.IntegrationEnrollSection_value[eventData.Section]),
+			},
+		}}, nil
+	case uiIntegrationEnrollFieldCompleteEvent:
+		eventData := struct {
+			ID    string `json:"id"`
+			Kind  string `json:"kind"`
+			Step  string `json:"step"`
+			Field string `json:"field"`
+		}{}
+		if err := json.Unmarshal([]byte(*req.EventData), &eventData); err != nil {
+			return nil, trace.BadParameter("eventData is invalid: %v", err)
+		}
+
+		kindEnum, ok := usageeventsv1.IntegrationEnrollKind_value[eventData.Kind]
+		if !ok {
+			return nil, trace.BadParameter("invalid integration enroll kind %s", eventData.Kind)
+		}
+
+		return &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollFieldCompleteEvent{
+			UiIntegrationEnrollFieldCompleteEvent: &usageeventsv1.UIIntegrationEnrollFieldCompleteEvent{
+				Metadata: &usageeventsv1.IntegrationEnrollMetadata{
+					Id:   eventData.ID,
+					Kind: usageeventsv1.IntegrationEnrollKind(kindEnum),
+				},
+				Step:  usageeventsv1.IntegrationEnrollStep(usageeventsv1.IntegrationEnrollStep_value[eventData.Step]),
+				Field: usageeventsv1.IntegrationEnrollField(usageeventsv1.IntegrationEnrollField_value[eventData.Field]),
+			},
+		}}, nil
+	case uiIntegrationEnrollCodeCopyEvent:
+		eventData := struct {
+			ID       string `json:"id"`
+			Kind     string `json:"kind"`
+			Step     string `json:"step"`
+			CodeType string `json:"codeType"`
+		}{}
+		if err := json.Unmarshal([]byte(*req.EventData), &eventData); err != nil {
+			return nil, trace.BadParameter("eventData is invalid: %v", err)
+		}
+
+		kindEnum, ok := usageeventsv1.IntegrationEnrollKind_value[eventData.Kind]
+		if !ok {
+			return nil, trace.BadParameter("invalid integration enroll kind %s", eventData.Kind)
+		}
+
+		return &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollCodeCopyEvent{
+			UiIntegrationEnrollCodeCopyEvent: &usageeventsv1.UIIntegrationEnrollCodeCopyEvent{
+				Metadata: &usageeventsv1.IntegrationEnrollMetadata{
+					Id:   eventData.ID,
+					Kind: usageeventsv1.IntegrationEnrollKind(kindEnum),
+				},
+				Step: usageeventsv1.IntegrationEnrollStep(usageeventsv1.IntegrationEnrollStep_value[eventData.Step]),
+				Type: usageeventsv1.IntegrationEnrollCodeType(usageeventsv1.IntegrationEnrollCodeType_value[eventData.CodeType]),
+			},
+		}}, nil
+	case uiIntegrationEnrollLinkClickEvent:
+		eventData := struct {
+			ID   string `json:"id"`
+			Kind string `json:"kind"`
+			Step string `json:"step"`
+			Link string `json:"link"`
+		}{}
+		if err := json.Unmarshal([]byte(*req.EventData), &eventData); err != nil {
+			return nil, trace.BadParameter("eventData is invalid: %v", err)
+		}
+
+		kindEnum, ok := usageeventsv1.IntegrationEnrollKind_value[eventData.Kind]
+		if !ok {
+			return nil, trace.BadParameter("invalid integration enroll kind %s", eventData.Kind)
+		}
+
+		return &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiIntegrationEnrollLinkClickEvent{
+			UiIntegrationEnrollLinkClickEvent: &usageeventsv1.UIIntegrationEnrollLinkClickEvent{
+				Metadata: &usageeventsv1.IntegrationEnrollMetadata{
+					Id:   eventData.ID,
+					Kind: usageeventsv1.IntegrationEnrollKind(kindEnum),
+				},
+				Step: usageeventsv1.IntegrationEnrollStep(usageeventsv1.IntegrationEnrollStep_value[eventData.Step]),
+				Link: eventData.Link,
+			},
+		}}, nil
 	case uiDiscoverStartedEvent,
 		uiDiscoverResourceSelectionEvent,
 		uiDiscoverIntegrationAWSOIDCConnectEvent,
diff --git a/lib/usertasks/descriptions/ec2-ssm-invocation-failure.md b/lib/usertasks/descriptions/ec2-ssm-invocation-failure.md
index d773e64de859c..e85e0386630a6 100644
--- a/lib/usertasks/descriptions/ec2-ssm-invocation-failure.md
+++ b/lib/usertasks/descriptions/ec2-ssm-invocation-failure.md
@@ -8,6 +8,7 @@ Usually this happens when:
 
 The IAM Role used by the integration might be missing some required permissions.
 Ensure the following actions are allowed in the IAM Role used by the integration:
+- `account:ListRegions`
 - `ec2:DescribeInstances`
 - `ssm:DescribeInstanceInformation`
 - `ssm:GetCommandInvocation`
diff --git a/lib/utils/agentconn/agent_unix.go b/lib/utils/agentconn/agent_unix.go
deleted file mode 100644
index 0a4a9c857fe1b..0000000000000
--- a/lib/utils/agentconn/agent_unix.go
+++ /dev/null
@@ -1,37 +0,0 @@
-//go:build !windows
-
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package agentconn
-
-import (
-	"net"
-
-	"github.com/gravitational/trace"
-)
-
-// Dial creates net.Conn to a SSH agent listening on a Unix socket.
-func Dial(socket string) (net.Conn, error) {
-	conn, err := net.Dial("unix", socket)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return conn, nil
-}
diff --git a/lib/utils/agentconn/agent_windows.go b/lib/utils/agentconn/agent_windows.go
deleted file mode 100644
index fea5b4516be2c..0000000000000
--- a/lib/utils/agentconn/agent_windows.go
+++ /dev/null
@@ -1,262 +0,0 @@
-//go:build windows
-
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package agentconn
-
-import (
-	"context"
-	"encoding/binary"
-	"encoding/hex"
-	"log/slog"
-	"net"
-	"os"
-	"os/exec"
-	"os/user"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/Microsoft/go-winio"
-	"github.com/gravitational/trace"
-)
-
-const namedPipe = `\\.\pipe\openssh-ssh-agent`
-
-// Dial creates net.Conn to a SSH agent listening on a Windows named pipe.
-// This is behind a build flag because winio.DialPipe is only available on
-// Windows. If connecting to a named pipe fails and we're in a Cygwin
-// environment, a connection to a Cygwin SSH agent will be attempted.
-func Dial(socket string) (net.Conn, error) {
-	conn, err := winio.DialPipe(namedPipe, nil)
-	if err != nil {
-		// MSYSTEM is used to specify what Cygwin environment is used;
-		// if it exists, there's a very good chance we're in a Cygwin
-		// environment
-		if msys := os.Getenv("MSYSTEM"); msys != "" {
-			conn, err := dialCygwin(socket)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return conn, nil
-		}
-
-		return nil, trace.Wrap(err)
-	}
-
-	return conn, nil
-}
-
-// SIDs that are computer or domain SIDs start with this prefix.
-const wellKnownSIDPrefix = "S-1-5-"
-
-var (
-	// Format of the contents of a file created by Cygwin 'ssh-agent'.
-	// After '!<socket >', the listening port is specified, followed by
-	// an optional 's ' that is sometimes set depending on the implementation,
-	// ending with a GUID which is used as a shared secret when handshaking
-	// with the SSH agent.
-	// example:
-	// !<socket >51463 s 043B28B0-30D7E90E-027C556A-314067F9
-	cygwinSocket = regexp.MustCompile(`!<socket >(\d+) (s )?([A-Fa-f0-9-]+)`)
-	// format of an output line from Cygwin 'ps'
-	// example:
-	//       PID    PPID    PGID     WINPID   TTY         UID    STIME COMMAND
-	//      1634    1540    1634       7356     ?      197608 14:31:52 /usr/bin/ps
-	psLine = regexp.MustCompile(`(?m)^\s+\d+\s+\d+\s+\d+\s+\d+\s+\?\s+(\d+)`)
-)
-
-// attempt to connect a Cygwin SSH agent socket. Some code adapted from
-// https://github.com/abourget/secrets-bridge/blob/master/pkg/agentfwd/agentconn_windows.go
-func dialCygwin(socket string) (net.Conn, error) {
-	// the "socket" is actually a file Cygwin uses to communicate what the
-	// actual socket is and the parameters for the handshake
-	contents, err := os.ReadFile(socket)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	sockMatches := cygwinSocket.FindStringSubmatch(string(contents))
-	if len(sockMatches) != 4 {
-		return nil, trace.Errorf("could not find necessary information in Cygwin socket file")
-	}
-	port := sockMatches[1]
-	if sockMatches[2] != "s " {
-		return nil, trace.NotImplemented("dialing mysysgit ssh-agent sockets is not supported")
-	}
-	key := sockMatches[3]
-
-	u, err := user.Current()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var uid uint32
-	var unsureOfUID bool
-	if !strings.HasPrefix(u.Uid, wellKnownSIDPrefix) {
-		// the format of the SID isn't supported, fallback to getting
-		// the UID from 'ps'
-		uid, err = getCygwinUIDFromPS()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	} else {
-		// Attempt to get a Cygwin UID from a Windows SID. Details of
-		// UID -> SID mapping here: https://cygwin.com/cygwin-ug-net/ntsec.html
-		sidParts := strings.Split(u.Uid, "-")
-		if len(sidParts) == 4 {
-			// well-known SIDs in the NT_AUTHORITY domain of the S-1-5-RID type
-			u, err := strconv.ParseUint(sidParts[3], 10, 32)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			uid = uint32(u)
-		} else if len(sidParts) == 5 {
-			// other well-known SIDs that aren't groups
-			x, err := strconv.ParseUint(sidParts[3], 10, 32)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			rid, err := strconv.ParseUint(sidParts[4], 10, 32)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			uid = uint32(0x1000*x + rid)
-		} else if len(sidParts) == 8 {
-			// SIDs from the local machine's SAM, the machine's primary
-			// domain, or a trusted domain of the machine's primary domain
-			u, err := strconv.ParseUint(sidParts[7], 10, 32)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			uid = uint32(u)
-			unsureOfUID = true
-		} else {
-			// the format of the SID isn't supported, fallback to getting
-			// the UID from 'ps'
-			uid, err = getCygwinUIDFromPS()
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-		}
-	}
-
-	// dial socket and complete handshake
-	var conn net.Conn
-	if !unsureOfUID {
-		// we're confident in what the Cygwin UID is, only make one attempt
-		// at establishing a connection
-		conn, err = attemptCygwinHandshake(port, key, uid)
-		if err == nil {
-			return conn, nil
-		}
-	} else {
-		// the Cygwin UID could be built a few different ways; attempt
-		// with all UIDs until one succeeds
-		cygwinRIDNums := []uint32{0x30000, 0x100000, 0x80000000}
-		for _, num := range cygwinRIDNums {
-			conn, err = attemptCygwinHandshake(port, key, num+uid)
-			if err == nil {
-				return conn, nil
-			}
-		}
-
-		// none of those UIDs worked, fallback to getting UID from 'ps'
-		uid, err = getCygwinUIDFromPS()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		conn, err = attemptCygwinHandshake(port, key, uid)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	return conn, nil
-}
-
-// use Cygwin 'ps' binary to get the Cygwin UID of the current user
-func getCygwinUIDFromPS() (uint32, error) {
-	psOutput, err := exec.Command("ps").Output()
-	if err != nil {
-		return 0, trace.Wrap(err)
-	}
-	psMatches := psLine.FindStringSubmatch(string(psOutput))
-	if len(psMatches) != 2 {
-		return 0, trace.Errorf("UID not found in Cygwin ps output")
-	}
-	uid, err := strconv.ParseUint(psMatches[1], 10, 32)
-	if err != nil {
-		return 0, trace.Wrap(err)
-	}
-
-	return uint32(uid), nil
-}
-
-// connect to a listening socket of a Cygwin SSH agent and attempt to
-// preform a successful handshake with it. Handshake details here:
-// https://stackoverflow.com/questions/23086038/what-mechanism-is-used-by-msys-cygwin-to-emulate-unix-domain-sockets
-func attemptCygwinHandshake(port, key string, uid uint32) (net.Conn, error) {
-	slog.DebugContext(context.Background(), "[KEY AGENT] attempting a handshake with Cygwin ssh-agent socket", "port", port, "uid", uid)
-
-	conn, err := net.Dial("tcp", "localhost:"+port)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// 1. send hex-decoded GUID in little endian
-	keyBuf := make([]byte, 0, 16)
-	dst := make([]byte, 4)
-	// handle each part of the GUID in order
-	for i := 8; i <= len(key); i += 9 {
-		_, err := hex.Decode(dst, []byte(key)[i-8:i])
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		dst[0], dst[1], dst[2], dst[3] = dst[3], dst[2], dst[1], dst[0]
-		keyBuf = append(keyBuf, dst...)
-	}
-
-	if _, err = conn.Write(keyBuf); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// 2. server echoes the same bytes, read them
-	if _, err = conn.Read(keyBuf); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// 3. send PID, Cygwin UID and Cygwin GID of the calling process
-	pidsUids := make([]byte, 12)
-	pid := os.Getpid()
-	gid := pid // for cygwin's AF_UNIX -> AF_INET, pid = gid
-	binary.LittleEndian.PutUint32(pidsUids, uint32(pid))
-	binary.LittleEndian.PutUint32(pidsUids[4:], uid)
-	binary.LittleEndian.PutUint32(pidsUids[8:], uint32(gid))
-	if _, err = conn.Write(pidsUids); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// 4. server echoes the same bytes, read them
-	if _, err = conn.Read(pidsUids); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return conn, nil
-}
diff --git a/lib/utils/aws/aws.go b/lib/utils/aws/aws.go
index b486359d67da8..cf1dbf9e7b91c 100644
--- a/lib/utils/aws/aws.go
+++ b/lib/utils/aws/aws.go
@@ -26,6 +26,7 @@ import (
 	"log/slog"
 	"net/http"
 	"net/textproto"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -191,9 +192,7 @@ func VerifyAWSSignature(req *http.Request, credProvider aws.CredentialsProvider)
 		}
 	}
 
-	// Read the request body and replace the body ready with a new reader that will allow reading the body again
-	// by HTTP Transport.
-	payload, err := utils.GetAndReplaceRequestBody(req)
+	payloadHash, err := GetV4PayloadHash(req)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -216,8 +215,19 @@ func VerifyAWSSignature(req *http.Request, credProvider aws.CredentialsProvider)
 		return trace.Wrap(err)
 	}
 
+	// If the original request does not sign "content-length" (e.g. "aws sts
+	// get-caller-identity"), do not set reqCopy.ContentLength as go sdk's
+	// signer will forcefully sign "content-length" if it is set on the HTTP
+	// request.
+	findContentLength := slices.ContainsFunc(sigV4.SignedHeaders, func(header string) bool {
+		return strings.EqualFold(header, "content-length")
+	})
+	if !findContentLength {
+		reqCopy.ContentLength = 0
+	}
+
 	signer := NewSigner(sigV4.Service)
-	err = signer.SignHTTP(ctx, creds, reqCopy, GetV4PayloadHash(payload), sigV4.Service, sigV4.Region, t)
+	err = signer.SignHTTP(ctx, creds, reqCopy, payloadHash, sigV4.Service, sigV4.Region, t)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -249,14 +259,26 @@ func NewSigner(signingServiceName string) *v4.Signer {
 }
 
 // GetV4PayloadHash returns the V4 signing payload hash.
-func GetV4PayloadHash(payload []byte) string {
+func GetV4PayloadHash(req *http.Request) (string, error) {
+	payloadHash := strings.ToUpper(req.Header.Get("x-amz-content-sha256"))
+	switch payloadHash {
+	// unsigned payload, so we use the literal content string instead of hashing
+	// https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
+	case "UNSIGNED-PAYLOAD", "STREAMING-UNSIGNED-PAYLOAD-TRAILER":
+		return payloadHash, nil
+	default:
+	}
+	payload, err := utils.GetAndReplaceRequestBody(req)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
 	if len(payload) == 0 {
-		return EmptyPayloadHash
+		return EmptyPayloadHash, nil
 	}
 
 	hash := sha256.New()
 	hash.Write(payload)
-	return hex.EncodeToString(hash.Sum(nil))
+	return hex.EncodeToString(hash.Sum(nil)), nil
 }
 
 // filterHeaders removes request headers that are not in the headers list and returns the removed header keys.
diff --git a/lib/utils/aws/aws_test.go b/lib/utils/aws/aws_test.go
index 33b8483ea14cb..b8269bc73021a 100644
--- a/lib/utils/aws/aws_test.go
+++ b/lib/utils/aws/aws_test.go
@@ -19,9 +19,21 @@
 package aws
 
 import (
+	"crypto/tls"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // TestExtractCredFromAuthHeader test the extractCredFromAuthHeader function logic.
@@ -516,3 +528,101 @@ func TestResourceARN(t *testing.T) {
 		})
 	}
 }
+
+func TestVerifyAWSSignature(t *testing.T) {
+	creds1 := credentials.NewStaticCredentialsProvider("sameid", "secret1", "")
+	creds2 := credentials.NewStaticCredentialsProvider("sameid", "secret2", "")
+	creds3 := credentials.NewStaticCredentialsProvider("otherid", "secret1", "")
+	tests := []struct {
+		desc              string
+		clientCreds       aws.CredentialsProvider
+		serverCreds       aws.CredentialsProvider
+		checksumAlgorithm s3types.ChecksumAlgorithm
+		noTLS             bool
+		wantSha256Header  string
+		wantError         string
+	}{
+		{
+			desc:             "unsigned payload",
+			clientCreds:      creds1,
+			serverCreds:      creds1,
+			wantSha256Header: "UNSIGNED-PAYLOAD",
+		},
+		{
+			desc:        "signed payload",
+			clientCreds: creds1,
+			serverCreds: creds1,
+			// echo -n 'llama' | sha256sum
+			wantSha256Header: "fc5a1047f5919892fcdf8aa79ea5d6bb6531b5c176939ef0110906cb225941c1",
+			noTLS:            true,
+		},
+		{
+			desc:              "streaming unsigned payload trailer",
+			clientCreds:       creds1,
+			serverCreds:       creds1,
+			checksumAlgorithm: s3types.ChecksumAlgorithmCrc32,
+			wantSha256Header:  "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+		},
+		{
+			desc:             "different credential ID",
+			clientCreds:      creds3,
+			serverCreds:      creds1,
+			wantSha256Header: "UNSIGNED-PAYLOAD",
+			wantError:        "AccessKeyID does not match",
+		},
+		{
+			desc:             "different credential secret",
+			clientCreds:      creds2,
+			serverCreds:      creds1,
+			wantSha256Header: "UNSIGNED-PAYLOAD",
+			wantError:        "signature verification failed",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+				assert.Equal(t, test.wantSha256Header, req.Header.Get("x-amz-content-sha256"))
+				bodyBefore, err := utils.GetAndReplaceRequestBody(req)
+				assert.NoError(t, err)
+				err = VerifyAWSSignature(req, test.serverCreds)
+				if test.wantError != "" {
+					assert.ErrorContains(t, err, test.wantError)
+				} else {
+					assert.NoError(t, err)
+				}
+				bodyAfter, err := io.ReadAll(req.Body)
+				assert.NoError(t, err)
+				assert.Equal(t, string(bodyBefore), string(bodyAfter),
+					"checking a signature should not modify the request contents",
+				)
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer srv.Close()
+			if test.noTLS {
+				srv.Start()
+			} else {
+				srv.StartTLS()
+			}
+			tr := http.DefaultTransport.(*http.Transport).Clone()
+			tr.TLSClientConfig = &tls.Config{
+				InsecureSkipVerify: true,
+			}
+			clt := s3.New(s3.Options{
+				Credentials:      test.clientCreds,
+				BaseEndpoint:     aws.String(srv.URL),
+				Region:           "us-west-2",
+				RetryMaxAttempts: 1,
+				HTTPClient: &http.Client{
+					Transport: tr,
+				},
+			})
+			_, err := clt.PutObject(t.Context(), &s3.PutObjectInput{
+				ChecksumAlgorithm: test.checksumAlgorithm,
+				Bucket:            aws.String("bucket"),
+				Key:               aws.String("key"),
+				Body:              strings.NewReader("llama"),
+			})
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/lib/utils/aws/dynamodbutils/dynamo_test.go b/lib/utils/aws/dynamodbutils/dynamo_test.go
index 22207b53bb00d..bdd6a339876b8 100644
--- a/lib/utils/aws/dynamodbutils/dynamo_test.go
+++ b/lib/utils/aws/dynamodbutils/dynamo_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/utils/aws/dynamodbutils"
 )
 
@@ -54,7 +54,7 @@ func TestIsFIPSEnabled(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			t.Setenv("TELEPORT_UNSTABLE_DISABLE_AWS_FIPS", test.envVarValue)
 
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				FIPS: test.fips,
 			})
 
diff --git a/lib/utils/aws/ec2.go b/lib/utils/aws/ec2.go
new file mode 100644
index 0000000000000..2d50a62ce3c9d
--- /dev/null
+++ b/lib/utils/aws/ec2.go
@@ -0,0 +1,85 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package aws
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// GetRawEC2IdentityDocument fetches the PKCS7 RSA2048 InstanceIdentityDocument
+// from the IMDS for this EC2 instance.
+func GetRawEC2IdentityDocument(ctx context.Context) ([]byte, error) {
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	imdsClient := imds.NewFromConfig(cfg)
+	output, err := imdsClient.GetDynamicData(ctx, &imds.GetDynamicDataInput{
+		Path: "instance-identity/rsa2048",
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	iidBytes, err := utils.ReadAtMost(output.Content, teleport.MaxHTTPResponseSize)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if err := output.Content.Close(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return iidBytes, nil
+}
+
+func GetEC2InstanceIdentityDocument(ctx context.Context) (*imds.InstanceIdentityDocument, error) {
+	// fetch the raw IID
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	imdsClient := imds.NewFromConfig(cfg)
+	output, err := imdsClient.GetInstanceIdentityDocument(ctx, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &output.InstanceIdentityDocument, nil
+}
+
+// GetEC2NodeID returns the node ID to use for this EC2 instance when using
+// Simplified Node Joining.
+func GetEC2NodeID(ctx context.Context) (string, error) {
+	// fetch the raw IID
+	iid, err := GetEC2InstanceIdentityDocument(ctx)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return NodeIDFromIID(iid), nil
+}
+
+// NodeIDFromIID returns the node ID that must be used for nodes joining with
+// the given Instance Identity Document.
+func NodeIDFromIID(iid *imds.InstanceIdentityDocument) string {
+	return iid.AccountID + "-" + iid.InstanceID
+}
diff --git a/lib/utils/aws/region/internal/codegen.go b/lib/utils/aws/region/internal/codegen.go
index 6d3e9da4ec506..4aa2f89362715 100644
--- a/lib/utils/aws/region/internal/codegen.go
+++ b/lib/utils/aws/region/internal/codegen.go
@@ -88,7 +88,7 @@ type TemplateData struct {
 	Regions map[string]string
 }
 
-// AWSPartitions contains the struct representation of the AWS SDK patitions
+// AWSPartitions contains the struct representation of the AWS SDK partitions
 // JSON file.
 type AWSPartitions struct {
 	Partitions []struct {
@@ -101,7 +101,7 @@ type AWSPartitions struct {
 func main() {
 	partitionsContents, err := loadSDKPartitionsFile()
 	if err != nil {
-		log.Fatalf("failed to parse patitions: %s", trace.DebugReport(err))
+		log.Fatalf("failed to parse partitions: %s", trace.DebugReport(err))
 	}
 
 	data, err := convertToTemplateData(partitionsContents)
@@ -173,7 +173,7 @@ const (
 	outputFilename = "regions.go"
 	// awsPackageName is the AWS package used to find the paritions references.
 	awsPackageName = "github.com/aws/aws-sdk-go-v2"
-	// awsPartitionsFilePath is the patitions JSON file path inside the package.
+	// awsPartitionsFilePath is the partitions JSON file path inside the package.
 	awsPartitionsFilePath = "internal/endpoints/awsrulesfn/partitions.json"
 	// globalRegionSuffix is a strings suffix that indicates a region is a
 	// global region.
diff --git a/lib/utils/aws/region/regions.go b/lib/utils/aws/region/regions.go
index c287412b98401..cbf145503c5e2 100644
--- a/lib/utils/aws/region/regions.go
+++ b/lib/utils/aws/region/regions.go
@@ -41,6 +41,10 @@ var regions = sync.OnceValue(func() map[string]Region {
 			Name:        "ap-east-1",
 			Description: "Asia Pacific (Hong Kong)",
 		},
+		"ap-east-2": {
+			Name:        "ap-east-2",
+			Description: "Asia Pacific (Taipei)",
+		},
 		"ap-northeast-1": {
 			Name:        "ap-northeast-1",
 			Description: "Asia Pacific (Tokyo)",
@@ -81,6 +85,10 @@ var regions = sync.OnceValue(func() map[string]Region {
 			Name:        "ap-southeast-5",
 			Description: "Asia Pacific (Malaysia)",
 		},
+		"ap-southeast-6": {
+			Name:        "ap-southeast-6",
+			Description: "Asia Pacific (New Zealand)",
+		},
 		"ap-southeast-7": {
 			Name:        "ap-southeast-7",
 			Description: "Asia Pacific (Thailand)",
@@ -137,6 +145,10 @@ var regions = sync.OnceValue(func() map[string]Region {
 			Name:        "eu-west-3",
 			Description: "Europe (Paris)",
 		},
+		"eusc-de-east-1": {
+			Name:        "eusc-de-east-1",
+			Description: "EU (Germany)",
+		},
 		"il-central-1": {
 			Name:        "il-central-1",
 			Description: "Israel (Tel Aviv)",
@@ -185,6 +197,10 @@ var regions = sync.OnceValue(func() map[string]Region {
 			Name:        "us-isob-east-1",
 			Description: "US ISOB East (Ohio)",
 		},
+		"us-isob-west-1": {
+			Name:        "us-isob-west-1",
+			Description: "US ISOB West",
+		},
 		"us-isof-east-1": {
 			Name:        "us-isof-east-1",
 			Description: "US ISOF EAST",
diff --git a/lib/utils/aws/signing.go b/lib/utils/aws/signing.go
index 385ccfdcbae79..fce5df5e02635 100644
--- a/lib/utils/aws/signing.go
+++ b/lib/utils/aws/signing.go
@@ -79,7 +79,7 @@ func SignRequest(ctx context.Context, req *http.Request, signCtx *SigningCtx) (*
 	if err := signCtx.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	payload, err := utils.GetAndReplaceRequestBody(req)
+	payloadHash, err := GetV4PayloadHash(req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -101,7 +101,7 @@ func SignRequest(ctx context.Context, req *http.Request, signCtx *SigningCtx) (*
 	}
 
 	signer := NewSigner(signCtx.SigningName)
-	err = signer.SignHTTP(ctx, creds, reqCopy, GetV4PayloadHash(payload), signCtx.SigningName, signCtx.SigningRegion, time.Now())
+	err = signer.SignHTTP(ctx, creds, reqCopy, payloadHash, signCtx.SigningName, signCtx.SigningRegion, time.Now())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/utils/batcher/batcher.go b/lib/utils/batcher/batcher.go
new file mode 100644
index 0000000000000..c5e87b6490fcc
--- /dev/null
+++ b/lib/utils/batcher/batcher.go
@@ -0,0 +1,211 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package batcher
+
+import (
+	"context"
+	"io"
+	"iter"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+)
+
+// Run processes events from the given channel in batches, calling fn for each batch.
+// Events are collected into batches during the time window with maximum threshold number of events.
+//
+// It is useful in cases of high event volume where events can be aggregated and
+// processed together in a single operation. For example, when reacting to role
+// change events and check what users have been affected by this change.
+// Instead of fetching all the users for each role change event
+// you can aggregate roles change events and fetch and process all users only once
+// instead of fetching all the users from each role change event.
+//
+// Example:
+//
+//	   opts := []batcher.Option{
+//	       batcher.WithClock(u.clock),
+//	       batcher.WithWindow(time.Second * 10),
+//	       batcher.WithThreshold(100),
+//	   }
+//
+//		err := batcher.Run(ctx, eventChan, func(batch []Event) error {
+//			log.Printf("Processing %d events", len(batch))
+//			return processEvents(batch)
+//		}, opts...))
+//
+// The function returns when the context is canceled, returning ctx.Err(),
+// when fn returns an error, returning that error, or when the events channel is closed.
+func Run[T any](ctx context.Context, events <-chan T, fn func(batch []T) error, opts ...Option) error {
+	collector := New[T](opts...)
+	return trace.Wrap(collector.Run(ctx, events, fn))
+}
+
+// RunWithState is like Run but also provides the current State to the processing function.
+// The state is managed by the provided StateMonitor and updated based on the batch size.
+func RunWithState[T any](
+	ctx context.Context,
+	events <-chan T,
+	fn func(batch []T, state State) error,
+	stateManager *StateMonitor,
+	opts ...Option,
+) error {
+	return trace.Wrap(Run(ctx, events, func(batch []T) error {
+		currentState := stateManager.UpdateState(len(batch))
+		return trace.Wrap(fn(batch, currentState))
+	}, opts...))
+}
+
+// Iter allows to iterate over batches of events.
+func Iter[T any](ctx context.Context, events <-chan T, opts ...Option) iter.Seq2[[]T, error] {
+	collector := New[T](opts...)
+	return func(yield func([]T, error) bool) {
+		for {
+			batch, err := collector.CollectBatch(ctx, events)
+			if !yield(batch, err) {
+				return
+			}
+		}
+	}
+}
+
+// Option configures a Collector using the functional options pattern.
+type Option func(*config)
+
+// WithWindow sets the collection window duration.
+func WithWindow(d time.Duration) Option {
+	return func(c *config) {
+		if d > 0 {
+			c.window = d
+		}
+	}
+}
+
+// WithThreshold sets the maximum number of events per batch.
+func WithThreshold(n int) Option {
+	return func(c *config) {
+		if n > 0 {
+			c.threshold = n
+		}
+	}
+}
+
+// WithClock sets a custom clock for testing.
+// Default uses the system clock.
+func WithClock(clock clockwork.Clock) Option {
+	return func(c *config) {
+		if clock != nil {
+			c.clock = clock
+		}
+	}
+}
+
+type config struct {
+	window    time.Duration
+	threshold int
+	clock     clockwork.Clock
+}
+
+// New creates a new Collector with the given options.
+func New[T any](opts ...Option) *Collector[T] {
+	cfg := config{
+		window:    10 * time.Second,
+		threshold: 50,
+		clock:     clockwork.NewRealClock(),
+	}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+	return &Collector[T]{config: cfg}
+}
+
+// Collector batches events into time windows.
+type Collector[T any] struct {
+	config
+}
+
+// Run starts collecting events and calls fn for each batch.
+// It blocks until ctx is canceled or an error occurs.
+func (c *Collector[T]) Run(ctx context.Context, events <-chan T, fn func(batch []T) error) error {
+	for {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+
+		batch, err := c.CollectBatch(ctx, events)
+		if err != nil {
+			return err
+		}
+
+		if len(batch) > 0 {
+			if err := fn(batch); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+}
+
+// CollectBatch collects events into a batch until the time window elapses
+// or the threshold is reached, whichever comes first.
+// It blocks until at least one event is collected or ctx is canceled.
+//
+// NOTE: CollectBatch returns already collected events if ctx is canceled.
+// If you want to still process then you need to check the error returned
+// and handle ctx.Err() case separately.
+func (c *Collector[T]) CollectBatch(ctx context.Context, events <-chan T) ([]T, error) {
+	var timer clockwork.Timer
+	var timeout <-chan time.Time
+	defer func() {
+		if timer != nil {
+			timer.Stop()
+		}
+	}()
+
+	batch := make([]T, 0, c.threshold)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return batch, ctx.Err()
+
+		case <-timeout:
+			return batch, nil
+
+		case event, ok := <-events:
+			if !ok {
+				// Channel closed, return what we have
+				return batch, io.EOF
+			}
+			batch = append(batch, event)
+			// The batch is full, return it
+			// to not allow to grow the memory indefinitely.
+			if len(batch) >= c.threshold {
+				return batch, nil
+			}
+			if len(batch) == 1 {
+				// Start the timer on the first event instead of during the call
+				// to avoid returning empty batches and block if there are no events.
+				if timer == nil {
+					timer = c.clock.NewTimer(c.window)
+					timeout = timer.Chan()
+				}
+			}
+
+		}
+	}
+}
diff --git a/lib/utils/batcher/batcher_test.go b/lib/utils/batcher/batcher_test.go
new file mode 100644
index 0000000000000..323a170b14495
--- /dev/null
+++ b/lib/utils/batcher/batcher_test.go
@@ -0,0 +1,129 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package batcher_test
+
+import (
+	"context"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/batcher"
+)
+
+func TestCollectBatch_TimeWindow(t *testing.T) {
+	fakeClock := clockwork.NewFakeClock()
+	collector := batcher.New[string](
+		batcher.WithWindow(100*time.Millisecond),
+		batcher.WithClock(fakeClock),
+		batcher.WithThreshold(10),
+	)
+
+	events := make(chan string)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	var batch []string
+	var err error
+
+	done := make(chan bool)
+	go func() {
+		batch, err = collector.CollectBatch(ctx, events)
+		done <- true
+	}()
+
+	events <- "event1"
+	fakeClock.BlockUntil(1)
+
+	events <- "event2"
+
+	fakeClock.Advance(100 * time.Millisecond)
+
+	<-done
+	require.NoError(t, err)
+	assert.Equal(t, []string{"event1", "event2"}, batch)
+}
+
+func TestCollectBatch_Threshold(t *testing.T) {
+	collector := batcher.New[int](batcher.WithThreshold(3))
+
+	events := make(chan int, 10)
+	for i := 1; i <= 7; i++ {
+		events <- i
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	batch, err := collector.CollectBatch(ctx, events)
+	require.NoError(t, err)
+	assert.Equal(t, []int{1, 2, 3}, batch)
+
+	batch, err = collector.CollectBatch(ctx, events)
+	require.NoError(t, err)
+	assert.Equal(t, []int{4, 5, 6}, batch)
+}
+
+func TestCollectBatch_ChannelClosed(t *testing.T) {
+	collector := batcher.New[string]()
+
+	events := make(chan string, 2)
+	events <- "event1"
+	events <- "event2"
+	close(events)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	batch, err := collector.CollectBatch(ctx, events)
+
+	require.ErrorIs(t, err, io.EOF)
+	assert.Equal(t, []string{"event1", "event2"}, batch)
+}
+
+func TestCollectBatch_ContextCanceled(t *testing.T) {
+	collector := batcher.New[string](batcher.WithWindow(1 * time.Hour))
+
+	events := make(chan string, 2)
+	events <- "event1"
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	_, err := collector.CollectBatch(ctx, events)
+	assert.Equal(t, context.Canceled, err)
+}
+
+func TestCollectBatch_EmptyChannel(t *testing.T) {
+	fakeClock := clockwork.NewFakeClock()
+	collector := batcher.New[string](
+		batcher.WithWindow(100*time.Millisecond),
+		batcher.WithClock(fakeClock),
+	)
+
+	events := make(chan string)
+	close(events)
+
+	ctx := context.Background()
+	batch, err := collector.CollectBatch(ctx, events)
+
+	require.ErrorIs(t, err, io.EOF)
+	assert.Empty(t, batch)
+}
diff --git a/lib/utils/batcher/state.go b/lib/utils/batcher/state.go
new file mode 100644
index 0000000000000..5a46da7bd5e03
--- /dev/null
+++ b/lib/utils/batcher/state.go
@@ -0,0 +1,199 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package batcher
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+)
+
+// State represents the current processing mode based on batch volume.
+type State int
+
+const (
+	// StateNormal indicates regular processing mode with normal event volume.
+	StateNormal State = iota
+	// StateOverloaded indicates high-volume processing mode when batch sizes
+	// when threshold is reached.
+	StateOverloaded
+)
+
+// String returns a human-readable representation of the State.
+func (s State) String() string {
+	switch s {
+	case StateNormal:
+		return "Normal"
+	case StateOverloaded:
+		return "Overloaded"
+	default:
+		return "Unknown"
+	}
+}
+
+// StateConfig configures state transitions and callbacks for a StateMonitor.
+type StateConfig struct {
+	// OnEnterOverloaded is called when transitioning from Normal to Overloaded state.
+	// This callback is invoked when batch size reaches or exceeds the threshold.
+	// Is not provided, no action is taken on state transition.
+	OnEnterOverloaded func()
+
+	// OnExitOverloaded is called when transitioning from the Overloaded state back to the Normal state.
+	//
+	// This callback is invoked in either of the following cases:
+	//   - When the batch size drops below half of the configured Threshold.
+	//   - In background goroutine when the OverloadedIdleTimeout period elapses without
+	//     receiving any new events, causing the state to automatically revert to Normal.
+	//
+	// If not provided, no action is taken on state transition.
+	OnExitOverloaded func()
+
+	// Threshold is the batch size threshold for state transitions.
+	// Normal -> Overloaded: when batchSize >= Threshold
+	// Overloaded -> Normal: when batchSize < Threshold/2
+	Threshold int
+
+	// OverloadedIdleTimeout is the quiet-period after which the monitor will (if still in
+	// StateOverloaded) automatically return to StateNormal even if no new batches arrive.
+	// If zero, the timer-based transition is disabled and the state will only return
+	// to Normal via an explicit size drop (< Threshold/2).
+	OverloadedIdleTimeout time.Duration
+
+	// Clock is used to control time. If nil, the system clock is used.
+	Clock clockwork.Clock
+}
+
+func (cfg *StateConfig) CheckAndSetDefaults() error {
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	if cfg.Threshold == 0 {
+		cfg.Threshold = 100
+	}
+	if cfg.OverloadedIdleTimeout != 0 && cfg.OverloadedIdleTimeout < time.Second {
+		return trace.BadParameter("OverloadedIdleTimeout must be at least 1s")
+	}
+	return nil
+}
+
+// StateMonitor monitors batch sizes and manages state transitions based on configured thresholds.
+type StateMonitor struct {
+	StateConfig
+
+	mu    sync.RWMutex
+	state State
+
+	lastReceived time.Time
+	stop         chan struct{}
+}
+
+// NewStateMonitor creates a new StateMonitor with the given configuration.
+// The monitor starts in Normal state by default.
+func NewStateMonitor(config StateConfig) (*StateMonitor, error) {
+	if err := config.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &StateMonitor{
+		state:       StateNormal,
+		StateConfig: config,
+		stop:        make(chan struct{}),
+	}, nil
+}
+
+// GetState returns the current state of the monitor.
+func (sm *StateMonitor) GetState() State {
+	sm.mu.RLock()
+	defer sm.mu.RUnlock()
+	return sm.state
+}
+
+func (sm *StateMonitor) Start(ctx context.Context) {
+	if sm.OverloadedIdleTimeout == 0 {
+		return
+	}
+	go sm.monitorIdle(ctx)
+}
+
+func (sm *StateMonitor) monitorIdle(ctx context.Context) {
+	ticker := sm.Clock.NewTicker(sm.OverloadedIdleTimeout)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-sm.stop:
+			return
+		case <-ticker.Chan():
+			sm.mu.Lock()
+			if sm.state == StateOverloaded && sm.lastReceived.Add(sm.OverloadedIdleTimeout).Before(sm.Clock.Now()) {
+				sm.state = StateNormal
+				sm.mu.Unlock()
+				if sm.OnExitOverloaded != nil {
+					sm.OnExitOverloaded()
+				}
+			} else {
+				sm.mu.Unlock()
+			}
+		}
+	}
+}
+
+// UpdateState evaluates the current batch size and updates the state if necessary.
+func (sm *StateMonitor) UpdateState(batchSize int) State {
+	sm.mu.Lock()
+	oldState := sm.state
+	newState := sm.evaluateState(batchSize)
+	sm.state = newState
+	sm.lastReceived = sm.Clock.Now()
+	sm.mu.Unlock()
+
+	if oldState != newState {
+		switch {
+		case oldState != StateOverloaded && newState == StateOverloaded:
+			if sm.StateConfig.OnEnterOverloaded != nil {
+				sm.StateConfig.OnEnterOverloaded()
+			}
+		case oldState == StateOverloaded && newState == StateNormal:
+			if sm.StateConfig.OnExitOverloaded != nil {
+				sm.StateConfig.OnExitOverloaded()
+			}
+		}
+	}
+	return newState
+}
+
+func (sm *StateMonitor) evaluateState(batchSize int) State {
+	if batchSize >= sm.StateConfig.Threshold {
+		// Threshold is reached, enter Overloaded state.
+		return StateOverloaded
+	}
+	if batchSize < sm.StateConfig.Threshold/2 {
+		// The batch event size dropped below half the threshold, return to Normal state.
+		return StateNormal
+	}
+	return sm.state
+}
+
+// Stop stops any internal timers used by the StateMonitor.
+func (sm *StateMonitor) Stop() {
+	close(sm.stop)
+}
diff --git a/lib/utils/batcher/state_test.go b/lib/utils/batcher/state_test.go
new file mode 100644
index 0000000000000..502fa6cc4ef9c
--- /dev/null
+++ b/lib/utils/batcher/state_test.go
@@ -0,0 +1,127 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+package batcher_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/batcher"
+)
+
+func TestStateManage(t *testing.T) {
+	enterStormCount := 0
+	exitStormCount := 0
+
+	config := batcher.StateConfig{
+		Threshold: 100,
+		OnEnterOverloaded: func() {
+			enterStormCount++
+		},
+		OnExitOverloaded: func() {
+			exitStormCount++
+		},
+	}
+
+	sm, err := batcher.NewStateMonitor(config)
+	require.NoError(t, err)
+	defer sm.Stop()
+
+	sm.UpdateState(50)
+	require.Equal(t, 0, enterStormCount)
+	require.Equal(t, 0, exitStormCount)
+
+	sm.UpdateState(100)
+	require.Equal(t, 1, enterStormCount)
+	require.Equal(t, 0, exitStormCount)
+
+	sm.UpdateState(150)
+	require.Equal(t, 1, enterStormCount)
+	require.Equal(t, 0, exitStormCount)
+
+	sm.UpdateState(40)
+	require.Equal(t, 1, enterStormCount)
+	require.Equal(t, 1, exitStormCount)
+
+	sm.UpdateState(20)
+	require.Equal(t, 1, enterStormCount)
+	require.Equal(t, 1, exitStormCount)
+
+	sm.UpdateState(100)
+	require.Equal(t, 2, enterStormCount)
+	require.Equal(t, 1, exitStormCount)
+}
+
+func TestStateMonitor_IdleTimer(t *testing.T) {
+	fc := clockwork.NewFakeClock()
+
+	enterStormCount := 0
+	exitStormCount := 0
+	exitCh := make(chan struct{}, 1)
+
+	cfg := batcher.StateConfig{
+		Threshold:             100,
+		OverloadedIdleTimeout: 10 * time.Second,
+		Clock:                 fc,
+		OnEnterOverloaded: func() {
+			enterStormCount++
+		},
+		OnExitOverloaded: func() {
+			exitStormCount++
+			select {
+			case exitCh <- struct{}{}:
+			default:
+			}
+		},
+	}
+
+	sm, err := batcher.NewStateMonitor(cfg)
+	require.NoError(t, err)
+	sm.Start(t.Context())
+	defer sm.Stop()
+
+	sm.UpdateState(200)
+	require.Equal(t, batcher.StateOverloaded, sm.GetState())
+	require.Equal(t, 1, enterStormCount)
+	require.Equal(t, 0, exitStormCount)
+
+	fc.Advance(500 * time.Millisecond)
+	require.Equal(t, batcher.StateOverloaded, sm.GetState())
+	require.Equal(t, 0, exitStormCount)
+
+	sm.UpdateState(150)
+	require.Equal(t, batcher.StateOverloaded, sm.GetState())
+
+	// Advance another 700ms not new events but this state is still overloaded.
+	fc.Advance(700 * time.Millisecond)
+	require.Equal(t, batcher.StateOverloaded, sm.GetState())
+	require.Equal(t, 0, exitStormCount)
+
+	require.NoError(t, fc.BlockUntilContext(t.Context(), 1))
+	fc.Advance(21 * time.Second)
+
+	select {
+	case <-exitCh:
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("expected OnExitOverloaded to fire after idle timeout")
+	}
+
+	require.Equal(t, batcher.StateNormal, sm.GetState())
+	require.Equal(t, 1, exitStormCount)
+}
diff --git a/lib/utils/cert/certs.go b/lib/utils/cert/certs.go
index 47de43a21a42f..da05058eb5a1e 100644
--- a/lib/utils/cert/certs.go
+++ b/lib/utils/cert/certs.go
@@ -53,11 +53,7 @@ func createCertificate(principal string, certType uint32, algo cryptosuites.Algo
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	caPublicKey, err := ssh.NewPublicKey(caKey.Public())
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	caSigner, err := ssh.NewSignerFromKey(caKey)
+	caSigner, err := ssh.NewSignerFromSigner(caKey)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -81,7 +77,6 @@ func createCertificate(principal string, certType uint32, algo cryptosuites.Algo
 		KeyId:           principal,
 		ValidPrincipals: []string{principal},
 		Key:             publicKey,
-		SignatureKey:    caPublicKey,
 		ValidAfter:      uint64(time.Now().UTC().Add(-1 * time.Minute).Unix()),
 		ValidBefore:     uint64(time.Now().UTC().Add(1 * time.Minute).Unix()),
 		CertType:        certType,
diff --git a/lib/service/certreloader.go b/lib/utils/certreloader/certreloader.go
similarity index 77%
rename from lib/service/certreloader.go
rename to lib/utils/certreloader/certreloader.go
index 11da660b6b2d7..809819f0f59a0 100644
--- a/lib/service/certreloader.go
+++ b/lib/utils/certreloader/certreloader.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package service
+package certreloader
 
 import (
 	"context"
@@ -32,9 +32,9 @@ import (
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 )
 
-// CertReloaderConfig contains the configuration of the certificate reloader.
-type CertReloaderConfig struct {
-	// KeyPairs are the key and certificate pairs that the proxy will load.
+// Config contains the configuration of the certificate reloader.
+type Config struct {
+	// KeyPairs are the key and certificate pairs that the reloader will load.
 	KeyPairs []servicecfg.KeyPairPath
 	// KeyPairsReloadInterval is the interval between attempts to reload
 	// x509 key pairs. If set to 0, then periodic reloading is disabled.
@@ -46,19 +46,26 @@ type CertReloaderConfig struct {
 type CertReloader struct {
 	logger *slog.Logger
 	// cfg is the certificate reloader configuration.
-	cfg CertReloaderConfig
+	cfg Config
 
 	// certificates is the list of certificates loaded.
 	certificates []tls.Certificate
 	// mu protects the list of certificates.
 	mu sync.RWMutex
+
+	// onLoad, if not nil, is called on each certificate after successful load
+	onLoad func(path string, cert *x509.Certificate)
 }
 
-// NewCertReloader initializes a new certificate reloader.
-func NewCertReloader(cfg CertReloaderConfig) *CertReloader {
+// New initializes a new certificate reloader.
+func New(cfg Config, log *slog.Logger, onLoad func(path string, cert *x509.Certificate)) *CertReloader {
+	if log == nil {
+		log = slog.With(teleport.ComponentKey, "certreloader")
+	}
 	return &CertReloader{
-		logger: slog.With(teleport.ComponentKey, teleport.Component(teleport.ComponentProxy, "certreloader")),
+		logger: log,
 		cfg:    cfg,
+		onLoad: onLoad,
 	}
 }
 
@@ -102,6 +109,7 @@ func (c *CertReloader) Run(ctx context.Context) error {
 // If any of the key pairs fails to load, none of the certificates are updated.
 func (c *CertReloader) loadCertificates(ctx context.Context) error {
 	certs := make([]tls.Certificate, 0, len(c.cfg.KeyPairs))
+
 	for _, pair := range c.cfg.KeyPairs {
 		c.logger.DebugContext(ctx, "Loading TLS certificate",
 			"public_key", pair.Certificate,
@@ -127,6 +135,12 @@ func (c *CertReloader) loadCertificates(ctx context.Context) error {
 		certs = append(certs, certificate)
 	}
 
+	for i := range c.cfg.KeyPairs {
+		if c.onLoad != nil {
+			c.onLoad(c.cfg.KeyPairs[i].Certificate, certs[i].Leaf)
+		}
+	}
+
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.certificates = certs
@@ -160,3 +174,22 @@ func (c *CertReloader) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Ce
 	// If nothing matches, return the first certificate.
 	return &c.certificates[0], nil
 }
+
+// GetClientCertificate is compatible with tls.Config.GetClientCertificate, allowing
+// the CertReloader to be a source of certificates for mTLS connections.
+// certificate selection log is the same as the GetClientCertificate in crypto/tls
+// https://github.com/golang/go/blob/f64c2a2ce5dc859315047184e310879dcf747d53/src/crypto/tls/handshake_client.go#L977
+func (c *CertReloader) GetClientCertificate(requestInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	for _, cert := range c.certificates {
+		if err := requestInfo.SupportsCertificate(&cert); err != nil {
+			continue
+		}
+		return &cert, nil
+	}
+
+	// No acceptable certificate found. Don't send a certificate.
+	return new(tls.Certificate), nil
+}
diff --git a/lib/service/certreloader_test.go b/lib/utils/certreloader/certreloader_test.go
similarity index 97%
rename from lib/service/certreloader_test.go
rename to lib/utils/certreloader/certreloader_test.go
index af424eb3648bf..8b46e71aba9cd 100644
--- a/lib/service/certreloader_test.go
+++ b/lib/utils/certreloader/certreloader_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package service
+package certreloader
 
 import (
 	"context"
@@ -136,7 +136,7 @@ func TestCertReloader(t *testing.T) {
 			desc: "c0 and c1 certs do not change if one of them is corrupted",
 			certsUpdate: func(t *testing.T, certs []servicecfg.KeyPairPath) {
 				// Corrupt c0 cert key.
-				f, err := os.OpenFile(certs[0].PrivateKey, os.O_WRONLY, 0600)
+				f, err := os.OpenFile(certs[0].PrivateKey, os.O_WRONLY, 0o600)
 				require.NoError(t, err)
 				_, err = f.WriteAt([]byte{1, 2, 3, 4, 5, 6, 7, 8}, 0)
 				require.NoError(t, err)
@@ -164,11 +164,11 @@ func TestCertReloader(t *testing.T) {
 			// Set the reload interval to 0 so that the reloading goroutine is not spawned.
 			// This gives us more flexibility in the tests, so that we can call loadCertificates
 			// when we want.
-			cfg := CertReloaderConfig{
+			cfg := Config{
 				KeyPairs:               certs,
 				KeyPairsReloadInterval: 0,
 			}
-			certReloader := NewCertReloader(cfg)
+			certReloader := New(cfg, nil, nil)
 			err := certReloader.Run(ctx)
 
 			// Check that certificates load correctly in the synchronous (first) attempt.
@@ -232,6 +232,6 @@ func newCertKeyPair(t *testing.T) ([]byte, []byte) {
 
 // write rewrites the file with a new `content`.
 func write(t *testing.T, filename string, content []byte) {
-	err := os.WriteFile(filename, content, 0600)
+	err := os.WriteFile(filename, content, 0o600)
 	require.NoError(t, err)
 }
diff --git a/lib/utils/certs.go b/lib/utils/certs.go
index b18f1afb00cad..798ec7f2be9b0 100644
--- a/lib/utils/certs.go
+++ b/lib/utils/certs.go
@@ -142,6 +142,15 @@ func VerifyCertificateExpiry(c *x509.Certificate, clock clockwork.Clock) error {
 	return nil
 }
 
+// VerifyTLSCertLeafExpiry checks a TLS certificate's expiration status.
+func VerifyTLSCertLeafExpiry(cert tls.Certificate, clock clockwork.Clock) error {
+	leaf, err := TLSCertLeaf(cert)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(VerifyCertificateExpiry(leaf, clock))
+}
+
 // VerifyCertificateChain reads in chain of certificates and makes sure the
 // chain from leaf to root is valid. This ensures that clients (web browsers
 // and CLI) won't have problem validating the chain.
diff --git a/lib/utils/certs_test.go b/lib/utils/certs_test.go
index 672e8336d9af3..84e445b9fd430 100644
--- a/lib/utils/certs_test.go
+++ b/lib/utils/certs_test.go
@@ -19,13 +19,17 @@
 package utils
 
 import (
+	"crypto/tls"
 	"runtime"
 	"testing"
+	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/fixtures"
 )
 
 func TestRejectsInvalidPEMData(t *testing.T) {
@@ -60,3 +64,49 @@ func TestNewCertPoolFromPath(t *testing.T) {
 	//nolint:staticcheck // Pool not returned by SystemCertPool
 	require.Len(t, pool.Subjects(), 1)
 }
+
+func TestVerifyTLSCertLeafExpiry(t *testing.T) {
+	tlsCert, err := tls.X509KeyPair([]byte(fixtures.TLSCACertPEM), []byte(fixtures.TLSCAKeyPEM))
+	require.NoError(t, err)
+	emptyCert := tls.Certificate{}
+
+	tests := []struct {
+		name        string
+		input       tls.Certificate
+		fakeTime    time.Time
+		checkResult require.ErrorAssertionFunc
+	}{
+		{
+			name:        "empty",
+			input:       emptyCert,
+			fakeTime:    time.Now(),
+			checkResult: require.Error,
+		},
+		{
+			name:        "valid",
+			input:       tlsCert,
+			fakeTime:    fixtures.TLSCACertNotAfter.Add(-time.Minute),
+			checkResult: require.NoError,
+		},
+		{
+			name:        "not valid yet",
+			input:       tlsCert,
+			fakeTime:    fixtures.TLSCACertNotBefore.Add(-time.Minute),
+			checkResult: require.Error,
+		},
+		{
+			name:        "expired",
+			input:       tlsCert,
+			fakeTime:    fixtures.TLSCACertNotAfter.Add(time.Minute),
+			checkResult: require.Error,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clock := clockwork.NewFakeClockAt(tt.fakeTime)
+			err := VerifyTLSCertLeafExpiry(tt.input, clock)
+			tt.checkResult(t, err)
+		})
+	}
+}
diff --git a/lib/utils/cli.go b/lib/utils/cli.go
index a025a301a350b..9f1ca885379ae 100644
--- a/lib/utils/cli.go
+++ b/lib/utils/cli.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"crypto/x509"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"log/slog"
@@ -31,8 +30,6 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
-	"sync"
-	"testing"
 	"unicode"
 
 	"github.com/alecthomas/kingpin/v2"
@@ -54,6 +51,8 @@ const (
 	LoggingForDaemon LoggingPurpose = iota
 	// LoggingForCLI configures logging for user face utilities (tctl, tsh).
 	LoggingForCLI
+	// LoggingForMCP configures logging for MCP servers.
+	LoggingForMCP
 )
 
 // LoggingFormat defines the possible logging output formats.
@@ -100,7 +99,7 @@ func IsTerminal(w io.Writer) bool {
 }
 
 // InitLogger configures the global logger for a given purpose / verbosity level
-func InitLogger(purpose LoggingPurpose, level slog.Level, opts ...LoggerOption) error {
+func InitLogger(purpose LoggingPurpose, level slog.Level, opts ...LoggerOption) (*slog.Logger, error) {
 	var o logOpts
 
 	for _, opt := range opts {
@@ -110,51 +109,28 @@ func InitLogger(purpose LoggingPurpose, level slog.Level, opts ...LoggerOption)
 	// If debug or trace logging is not enabled for CLIs,
 	// then discard all log output.
 	if purpose == LoggingForCLI && level > slog.LevelDebug {
-		slog.SetDefault(slog.New(slog.DiscardHandler))
-		return nil
+		logger := slog.New(slog.DiscardHandler)
+		slog.SetDefault(logger)
+		return logger, nil
 	}
 
 	var output string
-	if o.osLogSubsystem != "" {
+	switch {
+	case o.osLogSubsystem != "":
 		output = logutils.LogOutputOSLog
+	case purpose == LoggingForMCP:
+		output = logutils.LogOutputMCP
+		o.format = LogFormatJSON
 	}
 
-	_, _, err := logutils.Initialize(logutils.Config{
+	logger, _, _, err := logutils.Initialize(logutils.Config{
 		Severity:       level.String(),
 		Format:         o.format,
 		EnableColors:   IsTerminal(os.Stderr),
 		Output:         output,
 		OSLogSubsystem: o.osLogSubsystem,
 	})
-	return trace.Wrap(err)
-}
-
-var initTestLoggerOnce = sync.Once{}
-
-// InitLoggerForTests initializes the standard logger for tests.
-func InitLoggerForTests() {
-	initTestLoggerOnce.Do(func() {
-		if !flag.Parsed() {
-			// Parse flags to check testing.Verbose().
-			flag.Parse()
-		}
-
-		if !testing.Verbose() {
-			slog.SetDefault(slog.New(slog.DiscardHandler))
-			return
-		}
-
-		logutils.Initialize(logutils.Config{
-			Severity: slog.LevelDebug.String(),
-			Format:   LogFormatJSON,
-		})
-	})
-}
-
-// NewSlogLoggerForTests creates a new slog logger for test environments.
-func NewSlogLoggerForTests() *slog.Logger {
-	InitLoggerForTests()
-	return slog.Default()
+	return logger, trace.Wrap(err)
 }
 
 // FatalError is for CLI front-ends: it detects gravitational/trace debugging
@@ -262,6 +238,51 @@ func formatCertError(err error) string {
 
 	var hostnameErr x509.HostnameError
 	if errors.As(err, &hostnameErr) {
+		// Special case for connecting to Auth via Proxy using internal cluster domain.
+		if strings.HasSuffix(hostnameErr.Host, ".teleport.cluster.local") {
+			var proxyEnvBuilder strings.Builder
+			for _, key := range []string{
+				"https_proxy", "http_proxy", "no_proxy",
+				"HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY",
+			} {
+				if val, ok := os.LookupEnv(key); ok {
+					fmt.Fprintf(&proxyEnvBuilder, "    %s: %s\n", key, val)
+				}
+			}
+
+			return fmt.Sprintf(`Cannot connect to the Auth service via the Teleport Proxy.
+
+  There might be one or more network intermediaries (like a proxy or VPN) that are modifying your connection before it
+  reaches the Teleport Proxy. These intermediaries can alter how your connection is seen by the Teleport Proxy and
+  routed, leading to certificate mismatches.
+
+  To fix this, ensure that any network intermediaries are properly configured and not interfering with your connection.
+
+DEBUG INFO:
+  Host: %s
+
+  Proxy Environment Variables:
+%s
+  Server Certificate Details:
+    Subject: %s
+    Issuer: %s
+    Serial Number: %s
+    Not Before: %s
+    Not After: %s
+    DNS Names: %v
+    IP Addresses: %v`,
+				hostnameErr.Host,
+				proxyEnvBuilder.String(),
+				hostnameErr.Certificate.Subject,
+				hostnameErr.Certificate.Issuer,
+				hostnameErr.Certificate.SerialNumber,
+				hostnameErr.Certificate.NotBefore,
+				hostnameErr.Certificate.NotAfter,
+				hostnameErr.Certificate.DNSNames,
+				hostnameErr.Certificate.IPAddresses,
+			)
+		}
+
 		return fmt.Sprintf("Cannot establish https connection to %s:\n%s\n%s\n",
 			hostnameErr.Host,
 			hostnameErr.Error(),
@@ -319,6 +340,18 @@ func InitCLIParser(appName, appHelp string) (app *kingpin.Application) {
 	return app.UsageTemplate(createUsageTemplate())
 }
 
+// InitHiddenCLIParser initializes a `kingpin.Application` that does not terminate the application
+// or write any usage information to os.Stdout. Can be used in scenarios where multiple `kingpin.Application`
+// instances are needed without interfering with subsequent parsing. Usage output is completely suppressed,
+// and the default global `--help` flag is ignored to prevent the application from exiting.
+func InitHiddenCLIParser() (app *kingpin.Application) {
+	app = kingpin.New("", "")
+	app.UsageWriter(io.Discard)
+	app.Terminate(func(i int) {})
+
+	return app
+}
+
 // createUsageTemplate creates an usage template for kingpin applications.
 func createUsageTemplate(opts ...func(*usageTemplateOptions)) string {
 	opt := &usageTemplateOptions{
@@ -331,54 +364,6 @@ func createUsageTemplate(opts ...func(*usageTemplateOptions)) string {
 	return fmt.Sprintf(defaultUsageTemplate, opt.commandPrintfWidth)
 }
 
-// UpdateAppUsageTemplate updates usage template for kingpin applications by
-// pre-parsing the arguments then applying any changes to the usage template if
-// necessary.
-func UpdateAppUsageTemplate(app *kingpin.Application, args []string) {
-	app.UsageTemplate(createUsageTemplate(
-		withCommandPrintfWidth(app, args),
-	))
-}
-
-// withCommandPrintfWidth returns a usage template option that
-// updates command printf width if longer than default.
-func withCommandPrintfWidth(app *kingpin.Application, args []string) func(*usageTemplateOptions) {
-	return func(opt *usageTemplateOptions) {
-		var commands []*kingpin.CmdModel
-
-		// When selected command is "help", skip the "help" arg
-		// so the intended command is selected for calculation.
-		if len(args) > 0 && args[0] == "help" {
-			args = args[1:]
-		}
-
-		appContext, err := app.ParseContext(args)
-		switch {
-		case appContext == nil:
-			slog.WarnContext(context.Background(), "No application context found")
-			return
-
-		// Note that ParseContext may return the current selected command that's
-		// causing the error. We should continue in those cases when appContext is
-		// not nil.
-		case err != nil:
-			slog.InfoContext(context.Background(), "Error parsing application context", "error", err)
-		}
-
-		if appContext.SelectedCommand != nil {
-			commands = appContext.SelectedCommand.Model().FlattenedCommands()
-		} else {
-			commands = app.Model().FlattenedCommands()
-		}
-
-		for _, command := range commands {
-			if !command.Hidden && len(command.FullCommand) > opt.commandPrintfWidth {
-				opt.commandPrintfWidth = len(command.FullCommand)
-			}
-		}
-	}
-}
-
 // SplitIdentifiers splits list of identifiers by commas/spaces/newlines.  Helpful when
 // accepting lists of identifiers in CLI (role names, request IDs, etc).
 func SplitIdentifiers(s string) []string {
@@ -491,7 +476,7 @@ Usage: {{.App.Name}}{{template "FormatUsage" .App}}
 {{end -}}
 {{if .Context.Flags -}}
 Flags:
-{{.Context.Flags|FlagsToTwoColumnsCompact|FormatTwoColumns}}
+{{.Context.Flags|FlagsToTwoColumns|FormatTwoColumns}}
 {{end -}}
 {{if .Context.Args -}}
 Args:
@@ -556,3 +541,27 @@ func FormatAlert(alert types.ClusterAlert) string {
 	}
 	return buf.String()
 }
+
+// FilterArguments filters the input arguments, keeping only those defined in the provided `kingpin.ApplicationModel`.
+// For example, if the model defines only one boolean flag `--insecure`, all other arguments in `args`
+// will be excluded, and only the `--insecure` flag will remain.
+func FilterArguments(args []string, model *kingpin.ApplicationModel) []string {
+	var result []string
+	for _, flag := range model.Flags {
+		for i := range args {
+			if strings.HasPrefix(args[i], fmt.Sprint("--", flag.Name, "=")) {
+				result = append(result, args[i])
+				break
+			}
+			if args[i] == fmt.Sprint("--", flag.Name) {
+				if flag.IsBoolFlag() {
+					result = append(result, args[i])
+				} else if i+2 <= len(args) {
+					result = append(result, args[i], args[i+1])
+				}
+				break
+			}
+		}
+	}
+	return result
+}
diff --git a/lib/utils/cli_test.go b/lib/utils/cli_test.go
index 23449430c960f..d9b2b04609a12 100644
--- a/lib/utils/cli_test.go
+++ b/lib/utils/cli_test.go
@@ -19,10 +19,9 @@
 package utils
 
 import (
-	"bytes"
 	"crypto/x509"
+	"errors"
 	"fmt"
-	"io"
 	"log/slog"
 	"testing"
 
@@ -164,81 +163,95 @@ func TestAllowWhitespace(t *testing.T) {
 	}
 }
 
-func TestUpdateAppUsageTemplate(t *testing.T) {
-	makeApp := func(usageWriter io.Writer) *kingpin.Application {
-		app := InitCLIParser("TestUpdateAppUsageTemplate", "some help message")
-		app.UsageWriter(usageWriter)
-		app.Terminate(func(int) {})
-
-		app.Command("hello", "Hello.")
+// TestFilterArguments tests filtering command arguments.
+func TestFilterArguments(t *testing.T) {
+	t.Parallel()
 
-		create := app.Command("create", "Create.")
-		create.Command("box", "Box.")
-		create.Command("rocket", "Rocket.")
-		return app
-	}
+	app := kingpin.New("tsh", "")
+	app.Flag("proxy", "").String()
+	app.Flag("check-update", "").Bool()
 
 	tests := []struct {
-		name           string
-		inputArgs      []string
-		outputContains string
+		args     []string
+		expected []string
 	}{
 		{
-			name:      "command width aligned for app help",
-			inputArgs: []string{},
-			outputContains: `
-Commands:
-  help          Show help.
-  hello         Hello.
-  create box    Box.
-  create rocket Rocket.
-`,
-		},
-		{
-			name:      "command width aligned for command help",
-			inputArgs: []string{"create"},
-			outputContains: `
-Commands:
-  create box    Box.
-  create rocket Rocket.
-`,
-		},
-		{
-			name:      "command width aligned for unknown command error",
-			inputArgs: []string{"unknown"},
-			outputContains: `
-Commands:
-  help          Show help.
-  hello         Hello.
-  create box    Box.
-  create rocket Rocket.
-`,
+			args:     []string{"--insecure", "--proxy", "localhost", "--check-update", "test"},
+			expected: []string{"--proxy", "localhost", "--check-update"},
+		},
+		{
+			args:     []string{"--insecure", "--proxy=localhost", "--check-update", "test"},
+			expected: []string{"--proxy=localhost", "--check-update"},
+		},
+		{
+			args:     []string{"--proxy", "localhost", "test"},
+			expected: []string{"--proxy", "localhost"},
+		},
+		{
+			args:     []string{"--proxy"},
+			expected: []string(nil),
+		},
+		{
+			args:     []string{"--insecure", "--check-update", "test", "--proxy=localhost"},
+			expected: []string{"--proxy=localhost", "--check-update"},
+		},
+		{
+			args:     []string{"--insecure", "--check-update", "test", "--proxy1=localhost"},
+			expected: []string{"--check-update"},
+		},
+		{
+			args:     []string{"--check-update", "test", "--proxy1", "localhost"},
+			expected: []string{"--check-update"},
+		},
+		{
+			args:     []string{"--insecure", "test", "--proxy1", "localhost", "--check-update"},
+			expected: []string{"--check-update"},
 		},
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Run("help flag", func(t *testing.T) {
-				var buffer bytes.Buffer
-				app := makeApp(&buffer)
-				args := append(tt.inputArgs, "--help")
-				UpdateAppUsageTemplate(app, args)
-
-				app.Usage(args)
-				require.Contains(t, buffer.String(), tt.outputContains)
-			})
-
-			t.Run("help command", func(t *testing.T) {
-				var buffer bytes.Buffer
-				app := makeApp(&buffer)
-				args := append([]string{"help"}, tt.inputArgs...)
-				UpdateAppUsageTemplate(app, args)
-
-				// HelpCommand is triggered on PreAction during Parse.
-				// See kingpin.Application.init for more details.
-				_, err := app.Parse(args)
-				require.NoError(t, err)
-				require.Contains(t, buffer.String(), tt.outputContains)
-			})
-		})
+
+	for i, tt := range tests {
+		require.Equal(t, tt.expected, FilterArguments(tt.args, app.Model()), fmt.Sprintf("test case %v", i))
 	}
 }
+
+// TestFormatCertError tests the formatCertError function for various x509 error types and messages.
+func TestFormatCertError(t *testing.T) {
+	t.Run("UnknownAuthorityError", func(t *testing.T) {
+		err := x509.UnknownAuthorityError{}
+		msg := formatCertError(err)
+		require.Contains(t, msg, "The proxy you are connecting to has presented a certificate signed by a")
+	})
+
+	t.Run("HostnameErrorConnectingToAuth", func(t *testing.T) {
+		cert := &x509.Certificate{Raw: []byte("dummy")}
+		err := x509.HostnameError{Certificate: cert, Host: "99999999999999999999999999999999.teleport.cluster.local"}
+		msg := formatCertError(err)
+		require.Contains(t, msg, "Cannot connect to the Auth service via the Teleport Proxy.")
+		require.Contains(t, msg, "Host: 99999999999999999999999999999999.teleport.cluster.local")
+	})
+
+	t.Run("HostnameError", func(t *testing.T) {
+		cert := &x509.Certificate{Raw: []byte("dummy")}
+		err := x509.HostnameError{Certificate: cert, Host: "example.com"}
+		msg := formatCertError(err)
+		require.Contains(t, msg, "Cannot establish https connection to example.com")
+	})
+
+	t.Run("CertificateInvalidError", func(t *testing.T) {
+		err := x509.CertificateInvalidError{Reason: x509.Expired, Cert: &x509.Certificate{}}
+		msg := formatCertError(err)
+		require.Contains(t, msg, "The certificate presented by the proxy is invalid")
+	})
+
+	t.Run("CertificateNotTrustedError", func(t *testing.T) {
+		err := errors.New("certificate is not trusted")
+		msg := formatCertError(err)
+		require.Contains(t, msg, "The proxy you are connecting to has presented a certificate signed by")
+	})
+
+	t.Run("NoMatch", func(t *testing.T) {
+		err := errors.New("some other error")
+		msg := formatCertError(err)
+		require.Empty(t, msg)
+	})
+}
diff --git a/lib/utils/diagnostics/latency/monitor_test.go b/lib/utils/diagnostics/latency/monitor_test.go
index 4e2afcbde4464..2d6245aa796bf 100644
--- a/lib/utils/diagnostics/latency/monitor_test.go
+++ b/lib/utils/diagnostics/latency/monitor_test.go
@@ -28,11 +28,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 
 	os.Exit(m.Run())
 }
diff --git a/lib/utils/dns/locate.go b/lib/utils/dns/locate.go
new file mode 100644
index 0000000000000..74dcd0b6be68f
--- /dev/null
+++ b/lib/utils/dns/locate.go
@@ -0,0 +1,66 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package dns
+
+import (
+	"cmp"
+	"context"
+	"net"
+	"strconv"
+
+	"github.com/gravitational/trace"
+)
+
+// Resolver interface wraps the net.Resolver methods needed for testing
+type Resolver interface {
+	LookupSRV(ctx context.Context, service, proto, name string) (string, []*net.SRV, error)
+}
+
+// LocateServerBySRV looks up a server of a given service and port
+// in an Active Directory environment by implementing the
+// DNS-based discovery DC locator process.
+//
+// See https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/dc-locator?tabs=dns-based-discovery
+func LocateServerBySRV(ctx context.Context, domain string, site string, resolver Resolver, service string, port string) ([]string, error) {
+	tryDomain := domain
+	if site != "" {
+		tryDomain = site + "._sites." + domain
+	}
+
+	_, records, err := resolver.LookupSRV(ctx, service, "tcp", tryDomain)
+	if err != nil && site != "" {
+		// If the site lookup fails, try the domain directly.
+		_, records, err = resolver.LookupSRV(ctx, service, "tcp", domain)
+	}
+
+	if err != nil {
+		return nil, trace.Wrap(err, "looking up SRV records for %v", domain)
+	}
+
+	// note: LookupSRV already returns records sorted by priority and takes in to account weights
+	var result []string
+	for _, record := range records {
+		// If a port has been passed, use that.
+		// If not, use the port returned by the SRV record.
+		usePort := cmp.Or(port, strconv.Itoa(int(record.Port)))
+		result = append(result, net.JoinHostPort(record.Target, usePort))
+	}
+
+	return result, nil
+}
diff --git a/lib/utils/dns/locate_test.go b/lib/utils/dns/locate_test.go
new file mode 100644
index 0000000000000..e660ff81e8891
--- /dev/null
+++ b/lib/utils/dns/locate_test.go
@@ -0,0 +1,170 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package dns
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLocateServerBySRV(t *testing.T) {
+	for _, test := range []struct {
+		name           string
+		domain         string
+		site           string
+		service        string
+		port           string
+		mockSRVRecords map[string][]*net.SRV
+		mockSRVErrors  map[string]error
+		expectedResult []string
+		expectedError  string
+	}{
+		{
+			name:    "successful lookup without site",
+			domain:  "example.com",
+			site:    "",
+			service: "ldap",
+			port:    "",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.example.com": {
+					{Target: "dc1.example.com.", Port: 389, Priority: 0, Weight: 5},
+					{Target: "dc2.example.com.", Port: 389, Priority: 1, Weight: 5},
+				},
+			},
+			expectedResult: []string{"dc1.example.com.:389", "dc2.example.com.:389"},
+		},
+		{
+			name:    "successful lookup with site",
+			domain:  "example.com",
+			site:    "site1",
+			service: "ldap",
+			port:    "",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.site1._sites.example.com": {
+					{Target: "dc1-site1.example.com.", Port: 389, Priority: 0, Weight: 5},
+				},
+			},
+			expectedResult: []string{"dc1-site1.example.com.:389"},
+		},
+		{
+			name:    "site lookup fails, fallback to domain succeeds",
+			domain:  "example.com",
+			site:    "site1",
+			service: "ldap",
+			port:    "",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.example.com": {
+					{Target: "dc1.example.com.", Port: 389, Priority: 0, Weight: 5},
+				},
+			},
+			mockSRVErrors: map[string]error{
+				"_ldap._tcp.site1._sites.example.com": &net.DNSError{Name: "site1._sites.example.com", Err: "no such host"},
+			},
+			expectedResult: []string{"dc1.example.com.:389"},
+		},
+		{
+			name:    "both site and domain lookups fail",
+			domain:  "example.com",
+			site:    "site1",
+			service: "ldap",
+			port:    "",
+			mockSRVErrors: map[string]error{
+				"_ldap._tcp.site1._sites.example.com": &net.DNSError{Name: "site1._sites.example.com", Err: "no such host"},
+				"_ldap._tcp.example.com":              &net.DNSError{Name: "example.com", Err: "no such host"},
+			},
+			expectedError: "looking up SRV records",
+		},
+		{
+			name:    "successful port override",
+			domain:  "example.com",
+			site:    "",
+			service: "ldap",
+			port:    "636",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.example.com": {
+					{Target: "dc1.example.com.", Port: 389, Priority: 0, Weight: 5},
+				},
+			},
+			expectedResult: []string{"dc1.example.com.:636"},
+		},
+		{
+			name:    "empty results",
+			domain:  "example.com",
+			site:    "",
+			service: "ldap",
+			port:    "",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.example.com": {},
+			},
+			expectedResult: nil,
+		},
+		{
+			name:    "multiple records with IPv6 target",
+			domain:  "example.com",
+			site:    "",
+			service: "ldap",
+			port:    "",
+			mockSRVRecords: map[string][]*net.SRV{
+				"_ldap._tcp.example.com": {
+					{Target: "dc1.example.com.", Port: 389, Priority: 0, Weight: 5},
+					{Target: "2001:db8::1.", Port: 389, Priority: 0, Weight: 5},
+				},
+			},
+			expectedResult: []string{"dc1.example.com.:389", "[2001:db8::1.]:389"},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			resolver := &mockResolver{
+				srvRecords: test.mockSRVRecords,
+				srvErrors:  test.mockSRVErrors,
+			}
+
+			result, err := LocateServerBySRV(context.Background(), test.domain, test.site, resolver, test.service, test.port)
+
+			if test.expectedError != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), test.expectedError)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Equal(t, test.expectedResult, result)
+		})
+	}
+}
+
+type mockResolver struct {
+	srvRecords map[string][]*net.SRV
+	srvErrors  map[string]error
+}
+
+func (m *mockResolver) LookupSRV(ctx context.Context, service, proto, name string) (string, []*net.SRV, error) {
+	key := "_" + service + "._" + proto + "." + name
+
+	if err, exists := m.srvErrors[key]; exists {
+		return "", nil, err
+	}
+
+	if records, exists := m.srvRecords[key]; exists {
+		return name, records, nil
+	}
+
+	return "", nil, &net.DNSError{Name: name, Err: "no such host"}
+}
diff --git a/lib/utils/dns/resolver.go b/lib/utils/dns/resolver.go
new file mode 100644
index 0000000000000..05dec51b19b6e
--- /dev/null
+++ b/lib/utils/dns/resolver.go
@@ -0,0 +1,60 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package dns
+
+import (
+	"context"
+	"log/slog"
+	"net"
+)
+
+// NewResolver creates and returns a DNS resolver
+//
+// DNSServerAddress, if set, will be used to resolve DNS requests. If
+// it is left blank, the default system resolver will be used.
+func NewResolver(ctx context.Context, dnsServerAddress string, logger *slog.Logger) *net.Resolver {
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	dialer := net.Dialer{}
+	dial := func(dialCtx context.Context, network, address string) (net.Conn, error) {
+		return dialer.DialContext(dialCtx, network, address)
+	}
+
+	if dnsServerAddress != "" {
+		logger.DebugContext(ctx, "Using custom DNS resolver address", "address", dnsServerAddress)
+
+		host, port, err := net.SplitHostPort(dnsServerAddress)
+		if err != nil {
+			host = dnsServerAddress
+			port = "53"
+		}
+
+		customResolverAddr := net.JoinHostPort(host, port)
+		dial = func(ctx context.Context, network, address string) (net.Conn, error) {
+			return dialer.DialContext(ctx, network, customResolverAddr)
+		}
+	}
+
+	resolver := &net.Resolver{
+		PreferGo: true,
+		Dial:     dial,
+	}
+
+	return resolver
+}
diff --git a/lib/utils/docs-usage.md.tmpl b/lib/utils/docs-usage.md.tmpl
new file mode 100644
index 0000000000000..ba7c8f6f68aba
--- /dev/null
+++ b/lib/utils/docs-usage.md.tmpl
@@ -0,0 +1,91 @@
+{{define "FormatCommand" -}}
+{{if .Flags|AnyVisibleFlags}}{{if .FlagSummary }} {{.FlagSummary}}{{end}}{{end -}}
+    {{range .Args}}{{if not .Hidden}} {{ .|FormatUsageArg}}{{end}}{{end -}}
+{{end -}}
+
+{{ define "FormatCommands" -}}
+{{$appName := .Name -}}
+{{range .FlattenedCommands|SortCommandsByName -}}
+{{if not .Hidden -}}
+## {{$appName}} {{.FullCommand}}
+
+{{.Help|Wrap 0 }}
+Usage:
+
+```code
+$ {{$appName}} {{.FullCommand}}{{template "FormatCommand" .}}
+```
+
+{{if AnyEnvVarsForCmd .Args .Flags -}}
+Environment variables:
+
+|Variable|Default|Description|
+|---|---|---|
+{{- EnvVarsToRows .Args .Flags|FormatThreeColMarkdownTable}}
+
+{{end -}}
+
+{{ if .Flags|AnyVisibleFlags -}}
+Flags:
+
+|Flag|Default|Description|
+|---|---|---|
+{{- .Flags|FlagsToRows|FormatThreeColMarkdownTable }}
+
+{{end -}}
+{{ if .Args -}}
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+{{- .Args|ArgsToRows|FormatThreeColMarkdownTable }}
+
+{{end -}}
+{{end -}}
+{{end -}}
+{{end -}}
+
+{{define "FormatUsage" -}}
+```code
+$ {{.Name}}{{template "FormatCommand" .}}{{if .Commands}} <command> [<args> ...]{{end}}
+```
+
+{{end -}}
+---
+title: {{.App.Name}} Reference
+description: Provides a comprehensive list of commands, arguments, and flags for {{.App.Name}}.
+---
+
+This guide provides a comprehensive list of commands, arguments, and flags for
+{{.App.Name}}: {{ if .App.Help -}}
+{{- .App.Help|Wrap 0 }}
+{{ end -}}
+
+{{template "FormatUsage" .App -}}
+{{if .Context.Flags -}}
+Global flags:
+
+|Flag|Default|Description|
+|---|---|---|
+{{- .Context.Flags|FlagsToRows|FormatThreeColMarkdownTable}}
+
+{{end -}}
+{{if AnyEnvVarsForCmd .Context.Args .Context.Flags -}}
+Global environment variables:
+
+|Variable|Default|Description|
+|---|---|---|
+{{- EnvVarsToRows .Context.Args .Context.Flags|FormatThreeColMarkdownTable}}
+
+{{end -}}
+{{if .Context.Args -}}
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+{{- .Context.Args|ArgsToRows|FormatThreeColMarkdownTable}}
+
+{{end -}}
+{{if .App.Commands -}}
+{{template "FormatCommands" .App -}}
+{{end -}}
diff --git a/lib/utils/ec2.go b/lib/utils/ec2.go
deleted file mode 100644
index 7018c82a5601d..0000000000000
--- a/lib/utils/ec2.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package utils
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport"
-)
-
-// GetRawEC2IdentityDocument fetches the PKCS7 RSA2048 InstanceIdentityDocument
-// from the IMDS for this EC2 instance.
-func GetRawEC2IdentityDocument(ctx context.Context) ([]byte, error) {
-	cfg, err := config.LoadDefaultConfig(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	imdsClient := imds.NewFromConfig(cfg)
-	output, err := imdsClient.GetDynamicData(ctx, &imds.GetDynamicDataInput{
-		Path: "instance-identity/rsa2048",
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	iidBytes, err := ReadAtMost(output.Content, teleport.MaxHTTPResponseSize)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if err := output.Content.Close(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return iidBytes, nil
-}
-
-func GetEC2InstanceIdentityDocument(ctx context.Context) (*imds.InstanceIdentityDocument, error) {
-	// fetch the raw IID
-	cfg, err := config.LoadDefaultConfig(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	imdsClient := imds.NewFromConfig(cfg)
-	output, err := imdsClient.GetInstanceIdentityDocument(ctx, nil)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &output.InstanceIdentityDocument, nil
-}
-
-// GetEC2NodeID returns the node ID to use for this EC2 instance when using
-// Simplified Node Joining.
-func GetEC2NodeID(ctx context.Context) (string, error) {
-	// fetch the raw IID
-	iid, err := GetEC2InstanceIdentityDocument(ctx)
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return NodeIDFromIID(iid), nil
-}
-
-// NodeIDFromIID returns the node ID that must be used for nodes joining with
-// the given Instance Identity Document.
-func NodeIDFromIID(iid *imds.InstanceIdentityDocument) string {
-	return iid.AccountID + "-" + iid.InstanceID
-}
diff --git a/lib/utils/fanoutbuffer/buffer.go b/lib/utils/fanoutbuffer/buffer.go
index e7a1a600e935f..0eddf2669c584 100644
--- a/lib/utils/fanoutbuffer/buffer.go
+++ b/lib/utils/fanoutbuffer/buffer.go
@@ -396,6 +396,10 @@ func (c *Cursor[T]) closeLocked() {
 	if c.closed {
 		return
 	}
+	// reset the finalizer that was set in (*Buffer).NewCursor, if it's still
+	// set - i.e. if this call is not the result of finalizeCursor but it's an
+	// explicit Close
+	runtime.SetFinalizer(c, nil)
 
 	c.closed = true
 
diff --git a/lib/utils/fields.go b/lib/utils/fields.go
index e076990b2c1c2..3fced938a5234 100644
--- a/lib/utils/fields.go
+++ b/lib/utils/fields.go
@@ -45,11 +45,19 @@ func (f Fields) GetStrings(key string) []string {
 	if !found {
 		return nil
 	}
+	res, _ := getStrings(val)
+	return res
+}
+
+func getStrings(val any) ([]string, bool) {
 	strings, ok := val.([]string)
 	if ok {
-		return strings
+		return strings, true
+	}
+	slice, ok := val.([]any)
+	if !ok {
+		return nil, false
 	}
-	slice, _ := val.([]interface{})
 	res := make([]string, 0, len(slice))
 	for _, v := range slice {
 		s, ok := v.(string)
@@ -57,7 +65,7 @@ func (f Fields) GetStrings(key string) []string {
 			res = append(res, s)
 		}
 	}
-	return res
+	return res, true
 }
 
 // GetInt returns an int representation of a field.
@@ -96,21 +104,62 @@ func (f Fields) HasField(key string) bool {
 	return ok
 }
 
+func (f Fields) Get(key string) (any, bool) {
+	v, ok := f[key]
+	return v, ok
+}
+
+func (f Fields) GetMapEntry(mapRef *types.WhereExpr2) (any, bool) {
+	field := mapRef.L.Field
+	key, ok := mapRef.R.Literal.(string)
+	if !ok {
+		return nil, false
+	}
+	val, found := f.Get(field)
+	if !found {
+		return nil, false
+	}
+	m, ok := val.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	v, ok := m[key]
+	if !ok {
+		return nil, false
+	}
+	return v, true
+}
+
 // FieldsCondition is a boolean function on Fields.
 type FieldsCondition func(Fields) bool
 
+// ToFieldsConditionConfig is the configuration for ToFieldsCondition.
+type ToFieldsConditionConfig struct {
+	Expr *types.WhereExpr
+	// CanView is an optional function that checks if the user is allowed to view the resource.
+	CanView func(Fields) bool
+}
+
 // ToFieldsCondition converts a WhereExpr into a FieldsCondition.
-func ToFieldsCondition(expr *types.WhereExpr) (FieldsCondition, error) {
-	if expr == nil {
+func ToFieldsCondition(cfg ToFieldsConditionConfig) (FieldsCondition, error) {
+	expr := cfg.Expr
+	if cfg.Expr == nil {
 		return nil, trace.BadParameter("expr is nil")
 	}
 
 	binOp := func(e types.WhereExpr2, op func(a, b bool) bool) (FieldsCondition, error) {
-		left, err := ToFieldsCondition(e.L)
+		left, err := ToFieldsCondition(ToFieldsConditionConfig{
+			Expr:    e.L,
+			CanView: cfg.CanView,
+		})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		right, err := ToFieldsCondition(e.R)
+		right, err := ToFieldsCondition(
+			ToFieldsConditionConfig{
+				Expr:    e.R,
+				CanView: cfg.CanView,
+			})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -122,13 +171,60 @@ func ToFieldsCondition(expr *types.WhereExpr) (FieldsCondition, error) {
 	if expr, err := binOp(expr.Or, func(a, b bool) bool { return a || b }); err == nil {
 		return expr, nil
 	}
-	if inner, err := ToFieldsCondition(expr.Not); err == nil {
+	if inner, err := ToFieldsCondition(
+		ToFieldsConditionConfig{
+			Expr:    expr.Not,
+			CanView: cfg.CanView,
+		},
+	); err == nil {
 		return func(f Fields) bool { return !inner(f) }, nil
 	}
 
 	if expr.Equals.L != nil && expr.Equals.R != nil {
 		left, right := expr.Equals.L, expr.Equals.R
 		switch {
+		case left.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(left.MapRef)
+				if !ok {
+					return false
+				}
+				strs, ok := val.(string)
+				if !ok {
+					return false
+				}
+				var strsVals string
+				if right.Field != "" {
+					strsVals = f.GetString(right.Field)
+				} else if right.Literal != nil {
+					strsVals, ok = right.Literal.(string)
+					if !ok {
+						return false
+					}
+				}
+				return strs == strsVals
+			}, nil
+		case right.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(right.MapRef)
+				if !ok {
+					return false
+				}
+				str, ok := val.(string)
+				if !ok {
+					return false
+				}
+				var strsVals string
+				if left.Field != "" {
+					strsVals = f.GetString(left.Field)
+				} else if left.Literal != nil {
+					strsVals, ok = left.Literal.(string)
+					if !ok {
+						return false
+					}
+				}
+				return str == strsVals
+			}, nil
 		case left.Field != "" && right.Field != "":
 			return func(f Fields) bool { return f[left.Field] == f[right.Field] }, nil
 		case left.Literal != nil && right.Field != "":
@@ -140,10 +236,52 @@ func ToFieldsCondition(expr *types.WhereExpr) (FieldsCondition, error) {
 	if expr.Contains.L != nil && expr.Contains.R != nil {
 		left, right := expr.Contains.L, expr.Contains.R
 		switch {
+		case left.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(left.MapRef)
+				if !ok {
+					return false
+				}
+				strs, ok := getStrings(val)
+				if !ok {
+					return false
+				}
+				var strsVals string
+				if right.Field != "" {
+					strsVals = f.GetString(right.Field)
+				} else if right.Literal != nil {
+					strsVals, ok = right.Literal.(string)
+					if !ok {
+						return false
+					}
+				}
+				return slices.Contains(strs, strsVals)
+			}, nil
+		case right.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(right.MapRef)
+				if !ok {
+					return false
+				}
+				str, ok := val.(string)
+				if !ok {
+					return false
+				}
+				var strsVals []string
+				if left.Field != "" {
+					strsVals = f.GetStrings(left.Field)
+				} else if left.Literal != nil {
+					strsVals, ok = getStrings(left.Literal)
+					if !ok {
+						return false
+					}
+				}
+				return slices.Contains(strsVals, str)
+			}, nil
 		case left.Field != "" && right.Field != "":
 			return func(f Fields) bool { return slices.Contains(f.GetStrings(left.Field), f.GetString(right.Field)) }, nil
 		case left.Literal != nil && right.Field != "":
-			if ss, ok := left.Literal.([]string); ok {
+			if ss, ok := getStrings(left.Literal); ok {
 				return func(f Fields) bool { return slices.Contains(ss, f.GetString(right.Field)) }, nil
 			}
 		case left.Field != "" && right.Literal != nil:
@@ -153,5 +291,161 @@ func ToFieldsCondition(expr *types.WhereExpr) (FieldsCondition, error) {
 		}
 	}
 
+	if expr.ContainsAll.L != nil && expr.ContainsAll.R != nil {
+		left, right := expr.ContainsAll.L, expr.ContainsAll.R
+		switch {
+		case left.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(left.MapRef)
+				if !ok {
+					return false
+				}
+
+				strs, ok := getStrings(val)
+				if !ok {
+					return false
+				}
+				var strsVals []string
+				if right.Field != "" {
+					strsVals = f.GetStrings(right.Field)
+				} else if right.Literal != nil {
+					strsVals, ok = getStrings(right.Literal)
+					if !ok {
+						return false
+					}
+				}
+				return containsAll(strs, strsVals)
+			}, nil
+		case right.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(right.MapRef)
+				if !ok {
+					return false
+				}
+				strs, ok := getStrings(val)
+				if !ok {
+					return false
+				}
+				var strsVals []string
+				if left.Field != "" {
+					strsVals = f.GetStrings(left.Field)
+				} else if left.Literal != nil {
+					strsVals, ok = getStrings(left.Literal)
+					if !ok {
+						return false
+					}
+				}
+				return containsAll(strsVals, strs)
+			}, nil
+		case left.Field != "" && right.Field != "":
+			return func(f Fields) bool { return containsAll(f.GetStrings(left.Field), f.GetStrings(right.Field)) }, nil
+		case left.Literal != nil && right.Field != "":
+			if ss, ok := getStrings(left.Literal); ok {
+				return func(f Fields) bool { return containsAll(ss, f.GetStrings(right.Field)) }, nil
+			}
+		case left.Field != "" && right.Literal != nil:
+			if s, ok := getStrings(right.Literal); ok {
+				return func(f Fields) bool { return containsAll(f.GetStrings(left.Field), s) }, nil
+			}
+		}
+	}
+
+	if expr.ContainsAny.L != nil && expr.ContainsAny.R != nil {
+		left, right := expr.ContainsAny.L, expr.ContainsAny.R
+		switch {
+		case left.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(left.MapRef)
+				if !ok {
+					return false
+				}
+				strs, ok := getStrings(val)
+				if !ok {
+					return false
+				}
+				var strsVals []string
+				if right.Field != "" {
+					strsVals = f.GetStrings(right.Field)
+				} else if right.Literal != nil {
+					strsVals, ok = getStrings(right.Literal)
+					if !ok {
+						return false
+					}
+				}
+				return containsAny(strs, strsVals)
+			}, nil
+		case right.MapRef != nil:
+			return func(f Fields) bool {
+				val, ok := f.GetMapEntry(right.MapRef)
+				if !ok {
+					return false
+				}
+				strs, ok := getStrings(val)
+				if !ok {
+					return false
+				}
+				var strsVals []string
+				if left.Field != "" {
+					strsVals = f.GetStrings(left.Field)
+				} else if left.Literal != nil {
+					strsVals, ok = getStrings(left.Literal)
+					if !ok {
+						return false
+					}
+				}
+				return containsAny(strsVals, strs)
+			}, nil
+		case left.Field != "" && right.Field != "":
+			return func(f Fields) bool { return containsAny(f.GetStrings(left.Field), f.GetStrings(right.Field)) }, nil
+		case left.Literal != nil && right.Field != "":
+			if ss, ok := getStrings(left.Literal); ok {
+				return func(f Fields) bool { return containsAny(ss, f.GetStrings(right.Field)) }, nil
+			}
+		case left.Field != "" && right.Literal != nil:
+			if s, ok := getStrings(right.Literal); ok {
+				return func(f Fields) bool { return containsAny(f.GetStrings(left.Field), s) }, nil
+			}
+		}
+	}
+
+	if expr.CanView != nil {
+		if cfg.CanView == nil {
+			return nil, trace.BadParameter("canView expression provided but no canView function specified")
+		}
+		return func(f Fields) bool { return cfg.CanView(f) }, nil
+	}
+
 	return nil, trace.BadParameter("failed to convert expression %q to FieldsCondition", expr)
 }
+
+func containsAll(slice []string, items []string) bool {
+	set := make(map[string]struct{}, len(slice))
+	for _, s := range slice {
+		set[s] = struct{}{}
+	}
+	if len(items) == 0 {
+		return false
+	}
+	for _, item := range items {
+		if _, ok := set[item]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+func containsAny(slice []string, items []string) bool {
+	set := make(map[string]struct{}, len(slice))
+	for _, s := range slice {
+		set[s] = struct{}{}
+	}
+	if len(items) == 0 {
+		return false
+	}
+	for _, item := range items {
+		if _, ok := set[item]; ok {
+			return true
+		}
+	}
+	return false
+}
diff --git a/lib/utils/fields_test.go b/lib/utils/fields_test.go
index d96ee1fdf9ce9..dfa4d2628ff65 100644
--- a/lib/utils/fields_test.go
+++ b/lib/utils/fields_test.go
@@ -61,7 +61,9 @@ func TestToFieldsCondition(t *testing.T) {
 		R: &types.WhereExpr{Contains: types.WhereExpr2{L: &types.WhereExpr{Field: "participants"}, R: &types.WhereExpr{Literal: "test-user"}}},
 	}}
 
-	cond, err := ToFieldsCondition(expr)
+	cond, err := ToFieldsCondition(ToFieldsConditionConfig{
+		Expr: expr,
+	})
 	require.NoError(t, err)
 
 	require.False(t, cond(Fields{}))
@@ -70,3 +72,558 @@ func TestToFieldsCondition(t *testing.T) {
 	require.True(t, cond(Fields{"login": "guest", "participants": []string{"test-user", "observer"}}))
 	require.True(t, cond(Fields{"participants": []string{"test-user"}}))
 }
+
+func TestToFieldsConditionNilExpression(t *testing.T) {
+	t.Parallel()
+
+	_, err := ToFieldsCondition(ToFieldsConditionConfig{
+		Expr: nil,
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "expr is nil")
+}
+
+func TestToFieldsConditionLogicalOperators(t *testing.T) {
+	t.Parallel()
+
+	t.Run("AND", func(t *testing.T) {
+		// name == "alice" AND role == "admin"
+		expr := &types.WhereExpr{And: types.WhereExpr2{
+			L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "name"}, R: &types.WhereExpr{Literal: "alice"}}},
+			R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "role"}, R: &types.WhereExpr{Literal: "admin"}}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		// Both conditions satisfied
+		require.True(t, cond(Fields{"name": "alice", "role": "admin"}))
+		// One condition satisfied
+		require.False(t, cond(Fields{"name": "alice", "role": "user"}))
+		require.False(t, cond(Fields{"name": "bob", "role": "admin"}))
+		// No conditions satisfied
+		require.False(t, cond(Fields{"name": "bob", "role": "user"}))
+	})
+
+	t.Run("OR", func(t *testing.T) {
+		// name == "alice" OR role == "admin"
+		expr := &types.WhereExpr{Or: types.WhereExpr2{
+			L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "name"}, R: &types.WhereExpr{Literal: "alice"}}},
+			R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "role"}, R: &types.WhereExpr{Literal: "admin"}}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		// Both conditions satisfied
+		require.True(t, cond(Fields{"name": "alice", "role": "admin"}))
+		// One condition satisfied
+		require.True(t, cond(Fields{"name": "alice", "role": "user"}))
+		require.True(t, cond(Fields{"name": "bob", "role": "admin"}))
+		// No conditions satisfied
+		require.False(t, cond(Fields{"name": "bob", "role": "user"}))
+	})
+
+	t.Run("NOT", func(t *testing.T) {
+		// NOT (name == "alice")
+		expr := &types.WhereExpr{Not: &types.WhereExpr{
+			Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "name"}, R: &types.WhereExpr{Literal: "alice"}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.False(t, cond(Fields{"name": "alice"}))
+		require.True(t, cond(Fields{"name": "bob"}))
+	})
+
+	t.Run("complex expression", func(t *testing.T) {
+		// (name == "alice" OR role == "admin") AND NOT (dept == "finance")
+		expr := &types.WhereExpr{And: types.WhereExpr2{
+			L: &types.WhereExpr{Or: types.WhereExpr2{
+				L: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "name"}, R: &types.WhereExpr{Literal: "alice"}}},
+				R: &types.WhereExpr{Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "role"}, R: &types.WhereExpr{Literal: "admin"}}},
+			}},
+			R: &types.WhereExpr{Not: &types.WhereExpr{
+				Equals: types.WhereExpr2{L: &types.WhereExpr{Field: "dept"}, R: &types.WhereExpr{Literal: "finance"}},
+			}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		// Satisfies both conditions
+		require.True(t, cond(Fields{"name": "alice", "dept": "engineering"}))
+		require.True(t, cond(Fields{"name": "bob", "role": "admin", "dept": "sales"}))
+
+		// Fails the NOT condition
+		require.False(t, cond(Fields{"name": "alice", "dept": "finance"}))
+		require.False(t, cond(Fields{"role": "admin", "dept": "finance"}))
+
+		// Fails the OR condition
+		require.False(t, cond(Fields{"name": "bob", "role": "user", "dept": "engineering"}))
+	})
+}
+
+func TestToFieldsConditionEqualsOperations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("field-field", func(t *testing.T) {
+		// name == alias
+		expr := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "name"},
+			R: &types.WhereExpr{Field: "alias"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"name": "alice", "alias": "alice"}))
+		require.False(t, cond(Fields{"name": "alice", "alias": "bob"}))
+		require.False(t, cond(Fields{"name": "alice"})) // missing field
+	})
+
+	t.Run("field-literal", func(t *testing.T) {
+		// name == "alice"
+		expr := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "name"},
+			R: &types.WhereExpr{Literal: "alice"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"name": "alice"}))
+		require.False(t, cond(Fields{"name": "bob"}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+
+	t.Run("literal-field", func(t *testing.T) {
+		// "alice" == name
+		expr := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: "alice"},
+			R: &types.WhereExpr{Field: "name"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"name": "alice"}))
+		require.False(t, cond(Fields{"name": "bob"}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+}
+
+func TestToFieldsConditionContainsOperations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("field-field", func(t *testing.T) {
+		// contains(teams, leader)
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "teams"},
+			R: &types.WhereExpr{Field: "leader"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"teams":  []string{"engineering", "frontend", "backend"},
+			"leader": "frontend",
+		}))
+		require.False(t, cond(Fields{
+			"teams":  []string{"engineering", "frontend", "backend"},
+			"leader": "design",
+		}))
+		require.False(t, cond(Fields{"teams": []string{"engineering"}})) // missing field
+	})
+
+	t.Run("field-literal", func(t *testing.T) {
+		// contains(teams, "frontend")
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "teams"},
+			R: &types.WhereExpr{Literal: "frontend"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"teams": []string{"engineering", "frontend", "backend"}}))
+		require.False(t, cond(Fields{"teams": []string{"engineering", "backend"}}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+
+	t.Run("literal-field", func(t *testing.T) {
+		// contains(["admin", "superuser"], role)
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin", "superuser"}},
+			R: &types.WhereExpr{Field: "role"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"role": "admin"}))
+		require.True(t, cond(Fields{"role": "superuser"}))
+		require.False(t, cond(Fields{"role": "user"}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+
+	t.Run("interface slice", func(t *testing.T) {
+		// contains(teams, "frontend")
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "teams"},
+			R: &types.WhereExpr{Literal: "frontend"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"teams": []any{"engineering", "frontend", "backend"}}))
+		require.False(t, cond(Fields{"teams": []any{"engineering", "backend"}}))
+	})
+}
+
+func TestToFieldsConditionContainsAllOperations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("field-field", func(t *testing.T) {
+		// contains_all(user_teams, required_teams)
+		expr := &types.WhereExpr{ContainsAll: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "user_teams"},
+			R: &types.WhereExpr{Field: "required_teams"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"user_teams":     []string{"engineering", "frontend", "backend"},
+			"required_teams": []string{"engineering", "frontend"},
+		}))
+		require.False(t, cond(Fields{
+			"user_teams":     []string{"engineering", "frontend"},
+			"required_teams": []string{"engineering", "frontend", "backend"},
+		}))
+		require.False(t, cond(Fields{
+			"user_teams":     []string{"engineering", "frontend"},
+			"required_teams": []string{"engineering", "backend"},
+		}))
+	})
+
+	t.Run("field-literal", func(t *testing.T) {
+		// contains_all(user_teams, ["engineering", "frontend"])
+		expr := &types.WhereExpr{ContainsAll: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "user_teams"},
+			R: &types.WhereExpr{Literal: []string{"engineering", "frontend"}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"user_teams": []string{"engineering", "frontend", "backend"}}))
+		require.True(t, cond(Fields{"user_teams": []string{"engineering", "frontend"}}))
+		require.False(t, cond(Fields{"user_teams": []string{"engineering", "backend"}}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+
+	t.Run("literal-field", func(t *testing.T) {
+		// contains_all(["admin", "superuser", "manager"], user_roles)
+		expr := &types.WhereExpr{ContainsAll: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin", "superuser", "manager"}},
+			R: &types.WhereExpr{Field: "user_roles"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"user_roles": []string{"admin", "superuser"}}))
+		require.True(t, cond(Fields{"user_roles": []string{"admin"}}))
+		require.False(t, cond(Fields{"user_roles": []string{"admin", "superuser", "manager", "extra"}}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+}
+
+func TestToFieldsConditionContainsAnyOperations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("field-field", func(t *testing.T) {
+		// contains_any(user_roles, allowed_roles)
+		expr := &types.WhereExpr{ContainsAny: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "user_roles"},
+			R: &types.WhereExpr{Field: "allowed_roles"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"user_roles":    []string{"admin", "manager"},
+			"allowed_roles": []string{"admin", "superuser", "operator"},
+		}))
+		require.False(t, cond(Fields{
+			"user_roles":    []string{"manager", "developer"},
+			"allowed_roles": []string{"admin", "superuser", "operator"},
+		}))
+	})
+
+	t.Run("field-literal", func(t *testing.T) {
+		// contains_any(user_roles, ["admin", "superuser"])
+		expr := &types.WhereExpr{ContainsAny: types.WhereExpr2{
+			L: &types.WhereExpr{Field: "user_roles"},
+			R: &types.WhereExpr{Literal: []string{"admin", "superuser"}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"user_roles": []string{"admin", "manager"}}))
+		require.True(t, cond(Fields{"user_roles": []string{"superuser"}}))
+		require.False(t, cond(Fields{"user_roles": []string{"manager", "operator"}}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+
+	t.Run("literal-field", func(t *testing.T) {
+		// contains_any(["admin", "superuser"], user_role)
+		expr := &types.WhereExpr{ContainsAny: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin", "superuser"}},
+			R: &types.WhereExpr{Field: "user_role"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"user_role": []string{"admin"}}))
+		require.True(t, cond(Fields{"user_role": []string{"superuser"}}))
+		require.False(t, cond(Fields{"user_role": []string{"manager"}}))
+		require.False(t, cond(Fields{})) // missing field
+	})
+}
+
+func TestToFieldsConditionMapReferences(t *testing.T) {
+	t.Parallel()
+
+	t.Run("map equals left", func(t *testing.T) {
+		// labels["env"] == "production"
+		expr := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "env"},
+			}},
+			R: &types.WhereExpr{Literal: "production"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"labels": map[string]any{"env": "production", "app": "web"}}))
+		require.False(t, cond(Fields{"labels": map[string]any{"env": "staging", "app": "web"}}))
+		require.False(t, cond(Fields{"labels": map[string]any{"app": "web"}})) // key not present
+		require.False(t, cond(Fields{}))                                       // map not present
+	})
+
+	t.Run("map equals right", func(t *testing.T) {
+		// "production" == labels["env"]
+		expr := &types.WhereExpr{Equals: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: "production"},
+			R: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "env"},
+			}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"labels": map[string]any{"env": "production", "app": "web"}}))
+		require.False(t, cond(Fields{"labels": map[string]any{"env": "staging", "app": "web"}}))
+		require.False(t, cond(Fields{"labels": map[string]any{"app": "web"}})) // key not present
+		require.False(t, cond(Fields{}))                                       // map not present
+	})
+
+	t.Run("map contains left", func(t *testing.T) {
+		// contains(labels["roles"], "admin")
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "roles"},
+			}},
+			R: &types.WhereExpr{Literal: "admin"},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "user"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"user", "guest"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{"labels": map[string]any{"app": "web"}})) // key not present
+		require.False(t, cond(Fields{}))                                       // map not present
+	})
+
+	t.Run("map contains right", func(t *testing.T) {
+		// contains(["admin"],labels["role"])
+		expr := &types.WhereExpr{Contains: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin"}},
+			R: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "role"},
+			}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"role": "admin", "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"role": "user", "app": "web"},
+		}))
+		require.False(t, cond(Fields{"labels": map[string]any{"app": "web"}})) // key not present
+		require.False(t, cond(Fields{}))                                       // map not present
+	})
+
+	t.Run("map contains_al left ", func(t *testing.T) {
+		// contains_all(labels["roles"], ["admin", "user"])
+		expr := &types.WhereExpr{ContainsAll: types.WhereExpr2{
+			L: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "roles"},
+			}},
+			R: &types.WhereExpr{Literal: []string{"admin", "user"}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "user", "guest"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "guest"}, "app": "web"},
+		}))
+	})
+
+	t.Run("map contains_al right", func(t *testing.T) {
+		// contains_all(["admin", "user"],labels["roles"])
+		expr := &types.WhereExpr{ContainsAll: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin", "user"}},
+			R: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "roles"},
+			}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "user"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "guest"}, "app": "web"},
+		}))
+	})
+
+	t.Run("map contains_any left", func(t *testing.T) {
+		// contains_any(labels["roles"], ["admin", "superuser"])
+		expr := &types.WhereExpr{ContainsAny: types.WhereExpr2{
+			L: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "roles"},
+			}},
+			R: &types.WhereExpr{Literal: []string{"admin", "superuser"}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "user"}, "app": "web"},
+		}))
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"superuser", "guest"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"user", "guest"}, "app": "web"},
+		}))
+	})
+
+	t.Run("map contains_any right", func(t *testing.T) {
+		// contains_any(["admin", "superuser"],labels["roles"])
+		expr := &types.WhereExpr{ContainsAny: types.WhereExpr2{
+			L: &types.WhereExpr{Literal: []string{"admin", "superuser"}},
+			R: &types.WhereExpr{MapRef: &types.WhereExpr2{
+				L: &types.WhereExpr{Field: "labels"},
+				R: &types.WhereExpr{Literal: "roles"},
+			}},
+		}}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{Expr: expr})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"admin", "user"}, "app": "web"},
+		}))
+		require.True(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"superuser", "guest"}, "app": "web"},
+		}))
+		require.False(t, cond(Fields{
+			"labels": map[string]any{"roles": []string{"user", "guest"}, "app": "web"},
+		}))
+	})
+}
+
+func TestToFieldsConditionCanView(t *testing.T) {
+	t.Parallel()
+
+	// can_view()
+	expr := &types.WhereExpr{CanView: &types.WhereNoExpr{}}
+
+	t.Run("with canView function", func(t *testing.T) {
+		// Provide a canView function that only allows access to resources with allow=true
+		canView := func(f Fields) bool {
+			allow, ok := f["allow"]
+			if !ok {
+				return false
+			}
+			return allow.(bool)
+		}
+
+		cond, err := ToFieldsCondition(ToFieldsConditionConfig{
+			Expr:    expr,
+			CanView: canView,
+		})
+		require.NoError(t, err)
+
+		require.True(t, cond(Fields{"allow": true, "name": "resource1"}))
+		require.False(t, cond(Fields{"allow": false, "name": "resource2"}))
+		require.False(t, cond(Fields{"name": "resource3"}))
+	})
+
+	t.Run("without canView function", func(t *testing.T) {
+		_, err := ToFieldsCondition(ToFieldsConditionConfig{
+			Expr: expr,
+			// No canView function provided
+		})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "canView expression provided but no canView function specified")
+	})
+}
+
+func TestToFieldsConditionInvalidExpression(t *testing.T) {
+	t.Parallel()
+
+	// Create an empty expression with no operators
+	expr := &types.WhereExpr{}
+
+	_, err := ToFieldsCondition(ToFieldsConditionConfig{
+		Expr: expr,
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "failed to convert expression")
+}
diff --git a/lib/utils/fncache.go b/lib/utils/fncache.go
index 1e4eb28749bd8..5600310f762ec 100644
--- a/lib/utils/fncache.go
+++ b/lib/utils/fncache.go
@@ -182,6 +182,40 @@ func (c *FnCache) Set(key, value any) {
 	c.SetWithTTL(key, value, c.cfg.TTL)
 }
 
+// GetIfExists retrieves a value from the cache without triggering a load operation.
+// It returns (value, true) if a valid, non-expired entry exists, or (nil, false)
+// otherwise. If an entry is currently being loaded by FnCacheGet, Get will
+// return false immediately without blocking. Get returns false for entries that
+// contain errors.
+// For most of the cases the FnCacheGet function should be used instead.
+func (c *FnCache) GetIfExists(key any) (any, bool) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return nil, false
+	}
+	entry := c.entries[key]
+	c.mu.Unlock()
+
+	if entry == nil {
+		return nil, false
+	}
+
+	select {
+	case <-entry.loaded:
+		if c.cfg.Clock.Now().After(entry.t.Add(entry.ttl)) {
+			return nil, false
+		}
+		if entry.e != nil {
+			return nil, false
+		}
+		return entry.v, true
+	default:
+		// Entry still loading - treat as cache miss
+		return nil, false
+	}
+}
+
 // SetWithTTL places an item in the cache with an explicit TTL.
 func (c *FnCache) SetWithTTL(key, value any, ttl time.Duration) {
 	c.mu.Lock()
diff --git a/lib/utils/fncache_test.go b/lib/utils/fncache_test.go
index 4e3e5341975f1..aebb30b1cbbeb 100644
--- a/lib/utils/fncache_test.go
+++ b/lib/utils/fncache_test.go
@@ -29,6 +29,7 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	apiutils "github.com/gravitational/teleport/api/utils"
@@ -655,3 +656,202 @@ func TestFnCacheSet(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, 100, out)
 }
+
+// TestGetIfExists tests the GetIfExists method which retrieves values without triggering loads.
+func TestGetIfExists(t *testing.T) {
+	t.Parallel()
+
+	t.Run("non-existent key", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+
+		val, ok := cache.GetIfExists("nonexistent")
+		require.False(t, ok)
+		require.Empty(t, val)
+	})
+
+	t.Run("existing valid entry", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+
+		cache.Set("test-key", "test-value")
+
+		val, ok := cache.GetIfExists("test-key")
+		require.True(t, ok)
+		require.Equal(t, "test-value", val)
+	})
+
+	t.Run("expired entry", func(t *testing.T) {
+		t.Parallel()
+		clock := clockwork.NewFakeClock()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clock,
+		})
+		require.NoError(t, err)
+
+		cache.SetWithTTL("test-key", "test-value", time.Minute)
+
+		val, ok := cache.GetIfExists("test-key")
+		require.True(t, ok)
+		require.Equal(t, "test-value", val)
+
+		// Advance time past the TTL
+		clock.Advance(2 * time.Minute)
+
+		// Entry should now be expired and not returned
+		val, ok = cache.GetIfExists("test-key")
+		require.False(t, ok)
+		require.Empty(t, val)
+	})
+
+	t.Run("entry with different TTL", func(t *testing.T) {
+		t.Parallel()
+		clock := clockwork.NewFakeClock()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clock,
+		})
+		require.NoError(t, err)
+
+		// Set entries with different TTLs
+		cache.SetWithTTL("short-ttl", "short-value", 30*time.Minute)
+		cache.SetWithTTL("long-ttl", "long-value", 2*time.Hour)
+
+		// Both should be accessible initially
+		val, ok := cache.GetIfExists("short-ttl")
+		require.True(t, ok)
+		require.Equal(t, "short-value", val)
+
+		val, ok = cache.GetIfExists("long-ttl")
+		require.True(t, ok)
+		require.Equal(t, "long-value", val)
+
+		// Advance time to expire only the short TTL entry
+		clock.Advance(45 * time.Minute)
+
+		// Short TTL entry should be expired
+		val, ok = cache.GetIfExists("short-ttl")
+		require.False(t, ok)
+		require.Empty(t, val)
+
+		// Long TTL entry should still be accessible
+		val, ok = cache.GetIfExists("long-ttl")
+		require.True(t, ok)
+		require.Equal(t, "long-value", val)
+	})
+
+	t.Run("entry loaded with error via FnCacheGet", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+		ctx := context.Background()
+
+		// Load an entry that results in an error
+		_, err = FnCacheGet(ctx, cache, "error-key", func(ctx context.Context) (string, error) {
+			return "", fmt.Errorf("load error")
+		})
+		require.Error(t, err)
+
+		// GetIfExists should not return the error entry
+		val, ok := cache.GetIfExists("error-key")
+		require.False(t, ok)
+		require.Empty(t, val)
+	})
+
+	t.Run("get after remove", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+
+		cache.Set("remove-test-key", "test-value")
+		val, ok := cache.GetIfExists("remove-test-key")
+		require.True(t, ok)
+		require.Equal(t, "test-value", val)
+
+		cache.Remove("remove-test-key")
+
+		val, ok = cache.GetIfExists("remove-test-key")
+		require.False(t, ok)
+		require.Empty(t, val)
+	})
+
+	t.Run("non-blocking while entry is loading", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+
+		loadStarted := make(chan struct{})
+		loadContinue := make(chan struct{})
+
+		// Start a load operation that will block
+		go func() {
+			_, err := FnCacheGet(context.Background(), cache, "loading-key", func(ctx context.Context) (string, error) {
+				close(loadStarted)
+				<-loadContinue
+				return "loaded-value", nil
+			})
+			assert.NoError(t, err)
+		}()
+
+		<-loadStarted
+
+		// GetIfExists should return immediately with false, not block
+		val, ok := cache.GetIfExists("loading-key")
+		require.False(t, ok)
+		require.Empty(t, val)
+
+		close(loadContinue)
+
+		// Now it should be available
+		require.Eventually(t, func() bool {
+			val, ok := cache.GetIfExists("loading-key")
+			return ok && val == "loaded-value"
+		}, time.Second, 10*time.Millisecond)
+	})
+
+	t.Run("concurrent GetIfExists Remove/Set on same key", func(t *testing.T) {
+		t.Parallel()
+		cache, err := NewFnCache(FnCacheConfig{
+			TTL:   time.Hour,
+			Clock: clockwork.NewFakeClock(),
+		})
+		require.NoError(t, err)
+
+		var wg sync.WaitGroup
+		for i := 0; i < 100; i++ {
+			wg.Add(3)
+			go func() {
+				defer wg.Done()
+				cache.GetIfExists("key")
+			}()
+			go func() {
+				defer wg.Done()
+				cache.Remove("key")
+			}()
+
+			go func() {
+				defer wg.Done()
+				cache.Set("key", "value")
+			}()
+		}
+		wg.Wait()
+	})
+}
diff --git a/lib/utils/fs.go b/lib/utils/fs.go
index 6831a4a482b71..a510c6e6a30b3 100644
--- a/lib/utils/fs.go
+++ b/lib/utils/fs.go
@@ -337,15 +337,9 @@ func removeSecure(filePath string, fi os.FileInfo) error {
 	defer f.Close()
 
 	if runtime.GOOS == "windows" {
-		// Windows can't unlink the file before overwriting.
-		if f != nil {
-			for i := 0; i < 3; i++ {
-				if err := overwriteFile(f, fi); err != nil {
-					break
-				}
-			}
-		}
-		// The file should be closed before removing it on Windows.
+		// On windows, os.Remove() will fail if there are any open handles to the
+		// file, including in other processes. Skip overwrite to avoid leaving
+		// files in a broken state.
 		closeErr := trace.ConvertSystemError(f.Close())
 		removeErr := trace.ConvertSystemError(os.Remove(filePath))
 		return trace.NewAggregate(closeErr, removeErr)
diff --git a/lib/utils/host/hostusers.go b/lib/utils/host/hostusers.go
index 684edec2e8d79..6a1b18d6b3ee8 100644
--- a/lib/utils/host/hostusers.go
+++ b/lib/utils/host/hostusers.go
@@ -27,8 +27,11 @@ import (
 	"os"
 	"os/exec"
 	"os/user"
+	"runtime"
 	"slices"
+	"strconv"
 	"strings"
+	"syscall"
 
 	"github.com/gravitational/trace"
 )
@@ -144,15 +147,26 @@ func UserAdd(username string, groups []string, opts UserOpts) (exitCode int, err
 	return cmd.ProcessState.ExitCode(), trace.Wrap(err)
 }
 
-// SetUserGroups adds a user to a list of specified groups on a host using `usermod`,
+// UserUpdate sets the groups and default shell for a host user using `usermod`,
 // overriding any existing supplementary groups.
-func SetUserGroups(username string, groups []string) (exitCode int, err error) {
+func UserUpdate(username string, groups []string, defaultShell string) (exitCode int, err error) {
 	usermodBin, err := exec.LookPath("usermod")
 	if err != nil {
 		return -1, trace.Wrap(err, "cant find usermod binary")
 	}
-	// usermod -G (replace groups) (username)
-	cmd := exec.Command(usermodBin, "-G", strings.Join(groups, ","), username)
+	var args []string
+	if groups != nil {
+		args = append(args, "-G", strings.Join(groups, ","))
+	}
+	if defaultShell != "" {
+		if shell, err := exec.LookPath(defaultShell); err != nil {
+			slog.WarnContext(context.Background(), "configured shell not found, falling back to host default", "shell", defaultShell)
+		} else {
+			args = append(args, "--shell", shell)
+		}
+	}
+	// usermod -G (replace groups) --shell (default shell) (username)
+	cmd := exec.Command(usermodBin, append(args, username)...)
 	output, err := cmd.CombinedOutput()
 	slog.DebugContext(context.Background(), "usermod completed",
 		"command_path", cmd.Path,
@@ -303,3 +317,106 @@ func CheckSudoers(contents []byte) error {
 	}
 	return trace.Wrap(err)
 }
+
+// UserShell invokes the 'getent' binary in order to fetch the default shell for the
+// given user.
+func UserShell(username string) (string, error) {
+	if username == "" {
+		return "", trace.BadParameter("cannot lookup shell without username")
+	}
+	getentBin, err := exec.LookPath("getent")
+	if err != nil {
+		return "", trace.NotFound("cannot find getent binary: %s", err)
+	}
+	cmd := exec.Command(getentBin, "passwd", username)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	// grab last element in passwd entry
+	entry := bytes.TrimSpace(output)
+	shellIdx := bytes.LastIndex(entry, []byte(":")) + 1
+	if shellIdx >= len(entry) {
+		return "", trace.Errorf("invalid passwd entry for user %q", username)
+	}
+
+	return string(entry), nil
+}
+
+// GetHostUserCredential parses the uid, gid, and groups of the given user intoAdd commentMore actions
+// a credential object for a command to use.
+func GetHostUserCredential(localUser *user.User) (*syscall.Credential, error) {
+	uid, err := strconv.ParseUint(localUser.Uid, 10, 32)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	gid, err := strconv.ParseUint(localUser.Gid, 10, 32)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if runtime.GOOS == "darwin" {
+		// on macOS we should rely on the list of groups managed by the system
+		// (the use of setgroups is "highly discouraged", as per the setgroups
+		// man page in macOS 13.5)
+		return &syscall.Credential{
+			Uid:         uint32(uid),
+			Gid:         uint32(gid),
+			NoSetGroups: true,
+		}, nil
+	}
+
+	// Lookup supplementary groups for the user.
+	userGroups, err := localUser.GroupIds()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	groups := make([]uint32, 0)
+	for _, sgid := range userGroups {
+		igid, err := strconv.ParseUint(sgid, 10, 32)
+		if err != nil {
+			slog.WarnContext(context.Background(), "Cannot interpret user group", "user_group", sgid)
+		} else {
+			groups = append(groups, uint32(igid))
+		}
+	}
+	if len(groups) == 0 {
+		groups = append(groups, uint32(gid))
+	}
+
+	return &syscall.Credential{
+		Uid:    uint32(uid),
+		Gid:    uint32(gid),
+		Groups: groups,
+	}, nil
+}
+
+// MaybeSetCommandCredentialAsUser sets process credentials if the UID/GID of the
+// requesting user are different from the process (Teleport).
+func MaybeSetCommandCredentialAsUser(ctx context.Context, cmd *exec.Cmd, requestUser *user.User, logger *slog.Logger) error {
+	credential, err := GetHostUserCredential(requestUser)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if os.Getuid() == int(credential.Uid) && os.Getgid() == int(credential.Gid) {
+		logger.DebugContext(ctx, "Creating process with ambient credentials",
+			"uid", credential.Uid,
+			"gid", credential.Gid,
+			"groups", credential.Groups,
+		)
+		return nil
+	}
+
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.Credential = credential
+	logger.DebugContext(ctx, "Creating process",
+		"uid", credential.Uid,
+		"gid", credential.Gid,
+		"groups", credential.Groups,
+	)
+	return nil
+}
diff --git a/lib/utils/hostid/hostid.go b/lib/utils/hostid/hostid.go
index 094e4cf9547ae..ee941038ab77f 100644
--- a/lib/utils/hostid/hostid.go
+++ b/lib/utils/hostid/hostid.go
@@ -17,14 +17,18 @@
 package hostid
 
 import (
+	"context"
 	"errors"
 	"io/fs"
 	"path/filepath"
 	"strings"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/aws"
 )
 
 const (
@@ -37,18 +41,12 @@ func GetPath(dataDir string) string {
 	return filepath.Join(dataDir, FileName)
 }
 
-// ExistsLocally checks if dataDir/host_uuid file exists in local storage.
-func ExistsLocally(dataDir string) bool {
-	_, err := ReadFile(dataDir)
-	return err == nil
-}
-
 // ReadFile reads host UUID from the file in the data dir
 func ReadFile(dataDir string) (string, error) {
 	out, err := utils.ReadPath(GetPath(dataDir))
 	if err != nil {
 		if errors.Is(err, fs.ErrPermission) {
-			//do not convert to system error as this loses the ability to compare that it is a permission error
+			// do not convert to system error as this loses the ability to compare that it is a permission error
 			return "", trace.Wrap(err)
 		}
 		return "", trace.ConvertSystemError(err)
@@ -59,3 +57,46 @@ func ReadFile(dataDir string) (string, error) {
 	}
 	return id, nil
 }
+
+// Generate a new host UUID based on the join method.
+// Uses the EC2 node ID for EC2 instances, and generates a new UUID for all other join methods.
+func Generate(ctx context.Context, joinMethod types.JoinMethod) (string, error) {
+	switch joinMethod {
+	case types.JoinMethodToken,
+		types.JoinMethodUnspecified,
+		types.JoinMethodAzureDevops,
+		types.JoinMethodBitbucket,
+		types.JoinMethodIAM,
+		types.JoinMethodCircleCI,
+		types.JoinMethodKubernetes,
+		types.JoinMethodGitHub,
+		types.JoinMethodGitLab,
+		types.JoinMethodAzure,
+		types.JoinMethodGCP,
+		types.JoinMethodTPM,
+		types.JoinMethodSpacelift,
+		types.JoinMethodTerraformCloud,
+		types.JoinMethodOracle,
+		types.JoinMethodEnv0:
+		// Checking error instead of the usual uuid.New() in case uuid generation
+		// fails due to not enough randomness. It's been known to happen happen when
+		// Teleport starts very early in the node initialization cycle and /dev/urandom
+		// isn't ready yet.
+		rawID, err := uuid.NewRandom()
+		if err != nil {
+			return "", trace.BadParameter("" +
+				"Teleport failed to generate host UUID. " +
+				"This may happen if randomness source is not fully initialized when the node is starting up. " +
+				"Please try restarting Teleport again.")
+		}
+		return rawID.String(), nil
+	case types.JoinMethodEC2:
+		hostUUID, err := aws.GetEC2NodeID(ctx)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+		return hostUUID, nil
+	default:
+		return "", trace.BadParameter("unknown join method %q", joinMethod)
+	}
+}
diff --git a/lib/utils/hostid/hostid_test.go b/lib/utils/hostid/hostid_test.go
index 208b95c292f6d..26f0e37e65556 100644
--- a/lib/utils/hostid/hostid_test.go
+++ b/lib/utils/hostid/hostid_test.go
@@ -32,12 +32,12 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/hostid"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/utils/iterators.go b/lib/utils/iterators.go
deleted file mode 100644
index bad40d86831fc..0000000000000
--- a/lib/utils/iterators.go
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package utils
-
-import (
-	"context"
-	"errors"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/utils/pagination"
-)
-
-// ErrStopIteration is value that signals to stop iteration from the caller injected function.
-var ErrStopIteration = errors.New("stop iteration")
-
-// ForEachOptions specifies options for ForEachResource.
-type ForEachOptions struct {
-	// PageSize is the number of items to fetch per page.
-	PageSize int
-}
-
-// ForEachOptionFunc is a function that sets an option on ForEachOptions.
-type ForEachOptionFunc func(*ForEachOptions)
-
-// WithPageSize sets the page size option.
-func WithPageSize(pageSize int) ForEachOptionFunc {
-	return func(opts *ForEachOptions) {
-		opts.PageSize = pageSize
-	}
-}
-
-// TokenLister is a function that lists resources with a page token.
-type TokenLister[T any] func(context.Context, int, string) ([]T, string, error)
-
-// ForEachResource iterates over resources.
-// Example:
-//
-//	count := 0
-//	err := ForEachResource(ctx, svc.ListAccessLists, func(acl accesslist.AccessList) error {
-//	   count++
-//	   return nil
-//	})
-//	if err != nil {
-//	   return trace.Wrap(err)
-//	}
-//	fmt.Printf("Total access lists: %v", count)
-func ForEachResource[T any](ctx context.Context, listFn TokenLister[T], fn func(T) error, opts ...ForEachOptionFunc) error {
-	var options ForEachOptions
-	for _, opt := range opts {
-		opt(&options)
-	}
-	pageToken := ""
-	for {
-		items, nextToken, err := listFn(ctx, options.PageSize, pageToken)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		for _, item := range items {
-			if err := fn(item); err != nil {
-				if errors.Is(err, ErrStopIteration) {
-					return nil
-				}
-				return trace.Wrap(err)
-			}
-		}
-		if nextToken == "" {
-			return nil
-		}
-		pageToken = nextToken
-	}
-}
-
-// ListerWithPageToken is a function that lists resources with a page token.
-type ListerWithPageToken[T any] func(context.Context, int, *pagination.PageRequestToken) ([]T, pagination.NextPageToken, error)
-
-// AdaptPageTokenLister adapts a listener with page token to a lister.
-func AdaptPageTokenLister[T any](listFn ListerWithPageToken[T]) TokenLister[T] {
-	return func(ctx context.Context, pageSize int, pageToken string) ([]T, string, error) {
-		var pageRequestToken pagination.PageRequestToken
-		pageRequestToken.Update(pagination.NextPageToken(pageToken))
-		resources, nextPageToken, err := listFn(ctx, pageSize, &pageRequestToken)
-		if err != nil {
-			return nil, "", trace.Wrap(err)
-		}
-		return resources, string(nextPageToken), nil
-	}
-}
-
-// CollectResources collects resources.
-// Example usage:
-//
-//	accessLists err := ForEachResource(ctx, svc.ListAccessLists)
-//	fmt.Printf("Total access lists: %v", len(accessLists))
-func CollectResources[T any](ctx context.Context, listFn TokenLister[T], opts ...ForEachOptionFunc) ([]T, error) {
-	var results []T
-	err := ForEachResource(ctx, listFn, func(item T) error {
-		results = append(results, item)
-		return nil
-	}, opts...)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return results, nil
-}
diff --git a/lib/utils/iterators_test.go b/lib/utils/iterators_test.go
deleted file mode 100644
index c05252a153d56..0000000000000
--- a/lib/utils/iterators_test.go
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package utils
-
-import (
-	"context"
-	"strconv"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib/utils/pagination"
-)
-
-func TestCollect(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-	ctx := context.Background()
-	results, err := CollectResources(ctx, mock.List)
-	require.NoError(t, err)
-	require.Equal(t, []int{1, 2, 3, 4, 5}, results)
-}
-
-func TestCollect_WithAdaptedLister(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-	ctx := context.Background()
-	results, err := CollectResources(ctx, AdaptPageTokenLister(mock.ListWithPagination))
-	require.NoError(t, err)
-	assert.Equal(t, []int{1, 2, 3, 4, 5}, results)
-}
-
-func TestForEachResource(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-
-	ctx := context.Background()
-	var count int
-
-	err := ForEachResource(ctx, mock.List, func(item int) error {
-		count++
-		return nil
-	}, WithPageSize(2))
-
-	require.NoError(t, err)
-	require.Len(t, mock.items, 5)
-}
-
-func TestForEachResource_StopIteration(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-
-	ctx := context.Background()
-	var count int
-
-	err := ForEachResource(ctx, mock.List, func(item int) error {
-		count++
-		if item == 3 {
-			return ErrStopIteration
-		}
-		return nil
-	}, WithPageSize(2))
-
-	require.NoError(t, err)
-	require.Equal(t, 3, count)
-}
-
-func TestForEachResource_AdaptPageTokenLister(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-
-	ctx := context.Background()
-	var count int
-
-	err := ForEachResource(ctx, AdaptPageTokenLister(mock.ListWithPagination), func(item int) error {
-		count++
-		return nil
-	}, WithPageSize(2))
-
-	require.NoError(t, err)
-	require.Equal(t, 5, count)
-}
-
-func TestMockBackendLister_List(t *testing.T) {
-	mock := &mockBackendLister{items: []int{1, 2, 3, 4, 5}}
-	ctx := context.Background()
-
-	expectedResults := [][]int{
-		{1}, {2}, {3}, {4}, {5},
-	}
-	pageToken := ""
-
-	for _, expected := range expectedResults {
-		results, nextToken, err := mock.List(ctx, 1, pageToken)
-		require.NoError(t, err)
-		require.Equal(t, expected, results)
-		pageToken = nextToken
-	}
-
-	require.Empty(t, pageToken)
-
-	pageToken = ""
-	results, nextToken, err := mock.List(ctx, 2, pageToken)
-	require.NoError(t, err)
-	require.Equal(t, []int{1, 2}, results)
-	require.NotEmpty(t, nextToken)
-
-	results, nextToken, err = mock.List(ctx, 2, nextToken)
-	require.NoError(t, err)
-	require.Equal(t, []int{3, 4}, results)
-	require.NotEmpty(t, nextToken)
-
-	results, nextToken, err = mock.List(ctx, 2, nextToken)
-	require.NoError(t, err)
-	require.Equal(t, []int{5}, results)
-	require.Empty(t, nextToken)
-}
-
-type mockBackendLister struct {
-	items []int
-}
-
-func (s *mockBackendLister) List(ctx context.Context, pageSize int, pageToken string) ([]int, string, error) {
-	if pageToken == "" {
-		pageToken = "0"
-	}
-	if pageSize <= 0 {
-		pageSize = 2
-	}
-	startIndex, err := strconv.Atoi(pageToken)
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-	endIndex := startIndex + pageSize
-	if endIndex > len(s.items) {
-		endIndex = len(s.items)
-	}
-	items := s.items[startIndex:endIndex]
-	if endIndex < len(s.items) {
-		return items, strconv.Itoa(endIndex), nil
-	}
-	return items, "", nil
-}
-
-func (s *mockBackendLister) ListWithPagination(ctx context.Context, pageSize int, page *pagination.PageRequestToken) ([]int, pagination.NextPageToken, error) {
-	if pageSize == 0 {
-		pageSize = 1
-	}
-	pageToken, err := page.Consume()
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-	resp, nextPage, err := s.List(ctx, pageSize, pageToken)
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-	return resp, pagination.NextPageToken(nextPage), nil
-}
diff --git a/lib/utils/jsontools.go b/lib/utils/jsontools.go
index 0047305eb0c54..c22b420b3c8d2 100644
--- a/lib/utils/jsontools.go
+++ b/lib/utils/jsontools.go
@@ -117,8 +117,7 @@ func FastMarshalIndent(v interface{}, prefix, indent string) ([]byte, error) {
 // WriteJSONArray marshals values as a JSON array.
 func WriteJSONArray[T any](w io.Writer, values []T) error {
 	if len(values) == 0 {
-		_, err := w.Write([]byte("[]"))
-		return err
+		values = []T{}
 	}
 	return WriteJSON(w, values)
 }
@@ -163,6 +162,14 @@ func StreamJSONArray[T any](items stream.Stream[T], out io.Writer, indent bool)
 	return trace.NewAggregate(items.Done(), stream.Flush())
 }
 
+// WriteYAMLArray marshals values as a YAML array.
+func WriteYAMLArray[T any](w io.Writer, values []T) error {
+	if len(values) == 0 {
+		values = []T{}
+	}
+	return writeYAML(w, values)
+}
+
 const yamlDocDelimiter = "---"
 
 // WriteYAML detects whether value is a list
diff --git a/lib/utils/listener/memory.go b/lib/utils/listener/memory.go
new file mode 100644
index 0000000000000..107a56ed18edb
--- /dev/null
+++ b/lib/utils/listener/memory.go
@@ -0,0 +1,119 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package listener
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+)
+
+// InMemoryListener is a in-memory implementation of a net.Listener.
+type InMemoryListener struct {
+	connCh    chan net.Conn
+	closeCh   chan struct{}
+	closeOnce sync.Once
+}
+
+// Accept implements net.Listener.
+func (m *InMemoryListener) Accept() (net.Conn, error) {
+	select {
+	case <-m.closeCh:
+		return nil, io.EOF
+	default:
+	}
+
+	for {
+		select {
+		case conn := <-m.connCh:
+			return conn, nil
+		case <-m.closeCh:
+			return nil, io.EOF
+		}
+	}
+}
+
+// Addr implements net.Listener.
+func (m *InMemoryListener) Addr() net.Addr {
+	return defaultMemoryAddr
+}
+
+// Close implements net.Listener.
+func (m *InMemoryListener) Close() error {
+	m.closeOnce.Do(func() { close(m.closeCh) })
+	return nil
+}
+
+// DialContext dials the memory listener, creating a new net.Conn.
+//
+// This function satisfies net.Dialer.DialContext signature.
+func (m *InMemoryListener) DialContext(ctx context.Context, _ string, _ string) (net.Conn, error) {
+	select {
+	case <-m.closeCh:
+		return nil, ErrListenerClosed
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	serverConn, clientConn := net.Pipe()
+
+	select {
+	case m.connCh <- serverConn:
+	case <-ctx.Done():
+		// In this case the connection was not accepted in time by the server
+		// and the dial context is done. To avoid having the server using an
+		// orphned connection we should close it.
+		_ = serverConn.Close()
+		return nil, ctx.Err()
+	}
+	return clientConn, nil
+}
+
+// MakeHTTPClient is a helper to generate an HTTP client that dials this listener.
+func (m *InMemoryListener) MakeHTTPClient() *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			DialContext: m.DialContext,
+		},
+	}
+}
+
+// ErrListenerClosed is the error returned by dial when the listener is closed.
+var ErrListenerClosed = errors.New("in-memory listener closed")
+
+// NewInMemoryListener initializes a new in-memory listener.
+func NewInMemoryListener() *InMemoryListener {
+	return &InMemoryListener{
+		connCh:  make(chan net.Conn),
+		closeCh: make(chan struct{}),
+	}
+}
+
+var _ net.Listener = (*InMemoryListener)(nil)
+
+type memoryAddr string
+
+func (m memoryAddr) Network() string { return string(m) }
+func (m memoryAddr) String() string  { return string(m) }
+
+var defaultMemoryAddr = memoryAddr("memory")
+
+var _ net.Addr = (*memoryAddr)(nil)
diff --git a/lib/utils/listener/memory_test.go b/lib/utils/listener/memory_test.go
new file mode 100644
index 0000000000000..024a96031de16
--- /dev/null
+++ b/lib/utils/listener/memory_test.go
@@ -0,0 +1,132 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package listener
+
+import (
+	"context"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMemoryListenerClient(t *testing.T) {
+	var wg sync.WaitGroup
+	expectedMessage := "hello from server"
+
+	listener := NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+
+		conn, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		t.Cleanup(func() { conn.Close() })
+
+		_, _ = conn.Write([]byte(expectedMessage))
+	}()
+
+	// To avoid blocking in case the server is not working correctly, wrap
+	// the client connection into a eventually loop.
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		conn, err := listener.DialContext(t.Context(), "", "")
+		require.NoError(collect, err)
+
+		buf := make([]byte, len(expectedMessage))
+		n, err := conn.Read(buf[0:])
+		require.NoError(collect, err)
+		require.Equal(collect, len(expectedMessage), n)
+		require.Equal(collect, expectedMessage, string(buf[:n]))
+	}, 50*time.Millisecond, 10*time.Millisecond)
+
+	require.Eventually(t, func() bool {
+		wg.Wait()
+		return true
+	}, 50*time.Millisecond, 10*time.Millisecond)
+}
+
+func TestMemoryListenerServer(t *testing.T) {
+	var wg sync.WaitGroup
+	expectedMessage := "hello from client"
+
+	listener := NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+
+		conn, err := listener.DialContext(t.Context(), "", "")
+		if err != nil {
+			return
+		}
+
+		_, _ = conn.Write([]byte(expectedMessage))
+	}()
+
+	// To avoid blocking in case the client is not working correctly, wrap
+	// the server accept connection into a eventually loop.
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		conn, err := listener.Accept()
+		require.NoError(collect, err)
+
+		buf := make([]byte, len(expectedMessage))
+		n, err := conn.Read(buf[0:])
+		require.NoError(collect, err)
+		require.Equal(collect, len(expectedMessage), n)
+		require.Equal(collect, expectedMessage, string(buf[:n]))
+	}, 50*time.Millisecond, 10*time.Millisecond)
+
+	// Close the listener and expect subsequent accept calls to return error.
+	listener.Close()
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		_, err := listener.Accept()
+		require.Error(collect, err)
+		require.ErrorIs(collect, err, io.EOF)
+	}, 50*time.Millisecond, 10*time.Millisecond)
+
+	require.Eventually(t, func() bool {
+		wg.Wait()
+		return true
+	}, 50*time.Millisecond, 10*time.Millisecond)
+}
+
+func TestMemoryListenerDialTimeout(t *testing.T) {
+	listener := NewInMemoryListener()
+	t.Cleanup(func() { listener.Close() })
+
+	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
+	defer cancel()
+
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		_, err := listener.DialContext(ctx, "", "")
+		require.Error(collect, err)
+		require.ErrorIs(collect, err, context.DeadlineExceeded)
+	}, 100*time.Millisecond, 10*time.Millisecond)
+
+	require.Never(t, func() bool {
+		_, _ = listener.Accept()
+		return true
+	}, 50*time.Millisecond, 10*time.Millisecond, "expected server to not have received connections")
+}
diff --git a/lib/utils/log/log.go b/lib/utils/log/log.go
index 3e68086500e29..9be14a0b734a6 100644
--- a/lib/utils/log/log.go
+++ b/lib/utils/log/log.go
@@ -57,11 +57,16 @@ const (
 	LogOutputSyslog = "syslog"
 	// LogOutputOSLog represents os_log, the unified logging system on macOS, as the destination for logs.
 	LogOutputOSLog = "os_log"
+	// LogOutputMCP defines to where the MCP command logs will be directed to.
+	// The stdout is exclusively used as the MCP server transport, leaving only
+	// stderr available.
+	LogOutputMCP = "stderr"
 )
 
 // Initialize configures the default global logger based on the
-// provided configuration. The [slog.Logger] and [slog.LevelVar]
-func Initialize(loggerConfig Config) (*slog.Logger, *slog.LevelVar, error) {
+// provided configuration. Returns a [slog.Logger] with its underlying
+// [slog.LevelVar] and [io.Writer].
+func Initialize(loggerConfig Config) (*slog.Logger, *slog.LevelVar, io.Writer, error) {
 	level := new(slog.LevelVar)
 	switch strings.ToLower(loggerConfig.Severity) {
 	case "", "info":
@@ -75,23 +80,26 @@ func Initialize(loggerConfig Config) (*slog.Logger, *slog.LevelVar, error) {
 	case "trace":
 		level.Set(TraceLevel)
 	default:
-		return nil, nil, trace.BadParameter("unsupported logger severity: %q", loggerConfig.Severity)
+		return nil, nil, nil, trace.BadParameter("unsupported logger severity: %q", loggerConfig.Severity)
 	}
 
 	if loggerConfig.Output == LogOutputOSLog {
 		if loggerConfig.OSLogSubsystem == "" {
-			return nil, nil, trace.BadParameter("OSLogSubsystem must be set when using os_log as output")
+			return nil, nil, nil, trace.BadParameter("OSLogSubsystem must be set when using os_log as output")
 		}
 
 		//nolint:staticcheck // SA4023. NewSlogOSLogHandler on unsupported platforms always returns err.
 		handler, err := NewSlogOSLogHandler(loggerConfig.OSLogSubsystem, level)
 		//nolint:staticcheck // SA4023.
 		if err != nil {
-			return nil, nil, trace.Wrap(err)
+			return nil, nil, nil, trace.Wrap(err)
 		}
 		logger := slog.New(handler)
 		slog.SetDefault(logger)
-		return logger, level, nil
+
+		// Return [io.Discard] as the [io.Writer] because the teleport binary
+		// does not currently support os_log.
+		return logger, level, io.Discard, nil
 	}
 
 	const (
@@ -115,23 +123,23 @@ func Initialize(loggerConfig Config) (*slog.Logger, *slog.LevelVar, error) {
 		if err != nil {
 			slog.ErrorContext(context.Background(), "Failed to switch logging to syslog", "error", err)
 			slog.SetDefault(slog.New(slog.DiscardHandler))
-			return slog.Default(), level, nil
+			return slog.Default(), level, io.Discard, nil
 		}
 	default:
 		// Assume a file path for all other provided output values.
 		sharedWriter, err := NewFileSharedWriter(loggerConfig.Output, logFileDefaultFlag, logFileDefaultMode)
 		if err != nil {
-			return nil, nil, trace.Wrap(err, "failed to init the log file shared writer")
+			return nil, nil, nil, trace.Wrap(err, "failed to init the log file shared writer")
 		}
 		w = NewWriterFinalizer(sharedWriter)
 		if err := sharedWriter.RunWatcherReopen(context.Background()); err != nil {
-			return nil, nil, trace.Wrap(err)
+			return nil, nil, nil, trace.Wrap(err)
 		}
 	}
 
 	configuredFields, err := ValidateFields(loggerConfig.ExtraFields)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, nil, nil, trace.Wrap(err)
 	}
 
 	format := strings.ToLower(loggerConfig.Format)
@@ -154,8 +162,8 @@ func Initialize(loggerConfig Config) (*slog.Logger, *slog.LevelVar, error) {
 		}))
 		slog.SetDefault(logger)
 	default:
-		return nil, nil, trace.BadParameter("unsupported log output format : %q", loggerConfig.Format)
+		return nil, nil, nil, trace.BadParameter("unsupported log output format : %q", loggerConfig.Format)
 	}
 
-	return logger, level, nil
+	return logger, level, w, nil
 }
diff --git a/lib/utils/log/logtest/log.go b/lib/utils/log/logtest/log.go
new file mode 100644
index 0000000000000..f43f2cea7e28c
--- /dev/null
+++ b/lib/utils/log/logtest/log.go
@@ -0,0 +1,59 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package logtest
+
+import (
+	"flag"
+	"log/slog"
+	"sync"
+
+	"github.com/gravitational/teleport/lib/utils/log"
+)
+
+var initLoggerOnce = sync.Once{}
+
+// InitLogger initializes the standard logger.
+func InitLogger(verbose func() bool) {
+	initLoggerOnce.Do(func() {
+		if !flag.Parsed() {
+			// Parse flags to check testing.Verbose().
+			flag.Parse()
+		}
+
+		if !verbose() {
+			slog.SetDefault(slog.New(slog.DiscardHandler))
+			return
+		}
+
+		log.Initialize(log.Config{
+			Severity: slog.LevelDebug.String(),
+			Format:   "json",
+		})
+	})
+}
+
+// With creates a new [slog.Logger] with the provided attributes for test environments.
+func With(args ...any) *slog.Logger {
+	InitLogger(func() bool { return false })
+	return slog.With(args...)
+}
+
+// NewLogger creates a new [slog.Logger] for test environments.
+func NewLogger() *slog.Logger {
+	InitLogger(func() bool { return false })
+	return slog.Default()
+}
diff --git a/lib/utils/log/slog.go b/lib/utils/log/slog.go
index 2771a4d6be770..2f219419dc0b0 100644
--- a/lib/utils/log/slog.go
+++ b/lib/utils/log/slog.go
@@ -175,6 +175,29 @@ func (s stringerAttr) LogValue() slog.Value {
 	return slog.StringValue(s.Stringer.String())
 }
 
+type stringerSliceAttr[T fmt.Stringer] struct {
+	stringers []T
+}
+
+func (s stringerSliceAttr[T]) LogValue() slog.Value {
+	return slog.StringValue(fmt.Sprint(s.stringers))
+}
+
+// StringerSliceAttr creates a [slog.LogValuer] that will defer formatting a
+// slice of [fmt.Stringer] as a string. All slog attributes are always evaluated,
+// even if the log event is discarded due to the configured log level.
+// A text [slog.Handler] will try to defer evaluation if the attribute is a
+// [fmt.Stringer], however, the JSON [slog.Handler] only defers to [json.Marshaler].
+// This means that to defer evaluation and creation of the string representation,
+// the object must implement [fmt.Stringer] and [json.Marshaler], otherwise additional
+// and unwanted values may be emitted if the logger is configured to use JSON
+// instead of text. This wrapping mechanism allows a slice of a type that
+// implements [fmt.Stringer], to be guaranteed to be lazily constructed and
+// always output the same content regardless of the output format.
+func StringerSliceAttr[T fmt.Stringer](ss []T) slog.LogValuer {
+	return stringerSliceAttr[T]{stringers: ss}
+}
+
 type typeAttr struct {
 	val any
 }
diff --git a/lib/utils/log/writer_finalizer.go b/lib/utils/log/writer_finalizer.go
index b90de0e8e3fdc..a3b82929ac5d8 100644
--- a/lib/utils/log/writer_finalizer.go
+++ b/lib/utils/log/writer_finalizer.go
@@ -34,7 +34,7 @@ func NewWriterFinalizer[T io.WriteCloser](writer T) *WriterFinalizer[T] {
 	wr := &WriterFinalizer[T]{
 		writer: writer,
 	}
-	runtime.SetFinalizer(wr, (*WriterFinalizer[T]).Close)
+	runtime.AddCleanup(wr, func(writer T) { _ = writer.Close() }, writer)
 	return wr
 }
 
diff --git a/lib/utils/mcptest/test.go b/lib/utils/mcptest/test.go
new file mode 100644
index 0000000000000..7f8c36beb9316
--- /dev/null
+++ b/lib/utils/mcptest/test.go
@@ -0,0 +1,121 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcptest
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gravitational/trace"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/require"
+)
+
+// NewServer creates an MCP test server that provides a "hello-server" tool that
+// always returns "hello-client".
+func NewServer() *mcpserver.MCPServer {
+	return NewServerWithVersion("1.0.0")
+}
+
+// NewServerWithVersion creates an MCP test server with the specified version
+// and provides a "hello-server" tool that always returns "hello-client".
+func NewServerWithVersion(version string) *mcpserver.MCPServer {
+	server := mcpserver.NewMCPServer("test-server", version)
+	server.AddTool(mcp.Tool{
+		Name: "hello-server",
+	}, func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		return &mcp.CallToolResult{
+			Content: []mcp.Content{mcp.NewTextContent("hello client")},
+		}, nil
+	})
+	return server
+}
+
+// MustStartSSETestServer starts an SSE server returns the SSE endpoint.
+func MustStartSSETestServer(t *testing.T) string {
+	t.Helper()
+	sseServer := mcpserver.NewSSEServer(NewServer())
+	httpServer := httptest.NewServer(sseServer)
+	t.Cleanup(httpServer.Close)
+	return httpServer.URL + "/sse"
+}
+
+// NewStdioClient creates a new stdio client and ensures the client is closed
+// when testing is done.
+func NewStdioClient(t *testing.T, input io.Reader, output io.WriteCloser) *mcpclient.Client {
+	t.Helper()
+	stdioClientTransport := mcpclienttransport.NewIO(input, output, io.NopCloser(bytes.NewReader(nil)))
+	require.NoError(t, stdioClientTransport.Start(t.Context()))
+	stdioClient := mcpclient.NewClient(stdioClientTransport)
+	t.Cleanup(func() {
+		stdioClient.Close()
+	})
+	require.NoError(t, stdioClient.Start(t.Context()))
+	return stdioClient
+}
+
+func NewStdioClientFromConn(t *testing.T, conn io.ReadWriteCloser) *mcpclient.Client {
+	t.Helper()
+	return NewStdioClient(t, conn, conn)
+}
+
+// InitializeClient starts initialize sequence and returns the initialize result
+// from the server.
+func InitializeClient(ctx context.Context, client *mcpclient.Client) (*mcp.InitializeResult, error) {
+	initReq := mcp.InitializeRequest{}
+	initReq.Params.ProtocolVersion = mcp.LATEST_PROTOCOL_VERSION
+	initReq.Params.ClientInfo = mcp.Implementation{
+		Name:    "test-client",
+		Version: "1.0.0",
+	}
+	resp, err := client.Initialize(ctx, initReq)
+	return resp, trace.Wrap(err)
+}
+
+func MustInitializeClient(t *testing.T, client *mcpclient.Client) *mcp.InitializeResult {
+	t.Helper()
+	result, err := InitializeClient(t.Context(), client)
+	require.NoError(t, err)
+	return result
+}
+
+// MustCallServerTool calls the "hello-server" tool and verifies the result.
+func MustCallServerTool(t *testing.T, client *mcpclient.Client) {
+	t.Helper()
+	callToolResult, err := CallServerTool(t.Context(), client)
+	require.NoError(t, err)
+	require.NotNil(t, callToolResult)
+	require.Equal(t, []mcp.Content{
+		mcp.NewTextContent("hello client"),
+	}, callToolResult.Content)
+}
+
+// CallServerTool calls the "hello-server" tool
+func CallServerTool(ctx context.Context, client *mcpclient.Client) (*mcp.CallToolResult, error) {
+	callToolRequest := mcp.CallToolRequest{}
+	callToolRequest.Params.Name = "hello-server"
+	callToolResult, err := client.CallTool(ctx, callToolRequest)
+	return callToolResult, trace.Wrap(err)
+}
diff --git a/lib/utils/mcputils/errors.go b/lib/utils/mcputils/errors.go
new file mode 100644
index 0000000000000..3e2d46e6c8e0b
--- /dev/null
+++ b/lib/utils/mcputils/errors.go
@@ -0,0 +1,68 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"errors"
+	"io"
+	"io/fs"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// IsOKCloseError checks if provided error is a common close error that
+// indicates the connection is ended.
+func IsOKCloseError(err error) bool {
+	return errors.Is(err, io.ErrClosedPipe) ||
+		isFileClosedError(err) ||
+		utils.IsOKNetworkError(err)
+}
+
+// isFileClosedError check if the error is a common error when exec.Command
+// pipes are closed.
+func isFileClosedError(err error) bool {
+	var pathErr *fs.PathError
+	if !errors.As(err, &pathErr) {
+		return false
+	}
+	return errors.Is(pathErr.Err, fs.ErrClosed)
+}
+
+type readerParseError struct {
+	Err error
+}
+
+func (e *readerParseError) Error() string {
+	return e.Err.Error()
+}
+
+func (e *readerParseError) Unwrap() error {
+	return e.Err
+}
+
+func isReaderParseError(err error) bool {
+	var parseError *readerParseError
+	return errors.As(err, &parseError)
+}
+
+func newReaderParseError(err error) error {
+	return &readerParseError{
+		Err: err,
+	}
+}
diff --git a/lib/utils/mcputils/http.go b/lib/utils/mcputils/http.go
new file mode 100644
index 0000000000000..638d3c0ca2d22
--- /dev/null
+++ b/lib/utils/mcputils/http.go
@@ -0,0 +1,259 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"mime"
+	"net/http"
+	"strconv"
+
+	"github.com/gravitational/trace"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// ServerMessageProcessor defines an interface that process JSON RPC responses
+// and notifications.
+type ServerMessageProcessor interface {
+	// ProcessResponse process a response and returns the message for client.
+	ProcessResponse(context.Context, *JSONRPCResponse) mcp.JSONRPCMessage
+	// ProcessNotification process a notification and returns the message for client.
+	ProcessNotification(context.Context, *JSONRPCNotification) mcp.JSONRPCMessage
+}
+
+// ReplaceHTTPResponse handles replacing the MCP server response for the
+// streamable HTTP transport.
+//
+// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http
+func ReplaceHTTPResponse(ctx context.Context, resp *http.Response, processor ServerMessageProcessor) error {
+	// Nothing to replace.
+	if resp.StatusCode != http.StatusOK || resp.ContentLength == 0 {
+		return nil
+	}
+
+	mediaType, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	switch mediaType {
+	case "application/json":
+		// Single response.
+		respBody, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPRequestSize)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		respFromServer, err := unmarshalResponse(string(respBody))
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		respToClient := processor.ProcessResponse(ctx, respFromServer)
+		respToClientAsBody, err := json.Marshal(respToClient)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		resp.Body = io.NopCloser(bytes.NewReader(respToClientAsBody))
+
+		// Make sure content length in both the response field and the header
+		// are updated.
+		resp.ContentLength = int64(len(respToClientAsBody))
+		resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(respToClientAsBody)), 10))
+		return nil
+
+	case "text/event-stream":
+		// Multiple messages (response or notification) can be sent through SSE.
+		// Instead of reading all messages then replacing them, here we replace
+		// the body with a reader that process the event one a time.
+		resp.Body = &httpSSEResponseReplacer{
+			ctx:               ctx,
+			SSEResponseReader: NewSSEResponseReader(resp.Body),
+			processor:         processor,
+		}
+
+		// Content-Length should be -1 from server for streams. Force to -1 again just to
+		// be sure.
+		resp.ContentLength = -1
+		resp.Header.Del("Content-Length")
+		return nil
+	default:
+		return trace.BadParameter("unsupported response type %s", mediaType)
+	}
+}
+
+type httpSSEResponseReplacer struct {
+	*SSEResponseReader
+	ctx       context.Context
+	processor ServerMessageProcessor
+	buf       []byte
+}
+
+func (r *httpSSEResponseReplacer) Read(p []byte) (int, error) {
+	if len(r.buf) != 0 {
+		n := copy(p, r.buf)
+		r.buf = r.buf[n:]
+		return n, nil
+	}
+
+	msg, err := r.ReadMessage(r.ctx)
+	if err != nil {
+		if utils.IsOKNetworkError(err) {
+			return 0, io.EOF
+		}
+		return 0, trace.Wrap(err)
+	}
+
+	var base BaseJSONRPCMessage
+	if err := json.Unmarshal([]byte(msg), &base); err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	var respToClient mcp.JSONRPCMessage
+	switch {
+	case base.IsResponse():
+		respToClient = r.processor.ProcessResponse(r.ctx, base.MakeResponse())
+	case base.IsNotification():
+		respToClient = r.processor.ProcessNotification(r.ctx, base.MakeNotification())
+	default:
+		return 0, trace.BadParameter("message is not a response or a notification")
+	}
+
+	respToSendAsBody, err := json.Marshal(respToClient)
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	// Convert to SSE.
+	e := event{
+		name: sseEventMessage,
+		data: respToSendAsBody,
+	}
+	r.buf = e.marshal()
+	return r.Read(p)
+}
+
+// HTTPReaderWriter implements MessageWriter and TransportReader for
+// streamable HTTP transport.
+type HTTPReaderWriter struct {
+	targetClient   *mcpclienttransport.StreamableHTTP
+	messagesToRead chan string
+}
+
+// NewHTTPReaderWriter creates a new HTTPReaderWriter that implements
+// MessageWriter and TransportReader that connects to provided serverURL in
+// streamable HTTP transport.
+func NewHTTPReaderWriter(
+	ctx context.Context,
+	serverURL string,
+	opts ...mcpclienttransport.StreamableHTTPCOption,
+) (*HTTPReaderWriter, error) {
+	// Use a real client transport from mcp-go to avoid writing custom logic.
+	targetClient, err := mcpclienttransport.NewStreamableHTTP(serverURL, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	h := &HTTPReaderWriter{
+		targetClient: targetClient,
+		// Normally only one message at a time. Use a small buffer just in case.
+		messagesToRead: make(chan string, 10),
+	}
+
+	// Notification will only be received if mcpclienttransport.WithContinuousListening
+	// is set and the listen (GET) request is successful.
+	h.targetClient.SetNotificationHandler(func(notification mcp.JSONRPCNotification) {
+		if err := h.sendMessageToRead(notification); err != nil {
+			// Error should never happen. Log a warning just in case.
+			slog.WarnContext(ctx, "failed to marshal msg", "error", err)
+		}
+	})
+	if err := h.targetClient.Start(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return h, nil
+}
+
+func (h *HTTPReaderWriter) sendMessageToRead(msg any) error {
+	data, err := json.Marshal(msg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	h.messagesToRead <- string(data)
+	return nil
+}
+
+// WriteMessage sends out a HTTP request to target. WriteMessage implements
+// MessageWriter.
+func (h *HTTPReaderWriter) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	switch v := msg.(type) {
+	case *JSONRPCRequest:
+		resp, err := h.targetClient.SendRequest(ctx, mcpclienttransport.JSONRPCRequest{
+			JSONRPC: v.JSONRPC,
+			ID:      v.ID,
+			Method:  v.Method,
+			Params:  v.Params,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		return trace.Wrap(h.sendMessageToRead(resp))
+
+	case *JSONRPCNotification:
+		return trace.Wrap(h.targetClient.SendNotification(ctx, mcp.JSONRPCNotification{
+			JSONRPC: v.JSONRPC,
+			Notification: mcp.Notification{
+				Method: v.Method,
+				Params: mcp.NotificationParams{
+					AdditionalFields: v.Params,
+				},
+			},
+		}))
+
+	default:
+		return trace.BadParameter("unrecognized message type: %T", msg)
+	}
+}
+
+// Type implements TransportReader.
+func (h *HTTPReaderWriter) Type() string {
+	return types.MCPTransportHTTP
+}
+
+// ReadMessage returns responses and notifications received from the target.
+// ReadMessage implements TransportReader.
+func (h *HTTPReaderWriter) ReadMessage(ctx context.Context) (string, error) {
+	select {
+	case <-ctx.Done():
+		return "", io.EOF
+	case msg := <-h.messagesToRead:
+		return msg, nil
+	}
+}
+
+// Close implements TransportReader.
+func (h *HTTPReaderWriter) Close() error {
+	return trace.Wrap(h.targetClient.Close())
+}
diff --git a/lib/utils/mcputils/http_test.go b/lib/utils/mcputils/http_test.go
new file mode 100644
index 0000000000000..addc52cb8fcfe
--- /dev/null
+++ b/lib/utils/mcputils/http_test.go
@@ -0,0 +1,254 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"net/http"
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/gravitational/trace"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	listenerutils "github.com/gravitational/teleport/lib/utils/listener"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
+)
+
+func TestMain(m *testing.M) {
+	logtest.InitLogger(testing.Verbose)
+	os.Exit(m.Run())
+}
+
+func TestReplaceHTTPResponse(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+
+		// Set up a server.
+		mcpServer := mcptest.NewServerWithVersion("11.22.33")
+		listener := makeHTTPServerWithInMemoryListener(t, mcpServer)
+
+		// Set up a client with custom transport which calls "ReplaceHTTPResponse".
+		httpClientTransport := newTestReplaceHTTPResponseTransport(listener)
+		mcpClientTransport, err := mcpclienttransport.NewStreamableHTTP(
+			"http://memory/mcp",
+			mcpclienttransport.WithHTTPBasicClient(
+				&http.Client{Transport: httpClientTransport},
+			),
+			mcpclienttransport.WithContinuousListening(),
+		)
+		require.NoError(t, err)
+		var countMCPNotification atomic.Uint32
+		client := mcpclient.NewClient(mcpClientTransport)
+		client.OnNotification(func(notification mcp.JSONRPCNotification) {
+			countMCPNotification.Add(1)
+		})
+		require.NoError(t, client.Start(ctx))
+
+		// Initialize client and call a tool.
+		result := mcptest.MustInitializeClient(t, client)
+		require.Equal(t, "111.222.333", result.ServerInfo.Version)
+		mcptest.MustCallServerTool(t, client)
+		require.Equal(t, uint32(2), httpClientTransport.countMCPResponse.Load())
+
+		// Send notifications from server. Notifications will be sent through SSE.
+		synctest.Wait() // Wait for client to establish the GET connection.
+		mcpServer.SendNotificationToAllClients("notifications/test", nil)
+		mcpServer.SendNotificationToAllClients("notifications/test", nil)
+		synctest.Wait() // Wait for client to receive notifications.
+		require.Equal(t, uint32(2), countMCPNotification.Load())
+
+		// Close client and count the requests.
+		require.NoError(t, client.Close())
+		synctest.Wait()
+		require.Equal(t, map[string]int{
+			"GET":    1, // For listening on SSE events.
+			"POST":   3, // "initialize", "notifications/initialize", and "tools/call".
+			"DELETE": 1, // Close session.
+		}, httpClientTransport.getCountMethods())
+	})
+}
+
+type testReplaceHTTPResponseTransport struct {
+	countMethods     map[string]int
+	countMethodsMu   sync.Mutex
+	countMCPResponse atomic.Uint32
+	client           http.Client
+}
+
+func newTestReplaceHTTPResponseTransport(inMemoryListener *listenerutils.InMemoryListener) *testReplaceHTTPResponseTransport {
+	return &testReplaceHTTPResponseTransport{
+		countMethods: make(map[string]int),
+		client: http.Client{
+			Transport: &http.Transport{
+				DialContext: inMemoryListener.DialContext,
+			},
+		},
+	}
+}
+
+func (t *testReplaceHTTPResponseTransport) getCountMethods() map[string]int {
+	t.countMethodsMu.Lock()
+	defer t.countMethodsMu.Unlock()
+	return maps.Clone(t.countMethods)
+}
+
+func (t *testReplaceHTTPResponseTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	t.countMethodsMu.Lock()
+	t.countMethods[r.Method]++
+	t.countMethodsMu.Unlock()
+
+	resp, err := t.client.Do(r)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := ReplaceHTTPResponse(r.Context(), resp, t); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if resp != nil {
+		switch {
+		case resp.ContentLength >= 0:
+			if resp.Header.Get("Content-Length") != fmt.Sprintf("%d", resp.ContentLength) {
+				return nil, trace.CompareFailed("Content-Length does not match Content-Length header")
+			}
+
+		default:
+			if resp.Header.Get("Content-Length") != "" {
+				return nil, trace.CompareFailed("Content-Length does not match Content-Length header")
+			}
+		}
+	}
+
+	return resp, nil
+}
+
+func (t *testReplaceHTTPResponseTransport) ProcessResponse(_ context.Context, response *JSONRPCResponse) mcp.JSONRPCMessage {
+	// Replace server version.
+	response.Result = bytes.ReplaceAll(response.Result, []byte("11.22.33"), []byte("111.222.333"))
+	t.countMCPResponse.Add(1)
+	return response
+}
+
+func (t *testReplaceHTTPResponseTransport) ProcessNotification(_ context.Context, notification *JSONRPCNotification) mcp.JSONRPCMessage {
+	return notification
+}
+
+func TestHTTPReaderWriter(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		ctx := t.Context()
+
+		// Set up an MCP server.
+		mcpServer := mcptest.NewServer()
+		listener := makeHTTPServerWithInMemoryListener(t, mcpServer)
+
+		// Create a proxy that converts from stdio to HTTP.
+		clientStdin, writeToClient := io.Pipe()
+		readFromClient, clientStdout := io.Pipe()
+		t.Cleanup(func() {
+			assert.NoError(t, trace.NewAggregate(
+				clientStdin.Close(), writeToClient.Close(),
+				readFromClient.Close(), clientStdout.Close(),
+			))
+		})
+
+		serverReaderWriter, err := NewHTTPReaderWriter(
+			ctx,
+			"http://memory/mcp",
+			mcpclienttransport.WithContinuousListening(),
+			mcpclienttransport.WithHTTPBasicClient(listener.MakeHTTPClient()),
+		)
+		require.NoError(t, err)
+		defer serverReaderWriter.Close() // Send DELETE before server is shutdown
+
+		clientTransportReader := NewStdioReader(readFromClient)
+		clientWriter := NewStdioMessageWriter(writeToClient)
+		proxyReaderWriter(t, clientTransportReader, clientWriter, serverReaderWriter, serverReaderWriter)
+
+		// Make a "high-level" stdio MCP client and test the proxy.
+		var receivedNotifications []mcp.JSONRPCNotification
+		stdioClient := mcptest.NewStdioClient(t, clientStdin, clientStdout)
+		stdioClient.OnNotification(func(notification mcp.JSONRPCNotification) {
+			receivedNotifications = append(receivedNotifications, notification)
+		})
+		mcptest.MustInitializeClient(t, stdioClient)
+		mcptest.MustCallServerTool(t, stdioClient)
+
+		// Test listening notifications from server.
+		// First do a synctest.Wait until the client establish the listening
+		// stream before sending the notification from the server. Then do
+		// another synctest.Wait for the client to receive the notification.
+		synctest.Wait()
+		mcpServer.SendNotificationToAllClients("notifications/test", nil)
+		synctest.Wait()
+		require.Len(t, receivedNotifications, 1)
+		require.Equal(t, "notifications/test", receivedNotifications[0].Notification.Method)
+	})
+}
+
+func proxyReaderWriter(
+	t *testing.T,
+	clientTransportReader TransportReader,
+	clientWriter MessageWriter,
+	serverTransportReader TransportReader,
+	serverWriter MessageWriter,
+) {
+	t.Helper()
+
+	clientMessageReader, err := NewForwardMessageReader(slog.Default(), clientTransportReader, serverWriter)
+	require.NoError(t, err)
+	serverMessageReader, err := NewForwardMessageReader(slog.Default(), serverTransportReader, clientWriter)
+	require.NoError(t, err)
+	go clientMessageReader.Run(t.Context())
+	go serverMessageReader.Run(t.Context())
+}
+
+// makeHTTPServerWithInMemoryListener starts a streamable-HTTP MCP server using
+// an InMemoryListener. InMemoryListener is good to use with synctest.
+func makeHTTPServerWithInMemoryListener(t *testing.T, mcpServer *mcpserver.MCPServer) *listenerutils.InMemoryListener {
+	t.Helper()
+	listener := listenerutils.NewInMemoryListener()
+	httpServer := &http.Server{
+		Handler: mcpserver.NewStreamableHTTPServer(mcpServer),
+	}
+	go httpServer.Serve(listener)
+	t.Cleanup(func() {
+		httpServer.Close()
+	})
+	return listener
+}
diff --git a/lib/utils/mcputils/id_tracker.go b/lib/utils/mcputils/id_tracker.go
new file mode 100644
index 0000000000000..01bbbf648d59a
--- /dev/null
+++ b/lib/utils/mcputils/id_tracker.go
@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"sync"
+
+	"github.com/gravitational/trace"
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+// IDTracker tracks message information like method based on ID. IDTracker
+// internally uses an LRU cache to keep track the last X messages to avoid
+// growing infinitely. IDTracker is safe for concurrent use.
+type IDTracker struct {
+	mu       sync.Mutex
+	lruCache *simplelru.LRU[mcp.RequestId, string]
+}
+
+// NewIDTracker creates a new IDTracker with provided maximum size.
+func NewIDTracker(size int) (*IDTracker, error) {
+	lruCache, err := simplelru.NewLRU[mcp.RequestId, string](size, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &IDTracker{
+		lruCache: lruCache,
+	}, nil
+}
+
+// PushRequest tracks a request. Returns true if the request has been added to
+// cache.
+func (t *IDTracker) PushRequest(msg *JSONRPCRequest) bool {
+	if msg == nil || msg.ID.IsNil() || msg.Method == "" {
+		return false
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.lruCache.Add(msg.ID, msg.Method)
+	return true
+}
+
+// PopByID retrieves the tracked information and remove it from the tracker.
+func (t *IDTracker) PopByID(id mcp.RequestId) (string, bool) {
+	if id.IsNil() {
+		return "", false
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	retrieved, ok := t.lruCache.Get(id)
+	if !ok {
+		return "", false
+	}
+	t.lruCache.Remove(id)
+	return retrieved, true
+}
+
+// Len returns the size of the tracker cache.
+func (t *IDTracker) Len() int {
+	return t.lruCache.Len()
+}
diff --git a/lib/utils/mcputils/id_tracker_test.go b/lib/utils/mcputils/id_tracker_test.go
new file mode 100644
index 0000000000000..3036179deae56
--- /dev/null
+++ b/lib/utils/mcputils/id_tracker_test.go
@@ -0,0 +1,109 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIDTracker(t *testing.T) {
+	tracker, err := NewIDTracker(5)
+	require.NoError(t, err)
+	require.Empty(t, tracker.Len())
+
+	t.Run("request missing ID not tracked", func(t *testing.T) {
+		require.False(t, tracker.PushRequest(&JSONRPCRequest{
+			Method: "bad",
+		}))
+		require.Empty(t, tracker.Len())
+	})
+
+	t.Run("request tracked", func(t *testing.T) {
+		require.True(t, tracker.PushRequest(&JSONRPCRequest{
+			ID:     mcp.NewRequestId(0),
+			Method: MethodToolsList,
+		}))
+		require.Equal(t, 1, tracker.Len())
+	})
+
+	t.Run("pop unknown id", func(t *testing.T) {
+		unknownIDs := []mcp.RequestId{
+			mcp.NewRequestId(5),
+			mcp.NewRequestId("0"),
+			mcp.NewRequestId(nil),
+		}
+		for id := range slices.Values(unknownIDs) {
+			t.Run(fmt.Sprintf("%T", id), func(t *testing.T) {
+				_, ok := tracker.PopByID(id)
+				require.False(t, ok)
+				require.Equal(t, 1, tracker.Len())
+			})
+		}
+	})
+
+	t.Run("pop tracked id", func(t *testing.T) {
+		method, ok := tracker.PopByID(mcp.NewRequestId(0))
+		require.True(t, ok)
+		require.Equal(t, MethodToolsList, method)
+		require.Empty(t, tracker.Len())
+	})
+
+	t.Run("track last 5", func(t *testing.T) {
+		for i := range 20 {
+			tracker.PushRequest(&JSONRPCRequest{
+				ID:     mcp.NewRequestId(i + 1),
+				Method: MethodToolsCall,
+			})
+			require.LessOrEqual(t, tracker.Len(), 10)
+		}
+		for i := range 5 {
+			method, ok := tracker.PopByID(mcp.NewRequestId(20 - i))
+			require.True(t, ok)
+			require.Equal(t, MethodToolsCall, method)
+		}
+		require.Empty(t, tracker.Len())
+	})
+}
+
+func BenchmarkIDTracker(b *testing.B) {
+	idTracker, err := NewIDTracker(100)
+	require.NoError(b, err)
+
+	for i := 0; i < 100; i++ {
+		idTracker.PushRequest(&JSONRPCRequest{
+			ID:     mcp.NewRequestId(i),
+			Method: MethodToolsList,
+		})
+	}
+
+	// cpu: Apple M3 Pro
+	// BenchmarkIDTracker-12    	12267649	        81.85 ns/op
+	for b.Loop() {
+		idTracker.PushRequest(&JSONRPCRequest{
+			ID:     mcp.NewRequestId(2000),
+			Method: MethodToolsList,
+		})
+		idTracker.PopByID(mcp.NewRequestId(2000))
+	}
+}
diff --git a/lib/utils/mcputils/protocol.go b/lib/utils/mcputils/protocol.go
new file mode 100644
index 0000000000000..19cc5170fcc61
--- /dev/null
+++ b/lib/utils/mcputils/protocol.go
@@ -0,0 +1,249 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"encoding/json"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+)
+
+// Type definitions from both mcp-go/client/transport or mcp-go are not suitable
+// for our reverse proxy use, thus this file redefines them.
+//
+// TODO(greedy52) switch to official golang lib or official go SDK if they offer
+// the level of handling we need. Same goes for other helpers like StdioXXX.
+
+// JSONRPCParams defines params for request or notification.
+// TODO(greedy52) handle metadata
+type JSONRPCParams map[string]any
+
+// GetEventParams returns the apievents.Struct for auditing.
+func (p JSONRPCParams) GetEventParams() *apievents.Struct {
+	if p == nil {
+		return nil
+	}
+
+	eventParams, _ := apievents.EncodeMap(p)
+	return eventParams
+}
+
+// GetName returns the "name" param.
+func (p JSONRPCParams) GetName() (string, bool) {
+	if p == nil {
+		return "", false
+	}
+	name, ok := p["name"].(string)
+	return name, ok
+}
+
+// BaseJSONRPCMessage is a base message that includes all fields for MCP
+// protocol.
+//
+// Note that json.RawMessage is used to keep the original content when
+// marshaling it again. json.RawMessage can also be easily unmarshalled to user
+// defined types when needed. Same applies to other types in this file.
+type BaseJSONRPCMessage struct {
+	// JSONRPC specifies the version of JSONRPC.
+	JSONRPC string `json:"jsonrpc"`
+	// ID is the ID for request and response. ID is nil for notification.
+	ID mcp.RequestId `json:"id,omitempty"`
+	// Method is the request or notification method. Method is empty for response.
+	Method string `json:"method,omitempty"`
+	// Params is the params for request and notification.
+	Params JSONRPCParams `json:"params,omitempty"`
+	// Result is the response result.
+	Result json.RawMessage `json:"result,omitempty"`
+	// Error is the response error.
+	Error json.RawMessage `json:"error,omitempty"`
+}
+
+// IsNotification returns true if the message is a notification.
+func (m *BaseJSONRPCMessage) IsNotification() bool {
+	return m.ID.IsNil()
+}
+
+// IsRequest returns true if the message is a request.
+func (m *BaseJSONRPCMessage) IsRequest() bool {
+	return !m.ID.IsNil() && m.Method != ""
+}
+
+// IsResponse returns if the message is a response.
+func (m *BaseJSONRPCMessage) IsResponse() bool {
+	return !m.ID.IsNil() && (m.Result != nil || m.Error != nil)
+}
+
+// MakeNotification converts the base message to JSONRPCNotification.
+func (m *BaseJSONRPCMessage) MakeNotification() *JSONRPCNotification {
+	return &JSONRPCNotification{
+		JSONRPC: m.JSONRPC,
+		Method:  m.Method,
+		Params:  m.Params,
+	}
+}
+
+// MakeRequest converts the base message to JSONRPCRequest.
+func (m *BaseJSONRPCMessage) MakeRequest() *JSONRPCRequest {
+	return &JSONRPCRequest{
+		JSONRPC: m.JSONRPC,
+		ID:      m.ID,
+		Method:  m.Method,
+		Params:  m.Params,
+	}
+}
+
+// MakeResponse converts the base message to JSONRPCResponse.
+func (m *BaseJSONRPCMessage) MakeResponse() *JSONRPCResponse {
+	return &JSONRPCResponse{
+		JSONRPC: m.JSONRPC,
+		ID:      m.ID,
+		Result:  m.Result,
+		Error:   m.Error,
+	}
+}
+
+// JSONRPCNotification defines a MCP notification.
+//
+// https://modelcontextprotocol.io/specification/2025-03-26/basic#notifications
+type JSONRPCNotification struct {
+	JSONRPC string        `json:"jsonrpc"`
+	Method  string        `json:"method"`
+	Params  JSONRPCParams `json:"params,omitempty"`
+}
+
+// JSONRPCRequest defines a MCP request.
+//
+// https://modelcontextprotocol.io/specification/2025-03-26/basic#requests
+type JSONRPCRequest struct {
+	JSONRPC string        `json:"jsonrpc"`
+	Method  string        `json:"method"`
+	ID      mcp.RequestId `json:"id,omitempty"`
+	Params  JSONRPCParams `json:"params,omitempty"`
+}
+
+// JSONRPCResponse defines an MCP response.
+//
+// By protocol spec, responses are further sub-categorized as either successful
+// results or errors. Either a result or an error MUST be set. A response MUST
+// NOT set both.
+//
+// https://modelcontextprotocol.io/specification/2025-03-26/basic#responses
+type JSONRPCResponse struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      mcp.RequestId   `json:"id"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   json.RawMessage `json:"error,omitempty"`
+}
+
+// GetListToolResult assumes the result is for MethodToolsList and returns
+// the corresponding go object.
+func (r *JSONRPCResponse) GetListToolResult() (*mcp.ListToolsResult, error) {
+	var listResult mcp.ListToolsResult
+	if err := json.Unmarshal([]byte(r.Result), &listResult); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &listResult, nil
+}
+
+// GetInitializeResult assumes the result is for MethodInitialize and
+// returns the corresponding go object.
+func (r *JSONRPCResponse) GetInitializeResult() (*mcp.InitializeResult, error) {
+	var result mcp.InitializeResult
+	if err := json.Unmarshal(r.Result, &result); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &result, nil
+}
+
+// unmarshalResponse is a helper that unmarshalls a raw message to an
+// JSONRPCResponse.
+func unmarshalResponse(rawMessage string) (*JSONRPCResponse, error) {
+	var base BaseJSONRPCMessage
+	if err := json.Unmarshal([]byte(rawMessage), &base); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if !base.IsResponse() {
+		return nil, trace.BadParameter("message is not a response")
+	}
+	return base.MakeResponse(), nil
+}
+
+const (
+	// MethodInitialize initiates connection and negotiates protocol capabilities.
+	MethodInitialize = "initialize"
+
+	// MethodPing verifies connection liveness between client and server.
+	MethodPing = "ping"
+
+	// MethodResourcesList lists all available server resources.
+	MethodResourcesList = "resources/list"
+
+	// MethodResourcesTemplatesList provides URI templates for constructing resource URIs.
+	MethodResourcesTemplatesList = "resources/templates/list"
+
+	// MethodResourcesRead retrieves content of a specific resource by URI.
+	MethodResourcesRead = "resources/read"
+
+	// MethodPromptsList lists all available prompt templates.
+	MethodPromptsList = "prompts/list"
+
+	// MethodPromptsGet retrieves a specific prompt template with filled parameters.
+	MethodPromptsGet = "prompts/get"
+
+	// MethodToolsList lists all available executable tools.
+	MethodToolsList = "tools/list"
+
+	// MethodToolsCall invokes a specific tool with provided parameters.
+	MethodToolsCall = "tools/call"
+
+	// MethodSetLogLevel configures the minimum log level for client
+	MethodSetLogLevel = "logging/setLevel"
+
+	// MethodElicitationCreate requests additional information from the user during interactions.
+	MethodElicitationCreate = "elicitation/create"
+
+	// MethodListRoots requests roots list from the client during interactions.
+	MethodListRoots = "roots/list"
+
+	// MethodSamplingCreateMessage is sent by server to request client to sample messages from LLM.
+	MethodSamplingCreateMessage = "sampling/createMessage"
+
+	// MethodNotificationResourcesListChanged notifies when the list of available resources changes.
+	MethodNotificationResourcesListChanged = "notifications/resources/list_changed"
+
+	// MethodNotificationResourceUpdated notifies when a resource changes.
+	MethodNotificationResourceUpdated = "notifications/resources/updated"
+
+	// MethodNotificationPromptsListChanged notifies when the list of available prompt templates changes.
+	MethodNotificationPromptsListChanged = "notifications/prompts/list_changed"
+
+	// MethodNotificationToolsListChanged notifies when the list of available tools changes.
+	MethodNotificationToolsListChanged = "notifications/tools/list_changed"
+
+	// MethodNotificationRootsListChanged notifies when the list of available roots changes.
+	MethodNotificationRootsListChanged = "notifications/roots/list_changed"
+
+	// MethodNotificationInitialized defines the method used for "initialized"
+	// notification. This notification is sent by the client after it receives
+	// the initialize response.
+	MethodNotificationInitialized = "notifications/initialized"
+)
diff --git a/lib/utils/mcputils/protocol_test.go b/lib/utils/mcputils/protocol_test.go
new file mode 100644
index 0000000000000..3ba06d65b4943
--- /dev/null
+++ b/lib/utils/mcputils/protocol_test.go
@@ -0,0 +1,156 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	sampleNotificationJSON = []byte(`{
+  "jsonrpc": "2.0",
+  "method": "notifications/message",
+  "params": {
+    "level": "error",
+    "logger": "database",
+    "data": {
+      "error": "Connection failed",
+      "details": {
+        "host": "localhost",
+        "port": 5432
+      }
+    }
+  }
+}`)
+	sampleRequestJSON = []byte(`{
+  "jsonrpc": "2.0",
+  "id": 2,
+  "method": "tools/call",
+  "params": {
+    "name": "get_weather",
+    "arguments": {
+      "location": "New York"
+    }
+  }
+}`)
+
+	sampleResponseJSON = []byte(`{
+  "jsonrpc": "2.0",
+  "id": 2,
+  "result": {
+    "tools": [
+      {
+        "name": "get_weather",
+        "description": "Get current weather information for a location",
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "location": {
+              "type": "string",
+              "description": "City name or zip code"
+            }
+          },
+          "required": ["location"]
+        }
+      }
+    ],
+    "nextCursor": "next-page-cursor"
+  }
+}`)
+)
+
+func TestJSONRPCNotification(t *testing.T) {
+	var base BaseJSONRPCMessage
+	require.NoError(t, json.Unmarshal(sampleNotificationJSON, &base))
+	assert.True(t, base.IsNotification())
+	assert.False(t, base.IsRequest())
+	assert.False(t, base.IsResponse())
+
+	m := base.MakeNotification()
+	require.NotNil(t, m)
+	assert.Equal(t, "notifications/message", m.Method)
+	assert.Len(t, base.Params, 3)
+
+	outputJSON, err := json.MarshalIndent(m, "", "  ")
+	require.NoError(t, err)
+	assert.JSONEq(t, string(sampleNotificationJSON), string(outputJSON))
+}
+
+func TestJSONRPCRequest(t *testing.T) {
+	var base BaseJSONRPCMessage
+	require.NoError(t, json.Unmarshal(sampleRequestJSON, &base))
+	assert.False(t, base.IsNotification())
+	assert.True(t, base.IsRequest())
+	assert.False(t, base.IsResponse())
+
+	m := base.MakeRequest()
+	require.NotNil(t, m)
+	assert.Equal(t, MethodToolsCall, m.Method)
+	assert.Equal(t, "int64:2", m.ID.String())
+	name, ok := m.Params.GetName()
+	assert.True(t, ok)
+	assert.Equal(t, "get_weather", name)
+
+	outputJSON, err := json.MarshalIndent(m, "", "  ")
+	require.NoError(t, err)
+	assert.JSONEq(t, string(sampleRequestJSON), string(outputJSON))
+}
+
+func TestJSONRPCResponse(t *testing.T) {
+	var base BaseJSONRPCMessage
+	require.NoError(t, json.Unmarshal(sampleResponseJSON, &base))
+	assert.False(t, base.IsNotification())
+	assert.False(t, base.IsRequest())
+	assert.True(t, base.IsResponse())
+
+	m := base.MakeResponse()
+	require.NotNil(t, m)
+	assert.Equal(t, "int64:2", m.ID.String())
+
+	outputJSON, err := json.MarshalIndent(m, "", "  ")
+	require.NoError(t, err)
+	assert.JSONEq(t, string(sampleResponseJSON), string(outputJSON))
+
+	toolList, err := m.GetListToolResult()
+	require.NoError(t, err)
+	require.Equal(t, &mcp.ListToolsResult{
+		PaginatedResult: mcp.PaginatedResult{
+			NextCursor: "next-page-cursor",
+		},
+		Tools: []mcp.Tool{{
+			Name:        "get_weather",
+			Description: "Get current weather information for a location",
+			InputSchema: mcp.ToolInputSchema{
+				Type: "object",
+				Properties: map[string]interface{}{
+					"location": map[string]interface{}{
+						"type":        "string",
+						"description": "City name or zip code",
+					},
+				},
+				Required: []string{"location"},
+			},
+		}},
+	}, toolList)
+}
diff --git a/lib/utils/mcputils/reader.go b/lib/utils/mcputils/reader.go
new file mode 100644
index 0000000000000..4511e99636d5e
--- /dev/null
+++ b/lib/utils/mcputils/reader.go
@@ -0,0 +1,256 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	logutils "github.com/gravitational/teleport/lib/utils/log"
+)
+
+// HandleParseErrorFunc handles parse errors.
+type HandleParseErrorFunc func(context.Context, mcp.RequestId, error) error
+
+// HandleRequestFunc handles a request.
+type HandleRequestFunc func(context.Context, *JSONRPCRequest) error
+
+// HandleResponseFunc handles a response.
+type HandleResponseFunc func(context.Context, *JSONRPCResponse) error
+
+// HandleNotificationFunc handles a notification.
+type HandleNotificationFunc func(context.Context, *JSONRPCNotification) error
+
+// ReplyParseError returns a HandleParseErrorFunc that forwards the error to
+// provided writer.
+func ReplyParseError(w MessageWriter) HandleParseErrorFunc {
+	return func(ctx context.Context, id mcp.RequestId, parseError error) error {
+		rpcError := mcp.NewJSONRPCError(id, mcp.PARSE_ERROR, parseError.Error(), nil)
+		return trace.Wrap(w.WriteMessage(ctx, rpcError))
+	}
+}
+
+// LogAndIgnoreParseError returns a HandleParseErrorFunc that logs the parse
+// error.
+func LogAndIgnoreParseError(log *slog.Logger) HandleParseErrorFunc {
+	return func(ctx context.Context, id mcp.RequestId, parseError error) error {
+		log.DebugContext(ctx, "Ignore parse error", "error", parseError, "id", id)
+		return nil
+	}
+}
+
+// TransportReader defines an interface for reading next raw/unmarshalled
+// message from the MCP transport.
+type TransportReader interface {
+	// Type is the transport type for logging purpose.
+	Type() string
+	// ReadMessage reads the next raw message.
+	ReadMessage(context.Context) (string, error)
+	// Close closes the transport.
+	Close() error
+}
+
+// MessageReaderConfig is the config for MessageReader.
+type MessageReaderConfig struct {
+	// Transport is the input to the read the raw/unmarshalled messages from.
+	// Transport will be closed when reader finishes.
+	Transport TransportReader
+	// Logger is the slog.Logger.
+	Logger *slog.Logger
+
+	// OnClose is an optional callback when reader finishes.
+	OnClose func()
+	// OnParseError specifies the handler for handling parse error. Any error
+	// returned by the handler stops this message reader.
+	OnParseError HandleParseErrorFunc
+	// OnRequest specifies the handler for handling request. Any error by the
+	// handler stops this message reader.
+	OnRequest HandleRequestFunc
+	// OnResponse specifies the handler for handling response. Any error by the
+	// handler stops this message reader.
+	OnResponse HandleResponseFunc
+	// OnNotification specifies the handler for handling notification. Any error
+	// returned by the handler stops this message reader.
+	OnNotification HandleNotificationFunc
+}
+
+// CheckAndSetDefaults checks values and sets defaults.
+func (c *MessageReaderConfig) CheckAndSetDefaults() error {
+	if c.Transport == nil {
+		return trace.BadParameter("missing parameter Transport")
+	}
+	if c.OnParseError == nil {
+		return trace.BadParameter("missing parameter OnParseError")
+	}
+	if c.OnNotification == nil {
+		return trace.BadParameter("missing parameter OnNotification")
+	}
+	if c.OnRequest == nil && c.OnResponse == nil {
+		return trace.BadParameter("one of OnRequest or OnResponse must be set")
+	}
+	if c.Logger == nil {
+		c.Logger = slog.With(teleport.ComponentKey, "mcp")
+	}
+	return nil
+}
+
+// MessageReader reads requests from provided reader.
+type MessageReader struct {
+	cfg     MessageReaderConfig
+	runDone chan struct{}
+}
+
+// NewMessageReader creates a new MessageReader. Must call "Start" to
+// start the processing.
+func NewMessageReader(cfg MessageReaderConfig) (*MessageReader, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &MessageReader{
+		cfg:     cfg,
+		runDone: make(chan struct{}),
+	}, nil
+}
+
+// Run starts reading requests from provided reader. Run blocks until an
+// error happens from the provided reader or any of the handler.
+func (r *MessageReader) Run(ctx context.Context) {
+	r.cfg.Logger.InfoContext(ctx, "Start processing messages", "transport", r.cfg.Transport.Type())
+	defer close(r.runDone)
+
+	processDone := make(chan struct{})
+	go func() {
+		r.startProcess(ctx)
+		close(processDone)
+	}()
+
+	select {
+	case <-processDone:
+	case <-ctx.Done():
+	}
+
+	r.cfg.Logger.InfoContext(ctx, "Finished processing messages", "transport", r.cfg.Transport.Type())
+	if err := r.cfg.Transport.Close(); err != nil && !IsOKCloseError(err) {
+		r.cfg.Logger.ErrorContext(ctx, "Failed to close reader", "error", err)
+	}
+	if r.cfg.OnClose != nil {
+		r.cfg.OnClose()
+	}
+}
+
+// Done returns a channel for waiting until Run finishes. Useful if Run is
+// kicked off in another goroutine.
+func (r *MessageReader) Done() chan struct{} {
+	return r.runDone
+}
+
+func (r *MessageReader) startProcess(ctx context.Context) {
+	for {
+		if ctx.Err() != nil {
+			return
+		}
+
+		if err := r.processNextLine(ctx); err != nil {
+			if !IsOKCloseError(err) {
+				r.cfg.Logger.ErrorContext(ctx, "Failed to process line", "error", err)
+			}
+			return
+		}
+	}
+}
+
+func (r *MessageReader) processNextLine(ctx context.Context) error {
+	rawMessage, err := r.cfg.Transport.ReadMessage(ctx)
+	switch {
+	case isReaderParseError(err):
+		if err := r.cfg.OnParseError(ctx, mcp.NewRequestId(nil), err); err != nil {
+			return trace.Wrap(err, "handling reader parse error")
+		}
+	case err != nil:
+		return trace.Wrap(err, "reading next message")
+	}
+
+	r.cfg.Logger.Log(ctx, logutils.TraceLevel, "Trace read", "raw", rawMessage)
+
+	var base BaseJSONRPCMessage
+	if parseError := json.Unmarshal([]byte(rawMessage), &base); parseError != nil {
+		if err := r.cfg.OnParseError(ctx, mcp.NewRequestId(nil), parseError); err != nil {
+			return trace.Wrap(err, "handling JSON unmarshal error")
+		}
+	}
+
+	switch {
+	case base.IsNotification():
+		return trace.Wrap(r.cfg.OnNotification(ctx, base.MakeNotification()), "handling notification")
+	case base.IsRequest():
+		if r.cfg.OnRequest != nil {
+			return trace.Wrap(r.cfg.OnRequest(ctx, base.MakeRequest()), "handling request")
+		}
+		// Should not happen. Log something just in case.
+		r.cfg.Logger.DebugContext(ctx, "Skipping request", "id", base.ID)
+		return nil
+	case base.IsResponse():
+		if r.cfg.OnResponse != nil {
+			return trace.Wrap(r.cfg.OnResponse(ctx, base.MakeResponse()), "handling response")
+		}
+		// Should not happen. Log something just in case.
+		r.cfg.Logger.DebugContext(ctx, "Skipping response", "id", base.ID)
+		return nil
+	default:
+		return trace.Wrap(
+			r.cfg.OnParseError(ctx, base.ID, trace.BadParameter("unknown message type")),
+			"handling unknown message type error",
+		)
+	}
+}
+
+// ReadOneResponse reads one message from the reader and marshals it to a
+// response.
+func ReadOneResponse(ctx context.Context, reader TransportReader) (*JSONRPCResponse, error) {
+	rawMessage, err := reader.ReadMessage(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return unmarshalResponse(rawMessage)
+}
+
+// NewForwardMessageReader creates a MessageReader that simply forwards every
+// message read from the provided reader to the provided writer.
+func NewForwardMessageReader(logger *slog.Logger, reader TransportReader, writer MessageWriter) (*MessageReader, error) {
+	return NewMessageReader(MessageReaderConfig{
+		Logger:    logger,
+		Transport: reader,
+		OnNotification: func(ctx context.Context, notification *JSONRPCNotification) error {
+			return trace.Wrap(writer.WriteMessage(ctx, notification))
+		},
+		OnRequest: func(ctx context.Context, request *JSONRPCRequest) error {
+			return trace.Wrap(writer.WriteMessage(ctx, request))
+		},
+		OnResponse: func(ctx context.Context, response *JSONRPCResponse) error {
+			return trace.Wrap(writer.WriteMessage(ctx, response))
+		},
+		OnParseError: LogAndIgnoreParseError(logger),
+	})
+}
diff --git a/lib/utils/mcputils/reader_test.go b/lib/utils/mcputils/reader_test.go
new file mode 100644
index 0000000000000..eac495d62dafa
--- /dev/null
+++ b/lib/utils/mcputils/reader_test.go
@@ -0,0 +1,84 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type mockTransportReader struct {
+	message string
+}
+
+func (m mockTransportReader) ReadMessage(context.Context) (string, error) {
+	return m.message, nil
+}
+func (m mockTransportReader) Type() string {
+	return "mock"
+}
+func (m mockTransportReader) Close() error {
+	return nil
+}
+
+func TestReadOneResponse(t *testing.T) {
+	tests := []struct {
+		name          string
+		rawMessage    string
+		checkError    require.ErrorAssertionFunc
+		checkResponse func(*testing.T, *JSONRPCResponse)
+	}{
+		{
+			name:       "bad json",
+			rawMessage: "not JSON RPC message",
+			checkError: require.Error,
+		},
+		{
+			name:       "notification",
+			rawMessage: string(sampleNotificationJSON),
+			checkError: require.Error,
+		},
+		{
+			name:       "request",
+			rawMessage: string(sampleRequestJSON),
+			checkError: require.Error,
+		},
+		{
+			name:       "response",
+			rawMessage: string(sampleResponseJSON),
+			checkError: require.NoError,
+			checkResponse: func(t *testing.T, response *JSONRPCResponse) {
+				require.NotNil(t, response)
+				_, err := response.GetListToolResult()
+				require.NoError(t, err)
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			resp, err := ReadOneResponse(t.Context(), mockTransportReader{test.rawMessage})
+			test.checkError(t, err)
+			if test.checkResponse != nil {
+				test.checkResponse(t, resp)
+			}
+		})
+	}
+}
diff --git a/lib/utils/mcputils/sse.go b/lib/utils/mcputils/sse.go
new file mode 100644
index 0000000000000..1b9720aa8980b
--- /dev/null
+++ b/lib/utils/mcputils/sse.go
@@ -0,0 +1,238 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+// ConnectSSEServer establishes an SSE stream with the MCP server and finds the
+// endpoint used for posting client requests. If successful, the transport
+// reader and message writer are returned.
+func ConnectSSEServer(ctx context.Context, baseURL *url.URL, transport http.RoundTripper) (*SSEResponseReader, *SSERequestWriter, error) {
+	httpClient := &http.Client{
+		Transport: transport,
+	}
+
+	connectReq, err := http.NewRequestWithContext(ctx, "GET", baseURL.String(), nil)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "making SSE connection request")
+	}
+	connectReq.Header.Set("Accept", "text/event-stream")
+	connectReq.Header.Set("Cache-Control", "no-cache")
+	connectReq.Header.Set("Connection", "keep-alive")
+
+	resp, err := httpClient.Do(connectReq)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "sending SSE request")
+	}
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		return nil, nil, trace.Errorf("unexpected status code: %d. Ensure the server URL is reachable, and is serving an MCP SSE server on the specified path.", resp.StatusCode)
+	}
+
+	reader := NewSSEResponseReader(resp.Body)
+	endpointURL, err := reader.ReadEndpoint(ctx, baseURL)
+	if err != nil {
+		reader.Close()
+		return nil, nil, trace.Wrap(err, "reading SSE server endpoint")
+	}
+	requestWriter := NewSSERequestWriter(httpClient, endpointURL)
+	return reader, requestWriter, nil
+}
+
+// SSERequestWriter posts requests to the remote server. Implements
+// MessageWriter.
+type SSERequestWriter struct {
+	httpClient  *http.Client
+	endpointURL string
+	sessionID   string
+}
+
+// NewSSERequestWriter creates a new SSERequestWriter.
+func NewSSERequestWriter(httpClient *http.Client, endpointURL *url.URL) *SSERequestWriter {
+	return &SSERequestWriter{
+		httpClient:  httpClient,
+		endpointURL: endpointURL.String(),
+		sessionID:   endpointURL.Query().Get("sessionId"),
+	}
+}
+
+// GetSessionID returns the MCP session ID tracked by the remote MCP server.
+func (w *SSERequestWriter) GetSessionID() string {
+	return w.sessionID
+}
+
+// GetEndpointURL returns the endpoint URL.
+func (w *SSERequestWriter) GetEndpointURL() string {
+	return w.endpointURL
+}
+
+// WriteMessage posts an HTTP request with the MCP message to the remote MCP
+// server.
+//
+// Note that the HTTP response does not contain the MCP response. MCP response
+// is sent through the SSE stream ¯\(ツ)/¯.
+func (w *SSERequestWriter) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	data, err := json.Marshal(msg)
+	if err != nil {
+		return trace.Wrap(err, "marshaling MCP request")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, w.endpointURL, bytes.NewReader(data))
+	if err != nil {
+		return trace.Wrap(err, "building SSE POST request")
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := w.httpClient.Do(req)
+	if err != nil {
+		return trace.Wrap(err, "sending SSE request")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted {
+		return trace.BadParameter("SSE request returned %s", resp.Status)
+	}
+	return nil
+}
+
+// SSEResponseReader implements TransportReader that reads responses from the
+// SSE stream with the MCP server.
+type SSEResponseReader struct {
+	io.Closer
+	scanner *bufio.Scanner
+}
+
+// NewSSEResponseReader creates a new SSEResponseReader. Input reader is usually the
+// http body used for SSE stream.
+func NewSSEResponseReader(reader io.ReadCloser) *SSEResponseReader {
+	return &SSEResponseReader{
+		Closer:  reader,
+		scanner: bufio.NewScanner(reader),
+	}
+}
+
+// ReadEndpoint reads the endpoint event and crafts the endpoint URL.
+// This should be the first event after connecting to SSE server, and any error
+// is critical.
+func (r *SSEResponseReader) ReadEndpoint(ctx context.Context, baseURL *url.URL) (*url.URL, error) {
+	evt, err := r.nextEvent()
+	if err != nil {
+		return nil, trace.Wrap(err, "reading SSE server message")
+	}
+	if evt.name != sseEventEndpoint {
+		return nil, trace.BadParameter("expecting endpoint event, got %s", evt.name)
+	}
+	endpointURI, err := baseURL.Parse(string(evt.data))
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing endpoint data")
+	}
+	return endpointURI, nil
+}
+
+// ReadMessage reads the next SSE message event from SSE stream.
+func (r *SSEResponseReader) ReadMessage(ctx context.Context) (string, error) {
+	evt, err := r.nextEvent()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	if evt.name != sseEventMessage {
+		return "", newReaderParseError(trace.BadParameter("unexpected event type %s", evt.name))
+	}
+	return string(evt.data), nil
+}
+
+// Type returns "SSE".
+func (r *SSEResponseReader) Type() string {
+	return types.MCPTransportSSE
+}
+
+const (
+	sseEventEndpoint string = "endpoint"
+	sseEventMessage  string = "message"
+)
+
+// event is an event is a server-sent event.
+type event struct {
+	name string
+	data []byte
+}
+
+func (e event) marshal() []byte {
+	return fmt.Appendf(nil, "event: %s\ndata: %s\n\n", e.name, e.data)
+}
+
+// nextEvent reads one sse event from the wire.
+//
+// Logic is copied from golang internal mcp lib which might get released
+// officially someday:
+// https://cs.opensource.google/go/x/tools/+/refs/tags/v0.34.0:internal/mcp/sse.go.
+//
+// Original comment from above go source:
+// https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events#examples
+//   - `key: value` line records.
+//   - Consecutive `data: ...` fields are joined with newlines.
+//   - Unrecognized fields are ignored. Since we only care about 'event' and
+//     'data', these are the only two we consider.
+//   - Lines starting with ":" are ignored.
+//   - Records are terminated with two consecutive newlines.
+func (r *SSEResponseReader) nextEvent() (event, error) {
+	var (
+		evt         event
+		lastWasData bool // if set, preceding data field was also data
+	)
+	for r.scanner.Scan() {
+		line := r.scanner.Bytes()
+		if len(line) == 0 && (evt.name != "" || len(evt.data) > 0) {
+			return evt, nil
+		}
+		before, after, found := bytes.Cut(line, []byte{':'})
+		if !found {
+			return evt, fmt.Errorf("malformed line in SSE stream: %q", string(line))
+		}
+		switch {
+		case bytes.Equal(before, []byte("event")):
+			evt.name = strings.TrimSpace(string(after))
+		case bytes.Equal(before, []byte("data")):
+			data := bytes.TrimSpace(after)
+			if lastWasData {
+				evt.data = slices.Concat(evt.data, []byte{'\n'}, data)
+			} else {
+				evt.data = data
+			}
+			lastWasData = true
+		}
+	}
+	return evt, io.EOF
+}
diff --git a/lib/utils/mcputils/sse_test.go b/lib/utils/mcputils/sse_test.go
new file mode 100644
index 0000000000000..26a846a65b618
--- /dev/null
+++ b/lib/utils/mcputils/sse_test.go
@@ -0,0 +1,76 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	mcpclienttransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+func TestConnectSSEServer(t *testing.T) {
+	testServerSSEEndpoint := mcptest.MustStartSSETestServer(t)
+	testServerURL, err := url.Parse(testServerSSEEndpoint)
+	require.NoError(t, err)
+
+	reader, writer, err := ConnectSSEServer(t.Context(), testServerURL, http.DefaultTransport)
+	require.NoError(t, err)
+	defer reader.Close()
+
+	// Check endpoint info.
+	require.Contains(t, writer.GetEndpointURL(), "/message")
+	require.NotEmpty(t, writer.GetSessionID())
+
+	// Send initialize.
+	initReq := mcpclienttransport.JSONRPCRequest{
+		JSONRPC: mcp.JSONRPC_VERSION,
+		ID:      mcp.NewRequestId(int64(1)),
+		Method:  MethodInitialize,
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client",
+				Version: "1.0.0",
+			},
+		},
+	}
+	require.NoError(t, writer.WriteMessage(t.Context(), initReq))
+
+	// Receive response.
+	initResp, err := ReadOneResponse(t.Context(), reader)
+	require.NoError(t, err)
+	require.Equal(t, initReq.ID.String(), initResp.ID.String())
+	initResult, err := initResp.GetInitializeResult()
+	require.NoError(t, err)
+	require.Equal(t, "test-server", initResult.ServerInfo.Name)
+}
+
+func TestEventMarshal(t *testing.T) {
+	e := event{
+		name: sseEventMessage,
+		data: []byte("hello"),
+	}
+	require.Equal(t, "event: message\ndata: hello\n\n", string(e.marshal()))
+}
diff --git a/lib/utils/mcputils/stdio.go b/lib/utils/mcputils/stdio.go
new file mode 100644
index 0000000000000..ac7549dbba03e
--- /dev/null
+++ b/lib/utils/mcputils/stdio.go
@@ -0,0 +1,117 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"bufio"
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// StderrLogWriter implements io.Writer and logs the content at configured log
+// level. Used for tracing stderr.
+type StderrLogWriter struct {
+	level slog.Level
+	ctx   context.Context
+	log   *slog.Logger
+}
+
+// NewStderrLogWriter returns a new StderrLogWriter.
+func NewStderrLogWriter(ctx context.Context, log *slog.Logger, level slog.Level) *StderrLogWriter {
+	return &StderrLogWriter{
+		ctx:   ctx,
+		level: level,
+		log:   cmp.Or(log, slog.Default()).With(teleport.ComponentKey, teleport.Component("MCP:stderr")),
+	}
+}
+
+// Write implements io.Writer and logs the given input p at configured level.
+// Note that the input p may contain arbitrary-length data, which can span
+// multiple lines or include partial lines.
+func (l *StderrLogWriter) Write(p []byte) (int, error) {
+	l.log.Log(l.ctx, l.level, "stderr", "data", string(p))
+	return len(p), nil
+}
+
+// StdioMessageWriter writes a JSONRPC message in stdio transport.
+type StdioMessageWriter struct {
+	w io.Writer
+}
+
+// NewStdioMessageWriter returns a MessageWriter using stdio transport.
+func NewStdioMessageWriter(w io.Writer) *StdioMessageWriter {
+	return &StdioMessageWriter{
+		w: w,
+	}
+}
+
+// WriteMessage writes a JSONRPC message in stdio transport.
+func (w *StdioMessageWriter) WriteMessage(_ context.Context, resp mcp.JSONRPCMessage) error {
+	bytes, err := json.Marshal(resp)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = fmt.Fprintf(w.w, "%s\n", string(bytes))
+	return trace.Wrap(err)
+}
+
+// NewSyncStdioMessageWriter returns a MessageWriter using stdio transport, the
+// "sync" version.
+func NewSyncStdioMessageWriter(w io.Writer) MessageWriter {
+	return NewSyncMessageWriter(NewStdioMessageWriter(w))
+}
+
+// StdioReader implements TransportReader for stdio transport
+type StdioReader struct {
+	io.Closer
+	br *bufio.Reader
+}
+
+// NewStdioReader creates a new StdioReader. Input reader can be either stdin or
+// stdout.
+func NewStdioReader(readCloser io.ReadCloser) *StdioReader {
+	return &StdioReader{
+		Closer: readCloser,
+		br:     bufio.NewReader(readCloser),
+	}
+}
+
+// ReadMessage reads the next line.
+func (r *StdioReader) ReadMessage(context.Context) (string, error) {
+	line, err := r.br.ReadString('\n')
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return line, nil
+}
+
+// Type returns "stdio".
+func (r *StdioReader) Type() string {
+	return types.MCPTransportStdio
+}
diff --git a/lib/utils/mcputils/stdio_test.go b/lib/utils/mcputils/stdio_test.go
new file mode 100644
index 0000000000000..355c4d960f267
--- /dev/null
+++ b/lib/utils/mcputils/stdio_test.go
@@ -0,0 +1,148 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"context"
+	"io"
+	"log"
+	"log/slog"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils/mcptest"
+)
+
+type countingMessageWriter struct {
+	m MessageWriter
+
+	notifications atomic.Int32
+	requests      atomic.Int32
+	responses     atomic.Int32
+}
+
+func newCountingMessageWriter(m MessageWriter) *countingMessageWriter {
+	return &countingMessageWriter{
+		m: m,
+	}
+}
+
+func (c *countingMessageWriter) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	switch msg.(type) {
+	case *JSONRPCRequest:
+		c.requests.Add(1)
+	case *JSONRPCResponse:
+		c.responses.Add(1)
+	case *JSONRPCNotification:
+		c.notifications.Add(1)
+	}
+	return trace.Wrap(c.m.WriteMessage(ctx, msg))
+}
+
+// TestStdioHelpers tests MessageReader and StdioMessageWriter by
+// implementing a passthrough reverse proxy.
+//
+// The flow looks something like this:
+// request: MCP client --> client message reader --> server message writer --> MCP server
+// response: MCP client <-- client message writer <-- server message reader <-- MCP server
+func TestStdioHelpers(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	// Pipes for hooking things up.
+	clientStdin, writeToClient := io.Pipe()
+	readFromClient, clientStdout := io.Pipe()
+	serverStdin, writeToServer := io.Pipe()
+	readFromServer, serverStdout := io.Pipe()
+	t.Cleanup(func() {
+		assert.NoError(t, trace.NewAggregate(
+			clientStdin.Close(), writeToClient.Close(),
+			readFromClient.Close(), clientStdout.Close(),
+			serverStdin.Close(), writeToServer.Close(),
+			readFromServer.Close(), serverStdout.Close(),
+		))
+	})
+
+	// Make "low-level" message readers and writers for MITM proxy.
+	clientMessageWriter := newCountingMessageWriter(NewStdioMessageWriter(writeToClient))
+	serverMessageWriter := newCountingMessageWriter(NewStdioMessageWriter(writeToServer))
+
+	clientMessageReader, err := NewForwardMessageReader(slog.Default(), NewStdioReader(readFromClient), serverMessageWriter)
+	require.NoError(t, err)
+	go clientMessageReader.Run(ctx)
+
+	serverMessageReader, err := NewForwardMessageReader(slog.Default(), NewStdioReader(readFromServer), clientMessageWriter)
+	require.NoError(t, err)
+	serverMessageReaderCtx, serverMessageReaderCtxCancel := context.WithCancel(ctx)
+	go serverMessageReader.Run(serverMessageReaderCtx)
+
+	// Make "high-level" MCP client and server with stdio transport as the two
+	// ends.
+	stdioClient := mcptest.NewStdioClient(t, clientStdin, clientStdout)
+
+	stdioServer := mcpserver.NewStdioServer(mcptest.NewServer())
+	stdioServer.SetErrorLogger(log.New(io.Discard, "", log.LstdFlags))
+	go stdioServer.Listen(ctx, serverStdin, serverStdout)
+
+	// Test things out.
+	t.Run("client initialize", func(t *testing.T) {
+		mcptest.MustInitializeClient(t, stdioClient)
+	})
+
+	t.Run("client call tool", func(t *testing.T) {
+		mcptest.MustCallServerTool(t, stdioClient)
+	})
+
+	t.Run("reader closed by closing stdin", func(t *testing.T) {
+		readFromClient.Close()
+		select {
+		case <-clientMessageReader.Done():
+		case <-time.After(time.Second * 2):
+			require.Fail(t, "timeout waiting for reader closed by closing stdin")
+		}
+	})
+
+	t.Run("reader closed by canceling context", func(t *testing.T) {
+		serverMessageReaderCtxCancel()
+		select {
+		case <-serverMessageReader.Done():
+		case <-time.After(time.Second * 2):
+			require.Fail(t, "timeout waiting for reader closed by canceling context")
+		}
+	})
+
+	t.Run("verify counters", func(t *testing.T) {
+		// client -> server: initialize request
+		// server -> client: initialize response
+		// client -> server: notifications/initialized
+		// client -> server: tools\call request
+		// server -> client: tools\call response
+		assert.Equal(t, int32(1), serverMessageWriter.notifications.Load())
+		assert.Equal(t, int32(2), serverMessageWriter.requests.Load())
+		assert.Equal(t, int32(0), clientMessageWriter.notifications.Load())
+		assert.Equal(t, int32(2), clientMessageWriter.responses.Load())
+	})
+}
diff --git a/lib/utils/mcputils/writer.go b/lib/utils/mcputils/writer.go
new file mode 100644
index 0000000000000..29fd2053dac8b
--- /dev/null
+++ b/lib/utils/mcputils/writer.go
@@ -0,0 +1,87 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package mcputils
+
+import (
+	"context"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+// MessageWriter defines an interface for writing JSON RPC messages.
+type MessageWriter interface {
+	// WriteMessage writes an JSON RPC message.
+	WriteMessage(context.Context, mcp.JSONRPCMessage) error
+}
+
+// SyncMessageWriter process goroutine safety for MessageWriter
+type SyncMessageWriter struct {
+	w  MessageWriter
+	mu sync.Mutex
+}
+
+// NewSyncMessageWriter returns a SyncMessageWriter.
+func NewSyncMessageWriter(w MessageWriter) *SyncMessageWriter {
+	return &SyncMessageWriter{
+		w: w,
+	}
+}
+
+// WriteMessage acquires a lock then writes the message.
+func (s *SyncMessageWriter) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.w.WriteMessage(ctx, msg)
+}
+
+// MessageWriterFunc defines a message writer function that implements
+// MessageWriter.
+type MessageWriterFunc func(context.Context, mcp.JSONRPCMessage) error
+
+// WriteMessage writes an JSON RPC message.
+func (f MessageWriterFunc) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	return f(ctx, msg)
+}
+
+// MultiMessageWriter creates a writer that duplicates its writes to all the
+// provided writers.
+//
+// Each write is written to each listed writer, one at a time. If a listed
+// writer returns an error, that overall writes operation stops and returns the
+// error; it does not continue down the list.
+type MultiMessageWriter struct {
+	writers []MessageWriter
+}
+
+// NewMultiMessageWriter creates a new MultiMessageWriter.
+func NewMultiMessageWriter(writers ...MessageWriter) *MultiMessageWriter {
+	return &MultiMessageWriter{writers: writers}
+}
+
+// WriteMessage writes the message to each listed writer, one at a time.
+func (w *MultiMessageWriter) WriteMessage(ctx context.Context, msg mcp.JSONRPCMessage) error {
+	for _, writer := range w.writers {
+		if err := writer.WriteMessage(ctx, msg); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
diff --git a/lib/utils/oidc/issuer.go b/lib/utils/oidc/issuer.go
index a777dbebaac79..0c2f6b0c2fcf0 100644
--- a/lib/utils/oidc/issuer.go
+++ b/lib/utils/oidc/issuer.go
@@ -26,19 +26,29 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 )
 
-// ProxyGetter is a service that gets proxies.
+// ProxiesGetter is a service that gets proxies.
 type ProxiesGetter interface {
 	// GetProxies returns a list of registered proxies.
+	//
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
+	// ListProxyServers returns a paginated list of registered proxies.
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
 }
 
 // IssuerForCluster returns the issuer URL using the Cluster state.
 // Path is an optional element to append to the issuer to distinguish a
 // separate CA within the same cluster.
 func IssuerForCluster(ctx context.Context, clt ProxiesGetter, path string) (string, error) {
-	proxies, err := clt.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, clt.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return clt.GetProxies()
+	})
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
diff --git a/lib/utils/oidc/issuer_test.go b/lib/utils/oidc/issuer_test.go
index dd360ab937d4c..7045142f61792 100644
--- a/lib/utils/oidc/issuer_test.go
+++ b/lib/utils/oidc/issuer_test.go
@@ -94,6 +94,13 @@ func (m *mockProxyGetter) GetProxies() ([]types.Server, error) {
 	return m.proxies, nil
 }
 
+func (m *mockProxyGetter) ListProxyServers(_ context.Context, _ int, _ string) ([]types.Server, string, error) {
+	if m.returnErr != nil {
+		return nil, "", m.returnErr
+	}
+	return m.proxies, "", nil
+}
+
 func TestIssuerForCluster(t *testing.T) {
 	ctx := context.Background()
 	for _, tt := range []struct {
diff --git a/lib/utils/once/keyedvalue.go b/lib/utils/once/keyedvalue.go
new file mode 100644
index 0000000000000..d6b95ee7f9f28
--- /dev/null
+++ b/lib/utils/once/keyedvalue.go
@@ -0,0 +1,73 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package once
+
+import (
+	"context"
+	"sync"
+)
+
+type entry[V any] struct {
+	value V
+	err   error
+	ready chan struct{}
+}
+
+// KeyedValue provides a keyed, fallible, and context-aware equivalent to [sync.OnceValue]. the
+// wrapped function is called exactly once for a given key and the result is cached indefinitely.
+// canceling the context passed to the returned closure unblocks the waiting caller but does not cause
+// cancellation of inflight calls to the wrapped function. the returned cancel function may optionally
+// be called to signal cancellation to inflight and future calls of the wrapped function.
+func KeyedValue[K comparable, V any](fn func(context.Context, K) (V, error)) (func(context.Context, K) (V, error), context.CancelFunc) {
+
+	entries := make(map[K]*entry[V])
+	var mu sync.Mutex
+
+	closeContext, cancel := context.WithCancel(context.Background())
+
+	ensure := func(key K) *entry[V] {
+		mu.Lock()
+		defer mu.Unlock()
+
+		e, ok := entries[key]
+		if ok {
+			return e
+		}
+
+		e = &entry[V]{ready: make(chan struct{})}
+		entries[key] = e
+
+		go func() {
+			defer close(e.ready)
+			e.value, e.err = fn(closeContext, key)
+		}()
+		return e
+	}
+
+	return func(ctx context.Context, key K) (V, error) {
+		e := ensure(key)
+
+		select {
+		case <-e.ready:
+			return e.value, e.err
+		case <-ctx.Done():
+			return *new(V), ctx.Err()
+		}
+	}, cancel
+}
diff --git a/lib/utils/once/keyedvalue_test.go b/lib/utils/once/keyedvalue_test.go
new file mode 100644
index 0000000000000..908fd934f029a
--- /dev/null
+++ b/lib/utils/once/keyedvalue_test.go
@@ -0,0 +1,117 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package once
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestKeyedValue verifies the basic expected function of KeyedValue.
+func TestKeyedValue(t *testing.T) {
+
+	var callsMu sync.Mutex
+	calls := make(map[int]int)
+
+	fn, cancel := KeyedValue(func(ctx context.Context, key int) (string, error) {
+		callsMu.Lock()
+		defer callsMu.Unlock()
+		calls[key]++
+		return fmt.Sprintf("value-%d", key), nil
+	})
+	defer cancel()
+
+	results := make(chan struct {
+		key int
+		val string
+		err error
+	})
+	for i := 0; i < 16; i++ {
+		key := i % 2
+		go func() {
+			for j := 0; j < 16; j++ {
+				val, err := fn(context.Background(), key)
+				results <- struct {
+					key int
+					val string
+					err error
+				}{key, val, err}
+			}
+		}()
+	}
+
+	for i := 0; i < 256; i++ {
+		res := <-results
+		require.NoError(t, res.err)
+		require.Equal(t, fmt.Sprintf("value-%d", res.key), res.val)
+	}
+
+	callsMu.Lock()
+	require.Equal(t, map[int]int{0: 1, 1: 1}, calls)
+	callsMu.Unlock()
+}
+
+// TestKeyedValueCancellation verifies that KeyedValue respects caller context cancellation
+// and that the cancel function returned by KeyedValue causes cancellation of inflight
+// calls to the wrapped function.
+func TestKeyedValueCancellation(t *testing.T) {
+	canceledInner := errors.New("inner-function-canceled")
+
+	unblock := make(chan struct{}, 1)
+
+	fn, cancelInner := KeyedValue(func(ctx context.Context, key int) (string, error) {
+		select {
+		case <-unblock:
+			return fmt.Sprintf("value-%d", key), nil
+		case <-ctx.Done():
+			return "", canceledInner
+		}
+	})
+	defer cancelInner()
+
+	// verify normal operation
+	unblock <- struct{}{}
+	val, err := fn(context.Background(), 1)
+	require.NoError(t, err)
+	require.Equal(t, "value-1", val)
+
+	// verify cancellation of caller context
+	tctx, cancel := context.WithTimeout(context.Background(), 1)
+	defer cancel()
+	val, err = fn(tctx, 2)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	require.Empty(t, val)
+
+	// unblock the inner function and verify it completes normally
+	unblock <- struct{}{}
+	val, err = fn(context.Background(), 2)
+	require.NoError(t, err)
+	require.Equal(t, "value-2", val)
+
+	// verify cancellation of the inner function via the cancel function
+	cancelInner()
+	val, err = fn(context.Background(), 3)
+	require.ErrorIs(t, err, canceledInner)
+	require.Empty(t, val)
+}
diff --git a/lib/utils/packagemanager/apt.go b/lib/utils/packagemanager/apt.go
index 591971e2774a2..f85e044b51dbe 100644
--- a/lib/utils/packagemanager/apt.go
+++ b/lib/utils/packagemanager/apt.go
@@ -96,7 +96,7 @@ func NewAPT(cfg *APTConfig) (*APT, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	httpClient, err := defaults.HTTPClient()
+	httpClient, err := defaults.HTTPClient(defaults.UseProxyFromEnvironment())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/utils/packaging/unarchive.go b/lib/utils/packaging/unarchive.go
index ed81a4b4b2d24..2ca1a5ff00708 100644
--- a/lib/utils/packaging/unarchive.go
+++ b/lib/utils/packaging/unarchive.go
@@ -35,6 +35,11 @@ const (
 	// reservedFreeDisk is the predefined amount of free disk space (in bytes) required
 	// to remain available after extracting Teleport binaries.
 	reservedFreeDisk = 10 * 1024 * 1024
+	// directoryPerm defines the permissions used when creating the directory
+	// structure, matching those from the archive.
+	directoryPerm = 0o755
+	// binaryPerm defines the permissions applied to extracted binaries.
+	binaryPerm = 0o755
 )
 
 // RemoveWithSuffix removes all that matches the provided suffix, except for file or directory with `skipName`.
@@ -70,22 +75,22 @@ func RemoveWithSuffix(dir, suffix string, skipNames []string) error {
 
 // replaceZip un-archives the Teleport package in .zip format, iterates through
 // the compressed content, and ignores everything not matching the binaries specified
-// in the execNames argument. The data is extracted to extractDir, and symlinks are created
-// in toolsDir pointing to the extractDir path with binaries.
-func replaceZip(toolsDir string, archivePath string, extractDir string, execNames []string) error {
+// in the execNames argument. The data is extracted to extractDir, and copies are created in toolsDir.
+func replaceZip(archivePath string, extractDir string, execNames []string) (map[string]string, error) {
+	execPaths := make(map[string]string, len(execNames))
 	f, err := os.Open(archivePath)
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	defer f.Close()
 
 	fi, err := f.Stat()
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	zipReader, err := zip.NewReader(f, fi.Size())
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	var totalSize uint64 = 0
@@ -101,7 +106,7 @@ func replaceZip(toolsDir string, archivePath string, extractDir string, execName
 	}
 	// Verify that we have enough space for uncompressed zipFile.
 	if err := checkFreeSpace(extractDir, totalSize); err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	for _, zipFile := range zipReader.File {
@@ -118,31 +123,26 @@ func replaceZip(toolsDir string, archivePath string, extractDir string, execName
 			}
 			defer file.Close()
 
-			dest := filepath.Join(extractDir, baseName)
-			destFile, err := os.OpenFile(dest, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
-			if err != nil {
+			dest := filepath.Join(extractDir, zipFile.Name)
+			// Preserve the archive directory structure.
+			if err := os.MkdirAll(filepath.Dir(dest), directoryPerm); err != nil {
 				return trace.Wrap(err)
 			}
-			defer destFile.Close()
-
-			if _, err := io.Copy(destFile, file); err != nil {
+			destFile, err := os.OpenFile(dest, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, binaryPerm)
+			if err != nil {
 				return trace.Wrap(err)
 			}
-			appPath := filepath.Join(toolsDir, baseName)
-			// For the Windows build, we need to copy the binary to perform updates without requiring
-			// administrative access, which would otherwise be needed for creating symlinks.
-			// Since symlinks are not used on the Windows platform, there's no need to remove appPath
-			// before copying the new binary — it will simply be replaced.
-			if err := utils.CopyFile(dest, appPath, 0o755); err != nil {
-				return trace.Wrap(err)
+			if _, err := io.Copy(destFile, file); err != nil {
+				return trace.NewAggregate(err, destFile.Close())
 			}
 			return trace.Wrap(destFile.Close())
 		}(zipFile); err != nil {
-			return trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
+		execPaths[baseName] = zipFile.Name
 	}
 
-	return nil
+	return execPaths, nil
 }
 
 // checkFreeSpace verifies that we have enough requested space (in bytes) at specific directory.
diff --git a/lib/utils/packaging/unarchive_test.go b/lib/utils/packaging/unarchive_test.go
index b124b603b0fd5..f4de77b598fce 100644
--- a/lib/utils/packaging/unarchive_test.go
+++ b/lib/utils/packaging/unarchive_test.go
@@ -22,6 +22,7 @@ package packaging
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -36,21 +37,7 @@ import (
 // TestPackaging verifies un-archiving of all supported teleport package formats.
 func TestPackaging(t *testing.T) {
 	script := "#!/bin/sh\necho test"
-
-	sourceDir, err := os.MkdirTemp(os.TempDir(), "source")
-	require.NoError(t, err)
-
-	toolsDir, err := os.MkdirTemp(os.TempDir(), "dest")
-	require.NoError(t, err)
-
-	extractDir, err := os.MkdirTemp(toolsDir, "extract")
-	require.NoError(t, err)
-
-	t.Cleanup(func() {
-		require.NoError(t, os.RemoveAll(extractDir))
-		require.NoError(t, os.RemoveAll(sourceDir))
-		require.NoError(t, os.RemoveAll(toolsDir))
-	})
+	sourceDir := t.TempDir()
 
 	// Create test script for packaging in relative path `teleport\bin` to ensure that
 	// binaries going to be identified and extracted flatten to `extractDir`.
@@ -62,57 +49,67 @@ func TestPackaging(t *testing.T) {
 	ctx := context.Background()
 
 	t.Run("tar.gz", func(t *testing.T) {
+		toolsDir := t.TempDir()
+		extractDir, err := os.MkdirTemp(toolsDir, "extract")
+		require.NoError(t, err)
+
 		archivePath := filepath.Join(toolsDir, "tsh.tar.gz")
-		err = archive.CompressDirToTarGzFile(ctx, sourceDir, archivePath)
+		err = archive.CompressDirToTarGzFile(ctx, sourceDir, archivePath, archive.WithNoCompress())
 		require.NoError(t, err)
 		require.FileExists(t, archivePath, "archive not created")
 
 		// For the .tar.gz format we extract app by app to check that content discard is not required.
-		err = replaceTarGz(toolsDir, archivePath, extractDir, []string{"tctl"})
-		require.NoError(t, err)
-		err = replaceTarGz(toolsDir, archivePath, extractDir, []string{"tsh"})
-		require.NoError(t, err)
-		assert.FileExists(t, filepath.Join(toolsDir, "tsh"), "script not created")
-		assert.FileExists(t, filepath.Join(toolsDir, "tctl"), "script not created")
-
-		data, err := os.ReadFile(filepath.Join(toolsDir, "tsh"))
+		toolsMap, err := replaceTarGz(archivePath, extractDir, []string{"tsh", "tctl"})
 		require.NoError(t, err)
-		assert.Equal(t, script, string(data))
+		for tool, path := range toolsMap {
+			assert.FileExists(t, filepath.Join(extractDir, path), fmt.Sprintf("script: %q not found", tool))
+			data, err := os.ReadFile(filepath.Join(extractDir, path))
+			require.NoError(t, err)
+			assert.Equal(t, script, string(data))
+		}
 	})
 
 	t.Run("pkg", func(t *testing.T) {
 		if runtime.GOOS != "darwin" {
 			t.Skip("unsupported platform")
 		}
+		toolsDir := t.TempDir()
+		extractDir, err := os.MkdirTemp(toolsDir, "extract")
+		require.NoError(t, err)
+
 		archivePath := filepath.Join(toolsDir, "tsh.pkg")
 		err = archive.CompressDirToPkgFile(ctx, sourceDir, archivePath, "com.example.pkgtest")
 		require.NoError(t, err)
 		require.FileExists(t, archivePath, "archive not created")
 
-		err = replacePkg(toolsDir, archivePath, filepath.Join(extractDir, "apps"), []string{"tsh", "tctl"})
-		require.NoError(t, err)
-		assert.FileExists(t, filepath.Join(toolsDir, "tsh"), "script not created")
-		assert.FileExists(t, filepath.Join(toolsDir, "tctl"), "script not created")
-
-		data, err := os.ReadFile(filepath.Join(toolsDir, "tsh"))
+		toolsMap, err := replacePkg(archivePath, filepath.Join(extractDir, "apps"), []string{"tsh", "tctl"})
 		require.NoError(t, err)
-		assert.Equal(t, script, string(data))
+		for tool, path := range toolsMap {
+			assert.FileExists(t, filepath.Join(extractDir, "apps", path), fmt.Sprintf("script: %q not found", tool))
+			data, err := os.ReadFile(filepath.Join(extractDir, "apps", path))
+			require.NoError(t, err)
+			assert.Equal(t, script, string(data))
+		}
 	})
 
 	t.Run("zip", func(t *testing.T) {
+		toolsDir := t.TempDir()
+		extractDir, err := os.MkdirTemp(toolsDir, "extract")
+		require.NoError(t, err)
+
 		archivePath := filepath.Join(toolsDir, "tsh.zip")
 		err = archive.CompressDirToZipFile(ctx, sourceDir, archivePath)
 		require.NoError(t, err)
 		require.FileExists(t, archivePath, "archive not created")
 
-		err = replaceZip(toolsDir, archivePath, extractDir, []string{"tsh", "tctl"})
+		toolsMap, err := replaceZip(archivePath, extractDir, []string{"tsh", "tctl"})
 		require.NoError(t, err)
-		assert.FileExists(t, filepath.Join(toolsDir, "tsh"), "script not created")
-		assert.FileExists(t, filepath.Join(toolsDir, "tctl"), "script not created")
-
-		data, err := os.ReadFile(filepath.Join(toolsDir, "tsh"))
-		require.NoError(t, err)
-		assert.Equal(t, script, string(data))
+		for tool, path := range toolsMap {
+			assert.FileExists(t, filepath.Join(extractDir, path), fmt.Sprintf("script: %q not found", tool))
+			data, err := os.ReadFile(filepath.Join(extractDir, path))
+			require.NoError(t, err)
+			assert.Equal(t, script, string(data))
+		}
 	})
 }
 
diff --git a/lib/utils/packaging/unarchive_unix.go b/lib/utils/packaging/unarchive_unix.go
index 8daf1b3aa5525..551aad22547e4 100644
--- a/lib/utils/packaging/unarchive_unix.go
+++ b/lib/utils/packaging/unarchive_unix.go
@@ -31,7 +31,6 @@ import (
 	"runtime"
 	"slices"
 
-	"github.com/google/renameio/v2"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/constants"
@@ -43,12 +42,12 @@ import (
 //
 // For Darwin, archivePath must be a .pkg file.
 // For other POSIX, archivePath must be a gzipped tarball.
-func ReplaceToolsBinaries(toolsDir string, archivePath string, extractDir string, execNames []string) error {
+func ReplaceToolsBinaries(archivePath string, extractDir string, execNames []string) (map[string]string, error) {
 	switch runtime.GOOS {
 	case constants.DarwinOS:
-		return replacePkg(toolsDir, archivePath, extractDir, execNames)
+		return replacePkg(archivePath, extractDir, execNames)
 	default:
-		return replaceTarGz(toolsDir, archivePath, extractDir, execNames)
+		return replaceTarGz(archivePath, extractDir, execNames)
 	}
 }
 
@@ -56,19 +55,20 @@ func ReplaceToolsBinaries(toolsDir string, archivePath string, extractDir string
 // the compressed content, and ignores everything not matching the app binaries specified
 // in the apps argument. The data is extracted to extractDir, and symlinks are created
 // in toolsDir pointing to the extractDir path with binaries.
-func replaceTarGz(toolsDir string, archivePath string, extractDir string, execNames []string) error {
+func replaceTarGz(archivePath string, extractDir string, execNames []string) (map[string]string, error) {
+	execPaths := make(map[string]string, len(execNames))
 	if err := validateFreeSpaceTarGz(archivePath, extractDir, execNames); err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	f, err := os.Open(archivePath)
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	defer f.Close()
 
 	gzipReader, err := gzip.NewReader(f)
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	tarReader := tar.NewReader(gzipReader)
 	for {
@@ -77,7 +77,7 @@ func replaceTarGz(toolsDir string, archivePath string, extractDir string, execNa
 			break
 		}
 		if err != nil {
-			return trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		baseName := filepath.Base(header.Name)
 		// Skip over any files in the archive that are not in execNames.
@@ -86,27 +86,26 @@ func replaceTarGz(toolsDir string, archivePath string, extractDir string, execNa
 		}
 
 		if err = func(header *tar.Header) error {
-			tempFile, err := renameio.TempFile(extractDir, filepath.Join(toolsDir, baseName))
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			defer tempFile.Cleanup()
-			if err := os.Chmod(tempFile.Name(), 0o755); err != nil {
+			dest := filepath.Join(extractDir, header.Name)
+			// Preserve the archive directory structure.
+			if err := os.MkdirAll(filepath.Dir(dest), directoryPerm); err != nil {
 				return trace.Wrap(err)
 			}
-			if _, err := io.Copy(tempFile, tarReader); err != nil {
+			destFile, err := os.OpenFile(dest, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, binaryPerm)
+			if err != nil {
 				return trace.Wrap(err)
 			}
-			if err := tempFile.CloseAtomicallyReplace(); err != nil {
-				return trace.Wrap(err)
+			if _, err := io.Copy(destFile, tarReader); err != nil {
+				return trace.NewAggregate(err, destFile.Close())
 			}
-			return trace.Wrap(tempFile.Cleanup())
+			return trace.Wrap(destFile.Close())
 		}(header); err != nil {
-			return trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
+		execPaths[baseName] = header.Name
 	}
 
-	return trace.Wrap(gzipReader.Close())
+	return execPaths, trace.Wrap(gzipReader.Close())
 }
 
 // validateFreeSpaceTarGz validates that extraction size match available disk space in `extractDir`.
@@ -146,7 +145,8 @@ func validateFreeSpaceTarGz(archivePath string, extractDir string, execNames []s
 // The data is extracted to extractDir, and symlinks are created in toolsDir pointing to the binaries
 // in extractDir. Before creating the symlinks, each binary must be executed at least once to pass
 // OS signature verification.
-func replacePkg(toolsDir string, archivePath string, extractDir string, execNames []string) error {
+func replacePkg(archivePath string, extractDir string, execNames []string) (map[string]string, error) {
+	execPaths := make(map[string]string, len(execNames))
 	// Use "pkgutil" from the filesystem to expand the archive. In theory .pkg
 	// files are xz archives, however it's still safer to use "pkgutil" in-case
 	// Apple makes non-standard changes to the format.
@@ -154,11 +154,11 @@ func replacePkg(toolsDir string, archivePath string, extractDir string, execName
 	// Full command: pkgutil --expand-full NAME.pkg DIRECTORY/
 	pkgutil, err := exec.LookPath("pkgutil")
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	if err = exec.Command(pkgutil, "--expand-full", archivePath, extractDir).Run(); err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
@@ -191,18 +191,14 @@ func replacePkg(toolsDir string, archivePath string, extractDir string, execName
 		if err := command.Run(); err != nil {
 			return trace.WrapWithMessage(err, "failed to validate binary")
 		}
-
-		// Due to macOS applications not being a single binary (they are a
-		// directory), atomic operations are not possible. To work around this, use
-		// a symlink (which can be atomically swapped), then do a cleanup pass
-		// removing any stale copies of the expanded package.
-		newName := filepath.Join(toolsDir, filepath.Base(path))
-		if err := renameio.Symlink(path, newName); err != nil {
+		relPath, err := filepath.Rel(extractDir, path)
+		if err != nil {
 			return trace.Wrap(err)
 		}
+		execPaths[info.Name()] = relPath
 
 		return nil
 	})
 
-	return trace.Wrap(err)
+	return execPaths, trace.Wrap(err)
 }
diff --git a/lib/utils/packaging/unarchive_windows.go b/lib/utils/packaging/unarchive_windows.go
index c07471adce83c..f17b6c7e4bed7 100644
--- a/lib/utils/packaging/unarchive_windows.go
+++ b/lib/utils/packaging/unarchive_windows.go
@@ -25,6 +25,6 @@ package packaging
 // toolsDir/[name].
 //
 // For Windows, archivePath must be a .zip file.
-func ReplaceToolsBinaries(toolsDir string, archivePath string, extractPath string, execNames []string) error {
-	return replaceZip(toolsDir, archivePath, extractPath, execNames)
+func ReplaceToolsBinaries(archivePath string, extractPath string, execNames []string) (map[string]string, error) {
+	return replaceZip(archivePath, extractPath, execNames)
 }
diff --git a/lib/utils/pagination/pagination.go b/lib/utils/pagination/pagination.go
deleted file mode 100644
index d013ea321e8e8..0000000000000
--- a/lib/utils/pagination/pagination.go
+++ /dev/null
@@ -1,118 +0,0 @@
-// Teleport
-// Copyright (C) 2024 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-// Package pagination supplies vocabulary types and definitions to help make
-// paging through record sets less error prone. The goals of this package are to
-//  1. make bad conversions impossible by having separate types for the
-//     "page request" token used by the caller and "next page" token returned
-//     by the callee.
-//  2. force the single use of a PageRequestToken value, and returning an error
-//     if a token is recycled without being updated.
-//
-// For example, imagine a service that lists widgets.
-//
-//	type WidgetLister interface {
-//		ListWidgets(context.Context, *pagination.PageRequestToken) ([]Widget, NextPageToken, error)
-//	}
-//
-// Callers can page through the Widget list like so:
-//
-//	func iterateWidgets(ctx context.Context, widgetLister widgetLister) error {
-//		var pageToken pagination.PageRequestToken
-//		for {
-//			_, nextPage, err := widgetLister.ListWidgets(ctx, &pageToken)
-//			if err != nil {
-//				return trace.Wrap(err)
-//			}
-//
-//			if nextPage == pagination.EndOfList {
-//				break
-//			}
-//			pageToken.Update(nextPage)
-//		}
-//		return nil
-//	}
-//
-// A callee can retrieve the underlying token by calling Consume() on the
-// supplied PageRequestToken, which will mark the token as stale. Using a stale
-// token is an error and will cause the method to fail if a token is recycled.
-//
-//	func (_ *someType) ListWidgets(context.Context, pageRequestToken *pagination.PageRequestToken) ([]Widget, pagination.NextPageToken, error)
-//		pageToken, err := pageRequestToken.Consume()
-//		if err != nil {
-//			return nil, NextPageToken(""), trace.Wrap(err)
-//		}
-//
-//		// now feed the extracted page token to the underlying service or
-//		// backend and do whatever you need to do
-//
-//		nextPage := pagination.NextPageToken(/* whatever next-page token was returned by backend */)
-//		if thisIsTheLastPage {
-//			nextPage = pagination.EndOfList
-//		}
-//		return []Widget{}, nextPage, nil
-//	}
-package pagination
-
-import "github.com/gravitational/trace"
-
-// NextPageToken is an indication returned by a function showing where the next
-// page of data to be returned starts.
-type NextPageToken string
-
-const (
-	// EndOfList is a NextPageToken that marks the end of the list. No more
-	// iteration is required.
-	EndOfList NextPageToken = ""
-)
-
-// PageRequestToken is a request for a given page of data. The only requirement
-// is that the underlying format of the page request is the same as its
-// corresponding NextPageToken.
-//
-// The underlying token value is retrieved by calling `Consume()`, and may only
-// be retrieved once before being reset with a `NextPageToken`. This is so we can
-// easily detect pagination issues where the request token value is not updated
-// between calls and token values are incorrectly recycled.
-//
-// The zero value of this struct will fit most use cases (i.e., where the first
-// page token is the empty string).
-type PageRequestToken struct {
-	token string
-	stale bool
-}
-
-// Consume moves the token value out of the PageRequestToken and marks the token
-// as stale. If the token is already stale, this method will fail with
-// BadParameter.
-func (t *PageRequestToken) Consume() (string, error) {
-	if t.stale {
-		return "", trace.BadParameter("page request token is stale")
-	}
-
-	token := t.token
-	t.token = ""
-	t.stale = true
-
-	return token, nil
-}
-
-// Update updates a PageRequestToken with a token value from the supplied
-// NextPageToken
-func (t *PageRequestToken) Update(token NextPageToken) {
-	t.token = string(token)
-	t.stale = false
-}
diff --git a/lib/utils/pagination/pagination_test.go b/lib/utils/pagination/pagination_test.go
deleted file mode 100644
index fdf89133f6747..0000000000000
--- a/lib/utils/pagination/pagination_test.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Teleport
-// Copyright (C) 2024 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package pagination
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestPageRequestToken(t *testing.T) {
-	t.Run("zero value is valid", func(t *testing.T) {
-		var token PageRequestToken
-		value, err := token.Consume()
-		require.NoError(t, err)
-		require.Empty(t, value)
-	})
-
-	t.Run("recycling a value is an error", func(t *testing.T) {
-		var token PageRequestToken
-		_, _ = token.Consume()
-		_, err := token.Consume()
-		require.Error(t, err)
-	})
-
-	t.Run("updating token resets stale state", func(t *testing.T) {
-		var token PageRequestToken
-		_, _ = token.Consume()
-		token.Update(NextPageToken("banana"))
-		value, err := token.Consume()
-		require.NoError(t, err)
-		require.Equal(t, "banana", value)
-	})
-}
diff --git a/lib/utils/process/pid.go b/lib/utils/process/pid.go
new file mode 100644
index 0000000000000..00b95ee310aa6
--- /dev/null
+++ b/lib/utils/process/pid.go
@@ -0,0 +1,63 @@
+//go:build !windows
+
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package process
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+
+	"github.com/google/renameio/v2"
+	"github.com/gravitational/trace"
+	"golang.org/x/sys/unix"
+)
+
+// CreateLockedPIDFile creates a PID file in the path specified by pidFile
+// containing the current PID, atomically swapping it in the final place and
+// leaving it with an exclusive advisory lock that will get released when the
+// process ends, for the benefit of "pkill -L".
+func CreateLockedPIDFile(pidFile string) error {
+	pending, err := renameio.NewPendingFile(pidFile, renameio.WithPermissions(0o644))
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	defer pending.Cleanup()
+	if _, err := fmt.Fprintf(pending, "%v\n", os.Getpid()); err != nil {
+		return trace.ConvertSystemError(err)
+	}
+
+	const minimumDupFD = 3 // skip stdio
+	locker, err := unix.FcntlInt(pending.Fd(), unix.F_DUPFD_CLOEXEC, minimumDupFD)
+	runtime.KeepAlive(pending)
+	if err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	if err := unix.Flock(locker, unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		_ = unix.Close(locker)
+		return trace.ConvertSystemError(err)
+	}
+	// deliberately leak the fd to hold the lock until the process dies
+
+	if err := pending.CloseAtomicallyReplace(); err != nil {
+		return trace.ConvertSystemError(err)
+	}
+	return nil
+}
diff --git a/lib/utils/process/pid_windows.go b/lib/utils/process/pid_windows.go
new file mode 100644
index 0000000000000..caac52010a006
--- /dev/null
+++ b/lib/utils/process/pid_windows.go
@@ -0,0 +1,29 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package process
+
+import "errors"
+
+// CreateLockedPIDFile creates a PID file in the path specified by pidFile
+// containing the current PID, atomically swapping it in the final place and
+// leaving it with an exclusive advisory lock that will get released when the
+// process ends, for the benefit of "pkill -L".
+func CreateLockedPIDFile(pidFile string) error {
+	return errors.New("PID files are not supported on Windows")
+}
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index f9995b0c12a92..6afe1dd9b3bab 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -62,7 +62,7 @@ func (d directDial) Dial(ctx context.Context, network string, addr string, confi
 
 	// Works around the case when net.DialWithTimeout succeeds, but key exchange hangs.
 	// Setting deadline on connection prevents this case from happening
-	return tracessh.NewClientConnWithDeadline(ctx, conn, addr, config)
+	return tracessh.NewClientWithTimeout(ctx, conn, addr, config)
 }
 
 // DialTimeout acts like Dial but takes a timeout.
@@ -124,23 +124,12 @@ func (d proxyDial) Dial(ctx context.Context, network string, addr string, config
 		return nil, trace.Wrap(err)
 	}
 
-	if config.Timeout > 0 {
-		if err := pconn.SetReadDeadline(time.Now().Add(config.Timeout)); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	// Do the same as ssh.Dial but pass in proxy connection.
-	c, chans, reqs, err := tracessh.NewClientConn(ctx, pconn, addr, config)
+	c, err := tracessh.NewClientWithTimeout(ctx, pconn, addr, config)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if config.Timeout > 0 {
-		if err := pconn.SetReadDeadline(time.Time{}); err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-	return tracessh.NewClient(c, chans, reqs), nil
+
+	return c, nil
 }
 
 type dialerOptions struct {
diff --git a/lib/utils/replace.go b/lib/utils/replace.go
index a4bb24659e004..9477ef74219ca 100644
--- a/lib/utils/replace.go
+++ b/lib/utils/replace.go
@@ -214,6 +214,26 @@ func KubeResourceMatchesRegex(input types.KubernetesResource, isClusterWideResou
 			if ok, err := MatchString(input.Name, resource.Name); err != nil || ok {
 				return ok, trace.Wrap(err)
 			}
+		case input.Kind == "namespaces":
+			if input.Kind != resource.Kind && resource.Kind != types.Wildcard {
+				continue
+			}
+			if ok, err := MatchString(input.APIGroup, resource.APIGroup); err != nil {
+				return false, trace.Wrap(err)
+			} else if !ok {
+				continue
+			}
+			targetNamespace := resource.Namespace
+			if resource.Kind == "namespaces" {
+				targetNamespace = resource.Name
+			} else if resource.Kind == types.Wildcard && (resource.Namespace == "" || resource.Namespace == types.Wildcard) {
+				targetNamespace = resource.Name
+			}
+			if ok, err := MatchString(input.Name, targetNamespace); err != nil || ok {
+				return ok, trace.Wrap(err)
+			}
+			// No match.
+			continue
 		default:
 			if input.Kind != resource.Kind && resource.Kind != types.Wildcard {
 				continue
@@ -277,6 +297,17 @@ func KubeResourceCouldMatchRules(input types.KubernetesResource, isClusterWideRe
 			continue
 		}
 		switch {
+		case targetsReadOnlyNamespace && isDeny:
+			// For read-only namespace request, match the deny only if there is an explicit deny,
+			// i.e., if we have a wildcard deny, we should still be able to get namespaces.
+			// If the group doesn't match and is not wildcard, skip.
+			if resource.Kind != "namespaces" {
+				continue // The only possible way to match in deny is to have an explicit 'namespaces' rule.
+			}
+			if ok, err := MatchString(input.Name, resource.Name); err != nil || ok {
+				return ok, trace.Wrap(err)
+			}
+			continue
 		case targetsReadOnlyNamespace && !isDeny && resource.Kind != "namespaces" && resource.Namespace != "":
 			// If the user requests a read-only namespace get/list/watch, they should
 			// be able to see the list of namespaces they have resources defined in.
@@ -303,6 +334,11 @@ func KubeResourceCouldMatchRules(input types.KubernetesResource, isClusterWideRe
 				return !isDeny, nil
 			}
 
+			// If we are listing a namespaced resource, we can't match against a cluster-wide entry.
+			if isDeny && resource.Namespace == "" {
+				return false, nil
+			}
+
 			// at this point, the resource is namespaced and if the namespace is empty,
 			// the user is requesting resources in all namespaces.
 			// Since he has some rule defined, we should return.
diff --git a/lib/utils/socks/socks_test.go b/lib/utils/socks/socks_test.go
index 0dcc2ddcb44c1..33e79e7b0b44e 100644
--- a/lib/utils/socks/socks_test.go
+++ b/lib/utils/socks/socks_test.go
@@ -30,11 +30,11 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/proxy"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/lib/utils/teleportassets/teleportassets.go b/lib/utils/teleportassets/teleportassets.go
index d5fb430a49bde..ee456f661e8a4 100644
--- a/lib/utils/teleportassets/teleportassets.go
+++ b/lib/utils/teleportassets/teleportassets.go
@@ -20,6 +20,8 @@ package teleportassets
 
 import (
 	"fmt"
+	"net/url"
+	"os"
 
 	"github.com/coreos/go-semver/semver"
 
@@ -27,6 +29,21 @@ import (
 	"github.com/gravitational/teleport/lib/modules"
 )
 
+// IMPORTANT SECURITY WARNING:
+// Do not dynamically switch between production and staging CDNs. This is sadly
+// done in several places in Teleport, we should remove those instead of
+// adding new ones.
+// The main reasons are:
+//  - Staging CDN is only for development convenience, this should never be used
+//    by any Teleport user in production
+//  - Staging CDN doesn't offer the same security guarantees as the production
+//    one. Allowing a production binary to pull from the staging CDN is a
+//    security vulnerability.
+//  - the heuristic "pre-release is set, so we should use the staging CDN" is
+//    weak and will break. In the past we had a single CDN, we are considering
+//    adding other ones (so we can cut customer-specific builds, with higher
+//    levels of security than the current staging CDN).
+
 const (
 	// TeleportReleaseCDN is the Teleport CDN URL for release builds.
 	// This can be used to download the Teleport binary for release builds.
@@ -102,3 +119,37 @@ func distrolessImageName(buildType string) string {
 	}
 	return distrolessTeleportOSSImage
 }
+
+const (
+	HelmRepoURLEnvVar    = "TELEPORT_HELM_REPO_URL"
+	HelmProductionDomain = "charts.releases.teleport.dev"
+	HelmStagingDomain    = "charts.releases.development.teleport.dev"
+)
+
+// HelmRepoURL returns the URL of the Teleport Helm repository.
+// If the TELEPORT_HELM_REPO_URL override is set, it is used.
+// If the environment variable value is malformed, it is silently ignored.
+func HelmRepoURL() *url.URL {
+	if providedURL := os.Getenv(HelmRepoURLEnvVar); providedURL != "" {
+		parsedURL, err := url.Parse(providedURL)
+		if err == nil {
+			return parsedURL
+		}
+	}
+	return &url.URL{
+		Scheme: "https",
+		Host:   HelmProductionDomain,
+	}
+}
+
+// HelmStagingRepoURL returns the URL of the Teleport Helm staging repository.
+// Deprecated: Do not dynamically switch between Helm repos.
+// See security warning in the teleportassets lib.
+// This function is for backward compatibility.
+// Use HelmRepoURL + TELEPORT_HELM_REPO_URL instead.
+func HelmStagingRepoURL() *url.URL {
+	return &url.URL{
+		Scheme: "https",
+		Host:   HelmStagingDomain,
+	}
+}
diff --git a/lib/utils/teleportassets/teleportassets_test.go b/lib/utils/teleportassets/teleportassets_test.go
index ffc3a9471891c..5c0fe7f008611 100644
--- a/lib/utils/teleportassets/teleportassets_test.go
+++ b/lib/utils/teleportassets/teleportassets_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestDistrolessTeleportImageRepo(t *testing.T) {
@@ -75,7 +76,7 @@ func TestDistrolessTeleportImageRepo(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			semVer, err := semver.NewVersion(test.version)
 			require.NoError(t, err)
-			modules.SetTestModules(t, &modules.TestModules{TestBuildType: test.buildType})
+			modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: test.buildType})
 			require.Equal(t, test.want, DistrolessImage(*semVer))
 		})
 	}
diff --git a/lib/utils/testhelpers.go b/lib/utils/testhelpers.go
deleted file mode 100644
index 446624717cf11..0000000000000
--- a/lib/utils/testhelpers.go
+++ /dev/null
@@ -1,125 +0,0 @@
-// Teleport
-// Copyright (C) 2024 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package utils
-
-import (
-	"context"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"os"
-	"os/user"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-// TestBackgroundTask is a task that should be run in the background for the remaining duration of a test and
-// reliably exit before the test completes.
-type TestBackgroundTask struct {
-	// Name is an identifier for the task that will be included in logs and error messages.
-	Name string
-
-	// Task is the function that will be called in a background goroutine to run the task.
-	//
-	// It must not terminate before the context is canceled, and it must reliably terminate after the context
-	// is canceled and Terminate is called.
-	//
-	// Any error other than [context.Canceled] will fail the test.
-	Task func(ctx context.Context) error
-
-	// Terminate is an optional function that will be called to terminate the task during test cleanup.
-	// It does not need to be set if the task will reliably terminate after context cancellation.
-	Terminate func() error
-}
-
-// RunTestBackgroundTask runs task.Task in the background for the remaining duration of the test.
-// During test cleanup it will cancel the context passed to the task, call task.Terminate if set, and wait for
-// the task to terminate before allowing the test to complete.
-func RunTestBackgroundTask(ctx context.Context, t *testing.T, task *TestBackgroundTask) {
-	ctx, cancel := context.WithCancel(ctx)
-	done := make(chan struct{})
-
-	go func() {
-		defer close(done)
-		err := task.Task(ctx)
-		if ctx.Err() == nil {
-			// The context hasn't been canceled yet, meaning the task has exited prematurely. This should
-			// fail the test even if the error is nil.
-			t.Errorf("Test background task %q exited prematurely with error: %s", task.Name, trace.DebugReport(err))
-			return
-		}
-		// The context has been canceled and the task has successfully exited, but any error other than
-		// context.Canceled should still fail the test.
-		if err != nil && !errors.Is(err, context.Canceled) {
-			t.Errorf("Test background task %q exited with error: %+v", task.Name, trace.DebugReport(err))
-		}
-	}()
-
-	t.Cleanup(func() {
-		t.Logf("Cleanup: terminating test background task %q.", task.Name)
-		cancel()
-		if task.Terminate != nil {
-			if err := task.Terminate(); err != nil {
-				t.Errorf("Terminating test background task %q failed with error: %s", task.Name, trace.DebugReport(err))
-			}
-		}
-		ticker := time.NewTicker(2 * time.Second)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-ticker.C:
-				t.Logf("Waiting for test background task %q to terminate.", task.Name)
-			case <-done:
-				return
-			}
-		}
-	})
-}
-
-// RequireRoot skips the current test if it is not running as root.
-func RequireRoot(tb testing.TB) {
-	tb.Helper()
-	if os.Geteuid() != 0 {
-		tb.Skip("This test will be skipped because tests are not being run as root.")
-	}
-}
-
-func generateUsername(tb testing.TB) string {
-	suffix := make([]byte, 8)
-	_, err := rand.Read(suffix)
-	require.NoError(tb, err)
-	return fmt.Sprintf("teleport-%x", suffix)
-}
-
-// GenerateLocalUsername generates the username for a local user that does not
-// already exists (but it does not create the user).
-func GenerateLocalUsername(tb testing.TB) string {
-	const maxAttempts = 10
-	for i := 0; i < maxAttempts; i++ {
-		login := generateUsername(tb)
-		_, err := user.Lookup(login)
-		if errors.Is(err, user.UnknownUserError(login)) {
-			return login
-		}
-		require.NoError(tb, err)
-	}
-	tb.Fatalf("Unable to generate unused username after %v attempts", maxAttempts)
-	return ""
-}
diff --git a/lib/utils/testutils/grpctest/grpc.go b/lib/utils/testutils/grpctest/grpc.go
new file mode 100644
index 0000000000000..26ce3e226798e
--- /dev/null
+++ b/lib/utils/testutils/grpctest/grpc.go
@@ -0,0 +1,194 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package grpctest
+
+import (
+	"context"
+	"io"
+
+	"google.golang.org/grpc"
+)
+
+// NewGRPCStreams creates a new bidirectional streaming gRPC pair, a bidirectional
+// streaming client and server, for the given request type T1 and response type
+// T2.
+//
+// The streams are directly connected without the use of network and are
+// therefore suitable to be used with synctest.
+//
+// The client sends its requests on the clientStream which are directly received
+// by the server via a channel with buffer size 1. The server sends its
+// responses on its serverStream via another channel with buffer size 1.
+//
+// Private fields are purposefully written in a *not* concurrency-safe manner to
+// simulate non-concurrency safety of real over-the-network GRPC stream. It will
+// be caught when executing the test with the race detector enbled.
+func NewGRPCTester[T1, T2 any](ctx context.Context) *GRPCTester[T1, T2] {
+	return &GRPCTester[T1, T2]{
+		ctx:      ctx,
+		toServer: make(chan *T1, 1),
+		toClient: make(chan *T2, 1),
+	}
+}
+
+type GRPCTester[T1, T2 any] struct {
+	ctx      context.Context
+	toServer chan *T1
+	toClient chan *T2
+}
+
+func (t *GRPCTester[T1, T2]) NewClientStream() grpc.BidiStreamingClient[T1, T2] {
+	return &client[T1, T2]{
+		ctx:      t.ctx,
+		toServer: t.toServer,
+		toClient: t.toClient,
+	}
+}
+
+func (t *GRPCTester[T1, T2]) NewServerStream() grpc.BidiStreamingServer[T1, T2] {
+	return &server[T1, T2]{
+		ctx:      t.ctx,
+		toServer: t.toServer,
+		toClient: t.toClient,
+	}
+}
+
+type client[T1, T2 any] struct {
+	grpc.ClientStream
+	ctx      context.Context
+	toServer chan *T1
+	toClient chan *T2
+	// simulate non-concurrency safety
+	sendRaceDetector    bool
+	receiveRaceDetector bool
+}
+
+func (c *client[T1, T2]) Context() context.Context {
+	return c.ctx
+}
+
+func (c *client[T1, T2]) Send(req *T1) error {
+	c.sendRaceDetector = true // simulate non-concurrency safety
+	select {
+	case c.toServer <- req:
+		return nil
+	case <-c.ctx.Done():
+		return c.ctx.Err()
+	}
+}
+
+func (c *client[T1, T2]) Recv() (*T2, error) {
+	c.receiveRaceDetector = true // simulate non-concurrency safety
+	select {
+	case resp := <-c.toClient:
+		return resp, nil
+	case <-c.ctx.Done():
+		return nil, c.ctx.Err()
+	}
+}
+
+func (c *client[T1, T2]) CloseSend() error {
+	close(c.toServer)
+	return nil
+}
+
+type server[T1, T2 any] struct {
+	grpc.ServerStream
+	ctx      context.Context
+	toServer chan *T1
+	toClient chan *T2
+	// simulate non-concurrency safety
+	sendRaceDetector    bool
+	receiveRaceDetector bool
+}
+
+func (s *server[T1, T2]) Context() context.Context {
+	return s.ctx
+}
+
+func (s *server[T1, T2]) Send(resp *T2) error {
+	s.sendRaceDetector = true
+	select {
+	case s.toClient <- resp:
+		return nil
+	case <-s.ctx.Done():
+		return s.ctx.Err()
+	}
+}
+
+func (s *server[T1, T2]) Recv() (*T1, error) {
+	s.receiveRaceDetector = true
+	select {
+	case req, ok := <-s.toServer:
+		if !ok {
+			return nil, io.EOF
+		}
+		return req, nil
+	case <-s.ctx.Done():
+		return nil, s.ctx.Err()
+	}
+}
+
+// NewServerStream creates an in-memory grpc.ServerStreamingServer[T] (unidirectional)
+// for use in tests, particularly when using synctest.
+//
+// Users can consume the messages sent by the server by calling Recv.
+//
+// Private fields are purposefully written in a *not* concurrency-safe manner to
+// simulate non-concurrency safety of real over-the-network GRPC stream. It will
+// be caught when executing the test with the race detector enbled.
+func NewServerStream[T any](ctx context.Context) *ServerStream[T] {
+	return &ServerStream[T]{
+		ctx:      ctx,
+		toClient: make(chan *T, 1),
+	}
+}
+
+// ServerStream is an in-memory implementation of grpc.ServerStreamingServer[T]
+// for use in tests.
+type ServerStream[T any] struct {
+	grpc.ServerStream
+	ctx              context.Context
+	toClient         chan *T
+	sendRaceDetector bool // simulate non-concurrency safety
+}
+
+// Context returns the context for this stream.
+func (s *ServerStream[T]) Context() context.Context { return s.ctx }
+
+// Send satisfies grpc.ServerStreamingServer[T].
+func (s *ServerStream[T]) Send(t *T) error {
+	s.sendRaceDetector = true
+	select {
+	case s.toClient <- t:
+		return nil
+	case <-s.ctx.Done():
+		return s.ctx.Err()
+	}
+}
+
+// Recv can be called from tests to receive the most recent *T sent by the server.
+func (s *ServerStream[T]) Recv() (*T, error) {
+	select {
+	case t := <-s.toClient:
+		return t, nil
+	case <-s.ctx.Done():
+		return nil, s.ctx.Err()
+	}
+}
diff --git a/lib/utils/testutils/synctest/synctest_goexperiment.go b/lib/utils/testutils/synctest/synctest_goexperiment.go
new file mode 100644
index 0000000000000..29fb08431b2b9
--- /dev/null
+++ b/lib/utils/testutils/synctest/synctest_goexperiment.go
@@ -0,0 +1,41 @@
+//go:build !go1.25 && goexperiment.synctest
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package synctest
+
+import (
+	"testing"
+	"testing/synctest" //nolint:depguard // this package wraps synctest
+)
+
+// Test runs the provided function in a synctest bubble if synctest is
+// supported, otherwise skips the test. To support older versions of Go, the
+// function might be called in a subtest of the provided test.
+func Test(t *testing.T, f func(*testing.T)) {
+	// in go 1.24 with the synctest experiment there's no integrated support for
+	// t.Cleanup callbacks to run before exiting the bubble, but if we run
+	// things in a subtest we get the same behavior, albeit with everything in a
+	// subtest, which is ugly but functional
+	synctest.Run(func() { t.Run("goexperiment.synctest", f) })
+}
+
+// Wait blocks until every goroutine in the bubble is durably blocked. See
+// [synctest.Wait] for details. Wait will panic if called from outside a bubble.
+func Wait() {
+	synctest.Wait()
+}
diff --git a/lib/utils/testutils/synctest/synctest_nosynctest.go b/lib/utils/testutils/synctest/synctest_nosynctest.go
new file mode 100644
index 0000000000000..396df418d6f1c
--- /dev/null
+++ b/lib/utils/testutils/synctest/synctest_nosynctest.go
@@ -0,0 +1,37 @@
+//go:build !go1.25 && !goexperiment.synctest
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package synctest
+
+import (
+	"testing"
+)
+
+// Test runs the provided function in a synctest bubble if synctest is
+// supported, otherwise skips the test. To support older versions of Go, the
+// function might be called in a subtest of the provided test.
+func Test(t *testing.T, f func(*testing.T)) {
+	t.Skip("this test requires synctest")
+}
+
+// Wait blocks until every goroutine in the bubble is durably blocked. See
+// [synctest.Wait] for details. Wait will panic if called from outside a bubble.
+func Wait() {
+	// technically true!
+	panic("goroutine is not in a bubble")
+}
diff --git a/lib/utils/testutils/synctest/synctest_release.go b/lib/utils/testutils/synctest/synctest_release.go
new file mode 100644
index 0000000000000..f0fe20f668f43
--- /dev/null
+++ b/lib/utils/testutils/synctest/synctest_release.go
@@ -0,0 +1,38 @@
+//go:build go1.25
+
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package synctest
+
+import (
+	"testing"
+	"testing/synctest" //nolint:depguard // this package wraps synctest
+)
+
+// Test runs the provided function in a synctest bubble if synctest is
+// supported, otherwise skips the test. To support older versions of Go, the
+// function might be called in a subtest of the provided test.
+func Test(t *testing.T, f func(*testing.T)) {
+	// this version of Go (1.25+) is recent enough
+	synctest.Test(t, f)
+}
+
+// Wait blocks until every goroutine in the bubble is durably blocked. See
+// [synctest.Wait] for details. Wait will panic if called from outside a bubble.
+func Wait() {
+	synctest.Wait()
+}
diff --git a/lib/utils/testutils/testhelpers.go b/lib/utils/testutils/testhelpers.go
new file mode 100644
index 0000000000000..2d70ae230bc27
--- /dev/null
+++ b/lib/utils/testutils/testhelpers.go
@@ -0,0 +1,125 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package testutils
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"os"
+	"os/user"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+// TestBackgroundTask is a task that should be run in the background for the remaining duration of a test and
+// reliably exit before the test completes.
+type TestBackgroundTask struct {
+	// Name is an identifier for the task that will be included in logs and error messages.
+	Name string
+
+	// Task is the function that will be called in a background goroutine to run the task.
+	//
+	// It must not terminate before the context is canceled, and it must reliably terminate after the context
+	// is canceled and Terminate is called.
+	//
+	// Any error other than [context.Canceled] will fail the test.
+	Task func(ctx context.Context) error
+
+	// Terminate is an optional function that will be called to terminate the task during test cleanup.
+	// It does not need to be set if the task will reliably terminate after context cancellation.
+	Terminate func() error
+}
+
+// RunTestBackgroundTask runs task.Task in the background for the remaining duration of the test.
+// During test cleanup it will cancel the context passed to the task, call task.Terminate if set, and wait for
+// the task to terminate before allowing the test to complete.
+func RunTestBackgroundTask(ctx context.Context, t *testing.T, task *TestBackgroundTask) {
+	ctx, cancel := context.WithCancel(ctx)
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+		err := task.Task(ctx)
+		if ctx.Err() == nil {
+			// The context hasn't been canceled yet, meaning the task has exited prematurely. This should
+			// fail the test even if the error is nil.
+			t.Errorf("Test background task %q exited prematurely with error: %s", task.Name, trace.DebugReport(err))
+			return
+		}
+		// The context has been canceled and the task has successfully exited, but any error other than
+		// context.Canceled should still fail the test.
+		if err != nil && !errors.Is(err, context.Canceled) {
+			t.Errorf("Test background task %q exited with error: %+v", task.Name, trace.DebugReport(err))
+		}
+	}()
+
+	t.Cleanup(func() {
+		t.Logf("Cleanup: terminating test background task %q.", task.Name)
+		cancel()
+		if task.Terminate != nil {
+			if err := task.Terminate(); err != nil {
+				t.Errorf("Terminating test background task %q failed with error: %s", task.Name, trace.DebugReport(err))
+			}
+		}
+		ticker := time.NewTicker(2 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ticker.C:
+				t.Logf("Waiting for test background task %q to terminate.", task.Name)
+			case <-done:
+				return
+			}
+		}
+	})
+}
+
+// RequireRoot skips the current test if it is not running as root.
+func RequireRoot(tb testing.TB) {
+	tb.Helper()
+	if os.Geteuid() != 0 {
+		tb.Skip("This test will be skipped because tests are not being run as root.")
+	}
+}
+
+func generateUsername(tb testing.TB) string {
+	suffix := make([]byte, 8)
+	_, err := rand.Read(suffix)
+	require.NoError(tb, err)
+	return fmt.Sprintf("teleport-%x", suffix)
+}
+
+// GenerateLocalUsername generates the username for a local user that does not
+// already exists (but it does not create the user).
+func GenerateLocalUsername(tb testing.TB) string {
+	const maxAttempts = 10
+	for i := 0; i < maxAttempts; i++ {
+		login := generateUsername(tb)
+		_, err := user.Lookup(login)
+		if errors.Is(err, user.UnknownUserError(login)) {
+			return login
+		}
+		require.NoError(tb, err)
+	}
+	tb.Fatalf("Unable to generate unused username after %v attempts", maxAttempts)
+	return ""
+}
diff --git a/lib/utils/uds/socketpair_impl_atomic.go b/lib/utils/uds/socketpair_impl_atomic.go
index 6697ed3cb73e5..84473e3dffaca 100644
--- a/lib/utils/uds/socketpair_impl_atomic.go
+++ b/lib/utils/uds/socketpair_impl_atomic.go
@@ -31,8 +31,7 @@ import (
 // socketpair directly in close-on-exec mode.
 func cloexecSocketpair(t SocketType) (uintptr, uintptr, error) {
 	// SOCK_CLOEXEC on socketpair is supported since Linux 2.6.27 and go's
-	// minimum requirement is 2.6.32 (FreeBSD supports it since FreeBSD 10 and
-	// go 1.20+ requires FreeBSD 12)
+	// minimum requirement is 3.2
 	fds, err := syscall.Socketpair(syscall.AF_UNIX, t.proto()|syscall.SOCK_CLOEXEC, 0)
 	if err != nil {
 		return 0, 0, trace.Wrap(err)
diff --git a/lib/utils/usage.go b/lib/utils/usage.go
new file mode 100644
index 0000000000000..f013feb236bfe
--- /dev/null
+++ b/lib/utils/usage.go
@@ -0,0 +1,74 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build !docs
+
+package utils
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/alecthomas/kingpin/v2"
+)
+
+// UpdateAppUsageTemplate updates usage template for kingpin applications by
+// pre-parsing the arguments then applying any changes to the usage template if
+// necessary.
+func UpdateAppUsageTemplate(app *kingpin.Application, args []string) {
+	app.UsageTemplate(createUsageTemplate(
+		withCommandPrintfWidth(app, args),
+	))
+}
+
+// withCommandPrintfWidth returns a usage template option that
+// updates command printf width if longer than default.
+func withCommandPrintfWidth(app *kingpin.Application, args []string) func(*usageTemplateOptions) {
+	return func(opt *usageTemplateOptions) {
+		var commands []*kingpin.CmdModel
+
+		// When selected command is "help", skip the "help" arg
+		// so the intended command is selected for calculation.
+		if len(args) > 0 && args[0] == "help" {
+			args = args[1:]
+		}
+
+		appContext, err := app.ParseContext(args)
+		switch {
+		case appContext == nil:
+			slog.WarnContext(context.Background(), "No application context found")
+			return
+
+		// Note that ParseContext may return the current selected command that's
+		// causing the error. We should continue in those cases when appContext is
+		// not nil.
+		case err != nil:
+			slog.InfoContext(context.Background(), "Error parsing application context", "error", err)
+		}
+
+		if appContext.SelectedCommand != nil {
+			commands = appContext.SelectedCommand.Model().FlattenedCommands()
+		} else {
+			commands = app.Model().FlattenedCommands()
+		}
+
+		for _, command := range commands {
+			if !command.Hidden && len(command.FullCommand) > opt.commandPrintfWidth {
+				opt.commandPrintfWidth = len(command.FullCommand)
+			}
+		}
+	}
+}
diff --git a/lib/utils/usage_docs.go b/lib/utils/usage_docs.go
new file mode 100644
index 0000000000000..f0e34f28e8deb
--- /dev/null
+++ b/lib/utils/usage_docs.go
@@ -0,0 +1,278 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build docs
+
+package utils
+
+import (
+	"bytes"
+	"cmp"
+	_ "embed"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+)
+
+// formatThreeColMarkdownTable formats the provided row data into a three-column
+// Markdown table, minus the header.
+func formatThreeColMarkdownTable(rows [][3]string) string {
+	var buf bytes.Buffer
+
+	for _, r := range rows {
+		fmt.Fprintf(&buf, "\n|%v|%v|%v|", r[0], r[1], r[2])
+	}
+	return buf.String()
+}
+
+// flagsToRows outputs data for a table that lists flags, their default
+// values, and help texts.
+func flagsToRows(f []*kingpin.FlagModel) [][3]string {
+	rows := [][3]string{}
+
+	for _, flag := range f {
+		if flag.Hidden {
+			continue
+		}
+		flagString := ""
+		flagName := flag.Name
+		if flag.IsBoolFlag() {
+			flagName = "[no-]" + flagName
+		}
+		if flag.Short != 0 {
+			flagString += fmt.Sprintf("`-%c`, `--%s`", flag.Short, flagName)
+		} else {
+			flagString += fmt.Sprintf("`--%s`", flagName)
+		}
+
+		rows = append(rows, [3]string{
+			flagString,
+			formatDefaultFlagValue(flag),
+			formatHelp(flag.Help),
+		})
+	}
+	return rows
+}
+
+// anyVisibleFlags returns whether any flags in f are visible, i.e., should be
+// included in a table of flags.
+func anyVisibleFlags(f []*kingpin.FlagModel) bool {
+	return slices.ContainsFunc(f, func(m *kingpin.FlagModel) bool {
+		return !m.Hidden
+	})
+}
+
+// anyEnvVarsForCmd indicates whether at least one of the arguments and flags
+// provided exposes an environment variable for configuration.
+func anyEnvVarsForCmd(args []*kingpin.ArgModel, flags []*kingpin.FlagModel) bool {
+	return slices.ContainsFunc(args, func(arg *kingpin.ArgModel) bool {
+		return arg.Envar != ""
+	}) || slices.ContainsFunc(flags, func(flag *kingpin.FlagModel) bool {
+		return flag.Envar != ""
+	})
+}
+
+// argsToRows outputs data for a table that lists arguments, their default
+// values, and help texts.
+func argsToRows(a []*kingpin.ArgModel) [][3]string {
+	rows := [][3]string{}
+	for _, arg := range a {
+		if arg.Hidden {
+			continue
+		}
+
+		// Some commands declare empty argument names and help texts as
+		// a hack to allow arbitrary values. Indicate this in the table
+		// as a special case.
+		argName := cmp.Or(arg.Name, "args")
+
+		help := "Arbitrary arguments"
+		if arg.Help != "" {
+			help = formatHelp(arg.Help)
+		}
+
+		rows = append(rows, [3]string{
+			argName,
+			formatDefaultArgValue(arg),
+			help,
+		})
+	}
+	return rows
+}
+
+// envVarsToRows prints table data for a list of environment variables, their
+// default values, and help texts.
+func envVarsToRows(args []*kingpin.ArgModel, flags []*kingpin.FlagModel) [][3]string {
+	rows := [][3]string{}
+	for _, arg := range args {
+		if arg.Hidden || arg.Envar == "" {
+			continue
+		}
+
+		rows = append(rows, [3]string{
+			fmt.Sprintf("`%v`", arg.Envar),
+			formatDefaultArgValue(arg),
+			arg.Help,
+		})
+	}
+	for _, flg := range flags {
+		if flg.Hidden || flg.Envar == "" {
+			continue
+		}
+
+		rows = append(rows, [3]string{
+			fmt.Sprintf("`%v`", flg.Envar),
+			formatDefaultFlagValue(flg),
+			flg.Help,
+		})
+	}
+	return rows
+}
+
+// sortcommandsByName sorts the commands in cmds by their full command names,
+// including all subcommands.
+func sortCommandsByName(cmds []*kingpin.CmdModel) []*kingpin.CmdModel {
+	slices.SortStableFunc(cmds, func(a, b *kingpin.CmdModel) int {
+		switch {
+		case a.FullCommand < b.FullCommand:
+			return -1
+		case a.FullCommand > b.FullCommand:
+			return 1
+		default:
+			return 0
+		}
+	})
+	return cmds
+}
+
+// formatDefaultFlagValue returns the default value of flag to display in a
+// table of flags. Assumes that a Boolean flag is false unless it is true by
+// default.
+func formatDefaultFlagValue(flag *kingpin.FlagModel) string {
+	switch {
+	case len(flag.Default) == 0 && flag.IsBoolFlag():
+		return "`false`"
+	case len(flag.Default) > 0:
+		ret := make([]string, len(flag.Default))
+		for i, v := range flag.Default {
+			ret[i] = fmt.Sprintf("`%v`", v)
+		}
+		return strings.Join(ret, ",")
+	default:
+		return "none"
+	}
+}
+
+// formatDefaultArgValue returns the default value of arg to display in a table
+// of flags. It also indicates whether the value is optional or required.
+func formatDefaultArgValue(arg *kingpin.ArgModel) string {
+	var ret string
+	if len(arg.Default) > 0 {
+		def := make([]string, len(arg.Default))
+		for i, v := range arg.Default {
+			def[i] = fmt.Sprintf("`%v`", v)
+		}
+		ret = strings.Join(def, ",")
+	} else {
+		ret = "none"
+	}
+	if arg.Required {
+		ret += " (required)"
+	} else {
+		ret += " (optional)"
+	}
+
+	return ret
+}
+
+// repeatableFlag is an interface for flags that can be repeated. Unexported
+// type in github.com/alecthomas/kingpin/v2.
+type repeatableFlag interface {
+	IsCumulative() bool
+}
+
+// formatUsageArg prints a command argument to include in a usage snippet.
+func formatUsageArg(arg *kingpin.ArgModel) string {
+	var ret string
+	switch {
+	case arg.PlaceHolder != "":
+		ret = arg.PlaceHolder
+	// Some special cases have empty arg names
+	case arg.Name == "":
+		ret = "args"
+	default:
+		ret = "<" + arg.Name + ">"
+	}
+	if v, ok := arg.Value.(repeatableFlag); ok && v.IsCumulative() {
+		ret += "..."
+	}
+	if !arg.Required {
+		ret = "[" + ret + "]"
+	}
+	return ret
+}
+
+// formatHelp prints help text to include in a Markdown table cell. It escapes
+// curly braces to avoid breaking the MDX parser, and it escapes pipes to
+// avoid breaking the cell.
+func formatHelp(help string) string {
+	return strings.NewReplacer("{", `\{`, "}", `\}`, "|", `\|`).Replace(help)
+}
+
+// docsUsageTemplatePath points to a help text template for CLI reference
+// documentation. Intended to be used as the argument to
+// *kingpin.Application.UsageTemplate.
+var docsUsageTemplatePath = filepath.Join("lib", "utils", "docs-usage.md.tmpl")
+
+// updateAppUsageTemplatePath updates the app usage template to print a reference
+// guide for the CLI application. It reads the template from r.
+func updateAppUsageTemplate(r io.Reader, app *kingpin.Application) {
+	var buf bytes.Buffer
+	if _, err := buf.ReadFrom(r); err != nil {
+		panic(fmt.Sprintf("unable to read from the docs usage template: %v", err))
+	}
+
+	app.UsageFuncs(map[string]any{
+		"AnyEnvVarsForCmd":            anyEnvVarsForCmd,
+		"AnyVisibleFlags":             anyVisibleFlags,
+		"ArgsToRows":                  argsToRows,
+		"EnvVarsToRows":               envVarsToRows,
+		"FlagsToRows":                 flagsToRows,
+		"FormatThreeColMarkdownTable": formatThreeColMarkdownTable,
+		"FormatUsageArg":              formatUsageArg,
+		"SortCommandsByName":          sortCommandsByName,
+	})
+	app.UsageTemplate(buf.String())
+}
+
+// UpdateAppUsageTemplate updates the app usage template to print a reference
+// guide for the CLI application.
+func UpdateAppUsageTemplate(app *kingpin.Application, _ []string) {
+	// Panic when failing to open or read from the docs usage template since
+	// we need to keep the signature of UpdateAppUsageTemplate consistent
+	// with the one included without build tags, i.e., with no return value.
+	f, err := os.Open(docsUsageTemplatePath)
+	if err != nil {
+		panic(fmt.Sprintf("unable to open the docs usage template at %v: %v", docsUsageTemplatePath, err))
+	}
+
+	updateAppUsageTemplate(f, app)
+}
diff --git a/lib/utils/usage_docs_test.go b/lib/utils/usage_docs_test.go
new file mode 100644
index 0000000000000..b9a77696045ad
--- /dev/null
+++ b/lib/utils/usage_docs_test.go
@@ -0,0 +1,445 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build docs
+
+package utils
+
+import (
+	"bytes"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateAppUsageTemplate(t *testing.T) {
+	tests := []struct {
+		name            string
+		makeApp         func() *kingpin.Application
+		expectSubstring string // The @ character is replaced with a backtick
+	}{
+		{
+			name: "subcommand flags and global flags",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				app.Command("hello", "Hello.")
+				create := app.Command("create", "Create.")
+				create.Flag("name", "The name of the resource").Default("myresource").String()
+				createRocket := create.Command("rocket", "Rocket.")
+				createRocket.Flag("launch", "Whether to launch the Rocket").Bool()
+				return app
+			},
+			expectSubstring: `---
+title: myapp Reference
+description: Provides a comprehensive list of commands, arguments, and flags for myapp.
+---
+
+This guide provides a comprehensive list of commands, arguments, and flags for
+myapp: This is the main CLI tool.
+
+@@@code
+$ myapp [<flags>] <command> [<args> ...]
+@@@
+
+Global flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--config@|@config.yaml@|The location of the config file|
+
+## myapp create rocket
+
+Rocket.
+
+Usage:
+
+@@@code
+$ myapp create rocket [<flags>]
+@@@
+
+Flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--[no-]launch@|@false@|Whether to launch the Rocket|
+
+## myapp hello
+
+Hello.
+
+Usage:
+
+@@@code
+$ myapp hello
+@@@
+
+## myapp help
+
+Show help.
+
+Usage:
+
+@@@code
+$ myapp help [<command>...]
+@@@
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|command|none (optional)|Show help on command.|
+
+`,
+		},
+		{
+			name: "multiple main command flags",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				app.Flag("verbosity", "Verbosity level.").Default("3").Int()
+				app.Flag("dry-run", "Whether to use dry-run mode").Default("false").Bool()
+				return app
+			},
+			expectSubstring: `This guide provides a comprehensive list of commands, arguments, and flags for
+myapp: This is the main CLI tool.
+
+@@@code
+$ myapp [<flags>] <command> [<args> ...]
+@@@
+
+Global flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--config@|@config.yaml@|The location of the config file|
+|@--verbosity@|@3@|Verbosity level.|
+|@--[no-]dry-run@|@false@|Whether to use dry-run mode|
+
+`,
+		},
+		{
+			name: "multiple subcommand flags",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				create := app.Command("create", "Create a resource.")
+				create.Flag("verbosity", "Verbosity level.").Default("3").Int()
+				create.Flag("dry-run", "Whether to use dry-run mode").Default("false").Bool()
+				return app
+			},
+			expectSubstring: `## myapp create
+
+Create a resource.
+
+Usage:
+
+@@@code
+$ myapp create [<flags>]
+@@@
+
+Flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--verbosity@|@3@|Verbosity level.|
+|@--[no-]dry-run@|@false@|Whether to use dry-run mode|
+
+`,
+		},
+		{
+			name: "multiple sub-command args",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				create := app.Command("create", "Create.")
+				create.Arg("verbosity", "Verbosity level.").Default("3").Int()
+				create.Arg("dry-run", "Whether to use dry-run mode").Default("false").Bool()
+				return app
+			},
+			expectSubstring: `## myapp create
+
+Create.
+
+Usage:
+
+@@@code
+$ myapp create [<verbosity>] [<dry-run>]
+@@@
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|verbosity|@3@ (optional)|Verbosity level.|
+|dry-run|@false@ (optional)|Whether to use dry-run mode|
+
+`,
+		},
+		{
+			name: "sub-command order",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				app.Command("create", "Create a resource.")
+				app.Command("validate", "Validate the config.")
+				app.Command("connect", "Connect to a server.")
+				return app
+			},
+			expectSubstring: `## myapp connect
+
+Connect to a server.
+
+Usage:
+
+@@@code
+$ myapp connect
+@@@
+
+## myapp create
+
+Create a resource.
+
+Usage:
+
+@@@code
+$ myapp create
+@@@
+
+## myapp help
+
+Show help.
+
+Usage:
+
+@@@code
+$ myapp help [<command>...]
+@@@
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|command|none (optional)|Show help on command.|
+
+## myapp validate
+
+Validate the config.
+
+Usage:
+
+@@@code
+$ myapp validate
+@@@
+
+`,
+		},
+		{
+			name: "level-3 command order",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				mfa := app.Command("mfa", "Manage MFA resources.")
+				mfa.Command("add", "Add an MFA device.")
+				app.Command("create", "Create a resource")
+				return app
+			},
+			expectSubstring: `## myapp create
+
+Create a resource
+
+Usage:
+
+@@@code
+$ myapp create
+@@@
+
+## myapp help
+
+Show help.
+
+Usage:
+
+@@@code
+$ myapp help [<command>...]
+@@@
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|command|none (optional)|Show help on command.|
+
+## myapp mfa add
+
+Add an MFA device.
+
+Usage:
+
+@@@code
+$ myapp mfa add
+@@@
+
+`,
+		},
+		{
+			name: "empty arg",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				app.Command("kubectl", "Proxy kubectl commands.")
+				kubectl := app.Command("kubectl", "Proxy kubectl commands.").Interspersed(false)
+				// This hack is required in order to accept any args for tsh kubectl.
+				kubectl.Arg("", "").StringsVar(new([]string))
+
+				return app
+			},
+			expectSubstring: `## myapp kubectl
+
+Proxy kubectl commands.
+
+Usage:
+
+@@@code
+$ myapp kubectl [args...]
+@@@
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|args|none (optional)|Arbitrary arguments|
+
+`,
+		},
+		{
+			name: "hidden flag",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				app.Command("kubectl", "Proxy kubectl commands.")
+				kubectl := app.Command("kubectl", "Proxy kubectl commands.").Interspersed(false)
+				kubectl.Flag("diag", "Run diagnostics").Hidden().Bool()
+				app.Command("log", "Print logs")
+
+				return app
+			},
+			expectSubstring: `## myapp kubectl
+
+Proxy kubectl commands.
+
+Usage:
+
+@@@code
+$ myapp kubectl
+@@@
+
+## myapp log
+`,
+		},
+		{
+			name: "main command env vars",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("verbosity", "Verbosity level.").Default("3").Envar("MYAPP_VERBOSITY").Int()
+				return app
+			},
+			expectSubstring: `Global flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--verbosity@|@3@|Verbosity level.|
+
+Global environment variables:
+
+|Variable|Default|Description|
+|---|---|---|
+|@MYAPP_VERBOSITY@|@3@|Verbosity level.|
+
+`,
+		},
+		{
+			name: "subcommand env vars",
+			makeApp: func() *kingpin.Application {
+				app := InitCLIParser("myapp", "This is the main CLI tool.")
+				app.Flag("config", "The location of the config file").Default("config.yaml").String()
+				create := app.Command("create", "Create a resource.")
+				create.Flag("name", "The name of the resource").Envar("CREATE_NAME").Default("myresource").String()
+				create.Arg("type", "The type of the resource").Envar("CREATE_TYPE").String()
+
+				return app
+			},
+			expectSubstring: `## myapp create
+
+Create a resource.
+
+Usage:
+
+@@@code
+$ myapp create [<flags>] [<type>]
+@@@
+
+Environment variables:
+
+|Variable|Default|Description|
+|---|---|---|
+|@CREATE_TYPE@|none (optional)|The type of the resource|
+|@CREATE_NAME@|@myresource@|The name of the resource|
+
+Flags:
+
+|Flag|Default|Description|
+|---|---|---|
+|@--name@|@myresource@|The name of the resource|
+
+Arguments:
+
+|Argument|Default|Description|
+|---|---|---|
+|type|none (optional)|The type of the resource|
+
+`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			app := tt.makeApp()
+			var buffer bytes.Buffer
+			app.UsageWriter(&buffer)
+			args := []string{"help"}
+			app.Terminate(func(int) {})
+
+			docsUsageTemplatePath := "docs-usage.md.tmpl"
+			f, err := os.Open(docsUsageTemplatePath)
+			require.NoError(t, err)
+			updateAppUsageTemplate(f, app)
+
+			// kingpin only adds a help command if there is at least
+			// one subcommand. Make sure that all test cases
+			// introduce a help command.
+			app.HelpCommand = app.Command("help", "Print help for the application.")
+			// HelpCommand is triggered on PreAction during Parse.
+			// See kingpin.Application.init for more details.
+			_, err = app.Parse(args)
+			require.NoError(t, err)
+			expected := strings.ReplaceAll(tt.expectSubstring, "@", "`")
+			require.Contains(t, buffer.String(), expected)
+		})
+	}
+}
diff --git a/lib/utils/usage_test.go b/lib/utils/usage_test.go
new file mode 100644
index 0000000000000..f9aeae2502e8a
--- /dev/null
+++ b/lib/utils/usage_test.go
@@ -0,0 +1,107 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build !docs
+
+package utils
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateAppUsageTemplate(t *testing.T) {
+	makeApp := func(usageWriter io.Writer) *kingpin.Application {
+		app := InitCLIParser("TestUpdateAppUsageTemplate", "some help message")
+		app.UsageWriter(usageWriter)
+		app.Terminate(func(int) {})
+
+		app.Command("hello", "Hello.")
+
+		create := app.Command("create", "Create.")
+		create.Command("box", "Box.")
+		create.Command("rocket", "Rocket.")
+		return app
+	}
+
+	tests := []struct {
+		name           string
+		inputArgs      []string
+		outputContains string
+	}{
+		{
+			name:      "command width aligned for app help",
+			inputArgs: []string{},
+			outputContains: `
+Commands:
+  help          Show help.
+  hello         Hello.
+  create box    Box.
+  create rocket Rocket.
+`,
+		},
+		{
+			name:      "command width aligned for command help",
+			inputArgs: []string{"create"},
+			outputContains: `
+Commands:
+  create box    Box.
+  create rocket Rocket.
+`,
+		},
+		{
+			name:      "command width aligned for unknown command error",
+			inputArgs: []string{"unknown"},
+			outputContains: `
+Commands:
+  help          Show help.
+  hello         Hello.
+  create box    Box.
+  create rocket Rocket.
+`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Run("help flag", func(t *testing.T) {
+				var buffer bytes.Buffer
+				app := makeApp(&buffer)
+				args := append(tt.inputArgs, "--help")
+				UpdateAppUsageTemplate(app, args)
+
+				app.Usage(args)
+				require.Contains(t, buffer.String(), tt.outputContains)
+			})
+
+			t.Run("help command", func(t *testing.T) {
+				var buffer bytes.Buffer
+				app := makeApp(&buffer)
+				args := append([]string{"help"}, tt.inputArgs...)
+				UpdateAppUsageTemplate(app, args)
+
+				// HelpCommand is triggered on PreAction during Parse.
+				// See kingpin.Application.init for more details.
+				_, err := app.Parse(args)
+				require.NoError(t, err)
+				require.Contains(t, buffer.String(), tt.outputContains)
+			})
+		})
+	}
+}
diff --git a/lib/utils/utils.go b/lib/utils/utils.go
index 96478dbc6e7fe..6ac5c175c11a5 100644
--- a/lib/utils/utils.go
+++ b/lib/utils/utils.go
@@ -304,6 +304,16 @@ func Host(hostname string) (string, error) {
 	return host, nil
 }
 
+// TryHost is a utility function that extracts host from the host:port pair,
+// in case of any error returns the original value.
+func TryHost(in string) string {
+	out, err := Host(in)
+	if err != nil {
+		return in
+	}
+	return out
+}
+
 // SplitHostPort splits host and port and checks that host is not empty
 func SplitHostPort(hostname string) (string, string, error) {
 	host, port, err := net.SplitHostPort(hostname)
diff --git a/lib/utils/utils_test.go b/lib/utils/utils_test.go
index 992a5198a443a..6790d132152fe 100644
--- a/lib/utils/utils_test.go
+++ b/lib/utils/utils_test.go
@@ -31,12 +31,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/utils/cert"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func TestMain(m *testing.M) {
-	InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
@@ -113,7 +113,7 @@ func TestMinVersions(t *testing.T) {
 	}
 	for _, testCase := range failTestCases {
 		t.Run(testCase.info, func(t *testing.T) {
-			fixtures.AssertBadParameter(t, CheckMinVersion(testCase.client, testCase.minClient))
+			require.True(t, trace.IsBadParameter(CheckMinVersion(testCase.client, testCase.minClient)))
 			assert.False(t, MeetsMinVersion(testCase.client, testCase.minClient), "MeetsMinVersion expected to fail")
 		})
 	}
@@ -146,7 +146,7 @@ func TestMaxVersions(t *testing.T) {
 	}
 	for _, testCase := range failTestCases {
 		t.Run(testCase.info, func(t *testing.T) {
-			fixtures.AssertBadParameter(t, CheckMaxVersion(testCase.client, testCase.maxClient))
+			require.True(t, trace.IsBadParameter(CheckMaxVersion(testCase.client, testCase.maxClient)))
 			assert.False(t, MeetsMaxVersion(testCase.client, testCase.maxClient), "MeetsMinVersion expected to fail")
 		})
 	}
@@ -214,7 +214,7 @@ func TestParseAdvertiseAddr(t *testing.T) {
 	for _, testCase := range failTestCases {
 		t.Run(testCase.info, func(t *testing.T) {
 			_, _, err := ParseAdvertiseAddr(testCase.in)
-			fixtures.AssertBadParameter(t, err)
+			require.True(t, trace.IsBadParameter(err))
 		})
 	}
 }
@@ -536,7 +536,7 @@ func TestTryReadValueAsFile(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = TryReadValueAsFile("/tmp/non-existent-token-for-teleport-tests-not-found")
-	fixtures.AssertNotFound(t, err)
+	require.True(t, trace.IsNotFound(err))
 
 	dir := t.TempDir()
 	tokenPath := filepath.Join(dir, "token")
diff --git a/lib/versioncontrol/target.go b/lib/versioncontrol/target.go
index 6f034fb4f9eb3..68feabe13168f 100644
--- a/lib/versioncontrol/target.go
+++ b/lib/versioncontrol/target.go
@@ -148,7 +148,7 @@ func (t Target) SecurityPatch() bool {
 }
 
 // SecurityPatchAltOf performs a bidirectional check to see if this target and another
-// are security patch alternates (i.e. wether or not they provide the same security fix).
+// are security patch alternates (i.e. whether or not they provide the same security fix).
 func (t Target) SecurityPatchAltOf(other Target) bool {
 	if !t.Ok() || !other.Ok() {
 		return false
diff --git a/lib/versioncontrol/upgradewindow/upgradewindow.go b/lib/versioncontrol/upgradewindow/upgradewindow.go
index ad321aec9aa9e..7187f7b404d2b 100644
--- a/lib/versioncontrol/upgradewindow/upgradewindow.go
+++ b/lib/versioncontrol/upgradewindow/upgradewindow.go
@@ -50,7 +50,7 @@ const (
 type ExportFunc func(ctx context.Context, req proto.ExportUpgradeWindowsRequest) (proto.ExportUpgradeWindowsResponse, error)
 
 // contextLike lets us abstract over the difference between basic contexts and context-like values such
-// as control stream senders or resource watchers. the exporter uses a contextLike value to decide wether
+// as control stream senders or resource watchers. the exporter uses a contextLike value to decide whether
 // or not auth connectivity appears healthy. during normal runtime, we end up using the inventory control
 // stream send handle.
 type contextLike interface {
@@ -316,10 +316,10 @@ type Driver interface {
 }
 
 // NewDriver sets up a new export driver corresponding to the specified upgrader kind.
-func NewDriver(kind string) (Driver, error) {
+func NewDriver(ctx context.Context, kind string) (Driver, error) {
 	switch kind {
 	case types.UpgraderKindKubeController:
-		return NewKubeControllerDriver(KubeControllerDriverConfig{})
+		return NewKubeControllerDriver(ctx, KubeControllerDriverConfig{})
 	case types.UpgraderKindSystemdUnit:
 		return NewSystemdUnitDriver(SystemdUnitDriverConfig{})
 	default:
@@ -344,10 +344,10 @@ type kubeDriver struct {
 	cfg KubeControllerDriverConfig
 }
 
-func NewKubeControllerDriver(cfg KubeControllerDriverConfig) (Driver, error) {
+func NewKubeControllerDriver(ctx context.Context, cfg KubeControllerDriverConfig) (Driver, error) {
 	if cfg.Backend == nil {
 		var err error
-		cfg.Backend, err = kubernetes.NewShared()
+		cfg.Backend, err = kubernetes.NewShared(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/versioncontrol/upgradewindow/upgradewindow_test.go b/lib/versioncontrol/upgradewindow/upgradewindow_test.go
index 3adb1bc9e9569..ec4b94bcd0d30 100644
--- a/lib/versioncontrol/upgradewindow/upgradewindow_test.go
+++ b/lib/versioncontrol/upgradewindow/upgradewindow_test.go
@@ -56,7 +56,7 @@ func TestKubeControllerDriver(t *testing.T) {
 
 	bk := newFakeKubeBackend()
 
-	driver, err := NewKubeControllerDriver(KubeControllerDriverConfig{
+	driver, err := NewKubeControllerDriver(ctx, KubeControllerDriverConfig{
 		Backend: bk,
 	})
 	require.NoError(t, err)
diff --git a/lib/vnet/admin_process_common.go b/lib/vnet/admin_process_common.go
index bf4574aae01f1..7ec69dae0b07f 100644
--- a/lib/vnet/admin_process_common.go
+++ b/lib/vnet/admin_process_common.go
@@ -17,15 +17,26 @@
 package vnet
 
 import (
+	"context"
+
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 )
 
-func newNetworkStackConfig(tun tunDevice, clt *clientApplicationServiceClient) (*networkStackConfig, error) {
+func newNetworkStackConfig(ctx context.Context, tun tunDevice, clt *clientApplicationServiceClient) (*networkStackConfig, error) {
+	clock := clockwork.NewRealClock()
+	sshProvider, err := newSSHProvider(ctx, sshProviderConfig{
+		clt:   clt,
+		clock: clock,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	tcpHandlerResolver := newTCPHandlerResolver(&tcpHandlerResolverConfig{
 		clt:         clt,
 		appProvider: newAppProvider(clt),
-		clock:       clockwork.NewRealClock(),
+		sshProvider: sshProvider,
+		clock:       clock,
 	})
 	ipv6Prefix, err := newIPv6Prefix()
 	if err != nil {
diff --git a/lib/vnet/admin_process_darwin.go b/lib/vnet/admin_process_darwin.go
index 90355bc85588b..9a7b789657a50 100644
--- a/lib/vnet/admin_process_darwin.go
+++ b/lib/vnet/admin_process_darwin.go
@@ -19,6 +19,7 @@ package vnet
 import (
 	"context"
 	"errors"
+	"os"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -59,7 +60,7 @@ func RunDarwinAdminProcess(ctx context.Context, config daemon.Config) error {
 	}
 	defer tun.Close()
 
-	networkStackConfig, err := newNetworkStackConfig(tun, clt)
+	networkStackConfig, err := newNetworkStackConfig(ctx, tun, clt)
 	if err != nil {
 		return trace.Wrap(err, "creating network stack config")
 	}
@@ -75,12 +76,13 @@ func RunDarwinAdminProcess(ctx context.Context, config daemon.Config) error {
 		return trace.Wrap(err, "reporting network stack info to client application")
 	}
 
-	osConfigProvider, err := newRemoteOSConfigProvider(
-		clt,
-		tunName,
-		networkStackConfig.ipv6Prefix.String(),
-		networkStackConfig.dnsIPv6.String(),
-	)
+	osConfigProvider, err := newOSConfigProvider(osConfigProviderConfig{
+		clt:           clt,
+		tunName:       tunName,
+		ipv6Prefix:    networkStackConfig.ipv6Prefix.String(),
+		dnsIPv6:       networkStackConfig.dnsIPv6.String(),
+		addDNSAddress: networkStack.addDNSAddress,
+	})
 	if err != nil {
 		return trace.Wrap(err, "creating OS config provider")
 	}
@@ -88,18 +90,21 @@ func RunDarwinAdminProcess(ctx context.Context, config daemon.Config) error {
 
 	g, ctx := errgroup.WithContext(ctx)
 	g.Go(func() error {
+		defer log.InfoContext(ctx, "Network stack terminated.")
 		if err := networkStack.run(ctx); err != nil {
 			return trace.Wrap(err, "running network stack")
 		}
 		return errors.New("network stack terminated")
 	})
 	g.Go(func() error {
+		defer log.InfoContext(ctx, "OS configuration loop exited.")
 		if err := osConfigurator.runOSConfigurationLoop(ctx); err != nil {
 			return trace.Wrap(err, "running OS configuration loop")
 		}
 		return errors.New("OS configuration loop terminated")
 	})
 	g.Go(func() error {
+		defer log.InfoContext(ctx, "Ping loop exited.")
 		tick := time.Tick(time.Second)
 		for {
 			select {
@@ -112,7 +117,27 @@ func RunDarwinAdminProcess(ctx context.Context, config daemon.Config) error {
 			}
 		}
 	})
-	return trace.Wrap(g.Wait(), "running VNet admin process")
+
+	done := make(chan error)
+	go func() {
+		done <- g.Wait()
+	}()
+
+	select {
+	case err := <-done:
+		return trace.Wrap(err, "running VNet admin process")
+	case <-ctx.Done():
+	}
+
+	select {
+	case err := <-done:
+		// network stack exited cleanly within timeout
+		return trace.Wrap(err, "running VNet admin process")
+	case <-time.After(10 * time.Second):
+		log.ErrorContext(ctx, "VNet admin process did not exit within 10 seconds, forcing shutdown.")
+		os.Exit(1)
+		return nil
+	}
 }
 
 func createTUNDevice(ctx context.Context) (tun.Device, string, error) {
diff --git a/lib/vnet/admin_process_windows.go b/lib/vnet/admin_process_windows.go
index e4f1112f2b0be..09afbf8619d48 100644
--- a/lib/vnet/admin_process_windows.go
+++ b/lib/vnet/admin_process_windows.go
@@ -100,7 +100,7 @@ func runWindowsAdminProcess(ctx context.Context, cfg *windowsAdminProcessConfig)
 	}
 	log.InfoContext(ctx, "Created TUN interface", "tun", tunName)
 
-	networkStackConfig, err := newNetworkStackConfig(device, clt)
+	networkStackConfig, err := newNetworkStackConfig(ctx, device, clt)
 	if err != nil {
 		return trace.Wrap(err, "creating network stack config")
 	}
@@ -116,12 +116,13 @@ func runWindowsAdminProcess(ctx context.Context, cfg *windowsAdminProcessConfig)
 		return trace.Wrap(err, "reporting network stack info to client application")
 	}
 
-	osConfigProvider, err := newRemoteOSConfigProvider(
-		clt,
-		tunName,
-		networkStackConfig.ipv6Prefix.String(),
-		networkStackConfig.dnsIPv6.String(),
-	)
+	osConfigProvider, err := newOSConfigProvider(osConfigProviderConfig{
+		clt:           clt,
+		tunName:       tunName,
+		ipv6Prefix:    networkStackConfig.ipv6Prefix.String(),
+		dnsIPv6:       networkStackConfig.dnsIPv6.String(),
+		addDNSAddress: networkStack.addDNSAddress,
+	})
 	if err != nil {
 		return trace.Wrap(err, "creating OS config provider")
 	}
diff --git a/lib/vnet/app_handler.go b/lib/vnet/app_handler.go
index 09322d52bb264..aefa77fed33f1 100644
--- a/lib/vnet/app_handler.go
+++ b/lib/vnet/app_handler.go
@@ -49,6 +49,10 @@ type tcpAppHandlerConfig struct {
 	appInfo     *vnetv1.AppInfo
 	appProvider *appProvider
 	clock       clockwork.Clock
+	// alwaysTrustRootClusterCA can be set in tests so that TLS dials to the
+	// proxy always trust the root cluster CA rather than the system cert pool,
+	// even when ALPN conn upgrades are not required.
+	alwaysTrustRootClusterCA bool
 }
 
 func newTCPAppHandler(cfg *tcpAppHandlerConfig) *tcpAppHandler {
@@ -102,9 +106,13 @@ func (h *tcpAppHandler) getOrInitializeLocalProxy(ctx context.Context, localPort
 		InsecureSkipVerify:      dialOptions.GetInsecureSkipVerify(),
 		Clock:                   h.cfg.clock,
 	}
-	if certPoolPEM := dialOptions.GetRootClusterCaCertPool(); len(certPoolPEM) > 0 {
+	if dialOptions.GetAlpnConnUpgradeRequired() || h.cfg.alwaysTrustRootClusterCA {
+		certPoolPEM := dialOptions.GetRootClusterCaCertPool()
+		if len(certPoolPEM) == 0 {
+			return nil, trace.BadParameter("ALPN conn upgrade required but no root CA cert pool provided")
+		}
 		caPool := x509.NewCertPool()
-		if !caPool.AppendCertsFromPEM(dialOptions.GetRootClusterCaCertPool()) {
+		if !caPool.AppendCertsFromPEM(certPoolPEM) {
 			return nil, trace.Errorf("failed to parse root cluster CA certs")
 		}
 		localProxyConfig.RootCAs = caPool
@@ -157,7 +165,7 @@ func (i *appCertIssuer) IssueCert(ctx context.Context) (tls.Certificate, error)
 }
 
 // localProxyMiddleware wraps around [client.CertChecker] and additionally makes it so that its
-// OnNewConnection method calls the same method of [appProvider].
+// OnNewConnection method calls OnNewAppConnection on [appProvider].
 type localProxyMiddleware struct {
 	appKey      *vnetv1.AppKey
 	certChecker *client.CertChecker
@@ -169,7 +177,7 @@ func (m *localProxyMiddleware) OnNewConnection(ctx context.Context, lp *alpnprox
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	return trace.Wrap(m.appProvider.OnNewConnection(ctx, m.appKey))
+	return trace.Wrap(m.appProvider.OnNewAppConnection(ctx, m.appKey))
 }
 
 func (m *localProxyMiddleware) OnStart(ctx context.Context, lp *alpnproxy.LocalProxy) error {
diff --git a/lib/vnet/app_provider.go b/lib/vnet/app_provider.go
index e4828d99ff38f..c8ec1e8d3e269 100644
--- a/lib/vnet/app_provider.go
+++ b/lib/vnet/app_provider.go
@@ -18,11 +18,8 @@ package vnet
 
 import (
 	"context"
-	"crypto"
-	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
-	"io"
 
 	"github.com/gravitational/trace"
 
@@ -59,64 +56,27 @@ func (p *appProvider) ReissueAppCert(ctx context.Context, appInfo *vnetv1.AppInf
 	return tlsCert, nil
 }
 
-func (p *appProvider) newAppCertSigner(cert []byte, appKey *vnetv1.AppKey, targetPort uint16) (*rpcAppCertSigner, error) {
+func (p *appProvider) newAppCertSigner(cert []byte, appKey *vnetv1.AppKey, targetPort uint16) (*rpcSigner, error) {
 	x509Cert, err := x509.ParseCertificate(cert)
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing x509 certificate")
 	}
-	return &rpcAppCertSigner{
-		clt:        p.clt,
-		pub:        x509Cert.PublicKey,
-		appKey:     appKey,
-		targetPort: targetPort,
+	pub := x509Cert.PublicKey
+	return &rpcSigner{
+		pub: pub,
+		sendRequest: func(req *vnetv1.SignRequest) ([]byte, error) {
+			return p.clt.SignForApp(context.TODO(), &vnetv1.SignForAppRequest{
+				AppKey:     appKey,
+				TargetPort: uint32(targetPort),
+				Sign:       req,
+			})
+		},
 	}, nil
 }
 
-// rpcAppCertSigner implements [crypto.Signer] for app TLS signatures that are
-// issued by the client application over gRPC.
-type rpcAppCertSigner struct {
-	clt        *clientApplicationServiceClient
-	pub        crypto.PublicKey
-	appKey     *vnetv1.AppKey
-	targetPort uint16
-}
-
-// Public implements [crypto.Signer.Public] and returns the public key
-// associated with the signer.
-func (s *rpcAppCertSigner) Public() crypto.PublicKey {
-	return s.pub
-}
-
-// Sign implements [crypto.Signer.Sign] and issues a signature over digest for
-// the associated app.
-func (s *rpcAppCertSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
-	req := &vnetv1.SignForAppRequest{
-		AppKey:     s.appKey,
-		TargetPort: uint32(s.targetPort),
-		Digest:     digest,
-	}
-	switch opts.HashFunc() {
-	case 0:
-		req.Hash = vnetv1.Hash_HASH_NONE
-	case crypto.SHA256:
-		req.Hash = vnetv1.Hash_HASH_SHA256
-	default:
-		return nil, trace.BadParameter("unsupported signature hash func %v", opts.HashFunc())
-	}
-	if pssOpts, ok := opts.(*rsa.PSSOptions); ok {
-		saltLen := int32(pssOpts.SaltLength)
-		req.PssSaltLength = &saltLen
-	}
-	signature, err := s.clt.SignForApp(context.TODO(), req)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return signature, nil
-}
-
-// OnNewConnection reports a new TCP connection to the target app.
-func (p *appProvider) OnNewConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
-	if err := p.clt.OnNewConnection(ctx, appKey); err != nil {
+// OnNewAppConnection reports a new TCP connection to the target app.
+func (p *appProvider) OnNewAppConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
+	if err := p.clt.OnNewAppConnection(ctx, appKey); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
diff --git a/lib/vnet/client_application_service.go b/lib/vnet/client_application_service.go
index 1f1b17a0e35d8..94f58a48c3baa 100644
--- a/lib/vnet/client_application_service.go
+++ b/lib/vnet/client_application_service.go
@@ -17,16 +17,24 @@
 package vnet
 
 import (
+	"cmp"
 	"context"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
 	"sync"
+	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport/api"
+	"github.com/gravitational/teleport/api/client/proto"
 	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // clientApplicationService implements the gRPC
@@ -43,8 +51,8 @@ type clientApplicationService struct {
 	// ReportNetworkStackInfo.
 	networkStackInfo chan *vnetv1.NetworkStackInfo
 
-	// mu protects appSignerCache
-	mu sync.Mutex
+	// appSignerMu protects appSignerCache.
+	appSignerMu sync.Mutex
 	// appSignerCache caches the crypto.Signer for each certificate issued by
 	// ReissueAppCert so that SignForApp can later use that signer.
 	//
@@ -53,20 +61,36 @@ type clientApplicationService struct {
 	// ReissueAppCert, which will overwrite the signer for the app with a new
 	// one.
 	appSignerCache map[appKey]crypto.Signer
+
+	// sshSigners is a cache containing [crypto.Signer]s keyed by SSH session
+	// ID. This "session ID" is a concept only used here for retrieving a signer
+	// previously associated with the same session, it is not some Teleport
+	// session identifier.
+	sshSigners *utils.FnCache
 }
 
 type clientApplicationServiceConfig struct {
-	fqdnResolver          *fqdnResolver
-	localOSConfigProvider *LocalOSConfigProvider
-	clientApplication     ClientApplication
+	fqdnResolver                 *fqdnResolver
+	unifiedClusterConfigProvider *UnifiedClusterConfigProvider
+	clientApplication            ClientApplication
+	homePath                     string
+	clock                        clockwork.Clock
 }
 
-func newClientApplicationService(cfg *clientApplicationServiceConfig) *clientApplicationService {
+func newClientApplicationService(cfg *clientApplicationServiceConfig) (*clientApplicationService, error) {
+	sshSigners, err := utils.NewFnCache(utils.FnCacheConfig{
+		TTL:   time.Minute,
+		Clock: cfg.clock,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	return &clientApplicationService{
 		cfg:              cfg,
 		networkStackInfo: make(chan *vnetv1.NetworkStackInfo, 1),
 		appSignerCache:   make(map[appKey]crypto.Signer),
-	}
+		sshSigners:       sshSigners,
+	}, nil
 }
 
 // AuthenticateProcess implements [vnetv1.ClientApplicationServiceServer.AuthenticateProcess].
@@ -132,29 +156,14 @@ func (s *clientApplicationService) ReissueAppCert(ctx context.Context, req *vnet
 // It uses a cached signer for the requested app, which must have previously
 // been issued a certificate via [clientApplicationService.ReissueAppCert].
 func (s *clientApplicationService) SignForApp(ctx context.Context, req *vnetv1.SignForAppRequest) (*vnetv1.SignForAppResponse, error) {
+	signReq := req.GetSign()
 	log.DebugContext(ctx, "Got SignForApp request",
 		"app", req.GetAppKey(),
-		"hash", req.GetHash(),
-		"is_rsa_pss", req.PssSaltLength != nil,
-		"pss_salt_len", req.GetPssSaltLength(),
-		"digest_len", len(req.GetDigest()),
+		"hash", signReq.GetHash(),
+		"is_rsa_pss", signReq.PssSaltLength != nil,
+		"pss_salt_len", signReq.GetPssSaltLength(),
+		"digest_len", len(signReq.GetDigest()),
 	)
-	var hash crypto.Hash
-	switch req.GetHash() {
-	case vnetv1.Hash_HASH_NONE:
-		hash = crypto.Hash(0)
-	case vnetv1.Hash_HASH_SHA256:
-		hash = crypto.SHA256
-	default:
-		return nil, trace.BadParameter("unsupported hash %v", req.GetHash())
-	}
-	opts := crypto.SignerOpts(hash)
-	if req.PssSaltLength != nil {
-		opts = &rsa.PSSOptions{
-			Hash:       hash,
-			SaltLength: int(*req.PssSaltLength),
-		}
-	}
 
 	appKey := req.GetAppKey()
 	if err := checkAppKey(appKey); err != nil {
@@ -165,7 +174,7 @@ func (s *clientApplicationService) SignForApp(ctx context.Context, req *vnetv1.S
 		return nil, trace.BadParameter("no signer for app %v", appKey)
 	}
 
-	signature, err := signer.Sign(rand.Reader, req.GetDigest(), opts)
+	signature, err := sign(signer, signReq)
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for app %v", appKey)
 	}
@@ -174,26 +183,45 @@ func (s *clientApplicationService) SignForApp(ctx context.Context, req *vnetv1.S
 	}, nil
 }
 
+func sign(signer crypto.Signer, signReq *vnetv1.SignRequest) ([]byte, error) {
+	var hash crypto.Hash
+	switch signReq.GetHash() {
+	case vnetv1.Hash_HASH_NONE:
+		hash = crypto.Hash(0)
+	case vnetv1.Hash_HASH_SHA256:
+		hash = crypto.SHA256
+	default:
+		return nil, trace.BadParameter("unsupported hash %v", signReq.GetHash())
+	}
+	opts := crypto.SignerOpts(hash)
+	if signReq.PssSaltLength != nil {
+		opts = &rsa.PSSOptions{
+			Hash:       hash,
+			SaltLength: int(*signReq.PssSaltLength),
+		}
+	}
+	signature, err := signer.Sign(rand.Reader, signReq.GetDigest(), opts)
+	return signature, trace.Wrap(err)
+}
+
 func (s *clientApplicationService) setSignerForApp(appKey *vnetv1.AppKey, targetPort uint16, signer crypto.Signer) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+	s.appSignerMu.Lock()
+	defer s.appSignerMu.Unlock()
 	s.appSignerCache[newAppKey(appKey, targetPort)] = signer
 }
 
 func (s *clientApplicationService) getSignerForApp(appKey *vnetv1.AppKey, targetPort uint16) (crypto.Signer, bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+	s.appSignerMu.Lock()
+	defer s.appSignerMu.Unlock()
 	signer, ok := s.appSignerCache[newAppKey(appKey, targetPort)]
 	return signer, ok
 }
 
-// OnNewConnection gets called whenever a new connection is about to be
+// OnNewAppConnection gets called whenever a new app connection is about to be
 // established through VNet for observability.
-func (s *clientApplicationService) OnNewConnection(ctx context.Context, req *vnetv1.OnNewConnectionRequest) (*vnetv1.OnNewConnectionResponse, error) {
-	if err := s.cfg.clientApplication.OnNewConnection(ctx, req.GetAppKey()); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &vnetv1.OnNewConnectionResponse{}, nil
+func (s *clientApplicationService) OnNewAppConnection(ctx context.Context, req *vnetv1.OnNewAppConnectionRequest) (*vnetv1.OnNewAppConnectionResponse, error) {
+	s.cfg.clientApplication.OnNewAppConnection(ctx, req.GetAppKey())
+	return &vnetv1.OnNewAppConnectionResponse{}, nil
 }
 
 // OnInvalidLocalPort gets called before VNet refuses to handle a connection
@@ -225,12 +253,180 @@ func newAppKey(protoAppKey *vnetv1.AppKey, port uint16) appKey {
 // DNS nameserver and the IPv4 CIDR ranges that should be routed to the VNet TUN
 // interface.
 func (s *clientApplicationService) GetTargetOSConfiguration(ctx context.Context, _ *vnetv1.GetTargetOSConfigurationRequest) (*vnetv1.GetTargetOSConfigurationResponse, error) {
-	targetConfig, err := s.cfg.localOSConfigProvider.GetTargetOSConfiguration(ctx)
+	unifiedClusterConfig, err := s.cfg.unifiedClusterConfigProvider.GetUnifiedClusterConfig(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err, "getting target OS configuration")
 	}
 	return &vnetv1.GetTargetOSConfigurationResponse{
-		TargetOsConfiguration: targetConfig,
+		TargetOsConfiguration: &vnetv1.TargetOSConfiguration{
+			DnsZones:       unifiedClusterConfig.AllDNSZones(),
+			Ipv4CidrRanges: unifiedClusterConfig.IPv4CidrRanges,
+		},
+	}, nil
+}
+
+// UserTLSCert returns the user TLS certificate for a specific profile.
+func (s *clientApplicationService) UserTLSCert(ctx context.Context, req *vnetv1.UserTLSCertRequest) (*vnetv1.UserTLSCertResponse, error) {
+	tlsCert, err := s.cfg.clientApplication.UserTLSCert(ctx, req.GetProfile())
+	if err != nil {
+		return nil, trace.Wrap(err, "getting user TLS cert")
+	}
+	if len(tlsCert.Certificate) == 0 {
+		return nil, trace.Errorf("user TLS cert has no certificate")
+	}
+	dialOpts, err := s.cfg.clientApplication.GetDialOptions(ctx, req.GetProfile())
+	if err != nil {
+		return nil, trace.Wrap(err, "getting TLS dial options")
+	}
+	return &vnetv1.UserTLSCertResponse{
+		Cert:        tlsCert.Certificate[0],
+		DialOptions: dialOpts,
+	}, nil
+}
+
+// SignForUserTLS signs a digest with the user TLS private key.
+func (s *clientApplicationService) SignForUserTLS(ctx context.Context, req *vnetv1.SignForUserTLSRequest) (*vnetv1.SignForUserTLSResponse, error) {
+	tlsCert, err := s.cfg.clientApplication.UserTLSCert(ctx, req.GetProfile())
+	if err != nil {
+		return nil, trace.Wrap(err, "getting user TLS config")
+	}
+	signer, ok := tlsCert.PrivateKey.(crypto.Signer)
+	if !ok {
+		return nil, trace.Errorf("user TLS private key does not implement crypto.Signer")
+	}
+	signature, err := sign(signer, req.GetSign())
+	if err != nil {
+		return nil, trace.Wrap(err, "signing for user TLS certificate")
+	}
+	return &vnetv1.SignForUserTLSResponse{
+		Signature: signature,
+	}, nil
+}
+
+// SessionSSHConfig returns user SSH configuration values for an SSH session.
+func (s *clientApplicationService) SessionSSHConfig(ctx context.Context, req *vnetv1.SessionSSHConfigRequest) (*vnetv1.SessionSSHConfigResponse, error) {
+	clusterClient, err := s.cfg.clientApplication.GetCachedClient(ctx, req.GetProfile(), req.GetLeafCluster())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// If req.LeafCluster is not empty the node is in the leaf cluster, else it
+	// is in the root cluster.
+	targetCluster := cmp.Or(req.GetLeafCluster(), req.GetRootCluster())
+	target := client.NodeDetails{
+		Addr:    req.GetAddress(),
+		Cluster: targetCluster,
+	}
+	keyRing, completedMFA, err := clusterClient.SessionSSHKeyRing(ctx, req.GetUser(), target)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting KeyRing for SSH session")
+	}
+	if !completedMFA && keyRing.Cert == nil && targetCluster == req.GetLeafCluster() {
+		// It's possible/likely the user doesn't have an SSH cert specifically
+		// for the leaf cluster. Luckily if MFA was not required, the root
+		// cluster cert should work.
+		log.DebugContext(ctx, "Leaf cluster KeyRing had no SSH cert, using root cluster KeyRing")
+		rootClusterClient, err := s.cfg.clientApplication.GetCachedClient(ctx, req.GetProfile(), "")
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// Set the target cluster to the root cluster and disable the MFA check
+		// so that SessionSSHKeyRing will just return the base root cluster
+		// keyring.
+		target.Cluster = req.GetRootCluster()
+		target.MFACheck = &proto.IsMFARequiredResponse{
+			Required:    false,
+			MFARequired: proto.MFARequired_MFA_REQUIRED_NO,
+		}
+		keyRing, _, err = rootClusterClient.SessionSSHKeyRing(ctx, req.GetUser(), target)
+		if err != nil {
+			return nil, trace.Wrap(err, "getting root cluster KeyRing for SSH session")
+		}
+	}
+	if len(keyRing.Cert) == 0 {
+		return nil, trace.Errorf("user KeyRing has no SSH cert")
+	}
+	sshCert, _, _, _, err := ssh.ParseAuthorizedKey(keyRing.Cert)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing user SSH certificate")
+	}
+	var trustedCAs [][]byte
+	for _, trustedCert := range keyRing.TrustedCerts {
+		switch trustedCert.ClusterName {
+		case targetCluster, req.GetRootCluster():
+			// Always trust the target cluster and the root cluster in case the
+			// root proxy will terminate the connection in proxy recording mode.
+		default:
+			// Don't trust CAs for other leaf clusters or unknown clusters.
+			continue
+		}
+		for _, authorizedKey := range trustedCert.AuthorizedKeys {
+			trustedCA, _, _, _, err := ssh.ParseAuthorizedKey(authorizedKey)
+			if err != nil {
+				return nil, trace.Wrap(err, "parsing CA public key")
+			}
+			trustedCAs = append(trustedCAs, trustedCA.Marshal())
+		}
+	}
+	if len(trustedCAs) == 0 {
+		return nil, trace.Errorf("user KeyRing host no trusted SSH CAs for cluster %s", targetCluster)
+	}
+	sessionID := s.setSignerForSSHSession(keyRing.SSHPrivateKey)
+
+	// Submit usage event.
+	s.cfg.clientApplication.OnNewSSHSession(ctx, req.GetProfile(), req.GetRootCluster())
+
+	return &vnetv1.SessionSSHConfigResponse{
+		SessionId:  sessionID,
+		Cert:       sshCert.Marshal(),
+		TrustedCas: trustedCAs,
+	}, nil
+}
+
+// SignForSSHSession signs a digest with the SSH private key associated with the
+// session from a previous call to SessionSSHConfig.
+func (s *clientApplicationService) SignForSSHSession(ctx context.Context, req *vnetv1.SignForSSHSessionRequest) (*vnetv1.SignForSSHSessionResponse, error) {
+	signer, err := s.getSignerForSSHSession(ctx, req.GetSessionId())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	signature, err := sign(signer, req.GetSign())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &vnetv1.SignForSSHSessionResponse{
+		Signature: signature,
+	}, nil
+}
+
+func (s *clientApplicationService) setSignerForSSHSession(signer crypto.Signer) string {
+	sessionID := uuid.NewString()
+	s.sshSigners.Set(sessionID, signer)
+	return sessionID
+}
+
+func (s *clientApplicationService) getSignerForSSHSession(ctx context.Context, sessionID string) (crypto.Signer, error) {
+	signer, err := utils.FnCacheGet(ctx, s.sshSigners, sessionID, func(ctx context.Context) (crypto.Signer, error) {
+		return nil, trace.NotFound("session key expired")
+	})
+	return signer, trace.Wrap(err)
+}
+
+// ExchangeSSHKeys recevies the VNet service host CA public key and writes it to
+// ${TELEPORT_HOME}/vnet_known_hosts so that third-party SSH clients can trust
+// it. It then reads or generates ${TELEPORT_HOME}/id_vnet(.pub) which SSH
+// clients should be configured to use for connections to VNet SSH. It returns
+// id_vnet.pub so that VNet SSH can trust it for incoming connections.
+func (s *clientApplicationService) ExchangeSSHKeys(ctx context.Context, req *vnetv1.ExchangeSSHKeysRequest) (*vnetv1.ExchangeSSHKeysResponse, error) {
+	hostPublicKey, err := ssh.ParsePublicKey(req.GetHostPublicKey())
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing host public key")
+	}
+	userPublicKey, err := writeSSHKeys(s.cfg.homePath, hostPublicKey)
+	if err != nil {
+		return nil, trace.Wrap(err, "writing SSH keys")
+	}
+	return &vnetv1.ExchangeSSHKeysResponse{
+		UserPublicKey: userPublicKey.Marshal(),
 	}, nil
 }
 
diff --git a/lib/vnet/client_application_service_client.go b/lib/vnet/client_application_service_client.go
index 06b8d109b8f9b..ffee0471ba349 100644
--- a/lib/vnet/client_application_service_client.go
+++ b/lib/vnet/client_application_service_client.go
@@ -18,8 +18,12 @@ package vnet
 
 import (
 	"context"
+	"crypto"
+	"crypto/rsa"
+	"io"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc"
 	grpccredentials "google.golang.org/grpc/credentials"
 
@@ -130,13 +134,13 @@ func (c *clientApplicationServiceClient) SignForApp(ctx context.Context, req *vn
 	return resp.GetSignature(), nil
 }
 
-// OnNewConnection reports a new TCP connection to the target app.
-func (c *clientApplicationServiceClient) OnNewConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
-	_, err := c.clt.OnNewConnection(ctx, &vnetv1.OnNewConnectionRequest{
+// OnNewAppConnection reports a new TCP connection to the target app.
+func (c *clientApplicationServiceClient) OnNewAppConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
+	_, err := c.clt.OnNewAppConnection(ctx, &vnetv1.OnNewAppConnectionRequest{
 		AppKey: appKey,
 	})
 	if err != nil {
-		return trace.Wrap(err, "calling OnNewConnection rpc")
+		return trace.Wrap(err, "calling OnNewAppConnection rpc")
 	}
 	return nil
 }
@@ -165,3 +169,97 @@ func (c *clientApplicationServiceClient) GetTargetOSConfiguration(ctx context.Co
 	}
 	return resp.GetTargetOsConfiguration(), nil
 }
+
+// UserTLSCert returns the user TLS certificate for the given profile.
+func (c *clientApplicationServiceClient) UserTLSCert(ctx context.Context, profileName string) (*vnetv1.UserTLSCertResponse, error) {
+	resp, err := c.clt.UserTLSCert(ctx, &vnetv1.UserTLSCertRequest{
+		Profile: profileName,
+	})
+	return resp, trace.Wrap(err, "calling UserTLSCert rpc")
+}
+
+// SignForUserTLS returns a cryptographic signature with the key associated with
+// the user TLS key for the requested profile.
+func (c *clientApplicationServiceClient) SignForUserTLS(ctx context.Context, req *vnetv1.SignForUserTLSRequest) ([]byte, error) {
+	resp, err := c.clt.SignForUserTLS(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err, "calling SignForUserTLS rpc")
+	}
+	return resp.GetSignature(), nil
+}
+
+// SessionSSHConfig returns user SSH configuration values for an SSH session.
+func (c *clientApplicationServiceClient) SessionSSHConfig(ctx context.Context, target dialTarget, user string) (*vnetv1.SessionSSHConfigResponse, error) {
+	resp, err := c.clt.SessionSSHConfig(ctx, &vnetv1.SessionSSHConfigRequest{
+		Profile:     target.profile,
+		RootCluster: target.rootCluster,
+		LeafCluster: target.leafCluster,
+		Address:     target.addr,
+		User:        user,
+	})
+	return resp, trace.Wrap(err, "calling SessionSSHConfig rpc")
+}
+
+// SignForSSHSession signs a digest with the SSH private key associated with the
+// session from a previous call to SessionSSHConfig.
+func (c *clientApplicationServiceClient) SignForSSHSession(ctx context.Context, sessionID string, sign *vnetv1.SignRequest) ([]byte, error) {
+	resp, err := c.clt.SignForSSHSession(ctx, &vnetv1.SignForSSHSessionRequest{
+		SessionId: sessionID,
+		Sign:      sign,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "calling SignForSSHSession rpc")
+	}
+	return resp.GetSignature(), nil
+}
+
+// ExchangeSSHKeys sends hostPublicKey to the client application so that it
+// can write an OpenSSH-compatible configuration file. It returns the user
+// public key that should be trusted for incoming connections from third-party
+// SSH clients.
+func (c *clientApplicationServiceClient) ExchangeSSHKeys(ctx context.Context, hostPublicKey ssh.PublicKey) (ssh.PublicKey, error) {
+	resp, err := c.clt.ExchangeSSHKeys(ctx, &vnetv1.ExchangeSSHKeysRequest{
+		HostPublicKey: hostPublicKey.Marshal(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "calling ExchangeSSHKeys rpc")
+	}
+	userPublicKey, err := ssh.ParsePublicKey(resp.GetUserPublicKey())
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing trusted user public key")
+	}
+	return userPublicKey, nil
+}
+
+// rpcSigner implements [crypto.Signer] for signatures that are issued by the
+// client application over gRPC.
+type rpcSigner struct {
+	pub         crypto.PublicKey
+	sendRequest func(signReq *vnetv1.SignRequest) ([]byte, error)
+}
+
+// Public implements [crypto.Signer.Public] and returns the public key
+// associated with the signer.
+func (s *rpcSigner) Public() crypto.PublicKey {
+	return s.pub
+}
+
+// Sign implements [crypto.Signer.Sign] and issues a signature over digest.
+func (s *rpcSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	req := &vnetv1.SignRequest{
+		Digest: digest,
+	}
+	switch opts.HashFunc() {
+	case 0:
+		req.Hash = vnetv1.Hash_HASH_NONE
+	case crypto.SHA256:
+		req.Hash = vnetv1.Hash_HASH_SHA256
+	default:
+		return nil, trace.BadParameter("unsupported signature hash func %v", opts.HashFunc())
+	}
+	if pssOpts, ok := opts.(*rsa.PSSOptions); ok {
+		saltLen := int32(pssOpts.SaltLength)
+		req.PssSaltLength = &saltLen
+	}
+	return s.sendRequest(req)
+}
diff --git a/lib/vnet/clusterconfigcache.go b/lib/vnet/clusterconfigcache.go
index b0dde70c522bf..70b8403d86ddd 100644
--- a/lib/vnet/clusterconfigcache.go
+++ b/lib/vnet/clusterconfigcache.go
@@ -32,9 +32,10 @@ import (
 )
 
 type ClusterConfig struct {
-	// DNSZones is the list of DNS zones that are valid for this cluster, this includes ProxyPublicAddr *and*
-	// any configured custom DNS zones for the cluster.
-	DNSZones []string
+	// ProxyPublicAddr is the public address of the proxy, it is always a valid DNS zone for apps.
+	ProxyPublicAddr string
+	// CustomDNSZones is the list of custom DNS zones configured for the cluster.
+	CustomDNSZones []string
 	// IPv4CIDRRange is the CIDR range that IPv4 addresses should be assigned from for apps in this cluster.
 	IPv4CIDRRange string
 	// Expires is the time at which this information should be considered stale and refetched. Stale data may
@@ -46,6 +47,10 @@ func (e *ClusterConfig) stale(clock clockwork.Clock) bool {
 	return clock.Now().After(e.Expires)
 }
 
+func (c *ClusterConfig) appDNSZones() []string {
+	return append([]string{c.ProxyPublicAddr}, c.CustomDNSZones...)
+}
+
 // ClusterConfigCache is a read-through cache for cluster VnetConfigs. Cached entries go stale after 5
 // minutes, after which they will be re-fetched on the next read.
 //
@@ -116,7 +121,7 @@ func (c *ClusterConfigCache) getClusterConfigUncached(ctx context.Context, clust
 		}
 	}
 
-	dnsZones := []string{proxyPublicAddr}
+	var customDNSZones []string
 	ipv4CIDRRange := typesvnet.DefaultIPv4CIDRRange
 
 	vnetConfig, err := clusterClient.CurrentCluster().GetVnetConfig(ctx)
@@ -126,14 +131,15 @@ func (c *ClusterConfigCache) getClusterConfigUncached(ctx context.Context, clust
 		return nil, trace.Wrap(err)
 	} else {
 		for _, zone := range vnetConfig.GetSpec().GetCustomDnsZones() {
-			dnsZones = append(dnsZones, zone.GetSuffix())
+			customDNSZones = append(customDNSZones, zone.GetSuffix())
 		}
 		ipv4CIDRRange = cmp.Or(vnetConfig.GetSpec().GetIpv4CidrRange(), typesvnet.DefaultIPv4CIDRRange)
 	}
 
 	return &ClusterConfig{
-		DNSZones:      dnsZones,
-		IPv4CIDRRange: ipv4CIDRRange,
-		Expires:       c.clock.Now().Add(5 * time.Minute),
+		ProxyPublicAddr: proxyPublicAddr,
+		CustomDNSZones:  customDNSZones,
+		IPv4CIDRRange:   ipv4CIDRRange,
+		Expires:         c.clock.Now().Add(5 * time.Minute),
 	}, nil
 }
diff --git a/lib/vnet/diag/routeconflict_darwin.go b/lib/vnet/diag/routeconflict_darwin.go
index ae533ff1744ba..36785ca2f0722 100644
--- a/lib/vnet/diag/routeconflict_darwin.go
+++ b/lib/vnet/diag/routeconflict_darwin.go
@@ -129,5 +129,6 @@ func (n *NetInterfaces) interfaceApp(ctx context.Context, ifaceName string) (str
 func (c *RouteConflictDiag) commands(ctx context.Context) []*exec.Cmd {
 	return []*exec.Cmd{
 		exec.CommandContext(ctx, "netstat", "-rn", "-f", "inet"),
+		exec.CommandContext(ctx, "scutil", "--dns"),
 	}
 }
diff --git a/lib/vnet/diag/routeconflict_other.go b/lib/vnet/diag/routeconflict_other.go
index ce0acdaca1553..5ca8360dabd60 100644
--- a/lib/vnet/diag/routeconflict_other.go
+++ b/lib/vnet/diag/routeconflict_other.go
@@ -1,4 +1,4 @@
-//go:build !darwin
+//go:build !darwin && !windows
 
 // Teleport
 // Copyright (C) 2025 Gravitational, Inc.
diff --git a/lib/vnet/diag/routeconflict_windows.go b/lib/vnet/diag/routeconflict_windows.go
new file mode 100644
index 0000000000000..9dc89fc2d775d
--- /dev/null
+++ b/lib/vnet/diag/routeconflict_windows.go
@@ -0,0 +1,79 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package diag
+
+import (
+	"context"
+	"net/netip"
+	"os/exec"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+)
+
+var ipv4Broadcast = netip.AddrFrom4([4]byte{255, 255, 255, 255})
+
+// WindowsRouting provides Windows-specific [Routing] implementation used by [RouteConflictDiag].
+type WindowsRouting struct{}
+
+// GetRouteDestinations gets routes from the OS and then extracts the only
+// information needed from them: the route destination and the index of the
+// network interface. It operates solely on IPv4 routes.
+func (wr *WindowsRouting) GetRouteDestinations() ([]RouteDest, error) {
+	rows, err := winipcfg.GetIPForwardTable2(windows.AF_INET)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	rds := make([]RouteDest, 0, len(rows))
+	for _, row := range rows {
+		prefix := row.DestinationPrefix.Prefix()
+		addr := prefix.Addr()
+		if addr.IsLinkLocalMulticast() || addr == ipv4Broadcast {
+			// All interfaces seem to get a link local multicast and broadcast
+			// route assigned which would always appear as a conflict, so skip
+			// them.
+			continue
+		}
+		if prefix.IsSingleIP() {
+			rds = append(rds, &RouteDestIP{
+				Addr:       addr,
+				ifaceIndex: int(row.InterfaceIndex),
+			})
+		} else {
+			rds = append(rds, &RouteDestPrefix{
+				Prefix:     prefix,
+				ifaceIndex: int(row.InterfaceIndex),
+			})
+		}
+	}
+	return rds, nil
+}
+
+func (n *NetInterfaces) interfaceApp(ctx context.Context, ifaceName string) (string, error) {
+	// Interfaces usually have descriptive names on Windows (the TUN interfaces
+	// used by VNet and Tailscale do, at least).
+	return ifaceName, nil
+}
+
+func (c *RouteConflictDiag) commands(ctx context.Context) []*exec.Cmd {
+	return []*exec.Cmd{
+		exec.CommandContext(ctx, "netstat.exe", "-rn"),
+		exec.CommandContext(ctx, "ipconfig.exe", "/all"),
+		exec.CommandContext(ctx, "netsh.exe", "namespace", "show", "effectivepolicy"),
+	}
+}
diff --git a/lib/vnet/diag/ssh.go b/lib/vnet/diag/ssh.go
new file mode 100644
index 0000000000000..c0708aa650b2e
--- /dev/null
+++ b/lib/vnet/diag/ssh.go
@@ -0,0 +1,279 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package diag
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/dustin/go-humanize"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/teleport/api/utils/keypaths"
+	diagv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/diag/v1"
+)
+
+const (
+	maxOpenSSHConfigFileSize = 1 * 1024 * 1024 // 1 MiB
+)
+
+// SSHConfig includes everything that [SSHDiag] needs to run.
+type SSHConfig struct {
+	// ProfilePath is the path to the user profile (TELEPORT_HOME) where VNet's
+	// SSH configuration file is stored.
+	ProfilePath string
+}
+
+// SSHDiag is a diagnostic check that inspects whether the default user OpenSSH
+// config file includes VNet's generated SSH config file.
+type SSHDiag struct {
+	cfg              *SSHConfig
+	sshConfigChecker *SSHConfigChecker
+}
+
+// NewSSHDiag returns a new [SSHDiag].
+func NewSSHDiag(cfg *SSHConfig) (*SSHDiag, error) {
+	sshConfigChecker, err := NewSSHConfigChecker(cfg.ProfilePath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &SSHDiag{
+		cfg:              cfg,
+		sshConfigChecker: sshConfigChecker,
+	}, nil
+}
+
+// Commands returns no commands for this diagnostic.
+func (d *SSHDiag) Commands(ctx context.Context) []*exec.Cmd {
+	return nil
+}
+
+// EmptyCheckReport returns an empty SSH configuration report.
+func (d *SSHDiag) EmptyCheckReport() *diagv1.CheckReport {
+	return &diagv1.CheckReport{Report: &diagv1.CheckReport_SshConfigurationReport{}}
+}
+
+// Run runs the diagnostic.
+func (d *SSHDiag) Run(ctx context.Context) (*diagv1.CheckReport, error) {
+	report, err := d.run(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &diagv1.CheckReport{
+		// This intentionally always returns CHECK_REPORT_STATUS_OK even if
+		// ~/.ssh/config does not include the VNet generated SSH config. It is
+		// not mandatory to configure SSH and returning an error status would
+		// cause an alert and notification in Connect.
+		Status: diagv1.CheckReportStatus_CHECK_REPORT_STATUS_OK,
+		Report: &diagv1.CheckReport_SshConfigurationReport{
+			SshConfigurationReport: report,
+		},
+	}, nil
+}
+
+func (d *SSHDiag) run(ctx context.Context) (*diagv1.SSHConfigurationReport, error) {
+	userOpenSSHConfigContents, included, err := d.sshConfigChecker.OpenSSHConfigIncludesVNetSSHConfig()
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return &diagv1.SSHConfigurationReport{
+				UserOpensshConfigPath: d.sshConfigChecker.UserOpenSSHConfigPath,
+				VnetSshConfigPath:     d.sshConfigChecker.VNetSSHConfigPath,
+			}, nil
+		}
+		return nil, trace.Wrap(err)
+	}
+	if !utf8.Valid(userOpenSSHConfigContents) {
+		return nil, trace.Errorf("%s is not valid UTF-8", d.sshConfigChecker.UserOpenSSHConfigPath)
+	}
+	return &diagv1.SSHConfigurationReport{
+		UserOpensshConfigPath:                  d.sshConfigChecker.UserOpenSSHConfigPath,
+		VnetSshConfigPath:                      d.sshConfigChecker.VNetSSHConfigPath,
+		UserOpensshConfigIncludesVnetSshConfig: included,
+		UserOpensshConfigExists:                true,
+		UserOpensshConfigContents:              string(userOpenSSHConfigContents),
+	}, nil
+}
+
+// SSHConfigChecker checks the state of the user's SSH configuration.
+type SSHConfigChecker struct {
+	userHome              string
+	UserOpenSSHConfigPath string
+	VNetSSHConfigPath     string
+	isWindows             bool
+}
+
+// NewSSHConfigChecker returns a new SSHConfigChecker.
+func NewSSHConfigChecker(profilePath string) (*SSHConfigChecker, error) {
+	userHome, ok := profile.UserHomeDir()
+	if !ok {
+		return nil, trace.Errorf("unable to find user's home directory")
+	}
+	userOpenSSHConfigPath := filepath.Join(userHome, ".ssh", "config")
+	vnetSSHConfigPath := keypaths.VNetSSHConfigPath(profilePath)
+	return &SSHConfigChecker{
+		userHome:              userHome,
+		UserOpenSSHConfigPath: userOpenSSHConfigPath,
+		VNetSSHConfigPath:     vnetSSHConfigPath,
+		isWindows:             runtime.GOOS == constants.WindowsOS,
+	}, nil
+}
+
+// OpenSSHConfigIncludesVNetSSHConfig returns the current user OpenSSH
+// configuration file contents (~/.ssh/config) and a boolean indicating whether
+// it already includes VNet's generated OpenSSH-compatible configuration file.
+//
+// If ~/.ssh/config does not exist it returns a [trace.NotFoundError]
+func (c *SSHConfigChecker) OpenSSHConfigIncludesVNetSSHConfig() ([]byte, bool, error) {
+	userOpenSSHConfigFile, err := os.Open(c.UserOpenSSHConfigPath)
+	if err != nil {
+		return nil, false, trace.Wrap(trace.ConvertSystemError(err), "opening %s for reading", c.UserOpenSSHConfigPath)
+	}
+	defer userOpenSSHConfigFile.Close()
+
+	userOpenSSHConfigContents, err := io.ReadAll(io.LimitReader(userOpenSSHConfigFile, maxOpenSSHConfigFileSize))
+	if err != nil {
+		return nil, false, trace.Wrap(trace.ConvertSystemError(err), "reading %s", c.UserOpenSSHConfigPath)
+	}
+	if len(userOpenSSHConfigContents) == maxOpenSSHConfigFileSize {
+		return nil, false, trace.Errorf("%s is too large to read (max size %s)",
+			c.UserOpenSSHConfigPath, humanize.Bytes(maxOpenSSHConfigFileSize))
+	}
+
+	included, err := c.openSSHConfigIncludesVNetSSHConfig(bytes.NewReader(userOpenSSHConfigContents))
+	if err != nil {
+		return nil, false, trace.Wrap(err, "checking if the default user OpenSSH config includes VNet's SSH configuration")
+	}
+	return userOpenSSHConfigContents, included, nil
+}
+
+func (c *SSHConfigChecker) openSSHConfigIncludesVNetSSHConfig(r io.Reader) (bool, error) {
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		if c.openSSHConfigLineIncludesPath(scanner.Text(), c.VNetSSHConfigPath) {
+			return true, nil
+		}
+	}
+	return false, trace.Wrap(scanner.Err())
+}
+
+// openSSHConfigLineIncludesPath returns true if the given line of an OpenSSH
+// configuration file is an include statement for the given path.
+func (c *SSHConfigChecker) openSSHConfigLineIncludesPath(line, wantPath string) bool {
+	wantPath = c.normalizePath(wantPath)
+	line = strings.TrimSpace(line)
+
+	// Only consider lines that begin with "include" (case-insensitive).
+	i := strings.IndexFunc(line, isSpace)
+	if i == -1 {
+		return false
+	}
+	if strings.ToLower(line[:i]) != "include" {
+		return false
+	}
+	// Consider the rest of the line after "include".
+	line = line[i+1:]
+
+	// Include lines may specify multiple pathnames and each pathname may
+	// contain glob wildcards, tokens, environment variables, ~, escaped
+	// characters and may or may not be quoted. This function does not support
+	// glob wildcards, tokens, or environment variables. It splits each argument
+	// at unescaped and unquoted whitespace and if the argument matches wantPath
+	// returns true. It does support ~ as an alias for the user's home
+	// directory.
+	var (
+		// pathBuf is a running buffer holding the current argument as parsed up to
+		// the current point.
+		pathBuf strings.Builder
+		// quote holds the opening quote character if one has been found.
+		quote = byte(0)
+	)
+loop:
+	for i := 0; i < len(line); i++ {
+		b := line[i]
+		switch {
+		case b == '\\' && i < len(line)-1 && canBeEscaped(line[i+1]):
+			// Skip the escape char and write the next char literally.
+			i++
+			pathBuf.WriteByte(line[i])
+		case quote == 0 && (b == '"' || b == '\''):
+			// Start of quote
+			quote = b
+		case quote != 0 && b == quote:
+			// End of quote
+			quote = 0
+		case pathBuf.Len() == 0 && b == '~':
+			// Support ~ as an alias for the user's home directory.
+			pathBuf.WriteString(c.userHome)
+		case quote == 0 && b == '#':
+			// Found an unquoted comment in the middle of the line, ignore the rest.
+			break loop
+		case quote == 0 && isSpace(rune(b)):
+			// Reached the end of this argument, check if it matches wantPath.
+			if c.normalizePath(pathBuf.String()) == wantPath {
+				return true
+			}
+			pathBuf.Reset()
+		default:
+			// By default just append the current byte to the path.
+			pathBuf.WriteByte(b)
+		}
+	}
+	if quote != 0 {
+		// Unmatched quote.
+		return false
+	}
+	// Handle an argument that ends at the end of the line.
+	return c.normalizePath(pathBuf.String()) == wantPath
+}
+
+func (c *SSHConfigChecker) normalizePath(path string) string {
+	if c.isWindows {
+		// Normalize all paths to use unix-style separators since OpenSSH
+		// supports / or \\ on Windows.
+		path = strings.ReplaceAll(path, `\`, `/`)
+		// Windows paths are case-insensitive.
+		path = strings.ToLower(path)
+	}
+	return filepath.Clean(path)
+}
+
+func isSpace(r rune) bool {
+	switch r {
+	case ' ', '\t':
+		return true
+	}
+	return false
+}
+
+func canBeEscaped(c byte) bool {
+	// https://github.com/openssh/openssh-portable/blob/5f761cdb2331a12318bde24db5ca84ee144a51d1/misc.c#L2089-L2099
+	switch c {
+	case ' ', '\\', '\'', '"':
+		return true
+	}
+	return false
+}
diff --git a/lib/vnet/diag/ssh_test.go b/lib/vnet/diag/ssh_test.go
new file mode 100644
index 0000000000000..a152f38c1ac90
--- /dev/null
+++ b/lib/vnet/diag/ssh_test.go
@@ -0,0 +1,250 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package diag
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/utils/keypaths"
+	diagv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/diag/v1"
+)
+
+var sshDiagTestCases = []struct {
+	desc        string
+	profilePath string
+	userHome    string
+	isWindows   bool
+	input       string
+	expect      bool
+}{
+	{
+		desc:        "empty",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+	},
+	{
+		desc:        "macos tsh",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include /Users/user/.tsh/vnet_ssh_config`,
+		expect:      true,
+	},
+	{
+		desc:        "macos tsh ~",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include ~/.tsh/vnet_ssh_config`,
+		expect:      true,
+	},
+	{
+		desc:        "macos connect",
+		profilePath: `/Users/user/Application Support/Teleport Connect/tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include "/Users/user/Application Support/Teleport Connect/tsh/vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "macos connect ~",
+		profilePath: `/Users/user/Application Support/Teleport Connect/tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include "~/Application Support/Teleport Connect/tsh/vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "macos tsh not match connect",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include "/Users/user/Application Support/Teleport Connect/tsh/vnet_ssh_config"`,
+	},
+	{
+		desc:        "macos connect not match tsh",
+		profilePath: `/Users/user/Application Support/Teleport Connect/tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include /Users/user/.tsh/vnet_ssh_config`,
+	},
+	{
+		desc:        "windows tsh",
+		profilePath: `C:\Users\User\.tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\\Users\\User\\.tsh\\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows tsh unescaped",
+		profilePath: `C:\Users\User\.tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\Users\User\.tsh\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows tsh unix path",
+		profilePath: `C:\Users\User\.tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:/Users/User/.tsh/vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows tsh ~",
+		profilePath: `C:\Users\User\.tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "~\\.tsh\\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows connect",
+		profilePath: `C:\Users\User\AppData\Roaming\Teleport Connect\tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\\Users\\User\\AppData\\Roaming\\Teleport\ Connect\\tsh\\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows connect unescaped",
+		profilePath: `C:\Users\User\AppData\Roaming\Teleport Connect\tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\Users\User\AppData\Roaming\Teleport Connect\tsh\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows connect unix path",
+		profilePath: `C:\Users\User\AppData\Roaming\Teleport Connect\tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:/Users/User/AppData/Roaming/Teleport\ Connect/tsh/vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows connect ~",
+		profilePath: `C:\Users\User\AppData\Roaming\Teleport Connect\tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "~\\AppData\\Roaming\\Teleport\ Connect\\tsh\\vnet_ssh_config"`,
+		expect:      true,
+	},
+	{
+		desc:        "windows tsh not match connect",
+		profilePath: `C:\Users\User\.tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\\Users\\User\\AppData\\Roaming\\Teleport\ Connect\\tsh\\vnet_ssh_config"`,
+	},
+	{
+		desc:        "windows connect not match tsh",
+		profilePath: `C:\Users\User\AppData\Roaming\Teleport Connect\tsh`,
+		userHome:    `C:\Users\User`,
+		isWindows:   true,
+		input:       `Include "C:\\Users\\User\\.tsh\\vnet_ssh_config"`,
+	},
+	{
+		desc:        "some other file",
+		profilePath: `/Users/user/.tsh`,
+		input:       `Include /Users/user/.tsh/ssh_config`,
+	},
+	{
+		desc:        "multiple includes",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input: `
+Include ~/.ssh/include/*
+Include /Users/user/ssh_config
+Include /Users/user/.tsh/vnet_ssh_config
+`,
+		expect: true,
+	},
+	{
+		desc:        "commented",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include #/Users/user/.tsh/vnet_ssh_config`,
+	},
+	{
+		desc:        "single quotes",
+		profilePath: `/Users/user/.tsh`,
+		userHome:    `/Users/user`,
+		input:       `Include '/Users/user/.tsh/vnet_ssh_config'`,
+		expect:      true,
+	},
+}
+
+// TestSSHDiag tests the SSH configuration diagnostic, specifically its ability
+// to check whether an OpenSSH config file includes the VNet SSH config file.
+func TestSSHDiag(t *testing.T) {
+	t.Parallel()
+	for _, tc := range sshDiagTestCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			diag, err := NewSSHDiag(&SSHConfig{
+				ProfilePath: tc.profilePath,
+			})
+			require.NoError(t, err)
+			userOpenSSHConfigPath := filepath.Join(t.TempDir(), "test_ssh_config")
+
+			// Override isWindows and paths for the purpose of the test.
+			diag.sshConfigChecker.isWindows = tc.isWindows
+			diag.sshConfigChecker.userHome = tc.userHome
+			diag.sshConfigChecker.UserOpenSSHConfigPath = userOpenSSHConfigPath
+
+			if len(tc.input) > 0 {
+				require.NoError(t, os.WriteFile(userOpenSSHConfigPath, []byte(tc.input), 0o600))
+			}
+
+			expectReport := &diagv1.CheckReport{
+				Status: diagv1.CheckReportStatus_CHECK_REPORT_STATUS_OK,
+				Report: &diagv1.CheckReport_SshConfigurationReport{
+					SshConfigurationReport: &diagv1.SSHConfigurationReport{
+						UserOpensshConfigPath:                  userOpenSSHConfigPath,
+						VnetSshConfigPath:                      keypaths.VNetSSHConfigPath(tc.profilePath),
+						UserOpensshConfigIncludesVnetSshConfig: tc.expect,
+						UserOpensshConfigExists:                len(tc.input) > 0,
+						UserOpensshConfigContents:              tc.input,
+					},
+				},
+			}
+
+			report, err := diag.Run(t.Context())
+			require.NoError(t, err)
+			require.Equal(t, expectReport, report)
+		})
+	}
+}
+
+// FuzzOpenSSHConfigIncludesPath fuzzes [SSHConfigChecker.openSSHConfigIncludesVNetSSHConfig]
+// to make sure it won't panic on arbitrary input.
+func FuzzOpenSSHConfigIncludesPath(f *testing.F) {
+	// Add all test cases as the base test corpus.
+	for _, tc := range sshDiagTestCases {
+		f.Add(tc.isWindows, tc.profilePath, tc.input)
+	}
+	f.Fuzz(func(t *testing.T, isWindows bool, profilePath, input string) {
+		vnetSSHConfigPath := keypaths.VNetSSHConfigPath(profilePath)
+		sshConfigChecker := &SSHConfigChecker{
+			VNetSSHConfigPath: vnetSSHConfigPath,
+			isWindows:         isWindows,
+		}
+		// Can't deterministically check the result for fuzzed inputs but it shouldn't panic.
+		sshConfigChecker.openSSHConfigIncludesVNetSSHConfig(strings.NewReader(input))
+	})
+}
diff --git a/lib/vnet/dns/dns_test.go b/lib/vnet/dns/dns_test.go
index 81f0bf33cc8b6..9d981c977dd03 100644
--- a/lib/vnet/dns/dns_test.go
+++ b/lib/vnet/dns/dns_test.go
@@ -29,6 +29,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 var (
@@ -63,7 +64,7 @@ func TestServer(t *testing.T) {
 		conn, err := net.ListenUDP("udp", udpLocalhost)
 		require.NoError(t, err)
 
-		utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+		testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 			Name: fmt.Sprintf("upstream nameserver %d", i),
 			Task: func(ctx context.Context) error {
 				err := upstreamServer.ListenAndServeUDP(ctx, conn)
@@ -113,7 +114,7 @@ func TestServer(t *testing.T) {
 	conn, err := net.ListenUDP("udp", udpLocalhost)
 	require.NoError(t, err)
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "nameserver under test",
 		Task: func(ctx context.Context) error {
 			err := server.ListenAndServeUDP(ctx, conn)
diff --git a/lib/vnet/dns/osnameservers_darwin_test.go b/lib/vnet/dns/osnameservers_darwin_test.go
index 1c14a4aaa32a1..c33df777bef67 100644
--- a/lib/vnet/dns/osnameservers_darwin_test.go
+++ b/lib/vnet/dns/osnameservers_darwin_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 // TestOSUpstreamNameservers configures the DNS server to forward requests for all addresses to the OS's real
@@ -46,7 +47,7 @@ func TestOSUpstreamNameservers(t *testing.T) {
 	conn, err := net.ListenUDP("udp", udpLocalhost)
 	require.NoError(t, err)
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "nameserver",
 		Task: func(ctx context.Context) error {
 			err := server.ListenAndServeUDP(ctx, conn)
diff --git a/lib/vnet/fqdn_resolver.go b/lib/vnet/fqdn_resolver.go
index 553cf97e1ebbf..cce5c910a02a8 100644
--- a/lib/vnet/fqdn_resolver.go
+++ b/lib/vnet/fqdn_resolver.go
@@ -146,7 +146,7 @@ func (r *fqdnResolver) clusterClientForAppFQDN(ctx context.Context, profileName,
 			log.ErrorContext(ctx, "Failed to get VNet config, apps in this cluster will not be resolved.", "profile", profileName, "leaf_cluster", leafClusterName, "error", err)
 			continue
 		}
-		for _, zone := range clusterConfig.DNSZones {
+		for _, zone := range clusterConfig.appDNSZones() {
 			if isDescendantSubdomain(fqdn, zone) {
 				return clusterClient, nil
 			}
@@ -226,11 +226,12 @@ func (r *fqdnResolver) resolveAppInfoForCluster(
 	}, nil
 }
 
-// VNet SSH handles SSH hostnames matching "<hostname>.<cluster_name>." or
-// "<hostname>.<leaf_cluster_name>.<cluster_name>.". tryResolveSSH checks if
-// fqdn matches that pattern for any logged-in cluster and if so returns a
-// match. We never actually query for whether or not a matching SSH node exists,
-// we just attempt to dial it when the client connects to the assigned IP.
+// VNet SSH handles SSH hostnames matching "<hostname>.<cluster_name>.", where
+// the <cluster-name> may be the name of a root or leaf cluster.
+// tryResolveSSH checks if fqdn matches that pattern for any known cluster
+// and if so returns a match. We never actually query for whether or not a
+// matching SSH node exists, we just attempt to dial it when the client
+// connects to the assigned IP.
 func (r *fqdnResolver) tryResolveSSH(ctx context.Context, profileNames []string, fqdn string) (*vnetv1.ResolveFQDNResponse, error) {
 	for _, profileName := range profileNames {
 		log := log.With("profile", profileName)
@@ -240,23 +241,21 @@ func (r *fqdnResolver) tryResolveSSH(ctx context.Context, profileNames []string,
 			continue
 		}
 		rootClusterName := rootClient.ClusterName()
-		if !isDescendantSubdomain(fqdn, rootClusterName) {
-			continue
-		}
+		log = log.With("root_cluster", rootClusterName)
 		leafClusters, err := r.cfg.leafClusterCache.getLeafClusters(ctx, rootClient)
 		if err != nil {
 			// Good chance we're here because the user is not logged in to the profile.
 			log.ErrorContext(ctx, "Failed to list leaf clusters, SSH nodes in this cluster will not be resolved", "error", err)
-			return nil, errNoMatch
+			continue
 		}
 		rootDialOpts, err := r.cfg.clientApplication.GetDialOptions(ctx, profileName)
 		if err != nil {
 			log.ErrorContext(ctx, "Failed to get cluster dial options, SSH nodes in this cluster will not be resolved", "error", err)
-			return nil, errNoMatch
+			continue
 		}
 		for _, leafClusterName := range leafClusters {
 			log := log.With("leaf_cluster", leafClusterName)
-			if !isDescendantSubdomain(fqdn, leafClusterName+"."+rootClusterName) {
+			if !isDescendantSubdomain(fqdn, leafClusterName) {
 				continue
 			}
 			leafClient, err := r.cfg.clientApplication.GetCachedClient(ctx, profileName, leafClusterName)
@@ -275,12 +274,17 @@ func (r *fqdnResolver) tryResolveSSH(ctx context.Context, profileNames []string,
 					MatchedCluster: &vnetv1.MatchedCluster{
 						WebProxyAddr:  rootDialOpts.GetWebProxyAddr(),
 						Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
+						Profile:       profileName,
+						RootCluster:   rootClusterName,
+						LeafCluster:   leafClusterName,
 					},
 				},
 			}, nil
 		}
-		// If it didn't match any leaf cluster assume it matches the root
-		// cluster.
+		// Didn't match any leaf, check if it's in the root cluster.
+		if !isDescendantSubdomain(fqdn, rootClusterName) {
+			continue
+		}
 		clusterConfig, err := r.cfg.clusterConfigCache.GetClusterConfig(ctx, rootClient)
 		if err != nil {
 			log.ErrorContext(ctx, "Failed to get VNet config, SSH nodes in this cluster will not be resolved", "error", err)
@@ -292,6 +296,8 @@ func (r *fqdnResolver) tryResolveSSH(ctx context.Context, profileNames []string,
 				MatchedCluster: &vnetv1.MatchedCluster{
 					WebProxyAddr:  rootDialOpts.GetWebProxyAddr(),
 					Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
+					Profile:       profileName,
+					RootCluster:   rootClusterName,
 				},
 			},
 		}, nil
diff --git a/lib/vnet/local_osconfig_provider.go b/lib/vnet/local_osconfig_provider.go
deleted file mode 100644
index 0e54b8d522855..0000000000000
--- a/lib/vnet/local_osconfig_provider.go
+++ /dev/null
@@ -1,119 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package vnet
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/utils"
-	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
-)
-
-// LocalOSConfigProvider fetches target OS configuration parameters.
-// Its methods get exposed by [clientApplicationService] so that
-// [remoteOSConfigProvider] can be implemented by calling these methods from the
-// VNet admin process.
-type LocalOSConfigProvider struct {
-	cfg *LocalOSConfigProviderConfig
-}
-
-// LocalOSConfigProviderConfig holds configuration parameters for
-// LocalOSConfigProvider.
-type LocalOSConfigProviderConfig struct {
-	clientApplication  ClientApplication
-	clusterConfigCache *ClusterConfigCache
-	leafClusterCache   *leafClusterCache
-}
-
-// NewLocalOSConfigProvider returns a new LocalOSConfigProvider.
-func NewLocalOSConfigProvider(cfg *LocalOSConfigProviderConfig) *LocalOSConfigProvider {
-	return &LocalOSConfigProvider{
-		cfg: cfg,
-	}
-}
-
-// GetTargetOSConfiguration returns the configuration values that should be
-// configured in the OS, including DNS zones that should be handled by the VNet
-// DNS nameserver and the IPv4 CIDR ranges that should be routed to the VNet TUN
-// interface. This is not all of the OS configuration values, only the ones that
-// must be communicated from the client application to the admin process.
-func (p *LocalOSConfigProvider) GetTargetOSConfiguration(ctx context.Context) (*vnetv1.TargetOSConfiguration, error) {
-	profiles, err := p.cfg.clientApplication.ListProfiles()
-	if err != nil {
-		return nil, trace.Wrap(err, "listing profiles")
-	}
-	var targetOSConfig vnetv1.TargetOSConfiguration
-	for _, profileName := range profiles {
-		profileTargetConfig := p.targetOSConfigurationForProfile(ctx, profileName)
-		targetOSConfig.DnsZones = append(targetOSConfig.DnsZones, profileTargetConfig.DnsZones...)
-		targetOSConfig.Ipv4CidrRanges = append(targetOSConfig.Ipv4CidrRanges, profileTargetConfig.Ipv4CidrRanges...)
-	}
-	targetOSConfig.DnsZones = utils.Deduplicate(targetOSConfig.DnsZones)
-	targetOSConfig.Ipv4CidrRanges = utils.Deduplicate(targetOSConfig.Ipv4CidrRanges)
-	return &targetOSConfig, nil
-}
-
-// targetOSConfigurationForProfile does not return errors, it is better to
-// configure VNet for any working profiles and log errors for failures.
-func (p *LocalOSConfigProvider) targetOSConfigurationForProfile(ctx context.Context, profileName string) *vnetv1.TargetOSConfiguration {
-	targetOSConfig := &vnetv1.TargetOSConfiguration{}
-	rootClusterClient, err := p.cfg.clientApplication.GetCachedClient(ctx, profileName, "" /*leafClusterName*/)
-	if err != nil {
-		log.WarnContext(ctx,
-			"Failed to get root cluster client from cache, profile may be expired, not configuring VNet for this cluster",
-			"profile", profileName, "error", err)
-		return targetOSConfig
-	}
-	rootClusterConfig, err := p.cfg.clusterConfigCache.GetClusterConfig(ctx, rootClusterClient)
-	if err != nil {
-		log.WarnContext(ctx,
-			"Failed to load VNet configuration, profile may be expired, not configuring VNet for this cluster",
-			"profile", profileName, "error", err)
-		return targetOSConfig
-	}
-	targetOSConfig.DnsZones = rootClusterConfig.DNSZones
-	targetOSConfig.Ipv4CidrRanges = []string{rootClusterConfig.IPv4CIDRRange}
-
-	leafClusterNames, err := p.cfg.leafClusterCache.getLeafClusters(ctx, rootClusterClient)
-	if err != nil {
-		log.WarnContext(ctx,
-			"Failed to list leaf clusters, profile may be expired, not configuring VNet for leaf clusters of this cluster",
-			"profile", profileName, "error", err)
-		return targetOSConfig
-	}
-	for _, leafClusterName := range leafClusterNames {
-		leafClusterClient, err := p.cfg.clientApplication.GetCachedClient(ctx, profileName, leafClusterName)
-		if err != nil {
-			log.WarnContext(ctx,
-				"Failed to create leaf cluster client, not configuring VNet for this cluster",
-				"profile", profileName, "leaf_cluster", leafClusterName, "error", err)
-			return targetOSConfig
-		}
-		leafClusterConfig, err := p.cfg.clusterConfigCache.GetClusterConfig(ctx, leafClusterClient)
-		if err != nil {
-			log.WarnContext(ctx,
-				"Failed to load VNet configuration, not configuring VNet for this cluster",
-				"profile", profileName, "leaf_cluster", leafClusterName, "error", err)
-			return targetOSConfig
-		}
-		targetOSConfig.DnsZones = append(targetOSConfig.DnsZones, leafClusterConfig.DNSZones...)
-		targetOSConfig.Ipv4CidrRanges = append(targetOSConfig.Ipv4CidrRanges, leafClusterConfig.IPv4CIDRRange)
-	}
-	return targetOSConfig
-}
diff --git a/lib/vnet/network_stack.go b/lib/vnet/network_stack.go
index 25256b4a4eb59..b2bf30d67d9fa 100644
--- a/lib/vnet/network_stack.go
+++ b/lib/vnet/network_stack.go
@@ -158,6 +158,10 @@ type networkStack struct {
 	// ipv6Prefix holds the 96-bit prefix that will be used for all IPv6 addresses assigned in the VNet.
 	ipv6Prefix tcpip.Address
 
+	// dnsServer is the VNet's local DNS server that can handle UDP DNS
+	// requests.
+	dnsServer *dns.Server
+
 	// tcpHandlerResolver resolves FQDNs to a TCP handler that will be used to handle all future TCP
 	// connections to IP addresses that will be assigned to that FQDN.
 	tcpHandlerResolver *tcpHandlerResolver
@@ -233,6 +237,19 @@ func newNetworkStack(cfg *networkStackConfig) (*networkStack, error) {
 		slog:               slog,
 	}
 
+	upstreamNameserverSource := cfg.upstreamNameserverSource
+	if upstreamNameserverSource == nil {
+		upstreamNameserverSource, err = dns.NewOSUpstreamNameserverSource()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+	dnsServer, err := dns.NewServer(ns, upstreamNameserverSource)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	ns.dnsServer = dnsServer
+
 	tcpForwarder := tcp.NewForwarder(ns.stack, tcpReceiveBufferSize, maxInFlightTCPConnectionAttempts, ns.handleTCP)
 	ns.stack.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
 
@@ -240,17 +257,6 @@ func newNetworkStack(cfg *networkStackConfig) (*networkStack, error) {
 	ns.stack.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)
 
 	if cfg.dnsIPv6 != (tcpip.Address{}) {
-		upstreamNameserverSource := cfg.upstreamNameserverSource
-		if upstreamNameserverSource == nil {
-			upstreamNameserverSource, err = dns.NewOSUpstreamNameserverSource()
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-		}
-		dnsServer, err := dns.NewServer(ns, upstreamNameserverSource)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
 		if err := ns.assignUDPHandler(cfg.dnsIPv6, dnsServer); err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -322,13 +328,16 @@ func (ns *networkStack) run(ctx context.Context) error {
 		// When the context is canceled for any reason (the caller or one of the other concurrent tasks may
 		// have canceled it) destroy everything and quit.
 		<-ctx.Done()
+		ns.slog.InfoContext(ctx, "Context canceled, beginning network stack shutdown.")
 
 		// In-flight connections should start terminating after closing [ns.destroyed].
 		close(ns.destroyed)
 
 		// Close the link endpoint and the TUN, this should cause [forwardBetweenTunAndNetstack] to terminate
 		// if it hasn't already.
+		ns.slog.InfoContext(ctx, "Closing link endpoint.")
 		ns.linkEndpoint.Close()
+		ns.slog.InfoContext(ctx, "Closing TUN device.")
 		err := trace.Wrap(ns.tun.Close(), "closing TUN device")
 
 		allErrors <- err
@@ -339,9 +348,11 @@ func (ns *networkStack) run(ctx context.Context) error {
 	_ = g.Wait()
 
 	// Wait for all connections and goroutines to clean themselves up.
+	ns.slog.InfoContext(ctx, "Waiting for all connections and goroutines to clean up.")
 	ns.wg.Wait()
 
 	// Now we can destroy the gVisor networking stack and wait for all its goroutines to terminate.
+	ns.slog.InfoContext(ctx, "Destroying networking stack.")
 	ns.stack.Destroy()
 
 	close(allErrors)
@@ -542,6 +553,13 @@ func (ns *networkStack) assignUDPHandler(addr tcpip.Address, handler udpHandler)
 	return nil
 }
 
+// addDNSAddress adds a DNS handler at the given IP.
+func (ns *networkStack) addDNSAddress(ip net.IP) error {
+	slog.DebugContext(context.Background(), "Serving DNS on IPv4.", "dns_addr", ip.String())
+	return trace.Wrap(ns.assignUDPHandler(tcpip.AddrFromSlice(ip), ns.dnsServer),
+		"adding UDP handler at %s", ip.String())
+}
+
 // ResolveA implements [dns.Resolver.ResolveA].
 func (ns *networkStack) ResolveA(ctx context.Context, fqdn string) (dns.Result, error) {
 	// Do the actual resolution within a [singleflight.Group] keyed by [fqdn] to avoid concurrent requests to
@@ -607,7 +625,9 @@ func forwardBetweenTunAndNetstack(ctx context.Context, tun tunDevice, linkEndpoi
 	g, ctx := errgroup.WithContext(ctx)
 	g.Go(func() error { return forwardNetstackToTUN(ctx, linkEndpoint, tun) })
 	g.Go(func() error { return forwardTUNtoNetstack(ctx, tun, linkEndpoint) })
-	return trace.Wrap(g.Wait())
+	err := g.Wait()
+	slog.DebugContext(ctx, "Finished forwarding IP packets between OS and VNet.")
+	return trace.Wrap(err)
 }
 
 func forwardNetstackToTUN(ctx context.Context, linkEndpoint *channel.Endpoint, tun tunDevice) error {
diff --git a/lib/vnet/opensshconfig.go b/lib/vnet/opensshconfig.go
new file mode 100644
index 0000000000000..7a3fcd52dc195
--- /dev/null
+++ b/lib/vnet/opensshconfig.go
@@ -0,0 +1,365 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"text/template"
+	"time"
+
+	renameio "github.com/google/renameio/v2/maybe" // Writes aren't guaranteed to be atomic on Windows.
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keypaths"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	libutils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/vnet/diag"
+)
+
+const (
+	filePerms                      os.FileMode = 0o600
+	sshConfigurationUpdateInterval             = 30 * time.Second
+)
+
+// writeSSHKeys writes hostCAKey to ${TELEPORT_HOME}/vnet_known_hosts so that
+// third-party SSH clients can trust it. It then reads or generates
+// ${TELEPORT_HOME}/id_vnet(.pub) which SSH clients should be configured to use
+// for connections to VNet SSH. It returns id_vnet.pub so that VNet SSH can
+// trust it for incoming connections.
+func writeSSHKeys(homePath string, hostCAKey ssh.PublicKey) (ssh.PublicKey, error) {
+	profilePath := fullProfilePath(homePath)
+	if err := writeKnownHosts(profilePath, hostCAKey); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	userPubKey, err := readUserPubKey(profilePath)
+	if trace.IsNotFound(err) {
+		userPubKey, err = generateAndWriteUserKey(profilePath)
+	}
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return userPubKey, nil
+}
+
+func fullProfilePath(homePath string) string {
+	if homePath == "" {
+		if homeDir := os.Getenv(types.HomeEnvVar); homeDir != "" {
+			homePath = filepath.Clean(homeDir)
+		}
+	}
+	return profile.FullProfilePath(homePath)
+}
+
+func writeKnownHosts(profilePath string, hostCAKey ssh.PublicKey) error {
+	// MarshalAuthorizedKey serializes the key for inclusion in an
+	// authorized_keys file, we need to add the @cert-authority prefix and the
+	// wildcard so this CA is trusted for all hosts. The SSH configuration file
+	// should only load this vnet_known_hosts file for hosts matching
+	// appropriate subdomains, there is no need to keep that list of domains
+	// updated in both the SSH config file and the vnet_known_hosts file.
+	authorizedKey := ssh.MarshalAuthorizedKey(hostCAKey)
+	authorizedCA := "@cert-authority * " + string(authorizedKey)
+	p := keypaths.VNetKnownHostsPath(profilePath)
+	err := renameio.WriteFile(p, []byte(authorizedCA), filePerms)
+	return trace.Wrap(trace.ConvertSystemError(err), "writing host CA to %s", p)
+}
+
+func readUserPubKey(profilePath string) (ssh.PublicKey, error) {
+	p := keypaths.VNetClientSSHKeyPubPath(profilePath)
+	f, err := os.Open(p)
+	if err != nil {
+		return nil, trace.Wrap(trace.ConvertSystemError(err), "opening %s for reading", p)
+	}
+	defer f.Close()
+	const maxPubKeyFileSize = 10000 // RSA 4096 pub key files are ~750 bytes, ~10x to be safe.
+	pubKeyBytes, err := io.ReadAll(io.LimitReader(f, maxPubKeyFileSize))
+	if err != nil {
+		return nil, trace.Wrap(trace.ConvertSystemError(err), "reading user public key from %s", p)
+	}
+	userPubKey, _, _, _, err := ssh.ParseAuthorizedKey(pubKeyBytes)
+	return userPubKey, trace.Wrap(err, "parsing user public key from %s", p)
+}
+
+func generateAndWriteUserKey(profilePath string) (ssh.PublicKey, error) {
+	userKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating SSH user key")
+	}
+
+	privPemBlock, err := ssh.MarshalPrivateKey(userKey, "")
+	if err != nil {
+		return nil, trace.Wrap(err, "marshaling SSH user key")
+	}
+	privKeyBytes := pem.EncodeToMemory(privPemBlock)
+	privKeyPath := keypaths.VNetClientSSHKeyPath(profilePath)
+	if err := renameio.WriteFile(privKeyPath, privKeyBytes, filePerms); err != nil {
+		return nil, trace.Wrap(trace.ConvertSystemError(err), "writing user private key to %s", privKeyPath)
+	}
+
+	userPubKey, err := ssh.NewPublicKey(userKey.Public())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	pubKeyPath := keypaths.VNetClientSSHKeyPubPath(profilePath)
+	if err := renameio.WriteFile(pubKeyPath, ssh.MarshalAuthorizedKey(userPubKey), filePerms); err != nil {
+		return nil, trace.Wrap(trace.ConvertSystemError(err), "writing user public key to %s", pubKeyPath)
+	}
+	return userPubKey, nil
+}
+
+// sshConfigurator writes an OpenSSH-compatible config file to
+// TELEPORT_HOME/vnet_ssh_config, and keeps it up to date with the list of
+// clusters that should match.
+type sshConfigurator struct {
+	cfg         sshConfiguratorConfig
+	profilePath string
+	clock       clockwork.Clock
+}
+
+type sshConfiguratorConfig struct {
+	clientApplication ClientApplication
+	leafClusterCache  *leafClusterCache
+	homePath          string
+	clock             clockwork.Clock
+}
+
+func newSSHConfigurator(cfg sshConfiguratorConfig) *sshConfigurator {
+	return &sshConfigurator{
+		cfg:         cfg,
+		profilePath: fullProfilePath(cfg.homePath),
+		clock:       cmp.Or(cfg.clock, clockwork.NewRealClock()),
+	}
+}
+
+func (c *sshConfigurator) runConfigurationLoop(ctx context.Context) error {
+	if err := c.updateSSHConfiguration(ctx); err != nil {
+		return trace.Wrap(err, "generating vnet_ssh_config")
+	}
+	// Delete the configuration file before exiting, if it is imported by the
+	// default SSH config file it will just stop taking effect.
+	defer func() {
+		if err := deleteSSHConfigFile(c.profilePath); err != nil {
+			log.WarnContext(ctx, "Failed to delete vnet_ssh_config while shutting down", "error", err)
+		}
+	}()
+	// clock.After is intentionally used in the loop instead of a ticker simply
+	// for more reliable testing. In the test I use clock.BlockUntilContext(1)
+	// to block until the loop is stuck waiting on the clock. If I used
+	// clock.NewTicker instead, the ticker always counts as a waiter, and that
+	// strategy doesn't work. In go 1.25 we can use testing/synctest instead.
+	for {
+		select {
+		case <-c.clock.After(sshConfigurationUpdateInterval):
+			if err := c.updateSSHConfiguration(ctx); err != nil {
+				return trace.Wrap(err, "updating vnet_ssh_config")
+			}
+		case <-ctx.Done():
+			return trace.Wrap(ctx.Err(), "context canceled, shutting down vnet_ssh_config update loop")
+		}
+	}
+}
+
+func (c *sshConfigurator) updateSSHConfiguration(ctx context.Context) error {
+	profileNames, err := c.cfg.clientApplication.ListProfiles()
+	if err != nil {
+		return trace.Wrap(err, "listing profiles")
+	}
+	// Build a set of unique cluster names for all active clusters.
+	clusterNames := make(map[string]struct{})
+	for _, profileName := range profileNames {
+		rootClient, err := c.cfg.clientApplication.GetCachedClient(ctx, profileName, "" /*leafClusterName*/)
+		if err != nil {
+			log.WarnContext(ctx,
+				"Failed to get root cluster client from cache, profile may be expired, not configuring VNet SSH for this cluster",
+				"profile", profileName, "error", err)
+			continue
+		}
+		clusterNames[rootClient.RootClusterName()] = struct{}{}
+		leafClusters, err := c.cfg.leafClusterCache.getLeafClusters(ctx, rootClient)
+		if err != nil {
+			log.WarnContext(ctx,
+				"Failed to list leaf clusters, not configuring VNet SSH for leaf clusters of this cluster",
+				"root_cluster", rootClient.ClusterName(), "error", err)
+			continue
+		}
+		for _, leafCluster := range leafClusters {
+			clusterNames[leafCluster] = struct{}{}
+		}
+	}
+	return trace.Wrap(writeSSHConfigFile(c.profilePath, clusterNames))
+}
+
+func deleteSSHConfigFile(profilePath string) error {
+	p := keypaths.VNetSSHConfigPath(profilePath)
+	if err := os.Remove(p); err != nil {
+		err = trace.ConvertSystemError(err)
+		if trace.IsNotFound(err) {
+			return nil
+		}
+		return trace.Wrap(err, "deleting %s", p)
+	}
+	return nil
+}
+
+func writeSSHConfigFile(profilePath string, clusterNames map[string]struct{}) error {
+	var b bytes.Buffer
+	b.WriteString(generatedFileHeader)
+	if len(clusterNames) == 0 {
+		// Avoid writing the Host block if there are no clusters to match.
+		b.WriteString("# VNet currently detects no logged-in clusters, log in to start using VNet\n")
+	} else {
+		hosts := strings.Join(hostMatchers(clusterNames), " ")
+		if err := configFileTemplate.Execute(&b, configFileTemplateInput{
+			Hosts:          hosts,
+			PrivateKeyPath: strconv.Quote(keypaths.VNetClientSSHKeyPath(profilePath)),
+			KnownHostsPath: strconv.Quote(keypaths.VNetKnownHostsPath(profilePath)),
+		}); err != nil {
+			return trace.Wrap(err, "generating SSH config file")
+		}
+	}
+	p := keypaths.VNetSSHConfigPath(profilePath)
+	err := renameio.WriteFile(p, b.Bytes(), filePerms)
+	return trace.Wrap(trace.ConvertSystemError(err), "writing SSH config file to %s", p)
+}
+
+// hostMatchers returns a sorted list of host matchers for a given set of
+// cluster names.
+func hostMatchers(clusterNames map[string]struct{}) []string {
+	sortedClusterNames := slices.Sorted(maps.Keys(clusterNames))
+	matchers := make([]string, 0, len(sortedClusterNames))
+	for _, clusterName := range sortedClusterNames {
+		matchers = append(matchers, hostMatcher(clusterName))
+	}
+	return matchers
+}
+
+func hostMatcher(clusterName string) string {
+	return "*." + strings.Trim(clusterName, ".")
+}
+
+const generatedFileHeader = `# ---------------------------------------------------------------------
+# THIS FILE IS AUTOMATICALLY GENERATED BY TELEPORT VNET. DO NOT EDIT.
+# Your changes will be overwritten the next time the file is generated.
+# ---------------------------------------------------------------------
+
+`
+
+var configFileTemplate = template.Must(template.New("vnet_ssh_config").
+	Parse(`Host {{ .Hosts }}
+    IdentityFile {{ .PrivateKeyPath }}
+    GlobalKnownHostsFile {{ .KnownHostsPath }}
+    UserKnownHostsFile /dev/null
+    StrictHostKeyChecking yes
+    IdentitiesOnly yes
+`))
+
+type configFileTemplateInput struct {
+	Hosts          string
+	PrivateKeyPath string
+	KnownHostsPath string
+}
+
+type autoConfigureOpenSSHOptions struct {
+	overrideUserSSHConfigPath string
+}
+type autoConfigureOpenSSHOption func(*autoConfigureOpenSSHOptions)
+
+func withUserSSHConfigPathOverride(path string) autoConfigureOpenSSHOption {
+	return func(opts *autoConfigureOpenSSHOptions) {
+		opts.overrideUserSSHConfigPath = path
+	}
+}
+
+// AutoConfigureOpenSSH adds an Include directive to the default user OpenSSH
+// config file (~/.ssh/config) to include the vnet_ssh_config file found under
+// profilePath.
+func AutoConfigureOpenSSH(ctx context.Context, profilePath string, opts ...autoConfigureOpenSSHOption) (err error) {
+	var options autoConfigureOpenSSHOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	sshConfigChecker, err := diag.NewSSHConfigChecker(profilePath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if options.overrideUserSSHConfigPath != "" {
+		sshConfigChecker.UserOpenSSHConfigPath = options.overrideUserSSHConfigPath
+	}
+
+	// Create ~/.ssh if it does not exist yet.
+	err = trace.ConvertSystemError(os.Mkdir(
+		filepath.Dir(sshConfigChecker.UserOpenSSHConfigPath), os.FileMode(0o700)))
+	switch {
+	case trace.IsAlreadyExists(err):
+		// This is fine/expected.
+	case err != nil:
+		return trace.Wrap(err, "creating directory for %s", sshConfigChecker.UserOpenSSHConfigPath)
+	}
+
+	// There should not be much lock contention on this file and it's okay if
+	// this fails so just try once to grab the lock.
+	unlock, err := libutils.FSTryWriteLock(sshConfigChecker.UserOpenSSHConfigPath)
+	if err != nil {
+		return trace.Wrap(err, "getting write lock for %s", sshConfigChecker.UserOpenSSHConfigPath)
+	}
+	defer func() {
+		unlockErr := unlock()
+		err = trace.NewAggregate(err, trace.Wrap(unlockErr, "unlocking %s", sshConfigChecker.UserOpenSSHConfigPath))
+	}()
+
+	currentContents, alreadyIncluded, err := sshConfigChecker.OpenSSHConfigIncludesVNetSSHConfig()
+	switch {
+	case trace.IsNotFound(err):
+		// This is fine, the file will be created with a single include.
+	case err != nil:
+		return trace.Wrap(err)
+	case alreadyIncluded:
+		return trace.AlreadyExists("%s is already included in %s",
+			sshConfigChecker.VNetSSHConfigPath, sshConfigChecker.UserOpenSSHConfigPath)
+	}
+
+	// Add the include at the top of the file for 2 reasons:
+	// - options set first take precedence over options set later in the file
+	// - if the include line is added after an existing Host block it will only
+	//   be included if the host block matches
+	var newContents bytes.Buffer
+	fmt.Fprintf(&newContents, `# Include Teleport VNet generated configuration
+Include "%s"
+
+`, sshConfigChecker.VNetSSHConfigPath)
+	newContents.Write(currentContents)
+
+	err = renameio.WriteFile(sshConfigChecker.UserOpenSSHConfigPath, newContents.Bytes(), filePerms)
+	return trace.Wrap(trace.ConvertSystemError(err), "writing to %s", sshConfigChecker.UserOpenSSHConfigPath)
+}
diff --git a/lib/vnet/opensshconfig_test.go b/lib/vnet/opensshconfig_test.go
new file mode 100644
index 0000000000000..7557743c796e2
--- /dev/null
+++ b/lib/vnet/opensshconfig_test.go
@@ -0,0 +1,217 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/utils/keypaths"
+)
+
+func TestSSHConfigurator(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	homePath := t.TempDir()
+
+	// This test gives a fake clock only to the SSH configurator and a real
+	// clock to everything else, so that fakeClock.BlockUntilContext will
+	// reliably only capture the SSH configuration loop and nothing else.
+	fakeClock := clockwork.NewFakeClockAt(time.Now())
+	realClock := clockwork.NewRealClock()
+
+	fakeClientApp := newFakeClientApp(ctx, t, &fakeClientAppConfig{
+		clusters: map[string]testClusterSpec{
+			"cluster1": {
+				leafClusters: map[string]testClusterSpec{
+					"leaf1": {},
+				},
+			},
+			"cluster2": {},
+		},
+		clock: realClock,
+	})
+	leafClusterCache, err := newLeafClusterCache(realClock)
+	require.NoError(t, err)
+
+	c := newSSHConfigurator(sshConfiguratorConfig{
+		clientApplication: fakeClientApp,
+		leafClusterCache:  leafClusterCache,
+		homePath:          homePath,
+		clock:             fakeClock,
+	})
+	errC := make(chan error)
+	go func() {
+		errC <- c.runConfigurationLoop(ctx)
+	}()
+
+	// Intentionally not using the template defined in the production code to
+	// test that it actually produces output that looks like this.
+	expectedConfigFile := func(expectedHosts string) string {
+		if expectedHosts == "" {
+			return generatedFileHeader + "# VNet currently detects no logged-in clusters, log in to start using VNet\n"
+		}
+		return generatedFileHeader + fmt.Sprintf(`Host %s
+    IdentityFile "%s/id_vnet"
+    GlobalKnownHostsFile "%s/vnet_known_hosts"
+    UserKnownHostsFile /dev/null
+    StrictHostKeyChecking yes
+    IdentitiesOnly yes
+`,
+			expectedHosts,
+			homePath, homePath)
+	}
+
+	assertConfigFile := func(expectedHosts string) {
+		t.Helper()
+		expected := expectedConfigFile(expectedHosts)
+		contents, err := os.ReadFile(keypaths.VNetSSHConfigPath(homePath))
+		require.NoError(t, err)
+		require.Equal(t, expected, string(contents))
+	}
+
+	// Wait until the configurator has had a chance to write the initial config
+	// file and then get blocked in the loop.
+	fakeClock.BlockUntilContext(ctx, 1)
+	// Assert the config file contains both root clusters reported by
+	// fakeClientApp.
+	assertConfigFile("*.cluster1 *.cluster2 *.leaf1")
+
+	// To reliably advance the clock and allow runConfigurationLoop to update
+	// the config the test waits until the loop is blocked on the clock, then
+	// advances the clock, then waits until the loop is blocked again.
+	advance := func() {
+		fakeClock.BlockUntilContext(ctx, 1)
+		fakeClock.Advance(sshConfigurationUpdateInterval)
+		fakeClock.BlockUntilContext(ctx, 1)
+	}
+
+	// Add a new root and leaf cluster, allow the configuration loop to run,
+	// and then assert that the new clusters are in the config file.
+	fakeClientApp.cfg.clusters["cluster3"] = testClusterSpec{
+		leafClusters: map[string]testClusterSpec{
+			"leaf2": {},
+		},
+	}
+	advance()
+	assertConfigFile("*.cluster1 *.cluster2 *.cluster3 *.leaf1 *.leaf2")
+
+	// Delete all clusters as if the user logged out, allow the configuration
+	// loop to run, and then assert that the config file is well-formed.
+	fakeClientApp.cfg.clusters = nil
+	advance()
+	assertConfigFile("")
+
+	// Kill the configurator, wait for it to return, and assert that the config
+	// file was deleted.
+	cancel()
+	require.ErrorIs(t, <-errC, context.Canceled)
+	_, err = os.Stat(keypaths.VNetSSHConfigPath(homePath))
+	require.ErrorIs(t, err, os.ErrNotExist)
+}
+
+func TestAutoConfigureOpenSSH(t *testing.T) {
+	d := t.TempDir()
+	profilePath := filepath.Join(d, ".tsh")
+	vnetSSHConfigPath := keypaths.VNetSSHConfigPath(profilePath)
+	userOpenSSHConfigPath := filepath.Join(d, ".ssh", "config")
+	expectedInclude := fmt.Sprintf(`# Include Teleport VNet generated configuration
+Include "%s"
+
+`, vnetSSHConfigPath)
+	for _, tc := range []struct {
+		desc                            string
+		userOpenSSHConfigExists         bool
+		userOpenSSHConfigContents       string
+		expectAlreadyIncludedError      bool
+		expectUserOpenSSHConfigContents string
+	}{
+		{
+			// When the user OpenSSH config file doesn't exist, it should be
+			// created with the include.
+			desc:                            "no file",
+			expectUserOpenSSHConfigContents: expectedInclude,
+		},
+		{
+			// When the user OpenSSH config file already exists but it's empty,
+			// the include should be added.
+			desc:                            "empty file",
+			userOpenSSHConfigExists:         true,
+			expectUserOpenSSHConfigContents: expectedInclude,
+		},
+		{
+			// When the user OpenSSH config file already exists with some
+			// content, the include should be added at the top.
+			desc:                            "not empty",
+			userOpenSSHConfigExists:         true,
+			userOpenSSHConfigContents:       "something\nsomethingelse\n",
+			expectUserOpenSSHConfigContents: expectedInclude + "something\nsomethingelse\n",
+		},
+		{
+			// When the user OpenSSH config file already includes VNet's config
+			// file, it should return an AlreadyExists error and the file
+			// should not be modified.
+			desc:                            "already included",
+			userOpenSSHConfigExists:         true,
+			userOpenSSHConfigContents:       expectedInclude,
+			expectAlreadyIncludedError:      true,
+			expectUserOpenSSHConfigContents: expectedInclude,
+		},
+		{
+			// When the user OpenSSH config file already includes VNet's config
+			// file along with existing content, it should return an
+			// AlreadyExists error and the file should not be modified.
+			desc:                            "already included with extra content",
+			userOpenSSHConfigExists:         true,
+			userOpenSSHConfigContents:       "something\n" + expectedInclude + "somethingelse",
+			expectAlreadyIncludedError:      true,
+			expectUserOpenSSHConfigContents: "something\n" + expectedInclude + "somethingelse",
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			if tc.userOpenSSHConfigExists {
+				// Write the existing user OpenSSH config file if it's supposed
+				// to exist for this test case.
+				require.NoError(t, os.WriteFile(userOpenSSHConfigPath,
+					[]byte(tc.userOpenSSHConfigContents), filePerms))
+			}
+
+			err := AutoConfigureOpenSSH(t.Context(), profilePath, withUserSSHConfigPathOverride(userOpenSSHConfigPath))
+
+			if tc.expectAlreadyIncludedError {
+				assert.ErrorIs(t, err, trace.AlreadyExists("%s is already included in %s",
+					vnetSSHConfigPath, userOpenSSHConfigPath))
+			} else {
+				assert.NoError(t, err)
+			}
+
+			contents, err := os.ReadFile(userOpenSSHConfigPath)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectUserOpenSSHConfigContents, string(contents))
+		})
+	}
+}
diff --git a/lib/vnet/osconfig.go b/lib/vnet/osconfig.go
index 0edd68ab93bc7..307b3363f0170 100644
--- a/lib/vnet/osconfig.go
+++ b/lib/vnet/osconfig.go
@@ -30,9 +30,10 @@ import (
 type osConfig struct {
 	tunName    string
 	tunIPv4    string
+	tunIPv4Net *net.IPNet
 	tunIPv6    string
 	cidrRanges []string
-	dnsAddr    string
+	dnsAddrs   []string
 	dnsZones   []string
 }
 
@@ -45,11 +46,11 @@ func configureOS(ctx context.Context, osConfig *osConfig, osConfigState *osConfi
 }
 
 type osConfigurator struct {
-	remoteOSConfigProvider *remoteOSConfigProvider
+	remoteOSConfigProvider *osConfigProvider
 	osConfigState          osConfigState
 }
 
-func newOSConfigurator(remoteOSConfigProvider *remoteOSConfigProvider) *osConfigurator {
+func newOSConfigurator(remoteOSConfigProvider *osConfigProvider) *osConfigurator {
 	return &osConfigurator{
 		remoteOSConfigProvider: remoteOSConfigProvider,
 	}
@@ -125,20 +126,6 @@ func tunIPv6ForPrefix(ipv6Prefix string) (string, error) {
 	return addr.Next().String(), nil
 }
 
-// tunIPv4ForCIDR returns the IPv4 address to use for the TUN interface in
-// cidrRange. It always returns the second address in the range.
-func tunIPv4ForCIDR(cidrRange string) (string, error) {
-	_, ipnet, err := net.ParseCIDR(cidrRange)
-	if err != nil {
-		return "", trace.Wrap(err, "parsing CIDR %q", cidrRange)
-	}
-	// ipnet.IP is the network address, ending in 0s, like 100.64.0.0
-	// Add 1 to assign the TUN address, like 100.64.0.1
-	tunAddress := ipnet.IP
-	tunAddress[len(tunAddress)-1]++
-	return tunAddress.String(), nil
-}
-
 func runCommand(ctx context.Context, path string, args ...string) error {
 	cmdString := strings.Join(append([]string{path}, args...), " ")
 	log.DebugContext(ctx, "Running command", "cmd", cmdString)
diff --git a/lib/vnet/osconfig_darwin.go b/lib/vnet/osconfig_darwin.go
index eb7b7307a19cc..4dcdd9e3da777 100644
--- a/lib/vnet/osconfig_darwin.go
+++ b/lib/vnet/osconfig_darwin.go
@@ -18,10 +18,12 @@ package vnet
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"os"
 	"path/filepath"
 
+	"github.com/google/renameio/v2"
 	"github.com/gravitational/trace"
 )
 
@@ -69,7 +71,7 @@ func platformConfigureOS(ctx context.Context, cfg *osConfig, _ *platformOSConfig
 		}
 	}
 
-	if err := configureDNS(ctx, cfg.dnsAddr, cfg.dnsZones); err != nil {
+	if err := configureDNS(ctx, cfg.dnsAddrs, cfg.dnsZones); err != nil {
 		return trace.Wrap(err, "configuring DNS")
 	}
 
@@ -80,12 +82,14 @@ const resolverFileComment = "# automatically installed by Teleport VNet"
 
 var resolverPath = filepath.Join("/", "etc", "resolver")
 
-func configureDNS(ctx context.Context, nameserver string, zones []string) error {
-	if len(nameserver) == 0 && len(zones) > 0 {
-		return trace.BadParameter("empty nameserver with non-empty zones")
+func configureDNS(ctx context.Context, nameservers []string, zones []string) error {
+	if len(nameservers) == 0 {
+		// There are no nameservers so VNet can't handle any DNS zones. Continue
+		// so that any VNet-managed resolver files can be deleted.
+		zones = nil
 	}
 
-	log.DebugContext(ctx, "Configuring DNS.", "nameserver", nameserver, "zones", zones)
+	log.DebugContext(ctx, "Configuring DNS.", "nameservers", nameservers, "zones", zones)
 	if err := os.MkdirAll(resolverPath, os.FileMode(0755)); err != nil {
 		return trace.Wrap(err, "creating %s", resolverPath)
 	}
@@ -95,14 +99,22 @@ func configureDNS(ctx context.Context, nameserver string, zones []string) error
 		return trace.Wrap(err, "finding VNet managed files in /etc/resolver")
 	}
 
-	// Always attempt to write or clean up all files below, even if encountering errors with one or more of
-	// them.
+	// Always attempt to write or clean up all files below, even if encountering
+	// errors with one or more of them.
 	var allErrors []error
 
+	var fileContents bytes.Buffer
+	fileContents.WriteString(resolverFileComment)
+	fileContents.WriteByte('\n')
+	for _, nameserver := range nameservers {
+		fileContents.WriteString("nameserver ")
+		fileContents.WriteString(nameserver)
+		fileContents.WriteByte('\n')
+	}
+
 	for _, zone := range zones {
 		fileName := filepath.Join(resolverPath, zone)
-		contents := resolverFileComment + "\nnameserver " + nameserver
-		if err := os.WriteFile(fileName, []byte(contents), 0644); err != nil {
+		if err := renameio.WriteFile(fileName, fileContents.Bytes(), 0644); err != nil {
 			allErrors = append(allErrors, trace.Wrap(err, "writing DNS configuration file %s", fileName))
 		} else {
 			// Successfully wrote this file, don't clean it up below.
diff --git a/lib/vnet/osconfig_provider.go b/lib/vnet/osconfig_provider.go
new file mode 100644
index 0000000000000..64975a762d121
--- /dev/null
+++ b/lib/vnet/osconfig_provider.go
@@ -0,0 +1,124 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"net"
+	"slices"
+
+	"github.com/gravitational/trace"
+
+	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
+)
+
+// osConfigProvider fetches a target OS configuration based on cluster
+// configuration fetched via the client application process available over gRPC.
+type osConfigProvider struct {
+	cfg        osConfigProviderConfig
+	dnsAddrs   []string
+	tunIPv6    string
+	tunIPv4    string
+	tunIPv4Net *net.IPNet
+}
+
+// osConfigProviderConfig holds configuration parameters for an osConfigProvider.
+type osConfigProviderConfig struct {
+	clt           targetOSConfigGetter
+	tunName       string
+	ipv6Prefix    string
+	dnsIPv6       string
+	addDNSAddress func(net.IP) error
+}
+
+type targetOSConfigGetter interface {
+	GetTargetOSConfiguration(context.Context) (*vnetv1.TargetOSConfiguration, error)
+}
+
+func newOSConfigProvider(cfg osConfigProviderConfig) (*osConfigProvider, error) {
+	tunIPv6, err := tunIPv6ForPrefix(cfg.ipv6Prefix)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &osConfigProvider{
+		cfg:      cfg,
+		dnsAddrs: []string{cfg.dnsIPv6},
+		tunIPv6:  tunIPv6,
+	}, nil
+}
+
+func (p *osConfigProvider) targetOSConfig(ctx context.Context) (*osConfig, error) {
+	targetOSConfig, err := p.cfg.clt.GetTargetOSConfiguration(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "getting target OS configuration from client application")
+	}
+	if p.tunIPv4 == "" && len(targetOSConfig.Ipv4CidrRanges) > 0 {
+		// Choose an IPv4 address for the TUN interface and the IPv4 DNS server
+		// from the CIDR range of one arbitrary currently logged-in cluster.
+		// We currently only assign one V4 address to the interface and only
+		// advertise DNS on one V4 address.
+		if err := p.setV4IPsFromFirstCIDR(targetOSConfig.Ipv4CidrRanges[0]); err != nil {
+			return nil, trace.Wrap(err, "setting TUN IPv4 address")
+		}
+	}
+	return &osConfig{
+		tunName:    p.cfg.tunName,
+		tunIPv6:    p.tunIPv6,
+		tunIPv4:    p.tunIPv4,
+		tunIPv4Net: p.tunIPv4Net,
+		dnsAddrs:   p.dnsAddrs,
+		dnsZones:   targetOSConfig.GetDnsZones(),
+		cidrRanges: targetOSConfig.GetIpv4CidrRanges(),
+	}, nil
+}
+
+func (p *osConfigProvider) setV4IPsFromFirstCIDR(cidrRange string) error {
+	if p.tunIPv4 != "" {
+		// Only set these once.
+		return nil
+	}
+	tunIPv4, tunIPv4Net, dnsIPv4, err := ipsForCIDR(cidrRange)
+	if err != nil {
+		return trace.Wrap(err, "setting TUN IPv4 address for range %s", cidrRange)
+	}
+	if err := p.cfg.addDNSAddress(dnsIPv4); err != nil {
+		return trace.Wrap(err, "adding IPv4 DNS server at %s", dnsIPv4.String())
+	}
+	p.tunIPv4 = tunIPv4.String()
+	p.tunIPv4Net = tunIPv4Net
+	p.dnsAddrs = append(p.dnsAddrs, dnsIPv4.String())
+	return nil
+}
+
+// ipsForCIDR returns the V4 IPs to assign to the interface and use for DNS in
+// cidrRange.
+func ipsForCIDR(cidrRange string) (tunIP net.IP, tunIPNet *net.IPNet, dnsIP net.IP, err error) {
+	_, tunIPNet, err = net.ParseCIDR(cidrRange)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err, "parsing CIDR %q", cidrRange)
+	}
+	// tunIPNet.IP is the network address, ending in 0s, like 100.64.0.0
+	// Add 1 to assign the TUN address, like 100.64.0.1
+	tunIP = slices.Clone(tunIPNet.IP)
+	tunIP[len(tunIP)-1]++
+
+	// Add 1 again to assign the DNS address, like 100.64.0.2
+	dnsIP = slices.Clone(tunIP)
+	dnsIP[len(dnsIP)-1]++
+
+	return tunIP, tunIPNet, dnsIP, nil
+}
diff --git a/lib/vnet/osconfig_provider_test.go b/lib/vnet/osconfig_provider_test.go
new file mode 100644
index 0000000000000..e368524ee465e
--- /dev/null
+++ b/lib/vnet/osconfig_provider_test.go
@@ -0,0 +1,142 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
+)
+
+func TestOSConfigProvider(t *testing.T) {
+	ctx := context.Background()
+	for _, tc := range []struct {
+		desc                 string
+		tunName              string
+		ipv6Prefix           string
+		dnsIPv6              string
+		dnsZones             []string
+		ipv4CIDRRanges       []string
+		getTargetOSConfigErr error
+		expectErr            error
+		expectTargetOSConfig *osConfig
+	}{
+		{
+			// No IPv4 address should be assigned until an IPv4 CIDR range is
+			// reported.
+			desc:       "no cidr ranges",
+			tunName:    "testtun1",
+			ipv6Prefix: "fd01:2345:6789::",
+			dnsIPv6:    "fd01:2345:6789::2",
+			dnsZones:   []string{"test.example.com"},
+			expectTargetOSConfig: &osConfig{
+				tunName: "testtun1",
+				// Should be the first non-broadcast address under the IPv6 prefix.
+				tunIPv6:  "fd01:2345:6789::1",
+				dnsAddrs: []string{"fd01:2345:6789::2"},
+				dnsZones: []string{"test.example.com"},
+			},
+		},
+		{
+			desc:           "with cidr range",
+			tunName:        "testtun1",
+			ipv6Prefix:     "fd01:2345:6789::",
+			dnsIPv6:        "fd01:2345:6789::2",
+			dnsZones:       []string{"test.example.com"},
+			ipv4CIDRRanges: []string{"192.168.1.0/24"},
+			expectTargetOSConfig: &osConfig{
+				tunName: "testtun1",
+				// Should be the first non-broadcast address in the CIDR range.
+				tunIPv4:    "192.168.1.1",
+				tunIPv4Net: &net.IPNet{IP: []byte{192, 168, 1, 0}, Mask: []byte{255, 255, 255, 0}},
+				tunIPv6:    "fd01:2345:6789::1",
+				// Should include the second non-broadcast address in the CIDR range.
+				dnsAddrs:   []string{"fd01:2345:6789::2", "192.168.1.2"},
+				dnsZones:   []string{"test.example.com"},
+				cidrRanges: []string{"192.168.1.0/24"},
+			},
+		},
+		{
+			desc:           "multiple cidr ranges",
+			tunName:        "testtun1",
+			ipv6Prefix:     "fd01:2345:6789::",
+			dnsIPv6:        "fd01:2345:6789::2",
+			dnsZones:       []string{"test.example.com"},
+			ipv4CIDRRanges: []string{"10.64.0.0/10", "192.168.1.0/24"},
+			expectTargetOSConfig: &osConfig{
+				tunName: "testtun1",
+				// Should be chosen from the first CIDR range.
+				tunIPv4:    "10.64.0.1",
+				tunIPv4Net: &net.IPNet{IP: []byte{10, 64, 0, 0}, Mask: []byte{255, 192, 0, 0}},
+				tunIPv6:    "fd01:2345:6789::1",
+				dnsAddrs:   []string{"fd01:2345:6789::2", "10.64.0.2"},
+				dnsZones:   []string{"test.example.com"},
+				cidrRanges: []string{"10.64.0.0/10", "192.168.1.0/24"},
+			},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			targetOSConfigGetter := &fakeTargetOSConfigGetter{
+				targetOSConfig: &vnetv1.TargetOSConfiguration{
+					DnsZones:       tc.dnsZones,
+					Ipv4CidrRanges: tc.ipv4CIDRRanges,
+				},
+				err: tc.getTargetOSConfigErr,
+			}
+			// Keep track of new DNS addresses the osConfigProvider tried to add.
+			var addedDNSAddrs []string
+			osConfigProvider, err := newOSConfigProvider(osConfigProviderConfig{
+				clt:        targetOSConfigGetter,
+				tunName:    tc.tunName,
+				ipv6Prefix: tc.ipv6Prefix,
+				dnsIPv6:    tc.dnsIPv6,
+				addDNSAddress: func(ip net.IP) error {
+					addedDNSAddrs = append(addedDNSAddrs, ip.String())
+					return nil
+				},
+			})
+			require.NoError(t, err)
+
+			targetOSConfig, err := osConfigProvider.targetOSConfig(ctx)
+			if tc.expectErr != nil {
+				require.ErrorIs(t, err, tc.expectErr)
+				return
+			}
+			require.Equal(t, tc.expectTargetOSConfig, targetOSConfig)
+
+			// expectTargetOSConfig.dnsAddrs always starts with the IPv6 DNS
+			// addr, assert that any additional addrs were added to the network
+			// stack.
+			if len(tc.expectTargetOSConfig.dnsAddrs) > 1 {
+				require.ElementsMatch(t, tc.expectTargetOSConfig.dnsAddrs[1:], addedDNSAddrs)
+			}
+		})
+	}
+}
+
+type fakeTargetOSConfigGetter struct {
+	targetOSConfig *vnetv1.TargetOSConfiguration
+	err            error
+}
+
+func (f *fakeTargetOSConfigGetter) GetTargetOSConfiguration(_ context.Context) (*vnetv1.TargetOSConfiguration, error) {
+	return f.targetOSConfig, f.err
+}
diff --git a/lib/vnet/osconfig_windows.go b/lib/vnet/osconfig_windows.go
index 0b10495434e1a..27a387b89a788 100644
--- a/lib/vnet/osconfig_windows.go
+++ b/lib/vnet/osconfig_windows.go
@@ -18,15 +18,20 @@ package vnet
 
 import (
 	"context"
+	"errors"
 	"net"
 	"slices"
 	"strconv"
 	"strings"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
+)
 
-	"github.com/gravitational/teleport/api/utils"
+var (
+	userenv             = windows.NewLazySystemDLL("userenv.dll")
+	procRefreshPolicyEx = userenv.NewProc("RefreshPolicyEx")
 )
 
 // platformOSConfigState holds state about which addresses and routes have
@@ -42,9 +47,16 @@ type platformOSConfigState struct {
 	configuredV4Address bool
 	configuredV6Address bool
 	configuredRanges    []string
-	configuredDNSZones  []string
 
 	ifaceIndex string
+
+	// configuredDNSZones caches DNS zones so DNS is reconfigured when they change.
+	configuredDNSZones []string
+	// configuredDNSAddrs caches DNS addresses so DNS is reconfigured when they change.
+	configuredDNSAddrs []string
+	// configuredGroupPolicyKey caches existence of the group policy key so DNS is reconfigured when
+	// the key is created or removed.
+	configuredGroupPolicyKey bool
 }
 
 func (p *platformOSConfigState) getIfaceIndex() (string, error) {
@@ -70,8 +82,9 @@ func platformConfigureOS(ctx context.Context, cfg *osConfig, state *platformOSCo
 		if !state.configuredV4Address {
 			log.InfoContext(ctx, "Setting IPv4 address for the TUN device",
 				"device", cfg.tunName, "address", cfg.tunIPv4)
+			netMask := maskForIPNet(cfg.tunIPv4Net)
 			if err := runCommand(ctx,
-				"netsh", "interface", "ip", "set", "address", cfg.tunName, "static", cfg.tunIPv4,
+				"netsh", "interface", "ip", "set", "address", cfg.tunName, "static", cfg.tunIPv4, netMask,
 			); err != nil {
 				return trace.Wrap(err)
 			}
@@ -113,11 +126,22 @@ func platformConfigureOS(ctx context.Context, cfg *osConfig, state *platformOSCo
 		state.configuredV6Address = true
 	}
 
-	if shouldUpdateDNSConfig(cfg, state) {
-		if err := configureDNS(ctx, cfg.dnsZones, cfg.dnsAddr); err != nil {
+	// Configure DNS only if the DNS zones or addresses have changed. This typically happens when the
+	// user logs in or out of a cluster. Otherwise configureDNS would refresh all computer policies
+	// every 10 seconds when platformConfigureOS is called.
+	doesGroupPolicyKeyExist, err := doesKeyPathExist(registry.LOCAL_MACHINE, groupPolicyNRPTParentKey)
+	if err != nil {
+		return trace.Wrap(err, "checking existence of group policy NRPT registry key %s", groupPolicyNRPTParentKey)
+	}
+	if !slices.Equal(cfg.dnsZones, state.configuredDNSZones) ||
+		!slices.Equal(cfg.dnsAddrs, state.configuredDNSAddrs) ||
+		doesGroupPolicyKeyExist != state.configuredGroupPolicyKey {
+		if err := configureDNS(ctx, cfg.dnsZones, cfg.dnsAddrs, doesGroupPolicyKeyExist); err != nil {
 			return trace.Wrap(err, "configuring DNS")
 		}
 		state.configuredDNSZones = cfg.dnsZones
+		state.configuredDNSAddrs = cfg.dnsAddrs
+		state.configuredGroupPolicyKey = doesGroupPolicyKeyExist
 	}
 
 	return nil
@@ -131,29 +155,80 @@ func addrMaskForCIDR(cidr string) (string, string, error) {
 	if err != nil {
 		return "", "", trace.Wrap(err, "parsing CIDR range %s", cidr)
 	}
-	return ipNet.IP.String(), net.IP(ipNet.Mask).String(), nil
+	return ipNet.IP.String(), maskForIPNet(ipNet), nil
 }
 
-func shouldUpdateDNSConfig(cfg *osConfig, state *platformOSConfigState) bool {
-	// Always reconfigure if there should be no zones, to make sure we clear
-	// any leftover state when starting up.
-	if len(cfg.dnsZones) == 0 {
-		return true
+func maskForIPNet(ipNet *net.IPNet) string {
+	return net.IP(ipNet.Mask).String()
+}
+
+const (
+	// Split DNS is configured via the Name Resolution Policy Table in the
+	// Windows registry.
+
+	// This key holds the local system NRPT configuration.
+	systemNRPTParentKey = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
+	// This key holds NRPT entries coming from group policy, if it's present
+	// then policies under systemNRPTParentKey are ignored, so VNet needs to write policies here.
+	groupPolicyNRPTParentKey = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+	// The UUID at the end was randomly generated once, VNet
+	// always writes policies at this key and cleans it up on shutdown.
+	vnetNRPTKeyID = `{ad074e9a-bd1b-447e-9108-14e545bf11a5}`
+)
+
+func configureDNS(ctx context.Context, zones, nameservers []string, doesGroupPolicyKeyExist bool) error {
+	// Always configure NRPT rules under the local system NRPT registry key.
+	// This is harmless/innefective if groupPolicyNRPTParentKey exists, but
+	// always writing the rules here means they will be effective if
+	// groupPolicyNRPTParentKey gets deleted later.
+	nrptRegKey := systemNRPTParentKey + `\` + vnetNRPTKeyID
+	if err := configureDNSAtNRPTKey(ctx, nrptRegKey, zones, nameservers); err != nil {
+		return trace.Wrap(err, "configuring DNS NRPT at local system path %s", nrptRegKey)
+	}
+
+	// If groupPolicyNRPTParentKey exists then all rules under
+	// systemNRPTParentKey will be ignored and rules under
+	// groupPolicyNRPTParentKey take precendence, so VNet needs to write rules
+	// under this key as well.
+	if !doesGroupPolicyKeyExist {
+		// The group policy parent key doesn't exist, no need to write under it.
+		return nil
+	}
+
+	nrptRegKey = groupPolicyNRPTParentKey + `\` + vnetNRPTKeyID
+	if err := configureDNSAtNRPTKey(ctx, nrptRegKey, zones, nameservers); err != nil {
+		return trace.Wrap(err, "configuring DNS NRPT at group policy path %s", nrptRegKey)
+	}
+	// In some cases, rules under groupPolicyKey don't seem to be picked up by the DNS client service
+	// until the computer refreshes its policies. [1] A force refresh here ensures they're picked up
+	// immediately. See also https://github.com/gravitational/teleport/issues/60468.
+	// 1: https://github.com/tailscale/tailscale/issues/4607#issuecomment-1130586168
+	if err := forceRefreshComputerPolicies(); err != nil {
+		return trace.Wrap(err, "refreshing computer policies")
 	}
-	// Otherwise, reconfigure if anything has changed.
-	return !utils.ContainSameUniqueElements(cfg.dnsZones, state.configuredDNSZones)
+	return nil
 }
 
-func configureDNS(ctx context.Context, zones []string, nameserver string) (err error) {
-	if len(nameserver) == 0 && len(zones) > 0 {
-		return trace.BadParameter("empty nameserver with non-empty zones")
+func doesKeyPathExist(k registry.Key, path string) (bool, error) {
+	key, err := registry.OpenKey(k, path, registry.READ)
+	if err != nil {
+		if !errors.Is(err, registry.ErrNotExist) {
+			return false, trace.Wrap(err, "opening registry key %s", path)
+		}
+		return false, nil
+	}
+	if err := key.Close(); err != nil {
+		return true, trace.Wrap(err, "closing registry key %s", path)
 	}
-	log.InfoContext(ctx, "Configuring DNS.", "nameserver", nameserver, "zones", zones)
+	return true, nil
+}
 
-	// Split DNS is configured via the Name Resolution Policy Table in the
-	// Windows registry. The UUID at the end was randomly generated, we'll
-	// always write to this key and clean it up on shutdown.
-	const nrptRegKey = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\{ad074e9a-bd1b-447e-9108-14e545bf11a5}`
+func configureDNSAtNRPTKey(ctx context.Context, nrptRegKey string, zones, nameservers []string) (err error) {
+	if len(nameservers) == 0 {
+		// Can't handle any zones if there are no nameservers.
+		zones = nil
+	}
+	log.InfoContext(ctx, "Configuring DNS.", "reg_key", nrptRegKey, "zones", zones, "nameservers", nameservers)
 
 	if len(zones) == 0 {
 		// Either we have no zones we want to handle (the user is not
@@ -162,7 +237,7 @@ func configureDNS(ctx context.Context, zones []string, nameserver string) (err e
 		return trace.Wrap(deleteRegistryKey(nrptRegKey))
 	}
 
-	// Open the registry key where split DNS is configured for VNet.
+	// Open the registry key where split DNS will be configured.
 	dnsKey, _ /*alreadyExisted*/, err := registry.CreateKey(registry.LOCAL_MACHINE, nrptRegKey, registry.SET_VALUE)
 	if err != nil {
 		return trace.Wrap(err, "failed to open Windows registry key to configure split DNS")
@@ -182,15 +257,24 @@ func configureDNS(ctx context.Context, zones []string, nameserver string) (err e
 		err = trace.NewAggregate(origErr, deleteErr, closeErr)
 	}()
 
+	// The NRPT version must be 1.
 	if err := dnsKey.SetDWordValue("Version", 1); err != nil {
 		return trace.Wrap(err, "failed to set Version in DNS registry key")
 	}
+	// Name is a list of strings holding the DNS suffixes to match.
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/c1f8a4c0-d4e0-49b2-b4ef-87031be16662
 	if err := dnsKey.SetStringsValue("Name", normalizeDNSZones(zones)); err != nil {
 		return trace.Wrap(err, "failed to set Name in DNS registry key")
 	}
-	if err := dnsKey.SetStringValue("GenericDNSServers", nameserver); err != nil {
+	// GenericDNSServers is a string value holding a semicolon-delimited list of
+	// IP addresses of DNS nameservers.
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/06088ca3-4cf1-48fa-8837-ca8d853ee1e8
+	if err := dnsKey.SetStringValue("GenericDNSServers", strings.Join(nameservers, ";")); err != nil {
 		return trace.Wrap(err, "failed to set GenericDNSServers in DNS registry key")
 	}
+	// Setting ConfigOptions to 8 tells NRPT that only GenericDNSServers is
+	// specified (DNSSEC, DirectAccess, and IDN options are not set).
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/2d34f260-1e9e-4a52-ac91-2056dfd29702
 	if err := dnsKey.SetDWordValue("ConfigOptions", 8); err != nil {
 		return trace.Wrap(err, "failed to set ConfigOptions in DNS registry key")
 	}
@@ -222,3 +306,22 @@ func deleteRegistryKey(key string) error {
 	keyHandle.Close()
 	return trace.Wrap(deleteErr, "failed to delete DNS registry key %s", key)
 }
+
+// https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-refreshpolicyex
+func forceRefreshComputerPolicies() error {
+	// refreshComputerPolicies corresponds to the first argument of RefreshPolicyEx which specifies
+	// whether to refresh computer or user policies.
+	const refreshComputerPolicies = 1
+	// rpForce corresponds to the RP_FORCE flag for RefreshPolicyEx which makes it reapply all
+	// policies even if no policy change was detected.
+	const rpForce = 1
+
+	retVal, _, err := procRefreshPolicyEx.Call(
+		uintptr(refreshComputerPolicies),
+		uintptr(rpForce),
+	)
+	if retVal == 0 {
+		return trace.Wrap(err)
+	}
+	return nil
+}
diff --git a/lib/vnet/remote_osconfig_provider.go b/lib/vnet/remote_osconfig_provider.go
deleted file mode 100644
index 8a91db28603d9..0000000000000
--- a/lib/vnet/remote_osconfig_provider.go
+++ /dev/null
@@ -1,86 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package vnet
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-
-	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
-)
-
-// remoteOSConfigProvider fetches a target OS configuration based on cluster
-// configuration fetched via the client application process available over gRPC.
-type remoteOSConfigProvider struct {
-	clt     targetOSConfigGetter
-	tunName string
-	dnsAddr string
-	tunIPv6 string
-	tunIPv4 string
-}
-
-type targetOSConfigGetter interface {
-	GetTargetOSConfiguration(context.Context) (*vnetv1.TargetOSConfiguration, error)
-}
-
-func newRemoteOSConfigProvider(clt targetOSConfigGetter, tunName, ipv6Prefix, dnsAddr string) (*remoteOSConfigProvider, error) {
-	tunIPv6, err := tunIPv6ForPrefix(ipv6Prefix)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &remoteOSConfigProvider{
-		clt:     clt,
-		tunName: tunName,
-		dnsAddr: dnsAddr,
-		tunIPv6: tunIPv6,
-	}, nil
-}
-
-func (p *remoteOSConfigProvider) targetOSConfig(ctx context.Context) (*osConfig, error) {
-	targetOSConfig, err := p.clt.GetTargetOSConfiguration(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "getting target OS configuration from client application")
-	}
-	if p.tunIPv4 == "" && len(targetOSConfig.Ipv4CidrRanges) > 0 {
-		// Choose an IPv4 address for the TUN interface from the CIDR range of one arbitrary currently
-		// logged-in cluster. Only one IPv4 address is needed.
-		if err := p.setTunIPv4FromCIDR(targetOSConfig.Ipv4CidrRanges[0]); err != nil {
-			return nil, trace.Wrap(err, "setting TUN IPv4 address")
-		}
-	}
-	return &osConfig{
-		tunName:    p.tunName,
-		tunIPv6:    p.tunIPv6,
-		tunIPv4:    p.tunIPv4,
-		dnsAddr:    p.dnsAddr,
-		dnsZones:   targetOSConfig.GetDnsZones(),
-		cidrRanges: targetOSConfig.GetIpv4CidrRanges(),
-	}, nil
-}
-
-func (p *remoteOSConfigProvider) setTunIPv4FromCIDR(cidrRange string) error {
-	if p.tunIPv4 != "" {
-		return nil
-	}
-	ip, err := tunIPv4ForCIDR(cidrRange)
-	if err != nil {
-		return trace.Wrap(err, "setting TUN IPv4 address for range %s", cidrRange)
-	}
-	p.tunIPv4 = ip
-	return nil
-}
diff --git a/lib/vnet/remote_osconfig_provider_test.go b/lib/vnet/remote_osconfig_provider_test.go
deleted file mode 100644
index aaba5f79a079b..0000000000000
--- a/lib/vnet/remote_osconfig_provider_test.go
+++ /dev/null
@@ -1,120 +0,0 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-package vnet
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
-)
-
-func TestRemoteOSConfigProvider(t *testing.T) {
-	ctx := context.Background()
-	for _, tc := range []struct {
-		desc                 string
-		tunName              string
-		ipv6Prefix           string
-		dnsAddr              string
-		dnsZones             []string
-		ipv4CIDRRanges       []string
-		getTargetOSConfigErr error
-		expectErr            error
-		expectTargetOSConfig *osConfig
-	}{
-		{
-			// No IPv4 address should be assigned until an IPv4 CIDR range is
-			// reported.
-			desc:       "no cidr ranges",
-			tunName:    "testtun1",
-			ipv6Prefix: "fd01:2345:6789::",
-			dnsAddr:    "fd01:2345:6789::2",
-			dnsZones:   []string{"test.example.com"},
-			expectTargetOSConfig: &osConfig{
-				tunName: "testtun1",
-				// Should be the first non-broadcast address under the IPv6 prefix.
-				tunIPv6:  "fd01:2345:6789::1",
-				dnsAddr:  "fd01:2345:6789::2",
-				dnsZones: []string{"test.example.com"},
-			},
-		},
-		{
-			desc:           "with cidr range",
-			tunName:        "testtun1",
-			ipv6Prefix:     "fd01:2345:6789::",
-			dnsAddr:        "fd01:2345:6789::2",
-			dnsZones:       []string{"test.example.com"},
-			ipv4CIDRRanges: []string{"192.168.1.0/24"},
-			expectTargetOSConfig: &osConfig{
-				tunName: "testtun1",
-				// Should be the first non-broadcast address in the CIDR range.
-				tunIPv4:    "192.168.1.1",
-				tunIPv6:    "fd01:2345:6789::1",
-				dnsAddr:    "fd01:2345:6789::2",
-				dnsZones:   []string{"test.example.com"},
-				cidrRanges: []string{"192.168.1.0/24"},
-			},
-		},
-		{
-			desc:           "multiple cidr ranges",
-			tunName:        "testtun1",
-			ipv6Prefix:     "fd01:2345:6789::",
-			dnsAddr:        "fd01:2345:6789::2",
-			dnsZones:       []string{"test.example.com"},
-			ipv4CIDRRanges: []string{"10.64.0.0/16", "192.168.1.0/24"},
-			expectTargetOSConfig: &osConfig{
-				tunName: "testtun1",
-				// Should be chosen from the first CIDR range.
-				tunIPv4:    "10.64.0.1",
-				tunIPv6:    "fd01:2345:6789::1",
-				dnsAddr:    "fd01:2345:6789::2",
-				dnsZones:   []string{"test.example.com"},
-				cidrRanges: []string{"10.64.0.0/16", "192.168.1.0/24"},
-			},
-		},
-	} {
-		t.Run(tc.desc, func(t *testing.T) {
-			targetOSConfigGetter := &fakeTargetOSConfigGetter{
-				targetOSConfig: &vnetv1.TargetOSConfiguration{
-					DnsZones:       tc.dnsZones,
-					Ipv4CidrRanges: tc.ipv4CIDRRanges,
-				},
-				err: tc.getTargetOSConfigErr,
-			}
-			remoteOSConfigProvider, err := newRemoteOSConfigProvider(targetOSConfigGetter, tc.tunName, tc.ipv6Prefix, tc.dnsAddr)
-			require.NoError(t, err)
-
-			targetOSConfig, err := remoteOSConfigProvider.targetOSConfig(ctx)
-			if tc.expectErr != nil {
-				require.ErrorIs(t, err, tc.expectErr)
-				return
-			}
-			require.Equal(t, tc.expectTargetOSConfig, targetOSConfig)
-		})
-	}
-}
-
-type fakeTargetOSConfigGetter struct {
-	targetOSConfig *vnetv1.TargetOSConfiguration
-	err            error
-}
-
-func (f *fakeTargetOSConfigGetter) GetTargetOSConfiguration(_ context.Context) (*vnetv1.TargetOSConfiguration, error) {
-	return f.targetOSConfig, f.err
-}
diff --git a/lib/vnet/ssh_agent.go b/lib/vnet/ssh_agent.go
new file mode 100644
index 0000000000000..1db229c1e82fa
--- /dev/null
+++ b/lib/vnet/ssh_agent.go
@@ -0,0 +1,162 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"crypto/rand"
+	"sync"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
+
+	"github.com/gravitational/teleport/api/utils/sshutils"
+)
+
+// sshAgent implements [agent.ExtendedAgent]. The sole purpose is to forward
+// the user's Teleport SSH key to the proxy in case the cluster is in proxy
+// recording mode. In this case there will be an SSH connection between VNet
+// and the root cluster proxy terminated with the SSH key in the
+// [ssh.ClientConfig], and then the key forwarded via this agent will be used
+// to terminate the final SSH connection to the target node.
+type sshAgent struct {
+	mu     sync.Mutex
+	signer ssh.Signer
+}
+
+func newSSHAgent() *sshAgent {
+	return &sshAgent{}
+}
+
+// setSessionKey must be called at most once, before the agent will be used.
+// It's not possible to initialize sshAgent with the SSH signer because the
+// agent must be passed to [proxy.Client.DialHost] before the session SSH
+// signer has been created.
+func (a *sshAgent) setSessionKey(signer ssh.Signer) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.signer != nil {
+		return trace.Errorf("sshAgent.setSessionKey must be called at most once (this is a bug)")
+	}
+	a.signer = signer
+	return nil
+}
+
+// List implements [agent.ExtendedAgent.List], it returns a single key if it
+// has been set by setSessionKey.
+func (a *sshAgent) List() ([]*agent.Key, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.signer == nil {
+		return nil, nil
+	}
+	pub := a.signer.PublicKey()
+	return []*agent.Key{{
+		Format: pub.Type(),
+		Blob:   pub.Marshal(),
+	}}, nil
+}
+
+// List implements [agent.ExtendedAgent.Signers], it returns a single key if it
+// has been set by setSessionKey.
+func (a *sshAgent) Signers() ([]ssh.Signer, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.signer == nil {
+		return nil, nil
+	}
+	return []ssh.Signer{a.signer}, nil
+}
+
+// SignWithFlags implements [agent.ExtendedAgent.Sign], it returns an SSH
+// signature with a.signer if it has been set and matches the requested key.
+func (a *sshAgent) Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, error) {
+	return a.SignWithFlags(key, data, 0)
+}
+
+// SignWithFlags implements [agent.ExtendedAgent.SignWithFlags], it returns an
+// SSH signature with a.signer if it has been set and matches the requested
+// key.
+func (a *sshAgent) SignWithFlags(key ssh.PublicKey, data []byte, flags agent.SignatureFlags) (*ssh.Signature, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.signer == nil {
+		return nil, trace.Errorf("VNet SSH agent has no signer")
+	}
+	if !sshutils.KeysEqual(a.signer.PublicKey(), key) {
+		return nil, trace.BadParameter("requested key does not equal VNet SSH agent key")
+	}
+	var algo string
+	switch flags {
+	case 0:
+	case agent.SignatureFlagRsaSha256:
+		algo = ssh.KeyAlgoRSASHA256
+	case agent.SignatureFlagRsaSha512:
+		algo = ssh.KeyAlgoRSASHA512
+	default:
+		return nil, trace.Errorf("unsupported signature flag %v", flags)
+	}
+	log.DebugContext(context.Background(), "VNet SSH agent signature requested",
+		"key_type", a.signer.PublicKey().Type(), "algo", algo)
+	if algo == "" {
+		sig, err := a.signer.Sign(rand.Reader, data)
+		return sig, trace.Wrap(err)
+	}
+	algorithmSigner, ok := a.signer.(ssh.AlgorithmSigner)
+	if !ok {
+		return nil, trace.Errorf("VNet SSH agent signer does not implement ssh.AlgorithmSigner")
+	}
+	sig, err := algorithmSigner.SignWithAlgorithm(rand.Reader, data, algo)
+	return sig, trace.Wrap(err, "signing with VNet SSH agent signer")
+}
+
+// Add implements [agent.ExtendedAgent.Add]. It is irrelevant for this
+// implementation and always returns an error, it is not called.
+func (a *sshAgent) Add(key agent.AddedKey) error {
+	return trace.NotImplemented("sshAgent.Add is not implemented")
+}
+
+// Remove implements [agent.ExtendedAgent.Remove]. It is irrelevant for this
+// implementation and always returns an error, it is not called.
+func (a *sshAgent) Remove(key ssh.PublicKey) error {
+	return trace.NotImplemented("sshAgent.Remove is not implemented")
+}
+
+// RemoveAll implements [agent.ExtendedAgent.RemoveAll]. It is irrelevant for this
+// implementation and always returns an error, it is not called.
+func (a *sshAgent) RemoveAll() error {
+	return trace.NotImplemented("sshAgent.RemoveAll is not implemented")
+}
+
+// Lock implements [agent.ExtendedAgent.Lock]. It is irrelevant for this
+// implementation and always returns an error, it is not called.
+func (a *sshAgent) Lock(passphrase []byte) error {
+	return trace.NotImplemented("sshAgent.Lock is not implemented")
+}
+
+// Unlock implements [agent.ExtendedAgent.Unlock]. It is irrelevant for this
+// implementation and always returns an error, it is not called.
+func (a *sshAgent) Unlock(passphrase []byte) error {
+	return trace.NotImplemented("sshAgent.Unlock is not implemented")
+}
+
+// Extension implements [agent.ExtendedAgent.Extension]. It is irrelevant for
+// this implementation and always returns an error, it is not called.
+func (a *sshAgent) Extension(extensionType string, contents []byte) ([]byte, error) {
+	return nil, trace.NotImplemented("sshAgent.Extension is not implemented")
+}
diff --git a/lib/vnet/ssh_handler.go b/lib/vnet/ssh_handler.go
new file mode 100644
index 0000000000000..8fd07572006ea
--- /dev/null
+++ b/lib/vnet/ssh_handler.go
@@ -0,0 +1,222 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
+	"github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// sshHandler handles incoming VNet SSH connections.
+type sshHandler struct {
+	cfg sshHandlerConfig
+}
+
+type sshHandlerConfig struct {
+	sshProvider *sshProvider
+	target      dialTarget
+}
+
+func newSSHHandler(cfg sshHandlerConfig) *sshHandler {
+	return &sshHandler{
+		cfg: cfg,
+	}
+}
+
+// handleTCPConnector handles an incoming TCP connection from VNet and proxies
+// the connection to a target SSH node.
+func (h *sshHandler) handleTCPConnector(ctx context.Context, localPort uint16, connector func() (net.Conn, error)) error {
+	if localPort != 22 {
+		return trace.BadParameter("SSH is only handled on port 22")
+	}
+	agent := newSSHAgent()
+	targetConn, err := h.cfg.sshProvider.dial(ctx, h.cfg.target, agent)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer targetConn.Close()
+	return trace.Wrap(h.handleTCPConnectorWithTargetConn(ctx, connector, targetConn, agent))
+}
+
+// handleTCPConnectorWithTargetTCPConn handles an incoming TCP connection from
+// VNet when a TCP connection to the target host has already been established.
+func (h *sshHandler) handleTCPConnectorWithTargetConn(
+	ctx context.Context,
+	connector func() (net.Conn, error),
+	targetConn net.Conn,
+	agent *sshAgent,
+) error {
+	target := h.cfg.target
+	hostCert, err := newHostCert(target.fqdn, h.cfg.sshProvider.hostCASigner)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	localConn, err := connector()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer localConn.Close()
+
+	var (
+		clientConn       *sshConn
+		clientConnErr    error
+		initiatedSSHConn bool
+	)
+	serverConfig := &ssh.ServerConfig{
+		// We attempt to initiate an SSH connection with the target server in
+		// PublicKeyCallback in order to fail the SSH authentication phase with
+		// the client if SSH authentication to the target fails. Otherwise, when
+		// connection to an SSH node the user is not allowed to access, they
+		// would just see an succesfull SSH handshake and then an immediately
+		// closed connection.
+		//
+		// TODO(nklaassen): if https://github.com/golang/go/issues/70795 ever
+		// gets implemented we should do this in VerifiedPublicKeyCallback
+		// instead.
+		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			if !sshutils.KeysEqual(h.cfg.sshProvider.trustedUserPublicKey, key) {
+				return nil, trace.AccessDenied("client public key is not trusted")
+			}
+			// Make sure to only initiate the SSH connection once in case
+			// PublicKeyCallback is called multiple times.
+			if initiatedSSHConn {
+				return nil, clientConnErr
+			}
+			initiatedSSHConn = true
+			clientConn, clientConnErr = h.initiateSSHConn(ctx, targetConn, conn.User(), agent)
+			if clientConnErr != nil {
+				// Attempt to send a friendlier errer message if we failed to
+				// initiate the SSH connection to the target by sending an auth
+				// banner message.
+				if utils.IsHandshakeFailedError(clientConnErr) {
+					// We don't have much real information about the error in
+					// this case, this is the same message tsh prints.
+					return nil, &ssh.BannerError{
+						Err:     clientConnErr,
+						Message: formatBannerMessage(fmt.Sprintf("access denied to %s connecting to %s", conn.User(), target.hostname)),
+					}
+				}
+				return nil, &ssh.BannerError{
+					Err:     clientConnErr,
+					Message: formatBannerMessage(trace.UserMessage(clientConnErr)),
+				}
+			}
+			return nil, nil
+		},
+	}
+	serverConfig.AddHostKey(hostCert)
+
+	serverConn, serverChans, serverReqs, err := ssh.NewServerConn(localConn, serverConfig)
+	if err != nil {
+		// Make sure to close the client conn if we already accepted it.
+		if clientConn != nil {
+			clientConn.Close()
+		}
+		return trace.Wrap(err, "accepting incoming SSH connection")
+	}
+	log.DebugContext(ctx, "Accepted incoming SSH connection",
+		"profile", target.profile,
+		"cluster", target.cluster,
+		"host", target.hostname,
+		"user", serverConn.User(),
+	)
+
+	// proxySSHConnection transparently proxies the SSH connection from the
+	// client to the target. It will handle closing the connections before it
+	// returns.
+	proxySSHConnection(ctx,
+		sshConn{
+			conn:  serverConn,
+			chans: serverChans,
+			reqs:  serverReqs,
+		},
+		*clientConn,
+	)
+	return nil
+}
+
+func (h *sshHandler) initiateSSHConn(ctx context.Context, targetConn net.Conn, user string, agent *sshAgent) (*sshConn, error) {
+	target := h.cfg.target
+	clientConfig, err := h.cfg.sshProvider.sessionSSHConfig(ctx, target, user, agent)
+	if err != nil {
+		return nil, trace.Wrap(err, "building SSH client config")
+	}
+	clientConn, clientChans, clientReqs, err := tracessh.NewClientConnWithTimeout(ctx, targetConn, target.addr, clientConfig)
+	if err != nil {
+		return nil, trace.Wrap(err, "initiating SSH connection to %s@%s", user, target.addr)
+	}
+	log.DebugContext(ctx, "Initiated SSH connection to target", "root_cluster", target.rootCluster,
+		"leaf_cluster", target.leafCluster, "host", target.addr)
+	return &sshConn{
+		conn:  clientConn,
+		chans: clientChans,
+		reqs:  clientReqs,
+	}, nil
+}
+
+func newHostCert(fqdn string, ca ssh.Signer) (ssh.Signer, error) {
+	// If the user typed "ssh host.com" or "ssh host.com." our DNS handler will
+	// only see the fully-qualified variant with the trailing "." but the SSH
+	// client treats them differently, we need both in the principals if we want
+	// the cert to be trusted in both cases.
+	validPrincipals := []string{
+		fqdn,
+		strings.TrimSuffix(fqdn, "."),
+	}
+	// We generate an ephemeral key for every connection, Ed25519 is fast and
+	// well supported.
+	hostKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	if err != nil {
+		return nil, trace.Wrap(err, "generating SSH host key")
+	}
+	hostSigner, err := ssh.NewSignerFromSigner(hostKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cert := &ssh.Certificate{
+		Key:             hostSigner.PublicKey(),
+		Serial:          1,
+		CertType:        ssh.HostCert,
+		ValidPrincipals: validPrincipals,
+		// This cert will only ever be used to handle this one SSH connection,
+		// the private key is held only in memory, the issuing CA is regenerated
+		// every time this process restarts and will only be trusted on this one
+		// host. The expiry doesn't matter.
+		ValidBefore: ssh.CertTimeInfinity,
+	}
+	if err := cert.SignCert(rand.Reader, ca); err != nil {
+		return nil, trace.Wrap(err, "signing SSH host cert")
+	}
+	certSigner, err := ssh.NewCertSigner(cert, hostSigner)
+	return certSigner, trace.Wrap(err)
+}
+
+func formatBannerMessage(msg string) string {
+	return "VNet: " + msg + "\n"
+}
diff --git a/lib/vnet/ssh_provider.go b/lib/vnet/ssh_provider.go
new file mode 100644
index 0000000000000..2584794cf2b75
--- /dev/null
+++ b/lib/vnet/ssh_provider.go
@@ -0,0 +1,295 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"cmp"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"golang.org/x/crypto/ssh"
+
+	proxyclient "github.com/gravitational/teleport/api/client/proxy"
+	"github.com/gravitational/teleport/api/utils/sshutils"
+	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+)
+
+// sshProvider provides methods necessary for VNet SSH access.
+type sshProvider struct {
+	cfg sshProviderConfig
+	// hostCASigner is the host CA key used internally in VNet to terminate
+	// connections from clients, it is not a Teleport CA used by any cluster.
+	hostCASigner         ssh.Signer
+	trustedUserPublicKey ssh.PublicKey
+}
+
+type sshProviderConfig struct {
+	clt   *clientApplicationServiceClient
+	clock clockwork.Clock
+	// overrideNodeDialer can be used in tests to dial SSH nodes with the real
+	// TLS configuration but without setting up the proxy transport service.
+	overrideNodeDialer func(
+		ctx context.Context,
+		target dialTarget,
+		tlsConfig *tls.Config,
+		dialOpts *vnetv1.DialOptions,
+		agent *sshAgent,
+	) (net.Conn, error)
+}
+
+func newSSHProvider(ctx context.Context, cfg sshProviderConfig) (*sshProvider, error) {
+	hostCAKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	hostCASigner, err := ssh.NewSignerFromSigner(hostCAKey)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	trustedUserPublicKey, err := cfg.clt.ExchangeSSHKeys(ctx, hostCASigner.PublicKey())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &sshProvider{
+		cfg:                  cfg,
+		hostCASigner:         hostCASigner,
+		trustedUserPublicKey: trustedUserPublicKey,
+	}, nil
+}
+
+// dial dials the target SSH host.
+func (p *sshProvider) dial(ctx context.Context, target dialTarget, agent *sshAgent) (net.Conn, error) {
+	userTLSCertResp, err := p.cfg.clt.UserTLSCert(ctx, target.profile)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	rawCert := userTLSCertResp.GetCert()
+	dialOpts := userTLSCertResp.GetDialOptions()
+	tlsConfig, err := p.userTLSConfig(ctx, target.profile, rawCert, dialOpts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if p.cfg.overrideNodeDialer != nil {
+		conn, err := p.cfg.overrideNodeDialer(ctx, target, tlsConfig, dialOpts, agent)
+		return conn, trace.Wrap(err)
+	}
+	return p.dialViaProxy(ctx, target, tlsConfig, dialOpts, agent)
+}
+
+// dialViaProxy dials the target SSH host via the proxy transport service.
+func (p *sshProvider) dialViaProxy(
+	ctx context.Context,
+	target dialTarget,
+	tlsConfig *tls.Config,
+	dialOpts *vnetv1.DialOptions,
+	agent *sshAgent,
+) (net.Conn, error) {
+	// TODO(nklaassen): consider reusing proxy clients, need to figure out when
+	// it's necessary to make a new client e.g. if the user's TLS credentials
+	// are replaced by a relogin. For now it's simpler to make a new client for
+	// every SSH dial.
+	pclt, err := proxyclient.NewClient(ctx, proxyclient.ClientConfig{
+		ProxyAddress:            dialOpts.GetWebProxyAddr(),
+		TLSConfigFunc:           func(cluster string) (*tls.Config, error) { return tlsConfig, nil },
+		ALPNConnUpgradeRequired: dialOpts.GetAlpnConnUpgradeRequired(),
+		InsecureSkipVerify:      dialOpts.GetInsecureSkipVerify(),
+		// This empty SSH client config should never be used, we dial to the
+		// proxy over TLS only.
+		SSHConfig: &ssh.ClientConfig{},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err, "building proxy client")
+	}
+	// Forward an SSH agent in case proxy recording mode is enabled in the cluster.
+	// At this point there is no SSH key for the user yet and the agent is
+	// empty, the SSH key will be added to the agent in [sshProvider.sessionSSHConfig].
+	// This forwarded agent will be used only to make the next SSH connection
+	// to the target SSH node, it is not actually forwarded to the target node
+	// and does not prevent the client from forwarding its own agent if
+	// requested.
+	conn, _, err := pclt.DialHost(ctx, target.addr, target.cluster, agent)
+	if err != nil {
+		pclt.Close()
+		return nil, trace.Wrap(err, "dialing target via proxy")
+	}
+	// Make sure to close the proxy client, but not until we're done with the
+	// target connection or else it would close the underlying gRPC stream.
+	conn = newConnWithExtraCloser(conn, pclt.Close)
+	return conn, nil
+}
+
+func (p *sshProvider) userTLSConfig(
+	ctx context.Context,
+	profile string,
+	rawCert []byte,
+	dialOpts *vnetv1.DialOptions,
+) (*tls.Config, error) {
+	parsedCert, err := x509.ParseCertificate(rawCert)
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing user TLS certificate")
+	}
+	signer := &rpcSigner{
+		pub: parsedCert.PublicKey,
+		sendRequest: func(req *vnetv1.SignRequest) ([]byte, error) {
+			return p.cfg.clt.SignForUserTLS(ctx, &vnetv1.SignForUserTLSRequest{
+				Profile: profile,
+				Sign:    req,
+			})
+		},
+	}
+	tlsCert := tls.Certificate{
+		Certificate: [][]byte{rawCert},
+		PrivateKey:  signer,
+	}
+	caPool := x509.NewCertPool()
+	if !caPool.AppendCertsFromPEM(dialOpts.GetRootClusterCaCertPool()) {
+		return nil, trace.Errorf("failed to parse root cluster CA cert pool")
+	}
+	return &tls.Config{
+		Certificates:       []tls.Certificate{tlsCert},
+		RootCAs:            caPool,
+		ServerName:         dialOpts.GetSni(),
+		InsecureSkipVerify: dialOpts.GetInsecureSkipVerify(),
+	}, nil
+}
+
+func (p *sshProvider) sessionSSHConfig(
+	ctx context.Context,
+	target dialTarget,
+	user string,
+	agent *sshAgent,
+) (*ssh.ClientConfig, error) {
+	// TODO(nklaassen): cache session SSH configs so we don't have to regenerate
+	// every time.
+	resp, err := p.cfg.clt.SessionSSHConfig(ctx, target, user)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sshPub, err := ssh.ParsePublicKey(resp.GetCert())
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing session SSH cert")
+	}
+	sshCert, ok := sshPub.(*ssh.Certificate)
+	if !ok {
+		return nil, trace.BadParameter("expected ssh.Certificate, got %T", sshCert)
+	}
+	cryptoPub, ok := sshCert.Key.(ssh.CryptoPublicKey)
+	if !ok {
+		return nil, trace.BadParameter("expected SSH key to implement CryptoPublicKey, got %T", sshCert.Key)
+	}
+	sessionID := resp.GetSessionId()
+	signer := &rpcSigner{
+		pub: cryptoPub.CryptoPublicKey(),
+		sendRequest: func(req *vnetv1.SignRequest) ([]byte, error) {
+			return p.cfg.clt.SignForSSHSession(ctx, sessionID, req)
+		},
+	}
+	sshSigner, err := ssh.NewSignerFromSigner(signer)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	certSigner, err := ssh.NewCertSigner(sshCert, sshSigner)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Add the session SSH key to the SSH agent in case proxy recording mode is
+	// enabled. Adding it to the agent here before returning an
+	// ssh.ClientConfig guarantees the key is added to the agent before the
+	// agent could be used.
+	if err := agent.setSessionKey(certSigner); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	hostKeyCallback, err := buildHostKeyCallback(resp.GetTrustedCas(), p.cfg.clock)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &ssh.ClientConfig{
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(certSigner)},
+		User:            user,
+		HostKeyCallback: hostKeyCallback,
+	}, nil
+}
+
+func buildHostKeyCallback(trustedCAs [][]byte, clock clockwork.Clock) (ssh.HostKeyCallback, error) {
+	var caKeys []ssh.PublicKey
+	for _, trustedCA := range trustedCAs {
+		caKey, err := ssh.ParsePublicKey(trustedCA)
+		if err != nil {
+			return nil, trace.Wrap(err, "parsing trusted CA key")
+		}
+		caKeys = append(caKeys, caKey)
+	}
+	hostKeyCallback, err := sshutils.NewHostKeyCallback(sshutils.HostKeyCallbackConfig{
+		GetHostCheckers: func() ([]ssh.PublicKey, error) {
+			return caKeys, nil
+		},
+		Clock: clock,
+	})
+	return hostKeyCallback, trace.Wrap(err, "building host key callback")
+}
+
+type dialTarget struct {
+	fqdn        string
+	profile     string
+	rootCluster string
+	leafCluster string
+	cluster     string
+	hostname    string
+	addr        string
+}
+
+func computeDialTarget(matchedCluster *vnetv1.MatchedCluster, fqdn string) dialTarget {
+	// matchedCluster.LeafCluster will be set if the host was in a leaf
+	// cluster, else it will be unset and the target cluster is the root.
+	targetCluster := cmp.Or(matchedCluster.GetLeafCluster(), matchedCluster.GetRootCluster())
+	targetHost := strings.TrimSuffix(fqdn, "."+fullyQualify(targetCluster))
+	return dialTarget{
+		fqdn:        fqdn,
+		profile:     matchedCluster.GetProfile(),
+		rootCluster: matchedCluster.GetRootCluster(),
+		leafCluster: matchedCluster.GetLeafCluster(),
+		cluster:     targetCluster,
+		hostname:    targetHost,
+		addr:        targetHost + ":0",
+	}
+}
+
+// connWithExtraCloser embeds a net.Conn and overrides the Close method to close
+// an extra closer. Useful when the lifetime of a client providing the net.Conn
+// must be tied to the lifetime of the Conn.
+type connWithExtraCloser struct {
+	net.Conn
+	extraCloser func() error
+}
+
+func newConnWithExtraCloser(conn net.Conn, extraCloser func() error) *connWithExtraCloser {
+	return &connWithExtraCloser{
+		Conn:        conn,
+		extraCloser: extraCloser,
+	}
+}
+
+// Close closes the net.Conn and the extra closer.
+func (c *connWithExtraCloser) Close() error {
+	return trace.NewAggregate(c.Conn.Close(), c.extraCloser())
+}
diff --git a/lib/vnet/ssh_proxy.go b/lib/vnet/ssh_proxy.go
index 35c1f44e17b13..df82175c25fd7 100644
--- a/lib/vnet/ssh_proxy.go
+++ b/lib/vnet/ssh_proxy.go
@@ -19,12 +19,12 @@ package vnet
 import (
 	"context"
 	"errors"
+	"io"
 	"log/slog"
 	"sync"
 
+	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport/lib/utils"
 )
 
 // sshConn represents an established SSH client or server connection.
@@ -34,6 +34,16 @@ type sshConn struct {
 	reqs  <-chan *ssh.Request
 }
 
+// Close closes the connection and drains all channels.
+func (c *sshConn) Close() error {
+	err := trace.Wrap(c.conn.Close())
+	go ssh.DiscardRequests(c.reqs)
+	for newChan := range c.chans {
+		newChan.Reject(0, "")
+	}
+	return err
+}
+
 // proxySSHConnection transparently proxies SSH channels and requests
 // between 2 established SSH connections. serverConn represents an incoming SSH
 // connection where this proxy acts as a server, client represents an outgoing
@@ -44,8 +54,8 @@ func proxySSHConnection(
 	clientConn sshConn,
 ) {
 	closeConnections := sync.OnceFunc(func() {
-		clientConn.conn.Close()
-		serverConn.conn.Close()
+		clientConn.Close()
+		serverConn.Close()
 	})
 	// Close both connections if the context is canceled.
 	stop := context.AfterFunc(ctx, closeConnections)
@@ -160,60 +170,134 @@ func proxyChannel(
 		return
 	}
 
-	// Copy channel requests in both directions concurrently. If either fails or
-	// exits it will cancel the context so that utils.ProxyConn below will close
-	// both channels so the other goroutine can also exit.
+	// Copy channel data and requests from the incoming channel to the target
+	// channel, and vice-versa.
+	target := newSSHChan(targetChan, targetChanRequests, slog.With("direction", "client->target"))
+	incoming := newSSHChan(incomingChan, incomingChanRequests, slog.With("direction", "target->client"))
+
 	var wg sync.WaitGroup
 	wg.Add(2)
-	ctx, cancel := context.WithCancel(ctx)
 	go func() {
-		proxyChannelRequests(ctx, log, targetChan, incomingChanRequests, cancel)
-		cancel()
+		target.writeFrom(ctx, incoming)
 		wg.Done()
 	}()
 	go func() {
-		proxyChannelRequests(ctx, log, incomingChan, targetChanRequests, cancel)
-		cancel()
+		incoming.writeFrom(ctx, target)
 		wg.Done()
 	}()
+	wg.Wait()
+}
 
-	// ProxyConn copies channel data bidirectionally. If the context is
-	// canceled it will terminate, it always closes both channels before
-	// returning.
-	if err := utils.ProxyConn(ctx, incomingChan, targetChan); err != nil &&
-		!utils.IsOKNetworkError(err) && !errors.Is(err, context.Canceled) {
-		log.DebugContext(ctx, "Unexpected error proxying channel data", "error", err)
+// sshChan manages all writes to an SSH channel and handles closing the channel
+// once no more data or requests will be written to it.
+type sshChan struct {
+	ch       ssh.Channel
+	requests <-chan *ssh.Request
+	log      *slog.Logger
+}
+
+func newSSHChan(ch ssh.Channel, requests <-chan *ssh.Request, log *slog.Logger) *sshChan {
+	return &sshChan{
+		ch:       ch,
+		requests: requests,
+		log:      log,
 	}
+}
 
-	// Wait for all goroutines to terminate.
+// writeFrom writes channel data and requests from the source to this SSH channel.
+//
+// In the happy path it waits for:
+// - channel data reads from source to return EOF
+// - the source request channel to be closed
+// and then closes this channel.
+//
+// Channel data reads from source can return EOF at any time if it has sent
+// SSH_MSG_CHANNEL_EOF but it is still valid to send more channel requests
+// after this.
+//
+// If an unrecoverable error is encountered it immediately closes both
+// channels.
+func (c *sshChan) writeFrom(ctx context.Context, source *sshChan) {
+	// Close the channel after all data and request writes are complete.
+	defer c.ch.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		c.writeDataFrom(ctx, source)
+		wg.Done()
+	}()
+	go func() {
+		c.writeRequestsFrom(ctx, source)
+		wg.Done()
+	}()
 	wg.Wait()
 }
 
-func proxyChannelRequests(
-	ctx context.Context,
-	log *slog.Logger,
-	targetChan ssh.Channel,
-	reqs <-chan *ssh.Request,
-	closeChannels func(),
-) {
-	log = log.With("request_layer", "channel")
+// writeDataFrom writes channel data from source to this SSH channel.
+// It handles standard channel data and extended channel data of type stderr.
+func (c *sshChan) writeDataFrom(ctx context.Context, source *sshChan) {
+	// Close the channel for writes only after both the standard and stderr
+	// streams are finished writing.
+	defer c.ch.CloseWrite()
+
+	errors := make(chan error, 2)
+	go func() {
+		_, err := io.Copy(c.ch, source.ch)
+		errors <- err
+	}()
+	go func() {
+		_, err := io.Copy(c.ch.Stderr(), source.ch.Stderr())
+		errors <- err
+	}()
+
+	// Read both errors to make sure both goroutines terminate, but only do
+	// anything on the first non-nil error, the second error is likely either
+	// the same as the first one or caused by closing the channel.
+	handledError := false
+	for range 2 {
+		err := <-errors
+		if err != nil && !handledError {
+			handledError = true
+			// Failed to write channel data from source to this channel. This was
+			// not an EOF from source or io.Copy would have returned nil. The
+			// stream might be missing data so close both channels.
+			//
+			// This should also unblock the stderr stream if the regular stream
+			// returned an error, and vice-versa.
+			c.log.ErrorContext(ctx, "Fatal error proxying SSH channel data", "error", err)
+			c.ch.Close()
+			source.ch.Close()
+		}
+	}
+}
+
+// writeRequestsFrom forwards channel requests from source to this SSH channel.
+func (c *sshChan) writeRequestsFrom(ctx context.Context, source *sshChan) {
+	log := c.log.With("request_layer", "channel")
 	sendRequest := func(name string, wantReply bool, payload []byte) (bool, []byte, error) {
-		ok, err := targetChan.SendRequest(name, wantReply, payload)
+		ok, err := c.ch.SendRequest(name, wantReply, payload)
 		// Replies to channel requests never have a payload.
 		return ok, nil, err
 	}
-	proxyRequests(ctx, log, sendRequest, reqs, closeChannels)
+	// Must forcibly close both channels if there was a fatal error proxying
+	// channel requests so that we don't continue in a bad state.
+	onFatalError := func() {
+		c.ch.Close()
+		source.ch.Close()
+	}
+	proxyRequests(ctx, log, sendRequest, source.requests, onFatalError)
 }
 
 func proxyGlobalRequests(
 	ctx context.Context,
 	targetConn ssh.Conn,
 	reqs <-chan *ssh.Request,
-	closeConnections func(),
+	onFatalError func(),
 ) {
 	log := log.With("request_layer", "global")
 	sendRequest := targetConn.SendRequest
-	proxyRequests(ctx, log, sendRequest, reqs, closeConnections)
+	proxyRequests(ctx, log, sendRequest, reqs, onFatalError)
 }
 
 func proxyRequests(
@@ -221,7 +305,7 @@ func proxyRequests(
 	log *slog.Logger,
 	sendRequest func(name string, wantReply bool, payload []byte) (bool, []byte, error),
 	reqs <-chan *ssh.Request,
-	closeRequestSources func(),
+	onFatalError func(),
 ) {
 	for req := range reqs {
 		log := log.With("request_type", req.Type)
@@ -229,23 +313,20 @@ func proxyRequests(
 		ok, reply, err := sendRequest(req.Type, req.WantReply, req.Payload)
 		if err != nil {
 			// We failed to send the request, the target must be dead.
-			log.DebugContext(ctx, "Failed to forward SSH request", "request_type", req.Type, "error", err)
-			// Close both connections or channels to clean up but we must
-			// continue handling requests on the chan until it is closed by
-			// crypto/ssh.
-			closeRequestSources()
-			_ = req.Reply(false, nil)
-			continue
+			log.DebugContext(ctx, "Failed to forward SSH request", "error", err)
+			onFatalError()
+			req.Reply(false, nil)
+			ssh.DiscardRequests(reqs)
+			return
 		}
 		if err := req.Reply(ok, reply); err != nil {
 			// A reply was expected and returned by the target but we failed to
 			// forward it back, the connection that initiated the request must
 			// be dead.
-			log.DebugContext(ctx, "Failed to reply to SSH request", "request_type", req.Type, "error", err)
-			// Close both connections or channels to clean up but we must
-			// continue handling requests on the chan until it is closed by
-			// crypto/ssh.
-			closeRequestSources()
+			log.DebugContext(ctx, "Failed to reply to SSH request", "error", err)
+			onFatalError()
+			ssh.DiscardRequests(reqs)
+			return
 		}
 	}
 }
diff --git a/lib/vnet/ssh_proxy_test.go b/lib/vnet/ssh_proxy_test.go
index cca3f6a72862a..d7eb8313c8a11 100644
--- a/lib/vnet/ssh_proxy_test.go
+++ b/lib/vnet/ssh_proxy_test.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"sync"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -30,7 +31,7 @@ import (
 	"google.golang.org/grpc/test/bufconn"
 
 	"github.com/gravitational/teleport/lib/cryptosuites"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 // TestProxySSHConnection exercises [proxySSHConnection] to test that it
@@ -56,7 +57,7 @@ func TestProxySSHConnection(t *testing.T) {
 
 	proxyClientConfig := sshClientConfig(t)
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "target server",
 		Task: func(ctx context.Context) error {
 			return runTestSSHServer(serverListener, targetServerConfig)
@@ -65,7 +66,7 @@ func TestProxySSHConnection(t *testing.T) {
 			return trace.Wrap(serverListener.Close())
 		},
 	})
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "proxy server",
 		Task: func(ctx context.Context) error {
 			return runTestSSHProxy(ctx,
@@ -103,11 +104,22 @@ func testSSHConnection(t *testing.T, dial dialer) {
 	sshConn, chans, reqs, err := ssh.NewClientConn(tcpConn, "localhost", clientConfig)
 	require.NoError(t, err)
 	defer sshConn.Close()
-	go ssh.DiscardRequests(reqs)
+
+	testConnectionToSshEchoServer(t, sshConn, chans, reqs)
+}
+
+func testConnectionToSshEchoServer(t *testing.T, sshConn ssh.Conn, chans <-chan ssh.NewChannel, reqs <-chan *ssh.Request) {
+	requestStreamEnded := make(chan struct{})
+	go func() {
+		ssh.DiscardRequests(reqs)
+		close(requestStreamEnded)
+	}()
+	chanStreamEnded := make(chan struct{})
 	go func() {
 		for newChan := range chans {
 			newChan.Reject(ssh.Prohibited, "test")
 		}
+		close(chanStreamEnded)
 	}()
 
 	// Try sending some global requests.
@@ -131,6 +143,26 @@ func testSSHConnection(t *testing.T, dial dialer) {
 	t.Run("echo channel 2", func(t *testing.T) {
 		testEchoChannel(t, sshConn)
 	})
+
+	t.Run("closing", func(t *testing.T) {
+		// Send a request that causes the target server to close the connection
+		// immediately and make sure channel reads are unblocked, and the global
+		// request and channel request streams end.
+		ch, reqs, err := sshConn.OpenChannel("echo", nil)
+		require.NoError(t, err)
+		go ssh.DiscardRequests(reqs)
+		readErr := make(chan error)
+		go func() {
+			var b [1]byte
+			_, err := ch.Read(b[:])
+			readErr <- err
+		}()
+		_, _, err = sshConn.SendRequest("close", false, nil)
+		require.NoError(t, err)
+		require.ErrorIs(t, <-readErr, io.EOF)
+		<-requestStreamEnded
+		<-chanStreamEnded
+	})
 }
 
 func testGlobalRequests(t *testing.T, conn ssh.Conn) {
@@ -151,7 +183,11 @@ func testGlobalRequests(t *testing.T, conn ssh.Conn) {
 func testEchoChannel(t *testing.T, conn ssh.Conn) {
 	ch, reqs, err := conn.OpenChannel("echo", nil)
 	require.NoError(t, err)
-	go ssh.DiscardRequests(reqs)
+	requestStreamEnded := make(chan struct{})
+	go func() {
+		ssh.DiscardRequests(reqs)
+		close(requestStreamEnded)
+	}()
 	defer ch.Close()
 
 	// Try sending a message over the SSH channel and asserting that it is
@@ -165,16 +201,43 @@ func testEchoChannel(t *testing.T, conn ssh.Conn) {
 	require.Equal(t, len(msg), n)
 	require.Equal(t, msg, buf[:n])
 
+	// Try sending a message over stderr and asserting that it is echoed back.
+	_, err = ch.Stderr().Write(msg)
+	require.NoError(t, err)
+	n, err = ch.Stderr().Read(buf[:])
+	require.NoError(t, err)
+	require.Equal(t, len(msg), n)
+	require.Equal(t, msg, buf[:n])
+
 	// Try sending a channel request that expects a reply.
 	reply, err := ch.SendRequest("echo", true, nil)
 	require.NoError(t, err)
 	require.True(t, reply)
 
+	// Close the channel for writes of in-band data and send another channel
+	// request, which should succeed.
+	require.NoError(t, ch.CloseWrite())
+	reply, err = ch.SendRequest("echo", true, nil)
+	require.NoError(t, err)
+	require.True(t, reply)
+
 	// The test server replies false to channel requests with type other than
 	// "echo".
 	reply, err = ch.SendRequest("unknown", true, nil)
 	require.NoError(t, err)
 	require.False(t, reply)
+
+	// Send a channel request that causes the server to close the channel and
+	// make sure channel reads get unblocked and the incoming request stream ends.
+	readErr := make(chan error)
+	go func() {
+		_, err := ch.Read(buf[:])
+		readErr <- err
+	}()
+	_, err = ch.SendRequest("close", false, nil)
+	require.NoError(t, err)
+	require.ErrorIs(t, <-readErr, io.EOF)
+	<-requestStreamEnded
 }
 
 type dialer interface {
@@ -277,7 +340,7 @@ func runTestSSHServerInstance(tcpConn net.Conn, cfg *ssh.ServerConfig) error {
 		return trace.Wrap(err)
 	}
 	go func() {
-		handleEchoRequests(reqs)
+		handleSSHRequests(reqs, sshConn.Close)
 		sshConn.Close()
 	}()
 	handleEchoChannels(chans)
@@ -285,17 +348,6 @@ func runTestSSHServerInstance(tcpConn net.Conn, cfg *ssh.ServerConfig) error {
 	return nil
 }
 
-func handleEchoRequests(reqs <-chan *ssh.Request) {
-	for req := range reqs {
-		switch req.Type {
-		case "echo":
-			req.Reply(true, req.Payload)
-		default:
-			req.Reply(false, nil)
-		}
-	}
-}
-
 func handleEchoChannels(chans <-chan ssh.NewChannel) {
 	for newChan := range chans {
 		switch newChan.ChannelType() {
@@ -312,8 +364,33 @@ func handleEchoChannel(newChan ssh.NewChannel) {
 	if err != nil {
 		return
 	}
-	go handleEchoRequests(reqs)
-	io.Copy(ch, ch)
+	go handleSSHRequests(reqs, ch.Close)
+	defer ch.CloseWrite()
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		io.Copy(ch, ch)
+		wg.Done()
+	}()
+	go func() {
+		io.Copy(ch.Stderr(), ch.Stderr())
+		wg.Done()
+	}()
+	wg.Wait()
+}
+
+func handleSSHRequests(reqs <-chan *ssh.Request, closeSource func() error) {
+	defer closeSource()
+	for req := range reqs {
+		switch req.Type {
+		case "echo":
+			req.Reply(true, req.Payload)
+		case "close":
+			closeSource()
+		default:
+			req.Reply(false, nil)
+		}
+	}
 }
 
 func sshServerConfig(t *testing.T) *ssh.ServerConfig {
diff --git a/lib/vnet/tcp_handler_resolver.go b/lib/vnet/tcp_handler_resolver.go
index 6274e42eb19f2..ff679b48eb2d6 100644
--- a/lib/vnet/tcp_handler_resolver.go
+++ b/lib/vnet/tcp_handler_resolver.go
@@ -37,9 +37,11 @@ type tcpHandlerResolver struct {
 }
 
 type tcpHandlerResolverConfig struct {
-	clt         *clientApplicationServiceClient
-	appProvider *appProvider
-	clock       clockwork.Clock
+	clt                      *clientApplicationServiceClient
+	appProvider              *appProvider
+	sshProvider              *sshProvider
+	clock                    clockwork.Clock
+	alwaysTrustRootClusterCA bool
 }
 
 func newTCPHandlerResolver(cfg *tcpHandlerResolverConfig) *tcpHandlerResolver {
@@ -67,9 +69,10 @@ func (r *tcpHandlerResolver) resolveTCPHandler(ctx context.Context, fqdn string)
 		return &tcpHandlerSpec{
 			ipv4CIDRRange: appInfo.GetIpv4CidrRange(),
 			tcpHandler: newTCPAppHandler(&tcpAppHandlerConfig{
-				appInfo:     appInfo,
-				appProvider: r.cfg.appProvider,
-				clock:       r.cfg.clock,
+				appInfo:                  appInfo,
+				appProvider:              r.cfg.appProvider,
+				clock:                    r.cfg.clock,
+				alwaysTrustRootClusterCA: r.cfg.alwaysTrustRootClusterCA,
 			}),
 		}, nil
 	}
@@ -85,11 +88,9 @@ func (r *tcpHandlerResolver) resolveTCPHandler(ctx context.Context, fqdn string)
 		// TCP connection if this may match an SSH node or an app that may be
 		// added later so we return an undecidedHandler.
 		handler, err := newUndecidedHandler(&undecidedHandlerConfig{
-			clt:          r.cfg.clt,
-			appProvider:  r.cfg.appProvider,
-			clock:        r.cfg.clock,
-			fqdn:         fqdn,
-			webProxyAddr: matchedCluster.GetWebProxyAddr(),
+			tcpHandlerResolverConfig: r.cfg,
+			fqdn:                     fqdn,
+			webProxyAddr:             matchedCluster.GetWebProxyAddr(),
 		})
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -118,9 +119,7 @@ type undecidedHandler struct {
 }
 
 type undecidedHandlerConfig struct {
-	clt          *clientApplicationServiceClient
-	appProvider  *appProvider
-	clock        clockwork.Clock
+	*tcpHandlerResolverConfig
 	fqdn         string
 	webProxyAddr string
 }
@@ -163,14 +162,16 @@ func (h *undecidedHandler) handleTCPConnector(ctx context.Context, localPort uin
 	if err != nil {
 		return trace.Wrap(err, "resolving target in undecidedHandler")
 	}
+	log := log.With("fqdn", h.cfg.fqdn)
 	if matchedTCPApp := resp.GetMatchedTcpApp(); matchedTCPApp != nil {
 		// If matched a TCP app, build a tcpAppHandler that will be used for this
 		// and all subsequent connections to this address.
-		log.DebugContext(ctx, "Resolved FQDN to a matched TCP app", "fqdn", h.cfg.fqdn)
+		log.DebugContext(ctx, "Resolved FQDN to a matched TCP app")
 		tcpAppHandler := newTCPAppHandler(&tcpAppHandlerConfig{
-			appInfo:     matchedTCPApp.GetAppInfo(),
-			appProvider: h.cfg.appProvider,
-			clock:       h.cfg.clock,
+			appInfo:                  matchedTCPApp.GetAppInfo(),
+			appProvider:              h.cfg.appProvider,
+			clock:                    h.cfg.clock,
+			alwaysTrustRootClusterCA: h.cfg.alwaysTrustRootClusterCA,
 		})
 		h.setDecidedHandler(tcpAppHandler)
 		return tcpAppHandler.handleTCPConnector(ctx, localPort, connector)
@@ -178,13 +179,38 @@ func (h *undecidedHandler) handleTCPConnector(ctx context.Context, localPort uin
 	if matchedWebApp := resp.GetMatchedWebApp(); matchedWebApp != nil && localPort == h.webProxyPort {
 		// If matched a web app, build a webAppHandler that will be used for this
 		// and all subsequent connections to this address.
-		log.DebugContext(ctx, "Resolved FQDN to a matched web app", "fqdn", h.cfg.fqdn)
+		log.DebugContext(ctx, "Resolved FQDN to a matched web app")
 		webAppHandler := newWebAppHandler(h.cfg.webProxyAddr, h.webProxyPort)
 		h.setDecidedHandler(webAppHandler)
 		return webAppHandler.handleTCPConnector(ctx, localPort, connector)
 	}
 	if matchedCluster := resp.GetMatchedCluster(); matchedCluster != nil && localPort == 22 {
-		return trace.NotImplemented("SSH connection forwarding not yet implemented")
+		// Matched a cluster, this FQDN could potentially match an SSH node.
+		log.DebugContext(ctx, "Resolved FQDN to a matched cluster")
+		// Attempt a dial to the target SSH node to see if it exists.
+		target := computeDialTarget(matchedCluster, h.cfg.fqdn)
+		agent := newSSHAgent()
+		targetConn, err := h.cfg.sshProvider.dial(ctx, target, agent)
+		if err != nil {
+			if trace.IsConnectionProblem(err) {
+				log.DebugContext(ctx, "Failed TCP dial to target, node might be offline")
+				return nil
+			}
+			return trace.Wrap(err, "unexpected error TCP dialing to target node at %s", h.cfg.fqdn)
+		}
+		defer targetConn.Close()
+		log.DebugContext(ctx, "TCP dial to target SSH node succeeded", "fqdn", h.cfg.fqdn)
+		// Now that we know there is a matching SSH node, this handler will
+		// permanently handle SSH connections at this address and avoid app
+		// queries on subsequent connections.
+		sshHandler := newSSHHandler(sshHandlerConfig{
+			sshProvider: h.cfg.sshProvider,
+			target:      target,
+		})
+		h.setDecidedHandler(sshHandler)
+		// Handle the incoming connection with the TCP connection to the target
+		// SSH node that has already been established.
+		return sshHandler.handleTCPConnectorWithTargetConn(ctx, connector, targetConn, agent)
 	}
 	return trace.Errorf("rejecting connection to %s:%d", h.cfg.fqdn, localPort)
 }
diff --git a/lib/vnet/unified_cluster_config_provider.go b/lib/vnet/unified_cluster_config_provider.go
new file mode 100644
index 0000000000000..bb6cdf1f4f470
--- /dev/null
+++ b/lib/vnet/unified_cluster_config_provider.go
@@ -0,0 +1,152 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"slices"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/utils"
+)
+
+// UnifiedClusterConfig is a unified VNet configuration for all clusters
+// the user is logged in to.
+type UnifiedClusterConfig struct {
+	// ClusterNames contains the name of each root or leaf cluster the user is
+	// logged in to. SSH hosts are reachable via VNet SSH at subdomains of
+	// these cluster names.
+	ClusterNames []string
+	// ProxyPublicAddrs contains the proxy public address of root and leaf
+	// cluster the user is logged in to. These are always valid DNS suffixes for
+	// TCP apps.
+	ProxyPublicAddrs []string
+	// CustomDNSZones is the unified set of custom DNS zones configured in all clusters.
+	CustomDNSZones []string
+	// IPv4CidrRanges is the unified set of IPv4 CIDR ranges configured in all
+	// clusters, VNet will try to route all of these to the TUN interface.
+	IPv4CidrRanges []string
+}
+
+// AppDNSZones returns the DNS suffixes valid for TCP apps.
+func (c *UnifiedClusterConfig) AppDNSZones() []string {
+	return utils.Deduplicate(slices.Concat(c.CustomDNSZones, c.ProxyPublicAddrs))
+}
+
+// AllDNSZones return all DNS suffixes VNet handles.
+func (c *UnifiedClusterConfig) AllDNSZones() []string {
+	return utils.Deduplicate(slices.Concat(c.CustomDNSZones, c.ProxyPublicAddrs, c.ClusterNames))
+}
+
+// UnifiedClusterConfigProvider fetches the [UnifiedClusterConfig].
+type UnifiedClusterConfigProvider struct {
+	cfg *UnifiedClusterConfigProviderConfig
+}
+
+// UnifiedClusterConfigProviderConfig holds configuration parameters for
+// [UnifiedClusterConfigProvider].
+type UnifiedClusterConfigProviderConfig struct {
+	clientApplication  ClientApplication
+	clusterConfigCache *ClusterConfigCache
+	leafClusterCache   *leafClusterCache
+}
+
+// NewUnifiedClusterConfigProvider returns a new [UnifiedClusterConfigProvider].
+func NewUnifiedClusterConfigProvider(cfg *UnifiedClusterConfigProviderConfig) *UnifiedClusterConfigProvider {
+	return &UnifiedClusterConfigProvider{
+		cfg: cfg,
+	}
+}
+
+// GetUnifiedClusterConfig returns the unified VNet configuration of all
+// clusters the user is logged in to.
+func (p *UnifiedClusterConfigProvider) GetUnifiedClusterConfig(ctx context.Context) (*UnifiedClusterConfig, error) {
+	profiles, err := p.cfg.clientApplication.ListProfiles()
+	if err != nil {
+		return nil, trace.Wrap(err, "listing profiles")
+	}
+	var unifiedClusterConfig UnifiedClusterConfig
+	for _, profileName := range profiles {
+		if err := p.fetchForProfile(ctx, profileName, &unifiedClusterConfig); err != nil {
+			log.WarnContext(ctx,
+				"Failed to fetch VNet configuration, profile may be expired, not configuring VNet for this profile",
+				"profile", profileName, "error", err)
+		}
+	}
+	unifiedClusterConfig.ClusterNames = utils.Deduplicate(unifiedClusterConfig.ClusterNames)
+	unifiedClusterConfig.ProxyPublicAddrs = utils.Deduplicate(unifiedClusterConfig.ProxyPublicAddrs)
+	unifiedClusterConfig.CustomDNSZones = utils.Deduplicate(unifiedClusterConfig.CustomDNSZones)
+	unifiedClusterConfig.IPv4CidrRanges = utils.Deduplicate(unifiedClusterConfig.IPv4CidrRanges)
+	return &unifiedClusterConfig, nil
+}
+
+func (p *UnifiedClusterConfigProvider) fetchForProfile(
+	ctx context.Context,
+	profileName string,
+	unifiedClusterConfig *UnifiedClusterConfig,
+) error {
+	rootClusterClient, err := p.cfg.clientApplication.GetCachedClient(ctx, profileName, "" /*leafClusterName*/)
+	if err != nil {
+		return trace.Wrap(err, "getting root cluster client from cache")
+	}
+	rootClusterConfig, err := p.cfg.clusterConfigCache.GetClusterConfig(ctx, rootClusterClient)
+	if err != nil {
+		return trace.Wrap(err, "fetching root cluster VNet config")
+	}
+	unifiedClusterConfig.ClusterNames = append(unifiedClusterConfig.ClusterNames, rootClusterClient.ClusterName())
+	unifiedClusterConfig.ProxyPublicAddrs = append(unifiedClusterConfig.ProxyPublicAddrs, rootClusterConfig.ProxyPublicAddr)
+	unifiedClusterConfig.CustomDNSZones = append(unifiedClusterConfig.CustomDNSZones, rootClusterConfig.CustomDNSZones...)
+	unifiedClusterConfig.IPv4CidrRanges = append(unifiedClusterConfig.IPv4CidrRanges, rootClusterConfig.IPv4CIDRRange)
+
+	leafClusterNames, err := p.cfg.leafClusterCache.getLeafClusters(ctx, rootClusterClient)
+	if err != nil {
+		log.WarnContext(ctx,
+			"Failed to list leaf clusters, profile may be expired, not configuring VNet for leaf clusters in this profile",
+			"profile", profileName, "error", err)
+		return nil
+	}
+	for _, leafClusterName := range leafClusterNames {
+		if err := p.fetchForLeafCluster(ctx, profileName, leafClusterName, unifiedClusterConfig); err != nil {
+			log.WarnContext(ctx,
+				"Failed to fetch VNet configuration for leaf cluster, VNet will not be configured for this cluster",
+				"profile", profileName, "leaf_cluster", leafClusterName, "error", err)
+		}
+	}
+	return nil
+}
+
+func (p *UnifiedClusterConfigProvider) fetchForLeafCluster(
+	ctx context.Context,
+	profileName string,
+	leafClusterName string,
+	unifiedClusterConfig *UnifiedClusterConfig,
+) error {
+	leafClusterClient, err := p.cfg.clientApplication.GetCachedClient(ctx, profileName, leafClusterName)
+	if err != nil {
+		return trace.Wrap(err, "getting leaf cluster client from cache")
+	}
+	leafClusterConfig, err := p.cfg.clusterConfigCache.GetClusterConfig(ctx, leafClusterClient)
+	if err != nil {
+		return trace.Wrap(err, "fetching leaf cluster VNet config from cache")
+	}
+	unifiedClusterConfig.ClusterNames = append(unifiedClusterConfig.ClusterNames, leafClusterName)
+	unifiedClusterConfig.ProxyPublicAddrs = append(unifiedClusterConfig.ProxyPublicAddrs, leafClusterConfig.ProxyPublicAddr)
+	unifiedClusterConfig.CustomDNSZones = append(unifiedClusterConfig.CustomDNSZones, leafClusterConfig.CustomDNSZones...)
+	unifiedClusterConfig.IPv4CidrRanges = append(unifiedClusterConfig.IPv4CidrRanges, leafClusterConfig.IPv4CIDRRange)
+	return nil
+}
diff --git a/lib/vnet/unsupported_os.go b/lib/vnet/unsupported_os.go
index b21576076ff8a..a003fa6c4f4c3 100644
--- a/lib/vnet/unsupported_os.go
+++ b/lib/vnet/unsupported_os.go
@@ -44,4 +44,5 @@ var (
 	_ = (*osConfigurator).runOSConfigurationLoop
 	_ = runCommand
 	_ = newNetworkStackConfig
+	_ = (*networkStack).addDNSAddress
 )
diff --git a/lib/vnet/user_process.go b/lib/vnet/user_process.go
index e490a8c639405..b74a662d60098 100644
--- a/lib/vnet/user_process.go
+++ b/lib/vnet/user_process.go
@@ -25,6 +25,7 @@ import (
 
 	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/client"
 )
 
 // ClientApplication is the common interface implemented by each VNet client
@@ -45,16 +46,23 @@ type ClientApplication interface {
 	// ReissueAppCert issues a new cert for the target app.
 	ReissueAppCert(ctx context.Context, appInfo *vnetv1.AppInfo, targetPort uint16) (tls.Certificate, error)
 
+	// UserTLSCert returns the user TLS certificate for the given profile.
+	UserTLSCert(ctx context.Context, profileName string) (tls.Certificate, error)
+
 	// GetDialOptions returns ALPN dial options for the profile.
 	GetDialOptions(ctx context.Context, profileName string) (*vnetv1.DialOptions, error)
 
-	// OnNewConnection gets called whenever a new connection is about to be established through VNet.
-	// By the time OnNewConnection, VNet has already verified that the user holds a valid cert for the
+	// OnNewSSHSession should be called whenever a new SSH session is about to be
+	// started, after getting the user SSH certificate for the session.
+	OnNewSSHSession(ctx context.Context, profileName, rootClusterName string)
+
+	// OnNewAppConnection gets called whenever a new app connection is about to be established through VNet.
+	// By the time OnNewAppConnection, VNet has already verified that the user holds a valid cert for the
 	// app.
 	//
-	// The connection won't be established until OnNewConnection returns. Returning an error prevents
+	// The connection won't be established until OnNewAppConnection returns. Returning an error prevents
 	// the connection from being made.
-	OnNewConnection(ctx context.Context, appKey *vnetv1.AppKey) error
+	OnNewAppConnection(ctx context.Context, appKey *vnetv1.AppKey) error
 
 	// OnInvalidLocalPort gets called before VNet refuses to handle a connection to a multi-port TCP app
 	// because the provided port does not match any of the TCP ports in the app spec.
@@ -67,6 +75,7 @@ type ClusterClient interface {
 	CurrentCluster() authclient.ClientI
 	ClusterName() string
 	RootClusterName() string
+	SessionSSHKeyRing(ctx context.Context, user string, target client.NodeDetails) (keyRing *client.KeyRing, completedMFA bool, err error)
 }
 
 // RunUserProcess is the entry point called by all VNet client applications
@@ -93,23 +102,38 @@ func RunUserProcess(ctx context.Context, clientApplication ClientApplication) (*
 		clusterConfigCache: clusterConfigCache,
 		leafClusterCache:   leafClusterCache,
 	})
-	osConfigProvider := NewLocalOSConfigProvider(&LocalOSConfigProviderConfig{
+	unifiedClusterConfigProvider := NewUnifiedClusterConfigProvider(&UnifiedClusterConfigProviderConfig{
 		clientApplication:  clientApplication,
 		clusterConfigCache: clusterConfigCache,
 		leafClusterCache:   leafClusterCache,
 	})
-	clientApplicationService := newClientApplicationService(&clientApplicationServiceConfig{
-		clientApplication:     clientApplication,
-		fqdnResolver:          fqdnResolver,
-		localOSConfigProvider: osConfigProvider,
+	clientApplicationService, err := newClientApplicationService(&clientApplicationServiceConfig{
+		clientApplication:            clientApplication,
+		fqdnResolver:                 fqdnResolver,
+		unifiedClusterConfigProvider: unifiedClusterConfigProvider,
+		clock:                        clock,
 	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	processManager, processCtx := newProcessManager()
+	sshConfigurator := newSSHConfigurator(sshConfiguratorConfig{
+		clientApplication: clientApplication,
+		leafClusterCache:  leafClusterCache,
+	})
+	processManager.AddCriticalBackgroundTask("SSH configuration loop", func() error {
+		return trace.Wrap(sshConfigurator.runConfigurationLoop(processCtx))
+	})
+
 	userProcess := &UserProcess{
-		clientApplication:        clientApplication,
-		osConfigProvider:         osConfigProvider,
-		clientApplicationService: clientApplicationService,
-		clock:                    clock,
+		clientApplication:            clientApplication,
+		unifiedClusterConfigProvider: unifiedClusterConfigProvider,
+		clientApplicationService:     clientApplicationService,
+		clock:                        clock,
+		processManager:               processManager,
 	}
-	if err := userProcess.runPlatformUserProcess(ctx); err != nil {
+	if err := userProcess.runPlatformUserProcess(processCtx); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return userProcess, nil
@@ -120,9 +144,9 @@ func RunUserProcess(ctx context.Context, clientApplication ClientApplication) (*
 type UserProcess struct {
 	clientApplication ClientApplication
 
-	clock                    clockwork.Clock
-	osConfigProvider         *LocalOSConfigProvider
-	clientApplicationService *clientApplicationService
+	clock                        clockwork.Clock
+	unifiedClusterConfigProvider *UnifiedClusterConfigProvider
+	clientApplicationService     *clientApplicationService
 
 	processManager   *ProcessManager
 	networkStackInfo *vnetv1.NetworkStackInfo
@@ -143,6 +167,6 @@ func (p *UserProcess) NetworkStackInfo() *vnetv1.NetworkStackInfo {
 // GetTargetOSConfiguration returns the LocalOSConfigProvider which clients may
 // use to report the proxied DNS zones, run diagnostics, etc. The returned
 // *LocalOSConfigProvider will remain valid even if the UserProcess is closed.
-func (p *UserProcess) GetOSConfigProvider() *LocalOSConfigProvider {
-	return p.osConfigProvider
+func (p *UserProcess) GetUnifiedClusterConfigProvider() *UnifiedClusterConfigProvider {
+	return p.unifiedClusterConfigProvider
 }
diff --git a/lib/vnet/user_process_darwin.go b/lib/vnet/user_process_darwin.go
index a88f2313688a6..44c0d672470ab 100644
--- a/lib/vnet/user_process_darwin.go
+++ b/lib/vnet/user_process_darwin.go
@@ -35,7 +35,7 @@ import (
 // interface that the daemon uses to query application names and get user
 // certificates for apps. If successful it sets p.processManager and
 // p.networkStackInfo.
-func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
+func (p *UserProcess) runPlatformUserProcess(processCtx context.Context) error {
 	ipcCreds, err := newIPCCredentials()
 	if err != nil {
 		return trace.Wrap(err, "creating credentials for IPC")
@@ -67,16 +67,14 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 	)
 	vnetv1.RegisterClientApplicationServiceServer(grpcServer, p.clientApplicationService)
 
-	pm, processCtx := newProcessManager()
-	p.processManager = pm
-	pm.AddCriticalBackgroundTask("admin process", func() error {
+	p.processManager.AddCriticalBackgroundTask("admin process", func() error {
 		defer func() {
 			// Delete service credentials after the service terminates.
 			if ipcCreds.client.remove(credDir); err != nil {
-				log.ErrorContext(ctx, "Failed to remove service credential files", "error", err)
+				log.ErrorContext(processCtx, "Failed to remove service credential files", "error", err)
 			}
 			if err := os.RemoveAll(credDir); err != nil {
-				log.ErrorContext(ctx, "Failed to remove service credential directory", "error", err)
+				log.ErrorContext(processCtx, "Failed to remove service credential directory", "error", err)
 			}
 		}()
 		daemonConfig := daemon.Config{
@@ -85,13 +83,13 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 		}
 		return trace.Wrap(execAdminProcess(processCtx, daemonConfig))
 	})
-	pm.AddCriticalBackgroundTask("gRPC service", func() error {
+	p.processManager.AddCriticalBackgroundTask("gRPC service", func() error {
 		log.InfoContext(processCtx, "Starting gRPC service",
 			"addr", listener.Addr().String())
 		return trace.Wrap(grpcServer.Serve(listener),
 			"serving VNet user process gRPC service")
 	})
-	pm.AddCriticalBackgroundTask("gRPC server closer", func() error {
+	p.processManager.AddCriticalBackgroundTask("gRPC server closer", func() error {
 		// grpcServer.Serve does not stop on its own when processCtx is done, so
 		// this task waits for processCtx and then explicitly stops grpcServer.
 		<-processCtx.Done()
@@ -104,6 +102,6 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 		p.networkStackInfo = nsi
 		return nil
 	case <-processCtx.Done():
-		return trace.Wrap(pm.Wait(), "process manager exited before network stack info was received")
+		return trace.Wrap(p.processManager.Wait(), "process manager exited before network stack info was received")
 	}
 }
diff --git a/lib/vnet/user_process_windows.go b/lib/vnet/user_process_windows.go
index 80d935f209fd1..e0ab82eda82cf 100644
--- a/lib/vnet/user_process_windows.go
+++ b/lib/vnet/user_process_windows.go
@@ -37,7 +37,7 @@ import (
 // interface that the admin process uses to query application names and get user
 // certificates for apps. It returns a [ProcessManager] which controls the
 // lifecycle of both the user and admin processes.
-func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
+func (p *UserProcess) runPlatformUserProcess(processCtx context.Context) error {
 	ipcCreds, err := newIPCCredentials()
 	if err != nil {
 		return trace.Wrap(err, "creating credentials for IPC")
@@ -77,17 +77,15 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 	)
 	vnetv1.RegisterClientApplicationServiceServer(grpcServer, p.clientApplicationService)
 
-	pm, processCtx := newProcessManager()
-	p.processManager = pm
-	pm.AddCriticalBackgroundTask("admin process", func() error {
+	p.processManager.AddCriticalBackgroundTask("admin process", func() error {
 		log.InfoContext(processCtx, "Starting Windows service")
 		defer func() {
 			// Delete service credentials after the service terminates.
 			if ipcCreds.client.remove(credDir); err != nil {
-				log.ErrorContext(ctx, "Failed to remove service credential files", "error", err)
+				log.ErrorContext(processCtx, "Failed to remove service credential files", "error", err)
 			}
 			if err := os.RemoveAll(credDir); err != nil {
-				log.ErrorContext(ctx, "Failed to remove service credential directory", "error", err)
+				log.ErrorContext(processCtx, "Failed to remove service credential directory", "error", err)
 			}
 		}()
 		return trace.Wrap(runService(processCtx, &windowsAdminProcessConfig{
@@ -96,13 +94,13 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 			userSID:                      userSID,
 		}))
 	})
-	pm.AddCriticalBackgroundTask("gRPC service", func() error {
+	p.processManager.AddCriticalBackgroundTask("gRPC service", func() error {
 		log.InfoContext(processCtx, "Starting gRPC service",
 			"addr", listener.Addr().String())
 		return trace.Wrap(grpcServer.Serve(listener),
 			"serving VNet user process gRPC service")
 	})
-	pm.AddCriticalBackgroundTask("gRPC server closer", func() error {
+	p.processManager.AddCriticalBackgroundTask("gRPC server closer", func() error {
 		// grpcServer.Serve does not stop on its own when processCtx is done, so
 		// this task waits for processCtx and then explicitly stops grpcServer.
 		<-processCtx.Done()
@@ -115,7 +113,7 @@ func (p *UserProcess) runPlatformUserProcess(ctx context.Context) error {
 		p.networkStackInfo = nsi
 		return nil
 	case <-processCtx.Done():
-		return trace.Wrap(pm.Wait(), "process manager exited before network stack info was received")
+		return trace.Wrap(p.processManager.Wait(), "process manager exited before network stack info was received")
 	}
 }
 
diff --git a/lib/vnet/vnet_test.go b/lib/vnet/vnet_test.go
index 004f017eea66b..405a466a14919 100644
--- a/lib/vnet/vnet_test.go
+++ b/lib/vnet/vnet_test.go
@@ -43,6 +43,7 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc"
 	grpccredentials "google.golang.org/grpc/credentials"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -52,16 +53,22 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/defaults"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
 	"github.com/gravitational/teleport/api/types"
 	typesvnet "github.com/gravitational/teleport/api/types/vnet"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
+	"github.com/gravitational/teleport/api/utils/keypaths"
+	"github.com/gravitational/teleport/api/utils/sshutils"
 	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 )
 
 const (
@@ -86,9 +93,14 @@ type testPack struct {
 type testPackConfig struct {
 	clock         clockwork.Clock
 	fakeClientApp *fakeClientApp
+	homePath      string
 }
 
 func newTestPack(t *testing.T, ctx context.Context, cfg testPackConfig) *testPack {
+	if cfg.homePath == "" {
+		cfg.homePath = t.TempDir()
+	}
+
 	// Create two sides of an emulated TUN interface: writes to one can be read on the other, and vice versa.
 	tun1, tun2 := newSplitTUN()
 
@@ -104,7 +116,7 @@ func newTestPack(t *testing.T, ctx context.Context, cfg testPackConfig) *testPac
 		return err == nil || errors.Is(err, context.Canceled) || utils.IsOKNetworkError(err) || errors.Is(err, errFakeTUNClosed)
 	}
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "test network stack",
 		Task: func(ctx context.Context) error {
 			if err := forwardBetweenTunAndNetstack(ctx, tun1, testLinkEndpoint); !errIsOK(err) {
@@ -142,12 +154,20 @@ func newTestPack(t *testing.T, ctx context.Context, cfg testPackConfig) *testPac
 	// client application and communicates over gRPC. For the test, everything
 	// runs in a single process, but we still set up the gRPC service and only
 	// interface with fakeClientApp via the gRPC client.
-	clt := runTestClientApplicationService(t, ctx, cfg.clock, cfg.fakeClientApp)
+	clt := runTestClientApplicationService(t, ctx, cfg)
 	appProvider := newAppProvider(clt)
+	sshProvider, err := newSSHProvider(ctx, sshProviderConfig{
+		clt:                clt,
+		clock:              cfg.clock,
+		overrideNodeDialer: cfg.fakeClientApp.dialSSHNode,
+	})
+	require.NoError(t, err)
 	tcpHandlerResolver := newTCPHandlerResolver(&tcpHandlerResolverConfig{
-		clt:         clt,
-		appProvider: appProvider,
-		clock:       cfg.clock,
+		clt:                      clt,
+		appProvider:              appProvider,
+		sshProvider:              sshProvider,
+		clock:                    cfg.clock,
+		alwaysTrustRootClusterCA: true,
 	})
 
 	// Create the VNet and connect it to the other side of the TUN.
@@ -160,7 +180,7 @@ func newTestPack(t *testing.T, ctx context.Context, cfg testPackConfig) *testPac
 	})
 	require.NoError(t, err)
 
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "VNet",
 		Task: func(ctx context.Context) error {
 			if err := ns.run(ctx); !errIsOK(err) {
@@ -253,20 +273,22 @@ func (p *testPack) dialHost(ctx context.Context, host string, port int) (net.Con
 // runTestClientApplicationService runs the gRPC service that's normally used to
 // expose the client application and Teleport client methods to the VNet
 // admin/networking process over gRPC. It returns a client of the gRPC service.
-func runTestClientApplicationService(t *testing.T, ctx context.Context, clock clockwork.Clock, clientApp *fakeClientApp) *clientApplicationServiceClient {
-	clusterConfigCache := NewClusterConfigCache(clock)
-	leafClusterCache, err := newLeafClusterCache(clock)
+func runTestClientApplicationService(t *testing.T, ctx context.Context, cfg testPackConfig) *clientApplicationServiceClient {
+	clusterConfigCache := NewClusterConfigCache(cfg.clock)
+	leafClusterCache, err := newLeafClusterCache(cfg.clock)
 	require.NoError(t, err)
 	fqdnResolver := newFQDNResolver(&fqdnResolverConfig{
-		clientApplication:  clientApp,
+		clientApplication:  cfg.fakeClientApp,
 		clusterConfigCache: clusterConfigCache,
 		leafClusterCache:   leafClusterCache,
 	})
-	clientApplicationService := newClientApplicationService(&clientApplicationServiceConfig{
-		clientApplication:     clientApp,
-		fqdnResolver:          fqdnResolver,
-		localOSConfigProvider: nil, // OS configuration is not needed in tests.
+	clientApplicationService, err := newClientApplicationService(&clientApplicationServiceConfig{
+		clientApplication: cfg.fakeClientApp,
+		fqdnResolver:      fqdnResolver,
+		homePath:          cfg.homePath,
+		clock:             cfg.clock,
 	})
+	require.NoError(t, err)
 
 	ipcCredentials, err := newIPCCredentials()
 	require.NoError(t, err)
@@ -282,7 +304,7 @@ func runTestClientApplicationService(t *testing.T, ctx context.Context, clock cl
 
 	listener, err := net.Listen("tcp", "localhost:0")
 	require.NoError(t, err)
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "user process gRPC server",
 		Task: func(ctx context.Context) error {
 			return trace.Wrap(grpcServer.Serve(listener), "serving VNet user process gRPC service")
@@ -318,8 +340,13 @@ type appSpec struct {
 	tcpPorts   []*types.PortRange
 }
 
+type nodeSpec struct {
+	denyAccess bool
+}
+
 type testClusterSpec struct {
 	apps           []appSpec
+	nodes          map[string]nodeSpec
 	cidrRange      string
 	customDNSZones []string
 	leafClusters   map[string]testClusterSpec
@@ -331,11 +358,21 @@ type fakeClientApp struct {
 	tlsCA    tls.Certificate
 	dialOpts *vnetv1.DialOptions
 
-	onNewConnectionCallCount    atomic.Uint32
+	userTLSCertMu      sync.Mutex
+	userTLSCert        tls.Certificate
+	userTLSCertExpires time.Time
+
+	teleportHostCA ssh.Signer
+	teleportUserCA ssh.Signer
+
+	onNewSSHSessionCallCount    atomic.Uint32
+	onNewAppConnectionCallCount atomic.Uint32
 	onInvalidLocalPortCallCount atomic.Uint32
 	// requestedRouteToApps indexed by public address.
 	requestedRouteToApps   map[string][]*proto.RouteToApp
 	requestedRouteToAppsMu sync.RWMutex
+
+	forwardedAgents *forwardedAgents
 }
 
 type fakeClientAppConfig struct {
@@ -349,13 +386,36 @@ type fakeClientAppConfig struct {
 // able to run with any implementation of [ClientApplication] and little to no
 // other configuration.
 func newFakeClientApp(ctx context.Context, t *testing.T, cfg *fakeClientAppConfig) *fakeClientApp {
+	teleportHostCAKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	require.NoError(t, err)
+	teleportHostCA, err := ssh.NewSignerFromSigner(teleportHostCAKey)
+	require.NoError(t, err)
+
+	teleportUserCAKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	require.NoError(t, err)
+	teleportUserCA, err := ssh.NewSignerFromSigner(teleportUserCAKey)
+	require.NoError(t, err)
+
+	forwardedAgents := &forwardedAgents{}
+
 	tlsCA := newSelfSignedCA(t)
-	dialOpts := mustStartFakeWebProxy(ctx, t, tlsCA, cfg.clock, cfg.signatureAlgorithmSuite)
+	dialOpts := mustStartFakeWebProxy(ctx, t, fakeWebProxyConfig{
+		tlsCA:           tlsCA,
+		hostCA:          teleportHostCA,
+		userCA:          teleportUserCA,
+		clock:           cfg.clock,
+		suite:           cfg.signatureAlgorithmSuite,
+		forwardedAgents: forwardedAgents,
+	})
+
 	return &fakeClientApp{
 		cfg:                  cfg,
 		tlsCA:                tlsCA,
 		dialOpts:             dialOpts,
+		teleportHostCA:       teleportHostCA,
+		teleportUserCA:       teleportUserCA,
 		requestedRouteToApps: make(map[string][]*proto.RouteToApp),
+		forwardedAgents:      forwardedAgents,
 	}
 }
 
@@ -379,6 +439,10 @@ func (p *fakeClientApp) GetCachedClient(ctx context.Context, profileName, leafCl
 				clusterName:     profileName,
 				rootClusterName: profileName,
 			},
+			clusterSpec:    &rootCluster,
+			teleportHostCA: p.teleportHostCA,
+			teleportUserCA: p.teleportUserCA,
+			clock:          p.cfg.clock,
 		}, nil
 	}
 	leafCluster, ok := rootCluster.leafClusters[leafClusterName]
@@ -391,6 +455,10 @@ func (p *fakeClientApp) GetCachedClient(ctx context.Context, profileName, leafCl
 			clusterName:     leafClusterName,
 			rootClusterName: profileName,
 		},
+		clusterSpec:    &leafCluster,
+		teleportHostCA: p.teleportHostCA,
+		teleportUserCA: p.teleportUserCA,
+		clock:          p.cfg.clock,
 	}, nil
 }
 
@@ -409,6 +477,29 @@ func (p *fakeClientApp) ReissueAppCert(ctx context.Context, appInfo *vnetv1.AppI
 		cryptosuites.UserTLS)
 }
 
+func (p *fakeClientApp) UserTLSCert(ctx context.Context, profileName string) (tls.Certificate, error) {
+	p.userTLSCertMu.Lock()
+	defer p.userTLSCertMu.Unlock()
+
+	now := p.cfg.clock.Now()
+	if now.Before(p.userTLSCertExpires) {
+		return p.userTLSCert, nil
+	}
+	expiry := now.Add(defaults.CertDuration)
+	userTLSCert, err := newClientCert(ctx,
+		p.tlsCA,
+		"testuser",
+		expiry,
+		p.cfg.signatureAlgorithmSuite,
+		cryptosuites.UserTLS)
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err)
+	}
+	p.userTLSCert = userTLSCert
+	p.userTLSCertExpires = expiry
+	return userTLSCert, nil
+}
+
 func (p *fakeClientApp) RequestedRouteToApps(publicAddr string) []*proto.RouteToApp {
 	p.requestedRouteToAppsMu.RLock()
 	defer p.requestedRouteToAppsMu.RUnlock()
@@ -475,8 +566,12 @@ func (p *fakeClientApp) GetVnetConfig(ctx context.Context, profileName, leafClus
 	return cfg, nil
 }
 
-func (p *fakeClientApp) OnNewConnection(_ context.Context, _ *vnetv1.AppKey) error {
-	p.onNewConnectionCallCount.Add(1)
+func (p *fakeClientApp) OnNewSSHSession(ctx context.Context, profileName, rootClusterName string) {
+	p.onNewSSHSessionCallCount.Add(1)
+}
+
+func (p *fakeClientApp) OnNewAppConnection(_ context.Context, _ *vnetv1.AppKey) error {
+	p.onNewAppConnectionCallCount.Add(1)
 	return nil
 }
 
@@ -484,8 +579,42 @@ func (p *fakeClientApp) OnInvalidLocalPort(_ context.Context, _ *vnetv1.AppInfo,
 	p.onInvalidLocalPortCallCount.Add(1)
 }
 
+func (p *fakeClientApp) dialSSHNode(
+	ctx context.Context,
+	target dialTarget,
+	tlsConfig *tls.Config,
+	dialOpts *vnetv1.DialOptions,
+	agent *sshAgent,
+) (net.Conn, error) {
+	targetCluster, ok := p.cfg.clusters[target.profile]
+	if !ok {
+		return nil, trace.NotFound("no such profile")
+	}
+	if target.cluster != target.profile {
+		targetCluster, ok = targetCluster.leafClusters[target.cluster]
+		if !ok {
+			return nil, trace.NotFound("no such cluster")
+		}
+	}
+	if _, ok := targetCluster.nodes[target.hostname]; !ok {
+		return nil, trace.NotFound("no such host")
+	}
+	// In this test suite all SSH dials go to a single faked web proxy expecting
+	// the ALPN protocol alpncomm.ProtocolProxySSH for SSH dials. It doesn't
+	// run the real transport service that handles SSH agent forwarding over
+	// gRPC, but the test shares the forwarded agent with the fake proxy via
+	// the forwardedAgents collection.
+	p.forwardedAgents.add(agent)
+	tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
+	return tls.Dial("tcp", dialOpts.GetWebProxyAddr(), tlsConfig)
+}
+
 type fakeClusterClient struct {
-	authClient *fakeAuthClient
+	authClient     *fakeAuthClient
+	clusterSpec    *testClusterSpec
+	teleportHostCA ssh.Signer
+	teleportUserCA ssh.Signer
+	clock          clockwork.Clock
 }
 
 func (c *fakeClusterClient) CurrentCluster() authclient.ClientI {
@@ -500,6 +629,52 @@ func (c *fakeClusterClient) RootClusterName() string {
 	return c.authClient.rootClusterName
 }
 
+func (c *fakeClusterClient) SessionSSHKeyRing(ctx context.Context, user string, target client.NodeDetails) (*client.KeyRing, bool, error) {
+	targetHost, _, err := net.SplitHostPort(target.Addr)
+	if err != nil {
+		return nil, false, trace.Wrap(err)
+	}
+	nodeSpec, ok := c.clusterSpec.nodes[targetHost]
+	if !ok {
+		return nil, false, trace.NotFound("no such node")
+	}
+	if nodeSpec.denyAccess {
+		return nil, false, trace.AccessDenied("access denied to %s", targetHost)
+	}
+	userSSHKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.Ed25519)
+	if err != nil {
+		return nil, false, trace.Wrap(err)
+	}
+	userSSHSigner, err := ssh.NewSignerFromSigner(userSSHKey)
+	if err != nil {
+		return nil, false, trace.Wrap(err)
+	}
+	now := c.clock.Now()
+	cert := &ssh.Certificate{
+		Key:             userSSHSigner.PublicKey(),
+		Serial:          1,
+		CertType:        ssh.UserCert,
+		ValidPrincipals: []string{user},
+		ValidAfter:      uint64(now.Add(-1 * time.Minute).Unix()),
+		ValidBefore:     uint64(now.Add(time.Minute).Unix()),
+	}
+	if err := cert.SignCert(rand.Reader, c.teleportUserCA); err != nil {
+		return nil, false, trace.Wrap(err)
+	}
+	trustedCert := ssh.MarshalAuthorizedKey(c.teleportHostCA.PublicKey())
+	k := &client.KeyRing{
+		SSHPrivateKey: userSSHKey,
+		Cert:          ssh.MarshalAuthorizedKey(cert),
+		TrustedCerts: []authclient.TrustedCerts{
+			{
+				ClusterName:    c.ClusterName(),
+				AuthorizedKeys: [][]byte{trustedCert},
+			},
+		},
+	}
+	return k, false, nil
+}
+
 // fakeAuthClient is a fake auth client that answers GetResources requests with a static list of apps and
 // basic/faked predicate filtering.
 type fakeAuthClient struct {
@@ -592,20 +767,16 @@ func TestDialFakeApp(t *testing.T) {
 		clusters: map[string]testClusterSpec{
 			"root1.example.com": {
 				apps: []appSpec{
-					appSpec{publicAddr: "echo1.root1.example.com"},
-					appSpec{publicAddr: "echo2.root1.example.com"},
-					appSpec{publicAddr: "echo.myzone.example.com"},
-					appSpec{publicAddr: "echo.nested.myzone.example.com"},
-					appSpec{publicAddr: "not.in.a.custom.zone"},
-					appSpec{
+					{publicAddr: "echo1.root1.example.com"},
+					{publicAddr: "echo2.root1.example.com"},
+					{publicAddr: "echo.myzone.example.com"},
+					{publicAddr: "echo.nested.myzone.example.com"},
+					{publicAddr: "not.in.a.custom.zone"},
+					{
 						publicAddr: "multi-port.root1.example.com",
 						tcpPorts: []*types.PortRange{
-							&types.PortRange{
-								Port: 1337,
-							},
-							&types.PortRange{
-								Port: 4242,
-							},
+							{Port: 1337},
+							{Port: 4242},
 						},
 					},
 				},
@@ -616,36 +787,32 @@ func TestDialFakeApp(t *testing.T) {
 				leafClusters: map[string]testClusterSpec{
 					"leaf1.example.com": {
 						apps: []appSpec{
-							appSpec{publicAddr: "echo1.leaf1.example.com"},
-							appSpec{
+							{publicAddr: "echo1.leaf1.example.com"},
+							{
 								publicAddr: "multi-port.leaf1.example.com",
 								tcpPorts: []*types.PortRange{
-									&types.PortRange{
-										Port: 1337,
-									},
-									&types.PortRange{
-										Port: 4242,
-									},
+									{Port: 1337},
+									{Port: 4242},
 								},
 							},
 						},
 					},
 					"leaf2.example.com": {
 						apps: []appSpec{
-							appSpec{publicAddr: "echo1.leaf2.example.com"},
+							{publicAddr: "echo1.leaf2.example.com"},
 						},
 					},
 				},
 			},
 			"root2.example.com": {
 				apps: []appSpec{
-					appSpec{publicAddr: "echo1.root2.example.com"},
-					appSpec{publicAddr: "echo2.root2.example.com"},
+					{publicAddr: "echo1.root2.example.com"},
+					{publicAddr: "echo2.root2.example.com"},
 				},
 				leafClusters: map[string]testClusterSpec{
 					"leaf3.example.com": {
 						apps: []appSpec{
-							appSpec{publicAddr: "echo1.leaf3.example.com"},
+							{publicAddr: "echo1.leaf3.example.com"},
 						},
 					},
 				},
@@ -875,9 +1042,9 @@ func testEchoConnection(t *testing.T, conn net.Conn) {
 	}
 }
 
-// TestOnNewConnection tests that the client applications OnNewConnection method
+// TestOnNewAppConnection tests that the client applications OnNewAppConnection method
 // is called when a user connects to a valid TCP app.
-func TestOnNewConnection(t *testing.T) {
+func TestOnNewAppConnection(t *testing.T) {
 	t.Parallel()
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
@@ -887,7 +1054,7 @@ func TestOnNewConnection(t *testing.T) {
 		clusters: map[string]testClusterSpec{
 			"root1.example.com": {
 				apps: []appSpec{
-					appSpec{publicAddr: "echo1"},
+					{publicAddr: "echo1"},
 				},
 				cidrRange:    "192.168.2.0/24",
 				leafClusters: map[string]testClusterSpec{},
@@ -905,19 +1072,19 @@ func TestOnNewConnection(t *testing.T) {
 		fakeClientApp: clientApp,
 	})
 
-	// Attempt to establish a connection to an invalid app and verify that OnNewConnection was not
+	// Attempt to establish a connection to an invalid app and verify that OnNewAppConnection was not
 	// called.
 	lookupCtx, lookupCtxCancel := context.WithTimeout(ctx, 200*time.Millisecond)
 	defer lookupCtxCancel()
 	_, err := p.lookupHost(lookupCtx, invalidAppName)
 	require.Error(t, err, "Expected lookup of an invalid app to fail")
-	require.Equal(t, uint32(0), clientApp.onNewConnectionCallCount.Load())
+	require.Equal(t, uint32(0), clientApp.onNewAppConnectionCallCount.Load())
 
-	// Establish a connection to a valid app and verify that OnNewConnection was called.
+	// Establish a connection to a valid app and verify that OnNewAppConnection was called.
 	conn, err := p.dialHost(ctx, validAppName, 80 /* bogus port */)
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, conn.Close()) })
-	require.Equal(t, uint32(1), clientApp.onNewConnectionCallCount.Load())
+	require.Equal(t, uint32(1), clientApp.onNewAppConnectionCallCount.Load())
 }
 
 // TestWithAlgorithmSuites tests basic VNet functionality with each signature
@@ -948,15 +1115,15 @@ func testWithAlgorithmSuite(t *testing.T, suite types.SignatureAlgorithmSuite) {
 		clusters: map[string]testClusterSpec{
 			"root.example.com": {
 				apps: []appSpec{
-					appSpec{publicAddr: "echo1"},
-					appSpec{publicAddr: "echo2"},
+					{publicAddr: "echo1"},
+					{publicAddr: "echo2"},
 				},
 				cidrRange: "192.168.2.0/24",
 				leafClusters: map[string]testClusterSpec{
 					"leaf.example.com": {
 						apps: []appSpec{
-							appSpec{publicAddr: "echo1"},
-							appSpec{publicAddr: "echo2"},
+							{publicAddr: "echo1"},
+							{publicAddr: "echo2"},
 						},
 						cidrRange: "192.168.2.0/24",
 					},
@@ -996,9 +1163,9 @@ func testWithAlgorithmSuite(t *testing.T, suite types.SignatureAlgorithmSuite) {
 
 // TestSSH tests basic VNet SSH functionality.
 func TestSSH(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
+	ctx := t.Context()
 	clock := clockwork.NewRealClock()
+	homePath := t.TempDir()
 
 	const (
 		root1CIDR = "192.168.1.0/24"
@@ -1010,17 +1177,30 @@ func TestSSH(t *testing.T) {
 		clusters: map[string]testClusterSpec{
 			"root1.example.com": {
 				cidrRange: root1CIDR,
+				nodes: map[string]nodeSpec{
+					"node":     {},
+					"denynode": {denyAccess: true},
+				},
 				leafClusters: map[string]testClusterSpec{
 					"leaf1.example.com": {
 						cidrRange: leaf1CIDR,
+						nodes: map[string]nodeSpec{
+							"node": {},
+						},
 					},
 				},
 			},
 			"root2.example.com": {
 				cidrRange: root2CIDR,
+				nodes: map[string]nodeSpec{
+					"node": {},
+				},
 				leafClusters: map[string]testClusterSpec{
 					"leaf2.example.com": {
 						cidrRange: leaf2CIDR,
+						nodes: map[string]nodeSpec{
+							"node": {},
+						},
 					},
 				},
 			},
@@ -1032,56 +1212,264 @@ func TestSSH(t *testing.T) {
 	p := newTestPack(t, ctx, testPackConfig{
 		fakeClientApp: clientApp,
 		clock:         clock,
+		homePath:      homePath,
+	})
+
+	// Read the generated vnet_known_hosts file to get the trusted host CA key.
+	knownHosts, err := os.ReadFile(keypaths.VNetKnownHostsPath(homePath))
+	require.NoError(t, err)
+	marker, hosts, hostCAPubKey, _, _, err := ssh.ParseKnownHosts(knownHosts)
+	require.NoError(t, err)
+	require.Equal(t, "cert-authority", marker)
+	require.Equal(t, []string{"*"}, hosts)
+
+	// Read the generated id_vnet file to get the user key.
+	sshUserKey, err := os.ReadFile(keypaths.VNetClientSSHKeyPath(homePath))
+	require.NoError(t, err)
+	sshUserSigner, err := ssh.ParsePrivateKey(sshUserKey)
+	require.NoError(t, err)
+
+	// Create a fake user key to test failed authentication.
+	badUserKey, err := cryptosuites.GenerateKeyWithAlgorithm(cryptosuites.Ed25519)
+	require.NoError(t, err)
+	badUserSigner, err := ssh.NewSignerFromSigner(badUserKey)
+	require.NoError(t, err)
+
+	// Check that each successful SSH session is reported to the client
+	// application, do this in a t.Cleanup func so that the check runs after
+	// all parallel subtests have completed.
+	var expectReportedSSHSessions atomic.Uint32
+	t.Cleanup(func() {
+		assert.Equal(t, expectReportedSSHSessions.Load(), clientApp.onNewSSHSessionCallCount.Load(),
+			"OnNewSSHSession call count does not match the expected number of reported SSH sessions")
 	})
 
 	for _, tc := range []struct {
-		addr       string
-		expectCIDR string
+		dialAddr                 string
+		dialPort                 int
+		expectCIDR               string
+		expectLookupToFail       bool
+		expectDialToFail         bool
+		sshUser                  string
+		sshUserSigner            ssh.Signer
+		expectSSHHandshakeToFail bool
+		expectBannerMessages     []string
+		expectSSHSessionReported bool
 	}{
 		{
-			addr:       "node.root1.example.com",
-			expectCIDR: root1CIDR,
+			// Connection to node in root cluster should work.
+			dialAddr:                 "node.root1.example.com",
+			dialPort:                 22,
+			expectCIDR:               root1CIDR,
+			sshUser:                  "testuser",
+			sshUserSigner:            sshUserSigner,
+			expectSSHSessionReported: true,
 		},
 		{
-			addr:       "node.leaf1.example.com.root1.example.com",
-			expectCIDR: leaf1CIDR,
+			// Fully-qualified hostname should also work.
+			dialAddr:                 "node.root1.example.com.",
+			dialPort:                 22,
+			expectCIDR:               root1CIDR,
+			sshUser:                  "testuser",
+			sshUserSigner:            sshUserSigner,
+			expectSSHSessionReported: true,
 		},
 		{
-			addr:       "node.root2.example.com",
-			expectCIDR: root2CIDR,
+			// Dial should fail on non-standard SSH port.
+			dialAddr:         "node.root1.example.com",
+			dialPort:         23,
+			expectCIDR:       root1CIDR,
+			expectDialToFail: true,
 		},
 		{
-			addr:       "node.leaf2.example.com.root2.example.com",
-			expectCIDR: leaf2CIDR,
+			// SSH handshake should fail if using the wrong user key.
+			dialAddr:                 "node.root1.example.com",
+			dialPort:                 22,
+			expectCIDR:               root1CIDR,
+			sshUser:                  "baduser",
+			sshUserSigner:            badUserSigner,
+			expectSSHHandshakeToFail: true,
+		},
+		{
+			// Access to denied node should be denied with appropriate banner
+			// messages.
+			dialAddr:      "denynode.root1.example.com",
+			dialPort:      22,
+			expectCIDR:    root1CIDR,
+			sshUser:       "testuser",
+			sshUserSigner: sshUserSigner,
+			expectBannerMessages: []string{
+				"VNet: building SSH client config\n\tcalling SessionSSHConfig rpc\n\t\tgetting KeyRing for SSH session\n\taccess denied to denynode\n",
+			},
+			expectSSHHandshakeToFail: true,
+		},
+		{
+			// username "denyuser" is hardcoded to be denied.
+			dialAddr:      "node.root1.example.com",
+			dialPort:      22,
+			expectCIDR:    root1CIDR,
+			sshUser:       "denyuser",
+			sshUserSigner: sshUserSigner,
+			expectBannerMessages: []string{
+				"VNet: access denied to denyuser connecting to node\n",
+			},
+			expectSSHHandshakeToFail: true,
+			// The session should be reported because VNet successfully got a
+			// Teleport user SSH cert for this session and made the SSH dial to
+			// the target, only then the target SSH server rejected the
+			// connection.
+			expectSSHSessionReported: true,
+		},
+		{
+			// Connection to node in leaf cluster should work.
+			dialAddr:                 "node.leaf1.example.com",
+			dialPort:                 22,
+			expectCIDR:               leaf1CIDR,
+			sshUser:                  "testuser",
+			sshUserSigner:            sshUserSigner,
+			expectSSHSessionReported: true,
+		},
+		{
+			// Connection to node in root cluster in alternate profile should
+			// work.
+			dialAddr:                 "node.root2.example.com",
+			dialPort:                 22,
+			expectCIDR:               root2CIDR,
+			sshUser:                  "testuser",
+			sshUserSigner:            sshUserSigner,
+			expectSSHSessionReported: true,
+		},
+		{
+			// Connection to node in leaf cluster in alternate profile should
+			// work.
+			dialAddr:                 "node.leaf2.example.com",
+			dialPort:                 22,
+			expectCIDR:               leaf2CIDR,
+			sshUser:                  "testuser",
+			sshUserSigner:            sshUserSigner,
+			expectSSHSessionReported: true,
+		},
+		{
+			// DNS lookup should fail if the FQDN doesn't match any cluster.
+			dialAddr:           "node.bogus.example.com.",
+			dialPort:           22,
+			expectLookupToFail: true,
+		},
+		{
+			// If the FQDN matches a cluster but no node, the DNS lookup should
+			// succeed but the TCP dial should fail.
+			dialAddr:         "bogus.root1.example.com",
+			dialPort:         22,
+			expectCIDR:       root1CIDR,
+			expectDialToFail: true,
 		},
 	} {
-		t.Run(tc.addr, func(t *testing.T) {
+		t.Run(fmt.Sprintf("%s@%s:%d", tc.sshUser, tc.dialAddr, tc.dialPort), func(t *testing.T) {
 			t.Parallel()
-			// SSH access isn't fully implemented yet, at this point the DNS
-			// lookup for *.<cluster-name> should resolve to an IP in the
-			// expected CIDR range for the cluster.
-			resolvedAddrs, err := p.lookupHost(ctx, tc.addr)
+
+			if tc.expectSSHSessionReported {
+				expectReportedSSHSessions.Add(1)
+			}
+
+			if tc.expectLookupToFail {
+				// In these cases the DNS lookup is expected to fail, just run the DNS lookup.
+				ctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+				defer cancel()
+				_, err := p.lookupHost(ctx, tc.dialAddr)
+				require.Error(t, err)
+				return
+			}
+
+			if tc.expectDialToFail {
+				// In these cases the DNS lookup should succeed but then the
+				// TCP dial should fail, do each separately to make sure we
+				// catch the error at the right step.
+				resolvedAddrs, err := p.lookupHost(ctx, tc.dialAddr)
+				require.NoError(t, err)
+				require.NotEmpty(t, resolvedAddrs)
+
+				ctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+				defer cancel()
+				_, err = p.dialHost(ctx, resolvedAddrs[0], tc.dialPort)
+				require.Error(t, err)
+				return
+			}
+
+			conn, err := p.dialHost(ctx, tc.dialAddr, tc.dialPort)
 			require.NoError(t, err)
+			defer conn.Close()
 
+			// The DNS query may have resolved to a v4 or v6 address, either
+			// way the 4-byte suffix should be a valid IPv4 address in the
+			// expected CIDR range.
+			resolvedIP := conn.RemoteAddr().(*net.TCPAddr).IP
+			resolvedIPSuffix := resolvedIP[len(resolvedIP)-4:]
 			_, expectNet, err := net.ParseCIDR(tc.expectCIDR)
 			require.NoError(t, err)
+			assert.True(t, expectNet.Contains(resolvedIPSuffix),
+				"expected CIDR range %s does not include resolved IP %s", expectNet, resolvedIPSuffix)
+
+			// Initiate an SSH connection to the target. At this point the
+			// handshake should complete successfully as long as the right keys
+			// are used, but the SSH connection will be immediately closed by
+			// the server.
+			certChecker := ssh.CertChecker{
+				IsHostAuthority: func(auth ssh.PublicKey, address string) bool {
+					return sshutils.KeysEqual(auth, hostCAPubKey)
+				},
+				Clock: clock.Now,
+			}
+			var bannerMessages []string
+			clientConfig := &ssh.ClientConfig{
+				User:            tc.sshUser,
+				Auth:            []ssh.AuthMethod{ssh.PublicKeys(tc.sshUserSigner)},
+				HostKeyCallback: certChecker.CheckHostKey,
+				BannerCallback: func(msg string) error {
+					bannerMessages = append(bannerMessages, msg)
+					return nil
+				},
+			}
 
-			for _, resolvedAddr := range resolvedAddrs {
-				resolvedIP := net.ParseIP(resolvedAddr)
-				// The query may have resolved to a v4 or v6 address or both,
-				// either way the 4-byte suffix should be a valid IPv4 address
-				// in the expected CIDR range.
-				resolvedIPSuffix := resolvedIP[len(resolvedIP)-4:]
-				assert.True(t, expectNet.Contains(resolvedIPSuffix),
-					"expected CIDR range %s does not include resolved IP %s", expectNet, resolvedIPSuffix)
+			sshConn, chans, reqs, err := ssh.NewClientConn(conn, fmt.Sprintf("%s:%d", tc.dialAddr, tc.dialPort), clientConfig)
+			assert.Equal(t, tc.expectBannerMessages, bannerMessages, "actual banner messages did not match the expected")
+			if tc.expectSSHHandshakeToFail {
+				assert.Error(t, err, "expected SSH handshake to fail")
+				return
 			}
+			require.NoError(t, err)
+			defer sshConn.Close()
 
-			// Actually dialing the address should still fail until VNet SSH is
-			// implemented.
-			_, err = p.dialHost(ctx, tc.addr, 22)
-			require.Error(t, err)
+			testConnectionToSshEchoServer(t, sshConn, chans, reqs)
 		})
 	}
+
+	// Test that a fresh SSH host cert is used on each connection.
+	t.Run("ephemeral certs", func(t *testing.T) {
+		t.Parallel()
+		// Set up the SSH client config to capture the host certs it sees.
+		var checkedHostCerts []*ssh.Certificate
+		clientConfig := &ssh.ClientConfig{
+			User: "testuser",
+			Auth: []ssh.AuthMethod{ssh.PublicKeys(sshUserSigner)},
+			HostKeyCallback: func(addr string, remote net.Addr, key ssh.PublicKey) error {
+				checkedHostCerts = append(checkedHostCerts, key.(*ssh.Certificate))
+				return nil
+			},
+		}
+		const connections = 3
+		for range connections {
+			conn, err := p.dialHost(ctx, "node.root1.example.com", 22)
+			require.NoError(t, err)
+			sshConn, _, _, err := ssh.NewClientConn(conn, "node.root1.example.com:22", clientConfig)
+			require.NoError(t, err)
+			sshConn.Close()
+			expectReportedSSHSessions.Add(1)
+		}
+		require.Len(t, checkedHostCerts, connections)
+		for i := range connections - 1 {
+			require.NotEqual(t, checkedHostCerts[i], checkedHostCerts[i+1])
+		}
+	})
 }
 
 func randomULAAddress() (tcpip.Address, error) {
@@ -1255,27 +1643,34 @@ func newLeafCert(
 	}, nil
 }
 
+type fakeWebProxyConfig struct {
+	tlsCA           tls.Certificate
+	hostCA          ssh.Signer
+	userCA          ssh.Signer
+	clock           clockwork.Clock
+	suite           types.SignatureAlgorithmSuite
+	forwardedAgents *forwardedAgents
+}
+
 func mustStartFakeWebProxy(
 	ctx context.Context,
 	t *testing.T,
-	ca tls.Certificate,
-	clock clockwork.Clock,
-	suite types.SignatureAlgorithmSuite,
+	cfg fakeWebProxyConfig,
 ) *vnetv1.DialOptions {
 	t.Helper()
 
 	roots := x509.NewCertPool()
-	caX509, err := x509.ParseCertificate(ca.Certificate[0])
+	caX509, err := x509.ParseCertificate(cfg.tlsCA.Certificate[0])
 	require.NoError(t, err)
 	roots.AddCert(caX509)
 
 	const proxyCN = "testproxy"
 	proxyCert, err := newServerCert(
 		ctx,
-		ca,
+		cfg.tlsCA,
 		proxyCN,
-		clock.Now().Add(365*24*time.Hour),
-		suite,
+		cfg.clock.Now().Add(365*24*time.Hour),
+		cfg.suite,
 		cryptosuites.HostIdentity,
 	)
 	require.NoError(t, err)
@@ -1284,13 +1679,64 @@ func mustStartFakeWebProxy(
 		Certificates: []tls.Certificate{proxyCert},
 		ClientAuth:   tls.RequireAndVerifyClientCert,
 		ClientCAs:    roots,
+		NextProtos: []string{
+			string(alpncommon.ProtocolProxySSH),
+			string(alpncommon.ProtocolTCP),
+		},
+	}
+
+	tcpAppHandler := func(conn net.Conn) error {
+		// All fake TCP apps for the tests get routed to this handler which
+		// simply echos any input back on the tcp connection.
+		_, err := io.Copy(conn, conn)
+		return trace.Wrap(err, "io.Copy error in proxy echo server")
+	}
+	sshHandler := func(conn net.Conn) error {
+		// All fake SSH nodes for the tests get routed to this handler which
+		// terminates the incoming SSH connection with an ephemeral host cert.
+		// It trusts cfg.userCA for incoming SSH connections but always denies
+		// access for SSH users named "denyuser". After completing the handshake
+		// it runs a test "echo" SSH server implemented in
+		// runTestSSHServerInstance.
+		hostCert, err := newHostCert("node", cfg.hostCA)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		certChecker := ssh.CertChecker{
+			IsUserAuthority: func(auth ssh.PublicKey) bool {
+				return sshutils.KeysEqual(auth, cfg.userCA.PublicKey())
+			},
+			Clock: cfg.clock.Now,
+		}
+		serverConfig := &ssh.ServerConfig{
+			PublicKeyCallback: func(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
+				if conn.User() == "denyuser" {
+					return nil, trace.AccessDenied("access denied for denyuser")
+				}
+				// The test suite doesn't implement real "proxy recording mode"
+				// or SSH agent forwarding, but at least test here that the
+				// user key used to make this connection was forwarded so that
+				// the real SSH forwarding proxy would have access to it.
+				if !cfg.forwardedAgents.forwarded(pubKey) {
+					return nil, trace.Errorf("user SSH key was not forwarded")
+				}
+				return certChecker.Authenticate(conn, pubKey)
+			},
+		}
+		serverConfig.AddHostKey(hostCert)
+		return trace.Wrap(runTestSSHServerInstance(conn, serverConfig))
+	}
+
+	// Run a simplified TLS router for the test.
+	protocolHandlers := map[alpncommon.Protocol]func(net.Conn) error{
+		alpncommon.ProtocolTCP:      tcpAppHandler,
+		alpncommon.ProtocolProxySSH: sshHandler,
 	}
 
 	listener, err := tls.Listen("tcp", "localhost:0", proxyTLSConfig)
 	require.NoError(t, err)
 
-	// Run a fake web proxy that will accept any client connection and echo the input back.
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "web proxy",
 		Task: func(ctx context.Context) error {
 			for {
@@ -1325,14 +1771,19 @@ func mustStartFakeWebProxy(
 					// It's important that the fake clock is never far behind the real clock, and that the
 					// cert NotBefore is always at/before the real current time, so the TLS library is
 					// satisfied.
-					if clock.Now().After(clientCerts[0].NotAfter) {
-						t.Logf("client cert is expired: currentTime=%s expiry=%s", clock.Now(), clientCerts[0].NotAfter)
+					if cfg.clock.Now().After(clientCerts[0].NotAfter) {
+						t.Logf("client cert is expired: currentTime=%s expiry=%s", cfg.clock.Now(), clientCerts[0].NotAfter)
 						return
 					}
 
-					_, err := io.Copy(conn, conn)
-					if err != nil && !utils.IsOKNetworkError(err) {
-						t.Logf("error in io.Copy for echo proxy server: %v", err)
+					protocol := tlsConn.ConnectionState().NegotiatedProtocol
+					handler, ok := protocolHandlers[alpncommon.Protocol(protocol)]
+					if !ok {
+						t.Logf("unhandled proxy protocol %s", protocol)
+						return
+					}
+					if err := handler(conn); err != nil {
+						t.Logf("error in protocol handler: %v", err)
 					}
 				}()
 			}
@@ -1354,3 +1805,35 @@ func mustStartFakeWebProxy(
 	}
 	return dialOpts
 }
+
+// forwardedAgents is a crude way of tracking all the forwarded SSH agents and
+// checking if any of them forward a specific SSH key.
+type forwardedAgents struct {
+	mu     sync.Mutex
+	agents []*sshAgent
+}
+
+func (a *forwardedAgents) add(agent *sshAgent) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.agents = append(a.agents, agent)
+}
+
+func (a *forwardedAgents) forwarded(key ssh.PublicKey) bool {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	blob := key.Marshal()
+	for _, agent := range a.agents {
+		agentKeys, err := agent.List()
+		if err != nil {
+			// sshAgent.List never returns an error.
+			continue
+		}
+		for _, agentKey := range agentKeys {
+			if slices.Equal(agentKey.Blob, blob) {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/lib/watcher/ready.go b/lib/watcher/ready.go
new file mode 100644
index 0000000000000..985d529ae5e7a
--- /dev/null
+++ b/lib/watcher/ready.go
@@ -0,0 +1,149 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package libwatcher
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+)
+
+type watcher interface {
+	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
+}
+
+// WaitForReadyConfig contains configuration for waiting for an event stream to be ready.
+type WaitForReadyConfig struct {
+	// Watcher is the watcher to use for creating event watchers.
+	Watcher watcher
+	// Watch is the watch configuration.
+	Watch types.Watch
+	// Logger is the logger to use for logging.
+	Logger *slog.Logger
+	// Clock is the clock to use for timing operations.
+	Clock clockwork.Clock
+	// RetryConfig is the retry configuration. If nil, a default configuration will be used.
+	RetryConfig *retryutils.RetryV2Config
+}
+
+func (c *WaitForReadyConfig) checkAndSetDefaults() error {
+	if c.Watcher == nil {
+		return trace.BadParameter("missing Watcher")
+	}
+	if c.Logger == nil {
+		return trace.BadParameter("missing Logger")
+	}
+	if c.Clock == nil {
+		c.Clock = clockwork.NewRealClock()
+	}
+	if c.RetryConfig == nil {
+		c.RetryConfig = &retryutils.RetryV2Config{
+			First:  0,
+			Driver: retryutils.NewLinearDriver(5 * time.Second),
+			Max:    time.Minute,
+			Jitter: retryutils.DefaultJitter,
+			Clock:  c.Clock,
+		}
+	}
+	if c.Watch.Name == "" {
+		c.Watch = types.Watch{
+			Name: "wait-for-ready",
+			Kinds: []types.WatchKind{
+				{Kind: types.KindClusterName},
+			},
+		}
+	}
+	return nil
+}
+
+// WaitForReady waits for an event stream to be ready by creating a watcher
+// and waiting for an OpInit event. It retries on failure until successful or the
+// context is canceled.
+//
+// An event stream can be either a Cache or Backend. This function is very
+// useful when a service flow depends on the cache or backend being ready before proceeding.
+// For instance, you don't want to fetch large collections from the backend while the cache
+// is still syncing, as this would create unnecessary load on the backend.
+func WaitForReady(ctx context.Context, cfg WaitForReadyConfig) error {
+	if err := cfg.checkAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	start := cfg.Clock.Now()
+	retry, err := retryutils.NewRetryV2(*cfg.RetryConfig)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var attempt int
+	for {
+		attempt++
+		// By default, return immediately on the first attempt without waiting.
+		if err := waitForRetry(ctx, retry); err != nil {
+			return trace.Wrap(err)
+		}
+		watcher, err := cfg.Watcher.NewWatcher(ctx, cfg.Watch)
+		if err != nil {
+			cfg.Logger.ErrorContext(ctx, "Failed to create watcher", "name", cfg.Watch.Name, "attempt", attempt, "error", err)
+			continue
+		}
+		if err := waitForInitEvent(ctx, watcher, cfg, attempt, start); err != nil {
+			continue
+		}
+		return nil
+	}
+}
+
+// waitForRetry waits for the retry delay or returns if context is canceled.
+func waitForRetry(ctx context.Context, retry *retryutils.RetryV2) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-retry.After():
+		retry.Inc()
+		return nil
+	}
+}
+
+// waitForInitEvent waits for the OpInit event from the watcher. Returns nil on success,
+// or an error if the watcher closes or an unexpected event is received.
+func waitForInitEvent(ctx context.Context, w types.Watcher, cfg WaitForReadyConfig, attempt int, start time.Time) error {
+	defer w.Close()
+	select {
+	case evt := <-w.Events():
+		if evt.Type != types.OpInit {
+			cfg.Logger.ErrorContext(ctx, "expected init event, got something else (this is a bug)", "name", cfg.Watch.Name, "attempt", attempt, "event_type", evt.Type)
+			return trace.BadParameter("unexpected event type: %v", evt.Type)
+		}
+		cfg.Logger.InfoContext(ctx, "event stream initialized", "name", cfg.Watch.Name, "duration", cfg.Clock.Since(start).String())
+		return nil
+
+	case <-w.Done():
+		cfg.Logger.ErrorContext(ctx, "watcher closed while waiting for init",
+			"name", cfg.Watch.Name,
+			"attempt", attempt,
+			"error", w.Error())
+		return trace.Wrap(w.Error())
+
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	}
+}
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index d60cf266b82a7..0a0ee5167b7c0 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -36,6 +36,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"regexp"
 	"slices"
 	"strconv"
 	"strings"
@@ -64,24 +65,30 @@ import (
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
 	"github.com/gravitational/teleport/api/mfa"
 	apitracing "github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/installers"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/moderation"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
+	autoupdatelookup "github.com/gravitational/teleport/lib/autoupdate/lookup"
 	"github.com/gravitational/teleport/lib/client"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 	"github.com/gravitational/teleport/lib/client/sso"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/defaults"
 	dtconfig "github.com/gravitational/teleport/lib/devicetrust/config"
 	"github.com/gravitational/teleport/lib/events"
@@ -100,7 +107,6 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/readonly"
 	"github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
 	"github.com/gravitational/teleport/lib/web/app"
@@ -136,10 +142,6 @@ const (
 	// This cache is here to protect against accidental or intentional DDoS, the TTL must be low to quickly reflect
 	// cluster configuration changes.
 	findEndpointCacheTTL = 10 * time.Second
-	// cmcCacheTTL is the cache TTL for the clusterMaintenanceConfig resource.
-	// This cache is here to protect against accidental or intentional DDoS, the TTL must be low to quickly reflect
-	// cluster configuration changes.
-	cmcCacheTTL = time.Minute
 	// DefaultAgentUpdateJitterSeconds is the default jitter agents should wait before updating.
 	DefaultAgentUpdateJitterSeconds = 60
 )
@@ -183,8 +185,7 @@ type Handler struct {
 	// caller specified its Automatic Updates UUID or group.
 	findEndpointCache *utils.FnCache
 
-	// clusterMaintenanceConfig is used to cache the cluster maintenance config from the AUth Service.
-	clusterMaintenanceConfigCache *utils.FnCache
+	autoUpdateResolver *autoupdatelookup.Resolver
 }
 
 // HandlerOption is a functional argument - an option that can be passed
@@ -211,9 +212,8 @@ type PresenceChecker = func(ctx context.Context, term io.Writer, maintainer clie
 type Config struct {
 	// PluginRegistry handles plugin registration
 	PluginRegistry plugin.Registry
-	// Proxy is a reverse tunnel proxy that handles connections
-	// to local cluster or remote clusters using unified interface
-	Proxy reversetunnelclient.Tunnel
+	// Proxy provides a means to look up clusters.
+	Proxy reversetunnelclient.ClusterGetter
 	// AuthServers is a list of auth servers this proxy talks to
 	AuthServers utils.NetAddr
 	// ProxyClient is a client that authenticated as proxy
@@ -226,12 +226,15 @@ type Config struct {
 	ProxyWebAddr utils.NetAddr
 	// ProxyPublicAddr contains web proxy public addresses.
 	ProxyPublicAddrs []utils.NetAddr
+	// ProxyGroupID is reverse tunnel group ID, used by reverse tunnel agents
+	// in proxy peering mode.
+	ProxyGroupID string
 	// GetProxyClientCertificate returns the proxy client certificate.
 	GetProxyClientCertificate func() (*tls.Certificate, error)
 	// CipherSuites is the list of cipher suites Teleport suppports.
 	CipherSuites []uint16
 
-	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// FIPS mode means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	FIPS bool
 
@@ -341,6 +344,12 @@ func (c *Config) SetDefaults() {
 		c.PresenceChecker = client.RunPresenceTask
 	}
 
+	if c.AutomaticUpgradesChannels == nil {
+		c.AutomaticUpgradesChannels = automaticupgrades.Channels{}
+	}
+
+	c.ProxyGroupID = cmp.Or(c.ProxyGroupID, os.Getenv("TELEPORT_UNSTABLE_PROXYGROUP_ID"))
+
 	c.FeatureWatchInterval = cmp.Or(c.FeatureWatchInterval, DefaultFeatureWatchInterval)
 }
 
@@ -491,18 +500,21 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	}
 	h.findEndpointCache = findCache
 
-	// We create the cache after applying the options to make sure we use the fake clock if it was passed.
-	cmcCache, err := utils.NewFnCache(utils.FnCacheConfig{
-		TTL:         cmcCacheTTL,
-		Clock:       h.clock,
-		Context:     cfg.Context,
-		ReloadOnErr: false,
-	})
+	autoUpdateResolver, err := autoupdatelookup.NewResolver(
+		autoupdatelookup.Config{
+			RolloutGetter: cfg.AccessPoint,
+			CMCGetter:     cfg.ProxyClient,
+			Channels:      h.cfg.AutomaticUpgradesChannels,
+			Log:           h.logger,
+			Clock:         h.clock,
+			Context:       h.cfg.Context,
+		})
 	if err != nil {
-		return nil, trace.Wrap(err, "creating cluster maintenance config cache")
+		return nil, trace.Wrap(err, "creating autoupdate resolver")
 	}
-	h.clusterMaintenanceConfigCache = cmcCache
+	h.autoUpdateResolver = autoUpdateResolver
 
+	// We create the cache after applying the options to make sure we use the fake clock if it was passed.
 	sessionLingeringThreshold := cachedSessionLingeringThreshold
 	if cfg.CachedSessionLingeringThreshold != nil {
 		sessionLingeringThreshold = *cfg.CachedSessionLingeringThreshold
@@ -649,7 +661,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 
 		// request is going to the web UI
 		if cfg.StaticFS == nil {
-			w.WriteHeader(http.StatusNotImplemented)
+			httplib.RouteNotFoundResponse(r.Context(), w)
 			return
 		}
 
@@ -672,7 +684,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 
 			fs := http.FileServer(cfg.StaticFS)
 
-			fs = makeGzipHandler(fs)
+			fs = makeBrotliHandler(fs, cfg.StaticFS)
 			fs = makeCacheHandler(fs, etag)
 
 			http.StripPrefix("/web", fs).ServeHTTP(w, r)
@@ -721,7 +733,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 			Clock:                 h.clock,
 			AuthClient:            cfg.ProxyClient,
 			AccessPoint:           cfg.AccessPoint,
-			ProxyClient:           cfg.Proxy,
+			ClusterGetter:         cfg.Proxy,
 			CipherSuites:          cfg.CipherSuites,
 			ProxyPublicAddrs:      cfg.ProxyPublicAddrs,
 			WebPublicAddr:         resp.SSH.PublicAddr,
@@ -812,7 +824,11 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.POST("/webapi/sessions/web/renew", h.WithAuth(h.renewWebSession))
 	h.POST("/webapi/users", h.WithAuth(h.createUserHandle))
 	h.PUT("/webapi/users", h.WithAuth(h.updateUserHandle))
+	// TODO(rudream): DELETE IN V21.0.0
+	// MUST delete with related code found in web/packages/teleport/src/services/user/user.ts(fetchUsers)
 	h.GET("/webapi/users", h.WithAuth(h.getUsersHandle))
+	// The v2 version of this endpoint is paginated.
+	h.GET("/v2/webapi/users", h.WithAuth(h.listUsersHandle))
 	h.DELETE("/webapi/users/:username", h.WithAuth(h.deleteUserHandle))
 
 	// We have an overlap route here, please see godoc of handleGetUserOrResetToken
@@ -849,7 +865,9 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.GET("/webapi/sites/:site/alerts", h.WithClusterAuth(h.clusterLoginAlertsGet))
 
 	// lock interactions
+	// TODO(nicholasmarais1158): DELETE IN 20.0.0 - Replaced by /v2/webapi/sites/:site/locks endpoint
 	h.GET("/webapi/sites/:site/locks", h.WithClusterAuth(h.getClusterLocks))
+	h.GET("/v2/webapi/sites/:site/locks", h.WithClusterAuth(h.getClusterLocksV2))
 	h.PUT("/webapi/sites/:site/locks", h.WithClusterAuth(h.createClusterLock))
 	h.DELETE("/webapi/sites/:site/locks/:uuid", h.WithClusterAuth(h.deleteClusterLock))
 
@@ -863,6 +881,7 @@ func (h *Handler) bindDefaultEndpoints() {
 	// Audit events handlers.
 	h.GET("/webapi/sites/:site/events/search", h.WithClusterAuth(h.clusterSearchEvents))                 // search site events
 	h.GET("/webapi/sites/:site/events/search/sessions", h.WithClusterAuth(h.clusterSearchSessionEvents)) // search site session events
+
 	h.GET("/webapi/sites/:site/ttyplayback/:sid", h.WithClusterAuth(h.ttyPlaybackHandle))
 	h.GET("/webapi/sites/:site/sessionlength/:sid", h.WithClusterAuth(h.sessionLengthHandle))
 
@@ -875,7 +894,7 @@ func (h *Handler) bindDefaultEndpoints() {
 
 	// Returns the CA Certs
 	// Deprecated, use the `webapi/auth/export` endpoint.
-	// Returning other clusters (trusted cluster) CA certs would leak wether the TrustedCluster exists or not.
+	// Returning other clusters (trusted cluster) CA certs would leak whether the TrustedCluster exists or not.
 	// Given that this is a public/unauthorized endpoint, we should refrain from exposing that kind of information.
 	h.GET("/webapi/sites/:site/auth/export", h.authExportPublic)
 	h.GET("/webapi/auth/export", h.authExportPublic)
@@ -893,6 +912,8 @@ func (h *Handler) bindDefaultEndpoints() {
 	// v2 endpoint processes "suggestedLabels" field
 	h.POST("/v2/webapi/token", h.WithAuth(h.createTokenForDiscoveryHandle))
 	h.GET("/webapi/tokens", h.WithAuth(h.getTokens))
+	// used to retrieve a paginated list of tokens. Items can be filtered by roles and bot name.
+	h.GET("/v2/webapi/tokens", h.WithAuth(h.listProvisionTokens))
 	h.DELETE("/webapi/tokens", h.WithAuth(h.deleteToken))
 
 	// install script, the ':token' wildcard is a hack to make the router happy and support
@@ -929,6 +950,7 @@ func (h *Handler) bindDefaultEndpoints() {
 	// Kube access handlers.
 	h.GET("/webapi/sites/:site/kubernetes", h.WithClusterAuth(h.clusterKubesGet))
 	h.GET("/webapi/sites/:site/kubernetes/resources", h.WithClusterAuth(h.clusterKubeResourcesGet))
+	h.GET("/webapi/sites/:site/kubernetesservers", h.WithClusterAuth(h.clusterKubeServersList))
 
 	// Github connector handlers
 	h.GET("/webapi/github/login/web", h.WithRedirect(h.githubLoginWeb))
@@ -965,11 +987,18 @@ func (h *Handler) bindDefaultEndpoints() {
 	// User Status (used by client to check if user session is valid)
 	h.GET("/webapi/user/status", h.WithAuth(h.getUserStatus))
 
+	// TODO(kimlisa): DELETE IN 20.0 along with the api path defined in `config.ts`
+	// Replaced by its v2 endpoint
 	h.GET("/webapi/roles", h.WithAuth(h.listRolesHandle))
+	// v2 introduces a query param for optionally including system roles
+	// in the list and optionally include returning the object version
+	// of resource (only supported for roles).
+	h.GET("/v2/webapi/roles", h.WithAuth(h.listRolesHandle))
 	h.POST("/webapi/roles", h.WithAuth(h.createRoleHandle))
 	h.GET("/webapi/roles/:name", h.WithAuth(h.getRole))
 	h.PUT("/webapi/roles/:name", h.WithAuth(h.updateRoleHandle))
 	h.DELETE("/webapi/roles/:name", h.WithAuth(h.deleteRole))
+	h.GET("/webapi/requestableroles", h.WithAuth(h.listRequestableRolesHandle))
 	h.GET("/webapi/presetroles", h.WithUnauthenticatedHighLimiter(h.getPresetRoles))
 
 	h.GET("/webapi/github", h.WithAuth(h.getGithubConnectorsHandle))
@@ -982,6 +1011,8 @@ func (h *Handler) bindDefaultEndpoints() {
 
 	// Sets the default connector in the auth preference.
 	h.PUT("/webapi/authconnector/default", h.WithAuth(h.setDefaultConnectorHandle))
+	// Returns auth connectors that match a given username.
+	h.POST("/webapi/authconnectors", h.WithLimiter(h.getUserMatchedAuthConnectors))
 
 	h.GET("/webapi/trustedcluster", h.WithAuth(h.getTrustedClustersHandle))
 	h.POST("/webapi/trustedcluster", h.WithAuth(h.upsertTrustedClusterHandle))
@@ -1057,6 +1088,12 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.DELETE("/webapi/sites/:site/integrations/:name_or_subkind/aws-app-access/:name", h.WithClusterAuth(h.awsOIDCDeleteAWSAppAccess))
 	h.GET("/webapi/scripts/integrations/configure/ec2-ssm-iam.sh", h.WithLimiter(h.awsOIDCConfigureEC2SSMIAM))
 
+	// AWS IAM Roles Anywhere Integration Actions
+	h.GET("/webapi/scripts/integrations/configure/awsra-trust-anchor.sh", h.WithLimiter(h.awsRolesAnywhereConfigureTrustAnchor))
+	h.POST("/webapi/sites/:site/integrations/aws-ra/:name/validate", h.WithClusterAuth(h.validateAWSRolesAnywhereIntegration))
+	h.POST("/webapi/sites/:site/integrations/aws-ra/:name/ping", h.WithClusterAuth(h.awsRolesAnywherePing))
+	h.POST("/webapi/sites/:site/integrations/aws-ra/:name/listprofiles", h.WithClusterAuth(h.awsRolesAnywhereListProfiles))
+
 	// SAML IDP integration endpoints
 	h.GET("/webapi/scripts/integrations/configure/gcp-workforce-saml.sh", h.WithLimiter(h.gcpWorkforceConfigScript))
 
@@ -1132,14 +1169,31 @@ func (h *Handler) bindDefaultEndpoints() {
 	// Create bot join tokens
 	h.POST("/webapi/sites/:site/machine-id/token", h.WithClusterAuth(h.createBotJoinToken))
 	// PUT Machine ID bot by name
-	h.PUT("/webapi/sites/:site/machine-id/bot/:name", h.WithClusterAuth(h.updateBot))
+	// TODO(nicholasmarais1158) DELETE IN v20.0.0
+	// Replaced by `PUT /v2/webapi/sites/:site/machine-id/bot/:name` which allows editing more than just roles.
+	h.PUT("/webapi/sites/:site/machine-id/bot/:name", h.WithClusterAuth(h.updateBotV1))
+	// PUT Machine ID bot by name
+	// TODO(nicholasmarais1158) DELETE IN v20.0.0
+	// Replaced by `PUT /v3/webapi/sites/:site/machine-id/bot/:name` which allows editing description.
+	h.PUT("/v2/webapi/sites/:site/machine-id/bot/:name", h.WithClusterAuth(h.updateBotV2))
+	// PUT Machine ID bot by name
+	h.PUT("/v3/webapi/sites/:site/machine-id/bot/:name", h.WithClusterAuth(h.updateBotV3))
 	// Delete Machine ID bot
 	h.DELETE("/webapi/sites/:site/machine-id/bot/:name", h.WithClusterAuth(h.deleteBot))
 
 	// GET Machine ID instance for a bot by id
 	h.GET("/webapi/sites/:site/machine-id/bot/:name/bot-instance/:id", h.WithClusterAuth(h.getBotInstance))
 	// GET Machine ID bot instances (paged)
+	// TODO(nicholasmarais1158) DELETE IN v20.0.0
+	// Replaced by `GET /v2/webapi/sites/:site/machine-id/bot-instance`.
 	h.GET("/webapi/sites/:site/machine-id/bot-instance", h.WithClusterAuth(h.listBotInstances))
+	// GET Machine ID bot instances (paged)
+	h.GET("/v2/webapi/sites/:site/machine-id/bot-instance", h.WithClusterAuth(h.listBotInstancesV2))
+	// GET Machine ID bot instance metrics.
+	h.GET("/webapi/sites/:site/machine-id/bot-instance/metrics", h.WithClusterAuth(h.botInstanceMetrics))
+
+	// List workload identities
+	h.GET("/webapi/sites/:site/workload-identity", h.WithClusterAuth(h.listWorkloadIdentities))
 
 	// GET a paginated list of notifications for a user
 	h.GET("/webapi/sites/:site/notifications", h.WithClusterAuth(h.notificationsGet))
@@ -1152,6 +1206,13 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.PUT("/webapi/sites/:site/gitservers", h.WithClusterAuth(h.gitServerCreateOrUpsert))
 	h.GET("/webapi/sites/:site/gitservers/:name", h.WithClusterAuth(h.gitServerGet))
 	h.DELETE("/webapi/sites/:site/gitservers/:name", h.WithClusterAuth(h.gitServerDelete))
+
+	h.GET("/webapi/sites/:site/sessionthumbnail/:session_id", h.WithClusterAuth(h.getSessionRecordingThumbnail))
+	h.GET("/webapi/sites/:site/sessionrecording/:session_id/metadata/ws", h.WithClusterAuthWebSocket(h.getSessionRecordingMetadata))
+	h.GET("/webapi/sites/:site/sessionrecording/:session_id/playback/ws", h.WithClusterAuthWebSocket(h.recordingPlaybackWS))
+
+	// MWI IaC Wizards
+	h.POST("/webapi/sites/:site/machine-id/wizards/ci-cd", h.WithClusterAuth(h.machineIDWizardGenerateIaC))
 }
 
 // GetProxyClient returns authenticated auth server client
@@ -1241,12 +1302,12 @@ func (h *Handler) handleGetUserOrResetToken(w http.ResponseWriter, r *http.Reque
 // getUserContext returns user context
 //
 // GET /webapi/sites/:site/context
-func (h *Handler) getUserContext(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) getUserContext(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	cn, err := h.cfg.AccessPoint.GetClusterName(r.Context())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if cn.GetClusterName() != site.GetName() {
+	if cn.GetClusterName() != cluster.GetName() {
 		return nil, trace.BadParameter("endpoint only implemented for root cluster")
 	}
 	accessChecker, err := c.GetUserAccessChecker()
@@ -1298,7 +1359,7 @@ func (h *Handler) getUserContext(w http.ResponseWriter, r *http.Request, p httpr
 
 	userContext.AllowedSearchAsRoles = accessChecker.GetAllowedSearchAsRoles()
 
-	userContext.Cluster, err = ui.GetClusterDetails(r.Context(), site)
+	userContext.Cluster, err = ui.GetClusterDetails(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1464,7 +1525,15 @@ func getAuthSettings(ctx context.Context, authClient authclient.ClientI, logger
 
 			as = oidcSettings(oidcConnector, authPreference)
 		} else {
-			oidcConnectors, err := authClient.GetOIDCConnectors(ctx, false)
+			// TODO(okraport): DELETE IN v21.0.0, remove GetOIDCConnectors
+			oidcConnectors, err := clientutils.CollectWithFallback(ctx,
+				func(ctx context.Context, limit int, start string) ([]types.OIDCConnector, string, error) {
+					return authClient.ListOIDCConnectors(ctx, limit, start, false)
+				},
+				func(ctx context.Context) ([]types.OIDCConnector, error) {
+					return authClient.GetOIDCConnectors(ctx, false)
+				},
+			)
 			if err != nil {
 				return webclient.AuthenticationSettings{}, trace.Wrap(err)
 			}
@@ -1483,7 +1552,15 @@ func getAuthSettings(ctx context.Context, authClient authclient.ClientI, logger
 
 			as = samlSettings(samlConnector, authPreference)
 		} else {
-			samlConnectors, err := authClient.GetSAMLConnectorsWithValidationOptions(ctx, false, types.SAMLConnectorValidationFollowURLs(false))
+			// TODO(okraport): DELETE IN v21.0.0, remove GetSAMLConnectorsWithValidationOptions
+			samlConnectors, err := clientutils.CollectWithFallback(ctx,
+				func(ctx context.Context, limit int, start string) ([]types.SAMLConnector, string, error) {
+					return authClient.ListSAMLConnectorsWithOptions(ctx, limit, start, false, types.SAMLConnectorValidationFollowURLs(false))
+				},
+				func(ctx context.Context) ([]types.SAMLConnector, error) {
+					return authClient.GetSAMLConnectorsWithValidationOptions(ctx, false, types.SAMLConnectorValidationFollowURLs(false))
+				},
+			)
 			if err != nil {
 				return webclient.AuthenticationSettings{}, trace.Wrap(err)
 			}
@@ -1501,7 +1578,15 @@ func getAuthSettings(ctx context.Context, authClient authclient.ClientI, logger
 			}
 			as = githubSettings(githubConnector, authPreference)
 		} else {
-			githubConnectors, err := authClient.GetGithubConnectors(ctx, false)
+			// TODO(okraport): DELETE IN v21.0.0, remove GetGithubConnectors
+			githubConnectors, err := clientutils.CollectWithFallback(ctx,
+				func(ctx context.Context, limit int, start string) ([]types.GithubConnector, string, error) {
+					return authClient.ListGithubConnectors(ctx, limit, start, false)
+				},
+				func(ctx context.Context) ([]types.GithubConnector, error) {
+					return authClient.GetGithubConnectors(ctx, false)
+				},
+			)
 			if err != nil {
 				return webclient.AuthenticationSettings{}, trace.Wrap(err)
 			}
@@ -1612,6 +1697,7 @@ func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Para
 	}
 
 	group := r.URL.Query().Get(webclient.AgentUpdateGroupParameter)
+	updaterID := r.URL.Query().Get(webclient.AgentUpdateIDParameter)
 
 	return webclient.PingResponse{
 		Auth:              authSettings,
@@ -1620,7 +1706,7 @@ func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Para
 		MinClientVersion:  teleport.MinClientSemVer().String(),
 		ClusterName:       h.auth.clusterName,
 		AutomaticUpgrades: pr.ServerFeatures.GetAutomaticUpgrades(),
-		AutoUpdate:        h.automaticUpdateSettings184(r.Context(), group, "" /* updater UUID */),
+		AutoUpdate:        h.automaticUpdateSettings184(r.Context(), group, updaterID),
 		Edition:           modules.GetModules().BuildType(),
 		FIPS:              modules.IsBoringBinary(),
 	}, nil
@@ -1659,6 +1745,14 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, p httprouter.Para
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	// Now we modulate the autoupdate answer on a per-request basis.
+	// We don't want to cache one answer per updater UUID, so we take the
+	// cached result and just override what we must.
+	updaterID := r.URL.Query().Get(webclient.AgentUpdateIDParameter)
+	if updaterID != "" {
+		resp.AutoUpdate = h.automaticUpdateSettings184(r.Context(), group, updaterID)
+	}
 	return resp, nil
 }
 
@@ -1758,12 +1852,18 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 
 	authProviders := []webclient.WebConfigAuthProvider{}
 
+	// identifierFirstLoginEnabled is true if at least one auth connector has a defined `user_matchers` field.
+	var identifierFirstLoginEnabled bool
+
 	// get all OIDC connectors
 	oidcConnectors, err := h.cfg.ProxyClient.GetOIDCConnectors(r.Context(), false)
 	if err != nil {
 		h.logger.ErrorContext(r.Context(), "Cannot retrieve OIDC connectors", "error", err)
 	}
 	for _, item := range oidcConnectors {
+		if item.GetUserMatchers() != nil {
+			identifierFirstLoginEnabled = true
+		}
 		authProviders = append(authProviders, webclient.WebConfigAuthProvider{
 			Type:        webclient.WebConfigAuthProviderOIDCType,
 			WebAPIURL:   webclient.WebConfigAuthProviderOIDCURL,
@@ -1778,6 +1878,9 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 		h.logger.ErrorContext(r.Context(), "Cannot retrieve SAML connectors", "error", err)
 	}
 	for _, item := range samlConnectors {
+		if item.GetUserMatchers() != nil {
+			identifierFirstLoginEnabled = true
+		}
 		authProviders = append(authProviders, webclient.WebConfigAuthProvider{
 			Type:        webclient.WebConfigAuthProviderSAMLType,
 			WebAPIURL:   webclient.WebConfigAuthProviderSAMLURL,
@@ -1792,6 +1895,9 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 		h.logger.ErrorContext(r.Context(), "Cannot retrieve GitHub connectors", "error", err)
 	}
 	for _, item := range githubConnectors {
+		if item.GetUserMatchers() != nil {
+			identifierFirstLoginEnabled = true
+		}
 		authProviders = append(authProviders, webclient.WebConfigAuthProvider{
 			Type:        webclient.WebConfigAuthProviderGitHubType,
 			WebAPIURL:   webclient.WebConfigAuthProviderGitHubURL,
@@ -1822,16 +1928,17 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 		}
 
 		authSettings = webclient.WebConfigAuthSettings{
-			Providers:            authProviders,
-			SecondFactor:         types.LegacySecondFactorFromSecondFactors(cap.GetSecondFactors()),
-			LocalAuthEnabled:     cap.GetAllowLocalAuth(),
-			AllowPasswordless:    cap.GetAllowPasswordless(),
-			AuthType:             authType,
-			DefaultConnectorName: defaultConnectorName,
-			PreferredLocalMFA:    cap.GetPreferredLocalMFA(),
-			LocalConnectorName:   localConnectorName,
-			PrivateKeyPolicy:     cap.GetPrivateKeyPolicy(),
-			MOTD:                 cap.GetMessageOfTheDay(),
+			Providers:                   authProviders,
+			SecondFactor:                types.LegacySecondFactorFromSecondFactors(cap.GetSecondFactors()),
+			LocalAuthEnabled:            cap.GetAllowLocalAuth(),
+			AllowPasswordless:           cap.GetAllowPasswordless(),
+			AuthType:                    authType,
+			DefaultConnectorName:        defaultConnectorName,
+			PreferredLocalMFA:           cap.GetPreferredLocalMFA(),
+			LocalConnectorName:          localConnectorName,
+			PrivateKeyPolicy:            cap.GetPrivateKeyPolicy(),
+			MOTD:                        cap.GetMessageOfTheDay(),
+			IdentifierFirstLoginEnabled: identifierFirstLoginEnabled,
 		}
 	}
 
@@ -1861,7 +1968,7 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 	var automaticUpgradesTargetVersion string
 	if automaticUpgradesEnabled {
 		const group, updaterUUID = "", ""
-		agentVersion, err := h.autoUpdateAgentVersion(r.Context(), group, updaterUUID)
+		agentVersion, err := h.autoUpdateResolver.GetVersion(r.Context(), group, updaterUUID)
 		if err != nil {
 			h.logger.ErrorContext(r.Context(), "Cannot read autoupdate target version", "error", err)
 		} else {
@@ -1872,6 +1979,14 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 
 	disableRoleVisualizer, _ := strconv.ParseBool(os.Getenv("TELEPORT_UNSTABLE_DISABLE_ROLE_VISUALIZER"))
 
+	sessionSummarizerEnabled := false
+	if isEnabledRes, err := h.cfg.ProxyClient.SummarizerServiceClient().IsEnabled(
+		r.Context(),
+		&summarizerv1.IsEnabledRequest{},
+	); err == nil {
+		sessionSummarizerEnabled = isEnabledRes.Enabled
+	}
+
 	webCfg := webclient.WebConfig{
 		Edition:                        modules.GetModules().BuildType(),
 		Auth:                           authSettings,
@@ -1891,6 +2006,7 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 		IsStripeManaged:                clusterFeatures.GetIsStripeManaged(),
 		PremiumSupport:                 clusterFeatures.GetSupportType() == proto.SupportType_SUPPORT_TYPE_PREMIUM,
 		PlayableDatabaseProtocols:      player.SupportedDatabaseProtocols,
+		SessionSummarizerEnabled:       sessionSummarizerEnabled,
 		// Entitlements are reset/overridden in setEntitlementsWithLegacyLogic until setEntitlementsWithLegacyLogic is removed in v18
 		Entitlements: GetWebCfgEntitlements(clusterFeatures.GetEntitlements()),
 	}
@@ -1914,6 +2030,153 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 	return nil, nil
 }
 
+// getUserMatchedAuthConnectorsReq is the request body for getting user-matched auth connectors.
+type getUserMatchedAuthConnectorsReq struct {
+	// Username is the username to match against the auth connectors.
+	Username string `json:"username"`
+}
+
+// getUserMatchedAuthConnectorsResponse is the response body for getting user-matched auth connectors.
+type getUserMatchedAuthConnectorsResponse struct {
+	Connectors []webclient.WebConfigAuthProvider `json:"connectors"`
+}
+
+// globMatch performs simple a simple glob-style match test on a string.
+// - '*' matches zero or more characters.
+// It returns true if a match is detected.
+func globMatch(pattern, str string) (bool, error) {
+	pattern = utils.GlobToRegexp(pattern)
+	matched, err := regexp.MatchString(pattern, str)
+	return matched, trace.Wrap(err)
+}
+
+// userMatchesConnector is a helper function to check if a user matches any of a connector's user matchers.
+func userMatchesConnector(username string, connector interface {
+	GetUserMatchers() []string
+}) (isMatch bool, isFallback bool, err error) {
+	matchers := connector.GetUserMatchers()
+	for _, pattern := range matchers {
+		matched, err := globMatch(pattern, username)
+		if err != nil {
+			return false, false, trace.Wrap(err)
+		}
+		if matched {
+			// If the pattern is exactly "*", it matches all users and is considered a fallback.
+			// This match will only be returned to the user if the user doesn't match any other connectors via more explicit matchers.
+			// We continue here since there could be other matchers for this connector that are more specific, and if any of them match, this should not be treated as a fallback.
+			if pattern == "*" {
+				isFallback = true
+				continue
+			}
+			return true, false, nil
+		}
+	}
+	if isFallback {
+		return true, true, nil
+	}
+	return false, false, nil
+}
+
+// getUserMatchedAuthConnectors returns auth connectors that match the given username.
+func (h *Handler) getUserMatchedAuthConnectors(w http.ResponseWriter, r *http.Request, params httprouter.Params) (any, error) {
+	var req *getUserMatchedAuthConnectorsReq
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if req.Username != "" && len(req.Username) > teleport.MaxUsernameLength {
+		return nil, trace.BadParameter("username exceeds maximum length of %d characters", teleport.MaxUsernameLength)
+	}
+
+	githubConns, err := h.cfg.ProxyClient.GetGithubConnectors(r.Context(), false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	samlConns, err := h.cfg.ProxyClient.GetSAMLConnectorsWithValidationOptions(r.Context(), false, types.SAMLConnectorValidationFollowURLs(false))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	oidcConns, err := h.cfg.ProxyClient.GetOIDCConnectors(r.Context(), false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var matchedConnectors []webclient.WebConfigAuthProvider
+	var fallbackConnectors []webclient.WebConfigAuthProvider
+
+	// Match GitHub connectors
+	for _, conn := range githubConns {
+		if matches, isFallback, err := userMatchesConnector(req.Username, conn); err != nil {
+			return nil, trace.Wrap(err)
+		} else if matches {
+			provider := webclient.WebConfigAuthProvider{
+				Type:        webclient.WebConfigAuthProviderGitHubType,
+				WebAPIURL:   webclient.WebConfigAuthProviderGitHubURL,
+				Name:        conn.GetName(),
+				DisplayName: conn.GetDisplay(),
+			}
+
+			if isFallback {
+				fallbackConnectors = append(fallbackConnectors, provider)
+			} else {
+				matchedConnectors = append(matchedConnectors, provider)
+			}
+		}
+	}
+
+	// Match SAML connectors
+	for _, conn := range samlConns {
+		if matches, isFallback, err := userMatchesConnector(req.Username, conn); err != nil {
+			return nil, trace.Wrap(err)
+		} else if matches {
+			provider := webclient.WebConfigAuthProvider{
+				Type:        webclient.WebConfigAuthProviderSAMLType,
+				WebAPIURL:   webclient.WebConfigAuthProviderSAMLURL,
+				Name:        conn.GetName(),
+				DisplayName: conn.GetDisplay(),
+			}
+
+			if isFallback {
+				fallbackConnectors = append(fallbackConnectors, provider)
+			} else {
+				matchedConnectors = append(matchedConnectors, provider)
+			}
+		}
+	}
+
+	// Match OIDC connectors
+	for _, conn := range oidcConns {
+		if matches, isFallback, err := userMatchesConnector(req.Username, conn); err != nil {
+			return nil, trace.Wrap(err)
+		} else if matches {
+			provider := webclient.WebConfigAuthProvider{
+				Type:        webclient.WebConfigAuthProviderOIDCType,
+				WebAPIURL:   webclient.WebConfigAuthProviderOIDCURL,
+				Name:        conn.GetName(),
+				DisplayName: conn.GetDisplay(),
+			}
+			if isFallback {
+				fallbackConnectors = append(fallbackConnectors, provider)
+			} else {
+				matchedConnectors = append(matchedConnectors, provider)
+			}
+		}
+	}
+
+	// Use specific matches if available, otherwise use fallback matches.
+	var connectors []webclient.WebConfigAuthProvider
+	if len(matchedConnectors) > 0 {
+		connectors = matchedConnectors
+	} else {
+		connectors = fallbackConnectors
+	}
+
+	return &getUserMatchedAuthConnectorsResponse{
+		Connectors: connectors,
+	}, nil
+}
+
 // setEntitlementsWithLegacyLogic ensures entitlements on webCfg are backwards compatible
 // If Entitlements are present, will set the legacy fields equal to the equivalent entitlement value
 // i.e. webCfg.IsIGSEnabled = clusterFeatures.Entitlements[entitlements.Identity].Enabled
@@ -2157,6 +2420,7 @@ func (h *Handler) githubCallback(w http.ResponseWriter, r *http.Request, p httpr
 			CSRFToken:         response.Req.CSRFToken,
 			Username:          response.Username,
 			SessionName:       response.Session.GetName(),
+			SessionExpiry:     response.Session.Expiry(),
 			ClientRedirectURL: response.Req.ClientRedirectURL,
 		}
 
@@ -2193,6 +2457,7 @@ func (h *Handler) githubCallback(w http.ResponseWriter, r *http.Request, p httpr
 		TLSCert:           response.TLSCert,
 		HostSigners:       response.HostSigners,
 		FIPS:              h.cfg.FIPS,
+		ClientOptions:     response.ClientOptions,
 	})
 	if err != nil {
 		logger.ErrorContext(r.Context(), "Error constructing ssh response", "error", err)
@@ -2238,7 +2503,7 @@ func (h *Handler) installer(w http.ResponseWriter, r *http.Request, p httprouter
 	}
 
 	const group, agentUUD = "", ""
-	targetVersion, err := h.autoUpdateAgentVersion(r.Context(), group, agentUUD)
+	targetVersion, err := h.autoUpdateResolver.GetVersion(r.Context(), group, agentUUD)
 	if err != nil {
 		h.logger.WarnContext(r.Context(), "Error retrieving the target version", "error", err)
 		targetVersion = teleport.SemVer()
@@ -2300,11 +2565,14 @@ type AuthParams struct {
 	HostSigners []types.CertAuthority
 	// ClientRedirectURL is a URL to redirect client to
 	ClientRedirectURL string
-	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
+	// FIPS mode means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	FIPS bool
 	// MFAToken is an SSO MFA token.
 	MFAToken string
+	// ClientOptions contains some options that the cluster wants the client to
+	// use.
+	ClientOptions authclient.ClientOptions
 }
 
 // ConstructSSHResponse creates a special SSH response for SSH login method
@@ -2315,29 +2583,31 @@ func ConstructSSHResponse(response AuthParams) (*url.URL, error) {
 		return nil, trace.Wrap(err)
 	}
 	consoleResponse := authclient.SSHLoginResponse{
-		Username:    response.Username,
-		Cert:        response.Cert,
-		TLSCert:     response.TLSCert,
-		HostSigners: authclient.AuthoritiesToTrustedCerts(response.HostSigners),
-		MFAToken:    response.MFAToken,
+		Username:      response.Username,
+		Cert:          response.Cert,
+		TLSCert:       response.TLSCert,
+		HostSigners:   authclient.AuthoritiesToTrustedCerts(response.HostSigners),
+		MFAToken:      response.MFAToken,
+		ClientOptions: response.ClientOptions,
 	}
 	out, err := json.Marshal(consoleResponse)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	// Extract secret out of the request.
-	secretKey := u.Query().Get("secret_key")
-
-	// We don't use a secret key for WebUI SSO MFA redirects. The request ID itself is
-	// kept a secret on the front end to minimize the risk of a phishing attack.
-	if secretKey == "" && u.Path == sso.WebMFARedirect && response.MFAToken != "" {
+	if u.Path == sso.WebMFARedirect {
+		// Transform the web sso mfa redirectURL into a relative redirect, preserving
+		// query parameters while ignoring scheme, hostname, and other url parts.
 		q := u.Query()
 		q.Add("response", string(out))
-		u.RawQuery = q.Encode()
-		return u, nil
+		return &url.URL{
+			Path:     sso.WebMFARedirect,
+			RawQuery: q.Encode(),
+		}, nil
 	}
 
+	// Extract secret out of the request.
+	secretKey := u.Query().Get("secret_key")
 	if secretKey == "" {
 		return nil, trace.BadParameter("missing secret_key")
 	}
@@ -2474,6 +2744,7 @@ func (h *Handler) createWebSession(w http.ResponseWriter, r *http.Request, p htt
 	}
 
 	clientMeta := clientMetaFromReq(r)
+	clientMeta.ProxyGroupID = h.cfg.ProxyGroupID
 
 	var webSession types.WebSession
 	switch {
@@ -2497,7 +2768,7 @@ func (h *Handler) createWebSession(w http.ResponseWriter, r *http.Request, p htt
 		return nil, trace.AccessDenied("invalid credentials")
 	}
 
-	if err := websession.SetCookie(w, req.User, webSession.GetName()); err != nil {
+	if err := websession.SetCookie(w, req.User, webSession.GetName(), webSession.Expiry()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2621,7 +2892,7 @@ func (h *Handler) renewWebSession(w http.ResponseWriter, r *http.Request, params
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := websession.SetCookie(w, newSession.GetUser(), newSession.GetName()); err != nil {
+	if err := websession.SetCookie(w, newSession.GetUser(), newSession.GetName(), newSession.Expiry()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2698,7 +2969,7 @@ func (h *Handler) changeUserAuthentication(w http.ResponseWriter, r *http.Reques
 		return nil, trace.Wrap(err)
 	}
 
-	if err := websession.SetCookie(w, sess.GetUser(), sess.GetName()); err != nil {
+	if err := websession.SetCookie(w, sess.GetUser(), sess.GetName(), sess.Expiry()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2859,6 +3130,8 @@ func (h *Handler) mfaLoginFinish(w http.ResponseWriter, r *http.Request, p httpr
 	}
 
 	clientMeta := clientMetaFromReq(r)
+	clientMeta.ProxyGroupID = h.cfg.ProxyGroupID
+
 	cert, err := h.auth.AuthenticateSSHUser(r.Context(), *req, clientMeta)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -2883,6 +3156,8 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
 	}
 
 	clientMeta := clientMetaFromReq(r)
+	clientMeta.ProxyGroupID = h.cfg.ProxyGroupID
+
 	session, err := h.auth.AuthenticateWebUser(r.Context(), req, clientMeta)
 	switch {
 	// Since checking for private key policy meant that they passed authn,
@@ -2903,7 +3178,7 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
 
 	// Fetch user from session, user is empty for passwordless requests.
 	user := session.GetUser()
-	if err := websession.SetCookie(w, user, session.GetName()); err != nil {
+	if err := websession.SetCookie(w, user, session.GetName(), session.Expiry()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2959,14 +3234,14 @@ type getClusterInfoResponse struct {
 }
 
 // getClusterInfo returns the information about the cluster in the :site param
-func (h *Handler) getClusterInfo(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) getClusterInfo(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
-	clusterDetails, err := ui.GetClusterDetails(ctx, site)
+	clusterDetails, err := ui.GetClusterDetails(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2993,7 +3268,7 @@ type getSiteNamespacesResponse struct {
 // Successful response:
 //
 // {"namespaces": [{..namespace resource...}]}
-func (h *Handler) getSiteNamespaces(w http.ResponseWriter, r *http.Request, _ httprouter.Params, c *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) getSiteNamespaces(w http.ResponseWriter, r *http.Request, _ httprouter.Params, c *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	return getSiteNamespacesResponse{
 		Namespaces: []types.Namespace{types.DefaultNamespace()},
 	}, nil
@@ -3016,6 +3291,12 @@ func makeUnifiedResourceRequest(r *http.Request) (*proto.ListUnifiedResourcesReq
 		}
 	}
 
+	// include KindSAMLIdPServiceProvider when requesting KindApp
+	if slices.Contains(kinds, types.KindApp) &&
+		!slices.Contains(kinds, types.KindSAMLIdPServiceProvider) {
+		kinds = append(kinds, types.KindSAMLIdPServiceProvider)
+	}
+
 	// set default kinds to be requested if none exist in the request
 	if len(kinds) == 0 {
 		kinds = []string{
@@ -3051,29 +3332,6 @@ type loginGetter interface {
 	GetAllowedLoginsForResource(resource services.AccessCheckable) ([]string, error)
 }
 
-// calculateSSHLogins returns the subset of the allowedLogins that exist in
-// the principals of the identity. This is required because SSH authorization
-// only allows using a login that exists in the certificates valid principals.
-// When connecting to servers in a leaf cluster, the root certificate is used,
-// so we need to ensure that we only present the allowed logins that would
-// result in a successful connection, if any exists.
-func calculateSSHLogins(identity *tlsca.Identity, allowedLogins []string) ([]string, error) {
-	allowed := make(map[string]struct{})
-	for _, login := range allowedLogins {
-		allowed[login] = struct{}{}
-	}
-
-	var logins []string
-	for _, local := range identity.Principals {
-		if _, ok := allowed[local]; ok {
-			logins = append(logins, local)
-		}
-	}
-
-	slices.Sort(logins)
-	return logins, nil
-}
-
 // calculateAppLogins determines the app logins allowed for the provided
 // resource.
 //
@@ -3120,8 +3378,8 @@ func (h *Handler) getUserGroupLookup(ctx context.Context, clt apiclient.GetResou
 
 // clusterUnifiedResourcesGet returns a list of resources for a given cluster site. This includes all resources available to be displayed in the web ui
 // such as Nodes, Apps, Desktops, etc etc
-func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(request.Context(), site)
+func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(request.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3148,19 +3406,21 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 
 	getUserGroupLookup := h.getUserGroupLookup(request.Context(), clt)
 
+	clusterAuthProxyFeatures := h.getAuthProxyComponentFeaturesIntersection(request.Context())
+
 	unifiedResources := make([]any, 0, len(page))
 	for _, enriched := range page {
 		switch r := enriched.ResourceWithLabels.(type) {
 		case types.Server:
 			switch enriched.GetKind() {
 			case types.KindNode:
-				logins, err := calculateSSHLogins(identity, enriched.Logins)
+				logins, err := client.CalculateSSHLogins(identity.Principals, enriched.Logins)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
-				unifiedResources = append(unifiedResources, ui.MakeServer(site.GetName(), r, logins, enriched.RequiresRequest))
+				unifiedResources = append(unifiedResources, ui.MakeServer(cluster.GetName(), r, logins, enriched.RequiresRequest))
 			case types.KindGitServer:
-				unifiedResources = append(unifiedResources, ui.MakeGitServer(site.GetName(), r, enriched.RequiresRequest))
+				unifiedResources = append(unifiedResources, ui.MakeGitServer(cluster.GetName(), r, enriched.RequiresRequest))
 			}
 		case types.DatabaseServer:
 			db := ui.MakeDatabaseFromDatabaseServer(r, accessChecker, h.cfg.DatabaseREPLRegistry, enriched.RequiresRequest)
@@ -3180,14 +3440,20 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 				proxyDNSName = utils.FindMatchingProxyDNS(request.Host, h.proxyDNSNames())
 			}
 
+			// Compute end-to-end feature support for this app: only features that are supported by the AppServer *and*
+			// by all required cluster hops (Auth + Proxy), so clients can hide features that would fail somewhere
+			// along the request path.
+			appComponentFeatures := componentfeatures.Intersect(r.GetComponentFeatures(), clusterAuthProxyFeatures)
+
 			app := ui.MakeApp(r.GetApp(), ui.MakeAppsConfig{
 				LocalClusterName:      h.auth.clusterName,
 				LocalProxyDNSName:     proxyDNSName,
-				AppClusterName:        site.GetName(),
+				AppClusterName:        cluster.GetName(),
 				AllowedAWSRolesLookup: allowedAWSRolesLookup,
 				UserGroupLookup:       getUserGroupLookup(),
 				Logger:                h.logger,
 				RequiresRequest:       enriched.RequiresRequest,
+				SupportedFeatures:     appComponentFeatures,
 			})
 			unifiedResources = append(unifiedResources, app)
 		case types.SAMLIdPServiceProvider:
@@ -3196,7 +3462,7 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 			app := ui.MakeAppTypeFromSAMLApp(r, ui.MakeAppsConfig{
 				LocalClusterName:  h.auth.clusterName,
 				LocalProxyDNSName: h.proxyDNSName(),
-				AppClusterName:    site.GetName(),
+				AppClusterName:    cluster.GetName(),
 				RequiresRequest:   enriched.RequiresRequest,
 			})
 			unifiedResources = append(unifiedResources, app)
@@ -3207,6 +3473,10 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 			unifiedResources = append(unifiedResources, kube)
 		case types.KubeServer:
 			kube := ui.MakeKubeCluster(r.GetCluster(), accessChecker, enriched.RequiresRequest)
+			targetHealth := r.GetTargetHealth()
+			if targetHealth != nil {
+				kube.TargetHealth = *targetHealth
+			}
 			unifiedResources = append(unifiedResources, kube)
 		default:
 			return nil, trace.Errorf("UI Resource has unknown type: %T", enriched)
@@ -3221,11 +3491,56 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 	return resp, nil
 }
 
+// getAuthProxyComponentFeaturesIntersection returns an intersection of supported ComponentFeatures
+// from all cluster Proxy and Auth servers.
+func (h *Handler) getAuthProxyComponentFeaturesIntersection(ctx context.Context) *componentfeaturesv1.ComponentFeatures {
+	ap := h.GetAccessPoint()
+	features := make([]*componentfeaturesv1.ComponentFeatures, 0)
+
+	allProxies, err := clientutils.CollectWithFallback(
+		ctx,
+		ap.ListProxyServers,
+		func(context.Context) ([]types.Server, error) {
+			//nolint:staticcheck // TODO(kiosion): DELETE IN 21.0.0
+			return ap.GetProxies()
+		},
+	)
+	if err != nil {
+		// If we fail to get proxies & can't be sure about feature support,
+		// intersecting on `nil` ensures any intersection of ComponentFeatures will be empty.
+		h.logger.ErrorContext(ctx, "Failed to get proxy servers to collect ComponentFeatures", "error", err)
+		features = append(features, nil)
+	} else {
+		for _, srv := range allProxies {
+			features = append(features, srv.GetComponentFeatures())
+		}
+	}
+
+	allAuthServers, err := clientutils.CollectWithFallback(
+		ctx,
+		ap.ListAuthServers,
+		func(context.Context) ([]types.Server, error) {
+			//nolint:staticcheck // TODO(kiosion): DELETE IN 21.0.0
+			return ap.GetAuthServers()
+		},
+	)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "Failed to get auth servers to collect ComponentFeatures", "error", err)
+		features = append(features, nil)
+	} else {
+		for _, srv := range allAuthServers {
+			features = append(features, srv.GetComponentFeatures())
+		}
+	}
+
+	return componentfeatures.Intersect(features...)
+}
+
 // clusterNodesGet returns a list of nodes for a given cluster site.
-func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of nodes.
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3253,12 +3568,12 @@ func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p http
 			continue
 		}
 
-		logins, err := calculateSSHLogins(identity, resource.Logins)
+		logins, err := client.CalculateSSHLogins(identity.Principals, resource.Logins)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		uiServers = append(uiServers, ui.MakeServer(site.GetName(), server, logins, false /* requiresRequest */))
+		uiServers = append(uiServers, ui.MakeServer(cluster.GetName(), server, logins, false /* requiresRequest */))
 	}
 
 	return listResourcesGetResponse{
@@ -3272,8 +3587,8 @@ func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p http
 const iso8601MilliFormat = "2006-01-02T15:04:05.000Z0700"
 
 // notificationsGet returns a paginated list of notifications for a user.
-func (h *Handler) notificationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) notificationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3315,8 +3630,8 @@ type GetNotificationsResponse struct {
 }
 
 // notificationsUpsertLastSeenTimestamp upserts a user's last seen notification timestamp.
-func (h *Handler) notificationsUpsertLastSeenTimestamp(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) notificationsUpsertLastSeenTimestamp(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3352,8 +3667,8 @@ type UpsertUserLastSeenNotificationRequest struct {
 }
 
 // notificationsUpsertNotificationState upserts a user notification state.
-func (h *Handler) notificationsUpsertNotificationState(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) notificationsUpsertNotificationState(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3394,10 +3709,10 @@ type getLoginAlertsResponse struct {
 }
 
 // clusterLoginAlertsGet returns a list of on-login alerts for the user.
-func (h *Handler) clusterLoginAlertsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterLoginAlertsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of alerts.
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3421,15 +3736,27 @@ func (h *Handler) getClusterLocks(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnelclient.RemoteSite,
-) (interface{}, error) {
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
 	ctx := r.Context()
-	clt, err := sessionCtx.GetUserClient(ctx, site)
+	clt, err := sessionCtx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	locks, err := clt.GetLocks(ctx, false)
+	locks, err := clientutils.CollectWithFallback(
+		ctx,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			var noFilter *types.LockFilter
+			return clt.ListLocks(ctx, limit, start, noFilter)
+		},
+		func(ctx context.Context) ([]types.Lock, error) {
+			// TODO(okraport): DELETE IN v21
+			const inForceOnlyFalse = false
+			return clt.GetLocks(ctx, inForceOnlyFalse)
+		},
+	)
+
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3437,6 +3764,89 @@ func (h *Handler) getClusterLocks(
 	return ui.MakeLocks(locks), nil
 }
 
+type GetClusterLocksV2Response struct {
+	Locks []ui.Lock `json:"items"`
+}
+
+func (h *Handler) getClusterLocksV2(
+	w http.ResponseWriter,
+	r *http.Request,
+	p httprouter.Params,
+	sessionCtx *SessionContext,
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
+	ctx := r.Context()
+	clt, err := sessionCtx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// TODO(okraport): DELETE IN v21
+	var targets []types.LockTarget
+	filter := &types.LockFilter{}
+
+	if r.URL.Query().Has("target") {
+		ts := r.URL.Query()["target"]
+		for _, ts := range ts {
+			parts := strings.Split(ts, "|")
+			if len(parts) != 2 {
+				return nil, trace.BadParameter("invalid target %q", ts)
+			}
+			var target types.LockTarget
+			switch parts[0] {
+			case "user":
+				target.User = parts[1]
+			case "role":
+				target.Role = parts[1]
+			case "login":
+				target.Login = parts[1]
+			case "mfa_device":
+				target.MFADevice = parts[1]
+			case "windows_desktop":
+				target.WindowsDesktop = parts[1]
+			case "access_request":
+				target.AccessRequest = parts[1]
+			case "device":
+				target.Device = parts[1]
+			case "server_id":
+				target.ServerID = parts[1]
+			case "bot_instance_id":
+				target.BotInstanceID = parts[1]
+			case "join_token":
+				target.JoinToken = parts[1]
+			default:
+				return nil, trace.BadParameter("invalid target type %q", parts[0])
+			}
+			targets = append(targets, target)
+			filter.Targets = append(filter.Targets, &target)
+		}
+	}
+
+	inForceOnly := false
+	if r.URL.Query().Has("in_force_only") {
+		inForceOnly = r.URL.Query().Get("in_force_only") == "true"
+		filter.InForceOnly = inForceOnly
+	}
+
+	locks, err := clientutils.CollectWithFallback(
+		ctx,
+		func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+			return clt.ListLocks(ctx, limit, start, filter)
+		},
+		func(ctx context.Context) ([]types.Lock, error) {
+			// TODO(okraport): DELETE IN v21
+			return clt.GetLocks(ctx, inForceOnly, targets...)
+		},
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &GetClusterLocksV2Response{
+		Locks: ui.MakeLocks(locks),
+	}, nil
+}
+
 type createLockReq struct {
 	Targets types.LockTarget `json:"targets"`
 	Message string           `json:"message"`
@@ -3448,15 +3858,15 @@ func (h *Handler) createClusterLock(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnelclient.RemoteSite,
-) (interface{}, error) {
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
 	var req *createLockReq
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	ctx := r.Context()
-	clt, err := sessionCtx.GetUserClient(ctx, site)
+	clt, err := sessionCtx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3496,10 +3906,10 @@ func (h *Handler) deleteClusterLock(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnelclient.RemoteSite,
-) (interface{}, error) {
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
 	ctx := r.Context()
-	clt, err := sessionCtx.GetUserClient(ctx, site)
+	clt, err := sessionCtx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3547,9 +3957,9 @@ func (f SessionControllerFunc) AcquireSessionContext(ctx context.Context, sctx *
 func (h *Handler) siteNodeConnect(
 	w http.ResponseWriter,
 	r *http.Request,
-	p httprouter.Params,
+	_ httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) (interface{}, error) {
 	q := r.URL.Query()
@@ -3562,7 +3972,7 @@ func (h *Handler) siteNodeConnect(
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sessionCtx.GetUserClient(r.Context(), site)
+	clt, err := sessionCtx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3578,16 +3988,15 @@ func (h *Handler) siteNodeConnect(
 		tracker      types.SessionTracker
 	)
 
-	clusterName := site.GetName()
-	if req.SessionID.IsZero() {
-		// An existing session ID was not provided so we need to create a new one.
+	clusterName := cluster.GetName()
+	if req.JoinSessionID.IsZero() {
 		sessionData, err = h.generateSession(r.Context(), &req, clusterName, sessionCtx)
 		if err != nil {
 			h.logger.DebugContext(r.Context(), "Unable to generate new ssh session", "error", err)
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		sessionData, tracker, err = h.fetchExistingSession(ctx, clt, &req, clusterName)
+		sessionData, tracker, err = h.fetchJoinSession(ctx, clt, &req, clusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3607,11 +4016,10 @@ func (h *Handler) siteNodeConnect(
 	h.logger.DebugContext(r.Context(), "New terminal request",
 		"server", req.Server,
 		"login", req.Login,
-		"sid", sessionData.ID,
 		"websid", sessionCtx.GetSessionID(),
 	)
 
-	authAccessPoint, err := site.CachingAccessPoint()
+	authAccessPoint, err := cluster.CachingAccessPoint()
 	if err != nil {
 		h.logger.DebugContext(r.Context(), "Unable to get auth access point", "error", err)
 		return nil, trace.Wrap(err)
@@ -3632,7 +4040,7 @@ func (h *Handler) siteNodeConnect(
 		keepAliveInterval = req.KeepAliveInterval
 	}
 
-	nw, err := site.NodeWatcher()
+	nw, err := cluster.NodeWatcher()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3726,7 +4134,7 @@ func (h *Handler) podConnect(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) (interface{}, error) {
 	q := r.URL.Query()
@@ -3746,7 +4154,7 @@ func (h *Handler) podConnect(
 			params.SessionID.String(),
 			params.ParticipantMode,
 			sctx,
-			site,
+			cluster,
 			ws,
 		))
 	}
@@ -3773,7 +4181,7 @@ func (h *Handler) podConnect(
 	sess := session.Session{
 		Kind:                  types.KubernetesSessionKind,
 		Login:                 "root",
-		ClusterName:           site.GetName(),
+		ClusterName:           cluster.GetName(),
 		KubernetesClusterName: execReq.KubeCluster,
 		ID:                    session.NewID(),
 		Created:               h.clock.Now().UTC(),
@@ -3791,7 +4199,7 @@ func (h *Handler) podConnect(
 		"websid", sctx.GetSessionID(),
 	)
 
-	authAccessPoint, err := site.CachingAccessPoint()
+	authAccessPoint, err := cluster.CachingAccessPoint()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3814,7 +4222,7 @@ func (h *Handler) podConnect(
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3823,7 +4231,7 @@ func (h *Handler) podConnect(
 		req:                 execReq,
 		sess:                sess,
 		sctx:                sctx,
-		teleportCluster:     site.GetName(),
+		teleportCluster:     cluster.GetName(),
 		ws:                  ws,
 		keepAliveInterval:   netConfig.GetKeepAliveInterval(),
 		logger:              h.logger.With(teleport.ComponentKey, "pod"),
@@ -3904,7 +4312,7 @@ func (h *Handler) generateSession(ctx context.Context, req *TerminalRequest, clu
 		return session.Session{}, trace.Wrap(err)
 	}
 	policySets := accessChecker.SessionPolicySets()
-	accessEvaluator := auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, owner)
+	accessEvaluator := moderation.NewSessionAccessEvaluator(policySets, types.SSHSessionKind, owner)
 
 	return session.Session{
 		Kind:           types.SSHSessionKind,
@@ -3914,7 +4322,6 @@ func (h *Handler) generateSession(ctx context.Context, req *TerminalRequest, clu
 		ServerHostname: host,
 		ServerHostPort: port,
 		Moderated:      accessEvaluator.IsModerated(),
-		ID:             session.NewID(),
 		Created:        time.Now().UTC(),
 		LastActive:     time.Now().UTC(),
 		Namespace:      apidefaults.Namespace,
@@ -3922,9 +4329,19 @@ func (h *Handler) generateSession(ctx context.Context, req *TerminalRequest, clu
 	}, nil
 }
 
-// fetchExistingSession fetches an active or pending SSH session by the SessionID passed in the TerminalRequest.
-func (h *Handler) fetchExistingSession(ctx context.Context, clt authclient.ClientI, req *TerminalRequest, siteName string) (session.Session, types.SessionTracker, error) {
-	sessionID, err := session.ParseID(req.SessionID.String())
+// fetchJoinSession fetches an active or pending SSH session by the SessionID passed in the TerminalRequest.
+func (h *Handler) fetchJoinSession(ctx context.Context, clt authclient.ClientI, req *TerminalRequest, siteName string) (session.Session, types.SessionTracker, error) {
+	// Session joining is not supported in proxy recording mode
+	if recConfig, err := h.auth.accessPoint.GetSessionRecordingConfig(ctx); err != nil {
+		// If the user can't see the recording mode, just let them try joining below
+		if !trace.IsAccessDenied(err) {
+			return session.Session{}, nil, trace.Wrap(err)
+		}
+	} else if services.IsRecordAtProxy(recConfig.GetMode()) {
+		return session.Session{}, nil, trace.BadParameter("session joining is not supported in proxy recording mode. If you are a Teleport administrator, you can learn more about recording modes at: https://goteleport.com/docs/reference/architecture/session-recording")
+	}
+
+	sessionID, err := session.ParseID(req.JoinSessionID.String())
 	if err != nil {
 		return session.Session{}, nil, trace.Wrap(err)
 	}
@@ -3935,6 +4352,10 @@ func (h *Handler) fetchExistingSession(ctx context.Context, clt authclient.Clien
 		return session.Session{}, nil, trace.Wrap(err)
 	}
 
+	if types.IsOpenSSHNodeSubKind(tracker.GetTargetSubKind()) {
+		return session.Session{}, nil, trace.BadParameter("session joining is only supported for nodes which are Teleport agents, not OpenSSH nodes")
+	}
+
 	if tracker.GetSessionKind() != types.SSHSessionKind || tracker.GetState() == types.SessionState_SessionStateTerminated {
 		return session.Session{}, nil, trace.NotFound("SSH session %v not found", sessionID)
 	}
@@ -3971,12 +4392,13 @@ func trackerToLegacySession(tracker types.SessionTracker, clusterName string) se
 		parties = append(parties, session.Party{
 			ID:         session.ID(participant.ID),
 			User:       participant.User,
+			Cluster:    participant.Cluster,
 			ServerID:   tracker.GetAddress(),
 			LastActive: participant.LastActive,
 			// note: we don't populate the RemoteAddr field since it isn't used and we don't have an equivalent value
 		})
 	}
-	accessEvaluator := auth.NewSessionAccessEvaluator(tracker.GetHostPolicySets(), types.SSHSessionKind, tracker.GetHostUser())
+	accessEvaluator := moderation.NewSessionAccessEvaluator(tracker.GetHostPolicySets(), types.SSHSessionKind, tracker.GetHostUser())
 
 	return session.Session{
 		Kind:      tracker.GetSessionKind(),
@@ -4007,8 +4429,8 @@ func trackerToLegacySession(tracker types.SessionTracker, clusterName string) se
 // clusterActiveAndPendingSessionsGet gets the list of active and pending sessions for a site.
 //
 // GET /v1/webapi/sites/:site/sessions
-func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4022,7 +4444,7 @@ func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *h
 		return nil, trace.Wrap(err)
 	}
 
-	accessContext := auth.SessionAccessContext{
+	accessContext := moderation.SessionAccessContext{
 		Username: sctx.GetUser(),
 		Roles:    userRoles,
 	}
@@ -4032,7 +4454,7 @@ func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *h
 		if tracker.GetState() != types.SessionState_SessionStateTerminated {
 			session := trackerToLegacySession(tracker, p.ByName("site"))
 			// Get the participant modes available to the user from their roles.
-			accessEvaluator := auth.NewSessionAccessEvaluator(tracker.GetHostPolicySets(), types.SSHSessionKind, tracker.GetHostUser())
+			accessEvaluator := moderation.NewSessionAccessEvaluator(tracker.GetHostPolicySets(), types.SSHSessionKind, tracker.GetHostUser())
 			participantModes := accessEvaluator.CanJoin(accessContext)
 
 			sessions = append(sessions, siteSessionsGetResponseSession{Session: session, ParticipantModes: participantModes})
@@ -4071,7 +4493,7 @@ func toFieldsSlice(rawEvents []apievents.AuditEvent) ([]events.EventFields, erro
 //	"order":    optional ordering of events. Can be either "asc" or "desc"
 //	            for ascending and descending respectively.
 //	            If no order is provided it defaults to descending.
-func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	values := r.URL.Query()
 
 	var eventTypes []string
@@ -4089,7 +4511,7 @@ func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p
 			StartKey:   startKey,
 		})
 	}
-	return clusterEventsList(r.Context(), sctx, site, r.URL.Query(), searchEvents)
+	return clusterEventsList(r.Context(), sctx, cluster, r.URL.Query(), searchEvents)
 }
 
 // clusterSearchSessionEvents returns session events matching the criteria.
@@ -4106,7 +4528,7 @@ func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p
 //	"order":    optional ordering of events. Can be either "asc" or "desc"
 //	            for ascending and descending respectively.
 //	            If no order is provided it defaults to descending.
-func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	searchSessionEvents := func(clt authclient.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error) {
 		return clt.SearchSessionEvents(r.Context(), events.SearchSessionEventsRequest{
 			From:     from,
@@ -4116,12 +4538,12 @@ func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Requ
 			StartKey: startKey,
 		})
 	}
-	return clusterEventsList(r.Context(), sctx, site, r.URL.Query(), searchSessionEvents)
+	return clusterEventsList(r.Context(), sctx, cluster, r.URL.Query(), searchSessionEvents)
 }
 
 // clusterEventsList returns a list of audit events obtained using the provided
 // searchEvents method.
-func clusterEventsList(ctx context.Context, sctx *SessionContext, site reversetunnelclient.RemoteSite, values url.Values, searchEvents func(clt authclient.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error)) (interface{}, error) {
+func clusterEventsList(ctx context.Context, sctx *SessionContext, cluster reversetunnelclient.Cluster, values url.Values, searchEvents func(clt authclient.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error)) (any, error) {
 	from, err := queryTime(values, "from", time.Now().UTC().AddDate(0, -1, 0))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -4144,7 +4566,7 @@ func clusterEventsList(ctx context.Context, sctx *SessionContext, site reversetu
 
 	startKey := values.Get("startKey")
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4275,13 +4697,15 @@ func (h *Handler) headlessLogin(w http.ResponseWriter, r *http.Request, p httpro
 	}
 
 	authClient := h.cfg.ProxyClient
+	clientMeta := clientMetaFromReq(r)
+	clientMeta.ProxyGroupID = h.cfg.ProxyGroupID
 
 	authSSHUserReq := authclient.AuthenticateSSHRequest{
 		AuthenticateUserRequest: authclient.AuthenticateUserRequest{
 			Username:                 req.User,
 			SSHPublicKey:             req.SSHPubKey,
 			TLSPublicKey:             req.TLSPubKey,
-			ClientMetadata:           clientMetaFromReq(r),
+			ClientMetadata:           clientMeta,
 			HeadlessAuthenticationID: req.HeadlessAuthenticationID,
 		},
 		CompatibilityMode:       req.Compatibility,
@@ -4375,10 +4799,10 @@ const currentSiteShortcut = "-current-"
 type ContextHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext) (interface{}, error)
 
 // ClusterHandler is a authenticated handler that is called for some existing remote cluster
-type ClusterHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error)
+type ClusterHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error)
 
 // ClusterWebsocketHandler is a authenticated websocket handler that is called for some existing remote cluster
-type ClusterWebsocketHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite, ws *websocket.Conn) (interface{}, error)
+type ClusterWebsocketHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster, ws *websocket.Conn) (any, error)
 
 // WithClusterAuth wraps a ClusterHandler to ensure that a request is authenticated to this proxy
 // (the same as WithAuth), as well as to grab the remoteSite (which can represent this local cluster
@@ -4456,7 +4880,7 @@ func (h *Handler) WithClusterAuthWebSocket(fn ClusterWebsocketHandler) httproute
 // *SessionContext (same as AuthenticateRequest), and also grabs the
 // remoteSite (which can represent this local cluster or a remote
 // trusted cluster) as specified by the ":site" url parameter.
-func (h *Handler) authenticateWSRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, *websocket.Conn, reversetunnelclient.RemoteSite, error) {
+func (h *Handler) authenticateWSRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, *websocket.Conn, reversetunnelclient.Cluster, error) {
 	sctx, ws, err := h.AuthenticateRequestWS(w, r)
 	if err != nil {
 		return nil, nil, nil, trace.Wrap(err)
@@ -4474,7 +4898,7 @@ func (h *Handler) authenticateWSRequestWithCluster(w http.ResponseWriter, r *htt
 // to this proxy, returning the *SessionContext (same as AuthenticateRequest),
 // and also grabs the remoteSite (which can represent this local cluster or a
 // remote trusted cluster) as specified by the ":site" url parameter.
-func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, reversetunnelclient.RemoteSite, error) {
+func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, reversetunnelclient.Cluster, error) {
 	sctx, err := h.AuthenticateRequest(w, r, true)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -4490,7 +4914,7 @@ func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.
 
 // getSiteByParams gets the remoteSite (which can represent this local cluster or a
 // remote trusted cluster) as specified by the ":site" url parameter.
-func (h *Handler) getSiteByParams(ctx context.Context, sctx *SessionContext, p httprouter.Params) (reversetunnelclient.RemoteSite, error) {
+func (h *Handler) getSiteByParams(ctx context.Context, sctx *SessionContext, p httprouter.Params) (reversetunnelclient.Cluster, error) {
 	clusterName := p.ByName("site")
 	site, err := h.getSiteByClusterName(ctx, sctx, clusterName)
 	if err != nil {
@@ -4500,7 +4924,7 @@ func (h *Handler) getSiteByParams(ctx context.Context, sctx *SessionContext, p h
 	return site, nil
 }
 
-func (h *Handler) getSiteByClusterName(ctx context.Context, sctx *SessionContext, clusterName string) (reversetunnelclient.RemoteSite, error) {
+func (h *Handler) getSiteByClusterName(ctx context.Context, sctx *SessionContext, clusterName string) (reversetunnelclient.Cluster, error) {
 	if clusterName == currentSiteShortcut {
 		res, err := h.cfg.ProxyClient.GetClusterName(ctx)
 		if err != nil {
@@ -4516,13 +4940,13 @@ func (h *Handler) getSiteByClusterName(ctx context.Context, sctx *SessionContext
 		return nil, trace.Wrap(err)
 	}
 
-	site, err := proxy.GetSite(clusterName)
+	cluster, err := proxy.Cluster(ctx, clusterName)
 	if err != nil {
 		h.logger.WarnContext(ctx, "Failed to query site", "error", err, "cluster", clusterName)
 		return nil, trace.Wrap(err)
 	}
 
-	return site, nil
+	return cluster, nil
 }
 
 // ClusterClientProvider is an interface for a type which can provide
@@ -4575,7 +4999,7 @@ func (h *Handler) WithClusterClientProvider(fn ClusterClientHandler) httprouter.
 }
 
 // ProvisionTokenHandler is a authenticated handler that is called for some existing Token
-type ProvisionTokenHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnelclient.RemoteSite, token types.ProvisionToken) (interface{}, error)
+type ProvisionTokenHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, cluster reversetunnelclient.Cluster, token types.ProvisionToken) (any, error)
 
 // WithProvisionTokenAuth ensures that request is authenticated with a provision token.
 // Provision tokens, when used like this are invalidated as soon as used.
@@ -4594,13 +5018,13 @@ func (h *Handler) WithProvisionTokenAuth(fn ProvisionTokenHandler) httprouter.Ha
 			return nil, trace.AccessDenied("need auth")
 		}
 
-		site, err := h.cfg.Proxy.GetSite(h.auth.clusterName)
+		cluster, err := h.cfg.Proxy.Cluster(ctx, h.auth.clusterName)
 		if err != nil {
 			h.logger.WarnContext(ctx, "Failed to query cluster", "error", err, "cluster", h.auth.clusterName)
 			return nil, trace.Wrap(err)
 		}
 
-		return fn(w, r, p, site, token)
+		return fn(w, r, p, cluster, token)
 	})
 }
 
@@ -4716,7 +5140,7 @@ func (h *Handler) WithSession(fn ContextHandler) httprouter.Handle {
 // This is a good default to use as both Cluster and User auth are checked here, but `WithLimiter` can be used if
 // you're certain that no authenticated requests will be made.
 func (h *Handler) WithUnauthenticatedLimiter(fn httplib.HandlerFunc) httprouter.Handle {
-	return h.unauthenticatedLimiterFunc(fn, h.WithLimiterHandlerFunc)
+	return h.unauthenticatedLimiterFunc(fn, h.limiter)
 }
 
 // WithUnauthenticatedHighLimiter adds a conditional IP-based rate limiting that will limit only unauthenticated
@@ -4724,16 +5148,24 @@ func (h *Handler) WithUnauthenticatedLimiter(fn httplib.HandlerFunc) httprouter.
 // This higher rate limit should only be used on endpoints which are only CPU constrained
 // (no file or other resources used).
 func (h *Handler) WithUnauthenticatedHighLimiter(fn httplib.HandlerFunc) httprouter.Handle {
-	return h.unauthenticatedLimiterFunc(fn, h.WithHighLimiterHandlerFunc)
+	return h.unauthenticatedLimiterFunc(fn, h.highLimiter)
 }
 
-func (h *Handler) unauthenticatedLimiterFunc(fn httplib.HandlerFunc, rateFunc func(fn httplib.HandlerFunc) httplib.HandlerFunc) httprouter.Handle {
+func (h *Handler) unauthenticatedLimiterFunc(fn httplib.HandlerFunc, limiter *limiter.RateLimiter) httprouter.Handle {
 	return httplib.MakeHandler(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
+		// check if the request remote is rate limited before attempting authentication.
+		isLimited, err := isRequestRateLimited(r, limiter)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if isLimited {
+			return nil, trace.LimitExceeded("rate limit exceeded")
+		}
 		if _, _, err := h.authenticateRequestWithCluster(w, r, p); err != nil {
 			// retry with user auth
 			if _, err = h.AuthenticateRequest(w, r, true /* check token */); err != nil {
 				// no auth passed, limit request
-				return rateFunc(fn)(w, r, p)
+				return withLimiterHandlerFunc(fn, limiter)(w, r, p)
 			}
 		}
 		// auth passed, call directly
@@ -4741,6 +5173,53 @@ func (h *Handler) unauthenticatedLimiterFunc(fn httplib.HandlerFunc, rateFunc fu
 	})
 }
 
+func withLimiterHandlerFunc(fn httplib.HandlerFunc, limiter *limiter.RateLimiter) httplib.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+		err := rateLimitRequest(r, limiter)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return fn(w, r, p)
+	}
+}
+
+// WithAccessDeniedLimiter adds conditional IP-based rate limiting that only applies
+// when the request handler returns an access denied error.
+//
+// This is different from WithUnauthenticatedLimiter in an important way:
+//   - WithUnauthenticatedLimiter: Checks authentication BEFORE executing the handler using local
+//     authentication mechanisms (user auth session cookie). If authentication fails locally, it
+//     applies rate limiting BEFORE executing the handler.
+//   - WithAccessDeniedLimiter: Executes the handler first, delegates authentication
+//     to the handler, then applies rate limiting ONLY if the handler returns an access denied error.
+//
+// Use this limiter for endpoints where authentication happens downstream (e.g., SCIM
+// endpoints where auth is handled by the auth server, not in the proxy).
+func (h *Handler) WithAccessDeniedLimiter(fn httplib.HandlerFunc) httprouter.Handle {
+	return h.conditionalLimiterFunc(fn, h.limiter, trace.IsAccessDenied)
+}
+
+func (h *Handler) conditionalLimiterFunc(fn httplib.HandlerFunc, limiter *limiter.RateLimiter, shouldLimit func(error) bool) httprouter.Handle {
+	return httplib.MakeHandler(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+		remoteAddr, err := getRemoteAddressFromRequest(r)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if limiter.IsRateLimited(remoteAddr) {
+			return nil, trace.LimitExceeded("rate limit exceeded")
+		}
+		result, err := fn(w, r, p)
+		if err != nil {
+			if shouldLimit(err) {
+				if err := limiter.RegisterRequest(remoteAddr, nil); err != nil {
+					return nil, trace.Wrap(err)
+				}
+			}
+		}
+		return result, err
+	})
+}
+
 // WithLimiter adds IP-based rate limiting to fn.
 // Limits are applied to all requests, authenticated or not.
 func (h *Handler) WithLimiter(fn httplib.HandlerFunc) httprouter.Handle {
@@ -4783,6 +5262,24 @@ func (h *Handler) WithHighLimiterHandlerFunc(fn httplib.HandlerFunc) httplib.Han
 	}
 }
 
+// isRequestRateLimited checks if the request would be rate-limited without consuming any tokens.
+// Returns true if the request is rate-limited, false otherwise.
+func isRequestRateLimited(r *http.Request, limiter *limiter.RateLimiter) (bool, error) {
+	remote, err := getRemoteAddressFromRequest(r)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	return limiter.IsRateLimited(remote), nil
+}
+
+func getRemoteAddressFromRequest(r *http.Request) (string, error) {
+	remote, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return remote, nil
+}
+
 func rateLimitRequest(r *http.Request, limiter *limiter.RateLimiter) error {
 	remote, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
@@ -4934,7 +5431,7 @@ func (h *Handler) AuthenticateRequestWS(w http.ResponseWriter, r *http.Request)
 
 // ProxyWithRoles returns a reverse tunnel proxy verifying the permissions
 // of the given user.
-func (h *Handler) ProxyWithRoles(ctx context.Context, sctx *SessionContext) (reversetunnelclient.Tunnel, error) {
+func (h *Handler) ProxyWithRoles(ctx context.Context, sctx *SessionContext) (reversetunnelclient.ClusterGetter, error) {
 	accessChecker, err := sctx.GetUserAccessChecker()
 	if err != nil {
 		h.logger.WarnContext(ctx, "Failed to get client roles", "error", err)
@@ -4945,7 +5442,7 @@ func (h *Handler) ProxyWithRoles(ctx context.Context, sctx *SessionContext) (rev
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return reversetunnelclient.NewTunnelWithRoles(h.cfg.Proxy, cn.GetClusterName(), accessChecker.CheckAccessToRemoteCluster, h.cfg.AccessPoint), nil
+	return reversetunnelclient.NewClusterGetterWithRoles(h.cfg.Proxy, cn.GetClusterName(), accessChecker.CheckAccessToRemoteCluster, h.cfg.AccessPoint), nil
 }
 
 // ProxyHostPort returns the address of the proxy server using --proxy
@@ -5028,6 +5525,7 @@ func makeTeleportClientConfig(ctx context.Context, sctx *SessionContext) (*clien
 		HostKeyCallback:   callback,
 		TLSRoutingEnabled: proxyListenerMode == types.ProxyListenerMode_Multiplex,
 		Tracer:            apitracing.DefaultProvider().Tracer("webterminal"),
+		AddKeysToAgent:    client.AddKeysToAgentNo,
 	}
 
 	return config, nil
@@ -5044,6 +5542,8 @@ type SSORequestParams struct {
 	ConnectorID string
 	// CSRFToken is used to protect against login-CSRF in SSO flows.
 	CSRFToken string
+	// LoginHint is the user's identifier (email) for identifier-first login.
+	LoginHint string
 }
 
 // ParseSSORequestParams extracts the SSO request parameters from an http.Request,
@@ -5071,6 +5571,10 @@ func ParseSSORequestParams(r *http.Request) (*SSORequestParams, error) {
 	}
 
 	query := r.URL.Query()
+	loginHint := query.Get("login_hint")
+	if len(loginHint) > teleport.MaxUsernameLength {
+		loginHint = ""
+	}
 	connectorID := query.Get("connector_id")
 	if connectorID == "" {
 		return nil, trace.BadParameter("missing connector_id query parameter")
@@ -5085,6 +5589,7 @@ func ParseSSORequestParams(r *http.Request) (*SSORequestParams, error) {
 		ClientRedirectURL: clientRedirectURL,
 		ConnectorID:       connectorID,
 		CSRFToken:         csrfToken,
+		LoginHint:         loginHint,
 	}, nil
 }
 
@@ -5100,6 +5605,10 @@ type SSOCallbackResponse struct {
 	// SessionName is the name of the session generated by auth server if
 	// requested in the SSO request.
 	SessionName string
+	// SessionExpiry is the expiration of the session. This is used
+	// to set the expiration time of the cookie. If no expiraton is set,
+	// the cookie with be a "session cookie", which is removed when the browser closes.
+	SessionExpiry time.Time
 	// ClientRedirectURL is the URL to redirect back to on completion of
 	// the SSO login process.
 	ClientRedirectURL string
@@ -5124,7 +5633,7 @@ func SSOSetWebSessionAndRedirectURL(w http.ResponseWriter, r *http.Request, resp
 		}
 	}
 
-	if err := websession.SetCookie(w, response.Username, response.SessionName); err != nil {
+	if err := websession.SetCookie(w, response.Username, response.SessionName, response.SessionExpiry); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/web/apiserver_login_test.go b/lib/web/apiserver_login_test.go
index 9f8c00a99ba36..dc3eb99f816bd 100644
--- a/lib/web/apiserver_login_test.go
+++ b/lib/web/apiserver_login_test.go
@@ -38,13 +38,13 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -203,7 +203,7 @@ func TestWebauthnLogin_webWithPrivateKeyEnabledError(t *testing.T) {
 	_, err = authServer.UpsertAuthPreference(ctx, cap)
 	require.NoError(t, err)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		MockAttestationData: &keys.AttestationData{
 			PrivateKeyPolicy: keys.PrivateKeyPolicyNone,
 		},
@@ -415,10 +415,10 @@ func TestPasswordlessProhibitedForSSO(t *testing.T) {
 	ctx := context.Background()
 
 	// Register a passwordless device.
-	userClient, err := testServer.NewClient(auth.TestUser(user))
+	userClient, err := testServer.NewClient(authtest.TestUser(user))
 	require.NoError(t, err, "NewClient failed")
-	pwdlessDev, err := auth.RegisterTestDevice(
-		ctx, userClient, "pwdless", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, mfa.WebDev, auth.WithPasswordless())
+	pwdlessDev, err := authtest.RegisterTestDevice(
+		ctx, userClient, "pwdless", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, mfa.WebDev, authtest.WithPasswordless())
 	require.NoError(t, err, "RegisterTestDevice failed")
 
 	// Update the user so it looks like an SSO user.
@@ -605,7 +605,7 @@ func TestAuthenticate_deviceWebToken(t *testing.T) {
 
 type configureMFAResp struct {
 	User, Password string
-	WebDev         *auth.TestDevice
+	WebDev         *authtest.Device
 }
 
 func configureClusterForMFA(t *testing.T, env *webPack, spec *types.AuthPreferenceSpecV2) *configureMFAResp {
@@ -625,9 +625,9 @@ func configureClusterForMFA(t *testing.T, env *webPack, spec *types.AuthPreferen
 	env.proxies[0].createUser(ctx, t, user, "root", "password1234", "" /* otpSecret */, nil /* roles */)
 
 	// Register device.
-	clt, err := env.server.NewClient(auth.TestUser(user))
+	clt, err := env.server.NewClient(authtest.TestUser(user))
 	require.NoError(t, err)
-	webDev, err := auth.RegisterTestDevice(ctx, clt, "webauthn", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "webauthn", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
 
 	return &configureMFAResp{
diff --git a/lib/web/apiserver_ping_test.go b/lib/web/apiserver_ping_test.go
index 84e073ca7ae87..291dcb1a21553 100644
--- a/lib/web/apiserver_ping_test.go
+++ b/lib/web/apiserver_ping_test.go
@@ -25,6 +25,7 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
@@ -34,10 +35,12 @@ import (
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	autoupdatev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/autoupdate"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 )
 
 func TestPing(t *testing.T) {
@@ -214,7 +217,7 @@ func TestPing(t *testing.T) {
 			if buildType == "" {
 				buildType = modules.BuildOSS
 			}
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestBuildType: buildType,
 			})
 
@@ -251,9 +254,9 @@ func TestPing_multiProxyAddr(t *testing.T) {
 
 // TestPing_minimalAPI tests that pinging the minimal web API works correctly.
 func TestPing_minimalAPI(t *testing.T) {
-	env := newWebPack(t, 1, func(cfg *proxyConfig) {
+	env := newWebPack(t, 1, withWebPackProxyOptions(func(cfg *proxyConfig) {
 		cfg.minimalHandler = true
-	})
+	}))
 	proxy := env.proxies[0]
 	tests := []struct {
 		name string
@@ -283,23 +286,23 @@ func TestPing_minimalAPI(t *testing.T) {
 
 // TestPing_autoUpdateResources tests that find endpoint return correct data related to auto updates.
 func TestPing_autoUpdateResources(t *testing.T) {
-	env := newWebPack(t, 1, func(cfg *proxyConfig) {
-		cfg.minimalHandler = true
-	})
+	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	req, err := http.NewRequest(http.MethodGet, proxy.newClient(t).Endpoint("webapi", "find"), nil)
-	require.NoError(t, err)
-	req.Host = proxy.handler.handler.cfg.ProxyPublicAddrs[0].Host()
+	testGroup := "test-group"
+	testUpdaterID := uuid.NewString()
 
+	// Note: we are not using webclient.Ping() here because we don't have a valid certificate for 127.0.0.1 and
+	// The webclient doesn't support being passed custom transport.
+	clt := proxy.newClient(t)
 	tests := []struct {
 		name     string
 		config   *autoupdatev1pb.AutoUpdateConfigSpec
 		version  *autoupdatev1pb.AutoUpdateVersionSpec
-		rollout  *autoupdatev1pb.AutoUpdateAgentRolloutSpec
+		rollout  *autoupdatev1pb.AutoUpdateAgentRollout
 		cleanup  bool
 		expected webclient.AutoUpdateSettings
 	}{
@@ -331,12 +334,17 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "enable agent auto update, immediate schedule",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
-				AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-				Strategy:       autoupdate.AgentsStrategyHaltOnError,
-				Schedule:       autoupdate.AgentsScheduleImmediate,
-				StartVersion:   "1.2.3",
-				TargetVersion:  "1.2.4",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleImmediate,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
 			},
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
@@ -349,12 +357,17 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "agent rollout present but AU mode is disabled",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
-				AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
-				Strategy:       autoupdate.AgentsStrategyHaltOnError,
-				Schedule:       autoupdate.AgentsScheduleImmediate,
-				StartVersion:   "1.2.3",
-				TargetVersion:  "1.2.4",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleImmediate,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
 			},
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
@@ -433,6 +446,171 @@ func TestPing_autoUpdateResources(t *testing.T) {
 				AgentAutoUpdate:          false,
 				AgentVersion:             api.Version,
 			},
+			cleanup: true,
+		},
+		{
+			name: "group must be updated",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
+				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:       testGroup,
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+							ConfigDays: []string{"*"},
+						},
+						{
+							Name:       "unstarted",
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							ConfigDays: []string{"*"},
+						},
+					},
+				},
+			},
+			expected: webclient.AutoUpdateSettings{
+				ToolsVersion:             api.Version,
+				ToolsAutoUpdate:          false,
+				AgentVersion:             "1.2.4",
+				AgentAutoUpdate:          true,
+				AgentUpdateJitterSeconds: DefaultAgentUpdateJitterSeconds,
+			},
+			cleanup: true,
+		},
+		{
+			name: "group must not be updated",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
+				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:       "done",
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+							ConfigDays: []string{"*"},
+						},
+						{
+							Name:       testGroup,
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							ConfigDays: []string{"*"},
+						},
+					},
+				},
+			},
+			expected: webclient.AutoUpdateSettings{
+				ToolsVersion:             api.Version,
+				ToolsAutoUpdate:          false,
+				AgentVersion:             "1.2.3",
+				AgentAutoUpdate:          false,
+				AgentUpdateJitterSeconds: DefaultAgentUpdateJitterSeconds,
+			},
+			cleanup: true,
+		},
+		{
+			name: "canary must be updated",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
+				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:       testGroup,
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+							ConfigDays: []string{"*"},
+							Canaries: []*autoupdatev1pb.Canary{
+								{
+									UpdaterId: testUpdaterID,
+									HostId:    uuid.NewString(),
+									Hostname:  "test-host",
+									Success:   false,
+								},
+							},
+						},
+						{
+							Name:       "unstarted",
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							ConfigDays: []string{"*"},
+						},
+					},
+				},
+			},
+			expected: webclient.AutoUpdateSettings{
+				ToolsVersion:             api.Version,
+				ToolsAutoUpdate:          false,
+				AgentVersion:             "1.2.4",
+				AgentAutoUpdate:          true,
+				AgentUpdateJitterSeconds: DefaultAgentUpdateJitterSeconds,
+			},
+			cleanup: true,
+		},
+		{
+			name: "canary must not be updated",
+			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateAgentRollout,
+				},
+				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+				},
+				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:  testGroup,
+							State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+							Canaries: []*autoupdatev1pb.Canary{
+								{
+									UpdaterId: uuid.NewString(),
+									HostId:    uuid.NewString(),
+									Hostname:  "test-host",
+									Success:   false,
+								},
+							},
+							ConfigDays: []string{"*"},
+						},
+						{
+							Name:       "unstarted",
+							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							ConfigDays: []string{"*"},
+						},
+					},
+				},
+			},
+			expected: webclient.AutoUpdateSettings{
+				ToolsVersion:             api.Version,
+				ToolsAutoUpdate:          false,
+				AgentVersion:             "1.2.3",
+				AgentAutoUpdate:          false,
+				AgentUpdateJitterSeconds: DefaultAgentUpdateJitterSeconds,
+			},
+			cleanup: true,
 		},
 	}
 	for _, tc := range tests {
@@ -450,9 +628,7 @@ func TestPing_autoUpdateResources(t *testing.T) {
 				require.NoError(t, err)
 			}
 			if tc.rollout != nil {
-				rollout, err := autoupdate.NewAutoUpdateAgentRollout(tc.rollout)
-				require.NoError(t, err)
-				_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
+				_, err := env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, tc.rollout)
 				require.NoError(t, err)
 			}
 
@@ -461,12 +637,14 @@ func TestPing_autoUpdateResources(t *testing.T) {
 				proxy.clock.Advance(2 * findEndpointCacheTTL)
 			}
 
-			resp, err := client.NewInsecureWebClient().Do(req)
+			resp, err := clt.Get(ctx, clt.Endpoint("webapi", "ping"), url.Values{
+				webclient.AgentUpdateIDParameter:    []string{testUpdaterID},
+				webclient.AgentUpdateGroupParameter: []string{testGroup},
+			})
 			require.NoError(t, err)
 
 			pr := &webclient.PingResponse{}
-			require.NoError(t, json.NewDecoder(resp.Body).Decode(pr))
-			require.NoError(t, resp.Body.Close())
+			require.NoError(t, json.NewDecoder(resp.Reader()).Decode(pr))
 
 			assert.Equal(t, tc.expected, pr.AutoUpdate)
 
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index 11346cae8c3c4..62915f58bf561 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -45,6 +45,7 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -92,6 +93,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
@@ -100,6 +102,7 @@ import (
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	tlsutils "github.com/gravitational/teleport/lib/auth/keygen"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/auth/state"
@@ -111,16 +114,21 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/conntest"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
+	"github.com/gravitational/teleport/lib/client/sso"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
+	"github.com/gravitational/teleport/lib/healthcheck"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/httplib/csrf"
 	"github.com/gravitational/teleport/lib/inventory"
 	kubeproxy "github.com/gravitational/teleport/lib/kube/proxy"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/player"
@@ -141,6 +149,8 @@ import (
 	"github.com/gravitational/teleport/lib/ui"
 	"github.com/gravitational/teleport/lib/utils"
 	utilsaws "github.com/gravitational/teleport/lib/utils/aws"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 	"github.com/gravitational/teleport/lib/web/app"
 	websession "github.com/gravitational/teleport/lib/web/session"
 	"github.com/gravitational/teleport/lib/web/terminal"
@@ -163,7 +173,7 @@ type WebSuite struct {
 	webHandler *APIHandler
 
 	mockU2F     *mocku2f.Key
-	server      *auth.TestServer
+	server      *authtest.Server
 	proxyClient *authclient.Client
 	clock       *clockwork.FakeClock
 }
@@ -171,7 +181,7 @@ type WebSuite struct {
 // TestMain will re-execute Teleport to run a command if "exec" is passed to
 // it as an argument. Otherwise, it will run tests as normal.
 func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	modules.SetInsecureTestMode(true)
 	// If the test is re-executing itself, execute the command that comes over
 	// the pipe.
@@ -179,10 +189,13 @@ func TestMain(m *testing.M) {
 		srv.RunAndExit(os.Args[1])
 		return
 	}
-	cryptosuites.PrecomputeRSATestKeys(m)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
 
 	// Otherwise run tests as normal.
 	code := m.Run()
+	cancel()
 	os.Exit(code)
 }
 
@@ -196,6 +209,8 @@ type webSuiteConfig struct {
 
 	disableDiskBasedRecording bool
 
+	onSessionRecordEvent func(ctx context.Context, sid session.ID, pe apievents.PreparedSessionEvent) error
+
 	uiConfig webclient.UIConfig
 
 	// Custom "HealthCheckAppServer" function. Can be used to avoid dialing app
@@ -247,8 +262,8 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 	})
 	require.NoError(t, err)
 
-	authCfg := auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
+	authCfg := authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
 			ClusterName:             "localhost",
 			Dir:                     t.TempDir(),
 			Clock:                   s.clock,
@@ -259,9 +274,20 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 
 	if cfg.disableDiskBasedRecording {
 		authCfg.Auth.AuditLog = events.NewDiscardAuditLog()
+		if cfg.onSessionRecordEvent != nil {
+			streamer, err := events.NewCallbackStreamer(
+				events.CallbackStreamerConfig{
+					// Inner emits events to the underlying store
+					Inner:         events.NewDiscardStreamer(),
+					OnRecordEvent: cfg.onSessionRecordEvent,
+				},
+			)
+			require.NoError(t, err)
+			authCfg.Auth.Streamer = streamer
+		}
 	}
 
-	s.server, err = auth.NewTestServer(authCfg)
+	s.server, err = authtest.NewTestServer(authCfg)
 	require.NoError(t, err)
 
 	if cfg.disableDiskBasedRecording {
@@ -271,6 +297,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 		recConfig.SetMode(types.RecordAtNodeSync)
 		_, err := s.server.AuthServer.AuthServer.UpsertSessionRecordingConfig(context.Background(), recConfig)
 		require.NoError(t, err)
+
 	}
 
 	// Register the auth server, since test auth server doesn't start its own
@@ -293,7 +320,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPub, err := auth.PrivateKeyToPublicKeyTLS(priv)
+	tlsPub, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	nodeID := "node"
@@ -306,13 +333,13 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 			Role:         types.RoleNode,
 			PublicSSHKey: pub,
 			PublicTLSKey: tlsPub,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	signer, err := sshutils.NewSigner(priv, certs.SSH)
 	require.NoError(t, err)
 
-	nodeClient, err := s.server.NewClient(auth.TestIdentity{
+	nodeClient, err := s.server.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: nodeID,
@@ -366,7 +393,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 
 	// create reverse tunnel service:
 	proxyID := "proxy"
-	s.proxyClient, err = s.server.NewClient(auth.TestIdentity{
+	s.proxyClient, err = s.server.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleProxy,
 			Username: proxyID,
@@ -441,7 +468,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 	router, err := proxy.NewRouter(proxy.RouterConfig{
 		ClusterName:      s.server.ClusterName(),
 		LocalAccessPoint: s.proxyClient,
-		SiteGetter:       revTunServer,
+		ClusterGetter:    revTunServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -480,8 +507,6 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 
 	// Expired sessions are purged immediately
 	var sessionLingeringThreshold time.Duration
-	fs, err := NewDebugFileSystem(false)
-	require.NoError(t, err)
 
 	features := *modules.GetModules().Features().ToProto() // safe to dereference because ToProto creates a struct and return a pointer to it
 	if cfg.ClusterFeatures != nil {
@@ -507,7 +532,6 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 		Context:                         s.ctx,
 		HostUUID:                        proxyID,
 		Emitter:                         s.proxyClient,
-		StaticFS:                        fs,
 		CachedSessionLingeringThreshold: &sessionLingeringThreshold,
 		ProxySettings: &ProxySettings{
 			ServiceConfig: servicecfg.MakeDefaultConfig(),
@@ -551,6 +575,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 
 	// Wait for proxy to fully register before starting the test.
 	for start := time.Now(); ; {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 		proxies, err := s.proxyClient.GetProxies()
 		require.NoError(t, err)
 		if len(proxies) != 0 {
@@ -600,7 +625,7 @@ func (s *WebSuite) addNode(t *testing.T, uuid string, hostname string, address s
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPub, err := auth.PrivateKeyToPublicKeyTLS(priv)
+	tlsPub, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	// start node
@@ -611,13 +636,13 @@ func (s *WebSuite) addNode(t *testing.T, uuid string, hostname string, address s
 			Role:         types.RoleNode,
 			PublicSSHKey: pub,
 			PublicTLSKey: tlsPub,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	signer, err := sshutils.NewSigner(priv, certs.SSH)
 	require.NoError(t, err)
 
-	nodeClient, err := s.server.NewClient(auth.TestIdentity{
+	nodeClient, err := s.server.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: uuid,
@@ -697,7 +722,7 @@ type authPack struct {
 	session   *CreateSessionResponse
 	clt       *TestWebClient
 	cookies   []*http.Cookie
-	device    *auth.TestDevice
+	device    *authtest.Device
 }
 
 // authPack returns new authenticated package consisting of created valid
@@ -821,7 +846,7 @@ func (s *WebSuite) authPackWithMFA(t *testing.T, name string, roles ...types.Rol
 		session: sessionResp,
 		clt:     clt,
 		cookies: httpResp.Cookies(),
-		device:  &auth.TestDevice{Key: device},
+		device:  &authtest.Device{Key: device},
 	}
 }
 
@@ -1270,6 +1295,120 @@ func TestUserGroupsGet(t *testing.T) {
 	}})
 }
 
+func TestUnifiedResourcesGet_AppComponentFeatures(t *testing.T) {
+	t.Parallel()
+
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+
+	ctx := t.Context()
+	username := "test-user@example.com"
+
+	u, err := user.Current()
+	require.NoError(t, err)
+	loginUser := u.Username
+
+	role := defaultRoleForNewUser(&types.UserV2{Metadata: types.Metadata{Name: username}}, loginUser)
+	role.SetAppLabels(types.Allow, types.Labels{"env": []string{"prod"}})
+
+	pack := proxy.authPack(t, username, []types.Role{role})
+
+	// - cluster (auth/proxy) support `feature1`
+	// - app has 2 appservers, both support `feature1` + `feature2`
+	// - aggregated appserver features should = {feature1, feature2}
+	// - final app supportedFeatureIDs should = {feature1}
+	feature1 := componentfeatures.FeatureID(9998)
+	feature2 := componentfeatures.FeatureID(9999)
+
+	{
+		for srv := range clientutils.Resources(ctx, env.server.Auth().ListProxyServers) {
+			srv.SetComponentFeatures(componentfeatures.New(feature1))
+			err := env.server.Auth().UpsertProxy(ctx, srv)
+			require.NoError(t, err)
+		}
+	}
+	{
+		for srv := range clientutils.Resources(ctx, env.server.Auth().ListAuthServers) {
+			srv.SetComponentFeatures(componentfeatures.New(feature1))
+			err := env.server.Auth().UpsertAuthServer(ctx, srv)
+			require.NoError(t, err)
+		}
+	}
+
+	// AWS Console app + 2 app servers serving it
+	appName := "aws-console-app"
+	awsApp, err := types.NewAppV3(
+		types.Metadata{
+			Name: appName,
+			Labels: map[string]string{
+				"env": "prod",
+			},
+		},
+		types.AppSpecV3{
+			URI:   "https://console.aws.amazon.com",
+			Cloud: "AWS",
+		},
+	)
+	require.NoError(t, err)
+
+	awsSrv1, err := types.NewAppServerV3FromApp(awsApp, "localhost", "host-1")
+	require.NoError(t, err)
+	awsSrv1.SetComponentFeatures(componentfeatures.New(feature1, feature2))
+	_, err = env.server.Auth().UpsertApplicationServer(ctx, awsSrv1)
+	require.NoError(t, err)
+
+	awsSrv2, err := types.NewAppServerV3FromApp(awsApp, "localhost", "host-2")
+	require.NoError(t, err)
+	awsSrv2.SetComponentFeatures(componentfeatures.New(feature1, feature2))
+	_, err = env.server.Auth().UpsertApplicationServer(ctx, awsSrv2)
+	require.NoError(t, err)
+
+	clusterName := env.server.ClusterName()
+	endpoint := pack.clt.Endpoint("webapi", "sites", clusterName, "resources")
+	query := url.Values{"kinds": []string{types.KindApp}}
+
+	require.Eventually(t, func() bool {
+		return env.server.Auth().UnifiedResourceCache.IsInitialized()
+	}, 5*time.Second, 50*time.Millisecond, "unified resource cache failed to initialize")
+
+	// Ensure aggregated AppServers' features are intersected as expected
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		var got []types.AppServer
+
+		for srv, err := range env.server.Auth().UnifiedResourceCache.AppServers(
+			ctx, services.UnifiedResourcesIterateParams{},
+		) {
+			require.NoError(t, err)
+			if srv.GetApp() == nil || srv.GetApp().GetName() != appName {
+				continue
+			}
+			got = append(got, srv)
+		}
+
+		require.Len(t, got, 1)
+
+		cf := got[0].GetComponentFeatures()
+		require.NotNil(t, cf)
+		require.ElementsMatch(t, componentfeatures.New(feature1, feature2).GetFeatures(), cf.GetFeatures())
+	}, 5*time.Second, 50*time.Millisecond, "unified resource cache did not expose aggregated AppServer")
+
+	// Ensure returned UnifiedResource's features are intersected as expected (against all auth/proxy)
+	re, err := pack.clt.Get(ctx, endpoint, query)
+	require.NoError(t, err)
+
+	var resp struct {
+		Items []webui.App `json:"items"`
+	}
+	err = json.Unmarshal(re.Bytes(), &resp)
+	require.NoError(t, err)
+	require.Len(t, resp.Items, 1)
+
+	app := resp.Items[0]
+	require.True(t, app.AWSConsole)
+
+	require.ElementsMatch(t, []int{int(feature1)}, app.SupportedFeatureIDs)
+}
+
 func TestUnifiedResourcesGet(t *testing.T) {
 	t.Parallel()
 	env := newWebPack(t, 1)
@@ -1338,8 +1477,25 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	_, err = env.server.Auth().UpsertApplicationServer(context.Background(), appServer)
 	require.NoError(t, err)
 
+	// add a SAMLIdPServiceProvider
+	samlapp, err := types.NewSAMLIdPServiceProvider(
+		types.Metadata{
+			Name: "sp1",
+			Labels: map[string]string{
+				"env": "prod",
+			},
+		},
+		types.SAMLIdPServiceProviderSpecV1{
+			EntityID: "https://example.com",
+			ACSURL:   "https://example.com/acs",
+		},
+	)
+	require.NoError(t, err)
+	err = env.server.Auth().CreateSAMLIdPServiceProvider(context.Background(), samlapp)
+	require.NoError(t, err)
+
 	// Add nodes
-	for i := 0; i < 20; i++ {
+	for i := range 20 {
 		name := fmt.Sprintf("server-%d", i)
 		node, err := types.NewServer(name, types.KindNode, types.ServerSpecV2{
 			Hostname: name,
@@ -1349,28 +1505,30 @@ func TestUnifiedResourcesGet(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	// add db
-	db, err := types.NewDatabaseV3(types.Metadata{
-		Name: "dbdb",
-		Labels: map[string]string{
-			"env": "prod",
-		},
-	}, types.DatabaseSpecV3{
-		Protocol: "test-protocol",
-		URI:      "test-uri",
-	})
-	require.NoError(t, err)
-	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-		Name: "dddb1",
-	}, types.DatabaseServerSpecV3{
-		Hostname: "dddb1",
-		HostID:   uuid.NewString(),
-		Database: db,
-	})
-	require.NoError(t, err)
-	dbServer.SetTargetHealth(types.TargetHealth{Status: "testing-status"})
-	_, err = env.server.Auth().UpsertDatabaseServer(context.Background(), dbServer)
-	require.NoError(t, err)
+	// add HA dbs
+	for _, healthStatus := range []string{"healthy", "unhealthy", "unknown"} {
+		db, err := types.NewDatabaseV3(types.Metadata{
+			Name: "dbdb",
+			Labels: map[string]string{
+				"env": "prod",
+			},
+		}, types.DatabaseSpecV3{
+			Protocol: "test-protocol",
+			URI:      "test-uri",
+		})
+		require.NoError(t, err)
+		dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+			Name: db.GetName(),
+		}, types.DatabaseServerSpecV3{
+			Hostname: "dddb1",
+			HostID:   uuid.NewString(),
+			Database: db,
+		})
+		require.NoError(t, err)
+		dbServer.SetTargetHealth(types.TargetHealth{Status: healthStatus})
+		_, err = env.server.Auth().UpsertDatabaseServer(context.Background(), dbServer)
+		require.NoError(t, err)
+	}
 
 	// add windows desktop
 	win, err := types.NewWindowsDesktopV3(
@@ -1402,7 +1560,8 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	require.NoError(t, json.Unmarshal(re.Bytes(), &res))
 	require.Equal(t, types.KindApp, res.Items[0].Kind)
 	require.Equal(t, types.KindApp, res.Items[1].Kind)
-	require.Equal(t, types.KindDatabase, res.Items[2].Kind)
+	require.Equal(t, types.KindApp, res.Items[2].Kind)
+	require.Equal(t, types.KindDatabase, res.Items[3].Kind)
 
 	// test sort type desc
 	query = url.Values{"sort": []string{"kind:desc"}}
@@ -1430,7 +1589,7 @@ func TestUnifiedResourcesGet(t *testing.T) {
 		Items      []webui.Database `json:"items"`
 		TotalCount int              `json:"totalCount"`
 	}
-	query = url.Values{"sort": []string{"name"}, "limit": []string{"1"}, "kinds": []string{types.KindDatabase}}
+	query = url.Values{"sort": []string{"name"}, "limit": []string{"1"}, "kinds": []string{types.KindDatabase}, "query": []string{`health.status == "mixed"`}}
 	re, err = pack.clt.Get(context.Background(), endpoint, query)
 	require.NoError(t, err)
 	dbRes := dbResponse{}
@@ -1444,7 +1603,7 @@ func TestUnifiedResourcesGet(t *testing.T) {
 		Protocol:     "test-protocol",
 		Hostname:     "test-uri",
 		URI:          "test-uri",
-		TargetHealth: types.TargetHealth{Status: "testing-status"},
+		TargetHealth: types.TargetHealth{Status: "mixed"},
 	}})
 
 	// should return first page and have a second page
@@ -1463,7 +1622,7 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	require.NoError(t, err)
 	res = clusterNodesGetResponse{}
 	require.NoError(t, json.Unmarshal(re.Bytes(), &res))
-	require.Len(t, res.Items, 11)
+	require.Len(t, res.Items, 12)
 	require.Empty(t, res.StartKey)
 
 	// Only list valid AWS Roles for AWS Apps
@@ -1483,6 +1642,40 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	}
 	require.Equal(t, expectedRoles, listResp.Items[0].AWSRoles)
 	t.Log(string(re.Bytes()), listResp)
+
+	t.Run("saml_idp_service_provider is included with app kinds", func(t *testing.T) {
+		type appResponse struct {
+			Items      []webui.App `json:"items"`
+			TotalCount int         `json:"totalCount"`
+		}
+		query := url.Values{"kinds": []string{types.KindApp}}
+		re, err := pack.clt.Get(context.Background(), endpoint, query)
+		require.NoError(t, err)
+		appRes := appResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &appRes))
+
+		appConfig := webui.MakeAppsConfig{
+			LocalClusterName:      clusterName,
+			LocalProxyDNSName:     "proxy-1.example.com",
+			AppClusterName:        clusterName,
+			RequiresRequest:       false,
+			AllowedAWSRolesLookup: map[string][]string{"my-aws-app": {"arn:aws:iam::999999999999:role/ProdInstance"}},
+		}
+
+		expectedApps := []webui.App{
+			webui.MakeApp(app, appConfig),
+			webui.MakeApp(awsApp, appConfig),
+			webui.MakeAppTypeFromSAMLApp(samlapp, appConfig),
+		}
+
+		// marshal & unmarshal to match API response (i.e. omitempty)
+		expectedJSON, err := json.Marshal(expectedApps)
+		require.NoError(t, err)
+		var expected []webui.App
+		require.NoError(t, json.Unmarshal(expectedJSON, &expected))
+
+		require.ElementsMatch(t, appRes.Items, expected)
+	})
 }
 
 type clusterAlertsGetResponse struct {
@@ -1754,7 +1947,7 @@ func TestNewTerminalHandler(t *testing.T) {
 			},
 		},
 		{
-			expectedErr: "term: bad dimensions(-1x0)",
+			expectedErr: "term: bad dimensions(-1x25)",
 			cfg: TerminalHandlerConfig{
 				SessionData: session.Session{
 					ID:       session.NewID(),
@@ -1767,6 +1960,20 @@ func TestNewTerminalHandler(t *testing.T) {
 				},
 			},
 		},
+		{
+			expectedErr: "term: bad dimensions(80x-1)",
+			cfg: TerminalHandlerConfig{
+				SessionData: session.Session{
+					ID:       session.NewID(),
+					Login:    "root",
+					ServerID: uuid.New().String(),
+				},
+				Term: session.TerminalParams{
+					W: 0,
+					H: -1,
+				},
+			},
+		},
 		{
 			expectedErr: "term: bad dimensions(1x4097)",
 			cfg: TerminalHandlerConfig{
@@ -1857,7 +2064,53 @@ func TestUIConfig(t *testing.T) {
 
 func TestResizeTerminal(t *testing.T) {
 	t.Parallel()
-	s := newWebSuiteWithConfig(t, webSuiteConfig{disableDiskBasedRecording: true})
+	const fooUser = "foo"
+
+	eventsChan := make(chan apievents.AuditEvent, 10)
+	isInitialResizeComplete := make(chan struct{})
+	go func() {
+		var once sync.Once
+		for {
+			select {
+			case <-t.Context().Done():
+				return
+			case evt, ok := <-eventsChan:
+				if !ok {
+					return
+				}
+				// we are only interested in resize events
+				if evt.GetType() != events.ResizeEvent {
+					continue
+				}
+				resize, ok := evt.(*apievents.Resize)
+				assert.True(t, ok)
+
+				// we are only interested in resize events from foo user with 100x100 terminal size
+				// which is the initial size the client connects with.
+				if resize.GetUser() != fooUser || resize.TerminalSize != "100:100" {
+					continue
+				}
+
+				// signal that the initial resize events have been processed
+				// by the server
+				once.Do(func() {
+					close(isInitialResizeComplete)
+				})
+
+			}
+		}
+	}()
+
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		disableDiskBasedRecording: true,
+		onSessionRecordEvent: func(ctx context.Context, sid session.ID, pe apievents.PreparedSessionEvent) error {
+			select {
+			case eventsChan <- pe.GetAuditEvent():
+			case <-ctx.Done():
+			}
+			return nil
+		},
+	})
 	sid := session.NewID()
 
 	ctx, cancel := context.WithCancel(s.ctx)
@@ -1868,7 +2121,7 @@ func TestResizeTerminal(t *testing.T) {
 	ws2Messages := make(chan *terminal.Envelope)
 	// Create a new user "foo", open a terminal to a new session
 	term, err := connectToHost(ctx, connectConfig{
-		pack:  s.authPack(t, "foo"),
+		pack:  s.authPack(t, fooUser),
 		host:  s.node.ID(),
 		proxy: s.webServer.Listener.Addr().String(),
 		handlers: map[string]terminal.WSHandlerFunc{
@@ -1880,6 +2133,22 @@ func TestResizeTerminal(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, term.Close()) })
 
+	// The client connects to the server with an initial terminal size of 100x100.
+	// We must ensure the server processes this initial resize event before proceeding
+	// with bar joining the session and sending a new resize event.
+	// This is done by waiting for the resize event to be recorded
+	// by the onSessionRecordEvent callback above.
+	// If this does not happen within 10 seconds, the test fails.
+	// This ensures that the bar user joining never receives any possible
+	// pending resize events from foo creating the session.
+	select {
+	case <-isInitialResizeComplete:
+	case <-time.After(10 * time.Second):
+		require.FailNow(t, "", "timeout waiting for initial resize events")
+	case <-t.Context().Done():
+		require.FailNow(t, "", "test context done: %v", t.Context().Err())
+	}
+
 	sess := term.GetSession()
 	// Wait for session to have started
 	require.Eventually(t, func() bool {
@@ -2153,7 +2422,7 @@ func TestTerminalRouting(t *testing.T) {
 
 			sess := term.GetSession()
 
-			metadata := tt.target.TargetMetadata()
+			metadata := tt.target.EventMetadata()
 			require.Equal(t, metadata.ServerID, sess.ServerID)
 			require.Equal(t, metadata.ServerHostname, sess.ServerHostname)
 
@@ -2174,14 +2443,14 @@ func TestTerminalRequireSessionMFA(t *testing.T) {
 	const username = "llama2999"
 	pack := proxy.authPack(t, username, nil /* roles */)
 
-	userClient, err := env.server.NewClient(auth.TestUser(username))
+	userClient, err := env.server.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
 
 	cases := []struct {
 		name                      string
 		getAuthPreference         func(t *testing.T) types.AuthPreference
-		registerDevice            func(t *testing.T) *auth.TestDevice
-		getChallengeResponseBytes func(t *testing.T, chal client.MFAAuthenticateChallenge, testDev *auth.TestDevice) []byte
+		registerDevice            func(t *testing.T) *authtest.Device
+		getChallengeResponseBytes func(t *testing.T, chal client.MFAAuthenticateChallenge, testDev *authtest.Device) []byte
 	}{
 		{
 			name: "with webauthn",
@@ -2198,8 +2467,8 @@ func TestTerminalRequireSessionMFA(t *testing.T) {
 
 				return ap
 			},
-			registerDevice: func(t *testing.T) *auth.TestDevice {
-				webauthnDev, err := auth.RegisterTestDevice(
+			registerDevice: func(t *testing.T) *authtest.Device {
+				webauthnDev, err := authtest.RegisterTestDevice(
 					ctx,
 					userClient,
 					"webauthn", authproto.DeviceType_DEVICE_TYPE_WEBAUTHN, pack.device /* authenticator */)
@@ -2207,7 +2476,7 @@ func TestTerminalRequireSessionMFA(t *testing.T) {
 
 				return webauthnDev
 			},
-			getChallengeResponseBytes: func(t *testing.T, chal client.MFAAuthenticateChallenge, testDev *auth.TestDevice) []byte {
+			getChallengeResponseBytes: func(t *testing.T, chal client.MFAAuthenticateChallenge, testDev *authtest.Device) []byte {
 				res, err := testDev.SolveAuthn(&authproto.MFAAuthenticateChallenge{
 					WebauthnChallenge: wantypes.CredentialAssertionToProto(chal.WebauthnChallenge),
 				})
@@ -2341,8 +2610,8 @@ func TestDesktopAccessMFA(t *testing.T) {
 	tests := []struct {
 		name           string
 		authPref       types.AuthPreferenceSpecV2
-		mfaHandler     func(t *testing.T, ws *websocket.Conn, dev *auth.TestDevice)
-		registerDevice func(t *testing.T, ctx context.Context, clt *authclient.Client) *auth.TestDevice
+		mfaHandler     func(t *testing.T, ws *websocket.Conn, dev *authtest.Device)
+		registerDevice func(t *testing.T, ctx context.Context, clt *authclient.Client) *authtest.Device
 	}{
 		{
 			name: "webauthn",
@@ -2355,8 +2624,8 @@ func TestDesktopAccessMFA(t *testing.T) {
 				RequireMFAType: types.RequireMFAType_SESSION,
 			},
 			mfaHandler: handleDesktopMFAWebauthnChallenge,
-			registerDevice: func(t *testing.T, ctx context.Context, clt *authclient.Client) *auth.TestDevice {
-				webauthnDev, err := auth.RegisterTestDevice(ctx, clt, "webauthn", authproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+			registerDevice: func(t *testing.T, ctx context.Context, clt *authclient.Client) *authtest.Device {
+				webauthnDev, err := authtest.RegisterTestDevice(ctx, clt, "webauthn", authproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 				require.NoError(t, err)
 				return webauthnDev
 			},
@@ -2370,7 +2639,7 @@ func TestDesktopAccessMFA(t *testing.T) {
 			proxy := env.proxies[0]
 			pack := proxy.authPack(t, "llama", nil /* roles */)
 
-			clt, err := env.server.NewClient(auth.TestUser("llama"))
+			clt, err := env.server.NewClient(authtest.TestUser("llama"))
 			require.NoError(t, err)
 			wdID := uuid.New().String()
 
@@ -2420,12 +2689,18 @@ func TestDesktopAccessMFA(t *testing.T) {
 
 			msg, err := tdpClient.ReadMessage()
 			require.NoError(t, err)
+
+			// sometimes LatencyStats will be sent before we get Alert, in such case just skip it and get next one
+			if _, ok := msg.(tdp.LatencyStats); ok {
+				msg, err = tdpClient.ReadMessage()
+				require.NoError(t, err)
+			}
 			require.IsType(t, tdp.Alert{}, msg)
 		})
 	}
 }
 
-func handleDesktopMFAWebauthnChallenge(t *testing.T, ws *websocket.Conn, dev *auth.TestDevice) {
+func handleDesktopMFAWebauthnChallenge(t *testing.T, ws *websocket.Conn, dev *authtest.Device) {
 	wsrwc := &WebsocketIO{Conn: ws}
 	tdpConn := tdp.NewConn(wsrwc)
 
@@ -2475,7 +2750,7 @@ func TestWebAgentForward(t *testing.T) {
 
 func TestActiveSessions(t *testing.T) {
 	// Use enterprise license (required for moderated sessions).
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	s := newWebSuite(t)
 	pack := s.authPack(t, "foo")
@@ -2625,7 +2900,7 @@ type httpErrorResponse struct {
 }
 
 func TestLogin_PrivateKeyEnabledError(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		MockAttestationData: &keys.AttestationData{
 			PrivateKeyPolicy: keys.PrivateKeyPolicyNone,
 		},
@@ -2805,7 +3080,7 @@ func TestMotD(t *testing.T) {
 func TestPingAutomaticUpgrades(t *testing.T) {
 	t.Run("Automatic Upgrades are enabled", func(t *testing.T) {
 		// Enable Automatic Upgrades
-		modules.SetTestModules(t, &modules.TestModules{TestFeatures: modules.Features{
+		modulestest.SetTestModules(t, modulestest.Modules{TestFeatures: modules.Features{
 			AutomaticUpgrades: true,
 		}})
 
@@ -2823,7 +3098,7 @@ func TestPingAutomaticUpgrades(t *testing.T) {
 	})
 	t.Run("Automatic Upgrades are disabled", func(t *testing.T) {
 		// Disable Automatic Upgrades
-		modules.SetTestModules(t, &modules.TestModules{TestFeatures: modules.Features{
+		modulestest.SetTestModules(t, modulestest.Modules{TestFeatures: modules.Features{
 			AutomaticUpgrades: false,
 		}})
 
@@ -2844,7 +3119,7 @@ func TestPingAutomaticUpgrades(t *testing.T) {
 // TestInstallerRepoChannel ensures the returned installer script has the proper repo channel
 func TestInstallerRepoChannel(t *testing.T) {
 	t.Run("cloud with automatic upgrades", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestFeatures: modules.Features{
 				Cloud:             true,
 				AutomaticUpgrades: true,
@@ -2918,7 +3193,7 @@ echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 	})
 
 	t.Run("cloud without automatic upgrades", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestFeatures: modules.Features{
 				Cloud:             true,
 				AutomaticUpgrades: false,
@@ -2975,7 +3250,7 @@ echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 	})
 
 	t.Run("oss or enterprise with automatic upgrades", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestBuildType: modules.BuildOSS,
 			TestFeatures: modules.Features{
 				Cloud:             false,
@@ -3226,6 +3501,35 @@ func (f byTimeAndIndex) Swap(i, j int) {
 	f[i], f[j] = f[j], f[i]
 }
 
+// ConstructSSHResponse_WebMFA tests that [sso.WebMFARedirect] is always
+// transformed into a relative URL so that the sso callback will redirect
+// back to the proxy.
+func TestConstructSSHResponse_WebMFA(t *testing.T) {
+	baseURL := sso.WebMFARedirect + "?channel_id=" + uuid.NewString()
+	for _, clientRedirectURL := range []string{
+		baseURL,
+		"http://127.0.0.1:1234" + baseURL,
+		"http://localhost:1234" + baseURL,
+		"https://proxy.example.com" + baseURL,
+		"tcp://tcp.app.com" + baseURL,
+	} {
+		t.Run("clientRedirectURL: "+clientRedirectURL, func(t *testing.T) {
+			redirectURL, err := ConstructSSHResponse(AuthParams{
+				Username:          "foo",
+				Cert:              []byte{0x00},
+				TLSCert:           []byte{0x01},
+				MFAToken:          "token",
+				ClientRedirectURL: clientRedirectURL,
+			})
+			require.NoError(t, err)
+			require.NotEmpty(t, redirectURL.Query().Get("channel_id"))
+			require.NotEmpty(t, redirectURL.Query().Get("response"))
+			withoutQueryParams, _, _ := strings.Cut(redirectURL.String(), "?")
+			require.Equal(t, sso.WebMFARedirect, withoutQueryParams)
+		})
+	}
+}
+
 // TestSearchClusterEvents makes sure web API allows querying events by type.
 func TestSearchClusterEvents(t *testing.T) {
 	t.Parallel()
@@ -3363,18 +3667,18 @@ func TestSearchClusterEvents(t *testing.T) {
 func TestGetClusterDetails(t *testing.T) {
 	t.Parallel()
 	s := newWebSuite(t)
-	site, err := s.proxyTunnel.GetSite(s.server.ClusterName())
+	cluster, err := s.proxyTunnel.Cluster(t.Context(), s.server.ClusterName())
 	require.NoError(t, err)
-	require.NotNil(t, site)
+	require.NotNil(t, cluster)
 
-	cluster, err := webui.GetClusterDetails(s.ctx, site)
+	clusterDetails, err := webui.GetClusterDetails(s.ctx, cluster)
 	require.NoError(t, err)
-	require.Equal(t, s.server.ClusterName(), cluster.Name)
-	require.Equal(t, teleport.Version, cluster.ProxyVersion)
-	require.Equal(t, fmt.Sprintf("%v:%v", s.server.ClusterName(), defaults.HTTPListenPort), cluster.PublicURL)
-	require.Equal(t, teleport.RemoteClusterStatusOnline, cluster.Status)
-	require.NotNil(t, cluster.LastConnected)
-	require.Equal(t, teleport.Version, cluster.AuthVersion)
+	require.Equal(t, s.server.ClusterName(), clusterDetails.Name)
+	require.Equal(t, teleport.Version, clusterDetails.ProxyVersion)
+	require.Equal(t, fmt.Sprintf("%v:%v", s.server.ClusterName(), defaults.HTTPListenPort), clusterDetails.PublicURL)
+	require.Equal(t, teleport.RemoteClusterStatusOnline, clusterDetails.Status)
+	require.NotNil(t, clusterDetails.LastConnected)
+	require.Equal(t, teleport.Version, clusterDetails.AuthVersion)
 }
 
 func TestTokenGeneration(t *testing.T) {
@@ -3694,7 +3998,7 @@ func TestKnownWebPathsWithAndWithoutV1Prefix(t *testing.T) {
 
 func TestInstallDatabaseScriptGeneration(t *testing.T) {
 	const username = "test-user@example.com"
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildCommunity})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildCommunity})
 
 	// Users should be able to create Tokens even if they can't update them
 	roleTokenCRD, err := types.NewRole(services.RoleNameForUser(username), types.RoleSpecV6{
@@ -3950,7 +4254,7 @@ func TestClusterDatabasesGet_NoRole(t *testing.T) {
 		Database: db,
 	})
 	require.NoError(t, err)
-	dbServer.SetTargetHealth(types.TargetHealth{Status: "testing-status"})
+	dbServer.SetTargetHealth(types.TargetHealth{Status: "healthy"})
 
 	_, err = env.server.Auth().UpsertDatabaseServer(context.Background(), dbServer)
 	require.NoError(t, err)
@@ -3970,7 +4274,7 @@ func TestClusterDatabasesGet_NoRole(t *testing.T) {
 		Protocol:     "test-protocol",
 		Hostname:     "test-uri",
 		URI:          "test-uri:1234",
-		TargetHealth: types.TargetHealth{Status: "testing-status"},
+		TargetHealth: types.TargetHealth{Status: "healthy"},
 	}})
 }
 
@@ -4291,7 +4595,7 @@ func TestClusterKubeResourcesGet(t *testing.T) {
 // TestApplicationAccessDisabled makes sure application access can be disabled
 // via modules.
 func TestApplicationAccessDisabled(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.App: {Enabled: false},
@@ -4591,6 +4895,7 @@ func TestGetWebConfig_WithEntitlements(t *testing.T) {
 			string(entitlements.LicenseAutoUpdate):          {Enabled: false},
 			string(entitlements.AccessGraphDemoMode):        {Enabled: false},
 			string(entitlements.UnrestrictedManagedUpdates): {Enabled: false},
+			string(entitlements.ClientIPRestrictions):       {Enabled: false},
 		},
 		TunnelPublicAddress:            "",
 		RecoveryCodesEnabled:           false,
@@ -4622,7 +4927,7 @@ func TestGetWebConfig_WithEntitlements(t *testing.T) {
 	require.Equal(t, expectedCfg, cfg)
 
 	// update features and assert that it is properly updated on the config object
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud:               true,
 			IsUsageBasedBilling: true,
@@ -4690,7 +4995,7 @@ func TestGetWebConfig_WithEntitlements(t *testing.T) {
 	expectedCfg.Entitlements[string(entitlements.DeviceTrust)] = webclient.EntitlementInfo{Enabled: false}
 
 	// update modules but NOT the expected config
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			Cloud:               false,
 			IsUsageBasedBilling: false,
@@ -4717,7 +5022,7 @@ func TestGetWebConfig_LegacyFeatureLimits(t *testing.T) {
 	ctx := context.Background()
 	env := newWebPack(t, 1)
 
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			ProductType:         modules.ProductTypeTeam,
 			IsUsageBasedBilling: true,
@@ -4778,6 +5083,7 @@ func TestGetWebConfig_LegacyFeatureLimits(t *testing.T) {
 			string(entitlements.LicenseAutoUpdate):          {Enabled: false},
 			string(entitlements.AccessGraphDemoMode):        {Enabled: false},
 			string(entitlements.UnrestrictedManagedUpdates): {Enabled: false},
+			string(entitlements.ClientIPRestrictions):       {Enabled: false},
 		},
 		PlayableDatabaseProtocols:     player.SupportedDatabaseProtocols,
 		IsPolicyRoleVisualizerEnabled: true,
@@ -4877,7 +5183,7 @@ func TestAddMFADevice(t *testing.T) {
 				})
 				require.NoError(t, err)
 
-				_, regRes, err := auth.NewTestDeviceFromChallenge(res, auth.WithTestDeviceClock(env.clock))
+				_, regRes, err := authtest.NewTestDeviceFromChallenge(res, authtest.WithTestDeviceClock(env.clock))
 				require.NoError(t, err)
 
 				return regRes.GetTOTP().Code
@@ -4894,7 +5200,7 @@ func TestAddMFADevice(t *testing.T) {
 				})
 				require.NoError(t, err)
 
-				_, regRes, err := auth.NewTestDeviceFromChallenge(res)
+				_, regRes, err := authtest.NewTestDeviceFromChallenge(res)
 				require.NoError(t, err)
 
 				return wantypes.CredentialCreationResponseFromProto(regRes.GetWebauthn())
@@ -5472,9 +5778,9 @@ func TestCreateAppSession_RequireSessionMFA(t *testing.T) {
 	require.NoError(t, err)
 
 	// register an mfa device for the user.
-	userClient, err := s.server.NewClient(auth.TestUser(pack.user))
+	userClient, err := s.server.NewClient(authtest.TestUser(pack.user))
 	require.NoError(t, err)
-	webauthnDev, err := auth.RegisterTestDevice(
+	webauthnDev, err := authtest.RegisterTestDevice(
 		ctx,
 		userClient,
 		"webauthn", authproto.DeviceType_DEVICE_TYPE_WEBAUTHN, pack.device /* authenticator */)
@@ -5734,7 +6040,7 @@ func TestChangeUserAuthentication_recoveryCodesReturnedForCloud(t *testing.T) {
 	require.NoError(t, err)
 
 	// Enable cloud feature.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -5824,7 +6130,7 @@ func TestChangeUserAuthentication_WithPrivacyPolicyEnabledError(t *testing.T) {
 	require.NoError(t, err)
 
 	// Enable cloud feature.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestFeatures: modules.Features{
 			RecoveryCodes: true,
 		},
@@ -5926,7 +6232,7 @@ func TestChangeUserAuthentication_settingDefaultClusterAuthPreference(t *testing
 
 	for _, tc := range tt {
 		t.Run(tc.name, func(t *testing.T) {
-			modules.SetTestModules(t, &modules.TestModules{
+			modulestest.SetTestModules(t, modulestest.Modules{
 				TestFeatures: modules.Features{
 					Cloud: tc.cloud,
 				},
@@ -6099,6 +6405,205 @@ func TestParseSSORequestParams(t *testing.T) {
 	}
 }
 
+// TestGetUserMatchedAuthConnectors tests that auth connectors are matched correctly to users.
+func TestGetUserMatchedAuthConnectors(t *testing.T) {
+	ctx := context.Background()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "test-user@example.com", nil)
+
+	// Create GitHub connectors with various matchers
+	githubConnectors := []struct {
+		name     string
+		matchers []string
+	}{
+		{
+			name:     "github-specific",
+			matchers: []string{"alice@example.com", "bob@example.com"},
+		},
+		{
+			name:     "github-domain",
+			matchers: []string{"*@company.com"},
+		},
+		{
+			name:     "github-fallback",
+			matchers: []string{"*"},
+		},
+	}
+
+	for _, connSpec := range githubConnectors {
+		connector, err := types.NewGithubConnector(connSpec.name, types.GithubConnectorSpecV3{
+			UserMatchers: connSpec.matchers,
+			TeamsToRoles: []types.TeamRolesMapping{
+				{
+					Organization: "octocats",
+					Team:         "devs",
+					Roles:        []string{"access"},
+				},
+			},
+		})
+		require.NoError(t, err)
+		_, err = env.server.Auth().UpsertGithubConnector(ctx, connector)
+		require.NoError(t, err)
+	}
+
+	// Create SAML connectors with various matchers
+	samlConnectors := []struct {
+		name     string
+		matchers []string
+	}{
+		{
+			name:     "saml-specific",
+			matchers: []string{"charlie@example.com"},
+		},
+		{
+			name:     "saml-pattern",
+			matchers: []string{"*@saml-company.com"},
+		},
+		{
+			name:     "saml-fallback",
+			matchers: []string{"*"},
+		},
+		{
+			name:     "saml-fallback-and-explicit",
+			matchers: []string{"*", "*@example.com"},
+		},
+	}
+
+	for _, connSpec := range samlConnectors {
+		connector, err := types.NewSAMLConnector(connSpec.name, types.SAMLConnectorSpecV2{
+			UserMatchers:             connSpec.matchers,
+			AssertionConsumerService: "test",
+			SSO:                      "test",
+			EntityDescriptor: `<?xml version="1.0" encoding="UTF-8"?>
+    <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="test">
+      <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+        <md:KeyDescriptor use="signing">
+          <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+            <ds:X509Data>
+              <ds:X509Certificate></ds:X509Certificate>
+            </ds:X509Data>
+          </ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com" />
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com" />
+      </md:IDPSSODescriptor>
+    </md:EntityDescriptor>`,
+			AttributesToRoles: []types.AttributeMapping{
+				{
+					Name:  "test",
+					Value: "test",
+					Roles: []string{"default-implicit-role"},
+				},
+			},
+		})
+		require.NoError(t, err)
+		_, err = env.server.Auth().UpsertSAMLConnector(ctx, connector)
+		require.NoError(t, err)
+	}
+
+	// Create OIDC connectors with various matchers
+	oidcConnectors := []struct {
+		name     string
+		matchers []string
+	}{
+		{
+			name:     "oidc-specific",
+			matchers: []string{"dave@example.com"},
+		},
+		{
+			name:     "oidc-fallback",
+			matchers: []string{"*"},
+		},
+	}
+
+	for _, connSpec := range oidcConnectors {
+		connector, err := types.NewOIDCConnector(connSpec.name, types.OIDCConnectorSpecV3{
+			UserMatchers: connSpec.matchers,
+			ClientID:     "test",
+			ClientSecret: "test",
+			ClaimsToRoles: []types.ClaimMapping{
+				{
+					Claim: "team",
+					Value: "dev",
+					Roles: []string{"dev-team-access"},
+				},
+			},
+			RedirectURLs: []string{"https://proxy.example.com/v1/webapi/oidc/callback"},
+		})
+		require.NoError(t, err)
+		_, err = env.server.Auth().UpsertOIDCConnector(ctx, connector)
+		require.NoError(t, err)
+	}
+
+	testCases := []struct {
+		name               string
+		username           string
+		expectedConnectors []string
+	}{
+		{
+			name:               "explicit matches",
+			username:           "alice@example.com",
+			expectedConnectors: []string{"github-specific", "saml-fallback-and-explicit"},
+		},
+		{
+			name:               "domain matches",
+			username:           "user@company.com",
+			expectedConnectors: []string{"github-domain"},
+		},
+		{
+			name:               "multiple specific matches excludes fallbacks",
+			username:           "charlie@example.com",
+			expectedConnectors: []string{"saml-specific", "saml-fallback-and-explicit"},
+		},
+		{
+			name:               "mixed specific matches across connector types",
+			username:           "user@saml-company.com",
+			expectedConnectors: []string{"saml-pattern"},
+		},
+		{
+			name:               "fallbacks used when no specific matches",
+			username:           "unknown@nowhere.com",
+			expectedConnectors: []string{"github-fallback", "saml-fallback", "saml-fallback-and-explicit", "oidc-fallback"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			reqPayload := struct {
+				Username string `json:"username"`
+			}{
+				Username: tc.username,
+			}
+
+			resp, err := pack.clt.PostJSON(ctx, pack.clt.Endpoint("webapi", "authconnectors"), reqPayload)
+			require.NoError(t, err, "failed to call getUserMatchedAuthConnectors endpoint")
+			require.Equal(t, http.StatusOK, resp.Code(), "unexpected status code")
+
+			var response struct {
+				Connectors []struct {
+					Name string `json:"name"`
+					Type string `json:"type"`
+				} `json:"connectors"`
+			}
+			require.NoError(t, json.Unmarshal(resp.Bytes(), &response), "failed to unmarshal response")
+
+			var actualConnectors []string
+			for _, conn := range response.Connectors {
+				actualConnectors = append(actualConnectors, conn.Name)
+			}
+
+			sort.Strings(actualConnectors)
+			sort.Strings(tc.expectedConnectors)
+			require.Equal(t, tc.expectedConnectors, actualConnectors)
+		})
+	}
+}
+
 func TestClusterDesktopsGet(t *testing.T) {
 	t.Parallel()
 	env := newWebPack(t, 1)
@@ -6437,7 +6942,7 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 					Type:    types.ConnectionDiagnosticTrace_CONNECTIVITY,
 					Status:  types.ConnectionDiagnosticTrace_FAILED,
 					Details: `Failed to connect to the Node. Ensure teleport service is running using "systemctl status teleport".`,
-					Error:   "direct dialing to nodes not found in inventory is not supported",
+					Error:   "target host notanode is offline or does not exist",
 				},
 			},
 		},
@@ -6455,7 +6960,7 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 					Type:    types.ConnectionDiagnosticTrace_CONNECTIVITY,
 					Status:  types.ConnectionDiagnosticTrace_FAILED,
 					Details: `Failed to connect to the Node. Ensure teleport service is running using "launchctl print 'system/Teleport Service'".`,
-					Error:   "direct dialing to nodes not found in inventory is not supported",
+					Error:   "target host notanode is offline or does not exist",
 				},
 			},
 		},
@@ -6474,7 +6979,7 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 					Type:    types.ConnectionDiagnosticTrace_CONNECTIVITY,
 					Status:  types.ConnectionDiagnosticTrace_FAILED,
 					Details: `Open the Connect My Computer tab in Teleport Connect and make sure that the agent is running.`,
-					Error:   "direct dialing to nodes not found in inventory is not supported",
+					Error:   "target host notanode is offline or does not exist",
 				},
 			},
 		},
@@ -6625,7 +7130,7 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 					require.Contains(t, returnedTrace.Error, expectedTrace.Error)
 				}
 
-				require.True(t, foundTrace, "expected trace %v was not found", expectedTrace)
+				require.True(t, foundTrace, "expected trace '%v' was not found, got '%v'", expectedTrace, connectionDiagnostic.Traces)
 			}
 			require.Equal(t, expectedFailedTraces, gotFailedTraces)
 		})
@@ -6727,7 +7232,11 @@ func TestDiagnoseKubeConnection(t *testing.T) {
 	}
 	require.NotNil(t, rolesWithoutAccessToKubeCluster)
 
-	env := newWebPack(t, 1)
+	env := newWebPack(t, 1,
+		withWebPackProxyOptions(
+			withKubeProxy(),
+		),
+	)
 
 	rt := http.NewServeMux()
 	rt.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
@@ -7862,16 +8371,42 @@ func decodeSessionCookie(t *testing.T, value string) (sessionID string) {
 	return cookie.SessionID
 }
 
-func newWebPack(t *testing.T, numProxies int, opts ...proxyOption) *webPack {
+type WebPackOptions struct {
+	proxyOptions    []proxyOption
+	enableAuthCache bool
+}
+
+type webPackOptions func(*WebPackOptions)
+
+func withWebPackProxyOptions(opts ...proxyOption) webPackOptions {
+	return func(cfg *WebPackOptions) {
+		cfg.proxyOptions = opts
+	}
+}
+
+func withWebPackAuthCacheEnabled(enable bool) webPackOptions {
+	return func(cfg *WebPackOptions) {
+		cfg.enableAuthCache = enable
+	}
+}
+
+func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack {
+	options := &WebPackOptions{}
+
+	for _, opt := range opts {
+		opt(options)
+	}
+
 	ctx := context.Background()
 	clock := clockwork.NewFakeClockAt(time.Now())
 
-	server, err := auth.NewTestServer(auth.TestServerConfig{
-		Auth: auth.TestAuthServerConfig{
-			ClusterName: "localhost",
-			Dir:         t.TempDir(),
-			Clock:       clock,
-			AuditLog:    events.NewDiscardAuditLog(),
+	server, err := authtest.NewTestServer(authtest.ServerConfig{
+		Auth: authtest.AuthServerConfig{
+			ClusterName:  "localhost",
+			Dir:          t.TempDir(),
+			Clock:        clock,
+			AuditLog:     events.NewDiscardAuditLog(),
+			CacheEnabled: options.enableAuthCache,
 		},
 	})
 	require.NoError(t, err)
@@ -7904,7 +8439,7 @@ func newWebPack(t *testing.T, numProxies int, opts ...proxyOption) *webPack {
 	priv, pub, err := testauthority.New().GenerateKeyPair()
 	require.NoError(t, err)
 
-	tlsPub, err := auth.PrivateKeyToPublicKeyTLS(priv)
+	tlsPub, err := authtest.PrivateKeyToPublicKeyTLS(priv)
 	require.NoError(t, err)
 
 	const nodeID = "node"
@@ -7916,14 +8451,14 @@ func newWebPack(t *testing.T, numProxies int, opts ...proxyOption) *webPack {
 			Role:         types.RoleNode,
 			PublicSSHKey: pub,
 			PublicTLSKey: tlsPub,
-		})
+		}, "")
 	require.NoError(t, err)
 
 	signer, err := sshutils.NewSigner(priv, certs.SSH)
 	require.NoError(t, err)
 	hostSigners := []ssh.Signer{signer}
 
-	nodeClient, err := server.TLS.NewClient(auth.TestIdentity{
+	nodeClient, err := server.TLS.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleNode,
 			Username: nodeID,
@@ -7983,11 +8518,12 @@ func newWebPack(t *testing.T, numProxies int, opts ...proxyOption) *webPack {
 	var proxies []*testProxy
 	for p := 0; p < numProxies; p++ {
 		proxyID := fmt.Sprintf("proxy%v", p)
-		proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, opts...))
+		proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, options.proxyOptions...))
 	}
 
 	// Wait for proxies to fully register before starting the test.
 	for start := time.Now(); ; {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 		proxies, err := proxies[0].client.GetProxies()
 		require.NoError(t, err)
 		if len(proxies) == numProxies {
@@ -8020,6 +8556,7 @@ func (w *wrappedAuthClient) DevicesClient() devicepb.DeviceTrustServiceClient {
 type proxyConfig struct {
 	minimalHandler        bool
 	devicesClientOverride devicepb.DeviceTrustServiceClient
+	kubeProxy             bool
 }
 
 type proxyOption func(cfg *proxyConfig)
@@ -8030,7 +8567,13 @@ func withDevicesClientOverride(c devicepb.DeviceTrustServiceClient) proxyOption
 	}
 }
 
-func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regular.Server, authServer *auth.TestTLSServer,
+func withKubeProxy() proxyOption {
+	return func(cfg *proxyConfig) {
+		cfg.kubeProxy = true
+	}
+}
+
+func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regular.Server, authServer *authtest.TLSServer,
 	hostSigners []ssh.Signer, clock *clockwork.FakeClock, opts ...proxyOption,
 ) *testProxy {
 	cfg := proxyConfig{}
@@ -8038,7 +8581,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		opt(&cfg)
 	}
 	// create reverse tunnel service:
-	authClient, err := authServer.NewClient(auth.TestIdentity{
+	authClient, err := authServer.NewClient(authtest.TestIdentity{
 		I: authz.BuiltinRole{
 			Role:     types.RoleProxy,
 			Username: proxyID,
@@ -8129,7 +8672,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 	router, err := proxy.NewRouter(proxy.RouterConfig{
 		ClusterName:      clustername,
 		LocalAccessPoint: client,
-		SiteGetter:       revTunServer,
+		ClusterGetter:    revTunServer,
 		TracerProvider:   tracing.NoopProvider(),
 	})
 	require.NoError(t, err)
@@ -8165,11 +8708,17 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		}
 	}()
 
-	authorizer, err := authz.NewAuthorizer(authz.AuthorizerOpts{
-		ClusterName: clustername,
-		AccessPoint: authServer.Auth(),
-		LockWatcher: proxyLockWatcher,
-	})
+	authorizerOpts := authz.AuthorizerOpts{
+		ClusterName:      clustername,
+		AccessPoint:      authServer.Auth(),
+		ScopedRoleReader: authServer.Auth().ScopedRoleReader(),
+		LockWatcher:      proxyLockWatcher,
+	}
+
+	authorizer, err := authz.NewAuthorizer(authorizerOpts)
+	require.NoError(t, err)
+
+	scopedAuthorizer, err := authz.NewScopedAuthorizer(authorizerOpts)
 	require.NoError(t, err)
 
 	tlscfg, err := authServer.Identity.TLSConfig(utils.DefaultCipherSuites())
@@ -8198,7 +8747,8 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		UserGetter: &auth.Middleware{
 			ClusterName: authServer.ClusterName(),
 		},
-		Authorizer: authorizer,
+		Authorizer:       authorizer,
+		ScopedAuthorizer: scopedAuthorizer,
 	})
 	require.NoError(t, err)
 
@@ -8213,19 +8763,26 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		AccessPoint:    client,
 		LockWatcher:    proxyLockWatcher,
 		Clock:          clock,
-		ServerID:       proxyID,
+		ServerID:       node.ID(),
 		Emitter:        client,
 		EmitterContext: ctx,
-		Logger:         utils.NewSlogLoggerForTests(),
+		Logger:         logtest.NewLogger(),
 	})
 	require.NoError(t, err)
 
 	transportService, err := transportv1.NewService(transportv1.ServerConfig{
 		FIPS:   false,
-		Logger: utils.NewSlogLoggerForTests(),
+		Logger: logtest.NewLogger(),
 		Dialer: router,
-		SignerFn: func(authzCtx *authz.Context, clusterName string) agentless.SignerCreator {
-			return agentless.SignerFromAuthzContext(authzCtx, client, clusterName)
+		SignerFn: func(authzCtx *authz.ScopedContext, clusterName string) agentless.SignerCreator {
+			if unscopedCtx, ok := authzCtx.UnscopedContext(); ok {
+				return agentless.SignerFromAuthzContext(unscopedCtx, client, clusterName)
+			}
+
+			return func(ctx context.Context, localAccessPoint agentless.LocalAccessPoint, certGen agentless.CertGenerator) (ssh.Signer, error) {
+				// TODO(fspamarshall/scopes): implement agentless transport signer for scoped identities
+				return nil, trace.NotImplemented("agentless transport signer is not implemented for scoped identities")
+			}
 		},
 		ConnectionMonitor: connMonitor,
 		LocalAddr:         proxyListener.Addr(),
@@ -8262,9 +8819,6 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyServer.Close()) })
 
-	fs, err := NewDebugFileSystem(false)
-	require.NoError(t, err)
-
 	authID := state.IdentityID{
 		Role:     types.RoleProxy,
 		HostUUID: proxyID,
@@ -8284,7 +8838,6 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		Context:          ctx,
 		HostUUID:         proxyID,
 		Emitter:          client,
-		StaticFS:         fs,
 		ProxySettings: &ProxySettings{
 			ServiceConfig: servicecfg.MakeDefaultConfig(),
 			ProxySSHAddr:  "127.0.0.1",
@@ -8323,16 +8876,18 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 	require.NoError(t, err)
 	handler.handler.sshPort = sshPort
 
-	kubeProxyAddr := startKube(
-		ctx,
-		t,
-		startKubeOptions{
-			serviceType: kubeproxy.ProxyService,
-			authServer:  authServer,
-			revTunnel:   revTunServer,
-		},
-	)
-	handler.handler.cfg.ProxyKubeAddr = utils.FromAddr(kubeProxyAddr)
+	if cfg.kubeProxy {
+		kubeProxyAddr := startKube(
+			ctx,
+			t,
+			startKubeOptions{
+				serviceType: kubeproxy.ProxyService,
+				authServer:  authServer,
+				revTunnel:   revTunServer,
+			},
+		)
+		handler.handler.cfg.ProxyKubeAddr = utils.FromAddr(kubeProxyAddr)
+	}
 	handler.handler.cfg.PublicProxyAddr = webServer.Listener.Addr().String()
 	url, err := url.Parse("https://" + webServer.Listener.Addr().String())
 	require.NoError(t, err)
@@ -8360,7 +8915,7 @@ func (m *mockIntegrationAppHandler) HandleConnection(_ net.Conn) {}
 // directly.
 type webPack struct {
 	proxies []*testProxy
-	server  *auth.TestServer
+	server  *authtest.Server
 	node    *regular.Server
 	clock   *clockwork.FakeClock
 }
@@ -8368,7 +8923,7 @@ type webPack struct {
 type testProxy struct {
 	clock   *clockwork.FakeClock
 	client  authclient.ClientI
-	auth    *auth.TestTLSServer
+	auth    *authtest.TLSServer
 	revTun  reversetunnelclient.Server
 	node    *regular.Server
 	proxy   *regular.Server
@@ -8425,7 +8980,7 @@ func (r *testProxy) authPack(t *testing.T, teleportUser string, roles []types.Ro
 		clt:       clt,
 		cookies:   httpResp.Cookies(),
 		password:  pass,
-		device: &auth.TestDevice{
+		device: &authtest.Device{
 			TOTPSecret: otpSecret,
 		},
 	}
@@ -8870,6 +9425,93 @@ func TestWithLimiterHandlerFunc(t *testing.T) {
 	require.True(t, trace.IsLimitExceeded(err), "WithLimiterHandlerFunc returned err = %T, want trace.LimitExceededError", err)
 }
 
+func TestWitWithAccessDeniedLimiter(t *testing.T) {
+	rateLimiter, err := limiter.NewRateLimiter(limiter.Config{
+		Rates: []limiter.Rate{
+			{Period: time.Minute, Average: 2, Burst: 3},
+		},
+		Clock: clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	h := &Handler{limiter: rateLimiter}
+
+	callCount := 0
+	shouldFail := false
+	handle := h.WithAccessDeniedLimiter(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+		callCount++
+		if shouldFail {
+			return nil, trace.AccessDenied("invalid credentials")
+		}
+		return "success", nil
+	})
+
+	r := &http.Request{RemoteAddr: "192.168.1.1:1234"}
+
+	// Make some successful requests - these should not count toward rate limit
+	for i := 0; i < 5; i++ {
+		w := httptest.NewRecorder()
+		handle(w, r, nil)
+		require.Equal(t, http.StatusOK, w.Code)
+	}
+
+	// Now make access denied requests - only these should count
+	shouldFail = true
+	for i := 0; i < 3; i++ {
+		w := httptest.NewRecorder()
+		handle(w, r, nil)
+		require.Equal(t, http.StatusForbidden, w.Code)
+	}
+	require.Equal(t, 8, callCount)
+
+	// Next request should be rate limited (handler not called)
+	w := httptest.NewRecorder()
+	handle(w, r, nil)
+	require.Equal(t, http.StatusTooManyRequests, w.Code)
+
+	require.Equal(t, 8, callCount)
+}
+
+func TestWithUnauthenticatedLimiter(t *testing.T) {
+	rateLimiter, err := limiter.NewRateLimiter(limiter.Config{
+		Rates: []limiter.Rate{
+			{Period: time.Minute, Average: 2, Burst: 3},
+		},
+		Clock: clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	h := &Handler{limiter: rateLimiter}
+
+	callCount := 0
+	handle := h.WithUnauthenticatedLimiter(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+		callCount++
+		return "success", nil
+	})
+
+	r := &http.Request{RemoteAddr: "192.168.1.1:1234"}
+
+	// Request should return the error from handler
+	w := httptest.NewRecorder()
+	handle(w, r, nil)
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, 1, callCount)
+
+	// Should be able to make more requests (they still count toward rate limit)
+	for range 2 {
+		w := httptest.NewRecorder()
+		handle(w, r, nil)
+		require.Equal(t, http.StatusOK, w.Code)
+	}
+	require.Equal(t, 3, callCount)
+
+	// Next request should be rate limited
+	w = httptest.NewRecorder()
+	handle(w, r, nil)
+	require.Equal(t, http.StatusTooManyRequests, w.Code)
+	require.Equal(t, 3, callCount)
+}
+
 // kubeClusterConfig defines the cluster to be created
 type kubeClusterConfig struct {
 	name        string
@@ -8900,7 +9542,7 @@ func newKubeConfigFile(ctx context.Context, t *testing.T, clusters ...kubeCluste
 
 type startKubeOptions struct {
 	clusters    []kubeClusterConfig
-	authServer  *auth.TestTLSServer
+	authServer  *authtest.TLSServer
 	revTunnel   reversetunnelclient.Server
 	serviceType kubeproxy.KubeServiceType
 }
@@ -8931,11 +9573,11 @@ func startKubeWithoutCleanup(ctx context.Context, t *testing.T, cfg startKubeOpt
 	hostID := uuid.New().String()
 	// heartbeatsWaitChannel waits for clusters heartbeats to start.
 	heartbeatsWaitChannel := make(chan struct{}, len(cfg.clusters))
-	client, err := cfg.authServer.NewClient(auth.TestServerID(role, hostID))
+	client, err := cfg.authServer.NewClient(authtest.TestServerID(role, hostID))
 	require.NoError(t, err)
 
 	// Auth client, lock watcher and authorizer for Kube proxy.
-	proxyAuthClient, err := cfg.authServer.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := cfg.authServer.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
@@ -8985,6 +9627,23 @@ func startKubeWithoutCleanup(ctx context.Context, t *testing.T, cfg startKubeOpt
 		KubernetesServerGetter: client,
 	})
 	require.NoError(t, err)
+	t.Cleanup(watcher.Close)
+
+	// wait for the watcher to init before continuing
+	require.NoError(t, watcher.WaitInitialization())
+
+	healthCheckManager, err := healthcheck.NewManager(
+		ctx,
+		healthcheck.ManagerConfig{
+			Component:               teleport.ComponentKube,
+			Events:                  client,
+			HealthCheckConfigReader: client,
+		},
+	)
+	require.NoError(t, err)
+	err = healthCheckManager.Start(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, healthCheckManager.Close()) })
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(client.InventoryControlStream,
 		func(ctx context.Context) (*authproto.UpstreamInventoryHello, error) {
@@ -9057,6 +9716,7 @@ func startKubeWithoutCleanup(ctx context.Context, t *testing.T, cfg startKubeOpt
 		OnReconcile:              func(kc types.KubeClusters) {},
 		KubernetesServersWatcher: watcher,
 		InventoryHandle:          inventoryHandle,
+		HealthCheckManager:       healthCheckManager,
 	})
 	require.NoError(t, err)
 
@@ -9072,8 +9732,6 @@ func startKubeWithoutCleanup(ctx context.Context, t *testing.T, cfg startKubeOpt
 		}
 		errChan <- err
 	}()
-	// wait for the watcher to init or it may race with test cleanup.
-	require.NoError(t, watcher.WaitInitialization())
 
 	// Waits for len(clusters) heartbeats to start
 	heartbeatsToExpect := len(cfg.clusters)
@@ -9429,11 +10087,11 @@ func TestLogout(t *testing.T) {
 func initGRPCServer(t *testing.T, env *webPack, listener net.Listener) {
 	clusterName := env.server.ClusterName()
 	// Auth client, lock watcher and authorizer for Kube proxy.
-	proxyAuthClient, err := env.server.TLS.NewClient(auth.TestBuiltin(types.RoleProxy))
+	proxyAuthClient, err := env.server.TLS.NewClient(authtest.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
 
-	serverIdentity, err := auth.NewServerIdentity(env.server.Auth(), uuid.NewString(), types.RoleProxy)
+	serverIdentity, err := authtest.NewServerIdentity(env.server.Auth(), uuid.NewString(), types.RoleProxy)
 	require.NoError(t, err)
 	tlsConfig, err := serverIdentity.TLSConfig(nil)
 	require.NoError(t, err)
@@ -9818,7 +10476,7 @@ func (m mockedPingTestProxy) Ping(ctx context.Context) (authproto.PingResponse,
 // is allowed to access the host and start entering input and receiving
 // output until the moderator terminates the session.
 func TestModeratedSession(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	s := newWebSuiteWithConfig(t, webSuiteConfig{disableDiskBasedRecording: true})
 
@@ -9900,7 +10558,7 @@ func TestModeratedSession(t *testing.T) {
 // presence checks are performed by the moderator. When presence checks are not performed
 // the session is aborted.
 func TestModeratedSessionWithMFA(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	const RPID = "localhost"
 
@@ -10359,7 +11017,11 @@ func sshLoginResponseFromCallbackResponse(t *testing.T, responseBody io.Reader,
 }
 
 func TestGithubConnector(t *testing.T) {
-	ctx := context.Background()
+	// We run this test as a Teleport Enterprise server to bypass the check for whether
+	// the GitHub org uses SSO.
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
+
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 
 	proxy := env.proxies[0]
@@ -10463,53 +11125,6 @@ func TestGithubConnector(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.Code(), "unexpected status code getting connectors")
 }
 
-func TestCalculateSSHLogins(t *testing.T) {
-	cases := []struct {
-		name              string
-		allowedLogins     []string
-		grantedPrincipals []string
-		expectedLogins    []string
-	}{
-		{
-			name:              "no matching logins",
-			allowedLogins:     []string{"llama"},
-			grantedPrincipals: []string{"fish"},
-		},
-		{
-			name:              "identical logins",
-			allowedLogins:     []string{"llama", "shark", "goose"},
-			grantedPrincipals: []string{"shark", "goose", "llama"},
-			expectedLogins:    []string{"goose", "shark", "llama"},
-		},
-		{
-			name:              "subset of logins",
-			allowedLogins:     []string{"llama"},
-			grantedPrincipals: []string{"shark", "goose", "llama"},
-			expectedLogins:    []string{"llama"},
-		},
-		{
-			name:              "no allowed logins",
-			grantedPrincipals: []string{"shark", "goose", "llama"},
-		},
-		{
-			name:          "no granted logins",
-			allowedLogins: []string{"shark", "goose", "llama"},
-		},
-	}
-
-	for _, test := range cases {
-		t.Run(test.name, func(t *testing.T) {
-			identity := &tlsca.Identity{Principals: test.grantedPrincipals}
-
-			logins, err := calculateSSHLogins(identity, test.allowedLogins)
-			require.NoError(t, err)
-			require.Empty(t, cmp.Diff(logins, test.expectedLogins, cmpopts.SortSlices(func(a, b string) bool {
-				return strings.Compare(a, b) < 0
-			})))
-		})
-	}
-}
-
 func TestCalculateAppLogins(t *testing.T) {
 	cases := []struct {
 		name           string
@@ -10622,7 +11237,7 @@ func TestWebSocketClosedBeforeSSHSessionCreated(t *testing.T) {
 	// not yet established.
 	stream := terminal.NewStream(ctx, terminal.StreamConfig{
 		WS:     ws,
-		Logger: utils.NewSlogLoggerForTests(),
+		Logger: logtest.NewLogger(),
 		Handlers: map[string]terminal.WSHandlerFunc{
 			defaults.WebsocketSessionMetadata: func(ctx context.Context, envelope terminal.Envelope) {
 				if envelope.Type != defaults.WebsocketSessionMetadata {
@@ -10758,6 +11373,7 @@ func Test_setEntitlementsWithLegacyLogic(t *testing.T) {
 					string(entitlements.LicenseAutoUpdate):          {Enabled: true, Limit: 99},
 					string(entitlements.AccessGraphDemoMode):        {Enabled: true, Limit: 99},
 					string(entitlements.UnrestrictedManagedUpdates): {Enabled: true, Limit: 99},
+					string(entitlements.ClientIPRestrictions):       {Enabled: true, Limit: 99},
 				},
 			},
 			expected: &webclient.WebConfig{
@@ -10822,6 +11438,7 @@ func Test_setEntitlementsWithLegacyLogic(t *testing.T) {
 					string(entitlements.LicenseAutoUpdate):          {Enabled: true, Limit: 99},
 					string(entitlements.AccessGraphDemoMode):        {Enabled: true, Limit: 99},
 					string(entitlements.UnrestrictedManagedUpdates): {Enabled: true, Limit: 99},
+					string(entitlements.ClientIPRestrictions):       {Enabled: true, Limit: 99},
 				},
 			},
 		},
@@ -10925,6 +11542,7 @@ func Test_setEntitlementsWithLegacyLogic(t *testing.T) {
 					string(entitlements.LicenseAutoUpdate):          {Enabled: false},
 					string(entitlements.AccessGraphDemoMode):        {Enabled: false},
 					string(entitlements.UnrestrictedManagedUpdates): {Enabled: false},
+					string(entitlements.ClientIPRestrictions):       {Enabled: false},
 
 					// set to equivalent legacy feature
 					string(entitlements.ExternalAuditStorage):   {Enabled: true},
@@ -11055,6 +11673,8 @@ func Test_setEntitlementsWithLegacyLogic(t *testing.T) {
 					string(entitlements.SAML):                       {Enabled: true},
 					string(entitlements.AccessGraphDemoMode):        {Enabled: false},
 					string(entitlements.UnrestrictedManagedUpdates): {Enabled: false},
+					string(entitlements.ClientIPRestrictions):       {Enabled: false},
+
 					// set to legacy feature "IsIGSEnabled"; false so set value and keep limits
 					string(entitlements.AccessLists):       {Enabled: true, Limit: 88},
 					string(entitlements.AccessMonitoring):  {Enabled: true, Limit: 88},
@@ -11166,6 +11786,7 @@ func Test_setEntitlementsWithLegacyLogic(t *testing.T) {
 					string(entitlements.LicenseAutoUpdate):          {Enabled: false},
 					string(entitlements.AccessGraphDemoMode):        {Enabled: false},
 					string(entitlements.UnrestrictedManagedUpdates): {Enabled: false},
+					string(entitlements.ClientIPRestrictions):       {Enabled: false},
 				},
 			},
 		},
@@ -11221,7 +11842,7 @@ func TestPingWithSAMLURL(t *testing.T) {
 			w.Write([]byte(entityDescriptor))
 		}),
 	}
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "HTTP server",
 		Task: func(ctx context.Context) error {
 			if err := httpServer.Serve(l); !errors.Is(err, http.ErrServerClosed) {
@@ -11262,3 +11883,80 @@ func TestPingWithSAMLURL(t *testing.T) {
 		})
 	}
 }
+
+func TestGetLocksV2(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	clusterName := env.server.ClusterName()
+	pack := proxy.authPack(t, "test-user@example.com", nil /* roles */)
+	endpoint := pack.clt.Endpoint("v2", "webapi", "sites", clusterName, "locks")
+
+	locks := []types.Lock{
+		newLock(t, "test-lock-1", false, types.LockTarget{User: "test-user-1"}),
+		newLock(t, "test-lock-2", false, types.LockTarget{Role: "test-role-1"}),
+		newLock(t, "test-lock-3", false, types.LockTarget{Login: "test-login-1"}),
+		newLock(t, "test-lock-4", false, types.LockTarget{MFADevice: "test-mfa-1"}),
+		newLock(t, "test-lock-5", false, types.LockTarget{WindowsDesktop: "test-win-1"}),
+		newLock(t, "test-lock-6", false, types.LockTarget{Device: "test-device-1"}),
+		newLock(t, "test-lock-7", false, types.LockTarget{ServerID: "test-server-1"}),
+		newLock(t, "test-lock-8", false, types.LockTarget{BotInstanceID: "test-instance-1"}),
+		newLock(t, "test-lock-9", false, types.LockTarget{JoinToken: "test-token-1"}),
+
+		newLock(t, "test-lock-10", true, types.LockTarget{
+			User: "test-user-1",
+			Role: "test-role-1",
+		}),
+	}
+
+	for _, l := range locks {
+		err := env.server.Auth().UpsertLock(ctx, l)
+		require.NoError(t, err)
+	}
+
+	// Without filters - returns all items
+	re, err := pack.clt.Get(ctx, endpoint, url.Values{})
+	require.NoError(t, err)
+	resp := GetClusterLocksV2Response{}
+	require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+	require.Len(t, resp.Locks, len(locks))
+
+	// With target filter - returns partial matching items also
+	re, err = pack.clt.Get(ctx, endpoint, url.Values{
+		"target": []string{"user|test-user-1", "login|test-login-1"},
+	})
+	require.NoError(t, err)
+	resp = GetClusterLocksV2Response{}
+	require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+	require.Len(t, resp.Locks, 3)
+
+	// With target filter and in_force_only - returns only non-expired items
+	re, err = pack.clt.Get(ctx, endpoint, url.Values{
+		"target":        []string{"user|test-user-1"},
+		"in_force_only": []string{"true"},
+	})
+	require.NoError(t, err)
+	resp = GetClusterLocksV2Response{}
+	require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+	require.Len(t, resp.Locks, 1)
+}
+
+func newLock(t *testing.T, name string, expired bool, target types.LockTarget) types.Lock {
+	t.Helper()
+
+	expires := time.Now()
+	if expired {
+		expires = expires.Add(-time.Hour)
+	} else {
+		expires = expires.Add(time.Hour)
+	}
+
+	lock, err := types.NewLock(name, types.LockSpecV2{
+		Target:  target,
+		Expires: &expires,
+	})
+	require.NoError(t, err)
+
+	return lock
+}
diff --git a/lib/web/apiserver_test_utils.go b/lib/web/apiserver_test_utils.go
deleted file mode 100644
index 9a98415a504ba..0000000000000
--- a/lib/web/apiserver_test_utils.go
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package web
-
-import (
-	"context"
-	"log/slog"
-	"net/http"
-	"os"
-	"path/filepath"
-
-	"github.com/gravitational/trace"
-)
-
-// NewDebugFileSystem returns the HTTP file system implementation
-func NewDebugFileSystem(isEnterprise bool) (http.FileSystem, error) {
-	// If the location of the UI changes on disk then this will need to be updated.
-	assetsPath := "../../webassets/teleport"
-
-	if isEnterprise {
-		assetsPath = "../../../webassets/e/teleport"
-	}
-
-	// Ensure we have the built assets available before continuing.
-	for _, af := range []string{"index.html", "/app"} {
-		_, err := os.Stat(filepath.Join(assetsPath, af))
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-	slog.InfoContext(context.TODO(), "Using filesystem for serving web assets", "assets_path", assetsPath)
-
-	return http.Dir(assetsPath), nil
-}
diff --git a/lib/web/app/handler.go b/lib/web/app/handler.go
index 2429fcc27ebf5..d54e3d341f420 100644
--- a/lib/web/app/handler.go
+++ b/lib/web/app/handler.go
@@ -55,8 +55,8 @@ type HandlerConfig struct {
 	AuthClient authclient.ClientI
 	// AccessPoint is caching client to auth.
 	AccessPoint authclient.ProxyAccessPoint
-	// ProxyClient holds connections to leaf clusters.
-	ProxyClient reversetunnelclient.Tunnel
+	// ClusterGetter holds connections to leaf clusters.
+	ClusterGetter reversetunnelclient.ClusterGetter
 	// ProxyPublicAddrs contains web proxy public addresses.
 	ProxyPublicAddrs []utils.NetAddr
 	// CipherSuites is the list of TLS cipher suites that have been configured
@@ -224,7 +224,7 @@ func (h *Handler) HandleConnection(ctx context.Context, clientConn net.Conn) err
 // application requests. Can be used to ensure the proxy can handle application
 // requests before they arrive.
 func (h *Handler) HealthCheckAppServer(ctx context.Context, publicAddr string, clusterName string) error {
-	clusterClient, err := h.c.ProxyClient.GetSite(clusterName)
+	clusterClient, err := h.c.ClusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -236,7 +236,7 @@ func (h *Handler) HealthCheckAppServer(ctx context.Context, publicAddr string, c
 	// At least one AppServer needs to be present to serve the requests. Using
 	// MatchOne can reduce the amount of work required by the app matcher by not
 	// dialing every AppServer.
-	_, err = MatchOne(ctx, accessPoint, appServerMatcher(h.c.ProxyClient, publicAddr, clusterName))
+	_, err = MatchOne(ctx, accessPoint, appServerMatcher(h.c.ClusterGetter, publicAddr, clusterName))
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/web/app/handler_test.go b/lib/web/app/handler_test.go
index 6250a22c89f93..4c4b581731361 100644
--- a/lib/web/app/handler_test.go
+++ b/lib/web/app/handler_test.go
@@ -328,10 +328,10 @@ func TestMatchApplicationServers(t *testing.T) {
 	// Create a httptest server to serve the application requests. It must serve
 	// TLS content with the generated certificate.
 	expectedContent := "Hello application"
-	fakeRemoteSite := startFakeAppServerOnRemoteSite(t, clusterName, authClient, cert, key)
+	fakeCluster := startFakeAppServerOnCluster(t, clusterName, authClient, cert, key)
 	tunnel := &reversetunnelclient.FakeServer{
-		Sites: []reversetunnelclient.RemoteSite{
-			fakeRemoteSite,
+		FakeClusters: []reversetunnelclient.Cluster{
+			fakeCluster,
 		},
 	}
 
@@ -348,9 +348,9 @@ func TestMatchApplicationServers(t *testing.T) {
 	})
 
 	require.Equal(t, http.StatusOK, status)
-	// Remote site should receive only 4 connection requests: 3 from the
+	// Cluster should receive only 4 connection requests: 3 from the
 	// MatchHealthy and 1 from the transport.
-	require.Equal(t, int64(4), fakeRemoteSite.DialCount())
+	require.Equal(t, int64(4), fakeCluster.DialCount())
 	// Guarantee the request was returned by the httptest server.
 	require.Equal(t, expectedContent, content)
 }
@@ -370,14 +370,14 @@ func TestHealthCheckAppServer(t *testing.T) {
 	for _, tc := range []struct {
 		desc                string
 		publicAddr          string
-		appServersFunc      func(t *testing.T, remoteSite *reversetunnelclient.FakeRemoteSite) []types.AppServer
+		appServersFunc      func(t *testing.T, cluster *reversetunnelclient.FakeCluster) []types.AppServer
 		expectedTunnelCalls int
 		expectErr           require.ErrorAssertionFunc
 	}{
 		{
 			desc:       "match and online services",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, _ *reversetunnelclient.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, _ *reversetunnelclient.FakeCluster) []types.AppServer {
 				return []types.AppServer{createAppServer(t, "valid.example.com")}
 			},
 			expectedTunnelCalls: 1,
@@ -386,9 +386,9 @@ func TestHealthCheckAppServer(t *testing.T) {
 		{
 			desc:       "match and but no online services",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, tunnel *reversetunnelclient.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, cluster *reversetunnelclient.FakeCluster) []types.AppServer {
 				appServer := createAppServer(t, "valid.example.com")
-				tunnel.OfflineTunnels = map[string]struct{}{
+				cluster.OfflineTunnels = map[string]struct{}{
 					fmt.Sprintf("%s.%s", appServer.GetHostID(), clusterName): {},
 				}
 				return []types.AppServer{appServer}
@@ -399,7 +399,7 @@ func TestHealthCheckAppServer(t *testing.T) {
 		{
 			desc:       "no match",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, tunnel *reversetunnelclient.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, _ *reversetunnelclient.FakeCluster) []types.AppServer {
 				return []types.AppServer{}
 			},
 			expectedTunnelCalls: 0,
@@ -416,18 +416,18 @@ func TestHealthCheckAppServer(t *testing.T) {
 				caCert:      cert,
 			}
 
-			fakeRemoteSite := startFakeAppServerOnRemoteSite(t, clusterName, authClient, cert, key)
-			authClient.appServers = tc.appServersFunc(t, fakeRemoteSite)
+			fakeCluster := startFakeAppServerOnCluster(t, clusterName, authClient, cert, key)
+			authClient.appServers = tc.appServersFunc(t, fakeCluster)
 
 			tunnel := &reversetunnelclient.FakeServer{
-				Sites: []reversetunnelclient.RemoteSite{fakeRemoteSite},
+				FakeClusters: []reversetunnelclient.Cluster{fakeCluster},
 			}
 
 			appHandler, err := NewHandler(ctx, &HandlerConfig{
 				Clock:                 fakeClock,
 				AuthClient:            authClient,
 				AccessPoint:           authClient,
-				ProxyClient:           tunnel,
+				ClusterGetter:         tunnel,
 				CipherSuites:          utils.DefaultCipherSuites(),
 				IntegrationAppHandler: &mockIntegrationAppHandler{},
 			})
@@ -435,7 +435,7 @@ func TestHealthCheckAppServer(t *testing.T) {
 
 			err = appHandler.HealthCheckAppServer(ctx, tc.publicAddr, clusterName)
 			tc.expectErr(t, err)
-			require.Equal(t, int64(tc.expectedTunnelCalls), fakeRemoteSite.DialCount())
+			require.Equal(t, int64(tc.expectedTunnelCalls), fakeCluster.DialCount())
 		})
 	}
 }
@@ -444,12 +444,12 @@ type testServer struct {
 	serverURL *url.URL
 }
 
-func setup(t *testing.T, clock *clockwork.FakeClock, authClient authclient.ClientI, proxyClient reversetunnelclient.Tunnel) *testServer {
+func setup(t *testing.T, clock *clockwork.FakeClock, authClient authclient.ClientI, clusterGetter reversetunnelclient.ClusterGetter) *testServer {
 	appHandler, err := NewHandler(context.Background(), &HandlerConfig{
 		Clock:                 clock,
 		AuthClient:            authClient,
 		AccessPoint:           authClient,
-		ProxyClient:           proxyClient,
+		ClusterGetter:         clusterGetter,
 		CipherSuites:          utils.DefaultCipherSuites(),
 		IntegrationAppHandler: &mockIntegrationAppHandler{},
 	})
@@ -577,26 +577,30 @@ func (c *mockAuthClient) GetProxies() ([]types.Server, error) {
 	return []types.Server{}, nil
 }
 
-// fakeRemoteListener Implements a `net.Listener` that return `net.Conn` from
-// the `FakeRemoteSite`.
-type fakeRemoteListener struct {
-	fakeRemote *reversetunnelclient.FakeRemoteSite
+func (c *mockAuthClient) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	return []types.Server{}, "", nil
 }
 
-func (r *fakeRemoteListener) Accept() (net.Conn, error) {
-	conn, ok := <-r.fakeRemote.ProxyConn()
+// fakeClusterListener Implements a `net.Listener` that return `net.Conn` from
+// the `FakeCluster`.
+type fakeClusterListener struct {
+	fakeCluster *reversetunnelclient.FakeCluster
+}
+
+func (r *fakeClusterListener) Accept() (net.Conn, error) {
+	conn, ok := <-r.fakeCluster.ProxyConn()
 	if !ok {
-		return nil, fmt.Errorf("remote closed")
+		return nil, fmt.Errorf("cluster closed")
 	}
 
 	return conn, nil
 }
 
-func (r *fakeRemoteListener) Close() error {
+func (r *fakeClusterListener) Close() error {
 	return nil
 }
 
-func (r *fakeRemoteListener) Addr() net.Addr {
+func (r *fakeClusterListener) Addr() net.Addr {
 	return &net.IPAddr{}
 }
 
@@ -775,19 +779,19 @@ func TestMakeAppRedirectURL(t *testing.T) {
 	}
 }
 
-func startFakeAppServerOnRemoteSite(t *testing.T, clusterName string, accessPoint authclient.RemoteProxyAccessPoint, cert, key []byte) *reversetunnelclient.FakeRemoteSite {
+func startFakeAppServerOnCluster(t *testing.T, clusterName string, accessPoint authclient.RemoteProxyAccessPoint, cert, key []byte) *reversetunnelclient.FakeCluster {
 	t.Helper()
 
 	tlsCert, err := tls.X509KeyPair(cert, key)
 	require.NoError(t, err)
 
-	fakeRemoteSite := reversetunnelclient.NewFakeRemoteSite(clusterName, accessPoint)
+	fakeCluster := reversetunnelclient.NewFakeCluster(clusterName, accessPoint)
 	server := &httptest.Server{
 		TLS: &tls.Config{
 			Certificates: []tls.Certificate{tlsCert},
 		},
-		Listener: &fakeRemoteListener{
-			fakeRemote: fakeRemoteSite,
+		Listener: &fakeClusterListener{
+			fakeCluster: fakeCluster,
 		},
 		Config: &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 			fmt.Fprint(w, "Hello application")
@@ -795,11 +799,11 @@ func startFakeAppServerOnRemoteSite(t *testing.T, clusterName string, accessPoin
 	}
 	server.StartTLS()
 	t.Cleanup(func() {
-		// Close fake remote site first to make sure fake listener quits.
-		fakeRemoteSite.Close()
+		// Close fake cluster first to make sure fake listener quits.
+		fakeCluster.Close()
 		server.Close()
 	})
-	return fakeRemoteSite
+	return fakeCluster
 }
 
 func TestHandlerAuthenticate(t *testing.T) {
@@ -826,14 +830,14 @@ func TestHandlerAuthenticate(t *testing.T) {
 		caCert: cert,
 	}
 
-	fakeRemoteSite := startFakeAppServerOnRemoteSite(t, clusterName, authClient, cert, key)
+	fakeCluster := startFakeAppServerOnCluster(t, clusterName, authClient, cert, key)
 
 	appHandler, err := NewHandler(ctx, &HandlerConfig{
 		Clock:       fakeClock,
 		AuthClient:  authClient,
 		AccessPoint: authClient,
-		ProxyClient: &reversetunnelclient.FakeServer{
-			Sites: []reversetunnelclient.RemoteSite{fakeRemoteSite},
+		ClusterGetter: &reversetunnelclient.FakeServer{
+			FakeClusters: []reversetunnelclient.Cluster{fakeCluster},
 		},
 		CipherSuites:          utils.DefaultCipherSuites(),
 		IntegrationAppHandler: &mockIntegrationAppHandler{},
diff --git a/lib/web/app/match.go b/lib/web/app/match.go
index 0be58c3c663ec..5fa70c91c937f 100644
--- a/lib/web/app/match.go
+++ b/lib/web/app/match.go
@@ -97,7 +97,7 @@ func MatchName(name string) Matcher {
 // MatchHealthy tries to establish a connection with the server using the
 // `dialAppServer` function. The app server is matched if the function call
 // doesn't return any error.
-func MatchHealthy(proxyClient reversetunnelclient.Tunnel, clusterName string) Matcher {
+func MatchHealthy(clusterGetter reversetunnelclient.ClusterGetter, clusterName string) Matcher {
 	return func(ctx context.Context, appServer types.AppServer) bool {
 		// Redirected apps don't need to be dialed, as the proxy will redirect to them.
 		if redirectInsteadOfForward(appServer) {
@@ -110,7 +110,7 @@ func MatchHealthy(proxyClient reversetunnelclient.Tunnel, clusterName string) Ma
 			return true
 		}
 
-		conn, err := dialAppServer(ctx, proxyClient, clusterName, appServer)
+		conn, err := dialAppServer(ctx, clusterGetter, clusterName, appServer)
 		if err != nil {
 			return false
 		}
@@ -133,6 +133,12 @@ func MatchAll(matchers ...Matcher) Matcher {
 	}
 }
 
+// ClusterGetter provides a means to retrieve all connected
+// Teleport clusters - either local or remote.
+type ClusterGetter interface {
+	Clusters(context.Context) ([]reversetunnelclient.Cluster, error)
+}
+
 // ResolveFQDN makes a best effort attempt to resolve FQDN to an application
 // running a root or leaf cluster.
 //
@@ -141,7 +147,7 @@ func MatchAll(matchers ...Matcher) Matcher {
 // cluster, this method will always return "acme" running within the root
 // cluster. Always supply public address and cluster name to deterministically
 // resolve an application.
-func ResolveFQDN(ctx context.Context, clt Getter, tunnel reversetunnelclient.Tunnel, proxyDNSNames []string, fqdn string) (types.AppServer, string, error) {
+func ResolveFQDN(ctx context.Context, clt Getter, clusterGetter ClusterGetter, proxyDNSNames []string, fqdn string) (types.AppServer, string, error) {
 	// Try and match FQDN to public address of application within cluster.
 	servers, err := MatchUnshuffled(ctx, clt, MatchPublicAddr(fqdn))
 	if err == nil && len(servers) > 0 {
@@ -160,7 +166,7 @@ func ResolveFQDN(ctx context.Context, clt Getter, tunnel reversetunnelclient.Tun
 
 	// Loop over all clusters and try and match application name to an
 	// application within the cluster. This also includes the local cluster.
-	clusterClients, err := tunnel.GetSites()
+	clusterClients, err := clusterGetter.Clusters(ctx)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
diff --git a/lib/web/app/match_test.go b/lib/web/app/match_test.go
index 51820fe3c7847..cd0dfe5676308 100644
--- a/lib/web/app/match_test.go
+++ b/lib/web/app/match_test.go
@@ -76,8 +76,8 @@ func TestMatchHealthy(t *testing.T) {
 
 	for name, test := range testCases {
 		t.Run(name, func(t *testing.T) {
-			match := MatchHealthy(&mockProxyClient{
-				remoteSite: &mockRemoteSite{
+			match := MatchHealthy(&mockClusterGetter{
+				cluster: &mockCluster{
 					dialErr: test.dialErr,
 				},
 			}, "")
@@ -111,21 +111,21 @@ func mustNewAppServer(t *testing.T, origin string) func() types.AppServer {
 	}
 }
 
-type mockProxyClient struct {
-	reversetunnelclient.Tunnel
-	remoteSite *mockRemoteSite
+type mockClusterGetter struct {
+	reversetunnelclient.ClusterGetter
+	cluster *mockCluster
 }
 
-func (p *mockProxyClient) GetSite(_ string) (reversetunnelclient.RemoteSite, error) {
-	return p.remoteSite, nil
+func (p *mockClusterGetter) Cluster(context.Context, string) (reversetunnelclient.Cluster, error) {
+	return p.cluster, nil
 }
 
-type mockRemoteSite struct {
-	reversetunnelclient.RemoteSite
+type mockCluster struct {
+	reversetunnelclient.Cluster
 	dialErr error
 }
 
-func (r *mockRemoteSite) Dial(_ reversetunnelclient.DialParams) (net.Conn, error) {
+func (r *mockCluster) Dial(_ reversetunnelclient.DialParams) (net.Conn, error) {
 	if r.dialErr != nil {
 		return nil, r.dialErr
 	}
diff --git a/lib/web/app/middleware.go b/lib/web/app/middleware.go
index 2d364e8bc109e..71bf21020b15b 100644
--- a/lib/web/app/middleware.go
+++ b/lib/web/app/middleware.go
@@ -73,13 +73,15 @@ func (h *Handler) redirectToLauncher(w http.ResponseWriter, r *http.Request, p l
 	}
 
 	if h.c.WebPublicAddr == "" {
-		// The error below tends to be swallowed by the Web UI, so log a warning for
-		// admins as well.
-		const msg = "Application Service requires public_addr to be set in the Teleport Proxy Service configuration. " +
-			"Please contact your Teleport cluster administrator or refer to " +
-			"https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/."
-		h.logger.ErrorContext(r.Context(), msg)
-		return trace.BadParameter("public address of the proxy is not set")
+		const errMsg = "Application Service requires public_addr to be set in the Teleport Proxy Service configuration. " +
+			"Update the Teleport Proxy Service configuration to include a public_addr. " +
+			"Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/."
+
+		// Log the error to warn admins 🚩
+		h.logger.ErrorContext(r.Context(), errMsg)
+
+		// Immediately return an error since this is a critical misconfiguration 🛑
+		return trace.BadParameter(errMsg)
 	}
 
 	addr, err := utils.ParseAddr(r.Host)
@@ -87,11 +89,26 @@ func (h *Handler) redirectToLauncher(w http.ResponseWriter, r *http.Request, p l
 		return trace.Wrap(err)
 	}
 
-	var proxyPublicAddrs []string
+	proxyPublicAddrs := make([]string, 0, len(h.c.ProxyPublicAddrs))
+
 	for _, proxyAddr := range h.c.ProxyPublicAddrs {
-		// preserving full `host:port` to support proxy hosted on non-standard HTTPS port.
+		if p.publicAddr == proxyAddr.Host() {
+			const errMsg = "Application public address conflicts with the Teleport Proxy public address. " +
+				"Configure the application to use a unique public address that does not match the proxy's public addresses. " +
+				"Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/."
+
+			// Log the error to warn admins 🚩
+			h.logger.ErrorContext(r.Context(), errMsg, "launcher_params", p)
+
+			// Immediately return an error since this is a critical misconfiguration 🛑
+			return trace.BadParameter(errMsg)
+		}
+
+		// Append the full proxy address (host:port) to the list, preserving the port information.
+		// This is necessary to support proxies running on non-standard HTTPS ports and ensure accurate DNS matching.
 		proxyPublicAddrs = append(proxyPublicAddrs, proxyAddr.String())
 	}
+
 	proxyDNSName := utils.FindMatchingProxyDNS(r.Host, proxyPublicAddrs)
 	urlString := makeAppRedirectURL(r, proxyDNSName, addr.Host(), p)
 	http.Redirect(w, r, urlString, http.StatusFound)
@@ -122,7 +139,7 @@ func makeHandler(handler handlerFunc) http.HandlerFunc {
 // response writer.
 func writeError(w http.ResponseWriter, err error) {
 	code := trace.ErrorToCode(err)
-	http.Error(w, http.StatusText(code), code)
+	http.Error(w, err.Error(), code)
 }
 
 type routerFunc func(http.ResponseWriter, *http.Request, httprouter.Params) error
diff --git a/lib/web/app/session.go b/lib/web/app/session.go
index 56eeb31b5e4de..adb3cd7852269 100644
--- a/lib/web/app/session.go
+++ b/lib/web/app/session.go
@@ -56,7 +56,7 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 
 	// Query the cluster this application is running in to find the public
 	// address and cluster name pair which will be encoded into the certificate.
-	clusterClient, err := h.c.ProxyClient.GetSite(identity.RouteToApp.ClusterName)
+	clusterClient, err := h.c.ClusterGetter.Cluster(ctx, identity.RouteToApp.ClusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -68,7 +68,7 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 	servers, err := MatchUnshuffled(
 		ctx,
 		accessPoint,
-		appServerMatcher(h.c.ProxyClient, identity.RouteToApp.PublicAddr, identity.RouteToApp.ClusterName),
+		appServerMatcher(h.c.ClusterGetter, identity.RouteToApp.PublicAddr, identity.RouteToApp.ClusterName),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -86,7 +86,7 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 	transport, err := newTransport(&transportConfig{
 		log:                   h.logger,
 		clock:                 h.c.Clock,
-		proxyClient:           h.c.ProxyClient,
+		clusterGetter:         h.c.ClusterGetter,
 		accessPoint:           h.c.AccessPoint,
 		cipherSuites:          h.c.CipherSuites,
 		identity:              identity,
@@ -125,7 +125,7 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 
 // appServerMatcher returns a Matcher function used to find which AppServer can
 // handle the application requests.
-func appServerMatcher(proxyClient reversetunnelclient.Tunnel, publicAddr string, clusterName string) Matcher {
+func appServerMatcher(clusterGetter reversetunnelclient.ClusterGetter, publicAddr string, clusterName string) Matcher {
 	// Match healthy and PublicAddr servers. Having a list of only healthy
 	// servers helps the transport fail before the request is forwarded to a
 	// server (in cases where there are no healthy servers). This process might
@@ -135,6 +135,6 @@ func appServerMatcher(proxyClient reversetunnelclient.Tunnel, publicAddr string,
 		MatchPublicAddr(publicAddr),
 		// NOTE: Try to leave this matcher as the last one to dial only the
 		// application servers that match the requested application.
-		MatchHealthy(proxyClient, clusterName),
+		MatchHealthy(clusterGetter, clusterName),
 	)
 }
diff --git a/lib/web/app/transport.go b/lib/web/app/transport.go
index 918dc0fd47283..b6b80cac9e3b3 100644
--- a/lib/web/app/transport.go
+++ b/lib/web/app/transport.go
@@ -55,15 +55,15 @@ type ServerHandler interface {
 
 // transportConfig is configuration for a rewriting transport.
 type transportConfig struct {
-	proxyClient  reversetunnelclient.Tunnel
-	accessPoint  authclient.ReadProxyAccessPoint
-	cipherSuites []uint16
-	identity     *tlsca.Identity
-	servers      []types.AppServer
-	ws           types.WebSession
-	clusterName  string
-	log          *slog.Logger
-	clock        clockwork.Clock
+	clusterGetter reversetunnelclient.ClusterGetter
+	accessPoint   authclient.ReadProxyAccessPoint
+	cipherSuites  []uint16
+	identity      *tlsca.Identity
+	servers       []types.AppServer
+	ws            types.WebSession
+	clusterName   string
+	log           *slog.Logger
+	clock         clockwork.Clock
 
 	// integrationAppHandler is used to handle App proxy requests for Apps that are configured to use an Integration.
 	// Instead of proxying the connection to an AppService, the app is immediately proxied from the Proxy.
@@ -72,7 +72,7 @@ type transportConfig struct {
 
 // Check validates configuration.
 func (c *transportConfig) Check() error {
-	if c.proxyClient == nil {
+	if c.clusterGetter == nil {
 		return trace.BadParameter("proxy client missing")
 	}
 	if c.accessPoint == nil {
@@ -287,8 +287,10 @@ func (t *transport) resignAzureJWTCookie(r *http.Request) error {
 
 	// Create a new jwt key using the client public key to verify and parse the token.
 	clientJWTKey, err := jwt.New(&jwt.Config{
-		Clock:       t.c.clock,
-		PublicKey:   r.TLS.PeerCertificates[0].PublicKey,
+		Clock:     t.c.clock,
+		PublicKey: r.TLS.PeerCertificates[0].PublicKey,
+		// TODO(gabrielcorado): use the cluster name. This value must match the
+		// one used by the proxy.
 		ClusterName: types.TeleportAzureMSIEndpoint,
 	})
 	if err != nil {
@@ -301,8 +303,10 @@ func (t *transport) resignAzureJWTCookie(r *http.Request) error {
 		return trace.Wrap(err)
 	}
 	wsJWTKey, err := jwt.New(&jwt.Config{
-		Clock:       t.c.clock,
-		PrivateKey:  wsPrivateKey,
+		Clock:      t.c.clock,
+		PrivateKey: wsPrivateKey,
+		// TODO(gabrielcorado): use the cluster name. This value must match the
+		// one used by the proxy.
 		ClusterName: types.TeleportAzureMSIEndpoint,
 	})
 	if err != nil {
@@ -357,11 +361,25 @@ func (t *transport) DialContext(ctx context.Context, _, _ string) (conn net.Conn
 		appIntegration := appServer.GetApp().GetIntegration()
 		if appIntegration != "" {
 			src, dst := net.Pipe()
-			go t.c.integrationAppHandler.HandleConnection(src)
+
+			// Creating the connection using `net.Pipe()` results in both ends having the same local/remote address: "pipe".
+			// This causes IP Pinning checks to fail when validating that the connection remote address matches the certificate pinned IP.
+			//
+			// To fix this, we need to wrap the `src` connection to return the client source address as the remote address.
+			// The client source address is extracted from the context, the same way as in `dialAppServer`.
+			srcWithClientSrcAddr, err := wrapConnWithClientSrcAddrFromContext(ctx, src)
+			if err != nil {
+				// Log a warning and use the original remote address if we fail to extract the client source address from context.
+				// This will result in an error if the flow has pinned IP restrictions.
+				t.c.log.WarnContext(ctx, "Failed to extract client source address from context when proxying access to Application with integration credentials. IP Pinning checks will fail.", "error", err)
+				srcWithClientSrcAddr = src
+			}
+
+			go t.c.integrationAppHandler.HandleConnection(srcWithClientSrcAddr)
 			return dst, nil
 		}
 
-		conn, err = dialAppServer(ctx, t.c.proxyClient, t.c.identity.RouteToApp.ClusterName, appServer)
+		conn, err = dialAppServer(ctx, t.c.clusterGetter, t.c.identity.RouteToApp.ClusterName, appServer)
 		if err != nil && isReverseTunnelDownError(err) {
 			t.c.log.WarnContext(ctx, "Failed to connect to application server", "app_server", appServer.GetName(), "error", err)
 			// Continue to the next server if there is an issue
@@ -375,21 +393,6 @@ func (t *transport) DialContext(ctx context.Context, _, _ string) (conn net.Conn
 		break
 	}
 
-	t.mu.Lock()
-	// Only attempt to tidy up the list of servers if they weren't altered
-	// while the dialing happened. Since the lock is only held initially when
-	// making the servers copy and released during the dials, another dial attempt
-	// may have already happened and modified the list of servers.
-	if len(servers) == len(t.c.servers) {
-		// eliminate any servers from the head of the list that were unreachable
-		if i < len(t.c.servers) {
-			t.c.servers = t.c.servers[i:]
-		} else {
-			t.c.servers = nil
-		}
-	}
-	t.mu.Unlock()
-
 	if conn != nil || err != nil {
 		return conn, trace.Wrap(err)
 	}
@@ -397,6 +400,27 @@ func (t *transport) DialContext(ctx context.Context, _, _ string) (conn net.Conn
 	return nil, trace.ConnectionProblem(nil, "no application servers remaining to connect")
 }
 
+type connWithCustomRemoteAddr struct {
+	net.Conn
+	remoteAddr net.Addr
+}
+
+func (w *connWithCustomRemoteAddr) RemoteAddr() net.Addr {
+	return w.remoteAddr
+}
+
+func wrapConnWithClientSrcAddrFromContext(ctx context.Context, conn net.Conn) (net.Conn, error) {
+	clientSrcAddr, err := authz.ClientSrcAddrFromContext(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &connWithCustomRemoteAddr{
+		Conn:       conn,
+		remoteAddr: clientSrcAddr,
+	}, nil
+}
+
 // DialWebsocket dials a websocket connection over the transport's reverse
 // tunnel.
 func (t *transport) DialWebsocket(network, address string) (net.Conn, error) {
@@ -410,8 +434,8 @@ func (t *transport) DialWebsocket(network, address string) (net.Conn, error) {
 
 // dialAppServer dial and connect to the application service over the reverse
 // tunnel subsystem.
-func dialAppServer(ctx context.Context, proxyClient reversetunnelclient.Tunnel, clusterName string, server types.AppServer) (net.Conn, error) {
-	clusterClient, err := proxyClient.GetSite(clusterName)
+func dialAppServer(ctx context.Context, clusterGetter reversetunnelclient.ClusterGetter, clusterName string, server types.AppServer) (net.Conn, error) {
+	clusterClient, err := clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/app/transport_test.go b/lib/web/app/transport_test.go
index a91fad73a476e..2a7504b4a3ee3 100644
--- a/lib/web/app/transport_test.go
+++ b/lib/web/app/transport_test.go
@@ -42,12 +42,14 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 func Test_transport_rewriteRedirect(t *testing.T) {
@@ -84,8 +86,8 @@ func Test_transport_rewriteRedirect(t *testing.T) {
 			identity:    identity,
 			servers:     []types.AppServer{server},
 
-			cipherSuites: utils.DefaultCipherSuites(),
-			proxyClient:  &mockProxyClient{},
+			cipherSuites:  utils.DefaultCipherSuites(),
+			clusterGetter: &mockClusterGetter{},
 			accessPoint: &mockAuthClient{
 				caKey:       caKey,
 				caCert:      caCert,
@@ -217,20 +219,20 @@ func Test_transport_rewriteRedirect(t *testing.T) {
 }
 
 type fakeTunnel struct {
-	reversetunnelclient.Tunnel
+	reversetunnelclient.ClusterGetter
 
-	fakeSite *reversetunnelclient.FakeRemoteSite
-	err      error
+	fakeCluster *reversetunnelclient.FakeCluster
+	err         error
 }
 
-func (f fakeTunnel) GetSite(domainName string) (reversetunnelclient.RemoteSite, error) {
-	return f.fakeSite, f.err
+func (f fakeTunnel) Cluster(context.Context, string) (reversetunnelclient.Cluster, error) {
+	return f.fakeCluster, f.err
 }
 
 func TestTransport_DialContextNoServersAvailable(t *testing.T) {
 	tp := transport{
 		c: &transportConfig{
-			proxyClient: fakeTunnel{
+			clusterGetter: fakeTunnel{
 				err: trace.ConnectionProblem(errors.New(reversetunnelclient.NoApplicationTunnel), ""),
 			},
 			identity: &tlsca.Identity{},
@@ -239,7 +241,7 @@ func TestTransport_DialContextNoServersAvailable(t *testing.T) {
 				&types.AppServerV3{Spec: types.AppServerSpecV3{App: &types.AppV3{}}},
 				&types.AppServerV3{Spec: types.AppServerSpecV3{App: &types.AppV3{}}},
 			},
-			log: utils.NewSlogLoggerForTests(),
+			log: logtest.NewLogger(),
 		},
 	}
 
@@ -304,9 +306,9 @@ func Test_transport_rewriteRequest(t *testing.T) {
 				AzureIdentity: "azure-identity",
 			},
 		},
-		servers:      []types.AppServer{azureAppServer},
-		cipherSuites: utils.DefaultCipherSuites(),
-		proxyClient:  &mockProxyClient{},
+		servers:       []types.AppServer{azureAppServer},
+		cipherSuites:  utils.DefaultCipherSuites(),
+		clusterGetter: &mockClusterGetter{},
 		accessPoint: &mockAuthClient{
 			caKey:       caKey,
 			caCert:      caCert,
@@ -480,9 +482,9 @@ func Test_transport_with_integration(t *testing.T) {
 				AWSRoleARN:  "MyAWSRole",
 			},
 		},
-		servers:      []types.AppServer{awsAppServer},
-		cipherSuites: utils.DefaultCipherSuites(),
-		proxyClient:  &mockProxyClient{},
+		servers:       []types.AppServer{awsAppServer},
+		cipherSuites:  utils.DefaultCipherSuites(),
+		clusterGetter: &mockClusterGetter{},
 		accessPoint: &mockAuthClient{
 			caKey:       caKey,
 			caCert:      caCert,
@@ -493,13 +495,20 @@ func Test_transport_with_integration(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	conn, err := tr.DialContext(context.Background(), "", "")
+	ctxWithClientSrcAddr := authz.ContextWithClientSrcAddr(t.Context(), &utils.NetAddr{
+		AddrNetwork: "tcp",
+		Addr:        net.JoinHostPort("127.0.0.1", "55555"),
+	})
+
+	conn, err := tr.DialContext(ctxWithClientSrcAddr, "", "")
 	require.NoError(t, err)
 
 	require.Eventually(t, func() bool {
 		return integrationAppHandler.getConnection() != nil
 	}, 100*time.Millisecond, 10*time.Millisecond)
 
+	require.Equal(t, "127.0.0.1:55555", integrationAppHandler.getConnection().RemoteAddr().String())
+
 	message := "hello world"
 	messageSize := len(message)
 
diff --git a/lib/web/apps.go b/lib/web/apps.go
index bae4a9ab2f0e6..ce9fe80361c8a 100644
--- a/lib/web/apps.go
+++ b/lib/web/apps.go
@@ -282,8 +282,8 @@ func (h *Handler) resolveApp(ctx context.Context, scx *SessionContext, params Re
 
 // resolveAppByName will take an application name and cluster name and exactly resolves
 // the application and the server on which it is running.
-func (h *Handler) resolveAppByName(ctx context.Context, proxy reversetunnelclient.Tunnel, appName string, clusterName string) (types.AppServer, string, error) {
-	clusterClient, err := proxy.GetSite(clusterName)
+func (h *Handler) resolveAppByName(ctx context.Context, clusterGetter reversetunnelclient.ClusterGetter, appName string, clusterName string) (types.AppServer, string, error) {
+	clusterClient, err := clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
@@ -307,8 +307,8 @@ func (h *Handler) resolveAppByName(ctx context.Context, proxy reversetunnelclien
 
 // resolveDirect takes a public address and cluster name and exactly resolves
 // the application and the server on which it is running.
-func (h *Handler) resolveDirect(ctx context.Context, proxy reversetunnelclient.Tunnel, publicAddr string, clusterName string) (types.AppServer, string, error) {
-	clusterClient, err := proxy.GetSite(clusterName)
+func (h *Handler) resolveDirect(ctx context.Context, clusterGetter reversetunnelclient.ClusterGetter, publicAddr string, clusterName string) (types.AppServer, string, error) {
+	clusterClient, err := clusterGetter.Cluster(ctx, clusterName)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
 	}
@@ -332,8 +332,8 @@ func (h *Handler) resolveDirect(ctx context.Context, proxy reversetunnelclient.T
 
 // resolveFQDN makes a best effort attempt to resolve FQDN to an application
 // running within a root or leaf cluster.
-func (h *Handler) resolveFQDN(ctx context.Context, clt app.Getter, proxy reversetunnelclient.Tunnel, fqdn string) (types.AppServer, string, error) {
-	return app.ResolveFQDN(ctx, clt, proxy, h.proxyDNSNames(), fqdn)
+func (h *Handler) resolveFQDN(ctx context.Context, clt app.Getter, clusterGetter reversetunnelclient.ClusterGetter, fqdn string) (types.AppServer, string, error) {
+	return app.ResolveFQDN(ctx, clt, clusterGetter, h.proxyDNSNames(), fqdn)
 }
 
 // proxyDNSName is a DNS name the HTTP proxy is available at, where
diff --git a/lib/web/autoupdate_common.go b/lib/web/autoupdate_common.go
deleted file mode 100644
index c469aefb52034..0000000000000
--- a/lib/web/autoupdate_common.go
+++ /dev/null
@@ -1,239 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package web
-
-import (
-	"context"
-
-	"github.com/coreos/go-semver/semver"
-	"github.com/gravitational/trace"
-
-	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/autoupdate"
-	"github.com/gravitational/teleport/lib/automaticupgrades"
-	"github.com/gravitational/teleport/lib/automaticupgrades/version"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// autoUpdateAgentVersion returns the version the agent should install/update to based on
-// its group and updater UUID.
-// If the cluster contains an autoupdate_agent_rollout resource from RFD184 it should take precedence.
-// If the resource is not there, we fall back to RFD109-style updates with channels
-// and maintenance window derived from the cluster_maintenance_config resource.
-func (h *Handler) autoUpdateAgentVersion(ctx context.Context, group, updaterUUID string) (*semver.Version, error) {
-	rollout, err := h.cfg.AccessPoint.GetAutoUpdateAgentRollout(ctx)
-	if err != nil {
-		// Fallback to channels if there is no autoupdate_agent_rollout.
-		if trace.IsNotFound(err) || trace.IsNotImplemented(err) {
-			return getVersionFromChannel(ctx, h.cfg.AutomaticUpgradesChannels, group)
-		}
-		// Something is broken, we don't want to fallback to channels, this would be harmful.
-		return nil, trace.Wrap(err, "getting autoupdate_agent_rollout")
-	}
-
-	return getVersionFromRollout(rollout, group, updaterUUID)
-}
-
-// handlerVersionGetter is a dummy struct implementing version.Getter by wrapping Handler.autoUpdateAgentVersion.
-type handlerVersionGetter struct {
-	*Handler
-}
-
-// GetVersion implements version.Getter.
-func (h *handlerVersionGetter) GetVersion(ctx context.Context) (*semver.Version, error) {
-	const group, updaterUUID = "", ""
-	agentVersion, err := h.autoUpdateAgentVersion(ctx, group, updaterUUID)
-	return agentVersion, trace.Wrap(err)
-}
-
-// autoUpdateAgentShouldUpdate returns if the agent should update now to based on its group
-// and updater UUID.
-// If the cluster contains an autoupdate_agent_rollout resource from RFD184 it should take precedence.
-// If the resource is not there, we fall back to RFD109-style updates with channels
-// and maintenance window derived from the cluster_maintenance_config resource.
-func (h *Handler) autoUpdateAgentShouldUpdate(ctx context.Context, group, updaterUUID string, windowLookup bool) (bool, error) {
-	rollout, err := h.cfg.AccessPoint.GetAutoUpdateAgentRollout(ctx)
-	if err != nil {
-		// Fallback to channels if there is no autoupdate_agent_rollout.
-		if trace.IsNotFound(err) || trace.IsNotImplemented(err) {
-			// Updaters using the RFD184 API are not aware of maintenance windows
-			// like RFD109 updaters are. To have both updaters adopt the same behavior
-			// we must do the CMC window lookup for them.
-			if windowLookup {
-				return h.getTriggerFromWindowThenChannel(ctx, group)
-			}
-			return getTriggerFromChannel(ctx, h.cfg.AutomaticUpgradesChannels, group)
-		}
-		// Something is broken, we don't want to fallback to channels, this would be harmful.
-		return false, trace.Wrap(err, "failed to get auto-update rollout")
-	}
-
-	return getTriggerFromRollout(rollout, group, updaterUUID)
-}
-
-// getVersionFromRollout returns the version we should serve to the agent based
-// on the RFD184 agent rollout, the agent group name, and its UUID.
-// This logic is pretty complex and described in RFD 184.
-// The spec is summed up in the following table:
-// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
-func getVersionFromRollout(
-	rollout *autoupdatepb.AutoUpdateAgentRollout,
-	groupName, updaterUUID string,
-) (*semver.Version, error) {
-	switch rollout.GetSpec().GetAutoupdateMode() {
-	case autoupdate.AgentsUpdateModeDisabled:
-		// If AUs are disabled, we always answer the target version
-		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
-	case autoupdate.AgentsUpdateModeSuspended, autoupdate.AgentsUpdateModeEnabled:
-		// If AUs are enabled or suspended, we modulate the response based on the schedule and agent group state
-	default:
-		return nil, trace.BadParameter("unsupported agent update mode %q", rollout.GetSpec().GetAutoupdateMode())
-	}
-
-	// If the schedule is immediate, agents always update to the latest version
-	if rollout.GetSpec().GetSchedule() == autoupdate.AgentsScheduleImmediate {
-		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
-	}
-
-	// Else we follow the regular schedule and answer based on the agent group state
-	group, err := getGroup(rollout, groupName)
-	if err != nil {
-		return nil, trace.Wrap(err, "getting group %q", groupName)
-	}
-
-	switch group.GetState() {
-	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
-		return version.EnsureSemver(rollout.GetSpec().GetStartVersion())
-	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
-		return version.EnsureSemver(rollout.GetSpec().GetTargetVersion())
-	default:
-		return nil, trace.NotImplemented("unsupported group state %q", group.GetState())
-	}
-}
-
-// getTriggerFromRollout returns the version we should serve to the agent based
-// on the RFD184 agent rollout, the agent group name, and its UUID.
-// This logic is pretty complex and described in RFD 184.
-// The spec is summed up in the following table:
-// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
-func getTriggerFromRollout(rollout *autoupdatepb.AutoUpdateAgentRollout, groupName, updaterUUID string) (bool, error) {
-	// If the mode is "paused" or "disabled", we never tell to update
-	switch rollout.GetSpec().GetAutoupdateMode() {
-	case autoupdate.AgentsUpdateModeDisabled, autoupdate.AgentsUpdateModeSuspended:
-		// If AUs are disabled or suspended, never tell to update
-		return false, nil
-	case autoupdate.AgentsUpdateModeEnabled:
-		// If AUs are enabled, we modulate the response based on the schedule and agent group state
-	default:
-		return false, trace.BadParameter("unsupported agent update mode %q", rollout.GetSpec().GetAutoupdateMode())
-	}
-
-	// If the schedule is immediate, agents always update to the latest version
-	if rollout.GetSpec().GetSchedule() == autoupdate.AgentsScheduleImmediate {
-		return true, nil
-	}
-
-	// Else we follow the regular schedule and answer based on the agent group state
-	group, err := getGroup(rollout, groupName)
-	if err != nil {
-		return false, trace.Wrap(err, "getting group %q", groupName)
-	}
-
-	switch group.GetState() {
-	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:
-		return false, nil
-	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
-		return true, nil
-	case autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
-		return rollout.GetSpec().GetStrategy() == autoupdate.AgentsStrategyHaltOnError, nil
-	default:
-		return false, trace.NotImplemented("Unsupported group state %q", group.GetState())
-	}
-}
-
-// getGroup returns the agent rollout group the requesting agent belongs to.
-// If a group matches the agent-provided group name, this group is returned.
-// Else the default group is returned. The default group currently is the last
-// one. This might change in the future.
-func getGroup(
-	rollout *autoupdatepb.AutoUpdateAgentRollout,
-	groupName string,
-) (*autoupdatepb.AutoUpdateAgentRolloutStatusGroup, error) {
-	groups := rollout.GetStatus().GetGroups()
-	if len(groups) == 0 {
-		return nil, trace.BadParameter("no groups found")
-	}
-
-	// Try to find a group with our name
-	for _, group := range groups {
-		if group.Name == groupName {
-			return group, nil
-		}
-	}
-
-	// Fallback to the default group (currently the last one but this might change).
-	return groups[len(groups)-1], nil
-}
-
-// getVersionFromChannel gets the target version from the RFD109 channels.
-func getVersionFromChannel(ctx context.Context, channels automaticupgrades.Channels, groupName string) (version *semver.Version, err error) {
-	if channel, ok := channels[groupName]; ok {
-		return channel.GetVersion(ctx)
-	}
-	return channels.DefaultVersion(ctx)
-}
-
-// getTriggerFromWindowThenChannel gets the target version from the RFD109 maintenance window and channels.
-func (h *Handler) getTriggerFromWindowThenChannel(ctx context.Context, groupName string) (bool, error) {
-	// Caching the CMC for 60 seconds because this resource is cached neither by the auth nor the proxy.
-	// And this function can be accessed via unauthenticated endpoints.
-	cmc, err := utils.FnCacheGet(ctx, h.clusterMaintenanceConfigCache, "cmc", func(ctx context.Context) (types.ClusterMaintenanceConfig, error) {
-		return h.cfg.ProxyClient.GetClusterMaintenanceConfig(ctx)
-	})
-
-	// If there's no CMC or we failed to get it, we fallback directly to the channel
-	if err != nil {
-		if !trace.IsNotFound(err) {
-			h.logger.WarnContext(ctx, "Failed to get cluster maintenance config", "error", err)
-		}
-		return getTriggerFromChannel(ctx, h.cfg.AutomaticUpgradesChannels, groupName)
-	}
-
-	// If we have a CMC, we check if the window is active, else we just check if the update is critical.
-	if cmc.WithinUpgradeWindow(h.clock.Now()) {
-		return true, nil
-	}
-	return getTriggerFromChannel(ctx, h.cfg.AutomaticUpgradesChannels, groupName)
-}
-
-// getTriggerFromWindowThenChannel gets the target version from the RFD109 channels.
-func getTriggerFromChannel(ctx context.Context, channels automaticupgrades.Channels, groupName string) (bool, error) {
-	if channel, ok := channels[groupName]; ok {
-		return channel.GetCritical(ctx)
-	}
-	defaultChannel, err := channels.DefaultChannel()
-	if err != nil {
-		return false, trace.Wrap(err, "creating new default channel")
-	}
-	return defaultChannel.GetCritical(ctx)
-}
diff --git a/lib/web/autoupdate_common_test.go b/lib/web/autoupdate_common_test.go
deleted file mode 100644
index b84070d115f1d..0000000000000
--- a/lib/web/autoupdate_common_test.go
+++ /dev/null
@@ -1,807 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package web
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/coreos/go-semver/semver"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/autoupdate"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/automaticupgrades"
-	"github.com/gravitational/teleport/lib/automaticupgrades/constants"
-	"github.com/gravitational/teleport/lib/automaticupgrades/version"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-const (
-	testVersionHigh = "2.3.4"
-	testVersionLow  = "2.0.4"
-)
-
-// fakeRolloutAccessPoint allows us to mock the ProxyAccessPoint in autoupdate
-// tests.
-type fakeRolloutAccessPoint struct {
-	authclient.ProxyAccessPoint
-
-	rollout *autoupdatepb.AutoUpdateAgentRollout
-	err     error
-}
-
-func (ap *fakeRolloutAccessPoint) GetAutoUpdateAgentRollout(_ context.Context) (*autoupdatepb.AutoUpdateAgentRollout, error) {
-	return ap.rollout, ap.err
-}
-
-// fakeRolloutAccessPoint allows us to mock the proxy's auth client in autoupdate
-// tests.
-type fakeCMCAuthClient struct {
-	authclient.ClientI
-
-	cmc types.ClusterMaintenanceConfig
-	err error
-}
-
-func (c *fakeCMCAuthClient) GetClusterMaintenanceConfig(_ context.Context) (types.ClusterMaintenanceConfig, error) {
-	return c.cmc, c.err
-}
-
-func TestAutoUpdateAgentVersion(t *testing.T) {
-	t.Parallel()
-	groupName := "test-group"
-	ctx := context.Background()
-
-	// brokenChannelUpstream is a buggy upstream version server.
-	// This allows us to craft version channels returning errors.
-	brokenChannelUpstream := httptest.NewServer(
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusBadRequest)
-		}))
-	t.Cleanup(brokenChannelUpstream.Close)
-
-	tests := []struct {
-		name            string
-		rollout         *autoupdatepb.AutoUpdateAgentRollout
-		rolloutErr      error
-		channel         *automaticupgrades.Channel
-		expectedVersion *semver.Version
-		expectError     require.ErrorAssertionFunc
-	}{
-		{
-			name: "version is looked up from rollout if it is here",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
-					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-					TargetVersion:  testVersionHigh,
-					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
-			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
-			expectError:     require.NoError,
-			expectedVersion: semver.Must(version.EnsureSemver(testVersionHigh)),
-		},
-		{
-			name:            "version is looked up from channel if rollout is not here",
-			rolloutErr:      trace.NotFound("rollout is not here"),
-			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
-			expectError:     require.NoError,
-			expectedVersion: semver.Must(version.EnsureSemver(testVersionLow)),
-		},
-		{
-			name:       "hard error getting rollout should not fallback to version channels",
-			rolloutErr: trace.AccessDenied("something is very broken"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-			},
-			expectError: require.Error,
-		},
-		{
-			name:        "no rollout, error checking channel",
-			rolloutErr:  trace.NotFound("rollout is not here"),
-			channel:     &automaticupgrades.Channel{ForwardURL: brokenChannelUpstream.URL},
-			expectError: require.Error,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test setup: building the channel, mock client, and handler with test config.
-			require.NoError(t, tt.channel.CheckAndSetDefaults())
-			h := &Handler{
-				cfg: Config{
-					AccessPoint: &fakeRolloutAccessPoint{
-						rollout: tt.rollout,
-						err:     tt.rolloutErr,
-					},
-					AutomaticUpgradesChannels: map[string]*automaticupgrades.Channel{
-						groupName: tt.channel,
-					},
-				},
-			}
-
-			// Test execution
-			result, err := h.autoUpdateAgentVersion(ctx, groupName, "")
-			tt.expectError(t, err)
-			require.Equal(t, tt.expectedVersion, result)
-		})
-	}
-}
-
-// TestAutoUpdateAgentShouldUpdate also accidentally tests getTriggerFromWindowThenChannel.
-func TestAutoUpdateAgentShouldUpdate(t *testing.T) {
-	t.Parallel()
-
-	groupName := "test-group"
-	ctx := context.Background()
-
-	// brokenChannelUpstream is a buggy upstream version server.
-	// This allows us to craft version channels returning errors.
-	brokenChannelUpstream := httptest.NewServer(
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusBadRequest)
-		}))
-	t.Cleanup(brokenChannelUpstream.Close)
-
-	cacheClock := clockwork.NewFakeClock()
-	cmcCache, err := utils.NewFnCache(utils.FnCacheConfig{
-		TTL:         findEndpointCacheTTL,
-		Clock:       cacheClock,
-		Context:     ctx,
-		ReloadOnErr: false,
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		cmcCache.Shutdown(ctx)
-	})
-
-	// We don't use the cache clock because we are advancing it to invalidate the cmc cache and
-	// this would interfere with the test logic
-	clock := clockwork.NewFakeClock()
-	activeUpgradeWindow := types.AgentUpgradeWindow{UTCStartHour: uint32(clock.Now().Hour())}
-	inactiveUpgradeWindow := types.AgentUpgradeWindow{UTCStartHour: uint32(clock.Now().Add(2 * time.Hour).Hour())}
-	tests := []struct {
-		name            string
-		rollout         *autoupdatepb.AutoUpdateAgentRollout
-		rolloutErr      error
-		channel         *automaticupgrades.Channel
-		upgradeWindow   types.AgentUpgradeWindow
-		cmcErr          error
-		windowLookup    bool
-		expectedTrigger bool
-		expectError     require.ErrorAssertionFunc
-	}{
-		{
-			name: "trigger is looked up from rollout if it is here, trigger firing",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
-					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-					TargetVersion:  testVersionHigh,
-					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
-			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
-			expectError:     require.NoError,
-			expectedTrigger: true,
-		},
-		{
-			name: "trigger is looked up from rollout if it is here, trigger not firing",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
-					AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
-					TargetVersion:  testVersionHigh,
-					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
-			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
-			expectError:     require.NoError,
-			expectedTrigger: false,
-		},
-		{
-			name:       "trigger is looked up from channel if rollout is not here and window lookup is disabled, trigger not firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      false,
-			},
-			expectError:     require.NoError,
-			expectedTrigger: false,
-		},
-		{
-			name:       "trigger is looked up from channel if rollout is not here and window lookup is disabled, trigger firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      true,
-			},
-			expectError:     require.NoError,
-			expectedTrigger: true,
-		},
-		{
-			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      false,
-			},
-			upgradeWindow:   activeUpgradeWindow,
-			windowLookup:    true,
-			expectError:     require.NoError,
-			expectedTrigger: true,
-		},
-		{
-			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc not firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      false,
-			},
-			upgradeWindow:   inactiveUpgradeWindow,
-			windowLookup:    true,
-			expectError:     require.NoError,
-			expectedTrigger: false,
-		},
-		{
-			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, cmc not firing but channel firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      true,
-			},
-			upgradeWindow:   inactiveUpgradeWindow,
-			windowLookup:    true,
-			expectError:     require.NoError,
-			expectedTrigger: true,
-		},
-		{
-			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, no cmc and channel not firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      false,
-			},
-			cmcErr:          trace.NotFound("no cmc for this cluster"),
-			windowLookup:    true,
-			expectError:     require.NoError,
-			expectedTrigger: false,
-		},
-		{
-			name:       "trigger is looked up from cmc, then channel if rollout is not here and window lookup is enabled, no cmc and channel firing",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-				Critical:      true,
-			},
-			cmcErr:          trace.NotFound("no cmc for this cluster"),
-			windowLookup:    true,
-			expectError:     require.NoError,
-			expectedTrigger: true,
-		},
-		{
-			name:       "hard error getting rollout should not fallback to RFD109 trigger",
-			rolloutErr: trace.AccessDenied("something is very broken"),
-			channel: &automaticupgrades.Channel{
-				StaticVersion: testVersionLow,
-			},
-			expectError: require.Error,
-		},
-		{
-			name:       "no rollout, error checking channel",
-			rolloutErr: trace.NotFound("rollout is not here"),
-			channel: &automaticupgrades.Channel{
-				ForwardURL: brokenChannelUpstream.URL,
-			},
-			expectError: require.Error,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test setup: building the channel, mock clients, and handler with test config.
-			cmc := types.NewClusterMaintenanceConfig()
-			cmc.SetAgentUpgradeWindow(tt.upgradeWindow)
-			require.NoError(t, tt.channel.CheckAndSetDefaults())
-			// Advance cache clock to expire cached cmc
-			cacheClock.Advance(2 * findEndpointCacheTTL)
-			h := &Handler{
-				cfg: Config{
-					AccessPoint: &fakeRolloutAccessPoint{
-						rollout: tt.rollout,
-						err:     tt.rolloutErr,
-					},
-					ProxyClient: &fakeCMCAuthClient{
-						cmc: cmc,
-						err: tt.cmcErr,
-					},
-					AutomaticUpgradesChannels: map[string]*automaticupgrades.Channel{
-						groupName: tt.channel,
-					},
-				},
-				clock:                         clock,
-				clusterMaintenanceConfigCache: cmcCache,
-			}
-
-			// Test execution
-			result, err := h.autoUpdateAgentShouldUpdate(ctx, groupName, "", tt.windowLookup)
-			tt.expectError(t, err)
-			require.Equal(t, tt.expectedTrigger, result)
-		})
-	}
-}
-
-func TestGetVersionFromRollout(t *testing.T) {
-	t.Parallel()
-	groupName := "test-group"
-
-	// This test matrix is written based on:
-	// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
-	latestAllTheTime := map[autoupdatepb.AutoUpdateAgentGroupState]string{
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  testVersionHigh,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       testVersionHigh,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     testVersionHigh,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: testVersionHigh,
-	}
-
-	activeDoneOnly := map[autoupdatepb.AutoUpdateAgentGroupState]string{
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  testVersionLow,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       testVersionHigh,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     testVersionHigh,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: testVersionLow,
-	}
-
-	tests := map[string]map[string]map[autoupdatepb.AutoUpdateAgentGroupState]string{
-		autoupdate.AgentsUpdateModeDisabled: {
-			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
-			autoupdate.AgentsScheduleRegular:   latestAllTheTime,
-		},
-		autoupdate.AgentsUpdateModeSuspended: {
-			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
-			autoupdate.AgentsScheduleRegular:   activeDoneOnly,
-		},
-		autoupdate.AgentsUpdateModeEnabled: {
-			autoupdate.AgentsScheduleImmediate: latestAllTheTime,
-			autoupdate.AgentsScheduleRegular:   activeDoneOnly,
-		},
-	}
-	for mode, scheduleCases := range tests {
-		for schedule, stateCases := range scheduleCases {
-			for state, expectedVersion := range stateCases {
-				t.Run(fmt.Sprintf("%s/%s/%s", mode, schedule, state), func(t *testing.T) {
-					expectedSemVersion, err := version.EnsureSemver(expectedVersion)
-					require.NoError(t, err)
-
-					rollout := &autoupdatepb.AutoUpdateAgentRollout{
-						Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
-							StartVersion:   testVersionLow,
-							TargetVersion:  testVersionHigh,
-							Schedule:       schedule,
-							AutoupdateMode: mode,
-							// Strategy does not affect which version are served
-							Strategy: autoupdate.AgentsStrategyTimeBased,
-						},
-						Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
-							Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-								{
-									Name:  groupName,
-									State: state,
-								},
-							},
-						},
-					}
-					version, err := getVersionFromRollout(rollout, groupName, "")
-					require.NoError(t, err)
-					require.Equal(t, expectedSemVersion, version)
-				})
-			}
-		}
-	}
-}
-
-func TestGetTriggerFromRollout(t *testing.T) {
-	t.Parallel()
-	groupName := "test-group"
-
-	// This test matrix is written based on:
-	// https://github.com/gravitational/teleport/blob/master/rfd/0184-agent-auto-updates.md#rollout-status-disabled
-	neverUpdate := map[autoupdatepb.AutoUpdateAgentGroupState]bool{
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     false,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: false,
-	}
-	alwaysUpdate := map[autoupdatepb.AutoUpdateAgentGroupState]bool{
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  true,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
-		autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
-	}
-
-	tests := map[string]map[string]map[string]map[autoupdatepb.AutoUpdateAgentGroupState]bool{
-		autoupdate.AgentsUpdateModeDisabled: {
-			autoupdate.AgentsStrategyTimeBased: {
-				autoupdate.AgentsScheduleImmediate: neverUpdate,
-				autoupdate.AgentsScheduleRegular:   neverUpdate,
-			},
-			autoupdate.AgentsStrategyHaltOnError: {
-				autoupdate.AgentsScheduleImmediate: neverUpdate,
-				autoupdate.AgentsScheduleRegular:   neverUpdate,
-			},
-		},
-		autoupdate.AgentsUpdateModeSuspended: {
-			autoupdate.AgentsStrategyTimeBased: {
-				autoupdate.AgentsScheduleImmediate: neverUpdate,
-				autoupdate.AgentsScheduleRegular:   neverUpdate,
-			},
-			autoupdate.AgentsStrategyHaltOnError: {
-				autoupdate.AgentsScheduleImmediate: neverUpdate,
-				autoupdate.AgentsScheduleRegular:   neverUpdate,
-			},
-		},
-		autoupdate.AgentsUpdateModeEnabled: {
-			autoupdate.AgentsStrategyTimeBased: {
-				autoupdate.AgentsScheduleImmediate: alwaysUpdate,
-				autoupdate.AgentsScheduleRegular: {
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       false,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
-				},
-			},
-			autoupdate.AgentsStrategyHaltOnError: {
-				autoupdate.AgentsScheduleImmediate: alwaysUpdate,
-				autoupdate.AgentsScheduleRegular: {
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:  false,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:       true,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE:     true,
-					autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK: true,
-				},
-			},
-		},
-	}
-	for mode, strategyCases := range tests {
-		for strategy, scheduleCases := range strategyCases {
-			for schedule, stateCases := range scheduleCases {
-				for state, expectedTrigger := range stateCases {
-					t.Run(fmt.Sprintf("%s/%s/%s/%s", mode, strategy, schedule, state), func(t *testing.T) {
-						rollout := &autoupdatepb.AutoUpdateAgentRollout{
-							Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
-								StartVersion:   testVersionLow,
-								TargetVersion:  testVersionHigh,
-								Schedule:       schedule,
-								AutoupdateMode: mode,
-								Strategy:       strategy,
-							},
-							Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
-								Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-									{
-										Name:  groupName,
-										State: state,
-									},
-								},
-							},
-						}
-						shouldUpdate, err := getTriggerFromRollout(rollout, groupName, "")
-						require.NoError(t, err)
-						require.Equal(t, expectedTrigger, shouldUpdate)
-					})
-				}
-			}
-		}
-	}
-}
-
-func TestGetGroup(t *testing.T) {
-	groupName := "test-group"
-	t.Parallel()
-	tests := []struct {
-		name           string
-		rollout        *autoupdatepb.AutoUpdateAgentRollout
-		expectedResult *autoupdatepb.AutoUpdateAgentRolloutStatusGroup
-		expectError    require.ErrorAssertionFunc
-	}{
-		{
-			name:        "nil",
-			expectError: require.Error,
-		},
-		{
-			name:        "nil status",
-			rollout:     &autoupdatepb.AutoUpdateAgentRollout{},
-			expectError: require.Error,
-		},
-		{
-			name:        "nil status groups",
-			rollout:     &autoupdatepb.AutoUpdateAgentRollout{Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{}},
-			expectError: require.Error,
-		},
-		{
-			name: "empty status groups",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
-					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{},
-				},
-			},
-			expectError: require.Error,
-		},
-		{
-			name: "group matching name",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
-					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{Name: "foo", State: 1},
-						{Name: "bar", State: 1},
-						{Name: groupName, State: 2},
-						{Name: "baz", State: 1},
-					},
-				},
-			},
-			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				Name:  groupName,
-				State: 2,
-			},
-			expectError: require.NoError,
-		},
-		{
-			name: "no group matching name, should fallback to default",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
-					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{Name: "foo", State: 1},
-						{Name: "bar", State: 1},
-						{Name: "baz", State: 1},
-					},
-				},
-			},
-			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				Name:  "baz",
-				State: 1,
-			},
-			expectError: require.NoError,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := getGroup(tt.rollout, groupName)
-			tt.expectError(t, err)
-			require.Equal(t, tt.expectedResult, result)
-		})
-	}
-}
-
-type mockRFD109VersionServer struct {
-	t        *testing.T
-	channels map[string]channelStub
-}
-
-type channelStub struct {
-	// with our without the leading "v"
-	version  string
-	critical bool
-	fail     bool
-}
-
-func (m *mockRFD109VersionServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	var path string
-	var writeResp func(w http.ResponseWriter, stub channelStub) error
-
-	switch {
-	case strings.HasSuffix(r.URL.Path, constants.VersionPath):
-		path = strings.Trim(strings.TrimSuffix(r.URL.Path, constants.VersionPath), "/")
-		writeResp = func(w http.ResponseWriter, stub channelStub) error {
-			_, err := w.Write([]byte(stub.version))
-			return err
-		}
-	case strings.HasSuffix(r.URL.Path, constants.MaintenancePath):
-		path = strings.Trim(strings.TrimSuffix(r.URL.Path, constants.MaintenancePath), "/")
-		writeResp = func(w http.ResponseWriter, stub channelStub) error {
-			response := "no"
-			if stub.critical {
-				response = "yes"
-			}
-			_, err := w.Write([]byte(response))
-			return err
-		}
-	default:
-		assert.Fail(m.t, "unsupported path %q", r.URL.Path)
-		w.WriteHeader(http.StatusNotFound)
-		return
-	}
-
-	channel, ok := m.channels[path]
-	if !ok {
-		w.WriteHeader(http.StatusNotFound)
-		assert.Fail(m.t, "channel %q not found", path)
-		return
-	}
-	if channel.fail {
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	assert.NoError(m.t, writeResp(w, channel), "failed to write response")
-}
-
-func TestGetVersionFromChannel(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	channelName := "test-channel"
-
-	mock := mockRFD109VersionServer{
-		t: t,
-		channels: map[string]channelStub{
-			"broken":            {fail: true},
-			"with-leading-v":    {version: "v" + testVersionHigh},
-			"without-leading-v": {version: testVersionHigh},
-			"low":               {version: testVersionLow},
-		},
-	}
-	srv := httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
-	t.Cleanup(srv.Close)
-
-	testVersion, err := version.EnsureSemver(testVersionHigh)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name           string
-		channels       automaticupgrades.Channels
-		expectedResult *semver.Version
-		expectError    require.ErrorAssertionFunc
-	}{
-		{
-			name: "channel with leading v",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/with-leading-v"},
-				"default":   {ForwardURL: srv.URL + "/low"},
-			},
-			expectedResult: testVersion,
-			expectError:    require.NoError,
-		},
-		{
-			name: "channel without leading v",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/without-leading-v"},
-				"default":   {ForwardURL: srv.URL + "/low"},
-			},
-			expectedResult: testVersion,
-			expectError:    require.NoError,
-		},
-		{
-			name: "fallback to default with leading v",
-			channels: automaticupgrades.Channels{
-				"default": {ForwardURL: srv.URL + "/with-leading-v"},
-			},
-			expectedResult: testVersion,
-			expectError:    require.NoError,
-		},
-		{
-			name: "fallback to default without leading v",
-			channels: automaticupgrades.Channels{
-				"default": {ForwardURL: srv.URL + "/without-leading-v"},
-			},
-			expectedResult: testVersion,
-			expectError:    require.NoError,
-		},
-		{
-			name: "broken channel",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/broken"},
-				"default":   {ForwardURL: srv.URL + "/without-leading-v"},
-			},
-			expectError: require.Error,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test setup
-			require.NoError(t, tt.channels.CheckAndSetDefaults())
-
-			// Test execution
-			result, err := getVersionFromChannel(ctx, tt.channels, channelName)
-			tt.expectError(t, err)
-			require.Equal(t, tt.expectedResult, result)
-		})
-	}
-}
-
-func TestGetTriggerFromChannel(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	channelName := "test-channel"
-
-	mock := mockRFD109VersionServer{
-		t: t,
-		channels: map[string]channelStub{
-			"broken":       {fail: true},
-			"critical":     {critical: true},
-			"non-critical": {critical: false},
-		},
-	}
-	srv := httptest.NewServer(http.HandlerFunc(mock.ServeHTTP))
-	t.Cleanup(srv.Close)
-
-	tests := []struct {
-		name           string
-		channels       automaticupgrades.Channels
-		expectedResult bool
-		expectError    require.ErrorAssertionFunc
-	}{
-		{
-			name: "critical channel",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/critical"},
-				"default":   {ForwardURL: srv.URL + "/non-critical"},
-			},
-			expectedResult: true,
-			expectError:    require.NoError,
-		},
-		{
-			name: "non-critical channel",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/non-critical"},
-				"default":   {ForwardURL: srv.URL + "/critical"},
-			},
-			expectedResult: false,
-			expectError:    require.NoError,
-		},
-		{
-			name: "fallback to default which is critical",
-			channels: automaticupgrades.Channels{
-				"default": {ForwardURL: srv.URL + "/critical"},
-			},
-			expectedResult: true,
-			expectError:    require.NoError,
-		},
-		{
-			name: "fallback to default which is non-critical",
-			channels: automaticupgrades.Channels{
-				"default": {ForwardURL: srv.URL + "/non-critical"},
-			},
-			expectedResult: false,
-			expectError:    require.NoError,
-		},
-		{
-			name: "broken channel",
-			channels: automaticupgrades.Channels{
-				channelName: {ForwardURL: srv.URL + "/broken"},
-				"default":   {ForwardURL: srv.URL + "/critical"},
-			},
-			expectError: require.Error,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test setup
-			require.NoError(t, tt.channels.CheckAndSetDefaults())
-
-			// Test execution
-			result, err := getTriggerFromChannel(ctx, tt.channels, channelName)
-			tt.expectError(t, err)
-			require.Equal(t, tt.expectedResult, result)
-		})
-	}
-}
diff --git a/lib/web/autoupdate_rfd109.go b/lib/web/autoupdate_rfd109.go
index 4817493e995ec..b4ea460aeaa14 100644
--- a/lib/web/autoupdate_rfd109.go
+++ b/lib/web/autoupdate_rfd109.go
@@ -77,7 +77,7 @@ func (h *Handler) automaticUpgradesVersion109(w http.ResponseWriter, r *http.Req
 	ctx, cancel := context.WithTimeout(r.Context(), defaultChannelTimeout)
 	defer cancel()
 
-	targetVersion, err := h.autoUpdateAgentVersion(ctx, channelName, "" /* updater UUID */)
+	targetVersion, err := h.autoUpdateResolver.GetVersion(ctx, channelName, "" /* updater UUID */)
 	if err != nil {
 		// If the error is that the upstream channel has no version
 		// We gracefully handle by serving "none"
@@ -103,7 +103,7 @@ func (h *Handler) automaticUpgradesCritical109(w http.ResponseWriter, r *http.Re
 
 	// RFD109 agents already retrieve maintenance windows from the CMC, no need to
 	// do a maintenance window lookup for them.
-	critical, err := h.autoUpdateAgentShouldUpdate(ctx, channelName, "" /* updater UUID */, false /* window lookup */)
+	critical, err := h.autoUpdateResolver.ShouldUpdate(ctx, channelName, "" /* updater UUID */, false /* window lookup */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/autoupdate_rfd184.go b/lib/web/autoupdate_rfd184.go
index d8d275f4b2589..4c5999f975bb6 100644
--- a/lib/web/autoupdate_rfd184.go
+++ b/lib/web/autoupdate_rfd184.go
@@ -48,7 +48,7 @@ func (h *Handler) automaticUpdateSettings184(ctx context.Context, group, updater
 	}
 
 	// Agent auto updates section.
-	agentVersion, err := h.autoUpdateAgentVersion(ctx, group, updaterUUID)
+	agentVersion, err := h.autoUpdateResolver.GetVersion(ctx, group, updaterUUID)
 	if err != nil {
 		h.logger.ErrorContext(ctx, "failed to resolve AgentVersion", "error", err)
 		// Defaulting to current version
@@ -57,7 +57,7 @@ func (h *Handler) automaticUpdateSettings184(ctx context.Context, group, updater
 	// If the source of truth is RFD 109 configuration (channels + CMC) we must emulate the
 	// RFD109 agent maintenance window behavior by looking up the CMC and checking if
 	// we are in a maintenance window.
-	shouldUpdate, err := h.autoUpdateAgentShouldUpdate(ctx, group, updaterUUID, true /* window lookup */)
+	shouldUpdate, err := h.autoUpdateResolver.ShouldUpdate(ctx, group, updaterUUID, true /* window lookup */)
 	if err != nil {
 		h.logger.ErrorContext(ctx, "failed to resolve AgentAutoUpdate", "error", err)
 		// Failing open
diff --git a/lib/web/brotlihandler.go b/lib/web/brotlihandler.go
new file mode 100644
index 0000000000000..67b0ecd8f53cd
--- /dev/null
+++ b/lib/web/brotlihandler.go
@@ -0,0 +1,69 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"io"
+	"mime"
+	"net/http"
+	"path"
+	"slices"
+	"strings"
+)
+
+var compressedFileExtensions = []string{
+	".js",
+	".svg",
+	".wasm",
+}
+
+// makeBrotliHandler serves pre-compressed .br files for supported file types.
+func makeBrotliHandler(handler http.Handler, fs http.FileSystem) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ext := path.Ext(r.URL.Path)
+		isRequestForCompressedFile := slices.Contains(compressedFileExtensions, ext)
+		clientAcceptsBrotli := strings.Contains(r.Header.Get("Accept-Encoding"), "br")
+		if !isRequestForCompressedFile || !clientAcceptsBrotli {
+			handler.ServeHTTP(w, r)
+			return
+		}
+
+		brPath := r.URL.Path + ".br"
+		brFile, err := fs.Open(brPath)
+		if err != nil {
+			handler.ServeHTTP(w, r)
+			return
+		}
+		defer brFile.Close()
+
+		contentType := mime.TypeByExtension(ext)
+		if contentType == "" {
+			contentType = "application/octet-stream" // same default as http.DetectContentType
+		}
+
+		w.Header().Set("Content-Encoding", "br")
+		w.Header().Set("Content-Type", contentType)
+
+		if r.Method == http.MethodHead {
+			return
+		}
+
+		io.Copy(w, brFile)
+	})
+}
diff --git a/lib/web/connection_diagnostic.go b/lib/web/connection_diagnostic.go
index 69315be7ce470..b2cf85468697c 100644
--- a/lib/web/connection_diagnostic.go
+++ b/lib/web/connection_diagnostic.go
@@ -31,8 +31,8 @@ import (
 )
 
 // getConnectionDiagnostic returns a connection diagnostic connection diagnostics.
-func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -52,7 +52,7 @@ func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request
 }
 
 // diagnoseConnection executes and returns a connection diagnostic.
-func (h *Handler) diagnoseConnection(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) diagnoseConnection(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	req := conntest.TestConnectionRequest{}
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -62,7 +62,7 @@ func (h *Handler) diagnoseConnection(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.Wrap(err)
 	}
 
-	userClt, err := sctx.GetUserClient(r.Context(), site)
+	userClt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/databases.go b/lib/web/databases.go
index 461fff60fc43c..2d9f77a2b75a8 100644
--- a/lib/web/databases.go
+++ b/lib/web/databases.go
@@ -40,15 +40,19 @@ import (
 	"github.com/julienschmidt/httprouter"
 	oteltrace "go.opentelemetry.io/otel/trace"
 
+	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/tlsutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/gcp"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
@@ -118,7 +122,7 @@ func (r *createOrOverwriteDatabaseRequest) checkAndSetDefaults() error {
 }
 
 // handleDatabaseCreate creates a database's metadata.
-func (h *Handler) handleDatabaseCreateOrOverwrite(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabaseCreateOrOverwrite(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req *createOrOverwriteDatabaseRequest
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -133,7 +137,7 @@ func (h *Handler) handleDatabaseCreateOrOverwrite(w http.ResponseWriter, r *http
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -199,7 +203,7 @@ func (r *updateDatabaseRequest) checkAndSetDefaults() error {
 }
 
 // handleDatabaseUpdate updates the database
-func (h *Handler) handleDatabasePartialUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabasePartialUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("a database name is required")
@@ -214,7 +218,7 @@ func (h *Handler) handleDatabasePartialUpdate(w http.ResponseWriter, r *http.Req
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -292,22 +296,22 @@ type databaseIAMPolicyAWS struct {
 }
 
 // handleDatabaseGetIAMPolicy returns the required IAM policy for database.
-func (h *Handler) handleDatabaseGetIAMPolicy(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabaseGetIAMPolicy(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("missing database name")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	dbServer, err := fetchDatabaseServerByDatabaseName(r.Context(), clt, r, databaseName)
+	dbServers, err := fetchDatabaseServersWithName(r.Context(), clt, r, databaseName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	database := dbServer.GetDatabase()
+	database := dbServers[0].GetDatabase()
 
 	switch {
 	case database.IsAWSHosted():
@@ -348,7 +352,10 @@ func (h *Handler) sqlServerConfigureADScriptHandle(w http.ResponseWriter, r *htt
 		return "", trace.BadParameter("invalid token")
 	}
 
-	proxyServers, err := h.GetProxyClient().GetProxies()
+	proxyServers, err := clientutils.CollectWithFallback(r.Context(), h.GetProxyClient().ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return h.GetProxyClient().GetProxies()
+	})
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -407,11 +414,11 @@ func (h *Handler) sqlServerConfigureADScriptHandle(w http.ResponseWriter, r *htt
 }
 
 func (h *Handler) dbConnect(
-	w http.ResponseWriter,
+	_ http.ResponseWriter,
 	r *http.Request,
-	p httprouter.Params,
+	_ httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) (interface{}, error) {
 	// Create a context for signaling when the terminal session is over and
@@ -421,6 +428,20 @@ func (h *Handler) dbConnect(
 	defer cancel()
 	h.logger.DebugContext(ctx, "Received database interactive connection")
 
+	var term session.TerminalParams
+	q := r.URL.Query()
+	params := q.Get("params")
+	if params != "" {
+		var termReq TerminalRequest
+		if err := json.Unmarshal([]byte(params), &termReq); err != nil {
+			h.logger.DebugContext(ctx, "Failed to unmarshal terminal request",
+				"error", err,
+			)
+		} else {
+			term = termReq.Term
+		}
+	}
+
 	req, err := readDatabaseSessionRequest(ws)
 	if err != nil {
 		if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) || terminal.IsOKWebsocketCloseError(trace.Unwrap(err)) {
@@ -469,32 +490,51 @@ func (h *Handler) dbConnect(
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	databases, err := apiclient.GetAllResources[types.DatabaseServer](ctx, clt, &proto.ListResourcesRequest{
+		Namespace:           apidefaults.Namespace,
+		ResourceType:        types.KindDatabaseServer,
+		PredicateExpression: fmt.Sprintf(`name == "%s"`, req.ServiceName),
+		Limit:               1,
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	var db types.Database
+	if len(databases) > 0 {
+		db = databases[0].GetDatabase()
+		adjusted, newUsername := gcp.AdjustDatabaseUsername(req.DatabaseUser, db)
+		if adjusted {
+			log.DebugContext(ctx, "Adding default project suffix for IAM principal", "original", req.DatabaseUser, "updated", newUsername)
+			req.DatabaseUser = newUsername
+		}
+	}
+
 	sess, err := newDatabaseInteractiveSession(ctx, databaseInteractiveSessionConfig{
 		log:               log,
 		req:               req,
 		ws:                ws,
 		sctx:              sctx,
-		site:              site,
+		site:              cluster,
 		clt:               clt,
 		keepAliveInterval: netConfig.GetKeepAliveInterval(),
 		registry:          h.cfg.DatabaseREPLRegistry,
 		alpnHandler:       h.cfg.ALPNHandler,
 		proxyAddr:         h.PublicProxyAddr(),
 		proxyHostCA:       proxyHostCA,
+		Term:              term,
 	})
 	if err != nil {
+		h.logger.ErrorContext(r.Context(), "Failed to create interactive database session", "error", err)
 		return nil, trace.Wrap(err)
 	}
 	defer sess.Close()
 
-	// Don't close the terminal stream on session error, as it would also
-	// cause the underlying connection to be closed. This will prevent the
-	// middleware from properly writing the error into the WebSocket connection.
 	if err := sess.Run(); err != nil {
 		log.ErrorContext(ctx, "Database interactive session exited with error", "error", err)
 		return nil, trace.Wrap(err)
@@ -566,13 +606,15 @@ type databaseInteractiveSessionConfig struct {
 	log               *slog.Logger
 	req               *DatabaseSessionRequest
 	sctx              *SessionContext
-	site              reversetunnelclient.RemoteSite
+	site              reversetunnelclient.Cluster
 	clt               authclient.ClientI
 	keepAliveInterval time.Duration
 	registry          dbrepl.REPLRegistry
 	alpnHandler       ConnectionHandler
 	proxyAddr         string
 	proxyHostCA       types.CertAuthority
+	// Term is the initial PTY size.
+	Term session.TerminalParams
 }
 
 func (c *databaseInteractiveSessionConfig) check() error {
@@ -603,15 +645,20 @@ func (c *databaseInteractiveSessionConfig) check() error {
 	if c.proxyHostCA == nil {
 		return trace.BadParameter("missing parameter proxyHostCA")
 	}
+	if err := c.Term.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
 	return nil
 }
 
 type databaseInteractiveSession struct {
 	databaseInteractiveSessionConfig
-	ctx      context.Context
-	replConn net.Conn
-	alpnConn net.Conn
-	stream   *terminal.Stream
+	ctx            context.Context
+	replConn       net.Conn
+	alpnConn       net.Conn
+	stream         *terminal.Stream
+	instance       dbrepl.REPLInstance
+	instanceReadyC chan struct{}
 }
 
 func newDatabaseInteractiveSession(ctx context.Context, cfg databaseInteractiveSessionConfig) (*databaseInteractiveSession, error) {
@@ -619,15 +666,36 @@ func newDatabaseInteractiveSession(ctx context.Context, cfg databaseInteractiveS
 		return nil, trace.Wrap(err)
 	}
 	replConn, alpnConn := net.Pipe()
-	return &databaseInteractiveSession{
+	sess := &databaseInteractiveSession{
 		ctx:                              ctx,
 		databaseInteractiveSessionConfig: cfg,
 		replConn:                         replConn,
 		alpnConn:                         alpnConn,
-		stream: terminal.NewStream(ctx, terminal.StreamConfig{
-			WS: cfg.ws,
-		}),
-	}, nil
+		instanceReadyC:                   make(chan struct{}),
+	}
+	sess.stream = terminal.NewStream(ctx, terminal.StreamConfig{
+		// Don't close the terminal stream on session error, as it would also
+		// cause the underlying connection to be closed. This will prevent the
+		// middleware from properly writing the error into the WebSocket connection.
+		// The middleware initiates the connection, forwards it to our
+		// handler, and always closes it.
+		WS: noopCloserWS{Conn: cfg.ws},
+		Handlers: map[string]terminal.WSHandlerFunc{
+			defaults.WebsocketResize: sess.handleWindowResize,
+		},
+	})
+	return sess, nil
+}
+
+// noopCloserWS prevents the stream from closing the websocket, to allow the
+// middleware to write any returned errors to the client before closing the
+// websocket.
+type noopCloserWS struct {
+	*websocket.Conn
+}
+
+func (c noopCloserWS) Close() error {
+	return nil
 }
 
 func (s *databaseInteractiveSession) Run() error {
@@ -640,13 +708,24 @@ func (s *databaseInteractiveSession) Run() error {
 		return trace.Wrap(err)
 	}
 
+	defaultCloseHandler := s.ws.CloseHandler()
+	s.ws.SetCloseHandler(func(code int, text string) error {
+		s.log.DebugContext(s.ctx, "web socket was closed by client - terminating session")
+		// Call the default close handler if one was set.
+		if defaultCloseHandler != nil {
+			err := defaultCloseHandler(code, text)
+			return trace.NewAggregate(err, s.Close())
+		}
+
+		return trace.Wrap(s.Close())
+	})
 	go startWSPingLoop(s.ctx, s.ws, s.keepAliveInterval, s.log, s.Close)
 
 	// Wrap s.alpnConn with real client addresses and pass it to the ALPN
 	// handler.
 	go func() {
 		alpnConnWithAddr := utils.NewConnWithAddr(s.alpnConn, s.ws.LocalAddr(), s.ws.RemoteAddr())
-		if err := s.alpnHandler(s.ctx, alpnConnWithAddr); !utils.IsOKNetworkError(err) {
+		if err := s.alpnHandler(s.ctx, alpnConnWithAddr); err != nil && !utils.IsOKNetworkError(err) {
 			s.log.ErrorContext(s.ctx, "ALPN handler for database interactive session failed", "error", err)
 		}
 	}()
@@ -659,6 +738,13 @@ func (s *databaseInteractiveSession) Run() error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	s.instance = repl
+	if err := repl.SetSize(s.Term.W, s.Term.H); err != nil {
+		s.log.ErrorContext(s.ctx, "Failed to set initial terminal window size",
+			"error", err,
+		)
+	}
+	close(s.instanceReadyC)
 
 	s.log.DebugContext(s.ctx, "Starting database interactive session")
 	if err := repl.Run(s.ctx); err != nil {
@@ -819,8 +905,37 @@ func (s *databaseInteractiveSession) sendSessionMetadata() error {
 	return nil
 }
 
-// fetchDatabaseServerByDatabaseName fetch a database with provided database name.
-func fetchDatabaseServerByDatabaseName(ctx context.Context, clt resourcesAPIGetter, r *http.Request, databaseName string) (types.DatabaseServer, error) {
+func (s *databaseInteractiveSession) waitForREPLInstance(ctx context.Context) (dbrepl.REPLInstance, error) {
+	select {
+	case <-ctx.Done():
+		return nil, trace.Wrap(ctx.Err())
+	case <-s.instanceReadyC:
+	}
+	if s.instance == nil {
+		return nil, trace.NotFound("missing database REPL instance")
+	}
+	return s.instance, nil
+}
+
+func (s *databaseInteractiveSession) handleWindowResize(ctx context.Context, envelope terminal.Envelope) {
+	repl, err := s.waitForREPLInstance(ctx)
+	if err != nil {
+		s.log.DebugContext(ctx, "Failed to get database REPL instance", "error", err)
+		return
+	}
+	if params, err := terminal.ParseWindowResizeMsg(envelope); err != nil {
+		s.log.WarnContext(ctx, "Failed to handle terminal window resize",
+			"error", err,
+		)
+	} else if err := repl.SetSize(params.W, params.H); err != nil {
+		s.log.ErrorContext(ctx, "Failed to set terminal window size",
+			"error", err,
+		)
+	}
+}
+
+// fetchDatabaseServersWithName fetches all database servers with provided database name.
+func fetchDatabaseServersWithName(ctx context.Context, clt resourcesAPIGetter, r *http.Request, databaseName string) ([]types.DatabaseServer, error) {
 	resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
 		Limit:               defaults.MaxIterationLimit,
 		ResourceType:        types.KindDatabaseServer,
@@ -835,13 +950,10 @@ func fetchDatabaseServerByDatabaseName(ctx context.Context, clt resourcesAPIGett
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	switch len(servers) {
-	case 0:
+	if len(servers) == 0 {
 		return nil, trace.NotFound("database %q not found", databaseName)
-	default:
-		return servers[0], nil
 	}
+	return servers, nil
 }
 
 func getNewDatabaseResource(req createOrOverwriteDatabaseRequest) (*types.DatabaseV3, error) {
diff --git a/lib/web/databases_test.go b/lib/web/databases_test.go
index e311ed80839e1..4dd58ed9a15ff 100644
--- a/lib/web/databases_test.go
+++ b/lib/web/databases_test.go
@@ -27,6 +27,7 @@ import (
 	"net/http"
 	"net/url"
 	"regexp"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -40,13 +41,16 @@ import (
 
 	authproto "github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/client"
 	dbrepl "github.com/gravitational/teleport/lib/client/db/repl"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/session"
 	dbiam "github.com/gravitational/teleport/lib/srv/db/common/iam"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/terminal"
@@ -604,7 +608,7 @@ func TestConnectDatabaseInteractiveSession(t *testing.T) {
 
 	// Use a mock REPL and modify it adding the additional configuration when
 	// it is set.
-	repl := &mockDatabaseREPL{message: "hello from repl"}
+	repl := &mockDatabaseREPL{message: "hello from repl", resizeC: make(chan session.TerminalParams, 1)}
 
 	s := newWebSuiteWithConfig(t, webSuiteConfig{
 		disableDiskBasedRecording: true,
@@ -628,8 +632,7 @@ func TestConnectDatabaseInteractiveSession(t *testing.T) {
 		alpnHandler: func(ctx context.Context, conn net.Conn) error {
 			// mock repl will not send any actual data. just verify the
 			// forwarded address.
-			defer conn.Close()
-			if conn.RemoteAddr().String() != forwardedClientAddr {
+			if !strings.Contains(conn.RemoteAddr().String(), forwardedClientAddr) {
 				return trace.CompareFailed("expecting address %v, got %v", forwardedClientAddr, conn.RemoteAddr())
 			}
 			return nil
@@ -659,61 +662,123 @@ func TestConnectDatabaseInteractiveSession(t *testing.T) {
 
 	_, err = s.server.Auth().UpsertDatabaseServer(ctx, mustCreateDatabaseServer(t, selfHosted))
 	require.NoError(t, err)
-
-	u := url.URL{
-		Host:   s.webServer.Listener.Addr().String(),
-		Scheme: client.WSS,
-		Path:   fmt.Sprintf("/v1/webapi/sites/%s/db/exec/ws", s.server.ClusterName()),
-	}
-
-	header := http.Header{}
-	header.Add(xForwardedForHeader, "1.2.3.4")
-	for _, cookie := range pack.cookies {
-		header.Add("Cookie", cookie.String())
-	}
-
-	dialer := websocket.Dialer{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-	}
-
-	ws, resp, err := dialer.DialContext(ctx, u.String(), header)
-	require.NoError(t, err)
-	defer ws.Close()
-	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
-	require.NoError(t, resp.Body.Close())
-	require.NoError(t, makeAuthReqOverWS(ws, pack.session.Token))
-
-	req := DatabaseSessionRequest{
-		Protocol:      databaseProtocol,
-		ServiceName:   databaseName,
-		DatabaseName:  "postgres",
-		DatabaseUser:  "postgres",
-		DatabaseRoles: []string{"reader"},
+	tests := []struct {
+		desc    string
+		replErr error
+	}{
+		{
+			desc: "success",
+		},
+		{
+			desc:    "errors are sent to the user",
+			replErr: trace.Errorf("database connection interrupted by unexpected llama crossing"),
+		},
 	}
-	encodedReq, err := json.Marshal(req)
-	require.NoError(t, err)
-	reqWebSocketMessage, err := proto.Marshal(&terminal.Envelope{
-		Version: defaults.WebsocketVersion,
-		Type:    defaults.WebsocketDatabaseSessionRequest,
-		Payload: string(encodedReq),
-	})
-	require.NoError(t, err)
-	require.NoError(t, ws.WriteMessage(websocket.BinaryMessage, reqWebSocketMessage))
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			repl.setError(test.replErr)
+			u := url.URL{
+				Host:   s.webServer.Listener.Addr().String(),
+				Scheme: client.WSS,
+				Path:   fmt.Sprintf("/v1/webapi/sites/%s/db/exec/ws", s.server.ClusterName()),
+			}
+			{
+				termReq := TerminalRequest{
+					Term: session.TerminalParams{
+						W: 42,
+						H: 24,
+					},
+				}
+				data, err := json.Marshal(termReq)
+				require.NoError(t, err)
+				q := u.Query()
+				q.Set("params", string(data))
+				u.RawQuery = q.Encode()
+			}
 
-	performMFACeremonyWS(t, ws, pack)
+			header := http.Header{}
+			header.Add(xForwardedForHeader, "1.2.3.4")
+			for _, cookie := range pack.cookies {
+				header.Add("Cookie", cookie.String())
+			}
 
-	// After the MFA is performed we expect the WebSocket to receive the
-	// session data information.
-	sessionData := receiveWSMessage(t, ws)
-	require.Equal(t, defaults.WebsocketSessionMetadata, sessionData.Type)
+			dialer := websocket.Dialer{
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+			}
 
-	// Assert data written by the REPL comes as raw data.
-	replResp := receiveWSMessage(t, ws)
-	require.Equal(t, defaults.WebsocketRaw, replResp.Type)
-	require.Equal(t, repl.message, replResp.Payload)
+			ws, resp, err := dialer.DialContext(ctx, u.String(), header)
+			require.NoError(t, err)
+			defer ws.Close()
+			require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+			require.NoError(t, resp.Body.Close())
+			require.NoError(t, makeAuthReqOverWS(ws, pack.session.Token))
+
+			req := DatabaseSessionRequest{
+				Protocol:      databaseProtocol,
+				ServiceName:   databaseName,
+				DatabaseName:  "postgres",
+				DatabaseUser:  "postgres",
+				DatabaseRoles: []string{"reader"},
+			}
+			encodedReq, err := json.Marshal(req)
+			require.NoError(t, err)
+			reqWebSocketMessage, err := proto.Marshal(&terminal.Envelope{
+				Version: defaults.WebsocketVersion,
+				Type:    defaults.WebsocketDatabaseSessionRequest,
+				Payload: string(encodedReq),
+			})
+			require.NoError(t, err)
+			require.NoError(t, ws.WriteMessage(websocket.BinaryMessage, reqWebSocketMessage))
+
+			performMFACeremonyWS(t, ws, pack)
+
+			// After the MFA is performed we expect the WebSocket to receive the
+			// session data information.
+			sessionData := receiveWSMessage(t, ws)
+			require.Equal(t, defaults.WebsocketSessionMetadata, sessionData.Type)
+
+			// Assert data written by the REPL comes as raw data.
+			replResp := receiveWSMessage(t, ws)
+			if test.replErr != nil {
+				require.Equal(t, defaults.WebsocketError, replResp.Type)
+				require.Equal(t, test.replErr.Error(), replResp.Payload)
+				require.NoError(t, ws.Close())
+				require.True(t, repl.getClosed(), "expected REPL instance to be closed after websocket.Conn is closed")
+				return
+			}
+			require.Equal(t, defaults.WebsocketRaw, replResp.Type)
+			require.Equal(t, repl.message, replResp.Payload)
 
-	require.NoError(t, ws.Close())
-	require.True(t, repl.getClosed(), "expected REPL instance to be closed after websocket.Conn is closed")
+			termParams := repl.waitForResize(t)
+			require.Equal(t, 42, termParams.W, "initial terminal width should have been set on REPL")
+			require.Equal(t, 24, termParams.H, "initial terminal height should have been set on REPL")
+			params, err := session.NewTerminalParamsFromInt(300, 120)
+			require.NoError(t, err)
+			{
+				data, err := json.Marshal(events.EventFields{
+					events.EventType:      events.ResizeEvent,
+					events.EventNamespace: apidefaults.Namespace,
+					events.SessionEventID: session.NewID(),
+					events.TerminalSize:   params.Serialize(),
+				})
+				require.NoError(t, err)
+				envelope := &terminal.Envelope{
+					Version: defaults.WebsocketVersion,
+					Type:    defaults.WebsocketResize,
+					Payload: string(data),
+				}
+				envelopeBytes, err := proto.Marshal(envelope)
+				require.NoError(t, err)
+				require.NoError(t, ws.WriteMessage(websocket.BinaryMessage, envelopeBytes))
+			}
+			termParams = repl.waitForResize(t)
+			require.Equal(t, 300, termParams.W, "terminal width should have been updated")
+			require.Equal(t, 120, termParams.H, "terminal height should have been updated")
+			err = ws.WriteControl(websocket.CloseMessage, nil, time.Now().Add(30*time.Second))
+			require.NoError(t, err)
+			require.True(t, repl.getClosed(), "expected REPL instance to be closed after websocket.Conn is closed")
+		})
+	}
 }
 
 func receiveWSMessage(t *testing.T, ws *websocket.Conn) terminal.Envelope {
@@ -779,17 +844,29 @@ func (m *mockDatabaseREPLRegistry) IsSupported(protocol string) bool {
 type mockDatabaseREPL struct {
 	mu      sync.Mutex
 	message string
+	err     error
 	cfg     *dbrepl.NewREPLConfig
+	resizeC chan session.TerminalParams
 	closed  bool
 }
 
+func (m *mockDatabaseREPL) setError(err error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.err = err
+}
+
 func (m *mockDatabaseREPL) Run(_ context.Context) error {
 	m.mu.Lock()
 	defer func() {
-		m.closeUnlocked()
+		m.closeLocked()
 		m.mu.Unlock()
 	}()
 
+	if m.err != nil {
+		return trace.Wrap(m.err)
+	}
+
 	if _, err := m.cfg.Client.Write([]byte(m.message)); err != nil {
 		return trace.Wrap(err)
 	}
@@ -801,6 +878,13 @@ func (m *mockDatabaseREPL) Run(_ context.Context) error {
 	return nil
 }
 
+func (m *mockDatabaseREPL) SetSize(width, height int) error {
+	if m.resizeC != nil {
+		m.resizeC <- session.TerminalParams{W: width, H: height}
+	}
+	return nil
+}
+
 func (m *mockDatabaseREPL) setConfig(c *dbrepl.NewREPLConfig) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -813,10 +897,22 @@ func (m *mockDatabaseREPL) getClosed() bool {
 	return m.closed
 }
 
-func (m *mockDatabaseREPL) closeUnlocked() {
+func (m *mockDatabaseREPL) closeLocked() {
+	m.cfg.Client.Close()
 	m.closed = true
 }
 
+func (m *mockDatabaseREPL) waitForResize(t *testing.T) session.TerminalParams {
+	t.Helper()
+	select {
+	case termParams := <-m.resizeC:
+		return termParams
+	case <-time.After(30 * time.Second):
+		require.FailNow(t, "timed out waiting for database REPL resize")
+		return session.TerminalParams{}
+	}
+}
+
 func mustCreateDatabaseServer(t *testing.T, db *types.DatabaseV3) types.DatabaseServer {
 	t.Helper()
 
diff --git a/lib/web/desktop.go b/lib/web/desktop.go
index 1b0e8c42aa298..94ce49747c0d1 100644
--- a/lib/web/desktop.go
+++ b/lib/web/desktop.go
@@ -25,6 +25,7 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"net/url"
 
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
@@ -37,9 +38,11 @@ import (
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/client/sso"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/desktop"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -55,7 +58,7 @@ func (h *Handler) desktopConnectHandle(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) (interface{}, error) {
 	desktopName := p.ByName("desktopName")
@@ -65,11 +68,11 @@ func (h *Handler) desktopConnectHandle(
 
 	log := sctx.cfg.Log.With(
 		"desktop_name", desktopName,
-		"cluster_name", site.GetName(),
+		"cluster_name", cluster.GetName(),
 	)
 	log.DebugContext(r.Context(), "New desktop access websocket connection")
 
-	if err := h.createDesktopConnection(r, desktopName, site.GetName(), log, sctx, site, ws); err != nil {
+	if err := h.createDesktopConnection(r, desktopName, cluster.GetName(), log, sctx, cluster, ws); err != nil {
 		// createDesktopConnection makes a best effort attempt to send an error to the user
 		// (via websocket) before terminating the connection. We log the error here, but
 		// return nil because our HTTP middleware will try to write the returned error in JSON
@@ -86,7 +89,7 @@ func (h *Handler) createDesktopConnection(
 	clusterName string,
 	log *slog.Logger,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) error {
 	defer ws.Close()
@@ -153,7 +156,7 @@ func (h *Handler) createDesktopConnection(
 		withheld = append(withheld, msg)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return sendTDPError(trace.Wrap(err))
 	}
@@ -165,7 +168,7 @@ func (h *Handler) createDesktopConnection(
 	}
 
 	// Check if MFA is required and create a UserCertsRequest.
-	mfaRequired, certsReq, err := h.prepareForCertIssuance(ctx, sctx, site, pk.Public(), desktopName, username)
+	mfaRequired, certsReq, err := h.prepareForCertIssuance(ctx, sctx, cluster, pk.Public(), desktopName, username)
 	if err != nil {
 		return sendTDPError(err)
 	}
@@ -187,7 +190,7 @@ func (h *Handler) createDesktopConnection(
 	serviceConn, version, err := desktop.ConnectToWindowsService(ctx, &desktop.ConnectionConfig{
 		Log:            log,
 		DesktopsGetter: clt,
-		Site:           site,
+		Cluster:        cluster,
 		ClientSrcAddr:  clientSrcAddr,
 		ClientDstAddr:  clientDstAddr,
 		DesktopName:    desktopName,
@@ -295,7 +298,7 @@ func createUserCertsRequest(
 func (h *Handler) prepareForCertIssuance(
 	ctx context.Context,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	publicKey crypto.PublicKey,
 	desktopName, username string,
 ) (mfaRequired bool, certsReq *proto.UserCertsRequest, err error) {
@@ -305,12 +308,12 @@ func (h *Handler) prepareForCertIssuance(
 			DesktopName: desktopName,
 			Login:       username,
 		},
-	}, sctx, site)
+	}, sctx, cluster)
 	if err != nil {
 		return false, nil, trace.Wrap(err)
 	}
 
-	certsReq, err = createUserCertsRequest(sctx, publicKey, desktopName, username, site.GetName())
+	certsReq, err = createUserCertsRequest(sctx, publicKey, desktopName, username, cluster.GetName())
 	if err != nil {
 		return false, nil, trace.Wrap(err)
 	}
@@ -384,21 +387,42 @@ func (h *Handler) performSessionMFACeremony(
 		span.End()
 	}()
 
+	// channelID is used by the front end to differentiate between separate ongoing SSO challenges.
+	channelID := uuid.NewString()
+
 	mfaCeremony := &mfa.Ceremony{
-		PromptConstructor: func(po ...mfa.PromptOpt) mfa.Prompt {
+		CreateAuthenticateChallenge: sctx.cfg.RootClient.CreateAuthenticateChallenge,
+		SSOMFACeremonyConstructor: func(_ context.Context) (mfa.SSOMFACeremony, error) {
+			u, err := url.Parse(sso.WebMFARedirect)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			u.RawQuery = url.Values{"channel_id": {channelID}}.Encode()
+			return &sso.MFACeremony{
+				ClientCallbackURL: u.String(),
+				ProxyAddress:      h.PublicProxyAddr(),
+			}, nil
+		},
+		PromptConstructor: func(...mfa.PromptOpt) mfa.Prompt {
 			return mfa.PromptFunc(func(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
-				codec := tdpMFACodec{}
+				// Convert from proto to JSON types.
+				var challenge client.MFAAuthenticateChallenge
+				if chal.WebauthnChallenge != nil {
+					challenge.WebauthnChallenge = wantypes.CredentialAssertionFromProto(chal.WebauthnChallenge)
+				}
 
-				if chal.WebauthnChallenge == nil {
-					return nil, trace.AccessDenied("Desktop access requires WebAuthn MFA, please register a WebAuthn device to connect")
+				if chal.SSOChallenge != nil {
+					challenge.SSOChallenge = client.SSOChallengeFromProto(chal.SSOChallenge)
+					challenge.SSOChallenge.ChannelID = channelID
 				}
+
+				if chal.WebauthnChallenge == nil && chal.SSOChallenge == nil {
+					return nil, trace.Wrap(authclient.ErrNoMFADevices)
+				}
+
 				// Send the challenge over the socket.
-				msg, err := codec.Encode(
-					&client.MFAAuthenticateChallenge{
-						WebauthnChallenge: wantypes.CredentialAssertionFromProto(chal.WebauthnChallenge),
-					},
-					defaults.WebsocketMFAChallenge,
-				)
+				var codec tdpMFACodec
+				msg, err := codec.Encode(&challenge, defaults.WebsocketMFAChallenge)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
@@ -457,7 +481,6 @@ func (h *Handler) performSessionMFACeremony(
 				return assertion, nil
 			})
 		},
-		CreateAuthenticateChallenge: sctx.cfg.RootClient.CreateAuthenticateChallenge,
 	}
 
 	result, err := client.PerformSessionMFACeremony(ctx, client.PerformSessionMFACeremonyParams{
@@ -552,7 +575,6 @@ func proxyWebsocketConn(ctx context.Context, ws *websocket.Conn, wds *tls.Conn,
 
 		go monitorLatency(ctx, clockwork.NewRealClock(), ws, pinger,
 			latency.ReporterFunc(func(ctx context.Context, stats latency.Statistics) error {
-				log.DebugContext(ctx, "sending latency stats", "client", stats.Client, "server", stats.Server)
 				return trace.Wrap(tdpConnProxy.SendToClient(tdp.LatencyStats{
 					ClientLatency: uint32(stats.Client),
 					ServerLatency: uint32(stats.Server),
diff --git a/lib/web/desktop/playback_test.go b/lib/web/desktop/playback_test.go
index da284e4d18792..adba16b3c00cf 100644
--- a/lib/web/desktop/playback_test.go
+++ b/lib/web/desktop/playback_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/lib/player"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web/desktop"
 )
 
@@ -81,7 +82,7 @@ func newServer(t *testing.T, streamInterval time.Duration, events []apievents.Au
 	t.Helper()
 
 	fs := eventstest.NewFakeStreamer(events, streamInterval)
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		upgrader := websocket.Upgrader{
diff --git a/lib/web/desktop_playback.go b/lib/web/desktop_playback.go
index 37611058a8131..a1da724fa3e38 100644
--- a/lib/web/desktop_playback.go
+++ b/lib/web/desktop_playback.go
@@ -37,7 +37,7 @@ func (h *Handler) desktopPlaybackHandle(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) (interface{}, error) {
 	sID := p.ByName("sid")
@@ -45,7 +45,7 @@ func (h *Handler) desktopPlaybackHandle(
 		return nil, trace.BadParameter("missing session ID in request URL")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/device_trust_test.go b/lib/web/device_trust_test.go
index 7a6f21a9887f6..940fe402339c4 100644
--- a/lib/web/device_trust_test.go
+++ b/lib/web/device_trust_test.go
@@ -40,7 +40,7 @@ func TestHandler_DeviceWebConfirm(t *testing.T) {
 	wPack := newWebPack(
 		t,
 		1, /* numProxies */
-		withDevicesClientOverride(fakeDevices),
+		withWebPackProxyOptions(withDevicesClientOverride(fakeDevices)),
 	)
 	proxy := wPack.proxies[0]
 
diff --git a/lib/web/discoveryconfig.go b/lib/web/discoveryconfig.go
index 1c3429ce22640..921aa8d669a38 100644
--- a/lib/web/discoveryconfig.go
+++ b/lib/web/discoveryconfig.go
@@ -33,7 +33,7 @@ import (
 )
 
 // discoveryconfigCreate creates a DiscoveryConfig
-func (h *Handler) discoveryconfigCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) discoveryconfigCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req ui.DiscoveryConfig
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -60,7 +60,7 @@ func (h *Handler) discoveryconfigCreate(w http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -77,7 +77,7 @@ func (h *Handler) discoveryconfigCreate(w http.ResponseWriter, r *http.Request,
 }
 
 // discoveryconfigUpdate updates the DiscoveryConfig based on its name
-func (h *Handler) discoveryconfigUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) discoveryconfigUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	dcName := p.ByName("name")
 	if dcName == "" {
 		return nil, trace.BadParameter("a discoveryconfig name is required")
@@ -92,7 +92,7 @@ func (h *Handler) discoveryconfigUpdate(w http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -118,13 +118,13 @@ func (h *Handler) discoveryconfigUpdate(w http.ResponseWriter, r *http.Request,
 }
 
 // discoveryconfigDelete removes a DiscoveryConfig based on its name
-func (h *Handler) discoveryconfigDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) discoveryconfigDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	discoveryconfigName := p.ByName("name")
 	if discoveryconfigName == "" {
 		return nil, trace.BadParameter("a discoveryconfig name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -137,13 +137,13 @@ func (h *Handler) discoveryconfigDelete(w http.ResponseWriter, r *http.Request,
 }
 
 // discoveryconfigGet returns a DiscoveryConfig based on its name
-func (h *Handler) discoveryconfigGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) discoveryconfigGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	discoveryconfigName := p.ByName("name")
 	if discoveryconfigName == "" {
 		return nil, trace.BadParameter("as discoveryconfig name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -157,8 +157,8 @@ func (h *Handler) discoveryconfigGet(w http.ResponseWriter, r *http.Request, p h
 }
 
 // discoveryconfigList returns a page of DiscoveryConfigs
-func (h *Handler) discoveryconfigList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) discoveryconfigList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/discoveryconfig_test.go b/lib/web/discoveryconfig_test.go
index fd71cd273dbe0..9118df14d213b 100644
--- a/lib/web/discoveryconfig_test.go
+++ b/lib/web/discoveryconfig_test.go
@@ -33,7 +33,7 @@ import (
 	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
@@ -126,7 +126,7 @@ func TestDiscoveryConfig(t *testing.T) {
 		})
 
 		t.Run("Read status after an update", func(t *testing.T) {
-			client, err := env.server.NewClient(auth.TestIdentity{
+			client, err := env.server.NewClient(authtest.TestIdentity{
 				I: authz.BuiltinRole{
 					Role:     types.RoleDiscovery,
 					Username: "disc",
diff --git a/lib/web/features_test.go b/lib/web/features_test.go
index d6d1fd6d5caa0..e4878ca7a3398 100644
--- a/lib/web/features_test.go
+++ b/lib/web/features_test.go
@@ -21,12 +21,11 @@ package web
 import (
 	"context"
 	"log/slog"
+	"sync"
 	"testing"
 	"time"
 
-	"github.com/google/go-cmp/cmp"
 	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
@@ -34,142 +33,138 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/utils/testutils/synctest"
 )
 
-// mockedPingTestProxy is a test proxy with a mocked Ping method
+// mockedFeatureGetter is a test proxy with a mocked Ping method
 // that returns the internal features
 type mockedFeatureGetter struct {
 	authclient.ClientI
+
+	mu       sync.Mutex
 	features proto.Features
 }
 
 func (m *mockedFeatureGetter) Ping(ctx context.Context) (proto.PingResponse, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	return proto.PingResponse{
 		ServerFeatures: utils.CloneProtoMsg(&m.features),
 	}, nil
 }
 
 func (m *mockedFeatureGetter) setFeatures(f proto.Features) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	m.features = f
 }
 
 func TestFeaturesWatcher(t *testing.T) {
-	clock := clockwork.NewFakeClock()
-
-	mockClient := &mockedFeatureGetter{features: proto.Features{
-		Kubernetes:     true,
-		Entitlements:   map[string]*proto.EntitlementInfo{},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	handler := &Handler{
-		cfg: Config{
-			FeatureWatchInterval: 100 * time.Millisecond,
-			ProxyClient:          mockClient,
-			Context:              ctx,
-		},
-		clock:           clock,
-		clusterFeatures: proto.Features{},
-		logger:          slog.Default().With(teleport.ComponentKey, teleport.ComponentWeb),
-	}
-
-	// before running the watcher, features should match the value passed to the handler
-	requireFeatures(t, clock, proto.Features{}, handler.GetClusterFeatures)
-
-	go handler.startFeatureWatcher()
-	clock.BlockUntil(1)
-
-	// after starting the watcher, handler.GetClusterFeatures should return
-	// values matching the client's response
-	features := proto.Features{
-		Kubernetes:     true,
-		Entitlements:   map[string]*proto.EntitlementInfo{},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}
-	entitlements.BackfillFeatures(&features)
-	expected := utils.CloneProtoMsg(&features)
-	requireFeatures(t, clock, *expected, handler.GetClusterFeatures)
-
-	// update values once again and check if the features are properly updated
-	features = proto.Features{
-		Kubernetes:     false,
-		Entitlements:   map[string]*proto.EntitlementInfo{},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}
-	entitlements.BackfillFeatures(&features)
-	mockClient.setFeatures(features)
-	expected = utils.CloneProtoMsg(&features)
-	requireFeatures(t, clock, *expected, handler.GetClusterFeatures)
-
-	// test updating entitlements
-	features = proto.Features{
-		Kubernetes: true,
-		Entitlements: map[string]*proto.EntitlementInfo{
-			string(entitlements.ExternalAuditStorage):   {Enabled: true},
-			string(entitlements.AccessLists):            {Enabled: true},
-			string(entitlements.AccessMonitoring):       {Enabled: true},
-			string(entitlements.App):                    {Enabled: true},
-			string(entitlements.CloudAuditLogRetention): {Enabled: true},
-		},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}
-	entitlements.BackfillFeatures(&features)
-	mockClient.setFeatures(features)
-
-	expected = &proto.Features{
-		Kubernetes: true,
-		Entitlements: map[string]*proto.EntitlementInfo{
-			string(entitlements.ExternalAuditStorage):   {Enabled: true},
-			string(entitlements.AccessLists):            {Enabled: true},
-			string(entitlements.AccessMonitoring):       {Enabled: true},
-			string(entitlements.App):                    {Enabled: true},
-			string(entitlements.CloudAuditLogRetention): {Enabled: true},
-		},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}
-	entitlements.BackfillFeatures(expected)
-	requireFeatures(t, clock, *expected, handler.GetClusterFeatures)
-
-	// stop watcher and ensure it stops updating features
-	cancel()
-	features = proto.Features{
-		Kubernetes:     !features.Kubernetes,
-		App:            !features.App,
-		DB:             true,
-		Entitlements:   map[string]*proto.EntitlementInfo{},
-		AccessRequests: &proto.AccessRequestsFeature{},
-	}
-	entitlements.BackfillFeatures(&features)
-	mockClient.setFeatures(features)
-	notExpected := utils.CloneProtoMsg(&features)
-	// assert the handler never get these last features as the watcher is stopped
-	neverFeatures(t, clock, *notExpected, handler.GetClusterFeatures)
-}
-
-// requireFeatures is a helper function that advances the clock, then
-// calls `getFeatures` every 100ms for up to 1 second, until it
-// returns the expected result (`want`).
-func requireFeatures(t *testing.T, fakeClock *clockwork.FakeClock, want proto.Features, getFeatures func() proto.Features) {
-	t.Helper()
-
-	// Advance the clock so the service fetch and stores features
-	fakeClock.Advance(1 * time.Second)
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		diff := cmp.Diff(want, getFeatures())
-		assert.Empty(t, diff)
-	}, 5*time.Second, time.Millisecond*100)
-}
-
-// neverFeatures is a helper function that advances the clock, then
-// calls `getFeatures` every 100ms for up to 1 second. If at some point `getFeatures`
-// returns `doNotWant`, the test fails.
-func neverFeatures(t *testing.T, fakeClock *clockwork.FakeClock, doNotWant proto.Features, getFeatures func() proto.Features) {
-	t.Helper()
-
-	fakeClock.Advance(1 * time.Second)
-	require.Never(t, func() bool {
-		return cmp.Diff(doNotWant, getFeatures()) == ""
-	}, 1*time.Second, time.Millisecond*100)
+	synctest.Test(t, func(t *testing.T) {
+		mockClient := &mockedFeatureGetter{features: proto.Features{
+			Kubernetes:     true,
+			Entitlements:   map[string]*proto.EntitlementInfo{},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}}
+
+		ctx, cancel := context.WithCancel(t.Context())
+
+		handler := &Handler{
+			cfg: Config{
+				FeatureWatchInterval: 100 * time.Millisecond,
+				ProxyClient:          mockClient,
+				Context:              ctx,
+			},
+			clock:           clockwork.NewRealClock(),
+			clusterFeatures: proto.Features{},
+			logger:          slog.Default().With(teleport.ComponentKey, teleport.ComponentWeb),
+		}
+
+		go handler.startFeatureWatcher()
+		synctest.Wait()
+
+		// before running the watcher, features should match the value passed to the handler
+		require.Equal(t, proto.Features{}, handler.GetClusterFeatures())
+
+		// advance and wait. once this returns the first feature update will have completed
+		// and the updater will be blocked prior to the second update.
+		time.Sleep(handler.cfg.FeatureWatchInterval)
+		synctest.Wait()
+
+		// after starting the watcher, handler.GetClusterFeatures should return
+		// values matching the client's response
+		features := proto.Features{
+			Kubernetes:     true,
+			Entitlements:   map[string]*proto.EntitlementInfo{},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}
+		entitlements.BackfillFeatures(&features)
+		expected := utils.CloneProtoMsg(&features)
+		require.Equal(t, *expected, handler.GetClusterFeatures())
+
+		// update values once again and check if the features are properly updated
+		features = proto.Features{
+			Kubernetes:     false,
+			Entitlements:   map[string]*proto.EntitlementInfo{},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}
+		entitlements.BackfillFeatures(&features)
+		mockClient.setFeatures(features)
+
+		time.Sleep(handler.cfg.FeatureWatchInterval)
+		synctest.Wait()
+
+		expected = utils.CloneProtoMsg(&features)
+		require.Equal(t, *expected, handler.GetClusterFeatures())
+
+		// test updating entitlements
+		features = proto.Features{
+			Kubernetes: true,
+			Entitlements: map[string]*proto.EntitlementInfo{
+				string(entitlements.ExternalAuditStorage):   {Enabled: true},
+				string(entitlements.AccessLists):            {Enabled: true},
+				string(entitlements.AccessMonitoring):       {Enabled: true},
+				string(entitlements.App):                    {Enabled: true},
+				string(entitlements.CloudAuditLogRetention): {Enabled: true},
+			},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}
+		entitlements.BackfillFeatures(&features)
+		mockClient.setFeatures(features)
+
+		time.Sleep(handler.cfg.FeatureWatchInterval)
+		synctest.Wait()
+
+		expected = &proto.Features{
+			Kubernetes: true,
+			Entitlements: map[string]*proto.EntitlementInfo{
+				string(entitlements.ExternalAuditStorage):   {Enabled: true},
+				string(entitlements.AccessLists):            {Enabled: true},
+				string(entitlements.AccessMonitoring):       {Enabled: true},
+				string(entitlements.App):                    {Enabled: true},
+				string(entitlements.CloudAuditLogRetention): {Enabled: true},
+			},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}
+		entitlements.BackfillFeatures(expected)
+		require.Equal(t, *expected, handler.GetClusterFeatures())
+
+		// stop watcher and ensure it stops updating features
+		cancel()
+		synctest.Wait()
+
+		features = proto.Features{
+			Kubernetes:     !features.Kubernetes,
+			App:            !features.App,
+			DB:             true,
+			Entitlements:   map[string]*proto.EntitlementInfo{},
+			AccessRequests: &proto.AccessRequestsFeature{},
+		}
+		entitlements.BackfillFeatures(&features)
+		mockClient.setFeatures(features)
+		notExpected := utils.CloneProtoMsg(&features)
+
+		// assert the handler never get these last features as the watcher is stopped
+		require.NotEqual(t, *notExpected, handler.GetClusterFeatures())
+	})
 }
diff --git a/lib/web/files.go b/lib/web/files.go
index 7a3c5370c371e..3d659fa9f8d3a 100644
--- a/lib/web/files.go
+++ b/lib/web/files.go
@@ -31,17 +31,19 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
+	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils/sftp"
-	"github.com/gravitational/teleport/lib/teleagent"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -66,10 +68,12 @@ type fileTransferRequest struct {
 	moderatedSessionID string
 }
 
-func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	ctx := r.Context()
+
 	query := r.URL.Query()
 	req := fileTransferRequest{
-		cluster:               site.GetName(),
+		cluster:               cluster.GetName(),
 		login:                 p.ByName("login"),
 		serverID:              p.ByName("server"),
 		remoteLocation:        query.Get("location"),
@@ -98,7 +102,7 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 		return nil, trace.BadParameter("fileTransferRequestId and moderatedSessionId must both be included in the same request.")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -125,25 +129,6 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 		return nil, trace.AccessDenied("MFA required for file transfer")
 	}
 
-	var cfg *sftp.Config
-	isUpload := r.Method == http.MethodPost
-	if isUpload {
-		cfg, err = sftp.CreateHTTPUploadConfig(sftp.HTTPTransferRequest{
-			Src:         req.filename,
-			Dst:         req.remoteLocation,
-			HTTPRequest: r,
-		})
-	} else {
-		cfg, err = sftp.CreateHTTPDownloadConfig(sftp.HTTPTransferRequest{
-			Src:          req.remoteLocation,
-			Dst:          req.filename,
-			HTTPResponse: w,
-		})
-	}
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	tc, err := ft.createClient(req, r, h.cfg.PROXYSigner)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -155,12 +140,12 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 		}
 	}
 
-	ctx := r.Context()
+	var moderatedSessionID string
 	if req.fileTransferRequestID != "" {
-		ctx = context.WithValue(ctx, sftp.ModeratedSessionID, req.moderatedSessionID)
+		moderatedSessionID = req.moderatedSessionID
 	}
 
-	accessPoint, err := site.CachingAccessPoint()
+	accessPoint, err := cluster.CachingAccessPoint()
 	if err != nil {
 		h.logger.DebugContext(r.Context(), "Unable to get auth access point", "error", err)
 		return nil, trace.Wrap(err)
@@ -171,9 +156,8 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 		return nil, trace.Wrap(err)
 	}
 
-	getAgent := func() (teleagent.Agent, error) {
-		return teleagent.NopCloser(tc.LocalAgent()), nil
-	}
+	getAgent := sshagent.NewStaticClientGetter(tc.LocalAgent())
+
 	cert, err := sctx.GetSSHCertificate()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -186,10 +170,15 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 
 	signer := agentless.SignerFromSSHIdentity(ident, h.auth.accessPoint, tc.SiteName, tc.Username)
 
+	clientDstAddr := h.cfg.ProxyWebAddr
+	if srvConn, err := authz.ConnFromContext(r.Context()); err == nil {
+		clientDstAddr = utils.FromAddr(srvConn.LocalAddr())
+	}
 	conn, err := h.cfg.Router.DialHost(
 		ctx,
+		ident.ScopePin,
 		&utils.NetAddr{Addr: r.RemoteAddr},
-		&h.cfg.ProxyWebAddr,
+		&clientDstAddr,
 		req.serverID,
 		"0",
 		tc.SiteName,
@@ -239,7 +228,42 @@ func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprou
 
 	defer nodeClient.Close()
 
-	if err := nodeClient.TransferFiles(ctx, cfg); err != nil {
+	webTarget := sftp.Target{
+		Path: req.filename,
+	}
+	remoteTarget := sftp.Target{
+		Login: req.login,
+		Addr: &utils.NetAddr{
+			Addr: req.serverID + ":0",
+		},
+		Path: req.remoteLocation,
+	}
+	dialHost := func(_ context.Context, _, _ string) (*tracessh.Client, error) {
+		return nodeClient.Client, nil
+	}
+	var sftpReq *sftp.FileTransferRequest
+	if r.Method == http.MethodPost {
+		sftpReq, err = sftp.CreateHTTPUploadRequest(sftp.HTTPTransferRequest{
+			Src:                webTarget,
+			Dst:                remoteTarget,
+			HTTPRequest:        r,
+			DialHost:           dialHost,
+			ModeratedSessionID: moderatedSessionID,
+		})
+	} else {
+		sftpReq, err = sftp.CreateHTTPDownloadRequest(sftp.HTTPTransferRequest{
+			Src:                remoteTarget,
+			Dst:                webTarget,
+			HTTPResponse:       w,
+			DialHost:           dialHost,
+			ModeratedSessionID: moderatedSessionID,
+		})
+	}
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := sftp.TransferFiles(ctx, sftpReq); err != nil {
 		if errors.As(err, new(*sftp.NonRecursiveDirectoryTransferError)) {
 			return nil, trace.Errorf("transferring directories through the Web UI is not supported at the moment, please use tsh scp -r")
 		}
diff --git a/lib/web/git_servers.go b/lib/web/git_servers.go
index e99a2bddd9bff..0cf3cf856eeaf 100644
--- a/lib/web/git_servers.go
+++ b/lib/web/git_servers.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
-func (h *Handler) gitServerCreateOrUpsert(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) gitServerCreateOrUpsert(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req *ui.CreateGitServerRequest
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -49,7 +49,7 @@ func (h *Handler) gitServerCreateOrUpsert(_ http.ResponseWriter, r *http.Request
 		return nil, trace.Wrap(err)
 	}
 
-	userClient, err := sctx.GetUserClient(r.Context(), site)
+	userClient, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -64,13 +64,13 @@ func (h *Handler) gitServerCreateOrUpsert(_ http.ResponseWriter, r *http.Request
 	return created, trace.Wrap(err)
 }
 
-func (h *Handler) gitServerGet(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) gitServerGet(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	name := p.ByName("name")
 	if name == "" {
 		return nil, trace.BadParameter("git server name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -79,16 +79,16 @@ func (h *Handler) gitServerGet(_ http.ResponseWriter, r *http.Request, p httprou
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return ui.MakeGitServer(site.GetName(), gitServer, false), nil
+	return ui.MakeGitServer(cluster.GetName(), gitServer, false), nil
 }
 
-func (h *Handler) gitServerDelete(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) gitServerDelete(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	name := p.ByName("name")
 	if name == "" {
 		return nil, trace.BadParameter("git server name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/gziphandler.go b/lib/web/gziphandler.go
deleted file mode 100644
index c2e59068d84d6..0000000000000
--- a/lib/web/gziphandler.go
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package web
-
-import (
-	"compress/gzip"
-	"io"
-	"net/http"
-	"strings"
-	"sync"
-)
-
-// writerPool is a sync.Pool for shared gzip writers.
-// each gzip writer allocates a lot of memory
-// so it makes sense to reset the writer and reuse the
-// internal buffers to avoid too many objects on the heap
-var writerPool = sync.Pool{
-	New: func() interface{} {
-		gz := gzip.NewWriter(io.Discard)
-		return gz
-	},
-}
-
-func newGzipResponseWriter(w http.ResponseWriter) gzipResponseWriter {
-	gz := writerPool.Get().(*gzip.Writer)
-	gz.Reset(w)
-	return gzipResponseWriter{gz: gz, ResponseWriter: w}
-}
-
-type gzipResponseWriter struct {
-	gz *gzip.Writer
-	http.ResponseWriter
-}
-
-// Write uses the Writer part of gzipResponseWriter to write the output.
-func (w gzipResponseWriter) Write(b []byte) (int, error) {
-	_, haveType := w.Header()["Content-Type"]
-	// Explicitly set Content-Type if it has not been set previously
-	if !haveType {
-		// If no content type, apply sniffing algorithm to un-gzipped body.
-		w.Header().Set("Content-Type", http.DetectContentType(b))
-	}
-	return w.gz.Write(b)
-}
-
-// makeGzipHandler adds support for gzip compression for given handler.
-func makeGzipHandler(handler http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Check if the client can accept the gzip encoding and that this is not an image asset.
-		if !strings.Contains(r.Header.Get("Accept-Encoding"), "gzip") || isCompressedImageRequest(r) {
-			handler.ServeHTTP(w, r)
-			return
-		}
-
-		// Set the HTTP header indicating encoding.
-		w.Header().Set("Content-Encoding", "gzip")
-		gzw := newGzipResponseWriter(w)
-		defer gzw.gz.Close()
-		handler.ServeHTTP(gzw, r)
-	})
-}
-
-// isCompressedImageRequest checks whether a request is for a png or jpg/jpeg
-func isCompressedImageRequest(r *http.Request) bool {
-	return strings.HasSuffix(r.URL.Path, ".png") || strings.HasSuffix(r.URL.Path, ".jpg") || strings.HasSuffix(r.URL.Path, ".jpeg")
-}
diff --git a/lib/web/integrations.go b/lib/web/integrations.go
index d3eec593984ad..4795961dce886 100644
--- a/lib/web/integrations.go
+++ b/lib/web/integrations.go
@@ -46,7 +46,7 @@ import (
 )
 
 // integrationsCreate creates an Integration
-func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req *ui.CreateIntegrationRequest
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -110,9 +110,10 @@ func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p h
 		}, &types.AWSRAIntegrationSpecV1{
 			TrustAnchorARN: req.Integration.AWSRA.TrustAnchorARN,
 			ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
-				Enabled:    req.Integration.AWSRA.ProfileSyncConfig.Enabled,
-				ProfileARN: req.Integration.AWSRA.ProfileSyncConfig.ProfileARN,
-				RoleARN:    req.Integration.AWSRA.ProfileSyncConfig.RoleARN,
+				Enabled:            req.Integration.AWSRA.ProfileSyncConfig.Enabled,
+				ProfileARN:         req.Integration.AWSRA.ProfileSyncConfig.ProfileARN,
+				RoleARN:            req.Integration.AWSRA.ProfileSyncConfig.RoleARN,
+				ProfileNameFilters: req.Integration.AWSRA.ProfileSyncConfig.ProfileNameFilters,
 			},
 		})
 		if err != nil {
@@ -123,7 +124,7 @@ func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.BadParameter("subkind %q is not supported", req.SubKind)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -145,10 +146,10 @@ func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsUpdate updates the Integration based on its name
-func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
 	var req *ui.UpdateIntegrationRequest
@@ -160,7 +161,7 @@ func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -212,9 +213,10 @@ func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p h
 		spec := integration.GetAWSRolesAnywhereIntegrationSpec()
 		spec.TrustAnchorARN = req.AWSRA.TrustAnchorARN
 		spec.ProfileSyncConfig = &types.AWSRolesAnywhereProfileSyncConfig{
-			Enabled:    req.AWSRA.ProfileSyncConfig.Enabled,
-			ProfileARN: req.AWSRA.ProfileSyncConfig.ProfileARN,
-			RoleARN:    req.AWSRA.ProfileSyncConfig.RoleARN,
+			Enabled:            req.AWSRA.ProfileSyncConfig.Enabled,
+			ProfileARN:         req.AWSRA.ProfileSyncConfig.ProfileARN,
+			RoleARN:            req.AWSRA.ProfileSyncConfig.RoleARN,
+			ProfileNameFilters: req.AWSRA.ProfileSyncConfig.ProfileNameFilters,
 
 			ProfileAcceptsRoleSessionName: spec.ProfileSyncConfig.ProfileAcceptsRoleSessionName,
 		}
@@ -234,13 +236,13 @@ func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsDelete removes an Integration based on its name
-func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name_or_subkind")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -257,13 +259,13 @@ func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsGet returns an Integration based on its name
-func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -282,13 +284,13 @@ func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p http
 }
 
 // integrationStats returns the integration stats.
-func (h *Handler) integrationStats(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationStats(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -400,25 +402,57 @@ func collectIntegrationStats(ctx context.Context, req collectIntegrationStatsReq
 		nextPage = nextToken
 	}
 
+	switch req.integration.GetSubKind() {
+	case types.IntegrationSubKindAWSRolesAnywhere:
+		ret.RolesAnywhereProfileSync = &ui.RolesAnywhereProfileSync{}
+
+		awsRolesAnywhereSpec := req.integration.GetAWSRolesAnywhereIntegrationSpec()
+		if awsRolesAnywhereSpec != nil {
+			ret.RolesAnywhereProfileSync.Enabled = awsRolesAnywhereSpec.ProfileSyncConfig.Enabled
+		}
+
+		integrationStatus := req.integration.GetStatus()
+		if integrationStatus.AWSRolesAnywhere != nil {
+			ret.RolesAnywhereProfileSync.Status = integrationStatus.AWSRolesAnywhere.LastProfileSync.Status
+			ret.RolesAnywhereProfileSync.ErrorMessage = integrationStatus.AWSRolesAnywhere.LastProfileSync.ErrorMessage
+			ret.RolesAnywhereProfileSync.SyncedProfiles = int(integrationStatus.AWSRolesAnywhere.LastProfileSync.SyncedProfiles)
+			ret.RolesAnywhereProfileSync.SyncStartTime = integrationStatus.AWSRolesAnywhere.LastProfileSync.StartTime
+			ret.RolesAnywhereProfileSync.SyncEndTime = integrationStatus.AWSRolesAnywhere.LastProfileSync.EndTime
+		}
+
+	case types.IntegrationSubKindAWSOIDC:
+		// For now, Deploying Database Services is only possible using the AWS OIDC Integration.
+		// When/if more integrations (eg, AWS IAM Roles Anywhere) support it, this must be updated.
+		ecsCount, err := countAWSOIDCDeployedDatabaseServices(ctx, req)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		ret.AWSRDS.ECSDatabaseServiceCount = ecsCount
+	}
+
+	return ret, nil
+}
+
+func countAWSOIDCDeployedDatabaseServices(ctx context.Context, req collectIntegrationStatsRequest) (int, error) {
 	regions, err := fetchRelevantAWSRegions(ctx, req.databaseGetter, req.discoveryConfigLister)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return 0, trace.Wrap(err)
 	}
 
 	services, err := listDeployedDatabaseServices(ctx, req.logger, req.integration.GetName(), regions, req.awsOIDCClient)
-	switch {
-	case trace.IsAccessDenied(err):
+	if err != nil {
 		// The number of ECS Database Services is shown when listing the integration status.
 		// However, listing ECS Services is only possible after the user goes through the RDS enrollment flows, which adds the required policy to the IAM Role.
 		// If this calls returns an access denied, we assume the user doesn't have the required IAM Policies in their IAM Role and show 0 instead.
+		if trace.IsAccessDenied(err) {
+			return 0, nil
+		}
 
-	case err != nil:
-		return nil, trace.Wrap(err)
+		return 0, trace.Wrap(err)
 	}
 
-	ret.AWSRDS.ECSDatabaseServiceCount = len(services)
-
-	return ret, nil
+	return len(services), nil
 }
 
 func mergeResourceTypeSummary(in *ui.ResourceTypeSummary, lastSyncTime time.Time, new *discoveryconfigv1.ResourcesDiscoveredSummary) {
@@ -465,10 +499,10 @@ func rulesWithIntegration(dc *discoveryconfig.DiscoveryConfig, matcherType strin
 // startKey: indicator for pagination, should be the value of the last reponse's `nextItem`, or absent for a the starting page
 // resourceType: which resource type to return, one of ec2, eks, rds
 // regions: only rules for regions listed are returned (omit query to include all regions)
-func (h *Handler) integrationDiscoveryRules(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationDiscoveryRules(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
 	values := r.URL.Query()
@@ -481,7 +515,7 @@ func (h *Handler) integrationDiscoveryRules(w http.ResponseWriter, r *http.Reque
 		regionsFilter = nil
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -586,8 +620,8 @@ func collectAutoDiscoveryRulesFromDiscoveryConfig(dc *discoveryconfig.DiscoveryC
 }
 
 // integrationsList returns a page of Integrations
-func (h *Handler) integrationsList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) integrationsList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -617,8 +651,8 @@ func (h *Handler) integrationsList(w http.ResponseWriter, r *http.Request, p htt
 }
 
 // integrationsMsTeamsAppZipGet generates and returns the app.zip required for the MsTeams plugin with the given name.
-func (h *Handler) integrationsMsTeamsAppZipGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) integrationsMsTeamsAppZipGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -648,13 +682,13 @@ func (h *Handler) integrationsMsTeamsAppZipGet(w http.ResponseWriter, r *http.Re
 	return nil, nil
 }
 
-func (h *Handler) integrationsExportCA(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsExportCA(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/integrations_awsoidc.go b/lib/web/integrations_awsoidc.go
index eb36e3700eb9e..0dabaf5dbe09b 100644
--- a/lib/web/integrations_awsoidc.go
+++ b/lib/web/integrations_awsoidc.go
@@ -25,8 +25,11 @@ import (
 	"maps"
 	"net/http"
 	"slices"
+	"strconv"
 	"strings"
 
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/coreos/go-semver/semver"
 	"github.com/google/safetext/shsprintf"
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
@@ -59,7 +62,7 @@ import (
 )
 
 // awsOIDCListDatabases returns a list of databases using the ListDatabases action of the AWS OIDC Integration.
-func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListDatabasesRequest
@@ -69,10 +72,10 @@ func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -101,7 +104,7 @@ func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p
 }
 
 // awsOIDCDeployService deploys a Discovery Service and a Database Service in Amazon ECS.
-func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCDeployServiceRequest
@@ -111,10 +114,10 @@ func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -159,7 +162,7 @@ func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p
 	teleportVersionTag := teleport.Version
 	if automaticUpgrades(h.GetClusterFeatures()) {
 		const group, updaterUUID = "", ""
-		autoUpdateVersion, err := h.autoUpdateAgentVersion(r.Context(), group, updaterUUID)
+		autoUpdateVersion, err := h.autoUpdateResolver.GetVersion(r.Context(), group, updaterUUID)
 		if err != nil {
 			h.logger.WarnContext(r.Context(),
 				"Cannot read autoupdate target version, falling back to our own version",
@@ -194,7 +197,7 @@ func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p
 }
 
 // awsOIDCDeployDatabaseService deploys a Database Service in Amazon ECS.
-func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCDeployDatabaseServiceRequest
@@ -204,10 +207,10 @@ func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.R
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +218,7 @@ func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.R
 	teleportVersionTag := teleport.Version
 	if automaticUpgrades(h.GetClusterFeatures()) {
 		const group, updaterUUID = "", ""
-		autoUpdateVersion, err := h.autoUpdateAgentVersion(r.Context(), group, updaterUUID)
+		autoUpdateVersion, err := h.autoUpdateResolver.GetVersion(r.Context(), group, updaterUUID)
 		if err != nil {
 			h.logger.WarnContext(r.Context(),
 				"Cannot read autoupdate target version, falling back to self version.",
@@ -270,16 +273,16 @@ func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.R
 }
 
 // awsOIDCListDeployedDatabaseService lists the deployed Database Services in Amazon ECS.
-func (h *Handler) awsOIDCListDeployedDatabaseService(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListDeployedDatabaseService(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
 	regions, err := regionsForListingDeployedDatabaseService(ctx, r, clt, clt.DiscoveryConfigClient())
@@ -608,7 +611,7 @@ func (h *Handler) awsOIDCConfigureDeployServiceIAM(w http.ResponseWriter, r *htt
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
@@ -641,8 +644,8 @@ func (h *Handler) awsOIDCConfigureAWSAppAccessIAM(w http.ResponseWriter, r *http
 	}
 
 	httplib.SetScriptHeaders(w.Header())
+	_, err = w.Write([]byte(script))
 
-	_, err = fmt.Fprint(w, script)
 	return nil, trace.Wrap(err)
 }
 
@@ -675,10 +678,9 @@ func (h *Handler) awsOIDCConfigureEC2SSMIAM(w http.ResponseWriter, r *http.Reque
 		return nil, trace.Wrap(err, "invalid awsAccountID")
 	}
 
+	// SSM Document is not required, since the user might want to use a pre-defined one. Eg, AWS-RunShellScript.
 	ssmDocumentName := queryParams.Get("ssmDocument")
-	if ssmDocumentName == "" {
-		return nil, trace.BadParameter("missing ssmDocument query param")
-	}
+
 	// PublicProxyAddr() might return tenant.teleport.sh
 	// However, the expected format for --proxy-public-url includes the protocol `https://`
 	proxyPublicURL := h.PublicProxyAddr()
@@ -712,8 +714,8 @@ func (h *Handler) awsOIDCConfigureEC2SSMIAM(w http.ResponseWriter, r *http.Reque
 	}
 
 	httplib.SetScriptHeaders(w.Header())
+	_, err = w.Write([]byte(script))
 
-	_, err = fmt.Fprint(w, script)
 	return nil, trace.Wrap(err)
 }
 
@@ -753,14 +755,29 @@ func (h *Handler) awsOIDCConfigureEKSIAM(w http.ResponseWriter, r *http.Request,
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
 
+// TODO(hugoShaka): change the version getter signature to take group and id
+// so we can get rid of this wrapper.
+
+// handlerVersionGetter is a dummy struct implementing version.Getter by wrapping Handler.GetVersion.
+type handlerVersionGetter struct {
+	*Handler
+}
+
+// GetVersion implements version.Getter.
+func (h *handlerVersionGetter) GetVersion(ctx context.Context) (*semver.Version, error) {
+	const group, updaterUUID = "", ""
+	agentVersion, err := h.autoUpdateResolver.GetVersion(ctx, group, updaterUUID)
+	return agentVersion, trace.Wrap(err)
+}
+
 // awsOIDCEnrollEKSClusters enroll EKS clusters by installing teleport-kube-agent Helm chart on them.
 // v2 endpoint introduces "extraLabels" field.
-func (h *Handler) awsOIDCEnrollEKSClusters(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCEnrollEKSClusters(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCEnrollEKSClustersRequest
@@ -768,14 +785,14 @@ func (h *Handler) awsOIDCEnrollEKSClusters(w http.ResponseWriter, r *http.Reques
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
 	versionGetter := &handlerVersionGetter{h}
@@ -817,7 +834,7 @@ func (h *Handler) awsOIDCEnrollEKSClusters(w http.ResponseWriter, r *http.Reques
 }
 
 // awsOIDCListEKSClusters returns a list of EKS clusters using the ListEKSClusters action of the AWS OIDC integration.
-func (h *Handler) awsOIDCListEKSClusters(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListEKSClusters(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListEKSClustersRequest
@@ -827,10 +844,10 @@ func (h *Handler) awsOIDCListEKSClusters(w http.ResponseWriter, r *http.Request,
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -851,7 +868,7 @@ func (h *Handler) awsOIDCListEKSClusters(w http.ResponseWriter, r *http.Request,
 }
 
 // awsOIDCListSecurityGroups returns a list of VPC Security Groups using the ListSecurityGroups action of the AWS OIDC Integration.
-func (h *Handler) awsOIDCListSecurityGroups(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListSecurityGroups(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListSecurityGroupsRequest
@@ -861,10 +878,10 @@ func (h *Handler) awsOIDCListSecurityGroups(w http.ResponseWriter, r *http.Reque
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -939,7 +956,7 @@ func awsOIDCSecurityGroupsRulesConverter(inRules []*integrationv1.SecurityGroupR
 // This api will return empty if we already have agents that can proxy the discovered databases.
 // Otherwise it will return with a map of VPC and its subnets where it's values are later used
 // to configure and deploy an agent (deploy an agent per unique VPC).
-func (h *Handler) awsOIDCRequiredDatabasesVPCS(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCRequiredDatabasesVPCS(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCRequiredVPCSRequest
@@ -949,10 +966,10 @@ func (h *Handler) awsOIDCRequiredDatabasesVPCS(w http.ResponseWriter, r *http.Re
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1057,7 +1074,7 @@ func awsOIDCRequiredVPCSHelper(ctx context.Context, clt client.GetResourcesClien
 
 // awsOIDCCreateAWSAppAccess creates an AppServer that uses an AWS OIDC Integration for proxying access.
 // v2 endpoint introduces "labels" field
-func (h *Handler) awsOIDCCreateAWSAppAccess(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCCreateAWSAppAccess(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCCreateAWSAppAccessRequest
@@ -1067,10 +1084,10 @@ func (h *Handler) awsOIDCCreateAWSAppAccess(w http.ResponseWriter, r *http.Reque
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1136,7 +1153,7 @@ func (h *Handler) awsOIDCCreateAWSAppAccess(w http.ResponseWriter, r *http.Reque
 	return ui.MakeApp(appServer.GetApp(), ui.MakeAppsConfig{
 		LocalClusterName:      h.auth.clusterName,
 		LocalProxyDNSName:     h.proxyDNSName(),
-		AppClusterName:        site.GetName(),
+		AppClusterName:        cluster.GetName(),
 		AllowedAWSRolesLookup: allowedAWSRolesLookup,
 		UserGroupLookup:       getUserGroupLookup(),
 		Logger:                h.logger,
@@ -1144,7 +1161,7 @@ func (h *Handler) awsOIDCCreateAWSAppAccess(w http.ResponseWriter, r *http.Reque
 }
 
 // awsOIDCDeleteAWSAppAccess deletes the AWS AppServer created that uses the AWS OIDC Integration for proxying requests.
-func (h *Handler) awsOIDCDeleteAWSAppAccess(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCDeleteAWSAppAccess(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	subkind := p.ByName("name_or_subkind")
@@ -1154,10 +1171,10 @@ func (h *Handler) awsOIDCDeleteAWSAppAccess(w http.ResponseWriter, r *http.Reque
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1260,7 +1277,7 @@ func (h *Handler) awsOIDCConfigureIdP(w http.ResponseWriter, r *http.Request, p
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
@@ -1301,7 +1318,7 @@ func (h *Handler) awsOIDCConfigureListDatabasesIAM(w http.ResponseWriter, r *htt
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
@@ -1338,6 +1355,44 @@ func (h *Handler) awsAccessGraphOIDCSync(w http.ResponseWriter, r *http.Request,
 		fmt.Sprintf("--role=%s", shsprintf.EscapeDefaultContext(role)),
 		fmt.Sprintf("--aws-account-id=%s", shsprintf.EscapeDefaultContext(awsAccountID)),
 	}
+
+	if sqsURL := queryParams.Get("sqsUrl"); sqsURL != "" {
+		if !awsoidc.IsValidSQSURL(sqsURL) {
+			return nil, trace.BadParameter("invalid sqsUrl %q", sqsURL)
+		}
+		argsList = append(argsList, fmt.Sprintf("--sqs-queue-url=%s", shsprintf.EscapeDefaultContext(sqsURL)))
+	}
+
+	if s3Bucket := queryParams.Get("cloudTrailS3Bucket"); s3Bucket != "" {
+		if _, err := arn.Parse(s3Bucket); err != nil {
+			return nil, trace.BadParameter("invalid cloudTrailS3Bucket %q", s3Bucket)
+		}
+
+		argsList = append(argsList, fmt.Sprintf("--cloud-trail-bucket=%s", shsprintf.EscapeDefaultContext(s3Bucket)))
+	}
+
+	if kmsKeysARNs := queryParams["kmsKeysARNs"]; len(kmsKeysARNs) > 0 {
+		for _, keyARN := range kmsKeysARNs {
+			if _, err := arn.Parse(keyARN); err != nil {
+				return nil, trace.BadParameter("invalid kmsKeysARNs %q", keyARN)
+			}
+			argsList = append(argsList, fmt.Sprintf("--kms-key=%s", shsprintf.EscapeDefaultContext(keyARN)))
+		}
+	}
+
+	if eksAuditLogs := queryParams.Get("eksAuditLogs"); eksAuditLogs != "" {
+		enabled, err := strconv.ParseBool(eksAuditLogs)
+		if err != nil {
+			// The error returned by ParseBool contains no more information than this
+			// error. As we canot wrap both it and trace.BadParameter, we do the
+			// latter as a preferred error type.
+			return nil, trace.BadParameter("invalid boolean value for eksAuditLogs %q", eksAuditLogs)
+		}
+		if enabled {
+			argsList = append(argsList, "--eks-audit-logs")
+		}
+	}
+
 	script, err := oneoff.BuildScript(oneoff.OneOffScriptParams{
 		EntrypointArgs: strings.Join(argsList, " "),
 		SuccessMessage: "Success! You can now go back to the Teleport Web UI to complete the Access Graph AWS Sync enrollment.",
@@ -1347,13 +1402,13 @@ func (h *Handler) awsAccessGraphOIDCSync(w http.ResponseWriter, r *http.Request,
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
 
 // awsOIDCListSubnets returns a list of VPC subnets using the ListSubnets action of the AWS OIDC Integration.
-func (h *Handler) awsOIDCListSubnets(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListSubnets(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListSubnetsRequest
@@ -1363,10 +1418,10 @@ func (h *Handler) awsOIDCListSubnets(w http.ResponseWriter, r *http.Request, p h
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1399,7 +1454,7 @@ func (h *Handler) awsOIDCListSubnets(w http.ResponseWriter, r *http.Request, p h
 // awsOIDCListDatabaseVPCs returns a list of VPCs using the ListVpcs action
 // of the AWS OIDC Integration, and includes a link to the ECS service if
 // a database service has been deployed for each VPC.
-func (h *Handler) awsOIDCListDatabaseVPCs(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCListDatabaseVPCs(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListVPCsRequest
@@ -1409,10 +1464,10 @@ func (h *Handler) awsOIDCListDatabaseVPCs(w http.ResponseWriter, r *http.Request
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1526,12 +1581,12 @@ func getServiceURLs(dbServices []types.DatabaseService, accountID, region, telep
 // awsOIDCPing performs an health check for the integration.
 // If ARN is present in the request body, that's the ARN that will be used instead of using the one stored in the integration.
 // Returns meta information: account id and assumed the ARN for the IAM Role.
-func (h *Handler) awsOIDCPing(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) awsOIDCPing(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	integrationName := p.ByName("name")
 	if integrationName == "" {
-		return nil, trace.BadParameter("an integration name is required")
+		return nil, trace.BadParameter("integration name is required")
 	}
 
 	var req ui.AWSOIDCPingRequest
@@ -1539,7 +1594,7 @@ func (h *Handler) awsOIDCPing(w http.ResponseWriter, r *http.Request, p httprout
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/integrations_awsoidc_test.go b/lib/web/integrations_awsoidc_test.go
index babdf4d56ed3d..ab6d27223fc0b 100644
--- a/lib/web/integrations_awsoidc_test.go
+++ b/lib/web/integrations_awsoidc_test.go
@@ -44,7 +44,7 @@ import (
 	"github.com/gravitational/teleport/lib/integrations/awsoidc/deployserviceconfig"
 	"github.com/gravitational/teleport/lib/services"
 	libui "github.com/gravitational/teleport/lib/ui"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -310,13 +310,173 @@ func TestBuildEC2SSMIAMScript(t *testing.T) {
 	}
 }
 
+func TestBuildAccessGraphCloudSyncIAMScript(t *testing.T) {
+	t.Parallel()
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	env := newWebPack(t, 1)
+
+	// Unauthenticated client for script downloading.
+	anonymousHTTPClient := env.proxies[0].newClient(t)
+	pathVars := []string{
+		"webapi",
+		"scripts",
+		"integrations",
+		"configure",
+		"access-graph-cloud-sync-iam.sh",
+	}
+	endpoint := anonymousHTTPClient.Endpoint(pathVars...)
+
+	role := "myRole"
+	awsAccountID := "123456789012"
+	sqsUrl := "https://sqs.us-west-2.amazonaws.com/123456789012/queue-name"
+	cloudTrailS3Bucket := "arn:aws:s3:::bucket-name"
+	kmsKey1 := "arn:aws:kms:us-west-2:123456789012:key/00000000-1111-2222-3333-444444444444"
+	kmsKey2 := "arn:aws:kms:us-west-2:123456789012:key/55555555-6666-7777-8888-999999999999"
+
+	tests := []struct {
+		name                 string
+		reqRelativeURL       string
+		reqQuery             url.Values
+		errCheck             require.ErrorAssertionFunc
+		expectedTeleportArgs string
+	}{
+		{
+			name: "valid",
+			reqQuery: url.Values{
+				"kind":         []string{"aws-iam"},
+				"role":         []string{role},
+				"awsAccountID": []string{awsAccountID},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure access-graph aws-iam" +
+				" --role=" + role +
+				" --aws-account-id=" + awsAccountID,
+		},
+		{
+			name: "valid with cloud trail",
+			reqQuery: url.Values{
+				"kind":               []string{"aws-iam"},
+				"role":               []string{role},
+				"awsAccountID":       []string{awsAccountID},
+				"sqsUrl":             []string{sqsUrl},
+				"cloudTrailS3Bucket": []string{cloudTrailS3Bucket},
+				"kmsKeysARNs":        []string{kmsKey1, kmsKey2},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure access-graph aws-iam" +
+				" --role=" + role +
+				" --aws-account-id=" + awsAccountID +
+				" --sqs-queue-url=" + sqsUrl +
+				" --cloud-trail-bucket=" + cloudTrailS3Bucket +
+				" --kms-key=" + kmsKey1 +
+				" --kms-key=" + kmsKey2,
+		},
+		{
+			name: "valid with eks audit logs",
+			reqQuery: url.Values{
+				"kind":         []string{"aws-iam"},
+				"role":         []string{role},
+				"awsAccountID": []string{awsAccountID},
+				"eksAuditLogs": []string{"true"},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure access-graph aws-iam" +
+				" --role=" + role +
+				" --aws-account-id=" + awsAccountID +
+				" --eks-audit-logs",
+		},
+		{
+			name: "valid with cloud trail and eks audit logs",
+			reqQuery: url.Values{
+				"kind":               []string{"aws-iam"},
+				"role":               []string{role},
+				"awsAccountID":       []string{awsAccountID},
+				"sqsUrl":             []string{sqsUrl},
+				"cloudTrailS3Bucket": []string{cloudTrailS3Bucket},
+				"kmsKeysARNs":        []string{kmsKey1, kmsKey2},
+				"eksAuditLogs":       []string{"true"},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure access-graph aws-iam" +
+				" --role=" + role +
+				" --aws-account-id=" + awsAccountID +
+				" --sqs-queue-url=" + sqsUrl +
+				" --cloud-trail-bucket=" + cloudTrailS3Bucket +
+				" --kms-key=" + kmsKey1 +
+				" --kms-key=" + kmsKey2 +
+				" --eks-audit-logs",
+		},
+		{
+			name: "valid with symbols in role",
+			reqQuery: url.Values{
+				"kind":         []string{"aws-iam"},
+				"role":         []string{"Test+1=2,3.4@5-6_7"},
+				"awsAccountID": []string{"123456789012"},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure access-graph aws-iam " +
+				"--role=Test\\+1=2,3.4\\@5-6_7 " +
+				"--aws-account-id=123456789012",
+		},
+		{
+			name: "missing kind",
+			reqQuery: url.Values{
+				"role":         []string{"myRole"},
+				"awsAccountID": []string{"123456789012"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing role",
+			reqQuery: url.Values{
+				"kind":         []string{"aws-iam"},
+				"awsAccountID": []string{"123456789012"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing awsAccountID",
+			reqQuery: url.Values{
+				"kind": []string{"aws-iam"},
+				"role": []string{"myRole"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "trying to inject escape sequence into query params",
+			reqQuery: url.Values{
+				"kind":         []string{"aws-iam"},
+				"role":         []string{"'; rm -rf /tmp/dir; echo '"},
+				"awsAccountID": []string{"123456789012"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			resp, err := anonymousHTTPClient.Get(t.Context(), endpoint, tc.reqQuery)
+			tc.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Contains(t, string(resp.Bytes()),
+				fmt.Sprintf("entrypointArgs='%s'\n", tc.expectedTeleportArgs),
+			)
+		})
+	}
+}
+
 func TestBuildAWSAppAccessConfigureIAMScript(t *testing.T) {
 	t.Parallel()
 	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
 		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
 	}
 
-	ctx := context.Background()
 	env := newWebPack(t, 1)
 
 	// Unauthenticated client for script downloading.
@@ -372,7 +532,7 @@ func TestBuildAWSAppAccessConfigureIAMScript(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			resp, err := anonymousHTTPClient.Get(ctx, endpoint, tc.reqQuery)
+			resp, err := anonymousHTTPClient.Get(t.Context(), endpoint, tc.reqQuery)
 			tc.errCheck(t, err)
 			if err != nil {
 				return
@@ -1154,7 +1314,7 @@ func (m *mockDeployedDatabaseServices) ListDeployedDatabaseServices(ctx context.
 
 func TestAWSOIDCListDeployedDatabaseServices(t *testing.T) {
 	ctx := context.Background()
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	for _, tt := range []struct {
 		name              string
diff --git a/lib/web/integrations_awsra.go b/lib/web/integrations_awsra.go
new file mode 100644
index 0000000000000..60b064ba87706
--- /dev/null
+++ b/lib/web/integrations_awsra.go
@@ -0,0 +1,281 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/google/safetext/shsprintf"
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+
+	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/aws"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/integrations/awscommon"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/web/scripts/oneoff"
+	"github.com/gravitational/teleport/lib/web/ui"
+)
+
+// awsRolesAnywhereConfigureTrustAnchor returns a script that configures AWS IAM Roles Anywhere Integration
+// by creating:
+// - IAM Roles Anywhere Trust Anchor which trusts the Teleport AWS RA CA
+// - Roles Anywhere to Apps sync process:
+//   - IAM Role which can be assumed by the Trust Anchor and allows the APIs required by the sync process
+//   - IAM Roles Anywhere Profile which allows access to the IAM Role above
+//
+// It requires the following query parameters:
+// - integrationName: the name of the AWS IAM Roles Anywhere Integration
+// - trustAnchor: the name of the Trust Anchor to be created
+// - syncRole: the name of the IAM Role to be created
+// - syncProfile: the name of the IAM Roles Anywhere Profile to be created
+func (h *Handler) awsRolesAnywhereConfigureTrustAnchor(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+	ctx := r.Context()
+
+	queryParams := r.URL.Query()
+
+	integrationName := queryParams.Get("integrationName")
+	if integrationName == "" {
+		return nil, trace.BadParameter("missing integrationName param")
+	}
+
+	trustAnchorName := queryParams.Get("trustAnchor")
+	if trustAnchorName == "" {
+		return nil, trace.BadParameter("missing trustAnchor param")
+	}
+	if err := aws.IsValidIAMRolesAnywhereTrustAnchorName(trustAnchorName); err != nil {
+		return nil, trace.BadParameter("invalid trustAnchor %q", trustAnchorName)
+	}
+
+	syncRoleName := queryParams.Get("syncRole")
+	if syncRoleName == "" {
+		return nil, trace.BadParameter("missing syncRole param")
+	}
+	if err := aws.IsValidIAMRoleName(syncRoleName); err != nil {
+		return nil, trace.BadParameter("invalid role %q", syncRoleName)
+	}
+
+	syncProfileName := queryParams.Get("syncProfile")
+	if syncProfileName == "" {
+		return nil, trace.BadParameter("missing syncProfile param")
+	}
+	if err := aws.IsValidIAMRolesAnywhereProfileName(syncProfileName); err != nil {
+		return nil, trace.BadParameter("invalid syncProfile %q", syncProfileName)
+	}
+
+	clusterName, err := h.GetProxyClient().GetDomainName(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Ensure the IntegrationName is valid.
+	_, err = h.GetProxyClient().GetIntegration(ctx, integrationName)
+	// NotFound error is ignored to prevent disclosure of whether the integration exists in a public/no-auth endpoint.
+	if err != nil && !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
+	authorities, err := client.ExportAllAuthorities(
+		ctx,
+		h.GetProxyClient(),
+		client.ExportAuthoritiesRequest{
+			AuthType: string(types.AWSRACA),
+		},
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if len(authorities) == 0 {
+		return nil, trace.NotFound("no AWS IAM Roles Anywhere CA found")
+	}
+
+	var certAuthoritiesData [][]byte
+	for _, authority := range authorities {
+		certAuthoritiesData = append(certAuthoritiesData, authority.Data)
+	}
+
+	awsRACACertB64 := base64.RawStdEncoding.EncodeToString(bytes.Join(certAuthoritiesData, []byte("\n")))
+
+	// The script must execute the following command:
+	// teleport integration configure awsra-trust-anchor
+	argsList := []string{
+		"integration", "configure", "awsra-trust-anchor",
+		fmt.Sprintf("--cluster=%s", shsprintf.EscapeDefaultContext(clusterName)),
+		fmt.Sprintf("--name=%s", shsprintf.EscapeDefaultContext(integrationName)),
+		fmt.Sprintf("--trust-anchor=%s", shsprintf.EscapeDefaultContext(trustAnchorName)),
+		fmt.Sprintf("--sync-profile=%s", shsprintf.EscapeDefaultContext(syncProfileName)),
+		fmt.Sprintf("--sync-role=%s", shsprintf.EscapeDefaultContext(syncRoleName)),
+		fmt.Sprintf("--trust-anchor-cert-b64=%s", awsRACACertB64),
+	}
+
+	script, err := oneoff.BuildScript(oneoff.OneOffScriptParams{
+		EntrypointArgs: strings.Join(argsList, " "),
+		SuccessMessage: "Success! You can now go back to the Teleport Web UI to continue the setup.",
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	httplib.SetScriptHeaders(w.Header())
+	_, err = w.Write([]byte(script))
+
+	return nil, trace.Wrap(err)
+}
+
+// validateAWSRolesAnywhereIntegration performs a validation for the AWS Roles Anywhere Integration name.
+// This ensures the integration name is not yet being used and that it is a valid name.
+func (h *Handler) validateAWSRolesAnywhereIntegration(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	ctx := r.Context()
+
+	integrationName := p.ByName("name")
+	if integrationName == "" {
+		return nil, trace.BadParameter("integration name is required")
+	}
+
+	// validate integration name.
+	if err := awscommon.ValidIntegrationName(integrationName); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	_, err = clt.GetIntegration(ctx, integrationName)
+	switch {
+	case err == nil:
+		return nil, trace.AlreadyExists("integration named %q already exists", integrationName)
+
+	case trace.IsNotFound(err):
+
+	default:
+		return nil, trace.Wrap(err)
+	}
+
+	return OK(), nil
+}
+
+// awsRolesAnywherePing performs an health check for the integration.
+// It returns the caller identity and the number of AWS Roles Anywhere Profiles that are active.
+// If a trust anchor is provided in the body, it will be used to check the connection ignoring the integration.
+// Otherwise, the integration is used to check the connection.
+func (h *Handler) awsRolesAnywherePing(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	ctx := r.Context()
+
+	integrationName := p.ByName("name")
+	if integrationName == "" {
+		return nil, trace.BadParameter("integration name is required")
+	}
+
+	var req ui.AWSRolesAnywherePingRequest
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	pingRequest := &integrationv1.AWSRolesAnywherePingRequest{}
+
+	// When creating an integration, the Ping is called with an empty integration, but Trust Anchor, Profile and Role ARNs must be provided.
+	// This allow us to check if the integration is properly configured before creating it.
+	switch {
+	case req.TrustAnchorARN != "":
+		if req.SyncRoleARN == "" || req.SyncProfileARN == "" {
+			return nil, trace.BadParameter("sync role and sync profile ARNs must be provided when trust anchor ARN is provided")
+		}
+
+		pingRequest.Mode = &integrationv1.AWSRolesAnywherePingRequest_Custom{
+			Custom: &integrationv1.AWSRolesAnywherePingRequestWithoutIntegration{
+				TrustAnchorArn: req.TrustAnchorARN,
+				RoleArn:        req.SyncRoleARN,
+				ProfileArn:     req.SyncProfileARN,
+			},
+		}
+
+	default:
+		pingRequest.Mode = &integrationv1.AWSRolesAnywherePingRequest_Integration{
+			Integration: integrationName,
+		}
+	}
+
+	pingResp, err := clt.IntegrationAWSRolesAnywhereClient().AWSRolesAnywherePing(ctx, pingRequest)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return ui.AWSRolesAnywherePingResponse{
+		ProfileCount: int(pingResp.GetProfileCount()),
+		AccountID:    pingResp.GetAccountId(),
+		ARN:          pingResp.GetArn(),
+		UserID:       pingResp.GetUserId(),
+	}, nil
+}
+
+// awsRolesAnywhereListProfiles lists profiles Roles Anywhere Profiles accessible by the integration.
+func (h *Handler) awsRolesAnywhereListProfiles(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	ctx := r.Context()
+
+	integrationName := p.ByName("name")
+	if integrationName == "" {
+		return nil, trace.BadParameter("integration name is required")
+	}
+
+	var req ui.AWSRolesAnywhereListProfilesRequest
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	allProfiles := &integrationv1.ListRolesAnywhereProfilesResponse{}
+	var startKey string
+	for {
+		listResp, err := clt.IntegrationAWSRolesAnywhereClient().ListRolesAnywhereProfiles(ctx, &integrationv1.ListRolesAnywhereProfilesRequest{
+			Integration:        integrationName,
+			NextPageToken:      startKey,
+			ProfileNameFilters: req.Filters,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		allProfiles.Profiles = append(allProfiles.Profiles, listResp.Profiles...)
+
+		startKey = listResp.NextPageToken
+		if startKey == "" {
+			break
+		}
+	}
+
+	return allProfiles, nil
+}
diff --git a/lib/web/integrations_awsra_test.go b/lib/web/integrations_awsra_test.go
new file mode 100644
index 0000000000000..c20da94423f5e
--- /dev/null
+++ b/lib/web/integrations_awsra_test.go
@@ -0,0 +1,181 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"context"
+	"net/url"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+func TestBuildAWSRATrustAnchorConfigureScript(t *testing.T) {
+	t.Parallel()
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	ctx := context.Background()
+	env := newWebPack(t, 1)
+
+	// Unauthenticated client for script downloading.
+	publicClt := env.proxies[0].newClient(t)
+	pathVars := []string{
+		"webapi",
+		"scripts",
+		"integrations",
+		"configure",
+		"awsra-trust-anchor.sh",
+	}
+	scriptEndpoint := publicClt.Endpoint(pathVars...)
+
+	baseQueryParams := func() url.Values {
+		return url.Values{
+			"integrationName": []string{"myintegration"},
+			"trustAnchor":     []string{"my-trust-anchor"},
+			"syncProfile":     []string{"my-profile-for-sync"},
+			"syncRole":        []string{"my-role-for-sync"},
+		}
+	}
+
+	tests := []struct {
+		name                 string
+		reqRelativeURL       string
+		reqQuery             func() url.Values
+		errCheck             require.ErrorAssertionFunc
+		expectedTeleportArgs string
+	}{
+		{
+			name:     "valid",
+			reqQuery: baseQueryParams,
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure awsra-trust-anchor " +
+				"--cluster=localhost " +
+				"--name=myintegration " +
+				"--trust-anchor=my-trust-anchor " +
+				"--sync-profile=my-profile-for-sync " +
+				"--sync-role=my-role-for-sync ",
+		},
+		{
+			name: "missing integration name",
+			reqQuery: func() url.Values {
+				q := baseQueryParams()
+				q.Del("integrationName")
+				return q
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing trust anchor",
+			reqQuery: func() url.Values {
+				q := baseQueryParams()
+				q.Del("trustAnchor")
+				return q
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing sync profile name",
+			reqQuery: func() url.Values {
+				q := baseQueryParams()
+				q.Del("syncProfile")
+				return q
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing sync role name",
+			reqQuery: func() url.Values {
+				q := baseQueryParams()
+				q.Del("syncRole")
+				return q
+			},
+			errCheck: isBadParamErrFn,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			resp, err := publicClt.Get(ctx, scriptEndpoint, tc.reqQuery())
+			tc.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Contains(t, string(resp.Bytes()), "entrypointArgs='"+tc.expectedTeleportArgs)
+		})
+	}
+}
+
+func TestValidateAWSRolesAnywhereIntegration(t *testing.T) {
+	t.Parallel()
+	wPack := newWebPack(t, 1 /* proxies */)
+	proxy := wPack.proxies[0]
+	authPack := proxy.authPack(t, "user", []types.Role{services.NewPresetEditorRole()})
+	ctx := t.Context()
+
+	existingIntegration, err := types.NewIntegrationAWSOIDC(types.Metadata{
+		Name: "existing-integration",
+	}, &types.AWSOIDCIntegrationSpecV1{
+		RoleARN: "arn:aws:iam::123456789012:role/valid-role",
+	})
+	require.NoError(t, err)
+
+	_, err = wPack.server.Auth().CreateIntegration(ctx, existingIntegration)
+	require.NoError(t, err)
+
+	for _, tt := range []struct {
+		name            string
+		integrationName string
+		errCheck        require.ErrorAssertionFunc
+	}{
+		{
+			name:            "valid",
+			integrationName: "valid-integration",
+			errCheck:        require.NoError,
+		},
+		{
+			name:            "invalid",
+			integrationName: "INVALID-",
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "must be a lower case valid DNS subdomain")
+			},
+		},
+		{
+			name:            "valid name but it already exists",
+			integrationName: "existing-integration",
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.Error(tt, err)
+				require.ErrorContains(tt, err, "already exists")
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			endpoint := authPack.clt.Endpoint("webapi", "sites", wPack.server.ClusterName(), "integrations", "aws-ra", tt.integrationName, "validate")
+			_, err := authPack.clt.PostJSON(ctx, endpoint, nil)
+			tt.errCheck(t, err)
+		})
+	}
+}
diff --git a/lib/web/integrations_azureoidc.go b/lib/web/integrations_azureoidc.go
index 3a1dd654550e5..24886cd7dc81d 100644
--- a/lib/web/integrations_azureoidc.go
+++ b/lib/web/integrations_azureoidc.go
@@ -74,7 +74,7 @@ func (h *Handler) azureOIDCConfigure(w http.ResponseWriter, r *http.Request, p h
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
diff --git a/lib/web/integrations_samlidp.go b/lib/web/integrations_samlidp.go
index eda5dac78a265..77ee47022f8af 100644
--- a/lib/web/integrations_samlidp.go
+++ b/lib/web/integrations_samlidp.go
@@ -64,7 +64,7 @@ func (h *Handler) gcpWorkforceConfigScript(w http.ResponseWriter, r *http.Reques
 	}
 
 	httplib.SetScriptHeaders(w.Header())
-	_, err = fmt.Fprint(w, script)
+	_, err = w.Write([]byte(script))
 
 	return nil, trace.Wrap(err)
 }
diff --git a/lib/web/integrations_test.go b/lib/web/integrations_test.go
index 17b44412f1084..4f73122a0991b 100644
--- a/lib/web/integrations_test.go
+++ b/lib/web/integrations_test.go
@@ -21,6 +21,7 @@ package web
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"strconv"
 	"testing"
 	"time"
@@ -40,9 +41,10 @@ import (
 	"github.com/gravitational/teleport/api/types/usertasks"
 	"github.com/gravitational/teleport/lib/auth/integration/credentials"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	libui "github.com/gravitational/teleport/lib/ui"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -170,9 +172,10 @@ func TestIntegrationsCRUDRolesAnywhere(t *testing.T) {
 		AWSRA: &ui.IntegrationAWSRASpec{
 			TrustAnchorARN: updatedTrustAnchor,
 			ProfileSyncConfig: ui.AWSRAProfileSync{
-				Enabled:    true,
-				ProfileARN: syncProfileARN,
-				RoleARN:    syncRoleARN,
+				Enabled:            true,
+				ProfileARN:         syncProfileARN,
+				RoleARN:            syncRoleARN,
+				ProfileNameFilters: []string{"ExposedProfile-*"},
 			},
 		},
 	}
@@ -196,6 +199,8 @@ func TestIntegrationsCRUDRolesAnywhere(t *testing.T) {
 	require.True(t, integrationObject.AWSRA.ProfileSyncConfig.Enabled)
 	require.Equal(t, syncProfileARN, integrationObject.AWSRA.ProfileSyncConfig.ProfileARN)
 	require.Equal(t, syncRoleARN, integrationObject.AWSRA.ProfileSyncConfig.RoleARN)
+	require.Len(t, integrationObject.AWSRA.ProfileSyncConfig.ProfileNameFilters, 1)
+	require.Equal(t, "ExposedProfile-*", integrationObject.AWSRA.ProfileSyncConfig.ProfileNameFilters[0])
 
 	// Delete Integration
 	err = wPack.server.Auth().DeleteIntegration(ctx, integrationName)
@@ -240,9 +245,9 @@ func (m *mockUserTasksLister) ListUserTasks(ctx context.Context, pageSize int64,
 	return ret, "", nil
 }
 
-func TestCollectAWSOIDCAutoDiscoverStats(t *testing.T) {
+func TestCollectIntegrationStats(t *testing.T) {
 	ctx := context.Background()
-	logger := utils.NewSlogLoggerForTests()
+	logger := logtest.NewLogger()
 
 	integrationName := "my-integration"
 	integration, err := types.NewIntegrationAWSOIDC(
@@ -501,6 +506,152 @@ func TestCollectAWSOIDCAutoDiscoverStats(t *testing.T) {
 		}
 		require.Equal(t, expectedSummary, gotSummary)
 	})
+
+	t.Run("returns AWS IAM Roles Anywhere Profile Sync status", func(t *testing.T) {
+		syncStartTime := time.Now()
+		syncEndTime := syncStartTime.Add(5 * time.Minute)
+		integrationName := "my-integration"
+		integration, err := types.NewIntegrationAWSRA(
+			types.Metadata{Name: integrationName},
+			&types.AWSRAIntegrationSpecV1{
+				TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+				ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+					Enabled:                       true,
+					ProfileARN:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+					ProfileAcceptsRoleSessionName: true,
+					RoleARN:                       "arn:aws:iam::123456789012:role/SyncRole",
+				},
+			},
+		)
+		require.NoError(t, err)
+		integration.SetStatus(types.IntegrationStatusV1{
+			AWSRolesAnywhere: &types.AWSRAIntegrationStatusV1{
+				LastProfileSync: &types.AWSRolesAnywhereProfileSyncIterationSummary{
+					Status:         "SUCCESS",
+					SyncedProfiles: 4,
+					StartTime:      syncStartTime,
+					EndTime:        syncEndTime,
+				},
+			},
+		})
+
+		clt := &mockRelevantAWSRegionsClient{
+			discoveryConfigs: []*discoveryconfig.DiscoveryConfig{},
+			databaseServices: &proto.ListResourcesResponse{},
+			databases: []types.Database{
+				&types.DatabaseV3{Spec: types.DatabaseSpecV3{AWS: types.AWS{Region: "us-west-1"}}},
+			},
+		}
+
+		deployedDatabaseServicesClient := &mockDeployedDatabaseServices{
+			listErr: errors.New("only aws oidc integrations can list deployed database services"),
+		}
+		req := collectIntegrationStatsRequest{
+			logger:                logger,
+			integration:           integration,
+			discoveryConfigLister: clt,
+			databaseGetter:        clt,
+			awsOIDCClient:         deployedDatabaseServicesClient,
+			userTasksClient:       &mockUserTasksLister{},
+		}
+		gotSummary, err := collectIntegrationStats(ctx, req)
+		require.NoError(t, err)
+		expectedSummary := &ui.IntegrationWithSummary{
+			Integration: &ui.Integration{
+				Name:    integrationName,
+				SubKind: "aws-ra",
+				AWSRA: &ui.IntegrationAWSRASpec{
+					TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+					ProfileSyncConfig: ui.AWSRAProfileSync{
+						Enabled:    true,
+						ProfileARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+						RoleARN:    "arn:aws:iam::123456789012:role/SyncRole",
+					},
+				},
+			},
+			RolesAnywhereProfileSync: &ui.RolesAnywhereProfileSync{
+				Enabled:        true,
+				Status:         "SUCCESS",
+				SyncedProfiles: 4,
+				SyncStartTime:  syncStartTime,
+				SyncEndTime:    syncEndTime,
+			},
+		}
+		require.Equal(t, expectedSummary, gotSummary)
+	})
+
+	t.Run("returns AWS IAM Roles Anywhere Profile Sync status with error message", func(t *testing.T) {
+		syncStartTime := time.Now()
+		syncEndTime := syncStartTime.Add(5 * time.Minute)
+		integrationName := "my-integration"
+		integration, err := types.NewIntegrationAWSRA(
+			types.Metadata{Name: integrationName},
+			&types.AWSRAIntegrationSpecV1{
+				TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+				ProfileSyncConfig: &types.AWSRolesAnywhereProfileSyncConfig{
+					Enabled:                       true,
+					ProfileARN:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+					ProfileAcceptsRoleSessionName: true,
+					RoleARN:                       "arn:aws:iam::123456789012:role/SyncRole",
+				},
+			},
+		)
+		require.NoError(t, err)
+		integration.SetStatus(types.IntegrationStatusV1{
+			AWSRolesAnywhere: &types.AWSRAIntegrationStatusV1{
+				LastProfileSync: &types.AWSRolesAnywhereProfileSyncIterationSummary{
+					Status:         "ERROR",
+					SyncedProfiles: 0,
+					StartTime:      syncStartTime,
+					EndTime:        syncEndTime,
+					ErrorMessage:   "Failed to sync profiles due to access denied error",
+				},
+			},
+		})
+
+		clt := &mockRelevantAWSRegionsClient{
+			discoveryConfigs: []*discoveryconfig.DiscoveryConfig{},
+			databaseServices: &proto.ListResourcesResponse{},
+			databases:        make([]types.Database, 0),
+		}
+
+		deployedDatabaseServicesClient := &mockDeployedDatabaseServices{
+			listErr: trace.AccessDenied("AccessDenied to ECS:ListServices"),
+		}
+		req := collectIntegrationStatsRequest{
+			logger:                logger,
+			integration:           integration,
+			discoveryConfigLister: clt,
+			databaseGetter:        clt,
+			awsOIDCClient:         deployedDatabaseServicesClient,
+			userTasksClient:       &mockUserTasksLister{},
+		}
+		gotSummary, err := collectIntegrationStats(ctx, req)
+		require.NoError(t, err)
+		expectedSummary := &ui.IntegrationWithSummary{
+			Integration: &ui.Integration{
+				Name:    integrationName,
+				SubKind: "aws-ra",
+				AWSRA: &ui.IntegrationAWSRASpec{
+					TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+					ProfileSyncConfig: ui.AWSRAProfileSync{
+						Enabled:    true,
+						ProfileARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid2",
+						RoleARN:    "arn:aws:iam::123456789012:role/SyncRole",
+					},
+				},
+			},
+			RolesAnywhereProfileSync: &ui.RolesAnywhereProfileSync{
+				Enabled:        true,
+				Status:         "ERROR",
+				SyncedProfiles: 0,
+				SyncStartTime:  syncStartTime,
+				SyncEndTime:    syncEndTime,
+				ErrorMessage:   "Failed to sync profiles due to access denied error",
+			},
+		}
+		require.Equal(t, expectedSummary, gotSummary)
+	})
 }
 
 func TestCollectAutoDiscoveryRules(t *testing.T) {
@@ -793,7 +944,7 @@ func TestCollectAutoDiscoveryRules(t *testing.T) {
 // The test cases in this test are performed sequentially and each test case
 // depends on the previous state.
 func TestGitHubIntegration(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	wPack := newWebPack(t, 1 /* proxies */)
 	proxy := wPack.proxies[0]
diff --git a/lib/web/join_tokens.go b/lib/web/join_tokens.go
index 9a330d3466a69..c4b0dea9a2f11 100644
--- a/lib/web/join_tokens.go
+++ b/lib/web/join_tokens.go
@@ -27,6 +27,7 @@ import (
 	"net/url"
 	"reflect"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -37,8 +38,10 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/ui"
@@ -98,9 +101,60 @@ func (h *Handler) getTokens(w http.ResponseWriter, r *http.Request, params httpr
 		return nil, trace.Wrap(err)
 	}
 
-	tokens, err := clt.GetTokens(r.Context())
-	if err != nil {
-		return nil, trace.Wrap(err)
+	// There are 3 tokens types:
+	// - provision tokens
+	// - static tokens
+	// - user tokens
+	// This endpoint returns all 3 for compatibility reasons.
+	// Before, all 3 tokens were returned by the same "GetTokens" RPC, now we are using
+	// separate RPCs, with pagination. However, we don't know if the auth we are talking
+	// to supports the new RPCs. As the static token one got introduced last, we
+	// try to use it.If it works, we consume the two other RPCs. If it doesn't,
+	// we fallback to the legacy all-in-one RPC.
+	var tokens []types.ProvisionToken
+
+	// Trying to get static tokens
+	staticTokens, err := clt.GetStaticTokens(r.Context())
+	if err != nil && !trace.IsNotImplemented(err) {
+		return nil, trace.Wrap(err, "getting static tokens")
+	}
+
+	// TODO(hugoShaka): DELETE IN 19.0.0
+	if trace.IsNotImplemented(err) {
+		// We are connected to an old auth, that doesn't support the per-token type RPCs
+		// so we fallback to the legacy all-in-one RPC.
+		tokens, err = clt.GetTokens(r.Context())
+		if err != nil {
+			return nil, trace.Wrap(err, "getting all tokens through the legacy RPC")
+		}
+	} else {
+		// We are connected to a modern auth, we must collect all 3 tokens types.
+		// Getting the provision tokens.
+		provisionTokens, err := stream.Collect(clientutils.Resources(r.Context(),
+			func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+				return clt.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+			},
+		))
+		if err != nil {
+			return nil, trace.Wrap(err, "getting provision tokens")
+		}
+		tokens = append(staticTokens.GetStaticTokens(), provisionTokens...)
+
+		// Getting the user tokens.
+		userTokens, err := stream.Collect(clientutils.Resources(r.Context(), clt.ListResetPasswordTokens))
+		if err != nil {
+			return nil, trace.Wrap(err, "getting user tokens")
+		}
+		// Converting the user tokens as provision tokens for presentation and
+		// backward compatibility.
+		for _, t := range userTokens {
+			roles := types.SystemRoles{types.RoleSignup}
+			tok, err := types.NewProvisionToken(t.GetName(), roles, t.Expiry())
+			if err != nil {
+				return nil, trace.Wrap(err, "converting user token as a provision token")
+			}
+			tokens = append(tokens, tok)
+		}
 	}
 
 	uiTokens, err := webui.MakeJoinTokens(tokens)
@@ -113,7 +167,52 @@ func (h *Handler) getTokens(w http.ResponseWriter, r *http.Request, params httpr
 	}, nil
 }
 
-func (h *Handler) deleteToken(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
+// ListProvisionTokensResponse contains a paginated list of provision tokens.
+type ListProvisionTokensResponse struct {
+	Items         []webui.JoinToken `json:"items"`
+	NextPageToken string            `json:"next_page_token,omitempty"`
+}
+
+// listProvisionTokens returns a paginated list of provision tokens. Items can
+// be filtered by role and bot name. Tokens with ANY of the provided roles are
+// returned. If a bot name is provided, only tokens having a role of Bot are
+// returned.
+func (h *Handler) listProvisionTokens(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (any, error) {
+	clt, err := ctx.GetClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var pageSize int64 = 20
+	if r.URL.Query().Has("page_size") {
+		pageSize, err = strconv.ParseInt(r.URL.Query().Get("page_size"), 10, 32)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to parse page_size")
+		}
+	}
+
+	roles, err := types.NewTeleportRoles(r.URL.Query()["role"])
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	items, nextToken, err := clt.ListProvisionTokens(r.Context(), int(pageSize), r.URL.Query().Get("page_token"), roles, r.URL.Query().Get("bot_name"))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	uiTokens, err := webui.MakeJoinTokens(items)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return ListProvisionTokensResponse{
+		Items:         uiTokens,
+		NextPageToken: nextToken,
+	}, nil
+}
+
+func (h *Handler) deleteToken(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (any, error) {
 	token := r.Header.Get(HeaderTokenName)
 	if token == "" {
 		return nil, trace.BadParameter("requires a token to delete")
@@ -205,8 +304,8 @@ func (h *Handler) upsertTokenHandle(w http.ResponseWriter, r *http.Request, para
 
 	var expires time.Time
 	switch req.JoinMethod {
-	case types.JoinMethodGCP, types.JoinMethodIAM, types.JoinMethodOracle, types.JoinMethodGitHub:
-		// IAM, GCP, Oracle and GitHub tokens should never expire.
+	case types.JoinMethodGCP, types.JoinMethodIAM, types.JoinMethodOracle, types.JoinMethodGitHub, types.JoinMethodGitLab:
+		// IAM, GCP, Oracle, GitHub and GitLab tokens should never expire.
 		expires = time.Time{}
 	default:
 		// Set expires time to default node join token TTL.
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index d605984443c07..027ec68441e27 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/durationpb"
@@ -47,14 +48,16 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/automaticupgrades"
+	autoupdatelookup "github.com/gravitational/teleport/lib/autoupdate/lookup"
 	"github.com/gravitational/teleport/lib/boundkeypair"
-	"github.com/gravitational/teleport/lib/boundkeypair/boundkeypairexperiment"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/services"
 	libui "github.com/gravitational/teleport/lib/ui"
 	utils "github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -98,6 +101,7 @@ func TestGenerateIAMTokenName(t *testing.T) {
 
 type tokenData struct {
 	name   string
+	labels map[string]string
 	expiry time.Time
 	spec   types.ProvisionTokenSpecV2
 }
@@ -146,6 +150,30 @@ func TestGetTokens(t *testing.T) {
 			},
 			includeUserToken: true,
 		},
+		{
+			name: "cloud managed",
+			tokenData: []tokenData{
+				{
+					name: "cloud-iam",
+					spec: types.ProvisionTokenSpecV2{
+						Roles: types.SystemRoles{types.RoleProxy},
+					},
+					labels: map[string]string{"teleport.internal/cloud/token": "iam"},
+					expiry: expiry,
+				},
+			},
+			expected: []ui.JoinToken{
+				staticUIToken,
+				{
+					ID:            "cloud-iam",
+					SafeName:      "*********",
+					Expiry:        expiry,
+					Roles:         types.SystemRoles{types.RoleProxy},
+					IsCloudSystem: true, // due to presence of the teleport.internal/cloud/token label
+					Method:        "token",
+				},
+			},
+		},
 		{
 			name: "all tokens",
 			tokenData: []tokenData{
@@ -239,7 +267,7 @@ func TestGetTokens(t *testing.T) {
 									Workflow:        "test-workflow",
 									Environment:     "test-environment",
 									Actor:           "octocat",
-									Ref:             "ref/heads/main",
+									Ref:             "refs/heads/main",
 									RefType:         "branch",
 								},
 							},
@@ -266,7 +294,7 @@ func TestGetTokens(t *testing.T) {
 								Workflow:        "test-workflow",
 								Environment:     "test-environment",
 								Actor:           "octocat",
-								Ref:             "ref/heads/main",
+								Ref:             "refs/heads/main",
 								RefType:         "branch",
 							},
 						},
@@ -317,6 +345,13 @@ func TestGetTokens(t *testing.T) {
 			for _, td := range tc.tokenData {
 				token, err := types.NewProvisionTokenFromSpec(td.name, td.expiry, td.spec)
 				require.NoError(t, err)
+
+				if len(td.labels) > 0 {
+					m := token.GetMetadata()
+					m.Labels = td.labels
+					token.SetMetadata(m)
+				}
+
 				err = env.server.Auth().CreateToken(ctx, token)
 				require.NoError(t, err)
 			}
@@ -328,11 +363,135 @@ func TestGetTokens(t *testing.T) {
 			resp := GetTokensResponse{}
 			require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
 			require.Len(t, resp.Items, len(tc.expected))
-			require.Empty(t, cmp.Diff(resp.Items, tc.expected, cmpopts.IgnoreFields(ui.JoinToken{}, "Content")))
+			require.Empty(t, cmp.Diff(tc.expected, resp.Items, cmpopts.IgnoreFields(ui.JoinToken{}, "Content"), cmpopts.SortSlices(func(a, b ui.JoinToken) bool { return a.ID < b.ID })))
 		})
 	}
 }
 
+func TestListProvisionTokens(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	expiry := time.Now().UTC().Add(30 * time.Minute)
+
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "test-user@example.com", nil /* roles */)
+
+	items := []struct {
+		name string
+		spec types.ProvisionTokenSpecV2
+	}{
+		{
+			name: "test-token-3",
+			spec: types.ProvisionTokenSpecV2{
+				Roles:   types.SystemRoles{types.RoleBot, types.RoleNode},
+				BotName: "bot-2",
+			},
+		},
+		{
+			name: "test-token-1",
+			spec: types.ProvisionTokenSpecV2{
+				Roles: types.SystemRoles{types.RoleNode},
+			},
+		},
+		{
+			name: "test-token-2",
+			spec: types.ProvisionTokenSpecV2{
+				Roles:   types.SystemRoles{types.RoleBot},
+				BotName: "bot-1",
+			},
+		},
+	}
+
+	for _, item := range items {
+		token, err := types.NewProvisionTokenFromSpec(
+			item.name,
+			expiry,
+			item.spec)
+		require.NoError(t, err)
+		err = env.server.Auth().CreateToken(ctx, token)
+		require.NoError(t, err)
+	}
+
+	endpoint := pack.clt.Endpoint("v2", "webapi", "tokens")
+
+	t.Run("paging", func(t *testing.T) {
+		re, err := pack.clt.Get(ctx, endpoint, url.Values{
+			"page_token": []string{""}, // default to the start
+			"page_size":  []string{strconv.Itoa(2)},
+		})
+		require.NoError(t, err)
+		resp := ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+
+		require.Len(t, resp.Items, 2)
+		assert.Equal(t, "test-token-3", resp.NextPageToken)
+		assert.Equal(t, "test-token-1", resp.Items[0].ID)
+		assert.Equal(t, "test-token-2", resp.Items[1].ID)
+
+		re, err = pack.clt.Get(ctx, endpoint, url.Values{
+			"page_token": []string{resp.NextPageToken},
+			"page_size":  []string{strconv.Itoa(2)},
+		})
+		require.NoError(t, err)
+		resp = ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+
+		require.Len(t, resp.Items, 1)
+		assert.Empty(t, resp.NextPageToken)
+		assert.Equal(t, "test-token-3", resp.Items[0].ID)
+	})
+
+	t.Run("filter by roles", func(t *testing.T) {
+		re, err := pack.clt.Get(ctx, endpoint, url.Values{
+			"role": []string{"Node", "Bot"},
+		})
+		require.NoError(t, err)
+		resp := ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+		require.Len(t, resp.Items, 3)
+
+		re, err = pack.clt.Get(ctx, endpoint, url.Values{
+			"role": []string{"Node"},
+		})
+		require.NoError(t, err)
+		resp = ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+		require.Len(t, resp.Items, 2)
+		assert.Equal(t, "test-token-1", resp.Items[0].ID)
+		assert.Equal(t, "test-token-3", resp.Items[1].ID)
+
+		re, err = pack.clt.Get(ctx, endpoint, url.Values{
+			"role": []string{"Bot"},
+		})
+		require.NoError(t, err)
+		resp = ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+		require.Len(t, resp.Items, 2)
+		assert.Equal(t, "test-token-2", resp.Items[0].ID)
+		assert.Equal(t, "test-token-3", resp.Items[1].ID)
+	})
+
+	t.Run("filter by bot name", func(t *testing.T) {
+		re, err := pack.clt.Get(ctx, endpoint, url.Values{
+			"bot_name": []string{""},
+		})
+		require.NoError(t, err)
+		resp := ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+		require.Len(t, resp.Items, 3)
+
+		re, err = pack.clt.Get(ctx, endpoint, url.Values{
+			"bot_name": []string{"bot-1"},
+		})
+		require.NoError(t, err)
+		resp = ListProvisionTokensResponse{}
+		require.NoError(t, json.Unmarshal(re.Bytes(), &resp))
+		require.Len(t, resp.Items, 1)
+		assert.Equal(t, "test-token-2", resp.Items[0].ID)
+	})
+}
+
 func TestDeleteToken(t *testing.T) {
 	ctx := context.Background()
 	username := "test-user@example.com"
@@ -474,16 +633,13 @@ func TestEditToken(t *testing.T) {
 func TestCreateTokenExpiry(t *testing.T) {
 	// Can't t.Parallel because of modules.SetTestModules.
 	// Use enterprise build to access token types such as TPM and Spacelift
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Cloud: false,
 		},
 	})
 
-	// TODO: Remove this once bound keypair experiment flag is removed.
-	boundkeypairexperiment.SetEnabled(true)
-
 	ctx := context.Background()
 	username := "test-user@example.com"
 	env := newWebPack(t, 1)
@@ -500,7 +656,7 @@ func TestCreateTokenExpiry(t *testing.T) {
 
 			var expectedExpiry time.Time
 			switch method {
-			case types.JoinMethodGCP, types.JoinMethodIAM, types.JoinMethodOracle, types.JoinMethodGitHub:
+			case types.JoinMethodGCP, types.JoinMethodIAM, types.JoinMethodOracle, types.JoinMethodGitHub, types.JoinMethodGitLab:
 				expectedExpiry = time.Time{}
 			default:
 				expectedExpiry = time.Now().UTC().Add(4 * time.Hour)
@@ -637,6 +793,15 @@ func setMinimalConfigForMethod(spec *types.ProvisionTokenSpecV2, method types.Jo
 				Mode: boundkeypair.RecoveryModeInsecure,
 			},
 		}
+	case types.JoinMethodEnv0:
+		spec.Env0 = &types.ProvisionTokenSpecV2Env0{
+			Allow: []*types.ProvisionTokenSpecV2Env0_Rule{
+				{
+					OrganizationID: "example-organization-id",
+					ProjectName:    "example-project-name",
+				},
+			},
+		}
 	}
 }
 
@@ -1215,8 +1380,13 @@ func (a *autoupdateProxyClientMock) GetClusterCACert(ctx context.Context) (*prot
 	return args.Get(0).(*proto.GetClusterCACertResponse), args.Error(1)
 }
 
+func (a *autoupdateProxyClientMock) GetClusterMaintenanceConfig(ctx context.Context) (types.ClusterMaintenanceConfig, error) {
+	args := a.Called(ctx)
+	return args.Get(0).(types.ClusterMaintenanceConfig), args.Error(1)
+}
+
 type autoupdateTestHandlerConfig struct {
-	testModules *modules.TestModules
+	testModules *modulestest.Modules
 	hostname    string
 	port        int
 	channels    automaticupgrades.Channels
@@ -1253,22 +1423,34 @@ func newAutoupdateTestHandler(t *testing.T, config autoupdateTestHandlerConfig)
 	}
 
 	clt.On("GetClusterCACert", mock.Anything).Return(&proto.GetClusterCACertResponse{TLSCA: []byte(fixtures.SigningCertPEM)}, nil)
+	clt.On("GetClusterMaintenanceConfig", mock.Anything).Return(nil, trace.NotImplemented("Should not be called"))
 
 	if config.testModules == nil {
-		config.testModules = &modules.TestModules{
+		config.testModules = &modulestest.Modules{
 			TestBuildType: modules.BuildCommunity,
 		}
 	}
-	modules.SetTestModules(t, config.testModules)
+
+	log := logtest.NewLogger()
+	modulestest.SetTestModules(t, *config.testModules)
+	r, err := autoupdatelookup.NewResolver(
+		autoupdatelookup.Config{
+			RolloutGetter: ap,
+			CMCGetter:     clt,
+			Channels:      config.channels,
+			Log:           log,
+			Context:       t.Context(),
+		})
+	require.NoError(t, err)
 	h := &Handler{
 		clusterFeatures: *config.testModules.Features().ToProto(),
 		cfg: Config{
-			AutomaticUpgradesChannels: config.channels,
-			AccessPoint:               ap,
-			PublicProxyAddr:           addr,
-			ProxyClient:               clt,
+			AccessPoint:     ap,
+			PublicProxyAddr: addr,
+			ProxyClient:     clt,
 		},
-		logger: utils.NewSlogLoggerForTests(),
+		logger:             log,
+		autoUpdateResolver: r,
 	}
 	h.PublicProxyAddr()
 	return h
@@ -1844,7 +2026,7 @@ func TestJoinScript(t *testing.T) {
 		t.Run("ent", func(t *testing.T) {
 			// Using the Enterprise Version, the package name must be teleport-ent
 			h := newAutoupdateTestHandler(t, autoupdateTestHandlerConfig{
-				testModules: &modules.TestModules{TestBuildType: modules.BuildEnterprise},
+				testModules: &modulestest.Modules{TestBuildType: modules.BuildEnterprise},
 				token:       token,
 			})
 			script, err := h.getJoinScript(context.Background(), scriptSettings{token: validToken})
@@ -1865,7 +2047,7 @@ func TestJoinScript(t *testing.T) {
 		t.Run("installUpdater is true", func(t *testing.T) {
 			currentStableCloudVersion := "1.2.3"
 			h := newAutoupdateTestHandler(t, autoupdateTestHandlerConfig{
-				testModules: &modules.TestModules{TestFeatures: modules.Features{Cloud: true, AutomaticUpgrades: true}},
+				testModules: &modulestest.Modules{TestFeatures: modules.Features{Cloud: true, AutomaticUpgrades: true}},
 				token:       token,
 				channels: automaticupgrades.Channels{
 					automaticupgrades.DefaultChannelName: &automaticupgrades.Channel{StaticVersion: currentStableCloudVersion},
@@ -1906,7 +2088,7 @@ func TestJoinScript(t *testing.T) {
 		t.Run("rollout exists and autoupdates are on", func(t *testing.T) {
 			currentStableCloudVersion := "1.1.1"
 			config := autoupdateTestHandlerConfig{
-				testModules: &modules.TestModules{TestFeatures: modules.Features{Cloud: true, AutomaticUpgrades: true}},
+				testModules: &modulestest.Modules{TestFeatures: modules.Features{Cloud: true, AutomaticUpgrades: true}},
 				channels: automaticupgrades.Channels{
 					automaticupgrades.DefaultChannelName: &automaticupgrades.Channel{StaticVersion: currentStableCloudVersion},
 				},
@@ -1937,7 +2119,7 @@ func TestJoinScript(t *testing.T) {
 
 func TestAutomaticUpgrades(t *testing.T) {
 	t.Run("cloud and automatic upgrades enabled", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestFeatures: modules.Features{
 				Cloud:             true,
 				AutomaticUpgrades: true,
@@ -1948,7 +2130,7 @@ func TestAutomaticUpgrades(t *testing.T) {
 		require.True(t, got)
 	})
 	t.Run("cloud but automatic upgrades disabled", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestFeatures: modules.Features{
 				Cloud:             true,
 				AutomaticUpgrades: false,
@@ -1960,7 +2142,7 @@ func TestAutomaticUpgrades(t *testing.T) {
 	})
 
 	t.Run("automatic upgrades enabled but is not cloud", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
 				Cloud:             false,
diff --git a/lib/web/kube.go b/lib/web/kube.go
index 7d1f954cedbde..77c8df2836694 100644
--- a/lib/web/kube.go
+++ b/lib/web/kube.go
@@ -437,7 +437,7 @@ func (h *Handler) joinKubernetesSession(
 	sessionID string,
 	mode types.SessionParticipantMode,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
+	cluster reversetunnelclient.Cluster,
 	ws *websocket.Conn,
 ) error {
 	h.logger.InfoContext(ctx, "Attempting to join kubernetes existing session",
@@ -450,7 +450,7 @@ func (h *Handler) joinKubernetesSession(
 		return trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -499,7 +499,7 @@ func (h *Handler) joinKubernetesSession(
 		return trace.Wrap(err)
 	}
 
-	authAccessPoint, err := site.CachingAccessPoint()
+	authAccessPoint, err := cluster.CachingAccessPoint()
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/web/machineid.go b/lib/web/machineid.go
index a5bddfdc7d304..633e6ebfc5791 100644
--- a/lib/web/machineid.go
+++ b/lib/web/machineid.go
@@ -17,20 +17,28 @@
 package web
 
 import (
+	"cmp"
+	"context"
+	"fmt"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	yaml "github.com/ghodss/yaml"
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
+	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/fieldmaskpb"
 
+	"github.com/gravitational/teleport/api/constants"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/services"
 	tslices "github.com/gravitational/teleport/lib/utils/slices"
 )
 
@@ -59,8 +67,8 @@ type CreateBotRequest struct {
 
 // listBots returns a list of bots for a given cluster site. It does not leverage pagination from the UI. Due to the
 // nature of the bot:user relationship, pagination is not yet supported. This endpoint will return all bots.
-func (h *Handler) listBots(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) listBots(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -88,13 +96,13 @@ func (h *Handler) listBots(w http.ResponseWriter, r *http.Request, p httprouter.
 }
 
 // createBot creates a bot
-func (h *Handler) createBot(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) createBot(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req *CreateBotRequest
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -121,8 +129,8 @@ func (h *Handler) createBot(w http.ResponseWriter, r *http.Request, p httprouter
 	return OK(), nil
 }
 
-func (h *Handler) deleteBot(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) deleteBot(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -155,7 +163,7 @@ type CreateBotJoinTokenRequest struct {
 }
 
 // createBotJoinToken creates a bot join token
-func (h *Handler) createBotJoinToken(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) createBotJoinToken(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var req *CreateBotJoinTokenRequest
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -165,7 +173,7 @@ func (h *Handler) createBotJoinToken(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -197,13 +205,13 @@ func (h *Handler) createBotJoinToken(w http.ResponseWriter, r *http.Request, p h
 }
 
 // getBot retrieves a bot by name
-func (h *Handler) getBot(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) getBot(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	botName := p.ByName("name")
 	if botName == "" {
 		return nil, trace.BadParameter("empty name")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -218,38 +226,134 @@ func (h *Handler) getBot(w http.ResponseWriter, r *http.Request, p httprouter.Pa
 }
 
 // updateBot updates a bot with provided roles. The only supported change via this endpoint today is roles.
-func (h *Handler) updateBot(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	var request updateBotRequest
+// TODO(nicholasmarais1158) DELETE IN v20.0.0 - replaced by updateBotV2
+// MUST delete with related code found in `web/packages/teleport/src/services/bot/bot.ts`
+func (h *Handler) updateBotV1(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	var request updateBotRequestV1
 	if err := httplib.ReadResourceJSON(r, &request); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	botName := p.ByName("name")
-	if botName == "" {
-		return nil, trace.BadParameter("empty name")
+	return updateBot(r.Context(), p.ByName("name"), updateBotRequestV3{
+		Roles: request.Roles,
+	}, sctx, cluster)
+}
+
+type updateBotRequestV1 struct {
+	Roles []string `json:"roles"`
+}
+
+// updateBotV2 updates a bot with provided roles, traits and max_session_ttl.
+// TODO(nicholasmarais1158) DELETE IN v20.0.0 - replaced by updateBotV3
+// MUST delete with related code found in `web/packages/teleport/src/services/bot/bot.ts`
+func (h *Handler) updateBotV2(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	var request updateBotRequestV2
+	if err := httplib.ReadResourceJSON(r, &request); err != nil {
+		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	return updateBot(r.Context(), p.ByName("name"), updateBotRequestV3{
+		Roles:         request.Roles,
+		Traits:        request.Traits,
+		MaxSessionTtl: request.MaxSessionTtl,
+	}, sctx, cluster)
+}
+
+type updateBotRequestV2 struct {
+	Roles         []string                `json:"roles"`
+	Traits        []updateBotRequestTrait `json:"traits"`
+	MaxSessionTtl string                  `json:"max_session_ttl"`
+}
+
+type updateBotRequestTrait struct {
+	Name   string   `json:"name"`
+	Values []string `json:"values"`
+}
+
+// updateBot updates a bot with provided roles, traits, max_session_ttl and
+// description.
+func (h *Handler) updateBotV3(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	var request updateBotRequestV3
+	if err := httplib.ReadResourceJSON(r, &request); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return updateBot(r.Context(), p.ByName("name"), request, sctx, cluster)
+}
+
+type updateBotRequestV3 struct {
+	Roles         []string                `json:"roles"`
+	Traits        []updateBotRequestTrait `json:"traits"`
+	MaxSessionTtl string                  `json:"max_session_ttl"`
+	Description   *string                 `json:"description"`
+}
+
+// updateBot updates a bot with provided roles, traits, max_session_ttl and
+// description.
+func updateBot(ctx context.Context, botName string, request updateBotRequestV3, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	mask, err := fieldmaskpb.New(&machineidv1.Bot{}, "spec.roles")
+	if botName == "" {
+		return nil, trace.BadParameter("empty name")
+	}
+
+	mask, err := fieldmaskpb.New(&machineidv1.Bot{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := clt.BotServiceClient().UpdateBot(r.Context(), &machineidv1.UpdateBotRequest{
+	metadata := headerv1.Metadata{
+		Name: botName,
+	}
+	spec := machineidv1.BotSpec{}
+
+	if request.Roles != nil {
+		mask.Append(&machineidv1.Bot{}, "spec.roles")
+
+		spec.Roles = request.Roles
+	}
+
+	if request.Traits != nil {
+		mask.Append(&machineidv1.Bot{}, "spec.traits")
+
+		traits := make([]*machineidv1.Trait, len(request.Traits))
+		for i, trait := range request.Traits {
+			traits[i] = &machineidv1.Trait{
+				Name:   trait.Name,
+				Values: trait.Values,
+			}
+		}
+
+		spec.Traits = traits
+	}
+
+	if request.MaxSessionTtl != "" {
+		mask.Append(&machineidv1.Bot{}, "spec.max_session_ttl")
+
+		ttl, err := time.ParseDuration(request.MaxSessionTtl)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		spec.MaxSessionTtl = durationpb.New(ttl)
+	}
+
+	if request.Description != nil {
+		mask.Append(&machineidv1.Bot{}, "metadata.description")
+
+		metadata.Description = *request.Description
+	}
+
+	updated, err := clt.BotServiceClient().UpdateBot(ctx, &machineidv1.UpdateBotRequest{
 		UpdateMask: mask,
 		Bot: &machineidv1.Bot{
-			Kind:    types.KindBot,
-			Version: types.V1,
-			Metadata: &headerv1.Metadata{
-				Name: botName,
-			},
-			Spec: &machineidv1.BotSpec{
-				Roles: request.Roles,
-			},
+			Kind:     types.KindBot,
+			Version:  types.V1,
+			Metadata: &metadata,
+			Spec:     &spec,
 		},
 	})
 	if err != nil {
@@ -259,12 +363,8 @@ func (h *Handler) updateBot(w http.ResponseWriter, r *http.Request, p httprouter
 	return updated, nil
 }
 
-type updateBotRequest struct {
-	Roles []string `json:"roles"`
-}
-
 // getBotInstance retrieves a bot instance by id
-func (h *Handler) getBotInstance(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) getBotInstance(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	botName := p.ByName("name")
 	instanceId := p.ByName("id")
 	if botName == "" {
@@ -274,7 +374,7 @@ func (h *Handler) getBotInstance(w http.ResponseWriter, r *http.Request, p httpr
 		return nil, trace.BadParameter("empty id")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -303,8 +403,8 @@ type GetBotInstanceResponse struct {
 }
 
 // listBotInstances returns a list of bot instances for a given cluster site.
-func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -317,22 +417,27 @@ func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ htt
 		}
 	}
 
+	var sort *types.SortBy
+	if r.URL.Query().Has("sort") {
+		sortString := r.URL.Query().Get("sort")
+		s := types.GetSortByFromString(sortString)
+		sort = &s
+	}
+
+	//nolint:staticcheck // SA1019. Kept for backward compatibility.
 	instances, err := clt.BotInstanceServiceClient().ListBotInstances(r.Context(), &machineidv1.ListBotInstancesRequest{
 		FilterBotName:    r.URL.Query().Get("bot_name"),
 		PageSize:         int32(pageSize),
 		PageToken:        r.URL.Query().Get("page_token"),
 		FilterSearchTerm: r.URL.Query().Get("search"),
+		Sort:             sort,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	uiInstances := tslices.Map(instances.BotInstances, func(instance *machineidv1.BotInstance) BotInstance {
-		latestHeartbeats := instance.GetStatus().GetLatestHeartbeats()
-		heartbeat := instance.Status.InitialHeartbeat // Use initial heartbeat as a fallback
-		if len(latestHeartbeats) > 0 {
-			heartbeat = latestHeartbeats[len(latestHeartbeats)-1]
-		}
+		heartbeat := services.GetBotInstanceLatestHeartbeat(instance)
 
 		uiInstance := BotInstance{
 			InstanceId: instance.Spec.InstanceId,
@@ -344,6 +449,74 @@ func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ htt
 			uiInstance.HostNameLatest = heartbeat.Hostname
 			uiInstance.VersionLatest = heartbeat.Version
 			uiInstance.ActiveAtLatest = heartbeat.RecordedAt.AsTime().Format(time.RFC3339)
+			uiInstance.OSLatest = heartbeat.Os
+		}
+
+		return uiInstance
+	})
+
+	return ListBotInstancesResponse{
+		BotInstances:  uiInstances,
+		NextPageToken: instances.NextPageToken,
+	}, nil
+}
+
+// listBotInstancesV2 returns a list of bot instances for a given cluster site.
+func (h *Handler) listBotInstancesV2(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	request := &machineidv1.ListBotInstancesV2Request{
+		PageToken: r.URL.Query().Get("page_token"),
+		SortField: r.URL.Query().Get("sort_field"),
+		Filter: &machineidv1.ListBotInstancesV2Request_Filters{
+			BotName:    r.URL.Query().Get("bot_name"),
+			SearchTerm: r.URL.Query().Get("search"),
+			Query:      r.URL.Query().Get("query"),
+		},
+	}
+
+	if r.URL.Query().Has("page_size") {
+		pageSize, err := strconv.ParseInt(r.URL.Query().Get("page_size"), 10, 32)
+		if err != nil {
+			return nil, trace.BadParameter("invalid page size")
+		}
+		request.PageSize = int32(pageSize)
+	}
+
+	if r.URL.Query().Has("sort_dir") {
+		sortDir := r.URL.Query().Get("sort_dir")
+		request.SortDesc = strings.ToLower(sortDir) == "desc"
+	}
+
+	instances, err := clt.BotInstanceServiceClient().ListBotInstancesV2(r.Context(), request)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	uiInstances := tslices.Map(instances.BotInstances, func(instance *machineidv1.BotInstance) BotInstance {
+		heartbeat := services.GetBotInstanceLatestHeartbeat(instance)
+		authentication := services.GetBotInstanceLatestAuthentication(instance)
+
+		uiInstance := BotInstance{
+			InstanceId: instance.GetSpec().GetInstanceId(),
+			BotName:    instance.GetSpec().GetBotName(),
+		}
+
+		if authentication != nil {
+			uiInstance.JoinMethodLatest = cmp.Or(
+				authentication.GetJoinAttrs().GetMeta().GetJoinMethod(),
+				authentication.GetJoinMethod(),
+			)
+		}
+
+		if heartbeat != nil {
+			uiInstance.HostNameLatest = heartbeat.GetHostname()
+			uiInstance.VersionLatest = heartbeat.GetVersion()
+			uiInstance.ActiveAtLatest = heartbeat.GetRecordedAt().AsTime().Format(time.RFC3339)
+			uiInstance.OSLatest = heartbeat.GetOs()
 		}
 
 		return uiInstance
@@ -367,4 +540,163 @@ type BotInstance struct {
 	HostNameLatest   string `json:"host_name_latest,omitempty"`
 	VersionLatest    string `json:"version_latest,omitempty"`
 	ActiveAtLatest   string `json:"active_at_latest,omitempty"`
+	OSLatest         string `json:"os_latest,omitempty"`
+}
+
+func (h *Handler) botInstanceMetrics(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	ctx := r.Context()
+
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rsp := BotInstanceMetricsResponse{
+		RefreshAfterSeconds: int(constants.AutoUpdateBotInstanceReportPeriod.Seconds()),
+	}
+
+	// If no report is available yet, `UpgradeStatuses` will be nil.
+	report, err := clt.GetAutoUpdateBotInstanceReport(ctx)
+	switch {
+	case trace.IsNotFound(err):
+		return rsp, nil
+	case err != nil:
+		return nil, trace.Wrap(err)
+	}
+
+	// Our target version is the operator's selected auto-update tools version,
+	// or if there isn't one configured: the proxy version.
+	autoUpdateVersion, err := h.cfg.AccessPoint.GetAutoUpdateVersion(ctx)
+	if err != nil && !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+	targetVersion, err := getToolsVersion(autoUpdateVersion)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Returns the earliest possible version in a major release. It's based on:
+	// lib/utils.VersionBeforeAlpha.
+	lowerBound := func(major int64) semver.Version {
+		return semver.Version{Major: major, PreRelease: "aa"}
+	}
+
+	const versionField = "status.latest_heartbeat.version"
+
+	rsp.UpgradeStatuses = &BotInstanceUpgradeStatuses{
+		UpdatedAt: report.GetSpec().GetTimestamp().AsTime(),
+		UpToDate: BotInstanceUpgradeStatus{
+			Filter: fmt.Sprintf("%[1]s == %[2]q", versionField, targetVersion),
+		},
+		Unsupported: BotInstanceUpgradeStatus{
+			Filter: fmt.Sprintf(
+				"older_than(%[1]s, %[2]q) || %[1]s == %[3]q || newer_than(%[1]s, %[3]q)",
+				versionField,
+				lowerBound(targetVersion.Major-1),
+				lowerBound(targetVersion.Major+1),
+			),
+		},
+		PatchAvailable: BotInstanceUpgradeStatus{
+			Filter: fmt.Sprintf(
+				"between(%[1]s, %[2]q, %[3]q)",
+				versionField,
+				lowerBound(targetVersion.Major),
+				targetVersion,
+			),
+		},
+		RequiresUpgrade: BotInstanceUpgradeStatus{
+			Filter: fmt.Sprintf(
+				"between(%[1]s, %[2]q, %[3]q)",
+				versionField,
+				lowerBound(targetVersion.Major-1),
+				lowerBound(targetVersion.Major),
+			),
+		},
+	}
+
+	for _, groupMetrics := range report.GetSpec().GetGroups() {
+		for versionString, versionMetrics := range groupMetrics.GetVersions() {
+			version, err := semver.NewVersion(versionString)
+			if err != nil {
+				h.logger.ErrorContext(ctx,
+					"Failed to parse bot instance version string",
+					"version_string", versionString,
+					"error", err,
+				)
+				continue
+			}
+
+			switch {
+			case targetVersion.Equal(*version):
+				// Bot is up to date.
+				rsp.UpgradeStatuses.UpToDate.Count += int(versionMetrics.Count)
+
+			case targetVersion.LessThan(*version):
+				// Bot is running a newer version, we don't support this.
+				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.Count)
+
+			case targetVersion.Major == version.Major:
+				// Bot is running the right major version, but there's a minor
+				// or patch update available
+				rsp.UpgradeStatuses.PatchAvailable.Count += int(versionMetrics.Count)
+
+			case version.Major == targetVersion.Major-1:
+				// Bot is running the previous major version and should upgrade.
+				rsp.UpgradeStatuses.RequiresUpgrade.Count += int(versionMetrics.Count)
+
+			case version.Major < targetVersion.Major-1:
+				// Bot is running a version that is too old. In this case, the
+				// connection would be terminated so we shouldn't really see it.
+				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.Count)
+
+			default:
+				// The branches of this switch should be exhaustive, but just in case!
+				h.logger.DebugContext(ctx,
+					"Bot instance version comparison is missing a branch",
+					"bot_instance_version", version,
+					"target_version", targetVersion,
+				)
+			}
+		}
+	}
+	return rsp, nil
+}
+
+type BotInstanceMetricsResponse struct {
+	// RefreshAfterSeconds is the amount of time (in seconds) after receiving
+	// this response the client should poll for new metrics.
+	RefreshAfterSeconds int `json:"refresh_after_seconds"`
+
+	// UpgradeStatuses contains instance counts by "upgrade status".
+	UpgradeStatuses *BotInstanceUpgradeStatuses `json:"upgrade_statuses"`
+}
+
+type BotInstanceUpgradeStatuses struct {
+	// UpdatedAt is when these metrics were last updated.
+	UpdatedAt time.Time `json:"updated_at"`
+
+	// UpToDate means the instance matches the desired version.
+	UpToDate BotInstanceUpgradeStatus `json:"up_to_date"`
+
+	// Unsupported means the instance is running a release that is too old or
+	// too new for us to support.
+	Unsupported BotInstanceUpgradeStatus `json:"unsupported"`
+
+	// RequiresUpgrade means the instance is running a release from the previous
+	// major series. We can support it for now, but the next major upgrade will
+	// break compatibility.
+	RequiresUpgrade BotInstanceUpgradeStatus `json:"requires_upgrade"`
+
+	// PatchAvailable means the instance is running a release from the desired
+	// major series, but they're behind on a minor or patch release.
+	PatchAvailable BotInstanceUpgradeStatus `json:"patch_available"`
+}
+
+type BotInstanceUpgradeStatus struct {
+	// Count is the number of bot instances.
+	Count int `json:"count"`
+
+	// Filter is a predicate language filter that can be applied to the bot
+	// instance list to find matching instances.
+	Filter string `json:"filter"`
 }
diff --git a/lib/web/machineid_test.go b/lib/web/machineid_test.go
index dbe1bd378edca..0644cd0449e82 100644
--- a/lib/web/machineid_test.go
+++ b/lib/web/machineid_test.go
@@ -17,7 +17,6 @@
 package web
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"math"
@@ -26,6 +25,7 @@ import (
 	"slices"
 	"strconv"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
@@ -35,14 +35,17 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
+	update "github.com/gravitational/teleport/api/types/autoupdate"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 func TestListBots(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -81,7 +84,7 @@ func TestListBots(t *testing.T) {
 }
 
 func TestListBots_UnauthenticatedError(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	s := newWebSuite(t)
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
@@ -120,7 +123,7 @@ func TestCreateBot(t *testing.T) {
 		"bot",
 	)
 
-	ctx := context.Background()
+	ctx := t.Context()
 
 	resp, err := pack.clt.PostJSON(ctx, endpoint, CreateBotRequest{
 		BotName: "test-bot",
@@ -178,7 +181,7 @@ func TestCreateBot(t *testing.T) {
 }
 
 func TestCreateBotJoinToken(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -230,7 +233,7 @@ func TestCreateBotJoinToken(t *testing.T) {
 }
 
 func TestDeleteBot_UnauthenticatedError(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	s := newWebSuite(t)
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
@@ -254,7 +257,7 @@ func TestDeleteBot_UnauthenticatedError(t *testing.T) {
 func TestDeleteBot(t *testing.T) {
 	botName := "bot-bravo"
 
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -289,7 +292,7 @@ func TestDeleteBot(t *testing.T) {
 }
 
 func TestGetBotByName(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -324,7 +327,7 @@ func TestGetBotByName(t *testing.T) {
 }
 
 func TestEditBot(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -345,7 +348,7 @@ func TestEditBot(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	response, err := pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpoint, botName), updateBotRequest{
+	response, err := pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpoint, botName), updateBotRequestV1{
 		Roles: []string{"new-new-role"},
 	})
 	require.NoError(t, err)
@@ -357,22 +360,284 @@ func TestEditBot(t *testing.T) {
 	assert.Equal(t, []string{"new-new-role"}, bot.Spec.Roles)
 }
 
-func TestListBotInstances(t *testing.T) {
-	t.Parallel()
+func TestEditBotRoles(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpointV1 := pack.clt.Endpoint(
+		"v1",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+	endpointV2 := pack.clt.Endpoint(
+		"v2",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+
+	// create a bot named `test-bot-edit`
+	botName := "test-bot-edit"
+	_, err := pack.clt.PostJSON(ctx, endpointV1, CreateBotRequest{
+		BotName: botName,
+		Roles:   []string{"test-role"},
+		Traits: []*machineidv1.Trait{
+			{
+				Name:   "test-trait-1",
+				Values: []string{"value-1"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	response, err := pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpointV2, botName), updateBotRequestV2{
+		Roles: []string{"new-new-role"},
+	})
+	require.NoError(t, err)
+
+	var bot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &bot), "invalid response received")
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code updating bot")
+	assert.Equal(t, botName, bot.GetMetadata().GetName())
+	assert.Equal(t, []string{"new-new-role"}, bot.GetSpec().GetRoles())
+	assert.Equal(t, []*machineidv1.Trait{
+		{
+			Name:   "test-trait-1",
+			Values: []string{"value-1"},
+		},
+	}, bot.GetSpec().Traits)
+	assert.Equal(t, int64((12*time.Hour)/time.Second), bot.GetSpec().GetMaxSessionTtl().GetSeconds())
+}
 
-	ctx := context.Background()
+func TestEditBotTraits(t *testing.T) {
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
 	clusterName := env.server.ClusterName()
-	endpoint := pack.clt.Endpoint(
+	endpointV1 := pack.clt.Endpoint(
+		"v1",
 		"webapi",
 		"sites",
 		clusterName,
 		"machine-id",
-		"bot-instance",
+		"bot",
+	)
+	endpointV2 := pack.clt.Endpoint(
+		"v2",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
 	)
 
+	// create a bot named `test-bot-edit`
+	botName := "test-bot-edit"
+	_, err := pack.clt.PostJSON(ctx, endpointV1, CreateBotRequest{
+		BotName: botName,
+		Roles:   []string{"test-role"},
+		Traits: []*machineidv1.Trait{
+			{
+				Name:   "test-trait-1",
+				Values: []string{"value-1", "value-2"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	response, err := pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpointV2, botName), updateBotRequestV2{
+		Traits: []updateBotRequestTrait{
+			{
+				Name:   "test-trait-1",
+				Values: []string{"value-1", "value-2", "value-3"},
+			},
+			{
+				Name:   "test-trait-2",
+				Values: []string{"value-1"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	var bot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &bot), "invalid response received")
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code updating bot")
+	assert.Equal(t, botName, bot.GetMetadata().GetName())
+	assert.Equal(t, []string{"test-role"}, bot.GetSpec().GetRoles())
+	assert.Len(t, bot.GetSpec().Traits, 2)
+	for _, trait := range bot.GetSpec().Traits {
+		// Avoid ordering race - traits are stored in a map
+		switch trait.GetName() {
+		case "test-trait-1":
+			assert.Equal(t, []string{"value-1", "value-2", "value-3"}, trait.GetValues())
+		case "test-trait-2":
+			assert.Equal(t, []string{"value-1"}, trait.GetValues())
+		}
+	}
+	assert.Equal(t, int64((12*time.Hour)/time.Second), bot.GetSpec().GetMaxSessionTtl().GetSeconds())
+}
+
+func TestEditBotMaxSessionTTL(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpointV1 := pack.clt.Endpoint(
+		"v1",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+	endpointV2 := pack.clt.Endpoint(
+		"v2",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+
+	// create a bot named `test-bot-edit`
+	botName := "test-bot-edit"
+	_, err := pack.clt.PostJSON(ctx, endpointV1, CreateBotRequest{
+		BotName: botName,
+		Roles:   []string{"test-role"},
+		Traits: []*machineidv1.Trait{
+			{
+				Name:   "test-trait-1",
+				Values: []string{"value-1"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	response, err := pack.clt.Get(ctx, fmt.Sprintf("%s/%s", endpointV1, botName), nil)
+	require.NoError(t, err)
+
+	var createdBot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &createdBot), "invalid response received")
+	assert.Equal(t, int64(43200), createdBot.GetSpec().GetMaxSessionTtl().GetSeconds())
+
+	response, err = pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpointV2, botName), updateBotRequestV2{
+		MaxSessionTtl: "1h2m3s",
+	})
+	require.NoError(t, err)
+
+	var updatedBot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &updatedBot), "invalid response received")
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code updating bot")
+	assert.Equal(t, botName, updatedBot.GetMetadata().GetName())
+	assert.Equal(t, []string{"test-role"}, updatedBot.GetSpec().GetRoles())
+	assert.Equal(t, []*machineidv1.Trait{
+		{
+			Name:   "test-trait-1",
+			Values: []string{"value-1"},
+		},
+	}, updatedBot.GetSpec().Traits)
+	assert.Equal(t, int64((1*time.Hour+2*time.Minute+3*time.Second)/time.Second), updatedBot.GetSpec().GetMaxSessionTtl().GetSeconds())
+}
+
+func TestEditBotDescription(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpointV1 := pack.clt.Endpoint(
+		"v1",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+	endpointV3 := pack.clt.Endpoint(
+		"v3",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot",
+	)
+
+	// create a bot named `test-bot-edit`
+	botName := "test-bot-edit"
+	_, err := pack.clt.PostJSON(ctx, endpointV1, CreateBotRequest{
+		BotName: botName,
+		Roles:   []string{"test-role"},
+		Traits: []*machineidv1.Trait{
+			{
+				Name:   "test-trait-1",
+				Values: []string{"value-1"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	response, err := pack.clt.Get(ctx, fmt.Sprintf("%s/%s", endpointV1, botName), nil)
+	require.NoError(t, err)
+
+	var createdBot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &createdBot), "invalid response received")
+	assert.Equal(t, int64(43200), createdBot.GetSpec().GetMaxSessionTtl().GetSeconds())
+
+	description := "This is the bot's description."
+	response, err = pack.clt.PutJSON(ctx, fmt.Sprintf("%s/%s", endpointV3, botName), updateBotRequestV3{
+		Description: &description,
+	})
+	require.NoError(t, err)
+
+	var updatedBot machineidv1.Bot
+	require.NoError(t, json.Unmarshal(response.Bytes(), &updatedBot), "invalid response received")
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code updating bot")
+	assert.Equal(t, botName, updatedBot.GetMetadata().GetName())
+	assert.Equal(t, []string{"test-role"}, updatedBot.GetSpec().GetRoles())
+	assert.Equal(t, []*machineidv1.Trait{
+		{
+			Name:   "test-trait-1",
+			Values: []string{"value-1"},
+		},
+	}, updatedBot.GetSpec().Traits)
+	assert.Equal(t, int64((12*time.Hour)/time.Second), updatedBot.GetSpec().GetMaxSessionTtl().GetSeconds())
+	assert.Equal(t, description, updatedBot.GetMetadata().GetDescription())
+}
+
+func TestListBotInstances(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoints := []string{
+		pack.clt.Endpoint(
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+		pack.clt.Endpoint(
+			"v2",
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+	}
 	instanceID := uuid.New().String()
 
 	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
@@ -404,49 +669,86 @@ func TestListBotInstances(t *testing.T) {
 					Version:    "1.0.0",
 					Hostname:   "test-hostname",
 					JoinMethod: "test-join-method",
+					Os:         "linux",
+				},
+			},
+			LatestAuthentications: []*machineidv1.BotInstanceStatusAuthentication{
+				{
+					AuthenticatedAt: &timestamppb.Timestamp{
+						Seconds: 2,
+						Nanos:   0,
+					},
+				},
+				{
+					AuthenticatedAt: &timestamppb.Timestamp{
+						Seconds: 1,
+						Nanos:   0,
+					},
+				},
+				{
+					AuthenticatedAt: &timestamppb.Timestamp{
+						Seconds: 2,
+						Nanos:   0,
+					},
+					JoinMethod: "test-join-method",
 				},
 			},
 		},
 	})
 	require.NoError(t, err)
 
-	response, err := pack.clt.Get(ctx, endpoint, url.Values{})
-	require.NoError(t, err)
-	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+	for _, endpoint := range endpoints {
+		t.Run(endpoint, func(t *testing.T) {
+			response, err := pack.clt.Get(ctx, endpoint, url.Values{})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
 
-	var instances ListBotInstancesResponse
-	require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+			var instances ListBotInstancesResponse
+			require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
 
-	assert.Len(t, instances.BotInstances, 1)
-	require.Empty(t, cmp.Diff(instances, ListBotInstancesResponse{
-		BotInstances: []BotInstance{
-			{
-				InstanceId:       instanceID,
-				BotName:          "test-bot",
-				JoinMethodLatest: "test-join-method",
-				HostNameLatest:   "test-hostname",
-				VersionLatest:    "1.0.0",
-				ActiveAtLatest:   "1970-01-01T00:00:03Z",
-			},
-		},
-	}))
+			assert.Len(t, instances.BotInstances, 1)
+			require.Empty(t, cmp.Diff(instances, ListBotInstancesResponse{
+				BotInstances: []BotInstance{
+					{
+						InstanceId:       instanceID,
+						BotName:          "test-bot",
+						JoinMethodLatest: "test-join-method",
+						HostNameLatest:   "test-hostname",
+						VersionLatest:    "1.0.0",
+						ActiveAtLatest:   "1970-01-01T00:00:03Z",
+						OSLatest:         "linux",
+					},
+				},
+			}))
+		})
+	}
 }
 
 func TestListBotInstancesWithInitialHeartbeat(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
 	clusterName := env.server.ClusterName()
-	endpoint := pack.clt.Endpoint(
-		"webapi",
-		"sites",
-		clusterName,
-		"machine-id",
-		"bot-instance",
-	)
+	endpoints := []string{
+		pack.clt.Endpoint(
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+		pack.clt.Endpoint(
+			"v2",
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+	}
 
 	instanceID := uuid.New().String()
 
@@ -468,35 +770,66 @@ func TestListBotInstancesWithInitialHeartbeat(t *testing.T) {
 				JoinMethod: "test-join-method",
 			},
 			LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{},
+			InitialAuthentication: &machineidv1.BotInstanceStatusAuthentication{
+				JoinMethod: "test-join-method",
+			},
 		},
 	})
 	require.NoError(t, err)
 
-	response, err := pack.clt.Get(ctx, endpoint, url.Values{})
-	require.NoError(t, err)
-	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+	for _, endpoint := range endpoints {
+		t.Run(endpoint, func(t *testing.T) {
+			response, err := pack.clt.Get(ctx, endpoint, url.Values{})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
 
-	var instances ListBotInstancesResponse
-	require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+			var instances ListBotInstancesResponse
+			require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
 
-	assert.Len(t, instances.BotInstances, 1)
-	require.Empty(t, cmp.Diff(instances, ListBotInstancesResponse{
-		BotInstances: []BotInstance{
-			{
-				InstanceId:       instanceID,
-				BotName:          "test-bot",
-				JoinMethodLatest: "test-join-method",
-				HostNameLatest:   "test-hostname",
-				VersionLatest:    "1.0.0",
-				ActiveAtLatest:   "1970-01-01T00:00:03Z",
-			},
-		},
-	}))
+			assert.Len(t, instances.BotInstances, 1)
+			require.Empty(t, cmp.Diff(instances, ListBotInstancesResponse{
+				BotInstances: []BotInstance{
+					{
+						InstanceId:       instanceID,
+						BotName:          "test-bot",
+						JoinMethodLatest: "test-join-method",
+						HostNameLatest:   "test-hostname",
+						VersionLatest:    "1.0.0",
+						ActiveAtLatest:   "1970-01-01T00:00:03Z",
+					},
+				},
+			}))
+		})
+	}
 }
 
 func TestListBotInstancesPaging(t *testing.T) {
 	t.Parallel()
 
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+
+	endpoints := []string{
+		pack.clt.Endpoint(
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+		pack.clt.Endpoint(
+			"v2",
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+	}
+
 	tcs := []struct {
 		name         string
 		numInstances int
@@ -519,56 +852,51 @@ func TestListBotInstancesPaging(t *testing.T) {
 		},
 	}
 
-	for _, tc := range tcs {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
-			env := newWebPack(t, 1)
-			proxy := env.proxies[0]
-			pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
-			clusterName := env.server.ClusterName()
-			endpoint := pack.clt.Endpoint(
-				"webapi",
-				"sites",
-				clusterName,
-				"machine-id",
-				"bot-instance",
-			)
-
-			n := 0
-			for n < tc.numInstances {
-				n += 1
-				_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
-					Kind:    types.KindBotInstance,
-					Version: types.V1,
-					Spec: &machineidv1.BotInstanceSpec{
-						BotName:    "bot-1",
-						InstanceId: uuid.New().String(),
-					},
-					Status: &machineidv1.BotInstanceStatus{},
+	for _, endpoint := range endpoints {
+		t.Run(endpoint, func(t *testing.T) {
+			for _, tc := range tcs {
+				t.Run(tc.name, func(t *testing.T) {
+					for n := range tc.numInstances {
+						_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+							Kind:    types.KindBotInstance,
+							Version: types.V1,
+							Spec: &machineidv1.BotInstanceSpec{
+								BotName:    "bot-1",
+								InstanceId: "instance-" + strconv.Itoa(n),
+							},
+							Status: &machineidv1.BotInstanceStatus{},
+						})
+						require.NoError(t, err)
+					}
+
+					response, err := pack.clt.Get(ctx, endpoint, url.Values{
+						"page_token": []string{""}, // default to the start
+						"page_size":  []string{strconv.Itoa(tc.pageSize)},
+					})
+					require.NoError(t, err)
+					assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+					var resp ListBotInstancesResponse
+					require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
+
+					assert.Len(t, resp.BotInstances, int(math.Min(float64(tc.numInstances), float64(tc.pageSize))))
+
+					// remove instances before next test
+					for n := range tc.numInstances {
+						err = env.server.Auth().DeleteBotInstance(ctx, "bot-1", "instance-"+strconv.Itoa(n))
+						require.NoError(t, err)
+					}
 				})
-				require.NoError(t, err)
 			}
-
-			response, err := pack.clt.Get(ctx, endpoint, url.Values{
-				"page_token": []string{""}, // default to the start
-				"page_size":  []string{strconv.Itoa(tc.pageSize)},
-			})
-			require.NoError(t, err)
-			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
-
-			var resp ListBotInstancesResponse
-			require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
-
-			assert.Len(t, resp.BotInstances, int(math.Min(float64(tc.numInstances), float64(tc.pageSize))))
 		})
 	}
 }
 
-func TestListBotInstancesWithBotFilter(t *testing.T) {
+func TestListBotInstancesSorting(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
-	env := newWebPack(t, 1)
+	ctx := t.Context()
+	env := newWebPack(t, 1, withWebPackAuthCacheEnabled(true))
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
 	clusterName := env.server.ClusterName()
@@ -580,6 +908,70 @@ func TestListBotInstancesWithBotFilter(t *testing.T) {
 		"bot-instance",
 	)
 
+	for i := range 10 {
+		now := time.Now()
+		_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+			Kind:    types.KindBotInstance,
+			Version: types.V1,
+			Spec: &machineidv1.BotInstanceSpec{
+				BotName:    "bot-1",
+				InstanceId: uuid.New().String(),
+			},
+			Status: &machineidv1.BotInstanceStatus{
+				InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+					RecordedAt: &timestamppb.Timestamp{
+						Seconds: now.Unix() + int64(i),
+					},
+				},
+			},
+		})
+		require.NoError(t, err, "failed to create BotInstance index:%d", i)
+	}
+
+	response, err := pack.clt.Get(ctx, endpoint, url.Values{
+		"page_token": []string{""}, // default to the start
+		"page_size":  []string{"0"},
+		"sort":       []string{"active_at_latest:desc"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+	var resp ListBotInstancesResponse
+	require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
+
+	prevValue := "~"
+	for _, r := range resp.BotInstances {
+		assert.Less(t, r.ActiveAtLatest, prevValue)
+		prevValue = r.ActiveAtLatest
+	}
+}
+
+func TestListBotInstancesWithBotFilter(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoints := []string{
+		pack.clt.Endpoint(
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+		pack.clt.Endpoint(
+			"v2",
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+	}
+
 	n := 0
 	for n < 5 {
 		n += 1
@@ -596,21 +988,48 @@ func TestListBotInstancesWithBotFilter(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	response, err := pack.clt.Get(ctx, endpoint, url.Values{
-		"bot_name": []string{"bot-1"},
-	})
-	require.NoError(t, err)
-	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+	for _, endpoint := range endpoints {
+		t.Run(endpoint, func(t *testing.T) {
+			response, err := pack.clt.Get(ctx, endpoint, url.Values{
+				"bot_name": []string{"bot-1"},
+			})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
 
-	var instances ListBotInstancesResponse
-	require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+			var instances ListBotInstancesResponse
+			require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
 
-	assert.Len(t, instances.BotInstances, 3)
+			assert.Len(t, instances.BotInstances, 3)
+		})
+	}
 }
 
 func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 	t.Parallel()
 
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoints := []string{
+		pack.clt.Endpoint(
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+		pack.clt.Endpoint(
+			"v2",
+			"webapi",
+			"sites",
+			clusterName,
+			"machine-id",
+			"bot-instance",
+		),
+	}
+
 	tcs := []struct {
 		name       string
 		searchTerm string
@@ -659,73 +1078,128 @@ func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 		},
 	}
 
-	for _, tc := range tcs {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
-			env := newWebPack(t, 1)
-			proxy := env.proxies[0]
-			pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
-			clusterName := env.server.ClusterName()
-			endpoint := pack.clt.Endpoint(
-				"webapi",
-				"sites",
-				clusterName,
-				"machine-id",
-				"bot-instance",
-			)
-
-			spec := tc.spec
-			if spec == nil {
-				spec = &machineidv1.BotInstanceSpec{
-					BotName:    "test-bot",
-					InstanceId: "00000000-0000-0000-0000-000000000000",
-				}
+	for _, endpoint := range endpoints {
+		t.Run(endpoint, func(t *testing.T) {
+			for _, tc := range tcs {
+				t.Run(tc.name, func(t *testing.T) {
+					spec := tc.spec
+					if spec == nil {
+						spec = &machineidv1.BotInstanceSpec{
+							BotName:    "test-bot",
+							InstanceId: "00000000-0000-0000-0000-000000000000",
+						}
+					}
+
+					_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+						Kind:    types.KindBotInstance,
+						Version: types.V1,
+						Spec:    spec,
+						Status: &machineidv1.BotInstanceStatus{
+							InitialHeartbeat: tc.heartbeat,
+						},
+					})
+					require.NoError(t, err)
+
+					_, err = env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+						Kind:    types.KindBotInstance,
+						Version: types.V1,
+						Spec: &machineidv1.BotInstanceSpec{
+							BotName:    "bot-gone",
+							InstanceId: uuid.New().String(),
+						},
+						Status: &machineidv1.BotInstanceStatus{
+							InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+								Version:    "1.1.1-prod",
+								Hostname:   "test-hostname",
+								JoinMethod: "test-join-method",
+							},
+						},
+					})
+					require.NoError(t, err)
+
+					response, err := pack.clt.Get(ctx, endpoint, url.Values{
+						"search": []string{tc.searchTerm},
+					})
+					require.NoError(t, err)
+					assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+					var instances ListBotInstancesResponse
+					require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+
+					assert.Len(t, instances.BotInstances, 1)
+					assert.Equal(t, "00000000-0000-0000-0000-000000000000", instances.BotInstances[0].InstanceId)
+
+					// remove before next test
+					err = env.server.Auth().DeleteBotInstance(ctx, spec.BotName, spec.InstanceId)
+					require.NoError(t, err)
+				})
 			}
+		})
+	}
+}
 
-			_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
-				Kind:    types.KindBotInstance,
-				Version: types.V1,
-				Spec:    spec,
-				Status: &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: tc.heartbeat,
-				},
-			})
-			require.NoError(t, err)
+func TestListBotInstancesWithQueryFilter(t *testing.T) {
+	t.Parallel()
 
-			_, err = env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
-				Kind:    types.KindBotInstance,
-				Version: types.V1,
-				Spec: &machineidv1.BotInstanceSpec{
-					BotName:    "bot-gone",
-					InstanceId: uuid.New().String(),
-				},
-				Status: &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
-						Version:    "1.1.1-prod",
-						Hostname:   "test-hostname",
-						JoinMethod: "test-join-method",
-					},
-				},
-			})
-			require.NoError(t, err)
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoint := pack.clt.Endpoint(
+		"v2",
+		"webapi",
+		"sites",
+		clusterName,
+		"machine-id",
+		"bot-instance",
+	)
 
-			response, err := pack.clt.Get(ctx, endpoint, url.Values{
-				"search": []string{tc.searchTerm},
-			})
-			require.NoError(t, err)
-			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+		Kind:    types.KindBotInstance,
+		Version: types.V1,
+		Spec: &machineidv1.BotInstanceSpec{
+			BotName:    "test-bot-1",
+			InstanceId: "00000000-0000-0000-0000-000000000000",
+		},
+		Status: &machineidv1.BotInstanceStatus{
+			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				Hostname: "svr-eu-tel-123-a",
+			},
+		},
+	})
+	require.NoError(t, err)
 
-			var instances ListBotInstancesResponse
-			require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+	_, err = env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+		Kind:    types.KindBotInstance,
+		Version: types.V1,
+		Spec: &machineidv1.BotInstanceSpec{
+			BotName:    "test-bot-2",
+			InstanceId: uuid.New().String(),
+		},
+		Status: &machineidv1.BotInstanceStatus{
+			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				Hostname: "test-hostname",
+			},
+		},
+	})
+	require.NoError(t, err)
 
-			assert.Len(t, instances.BotInstances, 1)
-			assert.Equal(t, "00000000-0000-0000-0000-000000000000", instances.BotInstances[0].InstanceId)
-		})
-	}
+	response, err := pack.clt.Get(ctx, endpoint, url.Values{
+		"query": []string{`status.latest_heartbeat.hostname == "svr-eu-tel-123-a"`},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+	var instances ListBotInstancesResponse
+	require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+
+	assert.Len(t, instances.BotInstances, 1)
+	assert.Equal(t, "00000000-0000-0000-0000-000000000000", instances.BotInstances[0].InstanceId)
 }
 
 func TestGetBotInstance(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
 	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
@@ -787,3 +1261,110 @@ func TestGetBotInstance(t *testing.T) {
 	}, protocmp.Transform(), protocmp.IgnoreFields(&machineidv1.BotInstance{}, "metadata")))
 	assert.YAMLEq(t, fmt.Sprintf("kind: bot_instance\nmetadata:\n  name: %[1]s\n  revision: %[2]s\nspec:\n  bot_name: test-bot\n  instance_id: %[1]s\nstatus:\n  initial_heartbeat:\n    recorded_at: \"1970-01-01T00:00:01Z\"\nversion: v1\n", instanceID, resp.BotInstance.Metadata.Revision), resp.YAML)
 }
+
+func TestBotInstanceMetrics_NotFound(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	pack := env.proxies[0].authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+
+	// No report yet should return an empty `UpgradeStatuses`.
+	endpoint := pack.clt.Endpoint(
+		"webapi", "sites", clusterName, "machine-id", "bot-instance", "metrics",
+	)
+	rsp, err := pack.clt.Get(ctx, endpoint, url.Values{})
+	require.NoError(t, err)
+
+	var body BotInstanceMetricsResponse
+	require.NoError(t, json.Unmarshal(rsp.Bytes(), &body))
+	require.Nil(t, body.UpgradeStatuses)
+}
+
+func TestBotInstanceMetrics_Success(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	pack := env.proxies[0].authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+
+	const targetVersion = "19.1.1"
+
+	_, err := env.server.Auth().
+		CreateAutoUpdateVersion(ctx, &autoupdate.AutoUpdateVersion{
+			Kind:    types.KindAutoUpdateVersion,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: types.MetaNameAutoUpdateVersion,
+			},
+			Spec: &autoupdate.AutoUpdateVersionSpec{
+				Tools: &autoupdate.AutoUpdateVersionSpecTools{
+					TargetVersion: targetVersion,
+				},
+			},
+		})
+	require.NoError(t, err)
+
+	report, err := update.NewAutoUpdateBotInstanceReport(&autoupdate.AutoUpdateBotInstanceReportSpec{
+		Timestamp: timestamppb.New(env.clock.Now()),
+		Groups: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup{
+			"prod": {
+				Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
+					"19.1.1":     {Count: 1},      // Up to date
+					"19.2.0":     {Count: 10},     // Unsupported (too new)
+					"19.1.0":     {Count: 100},    // Patch available
+					"19.0.0-rc1": {Count: 1000},   // Patch available
+					"18.0.0":     {Count: 10000},  // Requires upgrade
+					"17.0.0":     {Count: 100000}, // Unsupported (too old)
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	_, err = env.server.Auth().UpsertAutoUpdateBotInstanceReport(ctx, report)
+	require.NoError(t, err)
+
+	endpoint := pack.clt.Endpoint(
+		"webapi", "sites", clusterName, "machine-id", "bot-instance", "metrics",
+	)
+	rsp, err := pack.clt.Get(ctx, endpoint, url.Values{})
+	require.NoError(t, err)
+
+	var body BotInstanceMetricsResponse
+	require.NoError(t, json.Unmarshal(rsp.Bytes(), &body))
+
+	// Up to date
+	require.Equal(t,
+		BotInstanceUpgradeStatus{
+			Count:  1,
+			Filter: `status.latest_heartbeat.version == "19.1.1"`,
+		},
+		body.UpgradeStatuses.UpToDate,
+	)
+
+	// Unsupported
+	require.Equal(t,
+		BotInstanceUpgradeStatus{
+			Count:  100010,
+			Filter: `older_than(status.latest_heartbeat.version, "18.0.0-aa") || status.latest_heartbeat.version == "20.0.0-aa" || newer_than(status.latest_heartbeat.version, "20.0.0-aa")`,
+		},
+		body.UpgradeStatuses.Unsupported,
+	)
+
+	// Patch available
+	require.Equal(t,
+		BotInstanceUpgradeStatus{
+			Count:  1100,
+			Filter: `between(status.latest_heartbeat.version, "19.0.0-aa", "19.1.1")`,
+		},
+		body.UpgradeStatuses.PatchAvailable,
+	)
+
+	// Requires upgrade
+	require.Equal(t,
+		BotInstanceUpgradeStatus{
+			Count:  10000,
+			Filter: `between(status.latest_heartbeat.version, "18.0.0-aa", "19.0.0-aa")`,
+		},
+		body.UpgradeStatuses.RequiresUpgrade,
+	)
+}
diff --git a/lib/web/mfa.go b/lib/web/mfa.go
index 4a4f15814a521..e9840d6623a7a 100644
--- a/lib/web/mfa.go
+++ b/lib/web/mfa.go
@@ -601,13 +601,13 @@ type isMfaRequiredResponse struct {
 }
 
 // isMFARequired is the [ClusterHandler] implementer for checking if MFA is required for a given target.
-func (h *Handler) isMFARequired(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) isMFARequired(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	var httpReq *IsMFARequiredRequest
 	if err := httplib.ReadResourceJSON(r, &httpReq); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	required, err := h.checkMFARequired(r.Context(), httpReq, sctx, site)
+	required, err := h.checkMFARequired(r.Context(), httpReq, sctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -616,13 +616,13 @@ func (h *Handler) isMFARequired(w http.ResponseWriter, r *http.Request, p httpro
 }
 
 // checkMFARequired checks if MFA is required for the target specified in the [isMFARequiredRequest].
-func (h *Handler) checkMFARequired(ctx context.Context, req *IsMFARequiredRequest, sctx *SessionContext, site reversetunnelclient.RemoteSite) (bool, error) {
+func (h *Handler) checkMFARequired(ctx context.Context, req *IsMFARequiredRequest, sctx *SessionContext, cluster reversetunnelclient.Cluster) (bool, error) {
 	protoReq, err := h.checkAndGetProtoRequest(ctx, sctx, req)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
diff --git a/lib/web/mwi_wizards.go b/lib/web/mwi_wizards.go
new file mode 100644
index 0000000000000..e3cd3832c7779
--- /dev/null
+++ b/lib/web/mwi_wizards.go
@@ -0,0 +1,221 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"bytes"
+	"embed"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"text/template"
+
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+
+	"github.com/gravitational/teleport"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/tfgen"
+	"github.com/gravitational/teleport/lib/tfgen/transform"
+	"github.com/gravitational/teleport/lib/utils/slices"
+)
+
+// machineIDWizardGenerateIaC generates IaC code for the Machine Identity CI/CD wizards.
+func (h *Handler) machineIDWizardGenerateIaC(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, _ *SessionContext, _ reversetunnelclient.Cluster) (any, error) {
+	var req machineIDWizardGenerateIaCRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	switch {
+	// We currently only support deploying from GitHub Actions to Kubernetes but
+	// this endpoint will support other sources and destinations in the future.
+	case req.SourceType != "github":
+		return nil, trace.BadParameter("source_type must be one of: [github]")
+	case req.DestinationType != "kubernetes":
+		return nil, trace.BadParameter("destination_type must be one of: [kubernetes]")
+	// We also currently only support a single repository, but we may support
+	// multiple in the future, so the allow field is a slice.
+	case req.GitHub != nil && len(req.GitHub.Allow) != 1:
+		return nil, trace.BadParameter("github.allow: must contain exactly one item")
+	}
+
+	if req.GitHub == nil {
+		// Default to *something* so the generated code isn't completely broken.
+		req.GitHub = &machineIDWizardRequestGitHub{
+			Allow: []machineIDWizardRequestGitHubAllow{
+				{
+					Repository: "repository",
+					Owner:      "organization",
+				},
+			},
+		}
+	}
+
+	namePrefix := fmt.Sprintf(
+		"gha-%s-%s",
+		req.GitHub.Allow[0].Owner,
+		req.GitHub.Allow[0].Repository,
+	)
+
+	// Role resource.
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V7,
+		Metadata: types.Metadata{
+			Name: fmt.Sprintf("%s-kube-access", namePrefix),
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{},
+		},
+	}
+	var roleOpts []tfgen.GenerateOpt
+	if req.Kubernetes != nil {
+		role.Spec.Allow.KubernetesLabels = req.Kubernetes.Labels
+		role.Spec.Allow.KubernetesResources = req.Kubernetes.Resources
+		role.Spec.Allow.KubeGroups = req.Kubernetes.Groups
+		role.Spec.Allow.KubeUsers = req.Kubernetes.Users
+	} else {
+		roleOpts = append(roleOpts, tfgen.WithFieldComment("spec.allow.kubernetes_labels", "kubernetes_labels will be added in the next step."))
+		roleOpts = append(roleOpts, tfgen.WithFieldComment("spec.allow.kubernetes_groups", "kubernetes_groups will be added in the next step."))
+	}
+
+	// Bot resource.
+	bot := &machineidv1.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: namePrefix,
+		},
+		Spec: &machineidv1.BotSpec{
+			Roles: []string{role.GetName()},
+		},
+	}
+	botOpts := []tfgen.GenerateOpt{
+		tfgen.WithFieldTransform("spec.traits", transform.BotTraits),
+	}
+
+	// Join token resource.
+	token := &types.ProvisionTokenV2{
+		Kind:    types.KindToken,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name: namePrefix,
+		},
+		Spec: types.ProvisionTokenSpecV2{
+			Roles:      []types.SystemRole{types.RoleBot},
+			JoinMethod: types.JoinMethodGitHub,
+			BotName:    namePrefix,
+			GitHub: &types.ProvisionTokenSpecV2GitHub{
+				Allow: slices.Map(req.GitHub.Allow, func(allow machineIDWizardRequestGitHubAllow) *types.ProvisionTokenSpecV2GitHub_Rule {
+					return &types.ProvisionTokenSpecV2GitHub_Rule{
+						Repository:      fmt.Sprintf("%s/%s", allow.Owner, allow.Repository),
+						RepositoryOwner: allow.Owner,
+						Workflow:        allow.Workflow,
+						Environment:     allow.Environment,
+						Actor:           allow.Actor,
+						Ref:             allow.Ref,
+						RefType:         allow.RefType,
+					}
+				}),
+				EnterpriseServerHost: req.GitHub.EnterpriseServerHost,
+				EnterpriseSlug:       req.GitHub.EnterpriseSlug,
+				StaticJWKS:           req.GitHub.StaticJWKS,
+			},
+		},
+	}
+
+	roleCfg, err := tfgen.Generate(role, roleOpts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	botCfg, err := tfgen.Generate(bot, botOpts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	tokenCfg, err := tfgen.Generate(token, tfgen.WithResourceType("teleport_provision_token"))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var buf bytes.Buffer
+	err = templates.ExecuteTemplate(&buf, "machine-id-gha-k8s-wizard.tf.tmpl", struct {
+		RoleConfig   string
+		BotConfig    string
+		TokenConfig  string
+		MajorVersion int64
+		ProxyAddr    string
+	}{
+		RoleConfig:   string(roleCfg),
+		BotConfig:    string(botCfg),
+		TokenConfig:  string(tokenCfg),
+		MajorVersion: teleport.SemVer().Major,
+		ProxyAddr:    h.PublicProxyAddr(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return machineIDGHAK8sWizardGenerateIaCResponse{Terraform: buf.String()}, nil
+}
+
+type machineIDWizardGenerateIaCRequest struct {
+	SourceType      string                            `json:"source_type"`
+	DestinationType string                            `json:"destination_type"`
+	GitHub          *machineIDWizardRequestGitHub     `json:"github"`
+	Kubernetes      *machineIDWizardRequestKubernetes `json:"kubernetes"`
+}
+
+type machineIDWizardRequestGitHub struct {
+	Allow                []machineIDWizardRequestGitHubAllow `json:"allow"`
+	EnterpriseServerHost string                              `json:"enterprise_server_host"`
+	EnterpriseSlug       string                              `json:"enterprise_slug"`
+	StaticJWKS           string                              `json:"static_jwks"`
+}
+
+type machineIDWizardRequestGitHubAllow struct {
+	Repository  string `json:"repository"`
+	Owner       string `json:"owner"`
+	Workflow    string `json:"workflow"`
+	Environment string `json:"environment"`
+	Actor       string `json:"actor"`
+	Ref         string `json:"ref"`
+	RefType     string `json:"ref_type"`
+}
+
+type machineIDWizardRequestKubernetes struct {
+	Labels    types.Labels               `json:"labels"`
+	Groups    []string                   `json:"groups"`
+	Users     []string                   `json:"users"`
+	Resources []types.KubernetesResource `json:"resources"`
+}
+
+type machineIDGHAK8sWizardGenerateIaCResponse struct {
+	Terraform string `json:"terraform"`
+}
+
+var (
+	//go:embed templates/*
+	templateDir embed.FS
+	templates   = template.Must(template.ParseFS(templateDir, "templates/*.tmpl"))
+)
diff --git a/lib/web/mwi_wizards_test.go b/lib/web/mwi_wizards_test.go
new file mode 100644
index 0000000000000..f9a6b739e9fdb
--- /dev/null
+++ b/lib/web/mwi_wizards_test.go
@@ -0,0 +1,153 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func TestMachineIDWizard(t *testing.T) {
+	t.Parallel()
+
+	const testJWKS = `{
+  "keys": [
+    {
+      "kty": "RSA",
+      "use": "sig",
+      "kid": "P9Zd",
+      "alg": "RS256",
+      "n": "kWp2zRA23Z3vTL4uoe8kTFptxBVFunIoP4t_8TDYJrOb7D1iZNDXVeEsYKp6ppmrTZDAgd-cNOTKLd4M39WJc5FN0maTAVKJc7NxklDeKc4dMe1BGvTZNG4MpWBo-taKULlYUu0ltYJuLzOjIrTHfarucrGoRWqM0sl3z2-fv9k",
+      "e": "AQAB"
+    }
+  ]
+}`
+
+	env := newWebPack(t, 1)
+	pack := env.proxies[0].authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	endpoint := pack.clt.Endpoint("webapi", "sites", env.server.ClusterName(), "machine-id", "wizards", "ci-cd")
+
+	testCases := map[string]machineIDWizardGenerateIaCRequest{
+		"github+kubernetes-empty-terraform": {
+			SourceType:      "github",
+			DestinationType: "kubernetes",
+		},
+		"github+kubernetes-step1-terraform": {
+			SourceType:      "github",
+			DestinationType: "kubernetes",
+			GitHub: &machineIDWizardRequestGitHub{
+				Allow: []machineIDWizardRequestGitHubAllow{
+					{
+						Repository: "teleport",
+						Owner:      "gravitational",
+					},
+				},
+			},
+		},
+		"github+kubernetes-step2-terraform": {
+			SourceType:      "github",
+			DestinationType: "kubernetes",
+			GitHub: &machineIDWizardRequestGitHub{
+				Allow: []machineIDWizardRequestGitHubAllow{
+					{
+						Repository: "teleport",
+						Owner:      "gravitational",
+					},
+				},
+			},
+			Kubernetes: &machineIDWizardRequestKubernetes{
+				Labels: types.Labels{"department": []string{"engineering"}},
+				Groups: []string{"system:masters"},
+			},
+		},
+		"github+kubernetes-complex-terraform": {
+			SourceType:      "github",
+			DestinationType: "kubernetes",
+			GitHub: &machineIDWizardRequestGitHub{
+				Allow: []machineIDWizardRequestGitHubAllow{
+					{
+						Repository:  "teleport",
+						Owner:       "gravitational",
+						Workflow:    "deploy",
+						Environment: "production",
+						Actor:       "deployinator",
+						Ref:         "main",
+						RefType:     "branch",
+					},
+				},
+				EnterpriseServerHost: "github.corp.internal",
+				EnterpriseSlug:       "sluggy",
+				StaticJWKS:           testJWKS,
+			},
+			Kubernetes: &machineIDWizardRequestKubernetes{
+				Labels: types.Labels{"department": []string{"engineering"}},
+				Groups: []string{"viewers"},
+				Users:  []string{"serviceAccount:deployment-sa"},
+				Resources: []types.KubernetesResource{
+					{
+						Kind:      "deployment",
+						APIGroup:  "apps",
+						Name:      "billing-service",
+						Namespace: "default",
+					},
+				},
+			},
+		},
+	}
+	for name, req := range testCases {
+		t.Run(name, func(t *testing.T) {
+			rsp, err := pack.clt.PostJSON(t.Context(), endpoint, req)
+			require.NoError(t, err)
+
+			var body machineIDGHAK8sWizardGenerateIaCResponse
+			require.NoError(t, json.Unmarshal(rsp.Bytes(), &body))
+
+			// Cut the provider configuration out of the golden file, as this
+			// contains values that will change between test runs (e.g. major
+			// version number and proxy address).
+			providerConfigIdx := strings.Index(body.Terraform, "terraform {")
+			beforeProviderConfig := body.Terraform[:providerConfigIdx]
+			providerConfig := body.Terraform[providerConfigIdx:]
+
+			if golden.ShouldSet() {
+				golden.Set(t, []byte(beforeProviderConfig))
+			}
+
+			require.Empty(t,
+				cmp.Diff(
+					string(golden.Get(t)),
+					beforeProviderConfig,
+				),
+			)
+
+			require.Contains(t,
+				providerConfig,
+				env.proxies[0].handler.handler.PublicProxyAddr(),
+			)
+		})
+	}
+}
diff --git a/lib/web/recordingmetadata.go b/lib/web/recordingmetadata.go
new file mode 100644
index 0000000000000..ed1b32e89a22a
--- /dev/null
+++ b/lib/web/recordingmetadata.go
@@ -0,0 +1,306 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/gorilla/websocket"
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	recordingmetadatav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingmetadata/v1"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+)
+
+type sessionRecordingMessageType string
+
+const (
+	recordingThumbnailMessageType sessionRecordingMessageType = "thumbnail"
+	recordingMetadataMessageType  sessionRecordingMessageType = "metadata"
+	recordingErrorMessageType     sessionRecordingMessageType = "error"
+)
+
+type sessionRecordingErrorResponse struct {
+	Error string `json:"error"`
+}
+
+// sessionRecordingMessageWrapper is a wrapper for session recording messages sent over WebSocket.
+// This makes it easier to have strongly typed messages on the frontend, switching on the `Type` field.
+type sessionRecordingMessageWrapper struct {
+	Type sessionRecordingMessageType `json:"type"`
+	Data any                         `json:"data"`
+}
+
+// getSessionRecordingMetadata handles the WebSocket connection to stream session recording metadata and thumbnails.
+// The metadata is loaded over a websocket connection to avoid gRPC message size limits.
+// It sends metadata and thumbnails as JSON messages to the client.
+func (h *Handler) getSessionRecordingMetadata(
+	w http.ResponseWriter,
+	r *http.Request,
+	p httprouter.Params,
+	sctx *SessionContext,
+	cluster reversetunnelclient.Cluster,
+	ws *websocket.Conn,
+) (interface{}, error) {
+	sessionID := p.ByName("session_id")
+	if sessionID == "" {
+		return nil, trace.BadParameter("missing session ID in request URL")
+	}
+
+	ctx := r.Context()
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
+			Error: err.Error(),
+		})
+		return nil, nil
+	}
+
+	stream, err := clt.RecordingMetadataServiceClient().GetMetadata(ctx, &recordingmetadatav1.GetMetadataRequest{
+		SessionId: sessionID,
+	})
+	if err != nil {
+		sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
+			Error: err.Error(),
+		})
+		return nil, nil
+	}
+
+	for {
+		chunk, err := stream.Recv()
+		if err != nil {
+			if trace.IsNotFound(err) {
+				sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
+					Error: fmt.Sprintf("metadata for session %q not found", sessionID),
+				})
+				return nil, nil
+			}
+
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			h.logger.ErrorContext(ctx, "failed to receive chunk", "session_id", sessionID, "error", err)
+			sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
+				Error: err.Error(),
+			})
+			return nil, nil
+		}
+
+		if chunk.GetMetadata() != nil {
+			if err := sendMessage(ws, recordingMetadataMessageType, encodeSessionRecordingMetadata(chunk.GetMetadata())); err != nil {
+				h.logger.ErrorContext(ctx, "failed to send metadata", "session_id", sessionID, "error", err)
+				return nil, nil
+			}
+
+			continue
+		}
+
+		if chunk.GetFrame() != nil {
+			if err := sendMessage(ws, recordingThumbnailMessageType, encodeSessionRecordingThumbnail(chunk.GetFrame())); err != nil {
+				h.logger.ErrorContext(ctx, "failed to send thumbnail", "session_id", sessionID, "error", err)
+				return nil, nil
+			}
+
+			continue
+		}
+
+		h.logger.ErrorContext(ctx, "received nil frame in metadata stream")
+		sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
+			Error: trace.BadParameter("received nil frame").Error(),
+		})
+
+		return nil, nil
+	}
+
+	return nil, nil
+}
+
+func sendMessage(ws *websocket.Conn, msgType sessionRecordingMessageType, data interface{}) error {
+	return ws.WriteJSON(sessionRecordingMessageWrapper{
+		Type: msgType,
+		Data: data,
+	})
+}
+
+func (h *Handler) getSessionRecordingThumbnail(
+	w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster,
+) (any, error) {
+	sessionId := p.ByName("session_id")
+	if sessionId == "" {
+		return nil, trace.BadParameter("session_id is required")
+	}
+
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	response, err := clt.RecordingMetadataServiceClient().GetThumbnail(r.Context(), &recordingmetadatav1.GetThumbnailRequest{
+		SessionId: sessionId,
+	})
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return nil, trace.NotFound("thumbnail not found for session %q", sessionId)
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	if response.Thumbnail == nil {
+		return nil, trace.NotFound("thumbnail not found for session %q", sessionId)
+	}
+
+	return encodeSessionRecordingThumbnail(response.Thumbnail), nil
+}
+
+type baseEvent struct {
+	StartOffset int64  `json:"startTime"`
+	EndOffset   int64  `json:"endTime"`
+	Type        string `json:"type"`
+}
+
+type resizeEvent struct {
+	baseEvent
+	Cols int32 `json:"cols"`
+	Rows int32 `json:"rows"`
+}
+
+func (resizeEvent) isSessionRecordingEvent() {}
+
+type joinEvent struct {
+	baseEvent
+	User string `json:"user"`
+}
+
+func (joinEvent) isSessionRecordingEvent() {}
+
+type inactivityEvent struct {
+	baseEvent
+}
+
+func (inactivityEvent) isSessionRecordingEvent() {}
+
+type sessionRecordingEvent interface {
+	isSessionRecordingEvent()
+}
+
+type sessionRecordingMetadata struct {
+	Duration     int64                   `json:"duration"`
+	Events       []sessionRecordingEvent `json:"events"`
+	StartCols    int32                   `json:"startCols"`
+	StartRows    int32                   `json:"startRows"`
+	StartTime    int64                   `json:"startTime"`
+	EndTime      int64                   `json:"endTime"`
+	ClusterName  string                  `json:"clusterName"`
+	ResourceName string                  `json:"resourceName,omitempty"`
+	User         string                  `json:"user,omitempty"`
+	Type         string                  `json:"type,omitempty"`
+}
+
+func pbTypeToString(t recordingmetadatav1.SessionRecordingType) string {
+	switch t {
+	case recordingmetadatav1.SessionRecordingType_SESSION_RECORDING_TYPE_SSH:
+		return "ssh"
+	case recordingmetadatav1.SessionRecordingType_SESSION_RECORDING_TYPE_KUBERNETES:
+		return "k8s"
+	default:
+		return "unknown"
+	}
+}
+
+// encodeSessionRecordingMetadata converts the session recording metadata to a format more suitable for the frontend
+// to use.
+func encodeSessionRecordingMetadata(metadata *recordingmetadatav1.SessionRecordingMetadata) sessionRecordingMetadata {
+	result := sessionRecordingMetadata{
+		Duration:     convertDurationToMs(metadata.Duration),
+		StartCols:    metadata.StartCols,
+		StartRows:    metadata.StartRows,
+		Events:       make([]sessionRecordingEvent, 0, len(metadata.Events)),
+		StartTime:    metadata.StartTime.AsTime().Unix(),
+		EndTime:      metadata.EndTime.AsTime().Unix(),
+		ClusterName:  metadata.ClusterName,
+		ResourceName: metadata.ResourceName,
+		User:         metadata.User,
+		Type:         pbTypeToString(metadata.Type),
+	}
+
+	for _, event := range metadata.Events {
+		base := baseEvent{
+			StartOffset: convertDurationToMs(event.StartOffset),
+			EndOffset:   convertDurationToMs(event.EndOffset),
+		}
+
+		switch e := event.Event.(type) {
+		case *recordingmetadatav1.SessionRecordingEvent_Inactivity:
+			base.Type = "inactivity"
+			result.Events = append(result.Events, inactivityEvent{baseEvent: base})
+		case *recordingmetadatav1.SessionRecordingEvent_Join:
+			base.Type = "join"
+			result.Events = append(result.Events, joinEvent{
+				baseEvent: base,
+				User:      e.Join.User,
+			})
+		case *recordingmetadatav1.SessionRecordingEvent_Resize:
+			base.Type = "resize"
+			result.Events = append(result.Events, resizeEvent{
+				baseEvent: base,
+				Cols:      e.Resize.Cols,
+				Rows:      e.Resize.Rows,
+			})
+		}
+	}
+
+	return result
+}
+
+type sessionRecordingThumbnailResponse struct {
+	Svg           string `json:"svg"`
+	Cols          int32  `json:"cols"`
+	Rows          int32  `json:"rows"`
+	CursorX       int32  `json:"cursorX"`
+	CursorY       int32  `json:"cursorY"`
+	CursorVisible bool   `json:"cursorVisible"`
+	StartOffset   int64  `json:"startOffset"`
+	EndOffset     int64  `json:"endOffset"`
+}
+
+// encodeSessionRecordingThumbnail converts the session recording thumbnail to a format more suitable for the frontend.
+func encodeSessionRecordingThumbnail(thumbnail *recordingmetadatav1.SessionRecordingThumbnail) sessionRecordingThumbnailResponse {
+	return sessionRecordingThumbnailResponse{
+		Svg:           string(thumbnail.Svg),
+		Cols:          thumbnail.Cols,
+		Rows:          thumbnail.Rows,
+		CursorX:       thumbnail.CursorX,
+		CursorY:       thumbnail.CursorY,
+		CursorVisible: thumbnail.CursorVisible,
+		StartOffset:   convertDurationToMs(thumbnail.StartOffset),
+		EndOffset:     convertDurationToMs(thumbnail.EndOffset),
+	}
+}
+
+func convertDurationToMs(d *durationpb.Duration) int64 {
+	if d == nil {
+		return 0
+	}
+	return d.Seconds*1000 + int64(d.Nanos/1000000)
+}
diff --git a/lib/web/recordingplayback.go b/lib/web/recordingplayback.go
new file mode 100644
index 0000000000000..0c9db05720636
--- /dev/null
+++ b/lib/web/recordingplayback.go
@@ -0,0 +1,660 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"context"
+	"encoding/binary"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/gravitational/trace"
+	"github.com/hinshun/vt10x"
+	"github.com/julienschmidt/httprouter"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/metadata"
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// maxRequestRange is the maximum allowed time range for a request
+const maxRequestRange = 10 * time.Minute
+
+const websocketCloseTimeout = 5 * time.Second
+
+// websocketMessage represents a message to be written to the websocket
+type websocketMessage struct {
+	messageType int
+	data        []byte
+}
+
+type recordingTerminal struct {
+	sync.Mutex
+	vt vt10x.Terminal
+}
+
+type recordingStream struct {
+	sync.Mutex
+	eventsChan    <-chan apievents.AuditEvent
+	errorsChan    <-chan error
+	lastEndTime   time.Duration
+	bufferedEvent apievents.AuditEvent
+}
+
+// recordingPlayback manages session event streaming
+type recordingPlayback struct {
+	ctx              context.Context
+	cancel           context.CancelFunc
+	clt              events.SessionStreamer
+	sessionID        string
+	logger           *slog.Logger
+	mu               sync.Mutex
+	cancelActiveTask context.CancelFunc
+	wg               sync.WaitGroup
+	ws               *websocket.Conn
+	writeChan        chan websocketMessage
+	closeSent        bool // tracks if a close message has been sent
+	stream           recordingStream
+	terminal         recordingTerminal
+}
+
+// fetchRequest represents a request for session events.
+type fetchRequest struct {
+	requestType          requestType
+	startOffset          time.Duration
+	endOffset            time.Duration
+	requestID            int
+	requestCurrentScreen bool
+}
+
+// sessionEvent represents a single session event with its type, timestamp, and data.
+type sessionEvent struct {
+	eventType  responseType
+	timeOffset time.Duration
+	data       []byte
+}
+
+func (h *Handler) recordingPlaybackWS(
+	w http.ResponseWriter,
+	r *http.Request,
+	p httprouter.Params,
+	sctx *SessionContext,
+	cluster reversetunnelclient.Cluster,
+	ws *websocket.Conn,
+) (interface{}, error) {
+	sessionID := p.ByName("session_id")
+	if sessionID == "" {
+		h.closeWebsocketWithError(r.Context(), ws, sessionID, trace.BadParameter("missing session ID in request URL"))
+		return nil, nil
+	}
+
+	ctx := r.Context()
+	clt, err := sctx.GetUserClient(ctx, cluster)
+	if err != nil {
+		h.closeWebsocketWithError(ctx, ws, sessionID, trace.Wrap(err, "failed to get user client"))
+		return nil, nil
+	}
+
+	playback := newRecordingPlayback(ctx, ws, clt, sessionID, h.logger)
+
+	playback.run()
+
+	return nil, nil
+}
+
+func (h *Handler) closeWebsocketWithError(ctx context.Context, ws *websocket.Conn, sessionID string, err error) {
+	data := []byte(err.Error())
+
+	totalSize := responseHeaderSize + len(data)
+	buf := make([]byte, totalSize)
+
+	encodeEvent(buf, 0, eventTypeError, 0, data, 0)
+
+	if err := ws.WriteMessage(websocket.BinaryMessage, buf); err != nil {
+		h.logger.ErrorContext(ctx, "failed to send event", "session_id", sessionID, "error", err)
+	}
+
+	deadline := time.Now().Add(websocketCloseTimeout)
+
+	// Send close frame to initiate graceful shutdown
+	if err := ws.SetWriteDeadline(deadline); err != nil {
+		h.logger.DebugContext(ctx, "failed to set write deadline", "session_id", sessionID, "error", err)
+	}
+	if err := ws.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "")); err != nil {
+		h.logger.DebugContext(ctx, "failed to send close message", "session_id", sessionID, "error", err)
+	}
+
+	// Wait for peer's close frame response (or timeout)
+	if err := ws.SetReadDeadline(deadline); err != nil {
+		h.logger.DebugContext(ctx, "failed to set read deadline", "session_id", sessionID, "error", err)
+	}
+
+	// Log if we got something other than a close acknowledgement
+	if _, _, err := ws.ReadMessage(); err != nil && !websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+		h.logger.DebugContext(ctx, "received non-close message while waiting for close acknowledgement",
+			"session_id", sessionID, "error", err)
+	}
+
+	// Finally close the underlying connection
+	ws.Close()
+}
+
+// newRecordingPlayback creates a new session recording playback handler.
+// This provides a way for the client to request session events within a specific time range, as well as the current
+// terminal screen state at a given time (when seeking).
+// This allows for faster seeking without having to send the client extra events to reconstruct the terminal state.
+func newRecordingPlayback(ctx context.Context, ws *websocket.Conn, clt events.SessionStreamer, sessionID string, logger *slog.Logger) *recordingPlayback {
+	ctx, cancel := context.WithCancel(ctx)
+
+	s := &recordingPlayback{
+		ctx:       ctx,
+		cancel:    cancel,
+		clt:       clt,
+		sessionID: sessionID,
+		logger:    logger,
+		ws:        ws,
+		writeChan: make(chan websocketMessage),
+	}
+
+	return s
+}
+
+// run starts the recording playback handler.
+func (s *recordingPlayback) run() {
+	defer s.cleanup()
+
+	go s.writeLoop()
+
+	s.readLoop()
+}
+
+// cleanup cleans up the recording playback resources.
+func (s *recordingPlayback) cleanup() {
+	s.cancel()
+
+	s.mu.Lock()
+
+	// Only send close message if we haven't already sent one
+	if !s.closeSent {
+		select {
+		case s.writeChan <- websocketMessage{
+			messageType: websocket.CloseMessage,
+			data:        websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""),
+		}:
+		case <-time.After(websocketCloseTimeout):
+		}
+	}
+
+	s.mu.Unlock()
+
+	// Wait for any active task to complete
+	s.wg.Wait()
+
+	close(s.writeChan)
+
+	// Wait for peer's close frame response (or timeout)
+	deadline := time.Now().Add(websocketCloseTimeout)
+	if err := s.ws.SetReadDeadline(deadline); err != nil {
+		s.logger.DebugContext(s.ctx, "failed to set read deadline", "session_id", s.sessionID, "error", err)
+	}
+
+	// Log if we got something other than a close acknowledgement
+	if _, _, err := s.ws.ReadMessage(); err != nil && !websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+		s.logger.DebugContext(s.ctx, "received non-close message while waiting for close acknowledgement",
+			"session_id", s.sessionID, "error", err)
+	}
+
+	// Finally close the underlying connection
+	s.ws.Close()
+}
+
+// writeLoop handles all websocket writes from a dedicated goroutine.
+func (s *recordingPlayback) writeLoop() {
+	for {
+		select {
+		case <-s.ctx.Done():
+			return
+		case msg, ok := <-s.writeChan:
+			if !ok {
+				return
+			}
+
+			if err := s.ws.SetWriteDeadline(time.Now().Add(10 * time.Second)); err != nil {
+				s.logWebsocketError(err)
+				return
+			}
+
+			if err := s.ws.WriteMessage(msg.messageType, msg.data); err != nil {
+				s.logWebsocketError(err)
+				return
+			}
+
+			// If we just sent a close message, exit the loop
+			if msg.messageType == websocket.CloseMessage {
+				// Mark that we're sending a close message
+				s.mu.Lock()
+				s.closeSent = true
+				s.mu.Unlock()
+
+				return
+			}
+		}
+	}
+}
+
+// logWebsocketError handles errors that occur during websocket writes.
+func (s *recordingPlayback) logWebsocketError(err error) {
+	if !websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) &&
+		!utils.IsOKNetworkError(err) {
+		s.logger.ErrorContext(s.ctx, "websocket write error", "error", err)
+	}
+}
+
+// readLoop reads messages from the websocket connection and processes them.
+func (s *recordingPlayback) readLoop() {
+	for {
+		msgType, data, err := s.ws.ReadMessage()
+		if err != nil {
+			s.logWebsocketError(err)
+			return
+		}
+
+		if msgType != websocket.BinaryMessage {
+			s.logger.ErrorContext(s.ctx, "ignoring non-binary websocket message", "session_id", s.sessionID, "type", msgType)
+
+			// Send close message through the write channel
+			select {
+			case s.writeChan <- websocketMessage{
+				messageType: websocket.CloseMessage,
+				data:        websocket.FormatCloseMessage(websocket.CloseUnsupportedData, "only binary messages are supported"),
+			}:
+			case <-time.After(1 * time.Second):
+				s.logger.ErrorContext(s.ctx, "timeout sending close message", "session_id", s.sessionID)
+			}
+
+			return
+		}
+
+		req, err := decodeBinaryRequest(data)
+		if err != nil {
+			s.logger.WarnContext(s.ctx, "failed to decode request", "session_id", s.sessionID, "error", err)
+			continue
+		}
+
+		switch req.requestType {
+		case requestTypeFetch:
+			s.handleFetchRequest(req)
+		default:
+			s.sendError(trace.BadParameter("unknown request type: %d", req.requestType), req.requestID)
+
+			s.logger.ErrorContext(s.ctx, "received unknown request type", "session_id", s.sessionID, "type", req.requestType)
+		}
+	}
+}
+
+// createTaskContext creates a new context for a task and cancels any previous task.
+// A task context is used to manage the lifecycle of a fetch request, ensuring that only one fetch request is active at a time.
+func (s *recordingPlayback) createTaskContext() context.Context {
+	s.mu.Lock()
+
+	if s.cancelActiveTask != nil {
+		// Cancel the active task first
+		s.cancelActiveTask()
+		s.mu.Unlock()
+
+		// Wait for streamEvents to terminate before continuing
+		// We unlock the mutex while waiting to avoid deadlock
+		s.wg.Wait()
+
+		s.mu.Lock()
+	}
+
+	ctx, taskCancel := context.WithCancel(s.ctx)
+	s.cancelActiveTask = taskCancel
+	s.mu.Unlock()
+
+	return ctx
+}
+
+// handleFetchRequest processes a fetch request for session events.
+func (s *recordingPlayback) handleFetchRequest(req *fetchRequest) {
+	if err := validateRequest(req); err != nil {
+		s.sendError(err, req.requestID)
+
+		return
+	}
+
+	ctx := s.createTaskContext()
+
+	s.stream.Lock()
+
+	// start the stream if it doesn't exist or if we need to go back in time
+	needNewStream := s.stream.eventsChan == nil || req.startOffset < s.stream.lastEndTime
+
+	if needNewStream {
+		events, errors := s.clt.StreamSessionEvents(
+			metadata.WithSessionRecordingFormatContext(s.ctx, teleport.PTY),
+			session.ID(s.sessionID),
+			0,
+		)
+
+		if events == nil || errors == nil {
+			s.sendError(fmt.Errorf("failed to start session event stream"), req.requestID)
+			s.stream.Unlock()
+
+			return
+		}
+
+		s.stream.eventsChan = events
+		s.stream.errorsChan = errors
+		s.stream.lastEndTime = 0
+
+		s.terminal.Lock()
+		s.terminal.vt = vt10x.New()
+		s.terminal.Unlock()
+	}
+
+	s.stream.lastEndTime = req.endOffset
+
+	eventsChan := s.stream.eventsChan
+	errorsChan := s.stream.errorsChan
+
+	s.stream.Unlock()
+
+	s.wg.Add(1)
+	go func() {
+		defer s.wg.Done()
+		s.streamEvents(ctx, req, eventsChan, errorsChan)
+	}()
+}
+
+// streamEvents streams session events to the client.
+func (s *recordingPlayback) streamEvents(ctx context.Context, req *fetchRequest, eventsChan <-chan apievents.AuditEvent, errorsChan <-chan error) {
+	startSent := false
+	screenSent := false
+	inTimeRange := false
+
+	const maxBatchSize = 200
+	eventBatch := make([]sessionEvent, 0, maxBatchSize)
+
+	flushBatch := func() {
+		// Send start event if not already sent
+		if !startSent {
+			s.sendEvent(eventTypeStart, req.startOffset, nil, req.requestID)
+			startSent = true
+		}
+
+		if len(eventBatch) == 0 {
+			return
+		}
+
+		s.sendEventBatch(eventBatch, req.requestID)
+		eventBatch = eventBatch[:0]
+	}
+
+	addToBatch := func(eventType responseType, timeOffset time.Duration, data []byte) {
+		eventBatch = append(eventBatch, sessionEvent{eventType, timeOffset, data})
+
+		if len(eventBatch) >= maxBatchSize {
+			flushBatch()
+		}
+	}
+
+	sendStop := func() {
+		// Send start event if not already sent
+		if !startSent {
+			s.sendEvent(eventTypeStart, req.startOffset, nil, req.requestID)
+			startSent = true
+		}
+
+		s.sendEvent(eventTypeStop, 0, encodeTime(req.startOffset, req.endOffset), req.requestID)
+	}
+
+	// process an event, returning a boolean indicating if the events should continue being
+	// processed (i.e. returns false once we have reached the end of the requested time window)
+	processEvent := func(evt apievents.AuditEvent) bool {
+		eventTime := getEventTime(evt)
+
+		inTimeRange = eventTime >= req.startOffset && eventTime <= req.endOffset
+
+		if inTimeRange && req.requestCurrentScreen && !screenSent {
+			flushBatch()
+			s.sendCurrentScreen(req.requestID, eventTime)
+
+			screenSent = true
+		}
+
+		if eventTime > req.endOffset {
+			s.stream.Lock()
+			// store the event for the next request as it is outside the current time range
+			// and won't be returned by the stream on the next request
+			// this will only store print or end events as they are the only ones with a timestamp
+			s.stream.bufferedEvent = evt
+			s.stream.Unlock()
+
+			return false
+		}
+
+		switch evt := evt.(type) {
+		case *apievents.SessionStart:
+			if err := s.resizeTerminal(evt.TerminalSize); err != nil {
+				s.logger.ErrorContext(s.ctx, "failed to resize terminal", "session_id", s.sessionID, "error", err)
+
+				// continue returning events even if resize fails
+			}
+
+			if inTimeRange {
+				addToBatch(eventTypeSessionStart, 0, []byte(evt.TerminalSize))
+			}
+
+		case *apievents.SessionPrint:
+			s.terminal.Lock()
+			if _, err := s.terminal.vt.Write(evt.Data); err != nil {
+				s.logger.ErrorContext(s.ctx, "failed to write to terminal", "session_id", s.sessionID, "error", err)
+			}
+			s.terminal.Unlock()
+
+			if inTimeRange {
+				addToBatch(eventTypeSessionPrint, eventTime, evt.Data)
+			}
+
+		case *apievents.SessionEnd:
+			endTime := evt.EndTime.Sub(evt.StartTime)
+
+			if inTimeRange {
+				addToBatch(eventTypeSessionEnd, endTime, []byte(evt.EndTime.Format(time.RFC3339)))
+			}
+
+			return false
+
+		case *apievents.Resize:
+			if err := s.resizeTerminal(evt.TerminalSize); err != nil {
+				s.logger.ErrorContext(s.ctx, "failed to resize terminal", "session_id", s.sessionID, "error", err)
+
+				// continue returning events even if resize fails
+			}
+
+			// always add resize events as they do not have a timestamp
+			addToBatch(eventTypeResize, 0, []byte(evt.TerminalSize))
+		}
+
+		return true
+	}
+
+	s.stream.Lock()
+
+	buffered := s.stream.bufferedEvent
+	s.stream.bufferedEvent = nil
+
+	s.stream.Unlock()
+
+	if buffered != nil {
+		// process any buffered event from a previous request first
+		// the processEvent will ignore it if it's outside the requested time range
+		_ = processEvent(buffered)
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			// Don't send any more events after context cancellation
+			return
+
+		case err := <-errorsChan:
+			flushBatch()
+			if err != nil {
+				s.sendError(err, req.requestID)
+			}
+			sendStop()
+
+			return
+
+		case evt, ok := <-eventsChan:
+			if !ok {
+				flushBatch()
+				// Send screen if requested and not already sent
+				// This handles the case where the stream ends, but we haven't sent the screen yet
+				if req.requestCurrentScreen && !screenSent {
+					s.sendCurrentScreen(req.requestID, req.startOffset)
+				}
+				sendStop()
+
+				return
+			}
+
+			if !processEvent(evt) {
+				flushBatch()
+				// Send screen if requested and not already sent when we reach the end of the time range
+				// (i.e. there was no event in the time range)
+				if req.requestCurrentScreen && !screenSent {
+					s.sendCurrentScreen(req.requestID, req.startOffset)
+				}
+				sendStop()
+
+				return
+			}
+		}
+	}
+}
+
+// resizeTerminal resizes the terminal based on the provided size string.
+func (s *recordingPlayback) resizeTerminal(size string) error {
+	params, err := session.UnmarshalTerminalParams(size)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	s.terminal.Lock()
+	defer s.terminal.Unlock()
+
+	s.terminal.vt.Resize(params.W, params.H)
+
+	return nil
+}
+
+// writeMessage sends a message through the write channel.
+func (s *recordingPlayback) writeMessage(data []byte) error {
+	select {
+	case <-s.ctx.Done():
+		return s.ctx.Err()
+	case s.writeChan <- websocketMessage{messageType: websocket.BinaryMessage, data: data}:
+		return nil
+	case <-time.After(10 * time.Second):
+		return fmt.Errorf("timeout sending message")
+	}
+}
+
+// sendEvent sends a single event to the client.
+func (s *recordingPlayback) sendEvent(eventType responseType, timeOffset time.Duration, data []byte, requestID int) {
+	totalSize := responseHeaderSize + len(data)
+	buf := make([]byte, totalSize)
+
+	encodeEvent(buf, 0, eventType, timeOffset, data, requestID)
+
+	if err := s.writeMessage(buf); err != nil {
+		s.logger.ErrorContext(s.ctx, "failed to send event", "session_id", s.sessionID, "error", err)
+	}
+}
+
+// sendEventBatch sends a batch of events to the client.
+func (s *recordingPlayback) sendEventBatch(batch []sessionEvent, requestID int) {
+	totalSize := responseHeaderSize
+	for _, evt := range batch {
+		totalSize += responseHeaderSize + len(evt.data)
+	}
+
+	buf := make([]byte, totalSize)
+
+	buf[0] = byte(eventTypeBatch)
+	binary.BigEndian.PutUint32(buf[1:5], uint32(len(batch)))
+	binary.BigEndian.PutUint32(buf[5:9], uint32(requestID))
+
+	offset := responseHeaderSize
+	for _, evt := range batch {
+		encodeEvent(buf, offset, evt.eventType, evt.timeOffset, evt.data, requestID)
+
+		offset += responseHeaderSize + len(evt.data)
+	}
+
+	if err := s.writeMessage(buf); err != nil {
+		s.logger.ErrorContext(s.ctx, "failed to send event batch",
+			"session_id", s.sessionID,
+			"error", err,
+			"batch_size", len(batch),
+			"buffer_size", totalSize)
+	}
+}
+
+// sendError sends an error event to the client.
+func (s *recordingPlayback) sendError(err error, requestID int) {
+	s.sendEvent(eventTypeError, 0, []byte(err.Error()), requestID)
+}
+
+// sendCurrentScreen sends the current terminal screen state to the client.
+func (s *recordingPlayback) sendCurrentScreen(requestID int, timeOffset time.Duration) {
+	s.terminal.Lock()
+	state := s.terminal.vt.DumpState()
+	cols, rows := s.terminal.vt.Size()
+	cursor := s.terminal.vt.Cursor()
+	s.terminal.Unlock()
+
+	data := encodeScreenEvent(state, cols, rows, cursor)
+
+	s.sendEvent(eventTypeScreen, timeOffset, data, requestID)
+}
+
+// getEventTime extracts the event time from an AuditEvent.
+func getEventTime(evt apievents.AuditEvent) time.Duration {
+	switch evt := evt.(type) {
+	case *apievents.SessionPrint:
+		return time.Duration(evt.DelayMilliseconds) * time.Millisecond
+	case *apievents.SessionEnd:
+		return evt.EndTime.Sub(evt.StartTime)
+	default:
+		return 0
+	}
+}
diff --git a/lib/web/recordingplayback_protocol.go b/lib/web/recordingplayback_protocol.go
new file mode 100644
index 0000000000000..d527ba73cb696
--- /dev/null
+++ b/lib/web/recordingplayback_protocol.go
@@ -0,0 +1,139 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/hinshun/vt10x"
+
+	"github.com/gravitational/teleport/lib/terminal"
+)
+
+const (
+	// requestHeaderSize is the size of the request header (event type, start time, end time, request ID, and current screen flag)
+	requestHeaderSize = 22
+	// responseHeaderSize is the size of the response header (event type, timestamp, data size, and request ID)
+	responseHeaderSize = 17
+)
+
+type requestType byte
+
+// Identifies requests coming from the client (web UI)
+const (
+	// requestTypeFetch requests event data
+	requestTypeFetch requestType = 1
+)
+
+type responseType byte
+
+// Response types sent back to the client
+const (
+	// eventTypeStart indicates the start of a response of events
+	eventTypeStart responseType = 1
+	// eventTypeStop indicates the stop of a response of events
+	eventTypeStop responseType = 2
+	// eventTypeError indicates an error
+	eventTypeError responseType = 3
+	// eventTypeSessionStart indicates session started
+	eventTypeSessionStart responseType = 4
+	// eventTypeSessionPrint contains terminal output
+	eventTypeSessionPrint responseType = 5
+	// eventTypeSessionEnd indicates session ended
+	eventTypeSessionEnd responseType = 6
+	// eventTypeResize indicates terminal resize
+	eventTypeResize responseType = 7
+	// eventTypeScreen contains terminal screen state
+	eventTypeScreen responseType = 8
+	// eventTypeBatch indicates a batch of events
+	eventTypeBatch responseType = 9
+)
+
+// encodeScreenEvent encodes the current terminal screen state into a byte slice.
+func encodeScreenEvent(state vt10x.TerminalState, cols, rows int, cursor vt10x.Cursor) []byte {
+	var buf bytes.Buffer
+	buf.Write(make([]byte, responseHeaderSize))
+
+	terminal.VtStateToANSI(&buf, state)
+
+	eventData := buf.Bytes()
+	eventData[0] = byte(eventTypeScreen)
+	binary.BigEndian.PutUint32(eventData[1:5], uint32(cols))
+	binary.BigEndian.PutUint32(eventData[5:9], uint32(rows))
+	binary.BigEndian.PutUint32(eventData[9:13], uint32(cursor.X))
+	binary.BigEndian.PutUint32(eventData[13:17], uint32(cursor.Y))
+	binary.BigEndian.PutUint32(eventData[17:21], uint32(len(eventData)-responseHeaderSize))
+
+	return eventData
+}
+
+// encodeEvent encodes a session event into a byte slice.
+func encodeEvent(buf []byte, offset int, eventType responseType, timeOffset time.Duration, data []byte, requestID int) {
+	buf[offset] = byte(eventType)
+
+	binary.BigEndian.PutUint64(buf[offset+1:offset+9], uint64(timeOffset/time.Millisecond))
+	binary.BigEndian.PutUint32(buf[offset+9:offset+13], uint32(len(data)))
+	binary.BigEndian.PutUint32(buf[offset+13:offset+17], uint32(requestID))
+
+	copy(buf[offset+responseHeaderSize:], data)
+}
+
+// encodeTime encodes the start and end times into a byte slice.
+func encodeTime(startTime, endTime time.Duration) []byte {
+	buf := make([]byte, 16)
+
+	binary.BigEndian.PutUint64(buf, uint64(startTime/time.Millisecond))
+	binary.BigEndian.PutUint64(buf[8:], uint64(endTime/time.Millisecond))
+
+	return buf
+}
+
+// decodeBinaryRequest decodes a binary request from the client.
+func decodeBinaryRequest(data []byte) (*fetchRequest, error) {
+	if len(data) != requestHeaderSize {
+		return nil, trace.BadParameter("invalid request size: expected %d bytes, got %d bytes", requestHeaderSize, len(data))
+	}
+
+	req := &fetchRequest{
+		requestType:          requestType(data[0]),
+		startOffset:          time.Duration(binary.BigEndian.Uint64(data[1:9])) * time.Millisecond,
+		endOffset:            time.Duration(binary.BigEndian.Uint64(data[9:17])) * time.Millisecond,
+		requestID:            int(binary.BigEndian.Uint32(data[17:21])),
+		requestCurrentScreen: data[21] == 1,
+	}
+
+	return req, nil
+}
+
+// validateRequest validates the fetch request parameters.
+func validateRequest(req *fetchRequest) error {
+	if req.startOffset < 0 || req.endOffset < 0 || req.endOffset < req.startOffset {
+		return fmt.Errorf("invalid time range (%v, %v)", req.startOffset, req.endOffset)
+	}
+
+	if req.endOffset-req.startOffset > maxRequestRange {
+		return trace.LimitExceeded("time range too large, max is %s", maxRequestRange)
+	}
+
+	return nil
+}
diff --git a/lib/web/recordingplayback_protocol_test.go b/lib/web/recordingplayback_protocol_test.go
new file mode 100644
index 0000000000000..1a543f6bb3773
--- /dev/null
+++ b/lib/web/recordingplayback_protocol_test.go
@@ -0,0 +1,179 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"encoding/binary"
+	"testing"
+	"time"
+
+	"github.com/hinshun/vt10x"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateRequest(t *testing.T) {
+	tests := []struct {
+		name    string
+		req     *fetchRequest
+		wantErr bool
+		errMsg  string
+	}{
+		{
+			name: "valid request",
+			req: &fetchRequest{
+				startOffset: 0,
+				endOffset:   1 * time.Second,
+			},
+			wantErr: false,
+		},
+		{
+			name: "negative start offset",
+			req: &fetchRequest{
+				startOffset: -1 * time.Second,
+				endOffset:   1 * time.Second,
+			},
+			wantErr: true,
+			errMsg:  "invalid time range",
+		},
+		{
+			name: "negative end offset",
+			req: &fetchRequest{
+				startOffset: 0,
+				endOffset:   -1 * time.Second,
+			},
+			wantErr: true,
+			errMsg:  "invalid time range",
+		},
+		{
+			name: "end before start",
+			req: &fetchRequest{
+				startOffset: 1 * time.Second,
+				endOffset:   500 * time.Millisecond,
+			},
+			wantErr: true,
+			errMsg:  "invalid time range (1s, 500ms)",
+		},
+		{
+			name: "range too large",
+			req: &fetchRequest{
+				startOffset: 0,
+				endOffset:   11 * time.Minute,
+			},
+			wantErr: true,
+			errMsg:  "time range too large",
+		},
+		{
+			name: "max valid range",
+			req: &fetchRequest{
+				startOffset: 0,
+				endOffset:   10 * time.Minute,
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateRequest(tt.req)
+			if tt.wantErr {
+				require.Error(t, err)
+				require.ErrorContains(t, err, tt.errMsg)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestDecodeBinaryRequest(t *testing.T) {
+	tests := []struct {
+		name    string
+		data    []byte
+		want    *fetchRequest
+		wantErr bool
+	}{
+		{
+			name: "valid request with current screen flag false",
+			data: createFetchRequest(1000, 2000, 42, false),
+			want: &fetchRequest{
+				requestType:          requestTypeFetch,
+				startOffset:          time.Duration(1000) * time.Millisecond,
+				endOffset:            time.Duration(2000) * time.Millisecond,
+				requestID:            42,
+				requestCurrentScreen: false,
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid request with current screen flag true",
+			data: createFetchRequest(1000, 2000, 42, true),
+			want: &fetchRequest{
+				requestType:          requestTypeFetch,
+				startOffset:          time.Duration(1000) * time.Millisecond,
+				endOffset:            time.Duration(2000) * time.Millisecond,
+				requestID:            42,
+				requestCurrentScreen: true,
+			},
+			wantErr: false,
+		},
+		{
+			name:    "request too short",
+			data:    make([]byte, requestHeaderSize-1),
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			name:    "request too long",
+			data:    make([]byte, requestHeaderSize+1),
+			want:    nil,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := decodeBinaryRequest(tt.data)
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
+
+func TestEncodeScreenEvent(t *testing.T) {
+	state := vt10x.TerminalState{
+		Cols: 80,
+		Rows: 24,
+	}
+	cols := 80
+	rows := 24
+	cursor := vt10x.Cursor{X: 10, Y: 5}
+
+	result := encodeScreenEvent(state, cols, rows, cursor)
+
+	require.Greater(t, len(result), requestHeaderSize)
+	require.Equal(t, byte(eventTypeScreen), result[0])
+	require.Equal(t, uint32(cols), binary.BigEndian.Uint32(result[1:5]))
+	require.Equal(t, uint32(rows), binary.BigEndian.Uint32(result[5:9]))
+	require.Equal(t, uint32(cursor.X), binary.BigEndian.Uint32(result[9:13]))
+	require.Equal(t, uint32(cursor.Y), binary.BigEndian.Uint32(result[13:17]))
+}
diff --git a/lib/web/recordingplayback_test.go b/lib/web/recordingplayback_test.go
new file mode 100644
index 0000000000000..d3350e9ec4f97
--- /dev/null
+++ b/lib/web/recordingplayback_test.go
@@ -0,0 +1,703 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/hinshun/vt10x"
+	"github.com/stretchr/testify/require"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+)
+
+func TestResizeTerminalEvent(t *testing.T) {
+	tests := []struct {
+		name         string
+		sizeString   string
+		expectResize bool
+	}{
+		{
+			name:         "valid size string",
+			sizeString:   "80:24",
+			expectResize: true,
+		},
+		{
+			name:         "invalid format - no colon",
+			sizeString:   "8024",
+			expectResize: false,
+		},
+		{
+			name:         "invalid format - too many parts",
+			sizeString:   "80:24:10",
+			expectResize: false,
+		},
+		{
+			name:         "invalid cols",
+			sizeString:   "abc:24",
+			expectResize: false,
+		},
+		{
+			name:         "invalid rows",
+			sizeString:   "80:xyz",
+			expectResize: false,
+		},
+		{
+			name:         "empty string",
+			sizeString:   "",
+			expectResize: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &recordingPlayback{
+				ctx:    t.Context(),
+				logger: slog.Default(),
+			}
+			s.terminal.vt = vt10x.New()
+
+			initialCols, initialRows := s.terminal.vt.Size()
+
+			s.resizeTerminal(tt.sizeString)
+
+			if tt.expectResize {
+				parts := strings.Split(tt.sizeString, ":")
+				expectedCols, _ := strconv.Atoi(parts[0])
+				expectedRows, _ := strconv.Atoi(parts[1])
+
+				newCols, newRows := s.terminal.vt.Size()
+				require.Equal(t, expectedCols, newCols)
+				require.Equal(t, expectedRows, newRows)
+			} else {
+				newCols, newRows := s.terminal.vt.Size()
+
+				require.Equal(t, initialCols, newCols)
+				require.Equal(t, initialRows, newRows)
+			}
+		})
+	}
+}
+
+func TestCreateTaskContext(t *testing.T) {
+	s := &recordingPlayback{
+		ctx:    t.Context(),
+		logger: slog.Default(),
+	}
+
+	// Create first task
+	taskCtx1 := s.createTaskContext()
+	require.NotNil(t, taskCtx1)
+	require.NotNil(t, s.cancelActiveTask)
+
+	require.NoError(t, taskCtx1.Err(), "task context should not be canceled yet")
+
+	// Create second task - should cancel the first task
+	taskCtx2 := s.createTaskContext()
+	require.NotNil(t, taskCtx2)
+
+	// First task should be canceled
+	select {
+	case <-taskCtx1.Done():
+		// Expected
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("First task context should be canceled")
+	}
+
+	// Second task should still be active
+	select {
+	case <-taskCtx2.Done():
+		t.Fatal("Second task context should not be canceled yet")
+	default:
+		// Expected
+	}
+}
+
+func TestFetchOverWebSocket(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("Hello, World!"),
+		})
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(600 * time.Millisecond),
+		})
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 0, 1000, false, 1)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, print, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeBatch), responses[1][0], "Second message should be batch event")
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "Hello, World!", "Print event should contain expected data")
+}
+
+func TestErrorOverWebSocket(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendError(errors.New("test error"))
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 0, 1000, false, 1)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, error, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeError), responses[1][0], "Second message should be error event")
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "test error", "Error event should contain expected error message")
+}
+
+func TestSeekingBackwards(t *testing.T) {
+	ws, mockClient := createWebSocket(t, func(mockClient *mockStreamClient) {
+		// no need to send events, just testing that seeking forwards reuses the same stream and
+		// seeking backwards starts a new stream
+	})
+
+	req := createFetchRequest(0, 1000, 1, false)
+
+	err := ws.WriteMessage(websocket.BinaryMessage, req)
+	require.NoError(t, err)
+
+	select {
+	case <-mockClient.eventRequested:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for event request")
+	}
+
+	require.Equal(t, 1, mockClient.streamCount, "Should have started a single stream")
+
+	req = createFetchRequest(1000, 2000, 2, false)
+	err = ws.WriteMessage(websocket.BinaryMessage, req)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, mockClient.streamCount, "Should still be on the same stream after seeking forwards")
+
+	req = createFetchRequest(0, 1000, 3, false)
+	err = ws.WriteMessage(websocket.BinaryMessage, req)
+	require.NoError(t, err)
+
+	select {
+	case <-mockClient.eventRequested:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for event request")
+	}
+
+	require.Equal(t, 2, mockClient.streamCount, "Should have started a new stream after seeking backwards")
+}
+
+func TestRequestScreen(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("\x1b[H\x1b[2JHello, World!"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 700,
+			Data:              []byte("\033[2J\033[H"), // send a clear screen escape sequence
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1000,
+			Data:              []byte("\x1b[H\x1b[2JThis is the second screen update"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1500,
+			Data:              []byte("\x1b[H\x1b[2JThis is the third screen update"),
+		})
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(2 * time.Second),
+		})
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 1200, 2200, true, 1)
+
+	require.Len(t, responses, 4, "Should receive 4 messages: start, screen, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeScreen), responses[1][0], "Second message should be screen event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "This is the second screen update", "Screen event should contain data from after the clear screen sequence")
+	require.NotContains(t, string(responses[1][responseHeaderSize:]), "Hello, World!", "Screen event should not contain data from before the clear screen sequence")
+
+	require.Equal(t, byte(eventTypeBatch), responses[2][0], "Third message should be batch event")
+	require.Equal(t, byte(eventTypeStop), responses[3][0], "Fourth message should be stop event")
+}
+
+func TestResizeEvent(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("\x1b[H\x1b[2JHello, World!"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 700,
+			Data:              []byte("\033[2J\033[H"), // send a clear screen escape sequence
+		})
+		mockClient.sendEvent(&apievents.Resize{
+			TerminalSize: "100:30",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1100,
+			Data:              []byte("\x1b[H\x1b[2JThis is the second screen update"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1500,
+			Data:              []byte("\x1b[H\x1b[2JThis is the third screen update"),
+		})
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(2 * time.Second),
+		})
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 0, 1000, true, 1)
+
+	require.Len(t, responses, 4, "Should receive 4 messages: start, screen, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeScreen), responses[1][0], "Second message should be screen event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "[8;24;80t", "Initial screen event should have 24 rows and 80 columns")
+
+	responses = fetchAndCollectResponses(t, ws, 1000, 2000, true, 2)
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "[8;30;100", "Initial screen event should have 30 rows and 100 columns")
+}
+
+func TestBufferedEvents(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("Will be included in the first batch"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 999,
+			Data:              []byte("Will only just make it into the first batch"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1001,
+			Data:              []byte("Will be included in the second batch"),
+		})
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(2 * time.Second),
+		})
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 0, 1000, false, 1)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeBatch), responses[1][0], "Second message should be batch event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "Will only just make it into the first batch", "First batch should contain expected data")
+	require.NotContains(t, string(responses[1][responseHeaderSize:]), "Will be included in the second batch", "First batch should not contain data from the third print event")
+
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+
+	responses = fetchAndCollectResponses(t, ws, 1000, 2000, false, 2)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeBatch), responses[1][0], "Second message should be batch event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "Will be included in the second batch", "Second batch should contain expected data")
+
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+}
+
+func TestBufferedEvents_LargeGap(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("a"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 999,
+			Data:              []byte("b"),
+		})
+
+		// we will request the first second and then the 9th-10th seconds
+		// adding some events in the middle to ensure the events are processed properly and the terminal state is correct
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 2000,
+			Data:              []byte("c"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 3000,
+			Data:              []byte("d"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 4000,
+			Data:              []byte("e"),
+		})
+
+		// add some events into the time range that will be requested
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 9000,
+			Data:              []byte("f"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 9500,
+			Data:              []byte("g"),
+		})
+
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(10 * time.Second),
+		})
+	})
+
+	responses := fetchAndCollectResponses(t, ws, 0, 1000, false, 1)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeBatch), responses[1][0], "Second message should be batch event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "a", "First batch should contain event with 'a' data")
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "b", "First batch should contain event with 'b' data")
+
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+
+	responses = fetchAndCollectResponses(t, ws, 9000, 10000, true, 2)
+
+	require.Len(t, responses, 4, "Should receive 4 messages: start, screen, batch, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeScreen), responses[1][0], "Second message should be screen event")
+
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "abcde", "Screen event should contain data from all previous events")
+	require.NotContains(t, string(responses[1][responseHeaderSize:]), "f", "Screen event should not contain data from the future events")
+
+	require.Equal(t, byte(eventTypeBatch), responses[2][0], "Third message should be batch event")
+
+	require.Contains(t, string(responses[2][responseHeaderSize:]), "f", "Second batch should contain event with f data")
+	require.Contains(t, string(responses[2][responseHeaderSize:]), "g", "Second batch should contain event with g data")
+
+	require.Equal(t, byte(eventTypeStop), responses[3][0], "Fourth message should be stop event")
+}
+
+func TestScreenWithNoEventsInRange(t *testing.T) {
+	ws, _ := createWebSocket(t, func(mockClient *mockStreamClient) {
+		<-mockClient.eventRequested
+
+		mockClient.sendEvent(&apievents.SessionStart{
+			TerminalSize: "80:24",
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 500,
+			Data:              []byte("Early content"),
+		})
+		mockClient.sendEvent(&apievents.SessionPrint{
+			DelayMilliseconds: 1500,
+			Data:              []byte(" that should appear in screen"),
+		})
+		// No events in the 3000-4000ms range we'll request
+		mockClient.sendEvent(&apievents.SessionEnd{
+			StartTime: time.Now(),
+			EndTime:   time.Now().Add(5 * time.Second),
+		})
+	})
+
+	// Request a time range with no events but ask for screen
+	responses := fetchAndCollectResponses(t, ws, 3000, 4000, true, 1)
+
+	require.Len(t, responses, 3, "Should receive 3 messages: start, screen, stop")
+
+	require.Equal(t, byte(eventTypeStart), responses[0][0], "First message should be start event")
+	require.Equal(t, byte(eventTypeScreen), responses[1][0], "Second message should be screen event")
+
+	// The screen should contain the content from events before the requested range
+	require.Contains(t, string(responses[1][responseHeaderSize:]), "Early content that should appear in screen",
+		"Screen should contain terminal state even though no events in requested range")
+
+	require.Equal(t, byte(eventTypeStop), responses[2][0], "Third message should be stop event")
+}
+
+func TestUnsupportedRequest(t *testing.T) {
+	mockClient := newMockStreamClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := websocket.Upgrader{}
+		ws, _ := upgrader.Upgrade(w, r, nil)
+		defer ws.Close()
+
+		ctx := context.Background()
+		logger := slog.Default()
+
+		playback := newRecordingPlayback(ctx, ws, mockClient, "test-session", logger)
+		playback.run()
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http")
+	ws, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	require.NoError(t, err)
+	if resp != nil {
+		resp.Body.Close()
+	}
+	defer ws.Close()
+
+	// Send a request with an invalid request type
+	req := make([]byte, requestHeaderSize)
+	req[0] = 99 // invalid request type
+
+	err = ws.WriteMessage(websocket.BinaryMessage, req)
+	require.NoError(t, err)
+
+	ws.SetReadDeadline(time.Now().Add(5 * time.Second))
+
+	_, data, err := ws.ReadMessage()
+
+	// Should receive a message with the type set to eventTypeError
+	require.NoError(t, err)
+	require.Equal(t, byte(eventTypeError), data[0], "Response should be an error event")
+	require.Contains(t, string(data[responseHeaderSize:]), "unknown request type", "Error message should indicate unsupported request type")
+
+	deadline := time.Now().Add(time.Second)
+	ws.WriteControl(websocket.CloseMessage,
+		websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""),
+		deadline)
+}
+
+func TestNonBinaryMessageClosesWebSocket(t *testing.T) {
+	mockClient := newMockStreamClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := websocket.Upgrader{}
+		ws, _ := upgrader.Upgrade(w, r, nil)
+		defer ws.Close()
+
+		ctx := context.Background()
+		logger := slog.Default()
+
+		playback := newRecordingPlayback(ctx, ws, mockClient, "test-session", logger)
+		playback.run()
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http")
+	ws, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	require.NoError(t, err)
+	if resp != nil {
+		resp.Body.Close()
+	}
+	defer ws.Close()
+
+	// Send a text message (non-binary) - this should trigger the close handshake
+	err = ws.WriteMessage(websocket.TextMessage, []byte("this is a text message"))
+	require.NoError(t, err)
+
+	ws.SetReadDeadline(time.Now().Add(5 * time.Second))
+
+	// The server should send a close message with CloseUnsupportedData
+	_, _, err = ws.ReadMessage()
+	require.Error(t, err)
+
+	var closeErr *websocket.CloseError
+
+	require.ErrorAs(t, err, &closeErr, "Expected a websocket.CloseError, got %T: %v", err, err)
+	require.Equal(t, websocket.CloseUnsupportedData, closeErr.Code, "Expected CloseUnsupportedData (1003), got %d", closeErr.Code)
+	require.Contains(t, closeErr.Text, "only binary messages are supported", "Close message should explain that only binary messages are supported")
+
+	err = ws.WriteMessage(websocket.BinaryMessage, createFetchRequest(0, 1000, 1, false))
+
+	require.Error(t, err, "Should not be able to send messages after close handshake")
+}
+
+func createFetchRequest(start, end int64, requestID uint32, currentScreen bool) []byte {
+	buf := make([]byte, requestHeaderSize)
+
+	buf[0] = byte(requestTypeFetch)
+
+	binary.BigEndian.PutUint64(buf[1:9], uint64(start))
+	binary.BigEndian.PutUint64(buf[9:17], uint64(end))
+	binary.BigEndian.PutUint32(buf[17:21], requestID)
+
+	buf[21] = 0
+	if currentScreen {
+		buf[21] = 1
+	}
+
+	return buf
+}
+
+// fetchAndCollectResponses sends a fetch request over the WebSocket connection and collects all responses.
+func fetchAndCollectResponses(t *testing.T, ws *websocket.Conn, start, end int64, requestCurrentScreen bool, requestID uint32) [][]byte {
+	testTimeout := 5 * time.Second
+
+	req := createFetchRequest(start, end, requestID, requestCurrentScreen)
+
+	err := ws.WriteMessage(websocket.BinaryMessage, req)
+	require.NoError(t, err)
+
+	var responses [][]byte
+
+	done := make(chan bool)
+	go func() {
+		for {
+			ws.SetReadDeadline(time.Now().Add(testTimeout))
+			_, msg, err := ws.ReadMessage()
+			if err != nil {
+				break
+			}
+
+			responses = append(responses, msg)
+			if len(msg) > 0 && msg[0] == byte(eventTypeStop) {
+				done <- true
+				break
+			}
+		}
+	}()
+
+	select {
+	case success := <-done:
+		if !success {
+			t.Fatal("Connection closed before receiving stop event")
+		}
+	case <-time.After(testTimeout):
+		t.Fatal("Timeout waiting for responses")
+	}
+
+	return responses
+}
+
+// createWebSocket sets up a WebSocket server for testing, returning the server, websocket connection and mock
+// client, taking a callback to allow populating the mock client with events before running the playback.
+func createWebSocket(t *testing.T, setupEvents func(mockClient *mockStreamClient)) (*websocket.Conn, *mockStreamClient) {
+	mockClient := newMockStreamClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := websocket.Upgrader{}
+		ws, _ := upgrader.Upgrade(w, r, nil)
+		defer ws.Close()
+
+		ctx := context.Background()
+		logger := slog.Default()
+
+		playback := newRecordingPlayback(ctx, ws, mockClient, "test-session", logger)
+
+		go setupEvents(mockClient)
+
+		playback.run()
+	}))
+
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http")
+	ws, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	require.NoError(t, err)
+	if resp != nil {
+		resp.Body.Close()
+	}
+
+	t.Cleanup(func() {
+		deadline := time.Now().Add(time.Second)
+		ws.WriteControl(websocket.CloseMessage,
+			websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""),
+			deadline)
+
+		ws.Close()
+		server.Close()
+	})
+
+	return ws, mockClient
+}
+
+// mockStreamClient implements events.SessionStreamer interface for testing, counting the number of streams
+// and allowing sending events and errors to the channel.
+type mockStreamClient struct {
+	events         chan apievents.AuditEvent
+	errors         chan error
+	eventRequested chan struct{}
+	streamCount    int
+}
+
+func newMockStreamClient() *mockStreamClient {
+	return &mockStreamClient{
+		events:         make(chan apievents.AuditEvent, 100),
+		errors:         make(chan error, 1),
+		eventRequested: make(chan struct{}, 10),
+		streamCount:    0,
+	}
+}
+
+func (m *mockStreamClient) StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
+	m.streamCount += 1
+
+	// Notify that a new stream has been requested so that the test can send events to the channels.
+	select {
+	case m.eventRequested <- struct{}{}:
+	default:
+	}
+
+	return m.events, m.errors
+}
+
+func (m *mockStreamClient) sendEvent(evt apievents.AuditEvent) {
+	m.events <- evt
+}
+
+func (m *mockStreamClient) sendError(err error) {
+	m.errors <- err
+}
diff --git a/lib/web/resources.go b/lib/web/resources.go
index feb7178250e83..050dcb3178437 100644
--- a/lib/web/resources.go
+++ b/lib/web/resources.go
@@ -20,6 +20,7 @@ package web
 
 import (
 	"context"
+	"iter"
 	"net/http"
 	"net/url"
 	"strings"
@@ -33,11 +34,13 @@ import (
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
@@ -58,12 +61,15 @@ func listRoles(clt resourcesAPIGetter, values url.Values) (*listResourcesWithout
 		return nil, trace.Wrap(err)
 	}
 
+	skipSystemRoles := values.Get("includeSystemRoles") != "yes"
+	includeRoleObject := values.Get("includeObject") == "yes"
+
 	roles, err := clt.ListRoles(context.TODO(), &proto.ListRolesRequest{
 		Limit:    limit,
 		StartKey: values.Get("startKey"),
 		Filter: &types.RoleFilter{
 			SearchKeywords:  client.ParseSearchKeywords(values.Get("search"), ' '),
-			SkipSystemRoles: true,
+			SkipSystemRoles: skipSystemRoles,
 		},
 	})
 	if err != nil {
@@ -75,7 +81,7 @@ func listRoles(clt resourcesAPIGetter, values url.Values) (*listResourcesWithout
 		typeRoles = append(typeRoles, role)
 	}
 
-	uiRoles, err := ui.NewRoles(typeRoles)
+	uiRoles, err := ui.NewRoles(typeRoles, includeRoleObject)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -86,6 +92,41 @@ func listRoles(clt resourcesAPIGetter, values url.Values) (*listResourcesWithout
 	}, nil
 }
 
+// listRequestableRolesHandle is the web handler for listing requestable roles.
+// Under the hood this just calls the `ListRoles` method with a filter for requestable roles,
+// we have this as a separate endpoint because the response needs to be formatted differently.
+func (h *Handler) listRequestableRolesHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (any, error) {
+	clt, err := ctx.GetClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	values := r.URL.Query()
+
+	limit, err := QueryLimitAsInt32(values, "limit", defaults.MaxIterationLimit)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	rolesReq := &proto.ListRequestableRolesRequest{
+		PageSize:  limit,
+		PageToken: values.Get("startKey"),
+		Filter: &proto.ListRequestableRolesRequest_Filter{
+			SearchKeywords: client.ParseSearchKeywords(values.Get("search"), ' '),
+		},
+	}
+
+	resp, err := clt.ListRequestableRoles(r.Context(), rolesReq)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &listResourcesWithoutCountGetResponse{
+		Items:    ui.RequestableRolesFromProto(resp.Roles),
+		StartKey: resp.NextPageToken,
+	}, nil
+}
+
 func (h *Handler) deleteRole(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
 	clt, err := ctx.GetClient()
 	if err != nil {
@@ -142,7 +183,7 @@ func (h *Handler) updateRoleHandle(w http.ResponseWriter, r *http.Request, param
 // via the public ping endpoint.
 func (h *Handler) getPresetRoles(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
 	presets := auth.GetPresetRoles()
-	return ui.NewRoles(presets)
+	return ui.NewRoles(presets, false /* without role object */)
 }
 
 // getGithubConnectorHandle returns a GitHub connector by name.
@@ -229,7 +270,15 @@ func ProcessDefaultConnector(ctx context.Context, clt authclient.ClientI, connec
 }
 
 func getGithubConnectors(ctx context.Context, clt resourcesAPIGetter) ([]ui.ResourceItem, error) {
-	connectors, err := clt.GetGithubConnectors(ctx, true)
+	// TODO(okraport): DELETE IN v21.0.0, replace with regular collect.
+	connectors, err := clientutils.CollectWithFallback(ctx,
+		func(ctx context.Context, limit int, start string) ([]types.GithubConnector, string, error) {
+			return clt.ListGithubConnectors(ctx, limit, start, true)
+		},
+		func(ctx context.Context) ([]types.GithubConnector, error) {
+			return clt.GetGithubConnectors(ctx, true)
+		},
+	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -301,9 +350,18 @@ func (h *Handler) getTrustedClustersHandle(w http.ResponseWriter, r *http.Reques
 }
 
 func getTrustedClusters(ctx context.Context, clt resourcesAPIGetter) ([]ui.ResourceItem, error) {
-	trustedClusters, err := clt.GetTrustedClusters(ctx)
+
+	trustedClusters, err := stream.Collect(clientutils.Resources(ctx, clt.ListTrustedClusters))
 	if err != nil {
-		return nil, trace.Wrap(err)
+		// TODO(okraport) DELETE IN v21.0.0
+		if trace.IsNotImplemented(err) {
+			trustedClusters, err = clt.GetTrustedClusters(ctx)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		} else {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	return ui.NewTrustedClusters(trustedClusters)
@@ -626,10 +684,18 @@ type resourcesAPIGetter interface {
 	GetRole(ctx context.Context, name string) (types.Role, error)
 	// ListRoles returns a paginated list of roles.
 	ListRoles(ctx context.Context, req *proto.ListRolesRequest) (*proto.ListRolesResponse, error)
+	// ListRequestableRoles returns a paginated list of requestable roles.
+	ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error)
 	// UpsertRole creates or updates role
 	UpsertRole(ctx context.Context, role types.Role) (types.Role, error)
 	// GetGithubConnectors returns all configured Github connectors
 	GetGithubConnectors(ctx context.Context, withSecrets bool) ([]types.GithubConnector, error)
+	// ListGithubConnectors returns a page of valid registered Github connectors.
+	// withSecrets adds or removes client secret from return results.
+	ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error)
+	// RangeGithubConnectors returns valid registered Github connectors within the range [start, end).
+	// withSecrets adds or removes client secret from return results.
+	RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error]
 	// GetGithubConnector returns the specified Github connector
 	GetGithubConnector(ctx context.Context, id string, withSecrets bool) (types.GithubConnector, error)
 	// DeleteGithubConnector deletes the specified Github connector
@@ -640,6 +706,8 @@ type resourcesAPIGetter interface {
 	GetTrustedCluster(ctx context.Context, name string) (types.TrustedCluster, error)
 	// GetTrustedClusters returns all TrustedClusters in the backend.
 	GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster, error)
+	// ListTrustedClusters returns a page of Trusted Cluster resources.
+	ListTrustedClusters(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error)
 	// DeleteTrustedCluster removes a TrustedCluster from the backend by name.
 	DeleteTrustedCluster(ctx context.Context, name string) error
 	// ListResources returns a paginated list of resources.
diff --git a/lib/web/resources_test.go b/lib/web/resources_test.go
index 0871f5ef0a7b6..bffb17cd59c45 100644
--- a/lib/web/resources_test.go
+++ b/lib/web/resources_test.go
@@ -21,6 +21,7 @@ package web
 import (
 	"context"
 	"encoding/json"
+	"iter"
 	"net/http"
 	"net/url"
 	"strings"
@@ -40,6 +41,7 @@ import (
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
@@ -305,6 +307,7 @@ func TestListRoles(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
+		require.True(t, req.Filter.SkipSystemRoles)
 
 		return &proto.ListRolesResponse{
 			Roles:   []*types.RoleV6{role.(*types.RoleV6)},
@@ -317,6 +320,49 @@ func TestListRoles(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, roles.Items, 1)
 	require.Contains(t, roles.Items.([]ui.ResourceItem)[0].Content, "name: test")
+	require.Empty(t, roles.Items.([]ui.ResourceItem)[0].Object)
+}
+
+func TestListRolesQueryParamIncludeObject(t *testing.T) {
+	m := &mockedResourceAPIGetter{}
+
+	m.mockListRoles = func(ctx context.Context, req *proto.ListRolesRequest) (*proto.ListRolesResponse, error) {
+		role, err := types.NewRole("test", types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Logins: []string{"test"},
+			},
+		})
+		require.NoError(t, err)
+		require.True(t, req.Filter.SkipSystemRoles)
+
+		return &proto.ListRolesResponse{
+			Roles:   []*types.RoleV6{role.(*types.RoleV6)},
+			NextKey: "",
+		}, nil
+	}
+
+	// Test response is converted to ui objects.
+	roles, err := listRoles(m, url.Values{
+		"includeObject": []string{"yes"},
+	})
+	require.NoError(t, err)
+	require.Len(t, roles.Items, 1)
+	require.Contains(t, roles.Items.([]ui.ResourceItem)[0].Content, "name: test")
+	require.NotEmpty(t, roles.Items.([]ui.ResourceItem)[0].Object)
+	require.Equal(t, "test", roles.Items.([]ui.ResourceItem)[0].Object.GetName())
+}
+
+func TestListRolesQueryParamIncludeSystemRoles(t *testing.T) {
+	m := &mockedResourceAPIGetter{}
+
+	m.mockListRoles = func(ctx context.Context, req *proto.ListRolesRequest) (*proto.ListRolesResponse, error) {
+		require.False(t, req.Filter.SkipSystemRoles)
+		return nil, nil
+	}
+
+	listRoles(m, url.Values{
+		"includeSystemRoles": []string{"yes"},
+	})
 }
 
 func TestRoleCRUD(t *testing.T) {
@@ -550,7 +596,7 @@ func TestGithubConnectorsCRUD(t *testing.T) {
 	}
 }
 
-func TestGetTrustedClusters(t *testing.T) {
+func TestGetTrustedClustersFallback(t *testing.T) {
 	ctx := context.Background()
 	m := &mockedResourceAPIGetter{}
 
@@ -568,6 +614,24 @@ func TestGetTrustedClusters(t *testing.T) {
 	require.Contains(t, tcs[0].Content, "name: test")
 }
 
+func TestListTrustedClusters(t *testing.T) {
+	ctx := context.Background()
+	m := &mockedResourceAPIGetter{}
+
+	m.mockListTrustedClusters = func(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error) {
+		cluster, err := types.NewTrustedCluster("test", types.TrustedClusterSpecV2{})
+		require.NoError(t, err)
+
+		return []types.TrustedCluster{cluster}, "", nil
+	}
+
+	// Test response is converted to ui objects.
+	tcs, err := getTrustedClusters(ctx, m)
+	require.NoError(t, err)
+	require.Len(t, tcs, 1)
+	require.Contains(t, tcs[0].Content, "name: test")
+}
+
 func TestUpsertTrustedCluster(t *testing.T) {
 	m := &mockedResourceAPIGetter{}
 
@@ -720,13 +784,17 @@ type mockedResourceAPIGetter struct {
 	mockGetRole               func(ctx context.Context, name string) (types.Role, error)
 	mockGetRoles              func(ctx context.Context) ([]types.Role, error)
 	mockListRoles             func(ctx context.Context, req *proto.ListRolesRequest) (*proto.ListRolesResponse, error)
+	mockListRequestableRoles  func(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error)
 	mockUpsertRole            func(ctx context.Context, role types.Role) (types.Role, error)
 	mockGetGithubConnectors   func(ctx context.Context, withSecrets bool) ([]types.GithubConnector, error)
+	mockListGithubConnectors  func(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error)
+	mockRangeGithubConnectors func(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error]
 	mockGetGithubConnector    func(ctx context.Context, id string, withSecrets bool) (types.GithubConnector, error)
 	mockDeleteGithubConnector func(ctx context.Context, id string) error
 	mockUpsertTrustedCluster  func(ctx context.Context, tc types.TrustedCluster) (types.TrustedCluster, error)
 	mockGetTrustedCluster     func(ctx context.Context, name string) (types.TrustedCluster, error)
 	mockGetTrustedClusters    func(ctx context.Context) ([]types.TrustedCluster, error)
+	mockListTrustedClusters   func(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error)
 	mockDeleteTrustedCluster  func(ctx context.Context, name string) error
 	mockListResources         func(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
 	mockGetAuthPreference     func(ctx context.Context) (types.AuthPreference, error)
@@ -754,6 +822,13 @@ func (m *mockedResourceAPIGetter) ListRoles(ctx context.Context, req *proto.List
 	return nil, trace.NotImplemented("mockListRoles not implemented")
 }
 
+func (m *mockedResourceAPIGetter) ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error) {
+	if m.mockListRequestableRoles != nil {
+		return m.mockListRequestableRoles(ctx, req)
+	}
+	return nil, trace.NotImplemented("mockListRequestableRoles not implemented")
+}
+
 func (m *mockedResourceAPIGetter) UpsertRole(ctx context.Context, role types.Role) (types.Role, error) {
 	if m.mockUpsertRole != nil {
 		return m.mockUpsertRole(ctx, role)
@@ -770,6 +845,26 @@ func (m *mockedResourceAPIGetter) GetGithubConnectors(ctx context.Context, withS
 	return nil, trace.NotImplemented("mockGetGithubConnectors not implemented")
 }
 
+// ListGithubConnectors returns a page of valid registered Github connectors.
+// withSecrets adds or removes client secret from return results.
+func (m *mockedResourceAPIGetter) ListGithubConnectors(ctx context.Context, limit int, start string, withSecrets bool) ([]types.GithubConnector, string, error) {
+	if m.mockListGithubConnectors != nil {
+		return m.mockListGithubConnectors(ctx, limit, start, withSecrets)
+	}
+
+	return nil, "", trace.NotImplemented("mockListGithubConnectors not implemented")
+}
+
+// RangeGithubConnectors returns valid registered Github connectors within the range [start, end).
+// withSecrets adds or removes client secret from return results.
+func (m *mockedResourceAPIGetter) RangeGithubConnectors(ctx context.Context, start, end string, withSecrets bool) iter.Seq2[types.GithubConnector, error] {
+	if m.mockRangeGithubConnectors != nil {
+		return m.mockRangeGithubConnectors(ctx, start, end, withSecrets)
+	}
+
+	return stream.Fail[types.GithubConnector](trace.NotImplemented("mockRangeGithubConnectors not implemented"))
+}
+
 func (m *mockedResourceAPIGetter) GetGithubConnector(ctx context.Context, id string, withSecrets bool) (types.GithubConnector, error) {
 	if m.mockGetGithubConnector != nil {
 		return m.mockGetGithubConnector(ctx, id, false)
@@ -810,6 +905,13 @@ func (m *mockedResourceAPIGetter) GetTrustedClusters(ctx context.Context) ([]typ
 	return nil, trace.NotImplemented("mockGetTrustedClusters not implemented")
 }
 
+func (m *mockedResourceAPIGetter) ListTrustedClusters(ctx context.Context, limit int, startKey string) ([]types.TrustedCluster, string, error) {
+	if m.mockListTrustedClusters != nil {
+		return m.mockListTrustedClusters(ctx, limit, startKey)
+	}
+	return nil, "", trace.NotImplemented("mockListTrustedClusters not implemented")
+}
+
 func (m *mockedResourceAPIGetter) DeleteTrustedCluster(ctx context.Context, name string) error {
 	if m.mockDeleteTrustedCluster != nil {
 		return m.mockDeleteTrustedCluster(ctx, name)
@@ -918,6 +1020,69 @@ func Test_newKubeListRequest(t *testing.T) {
 	}
 }
 
+// TestListRequestableRoles tests the /webapi/requestableroles endpoint
+func TestListRequestableRoles(t *testing.T) {
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+
+	// Create a user role that can request another role
+	userRole, err := types.NewRole("user-role", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Logins: []string{"user"},
+			Request: &types.AccessRequestConditions{
+				Roles: []string{"role-requestable"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Create a requestable role
+	requestableRole, err := types.NewRole("role-requestable", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Logins: []string{"123"},
+		},
+	})
+	require.NoError(t, err)
+
+	// Create a role that they can't request
+	nonRequestableRole, err := types.NewRole("admin-role", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Logins: []string{"admin"},
+		},
+	})
+	require.NoError(t, err)
+
+	// Create the roles in the backend
+	_, err = env.server.Auth().CreateRole(ctx, userRole)
+	require.NoError(t, err)
+	_, err = env.server.Auth().CreateRole(ctx, requestableRole)
+	require.NoError(t, err)
+	_, err = env.server.Auth().CreateRole(ctx, nonRequestableRole)
+	require.NoError(t, err)
+
+	pack := proxy.authPack(t, "test-user", []types.Role{userRole})
+
+	resp, err := pack.clt.Get(ctx, pack.clt.Endpoint("webapi", "requestableroles"), url.Values{})
+	require.NoError(t, err)
+
+	var response expectedRequestableRoleResponse
+	err = json.Unmarshal(resp.Bytes(), &response)
+	require.NoError(t, err)
+
+	require.Len(t, response.Items, 1)
+
+	roleName := response.Items[0].Name
+	require.Equal(t, "role-requestable", roleName)
+
+	require.Empty(t, response.StartKey)
+}
+
+type expectedRequestableRoleResponse struct {
+	Items    []ui.RequestableRole `json:"items"`
+	StartKey string               `json:"startKey"`
+}
+
 func makeGithubConnector(t *testing.T, name string) types.GithubConnector {
 	connector, err := types.NewGithubConnector(name, types.GithubConnectorSpecV3{
 		TeamsToRoles: []types.TeamRolesMapping{
diff --git a/lib/web/scripts.go b/lib/web/scripts.go
index 9e4365fe766c6..0f64bc6da8fa0 100644
--- a/lib/web/scripts.go
+++ b/lib/web/scripts.go
@@ -36,7 +36,10 @@ import (
 	"github.com/gravitational/teleport/lib/web/scripts"
 )
 
-const insecureParamName = "insecure"
+const (
+	insecureParamName = "insecure"
+	groupParamName    = "group"
+)
 
 // installScriptHandle handles calls for "/scripts/install.sh" and responds with a bash script installing Teleport
 // by downloading and running `teleport-update`. This installation script does not start the agent, join it,
@@ -62,6 +65,9 @@ func (h *Handler) installScriptHandle(w http.ResponseWriter, r *http.Request, pa
 		}
 		opts.Insecure = v
 	}
+	if group := r.URL.Query().Get(groupParamName); group != "" {
+		opts.Group = group
+	}
 
 	script, err := scripts.GetInstallScript(r.Context(), opts)
 	if err != nil {
@@ -86,7 +92,7 @@ func (h *Handler) installScriptHandle(w http.ResponseWriter, r *http.Request, pa
 func (h *Handler) installScriptOptions(ctx context.Context) (scripts.InstallScriptOptions, error) {
 	const defaultGroup, defaultUpdater = "", ""
 
-	version, err := h.autoUpdateAgentVersion(ctx, defaultGroup, defaultUpdater)
+	version, err := h.autoUpdateResolver.GetVersion(ctx, defaultGroup, defaultUpdater)
 	if err != nil {
 		h.logger.WarnContext(ctx, "Failed to get intended agent version", "error", err)
 		version = teleport.SemVer()
diff --git a/lib/web/scripts/install.go b/lib/web/scripts/install.go
index 394fb5bc3d035..1c981e52a6ae5 100644
--- a/lib/web/scripts/install.go
+++ b/lib/web/scripts/install.go
@@ -92,6 +92,9 @@ type InstallScriptOptions struct {
 	// the artifacts from the CDN.
 	// The agent install in insecure mode will not be able to automatically update.
 	Insecure bool
+	// Group is the group for agent installation used by 'teleport-update enable' command.
+	// Ignored by legacy script.
+	Group string
 }
 
 // Check validates that the minimal options are set.
@@ -138,6 +141,9 @@ func (o *InstallScriptOptions) oneOffParams() (params oneoff.OneOffScriptParams)
 	}
 
 	successMessage := "Teleport successfully installed."
+	if o.Group != "" {
+		args = append(args, "--group", shsprintf.EscapeDefaultContext(o.Group))
+	}
 	if o.Insecure {
 		args = append(args, "--insecure")
 		successMessage += " --insecure was used during installation, automatic updates will not work unless the Proxy Service presents a certificate trusted by the system."
diff --git a/lib/web/scripts/install/install.sh b/lib/web/scripts/install/install.sh
index 29892b7c55551..71d9d3f70934d 100755
--- a/lib/web/scripts/install/install.sh
+++ b/lib/web/scripts/install/install.sh
@@ -328,13 +328,13 @@ install_teleport() {
   esac
 
   # select install method based on distribution
-  # if ID is debian derivate, run apt-get
+  # if ID is debian derivative, run apt-get
   case "$ID" in
   debian | ubuntu | kali | linuxmint | pop | raspbian | neon | zorin | parrot | elementary)
     install_via_apt_get
     ;;
   # if ID is amazon Linux 2/RHEL/etc, run yum
-  centos | rhel | amzn)
+  centos | rhel | rocky | almalinux | amzn)
     install_via_yum "$ID"
     ;;
   sles)
diff --git a/lib/web/scripts/install_test.go b/lib/web/scripts/install_test.go
index 82074daffa5e6..0aee64198b68a 100644
--- a/lib/web/scripts/install_test.go
+++ b/lib/web/scripts/install_test.go
@@ -97,6 +97,24 @@ func TestGetInstallScript(t *testing.T) {
 				require.Contains(t, script, "packageSuffix='bin.tar.gz'")
 			},
 		},
+		{
+			name: "Oneoff install with group",
+			opts: InstallScriptOptions{
+				AutoupdateStyle: UpdaterBinaryAutoupdate,
+				TeleportVersion: testVersion,
+				ProxyAddr:       testProxyAddr,
+				TeleportFlavor:  types.PackageNameOSS,
+				Group:           "development",
+			},
+			assertFn: func(t *testing.T, script string) {
+				require.Contains(t, script, "entrypoint='teleport-update'")
+				require.Contains(t, script, fmt.Sprintf("teleportVersion='v%s'", testVersion))
+				require.Contains(t, script, fmt.Sprintf("teleportFlavor='%s'", types.PackageNameOSS))
+				require.Contains(t, script, fmt.Sprintf("cdnBaseURL='%s'", teleportassets.CDNBaseURL()))
+				require.Contains(t, script, fmt.Sprintf("entrypointArgs='enable --proxy %s --group development'", testProxyAddr))
+				require.Contains(t, script, "packageSuffix='bin.tar.gz'")
+			},
+		},
 		{
 			name: "Oneoff install custom CDN",
 			opts: InstallScriptOptions{
diff --git a/lib/web/scripts/node-join/install.sh b/lib/web/scripts/node-join/install.sh
index 9fc4621c813d4..22f19b6d9589c 100755
--- a/lib/web/scripts/node-join/install.sh
+++ b/lib/web/scripts/node-join/install.sh
@@ -419,7 +419,24 @@ get_download_filename() { echo "${1##*/}"; }
 # gets the pid of any running teleport process (and converts newlines to spaces)
 get_teleport_pid() {
     check_exists_fatal pgrep xargs
-    pgrep teleport | xargs echo
+    TELEPORT_PIDS=$(pgrep teleport | xargs echo)
+    # if we have procfs available (i.e. on Linux), we do a more detailed check for the binary name
+    # this method also combats issues with install scripts running in cloud-init with "teleport" in
+    # their name (see https://github.com/gravitational/teleport/pull/59452)
+    # for MacOS (and Linux without procfs, if that ever happens), we just use the original behaviour
+    if [[ -d /proc ]]; then
+        check_exists_fatal basename readlink
+        TELEPORT_PIDS=""
+        POTENTIAL_PIDS=$(pgrep -f "teleport start" | xargs echo)
+        for PID in ${POTENTIAL_PIDS}; do
+            if [ -f /proc/${PID}/exe ]; then
+                EXE=$(basename "$(readlink /proc/${PID}/exe)")
+                if [[ "${EXE}" == "teleport" ]]; then TELEPORT_PIDS="${PID} ${TELEPORT_PIDS}"; fi
+            fi
+        done
+    fi
+    # return list of pids with whitespace trimmed from the end
+    echo ${TELEPORT_PIDS%%[[:space:]]*}
 }
 # returns a command which will start teleport using the config
 get_teleport_start_command() {
diff --git a/lib/web/scripts/oneoff/oneoff.go b/lib/web/scripts/oneoff/oneoff.go
index 794749b1abc02..a4a974f971c0a 100644
--- a/lib/web/scripts/oneoff/oneoff.go
+++ b/lib/web/scripts/oneoff/oneoff.go
@@ -146,7 +146,8 @@ func (p *OneOffScriptParams) CheckAndSetDefaults() error {
 
 	switch p.TeleportCommandPrefix {
 	case PrefixSUDO:
-		p.TeleportCommandPrefix = p.binSudo
+		// add -E to preserve environment variables set before executing the script.
+		p.TeleportCommandPrefix = p.binSudo + " -E"
 	case "":
 	default:
 		return trace.BadParameter("invalid command prefix %q, only %v are supported", p.TeleportCommandPrefix, allowedCommandPrefix)
diff --git a/lib/web/scripts/oneoff/oneoff.sh b/lib/web/scripts/oneoff/oneoff.sh
index eaa15841be18b..1b86eec3fe903 100644
--- a/lib/web/scripts/oneoff/oneoff.sh
+++ b/lib/web/scripts/oneoff/oneoff.sh
@@ -21,7 +21,7 @@ trap 'rm -rf -- "$tempDir"' EXIT
 
 teleportTarballName() {
     if [ "${OS}" = "Darwin" ]; then
-        if [ "$fips" = "true"]; then
+        if [ "$fips" = "true" ]; then
             echo "FIPS version of Teleport is not compatible with MacOS. Please run this script in a Linux machine."
             return 1
         fi
diff --git a/lib/web/scripts/oneoff/oneoff_test.go b/lib/web/scripts/oneoff/oneoff_test.go
index c6da7d96e2e21..96df131666dc9 100644
--- a/lib/web/scripts/oneoff/oneoff_test.go
+++ b/lib/web/scripts/oneoff/oneoff_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -130,6 +131,112 @@ func TestOneOffScript(t *testing.T) {
 		require.NoDirExists(t, testWorkingDir)
 	})
 
+	t.Run("command can be executed on MacOS", func(t *testing.T) {
+		// set up
+		testWorkingDir := t.TempDir()
+		require.NoError(t, os.Mkdir(testWorkingDir+"/bin/", 0o755))
+		scriptLocation := testWorkingDir + "/" + scriptName
+
+		teleportMock, err := bintest.NewMock(testWorkingDir + "/bin/teleport")
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			assert.NoError(t, teleportMock.Close())
+		})
+
+		teleportBinTarball, err := utils.CompressTarGzArchive([]string{"teleport/teleport"}, singleFileFS{file: teleportMock.Path})
+		require.NoError(t, err)
+
+		testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			assert.Equal(t, "/teleport-v13.1.0-darwin-universal-bin.tar.gz", req.URL.Path)
+			http.ServeContent(w, req, "teleport-v13.1.0-darwin-universal-bin.tar.gz", time.Now(), bytes.NewReader(teleportBinTarball.Bytes()))
+		}))
+		t.Cleanup(func() { testServer.Close() })
+
+		script, err := BuildScript(OneOffScriptParams{
+			BinUname:        unameMock.Path,
+			BinMktemp:       mktempMock.Path,
+			CDNBaseURL:      testServer.URL,
+			TeleportVersion: "v13.1.0",
+			EntrypointArgs:  "version",
+			SuccessMessage:  "Test was a success.",
+		})
+		require.NoError(t, err)
+
+		unameMock.Expect("-s").AndWriteToStdout("Darwin")
+		unameMock.Expect("-m").AndWriteToStdout("x86_64")
+		mktempMock.Expect("-d", "-p", homeDir).AndWriteToStdout(testWorkingDir)
+		teleportMock.Expect("version").AndWriteToStdout(teleportVersionOutput)
+
+		err = os.WriteFile(scriptLocation, []byte(script), 0700)
+		require.NoError(t, err)
+
+		// execute script
+		out, err := exec.Command("sh", scriptLocation).CombinedOutput()
+
+		// validate
+		require.NoError(t, err, string(out))
+
+		require.True(t, unameMock.Check(t))
+		require.True(t, mktempMock.Check(t))
+		require.True(t, teleportMock.Check(t))
+
+		require.Contains(t, string(out), "teleport version")
+		require.Contains(t, string(out), teleportVersionOutput)
+		require.Contains(t, string(out), "Test was a success.")
+
+		// Script should remove the temporary directory.
+		require.NoDirExists(t, testWorkingDir)
+	})
+
+	t.Run("MacOS + fips fails", func(t *testing.T) {
+		// set up
+		testWorkingDir := t.TempDir()
+		require.NoError(t, os.Mkdir(testWorkingDir+"/bin/", 0o755))
+		scriptLocation := testWorkingDir + "/" + scriptName
+
+		teleportMock, err := bintest.NewMock(testWorkingDir + "/bin/teleport")
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			assert.NoError(t, teleportMock.Close())
+		})
+
+		testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			assert.Fail(t, "should not be called", req.URL.String())
+		}))
+		t.Cleanup(func() { testServer.Close() })
+
+		script, err := BuildScript(OneOffScriptParams{
+			BinUname:        unameMock.Path,
+			BinMktemp:       mktempMock.Path,
+			CDNBaseURL:      testServer.URL,
+			TeleportVersion: "v13.1.0",
+			EntrypointArgs:  "version",
+			SuccessMessage:  "Test was a success.",
+			TeleportFIPS:    true,
+		})
+		require.NoError(t, err)
+
+		unameMock.Expect("-s").AndWriteToStdout("Darwin")
+		unameMock.Expect("-m").AndWriteToStdout("x86_64")
+		mktempMock.Expect("-d", "-p", homeDir).AndWriteToStdout(testWorkingDir)
+		// no call expected to teleportMock
+
+		err = os.WriteFile(scriptLocation, []byte(script), 0700)
+		require.NoError(t, err)
+
+		// execute script
+		out, err := exec.Command("sh", scriptLocation).CombinedOutput()
+
+		// validate
+		require.Error(t, err, string(out))
+
+		require.True(t, unameMock.Check(t))
+		require.True(t, mktempMock.Check(t))
+
+		// Script should remove the temporary directory.
+		require.NoDirExists(t, testWorkingDir)
+	})
+
 	t.Run("command with prefix can be executed", func(t *testing.T) {
 		// set up
 		testWorkingDir := t.TempDir()
@@ -166,7 +273,7 @@ func TestOneOffScript(t *testing.T) {
 		unameMock.Expect("-s").AndWriteToStdout("Linux")
 		unameMock.Expect("-m").AndWriteToStdout("x86_64")
 		mktempMock.Expect("-d", "-p", homeDir).AndWriteToStdout(testWorkingDir)
-		sudoMock.Expect(teleportMock.Path, "version").AndWriteToStdout(teleportVersionOutput)
+		sudoMock.Expect("-E", teleportMock.Path, "version").AndWriteToStdout(teleportVersionOutput)
 
 		err = os.WriteFile(scriptLocation, []byte(script), 0700)
 		require.NoError(t, err)
@@ -326,7 +433,7 @@ func TestOneOffScript(t *testing.T) {
 			assert.NoError(t, teleportMock.Close())
 		})
 
-		modules.SetTestModules(t, &modules.TestModules{
+		modulestest.SetTestModules(t, modulestest.Modules{
 			TestBuildType: modules.BuildEnterprise,
 		})
 		teleportBinTarball, err := utils.CompressTarGzArchive([]string{"teleport-ent/teleport"}, singleFileFS{file: teleportMock.Path})
diff --git a/lib/web/servers.go b/lib/web/servers.go
index 3dfa9fe6674db..1ee4b50bee88e 100644
--- a/lib/web/servers.go
+++ b/lib/web/servers.go
@@ -21,6 +21,7 @@ package web
 import (
 	"net/http"
 	"slices"
+	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
@@ -34,8 +35,8 @@ import (
 )
 
 // clusterKubesGet returns a list of kube clusters in a form the UI can present.
-func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -63,7 +64,7 @@ func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p http
 }
 
 // clusterKubeResourcesGet returns supported requested kubernetes subresources eg: pods, namespaces, secrets etc.
-func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	kind := r.URL.Query().Get("kind")
 	kubeCluster := r.URL.Query().Get("kubeCluster")
 
@@ -75,8 +76,8 @@ func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request
 		return nil, trace.BadParameter("missing param %q", "kind")
 	}
 
-	if !slices.Contains(types.KubernetesResourcesKinds, kind) {
-		return nil, trace.BadParameter("kind is not valid, valid kinds %v", types.KubernetesResourcesKinds)
+	if !slices.Contains(types.KubernetesResourcesKinds, kind) && !strings.HasPrefix(kind, types.AccessRequestPrefixKindKube) {
+		return nil, trace.BadParameter("kind is not valid, valid kinds %v %s<kind>", types.KubernetesResourcesKinds, types.AccessRequestPrefixKindKube)
 	}
 
 	clt, err := sctx.NewKubernetesServiceClient(r.Context(), h.cfg.ProxyWebAddr.Addr)
@@ -84,7 +85,7 @@ func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := listKubeResources(r.Context(), clt, r.URL.Query(), site.GetName(), kind)
+	resp, err := listKubeResources(r.Context(), clt, r.URL.Query(), cluster.GetName(), kind)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -96,9 +97,32 @@ func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request
 	}, nil
 }
 
+// clusterKubeServersList returns a list of kube servers in a form the UI can present.
+func (h *Handler) clusterKubeServersList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := ctx.GetUserClient(r.Context(), cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	req, err := convertListResourcesRequest(r, types.KindKubeServer)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	page, err := client.GetResourcePage[types.KubeServer](r.Context(), clt, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return listResourcesGetResponse{
+		Items:    page.Resources,
+		StartKey: page.NextKey,
+	}, nil
+}
+
 // clusterDatabasesGet returns a list of db servers in a form the UI can present.
-func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -132,33 +156,46 @@ func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p
 }
 
 // clusterDatabaseGet returns a database in a form the UI can present.
-func (h *Handler) clusterDatabaseGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDatabaseGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("database name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	dbServer, err := fetchDatabaseServerByDatabaseName(r.Context(), clt, r, databaseName)
+	dbServers, err := fetchDatabaseServersWithName(r.Context(), clt, r, databaseName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	aggregateStatus := types.AggregateHealthStatus(func(yield func(types.TargetHealthStatus) bool) {
+		for _, srv := range dbServers {
+			if !yield(srv.GetTargetHealthStatus()) {
+				return
+			}
+		}
+	})
+	dbServers[0].SetTargetHealthStatus(aggregateStatus)
 
 	accessChecker, err := sctx.GetUserAccessChecker()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return webui.MakeDatabaseFromDatabaseServer(dbServer, accessChecker, h.cfg.DatabaseREPLRegistry, false /* requiresRequest */), nil
+	return webui.MakeDatabaseFromDatabaseServer(
+		dbServers[0],
+		accessChecker,
+		h.cfg.DatabaseREPLRegistry,
+		false, /* requiresRequest */
+	), nil
 }
 
 // clusterDatabaseServicesList returns a list of DatabaseServices (database agents) in a form the UI can present.
-func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := ctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := ctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -181,8 +218,8 @@ func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Req
 }
 
 // clusterDatabaseServersList returns a list of database servers in a form the UI can present.
-func (h *Handler) clusterDatabaseServersList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := ctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterDatabaseServersList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := ctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -204,8 +241,8 @@ func (h *Handler) clusterDatabaseServersList(w http.ResponseWriter, r *http.Requ
 }
 
 // clusterDesktopsGet returns a list of desktops in a form the UI can present.
-func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -238,10 +275,10 @@ func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p h
 }
 
 // clusterDesktopServicesGet returns a list of desktop services in a form the UI can present.
-func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of desktop services.
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -264,8 +301,8 @@ func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Reque
 }
 
 // getDesktopHandle returns a desktop.
-func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -305,7 +342,7 @@ func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p htt
 // Response body:
 //
 // {"active": bool}
-func (h *Handler) desktopIsActive(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) desktopIsActive(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	desktopName := p.ByName("desktopName")
 	trackers, err := h.auth.proxyClient.GetActiveSessionTrackersWithFilter(r.Context(), &types.SessionTrackerFilter{
 		Kind: string(types.WindowsDesktopSessionKind),
@@ -318,7 +355,7 @@ func (h *Handler) desktopIsActive(w http.ResponseWriter, r *http.Request, p http
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -385,7 +422,7 @@ func (r *createNodeRequest) checkAndSetDefaults() error {
 }
 
 // handleNodeCreate creates a Teleport Node.
-func (h *Handler) handleNodeCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) handleNodeCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	ctx := r.Context()
 
 	var req *createNodeRequest
@@ -397,7 +434,7 @@ func (h *Handler) handleNodeCreate(w http.ResponseWriter, r *http.Request, p htt
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -444,5 +481,5 @@ func (h *Handler) handleNodeCreate(w http.ResponseWriter, r *http.Request, p htt
 		return nil, trace.Wrap(err)
 	}
 
-	return webui.MakeServer(site.GetName(), server, logins, false /* requiresRequest */), nil
+	return webui.MakeServer(cluster.GetName(), server, logins, false /* requiresRequest */), nil
 }
diff --git a/lib/web/session/cookie.go b/lib/web/session/cookie.go
index df9bb4b538a6b..5034e8546db30 100644
--- a/lib/web/session/cookie.go
+++ b/lib/web/session/cookie.go
@@ -22,6 +22,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"net/http"
+	"time"
 )
 
 // Cookie stores information about active user and session
@@ -56,7 +57,7 @@ func DecodeCookie(b string) (*Cookie, error) {
 
 // SetCookie encodes the provided user and session id via [EncodeCookie]
 // and then sets the [http.Cookie] of the provided [http.ResponseWriter].
-func SetCookie(w http.ResponseWriter, user, sid string) error {
+func SetCookie(w http.ResponseWriter, user, sid string, expiry time.Time) error {
 	d, err := EncodeCookie(user, sid)
 	if err != nil {
 		return err
@@ -69,6 +70,11 @@ func SetCookie(w http.ResponseWriter, user, sid string) error {
 		Secure:   true,
 		SameSite: http.SameSiteLaxMode,
 	}
+	// if expiry is zero or in the past, we can skip MaxAge and treat as a session cookie.
+	// Otherwise, set maxage
+	if maxAge := int(time.Until(expiry).Seconds()); maxAge > 0 {
+		c.MaxAge = maxAge
+	}
 	http.SetCookie(w, c)
 	return nil
 }
diff --git a/lib/web/session/cookie_test.go b/lib/web/session/cookie_test.go
index 8f7d685033cfe..247acecb14c40 100644
--- a/lib/web/session/cookie_test.go
+++ b/lib/web/session/cookie_test.go
@@ -21,6 +21,7 @@ package session
 import (
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 )
@@ -32,23 +33,59 @@ func TestCookies(t *testing.T) {
 	)
 	expectedCookie := &Cookie{User: user, SID: sessionID}
 
-	encodedCookie, err := EncodeCookie(user, sessionID)
-	require.NoError(t, err)
+	t.Run("encode and decode", func(t *testing.T) {
+		encodedCookie, err := EncodeCookie(user, sessionID)
+		require.NoError(t, err)
 
-	cookie, err := DecodeCookie(encodedCookie)
-	require.NoError(t, err)
-	require.Equal(t, expectedCookie, cookie)
+		cookie, err := DecodeCookie(encodedCookie)
+		require.NoError(t, err)
+		require.Equal(t, expectedCookie, cookie)
+	})
 
-	recorder := httptest.NewRecorder()
-	require.Empty(t, recorder.Header().Get("Set-Cookie"))
+	tests := []struct {
+		name           string
+		expiry         time.Time
+		expectClear    bool
+		expectedCookie string
+	}{
+		{
+			name:           "valid expiry",
+			expiry:         time.Now().Add(10 * time.Second),
+			expectClear:    true,
+			expectedCookie: "__Host-session=7b2275736572223a226c6c616d61222c22736964223a223938373635227d; Path=/; Max-Age=9; HttpOnly; Secure; SameSite=Lax",
+		},
+		{
+			name:           "expired cert (returns session cookie)",
+			expiry:         time.Now().Add(-10 * time.Second),
+			expectClear:    false,
+			expectedCookie: "__Host-session=7b2275736572223a226c6c616d61222c22736964223a223938373635227d; Path=/; HttpOnly; Secure; SameSite=Lax",
+		},
+		{
+			name:           "zero time (returns session cookie)",
+			expiry:         time.Time{},
+			expectClear:    false,
+			expectedCookie: "__Host-session=7b2275736572223a226c6c616d61222c22736964223a223938373635227d; Path=/; HttpOnly; Secure; SameSite=Lax",
+		},
+	}
 
-	require.NoError(t, SetCookie(recorder, user, sessionID))
-	ClearCookie(recorder)
-	setCookies := recorder.Header().Values("Set-Cookie")
-	require.Len(t, setCookies, 2)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			require.Empty(t, recorder.Header().Get("Set-Cookie"))
 
-	// SetCookie will store the encoded session in the cookie
-	require.Equal(t, "__Host-session=7b2275736572223a226c6c616d61222c22736964223a223938373635227d; Path=/; HttpOnly; Secure; SameSite=Lax", setCookies[0])
-	// ClearCookie will add an entry with the cookie value cleared out
-	require.Equal(t, "__Host-session=; Path=/; HttpOnly; Secure; SameSite=Lax", setCookies[1])
+			require.NoError(t, SetCookie(recorder, user, sessionID, tt.expiry))
+
+			if tt.expectClear {
+				ClearCookie(recorder)
+				setCookies := recorder.Header().Values("Set-Cookie")
+				require.Len(t, setCookies, 2)
+				require.Equal(t, tt.expectedCookie, setCookies[0])
+				require.Equal(t, "__Host-session=; Path=/; HttpOnly; Secure; SameSite=Lax", setCookies[1])
+			} else {
+				setCookies := recorder.Header().Values("Set-Cookie")
+				require.Len(t, setCookies, 1)
+				require.Equal(t, tt.expectedCookie, setCookies[0])
+			}
+		})
+	}
 }
diff --git a/lib/web/sessions.go b/lib/web/sessions.go
index 0b9bb14957fe1..132e65db08cfc 100644
--- a/lib/web/sessions.go
+++ b/lib/web/sessions.go
@@ -28,7 +28,6 @@ import (
 	"log/slog"
 	"net"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -57,7 +56,6 @@ import (
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/session"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/sshca"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -77,7 +75,7 @@ type SessionContext struct {
 	// session.
 	remoteClientCache
 	// remoteClientGroup prevents duplicate requests to create remote clients
-	// for a given site
+	// for a given cluster
 	remoteClientGroup singleflight.Group
 
 	// mu guards kubeGRPCServiceConn.
@@ -115,8 +113,8 @@ type SessionContextConfig struct {
 	// Session refers the web session created for the user.
 	Session types.WebSession
 
-	// newRemoteClient is used by tests to override how remote clients are constructed to allow for fake sites
-	newRemoteClient func(ctx context.Context, sessionContext *SessionContext, site reversetunnelclient.RemoteSite) (authclient.ClientI, error)
+	// newRemoteClient is used by tests to override how remote clients are constructed to allow for fake clusters
+	newRemoteClient func(ctx context.Context, sessionContext *SessionContext, cluster reversetunnelclient.Cluster) (authclient.ClientI, error)
 }
 
 func (c *SessionContextConfig) CheckAndSetDefaults() error {
@@ -227,36 +225,36 @@ func (c *SessionContext) GetClientConnection() *grpc.ClientConn {
 }
 
 // GetUserClient will return an [authclient.ClientI]  with the role of the user at
-// the requested site. If the site is local a client with the users local role
-// is returned. If the site is remote a client with the users remote role is
+// the requested cluster. If the cluster is local a client with the users local role
+// is returned. If the cluster is remote a client with the users remote role is
 // returned.
-func (c *SessionContext) GetUserClient(ctx context.Context, site reversetunnelclient.RemoteSite) (authclient.ClientI, error) {
+func (c *SessionContext) GetUserClient(ctx context.Context, cluster reversetunnelclient.Cluster) (authclient.ClientI, error) {
 	// if we're trying to access the local cluster, pass back the local client.
-	if c.cfg.RootClusterName == site.GetName() {
+	if c.cfg.RootClusterName == cluster.GetName() {
 		return c.cfg.RootClient, nil
 	}
 
-	// return the client for the requested remote site
-	clt, err := c.remoteClient(ctx, site)
+	// return the client for the requested remote cluster
+	clt, err := c.remoteClient(ctx, cluster)
 	return clt, trace.Wrap(err)
 }
 
 // remoteClient returns an [authclient.ClientI]  with the role of the user at
-// the requested [site]. All remote clients are lazily created
+// the requested [cluster]. All remote clients are lazily created
 // when they are first requested and then cached. Subsequent requests
 // will return the previously created client to prevent having more than
-// a single [authclient.ClientI]  per site for a user.
+// a single [authclient.ClientI]  per cluster for a user.
 //
 // A [singleflight.Group] is leveraged to prevent duplicate requests for remote
 // clients at the same time to race.
-func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnelclient.RemoteSite) (authclient.ClientI, error) {
-	cltI, err, _ := c.remoteClientGroup.Do(site.GetName(), func() (interface{}, error) {
+func (c *SessionContext) remoteClient(ctx context.Context, cluster reversetunnelclient.Cluster) (authclient.ClientI, error) {
+	cltI, err, _ := c.remoteClientGroup.Do(cluster.GetName(), func() (any, error) {
 		// check if we already have a connection to this cluster
-		if clt, ok := c.remoteClientCache.getRemoteClient(site); ok {
+		if clt, ok := c.remoteClientCache.getRemoteClient(cluster); ok {
 			return clt, nil
 		}
 
-		rClt, err := c.cfg.newRemoteClient(ctx, c, site)
+		rClt, err := c.cfg.newRemoteClient(ctx, c, cluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -264,10 +262,10 @@ func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnelcli
 		// we'll save the remote client in our session context so we don't have to
 		// build a new connection next time. all remote clients will be closed when
 		// the session context is closed.
-		err = c.remoteClientCache.addRemoteClient(site, rClt)
+		err = c.remoteClientCache.addRemoteClient(cluster, rClt)
 		if err != nil {
-			c.cfg.Log.InfoContext(ctx, "Failed closing stale remote client for site",
-				"remote_site", site.GetName(),
+			c.cfg.Log.InfoContext(ctx, "Failed closing stale remote client for cluster",
+				"remote_cluster", cluster.GetName(),
 				"error", err,
 			)
 		}
@@ -288,8 +286,8 @@ func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnelcli
 }
 
 // newRemoteClient returns a client to a remote cluster with the role of current user.
-func newRemoteClient(ctx context.Context, sctx *SessionContext, site reversetunnelclient.RemoteSite) (authclient.ClientI, error) {
-	clt, err := sctx.newRemoteTLSClient(ctx, site)
+func newRemoteClient(ctx context.Context, sctx *SessionContext, cluster reversetunnelclient.Cluster) (authclient.ClientI, error) {
+	clt, err := sctx.newRemoteTLSClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -305,7 +303,7 @@ func newRemoteClient(ctx context.Context, sctx *SessionContext, site reversetunn
 }
 
 // clusterDialer returns DialContext function using cluster's dial function
-func clusterDialer(remoteCluster reversetunnelclient.RemoteSite, src, dst net.Addr) apiclient.ContextDialer {
+func clusterDialer(remoteCluster reversetunnelclient.Cluster, src, dst net.Addr) apiclient.ContextDialer {
 	return apiclient.ContextDialerFunc(func(in context.Context, network, _ string) (net.Conn, error) {
 		dialParams := reversetunnelclient.DialParams{
 			From:                  src,
@@ -343,16 +341,11 @@ func (c *SessionContext) NewKubernetesServiceClient(ctx context.Context, addr st
 		ctx,
 		addr,
 		grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)),
+		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 		grpc.WithChainUnaryInterceptor(
-			//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-			// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-			otelgrpc.UnaryClientInterceptor(),
 			metadata.UnaryClientInterceptor,
 		),
 		grpc.WithChainStreamInterceptor(
-			//nolint:staticcheck // SA1019. There is a data race in the stats.Handler that is replacing
-			// the interceptor. See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4576.
-			otelgrpc.StreamClientInterceptor(),
 			metadata.StreamClientInterceptor,
 		),
 	)
@@ -404,7 +397,7 @@ func (c *SessionContext) ClientTLSConfig(ctx context.Context, clusterName ...str
 	return tlsConfig, nil
 }
 
-func (c *SessionContext) newRemoteTLSClient(ctx context.Context, cluster reversetunnelclient.RemoteSite) (authclient.ClientI, error) {
+func (c *SessionContext) newRemoteTLSClient(ctx context.Context, cluster reversetunnelclient.Cluster) (authclient.ClientI, error) {
 	tlsConfig, err := c.ClientTLSConfig(ctx, cluster.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -519,7 +512,7 @@ func (c *SessionContext) GetUserAccessChecker() (services.AccessChecker, error)
 
 	accessInfo := services.AccessInfoFromLocalSSHIdentity(ident)
 
-	accessChecker, err := services.NewAccessChecker(accessInfo, c.cfg.RootClusterName, c.cfg.UnsafeCachedAuthClient)
+	accessChecker, err := services.NewAccessCheckerForUserSession(accessInfo, c.cfg.RootClusterName, c.cfg.UnsafeCachedAuthClient)
 	return accessChecker, trace.Wrap(err)
 }
 
@@ -619,7 +612,7 @@ func (c *SessionContext) expired(ctx context.Context) bool {
 	// Give the session some time to linger so existing users of the context
 	// have successfully disposed of them.
 	// If we remove the session immediately, a stale copy might still use the
-	// cached site clients.
+	// cached cluster clients.
 	// This is a cheaper way to avoid race without introducing object
 	// reference counters.
 	return c.cfg.Parent.clock.Since(expiry) > c.cfg.Parent.sessionLingeringThreshold
@@ -806,7 +799,7 @@ func (s *sessionCache) watchWebSessions(ctx context.Context) {
 		if err := s.watchWebSessionsOnce(ctx, linear.Reset); err != nil && !errors.Is(err, context.Canceled) {
 			const msg = "" +
 				"sessionCache: WebSession watcher aborted, re-connecting. " +
-				"This may have an impact in device trust web sessions."
+				"This may have an impact on Device Trust web sessions."
 			s.log.WarnContext(ctx, msg, "error", err)
 		}
 	}
@@ -963,6 +956,7 @@ func (s *sessionCache) AuthenticateSSHUser(
 ) (*authclient.SSHLoginResponse, error) {
 	authReq := authclient.AuthenticateUserRequest{
 		Username:       c.User,
+		Scope:          c.Scope,
 		ClientMetadata: clientMeta,
 		SSHPublicKey:   c.UserPublicKeys.SSHPubKey,
 		TLSPublicKey:   c.UserPublicKeys.TLSPubKey,
@@ -1280,43 +1274,43 @@ func sessionKey(user, sessionID string) string {
 	return user + sessionID
 }
 
-// remoteClientCache stores remote clients keyed by site name while also keeping
-// track of the actual remote site associated with the client (in case the
-// remote site has changed). Safe for concurrent access. Closes all clients and
+// remoteClientCache stores remote clients keyed by cluster name while also keeping
+// track of the actual remote cluster associated with the client (in case the
+// remote cluster has changed). Safe for concurrent access. Closes all clients and
 // wipes the cache on Close.
 type remoteClientCache struct {
 	sync.Mutex
 	clients map[string]struct {
 		authclient.ClientI
-		reversetunnelclient.RemoteSite
+		reversetunnelclient.Cluster
 	}
 }
 
-func (c *remoteClientCache) addRemoteClient(site reversetunnelclient.RemoteSite, remoteClient authclient.ClientI) error {
+func (c *remoteClientCache) addRemoteClient(cluster reversetunnelclient.Cluster, remoteClient authclient.ClientI) error {
 	c.Lock()
 	defer c.Unlock()
 	if c.clients == nil {
 		c.clients = make(map[string]struct {
 			authclient.ClientI
-			reversetunnelclient.RemoteSite
+			reversetunnelclient.Cluster
 		})
 	}
 	var err error
-	if c.clients[site.GetName()].ClientI != nil {
-		err = c.clients[site.GetName()].ClientI.Close()
+	if c.clients[cluster.GetName()].ClientI != nil {
+		err = c.clients[cluster.GetName()].ClientI.Close()
 	}
-	c.clients[site.GetName()] = struct {
+	c.clients[cluster.GetName()] = struct {
 		authclient.ClientI
-		reversetunnelclient.RemoteSite
-	}{remoteClient, site}
+		reversetunnelclient.Cluster
+	}{remoteClient, cluster}
 	return err
 }
 
-func (c *remoteClientCache) getRemoteClient(site reversetunnelclient.RemoteSite) (authclient.ClientI, bool) {
+func (c *remoteClientCache) getRemoteClient(cluster reversetunnelclient.Cluster) (authclient.ClientI, bool) {
 	c.Lock()
 	defer c.Unlock()
-	remoteClt, ok := c.clients[site.GetName()]
-	return remoteClt.ClientI, ok && remoteClt.RemoteSite == site
+	remoteClt, ok := c.clients[cluster.GetName()]
+	return remoteClt.ClientI, ok && remoteClt.Cluster == cluster
 }
 
 func (c *remoteClientCache) Close() error {
@@ -1331,84 +1325,3 @@ func (c *remoteClientCache) Close() error {
 
 	return trace.NewAggregate(errors...)
 }
-
-// sessionIDStatus indicates whether the session ID was received from
-// the server or not, and if not why
-type sessionIDStatus int
-
-const (
-	// sessionIDReceived indicates the the session ID was received
-	sessionIDReceived sessionIDStatus = iota + 1
-	// sessionIDNotSent indicates that the server set the session ID
-	// but didn't send it to us
-	sessionIDNotSent
-	// sessionIDNotModified indicates that the server used the session
-	// ID that was set by us
-	sessionIDNotModified
-)
-
-// prepareToReceiveSessionID configures the TeleportClient to listen for
-// the server to send the session ID it's using. The returned function
-// will return the current session ID from the server or a reason why
-// one wasn't received.
-func prepareToReceiveSessionID(ctx context.Context, log *slog.Logger, nc *client.NodeClient) func() (session.ID, sessionIDStatus) {
-	// send the session ID received from the server
-	var gotSessionID atomic.Bool
-	sessionIDFromServer := make(chan session.ID, 1)
-	nc.TC.OnChannelRequest = func(req *ssh.Request) *ssh.Request {
-		// ignore unrelated requests and handle only the first session
-		// ID request
-		if req.Type != teleport.CurrentSessionIDRequest || gotSessionID.Load() {
-			return req
-		}
-
-		sid, err := session.ParseID(string(req.Payload))
-		if err != nil {
-			log.WarnContext(ctx, "Unable to parse session ID", "error", err)
-			return nil
-		}
-
-		if gotSessionID.CompareAndSwap(false, true) {
-			sessionIDFromServer <- *sid
-		}
-
-		return nil
-	}
-
-	// If the session is about to close and we haven't received a session
-	// ID yet, ask if the server even supports sending one. Send the
-	// request in a new goroutine so session establishment won't be
-	// blocked on making this request
-	serverWillSetSessionID := make(chan bool, 1)
-	go func() {
-		resp, _, err := nc.Client.SendRequest(ctx, teleport.SessionIDQueryRequest, true, nil)
-		if err != nil {
-			log.WarnContext(ctx, "Failed to send session ID query request", "error", err)
-			serverWillSetSessionID <- false
-		} else {
-			serverWillSetSessionID <- resp
-		}
-	}()
-
-	return func() (session.ID, sessionIDStatus) {
-		timer := time.NewTimer(10 * time.Second)
-		defer timer.Stop()
-
-		for {
-			select {
-			case sessionID := <-sessionIDFromServer:
-				return sessionID, sessionIDReceived
-			case sessionIDIsComing := <-serverWillSetSessionID:
-				if !sessionIDIsComing {
-					return session.ID(""), sessionIDNotModified
-				}
-				// the server will send the session ID, continue
-				// waiting for it
-			case <-ctx.Done():
-				return session.ID(""), sessionIDNotSent
-			case <-timer.C:
-				return session.ID(""), sessionIDNotSent
-			}
-		}
-	}
-}
diff --git a/lib/web/sessions_test.go b/lib/web/sessions_test.go
index b2fd531f0255b..56c9ac09f8d52 100644
--- a/lib/web/sessions_test.go
+++ b/lib/web/sessions_test.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/cert"
@@ -44,9 +45,9 @@ func TestRemoteClientCache(t *testing.T) {
 	var openCount atomic.Int32
 	cache := remoteClientCache{}
 
-	sa1 := newMockRemoteSite("a")
-	sa2 := newMockRemoteSite("a")
-	sb := newMockRemoteSite("b")
+	sa1 := newMockCluster("a")
+	sa2 := newMockCluster("a")
+	sb := newMockCluster("b")
 
 	err1 := errors.New("c1")
 	err2 := errors.New("c2")
@@ -67,16 +68,16 @@ func TestRemoteClientCache(t *testing.T) {
 	require.Zero(t, openCount.Load())
 }
 
-func newMockRemoteSite(name string) reversetunnelclient.RemoteSite {
-	return &mockRemoteSite{name: name}
+func newMockCluster(name string) reversetunnelclient.Cluster {
+	return &mockCluster{name: name}
 }
 
-type mockRemoteSite struct {
-	reversetunnelclient.RemoteSite
+type mockCluster struct {
+	reversetunnelclient.Cluster
 	name string
 }
 
-func (m *mockRemoteSite) GetName() string {
+func (m *mockCluster) GetName() string {
 	return m.name
 }
 
@@ -108,14 +109,14 @@ func TestGetUserClient(t *testing.T) {
 	sctx := SessionContext{
 		cfg: SessionContextConfig{
 			RootClusterName: "local",
-			newRemoteClient: func(ctx context.Context, sessionContext *SessionContext, site reversetunnelclient.RemoteSite) (authclient.ClientI, error) {
+			newRemoteClient: func(ctx context.Context, sessionContext *SessionContext, cluster reversetunnelclient.Cluster) (authclient.ClientI, error) {
 				return newMockClientI(&openCount, nil), nil
 			},
 		},
 	}
 
-	localSite := &mockRemoteSite{name: "local"}
-	remoteSite := &mockRemoteSite{name: "remote"}
+	localSite := &mockCluster{name: "local"}
+	remoteSite := &mockCluster{name: "remote"}
 
 	// getting a client for the local site should return
 	// the RootClient from SessionContextConfig
@@ -190,7 +191,7 @@ func TestSessionCache_watcher(t *testing.T) {
 	// Can't t.Parallel because of modules.SetTestModules.
 
 	// Requires Enterprise to work.
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 	})
 
diff --git a/lib/web/sign.go b/lib/web/sign.go
index cada8ec93c7db..6ec0b004810b6 100644
--- a/lib/web/sign.go
+++ b/lib/web/sign.go
@@ -53,7 +53,7 @@ Should be equivalent to running:
 
 This endpoint returns a tar.gz compressed archive containing the required files to setup mTLS for the database.
 */
-func (h *Handler) signDatabaseCertificate(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnelclient.RemoteSite, token types.ProvisionToken) (interface{}, error) {
+func (h *Handler) signDatabaseCertificate(w http.ResponseWriter, r *http.Request, p httprouter.Params, cluster reversetunnelclient.Cluster, token types.ProvisionToken) (any, error) {
 	if !token.GetRoles().Include(types.RoleDatabase) {
 		return nil, trace.AccessDenied("required '%s' role was not provided by the token", types.RoleDatabase)
 	}
diff --git a/lib/web/templates/machine-id-gha-k8s-wizard.tf.tmpl b/lib/web/templates/machine-id-gha-k8s-wizard.tf.tmpl
new file mode 100644
index 0000000000000..cb62082801603
--- /dev/null
+++ b/lib/web/templates/machine-id-gha-k8s-wizard.tf.tmpl
@@ -0,0 +1,21 @@
+# This file contains definitions for resources required to allow a GitHub
+# Actions workflow to enroll with Teleport and connect to allowed Kubernetes
+# clusters protected by Teleport.
+
+# See the Teleport Terraform Provider docs for more information about using
+# Terraform to manage Teleport resources:
+# https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/
+
+# A role defines which Kubernetes clusters can be accessed, and the level of
+# access granted. Fine tune the access using the `kubernetes_*` attributes.
+# All available options can be found in the Teleport Terraform Provider
+# reference:
+# https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/
+{{ .RoleConfig }}
+# A bot is a Machine & Workload ID user which is granted access to enrolled
+# Kubernetes clusters using the role above.
+{{ .BotConfig }}
+# A provision token allows a GitHub Actions workflow to enroll with Teleport and
+# assume the identity of the bot defined above and its access.
+{{ .TokenConfig }}
+{{ template "terraform-provider.tf.tmpl" . }}
diff --git a/lib/web/templates/terraform-provider.tf.tmpl b/lib/web/templates/terraform-provider.tf.tmpl
new file mode 100644
index 0000000000000..97c5bf08ae05d
--- /dev/null
+++ b/lib/web/templates/terraform-provider.tf.tmpl
@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "~> {{ .MajorVersion }}.0"
+    }
+  }
+}
+
+provider "teleport" {
+  addr = "{{ .ProxyAddr }}"
+}
diff --git a/lib/web/terminal.go b/lib/web/terminal.go
index ae31b5bb40ce9..06c452b139ff3 100644
--- a/lib/web/terminal.go
+++ b/lib/web/terminal.go
@@ -44,6 +44,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	authproto "github.com/gravitational/teleport/api/client/proto"
+	scopesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/v1"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/observability/tracing"
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
@@ -61,8 +62,8 @@ import (
 	"github.com/gravitational/teleport/lib/proxy"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/sshca"
-	"github.com/gravitational/teleport/lib/teleagent"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/diagnostics/latency"
 	"github.com/gravitational/teleport/lib/web/terminal"
@@ -80,8 +81,8 @@ type TerminalRequest struct {
 	// Term is the initial PTY size.
 	Term session.TerminalParams `json:"term"`
 
-	// SessionID is a Teleport session ID to join as.
-	SessionID session.ID `json:"sid"`
+	// JoinSessionID is a Teleport session ID to join as.
+	JoinSessionID session.ID `json:"sid"`
 
 	// ProxyHostPort is the address of the server to connect to.
 	ProxyHostPort string `json:"-"`
@@ -227,9 +228,8 @@ func (t *TerminalHandlerConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("server: missing server")
 	}
 
-	if t.Term.W <= 0 || t.Term.H <= 0 ||
-		t.Term.W >= 4096 || t.Term.H >= 4096 {
-		return trace.BadParameter("term: bad dimensions(%dx%d)", t.Term.W, t.Term.H)
+	if err := t.Term.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
 	}
 
 	if t.UserAuthClient == nil {
@@ -624,16 +624,11 @@ func (t *sshBaseHandler) issueSessionMFACerts(ctx context.Context, tc *client.Te
 
 func newMFACeremony(stream *terminal.WSStream, createAuthenticateChallenge mfa.CreateAuthenticateChallengeFunc, proxyAddr string) *mfa.Ceremony {
 	// channelID is used by the front end to differentiate between separate ongoing SSO challenges.
-	var channelID string
+	channelID := uuid.NewString()
 
 	return &mfa.Ceremony{
 		CreateAuthenticateChallenge: createAuthenticateChallenge,
 		SSOMFACeremonyConstructor: func(ctx context.Context) (mfa.SSOMFACeremony, error) {
-			id, err := uuid.NewRandom()
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			channelID = id.String()
 
 			u, err := url.Parse(sso.WebMFARedirect)
 			if err != nil {
@@ -659,7 +654,7 @@ func newMFACeremony(stream *terminal.WSStream, createAuthenticateChallenge mfa.C
 				}
 
 				if chal.WebauthnChallenge == nil && chal.SSOChallenge == nil {
-					return nil, trace.AccessDenied("only WebAuthn and SSO MFA methods are supported on the web terminal, please register a supported mfa method to connect to this server")
+					return nil, trace.Wrap(authclient.ErrNoMFADevices)
 				}
 
 				var codec protobufMFACodec
@@ -674,7 +669,7 @@ func newMFACeremony(stream *terminal.WSStream, createAuthenticateChallenge mfa.C
 	}
 }
 
-type connectWithMFAFn = func(ctx context.Context, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent teleagent.Getter, signer agentless.SignerCreator) (*client.NodeClient, error)
+type connectWithMFAFn = func(ctx context.Context, scopePin *scopesv1.Pin, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent sshagent.ClientGetter, signer agentless.SignerCreator) (*client.NodeClient, error)
 
 // connectToHost establishes a connection to the target host. To reduce connection
 // latency if per session mfa is required, connections are tried with the existing
@@ -690,9 +685,7 @@ func (t *sshBaseHandler) connectToHost(ctx context.Context, ws terminal.WSConn,
 		return nil, trace.Wrap(err)
 	}
 
-	getAgent := func() (teleagent.Agent, error) {
-		return teleagent.NopCloser(tc.LocalAgent()), nil
-	}
+	getAgent := sshagent.NewStaticClientGetter(tc.LocalAgent())
 	cert, err := t.ctx.GetSSHCertificate()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -719,7 +712,7 @@ func (t *sshBaseHandler) connectToHost(ctx context.Context, ws terminal.WSConn,
 	mfaCtx, mfaCancel := context.WithCancel(ctx)
 	go func() {
 		// try connecting to the node with the certs we already have
-		clt, err := t.connectToNode(directCtx, ws, tc, accessChecker, getAgent, signer)
+		clt, err := t.connectToNode(directCtx, ident.ScopePin, ws, tc, accessChecker, getAgent, signer)
 		directResultC <- clientRes{clt: clt, err: err}
 	}()
 
@@ -727,7 +720,7 @@ func (t *sshBaseHandler) connectToHost(ctx context.Context, ws terminal.WSConn,
 	// function returns early
 	go func() {
 		// try performing mfa and then connecting with the single use certs
-		clt, err := connectToNodeWithMFA(mfaCtx, ws, tc, accessChecker, getAgent, signer)
+		clt, err := connectToNodeWithMFA(mfaCtx, ident.ScopePin, ws, tc, accessChecker, getAgent, signer)
 		mfaResultC <- clientRes{clt: clt, err: err}
 	}()
 
@@ -849,33 +842,50 @@ func (t *TerminalHandler) streamTerminal(ctx context.Context, tc *client.Telepor
 		// created and the server sends us the session ID it is using
 		writeSessionCtx, writeSessionCancel := context.WithCancel(ctx)
 		defer writeSessionCancel()
-		waitForSessionID := prepareToReceiveSessionID(writeSessionCtx, t.logger, nc)
+
+		// only handle the first session ID request
+		var receiveSessionIDOnce sync.Once
+		receivedSessionID := make(chan struct{})
+		nc.Client.HandleSessionRequest(ctx, teleport.CurrentSessionIDRequest, func(ctx context.Context, req *ssh.Request) {
+			receiveSessionIDOnce.Do(func() {
+				sid, err := session.ParseID(string(req.Payload))
+				if err != nil {
+					t.logger.WarnContext(ctx, "Unable to parse session ID", "error", err)
+					return
+				}
+
+				t.sessionData.ID = *sid
+				close(receivedSessionID)
+			})
+		})
 
 		// wait in a new goroutine because the server won't set a
-		// session ID until we open a shell
+		// session ID until we start the session.
 		go func() {
 			defer close(sessionDataSent)
 
-			sid, status := waitForSessionID()
-			switch status {
-			case sessionIDReceived:
-				t.sessionData.ID = sid
-				fallthrough
-			case sessionIDNotModified:
+			ctx, cancel := context.WithTimeout(writeSessionCtx, 10*time.Second)
+			defer cancel()
+
+			select {
+			case <-receivedSessionID:
 				if err := t.writeSessionData(ctx); err != nil {
 					t.logger.WarnContext(ctx, "Failure sending session data", "error", err)
 				}
-			case sessionIDNotSent:
+			case <-ctx.Done():
 				t.logger.WarnContext(ctx, "Failed to receive session data")
-			default:
-				t.logger.WarnContext(ctx, "Invalid session ID status", "status", status)
 			}
 		}()
 	}
 
+	var joinSessionID string
+	if t.tracker != nil {
+		joinSessionID = t.tracker.GetSessionID()
+	}
+
 	// Establish SSH connection to the server. This function will block until
 	// either an error occurs or it completes successfully.
-	if err = nc.RunInteractiveShell(ctx, t.participantMode, t.tracker, nil, beforeStart); err != nil {
+	if err = nc.RunInteractiveShell(ctx, joinSessionID, t.participantMode, beforeStart); err != nil {
 		if !t.closedByClient.Load() {
 			t.stream.WriteError(ctx, err.Error())
 		}
@@ -904,8 +914,8 @@ func (t *TerminalHandler) streamTerminal(ctx context.Context, tc *client.Telepor
 
 // connectToNode attempts to connect to the host with the already
 // provisioned certs for the user.
-func (t *sshBaseHandler) connectToNode(ctx context.Context, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent teleagent.Getter, signer agentless.SignerCreator) (*client.NodeClient, error) {
-	conn, err := t.router.DialHost(ctx, ws.RemoteAddr(), ws.LocalAddr(), t.sessionData.ServerID, strconv.Itoa(t.sessionData.ServerHostPort), tc.SiteName, accessChecker.CheckAccessToRemoteCluster, getAgent, signer)
+func (t *sshBaseHandler) connectToNode(ctx context.Context, scopePin *scopesv1.Pin, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent sshagent.ClientGetter, signer agentless.SignerCreator) (*client.NodeClient, error) {
+	conn, err := t.router.DialHost(ctx, scopePin, ws.RemoteAddr(), ws.LocalAddr(), t.sessionData.ServerID, strconv.Itoa(t.sessionData.ServerHostPort), tc.SiteName, accessChecker.CheckAccessToRemoteCluster, getAgent, signer)
 	if err != nil {
 		t.logger.WarnContext(ctx, "Unable to stream terminal - failed to dial host", "error", err)
 
@@ -957,19 +967,19 @@ func (t *sshBaseHandler) connectToNode(ctx context.Context, ws terminal.WSConn,
 
 // connectToNodeWithMFA attempts to perform the mfa ceremony and then dial the
 // host with the retrieved single use certs.
-func (t *TerminalHandler) connectToNodeWithMFA(ctx context.Context, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent teleagent.Getter, signer agentless.SignerCreator) (*client.NodeClient, error) {
+func (t *TerminalHandler) connectToNodeWithMFA(ctx context.Context, scopePin *scopesv1.Pin, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent sshagent.ClientGetter, signer agentless.SignerCreator) (*client.NodeClient, error) {
 	// perform mfa ceremony and retrieve new certs
 	authMethods, err := t.issueSessionMFACerts(ctx, tc, t.stream.WSStream)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return t.connectToNodeWithMFABase(ctx, ws, tc, accessChecker, getAgent, signer, authMethods)
+	return t.connectToNodeWithMFABase(ctx, scopePin, ws, tc, accessChecker, getAgent, signer, authMethods)
 }
 
 // connectToNodeWithMFABase attempts to dial the host with the provided auth
 // methods.
-func (t *sshBaseHandler) connectToNodeWithMFABase(ctx context.Context, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent teleagent.Getter, signer agentless.SignerCreator, authMethods []ssh.AuthMethod) (*client.NodeClient, error) {
+func (t *sshBaseHandler) connectToNodeWithMFABase(ctx context.Context, scopePin *scopesv1.Pin, ws terminal.WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent sshagent.ClientGetter, signer agentless.SignerCreator, authMethods []ssh.AuthMethod) (*client.NodeClient, error) {
 	sshConfig := &ssh.ClientConfig{
 		User:            tc.HostLogin,
 		Auth:            authMethods,
@@ -978,7 +988,7 @@ func (t *sshBaseHandler) connectToNodeWithMFABase(ctx context.Context, ws termin
 	}
 
 	// connect to the node again with the new certs
-	conn, err := t.router.DialHost(ctx, ws.RemoteAddr(), ws.LocalAddr(), t.sessionData.ServerID, strconv.Itoa(t.sessionData.ServerHostPort), tc.SiteName, accessChecker.CheckAccessToRemoteCluster, getAgent, signer)
+	conn, err := t.router.DialHost(ctx, scopePin, ws.RemoteAddr(), ws.LocalAddr(), t.sessionData.ServerID, strconv.Itoa(t.sessionData.ServerHostPort), tc.SiteName, accessChecker.CheckAccessToRemoteCluster, getAgent, signer)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/terminal/terminal.go b/lib/web/terminal/terminal.go
index bfc5e205c9c8c..83af3ffab187e 100644
--- a/lib/web/terminal/terminal.go
+++ b/lib/web/terminal/terminal.go
@@ -41,7 +41,6 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
-	logutils "github.com/gravitational/teleport/lib/utils/log"
 )
 
 // WSConn is a gorilla/websocket minimal interface used by our web implementation.
@@ -497,31 +496,12 @@ func (t *Stream) handleWindowResize(ctx context.Context, envelope Envelope) {
 		return
 	}
 
-	var e map[string]interface{}
-	if err := json.Unmarshal([]byte(envelope.Payload), &e); err != nil {
-		t.log.WarnContext(ctx, "Failed to parse resize payload", "error", err)
-		return
-	}
-
-	size, ok := e["size"].(string)
-	if !ok {
-		t.log.ErrorContext(ctx, "got unexpected size type, expected type string", "size_type", logutils.TypeAttr(size))
-		return
-	}
-
-	params, err := session.UnmarshalTerminalParams(size)
-	if err != nil {
-		t.log.WarnContext(ctx, "Failed to retrieve terminal size", "error", err)
-		return
-	}
-
-	// nil params indicates the channel was closed
-	if params == nil {
-		return
-	}
-
-	if err := sshSession.WindowChange(ctx, params.H, params.W); err != nil {
-		t.log.ErrorContext(ctx, "failed to send window change request", "error", err)
+	if params, err := ParseWindowResizeMsg(envelope); err != nil {
+		t.log.WarnContext(ctx, "Failed to handle terminal window resize",
+			"error", err,
+		)
+	} else if err := sshSession.WindowChange(ctx, params.H, params.W); err != nil {
+		t.log.ErrorContext(ctx, "Failed to send window change request", "error", err)
 	}
 }
 
@@ -615,3 +595,25 @@ func (t *Stream) Close() error {
 		return trace.Wrap(t.WSStream.Close())
 	}
 }
+
+// ParseWindowResizeMsg parses a terminal [Envelope] as a resize message.
+func ParseWindowResizeMsg(envelope Envelope) (*session.TerminalParams, error) {
+	if envelope.Type != defaults.WebsocketResize {
+		return nil, trace.BadParameter("expected resize message but got %q", envelope.Type)
+	}
+	var e map[string]any
+	if err := json.Unmarshal([]byte(envelope.Payload), &e); err != nil {
+		return nil, trace.Wrap(err, "failed to parse resize payload")
+	}
+
+	size, ok := e["size"].(string)
+	if !ok {
+		return nil, trace.BadParameter("unexpected window resize parameter type %T", size)
+	}
+
+	params, err := session.UnmarshalTerminalParams(size)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to parse terminal size")
+	}
+	return params, nil
+}
diff --git a/lib/web/terminal_test.go b/lib/web/terminal_test.go
index ea6182464bf9b..6349592a560fc 100644
--- a/lib/web/terminal_test.go
+++ b/lib/web/terminal_test.go
@@ -41,7 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/web/terminal"
 )
 
@@ -78,7 +78,7 @@ func TestTerminalReadFromClosedConn(t *testing.T) {
 
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
-	stream := terminal.NewStream(ctx, terminal.StreamConfig{WS: conn, Logger: utils.NewSlogLoggerForTests()})
+	stream := terminal.NewStream(ctx, terminal.StreamConfig{WS: conn, Logger: logtest.NewLogger()})
 
 	// close the stream before we attempt to read from it,
 	// this will produce a net.ErrClosed error on the read
@@ -115,7 +115,7 @@ func connectToHost(ctx context.Context, cfg connectConfig) (*testTerminal, error
 			W: 100,
 			H: 100,
 		},
-		SessionID:         cfg.sessionID,
+		JoinSessionID:     cfg.sessionID,
 		ParticipantMode:   cfg.participantMode,
 		KeepAliveInterval: cfg.keepAliveInterval,
 	}
diff --git a/lib/web/testdata/TestMachineIDWizard/github+kubernetes-complex-terraform.golden b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-complex-terraform.golden
new file mode 100644
index 0000000000000..aeb46fc674818
--- /dev/null
+++ b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-complex-terraform.golden
@@ -0,0 +1,81 @@
+# This file contains definitions for resources required to allow a GitHub
+# Actions workflow to enroll with Teleport and connect to allowed Kubernetes
+# clusters protected by Teleport.
+
+# See the Teleport Terraform Provider docs for more information about using
+# Terraform to manage Teleport resources:
+# https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/
+
+# A role defines which Kubernetes clusters can be accessed, and the level of
+# access granted. Fine tune the access using the `kubernetes_*` attributes.
+# All available options can be found in the Teleport Terraform Provider
+# reference:
+# https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/
+resource "teleport_role" "gha-gravitational-teleport-kube-access" {
+  version = "v7"
+
+  metadata = {
+    name = "gha-gravitational-teleport-kube-access"
+  }
+
+  spec = {
+    allow = {
+      kubernetes_groups = ["viewers"]
+      kubernetes_users  = ["serviceAccount:deployment-sa"]
+      kubernetes_labels = {
+        department = ["engineering"]
+      }
+      kubernetes_resources = [{
+        api_group = "apps"
+        kind      = "deployment"
+        name      = "billing-service"
+        namespace = "default"
+      }]
+    }
+  }
+}
+
+# A bot is a Machine & Workload ID user which is granted access to enrolled
+# Kubernetes clusters using the role above.
+resource "teleport_bot" "gha-gravitational-teleport" {
+  version = "v1"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles = ["gha-gravitational-teleport-kube-access"]
+  }
+}
+
+# A provision token allows a GitHub Actions workflow to enroll with Teleport and
+# assume the identity of the bot defined above and its access.
+resource "teleport_provision_token" "gha-gravitational-teleport" {
+  version = "v2"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    join_method = "github"
+    bot_name    = "gha-gravitational-teleport"
+    github = {
+      allow = [{
+        actor            = "deployinator"
+        environment      = "production"
+        ref              = "main"
+        ref_type         = "branch"
+        repository       = "gravitational/teleport"
+        repository_owner = "gravitational"
+        workflow         = "deploy"
+      }]
+      enterprise_server_host = "github.corp.internal"
+      enterprise_slug        = "sluggy"
+      static_jwks            = "{\n  \"keys\": [\n    {\n      \"kty\": \"RSA\",\n      \"use\": \"sig\",\n      \"kid\": \"P9Zd\",\n      \"alg\": \"RS256\",\n      \"n\": \"kWp2zRA23Z3vTL4uoe8kTFptxBVFunIoP4t_8TDYJrOb7D1iZNDXVeEsYKp6ppmrTZDAgd-cNOTKLd4M39WJc5FN0maTAVKJc7NxklDeKc4dMe1BGvTZNG4MpWBo-taKULlYUu0ltYJuLzOjIrTHfarucrGoRWqM0sl3z2-fv9k\",\n      \"e\": \"AQAB\"\n    }\n  ]\n}"
+    }
+  }
+}
+
diff --git a/lib/web/testdata/TestMachineIDWizard/github+kubernetes-empty-terraform.golden b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-empty-terraform.golden
new file mode 100644
index 0000000000000..b8a925fb6828e
--- /dev/null
+++ b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-empty-terraform.golden
@@ -0,0 +1,66 @@
+# This file contains definitions for resources required to allow a GitHub
+# Actions workflow to enroll with Teleport and connect to allowed Kubernetes
+# clusters protected by Teleport.
+
+# See the Teleport Terraform Provider docs for more information about using
+# Terraform to manage Teleport resources:
+# https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/
+
+# A role defines which Kubernetes clusters can be accessed, and the level of
+# access granted. Fine tune the access using the `kubernetes_*` attributes.
+# All available options can be found in the Teleport Terraform Provider
+# reference:
+# https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/
+resource "teleport_role" "gha-organization-repository-kube-access" {
+  version = "v7"
+
+  metadata = {
+    name = "gha-organization-repository-kube-access"
+  }
+
+  spec = {
+    allow = {
+      # kubernetes_groups will be added in the next step.
+      kubernetes_groups = []
+      # kubernetes_labels will be added in the next step.
+      kubernetes_labels = {}
+    }
+  }
+}
+
+# A bot is a Machine & Workload ID user which is granted access to enrolled
+# Kubernetes clusters using the role above.
+resource "teleport_bot" "gha-organization-repository" {
+  version = "v1"
+
+  metadata = {
+    name = "gha-organization-repository"
+  }
+
+  spec = {
+    roles = ["gha-organization-repository-kube-access"]
+  }
+}
+
+# A provision token allows a GitHub Actions workflow to enroll with Teleport and
+# assume the identity of the bot defined above and its access.
+resource "teleport_provision_token" "gha-organization-repository" {
+  version = "v2"
+
+  metadata = {
+    name = "gha-organization-repository"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    join_method = "github"
+    bot_name    = "gha-organization-repository"
+    github = {
+      allow = [{
+        repository       = "organization/repository"
+        repository_owner = "organization"
+      }]
+    }
+  }
+}
+
diff --git a/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step1-terraform.golden b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step1-terraform.golden
new file mode 100644
index 0000000000000..fe7e82e8928ca
--- /dev/null
+++ b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step1-terraform.golden
@@ -0,0 +1,66 @@
+# This file contains definitions for resources required to allow a GitHub
+# Actions workflow to enroll with Teleport and connect to allowed Kubernetes
+# clusters protected by Teleport.
+
+# See the Teleport Terraform Provider docs for more information about using
+# Terraform to manage Teleport resources:
+# https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/
+
+# A role defines which Kubernetes clusters can be accessed, and the level of
+# access granted. Fine tune the access using the `kubernetes_*` attributes.
+# All available options can be found in the Teleport Terraform Provider
+# reference:
+# https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/
+resource "teleport_role" "gha-gravitational-teleport-kube-access" {
+  version = "v7"
+
+  metadata = {
+    name = "gha-gravitational-teleport-kube-access"
+  }
+
+  spec = {
+    allow = {
+      # kubernetes_groups will be added in the next step.
+      kubernetes_groups = []
+      # kubernetes_labels will be added in the next step.
+      kubernetes_labels = {}
+    }
+  }
+}
+
+# A bot is a Machine & Workload ID user which is granted access to enrolled
+# Kubernetes clusters using the role above.
+resource "teleport_bot" "gha-gravitational-teleport" {
+  version = "v1"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles = ["gha-gravitational-teleport-kube-access"]
+  }
+}
+
+# A provision token allows a GitHub Actions workflow to enroll with Teleport and
+# assume the identity of the bot defined above and its access.
+resource "teleport_provision_token" "gha-gravitational-teleport" {
+  version = "v2"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    join_method = "github"
+    bot_name    = "gha-gravitational-teleport"
+    github = {
+      allow = [{
+        repository       = "gravitational/teleport"
+        repository_owner = "gravitational"
+      }]
+    }
+  }
+}
+
diff --git a/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step2-terraform.golden b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step2-terraform.golden
new file mode 100644
index 0000000000000..b81f5b452706b
--- /dev/null
+++ b/lib/web/testdata/TestMachineIDWizard/github+kubernetes-step2-terraform.golden
@@ -0,0 +1,66 @@
+# This file contains definitions for resources required to allow a GitHub
+# Actions workflow to enroll with Teleport and connect to allowed Kubernetes
+# clusters protected by Teleport.
+
+# See the Teleport Terraform Provider docs for more information about using
+# Terraform to manage Teleport resources:
+# https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/terraform-provider/
+
+# A role defines which Kubernetes clusters can be accessed, and the level of
+# access granted. Fine tune the access using the `kubernetes_*` attributes.
+# All available options can be found in the Teleport Terraform Provider
+# reference:
+# https://goteleport.com/docs/reference/infrastructure-as-code/terraform-provider/
+resource "teleport_role" "gha-gravitational-teleport-kube-access" {
+  version = "v7"
+
+  metadata = {
+    name = "gha-gravitational-teleport-kube-access"
+  }
+
+  spec = {
+    allow = {
+      kubernetes_groups = ["system:masters"]
+      kubernetes_labels = {
+        department = ["engineering"]
+      }
+    }
+  }
+}
+
+# A bot is a Machine & Workload ID user which is granted access to enrolled
+# Kubernetes clusters using the role above.
+resource "teleport_bot" "gha-gravitational-teleport" {
+  version = "v1"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles = ["gha-gravitational-teleport-kube-access"]
+  }
+}
+
+# A provision token allows a GitHub Actions workflow to enroll with Teleport and
+# assume the identity of the bot defined above and its access.
+resource "teleport_provision_token" "gha-gravitational-teleport" {
+  version = "v2"
+
+  metadata = {
+    name = "gha-gravitational-teleport"
+  }
+
+  spec = {
+    roles       = ["Bot"]
+    join_method = "github"
+    bot_name    = "gha-gravitational-teleport"
+    github = {
+      allow = [{
+        repository       = "gravitational/teleport"
+        repository_owner = "gravitational"
+      }]
+    }
+  }
+}
+
diff --git a/lib/web/tty_playback.go b/lib/web/tty_playback.go
index 838c1b45d1efd..2af90fbb231a4 100644
--- a/lib/web/tty_playback.go
+++ b/lib/web/tty_playback.go
@@ -59,8 +59,8 @@ func (h *Handler) sessionLengthHandle(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
-) (interface{}, error) {
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
 	sID := p.ByName("sid")
 	if sID == "" {
 		return nil, trace.BadParameter("missing session ID in request URL")
@@ -69,11 +69,16 @@ func (h *Handler) sessionLengthHandle(
 	ctx, cancel := context.WithCancel(r.Context())
 	defer cancel()
 
-	clt, err := sctx.GetUserClient(ctx, site)
+	clt, err := sctx.GetUserClient(ctx, cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	type response struct {
+		Duration      int64  `json:"durationMs"`
+		RecordingType string `json:"recordingType"`
+	}
+
 	evts, errs := clt.StreamSessionEvents(ctx, session.ID(sID), 0)
 	for {
 		select {
@@ -83,13 +88,14 @@ func (h *Handler) sessionLengthHandle(
 			if !ok {
 				return nil, trace.NotFound("could not find end event for session %v", sID)
 			}
+
 			switch evt := evt.(type) {
 			case *events.SessionEnd:
-				return map[string]any{"durationMs": evt.EndTime.Sub(evt.StartTime).Milliseconds()}, nil
+				return response{evt.EndTime.Sub(evt.StartTime).Milliseconds(), "ssh"}, nil
 			case *events.WindowsDesktopSessionEnd:
-				return map[string]any{"durationMs": evt.EndTime.Sub(evt.StartTime).Milliseconds()}, nil
+				return response{evt.EndTime.Sub(evt.StartTime).Milliseconds(), "desktop"}, nil
 			case *events.DatabaseSessionEnd:
-				return map[string]any{"durationMs": evt.EndTime.Sub(evt.StartTime).Milliseconds()}, nil
+				return response{evt.EndTime.Sub(evt.StartTime).Milliseconds(), "database"}, nil
 			}
 		}
 	}
@@ -100,14 +106,14 @@ func (h *Handler) ttyPlaybackHandle(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnelclient.RemoteSite,
-) (interface{}, error) {
+	cluster reversetunnelclient.Cluster,
+) (any, error) {
 	sID := p.ByName("sid")
 	if sID == "" {
 		return nil, trace.BadParameter("missing session ID in request URL")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/ui/app.go b/lib/web/ui/app.go
index 7f18cf6dce3a5..821c392488412 100644
--- a/lib/web/ui/app.go
+++ b/lib/web/ui/app.go
@@ -24,7 +24,9 @@ import (
 	"log/slog"
 	"sort"
 
+	componentfeaturesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/componentfeatures/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/ui"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/aws"
@@ -78,6 +80,12 @@ type App struct {
 	// SAMLAppLaunchURLs contains service provider specific authentication
 	// endpoints where user should be launched to start SAML authentication.
 	SAMLAppLaunchURLs []SAMLAppLaunchURL `json:"samlAppLaunchUrls,omitempty"`
+
+	// MCP includes MCP specific configuration.
+	MCP *MCP `json:"mcp,omitempty"`
+
+	// SupportedFeatureIDs contains ComponentFeatures supported by this App and all other involved components.
+	SupportedFeatureIDs []int `json:"supportedFeatureIds,omitempty"`
 }
 
 // UserGroupAndDescription is a user group name and its description.
@@ -101,6 +109,17 @@ type IdentityCenterPermissionSet struct {
 	RequiresRequest bool   `json:"requiresRequest,omitempty"`
 }
 
+// MCP includes MCP specific configuration.
+type MCP struct {
+	// Command to launch stdio-based MCP servers.
+	Command string `json:"command,omitempty"`
+	// Args to execute with the command.
+	Args []string `json:"args,omitempty"`
+	// RunAsHostUser is the host user account under which the command will be
+	// executed. Required for stdio-based MCP servers.
+	RunAsHostUser string `json:"runAsHostUser,omitempty"`
+}
+
 // MakeAppsConfig contains parameters for converting apps to UI representation.
 type MakeAppsConfig struct {
 	// LocalClusterName is the name of the local cluster.
@@ -121,6 +140,8 @@ type MakeAppsConfig struct {
 	Logger *slog.Logger
 	// RequireRequest indicates if a returned resource is only accessible after an access request
 	RequiresRequest bool
+	// SupportedFeatures contains ComponentFeatures supported by this App and all other involved components.
+	SupportedFeatures *componentfeaturesv1.ComponentFeatures
 }
 
 // MakeApp creates an application object for the WebUI.
@@ -173,6 +194,7 @@ func MakeApp(app types.Application, c MakeAppsConfig) App {
 		Integration:           app.GetIntegration(),
 		PermissionSets:        permissionSets,
 		UseAnyProxyPublicAddr: app.GetUseAnyProxyPublicAddr(),
+		SupportedFeatureIDs:   componentfeatures.ToIntegers(c.SupportedFeatures),
 	}
 
 	if app.IsAWSConsole() {
@@ -181,6 +203,14 @@ func MakeApp(app types.Application, c MakeAppsConfig) App {
 			app.GetAWSAccountID())
 	}
 
+	if mcpSpec := app.GetMCP(); mcpSpec != nil {
+		resultApp.MCP = &MCP{
+			Command:       mcpSpec.Command,
+			Args:          mcpSpec.Args,
+			RunAsHostUser: mcpSpec.RunAsHostUser,
+		}
+	}
+
 	return resultApp
 }
 
diff --git a/lib/web/ui/app_test.go b/lib/web/ui/app_test.go
index e6fc5590208fd..afcd079ef141c 100644
--- a/lib/web/ui/app_test.go
+++ b/lib/web/ui/app_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/componentfeatures"
 	"github.com/gravitational/teleport/lib/ui"
 )
 
@@ -41,6 +42,47 @@ func newApp(t *testing.T, name, publicAddr, description string, labels map[strin
 	return app
 }
 
+func TestMakeApp_SupportedFeatureIDs(t *testing.T) {
+	t.Parallel()
+
+	app, err := types.NewAppV3(
+		types.Metadata{Name: "test-app"},
+		types.AppSpecV3{URI: "localhost:8080"},
+	)
+	require.NoError(t, err)
+
+	baseCfg := MakeAppsConfig{
+		LocalClusterName:  "root",
+		LocalProxyDNSName: "proxy.example.com",
+		AppClusterName:    "root",
+		UserGroupLookup:   map[string]types.UserGroup{},
+	}
+
+	t.Run("nil SupportedFeatures yields empty SupportedFeatureIDs", func(t *testing.T) {
+		t.Parallel()
+
+		cfg := baseCfg
+		cfg.SupportedFeatures = nil
+
+		out := MakeApp(app, cfg)
+		require.Empty(t, out.SupportedFeatureIDs)
+	})
+
+	t.Run("SupportedFeatures is converted to SupportedFeatureIDs", func(t *testing.T) {
+		t.Parallel()
+
+		f1 := componentfeatures.FeatureResourceConstraintsV1
+		f2 := componentfeatures.FeatureID(9999)
+
+		cfg := baseCfg
+		cfg.SupportedFeatures = componentfeatures.New(f1, f2)
+
+		out := MakeApp(app, cfg)
+
+		require.ElementsMatch(t, []int{int(f1), int(f2)}, out.SupportedFeatureIDs)
+	})
+}
+
 func TestMakeAppTypeFromSAMLApp(t *testing.T) {
 	tests := []struct {
 		name             string
diff --git a/lib/web/ui/cluster.go b/lib/web/ui/cluster.go
index 2e5f29163594d..d457de5b8f9b7 100644
--- a/lib/web/ui/cluster.go
+++ b/lib/web/ui/cluster.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 )
@@ -52,16 +53,16 @@ type Cluster struct {
 }
 
 // NewClusters creates a slice of Cluster's, containing data about each cluster.
-func NewClusters(remoteClusters []reversetunnelclient.RemoteSite) ([]Cluster, error) {
+func NewClusters(remoteClusters []reversetunnelclient.Cluster) ([]Cluster, error) {
 	clusters := make([]Cluster, 0, len(remoteClusters))
-	for _, site := range remoteClusters {
+	for _, cluster := range remoteClusters {
 		// Other fields such as node count, url, and proxy/auth versions are not set
 		// because each cluster will need to make network calls to retrieve information
 		// which does not scale well (ie: 1k clusters, each request will take seconds).
 		cluster := &Cluster{
-			Name:          site.GetName(),
-			LastConnected: site.GetLastConnected(),
-			Status:        site.GetStatus(),
+			Name:          cluster.GetName(),
+			LastConnected: cluster.GetLastConnected(),
+			Status:        cluster.GetStatus(),
 		}
 
 		clusters = append(clusters, *cluster)
@@ -89,12 +90,13 @@ func NewClustersFromRemote(remoteClusters []types.RemoteCluster) ([]Cluster, err
 }
 
 // GetClusterDetails retrieves and sets details about a cluster
-func GetClusterDetails(ctx context.Context, site reversetunnelclient.RemoteSite, opts ...services.MarshalOption) (*Cluster, error) {
-	clt, err := site.CachingAccessPoint()
+func GetClusterDetails(ctx context.Context, cluster reversetunnelclient.Cluster, opts ...services.MarshalOption) (*Cluster, error) {
+	clt, err := cluster.CachingAccessPoint()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 	proxies, err := clt.GetProxies()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -104,7 +106,12 @@ func GetClusterDetails(ctx context.Context, site reversetunnelclient.RemoteSite,
 		return nil, trace.Wrap(err)
 	}
 
-	authServers, err := clt.GetAuthServers()
+	authServers, err := clientutils.CollectWithFallback(
+		ctx,
+		clt.ListAuthServers,
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		func(context.Context) ([]types.Server, error) { return clt.GetAuthServers() },
+	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -119,9 +126,9 @@ func GetClusterDetails(ctx context.Context, site reversetunnelclient.RemoteSite,
 	}
 
 	return &Cluster{
-		Name:          site.GetName(),
-		LastConnected: site.GetLastConnected(),
-		Status:        site.GetStatus(),
+		Name:          cluster.GetName(),
+		LastConnected: cluster.GetLastConnected(),
+		Status:        cluster.GetStatus(),
 		PublicURL:     proxyHost,
 		AuthVersion:   authVersion,
 
diff --git a/lib/web/ui/integration.go b/lib/web/ui/integration.go
index d373d566ce49b..2ea4d0ade2284 100644
--- a/lib/web/ui/integration.go
+++ b/lib/web/ui/integration.go
@@ -68,6 +68,21 @@ type AWSRAProfileSync struct {
 
 	// RoleARN is the ARN of the IAM Role that is used to sync profiles.
 	RoleARN string `json:"roleArn"`
+
+	// ProfileNameFilters are the filters applied to the profiles.
+	// Only matching profiles will be synchronized as application servers.
+	// If empty, no filtering is applied.
+	//
+	// Filters can be globs, for example:
+	//
+	//	profile*
+	//	*name*
+	//
+	// Or regexes if they're prefixed and suffixed with ^ and $, for example:
+	//
+	//	^profile.*$
+	//	^.*name.*$
+	ProfileNameFilters []string `json:"filters"`
 }
 
 // CheckAndSetDefaults for the aws oidc integration spec.
@@ -109,6 +124,9 @@ type IntegrationWithSummary struct {
 	AWSRDS ResourceTypeSummary `json:"awsrds,omitempty"`
 	// AWSEKS contains the summary for the AWS EKS resources for this integration.
 	AWSEKS ResourceTypeSummary `json:"awseks,omitempty"`
+
+	// RolesAnywhereProfileSync contains the summary for the AWS Roles Anywhere Profile Sync.
+	RolesAnywhereProfileSync *RolesAnywhereProfileSync `json:"rolesAnywhereProfileSync,omitempty"`
 }
 
 // ResourceTypeSummary contains the summary of the enrollment rules and found resources by the integration.
@@ -135,6 +153,26 @@ type ResourceTypeSummary struct {
 	ECSDatabaseServiceCount int `json:"ecsDatabaseServiceCount,omitempty"`
 }
 
+// RolesAnywhereProfileSync contains the summary for the AWS Roles Anywhere Profile Sync.
+type RolesAnywhereProfileSync struct {
+	// Enabled indicates whether the profile sync is enabled.
+	Enabled bool `json:"enabled"`
+
+	// Status is the string representation of the profile sync status.
+	// Either ERROR or SUCCESS.
+	Status string `json:"status,omitempty"`
+	// ErrorMessage is the error message from the last sync when the Status is ERROR.
+	ErrorMessage string `json:"errorMessage,omitempty"`
+
+	// SyncedProfiles is the number of profiles that were imported into Teleport.
+	SyncedProfiles int `json:"syncedProfiles,omitempty"`
+
+	// SyncStartTime is the time when the profile sync started.
+	SyncStartTime time.Time `json:"syncStartTime,omitempty"`
+	// SyncEndTime is the time when the profile sync ended.
+	SyncEndTime time.Time `json:"syncEndTime,omitempty"`
+}
+
 // IntegrationDiscoveryRule describes a discovery rule associated with an integration.
 type IntegrationDiscoveryRule struct {
 	// ResourceType indicates the type of resource that this rule targets.
@@ -355,9 +393,10 @@ func MakeIntegration(ig types.Integration) (*Integration, error) {
 		ret.AWSRA = &IntegrationAWSRASpec{
 			TrustAnchorARN: spec.TrustAnchorARN,
 			ProfileSyncConfig: AWSRAProfileSync{
-				Enabled:    spec.ProfileSyncConfig.Enabled,
-				ProfileARN: spec.ProfileSyncConfig.ProfileARN,
-				RoleARN:    spec.ProfileSyncConfig.RoleARN,
+				Enabled:            spec.ProfileSyncConfig.Enabled,
+				ProfileARN:         spec.ProfileSyncConfig.ProfileARN,
+				RoleARN:            spec.ProfileSyncConfig.RoleARN,
+				ProfileNameFilters: spec.ProfileSyncConfig.ProfileNameFilters,
 			},
 		}
 	}
@@ -669,3 +708,45 @@ type AWSOIDCCreateAWSAppAccessRequest struct {
 	// Labels added to the app server resource that will be created.
 	Labels map[string]string `json:"labels"`
 }
+
+// AWSRolesAnywherePingRequest contains ping request fields.
+type AWSRolesAnywherePingRequest struct {
+	// TrustAnchorARN is the ARN of the IAM Roles Anywhere Trust Anchor.
+	TrustAnchorARN string `json:"trustAnchorArn"`
+	// SyncProfileARN is the ARN of the IAM Roles Anywhere Profile that is used to sync profiles.
+	SyncProfileARN string `json:"syncProfileArn"`
+	// SyncRoleARN is the ARN of the IAM Role that is used to sync profiles.
+	SyncRoleARN string `json:"syncRoleArn"`
+}
+
+// AWSRolesAnywherePingResponse contains the result of the Ping request.
+// This response contains meta information about the current state of the Integration.
+type AWSRolesAnywherePingResponse struct {
+	// ProfileCount is the number of IAM Roles Anywhere Profiles that can be accessed by the Integration.
+	// Profiles that are disabled or don't have any IAM Role associated with them are not counted.
+	ProfileCount int `json:"profileCount"`
+	// AccountID number of the account that owns or contains the calling entity.
+	AccountID string `json:"accountId"`
+	// ARN associated with the calling entity.
+	ARN string `json:"arn"`
+	// UserID is the unique identifier of the calling entity.
+	UserID string `json:"userId"`
+}
+
+// AWSRolesAnywhereListProfilesRequest contains the request to list Roles Anywhere Profiles.
+type AWSRolesAnywhereListProfilesRequest struct {
+	// Filters are the filters applied to the profiles.
+	// Only matching profiles will be synchronized as application servers.
+	// If empty, no filtering is applied.
+	//
+	// Filters can be globs, for example:
+	//
+	//	profile*
+	//	*name*
+	//
+	// Or regexes if they're prefixed and suffixed with ^ and $, for example:
+	//
+	//	^profile.*$
+	//	^.*name.*$
+	Filters []string `json:"filters"`
+}
diff --git a/lib/web/ui/join_token.go b/lib/web/ui/join_token.go
index 2319841375e22..6d381c30a242f 100644
--- a/lib/web/ui/join_token.go
+++ b/lib/web/ui/join_token.go
@@ -41,6 +41,8 @@ type JoinToken struct {
 	Roles types.SystemRoles `json:"roles"`
 	// IsStatic is true if the token is statically configured
 	IsStatic bool `json:"isStatic"`
+	// IsCloudSystem is true if the token is managed by the Teleport Cloud system.
+	IsCloudSystem bool `json:"isCloudSystem"`
 	// Method is the join method that the token supports
 	Method types.JoinMethod `json:"method"`
 	// Allow is a list of allow rules
@@ -49,6 +51,8 @@ type JoinToken struct {
 	GCP *types.ProvisionTokenSpecV2GCP `json:"gcp,omitempty"`
 	// GitHub-specific configuration for the join method.
 	Github *types.ProvisionTokenSpecV2GitHub `json:"github,omitempty"`
+	// GitLab-specific configuration for the join method.
+	Gitlab *types.ProvisionTokenSpecV2GitLab `json:"gitlab,omitempty"`
 	// Content is resource yaml content.
 	Content string `json:"content"`
 }
@@ -58,16 +62,20 @@ func MakeJoinToken(token types.ProvisionToken) (*JoinToken, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	_, isCloudSystem := token.GetMetadata().Labels["teleport.internal/cloud/token"]
+
 	uiToken := &JoinToken{
-		ID:       token.GetName(),
-		SafeName: token.GetSafeName(),
-		BotName:  token.GetBotName(),
-		Expiry:   token.Expiry(),
-		Roles:    token.GetRoles(),
-		IsStatic: token.IsStatic(),
-		Method:   token.GetJoinMethod(),
-		Allow:    token.GetAllowRules(),
-		Content:  string(content[:]),
+		ID:            token.GetName(),
+		SafeName:      token.GetSafeName(),
+		BotName:       token.GetBotName(),
+		Expiry:        token.Expiry(),
+		Roles:         token.GetRoles(),
+		IsStatic:      token.IsStatic(),
+		IsCloudSystem: isCloudSystem,
+		Method:        token.GetJoinMethod(),
+		Allow:         token.GetAllowRules(),
+		Content:       string(content[:]),
 	}
 
 	if uiToken.Method == types.JoinMethodGCP {
@@ -78,6 +86,10 @@ func MakeJoinToken(token types.ProvisionToken) (*JoinToken, error) {
 		uiToken.Github = token.GetGithubRules()
 	}
 
+	if uiToken.Method == types.JoinMethodGitLab {
+		uiToken.Gitlab = token.GetGitlabRules()
+	}
+
 	return uiToken, nil
 }
 
diff --git a/lib/web/ui/perf_test.go b/lib/web/ui/perf_test.go
index f6038119e230a..121cce7a81f8f 100644
--- a/lib/web/ui/perf_test.go
+++ b/lib/web/ui/perf_test.go
@@ -89,7 +89,7 @@ func BenchmarkGetClusterDetails(b *testing.B) {
 			insertServers(ctx, b, svc, types.KindProxy, proxyCount)
 			insertServers(ctx, b, svc, types.KindAuthServer, authCount)
 
-			site := &mockRemoteSite{
+			site := &mockCluster{
 				accessPoint: &mockAccessPoint{
 					presence: svc,
 				},
@@ -137,34 +137,34 @@ func insertServers(ctx context.Context, b *testing.B, svc services.Presence, kin
 	}
 }
 
-func benchmarkGetClusterDetails(ctx context.Context, b *testing.B, site reversetunnelclient.RemoteSite, nodes int, opts ...services.MarshalOption) {
-	var cluster *Cluster
+func benchmarkGetClusterDetails(ctx context.Context, b *testing.B, cluster reversetunnelclient.Cluster, nodes int, opts ...services.MarshalOption) {
+	var got *Cluster
 	var err error
 	for b.Loop() {
-		cluster, err = GetClusterDetails(ctx, site, opts...)
+		got, err = GetClusterDetails(ctx, cluster, opts...)
 		require.NoError(b, err)
 	}
-	require.NotNil(b, cluster)
+	require.NotNil(b, got)
 }
 
-type mockRemoteSite struct {
-	reversetunnelclient.RemoteSite
+type mockCluster struct {
+	reversetunnelclient.Cluster
 	accessPoint authclient.ProxyAccessPoint
 }
 
-func (m *mockRemoteSite) CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error) {
+func (m *mockCluster) CachingAccessPoint() (authclient.RemoteProxyAccessPoint, error) {
 	return m.accessPoint, nil
 }
 
-func (m *mockRemoteSite) GetName() string {
+func (m *mockCluster) GetName() string {
 	return clusterName
 }
 
-func (m *mockRemoteSite) GetLastConnected() time.Time {
+func (m *mockCluster) GetLastConnected() time.Time {
 	return time.Now()
 }
 
-func (m *mockRemoteSite) GetStatus() string {
+func (m *mockCluster) GetStatus() string {
 	return teleport.RemoteClusterStatusOnline
 }
 
@@ -178,9 +178,19 @@ func (m *mockAccessPoint) GetNodes(ctx context.Context, namespace string) ([]typ
 }
 
 func (m *mockAccessPoint) GetProxies() ([]types.Server, error) {
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 	return m.presence.GetProxies()
 }
 
+func (m *mockAccessPoint) ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	return m.presence.ListProxyServers(ctx, pageSize, pageToken)
+}
+
 func (m *mockAccessPoint) GetAuthServers() ([]types.Server, error) {
+	//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
 	return m.presence.GetAuthServers()
 }
+
+func (m *mockAccessPoint) ListAuthServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error) {
+	return m.presence.ListAuthServers(ctx, pageSize, pageToken)
+}
diff --git a/lib/web/ui/resource.go b/lib/web/ui/resource.go
index 0c77025197de4..4721be04547c0 100644
--- a/lib/web/ui/resource.go
+++ b/lib/web/ui/resource.go
@@ -24,6 +24,7 @@ import (
 	yaml "github.com/ghodss/yaml"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -41,6 +42,9 @@ type ResourceItem struct {
 	Description string `json:"description,omitempty"`
 	// Content is resource yaml content.
 	Content string `json:"content"`
+	// Object is the resource itself (the non string format).
+	// Supported for roles.
+	Object types.Resource `json:"object,omitempty"`
 }
 
 // NewResourceItem creates UI objects for a resource.
@@ -65,7 +69,7 @@ func NewResourceItem(resource types.Resource) (*ResourceItem, error) {
 }
 
 // NewRoles creates resource item for each role.
-func NewRoles(roles []types.Role) ([]ResourceItem, error) {
+func NewRoles(roles []types.Role, includeRoleObject bool) ([]ResourceItem, error) {
 	items := make([]ResourceItem, 0, len(roles))
 	for _, role := range roles {
 		item, err := NewResourceItem(role)
@@ -73,12 +77,39 @@ func NewRoles(roles []types.Role) ([]ResourceItem, error) {
 			return nil, trace.Wrap(err)
 		}
 
+		if includeRoleObject {
+			item.Object = role
+		}
+
 		items = append(items, *item)
 	}
 
 	return items, nil
 }
 
+// RequestableRole is a role that a user can request, containing only the name and description.
+type RequestableRole struct {
+	// Name is the role name.
+	Name string `json:"name"`
+	// Description is the role description.
+	Description string `json:"description,omitempty"`
+}
+
+// RequestableRolesFromProto converts a slice of proto.ListRequestableRolesResponse_RequestableRole into a slice of ui.RequestableRole
+func RequestableRolesFromProto(roles []*proto.ListRequestableRolesResponse_RequestableRole) []RequestableRole {
+	out := make([]RequestableRole, 0, len(roles))
+	for _, role := range roles {
+		item := &RequestableRole{
+			Name:        role.Name,
+			Description: role.Description,
+		}
+
+		out = append(out, *item)
+	}
+
+	return out
+}
+
 // NewGithubConnectors creates resource item for each github connector.
 func NewGithubConnectors(connectors []types.GithubConnector) ([]ResourceItem, error) {
 	items := make([]ResourceItem, 0, len(connectors))
diff --git a/lib/web/ui/server.go b/lib/web/ui/server.go
index b53014318fcdf..29e3945d3b073 100644
--- a/lib/web/ui/server.go
+++ b/lib/web/ui/server.go
@@ -127,6 +127,15 @@ type KubeCluster struct {
 	KubeGroups []string `json:"kubernetes_groups"`
 	// RequireRequest indicates if a returned resource is only accessible after an access request
 	RequiresRequest bool `json:"requiresRequest,omitempty"`
+	// TargetHealth describes the health of a Kubernetes cluster
+	// reported from an Teleport Kubernetes agent.
+	//
+	// This field will be empty if Kubernetes was not extracted from
+	// a kube_server resource. The following endpoints will set this field
+	// since these endpoints query for kube_server under the hood and then
+	// extract kube from it:
+	// - webapi/sites/:site/resources (unified resources)
+	TargetHealth types.TargetHealth `json:"targetHealth,omitzero"`
 }
 
 // MakeKubeCluster creates a kube cluster object for the web ui
@@ -323,7 +332,7 @@ type Database struct {
 	// extract db from it:
 	// - webapi/sites/:site/databases/:database (singular)
 	// - webapi/sites/:site/resources (unified resources)
-	TargetHealth types.TargetHealth `json:"targetHealth,omitempty"`
+	TargetHealth types.TargetHealth `json:"targetHealth,omitzero"`
 }
 
 // AWS contains AWS specific fields.
@@ -349,19 +358,14 @@ type DatabaseInteractiveChecker interface {
 // MakeDatabase creates database objects.
 func MakeDatabase(database types.Database, accessChecker services.AccessChecker, interactiveChecker DatabaseInteractiveChecker, requiresRequest bool) Database {
 	var (
-		dbUsers []string
-		dbRoles []string
+		autoUserEnabled bool
+		dbUsers         []string
+		dbRoles         []string
 	)
 	dbNamesResult := accessChecker.EnumerateDatabaseNames(database)
-	dbNames := dbNamesResult.Allowed()
-	if dbNamesResult.WildcardAllowed() {
-		dbNames = append(dbNames, types.Wildcard)
-	}
+	dbNames, _ := dbNamesResult.ToEntities()
 	if res, err := accessChecker.EnumerateDatabaseUsers(database); err == nil {
-		dbUsers = res.Allowed()
-		if res.WildcardAllowed() {
-			dbUsers = append(dbUsers, types.Wildcard)
-		}
+		dbUsers, _ = res.ToEntities()
 	}
 	if roles, err := accessChecker.CheckDatabaseRoles(database, nil); err == nil {
 		// Avoid assigning empty slice to keep the resulting roles nil.
@@ -369,6 +373,9 @@ func MakeDatabase(database types.Database, accessChecker services.AccessChecker,
 			dbRoles = roles
 		}
 	}
+	if autoUser, err := accessChecker.DatabaseAutoUserMode(database); err == nil {
+		autoUserEnabled = database.IsAutoUsersEnabled() && autoUser.IsEnabled()
+	}
 
 	uiLabels := ui.MakeLabelsWithoutInternalPrefixes(database.GetAllLabels())
 
@@ -386,7 +393,7 @@ func MakeDatabase(database types.Database, accessChecker services.AccessChecker,
 		URI:                 database.GetURI(),
 		RequiresRequest:     requiresRequest,
 		SupportsInteractive: interactiveChecker.IsSupported(database.GetProtocol()),
-		AutoUsersEnabled:    database.IsAutoUsersEnabled(),
+		AutoUsersEnabled:    autoUserEnabled,
 	}
 
 	if database.IsAWSHosted() {
diff --git a/lib/web/ui/server_test.go b/lib/web/ui/server_test.go
index 6618a55766154..d6acbebd1bd5d 100644
--- a/lib/web/ui/server_test.go
+++ b/lib/web/ui/server_test.go
@@ -622,6 +622,7 @@ func TestMakeDatabaseConnectOptions(t *testing.T) {
 		roles        services.RoleSet
 		db           *types.DatabaseV3
 		assertResult require.ValueAssertionFunc
+		username     string
 	}{
 		"names wildcard": {
 			db: makeTestDatabase(t, map[string]string{"env": "dev"}, false),
@@ -698,12 +699,14 @@ func TestMakeDatabaseConnectOptions(t *testing.T) {
 			},
 		},
 		"auto-user provisioning enabled": {
-			db: makeTestDatabase(t, map[string]string{"env": "dev"}, true),
+			db:       makeTestDatabase(t, map[string]string{"env": "dev"}, true),
+			username: "alice",
 			roles: services.NewRoleSet(&types.RoleV6{
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
 						Namespaces:     []string{apidefaults.Namespace},
 						DatabaseLabels: types.Labels{"*": []string{"*"}},
+						DatabaseUsers:  []string{"otheruser"},
 						DatabaseRoles:  []string{"myrole"},
 					},
 					Options: types.RoleOptions{
@@ -713,13 +716,35 @@ func TestMakeDatabaseConnectOptions(t *testing.T) {
 			}),
 			assertResult: func(t require.TestingT, v interface{}, _ ...interface{}) {
 				db, _ := v.(Database)
-				require.ElementsMatch(t, []string{"myrole"}, db.DatabaseRoles)
 				require.True(t, db.AutoUsersEnabled)
+				require.ElementsMatch(t, []string{"alice"}, db.DatabaseUsers)
+				require.ElementsMatch(t, []string{"myrole"}, db.DatabaseRoles)
+			},
+		},
+		"auto-user provisioning at database but disabled on role": {
+			db:       makeTestDatabase(t, map[string]string{"env": "dev"}, true),
+			username: "alice",
+			roles: services.NewRoleSet(&types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						Namespaces:     []string{apidefaults.Namespace},
+						DatabaseLabels: types.Labels{"*": []string{"*"}},
+						DatabaseUsers:  []string{"*", "myuser"},
+					},
+					Options: types.RoleOptions{
+						CreateDatabaseUserMode: types.CreateDatabaseUserMode_DB_USER_MODE_OFF,
+					},
+				},
+			}),
+			assertResult: func(t require.TestingT, v interface{}, _ ...interface{}) {
+				db, _ := v.(Database)
+				require.False(t, db.AutoUsersEnabled)
+				require.ElementsMatch(t, []string{"*", "myuser"}, db.DatabaseUsers)
 			},
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clusterName", tc.roles)
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{Username: tc.username}, "clusterName", tc.roles)
 			single := MakeDatabase(tc.db, accessChecker, interactiveChecker, false)
 			tc.assertResult(t, single)
 
diff --git a/lib/web/user_groups.go b/lib/web/user_groups.go
index a61340491e8d8..8f57e2c1f7ffd 100644
--- a/lib/web/user_groups.go
+++ b/lib/web/user_groups.go
@@ -33,10 +33,10 @@ import (
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
-func (h *Handler) getUserGroups(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) getUserGroups(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of nodes.
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/userpreferences.go b/lib/web/userpreferences.go
index 5b833563206b9..40d3b180f9e65 100644
--- a/lib/web/userpreferences.go
+++ b/lib/web/userpreferences.go
@@ -89,8 +89,8 @@ type UserPreferencesResponse struct {
 	KeyboardLayout              uint32                              `json:"keyboardLayout"`
 }
 
-func (h *Handler) getUserClusterPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	authClient, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) getUserClusterPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	authClient, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -104,14 +104,14 @@ func (h *Handler) getUserClusterPreferences(_ http.ResponseWriter, r *http.Reque
 }
 
 // updateUserClusterPreferences is a handler for PUT /webapi/user/preferences.
-func (h *Handler) updateUserClusterPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+func (h *Handler) updateUserClusterPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	req := UserPreferencesResponse{}
 
 	if err := httplib.ReadResourceJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	authClient, err := sctx.GetUserClient(r.Context(), site)
+	authClient, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/users.go b/lib/web/users.go
index f96d0b4405e10..ee93cf31b9d80 100644
--- a/lib/web/users.go
+++ b/lib/web/users.go
@@ -27,10 +27,13 @@ import (
 	"github.com/julienschmidt/httprouter"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
@@ -53,6 +56,7 @@ func (h *Handler) createUserHandle(w http.ResponseWriter, r *http.Request, param
 	return createUser(r, clt, ctx.GetUser())
 }
 
+// TODO(rudream): DELETE IN V21.0.0
 func (h *Handler) getUsersHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
 	clt, err := ctx.GetClient()
 	if err != nil {
@@ -62,6 +66,68 @@ func (h *Handler) getUsersHandle(w http.ResponseWriter, r *http.Request, params
 	return getUsers(r.Context(), clt)
 }
 
+// listUsersHandle returns a paginated list of users.
+func (h *Handler) listUsersHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (any, error) {
+	clt, err := ctx.GetClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	values := r.URL.Query()
+
+	limit, err := QueryLimitAsInt32(values, "limit", defaults.MaxIterationLimit)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	users, nextToken, _, err := clientutils.Page(
+		r.Context(),
+		int(limit),
+		values.Get("startKey"),
+		func(ctx context.Context, pageSize int, pageToken string) ([]*types.UserV2, string, error) {
+			resp, err := clt.ListUsers(r.Context(), &userspb.ListUsersRequest{
+				PageSize:  int32(pageSize),
+				PageToken: pageToken,
+				Filter: &types.UserFilter{
+					SearchKeywords:  client.ParseSearchKeywords(values.Get("search"), ' '),
+					SkipSystemUsers: true,
+				},
+			})
+
+			if err != nil {
+				return nil, "", trace.Wrap(err)
+			}
+
+			return resp.Users, resp.NextPageToken, nil
+		})
+
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var uiUsers []ui.UserListEntry
+	for _, u := range users {
+		uiuser, err := ui.NewUserListEntry(u)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		uiUsers = append(uiUsers, *uiuser)
+	}
+
+	return &listUsersResponse{
+		Items:    uiUsers,
+		StartKey: nextToken,
+	}, nil
+}
+
+// listUsersResponse is the response for the list users request.
+type listUsersResponse struct {
+	// Items is the list of users retrieved.
+	Items []ui.UserListEntry `json:"items"`
+	// StartKey is the position from which to resume search.
+	StartKey string `json:"startKey"`
+}
+
 func (h *Handler) getUserHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
 	clt, err := ctx.GetClient()
 	if err != nil {
@@ -311,8 +377,11 @@ type userAPIGetter interface {
 	CreateUser(ctx context.Context, user types.User) (types.User, error)
 	// UpdateUser updates a user
 	UpdateUser(ctx context.Context, user types.User) (types.User, error)
-	// GetUsers returns a list of users
+	// GetUsers returns a list of all users
+	// TODO(rudream): DELETE IN V21.0.0
 	GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
+	// ListUsers returns a paginated list of users.
+	ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*userspb.ListUsersResponse, error)
 	// DeleteUser deletes a user by name.
 	DeleteUser(ctx context.Context, user string) error
 }
diff --git a/lib/web/users_test.go b/lib/web/users_test.go
index 9d8d729f0544e..e2a4ecc542605 100644
--- a/lib/web/users_test.go
+++ b/lib/web/users_test.go
@@ -30,6 +30,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/constants"
+	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -446,6 +447,7 @@ type mockedUserAPIGetter struct {
 	mockUpdateUser func(ctx context.Context, user types.User) (types.User, error)
 	mockGetUsers   func(ctx context.Context, withSecrets bool) ([]types.User, error)
 	mockDeleteUser func(ctx context.Context, user string) error
+	mockListUsers  func(ctx context.Context, req *userspb.ListUsersRequest) (*userspb.ListUsersResponse, error)
 }
 
 func (m *mockedUserAPIGetter) GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error) {
@@ -483,3 +485,11 @@ func (m *mockedUserAPIGetter) DeleteUser(ctx context.Context, name string) error
 
 	return trace.NotImplemented("mockDeleteUser not implemented")
 }
+
+func (m *mockedUserAPIGetter) ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*userspb.ListUsersResponse, error) {
+	if m.mockListUsers != nil {
+		return m.mockListUsers(ctx, req)
+	}
+
+	return nil, trace.NotImplemented("mockListUsers not implemented")
+}
diff --git a/lib/web/usertasks.go b/lib/web/usertasks.go
index 4fd5588c395db..285e165199822 100644
--- a/lib/web/usertasks.go
+++ b/lib/web/usertasks.go
@@ -32,7 +32,7 @@ import (
 )
 
 // userTaskStateUpdate updates the state of a User Task.
-func (h *Handler) userTaskStateUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) userTaskStateUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	userTaskName := p.ByName("name")
 	if userTaskName == "" {
 		return nil, trace.BadParameter("a user task name is required")
@@ -47,7 +47,7 @@ func (h *Handler) userTaskStateUpdate(w http.ResponseWriter, r *http.Request, p
 		return nil, trace.Wrap(err)
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -67,13 +67,13 @@ func (h *Handler) userTaskStateUpdate(w http.ResponseWriter, r *http.Request, p
 }
 
 // userTaskGet returns a User Task based on its name
-func (h *Handler) userTaskGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
+func (h *Handler) userTaskGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
 	userTaskName := p.ByName("name")
 	if userTaskName == "" {
 		return nil, trace.BadParameter("a user task name is required")
 	}
 
-	clt, err := sctx.GetUserClient(r.Context(), site)
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -95,8 +95,8 @@ func (h *Handler) userTaskGet(w http.ResponseWriter, r *http.Request, p httprout
 //
 // It returns a list of user tasks with the base attributes (common among all user tasks).
 // To get a detailed UserTask use the single resource endpoint, ie, usertask/<resource's name>.
-func (h *Handler) userTaskListByIntegration(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
-	clt, err := sctx.GetUserClient(r.Context(), site)
+func (h *Handler) userTaskListByIntegration(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/usertasks_test.go b/lib/web/usertasks_test.go
index 354b9fb8d9c53..4cf28441709de 100644
--- a/lib/web/usertasks_test.go
+++ b/lib/web/usertasks_test.go
@@ -31,7 +31,7 @@ import (
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/usertasks"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
@@ -54,7 +54,7 @@ func TestUserTask(t *testing.T) {
 		})
 	require.NoError(t, err)
 	pack := env.proxies[0].authPack(t, userWithRW, []types.Role{roleRWUserTask})
-	adminClient, err := env.server.NewClient(auth.TestAdmin())
+	adminClient, err := env.server.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
 	getAllEndpoint := pack.clt.Endpoint("webapi", "sites", clusterName, "usertask")
diff --git a/lib/web/workload_identity.go b/lib/web/workload_identity.go
new file mode 100644
index 0000000000000..a6ca8ec8d88a8
--- /dev/null
+++ b/lib/web/workload_identity.go
@@ -0,0 +1,94 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+
+	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	tslices "github.com/gravitational/teleport/lib/utils/slices"
+)
+
+// listWorkloadIdentities returns a list of workload identities for a given
+// cluster site.
+func (h *Handler) listWorkloadIdentities(_ http.ResponseWriter, r *http.Request, _ httprouter.Params, sctx *SessionContext, cluster reversetunnelclient.Cluster) (any, error) {
+	clt, err := sctx.GetUserClient(r.Context(), cluster)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	request := &workloadidentityv1.ListWorkloadIdentitiesV2Request{
+		PageSize:         20,
+		PageToken:        r.URL.Query().Get("page_token"),
+		SortField:        r.URL.Query().Get("sort_field"),
+		FilterSearchTerm: r.URL.Query().Get("search"),
+	}
+
+	if r.URL.Query().Has("page_size") {
+		pageSize, err := strconv.ParseInt(r.URL.Query().Get("page_size"), 10, 32)
+		if err != nil {
+			return nil, trace.BadParameter("invalid page size")
+		}
+		request.PageSize = int32(pageSize)
+	}
+
+	if r.URL.Query().Has("sort_dir") {
+		sortDir := r.URL.Query().Get("sort_dir")
+		request.SortDesc = strings.ToLower(sortDir) == "desc"
+	}
+
+	result, err := clt.WorkloadIdentityResourceServiceClient().ListWorkloadIdentitiesV2(r.Context(), request)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	uiItems := tslices.Map(result.WorkloadIdentities, func(item *workloadidentityv1.WorkloadIdentity) WorkloadIdentity {
+		uiItem := WorkloadIdentity{
+			Name:       item.Metadata.Name,
+			SpiffeID:   item.Spec.Spiffe.Id,
+			SpiffeHint: item.Spec.Spiffe.Hint,
+			Labels:     item.Metadata.Labels,
+		}
+
+		return uiItem
+	})
+
+	return ListWorkloadIdentitiesResponse{
+		Items:         uiItems,
+		NextPageToken: result.NextPageToken,
+	}, nil
+}
+
+type ListWorkloadIdentitiesResponse struct {
+	Items         []WorkloadIdentity `json:"items"`
+	NextPageToken string             `json:"next_page_token,omitempty"`
+}
+
+type WorkloadIdentity struct {
+	Name       string            `json:"name"`
+	SpiffeID   string            `json:"spiffe_id"`
+	SpiffeHint string            `json:"spiffe_hint"`
+	Labels     map[string]string `json:"labels"`
+}
diff --git a/lib/web/workload_identity_test.go b/lib/web/workload_identity_test.go
new file mode 100644
index 0000000000000..c79cca16e5310
--- /dev/null
+++ b/lib/web/workload_identity_test.go
@@ -0,0 +1,303 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package web
+
+import (
+	"encoding/json"
+	"math"
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+func TestListWorkloadIdentities(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	env := newWebPack(t, 1)
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoint := pack.clt.Endpoint(
+		"webapi",
+		"sites",
+		clusterName,
+		"workload-identity",
+	)
+
+	name := uuid.New().String()
+
+	_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		Kind:    types.KindWorkloadIdentity,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: name,
+			Labels: map[string]string{
+				"label-1": "value-1",
+				"label-2": "value-2",
+			},
+		},
+		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Id:   "/test/spiffe/id",
+				Hint: "Lorem ipsum delor sit",
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	response, err := pack.clt.Get(ctx, endpoint, url.Values{})
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+	var instances ListWorkloadIdentitiesResponse
+	require.NoError(t, json.Unmarshal(response.Bytes(), &instances), "invalid response received")
+
+	assert.Len(t, instances.Items, 1)
+	require.Empty(t, cmp.Diff(instances, ListWorkloadIdentitiesResponse{
+		Items: []WorkloadIdentity{
+			{
+				Name:       name,
+				SpiffeID:   "/test/spiffe/id",
+				SpiffeHint: "Lorem ipsum delor sit",
+				Labels: map[string]string{
+					"label-1": "value-1",
+					"label-2": "value-2",
+				},
+			},
+		},
+	}))
+}
+
+func TestListWorkloadIdentitiesPaging(t *testing.T) {
+	t.Parallel()
+
+	tcs := []struct {
+		name         string
+		numInstances int
+		pageSize     int
+	}{
+		{
+			name:         "zero results",
+			numInstances: 0,
+			pageSize:     1,
+		},
+		{
+			name:         "smaller page size",
+			numInstances: 5,
+			pageSize:     2,
+		},
+		{
+			name:         "larger page size",
+			numInstances: 2,
+			pageSize:     5,
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			env := newWebPack(t, 1)
+			proxy := env.proxies[0]
+			pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+			clusterName := env.server.ClusterName()
+			endpoint := pack.clt.Endpoint(
+				"webapi",
+				"sites",
+				clusterName,
+				"workload-identity",
+			)
+
+			for i := range tc.numInstances {
+				_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+					Kind:    types.KindWorkloadIdentity,
+					Version: types.V1,
+					Metadata: &headerv1.Metadata{
+						Name: uuid.New().String(),
+					},
+					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+							Id: "/test/spiffe/" + uuid.New().String(),
+						},
+					},
+				})
+				require.NoError(t, err, "failed to create WorkloadIdentity index:%d", i)
+			}
+
+			response, err := pack.clt.Get(ctx, endpoint, url.Values{
+				"page_token": []string{""}, // default to the start
+				"page_size":  []string{strconv.Itoa(tc.pageSize)},
+			})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+			var resp ListWorkloadIdentitiesResponse
+			require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
+
+			assert.Len(t, resp.Items, int(math.Min(float64(tc.numInstances), float64(tc.pageSize))))
+		})
+	}
+}
+
+func TestListWorkloadIdentitiesSorting(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	env := newWebPack(t, 1, withWebPackAuthCacheEnabled(true))
+	proxy := env.proxies[0]
+	pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+	clusterName := env.server.ClusterName()
+	endpoint := pack.clt.Endpoint(
+		"webapi",
+		"sites",
+		clusterName,
+		"workload-identity",
+	)
+
+	for i := range 10 {
+		_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			Kind:    types.KindWorkloadIdentity,
+			Version: types.V1,
+			Metadata: &headerv1.Metadata{
+				Name: uuid.New().String(),
+			},
+			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/test/spiffe/" + uuid.New().String(),
+				},
+			},
+		})
+		require.NoError(t, err, "failed to create WorkloadIdentity index:%d", i)
+	}
+
+	response, err := pack.clt.Get(ctx, endpoint, url.Values{
+		"page_token": []string{""}, // default to the start
+		"page_size":  []string{"0"},
+		"sort_field": []string{"spiffe_id"},
+		"sort_dir":   []string{"DESC"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+	var resp ListWorkloadIdentitiesResponse
+	require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
+
+	prevValue := "~"
+	for _, r := range resp.Items {
+		assert.Less(t, r.SpiffeID, prevValue)
+		prevValue = r.SpiffeID
+	}
+}
+
+func TestListWorkloadIdentitiesWithSearchTermFilter(t *testing.T) {
+	t.Parallel()
+
+	tcs := []struct {
+		name       string
+		searchTerm string
+		metadata   *headerv1.Metadata
+		spec       *workloadidentityv1pb.WorkloadIdentitySpec
+	}{
+		{
+			name:       "match on name",
+			searchTerm: "nick",
+			metadata: &headerv1.Metadata{
+				Name: "this-is-nicks-workload-identity",
+			},
+			spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/spiffe/id/99",
+				},
+			},
+		},
+		{
+			name:       "match on spiffe id",
+			searchTerm: "id/22",
+			metadata: &headerv1.Metadata{
+				Name: "this-is-nicks-workload-identity",
+			},
+			spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					Id: "/spiffe/id/22",
+				},
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			env := newWebPack(t, 1)
+			proxy := env.proxies[0]
+			pack := proxy.authPack(t, "admin", []types.Role{services.NewPresetEditorRole()})
+			clusterName := env.server.ClusterName()
+			endpoint := pack.clt.Endpoint(
+				"webapi",
+				"sites",
+				clusterName,
+				"workload-identity",
+			)
+
+			_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+				Kind:     types.KindWorkloadIdentity,
+				Version:  types.V1,
+				Metadata: tc.metadata,
+				Spec:     tc.spec,
+			})
+			require.NoError(t, err)
+
+			_, err = env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+				Kind:    types.KindWorkloadIdentity,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: "gone",
+				},
+				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+						Id: "/test/spiffe/id",
+					},
+				},
+			})
+			require.NoError(t, err)
+
+			response, err := pack.clt.Get(ctx, endpoint, url.Values{
+				"search": []string{tc.searchTerm},
+			})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code")
+
+			var resp ListWorkloadIdentitiesResponse
+			require.NoError(t, json.Unmarshal(response.Bytes(), &resp), "invalid response received")
+
+			assert.Len(t, resp.Items, 1)
+			assert.Equal(t, "this-is-nicks-workload-identity", resp.Items[0].Name)
+		})
+	}
+}
diff --git a/lib/winpki/certificate_authority.go b/lib/winpki/certificate_authority.go
index 147b34f0b29b1..7c30f271918ca 100644
--- a/lib/winpki/certificate_authority.go
+++ b/lib/winpki/certificate_authority.go
@@ -20,11 +20,13 @@ package winpki
 
 import (
 	"context"
+	"crypto/tls"
 	"log/slog"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tlsca"
 )
 
 // NewCertificateStoreClient returns a new structure for modifying windows certificates in a Windows CA.
@@ -43,6 +45,8 @@ type CertificateStoreClient struct {
 type CRLGenerator interface {
 	// GenerateCertAuthorityCRL returns an empty CRL for a CA.
 	GenerateCertAuthorityCRL(ctx context.Context, caType types.CertAuthType) ([]byte, error)
+	// GetCertAuthorities returns a list of cert authorities
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool) ([]types.CertAuthority, error)
 }
 
 // CertificateStoreConfig is a config structure for a Windows Certificate Authority
@@ -56,19 +60,14 @@ type CertificateStoreConfig struct {
 	Logger *slog.Logger
 	// ClusterName is the name of this Teleport cluster
 	ClusterName string
-	// LC is the LDAPClient
-	LC *LDAPClient
+	// LC is the LDAPConfig
+	LC *LDAPConfig
 }
 
 // Update publishes an empty certificate revocation list to LDAP.
-func (c *CertificateStoreClient) Update(ctx context.Context) error {
+func (c *CertificateStoreClient) Update(ctx context.Context, tc *tls.Config) error {
 	caType := types.UserCA
 
-	crlDER, err := c.cfg.AccessPoint.GenerateCertAuthorityCRL(ctx, caType)
-	if err != nil {
-		return trace.Wrap(err, "generating CRL")
-	}
-
 	// TODO(zmb3): check for the presence of Teleport's CA in the NTAuth store
 
 	// To make the CA trusted, we need 3 things:
@@ -76,15 +75,51 @@ func (c *CertificateStoreClient) Update(ctx context.Context) error {
 	// 2. put the CA cert into NTAuth store in LDAP
 	// 3. put the CRL of the CA into a dedicated LDAP entry
 	//
-	// #1 and #2 are done manually as part of the set up process (see public docs).
+	// #1 and #2 are done manually as part of the set-up process (see public docs).
 	// Below we do #3.
-	if err := c.updateCRL(ctx, crlDER, caType); err != nil {
-		return trace.Wrap(err, "updating CRL over LDAP")
+
+	hasCRL := false
+	certAuthorities, err := c.cfg.AccessPoint.GetCertAuthorities(ctx, caType, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	for _, ca := range certAuthorities {
+		for _, keyPair := range ca.GetActiveKeys().TLS {
+			if len(keyPair.CRL) == 0 {
+				continue
+			}
+			hasCRL = true
+			cert, err := tlsca.ParseCertificatePEM(keyPair.Cert)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if err := c.updateCRL(ctx, c.cfg.ClusterName, cert.SubjectKeyId, keyPair.CRL, caType, tc); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+
+	// All authorities are missing CRL, fall back to legacy behavior since some early v18 auth servers
+	// won't have set up CRLs yet.
+	// DELETE IN v19 (zmb3/probakowski): this is agent code, by the time agents are on v19 we won't
+	// need to worry about v18 auth servers.
+	if !hasCRL {
+		c.cfg.Logger.WarnContext(ctx, "No existing certificate authorities had an associated CRL. "+
+			"If you are using HSM or KMS for private key material, please update your auth server.")
+		crlDER, err := c.cfg.AccessPoint.GenerateCertAuthorityCRL(ctx, caType)
+		if err != nil {
+			return trace.Wrap(err, "generating CRL")
+		}
+
+		if err := c.updateCRL(ctx, c.cfg.ClusterName, nil, crlDER, caType, tc); err != nil {
+			return trace.Wrap(err, "updating CRL over LDAP")
+		}
 	}
 	return nil
 }
 
-func (c *CertificateStoreClient) updateCRL(ctx context.Context, crlDER []byte, caType types.CertAuthType) error {
+func (c *CertificateStoreClient) updateCRL(ctx context.Context, issuerCN string, issuerSKID []byte, crlDER []byte, caType types.CertAuthType, tc *tls.Config) error {
 	// Publish the CRL for current cluster CA. For trusted clusters, their
 	// respective windows_desktop_services will publish CRLs of their CAs so we
 	// don't have to do it here.
@@ -99,15 +134,21 @@ func (c *CertificateStoreClient) updateCRL(ctx context.Context, crlDER []byte, c
 	// CA will be placed at:
 	// ... > CDP > Teleport > prod
 	containerDN := crlContainerDN(c.cfg.Domain, caType)
-	crlDN := crlDN(c.cfg.ClusterName, c.cfg.Domain, caType)
+	crlDN := CRLDN(issuerCN, issuerSKID, c.cfg.Domain, caType)
+
+	ldapClient, err := DialLDAP(ctx, c.cfg.LC, tc)
+	if err != nil {
+		return trace.Wrap(err, "dialing LDAP server")
+	}
+	defer ldapClient.Close()
 
 	// Create the parent container.
-	if err := c.cfg.LC.CreateContainer(containerDN); err != nil {
+	if err := ldapClient.CreateContainer(ctx, containerDN); err != nil {
 		return trace.Wrap(err, "creating CRL container")
 	}
 
 	// Create the CRL object itself.
-	if err := c.cfg.LC.Create(
+	if err := ldapClient.Create(
 		crlDN,
 		"cRLDistributionPoint",
 		map[string][]string{"certificateRevocationList": {string(crlDER)}},
@@ -116,15 +157,16 @@ func (c *CertificateStoreClient) updateCRL(ctx context.Context, crlDER []byte, c
 			return trace.Wrap(err)
 		}
 		// CRL already exists, update it.
-		if err := c.cfg.LC.Update(
+		if err := ldapClient.Update(
+			ctx,
 			crlDN,
 			map[string][]string{"certificateRevocationList": {string(crlDER)}},
 		); err != nil {
 			return trace.Wrap(err)
 		}
-		c.cfg.Logger.InfoContext(ctx, "Updated CRL for Windows logins via LDAP")
+		c.cfg.Logger.InfoContext(ctx, "Updated CRL for Windows logins via LDAP", "dn", crlDN)
 	} else {
-		c.cfg.Logger.InfoContext(ctx, "Added CRL for Windows logins via LDAP")
+		c.cfg.Logger.InfoContext(ctx, "Added CRL for Windows logins via LDAP", "dn", crlDN)
 	}
 	return nil
 }
diff --git a/lib/winpki/ldap.go b/lib/winpki/ldap.go
index 16155347ca045..88f90698c64a6 100644
--- a/lib/winpki/ldap.go
+++ b/lib/winpki/ldap.go
@@ -19,23 +19,54 @@
 package winpki
 
 import (
-	"crypto/x509"
+	"context"
+	"crypto/tls"
+	"encoding/base32"
 	"errors"
 	"fmt"
+	"log/slog"
+	"net"
+	"os"
 	"strings"
-	"sync"
+	"time"
 
 	"github.com/go-ldap/ldap/v3"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils/dns"
 )
 
+const (
+	// ldapDialTimeout is the timeout for dialing the LDAP server
+	// when making an initial connection
+	ldapDialTimeout = 30 * time.Second
+
+	// ldapRequestTimeout is the timeout for making LDAP requests.
+	// It is larger than the dial timeout because LDAP queries in large
+	// Active Directory environments may take longer to complete.
+	ldapRequestTimeout = 45 * time.Second
+)
+
+// LocateServer contains parameters for locating LDAP servers
+// from the AD Domain
+type LocateServer struct {
+	// Automatically locate the LDAP server using DNS SRV records.
+	// https://ldap.com/dns-srv-records-for-ldap/
+	Enabled bool
+	// Use LDAP site to locate servers from a specific logical site.
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/b645c125-a7da-4097-84a1-2fa7cea07714#gt_8abdc986-5679-42d9-ad76-b11eb5a0daba
+	Site string
+}
+
 // LDAPConfig contains parameters for connecting to an LDAP server.
 type LDAPConfig struct {
 	// Addr is the LDAP server address in the form host:port.
 	// Standard port is 636 for LDAPS.
 	Addr string
+	// LocateServer contains parameters for locating LDAP servers from the AD domain.
+	LocateServer LocateServer
 	// Domain is an Active Directory domain name, like "example.com".
 	Domain string
 	// Username is an LDAP username, like "EXAMPLE\Administrator", where
@@ -43,26 +74,38 @@ type LDAPConfig struct {
 	Username string
 	// SID is the SID for the user specified by Username.
 	SID string
-	// InsecureSkipVerify decides whether we skip verifying with the LDAP server's CA when making the LDAPS connection.
-	InsecureSkipVerify bool
-	// ServerName is the name of the LDAP server for TLS.
-	ServerName string
-	// CA is an optional CA cert to be used for verification if InsecureSkipVerify is set to false.
-	CA *x509.Certificate
+	// Logger is the logger for the service.
+	Logger *slog.Logger
 }
 
-// Check verifies this LDAPConfig
-func (cfg LDAPConfig) Check() error {
-	if cfg.Addr == "" {
-		return trace.BadParameter("missing Addr in LDAPConfig")
-	}
-	if cfg.Domain == "" {
-		return trace.BadParameter("missing Domain in LDAPConfig")
-	}
-	if cfg.Username == "" {
-		return trace.BadParameter("missing Username in LDAPConfig")
+// LDAPClient is an LDAP client designed for Active Directory environments.
+// It uses mutual TLS for authentication, and has the ability to discover
+// LDAP servers from DNS if an explicit address is not provided.
+//
+// LDAPClient does not implement any form of credential refresh or certificate
+// rotation. It is no longer useful after its certificate expires.
+// For this reason, callers are encouraged to create clients on-demand rather
+// than keeping them open for long periods of time.
+type LDAPClient struct {
+	cfg  *LDAPConfig
+	conn *ldap.Conn
+}
+
+// DialLDAP creates a new LDAP client using the provided TLS config for client credentials.
+func DialLDAP(ctx context.Context, cfg *LDAPConfig, credentials *tls.Config) (*LDAPClient, error) {
+	conn, err := cfg.createConnection(ctx, credentials)
+	if err != nil {
+		return nil, trace.Wrap(err, "connecting to LDAP server")
 	}
-	return nil
+
+	return &LDAPClient{
+		cfg:  cfg,
+		conn: conn,
+	}, nil
+}
+
+func (l *LDAPClient) Close() error {
+	return l.conn.Close()
 }
 
 // DomainDN returns the distinguished name for an Active Directory Domain.
@@ -84,52 +127,23 @@ const (
 	AttrObjectSid = "objectSid"
 	// AttrObjectClass is the object class of an LDAP object
 	AttrObjectClass = "objectClass"
-)
 
-// classContainer is the object class for containers in Active Directory
-const classContainer = "container"
+	// AttrSAMAccountType is the SAM Account type for an LDAP object.
+	AttrSAMAccountType = "sAMAccountType"
+	// AccountTypeUser is the SAM account type for user accounts.
+	// See https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype
+	// (SAM_USER_OBJECT)
+	AccountTypeUser = "805306368"
+
+	// AttrSAMAccountName is the SAM Account name of an LDAP object.
+	AttrSAMAccountName = "sAMAccountName"
+)
 
 // searchPageSize is desired page size for LDAP search. In Active Directory the default search size limit is 1000 entries,
 // so in most cases the 1000 search page size will result in the optimal amount of requests made to
 // LDAP server.
 const searchPageSize = 1000
 
-// LDAPClient is a windows LDAP client.
-//
-// It does not automatically detect when the underlying connection
-// is closed. Callers should check for trace.ConnectionProblem errors
-// and provide a new client with [SetClient].
-type LDAPClient struct {
-	mu     sync.Mutex
-	client ldap.Client
-}
-
-// NewLDAPClient returns new LDAPClient. Parameter client may be nil.
-func NewLDAPClient(client ldap.Client) *LDAPClient {
-	return &LDAPClient{
-		client: client,
-	}
-}
-
-// SetClient sets the underlying ldap.Client
-func (c *LDAPClient) SetClient(client ldap.Client) {
-	c.mu.Lock()
-	if c.client != nil {
-		c.client.Close()
-	}
-	c.client = client
-	c.mu.Unlock()
-}
-
-// Close closes the underlying ldap.Client
-func (c *LDAPClient) Close() {
-	c.mu.Lock()
-	if c.client != nil {
-		c.client.Close()
-	}
-	c.mu.Unlock()
-}
-
 // convertLDAPError attempts to convert LDAP error codes to their
 // equivalent trace errors.
 func convertLDAPError(err error) error {
@@ -141,9 +155,6 @@ func convertLDAPError(err error) error {
 	if errors.As(err, &ldapErr) {
 		switch ldapErr.ResultCode {
 		case ldap.ErrorNetwork:
-			// this one is especially important, because Teleport will
-			// try to re-establish the connection when a ConnectionProblem
-			// is detected
 			return trace.ConnectionProblem(err, "network error")
 		case ldap.LDAPResultOperationsError:
 			if strings.Contains(err.Error(), "successful bind must be completed") {
@@ -163,9 +174,35 @@ func convertLDAPError(err error) error {
 	return err
 }
 
+// GetActiveDirectorySID makes an LDAP query to retrieve the security identifier (SID)
+// for the specified Active Directory user.
+func (l *LDAPClient) GetActiveDirectorySID(ctx context.Context, username string) (string, error) {
+	filter := CombineLDAPFilters([]string{
+		fmt.Sprintf("(%s=%s)", AttrSAMAccountType, AccountTypeUser),
+		fmt.Sprintf("(%s=%s)", AttrSAMAccountName, ldap.EscapeFilter(username)),
+	})
+
+	entries, err := l.ReadWithFilter(DomainDN(l.cfg.Domain), filter, []string{AttrObjectSid})
+	switch {
+	case err != nil:
+		return "", trace.Wrap(err)
+	case len(entries) == 0:
+		return "", trace.NotFound("could not find Windows account %q", username)
+	case len(entries) > 1:
+		l.cfg.Logger.WarnContext(ctx, "found multiple entries for user, taking the first", "user", username)
+	}
+
+	sid, err := ADSIDStringFromLDAPEntry(entries[0])
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return sid, nil
+}
+
 // ReadWithFilter searches the specified DN (and its children) using the specified LDAP filter.
 // See https://ldap.com/ldap-filters/ for more information on LDAP filter syntax.
-func (c *LDAPClient) ReadWithFilter(dn string, filter string, attrs []string) ([]*ldap.Entry, error) {
+func (l *LDAPClient) ReadWithFilter(dn string, filter string, attrs []string) ([]*ldap.Entry, error) {
 	req := ldap.NewSearchRequest(
 		dn,
 		ldap.ScopeWholeSubtree,
@@ -177,10 +214,8 @@ func (c *LDAPClient) ReadWithFilter(dn string, filter string, attrs []string) ([
 		attrs,
 		nil, // no Controls
 	)
-	c.mu.Lock()
-	defer c.mu.Unlock()
 
-	res, err := c.client.SearchWithPaging(req, searchPageSize)
+	res, err := l.conn.SearchWithPaging(req, searchPageSize)
 	if err != nil {
 		return nil, trace.Wrap(convertLDAPError(err), "fetching LDAP object %q with filter %q", dn, filter)
 	}
@@ -196,8 +231,8 @@ func (c *LDAPClient) ReadWithFilter(dn string, filter string, attrs []string) ([
 // specific entry using ADSIEdit.msc.
 // You can find the list of all AD classes at
 // https://docs.microsoft.com/en-us/windows/win32/adschema/classes-all
-func (c *LDAPClient) Read(dn string, class string, attrs []string) ([]*ldap.Entry, error) {
-	return c.ReadWithFilter(dn, fmt.Sprintf("(%s=%s)", AttrObjectClass, class), attrs)
+func (l *LDAPClient) Read(dn string, class string, attrs []string) ([]*ldap.Entry, error) {
+	return l.ReadWithFilter(dn, fmt.Sprintf("(%s=%s)", AttrObjectClass, class), attrs)
 }
 
 // Create creates an LDAP entry at the given path, with the given class and
@@ -208,26 +243,23 @@ func (c *LDAPClient) Read(dn string, class string, attrs []string) ([]*ldap.Entr
 // attributes for similar entries using ADSIEdit.msc.
 // You can find the list of all AD classes at
 // https://docs.microsoft.com/en-us/windows/win32/adschema/classes-all
-func (c *LDAPClient) Create(dn string, class string, attrs map[string][]string) error {
+func (l *LDAPClient) Create(dn string, class string, attrs map[string][]string) error {
 	req := ldap.NewAddRequest(dn, nil)
 	for k, v := range attrs {
 		req.Attribute(k, v)
 	}
 	req.Attribute("objectClass", []string{class})
 
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if err := c.client.Add(req); err != nil {
+	if err := l.conn.Add(req); err != nil {
 		return trace.Wrap(convertLDAPError(err), "error creating LDAP object %q", dn)
 	}
 	return nil
 }
 
-// CreateContainer creates an LDAP container entry if
-// it doesn't already exist.
-func (c *LDAPClient) CreateContainer(dn string) error {
-	err := c.Create(dn, classContainer, nil)
+// CreateContainer creates an LDAP container entry if it doesn't already exist.
+func (l *LDAPClient) CreateContainer(ctx context.Context, dn string) error {
+	const classContainer = "container"
+	err := l.Create(dn, classContainer, nil /* attrs */)
 	// Ignore the error if container already exists.
 	if trace.IsAlreadyExists(err) {
 		return nil
@@ -244,16 +276,13 @@ func (c *LDAPClient) CreateContainer(dn string) error {
 //
 // You can browse LDAP on the Windows host to find attributes of existing
 // entries using ADSIEdit.msc.
-func (c *LDAPClient) Update(dn string, replaceAttrs map[string][]string) error {
+func (l *LDAPClient) Update(ctx context.Context, dn string, replaceAttrs map[string][]string) error {
 	req := ldap.NewModifyRequest(dn, nil)
 	for k, v := range replaceAttrs {
 		req.Replace(k, v)
 	}
 
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if err := c.client.Modify(req); err != nil {
+	if err := l.conn.Modify(req); err != nil {
 		return trace.Wrap(convertLDAPError(err), "updating %q", dn)
 	}
 	return nil
@@ -268,8 +297,35 @@ func crlContainerDN(domain string, caType types.CertAuthType) string {
 	return fmt.Sprintf("CN=%s,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,%s", crlKeyName(caType), DomainDN(domain))
 }
 
-func crlDN(clusterName string, activeDirectoryDomain string, caType types.CertAuthType) string {
-	return "CN=" + clusterName + "," + crlContainerDN(activeDirectoryDomain, caType)
+// CRNCN computes the common name for a Teleport CRL in Windows environments.
+// The issuer SKID is optional, but should generally be set for compatibility
+// with clusters having more than one issuer (like those using HSMs).
+func CRLCN(issuerCN string, issuerSKID []byte) string {
+	name := issuerCN
+	if len(issuerSKID) > 0 {
+		id := base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString(issuerSKID)
+		name = id + "_" + name
+	}
+	// The limit on the CN attribute should be 64 characters, but in practice
+	// we observe that certutil.exe truncates the CN as soon as it exceeds 51 characters.
+	return name[:min(len(name), 51)]
+}
+
+// CRLDN computes the distinguished name for a Teleport CRL in Windows environments.
+// The issuer SKID is optional, but should generally be set for compatibility
+// with clusters having more than one issuer (like those using HSMs).
+func CRLDN(issuerCN string, issuerSKID []byte, activeDirectoryDomain string, caType types.CertAuthType) string {
+	return "CN=" + CRLCN(issuerCN, issuerSKID) + "," + crlContainerDN(activeDirectoryDomain, caType)
+}
+
+// CRLDistributionPoint computes the CRL distribution point for certs issued.
+func CRLDistributionPoint(activeDirectoryDomain string, caType types.CertAuthType, issuer *tlsca.CertAuthority, includeSKID bool) string {
+	var issuerSKID []byte
+	if includeSKID {
+		issuerSKID = issuer.Cert.SubjectKeyId
+	}
+	crlDN := CRLDN(issuer.Cert.Subject.CommonName, issuerSKID, activeDirectoryDomain, caType)
+	return fmt.Sprintf("ldap:///%s?certificateRevocationList?base?objectClass=cRLDistributionPoint", crlDN)
 }
 
 // crlKeyName returns the appropriate LDAP key given the CA type.
@@ -283,3 +339,51 @@ func crlKeyName(caType types.CertAuthType) string {
 		return "Teleport"
 	}
 }
+
+// createConnection dials an LDAP server using the provided TLS config.
+// The server is either obtained directly from the configuration or
+// discovered via DNS.
+func (c *LDAPConfig) createConnection(ctx context.Context, ldapTLSConfig *tls.Config) (*ldap.Conn, error) {
+	servers := []string{c.Addr}
+	dialer := net.Dialer{Timeout: ldapDialTimeout}
+
+	if c.LocateServer.Enabled {
+		// In development environments, the system's default resolver is unlikely to be
+		// able to resolve the Active Directory SRV records needed for server location,
+		// so we allow overriding the resolver. If the TELEPORT_LDAP_RESOLVER paramater
+		// is not set, the default resolver will be used.
+		resolver := dns.NewResolver(ctx, os.Getenv("TELEPORT_LDAP_RESOLVER"), c.Logger)
+
+		var err error
+		if servers, err = dns.LocateServerBySRV(ctx, c.Domain, c.LocateServer.Site, resolver, "ldap", "636"); err != nil {
+			return nil, trace.Wrap(err, "locating LDAP server")
+		}
+	}
+
+	if len(servers) == 0 {
+		return nil, trace.NotFound("no LDAP servers found for domain %q", c.Domain)
+	}
+
+	var lastErr error
+	for _, server := range servers {
+		conn, err := ldap.DialURL(
+			"ldaps://"+server,
+			ldap.DialWithDialer(&dialer),
+			ldap.DialWithTLSConfig(ldapTLSConfig),
+		)
+
+		if err == nil {
+			c.Logger.DebugContext(ctx, "Connected to LDAP server", "server", server)
+			conn.SetTimeout(ldapRequestTimeout)
+			return conn, nil
+		}
+		lastErr = err
+
+		if c.LocateServer.Enabled {
+			// If the connection fails and we're using LocateServer, log that a server failed.
+			c.Logger.DebugContext(ctx, "Error connecting to LDAP server, trying next available server", "server", server, "error", err)
+		}
+	}
+
+	return nil, trace.NotFound("no LDAP servers responded successfully for domain %q: %v", c.Domain, lastErr)
+}
diff --git a/lib/winpki/windows.go b/lib/winpki/windows.go
index 21c8ccd3f69e8..41ec817ffab1e 100644
--- a/lib/winpki/windows.go
+++ b/lib/winpki/windows.go
@@ -40,9 +40,12 @@ import (
 )
 
 type certRequest struct {
-	csrPEM      []byte
-	crlEndpoint string
-	keyDER      []byte
+	csrPEM []byte
+	keyDER []byte
+
+	// Optionally specifies the AD domain where CRLs are published.
+	// If omitted then the cert will not specify a CRL distribution point.
+	cdpDomain string
 }
 
 func createUsersExtension(groups []string) (pkix.Extension, error) {
@@ -107,10 +110,10 @@ func getCertRequest(req *GenerateCredentialsRequest) (*certRequest, error) {
 	}
 
 	if req.ActiveDirectorySID != "" {
-		adUserMapping, err := asn1.Marshal(SubjectAltName[adSid]{
-			otherName[adSid]{
+		adUserMapping, err := asn1.Marshal(SubjectAltName[ADSid]{
+			otherName[ADSid]{
 				OID: ADUserMappingInternalOID,
-				Value: adSid{
+				Value: ADSid{
 					Value: []byte(req.ActiveDirectorySID),
 				},
 			}})
@@ -134,17 +137,7 @@ func getCertRequest(req *GenerateCredentialsRequest) (*certRequest, error) {
 	}
 
 	if !req.OmitCDP {
-		// Note: this CRL DN may or may not be the same DN published in updateCRL.
-		//
-		// There can be multiple AD domains connected to Teleport. Each
-		// windows_desktop_service is connected to a single AD domain and publishes
-		// CRLs in it. Each service can also handle RDP connections for a different
-		// domain, with the assumption that some other windows_desktop_service
-		// published a CRL there.
-		crlDN := crlDN(req.ClusterName, cmp.Or(req.PKIDomain, req.Domain), req.CAType)
-
-		// TODO(zmb3) consider making Teleport itself the CDP (via HTTP) instead of LDAP
-		cr.crlEndpoint = fmt.Sprintf("ldap:///%s?certificateRevocationList?base?objectClass=cRLDistributionPoint", crlDN)
+		cr.cdpDomain = cmp.Or(req.PKIDomain, req.Domain)
 	}
 
 	return cr, nil
@@ -206,17 +199,9 @@ func GenerateWindowsDesktopCredentials(ctx context.Context, auth AuthInterface,
 		return nil, nil, trace.Wrap(err)
 	}
 	genResp, err := auth.GenerateWindowsDesktopCert(ctx, &proto.WindowsDesktopCertRequest{
-		CSR: certReq.csrPEM,
-		// LDAP URI pointing at the CRL created with updateCRL.
-		//
-		// The full format is:
-		// ldap://domain_controller_addr/distinguished_name_and_parameters.
-		//
-		// Using ldap:///distinguished_name_and_parameters (with empty
-		// domain_controller_addr) will cause Windows to fetch the CRL from any
-		// of its current domain controllers.
-		CRLEndpoint: certReq.crlEndpoint,
-		TTL:         proto.Duration(req.TTL),
+		CSR:       certReq.csrPEM,
+		CRLDomain: certReq.cdpDomain,
+		TTL:       proto.Duration(req.TTL),
 	})
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -250,7 +235,7 @@ func generateDatabaseCredentials(ctx context.Context, auth AuthInterface, req *G
 		// Using ldap:///distinguished_name_and_parameters (with empty
 		// domain_controller_addr) will cause Windows to fetch the CRL from any
 		// of its current domain controllers.
-		CRLEndpoint:           certReq.crlEndpoint,
+		CRLDomain:             certReq.cdpDomain,
 		TTL:                   proto.Duration(req.TTL),
 		CertificateExtensions: proto.DatabaseCertRequest_WINDOWS_SMARTCARD,
 	})
@@ -341,10 +326,10 @@ func SubjectAltNameExtension(user, domain string) (pkix.Extension, error) {
 	ext := pkix.Extension{Id: SubjectAltNameExtensionOID}
 	var err error
 	ext.Value, err = asn1.Marshal(
-		SubjectAltName[upn]{
-			OtherName: otherName[upn]{
+		SubjectAltName[UPN]{
+			OtherName: otherName[UPN]{
 				OID: UPNOtherNameOID,
-				Value: upn{
+				Value: UPN{
 					Value: fmt.Sprintf("%s@%s", user, domain), // TODO(zmb3): sanitize username to avoid domain spoofing
 				},
 			},
@@ -374,11 +359,11 @@ type (
 		Value T `asn1:"tag:0"`
 	}
 
-	upn struct {
+	UPN struct {
 		Value string `asn1:"utf8"`
 	}
 
-	adSid struct {
+	ADSid struct {
 		// Value is the bytes representation of the user's SID string,
 		// e.g. []byte("S-1-5-21-1329593140-2634913955-1900852804-500")
 		Value []byte // Gets encoded as an asn1 octet string
diff --git a/lib/winpki/windows_test.go b/lib/winpki/windows_test.go
index ca5a129c9c5a8..936a4eb2ffd34 100644
--- a/lib/winpki/windows_test.go
+++ b/lib/winpki/windows_test.go
@@ -19,17 +19,12 @@
 package winpki
 
 import (
-	"context"
-	"crypto/x509"
-	"encoding/asn1"
 	"os"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/modules"
 )
 
@@ -38,115 +33,11 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }
 
-// TestGenerateCredentials verifies that the smartcard certificates generated
-// by Teleport meet the requirements for Windows logon.
-func TestGenerateCredentials(t *testing.T) {
-	const (
-		clusterName = "test"
-		user        = "test-user"
-		domain      = "test.example.com"
-	)
-
-	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
-		ClusterName: clusterName,
-		Dir:         t.TempDir(),
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, authServer.Close())
-	})
-
-	tlsServer, err := authServer.NewTestTLSServer()
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, tlsServer.Close())
-	})
-
-	client, err := tlsServer.NewClient(auth.TestServerID(types.RoleWindowsDesktop, "test-host-id"))
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, client.Close())
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	testSid := "S-1-5-21-1329593140-2634913955-1900852804-500"
-
-	for _, test := range []struct {
-		name               string
-		activeDirectorySID string
-	}{
-		{
-			name:               "no ad sid",
-			activeDirectorySID: "",
-		},
-		{
-			name:               "with ad sid",
-			activeDirectorySID: testSid,
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			certb, keyb, err := GenerateWindowsDesktopCredentials(ctx, client, &GenerateCredentialsRequest{
-				Username:           user,
-				Domain:             domain,
-				TTL:                5 * time.Minute,
-				ClusterName:        clusterName,
-				ActiveDirectorySID: test.activeDirectorySID,
-			})
-			require.NoError(t, err)
-			require.NotNil(t, certb)
-			require.NotNil(t, keyb)
-
-			cert, err := x509.ParseCertificate(certb)
-			require.NoError(t, err)
-			require.NotNil(t, cert)
-
-			require.Equal(t, user, cert.Subject.CommonName)
-			require.Contains(t, cert.CRLDistributionPoints,
-				`ldap:///CN=test,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=example,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint`)
-
-			foundKeyUsage := false
-			foundAltName := false
-			foundAdUserMapping := false
-			for _, extension := range cert.Extensions {
-				switch {
-				case extension.Id.Equal(EnhancedKeyUsageExtensionOID):
-					foundKeyUsage = true
-					var oids []asn1.ObjectIdentifier
-					_, err = asn1.Unmarshal(extension.Value, &oids)
-					require.NoError(t, err)
-					require.Len(t, oids, 2)
-					require.Contains(t, oids, ClientAuthenticationOID)
-					require.Contains(t, oids, SmartcardLogonOID)
-				case extension.Id.Equal(SubjectAltNameExtensionOID):
-					foundAltName = true
-					var san SubjectAltName[upn]
-					_, err = asn1.Unmarshal(extension.Value, &san)
-					require.NoError(t, err)
-					require.Equal(t, UPNOtherNameOID, san.OtherName.OID)
-					require.Equal(t, user+"@"+domain, san.OtherName.Value.Value)
-				case extension.Id.Equal(ADUserMappingExtensionOID):
-					foundAdUserMapping = true
-					var adUserMapping SubjectAltName[adSid]
-					_, err = asn1.Unmarshal(extension.Value, &adUserMapping)
-					require.NoError(t, err)
-					require.Equal(t, ADUserMappingInternalOID, adUserMapping.OtherName.OID)
-					require.Equal(t, []byte(testSid), adUserMapping.OtherName.Value.Value)
-
-				}
-			}
-			require.True(t, foundKeyUsage)
-			require.True(t, foundAltName)
-			require.Equal(t, test.activeDirectorySID != "", foundAdUserMapping)
-		})
-	}
-}
-
 func TestCRLDN(t *testing.T) {
 	for _, test := range []struct {
 		name        string
 		clusterName string
+		issuerSKID  []byte
 		crlDN       string
 		caType      types.CertAuthType
 	}{
@@ -172,9 +63,31 @@ func TestCRLDN(t *testing.T) {
 			caType:      types.UserCA,
 			crlDN:       "CN=cluster.goteleport.com,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=goteleport,DC=com",
 		},
+		{
+			name:        "user CA with SKID",
+			clusterName: "example.com",
+			caType:      types.UserCA,
+			issuerSKID:  []byte{0x61, 0xbe, 0xe7, 0xf0, 0xb4, 0x88, 0x78, 0x33, 0x40, 0x7d, 0x7a, 0xc0, 0xa8, 0x2a, 0xeb, 0x3e, 0x9d, 0x9f, 0xa1, 0xba},
+			crlDN:       "CN=C6VEFS5KH1S36G3TFB0AGANB7QEPV8DQ_example.com,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=goteleport,DC=com",
+		},
+		{
+			name:        "user CA with SKID requiring padding",
+			clusterName: "example.com",
+			caType:      types.UserCA,
+			// This test makes sure we don't corrupt the DN with base32 padding in the even the SKID is not exactly 20 bytes long.
+			issuerSKID: []byte{0x61, 0xbe, 0xe7, 0xf0, 0xb4, 0x88, 0x78, 0x33, 0x40, 0x7d, 0x7a, 0xc0, 0xa8, 0x2a, 0xeb, 0x3e, 0x9d, 0x9f},
+			crlDN:      "CN=C6VEFS5KH1S36G3TFB0AGANB7QEPU_example.com,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=goteleport,DC=com",
+		},
+		{
+			name:        "long CN truncated",
+			clusterName: "reallylongclustername.goteleport.com",
+			caType:      types.UserCA,
+			issuerSKID:  []byte{0x61, 0xbe, 0xe7, 0xf0, 0xb4, 0x88, 0x78, 0x33, 0x40, 0x7d, 0x7a, 0xc0, 0xa8, 0x2a, 0xeb, 0x3e, 0x9d, 0x9f, 0xa1, 0xba},
+			crlDN:       "CN=C6VEFS5KH1S36G3TFB0AGANB7QEPV8DQ_reallylongclustern,CN=Teleport,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=goteleport,DC=com",
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			require.Equal(t, test.crlDN, crlDN(test.clusterName, "test.goteleport.com", test.caType))
+			require.Equal(t, test.crlDN, CRLDN(test.clusterName, test.issuerSKID, "test.goteleport.com", test.caType))
 		})
 	}
 }
diff --git a/metrics.go b/metrics.go
index f8a113128c001..ba2849bddb5d2 100644
--- a/metrics.go
+++ b/metrics.go
@@ -108,6 +108,9 @@ const (
 	// TagUpgrader is a metric tag for upgraders.
 	TagUpgrader = "upgrader"
 
+	// TagUpgraderStatus is propagated status from the upgrader.
+	TagUpgraderStatus = "status"
+
 	// MetricsAccessRequestsCreated provides total number of created access requests.
 	MetricAccessRequestsCreated = "access_requests_created"
 	// TagRoles is a number of roles requested as a part of access request.
@@ -263,6 +266,9 @@ const (
 	// MetricRegisteredServers tracks the number of Teleport servers that have successfully registered with the Teleport cluster and have not reached the end of their ttl
 	MetricRegisteredServers = "registered_servers"
 
+	// MetricBotInstances tracks the number of bot instances across the entire cluster, labeled by version
+	MetricBotInstances = "bot_instances"
+
 	// MetricRegisteredServersByInstallMethods tracks the number of Teleport servers, and their installation method,
 	// that have successfully registered with the Teleport cluster and have not reached the end of their ttl
 	MetricRegisteredServersByInstallMethods = "registered_servers_by_install_methods"
@@ -277,6 +283,24 @@ const (
 	// MetricTeleportServices tracks which services are currently running in the current Teleport Process.
 	MetricTeleportServices = "services"
 
+	// MetricResourcesHealthStatus tracks resource health status.
+	MetricResourcesHealthStatus = "resources_health_status"
+
+	// MetricHealthy represents a resource in an healthy state.
+	MetricHealthy = "healthy"
+
+	// MetricUnhealthy represents a resource in an unhealthy state.
+	MetricUnhealthy = "unhealthy"
+
+	// MetricUnknown represents a resource in an unknown health state.
+	MetricUnknown = "unknown"
+
+	// MetricResourceDB is a database resource metric.
+	MetricResourceDB = "db"
+
+	// MetricResourceKubernetes is a Kubernetes cluster resource metric.
+	MetricResourceKubernetes = "kubernetes"
+
 	// TagRange is a tag specifying backend requests
 	TagRange = "range"
 
@@ -295,6 +319,10 @@ const (
 	// TagVersion is a prometheus label for version of Teleport built
 	TagVersion = "version"
 
+	// TagOS is a prometheus label for indicating the Operating System
+	// where agent is running (e.g. Darwin, Linux).
+	TagOS = "os"
+
 	// TagGitref is a prometheus label for the gitref of Teleport built
 	TagGitref = "gitref"
 
diff --git a/package.json b/package.json
index f71909d752249..9eccd97fb3c15 100644
--- a/package.json
+++ b/package.json
@@ -22,9 +22,11 @@
     "lint-fix": "pnpm eslint --fix && pnpm prettier-write",
     "eslint": "eslint --quiet '+(e|web)/**/*.{ts,tsx,js,jsx,mts}'",
     "type-check": "NODE_OPTIONS='--max-old-space-size=4096' tsc --build",
+    "optimize-resource-icons": "svgo --multipass --quiet -rf web/packages/design/src/ResourceIcon/assets",
     "prettier-check": "prettier --check '+(e|web)/**/*.{ts,tsx,js,jsx,mts}'",
     "prettier-write": "prettier --write --log-level silent '+(e|web)/**/*.{ts,tsx,js,jsx,mts}'",
-    "process-icons": "node web/packages/design/src/Icon/script/script.js & pnpm prettier --log-level silent --write 'web/packages/design/src/Icon/**/*.tsx'",
+    "process-icons": "pnpm optimize-resource-icons && node web/packages/design/src/Icon/script/script.js && pnpm prettier --log-level silent --write 'web/packages/design/src/Icon/**/*.tsx'",
+    "list-installed-versions": "./web/scripts/list-installed-versions.sh",
     "nop": "exit 0"
   },
   "private": true,
@@ -36,14 +38,8 @@
   "devDependencies": {
     "@gravitational/build": "workspace:*",
     "@ianvs/prettier-plugin-sort-imports": "^4.4.1",
-    "@storybook/addon-actions": "^8.6.12",
-    "@storybook/addon-controls": "^8.6.12",
-    "@storybook/addon-toolbars": "^8.6.12",
-    "@storybook/components": "^8.6.12",
-    "@storybook/preview-api": "^8.6.12",
-    "@storybook/react": "^8.6.12",
-    "@storybook/react-vite": "^8.6.12",
-    "@storybook/test-runner": "^0.22.0",
+    "@storybook/addon-vitest": "^9.0.15",
+    "@storybook/react-vite": "^9.0.17",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
@@ -59,14 +55,15 @@
     "@types/wicg-file-system-access": "^2023.10.6",
     "cspell": "^9.0.1",
     "jest": "^29.7.0",
+    "jest-canvas-mock": "^2.5.2",
     "jsdom-testing-mocks": "^1.13.1",
     "msw": "^2.7.6",
-    "msw-storybook-addon": "^2.0.4",
-    "node-gyp": "^11.2.0",
-    "playwright": "^1.52.0",
-    "prettier": "^3.5.3",
+    "msw-storybook-addon": "^2.0.5",
+    "playwright": "^1.55.1",
+    "prettier": "^3.7.3",
     "react-select-event": "^5.5.1",
-    "storybook": "^8.6.12",
+    "storybook": "^9.1.17",
+    "svgo": "^4.0.0",
     "typescript": "^5.8.3",
     "vite": "^6.3.5"
   },
@@ -80,7 +77,7 @@
     "@nivo/bar": "^0.93.0",
     "@protobuf-ts/runtime": "^2.10.0",
     "@protobuf-ts/runtime-rpc": "^2.10.0",
-    "@tanstack/react-query": "^5.75.4",
+    "@tanstack/react-query": "^5.85.5",
     "@uiw/codemirror-themes": "^4.23.12",
     "@uiw/react-codemirror": "^4.23.12",
     "d3-scale": "^4.0.2",
@@ -93,6 +90,7 @@
     "react": "^19.1.0",
     "react-day-picker": "^9.6.7",
     "react-dom": "^19.1.0",
+    "react-error-boundary": "^6.0.0",
     "react-is": "^19.1.0",
     "react-router": "5.3.4",
     "react-router-dom": "5.3.4",
@@ -101,6 +99,7 @@
     "styled-components": "^6.1.17",
     "tslib": "^2.8.1",
     "use-immer": "^0.11.0",
+    "usehooks-ts": "^3.1.1",
     "whatwg-fetch": "^3.6.20"
   },
   "msw": {
@@ -108,7 +107,7 @@
       "web/.storybook/public"
     ]
   },
-  "packageManager": "pnpm@10.10.0+sha512.d615db246fe70f25dcfea6d8d73dee782ce23e2245e3c4f6f888249fb568149318637dca73c2c5c8ef2a4ca0d5657fb9567188bfab47f566d1ee6ce987815c39",
+  "packageManager": "pnpm@10.24.0+sha512.01ff8ae71b4419903b65c60fb2dc9d34cf8bb6e06d03bde112ef38f7a34d6904c424ba66bea5cdcf12890230bf39f9580473140ed9c946fef328b6e5238a345a",
   "engines": {
     "node": "^22"
   }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fd5fd97d9c3d6..dea7f6034175e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,6 +9,11 @@ overrides:
 
 pnpmfileChecksum: sha256-UhbfH9wqbTOi0Lx+Gm0eQ8EkqLSQxYCWXAFDAbl28uo=
 
+patchedDependencies:
+  jest-canvas-mock@2.5.2:
+    hash: 8329a68f6b8f930f6204c405a071859893962d4a6641b6c2c2bb33122c0441b1
+    path: web/patches/jest-canvas-mock@2.5.2.patch
+
 importers:
 
   .:
@@ -41,8 +46,8 @@ importers:
         specifier: ^2.10.0
         version: 2.10.0
       '@tanstack/react-query':
-        specifier: ^5.75.4
-        version: 5.75.5(react@19.1.0)
+        specifier: ^5.85.5
+        version: 5.85.5(react@19.1.0)
       '@uiw/codemirror-themes':
         specifier: ^4.23.12
         version: 4.23.12(@codemirror/view@6.36.7)
@@ -79,6 +84,9 @@ importers:
       react-dom:
         specifier: ^19.1.0
         version: 19.1.0(react@19.1.0)
+      react-error-boundary:
+        specifier: ^6.0.0
+        version: 6.0.0(react@19.1.0)
       react-is:
         specifier: ^19.1.0
         version: 19.1.0
@@ -103,6 +111,9 @@ importers:
       use-immer:
         specifier: ^0.11.0
         version: 0.11.0(immer@10.1.1)(react@19.1.0)
+      usehooks-ts:
+        specifier: ^3.1.1
+        version: 3.1.1(react@19.1.0)
       whatwg-fetch:
         specifier: ^3.6.20
         version: 3.6.20
@@ -112,31 +123,13 @@ importers:
         version: link:web/packages/build
       '@ianvs/prettier-plugin-sort-imports':
         specifier: ^4.4.1
-        version: 4.4.1(prettier@3.5.3)
-      '@storybook/addon-actions':
-        specifier: ^8.6.12
-        version: 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/addon-controls':
-        specifier: ^8.6.12
-        version: 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/addon-toolbars':
-        specifier: ^8.6.12
-        version: 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/components':
-        specifier: ^8.6.12
-        version: 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/preview-api':
-        specifier: ^8.6.12
-        version: 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/react':
-        specifier: ^8.6.12
-        version: 8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@8.6.12(prettier@3.5.3))(typescript@5.8.3)
+        version: 4.4.1(prettier@3.7.3)
+      '@storybook/addon-vitest':
+        specifier: ^9.0.15
+        version: 9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))
       '@storybook/react-vite':
-        specifier: ^8.6.12
-        version: 8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(rollup@4.40.2)(storybook@8.6.12(prettier@3.5.3))(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
-      '@storybook/test-runner':
-        specifier: ^0.22.0
-        version: 0.22.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)(storybook@8.6.12(prettier@3.5.3))
+        specifier: ^9.0.17
+        version: 9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(rollup@4.40.2)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       '@testing-library/jest-dom':
         specifier: ^6.6.3
         version: 6.6.3
@@ -182,6 +175,9 @@ importers:
       jest:
         specifier: ^29.7.0
         version: 29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)
+      jest-canvas-mock:
+        specifier: ^2.5.2
+        version: 2.5.2(patch_hash=8329a68f6b8f930f6204c405a071859893962d4a6641b6c2c2bb33122c0441b1)
       jsdom-testing-mocks:
         specifier: ^1.13.1
         version: 1.13.1
@@ -189,23 +185,23 @@ importers:
         specifier: ^2.7.6
         version: 2.7.6(@types/node@22.15.16)(typescript@5.8.3)
       msw-storybook-addon:
-        specifier: ^2.0.4
-        version: 2.0.4(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))
-      node-gyp:
-        specifier: ^11.2.0
-        version: 11.2.0
+        specifier: ^2.0.5
+        version: 2.0.5(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))
       playwright:
-        specifier: ^1.52.0
-        version: 1.52.0
+        specifier: ^1.55.1
+        version: 1.56.1
       prettier:
-        specifier: ^3.5.3
-        version: 3.5.3
+        specifier: ^3.7.3
+        version: 3.7.3
       react-select-event:
         specifier: ^5.5.1
         version: 5.5.1
       storybook:
-        specifier: ^8.6.12
-        version: 8.6.12(prettier@3.5.3)
+        specifier: ^9.1.17
+        version: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+      svgo:
+        specifier: ^4.0.0
+        version: 4.0.0
       typescript:
         specifier: ^5.8.3
         version: 5.8.3
@@ -262,6 +258,9 @@ importers:
       eslint-plugin-react-hooks:
         specifier: ^5.2.0
         version: 5.2.0(eslint@9.26.0)
+      eslint-plugin-storybook:
+        specifier: ^9.0.17
+        version: 9.0.17(eslint@9.26.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3)
       eslint-plugin-testing-library:
         specifier: ^7.1.1
         version: 7.1.1(eslint@9.26.0)(typescript@5.8.3)
@@ -286,6 +285,9 @@ importers:
       typescript-eslint:
         specifier: ^8.32.0
         version: 8.32.0(eslint@9.26.0)(typescript@5.8.3)
+      vite-plugin-compression:
+        specifier: ^0.5.1
+        version: 0.5.1(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       vite-plugin-wasm:
         specifier: ^3.4.1
         version: 3.4.1(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
@@ -332,6 +334,13 @@ importers:
       highlight-words-core:
         specifier: ^1.2.3
         version: 1.2.3
+      semver:
+        specifier: ^7.7.2
+        version: 7.7.2
+    devDependencies:
+      '@types/semver':
+        specifier: ^7.7.0
+        version: 7.7.0
 
   web/packages/teleport:
     dependencies:
@@ -407,9 +416,6 @@ importers:
       events:
         specifier: 3.3.0
         version: 3.3.0
-      react-markdown:
-        specifier: ^10.1.0
-        version: 10.1.0(@types/react@19.1.2)(react@19.1.0)
     devDependencies:
       '@gravitational/build':
         specifier: workspace:*
@@ -419,13 +425,10 @@ importers:
         version: 'link:'
       babel-plugin-transform-import-meta:
         specifier: 2.2.1
-        version: 2.2.1(@babel/core@7.27.1)
+        version: 2.2.1(@babel/core@7.28.3)
       babel-plugin-transform-vite-meta-env:
         specifier: ^1.0.3
         version: 1.0.3
-      jest-canvas-mock:
-        specifier: ^2.5.2
-        version: 2.5.2
       jest-websocket-mock:
         specifier: ^2.5.0
         version: 2.5.0
@@ -439,8 +442,8 @@ importers:
         specifier: ^3.0.4
         version: 3.0.4
       node-forge:
-        specifier: ^1.3.1
-        version: 1.3.1
+        specifier: ^1.3.2
+        version: 1.3.2
       node-pty:
         specifier: 1.1.0-beta34
         version: 1.1.0-beta34
@@ -454,8 +457,8 @@ importers:
         specifier: ^7.1.0
         version: 7.1.0
       tar-fs:
-        specifier: ^3.0.8
-        version: 3.0.8
+        specifier: ^3.1.1
+        version: 3.1.1
       which:
         specifier: ^5.0.0
         version: 5.0.0
@@ -463,9 +466,6 @@ importers:
         specifier: ^3.17.0
         version: 3.17.0
     devDependencies:
-      '@electron/notarize':
-        specifier: ^3.0.1
-        version: 3.0.1
       '@gravitational/build':
         specifier: workspace:*
         version: link:../build
@@ -494,20 +494,20 @@ importers:
         specifier: ^5.5.0
         version: 5.5.0
       electron:
-        specifier: 36.1.0
-        version: 36.1.0
+        specifier: 37.6.0
+        version: 37.6.0
       electron-builder:
         specifier: ^26.0.12
         version: 26.0.12
+      electron-updater:
+        specifier: ^6.6.8
+        version: 6.6.8
       electron-vite:
-        specifier: ^3.1.0
-        version: 3.1.0(@swc/core@1.11.24)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+        specifier: ^4.0.0
+        version: 4.0.0(@swc/core@1.11.24)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       events:
         specifier: 3.3.0
         version: 3.3.0
-      jest-canvas-mock:
-        specifier: ^2.5.2
-        version: 2.5.2
       react-dnd:
         specifier: ^14.0.4
         version: 14.0.5(@types/node@22.15.16)(@types/react@19.1.2)(react@19.1.0)
@@ -518,11 +518,8 @@ importers:
         specifier: ^14.2.0
         version: 14.2.0
       zod:
-        specifier: ^3.24.4
-        version: 3.24.4
-      zod-to-json-schema:
-        specifier: ^3.24.5
-        version: 3.24.5(zod@3.24.4)
+        specifier: ^4.1.5
+        version: 4.1.5
 
 packages:
 
@@ -551,10 +548,18 @@ packages:
     resolution: {integrity: sha512-IaaGWsQqfsQWVLqMn9OB92MNN7zukfVA4s7KKAI0KfrrDsZ0yhi5uV4baBuLuN7n3vsZpwP8asPPcVwApxvjBQ==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/core@7.28.3':
+    resolution: {integrity: sha512-yDBHV9kQNcr2/sUr9jghVyz9C3Y5G2zUM2H2lo+9mKv4sFgbA8s8Z9t8D1jiTkGoO/NoIfKMyKWr4s6CN23ZwQ==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/generator@7.27.1':
     resolution: {integrity: sha512-UnJfnIpc/+JO0/+KRVQNGU+y5taA5vCbwN8+azkX6beii/ZF+enZJSOKo11ZSzGJjlNfJHfQtmQT8H+9TXPG2w==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/generator@7.28.3':
+    resolution: {integrity: sha512-3lSpxGgvnmZznmBkCRnVREPUFJv2wrv9iAoFDvADJc0ypmdOxdUtcLeBgBJ6zE0PMeTKnxeQzyk0xTBq4Ep7zw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-annotate-as-pure@7.27.1':
     resolution: {integrity: sha512-WnuuDILl9oOBbKnb4L+DyODx7iC47XfzmNCpTttFsSp6hTG7XZxu60+4IO+2/hPfcGOoKbFiwoI/+zwARbNQow==}
     engines: {node: '>=6.9.0'}
@@ -580,6 +585,10 @@ packages:
     peerDependencies:
       '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
 
+  '@babel/helper-globals@7.28.0':
+    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-member-expression-to-functions@7.27.1':
     resolution: {integrity: sha512-E5chM8eWjTp/aNoVpcbfM7mLxu9XGLWYise2eBKGQomAk/Mb4XoxyqXTZbuTohbsl8EKqdlMhnDI2CCLfcs9wA==}
     engines: {node: '>=6.9.0'}
@@ -594,6 +603,12 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0
 
+  '@babel/helper-module-transforms@7.28.3':
+    resolution: {integrity: sha512-gytXUbs8k2sXS9PnQptz5o0QnpLL51SwASIORY6XaBKF88nsOT0Zw9szLqlSGQDP/4TljBAD5y98p2U1fqkdsw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
   '@babel/helper-optimise-call-expression@7.27.1':
     resolution: {integrity: sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw==}
     engines: {node: '>=6.9.0'}
@@ -638,11 +653,20 @@ packages:
     resolution: {integrity: sha512-FCvFTm0sWV8Fxhpp2McP5/W53GPllQ9QeQ7SiqGWjMf/LVG07lFa5+pgK05IRhVwtvafT22KF+ZSnM9I545CvQ==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helpers@7.28.3':
+    resolution: {integrity: sha512-PTNtvUQihsAsDHMOP5pfobP8C6CM4JWXmP8DrEIt46c3r2bf87Ua1zoqevsMo9g+tWDwgWrFP5EIxuBx5RudAw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/parser@7.27.1':
     resolution: {integrity: sha512-I0dZ3ZpCrJ1c04OqlNsQcKiZlsrXf/kkE4FXzID9rIOYICsAbA8mMDzhW/luRNAHdCNt7os/u8wenklZDlUVUQ==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  '@babel/parser@7.28.3':
+    resolution: {integrity: sha512-7+Ey1mAgYqFAx2h0RuoxcQT5+MlG3GTV0TQrgr7/ZliKsm/MNDxVVutlWaziMq7wJNAz8MTqz55XLpWvva6StA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.27.1':
     resolution: {integrity: sha512-QPG3C9cCVRQLxAVwmefEmwdTanECuUBMQZ/ym5kiw3XKCGA7qkuQLcjWWHcrD/GKbn/WmJwaezfuuAOcyKlRPA==}
     engines: {node: '>=6.9.0'}
@@ -1143,14 +1167,26 @@ packages:
     resolution: {integrity: sha512-Fyo3ghWMqkHHpHQCoBs2VnYjR4iWFFjguTDEqA5WgZDOrFesVjMhMM2FSqTKSoUSDO1VQtavj8NFpdRBEvJTtg==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/template@7.27.2':
+    resolution: {integrity: sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/traverse@7.27.1':
     resolution: {integrity: sha512-ZCYtZciz1IWJB4U61UPu4KEaqyfj+r5T1Q5mqPo+IBpcG9kHv30Z0aD8LXPgC1trYa6rK0orRyAhqUgk4MjmEg==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/traverse@7.28.3':
+    resolution: {integrity: sha512-7w4kZYHneL3A6NP2nxzHvT3HCZ7puDZZjFMqDpBPECub79sTtSO5CGXDkKrTQq8ksAwfD/XI2MRFX23njdDaIQ==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/types@7.27.1':
     resolution: {integrity: sha512-+EzkxvLNfiUeKMgy/3luqfsCWFRXLb7U6wNQTk60tovuckwB15B191tJWvpp4HjiQWdJkCxO3Wbvc6jlk3Xb2Q==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/types@7.28.2':
+    resolution: {integrity: sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ==}
+    engines: {node: '>=6.9.0'}
+
   '@bcoe/v8-coverage@0.2.3':
     resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
 
@@ -1474,10 +1510,6 @@ packages:
     resolution: {integrity: sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==}
     engines: {node: '>= 10.0.0'}
 
-  '@electron/notarize@3.0.1':
-    resolution: {integrity: sha512-5xzcOwvMGNjkSk7s0sPx4XcKWei9FYk4f2S5NkSorWW0ce5yktTOtlPa0W5yQHcREILh+C3JdH+t+M637g9TmQ==}
-    engines: {node: '>= 22.12.0'}
-
   '@electron/osx-sign@1.3.1':
     resolution: {integrity: sha512-BAfviURMHpmb1Yb50YbCxnOY0wfwaLXH5KJ4+80zS0gUkzDX3ec23naTlEqKsN+PwYn+a1cCzM7BJ4Wcd3sGzw==}
     engines: {node: '>=12.0.0'}
@@ -1551,150 +1583,306 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
+  '@esbuild/aix-ppc64@0.25.9':
+    resolution: {integrity: sha512-OaGtL73Jck6pBKjNIe24BnFE6agGl+6KxDtTfHhy1HmhthfKouEcOhqpSL64K4/0WCtbKFLOdzD/44cJ4k9opA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
   '@esbuild/android-arm64@0.25.4':
     resolution: {integrity: sha512-bBy69pgfhMGtCnwpC/x5QhfxAz/cBgQ9enbtwjf6V9lnPI/hMyT9iWpR1arm0l3kttTr4L0KSLpKmLp/ilKS9A==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
+  '@esbuild/android-arm64@0.25.9':
+    resolution: {integrity: sha512-IDrddSmpSv51ftWslJMvl3Q2ZT98fUSL2/rlUXuVqRXHCs5EUF1/f+jbjF5+NG9UffUDMCiTyh8iec7u8RlTLg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
   '@esbuild/android-arm@0.25.4':
     resolution: {integrity: sha512-QNdQEps7DfFwE3hXiU4BZeOV68HHzYwGd0Nthhd3uCkkEKK7/R6MTgM0P7H7FAs5pU/DIWsviMmEGxEoxIZ+ZQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
+  '@esbuild/android-arm@0.25.9':
+    resolution: {integrity: sha512-5WNI1DaMtxQ7t7B6xa572XMXpHAaI/9Hnhk8lcxF4zVN4xstUgTlvuGDorBguKEnZO70qwEcLpfifMLoxiPqHQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
   '@esbuild/android-x64@0.25.4':
     resolution: {integrity: sha512-TVhdVtQIFuVpIIR282btcGC2oGQoSfZfmBdTip2anCaVYcqWlZXGcdcKIUklfX2wj0JklNYgz39OBqh2cqXvcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
+  '@esbuild/android-x64@0.25.9':
+    resolution: {integrity: sha512-I853iMZ1hWZdNllhVZKm34f4wErd4lMyeV7BLzEExGEIZYsOzqDWDf+y082izYUE8gtJnYHdeDpN/6tUdwvfiw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
   '@esbuild/darwin-arm64@0.25.4':
     resolution: {integrity: sha512-Y1giCfM4nlHDWEfSckMzeWNdQS31BQGs9/rouw6Ub91tkK79aIMTH3q9xHvzH8d0wDru5Ci0kWB8b3up/nl16g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
+  '@esbuild/darwin-arm64@0.25.9':
+    resolution: {integrity: sha512-XIpIDMAjOELi/9PB30vEbVMs3GV1v2zkkPnuyRRURbhqjyzIINwj+nbQATh4H9GxUgH1kFsEyQMxwiLFKUS6Rg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@esbuild/darwin-x64@0.25.4':
     resolution: {integrity: sha512-CJsry8ZGM5VFVeyUYB3cdKpd/H69PYez4eJh1W/t38vzutdjEjtP7hB6eLKBoOdxcAlCtEYHzQ/PJ/oU9I4u0A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
+  '@esbuild/darwin-x64@0.25.9':
+    resolution: {integrity: sha512-jhHfBzjYTA1IQu8VyrjCX4ApJDnH+ez+IYVEoJHeqJm9VhG9Dh2BYaJritkYK3vMaXrf7Ogr/0MQ8/MeIefsPQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
   '@esbuild/freebsd-arm64@0.25.4':
     resolution: {integrity: sha512-yYq+39NlTRzU2XmoPW4l5Ifpl9fqSk0nAJYM/V/WUGPEFfek1epLHJIkTQM6bBs1swApjO5nWgvr843g6TjxuQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
+  '@esbuild/freebsd-arm64@0.25.9':
+    resolution: {integrity: sha512-z93DmbnY6fX9+KdD4Ue/H6sYs+bhFQJNCPZsi4XWJoYblUqT06MQUdBCpcSfuiN72AbqeBFu5LVQTjfXDE2A6Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@esbuild/freebsd-x64@0.25.4':
     resolution: {integrity: sha512-0FgvOJ6UUMflsHSPLzdfDnnBBVoCDtBTVyn/MrWloUNvq/5SFmh13l3dvgRPkDihRxb77Y17MbqbCAa2strMQQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
+  '@esbuild/freebsd-x64@0.25.9':
+    resolution: {integrity: sha512-mrKX6H/vOyo5v71YfXWJxLVxgy1kyt1MQaD8wZJgJfG4gq4DpQGpgTB74e5yBeQdyMTbgxp0YtNj7NuHN0PoZg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
   '@esbuild/linux-arm64@0.25.4':
     resolution: {integrity: sha512-+89UsQTfXdmjIvZS6nUnOOLoXnkUTB9hR5QAeLrQdzOSWZvNSAXAtcRDHWtqAUtAmv7ZM1WPOOeSxDzzzMogiQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
+  '@esbuild/linux-arm64@0.25.9':
+    resolution: {integrity: sha512-BlB7bIcLT3G26urh5Dmse7fiLmLXnRlopw4s8DalgZ8ef79Jj4aUcYbk90g8iCa2467HX8SAIidbL7gsqXHdRw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
   '@esbuild/linux-arm@0.25.4':
     resolution: {integrity: sha512-kro4c0P85GMfFYqW4TWOpvmF8rFShbWGnrLqlzp4X1TNWjRY3JMYUfDCtOxPKOIY8B0WC8HN51hGP4I4hz4AaQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
+  '@esbuild/linux-arm@0.25.9':
+    resolution: {integrity: sha512-HBU2Xv78SMgaydBmdor38lg8YDnFKSARg1Q6AT0/y2ezUAKiZvc211RDFHlEZRFNRVhcMamiToo7bDx3VEOYQw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
   '@esbuild/linux-ia32@0.25.4':
     resolution: {integrity: sha512-yTEjoapy8UP3rv8dB0ip3AfMpRbyhSN3+hY8mo/i4QXFeDxmiYbEKp3ZRjBKcOP862Ua4b1PDfwlvbuwY7hIGQ==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
+  '@esbuild/linux-ia32@0.25.9':
+    resolution: {integrity: sha512-e7S3MOJPZGp2QW6AK6+Ly81rC7oOSerQ+P8L0ta4FhVi+/j/v2yZzx5CqqDaWjtPFfYz21Vi1S0auHrap3Ma3A==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
   '@esbuild/linux-loong64@0.25.4':
     resolution: {integrity: sha512-NeqqYkrcGzFwi6CGRGNMOjWGGSYOpqwCjS9fvaUlX5s3zwOtn1qwg1s2iE2svBe4Q/YOG1q6875lcAoQK/F4VA==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
+  '@esbuild/linux-loong64@0.25.9':
+    resolution: {integrity: sha512-Sbe10Bnn0oUAB2AalYztvGcK+o6YFFA/9829PhOCUS9vkJElXGdphz0A3DbMdP8gmKkqPmPcMJmJOrI3VYB1JQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
   '@esbuild/linux-mips64el@0.25.4':
     resolution: {integrity: sha512-IcvTlF9dtLrfL/M8WgNI/qJYBENP3ekgsHbYUIzEzq5XJzzVEV/fXY9WFPfEEXmu3ck2qJP8LG/p3Q8f7Zc2Xg==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
+  '@esbuild/linux-mips64el@0.25.9':
+    resolution: {integrity: sha512-YcM5br0mVyZw2jcQeLIkhWtKPeVfAerES5PvOzaDxVtIyZ2NUBZKNLjC5z3/fUlDgT6w89VsxP2qzNipOaaDyA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
   '@esbuild/linux-ppc64@0.25.4':
     resolution: {integrity: sha512-HOy0aLTJTVtoTeGZh4HSXaO6M95qu4k5lJcH4gxv56iaycfz1S8GO/5Jh6X4Y1YiI0h7cRyLi+HixMR+88swag==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
+  '@esbuild/linux-ppc64@0.25.9':
+    resolution: {integrity: sha512-++0HQvasdo20JytyDpFvQtNrEsAgNG2CY1CLMwGXfFTKGBGQT3bOeLSYE2l1fYdvML5KUuwn9Z8L1EWe2tzs1w==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
   '@esbuild/linux-riscv64@0.25.4':
     resolution: {integrity: sha512-i8JUDAufpz9jOzo4yIShCTcXzS07vEgWzyX3NH2G7LEFVgrLEhjwL3ajFE4fZI3I4ZgiM7JH3GQ7ReObROvSUA==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
+  '@esbuild/linux-riscv64@0.25.9':
+    resolution: {integrity: sha512-uNIBa279Y3fkjV+2cUjx36xkx7eSjb8IvnL01eXUKXez/CBHNRw5ekCGMPM0BcmqBxBcdgUWuUXmVWwm4CH9kg==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
   '@esbuild/linux-s390x@0.25.4':
     resolution: {integrity: sha512-jFnu+6UbLlzIjPQpWCNh5QtrcNfMLjgIavnwPQAfoGx4q17ocOU9MsQ2QVvFxwQoWpZT8DvTLooTvmOQXkO51g==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
+  '@esbuild/linux-s390x@0.25.9':
+    resolution: {integrity: sha512-Mfiphvp3MjC/lctb+7D287Xw1DGzqJPb/J2aHHcHxflUo+8tmN/6d4k6I2yFR7BVo5/g7x2Monq4+Yew0EHRIA==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
   '@esbuild/linux-x64@0.25.4':
     resolution: {integrity: sha512-6e0cvXwzOnVWJHq+mskP8DNSrKBr1bULBvnFLpc1KY+d+irZSgZ02TGse5FsafKS5jg2e4pbvK6TPXaF/A6+CA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
+  '@esbuild/linux-x64@0.25.9':
+    resolution: {integrity: sha512-iSwByxzRe48YVkmpbgoxVzn76BXjlYFXC7NvLYq+b+kDjyyk30J0JY47DIn8z1MO3K0oSl9fZoRmZPQI4Hklzg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
   '@esbuild/netbsd-arm64@0.25.4':
     resolution: {integrity: sha512-vUnkBYxZW4hL/ie91hSqaSNjulOnYXE1VSLusnvHg2u3jewJBz3YzB9+oCw8DABeVqZGg94t9tyZFoHma8gWZQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
+  '@esbuild/netbsd-arm64@0.25.9':
+    resolution: {integrity: sha512-9jNJl6FqaUG+COdQMjSCGW4QiMHH88xWbvZ+kRVblZsWrkXlABuGdFJ1E9L7HK+T0Yqd4akKNa/lO0+jDxQD4Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
   '@esbuild/netbsd-x64@0.25.4':
     resolution: {integrity: sha512-XAg8pIQn5CzhOB8odIcAm42QsOfa98SBeKUdo4xa8OvX8LbMZqEtgeWE9P/Wxt7MlG2QqvjGths+nq48TrUiKw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
+  '@esbuild/netbsd-x64@0.25.9':
+    resolution: {integrity: sha512-RLLdkflmqRG8KanPGOU7Rpg829ZHu8nFy5Pqdi9U01VYtG9Y0zOG6Vr2z4/S+/3zIyOxiK6cCeYNWOFR9QP87g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
   '@esbuild/openbsd-arm64@0.25.4':
     resolution: {integrity: sha512-Ct2WcFEANlFDtp1nVAXSNBPDxyU+j7+tId//iHXU2f/lN5AmO4zLyhDcpR5Cz1r08mVxzt3Jpyt4PmXQ1O6+7A==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
+  '@esbuild/openbsd-arm64@0.25.9':
+    resolution: {integrity: sha512-YaFBlPGeDasft5IIM+CQAhJAqS3St3nJzDEgsgFixcfZeyGPCd6eJBWzke5piZuZ7CtL656eOSYKk4Ls2C0FRQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
   '@esbuild/openbsd-x64@0.25.4':
     resolution: {integrity: sha512-xAGGhyOQ9Otm1Xu8NT1ifGLnA6M3sJxZ6ixylb+vIUVzvvd6GOALpwQrYrtlPouMqd/vSbgehz6HaVk4+7Afhw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
+  '@esbuild/openbsd-x64@0.25.9':
+    resolution: {integrity: sha512-1MkgTCuvMGWuqVtAvkpkXFmtL8XhWy+j4jaSO2wxfJtilVCi0ZE37b8uOdMItIHz4I6z1bWWtEX4CJwcKYLcuA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.9':
+    resolution: {integrity: sha512-4Xd0xNiMVXKh6Fa7HEJQbrpP3m3DDn43jKxMjxLLRjWnRsfxjORYJlXPO4JNcXtOyfajXorRKY9NkOpTHptErg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@esbuild/sunos-x64@0.25.4':
     resolution: {integrity: sha512-Mw+tzy4pp6wZEK0+Lwr76pWLjrtjmJyUB23tHKqEDP74R3q95luY/bXqXZeYl4NYlvwOqoRKlInQialgCKy67Q==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
+  '@esbuild/sunos-x64@0.25.9':
+    resolution: {integrity: sha512-WjH4s6hzo00nNezhp3wFIAfmGZ8U7KtrJNlFMRKxiI9mxEK1scOMAaa9i4crUtu+tBr+0IN6JCuAcSBJZfnphw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
   '@esbuild/win32-arm64@0.25.4':
     resolution: {integrity: sha512-AVUP428VQTSddguz9dO9ngb+E5aScyg7nOeJDrF1HPYu555gmza3bDGMPhmVXL8svDSoqPCsCPjb265yG/kLKQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
+  '@esbuild/win32-arm64@0.25.9':
+    resolution: {integrity: sha512-mGFrVJHmZiRqmP8xFOc6b84/7xa5y5YvR1x8djzXpJBSv/UsNK6aqec+6JDjConTgvvQefdGhFDAs2DLAds6gQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
   '@esbuild/win32-ia32@0.25.4':
     resolution: {integrity: sha512-i1sW+1i+oWvQzSgfRcxxG2k4I9n3O9NRqy8U+uugaT2Dy7kLO9Y7wI72haOahxceMX8hZAzgGou1FhndRldxRg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
+  '@esbuild/win32-ia32@0.25.9':
+    resolution: {integrity: sha512-b33gLVU2k11nVx1OhX3C8QQP6UHQK4ZtN56oFWvVXvz2VkDoe6fbG8TOgHFxEvqeqohmRnIHe5A1+HADk4OQww==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
   '@esbuild/win32-x64@0.25.4':
     resolution: {integrity: sha512-nOT2vZNw6hJ+z43oP1SPea/G/6AbN6X+bGNhNuq8NtRHy4wsMhw765IKLNmnjek7GvjWBYQ8Q5VBoYTFg9y1UQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
 
+  '@esbuild/win32-x64@0.25.9':
+    resolution: {integrity: sha512-PPOl1mi6lpLNQxnGoyAfschAodRFYXJ+9fs6WHXz7CSWKbOqiMZsubC+BQsVKuul+3vKLuwTHsS2c2y9EoKwxQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
   '@eslint-community/eslint-utils@4.7.0':
     resolution: {integrity: sha512-dyybb3AcajC7uha6CvhdVRJqaKyn7w2YKqKyAN37NKYgZT36w+iRb0Dymmc5qEJ549c/S31cMMSFd75bteCpCw==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@@ -1739,8 +1927,8 @@ packages:
   '@floating-ui/dom@1.7.0':
     resolution: {integrity: sha512-lGTor4VlXcesUMh1cupTUTDoCxMb0V6bm3CnxHzQcw8Eaf1jQbgQX4i02fYgT0vJ82tb5MZ4CZk1LRGkktJCzg==}
 
-  '@floating-ui/react-dom@2.1.2':
-    resolution: {integrity: sha512-06okr5cgPzMNBy+Ycse2A6udMi4bqwW/zgBF/rwjcNqWkyr82Mcg8b0vjX8OJpZFy/FKjJmw6wV7t44kK6kW7A==}
+  '@floating-ui/react-dom@2.1.3':
+    resolution: {integrity: sha512-huMBfiU9UnQ2oBwIhgzyIiSpVgvlDstU8CX0AF+wS+KzmYMs0J2a3GwuFHV1Lz+jlrQGeC1fF+Nv0QoumyV0bA==}
     peerDependencies:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
@@ -1766,12 +1954,6 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
-  '@hapi/hoek@9.3.0':
-    resolution: {integrity: sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==}
-
-  '@hapi/topo@5.1.0':
-    resolution: {integrity: sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==}
-
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
     engines: {node: '>=18.18.0'}
@@ -1836,10 +2018,6 @@ packages:
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
 
-  '@isaacs/fs-minipass@4.0.1':
-    resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
-    engines: {node: '>=18.0.0'}
-
   '@istanbuljs/load-nyc-config@1.1.0':
     resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
     engines: {node: '>=8'}
@@ -1861,10 +2039,6 @@ packages:
       node-notifier:
         optional: true
 
-  '@jest/create-cache-key-function@29.7.0':
-    resolution: {integrity: sha512-4QqS3LY5PBmTRHj9sAg1HLoPzqAI0uOX6wI/TRqHIcOxlFidy6YEmCQJk6FSZjNLGCeubDMfmkWL+qaLKhSGQA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
   '@jest/environment@29.7.0':
     resolution: {integrity: sha512-aQIfHDq33ExsN4jP1NWGXhxgQ/wixs60gDiKO+XVMd8Mn0NWPWgc34ZQDTb2jKaUWQ7MuwoitXAsN2XVXNMpAw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -1918,15 +2092,18 @@ packages:
     resolution: {integrity: sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.5.0':
-    resolution: {integrity: sha512-qYDdL7fPwLRI+bJNurVcis+tNgJmvWjH4YTBGXTA8xMuxFrnAz6E5o35iyzyKbq5J5Lr8mJGfrR5GXl+WGwhgQ==}
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1':
+    resolution: {integrity: sha512-J4BaTocTOYFkMHIra1JDWrMWpNmBl4EkplIwHEsV8aeUOtdWjwSnln9U7twjMFTAEB7mptNtSKyVi1Y2W9sDJw==}
     peerDependencies:
       typescript: '>= 4.3.x'
-      vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0
+      vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       typescript:
         optional: true
 
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
   '@jridgewell/gen-mapping@0.3.8':
     resolution: {integrity: sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA==}
     engines: {node: '>=6.0.0'}
@@ -1945,6 +2122,9 @@ packages:
   '@jridgewell/trace-mapping@0.3.25':
     resolution: {integrity: sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==}
 
+  '@jridgewell/trace-mapping@0.3.30':
+    resolution: {integrity: sha512-GQ7Nw5G2lTu/BtHTKfXhKHok2WGetd4XYcVKGx00SjAk8GMwgJM3zr6zORiPGuOE+/vkc90KtTosSSvaCjKb2Q==}
+
   '@js-sdsl/ordered-map@4.4.2':
     resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==}
 
@@ -2039,18 +2219,10 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@npmcli/agent@3.0.0':
-    resolution: {integrity: sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   '@npmcli/fs@2.1.2':
     resolution: {integrity: sha512-yOJKRvohFOaLqipNtwYB9WugyZKhC/DZC4VYPmpaCzDBrA8YpK3qHZ8/HGscMnE4GqbkLNuVcCnxkeQEdGt6LQ==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  '@npmcli/fs@4.0.0':
-    resolution: {integrity: sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   '@npmcli/move-file@2.0.1':
     resolution: {integrity: sha512-mJd2Z5TjYWq/ttPLLGqArdtnC74J6bOzg4rMDnN+p1xTacZ2yPRCk2y0oSWQtygLR9YVQXgOcONrwtnk3JupxQ==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
@@ -2341,56 +2513,67 @@ packages:
     resolution: {integrity: sha512-de6TFZYIvJwRNjmW3+gaXiZ2DaWL5D5yGmSYzkdzjBDS3W+B9JQ48oZEsmMvemqjtAFzE16DIBLqd6IQQRuG9Q==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm-musleabihf@4.40.2':
     resolution: {integrity: sha512-urjaEZubdIkacKc930hUDOfQPysezKla/O9qV+O89enqsqUmQm8Xj8O/vh0gHg4LYfv7Y7UsE3QjzLQzDYN1qg==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-arm64-gnu@4.40.2':
     resolution: {integrity: sha512-KlE8IC0HFOC33taNt1zR8qNlBYHj31qGT1UqWqtvR/+NuCVhfufAq9fxO8BMFC22Wu0rxOwGVWxtCMvZVLmhQg==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.40.2':
     resolution: {integrity: sha512-j8CgxvfM0kbnhu4XgjnCWJQyyBOeBI1Zq91Z850aUddUmPeQvuAy6OiMdPS46gNFgy8gN1xkYyLgwLYZG3rBOg==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-loongarch64-gnu@4.40.2':
     resolution: {integrity: sha512-Ybc/1qUampKuRF4tQXc7G7QY9YRyeVSykfK36Y5Qc5dmrIxwFhrOzqaVTNoZygqZ1ZieSWTibfFhQ5qK8jpWxw==}
     cpu: [loong64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-powerpc64le-gnu@4.40.2':
     resolution: {integrity: sha512-3FCIrnrt03CCsZqSYAOW/k9n625pjpuMzVfeI+ZBUSDT3MVIFDSPfSUgIl9FqUftxcUXInvFah79hE1c9abD+Q==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-gnu@4.40.2':
     resolution: {integrity: sha512-QNU7BFHEvHMp2ESSY3SozIkBPaPBDTsfVNGx3Xhv+TdvWXFGOSH2NJvhD1zKAT6AyuuErJgbdvaJhYVhVqrWTg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-musl@4.40.2':
     resolution: {integrity: sha512-5W6vNYkhgfh7URiXTO1E9a0cy4fSgfE4+Hl5agb/U1sa0kjOLMLC1wObxwKxecE17j0URxuTrYZZME4/VH57Hg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-s390x-gnu@4.40.2':
     resolution: {integrity: sha512-B7LKIz+0+p348JoAL4X/YxGx9zOx3sR+o6Hj15Y3aaApNfAshK8+mWZEf759DXfRLeL2vg5LYJBB7DdcleYCoQ==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.40.2':
     resolution: {integrity: sha512-lG7Xa+BmBNwpjmVUbmyKxdQJ3Q6whHjMjzQplOs5Z+Gj7mxPtWakGHqzMqNER68G67kmCX9qX57aRsW5V0VOng==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.40.2':
     resolution: {integrity: sha512-tD46wKHd+KJvsmije4bUskNuvWKFcTOIM9tZ/RrmIvcXnbi0YK/cKS9FzFtAm7Oxi2EhV5N2OpfFB348vSQRXA==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-win32-arm64-msvc@4.40.2':
     resolution: {integrity: sha512-Bjv/HG8RRWLNkXwQQemdsWw4Mg+IJ29LK+bJPW2SCzPKOUaMmPEppQlu/Fqk1d7+DX3V7JbFdbkh/NMmurT6Pg==}
@@ -2407,15 +2590,6 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@sideway/address@4.1.5':
-    resolution: {integrity: sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==}
-
-  '@sideway/formula@3.0.1':
-    resolution: {integrity: sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==}
-
-  '@sideway/pinpoint@2.0.0':
-    resolution: {integrity: sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==}
-
   '@sinclair/typebox@0.27.8':
     resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==}
 
@@ -2429,108 +2603,70 @@ packages:
   '@sinonjs/fake-timers@10.3.0':
     resolution: {integrity: sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==}
 
-  '@storybook/addon-actions@8.6.12':
-    resolution: {integrity: sha512-B5kfiRvi35oJ0NIo53CGH66H471A3XTzrfaa6SxXEJsgxxSeKScG5YeXcCvLiZfvANRQ7QDsmzPUgg0o3hdMXw==}
-    peerDependencies:
-      storybook: ^8.6.12
-
-  '@storybook/addon-controls@8.6.12':
-    resolution: {integrity: sha512-9VSRPJWQVb9wLp21uvpxDGNctYptyUX0gbvxIWOHMH3R2DslSoq41lsC/oQ4l4zSHVdL+nq8sCTkhBxIsjKqdQ==}
-    peerDependencies:
-      storybook: ^8.6.12
-
-  '@storybook/addon-toolbars@8.6.12':
-    resolution: {integrity: sha512-HEcSzo1DyFtIu5/ikVOmh5h85C1IvK9iFKSzBR6ice33zBOaehVJK+Z5f487MOXxPsZ63uvWUytwPyViGInj+g==}
-    peerDependencies:
-      storybook: ^8.6.12
-
-  '@storybook/builder-vite@8.6.12':
-    resolution: {integrity: sha512-Gju21ud/3Qw4v2vLNaa5SuJECsI9ICNRr2G0UyCCzRvCHg8jpA9lDReu2NqhLDyFIuDG+ZYT38gcaHEUoNQ8KQ==}
-    peerDependencies:
-      storybook: ^8.6.12
-      vite: ^4.0.0 || ^5.0.0 || ^6.0.0
-
-  '@storybook/components@8.6.12':
-    resolution: {integrity: sha512-FiaE8xvCdvKC2arYusgtlDNZ77b8ysr8njAYQZwwaIHjy27TbR2tEpLDCmUwSbANNmivtc/xGEiDDwcNppMWlQ==}
-    peerDependencies:
-      storybook: ^8.2.0 || ^8.3.0-0 || ^8.4.0-0 || ^8.5.0-0 || ^8.6.0-0
-
-  '@storybook/core@8.6.12':
-    resolution: {integrity: sha512-t+ZuDzAlsXKa6tLxNZT81gEAt4GNwsKP/Id2wluhmUWD/lwYW0uum1JiPUuanw8xD6TdakCW/7ULZc7aQUBLCQ==}
+  '@storybook/addon-vitest@9.0.17':
+    resolution: {integrity: sha512-eogqcGbACR1sTedBSE2SP/4QV1ruicHYEhYjBtoPIjvYgymN1g5KSuQNysLx4f0SvAzczrcNjX2WVVLX2DVyzA==}
     peerDependencies:
-      prettier: ^2 || ^3
+      '@vitest/browser': ^3.0.0
+      '@vitest/runner': ^3.0.0
+      storybook: ^9.0.17
+      vitest: ^3.0.0
     peerDependenciesMeta:
-      prettier:
+      '@vitest/browser':
+        optional: true
+      '@vitest/runner':
+        optional: true
+      vitest:
         optional: true
 
-  '@storybook/csf-plugin@8.6.12':
-    resolution: {integrity: sha512-6s8CnP1aoKPb3XtC0jRLUp8M5vTA8RhGAwQDKUsFpCC7g89JR9CaKs9FY2ZSzsNbjR15uASi7b3K8BzeYumYQg==}
+  '@storybook/builder-vite@9.0.17':
+    resolution: {integrity: sha512-lyuvgGhb0NaVk1tdB4xwzky6+YXQfxlxfNQqENYZ9uYQZdPfErMa4ZTXVQTV+CQHAa2NL+p/dG2JPAeu39e9UA==}
     peerDependencies:
-      storybook: ^8.6.12
+      storybook: ^9.0.17
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/csf@0.1.13':
-    resolution: {integrity: sha512-7xOOwCLGB3ebM87eemep89MYRFTko+D8qE7EdAAq74lgdqRR5cOUtYWJLjO2dLtP94nqoOdHJo6MdLLKzg412Q==}
+  '@storybook/csf-plugin@9.0.17':
+    resolution: {integrity: sha512-6Q4eo1ObrLlsnB6bIt6T8+45XAb4to2pQGNrI7QPkLQRLrZinrJcNbLY7AGkyIoCOEsEbq08n09/nClQUbu8HA==}
+    peerDependencies:
+      storybook: ^9.0.17
 
   '@storybook/global@5.0.0':
     resolution: {integrity: sha512-FcOqPAXACP0I3oJ/ws6/rrPT9WGhu915Cg8D02a9YxLo0DE9zI+a9A5gRGvmQ09fiWPukqI8ZAEoQEdWUKMQdQ==}
 
-  '@storybook/manager-api@8.6.12':
-    resolution: {integrity: sha512-O0SpISeJLNTQvhSBOsWzzkCgs8vCjOq1578rwqHlC6jWWm4QmtfdyXqnv7rR1Hk08kQ+Dzqh0uhwHx0nfwy4nQ==}
-    peerDependencies:
-      storybook: ^8.2.0 || ^8.3.0-0 || ^8.4.0-0 || ^8.5.0-0 || ^8.6.0-0
-
-  '@storybook/preview-api@8.6.12':
-    resolution: {integrity: sha512-84FE3Hrs0AYKHqpDZOwx1S/ffOfxBdL65lhCoeI8GoWwCkzwa9zEP3kvXBo/BnEDO7nAfxvMhjASTZXbKRJh5Q==}
+  '@storybook/icons@1.4.0':
+    resolution: {integrity: sha512-Td73IeJxOyalzvjQL+JXx72jlIYHgs+REaHiREOqfpo3A2AYYG71AUbcv+lg7mEDIweKVCxsMQ0UKo634c8XeA==}
+    engines: {node: '>=14.0.0'}
     peerDependencies:
-      storybook: ^8.2.0 || ^8.3.0-0 || ^8.4.0-0 || ^8.5.0-0 || ^8.6.0-0
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
 
-  '@storybook/react-dom-shim@8.6.12':
-    resolution: {integrity: sha512-51QvoimkBzYs8s3rCYnY5h0cFqLz/Mh0vRcughwYaXckWzDBV8l67WBO5Xf5nBsukCbWyqBVPpEQLww8s7mrLA==}
+  '@storybook/react-dom-shim@9.0.17':
+    resolution: {integrity: sha512-ak/x/m6MDDxdE6rCDymTltaiQF3oiKrPHSwfM+YPgQR6MVmzTTs4+qaPfeev7FZEHq23IkfDMTmSTTJtX7Vs9A==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^8.6.12
+      storybook: ^9.0.17
 
-  '@storybook/react-vite@8.6.12':
-    resolution: {integrity: sha512-UA2Kule99oyFgHdhcuhrRwCKyWu/yMbqbl9U7NwowFHNwWWFjVMMir/AmfShb/H1C1DQ3LqOad6/QwJyPLjP8g==}
-    engines: {node: '>=18.0.0'}
+  '@storybook/react-vite@9.0.17':
+    resolution: {integrity: sha512-wx1yKScni4ifOC/ccqpnnpceQbyF2xto+jHGsyua+M4UUCQdS2NYPDR8JFWp1YvBhVt2cQiD6SAltVGM9QLGnQ==}
+    engines: {node: '>=20.0.0'}
     peerDependencies:
-      '@storybook/test': 8.6.12
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^8.6.12
-      vite: ^4.0.0 || ^5.0.0 || ^6.0.0
-    peerDependenciesMeta:
-      '@storybook/test':
-        optional: true
+      storybook: ^9.0.17
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/react@8.6.12':
-    resolution: {integrity: sha512-NzxlHLA5DkDgZM/dMwTYinuzRs6rsUPmlqP+NIv6YaciQ4NGnTYyOC7R/SqI6HHFm8ZZ5eMYvpfiFmhZ9rU+rQ==}
-    engines: {node: '>=18.0.0'}
+  '@storybook/react@9.0.17':
+    resolution: {integrity: sha512-wssao+uXg72OHtEJdQmmQJGdX90x/aU/6avoP3fgVgepWdZXVgciS9mnqHjKRF/vP+vPOlNQcJjojF/zTtq5qg==}
+    engines: {node: '>=20.0.0'}
     peerDependencies:
-      '@storybook/test': 8.6.12
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^8.6.12
-      typescript: '>= 4.2.x'
+      storybook: ^9.0.17
+      typescript: '>= 4.9.x'
     peerDependenciesMeta:
-      '@storybook/test':
-        optional: true
       typescript:
         optional: true
 
-  '@storybook/test-runner@0.22.0':
-    resolution: {integrity: sha512-fKY6MTE/bcvMaulKXy+z0fPmRXJx1REkYMOMcGn8zn6uffyBigGgaVf/sZ+AZfibwvjzg/StWhJ9HvAM8pc14g==}
-    engines: {node: ^16.10.0 || ^18.0.0 || >=20.0.0}
-    hasBin: true
-    peerDependencies:
-      storybook: ^0.0.0-0 || ^8.2.0 || ^8.3.0-0 || ^8.4.0-0 || ^8.5.0-0 || ^8.6.0-0 || ^9.0.0-0
-
-  '@storybook/theming@8.6.12':
-    resolution: {integrity: sha512-6VjZg8HJ2Op7+KV7ihJpYrDnFtd9D1jrQnUS8LckcpuBXrIEbaut5+34ObY8ssQnSqkk2GwIZBBBQYQBCVvkOw==}
-    peerDependencies:
-      storybook: ^8.2.0 || ^8.3.0-0 || ^8.4.0-0 || ^8.5.0-0 || ^8.6.0-0
-
   '@styled-system/background@5.1.2':
     resolution: {integrity: sha512-jtwH2C/U6ssuGSvwTN3ri/IyjdHb8W9X/g8Y0JLcrH02G+BW3OS8kZdHphF1/YyRklnrKrBT2ngwGUK6aqqV3A==}
 
@@ -2593,24 +2729,28 @@ packages:
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@swc/core-linux-arm64-musl@1.11.24':
     resolution: {integrity: sha512-ypXLIdszRo0re7PNNaXN0+2lD454G8l9LPK/rbfRXnhLWDBPURxzKlLlU/YGd2zP98wPcVooMmegRSNOKfvErw==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@swc/core-linux-x64-gnu@1.11.24':
     resolution: {integrity: sha512-IM7d+STVZD48zxcgo69L0yYptfhaaE9cMZ+9OoMxirNafhKKXwoZuufol1+alEFKc+Wbwp+aUPe/DeWC/Lh3dg==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@swc/core-linux-x64-musl@1.11.24':
     resolution: {integrity: sha512-DZByJaMVzSfjQKKQn3cqSeqwy6lpMaQDQQ4HPlch9FWtDx/dLcpdIhxssqZXcR2rhaQVIaRQsCqwV6orSDGAGw==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@swc/core-win32-arm64-msvc@1.11.24':
     resolution: {integrity: sha512-Q64Ytn23y9aVDKN5iryFi8mRgyHw3/kyjTjT4qFCa8AEb5sGUuSj//AUZ6c0J7hQKMHlg9do5Etvoe61V98/JQ==}
@@ -2642,12 +2782,6 @@ packages:
   '@swc/counter@0.1.3':
     resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
 
-  '@swc/jest@0.2.37':
-    resolution: {integrity: sha512-CR2BHhmXKGxTiFr21DYPRHQunLkX3mNIFGFkxBGji6r9uyIR5zftTOVYj1e0sFNMV2H7mf/+vpaglqaryBtqfQ==}
-    engines: {npm: '>= 7.0.0'}
-    peerDependencies:
-      '@swc/core': '*'
-
   '@swc/plugin-styled-components@7.1.4':
     resolution: {integrity: sha512-fnACXMLWnP23FZc7jn24NtElS+HymVQCc5Z8CPre9aOYFXU++B3mLjjO3RqZbtBAZuqzEyygZ6Uev41Ln6WpxA==}
 
@@ -2658,11 +2792,11 @@ packages:
     resolution: {integrity: sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==}
     engines: {node: '>=10'}
 
-  '@tanstack/query-core@5.75.5':
-    resolution: {integrity: sha512-kPDOxtoMn2Ycycb76Givx2fi+2pzo98F9ifHL/NFiahEDpDwSVW6o12PRuQ0lQnBOunhRG5etatAhQij91M3MQ==}
+  '@tanstack/query-core@5.85.5':
+    resolution: {integrity: sha512-KO0WTob4JEApv69iYp1eGvfMSUkgw//IpMnq+//cORBzXf0smyRwPLrUvEe5qtAEGjwZTXrjxg+oJNP/C00t6w==}
 
-  '@tanstack/react-query@5.75.5':
-    resolution: {integrity: sha512-QrLCJe40BgBVlWdAdf2ZEVJ0cISOuEy/HKupId1aTKU6gPJZVhSvZpH+Si7csRflCJphzlQ77Yx6gUxGW9o0XQ==}
+  '@tanstack/react-query@5.85.5':
+    resolution: {integrity: sha512-/X4EFNcnPiSs8wM2v+b6DqS5mmGeuJQvxBglmDxl6ZQb5V26ouD2SJYAcC3VjbNwqhY2zjxVD15rDA5nGbMn3A==}
     peerDependencies:
       react: ^18 || ^19
 
@@ -2717,6 +2851,9 @@ packages:
   '@types/cacheable-request@6.0.3':
     resolution: {integrity: sha512-IQ3EbTzGxIigb1I3qPZc1rWJnH0BmSKv5QYTalEwweFvyBDLSAe24zP0le/hyi7ecGfZVlIVAg4BZqb8WBwKqw==}
 
+  '@types/chai@5.2.2':
+    resolution: {integrity: sha512-8kB30R7Hwqf40JPiKhVzodJs2Qc1ZJ5zuT3uzw5Hq/dhNCl3G3l83jfpdI1e20BP348+fV7VIL/+FxaXkqBmWg==}
+
   '@types/cookie@0.6.0':
     resolution: {integrity: sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==}
 
@@ -2756,12 +2893,12 @@ packages:
   '@types/debug@4.1.12':
     resolution: {integrity: sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==}
 
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/doctrine@0.0.9':
     resolution: {integrity: sha512-eOIHzCUSH7SMfonMG1LsC2f8vxBFtho6NGBznK41R84YzPuvSBzrhEps33IsQiOW9+VL6NQ9DbjQJznk/S4uRA==}
 
-  '@types/estree-jsx@1.0.5':
-    resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
-
   '@types/estree@1.0.7':
     resolution: {integrity: sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==}
 
@@ -2771,9 +2908,6 @@ packages:
   '@types/graceful-fs@4.1.9':
     resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
 
-  '@types/hast@3.0.4':
-    resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
-
   '@types/history@4.7.11':
     resolution: {integrity: sha512-qjDJRrmvBMiTx+jyLxvLfJU7UznFuokDv4f3WRuriHKERccVpFU+8XMQUAbDzoiJCsmexxRExQeMwwCdamSKDA==}
 
@@ -2804,9 +2938,6 @@ packages:
   '@types/keyv@3.1.4':
     resolution: {integrity: sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
 
-  '@types/mdast@4.0.4':
-    resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
-
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
@@ -2850,6 +2981,9 @@ packages:
   '@types/responselike@1.0.3':
     resolution: {integrity: sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==}
 
+  '@types/semver@7.7.0':
+    resolution: {integrity: sha512-k107IF4+Xr7UHjwDc7Cfd6PRQfbdkiRabXGRjo07b4WyPahFBZCZ1sE+BNxYIJPPg73UkfOsVOLwqVc/6ETrIA==}
+
   '@types/shimmer@1.2.0':
     resolution: {integrity: sha512-UE7oxhQLLd9gub6JKIAhDq06T0F6FnztwMNRvYgjeQSBeMc1ZG/tA47EwfduvkuQS8apbkM/lpLpWsaCeYsXVg==}
 
@@ -2877,21 +3011,9 @@ packages:
   '@types/triple-beam@1.3.5':
     resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
 
-  '@types/unist@2.0.11':
-    resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==}
-
-  '@types/unist@3.0.3':
-    resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
-
-  '@types/uuid@9.0.8':
-    resolution: {integrity: sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==}
-
   '@types/verror@1.10.11':
     resolution: {integrity: sha512-RlDm9K7+o5stv0Co8i8ZRGxDbrTxhJtgjqjFyVh/tXQyl/rYtTKlnTvZ88oSTeYREWurwx20Js4kTuKCsFkUtg==}
 
-  '@types/wait-on@5.3.4':
-    resolution: {integrity: sha512-EBsPjFMrFlMbbUFf9D1Fp+PAB2TwmUn7a3YtHyD9RLuTIk1jDd8SxXVAoez2Ciy+8Jsceo2MYEYZzJ/DvorOKw==}
-
   '@types/webidl-conversions@7.0.1':
     resolution: {integrity: sha512-8hKOnOan+Uu+NgMaCouhg3cT9x5fFZ92Jwf+uDLXLu/MFRbXxlWwGeQY7KVHkeSft6RvY+tdxklUBuyY9eIEKg==}
 
@@ -2978,14 +3100,34 @@ packages:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@ungap/structured-clone@1.3.0':
-    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
-
   '@vitejs/plugin-react-swc@3.9.0':
     resolution: {integrity: sha512-jYFUSXhwMCYsh/aQTgSGLIN3Foz5wMbH9ahb0Zva//UzwZYbMiZd7oT3AU9jHT9DLswYDswsRwPU9jVF3yA48Q==}
     peerDependencies:
       vite: ^4 || ^5 || ^6
 
+  '@vitest/expect@3.2.4':
+    resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
+
+  '@vitest/mocker@3.2.4':
+    resolution: {integrity: sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@3.2.4':
+    resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
+
+  '@vitest/spy@3.2.4':
+    resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
+
+  '@vitest/utils@3.2.4':
+    resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
+
   '@xmldom/xmldom@0.8.10':
     resolution: {integrity: sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw==}
     engines: {node: '>=10.0.0'}
@@ -3030,10 +3172,6 @@ packages:
   abbrev@1.1.1:
     resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==}
 
-  abbrev@3.0.0:
-    resolution: {integrity: sha512-+/kfrslGQ7TNV2ecmQwMJj/B65g5KVq1/L3SGVZ3tCYGqlzFuFCGBZJtMP99wH3NpEUyAjn0zPdPUg0D+DwrOA==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   accepts@2.0.0:
     resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
     engines: {node: '>= 0.6'}
@@ -3091,10 +3229,6 @@ packages:
     resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==}
     engines: {node: '>=8'}
 
-  ansi-escapes@6.2.1:
-    resolution: {integrity: sha512-4nJ3yixlEthEJ9Rk4vPcdBRkZvQZlYyu8j4/Mqz5sgIkddmEnH2Yj2ZrnP9S3tQOvSNRUIgVNF/1yPpRAGNRig==}
-    engines: {node: '>=14.16'}
-
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
@@ -3103,10 +3237,6 @@ packages:
     resolution: {integrity: sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==}
     engines: {node: '>=12'}
 
-  ansi-styles@3.2.1:
-    resolution: {integrity: sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==}
-    engines: {node: '>=4'}
-
   ansi-styles@4.3.0:
     resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
     engines: {node: '>=8'}
@@ -3133,13 +3263,6 @@ packages:
       dmg-builder: 26.0.12
       electron-builder-squirrel-windows: 26.0.12
 
-  append-transform@2.0.0:
-    resolution: {integrity: sha512-7yeyCEurROLQJFv5Xj4lEGTy0borxepjFv1g22oAdqFu//SrAlDl1O1Nxx15SH1RoliUml6p8dwJW9jvZughhg==}
-    engines: {node: '>=8'}
-
-  archy@1.0.0:
-    resolution: {integrity: sha512-Xg+9RwCg/0p32teKdGMPTPnVXKD0w3DfHnFTficozsAgsvq2XenPJq/MYpzzQ/v8zrOyJn6Ds39VA4JIDwFfqw==}
-
   argparse@1.0.10:
     resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
 
@@ -3188,6 +3311,10 @@ packages:
     resolution: {integrity: sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==}
     engines: {node: '>=0.8'}
 
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
   ast-types@0.16.1:
     resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
     engines: {node: '>=4'}
@@ -3218,9 +3345,6 @@ packages:
     resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
     engines: {node: '>= 0.4'}
 
-  axios@1.8.2:
-    resolution: {integrity: sha512-ls4GYBm5aig9vWx8AWDSGLpnpDQRtWAfrjU+EuytuODrFBkqesN2RkOQCBzrA1RQNHw1SmRMSDDDSwzNAYQ6Rg==}
-
   b4a@1.6.7:
     resolution: {integrity: sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==}
 
@@ -3281,9 +3405,6 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0
 
-  bail@2.0.2:
-    resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
-
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
@@ -3329,23 +3450,23 @@ packages:
     resolution: {integrity: sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg==}
     engines: {node: '>=18'}
 
+  boolbase@1.0.0:
+    resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
+
   boolean@3.2.0:
     resolution: {integrity: sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==}
     deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
 
-  brace-expansion@1.1.11:
-    resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
+  brace-expansion@1.1.12:
+    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
 
-  brace-expansion@2.0.1:
-    resolution: {integrity: sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==}
+  brace-expansion@2.0.2:
+    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
 
   braces@3.0.3:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
 
-  browser-assert@1.2.1:
-    resolution: {integrity: sha512-nfulgvOR6S4gt9UKCeGJOuSGBPGiFT6oQ/2UBnvTY/5aQ1PnksW72fhZkM30DzoRRv2WpwZf1vHHEr3mtuXIWQ==}
-
   browserslist@4.24.5:
     resolution: {integrity: sha512-FDToo4Wo82hIdgc1CQ+NQD0hEhmpPjrZ3hiUgwgOG6IuTdlpr8jdjyG24P6cNP1yJpTLzS5OcGgSw0xmDU1/Tw==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
@@ -3367,6 +3488,10 @@ packages:
     resolution: {integrity: sha512-2/egrNDDnRaxVwK3A+cJq6UOlqOdedGA7JPqCeJjN2Zjk1/QB/6QUi3b714ScIGS7HafFXTyzJEOr5b44I3kvQ==}
     engines: {node: '>=12.0.0'}
 
+  builder-util-runtime@9.4.0:
+    resolution: {integrity: sha512-omkpaKbutPYqC0nwLEeGq540xND1YPhfVzwT6CFyCFzxhNDt/X+fykr17Yo3jxiuwI3zaAnY/1tKFoRN+FeHhg==}
+    engines: {node: '>=12.0.0'}
+
   builder-util@26.0.11:
     resolution: {integrity: sha512-xNjXfsldUEe153h1DraD0XvDOpqGR0L5eKFkdReB7eFW5HqysDZFfly4rckda6y9dF39N3pkPlOblcfHKGw+uA==}
 
@@ -3382,10 +3507,6 @@ packages:
     resolution: {integrity: sha512-/+Emcj9DAXxX4cwlLmRI9c166RuL3w30zp4R7Joiv2cQTtTtA+jeuCAjH3ZlGnYS3tKENSrKhAzVVP9GVyzeYQ==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  cacache@19.0.1:
-    resolution: {integrity: sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   cacheable-lookup@5.0.4:
     resolution: {integrity: sha512-2/kNscPhpcxrOigMZzbiWF7dz8ilhb/nIHU3EyZiXWXpeq/au8qJ8VhdftMkty3n7Gj6HIGalQG8oiBNB3AJgA==}
     engines: {node: '>=10.6.0'}
@@ -3394,10 +3515,6 @@ packages:
     resolution: {integrity: sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg==}
     engines: {node: '>=8'}
 
-  caching-transform@4.0.0:
-    resolution: {integrity: sha512-kpqOvwXnjjN44D89K5ccQC+RUrsy7jB/XLlRrx0D7/2HNcTPqzsb6XgYoErwko6QsV184CA2YgS1fxDiiDZMWA==}
-    engines: {node: '>=8'}
-
   call-bind-apply-helpers@1.0.2:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
@@ -3428,17 +3545,14 @@ packages:
   caniuse-lite@1.0.30001717:
     resolution: {integrity: sha512-auPpttCq6BDEG8ZAuHJIplGw6GODhjw+/11e7IjpnYCxZcW/ONgPs0KVBJ0d1bY3e2+7PRe5RCLyP+PfwVgkYw==}
 
-  ccount@2.0.1:
-    resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
+  chai@5.2.1:
+    resolution: {integrity: sha512-5nFxhUrX0PqtyogoYOA8IPswy5sZFTOsBFl/9bNsmDLgsxYTzSZQJDPppDnZPTQbzSEm0hqGjWPzRemQCYbD6A==}
+    engines: {node: '>=18'}
 
   chalk-template@1.1.0:
     resolution: {integrity: sha512-T2VJbcDuZQ0Tb2EWwSotMPJjgpy1/tGee1BTpUNsGZ/qgNjV2t7Mvu+d4600U564nbLesN1x2dPL+xii174Ekg==}
     engines: {node: '>=14.16'}
 
-  chalk@2.4.2:
-    resolution: {integrity: sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==}
-    engines: {node: '>=4'}
-
   chalk@3.0.0:
     resolution: {integrity: sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==}
     engines: {node: '>=8'}
@@ -3455,30 +3569,14 @@ packages:
     resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
     engines: {node: '>=10'}
 
-  char-regex@2.0.2:
-    resolution: {integrity: sha512-cbGOjAptfM2LVmWhwRFHEKTPkLwNddVmuqYZQt895yXwAsWsXObCG+YN4DGQ/JBtT4GP1a1lPPdio2z413LmTg==}
-    engines: {node: '>=12.20'}
-
-  character-entities-html4@2.1.0:
-    resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==}
-
-  character-entities-legacy@3.0.0:
-    resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
-
-  character-entities@2.0.2:
-    resolution: {integrity: sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==}
-
-  character-reference-invalid@2.0.1:
-    resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==}
+  check-error@2.1.1:
+    resolution: {integrity: sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==}
+    engines: {node: '>= 16'}
 
   chownr@2.0.0:
     resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
     engines: {node: '>=10'}
 
-  chownr@3.0.0:
-    resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==}
-    engines: {node: '>=18'}
-
   chromium-pickle-js@0.2.0:
     resolution: {integrity: sha512-1R5Fho+jBq0DDydt+/vHWj5KJNJCKdARKOCwZUen84I5BreWoLqRLANH1U87eJy1tiASPtMnGqJJq0ZsLoRPOw==}
 
@@ -3513,9 +3611,6 @@ packages:
     resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
     engines: {node: '>= 12'}
 
-  cliui@6.0.0:
-    resolution: {integrity: sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
-
   cliui@8.0.1:
     resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
     engines: {node: '>=12'}
@@ -3563,20 +3658,14 @@ packages:
     resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
     engines: {node: '>= 0.8'}
 
-  comma-separated-tokens@2.0.3:
-    resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
-
-  commander@12.1.0:
-    resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
-    engines: {node: '>=18'}
+  commander@11.1.0:
+    resolution: {integrity: sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==}
+    engines: {node: '>=16'}
 
   commander@13.1.0:
     resolution: {integrity: sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==}
     engines: {node: '>=18'}
 
-  commander@3.0.2:
-    resolution: {integrity: sha512-Gar0ASD4BDyKC4hl4DwHqDrmvjoxWKZigVnAbn5H1owvm4CxCPdb0HQDehwNYMJpla5+M2tPmPARzhtYuwpHow==}
-
   commander@5.1.0:
     resolution: {integrity: sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==}
     engines: {node: '>= 6'}
@@ -3585,9 +3674,6 @@ packages:
     resolution: {integrity: sha512-bKw/r35jR3HGt5PEPm1ljsQQGyCrR8sFGNiN5L+ykDHdpO8Smxkrkla9Yi6NkQyUrb8V54PGhfMs6NrIwtxtdw==}
     engines: {node: '>= 6'}
 
-  commondir@1.0.1:
-    resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
-
   compare-version@0.1.2:
     resolution: {integrity: sha512-pJDh5/4wrEnXX/VWRZvruAGHkzKdr46z11OlTPN+VrATlWWhSKewNCJ1futCO5C7eJB3nPMFZA1LeYtcFboZ2A==}
     engines: {node: '>=0.10.0'}
@@ -3701,15 +3787,34 @@ packages:
   css-mediaquery@0.1.2:
     resolution: {integrity: sha512-COtn4EROW5dBGlE/4PiKnh6rZpAPxDeFLaEEwt4i10jpDMFt2EhQGS79QmmrO+iKCHv0PU/HrOWEhijFd1x99Q==}
 
+  css-select@5.1.0:
+    resolution: {integrity: sha512-nwoRF1rvRRnnCqqY7updORDsuqKzqYJ28+oSMaJMMgOauh3fvwHqMS7EZpIPqK8GL+g9mKxF1vP/ZjSeNjEVHg==}
+
   css-to-react-native@3.2.0:
     resolution: {integrity: sha512-e8RKaLXMOFii+02mOlqwjbD00KSEKqblnpO9e++1aXS1fPQOpS1YoqdVHBqPjHNoxeF2mimzVqawm2KCbEdtHQ==}
 
+  css-tree@2.2.1:
+    resolution: {integrity: sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
+
+  css-tree@3.1.0:
+    resolution: {integrity: sha512-0eW44TGN5SQXU1mWSkKwFstI/22X2bG1nYzZTYMAWjylYURhse752YgbE4Cx46AC+bAvI+/dYTPRk1LqSUnu6w==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
+
+  css-what@6.1.0:
+    resolution: {integrity: sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw==}
+    engines: {node: '>= 6'}
+
   css.escape@1.5.1:
     resolution: {integrity: sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==}
 
   cssfontparser@1.2.1:
     resolution: {integrity: sha512-6tun4LoZnj7VN6YeegOVb67KBX/7JJsqvj+pv3ZA7F878/eN33AbGa5b/S/wXxS/tcp8nc40xRUrsPlxIyNUPg==}
 
+  csso@5.0.5:
+    resolution: {integrity: sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
+
   cssom@0.3.8:
     resolution: {integrity: sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==}
 
@@ -3727,10 +3832,6 @@ packages:
   csstype@3.1.3:
     resolution: {integrity: sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==}
 
-  cwd@0.10.0:
-    resolution: {integrity: sha512-YGZxdTTL9lmLkCUTpg4j0zQ7IhRB5ZmqNBbGCl3Tg6MP/d5/6sY7L5mmTjzbc6JKgVZYiqTQTNhPFsbXNGlRaA==}
-    engines: {node: '>=0.8'}
-
   d3-array@2.12.1:
     resolution: {integrity: sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ==}
 
@@ -3825,16 +3926,9 @@ packages:
       supports-color:
         optional: true
 
-  decamelize@1.2.0:
-    resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==}
-    engines: {node: '>=0.10.0'}
-
   decimal.js@10.5.0:
     resolution: {integrity: sha512-8vDa8Qxvr/+d94hSh5P3IJwI5t8/c0KsMp+g8bNw9cY2icONa5aPfvKeieW1WlG0WQYwwhJ7mjui2xtiePQSXw==}
 
-  decode-named-character-reference@1.1.0:
-    resolution: {integrity: sha512-Wy+JTSbFThEOXQIR2L6mxJvEs+veIzpmqD7ynWxMXGpnk3smkHQOp6forLdHsKpAMW9iJpaBBIxz285t1n1C3w==}
-
   decompress-response@6.0.0:
     resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
     engines: {node: '>=10'}
@@ -3847,6 +3941,10 @@ packages:
       babel-plugin-macros:
         optional: true
 
+  deep-eql@5.0.2:
+    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+    engines: {node: '>=6'}
+
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -3854,10 +3952,6 @@ packages:
     resolution: {integrity: sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==}
     engines: {node: '>=0.10.0'}
 
-  default-require-extensions@3.0.1:
-    resolution: {integrity: sha512-eXTJmRbm2TIt9MgWTsOH1wEuhew6XGZcMeGKCtLedIg/NCsg1iBePXkceTdK4Fii7pzmN9tGsZhKzZ4h7O/fxw==}
-    engines: {node: '>=8'}
-
   defaults@1.0.4:
     resolution: {integrity: sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
 
@@ -3900,16 +3994,10 @@ packages:
   detect-node@2.1.0:
     resolution: {integrity: sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==}
 
-  devlop@1.1.0:
-    resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
-
   diff-sequences@29.6.3:
     resolution: {integrity: sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  diffable-html@4.1.0:
-    resolution: {integrity: sha512-++kyNek+YBLH8cLXS+iTj/Hiy2s5qkRJEJ8kgu/WHbFrVY2vz9xPFUT+fii2zGF0m1CaojDlQJjkfrCt7YWM1g==}
-
   dir-compare@4.2.0:
     resolution: {integrity: sha512-2xMCmOoMrdQIPHdsTawECdNPwlVFB9zGcz3kuhmBO6U3oU+UQjsue0i8ayLKpgBcm+hcXPMVSGUN9d+pvJ6+VQ==}
 
@@ -3942,11 +4030,8 @@ packages:
   dom-helpers@5.2.1:
     resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
 
-  dom-serializer@0.2.2:
-    resolution: {integrity: sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==}
-
-  domelementtype@1.3.1:
-    resolution: {integrity: sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w==}
+  dom-serializer@2.0.0:
+    resolution: {integrity: sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==}
 
   domelementtype@2.3.0:
     resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==}
@@ -3956,11 +4041,12 @@ packages:
     engines: {node: '>=12'}
     deprecated: Use your platform's native DOMException instead
 
-  domhandler@2.4.2:
-    resolution: {integrity: sha512-JiK04h0Ht5u/80fdLMCEmV4zkNh2BcoMFBmZ/91WtYZ8qVXSKjiw7fXMgFPnHcSZgOo3XdinHvmnDUeMf5R4wA==}
+  domhandler@5.0.3:
+    resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
+    engines: {node: '>= 4'}
 
-  domutils@1.7.0:
-    resolution: {integrity: sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==}
+  domutils@3.2.2:
+    resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
 
   dotenv-expand@11.0.7:
     resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
@@ -3996,19 +4082,22 @@ packages:
   electron-to-chromium@1.5.150:
     resolution: {integrity: sha512-rOOkP2ZUMx1yL4fCxXQKDHQ8ZXwisb2OycOQVKHgvB3ZI4CvehOd4y2tfnnLDieJ3Zs1RL1Dlp3cMkyIn7nnXA==}
 
-  electron-vite@3.1.0:
-    resolution: {integrity: sha512-M7aAzaRvSl5VO+6KN4neJCYLHLpF/iWo5ztchI/+wMxIieDZQqpbCYfaEHHHPH6eupEzfvZdLYdPdmvGqoVe0Q==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  electron-updater@6.6.8:
+    resolution: {integrity: sha512-n8FeXRc7Q7BBweS85+H5h4/uzBz8hSSOYhDnwOumpbIhYdPk9EEzWLKDyoArMyf4RebywqWBUE96QDn9TETRhQ==}
+
+  electron-vite@4.0.0:
+    resolution: {integrity: sha512-U3d7GlKjl4BPs1sxYTHn1N8YlMmPvlx1t62UVQ1zouWoBxZs5Hd5yrJcQ+rmMnko/ASbIcx/KFOTXh8YcqLv7w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       '@swc/core': ^1.0.0
-      vite: ^4.0.0 || ^5.0.0 || ^6.0.0
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       '@swc/core':
         optional: true
 
-  electron@36.1.0:
-    resolution: {integrity: sha512-gnp3BnbKdGsVc7cm1qlEaZc8pJsR08mIs8H/yTo8gHEtFkGGJbDTVZOYNAfbQlL0aXh+ozv+CnyiNeDNkT1Upg==}
+  electron@37.6.0:
+    resolution: {integrity: sha512-8AANcn6irYQ7cTAJRY7r0CovWckcGCHUniQecyGhw/jJ25vWwitVhF97skF+EyDztiEI6YBoF0G6tx1s37bO3g==}
     engines: {node: '>= 12.20.55'}
     hasBin: true
 
@@ -4035,11 +4124,9 @@ packages:
   end-of-stream@1.4.4:
     resolution: {integrity: sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==}
 
-  entities@1.1.2:
-    resolution: {integrity: sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w==}
-
-  entities@2.2.0:
-    resolution: {integrity: sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==}
+  entities@4.5.0:
+    resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
+    engines: {node: '>=0.12'}
 
   entities@6.0.0:
     resolution: {integrity: sha512-aKstq2TDOndCn4diEyp9Uq/Flu2i1GlLkc6XIDQSDMuaFE3OPW5OphLCyQ5SpSJZTb4reN+kTcYru5yIfXoRPw==}
@@ -4104,6 +4191,11 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  esbuild@0.25.9:
+    resolution: {integrity: sha512-CRbODhYyQx3qp7ZEwzxOk4JBqmD/seJrzPa/cGjY1VtIn5E09Oi9/dB4JwctnfZ8Q8iT7rioVv5k/FNT/uf54g==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   escalade@3.2.0:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
@@ -4111,10 +4203,6 @@ packages:
   escape-html@1.0.3:
     resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
 
-  escape-string-regexp@1.0.5:
-    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
-    engines: {node: '>=0.8.0'}
-
   escape-string-regexp@2.0.0:
     resolution: {integrity: sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
     engines: {node: '>=8'}
@@ -4163,6 +4251,13 @@ packages:
     peerDependencies:
       eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
 
+  eslint-plugin-storybook@9.0.17:
+    resolution: {integrity: sha512-IuTdlwCEwoDNobdygRCxNhlKXHmsDfPtPvHGcsY35x2Bx8KItrjfekO19gJrjc1VT2CMfcZMYF8OBKaxHELupw==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      eslint: '>=8'
+      storybook: ^9.0.17
+
   eslint-plugin-testing-library@7.1.1:
     resolution: {integrity: sha512-nszC833aZPwB6tik1nMkbFqmtgIXTT0sfJEYs0zMBKMlkQ4to2079yUV96SvmLh00ovSBJI4pgcBC1TiIP8mXg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0, pnpm: ^9.14.0}
@@ -4221,12 +4316,12 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
-  estree-util-is-identifier-name@3.0.0:
-    resolution: {integrity: sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==}
-
   estree-walker@2.0.2:
     resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==}
 
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
   esutils@2.0.3:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
@@ -4255,13 +4350,6 @@ packages:
     resolution: {integrity: sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==}
     engines: {node: '>= 0.8.0'}
 
-  expand-tilde@1.2.2:
-    resolution: {integrity: sha512-rtmc+cjLZqnu9dSYosX9EWmSJhTwpACgJQTfj4hgg2JjOD/6SIQalZrt4a3aQeh++oNxkazcaxrhPUj6+g5G/Q==}
-    engines: {node: '>=0.10.0'}
-
-  expect-playwright@0.8.0:
-    resolution: {integrity: sha512-+kn8561vHAY+dt+0gMqqj1oY+g5xWrsuGMk4QGxotT2WS545nVqqjs37z6hrYfIuucwqthzwJfCJUEYqixyljg==}
-
   expect@29.7.0:
     resolution: {integrity: sha512-2Zks0hf1VLFYI1kbh0I5jP3KHHyCHpkfyHBzsSXRFgl/Bg9mWYfMW8oD+PdMPlEwy5HNsR9JutYy6pMeOh61nw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -4279,9 +4367,6 @@ packages:
     resolution: {integrity: sha512-DT9ck5YIRU+8GYzzU5kT3eHGA5iL+1Zd0EutOmTE9Dtk+Tvuzd23VBU+ec7HPNSTxXYO55gPV/hq4pSBJDjFpA==}
     engines: {node: '>= 18'}
 
-  extend@3.0.2:
-    resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
-
   extract-zip@2.0.1:
     resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==}
     engines: {node: '>= 10.17.0'}
@@ -4350,22 +4435,6 @@ packages:
     resolution: {integrity: sha512-/t88Ty3d5JWQbWYgaOGCCYfXRwV1+be02WqYYlL6h0lEiUAMPM8o8qKGO01YIkOHzka2up08wvgYD0mDiI+q3Q==}
     engines: {node: '>= 0.8'}
 
-  find-cache-dir@3.3.2:
-    resolution: {integrity: sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==}
-    engines: {node: '>=8'}
-
-  find-file-up@0.1.3:
-    resolution: {integrity: sha512-mBxmNbVyjg1LQIIpgO8hN+ybWBgDQK8qjht+EbrTCGmmPV/sc7RF1i9stPTD6bpvXZywBdrwRYxhSdJv867L6A==}
-    engines: {node: '>=0.10.0'}
-
-  find-pkg@0.1.2:
-    resolution: {integrity: sha512-0rnQWcFwZr7eO0513HahrWafsc3CTFioEB7DRiEYCUM/70QXSY8f3mCST17HXLcPvEhzH/Ty/Bxd72ZZsr/yvw==}
-    engines: {node: '>=0.10.0'}
-
-  find-process@1.4.10:
-    resolution: {integrity: sha512-ncYFnWEIwL7PzmrK1yZtaccN8GhethD37RzBHG6iOZoFYB4vSmLLXfeWJjeN5nMvCJMjOtBvBBF8OgxEcikiZg==}
-    hasBin: true
-
   find-root@1.1.0:
     resolution: {integrity: sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng==}
 
@@ -4377,6 +4446,10 @@ packages:
     resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
     engines: {node: '>=10'}
 
+  find-up@7.0.0:
+    resolution: {integrity: sha512-YyZM99iHrqLKjmt4LJDj58KI+fYyufRLBSYcqycxf//KpBk9FoewoGX0450m9nB44qrZnovzC2oeP5hUibxc/g==}
+    engines: {node: '>=18'}
+
   flat-cache@4.0.1:
     resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
     engines: {node: '>=16'}
@@ -4391,29 +4464,16 @@ packages:
   fn.name@1.1.0:
     resolution: {integrity: sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==}
 
-  follow-redirects@1.15.9:
-    resolution: {integrity: sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==}
-    engines: {node: '>=4.0'}
-    peerDependencies:
-      debug: '*'
-    peerDependenciesMeta:
-      debug:
-        optional: true
-
   for-each@0.3.5:
     resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
     engines: {node: '>= 0.4'}
 
-  foreground-child@2.0.0:
-    resolution: {integrity: sha512-dCIq9FpEcyQyXKCkyzmlPTFNgrCzPudOe+mhvJU5zAtlBnGVy2yKxtfsxK2tQBThwq225jcvBjpw1Gr40uzZCA==}
-    engines: {node: '>=8.0.0'}
-
   foreground-child@3.3.1:
     resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
     engines: {node: '>=14'}
 
-  form-data@4.0.2:
-    resolution: {integrity: sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==}
+  form-data@4.0.4:
+    resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==}
     engines: {node: '>= 6'}
 
   forwarded@0.2.0:
@@ -4424,13 +4484,6 @@ packages:
     resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
     engines: {node: '>= 0.8'}
 
-  fromentries@1.3.2:
-    resolution: {integrity: sha512-cHEpEQHUg0f8XdtZCc2ZAhrHzKzT0MrFUTcvx+hfxYu7rGMDc5SKoXFh+n4YigxsHXRzc6OrCshdR1bWH6HHyg==}
-
-  fs-exists-sync@0.1.0:
-    resolution: {integrity: sha512-cR/vflFyPZtrN6b38ZyWxpWdhlXrzZEBawlpBQMq7033xVY7/kg0GDMBK5jg8lDYQckdJ5x/YC88lM3C7VMsLg==}
-    engines: {node: '>=0.10.0'}
-
   fs-extra@10.1.0:
     resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==}
     engines: {node: '>=12'}
@@ -4451,10 +4504,6 @@ packages:
     resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
     engines: {node: '>= 8'}
 
-  fs-minipass@3.0.3:
-    resolution: {integrity: sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==}
-    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
-
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
@@ -4522,8 +4571,8 @@ packages:
     resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
     engines: {node: '>=10.13.0'}
 
-  glob@10.4.5:
-    resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+  glob@10.5.0:
+    resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
     hasBin: true
 
   glob@7.2.3:
@@ -4543,14 +4592,6 @@ packages:
     resolution: {integrity: sha512-wHTUcDUoZ1H5/0iVqEudYW4/kAlN5cZ3j/bXn0Dpbizl9iaUVeWSHqiOjsgk6OW2bkLclbBjzewBz6weQ1zA2Q==}
     engines: {node: '>=18'}
 
-  global-modules@0.2.3:
-    resolution: {integrity: sha512-JeXuCbvYzYXcwE6acL9V2bAOeSIGl4dD+iwLY9iUx2VBJJ80R18HCn+JCwHM9Oegdfya3lEkGCdaRkSyc10hDA==}
-    engines: {node: '>=0.10.0'}
-
-  global-prefix@0.1.5:
-    resolution: {integrity: sha512-gOPiyxcD9dJGCEArAhF4Hd0BAqvAe/JzERP7tYumE4yIkmIedPUVXcJFWbV3/p/ovIIvKjkrTk+f1UVkq7vvbw==}
-    engines: {node: '>=0.10.0'}
-
   globals@11.12.0:
     resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
     engines: {node: '>=4'}
@@ -4592,10 +4633,6 @@ packages:
     resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
     engines: {node: '>= 0.4'}
 
-  has-flag@3.0.0:
-    resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
-    engines: {node: '>=4'}
-
   has-flag@4.0.0:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
@@ -4619,20 +4656,10 @@ packages:
     resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
     engines: {node: '>= 0.4'}
 
-  hasha@5.2.2:
-    resolution: {integrity: sha512-Hrp5vIK/xr5SkeN2onO32H0MgNZ0f17HRNH39WfL0SYUNOTZ5Lz1TJ8Pajo/87dYGEFlLMm7mIc/k/s6Bvz9HQ==}
-    engines: {node: '>=8'}
-
   hasown@2.0.2:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
-  hast-util-to-jsx-runtime@2.3.6:
-    resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==}
-
-  hast-util-whitespace@3.0.0:
-    resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==}
-
   headers-polyfill@4.0.3:
     resolution: {integrity: sha512-IScLbePpkvO846sIwOtOTDjutRMWdXdJmXdMvk6gCBHxFO8d+QKOQedyZSxFTTFYRSmlgSTDtXqqq4pcenBXLQ==}
 
@@ -4649,10 +4676,6 @@ packages:
   hoist-non-react-statics@3.3.2:
     resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
 
-  homedir-polyfill@1.0.3:
-    resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==}
-    engines: {node: '>=0.10.0'}
-
   hosted-git-info@4.1.0:
     resolution: {integrity: sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==}
     engines: {node: '>=10'}
@@ -4668,12 +4691,6 @@ packages:
   html-escaper@2.0.2:
     resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
 
-  html-url-attributes@3.0.1:
-    resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
-
-  htmlparser2@3.10.1:
-    resolution: {integrity: sha512-IgieNijUMbkDovyoKObU1DUhm1iwNYE/fuifEoEHfd1oZKZDaONBSkal7Y01shxsM49R4XaMdGez3WnF9UfiCQ==}
-
   http-cache-semantics@4.1.1:
     resolution: {integrity: sha512-er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==}
 
@@ -4760,16 +4777,10 @@ packages:
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ini@1.3.8:
-    resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
-
   ini@4.1.1:
     resolution: {integrity: sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
-  inline-style-parser@0.2.4:
-    resolution: {integrity: sha512-0aO8FkhNZlj/ZIbNi7Lxxr12obT7cL1moPfE4tg1LkX7LlLfC6DeX4l2ZEud1ukP9jNQyNnfzQVqwbwmAATY4Q==}
-
   internal-slot@1.1.0:
     resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
     engines: {node: '>= 0.4'}
@@ -4789,16 +4800,6 @@ packages:
     resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
     engines: {node: '>= 0.10'}
 
-  is-alphabetical@2.0.1:
-    resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==}
-
-  is-alphanumerical@2.0.1:
-    resolution: {integrity: sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==}
-
-  is-arguments@1.2.0:
-    resolution: {integrity: sha512-7bVbi0huj/wrIAOzb8U1aszg9kdi3KN/CyU19CTI7tAoZYEZoL9yCDXpbXN+uPsuWnP02cyug1gleqq+TU+YCA==}
-    engines: {node: '>= 0.4'}
-
   is-array-buffer@3.0.5:
     resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
     engines: {node: '>= 0.4'}
@@ -4841,9 +4842,6 @@ packages:
     resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
     engines: {node: '>= 0.4'}
 
-  is-decimal@2.0.1:
-    resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==}
-
   is-docker@2.2.1:
     resolution: {integrity: sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==}
     engines: {node: '>=8'}
@@ -4873,9 +4871,6 @@ packages:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
 
-  is-hexadecimal@2.0.1:
-    resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
-
   is-interactive@1.0.0:
     resolution: {integrity: sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
     engines: {node: '>=8'}
@@ -4898,10 +4893,6 @@ packages:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
 
-  is-plain-obj@4.1.0:
-    resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
-    engines: {node: '>=12'}
-
   is-potential-custom-element-name@1.0.1:
     resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
 
@@ -4936,9 +4927,6 @@ packages:
     resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
     engines: {node: '>= 0.4'}
 
-  is-typedarray@1.0.0:
-    resolution: {integrity: sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
-
   is-unicode-supported@0.1.0:
     resolution: {integrity: sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==}
     engines: {node: '>=10'}
@@ -4955,14 +4943,6 @@ packages:
     resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
     engines: {node: '>= 0.4'}
 
-  is-windows@0.2.0:
-    resolution: {integrity: sha512-n67eJYmXbniZB7RF4I/FTjK1s6RPOCTxhYrVYLRaCt3lF0mpWZPKr3T2LSZAqyjQsxR2qMmGYXXzK0YWwcPM1Q==}
-    engines: {node: '>=0.10.0'}
-
-  is-windows@1.0.2:
-    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
-    engines: {node: '>=0.10.0'}
-
   is-wsl@2.2.0:
     resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
     engines: {node: '>=8'}
@@ -4992,14 +4972,6 @@ packages:
     resolution: {integrity: sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
     engines: {node: '>=8'}
 
-  istanbul-lib-hook@3.0.0:
-    resolution: {integrity: sha512-Pt/uge1Q9s+5VAZ+pCo16TYMWPBIl+oaNIjgLQxcX0itS6ueeaA+pEfThZpH8WxhFgCiEb8sAJY6MdUKgiIWaQ==}
-    engines: {node: '>=8'}
-
-  istanbul-lib-instrument@4.0.3:
-    resolution: {integrity: sha512-BXgQl9kf4WTCPCCpmFGoJkz/+uhvm7h7PFKUYxh7qarQd3ER33vHG//qaE8eN25l07YqZPpHXU9I09l/RD5aGQ==}
-    engines: {node: '>=8'}
-
   istanbul-lib-instrument@5.2.1:
     resolution: {integrity: sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==}
     engines: {node: '>=8'}
@@ -5008,10 +4980,6 @@ packages:
     resolution: {integrity: sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==}
     engines: {node: '>=10'}
 
-  istanbul-lib-processinfo@2.0.3:
-    resolution: {integrity: sha512-NkwHbo3E00oybX6NGJi6ar0B29vxyvNwoC7eJ4G4Yq28UfY758Hgn/heV8VRFhevPED4LXfFz0DQ8z/0kw9zMg==}
-    engines: {node: '>=8'}
-
   istanbul-lib-report@3.0.1:
     resolution: {integrity: sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
     engines: {node: '>=10'}
@@ -5105,10 +5073,6 @@ packages:
     resolution: {integrity: sha512-fP8u2pyfqx0K1rGn1R9pyE0/KTn+G7PxktWidOBTqFPLYX0b9ksaMFkhK5vrS3DVun09pckLdlx90QthlW7AmA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  jest-junit@16.0.0:
-    resolution: {integrity: sha512-A94mmw6NfJab4Fg/BlvVOUXzXgF0XIH6EmTgJ5NDPp4xoKq0Kr7sErb+4Xs9nZvu58pJojz5RFGpqnZYJTrRfQ==}
-    engines: {node: '>=10.12.0'}
-
   jest-leak-detector@29.7.0:
     resolution: {integrity: sha512-kYA8IJcSYtST2BY9I+SMC32nDpBT3J2NvWJx8+JCuCdl/CR1I4EKUJROiP8XtCcxqgTTBGJNdbB1A8XRKbTetw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -5125,14 +5089,6 @@ packages:
     resolution: {integrity: sha512-ITOMZn+UkYS4ZFh83xYAOzWStloNzJFO2s8DWrE4lhtGD+AorgnbkiKERe4wQVBydIGPx059g6riW5Btp6Llnw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  jest-playwright-preset@4.0.0:
-    resolution: {integrity: sha512-+dGZ1X2KqtwXaabVjTGxy0a3VzYfvYsWaRcuO8vMhyclHSOpGSI1+5cmlqzzCwQ3+fv0EjkTc7I5aV9lo08dYw==}
-    peerDependencies:
-      jest: ^29.3.1
-      jest-circus: ^29.3.1
-      jest-environment-node: ^29.3.1
-      jest-runner: ^29.3.1
-
   jest-pnp-resolver@1.2.3:
     resolution: {integrity: sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==}
     engines: {node: '>=6'}
@@ -5142,9 +5098,6 @@ packages:
       jest-resolve:
         optional: true
 
-  jest-process-manager@0.4.0:
-    resolution: {integrity: sha512-80Y6snDyb0p8GG83pDxGI/kQzwVTkCxc7ep5FPe/F6JYdvRDhwr6RzRmPSP7SEwuLhxo80lBS/NqOdUIbHIfhw==}
-
   jest-regex-util@29.6.3:
     resolution: {integrity: sha512-KJJBsRCyyLNWCNBOvZyRDnAIfUiRJ8v+hOBQYGn8gDyF3UegwiP4gwRR3/SDa42g1YbVycTidUF3rKjyLFDWbg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -5165,9 +5118,6 @@ packages:
     resolution: {integrity: sha512-gUnLjgwdGqW7B4LvOIkbKs9WGbn+QLqRQQ9juC6HndeDiezIwhDP+mhMwHWCEcfQ5RUXa6OPnFF8BJh5xegwwQ==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  jest-serializer-html@7.1.0:
-    resolution: {integrity: sha512-xYL2qC7kmoYHJo8MYqJkzrl/Fdlx+fat4U1AqYg+kafqwcKPiMkOcjWHPKhueuNEgr+uemhGc+jqXYiwCyRyLA==}
-
   jest-snapshot@29.7.0:
     resolution: {integrity: sha512-Rm0BMWtxBcioHr1/OX5YCP8Uov4riHvKPknOGs804Zg9JGZgmIBkbtlxJC/7Z4msKYVbIJtfU+tKb8xlYNfdkw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -5186,12 +5136,6 @@ packages:
     resolution: {integrity: sha512-ZB7wHqaRGVw/9hST/OuFUReG7M8vKeq0/J2egIGLdvjHCmYqGARhzXmtgi+gVeZ5uXFF219aOc3Ls2yLg27tkw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  jest-watch-typeahead@2.2.2:
-    resolution: {integrity: sha512-+QgOFW4o5Xlgd6jGS5X37i08tuuXNW8X0CV9WNFi+3n8ExCIP+E1melYhvYLjv5fE6D0yyzk74vsSO8I6GqtvQ==}
-    engines: {node: ^14.17.0 || ^16.10.0 || >=18.0.0}
-    peerDependencies:
-      jest: ^27.0.0 || ^28.0.0 || ^29.0.0
-
   jest-watcher@29.7.0:
     resolution: {integrity: sha512-49Fg7WXkU3Vl2h6LbLtMQ/HyB6rXSIX7SqvBLQmssRBGN9I0PNvPmAmCWSOY6SOvrjhI/F7/bGAv9RtnsPA03g==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -5213,27 +5157,20 @@ packages:
       node-notifier:
         optional: true
 
-  joi@17.13.3:
-    resolution: {integrity: sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==}
-
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@3.14.1:
-    resolution: {integrity: sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==}
+  js-yaml@3.14.2:
+    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
     hasBin: true
 
-  js-yaml@4.1.0:
-    resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
   jsbn@1.1.0:
     resolution: {integrity: sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==}
 
-  jsdoc-type-pratt-parser@4.1.0:
-    resolution: {integrity: sha512-Hicd6JK5Njt2QB6XYFS7ok9e37O8AYk3jTcppG4YVQnYjOemymvTcmc7OWsmq/Qqj5TdRFO5/x/tIPmBeRtGHg==}
-    engines: {node: '>=12.0.0'}
-
   jsdom-testing-mocks@1.13.1:
     resolution: {integrity: sha512-8BAsnuoO4DLGTf7LDbSm8fcx5CUHSv4h+bdUbwyt6rMYAXWjeHLRx9f8sYiSxoOTXy3S1e06pe87KER39o1ckA==}
     engines: {node: '>=14'}
@@ -5286,9 +5223,6 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
-  jsonc-parser@3.3.1:
-    resolution: {integrity: sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==}
-
   jsonfile@4.0.0:
     resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
 
@@ -5331,14 +5265,22 @@ packages:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
     engines: {node: '>=10'}
 
+  locate-path@7.2.0:
+    resolution: {integrity: sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
   lodash.camelcase@4.3.0:
     resolution: {integrity: sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==}
 
   lodash.debounce@4.0.8:
     resolution: {integrity: sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==}
 
-  lodash.flattendeep@4.4.0:
-    resolution: {integrity: sha512-uHaJFihxmJcEX3kT4I23ABqKKalJ/zDrDg0lsFtc1h+3uw49SIJ5beyhx5ExVRti3AvKoOJngIj7xz3oylPdWQ==}
+  lodash.escaperegexp@4.1.2:
+    resolution: {integrity: sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw==}
+
+  lodash.isequal@4.5.0:
+    resolution: {integrity: sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==}
+    deprecated: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
 
   lodash.merge@4.6.2:
     resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
@@ -5354,20 +5296,16 @@ packages:
     resolution: {integrity: sha512-TFYA4jnP7PVbmlBIfhlSe+WKxs9dklXMTEGcBCIvLhE/Tn3H6Gk1norupVW7m5Cnd4bLcr08AytbyV/xj7f/kQ==}
     engines: {node: '>= 12.0.0'}
 
-  loglevel@1.9.2:
-    resolution: {integrity: sha512-HgMmCqIJSAKqo68l0rS2AanEWfkxaZ5wNiEFb5ggm08lDs9Xl2KxBlX3PTcaD2chBM1gXAYf491/M2Rv8Jwayg==}
-    engines: {node: '>= 0.6.0'}
-
   long@5.3.2:
     resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
 
-  longest-streak@3.1.0:
-    resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
-
   loose-envify@1.4.0:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
+  loupe@3.1.4:
+    resolution: {integrity: sha512-wJzkKwJrheKtknCOKNEtDK4iqg/MxmZheEMtSTYvnzRdEYaZzmgH976nenp8WdJRdx5Vc1X/9MO0Oszl6ezeXg==}
+
   lowercase-keys@2.0.0:
     resolution: {integrity: sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==}
     engines: {node: '>=8'}
@@ -5390,17 +5328,9 @@ packages:
     resolution: {integrity: sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==}
     hasBin: true
 
-  magic-string@0.27.0:
-    resolution: {integrity: sha512-8UnnX2PeRAPZuN12svgR9j7M1uWMovg/CEnIwIG0LFkXSJJe4PdfUGiTGl8V9bsBHFUtfVINcSyYxd7q+kx9fA==}
-    engines: {node: '>=12'}
-
   magic-string@0.30.17:
     resolution: {integrity: sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==}
 
-  make-dir@3.1.0:
-    resolution: {integrity: sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==}
-    engines: {node: '>=8'}
-
   make-dir@4.0.0:
     resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
     engines: {node: '>=10'}
@@ -5409,10 +5339,6 @@ packages:
     resolution: {integrity: sha512-NgOPbRiaQM10DYXvN3/hhGVI2M5MtITFryzBGxHM5p4wnFxsVCbxkrBrDsk+EZ5OB4jEOT7AjDxtdF+KVEFT7w==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  make-fetch-happen@14.0.3:
-    resolution: {integrity: sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   makeerror@1.0.12:
     resolution: {integrity: sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==}
 
@@ -5424,29 +5350,11 @@ packages:
     resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
     engines: {node: '>= 0.4'}
 
-  mdast-util-from-markdown@2.0.2:
-    resolution: {integrity: sha512-uZhTV/8NBuw0WHkPTrCqDOl0zVe1BIng5ZtHoDk49ME1qqcjYmmLmOf0gELgcRMxN4w2iuIeVso5/6QymSrgmA==}
-
-  mdast-util-mdx-expression@2.0.1:
-    resolution: {integrity: sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==}
-
-  mdast-util-mdx-jsx@3.2.0:
-    resolution: {integrity: sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==}
+  mdn-data@2.0.28:
+    resolution: {integrity: sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g==}
 
-  mdast-util-mdxjs-esm@2.0.1:
-    resolution: {integrity: sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==}
-
-  mdast-util-phrasing@4.1.0:
-    resolution: {integrity: sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==}
-
-  mdast-util-to-hast@13.2.0:
-    resolution: {integrity: sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==}
-
-  mdast-util-to-markdown@2.1.2:
-    resolution: {integrity: sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==}
-
-  mdast-util-to-string@4.0.0:
-    resolution: {integrity: sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==}
+  mdn-data@2.12.2:
+    resolution: {integrity: sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA==}
 
   media-typer@1.1.0:
     resolution: {integrity: sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==}
@@ -5466,69 +5374,6 @@ packages:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
 
-  micromark-core-commonmark@2.0.3:
-    resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
-
-  micromark-factory-destination@2.0.1:
-    resolution: {integrity: sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==}
-
-  micromark-factory-label@2.0.1:
-    resolution: {integrity: sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==}
-
-  micromark-factory-space@2.0.1:
-    resolution: {integrity: sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==}
-
-  micromark-factory-title@2.0.1:
-    resolution: {integrity: sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==}
-
-  micromark-factory-whitespace@2.0.1:
-    resolution: {integrity: sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==}
-
-  micromark-util-character@2.1.1:
-    resolution: {integrity: sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==}
-
-  micromark-util-chunked@2.0.1:
-    resolution: {integrity: sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==}
-
-  micromark-util-classify-character@2.0.1:
-    resolution: {integrity: sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==}
-
-  micromark-util-combine-extensions@2.0.1:
-    resolution: {integrity: sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==}
-
-  micromark-util-decode-numeric-character-reference@2.0.2:
-    resolution: {integrity: sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==}
-
-  micromark-util-decode-string@2.0.1:
-    resolution: {integrity: sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==}
-
-  micromark-util-encode@2.0.1:
-    resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==}
-
-  micromark-util-html-tag-name@2.0.1:
-    resolution: {integrity: sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==}
-
-  micromark-util-normalize-identifier@2.0.1:
-    resolution: {integrity: sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==}
-
-  micromark-util-resolve-all@2.0.1:
-    resolution: {integrity: sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==}
-
-  micromark-util-sanitize-uri@2.0.1:
-    resolution: {integrity: sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==}
-
-  micromark-util-subtokenize@2.1.0:
-    resolution: {integrity: sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==}
-
-  micromark-util-symbol@2.0.1:
-    resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==}
-
-  micromark-util-types@2.0.2:
-    resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==}
-
-  micromark@4.0.2:
-    resolution: {integrity: sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==}
-
   micromatch@4.0.8:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
@@ -5592,18 +5437,10 @@ packages:
     resolution: {integrity: sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==}
     engines: {node: '>= 8'}
 
-  minipass-collect@2.0.1:
-    resolution: {integrity: sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==}
-    engines: {node: '>=16 || 14 >=14.17'}
-
   minipass-fetch@2.1.2:
     resolution: {integrity: sha512-LT49Zi2/WMROHYoqGgdlQIZh8mLPZmOrN2NdJjMXxYe4nkN6FUyuPuOAOedNJDrx0IRGg9+4guZewtp8hE6TxA==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  minipass-fetch@4.0.1:
-    resolution: {integrity: sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   minipass-flush@1.0.5:
     resolution: {integrity: sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==}
     engines: {node: '>= 8'}
@@ -5632,20 +5469,11 @@ packages:
     resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==}
     engines: {node: '>= 8'}
 
-  minizlib@3.0.2:
-    resolution: {integrity: sha512-oG62iEk+CYt5Xj2YqI5Xi9xWUeZhDI8jjQmC5oThVH5JGCTgIjr7ciJDzC7MBzYd//WvR1OTmP5Q38Q8ShQtVA==}
-    engines: {node: '>= 18'}
-
   mkdirp@1.0.4:
     resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
     engines: {node: '>=10'}
     hasBin: true
 
-  mkdirp@3.0.1:
-    resolution: {integrity: sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   mock-socket@9.3.1:
     resolution: {integrity: sha512-qxBgB7Qa2sEQgHFjj0dSigq7fX4k6Saisd5Nelwp2q8mlbAFh5dHV9JTTlF8viYJLSSWgMCZFUom8PJcMNBoJw==}
     engines: {node: '>= 8'}
@@ -5659,8 +5487,8 @@ packages:
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
-  msw-storybook-addon@2.0.4:
-    resolution: {integrity: sha512-rstO8+r01sRMg6PPP7OxM8LG5/6r4+wmp2uapHeHvm9TQQRHvpPXOU/Y9/Somysz8Oi4Ea1aummXH3JlnP2LIA==}
+  msw-storybook-addon@2.0.5:
+    resolution: {integrity: sha512-uum2gtprDBoUb8GV/rPMwPytHmB8+AUr25BQUY0MpjYey5/ujaew2Edt+4oHiXpLTd0ThyMqmEvGy/sRpDV4lg==}
     peerDependencies:
       msw: ^2.0.0
 
@@ -5707,22 +5535,13 @@ packages:
   node-api-version@0.2.1:
     resolution: {integrity: sha512-2xP/IGGMmmSQpI1+O/k72jF/ykvZ89JeuKX3TLJAYPDVLUalrshrLHkeVcCCZqG/eEa635cr8IBYzgnDvM2O8Q==}
 
-  node-forge@1.3.1:
-    resolution: {integrity: sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==}
+  node-forge@1.3.2:
+    resolution: {integrity: sha512-6xKiQ+cph9KImrRh0VsjH2d8/GXA4FIMlgU4B757iI1ApvcyA9VlouP0yZJha01V+huImO+kKMU7ih+2+E14fw==}
     engines: {node: '>= 6.13.0'}
 
-  node-gyp@11.2.0:
-    resolution: {integrity: sha512-T0S1zqskVUSxcsSTkAsLc7xCycrRYmtDHadDinzocrThjyQCn5kMlEBSj6H4qDbgsIOSLmmlRIeb0lZXj+UArA==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-    hasBin: true
-
   node-int64@0.4.0:
     resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==}
 
-  node-preload@0.2.1:
-    resolution: {integrity: sha512-RM5oyBy45cLEoHqCeh+MNuFAxO0vTFBLskvQbOKnEE7YTTSN4tbN8QWDIPQ6L+WvKsB/qLEGpYe2ZZ9d4W9OIQ==}
-    engines: {node: '>=8'}
-
   node-pty@1.1.0-beta34:
     resolution: {integrity: sha512-RraDtX9RS1G1I5iO7e4YIOIA4arzd4ZVCD4mZr7+szaNupoTg9fxDCRr0EanqS0Qlzgm3PIdHNbPmblJguJuyg==}
 
@@ -5734,11 +5553,6 @@ packages:
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
     hasBin: true
 
-  nopt@8.1.0:
-    resolution: {integrity: sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-    hasBin: true
-
   normalize-path@3.0.0:
     resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
     engines: {node: '>=0.10.0'}
@@ -5751,17 +5565,15 @@ packages:
     resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
     engines: {node: '>=8'}
 
+  nth-check@2.1.1:
+    resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==}
+
   nwsapi@2.2.20:
     resolution: {integrity: sha512-/ieB+mDe4MrrKMT8z+mQL8klXydZWGR5Dowt4RAGKbJ3kIGEx3X4ljUo+6V73IXtUPWgfOlU5B9MlGxFO5T+cA==}
 
   nwsapi@2.2.9:
     resolution: {integrity: sha512-2f3F0SEEer8bBu0dsNCFF50N0cTThV1nWFYcEYFZttdW0lDAoybv9cQoK7X7/68Z89S7FoRrVjP1LPX4XRf9vg==}
 
-  nyc@15.1.0:
-    resolution: {integrity: sha512-jMW04n9SxKdKi1ZMGhvUTHBN0EICCRkHemEoE5jm6mTYcqcdas0ATzgUgejlQUHMvpnOZqGB5Xxsv9KxJW1j8A==}
-    engines: {node: '>=8.9'}
-    hasBin: true
-
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
@@ -5816,10 +5628,6 @@ packages:
     resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
     engines: {node: '>=10'}
 
-  os-homedir@1.0.2:
-    resolution: {integrity: sha512-B5JU3cabzk8c67mRRd3ECmROafjYMXbuzlwtqdM8IbS8ktlTix8aFGb2bAGKrSRIlnfKwovGUUr72JUPyOb6kQ==}
-    engines: {node: '>=0.10.0'}
-
   outvariant@1.4.3:
     resolution: {integrity: sha512-+Sl2UErvtsoajRDKCE5/dBz4DIvHXQQnAxtQTF04OJxY0+DyZXSo5P5Bb7XYWOh81syohlYL24hbDwxedPUJCA==}
 
@@ -5839,6 +5647,10 @@ packages:
     resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
     engines: {node: '>=10'}
 
+  p-limit@4.0.0:
+    resolution: {integrity: sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
   p-locate@4.1.0:
     resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
     engines: {node: '>=8'}
@@ -5847,26 +5659,18 @@ packages:
     resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
     engines: {node: '>=10'}
 
-  p-map@3.0.0:
-    resolution: {integrity: sha512-d3qXVTF/s+W+CdJ5A29wywV2n8CQQYahlgz2bFiA+4eVNJbHJodPZ+/gXwPGh0bOqA+j8S+6+ckmvLGPk1QpxQ==}
-    engines: {node: '>=8'}
+  p-locate@6.0.0:
+    resolution: {integrity: sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
   p-map@4.0.0:
     resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
     engines: {node: '>=10'}
 
-  p-map@7.0.3:
-    resolution: {integrity: sha512-VkndIv2fIB99swvQoA65bm+fsmt6UNdGeIB0oxBs+WhAhdh08QA04JXpI7rbB9r08/nkbysKoya9rtDERYOYMA==}
-    engines: {node: '>=18'}
-
   p-try@2.2.0:
     resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
     engines: {node: '>=6'}
 
-  package-hash@4.0.0:
-    resolution: {integrity: sha512-whdkPIooSu/bASggZ96BWVvZTRMOFxnyUG5PnTSGKoJE2gd5mbVNmR2Nj20QFzxYYgAXpoqC+AiXzl+UMRh7zQ==}
-    engines: {node: '>=8'}
-
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
@@ -5878,17 +5682,10 @@ packages:
     resolution: {integrity: sha512-uo0Z9JJeWzv8BG+tRcapBKNJ0dro9cLyczGzulS6EfeyAdeC9sbojtW6XwvYxJkEne9En+J2XEl4zyglVeIwFg==}
     engines: {node: '>=8'}
 
-  parse-entities@4.0.2:
-    resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==}
-
   parse-json@5.2.0:
     resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
     engines: {node: '>=8'}
 
-  parse-passwd@1.0.0:
-    resolution: {integrity: sha512-1Y1A//QUXEZK7YKz+rD9WydcE1+EuPr6ZBgKecAB8tmoW6UFv0NREVJe1p+jRxtThkcbbKkfwIbWJe/IeE6m2Q==}
-    engines: {node: '>=0.10.0'}
-
   parse5@7.3.0:
     resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
 
@@ -5900,6 +5697,10 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
+  path-exists@5.0.0:
+    resolution: {integrity: sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
   path-is-absolute@1.0.1:
     resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
     engines: {node: '>=0.10.0'}
@@ -5929,6 +5730,10 @@ packages:
     resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
     engines: {node: '>=8'}
 
+  pathval@2.0.1:
+    resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
+    engines: {node: '>= 14.16'}
+
   pe-library@0.4.1:
     resolution: {integrity: sha512-eRWB5LBz7PpDu4PUlwT0PhnQfTQJlDDdPa35urV4Osrm0t0AqQFGn+UIkU3klZvwJ8KPO3VbBFsXquA6p6kqZw==}
     engines: {node: '>=12', npm: '>=6'}
@@ -5959,13 +5764,13 @@ packages:
     resolution: {integrity: sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==}
     engines: {node: '>=8'}
 
-  playwright-core@1.52.0:
-    resolution: {integrity: sha512-l2osTgLXSMeuLZOML9qYODUQoPPnUsKsb5/P6LJ2e6uPKXUdPK5WYhN4z03G+YNbWmGDY4YENauNu4ZKczreHg==}
+  playwright-core@1.56.1:
+    resolution: {integrity: sha512-hutraynyn31F+Bifme+Ps9Vq59hKuUCz7H1kDOcBs+2oGguKkWTU50bBWrtz34OUWmIwpBTWDxaRPXrIXkgvmQ==}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.52.0:
-    resolution: {integrity: sha512-JAwMNMBlxJ2oD1kce4KPtMkDeKGHQstdpFPcPH3maElAXon/QZeTvtsfXmTMRyO9TslfoYOXkSsvao2nE1ilTw==}
+  playwright@1.56.1:
+    resolution: {integrity: sha512-aFi5B0WovBHTEvpM3DzXTUaeN6eN0qWnTkKx4NQaH4Wvcmc153PdaY2UBdSYKaGYw+UyWXSVyxDUg5DoPEttjw==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -5973,10 +5778,6 @@ packages:
     resolution: {integrity: sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ==}
     engines: {node: '>=10.4.0'}
 
-  polished@4.3.1:
-    resolution: {integrity: sha512-OBatVyC/N7SCW/FaDHrSd+vn0o5cS855TOmYi4OkdWUMSJCET/xip//ch8xGUvtr3i44X9LVyWwQlRMTN3pwSA==}
-    engines: {node: '>=10'}
-
   possible-typed-array-names@1.1.0:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
@@ -5996,8 +5797,8 @@ packages:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
 
-  prettier@3.5.3:
-    resolution: {integrity: sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==}
+  prettier@3.7.3:
+    resolution: {integrity: sha512-QgODejq9K3OzoBbuyobZlUhznP5SKwPqp+6Q6xw6o8gnhr4O85L2U915iM2IDcfF2NPXVaM9zlo9tdwipnYwzg==}
     engines: {node: '>=14'}
     hasBin: true
 
@@ -6013,18 +5814,6 @@ packages:
     resolution: {integrity: sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  proc-log@5.0.0:
-    resolution: {integrity: sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
-  process-on-spawn@1.1.0:
-    resolution: {integrity: sha512-JOnOPQ/8TZgjs1JIH/m9ni7FfimjNa/PRx7y/Wb5qdItsnhO0jE4AT7fC0HjC28DUQWDr50dwSYZLdRMlqDq3Q==}
-    engines: {node: '>=8'}
-
-  process@0.11.10:
-    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
-    engines: {node: '>= 0.6.0'}
-
   progress@2.0.3:
     resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
     engines: {node: '>=0.4.0'}
@@ -6048,9 +5837,6 @@ packages:
   prop-types@15.8.1:
     resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
 
-  property-information@7.0.0:
-    resolution: {integrity: sha512-7D/qOz/+Y4X/rzSB6jKxKUsQnphO046ei8qxG59mtM3RG3DHgTK81HrxrmoDVINJb8NKT5ZsRbwHvQ6B68Iyhg==}
-
   protobufjs@7.5.0:
     resolution: {integrity: sha512-Z2E/kOY1QjoMlCytmexzYfDm/w5fKAiRwpSzGtdnXW1zC88Z2yXazHHrOtwCzn+7wSxyE8PYM4rvVcMphF9sOA==}
     engines: {node: '>=12.0.0'}
@@ -6059,9 +5845,6 @@ packages:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
     engines: {node: '>= 0.10'}
 
-  proxy-from-env@1.1.0:
-    resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
-
   psl@1.15.0:
     resolution: {integrity: sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==}
 
@@ -6126,15 +5909,20 @@ packages:
     peerDependencies:
       typescript: '>= 4.3.x'
 
-  react-docgen@7.1.1:
-    resolution: {integrity: sha512-hlSJDQ2synMPKFZOsKo9Hi8WWZTC7POR8EmWvTSjow+VDgKzkmjQvFm2fk0tmRw+f0vTOIYKlarR0iL4996pdg==}
-    engines: {node: '>=16.14.0'}
+  react-docgen@8.0.0:
+    resolution: {integrity: sha512-kmob/FOTwep7DUWf9KjuenKX0vyvChr3oTdvvPt09V60Iz75FJp+T/0ZeHMbAfJj2WaVWqAPP5Hmm3PYzSPPKg==}
+    engines: {node: ^20.9.0 || >=22}
 
   react-dom@19.1.0:
     resolution: {integrity: sha512-Xs1hdnE+DyKgeHJeJznQmYMIBG3TKIHJJT95Q58nHLSrElKlGQqDTR2HQ9fx5CN/Gk6Vh/kupBTDLU11/nDk/g==}
     peerDependencies:
       react: ^19.1.0
 
+  react-error-boundary@6.0.0:
+    resolution: {integrity: sha512-gdlJjD7NWr0IfkPlaREN2d9uUZUlksrfOx7SX62VRerwXbMY6ftGCIZua1VG1aXFNOimhISsTq+Owp725b9SiA==}
+    peerDependencies:
+      react: '>=16.13.1'
+
   react-is@16.13.1:
     resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
 
@@ -6147,12 +5935,6 @@ packages:
   react-is@19.1.0:
     resolution: {integrity: sha512-Oe56aUPnkHyyDxxkvqtd7KkdQP5uIUfHxd5XTb3wE9d/kRnZLmKbDB0GWk919tdQ+mxxPtG6EAs6RMT6i1qtHg==}
 
-  react-markdown@10.1.0:
-    resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
-    peerDependencies:
-      '@types/react': '>=18'
-      react: '>=18'
-
   react-router-dom@5.3.4:
     resolution: {integrity: sha512-m4EqFMHv/Ih4kpcBCONHbkT68KoAeHN4p3lAGoNryfHi0dMy0kCzEZakiKRsvg5wHZ/JLrLW8o8KomWiz/qbYQ==}
     peerDependencies:
@@ -6227,16 +6009,6 @@ packages:
     resolution: {integrity: sha512-cnE+y8bz4NhMjISKbgeVJtqNbtf5QpjZP+Bslo+UqkIt9QPnX9q095eiRRASJG1/tz6dlNr6Z5NsBiWYokp6EQ==}
     hasBin: true
 
-  release-zalgo@1.0.0:
-    resolution: {integrity: sha512-gUAyHVHPPC5wdqX/LG4LWtRYtgjxyX78oanFNTMMyFEfOqdC54s3eE82imuWKbOeqYht2CrNf64Qb8vgmmtZGA==}
-    engines: {node: '>=4'}
-
-  remark-parse@11.0.0:
-    resolution: {integrity: sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==}
-
-  remark-rehype@11.1.1:
-    resolution: {integrity: sha512-g/osARvjkBXb6Wo0XvAeXQohVta8i84ACbenPpoSsxTOQH/Ae0/RGP4WZgnMH5pMLpsj4FG7OHmcIcXxpza8eQ==}
-
   repeat-string@1.6.1:
     resolution: {integrity: sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==}
     engines: {node: '>=0.10'}
@@ -6249,9 +6021,6 @@ packages:
     resolution: {integrity: sha512-gAZ+kLqBdHarXB64XpAe2VCjB7rIRv+mU8tfRWziHRJ5umKsIHN2tLLv6EtMw7WCdP19S0ERVMldNvxYCHnhSQ==}
     engines: {node: '>=8.6.0'}
 
-  require-main-filename@2.0.0:
-    resolution: {integrity: sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==}
-
   requireindex@1.2.0:
     resolution: {integrity: sha512-L9jEkOi3ASd9PYit2cwRfyppc9NoABujTP8/5gFcbERmo5jUoAKovIC3fsF17pkTnGsrByysqX+Kxd2OTNI1ww==}
     engines: {node: '>=0.10.5'}
@@ -6270,10 +6039,6 @@ packages:
     resolution: {integrity: sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
     engines: {node: '>=8'}
 
-  resolve-dir@0.1.1:
-    resolution: {integrity: sha512-QxMPqI6le2u0dCLyiGzgy92kjkkL6zO0XyvHzjdTNH3zM6e5Hz3BwG6+aEyNgiQ5Xz6PwTwgQEj3U50dByPKIA==}
-    engines: {node: '>=0.10.0'}
-
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -6353,9 +6118,6 @@ packages:
   run-parallel@1.2.0:
     resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
 
-  rxjs@7.8.2:
-    resolution: {integrity: sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==}
-
   safe-array-concat@1.1.3:
     resolution: {integrity: sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q==}
     engines: {node: '>=0.4'}
@@ -6402,8 +6164,8 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.7.1:
-    resolution: {integrity: sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==}
+  semver@7.7.2:
+    resolution: {integrity: sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -6419,9 +6181,6 @@ packages:
     resolution: {integrity: sha512-61g9pCh0Vnh7IutZjtLGGpTA355+OPn2TyDv/6ivP2h/AdAVX9azsoxmg2/M6nZeQZNYBEwIcsne1mJd9oQItQ==}
     engines: {node: '>= 18'}
 
-  set-blocking@2.0.0:
-    resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
-
   set-function-length@1.2.2:
     resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
     engines: {node: '>= 0.4'}
@@ -6488,10 +6247,6 @@ packages:
     resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
     engines: {node: '>=8'}
 
-  slash@5.1.0:
-    resolution: {integrity: sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==}
-    engines: {node: '>=14.16'}
-
   slice-ansi@3.0.0:
     resolution: {integrity: sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==}
     engines: {node: '>=8'}
@@ -6504,10 +6259,6 @@ packages:
     resolution: {integrity: sha512-Fgl0YPZ902wEsAyiQ+idGd1A7rSFx/ayC1CQVMw5P+EQx2V0SgpGtf6OKFhVjPflPUl9YMmEOnmfjCdMUsygww==}
     engines: {node: '>= 10'}
 
-  socks-proxy-agent@8.0.5:
-    resolution: {integrity: sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==}
-    engines: {node: '>= 14'}
-
   socks@2.8.4:
     resolution: {integrity: sha512-D3YaD0aRxR3mEcqnidIs7ReYJFVzWdd6fXJYUM8ixcQcJRGTka/b3saV0KflYhyVJXKhb947GndU35SxYNResQ==}
     engines: {node: '>= 10.0.0', npm: '>= 3.0.0'}
@@ -6534,16 +6285,6 @@ packages:
     resolution: {integrity: sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==}
     engines: {node: '>= 8'}
 
-  space-separated-tokens@2.0.2:
-    resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
-
-  spawn-wrap@2.0.0:
-    resolution: {integrity: sha512-EeajNjfN9zMnULLwhZZQU3GWBoFNkbngTUPfaawT4RkMiviTxcX0qfhVbGey39mfctfDHkWtuecgQ8NJcyQWHg==}
-    engines: {node: '>=8'}
-
-  spawnd@5.0.0:
-    resolution: {integrity: sha512-28+AJr82moMVWolQvlAIv3JcYDkjkFTEmfDc503wxrF5l2rQ3dFz6DpbXp3kD4zmgGGldfM4xM4v1sFj/ZaIOA==}
-
   split2@4.2.0:
     resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
     engines: {node: '>= 10.x'}
@@ -6554,10 +6295,6 @@ packages:
   sprintf-js@1.1.3:
     resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==}
 
-  ssri@12.0.0:
-    resolution: {integrity: sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   ssri@9.0.1:
     resolution: {integrity: sha512-o57Wcn66jMQvfHG1FlYbWeZWW/dHZhJXjpIcTfXldXEk5nz5lStPo3mK0OJQfGR3RbZUlbISexbljkJzuEj/8Q==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
@@ -6577,8 +6314,8 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
-  storybook@8.6.12:
-    resolution: {integrity: sha512-Z/nWYEHBTLK1ZBtAWdhxC0l5zf7ioJ7G4+zYqtTdYeb67gTnxNj80gehf8o8QY9L2zA2+eyMRGLC2V5fI7Z3Tw==}
+  storybook@9.1.17:
+    resolution: {integrity: sha512-kfr6kxQAjA96ADlH6FMALJwJ+eM80UqXy106yVHNgdsAP/CdzkkicglRAhZAvUycXK9AeadF6KZ00CWLtVMN4w==}
     hasBin: true
     peerDependencies:
       prettier: ^2 || ^3
@@ -6596,10 +6333,6 @@ packages:
     resolution: {integrity: sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==}
     engines: {node: '>=10'}
 
-  string-length@5.0.1:
-    resolution: {integrity: sha512-9Ep08KAMUn0OadnVaBuRdE2l615CQ508kr0XMadjClfYpdCyvrbFp6Taebo8yyxokQ4viUd/xPPUA4FGgUa0ow==}
-    engines: {node: '>=12.20'}
-
   string-width@4.2.3:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
     engines: {node: '>=8'}
@@ -6630,9 +6363,6 @@ packages:
   string_decoder@1.3.0:
     resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
 
-  stringify-entities@4.0.4:
-    resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
-
   strip-ansi@6.0.1:
     resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
     engines: {node: '>=8'}
@@ -6668,12 +6398,6 @@ packages:
   style-mod@4.1.2:
     resolution: {integrity: sha512-wnD1HyVqpJUI2+eKZ+eo1UwghftP6yuFheBqqe+bWCotBjC2K1YnteJILRMs3SM4V/0dLEW1SC27MWP5y+mwmw==}
 
-  style-to-js@1.1.16:
-    resolution: {integrity: sha512-/Q6ld50hKYPH3d/r6nr117TZkHR0w0kGGIVfpG9N6D8NymRPM9RqCUv4pRpJ62E5DqOYx2AFpbZMyCPnjQCnOw==}
-
-  style-to-object@1.0.8:
-    resolution: {integrity: sha512-xT47I/Eo0rwJmaXC4oilDGDWLohVhR6o/xAQcPQN8q6QBuZVL8qMYL85kLmST5cPjAorwvqIA4qXTRQoYHaL6g==}
-
   styled-components@6.1.18:
     resolution: {integrity: sha512-Mvf3gJFzZCkhjY2Y/Fx9z1m3dxbza0uI9H1CbNZm/jSHCojzJhQ0R7bByrlFJINnMzz/gPulpoFFGymNwrsMcw==}
     engines: {node: '>= 16'}
@@ -6694,10 +6418,6 @@ packages:
     resolution: {integrity: sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg==}
     engines: {node: '>= 8.0'}
 
-  supports-color@5.5.0:
-    resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
-    engines: {node: '>=4'}
-
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
@@ -6710,14 +6430,19 @@ packages:
     resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
     engines: {node: '>= 0.4'}
 
+  svgo@4.0.0:
+    resolution: {integrity: sha512-VvrHQ+9uniE+Mvx3+C9IEe/lWasXCU0nXMY2kZeLrHNICuRiC8uMPyM14UEaMOFA5mhyQqEkB02VoQ16n3DLaw==}
+    engines: {node: '>=16'}
+    hasBin: true
+
   symbol-tree@3.2.4:
     resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
 
   tabbable@6.2.0:
     resolution: {integrity: sha512-Cat63mxsVJlzYvN51JmVXIgNoUokrIaT2zLclCXjRd8boZ0004U4KCs/sToJ75C6sdlByWxpYnb5Boif1VSFew==}
 
-  tar-fs@3.0.8:
-    resolution: {integrity: sha512-ZoROL70jptorGAlgAYiLoBLItEKw/fUxg9BSYK/dF/GAGYFJOJJJMvjPAKDJraCXFwadD456FCuvLWgfhMsPwg==}
+  tar-fs@3.1.1:
+    resolution: {integrity: sha512-LZA0oaPOc2fVo82Txf3gw+AkEd38szODlptMYejQUhndHMLQ9M059uXR+AfS7DNo0NpINvSqDsvyaCrBVkptWg==}
 
   tar-stream@3.1.7:
     resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==}
@@ -6726,10 +6451,6 @@ packages:
     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
     engines: {node: '>=10'}
 
-  tar@7.4.3:
-    resolution: {integrity: sha512-5S7Va8hKfV7W5U6g3aYxXmlPoZVAwUMy9AOKyF2fVuZa2UD3qZjg578OrLRt8PcNN1PleVaL/5/yYATNL0ICUw==}
-    engines: {node: '>=18'}
-
   temp-file@3.4.0:
     resolution: {integrity: sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg==}
 
@@ -6749,6 +6470,9 @@ packages:
   tiny-invariant@1.3.3:
     resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
 
+  tiny-typed-emitter@2.1.0:
+    resolution: {integrity: sha512-qVtvMxeXbVej0cQWKqVSSAHmKZEHAvxdF8HEUBFWts8h+xEo5m/lEiPakuyZ3BnCBjOD8i24kzNOiOLLgsSxhA==}
+
   tiny-warning@1.0.3:
     resolution: {integrity: sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA==}
 
@@ -6756,6 +6480,14 @@ packages:
     resolution: {integrity: sha512-mEwzpUgrLySlveBwEVDMKk5B57bhLPYovRfPAXD5gA/98Opn0rCDj3GtLwFvCvH5RK9uPCExUROW5NjDwvqkxw==}
     engines: {node: '>=12.0.0'}
 
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
+    engines: {node: '>=14.0.0'}
+
+  tinyspy@4.0.3:
+    resolution: {integrity: sha512-t2T/WLB2WRgZ9EpE4jgPJ9w+i66UZfDc8wHh0xrwiRNN+UwH98GIJkTeZqX9rg0i0ptwzqW+uYeIF0T4F8LR7A==}
+    engines: {node: '>=14.0.0'}
+
   tldts-core@6.1.86:
     resolution: {integrity: sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==}
 
@@ -6766,8 +6498,8 @@ packages:
   tmp-promise@3.0.3:
     resolution: {integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==}
 
-  tmp@0.2.3:
-    resolution: {integrity: sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==}
+  tmp@0.2.4:
+    resolution: {integrity: sha512-UdiSoX6ypifLmrfQ/XfiawN6hkjSBpCjhKxxZcWlUUmoXLaCKQU0bx4HF/tdDK2uzRuchf1txGvrWBzYREssoQ==}
     engines: {node: '>=14.14'}
 
   tmpl@1.0.5:
@@ -6797,19 +6529,9 @@ packages:
     resolution: {integrity: sha512-IUWnUK7ADYR5Sl1fZlO1INDUhVhatWl7BtJWsIhwJ0UAK7ilzzIa8uIqOO/aYVWHZPJkKbEL+362wrzoeRF7bw==}
     engines: {node: '>=18'}
 
-  tree-kill@1.2.2:
-    resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
-    hasBin: true
-
-  trim-lines@3.0.1:
-    resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==}
-
   triple-beam@1.3.0:
     resolution: {integrity: sha512-XrHUvV5HpdLmIj4uVMxHggLbFSZYIn7HEWsqePZcI50pco+MPqJ50wMGY794X7AOOhxOBAjbkqfAbEe/QMp2Lw==}
 
-  trough@2.2.0:
-    resolution: {integrity: sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==}
-
   truncate-utf8-bytes@1.0.2:
     resolution: {integrity: sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==}
 
@@ -6859,14 +6581,6 @@ packages:
     resolution: {integrity: sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==}
     engines: {node: '>=10'}
 
-  type-fest@0.8.1:
-    resolution: {integrity: sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==}
-    engines: {node: '>=8'}
-
-  type-fest@2.19.0:
-    resolution: {integrity: sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==}
-    engines: {node: '>=12.20'}
-
   type-fest@4.41.0:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
@@ -6891,9 +6605,6 @@ packages:
     resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==}
     engines: {node: '>= 0.4'}
 
-  typedarray-to-buffer@3.1.5:
-    resolution: {integrity: sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==}
-
   typescript-eslint@8.32.0:
     resolution: {integrity: sha512-UMq2kxdXCzinFFPsXc9o2ozIpYCCOiEC46MG3yEh5Vipq6BO27otTtEBZA1fQ66DulEUgE97ucQ/3YY66CPg0A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -6929,40 +6640,18 @@ packages:
     resolution: {integrity: sha512-6t3foTQI9qne+OZoVQB/8x8rk2k1eVy1gRXhV3oFQ5T6R1dqQ1xtin3XqSlx3+ATBkliTaR/hHyJBm+LVPNM8w==}
     engines: {node: '>=4'}
 
-  unified@11.0.5:
-    resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==}
+  unicorn-magic@0.1.0:
+    resolution: {integrity: sha512-lRfVq8fE8gz6QMBuDM6a+LO3IAzTi05H6gCVaUpir2E1Rwpo4ZUog45KpNXKC/Mn3Yb9UDuHumeFTo9iV/D9FQ==}
+    engines: {node: '>=18'}
 
   unique-filename@2.0.1:
     resolution: {integrity: sha512-ODWHtkkdx3IAR+veKxFV+VBkUMcN+FaqzUUd7IZzt+0zhDZFPFxhlqwPF3YQvMHx1TD0tdgYl+kuPnJ8E6ql7A==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  unique-filename@4.0.0:
-    resolution: {integrity: sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
   unique-slug@3.0.0:
     resolution: {integrity: sha512-8EyMynh679x/0gqE9fT9oilG+qEt+ibFyqjuVTsZn1+CMxH+XLlpvr2UZx4nVcCwTpx81nICr2JQFkM+HPLq4w==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
 
-  unique-slug@5.0.0:
-    resolution: {integrity: sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==}
-    engines: {node: ^18.17.0 || >=20.5.0}
-
-  unist-util-is@6.0.0:
-    resolution: {integrity: sha512-2qCTHimwdxLfz+YzdGfkqNlH0tLi9xjTnHddPmJwtIG9MGsdbutfTc4P+haPD7l7Cjxf/WZj+we5qfVPvvxfYw==}
-
-  unist-util-position@5.0.0:
-    resolution: {integrity: sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==}
-
-  unist-util-stringify-position@4.0.0:
-    resolution: {integrity: sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==}
-
-  unist-util-visit-parents@6.0.1:
-    resolution: {integrity: sha512-L/PqWzfTP9lzzEa6CKs0k2nARxTdZduw3zyh8d2NVBnsyvHjSX4TWse388YrrQKbvI8w20fGjGlhgT96WwKykw==}
-
-  unist-util-visit@5.0.0:
-    resolution: {integrity: sha512-MR04uvD+07cwl/yhVuVWAtw+3GOR/knlL55Nd/wAdblk27GCVt3lqpTivy/tkJcZoNPzTwS1Y+KMojlLDhoTzg==}
-
   universalify@0.1.2:
     resolution: {integrity: sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==}
     engines: {node: '>= 4.0.0'}
@@ -7010,23 +6699,18 @@ packages:
       '@types/react':
         optional: true
 
+  usehooks-ts@3.1.1:
+    resolution: {integrity: sha512-I4diPp9Cq6ieSUH2wu+fDAVQO43xwtulo+fKEidHUwZPnYImbtkTjzIJYcDcJqxgmX31GVqNFURodvcgHcW0pA==}
+    engines: {node: '>=16.15.0'}
+    peerDependencies:
+      react: ^16.8.0  || ^17 || ^18 || ^19 || ^19.0.0-rc
+
   utf8-byte-length@1.0.5:
     resolution: {integrity: sha512-Xn0w3MtiQ6zoz2vFyUVruaCL53O/DwUvkEeOvj+uulMm0BkUGYWmBYVyElqZaSLhY6ZD0ulfU3aBra2aVT4xfA==}
 
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  util@0.12.5:
-    resolution: {integrity: sha512-kZf/K6hEIrWHI6XqOFUiiMa+79wE/D8Q+NCNAWclkyg3b4d2k7s0QGepNjiABc+aR3N1PAyHL7p6UcLY6LmrnA==}
-
-  uuid@8.3.2:
-    resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
-    hasBin: true
-
-  uuid@9.0.1:
-    resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
-    hasBin: true
-
   v8-to-istanbul@9.1.3:
     resolution: {integrity: sha512-9lDD+EVI2fjFsMWXc6dy5JJzBsVTcQ2fVkfBvncZ6xJWG9wtBhOldG+mHkSL0+V1K/xgZz0JDO5UT5hFwHUghg==}
     engines: {node: '>=10.12.0'}
@@ -7042,11 +6726,10 @@ packages:
     resolution: {integrity: sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==}
     engines: {node: '>=0.6.0'}
 
-  vfile-message@4.0.2:
-    resolution: {integrity: sha512-jRDZ1IMLttGj41KcZvlrYAaI3CfqpLpfpf+Mfig13viT6NKvRzWZ+lXz0Y5D60w6uJIBAOGq9mSHf0gktF0duw==}
-
-  vfile@6.0.3:
-    resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
+  vite-plugin-compression@0.5.1:
+    resolution: {integrity: sha512-5QJKBDc+gNYVqL/skgFAP81Yuzo9R+EAf19d+EtsMF/i8kFUpNi3J/H01QD3Oo8zBQn+NzoCIFkpPLynoOzaJg==}
+    peerDependencies:
+      vite: '>=2.0.0'
 
   vite-plugin-wasm@3.4.1:
     resolution: {integrity: sha512-ja3nSo2UCkVeitltJGkS3pfQHAanHv/DqGatdI39ja6McgABlpsZ5hVgl6wuR8Qx5etY3T5qgDQhOWzc5RReZA==}
@@ -7118,16 +6801,6 @@ packages:
     resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
     engines: {node: '>=18'}
 
-  wait-on@7.2.0:
-    resolution: {integrity: sha512-wCQcHkRazgjG5XoAq9jbTMLpNIjoSlZslrJ2+N9MxDsGEv1HnFoVjOCexL0ESva7Y9cu350j+DWADdk54s4AFQ==}
-    engines: {node: '>=12.0.0'}
-    hasBin: true
-
-  wait-port@0.2.14:
-    resolution: {integrity: sha512-kIzjWcr6ykl7WFbZd0TMae8xovwqcqbx6FM9l+7agOgUByhzdjfzZBPK2CPufldTOMxbUivss//Sh9MFawmPRQ==}
-    engines: {node: '>=8'}
-    hasBin: true
-
   walker@1.0.8:
     resolution: {integrity: sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==}
 
@@ -7180,17 +6853,10 @@ packages:
     resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
     engines: {node: '>= 0.4'}
 
-  which-module@2.0.1:
-    resolution: {integrity: sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
-
   which-typed-array@1.1.19:
     resolution: {integrity: sha512-rEvr90Bck4WZt9HHFC4DJMsjvu7x+r6bImz0/BrbWb7A2djJ8hnZMrWnHo9F8ssv0OMErasDhftrfROTyqSDrw==}
     engines: {node: '>= 0.4'}
 
-  which@1.3.1:
-    resolution: {integrity: sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==}
-    hasBin: true
-
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
@@ -7228,9 +6894,6 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  write-file-atomic@3.0.3:
-    resolution: {integrity: sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==}
-
   write-file-atomic@4.0.2:
     resolution: {integrity: sha512-7KxauUdBmSdWnmpaGFg+ppNjKF8uNLry8LyzjauQDOVONfFLNKrKvQOxZ/VuTIcS/gge/YNahf5RIIQWTSarlg==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
@@ -7259,9 +6922,6 @@ packages:
     resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
     engines: {node: '>=18'}
 
-  xml@1.0.1:
-    resolution: {integrity: sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw==}
-
   xmlbuilder@15.1.1:
     resolution: {integrity: sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==}
     engines: {node: '>=8.0'}
@@ -7269,9 +6929,6 @@ packages:
   xmlchars@2.2.0:
     resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
 
-  y18n@4.0.3:
-    resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
-
   y18n@5.0.8:
     resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
     engines: {node: '>=10'}
@@ -7282,10 +6939,6 @@ packages:
   yallist@4.0.0:
     resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
 
-  yallist@5.0.0:
-    resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
-    engines: {node: '>=18'}
-
   yaml@1.10.2:
     resolution: {integrity: sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==}
     engines: {node: '>= 6'}
@@ -7295,18 +6948,10 @@ packages:
     engines: {node: '>= 14'}
     hasBin: true
 
-  yargs-parser@18.1.3:
-    resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
-    engines: {node: '>=6'}
-
   yargs-parser@21.1.1:
     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
     engines: {node: '>=12'}
 
-  yargs@15.4.1:
-    resolution: {integrity: sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
-    engines: {node: '>=8'}
-
   yargs@17.7.2:
     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
     engines: {node: '>=12'}
@@ -7318,6 +6963,10 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
+  yocto-queue@1.2.1:
+    resolution: {integrity: sha512-AyeEbWOu/TAXdxlV9wmGcR0+yh2j3vYPGOECcIj2S7MkrLyC7ne+oye2BKTItt0ii2PHk4cDy+95+LshzbXnGg==}
+    engines: {node: '>=12.20'}
+
   yoctocolors-cjs@2.1.2:
     resolution: {integrity: sha512-cYVsTjKl8b+FrnidjibDWskAv7UKOfcwaVZdp/it9n1s9fU3IkgDbhdIRKCW4JDsAlECJY0ytoVPT3sK6kideA==}
     engines: {node: '>=18'}
@@ -7330,12 +6979,12 @@ packages:
   zod@3.24.4:
     resolution: {integrity: sha512-OdqJE9UDRPwWsrHjLN2F8bPxvwJBK22EHLWtanu0LSYr5YqzsaaW3RMgmjwr8Rypg5k+meEJdSPXJZXE/yqOMg==}
 
+  zod@4.1.5:
+    resolution: {integrity: sha512-rcUUZqlLJgBC33IT3PNMgsCq6TzLQEG/Ei/KTCU0PedSWRMAXoOUN+4t/0H+Q8bdnLPdqUYnvboJT0bn/229qg==}
+
   zone.js@0.15.0:
     resolution: {integrity: sha512-9oxn0IIjbCZkJ67L+LkhYWRyAy7axphb3VgE2MBDlOqnmHMPWGYMxJxBYFueFq/JGY2GMwS0rU+UCLunEmy5UA==}
 
-  zwitch@2.0.4:
-    resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
-
 snapshots:
 
   7zip-bin@5.2.0: {}
@@ -7383,6 +7032,26 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/core@7.28.3':
+    dependencies:
+      '@ampproject/remapping': 2.3.0
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.28.3
+      '@babel/helper-compilation-targets': 7.27.2
+      '@babel/helper-module-transforms': 7.28.3(@babel/core@7.28.3)
+      '@babel/helpers': 7.28.3
+      '@babel/parser': 7.28.3
+      '@babel/template': 7.27.2
+      '@babel/traverse': 7.28.3
+      '@babel/types': 7.28.2
+      convert-source-map: 2.0.0
+      debug: 4.4.0
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/generator@7.27.1':
     dependencies:
       '@babel/parser': 7.27.1
@@ -7391,6 +7060,14 @@ snapshots:
       '@jridgewell/trace-mapping': 0.3.25
       jsesc: 3.1.0
 
+  '@babel/generator@7.28.3':
+    dependencies:
+      '@babel/parser': 7.28.3
+      '@babel/types': 7.28.2
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.30
+      jsesc: 3.1.0
+
   '@babel/helper-annotate-as-pure@7.27.1':
     dependencies:
       '@babel/types': 7.27.1
@@ -7434,6 +7111,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/helper-globals@7.28.0': {}
+
   '@babel/helper-member-expression-to-functions@7.27.1':
     dependencies:
       '@babel/traverse': 7.27.1
@@ -7457,6 +7136,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/helper-module-transforms@7.28.3(@babel/core@7.28.3)':
+    dependencies:
+      '@babel/core': 7.28.3
+      '@babel/helper-module-imports': 7.27.1
+      '@babel/helper-validator-identifier': 7.27.1
+      '@babel/traverse': 7.28.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/helper-optimise-call-expression@7.27.1':
     dependencies:
       '@babel/types': 7.27.1
@@ -7507,10 +7195,19 @@ snapshots:
       '@babel/template': 7.27.1
       '@babel/types': 7.27.1
 
+  '@babel/helpers@7.28.3':
+    dependencies:
+      '@babel/template': 7.27.2
+      '@babel/types': 7.28.2
+
   '@babel/parser@7.27.1':
     dependencies:
       '@babel/types': 7.27.1
 
+  '@babel/parser@7.28.3':
+    dependencies:
+      '@babel/types': 7.28.2
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.27.1(@babel/core@7.27.1)':
     dependencies:
       '@babel/core': 7.27.1
@@ -7651,6 +7348,11 @@ snapshots:
       '@babel/core': 7.27.1
       '@babel/helper-plugin-utils': 7.27.1
 
+  '@babel/plugin-transform-arrow-functions@7.27.1(@babel/core@7.28.3)':
+    dependencies:
+      '@babel/core': 7.28.3
+      '@babel/helper-plugin-utils': 7.27.1
+
   '@babel/plugin-transform-async-generator-functions@7.27.1(@babel/core@7.27.1)':
     dependencies:
       '@babel/core': 7.27.1
@@ -8118,6 +7820,12 @@ snapshots:
       '@babel/parser': 7.27.1
       '@babel/types': 7.27.1
 
+  '@babel/template@7.27.2':
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      '@babel/parser': 7.28.3
+      '@babel/types': 7.28.2
+
   '@babel/traverse@7.27.1':
     dependencies:
       '@babel/code-frame': 7.27.1
@@ -8130,11 +7838,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/traverse@7.28.3':
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.28.3
+      '@babel/helper-globals': 7.28.0
+      '@babel/parser': 7.28.3
+      '@babel/template': 7.27.2
+      '@babel/types': 7.28.2
+      debug: 4.4.0
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/types@7.27.1':
     dependencies:
       '@babel/helper-string-parser': 7.27.1
       '@babel/helper-validator-identifier': 7.27.1
 
+  '@babel/types@7.28.2':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.27.1
+
   '@bcoe/v8-coverage@0.2.3': {}
 
   '@bundled-es-modules/cookie@2.0.1':
@@ -8492,7 +8217,7 @@ snapshots:
       make-fetch-happen: 10.2.1
       nopt: 6.0.0
       proc-log: 2.0.1
-      semver: 7.7.1
+      semver: 7.7.2
       tar: 6.2.1
       which: 2.0.2
     transitivePeerDependencies:
@@ -8507,13 +8232,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@electron/notarize@3.0.1':
-    dependencies:
-      debug: 4.4.0
-      promise-retry: 2.0.1
-    transitivePeerDependencies:
-      - supports-color
-
   '@electron/osx-sign@1.3.1':
     dependencies:
       compare-version: 0.1.2
@@ -8538,7 +8256,7 @@ snapshots:
       node-api-version: 0.2.1
       ora: 5.4.1
       read-binary-file-arch: 1.0.6
-      semver: 7.7.1
+      semver: 7.7.2
       tar: 6.2.1
       yargs: 17.7.2
     transitivePeerDependencies:
@@ -8636,78 +8354,156 @@ snapshots:
   '@esbuild/aix-ppc64@0.25.4':
     optional: true
 
+  '@esbuild/aix-ppc64@0.25.9':
+    optional: true
+
   '@esbuild/android-arm64@0.25.4':
     optional: true
 
+  '@esbuild/android-arm64@0.25.9':
+    optional: true
+
   '@esbuild/android-arm@0.25.4':
     optional: true
 
+  '@esbuild/android-arm@0.25.9':
+    optional: true
+
   '@esbuild/android-x64@0.25.4':
     optional: true
 
+  '@esbuild/android-x64@0.25.9':
+    optional: true
+
   '@esbuild/darwin-arm64@0.25.4':
     optional: true
 
+  '@esbuild/darwin-arm64@0.25.9':
+    optional: true
+
   '@esbuild/darwin-x64@0.25.4':
     optional: true
 
+  '@esbuild/darwin-x64@0.25.9':
+    optional: true
+
   '@esbuild/freebsd-arm64@0.25.4':
     optional: true
 
+  '@esbuild/freebsd-arm64@0.25.9':
+    optional: true
+
   '@esbuild/freebsd-x64@0.25.4':
     optional: true
 
+  '@esbuild/freebsd-x64@0.25.9':
+    optional: true
+
   '@esbuild/linux-arm64@0.25.4':
     optional: true
 
+  '@esbuild/linux-arm64@0.25.9':
+    optional: true
+
   '@esbuild/linux-arm@0.25.4':
     optional: true
 
+  '@esbuild/linux-arm@0.25.9':
+    optional: true
+
   '@esbuild/linux-ia32@0.25.4':
     optional: true
 
+  '@esbuild/linux-ia32@0.25.9':
+    optional: true
+
   '@esbuild/linux-loong64@0.25.4':
     optional: true
 
+  '@esbuild/linux-loong64@0.25.9':
+    optional: true
+
   '@esbuild/linux-mips64el@0.25.4':
     optional: true
 
+  '@esbuild/linux-mips64el@0.25.9':
+    optional: true
+
   '@esbuild/linux-ppc64@0.25.4':
     optional: true
 
+  '@esbuild/linux-ppc64@0.25.9':
+    optional: true
+
   '@esbuild/linux-riscv64@0.25.4':
     optional: true
 
+  '@esbuild/linux-riscv64@0.25.9':
+    optional: true
+
   '@esbuild/linux-s390x@0.25.4':
     optional: true
 
+  '@esbuild/linux-s390x@0.25.9':
+    optional: true
+
   '@esbuild/linux-x64@0.25.4':
     optional: true
 
+  '@esbuild/linux-x64@0.25.9':
+    optional: true
+
   '@esbuild/netbsd-arm64@0.25.4':
     optional: true
 
+  '@esbuild/netbsd-arm64@0.25.9':
+    optional: true
+
   '@esbuild/netbsd-x64@0.25.4':
     optional: true
 
+  '@esbuild/netbsd-x64@0.25.9':
+    optional: true
+
   '@esbuild/openbsd-arm64@0.25.4':
     optional: true
 
+  '@esbuild/openbsd-arm64@0.25.9':
+    optional: true
+
   '@esbuild/openbsd-x64@0.25.4':
     optional: true
 
+  '@esbuild/openbsd-x64@0.25.9':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.9':
+    optional: true
+
   '@esbuild/sunos-x64@0.25.4':
     optional: true
 
+  '@esbuild/sunos-x64@0.25.9':
+    optional: true
+
   '@esbuild/win32-arm64@0.25.4':
     optional: true
 
+  '@esbuild/win32-arm64@0.25.9':
+    optional: true
+
   '@esbuild/win32-ia32@0.25.4':
     optional: true
 
+  '@esbuild/win32-ia32@0.25.9':
+    optional: true
+
   '@esbuild/win32-x64@0.25.4':
     optional: true
 
+  '@esbuild/win32-x64@0.25.9':
+    optional: true
+
   '@eslint-community/eslint-utils@4.7.0(eslint@9.26.0)':
     dependencies:
       eslint: 9.26.0
@@ -8737,7 +8533,7 @@ snapshots:
       globals: 14.0.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.1.0
+      js-yaml: 4.1.1
       minimatch: 3.1.2
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
@@ -8761,7 +8557,7 @@ snapshots:
       '@floating-ui/core': 1.7.0
       '@floating-ui/utils': 0.2.9
 
-  '@floating-ui/react-dom@2.1.2(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+  '@floating-ui/react-dom@2.1.3(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
     dependencies:
       '@floating-ui/dom': 1.7.0
       react: 19.1.0
@@ -8769,7 +8565,7 @@ snapshots:
 
   '@floating-ui/react@0.27.8(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.2(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@floating-ui/react-dom': 2.1.3(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
       '@floating-ui/utils': 0.2.9
       react: 19.1.0
       react-dom: 19.1.0(react@19.1.0)
@@ -8791,12 +8587,6 @@ snapshots:
       protobufjs: 7.5.0
       yargs: 17.7.2
 
-  '@hapi/hoek@9.3.0': {}
-
-  '@hapi/topo@5.1.0':
-    dependencies:
-      '@hapi/hoek': 9.3.0
-
   '@humanfs/core@0.19.1': {}
 
   '@humanfs/node@0.16.6':
@@ -8810,14 +8600,14 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.2': {}
 
-  '@ianvs/prettier-plugin-sort-imports@4.4.1(prettier@3.5.3)':
+  '@ianvs/prettier-plugin-sort-imports@4.4.1(prettier@3.7.3)':
     dependencies:
       '@babel/generator': 7.27.1
       '@babel/parser': 7.27.1
       '@babel/traverse': 7.27.1
       '@babel/types': 7.27.1
-      prettier: 3.5.3
-      semver: 7.7.1
+      prettier: 3.7.3
+      semver: 7.7.2
     transitivePeerDependencies:
       - supports-color
 
@@ -8856,16 +8646,12 @@ snapshots:
       wrap-ansi: 8.1.0
       wrap-ansi-cjs: wrap-ansi@7.0.0
 
-  '@isaacs/fs-minipass@4.0.1':
-    dependencies:
-      minipass: 7.1.2
-
   '@istanbuljs/load-nyc-config@1.1.0':
     dependencies:
       camelcase: 5.3.1
       find-up: 4.1.0
       get-package-type: 0.1.0
-      js-yaml: 3.14.1
+      js-yaml: 3.14.2
       resolve-from: 5.0.0
 
   '@istanbuljs/schema@0.1.3': {}
@@ -8914,10 +8700,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  '@jest/create-cache-key-function@29.7.0':
-    dependencies:
-      '@jest/types': 29.6.3
-
   '@jest/environment@29.7.0':
     dependencies:
       '@jest/fake-timers': 29.7.0
@@ -9036,15 +8818,20 @@ snapshots:
       '@types/yargs': 17.0.33
       chalk: 4.1.2
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.5.0(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
     dependencies:
-      glob: 10.4.5
-      magic-string: 0.27.0
+      glob: 10.5.0
+      magic-string: 0.30.17
       react-docgen-typescript: 2.2.2(typescript@5.8.3)
       vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
     optionalDependencies:
       typescript: 5.8.3
 
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.0
+      '@jridgewell/trace-mapping': 0.3.30
+
   '@jridgewell/gen-mapping@0.3.8':
     dependencies:
       '@jridgewell/set-array': 1.2.1
@@ -9062,6 +8849,11 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.0
 
+  '@jridgewell/trace-mapping@0.3.30':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.0
+
   '@js-sdsl/ordered-map@4.4.2': {}
 
   '@lezer/common@1.2.3': {}
@@ -9253,24 +9045,10 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.19.1
 
-  '@npmcli/agent@3.0.0':
-    dependencies:
-      agent-base: 7.1.3
-      http-proxy-agent: 7.0.2
-      https-proxy-agent: 7.0.6
-      lru-cache: 10.4.3
-      socks-proxy-agent: 8.0.5
-    transitivePeerDependencies:
-      - supports-color
-
   '@npmcli/fs@2.1.2':
     dependencies:
       '@gar/promisify': 1.1.3
-      semver: 7.7.1
-
-  '@npmcli/fs@4.0.0':
-    dependencies:
-      semver: 7.7.1
+      semver: 7.7.2
 
   '@npmcli/move-file@2.0.1':
     dependencies:
@@ -9385,7 +9163,7 @@ snapshots:
       '@types/shimmer': 1.2.0
       import-in-the-middle: 1.13.1
       require-in-the-middle: 7.5.2
-      semver: 7.7.1
+      semver: 7.7.2
       shimmer: 1.2.1
     transitivePeerDependencies:
       - supports-color
@@ -9613,14 +9391,6 @@ snapshots:
   '@rollup/rollup-win32-x64-msvc@4.40.2':
     optional: true
 
-  '@sideway/address@4.1.5':
-    dependencies:
-      '@hapi/hoek': 9.3.0
-
-  '@sideway/formula@3.0.1': {}
-
-  '@sideway/pinpoint@2.0.0': {}
-
   '@sinclair/typebox@0.27.8': {}
 
   '@sindresorhus/is@4.6.0': {}
@@ -9633,97 +9403,55 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  '@storybook/addon-actions@8.6.12(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      '@storybook/global': 5.0.0
-      '@types/uuid': 9.0.8
-      dequal: 2.0.3
-      polished: 4.3.1
-      storybook: 8.6.12(prettier@3.5.3)
-      uuid: 9.0.1
-
-  '@storybook/addon-controls@8.6.12(storybook@8.6.12(prettier@3.5.3))':
+  '@storybook/addon-vitest@9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))':
     dependencies:
       '@storybook/global': 5.0.0
-      dequal: 2.0.3
-      storybook: 8.6.12(prettier@3.5.3)
+      '@storybook/icons': 1.4.0(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      prompts: 2.4.2
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       ts-dedent: 2.2.0
+    transitivePeerDependencies:
+      - react
+      - react-dom
 
-  '@storybook/addon-toolbars@8.6.12(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
-
-  '@storybook/builder-vite@8.6.12(storybook@8.6.12(prettier@3.5.3))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
+  '@storybook/builder-vite@9.0.17(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
     dependencies:
-      '@storybook/csf-plugin': 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      browser-assert: 1.2.1
-      storybook: 8.6.12(prettier@3.5.3)
+      '@storybook/csf-plugin': 9.0.17(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       ts-dedent: 2.2.0
       vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
 
-  '@storybook/components@8.6.12(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
-
-  '@storybook/core@8.6.12(prettier@3.5.3)(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      '@storybook/theming': 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      better-opn: 3.0.2
-      browser-assert: 1.2.1
-      esbuild: 0.25.4
-      esbuild-register: 3.6.0(esbuild@0.25.4)
-      jsdoc-type-pratt-parser: 4.1.0
-      process: 0.11.10
-      recast: 0.23.11
-      semver: 7.7.1
-      util: 0.12.5
-      ws: 8.18.2
-    optionalDependencies:
-      prettier: 3.5.3
-    transitivePeerDependencies:
-      - bufferutil
-      - storybook
-      - supports-color
-      - utf-8-validate
-
-  '@storybook/csf-plugin@8.6.12(storybook@8.6.12(prettier@3.5.3))':
+  '@storybook/csf-plugin@9.0.17(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))':
     dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       unplugin: 1.16.1
 
-  '@storybook/csf@0.1.13':
-    dependencies:
-      type-fest: 2.19.0
-
   '@storybook/global@5.0.0': {}
 
-  '@storybook/manager-api@8.6.12(storybook@8.6.12(prettier@3.5.3))':
+  '@storybook/icons@1.4.0(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
     dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
-
-  '@storybook/preview-api@8.6.12(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
 
-  '@storybook/react-dom-shim@8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@8.6.12(prettier@3.5.3))':
+  '@storybook/react-dom-shim@9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))':
     dependencies:
       react: 19.1.0
       react-dom: 19.1.0(react@19.1.0)
-      storybook: 8.6.12(prettier@3.5.3)
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
 
-  '@storybook/react-vite@8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(rollup@4.40.2)(storybook@8.6.12(prettier@3.5.3))(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
+  '@storybook/react-vite@9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(rollup@4.40.2)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.5.0(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.8.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       '@rollup/pluginutils': 5.1.4(rollup@4.40.2)
-      '@storybook/builder-vite': 8.6.12(storybook@8.6.12(prettier@3.5.3))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
-      '@storybook/react': 8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@8.6.12(prettier@3.5.3))(typescript@5.8.3)
-      find-up: 5.0.0
+      '@storybook/builder-vite': 9.0.17(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+      '@storybook/react': 9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3)
+      find-up: 7.0.0
       magic-string: 0.30.17
       react: 19.1.0
-      react-docgen: 7.1.1
+      react-docgen: 8.0.0
       react-dom: 19.1.0(react@19.1.0)
       resolve: 1.22.10
-      storybook: 8.6.12(prettier@3.5.3)
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
       tsconfig-paths: 4.2.0
       vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
     transitivePeerDependencies:
@@ -9731,55 +9459,16 @@ snapshots:
       - supports-color
       - typescript
 
-  '@storybook/react@8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@8.6.12(prettier@3.5.3))(typescript@5.8.3)':
+  '@storybook/react@9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3)':
     dependencies:
-      '@storybook/components': 8.6.12(storybook@8.6.12(prettier@3.5.3))
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/preview-api': 8.6.12(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/react-dom-shim': 8.6.12(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@8.6.12(prettier@3.5.3))
-      '@storybook/theming': 8.6.12(storybook@8.6.12(prettier@3.5.3))
+      '@storybook/react-dom-shim': 9.0.17(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))
       react: 19.1.0
       react-dom: 19.1.0(react@19.1.0)
-      storybook: 8.6.12(prettier@3.5.3)
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
     optionalDependencies:
       typescript: 5.8.3
 
-  '@storybook/test-runner@0.22.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      '@babel/core': 7.27.1
-      '@babel/generator': 7.27.1
-      '@babel/template': 7.27.1
-      '@babel/types': 7.27.1
-      '@jest/types': 29.6.3
-      '@storybook/csf': 0.1.13
-      '@swc/core': 1.11.24
-      '@swc/jest': 0.2.37(@swc/core@1.11.24)
-      expect-playwright: 0.8.0
-      jest: 29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)
-      jest-circus: 29.7.0(babel-plugin-macros@3.1.0)
-      jest-environment-node: 29.7.0
-      jest-junit: 16.0.0
-      jest-playwright-preset: 4.0.0(jest-circus@29.7.0(babel-plugin-macros@3.1.0))(jest-environment-node@29.7.0)(jest-runner@29.7.0)(jest@29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0))
-      jest-runner: 29.7.0
-      jest-serializer-html: 7.1.0
-      jest-watch-typeahead: 2.2.2(jest@29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0))
-      nyc: 15.1.0
-      playwright: 1.52.0
-      storybook: 8.6.12(prettier@3.5.3)
-    transitivePeerDependencies:
-      - '@swc/helpers'
-      - '@types/node'
-      - babel-plugin-macros
-      - debug
-      - node-notifier
-      - supports-color
-      - ts-node
-
-  '@storybook/theming@8.6.12(storybook@8.6.12(prettier@3.5.3))':
-    dependencies:
-      storybook: 8.6.12(prettier@3.5.3)
-
   '@styled-system/background@5.1.2':
     dependencies:
       '@styled-system/core': 5.1.2
@@ -9879,13 +9568,6 @@ snapshots:
 
   '@swc/counter@0.1.3': {}
 
-  '@swc/jest@0.2.37(@swc/core@1.11.24)':
-    dependencies:
-      '@jest/create-cache-key-function': 29.7.0
-      '@swc/core': 1.11.24
-      '@swc/counter': 0.1.3
-      jsonc-parser: 3.3.1
-
   '@swc/plugin-styled-components@7.1.4':
     dependencies:
       '@swc/counter': 0.1.3
@@ -9898,11 +9580,11 @@ snapshots:
     dependencies:
       defer-to-connect: 2.0.1
 
-  '@tanstack/query-core@5.75.5': {}
+  '@tanstack/query-core@5.85.5': {}
 
-  '@tanstack/react-query@5.75.5(react@19.1.0)':
+  '@tanstack/react-query@5.85.5(react@19.1.0)':
     dependencies:
-      '@tanstack/query-core': 5.75.5
+      '@tanstack/query-core': 5.85.5
       react: 19.1.0
 
   '@testing-library/dom@10.1.0':
@@ -9972,6 +9654,10 @@ snapshots:
       '@types/node': 22.15.16
       '@types/responselike': 1.0.3
 
+  '@types/chai@5.2.2':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+
   '@types/cookie@0.6.0': {}
 
   '@types/d3-color@3.1.3': {}
@@ -10006,11 +9692,9 @@ snapshots:
     dependencies:
       '@types/ms': 2.1.0
 
-  '@types/doctrine@0.0.9': {}
+  '@types/deep-eql@4.0.2': {}
 
-  '@types/estree-jsx@1.0.5':
-    dependencies:
-      '@types/estree': 1.0.7
+  '@types/doctrine@0.0.9': {}
 
   '@types/estree@1.0.7': {}
 
@@ -10022,10 +9706,6 @@ snapshots:
     dependencies:
       '@types/node': 22.15.16
 
-  '@types/hast@3.0.4':
-    dependencies:
-      '@types/unist': 3.0.3
-
   '@types/history@4.7.11': {}
 
   '@types/http-cache-semantics@4.0.4': {}
@@ -10063,10 +9743,6 @@ snapshots:
     dependencies:
       '@types/node': 22.15.16
 
-  '@types/mdast@4.0.4':
-    dependencies:
-      '@types/unist': 3.0.3
-
   '@types/ms@2.1.0': {}
 
   '@types/node-forge@1.3.11':
@@ -10118,6 +9794,8 @@ snapshots:
     dependencies:
       '@types/node': 22.15.16
 
+  '@types/semver@7.7.0': {}
+
   '@types/shimmer@1.2.0': {}
 
   '@types/stack-utils@2.0.3': {}
@@ -10143,19 +9821,9 @@ snapshots:
 
   '@types/triple-beam@1.3.5': {}
 
-  '@types/unist@2.0.11': {}
-
-  '@types/unist@3.0.3': {}
-
-  '@types/uuid@9.0.8': {}
-
   '@types/verror@1.10.11':
     optional: true
 
-  '@types/wait-on@5.3.4':
-    dependencies:
-      '@types/node': 22.15.16
-
   '@types/webidl-conversions@7.0.1': {}
 
   '@types/whatwg-url@13.0.0':
@@ -10232,7 +9900,7 @@ snapshots:
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.7.1
+      semver: 7.7.2
       ts-api-utils: 2.1.0(typescript@5.8.3)
       typescript: 5.8.3
     transitivePeerDependencies:
@@ -10284,8 +9952,6 @@ snapshots:
     transitivePeerDependencies:
       - '@codemirror/autocomplete'
 
-  '@ungap/structured-clone@1.3.0': {}
-
   '@vitejs/plugin-react-swc@3.9.0(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
     dependencies:
       '@swc/core': 1.11.24
@@ -10293,6 +9959,37 @@ snapshots:
     transitivePeerDependencies:
       - '@swc/helpers'
 
+  '@vitest/expect@3.2.4':
+    dependencies:
+      '@types/chai': 5.2.2
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.2.1
+      tinyrainbow: 2.0.0
+
+  '@vitest/mocker@3.2.4(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))':
+    dependencies:
+      '@vitest/spy': 3.2.4
+      estree-walker: 3.0.3
+      magic-string: 0.30.17
+    optionalDependencies:
+      msw: 2.7.6(@types/node@22.15.16)(typescript@5.8.3)
+      vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
+
+  '@vitest/pretty-format@3.2.4':
+    dependencies:
+      tinyrainbow: 2.0.0
+
+  '@vitest/spy@3.2.4':
+    dependencies:
+      tinyspy: 4.0.3
+
+  '@vitest/utils@3.2.4':
+    dependencies:
+      '@vitest/pretty-format': 3.2.4
+      loupe: 3.1.4
+      tinyrainbow: 2.0.0
+
   '@xmldom/xmldom@0.8.10': {}
 
   '@xterm/addon-canvas@0.7.0(@xterm/xterm@5.5.0)':
@@ -10325,8 +10022,6 @@ snapshots:
 
   abbrev@1.1.1: {}
 
-  abbrev@3.0.0: {}
-
   accepts@2.0.0:
     dependencies:
       mime-types: 3.0.1
@@ -10385,16 +10080,10 @@ snapshots:
     dependencies:
       type-fest: 0.21.3
 
-  ansi-escapes@6.2.1: {}
-
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.0.1: {}
 
-  ansi-styles@3.2.1:
-    dependencies:
-      color-convert: 1.9.3
-
   ansi-styles@4.3.0:
     dependencies:
       color-convert: 2.0.1
@@ -10436,13 +10125,13 @@ snapshots:
       hosted-git-info: 4.1.0
       is-ci: 3.0.1
       isbinaryfile: 5.0.4
-      js-yaml: 4.1.0
+      js-yaml: 4.1.1
       json5: 2.2.3
       lazy-val: 1.0.5
       minimatch: 10.0.1
       plist: 3.1.0
       resedit: 1.7.2
-      semver: 7.7.1
+      semver: 7.7.2
       tar: 6.2.1
       temp-file: 3.4.0
       tiny-async-pool: 1.3.0
@@ -10450,12 +10139,6 @@ snapshots:
       - bluebird
       - supports-color
 
-  append-transform@2.0.0:
-    dependencies:
-      default-require-extensions: 3.0.1
-
-  archy@1.0.0: {}
-
   argparse@1.0.10:
     dependencies:
       sprintf-js: 1.0.3
@@ -10528,6 +10211,8 @@ snapshots:
   assert-plus@1.0.0:
     optional: true
 
+  assertion-error@2.0.1: {}
+
   ast-types@0.16.1:
     dependencies:
       tslib: 2.8.1
@@ -10549,14 +10234,6 @@ snapshots:
     dependencies:
       possible-typed-array-names: 1.1.0
 
-  axios@1.8.2:
-    dependencies:
-      follow-redirects: 1.15.9
-      form-data: 4.0.2
-      proxy-from-env: 1.1.0
-    transitivePeerDependencies:
-      - debug
-
   b4a@1.6.7: {}
 
   babel-jest@29.7.0(@babel/core@7.27.1):
@@ -10631,9 +10308,9 @@ snapshots:
       - '@babel/core'
       - supports-color
 
-  babel-plugin-transform-import-meta@2.2.1(@babel/core@7.27.1):
+  babel-plugin-transform-import-meta@2.2.1(@babel/core@7.28.3):
     dependencies:
-      '@babel/core': 7.27.1
+      '@babel/core': 7.28.3
       '@babel/template': 7.27.1
       tslib: 2.8.1
 
@@ -10667,8 +10344,6 @@ snapshots:
       babel-plugin-jest-hoist: 29.6.3
       babel-preset-current-node-syntax: 1.1.0(@babel/core@7.27.1)
 
-  bail@2.0.2: {}
-
   balanced-match@1.0.2: {}
 
   bare-events@2.5.4:
@@ -10726,15 +10401,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  boolbase@1.0.0: {}
+
   boolean@3.2.0:
     optional: true
 
-  brace-expansion@1.1.11:
+  brace-expansion@1.1.12:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@2.0.1:
+  brace-expansion@2.0.2:
     dependencies:
       balanced-match: 1.0.2
 
@@ -10742,8 +10419,6 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browser-assert@1.2.1: {}
-
   browserslist@4.24.5:
     dependencies:
       caniuse-lite: 1.0.30001717
@@ -10771,6 +10446,13 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  builder-util-runtime@9.4.0:
+    dependencies:
+      debug: 4.4.0
+      sax: 1.4.1
+    transitivePeerDependencies:
+      - supports-color
+
   builder-util@26.0.11:
     dependencies:
       7zip-bin: 5.2.0
@@ -10784,7 +10466,7 @@ snapshots:
       http-proxy-agent: 7.0.2
       https-proxy-agent: 7.0.6
       is-ci: 3.0.1
-      js-yaml: 4.1.0
+      js-yaml: 4.1.1
       sanitize-filename: 1.6.3
       source-map-support: 0.5.21
       stat-mode: 1.0.0
@@ -10820,21 +10502,6 @@ snapshots:
     transitivePeerDependencies:
       - bluebird
 
-  cacache@19.0.1:
-    dependencies:
-      '@npmcli/fs': 4.0.0
-      fs-minipass: 3.0.3
-      glob: 10.4.5
-      lru-cache: 10.4.3
-      minipass: 7.1.2
-      minipass-collect: 2.0.1
-      minipass-flush: 1.0.5
-      minipass-pipeline: 1.2.4
-      p-map: 7.0.3
-      ssri: 12.0.0
-      tar: 7.4.3
-      unique-filename: 4.0.0
-
   cacheable-lookup@5.0.4: {}
 
   cacheable-request@7.0.4:
@@ -10847,13 +10514,6 @@ snapshots:
       normalize-url: 6.1.0
       responselike: 2.0.1
 
-  caching-transform@4.0.0:
-    dependencies:
-      hasha: 5.2.2
-      make-dir: 3.1.0
-      package-hash: 4.0.0
-      write-file-atomic: 3.0.3
-
   call-bind-apply-helpers@1.0.2:
     dependencies:
       es-errors: 1.3.0
@@ -10881,18 +10541,18 @@ snapshots:
 
   caniuse-lite@1.0.30001717: {}
 
-  ccount@2.0.1: {}
+  chai@5.2.1:
+    dependencies:
+      assertion-error: 2.0.1
+      check-error: 2.1.1
+      deep-eql: 5.0.2
+      loupe: 3.1.4
+      pathval: 2.0.1
 
   chalk-template@1.1.0:
     dependencies:
       chalk: 5.4.1
 
-  chalk@2.4.2:
-    dependencies:
-      ansi-styles: 3.2.1
-      escape-string-regexp: 1.0.5
-      supports-color: 5.5.0
-
   chalk@3.0.0:
     dependencies:
       ansi-styles: 4.3.0
@@ -10907,20 +10567,10 @@ snapshots:
 
   char-regex@1.0.2: {}
 
-  char-regex@2.0.2: {}
-
-  character-entities-html4@2.1.0: {}
-
-  character-entities-legacy@3.0.0: {}
-
-  character-entities@2.0.2: {}
-
-  character-reference-invalid@2.0.1: {}
+  check-error@2.1.1: {}
 
   chownr@2.0.0: {}
 
-  chownr@3.0.0: {}
-
   chromium-pickle-js@0.2.0: {}
 
   ci-info@3.9.0: {}
@@ -10948,12 +10598,6 @@ snapshots:
 
   cli-width@4.1.0: {}
 
-  cliui@6.0.0:
-    dependencies:
-      string-width: 4.2.3
-      strip-ansi: 6.0.1
-      wrap-ansi: 6.2.0
-
   cliui@8.0.1:
     dependencies:
       string-width: 4.2.3
@@ -11011,14 +10655,10 @@ snapshots:
     dependencies:
       delayed-stream: 1.0.0
 
-  comma-separated-tokens@2.0.3: {}
-
-  commander@12.1.0: {}
+  commander@11.1.0: {}
 
   commander@13.1.0: {}
 
-  commander@3.0.2: {}
-
   commander@5.1.0: {}
 
   comment-json@4.2.5:
@@ -11029,15 +10669,13 @@ snapshots:
       has-own-prop: 2.0.0
       repeat-string: 1.6.1
 
-  commondir@1.0.1: {}
-
   compare-version@0.1.2: {}
 
   concat-map@0.0.1: {}
 
   config-file-ts@0.2.8-rc1:
     dependencies:
-      glob: 10.4.5
+      glob: 10.5.0
       typescript: 5.8.3
 
   content-disposition@1.0.0:
@@ -11193,23 +10831,47 @@ snapshots:
       cspell-lib: 9.0.1
       fast-json-stable-stringify: 2.1.0
       file-entry-cache: 9.1.0
-      semver: 7.7.1
+      semver: 7.7.2
       tinyglobby: 0.2.13
 
   css-color-keywords@1.0.0: {}
 
   css-mediaquery@0.1.2: {}
 
+  css-select@5.1.0:
+    dependencies:
+      boolbase: 1.0.0
+      css-what: 6.1.0
+      domhandler: 5.0.3
+      domutils: 3.2.2
+      nth-check: 2.1.1
+
   css-to-react-native@3.2.0:
     dependencies:
       camelize: 1.0.1
       css-color-keywords: 1.0.0
       postcss-value-parser: 4.2.0
 
+  css-tree@2.2.1:
+    dependencies:
+      mdn-data: 2.0.28
+      source-map-js: 1.2.1
+
+  css-tree@3.1.0:
+    dependencies:
+      mdn-data: 2.12.2
+      source-map-js: 1.2.1
+
+  css-what@6.1.0: {}
+
   css.escape@1.5.1: {}
 
   cssfontparser@1.2.1: {}
 
+  csso@5.0.5:
+    dependencies:
+      css-tree: 2.2.1
+
   cssom@0.3.8: {}
 
   cssom@0.5.0: {}
@@ -11225,11 +10887,6 @@ snapshots:
 
   csstype@3.1.3: {}
 
-  cwd@0.10.0:
-    dependencies:
-      find-pkg: 0.1.2
-      fs-exists-sync: 0.1.0
-
   d3-array@2.12.1:
     dependencies:
       internmap: 1.0.1
@@ -11326,14 +10983,8 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
-  decamelize@1.2.0: {}
-
   decimal.js@10.5.0: {}
 
-  decode-named-character-reference@1.1.0:
-    dependencies:
-      character-entities: 2.0.2
-
   decompress-response@6.0.0:
     dependencies:
       mimic-response: 3.1.0
@@ -11342,14 +10993,12 @@ snapshots:
     optionalDependencies:
       babel-plugin-macros: 3.1.0
 
+  deep-eql@5.0.2: {}
+
   deep-is@0.1.4: {}
 
   deepmerge@4.2.2: {}
 
-  default-require-extensions@3.0.1:
-    dependencies:
-      strip-bom: 4.0.0
-
   defaults@1.0.4:
     dependencies:
       clone: 1.0.4
@@ -11383,16 +11032,8 @@ snapshots:
   detect-node@2.1.0:
     optional: true
 
-  devlop@1.1.0:
-    dependencies:
-      dequal: 2.0.3
-
   diff-sequences@29.6.3: {}
 
-  diffable-html@4.1.0:
-    dependencies:
-      htmlparser2: 3.10.1
-
   dir-compare@4.2.0:
     dependencies:
       minimatch: 3.1.2
@@ -11405,7 +11046,7 @@ snapshots:
       builder-util-runtime: 9.3.1
       fs-extra: 10.1.0
       iconv-lite: 0.6.3
-      js-yaml: 4.1.0
+      js-yaml: 4.1.1
     optionalDependencies:
       dmg-license: 1.0.11
     transitivePeerDependencies:
@@ -11448,12 +11089,11 @@ snapshots:
       '@babel/runtime': 7.27.1
       csstype: 3.1.3
 
-  dom-serializer@0.2.2:
+  dom-serializer@2.0.0:
     dependencies:
       domelementtype: 2.3.0
-      entities: 2.2.0
-
-  domelementtype@1.3.1: {}
+      domhandler: 5.0.3
+      entities: 4.5.0
 
   domelementtype@2.3.0: {}
 
@@ -11461,14 +11101,15 @@ snapshots:
     dependencies:
       webidl-conversions: 7.0.0
 
-  domhandler@2.4.2:
+  domhandler@5.0.3:
     dependencies:
-      domelementtype: 1.3.1
+      domelementtype: 2.3.0
 
-  domutils@1.7.0:
+  domutils@3.2.2:
     dependencies:
-      dom-serializer: 0.2.2
-      domelementtype: 1.3.1
+      dom-serializer: 2.0.0
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
 
   dotenv-expand@11.0.7:
     dependencies:
@@ -11513,7 +11154,7 @@ snapshots:
       builder-util: 26.0.11
       builder-util-runtime: 9.3.1
       chalk: 4.1.2
-      form-data: 4.0.2
+      form-data: 4.0.4
       fs-extra: 10.1.0
       lazy-val: 1.0.5
       mime: 2.6.0
@@ -11522,12 +11163,25 @@ snapshots:
 
   electron-to-chromium@1.5.150: {}
 
-  electron-vite@3.1.0(@swc/core@1.11.24)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)):
+  electron-updater@6.6.8:
     dependencies:
-      '@babel/core': 7.27.1
-      '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.27.1)
+      builder-util-runtime: 9.4.0
+      fs-extra: 10.1.0
+      js-yaml: 4.1.1
+      lazy-val: 1.0.5
+      lodash.escaperegexp: 4.1.2
+      lodash.isequal: 4.5.0
+      semver: 7.7.2
+      tiny-typed-emitter: 2.1.0
+    transitivePeerDependencies:
+      - supports-color
+
+  electron-vite@4.0.0(@swc/core@1.11.24)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)):
+    dependencies:
+      '@babel/core': 7.28.3
+      '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.28.3)
       cac: 6.7.14
-      esbuild: 0.25.4
+      esbuild: 0.25.9
       magic-string: 0.30.17
       picocolors: 1.1.1
       vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
@@ -11536,7 +11190,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  electron@36.1.0:
+  electron@37.6.0:
     dependencies:
       '@electron/get': 2.0.3
       '@types/node': 22.15.16
@@ -11563,9 +11217,7 @@ snapshots:
     dependencies:
       once: 1.4.0
 
-  entities@1.1.2: {}
-
-  entities@2.2.0: {}
+  entities@4.5.0: {}
 
   entities@6.0.0: {}
 
@@ -11677,12 +11329,13 @@ snapshots:
       is-date-object: 1.1.0
       is-symbol: 1.1.1
 
-  es6-error@4.1.1: {}
+  es6-error@4.1.1:
+    optional: true
 
-  esbuild-register@3.6.0(esbuild@0.25.4):
+  esbuild-register@3.6.0(esbuild@0.25.9):
     dependencies:
       debug: 4.4.0
-      esbuild: 0.25.4
+      esbuild: 0.25.9
     transitivePeerDependencies:
       - supports-color
 
@@ -11714,12 +11367,39 @@ snapshots:
       '@esbuild/win32-ia32': 0.25.4
       '@esbuild/win32-x64': 0.25.4
 
+  esbuild@0.25.9:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.9
+      '@esbuild/android-arm': 0.25.9
+      '@esbuild/android-arm64': 0.25.9
+      '@esbuild/android-x64': 0.25.9
+      '@esbuild/darwin-arm64': 0.25.9
+      '@esbuild/darwin-x64': 0.25.9
+      '@esbuild/freebsd-arm64': 0.25.9
+      '@esbuild/freebsd-x64': 0.25.9
+      '@esbuild/linux-arm': 0.25.9
+      '@esbuild/linux-arm64': 0.25.9
+      '@esbuild/linux-ia32': 0.25.9
+      '@esbuild/linux-loong64': 0.25.9
+      '@esbuild/linux-mips64el': 0.25.9
+      '@esbuild/linux-ppc64': 0.25.9
+      '@esbuild/linux-riscv64': 0.25.9
+      '@esbuild/linux-s390x': 0.25.9
+      '@esbuild/linux-x64': 0.25.9
+      '@esbuild/netbsd-arm64': 0.25.9
+      '@esbuild/netbsd-x64': 0.25.9
+      '@esbuild/openbsd-arm64': 0.25.9
+      '@esbuild/openbsd-x64': 0.25.9
+      '@esbuild/openharmony-arm64': 0.25.9
+      '@esbuild/sunos-x64': 0.25.9
+      '@esbuild/win32-arm64': 0.25.9
+      '@esbuild/win32-ia32': 0.25.9
+      '@esbuild/win32-x64': 0.25.9
+
   escalade@3.2.0: {}
 
   escape-html@1.0.3: {}
 
-  escape-string-regexp@1.0.5: {}
-
   escape-string-regexp@2.0.0: {}
 
   escape-string-regexp@4.0.0: {}
@@ -11777,6 +11457,15 @@ snapshots:
       string.prototype.matchall: 4.0.12
       string.prototype.repeat: 1.0.0
 
+  eslint-plugin-storybook@9.0.17(eslint@9.26.0)(storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)))(typescript@5.8.3):
+    dependencies:
+      '@typescript-eslint/utils': 8.32.0(eslint@9.26.0)(typescript@5.8.3)
+      eslint: 9.26.0
+      storybook: 9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
   eslint-plugin-testing-library@7.1.1(eslint@9.26.0)(typescript@5.8.3):
     dependencies:
       '@typescript-eslint/scope-manager': 8.32.0
@@ -11861,10 +11550,12 @@ snapshots:
 
   estraverse@5.3.0: {}
 
-  estree-util-is-identifier-name@3.0.0: {}
-
   estree-walker@2.0.2: {}
 
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.7
+
   esutils@2.0.3: {}
 
   etag@1.8.1: {}
@@ -11891,12 +11582,6 @@ snapshots:
 
   exit@0.1.2: {}
 
-  expand-tilde@1.2.2:
-    dependencies:
-      os-homedir: 1.0.2
-
-  expect-playwright@0.8.0: {}
-
   expect@29.7.0:
     dependencies:
       '@jest/expect-utils': 29.7.0
@@ -11943,8 +11628,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  extend@3.0.2: {}
-
   extract-zip@2.0.1:
     dependencies:
       debug: 4.4.0
@@ -12021,27 +11704,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  find-cache-dir@3.3.2:
-    dependencies:
-      commondir: 1.0.1
-      make-dir: 3.1.0
-      pkg-dir: 4.2.0
-
-  find-file-up@0.1.3:
-    dependencies:
-      fs-exists-sync: 0.1.0
-      resolve-dir: 0.1.1
-
-  find-pkg@0.1.2:
-    dependencies:
-      find-file-up: 0.1.3
-
-  find-process@1.4.10:
-    dependencies:
-      chalk: 4.1.2
-      commander: 12.1.0
-      loglevel: 1.9.2
-
   find-root@1.1.0: {}
 
   find-up@4.1.0:
@@ -12054,6 +11716,12 @@ snapshots:
       locate-path: 6.0.0
       path-exists: 4.0.0
 
+  find-up@7.0.0:
+    dependencies:
+      locate-path: 7.2.0
+      path-exists: 5.0.0
+      unicorn-magic: 0.1.0
+
   flat-cache@4.0.1:
     dependencies:
       flatted: 3.3.3
@@ -12068,37 +11736,27 @@ snapshots:
 
   fn.name@1.1.0: {}
 
-  follow-redirects@1.15.9: {}
-
   for-each@0.3.5:
     dependencies:
       is-callable: 1.2.7
 
-  foreground-child@2.0.0:
-    dependencies:
-      cross-spawn: 7.0.6
-      signal-exit: 3.0.7
-
   foreground-child@3.3.1:
     dependencies:
       cross-spawn: 7.0.6
       signal-exit: 4.1.0
 
-  form-data@4.0.2:
+  form-data@4.0.4:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
+      hasown: 2.0.2
       mime-types: 2.1.35
 
   forwarded@0.2.0: {}
 
   fresh@2.0.0: {}
 
-  fromentries@1.3.2: {}
-
-  fs-exists-sync@0.1.0: {}
-
   fs-extra@10.1.0:
     dependencies:
       graceful-fs: 4.2.11
@@ -12128,10 +11786,6 @@ snapshots:
     dependencies:
       minipass: 3.3.6
 
-  fs-minipass@3.0.3:
-    dependencies:
-      minipass: 7.1.2
-
   fs.realpath@1.0.0: {}
 
   fsevents@2.3.2:
@@ -12199,7 +11853,7 @@ snapshots:
     dependencies:
       is-glob: 4.0.3
 
-  glob@10.4.5:
+  glob@10.5.0:
     dependencies:
       foreground-child: 3.3.1
       jackspeak: 3.4.3
@@ -12231,7 +11885,7 @@ snapshots:
       es6-error: 4.1.1
       matcher: 3.0.0
       roarr: 2.15.4
-      semver: 7.7.1
+      semver: 7.7.2
       serialize-error: 7.0.1
     optional: true
 
@@ -12239,18 +11893,6 @@ snapshots:
     dependencies:
       ini: 4.1.1
 
-  global-modules@0.2.3:
-    dependencies:
-      global-prefix: 0.1.5
-      is-windows: 0.2.0
-
-  global-prefix@0.1.5:
-    dependencies:
-      homedir-polyfill: 1.0.3
-      ini: 1.3.8
-      is-windows: 0.2.0
-      which: 1.3.1
-
   globals@11.12.0: {}
 
   globals@14.0.0: {}
@@ -12288,8 +11930,6 @@ snapshots:
 
   has-bigints@1.1.0: {}
 
-  has-flag@3.0.0: {}
-
   has-flag@4.0.0: {}
 
   has-own-prop@2.0.0: {}
@@ -12308,39 +11948,10 @@ snapshots:
     dependencies:
       has-symbols: 1.1.0
 
-  hasha@5.2.2:
-    dependencies:
-      is-stream: 2.0.1
-      type-fest: 0.8.1
-
   hasown@2.0.2:
     dependencies:
       function-bind: 1.1.2
 
-  hast-util-to-jsx-runtime@2.3.6:
-    dependencies:
-      '@types/estree': 1.0.7
-      '@types/hast': 3.0.4
-      '@types/unist': 3.0.3
-      comma-separated-tokens: 2.0.3
-      devlop: 1.1.0
-      estree-util-is-identifier-name: 3.0.0
-      hast-util-whitespace: 3.0.0
-      mdast-util-mdx-expression: 2.0.1
-      mdast-util-mdx-jsx: 3.2.0
-      mdast-util-mdxjs-esm: 2.0.1
-      property-information: 7.0.0
-      space-separated-tokens: 2.0.2
-      style-to-js: 1.1.16
-      unist-util-position: 5.0.0
-      vfile-message: 4.0.2
-    transitivePeerDependencies:
-      - supports-color
-
-  hast-util-whitespace@3.0.0:
-    dependencies:
-      '@types/hast': 3.0.4
-
   headers-polyfill@4.0.3: {}
 
   highlight-words-core@1.2.3: {}
@@ -12360,10 +11971,6 @@ snapshots:
     dependencies:
       react-is: 16.13.1
 
-  homedir-polyfill@1.0.3:
-    dependencies:
-      parse-passwd: 1.0.0
-
   hosted-git-info@4.1.0:
     dependencies:
       lru-cache: 6.0.0
@@ -12378,17 +11985,6 @@ snapshots:
 
   html-escaper@2.0.2: {}
 
-  html-url-attributes@3.0.1: {}
-
-  htmlparser2@3.10.1:
-    dependencies:
-      domelementtype: 1.3.1
-      domhandler: 2.4.2
-      domutils: 1.7.0
-      entities: 1.1.2
-      inherits: 2.0.4
-      readable-stream: 3.6.2
-
   http-cache-semantics@4.1.1: {}
 
   http-errors@2.0.0:
@@ -12487,12 +12083,8 @@ snapshots:
 
   inherits@2.0.4: {}
 
-  ini@1.3.8: {}
-
   ini@4.1.1: {}
 
-  inline-style-parser@0.2.4: {}
-
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
@@ -12510,18 +12102,6 @@ snapshots:
 
   ipaddr.js@1.9.1: {}
 
-  is-alphabetical@2.0.1: {}
-
-  is-alphanumerical@2.0.1:
-    dependencies:
-      is-alphabetical: 2.0.1
-      is-decimal: 2.0.1
-
-  is-arguments@1.2.0:
-    dependencies:
-      call-bound: 1.0.4
-      has-tostringtag: 1.0.2
-
   is-array-buffer@3.0.5:
     dependencies:
       call-bind: 1.0.8
@@ -12570,8 +12150,6 @@ snapshots:
       call-bound: 1.0.4
       has-tostringtag: 1.0.2
 
-  is-decimal@2.0.1: {}
-
   is-docker@2.2.1: {}
 
   is-extglob@2.1.1: {}
@@ -12595,8 +12173,6 @@ snapshots:
     dependencies:
       is-extglob: 2.1.1
 
-  is-hexadecimal@2.0.1: {}
-
   is-interactive@1.0.0: {}
 
   is-lambda@1.0.1: {}
@@ -12612,8 +12188,6 @@ snapshots:
 
   is-number@7.0.0: {}
 
-  is-plain-obj@4.1.0: {}
-
   is-potential-custom-element-name@1.0.1: {}
 
   is-promise@4.0.0: {}
@@ -12648,8 +12222,6 @@ snapshots:
     dependencies:
       which-typed-array: 1.1.19
 
-  is-typedarray@1.0.0: {}
-
   is-unicode-supported@0.1.0: {}
 
   is-weakmap@2.0.2: {}
@@ -12663,10 +12235,6 @@ snapshots:
       call-bound: 1.0.4
       get-intrinsic: 1.3.0
 
-  is-windows@0.2.0: {}
-
-  is-windows@1.0.2: {}
-
   is-wsl@2.2.0:
     dependencies:
       is-docker: 2.2.1
@@ -12685,19 +12253,6 @@ snapshots:
 
   istanbul-lib-coverage@3.2.2: {}
 
-  istanbul-lib-hook@3.0.0:
-    dependencies:
-      append-transform: 2.0.0
-
-  istanbul-lib-instrument@4.0.3:
-    dependencies:
-      '@babel/core': 7.27.1
-      '@istanbuljs/schema': 0.1.3
-      istanbul-lib-coverage: 3.2.2
-      semver: 6.3.1
-    transitivePeerDependencies:
-      - supports-color
-
   istanbul-lib-instrument@5.2.1:
     dependencies:
       '@babel/core': 7.27.1
@@ -12714,19 +12269,10 @@ snapshots:
       '@babel/parser': 7.27.1
       '@istanbuljs/schema': 0.1.3
       istanbul-lib-coverage: 3.2.2
-      semver: 7.7.1
+      semver: 7.7.2
     transitivePeerDependencies:
       - supports-color
 
-  istanbul-lib-processinfo@2.0.3:
-    dependencies:
-      archy: 1.0.0
-      cross-spawn: 7.0.6
-      istanbul-lib-coverage: 3.2.2
-      p-map: 3.0.0
-      rimraf: 3.0.2
-      uuid: 8.3.2
-
   istanbul-lib-report@3.0.1:
     dependencies:
       istanbul-lib-coverage: 3.2.2
@@ -12768,7 +12314,7 @@ snapshots:
       filelist: 1.0.4
       minimatch: 3.1.2
 
-  jest-canvas-mock@2.5.2:
+  jest-canvas-mock@2.5.2(patch_hash=8329a68f6b8f930f6204c405a071859893962d4a6641b6c2c2bb33122c0441b1):
     dependencies:
       cssfontparser: 1.2.1
       moo-color: 1.0.2
@@ -12917,13 +12463,6 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
-  jest-junit@16.0.0:
-    dependencies:
-      mkdirp: 1.0.4
-      strip-ansi: 6.0.1
-      uuid: 8.3.2
-      xml: 1.0.1
-
   jest-leak-detector@29.7.0:
     dependencies:
       jest-get-type: 29.6.3
@@ -12954,42 +12493,10 @@ snapshots:
       '@types/node': 22.15.16
       jest-util: 29.7.0
 
-  jest-playwright-preset@4.0.0(jest-circus@29.7.0(babel-plugin-macros@3.1.0))(jest-environment-node@29.7.0)(jest-runner@29.7.0)(jest@29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)):
-    dependencies:
-      expect-playwright: 0.8.0
-      jest: 29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)
-      jest-circus: 29.7.0(babel-plugin-macros@3.1.0)
-      jest-environment-node: 29.7.0
-      jest-process-manager: 0.4.0
-      jest-runner: 29.7.0
-      nyc: 15.1.0
-      playwright-core: 1.52.0
-      rimraf: 3.0.2
-      uuid: 8.3.2
-    transitivePeerDependencies:
-      - debug
-      - supports-color
-
   jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
     optionalDependencies:
       jest-resolve: 29.7.0
 
-  jest-process-manager@0.4.0:
-    dependencies:
-      '@types/wait-on': 5.3.4
-      chalk: 4.1.2
-      cwd: 0.10.0
-      exit: 0.1.2
-      find-process: 1.4.10
-      prompts: 2.4.2
-      signal-exit: 3.0.7
-      spawnd: 5.0.0
-      tree-kill: 1.2.2
-      wait-on: 7.2.0
-    transitivePeerDependencies:
-      - debug
-      - supports-color
-
   jest-regex-util@29.6.3: {}
 
   jest-resolve-dependencies@29.7.0:
@@ -13064,10 +12571,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  jest-serializer-html@7.1.0:
-    dependencies:
-      diffable-html: 4.1.0
-
   jest-snapshot@29.7.0:
     dependencies:
       '@babel/core': 7.27.1
@@ -13089,7 +12592,7 @@ snapshots:
       jest-util: 29.7.0
       natural-compare: 1.4.0
       pretty-format: 29.7.0
-      semver: 7.7.1
+      semver: 7.7.2
     transitivePeerDependencies:
       - supports-color
 
@@ -13116,17 +12619,6 @@ snapshots:
       leven: 3.1.0
       pretty-format: 29.7.0
 
-  jest-watch-typeahead@2.2.2(jest@29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)):
-    dependencies:
-      ansi-escapes: 6.2.1
-      chalk: 5.4.1
-      jest: 29.7.0(@types/node@22.15.16)(babel-plugin-macros@3.1.0)
-      jest-regex-util: 29.6.3
-      jest-watcher: 29.7.0
-      slash: 5.1.0
-      string-length: 5.0.1
-      strip-ansi: 7.1.0
-
   jest-watcher@29.7.0:
     dependencies:
       '@jest/test-result': 29.7.0
@@ -13162,29 +12654,19 @@ snapshots:
       - supports-color
       - ts-node
 
-  joi@17.13.3:
-    dependencies:
-      '@hapi/hoek': 9.3.0
-      '@hapi/topo': 5.1.0
-      '@sideway/address': 4.1.5
-      '@sideway/formula': 3.0.1
-      '@sideway/pinpoint': 2.0.0
-
   js-tokens@4.0.0: {}
 
-  js-yaml@3.14.1:
+  js-yaml@3.14.2:
     dependencies:
       argparse: 1.0.10
       esprima: 4.0.1
 
-  js-yaml@4.1.0:
+  js-yaml@4.1.1:
     dependencies:
       argparse: 2.0.1
 
   jsbn@1.1.0: {}
 
-  jsdoc-type-pratt-parser@4.1.0: {}
-
   jsdom-testing-mocks@1.13.1:
     dependencies:
       bezier-easing: 2.1.0
@@ -13201,7 +12683,7 @@ snapshots:
       decimal.js: 10.5.0
       domexception: 4.0.0
       escodegen: 2.1.0
-      form-data: 4.0.2
+      form-data: 4.0.4
       html-encoding-sniffer: 3.0.0
       http-proxy-agent: 5.0.0
       https-proxy-agent: 5.0.1
@@ -13267,8 +12749,6 @@ snapshots:
 
   json5@2.2.3: {}
 
-  jsonc-parser@3.3.1: {}
-
   jsonfile@4.0.0:
     optionalDependencies:
       graceful-fs: 4.2.11
@@ -13313,11 +12793,17 @@ snapshots:
     dependencies:
       p-locate: 5.0.0
 
+  locate-path@7.2.0:
+    dependencies:
+      p-locate: 6.0.0
+
   lodash.camelcase@4.3.0: {}
 
   lodash.debounce@4.0.8: {}
 
-  lodash.flattendeep@4.4.0: {}
+  lodash.escaperegexp@4.1.2: {}
+
+  lodash.isequal@4.5.0: {}
 
   lodash.merge@4.6.2: {}
 
@@ -13337,16 +12823,14 @@ snapshots:
       safe-stable-stringify: 2.3.1
       triple-beam: 1.3.0
 
-  loglevel@1.9.2: {}
-
   long@5.3.2: {}
 
-  longest-streak@3.1.0: {}
-
   loose-envify@1.4.0:
     dependencies:
       js-tokens: 4.0.0
 
+  loupe@3.1.4: {}
+
   lowercase-keys@2.0.0: {}
 
   lru-cache@10.4.3: {}
@@ -13363,21 +12847,13 @@ snapshots:
 
   lz-string@1.5.0: {}
 
-  magic-string@0.27.0:
-    dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.0
-
   magic-string@0.30.17:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.0
 
-  make-dir@3.1.0:
-    dependencies:
-      semver: 6.3.1
-
   make-dir@4.0.0:
     dependencies:
-      semver: 7.7.1
+      semver: 7.7.2
 
   make-fetch-happen@10.2.1:
     dependencies:
@@ -13401,22 +12877,6 @@ snapshots:
       - bluebird
       - supports-color
 
-  make-fetch-happen@14.0.3:
-    dependencies:
-      '@npmcli/agent': 3.0.0
-      cacache: 19.0.1
-      http-cache-semantics: 4.1.1
-      minipass: 7.1.2
-      minipass-fetch: 4.0.1
-      minipass-flush: 1.0.5
-      minipass-pipeline: 1.2.4
-      negotiator: 1.0.0
-      proc-log: 5.0.0
-      promise-retry: 2.0.1
-      ssri: 12.0.0
-    transitivePeerDependencies:
-      - supports-color
-
   makeerror@1.0.12:
     dependencies:
       tmpl: 1.0.5
@@ -13428,94 +12888,9 @@ snapshots:
 
   math-intrinsics@1.1.0: {}
 
-  mdast-util-from-markdown@2.0.2:
-    dependencies:
-      '@types/mdast': 4.0.4
-      '@types/unist': 3.0.3
-      decode-named-character-reference: 1.1.0
-      devlop: 1.1.0
-      mdast-util-to-string: 4.0.0
-      micromark: 4.0.2
-      micromark-util-decode-numeric-character-reference: 2.0.2
-      micromark-util-decode-string: 2.0.1
-      micromark-util-normalize-identifier: 2.0.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-      unist-util-stringify-position: 4.0.0
-    transitivePeerDependencies:
-      - supports-color
+  mdn-data@2.0.28: {}
 
-  mdast-util-mdx-expression@2.0.1:
-    dependencies:
-      '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.2
-    transitivePeerDependencies:
-      - supports-color
-
-  mdast-util-mdx-jsx@3.2.0:
-    dependencies:
-      '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      '@types/unist': 3.0.3
-      ccount: 2.0.1
-      devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.2
-      parse-entities: 4.0.2
-      stringify-entities: 4.0.4
-      unist-util-stringify-position: 4.0.0
-      vfile-message: 4.0.2
-    transitivePeerDependencies:
-      - supports-color
-
-  mdast-util-mdxjs-esm@2.0.1:
-    dependencies:
-      '@types/estree-jsx': 1.0.5
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.2
-    transitivePeerDependencies:
-      - supports-color
-
-  mdast-util-phrasing@4.1.0:
-    dependencies:
-      '@types/mdast': 4.0.4
-      unist-util-is: 6.0.0
-
-  mdast-util-to-hast@13.2.0:
-    dependencies:
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      '@ungap/structured-clone': 1.3.0
-      devlop: 1.1.0
-      micromark-util-sanitize-uri: 2.0.1
-      trim-lines: 3.0.1
-      unist-util-position: 5.0.0
-      unist-util-visit: 5.0.0
-      vfile: 6.0.3
-
-  mdast-util-to-markdown@2.1.2:
-    dependencies:
-      '@types/mdast': 4.0.4
-      '@types/unist': 3.0.3
-      longest-streak: 3.1.0
-      mdast-util-phrasing: 4.1.0
-      mdast-util-to-string: 4.0.0
-      micromark-util-classify-character: 2.0.1
-      micromark-util-decode-string: 2.0.1
-      unist-util-visit: 5.0.0
-      zwitch: 2.0.4
-
-  mdast-util-to-string@4.0.0:
-    dependencies:
-      '@types/mdast': 4.0.4
+  mdn-data@2.12.2: {}
 
   media-typer@1.1.0: {}
 
@@ -13527,139 +12902,6 @@ snapshots:
 
   merge2@1.4.1: {}
 
-  micromark-core-commonmark@2.0.3:
-    dependencies:
-      decode-named-character-reference: 1.1.0
-      devlop: 1.1.0
-      micromark-factory-destination: 2.0.1
-      micromark-factory-label: 2.0.1
-      micromark-factory-space: 2.0.1
-      micromark-factory-title: 2.0.1
-      micromark-factory-whitespace: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-chunked: 2.0.1
-      micromark-util-classify-character: 2.0.1
-      micromark-util-html-tag-name: 2.0.1
-      micromark-util-normalize-identifier: 2.0.1
-      micromark-util-resolve-all: 2.0.1
-      micromark-util-subtokenize: 2.1.0
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-factory-destination@2.0.1:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-factory-label@2.0.1:
-    dependencies:
-      devlop: 1.1.0
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-factory-space@2.0.1:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-types: 2.0.2
-
-  micromark-factory-title@2.0.1:
-    dependencies:
-      micromark-factory-space: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-factory-whitespace@2.0.1:
-    dependencies:
-      micromark-factory-space: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-util-character@2.1.1:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-util-chunked@2.0.1:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
-  micromark-util-classify-character@2.0.1:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-util-combine-extensions@2.0.1:
-    dependencies:
-      micromark-util-chunked: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-util-decode-numeric-character-reference@2.0.2:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
-  micromark-util-decode-string@2.0.1:
-    dependencies:
-      decode-named-character-reference: 1.1.0
-      micromark-util-character: 2.1.1
-      micromark-util-decode-numeric-character-reference: 2.0.2
-      micromark-util-symbol: 2.0.1
-
-  micromark-util-encode@2.0.1: {}
-
-  micromark-util-html-tag-name@2.0.1: {}
-
-  micromark-util-normalize-identifier@2.0.1:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
-  micromark-util-resolve-all@2.0.1:
-    dependencies:
-      micromark-util-types: 2.0.2
-
-  micromark-util-sanitize-uri@2.0.1:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-encode: 2.0.1
-      micromark-util-symbol: 2.0.1
-
-  micromark-util-subtokenize@2.1.0:
-    dependencies:
-      devlop: 1.1.0
-      micromark-util-chunked: 2.0.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
-  micromark-util-symbol@2.0.1: {}
-
-  micromark-util-types@2.0.2: {}
-
-  micromark@4.0.2:
-    dependencies:
-      '@types/debug': 4.1.12
-      debug: 4.4.0
-      decode-named-character-reference: 1.1.0
-      devlop: 1.1.0
-      micromark-core-commonmark: 2.0.3
-      micromark-factory-space: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-chunked: 2.0.1
-      micromark-util-combine-extensions: 2.0.1
-      micromark-util-decode-numeric-character-reference: 2.0.2
-      micromark-util-encode: 2.0.1
-      micromark-util-normalize-identifier: 2.0.1
-      micromark-util-resolve-all: 2.0.1
-      micromark-util-sanitize-uri: 2.0.1
-      micromark-util-subtokenize: 2.1.0
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-    transitivePeerDependencies:
-      - supports-color
-
   micromatch@4.0.8:
     dependencies:
       braces: 3.0.3
@@ -13689,19 +12931,19 @@ snapshots:
 
   minimatch@10.0.1:
     dependencies:
-      brace-expansion: 2.0.1
+      brace-expansion: 2.0.2
 
   minimatch@3.1.2:
     dependencies:
-      brace-expansion: 1.1.11
+      brace-expansion: 1.1.12
 
   minimatch@5.1.6:
     dependencies:
-      brace-expansion: 2.0.1
+      brace-expansion: 2.0.2
 
   minimatch@9.0.5:
     dependencies:
-      brace-expansion: 2.0.1
+      brace-expansion: 2.0.2
 
   minimist@1.2.8: {}
 
@@ -13709,10 +12951,6 @@ snapshots:
     dependencies:
       minipass: 3.3.6
 
-  minipass-collect@2.0.1:
-    dependencies:
-      minipass: 7.1.2
-
   minipass-fetch@2.1.2:
     dependencies:
       minipass: 3.3.6
@@ -13721,14 +12959,6 @@ snapshots:
     optionalDependencies:
       encoding: 0.1.13
 
-  minipass-fetch@4.0.1:
-    dependencies:
-      minipass: 7.1.2
-      minipass-sized: 1.0.3
-      minizlib: 3.0.2
-    optionalDependencies:
-      encoding: 0.1.13
-
   minipass-flush@1.0.5:
     dependencies:
       minipass: 3.3.6
@@ -13754,14 +12984,8 @@ snapshots:
       minipass: 3.3.6
       yallist: 4.0.0
 
-  minizlib@3.0.2:
-    dependencies:
-      minipass: 7.1.2
-
   mkdirp@1.0.4: {}
 
-  mkdirp@3.0.1: {}
-
   mock-socket@9.3.1: {}
 
   module-details-from-path@1.0.4: {}
@@ -13772,7 +12996,7 @@ snapshots:
 
   ms@2.1.3: {}
 
-  msw-storybook-addon@2.0.4(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3)):
+  msw-storybook-addon@2.0.5(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3)):
     dependencies:
       is-node-process: 1.2.0
       msw: 2.7.6(@types/node@22.15.16)(typescript@5.8.3)
@@ -13814,7 +13038,7 @@ snapshots:
 
   node-abi@3.75.0:
     dependencies:
-      semver: 7.7.1
+      semver: 7.7.2
 
   node-addon-api@1.7.2:
     optional: true
@@ -13823,31 +13047,12 @@ snapshots:
 
   node-api-version@0.2.1:
     dependencies:
-      semver: 7.7.1
+      semver: 7.7.2
 
-  node-forge@1.3.1: {}
-
-  node-gyp@11.2.0:
-    dependencies:
-      env-paths: 2.2.1
-      exponential-backoff: 3.1.2
-      graceful-fs: 4.2.11
-      make-fetch-happen: 14.0.3
-      nopt: 8.1.0
-      proc-log: 5.0.0
-      semver: 7.7.1
-      tar: 7.4.3
-      tinyglobby: 0.2.13
-      which: 5.0.0
-    transitivePeerDependencies:
-      - supports-color
+  node-forge@1.3.2: {}
 
   node-int64@0.4.0: {}
 
-  node-preload@0.2.1:
-    dependencies:
-      process-on-spawn: 1.1.0
-
   node-pty@1.1.0-beta34:
     dependencies:
       node-addon-api: 7.1.1
@@ -13858,10 +13063,6 @@ snapshots:
     dependencies:
       abbrev: 1.1.1
 
-  nopt@8.1.0:
-    dependencies:
-      abbrev: 3.0.0
-
   normalize-path@3.0.0: {}
 
   normalize-url@6.1.0: {}
@@ -13870,42 +13071,14 @@ snapshots:
     dependencies:
       path-key: 3.1.1
 
+  nth-check@2.1.1:
+    dependencies:
+      boolbase: 1.0.0
+
   nwsapi@2.2.20: {}
 
   nwsapi@2.2.9: {}
 
-  nyc@15.1.0:
-    dependencies:
-      '@istanbuljs/load-nyc-config': 1.1.0
-      '@istanbuljs/schema': 0.1.3
-      caching-transform: 4.0.0
-      convert-source-map: 1.9.0
-      decamelize: 1.2.0
-      find-cache-dir: 3.3.2
-      find-up: 4.1.0
-      foreground-child: 2.0.0
-      get-package-type: 0.1.0
-      glob: 7.2.3
-      istanbul-lib-coverage: 3.2.2
-      istanbul-lib-hook: 3.0.0
-      istanbul-lib-instrument: 4.0.3
-      istanbul-lib-processinfo: 2.0.3
-      istanbul-lib-report: 3.0.1
-      istanbul-lib-source-maps: 4.0.1
-      istanbul-reports: 3.1.7
-      make-dir: 3.1.0
-      node-preload: 0.2.1
-      p-map: 3.0.0
-      process-on-spawn: 1.1.0
-      resolve-from: 5.0.0
-      rimraf: 3.0.2
-      signal-exit: 3.0.7
-      spawn-wrap: 2.0.0
-      test-exclude: 6.0.0
-      yargs: 15.4.1
-    transitivePeerDependencies:
-      - supports-color
-
   object-assign@4.1.1: {}
 
   object-inspect@1.13.4: {}
@@ -13985,8 +13158,6 @@ snapshots:
       strip-ansi: 6.0.1
       wcwidth: 1.0.1
 
-  os-homedir@1.0.2: {}
-
   outvariant@1.4.3: {}
 
   own-keys@1.0.1:
@@ -14005,6 +13176,10 @@ snapshots:
     dependencies:
       yocto-queue: 0.1.0
 
+  p-limit@4.0.0:
+    dependencies:
+      yocto-queue: 1.2.1
+
   p-locate@4.1.0:
     dependencies:
       p-limit: 2.3.0
@@ -14013,25 +13188,16 @@ snapshots:
     dependencies:
       p-limit: 3.1.0
 
-  p-map@3.0.0:
+  p-locate@6.0.0:
     dependencies:
-      aggregate-error: 3.1.0
+      p-limit: 4.0.0
 
   p-map@4.0.0:
     dependencies:
       aggregate-error: 3.1.0
 
-  p-map@7.0.3: {}
-
   p-try@2.2.0: {}
 
-  package-hash@4.0.0:
-    dependencies:
-      graceful-fs: 4.2.11
-      hasha: 5.2.2
-      lodash.flattendeep: 4.4.0
-      release-zalgo: 1.0.0
-
   package-json-from-dist@1.0.1: {}
 
   parent-module@1.0.1:
@@ -14042,16 +13208,6 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
-  parse-entities@4.0.2:
-    dependencies:
-      '@types/unist': 2.0.11
-      character-entities-legacy: 3.0.0
-      character-reference-invalid: 2.0.1
-      decode-named-character-reference: 1.1.0
-      is-alphanumerical: 2.0.1
-      is-decimal: 2.0.1
-      is-hexadecimal: 2.0.1
-
   parse-json@5.2.0:
     dependencies:
       '@babel/code-frame': 7.27.1
@@ -14059,8 +13215,6 @@ snapshots:
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
 
-  parse-passwd@1.0.0: {}
-
   parse5@7.3.0:
     dependencies:
       entities: 6.0.0
@@ -14069,6 +13223,8 @@ snapshots:
 
   path-exists@4.0.0: {}
 
+  path-exists@5.0.0: {}
+
   path-is-absolute@1.0.1: {}
 
   path-key@3.1.1: {}
@@ -14090,6 +13246,8 @@ snapshots:
 
   path-type@4.0.0: {}
 
+  pathval@2.0.1: {}
+
   pe-library@0.4.1: {}
 
   pend@1.2.0: {}
@@ -14108,11 +13266,11 @@ snapshots:
     dependencies:
       find-up: 4.1.0
 
-  playwright-core@1.52.0: {}
+  playwright-core@1.56.1: {}
 
-  playwright@1.52.0:
+  playwright@1.56.1:
     dependencies:
-      playwright-core: 1.52.0
+      playwright-core: 1.56.1
     optionalDependencies:
       fsevents: 2.3.2
 
@@ -14122,10 +13280,6 @@ snapshots:
       base64-js: 1.5.1
       xmlbuilder: 15.1.1
 
-  polished@4.3.1:
-    dependencies:
-      '@babel/runtime': 7.27.1
-
   possible-typed-array-names@1.1.0: {}
 
   postcss-value-parser@4.2.0: {}
@@ -14144,7 +13298,7 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
-  prettier@3.5.3: {}
+  prettier@3.7.3: {}
 
   pretty-format@27.5.1:
     dependencies:
@@ -14160,14 +13314,6 @@ snapshots:
 
   proc-log@2.0.1: {}
 
-  proc-log@5.0.0: {}
-
-  process-on-spawn@1.1.0:
-    dependencies:
-      fromentries: 1.3.2
-
-  process@0.11.10: {}
-
   progress@2.0.3: {}
 
   promise-inflight@1.0.1: {}
@@ -14188,8 +13334,6 @@ snapshots:
       object-assign: 4.1.1
       react-is: 16.13.1
 
-  property-information@7.0.0: {}
-
   protobufjs@7.5.0:
     dependencies:
       '@protobufjs/aspromise': 1.1.2
@@ -14210,8 +13354,6 @@ snapshots:
       forwarded: 0.2.0
       ipaddr.js: 1.9.1
 
-  proxy-from-env@1.1.0: {}
-
   psl@1.15.0:
     dependencies:
       punycode: 2.3.1
@@ -14271,7 +13413,7 @@ snapshots:
     dependencies:
       typescript: 5.8.3
 
-  react-docgen@7.1.1:
+  react-docgen@8.0.0:
     dependencies:
       '@babel/core': 7.27.1
       '@babel/traverse': 7.27.1
@@ -14291,6 +13433,11 @@ snapshots:
       react: 19.1.0
       scheduler: 0.26.0
 
+  react-error-boundary@6.0.0(react@19.1.0):
+    dependencies:
+      '@babel/runtime': 7.27.1
+      react: 19.1.0
+
   react-is@16.13.1: {}
 
   react-is@17.0.2: {}
@@ -14299,24 +13446,6 @@ snapshots:
 
   react-is@19.1.0: {}
 
-  react-markdown@10.1.0(@types/react@19.1.2)(react@19.1.0):
-    dependencies:
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      '@types/react': 19.1.2
-      devlop: 1.1.0
-      hast-util-to-jsx-runtime: 2.3.6
-      html-url-attributes: 3.0.1
-      mdast-util-to-hast: 13.2.0
-      react: 19.1.0
-      remark-parse: 11.0.0
-      remark-rehype: 11.1.1
-      unified: 11.0.5
-      unist-util-visit: 5.0.0
-      vfile: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
   react-router-dom@5.3.4(react@19.1.0):
     dependencies:
       '@babel/runtime': 7.27.1
@@ -14443,27 +13572,6 @@ snapshots:
     dependencies:
       jsesc: 3.0.2
 
-  release-zalgo@1.0.0:
-    dependencies:
-      es6-error: 4.1.1
-
-  remark-parse@11.0.0:
-    dependencies:
-      '@types/mdast': 4.0.4
-      mdast-util-from-markdown: 2.0.2
-      micromark-util-types: 2.0.2
-      unified: 11.0.5
-    transitivePeerDependencies:
-      - supports-color
-
-  remark-rehype@11.1.1:
-    dependencies:
-      '@types/hast': 3.0.4
-      '@types/mdast': 4.0.4
-      mdast-util-to-hast: 13.2.0
-      unified: 11.0.5
-      vfile: 6.0.3
-
   repeat-string@1.6.1: {}
 
   require-directory@2.1.1: {}
@@ -14476,8 +13584,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  require-main-filename@2.0.0: {}
-
   requireindex@1.2.0: {}
 
   requires-port@1.0.0: {}
@@ -14492,11 +13598,6 @@ snapshots:
     dependencies:
       resolve-from: 5.0.0
 
-  resolve-dir@0.1.1:
-    dependencies:
-      expand-tilde: 1.2.2
-      global-modules: 0.2.3
-
   resolve-from@4.0.0: {}
 
   resolve-from@5.0.0: {}
@@ -14597,10 +13698,6 @@ snapshots:
     dependencies:
       queue-microtask: 1.2.3
 
-  rxjs@7.8.2:
-    dependencies:
-      tslib: 2.8.1
-
   safe-array-concat@1.1.3:
     dependencies:
       call-bind: 1.0.8
@@ -14645,7 +13742,7 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.7.1: {}
+  semver@7.7.2: {}
 
   send@1.2.0:
     dependencies:
@@ -14677,8 +13774,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  set-blocking@2.0.0: {}
-
   set-function-length@1.2.2:
     dependencies:
       define-data-property: 1.1.4
@@ -14751,14 +13846,12 @@ snapshots:
 
   simple-update-notifier@2.0.0:
     dependencies:
-      semver: 7.7.1
+      semver: 7.7.2
 
   sisteransi@1.0.5: {}
 
   slash@3.0.0: {}
 
-  slash@5.1.0: {}
-
   slice-ansi@3.0.0:
     dependencies:
       ansi-styles: 4.3.0
@@ -14776,14 +13869,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  socks-proxy-agent@8.0.5:
-    dependencies:
-      agent-base: 7.1.3
-      debug: 4.4.0
-      socks: 2.8.4
-    transitivePeerDependencies:
-      - supports-color
-
   socks@2.8.4:
     dependencies:
       ip-address: 9.0.5
@@ -14807,36 +13892,12 @@ snapshots:
 
   source-map@0.7.4: {}
 
-  space-separated-tokens@2.0.2: {}
-
-  spawn-wrap@2.0.0:
-    dependencies:
-      foreground-child: 2.0.0
-      is-windows: 1.0.2
-      make-dir: 3.1.0
-      rimraf: 3.0.2
-      signal-exit: 3.0.7
-      which: 2.0.2
-
-  spawnd@5.0.0:
-    dependencies:
-      exit: 0.1.2
-      signal-exit: 3.0.7
-      tree-kill: 1.2.2
-      wait-port: 0.2.14
-    transitivePeerDependencies:
-      - supports-color
-
   split2@4.2.0: {}
 
   sprintf-js@1.0.3: {}
 
   sprintf-js@1.1.3: {}
 
-  ssri@12.0.0:
-    dependencies:
-      minipass: 7.1.2
-
   ssri@9.0.1:
     dependencies:
       minipass: 3.3.6
@@ -14851,15 +13912,29 @@ snapshots:
 
   statuses@2.0.1: {}
 
-  storybook@8.6.12(prettier@3.5.3):
+  storybook@9.1.17(@testing-library/dom@10.1.0)(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(prettier@3.7.3)(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)):
     dependencies:
-      '@storybook/core': 8.6.12(prettier@3.5.3)(storybook@8.6.12(prettier@3.5.3))
+      '@storybook/global': 5.0.0
+      '@testing-library/jest-dom': 6.6.3
+      '@testing-library/user-event': 14.6.1(@testing-library/dom@10.1.0)
+      '@vitest/expect': 3.2.4
+      '@vitest/mocker': 3.2.4(msw@2.7.6(@types/node@22.15.16)(typescript@5.8.3))(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1))
+      '@vitest/spy': 3.2.4
+      better-opn: 3.0.2
+      esbuild: 0.25.9
+      esbuild-register: 3.6.0(esbuild@0.25.9)
+      recast: 0.23.11
+      semver: 7.7.2
+      ws: 8.18.2
     optionalDependencies:
-      prettier: 3.5.3
+      prettier: 3.7.3
     transitivePeerDependencies:
+      - '@testing-library/dom'
       - bufferutil
+      - msw
       - supports-color
       - utf-8-validate
+      - vite
 
   streamx@2.22.0:
     dependencies:
@@ -14875,11 +13950,6 @@ snapshots:
       char-regex: 1.0.2
       strip-ansi: 6.0.1
 
-  string-length@5.0.1:
-    dependencies:
-      char-regex: 2.0.2
-      strip-ansi: 7.1.0
-
   string-width@4.2.3:
     dependencies:
       emoji-regex: 8.0.0
@@ -14940,11 +14010,6 @@ snapshots:
     dependencies:
       safe-buffer: 5.2.1
 
-  stringify-entities@4.0.4:
-    dependencies:
-      character-entities-html4: 2.1.0
-      character-entities-legacy: 3.0.0
-
   strip-ansi@6.0.1:
     dependencies:
       ansi-regex: 5.0.1
@@ -14971,14 +14036,6 @@ snapshots:
 
   style-mod@4.1.2: {}
 
-  style-to-js@1.1.16:
-    dependencies:
-      style-to-object: 1.0.8
-
-  style-to-object@1.0.8:
-    dependencies:
-      inline-style-parser: 0.2.4
-
   styled-components@6.1.18(react-dom@19.1.0(react@19.1.0))(react@19.1.0):
     dependencies:
       '@emotion/is-prop-valid': 1.2.2
@@ -15019,10 +14076,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  supports-color@5.5.0:
-    dependencies:
-      has-flag: 3.0.0
-
   supports-color@7.2.0:
     dependencies:
       has-flag: 4.0.0
@@ -15033,11 +14086,21 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
+  svgo@4.0.0:
+    dependencies:
+      commander: 11.1.0
+      css-select: 5.1.0
+      css-tree: 3.1.0
+      css-what: 6.1.0
+      csso: 5.0.5
+      picocolors: 1.1.1
+      sax: 1.4.1
+
   symbol-tree@3.2.4: {}
 
   tabbable@6.2.0: {}
 
-  tar-fs@3.0.8:
+  tar-fs@3.1.1:
     dependencies:
       pump: 3.0.2
       tar-stream: 3.1.7
@@ -15062,15 +14125,6 @@ snapshots:
       mkdirp: 1.0.4
       yallist: 4.0.0
 
-  tar@7.4.3:
-    dependencies:
-      '@isaacs/fs-minipass': 4.0.1
-      chownr: 3.0.0
-      minipass: 7.1.2
-      minizlib: 3.0.2
-      mkdirp: 3.0.1
-      yallist: 5.0.0
-
   temp-file@3.4.0:
     dependencies:
       async-exit-hook: 2.0.1
@@ -15094,6 +14148,8 @@ snapshots:
 
   tiny-invariant@1.3.3: {}
 
+  tiny-typed-emitter@2.1.0: {}
+
   tiny-warning@1.0.3: {}
 
   tinyglobby@0.2.13:
@@ -15101,6 +14157,10 @@ snapshots:
       fdir: 6.4.4(picomatch@4.0.2)
       picomatch: 4.0.2
 
+  tinyrainbow@2.0.0: {}
+
+  tinyspy@4.0.3: {}
+
   tldts-core@6.1.86: {}
 
   tldts@6.1.86:
@@ -15109,9 +14169,9 @@ snapshots:
 
   tmp-promise@3.0.3:
     dependencies:
-      tmp: 0.2.3
+      tmp: 0.2.4
 
-  tmp@0.2.3: {}
+  tmp@0.2.4: {}
 
   tmpl@1.0.5: {}
 
@@ -15140,14 +14200,8 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  tree-kill@1.2.2: {}
-
-  trim-lines@3.0.1: {}
-
   triple-beam@1.3.0: {}
 
-  trough@2.2.0: {}
-
   truncate-utf8-bytes@1.0.2:
     dependencies:
       utf8-byte-length: 1.0.5
@@ -15183,10 +14237,6 @@ snapshots:
 
   type-fest@0.21.3: {}
 
-  type-fest@0.8.1: {}
-
-  type-fest@2.19.0: {}
-
   type-fest@4.41.0: {}
 
   type-is@2.0.1:
@@ -15228,10 +14278,6 @@ snapshots:
       possible-typed-array-names: 1.1.0
       reflect.getprototypeof: 1.0.10
 
-  typedarray-to-buffer@3.1.5:
-    dependencies:
-      is-typedarray: 1.0.0
-
   typescript-eslint@8.32.0(eslint@9.26.0)(typescript@5.8.3):
     dependencies:
       '@typescript-eslint/eslint-plugin': 8.32.0(@typescript-eslint/parser@8.32.0(eslint@9.26.0)(typescript@5.8.3))(eslint@9.26.0)(typescript@5.8.3)
@@ -15264,55 +14310,16 @@ snapshots:
 
   unicode-property-aliases-ecmascript@2.1.0: {}
 
-  unified@11.0.5:
-    dependencies:
-      '@types/unist': 3.0.3
-      bail: 2.0.2
-      devlop: 1.1.0
-      extend: 3.0.2
-      is-plain-obj: 4.1.0
-      trough: 2.2.0
-      vfile: 6.0.3
+  unicorn-magic@0.1.0: {}
 
   unique-filename@2.0.1:
     dependencies:
       unique-slug: 3.0.0
 
-  unique-filename@4.0.0:
-    dependencies:
-      unique-slug: 5.0.0
-
   unique-slug@3.0.0:
     dependencies:
       imurmurhash: 0.1.4
 
-  unique-slug@5.0.0:
-    dependencies:
-      imurmurhash: 0.1.4
-
-  unist-util-is@6.0.0:
-    dependencies:
-      '@types/unist': 3.0.3
-
-  unist-util-position@5.0.0:
-    dependencies:
-      '@types/unist': 3.0.3
-
-  unist-util-stringify-position@4.0.0:
-    dependencies:
-      '@types/unist': 3.0.3
-
-  unist-util-visit-parents@6.0.1:
-    dependencies:
-      '@types/unist': 3.0.3
-      unist-util-is: 6.0.0
-
-  unist-util-visit@5.0.0:
-    dependencies:
-      '@types/unist': 3.0.3
-      unist-util-is: 6.0.0
-      unist-util-visit-parents: 6.0.1
-
   universalify@0.1.2: {}
 
   universalify@0.2.0: {}
@@ -15352,21 +14359,14 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.2
 
-  utf8-byte-length@1.0.5: {}
-
-  util-deprecate@1.0.2: {}
-
-  util@0.12.5:
+  usehooks-ts@3.1.1(react@19.1.0):
     dependencies:
-      inherits: 2.0.4
-      is-arguments: 1.2.0
-      is-generator-function: 1.1.0
-      is-typed-array: 1.1.15
-      which-typed-array: 1.1.19
+      lodash.debounce: 4.0.8
+      react: 19.1.0
 
-  uuid@8.3.2: {}
+  utf8-byte-length@1.0.5: {}
 
-  uuid@9.0.1: {}
+  util-deprecate@1.0.2: {}
 
   v8-to-istanbul@9.1.3:
     dependencies:
@@ -15385,15 +14385,14 @@ snapshots:
       extsprintf: 1.4.1
     optional: true
 
-  vfile-message@4.0.2:
+  vite-plugin-compression@0.5.1(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)):
     dependencies:
-      '@types/unist': 3.0.3
-      unist-util-stringify-position: 4.0.0
-
-  vfile@6.0.3:
-    dependencies:
-      '@types/unist': 3.0.3
-      vfile-message: 4.0.2
+      chalk: 4.1.2
+      debug: 4.4.0
+      fs-extra: 10.1.0
+      vite: 6.3.5(@types/node@22.15.16)(yaml@2.7.1)
+    transitivePeerDependencies:
+      - supports-color
 
   vite-plugin-wasm@3.4.1(vite@6.3.5(@types/node@22.15.16)(yaml@2.7.1)):
     dependencies:
@@ -15437,24 +14436,6 @@ snapshots:
     dependencies:
       xml-name-validator: 5.0.0
 
-  wait-on@7.2.0:
-    dependencies:
-      axios: 1.8.2
-      joi: 17.13.3
-      lodash: 4.17.21
-      minimist: 1.2.8
-      rxjs: 7.8.2
-    transitivePeerDependencies:
-      - debug
-
-  wait-port@0.2.14:
-    dependencies:
-      chalk: 2.4.2
-      commander: 3.0.2
-      debug: 4.4.0
-    transitivePeerDependencies:
-      - supports-color
-
   walker@1.0.8:
     dependencies:
       makeerror: 1.0.12
@@ -15522,8 +14503,6 @@ snapshots:
       is-weakmap: 2.0.2
       is-weakset: 2.0.4
 
-  which-module@2.0.1: {}
-
   which-typed-array@1.1.19:
     dependencies:
       available-typed-arrays: 1.0.7
@@ -15534,10 +14513,6 @@ snapshots:
       gopd: 1.2.0
       has-tostringtag: 1.0.2
 
-  which@1.3.1:
-    dependencies:
-      isexe: 2.0.0
-
   which@2.0.2:
     dependencies:
       isexe: 2.0.0
@@ -15588,13 +14563,6 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  write-file-atomic@3.0.3:
-    dependencies:
-      imurmurhash: 0.1.4
-      is-typedarray: 1.0.0
-      signal-exit: 3.0.7
-      typedarray-to-buffer: 3.1.5
-
   write-file-atomic@4.0.2:
     dependencies:
       imurmurhash: 0.1.4
@@ -15608,47 +14576,22 @@ snapshots:
 
   xml-name-validator@5.0.0: {}
 
-  xml@1.0.1: {}
-
   xmlbuilder@15.1.1: {}
 
   xmlchars@2.2.0: {}
 
-  y18n@4.0.3: {}
-
   y18n@5.0.8: {}
 
   yallist@3.1.1: {}
 
   yallist@4.0.0: {}
 
-  yallist@5.0.0: {}
-
   yaml@1.10.2: {}
 
   yaml@2.7.1: {}
 
-  yargs-parser@18.1.3:
-    dependencies:
-      camelcase: 5.3.1
-      decamelize: 1.2.0
-
   yargs-parser@21.1.1: {}
 
-  yargs@15.4.1:
-    dependencies:
-      cliui: 6.0.0
-      decamelize: 1.2.0
-      find-up: 4.1.0
-      get-caller-file: 2.0.5
-      require-directory: 2.1.1
-      require-main-filename: 2.0.0
-      set-blocking: 2.0.0
-      string-width: 4.2.3
-      which-module: 2.0.1
-      y18n: 4.0.3
-      yargs-parser: 18.1.3
-
   yargs@17.7.2:
     dependencies:
       cliui: 8.0.1
@@ -15666,6 +14609,8 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
+  yocto-queue@1.2.1: {}
+
   yoctocolors-cjs@2.1.2: {}
 
   zod-to-json-schema@3.24.5(zod@3.24.4):
@@ -15674,6 +14619,6 @@ snapshots:
 
   zod@3.24.4: {}
 
-  zone.js@0.15.0: {}
+  zod@4.1.5: {}
 
-  zwitch@2.0.4: {}
+  zone.js@0.15.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d7302904413d6..cb2f63cee2d8d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -28,3 +28,12 @@ peerDependencyRules:
     - electron-builder-squirrel-windows
 # shellEmulator enables cross-platform scripting, allowing POSIX-style shell variables to work on Windows.
 shellEmulator: true
+# packageImportMethod avoids an issue building the web UI in docker on mac. It does not seem to
+# affect performance outside of docker.
+# https://github.com/gravitational/teleport/issues/46019
+packageImportMethod: clone-or-copy
+patchedDependencies:
+  # Needed for roundRect support which was merged to jest-canvas-mock but not released.
+  jest-canvas-mock@2.5.2: web/patches/jest-canvas-mock@2.5.2.patch
+# Do not install packages released less than 2 days (2880 minutes) ago
+minimumReleaseAge: 2880
diff --git a/proto/accessgraph/v1alpha/access_graph_service.proto b/proto/accessgraph/v1alpha/access_graph_service.proto
index 6401bbdbfdfe8..13a5d64f476be 100644
--- a/proto/accessgraph/v1alpha/access_graph_service.proto
+++ b/proto/accessgraph/v1alpha/access_graph_service.proto
@@ -31,6 +31,7 @@ import "accessgraph/v1alpha/netiq.proto";
 import "accessgraph/v1alpha/okta.proto";
 import "accessgraph/v1alpha/resources.proto";
 import "google/protobuf/empty.proto";
+import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 import "teleport/auditlog/v1/auditlog.proto";
 
@@ -103,6 +104,32 @@ service AccessGraphService {
   // 4. Client sends subsequent `AWSCloudTrailStreamRequest` messages.
   rpc AWSCloudTrailStream(stream AWSCloudTrailStreamRequest) returns (stream AWSCloudTrailStreamResponse);
 
+  // KubeAuditLogStream establishes a persistent bidirectional stream for exporting
+  // Kubernetes audit logs from a client (teleport) to a server (access-graph). This stream
+  // is separate from other audit log streams as fetching Kubernetes audit logs can
+  // require a variety of mechanisms for retrieving them depending on how/where the
+  // k8s cluster is deployed. It often will not make sense to integrate this audit log
+  // stream with any of the others.
+  //
+  // This stream facilitates:
+  // - Initial configuration exchange and validation.
+  // - Streaming batches of audit log events from client to server.
+  // - Reliable export resumption via client-provided resume state updates.
+  // - Logs for multiple clusters can be streamed across the one grpc stream.
+  //
+  // Basic Interaction Flow:
+  // 1. Client connects and sends an initial `KubeAuditLogStreamRequest` with `config`.
+  // 2. Server responds with an initial `KubeAuditLogStreamResponse`, confirming the
+  //    effective configuration.
+  // 3. Client sends a `KubeAuditLogNewStream` message initiating a log stream for
+  //    a cluster, with a timestamp of the oldest logs it wants.
+  // 4. Server responds with a `KubeAuditLogResumeState` message containing either
+  //    a resumption cursor indicating when logs should be streamed from, or if
+  //    a new cluster or an old outdated resumption point has been stored, sends
+  //    the timestamp from which logs should be sent.
+  // 5. Client sends subsequent `KubeAuditLogStreamRequest` messages with new logs.
+  rpc KubeAuditLogStream(stream KubeAuditLogStreamRequest) returns (stream KubeAuditLogStreamResponse);
+
   // Register submits a new tenant representing this Teleport cluster to the TAG service,
   // identified by its HostCA certificate.
   // The method is idempotent: it succeeds if the tenant has already registered and has the specific CA associated.
@@ -338,6 +365,8 @@ message AuditLogStreamRequest {
 // AuditLogConfig is the configuration for exporting audit logs.
 message AuditLogConfig {
   google.protobuf.Timestamp start_date = 1; // Start date for exporting audit logs.
+  // teleport_cluster is the teleport cluster name this audit log config refers to.
+  string teleport_cluster = 2;
 }
 
 // AuditLogEvents bundles a batch of unstructured audit log events with the
@@ -608,6 +637,119 @@ message AWSCloudTrailEventResource {
   string type = 2;
 }
 
+// KubeAuditLogStreamRequest is sent from the client (Teleport) to the server
+// (access graph) over the bi-directional KubeAuditLogStream. It encapsulates
+// distinct client actions for sending batches of Kubernetes audit log events
+// and managing the persistent resume state maintained by the access graph
+// server.
+message KubeAuditLogStreamRequest {
+  oneof action {
+    KubeAuditLogConfig config = 1;
+    KubeAuditLogNewStream new_stream = 2;
+    KubeAuditLogEvents events = 3;
+  }
+}
+
+// KubeAuditLogConfig is the KubeAuditLogStream configuration. It is sent from
+// the client (Teleport) to the server (access graph) on start up, containing
+// any configuration parameters from the Teleport config. The server will
+// respond with an adjusted config that is that it will use, possibly
+// overriding the supplied config.
+// Currently there is no configuration exchanged. This message is present for
+// future expansion.
+message KubeAuditLogConfig {}
+
+// KubeAuditLogNewStream identifies a log source and cluster that the client
+// wants to start sending to the server. The server responds with a
+// KubeAuditLogResumeState message indicating where to resume streaming
+// logs from.
+message KubeAuditLogNewStream {
+  KubeAuditLogCursor initial = 1;
+}
+
+// KubeAuditLogEvents is a chunk of Kubernetes apiserver audit logs.
+message KubeAuditLogEvents {
+  // event is a Kubernetes audit log event represented as a struct so as to
+  // not depend on the Kubernetes proto files. Additionally, the audit log
+  // events are typically received as JSON, not protobufs.
+  // package k8s.io.apiserver.pkg.apis.audit.v1 at
+  // https://github.com/kubernetes/apiserver/blob/master/pkg/apis/audit/v1/generated.proto
+  repeated google.protobuf.Struct events = 1;
+
+  // cursor is the position in the event stream of the last event in the
+  // event field. It can be sent back to Teleport when a stream is
+  // reconnected to resume the event stream from the end of this chunk.
+  KubeAuditLogCursor cursor = 2;
+}
+
+// KubeAuditLogCursor is a position in a stream of KubeAuditLogEvents for
+// resuming a stream of events after an interrupted connection. Each batch
+// of events has a cursor referring to the last event of the batch. The
+// cursor can be sent to Teleport when resuming a connection.
+message KubeAuditLogCursor {
+  // KubeAuditLogSource specifies a source of logs in order to interpret a
+  // KubeAuditLogCursor id and cursor. Different sources of logs will have
+  // different ways of representing a position in a log stream.
+  enum KubeAuditLogSource {
+    // KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED represents a zero value where no log
+    // source has been specified.
+    KUBE_AUDIT_LOG_SOURCE_UNSPECIFIED = 0;
+    // KUBE_AUDIT_LOG_SOURCE_EKS specifies AWS CloudWatch as the source of
+    // Kubernetes apiserver audit logs. This is where EKS sends the apiserver
+    // audit logs.
+    KUBE_AUDIT_LOG_SOURCE_EKS = 1;
+  }
+
+  // log_source is where the logs are coming from that this cursor is for.
+  KubeAuditLogSource log_source = 1;
+
+  // cluster_id is an opaque identifier for the Kubernetes cluster that this
+  // cursor refers to. The ID should be interpreted based on the cluster type.
+  string cluster_id = 2;
+
+  // event_id is the ID of the last event of a batch of events that a cursor
+  // refers to. It is an opaque value interpreted according to the log_source
+  // of the cursor. When sent as part of a KubeAuditLogNewStream message, it
+  // will be empty. When sent as part of a KubeAuditLogResumeState, it may be
+  // empty to indicate that there is no resume state cursor.
+  string event_id = 3;
+
+  // last_event_time is the timestamp of the last event of a batch of events
+  // that a cursor refers to. If the event_id is sufficient to resume streaming
+  // events for a log source then this field may be omitted. When sent as part
+  // of a KubeAuditLogNewStream message, it may contain the timestamp from which
+  // the client intends to stream logs. The KubeAuditLogResumeState may contain
+  // a different time, indicating the timestamp from which it should start,
+  // either because it is a resumption of an existing stream or because the
+  // server is overriding the start timestamp for a new stream.
+  google.protobuf.Timestamp last_event_time = 4;
+}
+
+// KubeAuditLogStreamResponse is sent from the server (access graph) to the
+// client (Teleport) over th bi-directional KubeAuditLogStream. It is used to
+// convey the resume state of the log streams that access graph is processing
+// the logs for.
+message KubeAuditLogStreamResponse {
+  oneof state {
+    KubeAuditLogConfig config = 1;
+    KubeAuditLogResumeState resume_state = 2;
+  }
+}
+
+// KubeAuditLogResumeState is the response to the KubeAuditLogNewStream request
+// and contains the cursor for the resume state of that Kubernetes cluster.
+message KubeAuditLogResumeState {
+  // cursor is a resumption cursor for a new stream, sent in response to
+  // a KubeAuditLogNewStream request. If the log_source and cluster_id sent
+  // in the new stream request are unknown to the server, this cursor
+  // may not contain a position to resume from. However the timestamp in
+  // the cursor should be set to what was received in the KubeAuditLogNewStream
+  // message if it is not to be overridden, or it should be replaced with
+  // a different initial start timestamp if Access Graph (server) wants to
+  // override that.
+  KubeAuditLogCursor cursor = 1;
+}
+
 // GitHubAuditLogStreamRequest represents a client message in the GitHubAuditLogStream,
 // containing either initial configuration or a batch of GitHub audit log events.
 message GitHubAuditLogStreamRequest {
diff --git a/proto/accessgraph/v1alpha/aws.proto b/proto/accessgraph/v1alpha/aws.proto
index ab3db4306b02a..72eca07e6a02c 100644
--- a/proto/accessgraph/v1alpha/aws.proto
+++ b/proto/accessgraph/v1alpha/aws.proto
@@ -77,13 +77,15 @@ message AWSResource {
     AWSSAMLProviderV1 saml_provider = 19;
     // oidc_provider is an AWS IAM OpenID Connect Identity Provider
     AWSOIDCProviderV1 oidc_provider = 20;
+    // kms_key is an AWS KMS key.
+    AWSKMSKeyV1 kms_key = 21;
   }
 }
 
 // AWSUserInlinePolicyV1 is a policy that is inlined to an AWS user.
 message AWSUserInlinePolicyV1 {
-  reserved 2;
-  reserved "username";
+  reserved 2, 6;
+  reserved "username", "last_sync_time";
   // policy_name is the name of the policy.
   string policy_name = 1;
   // policy_document is the JSON document that defines the policy.
@@ -92,12 +94,12 @@ message AWSUserInlinePolicyV1 {
   string account_id = 4;
   // user is the user who the policy is attached to.
   AWSUserV1 user = 5;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 6;
 }
 
 // AWSPolicyV1 is an AWS policy.
 message AWSPolicyV1 {
+  reserved 13;
+  reserved "last_sync_time";
   // arn is the ARN of the AWS policy.
   string arn = 1;
   // created_at is the time when the AWS policy was created.
@@ -123,12 +125,12 @@ message AWSPolicyV1 {
   string policy_name = 11;
   // policy_document is the JSON document that defines the policy.
   bytes policy_document = 12;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 13;
 }
 
 // AWSGroupV1 is a group of AWS users.
 message AWSGroupV1 {
+  reserved 7;
+  reserved "last_sync_time";
   // arn is the ARN of the AWS group.
   string arn = 1;
   // created_at is the time when the AWS group was created.
@@ -141,22 +143,22 @@ message AWSGroupV1 {
   string path = 5;
   // account_id is the ID of the AWS account that the group belongs to.
   string account_id = 6;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 7;
 }
 
 // AWSUserGroupsV1 is a list of AWS groups that an AWS user belongs to.
 message AWSUserGroupsV1 {
+  reserved 3;
+  reserved "last_sync_time";
   // user is the AWS user.
   AWSUserV1 user = 1;
   // groups is the list of AWS groups that the user belongs to.
   repeated AWSGroupV1 groups = 2;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 3;
 }
 
 // AWSUserV1 is an AWS user.
 message AWSUserV1 {
+  reserved 10;
+  reserved "last_sync_time";
   // arn is the ARN of the AWS user.
   string arn = 1;
   // created_at is the time when the AWS user was created.
@@ -175,8 +177,6 @@ message AWSUserV1 {
   repeated AWSTag tags = 8;
   // account_id is the ID of the AWS account that the user belongs to.
   string account_id = 9;
-  // last_sync_time is the time when the user was last synced.
-  google.protobuf.Timestamp last_sync_time = 10;
 }
 
 // AWSTag is a tag that is attached to an AWS resource.
@@ -207,6 +207,8 @@ enum UsersPermissionsBoundaryType {
 
 // AWSInstanceV1 is an AWS instance.
 message AWSInstanceV1 {
+  reserved 9;
+  reserved "last_sync_time";
   // instance_id is the ID of the AWS instance.
   string instance_id = 1;
   // launch_time is the time when the instance was launched.
@@ -225,21 +227,19 @@ message AWSInstanceV1 {
   // launch_key_name is the name of the key pair that is used to launch the
   // instance.
   google.protobuf.StringValue launch_key_name = 8;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 9;
 }
 
 // AWSUserAttachedPolicies is a list of AWS policies that are attached to an
 // AWS user.
 message AWSUserAttachedPolicies {
+  reserved 9;
+  reserved "last_sync_time";
   // user is the AWS user.
   AWSUserV1 user = 1;
   // policies is the list of AWS policies that are attached to the user.
   repeated AttachedPolicyV1 policies = 2;
   // account_id is the ID of the AWS account that the user belongs to.
   string account_id = 3;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 9;
 }
 
 // AttachedPolicyV1 is a AWS policy identifier.
@@ -253,18 +253,20 @@ message AttachedPolicyV1 {
 // AWSGroupAttachedPolicies is a list of AWS policies that are attached to an
 // AWS group.
 message AWSGroupAttachedPolicies {
+  reserved 4;
+  reserved "last_sync_time";
   // group is the AWS group.
   AWSGroupV1 group = 1;
   // policies is the list of AWS policies that are attached to the group.
   repeated AttachedPolicyV1 policies = 2;
   // account_id is the ID of the AWS account that the group belongs to.
   string account_id = 3;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 4;
 }
 
 // AWSGroupInlinePolicyV1 is a policy that is inlined to an AWS Group.
 message AWSGroupInlinePolicyV1 {
+  reserved 5;
+  reserved "last_sync_time";
   // policy_name is the name of the policy.
   string policy_name = 1;
   // group is the AWS group.
@@ -273,12 +275,12 @@ message AWSGroupInlinePolicyV1 {
   bytes policy_document = 3;
   // account_id is the ID of the AWS account that the group belongs to.
   string account_id = 4;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 5;
 }
 
 // AWSS3BucketV1 is an AWS S3 bucket.
 message AWSS3BucketV1 {
+  reserved 7;
+  reserved "last_sync_time";
   // name is the name of the AWS S3 bucket.
   string name = 1;
   // account_id is the ID of the AWS account that the S3 bucket belongs to.
@@ -291,8 +293,6 @@ message AWSS3BucketV1 {
   repeated AWSS3BucketACL acls = 5;
   // tags is the list of tags that are attached to the S3 bucket.
   repeated AWSTag tags = 6;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 7;
 }
 
 // AWSS3BucketACL is the ACL of an AWS S3 bucket.
@@ -319,6 +319,8 @@ message AWSS3BucketACLGrantee {
 
 // AWSRoleV1 is an AWS role.
 message AWSRoleV1 {
+  reserved 13;
+  reserved "last_sync_time";
   // arn is the ARN of the AWS role.
   string arn = 1;
   // assume_role_policy_document is the JSON document that defines the trust
@@ -344,8 +346,6 @@ message AWSRoleV1 {
   RoleLastUsedV1 role_last_used = 11;
   // account_id is the ID of the AWS account that the role belongs to.
   string account_id = 12;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 13;
 }
 
 // RolePermissionsBoundaryV1 is the permissions boundary of a role.
@@ -376,8 +376,8 @@ message RoleLastUsedV1 {
 
 // AWSRoleInlinePolicyV1 is a policy that is inlined to an AWS Role.
 message AWSRoleInlinePolicyV1 {
-  reserved 2;
-  reserved "role";
+  reserved 2, 6;
+  reserved "role", "last_sync_time";
   // policy_name is the name of the policy.
   string policy_name = 1;
   // policy_document is the JSON document that defines the policy.
@@ -386,27 +386,25 @@ message AWSRoleInlinePolicyV1 {
   string account_id = 4;
   // aws_role is the role name of the AWS role that the policy is attached to.
   AWSRoleV1 aws_role = 5;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 6;
 }
 
 // AWSRoleAttachedPolicies is a list of AWS policies that are attached to an
 // AWS role.
 message AWSRoleAttachedPolicies {
-  reserved 1;
-  reserved "role";
+  reserved 1, 5;
+  reserved "role", "last_sync_time";
   // policies is the list of AWS policies that are attached to the role.
   repeated AttachedPolicyV1 policies = 2;
   // account_id is the ID of the AWS account that the role belongs to.
   string account_id = 3;
   // aws_role is the AWS role.
   AWSRoleV1 aws_role = 4;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 5;
 }
 
 // AWSInstanceProfileV1 is an AWS instance profile.
 message AWSInstanceProfileV1 {
+  reserved 9;
+  reserved "last_sync_time";
   // arn is the ARN of the AWS instance profile.
   string arn = 1;
   // created_at is the time when the instance profile was created.
@@ -424,12 +422,12 @@ message AWSInstanceProfileV1 {
   // account_id is the ID of the AWS account that the instance profile belongs
   // to.
   string account_id = 8;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 9;
 }
 
 // AWSEKSClusterV1 represents an AWS EKS cluster.
 message AWSEKSClusterV1 {
+  reserved 9;
+  reserved "last_sync_time";
   // name is the cluster name.
   string name = 1;
   // arn is the cluster arn
@@ -447,12 +445,12 @@ message AWSEKSClusterV1 {
   // account_id is the ID of the AWS account that the instance profile belongs
   // to.
   string account_id = 8;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 9;
 }
 
 // AWSEKSClusterAccessEntriesV1 represents an EKS cluster Access Entry.
 message AWSEKSClusterAccessEntryV1 {
+  reserved 11;
+  reserved "last_sync_time";
   // cluster is the EKS cluster.
   AWSEKSClusterV1 cluster = 1;
   // access_entry_arn is the ARN of the access entry.
@@ -474,12 +472,12 @@ message AWSEKSClusterAccessEntryV1 {
   // account_id is the ID of the AWS account that the instance profile belongs
   // to.
   string account_id = 10;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 11;
 }
 
 // AWSEKSAssociatedAccessPolicyV1 identifies an access policy association.
 message AWSEKSAssociatedAccessPolicyV1 {
+  reserved 8;
+  reserved "last_sync_time";
   // cluster is the EKS cluster.
   AWSEKSClusterV1 cluster = 1;
   // principal_arn is the principal that the associated access policy insides.
@@ -496,8 +494,6 @@ message AWSEKSAssociatedAccessPolicyV1 {
   // account_id is the ID of the AWS account that the instance profile belongs
   // to.
   string account_id = 7;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 8;
 }
 
 //AWSEKSAccessScope identifies the scope to which the AssociatedAccessPolicy applies.
@@ -510,6 +506,8 @@ message AWSEKSAccessScopeV1 {
 
 // AWSRDSDatabaseV1 defines the database details.
 message AWSRDSDatabaseV1 {
+  reserved 11;
+  reserved "last_sync_time";
   // arn is the instance ARN.
   string arn = 1;
   // status is the instance status.
@@ -531,8 +529,6 @@ message AWSRDSDatabaseV1 {
   string account_id = 9;
   // resource_id is the RDS unique resource id.
   string resource_id = 10;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 11;
 }
 
 // AWSRDSEngineV1 defines the database engine details
@@ -545,6 +541,8 @@ message AWSRDSEngineV1 {
 
 // AWSSAMLProviderV1 defines the SAML identity provider details.
 message AWSSAMLProviderV1 {
+  reserved 9;
+  reserved "last_sync_time";
   // arn is the provider ARN.
   string arn = 1;
   // created_at is the time when the SAML provider was created.
@@ -561,12 +559,12 @@ message AWSSAMLProviderV1 {
   repeated string sso_urls = 7;
   // signing_certificates is a list of signing certificates for this identity provider.
   repeated string signing_certificates = 8;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 9;
 }
 
 // AWSOIDCProviderV1 defines the OIDC identity provider details.
 message AWSOIDCProviderV1 {
+  reserved 8;
+  reserved "last_sync_time";
   // arn is the provider ARN.
   string arn = 1;
   // created_at is the time when the OIDC provider was created.
@@ -581,6 +579,32 @@ message AWSOIDCProviderV1 {
   repeated string thumbprints = 6;
   // url is the URL for this OIDC provider.
   string url = 7;
-  // last_sync_time is the time when the resource was last synced.
-  google.protobuf.Timestamp last_sync_time = 8;
+}
+
+// AWSKMSKeyV1 defines the KMS key details.
+message AWSKMSKeyV1 {
+  reserved 5;
+  reserved "last_sync_time";
+  // arn is the key ARN.
+  string arn = 1;
+  // created_at is the time when the key was created.
+  google.protobuf.Timestamp created_at = 2;
+  // tags is the list of tags that are attached to the key.
+  repeated AWSTag tags = 3;
+  // account_id is the ID of the AWS account that the key belongs to.
+  string account_id = 4;
+  // aliases is the list of aliases that are attached to the key.
+  // they are prefixed with "alias/", for example "alias/my-key-alias".
+  repeated string aliases = 6;
+  // policy_document is the JSON document that defines the Key Policy. Every KMS
+  // key must have exactly one key policy.
+  bytes policy_document = 7;
+  // region is the AWS region that the key belongs to. For multi-region keys,
+  // this is the region where the current key, primary or replica, is located.
+  string region = 8;
+  // multi_region_key_type is the type of the multi-region key.
+  // It is set to "PRIMARY", "REPLICA" or left empty for single region keys.
+  string multi_region_key_type = 9;
+  // hsm_cluster_id is the ID of the HSM cluster that the key belongs to, if any.
+  string hsm_cluster_id = 10;
 }
diff --git a/proto/accessgraph/v1alpha/azure.proto b/proto/accessgraph/v1alpha/azure.proto
index 58bef9b36e97b..4a585e2990060 100644
--- a/proto/accessgraph/v1alpha/azure.proto
+++ b/proto/accessgraph/v1alpha/azure.proto
@@ -18,8 +18,6 @@
 syntax = "proto3";
 package accessgraph.v1alpha;
 
-import "google/protobuf/timestamp.proto";
-
 option go_package = "github.com/gravitational/teleport/gen/proto/go/accessgraph/v1alpha;accessgraphv1alpha";
 
 // AzureResourceList is a list of Azure resources
@@ -43,12 +41,12 @@ message AzureResource {
 
 // AzureVirtualMachine is an Azure virtual machine
 message AzureVirtualMachine {
+  reserved 3;
+  reserved "last_sync_time";
   // id is the ID of the virtual machine
   string id = 1;
   // subscription_id is the ID of the subscription to which the virtual machine belongs
   string subscription_id = 2;
-  // last_sync_time is when the virtual machine was last fetched from Azure
-  google.protobuf.Timestamp last_sync_time = 3;
   // name is the given name of the virtual machine
   string name = 4;
   // resource_group is the name of the resource group to which the virtual machine belongs
@@ -71,12 +69,12 @@ message AzureIdentity {
 
 // AzurePrincipal is a Graph API principal (user, group, service principal)
 message AzurePrincipal {
+  reserved 3;
+  reserved "last_sync_time";
   // id is the ID of the principal
   string id = 1;
   // subscription_id is the ID of the subscription to which the principal belongs
   string subscription_id = 2;
-  // last_sync_time is when the principal was last fetched from Azure
-  google.protobuf.Timestamp last_sync_time = 3;
   // display_name is the given name for the principal, e.g. a user's first+last name
   string display_name = 4;
   // member_of lists the groups and directories the principal is assigned to
@@ -89,12 +87,12 @@ message AzurePrincipal {
 
 // AzureRoleAssignment links an Azure principal to a role definition with a scope
 message AzureRoleAssignment {
+  reserved 3;
+  reserved "last_sync_time";
   // id is the ID of the role assignment
   string id = 1;
   // subscription_id is the ID of the subscription to which the role assignment belongs
   string subscription_id = 2;
-  // last_sync_time is when the role assignment was last fetched from Azure
-  google.protobuf.Timestamp last_sync_time = 3;
   // principal_id is the ID of the principal being assigned a role
   string principal_id = 4;
   // role_definition_id is the ID of the role definition assigned to the principal
@@ -107,12 +105,12 @@ message AzureRoleAssignment {
 
 // AzureRoleDefinition defines a role by its permissions
 message AzureRoleDefinition {
+  reserved 3;
+  reserved "last_sync_time";
   // id is the ID of the role definition
   string id = 1;
   // subscription_id is the ID of the subscription to which the role definition belongs
   string subscription_id = 2;
-  // last_sync_time is when the role definition was last fetched from Azure
-  google.protobuf.Timestamp last_sync_time = 3;
   // name is the given name for the role definition
   string name = 4;
   // description provides additional detail about the role definition
diff --git a/proto/accessgraph/v1alpha/okta.proto b/proto/accessgraph/v1alpha/okta.proto
index fdf69dc67f833..f9b4736486ac0 100644
--- a/proto/accessgraph/v1alpha/okta.proto
+++ b/proto/accessgraph/v1alpha/okta.proto
@@ -100,6 +100,8 @@ message OktaAuditLogV1 {
 message OktaConfigV1 {
   // The desired start date from which to begin exporting Okta audit logs.
   google.protobuf.Timestamp start_date = 1;
+  // organization is the Okta organization name.
+  string organization = 2;
 }
 
 // OktaTokenV1 holds information about an Okta token (ex.: an API token),
diff --git a/proto/prehog/v1/teleport.proto b/proto/prehog/v1/teleport.proto
index dc609b8745e4f..50faacf178cec 100644
--- a/proto/prehog/v1/teleport.proto
+++ b/proto/prehog/v1/teleport.proto
@@ -75,6 +75,11 @@ enum UserKind {
   //
   // PostHog property value: "bot"
   USER_KIND_BOT = 2;
+
+  // Indicates that the user associated with this event is a system component e.g. Okta service.
+  //
+  // PostHog property value: "system"
+  USER_KIND_SYSTEM = 3;
 }
 
 // UserOrigin is the origin of a user account.
diff --git a/proto/prehog/v1alpha/teleport.proto b/proto/prehog/v1alpha/teleport.proto
index 9e45919faa1f4..3155da7c58b98 100644
--- a/proto/prehog/v1alpha/teleport.proto
+++ b/proto/prehog/v1alpha/teleport.proto
@@ -201,6 +201,11 @@ enum UserKind {
   //
   // PostHog property value: "bot"
   USER_KIND_BOT = 2;
+
+  // Indicates that the user associated with this event is a system component e.g. Okta service.
+  //
+  // PostHog property value: "system"
+  USER_KIND_SYSTEM = 3;
 }
 
 // an event representing one of several audit events: session.start, port,
@@ -249,6 +254,10 @@ message SessionStartEvent {
   // if session_type == "git" the git struct contains additional information
   // about git session.
   SessionStartGitMetadata git = 7;
+
+  // if session_type == "app_mcp" the mcp struct contains additional information
+  // about the MCP session.
+  SessionStartMCPMetadata mcp = 8;
 }
 
 // SessionStartDatabaseMetadata contains additional information about database session.
@@ -303,6 +312,22 @@ message SessionStartGitMetadata {
   string git_service = 2;
 }
 
+// SessionStartMCPMetadata contains additional information about an MCP session.
+message SessionStartMCPMetadata {
+  // Transport type of the MCP server. Value from types.GetMCPServerTransportType.
+  string transport = 1;
+  // MCP protocol version like "2025-06-18".
+  string protocol_version = 2;
+  // Indicates the client used on the session, e.g "claude-ai".
+  string client_name = 3;
+  // Indicates the server used on the session, e.g "example-servers/everything".
+  string server_name = 4;
+  // Indicates how the MCP session is authorized between MCP client and Teleport.
+  string ingress_auth_type = 5;
+  // Indicates how the MCP session is authorized between Teleport and remote MCP server.
+  string egress_auth_type = 6;
+}
+
 // the issuance of a user certificate from the user CA
 //
 // PostHog event: tp.certificate.issued
@@ -517,6 +542,10 @@ enum DiscoverResource {
   DISCOVER_RESOURCE_KUBERNETES_EKS = 40;
 
   DISCOVER_RESOURCE_APPLICATION_AWS_CONSOLE = 41;
+
+  DISCOVER_RESOURCE_MCP_STDIO = 42;
+  DISCOVER_RESOURCE_MCP_SSE = 43;
+  DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP = 44;
 }
 
 // DiscoverResourceMetadata contains common metadata identifying resource type being added.
@@ -1124,6 +1153,8 @@ enum IntegrationEnrollKind {
   INTEGRATION_ENROLL_KIND_SERVICENOW = 25;
   INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER = 26;
   INTEGRATION_ENROLL_KIND_GITHUB_REPO_ACCESS = 27;
+  INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD = 28;
+  INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES = 29;
 }
 
 // IntegrationEnrollMetadata contains common metadata
@@ -1166,6 +1197,12 @@ enum IntegrationEnrollStep {
   INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER = 6;
   INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT = 7;
   INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE = 8;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB = 9;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS = 10;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW = 11;
+  INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME = 12;
 }
 
 // IntegrationEnrollStatusCode defines status code for an integration enroll step.
@@ -1206,6 +1243,89 @@ message UIIntegrationEnrollStepEvent {
   IntegrationEnrollStepStatus status = 3;
 }
 
+// UIIntegrationEnrollSectionOpenEvent is emitted when the user opens or expands
+// a section (e.g. "Advanced Options") in an integration setup wizard.
+message UIIntegrationEnrollSectionOpenEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the section was opened.
+  IntegrationEnrollStep step = 2;
+  // Section that was opened.
+  IntegrationEnrollSection section = 3;
+}
+
+// IntegrationEnrollSection identifies a section the user opened or expanded in
+// an integration setup wizard.
+enum IntegrationEnrollSection {
+  INTEGRATION_ENROLL_SECTION_UNSPECIFIED = 0;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS = 1;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER = 2;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS = 3;
+  INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER = 4;
+}
+
+// UIIntegrationEnrollFieldCompleteEvent is emitted when the user completes a
+// field in an integration setup wizard.
+message UIIntegrationEnrollFieldCompleteEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the field was completed.
+  IntegrationEnrollStep step = 2;
+  // Field that was completed.
+  IntegrationEnrollField field = 3;
+}
+
+// IntegrationEnrollField identifies a field the user completed in an integration
+// setup wizard.
+enum IntegrationEnrollField {
+  INTEGRATION_ENROLL_FIELD_UNSPECIFIED = 0;
+
+  // MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL = 1;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH = 2;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW = 3;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT = 4;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF = 5;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG = 6;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS = 7;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS = 8;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS = 9;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS = 10;
+  INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES = 11;
+}
+
+// UIIntegrationEnrollCodeCopyEvent is emitted when the user copies generated
+// IaC (e.g. Terraform) code in an integration setup wizard.
+message UIIntegrationEnrollCodeCopyEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the code was copied.
+  IntegrationEnrollStep step = 2;
+  // Type of code that was copied.
+  IntegrationEnrollCodeType type = 3;
+}
+
+// IntegrationEnrollCodeType identifies the type of code that was copied in an
+// integration setup wizard.
+enum IntegrationEnrollCodeType {
+  INTEGRATION_ENROLL_CODE_TYPE_UNSPECIFIED = 0;
+  INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM = 1;
+  INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML = 2;
+}
+
+// UIIntegrationEnrollLinkClickEvent is emitted when the user clicks a link to
+// documentation, etc. in an integration setup wizard.
+message UIIntegrationEnrollLinkClickEvent {
+  // Metadata of the event.
+  IntegrationEnrollMetadata metadata = 1;
+  // Step where the link was clicked.
+  IntegrationEnrollStep step = 2;
+  // Link that was clicked.
+  string link = 3;
+}
+
 // EditorChangeEvent is an event that is emitted when a user role set changes resulting in
 // a editor role being added on removed
 message EditorChangeEvent {
@@ -1818,6 +1938,11 @@ message SubmitEventRequest {
 
     AccessRequestCreateEvent access_request_create = 99;
     AccessRequestReviewEvent access_request_review = 100;
+
+    UIIntegrationEnrollSectionOpenEvent ui_integration_enroll_section_open_event = 101;
+    UIIntegrationEnrollFieldCompleteEvent ui_integration_enroll_field_complete_event = 102;
+    UIIntegrationEnrollCodeCopyEvent ui_integration_enroll_code_copy_event = 103;
+    UIIntegrationEnrollLinkClickEvent ui_integration_enroll_link_click_event = 104;
   }
 
   reserved 8; // UIOnboardGetStartedClickEvent
diff --git a/proto/teleport/lib/teleterm/auto_update/v1/auto_update_service.proto b/proto/teleport/lib/teleterm/auto_update/v1/auto_update_service.proto
new file mode 100644
index 0000000000000..74f21508339a7
--- /dev/null
+++ b/proto/teleport/lib/teleterm/auto_update/v1/auto_update_service.proto
@@ -0,0 +1,68 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+syntax = "proto3";
+
+package teleport.lib.teleterm.auto_update.v1;
+
+option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/auto_update/v1;auto_updatev1";
+
+// AutoUpdateService provides access to information about client tools updates.
+service AutoUpdateService {
+  // GetClusterVersions returns client tools versions for all clusters.
+  rpc GetClusterVersions(GetClusterVersionsRequest) returns (GetClusterVersionsResponse);
+  // GetDownloadBaseUrl returns a base URL (e.g. cdn.teleport.dev) for downloading packages.
+  // Can be overridden with TELEPORT_CDN_BASE_URL env var.
+  // OSS builds require this env var to be set, otherwise an error is returned.
+  rpc GetDownloadBaseUrl(GetDownloadBaseUrlRequest) returns (GetDownloadBaseUrlResponse);
+}
+
+// Request for GetClusterVersions.
+message GetClusterVersionsRequest {}
+
+// Response for GetClusterVersions.
+message GetClusterVersionsResponse {
+  repeated ClusterVersionInfo reachable_clusters = 1;
+  repeated UnreachableCluster unreachable_clusters = 2;
+}
+
+// ClusterVersionInfo contains tool version information for a reachable cluster.
+message ClusterVersionInfo {
+  // URI of the cluster.
+  string cluster_uri = 1;
+  // Whether the client should automatically update the tools version.
+  bool tools_auto_update = 2;
+  // Tools version required by this cluster.
+  string tools_version = 3;
+  // Minimum tools version allowed by this cluster.
+  string min_tools_version = 4;
+}
+
+// UnreachableCluster represents a cluster from which version information could not be retrieved.
+message UnreachableCluster {
+  // URI of the cluster.
+  string cluster_uri = 1;
+  // Error that occurred while retrieving version information.
+  string error_message = 2;
+}
+
+// Request for GetDownloadBaseUrl.
+message GetDownloadBaseUrlRequest {}
+
+// Response for GetDownloadBaseUrl.
+message GetDownloadBaseUrlResponse {
+  string base_url = 1;
+}
diff --git a/proto/teleport/lib/teleterm/v1/access_request.proto b/proto/teleport/lib/teleterm/v1/access_request.proto
index 3492669ac13cb..81e09cbe8eddd 100644
--- a/proto/teleport/lib/teleterm/v1/access_request.proto
+++ b/proto/teleport/lib/teleterm/v1/access_request.proto
@@ -40,9 +40,9 @@ message AccessRequest {
   repeated string suggested_reviewers = 10;
   // thresholds specifies minimum amount of approvers or deniers. Defaults to 'default'
   repeated string threshold_names = 11;
-  // TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-  // a list of resourceIDs requested in the AccessRequest
-  repeated ResourceID resource_ids = 12;
+  reserved "resource_ids";
+  reserved 12;
+  // List of requested resources.
   repeated Resource resources = 13;
   // promoted_access_list_title is the title of the access
   // list that this access request was promoted to.
@@ -56,6 +56,12 @@ message AccessRequest {
   google.protobuf.Timestamp request_ttl = 17;
   // session_ttl indicates how long a certificate for a session should be valid for.
   google.protobuf.Timestamp session_ttl = 18;
+  // reason_mode specifies the reason mode for this Access Request. It can be either "optional" or
+  // "required". It's only added in response to a dry run request.
+  string reason_mode = 19;
+  // reason_prompts is a sorted and deduplicated list of reason prompts for this Access Request.
+  // It's only added in response to a dry run request.
+  repeated string reason_prompts = 20;
 }
 
 message AccessRequestReview {
diff --git a/proto/teleport/lib/teleterm/v1/cluster.proto b/proto/teleport/lib/teleterm/v1/cluster.proto
index 09a8bfb49f3da..09170fa61af0b 100644
--- a/proto/teleport/lib/teleterm/v1/cluster.proto
+++ b/proto/teleport/lib/teleterm/v1/cluster.proto
@@ -20,6 +20,7 @@ syntax = "proto3";
 
 package teleport.lib.teleterm.v1;
 
+import "google/protobuf/timestamp.proto";
 import "teleport/legacy/types/trusted_device_requirement.proto";
 
 option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1";
@@ -34,7 +35,9 @@ message Cluster {
   // For leaf clusters, it has the form of /clusters/:rootClusterId/leaves/:leafClusterId where
   // leafClusterId is equal to the name property of the cluster.
   string uri = 1;
-  // name is used throughout the Teleport Connect codebase as the cluster name.
+  // name is the site name of Teleport cluster.
+  // Only present in root clusters if the user has logged in (the name comes from the certificate).
+  // Always available for leaf clusters.
   string name = 2;
   // proxy_host is address of the proxy used to connect to this cluster.
   // Always includes port number. Present only for root clusters.
@@ -83,8 +86,9 @@ message LoggedInUser {
   string name = 1;
   // roles is the user roles
   repeated string roles = 2;
-  // ssh_logins is the user ssh logins
-  repeated string ssh_logins = 3;
+
+  reserved "ssh_logins";
+  reserved 3;
   // acl is a user access control list.
   // It is available only after the cluster details are fetched, as it is not stored on disk.
   ACL acl = 4;
@@ -108,6 +112,8 @@ message LoggedInUser {
   bool is_device_trusted = 9;
   // Indicates whether access may be hindered by the lack of a trusted device.
   types.TrustedDeviceRequirement trusted_device_requirement = 10;
+  // Expiration time of the certificate.
+  google.protobuf.Timestamp valid_until = 11;
 }
 
 // ACL is the access control list of the user
diff --git a/proto/teleport/lib/teleterm/v1/database.proto b/proto/teleport/lib/teleterm/v1/database.proto
index 674ca719533e8..f0ea758264f85 100644
--- a/proto/teleport/lib/teleterm/v1/database.proto
+++ b/proto/teleport/lib/teleterm/v1/database.proto
@@ -45,6 +45,8 @@ message Database {
   repeated Label labels = 8;
   // target_health of the "db_server" that is serving this database.
   TargetHealth target_health = 9;
+  // gcp_project_id is optional project ID set for GCP Project databases.
+  string gcp_project_id = 10;
 }
 
 // DatabaseServer (db_server) describes a database heartbeat signal
diff --git a/proto/teleport/lib/teleterm/v1/kube.proto b/proto/teleport/lib/teleterm/v1/kube.proto
index 7fc36f0215010..4d3fd09cfc352 100644
--- a/proto/teleport/lib/teleterm/v1/kube.proto
+++ b/proto/teleport/lib/teleterm/v1/kube.proto
@@ -21,6 +21,7 @@ syntax = "proto3";
 package teleport.lib.teleterm.v1;
 
 import "teleport/lib/teleterm/v1/label.proto";
+import "teleport/lib/teleterm/v1/target_health.proto";
 
 option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1";
 
@@ -32,6 +33,8 @@ message Kube {
   string name = 2;
   // labels is the kube labels
   repeated Label labels = 3;
+  // target_health is the health of the kube cluster
+  TargetHealth target_health = 4;
 }
 
 // KubeResource describes a kube_cluster's subresource eg: pods, namespaces, etc.
@@ -52,3 +55,13 @@ message KubeResource {
   // refer to field "name" for the name of namespace
   string namespace = 6;
 }
+
+// KubeServer (kube_server) describes a Kube heartbeat signal
+// reported from an agent (kubernetes_service) that is proxying
+// the Kubernetes cluster.
+message KubeServer {
+  string uri = 1;
+  string hostname = 2;
+  string host_id = 3;
+  TargetHealth target_health = 4;
+}
diff --git a/proto/teleport/lib/teleterm/v1/server.proto b/proto/teleport/lib/teleterm/v1/server.proto
index 44ab85761f22e..3f15f37861b53 100644
--- a/proto/teleport/lib/teleterm/v1/server.proto
+++ b/proto/teleport/lib/teleterm/v1/server.proto
@@ -40,4 +40,6 @@ message Server {
   repeated Label labels = 6;
   // node sub kind: teleport, openssh, openssh-ec2-ice
   string sub_kind = 7;
+  // Subset of logins allowed by the certificate and RBAC rules.
+  repeated string logins = 8;
 }
diff --git a/proto/teleport/lib/teleterm/v1/service.proto b/proto/teleport/lib/teleterm/v1/service.proto
index a63f0f2ca6746..353433c59d6d8 100644
--- a/proto/teleport/lib/teleterm/v1/service.proto
+++ b/proto/teleport/lib/teleterm/v1/service.proto
@@ -87,11 +87,10 @@ service TerminalService {
   // ListKubernetesResourcesRequest defines a request to retrieve kube resources paginated.
   // Only one type of kube resource can be retrieved per request (eg: namespace, pods, secrets, etc.)
   rpc ListKubernetesResources(ListKubernetesResourcesRequest) returns (ListKubernetesResourcesResponse);
-
+  // Lists Kubernetes servers.
+  rpc ListKubernetesServers(ListKubernetesServersRequest) returns (ListKubernetesServersResponse);
   // AddCluster adds a cluster to profile
   rpc AddCluster(AddClusterRequest) returns (Cluster);
-  // RemoveCluster removes a cluster from profile
-  rpc RemoveCluster(RemoveClusterRequest) returns (EmptyResponse);
 
   // ListGateways lists gateways
   rpc ListGateways(ListGatewaysRequest) returns (ListGatewaysResponse);
@@ -132,8 +131,12 @@ service TerminalService {
   // -> Receive the index number associated with the selected credential in list
   // <- End
   rpc LoginPasswordless(stream LoginPasswordlessRequest) returns (stream LoginPasswordlessResponse);
-  // ClusterLogin logs out a user from cluster
+  // Logs the user out of the cluster and cleans up associated resources.
+  // Optionally removes the profile.
+  // This operation is idempotent and can be safely invoked multiple times.
   rpc Logout(LogoutRequest) returns (EmptyResponse);
+  // Closes root and leaf cluster clients that use outdated TLS certificates.
+  rpc ClearStaleClusterClients(ClearStaleClusterClientsRequest) returns (ClearStaleClusterClientsResponse);
   // TransferFile sends a request to download/upload a file
   rpc TransferFile(FileTransferRequest) returns (stream FileTransferProgress);
   // ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
@@ -192,21 +195,23 @@ service TerminalService {
 
 message EmptyResponse {}
 
-// RemoveClusterRequest describes RemoveClusterRequest
-message RemoveClusterRequest {
-  string cluster_uri = 1;
-}
-
 // GetClusterRequest describes GetClusterRequest
 message GetClusterRequest {
   string cluster_uri = 1;
 }
 
-// LogoutRequest describes LogoutRequest
 message LogoutRequest {
   string cluster_uri = 1;
+  // Whether to remove the associated YAML profile after logout.
+  bool remove_profile = 2;
 }
 
+message ClearStaleClusterClientsRequest {
+  string root_cluster_uri = 1;
+}
+
+message ClearStaleClusterClientsResponse {}
+
 message StartHeadlessWatcherRequest {
   string root_cluster_uri = 1;
 }
@@ -260,8 +265,7 @@ message CreateAccessRequestRequest {
   repeated string roles = 3;
   // suggested_reviewers is a suggested list of reviewers that can review a request.
   repeated string suggested_reviewers = 4;
-  // TODO(avatus) remove the resource_ids field once the changes to rely on resources instead is merged
-  // a list of resourceIDs requested in the AccessRequest
+  // List of resources to which access is being requested.
   repeated ResourceID resource_ids = 5;
   // assume_start_time is the time after which the requested access can be assumed.
   google.protobuf.Timestamp assume_start_time = 6;
@@ -359,6 +363,30 @@ message ListKubernetesResourcesResponse {
   reserved "next_key";
 }
 
+// Lists Kubernetes servers request.
+message ListKubernetesServersRequest {
+  // Maximum number of servers to return per page.
+  int32 page_size = 1;
+
+  // Pagination token from a previous response.
+  string page_token = 2;
+
+  // Target Kubernetes cluster URI.
+  string cluster_uri = 3;
+
+  // Additional filters and sorting options.
+  ListResourcesParams params = 4;
+}
+
+// Lists Kubernetes servers response.
+message ListKubernetesServersResponse {
+  // Resources in this page of results.
+  repeated KubeServer resources = 1;
+
+  // Pagination token for the next page.
+  string next_page_token = 2;
+}
+
 // CredentialInfo holds fields related to a user's WebAuthn credential.
 message CredentialInfo {
   string username = 1;
diff --git a/proto/teleport/lib/teleterm/v1/target_health.proto b/proto/teleport/lib/teleterm/v1/target_health.proto
index adbc11c0964f0..49be388fe781c 100644
--- a/proto/teleport/lib/teleterm/v1/target_health.proto
+++ b/proto/teleport/lib/teleterm/v1/target_health.proto
@@ -30,4 +30,6 @@ message TargetHealth {
   // error is the health check error observed, when
   // "status" field != "healthy".
   string error = 2;
+  // message is additional information meant for a user.
+  string message = 3;
 }
diff --git a/proto/teleport/lib/teleterm/vnet/v1/vnet_service.proto b/proto/teleport/lib/teleterm/vnet/v1/vnet_service.proto
index 05acea0a5c6ca..0336e122b523a 100644
--- a/proto/teleport/lib/teleterm/vnet/v1/vnet_service.proto
+++ b/proto/teleport/lib/teleterm/vnet/v1/vnet_service.proto
@@ -30,16 +30,8 @@ service VnetService {
   // Stop stops VNet.
   rpc Stop(StopRequest) returns (StopResponse);
 
-  // ListDNSZones returns DNS zones of all root and leaf clusters with non-expired user certs. This
-  // includes the proxy service hostnames and custom DNS zones configured in vnet_config.
-  //
-  // This is fetched independently of what the Electron app thinks the current state of the cluster
-  // looks like, since the VNet admin process also fetches this data independently of the Electron
-  // app.
-  //
-  // Just like the admin process, it skips root and leaf clusters for which the vnet_config couldn't
-  // be fetched (due to e.g., a network error or an expired cert).
-  rpc ListDNSZones(ListDNSZonesRequest) returns (ListDNSZonesResponse);
+  // GetServiceInfo returns info about the running VNet service.
+  rpc GetServiceInfo(GetServiceInfoRequest) returns (GetServiceInfoResponse);
 
   // GetBackgroundItemStatus returns the status of the background item responsible for launching
   // VNet daemon. macOS only. tsh must be compiled with the vnetdaemon build tag.
@@ -48,6 +40,10 @@ service VnetService {
   // RunDiagnostics runs a set of heuristics to determine if VNet actually works on the device, that
   // is receives network traffic and DNS queries. RunDiagnostics requires VNet to be started.
   rpc RunDiagnostics(RunDiagnosticsRequest) returns (RunDiagnosticsResponse);
+
+  // AutoConfigureSSH automatically configures OpenSSH-compatible clients for
+  // connections to Teleport SSH hosts.
+  rpc AutoConfigureSSH(AutoConfigureSSHRequest) returns (AutoConfigureSSHResponse);
 }
 
 // Request for Start.
@@ -62,13 +58,22 @@ message StopRequest {}
 // Response for Stop.
 message StopResponse {}
 
-// Request for ListDNSZones.
-message ListDNSZonesRequest {}
-
-// Response for ListDNSZones.
-message ListDNSZonesResponse {
-  // dns_zones is a deduplicated list of DNS zones.
-  repeated string dns_zones = 1;
+// Request for GetServiceInfo.
+message GetServiceInfoRequest {}
+
+// GetServiceInfoResponse contains the status of the running VNet service.
+message GetServiceInfoResponse {
+  // app_dns_zones is a deduplicated list of all DNS zones valid as DNS
+  // suffixes for connections to TCP apps.
+  repeated string app_dns_zones = 1;
+  // clusters is a list of cluster names valid as DNS suffixes for SSH hosts.
+  repeated string clusters = 2;
+  // ssh_configured is true if the user's SSH config file includes VNet's
+  // generated SSH config necessary for SSH access.
+  bool ssh_configured = 3;
+  // vnet_ssh_config_path is the path of VNet's generated OpenSSH-compatible
+  // config file.
+  string vnet_ssh_config_path = 4;
 }
 
 // Request for GetBackgroundItemStatus.
@@ -99,3 +104,9 @@ message RunDiagnosticsRequest {}
 message RunDiagnosticsResponse {
   teleport.lib.vnet.diag.v1.Report report = 1;
 }
+
+// Request for AutoConfigureSSH.
+message AutoConfigureSSHRequest {}
+
+// Response for AutoConfigureSSH.
+message AutoConfigureSSHResponse {}
diff --git a/proto/teleport/lib/vnet/diag/v1/diag.proto b/proto/teleport/lib/vnet/diag/v1/diag.proto
index 6d96cf1958a78..ce2407ded2e03 100644
--- a/proto/teleport/lib/vnet/diag/v1/diag.proto
+++ b/proto/teleport/lib/vnet/diag/v1/diag.proto
@@ -107,6 +107,8 @@ message CheckReport {
     // route_conflict reports whether there are routes that might conflict with routes set up by
     // VNet.
     RouteConflictReport route_conflict_report = 2;
+    // ssh_configuration_report reports the status of the system's SSH configuration.
+    SSHConfigurationReport ssh_configuration_report = 3;
   }
 }
 
@@ -158,3 +160,22 @@ message RouteConflict {
   // it's likely to be empty.
   string interface_app = 4;
 }
+
+// SSHConfigurationReport describes the state of the system's SSH configuration.
+message SSHConfigurationReport {
+  // user_openssh_config_path is the full path to the user's default OpenSSH
+  // config file (~/.ssh/config).
+  string user_openssh_config_path = 1;
+  // vnet_ssh_config_path is the path to VNet's generated OpenSSH-compatible
+  // config file.
+  string vnet_ssh_config_path = 2;
+  // user_openssh_config_includes_vnet_ssh_config is true if the default
+  // OpenSSH user configuration file includes VNet's SSH config file.
+  bool user_openssh_config_includes_vnet_ssh_config = 3;
+  // user_openssh_config_exists is true if a file exists at
+  // user_openssh_config_path (~/.ssh/config).
+  bool user_openssh_config_exists = 4;
+  // user_openssh_config_contents contains the contents of the file at
+  // user_openssh_config_path if it exists.
+  string user_openssh_config_contents = 5;
+}
diff --git a/proto/teleport/lib/vnet/v1/client_application_service.proto b/proto/teleport/lib/vnet/v1/client_application_service.proto
index e552e5bd0b277..b8193a53ff4fa 100644
--- a/proto/teleport/lib/vnet/v1/client_application_service.proto
+++ b/proto/teleport/lib/vnet/v1/client_application_service.proto
@@ -44,15 +44,27 @@ service ClientApplicationService {
   // SignForApp issues a signature with the private key associated with an x509
   // certificate previously issued for a requested app.
   rpc SignForApp(SignForAppRequest) returns (SignForAppResponse);
-  // OnNewConnection gets called whenever a new connection is about to be
+  // OnNewAppConnection gets called whenever a new app connection is about to be
   // established through VNet for observability.
-  rpc OnNewConnection(OnNewConnectionRequest) returns (OnNewConnectionResponse);
+  rpc OnNewAppConnection(OnNewAppConnectionRequest) returns (OnNewAppConnectionResponse);
   // OnInvalidLocalPort gets called before VNet refuses to handle a connection
   // to a multi-port TCP app because the provided port does not match any of the
   // TCP ports in the app spec.
   rpc OnInvalidLocalPort(OnInvalidLocalPortRequest) returns (OnInvalidLocalPortResponse);
   // GetTargetOSConfiguration gets the target OS configuration.
   rpc GetTargetOSConfiguration(GetTargetOSConfigurationRequest) returns (GetTargetOSConfigurationResponse);
+  // UserTLSCert returns the user TLS certificate for a specific profile.
+  rpc UserTLSCert(UserTLSCertRequest) returns (UserTLSCertResponse);
+  // SignForUserTLS signs a digest with the user TLS private key.
+  rpc SignForUserTLS(SignForUserTLSRequest) returns (SignForUserTLSResponse);
+  // SessionSSHConfig returns the user SSH configuration for an SSH session.
+  rpc SessionSSHConfig(SessionSSHConfigRequest) returns (SessionSSHConfigResponse);
+  // SignForSSHSession signs a digest with the SSH private key associated with the
+  // session from a previous call to SessionSSHConfig.
+  rpc SignForSSHSession(SignForSSHSessionRequest) returns (SignForSSHSessionResponse);
+  // ExchangeSSHKeys sends VNet's SSH host CA key to the client application and
+  // returns the user public key.
+  rpc ExchangeSSHKeys(ExchangeSSHKeysRequest) returns (ExchangeSSHKeysResponse);
 }
 
 // AuthenticateProcessRequest is a request for AuthenticateProcess.
@@ -131,6 +143,14 @@ message MatchedCluster {
   // WebProxyAddr is the web proxy address of the root cluster that matched the
   // query.
   string web_proxy_addr = 2;
+  // Profile is the profile the matched cluster was found in.
+  string profile = 3;
+  // RootCluster will always be set to the name of the root cluster that matched
+  // the query.
+  string root_cluster = 4;
+  // LeafCluster will be set only when the query matched a leaf cluster of
+  // RootCluster, or else it will be empty.
+  string leaf_cluster = 5;
 }
 
 // AppInfo holds all necessary info for making connections to VNet TCP apps.
@@ -172,8 +192,10 @@ message DialOptions {
   string sni = 3;
   // InsecureSkipVerify turns off verification for x509 upstream ALPN proxy service certificate.
   bool insecure_skip_verify = 4;
-  // RootClusterCaCertPool overrides the x509 certificate pool used to verify the server.
-  // It is a PEM-encoded X509 certificate pool.
+  // RootClusterCaCertPool is the host CA TLS certificate pool for the root
+  // cluster. It is a PEM-encoded X509 certificate pool. It should be used when
+  // dialing the proxy and AlpnConnUpgradeRequired is true or when dialing the
+  // transport service.
   bytes root_cluster_ca_cert_pool = 5;
 }
 
@@ -198,6 +220,8 @@ message ReissueAppCertResponse {
 // ReissueAppCert. The private key used for the signature will match the subject
 // public key of the issued x509 certificate.
 message SignForAppRequest {
+  reserved 3, 4, 5;
+  reserved "digest", "hash", "pss_salt_length";
   // AppKey uniquely identifies a TCP app, it must match the key of an app from
   // a previous successful call to ReissueAppCert.
   AppKey app_key = 1;
@@ -205,13 +229,19 @@ message SignForAppRequest {
   // TargetPort of a previous successful call to ReissueAppCert for an app
   // matching AppKey.
   uint32 target_port = 2;
+  // Sign holds signature request details.
+  SignRequest sign = 6;
+}
+
+// SignRequest holds signature request details.
+message SignRequest {
   // Digest is the bytes to sign.
-  bytes digest = 3;
+  bytes digest = 1;
   // Hash is the hash function used to compute digest.
-  Hash hash = 4;
+  Hash hash = 2;
   // PssSaltLength specifies the length of the salt added to the digest before a
   // signature. Only used and required for RSA PSS signatures.
-  optional int32 pss_salt_length = 5;
+  optional int32 pss_salt_length = 3;
 }
 
 // Hash specifies a cryptographic hash function.
@@ -232,14 +262,14 @@ message SignForAppResponse {
   bytes signature = 1;
 }
 
-// OnNewConnectionRequest is a request for OnNewConnection.
-message OnNewConnectionRequest {
+// OnNewAppConnectionRequest is a request for OnNewAppConnection.
+message OnNewAppConnectionRequest {
   // AppKey identifies the app the connection is being made for.
   AppKey app_key = 1;
 }
 
-// OnNewConnectionRequest is a response for OnNewConnection.
-message OnNewConnectionResponse {}
+// OnNewAppConnectionResponse is a response for OnNewAppConnection.
+message OnNewAppConnectionResponse {}
 
 // OnInvalidLocalPortRequest is a request for OnInvalidLocalPort.
 message OnInvalidLocalPortRequest {
@@ -278,3 +308,89 @@ message TargetOSConfiguration {
   // should also include the default range.
   repeated string ipv4_cidr_ranges = 2;
 }
+
+// UserTLSCertRequest is a request for UserTLSCert.
+message UserTLSCertRequest {
+  // Profile is the profile to retrieve the certificate for.
+  string profile = 1;
+}
+
+// UserTLSCertResponse is a response for UserTLSCert.
+message UserTLSCertResponse {
+  // Cert is the user TLS certificate in X.509 ASN.1 DER format.
+  bytes cert = 1;
+  // DialOptions holds options that should be used when dialing the root cluster
+  // proxy.
+  DialOptions dial_options = 2;
+}
+
+// SignForUserTLSRequest is a request for SignForUserTLS.
+message SignForUserTLSRequest {
+  // Profile is the user profile to sign for.
+  string profile = 1;
+  // Sign holds signature request details.
+  SignRequest sign = 2;
+}
+
+// SignForUserTLSResponse is a response for SignForUserTLS.
+message SignForUserTLSResponse {
+  // Signature is the signature.
+  bytes signature = 1;
+}
+
+// SessionSSHConfigRequest is a request for SessionSSHConfig.
+message SessionSSHConfigRequest {
+  // Profile is the profile in which the SSH server is found.
+  string profile = 1;
+  // RootCluster is the cluster in which the SSH server is found.
+  string root_cluster = 2;
+  // LeafCluster is the leaf cluster in which the SSH server is found.
+  // If empty, the SSH server is in the root cluster.
+  string leaf_cluster = 3;
+  // Address is the address of the SSH server.
+  string address = 4;
+  // User is the SSH user the session is for.
+  string user = 5;
+}
+
+// SessionSSHConfigResponse is a response for SessionSSHConfig.
+message SessionSSHConfigResponse {
+  // SessionId is an opaque identifier for the session, it should be passed to
+  // SignForSSHSession to issue signatures with the private key associated with
+  // the session.
+  string session_id = 1;
+  // Cert is the session SSH certificate in SSH wire format.
+  bytes cert = 2;
+  // TrustedCas is a list of trusted SSH certificate authorities in SSH wire
+  // format.
+  repeated bytes trusted_cas = 3;
+}
+
+// SignForSSHSessionRequest is a request for SignForSSHSession.
+message SignForSSHSessionRequest {
+  // SessionId is an opaque identifier for the session returned from a previous
+  // call to SessionSSHConfig.
+  string session_id = 1;
+  // Sign holds signature request details.
+  SignRequest sign = 2;
+}
+
+// SignForSSHSessionResponse is a response for SignForSSHSession.
+message SignForSSHSessionResponse {
+  // Signature is the signature.
+  bytes signature = 1;
+}
+
+// ExchangeSSHKeysRequest is a request to exchange SSH keys for VNet SSH.
+message ExchangeSSHKeysRequest {
+  // HostPublicKey is the host key that should be trusted by clients connecting
+  // to VNet SSH addresses. It is encoded in OpenSSH wire format.
+  bytes host_public_key = 1;
+}
+
+// ExchangeSSHKeysResponse is a response for ExchangeSSHKeys.
+message ExchangeSSHKeysResponse {
+  // UserPublicKey is the user key that should be trusted by VNet for incoming
+  // connections from SSH clients. It is encoded in OpenSSH wire format.
+  bytes user_public_key = 1;
+}
diff --git a/proto/teleport/relaypeering/v1alpha/dial.proto b/proto/teleport/relaypeering/v1alpha/dial.proto
new file mode 100644
index 0000000000000..753f651f51eb0
--- /dev/null
+++ b/proto/teleport/relaypeering/v1alpha/dial.proto
@@ -0,0 +1,51 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+syntax = "proto3";
+
+package teleport.relaypeering.v1alpha;
+
+import "google/rpc/status.proto";
+
+option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/relaypeering/v1alpha;relaypeeringv1alpha";
+
+// the message sent by the client at the beginning of a connection
+message DialRequest {
+  // the target agent for the connection attempt; should be "<host id>.<cluster name>"
+  string target_host_id = 1;
+  // the type of the connection as defined by api/types.TunnelType ("node",
+  // "app", "kube"...)
+  string connection_type = 2;
+
+  Addr source = 3;
+  Addr destination = 4;
+}
+
+// the message sent by the server as a response to a DialRequest; in case of
+// success (status is missing or reports "ok") the connection data follows on
+// the same stream, otherwise the stream ends and any data sent by the client is
+// to be treated as silently discarded
+message DialResponse {
+  google.rpc.Status status = 1;
+}
+
+// a stringy Go net.Addr, usually converted to and from lib/utils.NetAddr
+message Addr {
+  // likely always "tcp"
+  string network = 1;
+  // depending on the network, likely "<ip address>:<port>"
+  string addr = 2;
+}
diff --git a/proto/teleport/relaytunnel/v1alpha/control.proto b/proto/teleport/relaytunnel/v1alpha/control.proto
new file mode 100644
index 0000000000000..36910d1f9ce7b
--- /dev/null
+++ b/proto/teleport/relaytunnel/v1alpha/control.proto
@@ -0,0 +1,66 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+syntax = "proto3";
+
+package teleport.relaytunnel.v1alpha;
+
+import "google/rpc/status.proto";
+
+option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alpha";
+
+// sent by the client at the beginning of the control stream, the first and only
+// stream opened by the client at the beginning of the connection
+message ClientHello {
+  // a value from the api/types.TunnelType go enum, describing which tunnel the
+  // client wants to open
+  string tunnel_type = 1;
+}
+
+// sent by the server in the control stream, as a response to the ClientHello
+// message; if the status is not "ok" (or missing) the stream and connection are
+// going to be terminated
+message ServerHello {
+  google.rpc.Status status = 1;
+
+  // these are the same values that would be returned by
+  // DiscoveryService.Discover
+  string relay_group = 2;
+  int32 target_connection_count = 4;
+
+  // previously defined (but unused) in dev builds using the same protobuf
+  // package
+  reserved 3;
+  reserved "tunnel_public_addr";
+}
+
+// sent by the client in the control stream
+message ClientControl {
+  // no fields needed for now, but the server should still read (and discard)
+  // messages from the client in the control stream
+}
+
+// sent by the server in the control stream
+message ServerControl {
+  // the relay server is going to shut down soon, so the client should consider
+  // opening a new connection to maintain its tunnel connection count
+  bool terminating = 2;
+
+  // previously defined (but unused) in dev builds using the same protobuf
+  // package
+  reserved 1;
+  reserved "known_relays";
+}
diff --git a/proto/teleport/relaytunnel/v1alpha/dial.proto b/proto/teleport/relaytunnel/v1alpha/dial.proto
new file mode 100644
index 0000000000000..95e72cad0c978
--- /dev/null
+++ b/proto/teleport/relaytunnel/v1alpha/dial.proto
@@ -0,0 +1,46 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+syntax = "proto3";
+
+package teleport.relaytunnel.v1alpha;
+
+import "google/rpc/status.proto";
+
+option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alpha";
+
+// the message sent by the server at the beginning of a dial stream (any stream
+// opened by the server, in this version of the protocol)
+message DialRequest {
+  Addr source = 1;
+  Addr destination = 2;
+}
+
+// the message sent by the client as a response to a DialRequest; in case of
+// success (status is missing or reports "ok") the connection data follows on
+// the same stream, otherwise the stream ends and any data sent by the server is
+// to be treated as silently discarded
+message DialResponse {
+  google.rpc.Status status = 1;
+}
+
+// a stringy Go net.Addr, usually converted to and from lib/utils.NetAddr
+message Addr {
+  // likely always "tcp"
+  string network = 1;
+  // depending on the network, likely "<ip address>:<port>"
+  string addr = 2;
+}
diff --git a/proto/teleport/relaytunnel/v1alpha/discovery_service.proto b/proto/teleport/relaytunnel/v1alpha/discovery_service.proto
new file mode 100644
index 0000000000000..84a23396a4c5f
--- /dev/null
+++ b/proto/teleport/relaytunnel/v1alpha/discovery_service.proto
@@ -0,0 +1,42 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+syntax = "proto3";
+
+package teleport.relaytunnel.v1alpha;
+
+option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/relaytunnel/v1alpha;relaytunnelv1alpha";
+
+// rpcs related to the distribution of information about the relay group to
+// agents
+service DiscoveryService {
+  // returns info about the relay group and how agents should behave
+  rpc Discover(DiscoverRequest) returns (DiscoverResponse);
+}
+
+// request message for DiscoveryService.Discover
+message DiscoverRequest {}
+
+// response message for DiscoveryService.Discover
+message DiscoverResponse {
+  string relay_group = 1;
+
+  int32 target_connection_count = 2;
+
+  // the list of api/types.TunnelTypes supported by this Relay group; if empty,
+  // it should be treated as containing only types.NodeTunnel ("node")
+  repeated string supported_tunnel_types = 3;
+}
diff --git a/rfd/0130-autogenerate-resource-reference.md b/rfd/0130-autogenerate-resource-reference.md
index 95009b5b0bf57..f0654a47f8e84 100644
--- a/rfd/0130-autogenerate-resource-reference.md
+++ b/rfd/0130-autogenerate-resource-reference.md
@@ -6,8 +6,8 @@ title: 0130 - Automatically Generate the Teleport Resource Reference
 
 ## Required Approvers
 
-- Engineering: @codingllama, @zmb3
-- Product: (@alexfornuto || @xinding33)
+- Engineering: @zmb3
+- Product: @roraback
 
 ## What
 
@@ -15,15 +15,13 @@ Dynamic resources (also called "Teleport resources" in this RFD) are
 configuration objects that Teleport users can apply using `tctl`, Terraform, and
 other methods.
 
-The scope of this RFD is to automatically generate the "Dynamic resources"
-section of the resource reference (`docs/pages/reference/resources.mdx`), a list
-of the dynamic resources you can apply via `tctl`, from the Teleport source
-code. 
+The scope of this RFD is to automatically generate reference documents for
+resources you can apply via `tctl` from the Teleport source code. 
 
-To do this, write a program that we can run as a new Make target in a clone of
-`gravitational/teleport`. When we make changes to Teleport's dynamic resources,
-we can run the program manually, generate a new iteration of the reference, and
-manually open a pull request with the new content.
+To do this, we can write a program that we can run as a new Make target in a
+clone of `gravitational/teleport`. When we make changes to Teleport's dynamic
+resources, we can run the program manually, generate a new iteration of the
+reference, and manually open a pull request with the new content.
 
 The Make target will depend on `make grpc` so the generator always works from
 the latest `proto` files.
@@ -37,19 +35,14 @@ load.
 In general, we should strive to automatically generate reference guides whenever
 possible to ensure accuracy. While adding entries incrementally over time can be
 sustainable at a certain scale, adding many entries at once is a daunting task
-that is difficult for a documentation team to schedule. Our `tctl` resource
-reference is particularly lagging, with only five resources documented at the
-[time of
-writing](https://github.com/gravitational/teleport/blob/58f20f0c3fcc9bb281528915125b95dfaee6cec5/docs/pages/reference/resources.mdx).
+that is difficult for a documentation team to schedule.
 
 ## Details
 
-The generator reads a [configuration](#configuration) that specifies struct
-types to generate references from. After parsing Go source files, the generator
-uses the resulting AST information to [populate a template](#the-output). 
-
-To do so, it builds [mappings](#working-with-parsed-go-source) that it can use
-to track type declarations in source packages. Using these mappings, it
+After parsing Go source files, the generator uses AST information to [populate a
+template](#the-output). To do so, it builds
+[mappings](#working-with-parsed-go-source) that it can use to track type
+declarations in source packages. Using these mappings, it
 [converts](#converting-structs-to-resources) struct types to template data. To
 document the types of struct fields, the generator writes [additional
 entries](#processing-field-types) to the reference template as appropriate.
@@ -57,30 +50,11 @@ entries](#processing-field-types) to the reference template as appropriate.
 ### Configuration
 
 By default, the generator will attempt to include an entry in the resource
-reference for every struct type in the Teleport source that includes a field of
-the `github.com/gravitational/teleport/api/types.Metadata` type, since we
-include this field in all types that correspond to Teleport resources.
-
-For resources that we want to _exclude_ from the reference, the generator will
-read from a mapping of package paths to lists of named struct types within each
-package. 
-
-The program will declare the mapping within the Go code as a `map`.
-
-Here is an example:
-
-```go
-var exclude = map[string][]string{
-  "github.com/gravitational/teleport/api/types": {
-    "ProvisionTokenV2",
-    "AuthPreferenceV2",
-    "AccessRequestV3,
-  },
-  "github.com/gravitational/teleport/api/loginrulev1": {
-    "LoginRule",
-  },
-}
-```
+reference for every struct type in the Teleport source that we specify in a
+configuration file. Specifying resources (rather than automatically collecting
+them based on expected properties) allows us to gradually roll out the reference
+and catch bugs, hide resources meant for internal use, and control which
+versions of a resource we want to display.
 
 #### Alternative: Working from protobuf message definitions
 
@@ -114,157 +88,6 @@ I don't imagine this will be prohibitive, though, as long as we:
 
 Having this Make target depend on `make grpc` will also automate this flow.
 
-### The output
-
-The output of the program will be a Teleport resource reference generated
-from a template.
-
-#### Template format and data
-
-The generator will produce a template based on a `Resource` struct with the
-following fields:
-
-```go
-type Resource struct {
-  SectionName string
-  Description string
-  SourcePath  string
-  Fields      []Field
-  YAMLExample string
-}
-
-type Field struct{
-  Name        string
-  Description string
-  Type        string
-}
-```
-
-The template will look similar to this, anticipating a `[]Resource`:
-
-```text
-{{ range . }}
-## {{ .SectionName }}
-
-{{ .Description }}
-
-{/*Automatically generated from: {{ .SourcePath}}*/}
-
-|Field Name|Description|Type|
-|---|---|---|
-{{ range .Fields }}
-|.Name|.Description|.Type|
-{{ end }} 
-
-{{ .YAMLExample }}
-{{ end }}
-```
-
-#### Template example
-
-Here is an example of a populated template for an application (`AppSpecV3` in
-`api/types/types.pb.go`): 
-
-```markdown
-## App Spec V3
-
-App Spec V3 is the specification for an application registered with Teleport.
-
-{/*Automatically generated from: api/types/types.pb.go*/}
-
-|Field Name|Description|Type|
-|---|---|---|
-|`uri`|The web app endpoint.|`string`|
-|`public_addr`|The public address the application is accessible at.|`string`|
-|`dynamic_labels`|The app's command labels.|`map[string]`[Command LabelV2](#command-label-v2)|
-|`insecure_skip_verify`|Disables app's TLS certificate verification.|`boolean`|
-|`rewrite`|A list of rewriting rules to apply to requests and responses.|[Rewrite](#rewrite)|
-|`aws`|Contains additional options for AWS applications.|[App AWS](#app-aws)|
-|`cloud`|Identifies the cloud instance the app represents.|`string`|
-
-\`\`\`yaml
-uri: string
-public_addr: string
-dynamic_labels:
- # ...
-insecure_skip_verify: true
-rewrite: 
- # ...
-aws:
- # ...
-cloud:
- # ...
-\`\`\`
-
-## Command Label V2
-
-Command Label V2 is a label that has a value as a result of the output generated
-by running command, e.g. hostname.
-
-{/*Automatically generated from: api/types/types.pb.go*/}
-
-|Field Name|Description|Type|
-|---|---|---|
-|`period`|A time between command runs.|[Duration](#duration)|
-|`command`|A command to run|`[]string`|
-|`result`|Captures standard output|`string`|
-
-\`\`\`yaml
-period: 10s
-command:
-- string
-- string
-- string
-result: string
-\`\`\`
-
-## Duration
-
-Duration is a Go [duration type](https://pkg.go.dev/time#Duration).
-
-{/*Loaded from example file at autogen/examples/duration.mdx*/}
-
-\`\`\`yaml
-10s
-\`\`\`
-
-## Rewrite
-
-Rewrite is a list of rewriting rules to apply to requests and responses.
-
-{/*Automatically generated from: api/types/types.pb.go*/}
-
-|Field Name|Description|Type|
-|---|---|---|
-|`redirect`|Defines a list of hosts which will be rewritten to the public address of the application if they occur in the "Location" header.|`[]string`|
-|`headers`|A list of headers to inject when passing the request over to the application.|`[]`[Header](#header)|
-
-\`\`\`yaml
-redirect: 
-- string
-- string
-- string
-headers:
-# ...
-\`\`\`
-
-## Header
-
-Header represents a single http header passed over to the proxied application.
-
-{/*Automatically generated from: api/types/types.pb.go*/}
-
-|Field Name|Description|Type|
-|---|---|---|
-|`name`|The http header name.|`string`|
-|`value`|The http header value.|`string`|
-
-\`\`\`yaml
-name: string
-value: string
-\`\`\`
-```
-
 ### Working with parsed Go source
 
 The generator will use
@@ -303,12 +126,10 @@ begin generating a `Resource` for that struct type, plus additional `Resource`
 structs for the types of its fields (and their types and so on). The sequence
 is:
 
-- Iterate through each struct type within the declaration map.
-- If a struct type is named within the configuration as a type to exclude, skip
-  it.
-- If a struct type has a `types.Metadata` field, construct a `Resource` from the
-  struct type and insert it into the final data map (unless a `Resource` already
-  exists there).
+- Iterate through each struct type named in the configuration file.
+- If a struct has a corresponding declaration in the source, construct a
+  `Resource` from the struct type and insert it into the final data map (unless
+  a `Resource` already exists there).
 - Process the fields of the struct type using the rules described
   [below](#processing-field-types), looking up declaration data from the
   declaration map.
@@ -378,26 +199,6 @@ exit with an error message.
 
 #### Custom fields
 
-Entries in the reference for custom fields, e.g., `Labels`, don't lend
-themselves to automatic generation because they implement custom unmarshalers,
-and we can't rely on `json` struct tags to indicate the types of these fields.
-
-For simplicity, we can describe custom fields by hardcoding their descriptions
-and example YAML values. The generator expects a custom type to include a
-comment with a description and example YAML. Everything in a custom type's
-comment between the following delimiters is treated as example YAML:
-
-```
-Example YAML:
----
-```
-
-Comments before the `Example YAML` delimiter are treated as the type's
-description.
-
-The generator exits with an error if a custom type has no `Example YAML` comment
-block, giving the operator an opportunity to add this.
-
 If a field of a struct type has a custom type, we will include a link to an
 entry for that type in the struct type's table. The YAML example will include an
 ellipsis, leaving it to the custom field's entry in the reference to provide the
@@ -418,37 +219,16 @@ example:
 \`\`\`
 ```
 
-Here is an example of a comment we could add to the `Labels` [type
-declaration](https://github.com/gravitational/teleport/blob/c91da46765953688d218dcba4a4ce7acf606639f/api/types/role.go#L1137-L1140):
-
-```go
-// Labels is a wrapper around map
-// that can marshal and unmarshal itself
-// from scalar and list values
-// Example YAML:
-// 'env': 'test'
-// '*': '*'
-// 'region': ['us-west-1', -eu-central-1]
-// 'reg': ^us-west-1|eu-central-1$'
-// ---
-type Labels map[string]utils.Strings
-```
-
-This would lead to the following entry in the reference:
-
-```markdown
-## Labels
-
-Labels is a wrapper around map that can marshal and unmarshal itself from scalar
-and list values.
+Entries in the reference for custom fields, e.g., `Labels`, don't lend
+themselves to automatic generation because they implement custom unmarshalers,
+and we can't rely on `json` struct tags to indicate the types of these fields.
+For the following field types, leave the `Type` column of the field table blank,
+and do not attempt to populate an example YAML value:
 
-\`\`\`yaml
-'env': 'test'
-'*': '*'
-'region': ['us-west-1', 'eu-central-1']
-'reg': '^us-west-1|eu-central-1$'
-\`\`\`
-```
+- Scalars with a custom type
+- Custom types declared outside the source tree, or in the standard library
+- Interfaces
+- Types with a custom unmarshaler
 
 #### Predeclared scalar types
 
@@ -556,44 +336,6 @@ field:
 
 The same rule would apply to, for example, `map[string]map[string]Header`.
 
-#### Named types
-
-For both named scalar types and named composite types, if the named type is not
-a struct, the generator looks for a manual override and returns an error if one
-is not available. This is because, for named composite types (e.g., `Labels`),
-it's likely that the source contains some custom unmarshaling logic that we will
-need to explain.
-
-If the type of a field is a named struct, the generator will produce another
-`Resource` based on that struct and insert it elsewhere in the reference
-template.
-
-For all named field types, the reference entry for the struct that contains the
-named field type will include an ellipsis in the example YAML. For example, the
-`CommandLabelV2` type appears within the `AppSpecV3` struct in the
-`dynamic_labels` field as shown below:
-
-```yaml
-uri: string
-public_addr: string
-dynamic_labels:
- # ...
-insecure_skip_verify: true
-rewrite: 
- # ...
-aws:
- # ...
-cloud:
- # ...
-```
-
-Users can then navigate to the `Command Label V2` section (using the link in the
-table above the example YAML) to see an example YAML document for this type.
-
-If the type of the field is an embedded struct, the generator will act as if the
-fields of the embedded struct are fields within the outer struct. Otherwise, the
-generator will follow the rules above.
-
 ## Test plan
 
 We can make it part of our release procedure to ensure that we run the generator
diff --git a/rfd/0144-client-tools-updates.md b/rfd/0144-client-tools-updates.md
index 34ba8062971c8..3ccabab49cbe5 100644
--- a/rfd/0144-client-tools-updates.md
+++ b/rfd/0144-client-tools-updates.md
@@ -14,7 +14,7 @@ state: draft
 ## What/Why
 
 This RFD describes how client tools like `tsh` and `tctl` can be kept up to
-date, either using automatic updates or self-managed updates.
+date, either using managed updates or self-managed updates.
 
 Keeping client tools updated helps with security (fixes for known security
 vulnerabilities are pushed to endpoints), bugs (fixes for resolved issues are
@@ -30,13 +30,13 @@ rules).
 Client tools like `tsh` and `tctl` will automatically download and install the
 required version for the Teleport cluster.
 
-Enrollment in automatic updates for client tools will be controlled at the
-cluster level. By default all Cloud clusters will be opted into automatic
+Enrollment in managed updates for client tools will be controlled at the
+cluster level. By default, all Cloud clusters will be opted into managed
 updates for client tools. Cluster administrators using MDM software like Jamf
 will be able opt-out manually manage updates.
 
-Self-hosted clusters will be be opted out, but have the option to use the same
-automatic update mechanism.
+Self-hosted clusters will be opted out, but have the option to use the same
+managed update mechanism.
 
 Inspiration drawn from https://go.dev/doc/toolchain.
 
@@ -44,13 +44,18 @@ Inspiration drawn from https://go.dev/doc/toolchain.
 
 #### Client tools
 
-##### Automatic updates
+##### Managed updates
 
 When `tsh login` is executed, client tools will check `/v1/webapi/find` to
-determine if automatic updates are enabled. If the cluster's required version
+determine if managed updates are enabled. If the cluster's required version
 differs from the current binary, client tools will download and re-execute
-using the version required by the cluster. All other `tsh` subcommands (like
-`tsh ssh ...`) will always use the downloaded version.
+using the version required by the cluster. This means that Managed Updates 
+support major version differences, as the login command is intercepted 
+to check the version first.
+
+To enable managed updates for different set of command such as `tsh ssh` or
+`tsh proxy ssh` to verify the version set in cluster during login to ssh
+you need to set `TELEPORT_TOOLS_CHECK_UPDATE=t` environment variable.
 
 The original client tools binaries won't be overwritten. Instead, an additional
 binary will be downloaded and stored in `~/.tsh/bin` with `0755` permissions.
@@ -68,8 +73,14 @@ To enable concurrent operation of client tools, a locking mechanisms utilizing
 $ tree ~/.tsh
 ~/.tsh
 ├── bin
-│  ├── tctl
-│  └── tsh
+│  ├── .config.json
+│  ├── .lock
+│  ├── 7de24a1e-8141-4fc8-9a1f-cd4665afa338-update-pkg-v2
+│  │  ├── tctl
+│  │  └── tsh
+│  └── d00ffd3d-700d-47b0-bd65-94506f1362e2-update-pkg-v2
+│     ├── tctl
+│     └── tsh
 ├── current-profile
 ├── keys
 │  └── proxy.example.com
@@ -85,6 +96,37 @@ $ tree ~/.tsh
 └── proxy.example.com.yaml
 ```
 
+The configuration file structure should include a map of known hosts and a list of installed tools, ordered by most recently used.
+
+- The map of known hosts stores data received from the cluster configuration, such as version and mode. This version will be used for re-execution unless it is overridden by the `TELEPORT_TOOLS_VERSION` environment variable.
+- The list of installed tools has a limited size (at least 3 installations). When a tool is no longer referenced in the configuration, it will be removed during cleanup.
+
+When a specific version of a tool is requested for re-execution, the path is determined from the configuration as: `$TELEPORT_TOOLS_DIR/package/path[tool_name]`
+
+```json
+{
+  "configs": {
+    "proxy.example.com": {
+      "version": "17.5.1",
+      "disabled": false
+    }
+  },
+  "max_tools": 3,
+  "tools": [
+    {
+      "version": "17.5.1",
+      "path": {"tctl": "tctl", "tsh": "tsh"},
+      "package": "d00ffd3d-700d-47b0-bd65-94506f1362e2-update-pkg-v2"
+    },
+    {
+      "version": "17.5.2",
+      "path": {"tctl": "tctl", "tsh": "tsh"},
+      "package": "7de24a1e-8141-4fc8-9a1f-cd4665afa338-update-pkg-v2"
+    }
+  ]
+}
+```
+
 Users can cancel client tools updates using `Ctrl-C`. This may be needed if the
 user is on a low bandwidth connection (LTE or public Wi-Fi), if the Teleport
 download server is inaccessible, or the user urgently needs to access the
@@ -99,14 +141,22 @@ Update progress: [▒▒▒▒▒▒     ] (Ctrl-C to cancel update)
 ```
 
 All archive downloads are targeted to the `cdn.teleport.dev` endpoint and depend 
-on the operating system, platform, and edition. Where edition must be identified 
-by the original client tools binary, URL pattern:
+on the operating system, platform, and edition. The CDN base URL can be overridden 
+by the `TELEPORT_CDN_BASE_URL` environment variable and required to be set for OSS build.
+Where edition must be identified by the original client tools binary, URL pattern:
 `https://cdn.teleport.dev/teleport-{, ent-}v15.3.0-{linux, darwin, windows}-{amd64,arm64,arm,386}-{fips-}bin.tar.gz`
 
+
 An environment variable `TELEPORT_TOOLS_VERSION` will be introduced that can be
-`X.Y.Z` (use specific semver version) or `off` (do not update). This
-environment variable can be used as a emergency workaround for a known issue,
-pinning to a specific version in CI/CD, or for debugging.
+`X.Y.Z` (use specific semver version) or `off` (do not update). This environment 
+variable can be used for manual updates, pinning to a specific version in CI/CD, 
+or for debugging.
+
+By setting `TELEPORT_TOOLS_VERSION=X.Y.Z` during `tsh login`, the advertised version 
+from the cluster will be ignored, as well as any disabled mode. This specified 
+version will be recorded in the client tools configuration file and associated 
+with the cluster. When the profile for this cluster is active, the specified 
+version will be used for all commands.
 
 During re-execution, child process will inherit all environment variables and
 flags. `TELEPORT_TOOLS_VERSION=off` will be added during re-execution to
@@ -115,42 +165,31 @@ prevent infinite loops.
 When `tctl` is used to connect to Auth Service running on the same host over
 `localhost`, `tctl` assumes a special administrator role that can perform all
 operations on a cluster. In this situation the expectation is for the version
-of `tctl` and `teleport` to match so automatic updates will not be used.
+of `tctl` and `teleport` to match so managed updates will not be used.
 
-> [!NOTE]
-> If a user connects to multiple root clusters, each running a different
-> version of Teleport, client tools will attempt to download the differing
-> version of Teleport each time the user performs a `tsh login`.
->
-> In practice, the number of users impacted by this would be small. Customer
-> Cloud tenants would be on the same version and this feature is turned off by
-> default for self-hosted cluster.
->
-> However, for those people in this situation, the recommendation would be to
-> use self-managed updates.
 
 ##### Errors and warnings
 
-If cluster administrator has chosen not to enroll client tools in automatic
+If cluster administrator has chosen not to enroll client tools in managed
 updates and does not self-manage client tools updates as outlined in
 [Self-managed client tools updates](#self-managed-client-tools-updates), a
 series of warnings and errors with increasing urgency will be shown to the
 user.
 
 If the version of client tools is within the same major version as advertised
-by the cluster, a warning will be shown to urge the user to enroll in automatic
+by the cluster, a warning will be shown to urge the user to enroll in managed
 updates. Warnings will not prevent the user from using client tools that are
 slightly out of date.
 
 ```
 $ tsh login --proxy=proxy.example.com
-Warning: Client tools are out of date, update to vX.Y.Z.
+WARNING: Client tools are out of date, update to vX.Y.Z.
 
 Update Teleport to vX.Y.Z from https://goteleport.com/download or your system
 package manager.
 
-Enroll in automatic updates to keep client tools like tsh and tctl
-automatically updated. https://goteleport.com/docs/upgrading/automatic-updates
+Enroll in managed updates to keep client tools like tsh and tctl
+automatically updated. https://goteleport.com/docs/upgrading/client-tools-autoupdate/
 
 [...]
 ```
@@ -166,8 +205,8 @@ WARNING: Client tools are 1 major version out of date, update to vX.Y.Z.
 Some functionality may not work. Update Teleport to vX.Y.Z from
 https://goteleport.com/download or your system package manager.
 
-Enroll in automatic updates to keep client tools like tsh and tctl
-automatically updated. https://goteleport.com/docs/upgrading/automatic-updates
+Enroll in managed updates to keep client tools like tsh and tctl
+automatically updated. https://goteleport.com/docs/upgrading/client-tools-autoupdate/
 ```
 
 If the version of client tools is 2 (or more) versions lower than the version
@@ -182,8 +221,8 @@ ERROR: Client tools are N major versions out of date, update to vX.Y.Z.
 Your cluster requires {tsh,tctl} vX.Y.Z. Update Teleport from
 https://goteleport.com/download or your system package manager.
 
-Enroll in automatic updates to keep client tools like tsh and tctl
-automatically updated. https://goteleport.com/docs/upgrading/automatic-updates
+Enroll in managed updates to keep client tools like tsh and tctl
+automatically updated. https://goteleport.com/docs/upgrading/client-tools-autoupdate/
 
 Use the "--skip-version-check" flag to bypass this check and attempt to connect
 to this cluster.
@@ -208,11 +247,11 @@ $ tctl autoupdate client-tools status --proxy proxy.example.com --format json
 
 ##### Cluster configuration
 
-Enrollment of clients in automatic updates will be enforced at the cluster
+Enrollment of clients in managed updates will be enforced at the cluster
 level.
 
 The `autoupdate_config` resource will be updated to allow cluster
-administrators to turn client tools automatic updates `on` or `off`.
+administrators to turn client tools managed updates `on` or `off`.
 A `autoupdate_version` resource will be added to allow cluster administrators
 to manage the version of tools pushed to clients.
 
@@ -222,7 +261,7 @@ to manage the version of tools pushed to clients.
 > to `autoupdate_version` on Cloud.
 >
 > While Cloud customers will be able to use `autoupdate_config` to
-> turn client tools automatic updates `off` and self-manage updates, they will
+> turn client tools managed updates `off` and self-manage updates, they will
 > not be able to control the version of client tools in `autoupdate_version`.
 > That will continue to be managed by the Teleport Cloud team.
 
@@ -234,7 +273,7 @@ kind: autoupdate_config
 spec:
   tools:
     # tools mode allows to enable client tools updates or disable at the
-    # cluster level. Disable client tools automatic updates only if self-managed
+    # cluster level. Disable client tools managed updates only if self-managed
     # updates are in place.
     mode: enabled|disabled
 ```
@@ -292,14 +331,14 @@ frequency.
 How Cloud will push changes to `autoupdate_version` is out of scope for this
 RFD and will be handled by a separate Cloud specific RFD.
 
-Automatic updates for Teleport Connect are out of scope for this RFD as it uses
+Managed updates for Teleport Connect are out of scope for this RFD as it uses
 a different install/update mechanism. For now it will call `tsh` with
-`TELEPORT_TOOLS_VERSION=off` until automatic updates support can be added to
+`TELEPORT_TOOLS_VERSION=off` until managed updates support can be added to
 Connect.
 
 ### Security
 
-The initial version of automatic updates will rely on TLS to establish
+The initial version of managed updates will rely on TLS to establish
 connection authenticity to the Teleport download server. The authenticity of
 assets served from the download server is out of scope for this RFD. Cluster
 administrators concerned with the authenticity of assets served from the
diff --git a/rfd/0169-app-mfa-sessions.md b/rfd/0169-app-mfa-sessions.md
index 5761904b63632..6961bd57d0d4c 100644
--- a/rfd/0169-app-mfa-sessions.md
+++ b/rfd/0169-app-mfa-sessions.md
@@ -170,6 +170,30 @@ curl \
 <a href="/login">Found</a>.
 ```
 
+### `tsh app login` for AWS Access using AWS IAM Roles Anywhere integration credentials.
+
+In this case, the AWS credentials must be provided to the AWS client through conventional means (e.g.  `AWS_*` env vars or ~/.aws/config with credentials).
+In order to keep these credentials single-use with per-session MFA, the user is required to immediately export the credentials as `AWS_*` env vars in their current shell session.
+
+Note: unlike the local proxy flows where the cert is kept in-memory, we've determined that sharing the single-use AWS credentials through stdout / env vars cannot be avoided.
+However, since the credentials are still kept off disk where they could be more easily exfiltrated, these AWS creds will be still be permitted to exceed the common 1 minute per-session MFA TTL.
+The absolute minimum TTL permitted by AWS is 15 minutes, but these creds will be allowed to reach the user's max session TTL like the in-memory local proxy certs.
+
+In this case, users must export the AWS credentials into the current shell session:
+```console
+> eval "$(tsh apps login myaws --aws-role arn:aws:iam::123456789012:role/MyRole --env)"
+MFA is required to access Application "myaws"
+Tap any security key
+Detected security key tap
+
+> aws sts get-caller-identity
+{
+    "UserId": "USERID:00id123",
+    "Account": "123456789012",
+    "Arn": "arn:aws:sts::123456789012:assumed-role/MyRole/00id123"
+}
+```
+
 #### `tsh proxy app`
 
 Users can use `tsh proxy app` to create a local proxy for the app. This command
diff --git a/rfd/0207-vnet-ssh.md b/rfd/0207-vnet-ssh.md
index a78cf3c5fe8dc..66ebabf392673 100644
--- a/rfd/0207-vnet-ssh.md
+++ b/rfd/0207-vnet-ssh.md
@@ -7,9 +7,9 @@ state: draft
 
 ## Required Approvers
 
-* Engineering: @espadolini && @rosstimothy
-* Security: doyensec
-* Product: @klizhentas
+- Engineering: @espadolini && @rosstimothy
+- Security: doyensec
+- Product: @klizhentas
 
 ## What
 
@@ -24,7 +24,7 @@ Advanced Teleport features like per-session MFA and hardware keys will be fully
 supported.
 
 Here's a demo with a proof-of-concept of the feature in action:
-https://goteleport.zoom.us/clips/share/3xSvI4taSD6YgM1C0l12nQ
+<https://goteleport.zoom.us/clips/share/3xSvI4taSD6YgM1C0l12nQ>
 
 ## Why
 
@@ -197,13 +197,11 @@ we already have an SSH forwarding server implemented in `lib/srv/forward/sshserv
 VNet SSH will support SSH connections to DNS names matching any of the following:
 
 - `<hostname>.<cluster name>`
-- `<hostname>.<leaf cluster name>.<root cluster name>`
 - `<host ID>.<cluster name>`
-- `<host ID>.<leaf cluster name>.<root cluster name>`
 
 These are the same patterns supported by our existing OpenSSH client
 integration, which will offer a seamless transition for users switching to VNet SSH
-https://goteleport.com/docs/enroll-resources/server-access/openssh/openssh-agentless/#step-23-generate-an-ssh-client-configuration
+<https://goteleport.com/docs/enroll-resources/server-access/openssh/openssh-agentless/#step-23-generate-an-ssh-client-configuration>
 
 If users prefer to use a shorter name to connect to SSH hosts, they can add
 a `CanonicalDomains` option to their `~/.ssh/config` file, e.g.
@@ -236,7 +234,7 @@ If the user runs `tsh vnet` instead of Connect, we won't add anything to
 `vnet_ssh_config` will include the following:
 
 ```
-Host *.teleport.example.com *.leaf.teleport.example.com
+Host *.root.example.com *.leaf.example.com
     IdentityFile "/Users/nic/Library/Application Support/tsh/id_vnet"
     GlobalKnownHostsFile "/Users/nic/Library/Application Support/tsh/vnet_known_hosts"
     UserKnownHostsFile /dev/null
@@ -299,9 +297,8 @@ When the VNet process receives a DNS query this is how it will be resolved:
    1. If it matches a web app the DNS request will be forwarded to upstream DNS
       servers (this is also as it implicitly works today, now we'll do it
       explicitly to skip assigning a VNet IP for web apps).
-1. If the name does not match `*.<cluster name>` or
-   `*.<leaf cluster name>.<root cluster name>` for any profile, the request will
-   be forwarded to upstream DNS servers.
+1. If the name does not match `*.<cluster name>` or for any cluster, the
+   request will be forwarded to upstream DNS servers.
 1. VNet will assign a free IP address to the FQDN, but at this point it will not
    know if this IP will later resolve to an SSH host or an app or neither.
 1. VNet will return the IP address in an authoritative DNS answer.
@@ -310,6 +307,7 @@ When the VNet process receives a DNS query this is how it will be resolved:
 
 When the VNet process receives a TCP connection at an address that has been
 assigned to an FQDN but does not yet know if there is a matching app or SSH host:
+
 1. An app lookup will run first in case an app has been added since the DNS
    query that assigned this IP.
    If the queried FQDN matches a TCP app then the IP will be permanently
diff --git a/rfd/0222-bot-instances-at-scale.md b/rfd/0222-bot-instances-at-scale.md
new file mode 100644
index 0000000000000..e43107f03b069
--- /dev/null
+++ b/rfd/0222-bot-instances-at-scale.md
@@ -0,0 +1,425 @@
+---
+authors: Nick Marais (nicholas.marais@goteleport.com), Dan Upton (dan.upton@goteleport.com)
+state: draft
+---
+
+# RFD 0222 - Bot Instances at Scale
+
+## Required Approvers
+
+- Engineering: @strideynet
+- Product: @thedevelopnik
+
+# RFD 0222 - Bot Instances at Scale
+
+# What
+
+Machine ID bots allow non-human users to access resources in a Teleport cluster. They are useful for automating tasks, such as CI/CD runners, monitoring systems, and running scripts. The bot resource encapsulates a bot's access rights and roles. The `tbot` binary is used to start an instance of a bot and enrol it with the cluster (using a join token). When `tbot` starts and receives its credentials, a bot instance record is created in the cluster. Bot instance records expire when their credentials expire. Bot instances can be long-running processes which periodically renew their credentials, or short-lived, ephemeral processes which are created and destroyed on demand. Many instances of the same bot can exist at once, and clusters can have many bot instances. `tbot` periodically sends heartbeats which contain info such as uptime, hostname, tbot version and join method. Heartbeats are stored as part of the bot instance resource, and are limited to the 10 most recent.
+
+Today, the highest number of active bot instances is around 550 across 40 bots with most being long-running workloads. In general, 95% of Teleport clusters have fewer than 50 bot instances.
+
+This proposal seeks to address the pain points of deploying and maintaining a large fleet of Machine ID bots. It will focus solely on the Day 1 experience, and users are expected to be familiar with Teleport in general as well as the config and setup of their respective clusters. Day 0 tutorialization of setup steps and guided beginner scenarios are left to other initiatives.
+
+# Why
+
+As adoption of Machine & Workload ID increases, in part due to the drive to increase efficiency through automation as well as trends like Agentive AI, customers expect managing large fleets of bots to be simple and easy.
+
+The current bot instance list in the Web UI is suitable for the today's usage and future expansion and is scalable in terms of performance, but does not cater for the UX challenge of scaling. Currently, bot instances are paginated, sorted by either recency (default) or bot name, and can be filtered by basic text search term.
+
+It’s the responsibility of the **infrastructure security team** to own and manage the Teleport cluster and enrol protected resources. For teams which make extensive use of Machine ID, it has become cumbersome to manage many bots and bot instances. Where Dev/Dev Ops teams deploy bot instances themselves, it can be doubly difficult to coordinate upgrades and security initiatives.
+
+# Details
+
+## UX
+
+### User Stories
+
+**As a cluster owner (Infrastructure Security team), I want to know which Bot Instances, across all Bots, are blocking a safe cluster upgrade (major) due to their version.**
+
+The upgrade process can vary depending on the flavour of Teleport in use (cloud, oss, etc), and how it’s deployed. A common step is to query for agents running a version which would become incompatible should an upgrade be done - using `tctl inventory ls --older-than=v18.0.0`. This command does not include bot instances, and `tctl bots instances ls` doesn’t return versions numbers for instances.
+
+As such, it is a difficult task to identify bot instances that may be running an old version of `tbot`. This is especially difficult at scale. The current bot instance list available in the web UI allows filtering by version, although it’s a text search and it is not aware of semantic versioning - finding versions older than a given version is not possible.
+
+A breakdown of active instance versions will make the process of monitoring the version status easy at a glance, as well as provide convenient links to filter the instance list for versions already one or more major versions behind the control plane (thereby preventing a safe upgrade). To facilitate this in the web UI, the filter will allow queries such as `older_than(version, "18.1.0")`. The instance list will also indicate the status of an instance’s most recent version (as up-to-date, upgrade available, patch available, or incompatible). For the CLI, the `query` flag can be used to filter instances (e.g. `tctl bots instances ls --query=older_than(version, "18.1.0")`).
+
+**As a cluster owner (Infrastructure Security team), I want to know which Bot Instances, across all Bots, are running vulnerable versions.**
+
+Currently in the web UI the instances list can be filtered by version, but this is a text search and it is not aware of semantic versioning. It’s possible to find a specific version number, but it’s not easy to isolate a range of versions, such as “>18 & <18.2.1”, which is likely required to find instances between a vulnerable and patched version.
+
+To support this use-case, the filter for bot instances will support the predicate language and allow queries such as `version.between("18.0.0", "18.1.0")`. This works though the web UI and the CLI (`tctl`).
+
+**As a Bot Instance owner (Dev/Dev Ops team), I'd like help in understanding why my Bot Instance is not working properly.**
+
+For somebody diagnosing an issue with `tbot`, they’re likely to have access to the `tbot` log output. Such as;
+
+```
+INFO [TBOT:IDENTITY] Fetched new bot identity identity:mwi-demo-aws-manager, id=5c6af2e6-13a4-48c1-855f-74d8b8e01d86 | valid: after=2025-08-21T12:10:15Z, before=2025-08-21T12:31:13Z, duration=20m58s | kind=tls, renewable=false, disallow-reissue=false, roles=[bot-mwi-demo-aws-manager], principals=[-teleport-internal-join], generation=1 tbot/service_bot_identity.go:224
+```
+
+This log entry contains the bot name (as `identity`) and the instance’s ID. The instance ID can be used to filter the instances list in the web UI, and should make finding the relevant instance easy. In the CLI (`tctl`), both the bot name and instance ID are required to perform the look-up; `tctl bots instances show [bot_name]/[instance_id]`.
+
+Once found, in the web UI or CLI, the instance's details can be seen. Here a health status can be found for each `tbot` service (outputs, tunnels, etc), which includes failure info for those services which are unhealthy.
+
+### Instances dashboard
+
+This mock-up shows the bot instance page as it would be when first arriving at the page. No filters are set, so all instances are available in the list. Results are paginated, and the default sort order is by recency - instances with the most recent heartbeat are displayed first. Sorting can be toggled between ascending and descending, and the following sort fields are available; bot, recency, version, hostname. Filtering can be performed using a basic text search over supported fields, or an advanced search using the Teleport predicate language.
+
+The right-hand half of the page displays the dashboard, which is a summary over all instances. The visualizations use aggregate data prepared and updated by the auth server. An indication of when the data current is provided, as well as a refresh button which retrieves the most recently available data. A selection of timeframes is also available.
+
+The Upgrade Status visualization show a summary of all instances grouped by upgrade status; up-to-date, upgrade available, patch available, or incompatible. Status labels are selectable, and will populate the advanced search with the appropriate filter. For example, if the auth server is running v18 the filter will be populated with `older_than(version, "16.0.0")` when a user selects "not supported".
+
+![](assets/0222-dashboard.png)
+
+### Instance details
+These mock-ups shows the state of the page once an item had been selected from the instances list by clicking it. The dashboard section is replaced by the selected instance's details.
+
+The overview tab is displayed by default when an instance is selected. It shows further information about the instance, the join token that was used to enrol, and a summary of service health.
+
+![](assets/0222-details-overview.png)
+
+The services tab shows a list of all configured services (or outputs). Each includes it's name, type and health status. If there is extra health info available (such as and error message), this is also displayed.
+
+![](assets/0222-details-services.png)
+
+The YAML tab show the raw resource as readonly YAML.
+
+![](assets/0222-details-yaml.png)
+
+### tctl bots instances ls --search [term] --query [tql]
+
+The list bot instances command will include extra information about each instance; version and health status. A search term (`--search` flag) or advanced query (`--query` flag) can be used to filter the results. All instances are displayed, by fetching all available pages.
+
+```diff
+- ID                                         Join Method Hostname      Joined               Last Seen            Generation
+- ------------------------------------------ ----------- ------------- -------------------- -------------------- ----------
+- bot-1/d83b381d-b46c-4b92-a899-755991a6d0f5 iam         ip-10-0-15-34 2025-08-29T06:09:26Z 2025-09-01T12:49:26Z 237
+-
++ ID                                         Join Method Version Hostname      Status    Last Seen
++ ------------------------------------------ ----------- ------- ------------- --------- --------------------
++ bot-1/d83b381d-b46c-4b92-a899-755991a6d0f5 iam         v18.2.1 ip-10-0-15-34 UNHEALTHY 2025-09-01T12:49:26Z
++
+To view more information on a particular instance, run:
+
+> /Users/example/.tsh/bin/tctl bots instances show [id]
+```
+
+### tctl bots instances show [id]
+
+The show bot instance command gives an overall health summary as well as a listing of services and their respective health status.
+
+```diff
+Bot: w2w-demo-app-bot
+ID:  d83b381d-b46c-4b92-a899-755991a6d0f5
++ Status: UNHEALTHY
+
+Initial Authentication:
+  Authenticated At: 2025-08-29T06:09:26Z
+  Join Method:      iam
+  Join Token:       w2w-demo-web-bot
+  Join Metadata:    meta:{join_token_name:"w2w-demo-web-bot" join_method:"iam"} iam:{account:"668558765449" arn:"arn:aws:sts::668558765449:assumed-role/MWIw2wDemoInstance/i-0b7667843950debfd"}
+  Generation:       1
+  Public Key:       <178 bytes>
+
+Latest Authentication:
+  Authenticated At: 2025-09-01T12:49:26Z
+  Join Method:      iam
+  Join Token:       w2w-demo-web-bot
+  Join Metadata:    meta:{join_token_name:"w2w-demo-web-bot" join_method:"iam"} iam:{account:"668558765449" arn:"arn:aws:sts::668558765449:assumed-role/MWIw2wDemoInstance/i-0b7667843950debfd"}
+  Generation:       237
+  Public Key:       <178 bytes>
+
+Latest Heartbeat:
+  Recorded At:  2025-09-01T12:39:26Z
+  Is Startup:   false
+  Version:      18.1.5
+  Hostname:     ip-10-0-15-34
+  Uptime:       78h30m0.539099441s
+  Join Method:  iam
+  One Shot:     false
+  Architecture: arm64
+  OS:           linux
++
++ Service status:
++ Status    Name        Type                Reason         Updated At
++ --------- ----------- ------------------- -------------- --------------------
++ UNHEALTHY prod-aws-01 X509-output-service out of bananas 2025-09-01T12:49:26Z
+
+To view a full, machine-readable record including past heartbeats and authentication records, run:
+> /Users/example/.tsh/bin/tctl get bot_instance/w2w-demo-app-bot/d83b381d-b46c-4b92-a899-755991a6d0f5
+
+To onboard a new instance for this bot, run:
+> /Users/example/.tsh/bin/tctl bots instances add w2w-demo-app-bot
+```
+
+### Predicate language for instance filters
+
+The predicate language will be used to provide advanced filtering for instances. The filter query will be applied in the same way the existing filters work, and no changes to indexes are required. As items are read out of the backend storage, they are filtered one by one until the page size is reached or the end of the list. For a narrow filter, many or even all records will be scanned - this inefficiency is mitigated by the in-memory caching layer's performance.
+
+Instance-specific functions will be supported by implementing a custom `typical.ParserSpec`;
+
+| Function       | Purpose                                                                                                                                                     | Example                                |
+| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
+| **older_than** | Find instances running a version less than a given version - based on the most recent heartbeat                                                             | `older_than(version, "18.1.0")`        |
+| **newer_than** | Find instances running a version more than a given version - based on the most recent heartbeat                                                             | `newer_than(version, "18.1.0")`        |
+| **between**    | Find instances running versions between a vulnerable version and a fix version - based on the most recent heartbeat. Inclusive of from and exclusive of to. | `between(version, "18.0.0", "18.1.0")` |
+
+## Service/Output health
+
+Service health records for each configured `tbot` service/output will be sent with each heartbeat. These records are stored within the bot instance resource alongside heartbeats and authentications.
+
+Each service record includes the name of the configured service or output, a timestamp, it's health status (such as healthy, unhealthy, initializing or unknown), a timestamp, and an optional reason which may include an error message or stack trace.
+
+Any values included which are user-provided or dynamically generated based on errors or external state (namely the configured name and reason fields) will be limited in length to prevent uncapped data submissions.
+
+## Version Metrics
+
+We will periodically pre-calculate the number of bot instances per version, to power the Upgrade Status section of the dashboard.
+
+To aid future compatibility with Managed Updates, version counts will be written to the backend as an `AutoUpgradeBotInstanceReport` resource, with the following schema:
+
+```proto
+// AutoUpdateBotInstanceReport is a report generated by an elected instance of
+// the Teleport Auth service. The report tracks per update group and per version
+// how many instances of tbot are running.
+message AutoUpdateBotInstanceReport {
+  // The kind of resource represented. This is always `autoupdate_bot_instance_report`.
+  string kind = 1;
+
+  // Differentiates variations of the same kind. All resources should contain
+  // one, even if it is never populated.
+  string sub_kind = 2;
+
+  // The version of the resource being represented.
+  string version = 3;
+
+  // Common metadata that all resources share.
+  teleport.header.v1.Metadata metadata = 4;
+
+  // Contents of the report.
+  AutoUpdateBotInstanceReportSpec spec = 5;
+}
+
+// AutoUpdateBotInstanceReportSpec holds the contents of an AutoUpdateBotInstanceReport.
+message AutoUpdateBotInstanceReportSpec {
+  // Timestamp is when the report was generated.
+  google.protobuf.Timestamp timestamp = 1;
+
+  // Bot counts aggregated by update group.
+  map<string, AutoUpdateBotInstanceReportSpecGroup> groups = 2;
+}
+
+// AutoUpdateBotInstanceReportSpecGroup holds an update group's bot instance
+// counts.
+message AutoUpdateBotInstanceReportSpecGroup {
+  // Bot counts aggregated by version.
+  map<string, AutoUpdateBotInstanceReportSpecGroupVersion> versions = 1;
+}
+
+// AutoUpdateBotInstanceReportSpecGroupVersion holds a version's bot instance count.
+message AutoUpdateBotInstanceReportSpecGroupVersion {
+  // Count of bots running this version.
+  int32 count = 1;
+}
+```
+
+As `tbot` is not yet fully supported by `teleport-update`, we will add the necessary fields (e.g. `types.UpdaterV2Info`) to the bot heartbeat message, but leave them unpopulated. In reports, bot instances will be grouped together in the "unmanaged" update group (identified as an empty string) until `tbot` gains support and starts heartbeating a proper update group.
+
+Whereas the existing `AutoUpgradeAgentReport` resource is generated by each auth server instance by counting its connected agents, the `AutoUpgradeBotInstanceReport` will be generated from cluster state by a **single** instance, elected using a semaphore object.
+
+We will also expose these metrics to Teleport Cloud using a Prometheus gauge called `teleport_bot_instances`, labeled by version. Each auth server instance will report the same number, so operators will need to aggregate them using `max` rather than `sum` like the current `teleport_registered_servers` gauge.
+
+## Data aggregation
+
+To power the Upgrade Status section of the bot instance dashboard, we will pre-aggregate the following metrics; number of instances per version. Metrics will be stored in memory.
+
+As these metrics are intended to provide a rough overview of fleet health, and do not need to be strictly up-to-date, we will recalculate them on a timer (e.g. every 10 minutes). This is simpler, and in many cases likely more efficient than updating them incrementally by consuming the event stream.
+
+To avoid the need to "elect" a leader to calculate these metrics, each auth server instance will calculate them independently. Users therefore may see the numbers change if they refresh the dashboard, but this is an acceptable trade-off.
+
+## Data fields and expected quantities
+
+| Field                 | Description                                                                                  | Example                                       | Quantity                         | Limitations                                                                                   |
+| --------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------- | -------------------------------- | --------------------------------------------------------------------------------------------- |
+| Bot                   | A collection of roles and access assumed by `tbot` using a join token                        |                                               | 0-40+ per cluster                |                                                                                               |
+| Bot instance          | A unique joined instance of `tbot` in either a long-running or ephemeral environment         |                                               | 1-15+ per bot                    |                                                                                               |
+| Authentication record | Created for each join or renewal                                                             |                                               | 0-10 per instance (max enforced) |                                                                                               |
+| Instance heartbeat    | Self-reported by each bot instance                                                           |                                               | 0-10 per instance (max enforced) | Data is **not** validated by the auth server, and cannot be used for making access decisions. |
+| Service health        | An independent, internal part of `tbot`. Generally maps 1:1 with configured outputs/tunnels. | `application-tunnel`, `workload-identity-api` | 1-30 per instance (max enforced) |                                                                                               |
+| OS                    | Operating system from `runtime.GOOS`                                                         | linux, windows or darwin                      | Once per heartbeat               |                                                                                               |
+| Version               | Version of `tbot`                                                                            | 18.1.0                                        | Once per heartbeat               |                                                                                               |
+| Hostname              |                                                                                              |                                               | Once per heartbeat               |                                                                                               |
+| Uptime                | How long `tbot` has been running                                                             |                                               | Once per heartbeat               |                                                                                               |
+| Join token name       |                                                                                              |                                               | Once per auth                    |                                                                                               |
+| Join method           |                                                                                              | github, iam, kubernetes                       | Once per auth                    |                                                                                               |
+| Join attributes       | Metadata specific to a join method                                                           | GitHub repository name                        | Once per auth                    |                                                                                               |
+| Health status         |                                                                                              | INITIALIZING, HEALTHY, UNHEALTHY, UNKNOWN     | Once per service health          |                                                                                               |
+
+## Resource storage (backend)
+
+This proposal adds service health to bot instances. Service health scales with the number of services/outputs `tbot` is configured with. It doesn't make sense to limit the number of service records, as this would no longer provide a complete picture of the instance. As such, if there are more configured services than a maximum, then `tbot` will send none and raise a warning the the logs. Service health records for an instance will be cleared when the instance starts-up (denoted by the heartbeat field `is_startup`). Service health records will be stored as part of an instance's state, alongside heartbeats and authentications. Service health records may be used for filtering the list of bot instance in the web UI and CLI in the future, and so will remain local to the instance itself.
+
+To mitigate the risk of service degradation related to storing and serving additional data as part of `tbot` heartbeats (service health), the auth server will respect an environment variable which will disable the ingestion of this additional data.
+
+```
+TELEPORT_DISABLE_TBOT_HEARTBEAT_EXTRAS=true|false teleport start
+```
+
+While `tbot` will continue to send the extra heartbeat data, and it will continue to be relayed by proxies, the auth server will discard it. The UI and CLI will not be aware of this configuration and will simply receive no service health data when requesting bot instance/s and display an empty state.
+
+## Proto changes
+
+### RPC: `SubmitHeartbeat()`
+
+```protobuf
+// BotInstanceService provides functions to record and manage bot instances.
+service BotInstanceService {
+  // SubmitHeartbeat submits a heartbeat for a BotInstance.
+  rpc SubmitHeartbeat(SubmitHeartbeatRequest) returns (SubmitHeartbeatResponse);
+}
+
+// The request for SubmitHeartbeat.
+message SubmitHeartbeatRequest {
+  // The heartbeat data to submit.
+  BotInstanceStatusHeartbeat heartbeat = 1;
+
+  // The health of the services/output `tbot` is running.
+  repeated BotInstanceServiceHealth service_health = 2;
+}
+```
+
+### Bot instance
+
+```protobuf
+// BotInstanceStatus holds the status of a BotInstance.
+message BotInstanceStatus {
+  // ...[snip]...
+
+  // The health of the services/output `tbot` is running.
+  repeated BotInstanceServiceHealth service_health = 6;
+}
+```
+
+### Bot instance heartbeat
+
+```protobuf
+message BotInstanceStatusHeartbeat {
+  // ...[snip]...
+
+  // Kind identifies whether the bot is running in the tbot binary or embedded
+  // in another component.
+  BotKind kind = 12;
+}
+
+// BotKind identifies whether the bot is the tbot binary or embedded in another
+// component.
+enum BotKind {
+  // The enum zero-value, it means no kind was included.
+  BOT_KIND_UNSET = 0;
+
+  // Means the bot is running the tbot binary.
+  BOT_KIND_TBOT_BINARY = 1;
+
+  // Means the bot is running inside the Teleport Terraform provider.
+  BOT_KIND_TERRAFORM_PROVIDER = 2;
+
+  // Means the bot is running inside the Teleport Kubernetes operator.
+  BOT_KIND_KUBERNETES_OPERATOR = 3;
+}
+```
+
+### Bot instance service health
+
+```protobuf
+// BotInstanceServiceHealth is a snapshot of a `tbot` service's health.
+message BotInstanceServiceHealth {
+  // Service identifies the service.
+  BotInstanceServiceIdentifier service = 1;
+
+  // Status describes the service's healthiness.
+  BotInstanceHealthStatus status = 2;
+
+  // Reason is a human-readable explanation for the service's status. It might
+  // include an error message.
+  optional string reason = 3;
+
+  // UpdatedAt is the time at which the service's health last changed.
+  google.protobuf.Timestamp updated_at = 4;
+}
+
+// BotInstanceServiceIdentifier uniquely identifies a `tbot` service.
+message BotInstanceServiceIdentifier {
+  // Type of service (e.g. database-tunnel, ssh-multiplexer).
+  string type = 1;
+
+  // Name of the service, either given by the user or auto-generated.
+  string name = 2;
+}
+
+// BotInstanceHealthStatus describes the healthiness of a `tbot` service.
+enum BotInstanceHealthStatus {
+  // The enum zero-value, it means no status was included.
+  BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED = 0;
+
+  // Means the service is still "starting up" and hasn't reported its status.
+  BOT_INSTANCE_HEALTH_STATUS_INITIALIZING = 1;
+
+  // Means the service is healthy and ready to serve traffic, or it has
+  // recently succeeded in generating an output.
+  BOT_INSTANCE_HEALTH_STATUS_HEALTHY = 2;
+
+  // Means the service is failing to serve traffic or generate output.
+  BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY = 3;
+}
+```
+
+## Web API
+
+| Endpoint                                                                 | Description                                                                                                                                                                                                                       |
+| ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **GET /v2/webapi/sites/:site/machine-id/bot-instance**                   | A new version of an existing endpoint with a `query` parameter added to accept a string query in the Teleport predicate language (e.g. `older_than(version, 18.1)`) which is used to filter returned instances.                   |
+| **GET /v2/webapi/sites/:site/machine-id/bot/:name/bot-instance/:id**     | A new version of an existing endpoint which includes the new fields on bot instance (such as service health).                                                                                                                     |
+| **GET /webapi/:site/machine-id/bot-instance/dashboard**                  | A new endpoint to return summary data for bot instances. The result will contain multiple named datasets (one for each supported visualization). A “last updated at” timestamp will be included to give users a sense of recency. |
+
+## Privacy and Security
+
+The proposed changes are mainly capturing extra data and presenting it in the web UI and CLI. As such, there are not security and privacy concerns that need to be highlighted.
+
+## Backward Compatibility
+
+None of the proposed changes are backwards incompatible, nor are any migrations required. Older CLI clients will continue to function as they did, with any extra data being ignored. Older `tbot` versions will continue to be supported, but will not submit service health - the absence of this data will be supported by the web UI and CLI clients as well as the APIs they interact with.
+
+Where V2 versions of a webapi are added, the following backwards compatibility behaviour applies; In the situation where a new web client sends a request to an old proxy (in a load balanced setup), the old proxy will not host the new endpoint and will return a 404 and the proxy’s version. A helpful message is then displayed to the user advising that the proxy needs to be upgraded to support the operation.
+
+## Test Plan
+
+Addition after a Machine ID bot is created and an instance enrolled: "In the UI, a single Bot Instance record shows, with a heartbeat and an authentication record." and "In the CLI, using `tctl bot instance show [bot name]/[instance id]`, a single Bot Instance record shows, with a heartbeat and an authentication record.".
+
+# Delivery phases
+
+## Phase 1
+
+**tl;dr**: new instance UI, and version filters
+
+**Backports**: v17 and v18
+
+In this phase we’ll focus on the requirements to manage the versions of bot instances at scale. This includes filtering for instances running a version that prevents an upgrade, as well as instances running a compromised version.
+
+The instances list from the bot details will be reused with minimal changes (except the addition of bot name), and the details view will simply house the full instance yaml (including auth records and heartbeats). This lays the UI foundation for the following phases.
+
+The search field will get an ‘advanced’ mode where the Teleport predicate language can be used to filter items using semver-aware functions (such as `older_than` and `newer_than_or_equal`).
+
+An additional sort, by version, will also be included.
+
+## Phase 2
+
+**tl;dr**: upgrades dashboard, and service-level health
+
+**Backports**: v17 and v18
+
+This phase adds a dashboard which will provide a high-level overview of the MWI estate, and is invaluable when dealing with a large fleet. This phase will provide the groundwork for data aggregation and reporting, and will pave the way for future visualizations.
+
+A visual breakdown of instance upgrade status will be added to allow cluster maintainers to easily judge the number of instances with upgrades required/available, and to identify those instances.
+
+Additionally, this phase focuses on the requirements of the dev/dev-ops teams, who deploy instances of `tbot`. It includes features that enable easy confirmation of `tbot` running correctly, as well as tools to help troubleshoot issues.
+
+Giving users access to fine-grained health statuses (for each service/output) will help pinpoint areas where problems lie.
diff --git a/rfd/assets/0217-feature-unlock-bot.png b/rfd/assets/0217-feature-unlock-bot.png
new file mode 100644
index 0000000000000..20413b2473ea4
Binary files /dev/null and b/rfd/assets/0217-feature-unlock-bot.png differ
diff --git a/rfd/assets/0222-dashboard.png b/rfd/assets/0222-dashboard.png
new file mode 100644
index 0000000000000..7aa1c65d5e57f
Binary files /dev/null and b/rfd/assets/0222-dashboard.png differ
diff --git a/rfd/assets/0222-details-overview.png b/rfd/assets/0222-details-overview.png
new file mode 100644
index 0000000000000..9ff9e2c3d704a
Binary files /dev/null and b/rfd/assets/0222-details-overview.png differ
diff --git a/rfd/assets/0222-details-services.png b/rfd/assets/0222-details-services.png
new file mode 100644
index 0000000000000..ed102279fcafe
Binary files /dev/null and b/rfd/assets/0222-details-services.png differ
diff --git a/rfd/assets/0222-details-yaml.png b/rfd/assets/0222-details-yaml.png
new file mode 100644
index 0000000000000..adaca4a2d0152
Binary files /dev/null and b/rfd/assets/0222-details-yaml.png differ
diff --git a/rfd/cspell.json b/rfd/cspell.json
index 46cf7f5fe37c1..8c1196c021f86 100644
--- a/rfd/cspell.json
+++ b/rfd/cspell.json
@@ -382,6 +382,7 @@
     "managedclusters",
     "mant",
     "Mapred",
+    "Marais",
     "marcoandredinis",
     "marcodbtest",
     "Marek",
@@ -701,6 +702,7 @@
     "stretchr",
     "strideynet",
     "struct",
+    "structpb",
     "structs",
     "stscreds",
     "subcases",
@@ -783,6 +785,7 @@
     "tshd",
     "ttyplayback",
     "tunables",
+    "tutorialization",
     "udner",
     "uintptr",
     "unbeknowst",
diff --git a/svgo.config.mjs b/svgo.config.mjs
new file mode 100644
index 0000000000000..99677007a21d7
--- /dev/null
+++ b/svgo.config.mjs
@@ -0,0 +1,32 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export default {
+  plugins: [
+    {
+      name: 'preset-default',
+      params: {
+        overrides: {
+          cleanupIds: {
+            minify: false,
+          },
+        },
+      },
+    },
+  ],
+};
diff --git a/tool/common/common.go b/tool/common/common.go
index d0f9ef2ae9664..cfb20bbedc294 100644
--- a/tool/common/common.go
+++ b/tool/common/common.go
@@ -19,6 +19,7 @@
 package common
 
 import (
+	"cmp"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -27,6 +28,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/ghodss/yaml"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
@@ -82,11 +84,18 @@ func (e *SessionsCollection) WriteText(w io.Writer) error {
 		case *events.DatabaseSessionEnd:
 			id = session.GetSessionID()
 			typ = session.DatabaseProtocol
-			participants = session.GetUser()
+			participants = strings.Join(session.Participants, ", ")
 			target = session.DatabaseName
 			timestamp = session.GetTime().Format(constants.HumanDateFormatSeconds)
+		case *events.AppSessionChunk:
+			id = session.GetSessionChunkID()
+			typ = "app-chunk"
+			participants = session.User
+			target = cmp.Or(session.AppName, session.AppURI)
+			timestamp = session.GetTime().Format(constants.HumanDateFormatSeconds)
+
 		default:
-			slog.WarnContext(context.Background(), "unsupported event type: expected SessionEnd, WindowsDesktopSessionEnd or DatabaseSessionEnd", "event_type", logutils.TypeAttr(event))
+			slog.WarnContext(context.Background(), "unsupported event type: expected SessionEnd, WindowsDesktopSessionEnd, DatabaseSessionEnd or AppSessionChunk", "event_type", logutils.TypeAttr(event))
 			continue
 		}
 
@@ -238,3 +247,35 @@ func FormatDefault[T comparable](val, defaultVal T) string {
 	}
 	return fmt.Sprintf("%v", val)
 }
+
+// FormatAllowedEntities returns a human-readable string describing the allowed
+// entities, optionally including a list of denied entities as exceptions.
+func FormatAllowedEntities(allowed []string, denied []string) string {
+	if len(allowed) == 0 {
+		return "(none)"
+	}
+	if len(denied) == 0 {
+		return fmt.Sprintf("%v", allowed)
+	}
+	return fmt.Sprintf("%v, except: %v", allowed, denied)
+}
+
+// PrintJSONIndent prints provided value in JSON with default indentation.
+func PrintJSONIndent(w io.Writer, v any) error {
+	out, err := utils.FastMarshalIndent(v, "", "  ")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = fmt.Fprintln(w, string(out))
+	return trace.Wrap(err)
+}
+
+// PrintYAML prints provided value in YAML.
+func PrintYAML(w io.Writer, v any) error {
+	out, err := yaml.Marshal(v)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = fmt.Fprintln(w, string(out))
+	return trace.Wrap(err)
+}
diff --git a/tool/tbot/anonymous_telemetry.go b/tool/tbot/anonymous_telemetry.go
index 47b8b24c9f386..b6278817fa9cb 100644
--- a/tool/tbot/anonymous_telemetry.go
+++ b/tool/tbot/anonymous_telemetry.go
@@ -34,6 +34,9 @@ import (
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	prehogv1ac "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
 )
 
 const (
@@ -81,10 +84,10 @@ func sendTelemetry(
 ) error {
 	start := time.Now()
 	if !telemetryEnabled(envGetter) {
-		log.InfoContext(ctx, "Anonymous telemetry is not enabled. Find out more about Machine ID's anonymous telemetry at https://goteleport.com/docs/machine-id/reference/telemetry/")
+		log.InfoContext(ctx, "Anonymous telemetry is not enabled. Find out more about anonymous telemetry at https://goteleport.com/docs/reference/machine-workload-identity/machine-id/telemetry/")
 		return nil
 	}
-	log.InfoContext(ctx, "Anonymous telemetry is enabled. Find out more about Machine ID's anonymous telemetry at https://goteleport.com/docs/machine-id/reference/telemetry/")
+	log.InfoContext(ctx, "Anonymous telemetry is enabled. Find out more about anonymous telemetry at https://goteleport.com/docs/reference/machine-workload-identity/machine-id/telemetry/")
 
 	data := &prehogv1a.TbotStartEvent{
 		RunMode:  prehogv1a.TbotStartEvent_RUN_MODE_DAEMON,
@@ -100,11 +103,11 @@ func sendTelemetry(
 	}
 	for _, output := range cfg.Services {
 		switch output.(type) {
-		case *config.ApplicationOutput:
+		case *application.OutputConfig:
 			data.DestinationsApplication++
-		case *config.DatabaseOutput:
+		case *database.OutputConfig:
 			data.DestinationsDatabase++
-		case *config.KubernetesOutput:
+		case *k8s.OutputV1Config:
 			data.DestinationsKubernetes++
 		default:
 			data.DestinationsOther++
diff --git a/tool/tbot/anonymous_telemetry_test.go b/tool/tbot/anonymous_telemetry_test.go
index 5719ef17da428..a2c2bce4408f7 100644
--- a/tool/tbot/anonymous_telemetry_test.go
+++ b/tool/tbot/anonymous_telemetry_test.go
@@ -28,8 +28,14 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/tbot/services/application"
+	"github.com/gravitational/teleport/lib/tbot/services/database"
+	identitysvc "github.com/gravitational/teleport/lib/tbot/services/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/k8s"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type mockReportingServiceClient struct {
@@ -52,7 +58,7 @@ func mockEnvGetter(data map[string]string) envGetter {
 
 func TestSendTelemetry(t *testing.T) {
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	t.Run("sends telemetry when enabled", func(t *testing.T) {
 		mockClient := &mockReportingServiceClient{}
@@ -63,21 +69,21 @@ func TestSendTelemetry(t *testing.T) {
 		}
 		cfg := &config.BotConfig{
 			Oneshot: true,
-			Onboarding: config.OnboardingConfig{
+			Onboarding: onboarding.Config{
 				JoinMethod: types.JoinMethodGitHub,
 			},
 			Services: config.ServiceConfigs{
-				&config.IdentityOutput{
-					Destination: &config.DestinationDirectory{},
+				&identitysvc.OutputConfig{
+					Destination: &destination.Memory{},
 				},
-				&config.KubernetesOutput{
-					Destination: &config.DestinationDirectory{},
+				&k8s.OutputV1Config{
+					Destination: &destination.Directory{},
 				},
-				&config.ApplicationOutput{
-					Destination: &config.DestinationDirectory{},
+				&application.OutputConfig{
+					Destination: &destination.Directory{},
 				},
-				&config.DatabaseOutput{
-					Destination: &config.DestinationDirectory{},
+				&database.OutputConfig{
+					Destination: &destination.Directory{},
 				},
 			},
 		}
diff --git a/tool/tbot/copy_binaries.go b/tool/tbot/copy_binaries.go
new file mode 100644
index 0000000000000..816bc9175df2b
--- /dev/null
+++ b/tool/tbot/copy_binaries.go
@@ -0,0 +1,101 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package main
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/tbot/cli"
+)
+
+const (
+	// fdpassBinaryName is the name of the fdpass binary
+	fdpassBinaryName = "fdpass-teleport"
+
+	// tbotBinaryName is the name of the tbot binary
+	tbotBinaryName = "tbot"
+)
+
+// copyBinary copies a binary from the source to the destination. It assumes
+// 0755 permissions.
+func copyBinary(src, dest string) error {
+	inputFile, err := os.Open(src)
+	if err != nil {
+		return trace.Wrap(err, "opening source file: %s", src)
+	}
+	defer inputFile.Close()
+
+	destFile, err := os.OpenFile(dest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+	if err != nil {
+		return trace.Wrap(err, "opening destination for writing: %s", dest)
+	}
+	defer destFile.Close()
+
+	_, err = io.Copy(destFile, inputFile)
+	if err != nil {
+		return trace.Wrap(err, "copying file contents: %s", src)
+	}
+
+	return nil
+}
+
+// onCopyBinariesCommand runs `tbot copy-binaries`
+func onCopyBinariesCommand(ctx context.Context, cmd *cli.CopyBinariesCommand) error {
+	selfPath, err := os.Executable()
+	if err != nil {
+		return trace.Wrap(err, "determining current executable")
+	}
+
+	stat, err := os.Stat(cmd.DestinationDir)
+	if errors.Is(err, os.ErrNotExist) {
+		if err := os.MkdirAll(cmd.DestinationDir, 0755); err != nil {
+			return trace.Wrap(err, "creating destination directory: %s", cmd.DestinationDir)
+		}
+	} else if err != nil {
+		return trace.Wrap(err, "could not resolve destination directory: %s", cmd.DestinationDir)
+	} else if !stat.IsDir() {
+		return trace.BadParameter("invalid destination directory: %s", cmd.DestinationDir)
+	}
+
+	tbotDest := filepath.Join(cmd.DestinationDir, tbotBinaryName)
+	if err := copyBinary(selfPath, tbotDest); err != nil {
+		return trace.Wrap(err, "copying %s binary", tbotBinaryName)
+	}
+	log.InfoContext(ctx, "Copied tbot to destination", "path", tbotDest)
+
+	if cmd.IncludeFDPass {
+		fdpassPath := filepath.Join(filepath.Dir(selfPath), fdpassBinaryName)
+		fdpassDest := filepath.Join(cmd.DestinationDir, fdpassBinaryName)
+		if err := copyBinary(fdpassPath, fdpassDest); err != nil {
+			return trace.Wrap(err, "copying %s binary", fdpassBinaryName)
+		}
+
+		log.InfoContext(ctx, "Copied fdpass-teleport to destination", "path", fdpassDest)
+	}
+
+	log.InfoContext(ctx, "Binaries have been copied successfully", "destination", cmd.DestinationDir)
+
+	return nil
+}
diff --git a/tool/tbot/db.go b/tool/tbot/db.go
index 59d67c148563d..2b3fae24b8523 100644
--- a/tool/tbot/db.go
+++ b/tool/tbot/db.go
@@ -24,7 +24,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/tbot/cli"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 	"github.com/gravitational/teleport/lib/tbot/tshwrap"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -50,7 +50,7 @@ func onDBCommand(globalCfg *cli.GlobalArgs, dbCmd *cli.DBCommand) error {
 		return trace.Wrap(err)
 	}
 
-	identityPath := filepath.Join(destination.Path, config.IdentityFilePath)
+	identityPath := filepath.Join(destination.Path, identity.IdentityFilePath)
 	identity, err := tshwrap.LoadIdentity(identityPath)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tbot/init.go b/tool/tbot/init.go
index 4b7f493bea8df..ecbbc833e8ea2 100644
--- a/tool/tbot/init.go
+++ b/tool/tbot/init.go
@@ -32,6 +32,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
 	"github.com/gravitational/teleport/lib/tbot/cli"
 	"github.com/gravitational/teleport/lib/tbot/config"
@@ -444,7 +445,7 @@ func onInit(globals *cli.GlobalArgs, init *cli.InitCommand) error {
 	} else {
 		for _, v := range initables {
 			d := v.GetDestination()
-			dirDest, ok := d.(*config.DestinationDirectory)
+			dirDest, ok := d.(*destination.Directory)
 			if ok && dirDest.Path == init.InitDir {
 				target = v
 				break
@@ -455,7 +456,7 @@ func onInit(globals *cli.GlobalArgs, init *cli.InitCommand) error {
 		}
 	}
 
-	destDir, ok := target.GetDestination().(*config.DestinationDirectory)
+	destDir, ok := target.GetDestination().(*destination.Directory)
 	if !ok {
 		return trace.BadParameter("`tbot init` only supports directory destinations")
 	}
diff --git a/tool/tbot/init_test.go b/tool/tbot/init_test.go
index a9d6e8ef34ad3..083e083768907 100644
--- a/tool/tbot/init_test.go
+++ b/tool/tbot/init_test.go
@@ -33,6 +33,7 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
 	"github.com/gravitational/teleport/lib/tbot/botfs"
 	"github.com/gravitational/teleport/lib/tbot/cli"
 	"github.com/gravitational/teleport/lib/tbot/config"
@@ -130,10 +131,10 @@ func testConfigFromString(t *testing.T, yamlStr string) *config.BotConfig {
 
 // validateFileDestinations ensures all files in a destination exist on disk as
 // expected, and returns the destination.
-func validateFileDestination(t *testing.T, svc config.Initable) *config.DestinationDirectory {
+func validateFileDestination(t *testing.T, svc config.Initable) *destination.Directory {
 	destImpl := svc.GetDestination()
 
-	destDir, ok := destImpl.(*config.DestinationDirectory)
+	destDir, ok := destImpl.(*destination.Directory)
 	require.True(t, ok)
 
 	for _, art := range identity.GetArtifacts() {
diff --git a/tool/tbot/keypair.go b/tool/tbot/keypair.go
index e91820a7be015..7faa016d4e8a3 100644
--- a/tool/tbot/keypair.go
+++ b/tool/tbot/keypair.go
@@ -20,19 +20,30 @@ package main
 
 import (
 	"context"
+	"crypto"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"io"
+	"os"
 	"strings"
+	"text/template"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/join/boundkeypair"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
 	"github.com/gravitational/teleport/lib/tbot/cli"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 // getSuiteFromProxy fetches cryptosuite config from the given remote proxy.
@@ -58,45 +69,251 @@ func getSuiteFromProxy(proxyAddr string, insecure bool) cryptosuites.GetSuiteFun
 // specified.
 type KeypairDocument struct {
 	PublicKey string `json:"public_key"`
+
+	PrivateKey string `json:"private_key,omitempty"`
 }
 
-// printKeypair prints the current keypair from the given client state using the
-// specified format.
-func printKeypair(state *boundkeypair.ClientState, format string) error {
-	publicKeyBytes, err := state.ToPublicKeyBytes()
+// KeypairMessageParams are parameters used with `keypairMessageTemplate`
+type KeypairMessageParams struct {
+	PublicKey         string
+	EnvName           string
+	EncodedPrivateKey string
+	StaticKeyPath     string
+	TokenExample      string
+}
+
+var keypairMessageTemplate = template.Must(template.New("keypair_message").Parse(`
+To register the keypair with Teleport, include this public key in the token's
+'spec.bound_keypair.onboarding.initial_public_key' field:
+
+	{{ .PublicKey }}
+
+Refer to this token example as a reference:
+
+{{ .TokenExample }}
+{{- if .StaticKeyPath }}
+Note that you must also set 'spec.bound_keypair.recovery.mode' to 'insecure'
+to use static keys.
+
+The static key has been written to: {{ .StaticKeyPath }}
+
+Configure your bot to use this static key by setting the following 'tbot.yaml'
+field:
+
+	onboarding:
+	  join_method: bound_keypair
+	  bound_keypair:
+	    static_private_key_path: {{ .StaticKeyPath }}
+{{ else if .EncodedPrivateKey }}
+Configure your bot to use this static key by inserting the following private key
+value into the bot's environment, ideally via a platform-specific keystore if
+available:
+
+	export {{ .EnvName }}={{ .EncodedPrivateKey }}
+{{ end }}
+Note that bots joined with static tokens do not support keypair rotation and
+will be unable to join if a rotation is requested server-side via the token's
+'rotate_after' field. Additionally, 'insecure' recovery mode must be used, as
+shown above. Read more at:
+
+	https://goteleport.com/docs/reference/machine-workload-identity/machine-id/bound-keypair/concepts/#recovery
+`))
+
+func generateExampleToken(params KeypairMessageParams, indent string) (string, error) {
+	token := &types.ProvisionTokenV2{
+		Version: types.V2,
+		Kind:    types.KindToken,
+		Metadata: types.Metadata{
+			Name: "example-token",
+		},
+		Spec: types.ProvisionTokenSpecV2{
+			Roles:      []types.SystemRole{types.RoleBot},
+			BotName:    "example-bot",
+			JoinMethod: types.JoinMethodBoundKeypair,
+			BoundKeypair: &types.ProvisionTokenSpecV2BoundKeypair{
+				Onboarding: &types.ProvisionTokenSpecV2BoundKeypair_OnboardingSpec{
+					InitialPublicKey: params.PublicKey,
+				},
+				Recovery: &types.ProvisionTokenSpecV2BoundKeypair_RecoverySpec{},
+			},
+		},
+	}
+
+	if params.EncodedPrivateKey != "" {
+		// EncodedPrivateKey is always set if a static key is used, even if we
+		// only write the unencoded key to a file
+		token.Spec.BoundKeypair.Recovery.Mode = "insecure"
+	}
+
+	w := strings.Builder{}
+	if err := utils.WriteYAML(&w, token); err != nil {
+		return "", trace.Wrap(err, "generating example token spec")
+	}
+
+	if indent == "" {
+		return w.String(), nil
+	}
+
+	indented := strings.Builder{}
+	for line := range strings.Lines(w.String()) {
+		indented.WriteString(indent + line)
+	}
+
+	return indented.String(), nil
+}
+
+func printKeypair(w io.Writer, params KeypairMessageParams, format string) error {
+	example, err := generateExampleToken(params, "\t")
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	keyString := strings.TrimSpace(string(publicKeyBytes))
+	params.TokenExample = example
 
 	switch format {
 	case teleport.Text:
-		// TODO: maybe just print out an example token resource to copy and paste? Or a tctl command.
-		fmt.Printf(
-			"\nTo register the keypair with Teleport, include this public key in the token's\n"+
-				"`spec.bound_keypair.onboarding.initial_public_key`:\n\n"+
-				"\t%s\n\n",
-			keyString,
-		)
+		if err := keypairMessageTemplate.Execute(w, params); err != nil {
+			return trace.Wrap(err)
+		}
 	case teleport.JSON:
 		bytes, err := json.Marshal(&KeypairDocument{
-			PublicKey: keyString,
+			PublicKey:  params.PublicKey,
+			PrivateKey: params.EncodedPrivateKey,
 		})
 		if err != nil {
 			return trace.Wrap(err, "generating json")
 		}
 
-		fmt.Printf("%s\n", string(bytes))
+		fmt.Fprintf(w, "%s\n", string(bytes))
 	default:
-		return trace.BadParameter("unsupported output format %s; keypair has been generated", format)
+		return trace.BadParameter("unsupported output format %s; keypair has not been generated", format)
 	}
 
 	return nil
 }
 
+// printKeypairFromState prints the current keypair from the given client state using the
+// specified format.
+func printKeypairFromState(w io.Writer, state *boundkeypair.FSClientState, format string) error {
+	publicKeyBytes, err := state.ToPublicKeyBytes()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	keyString := strings.TrimSpace(string(publicKeyBytes))
+	return trace.Wrap(printKeypair(w, KeypairMessageParams{
+		PublicKey: keyString,
+	}, format))
+}
+
+func loadExistingStaticKeypair(path string) (crypto.Signer, error) {
+	bytes, err := os.ReadFile(path)
+	if trace.IsNotFound(err) {
+		// No existing keypair was found at the path, nothing to load.
+		return nil, nil
+	} else if err != nil {
+		return nil, trace.Wrap(err, "could not read from static key path %s", path)
+	}
+
+	parsed, err := keys.ParsePrivateKey(bytes)
+	if err != nil {
+		return nil, trace.Wrap(err, "could not parse existing key at static key path %s", path)
+	}
+
+	// MarshalPrivateKey expects an actual signer impl, so unpack it.
+	return parsed.Signer, nil
+}
+
+// generateStaticKeypair generates a static keypair, used when --static is set
+func generateStaticKeypair(ctx context.Context, globals *cli.GlobalArgs, cmd *cli.KeypairCreateCommand) error {
+	var key crypto.Signer
+	var err error
+
+	if cmd.StaticKeyPath != "" {
+		key, err = loadExistingStaticKeypair(cmd.StaticKeyPath)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		log.InfoContext(ctx, "Loaded existing static key from path", "path", cmd.StaticKeyPath)
+	}
+
+	if key == nil || cmd.Overwrite {
+		if key != nil {
+			log.WarnContext(
+				ctx,
+				"An existing static key was found at the specified path and will be overwritten",
+				"static_path", cmd.StaticKeyPath,
+			)
+		}
+
+		getSuite := cmd.GetSuite
+		if getSuite == nil {
+			getSuite = getSuiteFromProxy(cmd.ProxyServer, globals.Insecure)
+		}
+
+		key, err = cryptosuites.GenerateKey(
+			ctx,
+			getSuite,
+			cryptosuites.BoundKeypairJoining,
+		)
+		if err != nil {
+			return trace.Wrap(err, "generating keypair")
+		}
+	} else {
+		log.InfoContext(ctx, "An existing static key was found at the given path and will be printed. To generate a new key, pass --overwrite")
+	}
+
+	privateKeyBytes, err := keys.MarshalPrivateKey(key)
+	if err != nil {
+		return trace.Wrap(err, "marshaling private key")
+	}
+
+	encodedPrivateKey := base64.StdEncoding.EncodeToString(privateKeyBytes)
+
+	sshPubKey, err := ssh.NewPublicKey(key.Public())
+	if err != nil {
+		return trace.Wrap(err, "creating ssh public key")
+	}
+
+	publicKeyBytes := ssh.MarshalAuthorizedKey(sshPubKey)
+	publicKeyString := strings.TrimSpace(string(publicKeyBytes))
+
+	if cmd.StaticKeyPath != "" {
+		if err := os.WriteFile(cmd.StaticKeyPath, privateKeyBytes, botfs.DefaultMode); err != nil {
+			return trace.Wrap(err, "writing static key to %s", cmd.StaticKeyPath)
+		}
+
+		log.InfoContext(
+			ctx,
+			"A static keypair has been written to the specified static key path",
+			"path", cmd.StaticKeyPath,
+		)
+	}
+
+	w := cmd.Writer
+	if w == nil {
+		w = os.Stdout
+	}
+
+	return trace.Wrap(printKeypair(w, KeypairMessageParams{
+		PublicKey:         publicKeyString,
+		EnvName:           onboarding.BoundKeypairStaticKeyEnv,
+		EncodedPrivateKey: encodedPrivateKey,
+		StaticKeyPath:     cmd.StaticKeyPath,
+	}, cmd.Format))
+}
+
 // onKeypairCreate command handles `tbot keypair create`
 func onKeypairCreateCommand(ctx context.Context, globals *cli.GlobalArgs, cmd *cli.KeypairCreateCommand) error {
+	if cmd.Static {
+		return trace.Wrap(generateStaticKeypair(ctx, globals, cmd))
+	}
+
+	if cmd.Storage == "" {
+		return trace.BadParameter("a storage path must be provided with --storage")
+	}
+
 	dest, err := config.DestinationFromURI(cmd.Storage)
 	if err != nil {
 		return trace.Wrap(err, "parsing storage URI")
@@ -106,28 +323,34 @@ func onKeypairCreateCommand(ctx context.Context, globals *cli.GlobalArgs, cmd *c
 		return trace.Wrap(err, "initializing storage")
 	}
 
-	fsAdapter := config.NewBoundkeypairDestinationAdapter(dest)
+	fsAdapter := destination.NewBoundkeypairDestinationAdapter(dest)
+	w := cmd.Writer
+	if w == nil {
+		w = os.Stdout
+	}
 
 	// Check for existing client state.
 	state, err := boundkeypair.LoadClientState(ctx, fsAdapter)
 	if err == nil {
 		if !cmd.Overwrite {
 			log.InfoContext(ctx, "Existing client state found, printing existing public key. To generate a new key, pass --overwrite")
-			return trace.Wrap(printKeypair(state, cmd.Format))
+			return trace.Wrap(printKeypairFromState(w, state, cmd.Format))
 		} else {
 			log.WarnContext(ctx, "Overwriting existing client state and generating a new keypair.")
 		}
 	}
 
-	state, err = boundkeypair.NewUnboundClientState(
-		ctx,
-		getSuiteFromProxy(cmd.ProxyServer, globals.Insecure),
-	)
+	getSuite := cmd.GetSuite
+	if getSuite == nil {
+		getSuite = getSuiteFromProxy(cmd.ProxyServer, globals.Insecure)
+	}
+
+	state, err = boundkeypair.NewUnboundClientState(ctx, fsAdapter, getSuite)
 	if err != nil {
 		return trace.Wrap(err, "initializing new client state")
 	}
 
-	if err := boundkeypair.StoreClientState(ctx, fsAdapter, state); err != nil {
+	if err := state.Store(ctx); err != nil {
 		return trace.Wrap(err, "writing bound keypair state")
 	}
 
@@ -137,5 +360,5 @@ func onKeypairCreateCommand(ctx context.Context, globals *cli.GlobalArgs, cmd *c
 		"storage", dest.String(),
 	)
 
-	return trace.Wrap(printKeypair(state, cmd.Format))
+	return trace.Wrap(printKeypairFromState(w, state, cmd.Format))
 }
diff --git a/tool/tbot/keypair_test.go b/tool/tbot/keypair_test.go
new file mode 100644
index 0000000000000..f5eb87e6deff9
--- /dev/null
+++ b/tool/tbot/keypair_test.go
@@ -0,0 +1,112 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/cli"
+)
+
+func dummyGetSuite(ctx context.Context) (types.SignatureAlgorithmSuite, error) {
+	return types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1, nil
+}
+
+// TestGenerateStaticKeypairAtPath
+func TestGenerateStaticKeypairAtPath(t *testing.T) {
+	dir := t.TempDir()
+	dest := filepath.Join(dir, "test.key")
+
+	// Try creating a new key
+	firstBuf := bytes.Buffer{}
+	require.NoError(t, generateStaticKeypair(t.Context(), &cli.GlobalArgs{}, &cli.KeypairCreateCommand{
+		GetSuite:      dummyGetSuite,
+		Format:        teleport.JSON,
+		StaticKeyPath: dest,
+		Overwrite:     false,
+		Writer:        &firstBuf,
+	}))
+
+	// It should be readable and nonempty
+	require.FileExists(t, dest)
+	firstFileBytes, err := os.ReadFile(dest)
+	require.NoError(t, err)
+	require.NotEmpty(t, firstFileBytes)
+
+	firstParseResult := KeypairDocument{}
+	require.NoError(t, json.Unmarshal(firstBuf.Bytes(), &firstParseResult))
+
+	decodedFirstKey, err := base64.StdEncoding.DecodeString(firstParseResult.PrivateKey)
+	require.NoError(t, err)
+
+	// Defer to bytes.Equal instead of require.Equal(), since otherwise it'll
+	// print very unhelpful debugging info if the check fails.
+	require.True(t, bytes.Equal(firstFileBytes, decodedFirstKey))
+
+	// Try again, but overwrite
+	secondBuf := bytes.Buffer{}
+	require.NoError(t, generateStaticKeypair(t.Context(), &cli.GlobalArgs{}, &cli.KeypairCreateCommand{
+		GetSuite:      dummyGetSuite,
+		Format:        teleport.JSON,
+		StaticKeyPath: dest,
+		Overwrite:     true,
+		Writer:        &secondBuf,
+	}))
+
+	secondFileBytes, err := os.ReadFile(dest)
+	require.NoError(t, err)
+	require.NotEmpty(t, secondFileBytes)
+
+	// Content should be different
+	require.False(t, bytes.Equal(firstFileBytes, secondFileBytes))
+
+	// Try once more, but don't overwrite
+	thirdBuf := bytes.Buffer{}
+	require.NoError(t, generateStaticKeypair(t.Context(), &cli.GlobalArgs{}, &cli.KeypairCreateCommand{
+		GetSuite:      dummyGetSuite,
+		Format:        teleport.JSON,
+		StaticKeyPath: dest,
+		Overwrite:     false,
+		Writer:        &thirdBuf,
+	}))
+
+	thirdFileBytes, err := os.ReadFile(dest)
+	require.NoError(t, err)
+	require.NotEmpty(t, thirdFileBytes)
+
+	thirdParseResult := KeypairDocument{}
+	require.NoError(t, json.Unmarshal(thirdBuf.Bytes(), &thirdParseResult))
+
+	decodedThirdKey, err := base64.StdEncoding.DecodeString(thirdParseResult.PrivateKey)
+	require.NoError(t, err)
+
+	// These values should all match the file from the 2nd try
+	require.True(t, bytes.Equal(secondFileBytes, thirdFileBytes))
+	require.True(t, bytes.Equal(secondFileBytes, decodedThirdKey))
+}
diff --git a/tool/tbot/kube.go b/tool/tbot/kube.go
index 997b668087e11..2077d4ea9235a 100644
--- a/tool/tbot/kube.go
+++ b/tool/tbot/kube.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/identityfile"
 	"github.com/gravitational/teleport/lib/tbot/cli"
 	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -77,7 +78,7 @@ func onKubeCredentialsCommand(
 		return trace.Wrap(err)
 	}
 
-	idData, err := destination.Read(ctx, config.IdentityFilePath)
+	idData, err := destination.Read(ctx, identity.IdentityFilePath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tbot/main.go b/tool/tbot/main.go
index cadd10b88092e..20d74d055e4af 100644
--- a/tool/tbot/main.go
+++ b/tool/tbot/main.go
@@ -53,12 +53,12 @@ func main() {
 	}
 }
 
-const appHelp = `Teleport Machine ID
+const appHelp = `Teleport Machine & Workload Identity 
 
-Machine ID issues and renews short-lived certificates so your machines can
-access Teleport protected resources in the same way your engineers do!
+Machine & Workload Identity issues and renews short-lived certificates so your
+machines can access Teleport protected resources in the same way your engineers do!
 
-Find out more at https://goteleport.com/docs/machine-id/introduction/`
+Find out more at https://goteleport.com/docs/machine-workload-identity/`
 
 func Run(args []string, stdout io.Writer) error {
 	ctx := context.Background()
@@ -123,6 +123,10 @@ func Run(args []string, stdout io.Writer) error {
 			return onKeypairCreateCommand(ctx, globalCfg, keypairCreateCmd)
 		}),
 
+		cli.NewCopyBinariesCommand(app, func(cbc *cli.CopyBinariesCommand) error {
+			return onCopyBinariesCommand(ctx, cbc)
+		}),
+
 		// `start` and `configure` commands
 		cli.NewLegacyCommand(startCmd, buildConfigAndStart(ctx, globalCfg), cli.CommandModeStart),
 		cli.NewLegacyCommand(configureCmd, buildConfigAndConfigure(ctx, globalCfg, &configureOutPath, stdout), cli.CommandModeConfigure),
@@ -162,6 +166,12 @@ func Run(args []string, stdout io.Writer) error {
 
 		cli.NewWorkloadIdentityAWSRACommand(startCmd, buildConfigAndStart(ctx, globalCfg), cli.CommandModeStart),
 		cli.NewWorkloadIdentityAWSRACommand(configureCmd, buildConfigAndConfigure(ctx, globalCfg, &configureOutPath, stdout), cli.CommandModeConfigure),
+
+		cli.NewApplicationProxyCommand(startCmd, buildConfigAndStart(ctx, globalCfg), cli.CommandModeStart),
+		cli.NewApplicationProxyCommand(configureCmd, buildConfigAndConfigure(ctx, globalCfg, &configureOutPath, stdout), cli.CommandModeConfigure),
+
+		cli.NewSSHMultiplexerCommand(startCmd, buildConfigAndStart(ctx, globalCfg), cli.CommandModeStart),
+		cli.NewSSHMultiplexerCommand(configureCmd, buildConfigAndConfigure(ctx, globalCfg, &configureOutPath, stdout), cli.CommandModeConfigure),
 	)
 
 	// Initialize legacy-style commands. These are simple enough to not really
@@ -355,8 +365,13 @@ func onConfigure(
 		out = f
 	}
 
-	// Ensure they have provided a join method to use in the configuration.
-	if cfg.Onboarding.JoinMethod == types.JoinMethodUnspecified {
+	// Ensure they have provided either a valid joining URI, or a
+	// join method to use in the configuration.
+	if cfg.JoinURI != "" {
+		if _, err := config.ParseJoinURI(cfg.JoinURI); err != nil {
+			return trace.Wrap(err, "invalid joining URI")
+		}
+	} else if cfg.Onboarding.JoinMethod == types.JoinMethodUnspecified {
 		return trace.BadParameter("join method must be provided")
 	}
 
diff --git a/tool/tbot/proxy.go b/tool/tbot/proxy.go
index 6dc3804092249..2fb3e1753a9a9 100644
--- a/tool/tbot/proxy.go
+++ b/tool/tbot/proxy.go
@@ -27,7 +27,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/tbot/cli"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/services/identity"
 	"github.com/gravitational/teleport/lib/tbot/tshwrap"
 )
 
@@ -54,7 +54,7 @@ func onProxyCommand(
 		return trace.Wrap(err)
 	}
 
-	identityPath := filepath.Join(destination.Path, config.IdentityFilePath)
+	identityPath := filepath.Join(destination.Path, identity.IdentityFilePath)
 
 	// TODO(timothyb89):  We could consider supporting a --cluster passthrough
 	//  here as in `tbot db ...`.
diff --git a/tool/tbot/proxy_ssh.go b/tool/tbot/proxy_ssh.go
index f4bc17a0c7a09..b388f6e3444c6 100644
--- a/tool/tbot/proxy_ssh.go
+++ b/tool/tbot/proxy_ssh.go
@@ -22,8 +22,8 @@ import (
 
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport/lib/tbot"
 	"github.com/gravitational/teleport/lib/tbot/cli"
+	"github.com/gravitational/teleport/lib/tbot/services/ssh"
 )
 
 // onSSHProxyCommand is meant to be used as an OpenSSH/PuTTY proxy command. While this
@@ -39,7 +39,7 @@ func onSSHProxyCommand(ctx context.Context, globalCfg *cli.GlobalArgs, sshProxyC
 		sshProxyCmd.Port = "0"
 	}
 
-	proxySSHConfig := tbot.ProxySSHConfig{
+	proxySSHConfig := ssh.ProxySSHConfig{
 		Insecure:                  globalCfg.Insecure,
 		FIPS:                      globalCfg.FIPS,
 		DestinationPath:           sshProxyCmd.DestinationDir,
@@ -55,11 +55,11 @@ func onSSHProxyCommand(ctx context.Context, globalCfg *cli.GlobalArgs, sshProxyC
 		Log:                       log,
 	}
 
-	return trace.Wrap(tbot.ProxySSH(ctx, proxySSHConfig))
+	return trace.Wrap(ssh.ProxySSH(ctx, proxySSHConfig))
 }
 
 // onSSHMultiplexProxyCommand connects to an existing long-lived SSH multiplexer
 // service as opposed to onSSHProxyCommand which completes this on-the-fly.
 func onSSHMultiplexProxyCommand(ctx context.Context, socketPath string, target string) error {
-	return trace.Wrap(tbot.ConnectToSSHMultiplex(ctx, socketPath, target, os.Stdout))
+	return trace.Wrap(ssh.ConnectToSSHMultiplex(ctx, socketPath, target, os.Stdout))
 }
diff --git a/tool/tbot/systemd.go b/tool/tbot/systemd.go
index c61943fce4077..babf75c4be1bc 100644
--- a/tool/tbot/systemd.go
+++ b/tool/tbot/systemd.go
@@ -21,19 +21,18 @@ package main
 import (
 	"bytes"
 	"context"
-	_ "embed"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"os"
 	"path/filepath"
-	"text/template"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
 
 	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
+	"github.com/gravitational/teleport/lib/tbot/config/systemd"
 )
 
 type onInstallSystemdCmdFunc func(
@@ -47,7 +46,7 @@ func setupInstallSystemdCmd(rootCmd *kingpin.Application) (
 	string,
 	onInstallSystemdCmdFunc,
 ) {
-	installCmd := rootCmd.Command("install", "Helper commands for installing Machine ID.")
+	installCmd := rootCmd.Command("install", "Helper commands for installing tbot.")
 	installSystemdCmd := installCmd.Command("systemd", "Generates and installs a systemd unit file for a specified tbot configuration file.")
 	unitName := installSystemdCmd.Flag("name", "Name for the systemd unit. Defaults to 'tbot'.").Default("tbot").String()
 	group := installSystemdCmd.Flag("group", "The group that the service should run as. Defaults to 'teleport'.").Default("teleport").String()
@@ -83,21 +82,6 @@ func setupInstallSystemdCmd(rootCmd *kingpin.Application) (
 	return installSystemdCmd.FullCommand(), f
 }
 
-var (
-	//go:embed systemd.tmpl
-	systemdTemplateData string
-	systemdTemplate     = template.Must(template.New("").Parse(systemdTemplateData))
-)
-
-type systemdTemplateParams struct {
-	UnitName           string
-	User               string
-	Group              string
-	AnonymousTelemetry bool
-	ConfigPath         string
-	TBotPath           string
-}
-
 func onInstallSystemdCmd(
 	ctx context.Context,
 	log *slog.Logger,
@@ -132,7 +116,7 @@ func onInstallSystemdCmd(
 	}
 
 	buf := bytes.NewBuffer(nil)
-	err = systemdTemplate.Execute(buf, systemdTemplateParams{
+	err = systemd.Template.Execute(buf, systemd.TemplateParams{
 		UnitName:           unitName,
 		User:               user,
 		Group:              group,
diff --git a/tool/tbot/systemd.tmpl b/tool/tbot/systemd.tmpl
deleted file mode 100644
index c058c0fa72e93..0000000000000
--- a/tool/tbot/systemd.tmpl
+++ /dev/null
@@ -1,19 +0,0 @@
-# Generated by `tbot`
-[Unit]
-Description={{ .UnitName }} - Teleport Machine ID Service
-After=network.target
-
-[Service]
-Type=simple
-User={{ .User }}
-Group={{ .Group }}
-Restart=always
-RestartSec=5
-Environment="TELEPORT_ANONYMOUS_TELEMETRY={{ if .AnonymousTelemetry }}1{{ else }}0{{ end }}"
-ExecStart={{ .TBotPath }} start -c {{ .ConfigPath }}
-ExecReload=/bin/kill -HUP $MAINPID
-PIDFile=/run/{{ .UnitName }}.pid
-LimitNOFILE=524288
-
-[Install]
-WantedBy=multi-user.target
diff --git a/tool/tbot/systemd_test.go b/tool/tbot/systemd_test.go
index 248a696636a8f..2d536d95f1eff 100644
--- a/tool/tbot/systemd_test.go
+++ b/tool/tbot/systemd_test.go
@@ -30,13 +30,13 @@ import (
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 )
 
 func TestInstallSystemdCmd(t *testing.T) {
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
+	log := logtest.NewLogger()
 
 	// Create pre-existing file to test --force
 	preExistingDir := t.TempDir()
diff --git a/tool/tbot/testdata/TestInstallSystemdCmd/succeeds_prexisting_with_force.golden b/tool/tbot/testdata/TestInstallSystemdCmd/succeeds_prexisting_with_force.golden
index dc50b23f18226..93efdbeedfa4e 100644
--- a/tool/tbot/testdata/TestInstallSystemdCmd/succeeds_prexisting_with_force.golden
+++ b/tool/tbot/testdata/TestInstallSystemdCmd/succeeds_prexisting_with_force.golden
@@ -1,6 +1,6 @@
 # Generated by `tbot`
 [Unit]
-Description=tbot - Teleport Machine ID Service
+Description=tbot - Teleport Machine & Workload Identity Service
 After=network.target
 
 [Service]
@@ -10,7 +10,7 @@ Group=llamas
 Restart=always
 RestartSec=5
 Environment="TELEPORT_ANONYMOUS_TELEMETRY=0"
-ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml
+ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml --pid-file=/run/tbot.pid
 ExecReload=/bin/kill -HUP $MAINPID
 PIDFile=/run/tbot.pid
 LimitNOFILE=524288
diff --git a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults.golden b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults.golden
index e9f947e416a2b..e0f6f57ebc68b 100644
--- a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults.golden
+++ b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults.golden
@@ -1,6 +1,6 @@
 # Generated by `tbot`
 [Unit]
-Description=tbot - Teleport Machine ID Service
+Description=tbot - Teleport Machine & Workload Identity Service
 After=network.target
 
 [Service]
@@ -10,7 +10,7 @@ Group=teleport
 Restart=always
 RestartSec=5
 Environment="TELEPORT_ANONYMOUS_TELEMETRY=0"
-ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml
+ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml --pid-file=/run/tbot.pid
 ExecReload=/bin/kill -HUP $MAINPID
 PIDFile=/run/tbot.pid
 LimitNOFILE=524288
diff --git a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults_and_dry_run.golden b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults_and_dry_run.golden
index c4f72e6725054..eac370afaf8a2 100644
--- a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults_and_dry_run.golden
+++ b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_defaults_and_dry_run.golden
@@ -3,7 +3,7 @@ The following would have been written to '/test/dir/tbot.service':
 
 # Generated by `tbot`
 [Unit]
-Description=tbot - Teleport Machine ID Service
+Description=tbot - Teleport Machine & Workload Identity Service
 After=network.target
 
 [Service]
@@ -13,7 +13,7 @@ Group=teleport
 Restart=always
 RestartSec=5
 Environment="TELEPORT_ANONYMOUS_TELEMETRY=0"
-ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml
+ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml --pid-file=/run/tbot.pid
 ExecReload=/bin/kill -HUP $MAINPID
 PIDFile=/run/tbot.pid
 LimitNOFILE=524288
diff --git a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_overrides.golden b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_overrides.golden
index 3fe862913ac87..c242fd5e049c1 100644
--- a/tool/tbot/testdata/TestInstallSystemdCmd/success_-_overrides.golden
+++ b/tool/tbot/testdata/TestInstallSystemdCmd/success_-_overrides.golden
@@ -1,6 +1,6 @@
 # Generated by `tbot`
 [Unit]
-Description=my-farm-bot - Teleport Machine ID Service
+Description=my-farm-bot - Teleport Machine & Workload Identity Service
 After=network.target
 
 [Service]
@@ -10,7 +10,7 @@ Group=llamas
 Restart=always
 RestartSec=5
 Environment="TELEPORT_ANONYMOUS_TELEMETRY=1"
-ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml
+ExecStart=/usr/local/bin/tbot start -c /etc/tbot.yaml --pid-file=/run/my-farm-bot.pid
 ExecReload=/bin/kill -HUP $MAINPID
 PIDFile=/run/my-farm-bot.pid
 LimitNOFILE=524288
diff --git a/tool/tctl/common/admin_action_test.go b/tool/tctl/common/admin_action_test.go
index 8ca4c88c96873..8f382bf458aee 100644
--- a/tool/tctl/common/admin_action_test.go
+++ b/tool/tctl/common/admin_action_test.go
@@ -44,7 +44,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
-	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
@@ -52,11 +51,12 @@ import (
 	libmfa "github.com/gravitational/teleport/lib/client/mfa"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/hostid"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	tctl "github.com/gravitational/teleport/tool/tctl/common"
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
@@ -1050,7 +1050,7 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
 
 	t.Helper()
 	ctx := context.Background()
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -1071,7 +1071,7 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
 	authPref.SetOrigin(types.OriginDefaults)
 
 	var proxyPublicAddr utils.NetAddr
-	process := testserver.MakeTestServer(t,
+	process, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithAuthPreference(authPref),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			proxyPublicAddr = cfg.Proxy.WebAddr
@@ -1079,6 +1079,11 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
 			cfg.Proxy.PublicAddrs = []utils.NetAddr{proxyPublicAddr}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
 	authAddr, err := process.AuthAddr()
 	require.NoError(t, err)
 	s.authServer = process.GetAuthServer()
@@ -1174,11 +1179,9 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
 	})
 	require.NoError(t, err)
 
-	hostUUID, err := hostid.ReadFile(process.Config.DataDir)
-	require.NoError(t, err)
-	localAdmin, err := storage.ReadLocalIdentity(
+	localAdmin, err := storage.ReadLocalIdentityForRole(
 		filepath.Join(process.Config.DataDir, teleport.ComponentProcess),
-		state.IdentityID{Role: types.RoleAdmin, HostUUID: hostUUID},
+		types.RoleAdmin,
 	)
 	require.NoError(t, err)
 	localAdminTLS, err := localAdmin.TLSConfig(nil)
@@ -1186,7 +1189,7 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
 	s.localAdminClient, err = authclient.Connect(ctx, &authclient.Config{
 		TLS:         localAdminTLS,
 		AuthServers: []utils.NetAddr{*authAddr},
-		Log:         utils.NewSlogLoggerForTests(),
+		Log:         logtest.NewLogger(),
 	})
 	require.NoError(t, err)
 
diff --git a/tool/tctl/common/alert_command.go b/tool/tctl/common/alert_command.go
index 03fdd1c8efd2f..9e3cb97e92249 100644
--- a/tool/tctl/common/alert_command.go
+++ b/tool/tctl/common/alert_command.go
@@ -21,6 +21,7 @@ package common
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"strings"
 	"time"
@@ -36,6 +37,7 @@ import (
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	libclient "github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
@@ -62,6 +64,9 @@ type AlertCommand struct {
 	reason  string
 	alertID string
 	clear   bool
+
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
 }
 
 // Initialize allows AlertCommand to plug itself into the CLI parser
@@ -69,10 +74,12 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI
 	c.config = config
 	alert := app.Command("alerts", "Manage cluster alerts.").Alias("alert")
 
+	formats := defaults.DefaultFormats
+
 	c.alertList = alert.Command("list", "List cluster alerts.").Alias("ls")
 	c.alertList.Flag("verbose", "Show detailed alert info, including acknowledged alerts.").Short('v').BoolVar(&c.verbose)
 	c.alertList.Flag("labels", labelHelp).StringVar(&c.labels)
-	c.alertList.Flag("format", "Output format, 'text' or 'json'").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
+	c.alertList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...)
 
 	c.alertCreate = alert.Command("create", "Create cluster alerts.")
 	c.alertCreate.Arg("message", "Alert body message.").Required().StringVar(&c.message)
@@ -88,11 +95,16 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI
 	c.alertAck.Flag("clear", "Clear the acknowledgment for the cluster alert.").BoolVar(&c.clear)
 	c.alertAck.Flag("reason", "The reason for acknowledging the cluster alert.").StringVar(&c.reason)
 	c.alertAck.Arg("id", "The cluster alert ID.").Required().StringVar(&c.alertID)
+	c.alertAck.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...)
 
 	// We add "ack ls" as a command so kingpin shows it in the help dialog - as there is a space, `tctl ack xyz` will always be
 	// handled by the ack command above
 	// This allows us to be consistent with our other `tctl xyz ls` commands
 	alert.Command("ack ls", "List acknowledged cluster alerts.")
+
+	if c.stdout == nil {
+		c.stdout = os.Stdout
+	}
 }
 
 // TryRun takes the CLI command as an argument (like "alerts ls") and executes it.
@@ -124,14 +136,23 @@ func (c *AlertCommand) ListAck(ctx context.Context, client *authclient.Client) e
 		return trace.Wrap(err)
 	}
 
-	table := asciitable.MakeTable([]string{"ID", "Reason", "Expires"})
+	switch c.format {
+	case teleport.Text:
+		table := asciitable.MakeTable([]string{"ID", "Reason", "Expires"})
 
-	for _, ack := range acks {
-		expires := apiutils.HumanTimeFormat(ack.Expires)
-		table.AddRow([]string{ack.AlertID, fmt.Sprintf("%q", ack.Reason), expires})
-	}
+		for _, ack := range acks {
+			expires := apiutils.HumanTimeFormat(ack.Expires)
+			table.AddRow([]string{ack.AlertID, fmt.Sprintf("%q", ack.Reason), expires})
+		}
 
-	fmt.Println(table.AsBuffer().String())
+		fmt.Fprintln(c.stdout, table.AsBuffer().String())
+	case teleport.JSON:
+		return trace.Wrap(utils.WriteJSONArray(c.stdout, acks), "failed to marshal alert acks")
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAML(c.stdout, acks), "failed to marshal alert acks")
+	default:
+		return trace.BadParameter("invalid format %q", c.format)
+	}
 
 	return nil
 }
@@ -160,8 +181,16 @@ func (c *AlertCommand) Ack(ctx context.Context, client *authclient.Client) error
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("Successfully acknowledged alert %q. Alerts with this ID won't be pushed for %s.\n", c.alertID, c.ttl)
-
+	switch c.format {
+	case teleport.Text:
+		fmt.Fprintf(c.stdout, "Successfully acknowledged alert %q. Alerts with this ID won't be pushed for %s.\n", c.alertID, c.ttl)
+	case teleport.JSON:
+		return trace.Wrap(utils.WriteJSON(c.stdout, ack), "failed to marshal alert ack")
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAML(c.stdout, ack), "failed to marshal alert ack")
+	default:
+		return trace.BadParameter("invalid format %q", c.format)
+	}
 	return nil
 }
 
@@ -174,7 +203,7 @@ func (c *AlertCommand) ClearAck(ctx context.Context, client *authclient.Client)
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("Successfully cleared acknowledgement for alert %q. Alerts with this ID will resume being pushed.\n", c.alertID)
+	fmt.Fprintf(c.stdout, "Successfully cleared acknowledgement for alert %q. Alerts with this ID will resume being pushed.\n", c.alertID)
 
 	return nil
 }
@@ -195,7 +224,7 @@ func (c *AlertCommand) List(ctx context.Context, client *authclient.Client) erro
 	}
 
 	if len(alerts) == 0 && c.format == teleport.Text {
-		fmt.Println("no alerts")
+		fmt.Fprintln(c.stdout, "no alerts")
 		return nil
 	}
 
@@ -204,17 +233,19 @@ func (c *AlertCommand) List(ctx context.Context, client *authclient.Client) erro
 
 	switch c.format {
 	case teleport.Text:
-		displayAlertsText(alerts, c.verbose)
+		c.displayAlertsText(alerts, c.verbose)
 		return nil
 	case teleport.JSON:
-		return trace.Wrap(displayAlertsJSON(alerts))
+		return trace.Wrap(utils.WriteJSONArray(c.stdout, alerts))
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAML(c.stdout, alerts))
 	default:
 		// technically unreachable since kingpin validates the EnumVar
 		return trace.BadParameter("invalid format %q", c.format)
 	}
 }
 
-func displayAlertsText(alerts []types.ClusterAlert, verbose bool) {
+func (c *AlertCommand) displayAlertsText(alerts []types.ClusterAlert, verbose bool) {
 	if verbose {
 		table := asciitable.MakeTable([]string{"ID", "Severity", "Expires In", "Message", "Created", "Labels"})
 		for _, alert := range alerts {
@@ -233,7 +264,7 @@ func displayAlertsText(alerts []types.ClusterAlert, verbose bool) {
 				strings.Join(labelPairs, ", "),
 			})
 		}
-		fmt.Println(table.AsBuffer().String())
+		fmt.Fprintln(c.stdout, table.AsBuffer().String())
 	} else {
 		table := asciitable.MakeTable([]string{"ID", "Severity", "Expires In", "Message"})
 		for _, alert := range alerts {
@@ -244,7 +275,7 @@ func displayAlertsText(alerts []types.ClusterAlert, verbose bool) {
 				fmt.Sprintf("%q", alert.Spec.Message),
 			})
 		}
-		fmt.Println(table.AsBuffer().String())
+		fmt.Fprintln(c.stdout, table.AsBuffer().String())
 	}
 }
 
@@ -261,10 +292,6 @@ func calculateTTL(expiration *time.Time) time.Duration {
 	return remainingDuration.Round(time.Minute)
 }
 
-func displayAlertsJSON(alerts []types.ClusterAlert) error {
-	return utils.WriteJSONArray(os.Stdout, alerts)
-}
-
 func (c *AlertCommand) Create(ctx context.Context, client *authclient.Client) error {
 	labels, err := libclient.ParseLabelSpec(c.labels)
 	if err != nil {
diff --git a/tool/tctl/common/alert_command_test.go b/tool/tctl/common/alert_command_test.go
new file mode 100644
index 0000000000000..c322d4265fecc
--- /dev/null
+++ b/tool/tctl/common/alert_command_test.go
@@ -0,0 +1,76 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+// TestAlertAcks tests formatting (json, yaml) for alerts ack add, alerts ack list.
+func TestAlertAcks(t *testing.T) {
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(logtest.NewLogger()))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	// test all output formats of "alerts ack" (add alert acknowledgement)
+	buf, err := runAlertCommand(t, client, []string{"ack", "alert-1", "--reason=none", "--format", teleport.JSON})
+	require.NoError(t, err)
+	out := mustDecodeJSON[types.AlertAcknowledgement](t, buf)
+	require.Equal(t, "alert-1", out.AlertID)
+
+	buf, err = runAlertCommand(t, client, []string{"ack", "alert-2", "--reason=none", "--format", teleport.YAML})
+	require.NoError(t, err)
+
+	// transcode yaml to json, since AlertAcknowledgement does not contain yaml tags
+	// for safe decoding
+	yamlBuf := mustTranscodeYAMLToJSON(t, buf)
+	out = mustDecodeJSON[types.AlertAcknowledgement](t, bytes.NewReader(yamlBuf))
+	require.Equal(t, "alert-2", out.AlertID)
+
+	// test all output formats of "alerts ack ls"
+	buf, err = runAlertCommand(t, client, []string{"ack", "ls", "--format", teleport.JSON})
+	require.NoError(t, err)
+
+	jsonOut := mustDecodeJSON[[]types.AlertAcknowledgement](t, buf)
+	require.Len(t, jsonOut, 2)
+
+	buf, err = runAlertCommand(t, client, []string{"ack", "ls", "--format", teleport.YAML})
+	require.NoError(t, err)
+
+	var yamlOut []types.AlertAcknowledgement
+	yamlBuf = mustTranscodeYAMLDocsToJSON(t, buf)
+	yamlOut = mustDecodeJSON[[]types.AlertAcknowledgement](t, bytes.NewReader(yamlBuf))
+	require.Len(t, yamlOut, 2)
+
+	require.Equal(t, jsonOut, yamlOut)
+}
diff --git a/tool/tctl/common/app_command.go b/tool/tctl/common/app_command.go
index a271c93d901bc..3d8c5bcc62a2e 100644
--- a/tool/tctl/common/app_command.go
+++ b/tool/tctl/common/app_command.go
@@ -138,7 +138,7 @@ Fill out and run this command on a node to make the application available:
 > teleport app start \
    --token={{.token}} \{{range .ca_pins}}
    --ca-pin={{.}} \{{end}}
-   --auth-server={{.auth_server}} \
+   --auth-server={{.proxy_server}} \
    --name={{printf "%-30v" .app_name}} ` + "`" + `# Change "{{.app_name}}" to the name of your application.` + "`" + ` \
    --uri={{printf "%-31v" .app_uri}} ` + "`" + `# Change "{{.app_uri}}" to the address of your application.` + "`" + `
 
@@ -147,7 +147,7 @@ Your application will be available at {{.app_public_addr}}.
 Please note:
 
   - This invitation token will expire in {{.minutes}} minutes.
-  - {{.auth_server}} must be reachable from the new application service.
+  - {{.proxy_server}} must be reachable from the new application service.
   - Update DNS to point {{.app_public_addr}} to the Teleport proxy.
   - Add a TLS certificate for {{.app_public_addr}} to the Teleport proxy under "https_keypairs".
 `))
diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go
index 8d67f32d9313c..f56d635aaf4a2 100644
--- a/tool/tctl/common/auth_command.go
+++ b/tool/tctl/common/auth_command.go
@@ -20,6 +20,8 @@ package common
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"io"
 	"log/slog"
@@ -40,6 +42,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
@@ -57,8 +60,6 @@ import (
 
 // authCommandClient is aggregated client interface for auth command.
 type authCommandClient interface {
-	certificateSigner
-	crlGenerator
 	authclient.ClientI
 }
 
@@ -169,8 +170,9 @@ func (a *AuthCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 	a.authLS = auth.Command("ls", "List connected auth servers.")
 	a.authLS.Flag("format", "Output format: 'yaml', 'json' or 'text'").Default(teleport.YAML).StringVar(&a.format)
 
-	a.authCRL = auth.Command("crl", "Export empty certificate revocation list (CRL) for certificate authorities.")
+	a.authCRL = auth.Command("crl", "Export empty certificate revocation list (CRL) for Teleport certificate authorities.")
 	a.authCRL.Flag("type", fmt.Sprintf("Certificate authority type, one of: %s", strings.Join(allowedCRLCertificateTypes, ", "))).Required().EnumVar(&a.caType, allowedCRLCertificateTypes...)
+	a.authCRL.Flag("out", "If set, writes exported revocation lists to files with the given path prefix").StringVar(&a.output)
 }
 
 // TryRun takes the CLI command as an argument (like "auth gen") and executes it
@@ -191,7 +193,7 @@ func (a *AuthCommand) TryRun(ctx context.Context, cmd string, clientFunc commonc
 	case a.authLS.FullCommand():
 		commandFunc = a.ListAuthServers
 	case a.authCRL.FullCommand():
-		commandFunc = a.GenerateCRLForCA
+		commandFunc = a.ExportCRL
 	default:
 		return false, nil
 	}
@@ -284,7 +286,7 @@ func (a *AuthCommand) ExportAuthorities(ctx context.Context, clt authCommandClie
 			if err := os.WriteFile(name, authority.Data, perms); err != nil {
 				return trace.Wrap(err)
 			}
-			fmt.Println(name)
+			fmt.Fprintln(os.Stderr, name)
 		}
 		return nil
 	}
@@ -339,6 +341,10 @@ type certificateSigner interface {
 	GetClusterName(ctx context.Context) (types.ClusterName, error)
 	GetClusterNetworkingConfig(ctx context.Context) (types.ClusterNetworkingConfig, error)
 	GetDatabaseServers(ctx context.Context, namespace string, opts ...services.MarshalOption) ([]types.DatabaseServer, error)
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
 	GetProxies() ([]types.Server, error)
 	GetRemoteClusters(ctx context.Context) ([]types.RemoteCluster, error)
 	TrustClient() trustpb.TrustServiceClient
@@ -472,7 +478,12 @@ func (a *AuthCommand) generateSnowflakeKey(ctx context.Context, clusterAPI certi
 
 // ListAuthServers prints a list of connected auth servers
 func (a *AuthCommand) ListAuthServers(ctx context.Context, clusterAPI authCommandClient) error {
-	servers, err := clusterAPI.GetAuthServers()
+	servers, err := clientutils.CollectWithFallback(
+		ctx,
+		clusterAPI.ListAuthServers,
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		func(context.Context) ([]types.Server, error) { return clusterAPI.GetAuthServers() },
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -493,24 +504,95 @@ func (a *AuthCommand) ListAuthServers(ctx context.Context, clusterAPI authComman
 	return nil
 }
 
-type crlGenerator interface {
-	GenerateCertAuthorityCRL(ctx context.Context, caType types.CertAuthType) ([]byte, error)
-}
-
-// GenerateCRLForCA generates a certificate revocation list for a certificate
-// authority.
-func (a *AuthCommand) GenerateCRLForCA(ctx context.Context, clusterAPI authCommandClient) error {
+// ExportCRL exports an empty certificate revocation list for a
+// Teleport certificate authority.
+func (a *AuthCommand) ExportCRL(ctx context.Context, clusterAPI authCommandClient) error {
 	certType := types.CertAuthType(a.caType)
 	if err := certType.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-
-	crl, err := clusterAPI.GenerateCertAuthorityCRL(ctx, certType)
+	clusterName, err := clusterAPI.GetClusterName(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	authority, err := clusterAPI.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       certType,
+		DomainName: clusterName.GetClusterName(),
+	}, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	tlsKeys := authority.GetActiveKeys().TLS
+	if len(tlsKeys) == 0 {
+		return trace.BadParameter("CA has no active keys")
+	}
+
+	if a.output == "" {
+		if len(tlsKeys) > 1 {
+			return trace.BadParameter("CA has multiple active keys, use --out to export all CRLs")
+		}
+		crl := tlsKeys[0].CRL
+		if len(crl) == 0 {
+			fmt.Fprintf(os.Stderr, "keypair is missing CRL for %v authority %v, generating legacy fallback", authority.GetType(), authority.GetName())
+			crl, err = clusterAPI.GenerateCertAuthorityCRL(ctx, certType)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		fmt.Print(string(crl))
+		return nil
+	}
+
+	// collect the CRLs ahead of time so we can print a message
+	// like we do with tctl auth export
+	type output struct{ cert, crl []byte }
+	var results []output
+	for i, keypair := range tlsKeys {
+		crl := keypair.CRL
+		// DELETE IN v19 (probakowski, zmb3): tctl v19 means the server is either v19 or v20,
+		// both of which are guaranteed to have CRLs already in place.
+		if len(crl) == 0 {
+			// WARNING: GenerateCertAuthorityCRL will find any suitable keypair for signing the CRL,
+			// it is not guaranteed to use _this_ particular keypair.
+			fmt.Fprintf(os.Stderr, "Keypair %v is missing CRL for %v authority %v, generating legacy fallback.",
+				i, authority.GetType(), authority.GetName())
+			if len(tlsKeys) > 1 {
+				fmt.Fprintf(os.Stderr, "If you are using HSM or KMS for private key material, please update your auth server and re-export CRLs.")
+			}
+			crl, err = clusterAPI.GenerateCertAuthorityCRL(ctx, certType)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
+		results = append(results, output{keypair.Cert, crl})
+	}
+
+	fmt.Fprintf(os.Stderr, "Writing %d files with prefix %q\n", len(results), a.output)
+	commands := make([]string, len(results))
+	for i, out := range results {
+		block, _ := pem.Decode(out.cert)
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		cn := winpki.CRLCN(cert.Subject.CommonName, cert.SubjectKeyId)
+		filename := fmt.Sprintf("%s-%v-%v.crl", a.output, certType, cn)
+		if err := os.WriteFile(filename, out.crl, os.FileMode(0644)); err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Fprintln(os.Stderr, filename)
+		commands[i] = fmt.Sprintf("certutil -dspublish %s TeleportDB %s", filename, cn)
+	}
+
+	if certType == types.DatabaseClientCA && len(results) > 1 {
+		fmt.Fprintln(os.Stderr, "\nTo publish CRLs, run the following in Windows:")
+		for _, command := range commands {
+			fmt.Fprintln(os.Stderr, "  "+command)
+		}
+	}
 
-	fmt.Println(string(crl))
 	return nil
 }
 
@@ -1160,7 +1242,10 @@ func (a *AuthCommand) checkProxyAddr(ctx context.Context, clusterAPI certificate
 		return trace.WrapWithMessage(err, "couldn't load cluster network configuration, try setting --proxy manually")
 	}
 	// Fetch proxies known to auth server and try to find a public address.
-	proxies, err := clusterAPI.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, clusterAPI.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return clusterAPI.GetProxies()
+	})
 	if err != nil {
 		return trace.WrapWithMessage(err, "couldn't load registered proxies, try setting --proxy manually")
 	}
diff --git a/tool/tctl/common/auth_command_test.go b/tool/tctl/common/auth_command_test.go
index 9174ed037b5d8..80e5bcb1f6e60 100644
--- a/tool/tctl/common/auth_command_test.go
+++ b/tool/tctl/common/auth_command_test.go
@@ -438,6 +438,10 @@ func (c *mockClient) GetProxies() ([]types.Server, error) {
 	return c.proxies, nil
 }
 
+func (c *mockClient) ListProxyServers(context.Context, int, string) ([]types.Server, string, error) {
+	return c.proxies, "", nil
+}
+
 func (c *mockClient) GetRemoteClusters(ctx context.Context) ([]types.RemoteCluster, error) {
 	return c.remoteClusters, nil
 }
@@ -965,20 +969,34 @@ func TestGenerateAndSignKeys(t *testing.T) {
 	}
 }
 
-func TestGenerateCRLForCA(t *testing.T) {
+func TestExportCRL(t *testing.T) {
 	ctx := context.Background()
+	name, err := types.NewClusterName(types.ClusterNameSpecV2{ClusterName: "name", ClusterID: "clusterID"})
+	require.NoError(t, err)
+	cas := make([]types.CertAuthority, len(allowedCRLCertificateTypes))
+	for i, certificateType := range allowedCRLCertificateTypes {
+		cas[i], err = types.NewCertAuthority(types.CertAuthoritySpecV2{
+			Type:        types.CertAuthType(certificateType),
+			ClusterName: "name",
+			ActiveKeys: types.CAKeySet{
+				TLS: []*types.TLSKeyPair{{
+					CRL:  []byte{},
+					Cert: []byte{1},
+				}}},
+		})
+		require.NoError(t, err)
+	}
+	authClient := &mockClient{crl: []byte{}, clusterName: name, cas: cas}
 
 	for _, caType := range allowedCRLCertificateTypes {
 		t.Run(caType, func(t *testing.T) {
 			ac := AuthCommand{caType: caType}
-			authClient := &mockClient{crl: []byte{}}
-			require.NoError(t, ac.GenerateCRLForCA(ctx, authClient))
+			require.NoError(t, ac.ExportCRL(ctx, authClient))
 		})
 	}
 
 	t.Run("InvalidCAType", func(t *testing.T) {
 		ac := AuthCommand{caType: "wrong-ca"}
-		authClient := &mockClient{crl: []byte{}}
-		require.Error(t, ac.GenerateCRLForCA(ctx, authClient))
+		require.Error(t, ac.ExportCRL(ctx, authClient))
 	})
 }
diff --git a/tool/tctl/common/auth_rotate_command.go b/tool/tctl/common/auth_rotate_command.go
index ccecd5ee5856d..6e6beb459a0ee 100644
--- a/tool/tctl/common/auth_rotate_command.go
+++ b/tool/tctl/common/auth_rotate_command.go
@@ -44,6 +44,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	libmfa "github.com/gravitational/teleport/lib/client/mfa"
@@ -135,7 +136,7 @@ func (c *authRotateCommand) runInteractive(ctx context.Context, client *authclie
 	if err != nil {
 		return trace.Wrap(err, "failed to ping cluster")
 	}
-	m := newRotateModel(client, pingResp, types.CertAuthType(c.caType))
+	m := newRotateModel(ctx, client, pingResp, types.CertAuthType(c.caType))
 	p := tea.NewProgram(m, tea.WithContext(ctx))
 	_, err = p.Run()
 	return trace.Wrap(err)
@@ -159,6 +160,7 @@ var authRotateTheme = authRotateStyle{
 }
 
 type rotateModel struct {
+	ctx      context.Context
 	client   *authclient.Client
 	pingResp proto.PingResponse
 
@@ -178,8 +180,9 @@ type rotateModel struct {
 	help                          help.Model
 }
 
-func newRotateModel(client *authclient.Client, pingResp proto.PingResponse, caType types.CertAuthType) *rotateModel {
+func newRotateModel(ctx context.Context, client *authclient.Client, pingResp proto.PingResponse, caType types.CertAuthType) *rotateModel {
 	m := &rotateModel{
+		ctx:               ctx,
 		client:            client,
 		pingResp:          pingResp,
 		logsModel:         newWriterModel(authRotateTheme.normal),
@@ -248,7 +251,7 @@ func (m *rotateModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	// Now that we've got the current phase, init the waitForCurrentPhaseReady
 	// model if we haven't yet and the current phase is not standby.
 	if m.waitForCurrentPhaseReadyModel == nil && m.currentPhaseModel.phase != "standby" {
-		m.waitForCurrentPhaseReadyModel = newWaitForReadyModel(m.client, m.currentPhaseModel.caID, m.currentPhaseModel.phase)
+		m.waitForCurrentPhaseReadyModel = newWaitForReadyModel(m.ctx, m.client, m.currentPhaseModel.caID, m.currentPhaseModel.phase)
 		cmds = append(cmds, m.waitForCurrentPhaseReadyModel.init())
 	}
 	if m.waitForCurrentPhaseReadyModel != nil {
@@ -277,7 +280,7 @@ func (m *rotateModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			switch msg.String() {
 			case "n", "N":
 				// Go back to the beginning.
-				m = newRotateModel(m.client, m.pingResp, "")
+				m = newRotateModel(m.ctx, m.client, m.pingResp, "")
 				return m, m.Init()
 			case "y", "Y":
 				m.confirmed = true
@@ -303,7 +306,7 @@ func (m *rotateModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	// Now that we've sent the rotate request, init the waitForTargetPhaseReady model if we haven't yet.
 	if m.waitForTargetPhaseReadyModel == nil {
-		m.waitForTargetPhaseReadyModel = newWaitForReadyModel(m.client, m.currentPhaseModel.caID, m.targetPhaseModel.targetPhase)
+		m.waitForTargetPhaseReadyModel = newWaitForReadyModel(m.ctx, m.client, m.currentPhaseModel.caID, m.targetPhaseModel.targetPhase)
 		cmds = append(cmds, m.waitForTargetPhaseReadyModel.init())
 	}
 	cmds = append(cmds, m.waitForTargetPhaseReadyModel.update(msg))
@@ -313,11 +316,11 @@ func (m *rotateModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case tea.KeyMsg:
 		switch {
 		case key.Matches(msg, m.continueBinding):
-			newModel := newRotateModel(m.client, m.pingResp, m.caTypeModel.caType)
+			newModel := newRotateModel(m.ctx, m.client, m.pingResp, m.caTypeModel.caType)
 			newModel.waitForCurrentPhaseReadyModel = m.waitForTargetPhaseReadyModel
 			return newModel, newModel.Init()
 		case key.Matches(msg, m.newBinding):
-			newModel := newRotateModel(m.client, m.pingResp, "")
+			newModel := newRotateModel(m.ctx, m.client, m.pingResp, "")
 			return newModel, newModel.Init()
 		}
 	}
@@ -759,7 +762,7 @@ type waitForReadyModel struct {
 	help               help.Model
 }
 
-func newWaitForReadyModel(client *authclient.Client, caID types.CertAuthID, targetPhase string) *waitForReadyModel {
+func newWaitForReadyModel(ctx context.Context, client *authclient.Client, caID types.CertAuthID, targetPhase string) *waitForReadyModel {
 	m := &waitForReadyModel{
 		client:             client,
 		targetPhase:        targetPhase,
@@ -774,12 +777,31 @@ func newWaitForReadyModel(client *authclient.Client, caID types.CertAuthID, targ
 	}
 	m.kindReadyModels = []*waitForKindReadyModel{
 		newWaitForKindReadyModel(
-			targetPhase, "auth_servers", adaptServerGetter(client.GetAuthServers)).withMinReady(1),
+			targetPhase, "auth_servers", adaptServerGetter(func() ([]types.Server, error) {
+				return clientutils.CollectWithFallback(
+					ctx,
+					client.ListAuthServers,
+					func(context.Context) ([]types.Server, error) {
+						//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+						return client.GetAuthServers()
+					},
+				)
+			}),
+		).withMinReady(1),
 		newWaitForKindReadyModel(
-			targetPhase, "proxies", adaptServerGetter(client.GetProxies)),
+			targetPhase, "proxies", adaptServerGetter(func() ([]types.Server, error) {
+				return clientutils.CollectWithFallback(
+					ctx,
+					client.ListProxyServers,
+					func(context.Context) ([]types.Server, error) {
+						//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+						return client.GetProxies()
+					},
+				)
+			})),
 		newWaitForKindReadyModel(
 			targetPhase, "nodes", adaptServerGetter(func() ([]types.Server, error) {
-				return apiclient.GetAllResources[types.Server](context.TODO(), client, &proto.ListResourcesRequest{
+				return apiclient.GetAllResources[types.Server](ctx, client, &proto.ListResourcesRequest{
 					ResourceType:        types.KindNode,
 					Namespace:           apidefaults.Namespace,
 					PredicateExpression: `resource.sub_kind == ""`,
@@ -787,15 +809,11 @@ func newWaitForReadyModel(client *authclient.Client, caID types.CertAuthID, targ
 			})),
 		newWaitForKindReadyModel(
 			targetPhase, "app_servers", adaptServerGetter(func() ([]types.AppServer, error) {
-				return client.GetApplicationServers(context.TODO(), apidefaults.Namespace)
+				return client.GetApplicationServers(ctx, apidefaults.Namespace)
 			})),
 		newWaitForKindReadyModel(
 			targetPhase, "db_servers", adaptServerGetter(func() ([]types.DatabaseServer, error) {
-				return client.GetDatabaseServers(context.TODO(), apidefaults.Namespace)
-			})),
-		newWaitForKindReadyModel(
-			targetPhase, "kube_servers", adaptServerGetter(func() ([]types.KubeServer, error) {
-				return client.GetKubernetesServers(context.TODO())
+				return client.GetDatabaseServers(ctx, apidefaults.Namespace)
 			})),
 	}
 	return m
diff --git a/tool/tctl/common/autoupdate_command.go b/tool/tctl/common/autoupdate_command.go
index 8403b9828ed21..cf7f612e02a4b 100644
--- a/tool/tctl/common/autoupdate_command.go
+++ b/tool/tctl/common/autoupdate_command.go
@@ -22,7 +22,10 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"maps"
 	"os"
+	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -55,6 +58,7 @@ type AutoUpdateCommand struct {
 	toolsDisableCmd      *kingpin.CmdClause
 	toolsStatusCmd       *kingpin.CmdClause
 	agentsStatusCmd      *kingpin.CmdClause
+	agentsReportCmd      *kingpin.CmdClause
 	agentsStartUpdateCmd *kingpin.CmdClause
 	agentsMarkDoneCmd    *kingpin.CmdClause
 	agentsRollbackCmd    *kingpin.CmdClause
@@ -65,6 +69,10 @@ type AutoUpdateCommand struct {
 	groups             []string
 
 	clear bool
+	force bool
+
+	// used for testing purposes
+	now func() time.Time
 
 	// stdout allows to switch standard output source for resource command. Used in tests.
 	stdout io.Writer
@@ -91,8 +99,10 @@ func (c *AutoUpdateCommand) Initialize(app *kingpin.Application, ccf *tctlcfg.Gl
 
 	agentsCmd := autoUpdateCmd.Command("agents", "Manage agents auto update configuration.")
 	c.agentsStatusCmd = agentsCmd.Command("status", "Prints agents auto update status.")
+	c.agentsReportCmd = agentsCmd.Command("report", "Aggregates the agent autoupdate reports and displays agent count per version and per update group.")
 	c.agentsStartUpdateCmd = agentsCmd.Command("start-update", "Starts updating one or many groups.")
 	c.agentsStartUpdateCmd.Arg("groups", "Groups to start updating.").StringsVar(&c.groups)
+	c.agentsStartUpdateCmd.Flag("force", "Skips progressive deployment mechanism such as canaries or backpressure.").BoolVar(&c.force)
 	c.agentsMarkDoneCmd = agentsCmd.Command("mark-done", "Marks one or many groups as done updating.")
 	c.agentsMarkDoneCmd.Arg("groups", "Groups to mark as done updating.").StringsVar(&c.groups)
 	c.agentsRollbackCmd = agentsCmd.Command("rollback", "Rolls back one or many groups.")
@@ -101,6 +111,10 @@ func (c *AutoUpdateCommand) Initialize(app *kingpin.Application, ccf *tctlcfg.Gl
 	if c.stdout == nil {
 		c.stdout = os.Stdout
 	}
+
+	if c.now == nil {
+		c.now = time.Now
+	}
 }
 
 // TryRun takes the CLI command as an argument and executes it.
@@ -120,6 +134,8 @@ func (c *AutoUpdateCommand) TryRun(ctx context.Context, cmd string, clientFunc c
 		return true, trace.Wrap(err)
 	case cmd == c.agentsStatusCmd.FullCommand():
 		commandFunc = c.agentsStatusCommand
+	case cmd == c.agentsReportCmd.FullCommand():
+		commandFunc = c.agentsReportCommand
 	case cmd == c.agentsStartUpdateCmd.FullCommand():
 		commandFunc = c.agentsStartUpdateCommand
 	case cmd == c.agentsMarkDoneCmd.FullCommand():
@@ -201,6 +217,7 @@ type autoupdateClient interface {
 	TriggerAutoUpdateAgentGroup(ctx context.Context, groups []string, state autoupdatev1pb.AutoUpdateAgentGroupState) (*autoupdatev1pb.AutoUpdateAgentRollout, error)
 	ForceAutoUpdateAgentGroup(ctx context.Context, groups []string) (*autoupdatev1pb.AutoUpdateAgentRollout, error)
 	RollbackAutoUpdateAgentGroup(ctx context.Context, groups []string, allStartedGroups bool) (*autoupdatev1pb.AutoUpdateAgentRollout, error)
+	ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pageToken string) ([]*autoupdatev1pb.AutoUpdateAgentReport, string, error)
 }
 
 func (c *AutoUpdateCommand) agentsStatusCommand(ctx context.Context, client autoupdateClient) error {
@@ -242,18 +259,187 @@ func (c *AutoUpdateCommand) agentsStatusCommand(ctx context.Context, client auto
 	return nil
 }
 
+func (c *AutoUpdateCommand) agentsReportCommand(ctx context.Context, client autoupdateClient) error {
+	now := c.now()
+	reports, err := getAllReports(ctx, client)
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return trace.Wrap(err, "listing reports")
+		}
+
+		fmt.Fprintln(c.stdout, "No autoupdate_agent_report found.")
+		if c.ccf != nil && len(c.ccf.AuthServerAddr) > 0 && !strings.HasSuffix(c.ccf.AuthServerAddr[0], ".teleport.sh") {
+			fmt.Fprintln(c.stdout, "Managed Updates agent reports require enabling Managed Updates v2 by creating the autoupdate_version resource.")
+			fmt.Fprintln(c.stdout, "See: https://goteleport.com/docs/upgrading/agent-managed-updates/#configuring-managed-agent-updates")
+		}
+		return trace.Wrap(err)
+	}
+
+	if len(reports) == 0 {
+		return trace.BadParameter("no reports returned, but the server did not return a NotFoundError, this ia a bug")
+	}
+
+	validReports := filterValidReports(reports, now)
+
+	if len(validReports) == 0 {
+		fmt.Fprintf(c.stdout, "Read %d reports, but they are expired. If you just (re)deployed the Auth service, you might want to retry after 60 seconds.\n", len(reports))
+		return trace.CompareFailed("reports expired")
+	}
+
+	fmt.Fprintf(c.stdout, "%d autoupdate agent reports aggregated\n\n", len(validReports))
+
+	groupSet := make(map[string]struct{})
+	versionsSet := make(map[string]struct{})
+	for _, report := range validReports {
+		for groupName, group := range report.GetSpec().GetGroups() {
+			groupSet[groupName] = struct{}{}
+			for versionName := range group.GetVersions() {
+				versionsSet[versionName] = struct{}{}
+			}
+		}
+	}
+
+	groupNames := slices.Collect(maps.Keys(groupSet))
+	versionNames := slices.Collect(maps.Keys(versionsSet))
+	slices.Sort(groupNames)
+	slices.Sort(versionNames)
+
+	if len(groupNames) == 0 || len(versionNames) == 0 {
+		fmt.Fprintln(c.stdout, "Reports contain no agents.")
+	} else {
+		t := asciitable.MakeTable(append([]string{"Agent Version"}, groupNames...))
+		for _, versionName := range versionNames {
+			row := make([]string, len(groupNames)+1)
+			row[0] = versionName
+			for j, groupName := range groupNames {
+				var count int
+				for _, report := range validReports {
+					count += int(report.GetSpec().GetGroups()[groupName].GetVersions()[versionName].GetCount())
+				}
+				row[j+1] = strconv.Itoa(count)
+			}
+			t.AddRow(row)
+		}
+
+		_, err = t.AsBuffer().WriteTo(c.stdout)
+	}
+
+	fmt.Fprint(c.stdout, c.omittedSummary(validReports))
+
+	return trace.Wrap(err)
+}
+
+func filterValidReports(reports []*autoupdatev1pb.AutoUpdateAgentReport, now time.Time) []*autoupdatev1pb.AutoUpdateAgentReport {
+	var validReports []*autoupdatev1pb.AutoUpdateAgentReport
+	for _, report := range reports {
+		if now.Sub(report.GetSpec().GetTimestamp().AsTime()) <= time.Minute {
+			validReports = append(validReports, report)
+		}
+	}
+	return validReports
+}
+
+func (c *AutoUpdateCommand) omittedSummary(reports []*autoupdatev1pb.AutoUpdateAgentReport) string {
+	aggregated := make(map[string]int)
+	var totalOmitted int
+	for _, report := range reports {
+		for _, omitted := range report.GetSpec().GetOmitted() {
+			totalOmitted += int(omitted.GetCount())
+			aggregated[omitted.GetReason()] += int(omitted.GetCount())
+		}
+	}
+
+	if totalOmitted == 0 {
+		return ""
+	}
+
+	var sb strings.Builder
+	sb.WriteRune('\n')
+	sb.WriteString(fmt.Sprintf("%d agents were omitted from the reports:\n", totalOmitted))
+	// We sort reasons alphabetically as this ensures the output is consistent
+	// And makes snapshot testing easier.
+	for _, reason := range slices.Sorted(maps.Keys(aggregated)) {
+		sb.WriteString(fmt.Sprintf("- %d omitted because: %s\n", aggregated[reason], reason))
+	}
+	return sb.String()
+}
+
+func getAllReports(ctx context.Context, client autoupdateClient) ([]*autoupdatev1pb.AutoUpdateAgentReport, error) {
+	const pageSize = 50
+	var pageToken string
+	var reports []*autoupdatev1pb.AutoUpdateAgentReport
+	for {
+		page, nextToken, err := client.ListAutoUpdateAgentReports(ctx, pageSize, pageToken)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		reports = append(reports, page...)
+		if nextToken == "" {
+			return reports, nil
+		}
+		pageToken = nextToken
+	}
+}
+
+func rolloutHasAgentCounters(rollout *autoupdatev1pb.AutoUpdateAgentRollout) bool {
+	for _, group := range rollout.GetStatus().GetGroups() {
+		if group.PresentCount != 0 {
+			return true
+		}
+	}
+	return false
+}
+
 func rolloutGroupTable(rollout *autoupdatev1pb.AutoUpdateAgentRollout, writer io.Writer) {
-	if groups := rollout.GetStatus().GetGroups(); len(groups) > 0 {
+	groups := rollout.GetStatus().GetGroups()
+	switch {
+	case len(groups) != 0 && rolloutHasAgentCounters(rollout):
+		headers := []string{"Group Name", "State", "Start Time", "State Reason", "Agent Count", "Up-to-date"}
+		table := asciitable.MakeTable(headers)
+		for i, group := range groups {
+			groupName := group.GetName()
+			groupCount := group.PresentCount
+			groupUpToDate := group.UpToDateCount
+			if i == len(groups)-1 {
+				groupName = groupName + " (catch-all)"
+			}
+			state := userFriendlyState(group.GetState())
+
+			// If this is the canary state, we annotate the group state with the canary progress
+			if group.GetState() == autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY {
+				successCount := 0
+				for _, canary := range group.Canaries {
+					if canary.Success {
+						successCount++
+					}
+				}
+				state = fmt.Sprintf("%s (%d/%d)", state, successCount, group.CanaryCount)
+			}
+
+			table.AddRow([]string{
+				groupName,
+				state,
+				formatTimeIfNotEmpty(group.GetStartTime().AsTime(), time.DateTime),
+				group.GetLastUpdateReason(),
+				strconv.FormatUint(groupCount, 10),
+				strconv.FormatUint(groupUpToDate, 10),
+			})
+		}
+		writer.Write(table.AsBuffer().Bytes())
+
+	case len(groups) != 0:
 		headers := []string{"Group Name", "State", "Start Time", "State Reason"}
 		table := asciitable.MakeTable(headers)
 		for _, group := range groups {
+			groupName := group.GetName()
 			table.AddRow([]string{
-				group.GetName(),
+				groupName,
 				userFriendlyState(group.GetState()),
 				formatTimeIfNotEmpty(group.GetStartTime().AsTime(), time.DateTime),
 				group.GetLastUpdateReason()})
 		}
 		writer.Write(table.AsBuffer().Bytes())
+	default:
 	}
 }
 
@@ -269,7 +455,11 @@ func (c *AutoUpdateCommand) agentsStartUpdateCommand(ctx context.Context, client
 		return trace.BadParameter("no groups specified")
 	}
 
-	rollout, err := client.TriggerAutoUpdateAgentGroup(ctx, groups, autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED)
+	state := autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED
+	if c.force {
+		state = autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE
+	}
+	rollout, err := client.TriggerAutoUpdateAgentGroup(ctx, groups, state)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -295,9 +485,9 @@ func (c *AutoUpdateCommand) agentsMarkDoneCommand(ctx context.Context, client au
 	}
 
 	if len(c.groups) == 0 {
-		fmt.Fprintln(c.stdout, "Successfully rolledback every started agent group.")
+		fmt.Fprintln(c.stdout, "Successfully marked every started agent group as completed.")
 	} else {
-		fmt.Fprintf(c.stdout, "Successfully rolledback agents groups: %v.\n", groups)
+		fmt.Fprintf(c.stdout, "Successfully marked agent groups as completed: %v.\n", groups)
 	}
 
 	fmt.Fprint(c.stdout, "New agent rollout status:\n\n")
@@ -350,6 +540,8 @@ func userFriendlyState[T autoupdatev1pb.AutoUpdateAgentGroupState | autoupdatev1
 		return "Done"
 	case 4:
 		return "Rolledback"
+	case 5:
+		return "Canary"
 	default:
 		// If we don't know anything about this state, we display its integer
 		return fmt.Sprintf("Unknown state (%d)", state)
diff --git a/tool/tctl/common/autoupdate_command_test.go b/tool/tctl/common/autoupdate_command_test.go
index b5be5fbf30422..0d4d2ad74c37e 100644
--- a/tool/tctl/common/autoupdate_command_test.go
+++ b/tool/tctl/common/autoupdate_command_test.go
@@ -24,6 +24,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -33,10 +34,12 @@ import (
 
 	"github.com/gravitational/teleport/api/breaker"
 	autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types/autoupdate"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
@@ -45,12 +48,19 @@ import (
 // enabling/disabling auto update, setting the target version and retrieve it.
 func TestClientToolsAutoUpdateCommands(t *testing.T) {
 	ctx := context.Background()
-	log := utils.NewSlogLoggerForTests()
-	process := testenv.MakeTestServer(t, testenv.WithLogger(log))
-	authClient := testenv.MakeDefaultAuthClient(t, process)
+	log := logtest.NewLogger()
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	authClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = authClient.Close() })
 
 	// Check that AutoUpdateConfig and AutoUpdateVersion are not created.
-	_, err := authClient.GetAutoUpdateConfig(ctx)
+	_, err = authClient.GetAutoUpdateConfig(ctx)
 	require.True(t, trace.IsNotFound(err))
 	_, err = authClient.GetAutoUpdateVersion(ctx)
 	require.True(t, trace.IsNotFound(err))
@@ -123,18 +133,24 @@ func runAutoUpdateCommand(t *testing.T, client *authclient.Client, args []string
 	return &stdoutBuff, err
 }
 
-type mockRolloutClient struct {
+type mockAutoUpdateClient struct {
 	authclient.Client
 	mock.Mock
 }
 
-func (m *mockRolloutClient) GetAutoUpdateAgentRollout(_ context.Context) (*autoupdatepb.AutoUpdateAgentRollout, error) {
+func (m *mockAutoUpdateClient) GetAutoUpdateAgentRollout(_ context.Context) (*autoupdatepb.AutoUpdateAgentRollout, error) {
 	args := m.Called()
 	return args.Get(0).(*autoupdatepb.AutoUpdateAgentRollout), args.Error(1)
 }
 
+func (m *mockAutoUpdateClient) ListAutoUpdateAgentReports(_ context.Context, pageSize int, nextKey string) ([]*autoupdatepb.AutoUpdateAgentReport, string, error) {
+	args := m.Called()
+	return args.Get(0).([]*autoupdatepb.AutoUpdateAgentReport), "", args.Error(1)
+}
+
 func TestAutoUpdateAgentStatusCommand(t *testing.T) {
 	ctx := context.Background()
+	now := time.Now()
 
 	tests := []struct {
 		name           string
@@ -278,6 +294,149 @@ Group Name State     Start Time          State Reason
 dev        Done      2025-01-15 12:00:00 outside_window 
 stage      Active    2025-01-15 14:00:00 in_window      
 prod       Unstarted                     outside_window 
+`,
+		},
+		{
+			name: "rollout regular schedule halt-on-error with progress",
+			fixture: &autoupdatepb.AutoUpdateAgentRollout{
+				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+				},
+				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:             "dev",
+							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
+							LastUpdateTime:   nil,
+							LastUpdateReason: "outside_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  8,
+							PresentCount:     1023,
+							UpToDateCount:    567,
+							InitialCount:     1012,
+						},
+						{
+							Name:             "stage",
+							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
+							LastUpdateReason: "in_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  14,
+						},
+						{
+							Name:             "prod",
+							StartTime:        nil,
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							LastUpdateReason: "outside_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  18,
+							PresentCount:     789,
+						},
+					},
+					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
+					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
+					TimeOverride: nil,
+				},
+			},
+			expectedOutput: `Agent autoupdate mode: enabled
+Rollout creation date: 2025-01-15 02:00:00
+Start version: 1.2.3
+Target version: 1.2.4
+Rollout state: Active
+Strategy: halt-on-error
+
+Group Name       State     Start Time          State Reason   Agent Count Up-to-date 
+---------------- --------- ------------------- -------------- ----------- ---------- 
+dev              Done      2025-01-15 12:00:00 outside_window 1023        567        
+stage            Active    2025-01-15 14:00:00 in_window      0           0          
+prod (catch-all) Unstarted                     outside_window 789         0          
+`,
+		},
+		{
+			name: "rollout regular schedule halt-on-error with progress, with canary",
+			fixture: &autoupdatepb.AutoUpdateAgentRollout{
+				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					StartVersion:   "1.2.3",
+					TargetVersion:  "1.2.4",
+					Schedule:       autoupdate.AgentsScheduleRegular,
+					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
+					Strategy:       autoupdate.AgentsStrategyHaltOnError,
+				},
+				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+						{
+							Name:             "dev",
+							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
+							LastUpdateTime:   nil,
+							LastUpdateReason: "outside_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  8,
+							PresentCount:     1023,
+							UpToDateCount:    567,
+							InitialCount:     1012,
+						},
+						{
+							Name:             "stage",
+							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
+							LastUpdateReason: "in_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  14,
+							CanaryCount:      5,
+							Canaries: []*autoupdatepb.Canary{
+								{
+									UpdaterId: uuid.NewString(),
+									HostId:    uuid.NewString(),
+									Hostname:  "host-1",
+									Success:   true,
+								},
+								{
+									UpdaterId: uuid.NewString(),
+									HostId:    uuid.NewString(),
+									Hostname:  "host-2",
+									Success:   false,
+								},
+								{
+									UpdaterId: uuid.NewString(),
+									HostId:    uuid.NewString(),
+									Hostname:  "host-3",
+									Success:   true,
+								},
+							},
+						},
+						{
+							Name:             "prod",
+							StartTime:        nil,
+							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
+							LastUpdateReason: "outside_window",
+							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
+							ConfigStartHour:  18,
+							PresentCount:     789,
+						},
+					},
+					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
+					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
+					TimeOverride: nil,
+				},
+			},
+			expectedOutput: `Agent autoupdate mode: enabled
+Rollout creation date: 2025-01-15 02:00:00
+Start version: 1.2.3
+Target version: 1.2.4
+Rollout state: Active
+Strategy: halt-on-error
+
+Group Name       State        Start Time          State Reason   Agent Count Up-to-date 
+---------------- ------------ ------------------- -------------- ----------- ---------- 
+dev              Done         2025-01-15 12:00:00 outside_window 1023        567        
+stage            Canary (2/5) 2025-01-15 14:00:00 in_window      0           0          
+prod (catch-all) Unstarted                        outside_window 789         0          
 `,
 		},
 	}
@@ -285,12 +444,12 @@ prod       Unstarted                     outside_window
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			// Test setup: create mock client and load fixtures.
-			clt := &mockRolloutClient{}
+			clt := &mockAutoUpdateClient{}
 			clt.On("GetAutoUpdateAgentRollout", mock.Anything).Return(tt.fixture, tt.fixtureErr).Once()
 
 			// Test execution: run command.
 			output := &bytes.Buffer{}
-			cmd := AutoUpdateCommand{stdout: output}
+			cmd := AutoUpdateCommand{stdout: output, now: func() time.Time { return now }}
 			err := cmd.agentsStatusCommand(ctx, clt)
 			require.NoError(t, err)
 
@@ -303,3 +462,194 @@ prod       Unstarted                     outside_window
 	}
 
 }
+
+func TestAutoUpdateAgentReportCommand(t *testing.T) {
+	ctx := context.Background()
+	now := time.Now()
+	fewSecondsAgo := now.Add(-5 * time.Second)
+	fewMinutesAgo := now.Add(-5 * time.Minute)
+
+	tests := []struct {
+		name           string
+		fixtures       []*autoupdatepb.AutoUpdateAgentReport
+		fixturesErr    error
+		expectedOutput string
+		expectErr      require.ErrorAssertionFunc
+	}{
+		{
+			name:           "no agent report",
+			fixtures:       nil,
+			fixturesErr:    trace.NotFound("no agent report"),
+			expectedOutput: "No autoupdate_agent_report found.\n",
+			expectErr:      require.Error,
+		},
+		{
+			name: "only expired agent reports",
+			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
+				{
+					Metadata: &headerv1.Metadata{Name: "auth1"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewMinutesAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 123},
+									"1.2.4": {Count: 234},
+								},
+							},
+						},
+					},
+				},
+				{
+					Metadata: &headerv1.Metadata{Name: "auth2"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewMinutesAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 456},
+									"1.2.4": {Count: 567},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedOutput: "Read 2 reports, but they are expired. If you just (re)deployed the Auth service, you might want to retry after 60 seconds.\n",
+			expectErr:      require.Error,
+		},
+		{
+			name: "valid reports",
+			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
+				{
+					Metadata: &headerv1.Metadata{Name: "auth1"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewSecondsAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 123},
+									"1.2.4": {Count: 234},
+								},
+							},
+							"stage": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 123},
+								},
+							},
+						},
+					},
+				},
+				{
+					Metadata: &headerv1.Metadata{Name: "auth2"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewSecondsAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 456},
+									"1.2.4": {Count: 567},
+								},
+							},
+							"prod": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 789},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectErr: require.NoError,
+			expectedOutput: `2 autoupdate agent reports aggregated
+
+Agent Version dev  prod stage 
+------------- ---  ---- ----- 
+1.2.3         579  789  123   
+1.2.4         801  0    0     
+`,
+		},
+		{
+			name: "valid reports with omissions",
+			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
+				{
+					Metadata: &headerv1.Metadata{Name: "auth1"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewSecondsAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 123},
+									"1.2.4": {Count: 234},
+								},
+							},
+							"stage": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 123},
+								},
+							},
+						},
+						Omitted: []*autoupdatepb.AutoUpdateAgentReportSpecOmitted{
+							{Reason: "agent is too old", Count: 2},
+						},
+					},
+				},
+				{
+					Metadata: &headerv1.Metadata{Name: "auth2"},
+					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+						Timestamp: timestamppb.New(fewSecondsAgo),
+						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
+							"dev": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 456},
+									"1.2.4": {Count: 567},
+								},
+							},
+							"prod": {
+								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
+									"1.2.3": {Count: 789},
+								},
+							},
+						},
+						Omitted: []*autoupdatepb.AutoUpdateAgentReportSpecOmitted{
+							{Reason: "updater is disabled", Count: 5},
+						},
+					},
+				},
+			},
+			expectErr: require.NoError,
+			expectedOutput: `2 autoupdate agent reports aggregated
+
+Agent Version dev  prod stage 
+------------- ---  ---- ----- 
+1.2.3         579  789  123   
+1.2.4         801  0    0     
+
+7 agents were omitted from the reports:
+- 2 omitted because: agent is too old
+- 5 omitted because: updater is disabled
+`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test setup: create mock client and load fixtures.
+			clt := &mockAutoUpdateClient{}
+			clt.On("ListAutoUpdateAgentReports", mock.Anything, mock.Anything, mock.Anything).Return(tt.fixtures, tt.fixturesErr).Once()
+
+			// Test execution: run command.
+			output := &bytes.Buffer{}
+			cmd := AutoUpdateCommand{stdout: output, now: func() time.Time { return now }}
+			err := cmd.agentsReportCommand(ctx, clt)
+			tt.expectErr(t, err)
+
+			// Test validation: check the command output.
+			require.Equal(t, tt.expectedOutput, output.String())
+
+			// Test validation: check that the mock received the expected calls.
+			clt.AssertExpectations(t)
+		})
+	}
+
+}
diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go
index 12cc6f8888739..c5a08a9443427 100644
--- a/tool/tctl/common/bots_command.go
+++ b/tool/tctl/common/bots_command.go
@@ -28,26 +28,31 @@ import (
 	"log/slog"
 	"maps"
 	"os"
+	"path/filepath"
+	"slices"
 	"strings"
 	"text/template"
 	"time"
 
 	"github.com/alecthomas/kingpin/v2"
+	"github.com/fatih/color"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/fieldmaskpb"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/asciitable"
-	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
@@ -72,6 +77,12 @@ type BotsCommand struct {
 	addLogins     string
 	setLogins     string
 
+	search string
+	query  string
+
+	sortIndex string
+	sortOrder string
+
 	botsList          *kingpin.CmdClause
 	botsAdd           *kingpin.CmdClause
 	botsRemove        *kingpin.CmdClause
@@ -125,6 +136,11 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 
 	c.botsInstancesList = c.botsInstances.Command("list", "List bot instances.").Alias("ls")
 	c.botsInstancesList.Arg("name", "The name of the bot from which to list instances. If unset, lists instances from all bots.").StringVar(&c.botName)
+	c.botsInstancesList.Flag("format", "Output format, 'text' or 'json'").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
+	c.botsInstancesList.Flag("search", "Fuzzy search query used to filter bot instances").StringVar(&c.search)
+	c.botsInstancesList.Flag("query", "An expression in the Teleport predicate language used to filter bot instances").StringVar(&c.query)
+	c.botsInstancesList.Flag("sort-index", "Request sort index, 'bot_name', 'active_at_latest', 'version_latest' or 'host_name_latest'").Default("bot_name").StringVar(&c.sortIndex)
+	c.botsInstancesList.Flag("sort-order", "Request sort order, 'ascending' or 'descending'").Default("ascending").StringVar(&c.sortOrder)
 
 	c.botsInstancesAdd = c.botsInstances.Command("add", "Join a new instance onto an existing bot.").Alias("join")
 	c.botsInstancesAdd.Arg("name", "The name of the existing bot for which to add a new instance.").Required().StringVar(&c.botName)
@@ -137,8 +153,8 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 }
 
 // TryRun attempts to run subcommands.
-func (c *BotsCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
-	var commandFunc func(ctx context.Context, client *authclient.Client) error
+func (c *BotsCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (bool, error) {
+	var commandFunc func(ctx context.Context, client botsCommandClient) error
 	switch cmd {
 	case c.botsList.FullCommand():
 		commandFunc = c.ListBots
@@ -169,9 +185,26 @@ func (c *BotsCommand) TryRun(ctx context.Context, cmd string, clientFunc commonc
 	return true, trace.Wrap(err)
 }
 
+type botsCommandClient interface {
+	BotServiceClient() machineidv1pb.BotServiceClient
+	BotInstanceServiceClient() machineidv1pb.BotInstanceServiceClient
+
+	GetToken(ctx context.Context, name string) (types.ProvisionToken, error)
+	UpsertToken(ctx context.Context, token types.ProvisionToken) error
+	GetUser(ctx context.Context, name string, withSecrets bool) (types.User, error)
+	GetRole(context.Context, string) (types.Role, error)
+	UpsertLock(ctx context.Context, lock types.Lock) error
+	// Deprecated: Prefer paginated variant [ListProxyServers].
+	//
+	// TODO(kiosion): DELETE IN 21.0.0
+	GetProxies() ([]types.Server, error)
+	ListProxyServers(ctx context.Context, pageSize int, pageToken string) ([]types.Server, string, error)
+	PerformMFACeremony(ctx context.Context, in *proto.CreateAuthenticateChallengeRequest, promptOpts ...mfa.PromptOpt) (*proto.MFAAuthenticateResponse, error)
+}
+
 // ListBots writes a listing of the cluster's certificate renewal bots
 // to standard out.
-func (c *BotsCommand) ListBots(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) ListBots(ctx context.Context, client botsCommandClient) error {
 	var bots []*machineidv1pb.Bot
 	req := &machineidv1pb.ListBotsRequest{}
 	for {
@@ -200,7 +233,8 @@ func (c *BotsCommand) ListBots(ctx context.Context, client *authclient.Client) e
 		}
 		fmt.Fprintln(c.stdout, t.AsBuffer().String())
 
-		fmt.Fprintf(c.stdout, "\nTo view active instances of a bot, run:\n\n> %s bots instances list [name]\n", os.Args[0])
+		executableFileName := filepath.Base(os.Args[0])
+		fmt.Fprintf(c.stdout, "\nTo view active instances of a bot, run:\n\n> %s bots instances list [name]\n", executableFileName)
 	} else {
 		err := utils.WriteJSONArray(c.stdout, bots)
 		if err != nil {
@@ -253,7 +287,7 @@ Please note:
 `))
 
 // AddBot adds a new certificate renewal bot to the cluster.
-func (c *BotsCommand) AddBot(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) AddBot(ctx context.Context, client botsCommandClient) error {
 	// Prompt for admin action MFA if required, allowing reuse for UpsertToken and CreateBot.
 	mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, client.PerformMFACeremony, true /*allowReuse*/)
 	if err == nil {
@@ -339,10 +373,10 @@ func (c *BotsCommand) AddBot(ctx context.Context, client *authclient.Client) err
 		return trace.Wrap(err)
 	}
 
-	return trace.Wrap(outputToken(c.stdout, c.format, client, bot, token))
+	return trace.Wrap(outputToken(ctx, c.stdout, c.format, client, bot, token))
 }
 
-func (c *BotsCommand) RemoveBot(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) RemoveBot(ctx context.Context, client botsCommandClient) error {
 	_, err := client.BotServiceClient().DeleteBot(ctx, &machineidv1pb.DeleteBotRequest{
 		BotName: c.botName,
 	})
@@ -355,7 +389,7 @@ func (c *BotsCommand) RemoveBot(ctx context.Context, client *authclient.Client)
 	return nil
 }
 
-func (c *BotsCommand) LockBot(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) LockBot(ctx context.Context, client botsCommandClient) error {
 	lockExpiry, err := computeLockExpiry(c.lockExpires, c.lockTTL)
 	if err != nil {
 		return trace.Wrap(err)
@@ -457,14 +491,9 @@ func (c *BotsCommand) updateBotLogins(ctx context.Context, bot *machineidv1pb.Bo
 	return trace.Wrap(mask.Append(&machineidv1pb.Bot{}, "spec.traits"))
 }
 
-// clientRoleGetter is a minimal mockable interface for the client API
-type clientRoleGetter interface {
-	GetRole(context.Context, string) (types.Role, error)
-}
-
 // updateBotRoles applies updates from CLI arguments to a bot's roles, updating
 // the field mask as necessary if any updates were made.
-func (c *BotsCommand) updateBotRoles(ctx context.Context, client clientRoleGetter, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask) error {
+func (c *BotsCommand) updateBotRoles(ctx context.Context, client botsCommandClient, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask) error {
 	currentRoles := make(map[string]struct{})
 	for _, role := range bot.Spec.Roles {
 		currentRoles[role] = struct{}{}
@@ -508,7 +537,7 @@ func (c *BotsCommand) updateBotRoles(ctx context.Context, client clientRoleGette
 }
 
 // UpdateBot performs various updates to existing bot users and roles.
-func (c *BotsCommand) UpdateBot(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) UpdateBot(ctx context.Context, client botsCommandClient) error {
 	bot, err := client.BotServiceClient().GetBot(ctx, &machineidv1pb.GetBotRequest{
 		BotName: c.botName,
 	})
@@ -559,25 +588,47 @@ func (c *BotsCommand) UpdateBot(ctx context.Context, client *authclient.Client)
 }
 
 // ListBotInstances lists bot instances, possibly filtering for a specific bot
-func (c *BotsCommand) ListBotInstances(ctx context.Context, client *authclient.Client) error {
-	var instances []*machineidv1pb.BotInstance
-	req := &machineidv1pb.ListBotInstancesRequest{}
-
-	if c.botName != "" {
-		req.FilterBotName = c.botName
+func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandClient) error {
+	pageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
+		resp, err := client.BotInstanceServiceClient().ListBotInstancesV2(ctx, &machineidv1pb.ListBotInstancesV2Request{
+			PageSize:  int32(pageSize),
+			PageToken: pageToken,
+			SortField: c.sortIndex,
+			SortDesc:  c.sortOrder == "descending",
+			Filter: &machineidv1pb.ListBotInstancesV2Request_Filters{
+				BotName:    c.botName,
+				SearchTerm: c.search,
+				Query:      c.query,
+			},
+		})
+		return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
 	}
 
-	for {
-		resp, err := client.BotInstanceServiceClient().ListBotInstances(ctx, req)
-		if err != nil {
-			return trace.Wrap(err)
+	fallbackFunc := func(ctx context.Context) ([]*machineidv1pb.BotInstance, error) {
+		if c.query != "" {
+			return nil, trace.NotImplemented("fallback not supported for requests with a query")
 		}
-
-		instances = append(instances, resp.BotInstances...)
-		if resp.NextPageToken == "" {
-			break
+		fallbackPageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
+			// Needed for backwards compatibility
+			//nolint:staticcheck // SA1019
+			resp, err := client.BotInstanceServiceClient().ListBotInstances(ctx, &machineidv1pb.ListBotInstancesRequest{
+				FilterBotName:    c.botName,
+				PageSize:         int32(pageSize),
+				PageToken:        pageToken,
+				FilterSearchTerm: c.search,
+				Sort: &types.SortBy{
+					Field:  c.sortIndex,
+					IsDesc: c.sortOrder == "descending",
+				},
+			})
+			return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
 		}
-		req.PageToken = resp.NextPageToken
+		return stream.Collect(clientutils.Resources(ctx, fallbackPageFunc))
+	}
+
+	instances, err := clientutils.CollectWithFallback(ctx, pageFunc, fallbackFunc)
+	if err != nil {
+		return trace.Wrap(err)
 	}
 
 	if c.format == teleport.JSON {
@@ -606,15 +657,14 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client *authclient.C
 		return nil
 	}
 
-	t := asciitable.MakeTable([]string{"ID", "Join Method", "Hostname", "Joined", "Last Seen", "Generation"})
+	t := asciitable.MakeTable([]string{"ID", "Join Method", "Version", "Hostname", "Status", "Last Seen"})
 	for _, i := range instances {
 		var (
 			joinMethod string
 			hostname   string
-			generation string
+			version    string
 		)
 
-		joined := i.Status.InitialAuthentication.AuthenticatedAt.AsTime().Format(time.RFC3339)
 		initialJoinMethod := cmp.Or(
 			i.Status.InitialAuthentication.GetJoinAttrs().GetMeta().GetJoinMethod(),
 			i.Status.InitialAuthentication.JoinMethod,
@@ -622,13 +672,9 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client *authclient.C
 
 		lastSeen := i.Status.InitialAuthentication.AuthenticatedAt.AsTime()
 
-		if len(i.Status.LatestAuthentications) == 0 {
-			generation = "n/a"
-		} else {
+		if len(i.Status.LatestAuthentications) > 0 {
 			auth := i.Status.LatestAuthentications[len(i.Status.LatestAuthentications)-1]
 
-			generation = fmt.Sprint(auth.Generation)
-
 			authJM := cmp.Or(
 				auth.GetJoinAttrs().GetMeta().GetJoinMethod(),
 				auth.JoinMethod,
@@ -646,35 +692,43 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client *authclient.C
 		}
 
 		if len(i.Status.LatestHeartbeats) == 0 {
-			hostname = "n/a"
+			hostname = "-"
+			version = "-"
 		} else {
 			hb := i.Status.LatestHeartbeats[len(i.Status.LatestHeartbeats)-1]
 
 			hostname = hb.Hostname
+			version = hb.Version
 
 			if hb.RecordedAt.AsTime().After(lastSeen) {
 				lastSeen = hb.RecordedAt.AsTime()
 			}
 		}
 
+		healthStatus := "-"
+		if hasStatus, status := aggregateServiceHealth(i.GetStatus().GetServiceHealth()); hasStatus {
+			healthStatus = formatStatus(status, false) // Disable color, it messes with the table layout
+		}
+
 		t.AddRow([]string{
 			fmt.Sprintf("%s/%s", i.Spec.BotName, i.Spec.InstanceId), joinMethod,
-			hostname, joined, lastSeen.Format(time.RFC3339), generation,
+			version, hostname, healthStatus, lastSeen.Format(time.RFC3339),
 		})
 	}
 	fmt.Fprintln(c.stdout, t.AsBuffer().String())
 
-	fmt.Fprintf(c.stdout, "\nTo view more information on a particular instance, run:\n\n> %s bots instances show [id]\n", os.Args[0])
+	executableFileName := filepath.Base(os.Args[0])
+	fmt.Fprintf(c.stdout, "\nTo view more information on a particular instance, run:\n\n> %s bots instances show [id]\n", executableFileName)
 
 	if c.botName != "" {
-		fmt.Fprintf(c.stdout, "\nTo onboard a new instance for this bot, run:\n\n> %s bots instances add %s\n", os.Args[0], c.botName)
+		fmt.Fprintf(c.stdout, "\nTo onboard a new instance for this bot, run:\n\n> %s bots instances add %s\n", executableFileName, c.botName)
 	}
 
 	return nil
 }
 
 // AddBotInstance begins onboarding a new instance of an existing bot.
-func (c *BotsCommand) AddBotInstance(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) AddBotInstance(ctx context.Context, client botsCommandClient) error {
 	// A bit of a misnomer but makes the terminology a bit more consistent. This
 	// doesn't directly create a bot instance, but creates token that allows a
 	// bot to join, which creates a new instance.
@@ -708,7 +762,7 @@ func (c *BotsCommand) AddBotInstance(ctx context.Context, client *authclient.Cli
 			return trace.Wrap(err)
 		}
 
-		return trace.Wrap(outputToken(c.stdout, c.format, client, bot, token))
+		return trace.Wrap(outputToken(ctx, c.stdout, c.format, client, bot, token))
 	}
 
 	// There's not much to do in this case, but we can validate the token.
@@ -733,13 +787,14 @@ func (c *BotsCommand) AddBotInstance(ctx context.Context, client *authclient.Cli
 			c.tokenID, token.GetBotName(), c.botName)
 	}
 
-	return trace.Wrap(outputToken(c.stdout, c.format, client, bot, token))
+	return trace.Wrap(outputToken(ctx, c.stdout, c.format, client, bot, token))
 }
 
 var showMessageTemplate = template.Must(template.New("show").Funcs(template.FuncMap{
 	"bold": bold,
-}).Parse(`Bot: {{.instance.Spec.BotName}}
-ID:  {{.instance.Spec.InstanceId}}
+}).Parse(`Bot:    {{.instance.Spec.BotName}}
+ID:     {{.instance.Spec.InstanceId}}
+Status: {{.health_status}}
 
 Initial Authentication: {{.initial_authentication_table}}
 
@@ -747,6 +802,9 @@ Latest Authentication: {{.latest_authentication_table}}
 
 Latest Heartbeat: {{.heartbeat_table}}
 
+Services:
+{{.services_table}}
+
 To view a full, machine-readable record including past heartbeats and
 authentication records, run:
 
@@ -757,7 +815,7 @@ To onboard a new instance for this bot, run:
 > {{.executable}} bots instances add {{.instance.Spec.BotName}}
 `))
 
-func (c *BotsCommand) ShowBotInstance(ctx context.Context, client *authclient.Client) error {
+func (c *BotsCommand) ShowBotInstance(ctx context.Context, client botsCommandClient) error {
 	botName, instanceID, err := parseInstanceID(c.instanceID)
 	if err != nil {
 		return trace.Wrap(err)
@@ -789,12 +847,24 @@ func (c *BotsCommand) ShowBotInstance(ctx context.Context, client *authclient.Cl
 		heartbeatTable = "No heartbeat records."
 	}
 
+	healthStatus := "-"
+	if hasStatus, status := aggregateServiceHealth(instance.GetStatus().GetServiceHealth()); hasStatus {
+		healthStatus = formatStatus(status, true)
+	}
+
+	servicesTable := "  No reported services."
+	if instance.GetStatus().GetServiceHealth() != nil {
+		servicesTable = formatServices(instance.GetStatus().GetServiceHealth())
+	}
+
 	templateData := map[string]interface{}{
 		"executable":                   os.Args[0],
 		"instance":                     instance,
 		"initial_authentication_table": initialAuthenticationTable,
 		"latest_authentication_table":  latestAuthenticationTable,
 		"heartbeat_table":              heartbeatTable,
+		"health_status":                healthStatus,
+		"services_table":               servicesTable,
 	}
 
 	return trace.Wrap(showMessageTemplate.Execute(os.Stdout, templateData))
@@ -810,7 +880,7 @@ type botJSONResponse struct {
 }
 
 // outputToken writes token information to stdout, depending on the token format.
-func outputToken(wr io.Writer, format string, client *authclient.Client, bot *machineidv1pb.Bot, token types.ProvisionToken) error {
+func outputToken(ctx context.Context, wr io.Writer, format string, client botsCommandClient, bot *machineidv1pb.Bot, token types.ProvisionToken) error {
 	if format == teleport.JSON {
 		tokenTTL := time.Duration(0)
 		if exp := token.Expiry(); !exp.IsZero() {
@@ -834,7 +904,10 @@ func outputToken(wr io.Writer, format string, client *authclient.Client, bot *ma
 		return nil
 	}
 
-	proxies, err := client.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return client.GetProxies()
+	})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -908,6 +981,61 @@ func formatBotInstanceHeartbeat(record *machineidv1pb.BotInstanceStatusHeartbeat
 	return "\n" + indentString(table.AsBuffer().String(), "  ")
 }
 
+// formatServices returns a string containing a tabular representation of a
+// bot's services.
+func formatServices(services []*machineidv1pb.BotInstanceServiceHealth) string {
+	all := strings.Builder{}
+
+	sortedServices := slices.SortedFunc(slices.Values(services), func(a, b *machineidv1pb.BotInstanceServiceHealth) int {
+		return cmp.Compare(a.GetService().GetName(), b.GetService().GetName())
+	})
+	for _, service := range sortedServices {
+		all.WriteString("Name:        " + service.GetService().GetName())
+		all.WriteString("\n")
+		all.WriteString("Type:        " + service.GetService().GetType())
+		all.WriteString("\n")
+		all.WriteString("Status:      " + formatStatus(service.GetStatus(), true))
+		all.WriteString("\n")
+
+		if service.GetReason() != "" {
+			all.WriteString("Reason:      " + service.GetReason())
+			all.WriteString("\n")
+		}
+
+		all.WriteString("Reported at: " + service.GetUpdatedAt().AsTime().Format(time.RFC3339))
+		all.WriteString("\n\n")
+	}
+
+	return indentString(all.String(), "  ")
+}
+
+// formatStatus returns an human-readable representation of a service status.
+// Optionally, it can include a colored dot.
+func formatStatus(status machineidv1pb.BotInstanceHealthStatus, useColor bool) string {
+	switch status {
+	case machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY:
+		if useColor {
+			return color.GreenString("\u25CF") + " Healthy"
+		}
+		return "Healthy"
+	case machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY:
+		if useColor {
+			return color.RedString("\u25CF") + " Unhealthy"
+		}
+		return "Unhealthy"
+	case machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING:
+		if useColor {
+			return color.WhiteString("\u25CF") + " Initializing"
+		}
+		return "Initializing"
+	default:
+		if useColor {
+			return color.YellowString("\u25CF") + " Unknown"
+		}
+		return "Unknown"
+	}
+}
+
 // parseInstanceID converts an instance ID string in the form of
 // '[bot name]/[uuid]' to separate bot name and UUID strings.
 func parseInstanceID(s string) (name string, uuid string, err error) {
@@ -934,3 +1062,34 @@ func indentString(s string, indent string) string {
 
 	return buf.String()
 }
+
+// aggregateServiceHealth returns the least healthy status from the list of
+// services provided. Priority; unhealthy, unspecified, initializing, healthy
+func aggregateServiceHealth(services []*machineidv1pb.BotInstanceServiceHealth) (bool, machineidv1pb.BotInstanceHealthStatus) {
+	if len(services) == 0 {
+		return false, 0
+	}
+
+	hasUnhealthy := slices.ContainsFunc(services, func(service *machineidv1pb.BotInstanceServiceHealth) bool {
+		return service.GetStatus() == machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+	})
+	if hasUnhealthy {
+		return true, machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+	}
+
+	hasUnknown := slices.ContainsFunc(services, func(service *machineidv1pb.BotInstanceServiceHealth) bool {
+		return service.GetStatus() == machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED
+	})
+	if hasUnknown {
+		return true, machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED
+	}
+
+	hasInitializing := slices.ContainsFunc(services, func(service *machineidv1pb.BotInstanceServiceHealth) bool {
+		return service.GetStatus() == machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+	})
+	if hasInitializing {
+		return true, machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+	}
+
+	return true, machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+}
diff --git a/tool/tctl/common/bots_command_test.go b/tool/tctl/common/bots_command_test.go
index 96fc965a8bb33..c003223026054 100644
--- a/tool/tctl/common/bots_command_test.go
+++ b/tool/tctl/common/bots_command_test.go
@@ -24,18 +24,29 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/google/uuid"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/fieldmaskpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
@@ -133,6 +144,7 @@ func TestUpdateBotLogins(t *testing.T) {
 
 // mockAPIClient is a minimal API client used for testing
 type mockRoleGetterClient struct {
+	*authclient.Client
 	roles []string
 }
 
@@ -231,7 +243,7 @@ func TestUpdateBotRoles(t *testing.T) {
 				botRoles: tt.set,
 			}
 
-			err = cmd.updateBotRoles(context.TODO(), &mockClient, bot, fieldMask)
+			err = cmd.updateBotRoles(t.Context(), &mockClient, bot, fieldMask)
 			tt.assert(t, bot, fieldMask, err)
 		})
 	}
@@ -252,9 +264,14 @@ func TestAddAndListBotInstancesJSON(t *testing.T) {
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
 	ctx := context.Background()
-	client := testenv.MakeDefaultAuthClient(t, process)
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = client.Close() })
 
-	tokens, err := client.GetTokens(ctx)
+	tokens, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+		return client.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+	}))
 	require.NoError(t, err)
 	require.Empty(t, tokens)
 
@@ -300,3 +317,388 @@ func TestAddAndListBotInstancesJSON(t *testing.T) {
 
 	buf.Reset()
 }
+
+func TestAggregateServiceHealth(t *testing.T) {
+	t.Parallel()
+
+	healthy := machineidv1pb.BotInstanceServiceHealth{
+		Status: machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
+	}
+	unhealthy := machineidv1pb.BotInstanceServiceHealth{
+		Status: machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+	}
+	initializing := machineidv1pb.BotInstanceServiceHealth{
+		Status: machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING,
+	}
+	unknown := machineidv1pb.BotInstanceServiceHealth{
+		Status: machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED,
+	}
+
+	tcs := []struct {
+		name      string
+		services  []*machineidv1pb.BotInstanceServiceHealth
+		hasStatus bool
+		status    machineidv1pb.BotInstanceHealthStatus
+	}{
+		{
+			name:      "nil",
+			services:  nil,
+			hasStatus: false,
+			status:    0,
+		},
+		{
+			name:      "empty",
+			services:  []*machineidv1pb.BotInstanceServiceHealth{},
+			hasStatus: false,
+			status:    0,
+		},
+		{
+			name: "one item - healthy",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&healthy,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
+		},
+		{
+			name: "one item - unhealthy",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&unhealthy,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+		},
+		{
+			name: "one item - initializing",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&initializing,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING,
+		},
+		{
+			name: "one item - unknown",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&unknown,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED,
+		},
+		{
+			name: "multiple items - healthy",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&healthy,
+				&healthy,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
+		},
+		{
+			name: "multiple items - unhealthy",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&unhealthy,
+				&healthy,
+				&initializing,
+				&unknown,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+		},
+		{
+			name: "multiple items - unknown",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&healthy,
+				&initializing,
+				&unknown,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED,
+		},
+		{
+			name: "multiple items - initializing",
+			services: []*machineidv1pb.BotInstanceServiceHealth{
+				&healthy,
+				&initializing,
+			},
+			hasStatus: true,
+			status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING,
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			has, status := aggregateServiceHealth(tc.services)
+			assert.Equal(t, tc.hasStatus, has)
+			assert.Equal(t, tc.status, status)
+		})
+	}
+}
+func TestListBotInstances(t *testing.T) {
+	t.Parallel()
+
+	dynAddr := helpers.NewDynamicServiceAddr(t)
+	fileConfig := &config.FileConfig{
+		Global: config.Global{
+			DataDir: t.TempDir(),
+		},
+		Auth: config.Auth{
+			Service: config.Service{
+				EnabledFlag:   "true",
+				ListenAddress: dynAddr.AuthAddr,
+			},
+		},
+	}
+	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors), withEnableCache(true))
+	ctx := t.Context()
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = client.Close() })
+
+	instance0 := createBotInstance(t, ctx, process)
+	instance1 := createBotInstance(t, ctx, process, func(instance *machineidv1pb.BotInstance) {
+		instance.Status.InitialHeartbeat.Hostname = "test-hostname-3"
+		instance.Status.InitialHeartbeat.Version = "19.0.1"
+	})
+	instance2 := createBotInstance(t, ctx, process, func(instance *machineidv1pb.BotInstance) {
+		instance.Spec.BotName = "test-bot-2"
+		instance.Status.InitialHeartbeat.Hostname = "test-hostname-2"
+		instance.Status.InitialHeartbeat.Version = "18.1.0"
+	})
+
+	// Give the auth cache a chance to catch-up
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		res, _, err := process.GetAuthServer().ListBotInstances(ctx, 0, "", nil)
+		require.NoError(t, err)
+		require.Len(t, res, 3)
+	}, time.Second*10, time.Millisecond*50)
+
+	t.Run("defaults", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout: &buf,
+			format: teleport.JSON,
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 3)
+	})
+
+	t.Run("filter by bot name", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout:  &buf,
+			format:  teleport.JSON,
+			botName: "test-bot-1",
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 2)
+		assertContainsInstance(t, res, instance0.GetSpec().GetInstanceId())
+		assertContainsInstance(t, res, instance1.GetSpec().GetInstanceId())
+	})
+
+	t.Run("filter with search", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout: &buf,
+			format: teleport.JSON,
+			search: "test-hostname-2",
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 1)
+		assertContainsInstance(t, res, instance2.GetSpec().GetInstanceId())
+	})
+
+	t.Run("filter with query", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout: &buf,
+			format: teleport.JSON,
+			query:  `status.latest_heartbeat.hostname == "test-hostname-2"`,
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 1)
+		assertContainsInstance(t, res, instance2.GetSpec().GetInstanceId())
+	})
+
+	t.Run("sort by field", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout:    &buf,
+			format:    teleport.JSON,
+			sortIndex: "version_latest",
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 3)
+		assert.Equal(t, "18.1.0", res[0].GetStatus().GetInitialHeartbeat().GetVersion())
+		assert.Equal(t, "19.0.0", res[1].GetStatus().GetInitialHeartbeat().GetVersion())
+		assert.Equal(t, "19.0.1", res[2].GetStatus().GetInitialHeartbeat().GetVersion())
+	})
+
+	t.Run("sort order", func(t *testing.T) {
+		buf := strings.Builder{}
+		cmd := BotsCommand{
+			stdout:    &buf,
+			format:    teleport.JSON,
+			sortIndex: "version_latest",
+			sortOrder: "descending",
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, client))
+
+		res, err := services.UnmarshalProtoResourceArray[*machineidv1pb.BotInstance]([]byte(buf.String()))
+		require.NoError(t, err)
+
+		require.Len(t, res, 3)
+		assert.Equal(t, "19.0.1", res[0].GetStatus().GetInitialHeartbeat().GetVersion())
+		assert.Equal(t, "19.0.0", res[1].GetStatus().GetInitialHeartbeat().GetVersion())
+		assert.Equal(t, "18.1.0", res[2].GetStatus().GetInitialHeartbeat().GetVersion())
+	})
+}
+
+func assertContainsInstance(t *testing.T, res []*machineidv1pb.BotInstance, instanceId string) {
+	assert.True(t, slices.ContainsFunc(res, func(in *machineidv1pb.BotInstance) bool {
+		return in.GetSpec().GetInstanceId() == instanceId
+	}))
+}
+
+func createBotInstance(t *testing.T, ctx context.Context, process *service.TeleportProcess, options ...func(instance *machineidv1pb.BotInstance)) (result *machineidv1pb.BotInstance) {
+	heartbeat := &machineidv1pb.BotInstanceStatusHeartbeat{
+		RecordedAt: timestamppb.New(time.Now()),
+		IsStartup:  true,
+		Version:    "19.0.0",
+		Hostname:   "test-hostname-1",
+		Uptime:     durationpb.New(1 * time.Hour),
+		Os:         "linux",
+	}
+
+	base := &machineidv1pb.BotInstance{
+		Spec: &machineidv1pb.BotInstanceSpec{
+			BotName:    "test-bot-1",
+			InstanceId: uuid.New().String(),
+		},
+		Status: &machineidv1pb.BotInstanceStatus{
+			InitialHeartbeat: heartbeat,
+			LatestHeartbeats: []*machineidv1pb.BotInstanceStatusHeartbeat{
+				heartbeat,
+			},
+		},
+	}
+
+	for _, fn := range options {
+		fn(base)
+	}
+
+	result, err := process.GetAuthServer().CreateBotInstance(ctx, base)
+	require.NoError(t, err)
+
+	return
+}
+
+func TestListBotInstancesFallback(t *testing.T) {
+	t.Parallel()
+
+	dynAddr := helpers.NewDynamicServiceAddr(t)
+	fileConfig := &config.FileConfig{
+		Global: config.Global{
+			DataDir: t.TempDir(),
+		},
+		Auth: config.Auth{
+			Service: config.Service{
+				EnabledFlag:   "true",
+				ListenAddress: dynAddr.AuthAddr,
+			},
+		},
+	}
+	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors), withEnableCache(true))
+	ctx := t.Context()
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+
+	authClient := &mockBotInstanceListerClient{
+		Client: client,
+	}
+
+	t.Run("fallback allowed", func(t *testing.T) {
+		cmd := BotsCommand{
+			stdout: ptr(strings.Builder{}),
+			format: teleport.JSON,
+		}
+
+		require.NoError(t, cmd.ListBotInstances(ctx, authClient))
+	})
+
+	t.Run("fallback not allowed", func(t *testing.T) {
+		cmd := BotsCommand{
+			stdout: ptr(strings.Builder{}),
+			format: teleport.JSON,
+			query:  "foo()", // query is only available in ListBotInstancesV2
+		}
+
+		err := cmd.ListBotInstances(ctx, authClient)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "fallback not supported for requests with a query")
+	})
+}
+
+// mockBotInstanceListerClient is a client which returns NotImplemented for
+// ListBotInstancesV2 to simulate a service running an older version.
+type mockBotInstanceListerClient struct {
+	*authclient.Client
+}
+
+func (c *mockBotInstanceListerClient) BotInstanceServiceClient() machineidv1pb.BotInstanceServiceClient {
+	return &mockBotInstanceListV2ErrorClient{
+		BotInstanceServiceClient: c.Client.BotInstanceServiceClient(),
+		errV1:                    nil,
+		errV2:                    trace.NotImplemented("not implemeted in mock"),
+	}
+}
+
+type mockBotInstanceListV2ErrorClient struct {
+	machineidv1pb.BotInstanceServiceClient
+	errV1 error
+	errV2 error
+}
+
+func (c *mockBotInstanceListV2ErrorClient) ListBotInstances(ctx context.Context, in *machineidv1pb.ListBotInstancesRequest, opts ...grpc.CallOption) (*machineidv1pb.ListBotInstancesResponse, error) {
+	if c.errV1 == nil {
+		// Needed for backwards compatibility
+		//nolint:staticcheck // SA1019
+		return c.BotInstanceServiceClient.ListBotInstances(ctx, in, opts...)
+	}
+	return nil, c.errV2
+}
+
+func (c *mockBotInstanceListV2ErrorClient) ListBotInstancesV2(ctx context.Context, in *machineidv1pb.ListBotInstancesV2Request, opts ...grpc.CallOption) (*machineidv1pb.ListBotInstancesResponse, error) {
+	if c.errV2 == nil {
+		return c.BotInstanceServiceClient.ListBotInstancesV2(ctx, in, opts...)
+	}
+	return nil, c.errV2
+}
+
+func ptr[T any](v T) *T { return &v }
diff --git a/tool/tctl/common/bound_keypair_command.go b/tool/tctl/common/bound_keypair_command.go
new file mode 100644
index 0000000000000..b9c80026b68f7
--- /dev/null
+++ b/tool/tctl/common/bound_keypair_command.go
@@ -0,0 +1,112 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
+	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
+)
+
+type BoundKeypairCommand struct {
+	token string
+
+	requestRotation *kingpin.CmdClause
+}
+
+func (c *BoundKeypairCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
+	cmd := app.Command("bound-keypair", "Manage bound-keypair joining tokens")
+
+	c.requestRotation = cmd.Command("request-rotation", "Request a keypair rotation on the next join attempt.")
+	c.requestRotation.Arg("name", "The name of the token").Required().StringVar(&c.token)
+}
+
+func (c *BoundKeypairCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
+	var commandFunc func(ctx context.Context, client *authclient.Client) error
+
+	switch cmd {
+	case c.requestRotation.FullCommand():
+		commandFunc = c.RequestRotation
+	default:
+		return false, nil
+	}
+
+	client, closeFn, err := clientFunc(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	err = commandFunc(ctx, client)
+	closeFn(ctx)
+
+	return true, trace.Wrap(err)
+}
+
+func (c *BoundKeypairCommand) RequestRotation(ctx context.Context, client *authclient.Client) error {
+	// Perform MFA checks now since we'll otherwise need to prompt twice.
+	if _, err := mfa.MFAResponseFromContext(ctx); err == nil {
+		// Nothing to do.
+	} else {
+		mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, client.PerformMFACeremony, true /*allowReuse*/)
+		if err == nil {
+			ctx = mfa.ContextWithMFAResponse(ctx, mfaResponse)
+		} else if !errors.Is(err, &mfa.ErrMFANotRequired) && !errors.Is(err, &mfa.ErrMFANotSupported) {
+			return trace.Wrap(err)
+		}
+	}
+
+	token, err := client.GetToken(ctx, c.token)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if token.GetJoinMethod() != types.JoinMethodBoundKeypair {
+		return trace.BadParameter(
+			"token %s is of type %s, not %s",
+			c.token, token.GetJoinMethod(), types.JoinMethodBoundKeypair,
+		)
+	}
+
+	v2, ok := token.(*types.ProvisionTokenV2)
+	if !ok {
+		return trace.BadParameter("unsupported token type %T", token)
+	}
+
+	now := time.Now()
+	v2.Spec.BoundKeypair.RotateAfter = &now
+
+	if err := client.UpsertToken(ctx, v2); err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Printf("Token rotation flag has been set, rotation will be required during the next authentication attempt.\n")
+
+	return nil
+}
diff --git a/tool/tctl/common/client/auth.go b/tool/tctl/common/client/auth.go
index 1a5ea200c713b..1d05b8195c438 100644
--- a/tool/tctl/common/client/auth.go
+++ b/tool/tctl/common/client/auth.go
@@ -82,6 +82,7 @@ func GetInitFunc(ccf tctlcfg.GlobalCLIFlags, cfg *servicecfg.Config) InitFunc {
 
 		client, err := authclient.Connect(ctx, clientConfig)
 		if err != nil {
+			slog.WarnContext(ctx, "failed to connect to auth server", "error", err)
 			if utils.IsUntrustedCertErr(err) {
 				err = trace.WrapWithMessage(err, utils.SelfSignedCertsMsg)
 			}
diff --git a/tool/tctl/common/clusterconfig/accessgraphsettings.go b/tool/tctl/common/clusterconfig/accessgraphsettings.go
index 939b8ae23efc0..360e340510308 100644
--- a/tool/tctl/common/clusterconfig/accessgraphsettings.go
+++ b/tool/tctl/common/clusterconfig/accessgraphsettings.go
@@ -100,7 +100,7 @@ func ProtoToResource(set *clusterconfigpb.AccessGraphSettings) (*AccessGraphSett
 		ResourceHeader: types.ResourceHeader{
 			Kind:     set.Kind,
 			Version:  set.Version,
-			Metadata: legacy.FromHeaderMetadata(headerv1.FromMetadataProto(set.Metadata)),
+			Metadata: legacy.FromHeaderMetadata(headerv1.FromMetadataProto(set.GetMetadata())),
 		},
 		Spec: accessGraphSettingsSpec{
 			SecretsScanConfig: conf,
diff --git a/tool/tctl/common/cmds.go b/tool/tctl/common/cmds.go
index 9c28bcb3c832c..4621c87aaddf6 100644
--- a/tool/tctl/common/cmds.go
+++ b/tool/tctl/common/cmds.go
@@ -72,5 +72,7 @@ func Commands() []CLICommand {
 		&AutoUpdateCommand{},
 		&stableunixusers.Command{},
 		&decision.Command{},
+		&BoundKeypairCommand{},
+		&ScopedCommand{},
 	}
 }
diff --git a/tool/tctl/common/collection.go b/tool/tctl/common/collection.go
index 070102c320ddc..44151be446dc0 100644
--- a/tool/tctl/common/collection.go
+++ b/tool/tctl/common/collection.go
@@ -22,6 +22,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"maps"
 	"slices"
 	"sort"
 	"strconv"
@@ -41,6 +42,7 @@ import (
 	healthcheckconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1"
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
@@ -1253,7 +1255,7 @@ type botCollection struct {
 func (c *botCollection) resources() []types.Resource {
 	resources := make([]types.Resource, len(c.bots))
 	for i, b := range c.bots {
-		resources[i] = types.Resource153ToLegacy(b)
+		resources[i] = types.ProtoResource153ToLegacy(b)
 	}
 	return resources
 }
@@ -1634,6 +1636,7 @@ func (p *pluginResourceWrapper) UnmarshalJSON(data []byte) error {
 		settingsOpenAI                    = "openai"
 		settingsOkta                      = "okta"
 		settingsJamf                      = "jamf"
+		settingsIntune                    = "intune"
 		settingsPagerDuty                 = "pager_duty"
 		settingsMattermost                = "mattermost"
 		settingsJira                      = "jira"
@@ -1701,6 +1704,8 @@ func (p *pluginResourceWrapper) UnmarshalJSON(data []byte) error {
 			p.PluginV1.Status.Details = &types.PluginStatusV1_Okta{}
 		case settingsJamf:
 			p.PluginV1.Spec.Settings = &types.PluginSpecV1_Jamf{}
+		case settingsIntune:
+			p.PluginV1.Spec.Settings = &types.PluginSpecV1_Intune{}
 		case settingsPagerDuty:
 			p.PluginV1.Spec.Settings = &types.PluginSpecV1_PagerDuty{}
 		case settingsMattermost:
@@ -2036,6 +2041,54 @@ func (c *autoUpdateAgentRolloutCollection) writeText(w io.Writer, verbose bool)
 	return trace.Wrap(err)
 }
 
+type autoUpdateAgentReportCollection struct {
+	reports []*autoupdatev1pb.AutoUpdateAgentReport
+}
+
+func (c *autoUpdateAgentReportCollection) resources() []types.Resource {
+	resources := make([]types.Resource, len(c.reports))
+	for i, report := range c.reports {
+		resources[i] = types.ProtoResource153ToLegacy(report)
+	}
+	return resources
+}
+
+func (c *autoUpdateAgentReportCollection) writeText(w io.Writer, verbose bool) error {
+	groupSet := make(map[string]any)
+	versionsSet := make(map[string]any)
+	for _, report := range c.reports {
+		for groupName, group := range report.GetSpec().GetGroups() {
+			groupSet[groupName] = struct{}{}
+			for versionName := range group.GetVersions() {
+				versionsSet[versionName] = struct{}{}
+			}
+		}
+	}
+
+	groupNames := slices.Collect(maps.Keys(groupSet))
+	versionNames := slices.Collect(maps.Keys(versionsSet))
+	slices.Sort(groupNames)
+	slices.Sort(versionNames)
+
+	t := asciitable.MakeTable(append([]string{"Auth Server ID", "Agent Version"}, groupNames...))
+	for _, report := range c.reports {
+		for i, versionName := range versionNames {
+			row := make([]string, len(groupNames)+2)
+			if i == 0 {
+				row[0] = report.GetMetadata().GetName()
+			}
+			row[1] = versionName
+			for j, groupName := range groupNames {
+				row[j+2] = strconv.Itoa(int(report.GetSpec().GetGroups()[groupName].GetVersions()[versionName].GetCount()))
+			}
+			t.AddRow(row)
+		}
+		t.AddRow(make([]string, len(versionNames)+2))
+	}
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
 type accessMonitoringRuleCollection struct {
 	items []*accessmonitoringrulesv1pb.AccessMonitoringRule
 }
@@ -2105,3 +2158,91 @@ func (c *healthCheckConfigCollection) writeText(w io.Writer, verbose bool) error
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
+
+type scopedRoleCollection struct {
+	items []*scopedaccessv1.ScopedRole
+}
+
+func (c *scopedRoleCollection) resources() []types.Resource {
+	out := make([]types.Resource, 0, len(c.items))
+	for _, item := range c.items {
+		out = append(out, types.Resource153ToLegacy(item))
+	}
+	return out
+}
+
+func (c *scopedRoleCollection) writeText(w io.Writer, verbose bool) error {
+	headers := []string{"Scope", "Name"}
+	var rows [][]string
+	for _, item := range c.items {
+		rows = append(rows, []string{
+			item.GetScope(),
+			item.GetMetadata().GetName(),
+		})
+	}
+
+	t := asciitable.MakeTable(headers, rows...)
+
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+type scopedRoleAssignmentCollection struct {
+	items []*scopedaccessv1.ScopedRoleAssignment
+}
+
+func (c *scopedRoleAssignmentCollection) resources() []types.Resource {
+	out := make([]types.Resource, 0, len(c.items))
+	for _, item := range c.items {
+		out = append(out, types.Resource153ToLegacy(item))
+	}
+	return out
+}
+
+func (c *scopedRoleAssignmentCollection) writeText(w io.Writer, verbose bool) error {
+	headers := []string{"Scope", "Name", "User", "Assigns"}
+	var rows [][]string
+
+	for _, item := range c.items {
+		var assigns []string
+		for _, subAssignment := range item.GetSpec().GetAssignments() {
+			assigns = append(assigns, fmt.Sprintf("%s -> %s", subAssignment.GetRole(), subAssignment.GetScope()))
+		}
+
+		rows = append(rows, []string{
+			item.GetScope(),
+			item.GetMetadata().GetName(),
+			item.GetSpec().GetUser(),
+			strings.Join(assigns, ", "),
+		})
+	}
+
+	t := asciitable.MakeTable(headers, rows...)
+
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+type autoUpdateBotInstanceReportCollection struct {
+	report *autoupdatev1pb.AutoUpdateBotInstanceReport
+}
+
+func (c *autoUpdateBotInstanceReportCollection) resources() []types.Resource {
+	return []types.Resource{types.ProtoResource153ToLegacy(c.report)}
+}
+
+func (c *autoUpdateBotInstanceReportCollection) writeText(w io.Writer, _ bool) error {
+	t := asciitable.MakeTable([]string{"Update Group", "Version", "Count"})
+	for groupName, groupMetrics := range c.report.GetSpec().GetGroups() {
+		if groupName == "" {
+			groupName = "<no update group>"
+		}
+		for versionName, versionMetrics := range groupMetrics.GetVersions() {
+			t.AddRow([]string{groupName, versionName, strconv.Itoa(int(versionMetrics.Count))})
+		}
+	}
+	t.SortRowsBy([]int{0, 1}, true)
+
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
diff --git a/tool/tctl/common/config/global.go b/tool/tctl/common/config/global.go
index 0b357db8e848b..f63ebc94bf28c 100644
--- a/tool/tctl/common/config/global.go
+++ b/tool/tctl/common/config/global.go
@@ -33,7 +33,6 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -159,9 +158,8 @@ func ApplyConfig(ccf *GlobalCLIFlags, cfg *servicecfg.Config) (*authclient.Confi
 	}
 
 	authConfig := new(authclient.Config)
-	// read the host UUID only in case the identity was not provided,
-	// because it will be used for reading local auth server identity
-	cfg.HostUUID, err = hostid.ReadFile(cfg.DataDir)
+	// read the host UUID file only to test for existence and permission errors.
+	_, err = hostid.ReadFile(cfg.DataDir)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			return nil, trace.Wrap(err, "Could not load Teleport host UUID file at %s. "+
@@ -174,7 +172,7 @@ func ApplyConfig(ccf *GlobalCLIFlags, cfg *servicecfg.Config) (*authclient.Confi
 		}
 		return nil, trace.Wrap(err)
 	}
-	identity, err := storage.ReadLocalIdentity(filepath.Join(cfg.DataDir, teleport.ComponentProcess), state.IdentityID{Role: types.RoleAdmin, HostUUID: cfg.HostUUID})
+	identity, err := storage.ReadLocalIdentityForRole(filepath.Join(cfg.DataDir, teleport.ComponentProcess), types.RoleAdmin)
 	if err != nil {
 		// The "admin" identity is not present? This means the tctl is running
 		// NOT on the auth server
diff --git a/tool/tctl/common/db_command.go b/tool/tctl/common/db_command.go
index d23f2ebe51aa2..3512783fb81c4 100644
--- a/tool/tctl/common/db_command.go
+++ b/tool/tctl/common/db_command.go
@@ -130,7 +130,7 @@ Generate the configuration and start a Teleport agent using it:
 > teleport db configure create \
    --token={{.token}} \{{range .ca_pins}}
    --ca-pin={{.}} \{{end}}
-   --proxy={{.auth_server}} \
+   --proxy={{.proxy_server}} \
    --name={{.db_name}} \
    --protocol={{.db_protocol}} \
    --uri={{.db_uri}} \
diff --git a/tool/tctl/common/desktop_command.go b/tool/tctl/common/desktop_command.go
index 9b3eae8c7958e..99aa18c40d67a 100644
--- a/tool/tctl/common/desktop_command.go
+++ b/tool/tctl/common/desktop_command.go
@@ -27,6 +27,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -86,14 +88,26 @@ func (c *DesktopCommand) TryRun(ctx context.Context, cmd string, clientFunc comm
 
 // ListDesktop prints the list of desktops that have recently sent heartbeats
 // to the cluster.
-func (c *DesktopCommand) ListDesktop(ctx context.Context, client *authclient.Client) error {
-	desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+func (c *DesktopCommand) ListDesktop(ctx context.Context, clt *authclient.Client) error {
+	// The unified resource API is used here because it both supports pagination, removes duplicate
+	// resources and is backward compatible. Consider changing this to use ListWindowsDesktops in the future.
+	resources, err := client.GetAllUnifiedResources(ctx, clt, &proto.ListUnifiedResourcesRequest{
+		Kinds:  []string{types.KindWindowsDesktop},
+		SortBy: types.SortBy{Field: types.ResourceMetadataName},
+	})
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	coll := windowsDesktopCollection{
-		desktops: desktops,
+
+	coll := windowsDesktopCollection{desktops: make([]types.WindowsDesktop, 0, len(resources))}
+	for _, r := range resources {
+		desktop, ok := r.ResourceWithLabels.(*types.WindowsDesktopV3)
+		if !ok {
+			continue
+		}
+		coll.desktops = append(coll.desktops, desktop)
 	}
+
 	switch c.format {
 	case teleport.Text:
 		return trace.Wrap(coll.writeText(os.Stdout, c.verbose))
diff --git a/tool/tctl/common/devices.go b/tool/tctl/common/devices.go
index e2e0dd494290b..f8c1959150759 100644
--- a/tool/tctl/common/devices.go
+++ b/tool/tctl/common/devices.go
@@ -19,9 +19,13 @@
 package common
 
 import (
+	"cmp"
 	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"log/slog"
+	"os"
 	"sort"
 	"time"
 
@@ -30,6 +34,7 @@ import (
 	"github.com/gravitational/trace"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
@@ -38,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/lib/devicetrust"
 	dtnative "github.com/gravitational/teleport/lib/devicetrust/native"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 )
@@ -51,6 +57,9 @@ type DevicesCommand struct {
 	rm     deviceRemoveCommand
 	enroll deviceEnrollCommand
 	lock   deviceLockCommand
+
+	// stdout allows to switch the standard output source. Used in tests.
+	Stdout io.Writer
 }
 
 type osType = string
@@ -72,6 +81,8 @@ var osTypeToEnum = map[osType]devicepb.OSType{
 func (c *DevicesCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, cfg *servicecfg.Config) {
 	devicesCmd := app.Command("devices", "Register and manage trusted devices").Hidden()
 
+	formats := []string{teleport.Text, teleport.JSON, teleport.YAML}
+
 	addCmd := devicesCmd.Command("add", "Register managed devices.")
 	addCmd.Flag("os", "Operating system").
 		EnumVar(&c.add.os, osTypes...)
@@ -83,8 +94,10 @@ func (c *DevicesCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalC
 		BoolVar(&c.add.enroll)
 	addCmd.Flag("enroll-ttl", "Time duration for the enrollment token").
 		DurationVar(&c.add.enrollTTL)
+	addCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.add.format, formats...)
 
-	_ = devicesCmd.Command("ls", "Lists managed devices.")
+	lsCmd := devicesCmd.Command("ls", "Lists managed devices.")
+	lsCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.ls.format, formats...)
 
 	rmCmd := devicesCmd.Command("rm", "Removes a managed device.")
 	rmCmd.Flag("device-id", "Device identifier").StringVar(&c.rm.deviceID)
@@ -107,6 +120,15 @@ func (c *DevicesCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalC
 	lockCmd.Flag("message", "Message to display to locked-out users").StringVar(&c.lock.message)
 	lockCmd.Flag("expires", "Time point (RFC3339) when the lock expires").StringVar(&c.lock.expires)
 	lockCmd.Flag("ttl", "Time duration after which the lock expires").DurationVar(&c.lock.ttl)
+
+	if c.Stdout == nil {
+		c.Stdout = os.Stdout
+	}
+	c.add.stdout = c.Stdout
+	c.rm.stdout = c.Stdout
+	c.ls.stdout = c.Stdout
+	c.enroll.stdout = c.Stdout
+	c.lock.stdout = c.Stdout
 }
 
 // runner is used as a simple interface for subcommands.
@@ -145,6 +167,10 @@ type deviceAddCommand struct {
 	os        string // string from command line, distinct from inherited osType!
 	enroll    bool
 	enrollTTL time.Duration
+
+	format string
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
 }
 
 func (c *deviceAddCommand) Run(ctx context.Context, authClient *authclient.Client) error {
@@ -188,22 +214,35 @@ func (c *deviceAddCommand) Run(ctx context.Context, authClient *authclient.Clien
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf(
-		"Device %v/%v added to the inventory\n",
-		created.AssetTag,
-		devicetrust.FriendlyOSType(created.OsType))
-	printEnrollMessage(created.AssetTag, created.EnrollToken)
+	switch c.format {
+	case teleport.Text:
+		fmt.Fprintf(c.stdout,
+			"Device %v/%v added to the inventory\n",
+			created.AssetTag,
+			devicetrust.FriendlyOSType(created.OsType))
+		printEnrollMessage(created.AssetTag, created.EnrollToken, c.stdout)
+	case teleport.JSON:
+		out, err := json.MarshalIndent(created, "", "  ")
+		if err != nil {
+			return trace.Wrap(err, "failed to marshal added device")
+		}
+		fmt.Fprint(c.stdout, string(out))
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAML(c.stdout, created), "failed to marshal added device")
+	default:
+		return trace.BadParameter("invalid format %q", c.format)
+	}
 
 	return nil
 }
 
-func printEnrollMessage(name string, token *devicepb.DeviceEnrollToken) {
+func printEnrollMessage(name string, token *devicepb.DeviceEnrollToken, stdout io.Writer) {
 	if token.GetToken() == "" {
 		return
 	}
 	expireTime := token.ExpireTime.AsTime()
 
-	fmt.Printf(`The enrollment token: %v
+	fmt.Fprintf(stdout, `The enrollment token: %v
 This token will expire in %v.
 
 Run the command below on device %q to enroll it:
@@ -213,7 +252,11 @@ tsh device enroll --token=%v
 	)
 }
 
-type deviceListCommand struct{}
+type deviceListCommand struct {
+	format string
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
+}
 
 func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Client) error {
 	devices := authClient.DevicesClient()
@@ -237,7 +280,7 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 		req.PageToken = resp.NextPageToken
 	}
 	if len(devs) == 0 {
-		fmt.Println("No devices found")
+		fmt.Fprintln(c.stdout, "No devices found")
 		return nil
 	}
 
@@ -254,24 +297,61 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 	})
 
 	// Print devices.
-	table := asciitable.MakeTable([]string{"Asset Tag", "OS", "Enroll Status", "Device ID"})
-	for _, dev := range devs {
-		table.AddRow([]string{
-			dev.AssetTag,
-			devicetrust.FriendlyOSType(dev.OsType),
-			devicetrust.FriendlyDeviceEnrollStatus(dev.EnrollStatus),
-			dev.Id,
-		})
+	switch c.format {
+	case teleport.Text:
+		table := asciitable.MakeTable([]string{"Asset Tag", "OS", "Source", "Enroll Status", "Owner", "Device ID"})
+		for _, dev := range devs {
+			table.AddRow([]string{
+				dev.AssetTag,
+				devicetrust.FriendlyOSType(dev.OsType),
+				deviceSourceToString(dev.Source),
+				devicetrust.FriendlyDeviceEnrollStatus(dev.EnrollStatus),
+				dev.Owner,
+				dev.Id,
+			})
+		}
+		fmt.Fprintln(c.stdout, table.AsBuffer().String())
+	case teleport.JSON:
+		return trace.Wrap(utils.WriteJSONArray(c.stdout, devs), "failed to marshal devices list")
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAML(c.stdout, devs), "failed to marshal devices list")
+	default:
+		return trace.BadParameter("invalid format %q", c.format)
 	}
-	fmt.Println(table.AsBuffer().String())
 
 	return nil
 }
 
+var (
+	deviceOriginToDefaultName = map[devicepb.DeviceOrigin]string{
+		devicepb.DeviceOrigin_DEVICE_ORIGIN_JAMF:   "jamf",
+		devicepb.DeviceOrigin_DEVICE_ORIGIN_INTUNE: "intune",
+	}
+	deviceOriginToPrettyName = map[devicepb.DeviceOrigin]string{
+		devicepb.DeviceOrigin_DEVICE_ORIGIN_JAMF:   "Jamf",
+		devicepb.DeviceOrigin_DEVICE_ORIGIN_INTUNE: "Intune",
+	}
+)
+
+func deviceSourceToString(source *devicepb.DeviceSource) string {
+	if source == nil {
+		return ""
+	}
+
+	if defaultName, found := deviceOriginToDefaultName[source.Origin]; found && source.Name == defaultName {
+		return cmp.Or(deviceOriginToPrettyName[source.Origin], defaultName)
+	}
+
+	return source.Name
+}
+
 type deviceRemoveCommand struct {
 	canOperateOnCurrentDevice
 
 	deviceID string
+
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
 }
 
 func (c *deviceRemoveCommand) Run(ctx context.Context, authClient *authclient.Client) error {
@@ -303,7 +383,7 @@ func (c *deviceRemoveCommand) Run(ctx context.Context, authClient *authclient.Cl
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("Device %q removed\n", name)
+	fmt.Fprintf(c.stdout, "Device %q removed\n", name)
 	return nil
 }
 
@@ -312,6 +392,9 @@ type deviceEnrollCommand struct {
 
 	deviceID string
 	ttl      time.Duration
+
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
 }
 
 func (c *deviceEnrollCommand) Run(ctx context.Context, authClient *authclient.Client) error {
@@ -349,7 +432,7 @@ func (c *deviceEnrollCommand) Run(ctx context.Context, authClient *authclient.Cl
 		return trace.Wrap(err)
 	}
 
-	printEnrollMessage(name, token)
+	printEnrollMessage(name, token, c.stdout)
 	return nil
 }
 
@@ -360,6 +443,9 @@ type deviceLockCommand struct {
 	message  string
 	expires  string
 	ttl      time.Duration
+
+	// stdout allows to switch the standard output source. Used in tests.
+	stdout io.Writer
 }
 
 func (c *deviceLockCommand) Run(ctx context.Context, authClient *authclient.Client) error {
@@ -371,7 +457,7 @@ func (c *deviceLockCommand) Run(ctx context.Context, authClient *authclient.Clie
 		// Print here, otherwise device information isn't apparent.
 		// In other command modes the user just wrote the ID or asset tag in the
 		// command line.
-		fmt.Printf("Locking device %q.\n", c.assetTag)
+		fmt.Fprintf(c.stdout, "Locking device %q.\n", c.assetTag)
 	}
 
 	switch {
@@ -415,7 +501,7 @@ func (c *deviceLockCommand) Run(ctx context.Context, authClient *authclient.Clie
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("Created a lock with name %q.\n", lock.GetName())
+	fmt.Fprintf(c.stdout, "Created a lock with name %q.\n", lock.GetName())
 	return nil
 }
 
diff --git a/tool/tctl/common/devices_test.go b/tool/tctl/common/devices_test.go
new file mode 100644
index 0000000000000..647f18815d171
--- /dev/null
+++ b/tool/tctl/common/devices_test.go
@@ -0,0 +1,62 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
+)
+
+func TestDeviceSourceToString(t *testing.T) {
+	tests := []struct {
+		name   string
+		source *devicepb.DeviceSource
+		want   string
+	}{
+		{
+			name:   "default name for origin",
+			source: &devicepb.DeviceSource{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_INTUNE, Name: "intune"},
+			want:   "Intune",
+		},
+		{
+			name:   "custom name",
+			source: &devicepb.DeviceSource{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_JAMF, Name: "cool jamf"},
+			want:   "cool jamf",
+		},
+		{
+			name:   "no source",
+			source: nil,
+			want:   "",
+		},
+		{
+			name:   "unsupported origin",
+			source: &devicepb.DeviceSource{Origin: 1337, Name: "even cooler jamf"},
+			// Show the name instead of something like "unknown" as name is required and likely more
+			// informative than displaying "unknown".
+			want: "even cooler jamf",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, deviceSourceToString(tt.source))
+		})
+	}
+}
diff --git a/tool/tctl/common/edit_command.go b/tool/tctl/common/edit_command.go
index 9e68cd8f32032..00eec18de8567 100644
--- a/tool/tctl/common/edit_command.go
+++ b/tool/tctl/common/edit_command.go
@@ -19,12 +19,14 @@
 package common
 
 import (
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"os/exec"
 	"strings"
@@ -120,7 +122,7 @@ func (e *EditCommand) editResource(ctx context.Context, client *authclient.Clien
 	rc := &ResourceCommand{
 		refs:        services.Refs{e.ref},
 		format:      teleport.YAML,
-		stdout:      f,
+		Stdout:      f,
 		filename:    f.Name(),
 		force:       true,
 		withSecrets: true,
@@ -149,11 +151,19 @@ func (e *EditCommand) editResource(ctx context.Context, client *authclient.Clien
 		return trace.Wrap(err)
 	}
 
-	originalName, err := resourceName(f.Name())
+	originalResources, err := editResources(f.Name())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
+	key := func(r services.UnknownResource) string {
+		return fmt.Sprintf("%s/%s", r.Kind, r.GetName())
+	}
+	originalResourcesMap := make(map[string][]byte)
+	for _, r := range originalResources {
+		originalResourcesMap[key(r)] = r.Raw
+	}
+
 	if err := e.runEditor(ctx, f.Name()); err != nil {
 		return trace.Wrap(err)
 	}
@@ -169,46 +179,51 @@ func (e *EditCommand) editResource(ctx context.Context, client *authclient.Clien
 		return nil
 	}
 
-	newName, err := resourceName(f.Name())
+	newResources, err := editResources(f.Name())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	if originalName != newName {
-		return trace.NotImplemented("renaming resources is not supported with tctl edit")
+	if len(newResources) != len(originalResources) {
+		return trace.BadParameter("one or more resources were added or removed, renaming resources is not supported with tctl edit")
 	}
 
-	f, err = utils.OpenFileAllowingUnsafeLinks(rc.filename)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer f.Close()
+	for _, newResource := range newResources {
+		// Ensure the resource name and kind was not changed.
+		origRaw, ok := originalResourcesMap[key(newResource)]
+		if !ok {
+			return trace.BadParameter("resource %s/%s was added or removed, renaming resources is not supported with tctl edit", newResource.Kind, newResource.Metadata.Name)
+		}
 
-	decoder := kyaml.NewYAMLOrJSONDecoder(f, defaults.LookaheadBufSize)
-	var raw services.UnknownResource
-	if err := decoder.Decode(&raw); err != nil {
-		if errors.Is(err, io.EOF) {
-			return trace.BadParameter("no resources found, empty input?")
+		if bytes.Equal(origRaw, newResource.Raw) {
+			// Nothing changed for this resource, continue to the next one.
+			slog.DebugContext(ctx, "Resource was not modified", "resource", key(newResource))
+			continue
 		}
-		return trace.Wrap(err)
-	}
 
-	// Use the UpdateHandler if the resource has one, otherwise fallback to using
-	// the CreateHandler. UpdateHandlers are preferred over CreateHandler because an update
-	// will not forcibly overwrite a resource unlike with create which requires the force
-	// flag to be set to update an existing resource.
-	updator, found := rc.UpdateHandlers[ResourceKind(raw.Kind)]
-	if found {
-		return trace.Wrap(updator(ctx, client, raw))
-	}
+		// Use the UpdateHandler if the resource has one, otherwise fallback to using
+		// the CreateHandler. UpdateHandlers are preferred over CreateHandler because an update
+		// will not forcibly overwrite a resource unlike with create which requires the force
+		// flag to be set to update an existing resource.
+		if updator, found := rc.UpdateHandlers[ResourceKind(newResource.Kind)]; found {
+			if err := updator(ctx, client, newResource); err != nil {
+				return trace.Wrap(err)
+			}
+			continue
+		}
 
-	// TODO(tross) remove the fallback to CreateHandlers once all the resources
-	// have been updated to implement an UpdateHandler.
-	if creator, found := rc.CreateHandlers[ResourceKind(raw.Kind)]; found {
-		return trace.Wrap(creator(ctx, client, raw))
+		// TODO(tross) remove the fallback to CreateHandlers once all the resources
+		// have been updated to implement an UpdateHandler.
+		if creator, found := rc.CreateHandlers[ResourceKind(newResource.Kind)]; found {
+			if err := creator(ctx, client, newResource); err != nil {
+				return trace.Wrap(err)
+			}
+			continue
+		}
+		return trace.BadParameter("updating resources of type %q is not supported", newResource.Kind)
 	}
 
-	return trace.BadParameter("updating resources of type %q is not supported", raw.Kind)
+	return nil
 }
 
 // getTextEditor returns the text editor to be used for editing the resource.
@@ -236,19 +251,26 @@ func checksum(filename string) (string, error) {
 	return hex.EncodeToString(h.Sum(nil)), nil
 }
 
-func resourceName(filename string) (string, error) {
+func editResources(filename string) ([]services.UnknownResource, error) {
 	f, err := utils.OpenFileAllowingUnsafeLinks(filename)
 	if err != nil {
-		return "", trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	defer f.Close()
 
 	decoder := kyaml.NewYAMLOrJSONDecoder(f, defaults.LookaheadBufSize)
 
-	var raw services.UnknownResource
-	if err := decoder.Decode(&raw); err != nil {
-		return "", trace.Wrap(err)
-	}
+	names := make([]services.UnknownResource, 0)
+	for {
+		var raw services.UnknownResource
+		switch err := decoder.Decode(&raw); {
+		case errors.Is(err, io.EOF):
+			return names, nil
+		case err != nil:
+			return nil, trace.Wrap(err)
+		default:
+			names = append(names, raw)
+		}
 
-	return raw.GetName(), nil
+	}
 }
diff --git a/tool/tctl/common/edit_command_test.go b/tool/tctl/common/edit_command_test.go
index 06c9e4c18baa2..8fa9f4a20a89e 100644
--- a/tool/tctl/common/edit_command_test.go
+++ b/tool/tctl/common/edit_command_test.go
@@ -21,6 +21,7 @@ package common
 import (
 	"context"
 	"os"
+	"slices"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -41,15 +42,24 @@ import (
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 func TestEditResources(t *testing.T) {
-	t.Parallel()
-	log := utils.NewSlogLoggerForTests()
-	process := testenv.MakeTestServer(t, testenv.WithLogger(log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
+
+	log := logtest.NewLogger()
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	tests := []struct {
 		kind string
@@ -139,7 +149,6 @@ func testEditGithubConnector(t *testing.T, clt *authclient.Client) {
 
 		collection := &connectorsCollection{github: []types.GithubConnector{expected}}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the connector and validate that the expected field is updated.
@@ -177,7 +186,6 @@ func testEditRole(t *testing.T, clt *authclient.Client) {
 
 		collection := &roleCollection{roles: []types.Role{expected}}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the role and validate that the expected field is updated.
@@ -217,7 +225,6 @@ func testEditUser(t *testing.T, clt *authclient.Client) {
 
 		collection := &userCollection{users: []types.User{expected}}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the user and validate that the expected field is updated.
@@ -255,7 +262,6 @@ func testEditClusterNetworkingConfig(t *testing.T, clt *authclient.Client) {
 
 		collection := &netConfigCollection{netConfig: expected}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the cnc and validate that the expected field is updated.
@@ -294,7 +300,6 @@ func testEditAuthPreference(t *testing.T, clt *authclient.Client) {
 
 		collection := &authPrefCollection{authPref: expected}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the cap and validate that the expected field is updated.
@@ -332,7 +337,6 @@ func testEditSessionRecordingConfig(t *testing.T, clt *authclient.Client) {
 
 		collection := &recConfigCollection{recConfig: expected}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the src and validate that the expected field is updated.
@@ -358,7 +362,7 @@ func testEditSessionRecordingConfig(t *testing.T, clt *authclient.Client) {
 // The tests are grouped to amortize the cost of creating and auth server since
 // that is the most expensive part of testing editing the resource.
 func TestEditEnterpriseResources(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -367,9 +371,16 @@ func TestEditEnterpriseResources(t *testing.T) {
 			},
 		},
 	})
-	log := utils.NewSlogLoggerForTests()
-	process := testenv.MakeTestServer(t, testenv.WithLogger(log))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	log := logtest.NewLogger()
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	tests := []struct {
 		kind string
@@ -423,7 +434,6 @@ func testEditOIDCConnector(t *testing.T, clt *authclient.Client) {
 
 		collection := &connectorsCollection{oidc: []types.OIDCConnector{expected}}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the connector and validate that the expected field is updated.
@@ -492,7 +502,6 @@ func testEditSAMLConnector(t *testing.T, clt *authclient.Client) {
 
 		collection := &connectorsCollection{saml: []types.SAMLConnector{expected}}
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
-
 	}
 
 	// Edit the connector and validate that the expected field is updated.
@@ -676,3 +685,67 @@ func testEditDynamicWindowsDesktop(t *testing.T, clt *authclient.Client) {
 	expected.SetRevision(actual.GetRevision())
 	require.Empty(t, cmp.Diff(expected, actual, protocmp.Transform()))
 }
+
+func TestMultipleRoles(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	log := logtest.NewLogger()
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
+
+	roleNames := []string{"test-role1", "test-role2"}
+	for _, name := range roleNames {
+		expected, err := types.NewRole(name, types.RoleSpecV6{})
+		require.NoError(t, err, "creating initial role resource")
+		_, err = rootClient.CreateRole(ctx, expected.(*types.RoleV6))
+		require.NoError(t, err, "persisting initial role resource")
+	}
+
+	roles, err := rootClient.GetRoles(ctx)
+	require.NoError(t, err)
+
+	editor := func(name string) error {
+		f, err := os.Create(name)
+		if err != nil {
+			return trace.Wrap(err, "opening file to edit")
+		}
+		for _, role := range roles {
+			if !slices.Contains(roleNames, role.GetName()) {
+				continue
+			}
+			role.SetLogins(types.Allow, []string{"abcdef"})
+		}
+
+		collection := &roleCollection{roles: roles}
+		return trace.NewAggregate(writeYAML(collection, f), f.Close())
+	}
+
+	// Edit the role and validate that the expected field is updated.
+	_, err = runEditCommand(t, rootClient, []string{"edit", "roles"},
+		withEditor(editor),
+	)
+	require.NoError(t, err, "expected editing role to succeed")
+
+	for _, role := range roles {
+		actual, err := rootClient.GetRole(ctx, role.GetName())
+		require.NoError(t, err, "retrieving role after edit")
+
+		assert.Equal(t, role.GetLogins(types.Allow), actual.GetLogins(types.Allow), "logins should have been modified by edit")
+		require.Empty(t, cmp.Diff(role, actual, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+
+		switch {
+		case !slices.Contains(roleNames, role.GetName()):
+			require.Equal(t, role.GetRevision(), actual.GetRevision(), "revision should not have been modified by edit")
+		default:
+			require.NotEqual(t, role.GetRevision(), actual.GetRevision(), "revision should have been modified by edit")
+		}
+	}
+}
diff --git a/tool/tctl/common/helpers_test.go b/tool/tctl/common/helpers_test.go
index c99fc932b26d2..780036d688d6b 100644
--- a/tool/tctl/common/helpers_test.go
+++ b/tool/tctl/common/helpers_test.go
@@ -86,7 +86,7 @@ func runCommand(t *testing.T, client *authclient.Client, cmd cliCommand, args []
 func runResourceCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
 	var stdoutBuff bytes.Buffer
 	command := &ResourceCommand{
-		stdout: &stdoutBuff,
+		Stdout: &stdoutBuff,
 	}
 	return &stdoutBuff, runCommand(t, client, command, args)
 }
@@ -113,13 +113,23 @@ func runLockCommand(t *testing.T, client *authclient.Client, args []string) erro
 func runTokensCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
 	var stdoutBuff bytes.Buffer
 	command := &TokensCommand{
-		stdout: &stdoutBuff,
+		Stdout: &stdoutBuff,
 	}
 
 	args = append([]string{"tokens"}, args...)
 	return &stdoutBuff, runCommand(t, client, command, args)
 }
 
+func runScopedCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
+	var stdoutBuff bytes.Buffer
+	command := &ScopedCommand{
+		Stdout: &stdoutBuff,
+	}
+
+	args = append([]string{"scoped"}, args...)
+	return &stdoutBuff, runCommand(t, client, command, args)
+}
+
 func runUserCommand(t *testing.T, client *authclient.Client, args []string) error {
 	command := &UserCommand{}
 	args = append([]string{"users"}, args...)
@@ -148,6 +158,16 @@ func runNotificationsCommand(t *testing.T, client *authclient.Client, args []str
 	return &stdoutBuff, runCommand(t, client, command, args)
 }
 
+func runAlertCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
+	var stdoutBuff bytes.Buffer
+	command := &AlertCommand{
+		stdout: &stdoutBuff,
+	}
+
+	args = append([]string{"alerts"}, args...)
+	return &stdoutBuff, runCommand(t, client, command, args)
+}
+
 func mustDecodeJSON[T any](t *testing.T, r io.Reader) T {
 	var out T
 	err := json.NewDecoder(r).Decode(&out)
@@ -162,6 +182,29 @@ func mustTranscodeYAMLToJSON(t *testing.T, r io.Reader) []byte {
 	return resource.Raw
 }
 
+// mustTranscodeYAMLDocsToJSON safely transcodes YAML docs for unknown resources.
+func mustTranscodeYAMLDocsToJSON(t *testing.T, r io.Reader) []byte {
+	decoder := kyaml.NewYAMLToJSONDecoder(r)
+	var jsonRaw []json.RawMessage
+
+	for {
+		var resource services.UnknownResource
+		if err := decoder.Decode(&resource); err != nil {
+			// Break when there are no more documents to decode
+			if !errors.Is(err, io.EOF) {
+				require.FailNow(t, "error transcoding YAML docs to JSON: %v", err)
+			}
+			break
+		}
+		jsonRaw = append(jsonRaw, resource.Raw)
+	}
+
+	jsonDocs, err := json.Marshal(jsonRaw)
+	require.NoError(t, err)
+
+	return jsonDocs
+}
+
 func mustDecodeYAMLDocuments[T any](t *testing.T, r io.Reader, out *[]T) {
 	t.Helper()
 	decoder := yaml.NewDecoder(r)
@@ -217,6 +260,7 @@ type testServerOptions struct {
 	fileConfig      *config.FileConfig
 	fileDescriptors []*servicecfg.FileDescriptor
 	fakeClock       *clockwork.FakeClock
+	enableCache     bool
 }
 
 type testServerOptionFunc func(options *testServerOptions)
@@ -239,6 +283,12 @@ func withFakeClock(fakeClock *clockwork.FakeClock) testServerOptionFunc {
 	}
 }
 
+func withEnableCache(enableCache bool) testServerOptionFunc {
+	return func(options *testServerOptions) {
+		options.enableCache = enableCache
+	}
+}
+
 func makeAndRunTestAuthServer(t *testing.T, opts ...testServerOptionFunc) (auth *service.TeleportProcess) {
 	var options testServerOptions
 	for _, opt := range opts {
@@ -254,7 +304,7 @@ func makeAndRunTestAuthServer(t *testing.T, opts ...testServerOptionFunc) (auth
 		require.NoError(t, err)
 	}
 
-	cfg.CachePolicy.Enabled = false
+	cfg.CachePolicy.Enabled = options.enableCache
 	cfg.Proxy.DisableWebInterface = true
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	if options.fakeClock != nil {
diff --git a/tool/tctl/common/idp_comand_test.go b/tool/tctl/common/idp_comand_test.go
index a0305cee9f501..fc1b70b225894 100644
--- a/tool/tctl/common/idp_comand_test.go
+++ b/tool/tctl/common/idp_comand_test.go
@@ -44,7 +44,9 @@ func TestIdPSAMLCommand(t *testing.T) {
 		},
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	t.Run("test-attribute-mapping", func(t *testing.T) {
 		// Create user file
diff --git a/tool/tctl/common/kube_command.go b/tool/tctl/common/kube_command.go
index b0e2f69afe373..c02375258c2db 100644
--- a/tool/tctl/common/kube_command.go
+++ b/tool/tctl/common/kube_command.go
@@ -134,8 +134,9 @@ helm repo update
 > helm install teleport-agent teleport/teleport-kube-agent \
   --set kubeClusterName=cluster ` + "`" + `# Change kubeClusterName variable to your preferred name.` + "`" + ` \
   --set roles="{{.set_roles}}" \
-  --set proxyAddr={{.auth_server}} \
+  --set proxyAddr={{.proxy_server}} \
   --set authToken={{.token}} \
+  --set updater.enabled=true \
   --create-namespace \
   --namespace=teleport-agent \
   --version={{.version}}
@@ -143,7 +144,7 @@ helm repo update
 Please note:
 
   - This invitation token will expire in {{.minutes}} minutes.
-  - {{.auth_server}} must be reachable from Kubernetes cluster.
+  - {{.proxy_server}} must be reachable from Kubernetes cluster.
   - The token is usable in a standalone Linux server with kubernetes_service.
   - See https://goteleport.com/docs/kubernetes-access/ for detailed installation information.
 
diff --git a/tool/tctl/common/loadtest_command.go b/tool/tctl/common/loadtest_command.go
index 3fa9f58063f90..c2075fc4d59cc 100644
--- a/tool/tctl/common/loadtest_command.go
+++ b/tool/tctl/common/loadtest_command.go
@@ -61,6 +61,7 @@ type LoadtestCommand struct {
 	labels      int
 	interval    time.Duration
 	ttl         time.Duration
+	duration    time.Duration
 	concurrency int
 
 	kind   string
@@ -82,6 +83,7 @@ func (c *LoadtestCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Global
 	c.nodeHeartbeats.Flag("labels", "Number of labels to generate per node.").Default("1").IntVar(&c.labels)
 	c.nodeHeartbeats.Flag("interval", "Node heartbeat interval").Default("1m").DurationVar(&c.interval)
 	c.nodeHeartbeats.Flag("ttl", "TTL of heartbeated nodes").Default("10m").DurationVar(&c.ttl)
+	c.nodeHeartbeats.Flag("duration", "Maximum time to run before shutting down. A default value of '0' will run indefinitely").Default("0").DurationVar(&c.duration)
 	c.nodeHeartbeats.Flag("concurrency", "Max concurrent requests").Default(
 		strconv.Itoa(runtime.NumCPU() * 16),
 	).IntVar(&c.concurrency)
@@ -126,18 +128,30 @@ func (c *LoadtestCommand) NodeHeartbeats(ctx context.Context, client *authclient
 		fmt.Fprintf(os.Stderr, "[!] "+format+"\n", args...)
 	}
 
-	infof("Setting up node hb load generation. count=%d, churn=%d, labels=%d, interval=%s, ttl=%s, concurrency=%d",
+	durationReadable := c.duration.String()
+	if c.duration == 0 {
+		durationReadable = "forever"
+	}
+
+	infof("Setting up node hb load generation. count=%d, churn=%d, labels=%d, interval=%s, ttl=%s, duration=%s, concurrency=%d",
 		c.count,
 		c.churn,
 		c.labels,
 		c.interval,
 		c.ttl,
+		durationReadable,
 		c.concurrency,
 	)
 
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt)
 	defer cancel()
 
+	if c.duration > 0 {
+		timeoutCtx, cancel := context.WithTimeout(ctx, c.duration)
+		defer cancel()
+		ctx = timeoutCtx
+	}
+
 	node_ids := make([]string, 0, c.count)
 
 	for i := 0; i < c.count; i++ {
diff --git a/tool/tctl/common/lock_command.go b/tool/tctl/common/lock_command.go
index 3927c7ed91b28..00c412a894a14 100644
--- a/tool/tctl/common/lock_command.go
+++ b/tool/tctl/common/lock_command.go
@@ -59,6 +59,8 @@ func (c *LockCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 	c.mainCmd.Flag("expires", "Time point (RFC3339) when the lock expires.").StringVar(&c.expires)
 	c.mainCmd.Flag("ttl", "Time duration after which the lock expires.").DurationVar(&c.ttl)
 	c.mainCmd.Flag("server-id", "UUID of a Teleport server to disable.").StringVar(&c.spec.Target.ServerID)
+	c.mainCmd.Flag("bot-instance-id", "UUID of a bot instance to disable").StringVar(&c.spec.Target.BotInstanceID)
+	c.mainCmd.Flag("join-token", "Bot join token name to disable").StringVar(&c.spec.Target.JoinToken)
 }
 
 // TryRun attempts to run subcommands.
diff --git a/tool/tctl/common/lock_command_test.go b/tool/tctl/common/lock_command_test.go
index e41cbcd815d7e..d9ebfa14a82d6 100644
--- a/tool/tctl/common/lock_command_test.go
+++ b/tool/tctl/common/lock_command_test.go
@@ -57,7 +57,9 @@ func TestLocks(t *testing.T) {
 	timeNow := time.Now().UTC()
 	fakeClock := clockwork.NewFakeClockAt(timeNow)
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors), withFakeClock(fakeClock))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	t.Run("create", func(t *testing.T) {
 		err := runLockCommand(t, clt, []string{"--user=bad@actor", "--message=Come see me"})
diff --git a/tool/tctl/common/node_command.go b/tool/tctl/common/node_command.go
index 0be12463b8184..71349307e7d26 100644
--- a/tool/tctl/common/node_command.go
+++ b/tool/tctl/common/node_command.go
@@ -22,7 +22,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log/slog"
 	"os"
 	"strings"
 	"text/template"
@@ -36,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -185,7 +185,12 @@ func (c *NodeCommand) Invite(ctx context.Context, client *authclient.Client) err
 		return trace.Wrap(err)
 	}
 
-	authServers, err := client.GetAuthServers()
+	authServers, err := clientutils.CollectWithFallback(
+		ctx,
+		client.ListAuthServers,
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		func(context.Context) ([]types.Server, error) { return client.GetAuthServers() },
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -198,29 +203,12 @@ func (c *NodeCommand) Invite(ctx context.Context, client *authclient.Client) err
 		if roles.Include(types.RoleTrustedCluster) {
 			fmt.Printf(trustedClusterMessage, token, int(c.ttl.Minutes()))
 		} else {
-			authServer := authServers[0].GetAddr()
-
-			pingResponse, err := client.Ping(ctx)
-			if err != nil {
-				slog.DebugContext(ctx, "unable to ping auth client", "error", err)
-			}
-
-			if err == nil && pingResponse.GetServerFeatures().Cloud {
-				proxies, err := client.GetProxies()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-
-				if len(proxies) != 0 {
-					authServer = proxies[0].GetPublicAddr()
-				}
-			}
-			return nodeMessageTemplate.Execute(os.Stdout, map[string]interface{}{
+			return nodeMessageTemplate.Execute(os.Stdout, map[string]any{
 				"token":       token,
 				"minutes":     int(c.ttl.Minutes()),
 				"roles":       strings.ToLower(roles.String()),
 				"ca_pins":     caPins,
-				"auth_server": authServer,
+				"auth_server": controlPlaneAddr(ctx, client, authServers[0].GetAddr()),
 			})
 		}
 	} else {
diff --git a/tool/tctl/common/notification_command.go b/tool/tctl/common/notification_command.go
index 27c4517db19db..6913c156782b3 100644
--- a/tool/tctl/common/notification_command.go
+++ b/tool/tctl/common/notification_command.go
@@ -85,7 +85,7 @@ func (n *NotificationCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Gl
 	n.create.Flag("labels", "List of labels to attach to the notification. For example: key1=value1,key2=value2.").StringVar(&n.labels)
 
 	n.ls = notif.Command("ls", "List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all.")
-	n.ls.Flag("user", "Set which user to list user-specific notifications for.").StringVar(&n.user)
+	n.ls.Flag("user", "Set which user to list user-specific notifications for, or leave empty to list your own.").StringVar(&n.user)
 	n.ls.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.Text).EnumVar(&n.format, teleport.YAML, teleport.JSON, teleport.Text)
 	n.ls.Flag("all", "Set whether all notifications should be included, including those generated by Teleport, as opposed to solely those created using `tctl notifications create`.").BoolVar(&n.allNotifications)
 	n.ls.Flag("labels", labelHelp).StringVar(&n.labels)
diff --git a/tool/tctl/common/notification_command_test.go b/tool/tctl/common/notification_command_test.go
index 982ea688310a4..e60cace235313 100644
--- a/tool/tctl/common/notification_command_test.go
+++ b/tool/tctl/common/notification_command_test.go
@@ -47,7 +47,9 @@ func TestNotificationCommmandCRUD(t *testing.T) {
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
 
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	auditorUsername := "auditor-user"
 	managerUsername := "manager-user"
diff --git a/tool/tctl/common/plugin/awsic.go b/tool/tctl/common/plugin/awsic.go
index 16da0f51de941..31b86085739dd 100644
--- a/tool/tctl/common/plugin/awsic.go
+++ b/tool/tctl/common/plugin/awsic.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"net/url"
 	"slices"
 
@@ -36,28 +37,38 @@ import (
 	awsregion "github.com/gravitational/teleport/lib/utils/aws/region"
 )
 
-type awsICArgs struct {
-	cmd                  *kingpin.CmdClause
-	defaultOwners        []string
-	scimToken            string
-	scimURL              *url.URL
-	forceSCIMURL         bool
-	region               string
-	arn                  string
-	useSystemCredentials bool
-	assumeRoleARN        string
-	userOrigins          []string
-	userLabels           []string
-	groupNameFilters     []string
-	accountNameFilters   []string
-	accountIDFilters     []string
+const (
+	defaultAWSICPluginName = apicommon.OriginAWSIdentityCenter
+	awsicPluginNameFlag    = "plugin-name"
+	awsicPluginNameHelp    = "Name of the AWS Identity Center integration instance to update. Defaults to " + apicommon.OriginAWSIdentityCenter + "."
+	awsicRolesSyncModeFlag = "roles-sync-mode"
+	awsicRolesSyncModeHelp = "Control account-assignment role creation. ALL creates roles for all possible account assignments. NONE creates no roles, and also implies a totally-exclusive group import filter."
+	notAWSICPluginMsg      = "%q is not an AWS Identity Center integration"
+)
 
+type awsICInstallArgs struct {
+	cmd                       *kingpin.CmdClause
+	defaultOwners             []string
+	scimToken                 string
+	scimURL                   *url.URL
+	forceSCIMURL              bool
+	region                    string
+	arn                       string
+	useSystemCredentials      bool
+	oidcIntegration           string
+	assumeRoleARN             string
+	userOrigins               []string
+	userLabels                []string
+	groupNameFilters          []string
+	accountNameFilters        []string
+	accountIDFilters          []string
+	rolesSyncMode             string
 	excludeGroupNameFilters   []string
 	excludeAccountNameFilters []string
 	excludeAccountIDFilters   []string
 }
 
-func (a *awsICArgs) validate(ctx context.Context, log *slog.Logger) error {
+func (a *awsICInstallArgs) validate(ctx context.Context, auth authClient, log *slog.Logger) error {
 	if !awsregion.IsKnownRegion(a.region) {
 		return trace.BadParameter("unknown AWS region: %s", a.region)
 	}
@@ -66,7 +77,7 @@ func (a *awsICArgs) validate(ctx context.Context, log *slog.Logger) error {
 		return trace.BadParameter("SCIM token must not be empty")
 	}
 
-	if err := a.validateSystemCredentialInput(); err != nil {
+	if err := a.validateCredentialInput(); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -77,28 +88,38 @@ func (a *awsICArgs) validate(ctx context.Context, log *slog.Logger) error {
 	return nil
 }
 
-func (a *awsICArgs) validateSystemCredentialInput() error {
-	if !a.useSystemCredentials {
-		return trace.BadParameter("--use-system-credentials must be set. The tctl-based AWS IAM Identity Center plugin installation only supports AWS local system credentials")
+func (a *awsICInstallArgs) validateCredentialInput() error {
+	if a.useSystemCredentials {
+		if a.assumeRoleARN == "" {
+			return trace.BadParameter("--assume-role-arn must be set when --use-system-credentials is configured")
+		}
+
+		if a.oidcIntegration != "" {
+			return trace.BadParameter("--oidc-integration must not be set when --use-system-credentials is configured")
+		}
+
+		if _, err := awsutils.ParseRoleARN(a.assumeRoleARN); err != nil {
+			return trace.Wrap(err)
+		}
+		return nil
 	}
 
-	if a.assumeRoleARN == "" {
-		return trace.BadParameter("--assume-role-arn must be set when --use-system-credentials is configured")
+	if a.oidcIntegration == "" {
+		return trace.BadParameter("--oidc-integration must be set when --no-use-system-credentials is configured")
 	}
 
-	if _, err := awsutils.ParseRoleARN(a.assumeRoleARN); err != nil {
-		return trace.Wrap(err)
+	if a.assumeRoleARN != "" {
+		return trace.BadParameter("--assume-role-arn must not be set when --no-use-system-credentials is configured")
 	}
 
 	return nil
 }
 
-func (a *awsICArgs) validateSCIMBaseURL(ctx context.Context, log *slog.Logger) error {
+func (a *awsICInstallArgs) validateSCIMBaseURL(ctx context.Context, log *slog.Logger) error {
 	validatedBaseUrl, err := icutils.EnsureSCIMEndpointURL(a.scimURL)
 	if err == nil {
 		a.scimURL = validatedBaseUrl
 		return nil
-
 	}
 
 	if a.forceSCIMURL {
@@ -109,7 +130,7 @@ func (a *awsICArgs) validateSCIMBaseURL(ctx context.Context, log *slog.Logger) e
 	return trace.Wrap(err)
 }
 
-func (a *awsICArgs) parseGroupFilters() (icfilters.Filters, error) {
+func (a *awsICInstallArgs) parseGroupFilters() (icfilters.Filters, error) {
 	filters := make([]*types.AWSICResourceFilter, 0, len(a.groupNameFilters)+len(a.excludeGroupNameFilters))
 	for _, n := range a.groupNameFilters {
 		filters = append(filters, &types.AWSICResourceFilter{
@@ -124,7 +145,7 @@ func (a *awsICArgs) parseGroupFilters() (icfilters.Filters, error) {
 	return icfilters.New(filters)
 }
 
-func (a *awsICArgs) parseAccountFilters() (icfilters.Filters, error) {
+func (a *awsICInstallArgs) parseAccountFilters() (icfilters.Filters, error) {
 	filtersCap := len(a.accountNameFilters) + len(a.excludeAccountNameFilters) + len(a.accountIDFilters) + len(a.excludeAccountIDFilters)
 	filters := make([]*types.AWSICResourceFilter, 0, filtersCap)
 	for _, n := range a.accountNameFilters {
@@ -154,7 +175,7 @@ func (a *awsICArgs) parseAccountFilters() (icfilters.Filters, error) {
 	return icfilters.New(filters)
 }
 
-func (a *awsICArgs) parseUserFilters() ([]*types.AWSICUserSyncFilter, error) {
+func (a *awsICInstallArgs) parseUserFilters() ([]*types.AWSICUserSyncFilter, error) {
 	result := make([]*types.AWSICUserSyncFilter, 0, len(a.userOrigins)+len(a.userLabels))
 
 	if len(a.userOrigins) > 0 {
@@ -206,6 +227,8 @@ func (p *PluginsCommand) initInstallAWSIC(parent *kingpin.CmdClause) {
 		BoolVar(&p.install.awsIC.useSystemCredentials)
 	cmd.Flag("assume-role-arn", "ARN of a role that the system credential should assume.").
 		StringVar(&p.install.awsIC.assumeRoleARN)
+	cmd.Flag("oidc-integration", "Name of the Teleport OIDC integration to use when authenticating with AWS. Must be supplied when --no-use-system-credentials is set.").
+		StringVar(&p.install.awsIC.oidcIntegration)
 
 	cmd.Flag("user-origin", fmt.Sprintf(`Shorthand for "--user-label %s=ORIGIN"`, types.OriginLabel)).
 		PlaceHolder("ORIGIN").
@@ -227,12 +250,16 @@ func (p *PluginsCommand) initInstallAWSIC(parent *kingpin.CmdClause) {
 		StringsVar(&p.install.awsIC.excludeAccountNameFilters)
 	cmd.Flag("exclude-account-id", "Exclude AWS account from import list by ID.").
 		StringsVar(&p.install.awsIC.excludeAccountIDFilters)
+
+	cmd.Flag("roles-sync-mode", "Control account-assignment role creation. ALL creates Teleport Roles for all possible account assignments. NONE creates no Teleport Roles, and also implies a totally-exclusive group import filter.").
+		Default(types.AWSICRolesSyncModeAll).
+		EnumVar(&p.install.awsIC.rolesSyncMode, types.AWSICRolesSyncModeAll, types.AWSICRolesSyncModeNone)
 }
 
 // InstallAWSIC installs AWS Identity Center plugin.
-func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args pluginServices) error {
 	awsICArgs := p.install.awsIC
-	if err := awsICArgs.validate(ctx, p.config.Logger); err != nil {
+	if err := awsICArgs.validate(ctx, args.authClient, p.config.Logger); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -246,6 +273,15 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args installPluginArg
 		return trace.Wrap(err)
 	}
 
+	if awsICArgs.rolesSyncMode == types.AWSICRolesSyncModeNone {
+		if len(groupFilters) != 0 {
+			return trace.BadParameter("specifying group import filers is incompatible with --roles-sync-mode NONE")
+		}
+		groupFilters = append(groupFilters, &types.AWSICResourceFilter{
+			Exclude: &types.AWSICResourceFilter_ExcludeNameRegex{ExcludeNameRegex: "*"},
+		})
+	}
+
 	accountFilters, err := awsICArgs.parseAccountFilters()
 	if err != nil {
 		return trace.Wrap(err)
@@ -261,6 +297,7 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args installPluginArg
 		UserSyncFilters:         userFilters,
 		GroupSyncFilters:        groupFilters,
 		AwsAccountsFilters:      accountFilters,
+		RolesSyncMode:           awsICArgs.rolesSyncMode,
 	}
 
 	if awsICArgs.useSystemCredentials {
@@ -275,6 +312,14 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args installPluginArg
 		// Set the deprecated CredentialsSource to the legacy value to allow old
 		// versions of Teleport to handle the record. DELETE in Teleport 19
 		settings.CredentialsSource = types.AWSICCredentialsSource_AWSIC_CREDENTIALS_SOURCE_SYSTEM
+	} else {
+		settings.Credentials = &types.AWSICCredentials{
+			Source: &types.AWSICCredentials_Oidc{
+				Oidc: &types.AWSICCredentialSourceOIDC{
+					IntegrationName: awsICArgs.oidcIntegration,
+				},
+			},
+		}
 	}
 
 	req := &pluginspb.CreatePluginRequest{
@@ -316,3 +361,161 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args installPluginArg
 
 	return nil
 }
+
+type awsICEditArgs struct {
+	cmd           *kingpin.CmdClause
+	pluginName    string
+	rolesSyncMode string
+}
+
+func (p *PluginsCommand) initEditAWSIC(parent *kingpin.CmdClause) {
+	p.edit.awsIC.cmd = parent.Command("awsic", "Edit an AWS IAM Identity Center integration's settings.")
+	cmd := p.edit.awsIC.cmd
+
+	cmd.Flag(awsicPluginNameFlag, awsicPluginNameHelp).
+		Default(defaultAWSICPluginName).
+		StringVar(&p.edit.awsIC.pluginName)
+
+	cmd.Flag(awsicRolesSyncModeFlag, awsicRolesSyncModeHelp).
+		EnumVar(&p.edit.awsIC.rolesSyncMode, types.AWSICRolesSyncModeAll, types.AWSICRolesSyncModeNone)
+}
+
+func (p *PluginsCommand) EditAWSIC(ctx context.Context, args pluginServices) error {
+	plugin, err := args.plugins.GetPlugin(ctx, &pluginspb.GetPluginRequest{
+		Name: p.edit.awsIC.pluginName,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	icSettings := plugin.Spec.GetAwsIc()
+	if icSettings == nil {
+		return trace.BadParameter("%q is not an AWS Identity Center integration", p.edit.awsIC.pluginName)
+	}
+
+	cliArgs := &p.edit.awsIC
+	if cliArgs.rolesSyncMode != "" {
+		icSettings.RolesSyncMode = cliArgs.rolesSyncMode
+	}
+
+	_, err = args.plugins.UpdatePlugin(ctx, &pluginspb.UpdatePluginRequest{
+		Plugin: plugin,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+type awsICRotateCredsArgs struct {
+	cmd               *kingpin.CmdClause
+	pluginName        string
+	payload           string
+	requireValidation bool
+}
+
+func (p *PluginsCommand) initRotateCredsAWSIC(parent *kingpin.CmdClause) {
+	p.rotateCreds.awsic.cmd = parent.Command("awsic", "Rotate the AWS Identity Center SCIM bearer token.")
+	cmd := p.rotateCreds.awsic.cmd
+	args := &p.rotateCreds.awsic
+
+	cmd.Flag("plugin-name", "Name of the AWSIC plugin instance to update. Defaults to "+apicommon.OriginAWSIdentityCenter+".").
+		Default(apicommon.OriginAWSIdentityCenter).
+		StringVar(&args.pluginName)
+
+	cmd.Arg("token", "The new SCIM bearer token.").
+		PlaceHolder("TOKEN").
+		Required().
+		StringVar(&p.rotateCreds.awsic.payload)
+
+	cmd.Flag("validate-token", "Validate that the supplied token is valid for the configured downstream SCIM service").
+		Default("true").
+		BoolVar(&args.requireValidation)
+}
+
+func (p *PluginsCommand) RotateAWSICCreds(ctx context.Context, args pluginServices) error {
+	cliArgs := &p.rotateCreds.awsic
+
+	slog.InfoContext(ctx, "Fetching plugin...", "plugin_name", cliArgs.pluginName)
+	plugin, err := args.plugins.GetPlugin(ctx, &pluginspb.GetPluginRequest{
+		Name:        cliArgs.pluginName,
+		WithSecrets: true,
+	})
+	if err != nil {
+		return trace.Wrap(err, "fetching plugin %q", cliArgs.pluginName)
+	}
+
+	awsicSettings := plugin.Spec.GetAwsIc()
+	if awsicSettings == nil {
+		return trace.BadParameter(notAWSICPluginMsg, cliArgs.pluginName)
+	}
+
+	if p.rotateCreds.awsic.requireValidation {
+		if err := p.rotateCreds.awsic.validateToken(ctx, awsicSettings, args); err != nil {
+			return trace.Wrap(err, "validating SCIM bearer token")
+		}
+	}
+
+	staticCredsRef := plugin.Credentials.GetStaticCredentialsRef()
+	if staticCredsRef == nil {
+		return trace.BadParameter("plugin has no credentials reference")
+	}
+
+	req := pluginspb.UpdatePluginStaticCredentialsRequest{
+		Target: &pluginspb.UpdatePluginStaticCredentialsRequest_Query{
+			Query: &pluginspb.CredentialQuery{
+				Labels: staticCredsRef.Labels,
+			},
+		},
+		Credential: &types.PluginStaticCredentialsSpecV1{
+			Credentials: &types.PluginStaticCredentialsSpecV1_APIToken{
+				APIToken: p.rotateCreds.awsic.payload,
+			},
+		},
+	}
+
+	_, err = args.plugins.UpdatePluginStaticCredentials(ctx, &req)
+	if err != nil {
+		return trace.Wrap(err, "updating credentials")
+	}
+
+	return nil
+}
+
+func (args *awsICRotateCredsArgs) validateToken(ctx context.Context, awsicSettings *types.PluginAWSICSettings, env pluginServices) error {
+	provisioningSpec := awsicSettings.ProvisioningSpec
+	if provisioningSpec == nil {
+		return trace.BadParameter("plugin is missing provisioning spec")
+	}
+
+	slog.InfoContext(ctx, "Validating token", "scim_server", provisioningSpec.BaseUrl)
+
+	endPoint, err := url.JoinPath(provisioningSpec.BaseUrl, "ServiceProviderConfig")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endPoint, nil)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", args.payload))
+	req.Header.Set("Accept", "application/scim+json")
+
+	resp, err := env.httpProvider.RoundTrip(req)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	resp.Body.Close()
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return trace.BadParameter("invalid token")
+	case http.StatusInternalServerError:
+		return trace.BadParameter("internal server error")
+	default:
+		return trace.BadParameter("unexpected status code %v", resp.StatusCode)
+	}
+	return nil
+}
diff --git a/tool/tctl/common/plugin/awsic_test.go b/tool/tctl/common/plugin/awsic_test.go
index 55ea37c51669c..58b891cb67ecd 100644
--- a/tool/tctl/common/plugin/awsic_test.go
+++ b/tool/tctl/common/plugin/awsic_test.go
@@ -17,13 +17,20 @@
 package plugin
 
 import (
+	"bytes"
 	"context"
+	"io"
 	"log/slog"
+	"net/http"
 	"net/url"
 	"testing"
 
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
 
+	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
@@ -92,7 +99,7 @@ func TestAWSICUserFilters(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			cliArgs := awsICArgs{
+			cliArgs := awsICInstallArgs{
 				userLabels:  test.labelValues,
 				userOrigins: test.originValues,
 			}
@@ -134,7 +141,7 @@ func TestAWSICGroupFilters(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			cliArgs := awsICArgs{
+			cliArgs := awsICInstallArgs{
 				groupNameFilters: test.nameValues,
 			}
 
@@ -198,7 +205,7 @@ func TestAWSICAccountFilters(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			cliArgs := awsICArgs{
+			cliArgs := awsICInstallArgs{
 				accountNameFilters: test.nameValues,
 				accountIDFilters:   test.idValues,
 			}
@@ -256,7 +263,7 @@ func TestSCIMBaseURLValidation(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			cliArgs := awsICArgs{
+			cliArgs := awsICInstallArgs{
 				scimURL:      mustParseURL(test.suppliedURL),
 				forceSCIMURL: test.forceURL,
 			}
@@ -270,48 +277,337 @@ func TestSCIMBaseURLValidation(t *testing.T) {
 	}
 }
 
-func TestUseSystemCredentialsInput(t *testing.T) {
+type mockIntegrationGetter struct {
+	mock.Mock
+}
+
+func maybeGet[T any](args mock.Arguments, index int) T {
+	value := args.Get(index)
+	if value == nil {
+		var zero T
+		return zero
+	}
+	return value.(T)
+}
+
+func (m *mockIntegrationGetter) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+	result := m.Called(ctx, name)
+	return maybeGet[types.Integration](result, 0), result.Error(1)
+}
+
+func TestCredentialsInput(t *testing.T) {
 	testCases := []struct {
 		name                string
 		useSystemCredential bool
 		assumeRoleARN       string
+		integrationName     string
+		integrationExists   bool
 		expectError         require.ErrorAssertionFunc
 	}{
 		{
-			name:                "valid system credential config",
+			name:                "use system credentials",
 			useSystemCredential: true,
 			assumeRoleARN:       "arn:aws:iam::026000000023:role/assume1",
 			expectError:         require.NoError,
 		},
 		{
-			name:                "no useSystemCredential",
-			useSystemCredential: false,
+			name:                "use system credentials without assumeRoleARN is an error",
+			useSystemCredential: true,
 			assumeRoleARN:       "",
 			expectError:         require.Error,
 		},
 		{
-			name:                "useSystemCredential without assumeRoleARN",
+			name:                "use system credentials with a malformed assumeRoleARN is an error",
 			useSystemCredential: true,
-			assumeRoleARN:       "",
+			assumeRoleARN:       "i am not an arn",
 			expectError:         require.Error,
 		},
 		{
-			name:                "useSystemCredential with invalid assumeRoleARN",
+			name:                "use system credentials with integration is an error",
 			useSystemCredential: true,
-			assumeRoleARN:       "example-credential",
+			assumeRoleARN:       "arn:aws:iam::026000000023:role/assume1",
+			integrationName:     "some-integration",
+			expectError:         require.Error,
+		},
+		{
+			name:                "use oidc credentials",
+			useSystemCredential: false,
+			assumeRoleARN:       "",
+			integrationName:     "some-integration",
+			integrationExists:   true,
+			expectError:         require.NoError,
+		},
+		{
+			name:                "use oidc credentials with no integration set",
+			useSystemCredential: false,
+			assumeRoleARN:       "",
+			integrationName:     "",
+			expectError:         require.Error,
+		},
+		{
+			name:                "use oidc credentials and setting assumeRoleARN is an error",
+			useSystemCredential: false,
+			assumeRoleARN:       "arn:aws:iam::026000000023:role/assume1",
+			integrationName:     "some-integration",
+			integrationExists:   true,
 			expectError:         require.Error,
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			cliArgs := awsICArgs{
+			cliArgs := awsICInstallArgs{
 				useSystemCredentials: tc.useSystemCredential,
 				assumeRoleARN:        tc.assumeRoleARN,
+				oidcIntegration:      tc.integrationName,
 			}
 
-			err := cliArgs.validateSystemCredentialInput()
+			integrations := &mockIntegrationGetter{}
+			if !tc.useSystemCredential {
+				var integrationErr error
+				if !tc.integrationExists {
+					integrationErr = trace.NotFound("yes, we have no bananas")
+				}
+
+				integrations.
+					On("GetIntegration", anyContext, mock.AnythingOfType("string")).
+					Return(nil, integrationErr)
+			}
+
+			err := cliArgs.validateCredentialInput()
 			tc.expectError(t, err)
 		})
 	}
 }
+
+type mockRoundTripper struct {
+	mock.Mock
+}
+
+// RoundTrip implements the [http.RoundTripper] interface for the mockRoundTripper
+func (m *mockRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	args := m.Called(request)
+	return maybeGet[*http.Response](args, 0), args.Error(1)
+}
+
+func TestRotateAWSICSCIMToken(t *testing.T) {
+	const (
+		scimURL = "https://scim.example.com"
+	)
+	validAWSICPlugin := func() *types.PluginV1 {
+		return &types.PluginV1{
+			Kind:    types.KindPlugin,
+			SubKind: types.PluginSubkindAccess,
+			Metadata: types.Metadata{
+				Name:   types.PluginTypeAWSIdentityCenter,
+				Labels: map[string]string{types.HostedPluginLabel: "true"},
+			},
+			Spec: types.PluginSpecV1{
+				Settings: &types.PluginSpecV1_AwsIc{
+					AwsIc: &types.PluginAWSICSettings{
+						ProvisioningSpec: &types.AWSICProvisioningSpec{
+							BaseUrl: scimURL,
+						},
+					},
+				},
+			},
+			Credentials: &types.PluginCredentialsV1{
+				Credentials: &types.PluginCredentialsV1_StaticCredentialsRef{
+					StaticCredentialsRef: &types.PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"plugin-id": "some-aws-ic-integration",
+						},
+					},
+				},
+			},
+		}
+	}
+
+	makeResponse := func(status int) *http.Response {
+		if status == 0 {
+			return nil
+		}
+		return &http.Response{
+			Status:     http.StatusText(status),
+			StatusCode: status,
+			Body:       io.NopCloser(&bytes.Buffer{}),
+		}
+	}
+
+	testCases := []struct {
+		name                string
+		cliArgs             awsICRotateCredsArgs
+		pluginValueProvider func() *types.PluginV1
+		pluginFetchError    error
+		expectValidation    bool
+		validationError     error
+		validationResponse  int
+		expectUpdate        bool
+		updateError         error
+		assertError         require.ErrorAssertionFunc
+	}{
+		{
+			name: "default",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			pluginValueProvider: validAWSICPlugin,
+			expectValidation:    true,
+			validationResponse:  http.StatusOK,
+			expectUpdate:        true,
+			assertError:         require.NoError,
+		},
+		{
+			name: "no such plugin",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			pluginValueProvider: func() *types.PluginV1 { return nil },
+			pluginFetchError:    trace.NotFound("no such plugin"),
+			assertError:         require.Error,
+		},
+		{
+			name: "wrong plugin type",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			pluginValueProvider: func() *types.PluginV1 {
+				return &types.PluginV1{
+					Kind:    types.KindPlugin,
+					SubKind: types.PluginSubkindAccess,
+					Metadata: types.Metadata{
+						Name:   "okta",
+						Labels: map[string]string{types.HostedPluginLabel: "true"},
+					},
+					Spec: types.PluginSpecV1{
+						Settings: &types.PluginSpecV1_Okta{
+							Okta: &types.PluginOktaSettings{},
+						},
+					},
+				}
+			},
+			assertError: require.Error,
+		},
+		{
+			name: "no such credential",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			pluginValueProvider: validAWSICPlugin,
+			expectValidation:    true,
+			validationResponse:  http.StatusOK,
+			expectUpdate:        true,
+			updateError:         trace.NotFound("no such credential"),
+			assertError:         require.Error,
+		},
+		{
+			name: "validation failure",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			expectValidation:    true,
+			validationResponse:  http.StatusForbidden,
+			pluginValueProvider: validAWSICPlugin,
+			expectUpdate:        false,
+			assertError:         requireBadParameter,
+		},
+		{
+			name: "bypass validation",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: false,
+				payload:           "some-token",
+			},
+			expectValidation:    false,
+			validationResponse:  http.StatusForbidden,
+			pluginValueProvider: validAWSICPlugin,
+			expectUpdate:        true,
+			assertError:         require.NoError,
+		},
+		{
+			name: "update credential access denied",
+			cliArgs: awsICRotateCredsArgs{
+				pluginName:        types.PluginTypeAWSIdentityCenter,
+				requireValidation: true,
+				payload:           "some-token",
+			},
+			expectValidation:    true,
+			validationResponse:  http.StatusOK,
+			pluginValueProvider: validAWSICPlugin,
+			expectUpdate:        true,
+			updateError:         trace.AccessDenied("computer says no"),
+			assertError:         requireAccessDenied,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			cliArgs := PluginsCommand{
+				rotateCreds: pluginRotateCredsArgs{
+					awsic: test.cliArgs,
+				},
+			}
+
+			pluginsClient := &mockPluginsClient{}
+			pluginsClient.
+				On("GetPlugin", anyContext, mock.Anything, mock.Anything).
+				Run(func(args mock.Arguments) {
+					req, ok := args.Get(1).(*pluginsv1.GetPluginRequest)
+					require.True(t, ok, "expecting a *pluginsv1.GetPluginRequest, got %T", args.Get(1))
+					require.Equal(t, test.cliArgs.pluginName, req.Name)
+					require.True(t, req.WithSecrets)
+				}).
+				Return(test.pluginValueProvider(), test.pluginFetchError)
+
+			if test.expectUpdate {
+				pluginsClient.
+					On("UpdatePluginStaticCredentials", anyContext, mock.Anything, mock.Anything).
+					Return(func(ctx context.Context, in *pluginsv1.UpdatePluginStaticCredentialsRequest, _ ...grpc.CallOption) (*pluginsv1.UpdatePluginStaticCredentialsResponse, error) {
+						q := in.GetQuery()
+						require.NotNil(t, q, "Update request must specify target labels")
+						require.NotEmpty(t, q.Labels, "Update request must specify non-empty labels")
+
+						return &pluginsv1.UpdatePluginStaticCredentialsResponse{
+							Credential: &types.PluginStaticCredentialsV1{Spec: in.GetCredential()},
+						}, test.updateError
+					})
+			}
+
+			roundTripper := &mockRoundTripper{}
+			if test.expectValidation {
+				response := makeResponse(test.validationResponse)
+				defer response.Body.Close()
+
+				roundTripper.
+					On("RoundTrip", mock.Anything).
+					Run(func(args mock.Arguments) {
+						req, ok := args.Get(0).(*http.Request)
+						require.True(t, ok, "expecting a *http.Request, got %T", args.Get(0))
+						require.Equal(t, "Bearer "+test.cliArgs.payload, req.Header.Get("Authorization"))
+					}).
+					Return(response, test.validationError)
+			}
+
+			args := pluginServices{
+				plugins:      pluginsClient,
+				httpProvider: roundTripper,
+			}
+
+			err := cliArgs.RotateAWSICCreds(context.Background(), args)
+			test.assertError(t, err)
+
+			pluginsClient.AssertExpectations(t)
+			roundTripper.AssertExpectations(t)
+		})
+	}
+}
diff --git a/tool/tctl/common/plugin/entraid.go b/tool/tctl/common/plugin/entraid.go
index b175b11312665..ea05455991e38 100644
--- a/tool/tctl/common/plugin/entraid.go
+++ b/tool/tctl/common/plugin/entraid.go
@@ -40,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	entraapiutils "github.com/gravitational/teleport/api/utils/entraid"
 	"github.com/gravitational/teleport/lib/integrations/azureoidc"
+	"github.com/gravitational/teleport/lib/plugins/filter"
 	"github.com/gravitational/teleport/lib/utils/oidc"
 	"github.com/gravitational/teleport/lib/web/scripts/oneoff"
 )
@@ -78,7 +79,7 @@ With the output of Step 1, please copy and paste the following information:
 
 To finish the Entra ID integration, manually configure the Application in Microsoft Entra ID.
 
-Follow the instructions provided in the Teleport documentation: [https://goteleport.com/docs/admin-guides/teleport-policy/integrations/entra-id/].
+Follow the instructions provided in the Teleport documentation: [https://goteleport.com/docs/identity-security/integrations/entra-id/].
 
 After completing the Entra ID setup, copy and paste the following information:
 `
@@ -92,6 +93,8 @@ type entraArgs struct {
 	accessGraph          bool
 	force                bool
 	manualEntraIDSetup   bool
+
+	groupFilters filter.Inputs
 }
 
 func (p *PluginsCommand) initInstallEntra(parent *kingpin.CmdClause) {
@@ -131,6 +134,15 @@ func (p *PluginsCommand) initInstallEntra(parent *kingpin.CmdClause) {
 		Short('m').
 		Default("false").
 		BoolVar(&p.install.entraID.manualEntraIDSetup)
+
+	cmd.Flag("group-id", "Include group matching the specified group ID.").
+		StringsVar(&p.install.entraID.groupFilters.ID)
+	cmd.Flag("group-name", "Include groups matching the specified group name regex.").
+		StringsVar(&p.install.entraID.groupFilters.NameRegex)
+	cmd.Flag("exclude-group-id", "Exclude group matching the specified group ID.").
+		StringsVar(&p.install.entraID.groupFilters.ExcludeID)
+	cmd.Flag("exclude-group-name", "Exclude groups matching the specified group name regex.").
+		StringsVar(&p.install.entraID.groupFilters.ExcludeNameRegex)
 }
 
 type entraSettings struct {
@@ -143,8 +155,8 @@ var errCancel = trace.BadParameter("operation canceled")
 
 func (p *PluginsCommand) entraSetupGuide(proxyPublicAddr string, manualEntraIDSetup bool) (entraSettings, error) {
 	if manualEntraIDSetup {
-		fmt.Fprint(os.Stdout, manualConfigurationTemplate)
-		settings, err := readAzureInputs(p.install.entraID.accessGraph)
+		fmt.Fprint(p.stdout, manualConfigurationTemplate)
+		settings, err := readAzureInputs(p.install.entraID.accessGraph, p.stdin, p.stdout)
 		return settings, trace.Wrap(err)
 	}
 
@@ -173,9 +185,9 @@ func (p *PluginsCommand) entraSetupGuide(proxyPublicAddr string, manualEntraIDSe
 	}
 	fileLoc := f.Name()
 
-	fmt.Fprintf(os.Stdout, step1Template, fileLoc, filepath.Base(fileLoc))
+	fmt.Fprintf(p.stdout, step1Template, fileLoc, filepath.Base(fileLoc))
 
-	op, err := readData(os.Stdin, os.Stdout,
+	op, err := readData(p.stdin, p.stdout,
 		`Once the script completes, type 'continue' to proceed, 'exit' to quit`,
 		func(input string) bool {
 			return input == "continue" || input == "exit"
@@ -187,25 +199,25 @@ func (p *PluginsCommand) entraSetupGuide(proxyPublicAddr string, manualEntraIDSe
 		return entraSettings{}, errCancel
 	}
 
-	fmt.Fprint(os.Stdout, step2Template)
+	fmt.Fprint(p.stdout, step2Template)
 
-	settings, err := readAzureInputs(p.install.entraID.accessGraph)
+	settings, err := readAzureInputs(p.install.entraID.accessGraph, p.stdin, p.stdout)
 	return settings, trace.Wrap(err)
 }
 
-func readAzureInputs(acessGraph bool) (entraSettings, error) {
+func readAzureInputs(acessGraph bool, r io.Reader, w io.Writer) (entraSettings, error) {
 	validUUID := func(input string) bool {
 		_, err := uuid.Parse(input)
 		return err == nil
 	}
 	var settings entraSettings
 	var err error
-	settings.tenantID, err = readData(os.Stdin, os.Stdout, "Enter the Tenant ID", validUUID, "Invalid Tenant ID")
+	settings.tenantID, err = readData(r, w, "Enter the Tenant ID", validUUID, "Invalid Tenant ID")
 	if err != nil {
 		return settings, trace.Wrap(err, "failed to read Tenant ID")
 	}
 
-	settings.clientID, err = readData(os.Stdin, os.Stdout, "Enter the Client ID", validUUID, "Invalid Client ID")
+	settings.clientID, err = readData(r, w, "Enter the Client ID", validUUID, "Invalid Client ID")
 	if err != nil {
 		return settings, trace.Wrap(err, "failed to read Client ID")
 	}
@@ -215,7 +227,7 @@ func readAzureInputs(acessGraph bool) (entraSettings, error) {
 			settings.accessGraphCache, err = readTAGCache(input)
 			return err == nil
 		}
-		_, err = readData(os.Stdin, os.Stdout, "Enter the Access Graph Cache file location", dataValidator, "File does not exist or is invalid")
+		_, err = readData(r, w, "Enter the Access Graph Cache file location", dataValidator, "File does not exist or is invalid")
 		if err != nil {
 			return settings, trace.Wrap(err, "failed to read Access Graph Cache file")
 		}
@@ -239,8 +251,14 @@ func readAzureInputs(acessGraph bool) (entraSettings, error) {
 // system credentials for EntraID authentication.
 // Finally, if no system credentials are in use, the script will set up an Azure OIDC integration
 // in Teleport and a Teleport plugin to synchronize access lists from EntraID to Teleport.
-func (p *PluginsCommand) InstallEntra(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) InstallEntra(ctx context.Context, args pluginServices) error {
 	inputs := p.install
+	if p.stdin == nil {
+		p.stdin = os.Stdin
+	}
+	if p.stdout == nil {
+		p.stdout = os.Stdout
+	}
 
 	proxyPublicAddr, err := getProxyPublicAddr(ctx, args.authClient)
 	if err != nil {
@@ -330,6 +348,12 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args installPluginArg
 	if inputs.entraID.useSystemCredentials {
 		credentialsSource = types.EntraIDCredentialsSource_ENTRAID_CREDENTIALS_SOURCE_SYSTEM_CREDENTIALS
 	}
+
+	groupFilters, err := filter.NewFromInputs(inputs.entraID.groupFilters)
+	if err != nil {
+		return trace.Wrap(err, "failed to read filters")
+	}
+
 	req := &pluginspb.CreatePluginRequest{
 		Plugin: &types.PluginV1{
 			Metadata: types.Metadata{
@@ -347,6 +371,7 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args installPluginArg
 							CredentialsSource: credentialsSource,
 							TenantId:          settings.tenantID,
 							EntraAppId:        settings.clientID,
+							GroupFilters:      groupFilters,
 						},
 						AccessGraphSettings: tagSyncSettings,
 					},
diff --git a/tool/tctl/common/plugin/entraid_test.go b/tool/tctl/common/plugin/entraid_test.go
new file mode 100644
index 0000000000000..6c8f2a80ebe58
--- /dev/null
+++ b/tool/tctl/common/plugin/entraid_test.go
@@ -0,0 +1,166 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package plugin
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/plugins/filter"
+)
+
+func TestEntraIDGroupFilters(t *testing.T) {
+	testCases := []struct {
+		name            string
+		groupFilters    filter.Inputs
+		expectedFilters []*types.PluginSyncFilter
+		errorAssertion  require.ErrorAssertionFunc
+	}{
+		{
+			name:            "empty filter",
+			expectedFilters: []*types.PluginSyncFilter{},
+			errorAssertion:  require.NoError,
+		},
+		{
+			name: "valid filters",
+			groupFilters: filter.Inputs{
+				ID:               []string{"id1"},
+				NameRegex:        []string{"a*"},
+				ExcludeID:        []string{"id2"},
+				ExcludeNameRegex: []string{"b*"},
+			},
+			expectedFilters: []*types.PluginSyncFilter{
+				{Include: &types.PluginSyncFilter_Id{Id: "id1"}},
+				{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "a*"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: "id2"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "b*"}},
+			},
+			errorAssertion: require.NoError,
+		},
+		{
+			name: "valid multiple filters",
+			groupFilters: filter.Inputs{
+				ID:               []string{"id1", "id2"},
+				NameRegex:        []string{"a*", "b*"},
+				ExcludeID:        []string{"id3", "id4"},
+				ExcludeNameRegex: []string{"b*", "c*"},
+			},
+			expectedFilters: []*types.PluginSyncFilter{
+				{Include: &types.PluginSyncFilter_Id{Id: "id1"}},
+				{Include: &types.PluginSyncFilter_Id{Id: "id2"}},
+				{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "a*"}},
+				{Include: &types.PluginSyncFilter_NameRegex{NameRegex: "b*"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: "id3"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeId{ExcludeId: "id4"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "b*"}},
+				{Exclude: &types.PluginSyncFilter_ExcludeNameRegex{ExcludeNameRegex: "c*"}},
+			},
+			errorAssertion: require.NoError,
+		},
+		{
+			name: "empty include id string",
+			groupFilters: filter.Inputs{
+				ID: []string{""},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "bad regex",
+			groupFilters: filter.Inputs{
+				NameRegex: []string{"^[)$"},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "bad exclude regex",
+			groupFilters: filter.Inputs{
+				ExcludeNameRegex: []string{"^[)$"},
+			},
+			errorAssertion: require.Error,
+		},
+		{
+			name: "empty exclude id string",
+			groupFilters: filter.Inputs{
+				ExcludeID: []string{""},
+			},
+			errorAssertion: require.Error,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			authClient := &mockAuthClient{}
+			authClient.
+				On("Ping", anyContext).
+				Return(proto.PingResponse{
+					ProxyPublicAddr: "example.com",
+				}, nil)
+			authClient.
+				On("CreateSAMLConnector", anyContext, mock.Anything).
+				Return(&types.SAMLConnectorV2{}, nil)
+
+			pluginsClient := &mockPluginsClient{}
+			pluginsClient.
+				On("CreatePlugin", anyContext, mock.Anything, mock.Anything).
+				Run(func(args mock.Arguments) {
+					require.IsType(t, (*pluginsv1.CreatePluginRequest)(nil), args.Get(1))
+					request := args.Get(1).(*pluginsv1.CreatePluginRequest)
+					require.Empty(t, cmp.Diff(test.expectedFilters, request.GetPlugin().Spec.GetEntraId().SyncSettings.GroupFilters))
+				}).
+				Return(&emptypb.Empty{}, nil)
+			pluginArgs := pluginServices{
+				authClient: authClient,
+				plugins:    pluginsClient,
+			}
+
+			var output bytes.Buffer
+			var tenantID, clientID bytes.Buffer
+			_, err := io.WriteString(&tenantID, "55fe2b7f-85c7-43c6-a8ba-897ce8570503\n")
+			require.NoError(t, err)
+			_, err = io.WriteString(&clientID, "3658a550-f173-44fa-a670-74b9fd7e3ae7\n")
+			require.NoError(t, err)
+			inputs := io.MultiReader(&tenantID, &clientID)
+
+			cmd := PluginsCommand{
+				install: pluginInstallArgs{
+					name: "entra-id-default",
+					entraID: entraArgs{
+						authConnectorName:    "fake-saml-connector",
+						accessGraph:          false,
+						manualEntraIDSetup:   true,
+						useSystemCredentials: true,
+						groupFilters:         test.groupFilters,
+					},
+				},
+				stdin:  inputs,
+				stdout: &output,
+			}
+
+			err = cmd.InstallEntra(t.Context(), pluginArgs)
+			test.errorAssertion(t, err)
+		})
+	}
+}
diff --git a/tool/tctl/common/plugin/github.go b/tool/tctl/common/plugin/github.go
index 7d233e46ab546..38095041c87ea 100644
--- a/tool/tctl/common/plugin/github.go
+++ b/tool/tctl/common/plugin/github.go
@@ -40,7 +40,7 @@ type githubArgs struct {
 func (p *PluginsCommand) initInstallGithub(parent *kingpin.CmdClause) {
 	p.install.github.cmd = parent.Command("github", "Install an Access Graph Github integration.")
 	p.install.github.cmd.Flag("start-date", "Start date for the audit log ingest in the YYYY-MM-DD format.").
-		Default(time.Now().Add(10 * 24 * time.Hour).UTC().Format(time.DateOnly)).
+		Default(time.Now().Add(-10 * 24 * time.Hour).UTC().Format(time.DateOnly)).
 		StringVar(&p.install.github.startDate)
 }
 
@@ -98,7 +98,7 @@ func (p *PluginsCommand) gitubSetupGuide(ctx context.Context) (githubSettings, e
 	return settings, nil
 }
 
-func (p *PluginsCommand) InstallGithub(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) InstallGithub(ctx context.Context, args pluginServices) error {
 	settings, err := p.gitubSetupGuide(ctx)
 	if err != nil {
 		if errors.Is(err, errCancel) {
diff --git a/tool/tctl/common/plugin/mocks_test.go b/tool/tctl/common/plugin/mocks_test.go
new file mode 100644
index 0000000000000..336d57cfde5f2
--- /dev/null
+++ b/tool/tctl/common/plugin/mocks_test.go
@@ -0,0 +1,125 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package plugin
+
+import (
+	"context"
+
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/types"
+)
+
+type mockPluginsClient struct {
+	mock.Mock
+}
+
+func (m *mockPluginsClient) CreatePlugin(ctx context.Context, in *pluginsv1.CreatePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*emptypb.Empty), result.Error(1)
+}
+
+func (m *mockPluginsClient) GetPlugin(ctx context.Context, in *pluginsv1.GetPluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*types.PluginV1), result.Error(1)
+}
+
+func (m *mockPluginsClient) UpdatePlugin(ctx context.Context, in *pluginsv1.UpdatePluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*types.PluginV1), result.Error(1)
+}
+
+func (m *mockPluginsClient) NeedsCleanup(ctx context.Context, in *pluginsv1.NeedsCleanupRequest, opts ...grpc.CallOption) (*pluginsv1.NeedsCleanupResponse, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*pluginsv1.NeedsCleanupResponse), result.Error(1)
+}
+
+func (m *mockPluginsClient) Cleanup(ctx context.Context, in *pluginsv1.CleanupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*emptypb.Empty), result.Error(1)
+}
+
+func (m *mockPluginsClient) DeletePlugin(ctx context.Context, in *pluginsv1.DeletePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	result := m.Called(ctx, in, opts)
+	return result.Get(0).(*emptypb.Empty), result.Error(1)
+}
+
+func (m *mockPluginsClient) UpdatePluginStaticCredentials(ctx context.Context, in *pluginsv1.UpdatePluginStaticCredentialsRequest, opts ...grpc.CallOption) (*pluginsv1.UpdatePluginStaticCredentialsResponse, error) {
+	result := m.Called(ctx, in, opts)
+	var response *pluginsv1.UpdatePluginStaticCredentialsResponse
+
+	if fn, ok := result.Get(0).(func(context.Context, *pluginsv1.UpdatePluginStaticCredentialsRequest, ...grpc.CallOption) (*pluginsv1.UpdatePluginStaticCredentialsResponse, error)); ok {
+		return fn(ctx, in, opts...)
+	}
+
+	if r, ok := result.Get(0).(*pluginsv1.UpdatePluginStaticCredentialsResponse); ok {
+		response = r
+	}
+	return response, result.Error(1)
+}
+
+type mockAuthClient struct {
+	mock.Mock
+}
+
+func (m *mockAuthClient) GetSAMLConnector(ctx context.Context, id string, withSecrets bool) (types.SAMLConnector, error) {
+	result := m.Called(ctx, id, withSecrets)
+	return result.Get(0).(types.SAMLConnector), result.Error(1)
+}
+func (m *mockAuthClient) CreateSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error) {
+	result := m.Called(ctx, connector)
+	return result.Get(0).(types.SAMLConnector), result.Error(1)
+}
+func (m *mockAuthClient) UpsertSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error) {
+	result := m.Called(ctx, connector)
+	return result.Get(0).(types.SAMLConnector), result.Error(1)
+}
+func (m *mockAuthClient) CreateIntegration(ctx context.Context, ig types.Integration) (types.Integration, error) {
+	result := m.Called(ctx, ig)
+	return result.Get(0).(types.Integration), result.Error(1)
+}
+func (m *mockAuthClient) UpdateIntegration(ctx context.Context, ig types.Integration) (types.Integration, error) {
+	result := m.Called(ctx, ig)
+	return result.Get(0).(types.Integration), result.Error(1)
+}
+
+func (m *mockAuthClient) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+	result := m.Called(ctx, name)
+	return result.Get(0).(types.Integration), result.Error(1)
+}
+
+func (m *mockAuthClient) Ping(ctx context.Context) (proto.PingResponse, error) {
+	result := m.Called(ctx)
+	return result.Get(0).(proto.PingResponse), result.Error(1)
+}
+
+func (m *mockAuthClient) PerformMFACeremony(ctx context.Context, challengeRequest *proto.CreateAuthenticateChallengeRequest, promptOpts ...mfa.PromptOpt) (*proto.MFAAuthenticateResponse, error) {
+	return &proto.MFAAuthenticateResponse{}, nil
+}
+
+func (m *mockAuthClient) GetRole(ctx context.Context, name string) (types.Role, error) {
+	result := m.Called(ctx, name)
+	return result.Get(0).(types.Role), result.Error(1)
+}
+
+// anyContext is an argument matcher for testify mocks that matches any context.
+var anyContext any = mock.MatchedBy(func(context.Context) bool { return true })
diff --git a/tool/tctl/common/plugin/netiq.go b/tool/tctl/common/plugin/netiq.go
index 66bdb891317a1..80956bf776df2 100644
--- a/tool/tctl/common/plugin/netiq.go
+++ b/tool/tctl/common/plugin/netiq.go
@@ -172,7 +172,7 @@ func (p *PluginsCommand) netIQSetupGuide(ctx context.Context) (netIQSettings, er
 	return settings, nil
 }
 
-func (p *PluginsCommand) InstallNetIQ(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) InstallNetIQ(ctx context.Context, args pluginServices) error {
 	settings, err := p.netIQSetupGuide(ctx)
 	if err != nil {
 		if errors.Is(err, errCancel) {
diff --git a/tool/tctl/common/plugin/okta.go b/tool/tctl/common/plugin/okta.go
index e0871211a63b2..1f85e9eaa11fd 100644
--- a/tool/tctl/common/plugin/okta.go
+++ b/tool/tctl/common/plugin/okta.go
@@ -112,7 +112,7 @@ type oktaArgs struct {
 	autoGeneratedSCIMToken bool
 }
 
-func (s *oktaArgs) validateAndCheckDefaults(ctx context.Context, args *installPluginArgs) error {
+func (s *oktaArgs) validateAndCheckDefaults(ctx context.Context, args *pluginServices) error {
 	if s.apiToken == "" {
 		if !s.scimEnabled {
 			return trace.BadParameter("API token is required")
@@ -169,7 +169,7 @@ func (s *oktaArgs) validateAndCheckDefaults(ctx context.Context, args *installPl
 	return nil
 }
 
-func (p *PluginsCommand) InstallOkta(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) InstallOkta(ctx context.Context, args pluginServices) error {
 	oktaSettings := p.install.okta
 	if err := oktaSettings.validateAndCheckDefaults(ctx, &args); err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tctl/common/plugin/plugins_command.go b/tool/tctl/common/plugin/plugins_command.go
index 427b1cca34c0c..4c4a6cc4b9984 100644
--- a/tool/tctl/common/plugin/plugins_command.go
+++ b/tool/tctl/common/plugin/plugins_command.go
@@ -21,15 +21,16 @@ package plugin
 import (
 	"context"
 	"fmt"
+	"io"
 	"log/slog"
+	"net/http"
+	"os"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
-	"golang.org/x/crypto/bcrypt"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
 
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	"github.com/gravitational/teleport/api/mfa"
@@ -39,12 +40,6 @@ import (
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 )
 
-const (
-	logFieldPlugin        = "plugin"
-	logFieldSAMLConnector = "saml_connector"
-	logFieldRole          = "role"
-)
-
 func logErrorMessage(err error) slog.Attr {
 	const logFieldError = "err"
 	return slog.String(logFieldError, err.Error())
@@ -57,16 +52,20 @@ type pluginInstallArgs struct {
 	scim    scimArgs
 	entraID entraArgs
 	netIQ   netIQArgs
-	awsIC   awsICArgs
+	awsIC   awsICInstallArgs
 	github  githubArgs
 }
 
+type pluginEditArgs struct {
+	cmd   *kingpin.CmdClause
+	awsIC awsICEditArgs
+}
+
 type scimArgs struct {
 	cmd           *kingpin.CmdClause
-	samlConnector string
-	token         string
-	role          string
-	force         bool
+	connector     string
+	connectorType string
+	auth          string
 }
 
 type pluginDeleteArgs struct {
@@ -74,20 +73,38 @@ type pluginDeleteArgs struct {
 	name string
 }
 
+type pluginRotateCredsArgs struct {
+	cmd   *kingpin.CmdClause
+	awsic awsICRotateCredsArgs
+}
+
 // PluginsCommand allows for management of plugins.
 type PluginsCommand struct {
-	config     *servicecfg.Config
-	cleanupCmd *kingpin.CmdClause
-	pluginType string
-	dryRun     bool
-	install    pluginInstallArgs
-	delete     pluginDeleteArgs
+	config      *servicecfg.Config
+	cleanupCmd  *kingpin.CmdClause
+	pluginType  string
+	dryRun      bool
+	install     pluginInstallArgs
+	delete      pluginDeleteArgs
+	edit        pluginEditArgs
+	rotateCreds pluginRotateCredsArgs
+
+	// optional input and output buffer
+	// for tests.
+	stdin  io.Reader
+	stdout io.Writer
 }
 
 // Initialize creates the plugins command and subcommands
 func (p *PluginsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
 	p.config = config
 	p.dryRun = true
+	if p.stdin == nil {
+		p.stdin = os.Stdin
+	}
+	if p.stdout == nil {
+		p.stdout = os.Stdout
+	}
 
 	pluginsCommand := app.Command("plugins", "Manage Teleport plugins.").Hidden()
 
@@ -97,6 +114,8 @@ func (p *PluginsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalC
 
 	p.initInstall(pluginsCommand, config)
 	p.initDelete(pluginsCommand)
+	p.initEdit(pluginsCommand)
+	p.initRotateCreds(pluginsCommand)
 }
 
 func (p *PluginsCommand) initInstall(parent *kingpin.CmdClause, config *servicecfg.Config) {
@@ -110,34 +129,6 @@ func (p *PluginsCommand) initInstall(parent *kingpin.CmdClause, config *servicec
 	p.initInstallGithub(p.install.cmd)
 }
 
-func (p *PluginsCommand) initInstallSCIM(parent *kingpin.CmdClause) {
-	p.install.scim.cmd = p.install.cmd.Command("scim", "Install a new SCIM integration.")
-	p.install.scim.cmd.
-		Flag("name", "The name of the SCIM plugin resource to create").
-		Default("scim").
-		StringVar(&p.install.name)
-	p.install.scim.cmd.
-		Flag("saml-connector", "The name of the Teleport SAML connector users will log in with.").
-		Required().
-		StringVar(&p.install.scim.samlConnector)
-	p.install.scim.cmd.
-		Flag("role", "The Teleport role to assign users created by the plugin").
-		Short('r').
-		Default(teleport.PresetRequesterRoleName).
-		StringVar(&p.install.scim.role)
-	p.install.scim.cmd.
-		Flag("token", "The bearer token used by the SCIM client to authenticate").
-		Short('t').
-		Required().
-		Envar("TELEPORT_SCIM_BEARER_TOKEN").
-		StringVar(&p.install.scim.token)
-	p.install.scim.cmd.
-		Flag("force", "Proceed with installation even if validation fails").
-		Short('f').
-		Default("false").
-		BoolVar(&p.install.scim.force)
-}
-
 func (p *PluginsCommand) initDelete(parent *kingpin.CmdClause) {
 	p.delete.cmd = parent.Command("delete", "Remove a plugin instance.")
 	p.delete.cmd.
@@ -145,8 +136,13 @@ func (p *PluginsCommand) initDelete(parent *kingpin.CmdClause) {
 		StringVar(&p.delete.name)
 }
 
+func (p *PluginsCommand) initEdit(parent *kingpin.CmdClause) {
+	p.edit.cmd = parent.Command("edit", "Edits a plugin's or an integration's settings")
+	p.initEditAWSIC(p.edit.cmd)
+}
+
 // Delete implements `tctl plugins delete`, deleting a plugin from the Teleport cluster
-func (p *PluginsCommand) Delete(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) Delete(ctx context.Context, args pluginServices) error {
 	log := p.config.Logger.With("plugin", p.delete.name)
 
 	req := &pluginsv1.DeletePluginRequest{Name: p.delete.name}
@@ -162,7 +158,7 @@ func (p *PluginsCommand) Delete(ctx context.Context, args installPluginArgs) err
 }
 
 // Cleanup cleans up the given plugin.
-func (p *PluginsCommand) Cleanup(ctx context.Context, args installPluginArgs) error {
+func (p *PluginsCommand) Cleanup(ctx context.Context, args pluginServices) error {
 	needsCleanup, err := args.plugins.NeedsCleanup(ctx, &pluginsv1.NeedsCleanupRequest{
 		Type: p.pluginType,
 	})
@@ -206,6 +202,12 @@ func (p *PluginsCommand) Cleanup(ctx context.Context, args installPluginArgs) er
 	return nil
 }
 
+func (p *PluginsCommand) initRotateCreds(parent *kingpin.CmdClause) {
+	p.rotateCreds.cmd = parent.Command("rotate", "Rotates a plugin's credentials.")
+
+	p.initRotateCredsAWSIC(p.rotateCreds.cmd)
+}
+
 type authClient interface {
 	GetSAMLConnector(ctx context.Context, id string, withSecrets bool) (types.SAMLConnector, error)
 	CreateSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error)
@@ -225,104 +227,18 @@ type pluginsClient interface {
 	NeedsCleanup(ctx context.Context, in *pluginsv1.NeedsCleanupRequest, opts ...grpc.CallOption) (*pluginsv1.NeedsCleanupResponse, error)
 	Cleanup(ctx context.Context, in *pluginsv1.CleanupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	DeletePlugin(ctx context.Context, in *pluginsv1.DeletePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	UpdatePluginStaticCredentials(ctx context.Context, in *pluginsv1.UpdatePluginStaticCredentialsRequest, opts ...grpc.CallOption) (*pluginsv1.UpdatePluginStaticCredentialsResponse, error)
 }
 
-type installPluginArgs struct {
-	authClient authClient
-	plugins    pluginsClient
-}
-
-// InstallSCIM implements `tctl plugins install scim`, installing a SCIM integration
-// plugin into the teleport cluster
-func (p *PluginsCommand) InstallSCIM(ctx context.Context, args installPluginArgs) error {
-	log := p.config.Logger.With(logFieldPlugin, p.install.name)
-
-	log.DebugContext(ctx, "Fetching cluster info...")
-	info, err := args.authClient.Ping(ctx)
-	if err != nil {
-		return trace.Wrap(err, "failed fetching cluster info")
-	}
-
-	scimBaseURL := fmt.Sprintf("https://%s/v1/webapi/scim/%s", info.ProxyPublicAddr, p.install.name)
-
-	scimTokenHash, err := bcrypt.GenerateFromPassword([]byte(p.install.scim.token), bcrypt.DefaultCost)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	connectorID := p.install.scim.samlConnector
-	log.DebugContext(ctx, "Validating SAML Connector...", logFieldSAMLConnector, connectorID)
-	connector, err := args.authClient.GetSAMLConnector(ctx, p.install.scim.samlConnector, false)
-	if err != nil {
-		if !p.install.scim.force {
-			return trace.Wrap(err, "failed validating SAML connector")
-		}
-	}
-
-	role := p.install.scim.role
-	log.DebugContext(ctx, "Validating Default Role...", logFieldRole, role)
-	if _, err := args.authClient.GetRole(ctx, role); err != nil {
-		if !p.install.scim.force {
-			return trace.Wrap(err, "failed validating role")
-		}
-	}
-
-	request := &pluginsv1.CreatePluginRequest{
-		Plugin: &types.PluginV1{
-			SubKind: types.PluginSubkindProvisioning,
-			Metadata: types.Metadata{
-				Labels: map[string]string{
-					types.HostedPluginLabel: "true",
-					types.SCIMBaseURLLabel:  scimBaseURL,
-				},
-				Name: p.install.name,
-			},
-			Spec: types.PluginSpecV1{
-				Settings: &types.PluginSpecV1_Scim{
-					Scim: &types.PluginSCIMSettings{
-						SamlConnectorName: p.install.scim.samlConnector,
-						DefaultRole:       p.install.scim.role,
-					},
-				},
-			},
-		},
-		StaticCredentials: &types.PluginStaticCredentialsV1{
-			ResourceHeader: types.ResourceHeader{
-				Metadata: types.Metadata{
-					Name: p.install.name,
-				},
-			},
-			Spec: &types.PluginStaticCredentialsSpecV1{
-				Credentials: &types.PluginStaticCredentialsSpecV1_APIToken{
-					APIToken: string(scimTokenHash),
-				},
-			},
-		},
-	}
-
-	log.DebugContext(ctx, "Creating SCIM Plugin...")
-	if _, err := args.plugins.CreatePlugin(ctx, request); err != nil {
-		log.ErrorContext(ctx, "Failed to create SCIM integration", logErrorMessage(err))
-		return trace.Wrap(err)
-	}
-
-	fmt.Printf("Successfully created SCIM plugin %q\n", p.install.name)
-	fmt.Printf("SCIM base URL: %s\n", scimBaseURL)
-
-	if connector == nil {
-		return nil
-	}
-
-	switch connector.Origin() {
-	case types.OriginOkta:
-		fmt.Println("Follow this guide to configure SCIM provisioning on Okta side: https://goteleport.com/docs/application-access/okta/hosted-guide/#configuring-scim-provisioning")
-	}
-	return nil
+type pluginServices struct {
+	authClient   authClient
+	plugins      pluginsClient
+	httpProvider http.RoundTripper
 }
 
 // TryRun runs the plugins command
 func (p *PluginsCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
-	var commandFunc func(ctx context.Context, args installPluginArgs) error
+	var commandFunc func(ctx context.Context, args pluginServices) error
 	switch cmd {
 	case p.cleanupCmd.FullCommand():
 		commandFunc = p.Cleanup
@@ -340,6 +256,10 @@ func (p *PluginsCommand) TryRun(ctx context.Context, cmd string, clientFunc comm
 		commandFunc = p.InstallGithub
 	case p.delete.cmd.FullCommand():
 		commandFunc = p.Delete
+	case p.edit.awsIC.cmd.FullCommand():
+		commandFunc = p.EditAWSIC
+	case p.rotateCreds.awsic.cmd.FullCommand():
+		commandFunc = p.RotateAWSICCreds
 	default:
 		return false, nil
 	}
@@ -347,7 +267,12 @@ func (p *PluginsCommand) TryRun(ctx context.Context, cmd string, clientFunc comm
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
-	err = commandFunc(ctx, installPluginArgs{authClient: client, plugins: client.PluginsClient()})
+	args := pluginServices{
+		authClient:   client,
+		plugins:      client.PluginsClient(),
+		httpProvider: http.DefaultTransport,
+	}
+	err = commandFunc(ctx, args)
 	closeFn(ctx)
 
 	return true, trace.Wrap(err)
diff --git a/tool/tctl/common/plugin/plugins_command_test.go b/tool/tctl/common/plugin/plugins_command_test.go
index 6b472bfa5ab31..8566f83ba7dc8 100644
--- a/tool/tctl/common/plugin/plugins_command_test.go
+++ b/tool/tctl/common/plugin/plugins_command_test.go
@@ -27,12 +27,10 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
-	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 )
@@ -503,7 +501,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			var args installPluginArgs
+			var args pluginServices
 
 			if testCase.expectRequest != nil {
 				pluginsClient := &mockPluginsClient{}
@@ -552,9 +550,14 @@ func TestPluginsInstallOkta(t *testing.T) {
 	}
 }
 
-func requireBadParameter(t require.TestingT, err error, _ ...any) {
-	require.Error(t, err)
-	require.True(t, trace.IsBadParameter(err), "Expecting bad parameter, got %T: \"%v\"", err, err)
+func requireBadParameter(t require.TestingT, err error, msgAndArgs ...any) {
+	var bpe *trace.BadParameterError
+	require.ErrorAs(t, err, &bpe, msgAndArgs...)
+}
+
+func requireAccessDenied(t require.TestingT, err error, msgAndArgs ...any) {
+	var ade *trace.AccessDeniedError
+	require.ErrorAs(t, err, &ade, msgAndArgs...)
 }
 
 func mustParseURL(text string) *url.URL {
@@ -564,84 +567,3 @@ func mustParseURL(text string) *url.URL {
 	}
 	return url
 }
-
-type mockPluginsClient struct {
-	mock.Mock
-}
-
-func (m *mockPluginsClient) CreatePlugin(ctx context.Context, in *pluginsv1.CreatePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*emptypb.Empty), result.Error(1)
-}
-
-func (m *mockPluginsClient) GetPlugin(ctx context.Context, in *pluginsv1.GetPluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*types.PluginV1), result.Error(1)
-}
-
-func (m *mockPluginsClient) UpdatePlugin(ctx context.Context, in *pluginsv1.UpdatePluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*types.PluginV1), result.Error(1)
-}
-
-func (m *mockPluginsClient) NeedsCleanup(ctx context.Context, in *pluginsv1.NeedsCleanupRequest, opts ...grpc.CallOption) (*pluginsv1.NeedsCleanupResponse, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*pluginsv1.NeedsCleanupResponse), result.Error(1)
-}
-
-func (m *mockPluginsClient) Cleanup(ctx context.Context, in *pluginsv1.CleanupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*emptypb.Empty), result.Error(1)
-}
-
-func (m *mockPluginsClient) DeletePlugin(ctx context.Context, in *pluginsv1.DeletePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	result := m.Called(ctx, in, opts)
-	return result.Get(0).(*emptypb.Empty), result.Error(1)
-}
-
-type mockAuthClient struct {
-	mock.Mock
-}
-
-func (m *mockAuthClient) GetSAMLConnector(ctx context.Context, id string, withSecrets bool) (types.SAMLConnector, error) {
-	result := m.Called(ctx, id, withSecrets)
-	return result.Get(0).(types.SAMLConnector), result.Error(1)
-}
-func (m *mockAuthClient) CreateSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error) {
-	result := m.Called(ctx, connector)
-	return result.Get(0).(types.SAMLConnector), result.Error(1)
-}
-func (m *mockAuthClient) UpsertSAMLConnector(ctx context.Context, connector types.SAMLConnector) (types.SAMLConnector, error) {
-	result := m.Called(ctx, connector)
-	return result.Get(0).(types.SAMLConnector), result.Error(1)
-}
-func (m *mockAuthClient) CreateIntegration(ctx context.Context, ig types.Integration) (types.Integration, error) {
-	result := m.Called(ctx, ig)
-	return result.Get(0).(types.Integration), result.Error(1)
-}
-func (m *mockAuthClient) UpdateIntegration(ctx context.Context, ig types.Integration) (types.Integration, error) {
-	result := m.Called(ctx, ig)
-	return result.Get(0).(types.Integration), result.Error(1)
-}
-
-func (m *mockAuthClient) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
-	result := m.Called(ctx, name)
-	return result.Get(0).(types.Integration), result.Error(1)
-}
-
-func (m *mockAuthClient) Ping(ctx context.Context) (proto.PingResponse, error) {
-	result := m.Called(ctx)
-	return result.Get(0).(proto.PingResponse), result.Error(1)
-}
-
-func (m *mockAuthClient) PerformMFACeremony(ctx context.Context, challengeRequest *proto.CreateAuthenticateChallengeRequest, promptOpts ...mfa.PromptOpt) (*proto.MFAAuthenticateResponse, error) {
-	return &proto.MFAAuthenticateResponse{}, nil
-}
-
-func (m *mockAuthClient) GetRole(ctx context.Context, name string) (types.Role, error) {
-	result := m.Called(ctx, name)
-	return result.Get(0).(types.Role), result.Error(1)
-}
-
-// anyContext is an argument matcher for testify mocks that matches any context.
-var anyContext any = mock.MatchedBy(func(context.Context) bool { return true })
diff --git a/tool/tctl/common/plugin/scim.go b/tool/tctl/common/plugin/scim.go
new file mode 100644
index 0000000000000..5a4f4acaf8a72
--- /dev/null
+++ b/tool/tctl/common/plugin/scim.go
@@ -0,0 +1,205 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package plugin
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+var (
+	bearerAuthType = "bearer"
+	oauthAuthType  = "oauth"
+)
+
+var allAuthTypes = []string{
+	bearerAuthType,
+	oauthAuthType,
+}
+
+var supportedConnectors = []string{
+	types.KindOIDC,
+	types.KindSAML,
+}
+
+func (p *PluginsCommand) initInstallSCIM(parent *kingpin.CmdClause) {
+	p.install.scim.cmd = parent.Command("scim", "Install a Teleport SCIM plugin.")
+	cmd := p.install.scim.cmd
+
+	cmd.Flag("connector", "Name of the Teleport connector to use.").
+		Required().
+		StringVar(&p.install.scim.connector)
+
+	cmd.Flag("connector-type", "Type of the Teleport connector to use.").
+		EnumVar(&p.install.scim.connectorType, supportedConnectors...)
+
+	cmd.Flag("auth", "Plugin Authentication type.").
+		Default(oauthAuthType).
+		EnumVar(&p.install.scim.auth, allAuthTypes...)
+}
+
+// InstallSCIM implements `tctl plugins install scim`, installing a SCIM integration
+// plugin into the teleport cluster
+func (p *PluginsCommand) InstallSCIM(ctx context.Context, args pluginServices) error {
+	scimArgs := p.install.scim
+
+	pluginName := types.PluginTypeSCIM
+	plugin := &types.PluginV1{
+		SubKind: types.PluginSubkindAccess,
+		Metadata: types.Metadata{
+			Labels: map[string]string{
+				"teleport.dev/hosted-plugin": "true",
+			},
+			Name: pluginName,
+		},
+		Spec: types.PluginSpecV1{
+			Settings: &types.PluginSpecV1_Scim{
+				Scim: &types.PluginSCIMSettings{
+					ConnectorInfo: &types.PluginSCIMSettings_ConnectorInfo{
+						Name: scimArgs.connector,
+						Type: scimArgs.connectorType,
+					},
+				},
+			},
+		},
+	}
+
+	creds, err := generateSCIMCredentials(scimArgs.auth)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	req := &pluginspb.CreatePluginRequest{
+		Plugin:                plugin,
+		StaticCredentialsList: []*types.PluginStaticCredentialsV1{creds.PluginStaticCredentialsV1},
+	}
+	if _, err := args.plugins.CreatePlugin(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	pingResp, err := args.authClient.Ping(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Printf("\nSCIM Plugin Installed Successfully\n")
+	if err := printSCIMIntegrationInfo(creds, pingResp, pluginName); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func printSCIMIntegrationInfo(creds *credsWrapper, pingResp proto.PingResponse, pluginName string) error {
+	scimBaseURL := fmt.Sprintf("https://%s/v1/webapi/scim/%s", pingResp.GetProxyPublicAddr(), pluginName)
+	fmt.Println(" Base URL:              ", scimBaseURL)
+
+	switch t := creds.Spec.Credentials.(type) {
+	case *types.PluginStaticCredentialsSpecV1_OAuthClientSecret:
+		scimTokenURL := fmt.Sprintf("https://%s/v1/webapi/plugin/%s/token", pingResp.GetProxyPublicAddr(), pluginName)
+		fmt.Println(" OAuth Token URL:       ", scimTokenURL)
+		fmt.Println(" OAuth Client ID:       ", t.OAuthClientSecret.ClientId)
+		fmt.Println(" OAuth Client Secret:   ", t.OAuthClientSecret.ClientSecret)
+	case *types.PluginStaticCredentialsSpecV1_APIToken:
+		fmt.Println(" API Bearer Token:      ", creds.rawToken)
+	default:
+		return trace.BadParameter("unsupported credentials type %T", creds.Spec.Credentials)
+	}
+	return nil
+}
+
+func buildOauthCreds(clientID, clientSecret string) *types.PluginStaticCredentialsV1 {
+	return &types.PluginStaticCredentialsV1{
+		ResourceHeader: types.ResourceHeader{
+			Metadata: types.Metadata{
+				Name: fmt.Sprintf("%s-%s", types.PluginTypeSCIM, uuid.NewString()),
+			},
+		},
+		Spec: &types.PluginStaticCredentialsSpecV1{Credentials: &types.PluginStaticCredentialsSpecV1_OAuthClientSecret{
+			OAuthClientSecret: &types.PluginStaticCredentialsOAuthClientSecret{
+				ClientId:     clientID,
+				ClientSecret: clientSecret,
+			},
+		}},
+	}
+}
+
+func buildBearerCreds(token string) *types.PluginStaticCredentialsV1 {
+	return &types.PluginStaticCredentialsV1{
+		ResourceHeader: types.ResourceHeader{
+			Metadata: types.Metadata{
+				Name: fmt.Sprintf("%s-%s", types.PluginTypeSCIM, uuid.NewString()),
+			},
+		},
+		Spec: &types.PluginStaticCredentialsSpecV1{
+			Credentials: &types.PluginStaticCredentialsSpecV1_APIToken{
+				APIToken: token,
+			},
+		},
+	}
+}
+
+type credsWrapper struct {
+	*types.PluginStaticCredentialsV1
+	// rawToken is the raw bearer token generated for the SCIM plugin
+	// in case of PluginStaticCredentialsSpecV1_APIToken.
+	// Note that value of APIToken is bcrypt hashed, so the raw token
+	// is used ot printed to the user.
+	rawToken string
+}
+
+func generateSCIMCredentials(authType string) (*credsWrapper, error) {
+	switch authType {
+	case oauthAuthType:
+		clientID, err := utils.CryptoRandomHex(16)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		clientSecret, err := utils.CryptoRandomHex(32)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &credsWrapper{
+			PluginStaticCredentialsV1: buildOauthCreds(clientID, clientSecret),
+		}, nil
+	case bearerAuthType:
+		bearerToken, err := utils.CryptoRandomHex(32)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		hashedToken, err := bcrypt.GenerateFromPassword([]byte(bearerToken), bcrypt.DefaultCost)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &credsWrapper{
+			PluginStaticCredentialsV1: buildBearerCreds(string(hashedToken)),
+			rawToken:                  bearerToken,
+		}, nil
+	default:
+		return nil, trace.BadParameter("unsupported auth type %q", authType)
+	}
+}
diff --git a/tool/tctl/common/proxy_command.go b/tool/tctl/common/proxy_command.go
index cd8f868fa77a1..fcb7bda7d1493 100644
--- a/tool/tctl/common/proxy_command.go
+++ b/tool/tctl/common/proxy_command.go
@@ -26,6 +26,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
@@ -52,7 +54,10 @@ func (p *ProxyCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI
 
 // ListProxies prints currently connected proxies
 func (p *ProxyCommand) ListProxies(ctx context.Context, clusterAPI *authclient.Client) error {
-	proxies, err := clusterAPI.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, clusterAPI.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return clusterAPI.GetProxies()
+	})
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/recordings_command.go b/tool/tctl/common/recordings_command.go
index f2a2fdae8dfed..f354451bf6262 100644
--- a/tool/tctl/common/recordings_command.go
+++ b/tool/tctl/common/recordings_command.go
@@ -21,6 +21,7 @@ package common
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 
 	"github.com/alecthomas/kingpin/v2"
@@ -47,6 +48,8 @@ type RecordingsCommand struct {
 	format string
 	// recordingsList implements the "tctl recordings ls" subcommand.
 	recordingsList *kingpin.CmdClause
+	// recordingsEncryption implements the "tctl recordings encryption" subcommand.
+	recordingsEncryption recordingsEncryptionCommand
 	// fromUTC is the start time to use for the range of recordings listed by the recorded session listing command
 	fromUTC string
 	// toUTC is the start time to use for the range of recordings listed by the recorded session listing command
@@ -55,10 +58,17 @@ type RecordingsCommand struct {
 	maxRecordingsToShow int
 	// recordingsSince is a duration which sets the time into the past in which to list session recordings
 	recordingsSince string
+
+	// stdout allows to switch standard output source for resource command. Used in tests.
+	stdout io.Writer
 }
 
 // Initialize allows RecordingsCommand to plug itself into the CLI parser
 func (c *RecordingsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
+	if c.stdout == nil {
+		c.stdout = os.Stdout
+	}
+
 	c.config = config
 	recordings := app.Command("recordings", "View and control session recordings.")
 	c.recordingsList = recordings.Command("ls", "List recorded sessions.")
@@ -67,6 +77,11 @@ func (c *RecordingsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Glob
 	c.recordingsList.Flag("to-utc", fmt.Sprintf("End of time range in which recordings are listed. Format %s. Defaults to current time.", defaults.TshTctlSessionListTimeFormat)).StringVar(&c.toUTC)
 	c.recordingsList.Flag("limit", fmt.Sprintf("Maximum number of recordings to show. Default %s.", defaults.TshTctlSessionListLimit)).Default(defaults.TshTctlSessionListLimit).IntVar(&c.maxRecordingsToShow)
 	c.recordingsList.Flag("last", "Duration into the past from which session recordings should be listed. Format 5h30m40s").StringVar(&c.recordingsSince)
+	c.recordingsEncryption.Initialize(recordings, c.stdout)
+
+	if c.recordingsEncryption.stdout == nil {
+		c.recordingsEncryption.stdout = c.stdout
+	}
 }
 
 // TryRun attempts to run subcommands like "recordings ls".
@@ -76,7 +91,7 @@ func (c *RecordingsCommand) TryRun(ctx context.Context, cmd string, clientFunc c
 	case c.recordingsList.FullCommand():
 		commandFunc = c.ListRecordings
 	default:
-		return false, nil
+		return c.recordingsEncryption.TryRun(ctx, cmd, clientFunc)
 	}
 	client, closeFn, err := clientFunc(ctx)
 	if err != nil {
@@ -103,5 +118,5 @@ func (c *RecordingsCommand) ListRecordings(ctx context.Context, tc *authclient.C
 	if err != nil {
 		return trace.Errorf("getting session events: %v", err)
 	}
-	return trace.Wrap(common.ShowSessions(recordings, c.format, os.Stdout))
+	return trace.Wrap(common.ShowSessions(recordings, c.format, c.stdout))
 }
diff --git a/tool/tctl/common/recordings_encryption_command.go b/tool/tctl/common/recordings_encryption_command.go
new file mode 100644
index 0000000000000..6f9290d745ad9
--- /dev/null
+++ b/tool/tctl/common/recordings_encryption_command.go
@@ -0,0 +1,207 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
+	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
+)
+
+type recordingsEncryptionCommand struct {
+	// cmd implements the "tctl recordings encryptino" parent command
+	cmd *kingpin.CmdClause
+
+	// rotateCmd implements the "tctl recordings encryption rotate" subcommand.
+	rotateCmd *kingpin.CmdClause
+
+	// statusCmd implements the "tctl recordings encryption status" subcommand.
+	statusCmd *kingpin.CmdClause
+
+	// completeCmd implements the "tctl recordings encryption complete" subcommand.
+	completeCmd *kingpin.CmdClause
+
+	// rollbackCmd implements the "tctl recordings encryption rollback" subcommand.
+	rollbackCmd *kingpin.CmdClause
+
+	// format is the output format of statusCmd (text, json, or yaml)
+	format string
+
+	// stdout allows for redirecting command output. Useful for tests.
+	stdout io.Writer
+}
+
+// Initialize allows recordingsEncryptionCommand to plug itself into the CLI parser.
+func (c *recordingsEncryptionCommand) Initialize(recordingsCmd *kingpin.CmdClause, stdout io.Writer) {
+	c.cmd = recordingsCmd.Command("encryption", "Manage encryption properties of session recordings.")
+
+	c.rotateCmd = c.cmd.Command("rotate", "Rotate encryption keys used for encrypting session recordings.")
+	c.statusCmd = c.cmd.Command("status", "Show current rotation status.")
+	c.statusCmd.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)+". Defaults to 'text'.").Default(teleport.Text).StringVar(&c.format)
+	c.completeCmd = c.cmd.Command("complete-rotation", "Completes an in-progress encryption key rotation.")
+	c.rollbackCmd = c.cmd.Command("rollback-rotation", "Rolls back an in-progress encryption key rotation.")
+	if stdout == nil {
+		c.stdout = os.Stdout
+	}
+}
+
+// TryRun attempts to run subcommands like "recordings encryption rotate".
+func (c *recordingsEncryptionCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
+	var commandFunc func(ctx context.Context, client *authclient.Client) error
+	switch cmd {
+	case c.rotateCmd.FullCommand():
+		commandFunc = c.Rotate
+	case c.statusCmd.FullCommand():
+		commandFunc = c.Status
+	case c.completeCmd.FullCommand():
+		commandFunc = c.Complete
+	case c.rollbackCmd.FullCommand():
+		commandFunc = c.Rollback
+	default:
+		return false, nil
+	}
+	client, closeFn, err := clientFunc(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	err = commandFunc(ctx, client)
+	closeFn(ctx)
+
+	return true, trace.Wrap(err)
+}
+
+// Rotate initiates a key rotation. It should fail if a key rotation is already
+// in progress.
+func (c *recordingsEncryptionCommand) Rotate(ctx context.Context, tc *authclient.Client) error {
+	client := tc.RecordingEncryptionServiceClient()
+	if _, err := client.RotateKey(ctx, &recordingencryptionv1.RotateKeyRequest{}); err != nil {
+		return trace.Errorf("rotating key encryption keys: %v", err)
+	}
+	fmt.Fprintln(c.stdout, "Rotation started")
+	return nil
+}
+
+// Complete an in progress key rotation. It should fail if any key is marked
+// 'inaccessible'.
+func (c *recordingsEncryptionCommand) Complete(ctx context.Context, tc *authclient.Client) error {
+	client := tc.RecordingEncryptionServiceClient()
+	if _, err := client.CompleteRotation(ctx, &recordingencryptionv1.CompleteRotationRequest{}); err != nil {
+		return trace.Errorf("completing encryption key rotation: %v", err)
+	}
+
+	fmt.Fprintln(c.stdout, "Rotation completed")
+	return nil
+}
+
+// Rollback an in progress key rotation.
+func (c *recordingsEncryptionCommand) Rollback(ctx context.Context, tc *authclient.Client) error {
+	client := tc.RecordingEncryptionServiceClient()
+	if _, err := client.RollbackRotation(ctx, &recordingencryptionv1.RollbackRotationRequest{}); err != nil {
+		return trace.Errorf("rolling back encryption key rotation: %v", err)
+	}
+
+	fmt.Fprintln(c.stdout, "Rotation rollback successful")
+	return nil
+}
+
+// Status displays the current rotation status of the active encryption keys.
+func (c *recordingsEncryptionCommand) Status(ctx context.Context, tc *authclient.Client) error {
+	client := tc.RecordingEncryptionServiceClient()
+	res, err := client.GetRotationState(ctx, &recordingencryptionv1.GetRotationStateRequest{})
+	if err != nil {
+		return trace.Errorf("fetching encryption key status: %v", err)
+	}
+
+	switch c.format {
+	case teleport.Text, "":
+		return trace.Wrap(c.writeStatusText(c.stdout, res.GetKeyPairStates()))
+	case teleport.YAML:
+		return trace.Wrap(c.writeStatusYAML(c.stdout, res.GetKeyPairStates()))
+	case teleport.JSON:
+		return trace.Wrap(c.writeStatusJSON(c.stdout, res.GetKeyPairStates()))
+	}
+
+	return trace.Wrap(err, "writing encryption key status")
+}
+
+func (c *recordingsEncryptionCommand) writeStatusJSON(w io.Writer, keyStates []*recordingencryptionv1.FingerprintWithState) error {
+	data, err := json.MarshalIndent(keyStates, "", "    ")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = w.Write(data)
+	return trace.Wrap(err)
+}
+
+func (c *recordingsEncryptionCommand) writeStatusYAML(w io.Writer, keyStates []*recordingencryptionv1.FingerprintWithState) error {
+	return trace.Wrap(utils.WriteYAML(w, keyStates))
+}
+
+func (c *recordingsEncryptionCommand) writeStatusText(w io.Writer, keyStates []*recordingencryptionv1.FingerprintWithState) error {
+	rotationState := recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_UNSPECIFIED
+	t := asciitable.MakeTable([]string{"Key Pair Fingerprint", "State"})
+	for _, pair := range keyStates {
+		if pair.State == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE {
+			rotationState = pair.State
+		}
+
+		if pair.State == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING {
+			if rotationState != recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE {
+				rotationState = pair.State
+			}
+		}
+
+		t.AddRow([]string{pair.Fingerprint, c.getFriendlyStatusString(pair.State)})
+	}
+
+	switch rotationState {
+	case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE:
+		fmt.Fprintln(w, "Rotation failed due to inaccessible key")
+	case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING:
+		fmt.Fprintln(w, "Rotation in progress")
+	}
+
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+func (c *recordingsEncryptionCommand) getFriendlyStatusString(state recordingencryptionv1.KeyPairState) string {
+	switch state {
+	case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING:
+		return "rotating"
+	case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE:
+		return "active"
+	case recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE:
+		return "inaccessible"
+	default:
+		return "unknown"
+	}
+}
diff --git a/tool/tctl/common/recordings_encryption_command_test.go b/tool/tctl/common/recordings_encryption_command_test.go
new file mode 100644
index 0000000000000..2e7faa64a5abf
--- /dev/null
+++ b/tool/tctl/common/recordings_encryption_command_test.go
@@ -0,0 +1,139 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestRecordingEncryptionKeyRotation(t *testing.T) {
+	dynAddr := helpers.NewDynamicServiceAddr(t)
+	fileConfig := &config.FileConfig{
+		Global: config.Global{
+			DataDir: t.TempDir(),
+		},
+		Auth: config.Auth{
+			Service: config.Service{
+				EnabledFlag:   "true",
+				ListenAddress: dynAddr.AuthAddr,
+			},
+			SessionRecordingConfig: &config.SessionRecordingConfig{
+				Mode: "node",
+				Encryption: &config.SessionRecordingEncryptionConfig{
+					Enabled: true,
+				},
+			},
+		},
+	}
+
+	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, clt.Close())
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	// get initial status to confirm one active key exists
+	keyStates := getEncryptionKeyStates(t, clt)
+	require.Len(t, keyStates, 1)
+	initialKeyState := keyStates[0]
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKeyState.State)
+
+	// start key rotation
+	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
+	require.NoError(t, err)
+
+	// refetch status to confirm original key is now 'rotating' and new key is 'active'
+	keyStates = getEncryptionKeyStates(t, clt)
+	require.Len(t, keyStates, 2)
+	rotatedKeyState := keyStates[0]
+	newKeyState := keyStates[1]
+
+	require.Equal(t, initialKeyState.Fingerprint, rotatedKeyState.Fingerprint)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.State)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+
+	// confirm a second rotation fails when one is already in progress
+	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
+	require.Error(t, err)
+
+	// rollback rotation
+	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rollback-rotation"})
+	require.NoError(t, err)
+
+	// ensure initial key is the only active key remaining
+	keyStates = getEncryptionKeyStates(t, clt)
+	require.Len(t, keyStates, 1)
+	newKeyState = keyStates[0]
+	require.Equal(t, initialKeyState.Fingerprint, newKeyState.Fingerprint)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+
+	// start a new rotation
+	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
+	require.NoError(t, err)
+
+	// confirm in progress rotation state
+	keyStates = getEncryptionKeyStates(t, clt)
+	require.Len(t, keyStates, 2)
+	rotatedKeyState = keyStates[0]
+	newKeyState = keyStates[1]
+	require.Equal(t, initialKeyState.Fingerprint, rotatedKeyState.Fingerprint)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.State)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+
+	// complete rotation
+	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "complete-rotation"})
+	require.NoError(t, err)
+
+	// ensure remaining active key is new
+	keyStates = getEncryptionKeyStates(t, clt)
+	require.Len(t, keyStates, 1)
+	finalKeyState := keyStates[0]
+	require.Equal(t, newKeyState.Fingerprint, finalKeyState.Fingerprint)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, finalKeyState.State)
+}
+
+func getEncryptionKeyStates(t *testing.T, client *authclient.Client) []*recordingencryptionv1.FingerprintWithState {
+	var keyStates []*recordingencryptionv1.FingerprintWithState
+	out, err := runRecordingsCommand(t, client, []string{"recordings", "encryption", "status", "--format", "json"})
+	require.NoError(t, err)
+	err = json.Unmarshal(out.Bytes(), &keyStates)
+	require.NoError(t, err)
+
+	return keyStates
+}
+
+func runRecordingsCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
+	var stdoutBuf bytes.Buffer
+	command := &RecordingsCommand{
+		stdout: &stdoutBuf,
+	}
+
+	return &stdoutBuf, runCommand(t, client, command, args)
+}
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index 2abe0999ef6a9..56e8a963197ff 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -54,11 +54,12 @@ import (
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
 	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/vnet/v1"
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
-	"github.com/gravitational/teleport/api/internalutils/stream"
+	apistream "github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
@@ -67,10 +68,14 @@ import (
 	"github.com/gravitational/teleport/api/types/externalauditstorage"
 	"github.com/gravitational/teleport/api/types/installers"
 	"github.com/gravitational/teleport/api/types/secreports"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/devicetrust"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
@@ -117,8 +122,8 @@ type ResourceCommand struct {
 	CreateHandlers map[ResourceKind]ResourceCreateHandler
 	UpdateHandlers map[ResourceKind]ResourceCreateHandler
 
-	// stdout allows to switch standard output source for resource command. Used in tests.
-	stdout io.Writer
+	// Stdout allows to switch standard output source for resource command. Used in tests.
+	Stdout io.Writer
 }
 
 const getHelp = `Examples:
@@ -185,9 +190,15 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Globa
 		types.KindAutoUpdateVersion:                  rc.createAutoUpdateVersion,
 		types.KindGitServer:                          rc.createGitServer,
 		types.KindAutoUpdateAgentRollout:             rc.createAutoUpdateAgentRollout,
+		types.KindAutoUpdateAgentReport:              rc.upsertAutoUpdateAgentReport,
 		types.KindWorkloadIdentityX509IssuerOverride: rc.createWorkloadIdentityX509IssuerOverride,
 		types.KindSigstorePolicy:                     rc.createSigstorePolicy,
 		types.KindHealthCheckConfig:                  rc.createHealthCheckConfig,
+		types.KindInferenceModel:                     rc.createInferenceModel,
+		types.KindInferenceSecret:                    rc.createInferenceSecret,
+		types.KindInferencePolicy:                    rc.createInferencePolicy,
+		scopedaccess.KindScopedRole:                  rc.createScopedRole,
+		scopedaccess.KindScopedRoleAssignment:        rc.createScopedRoleAssignment,
 	}
 	rc.UpdateHandlers = map[ResourceKind]ResourceCreateHandler{
 		types.KindUser:                               rc.updateUser,
@@ -210,9 +221,14 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Globa
 		types.KindDynamicWindowsDesktop:              rc.updateDynamicWindowsDesktop,
 		types.KindGitServer:                          rc.updateGitServer,
 		types.KindAutoUpdateAgentRollout:             rc.updateAutoUpdateAgentRollout,
+		types.KindAutoUpdateAgentReport:              rc.upsertAutoUpdateAgentReport,
 		types.KindWorkloadIdentityX509IssuerOverride: rc.updateWorkloadIdentityX509IssuerOverride,
 		types.KindSigstorePolicy:                     rc.updateSigstorePolicy,
 		types.KindHealthCheckConfig:                  rc.updateHealthCheckConfig,
+		types.KindInferenceModel:                     rc.updateInferenceModel,
+		types.KindInferencePolicy:                    rc.updateInferencePolicy,
+		scopedaccess.KindScopedRole:                  rc.updateScopedRole,
+		scopedaccess.KindScopedRoleAssignment:        rc.updateScopedRoleAssignment,
 	}
 	rc.config = config
 
@@ -237,7 +253,7 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Globa
 	<resource name>  Resource name to delete
 
 	Examples:
-	$ tctl rm connector/github
+	$ tctl rm role/devs
 	$ tctl rm cluster/main`).SetValue(&rc.ref)
 
 	rc.getCmd = app.Command("get", "Print a YAML declaration of various Teleport resources.")
@@ -249,8 +265,8 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Globa
 
 	rc.getCmd.Alias(getHelp)
 
-	if rc.stdout == nil {
-		rc.stdout = os.Stdout
+	if rc.Stdout == nil {
+		rc.Stdout = os.Stdout
 	}
 }
 
@@ -334,11 +350,11 @@ func (rc *ResourceCommand) Get(ctx context.Context, client *authclient.Client) e
 	// is experimental.
 	switch rc.format {
 	case teleport.Text:
-		return collection.writeText(rc.stdout, rc.verbose)
+		return collection.writeText(rc.Stdout, rc.verbose)
 	case teleport.YAML:
-		return writeYAML(collection, rc.stdout)
+		return writeYAML(collection, rc.Stdout)
 	case teleport.JSON:
-		return writeJSON(collection, rc.stdout)
+		return writeJSON(collection, rc.Stdout)
 	}
 	return trace.BadParameter("unsupported format")
 }
@@ -357,7 +373,7 @@ func (rc *ResourceCommand) GetMany(ctx context.Context, client *authclient.Clien
 		}
 		resources = append(resources, collection.resources()...)
 	}
-	if err := utils.WriteYAML(rc.stdout, resources); err != nil {
+	if err := utils.WriteYAML(rc.Stdout, resources); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -462,18 +478,11 @@ func (rc *ResourceCommand) createTrustedCluster(ctx context.Context, client *aut
 	// TODO(bernardjkim) consider using UpsertTrustedClusterV2 in VX.0.0
 	out, err := client.UpsertTrustedCluster(ctx, tc)
 	if err != nil {
-		// If force is used and UpsertTrustedCluster returns trace.AlreadyExists,
-		// this means the user tried to upsert a cluster whose exact match already
-		// exists in the backend, nothing needs to occur other than happy message
-		// that the trusted cluster has been created.
-		if rc.force && trace.IsAlreadyExists(err) {
-			out = tc
-		} else {
-			return trace.Wrap(err)
-		}
+		return trace.Wrap(err)
 	}
+
 	if out.GetName() != tc.GetName() {
-		fmt.Printf("WARNING: trusted cluster %q resource has been renamed to match remote cluster name %q\n", name, out.GetName())
+		fmt.Printf("WARNING: trusted cluster resource %q has been renamed to match root cluster name %q. this will become an error in future teleport versions, please update your configuration to use the correct name.\n", name, out.GetName())
 	}
 	fmt.Printf("trusted cluster %q has been %v\n", out.GetName(), UpsertVerb(exists, rc.force))
 	return nil
@@ -1197,7 +1206,7 @@ func (rc *ResourceCommand) createWorkloadIdentityX509IssuerOverride(ctx context.
 	}
 
 	fmt.Fprintf(
-		rc.stdout,
+		rc.Stdout,
 		types.KindWorkloadIdentityX509IssuerOverride+" %q has been created\n",
 		r.GetMetadata().GetName(),
 	)
@@ -1221,13 +1230,89 @@ func (rc *ResourceCommand) updateWorkloadIdentityX509IssuerOverride(ctx context.
 	}
 
 	fmt.Fprintf(
-		rc.stdout,
+		rc.Stdout,
 		types.KindWorkloadIdentityX509IssuerOverride+" %q has been updated\n",
 		r.GetMetadata().GetName(),
 	)
 	return nil
 }
 
+func (rc *ResourceCommand) createScopedRole(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
+	if rc.IsForced() {
+		return trace.BadParameter("scoped role creation does not support --force")
+	}
+
+	r, err := services.UnmarshalProtoResource[*scopedaccessv1.ScopedRole](raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := client.ScopedAccessServiceClient().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		Role: r,
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Fprintf(
+		rc.Stdout,
+		scopedaccess.KindScopedRole+" %q has been created\n",
+		r.GetMetadata().GetName(),
+	)
+
+	return nil
+}
+
+func (rc *ResourceCommand) updateScopedRole(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
+	r, err := services.UnmarshalProtoResource[*scopedaccessv1.ScopedRole](raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err = client.ScopedAccessServiceClient().UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		Role: r,
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Fprintf(
+		rc.Stdout,
+		scopedaccess.KindScopedRole+" %q has been updated\n",
+		r.GetMetadata().GetName(),
+	)
+
+	return nil
+}
+
+func (rc *ResourceCommand) createScopedRoleAssignment(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
+	if rc.IsForced() {
+		return trace.BadParameter("scoped role assignment creation does not support --force")
+	}
+
+	r, err := services.UnmarshalProtoResource[*scopedaccessv1.ScopedRoleAssignment](raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	rsp, err := client.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		Assignment: r,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Fprintf(
+		rc.Stdout,
+		scopedaccess.KindScopedRoleAssignment+" %q has been created\n",
+		rsp.GetAssignment().GetMetadata().GetName(), // must extract from rsp since assignment names are generated server-side
+	)
+
+	return nil
+}
+
+func (rc *ResourceCommand) updateScopedRoleAssignment(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
+	return trace.NotImplemented("scoped_role_assignment resources do not support updates")
+}
+
 func (rc *ResourceCommand) createSigstorePolicy(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
 	r, err := services.UnmarshalProtoResource[*workloadidentityv1pb.SigstorePolicy](raw.Raw, services.DisallowUnknown())
 	if err != nil {
@@ -1256,7 +1341,7 @@ func (rc *ResourceCommand) createSigstorePolicy(ctx context.Context, client *aut
 	}
 
 	fmt.Fprintf(
-		rc.stdout,
+		rc.Stdout,
 		types.KindSigstorePolicy+" %q has been created\n",
 		r.GetMetadata().GetName(),
 	)
@@ -1280,7 +1365,7 @@ func (rc *ResourceCommand) updateSigstorePolicy(ctx context.Context, client *aut
 	}
 
 	fmt.Fprintf(
-		rc.stdout,
+		rc.Stdout,
 		types.KindSigstorePolicy+" %q has been updated\n",
 		r.GetMetadata().GetName(),
 	)
@@ -1647,6 +1732,8 @@ func (rc *ResourceCommand) createIntegration(ctx context.Context, client *authcl
 			existingIntegration.SetGitHubIntegrationSpec(integration.GetGitHubIntegrationSpec())
 		case types.IntegrationSubKindAWSRolesAnywhere:
 			existingIntegration.SetAWSRolesAnywhereIntegrationSpec(integration.GetAWSRolesAnywhereIntegrationSpec())
+		case types.IntegrationSubKindAzureOIDC:
+			existingIntegration.SetAzureOIDCIntegrationSpec(integration.GetAzureOIDCIntegrationSpec())
 		default:
 			return trace.BadParameter("subkind %q is not supported", integration.GetSubKind())
 		}
@@ -1794,6 +1881,7 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 		types.KindAutoUpdateConfig,
 		types.KindAutoUpdateVersion,
 		types.KindAutoUpdateAgentRollout,
+		types.KindAutoUpdateBotInstanceReport,
 	}
 	if !slices.Contains(singletonResources, rc.ref.Kind) && (rc.ref.Kind == "" || rc.ref.Name == "") {
 		return trace.BadParameter("provide a full resource name to delete, for example:\n$ tctl rm cluster/east\n")
@@ -1935,7 +2023,8 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 		}
 		fmt.Printf("application %q has been deleted\n", rc.ref.Name)
 	case types.KindDatabase:
-		databases, err := client.GetDatabases(ctx)
+		// TODO(okraport) DELETE IN v21.0.0, replace with regular Collect
+		databases, err := clientutils.CollectWithFallback(ctx, client.ListDatabases, client.GetDatabases)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1950,7 +2039,8 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 		}
 		fmt.Printf("%s %q has been deleted\n", resDesc, name)
 	case types.KindKubernetesCluster:
-		clusters, err := client.GetKubernetesClusters(ctx)
+		// TODO(okraport) DELETE IN v21.0.0, replace with regular Collect
+		clusters, err := clientutils.CollectWithFallback(ctx, client.ListKubernetesClusters, client.GetKubernetesClusters)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -2215,10 +2305,32 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 			return trace.Wrap(err)
 		}
 		fmt.Fprintf(
-			rc.stdout,
+			rc.Stdout,
 			types.KindWorkloadIdentityX509IssuerOverride+" %q has been deleted\n",
 			rc.ref.Name,
 		)
+	case scopedaccess.KindScopedRole:
+		if _, err := client.ScopedAccessServiceClient().DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+			Name: rc.ref.Name,
+		}); err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Fprintf(
+			rc.Stdout,
+			scopedaccess.KindScopedRole+" %q has been deleted\n",
+			rc.ref.Name,
+		)
+	case scopedaccess.KindScopedRoleAssignment:
+		if _, err := client.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+			Name: rc.ref.Name,
+		}); err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Fprintf(
+			rc.Stdout,
+			scopedaccess.KindScopedRoleAssignment+" %q has been deleted\n",
+			rc.ref.Name,
+		)
 	case types.KindSigstorePolicy:
 		c := client.SigstorePolicyResourceServiceClient()
 		if _, err := c.DeleteSigstorePolicy(
@@ -2230,7 +2342,7 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 			return trace.Wrap(err)
 		}
 		fmt.Fprintf(
-			rc.stdout,
+			rc.Stdout,
 			types.KindSigstorePolicy+" %q has been deleted\n",
 			rc.ref.Name,
 		)
@@ -2259,8 +2371,24 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 			return trace.Wrap(err)
 		}
 		fmt.Printf("AutoUpdateAgentRollout has been deleted\n")
+	case types.KindAutoUpdateBotInstanceReport:
+		if err := client.DeleteAutoUpdateBotInstanceReport(ctx); err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Printf("%s has been deleted\n", types.KindAutoUpdateBotInstanceReport)
 	case types.KindHealthCheckConfig:
 		return trace.Wrap(rc.deleteHealthCheckConfig(ctx, client))
+	case types.KindRelayServer:
+		if err := client.DeleteRelayServer(ctx, rc.ref.Name); err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Printf("relay_server %+q has been deleted\n", rc.ref.Name)
+	case types.KindInferenceModel:
+		return trace.Wrap(rc.deleteInferenceModel(ctx, client))
+	case types.KindInferenceSecret:
+		return trace.Wrap(rc.deleteInferenceSecret(ctx, client))
+	case types.KindInferencePolicy:
+		return trace.Wrap(rc.deleteInferencePolicy(ctx, client))
 	default:
 		return trace.BadParameter("deleting resources of type %q is not supported", rc.ref.Kind)
 	}
@@ -2434,22 +2562,12 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		if rc.ref.Name != "" {
 			return nil, trace.BadParameter("reverse tunnel cannot be searched by name")
 		}
-		var tunnels []types.ReverseTunnel
-		var nextToken string
-		for {
-			var page []types.ReverseTunnel
-			var err error
 
-			const defaultPageSize = 0
-			page, nextToken, err = client.ListReverseTunnels(ctx, defaultPageSize, nextToken)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			tunnels = append(tunnels, page...)
-			if nextToken == "" {
-				break
-			}
+		tunnels, err := stream.Collect(clientutils.Resources(ctx, client.ListReverseTunnels))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &reverseTunnelCollection{tunnels: tunnels}, nil
 	case types.KindCertAuthority:
 		getAll := rc.ref.SubKind == "" && rc.ref.Name == ""
@@ -2524,6 +2642,7 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 
 		return &collection, nil
 	case types.KindAuthServer:
+		//nolint:staticcheck // TODO(kiosion): DELETE IN 21.0.0
 		servers, err := client.GetAuthServers()
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2538,6 +2657,7 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		}
 		return nil, trace.NotFound("auth server with ID %q not found", rc.ref.Name)
 	case types.KindProxy:
+		//nolint:staticcheck // TODO(kiosion): DELETE IN 21.0.0
 		servers, err := client.GetProxies()
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2569,10 +2689,16 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		return &namespaceCollection{namespaces: []types.Namespace{types.DefaultNamespace()}}, nil
 	case types.KindTrustedCluster:
 		if rc.ref.Name == "" {
-			trustedClusters, err := client.GetTrustedClusters(ctx)
+			// TODO(okraport): DELETE IN v21.0.0, replace with regular Collect
+			trustedClusters, err := clientutils.CollectWithFallback(
+				ctx,
+				client.ListTrustedClusters,
+				client.GetTrustedClusters,
+			)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
+
 			return &trustedClusterCollection{trustedClusters: trustedClusters}, nil
 		}
 		trustedCluster, err := client.GetTrustedCluster(ctx, rc.ref.Name)
@@ -2594,10 +2720,19 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		}
 		return &remoteClusterCollection{remoteClusters: []types.RemoteCluster{remoteCluster}}, nil
 	case types.KindSemaphore:
-		sems, err := client.GetSemaphores(ctx, types.SemaphoreFilter{
+		filter := types.SemaphoreFilter{
 			SemaphoreKind: rc.ref.SubKind,
 			SemaphoreName: rc.ref.Name,
-		})
+		}
+		sems, err := clientutils.CollectWithFallback(ctx,
+			func(ctx context.Context, pageSize int, pageToken string) ([]types.Semaphore, string, error) {
+				return client.ListSemaphores(ctx, pageSize, pageToken, &filter)
+			},
+			func(ctx context.Context) ([]types.Semaphore, error) {
+				return client.GetSemaphores(ctx, filter)
+			},
+		)
+
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2642,7 +2777,18 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		return &recConfigCollection{recConfig}, nil
 	case types.KindLock:
 		if rc.ref.Name == "" {
-			locks, err := client.GetLocks(ctx, false)
+			locks, err := clientutils.CollectWithFallback(
+				ctx,
+				func(ctx context.Context, limit int, start string) ([]types.Lock, string, error) {
+					var noFilter *types.LockFilter
+					return client.ListLocks(ctx, limit, start, noFilter)
+				},
+				func(ctx context.Context) ([]types.Lock, error) {
+					// TODO(okraport): DELETE IN v21
+					const inForceOnlyFalse = false
+					return client.GetLocks(ctx, inForceOnlyFalse)
+				},
+			)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -2715,22 +2861,27 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		return &netRestrictionsCollection{nr}, nil
 	case types.KindApp:
 		if rc.ref.Name == "" {
-			apps, err := client.GetApps(ctx)
+			// TODO(tross): DELETE IN v21.0.0, replace with regular Collect
+			apps, err := clientutils.CollectWithFallback(ctx, client.ListApps, client.GetApps)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
+
 			return &appCollection{apps: apps}, nil
 		}
+
 		app, err := client.GetApp(ctx, rc.ref.Name)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		return &appCollection{apps: []types.Application{app}}, nil
 	case types.KindDatabase:
-		databases, err := client.GetDatabases(ctx)
+		// TODO(okraport): DELETE IN v21.0.0, replace with regular Collect
+		databases, err := clientutils.CollectWithFallback(ctx, client.ListDatabases, client.GetDatabases)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+
 		if rc.ref.Name == "" {
 			return &databaseCollection{databases: databases}, nil
 		}
@@ -2740,7 +2891,8 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		}
 		return &databaseCollection{databases: databases}, nil
 	case types.KindKubernetesCluster:
-		clusters, err := client.GetKubernetesClusters(ctx)
+		// TODO(okraport) DELETE IN v21.0.0, replace with regular Collect
+		clusters, err := clientutils.CollectWithFallback(ctx, client.ListKubernetesClusters, client.GetKubernetesClusters)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2753,61 +2905,69 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		}
 		return &kubeClusterCollection{clusters: clusters}, nil
 	case types.KindCrownJewel:
-		cjClient := client.CrownJewelsClient()
-		var rules []*crownjewelv1.CrownJewel
-		nextToken := ""
-		for {
-			resp, token, err := cjClient.ListCrownJewels(ctx, 0 /* default size */, nextToken)
+		jewels, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, startKey string) ([]*crownjewelv1.CrownJewel, string, error) {
+			return client.CrownJewelsClient().ListCrownJewels(ctx, int64(limit), startKey)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &crownJewelCollection{items: jewels}, nil
+	case types.KindWindowsDesktopService:
+		if rc.ref.Name != "" {
+			service, err := client.GetWindowsDesktopService(ctx, rc.ref.Name)
 			if err != nil {
+				if trace.IsNotFound(err) {
+					return nil, trace.NotFound("Windows desktop service %q not found", rc.ref.Name)
+				}
 				return nil, trace.Wrap(err)
 			}
 
-			rules = append(rules, resp...)
-
-			if token == "" {
-				break
-			}
-			nextToken = token
+			return &windowsDesktopServiceCollection{services: []types.WindowsDesktopService{service}}, nil
 		}
-		return &crownJewelCollection{items: rules}, nil
-	case types.KindWindowsDesktopService:
-		services, err := client.GetWindowsDesktopServices(ctx)
+
+		services, err := apiclient.GetAllResources[types.WindowsDesktopService](ctx, client, &proto.ListResourcesRequest{ResourceType: types.KindWindowsDesktopService})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		if rc.ref.Name == "" {
-			return &windowsDesktopServiceCollection{services: services}, nil
-		}
-
-		var out []types.WindowsDesktopService
-		for _, service := range services {
-			if service.GetName() == rc.ref.Name {
-				out = append(out, service)
+		return &windowsDesktopServiceCollection{services: services}, nil
+	case types.KindWindowsDesktop:
+		if rc.ref.Name != "" {
+			desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{Name: rc.ref.Name})
+			if err != nil {
+				if trace.IsNotFound(err) {
+					return nil, trace.NotFound("Windows desktop %q not found", rc.ref.Name)
+				}
+				return nil, trace.Wrap(err)
 			}
+
+			return &windowsDesktopCollection{desktops: desktops}, nil
 		}
-		if len(out) == 0 {
-			return nil, trace.NotFound("Windows desktop service %q not found", rc.ref.Name)
-		}
-		return &windowsDesktopServiceCollection{services: out}, nil
-	case types.KindWindowsDesktop:
-		desktops, err := client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+
+		// TODO(tross): DELETE IN v21.0.0, replace with regular Collect
+		desktops, err := clientutils.CollectWithFallback(
+			ctx,
+			func(ctx context.Context, limit int, token string) ([]types.WindowsDesktop, string, error) {
+				resp, err := client.ListWindowsDesktops(ctx,
+					types.ListWindowsDesktopsRequest{
+						StartKey: token,
+						Limit:    limit,
+					})
+				if err != nil {
+					return nil, "", trace.Wrap(err)
+				}
+				return resp.Desktops, resp.NextKey, nil
+			},
+			func(ctx context.Context) ([]types.WindowsDesktop, error) {
+				return client.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+			},
+		)
+
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		if rc.ref.Name == "" {
-			return &windowsDesktopCollection{desktops: desktops}, nil
-		}
 
-		var out []types.WindowsDesktop
-		for _, desktop := range desktops {
-			if desktop.GetName() == rc.ref.Name {
-				out = append(out, desktop)
-			}
-		}
-		if len(out) == 0 {
-			return nil, trace.NotFound("Windows desktop %q not found", rc.ref.Name)
-		}
-		return &windowsDesktopCollection{desktops: out}, nil
+		return &windowsDesktopCollection{desktops: desktops}, nil
 	case types.KindDynamicWindowsDesktop:
 		dynamicDesktopClient := client.DynamicDesktopClient()
 		if rc.ref.Name != "" {
@@ -2820,32 +2980,15 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}, nil
 		}
 
-		pageToken := ""
-		desktops := make([]types.DynamicWindowsDesktop, 0, 100)
-		for {
-			d, next, err := dynamicDesktopClient.ListDynamicWindowsDesktops(ctx, 100, pageToken)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			if rc.ref.Name == "" {
-				desktops = append(desktops, d...)
-			} else {
-				for _, desktop := range desktops {
-					if desktop.GetName() == rc.ref.Name {
-						desktops = append(desktops, desktop)
-					}
-				}
-			}
-			pageToken = next
-			if next == "" {
-				break
-			}
+		desktops, err := stream.Collect(clientutils.Resources(ctx, dynamicDesktopClient.ListDynamicWindowsDesktops))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		return &dynamicWindowsDesktopCollection{desktops}, nil
 	case types.KindToken:
 		if rc.ref.Name == "" {
-			tokens, err := client.GetTokens(ctx)
+			tokens, err := getAllTokens(ctx, client)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -2858,7 +3001,8 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		return &tokenCollection{tokens: []types.ProvisionToken{token}}, nil
 	case types.KindInstaller:
 		if rc.ref.Name == "" {
-			installers, err := client.GetInstallers(ctx)
+			// TODO(okraport): DELETE IN v21.0.0, replace with regular collect.
+			installers, err := clientutils.CollectWithFallback(ctx, client.ListInstallers, client.GetInstallers)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -2905,20 +3049,17 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 	case types.KindLoginRule:
 		loginRuleClient := client.LoginRuleClient()
 		if rc.ref.Name == "" {
-			fetch := func(token string) (*loginrulepb.ListLoginRulesResponse, error) {
+			rules, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*loginrulepb.LoginRule, string, error) {
 				resp, err := loginRuleClient.ListLoginRules(ctx, &loginrulepb.ListLoginRulesRequest{
+					PageSize:  int32(limit),
 					PageToken: token,
 				})
-				return resp, trail.FromGRPC(err)
-			}
-			var rules []*loginrulepb.LoginRule
-			resp, err := fetch("")
-			for ; err == nil; resp, err = fetch(resp.NextPageToken) {
-				rules = append(rules, resp.LoginRules...)
-				if resp.NextPageToken == "" {
-					break
-				}
+				return resp.GetLoginRules(), resp.GetNextPageToken(), trace.Wrap(err)
+			}))
+			if err != nil {
+				return nil, trace.Wrap(err)
 			}
+
 			return &loginRuleCollection{rules}, trace.Wrap(err)
 		}
 		rule, err := loginRuleClient.GetLoginRule(ctx, &loginrulepb.GetLoginRuleRequest{
@@ -2933,20 +3074,10 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return &samlIdPServiceProviderCollection{serviceProviders: []types.SAMLIdPServiceProvider{serviceProvider}}, nil
 		}
-		var resources []types.SAMLIdPServiceProvider
-		nextKey := ""
-		for {
-			var sps []types.SAMLIdPServiceProvider
-			var err error
-			sps, nextKey, err = client.ListSAMLIdPServiceProviders(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
 
-			resources = append(resources, sps...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, client.ListSAMLIdPServiceProviders))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 		return &samlIdPServiceProviderCollection{serviceProviders: resources}, nil
 	case types.KindDevice:
@@ -3005,21 +3136,18 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &botCollection{bots: []*machineidv1pb.Bot{bot}}, nil
 		}
 
-		req := &machineidv1pb.ListBotsRequest{}
-		var bots []*machineidv1pb.Bot
-		for {
-			resp, err := remote.ListBots(ctx, req)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			bots = append(bots, resp.Bots...)
+		bots, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*machineidv1pb.Bot, string, error) {
+			resp, err := remote.ListBots(ctx, &machineidv1pb.ListBotsRequest{
+				PageSize:  int32(limit),
+				PageToken: token,
+			})
 
-			if resp.NextPageToken == "" {
-				break
-			}
-			req.PageToken = resp.NextPageToken
+			return resp.GetBots(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &botCollection{bots: bots}, nil
 	case types.KindDatabaseObjectImportRule:
 		remote := client.DatabaseObjectImportRuleClient()
@@ -3031,21 +3159,18 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &databaseObjectImportRuleCollection{rules: []*dbobjectimportrulev1.DatabaseObjectImportRule{rule}}, nil
 		}
 
-		req := &dbobjectimportrulev1.ListDatabaseObjectImportRulesRequest{}
-		var rules []*dbobjectimportrulev1.DatabaseObjectImportRule
-		for {
-			resp, err := remote.ListDatabaseObjectImportRules(ctx, req)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			rules = append(rules, resp.Rules...)
+		rules, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*dbobjectimportrulev1.DatabaseObjectImportRule, string, error) {
+			resp, err := remote.ListDatabaseObjectImportRules(ctx, &dbobjectimportrulev1.ListDatabaseObjectImportRulesRequest{
+				PageSize:  int32(limit),
+				PageToken: token,
+			})
 
-			if resp.NextPageToken == "" {
-				break
-			}
-			req.PageToken = resp.NextPageToken
+			return resp.GetRules(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &databaseObjectImportRuleCollection{rules: rules}, nil
 	case types.KindDatabaseObject:
 		remote := client.DatabaseObjectsClient()
@@ -3057,21 +3182,11 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &databaseObjectCollection{objects: []*dbobjectv1.DatabaseObject{object}}, nil
 		}
 
-		token := ""
-		var objects []*dbobjectv1.DatabaseObject
-		for {
-			resp, nextToken, err := remote.ListDatabaseObjects(ctx, 0, token)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			objects = append(objects, resp...)
-
-			if nextToken == "" {
-				break
-			}
-			token = nextToken
+		objects, err := stream.Collect(clientutils.Resources(ctx, remote.ListDatabaseObjects))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &databaseObjectCollection{objects: objects}, nil
 	case types.KindOktaImportRule:
 		if rc.ref.Name != "" {
@@ -3081,21 +3196,12 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return &oktaImportRuleCollection{importRules: []types.OktaImportRule{importRule}}, nil
 		}
-		var resources []types.OktaImportRule
-		nextKey := ""
-		for {
-			var importRules []types.OktaImportRule
-			var err error
-			importRules, nextKey, err = client.OktaClient().ListOktaImportRules(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
 
-			resources = append(resources, importRules...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, client.OktaClient().ListOktaImportRules))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &oktaImportRuleCollection{importRules: resources}, nil
 	case types.KindOktaAssignment:
 		if rc.ref.Name != "" {
@@ -3105,21 +3211,12 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return &oktaAssignmentCollection{assignments: []types.OktaAssignment{assignment}}, nil
 		}
-		var resources []types.OktaAssignment
-		nextKey := ""
-		for {
-			var assignments []types.OktaAssignment
-			var err error
-			assignments, nextKey, err = client.OktaClient().ListOktaAssignments(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
 
-			resources = append(resources, assignments...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, client.OktaClient().ListOktaAssignments))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &oktaAssignmentCollection{assignments: resources}, nil
 	case types.KindUserGroup:
 		if rc.ref.Name != "" {
@@ -3129,21 +3226,12 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return &userGroupCollection{userGroups: []types.UserGroup{userGroup}}, nil
 		}
-		var resources []types.UserGroup
-		nextKey := ""
-		for {
-			var userGroups []types.UserGroup
-			var err error
-			userGroups, nextKey, err = client.ListUserGroups(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
 
-			resources = append(resources, userGroups...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, client.ListUserGroups))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &userGroupCollection{userGroups: resources}, nil
 	case types.KindExternalAuditStorage:
 		out := []*externalauditstorage.ExternalAuditStorage{}
@@ -3191,20 +3279,11 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &integrationCollection{integrations: []types.Integration{ig}}, nil
 		}
 
-		var resources []types.Integration
-		var igs []types.Integration
-		var err error
-		var nextKey string
-		for {
-			igs, nextKey, err = client.ListIntegrations(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			resources = append(resources, igs...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, client.ListIntegrations))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		return &integrationCollection{integrations: resources}, nil
 	case types.KindUserTask:
 		userTasksClient := client.UserTasksClient()
@@ -3216,19 +3295,11 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &userTaskCollection{items: []*usertasksv1.UserTask{uit}}, nil
 		}
 
-		var tasks []*usertasksv1.UserTask
-		nextToken := ""
-		for {
-			resp, token, err := userTasksClient.ListUserTasks(ctx, 0 /* default size */, nextToken, &usertasksv1.ListUserTasksFilters{})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			tasks = append(tasks, resp...)
-
-			if token == "" {
-				break
-			}
-			nextToken = token
+		tasks, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*usertasksv1.UserTask, string, error) {
+			return userTasksClient.ListUserTasks(ctx, int64(limit), token, &usertasksv1.ListUserTasksFilters{})
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 		return &userTaskCollection{items: tasks}, nil
 	case types.KindDiscoveryConfig:
@@ -3241,19 +3312,9 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &discoveryConfigCollection{discoveryConfigs: []*discoveryconfig.DiscoveryConfig{dc}}, nil
 		}
 
-		var resources []*discoveryconfig.DiscoveryConfig
-		var dcs []*discoveryconfig.DiscoveryConfig
-		var err error
-		var nextKey string
-		for {
-			dcs, nextKey, err = remote.ListDiscoveryConfigs(ctx, 0, nextKey)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			resources = append(resources, dcs...)
-			if nextKey == "" {
-				break
-			}
+		resources, err := stream.Collect(clientutils.Resources(ctx, remote.ListDiscoveryConfigs))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		return &discoveryConfigCollection{discoveryConfigs: resources}, nil
@@ -3294,7 +3355,7 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return &serverInfoCollection{serverInfos: []types.ServerInfo{si}}, nil
 		}
-		serverInfos, err := stream.Collect(client.GetServerInfos(ctx))
+		serverInfos, err := apistream.Collect(client.GetServerInfos(ctx))
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3398,22 +3459,16 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &workloadIdentityCollection{items: []*workloadidentityv1pb.WorkloadIdentity{resource}}, nil
 		}
 
-		var resources []*workloadidentityv1pb.WorkloadIdentity
-		pageToken := ""
-		for {
+		resources, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
 			resp, err := client.WorkloadIdentityResourceServiceClient().ListWorkloadIdentities(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesRequest{
+				PageSize:  int32(limit),
 				PageToken: pageToken,
 			})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			resources = append(resources, resp.WorkloadIdentities...)
 
-			if resp.NextPageToken == "" {
-				break
-			}
-			pageToken = resp.NextPageToken
+			return resp.GetWorkloadIdentities(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		return &workloadIdentityCollection{items: resources}, nil
@@ -3430,24 +3485,16 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &workloadIdentityX509RevocationCollection{items: []*workloadidentityv1pb.WorkloadIdentityX509Revocation{resource}}, nil
 		}
 
-		var resources []*workloadidentityv1pb.WorkloadIdentityX509Revocation
-		pageToken := ""
-		for {
-			resp, err := client.
-				WorkloadIdentityRevocationServiceClient().
-				ListWorkloadIdentityX509Revocations(ctx, &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest{
-					PageToken: pageToken,
-				})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			resources = append(resources, resp.WorkloadIdentityX509Revocations...)
+		resources, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentityX509Revocation, string, error) {
+			resp, err := client.WorkloadIdentityRevocationServiceClient().ListWorkloadIdentityX509Revocations(ctx, &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest{
+				PageSize:  int32(limit),
+				PageToken: pageToken,
+			})
 
-			if resp.NextPageToken == "" {
-				break
-			}
-			pageToken = resp.NextPageToken
+			return resp.GetWorkloadIdentityX509Revocations(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		return &workloadIdentityX509RevocationCollection{items: resources}, nil
@@ -3465,28 +3512,21 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &botInstanceCollection{items: []*machineidv1pb.BotInstance{bi}}, nil
 		}
 
-		var instances []*machineidv1pb.BotInstance
-		startKey := ""
-
-		for {
+		instances, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
+			// TODO(nicholasmarais1158) Use ListBotInstancesV2 instead.
+			//nolint:staticcheck // SA1019
 			resp, err := client.BotInstanceServiceClient().ListBotInstances(ctx, &machineidv1pb.ListBotInstancesRequest{
-				PageSize:  100,
-				PageToken: startKey,
+				PageSize:  int32(limit),
+				PageToken: pageToken,
 
 				// Note: empty filter lists all bot instances
 				FilterBotName: rc.ref.Name,
 			})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			instances = append(instances, resp.BotInstances...)
 
-			if resp.NextPageToken == "" {
-				break
-			}
-
-			startKey = resp.NextPageToken
+			return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		return &botInstanceCollection{items: instances}, nil
@@ -3501,20 +3541,11 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return &staticHostUserCollection{items: []*userprovisioningpb.StaticHostUser{hostUser}}, nil
 		}
 
-		var hostUsers []*userprovisioningpb.StaticHostUser
-		var nextToken string
-		for {
-			resp, token, err := hostUserClient.ListStaticHostUsers(ctx, 0, nextToken)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			hostUsers = append(hostUsers, resp...)
-			if token == "" {
-				break
-			}
-			nextToken = token
+		resources, err := stream.Collect(clientutils.Resources(ctx, hostUserClient.ListStaticHostUsers))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return &staticHostUserCollection{items: hostUsers}, nil
+		return &staticHostUserCollection{items: resources}, nil
 	case types.KindAutoUpdateConfig:
 		config, err := client.GetAutoUpdateConfig(ctx)
 		if err != nil {
@@ -3533,52 +3564,57 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			return nil, trace.Wrap(err)
 		}
 		return &autoUpdateAgentRolloutCollection{version}, nil
-	case types.KindAccessMonitoringRule:
+	case types.KindAutoUpdateAgentReport:
 		if rc.ref.Name != "" {
-			rule, err := client.AccessMonitoringRuleClient().GetAccessMonitoringRule(ctx, rc.ref.Name)
+			report, err := client.GetAutoUpdateAgentReport(ctx, rc.ref.Name)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			return &accessMonitoringRuleCollection{items: []*accessmonitoringrulesv1pb.AccessMonitoringRule{rule}}, nil
+			return &autoUpdateAgentReportCollection{reports: []*autoupdatev1pb.AutoUpdateAgentReport{report}}, nil
 		}
 
-		var rules []*accessmonitoringrulesv1pb.AccessMonitoringRule
-		nextToken := ""
-		for {
-			resp, token, err := client.AccessMonitoringRuleClient().ListAccessMonitoringRules(ctx, 0, nextToken)
+		reports, err := stream.Collect(clientutils.Resources(ctx, client.ListAutoUpdateAgentReports))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &autoUpdateAgentReportCollection{reports: reports}, nil
+	case types.KindAutoUpdateBotInstanceReport:
+		if rc.ref.Name != "" {
+			return nil, trace.BadParameter("only simple `tctl get %v` can be used", types.KindAutoUpdateBotInstanceReport)
+		}
+		report, err := client.GetAutoUpdateBotInstanceReport(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &autoUpdateBotInstanceReportCollection{report}, nil
+	case types.KindAccessMonitoringRule:
+		if rc.ref.Name != "" {
+			rule, err := client.AccessMonitoringRuleClient().GetAccessMonitoringRule(ctx, rc.ref.Name)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			rules = append(rules, resp...)
-			if token == "" {
-				break
-			}
-			nextToken = token
+			return &accessMonitoringRuleCollection{items: []*accessmonitoringrulesv1pb.AccessMonitoringRule{rule}}, nil
+		}
+
+		rules, err := stream.Collect(clientutils.Resources(ctx, client.AccessMonitoringRuleClient().ListAccessMonitoringRules))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 		return &accessMonitoringRuleCollection{items: rules}, nil
 	case types.KindGitServer:
-		var page, servers []types.Server
-
-		// TODO(greedy52) use unified resource request once available.
 		if rc.ref.Name != "" {
 			server, err := client.GitServerClient().GetGitServer(ctx, rc.ref.Name)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			return &serverCollection{servers: append(servers, server)}, nil
+			return &serverCollection{servers: []types.Server{server}}, nil
 		}
-		var err error
-		var token string
-		for {
-			page, token, err = client.GitServerClient().ListGitServers(ctx, 0, token)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			servers = append(servers, page...)
-			if token == "" {
-				break
-			}
+
+		servers, err := stream.Collect(clientutils.Resources(ctx, client.GitServerClient().ListGitServers))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
+
 		// TODO(greedy52) consider making dedicated git server collection.
 		return &serverCollection{servers: servers}, nil
 
@@ -3596,28 +3632,31 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return namedResourceCollection{types.ProtoResource153ToLegacy(r)}, nil
 		}
-		var collection namedResourceCollection
-		var pageToken string
-		for {
-			resp, err := c.ListX509IssuerOverrides(
-				ctx,
-				&workloadidentityv1pb.ListX509IssuerOverridesRequest{
-					PageToken: pageToken,
+
+		resources, err := stream.Collect(
+			stream.FilterMap(
+				clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.X509IssuerOverride, string, error) {
+					resp, err := c.ListX509IssuerOverrides(
+						ctx,
+						&workloadidentityv1pb.ListX509IssuerOverridesRequest{
+							PageSize:  int32(limit),
+							PageToken: pageToken,
+						},
+					)
+
+					return resp.GetX509IssuerOverrides(), resp.GetNextPageToken(), trace.Wrap(err)
+				}),
+
+				func(r *workloadidentityv1pb.X509IssuerOverride) (types.Resource, bool) {
+					return types.ProtoResource153ToLegacy(r), true
 				},
-			)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			collection = slices.Grow(collection, len(resp.GetX509IssuerOverrides()))
-			for _, r := range resp.GetX509IssuerOverrides() {
-				collection = append(collection, types.ProtoResource153ToLegacy(r))
-			}
-			pageToken = resp.GetNextPageToken()
-			if pageToken == "" {
-				break
-			}
+			),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return collection, nil
+
+		return namedResourceCollection(resources), nil
 	case types.KindSigstorePolicy:
 		c := client.SigstorePolicyResourceServiceClient()
 		if rc.ref.Name != "" {
@@ -3632,28 +3671,31 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 			}
 			return namedResourceCollection{types.ProtoResource153ToLegacy(r)}, nil
 		}
-		var collection namedResourceCollection
-		var pageToken string
-		for {
-			resp, err := c.ListSigstorePolicies(
-				ctx,
-				&workloadidentityv1pb.ListSigstorePoliciesRequest{
-					PageToken: pageToken,
+
+		resources, err := stream.Collect(
+			stream.FilterMap(
+				clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.SigstorePolicy, string, error) {
+					resp, err := c.ListSigstorePolicies(
+						ctx,
+						&workloadidentityv1pb.ListSigstorePoliciesRequest{
+							PageSize:  int32(limit),
+							PageToken: pageToken,
+						},
+					)
+
+					return resp.GetSigstorePolicies(), resp.GetNextPageToken(), trace.Wrap(err)
+				}),
+
+				func(r *workloadidentityv1pb.SigstorePolicy) (types.Resource, bool) {
+					return types.ProtoResource153ToLegacy(r), true
 				},
-			)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			collection = slices.Grow(collection, len(resp.GetSigstorePolicies()))
-			for _, r := range resp.GetSigstorePolicies() {
-				collection = append(collection, types.ProtoResource153ToLegacy(r))
-			}
-			pageToken = resp.GetNextPageToken()
-			if pageToken == "" {
-				break
-			}
+			),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return collection, nil
+
+		return namedResourceCollection(resources), nil
 	case types.KindHealthCheckConfig:
 		if rc.ref.Name != "" {
 			cfg, err := client.GetHealthCheckConfig(ctx, rc.ref.Name)
@@ -3664,29 +3706,88 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 				items: []*healthcheckconfigv1.HealthCheckConfig{cfg},
 			}, nil
 		}
-		var items []*healthcheckconfigv1.HealthCheckConfig
-		var token string
-		for {
-			page, nextToken, err := client.ListHealthCheckConfigs(ctx, 0, token)
-			token = nextToken
+
+		items, err := stream.Collect(clientutils.Resources(ctx, client.ListHealthCheckConfigs))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return &healthCheckConfigCollection{items: items}, nil
+	case types.KindRelayServer:
+		if rc.ref.Name != "" {
+			rs, err := client.GetRelayServer(ctx, rc.ref.Name)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			items = append(items, page...)
-			if token == "" {
-				break
+			return namedResourceCollection{types.ProtoResource153ToLegacy(rs)}, nil
+		}
+		var c namedResourceCollection
+		for rs, err := range clientutils.Resources(ctx, client.ListRelayServers) {
+			if err != nil {
+				return nil, trace.Wrap(err)
 			}
+			c = append(c, types.ProtoResource153ToLegacy(rs))
+		}
+		return c, nil
+	case types.KindInferenceModel:
+		models, err := rc.getInferenceModels(ctx, client)
+		return models, trace.Wrap(err)
+	case types.KindInferenceSecret:
+		secrets, err := rc.getInferenceSecrets(ctx, client)
+		return secrets, trace.Wrap(err)
+	case types.KindInferencePolicy:
+		policies, err := rc.getInferencePolicies(ctx, client)
+		return policies, trace.Wrap(err)
+	case scopedaccess.KindScopedRole:
+		if rc.ref.Name != "" {
+			rsp, err := client.ScopedAccessServiceClient().GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+				Name: rc.ref.Name,
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return &scopedRoleCollection{items: []*scopedaccessv1.ScopedRole{rsp.Role}}, nil
+		}
+
+		items, err := stream.Collect(scopedutils.RangeScopedRoles(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRolesRequest{}))
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return &healthCheckConfigCollection{
-			items: items,
-		}, nil
+		return &scopedRoleCollection{items: items}, nil
+	case scopedaccess.KindScopedRoleAssignment:
+		if rc.ref.Name != "" {
+			rsp, err := client.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+				Name: rc.ref.Name,
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return &scopedRoleAssignmentCollection{items: []*scopedaccessv1.ScopedRoleAssignment{rsp.Assignment}}, nil
+		}
+
+		items, err := stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{}))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &scopedRoleAssignmentCollection{items: items}, nil
 	}
 	return nil, trace.BadParameter("getting %q is not supported", rc.ref.String())
 }
 
 func getSAMLConnectors(ctx context.Context, client *authclient.Client, name string, withSecrets bool) ([]types.SAMLConnector, error) {
 	if name == "" {
-		connectors, err := client.GetSAMLConnectors(ctx, withSecrets)
+		// TODO(okraport): DELETE IN v21.0.0, remove GetSAMLConnectors
+		connectors, err := clientutils.CollectWithFallback(ctx,
+			func(ctx context.Context, limit int, start string) ([]types.SAMLConnector, string, error) {
+				return client.ListSAMLConnectorsWithOptions(ctx, limit, start, withSecrets)
+			},
+			func(ctx context.Context) ([]types.SAMLConnector, error) {
+				//nolint:staticcheck // support older backends during migration
+				return client.GetSAMLConnectors(ctx, withSecrets)
+			},
+		)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3701,7 +3802,15 @@ func getSAMLConnectors(ctx context.Context, client *authclient.Client, name stri
 
 func getOIDCConnectors(ctx context.Context, client *authclient.Client, name string, withSecrets bool) ([]types.OIDCConnector, error) {
 	if name == "" {
-		connectors, err := client.GetOIDCConnectors(ctx, withSecrets)
+		// TODO(okraport): DELETE IN v21.0.0, replace with regular collect.
+		connectors, err := clientutils.CollectWithFallback(ctx,
+			func(ctx context.Context, limit int, start string) ([]types.OIDCConnector, string, error) {
+				return client.ListOIDCConnectors(ctx, limit, start, withSecrets)
+			},
+			func(ctx context.Context) ([]types.OIDCConnector, error) {
+				return client.GetOIDCConnectors(ctx, withSecrets)
+			},
+		)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -3716,7 +3825,15 @@ func getOIDCConnectors(ctx context.Context, client *authclient.Client, name stri
 
 func getGithubConnectors(ctx context.Context, client *authclient.Client, name string, withSecrets bool) ([]types.GithubConnector, error) {
 	if name == "" {
-		connectors, err := client.GetGithubConnectors(ctx, withSecrets)
+		// TODO(okraport): DELETE IN v21.0.0, replace with regular collect.
+		connectors, err := clientutils.CollectWithFallback(ctx,
+			func(ctx context.Context, limit int, start string) ([]types.GithubConnector, string, error) {
+				return client.ListGithubConnectors(ctx, limit, start, withSecrets)
+			},
+			func(ctx context.Context) ([]types.GithubConnector, error) {
+				return client.GetGithubConnectors(ctx, withSecrets)
+			},
+		)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -4149,6 +4266,21 @@ func (rc *ResourceCommand) createAutoUpdateAgentRollout(ctx context.Context, cli
 	return nil
 }
 
+func (rc *ResourceCommand) upsertAutoUpdateAgentReport(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
+	report, err := services.UnmarshalProtoResource[*autoupdatev1pb.AutoUpdateAgentReport](raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = client.UpsertAutoUpdateAgentReport(ctx, report)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Println("autoupdate_agent_report has been created")
+	return nil
+}
+
 func (rc *ResourceCommand) updateAutoUpdateAgentRollout(ctx context.Context, client *authclient.Client, raw services.UnknownResource) error {
 	rollout, err := services.UnmarshalProtoResource[*autoupdatev1pb.AutoUpdateAgentRollout](raw.Raw, services.DisallowUnknown())
 	if err != nil {
diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go
index 822ee82de56ee..6bcb90725bd88 100644
--- a/tool/tctl/common/resource_command_test.go
+++ b/tool/tctl/common/resource_command_test.go
@@ -44,6 +44,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
 	userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
 	"github.com/gravitational/teleport/api/types"
 	apicommon "github.com/gravitational/teleport/api/types/common"
@@ -56,8 +57,10 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
+	scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/tctl/common/databaseobject"
 	"github.com/gravitational/teleport/tool/tctl/common/databaseobjectimportrule"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
@@ -201,7 +204,9 @@ func TestDatabaseServerResource(t *testing.T) {
 	require.NoError(t, err)
 
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	// get all database servers
 	buff, err := runResourceCommand(t, clt, []string{"get", types.KindDatabaseServer, "--format=json"})
@@ -266,7 +271,9 @@ func TestDatabaseServiceResource(t *testing.T) {
 	}
 
 	auth := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, auth)
+	clt, err := testenv.NewDefaultAuthClient(auth)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	// Add a lot of DatabaseServices to test pagination
 	dbS, err := types.NewDatabaseServiceV1(
@@ -322,6 +329,203 @@ func TestDatabaseServiceResource(t *testing.T) {
 	})
 }
 
+func TestScopedRoleAndAssignmentResource(t *testing.T) {
+	const scopedRoleYAML = `kind: scoped_role
+metadata:
+  name: some-role
+scope: "/"
+spec:
+  assignable_scopes: ["/foo"]
+version: v1
+`
+	const scopedRoleAssignmentYAML = `kind: scoped_role_assignment
+scope: "/"
+spec:
+  user: "bob"
+  assignments:
+    - role: some-role
+      scope: /foo
+version: v1
+`
+
+	t.Setenv("TELEPORT_UNSTABLE_SCOPES", "yes")
+
+	dynAddr := helpers.NewDynamicServiceAddr(t)
+
+	fileConfig := &config.FileConfig{
+		Global: config.Global{
+			DataDir: t.TempDir(),
+		},
+		Proxy: config.Proxy{
+			Service: config.Service{
+				EnabledFlag: "true",
+			},
+			WebAddr: dynAddr.WebAddr,
+			TunAddr: dynAddr.TunnelAddr,
+		},
+		Auth: config.Auth{
+			Service: config.Service{
+				EnabledFlag:   "true",
+				ListenAddress: dynAddr.AuthAddr,
+			},
+		},
+	}
+
+	auth := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
+	clt, err := testenv.NewDefaultAuthClient(auth)
+	require.NoError(t, err)
+
+	scopedRoleYAMLPath := filepath.Join(t.TempDir(), "some-role.yaml")
+	require.NoError(t, os.WriteFile(scopedRoleYAMLPath, []byte(scopedRoleYAML), 0644))
+
+	// Create the scoped role
+	_, err = runResourceCommand(t, clt, []string{"create", scopedRoleYAMLPath})
+	require.NoError(t, err)
+
+	// wait for cache propagation
+	timeout := time.After(time.Second * 30)
+	var raw []byte
+	for {
+		// Get the scoped role
+		buff, err := runResourceCommand(t, clt, []string{"get", "scoped_role/some-role", "--format=json"})
+		if err == nil {
+			raw = buff.Bytes()
+			break
+		}
+
+		require.True(t, trace.IsNotFound(err), "expected a NotFound error, got %v", err)
+
+		select {
+		case <-timeout:
+			require.FailNow(t, "Timed out waiting for scoped role cache propagation")
+		case <-time.After(time.Millisecond * 100):
+		}
+	}
+
+	// Unmarshal the response into a ScopedRole object
+	rs, err := services.UnmarshalProtoResourceArray[*scopedaccessv1.ScopedRole](raw, services.DisallowUnknown())
+	require.NoError(t, err)
+	require.Len(t, rs, 1)
+
+	// Compare with expected value
+	expected := &scopedaccessv1.ScopedRole{
+		Kind: scopedaccess.KindScopedRole,
+		Metadata: &headerv1.Metadata{
+			Name: "some-role",
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleSpec{
+			AssignableScopes: []string{"/foo"},
+		},
+		Version: types.V1,
+	}
+
+	require.Empty(t, cmp.Diff(expected, rs[0], protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// now that a role exists, test commands for assignment creation
+	scopedRoleAssignmentYAMLPath := filepath.Join(t.TempDir(), "some-role-assignment.yaml")
+	require.NoError(t, os.WriteFile(scopedRoleAssignmentYAMLPath, []byte(scopedRoleAssignmentYAML), 0644))
+
+	// Create the scoped role assignment
+	buff, err := runResourceCommand(t, clt, []string{"create", scopedRoleAssignmentYAMLPath})
+	require.NoError(t, err)
+
+	parts := bytes.Split(buff.Bytes(), []byte("\""))
+	require.Len(t, parts, 3)
+
+	assignmentName := string(parts[1])
+
+	_, err = uuid.Parse(assignmentName)
+	require.NoError(t, err, "expected assignment name to be a UUID, got %q (extracted from output %q)", assignmentName, buff.String())
+
+	// wait for cache propagation
+	timeout = time.After(time.Second * 30)
+	var rawAssignment []byte
+	for {
+		// Get the scoped role assignment
+		buff, err := runResourceCommand(t, clt, []string{"get", "scoped_role_assignment/" + assignmentName, "--format=json"})
+		if err == nil {
+			rawAssignment = buff.Bytes()
+			break
+		}
+		require.True(t, trace.IsNotFound(err), "expected a NotFound error, got %v", err)
+
+		select {
+		case <-timeout:
+			require.FailNow(t, "Timed out waiting for scoped role assignment cache propagation")
+		case <-time.After(time.Millisecond * 100):
+		}
+	}
+
+	// Unmarshal the response into a ScopedRoleAssignment object
+	as, err := services.UnmarshalProtoResourceArray[*scopedaccessv1.ScopedRoleAssignment](rawAssignment, services.DisallowUnknown())
+	require.NoError(t, err)
+	require.Len(t, as, 1)
+
+	// Compare with expected value
+	expectedAssignment := &scopedaccessv1.ScopedRoleAssignment{
+		Kind: scopedaccess.KindScopedRoleAssignment,
+		Metadata: &headerv1.Metadata{
+			Name: assignmentName,
+		},
+		Scope: "/",
+		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			User: "bob",
+			Assignments: []*scopedaccessv1.Assignment{
+				{
+					Role:  "some-role",
+					Scope: "/foo",
+				},
+			},
+		},
+		Version: types.V1,
+	}
+
+	require.Empty(t, cmp.Diff(expectedAssignment, as[0], protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+
+	// verify delete of assignment
+	_, err = runResourceCommand(t, clt, []string{"rm", "scoped_role_assignment/" + assignmentName})
+	require.NoError(t, err)
+
+	// wait for delete cache propagation
+	timeout = time.After(time.Second * 30)
+	for {
+		// verify assignment is gone
+		_, err = runResourceCommand(t, clt, []string{"get", "scoped_role_assignment/" + assignmentName, "--format=json"})
+		if err != nil {
+			require.True(t, trace.IsNotFound(err), "expected a NotFound error, got %v", err)
+			break
+		}
+
+		select {
+		case <-timeout:
+			require.FailNow(t, "Timed out waiting for scoped role assignment cache propagation")
+		case <-time.After(time.Millisecond * 100):
+		}
+	}
+
+	// verify delete of role
+	_, err = runResourceCommand(t, clt, []string{"rm", "scoped_role/some-role"})
+	require.NoError(t, err)
+
+	// wait for delete cache propagation
+	timeout = time.After(time.Second * 30)
+	for {
+		// verify role is gone
+		_, err = runResourceCommand(t, clt, []string{"get", "scoped_role/some-role", "--format=json"})
+		if err != nil {
+			require.True(t, trace.IsNotFound(err), "expected a NotFound error, got %v", err)
+			break
+		}
+
+		select {
+		case <-timeout:
+			require.FailNow(t, "Timed out waiting for scoped role cache propagation")
+		case <-time.After(time.Millisecond * 100):
+		}
+	}
+}
+
 // TestIntegrationResource tests tctl integration commands.
 func TestIntegrationResource(t *testing.T) {
 	dynAddr := helpers.NewDynamicServiceAddr(t)
@@ -347,7 +551,9 @@ func TestIntegrationResource(t *testing.T) {
 	}
 
 	auth := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, auth)
+	clt, err := testenv.NewDefaultAuthClient(auth)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	t.Run("get", func(t *testing.T) {
 
@@ -460,7 +666,9 @@ func TestDiscoveryConfigResource(t *testing.T) {
 	}
 
 	auth := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, auth)
+	clt, err := testenv.NewDefaultAuthClient(auth)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	t.Run("get", func(t *testing.T) {
 		// Add a lot of DiscoveryConfigs to test pagination
@@ -573,9 +781,11 @@ func TestCreateLock(t *testing.T) {
 	timeNow := time.Now().UTC()
 	fakeClock := clockwork.NewFakeClockAt(timeNow)
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors), withFakeClock(fakeClock))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
-	_, err := types.NewLock("test-lock", types.LockSpecV2{
+	_, err = types.NewLock("test-lock", types.LockSpecV2{
 		Target: types.LockTarget{
 			User: "bad@actor",
 		},
@@ -645,13 +855,15 @@ func TestCreateDatabaseInInsecureMode(t *testing.T) {
 	}
 
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	// Create the databases yaml file.
 	dbYAMLPath := filepath.Join(t.TempDir(), "db.yaml")
 	require.NoError(t, os.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
 
-	_, err := runResourceCommand(t, clt, []string{"create", dbYAMLPath})
+	_, err = runResourceCommand(t, clt, []string{"create", dbYAMLPath})
 	require.NoError(t, err)
 }
 
@@ -786,7 +998,9 @@ func TestCreateClusterAuthPreference_WithSupportForSecondFactorWithoutQuotes(t *
 	}
 
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	tests := []struct {
 		desc               string
@@ -871,7 +1085,9 @@ func TestCreateSAMLIdPServiceProvider(t *testing.T) {
 	}
 
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	tests := []struct {
 		desc           string
@@ -1038,7 +1254,9 @@ func (test *dynamicResourceTest[T]) setup(t *testing.T) *authclient.Client {
 		},
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 	return clt
 }
 
@@ -1370,8 +1588,15 @@ func requireGotDatabaseServers(t *testing.T, buf *bytes.Buffer, want ...types.Da
 func TestCreateResources(t *testing.T) {
 	t.Parallel()
 
-	process := testenv.MakeTestServer(t, testenv.WithLogger(utils.NewSlogLoggerForTests()))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(logtest.NewLogger()))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	// tctlGetAllValidations allows tests to register post-test validations to validate
 	// that their resource is present in "tctl get all" output.
@@ -2116,7 +2341,7 @@ version: v1
 // The tests are grouped to amortize the cost of creating and auth server since
 // that is the most expensive part of testing editing the resource.
 func TestCreateEnterpriseResources(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -2126,8 +2351,15 @@ func TestCreateEnterpriseResources(t *testing.T) {
 		},
 	})
 
-	process := testenv.MakeTestServer(t)
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	tests := []struct {
 		kind   string
diff --git a/tool/tctl/common/resource_summarizer.go b/tool/tctl/common/resource_summarizer.go
new file mode 100644
index 0000000000000..552be979cd67c
--- /dev/null
+++ b/tool/tctl/common/resource_summarizer.go
@@ -0,0 +1,437 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// CRUD operations for InferenceModel resources
+
+// createInferenceModel creates or updates a new inference model resource.
+func (rc *ResourceCommand) createInferenceModel(
+	ctx context.Context, clt *authclient.Client, raw services.UnknownResource,
+) error {
+	model, err := services.UnmarshalProtoResource[*summarizerv1.InferenceModel](
+		raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	sclt := clt.SummarizerServiceClient()
+	if rc.IsForced() {
+		req := &summarizerv1.UpsertInferenceModelRequest{
+			Model: model,
+		}
+		_, err = sclt.UpsertInferenceModel(ctx, req)
+	} else {
+		req := &summarizerv1.CreateInferenceModelRequest{
+			Model: model,
+		}
+		_, err = sclt.CreateInferenceModel(ctx, req)
+	}
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Printf("inference_model %q has been created\n", model.GetMetadata().GetName())
+	return nil
+}
+
+// updateInferenceModel updates an inference model resource.
+func (rc *ResourceCommand) updateInferenceModel(
+	ctx context.Context, clt *authclient.Client, raw services.UnknownResource,
+) error {
+	model, err := services.UnmarshalProtoResource[*summarizerv1.InferenceModel](
+		raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	req := &summarizerv1.UpdateInferenceModelRequest{
+		Model: model,
+	}
+	if _, err := clt.SummarizerServiceClient().UpdateInferenceModel(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("inference_model %q has been updated\n", model.GetMetadata().GetName())
+	return nil
+}
+
+// getInferenceModels retrieves one or more inference model resources.
+func (rc *ResourceCommand) getInferenceModels(
+	ctx context.Context, clt *authclient.Client,
+) (ResourceCollection, error) {
+	ssclt := clt.SummarizerServiceClient()
+	if rc.ref.Name != "" {
+		req := &summarizerv1.GetInferenceModelRequest{
+			Name: rc.ref.Name,
+		}
+		res, err := ssclt.GetInferenceModel(ctx, req)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return InferenceModelCollection{res.Model}, nil
+	}
+
+	items, err := stream.Collect(clientutils.Resources(
+		ctx,
+		func(
+			ctx context.Context, _ int, nextPageToken string,
+		) ([]*summarizerv1.InferenceModel, string, error) {
+			resp, err := ssclt.ListInferenceModels(
+				ctx,
+				&summarizerv1.ListInferenceModelsRequest{
+					PageToken: nextPageToken,
+				})
+			return resp.GetModels(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return InferenceModelCollection(items), nil
+}
+
+// deleteInferenceModel deletes an inference model resource.
+func (rc *ResourceCommand) deleteInferenceModel(
+	ctx context.Context, clt *authclient.Client,
+) error {
+	req := &summarizerv1.DeleteInferenceModelRequest{
+		Name: rc.ref.Name,
+	}
+	if _, err := clt.SummarizerServiceClient().DeleteInferenceModel(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("inference_model %q has been deleted\n", rc.ref.Name)
+	return nil
+}
+
+// InferenceModelCollection is a collection of InferenceModel resources that
+// can be written to an io.Writer in a human-readable format.
+type InferenceModelCollection []*summarizerv1.InferenceModel
+
+func (c InferenceModelCollection) resources() []types.Resource {
+	out := make([]types.Resource, 0, len(c))
+	for _, item := range c {
+		out = append(out, types.ProtoResource153ToLegacy(item))
+	}
+	return out
+}
+
+func (c InferenceModelCollection) Resources() []types.Resource {
+	return c.resources()
+}
+
+func (c InferenceModelCollection) writeText(w io.Writer, verbose bool) error {
+	headers := []string{"Name", "Description", "Provider", "Provider Model ID"}
+	var rows [][]string
+	for _, item := range c {
+		meta := item.GetMetadata()
+		spec := item.GetSpec()
+		providerName := ""
+		providerModel := ""
+		if spec.GetOpenai() != nil {
+			providerName = "OpenAI"
+			providerModel = spec.GetOpenai().OpenaiModelId
+		}
+		rows = append(rows, []string{
+			meta.GetName(),
+			meta.GetDescription(),
+			providerName,
+			providerModel,
+		})
+	}
+	var t asciitable.Table
+	if verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Description")
+	}
+
+	// stable sort by name.
+	t.SortRowsBy([]int{0}, true)
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+// CRUD operations for InferenceSecret resources
+
+// createInferenceSecret creates or updates a new inference secret resource.
+func (rc *ResourceCommand) createInferenceSecret(
+	ctx context.Context, clt *authclient.Client, raw services.UnknownResource,
+) error {
+	secret, err := services.UnmarshalProtoResource[*summarizerv1.InferenceSecret](
+		raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	sclt := clt.SummarizerServiceClient()
+	if rc.IsForced() {
+		req := &summarizerv1.UpsertInferenceSecretRequest{
+			Secret: secret,
+		}
+		_, err = sclt.UpsertInferenceSecret(ctx, req)
+	} else {
+		req := &summarizerv1.CreateInferenceSecretRequest{
+			Secret: secret,
+		}
+		_, err = sclt.CreateInferenceSecret(ctx, req)
+	}
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Printf("inference_secret %q has been created\n", secret.GetMetadata().GetName())
+	return nil
+}
+
+// getInferenceSecrets retrieves one or more inference secret resources.
+func (rc *ResourceCommand) getInferenceSecrets(
+	ctx context.Context, clt *authclient.Client,
+) (ResourceCollection, error) {
+	ssclt := clt.SummarizerServiceClient()
+	if rc.ref.Name != "" {
+		req := &summarizerv1.GetInferenceSecretRequest{
+			Name: rc.ref.Name,
+		}
+		res, err := ssclt.GetInferenceSecret(ctx, req)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return inferenceSecretCollection{res.Secret}, nil
+	}
+
+	items, err := stream.Collect(clientutils.Resources(
+		ctx,
+		func(
+			ctx context.Context, _ int, nextPageToken string,
+		) ([]*summarizerv1.InferenceSecret, string, error) {
+			resp, err := ssclt.ListInferenceSecrets(
+				ctx,
+				&summarizerv1.ListInferenceSecretsRequest{
+					PageToken: nextPageToken,
+				})
+			return resp.GetSecrets(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return inferenceSecretCollection(items), nil
+}
+
+func (rc *ResourceCommand) deleteInferenceSecret(
+	ctx context.Context, clt *authclient.Client,
+) error {
+	req := &summarizerv1.DeleteInferenceSecretRequest{
+		Name: rc.ref.Name,
+	}
+	if _, err := clt.SummarizerServiceClient().DeleteInferenceSecret(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("inference_secret %q has been deleted\n", rc.ref.Name)
+	return nil
+}
+
+// inferenceSecretCollection is a collection of InferenceSecret resources that
+// can be written to an io.Writer in a human-readable format.
+type inferenceSecretCollection []*summarizerv1.InferenceSecret
+
+func (c inferenceSecretCollection) resources() []types.Resource {
+	out := make([]types.Resource, 0, len(c))
+	for _, item := range c {
+		out = append(out, types.ProtoResource153ToLegacy(item))
+	}
+	return out
+}
+
+func (c inferenceSecretCollection) writeText(w io.Writer, verbose bool) error {
+	headers := []string{"Name", "Description"}
+	var rows [][]string
+	for _, item := range c {
+		meta := item.GetMetadata()
+		rows = append(rows, []string{
+			meta.GetName(),
+			meta.GetDescription(),
+		})
+	}
+	var t asciitable.Table
+	if verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Description")
+	}
+
+	// stable sort by name.
+	t.SortRowsBy([]int{0}, true)
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+// CRUD operations for InferencePolicy resources
+
+// createInferencePolicy creates or updates a new inference policy resource.
+func (rc *ResourceCommand) createInferencePolicy(
+	ctx context.Context, clt *authclient.Client, raw services.UnknownResource,
+) error {
+	policy, err := services.UnmarshalProtoResource[*summarizerv1.InferencePolicy](
+		raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	sclt := clt.SummarizerServiceClient()
+	if rc.IsForced() {
+		req := &summarizerv1.UpsertInferencePolicyRequest{
+			Policy: policy,
+		}
+		_, err = sclt.UpsertInferencePolicy(ctx, req)
+	} else {
+		req := &summarizerv1.CreateInferencePolicyRequest{
+			Policy: policy,
+		}
+		_, err = sclt.CreateInferencePolicy(ctx, req)
+	}
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	fmt.Printf("inference_policy %q has been created\n", policy.GetMetadata().GetName())
+	return nil
+}
+
+// updateInferencePolicy updates an inference policy resource.
+func (rc *ResourceCommand) updateInferencePolicy(
+	ctx context.Context, clt *authclient.Client, raw services.UnknownResource,
+) error {
+	policy, err := services.UnmarshalProtoResource[*summarizerv1.InferencePolicy](
+		raw.Raw, services.DisallowUnknown())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	req := &summarizerv1.UpdateInferencePolicyRequest{
+		Policy: policy,
+	}
+	if _, err := clt.SummarizerServiceClient().UpdateInferencePolicy(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("inference_policy %q has been updated\n", policy.GetMetadata().GetName())
+	return nil
+}
+
+// getInferencePolicies retrieves one or more inference policy resources.
+func (rc *ResourceCommand) getInferencePolicies(
+	ctx context.Context, clt *authclient.Client,
+) (ResourceCollection, error) {
+	ssclt := clt.SummarizerServiceClient()
+	if rc.ref.Name != "" {
+		req := &summarizerv1.GetInferencePolicyRequest{
+			Name: rc.ref.Name,
+		}
+		res, err := ssclt.GetInferencePolicy(ctx, req)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return InferencePolicyCollection{res.Policy}, nil
+	}
+
+	items, err := stream.Collect(clientutils.Resources(
+		ctx,
+		func(
+			ctx context.Context, _ int, nextPageToken string,
+		) ([]*summarizerv1.InferencePolicy, string, error) {
+			resp, err := ssclt.ListInferencePolicies(
+				ctx,
+				&summarizerv1.ListInferencePoliciesRequest{
+					PageToken: nextPageToken,
+				})
+			return resp.GetPolicies(), resp.GetNextPageToken(), trace.Wrap(err)
+		}))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return InferencePolicyCollection(items), nil
+}
+
+// deleteInferencePolicy deletes an inference policy resource.
+func (rc *ResourceCommand) deleteInferencePolicy(
+	ctx context.Context, clt *authclient.Client,
+) error {
+	req := &summarizerv1.DeleteInferencePolicyRequest{
+		Name: rc.ref.Name,
+	}
+	if _, err := clt.SummarizerServiceClient().DeleteInferencePolicy(ctx, req); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("inference_policy %q has been deleted\n", rc.ref.Name)
+	return nil
+}
+
+// InferencePolicyCollection is a collection of InferencePolicy resources that
+// can be written to an io.Writer in a human-readable format.
+type InferencePolicyCollection []*summarizerv1.InferencePolicy
+
+func (c InferencePolicyCollection) resources() []types.Resource {
+	out := make([]types.Resource, 0, len(c))
+	for _, item := range c {
+		out = append(out, types.ProtoResource153ToLegacy(item))
+	}
+	return out
+}
+
+func (c InferencePolicyCollection) Resources() []types.Resource {
+	return c.resources()
+}
+
+func (c InferencePolicyCollection) writeText(w io.Writer, verbose bool) error {
+	headers := []string{"Name", "Description", "Kinds", "Filter", "Model"}
+	var rows [][]string
+	for _, item := range c {
+		meta := item.GetMetadata()
+		spec := item.GetSpec()
+		rows = append(rows, []string{
+			meta.GetName(),
+			meta.GetDescription(),
+			strings.Join(spec.Kinds, ", "),
+			spec.Filter,
+			spec.Model,
+		})
+	}
+	var t asciitable.Table
+	if verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Description")
+	}
+
+	// stable sort by name.
+	t.SortRowsBy([]int{0}, true)
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
diff --git a/tool/tctl/common/scoped_command.go b/tool/tctl/common/scoped_command.go
new file mode 100644
index 0000000000000..764fbbc7e2487
--- /dev/null
+++ b/tool/tctl/common/scoped_command.go
@@ -0,0 +1,145 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"maps"
+	"os"
+	"slices"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
+	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
+)
+
+// ScopedCommand implements scoped variants of tctl command groups, such as
+// `tctl scoped tokens`.
+type ScopedCommand struct {
+	config *servicecfg.Config
+	tokens *ScopedTokensCommand
+	Stdout io.Writer
+
+	status *kingpin.CmdClause
+}
+
+// Initialize allows ScopedCommand to plug itself into the CLI parser
+func (c *ScopedCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
+	c.config = config
+	scoped := app.Command("scoped", "Run a subcommand using scoped auth").Alias("scopes")
+
+	if c.Stdout == nil {
+		c.Stdout = os.Stdout
+	}
+
+	c.tokens = &ScopedTokensCommand{
+		Stdout: c.Stdout,
+	}
+
+	c.tokens.Initialize(scoped, config)
+
+	c.status = scoped.Command("status", "Show the status of scoped resources")
+}
+
+// TryRun takes the CLI command as an argument (like "scoped tokens") and executes it.
+func (c *ScopedCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
+	var commandFunc func(ctx context.Context, client *authclient.Client) error
+	switch cmd {
+	case c.status.FullCommand():
+		commandFunc = c.Status
+	default:
+		// may match the token family of commands
+		return c.tokens.TryRun(ctx, cmd, clientFunc)
+	}
+
+	client, closeFn, err := clientFunc(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer closeFn(ctx)
+
+	return true, trace.Wrap(commandFunc(ctx, client))
+}
+
+// Status shows the status of scoped resources.
+func (c *ScopedCommand) Status(ctx context.Context, client *authclient.Client) error {
+	// TODO(fspmarshall/scopes): move the calculation of counts server-side and based on
+	// scoped access cache. Ideally we want to allow for a paginated view of scope stats
+	// with one item/row per scope.  We should also consider how to optionally include
+	// additional columns conditional on user's permissions (e.g. number of tokens if
+	// user has permission to view tokens... in that case specifically we want readnosecrets
+	// to allow seeing the token count without seeing actual tokens).
+	type scopeMetricRow struct {
+		scope       string
+		roles       int
+		assignments int
+	}
+
+	// aggregate per scope counts
+	rows := make(map[string]scopeMetricRow)
+
+	for role, err := range scopedutils.RangeScopedRoles(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRolesRequest{}) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		scope := scopes.NormalizeForEquality(role.GetScope())
+		row := rows[scope]
+		row.scope = scope
+		row.roles++
+		rows[scope] = row
+	}
+
+	for assignment, err := range scopedutils.RangeScopedRoleAssignments(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{}) {
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		scope := scopes.NormalizeForEquality(assignment.GetScope())
+		row := rows[scope]
+		row.scope = scope
+		row.assignments++
+		rows[scope] = row
+	}
+
+	// scope sort order differs subtly from lexographic order, so we need a custom sort func here
+	sortedScopes := slices.SortedFunc(maps.Keys(rows), scopes.Sort)
+
+	table := asciitable.MakeTable([]string{"Scope", "Roles", "Assignments"})
+	for _, scope := range sortedScopes {
+		table.AddRow([]string{
+			scope,
+			fmt.Sprintf("%d", rows[scope].roles),
+			fmt.Sprintf("%d", rows[scope].assignments),
+		})
+	}
+
+	fmt.Fprint(c.Stdout, table.AsBuffer().String())
+	return nil
+}
diff --git a/tool/tctl/common/scoped_token_command.go b/tool/tctl/common/scoped_token_command.go
new file mode 100644
index 0000000000000..f731a9575d8f8
--- /dev/null
+++ b/tool/tctl/common/scoped_token_command.go
@@ -0,0 +1,310 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	joiningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/joining/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/scopes/joining"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/utils"
+	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
+)
+
+// ScopedTokensCommand implements `tctl scoped tokens` group of commands
+type ScopedTokensCommand struct {
+	config *servicecfg.Config
+
+	withSecrets bool
+
+	// format is the output format, e.g. text or json
+	format string
+
+	// tokenType is the type of token. For example, "node".
+	tokenType string
+
+	// Value is the value of the token. Can be used to either act on a
+	// token (for example, delete a token) or used to create a token with a
+	// specific value.
+	value string
+
+	// assignedScope allows for filtering tokens by the scope they assign
+	assignedScope string
+
+	// tokenScope allows for filtering tokens by the scope they belong to
+	tokenScope string
+
+	// ttl is how long the token will live for.
+	ttl time.Duration
+
+	// tokenAdd is used to add a token.
+	tokenAdd *kingpin.CmdClause
+
+	// tokenDel is used to delete a token.
+	tokenDel *kingpin.CmdClause
+
+	// tokenList is used to view all tokens that Teleport knows about.
+	tokenList *kingpin.CmdClause
+
+	// Stdout allows to switch the standard output source. Used in tests.
+	Stdout io.Writer
+}
+
+// Initialize allows TokenCommand to plug itself into the CLI parser
+func (c *ScopedTokensCommand) Initialize(scopedCmd *kingpin.CmdClause, config *servicecfg.Config) {
+	c.config = config
+
+	tokens := scopedCmd.Command("tokens", "List or revoke scoped invitation tokens")
+
+	formats := []string{teleport.Text, teleport.JSON, teleport.YAML}
+
+	// tctl scoped tokens add ..."
+	c.tokenAdd = tokens.Command("add", "Create a scoped invitation token.")
+	c.tokenAdd.Flag("type", "Type(s) of token to add, e.g. --type=node").Required().StringVar(&c.tokenType)
+	c.tokenAdd.Flag("value", "Override the default random generated token with a specified value").StringVar(&c.value)
+	c.tokenAdd.Flag("ttl", fmt.Sprintf("Set expiration time for token, default is %v minutes",
+		int(defaults.ProvisioningTokenTTL/time.Minute))).
+		Default(fmt.Sprintf("%v", defaults.ProvisioningTokenTTL)).
+		DurationVar(&c.ttl)
+	c.tokenAdd.Flag("format", "Output format, 'text', 'json', or 'yaml'").EnumVar(&c.format, formats...)
+	c.tokenAdd.Flag("assign-scope", "Scope that should be applied to resources provisioned by this token").StringVar(&c.assignedScope)
+	c.tokenAdd.Flag("scope", "Scope assigned to the token itself").StringVar(&c.tokenScope)
+
+	// "tctl scoped tokens rm ..."
+	c.tokenDel = tokens.Command("rm", "Delete/revoke a scoped invitation token.").Alias("del")
+	c.tokenDel.Arg("token", "Token to delete").StringVar(&c.value)
+
+	// "tctl scoped tokens ls"
+	c.tokenList = tokens.Command("ls", "List invitation tokens.")
+	c.tokenList.Flag("format", "Output format, 'text', 'json' or 'yaml'").EnumVar(&c.format, formats...)
+	c.tokenList.Flag("with-secrets", "Do not redact join tokens").BoolVar(&c.withSecrets)
+
+	if c.Stdout == nil {
+		c.Stdout = os.Stdout
+	}
+}
+
+// TryRun attempts to run subcommands like like "scoped tokens ls".
+func (c *ScopedTokensCommand) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (match bool, err error) {
+	var commandFunc func(ctx context.Context, client *authclient.Client) error
+	switch cmd {
+	case c.tokenAdd.FullCommand():
+		commandFunc = c.Add
+	case c.tokenDel.FullCommand():
+		commandFunc = c.Del
+	case c.tokenList.FullCommand():
+		commandFunc = c.List
+	default:
+		return false, nil
+	}
+	client, closeFn, err := clientFunc(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	err = commandFunc(ctx, client)
+	closeFn(ctx)
+
+	return true, trace.Wrap(err)
+}
+
+// Add is called to execute "scoped tokens add ..." command.
+func (c *ScopedTokensCommand) Add(ctx context.Context, client *authclient.Client) error {
+	// Parse string to see if it's a type of role that Teleport supports.
+	roles, err := types.ParseTeleportRoles(c.tokenType)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// If it's Kube, then enable App and Discovery roles automatically so users
+	// don't have problems with running Kubernetes App Discovery by default.
+	if len(roles) == 1 && roles[0] == types.RoleKube {
+		roles = append(roles, types.RoleApp, types.RoleDiscovery)
+	}
+
+	tokenName := c.value
+
+	expires := time.Now().UTC().Add(c.ttl)
+	tok := &joiningv1.ScopedToken{
+		Kind:    types.KindScopedToken,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name:    tokenName,
+			Expires: timestamppb.New(expires),
+		},
+		Scope: c.tokenScope,
+		Spec: &joiningv1.ScopedTokenSpec{
+			Roles:         roles.StringSlice(),
+			AssignedScope: c.assignedScope,
+		},
+	}
+
+	tok, err = client.CreateScopedToken(ctx, tok)
+	if err != nil {
+		if trace.IsAlreadyExists(err) {
+			return trace.AlreadyExists(
+				"failed to create scoped token (%q already exists), please use another name",
+				tokenName,
+			)
+		}
+		return trace.Wrap(err, "creating scoped token")
+	}
+
+	tokenName = tok.GetMetadata().GetName()
+	// Print token information formatted with JSON, YAML, or just print the raw token.
+	switch c.format {
+	case teleport.JSON, teleport.YAML:
+		expires := time.Now().Add(c.ttl)
+		tokenInfo := map[string]any{
+			"token":        tokenName,
+			"roles":        roles,
+			"scope":        tok.GetScope(),
+			"assign_scope": tok.GetSpec().GetAssignedScope(),
+			"expires":      expires,
+		}
+
+		var (
+			data []byte
+			err  error
+		)
+		if c.format == teleport.JSON {
+			data, err = json.MarshalIndent(tokenInfo, "", " ")
+		} else {
+			data, err = yaml.Marshal(tokenInfo)
+		}
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Fprint(c.Stdout, string(data))
+
+		return nil
+	case teleport.Text:
+		fmt.Fprintln(c.Stdout, tokenName)
+		return nil
+	}
+
+	return trace.Wrap(showJoinInstructions(ctx, joinInstructionsInput{
+		out:       c.Stdout,
+		ttl:       c.ttl,
+		roles:     roles,
+		tokenName: tokenName,
+		client:    client,
+	}))
+}
+
+// Del is called to execute "scoped tokens del ..." command.
+func (c *ScopedTokensCommand) Del(ctx context.Context, client *authclient.Client) error {
+	if c.value == "" {
+		return trace.BadParameter("Need an argument: token")
+	}
+	if err := client.DeleteScopedToken(ctx, c.value); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Fprintf(c.Stdout, "Token %s has been deleted\n", c.value)
+	return nil
+}
+
+// List is called to execute "tokens ls" command.
+func (c *ScopedTokensCommand) List(ctx context.Context, client *authclient.Client) error {
+	tokens, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageKey string) ([]*joiningv1.ScopedToken, string, error) {
+		res, err := client.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{
+			Limit:  uint32(pageSize),
+			Cursor: pageKey,
+		})
+		if err != nil {
+			return nil, "", trace.Wrap(err)
+		}
+
+		return res.GetTokens(), res.GetCursor(), nil
+	}))
+	if err != nil {
+		return trace.Wrap(err, "listing scoped tokens")
+	}
+
+	if len(tokens) == 0 && c.format == teleport.Text {
+		fmt.Fprintln(c.Stdout, "No active tokens found.")
+		return nil
+	}
+
+	// Sort by expire time.
+	slices.SortStableFunc(tokens, func(left, right *joiningv1.ScopedToken) int {
+		return left.GetMetadata().GetExpires().AsTime().Compare(right.GetMetadata().GetExpires().AsTime())
+	})
+
+	nameFunc := func(tok *joiningv1.ScopedToken) string {
+		if c.withSecrets {
+			return tok.GetMetadata().GetName()
+		}
+		return joining.GetSafeScopedTokenName(tok)
+	}
+	switch c.format {
+	case teleport.JSON:
+		err := utils.WriteJSONArray(c.Stdout, tokens)
+		if err != nil {
+			return trace.Wrap(err, "failed to marshal tokens")
+		}
+	case teleport.YAML:
+		err := utils.WriteYAML(c.Stdout, tokens)
+		if err != nil {
+			return trace.Wrap(err, "failed to marshal tokens")
+		}
+	case teleport.Text:
+		for _, token := range tokens {
+			fmt.Fprintln(c.Stdout, nameFunc(token))
+		}
+	default:
+		tokensView := func() string {
+			table := asciitable.MakeTable([]string{"Token", "Type", "Scope", "Assigns Scope", "Labels", "Expiry Time (UTC)"})
+			now := time.Now()
+			for _, t := range tokens {
+				expiry := "never"
+				expiresAt := t.GetMetadata().GetExpires().AsTime()
+				if !expiresAt.IsZero() && expiresAt.Unix() != 0 {
+					exptime := expiresAt.Format(time.RFC822)
+					expdur := expiresAt.Sub(now).Round(time.Second)
+					expiry = fmt.Sprintf("%s (%s)", exptime, expdur.String())
+				}
+				table.AddRow([]string{nameFunc(t), strings.Join(t.GetSpec().GetRoles(), ","), t.GetScope(), t.GetSpec().GetAssignedScope(), printMetadataLabels(t.GetMetadata().Labels), expiry})
+			}
+			return table.AsBuffer().String()
+		}
+		fmt.Fprint(c.Stdout, tokensView())
+	}
+	return nil
+}
diff --git a/tool/tctl/common/scoped_token_command_test.go b/tool/tctl/common/scoped_token_command_test.go
new file mode 100644
index 0000000000000..95f2c34981fb3
--- /dev/null
+++ b/tool/tctl/common/scoped_token_command_test.go
@@ -0,0 +1,125 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+type listedScopedToken struct {
+	Kind     string
+	Version  string
+	Metadata struct {
+		Name    string
+		Expires timestamppb.Timestamp
+		ID      uint
+	}
+	Spec struct {
+		Roles      []string
+		JoinMethod string
+	}
+}
+
+func TestScopedTokens(t *testing.T) {
+	dynAddr := helpers.NewDynamicServiceAddr(t)
+	fileConfig := &config.FileConfig{
+		Global: config.Global{
+			DataDir: t.TempDir(),
+		},
+		Apps: config.Apps{
+			Service: config.Service{
+				EnabledFlag: "true",
+			},
+		},
+		Proxy: config.Proxy{
+			Service: config.Service{
+				EnabledFlag: "true",
+			},
+			WebAddr: dynAddr.WebAddr,
+			TunAddr: dynAddr.TunnelAddr,
+		},
+		Auth: config.Auth{
+			Service: config.Service{
+				EnabledFlag:   "true",
+				ListenAddress: dynAddr.AuthAddr,
+			},
+		},
+	}
+
+	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
+
+	scopeFlags := []string{"--scope=/aa", "--assign-scope=/aa/bb"}
+	// Test all output formats of "tokens add".
+	buf, err := runScopedCommand(t, clt, append([]string{"tokens", "add", "--type=node"}, scopeFlags...))
+	require.NoError(t, err)
+	require.True(t, strings.HasPrefix(buf.String(), "The invite token:"))
+
+	buf, err = runScopedCommand(t, clt, append([]string{"tokens", "add", "--type=node", "--format", teleport.Text}, scopeFlags...))
+	require.NoError(t, err)
+	require.Equal(t, 1, strings.Count(buf.String(), "\n"))
+
+	buf, err = runScopedCommand(t, clt, append([]string{"tokens", "add", "--type=node", "--format", teleport.JSON}, scopeFlags...))
+	require.NoError(t, err)
+	out := mustDecodeJSON[addedToken](t, buf)
+
+	require.Len(t, out.Roles, 1)
+	require.Equal(t, types.KindNode, strings.ToLower(out.Roles[0]))
+
+	buf, err = runScopedCommand(t, clt, append([]string{"tokens", "add", "--type=node", "--format", teleport.YAML}, scopeFlags...))
+	require.NoError(t, err)
+	out = mustDecodeYAML[addedToken](t, buf)
+
+	require.Len(t, out.Roles, 1)
+	require.Equal(t, types.KindNode, strings.ToLower(out.Roles[0]))
+
+	// Test all output formats of "tokens ls".
+	buf, err = runScopedCommand(t, clt, []string{"tokens", "ls"})
+	require.NoError(t, err)
+	require.True(t, strings.HasPrefix(buf.String(), "Token "))
+	require.Equal(t, 6, strings.Count(buf.String(), "\n")) // account for header lines
+
+	buf, err = runScopedCommand(t, clt, []string{"tokens", "ls", "--format", teleport.Text})
+	require.NoError(t, err)
+	require.Equal(t, 4, strings.Count(buf.String(), "\n"))
+
+	buf, err = runScopedCommand(t, clt, []string{"tokens", "ls", "--format", teleport.JSON})
+	require.NoError(t, err)
+	jsonOut := mustDecodeJSON[[]listedScopedToken](t, buf)
+	require.Len(t, jsonOut, 4)
+
+	buf, err = runScopedCommand(t, clt, []string{"tokens", "ls", "--format", teleport.YAML})
+	require.NoError(t, err)
+	yamlOut := []listedScopedToken{}
+	mustDecodeYAMLDocuments(t, buf, &yamlOut)
+	require.Len(t, yamlOut, 4)
+	require.Equal(t, jsonOut, yamlOut)
+}
diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go
index c1a47e0acdd28..cb3afd2fc9bc8 100644
--- a/tool/tctl/common/tctl.go
+++ b/tool/tctl/common/tctl.go
@@ -26,6 +26,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
@@ -73,11 +74,7 @@ type CLICommand interface {
 //
 // distribution: name of the Teleport distribution
 func Run(ctx context.Context, commands []CLICommand) {
-	if err := tools.CheckAndUpdateLocal(ctx, os.Args[1:]); err != nil {
-		utils.FatalError(err)
-	}
-
-	err := TryRun(commands, os.Args[1:])
+	err := TryRun(ctx, commands, os.Args[1:])
 	if err != nil {
 		var exitError *common.ExitCodeError
 		if errors.As(err, &exitError) {
@@ -89,18 +86,42 @@ func Run(ctx context.Context, commands []CLICommand) {
 
 // TryRun is a helper function for Run to call - it runs a tctl command and returns an error.
 // This is useful for testing tctl, because we can capture the returned error in tests.
-func TryRun(commands []CLICommand, args []string) error {
+func TryRun(ctx context.Context, commands []CLICommand, args []string) error {
 	utils.InitLogger(utils.LoggingForCLI, slog.LevelWarn)
 
-	// app is the command line parser
-	app := utils.InitCLIParser("tctl", GlobalHelpString)
+	var ccf tctlcfg.GlobalCLIFlags
+	muApp := utils.InitHiddenCLIParser()
+	muApp.Flag("auth-server",
+		fmt.Sprintf("Attempts to connect to specific auth/proxy address(es) instead of local auth [%v]", defaults.AuthConnectAddr().Addr)).
+		Envar(authAddrEnvVar).
+		StringsVar(&ccf.AuthServerAddr)
+	// We need to parse the arguments before executing managed updates to identify
+	// the profile name and the required version for the current cluster.
+	// All other commands and flags may change between versions, so full parsing
+	// should be performed only after managed updates are applied.
+	if _, err := muApp.Parse(utils.FilterArguments(args, muApp.Model())); err != nil {
+		slog.WarnContext(ctx, "can't identify current profile", "error", err)
+	}
 
 	// cfg (teleport auth server configuration) is going to be shared by all
 	// commands
 	cfg := servicecfg.MakeDefaultConfig()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	cfg.TeleportHome = os.Getenv(types.HomeEnvVar)
+	if cfg.TeleportHome != "" {
+		cfg.TeleportHome = filepath.Clean(cfg.TeleportHome)
+	}
 
-	var ccf tctlcfg.GlobalCLIFlags
+	var name string
+	if len(ccf.AuthServerAddr) != 0 {
+		name = utils.TryHost(strings.TrimPrefix(strings.ToLower(ccf.AuthServerAddr[0]), "https://"))
+	}
+	if err := tools.CheckAndUpdateLocal(ctx, name, args); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// app is the command line parser
+	app := utils.InitCLIParser("tctl", GlobalHelpString)
 
 	// Each command will add itself to the CLI parser.
 	for i := range commands {
@@ -157,14 +178,8 @@ func TryRun(commands []CLICommand, args []string) error {
 		return trace.BadParameter("tctl --identity also requires --auth-server")
 	}
 
-	cfg.TeleportHome = os.Getenv(types.HomeEnvVar)
-	if cfg.TeleportHome != "" {
-		cfg.TeleportHome = filepath.Clean(cfg.TeleportHome)
-	}
-
 	cfg.Debug = ccf.Debug
 
-	ctx := context.Background()
 	clientFunc := commonclient.GetInitFunc(ccf, cfg)
 	// Execute whatever is selected.
 	for _, c := range commands {
diff --git a/tool/tctl/common/tctl_test.go b/tool/tctl/common/tctl_test.go
index f7b8f7e442039..00c450f9338b9 100644
--- a/tool/tctl/common/tctl_test.go
+++ b/tool/tctl/common/tctl_test.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
@@ -48,7 +49,11 @@ func TestMain(m *testing.M) {
 	}
 
 	modules.SetInsecureTestMode(true)
-	os.Exit(m.Run())
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 func BenchmarkInit(b *testing.B) {
@@ -128,7 +133,9 @@ func TestConnect(t *testing.T) {
 		},
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 	fileConfigAgent := &config.FileConfig{
 		Global: config.Global{
 			DataDir: t.TempDir(),
diff --git a/tool/tctl/common/terraform_command.go b/tool/tctl/common/terraform_command.go
index 1a0e9bf552a56..b2d2527b0829b 100644
--- a/tool/tctl/common/terraform_command.go
+++ b/tool/tctl/common/terraform_command.go
@@ -43,9 +43,12 @@ import (
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/tbot"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/bot/connection"
+	"github.com/gravitational/teleport/lib/tbot/bot/destination"
+	"github.com/gravitational/teleport/lib/tbot/bot/onboarding"
 	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/tbot/services/clientcredentials"
 	"github.com/gravitational/teleport/lib/tbot/ssh"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
@@ -298,28 +301,37 @@ func (c *TerraformCommand) checkIfRoleExists(ctx context.Context, client roleCli
 // Note: the function also returns the SSH Host CA cert encoded in the known host format.
 // The identity.Identity uses a different format (authorized keys).
 func (c *TerraformCommand) useBotToObtainIdentity(ctx context.Context, addr utils.NetAddr, token string, clt *authclient.Client) (*identity.Identity, [][]byte, error) {
-	credential := &config.UnstableClientCredentialOutput{}
-	cfg := &config.BotConfig{
-		Version: "",
-		Onboarding: config.OnboardingConfig{
+	credential := &clientcredentials.UnstableConfig{}
+	credentialLifetime := bot.CredentialLifetime{
+		TTL:             c.botTTL,
+		RenewalInterval: bot.DefaultCredentialLifetime.RenewalInterval,
+	}
+	cfg := bot.Config{
+		Kind: bot.KindTctl,
+		Connection: connection.Config{
+			Address:     addr.String(),
+			AddressKind: connection.AddressKindAuth,
+			// When setting AuthServerAddressMode to ProxyAllowed, tbot will try both joining as an auth and as a proxy.
+			// This allows us to not care about how the user connects to Teleport (auth vs proxy joining).
+			AuthServerAddressMode: connection.AllowProxyAsAuthServer,
+			// If --insecure is passed, the bot will trust the certificate on first use.
+			// This does not truly disable TLS validation, only trusts the certificate on first connection.
+			Insecure: clt.Config().InsecureSkipVerify,
+		},
+		Onboarding: onboarding.Config{
 			TokenValue: token,
 			JoinMethod: types.JoinMethodToken,
 		},
-		Storage:            &config.StorageConfig{Destination: &config.DestinationMemory{}},
-		Services:           config.ServiceConfigs{credential},
-		CredentialLifetime: config.CredentialLifetime{TTL: c.botTTL},
-		Oneshot:            true,
-		// If --insecure is passed, the bot will trust the certificate on first use.
-		// This does not truly disable TLS validation, only trusts the certificate on first connection.
-		Insecure: clt.Config().InsecureSkipVerify,
+		InternalStorage:    destination.NewMemory(),
+		CredentialLifetime: credentialLifetime,
+		Services: []bot.ServiceBuilder{
+			clientcredentials.ServiceBuilder(credential, credentialLifetime),
+		},
+		Logger: c.log,
 	}
 
-	// When invoked only with auth address, tbot will try both joining as an auth and as a proxy.
-	// This allows us to not care about how the user connects to Teleport (auth vs proxy joining).
-	cfg.AuthServer = addr.String()
-
 	// Insecure joining is not compatible with CA pinning
-	if !cfg.Insecure {
+	if !cfg.Connection.Insecure {
 		// We use the client to get the TLS CA and compute its fingerprint.
 		// In case of auth joining, this ensures that tbot connects to the same Teleport auth as we do
 		// (no man in the middle possible between when we build the auth client and when we run tbot).
@@ -340,8 +352,11 @@ func (c *TerraformCommand) useBotToObtainIdentity(ctx context.Context, addr util
 	}
 
 	// Run the bot
-	bot := tbot.New(cfg, c.log)
-	err = bot.Run(ctx)
+	bot, err := bot.New(cfg)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "creating the bot")
+	}
+	err = bot.OneShot(ctx)
 	if err != nil {
 		return nil, nil, trace.Wrap(err, "running the bot")
 	}
diff --git a/tool/tctl/common/terraform_command_test.go b/tool/tctl/common/terraform_command_test.go
index e1db99aa73347..65c327cb875ea 100644
--- a/tool/tctl/common/terraform_command_test.go
+++ b/tool/tctl/common/terraform_command_test.go
@@ -29,7 +29,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/integrations/lib/testing/integration"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 // Note: due to its complex interactions with Teleport, the `tctl terraform env`
@@ -98,7 +98,7 @@ func TestTerraformCommand_checkIfRoleExists(t *testing.T) {
 			c := &TerraformCommand{
 				existingRole: tt.existingRoleFlag,
 				userOutput:   os.Stderr,
-				log:          utils.NewSlogLoggerForTests(),
+				log:          logtest.NewLogger(),
 			}
 			roleName, err := c.checkIfRoleExists(ctx, adminClient)
 			tt.expectedErr(t, err)
diff --git a/tool/tctl/common/token_command.go b/tool/tctl/common/token_command.go
index c08ee1c122602..8dbb6973bfaff 100644
--- a/tool/tctl/common/token_command.go
+++ b/tool/tctl/common/token_command.go
@@ -19,12 +19,14 @@
 package common
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"os"
+	"os/exec"
 	"slices"
 	"sort"
 	"strings"
@@ -32,18 +34,29 @@ import (
 	"time"
 
 	"github.com/alecthomas/kingpin/v2"
-	"github.com/ghodss/yaml"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/gravitational/trace"
+	oidcclient "github.com/zitadel/oidc/v3/pkg/client"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/client/webclient"
+	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/teleportassets"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 )
@@ -91,6 +104,26 @@ type TokensCommand struct {
 	// dbURI is the address the database is reachable at.
 	dbURI string
 
+	// serviceAccountName is the Kubernetes Service Account the token should allow joining with.
+	serviceAccountName string
+	// namespace is the Kubernetes namespace the token should allow joining from
+	namespace string
+	// kubeContext is the kubectl context used to discover the Kubernetes cluster.
+	kubeContext string
+
+	kubeName string
+
+	tokenName string
+	// botName is the name of the bot the token allow joining as.
+	botName string
+	// outputPath is the path of the output file containing the Helm values
+	outputPath string
+	// updateGroup is the name of the update group for version detection and the generated values.yaml
+	updateGroup string
+	// kubeJoinType is the kubernetes join method type. Can be 'oidc' or 'static_jwks'.
+	kubeJoinType string
+	force        bool
+
 	// ttl is how long the token will live for.
 	ttl time.Duration
 
@@ -106,8 +139,13 @@ type TokensCommand struct {
 	// tokenList is used to view all tokens that Teleport knows about.
 	tokenList *kingpin.CmdClause
 
-	// stdout allows to switch the standard output source. Used in tests.
-	stdout io.Writer
+	// tokenKubeOIDC is used to discover the OIDC provider of a Kube cluster and create the corresponding join token.
+	tokenKubeOIDC *kingpin.CmdClause
+
+	// Stdout allows to switch the standard output source. Used in tests.
+	Stdout io.Writer
+	// BinKubectl is the path to the kubectl binary. Used in tests.
+	BinKubectl string
 }
 
 // Initialize allows TokenCommand to plug itself into the CLI parser
@@ -144,8 +182,22 @@ func (c *TokensCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCL
 	c.tokenList.Flag("with-secrets", "Do not redact join tokens").BoolVar(&c.withSecrets)
 	c.tokenList.Flag("labels", labelHelp).StringVar(&c.labels)
 
-	if c.stdout == nil {
-		c.stdout = os.Stdout
+	// "tctl tokens configure-kube-oidc ..."
+	c.tokenKubeOIDC = tokens.Command("configure-kube", "Creates a token allowing workload from the Kubernetes cluster to join the Teleport cluster.")
+	c.tokenKubeOIDC.Flag("join-with", "Kubernetes joining type, possible values are 'oidc', 'jwks', and 'auto'. See https://goteleport.com/docs/reference/join-methods/#kubernetes-kubernetes for more details.").Short('j').Default("auto").StringVar(&c.kubeJoinType)
+	c.tokenKubeOIDC.Flag("out", "Path of the output file.").Short('o').Default("./values.yaml").StringVar(&c.outputPath)
+	c.tokenKubeOIDC.Flag("context", "Kubernetes context to use. When not set, defaults to the active context.").StringVar(&c.kubeContext)
+	c.tokenKubeOIDC.Flag("cluster-name", "Name of the Kubernetes cluster. When not set, defaults to the context name.").StringVar(&c.kubeName)
+	c.tokenKubeOIDC.Flag("token-name", "Optional name of the created join token. When not set, default to '<CLUSTER_NAME>(-<BOT_NAME>)'").StringVar(&c.tokenName)
+	c.tokenKubeOIDC.Flag("bot", "Name of the the bot that this token will grant access to. When set, creates a bot token. Overrides --type").StringVar(&c.botName)
+	c.tokenKubeOIDC.Flag("type", "Type(s) of token to add, e.g. --type=kube,app,db,discovery,proxy,etc").Default("kube,app,discovery").StringVar(&c.tokenType)
+	c.tokenKubeOIDC.Flag("service-account", "Name of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is the release name.").Short('s').Required().StringVar(&c.serviceAccountName)
+	c.tokenKubeOIDC.Flag("namespace", "Namespace of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is release namespace.").Short('n').Default("teleport").StringVar(&c.namespace)
+	c.tokenKubeOIDC.Flag("update-group", "Optional update group used for version detection and agent updater configuration").StringVar(&c.updateGroup)
+	c.tokenKubeOIDC.Flag("force", "Force the token creation, even if the token already exists").Default("false").Short('f').BoolVar(&c.force)
+
+	if c.Stdout == nil {
+		c.Stdout = os.Stdout
 	}
 }
 
@@ -159,6 +211,8 @@ func (c *TokensCommand) TryRun(ctx context.Context, cmd string, clientFunc commo
 		commandFunc = c.Del
 	case c.tokenList.FullCommand():
 		commandFunc = c.List
+	case c.tokenKubeOIDC.FullCommand():
+		commandFunc = c.ConfigureKube
 	default:
 		return false, nil
 	}
@@ -220,6 +274,17 @@ func (c *TokensCommand) Add(ctx context.Context, client *authclient.Client) erro
 		return trace.Wrap(err, "creating token")
 	}
 
+	// Calculate the CA pins for this cluster. The CA pins are used by the
+	// client to verify the identity of the Auth Server.
+	localCAResponse, err := client.GetClusterCACert(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	caPins, err := tlsca.CalculatePins(localCAResponse.TLSCA)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	// Print token information formatted with JSON, YAML, or just print the raw token.
 	switch c.format {
 	case teleport.JSON, teleport.YAML:
@@ -228,6 +293,7 @@ func (c *TokensCommand) Add(ctx context.Context, client *authclient.Client) erro
 			"token":   token,
 			"roles":   roles,
 			"expires": expires,
+			"ca_pins": caPins,
 		}
 
 		var (
@@ -242,148 +308,104 @@ func (c *TokensCommand) Add(ctx context.Context, client *authclient.Client) erro
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		fmt.Fprint(c.stdout, string(data))
+		fmt.Fprint(c.Stdout, string(data))
 
 		return nil
 	case teleport.Text:
-		fmt.Fprintln(c.stdout, token)
+		fmt.Fprintln(c.Stdout, token)
 		return nil
 	}
 
-	// Calculate the CA pins for this cluster. The CA pins are used by the
-	// client to verify the identity of the Auth Server.
-	localCAResponse, err := client.GetClusterCACert(ctx)
-	if err != nil {
-		return trace.Wrap(err)
+	return trace.Wrap(showJoinInstructions(ctx, joinInstructionsInput{
+		out:        c.Stdout,
+		client:     client,
+		roles:      roles,
+		tokenName:  token,
+		ttl:        c.ttl,
+		appName:    c.appName,
+		appURI:     c.appURI,
+		dbName:     c.dbName,
+		dbURI:      c.dbURI,
+		dbProtocol: c.dbProtocol,
+		caPins:     caPins,
+	}))
+}
+
+// Del is called to execute "tokens del ..." command.
+func (c *TokensCommand) Del(ctx context.Context, client *authclient.Client) error {
+	if c.value == "" {
+		return trace.Errorf("Need an argument: token")
 	}
-	caPins, err := tlsca.CalculatePins(localCAResponse.TLSCA)
-	if err != nil {
+	if err := client.DeleteToken(ctx, c.value); err != nil {
 		return trace.Wrap(err)
 	}
+	fmt.Fprintf(c.Stdout, "Token %s has been deleted\n", c.value)
+	return nil
+}
 
-	// Get list of auth servers. Used to print friendly signup message.
-	authServers, err := client.GetAuthServers()
-	if err != nil {
-		return trace.Wrap(err)
+// The caller MUST make sure the MFA ceremony has been performed and is stored in the context
+// Else this function will cause several MFA prompts.
+// The MFa ceremony cannot be done in this function because we don't know if
+// the caller already attempted one (e.g. tctl get all)
+func getAllTokens(ctx context.Context, clt *authclient.Client) ([]types.ProvisionToken, error) {
+	// There are 3 tokens types:
+	// - provision tokens
+	// - static tokens
+	// - user tokens
+	// This endpoint returns all 3 for compatibility reasons.
+	// Before, all 3 tokens were returned by the same "GetTokens" RPC, now we are using
+	// separate RPCs, with pagination. However, we don't know if the auth we are talking
+	// to supports the new RPCs. As the static token one got introduced last, we
+	// try to use it.If it works, we consume the two other RPCs. If it doesn't,
+	// we fallback to the legacy all-in-one RPC.
+	var tokens []types.ProvisionToken
+
+	// Trying to get static tokens
+	staticTokens, err := clt.GetStaticTokens(ctx)
+	if err != nil && !trace.IsNotImplemented(err) {
+		return nil, trace.Wrap(err, "getting static tokens")
 	}
-	if len(authServers) == 0 {
-		return trace.BadParameter("this cluster has no auth servers")
+
+	// TODO(hugoShaka): DELETE IN 19.0.0
+	if trace.IsNotImplemented(err) {
+		// We are connected to an old auth, that doesn't support the per-token type RPCs
+		// so we fallback to the legacy all-in-one RPC.
+		tokens, err := clt.GetTokens(ctx)
+		return tokens, trace.Wrap(err, "getting all tokens through the legacy RPC")
 	}
 
-	// Print signup message.
-	switch {
-	case roles.Include(types.RoleKube):
-		proxies, err := client.GetProxies()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if len(proxies) == 0 {
-			return trace.NotFound("cluster has no proxies")
-		}
-		setRoles := strings.ToLower(strings.Join(roles.StringSlice(), "\\,"))
-		return kubeMessageTemplate.Execute(c.stdout,
-			map[string]interface{}{
-				"auth_server": proxies[0].GetPublicAddr(),
-				"token":       token,
-				"minutes":     c.ttl.Minutes(),
-				"set_roles":   setRoles,
-				"version":     proxies[0].GetTeleportVersion(),
-			})
-	case roles.Include(types.RoleApp):
-		proxies, err := client.GetProxies()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if len(proxies) == 0 {
-			return trace.BadParameter("cluster has no proxies")
-		}
-		appPublicAddr := fmt.Sprintf("%v.%v", c.appName, proxies[0].GetPublicAddr())
-
-		return appMessageTemplate.Execute(c.stdout,
-			map[string]interface{}{
-				"token":           token,
-				"minutes":         c.ttl.Minutes(),
-				"ca_pins":         caPins,
-				"auth_server":     proxies[0].GetPublicAddr(),
-				"app_name":        c.appName,
-				"app_uri":         c.appURI,
-				"app_public_addr": appPublicAddr,
-			})
-	case roles.Include(types.RoleDatabase):
-		proxies, err := client.GetProxies()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if len(proxies) == 0 {
-			return trace.NotFound("cluster has no proxies")
-		}
-		return dbMessageTemplate.Execute(c.stdout,
-			map[string]interface{}{
-				"token":       token,
-				"minutes":     c.ttl.Minutes(),
-				"ca_pins":     caPins,
-				"auth_server": proxies[0].GetPublicAddr(),
-				"db_name":     c.dbName,
-				"db_protocol": c.dbProtocol,
-				"db_uri":      c.dbURI,
-			})
-	case roles.Include(types.RoleTrustedCluster):
-		fmt.Fprintf(c.stdout, trustedClusterMessage,
-			token,
-			int(c.ttl.Minutes()))
-	case roles.Include(types.RoleWindowsDesktop):
-		return desktopMessageTemplate.Execute(c.stdout,
-			map[string]interface{}{
-				"token":   token,
-				"minutes": c.ttl.Minutes(),
-			})
-	case roles.Include(types.RoleMDM):
-		return mdmTokenAddTemplate.Execute(c.stdout, map[string]interface{}{
-			"token":   token,
-			"minutes": c.ttl.Minutes(),
-			"ca_pins": caPins,
-		})
-	default:
-		authServer := authServers[0].GetAddr()
+	// We are connected to a modern auth, we must collect all 3 tokens types.
+	// Getting the provision tokens.
+	provisionTokens, err := stream.Collect(clientutils.Resources(ctx,
+		func(ctx context.Context, pageSize int, pageKey string) ([]types.ProvisionToken, string, error) {
+			return clt.ListProvisionTokens(ctx, pageSize, pageKey, nil, "")
+		},
+	))
+	if err != nil {
+		return nil, trace.Wrap(err, "getting provision tokens")
+	}
+	tokens = append(staticTokens.GetStaticTokens(), provisionTokens...)
 
-		pingResponse, err := client.Ping(ctx)
+	// Getting the user tokens.
+	userTokens, err := stream.Collect(clientutils.Resources(ctx, clt.ListResetPasswordTokens))
+	if err != nil && !trace.IsNotImplemented(err) {
+		return nil, trace.Wrap(err)
+	}
+	if err != nil {
+		return nil, trace.Wrap(err, "getting user tokens")
+	}
+	// Converting the user tokens as provision tokens for presentation and
+	// backward compatibility.
+	for _, t := range userTokens {
+		roles := types.SystemRoles{types.RoleSignup}
+		tok, err := types.NewProvisionToken(t.GetName(), roles, t.Expiry())
 		if err != nil {
-			slog.DebugContext(ctx, "unable to ping auth client", "error", err)
+			return nil, trace.Wrap(err, "converting user token as a provision token")
 		}
-
-		if err == nil && pingResponse.GetServerFeatures().Cloud {
-			proxies, err := client.GetProxies()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			if len(proxies) != 0 {
-				authServer = proxies[0].GetPublicAddr()
-			}
-		}
-
-		return nodeMessageTemplate.Execute(c.stdout, map[string]interface{}{
-			"token":       token,
-			"roles":       strings.ToLower(roles.String()),
-			"minutes":     int(c.ttl.Minutes()),
-			"ca_pins":     caPins,
-			"auth_server": authServer,
-		})
+		tokens = append(tokens, tok)
 	}
 
-	return nil
-}
-
-// Del is called to execute "tokens del ..." command.
-func (c *TokensCommand) Del(ctx context.Context, client *authclient.Client) error {
-	if c.value == "" {
-		return trace.Errorf("Need an argument: token")
-	}
-	if err := client.DeleteToken(ctx, c.value); err != nil {
-		return trace.Wrap(err)
-	}
-	fmt.Fprintf(c.stdout, "Token %s has been deleted\n", c.value)
-	return nil
+	return tokens, nil
 }
 
 // List is called to execute "tokens ls" command.
@@ -393,7 +415,15 @@ func (c *TokensCommand) List(ctx context.Context, client *authclient.Client) err
 		return trace.Wrap(err)
 	}
 
-	tokens, err := client.GetTokens(ctx)
+	// Because getAllTokens do up to 3 calls, we want to perform the MFA ceremony
+	// once and put it in the context. Else the users will get 3 MFA prompts.
+	if mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, client.PerformMFACeremony, true /*allowReuse*/); err == nil {
+		ctx = mfa.ContextWithMFAResponse(ctx, mfaResponse)
+	} else if !errors.Is(err, &mfa.ErrMFANotRequired) && !errors.Is(err, &mfa.ErrMFANotSupported) {
+		return trace.Wrap(err)
+	}
+
+	tokens, err := getAllTokens(ctx, client)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -409,7 +439,7 @@ func (c *TokensCommand) List(ctx context.Context, client *authclient.Client) err
 	})
 
 	if len(tokens) == 0 && c.format == teleport.Text {
-		fmt.Fprintln(c.stdout, "No active tokens found.")
+		fmt.Fprintln(c.Stdout, "No active tokens found.")
 		return nil
 	}
 
@@ -423,18 +453,18 @@ func (c *TokensCommand) List(ctx context.Context, client *authclient.Client) err
 
 	switch c.format {
 	case teleport.JSON:
-		err := utils.WriteJSONArray(c.stdout, tokens)
+		err := utils.WriteJSONArray(c.Stdout, tokens)
 		if err != nil {
 			return trace.Wrap(err, "failed to marshal tokens")
 		}
 	case teleport.YAML:
-		err := utils.WriteYAML(c.stdout, tokens)
+		err := utils.WriteYAML(c.Stdout, tokens)
 		if err != nil {
 			return trace.Wrap(err, "failed to marshal tokens")
 		}
 	case teleport.Text:
 		for _, token := range tokens {
-			fmt.Fprintln(c.stdout, nameFunc(token))
+			fmt.Fprintln(c.Stdout, nameFunc(token))
 		}
 	default:
 		tokensView := func() string {
@@ -451,7 +481,626 @@ func (c *TokensCommand) List(ctx context.Context, client *authclient.Client) err
 			}
 			return table.AsBuffer().String()
 		}
-		fmt.Fprint(c.stdout, tokensView())
+		fmt.Fprint(c.Stdout, tokensView())
 	}
 	return nil
 }
+
+func pingAuthAndProxy(ctx context.Context, client *authclient.Client, updateGroup string, insecure bool) (*proto.PingResponse, *webclient.PingResponse, error) {
+	// detect proxy address
+	authPong, err := client.Ping(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "failed to ping Teleport Auth")
+	}
+
+	proxyAddr := authPong.GetProxyPublicAddr()
+	if proxyAddr == "" {
+		return &authPong, nil, trace.BadParameter("failed to discover Teleport proxy address, make sure the Teleport Proxy service is running with `public_addr` set")
+	}
+	// detect autoupdate version
+	proxyPong, err := webclient.Ping(&webclient.Config{
+		Context:     ctx,
+		ProxyAddr:   proxyAddr,
+		Insecure:    insecure,
+		UpdateGroup: updateGroup,
+	})
+	if err != nil {
+		return &authPong, nil, trace.Wrap(err, "failed to ping Teleport Proxy")
+	}
+	return &authPong, proxyPong, nil
+}
+
+func lookupKubeActiveContext(path string) (string, error) {
+	stdout, stderr, err := runKubectlCommand(path, []string{"config", "current-context"})
+	if err != nil {
+		return "", trace.Wrap(err, "calling kubectl: %s", stderr.String())
+	}
+	kubeContext := strings.TrimSpace(stdout.String())
+	if kubeContext == "" {
+		return "", trace.BadParameter("context not set, and no active kubectl context found")
+	}
+	return kubeContext, nil
+}
+
+func runKubectlCommand(kubectlPath string, args []string) (stdout, stderr bytes.Buffer, err error) {
+	cmd := exec.Cmd{
+		Path:      kubectlPath,
+		Args:      append([]string{kubectlPath}, args...),
+		Env:       os.Environ(),
+		Stdout:    &stdout,
+		Stderr:    &stderr,
+		WaitDelay: 10 * time.Second,
+	}
+	if err := cmd.Run(); err != nil {
+		return stdout, stderr, trace.Wrap(err, "running `%s %s`", kubectlPath, args)
+	}
+
+	return stdout, stderr, nil
+}
+
+func detectOIDC(ctx context.Context, kubectlPath, kubeContext string) (*oidc.DiscoveryConfiguration, error) {
+	kubectlArgs := []string{"--context", kubeContext, "get", "--raw=/.well-known/openid-configuration"}
+	stdout, stderr, err := runKubectlCommand(kubectlPath, kubectlArgs)
+	if err != nil {
+		return nil, trace.Wrap(err, "running kubectl: %s", stderr.String())
+	}
+	var oidcResponse oidc.DiscoveryConfiguration
+
+	err = json.Unmarshal(stdout.Bytes(), &oidcResponse)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to parse oidc response: %s", stdout.String())
+	}
+
+	if oidcResponse.Issuer == "" {
+		return nil, trace.BadParameter("failed to discover OIDC issuer, empty Issuer field")
+	}
+
+	oidcDiscoverCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	// hit OIDC provider
+	dc, err := oidcclient.Discover(oidcDiscoverCtx, oidcResponse.Issuer, otelhttp.DefaultClient)
+	if err != nil {
+		// TODO: explain that the cluster might ot have OIDC enabled
+		return nil, trace.Wrap(err, "failed to discover OIDC issuer, make sure the cluster has OIDC enabled")
+	}
+
+	return dc, nil
+}
+
+func detectJWKS(kubectlPath, kubeContext string) (*jose.JSONWebKeySet, error) {
+	kubectlArgs := []string{"--context", kubeContext, "get", "--raw=/openid/v1/jwks"}
+	stdout, stderr, err := runKubectlCommand(kubectlPath, kubectlArgs)
+	if err != nil {
+		return nil, trace.Wrap(err, "running kubectl: %s", stderr.String())
+	}
+
+	var jwks jose.JSONWebKeySet
+	err = json.Unmarshal(stdout.Bytes(), &jwks)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to parse JWKS: %s", stdout.String())
+	}
+
+	if len(jwks.Keys) == 0 {
+		return nil, trace.BadParameter("failed to discover JWKS, no keys found")
+	}
+
+	return &jwks, nil
+}
+
+// ConfigureKube is called to execute "tctl tokens configure-kube ..." command
+// This function is covered by an integration test in `integration/tctl_token_kube_test.go`.
+func (c *TokensCommand) ConfigureKube(ctx context.Context, client *authclient.Client) error {
+	// preflight checks
+	var roles types.SystemRoles
+	var err error
+	if c.botName != "" {
+		roles = types.SystemRoles{types.RoleBot}
+	} else {
+		// Parse string to see if it's a type of role that Teleport supports.
+		roles, err = types.ParseTeleportRoles(c.tokenType)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	var kubeJoinType types.KubernetesJoinType
+	switch c.kubeJoinType {
+	case "oidc":
+		kubeJoinType = types.KubernetesJoinTypeOIDC
+	case "jwks", "static_jwks", "static-jwks":
+		kubeJoinType = types.KubernetesJoinTypeStaticJWKS
+	case "auto":
+		kubeJoinType = types.KubernetesJoinTypeUnspecified
+	default:
+		return trace.BadParameter("unknown --join-with value %q, supported values are 'oidc', 'jwks', and 'auto'.", c.kubeJoinType)
+	}
+
+	kubectlPath := c.BinKubectl
+	if kubectlPath == "" {
+		kubectlPath, err = exec.LookPath("kubectl")
+		if err != nil {
+			return trace.Wrap(err, "looking up kubectl binary")
+		}
+	}
+
+	fmt.Fprintln(os.Stderr, "📡 Looking up Teleport cluster settings")
+
+	authPong, proxyPong, err := pingAuthAndProxy(ctx, client, c.updateGroup, client.Config().InsecureSkipVerify)
+	if err != nil {
+		return trace.Wrap(err, "looking up Teleport cluster settings")
+	}
+
+	proxyAddr := authPong.GetProxyPublicAddr()
+	if proxyAddr == "" {
+		return trace.BadParameter("failed to discover Teleport proxy address, make sure the Teleport Proxy service is running with `public_addr` set")
+	}
+	agentVersion := proxyPong.AutoUpdate.AgentVersion
+	if agentVersion == "" {
+		return trace.NotFound("failed to discover Teleport Agent version")
+	}
+
+	fmt.Fprintln(os.Stderr, "📁 Finding local kubectl context")
+	kubeContext := c.kubeContext
+
+	// If kube context not set, we look it up
+	if kubeContext == "" {
+		kubeContext, err = lookupKubeActiveContext(kubectlPath)
+		if err != nil {
+			return trace.Wrap(err, "looking up active kubectl context")
+		}
+	}
+
+	// If the kube name is not specified, we use the context name
+	kubeName := c.kubeName
+	if kubeName == "" {
+		kubeName = kubeContext
+	}
+
+	// If the token name is not specified, we use the kube name suffixed by the bot name.
+	tokenName := c.tokenName
+	if tokenName == "" {
+		tokenName = kubeName
+		if c.botName != "" {
+			tokenName = tokenName + "-" + c.botName
+		}
+	}
+
+	tokenParams := createKubeTokenParams{
+		kubeContext:  kubeContext,
+		kubeName:     kubeName,
+		kubeJoinType: kubeJoinType,
+		kubectlPath:  kubectlPath,
+
+		roles:          roles,
+		botName:        c.botName,
+		namespace:      c.namespace,
+		serviceAccount: c.serviceAccountName,
+		tokenName:      tokenName,
+		insecure:       client.Config().InsecureSkipVerify,
+		force:          c.force,
+	}
+
+	token, err := createKubeToken(ctx, client, tokenParams)
+	if err != nil {
+		return trace.Wrap(err, "creating token")
+	}
+
+	chartName := "teleport/teleport-kube-agent"
+	if c.botName != "" {
+		chartName = "teleport/tbot"
+	}
+
+	fmt.Fprintf(os.Stderr, "📝 Writing %s Helm values to: %q\n", chartName, c.outputPath)
+
+	var valueGenerator valueGeneratorFunc
+	if c.botName != "" {
+		valueGenerator = generateTbotValues
+	} else {
+		valueGenerator = generateAgentValues
+	}
+
+	values, err := valueGenerator(valueGeneratorParams{
+		botName:             c.botName,
+		roles:               roles,
+		proxyAddr:           proxyAddr,
+		enterprise:          proxyPong.Edition == modules.BuildEnterprise,
+		updateGroup:         c.updateGroup,
+		tokenName:           token.GetName(),
+		teleportClusterName: authPong.GetClusterName(),
+		kubeClusterName:     kubeName,
+	})
+	if err != nil {
+		return trace.Wrap(err, "error generating chart values")
+	}
+
+	if err := os.WriteFile(c.outputPath, values, 0644); err != nil {
+		return trace.Wrap(err, "error writing chart values to file %s", c.outputPath)
+	}
+
+	fmt.Fprintln(os.Stderr, "🚀 You can now deploy the Helm chart:")
+	os.Stderr.Write([]byte("\n"))
+
+	fmt.Println(craftHelmCommand(craftHelmCommandParams{
+		releaseName: c.serviceAccountName,
+		chartName:   chartName,
+		namespace:   c.namespace,
+		version:     proxyPong.AutoUpdate.AgentVersion,
+		valuesPath:  c.outputPath,
+		kubeContext: kubeContext,
+	}))
+	return nil
+}
+
+type createKubeTokenParams struct {
+	// kubernetes detection settings
+	kubeJoinType types.KubernetesJoinType
+	kubeContext  string
+	kubeName     string
+	kubectlPath  string
+
+	// token settings
+	roles          types.SystemRoles
+	botName        string
+	namespace      string
+	serviceAccount string
+	tokenName      string
+	insecure       bool
+	force          bool
+}
+
+func craftKubeOIDCToken(params createKubeTokenParams, dc *oidc.DiscoveryConfiguration) (types.ProvisionToken, error) {
+	if dc == nil {
+		return nil, trace.BadParameter("cannot create token for a nil discovery configuration")
+	}
+	// craft token for cluster
+	tokenSpec := types.ProvisionTokenSpecV2{
+		Roles:      params.roles,
+		JoinMethod: types.JoinMethodKubernetes,
+		BotName:    params.botName,
+		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+				{ServiceAccount: fmt.Sprintf("%s:%s", params.namespace, params.serviceAccount)},
+			},
+			Type: types.KubernetesJoinTypeOIDC,
+			OIDC: &types.ProvisionTokenSpecV2Kubernetes_OIDCConfig{
+				Issuer:                  dc.Issuer,
+				InsecureAllowHTTPIssuer: params.insecure,
+			},
+		},
+	}
+	token, err := types.NewProvisionTokenFromSpec(params.tokenName, time.Time{}, tokenSpec)
+	if err != nil {
+		return nil, trace.Wrap(err, "error crafting provision token for the Kube cluster")
+	}
+	return token, nil
+}
+
+func craftKubeJWKSToken(params createKubeTokenParams, jwks *jose.JSONWebKeySet) (types.ProvisionToken, error) {
+	if jwks == nil {
+		return nil, trace.BadParameter("cannot create token for a nil JWKS")
+	}
+	jwksBytes, err := json.Marshal(jwks)
+	if err != nil {
+		return nil, trace.Wrap(err, "error marshaling JWKS")
+	}
+
+	// craft token for cluster
+	tokenSpec := types.ProvisionTokenSpecV2{
+		Roles:      params.roles,
+		JoinMethod: types.JoinMethodKubernetes,
+		BotName:    params.botName,
+		Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
+			Allow: []*types.ProvisionTokenSpecV2Kubernetes_Rule{
+				{ServiceAccount: fmt.Sprintf("%s:%s", params.namespace, params.serviceAccount)},
+			},
+			Type: types.KubernetesJoinTypeStaticJWKS,
+			StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
+				JWKS: string(jwksBytes),
+			},
+		},
+	}
+	token, err := types.NewProvisionTokenFromSpec(params.tokenName, time.Time{}, tokenSpec)
+	if err != nil {
+		return nil, trace.Wrap(err, "error crafting provision token for the Kube cluster")
+	}
+	return token, nil
+}
+
+func craftKubeToken(ctx context.Context, params createKubeTokenParams) (types.ProvisionToken, error) {
+	switch params.kubeJoinType {
+	case types.KubernetesJoinTypeUnspecified, types.KubernetesJoinTypeOIDC:
+		// We don't know if we should use OIDC or static JWKS so we try one, and fallback if it doesn't work.
+		fmt.Fprintf(os.Stderr, "🔎 Detecting OIDC provider for Kubernetes cluster %q\n", params.kubeName)
+		dc, err := detectOIDC(ctx, params.kubectlPath, params.kubeContext)
+		if err == nil {
+			token, err := craftKubeOIDCToken(params, dc)
+			return token, trace.Wrap(err, "creating OIDC provision token for cluster %q", params.kubeName)
+		}
+
+		// If the user explicitly asked for OIDC joining, we do a hard failure.
+		// Else we try JWKS.
+		if params.kubeJoinType == types.KubernetesJoinTypeOIDC {
+			return nil, trace.Wrap(err, "discovering OIDC provider for cluster %q", params.kubeName)
+		}
+
+		fmt.Fprintln(os.Stderr, "❌ Failed to detect OIDC provider, the cluster may not have a public OIDC provider. Falling back to static JWKS.")
+		fallthrough
+	case types.KubernetesJoinTypeStaticJWKS:
+		fmt.Fprintf(os.Stderr, "🔎 Detecting JWKS for Kubernetes cluster %q\n", params.kubeName)
+		jwks, err := detectJWKS(params.kubectlPath, params.kubeContext)
+		if err != nil {
+			return nil, trace.Wrap(err, "retrieving the JWKS for cluster %q", params.kubeName)
+		}
+		token, err := craftKubeJWKSToken(params, jwks)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating OIDC provision token for cluster %q", params.kubeName)
+		}
+		return token, nil
+	default:
+		return nil, trace.BadParameter("unknown join type: %v", params.kubeJoinType)
+	}
+}
+
+func createKubeToken(ctx context.Context, client *authclient.Client, params createKubeTokenParams) (types.ProvisionToken, error) {
+	token, err := craftKubeToken(ctx, params)
+	if err != nil {
+		return nil, trace.Wrap(err, "crafting token")
+	}
+	fmt.Fprintf(os.Stderr, "⚙️ Configuring trust by creating token %q\n", token.GetName())
+
+	if params.force {
+		err := client.UpsertToken(ctx, token)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed to upsert provision token %q", token.GetName())
+		}
+	} else {
+		err := client.CreateToken(ctx, token)
+		if err != nil {
+			if trace.IsAlreadyExists(err) {
+				return nil, trace.AlreadyExists(
+					"token %q already exists, you can pick a different token name with --token-name, or overwrite the existing token with --force",
+					token.GetName(),
+				)
+			}
+			return nil, trace.Wrap(err, "failed to create provision token %q", token.GetName())
+		}
+	}
+	return token, nil
+}
+
+type craftHelmCommandParams struct {
+	releaseName string
+	chartName   string
+	namespace   string
+	version     string
+	valuesPath  string
+	kubeContext string
+}
+
+func craftHelmCommand(params craftHelmCommandParams) string {
+	sb := &strings.Builder{}
+	fmt.Fprintf(sb, "helm repo add teleport %q; \n", teleportassets.HelmRepoURL().String())
+	sb.WriteString("helm repo update; \n")
+	fmt.Fprintf(sb, "helm upgrade --install %q %q", params.releaseName, params.chartName)
+	fmt.Fprintf(sb, "\\\n  --namespace %s --create-namespace ", params.namespace)
+	fmt.Fprintf(sb, "\\\n  --version %s ", params.version)
+	fmt.Fprintf(sb, "\\\n  --values %s ", params.valuesPath)
+	fmt.Fprintf(sb, "\\\n  --kube-context %s\n", params.kubeContext)
+	return sb.String()
+}
+
+type valueGeneratorParams struct {
+	botName             string
+	roles               types.SystemRoles
+	proxyAddr           string
+	enterprise          bool
+	updateGroup         string
+	tokenName           string
+	teleportClusterName string
+	kubeClusterName     string
+}
+type valueGeneratorFunc func(valueGeneratorParams) ([]byte, error)
+
+type TbotChartValues struct {
+	ClusterName          string `yaml:"clusterName"`
+	TeleportProxyAddress string `yaml:"teleportProxyAddress"`
+	DefaultOutput        struct {
+		SecretName string `yaml:"secretName"`
+	} `yaml:"defaultOutput"`
+	Token string `yaml:"token"`
+}
+
+func generateTbotValues(params valueGeneratorParams) ([]byte, error) {
+	tbotValues := TbotChartValues{
+		ClusterName:          params.teleportClusterName,
+		TeleportProxyAddress: params.proxyAddr,
+		DefaultOutput: struct {
+			SecretName string `yaml:"secretName"`
+		}{
+			SecretName: fmt.Sprintf("%s-output", params.botName),
+		},
+		Token: params.tokenName,
+	}
+	return yaml.Marshal(tbotValues)
+}
+
+type AgentChartValues struct {
+	Roles      string `yaml:"roles"`
+	ProxyAddr  string `yaml:"proxyAddr"`
+	Enterprise bool   `yaml:"enterprise"`
+	Updater    struct {
+		Enabled bool   `yaml:"enabled"`
+		Group   string `yaml:"group,omitempty"`
+	} `yaml:"updater,omitempty"`
+	JoinParams struct {
+		Method    string `yaml:"method"`
+		TokenName string `yaml:"tokenName"`
+	} `yaml:"joinParams"`
+	KubeClusterName     string `yaml:"kubeClusterName"`
+	TeleportClusterName string `yaml:"teleportClusterName"`
+}
+
+func generateAgentValues(params valueGeneratorParams) ([]byte, error) {
+	agentValues := AgentChartValues{
+		Roles:      strings.ToLower(params.roles.String()),
+		ProxyAddr:  params.proxyAddr,
+		Enterprise: params.enterprise,
+		Updater: struct {
+			Enabled bool   `yaml:"enabled"`
+			Group   string `yaml:"group,omitempty"`
+		}{
+			Enabled: true,
+			Group:   params.updateGroup,
+		},
+		JoinParams: struct {
+			Method    string `yaml:"method"`
+			TokenName string `yaml:"tokenName"`
+		}{
+			Method:    string(types.JoinMethodKubernetes),
+			TokenName: params.tokenName,
+		},
+		TeleportClusterName: params.teleportClusterName,
+		KubeClusterName:     params.kubeClusterName,
+	}
+
+	return yaml.Marshal(agentValues)
+}
+
+type joinInstructionsInput struct {
+	client     *authclient.Client
+	roles      types.SystemRoles
+	out        io.Writer
+	tokenName  string
+	ttl        time.Duration
+	appName    string
+	appURI     string
+	dbName     string
+	dbURI      string
+	dbProtocol string
+	caPins     []string
+}
+
+func showJoinInstructions(ctx context.Context, in joinInstructionsInput) error {
+	// Get list of auth servers. Used to print friendly signup message.
+	authServers, err := clientutils.CollectWithFallback(
+		ctx,
+		in.client.ListAuthServers,
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		func(context.Context) ([]types.Server, error) { return in.client.GetAuthServers() },
+	)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if len(authServers) == 0 {
+		return trace.BadParameter("this cluster has no auth servers")
+	}
+
+	// Print signup message.
+	switch {
+	case in.roles.Include(types.RoleKube):
+		proxies, err := clientutils.CollectWithFallback(ctx, in.client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+			//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+			return in.client.GetProxies()
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if len(proxies) == 0 {
+			return trace.NotFound("cluster has no proxies")
+		}
+		setRoles := strings.ToLower(strings.Join(in.roles.StringSlice(), "\\,"))
+		return kubeMessageTemplate.Execute(in.out,
+			map[string]any{
+				"proxy_server": proxies[0].GetPublicAddr(),
+				"token":        in.tokenName,
+				"minutes":      in.ttl.Minutes(),
+				"set_roles":    setRoles,
+				"version":      proxies[0].GetTeleportVersion(),
+			})
+	case in.roles.Include(types.RoleApp):
+		proxies, err := clientutils.CollectWithFallback(ctx, in.client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+			//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+			return in.client.GetProxies()
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if len(proxies) == 0 {
+			return trace.BadParameter("cluster has no proxies")
+		}
+		appPublicAddr := fmt.Sprintf("%v.%v", in.appName, proxies[0].GetPublicAddr())
+
+		return appMessageTemplate.Execute(in.out,
+			map[string]any{
+				"token":           in.tokenName,
+				"minutes":         in.ttl.Minutes(),
+				"ca_pins":         in.caPins,
+				"proxy_server":    proxies[0].GetPublicAddr(),
+				"app_name":        in.appName,
+				"app_uri":         in.appURI,
+				"app_public_addr": appPublicAddr,
+			})
+	case in.roles.Include(types.RoleDatabase):
+		proxies, err := clientutils.CollectWithFallback(ctx, in.client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+			//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+			return in.client.GetProxies()
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if len(proxies) == 0 {
+			return trace.NotFound("cluster has no proxies")
+		}
+		return dbMessageTemplate.Execute(in.out,
+			map[string]any{
+				"token":        in.tokenName,
+				"minutes":      in.ttl.Minutes(),
+				"ca_pins":      in.caPins,
+				"proxy_server": proxies[0].GetPublicAddr(),
+				"db_name":      in.dbName,
+				"db_protocol":  in.dbProtocol,
+				"db_uri":       in.dbURI,
+			})
+	case in.roles.Include(types.RoleTrustedCluster):
+		fmt.Fprintf(in.out, trustedClusterMessage,
+			in.tokenName,
+			int(in.ttl.Minutes()))
+	case in.roles.Include(types.RoleWindowsDesktop):
+		return desktopMessageTemplate.Execute(in.out,
+			map[string]any{
+				"token":   in.tokenName,
+				"minutes": in.ttl.Minutes(),
+			})
+	case in.roles.Include(types.RoleMDM):
+		return mdmTokenAddTemplate.Execute(in.out, map[string]any{
+			"token":   in.tokenName,
+			"minutes": in.ttl.Minutes(),
+			"ca_pins": in.caPins,
+		})
+	default:
+		return nodeMessageTemplate.Execute(in.out, map[string]any{
+			"token":       in.tokenName,
+			"roles":       strings.ToLower(in.roles.String()),
+			"minutes":     int(in.ttl.Minutes()),
+			"ca_pins":     in.caPins,
+			"auth_server": controlPlaneAddr(ctx, in.client, authServers[0].GetAddr()),
+		})
+	}
+
+	return nil
+}
+
+// controlPlaneAddr gets the address of the cluster control plane for
+// agent joining, preferring the proxy public address.
+func controlPlaneAddr(ctx context.Context, client *authclient.Client, authAddr string) string {
+	proxies, err := clientutils.CollectWithFallback(ctx, client.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return client.GetProxies()
+	})
+	if err == nil && len(proxies) > 0 {
+		return proxies[0].GetPublicAddr()
+	}
+
+	return authAddr
+}
diff --git a/tool/tctl/common/token_command_test.go b/tool/tctl/common/token_command_test.go
index afc84f963d4a4..4fea8d84a807a 100644
--- a/tool/tctl/common/token_command_test.go
+++ b/tool/tctl/common/token_command_test.go
@@ -79,7 +79,9 @@ func TestTokens(t *testing.T) {
 	}
 
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
-	clt := testenv.MakeDefaultAuthClient(t, process)
+	clt, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = clt.Close() })
 
 	// Test all output formats of "tokens add".
 	buf, err := runTokensCommand(t, clt, []string{"add", "--type=node"})
diff --git a/tool/tctl/common/top/box.go b/tool/tctl/common/top/box.go
index c4a803fe3395b..1526d556e8085 100644
--- a/tool/tctl/common/top/box.go
+++ b/tool/tctl/common/top/box.go
@@ -32,6 +32,10 @@ import (
 // │            Hello   │
 // ╰────────────────────╯
 func boxedView(title string, content string, width int) string {
+	return boxedViewWithStyle(title, content, width, lipgloss.NewStyle().Faint(true))
+}
+
+func boxedViewWithStyle(title string, content string, width int, style lipgloss.Style) string {
 	rounderBorder := lipgloss.RoundedBorder()
 
 	const borderCorners = 2
@@ -55,11 +59,10 @@ func boxedView(title string, content string, width int) string {
 	rounderBorder.Top = ""
 	rounderBorder.TopRight = ""
 
-	contentStyle := lipgloss.NewStyle().
+	contentStyle := style.
 		BorderStyle(rounderBorder).
 		PaddingLeft(1).
 		PaddingRight(1).
-		Faint(true).
 		Width(width)
 
 	return renderedTitle + contentStyle.Render(content)
diff --git a/tool/tctl/common/top/client/diag/client.go b/tool/tctl/common/top/client/diag/client.go
new file mode 100644
index 0000000000000..feea1e50fffc4
--- /dev/null
+++ b/tool/tctl/common/top/client/diag/client.go
@@ -0,0 +1,102 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package diag
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/url"
+
+	"github.com/gravitational/trace"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/expfmt"
+
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+// Client is a wrapper around [*http.Client] that provides
+// helpers for fetching metrics from the diagnostic endpoint of Teleport.
+type Client struct {
+	endpoint string
+	clt      *http.Client
+}
+
+// parseAddress takes a string address and attempts to parse it into a valid URL.
+// The input can either be a valid string URL or a <host>:<port> pair.
+func parseAddress(addr string) (*url.URL, error) {
+	u, err := url.Parse(addr)
+
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		// Attempt to parse the input as a host:port tuple instead.
+		_, _, err = net.SplitHostPort(addr)
+		if err != nil {
+			return nil, trace.Errorf("address %s is neither a valid URL nor <host>:<port>", addr)
+		}
+
+		u = &url.URL{
+			Scheme: "http",
+			Host:   addr,
+		}
+	}
+
+	return u, nil
+}
+
+// NewClient creates a new Client for a given address.
+func NewClient(addr string) (*Client, error) {
+	clt, err := defaults.HTTPClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	u, err := parseAddress(addr)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if u.Scheme != "http" {
+		return nil, trace.Errorf("unsupported scheme: %s, please provide a http address", u.Scheme)
+	}
+
+	return &Client{
+		endpoint: u.JoinPath("metrics").String(),
+		clt:      clt,
+	}, nil
+}
+
+// GetMetrics returns prometheus metrics as a map keyed by metric name.
+func (c *Client) GetMetrics(ctx context.Context) (map[string]*dto.MetricFamily, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.endpoint, http.NoBody)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp, err := c.clt.Do(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+
+	var parser expfmt.TextParser
+	metrics, err := parser.TextToMetricFamilies(resp.Body)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return metrics, nil
+}
diff --git a/tool/tctl/common/top/client/diag/client_test.go b/tool/tctl/common/top/client/diag/client_test.go
new file mode 100644
index 0000000000000..047e53b1c9f2e
--- /dev/null
+++ b/tool/tctl/common/top/client/diag/client_test.go
@@ -0,0 +1,87 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package diag
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestClientAddressParsing(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		addr string
+		url  *url.URL
+	}{
+		{
+			addr: "http://127.0.0.1:3000",
+			url: &url.URL{
+				Scheme: "http",
+				Host:   "127.0.0.1:3000",
+			},
+		},
+		{
+			addr: "http://localhost:3000",
+			url: &url.URL{
+				Scheme: "http",
+				Host:   "localhost:3000",
+			},
+		},
+		{
+			addr: "localhost:3000",
+			url: &url.URL{
+				Scheme: "http",
+				Host:   "localhost:3000",
+			},
+		},
+		{
+			addr: "127.0.0.1:3000",
+			url: &url.URL{
+				Scheme: "http",
+				Host:   "127.0.0.1:3000",
+			},
+		},
+		{
+			addr: "badurl:300:9:1",
+		},
+		{
+			addr: "http//badurl",
+		},
+		{
+			addr: "/var/lib/file.sock",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.addr, func(t *testing.T) {
+			u, err := parseAddress(tc.addr)
+			if tc.url == nil {
+				require.Error(t, err)
+				require.Nil(t, u)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tc.url.Host, u.Host)
+				require.Equal(t, tc.url.Scheme, u.Scheme)
+			}
+		})
+	}
+}
diff --git a/tool/tctl/common/top/command.go b/tool/tctl/common/top/command.go
index b917ff5fb9fcb..593fe71db4b34 100644
--- a/tool/tctl/common/top/command.go
+++ b/tool/tctl/common/top/command.go
@@ -22,45 +22,130 @@ import (
 
 	"github.com/alecthomas/kingpin/v2"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
+	dto "github.com/prometheus/client_model/go"
 
+	"github.com/gravitational/teleport/lib/client/debug"
+	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
 	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
+	"github.com/gravitational/teleport/tool/tctl/common/top/client/diag"
 )
 
 // Command is a debug command that consumes the
 // Teleport /metrics endpoint and displays diagnostic
 // information an easy to consume way.
 type Command struct {
+	global        *tctlcfg.GlobalCLIFlags
 	config        *servicecfg.Config
 	top           *kingpin.CmdClause
 	diagURL       string
 	refreshPeriod time.Duration
 }
 
+const defaultDiagAddr = "http://127.0.0.1:3000"
+
 // Initialize sets up the "tctl top" command.
-func (c *Command) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
+func (c *Command) Initialize(app *kingpin.Application, global *tctlcfg.GlobalCLIFlags, config *servicecfg.Config) {
 	c.config = config
+	c.global = global
 	c.top = app.Command("top", "Report diagnostic information.")
-	c.top.Arg("diag-addr", "Diagnostic HTTP URL").Default("http://127.0.0.1:3000").StringVar(&c.diagURL)
+	c.top.Arg("diag-addr", "Diagnostic HTTP URL").StringVar(&c.diagURL)
 	c.top.Arg("refresh", "Refresh period").Default("5s").DurationVar(&c.refreshPeriod)
 }
 
+type MetricsClient interface {
+	GetMetrics(ctx context.Context) (map[string]*dto.MetricFamily, error)
+}
+
+func (c *Command) newMetricsClient(ctx context.Context) (string, MetricsClient, error) {
+	if c.diagURL != "" {
+		clt, err := diag.NewClient(c.diagURL)
+		return c.diagURL, clt, trace.Wrap(err)
+	}
+
+	// Try the local UNIX debug service client first.
+	debugClient := debug.NewClient(c.config.DataDir)
+	_, debugErr := debugClient.GetMetrics(ctx)
+	if debugErr == nil {
+		return debugClient.SocketPath(), debugClient, nil
+	}
+	debugErr = trace.Wrap(debugErr, "retrieving metrics from debug service")
+
+	// Try default diagnostic address
+	diagClient, defErr := diag.NewClient(defaultDiagAddr)
+	if defErr != nil {
+		return "", nil, trace.Wrap(
+			trace.NewAggregate(
+				trace.Wrap(defErr, "creating diagnostics client for default address %q", defaultDiagAddr),
+				debugErr),
+			"unable to connect to Teleport metrics server")
+	}
+
+	_, defErr = diagClient.GetMetrics(ctx)
+	if defErr == nil {
+		return defaultDiagAddr, diagClient, nil
+	}
+
+	return "", nil, trace.Wrap(
+		trace.NewAggregate(
+			trace.Wrap(defErr, "getting metrics from diagnostics client at default address %q", defaultDiagAddr),
+			debugErr,
+		),
+		"connecting to Teleport metrics server")
+}
+
+// initConfig populates the [*servicecfg.Config]
+//
+// This is required by `tctl top` as it does not make use of the [commonclient.InitFunc]
+// which lazy loads the configuration during client creation, meaning the required configuration
+// fields are not initilized as this command uses a standalone metrics client instead on a local connection.
+//
+// TODO(okraport): remove this workaround once the caller can safely parse the teleport config file without common client.
+func (c *Command) initConfig() error {
+	var fileConf *config.FileConfig
+	var err error
+	if c.global.ConfigFile != "" {
+		fileConf, err = config.ReadConfigFile(c.global.ConfigFile)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if c.global.ConfigString != "" {
+		fileConf, err = config.ReadFromString(c.global.ConfigString)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if fileConf != nil {
+		if err = config.ApplyFileConfig(fileConf, c.config); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
 // TryRun attempts to run subcommands.
 func (c *Command) TryRun(ctx context.Context, cmd string, _ commonclient.InitFunc) (match bool, err error) {
 	if cmd != c.top.FullCommand() {
 		return false, nil
 	}
 
-	diagClient, err := roundtrip.NewClient(c.diagURL, "")
+	if err := c.initConfig(); err != nil {
+		return true, trace.Wrap(err)
+	}
+
+	addr, metricsClient, err := c.newMetricsClient(ctx)
 	if err != nil {
 		return true, trace.Wrap(err)
 	}
 
 	p := tea.NewProgram(
-		newTopModel(c.refreshPeriod, diagClient),
+		newTopModel(c.refreshPeriod, metricsClient, addr),
 		tea.WithAltScreen(),
 		tea.WithContext(ctx),
 	)
diff --git a/tool/tctl/common/top/keys.go b/tool/tctl/common/top/keys.go
new file mode 100644
index 0000000000000..8c27571a7ca92
--- /dev/null
+++ b/tool/tctl/common/top/keys.go
@@ -0,0 +1,104 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package top
+
+import "github.com/charmbracelet/bubbles/key"
+
+type keyMap struct {
+	Quit key.Binding
+
+	// Movement
+	Right  key.Binding
+	Left   key.Binding
+	Up     key.Binding
+	Down   key.Binding
+	Filter key.Binding
+
+	// Tabs
+	Common  key.Binding
+	Backend key.Binding
+	Cache   key.Binding
+	Watcher key.Binding
+	Audit   key.Binding
+	Raw     key.Binding
+}
+
+// newDefaultKeymap returns default keybinds used by top
+func newDefaultKeymap() *keyMap {
+	return &keyMap{
+		Quit: key.NewBinding(
+			key.WithKeys("q", "ctrl+c"),
+			key.WithHelp("q", "quit"),
+		),
+		Left: key.NewBinding(
+			key.WithKeys("left", "esc", "shift+tab", "h"),
+			key.WithHelp("←", "previous"),
+		),
+		Right: key.NewBinding(
+			key.WithKeys("right", "tab", "l"),
+			key.WithHelp("→", "next"),
+		),
+		Up: key.NewBinding(
+			key.WithKeys("up", "k"),
+			key.WithHelp("↑", "up"),
+		),
+		Down: key.NewBinding(
+			key.WithKeys("down", "j"),
+			key.WithHelp("↓", "down"),
+		),
+		Common: key.NewBinding(
+			key.WithKeys("1"),
+			key.WithHelp("1", "common"),
+		),
+		Backend: key.NewBinding(
+			key.WithKeys("2"),
+			key.WithHelp("2", "backend"),
+		),
+		Cache: key.NewBinding(
+			key.WithKeys("3"),
+			key.WithHelp("3", "cache"),
+		),
+		Watcher: key.NewBinding(
+			key.WithKeys("4"),
+			key.WithHelp("4", "watcher"),
+		),
+		Audit: key.NewBinding(
+			key.WithKeys("5"),
+			key.WithHelp("5", "audit"),
+		),
+		Raw: key.NewBinding(
+			key.WithKeys("6"),
+			key.WithHelp("6", "raw"),
+		),
+
+		Filter: key.NewBinding(
+			key.WithKeys("/"),
+			key.WithHelp("/", "filter"),
+		),
+	}
+}
+
+func (k keyMap) ShortHelp() []key.Binding {
+	return []key.Binding{k.Left, k.Right, k.Quit}
+}
+
+func (k keyMap) FullHelp() [][]key.Binding {
+	return [][]key.Binding{
+		{k.Left, k.Right},
+		{k.Quit},
+	}
+}
diff --git a/tool/tctl/common/top/metrics.go b/tool/tctl/common/top/metrics.go
new file mode 100644
index 0000000000000..e727d7233d5f9
--- /dev/null
+++ b/tool/tctl/common/top/metrics.go
@@ -0,0 +1,115 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package top
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+
+	"github.com/charmbracelet/bubbles/list"
+	"github.com/dustin/go-humanize"
+	dto "github.com/prometheus/client_model/go"
+)
+
+// metricItem implements [list.DefaultItem] interface to allow rendering via [list.DefaultDelegate]
+type metricItem struct {
+	name  string
+	value string
+}
+
+func (m metricItem) Title() string       { return m.name }
+func (m metricItem) Description() string { return m.value }
+func (m metricItem) FilterValue() string { return m.name }
+
+// getMetricLabelString formats prometheus labels into a readable string.
+//
+// Example for multiple labels:
+//
+//	"{label_key1=\"value1\",labelkey2=\"value2\"}"
+//
+// Empty slice will return:
+//
+//	""
+func getMetricLabelString(labels []*dto.LabelPair) string {
+	var out string
+
+	if len(labels) == 0 {
+		return ""
+	}
+
+	for i, label := range labels {
+		if i > 0 {
+			out += ","
+		}
+		out += label.GetName() + "=\"" + label.GetValue() + "\""
+	}
+
+	return "{" + out + "}"
+}
+
+// metricItemFromPromMetric returns a single [list.Item] from a prometheus metric family and a single metric.
+func metricItemFromPromMetric(mf *dto.MetricFamily, m *dto.Metric) list.Item {
+	value := "n/a"
+
+	switch mf.GetType() {
+	case dto.MetricType_COUNTER:
+		value = humanize.FormatFloat("", m.GetCounter().GetValue())
+	case dto.MetricType_GAUGE:
+		value = humanize.FormatFloat("", m.GetGauge().GetValue())
+	case dto.MetricType_SUMMARY:
+		value = fmt.Sprintf("count: %d sum: %s",
+			m.GetSummary().GetSampleCount(),
+			humanize.FormatFloat("", m.GetSummary().GetSampleSum()),
+		)
+	case dto.MetricType_HISTOGRAM:
+		// List view does not allow enough space to make historgram buckets meaningful, only show sum and count.
+		value = fmt.Sprintf("count: %d sum: %s",
+			m.GetHistogram().GetSampleCount(),
+			humanize.FormatFloat("", m.GetHistogram().GetSampleSum()),
+		)
+	}
+
+	return metricItem{
+		name:  mf.GetName() + getMetricLabelString(m.GetLabel()),
+		value: value,
+	}
+}
+
+// convertMetricsToItems converts a [metricsMsg] into a sorted slice of [list.Item] to be used in a list view.
+func convertMetricsToItems(msg metricsMsg) []list.Item {
+
+	var itemCount int
+	for _, mf := range msg {
+		itemCount += len(mf.GetMetric())
+	}
+
+	items := make([]list.Item, 0, itemCount)
+
+	for _, mf := range msg {
+		for _, m := range mf.GetMetric() {
+			items = append(items, metricItemFromPromMetric(mf, m))
+		}
+	}
+
+	// Sort the item list to keep the display order consistent.
+	slices.SortFunc(items, func(i, j list.Item) int {
+		return cmp.Compare(i.FilterValue(), j.FilterValue())
+	})
+
+	return items
+}
diff --git a/tool/tctl/common/top/model.go b/tool/tctl/common/top/model.go
index dd4668a197d64..06837478a05fc 100644
--- a/tool/tctl/common/top/model.go
+++ b/tool/tctl/common/top/model.go
@@ -20,17 +20,20 @@ import (
 	"cmp"
 	"context"
 	"fmt"
+	"maps"
+	"slices"
 	"strings"
 	"time"
 
 	"github.com/charmbracelet/bubbles/help"
 	"github.com/charmbracelet/bubbles/key"
+	"github.com/charmbracelet/bubbles/list"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/dustin/go-humanize"
-	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
 	"github.com/guptarohit/asciigraph"
+	dto "github.com/prometheus/client_model/go"
 
 	"github.com/gravitational/teleport/api/constants"
 )
@@ -43,82 +46,168 @@ type topModel struct {
 	height          int
 	selected        int
 	help            help.Model
+	keys            *keyMap
 	refreshInterval time.Duration
-	clt             *roundtrip.Client
+	clt             MetricsClient
+	metricsList     list.Model
 	report          *Report
 	reportError     error
+	addr            string
 }
 
-func newTopModel(refreshInterval time.Duration, clt *roundtrip.Client) *topModel {
+func newTopModel(refreshInterval time.Duration, clt MetricsClient, addr string) *topModel {
+	// A delegate is used to implement custom styling for list items.
+	delegate := list.NewDefaultDelegate()
+	delegate.Styles.NormalDesc = lipgloss.NewStyle().Faint(true)
+	delegate.Styles.NormalTitle = lipgloss.NewStyle().Faint(true)
+	delegate.Styles.SelectedTitle = lipgloss.NewStyle().Faint(false).Foreground(selectedColor)
+	delegate.Styles.SelectedDesc = lipgloss.NewStyle().Faint(false)
+
+	metricsList := list.New(nil, delegate, 0, 0)
+	metricsList.SetShowTitle(false)
+	metricsList.SetShowFilter(true)
+	metricsList.SetShowStatusBar(true)
+	metricsList.SetShowHelp(false)
+
 	return &topModel{
 		help:            help.New(),
 		clt:             clt,
 		refreshInterval: refreshInterval,
+		addr:            addr,
+		keys:            newDefaultKeymap(),
+		metricsList:     metricsList,
 	}
 }
 
-// refresh pulls metrics from Teleport and builds
-// a [Report] according to the configured refresh
-// interval.
-func (m *topModel) refresh() tea.Cmd {
-	return func() tea.Msg {
-		if m.report != nil {
-			<-time.After(m.refreshInterval)
-		}
+// tickMsg is dispached when the refresh period expires.
+type tickMsg time.Time
+
+// metricsMsg contains new prometheus metrics.
+type metricsMsg map[string]*dto.MetricFamily
+
+// tick provides a ticker at a specified interval.
+func (m *topModel) tick() tea.Cmd {
+	return tea.Tick(m.refreshInterval, func(t time.Time) tea.Msg {
+		return tickMsg(t)
+	})
+}
 
+// fetchMetricsCmd fetches metrics from target and returns [metricsMsg].
+func (m *topModel) fetchMetricsCmd() tea.Cmd {
+	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 		defer cancel()
 
-		report, err := fetchAndGenerateReport(ctx, m.clt, m.report, m.refreshInterval)
+		metrics, err := m.clt.GetMetrics(ctx)
 		if err != nil {
 			return err
 		}
 
+		return metricsMsg(metrics)
+	}
+}
+
+// generateReportCmd returns a command to generate a [Report] from given [metricsMsg]
+func (m *topModel) generateReportCmd(metrics metricsMsg) tea.Cmd {
+	return func() tea.Msg {
+		report, err := generateReport(metrics, m.report, m.refreshInterval)
+		if err != nil {
+			return err
+		}
 		return report
 	}
 }
 
-// Init is a noop but required to implement [tea.Model].
+// Init kickstarts the ticker to begin polling.
 func (m *topModel) Init() tea.Cmd {
-	return m.refresh()
+	return func() tea.Msg {
+		return tickMsg(time.Now())
+	}
+}
+
+// isMetricFilterFocused checks if the user is currently on the metric pane and filtering is in progress.
+func (m *topModel) isMetricFilterFocused() bool {
+	return m.selected == 5 && m.metricsList.FilterState() == list.Filtering
 }
 
 // Update processes messages in order to updated the
 // view based on user input and new metrics data.
 func (m *topModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		h, v := lipgloss.NewStyle().GetFrameSize()
 		m.height = msg.Height - v
 		m.width = msg.Width - h
+		m.metricsList.SetSize(m.width, m.height-6 /* account for UI height */)
 	case tea.KeyMsg:
-		switch msg.String() {
-		case "q", "ctrl+c":
-			return m, tea.Quit
-		case "1":
-			m.selected = 0
-		case "2":
-			m.selected = 1
-		case "3":
-			m.selected = 2
-		case "4":
-			m.selected = 3
-		case "5":
-			m.selected = 4
-		case "right":
-			m.selected = min(m.selected+1, len(tabs)-1)
-		case "left":
-			m.selected = max(m.selected-1, 0)
+		if m.isMetricFilterFocused() {
+			// Redirect all keybinds to the list until the user is done.
+			var cmd tea.Cmd
+			m.metricsList, cmd = m.metricsList.Update(msg)
+			cmds = append(cmds, cmd)
+		} else {
+			switch {
+			case key.Matches(msg, m.keys.Quit):
+				return m, tea.Quit
+			case key.Matches(msg, m.keys.Common):
+				m.selected = 0
+			case key.Matches(msg, m.keys.Backend):
+				m.selected = 1
+			case key.Matches(msg, m.keys.Cache):
+				m.selected = 2
+			case key.Matches(msg, m.keys.Watcher):
+				m.selected = 3
+			case key.Matches(msg, m.keys.Audit):
+				m.selected = 4
+			case key.Matches(msg, m.keys.Raw):
+				m.selected = 5
+			case key.Matches(msg, m.keys.Right):
+				m.selected = (m.selected + 1) % len(tabs)
+			case key.Matches(msg, m.keys.Left):
+				m.selected = (m.selected - 1 + len(tabs)) % len(tabs)
+			case key.Matches(msg, m.keys.Filter),
+				key.Matches(msg, m.keys.Up),
+				key.Matches(msg, m.keys.Down):
+				// Only a subset of keybinds are forwarded to the list view.
+				var cmd tea.Cmd
+				m.metricsList, cmd = m.metricsList.Update(msg)
+				cmds = append(cmds, cmd)
+			}
+		}
+	case tickMsg:
+		cmds = append(cmds, m.tick(), m.fetchMetricsCmd())
+	case metricsMsg:
+		cmds = append(cmds, m.generateReportCmd(msg))
+
+		filterValue := m.metricsList.FilterInput.Value()
+		selected := m.metricsList.Index()
+
+		var cmd tea.Cmd
+		cmd = m.metricsList.SetItems(convertMetricsToItems(msg))
+		cmds = append(cmds, cmd)
+
+		// There is a glitch in the list.Model view when a filter has been applied
+		// the pagination status is broken after replacing all items. Workaround this by
+		// manually resetting the filter and updating the selection.
+		if m.metricsList.FilterState() == list.FilterApplied {
+			m.metricsList.SetFilterText(filterValue)
+			m.metricsList.Select(selected)
 		}
+
 	case *Report:
 		m.report = msg
 		m.reportError = nil
-		return m, m.refresh()
 	case error:
 		m.reportError = msg
-		return m, m.refresh()
+	default:
+		// Forward internal messages to the metrics list.
+		var cmd tea.Cmd
+		m.metricsList, cmd = m.metricsList.Update(msg)
+		cmds = append(cmds, cmd)
 	}
-	return m, nil
+
+	return m, tea.Batch(cmds...)
 }
 
 // View formats the metrics and draws them to
@@ -169,15 +258,16 @@ func (m *topModel) footerView() string {
 
 	if m.reportError != nil {
 		if trace.IsConnectionProblem(m.reportError) {
-			leftContent = fmt.Sprintf("Could not connect to metrics service: %v", m.clt.Endpoint())
+			leftContent = fmt.Sprintf("Could not connect to metrics service: %v", m.addr)
 		} else {
 			leftContent = fmt.Sprintf("Failed to generate report: %v", m.reportError)
 		}
 	}
 	if leftContent == "" && m.report != nil {
-		leftContent = fmt.Sprintf("Report generated at %s for host %s",
+		leftContent = fmt.Sprintf("Report generated at %s for host %s (%s)",
 			m.report.Timestamp.Format(constants.HumanDateFormatSeconds),
 			m.report.Hostname,
+			m.addr,
 		)
 	}
 	left := lipgloss.NewStyle().
@@ -190,7 +280,7 @@ func (m *topModel) footerView() string {
 		Inline(true).
 		Width(35).
 		Align(lipgloss.Center).
-		Render(m.help.View(helpKeys))
+		Render(m.help.View(m.keys))
 
 	center := lipgloss.NewStyle().
 		Inline(true).
@@ -222,6 +312,8 @@ func (m *topModel) contentView() string {
 		return renderWatcher(m.report, m.height, m.width)
 	case 4:
 		return renderAudit(m.report, m.height, m.width)
+	case 5:
+		return boxedViewWithStyle("Prometheus Metrics", m.metricsList.View(), m.width, lipgloss.NewStyle())
 	default:
 		return ""
 	}
@@ -312,6 +404,24 @@ func renderCommon(report *Report, width int) string {
 	)
 	runtimeContent := boxedView("Go Runtime Stats", runtimeTable, columnWidth)
 
+	serviceKeys := slices.Sorted(maps.Keys(report.Service))
+	serviceCounts := make([]string, 0, len(serviceKeys))
+	for _, k := range serviceKeys {
+		serviceCounts = append(serviceCounts, humanize.FormatFloat("#.", report.Service[k]))
+	}
+	servicesTable := tableView(
+		columnWidth,
+		column{
+			width:   columnWidth * 8 / 10,
+			content: serviceKeys,
+		},
+		column{
+			width:   columnWidth * 2 / 10,
+			content: serviceCounts,
+		},
+	)
+	servicesContent := boxedView("Services", servicesTable, columnWidth)
+
 	certLatencyContent := boxedView("Generate Server Certificates Percentiles", "No data", columnWidth)
 
 	style := lipgloss.NewStyle().
@@ -328,7 +438,12 @@ func renderCommon(report *Report, width int) string {
 				runtimeContent,
 			),
 		),
-		style.Render(certLatencyContent),
+		style.Render(
+			lipgloss.JoinVertical(lipgloss.Left,
+				servicesContent,
+				certLatencyContent,
+			),
+		),
 	)
 }
 
@@ -531,41 +646,7 @@ func tabView(selectedTab int) string {
 	return output
 }
 
-// keyMap is used to display the help text at
-// the bottom of the screen.
-type keyMap struct {
-	quit  key.Binding
-	right key.Binding
-	left  key.Binding
-}
-
-func (k keyMap) ShortHelp() []key.Binding {
-	return []key.Binding{k.left, k.right, k.quit}
-}
-
-func (k keyMap) FullHelp() [][]key.Binding {
-	return [][]key.Binding{
-		{k.left, k.right},
-		{k.quit},
-	}
-}
-
 var (
-	helpKeys = keyMap{
-		quit: key.NewBinding(
-			key.WithKeys("q", "esc", "ctrl+c"),
-			key.WithHelp("q", "quit"),
-		),
-		left: key.NewBinding(
-			key.WithKeys("left", "esc"),
-			key.WithHelp("left", "previous"),
-		),
-		right: key.NewBinding(
-			key.WithKeys("right"),
-			key.WithHelp("right", "next"),
-		),
-	}
-
 	statusBarStyle = lipgloss.NewStyle()
 
 	separator = lipgloss.NewStyle().
@@ -577,5 +658,5 @@ var (
 	failedEventStyle  = lipgloss.NewStyle().Foreground(lipgloss.Color(fmt.Sprintf("%d", asciigraph.Red)))
 	trimmedEventStyle = lipgloss.NewStyle().Foreground(lipgloss.Color(fmt.Sprintf("%d", asciigraph.Goldenrod)))
 
-	tabs = []string{"Common", "Backend", "Cache", "Watcher", "Audit"}
+	tabs = []string{"Common", "Backend", "Cache", "Watcher", "Audit", "Raw Metrics"}
 )
diff --git a/tool/tctl/common/top/report.go b/tool/tctl/common/top/report.go
index b185daf9958e9..8756574fdca7a 100644
--- a/tool/tctl/common/top/report.go
+++ b/tool/tctl/common/top/report.go
@@ -18,21 +18,16 @@ package top
 
 import (
 	"cmp"
-	"context"
 	"fmt"
 	"iter"
 	"math"
-	"net/url"
 	"os"
 	"slices"
 	"strings"
 	"time"
 
-	"github.com/gravitational/roundtrip"
-	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
 	dto "github.com/prometheus/client_model/go"
-	"github.com/prometheus/common/expfmt"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
@@ -61,6 +56,8 @@ type Report struct {
 	Watcher *WatcherStats
 	// Audit contains stats for audit event backends.
 	Audit *AuditStats
+	// Service is a map of service name to a gauge value of how many services of that type are currently running.
+	Service map[string]float64
 }
 
 // AuditStats contains metrics related to the audit log.
@@ -375,20 +372,6 @@ type Bucket struct {
 	UpperBound float64
 }
 
-func fetchAndGenerateReport(ctx context.Context, client *roundtrip.Client, prev *Report, period time.Duration) (*Report, error) {
-	re, err := client.Get(ctx, client.Endpoint("metrics"), url.Values{})
-	if err != nil {
-		return nil, trace.Wrap(trace.ConvertSystemError(err))
-	}
-
-	var parser expfmt.TextParser
-	metrics, err := parser.TextToMetricFamilies(re.Reader())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return generateReport(metrics, prev, period)
-}
-
 func generateReport(metrics map[string]*dto.MetricFamily, prev *Report, period time.Duration) (*Report, error) {
 	// format top backend requests
 	hostname, _ := os.Hostname()
@@ -470,6 +453,8 @@ func generateReport(metrics map[string]*dto.MetricFamily, prev *Report, period t
 		Roles:                          getGaugeValue(metrics[prometheus.BuildFQName(teleport.MetricNamespace, "", "roles_total")]),
 	}
 
+	re.Service = getGaugeValuesForLabelKey(metrics[prometheus.BuildFQName(teleport.MetricNamespace, "", teleport.MetricTeleportServices)], teleport.TagServiceName)
+
 	var auditStats *AuditStats
 	if prev != nil {
 		auditStats = prev.Audit
@@ -702,6 +687,25 @@ func getActiveMigrations(metric *dto.MetricFamily) []string {
 	return out
 }
 
+// For a given `family` of metrics, return all gauge values that match a given `labelKey` as a map keyed by the label value.
+func getGaugeValuesForLabelKey(family *dto.MetricFamily, labelKey string) map[string]float64 {
+	if family.GetType() != dto.MetricType_GAUGE {
+		return nil
+	}
+
+	out := make(map[string]float64)
+	for _, metric := range family.GetMetric() {
+		for _, label := range metric.GetLabel() {
+			if label.GetName() == labelKey {
+				out[label.GetValue()] = metric.GetGauge().GetValue()
+				break
+			}
+		}
+	}
+
+	return out
+}
+
 func getComponentGaugeValue(component string, metric *dto.MetricFamily) float64 {
 	if metric == nil || metric.GetType() != dto.MetricType_GAUGE || len(metric.Metric) == 0 || metric.Metric[0].Gauge == nil || metric.Metric[0].Gauge.Value == nil {
 		return 0
diff --git a/tool/tctl/common/user_command.go b/tool/tctl/common/user_command.go
index 9325335b9b4aa..147d775c79aca 100644
--- a/tool/tctl/common/user_command.go
+++ b/tool/tctl/common/user_command.go
@@ -64,10 +64,13 @@ type UserCommand struct {
 	allowedAzureIdentities    []string
 	allowedGCPServiceAccounts []string
 	allowedRoles              []string
+	allowedMCPTools           []string
 	hostUserUID               string
 	hostUserUIDProvided       bool
 	hostUserGID               string
 	hostUserGIDProvided       bool
+	defaultRelayAddr          string
+	defaultRelayAddrProvided  bool
 
 	ttl time.Duration
 
@@ -103,6 +106,8 @@ func (u *UserCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 	u.userAdd.Flag("gcp-service-accounts", "List of allowed GCP service accounts for the new user").StringsVar(&u.allowedGCPServiceAccounts)
 	u.userAdd.Flag("host-user-uid", "UID for auto provisioned host users to use").IsSetByUser(&u.hostUserUIDProvided).StringVar(&u.hostUserUID)
 	u.userAdd.Flag("host-user-gid", "GID for auto provisioned host users to use").IsSetByUser(&u.hostUserGIDProvided).StringVar(&u.hostUserGID)
+	u.userAdd.Flag("mcp-tools", "List of allowed MCP tools for the new user").StringsVar(&u.allowedMCPTools)
+	u.userAdd.Flag("default-relay-addr", "Relay address that clients should use by default").StringVar(&u.defaultRelayAddr)
 
 	u.userAdd.Flag("roles", "List of roles for the new user to assume").Required().StringsVar(&u.allowedRoles)
 
@@ -138,6 +143,8 @@ func (u *UserCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
 		StringsVar(&u.allowedGCPServiceAccounts)
 	u.userUpdate.Flag("set-host-user-uid", "UID for auto provisioned host users to use. Value can be reset by providing an empty string").IsSetByUser(&u.hostUserUIDProvided).StringVar(&u.hostUserUID)
 	u.userUpdate.Flag("set-host-user-gid", "GID for auto provisioned host users to use. Value can be reset by providing an empty string").IsSetByUser(&u.hostUserGIDProvided).StringVar(&u.hostUserGID)
+	u.userUpdate.Flag("set-mcp-tools", "List of allowed MCP tools for the user, replaces current allowed MCP tools.").StringsVar(&u.allowedMCPTools)
+	u.userUpdate.Flag("set-default-relay-addr", "Relay address that clients should use by default. Value can be reset by providing an empty string").IsSetByUser(&u.defaultRelayAddrProvided).StringVar(&u.defaultRelayAddr)
 
 	u.userList = users.Command("ls", "Lists all user accounts.")
 	u.userList.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).StringVar(&u.format)
@@ -297,6 +304,11 @@ func (u *UserCommand) Add(ctx context.Context, client *authclient.Client) error
 		constants.TraitGCPServiceAccounts: gcpServiceAccounts,
 		constants.TraitHostUserUID:        {u.hostUserUID},
 		constants.TraitHostUserGID:        {u.hostUserGID},
+		constants.TraitMCPTools:           flattenSlice(u.allowedMCPTools),
+	}
+
+	if u.defaultRelayAddr != "" {
+		traits[constants.TraitDefaultRelayAddr] = []string{u.defaultRelayAddr}
 	}
 
 	user, err := types.NewUser(u.login)
@@ -476,6 +488,17 @@ func (u *UserCommand) Update(ctx context.Context, client *authclient.Client) err
 		updateMessages["Host user GID"] = []string{u.hostUserGID}
 	}
 
+	if len(u.allowedMCPTools) > 0 {
+		mcpTools := flattenSlice(u.allowedMCPTools)
+		user.SetMCPTools(mcpTools)
+		updateMessages["MCP tools"] = mcpTools
+	}
+
+	if u.defaultRelayAddrProvided {
+		user.SetDefaultRelayAddr(u.defaultRelayAddr)
+		updateMessages["default relay address"] = []string{u.defaultRelayAddr}
+	}
+
 	if len(updateMessages) == 0 {
 		return trace.BadParameter("Nothing to update. Please provide at least one --set flag.")
 	}
diff --git a/tool/tctl/common/user_command_test.go b/tool/tctl/common/user_command_test.go
index c486a6cc6a24d..c0e29acdb303b 100644
--- a/tool/tctl/common/user_command_test.go
+++ b/tool/tctl/common/user_command_test.go
@@ -85,7 +85,9 @@ func TestUserAdd(t *testing.T) {
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
 	ctx := context.Background()
-	client := testenv.MakeDefaultAuthClient(t, process)
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
 
 	tests := []struct {
 		name string
@@ -189,6 +191,27 @@ func TestUserAdd(t *testing.T) {
 				require.ErrorContains(t, err, "GCP service account \"foobar\" is invalid")
 			},
 		},
+		{
+			name: "mcp tools",
+			args: []string{"--mcp-tools", "aa,bb", "--mcp-tools", "get_*"},
+			wantTraits: map[string][]string{
+				constants.TraitMCPTools: {"aa", "bb", "get_*"},
+			},
+		},
+		{
+			name: "default relay addr set",
+			args: []string{"--default-relay-addr", "foo"},
+			wantTraits: map[string][]string{
+				constants.TraitDefaultRelayAddr: {"foo"},
+			},
+		},
+		{
+			name: "default relay addr blank",
+			args: []string{"--default-relay-addr", ""},
+			wantTraits: map[string][]string{
+				constants.TraitDefaultRelayAddr: nil,
+			},
+		},
 	}
 
 	for ix, tc := range tests {
@@ -237,7 +260,9 @@ func TestUserUpdate(t *testing.T) {
 	}
 	process := makeAndRunTestAuthServer(t, withFileConfig(fileConfig), withFileDescriptors(dynAddr.Descriptors))
 	ctx := context.Background()
-	client := testenv.MakeDefaultAuthClient(t, process)
+	client, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
 
 	baseUser, err := types.NewUser("test-user")
 	require.NoError(t, err)
@@ -352,6 +377,27 @@ func TestUserUpdate(t *testing.T) {
 				require.ErrorContains(t, err, "GCP service account \"foobar\" is invalid")
 			},
 		},
+		{
+			name: "mcp tools",
+			args: []string{"--set-mcp-tools", "aa,bb", "--set-mcp-tools", "get_*"},
+			wantTraits: map[string][]string{
+				constants.TraitMCPTools: {"aa", "bb", "get_*"},
+			},
+		},
+		{
+			name: "default relay addr set",
+			args: []string{"--set-default-relay-addr", "foo"},
+			wantTraits: map[string][]string{
+				constants.TraitDefaultRelayAddr: {"foo"},
+			},
+		},
+		{
+			name: "default relay addr reset",
+			args: []string{"--set-default-relay-addr", ""},
+			wantTraits: map[string][]string{
+				constants.TraitDefaultRelayAddr: nil,
+			},
+		},
 	}
 
 	for _, tc := range tests {
diff --git a/tool/tctl/common/workload_identity_command.go b/tool/tctl/common/workload_identity_command.go
index 5b274e4df50b8..33d8cdfdf475d 100644
--- a/tool/tctl/common/workload_identity_command.go
+++ b/tool/tctl/common/workload_identity_command.go
@@ -68,17 +68,20 @@ type WorkloadIdentityCommand struct {
 	revocationReason string
 	revocationExpiry string
 
-	overridesSignCmd  *kingpin.CmdClause
-	overridesSignMode workloadidentityv1pb.CSRCreationMode
+	overridesSignCmd   *kingpin.CmdClause
+	overridesSignMode  workloadidentityv1pb.CSRCreationMode
+	overridesSignForce bool
 
 	overridesCreateCmd        *kingpin.CmdClause
 	overridesCreateName       string
 	overridesCreateForce      bool
 	overridesCreateFullchains []string
+	overridesCreateDryRun     bool
 
 	now func() time.Time
 
 	stdout io.Writer
+	stderr io.Writer
 }
 
 // Initialize sets up the "tctl workload-identity" command.
@@ -173,12 +176,19 @@ func (c *WorkloadIdentityCommand) Initialize(
 		)).
 		StringVar(&overridesSignMode)
 	c.overridesSignMode = workloadidentityv1pb.CSRCreationMode_CSR_CREATION_MODE_SAME
+	c.overridesSignCmd.
+		Flag("force", "Attempt to sign as many CSRs as possible even in the presence of errors.").
+		Short('f').
+		BoolVar(&c.overridesSignForce)
 
 	c.overridesCreateCmd = overridesCmd.Command("create", "Create an issuer override from the given certificate chains.")
 	c.overridesCreateCmd.
 		Flag("force", "Overwrite the existing override if it exists.").
 		Short('f').
 		BoolVar(&c.overridesCreateForce)
+	c.overridesCreateCmd.
+		Flag("dry-run", "Print the workload_identity_x509_issuer_override that would have been created, without actually creating it.").
+		BoolVar(&c.overridesCreateDryRun)
 	c.overridesCreateCmd.
 		Flag("name", "The name of the override resource to write.").
 		Default("default").
@@ -191,6 +201,9 @@ func (c *WorkloadIdentityCommand) Initialize(
 	if c.stdout == nil {
 		c.stdout = os.Stdout
 	}
+	if c.stderr == nil {
+		c.stderr = os.Stderr
+	}
 	if c.now == nil {
 		c.now = time.Now
 	}
@@ -518,6 +531,24 @@ func (c *WorkloadIdentityCommand) runOverridesCreate(ctx context.Context, client
 		overrides = append(overrides, certs)
 	}
 
+	// Ensure that the user has not provided the Root CA - we only want them to
+	// provide the intermediates that chain to the root CA. If they provide the
+	// root CA, then workloads will end up needlessly distributing the root CA
+	// to validators.
+	for _, chain := range overrides {
+		for _, cert := range chain {
+			// If the issuer and subject are the same, then this is a
+			// "self-signed" certificate.
+			if bytes.Equal(cert.RawSubject, cert.RawIssuer) {
+				slog.WarnContext(
+					ctx,
+					"The provided certificate chain contains a root certificate when it should only contain the issuing CA and the intermediate CAs necessary to chain the issuing CA to the root CA. Remove the root certificate from the certificate file.",
+					"cert_subject", cert.Subject.String(),
+				)
+			}
+		}
+	}
+
 	clusterName, err := client.GetDomainName(ctx)
 	if err != nil {
 		return trace.Wrap(err)
@@ -578,6 +609,14 @@ func (c *WorkloadIdentityCommand) runOverridesCreate(ctx context.Context, client
 		},
 	}
 
+	if c.overridesCreateDryRun {
+		fmt.Fprintln(c.stderr, "Dry run mode enabled, the following override would have been created:")
+		if err := utils.WriteYAML(c.stdout, types.ProtoResource153ToLegacy(override)); err != nil {
+			return trace.Wrap(err, "failed to marshal override")
+		}
+		return nil
+	}
+
 	if c.overridesCreateForce {
 		if _, err := oclt.UpsertX509IssuerOverride(ctx, &workloadidentityv1pb.UpsertX509IssuerOverrideRequest{
 			X509IssuerOverride: override,
@@ -620,31 +659,55 @@ func (c *WorkloadIdentityCommand) runOverridesSignCSRs(ctx context.Context, clie
 	}
 
 	keypairs := ca.GetTrustedTLSKeyPairs()
-	csrs := make([]*x509.CertificateRequest, 0, len(keypairs))
+	type result struct {
+		issuer *x509.Certificate
+		csr    *x509.CertificateRequest
+		err    error
+	}
+	results := make([]result, 0, len(keypairs))
 	for _, kp := range keypairs {
-		block, _ := pem.Decode(kp.Cert)
-		if block == nil {
-			return trace.BadParameter("failed to decode PEM block in SPIFFE CA")
+		issuer, err := tlsca.ParseCertificatePEM(kp.Cert)
+		if err != nil {
+			return trace.Wrap(err)
 		}
 		resp, err := oclt.SignX509IssuerCSR(ctx, &workloadidentityv1pb.SignX509IssuerCSRRequest{
-			Issuer:          block.Bytes,
+			Issuer:          issuer.Raw,
 			CsrCreationMode: c.overridesSignMode,
 		})
 		if err != nil {
-			return trace.Wrap(err)
+			if !c.overridesSignForce {
+				return trace.Wrap(err)
+			}
+			results = append(results, result{
+				issuer: issuer,
+				csr:    nil,
+				err:    err,
+			})
+			continue
 		}
 		csr, err := x509.ParseCertificateRequest(resp.GetCsr())
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		csrs = append(csrs, csr)
+		results = append(results, result{
+			issuer: issuer,
+			csr:    csr,
+			err:    nil,
+		})
 	}
-	for _, csr := range csrs {
-		fmt.Fprintln(c.stdout, csr.Subject)
+
+	var errs []error
+	for _, r := range results {
+		fmt.Fprintln(c.stdout, r.issuer.Subject)
+		if r.err != nil {
+			errs = append(errs, r.err)
+			fmt.Fprintln(c.stdout, r.err.Error())
+			continue
+		}
 		_ = pem.Encode(c.stdout, &pem.Block{
 			Type:  "CERTIFICATE REQUEST",
-			Bytes: csr.Raw,
+			Bytes: r.csr.Raw,
 		})
 	}
-	return nil
+	return trace.Wrap(trace.NewAggregate(errs...), "some or all signature requests failed")
 }
diff --git a/tool/tctl/common/workload_identity_command_overrides_test.go b/tool/tctl/common/workload_identity_command_overrides_test.go
index b8df7b9541fa1..262b6e15261f6 100644
--- a/tool/tctl/common/workload_identity_command_overrides_test.go
+++ b/tool/tctl/common/workload_identity_command_overrides_test.go
@@ -215,7 +215,7 @@ func TestOverrideSign(t *testing.T) {
 
 	l, err := out.ReadString('\n')
 	require.NoError(t, err)
-	require.Equal(t, "CN=csr1\n", l)
+	require.Equal(t, "CN=c1\n", l)
 	b, rest := pem.Decode(out.Bytes())
 	require.NotNil(t, b)
 	require.Equal(t, "CERTIFICATE REQUEST", b.Type)
@@ -224,7 +224,7 @@ func TestOverrideSign(t *testing.T) {
 
 	l, err = out.ReadString('\n')
 	require.NoError(t, err)
-	require.Equal(t, "CN=csr2\n", l)
+	require.Equal(t, "CN=c2\n", l)
 	b, rest = pem.Decode(out.Bytes())
 	require.NotNil(t, b)
 	require.Equal(t, "CERTIFICATE REQUEST", b.Type)
@@ -232,6 +232,62 @@ func TestOverrideSign(t *testing.T) {
 	out.Next(out.Len() - len(rest))
 
 	require.Zero(t, out.Len())
+
+	clt = runFakeAPIServer(t, func(s *grpc.Server) {
+		proto.RegisterAuthServiceServer(s, &domainNameServer{
+			domainName: "clustername",
+		})
+		trustv1.RegisterTrustServiceServer(s, &caServer{
+			cas: map[types.CertAuthID]*types.CertAuthorityV2{
+				{Type: types.SPIFFECA, DomainName: "clustername"}: {
+					Spec: types.CertAuthoritySpecV2{
+						ActiveKeys: types.CAKeySet{
+							TLS: []*types.TLSKeyPair{
+								{Cert: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c1.Leaf.Raw})},
+								{Cert: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c2.Leaf.Raw})},
+							},
+						},
+					},
+				},
+			},
+		})
+		workloadidentityv1.RegisterX509OverridesServiceServer(s, &csrServer{
+			resp: map[string][]byte{
+				string(c1.Leaf.Raw): csr1,
+			},
+		})
+	})
+
+	out.Reset()
+
+	err = runCommand(t, clt, &WorkloadIdentityCommand{stdout: out}, []string{
+		"workload-identity", "x509-issuer-overrides", "sign-csrs",
+	})
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+	require.Zero(t, out.Len())
+
+	err = runCommand(t, clt, &WorkloadIdentityCommand{stdout: out}, []string{
+		"workload-identity", "x509-issuer-overrides", "sign-csrs", "--force",
+	})
+	require.ErrorAs(t, err, new(*trace.NotFoundError))
+
+	l, err = out.ReadString('\n')
+	require.NoError(t, err)
+	require.Equal(t, "CN=c1\n", l)
+	b, rest = pem.Decode(out.Bytes())
+	require.NotNil(t, b)
+	require.Equal(t, "CERTIFICATE REQUEST", b.Type)
+	require.Equal(t, csr1, b.Bytes)
+	out.Next(out.Len() - len(rest))
+
+	l, err = out.ReadString('\n')
+	require.NoError(t, err)
+	require.Equal(t, "CN=c2\n", l)
+	l, err = out.ReadString('\n')
+	require.NoError(t, err)
+	require.Equal(t, signKeyNotFoundMessage+"\n", l)
+
+	require.Zero(t, out.Len())
 }
 
 type domainNameServer struct {
@@ -292,13 +348,15 @@ type csrServer struct {
 	resp map[string][]byte
 }
 
+const signKeyNotFoundMessage = "key not found or something idk"
+
 func (s *csrServer) SignX509IssuerCSR(ctx context.Context, req *workloadidentityv1.SignX509IssuerCSRRequest) (*workloadidentityv1.SignX509IssuerCSRResponse, error) {
 	if req.GetCsrCreationMode() == 0 {
 		return nil, status.Errorf(codes.InvalidArgument, "")
 	}
 	csr, ok := s.resp[string(req.GetIssuer())]
 	if !ok {
-		return nil, status.Errorf(codes.NotFound, "")
+		return nil, status.Errorf(codes.NotFound, signKeyNotFoundMessage)
 	}
 	return &workloadidentityv1.SignX509IssuerCSRResponse{Csr: csr}, nil
 }
diff --git a/tool/tctl/common/workload_identity_test.go b/tool/tctl/common/workload_identity_test.go
index c3c7a688233b4..417ac6a9aec8a 100644
--- a/tool/tctl/common/workload_identity_test.go
+++ b/tool/tctl/common/workload_identity_test.go
@@ -37,7 +37,7 @@ import (
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
 	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
@@ -58,8 +58,15 @@ func runWorkloadIdentityCommand(
 func TestWorkloadIdentity(t *testing.T) {
 	t.Parallel()
 
-	process := testenv.MakeTestServer(t, testenv.WithLogger(utils.NewSlogLoggerForTests()))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(logtest.NewLogger()))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	yamlData := `kind: workload_identity
 version: v1
@@ -172,8 +179,15 @@ spec:
 func TestWorkloadIdentityRevocation(t *testing.T) {
 	t.Parallel()
 
-	process := testenv.MakeTestServer(t, testenv.WithLogger(utils.NewSlogLoggerForTests()))
-	rootClient := testenv.MakeDefaultAuthClient(t, process)
+	process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(logtest.NewLogger()))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+	rootClient, err := testenv.NewDefaultAuthClient(process)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = rootClient.Close() })
 
 	t.Run("workload-identity revocations ls empty", func(t *testing.T) {
 		buf, err := runWorkloadIdentityCommand(
@@ -197,7 +211,7 @@ func TestWorkloadIdentityRevocation(t *testing.T) {
 			},
 		)
 		require.NoError(t, err)
-		require.Equal(t, "[]", buf.String())
+		require.Equal(t, "[]\n", buf.String())
 	})
 
 	t.Run("workload-identity revocations add", func(t *testing.T) {
@@ -293,6 +307,6 @@ func TestWorkloadIdentityRevocation(t *testing.T) {
 			},
 		)
 		require.NoError(t, err)
-		require.Equal(t, "[]", buf.String())
+		require.Equal(t, "[]\n", buf.String())
 	})
 }
diff --git a/tool/tctl/sso/configure/github.go b/tool/tctl/sso/configure/github.go
index 09287ea6ebf7b..5bc7c2b427380 100644
--- a/tool/tctl/sso/configure/github.go
+++ b/tool/tctl/sso/configure/github.go
@@ -28,6 +28,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -119,7 +120,10 @@ func ResolveCallbackURL(ctx context.Context, logger *slog.Logger, clt *authclien
 	var callbackURL string
 
 	logger.InfoContext(ctx, "resolving callback url automatically", "field_name", fieldName)
-	proxies, err := clt.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, clt.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return clt.GetProxies()
+	})
 	if err != nil {
 		logger.ErrorContext(ctx, "unable to get proxy list", "error", err)
 	}
diff --git a/tool/tctl/sso/tester/command.go b/tool/tctl/sso/tester/command.go
index 654d3b12531f1..4da75702c1dfb 100644
--- a/tool/tctl/sso/tester/command.go
+++ b/tool/tctl/sso/tester/command.go
@@ -32,6 +32,7 @@ import (
 	kyaml "k8s.io/apimachinery/pkg/util/yaml"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
@@ -186,7 +187,10 @@ type AuthRequestInfo struct {
 type SSOLoginConsoleRequestFn func(req client.SSOLoginConsoleReq) (*client.SSOLoginConsoleResponse, error)
 
 func (cmd *SSOTestCommand) runSSOLoginFlow(ctx context.Context, connectorType string, c *authclient.Client, initiateSSOLoginFn SSOLoginConsoleRequestFn) (*authclient.SSHLoginResponse, error) {
-	proxies, err := c.GetProxies()
+	proxies, err := clientutils.CollectWithFallback(ctx, c.ListProxyServers, func(context.Context) ([]types.Server, error) {
+		//nolint:staticcheck // TODO(kiosion) DELETE IN 21.0.0
+		return c.GetProxies()
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/tool/teleport-update/main.go b/tool/teleport-update/main.go
index 969718d2d2926..01e78cc5c4175 100644
--- a/tool/teleport-update/main.go
+++ b/tool/teleport-update/main.go
@@ -50,12 +50,21 @@ Find out more at https://goteleport.com/docs/upgrading/agent-managed-updates`
 const (
 	// proxyServerEnvVar allows the proxy server address to be specified via env var.
 	proxyServerEnvVar = "TELEPORT_PROXY"
+	// installDirEnvVar specifies the Teleport install directory.
+	installDirEnvVar = "TELEPORT_INSTALL_DIR"
+	// pathEnvVar specifies the Teleport PATH for binary symlinks.
+	pathEnvVar = "TELEPORT_PATH"
 	// updateGroupEnvVar allows the update group to be specified via env var.
 	updateGroupEnvVar = "TELEPORT_UPDATE_GROUP"
-	// updateVersionEnvVar forces the version to specified value.
+	// updateVersionEnvVar specifies the Teleport version.
 	updateVersionEnvVar = "TELEPORT_UPDATE_VERSION"
+	// updateFlagsEnvVar specifies Teleport version flags.
+	updateFlagsEnvVar = "TELEPORT_UPDATE_FLAGS"
+
 	// updateLockTimeout is the duration commands will wait for update to complete before failing.
 	updateLockTimeout = 10 * time.Minute
+	// notUpToDateExitCode is returned by `teleport-update status --is-up-to-date` if Teleport is not up-to-date.
+	notUpToDateExitCode = 3
 )
 
 var plog = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentUpdater)
@@ -87,6 +96,10 @@ type cliConfig struct {
 	ForceUninstall bool
 	// Insecure skips TLS certificate verification.
 	Insecure bool
+	// StatusWithExitCode makes the status command return different exit codes depending on the update status.
+	StatusWithExitCode bool
+	// SetupTbot specifies whether tbot should be managed.
+	SetupTbot bool
 }
 
 func Run(args []string) int {
@@ -101,9 +114,9 @@ func Run(args []string) int {
 	app.Flag("log-format", "Controls the format of output logs. Can be `json` or `text`. Defaults to `text`.").
 		Default(libutils.LogFormatText).EnumVar(&ccfg.LogFormat, libutils.LogFormatJSON, libutils.LogFormatText)
 	app.Flag("install-suffix", "Suffix for creating an agent installation outside of the default $PATH. Note: this changes the default data directory.").
-		Short('i').StringVar(&ccfg.InstallSuffix)
+		Short('i').Envar(common.InstallSuffixEnvVar).StringVar(&ccfg.InstallSuffix)
 	app.Flag("install-dir", "Directory containing Teleport installations.").
-		Hidden().StringVar(&ccfg.InstallDir)
+		Hidden().Envar(installDirEnvVar).StringVar(&ccfg.InstallDir)
 	app.Flag("insecure", "Insecure mode disables certificate verification. Do not use in production.").
 		BoolVar(&ccfg.Insecure)
 
@@ -118,18 +131,20 @@ func Run(args []string) int {
 		Short('g').Envar(updateGroupEnvVar).StringVar(&ccfg.Group)
 	enableCmd.Flag("base-url", "Base URL used to override the Teleport download URL.").
 		Short('b').Envar(common.BaseURLEnvVar).StringVar(&ccfg.BaseURL)
-	enableCmd.Flag("overwrite", "Allow existing installed Teleport binaries to be overwritten.").
+	enableCmd.Flag("overwrite", "Allow existing installed binaries and services to be overwritten.").
 		Short('o').BoolVar(&ccfg.AllowOverwrite)
 	enableCmd.Flag("allow-proxy-conflict", "Allow proxy addresses in teleport.yaml and update.yaml to conflict.").
 		BoolVar(&ccfg.AllowProxyConflict)
 	enableCmd.Flag("force-version", "Force the provided version instead of using the version provided by the Teleport cluster.").
 		Hidden().Short('f').Envar(updateVersionEnvVar).StringVar(&ccfg.ForceVersion)
 	enableCmd.Flag("force-flag", "Force the provided version flags instead of using the version flags provided by the Teleport cluster.").
-		Hidden().StringsVar(&ccfg.ForceFlags)
+		Hidden().Envar(updateFlagsEnvVar).StringsVar(&ccfg.ForceFlags)
 	enableCmd.Flag("self-setup", "Use the current teleport-update binary to create systemd service config for managed updates.").
 		Hidden().BoolVar(&ccfg.SelfSetup)
 	enableCmd.Flag("path", "Directory to link the active Teleport installation's binaries into.").
-		Hidden().StringVar(&ccfg.Path)
+		Hidden().Envar(pathEnvVar).StringVar(&ccfg.Path)
+	enableCmd.Flag("selinux-ssh", "Install an SELinux module to constrain Teleport SSH.").
+		Hidden().Envar(autoupdate.SetupSELinuxSSHEnvVar).IsSetByUser(&ccfg.SELinuxSSHChanged).BoolVar(&ccfg.SELinuxSSH)
 
 	disableCmd := app.Command("disable", "Disable agent managed updates. Does not affect the active installation of Teleport.")
 
@@ -140,18 +155,20 @@ func Run(args []string) int {
 		Short('g').Envar(updateGroupEnvVar).StringVar(&ccfg.Group)
 	pinCmd.Flag("base-url", "Base URL used to override the Teleport download URL.").
 		Short('b').Envar(common.BaseURLEnvVar).StringVar(&ccfg.BaseURL)
-	pinCmd.Flag("overwrite", "Allow existing installed Teleport binaries to be overwritten.").
+	pinCmd.Flag("overwrite", "Allow existing installed binaries and services to be overwritten.").
 		Short('o').BoolVar(&ccfg.AllowOverwrite)
 	pinCmd.Flag("allow-proxy-conflict", "Allow proxy addresses in teleport.yaml and update.yaml to conflict.").
 		BoolVar(&ccfg.AllowProxyConflict)
 	pinCmd.Flag("force-version", "Force the provided version instead of using the version provided by the Teleport cluster.").
 		Short('f').Envar(updateVersionEnvVar).StringVar(&ccfg.ForceVersion)
 	pinCmd.Flag("force-flag", "Force the provided version flags instead of using the version flags provided by the Teleport cluster.").
-		Hidden().StringsVar(&ccfg.ForceFlags)
+		Hidden().Envar(updateFlagsEnvVar).StringsVar(&ccfg.ForceFlags)
 	pinCmd.Flag("self-setup", "Use the current teleport-update binary to create systemd service config for managed updates.").
 		Hidden().BoolVar(&ccfg.SelfSetup)
 	pinCmd.Flag("path", "Directory to link the active Teleport installation's binaries into.").
-		Hidden().StringVar(&ccfg.Path)
+		Hidden().Envar(pathEnvVar).StringVar(&ccfg.Path)
+	pinCmd.Flag("selinux-ssh", "Install an SELinux module to constrain Teleport SSH.").
+		Hidden().Envar(autoupdate.SetupSELinuxSSHEnvVar).IsSetByUser(&ccfg.SELinuxSSHChanged).BoolVar(&ccfg.SELinuxSSH)
 
 	unpinCmd := app.Command("unpin", "Unpin the current version, allowing it to be updated.")
 
@@ -164,14 +181,27 @@ func Run(args []string) int {
 	linkCmd := app.Command("link-package", "Link the system installation of Teleport from the Teleport package, if managed updates is disabled.")
 	unlinkCmd := app.Command("unlink-package", "Unlink the system installation of Teleport from the Teleport package.")
 
+	// setupCmd is invoked by other versions of the updater, so this contract must be stable.
+	// New flags may be added, but they may only be passed via env vars when setup is invoked via the updater.
 	setupCmd := app.Command("setup", "Write configuration files that run the update subcommand on a timer and verify the Teleport installation.").
 		Hidden()
 	setupCmd.Flag("reload", "Reload the Teleport agent. If not set, Teleport is not reloaded or restarted.").
 		BoolVar(&ccfg.Reload)
 	setupCmd.Flag("path", "Directory that the active Teleport installation's binaries are linked into.").
 		Required().StringVar(&ccfg.Path)
+	setupCmd.Flag("version", "Use the provided version to generate configuration files.").
+		Envar(autoupdate.SetupVersionEnvVar).StringVar(&ccfg.ForceVersion)
+	setupCmd.Flag("flag", "Use the provided flags to generate configuration files.").
+		Envar(autoupdate.SetupFlagsEnvVar).StringsVar(&ccfg.ForceFlags)
+	setupCmd.Flag("selinux-ssh", "Install the SELinux module for Teleport SSH.").
+		Hidden().Envar(autoupdate.SetupSELinuxSSHEnvVar).BoolVar(&ccfg.SELinuxSSH)
+	setupCmd.Flag("tbot", "Setup a systemd service for tbot.").
+		Envar(autoupdate.SetupTbotEnvVar).BoolVar(&ccfg.SetupTbot)
 
 	statusCmd := app.Command("status", "Show Teleport agent auto-update status.")
+	statusCmd.Flag("err-if-should-update-now",
+		fmt.Sprintf("Exits with code %d if the agent should update now. Exit code 0 means that the agent should not update now, even if it might not run the target version.", notUpToDateExitCode),
+	).BoolVar(&ccfg.StatusWithExitCode)
 
 	uninstallCmd := app.Command("uninstall", "Uninstall the updater-managed installation of Teleport. If the Teleport package is installed, it is restored as the primary installation.")
 	uninstallCmd.Flag("force", "Force complete uninstallation of Teleport, even if there is no packaged version of Teleport to revert to.").
@@ -202,6 +232,8 @@ func Run(args []string) int {
 		autoupdate.SetRequiredUmask(ctx, plog)
 	}
 
+	var successExitCode int
+
 	switch command {
 	case enableCmd.FullCommand():
 		ccfg.Enabled = true
@@ -226,7 +258,7 @@ func Run(args []string) int {
 	case versionCmd.FullCommand():
 		modules.GetModules().PrintVersion()
 	case statusCmd.FullCommand():
-		err = cmdStatus(ctx, &ccfg)
+		successExitCode, err = cmdStatus(ctx, &ccfg)
 		if errors.Is(err, autoupdate.ErrNotInstalled) {
 			plog.ErrorContext(ctx, "Teleport is not installed by teleport-update with this suffix.")
 			return 1
@@ -239,7 +271,7 @@ func Run(args []string) int {
 		plog.ErrorContext(ctx, "Command failed.", "error", err)
 		return 1
 	}
-	return 0
+	return successExitCode
 }
 
 func setupLogger(debug bool, format string) error {
@@ -458,25 +490,44 @@ func cmdSetup(ctx context.Context, ccfg *cliConfig) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = updater.Setup(ctx, ccfg.Path, ccfg.Reload)
+	flags := common.NewInstallFlagsFromStrings(ccfg.ForceFlags)
+	rev := autoupdate.NewRevision(ccfg.ForceVersion, flags)
+	err = updater.Setup(ctx, ccfg.Path, rev, autoupdate.SetupFeatures{
+		SELinuxSSH: ccfg.SELinuxSSH,
+		Tbot:       ccfg.SetupTbot,
+	}, ccfg.Reload)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
 
-// cmdStatus displays auto-update status.
-func cmdStatus(ctx context.Context, ccfg *cliConfig) error {
+// cmdStatus displays auto-update status. The command also returns the desired
+// error code (only valid if the error is nil).
+func cmdStatus(ctx context.Context, ccfg *cliConfig) (int, error) {
 	updater, err := statusConfig(ctx, ccfg)
 	if err != nil {
-		return trace.Wrap(err, "failed to initialize updater")
+		return 0, trace.Wrap(err, "failed to initialize updater")
 	}
 	status, err := updater.Status(ctx)
 	if err != nil {
-		return trace.Wrap(err, "failed to get status")
+		return 0, trace.Wrap(err, "failed to get status")
 	}
 	enc := yaml.NewEncoder(os.Stdout)
-	return trace.Wrap(enc.Encode(status))
+	if err := enc.Encode(status); err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	return statusExitCode(ccfg, status), nil
+}
+
+// statusExitCode returns the desired exit code for the status command.
+func statusExitCode(ccfg *cliConfig, status autoupdate.Status) int {
+	// Implement --is-up-to-date
+	if ccfg.StatusWithExitCode && status.InWindow && status.Active.String() != status.Target.String() {
+		return notUpToDateExitCode
+	}
+	return 0
 }
 
 // cmdUninstall removes the updater-managed install of Teleport and gracefully reverts back to the Teleport package.
diff --git a/tool/teleport-update/main_test.go b/tool/teleport-update/main_test.go
index d80dcbdc043a5..444d0373aef5a 100644
--- a/tool/teleport-update/main_test.go
+++ b/tool/teleport-update/main_test.go
@@ -24,6 +24,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	autoupdatelib "github.com/gravitational/teleport/lib/autoupdate"
+	autoupdate "github.com/gravitational/teleport/lib/autoupdate/agent"
 )
 
 const initTestSentinel = "init_test"
@@ -46,3 +49,111 @@ func BenchmarkInit(b *testing.B) {
 		assert.NoError(b, err)
 	}
 }
+
+func TestStatusExitCode(t *testing.T) {
+	lowVersion := "1.2.3"
+	highVersion := "1.2.4"
+	tests := []struct {
+		name             string
+		ccfg             *cliConfig
+		status           autoupdate.Status
+		expectedExitCode int
+	}{
+		{
+			name: "no --is-up-to-date passed, should update",
+			ccfg: &cliConfig{StatusWithExitCode: false},
+			status: autoupdate.Status{
+				UpdateStatus: autoupdate.UpdateStatus{
+					Active: autoupdate.Revision{
+						Version: lowVersion,
+					},
+				},
+				FindResp: autoupdate.FindResp{
+					Target: autoupdate.Revision{
+						Version: highVersion,
+					},
+					InWindow: true,
+				},
+			},
+			expectedExitCode: 0,
+		},
+		{
+			name: "--is-up-to-date passed, different version in maintenance",
+			ccfg: &cliConfig{StatusWithExitCode: true},
+			status: autoupdate.Status{
+				UpdateStatus: autoupdate.UpdateStatus{
+					Active: autoupdate.Revision{
+						Version: lowVersion,
+					},
+				},
+				FindResp: autoupdate.FindResp{
+					Target: autoupdate.Revision{
+						Version: highVersion,
+					},
+					InWindow: true,
+				},
+			},
+			expectedExitCode: notUpToDateExitCode,
+		},
+		{
+			name: "--is-up-to-date passed, different version out of maintenance",
+			ccfg: &cliConfig{StatusWithExitCode: true},
+			status: autoupdate.Status{
+				UpdateStatus: autoupdate.UpdateStatus{
+					Active: autoupdate.Revision{
+						Version: lowVersion,
+					},
+				},
+				FindResp: autoupdate.FindResp{
+					Target: autoupdate.Revision{
+						Version: highVersion,
+					},
+					InWindow: false,
+				},
+			},
+			expectedExitCode: 0,
+		},
+		{
+			name: "--is-up-to-date passed, same version in maintenance",
+			ccfg: &cliConfig{StatusWithExitCode: true},
+			status: autoupdate.Status{
+				UpdateStatus: autoupdate.UpdateStatus{
+					Active: autoupdate.Revision{
+						Version: highVersion,
+					},
+				},
+				FindResp: autoupdate.FindResp{
+					Target: autoupdate.Revision{
+						Version: highVersion,
+					},
+					InWindow: true,
+				},
+			},
+			expectedExitCode: 0,
+		},
+		{
+			name: "--is-up-to-date passed, same version in maintenance, edition mismatch",
+			ccfg: &cliConfig{StatusWithExitCode: true},
+			status: autoupdate.Status{
+				UpdateStatus: autoupdate.UpdateStatus{
+					Active: autoupdate.Revision{
+						Version: highVersion,
+					},
+				},
+				FindResp: autoupdate.FindResp{
+					Target: autoupdate.Revision{
+						Version: highVersion,
+						Flags:   autoupdatelib.FlagEnterprise,
+					},
+					InWindow: true,
+				},
+			},
+			expectedExitCode: notUpToDateExitCode,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expectedExitCode, statusExitCode(tt.ccfg, tt.status))
+		})
+	}
+}
diff --git a/tool/teleport/common/backend.go b/tool/teleport/common/backend.go
index c859af4cc088c..e993715272226 100644
--- a/tool/teleport/common/backend.go
+++ b/tool/teleport/common/backend.go
@@ -17,16 +17,42 @@
 package common
 
 import (
+	"cmp"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"iter"
+	"log/slog"
 	"os"
+	"os/exec"
+	"strings"
+	"time"
 
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
+	kyaml "k8s.io/apimachinery/pkg/util/yaml"
 
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/utils/prompt"
+	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
-func onClone(ctx context.Context, configPath string) error {
+func onBackendClone(ctx context.Context, configPath string) error {
+	// The config flag is global on the backend command, and not required,
+	// so that the default teleport config file can be used by other commands.
+	// However, since clone uses its own unique config file and not the teleport
+	// config file it needs to be explicitly provided.
+	if configPath == "" {
+		return trace.BadParameter("required flag --config/-c not provided")
+	}
+
 	data, err := os.ReadFile(configPath)
 	if err != nil {
 		return trace.Wrap(err)
@@ -53,3 +79,266 @@ func onClone(ctx context.Context, configPath string) error {
 	}
 	return nil
 }
+
+func onBackendGet(ctx context.Context, config backend.Config, key, format string) error {
+	bk, err := backend.New(ctx, config.Type, config.Params)
+	if err != nil {
+		return trace.Wrap(err, "creating backend")
+	}
+
+	item, err := bk.Get(ctx, backend.KeyFromString(key))
+	if err != nil {
+		return trace.Wrap(err, "getting item")
+	}
+
+	return trace.Wrap(printBackendItems(format, stream.Once(*item)))
+}
+
+func onBackendList(ctx context.Context, config backend.Config, prefix, format string) error {
+	bk, err := backend.New(ctx, config.Type, config.Params)
+	if err != nil {
+		return trace.Wrap(err, "creating backend")
+	}
+
+	var startKey, endKey backend.Key
+	if prefix != "" {
+		startKey = backend.KeyFromString(prefix)
+		endKey = backend.RangeEnd(startKey.ExactKey())
+	} else {
+		startKey = backend.NewKey("")
+		endKey = backend.RangeEnd(startKey)
+	}
+
+	items := bk.Items(ctx, backend.ItemsParams{StartKey: startKey, EndKey: endKey})
+
+	return trace.Wrap(printBackendItems(format, items))
+}
+
+func printBackendItems(format string, items iter.Seq2[backend.Item, error]) error {
+	// displayItem exists to better represent a
+	// [backend.Item] to users. The Key is converted to
+	// it's textual representation, and the Value is
+	// converted to a string so that it is not base64 encoded
+	// during marshaling.
+	type displayItem struct {
+		Key      string
+		Value    string
+		Revision string
+		Expires  time.Time
+	}
+
+	backendItems := stream.FilterMap(items, func(i backend.Item) (displayItem, bool) {
+		return displayItem{
+			Key:      i.Key.String(),
+			Expires:  i.Expires,
+			Revision: i.Revision,
+			Value:    string(i.Value),
+		}, true
+	})
+
+	switch strings.ToLower(format) {
+	case teleport.Text, "":
+		table := asciitable.MakeTable([]string{"Key", "Expires", "Revision"})
+		for row, err := range stream.FilterMap(backendItems, func(i displayItem) ([]string, bool) {
+			expiry := "Never"
+			if !i.Expires.IsZero() {
+				expiry = i.Expires.Format(time.RFC3339)
+			}
+			return []string{i.Key, expiry, i.Revision}, true
+		}) {
+			if err != nil {
+				return trace.Wrap(err, "retrieving items")
+			}
+
+			table.AddRow(row)
+		}
+
+		if err := table.WriteTo(os.Stdout); err != nil {
+			return trace.Wrap(err)
+		}
+	case teleport.JSON:
+		allItems, err := stream.Collect(backendItems)
+		if err != nil {
+			return trace.Wrap(err, "collecting items")
+		}
+
+		out, err := utils.FastMarshalIndent(allItems, "", "  ")
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if _, err := fmt.Fprintln(os.Stdout, string(out)); err != nil {
+			return trace.Wrap(err)
+		}
+	case teleport.YAML:
+		allItems, err := stream.Collect(backendItems)
+		if err != nil {
+			return trace.Wrap(err, "collecting items")
+		}
+
+		out, err := yaml.Marshal(allItems)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if _, err := fmt.Fprintln(os.Stdout, string(out)); err != nil {
+			return trace.Wrap(err)
+		}
+	default:
+		return trace.BadParameter("unsupported format %q", format)
+	}
+
+	return nil
+}
+
+func onBackendDelete(ctx context.Context, config backend.Config, key string) error {
+	// logs are discarded to prevent any logging output
+	// from stomping on the prompt.
+	slog.SetDefault(slog.New(slog.DiscardHandler))
+
+	bk, err := backend.New(ctx, config.Type, config.Params)
+	if err != nil {
+		return trace.Wrap(err, "creating backend")
+	}
+
+	ok, err := prompt.Confirmation(ctx, os.Stdout, prompt.Stdin(), fmt.Sprintf("Are you sure you want to delete %s", key))
+	if err != nil {
+		return trace.Wrap(err)
+	} else if !ok {
+		return trace.Errorf("Operation canceled by user request.")
+	}
+
+	if err := bk.Delete(ctx, backend.KeyFromString(key)); err != nil {
+		return trace.Wrap(err, "deleting item")
+	}
+
+	fmt.Printf("item %q has been deleted\n", key)
+	return nil
+}
+
+func checksum(filename string) (string, error) {
+	f, err := utils.OpenFileAllowingUnsafeLinks(filename)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func onBackendEdit(ctx context.Context, config backend.Config, key string) error {
+	// logs are discarded to prevent any logging output
+	// from being written over the editor.
+	slog.SetDefault(slog.New(slog.DiscardHandler))
+
+	bk, err := backend.New(ctx, config.Type, config.Params)
+	if err != nil {
+		return trace.Wrap(err, "creating backend")
+	}
+
+	item, err := bk.Get(ctx, backend.KeyFromString(key))
+	if err != nil {
+		return trace.Wrap(err, "getting item")
+	}
+
+	f, err := os.CreateTemp("", "teleport-item*.yaml")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer func() {
+		if err := os.Remove(f.Name()); err != nil {
+			fmt.Fprintf(os.Stderr, "ERROR: could not remove temporary file %v\n", f.Name())
+		}
+	}()
+
+	// displayItem exists to better represent a
+	// [backend.Item] to users when editing. The
+	// Key is omitted as that isn't allowed to be modified,
+	// and the Value is converted to a string so that it
+	// is not base64 encoded during marshaling.
+	type displayItem struct {
+		Revision string
+		Expires  time.Time
+		Value    string
+	}
+	if err := utils.WriteYAML(f, displayItem{
+		Revision: item.Revision,
+		Expires:  item.Expires,
+		Value:    string(item.Value),
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := f.Close(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	originalSum, err := checksum(f.Name())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	editor := cmp.Or(os.Getenv("TELEPORT_EDITOR"), os.Getenv("VISUAL"), os.Getenv("EDITOR"), "vi")
+	args := strings.Fields(editor)
+	editorCmd := exec.CommandContext(ctx, args[0], append(args[1:], f.Name())...)
+	editorCmd.Stdin = os.Stdin
+	editorCmd.Stdout = os.Stdout
+	editorCmd.Stderr = os.Stderr
+
+	if err := editorCmd.Start(); err != nil {
+		return trace.BadParameter("could not start editor %v: %v", editor, err)
+	}
+
+	if err := editorCmd.Wait(); err != nil {
+		return trace.BadParameter("skipping resource update, editor did not complete successfully: %v", err)
+	}
+
+	newSum, err := checksum(f.Name())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// nothing to do if the resource was not modified
+	if newSum == originalSum {
+		fmt.Println("edit canceled, no changes made")
+		return nil
+	}
+
+	editedFile, err := utils.OpenFileAllowingUnsafeLinks(f.Name())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer editedFile.Close()
+
+	decoder := kyaml.NewYAMLOrJSONDecoder(editedFile, defaults.LookaheadBufSize)
+
+	var editedItem displayItem
+	if err := decoder.Decode(&editedItem); err != nil {
+		if errors.Is(err, io.EOF) {
+			return trace.BadParameter("no item found, empty input?")
+		}
+		return trace.Wrap(err)
+	}
+
+	// The Key is not presented to the users and is
+	// not allowed to be modified. All other values
+	// can be adjusted, though due to the use of
+	// ConditionalUpdate below tweaking the revision
+	// will prevent updates unless it's being changed
+	// to the correct value.
+	item.Revision = editedItem.Revision
+	item.Expires = editedItem.Expires
+	item.Value = []byte(editedItem.Value)
+
+	if _, err := bk.ConditionalUpdate(ctx, *item); err != nil {
+		return trace.Wrap(err, "updating item in backend")
+	}
+
+	return nil
+}
diff --git a/tool/teleport/common/configurator.go b/tool/teleport/common/configurator.go
index 2dda4bb8547ec..6d3f58f9976cd 100644
--- a/tool/teleport/common/configurator.go
+++ b/tool/teleport/common/configurator.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/config/systemd"
 	"github.com/gravitational/teleport/lib/configurators"
 	awsconfigurators "github.com/gravitational/teleport/lib/configurators/aws"
 	"github.com/gravitational/teleport/lib/configurators/configuratorbuilder"
@@ -44,6 +45,7 @@ var awsDatabaseTypes = []string{
 	types.DatabaseTypeRedshift,
 	types.DatabaseTypeRedshiftServerless,
 	types.DatabaseTypeElastiCache,
+	types.DatabaseTypeElastiCacheServerless,
 	types.DatabaseTypeMemoryDB,
 	types.DatabaseTypeAWSKeyspaces,
 	types.DatabaseTypeDynamoDB,
@@ -52,7 +54,7 @@ var awsDatabaseTypes = []string{
 }
 
 type installSystemdFlags struct {
-	config.SystemdFlags
+	systemd.Flags
 	// output is the destination to write the systemd unit file to.
 	output string
 }
@@ -76,7 +78,7 @@ func onDumpSystemdUnitFile(flags installSystemdFlags) error {
 	}
 
 	buf := new(bytes.Buffer)
-	err := config.WriteSystemdUnitFile(flags.SystemdFlags, buf)
+	err := systemd.WriteUnitFile(flags.Flags, buf)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -137,11 +139,10 @@ func makeDatabaseServiceBootstrapFlagsWithDiscoveryServiceConfig(flags configure
 
 // onConfigureDiscoveryBootstrap subcommand that bootstraps configuration for
 // discovery  agents.
-func onConfigureDiscoveryBootstrap(flags configureDiscoveryBootstrapFlags) error {
+func onConfigureDiscoveryBootstrap(ctx context.Context, flags configureDiscoveryBootstrapFlags) error {
 	fmt.Printf("Reading configuration at %q...\n", flags.config.ConfigPath)
 
-	ctx := context.TODO()
-	configurators, err := configuratorbuilder.BuildConfigurators(flags.config)
+	configurators, err := configuratorbuilder.BuildConfigurators(ctx, flags.config)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -151,7 +152,7 @@ func onConfigureDiscoveryBootstrap(flags configureDiscoveryBootstrapFlags) error
 	// service config.
 	if flags.config.Service.IsDiscovery() && flags.databaseServiceRole != "" {
 		config := makeDatabaseServiceBootstrapFlagsWithDiscoveryServiceConfig(flags)
-		dbConfigurators, err := configuratorbuilder.BuildConfigurators(config)
+		dbConfigurators, err := configuratorbuilder.BuildConfigurators(ctx, config)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -244,7 +245,7 @@ type configureDatabaseAWSPrintFlags struct {
 
 // buildAWSConfigurator builds the database configurator used on AWS-specific
 // commands.
-func buildAWSConfigurator(manual bool, flags configureDatabaseAWSFlags) (configurators.Configurator, error) {
+func buildAWSConfigurator(ctx context.Context, manual bool, flags configureDatabaseAWSFlags) (configurators.Configurator, error) {
 	err := flags.CheckAndSetDefaults()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -270,6 +271,8 @@ func buildAWSConfigurator(manual bool, flags configureDatabaseAWSFlags) (configu
 			configuratorFlags.ForceRedshiftServerlessPermissions = true
 		case types.DatabaseTypeElastiCache:
 			configuratorFlags.ForceElastiCachePermissions = true
+		case types.DatabaseTypeElastiCacheServerless:
+			configuratorFlags.ForceElastiCacheServerlessPermissions = true
 		case types.DatabaseTypeMemoryDB:
 			configuratorFlags.ForceMemoryDBPermissions = true
 		case types.DatabaseTypeAWSKeyspaces:
@@ -283,7 +286,7 @@ func buildAWSConfigurator(manual bool, flags configureDatabaseAWSFlags) (configu
 		}
 	}
 
-	configurator, err := awsconfigurators.NewAWSConfigurator(awsconfigurators.ConfiguratorConfig{
+	configurator, err := awsconfigurators.NewAWSConfigurator(ctx, awsconfigurators.ConfiguratorConfig{
 		Flags:         configuratorFlags,
 		ServiceConfig: &servicecfg.Config{},
 	})
@@ -296,8 +299,8 @@ func buildAWSConfigurator(manual bool, flags configureDatabaseAWSFlags) (configu
 
 // onConfigureDatabasesAWSPrint is a subcommand used to print AWS IAM access
 // Teleport requires to run databases discovery on AWS.
-func onConfigureDatabasesAWSPrint(flags configureDatabaseAWSPrintFlags) error {
-	configurator, err := buildAWSConfigurator(true, flags.configureDatabaseAWSFlags)
+func onConfigureDatabasesAWSPrint(ctx context.Context, flags configureDatabaseAWSPrintFlags) error {
+	configurator, err := buildAWSConfigurator(ctx, true, flags.configureDatabaseAWSFlags)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -334,9 +337,8 @@ type configureDatabaseAWSCreateFlags struct {
 
 // onConfigureDatabasesAWSCreates is a subcommand used to create AWS IAM access
 // for Teleport to run databases discovery on AWS.
-func onConfigureDatabasesAWSCreate(flags configureDatabaseAWSCreateFlags) error {
-	ctx := context.TODO()
-	configurator, err := buildAWSConfigurator(false, flags.configureDatabaseAWSFlags)
+func onConfigureDatabasesAWSCreate(ctx context.Context, flags configureDatabaseAWSCreateFlags) error {
+	configurator, err := buildAWSConfigurator(ctx, false, flags.configureDatabaseAWSFlags)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/teleport/common/debug.go b/tool/teleport/common/debug.go
index c993b78742f6a..bcb907098db1b 100644
--- a/tool/teleport/common/debug.go
+++ b/tool/teleport/common/debug.go
@@ -24,14 +24,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"path/filepath"
+	"os"
 	"slices"
 	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport"
 	debugclient "github.com/gravitational/teleport/lib/client/debug"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -46,18 +45,23 @@ type DebugClient interface {
 	GetLogLevel(context.Context) (string, error)
 	// CollectProfile collects a pprof profile.
 	CollectProfile(context.Context, string, int) ([]byte, error)
+	// GetReadiness checks if the instance is ready to serve requests.
+	GetReadiness(context.Context) (debugclient.Readiness, error)
+	// GetRawMetrics fetches the unprocessed Prometheus metrics.
+	GetRawMetrics(context.Context) (io.ReadCloser, error)
+	SocketPath() string
 }
 
 func onSetLogLevel(configPath string, level string) error {
 	ctx := context.Background()
-	clt, dataDir, socketPath, err := newDebugClient(configPath)
+	clt, dataDir, err := newDebugClient(configPath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	setMessage, err := setLogLevel(ctx, clt, level)
 	if err != nil {
-		return convertToReadableErr(err, dataDir, socketPath)
+		return convertToReadableErr(err, dataDir, clt.SocketPath())
 	}
 
 	fmt.Println(setMessage)
@@ -74,14 +78,14 @@ func setLogLevel(ctx context.Context, clt DebugClient, level string) (string, er
 
 func onGetLogLevel(configPath string) error {
 	ctx := context.Background()
-	clt, dataDir, socketPath, err := newDebugClient(configPath)
+	clt, dataDir, err := newDebugClient(configPath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	currentLogLevel, err := getLogLevel(ctx, clt)
 	if err != nil {
-		return convertToReadableErr(err, dataDir, socketPath)
+		return convertToReadableErr(err, dataDir, clt.SocketPath())
 	}
 
 	fmt.Printf("Current log level %q\n", currentLogLevel)
@@ -111,14 +115,14 @@ func onCollectProfiles(configPath string, rawProfiles string, seconds int) error
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	defer cancelFunc()
 
-	clt, dataDir, socketPath, err := newDebugClient(configPath)
+	clt, dataDir, err := newDebugClient(configPath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	var output bytes.Buffer
 	if err := collectProfiles(ctx, clt, &output, rawProfiles, seconds); err != nil {
-		return convertToReadableErr(err, dataDir, socketPath)
+		return convertToReadableErr(err, dataDir, clt.SocketPath())
 	}
 
 	fmt.Print(output.String())
@@ -167,12 +171,60 @@ func collectProfiles(ctx context.Context, clt DebugClient, buf io.Writer, rawPro
 	return trace.NewAggregate(tw.Close(), gw.Close())
 }
 
+// onReadyz checks if the instance is ready to serve requests.
+func onReadyz(ctx context.Context, configPath string) error {
+	clt, dataDir, err := newDebugClient(configPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := readyz(ctx, clt); err != nil {
+		return convertToReadableErr(err, dataDir, clt.SocketPath())
+	}
+
+	return nil
+}
+
+func readyz(ctx context.Context, clt DebugClient) error {
+	readiness, err := clt.GetReadiness(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if !readiness.Ready {
+		return trace.Errorf("not ready (PID:%d): %s", readiness.PID, readiness.Status)
+	}
+
+	fmt.Printf("ready (PID:%d)\n", readiness.PID)
+	return nil
+}
+
+// onMetrics fetches the current Prometheus metrics.
+func onMetrics(ctx context.Context, configPath string) error {
+	clt, dataDir, err := newDebugClient(configPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	metrics, err := clt.GetRawMetrics(ctx)
+	if err != nil {
+		return convertToReadableErr(err, dataDir, clt.SocketPath())
+	}
+	defer metrics.Close()
+
+	if _, err := io.Copy(os.Stdout, metrics); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
 // newDebugClient initializes the debug client based on the Teleport
 // configuration. It also returns the data dir and socket path used.
-func newDebugClient(configPath string) (DebugClient, string, string, error) {
+func newDebugClient(configPath string) (DebugClient, string, error) {
 	cfg, err := config.ReadConfigFile(configPath)
 	if err != nil {
-		return nil, "", "", trace.Wrap(err)
+		return nil, "", trace.Wrap(err)
 	}
 
 	// ReadConfigFile returns nil configuration if the file doesn't exists.
@@ -183,8 +235,7 @@ func newDebugClient(configPath string) (DebugClient, string, string, error) {
 		dataDir = cfg.DataDir
 	}
 
-	socketPath := filepath.Join(dataDir, teleport.DebugServiceSocketName)
-	return debugclient.NewClient(socketPath), dataDir, socketPath, nil
+	return debugclient.NewClient(dataDir), dataDir, nil
 }
 
 // convertToReadableErr converts debug service client error into a more friendly
diff --git a/tool/teleport/common/install.go b/tool/teleport/common/install.go
index bfe71c50c6f10..3e4798f48623c 100644
--- a/tool/teleport/common/install.go
+++ b/tool/teleport/common/install.go
@@ -19,10 +19,12 @@ package common
 import (
 	"context"
 	"log/slog"
+	"os"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/autoupdate"
 	"github.com/gravitational/teleport/lib/srv/server/installer"
 	libutils "github.com/gravitational/teleport/lib/utils"
 )
@@ -73,6 +75,7 @@ func onInstallAutoDiscoverNode(cfg installAutoDiscoverNodeFlags) error {
 		AutoUpgrades:      autoUpgrades,
 		AzureClientID:     cfg.AzureClientID,
 		TokenName:         cfg.TokenName,
+		InstallationManagedByTeleportUpdateWithSuffix: os.Getenv(autoupdate.InstallSuffixEnvVar),
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/tool/teleport/common/integration_configure.go b/tool/teleport/common/integration_configure.go
index dcc925ce3df5a..6e2a3d50f229f 100644
--- a/tool/teleport/common/integration_configure.go
+++ b/tool/teleport/common/integration_configure.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
+	"github.com/gravitational/teleport/lib/integrations/awsra"
 	"github.com/gravitational/teleport/lib/integrations/azureoidc"
 	"github.com/gravitational/teleport/lib/integrations/externalauditstorage"
 	"github.com/gravitational/teleport/lib/integrations/externalauditstorage/easconfig"
@@ -216,9 +217,13 @@ func onIntegrationConfAccessGraphAWSSync(ctx context.Context, params config.Inte
 	}
 
 	confReq := awsoidc.AccessGraphAWSIAMConfigureRequest{
-		IntegrationRole: params.Role,
-		AccountID:       params.AccountID,
-		AutoConfirm:     params.AutoConfirm,
+		IntegrationRole:     params.Role,
+		AccountID:           params.AccountID,
+		AutoConfirm:         params.AutoConfirm,
+		SQSQueueURL:         params.SQSQueueURL,
+		CloudTrailBucketARN: params.CloudTrailBucketARN,
+		KMSKeyARNs:          params.KMSKeyARNs,
+		EnableEKSAuditLogs:  params.EnableEKSAuditLogs,
 	}
 	return trace.Wrap(awsoidc.ConfigureAccessGraphSyncIAM(ctx, clt, confReq))
 }
@@ -284,3 +289,27 @@ func onIntegrationConfSAMLIdPGCPWorkforce(ctx context.Context, params samlidpcon
 
 	return trace.Wrap(gcpWorkforceService.CreateWorkforcePoolAndProvider(ctx))
 }
+
+func onIntegrationConfAWSRATrustAnchor(ctx context.Context, clf config.CommandLineFlags) error {
+	// pass the value of --insecure flag to the runtime
+	lib.SetInsecureDevMode(clf.InsecureMode)
+
+	// Ensure we print output to the user. LogLevel at this point was set to Error.
+	utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo)
+
+	rolesAnywhereConfigClient, err := awsra.NewRolesAnywhereIAMConfigurationClient(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	confReq := awsra.TrustAnchorConfigureRequest{
+		Cluster:               clf.IntegrationConfAWSRATrustAnchorArguments.Cluster,
+		IntegrationName:       clf.IntegrationConfAWSRATrustAnchorArguments.Name,
+		TrustAnchorName:       clf.IntegrationConfAWSRATrustAnchorArguments.TrustAnchor,
+		TrustAnchorCertBase64: clf.IntegrationConfAWSRATrustAnchorArguments.TrustAnchorCertBase64,
+		SyncProfileName:       clf.IntegrationConfAWSRATrustAnchorArguments.SyncProfile,
+		SyncRoleName:          clf.IntegrationConfAWSRATrustAnchorArguments.SyncRole,
+		AutoConfirm:           clf.IntegrationConfAWSRATrustAnchorArguments.AutoConfirm,
+	}
+	return trace.Wrap(awsra.ConfigureRolesAnywhereIAM(ctx, rolesAnywhereConfigClient, confReq))
+}
diff --git a/tool/teleport/common/sftp.go b/tool/teleport/common/sftp.go
index 34f4d1f9ef4b8..e7d1a9ea931ce 100644
--- a/tool/teleport/common/sftp.go
+++ b/tool/teleport/common/sftp.go
@@ -24,7 +24,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"log/slog"
 	"os"
@@ -34,7 +33,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gogo/protobuf/jsonpb"
+	"github.com/gogo/protobuf/jsonpb" //nolint:depguard // needed for backwards compatibility
 	"github.com/gravitational/trace"
 	"github.com/pkg/sftp"
 	"golang.org/x/sys/unix"
@@ -89,7 +88,22 @@ func newSFTPHandler(logger *slog.Logger, req *srv.FileTransferRequest, events ch
 		}
 		// TODO(capnspacehook): reject relative paths and symlinks
 		// make filepaths consistent by ensuring all separators use backslashes
-		allowed.path = path.Clean(req.Location)
+		allowedPath, err := sftputils.ExpandHomeDir(req.Location)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if !path.IsAbs(allowedPath) {
+			currentUser, err := user.Current()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			if currentUser.HomeDir != "" {
+				allowedPath = path.Join(currentUser.HomeDir, allowedPath)
+			} else {
+				allowedPath = path.Join(string(os.PathSeparator), allowedPath)
+			}
+		}
+		allowed.path = path.Clean(allowedPath)
 	}
 
 	return &sftpHandler{
@@ -99,10 +113,6 @@ func newSFTPHandler(logger *slog.Logger, req *srv.FileTransferRequest, events ch
 	}, nil
 }
 
-func newDisallowedErr(req *sftp.Request) error {
-	return fmt.Errorf("method %s is not allowed on %s", strings.ToLower(req.Method), req.Filepath)
-}
-
 // ensureReqIsAllowed returns an error if the SFTP request isn't
 // allowed based on the approved file transfer request for this session.
 func (s *sftpHandler) ensureReqIsAllowed(req *sftp.Request) error {
@@ -111,8 +121,9 @@ func (s *sftpHandler) ensureReqIsAllowed(req *sftp.Request) error {
 		return nil
 	}
 
-	if s.allowed.path != path.Clean(req.Filepath) {
-		return newDisallowedErr(req)
+	cleaned := path.Clean(req.Filepath)
+	if s.allowed.path != cleaned {
+		return trace.Errorf("operations are only allowed on %s, not %s", s.allowed.path, cleaned)
 	}
 
 	switch req.Method {
@@ -121,15 +132,15 @@ func (s *sftpHandler) ensureReqIsAllowed(req *sftp.Request) error {
 	case sftputils.MethodGet:
 		// only allow reads for downloads
 		if s.allowed.write {
-			return newDisallowedErr(req)
+			return trace.Errorf("reading is not allowed for this request")
 		}
 	case sftputils.MethodPut, sftputils.MethodSetStat:
 		// only allow writes and chmods for uploads
 		if !s.allowed.write {
-			return newDisallowedErr(req)
+			return trace.Errorf("writing is not allowed for this request")
 		}
 	default:
-		return newDisallowedErr(req)
+		return trace.Errorf("method %s is not allowed on %s", strings.ToLower(req.Method), req.Filepath)
 	}
 
 	return nil
@@ -231,6 +242,12 @@ func (s *sftpHandler) Filelist(req *sftp.Request) (_ sftp.ListerAt, retErr error
 	return sftputils.HandleFilelist(req, nil /* local filesystem */)
 }
 
+// RealPath canonicalizes a path name, including resolving ".." and
+// following symlinks. Required to implement [sftp.RealPathFileLister].
+func (s *sftpHandler) RealPath(path string) (string, error) {
+	return sftputils.Realpath(path)
+}
+
 func (s *sftpHandler) sendSFTPEvent(req *sftp.Request, reqErr error) {
 	wd, err := os.Getwd()
 	if err != nil {
diff --git a/tool/teleport/common/teleport.go b/tool/teleport/common/teleport.go
index 8d4cf3ace4f84..c651d2812bf04 100644
--- a/tool/teleport/common/teleport.go
+++ b/tool/teleport/common/teleport.go
@@ -39,10 +39,12 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/gcp"
 	"github.com/gravitational/teleport/lib/auth"
 	debugclient "github.com/gravitational/teleport/lib/client/debug"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/config/systemd"
 	"github.com/gravitational/teleport/lib/configurators"
 	awsconfigurators "github.com/gravitational/teleport/lib/configurators/aws"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -166,7 +168,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	start.Flag("insecure",
 		"Insecure mode disables certificate validation").BoolVar(&ccf.InsecureMode)
 	start.Flag("fips",
-		"Start Teleport in FedRAMP/FIPS 140-2 mode.").
+		"Start Teleport in FedRAMP/FIPS 140 mode.").
 		Default("false").
 		BoolVar(&ccf.FIPS)
 	start.Flag("skip-version-check",
@@ -221,7 +223,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	appStartCmd.Flag("config", fmt.Sprintf("Path to a configuration file [%v].", defaults.ConfigFilePath)).Short('c').ExistingFileVar(&ccf.ConfigFile)
 	appStartCmd.Flag("config-string", "Base64 encoded configuration string.").Hidden().Envar(defaults.ConfigEnvar).StringVar(&ccf.ConfigString)
 	appStartCmd.Flag("labels", "Comma-separated list of labels for this node, for example env=dev,app=web.").StringVar(&ccf.Labels)
-	appStartCmd.Flag("fips", "Start Teleport in FedRAMP/FIPS 140-2 mode.").Default("false").BoolVar(&ccf.FIPS)
+	appStartCmd.Flag("fips", "Start Teleport in FedRAMP/FIPS 140 mode.").Default("false").BoolVar(&ccf.FIPS)
 	appStartCmd.Flag("name", "Name of the application to start.").StringVar(&ccf.AppName)
 	appStartCmd.Flag("uri", "Internal address of the application to proxy.").StringVar(&ccf.AppURI)
 	appStartCmd.Flag("cloud", fmt.Sprintf("Set to one of %v if application should proxy particular cloud API", []string{types.CloudAWS, types.CloudAzure, types.CloudGCP})).StringVar(&ccf.AppCloud)
@@ -230,6 +232,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	appStartCmd.Flag("insecure", "Insecure mode disables certificate validation").BoolVar(&ccf.InsecureMode)
 	appStartCmd.Flag("skip-version-check", "Skip version checking between server and client.").Default("false").BoolVar(&ccf.SkipVersionCheck)
 	appStartCmd.Flag("no-debug-service", "Disables debug service.").BoolVar(&ccf.DisableDebugService)
+	appStartCmd.Flag("mcp-demo-server", "Enables the Teleport demo MCP server that shows current user and session information.").BoolVar(&ccf.MCPDemoServer)
 	appStartCmd.Alias(appUsageExamples) // We're using "alias" section to display usage examples.
 
 	// "teleport db" command and its subcommands
@@ -243,7 +246,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbStartCmd.Flag("config", fmt.Sprintf("Path to a configuration file [%v].", defaults.ConfigFilePath)).Short('c').ExistingFileVar(&ccf.ConfigFile)
 	dbStartCmd.Flag("config-string", "Base64 encoded configuration string.").Hidden().Envar(defaults.ConfigEnvar).StringVar(&ccf.ConfigString)
 	dbStartCmd.Flag("labels", "Comma-separated list of labels for this node, for example env=dev,app=web.").StringVar(&ccf.Labels)
-	dbStartCmd.Flag("fips", "Start Teleport in FedRAMP/FIPS 140-2 mode.").Default("false").BoolVar(&ccf.FIPS)
+	dbStartCmd.Flag("fips", "Start Teleport in FedRAMP/FIPS 140 mode.").Default("false").BoolVar(&ccf.FIPS)
 	dbStartCmd.Flag("name", "Name of the proxied database.").StringVar(&ccf.DatabaseName)
 	dbStartCmd.Flag("description", "Description of the proxied database.").StringVar(&ccf.DatabaseDescription)
 	dbStartCmd.Flag("protocol", fmt.Sprintf("Proxied database protocol. Supported are: %v.", defaults.DatabaseProtocols)).StringVar(&ccf.DatabaseProtocol)
@@ -257,8 +260,14 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbStartCmd.Flag("aws-rds-instance-id", "(Only for RDS) RDS instance identifier.").StringVar(&ccf.DatabaseAWSRDSInstanceID)
 	dbStartCmd.Flag("aws-rds-cluster-id", "(Only for Aurora) Aurora cluster identifier.").StringVar(&ccf.DatabaseAWSRDSClusterID)
 	dbStartCmd.Flag("aws-session-tags", "(Only for DynamoDB) List of STS tags.").StringVar(&ccf.DatabaseAWSSessionTags)
-	dbStartCmd.Flag("gcp-project-id", "(Only for Cloud SQL) GCP Cloud SQL project identifier.").StringVar(&ccf.DatabaseGCPProjectID)
-	dbStartCmd.Flag("gcp-instance-id", "(Only for Cloud SQL) GCP Cloud SQL instance identifier.").StringVar(&ccf.DatabaseGCPInstanceID)
+	dbStartCmd.Flag("gcp-project-id", "(Only for Cloud SQL) Project identifier.").StringVar(&ccf.DatabaseGCPProjectID)
+	dbStartCmd.Flag("gcp-instance-id", "(Only for Cloud SQL) Instance identifier.").StringVar(&ccf.DatabaseGCPInstanceID)
+
+	var alloyDBEndpointTypes []string
+	for _, endpointType := range gcp.AlloyDBEndpointTypes {
+		alloyDBEndpointTypes = append(alloyDBEndpointTypes, string(endpointType))
+	}
+	dbStartCmd.Flag("gcp-alloydb-endpoint-type", fmt.Sprintf("(Only for AlloyDB) Endpoint type. One of: %v", alloyDBEndpointTypes)).EnumVar(&ccf.DatabaseGCPAlloyDBEndpointType, alloyDBEndpointTypes...)
 	dbStartCmd.Flag("ad-keytab-file", "(Only for SQL Server) Kerberos keytab file.").StringVar(&ccf.DatabaseADKeytabFile)
 	dbStartCmd.Flag("ad-krb5-file", "(Only for SQL Server) Kerberos krb5.conf file.").Default(defaults.Krb5FilePath).StringVar(&ccf.DatabaseADKrb5File)
 	dbStartCmd.Flag("ad-domain", "(Only for SQL Server) Active Directory domain.").StringVar(&ccf.DatabaseADDomain)
@@ -279,7 +288,8 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbConfigureCreate.Flag("rdsproxy-discovery", "List of AWS regions in which the agent will discover RDS Proxies.").StringsVar(&dbConfigCreateFlags.RDSProxyDiscoveryRegions)
 	dbConfigureCreate.Flag("redshift-discovery", "List of AWS regions in which the agent will discover Redshift instances.").StringsVar(&dbConfigCreateFlags.RedshiftDiscoveryRegions)
 	dbConfigureCreate.Flag("redshift-serverless-discovery", "List of AWS regions in which the agent will discover Redshift Serverless instances.").StringsVar(&dbConfigCreateFlags.RedshiftServerlessDiscoveryRegions)
-	dbConfigureCreate.Flag("elasticache-discovery", "List of AWS regions in which the agent will discover ElastiCache Redis clusters.").StringsVar(&dbConfigCreateFlags.ElastiCacheDiscoveryRegions)
+	dbConfigureCreate.Flag("elasticache-discovery", "List of AWS regions in which the agent will discover ElastiCache Valkey or Redis clusters.").StringsVar(&dbConfigCreateFlags.ElastiCacheDiscoveryRegions)
+	dbConfigureCreate.Flag("elasticache-serverless-discovery", "List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches.").StringsVar(&dbConfigCreateFlags.ElastiCacheServerlessDiscoveryRegions)
 	dbConfigureCreate.Flag("memorydb-discovery", "List of AWS regions in which the agent will discover MemoryDB clusters.").StringsVar(&dbConfigCreateFlags.MemoryDBDiscoveryRegions)
 	dbConfigureCreate.Flag("opensearch-discovery", "List of AWS regions in which the agent will discover OpenSearch domains.").StringsVar(&dbConfigCreateFlags.OpenSearchDiscoveryRegions)
 	dbConfigureCreate.Flag("aws-tags", "(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it").StringVar(&dbConfigCreateFlags.AWSRawTags)
@@ -303,6 +313,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbConfigureCreate.Flag("aws-rds-cluster-id", "(Only for RDS Aurora) RDS Aurora database cluster identifier.").StringVar(&dbConfigCreateFlags.DatabaseAWSRDSClusterID)
 	dbConfigureCreate.Flag("aws-rds-instance-id", "(Only for RDS) RDS database instance identifier.").StringVar(&dbConfigCreateFlags.DatabaseAWSRDSInstanceID)
 	dbConfigureCreate.Flag("aws-elasticache-group-id", "(Only for ElastiCache) ElastiCache replication group identifier.").StringVar(&dbConfigCreateFlags.DatabaseAWSElastiCacheGroupID)
+	dbConfigureCreate.Flag("aws-elasticache-serverless-cache-name", "(Only for ElastiCache Serverless) ElastiCache Serverless cache name.").StringVar(&dbConfigCreateFlags.DatabaseAWSElastiCacheServerlessCacheName)
 	dbConfigureCreate.Flag("aws-memorydb-cluster-name", "(Only for MemoryDB) MemoryDB cluster name.").StringVar(&dbConfigCreateFlags.DatabaseAWSMemoryDBClusterName)
 	dbConfigureCreate.Flag("ad-domain", "(Only for SQL Server) Active Directory domain.").StringVar(&dbConfigCreateFlags.DatabaseADDomain)
 	dbConfigureCreate.Flag("ad-spn", "(Only for SQL Server) Service Principal Name for Active Directory auth.").StringVar(&dbConfigCreateFlags.DatabaseADSPN)
@@ -372,13 +383,15 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	discoveryBootstrapCmd.Flag("manual", "When executed in \"manual\" mode, it will print the instructions to complete the configuration instead of applying them directly.").BoolVar(&configureDiscoveryBootstrapFlags.config.Manual)
 	discoveryBootstrapCmd.Flag("database-service-role", "Role name to attach database access policies to. If specified, bootstrap for the database service that accesses the databases discovered by this discovery service.").StringVar(&configureDiscoveryBootstrapFlags.databaseServiceRole)
 	discoveryBootstrapCmd.Flag("database-service-policy-name", "Name of the policy for bootstrapping database service when database-service-role is provided. ").Default(awsconfigurators.DatabaseAccessPolicyName).StringVar(&configureDiscoveryBootstrapFlags.databaseServicePolicyName)
+	discoveryBootstrapCmd.Flag("assume-role-arn", "Optional AWS IAM role to assume while bootstrapping.").StringVar(&configureDiscoveryBootstrapFlags.config.AssumeRoleARN)
+	discoveryBootstrapCmd.Flag("external-id", "Optional AWS external ID used when assuming an AWS role.").StringVar(&configureDiscoveryBootstrapFlags.config.ExternalID)
 
 	// "teleport install" command and its subcommands
 	installCmd := app.Command("install", "Teleport install commands.")
 	systemdInstall := installCmd.Command("systemd", "Creates a systemd unit file configuration.")
-	systemdInstall.Flag("env-file", "Full path to the environment file.").Default(config.SystemdDefaultEnvironmentFile).StringVar(&systemdInstallFlags.EnvironmentFile)
-	systemdInstall.Flag("pid-file", "Full path to the PID file.").Default(config.SystemdDefaultPIDFile).StringVar(&systemdInstallFlags.PIDFile)
-	systemdInstall.Flag("fd-limit", "Maximum number of open file descriptors.").Default(fmt.Sprintf("%v", config.SystemdDefaultFileDescriptorLimit)).IntVar(&systemdInstallFlags.FileDescriptorLimit)
+	systemdInstall.Flag("env-file", "Full path to the environment file.").Default(systemd.DefaultEnvironmentFile).StringVar(&systemdInstallFlags.EnvironmentFile)
+	systemdInstall.Flag("pid-file", "Full path to the PID file.").Default(systemd.DefaultPIDFile).StringVar(&systemdInstallFlags.PIDFile)
+	systemdInstall.Flag("fd-limit", "Maximum number of open file descriptors.").Default(fmt.Sprintf("%v", systemd.DefaultFileDescriptorLimit)).IntVar(&systemdInstallFlags.FileDescriptorLimit)
 	systemdInstall.Flag("teleport-path", "Full path to the Teleport binary.").StringVar(&systemdInstallFlags.TeleportInstallationFile)
 	systemdInstall.Flag("output", `Write to stdout with "--output=stdout" or custom path with --output=file:///path`).Short('o').Default(teleport.SchemeStdout).StringVar(&systemdInstallFlags.output)
 	systemdInstall.Alias(systemdInstallExamples) // We're using "alias" section to display usage examples.
@@ -432,6 +445,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dump.Flag("proxy", "Address of the proxy.").StringVar(&dumpFlags.ProxyAddress)
 	dump.Flag("app-name", "Name of the application to start when using app role.").StringVar(&dumpFlags.AppName)
 	dump.Flag("app-uri", "Internal address of the application to proxy.").StringVar(&dumpFlags.AppURI)
+	dump.Flag("mcp-demo-server", "Enables the Teleport demo MCP server that shows current user and session information.").BoolVar(&dumpFlags.MCPDemoServer)
 	dump.Flag("node-name", "Name for the Teleport node.").StringVar(&dumpFlags.NodeName)
 	dump.Flag("node-labels", "Comma-separated list of labels to add to newly created nodes, for example env=staging,cloud=aws.").StringVar(&dumpFlags.NodeLabels)
 
@@ -498,7 +512,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	integrationConfEC2SSMCmd := integrationConfigureCmd.Command("ec2-ssm-iam", "Adds required IAM permissions and SSM Document to enable EC2 Auto Discover using SSM.")
 	integrationConfEC2SSMCmd.Flag("role", "The AWS Role name used by the AWS OIDC Integration.").Required().StringVar(&ccf.IntegrationConfEC2SSMIAMArguments.RoleName)
 	integrationConfEC2SSMCmd.Flag("aws-region", "AWS Region.").Required().StringVar(&ccf.IntegrationConfEC2SSMIAMArguments.Region)
-	integrationConfEC2SSMCmd.Flag("ssm-document-name", "The AWS SSM Document name to create that will be used to install teleport.").Required().StringVar(&ccf.IntegrationConfEC2SSMIAMArguments.SSMDocumentName)
+	integrationConfEC2SSMCmd.Flag("ssm-document-name", "The AWS SSM Document name to create that will be used to install teleport.").StringVar(&ccf.IntegrationConfEC2SSMIAMArguments.SSMDocumentName)
 	integrationConfEC2SSMCmd.Flag("proxy-public-url", "Proxy Public URL (eg https://mytenant.teleport.sh).").StringVar(&ccf.
 		IntegrationConfEC2SSMIAMArguments.ProxyPublicURL)
 	integrationConfEC2SSMCmd.Flag("cluster", "Teleport Cluster's name.").Required().StringVar(&ccf.IntegrationConfEC2SSMIAMArguments.ClusterName)
@@ -522,6 +536,10 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	integrationConfAccessGraphAWSSyncCmd.Flag("role", "The AWS Role used by the AWS OIDC Integration.").Required().StringVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.Role)
 	integrationConfAccessGraphAWSSyncCmd.Flag("aws-account-id", "The AWS account ID.").StringVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.AccountID)
 	integrationConfAccessGraphAWSSyncCmd.Flag("confirm", "Apply changes without confirmation prompt.").BoolVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.AutoConfirm)
+	integrationConfAccessGraphAWSSyncCmd.Flag("sqs-queue-url", "SQS Queue URL used to receive notifications from CloudTrail.").StringVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.SQSQueueURL)
+	integrationConfAccessGraphAWSSyncCmd.Flag("cloud-trail-bucket", "ARN of the S3 bucket where CloudTrail writes events to.").StringVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.CloudTrailBucketARN)
+	integrationConfAccessGraphAWSSyncCmd.Flag("kms-key", "List of KMS Keys used to decrypt SQS and S3 bucket data.").StringsVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.KMSKeyARNs)
+	integrationConfAccessGraphAWSSyncCmd.Flag("eks-audit-logs", "Enable collection of EKS audit logs").BoolVar(&ccf.IntegrationConfAccessGraphAWSSyncArguments.EnableEKSAuditLogs)
 
 	integrationConfAccessGraphAzureSyncCmd := integrationConfAccessGraphCmd.Command("azure", "Adds required Azure permissions for syncing Azure resources into Access Graph service.")
 	integrationConfAccessGraphAzureSyncCmd.Flag("managed-identity", "The ID of the managed identity to run the Discovery service.").Required().StringVar(&ccf.IntegrationConfAccessGraphAzureSyncArguments.ManagedIdentity)
@@ -578,6 +596,15 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	integrationSAMLIdPGCPWorkforce.Flag("pool-provider-name", "Name for the new workforce identity pool provider.").Required().StringVar(&ccf.IntegrationConfSAMLIdPGCPWorkforceArguments.PoolProviderName)
 	integrationSAMLIdPGCPWorkforce.Flag("idp-metadata-url", "Teleport SAML IdP metadata endpoint.").Required().StringVar(&ccf.IntegrationConfSAMLIdPGCPWorkforceArguments.SAMLIdPMetadataURL)
 
+	integrationConfAWSRATrustAnchor := integrationConfigureCmd.Command("awsra-trust-anchor", "Configure AWS IAM Roles Anywhere Integration by creating resources in AWS.")
+	integrationConfAWSRATrustAnchor.Flag("cluster", "Teleport Cluster's name.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.Cluster)
+	integrationConfAWSRATrustAnchor.Flag("name", "Integration name.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.Name)
+	integrationConfAWSRATrustAnchor.Flag("trust-anchor", "AWS Roles Anywhere Trust Anchor name.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.TrustAnchor)
+	integrationConfAWSRATrustAnchor.Flag("trust-anchor-cert-b64", "AWS Roles Anywhere Trust Anchor's certificate, encoded in base64.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.TrustAnchorCertBase64)
+	integrationConfAWSRATrustAnchor.Flag("sync-profile", "The AWS IAM Roles Anywhere Profile name to create, which will be used to sync profiles as apps.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.SyncProfile)
+	integrationConfAWSRATrustAnchor.Flag("sync-role", "The AWS IAM Role name to create, which will be used to sync profiles as apps.").Required().StringVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.SyncRole)
+	integrationConfAWSRATrustAnchor.Flag("confirm", "Apply changes without confirmation prompt.").BoolVar(&ccf.IntegrationConfAWSRATrustAnchorArguments.AutoConfirm)
+
 	tpmCmd := app.Command("tpm", "Commands related to managing TPM joining functionality.")
 	tpmIdentifyCmd := tpmCmd.Command("identify", "Output identifying information related to the TPM detected on the system.")
 
@@ -590,23 +617,36 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	collectProfilesCmd.Alias(collectProfileUsageExamples) // We're using "alias" section to display usage examples.
 	collectProfilesCmd.Arg("PROFILES", fmt.Sprintf("Comma-separated profile names to be exported. Supported profiles: %s. Default: %s", strings.Join(slices.Collect(maps.Keys(debugclient.SupportedProfiles)), ","), strings.Join(defaultCollectProfiles, ","))).StringVar(&ccf.Profiles)
 	collectProfilesCmd.Flag("seconds", "For CPU and trace profiles, profile for the given duration (if set to 0, it returns a profile snapshot). For other profiles, return a delta profile. Default: 0").Short('s').Default("0").IntVar(&ccf.ProfileSeconds)
+	readyzCmd := debugCmd.Command("readyz", "Checks if the instance is ready to serve requests.")
+	metricsCmd := debugCmd.Command("metrics", "Fetches the cluster's Prometheus metrics.")
 
-	var moduleSourceCmd, fileContextsCmd, selinuxDirsCmd *kingpin.CmdClause
-	if runtime.GOOS == "linux" {
-		selinuxCmd := app.Command("selinux-ssh", "Commands related to SSH SELinux module.").Hidden()
-		selinuxCmd.Flag("config", fmt.Sprintf("Path to a configuration file [%v].", defaults.ConfigFilePath)).Short('c').ExistingFileVar(&ccf.ConfigFile)
-		moduleSourceCmd = selinuxCmd.Command("module-source", "Export SSH SELinux module source to stdout.").Hidden()
-		fileContextsCmd = selinuxCmd.Command("file-contexts", "Export SSH SELinux file contexts to stdout.").Hidden()
-		selinuxDirsCmd = selinuxCmd.Command("dirs", "Export directories that may need to be labeled for SSH SELinux module to work correctly.").Hidden()
-	}
+	selinuxCmd := app.Command("selinux-ssh", "Commands related to SSH SELinux module.").Hidden()
+	selinuxCmd.Flag("config", fmt.Sprintf("Path to a configuration file [%v].", defaults.ConfigFilePath)).Short('c').ExistingFileVar(&ccf.ConfigFile)
+	moduleSourceCmd := selinuxCmd.Command("module-source", "Export SSH SELinux module source to stdout.").Hidden()
+	fileContextsCmd := selinuxCmd.Command("file-contexts", "Export SSH SELinux file contexts to stdout.").Hidden()
+	selinuxDirsCmd := selinuxCmd.Command("dirs", "Export directories that may need to be labeled for SSH SELinux module to work correctly.").Hidden()
 
-	backendCmd := app.Command("backend", "Commands for managing backend data.")
-	backendCmd.Hidden()
-	backendCloneCmd := backendCmd.Command("clone", "Clones data from a source to a destination backend.")
-	backendCloneCmd.Flag("config", "Path to the clone config file.").
-		Required().
+	backendCmd := app.Command("backend", "Commands for managing cluster state backend data.").Hidden()
+	backendCmd.Flag("config", "Path to the config file.").
 		Short('c').
 		StringVar(&ccf.ConfigFile)
+	backendGetCmd := backendCmd.Command("get", "Retrieves a single item from the cluster state backend.")
+	backendGetCmd.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)).
+		Short('f').
+		Default(teleport.Text).
+		EnumVar(&ccf.Format, defaults.DefaultFormats...)
+	backendGetCmd.Arg("key", "The backend key to retrieve.").Required().StringVar(&ccf.BackendKey)
+	backendDeleteCmd := backendCmd.Command("rm", "Removes a single item from the cluster state backend.")
+	backendDeleteCmd.Arg("key", "The backend key to remove.").Required().StringVar(&ccf.BackendKey)
+	backendListCmd := backendCmd.Command("ls", "Lists the keys in the cluster state backend.")
+	backendListCmd.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)).
+		Short('f').
+		Default(teleport.Text).
+		EnumVar(&ccf.Format, defaults.DefaultFormats...)
+	backendListCmd.Arg("prefix", "An optional key prefix to limit listing to.").StringVar(&ccf.BackendPrefix)
+	backendEditCmd := backendCmd.Command("edit", "Modify a single item from the cluster state backend.")
+	backendEditCmd.Arg("key", "The backend key to retrieve.").Required().StringVar(&ccf.BackendKey)
+	backendCloneCmd := backendCmd.Command("clone", "Clones data from a source to a destination backend.")
 	backendCloneCmd.Alias(`
 Examples:
 
@@ -720,19 +760,19 @@ Examples:
 	case dbConfigureCreate.FullCommand():
 		err = onDumpDatabaseConfig(dbConfigCreateFlags)
 	case dbConfigureAWSPrintIAM.FullCommand():
-		err = onConfigureDatabasesAWSPrint(configureDatabaseAWSPrintFlags)
+		err = onConfigureDatabasesAWSPrint(ctx, configureDatabaseAWSPrintFlags)
 	case dbConfigureAWSCreateIAM.FullCommand():
-		err = onConfigureDatabasesAWSCreate(configureDatabaseAWSCreateFlags)
+		err = onConfigureDatabasesAWSCreate(ctx, configureDatabaseAWSCreateFlags)
 	case dbConfigureBootstrap.FullCommand():
 		configureDiscoveryBootstrapFlags.config.Service = configurators.DatabaseService
-		err = onConfigureDiscoveryBootstrap(configureDiscoveryBootstrapFlags)
+		err = onConfigureDiscoveryBootstrap(ctx, configureDiscoveryBootstrapFlags)
 	case systemdInstall.FullCommand():
 		err = onDumpSystemdUnitFile(systemdInstallFlags)
 	case installAutoDiscoverNode.FullCommand():
 		err = onInstallAutoDiscoverNode(installAutoDiscoverNodeFlags)
 	case discoveryBootstrapCmd.FullCommand():
 		configureDiscoveryBootstrapFlags.config.Service = configurators.DiscoveryService
-		err = onConfigureDiscoveryBootstrap(configureDiscoveryBootstrapFlags)
+		err = onConfigureDiscoveryBootstrap(ctx, configureDiscoveryBootstrapFlags)
 	case joinOpenSSH.FullCommand():
 		err = onJoinOpenSSH(ccf, conf)
 	case integrationConfDeployServiceCmd.FullCommand():
@@ -757,9 +797,11 @@ Examples:
 		err = onIntegrationConfAzureOIDCCmd(ctx, ccf.IntegrationConfAzureOIDCArguments)
 	case integrationSAMLIdPGCPWorkforce.FullCommand():
 		err = onIntegrationConfSAMLIdPGCPWorkforce(ctx, ccf.IntegrationConfSAMLIdPGCPWorkforceArguments)
+	case integrationConfAWSRATrustAnchor.FullCommand():
+		err = onIntegrationConfAWSRATrustAnchor(ctx, ccf)
 	case tpmIdentifyCmd.FullCommand():
 		var query *tpm.QueryRes
-		query, err = tpm.Query(context.Background(), slog.Default())
+		query, err = tpm.Query(ctx, slog.Default())
 		if err != nil {
 			break
 		}
@@ -770,15 +812,56 @@ Examples:
 		err = onGetLogLevel(ccf.ConfigFile)
 	case collectProfilesCmd.FullCommand():
 		err = onCollectProfiles(ccf.ConfigFile, ccf.Profiles, ccf.ProfileSeconds)
+	case readyzCmd.FullCommand():
+		err = onReadyz(ctx, ccf.ConfigFile)
+	case metricsCmd.FullCommand():
+		err = onMetrics(ctx, ccf.ConfigFile)
 	case moduleSourceCmd.FullCommand():
+		if runtime.GOOS != "linux" {
+			break
+		}
 		moduleSrc := selinux.ModuleSource()
 		fmt.Printf("%s", moduleSrc)
 	case fileContextsCmd.FullCommand():
+		if runtime.GOOS != "linux" {
+			break
+		}
 		err = onSELinuxFileContexts(ccf.ConfigFile)
 	case selinuxDirsCmd.FullCommand():
+		if runtime.GOOS != "linux" {
+			break
+		}
 		err = onSELinuxDirs(ccf.ConfigFile)
 	case backendCloneCmd.FullCommand():
-		err = onClone(context.Background(), ccf.ConfigFile)
+		err = onBackendClone(ctx, ccf.ConfigFile)
+	case backendGetCmd.FullCommand():
+		// configuration merge: defaults -> file-based conf -> CLI conf
+		if err = config.Configure(&ccf, conf, true); err != nil {
+			utils.FatalError(err)
+		}
+
+		err = onBackendGet(ctx, conf.Auth.StorageConfig, ccf.BackendKey, ccf.Format)
+	case backendDeleteCmd.FullCommand():
+		// configuration merge: defaults -> file-based conf -> CLI conf
+		if err = config.Configure(&ccf, conf, true); err != nil {
+			utils.FatalError(err)
+		}
+
+		err = onBackendDelete(ctx, conf.Auth.StorageConfig, ccf.BackendKey)
+	case backendListCmd.FullCommand():
+		// configuration merge: defaults -> file-based conf -> CLI conf
+		if err = config.Configure(&ccf, conf, true); err != nil {
+			utils.FatalError(err)
+		}
+
+		err = onBackendList(ctx, conf.Auth.StorageConfig, ccf.BackendPrefix, ccf.Format)
+	case backendEditCmd.FullCommand():
+		// configuration merge: defaults -> file-based conf -> CLI conf
+		if err = config.Configure(&ccf, conf, true); err != nil {
+			utils.FatalError(err)
+		}
+
+		err = onBackendEdit(ctx, conf.Auth.StorageConfig, ccf.BackendKey)
 	}
 	if err != nil {
 		utils.FatalError(err)
@@ -936,6 +1019,12 @@ func onConfigDump(flags dumpFlags) error {
 			os.Stderr, "%s Could not check the contents of %s: %s\n         The data directory may contain existing cluster state.\n", utils.Color(utils.Yellow, "WARNING:"), flags.DataDir, err.Error())
 	}
 
+	// Filter out the default directory /var/lib/teleport/bot used by `tbot` to
+	// avoid throwing a scary warning if `tbot` was installed prior to
+	// configuring teleport.
+	entries = slices.DeleteFunc(entries, func(entry os.DirEntry) bool {
+		return entry.Name() == "bot"
+	})
 	if err == nil && len(entries) != 0 {
 		fmt.Fprintf(
 			os.Stderr,
@@ -1058,7 +1147,7 @@ func onSCP(scpFlags *scp.Flags) error {
 	if scpFlags.Verbose {
 		verbosity = teleport.DebugLevel
 	}
-	_, _, err := logutils.Initialize(logutils.Config{
+	_, _, _, err := logutils.Initialize(logutils.Config{
 		Output:   logutils.LogOutputSyslog,
 		Severity: verbosity,
 	})
@@ -1138,7 +1227,7 @@ func onSELinuxFileContexts(configPath string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	fileContexts, err := selinux.FileContexts("/opt/teleport/default", cfg.DataDir, configPath)
+	fileContexts, err := selinux.FileContexts(cfg.DataDir, configPath, "")
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/teleport/common/teleport_test.go b/tool/teleport/common/teleport_test.go
index d291ec08a34c9..98ad8d7c4bb1e 100644
--- a/tool/teleport/common/teleport_test.go
+++ b/tool/teleport/common/teleport_test.go
@@ -37,7 +37,7 @@ import (
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 const initTestSentinel = "init_test"
@@ -47,7 +47,7 @@ func TestMain(m *testing.M) {
 		os.Exit(0)
 	}
 
-	utils.InitLoggerForTests()
+	logtest.InitLogger(testing.Verbose)
 	os.Exit(m.Run())
 }
 
diff --git a/tool/teleport/common/usage.go b/tool/teleport/common/usage.go
index bc9ce79d18f0f..9ee7c634ac8e3 100644
--- a/tool/teleport/common/usage.go
+++ b/tool/teleport/common/usage.go
@@ -47,7 +47,13 @@ const (
     --uri="http://localhost:8080" \
     --labels=group=dev
   Same as the above, but the app server runs with "group=dev" label which only
-  allows access to users with the application label "group: dev" in an assigned role.`
+  allows access to users with the application label "group: dev" in an assigned role.
+
+> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \
+    --mcp-demo-server
+  Runs a Teleport demo MCP server that shows current user and session
+  information.
+`
 
 	dbUsageExamples = `
 > teleport db start --token=xyz --auth-server=proxy.example.com:3080 \
diff --git a/tool/teleport/testenv/helpers.go b/tool/teleport/testenv/helpers.go
deleted file mode 100644
index 04464f8a6fd3c..0000000000000
--- a/tool/teleport/testenv/helpers.go
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2025  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package testenv
-
-import (
-	"context"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/mocku2f"
-	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
-	"github.com/gravitational/teleport/lib/service"
-)
-
-// RegisterPasswordlessDeviceForUser registers a mocked passwordless device for the user
-// to use during login or pass other routine MFA checks. The cluster auth preference should
-// be set up to allow webauthn and passwordless before calling this helper.
-func RegisterPasswordlessDeviceForUser(t *testing.T, server *service.TeleportProcess, username string) *mocku2f.Key {
-	proxyAddr, err := server.ProxyWebAddr()
-	require.NoError(t, err)
-	origin := fmt.Sprintf("https://%v", proxyAddr.Host())
-
-	device, err := mocku2f.Create()
-	require.NoError(t, err)
-	device.SetPasswordless()
-
-	ctx := context.Background()
-	token, err := server.GetAuthServer().CreateResetPasswordToken(ctx, authclient.CreateUserTokenRequest{
-		Name: username,
-	})
-	require.NoError(t, err)
-
-	tokenID := token.GetName()
-	res, err := server.GetAuthServer().CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
-		TokenID:     tokenID,
-		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
-		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
-	})
-	require.NoError(t, err)
-	cc := wantypes.CredentialCreationFromProto(res.GetWebauthn())
-
-	ccr, err := device.SignCredentialCreation(origin, cc)
-	require.NoError(t, err)
-	_, err = server.GetAuthServer().ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
-		TokenID: tokenID,
-		NewMFARegisterResponse: &proto.MFARegisterResponse{
-			Response: &proto.MFARegisterResponse_Webauthn{
-				Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	return device
-}
diff --git a/tool/teleport/testenv/test_server.go b/tool/teleport/testenv/test_server.go
index d0dac5dff7899..65059e8b5e534 100644
--- a/tool/teleport/testenv/test_server.go
+++ b/tool/teleport/testenv/test_server.go
@@ -20,26 +20,19 @@
 package testenv
 
 import (
-	"bytes"
 	"context"
 	"crypto"
 	"fmt"
-	"io"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"testing"
 	"time"
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/pkg/sftp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/breaker"
@@ -48,26 +41,19 @@ import (
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
-	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
-	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/auth/storage"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/cloud/imds"
-	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/hostid"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/teleport/common"
 )
 
@@ -90,55 +76,25 @@ func init() {
 	modules.SetModules(&cliModules{})
 }
 
-// WithInsecureDevMode is a test helper that sets insecure dev mode and resets
-// it in test cleanup.
-// It is NOT SAFE to use in parallel tests, because it modifies a global.
-// To run insecure dev mode tests in parallel, group them together under a
-// parent test and then run them as parallel subtests.
-// and call WithInsecureDevMode before running all the tests in parallel.
-func WithInsecureDevMode(t *testing.T, mode bool) {
-	originalValue := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(mode)
-	// To detect tests that run in parallel incorrectly, call t.Setenv with a
-	// dummy env var - that function detects tests with parallel ancestors
-	// and panics, preventing improper use of this helper.
-	t.Setenv("WithInsecureDevMode", "1")
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(originalValue)
-	})
-}
-
-// WithResyncInterval is a test helper that sets the tunnel resync interval and
-// resets it in test cleanup.
-// Useful to substantially speedup test cluster setup - passing 0 for the
-// interval selects a reasonably fast default of 100ms.
-// It is NOT SAFE to use in parallel tests, because it modifies a global.
-func WithResyncInterval(t *testing.T, interval time.Duration) {
-	if interval == 0 {
-		interval = time.Millisecond * 100
-	}
-	oldResyncInterval := defaults.ResyncInterval
-	defaults.ResyncInterval = interval
-	// To detect tests that run in parallel incorrectly, call t.Setenv with a
-	// dummy env var - that function detects tests with parallel ancestors
-	// and panics, preventing improper use of this helper.
-	t.Setenv("WithResyncInterval", "1")
-	t.Cleanup(func() {
-		defaults.ResyncInterval = oldResyncInterval
-	})
-}
-
-// MakeTestServer creates a Teleport Server for testing.
-func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.TeleportProcess) {
-	t.Helper()
-
+// NewTeleportProcess creates a Teleport Server for testing.
+func NewTeleportProcess(dataDir string, opts ...TestServerOptFunc) (_ *service.TeleportProcess, err error) {
 	var options TestServersOpts
 	for _, opt := range opts {
-		opt(&options)
+		if err := opt(&options); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	// Set up a test auth server with default config.
 	cfg := servicecfg.MakeDefaultConfig()
+	defer func() {
+		if err != nil {
+			for _, fd := range cfg.FileDescriptors {
+				fd.Close()
+			}
+		}
+	}()
+
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.CachePolicy.Enabled = false
 	// Disables cloud auto-imported labels when running tests in cloud envs
@@ -154,13 +110,18 @@ func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.T
 	cfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 
 	cfg.Hostname = "server01"
-	cfg.DataDir = t.TempDir()
-	cfg.Logger = utils.NewSlogLoggerForTests()
-	authAddr := utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerAuth, &cfg.FileDescriptors)}
+	cfg.DataDir = dataDir
+	cfg.Logger = logtest.NewLogger()
+
+	authAddr, err := newTCPListener(service.ListenerAuth, &cfg.FileDescriptors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	authNetAddr := utils.NetAddr{AddrNetwork: "tcp", Addr: authAddr}
 	cfg.SetToken(StaticToken)
-	cfg.SetAuthServerAddress(authAddr)
+	cfg.SetAuthServerAddress(authNetAddr)
 
-	cfg.Auth.ListenAddr = authAddr
+	cfg.Auth.ListenAddr = authNetAddr
 	cfg.Auth.BootstrapResources = options.Bootstrap
 	cfg.Auth.StorageConfig.Params = backend.Params{defaults.BackendPath: filepath.Join(cfg.DataDir, defaults.BackendDir)}
 	staticToken, err := types.NewStaticTokens(types.StaticTokensSpecV2{
@@ -170,7 +131,9 @@ func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.T
 			Token:   StaticToken,
 		}},
 	})
-	require.NoError(t, err)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	cfg.Auth.StaticTokens = staticToken
 	cfg.Auth.Preference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_BALANCED_V1)
 
@@ -179,12 +142,30 @@ func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.T
 	// Speeds up tests considerably.
 	cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond
 
-	cfg.Proxy.WebAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxyWeb, &cfg.FileDescriptors)}
-	cfg.Proxy.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxySSH, &cfg.FileDescriptors)}
-	cfg.Proxy.ReverseTunnelListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxyTunnel, &cfg.FileDescriptors)}
+	proxyWebAddr, err := newTCPListener(service.ListenerProxyWeb, &cfg.FileDescriptors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cfg.Proxy.WebAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: proxyWebAddr}
+
+	proxySSHAddr, err := newTCPListener(service.ListenerProxySSH, &cfg.FileDescriptors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	proxyTunnelAddr, err := newTCPListener(service.ListenerProxyTunnel, &cfg.FileDescriptors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cfg.Proxy.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: proxySSHAddr}
+	cfg.Proxy.ReverseTunnelListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: proxyTunnelAddr}
 	cfg.Proxy.DisableWebInterface = true
 
-	cfg.SSH.Addr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerNodeSSH, &cfg.FileDescriptors)}
+	nodeSSHAddr, err := newTCPListener(service.ListenerNodeSSH, &cfg.FileDescriptors)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	cfg.SSH.Addr = utils.NetAddr{AddrNetwork: "tcp", Addr: nodeSSHAddr}
 	cfg.SSH.DisableCreateHostUser = true
 
 	// Disabling debug service for tests so that it doesn't break if the data
@@ -196,53 +177,56 @@ func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.T
 		fn(cfg)
 	}
 
-	process, err = service.NewTeleport(cfg)
-	require.NoError(t, err, trace.DebugReport(err))
-	require.NoError(t, process.Start())
-	t.Cleanup(func() {
-		require.NoError(t, process.Close())
-		require.NoError(t, process.Wait())
-	})
+	process, err := service.NewTeleport(cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := process.Start(); err != nil {
+		return nil, trace.Wrap(err)
+	}
 
-	waitForServices(t, process, cfg)
+	if err := waitForServices(process, cfg); err != nil {
+		_ = process.Close()
+		_ = process.Wait()
+		return nil, trace.Wrap(err)
+	}
 
-	return process
+	return process, nil
 }
 
-// NewTCPListener creates a new TCP listener on 127.0.0.1:0, adds it to the
+// newTCPListener creates a new TCP listener on 127.0.0.1:0, adds it to the
 // FileDescriptor slice (with the specified type) and returns its actual local
 // address as a string (for use in configuration). Takes a pointer to the slice
 // so that it's convenient to call in the middle of a FileConfig or Config
 // struct literal.
-func NewTCPListener(t *testing.T, lt service.ListenerType, fds *[]*servicecfg.FileDescriptor) string {
-	t.Helper()
-
+func newTCPListener(lt service.ListenerType, fds *[]*servicecfg.FileDescriptor) (string, error) {
 	l, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
 	defer l.Close()
 	addr := l.Addr().String()
 
 	// File() returns a dup of the listener's file descriptor as an *os.File, so
 	// the original net.Listener still needs to be closed.
 	lf, err := l.(*net.TCPListener).File()
-	require.NoError(t, err)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
 	fd := &servicecfg.FileDescriptor{
 		Type:    string(lt),
 		Address: addr,
 		File:    lf,
 	}
-	// If the file descriptor slice ends up being passed to a TeleportProcess
-	// that successfully starts, listeners will either get "imported" and used
-	// or discarded and closed, this is just an extra safety measure that closes
-	// the listener at the end of the test anyway (the finalizer would do that
-	// anyway, in principle).
-	t.Cleanup(func() { require.NoError(t, fd.Close()) })
 
 	*fds = append(*fds, fd)
-	return addr
+	return addr, nil
 }
 
-func waitForServices(t *testing.T, auth *service.TeleportProcess, cfg *servicecfg.Config) {
+func waitForServices(auth *service.TeleportProcess, cfg *servicecfg.Config) error {
 	var serviceReadyEvents []string
 	if cfg.Proxy.Enabled {
 		serviceReadyEvents = append(serviceReadyEvents, service.ProxyWebServerReady)
@@ -259,32 +243,48 @@ func waitForServices(t *testing.T, auth *service.TeleportProcess, cfg *servicecf
 	if cfg.Auth.Enabled {
 		serviceReadyEvents = append(serviceReadyEvents, service.AuthTLSReady)
 	}
-	waitForEvents(t, auth, serviceReadyEvents...)
+	if cfg.Kube.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.KubernetesReady)
+	}
+	if err := waitForEvents(auth, serviceReadyEvents...); err != nil {
+		return trace.Wrap(err)
+	}
 
 	if cfg.Auth.Enabled && cfg.Databases.Enabled {
-		waitForDatabases(t, auth, cfg.Databases.Databases)
+		if err := waitForDatabases(auth, cfg.Databases.Databases); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	if cfg.Auth.Enabled && cfg.Apps.Enabled {
-		waitForApps(t, auth, cfg.Apps.Apps)
+		if err := waitForApps(auth, cfg.Apps.Apps); err != nil {
+			return trace.Wrap(err)
+		}
 	}
+
+	return nil
 }
 
-func waitForEvents(t *testing.T, svc service.Supervisor, events ...string) {
+func waitForEvents(svc service.Supervisor, events ...string) error {
 	for _, event := range events {
-		_, err := svc.WaitForEventTimeout(10*time.Second, event)
-		require.NoError(t, err, "service server didn't receive %v event after 10s", event)
+		if _, err := svc.WaitForEventTimeout(10*time.Second, event); err != nil {
+			return trace.Wrap(err, "service didn't receive %v event after 10s", event)
+		}
 	}
+
+	return nil
 }
 
-func waitForDatabases(t *testing.T, auth *service.TeleportProcess, dbs []servicecfg.Database) {
+func waitForDatabases(auth *service.TeleportProcess, dbs []servicecfg.Database) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	for {
 		select {
 		case <-time.After(500 * time.Millisecond):
 			all, err := auth.GetAuthServer().GetDatabaseServers(ctx, apidefaults.Namespace)
-			require.NoError(t, err)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 
 			// Count how many input "dbs" are registered.
 			var registered int
@@ -298,22 +298,24 @@ func waitForDatabases(t *testing.T, auth *service.TeleportProcess, dbs []service
 			}
 
 			if registered == len(dbs) {
-				return
+				return nil
 			}
 		case <-ctx.Done():
-			t.Fatal("Databases not registered after 10s")
+			return trace.LimitExceeded("Databases not registered after 10s")
 		}
 	}
 }
 
-func waitForApps(t *testing.T, auth *service.TeleportProcess, apps []servicecfg.App) {
+func waitForApps(auth *service.TeleportProcess, apps []servicecfg.App) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	for {
 		select {
 		case <-time.After(500 * time.Millisecond):
 			all, err := auth.GetAuthServer().GetApplicationServers(ctx, apidefaults.Namespace)
-			require.NoError(t, err)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 
 			var registered int
 			for _, app := range apps {
@@ -326,10 +328,10 @@ func waitForApps(t *testing.T, auth *service.TeleportProcess, apps []servicecfg.
 			}
 
 			if registered == len(apps) {
-				return
+				return nil
 			}
 		case <-ctx.Done():
-			t.Fatal("Apps not registered after 10s")
+			return trace.LimitExceeded("Apps not registered after 10s")
 		}
 	}
 }
@@ -339,17 +341,19 @@ type TestServersOpts struct {
 	ConfigFuncs []func(cfg *servicecfg.Config)
 }
 
-type TestServerOptFunc func(o *TestServersOpts)
+type TestServerOptFunc func(o *TestServersOpts) error
 
 func WithBootstrap(bootstrap ...types.Resource) TestServerOptFunc {
-	return func(o *TestServersOpts) {
+	return func(o *TestServersOpts) error {
 		o.Bootstrap = append(o.Bootstrap, bootstrap...)
+		return nil
 	}
 }
 
 func WithConfig(fn func(cfg *servicecfg.Config)) TestServerOptFunc {
-	return func(o *TestServersOpts) {
+	return func(o *TestServersOpts) error {
 		o.ConfigFuncs = append(o.ConfigFuncs, fn)
+		return nil
 	}
 }
 
@@ -359,14 +363,14 @@ func WithAuthConfig(fn func(*servicecfg.AuthConfig)) TestServerOptFunc {
 	})
 }
 
-func WithClusterName(t *testing.T, n string) TestServerOptFunc {
+func WithClusterName(name string) TestServerOptFunc {
 	return WithAuthConfig(func(cfg *servicecfg.AuthConfig) {
-		clusterName, err := services.NewClusterNameWithRandomID(
-			types.ClusterNameSpecV2{
-				ClusterName: n,
-			})
-		require.NoError(t, err)
-		cfg.ClusterName = clusterName
+		cfg.ClusterName = &types.ClusterNameV2{
+			Spec: types.ClusterNameSpecV2{
+				ClusterName: name,
+				ClusterID:   uuid.NewString(),
+			},
+		}
 	})
 }
 
@@ -404,14 +408,23 @@ func WithLogger(log *slog.Logger) TestServerOptFunc {
 }
 
 // WithProxyKube enables the Proxy Kube listener with a random address.
-func WithProxyKube(t *testing.T) TestServerOptFunc {
-	return WithConfig(func(cfg *servicecfg.Config) {
-		cfg.Proxy.Kube.Enabled = true
-		cfg.Proxy.Kube.ListenAddr = utils.NetAddr{
-			AddrNetwork: "tcp",
-			Addr:        NewTCPListener(t, service.ListenerProxyKube, &cfg.FileDescriptors),
+func WithProxyKube() TestServerOptFunc {
+	return func(o *TestServersOpts) error {
+		var fds []*servicecfg.FileDescriptor
+		addr, err := newTCPListener(service.ListenerProxyKube, &fds)
+		if err != nil {
+			return trace.Wrap(err)
 		}
-	})
+
+		return WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Proxy.Kube.Enabled = true
+			cfg.Proxy.Kube.ListenAddr = utils.NetAddr{
+				AddrNetwork: "tcp",
+				Addr:        addr,
+			}
+			cfg.FileDescriptors = append(cfg.FileDescriptors, fds...)
+		})(o)
+	}
 }
 
 // WithDebugApp enables the app service and the debug app.
@@ -424,14 +437,13 @@ func WithDebugApp() TestServerOptFunc {
 
 // WithTestApp enables the app service and adds a test app server
 // with the given name.
-func WithTestApp(t *testing.T, name string) TestServerOptFunc {
-	appUrl := startDummyHTTPServer(t, name)
+func WithTestApp(name, uri string) TestServerOptFunc {
 	return WithConfig(func(cfg *servicecfg.Config) {
 		cfg.Apps.Enabled = true
 		cfg.Apps.Apps = append(cfg.Apps.Apps,
 			servicecfg.App{
 				Name: name,
-				URI:  appUrl,
+				URI:  uri,
 				StaticLabels: map[string]string{
 					"name": name,
 				},
@@ -439,7 +451,7 @@ func WithTestApp(t *testing.T, name string) TestServerOptFunc {
 	})
 }
 
-func startDummyHTTPServer(t *testing.T, name string) string {
+func StartDummyHTTPServer(name string) *httptest.Server {
 	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Server", name)
 		_, _ = w.Write([]byte("hello"))
@@ -447,56 +459,15 @@ func startDummyHTTPServer(t *testing.T, name string) string {
 
 	srv.Start()
 
-	t.Cleanup(func() {
-		srv.Close()
-	})
-
-	return srv.URL
-}
-
-func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) {
-	// Use insecure mode so that the trusted cluster can establish trust over reverse tunnel.
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) })
-
-	rootProxyAddr, err := rootServer.ProxyWebAddr()
-	require.NoError(t, err)
-	rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr()
-	require.NoError(t, err)
-
-	tc, err := types.NewTrustedCluster(rootServer.Config.Auth.ClusterName.GetClusterName(), types.TrustedClusterSpecV2{
-		Enabled:              true,
-		Token:                StaticToken,
-		ProxyAddress:         rootProxyAddr.String(),
-		ReverseTunnelAddress: rootProxyTunnelAddr.String(),
-		RoleMap: append(additionalRoleMappings,
-			types.RoleMapping{
-				Remote: "access",
-				Local:  []string{"access"},
-			},
-		),
-	})
-	require.NoError(t, err)
-
-	_, err = leafServer.GetAuthServer().UpsertTrustedClusterV2(ctx, tc)
-	require.NoError(t, err)
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		rt, err := rootServer.GetAuthServer().GetTunnelConnections(leafServer.Config.Auth.ClusterName.GetClusterName())
-		assert.NoError(t, err)
-		assert.Len(t, rt, 1)
-	}, time.Second*10, time.Second)
-
-	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		rts, err := rootServer.GetAuthServer().GetRemoteClusters(ctx)
-		assert.NoError(t, err)
-		assert.Len(t, rts, 1)
-	}, time.Second*10, time.Second)
+	return srv
 }
 
 type cliModules struct{}
 
+func (p *cliModules) GenerateLongTermResourceGrouping(_ context.Context, _ modules.AccessResourcesGetter, _ types.AccessRequest) (*types.LongTermResourceGrouping, error) {
+	return &types.LongTermResourceGrouping{}, nil
+}
+
 func (p *cliModules) GenerateAccessRequestPromotions(_ context.Context, _ modules.AccessResourcesGetter, _ types.AccessRequest) (*types.AccessRequestAllowedPromotions, error) {
 	return &types.AccessRequestAllowedPromotions{}, nil
 }
@@ -566,257 +537,32 @@ func (p *cliModules) EnableAccessMonitoring() {}
 func (p *cliModules) SetFeatures(f modules.Features) {
 }
 
-func CreateAgentlessNode(t *testing.T, authServer *auth.Server, clusterName, nodeHostname string) *types.ServerV2 {
-	t.Helper()
-
-	ctx := context.Background()
-	openSSHCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       types.OpenSSHCA,
-		DomainName: clusterName,
-	}, false)
-	require.NoError(t, err)
-
-	caCheckers, err := sshutils.GetCheckers(openSSHCA)
-	require.NoError(t, err)
-
-	key, err := cryptosuites.GenerateKey(ctx, cryptosuites.GetCurrentSuiteFromAuthPreference(authServer), cryptosuites.HostSSH)
-	require.NoError(t, err)
-	sshPub, err := ssh.NewPublicKey(key.Public())
-	require.NoError(t, err)
-
-	nodeUUID := uuid.New().String()
-	hostCertBytes, err := authServer.GenerateHostCert(
-		ctx,
-		ssh.MarshalAuthorizedKey(sshPub),
-		"",
-		"",
-		[]string{nodeUUID, nodeHostname, Loopback},
-		clusterName,
-		types.RoleNode,
-		0,
-	)
-	require.NoError(t, err)
-
-	hostCert, err := apisshutils.ParseCertificate(hostCertBytes)
-	require.NoError(t, err)
-	signer, err := ssh.NewSignerFromSigner(key)
-	require.NoError(t, err)
-	hostKeySigner, err := ssh.NewCertSigner(hostCert, signer)
-	require.NoError(t, err)
-
-	// start SSH server
-	sshAddr := startSSHServer(t, caCheckers, hostKeySigner)
-
-	// create node resource
-	node := &types.ServerV2{
-		Kind:    types.KindNode,
-		SubKind: types.SubKindOpenSSHNode,
-		Version: types.V2,
-		Metadata: types.Metadata{
-			Name: nodeUUID,
-		},
-		Spec: types.ServerSpecV2{
-			Addr:     sshAddr,
-			Hostname: nodeHostname,
-		},
-	}
-	_, err = authServer.UpsertNode(ctx, node)
-	require.NoError(t, err)
-
-	// wait for node resource to be written to the backend
-	timedCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	t.Cleanup(cancel)
-	w, err := authServer.NewWatcher(timedCtx, types.Watch{
-		Name: "node-create watcher",
-		Kinds: []types.WatchKind{
-			{
-				Kind: types.KindNode,
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	for nodeCreated := false; !nodeCreated; {
-		select {
-		case e := <-w.Events():
-			if e.Type == types.OpPut {
-				nodeCreated = true
-			}
-		case <-w.Done():
-			t.Fatal("Did not receive node create event")
-		}
-	}
-	require.NoError(t, w.Close())
-
-	return node
-}
-
-// startSSHServer starts a SSH server that roughly mimics an unregistered
-// OpenSSH (agentless) server. The SSH server started only handles a small
-// subset of SSH requests necessary for testing.
-func startSSHServer(t *testing.T, caPubKeys []ssh.PublicKey, hostKey ssh.Signer) string {
-	t.Helper()
-
-	sshCfg := ssh.ServerConfig{
-		PublicKeyCallback: func(_ ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
-			cert, ok := key.(*ssh.Certificate)
-			if !ok {
-				return nil, fmt.Errorf("expected *ssh.Certificate, got %T", key)
-			}
-
-			// Sanity check incoming cert from proxy has Ed25519 key.
-			if cert.Key.Type() != ssh.KeyAlgoED25519 {
-				return nil, trace.BadParameter("expected Ed25519 key, got %v", cert.Key.Type())
-			}
-
-			for _, pubKey := range caPubKeys {
-				if bytes.Equal(cert.SignatureKey.Marshal(), pubKey.Marshal()) {
-					return &ssh.Permissions{}, nil
-				}
-			}
-
-			return nil, fmt.Errorf("signature key %v does not match OpenSSH CA", cert.SignatureKey)
-		},
-	}
-	sshCfg.AddHostKey(hostKey)
-
-	lis, err := net.Listen("tcp", Loopback+":")
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, lis.Close())
-	})
-
-	go func() {
-		nConn, err := lis.Accept()
-		if utils.IsOKNetworkError(err) {
-			return
-		}
-		assert.NoError(t, err)
-		t.Cleanup(func() {
-			if nConn != nil {
-				// the error is ignored here to avoid failing on net.ErrClosed
-				_ = nConn.Close()
-			}
-		})
-
-		conn, channels, reqs, err := ssh.NewServerConn(nConn, &sshCfg)
-		assert.NoError(t, err)
-		t.Cleanup(func() {
-			if conn != nil {
-				// the error is ignored here to avoid failing on net.ErrClosed
-				_ = conn.Close()
-			}
-		})
-		go ssh.DiscardRequests(reqs)
-
-		var agentForwarded bool
-		var shellRequested bool
-		var execRequested bool
-		var sftpRequested bool
-		for {
-			var channelReq ssh.NewChannel
-			select {
-			case channelReq = <-channels:
-				if channelReq == nil { // server is closed
-					return
-				}
-			case <-t.Context().Done():
-				return
-			}
-			if !assert.Equal(t, "session", channelReq.ChannelType()) {
-				assert.NoError(t, channelReq.Reject(ssh.Prohibited, "only session channels expected"))
-				continue
-			}
-			channel, reqs, err := channelReq.Accept()
-			assert.NoError(t, err)
-			t.Cleanup(func() {
-				// the error is ignored here to avoid failing on net.ErrClosed
-				_ = channel.Close()
-			})
-
-			go func() {
-			outer:
-				for {
-					var req *ssh.Request
-					select {
-					case req = <-reqs:
-						if req == nil { // channel is closed
-							return
-						}
-					case <-t.Context().Done():
-						break outer
-					}
-					if req.WantReply {
-						assert.NoError(t, req.Reply(true, nil))
-					}
-					switch req.Type {
-					case sshutils.AgentForwardRequest:
-						agentForwarded = true
-					case sshutils.ShellRequest:
-						assert.NoError(t, channel.Close())
-						shellRequested = true
-						break outer
-					case sshutils.ExecRequest:
-						_, err := channel.SendRequest("exit-status", false, ssh.Marshal(struct{ C uint32 }{C: 0}))
-						assert.NoError(t, err)
-						assert.NoError(t, channel.Close())
-						execRequested = true
-						break outer
-					case sshutils.SubsystemRequest:
-						var r sshutils.SubsystemReq
-						err := ssh.Unmarshal(req.Payload, &r)
-						assert.NoError(t, err)
-						assert.Equal(t, "sftp", r.Name)
-						sftpRequested = true
-
-						sftpServer, err := sftp.NewServer(channel)
-						assert.NoError(t, err)
-						go sftpServer.Serve()
-						t.Cleanup(func() {
-							err := sftpServer.Close()
-							if err != nil {
-								assert.ErrorIs(t, err, io.EOF)
-							}
-						})
-						break outer
-					}
-				}
-				assert.True(t, (agentForwarded && shellRequested) || execRequested || sftpRequested)
-			}()
-		}
-	}()
-
-	return lis.Addr().String()
-}
-
-// MakeDefaultAuthClient reimplements the bare minimum needed to create a
+// NewDefaultAuthClient reimplements the bare minimum needed to create a
 // default root-level auth client for a Teleport server started by
-// MakeTestServer.
-func MakeDefaultAuthClient(t *testing.T, process *service.TeleportProcess) *authclient.Client {
-	t.Helper()
-
+// NewTeleportProcess.
+func NewDefaultAuthClient(process *service.TeleportProcess) (*authclient.Client, error) {
 	cfg := process.Config
-	hostUUID, err := hostid.ReadFile(process.Config.DataDir)
-	require.NoError(t, err)
-
-	identity, err := storage.ReadLocalIdentity(
+	identity, err := storage.ReadLocalIdentityForRole(
 		filepath.Join(cfg.DataDir, teleport.ComponentProcess),
-		state.IdentityID{Role: types.RoleAdmin, HostUUID: hostUUID},
+		types.RoleAdmin,
 	)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 
 	authConfig := new(authclient.Config)
 	authConfig.TLS, err = identity.TLSConfig(cfg.CipherSuites)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 
 	authConfig.AuthServers = cfg.AuthServerAddresses()
 	authConfig.Log = cfg.Logger
 
 	client, err := authclient.Connect(context.Background(), authConfig)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		_ = client.Close()
-	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 
-	return client
+	return client, nil
 }
diff --git a/tool/tsh/common/access_request.go b/tool/tsh/common/access_request.go
index a3e4a73a3b940..8f76f220ecb15 100644
--- a/tool/tsh/common/access_request.go
+++ b/tool/tsh/common/access_request.go
@@ -19,9 +19,9 @@
 package common
 
 import (
+	"context"
 	"fmt"
 	"path"
-	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -35,8 +35,10 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/itertools/stream"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
@@ -407,6 +409,125 @@ func showRequestTable(cf *CLIConf, reqs []types.AccessRequest) error {
 }
 
 func onRequestSearch(cf *CLIConf) error {
+	if cf.RequestableRoles && cf.ResourceKind != "" {
+		return trace.BadParameter("only one of --kind and --roles may be specified")
+	}
+	if !cf.RequestableRoles && cf.ResourceKind == "" {
+		return trace.BadParameter("one of --kind and --roles is required")
+	}
+
+	if cf.RequestableRoles {
+		return searchRequestableRoles(cf)
+	} else {
+		return searchRequestableResources(cf)
+	}
+}
+
+type requestableRoleRow struct {
+	Role        string
+	Description string
+}
+
+type resourceRow interface {
+	kubeResourceRow |
+		dbResourceRow |
+		genericResourceRow
+}
+
+type kubeResourceRow struct {
+	Name       string
+	Namespace  string
+	Labels     string
+	ResourceID string
+}
+
+type dbResourceRow struct {
+	DatabaseName string
+	Labels       string
+	ResourceID   string
+}
+
+type genericResourceRow struct {
+	Name       string
+	Hostname   string
+	Labels     string
+	ResourceID string
+}
+
+func searchRequestableRoles(cf *CLIConf) error {
+	tc, err := makeClient(cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var allRoles []*proto.ListRequestableRolesResponse_RequestableRole
+	err = tc.WithRootClusterClient(cf.Context, func(clt authclient.ClientI) error {
+		pageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*proto.ListRequestableRolesResponse_RequestableRole, string, error) {
+			req := &proto.ListRequestableRolesRequest{
+				PageSize:  int32(pageSize),
+				PageToken: pageToken,
+			}
+
+			resp, err := clt.ListRequestableRoles(ctx, req)
+			return resp.GetRoles(), resp.GetNextPageToken(), trace.Wrap(err)
+		}
+
+		var err error
+		allRoles, err = stream.Collect(clientutils.Resources(cf.Context, pageFunc))
+		return err
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	rows := make([]requestableRoleRow, 0, len(allRoles))
+	for _, r := range allRoles {
+		rows = append(rows, requestableRoleRow{
+			Role:        r.Name,
+			Description: r.Description,
+		})
+	}
+
+	return printRequestableRoles(cf, rows)
+}
+
+func printRequestableRoles(cf *CLIConf, rows []requestableRoleRow) error {
+	format := strings.ToLower(cf.Format)
+
+	switch format {
+	case teleport.Text, "":
+		if len(rows) == 0 {
+			fmt.Fprintln(cf.Stdout(), "No requestable roles found.")
+			return nil
+		}
+
+		columns, rows, err := asciitable.MakeColumnsAndRows(rows, nil)
+		if err != nil {
+			return err
+		}
+
+		var table asciitable.Table
+		if cf.Verbose {
+			table = asciitable.MakeTable(columns, rows...)
+		} else {
+			table = asciitable.MakeTableWithTruncatedColumn(columns, rows, "Description")
+		}
+
+		if _, err := table.AsBuffer().WriteTo(cf.Stdout()); err != nil {
+			return trace.Wrap(err)
+		}
+		return nil
+
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAMLArray(cf.Stdout(), rows))
+	case teleport.JSON:
+		return trace.Wrap(utils.WriteJSONArray(cf.Stdout(), rows))
+	default:
+		return trace.BadParameter("unsupported format %q", cf.Format)
+	}
+}
+
+func searchRequestableResources(cf *CLIConf) error {
 	tc, err := makeClient(cf)
 	if err != nil {
 		return trace.Wrap(err)
@@ -416,8 +537,8 @@ func onRequestSearch(cf *CLIConf) error {
 	if cf.KubernetesCluster == "" {
 		cf.KubernetesCluster, _ = kubeconfig.SelectedKubeCluster(getKubeConfigPath(cf, ""), tc.SiteName)
 	}
-	if slices.Contains(types.KubernetesResourcesKinds, cf.ResourceKind) && cf.KubernetesCluster == "" {
-		return trace.BadParameter("when searching for Pods, --kube-cluster cannot be empty")
+	if cf.KubernetesCluster == "" && cf.ResourceKind == types.KindKubernetesResource {
+		return trace.BadParameter("--kube-cluster is required when searching for Kubernetes resources")
 	}
 	// if --all-namespaces flag was provided we search in every namespace.
 	// This means sending an empty namespace to the ListResources API.
@@ -425,16 +546,21 @@ func onRequestSearch(cf *CLIConf) error {
 		cf.kubeNamespace = ""
 	}
 
-	var resources types.ResourcesWithLabels
-	var tableColumns []string
-	switch {
-	case slices.Contains(types.KubernetesResourcesKinds, cf.ResourceKind):
+	deduplicateResourceIDs := map[string]struct{}{}
+	var resourceIDs []string
+
+	switch cf.ResourceKind {
+	case types.KindKubernetesResource:
 		proxyGRPCClient, err := tc.NewKubernetesServiceClient(cf.Context, tc.SiteName)
 		if err != nil {
 			return trace.Wrap(err)
 		}
+		resourceType := types.AccessRequestPrefixKindKube + cf.kubeResourceKind
+		if cf.kubeAPIGroup != "" {
+			resourceType = resourceType + "." + cf.kubeAPIGroup
+		}
 		req := kubeproto.ListKubernetesResourcesRequest{
-			ResourceType:        cf.ResourceKind,
+			ResourceType:        resourceType,
 			Labels:              tc.Labels,
 			PredicateExpression: cf.PredicateExpression,
 			SearchKeywords:      tc.SearchKeywords,
@@ -444,12 +570,39 @@ func onRequestSearch(cf *CLIConf) error {
 			TeleportCluster:     tc.SiteName,
 		}
 
-		resources, err = client.GetKubernetesResourcesWithFilters(cf.Context, proxyGRPCClient, &req)
+		resources, err := client.GetKubernetesResourcesWithFilters(cf.Context, proxyGRPCClient, &req)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
-		tableColumns = []string{"Name", "Namespace", "Labels", "Resource ID"}
+		var rows []kubeResourceRow
+		for _, resource := range resources {
+			r, ok := resource.(*types.KubernetesResourceV1)
+			if !ok {
+				continue
+			}
+
+			resourceID := types.ResourceIDToString(types.ResourceID{
+				ClusterName:     tc.SiteName,
+				Kind:            r.GetKind(),
+				Name:            cf.KubernetesCluster,
+				SubResourceName: path.Join(r.Spec.Namespace, r.GetName()),
+			})
+			if ignoreDuplicateResourceID(deduplicateResourceIDs, resourceID) {
+				continue
+			}
+			resourceIDs = append(resourceIDs, resourceID)
+
+			rows = append(rows, kubeResourceRow{
+				Name:       common.FormatResourceName(r, cf.Verbose),
+				Namespace:  r.Spec.Namespace,
+				Labels:     common.FormatLabels(r.GetAllLabels(), cf.Verbose),
+				ResourceID: resourceID,
+			})
+		}
+
+		return printRequestableResources(cf, rows, resourceIDs)
+
 	default:
 		// For all other resources, we need to connect to the auth server.
 		clusterClient, err := tc.ConnectToCluster(cf.Context)
@@ -465,105 +618,114 @@ func onRequestSearch(cf *CLIConf) error {
 			UseSearchAsRoles:    true,
 		}
 
-		resources, err = accessrequest.GetResourcesByKind(cf.Context, clusterClient.AuthClient, req, cf.ResourceKind)
+		resources, err := accessrequest.GetResourcesByKind(cf.Context, clusterClient.AuthClient, req, cf.ResourceKind)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		switch cf.ResourceKind {
 		case types.KindDatabase:
-			tableColumns = []string{"Database Name", "Labels", "Resource ID"}
-		default:
-			tableColumns = []string{"Name", "Hostname", "Labels", "Resource ID"}
-		}
-	}
-
-	var rows [][]string
-	var resourceIDs []string
-	deduplicateResourceIDs := map[string]struct{}{}
-	for _, resource := range resources {
-		var row []string
-		switch r := resource.(type) {
-		case *types.KubernetesResourceV1:
-			resourceID := types.ResourceIDToString(types.ResourceID{
-				ClusterName:     tc.SiteName,
-				Kind:            resource.GetKind(),
-				Name:            cf.KubernetesCluster,
-				SubResourceName: path.Join(r.Spec.Namespace, resource.GetName()),
-			})
-			if ignoreDuplicateResourceId(deduplicateResourceIDs, resourceID) {
-				continue
-			}
-			resourceIDs = append(resourceIDs, resourceID)
+			var rows []dbResourceRow
+			for _, resource := range resources {
+				r := resource
+
+				resourceID := types.ResourceIDToString(types.ResourceID{
+					ClusterName: tc.SiteName,
+					Kind:        r.GetKind(),
+					Name:        r.GetName(),
+				})
+				if ignoreDuplicateResourceID(deduplicateResourceIDs, resourceID) {
+					continue
+				}
+				resourceIDs = append(resourceIDs, resourceID)
 
-			row = []string{
-				common.FormatResourceName(resource, cf.Verbose),
-				r.Spec.Namespace,
-				common.FormatLabels(resource.GetAllLabels(), cf.Verbose),
-				resourceID,
+				rows = append(rows, dbResourceRow{
+					DatabaseName: common.FormatResourceName(r, cf.Verbose),
+					Labels:       common.FormatLabels(r.GetAllLabels(), cf.Verbose),
+					ResourceID:   resourceID,
+				})
 			}
+			return printRequestableResources(cf, rows, resourceIDs)
 
 		default:
-			resourceID := types.ResourceIDToString(types.ResourceID{
-				ClusterName: tc.SiteName,
-				Kind:        resource.GetKind(),
-				Name:        resource.GetName(),
-			})
-			if ignoreDuplicateResourceId(deduplicateResourceIDs, resourceID) {
-				continue
-			}
-
-			resourceIDs = append(resourceIDs, resourceID)
-			hostName := ""
-			if r, ok := resource.(interface{ GetHostname() string }); ok {
-				hostName = r.GetHostname()
-			}
-
-			switch cf.ResourceKind {
-			case types.KindDatabase:
-				row = []string{
-					common.FormatResourceName(resource, cf.Verbose),
-					common.FormatLabels(resource.GetAllLabels(), cf.Verbose),
-					resourceID,
+			var rows []genericResourceRow
+			for _, resource := range resources {
+				r := resource
+
+				resourceID := types.ResourceIDToString(types.ResourceID{
+					ClusterName: tc.SiteName,
+					Kind:        r.GetKind(),
+					Name:        r.GetName(),
+				})
+				if ignoreDuplicateResourceID(deduplicateResourceIDs, resourceID) {
+					continue
 				}
-			default:
-				row = []string{
-					common.FormatResourceName(resource, cf.Verbose),
-					hostName,
-					common.FormatLabels(resource.GetAllLabels(), cf.Verbose),
-					resourceID,
+				resourceIDs = append(resourceIDs, resourceID)
+
+				hostName := ""
+				if r2, ok := r.(interface{ GetHostname() string }); ok {
+					hostName = r2.GetHostname()
 				}
+
+				rows = append(rows, genericResourceRow{
+					Name:       common.FormatResourceName(r, cf.Verbose),
+					Hostname:   hostName,
+					Labels:     common.FormatLabels(r.GetAllLabels(), cf.Verbose),
+					ResourceID: resourceID,
+				})
 			}
+
+			return printRequestableResources(cf, rows, resourceIDs)
 		}
-		rows = append(rows, row)
-	}
-	var table asciitable.Table
-	if cf.Verbose {
-		table = asciitable.MakeTable(tableColumns, rows...)
-	} else {
-		table = asciitable.MakeTableWithTruncatedColumn(tableColumns, rows, "Labels")
-	}
-	if _, err := table.AsBuffer().WriteTo(cf.Stdout()); err != nil {
-		return trace.Wrap(err)
 	}
+}
+
+func printRequestableResources[T resourceRow](cf *CLIConf, rows []T, resourceIDs []string) error {
+	format := strings.ToLower(cf.Format)
+
+	switch format {
+	case teleport.Text, "":
+		columns, tableRows, err := asciitable.MakeColumnsAndRows(rows, nil)
+		if err != nil {
+			return err
+		}
+
+		var table asciitable.Table
+		if cf.Verbose {
+			table = asciitable.MakeTable(columns, tableRows...)
+		} else {
+			table = asciitable.MakeTableWithTruncatedColumn(columns, tableRows, "Labels")
+		}
+
+		if _, err := table.AsBuffer().WriteTo(cf.Stdout()); err != nil {
+			return trace.Wrap(err)
+		}
 
-	if len(resourceIDs) > 0 {
-		resourcesStr := strings.Join(resourceIDs, " --resource ")
-		fmt.Fprintf(cf.Stdout(), `
+		if len(resourceIDs) > 0 {
+			resourcesStr := strings.Join(resourceIDs, " --resource ")
+			fmt.Fprintf(cf.Stdout(), `
 To request access to these resources, run
 > tsh request create --resource %s \
     --reason <request reason>
 
 `, resourcesStr)
-	}
+		}
 
-	return nil
+		return nil
+
+	case teleport.YAML:
+		return trace.Wrap(utils.WriteYAMLArray(cf.Stdout(), rows))
+	case teleport.JSON:
+		return trace.Wrap(utils.WriteJSONArray(cf.Stdout(), rows))
+	default:
+		return trace.BadParameter("unsupported format %q", cf.Format)
+	}
 }
 
-// ignoreDuplicateResourceId returns true if the resource ID is a duplicate
+// ignoreDuplicateResourceID returns true if the resource ID is a duplicate
 // and should be ignored. Otherwise, it returns false and adds the resource ID
 // to the deduplicateResourceIDs map.
-func ignoreDuplicateResourceId(deduplicateResourceIDs map[string]struct{}, resourceID string) bool {
+func ignoreDuplicateResourceID(deduplicateResourceIDs map[string]struct{}, resourceID string) bool {
 	// Ignore duplicate resource IDs.
 	if _, ok := deduplicateResourceIDs[resourceID]; ok {
 		return true
diff --git a/tool/tsh/common/access_request_test.go b/tool/tsh/common/access_request_test.go
index 9b4c5bafff653..e2c18b1841b16 100644
--- a/tool/tsh/common/access_request_test.go
+++ b/tool/tsh/common/access_request_test.go
@@ -33,12 +33,13 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
 func TestAccessRequestSearch(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -116,9 +117,9 @@ func TestAccessRequestSearch(t *testing.T) {
 				table := asciitable.MakeTableWithTruncatedColumn(
 					[]string{"Name", "Namespace", "Labels", "Resource ID"},
 					[][]string{
-						{"nginx-1", "default", "", fmt.Sprintf("/%s/pod/%s/default/nginx-1", rootClusterName, rootKubeCluster)},
-						{"nginx-2", "default", "", fmt.Sprintf("/%s/pod/%s/default/nginx-2", rootClusterName, rootKubeCluster)},
-						{"test", "default", "", fmt.Sprintf("/%s/pod/%s/default/test", rootClusterName, rootKubeCluster)},
+						{"nginx-1", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/nginx-1", rootClusterName, rootKubeCluster)},
+						{"nginx-2", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/nginx-2", rootClusterName, rootKubeCluster)},
+						{"test", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/test", rootClusterName, rootKubeCluster)},
 					},
 					"Labels")
 				return table.AsBuffer().String()
@@ -135,7 +136,7 @@ func TestAccessRequestSearch(t *testing.T) {
 				table := asciitable.MakeTableWithTruncatedColumn(
 					[]string{"Name", "Namespace", "Labels", "Resource ID"},
 					[][]string{
-						{"nginx-1", "dev", "", fmt.Sprintf("/%s/pod/%s/dev/nginx-1", rootClusterName, rootKubeCluster)},
+						{"nginx-1", "dev", "", fmt.Sprintf("/%s/kube:ns:pods/%s/dev/nginx-1", rootClusterName, rootKubeCluster)},
 					},
 					"Labels")
 				return table.AsBuffer().String()
@@ -152,9 +153,9 @@ func TestAccessRequestSearch(t *testing.T) {
 				table := asciitable.MakeTableWithTruncatedColumn(
 					[]string{"Name", "Namespace", "Labels", "Resource ID"},
 					[][]string{
-						{"nginx-1", "default", "", fmt.Sprintf("/%s/pod/%s/default/nginx-1", leafClusterName, leafKubeCluster)},
-						{"nginx-2", "default", "", fmt.Sprintf("/%s/pod/%s/default/nginx-2", leafClusterName, leafKubeCluster)},
-						{"test", "default", "", fmt.Sprintf("/%s/pod/%s/default/test", leafClusterName, leafKubeCluster)},
+						{"nginx-1", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/nginx-1", leafClusterName, leafKubeCluster)},
+						{"nginx-2", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/nginx-2", leafClusterName, leafKubeCluster)},
+						{"test", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/test", leafClusterName, leafKubeCluster)},
 					},
 					"Labels")
 				return table.AsBuffer().String()
@@ -171,8 +172,8 @@ func TestAccessRequestSearch(t *testing.T) {
 				table := asciitable.MakeTableWithTruncatedColumn(
 					[]string{"Name", "Namespace", "Labels", "Resource ID"},
 					[][]string{
-						{"nginx-1", "default", "", fmt.Sprintf("/%s/pod/%s/default/nginx-1", leafClusterName, leafKubeCluster)},
-						{"nginx-1", "dev", "", fmt.Sprintf("/%s/pod/%s/dev/nginx-1", leafClusterName, leafKubeCluster)},
+						{"nginx-1", "default", "", fmt.Sprintf("/%s/kube:ns:pods/%s/default/nginx-1", leafClusterName, leafKubeCluster)},
+						{"nginx-1", "dev", "", fmt.Sprintf("/%s/kube:ns:pods/%s/dev/nginx-1", leafClusterName, leafKubeCluster)},
 					},
 					"Labels")
 				return table.AsBuffer().String()
@@ -200,10 +201,12 @@ func TestAccessRequestSearch(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			defer cancel()
 			homePath, _ := mustLoginLegacy(t, s, tc.args.teleportCluster)
 			captureStdout := new(bytes.Buffer)
 			err := Run(
-				context.Background(),
+				ctx,
 				append([]string{
 					"--insecure",
 					"request",
@@ -291,3 +294,354 @@ func TestShowRequestTable(t *testing.T) {
 		})
 	}
 }
+
+func TestRequestSearchRequestableRoles(t *testing.T) {
+	ctx := t.Context()
+	tmpHomePath := t.TempDir()
+	connector := mockConnector(t)
+
+	accessRole, err := types.NewRole("access", types.RoleSpecV6{})
+	require.NoError(t, err)
+	accessRole.SetMetadata(types.Metadata{
+		Name:        "access",
+		Description: "base access role",
+	})
+
+	dbAdminRole, err := types.NewRole("db-admin", types.RoleSpecV6{})
+	require.NoError(t, err)
+	dbAdminRole.SetMetadata(types.Metadata{
+		Name:        "db-admin",
+		Description: "database administrator role",
+	})
+
+	unrequestableRole, err := types.NewRole("unrequestable", types.RoleSpecV6{})
+	require.NoError(t, err)
+	unrequestableRole.SetMetadata(types.Metadata{
+		Name:        "unrequestable",
+		Description: "role that exists but is not requestable for this user",
+	})
+
+	requesterRole, err := types.NewRole("requester", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				Roles: []string{"access", "db-admin"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	user, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	user.SetRoles([]string{"requester"})
+
+	auth, proxy := makeTestServers(t,
+		withBootstrap(
+			connector,
+			accessRole,
+			dbAdminRole,
+			unrequestableRole,
+			requesterRole,
+			user,
+		),
+	)
+	authServer := auth.GetAuthServer()
+	require.NotNil(t, authServer)
+
+	proxyAddr, err := proxy.ProxyWebAddr()
+	require.NoError(t, err)
+
+	err = Run(ctx, []string{
+		"login",
+		"--insecure",
+		"--debug",
+		"--proxy", proxyAddr.String(),
+	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, user, connector.GetName()))
+	require.NoError(t, err)
+
+	wantRolesTable := func() string {
+		table := asciitable.MakeTable([]string{"Role", "Description"})
+		table.AddRow([]string{"access", "base access role"})
+		table.AddRow([]string{"db-admin", "database administrator role"})
+		return table.AsBuffer().String()
+	}
+
+	tests := []struct {
+		name string
+		args []string
+		// If empty, we expect the command to succeed.
+		errMessage string
+		want       func() string
+	}{
+		{
+			name:       "list requestable roles",
+			args:       []string{"request", "search", "--roles"},
+			errMessage: "",
+			want:       wantRolesTable,
+		},
+		{
+			name:       "both kind and roles set",
+			args:       []string{"request", "search", "--kind=node", "--roles"},
+			errMessage: "only one of --kind and --roles may be specified",
+			want:       nil,
+		},
+		{
+			name:       "neither kind nor roles set",
+			args:       []string{"request", "search"},
+			errMessage: "one of --kind and --roles is required",
+			want:       nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var stdout bytes.Buffer
+
+			err := Run(ctx,
+				append([]string{"--insecure"}, tc.args...),
+				setHomePath(tmpHomePath),
+				setCopyStdout(&stdout),
+			)
+
+			if tc.errMessage != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.errMessage)
+				return
+			}
+
+			require.NoError(t, err)
+			if tc.want != nil {
+				require.Equal(t, tc.want(), stdout.String())
+			}
+		})
+	}
+}
+
+func TestPrintRequestableResources(t *testing.T) {
+	rows := []kubeResourceRow{
+		{
+			Name:       "pod-1",
+			Namespace:  "default",
+			Labels:     "env=prod",
+			ResourceID: "id1",
+		},
+		{
+			Name:       "pod-2",
+			Namespace:  "dev",
+			Labels:     "env=dev",
+			ResourceID: "id2",
+		},
+	}
+	resourceIDs := []string{"id1", "id2"}
+
+	t.Run("text", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+		}
+
+		err := printRequestableResources(cf, rows, resourceIDs)
+		require.NoError(t, err)
+
+		// Build expected table using asciitable.
+		table := asciitable.MakeTable(
+			[]string{"Name", "Namespace", "Labels", "Resource ID"},
+			[][]string{
+				{"pod-1", "default", "env=prod", "id1"},
+				{"pod-2", "dev", "env=dev", "id2"},
+			}...,
+		)
+		expectedTable := table.AsBuffer().String()
+		out := buf.String()
+
+		require.Contains(t, out, expectedTable)
+		require.Contains(t, out, "To request access to these resources, run")
+	})
+
+	t.Run("json", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "json",
+		}
+
+		err := printRequestableResources(cf, rows, resourceIDs)
+		require.NoError(t, err)
+
+		got := buf.String()
+		wantJSON := `
+[
+{
+	"Name": "pod-1",
+	"Namespace": "default",
+	"Labels": "env=prod",
+	"ResourceID": "id1"
+},
+{
+	"Name": "pod-2",
+	"Namespace": "dev",
+	"Labels": "env=dev",
+	"ResourceID": "id2"
+}
+]
+`
+		require.JSONEq(t, wantJSON, got)
+	})
+
+	t.Run("yaml", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "yaml",
+		}
+
+		err := printRequestableResources(cf, rows, resourceIDs)
+		require.NoError(t, err)
+
+		got := buf.String()
+		wantYAML := `
+- Name: pod-1
+  Namespace: default
+  Labels: env=prod
+  ResourceID: id1
+- Name: pod-2
+  Namespace: dev
+  Labels: env=dev
+  ResourceID: id2
+`
+		require.YAMLEq(t, wantYAML, got)
+	})
+
+	t.Run("empty rows text", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "",
+			Verbose:        true,
+		}
+
+		err := printRequestableResources(cf, []kubeResourceRow{}, nil)
+		require.NoError(t, err)
+
+		out := buf.String()
+		table := asciitable.MakeTable(
+			[]string{"Name", "Namespace", "Labels", "Resource ID"},
+		)
+		expectedTable := table.AsBuffer().String()
+		require.Equal(t, expectedTable, out)
+	})
+
+	t.Run("unsupported format", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "random",
+		}
+
+		err := printRequestableResources(cf, rows, resourceIDs)
+		require.Error(t, err)
+	})
+}
+
+func TestPrintRequestableRoles(t *testing.T) {
+	rows := []requestableRoleRow{
+		{
+			Role:        "access",
+			Description: "base access role",
+		},
+		{
+			Role:        "db-admin",
+			Description: "database administrator role",
+		},
+	}
+
+	t.Run("text", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+		}
+
+		err := printRequestableRoles(cf, rows)
+		require.NoError(t, err)
+
+		table := asciitable.MakeTable(
+			[]string{"Role", "Description"},
+			[][]string{
+				{"access", "base access role"},
+				{"db-admin", "database administrator role"},
+			}...,
+		)
+		expectedTable := table.AsBuffer().String()
+		out := buf.String()
+
+		require.Equal(t, expectedTable, out)
+	})
+
+	t.Run("json", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "json",
+		}
+
+		err := printRequestableRoles(cf, rows)
+		require.NoError(t, err)
+
+		got := buf.String()
+		const wantJSON = `
+[
+  {
+    "Role": "access",
+    "Description": "base access role"
+  },
+  {
+    "Role": "db-admin",
+    "Description": "database administrator role"
+  }
+]
+`
+		require.JSONEq(t, wantJSON, got)
+	})
+
+	t.Run("yaml", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "yaml",
+		}
+
+		err := printRequestableRoles(cf, rows)
+		require.NoError(t, err)
+
+		got := buf.String()
+		const wantYAML = `
+- Role: access
+  Description: base access role
+- Role: db-admin
+  Description: database administrator role
+`
+		require.YAMLEq(t, wantYAML, got)
+	})
+
+	t.Run("empty roles text", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+		}
+
+		err := printRequestableRoles(cf, nil)
+		require.NoError(t, err)
+
+		require.Equal(t, "No requestable roles found.\n", buf.String())
+	})
+
+	t.Run("unsupported_format", func(t *testing.T) {
+		var buf bytes.Buffer
+		cf := &CLIConf{
+			OverrideStdout: &buf,
+			Format:         "random",
+		}
+
+		err := printRequestableRoles(cf, rows)
+		require.Error(t, err)
+	})
+}
diff --git a/tool/tsh/common/app.go b/tool/tsh/common/app.go
index 43d20a558898f..3c82a34657c6d 100644
--- a/tool/tsh/common/app.go
+++ b/tool/tsh/common/app.go
@@ -29,6 +29,7 @@ import (
 	"text/template"
 
 	"github.com/ghodss/yaml"
+	"github.com/google/safetext/shsprintf"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
@@ -79,6 +80,10 @@ func onAppLogin(cf *CLIConf) error {
 	}
 	defer clusterClient.Close()
 
+	if app.IsMCP() {
+		return trace.BadParameter("MCP applications are not supported. Please see 'tsh mcp config --help' for more details.")
+	}
+
 	if err := validateTargetPort(app, int(cf.TargetPort)); err != nil {
 		return trace.Wrap(err)
 	}
@@ -99,22 +104,114 @@ func onAppLogin(cf *CLIConf) error {
 		AccessRequests: appInfo.profile.ActiveRequests,
 	}
 
+	// When using `tsh app login`, certs should generally be saved to disk, whether standard certs or
+	// single-use MFA-verified 1m TTL certs. However, in cases where we are exceeding the standard
+	// 1m TTL for single-use certs, we must ensure the certs are not saved to disk.
+	saveCertificateToDisk := true
+	if app.GetAWSRolesAnywhereProfileARN() != "" {
+		singleUseCerts, err := isMFARequiredForAppAccess(cf.Context, tc, appInfo.RouteToApp)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if singleUseCerts {
+			// Prevent single use certificates from being written to disk.
+			saveCertificateToDisk = false
+
+			appCertParams.RequesterName = proto.UserCertsRequest_TSH_APP_AWS_CREDENTIALPROCESS
+
+			// When using single use certs (aka per-session MFA), tsh cannot write the certificate or AWS credentials to disk.
+			// Instead, ask user to use the `--env` flag which only outputs the credentials, in an eval friendly format.
+			if !cf.AppLoginAWSEnvOutput {
+				return trace.BadParameter(`AWS access is configured to use per-session MFA and credentials are only available to a single session. Pass the --env flag to the previous command and export the credentials using eval.
+Example:
+        eval "$(tsh apps login %s --aws-role %s --env)"
+
+You can now run the AWS CLI or other AWS SDK based tools as usual.
+Example:
+        aws sts get-caller-identity`,
+					shsprintf.EscapeDefaultContext(app.GetName()),
+					shsprintf.EscapeDefaultContext(appInfo.RouteToApp.AWSRoleARN),
+				)
+			}
+		}
+	}
+
 	key, err := appLogin(cf.Context, clusterClient, rootClient, appCertParams)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err := tc.LocalAgent().AddAppKeyRing(key); err != nil {
+	if saveCertificateToDisk {
+		if err := tc.LocalAgent().AddAppKeyRing(key); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	appInfo, err = reloadAppInfoFromKeyring(app, appInfo, key)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := writeFilesForExternalApps(cf.Stdout(), appInfo, cf.AppLoginAWSEnvOutput); err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err := printAppCommand(cf, tc, app, routeToApp); err != nil {
+	if err := printAppCommand(cf, tc, app, appInfo); err != nil {
 		return trace.Wrap(err)
 	}
 
 	return nil
 }
 
+// isMFARequiredForAppAccess calls the IsMFARequired endpoint in order to get from user roles if access to the application
+// requires MFA.
+func isMFARequiredForAppAccess(ctx context.Context, tc *client.TeleportClient, routeToApp proto.RouteToApp) (bool, error) {
+	clusterClient, err := tc.ConnectToCluster(ctx)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer clusterClient.Close()
+
+	mfaResp, err := clusterClient.AuthClient.IsMFARequired(ctx, &proto.IsMFARequiredRequest{
+		Target: &proto.IsMFARequiredRequest_App{
+			App: &routeToApp,
+		},
+	})
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	return mfaResp.GetRequired(), nil
+}
+
+func reloadAppInfoFromKeyring(app types.Application, appInfo *appInfo, key *client.KeyRing) (*appInfo, error) {
+	// AWS Access ugin Roles Anywhere integration receive the credentials in the certificate.
+	// For all other apps, the routeToApp is already correct.
+	if app.GetAWSRolesAnywhereProfileARN() == "" {
+		return appInfo, nil
+	}
+
+	// AWS Apps using AWS Roles Anywhere for granting access receive the AWS Credentials in the certificate.
+	appCerts, err := key.AppTLSCertificates()
+	if err != nil {
+		return appInfo, trace.Wrap(err)
+	}
+
+	for _, cert := range appCerts {
+		tlsID, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
+		if err != nil {
+			return appInfo, trace.Wrap(err)
+		}
+
+		if tlsID.RouteToApp.Name == appInfo.RouteToApp.Name {
+			appInfo.RouteToApp = tlscaRouteToAppToProto(tlsID.RouteToApp)
+			return appInfo, nil
+		}
+	}
+
+	return appInfo, nil
+}
+
 func appLogin(
 	ctx context.Context,
 	clusterClient *client.ClusterClient,
@@ -132,7 +229,8 @@ func localProxyRequiredForApp(tc *client.TeleportClient) bool {
 	return tc.TLSRoutingConnUpgradeRequired
 }
 
-func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Application, routeToApp proto.RouteToApp) error {
+func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Application, appInfo *appInfo) error {
+	routeToApp := appInfo.RouteToApp
 	output := cf.Stdout()
 	if cf.Quiet {
 		output = io.Discard
@@ -140,10 +238,25 @@ func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Applicati
 
 	switch {
 	case app.IsAWSConsole():
+		// When using env output, skip printing the login instructions because they were already emitted alongside the env var exports.
+		if cf.AppLoginAWSEnvOutput {
+			return nil
+		}
+
+		if routeToApp.AWSCredentialProcessCredentials != "" {
+			return awsNamedProfileLoginTemplate.Execute(output, map[string]string{
+				"awsAppName":        app.GetName(),
+				"escapedAWSAppName": shsprintf.EscapeDefaultContext(app.GetName()),
+				"awsCmd":            "s3 ls",
+				"awsRoleARN":        routeToApp.AWSRoleARN,
+			})
+		}
+
 		return awsLoginTemplate.Execute(output, map[string]string{
-			"awsAppName": app.GetName(),
-			"awsCmd":     "s3 ls",
-			"awsRoleARN": routeToApp.AWSRoleARN,
+			"awsAppName":        app.GetName(),
+			"escapedAWSAppName": shsprintf.EscapeDefaultContext(app.GetName()),
+			"awsCmd":            "s3 ls",
+			"awsRoleARN":        routeToApp.AWSRoleARN,
 		})
 
 	case app.IsAzureCloud():
@@ -151,11 +264,24 @@ func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Applicati
 			return trace.BadParameter("app is Azure Cloud but Azure identity is missing")
 		}
 
-		var args []string
+		azureApp, err := newAzureApp(tc, cf, appInfo)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		resourceArgumentName := "--username"
+		// After the CLI started relying in MSAL by default, the param for the
+		// managed identity changed.
+		//
+		// https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli?view=azure-cli-latest#profile
+		if azureApp.usingMSAL() {
+			resourceArgumentName = "--resource-id"
+		}
+
+		args := []string{"az", "login", "--identity", resourceArgumentName, routeToApp.AzureIdentity}
 		if cf.Debug {
 			args = append(args, "--debug")
 		}
-		args = append(args, "az", "login", "--identity", "-u", routeToApp.AzureIdentity)
 
 		// automatically login with right identity.
 		cmd := exec.Command(cf.executablePath, args...)
@@ -164,8 +290,7 @@ func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Applicati
 		cmd.Stdout = output
 
 		logger.DebugContext(cf.Context, "Running automatic az login", "command", logutils.StringerAttr(cmd))
-		err := cf.RunCommand(cmd)
-		if err != nil {
+		if err := cf.RunCommand(cmd); err != nil {
 			return trace.Wrap(err, "failed to automatically login with `az login` using identity %q; run with --debug for details", routeToApp.AzureIdentity)
 		}
 
@@ -187,13 +312,14 @@ func printAppCommand(cf *CLIConf, tc *client.TeleportClient, app types.Applicati
 		}
 
 		return tcpAppLoginTemplate.Execute(output, map[string]string{
-			"appName":                       app.GetName(),
+			"appName":                       shsprintf.EscapeDefaultContext(app.GetName()),
 			"appNameWithOptionalTargetPort": appNameWithOptionalTargetPort,
 		})
 
 	case localProxyRequiredForApp(tc):
-		return webAppLoginProxyTemplate.Execute(output, map[string]interface{}{
-			"appName": app.GetName(),
+		return webAppLoginProxyTemplate.Execute(output, map[string]any{
+			"appName":        app.GetName(),
+			"escapedAppName": shsprintf.EscapeDefaultContext(app.GetName()),
 		})
 
 	default:
@@ -239,7 +365,7 @@ WARNING: tsh was called with --insecure, so this curl command will be unable to
 var webAppLoginProxyTemplate = template.Must(template.New("").Parse(
 	`Logged into app {{.appName}}. Start the local proxy for it:
 
-  tsh proxy app {{.appName}} -p 8080
+  tsh proxy app {{.escapedAppName}} -p 8080
 
 Then connect to the application through this proxy:
 
@@ -268,7 +394,21 @@ Example AWS CLI command:
   tsh aws {{.awsCmd}}
 
 Or start a local proxy:
-  tsh proxy aws --app {{.awsAppName}}
+  tsh proxy aws --app {{.escapedAWSAppName}}
+`))
+
+// awsNamedProfileLoginTemplate is the message that gets printed to a user upon successful login
+// into an AWS Console application which provides AWS credentials in the `credential_process` schema.
+// Used for named profiles, where the profile name is the same as the app name.
+var awsNamedProfileLoginTemplate = template.Must(template.New("").Parse(
+	`Logged into AWS app "{{.awsAppName}}".
+
+Your IAM role:
+  {{.awsRoleARN}}
+
+Example AWS CLI commands:
+  aws --profile {{.awsAppName}} {{.awsCmd}}
+  AWS_PROFILE={{.awsAppName}} aws {{.awsCmd}}
 `))
 
 // azureLoginTemplate is the message that gets printed to a user upon successful login
@@ -342,6 +482,12 @@ func onAppLogout(cf *CLIConf) error {
 				"error", err,
 				"profile", profile.AppLocalCAPath(tc.SiteName, app.Name))
 		}
+
+		if err := removeExternalFilesForApp(app); err != nil {
+			logger.WarnContext(cf.Context, "Failed to clean up app external files",
+				"error", err,
+				"app", cf.AppName)
+		}
 	}
 
 	if cf.AppName == "" {
@@ -349,6 +495,11 @@ func onAppLogout(cf *CLIConf) error {
 		if err := tc.LogoutAllApps(); err != nil {
 			return trace.Wrap(err)
 		}
+
+		if err := removeExternalFilesForAllApps(); err != nil {
+			logger.WarnContext(cf.Context, "Failed to clean up apps external files",
+				"error", err)
+		}
 	}
 
 	if len(logout) == 1 {
@@ -378,13 +529,14 @@ func onAppConfig(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 	routeToApp := proto.RouteToApp{
-		Name:              app.Name,
-		PublicAddr:        app.PublicAddr,
-		ClusterName:       app.ClusterName,
-		AWSRoleARN:        app.AWSRoleARN,
-		AzureIdentity:     app.AzureIdentity,
-		GCPServiceAccount: app.GCPServiceAccount,
-		URI:               app.GetURI(),
+		Name:                            app.Name,
+		PublicAddr:                      app.PublicAddr,
+		ClusterName:                     app.ClusterName,
+		AWSCredentialProcessCredentials: app.AWSCredentialProcessCredentials,
+		AWSRoleARN:                      app.AWSRoleARN,
+		AzureIdentity:                   app.AzureIdentity,
+		GCPServiceAccount:               app.GCPServiceAccount,
+		URI:                             app.GetURI(),
 	}
 	conf, err := formatAppConfig(tc, profile, routeToApp, cf.Format)
 	if err != nil {
@@ -409,6 +561,9 @@ const (
 	appFormatJSON = "json"
 	// appFormatYAML prints app URI, CA cert path, cert path, key path, and curl command in YAML format.
 	appFormatYAML = "yaml"
+	// appFormatAWSCredentialProcessOutput prints the credentials for accessing AWS Console using the `credential_process` schema.
+	// See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html
+	appFormatAWSCredentialProcessOutput = "aws-credential-process"
 )
 
 func formatAppConfig(tc *client.TeleportClient, profile *client.ProfileStatus, routeToApp proto.RouteToApp, format string) (string, error) {
@@ -434,7 +589,7 @@ func formatAppConfig(tc *client.TeleportClient, profile *client.ProfileStatus, r
 		curlInsecureFlag,
 		certPath,
 		keyPath,
-		uri)
+		shsprintf.EscapeDefaultContext(uri))
 	format = strings.ToLower(format)
 	switch format {
 	case appFormatURI:
@@ -447,6 +602,8 @@ func formatAppConfig(tc *client.TeleportClient, profile *client.ProfileStatus, r
 		return keyPath, nil
 	case appFormatCURL:
 		return curlCmd, nil
+	case appFormatAWSCredentialProcessOutput:
+		return routeToApp.AWSCredentialProcessCredentials, nil
 	case appFormatJSON, appFormatYAML:
 		appConfig := &appConfigInfo{
 			Name:              routeToApp.Name,
@@ -704,12 +861,13 @@ func pickActiveApp(cf *CLIConf, activeRoutes []tlsca.RouteToApp) (proto.RouteToA
 
 func tlscaRouteToAppToProto(route tlsca.RouteToApp) proto.RouteToApp {
 	return proto.RouteToApp{
-		Name:              route.Name,
-		PublicAddr:        route.PublicAddr,
-		ClusterName:       route.ClusterName,
-		AWSRoleARN:        route.AWSRoleARN,
-		AzureIdentity:     route.AzureIdentity,
-		GCPServiceAccount: route.GCPServiceAccount,
-		URI:               route.URI,
+		Name:                            route.Name,
+		PublicAddr:                      route.PublicAddr,
+		ClusterName:                     route.ClusterName,
+		AWSRoleARN:                      route.AWSRoleARN,
+		AWSCredentialProcessCredentials: route.AWSCredentialProcessCredentials,
+		AzureIdentity:                   route.AzureIdentity,
+		GCPServiceAccount:               route.GCPServiceAccount,
+		URI:                             route.URI,
 	}
 }
diff --git a/tool/tsh/common/app_aws_test.go b/tool/tsh/common/app_aws_test.go
index 74bbe543448fc..9cc2793eb3d98 100644
--- a/tool/tsh/common/app_aws_test.go
+++ b/tool/tsh/common/app_aws_test.go
@@ -22,15 +22,23 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib"
+	"github.com/gravitational/teleport/lib/auth/mocku2f"
+	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
+	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
@@ -43,8 +51,8 @@ func TestAWS(t *testing.T) {
 
 	connector := mockConnector(t)
 	user, awsRole := makeUserWithAWSRole(t)
-	authProcess := testserver.MakeTestServer(
-		t,
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
 		testserver.WithBootstrap(connector, user, awsRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -57,6 +65,11 @@ func TestAWS(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -150,6 +163,263 @@ func TestAWS(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestAWSRolesAnywhereBasedAccess(t *testing.T) {
+	ctx := context.Background()
+
+	tmpHomePath := t.TempDir()
+
+	awsConfigFile := filepath.Join(tmpHomePath, "aws_config")
+	t.Setenv("AWS_CONFIG_FILE", awsConfigFile)
+
+	connector := mockConnector(t)
+	user, awsRole := makeUserWithAWSRole(t)
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithBootstrap(connector, user, awsRole),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
+
+	expectedAWSCredentials := `{"Version":1,"AccessKeyId":"aki","SecretAccessKey":"sak","SessionToken":"st","Expiration":"2025-06-25T12:07:02.474135Z"}`
+	authProcess.GetAuthServer().AWSRolesAnywhereCreateSessionOverride = func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+		return &createsession.CreateSessionResponse{
+			Version:         1,
+			AccessKeyID:     "aki",
+			SecretAccessKey: "sak",
+			SessionToken:    "st",
+			Expiration:      "2025-06-25T12:07:02.474135Z",
+		}, nil
+	}
+
+	integrationName := "aws-app"
+	profileName := "aws-profile"
+	integration, err := types.NewIntegrationAWSRA(
+		types.Metadata{Name: integrationName},
+		&types.AWSRAIntegrationSpecV1{
+			TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+		},
+	)
+	require.NoError(t, err)
+	_, err = authProcess.GetAuthServer().CreateIntegration(ctx, integration)
+	require.NoError(t, err)
+
+	awsAppUsingRolesAnywhere, err := types.NewAppServerV3(types.Metadata{
+		Name: profileName,
+	}, types.AppServerSpecV3{
+		HostID: authProcess.GetID(),
+		App: &types.AppV3{Metadata: types.Metadata{
+			Name: profileName,
+		}, Spec: types.AppSpecV3{
+			URI:         constants.AWSConsoleURL,
+			Integration: integrationName,
+			AWS: &types.AppAWS{
+				RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
+					ProfileARN:            "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+					AcceptRoleSessionName: true,
+				},
+			},
+			PublicAddr: "example.com",
+		}},
+	})
+	require.NoError(t, err)
+
+	_, err = authProcess.GetAuthServer().UpsertApplicationServer(ctx, awsAppUsingRolesAnywhere)
+	require.NoError(t, err)
+
+	authServer := authProcess.GetAuthServer()
+	require.NotNil(t, authServer)
+
+	proxyAddr, err := authProcess.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Log into Teleport cluster.
+	err = Run(ctx, []string{
+		"login", "--insecure", "--debug", "--proxy", proxyAddr.String(),
+	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, user, connector.GetName()))
+	require.NoError(t, err)
+
+	// Log into the "aws-profile" app.
+	err = Run(
+		ctx,
+		[]string{"apps", "login", "--insecure", "--aws-role", "some-aws-role", profileName},
+		setHomePath(tmpHomePath),
+	)
+	require.NoError(t, err)
+
+	// check if external files were set correctly
+	require.FileExists(t, awsConfigFile)
+
+	// check if certificate file was written
+	expectedCredentialFilePath := filepath.Join(tmpHomePath, "keys", proxyAddr.Host(), user.GetName()+"-app", "server01", profileName+".crt")
+	require.FileExists(t, expectedCredentialFilePath)
+
+	awsConfigContents, err := os.ReadFile(awsConfigFile)
+	require.NoError(t, err)
+
+	expectedProfileConfig := `; Do not edit. Section managed by Teleport.
+[profile aws-profile]
+credential_process=tsh apps config --format aws-credential-process aws-profile
+`
+	require.Equal(t, expectedProfileConfig, string(awsConfigContents))
+
+	// Running the tsh apps config command should return the credentials
+	appsConfigcommandOutput := &bytes.Buffer{}
+	err = Run(
+		ctx,
+		[]string{"apps", "config", "--format", "aws-credential-process", profileName},
+		setHomePath(tmpHomePath),
+		setCopyStdout(appsConfigcommandOutput),
+	)
+	require.NoError(t, err)
+	require.JSONEq(t, expectedAWSCredentials, appsConfigcommandOutput.String())
+
+	// Profile is removed after logout.
+	err = Run(
+		ctx,
+		[]string{"apps", "logout", "--insecure"},
+		setHomePath(tmpHomePath),
+	)
+	require.NoError(t, err)
+
+	awsConfigContents, err = os.ReadFile(awsConfigFile)
+	require.NoError(t, err)
+	require.Empty(t, awsConfigContents)
+}
+
+func TestAWSRolesAnywhereBasedAccess_usingMFA(t *testing.T) {
+	tmpHomePath := t.TempDir()
+
+	awsConfigFile := filepath.Join(tmpHomePath, "aws_config")
+	t.Setenv("AWS_CONFIG_FILE", awsConfigFile)
+
+	connector := mockConnector(t)
+
+	user, awsRole := makeUserWithAWSRole(t)
+	awsRoleOptions := awsRole.GetOptions()
+	awsRoleOptions.RequireMFAType = types.RequireMFAType_SESSION
+	awsRole.SetOptions(awsRoleOptions)
+
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithBootstrap(connector, user, awsRole),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
+
+	authServer := authProcess.GetAuthServer()
+	proxyAddr, err := authProcess.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Set up MFA device for the user.
+	origin := "https://127.0.0.1"
+	device, err := mocku2f.Create()
+	require.NoError(t, err)
+	device.SetPasswordless()
+	webauthnLoginOpt := setupWebAuthnChallengeSolver(device, true /* success */)
+
+	_, err = authProcess.GetAuthServer().UpsertAuthPreference(t.Context(), &types.AuthPreferenceV2{
+		Spec: types.AuthPreferenceSpecV2{
+			SecondFactor: constants.SecondFactorOptional,
+			Webauthn: &types.Webauthn{
+				RPID: "127.0.0.1",
+			},
+			RequireMFAType: types.RequireMFAType_SESSION,
+		},
+	})
+	require.NoError(t, err)
+	registerDeviceForUser(t, authServer, device, user.GetName(), origin)
+
+	authServer.AWSRolesAnywhereCreateSessionOverride = func(ctx context.Context, req createsession.CreateSessionRequest) (*createsession.CreateSessionResponse, error) {
+		return &createsession.CreateSessionResponse{
+			Version:         1,
+			AccessKeyID:     "aki",
+			SecretAccessKey: "sak",
+			SessionToken:    "st",
+			Expiration:      "2025-06-25T12:07:02.474135Z",
+		}, nil
+	}
+
+	integrationName := "aws-app"
+	profileName := "aws-profile"
+	integration, err := types.NewIntegrationAWSRA(
+		types.Metadata{Name: integrationName},
+		&types.AWSRAIntegrationSpecV1{
+			TrustAnchorARN: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+		},
+	)
+	require.NoError(t, err)
+	_, err = authProcess.GetAuthServer().CreateIntegration(t.Context(), integration)
+	require.NoError(t, err)
+
+	awsAppUsingRolesAnywhere, err := types.NewAppServerV3(types.Metadata{
+		Name: profileName,
+	}, types.AppServerSpecV3{
+		HostID: authProcess.GetID(),
+		App: &types.AppV3{Metadata: types.Metadata{
+			Name: profileName,
+		}, Spec: types.AppSpecV3{
+			URI:         constants.AWSConsoleURL,
+			Integration: integrationName,
+			AWS: &types.AppAWS{
+				RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
+					ProfileARN:            "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+					AcceptRoleSessionName: true,
+				},
+			},
+			PublicAddr: "example.com",
+		}},
+	})
+	require.NoError(t, err)
+
+	_, err = authServer.UpsertApplicationServer(t.Context(), awsAppUsingRolesAnywhere)
+	require.NoError(t, err)
+
+	// Log into Teleport cluster.
+	err = Run(t.Context(), []string{
+		"login", "--insecure", "--debug", "--proxy", proxyAddr.String(),
+	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, user, connector.GetName()))
+	require.NoError(t, err)
+
+	// Log into the "aws-profile" app.
+	err = Run(
+		t.Context(),
+		[]string{"apps", "login", "--insecure", "--aws-role", "some-aws-role", profileName},
+		setHomePath(tmpHomePath),
+		webauthnLoginOpt,
+	)
+	require.ErrorContains(t, err, "AWS access is configured to use per-session MFA")
+
+	// Log in again but now use the `--env` flag to export the credentials to the shell.
+	output := &bytes.Buffer{}
+	err = Run(
+		t.Context(),
+		[]string{"apps", "login", "--insecure", "--aws-role", "some-aws-role", profileName, "--env"},
+		setHomePath(tmpHomePath),
+		setOverrideStdout(output),
+		webauthnLoginOpt,
+	)
+	require.NoError(t, err)
+
+	require.Equal(t, `export AWS_ACCESS_KEY_ID=aki
+export AWS_SECRET_ACCESS_KEY=sak
+export AWS_SESSION_TOKEN=st
+# Export the above variables in your current shell to start using the AWS credentials.
+`, output.String())
+
+	// Verify that the AWS config file was not created.
+	require.NoFileExists(t, awsConfigFile)
+
+	// Verify that the certificate file was not created.
+	expectedCredentialFilePath := filepath.Join(tmpHomePath, "keys", proxyAddr.Host(), user.GetName()+"-app", "server01", profileName+".crt")
+	require.NoFileExists(t, expectedCredentialFilePath)
+}
+
 // TestAWSConsoleLogins given a AWS console application, execute a app login
 // without proving a role ARN and verify the provided list of available logins
 // is correct.
@@ -173,9 +443,9 @@ func TestAWSConsoleLogins(t *testing.T) {
 	require.NoError(t, err)
 	user.SetRoles([]string{"access", rootAWSRole.GetName()})
 	user.SetAWSRoleARNs(userARNs)
-	rootServer := testserver.MakeTestServer(
-		t,
-		testserver.WithClusterName(t, "root"),
+	rootServer, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName("root"),
 		testserver.WithBootstrap(connector, user, rootAWSRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -188,6 +458,11 @@ func TestAWSConsoleLogins(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 
 	leafARNs := []string{"arn:aws:iam::999999999999:role/leaf-1", "arn:aws:iam::999999999999:role/leaf-2"}
 	leafAWSRole, err := types.NewRole("aws", types.RoleSpecV6{
@@ -197,9 +472,9 @@ func TestAWSConsoleLogins(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	leafServer := testserver.MakeTestServer(
-		t,
-		testserver.WithClusterName(t, "leaf"),
+	leafServer, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName("leaf"),
 		testserver.WithBootstrap(leafAWSRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -212,7 +487,12 @@ func TestAWSConsoleLogins(t *testing.T) {
 			}
 		}),
 	)
-	testserver.SetupTrustedCluster(ctx, t, rootServer, leafServer, types.RoleMapping{Remote: "aws", Local: []string{"aws"}})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, leafServer.Close())
+		require.NoError(t, leafServer.Wait())
+	})
+	SetupTrustedCluster(ctx, t, rootServer, leafServer, types.RoleMapping{Remote: "aws", Local: []string{"aws"}})
 
 	authServer := rootServer.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -270,3 +550,54 @@ func makeUserWithAWSRole(t *testing.T) (types.User, types.Role) {
 	alice.SetRoles([]string{"access", awsRole.GetName()})
 	return alice, awsRole
 }
+
+func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) {
+	// Use insecure mode so that the trusted cluster can establish trust over reverse tunnel.
+	isInsecure := lib.IsInsecureDevMode()
+	lib.SetInsecureDevMode(true)
+	t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) })
+
+	rootProxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+	rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr()
+	require.NoError(t, err)
+
+	tc, err := types.NewTrustedCluster(rootServer.Config.Auth.ClusterName.GetClusterName(), types.TrustedClusterSpecV2{
+		Enabled:              true,
+		Token:                testserver.StaticToken,
+		ProxyAddress:         rootProxyAddr.String(),
+		ReverseTunnelAddress: rootProxyTunnelAddr.String(),
+		RoleMap: append(additionalRoleMappings,
+			types.RoleMapping{
+				Remote: "access",
+				Local:  []string{"access"},
+			},
+		),
+	})
+	require.NoError(t, err)
+
+	_, err = leafServer.GetAuthServer().UpsertTrustedClusterV2(ctx, tc)
+	require.NoError(t, err)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rt, err := rootServer.GetAuthServer().GetTunnelConnections(leafServer.Config.Auth.ClusterName.GetClusterName())
+		assert.NoError(t, err)
+		assert.Len(t, rt, 1)
+	}, time.Second*10, time.Second)
+
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rts, err := rootServer.GetAuthServer().GetRemoteClusters(ctx)
+		assert.NoError(t, err)
+		assert.Len(t, rts, 1)
+	}, time.Second*10, time.Second)
+
+	tsrv, err := rootServer.GetReverseTunnelServer()
+	require.NoError(t, err)
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		rts, err := tsrv.Cluster(ctx, leafServer.Config.Auth.ClusterName.GetClusterName())
+		require.NoError(t, err)
+		require.NotNil(t, rts)
+
+		require.Equal(t, 1, rts.GetTunnelsCount())
+	}, time.Second*10, time.Second)
+}
diff --git a/tool/tsh/common/app_azure.go b/tool/tsh/common/app_azure.go
index 74a70e770115d..d582d7bc5d6bb 100644
--- a/tool/tsh/common/app_azure.go
+++ b/tool/tsh/common/app_azure.go
@@ -19,16 +19,20 @@
 package common
 
 import (
+	"bytes"
 	"context"
 	"crypto"
 	"crypto/tls"
+	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strings"
+	"sync"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 
@@ -44,6 +48,24 @@ import (
 
 const (
 	azureCLIBinaryName = "az"
+
+	// msiEndpointEnvVarName defines the name of environment variable that
+	// contains the MSI endpoint value.
+	msiEndpointEnvVarName = "MSI_ENDPOINT"
+	// identityEndpointEnvVarName defines the name of environment variable that
+	// contains the App Service Identity endpoint value.
+	identityEndpointEnvVarName = "IDENTITY_ENDPOINT"
+	// identityHeaderEnvVarName defines the name of environment variable that
+	// contains the App Service Identity secret value.
+	identityHeaderEnvVarName = "IDENTITY_HEADER"
+)
+
+var (
+	// azureCLIVersionMSALRequirement represents the version the login with
+	// managed identities started using MSAL by default.
+	//
+	// https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli?view=azure-cli-latest#profile
+	azureCLIVersionMSALRequirement = semver.New("2.73.0")
 )
 
 func onAzure(cf *CLIConf) error {
@@ -73,13 +95,15 @@ func onAzure(cf *CLIConf) error {
 type azureApp struct {
 	*localProxyApp
 
-	cf        *CLIConf
-	msiSecret string
+	cf          *CLIConf
+	tokenSecret string
+	// fetchAzureCLIVersion retrieves the Azure CLI version.
+	fetchCLIVersion func() (*semver.Version, error)
 }
 
 // newAzureApp creates a new Azure app.
 func newAzureApp(tc *client.TeleportClient, cf *CLIConf, appInfo *appInfo) (*azureApp, error) {
-	msiSecret, err := getMSISecret()
+	msiSecret, err := getAzureTokenSecret()
 	if err != nil {
 		return nil, err
 	}
@@ -91,13 +115,42 @@ func newAzureApp(tc *client.TeleportClient, cf *CLIConf, appInfo *appInfo) (*azu
 	return &azureApp{
 		localProxyApp: localProxyApp,
 		cf:            cf,
-		msiSecret:     msiSecret,
+		tokenSecret:   msiSecret,
+		fetchCLIVersion: sync.OnceValues(func() (*semver.Version, error) {
+			// Retrieve the core version as it contains the login-related changes.
+			versionInfo := struct {
+				CLICoreVersion string `json:"azure-cli-core"`
+			}{}
+
+			var buf bytes.Buffer
+			cmd := exec.Command(azureCLIBinaryName, "version")
+			cmd.Stdout = &buf
+			if err := cf.RunCommand(cmd); err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			if err := json.Unmarshal(buf.Bytes(), &versionInfo); err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			ver, err := semver.NewVersion(versionInfo.CLICoreVersion)
+			return ver, trace.Wrap(err)
+		}),
 	}, nil
 }
 
-// getMSISecret will try to find the secret by parsing MSI_ENDPOINT env variable if present; it will return random hex string otherwise.
-func getMSISecret() (string, error) {
-	endpoint := os.Getenv("MSI_ENDPOINT")
+// getAzureTokenSecret will try to find the secret from the environment.
+// If not found it will return random hex string.
+func getAzureTokenSecret() (string, error) {
+	if secret, err := getAzureIdentitySecretToken(); !trace.IsNotFound(err) {
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+
+		return secret, nil
+	}
+
+	endpoint := os.Getenv(msiEndpointEnvVarName)
 	if endpoint == "" {
 		randomHex, err := utils.CryptoRandomHex(10)
 		if err != nil {
@@ -108,7 +161,7 @@ func getMSISecret() (string, error) {
 
 	expectedPrefix := "https://" + types.TeleportAzureMSIEndpoint + "/"
 	if !strings.HasPrefix(endpoint, expectedPrefix) {
-		return "", trace.BadParameter("MSI_ENDPOINT not empty, but doesn't start with %q as expected", expectedPrefix)
+		return "", trace.BadParameter("%q environment variable not empty, but doesn't start with %q as expected", msiEndpointEnvVarName, expectedPrefix)
 	}
 
 	secret := strings.TrimPrefix(endpoint, expectedPrefix)
@@ -118,21 +171,43 @@ func getMSISecret() (string, error) {
 	return secret, nil
 }
 
+// getAzureIdentitySecretToken returns the secret token for App Service Identity.
+func getAzureIdentitySecretToken() (string, error) {
+	endpoint := os.Getenv(identityEndpointEnvVarName)
+	secret := os.Getenv(identityHeaderEnvVarName)
+	if endpoint == "" && secret == "" {
+		return "", trace.NotFound("App Service Identity environment variables not provided")
+	}
+
+	if endpoint == "" || secret == "" {
+		return "", trace.BadParameter("%q and %q environment variables should be provided when using App Service Identity", identityEndpointEnvVarName, identityHeaderEnvVarName)
+	}
+
+	expectedPrefix := "https://" + types.TeleportAzureIdentityEndpoint
+	if !strings.HasPrefix(endpoint, expectedPrefix) {
+		return "", trace.BadParameter("%s not empty, but doesn't start with %q as expected", identityEndpointEnvVarName, expectedPrefix)
+	}
+
+	return secret, nil
+}
+
 // StartLocalProxies sets up local proxies for serving Azure clients.
 //
 // At minimum clients should work with these variables set:
 // - HTTPS_PROXY, for routing the traffic through the proxy
-// - MSI_ENDPOINT, for informing the client about credential provider endpoint
+// - MSI_ENDPOINT or IDENTITY_ENDPOINT, for informing the client about credential provider endpoint
 //
 // The request flow to remote server (i.e. Azure APIs) looks like this:
 // clients -> local forward proxy -> local ALPN proxy -> remote server
 //
-// However, with MSI_ENDPOINT variable set, clients will reach out to this address for tokens.
-// We intercept calls to https://azure-msi.teleport.dev using alpnproxy.AzureMSIMiddleware.
-// These calls are served entirely locally, which helps the overall performance experienced by the user.
+// However, with MSI_ENDPOINT or IDENTITY_ENDPOINT variable set, clients will
+// reach out to this address for tokens.
+// We intercept calls to those token endpoints using alpnproxy.AzureTokensMiddleware.
+// These calls are served entirely locally, which helps the overall performance
+// experienced by the user.
 func (a *azureApp) StartLocalProxies(ctx context.Context) error {
-	azureMiddleware := &alpnproxy.AzureMSIMiddleware{
-		Secret: a.msiSecret,
+	azureMiddleware := &alpnproxy.AzureTokenMiddleware{
+		Secret: a.tokenSecret,
 		// we could, in principle, get the actual TenantID either from live data or from static configuration,
 		// but at this moment there is no clear advantage over simply issuing a new random identifier.
 		TenantID: uuid.New().String(),
@@ -166,10 +241,6 @@ func (a *azureApp) GetEnvVars() (map[string]string, error) {
 		// 2. `az ...` in another console
 		// without custom config dir the second invocation will hang, attempting to connect to (inaccessible without configuration) MSI.
 		"AZURE_CONFIG_DIR": filepath.Join(profile.FullProfilePath(a.cf.HomePath), "azure", a.routeToApp.ClusterName, a.routeToApp.Name),
-		// setting MSI_ENDPOINT instructs Azure CLI to make managed identity calls on this address.
-		// the requests will be handled by tsh proxy.
-		"MSI_ENDPOINT": "https://" + types.TeleportAzureMSIEndpoint + "/" + a.msiSecret,
-
 		// Needed for az CLI to accept our certs.
 		// This isn't portable and applications other than az CLI may have to set different env variables,
 		// add the application cert to system root store (not recommended, ultimate fallback)
@@ -177,6 +248,22 @@ func (a *azureApp) GetEnvVars() (map[string]string, error) {
 		"REQUESTS_CA_BUNDLE": a.profile.AppLocalCAPath(a.cf.SiteName, a.routeToApp.Name),
 	}
 
+	if a.usingMSAL() {
+		// Setting App service Identity environment variables instructs Azure
+		// CLI to make managed identity calls on this address. The requests will
+		// be handled by tsh proxy. This is only required when Azure CLI
+		// defaults to using MSAL.
+		//
+		// https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#rest-endpoint-reference
+		envVars[identityEndpointEnvVarName] = "https://" + types.TeleportAzureIdentityEndpoint
+		envVars[identityHeaderEnvVarName] = a.tokenSecret
+	} else {
+		// Setting MSI environment variable instructs Azure CLI to make managed
+		// identity calls on this address. The requests will be handled by tsh
+		// proxy.
+		envVars[msiEndpointEnvVarName] = "https://" + types.TeleportAzureMSIEndpoint + "/" + a.tokenSecret
+	}
+
 	// Set proxy settings.
 	if a.localForwardProxy != nil {
 		envVars["HTTPS_PROXY"] = "http://" + a.localForwardProxy.GetAddr()
@@ -207,6 +294,19 @@ func (a *azureApp) RunCommand(cmd *exec.Cmd) error {
 	return nil
 }
 
+// usingMSAL returns true if the CLI is using Microsoft Authentication
+// Library (MSAL).
+func (a *azureApp) usingMSAL() bool {
+	ver, err := a.fetchCLIVersion()
+	if err != nil {
+		logger.WarnContext(a.cf.Context, "Unable to determine Azure CLI version. Assuming MSAL will be used.", "error", err)
+		return true
+	}
+
+	logger.DebugContext(a.cf.Context, "Azure CLI version", "version", ver)
+	return ver.Compare(*azureCLIVersionMSALRequirement) >= 0
+}
+
 func printAzureIdentities(identities []string) {
 	fmt.Println(formatAzureIdentities(identities))
 }
diff --git a/tool/tsh/common/app_azure_test.go b/tool/tsh/common/app_azure_test.go
index 2a0db09e4490c..01a2b5b66d034 100644
--- a/tool/tsh/common/app_azure_test.go
+++ b/tool/tsh/common/app_azure_test.go
@@ -22,8 +22,7 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/hex"
-	"encoding/json"
-	"io"
+	"fmt"
 	"net/http"
 	"net/url"
 	"os/exec"
@@ -31,6 +30,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -49,9 +49,9 @@ func TestAzure(t *testing.T) {
 	connector := mockConnector(t)
 	user, azureRole := makeUserWithAzureRole(t)
 
-	authProcess := testserver.MakeTestServer(
-		t,
-		testserver.WithClusterName(t, "localhost"),
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName("localhost"),
 		testserver.WithBootstrap(connector, user, azureRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -64,6 +64,11 @@ func TestAzure(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -79,136 +84,136 @@ func TestAzure(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	// set MSI_ENDPOINT along with secret
-	t.Setenv("MSI_ENDPOINT", "https://azure-msi.teleport.dev/very-secret")
-
-	// Log into Teleport cluster.
-	run([]string{"login", "--insecure", "--debug", "--proxy", proxyAddr.String()})
-
-	// Log into the "azure-api" app.
-	// Verify `tsh az login ...` gets called.
-	run([]string{"app", "login", "--insecure", "--azure-identity", "dummy_azure_identity", "azure-api"},
-		setCmdRunner(func(cmd *exec.Cmd) error {
-			require.Equal(t, []string{"az", "login", "--identity", "-u", "dummy_azure_identity"}, cmd.Args[1:])
-			return nil
-		}))
-
-	// Log into the "azure-api" app -- now with --debug flag.
-	run([]string{"app", "login", "--insecure", "azure-api", "--debug"},
-		setCmdRunner(func(cmd *exec.Cmd) error {
-			require.Equal(t, []string{"--debug", "az", "login", "--identity", "-u", "dummy_azure_identity"}, cmd.Args[1:])
-			return nil
-		}))
-
-	// basic requests to verify we can dial proxy as expected
-	// more comprehensive tests cover AzureMSIMiddleware directly
-	requests := []struct {
-		name         string
-		url          string
-		headers      map[string]string
-		expectedCode int
-		expectedBody []byte
-		verifyBody   func(t *testing.T, body []byte)
+	getEnvValue := func(cmdEnv []string, key string) string {
+		for _, env := range cmdEnv {
+			if strings.HasPrefix(env, key+"=") {
+				return strings.TrimPrefix(env, key+"=")
+			}
+		}
+		return ""
+	}
+
+	versionWithoutMSAL := semver.New(azureCLIVersionMSALRequirement.String())
+	versionWithoutMSAL.Minor -= 1
+
+	for name, tc := range map[string]struct {
+		setEnvironment       func(t *testing.T)
+		cliVersion           *semver.Version
+		tokenEndpointURL     string
+		expectedLoginCommand []string
+		assertCommandEnv     require.ValueAssertionFunc
 	}{
-		{
-			name:         "incomplete request",
-			url:          "https://azure-msi.teleport.dev/very-secret",
-			headers:      nil,
-			expectedCode: 400,
-			expectedBody: []byte("{\n    \"error\": {\n        \"message\": \"expected Metadata header with value 'true'\"\n    }\n}"),
+		"MSI": {
+			setEnvironment: func(t *testing.T) {
+				// This is required to avoid having a random generated secret.
+				t.Setenv(msiEndpointEnvVarName, "https://azure-msi.teleport.dev/very-secret")
+			},
+			cliVersion:           versionWithoutMSAL,
+			tokenEndpointURL:     "https://azure-msi.teleport.dev/very-secret",
+			expectedLoginCommand: []string{"az", "login", "--identity", "--username", "dummy_azure_identity"},
+			assertCommandEnv: func(t require.TestingT, val any, msgAndArgs ...any) {
+				env := val.([]string)
+				require.Equal(t, "https://azure-msi.teleport.dev/very-secret", getEnvValue(env, msiEndpointEnvVarName))
+			},
 		},
-		{
-			name:         "well-formatted request",
-			url:          "https://azure-msi.teleport.dev/very-secret?resource=myresource&msi_res_id=dummy_azure_identity",
-			headers:      map[string]string{"Metadata": "true"},
-			expectedCode: 200,
-			verifyBody: func(t *testing.T, body []byte) {
-				var req struct {
-					AccessToken  string `json:"access_token"`
-					ClientID     string `json:"client_id"`
-					Resource     string `json:"resource"`
-					TokenType    string `json:"token_type"`
-					ExpiresIn    int    `json:"expires_in"`
-					ExpiresOn    int    `json:"expires_on"`
-					ExtExpiresIn int    `json:"ext_expires_in"`
-					NotBefore    int    `json:"not_before"`
+		"Identity": {
+			setEnvironment: func(t *testing.T) {
+				// This is required to avoid having a random generated secret.
+				t.Setenv(identityEndpointEnvVarName, "https://azure-identity.teleport.dev")
+				t.Setenv(identityHeaderEnvVarName, "very-secret")
+			},
+			cliVersion:           azureCLIVersionMSALRequirement,
+			tokenEndpointURL:     "https://azure-identity.teleport.dev",
+			expectedLoginCommand: []string{"az", "login", "--identity", "--resource-id", "dummy_azure_identity"},
+			assertCommandEnv: func(t require.TestingT, val any, msgAndArgs ...any) {
+				env := val.([]string)
+				require.Equal(t, "https://azure-identity.teleport.dev", getEnvValue(env, identityEndpointEnvVarName))
+				require.Equal(t, "very-secret", getEnvValue(env, identityHeaderEnvVarName))
+			},
+		},
+	} {
+		t.Run("With"+name, func(t *testing.T) {
+			handleAzVersion := func(cmd *exec.Cmd) bool {
+				if len(cmd.Args) > 0 && cmd.Args[1] == "version" {
+					fmt.Fprintf(cmd.Stdout, `{ "azure-cli": "%s", "azure-cli-core": "%s", "azure-cli-telemetry": "1.1.0", "extensions": {} }`, tc.cliVersion.String(), tc.cliVersion.String())
+					return true
 				}
+				return false
+			}
 
-				require.NoError(t, json.Unmarshal(body, &req))
+			tc.setEnvironment(t)
 
-				require.NotEmpty(t, req.AccessToken)
-				require.NotEmpty(t, req.ClientID)
-				require.Equal(t, "myresource", req.Resource)
-				require.NotZero(t, req.ExpiresIn)
-				require.NotZero(t, req.ExpiresOn)
-				require.NotZero(t, req.ExtExpiresIn)
-				require.NotZero(t, req.NotBefore)
-			},
-		},
-	}
+			// Log into Teleport cluster.
+			run([]string{"login", "--insecure", "--debug", "--proxy", proxyAddr.String()})
 
-	// Run `tsh az vm ls`. Verify executed command and environment.
-	run([]string{"az", "vm", "ls", "-g", "my-group"},
-		setCmdRunner(func(cmd *exec.Cmd) error {
-			require.Equal(t, []string{"az", "vm", "ls", "-g", "my-group"}, cmd.Args)
+			// Log into the "azure-api" app.
+			// Verify `tsh az login ...` gets called.
+			run([]string{"app", "login", "--insecure", "--azure-identity", "dummy_azure_identity", "azure-api"},
+				setCmdRunner(func(cmd *exec.Cmd) error {
+					if handleAzVersion(cmd) {
+						return nil
+					}
+
+					require.Equal(t, tc.expectedLoginCommand, cmd.Args[1:])
+					return nil
+				}))
 
-			getEnvValue := func(key string) string {
-				for _, env := range cmd.Env {
-					if strings.HasPrefix(env, key+"=") {
-						return strings.TrimPrefix(env, key+"=")
+			// Log into the "azure-api" app -- now with --debug flag.
+			run([]string{"app", "login", "--insecure", "azure-api", "--debug"},
+				setCmdRunner(func(cmd *exec.Cmd) error {
+					if handleAzVersion(cmd) {
+						return nil
 					}
-				}
-				return ""
-			}
 
-			require.Equal(t, filepath.Join(tmpHomePath, "azure/localhost/azure-api"), getEnvValue("AZURE_CONFIG_DIR"))
-			require.Equal(t, "https://azure-msi.teleport.dev/very-secret", getEnvValue("MSI_ENDPOINT"))
-			require.Equal(t, filepath.Join(tmpHomePath, "keys/127.0.0.1/alice@example.com-app/localhost/azure-api-localca.pem"), getEnvValue("REQUESTS_CA_BUNDLE"))
-			require.True(t, strings.HasPrefix(getEnvValue("HTTPS_PROXY"), "http://127.0.0.1:"))
+					require.Equal(t, append(tc.expectedLoginCommand, "--debug"), cmd.Args[1:])
+					return nil
+				}))
 
-			// Validate MSI endpoint can be reached
-			caPool, err := utils.NewCertPoolFromPath(getEnvValue("REQUESTS_CA_BUNDLE"))
-			require.NoError(t, err)
+			// Run `tsh az vm ls`. Verify executed command and environment.
+			run([]string{"az", "vm", "ls", "-g", "my-group"},
+				setCmdRunner(func(cmd *exec.Cmd) error {
+					if handleAzVersion(cmd) {
+						return nil
+					}
 
-			httpsProxy, err := url.Parse(getEnvValue("HTTPS_PROXY"))
-			require.NoError(t, err)
+					require.Equal(t, []string{"az", "vm", "ls", "-g", "my-group"}, cmd.Args)
 
-			client := &http.Client{
-				Transport: &http.Transport{
-					Proxy: http.ProxyURL(httpsProxy),
-					TLSClientConfig: &tls.Config{
-						RootCAs: caPool,
-					},
-				},
-			}
+					require.Equal(t, filepath.Join(tmpHomePath, "azure/localhost/azure-api"), getEnvValue(cmd.Env, "AZURE_CONFIG_DIR"))
+					require.Equal(t, filepath.Join(tmpHomePath, "keys/127.0.0.1/alice@example.com-app/localhost/azure-api-localca.pem"), getEnvValue(cmd.Env, "REQUESTS_CA_BUNDLE"))
+					require.True(t, strings.HasPrefix(getEnvValue(cmd.Env, "HTTPS_PROXY"), "http://127.0.0.1:"))
+
+					tc.assertCommandEnv(t, cmd.Env)
 
-			for _, tc := range requests {
-				t.Run(tc.name, func(t *testing.T) {
-					req, err := http.NewRequest("GET", tc.url, nil)
+					// Validate MSI endpoint can be reached
+					caPool, err := utils.NewCertPoolFromPath(getEnvValue(cmd.Env, "REQUESTS_CA_BUNDLE"))
 					require.NoError(t, err)
 
-					for k, v := range tc.headers {
-						req.Header.Set(k, v)
+					httpsProxy, err := url.Parse(getEnvValue(cmd.Env, "HTTPS_PROXY"))
+					require.NoError(t, err)
+
+					// Dial using the Azure token service to ensure it will be
+					// reachable and handled when requested by the Azure CLI.
+					client := &http.Client{
+						Transport: &http.Transport{
+							Proxy:           http.ProxyURL(httpsProxy),
+							TLSClientConfig: &tls.Config{RootCAs: caPool},
+						},
 					}
 
-					resp, err := client.Do(req)
+					req, err := http.NewRequest("GET", tc.tokenEndpointURL, nil)
 					require.NoError(t, err)
 
-					require.Equal(t, tc.expectedCode, resp.StatusCode)
-					body, err := io.ReadAll(resp.Body)
+					// Given the missing params, the request should return error.
+					resp, err := client.Do(req)
 					require.NoError(t, err)
-					require.NoError(t, resp.Body.Close())
+					defer resp.Body.Close()
+					require.NotNil(t, resp)
+					require.Equal(t, http.StatusBadRequest, resp.StatusCode)
 
-					if tc.verifyBody != nil {
-						tc.verifyBody(t, body)
-					} else {
-						require.Equal(t, tc.expectedBody, body)
-					}
-				})
-			}
-
-			return nil
-		}))
+					return nil
+				}))
+		})
+	}
 }
 
 func makeUserWithAzureRole(t *testing.T) (types.User, types.Role) {
@@ -401,17 +406,19 @@ func Test_getAzureIdentityFromFlags(t *testing.T) {
 	}
 }
 
-func Test_getMSISecret(t *testing.T) {
+func Test_getAzureTokenSecret(t *testing.T) {
 	tests := []struct {
-		name     string
-		env      string
-		want     string
-		wantFunc func(t require.TestingT, result string)
-		wantErr  require.ErrorAssertionFunc
+		name             string
+		msiEndpoint      string
+		identityHeader   string
+		identityEndpoint string
+		want             string
+		wantFunc         func(t require.TestingT, result string)
+		wantErr          require.ErrorAssertionFunc
 	}{
 		{
-			name: "no env",
-			env:  "",
+			name:        "no env",
+			msiEndpoint: "",
 			wantFunc: func(t require.TestingT, result string) {
 				bytes, err := hex.DecodeString(result)
 				require.NoError(t, err)
@@ -421,31 +428,55 @@ func Test_getMSISecret(t *testing.T) {
 			wantErr: require.NoError,
 		},
 		{
-			name:    "MSI_ENDPOINT with secret",
-			env:     "https://azure-msi.teleport.dev/mysecret",
-			want:    "mysecret",
-			wantErr: require.NoError,
+			name:        "MSI_ENDPOINT with secret",
+			msiEndpoint: "https://" + types.TeleportAzureMSIEndpoint + "/mysecret",
+			want:        "mysecret",
+			wantErr:     require.NoError,
 		},
 		{
-			name: "MSI_ENDPOINT with invalid prefix",
-			env:  "dummy",
+			name:        "MSI_ENDPOINT with invalid prefix",
+			msiEndpoint: "dummy",
 			wantErr: func(t require.TestingT, err error, i ...interface{}) {
-				require.ErrorContains(t, err, `MSI_ENDPOINT not empty, but doesn't start with "https://azure-msi.teleport.dev/" as expected`)
+				require.ErrorContains(t, err, `"MSI_ENDPOINT" environment variable not empty, but doesn't start with "https://azure-msi.teleport.dev/" as expected`)
 			},
 		},
 		{
-			name: "MSI_ENDPOINT without secret",
-			env:  "https://azure-msi.teleport.dev/",
+			name:        "MSI_ENDPOINT without secret",
+			msiEndpoint: "https://" + types.TeleportAzureMSIEndpoint + "/",
 			wantErr: func(t require.TestingT, err error, i ...interface{}) {
 				require.ErrorContains(t, err, "MSI secret cannot be empty")
 			},
 		},
+		{
+			name:             "IDENTITY_HEADER and IDENTITY_ENDPOINT present",
+			identityHeader:   "secret",
+			identityEndpoint: "https://" + types.TeleportAzureIdentityEndpoint,
+			want:             "secret",
+			wantErr:          require.NoError,
+		},
+		{
+			name:           "IDENTITY_HEADER present without endpoint",
+			identityHeader: "secret",
+			wantErr: func(t require.TestingT, err error, i ...interface{}) {
+				require.ErrorContains(t, err, `IDENTITY_HEADER`)
+			},
+		},
+		{
+			name:             "Identity and MSI present, identity takes precedence",
+			identityHeader:   "secret",
+			identityEndpoint: "https://" + types.TeleportAzureIdentityEndpoint,
+			msiEndpoint:      "https://azure-msi.teleport.dev/different-secret",
+			want:             "secret",
+			wantErr:          require.NoError,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("MSI_ENDPOINT", tt.env)
-			result, err := getMSISecret()
+			t.Setenv(msiEndpointEnvVarName, tt.msiEndpoint)
+			t.Setenv(identityHeaderEnvVarName, tt.identityHeader)
+			t.Setenv(identityEndpointEnvVarName, tt.identityEndpoint)
+			result, err := getAzureTokenSecret()
 			tt.wantErr(t, err)
 			if tt.wantFunc != nil {
 				tt.wantFunc(t, result)
diff --git a/tool/tsh/common/app_external_files.go b/tool/tsh/common/app_external_files.go
new file mode 100644
index 0000000000000..bdc51a88c96c3
--- /dev/null
+++ b/tool/tsh/common/app_external_files.go
@@ -0,0 +1,132 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/google/safetext/shsprintf"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/aws/awsconfigfile"
+	"github.com/gravitational/teleport/lib/tlsca"
+)
+
+// writeFilesForExternalApps create or update local configuration files to allow external applications to use the credentials generated by tsh apps login.
+// These files are outside of the tsh profile directory.
+func writeFilesForExternalApps(stdout io.Writer, appInfo *appInfo, exportCredentials bool) error {
+	if appInfo.RouteToApp.AWSCredentialProcessCredentials != "" {
+		if exportCredentials {
+			return trace.Wrap(exportAWSCredentials(appInfo.RouteToApp.AWSCredentialProcessCredentials, stdout))
+		}
+
+		return trace.Wrap(addAWSProfileToConfig(appInfo.RouteToApp.Name))
+	}
+
+	return nil
+}
+
+// removeExternalFilesForApp remove or update local configuration files that allowed external applications to use the credentials generated by tsh apps login.
+// These files are outside of the tsh profile directory.
+func removeExternalFilesForApp(routeToApp tlsca.RouteToApp) error {
+	if routeToApp.AWSCredentialProcessCredentials != "" {
+		if err := removeAWSProfileFromConfig(routeToApp.Name); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+// removeExternalFilesForAllApps remove or update local configuration files that allowed external applications to use the credentials generated by tsh apps login.
+// These files are outside of the tsh profile directory.
+func removeExternalFilesForAllApps() error {
+	if err := removeAllAWSProfilesFromConfig(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// addAWSProfileToConfig adds a new profile to the AWS config file (ie. ~/.aws/config).
+// This profile will invoke the `tsh apps config --format aws-credential-process <app name>` command
+// which returns the credentials for accessing AWS.
+func addAWSProfileToConfig(appName string) error {
+	awsConfigFileLocation, err := awsconfigfile.AWSConfigFilePath()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	credentialProcessCommand := fmt.Sprintf("tsh apps config --format aws-credential-process %s", appName)
+	profileName := appName
+
+	if err := awsconfigfile.UpsertProfileCredentialProcess(awsConfigFileLocation, profileName, credentialProcessCommand); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// exportAWSCredentials writes a shell script that, when executed, exports the required permissions to access AWS APIs.
+// Receives the credentials as a JSON string, which are formatted as "credential_process".
+//
+// This output is meant to be consumed by the `eval` shell utility.
+func exportAWSCredentials(credentialsAsJsonString string, stdout io.Writer) error {
+	var credentials struct {
+		AccessKeyID     string `json:"AccessKeyId"`
+		SecretAccessKey string `json:"SecretAccessKey"`
+		SessionToken    string `json:"SessionToken"`
+	}
+
+	if err := json.Unmarshal([]byte(credentialsAsJsonString), &credentials); err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err := fmt.Fprintf(stdout,
+		`export AWS_ACCESS_KEY_ID=%s
+export AWS_SECRET_ACCESS_KEY=%s
+export AWS_SESSION_TOKEN=%s
+# Export the above variables in your current shell to start using the AWS credentials.
+`,
+		shsprintf.EscapeDefaultContext(credentials.AccessKeyID),
+		shsprintf.EscapeDefaultContext(credentials.SecretAccessKey),
+		shsprintf.EscapeDefaultContext(credentials.SessionToken),
+	)
+	return trace.Wrap(err)
+}
+
+func removeAWSProfileFromConfig(appName string) error {
+	awsConfigFileLocation, err := awsconfigfile.AWSConfigFilePath()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(awsconfigfile.RemoveTeleportManagedProfile(awsConfigFileLocation, appName))
+}
+
+func removeAllAWSProfilesFromConfig() error {
+	awsConfigFileLocation, err := awsconfigfile.AWSConfigFilePath()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(awsconfigfile.RemoveAllTeleportManagedProfiles(awsConfigFileLocation))
+}
diff --git a/tool/tsh/common/app_test.go b/tool/tsh/common/app_test.go
index f9a4aa76e2c5b..fbdc72fa34f45 100644
--- a/tool/tsh/common/app_test.go
+++ b/tool/tsh/common/app_test.go
@@ -43,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -85,7 +86,15 @@ func testDummyAppConn(addr string, tlsCerts ...tls.Certificate) (*http.Response,
 func TestAppCommands(t *testing.T) {
 	ctx := context.Background()
 
-	testserver.WithResyncInterval(t, 0)
+	oldResyncInterval := defaults.ResyncInterval
+	defaults.ResyncInterval = 100 * time.Millisecond
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithResyncInterval", "1")
+	t.Cleanup(func() {
+		defaults.ResyncInterval = oldResyncInterval
+	})
 
 	accessUser, err := types.NewUser("access")
 	require.NoError(t, err)
@@ -96,15 +105,23 @@ func TestAppCommands(t *testing.T) {
 	accessUser.SetLogins([]string{user.Name})
 	connector := mockConnector(t)
 
+	rootApp := testserver.StartDummyHTTPServer("rootapp")
+	t.Cleanup(rootApp.Close)
+
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
-		testserver.WithClusterName(t, "root"),
-		testserver.WithTestApp(t, "rootapp"),
+		testserver.WithClusterName("root"),
+		testserver.WithTestApp("rootapp", rootApp.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		}),
 	}
-	rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 	rootAuthServer := rootServer.GetAuthServer()
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
@@ -115,16 +132,24 @@ func TestAppCommands(t *testing.T) {
 	_, err = rootAuthServer.UpdateAuthPreference(ctx, cap)
 	require.NoError(t, err)
 
+	leafApp := testserver.StartDummyHTTPServer("leafapp")
+	t.Cleanup(leafApp.Close)
+
 	leafServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(accessUser),
-		testserver.WithClusterName(t, "leaf"),
-		testserver.WithTestApp(t, "leafapp"),
+		testserver.WithClusterName("leaf"),
+		testserver.WithTestApp("leafapp", leafApp.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		}),
 	}
-	leafServer := testserver.MakeTestServer(t, leafServerOpts...)
-	testserver.SetupTrustedCluster(ctx, t, rootServer, leafServer)
+	leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, leafServer.Close())
+		require.NoError(t, leafServer.Wait())
+	})
+	SetupTrustedCluster(ctx, t, rootServer, leafServer)
 
 	// Set up user with MFA device for per session MFA tests below.
 	origin := "https://127.0.0.1"
@@ -247,11 +272,15 @@ func TestAppCommands(t *testing.T) {
 								clientCert, err := tls.LoadX509KeyPair(info.Cert, info.Key)
 								require.NoError(t, err)
 
-								resp, err := testDummyAppConn(fmt.Sprintf("https://%v", rootProxyAddr.Addr), clientCert)
-								require.NoError(t, err)
-								resp.Body.Close()
-								assert.Equal(t, http.StatusOK, resp.StatusCode)
-								assert.Equal(t, app.name, resp.Header.Get("Server"))
+								// Wrap with eventually in case the app has not made it into the
+								// proxy cache yet, this was a previous source of test flakes.
+								require.EventuallyWithT(t, func(t *assert.CollectT) {
+									resp, err := testDummyAppConn(fmt.Sprintf("https://%v", rootProxyAddr.Addr), clientCert)
+									require.NoError(t, err)
+									resp.Body.Close()
+									assert.Equal(t, http.StatusOK, resp.StatusCode)
+									assert.Equal(t, app.name, resp.Header.Get("Server"))
+								}, 5*time.Second, 50*time.Millisecond)
 
 								// Verify that the app.session.start event was emitted.
 								if app.cluster == "root" {
diff --git a/tool/tsh/common/autoupdate.go b/tool/tsh/common/autoupdate.go
new file mode 100644
index 0000000000000..62f6dca8e5b0a
--- /dev/null
+++ b/tool/tsh/common/autoupdate.go
@@ -0,0 +1,72 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/autoupdate/tools"
+)
+
+type autoUpdateCommand struct {
+	update *managedUpdatesUpdateCommand
+}
+
+func newUpdateCommand(app *kingpin.Application) *autoUpdateCommand {
+	root := &autoUpdateCommand{
+		update: &managedUpdatesUpdateCommand{},
+	}
+
+	root.update.CmdClause = app.Command("update",
+		"Update client tools (tsh, tctl) to the latest version defined by the cluster configuration.")
+	root.update.CmdClause.Flag("clear", "Removes locally installed client tools updates from the Teleport home directory.").BoolVar(&root.update.clear)
+
+	return root
+}
+
+// managedUpdatesUpdateCommand additionally check for the latest available client tools
+// version in cluster and runs update.
+type managedUpdatesUpdateCommand struct {
+	*kingpin.CmdClause
+	clear bool
+}
+
+func (c *managedUpdatesUpdateCommand) run(cf *CLIConf) error {
+	if c.clear {
+		toolsDir, err := tools.Dir()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if err := tools.CleanUp(toolsDir, tools.DefaultClientTools()); err != nil {
+			return trace.Wrap(err)
+		}
+		return nil
+	}
+
+	tc, err := makeClient(cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if err := tools.DownloadUpdate(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
diff --git a/tool/tsh/common/db.go b/tool/tsh/common/db.go
index 6dbf2fbf5bf91..c41b9c2e5df89 100644
--- a/tool/tsh/common/db.go
+++ b/tool/tsh/common/db.go
@@ -51,6 +51,7 @@ import (
 	"github.com/gravitational/teleport/lib/client/db/dbcmd"
 	"github.com/gravitational/teleport/lib/client/db/oracle"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/gcp"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
@@ -536,11 +537,14 @@ func onDatabaseConfig(cf *CLIConf) error {
 	format := strings.ToLower(cf.Format)
 	switch format {
 	case dbFormatCommand:
-		cmd, err := dbcmd.NewCmdBuilder(tc, profile, *database, rootCluster,
+		cb, err := dbcmd.NewCmdBuilder(tc, profile, *database, rootCluster, getDatabase,
 			dbcmd.WithPrintFormat(),
 			dbcmd.WithLogger(logger),
-			dbcmd.WithGetDatabaseFunc(getDatabase),
-		).GetConnectCommand(cf.Context)
+		)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		cmd, err := cb.GetConnectCommand(cf.Context)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -607,7 +611,10 @@ func maybeStartLocalProxy(ctx context.Context, cf *CLIConf,
 	requires *dbLocalProxyRequirement,
 ) ([]dbcmd.ConnectCommandFunc, error) {
 	if !requires.localProxy {
-		return nil, nil
+		// Even when local proxy is not required, we need to build the base
+		// options for database command.
+		baseOpts, err := makeDatabaseCommandOptions(ctx, tc, dbInfo)
+		return baseOpts, trace.Wrap(err)
 	}
 	if requires.tunnel {
 		logger.DebugContext(ctx, "Starting local proxy tunnel", "reasons", requires.tunnelReasons)
@@ -787,7 +794,10 @@ func onDatabaseConnect(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	bb := dbcmd.NewCmdBuilder(tc, profile, dbInfo.RouteToDatabase, rootClusterName, opts...)
+	bb, err := dbcmd.NewCmdBuilder(tc, profile, dbInfo.RouteToDatabase, rootClusterName, dbInfo.getDatabaseForDBCmd, opts...)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 	cmd, err := bb.GetConnectCommand(cf.Context)
 	if err != nil {
 		return trace.Wrap(err)
@@ -803,7 +813,7 @@ func onDatabaseConnect(cf *CLIConf) error {
 	peakStderr := utils.NewCaptureNBytesWriter(dbcmd.PeakStderrSize)
 	cmd.Stderr = io.MultiWriter(os.Stderr, peakStderr)
 
-	err = cmd.Run()
+	err = cf.RunCommand(cmd)
 	if err != nil {
 		return dbcmd.ConvertCommandError(cmd, err, string(peakStderr.Bytes()))
 	}
@@ -957,36 +967,42 @@ func (d *databaseInfo) checkAndSetDefaults(cf *CLIConf, tc *client.TeleportClien
 		}
 		return trace.Wrap(err)
 	}
+
 	// ensure the route protocol matches the db.
 	d.Protocol = db.GetProtocol()
 
 	needDBUser := d.Username == "" && isDatabaseUserRequired(d.Protocol)
 	needDBName := d.Database == "" && isDatabaseNameRequired(d.Protocol)
-	if !needDBUser && !needDBName {
-		return nil
-	}
-
-	checker, err := d.getChecker(cf.Context, tc)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if needDBUser {
-		dbUser, err := getDefaultDBUser(db, checker)
+	if needDBUser || needDBName {
+		checker, err := d.getChecker(cf.Context, tc)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		logger.DebugContext(cf.Context, "Defaulting to the allowed database user", "database_user", dbUser)
-		d.Username = dbUser
-	}
-	if needDBName {
-		dbName, err := getDefaultDBName(db, checker)
-		if err != nil {
-			return trace.Wrap(err)
+
+		if needDBUser {
+			dbUser, err := getDefaultDBUser(db, checker)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			logger.DebugContext(cf.Context, "Defaulting to the allowed database user", "database_user", dbUser)
+			d.Username = dbUser
+		}
+		if needDBName {
+			dbName, err := getDefaultDBName(db, checker)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			logger.DebugContext(cf.Context, "Defaulting to the allowed database name", "database_name", dbName)
+			d.Database = dbName
 		}
-		logger.DebugContext(cf.Context, "Defaulting to the allowed database name", "database_name", dbName)
-		d.Database = dbName
 	}
+
+	adjusted, newUsername := gcp.AdjustDatabaseUsername(d.Username, db)
+	if adjusted {
+		logger.DebugContext(cf.Context, "Adding default project suffix for IAM principal", "original", d.Username, "updated", newUsername)
+		d.Username = newUsername
+	}
+
 	return nil
 }
 
@@ -1005,12 +1021,16 @@ func (d *databaseInfo) getChecker(ctx context.Context, tc *client.TeleportClient
 	}
 	defer clusterClient.Close()
 
+	return makeAccessChecker(ctx, tc, clusterClient.AuthClient)
+}
+
+func makeAccessChecker(ctx context.Context, tc *client.TeleportClient, auth services.CurrentUserRoleGetter) (services.AccessChecker, error) {
 	profile, err := tc.ProfileStatus()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	checker, err := services.NewAccessCheckerForRemoteCluster(ctx, profile.AccessInfo(), tc.SiteName, clusterClient.AuthClient)
+	checker, err := services.NewAccessCheckerForRemoteCluster(ctx, profile.AccessInfo(), tc.SiteName, auth)
 	return checker, trace.Wrap(err)
 }
 
@@ -1309,8 +1329,8 @@ func isDatabaseNameRequired(protocol string) bool {
 		return true
 	}
 	switch protocol {
-	case defaults.ProtocolOracle:
-		// Always require database name for the Oracle protocol.
+	// Always require database name for these protocols.
+	case defaults.ProtocolOracle, defaults.ProtocolSQLServer:
 		return true
 	}
 	return false
diff --git a/tool/tsh/common/db_exec.go b/tool/tsh/common/db_exec.go
index 63ff1575bde26..843acfb767308 100644
--- a/tool/tsh/common/db_exec.go
+++ b/tool/tsh/common/db_exec.go
@@ -516,8 +516,11 @@ func (m *databaseExecCommandMaker) makeCommand(ctx context.Context, dbInfo *data
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return dbcmd.NewCmdBuilder(m.tc, m.profile, dbInfo.RouteToDatabase, m.rootCluster, opts...).
-		GetExecCommand(ctx, command)
+	cb, err := dbcmd.NewCmdBuilder(m.tc, m.profile, dbInfo.RouteToDatabase, m.rootCluster, dbInfo.getDatabaseForDBCmd, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return cb.GetExecCommand(ctx, command)
 }
 
 // ensureEachDatabase ensures one to one mapping between the provided database
diff --git a/tool/tsh/common/db_exec_test.go b/tool/tsh/common/db_exec_test.go
index dc99644fd1b04..455bbda252d87 100644
--- a/tool/tsh/common/db_exec_test.go
+++ b/tool/tsh/common/db_exec_test.go
@@ -326,29 +326,19 @@ func (c *fakeDatabaseExecClient) issueCert(context.Context, *databaseInfo) (tls.
 	return c.cert, nil
 }
 func (c *fakeDatabaseExecClient) listDatabasesWithFilter(ctx context.Context, req *proto.ListResourcesRequest) ([]types.Database, error) {
-	filter := services.MatchResourceFilter{
-		ResourceKind:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
-	}
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		filter.PredicateExpression = expression
+	filtered, err := matchResources(req, c.allDatabaseServers)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
+	return types.DatabaseServers(filtered).ToDatabases(), nil
+}
 
-	var filtered []types.Database
-	for _, dbServer := range c.allDatabaseServers {
-		match, err := services.MatchResourceByFilters(dbServer, filter, nil)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		} else if match {
-			filtered = append(filtered, dbServer.GetDatabase())
-		}
+func matchResources[R types.ResourceWithLabels](req *proto.ListResourcesRequest, s []R) ([]R, error) {
+	filter, err := services.MatchResourceFilterFromListResourceRequest(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
-	return filtered, nil
+	return services.MatchResourcesByFilters(s, filter)
 }
 
 func mustMakeDatabaseServer(t *testing.T, db types.Database) types.DatabaseServer {
diff --git a/tool/tsh/common/db_test.go b/tool/tsh/common/db_test.go
index 06787491de421..a02a14edc32aa 100644
--- a/tool/tsh/common/db_test.go
+++ b/tool/tsh/common/db_test.go
@@ -24,13 +24,16 @@ import (
 	"encoding/pem"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
@@ -39,11 +42,13 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/entitlements"
+	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -51,7 +56,7 @@ import (
 	dbcommon "github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
+	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 func registerFakeEnterpriseDBEngines(t *testing.T) {
@@ -72,8 +77,8 @@ func TestTshDB(t *testing.T) {
 	// will fail. The fake engine registered are not functional. But other
 	// Enterprise features like Access Request can still be tested.
 	registerFakeEnterpriseDBEngines(t)
-	modules.SetTestModules(t,
-		&modules.TestModules{
+	modulestest.SetTestModules(t,
+		modulestest.Modules{
 			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
 				Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -86,9 +91,26 @@ func TestTshDB(t *testing.T) {
 	// this speeds up test suite setup substantially, which is where
 	// tests spend the majority of their time, especially when leaf
 	// clusters are setup.
-	testenv.WithResyncInterval(t, 0)
+	oldResyncInterval := defaults.ResyncInterval
+	defaults.ResyncInterval = 100 * time.Millisecond
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithResyncInterval", "1")
+	t.Cleanup(func() {
+		defaults.ResyncInterval = oldResyncInterval
+	})
+
 	// Proxy uses self-signed certificates in tests.
-	testenv.WithInsecureDevMode(t, true)
+	originalValue := lib.IsInsecureDevMode()
+	lib.SetInsecureDevMode(true)
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithInsecureDevMode", "1")
+	t.Cleanup(func() {
+		lib.SetInsecureDevMode(originalValue)
+	})
 	t.Run("Login", testDatabaseLogin)
 	t.Run("List", testListDatabase)
 	t.Run("DatabaseSelection", testDatabaseSelection)
@@ -1993,3 +2015,291 @@ func Test_shouldRetryGetDatabaseUsingSearchAsRoles(t *testing.T) {
 		})
 	}
 }
+
+func TestDatabaseInfo(t *testing.T) {
+	const serviceName = "test-db"
+	tests := []struct {
+		name     string
+		dbSpec   types.DatabaseSpecV3
+		cliConf  *CLIConf
+		routeIn  tlsca.RouteToDatabase
+		routeOut tlsca.RouteToDatabase
+	}{
+		{
+			name: "basic case no changes",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "uri",
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "alice",
+				Database:    "postgres",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "alice",
+				Database:    "postgres",
+			},
+		},
+		{
+			name: "override from CLI flags",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "uri",
+			},
+			cliConf: &CLIConf{
+				DatabaseUser:  "bob",
+				DatabaseName:  "bob_db",
+				DatabaseRoles: "r1,r2,r3",
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "alice",
+				Database:    "postgres",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "bob",
+				Database:    "bob_db",
+				Roles:       []string{"r1", "r2", "r3"},
+			},
+		},
+		{
+			name: "add GCP IAM suffix for CloudSQL",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: "postgres",
+				URI:      "uri",
+				GCP: types.GCPCloudSQL{
+					ProjectID:  "my-project",
+					InstanceID: "my-instance",
+				},
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser@my-project.iam",
+			},
+		},
+		{
+			name: "add GCP IAM suffix for AlloyDB",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: "postgres",
+				URI:      "alloydb://projects/my-project-123456/locations/europe-west1/clusters/my-cluster/instances/my-instance",
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser@my-project-123456.iam",
+			},
+		},
+		{
+			name: "keep existing GCP IAM suffix",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: "postgres",
+				URI:      "uri",
+				GCP: types.GCPCloudSQL{
+					ProjectID:  "my-project",
+					InstanceID: "my-instance",
+				},
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser@my-other-project.iam",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "postgres",
+				Database:    "postgres",
+				Username:    "iamuser@my-other-project.iam",
+			},
+		},
+		{
+			name: "do not modify non-Postgres logins",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolSpanner,
+				URI:      "uri",
+				GCP: types.GCPCloudSQL{
+					ProjectID:  "my-project",
+					InstanceID: "my-instance",
+				},
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "spanner",
+				Database:    "spanner",
+				Username:    "iamuser",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    "spanner",
+				Database:    "spanner",
+				Username:    "iamuser",
+			},
+		},
+		{
+			name: "default database name from role",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "uri",
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "alice",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "alice",
+				Database:    "database_from_role",
+			},
+		},
+		{
+			name: "default database username from role",
+			dbSpec: types.DatabaseSpecV3{
+				Protocol: defaults.ProtocolPostgres,
+				URI:      "uri",
+			},
+			routeIn: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Database:    "postgres",
+			},
+			routeOut: tlsca.RouteToDatabase{
+				ServiceName: serviceName,
+				Protocol:    defaults.ProtocolPostgres,
+				Username:    "user_from_role",
+				Database:    "postgres",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := types.NewDatabaseV3(types.Metadata{
+				Name:   serviceName,
+				Labels: map[string]string{"foo": "bar"},
+			}, tt.dbSpec)
+			require.NoError(t, err)
+
+			role := &types.RoleV6{
+				Metadata: types.Metadata{Name: "test-role", Namespace: apidefaults.Namespace},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						Namespaces:     []string{apidefaults.Namespace},
+						DatabaseLabels: types.Labels{"*": []string{"*"}},
+						DatabaseUsers:  []string{"user_from_role"},
+						DatabaseNames:  []string{"database_from_role"},
+					},
+				},
+			}
+
+			checker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", services.NewRoleSet(role))
+
+			dbInfo := &databaseInfo{
+				RouteToDatabase: tt.routeIn,
+
+				database: db,
+				checker:  checker,
+			}
+
+			cf := &CLIConf{}
+			if tt.cliConf != nil {
+				cf = tt.cliConf
+			}
+
+			// as long as dbInfo.database and dbInfo.checker are set
+			// the Teleport client won't be used and therefore can be nil.
+			var tc *client.TeleportClient = nil
+
+			err = dbInfo.checkAndSetDefaults(cf, tc)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.routeOut, dbInfo.RouteToDatabase)
+		})
+	}
+}
+
+// TestMongoDBSeparatePortCommandError given a MongoDB database with cluster
+// using separate port mode ensures `tsh` generates the connect command without
+// errors.
+//
+// See https://github.com/gravitational/teleport/issues/47895
+func TestMongoDBSeparatePortCommandError(t *testing.T) {
+	t.Parallel()
+
+	connector := mockConnector(t)
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetDatabaseUsers([]string{"admin"})
+	alice.SetDatabaseNames([]string{"default"})
+	alice.SetRoles([]string{"access"})
+
+	process, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName("root"),
+		testserver.WithBootstrap(connector, alice),
+		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			mongoPublicAddr := localListenerAddr()
+			cfg.Proxy.MongoAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: mongoPublicAddr}
+			cfg.Proxy.MongoPublicAddrs = []utils.NetAddr{{AddrNetwork: "tcp", Addr: mongoPublicAddr}}
+			cfg.Databases.Enabled = true
+			cfg.Databases.Databases = []servicecfg.Database{
+				{
+					Name:     "mongo",
+					Protocol: defaults.ProtocolMongoDB,
+					URI:      "external-mongo:27017",
+				},
+			}
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, process.Close())
+		assert.NoError(t, process.Wait())
+	})
+
+	tshHome, _ := mustLogin(t, process, alice, connector.GetName())
+
+	// cmdExecuted tracks that the MongoDB command was executed.
+	var cmdExecuted atomic.Bool
+
+	// noopCmdRunner is a command runner that does nothing. For this test, we
+	// only need to ensure the command is generated without actually validating
+	// it. This task should be handled in the dbcmd package.
+	noopCmdRunner := func(_ *exec.Cmd) error {
+		cmdExecuted.Store(true)
+		return nil
+	}
+
+	err = Run(context.Background(), []string{
+		"db",
+		"connect",
+		"mongo",
+		"--insecure",
+		"--db-name=test",
+		"--db-user=alice",
+	}, setHomePath(tshHome), setCmdRunner(noopCmdRunner))
+	require.NoError(t, err)
+	require.True(t, cmdExecuted.Load(), "expected the MongoDB command to have executed")
+}
diff --git a/tool/tsh/common/dup2_linux.go b/tool/tsh/common/dup2_linux.go
new file mode 100644
index 0000000000000..52ca8b0585e2c
--- /dev/null
+++ b/tool/tsh/common/dup2_linux.go
@@ -0,0 +1,34 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build linux
+
+package common
+
+import "syscall"
+
+// dup2 implements syscall.Dup2(oldfd, newfd) in a way that works on all
+// current Linux platforms, and likely on any new platforms. New platforms
+// such as ARM64 do not implement syscall.Dup2() instead implementing
+// syscall.Dup3() which is largely a superset, with one special case.
+func dup2(oldfd, newfd int) error {
+	if oldfd == newfd {
+		// dup2 would do nothing in this case, but dup3 returns an error.
+		// Emulate dup2 behavior.
+		return nil
+	}
+	return syscall.Dup3(oldfd, newfd, 0)
+}
diff --git a/tool/tsh/common/dup2_unix.go b/tool/tsh/common/dup2_unix.go
new file mode 100644
index 0000000000000..47aef96884851
--- /dev/null
+++ b/tool/tsh/common/dup2_unix.go
@@ -0,0 +1,28 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build unix && !linux
+
+package common
+
+import "syscall"
+
+// dup2 wraps syscall.Dup2(oldfd, newfd) on non-linux unix platforms. The
+// linux implementation uses syscall.Dup3() as Dup2() is not available
+// on all linux platforms.
+func dup2(oldfd, newfd int) error {
+	return syscall.Dup2(oldfd, newfd)
+}
diff --git a/tool/tsh/common/hardware_key_test.go b/tool/tsh/common/hardware_key_test.go
index 37cfd3d5f2d37..21016c78727c9 100644
--- a/tool/tsh/common/hardware_key_test.go
+++ b/tool/tsh/common/hardware_key_test.go
@@ -26,23 +26,37 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"io"
+	"net"
 	"net/http"
 	"os/user"
 	"testing"
+	"time"
 
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/pkg/sftp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
+	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/lib"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/utils"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
@@ -50,8 +64,7 @@ import (
 func TestHardwareKeyLogin(t *testing.T) {
 	ctx := context.Background()
 
-	testModules := &modules.TestModules{TestBuildType: modules.BuildEnterprise}
-	modules.SetTestModules(t, testModules)
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	connector := mockConnector(t)
 
@@ -61,7 +74,7 @@ func TestHardwareKeyLogin(t *testing.T) {
 	require.NoError(t, err)
 	alice.SetRoles([]string{aliceRole.GetName()})
 
-	testServer := testserver.MakeTestServer(t, testserver.WithBootstrap(connector, alice, aliceRole), func(o *testserver.TestServersOpts) {
+	testServer, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithBootstrap(connector, alice, aliceRole), func(o *testserver.TestServersOpts) error {
 		o.ConfigFuncs = append(o.ConfigFuncs, func(cfg *servicecfg.Config) {
 			// TODO (Joerger): This test fails to propagate hardware key policy errors from Proxy SSH connections
 			// for unknown reasons unless Multiplex mode is on. I could not reproduce these errors on a live
@@ -69,7 +82,15 @@ func TestHardwareKeyLogin(t *testing.T) {
 			// are not 1-to-1 with live certs.
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		})
+
+		return nil
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, testServer.Close())
+		require.NoError(t, testServer.Wait())
 	})
+
 	authServer := testServer.GetAuthServer()
 
 	proxyAddr, err := testServer.ProxyWebAddr()
@@ -82,13 +103,12 @@ func TestHardwareKeyLogin(t *testing.T) {
 		lastLoginCount++
 
 		// Set MockAttestationData to attest the expected key policy and reset it after login.
-		testModules.MockAttestationData = &keys.AttestationData{
-			PrivateKeyPolicy: keyRing.SSHPrivateKey.GetPrivateKeyPolicy(),
-		}
-		defer func() {
-			testModules.MockAttestationData = nil
-		}()
-
+		modulestest.SetTestModules(t, modulestest.Modules{
+			TestBuildType: modules.BuildEnterprise,
+			MockAttestationData: &keys.AttestationData{
+				PrivateKeyPolicy: keyRing.SSHPrivateKey.GetPrivateKeyPolicy(),
+			},
+		})
 		return mockSSOLogin(ctx, connectorID, keyRing, protocol)
 	}
 	setMockSSOLogin := setMockSSOLoginCustom(mockSSOLoginWithCountAndAttestation, connector.GetName())
@@ -181,12 +201,6 @@ func TestHardwareKeyLogin(t *testing.T) {
 // TestHardwareKeySSH tests Hardware Key SSH flows.
 func TestHardwareKeySSH(t *testing.T) {
 	ctx := context.Background()
-
-	testModules := &modules.TestModules{
-		TestBuildType: modules.BuildEnterprise,
-	}
-	modules.SetTestModules(t, testModules)
-
 	connector := mockConnector(t)
 
 	user, err := user.Current()
@@ -203,10 +217,10 @@ func TestHardwareKeySSH(t *testing.T) {
 	require.NoError(t, err)
 	alice.SetRoles([]string{aliceRole.GetName()})
 
-	testServer := testserver.MakeTestServer(t,
+	testServer, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithBootstrap(connector, alice, aliceRole),
-		testserver.WithClusterName(t, "my-cluster"),
-		func(o *testserver.TestServersOpts) {
+		testserver.WithClusterName("my-cluster"),
+		func(o *testserver.TestServersOpts) error {
 			o.ConfigFuncs = append(o.ConfigFuncs, func(cfg *servicecfg.Config) {
 				// TODO (Joerger): This test fails to propagate hardware key policy errors from Proxy SSH connections
 				// for unknown reasons unless Multiplex mode is on. I could not reproduce these errors on a live
@@ -214,12 +228,20 @@ func TestHardwareKeySSH(t *testing.T) {
 				// are not 1-to-1 with live certs.
 				cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			})
+
+			return nil
 		})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, testServer.Close())
+		require.NoError(t, testServer.Wait())
+	})
+
 	authServer := testServer.GetAuthServer()
 	proxyAddr, err := testServer.ProxyWebAddr()
 	require.NoError(t, err)
 
-	agentless := testserver.CreateAgentlessNode(t, authServer, "my-cluster", "agentless-node")
+	agentless := CreateAgentlessNode(t, authServer, "my-cluster", "agentless-node")
 
 	// Login before adding hardware key requirement
 	tmpHomePath := t.TempDir()
@@ -252,7 +274,10 @@ func TestHardwareKeySSH(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			testModules.MockAttestationData = nil
+			modulestest.SetTestModules(t, modulestest.Modules{
+				TestBuildType: modules.BuildEnterprise,
+			})
+
 			tmpHomePath = t.TempDir()
 			// SSH fails without an attested hardware key login.
 			err = Run(ctx, []string{
@@ -264,9 +289,12 @@ func TestHardwareKeySSH(t *testing.T) {
 			require.Error(t, err)
 
 			// Set MockAttestationData to attest the expected key policy and try again.
-			testModules.MockAttestationData = &keys.AttestationData{
-				PrivateKeyPolicy: keys.PrivateKeyPolicyHardwareKeyTouch,
-			}
+			modulestest.SetTestModules(t, modulestest.Modules{
+				TestBuildType: modules.BuildEnterprise,
+				MockAttestationData: &keys.AttestationData{
+					PrivateKeyPolicy: keys.PrivateKeyPolicyHardwareKeyTouch,
+				},
+			})
 
 			err = Run(ctx, []string{
 				"login",
@@ -286,21 +314,251 @@ func TestHardwareKeySSH(t *testing.T) {
 	}
 }
 
+func CreateAgentlessNode(t *testing.T, authServer *auth.Server, clusterName, nodeHostname string) *types.ServerV2 {
+	t.Helper()
+
+	ctx := context.Background()
+	openSSHCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.OpenSSHCA,
+		DomainName: clusterName,
+	}, false)
+	require.NoError(t, err)
+
+	caCheckers, err := sshutils.GetCheckers(openSSHCA)
+	require.NoError(t, err)
+
+	key, err := cryptosuites.GenerateKey(ctx, cryptosuites.GetCurrentSuiteFromAuthPreference(authServer), cryptosuites.HostSSH)
+	require.NoError(t, err)
+	sshPub, err := ssh.NewPublicKey(key.Public())
+	require.NoError(t, err)
+
+	nodeUUID := uuid.New().String()
+	hostCertBytes, err := authServer.GenerateHostCert(
+		ctx,
+		ssh.MarshalAuthorizedKey(sshPub),
+		"",
+		"",
+		[]string{nodeUUID, nodeHostname, testserver.Loopback},
+		clusterName,
+		types.RoleNode,
+		0,
+	)
+	require.NoError(t, err)
+
+	hostCert, err := apisshutils.ParseCertificate(hostCertBytes)
+	require.NoError(t, err)
+	signer, err := ssh.NewSignerFromSigner(key)
+	require.NoError(t, err)
+	hostKeySigner, err := ssh.NewCertSigner(hostCert, signer)
+	require.NoError(t, err)
+
+	// start SSH server
+	sshAddr := startSSHServer(t, caCheckers, hostKeySigner)
+
+	// create node resource
+	node := &types.ServerV2{
+		Kind:    types.KindNode,
+		SubKind: types.SubKindOpenSSHNode,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name: nodeUUID,
+		},
+		Spec: types.ServerSpecV2{
+			Addr:     sshAddr,
+			Hostname: nodeHostname,
+		},
+	}
+	_, err = authServer.UpsertNode(ctx, node)
+	require.NoError(t, err)
+
+	// wait for node resource to be written to the backend
+	timedCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	t.Cleanup(cancel)
+	w, err := authServer.NewWatcher(timedCtx, types.Watch{
+		Name: "node-create watcher",
+		Kinds: []types.WatchKind{
+			{
+				Kind: types.KindNode,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	for nodeCreated := false; !nodeCreated; {
+		select {
+		case e := <-w.Events():
+			if e.Type == types.OpPut {
+				nodeCreated = true
+			}
+		case <-w.Done():
+			t.Fatal("Did not receive node create event")
+		}
+	}
+	require.NoError(t, w.Close())
+
+	return node
+}
+
+// startSSHServer starts a SSH server that roughly mimics an unregistered
+// OpenSSH (agentless) server. The SSH server started only handles a small
+// subset of SSH requests necessary for testing.
+func startSSHServer(t *testing.T, caPubKeys []ssh.PublicKey, hostKey ssh.Signer) string {
+	t.Helper()
+
+	sshCfg := ssh.ServerConfig{
+		PublicKeyCallback: func(_ ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			cert, ok := key.(*ssh.Certificate)
+			if !ok {
+				return nil, fmt.Errorf("expected *ssh.Certificate, got %T", key)
+			}
+
+			// Sanity check incoming cert from proxy has Ed25519 key.
+			if cert.Key.Type() != ssh.KeyAlgoED25519 {
+				return nil, trace.BadParameter("expected Ed25519 key, got %v", cert.Key.Type())
+			}
+
+			for _, pubKey := range caPubKeys {
+				if bytes.Equal(cert.SignatureKey.Marshal(), pubKey.Marshal()) {
+					return &ssh.Permissions{}, nil
+				}
+			}
+
+			return nil, fmt.Errorf("signature key %v does not match OpenSSH CA", cert.SignatureKey)
+		},
+	}
+	sshCfg.AddHostKey(hostKey)
+
+	lis, err := net.Listen("tcp", testserver.Loopback+":")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, lis.Close())
+	})
+
+	go func() {
+		nConn, err := lis.Accept()
+		if utils.IsOKNetworkError(err) {
+			return
+		}
+		assert.NoError(t, err)
+		t.Cleanup(func() {
+			if nConn != nil {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = nConn.Close()
+			}
+		})
+
+		conn, channels, reqs, err := ssh.NewServerConn(nConn, &sshCfg)
+		assert.NoError(t, err)
+		t.Cleanup(func() {
+			if conn != nil {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = conn.Close()
+			}
+		})
+		go ssh.DiscardRequests(reqs)
+
+		var agentForwarded bool
+		var shellRequested bool
+		var execRequested bool
+		var sftpRequested bool
+		for {
+			var channelReq ssh.NewChannel
+			select {
+			case channelReq = <-channels:
+				if channelReq == nil { // server is closed
+					return
+				}
+			case <-t.Context().Done():
+				return
+			}
+			if !assert.Equal(t, "session", channelReq.ChannelType()) {
+				assert.NoError(t, channelReq.Reject(ssh.Prohibited, "only session channels expected"))
+				continue
+			}
+			channel, reqs, err := channelReq.Accept()
+			assert.NoError(t, err)
+			t.Cleanup(func() {
+				// the error is ignored here to avoid failing on net.ErrClosed
+				_ = channel.Close()
+			})
+
+			go func() {
+			outer:
+				for {
+					var req *ssh.Request
+					select {
+					case req = <-reqs:
+						if req == nil { // channel is closed
+							return
+						}
+					case <-t.Context().Done():
+						break outer
+					}
+					if req.WantReply {
+						assert.NoError(t, req.Reply(true, nil))
+					}
+					switch req.Type {
+					case sshutils.AgentForwardRequest:
+						agentForwarded = true
+					case sshutils.ShellRequest:
+						assert.NoError(t, channel.Close())
+						shellRequested = true
+						break outer
+					case sshutils.ExecRequest:
+						_, err := channel.SendRequest("exit-status", false, ssh.Marshal(struct{ C uint32 }{C: 0}))
+						assert.NoError(t, err)
+						assert.NoError(t, channel.Close())
+						execRequested = true
+						break outer
+					case sshutils.SubsystemRequest:
+						var r sshutils.SubsystemReq
+						err := ssh.Unmarshal(req.Payload, &r)
+						assert.NoError(t, err)
+						assert.Equal(t, "sftp", r.Name)
+						sftpRequested = true
+
+						sftpServer, err := sftp.NewServer(channel)
+						assert.NoError(t, err)
+						go sftpServer.Serve()
+						t.Cleanup(func() {
+							err := sftpServer.Close()
+							if err != nil {
+								assert.ErrorIs(t, err, io.EOF)
+							}
+						})
+						break outer
+					}
+				}
+				assert.True(t, (agentForwarded && shellRequested) || execRequested || sftpRequested)
+			}()
+		}
+	}()
+
+	return lis.Addr().String()
+}
+
 // TestHardwareKeyApp tests Hardware Key App flows.
 func TestHardwareKeyApp(t *testing.T) {
 	ctx := context.Background()
 
-	testModules := &modules.TestModules{
+	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
 			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
 				entitlements.App: {Enabled: true},
 			},
 		},
-	}
-	modules.SetTestModules(t, testModules)
+	})
 
-	testserver.WithResyncInterval(t, 0)
+	oldResyncInterval := defaults.ResyncInterval
+	defaults.ResyncInterval = 100 * time.Millisecond
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithResyncInterval", "1")
+	t.Cleanup(func() {
+		defaults.ResyncInterval = oldResyncInterval
+	})
 
 	isInsecure := lib.IsInsecureDevMode()
 	lib.SetInsecureDevMode(true)
@@ -317,9 +575,9 @@ func TestHardwareKeyApp(t *testing.T) {
 	accessUser.SetLogins([]string{user.Name})
 	connector := mockConnector(t)
 
-	testServer := testserver.MakeTestServer(t,
+	testServer, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithBootstrap(connector, accessUser),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps = servicecfg.AppsConfig{
@@ -331,6 +589,12 @@ func TestHardwareKeyApp(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, testServer.Close())
+		require.NoError(t, testServer.Wait())
+	})
+
 	authServer := testServer.GetAuthServer()
 	proxyAddr, err := testServer.ProxyWebAddr()
 	require.NoError(t, err)
@@ -402,8 +666,6 @@ func TestHardwareKeyApp(t *testing.T) {
 	_, err = authServer.UpsertRole(ctx, accessRole)
 	require.NoError(t, err)
 
-	testModules.MockAttestationData = nil
-
 	resp, err = testDummyAppConn(fmt.Sprintf("https://%v", proxyAddr.Addr), clientCert)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -420,9 +682,17 @@ func TestHardwareKeyApp(t *testing.T) {
 	require.Error(t, err)
 
 	// Set MockAttestationData to attest the expected key policy and try again.
-	testModules.MockAttestationData = &keys.AttestationData{
-		PrivateKeyPolicy: keys.PrivateKeyPolicyHardwareKeyTouch,
-	}
+	modulestest.SetTestModules(t, modulestest.Modules{
+		TestBuildType: modules.BuildEnterprise,
+		TestFeatures: modules.Features{
+			Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
+				entitlements.App: {Enabled: true},
+			},
+		},
+		MockAttestationData: &keys.AttestationData{
+			PrivateKeyPolicy: keys.PrivateKeyPolicyHardwareKeyTouch,
+		},
+	})
 
 	// App Login will still fail without MFA, since the app sessions will
 	// only be attested as "web_session".
diff --git a/tool/tsh/common/help.go b/tool/tsh/common/help.go
index 71ac21769b1db..c399417165ffe 100644
--- a/tool/tsh/common/help.go
+++ b/tool/tsh/common/help.go
@@ -76,4 +76,54 @@ Examples:
 
   Run commands in parallel, and save outputs to files:
   $ tsh db exec "select 1" --db-user mysql --labels env=dev --parallel=5 --output-dir=exec-outputs`
+
+	mcpConfigHelp = `
+Examples:
+  Print sample configuration for a MCP server app
+  $ tsh mcp config my-mcp-server-app
+
+  Print sample configuration for a streamable HTTP MCP server with custom headers
+  $ tsh mcp config my-mcp-server-app -H "Header1: value1" -H "Header2: value2"
+
+  Add all MCP servers to Claude Desktop
+  $ tsh mcp config --all --client-config=claude
+
+  Add all MCP servers to Cursor
+  $ tsh mcp config --all --client-config=cursor
+
+  Generate config for all MCP servers for VSCode
+  $ tsh mcp config --all --format=vscode
+
+  Add all MCP servers to VSCode project
+  $ tsh mcp config --all --client-config=<path-to-project>/.vscode/mcp.json
+
+  Add all MCP servers to Claude Code project
+  $ tsh mcp config --all --client-config=<path-to-project>/.mcp.json
+
+  Search MCP servers with labels and add to the specified JSON file
+  $ tsh mcp config --labels env=dev --client-config=my-config.json`
+
+	mcpDBConfigHelp = `
+Examples:
+  Print sample configuration for exposing database as MCP server
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname my-db-resource
+
+  Add the database configuration to Claude Desktop
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --client-config=claude my-db-resource
+
+  Add the database configuration to Cursor
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --client-config=cursor my-db-resource
+
+  Generate database configuration for VSCode
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --format=vscode my-db-resource
+
+  Add the database configuration to VSCode project
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --client-config=<path-to-project>/.vscode/.mcp.json my-db-resource
+
+  Add database configuration to Claude Code project
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --client-config=<path-to-project>/.mcp.json my-db-resource
+
+  Add the database configuration to the specified JSON file
+  $ tsh mcp db config --db-user=mydbuser --db-name=mydbname --client-config=my-config.json my-db-resource
+`
 )
diff --git a/tool/tsh/common/kube.go b/tool/tsh/common/kube.go
index a499c005d1ed1..9d37399dc0864 100644
--- a/tool/tsh/common/kube.go
+++ b/tool/tsh/common/kube.go
@@ -69,6 +69,7 @@ import (
 	kubeclient "github.com/gravitational/teleport/lib/client/kube"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	kuberelay "github.com/gravitational/teleport/lib/kube/relay"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -162,7 +163,7 @@ func (c *kubeJoinCommand) run(cf *CLIConf) error {
 			return trace.Wrap(err)
 		}
 		if crt != nil && time.Until(crt.NotAfter) > time.Minute {
-			logger.DebugContext(cf.Context, "Re-using existing TLS cert for kubernetes cluster", "cluster", kubeCluster)
+			logger.DebugContext(cf.Context, "Re-using existing TLS cert for Kubernetes cluster", "cluster", kubeCluster)
 		} else {
 			err = client.RetryWithRelogin(cf.Context, tc, func() error {
 				var err error
@@ -196,7 +197,11 @@ func (c *kubeJoinCommand) run(cf *CLIConf) error {
 		return trace.AccessDenied("this cluster does not support Kubernetes")
 	}
 
-	kubeStatus, err := fetchKubeStatus(cf.Context, tc)
+	// TODO(espadolini): joining requires hitting the agent handling a specific
+	// session, which is not currently implemented through the relay, once it's
+	// possible we should probably get rid of the whole ignoreRelay parameter
+	const ignoreRelayTrue = true
+	kubeStatus, err := fetchKubeStatus(cf.Context, tc, ignoreRelayTrue)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -208,7 +213,7 @@ func (c *kubeJoinCommand) run(cf *CLIConf) error {
 	}
 
 	tlsConfig.InsecureSkipVerify = cf.InsecureSkipVerify
-	tlsConfig.ServerName = kubeStatus.tlsServerName
+	tlsConfig.ServerName = kubeStatus.tlsServerNameForCluster(cluster, kubeCluster)
 	session, err := client.NewKubeSession(cf.Context,
 		client.KubeSessionConfig{
 			KubeProxyAddr:                 tc.Config.KubeProxyAddr,
@@ -852,7 +857,7 @@ func (c *kubeCredentialsCommand) writeKeyResponse(output io.Writer, keyRing *cli
 
 	cred, ok := keyRing.KubeTLSCredentials[kubeClusterName]
 	if !ok {
-		return trace.NotFound("TLS credential for kubernetes cluster %q not found", kubeClusterName)
+		return trace.NotFound("TLS credential for Kubernetes cluster %q not found", kubeClusterName)
 	}
 
 	// TODO (Joerger): Create a custom k8s Auth Provider or Exec Provider to use
@@ -1276,7 +1281,8 @@ func (c *kubeLoginCommand) run(cf *CLIConf) error {
 	err = retryWithAccessRequest(cf, tc, func() error {
 		err := client.RetryWithRelogin(cf.Context, tc, func() error {
 			var err error
-			kubeStatus, err = fetchKubeStatus(cf.Context, tc)
+			const ignoreRelayFalse = false
+			kubeStatus, err = fetchKubeStatus(cf.Context, tc, ignoreRelayFalse)
 			return trace.Wrap(err)
 		})
 		if err != nil {
@@ -1493,15 +1499,20 @@ type kubernetesStatus struct {
 	teleportClusterName string
 	kubeClusters        []types.KubeCluster
 	credentials         *client.KeyRing
-	tlsServerName       string
+	tlsServerNameFunc   func(teleportClusterName, kubeClusterName string) string
+}
+
+func (s *kubernetesStatus) tlsServerNameForCluster(teleportClusterName, kubeClusterName string) string {
+	if s.tlsServerNameFunc == nil {
+		return ""
+	}
+	return s.tlsServerNameFunc(teleportClusterName, kubeClusterName)
 }
 
 // fetchKubeStatus returns a kubernetesStatus populated from the given TeleportClient.
-func fetchKubeStatus(ctx context.Context, tc *client.TeleportClient) (*kubernetesStatus, error) {
+func fetchKubeStatus(ctx context.Context, tc *client.TeleportClient, ignoreRelay bool) (*kubernetesStatus, error) {
 	var err error
-	kubeStatus := &kubernetesStatus{
-		clusterAddr: tc.KubeClusterAddr(),
-	}
+	kubeStatus := &kubernetesStatus{}
 	kubeStatus.credentials, err = tc.LocalAgent().GetCoreKeyRing()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1511,9 +1522,22 @@ func fetchKubeStatus(ctx context.Context, tc *client.TeleportClient) (*kubernete
 		return nil, trace.Wrap(err)
 	}
 
+	if !ignoreRelay && tc.RelayAddr != "" {
+		kubeStatus.clusterAddr = (&url.URL{
+			Scheme: "https",
+			Host:   tc.RelayAddr,
+		}).String()
+		kubeStatus.tlsServerNameFunc = kuberelay.FullSNIForKubeCluster
+		return kubeStatus, nil
+	}
+
+	kubeStatus.clusterAddr = tc.KubeClusterAddr()
 	if tc.TLSRoutingEnabled {
 		k8host, _ := tc.KubeProxyHostPort()
-		kubeStatus.tlsServerName = client.GetKubeTLSServerName(k8host)
+		tlsServerName := client.GetKubeTLSServerName(k8host)
+		kubeStatus.tlsServerNameFunc = func(teleportClusterName, kubeClusterName string) string {
+			return tlsServerName
+		}
 	}
 
 	return kubeStatus, nil
@@ -1527,7 +1551,7 @@ func buildKubeConfigUpdate(cf *CLIConf, kubeStatus *kubernetesStatus, overrideCo
 		TeleportClusterName: kubeStatus.teleportClusterName,
 		Credentials:         kubeStatus.credentials,
 		ProxyAddr:           cf.Proxy,
-		TLSServerName:       kubeStatus.tlsServerName,
+		TLSServerNameFunc:   kubeStatus.tlsServerNameFunc,
 		Impersonate:         cf.kubernetesImpersonationConfig.kubernetesUser,
 		ImpersonateGroups:   cf.kubernetesImpersonationConfig.kubernetesGroups,
 		Namespace:           cf.kubeNamespace,
@@ -1592,7 +1616,7 @@ func updateKubeConfig(cf *CLIConf, tc *client.TeleportClient, path, overrideCont
 	if _, err := tc.Ping(cf.Context); err != nil {
 		return trace.Wrap(err)
 	}
-	if tc.KubeProxyAddr == "" {
+	if tc.KubeProxyAddr == "" && tc.RelayAddr == "" {
 		// Kubernetes support disabled, don't touch kubeconfig.
 		return nil
 	}
@@ -1748,7 +1772,7 @@ func formatAmbiguousKubeCluster(cf *CLIConf, selectors resourceSelectors, kubeCl
 func formatKubeNotFound(clusterFlag string, selectors resourceSelectors) string {
 	listCmd := formatKubeListCommand(clusterFlag)
 	if selectors.IsEmpty() {
-		return fmt.Sprintf("no kubernetes clusters found, check '%v' for a list of known clusters",
+		return fmt.Sprintf("no Kubernetes clusters found, check '%v' for a list of known clusters",
 			listCmd)
 	}
 	return fmt.Sprintf("%v not found, check '%v' for a list of known clusters",
diff --git a/tool/tsh/common/kube_proxy.go b/tool/tsh/common/kube_proxy.go
index 39310e7a6a6d0..009462cb53311 100644
--- a/tool/tsh/common/kube_proxy.go
+++ b/tool/tsh/common/kube_proxy.go
@@ -250,7 +250,7 @@ func (c *proxyKubeCommand) prepare(cf *CLIConf, tc *client.TeleportClient) (*cli
 	}
 
 	// Use logged-in clusters.
-	clusters := kubeconfig.LocalProxyClustersFromDefaultConfig(defaultConfig, tc.KubeClusterAddr())
+	clusters := kubeconfig.LocalProxyClustersFromDefaultConfig(defaultConfig, tc.WebProxyHost(), tc.KubeClusterAddr())
 	if len(clusters) == 0 {
 		return nil, nil, trace.BadParameter("%s", errorMsg)
 	}
@@ -352,23 +352,45 @@ func makeKubeLocalProxy(cf *CLIConf, tc *client.TeleportClient, clusters kubecon
 		Headless:     cf.Headless,
 		Logger:       logger,
 		CloseContext: cf.Context,
+		Relay:        tc.RelayAddr != "",
 	})
 
-	localProxy, err := alpnproxy.NewLocalProxy(
-		makeBasicLocalProxyConfig(cf.Context, tc, lpListener, cf.InsecureSkipVerify),
-		alpnproxy.WithHTTPMiddleware(kubeMiddleware),
-		alpnproxy.WithSNI(client.GetKubeTLSServerName(tc.WebProxyHost())),
-		alpnproxy.WithClusterCAs(cf.Context, tc.RootClusterCACertPool),
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
+	if tc.RelayAddr != "" {
+		localProxy, err := alpnproxy.NewLocalProxy(
+			alpnproxy.LocalProxyConfig{
+				RemoteProxyAddr: tc.RelayAddr,
+				// connectivity to a relay is secured by internal CAs, the
+				// insecure option makes no sense
+				InsecureSkipVerify: false,
+				Listener:           lpListener,
+				ParentContext:      cf.Context,
+				// the relay does not support TLS terminators
+				ALPNConnUpgradeRequired: false,
+			},
+			alpnproxy.WithHTTPMiddleware(kubeMiddleware),
+			alpnproxy.WithClusterCAs(cf.Context, tc.RootClusterCACertPool),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		kubeProxy.localProxy = localProxy
+	} else {
+		localProxy, err := alpnproxy.NewLocalProxy(
+			makeBasicLocalProxyConfig(cf.Context, tc, lpListener, cf.InsecureSkipVerify),
+			alpnproxy.WithHTTPMiddleware(kubeMiddleware),
+			alpnproxy.WithSNI(client.GetKubeTLSServerName(tc.WebProxyHost())),
+			alpnproxy.WithClusterCAs(cf.Context, tc.RootClusterCACertPool),
+		)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		kubeProxy.localProxy = localProxy
 	}
-	kubeProxy.localProxy = localProxy
 
 	kubeProxy.forwardProxy, err = alpnproxy.NewKubeForwardProxy(alpnproxy.KubeForwardProxyConfig{
 		CloseContext: cf.Context,
 		ListenPort:   port,
-		ForwardAddr:  localProxy.GetAddr(),
+		ForwardAddr:  lpListener.Addr().String(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -434,6 +456,7 @@ func (k *kubeLocalProxy) createKubeConfig(defaultConfig *clientcmdapi.Config, ov
 		return nil, trace.BadParameter("empty default config")
 	}
 	values := &kubeconfig.LocalProxyValues{
+		TeleportProfileName:     k.tc.WebProxyHost(),
 		TeleportKubeClusterAddr: k.tc.KubeClusterAddr(),
 		LocalProxyURL:           "http://" + k.GetAddr(),
 		LocalProxyCAs:           map[string][]byte{},
diff --git a/tool/tsh/common/kube_test.go b/tool/tsh/common/kube_test.go
index 8a399c976d254..b55a830253fff 100644
--- a/tool/tsh/common/kube_test.go
+++ b/tool/tsh/common/kube_test.go
@@ -53,11 +53,11 @@ import (
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
 	kubeserver "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/tool/common"
-	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 func TestKube(t *testing.T) {
@@ -323,8 +323,8 @@ func (p *kubeTestPack) testListKube(t *testing.T) {
 
 // Tests `tsh kube login`, `tsh proxy kube`.
 func TestKubeSelection(t *testing.T) {
-	modules.SetTestModules(t,
-		&modules.TestModules{
+	modulestest.SetTestModules(t,
+		modulestest.Modules{
 			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
 				Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -333,8 +333,25 @@ func TestKubeSelection(t *testing.T) {
 			},
 		},
 	)
-	testenv.WithInsecureDevMode(t, true)
-	testenv.WithResyncInterval(t, 0)
+	originalValue := lib.IsInsecureDevMode()
+	lib.SetInsecureDevMode(true)
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithInsecureDevMode", "1")
+	t.Cleanup(func() {
+		lib.SetInsecureDevMode(originalValue)
+	})
+
+	oldResyncInterval := defaults.ResyncInterval
+	defaults.ResyncInterval = 100 * time.Millisecond
+	// To detect tests that run in parallel incorrectly, call t.Setenv with a
+	// dummy env var - that function detects tests with parallel ancestors
+	// and panics, preventing improper use of this helper.
+	t.Setenv("WithResyncInterval", "1")
+	t.Cleanup(func() {
+		defaults.ResyncInterval = oldResyncInterval
+	})
 
 	// Create a role that allows the user to request access to a restricted
 	// cluster but not to access it directly.
diff --git a/tool/tsh/common/kubectl.go b/tool/tsh/common/kubectl.go
index 55efc7a0d2b57..66b9edc9acf06 100644
--- a/tool/tsh/common/kubectl.go
+++ b/tool/tsh/common/kubectl.go
@@ -458,6 +458,12 @@ func shouldUseKubeLocalProxy(cf *CLIConf, kubectlArgs []string) (*clientcmdapi.C
 		return nil, nil, false
 	}
 
+	// TODO(espadolini): we could skip the local proxy when using a relay, but
+	// we can only know if we are using a relay once we have a TeleportClient
+	// and we load the profile, which will only happen later; seeing as it's
+	// only a little wasteful to spin up a local proxy it's fine for now, but if
+	// we rework the flow we should add a way to skip the local proxy when using
+	// a relay even if a connection through the control plane would require it
 	if !profile.RequireKubeLocalProxy() {
 		return nil, nil, false
 	}
@@ -480,7 +486,7 @@ func shouldUseKubeLocalProxy(cf *CLIConf, kubectlArgs []string) (*clientcmdapi.C
 	}
 
 	// Prepare Teleport kube cluster based on selected context.
-	kubeCluster, found := kubeconfig.FindTeleportClusterForLocalProxy(defaultConfig, kubeClusterAddrFromProfile(profile), selectedContext)
+	kubeCluster, found := kubeconfig.FindTeleportClusterForLocalProxy(defaultConfig, selectedContext, profile.Name(), kubeClusterAddrFromProfile(profile))
 	if !found {
 		return nil, nil, false
 	}
diff --git a/tool/tsh/common/kubectl_test.go b/tool/tsh/common/kubectl_test.go
index 05ccd0c19fcfd..4cde07e7cba0c 100644
--- a/tool/tsh/common/kubectl_test.go
+++ b/tool/tsh/common/kubectl_test.go
@@ -282,6 +282,7 @@ func mustSetupKubeconfig(t *testing.T, tshHome, kubeCluster string) string {
 				TLSCertificates: [][]byte{[]byte(fixtures.TLSCACertPEM)},
 			}},
 		},
+		ProxyAddr:     "localhost:443",
 		SelectCluster: kubeCluster,
 	}, false)
 	require.NoError(t, err)
diff --git a/tool/tsh/common/logger.go b/tool/tsh/common/logger.go
index df3e97595d259..06a60d8f6cd79 100644
--- a/tool/tsh/common/logger.go
+++ b/tool/tsh/common/logger.go
@@ -38,7 +38,7 @@ const (
 // It is called twice, first soon after launching tsh before argv is parsed and then again after
 // kingpin parses argv. This makes it possible to debug early startup functionality, particularly
 // command aliases.
-func initLogger(cf *CLIConf, opts loggingOpts) error {
+func initLogger(cf *CLIConf, purpose utils.LoggingPurpose, opts loggingOpts) (*slog.Logger, error) {
 	cf.OSLog = opts.osLog
 	cf.Debug = opts.debug || opts.osLog
 
@@ -49,7 +49,8 @@ func initLogger(cf *CLIConf, opts loggingOpts) error {
 		level = slog.LevelDebug
 	}
 
-	return trace.Wrap(utils.InitLogger(utils.LoggingForCLI, level, initLoggerOpts...))
+	logger, err := utils.InitLogger(purpose, level, initLoggerOpts...)
+	return logger, trace.Wrap(err)
 }
 
 type loggingOpts struct {
@@ -59,19 +60,36 @@ type loggingOpts struct {
 
 // parseLoggingOptsFromEnv calculates logging opts taking into account only env vars.
 func parseLoggingOptsFromEnv() loggingOpts {
-	var opts loggingOpts
-	opts.debug, _ = strconv.ParseBool(os.Getenv(debugEnvVar))
-	opts.osLog, _ = strconv.ParseBool(os.Getenv(osLogEnvVar))
+	return parseLoggingOptsFromEnvWithDefault(loggingOpts{})
+}
+
+// parseLoggingOptsFromEnvWithDefault calculates logging opts from env vars and
+// only updates opts if the env vars are set with valid values.
+func parseLoggingOptsFromEnvWithDefault(opts loggingOpts) loggingOpts {
+	if debugValue, ok := os.LookupEnv(debugEnvVar); ok {
+		if debug, err := strconv.ParseBool(debugValue); err == nil {
+			opts.debug = debug
+		}
+	}
+	if osLogValue, ok := os.LookupEnv(osLogEnvVar); ok {
+		if osLog, err := strconv.ParseBool(osLogValue); err == nil {
+			opts.osLog = osLog
+		}
+	}
 	return opts
 }
 
-// parseLoggingOptsFromEnvAndArgv calculates logging opts taking into account env vars and argv.
+func parseLoggingOptsFromEnvAndArgv(cf *CLIConf) loggingOpts {
+	return getLoggingOptsWithDefault(cf, loggingOpts{})
+}
+
+// getLoggingOptsWithDefault calculates logging opts taking into account env vars and argv.
 // Before calling this function, make sure that argv has been processed by kingpin (by calling
 // kingpin.Application.Parse) so that cf fields set from argv are up-to-date.
 //
 // CLI flags take precedence over env vars.
-func parseLoggingOptsFromEnvAndArgv(cf *CLIConf) loggingOpts {
-	opts := parseLoggingOptsFromEnv()
+func getLoggingOptsWithDefault(cf *CLIConf, defaults loggingOpts) loggingOpts {
+	opts := parseLoggingOptsFromEnvWithDefault(defaults)
 
 	if cf.DebugSetByUser {
 		opts.debug = cf.Debug
diff --git a/tool/tsh/common/mcp.go b/tool/tsh/common/mcp.go
new file mode 100644
index 0000000000000..ba10c5bcfd5b2
--- /dev/null
+++ b/tool/tsh/common/mcp.go
@@ -0,0 +1,263 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+)
+
+type mcpCommands struct {
+	dbStart  *mcpDBStartCommand
+	dbConfig *mcpDBConfigCommand
+
+	config  *mcpConfigCommand
+	list    *mcpListCommand
+	connect *mcpConnectCommand
+}
+
+func newMCPCommands(app *kingpin.Application, cf *CLIConf) *mcpCommands {
+	mcp := app.Command("mcp", "View and control proxied MCP servers.")
+	db := mcp.Command("db", "Database access for MCP servers.")
+	return &mcpCommands{
+		dbStart:  newMCPDBCommand(db, cf),
+		dbConfig: newMCPDBconfigCommand(db, cf),
+
+		list:    newMCPListCommand(mcp, cf),
+		config:  newMCPConfigCommand(mcp, cf),
+		connect: newMCPConnectCommand(mcp, cf),
+	}
+}
+
+type mcpClientConfigFlags struct {
+	clientConfig          string
+	jsonFormat            string
+	configFormat          string
+	configFormatSetByUser bool
+}
+
+const (
+	mcpClientConfigClaude = "claude"
+	mcpClientConfigCursor = "cursor"
+)
+
+// cursorConfigFormatAlias is an alias for Cursor config format.
+const cursorConfigFormatAlias = "cursor"
+
+func (m *mcpClientConfigFlags) addToCmd(cmd *kingpin.CmdClause) {
+	cmd.Flag(
+		"client-config",
+		fmt.Sprintf(
+			"If specified, update the specified client config, assuming its format. %q for default Claude Desktop config, %q for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable %s.",
+			mcpClientConfigClaude,
+			mcpClientConfigCursor,
+			mcpClientConfigEnvVar,
+		)).
+		Envar(mcpClientConfigEnvVar).
+		StringVar(&m.clientConfig)
+
+	cmd.Flag(
+		"json-format",
+		fmt.Sprintf(
+			"Format the JSON file (%s). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable %s. Default is %s.",
+			strings.Join(m.jsonFormatOptions(), ", "),
+			mcpConfigJSONFormatEnvVar,
+			mcpconfig.FormatJSONAuto,
+		)).
+		Envar(mcpConfigJSONFormatEnvVar).
+		Default(string(mcpconfig.FormatJSONAuto)).
+		EnumVar(&m.jsonFormat, m.jsonFormatOptions()...)
+
+	cmd.Flag(
+		"format",
+		fmt.Sprintf(
+			"Format specifies the configuration format (%s, %s, %s). If not provided it will assume format from the configuration file, When no configuration file is provided it defaults to %q.",
+			string(mcpconfig.ConfigFormatClaude),
+			string(mcpconfig.ConfigFormatVSCode),
+			cursorConfigFormatAlias,
+			string(mcpconfig.DefaultConfigFormat),
+		)).
+		IsSetByUser(&m.configFormatSetByUser).
+		StringVar(&m.configFormat)
+}
+
+func (m *mcpClientConfigFlags) loadConfig(configFormat mcpconfig.ConfigFormat) (*mcpconfig.FileConfig, error) {
+	switch m.clientConfig {
+	case mcpClientConfigClaude:
+		return mcpconfig.LoadClaudeConfigFromDefaultPath()
+	case mcpClientConfigCursor:
+		return mcpconfig.LoadConfigFromGlobalCursor()
+	default:
+		return mcpconfig.LoadConfigFromFile(m.clientConfig, configFormat)
+	}
+}
+
+func (m *mcpClientConfigFlags) jsonFormatOptions() []string {
+	return []string{
+		string(mcpconfig.FormatJSONPretty),
+		string(mcpconfig.FormatJSONCompact),
+		string(mcpconfig.FormatJSONAuto),
+		string(mcpconfig.FormatJSONNone),
+	}
+}
+
+func (m *mcpClientConfigFlags) printFooterNotes(w io.Writer) error {
+	if m.configFormatSetByUser {
+		return nil
+	}
+
+	_, err := fmt.Fprintln(w, mcpConfigHint)
+	return trace.Wrap(err)
+}
+
+func (m *mcpClientConfigFlags) format() (mcpconfig.ConfigFormat, error) {
+	var (
+		configFormat mcpconfig.ConfigFormat
+		flagFormat   mcpconfig.ConfigFormat
+	)
+
+	switch m.clientConfig {
+	case mcpClientConfigClaude, mcpClientConfigCursor:
+		configFormat = mcpconfig.ConfigFormatClaude
+	case "":
+	default:
+		configFormat = mcpconfig.ConfigFormatFromPath(m.clientConfig)
+	}
+
+	if m.configFormat != "" {
+		// Solve alias.
+		if m.configFormat == cursorConfigFormatAlias {
+			m.configFormat = string(mcpconfig.ConfigFormatClaude)
+		}
+
+		var err error
+		flagFormat, err = mcpconfig.ParseConfigFormat(m.configFormat)
+		if err != nil {
+			return mcpconfig.ConfigFormatUnspecified, trace.Wrap(err)
+		}
+	}
+
+	// If both the format and config file path are presented, we must ensure
+	// both have the same format.
+	if configFormat.IsSpecified() && flagFormat.IsSpecified() {
+		if configFormat == flagFormat {
+			return configFormat, nil
+		}
+
+		return mcpconfig.ConfigFormatUnspecified, trace.BadParameter(
+			"Configuration format mismatch. --client-config=%s option uses %s config format, but --format=%s was set. You can drop one of the flags or adjust the values to match.",
+			m.clientConfig,
+			configFormat,
+			m.configFormat,
+		)
+	}
+
+	if configFormat.IsSpecified() {
+		return configFormat, nil
+	}
+
+	if flagFormat.IsSpecified() {
+		return flagFormat, nil
+	}
+
+	// In case of unspecified format, use default value.
+	return mcpconfig.DefaultConfigFormat, nil
+}
+
+// runMCPConfig runs the MCP config based on flags.
+func runMCPConfig(cf *CLIConf, flags *mcpClientConfigFlags, exec mcpConfigExec) error {
+	// Ensure the format options are correct, otherwise return error to the
+	// user instead of ignoring the values.
+	format, err := flags.format()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	switch flags.clientConfig {
+	case "":
+		return trace.Wrap(exec.printInstructions(cf.Stdout(), format))
+	default:
+		config, err := flags.loadConfig(format)
+		if err != nil {
+			return trace.BadParameter("failed to load mcp configuration file at %q: %v", flags.clientConfig, err)
+		}
+		return trace.Wrap(exec.updateConfig(cf.Stdout(), config))
+	}
+}
+
+// mcpConfig defines a subset of functions from mcpconfig.Config.
+type mcpConfig interface {
+	PutMCPServer(string, mcpconfig.MCPServer) error
+	GetMCPServers() map[string]mcpconfig.MCPServer
+}
+
+// mcpConfigExec defines the interface for generating install instructions and
+// directly updating the MCP config.
+type mcpConfigExec interface {
+	// printInstructions prints instructions on how to configure the MCP server.
+	printInstructions(io.Writer, mcpconfig.ConfigFormat) error
+	// updateConfig directly updates the client config. It might also print
+	// information.
+	updateConfig(io.Writer, *mcpconfig.FileConfig) error
+}
+
+func makeLocalMCPServer(cf *CLIConf, args []string) mcpconfig.MCPServer {
+	s := mcpconfig.MCPServer{
+		Command: cf.executablePath,
+		Args:    args,
+	}
+
+	// Use the same TELEPORT_HOME the current tsh uses.
+	if homeDir := os.Getenv(types.HomeEnvVar); homeDir != "" {
+		s.AddEnv(types.HomeEnvVar, homeDir)
+	}
+
+	// Disable debug through env var. MCP server commands should enable debug by
+	// default.
+	opts := getLoggingOptsForMCPServer(cf)
+	if !opts.debug {
+		s.AddEnv(debugEnvVar, "false")
+	}
+	if opts.osLog {
+		s.AddEnv(osLogEnvVar, "true")
+	}
+
+	// TODO(greedy52) anything else? maybe cluster, login-related, etc?
+	return s
+}
+
+func getLoggingOptsForMCPServer(cf *CLIConf) loggingOpts {
+	return getLoggingOptsWithDefault(cf, loggingOpts{
+		debug: true,
+	})
+}
+
+// mcpConfigHint is the hint message displayed when the configuration is shown
+// to users.
+const mcpConfigHint = `Tip: You can use this command to update your MCP servers configuration file automatically.
+- For Claude Desktop, use --client-config=claude to update the default configuration.
+- For Cursor, use --client-config=cursor to update the global MCP servers configuration.
+In addition, you can use --client-config=<path> to specify a config file location to directly update configuration of the supported clients.
+For example, you can update a VSCode project using --client-config=<path-to-project>/.vscode/mcp.json`
diff --git a/tool/tsh/common/mcp_app.go b/tool/tsh/common/mcp_app.go
new file mode 100644
index 0000000000000..3980aba3aee15
--- /dev/null
+++ b/tool/tsh/common/mcp_app.go
@@ -0,0 +1,541 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"io"
+	"iter"
+	"slices"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+	oteltrace "go.opentelemetry.io/otel/trace"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/iterutils"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/client"
+	clientmcp "github.com/gravitational/teleport/lib/client/mcp"
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/tool/common"
+)
+
+func newMCPConnectCommand(parent *kingpin.CmdClause, cf *CLIConf) *mcpConnectCommand {
+	cmd := &mcpConnectCommand{
+		CmdClause: parent.Command("connect", "Connect to an MCP server.").Hidden(),
+		cf:        cf,
+	}
+
+	cmd.Arg("name", "Name of the MCP server.").Required().StringVar(&cf.AppName)
+	cmd.Flag("auto-reconnect", mcpAutoReconnectHelp).Default("true").BoolVar(&cmd.autoReconnect)
+	cmd.Flag("header", "Extra custom headers used for streamable HTTP MCP servers.").Short('H').StringsVar(&cmd.httpHeaders)
+	return cmd
+}
+
+func newMCPListCommand(parent *kingpin.CmdClause, cf *CLIConf) *mcpListCommand {
+	cmd := &mcpListCommand{
+		CmdClause: parent.Command("ls", "List available MCP server applications."),
+		cf:        cf,
+	}
+
+	cmd.Flag("verbose", "Show extra MCP server fields.").Short('v').BoolVar(&cf.Verbose)
+	cmd.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
+	cmd.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
+	cmd.Arg("labels", labelHelp).StringVar(&cf.Labels)
+	cmd.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)).Short('f').Default(teleport.Text).EnumVar(&cf.Format, defaults.DefaultFormats...)
+	return cmd
+}
+
+func newMCPConfigCommand(parent *kingpin.CmdClause, cf *CLIConf) *mcpConfigCommand {
+	cmd := &mcpConfigCommand{
+		CmdClause: parent.Command("config", "Print client configuration details."),
+		cf:        cf,
+	}
+
+	cmd.Flag("all", "Select all MCP servers. Mutually exclusive with --labels or --query.").Short('R').BoolVar(&cf.ListAll)
+	cmd.Flag("labels", labelHelp).StringVar(&cf.Labels)
+	cmd.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
+	cmd.Flag("auto-reconnect", mcpAutoReconnectHelp).IsSetByUser(&cmd.autoReconnectSetByUser).BoolVar(&cmd.autoReconnect)
+	cmd.Arg("name", "Name of the MCP server.").StringVar(&cf.AppName)
+	cmd.clientConfig.addToCmd(cmd.CmdClause)
+	cmd.Alias(mcpConfigHelp)
+	cmd.Flag("header", "Extra custom headers used for streamable HTTP MCP servers.").Short('H').StringsVar(&cmd.httpHeaders)
+	return cmd
+}
+
+// mcpListCommand implements `tsh mcp ls` command.
+type mcpListCommand struct {
+	*kingpin.CmdClause
+	cf            *CLIConf
+	accessChecker services.AccessChecker
+	mcpServers    []types.Application
+}
+
+func (c *mcpListCommand) run() error {
+	if err := c.fetch(); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(c.print())
+}
+
+func (c *mcpListCommand) fetch() error {
+	ctx := c.cf.Context
+	tc, err := makeClient(c.cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var clusterClient *client.ClusterClient
+	err = client.RetryWithRelogin(ctx, tc, func() error {
+		clusterClient, err = tc.ConnectToCluster(ctx)
+		return trace.Wrap(err)
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer clusterClient.Close()
+
+	c.accessChecker, err = makeAccessChecker(ctx, tc, clusterClient.AuthClient)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	c.mcpServers, err = fetchMCPServers(ctx, tc, clusterClient.AuthClient)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+func (c *mcpListCommand) print() error {
+	mcpServers := iterutils.Map(func(app types.Application) mcpServerWithDetails {
+		return newMCPServerWithDetails(app, c.accessChecker)
+	}, slices.Values(c.mcpServers))
+
+	switch c.cf.Format {
+	case "", teleport.Text:
+		if c.cf.Verbose {
+			return trace.Wrap(printMCPServersInVerboseText(c.cf.Stdout(), mcpServers))
+		}
+		return trace.Wrap(printMCPServersInText(c.cf.Stdout(), mcpServers))
+
+	case teleport.JSON:
+		return trace.Wrap(common.PrintJSONIndent(c.cf.Stdout(), slices.Collect(mcpServers)))
+	case teleport.YAML:
+		return trace.Wrap(common.PrintYAML(c.cf.Stdout(), slices.Collect(mcpServers)))
+
+	default:
+		return trace.BadParameter("unsupported format %q", c.cf.Format)
+	}
+}
+
+func fetchMCPServers(ctx context.Context, tc *client.TeleportClient, auth apiclient.GetResourcesClient) ([]types.Application, error) {
+	if auth == nil {
+		var clusterClient *client.ClusterClient
+		var err error
+		err = client.RetryWithRelogin(ctx, tc, func() error {
+			clusterClient, err = tc.ConnectToCluster(ctx)
+			return trace.Wrap(err)
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		defer clusterClient.Close()
+		auth = clusterClient.AuthClient
+	}
+
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"fetchMCPServers",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
+	filter := tc.ResourceFilter(types.KindAppServer)
+	filter.PredicateExpression = withMCPServerAppFilter(filter.PredicateExpression)
+
+	appServers, err := apiclient.GetAllResources[types.AppServer](ctx, auth, filter)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return slices.SortedFunc(
+		types.DeduplicatedApps(types.AppServers(appServers).Applications()),
+		types.CompareResourceByNames,
+	), nil
+}
+
+func withMCPServerAppFilter(predicateExpression string) string {
+	return makePredicateConjunction(
+		predicateExpression,
+		`resource.sub_kind == "mcp"`,
+	)
+}
+
+// mcpServerWithDetails defines an MCP server application with permission
+// details, for printing purpose.
+type mcpServerWithDetails struct {
+	// Use a real type for inline.
+	*types.AppV3
+
+	Permissions struct {
+		MCP struct {
+			Tools struct {
+				Allowed []string `json:"allowed"`
+				Denied  []string `json:"denied,omitempty"`
+			} `json:"tools"`
+		} `json:"mcp"`
+	} `json:"permissions"`
+}
+
+func (a *mcpServerWithDetails) updateToolsPermissions(accessChecker services.AccessChecker) {
+	if accessChecker == nil {
+		return
+	}
+
+	mcpTools := accessChecker.EnumerateMCPTools(a.AppV3)
+	a.Permissions.MCP.Tools.Allowed, a.Permissions.MCP.Tools.Denied = mcpTools.ToEntities()
+}
+
+func newMCPServerWithDetails(app types.Application, accessChecker services.AccessChecker) mcpServerWithDetails {
+	a := mcpServerWithDetails{
+		AppV3: app.Copy(),
+	}
+	a.updateToolsPermissions(accessChecker)
+	return a
+}
+
+type mcpListRBACPrinter struct {
+	showFootnote bool
+}
+
+func (p *mcpListRBACPrinter) formatAllowedTools(mcpServer mcpServerWithDetails) string {
+	allowed := common.FormatAllowedEntities(mcpServer.Permissions.MCP.Tools.Allowed, mcpServer.Permissions.MCP.Tools.Denied)
+	if len(mcpServer.Permissions.MCP.Tools.Allowed) == 0 {
+		allowed += " [!]"
+		p.showFootnote = true
+	}
+	return allowed
+}
+
+func (p *mcpListRBACPrinter) maybePrintFootnote(w io.Writer) error {
+	if !p.showFootnote {
+		return nil
+	}
+	_, err := fmt.Fprintf(w, `[!] Warning: you do not have access to any tools on the MCP server.
+Please contact your Teleport administrator to ensure your Teleport role has
+appropriate 'allow.mcp.tools' set. For details on MCP access RBAC, see:
+https://goteleport.com/docs/enroll-resources/mcp-access/rbac/
+`)
+	return trace.Wrap(err)
+}
+
+func printMCPServersInText(w io.Writer, mcpServers iter.Seq[mcpServerWithDetails]) error {
+	var rows [][]string
+	var rbacPrinter mcpListRBACPrinter
+	for mcpServer := range mcpServers {
+		rows = append(rows, []string{
+			mcpServer.GetName(),
+			mcpServer.GetDescription(),
+			types.GetMCPServerTransportType(mcpServer.GetURI()),
+			rbacPrinter.formatAllowedTools(mcpServer),
+			common.FormatLabels(mcpServer.GetAllLabels(), false),
+		})
+	}
+	t := asciitable.MakeTableWithTruncatedColumn([]string{"Name", "Description", "Type", "Allowed Tools", "Labels"}, rows, "Labels")
+	if _, err := fmt.Fprintln(w, t.String()); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(rbacPrinter.maybePrintFootnote(w))
+}
+
+func printMCPServersInVerboseText(w io.Writer, mcpServers iter.Seq[mcpServerWithDetails]) error {
+	t := asciitable.MakeTable([]string{"Name", "Description", "Type", "Labels", "Command", "Args", "Allowed Tools"})
+	var rbacPrinter mcpListRBACPrinter
+	for mcpServer := range mcpServers {
+		mcpSpec := cmp.Or(mcpServer.GetMCP(), &types.MCP{})
+		t.AddRow([]string{
+			mcpServer.GetName(),
+			mcpServer.GetDescription(),
+			types.GetMCPServerTransportType(mcpServer.GetURI()),
+			common.FormatLabels(mcpServer.GetAllLabels(), true),
+			mcpSpec.Command,
+			strings.Join(mcpSpec.Args, " "),
+			rbacPrinter.formatAllowedTools(mcpServer),
+		})
+	}
+	if _, err := fmt.Fprintln(w, t.String()); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(rbacPrinter.maybePrintFootnote(w))
+}
+
+type mcpConfigCommand struct {
+	*kingpin.CmdClause
+	clientConfig           mcpClientConfigFlags
+	cf                     *CLIConf
+	autoReconnect          bool
+	autoReconnectSetByUser bool
+	httpHeaders            []string
+
+	mcpServerApps []types.Application
+
+	// fetchFunc is for fetching MCP servers, defaults to fetchMCPServers. Can
+	// be mocked in tests.
+	fetchFunc func(context.Context, *client.TeleportClient, apiclient.GetResourcesClient) ([]types.Application, error)
+}
+
+func (c *mcpConfigCommand) run() error {
+	if err := c.checkSelectorFlags(); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(runMCPConfig(c.cf, &c.clientConfig, c))
+}
+
+func (c *mcpConfigCommand) checkSelectorFlags() error {
+	// Some of them can technically be used together but make them mutually
+	// exclusively for simplicity.
+	var mutuallyExclusiveSelectors int
+	for _, selectorEnabled := range []bool{
+		c.cf.ListAll,
+		c.cf.AppName != "",
+		c.cf.PredicateExpression != "",
+		c.cf.Labels != "",
+	} {
+		if selectorEnabled {
+			mutuallyExclusiveSelectors++
+		}
+	}
+
+	switch mutuallyExclusiveSelectors {
+	case 0:
+		return trace.BadParameter("no selector specified. Please provide the MCP server name or use one of the following flags: --all, --labels, or --query.")
+	case 1:
+		return nil
+	default:
+		return trace.BadParameter("only one selector is allowed. Specify either the MCP server name or one of --all, --labels, or --query flags.")
+	}
+}
+
+func (c *mcpConfigCommand) fetchAndPrintResult() error {
+	if err := c.fetch(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	printList := fmt.Sprintf(`Found MCP servers:
+%v
+
+`, strings.Join(slices.Collect(types.ResourceNames(c.mcpServerApps)), "\n"))
+	_, err := fmt.Fprint(c.cf.Stdout(), printList)
+	return trace.Wrap(err)
+}
+
+func (c *mcpConfigCommand) fetch() error {
+	if c.cf.AppName != "" {
+		c.cf.PredicateExpression = makeNamePredicate(c.cf.AppName)
+	}
+	if c.fetchFunc == nil {
+		c.fetchFunc = fetchMCPServers
+	}
+
+	tc, err := makeClient(c.cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	c.mcpServerApps, err = c.fetchFunc(c.cf.Context, tc, nil)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if len(c.mcpServerApps) == 0 {
+		return trace.NotFound("no MCP servers found")
+	}
+	return nil
+}
+
+func (c *mcpConfigCommand) addMCPServersToConfig(config mcpConfig) error {
+	for _, app := range c.mcpServerApps {
+		localName := mcpServerAppConfigPrefix + app.GetName()
+		args := []string{"mcp", "connect", app.GetName()}
+		args = c.maybeAddAutoReconnect(args)
+		if types.GetMCPServerTransportType(app.GetURI()) == types.MCPTransportHTTP {
+			if _, err := parseHTTPHeaders(c.httpHeaders); err != nil {
+				return trace.Wrap(err)
+			}
+			for _, header := range c.httpHeaders {
+				args = append(args, "-H", header)
+			}
+		}
+		err := config.PutMCPServer(localName, makeLocalMCPServer(c.cf, args))
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
+func (c *mcpConfigCommand) maybeAddAutoReconnect(args []string) []string {
+	if !c.autoReconnectSetByUser {
+		return args
+	}
+	if c.autoReconnect {
+		return append(args, "--auto-reconnect")
+	}
+	return append(args, "--no-auto-reconnect")
+}
+
+func (c *mcpConfigCommand) printInstructions(w io.Writer, configFormat mcpconfig.ConfigFormat) error {
+	if err := c.fetchAndPrintResult(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	config := mcpconfig.NewConfig(configFormat)
+	if err := c.addMCPServersToConfig(config); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := fmt.Fprintf(w, "Here is a sample JSON configuration for launching Teleport MCP servers using %s format:\n", configFormat); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := config.Write(w, mcpconfig.FormatJSONOption(c.clientConfig.jsonFormat)); err != nil {
+		return trace.Wrap(err)
+	}
+	if _, err := fmt.Fprintln(w); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(c.clientConfig.printFooterNotes(w))
+}
+
+func (c *mcpConfigCommand) updateConfig(w io.Writer, config *mcpconfig.FileConfig) error {
+	if err := c.fetchAndPrintResult(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := c.addMCPServersToConfig(config); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := config.Save(mcpconfig.FormatJSONOption(c.clientConfig.jsonFormat)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err := fmt.Fprintf(c.cf.Stdout(), `Updated client configuration at:
+%s
+
+Teleport MCP servers will be prefixed with "teleport-mcp-" in this
+configuration. You may need to restart your client to reload these new
+configurations.
+`, config.Path())
+	return trace.Wrap(err)
+}
+
+const (
+	mcpServerAppConfigPrefix = "teleport-mcp-"
+	mcpAutoReconnectHelp     = "Automatically starts a new remote MCP session " +
+		"when the previous remote session is interrupted " +
+		"by network issues or tsh session expirations. " +
+		"Recommended for stateless MCP sessions. Defaults to true."
+)
+
+// mcpConnectCommand implements `tsh mcp connect` command.
+type mcpConnectCommand struct {
+	*kingpin.CmdClause
+	cf            *CLIConf
+	autoReconnect bool
+	httpHeaders   []string
+}
+
+func (c *mcpConnectCommand) run() error {
+	_, err := initLogger(c.cf, utils.LoggingForMCP, getLoggingOptsForMCPServer(c.cf))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	tc, err := makeClient(c.cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	tc.NonInteractive = true
+
+	httpHeaders, err := parseHTTPHeaders(c.httpHeaders)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	dialer := client.NewMCPServerDialer(tc, c.cf.AppName)
+	return clientmcp.ProxyStdioConn(
+		c.cf.Context,
+		clientmcp.ProxyStdioConnConfig{
+			ClientStdio:              utils.CombinedStdio{},
+			GetApp:                   dialer.GetApp,
+			DialServer:               dialer.DialALPN,
+			MakeReconnectUserMessage: makeMCPReconnectUserMessage,
+			AutoReconnect:            c.autoReconnect,
+			HTTPHeaders:              httpHeaders,
+		},
+	)
+}
+
+func parseHTTPHeaders(headerArgs []string) (map[string]string, error) {
+	if len(headerArgs) == 0 {
+		return nil, nil
+	}
+	httpHeaders := make(map[string]string)
+	for _, header := range headerArgs {
+		key, value, ok := strings.Cut(header, ":")
+		if !ok {
+			return nil, trace.BadParameter("malformed header %q", header)
+		}
+		httpHeaders[strings.TrimSpace(key)] = strings.TrimSpace(value)
+	}
+	return httpHeaders, nil
+}
+
+func makeMCPReconnectUserMessage(err error) string {
+	var userMessage string
+	switch {
+	case clientmcp.IsLikelyTemporaryNetworkError(err):
+		userMessage = "A network error occurred while trying to connect to Teleport." +
+			" This issue is likely temporary — the server may be unavailable, or your internet connection may be unstable." +
+			" Please check your network and try again in a few moments." +
+			" If your network appears to be working, try restarting your MCP client to see if the problem is resolved."
+	case client.IsErrorResolvableWithRelogin(err):
+		userMessage = clientmcp.ReloginRequiredErrorMessage
+	case clientmcp.IsServerInfoChangedError(err):
+		userMessage = "The remote MCP server information has changed after the reconnection. " +
+			" Please restart your MCP client to use the new version."
+	default:
+		userMessage = "An error was encountered while sending the request to Teleport." +
+			" This does not appear to be a transient error." +
+			" Please ensure your tsh session is valid and restart your MCP client to see if the problem is resolved."
+	}
+
+	userMessage += " If the issue persists, check the MCP logs for more details or contact your Teleport admin."
+	return userMessage
+}
diff --git a/tool/tsh/common/mcp_app_test.go b/tool/tsh/common/mcp_app_test.go
new file mode 100644
index 0000000000000..0f8199aa97315
--- /dev/null
+++ b/tool/tsh/common/mcp_app_test.go
@@ -0,0 +1,478 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"bytes"
+	"context"
+	"maps"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client"
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+	"github.com/gravitational/teleport/lib/observability/tracing"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils/testutils/golden"
+)
+
+func Test_fetchMCPServers(t *testing.T) {
+	devLabels := map[string]string{"env": "dev"}
+	prodLabels := map[string]string{"env": "prod"}
+
+	nonMCPAppServer := mustMakeNewAppServer(t, mustMakeNewAppV3(t,
+		types.Metadata{
+			Name:   "non-mcp-app",
+			Labels: devLabels,
+		},
+		types.AppSpecV3{
+			URI: "https://example.com",
+		},
+	), "host1")
+
+	devMCPAppHost1 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "dev", devLabels), "host1")
+	devMCPAppHost2 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "dev", devLabels), "host2")
+	proMCPApp1 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "prod-1", prodLabels), "host1")
+	proMCPApp2 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "prod-2", prodLabels), "host1")
+
+	fakeClient := &fakeResourcesClient{
+		resources: []types.ResourceWithLabels{
+			proMCPApp1, nonMCPAppServer, devMCPAppHost1, devMCPAppHost2, proMCPApp2,
+		},
+	}
+
+	tests := []struct {
+		name         string
+		searchConfig client.Config
+		wantNames    []string
+	}{
+		{
+			name: "no match",
+			searchConfig: client.Config{
+				Labels: map[string]string{"env": "not-found"},
+			},
+			wantNames: nil,
+		},
+		{
+			name:         "all",
+			searchConfig: client.Config{},
+			wantNames:    []string{"dev", "prod-1", "prod-2"},
+		},
+		{
+			name: "by label",
+			searchConfig: client.Config{
+				Labels: map[string]string{"env": "prod"},
+			},
+			wantNames: []string{"prod-1", "prod-2"},
+		},
+		{
+			name: "by keywords",
+			searchConfig: client.Config{
+				SearchKeywords: []string{"prod"},
+			},
+			wantNames: []string{"prod-1", "prod-2"},
+		},
+		{
+			name: "by predicate",
+			searchConfig: client.Config{
+				PredicateExpression: "name==\"dev\"",
+			},
+			wantNames: []string{"dev"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tc := &client.TeleportClient{
+				Config: tt.searchConfig,
+			}
+			tc.Tracer = tracing.NoopTracer(teleport.ComponentTSH)
+
+			mcpServers, err := fetchMCPServers(context.Background(), tc, fakeClient)
+			require.NoError(t, err)
+			require.Equal(t, tt.wantNames, slices.Collect(types.ResourceNames(mcpServers)))
+		})
+	}
+}
+
+// Test_mcpListCommand tests "tsh mcp ls".
+// Note that mcpListCommand.fetch is not interesting to test and some of its
+// logic is tested separately (see Test_fetchMCPServers above). Thus, this test
+// mocks fetch results and tests mcpListCommand.print.
+func Test_mcpListCommand(t *testing.T) {
+	devLabels := map[string]string{"env": "dev"}
+	mcpServers := []types.Application{
+		mustMakeMCPAppWithNameAndLabels(t, "allow-read", devLabels),
+		mustMakeMCPAppWithNameAndLabels(t, "deny-write", devLabels),
+	}
+	accessChecker := fakeMCPServerAccessChecker{}
+
+	tests := []struct {
+		name       string
+		cf         *CLIConf
+		mcpServers []types.Application
+		wantOutput string
+	}{
+		{
+			name:       "text format",
+			cf:         &CLIConf{},
+			mcpServers: mcpServers,
+		},
+		{
+			name: "text format in verbose",
+			cf: &CLIConf{
+				Verbose: true,
+			},
+			mcpServers: mcpServers,
+		},
+		{
+			name: "text format with rbac warning",
+			cf:   &CLIConf{},
+			mcpServers: []types.Application{
+				mustMakeMCPAppWithNameAndLabels(t, "no-access", devLabels),
+			},
+		},
+		{
+			name: "JSON format",
+			cf: &CLIConf{
+				Format: "json",
+			},
+			mcpServers: mcpServers,
+		},
+		{
+			name: "YAML format",
+			cf: &CLIConf{
+				Format: "yaml",
+			},
+			mcpServers: mcpServers,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			cf := tt.cf
+			cf.OverrideStdout = &buf
+			cf.Context = context.Background()
+
+			cmd := &mcpListCommand{
+				cf:            tt.cf,
+				mcpServers:    tt.mcpServers,
+				accessChecker: accessChecker,
+			}
+
+			err := cmd.print()
+			require.NoError(t, err)
+
+			if golden.ShouldSet() {
+				golden.Set(t, buf.Bytes())
+			}
+
+			require.Equal(t, string(golden.Get(t)), buf.String())
+		})
+	}
+}
+
+func Test_mcpConfigCommand(t *testing.T) {
+	devLabels := map[string]string{"env": "dev"}
+	prodLabels := map[string]string{"env": "prod"}
+	devMCPApp1 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "dev1", devLabels), "host")
+	devMCPApp2 := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "dev2", devLabels), "host")
+	prodMCPApp := mustMakeNewAppServer(t, mustMakeMCPAppWithNameAndLabels(t, "prod", prodLabels), "host")
+	httpMCPApp := mustMakeNewAppServer(t, mustMakeNewAppV3(t,
+		types.Metadata{Name: "streamable-http"},
+		types.AppSpecV3{URI: "mcp+https://localhost:12345/mcp"},
+	), "host")
+	fakeClient := &fakeResourcesClient{
+		resources: []types.ResourceWithLabels{
+			devMCPApp1, devMCPApp2, prodMCPApp, httpMCPApp,
+		},
+	}
+
+	tests := []struct {
+		name               string
+		cf                 *CLIConf
+		checkError         require.ErrorAssertionFunc
+		disableConfigFile  bool
+		inputHeaderArgs    []string
+		wantNamesInConfig  []string
+		wantOutputContains string
+	}{
+		{
+			name: "not found",
+			cf: &CLIConf{
+				AppName: "not found",
+			},
+			checkError: require.Error,
+			// "local-everything" was already in the config. Double-check we
+			// didn't screw it up.
+			wantNamesInConfig: []string{"local-everything"},
+		},
+		{
+			name: "single",
+			cf: &CLIConf{
+				AppName: "dev2",
+			},
+			checkError:         require.NoError,
+			wantNamesInConfig:  []string{"teleport-mcp-dev2", "local-everything"},
+			wantOutputContains: "Updated client configuration",
+		},
+		{
+			name: "all",
+			cf: &CLIConf{
+				ListAll: true,
+			},
+			checkError:         require.NoError,
+			wantNamesInConfig:  []string{"teleport-mcp-dev1", "teleport-mcp-dev2", "teleport-mcp-prod", "teleport-mcp-streamable-http", "local-everything"},
+			wantOutputContains: "Updated client configuration",
+		},
+		{
+			name: "labels",
+			cf: &CLIConf{
+				Labels: "env=dev",
+			},
+			checkError:         require.NoError,
+			wantNamesInConfig:  []string{"teleport-mcp-dev1", "teleport-mcp-dev2", "local-everything"},
+			wantOutputContains: "Updated client configuration",
+		},
+		{
+			name:              "no selector",
+			cf:                &CLIConf{},
+			checkError:        require.Error,
+			wantNamesInConfig: []string{"local-everything"},
+		},
+		{
+			name: "too many selectors",
+			cf: &CLIConf{
+				ListAll: true,
+				AppName: "dev2",
+			},
+			checkError:        require.Error,
+			wantNamesInConfig: []string{"local-everything"},
+		},
+		{
+			name: "print json",
+			cf: &CLIConf{
+				AppName: "dev2",
+			},
+			disableConfigFile: true,
+			checkError:        require.NoError,
+			// Hints for config file flags.
+			wantOutputContains: "Tip:",
+			wantNamesInConfig:  []string{"local-everything"},
+		},
+		{
+			name: "custom headers",
+			cf: &CLIConf{
+				AppName: "streamable-http",
+			},
+			inputHeaderArgs: []string{
+				"H1: v1",
+				"H2:v2",
+			},
+			disableConfigFile: true,
+			checkError:        require.NoError,
+			wantOutputContains: `"-H",
+        "H1: v1",
+        "-H",
+        "H2:v2"`,
+			wantNamesInConfig: []string{"local-everything"},
+		},
+		{
+			name: "invalid header",
+			cf: &CLIConf{
+				AppName: "streamable-http",
+			},
+			inputHeaderArgs: []string{
+				"H1=v1",
+			},
+			disableConfigFile: true,
+			checkError:        require.Error,
+			wantNamesInConfig: []string{"local-everything"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			configPath := setupMockMCPConfig(t)
+			var buf bytes.Buffer
+			tt.cf.Context = context.Background()
+			tt.cf.Proxy = "proxy:3080"
+			tt.cf.HomePath = t.TempDir()
+			tt.cf.OverrideStdout = &buf
+			mustCreateEmptyProfile(t, tt.cf)
+
+			cmd := mcpConfigCommand{
+				clientConfig: mcpClientConfigFlags{
+					clientConfig: configPath,
+					jsonFormat:   "pretty",
+				},
+				cf: tt.cf,
+				fetchFunc: func(ctx context.Context, tc *client.TeleportClient, _ apiclient.GetResourcesClient) ([]types.Application, error) {
+					return fetchMCPServers(ctx, tc, fakeClient)
+				},
+				httpHeaders: tt.inputHeaderArgs,
+			}
+
+			if tt.disableConfigFile {
+				cmd.clientConfig.clientConfig = ""
+			}
+
+			err := cmd.run()
+			tt.checkError(t, err)
+			mustHaveMCPServerNamesInConfig(t, configPath, tt.wantNamesInConfig)
+			require.Contains(t, buf.String(), tt.wantOutputContains)
+		})
+	}
+}
+
+func Test_parseHTTPHeaders(t *testing.T) {
+	tests := []struct {
+		name       string
+		inputArgs  []string
+		checkError require.ErrorAssertionFunc
+		expected   map[string]string
+	}{
+		{
+			name:       "no headers",
+			checkError: require.NoError,
+		},
+		{
+			name: "multiple headers",
+			inputArgs: []string{
+				"a:b",
+				"c: d",
+			},
+			checkError: require.NoError,
+			expected: map[string]string{
+				"a": "b",
+				"c": "d",
+			},
+		},
+		{
+			name: "invalid",
+			inputArgs: []string{
+				"a=b",
+			},
+			checkError: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			actual, err := parseHTTPHeaders(tt.inputArgs)
+			tt.checkError(t, err)
+			require.Equal(t, tt.expected, actual)
+		})
+	}
+}
+
+type fakeResourcesClient struct {
+	resources []types.ResourceWithLabels
+}
+
+func (f *fakeResourcesClient) GetResources(ctx context.Context, req *proto.ListResourcesRequest) (*proto.ListResourcesResponse, error) {
+	filtered, err := matchResources(req, f.resources)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	paginatedResources, err := services.MakePaginatedResources(req.ResourceType, filtered, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &proto.ListResourcesResponse{
+		Resources:  paginatedResources,
+		TotalCount: int32(len(filtered)),
+	}, nil
+}
+
+func mustMakeNewAppServer(t *testing.T, app *types.AppV3, host string) types.AppServer {
+	t.Helper()
+	appServer, err := types.NewAppServerV3FromApp(app, host, host)
+	require.NoError(t, err)
+	return appServer
+}
+
+func mustMakeMCPAppWithNameAndLabels(t *testing.T, name string, labels map[string]string, opts ...func(*types.MCP)) *types.AppV3 {
+	t.Helper()
+	mcpSpec := &types.MCP{
+		Command:       "test",
+		Args:          []string{"arg"},
+		RunAsHostUser: "test",
+	}
+	for _, opt := range opts {
+		opt(mcpSpec)
+	}
+	return mustMakeNewAppV3(t,
+		types.Metadata{
+			Name:        name,
+			Description: "description",
+			Labels:      labels,
+		},
+		types.AppSpecV3{
+			MCP: mcpSpec,
+		},
+	)
+}
+
+type fakeMCPServerAccessChecker struct {
+	services.AccessChecker
+}
+
+func (f fakeMCPServerAccessChecker) EnumerateMCPTools(app types.Application) services.EnumerationResult {
+	switch app.GetName() {
+	case "allow-read":
+		return services.NewEnumerationResultFromEntities([]string{"read_*"}, nil)
+	case "deny-write":
+		return services.NewEnumerationResultFromEntities([]string{"*"}, []string{"write_*"})
+	default:
+		return services.NewEnumerationResult()
+	}
+}
+
+func setupMockMCPConfig(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.json")
+	config, err := mcpconfig.LoadConfigFromFile(configPath, mcpconfig.ConfigFormatClaude)
+	require.NoError(t, err)
+	require.NoError(t, config.PutMCPServer("local-everything", mcpconfig.MCPServer{
+		Command: "npx",
+		Args:    []string{"-y", "@modelcontextprotocol/server-everything"},
+	}))
+	require.NoError(t, config.Save(mcpconfig.FormatJSONPretty))
+	return config.Path()
+}
+
+func mustHaveMCPServerNamesInConfig(t *testing.T, configPath string, wantNames []string) {
+	jsonConfig, err := mcpconfig.LoadConfigFromFile(configPath, mcpconfig.ConfigFormatClaude)
+	require.NoError(t, err)
+	require.ElementsMatch(t,
+		wantNames,
+		slices.Collect(maps.Keys(jsonConfig.GetMCPServers())),
+	)
+}
diff --git a/tool/tsh/common/mcp_db.go b/tool/tsh/common/mcp_db.go
new file mode 100644
index 0000000000000..d4476eb8f8510
--- /dev/null
+++ b/tool/tsh/common/mcp_db.go
@@ -0,0 +1,413 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"net"
+	"text/template"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client"
+	dbmcp "github.com/gravitational/teleport/lib/client/db/mcp"
+	pgmcp "github.com/gravitational/teleport/lib/client/db/postgres/mcp"
+	"github.com/gravitational/teleport/lib/client/mcp"
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// mcpDBStartCommand implements `tsh mcp db start` command.
+type mcpDBStartCommand struct {
+	*kingpin.CmdClause
+
+	cf           *CLIConf
+	databaseURIs []string
+}
+
+func newMCPDBCommand(parent *kingpin.CmdClause, cf *CLIConf) *mcpDBStartCommand {
+	cmd := &mcpDBStartCommand{
+		CmdClause: parent.Command("start", "Start a local MCP server for database access.").Hidden(),
+		cf:        cf,
+	}
+
+	cmd.Arg("uris", "List of database MCP resource URIs that will be served by the server").Required().StringsVar(&cmd.databaseURIs)
+	return cmd
+}
+
+func (c *mcpDBStartCommand) run() error {
+	logger, err := initLogger(c.cf, utils.LoggingForMCP, getLoggingOptsForMCPServer(c.cf))
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	registry := defaultDBMCPRegistry
+	if c.cf.databaseMCPRegistryOverride != nil {
+		registry = c.cf.databaseMCPRegistryOverride
+	}
+
+	tc, err := makeClient(c.cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Avoid any input request on the command execution. This is required,
+	// otherwise the MCP clients will be stuck waiting for a response.
+	tc.NonInteractive = false
+
+	configuredDatabases := map[string]struct{}{}
+	uris := make([]*mcp.ResourceURI, len(c.databaseURIs))
+	for i, rawURI := range c.databaseURIs {
+		uri, err := mcp.ParseResourceURI(rawURI)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if !uri.IsDatabase() {
+			return trace.BadParameter("%q resource must be a database", rawURI)
+		}
+
+		// TODO(gabrielcorado): support databases from different clusters.
+		if uri.GetClusterName() != tc.SiteName {
+			return trace.BadParameter("Databases must be from the same cluster (%q). %q is from a different cluster.", tc.SiteName, rawURI)
+		}
+
+		if _, ok := configuredDatabases[uri.WithoutParams().String()]; ok {
+			return trace.BadParameter("Database %q was configured twice. MCP servers only support serving a database service only once.", uri.GetDatabaseName())
+		}
+
+		configuredDatabases[uri.WithoutParams().String()] = struct{}{}
+		uris[i] = uri
+	}
+
+	server := dbmcp.NewRootServer(logger)
+	allDatabases, err := c.prepareDatabases(c.cf, tc, registry, uris, logger, server)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	for protocol, newServerFunc := range registry {
+		databases := allDatabases[protocol]
+		if len(databases) == 0 {
+			continue
+		}
+
+		srv, err := newServerFunc(c.cf.Context, &dbmcp.NewServerConfig{
+			Logger:     logger,
+			RootServer: server,
+			Databases:  databases,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		defer srv.Close(c.cf.Context)
+	}
+
+	return trace.Wrap(server.ServeStdio(c.cf.Context, c.cf.Stdin(), c.cf.Stdout()))
+}
+
+// prepareDatabases based on the available MCP servers, initialize the database
+// local proxy and generate the MCP database.
+func (c *mcpDBStartCommand) prepareDatabases(
+	cf *CLIConf,
+	tc *client.TeleportClient,
+	registry dbmcp.Registry,
+	uris []*mcp.ResourceURI,
+	logger *slog.Logger,
+	server *dbmcp.RootServer,
+) (map[string][]*dbmcp.Database, error) {
+	var (
+		ctx            = cf.Context
+		dbsPerProtocol = make(map[string][]*dbmcp.Database)
+	)
+
+	for _, uri := range uris {
+		serviceName := uri.GetDatabaseServiceName()
+		dbUser := uri.GetDatabaseUser()
+		dbName := uri.GetDatabaseName()
+
+		route := tlsca.RouteToDatabase{
+			ServiceName: serviceName,
+			Username:    dbUser,
+			Database:    dbName,
+		}
+
+		info, err := getDatabaseInfo(cf, tc, []tlsca.RouteToDatabase{route})
+		if err != nil {
+			logger.InfoContext(ctx, "failed to retrieve database information", "database", serviceName, "error", err)
+			continue
+		}
+
+		db, err := info.GetDatabase(ctx, tc)
+		if err != nil {
+			logger.InfoContext(ctx, "failed to load database information", "database", serviceName, "error", err)
+			continue
+		}
+
+		if !registry.IsSupported(db.GetProtocol()) {
+			logger.InfoContext(ctx, "database protocol unsupported, skipping it", "database", serviceName, "protocol", db.GetProtocol())
+			continue
+		}
+
+		mcpDB := &dbmcp.Database{
+			DB:           db,
+			ClusterName:  uri.GetClusterName(),
+			DatabaseUser: dbUser,
+			DatabaseName: dbName,
+			// Connections are always handled by the TeleportClient, so here we
+			// just need to return a placeholder.
+			LookupFunc: func(ctx context.Context, host string) (addrs []string, err error) {
+				return []string{host}, nil
+			},
+			DialContextFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				conn, err := tc.DialDatabase(ctx, proto.RouteToDatabase{
+					ServiceName: db.GetName(),
+					Protocol:    db.GetProtocol(),
+					Username:    dbUser,
+					Database:    dbName,
+				})
+				return conn, trace.Wrap(err)
+			},
+		}
+		dbsPerProtocol[db.GetProtocol()] = append(dbsPerProtocol[db.GetProtocol()], mcpDB)
+		server.RegisterDatabase(mcpDB)
+	}
+
+	return dbsPerProtocol, nil
+}
+
+// databasesGetter is the interface used to retrieve available
+// databases using filters.
+type databasesGetter interface {
+	// ListDatabases returns all registered databases.
+	ListDatabases(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.Database, error)
+}
+
+// mcpDBConfigCommand implements `tsh mcp db config` command.
+type mcpDBConfigCommand struct {
+	*kingpin.CmdClause
+
+	clientConfig mcpClientConfigFlags
+	ctx          context.Context
+	cf           *CLIConf
+	siteName     string
+	overwriteEnv bool
+
+	// dbURI is the generated database MCP resource URI.
+	dbURI mcp.ResourceURI
+
+	// databasesGetter used to retrieve databases information. Can be mocked in
+	// tests.
+	databasesGetter databasesGetter
+}
+
+func newMCPDBconfigCommand(parent *kingpin.CmdClause, cf *CLIConf) *mcpDBConfigCommand {
+	cmd := &mcpDBConfigCommand{
+		CmdClause: parent.Command("config", "Print client configuration details."),
+		ctx:       cf.Context,
+		cf:        cf,
+	}
+
+	cmd.Flag("db-user", "Database user to log in as.").Short('u').StringVar(&cf.DatabaseUser)
+	cmd.Flag("db-name", "Database name to log in to.").Short('n').StringVar(&cf.DatabaseName)
+	cmd.Flag("overwrite", "Overwrites command and environment variable from the config file.").BoolVar(&cmd.overwriteEnv)
+	cmd.Arg("name", "Database service name.").StringVar(&cf.DatabaseService)
+	cmd.clientConfig.addToCmd(cmd.CmdClause)
+	cmd.Alias(mcpDBConfigHelp)
+	return cmd
+}
+
+// TODO(gabrielcorado): support generating config for multiple databases at once.
+func (m *mcpDBConfigCommand) run() error {
+	if m.databasesGetter == nil {
+		tc, err := makeClient(m.cf)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		m.databasesGetter = tc
+		m.siteName = tc.SiteName
+	}
+
+	databases, err := m.databasesGetter.ListDatabases(m.ctx, &proto.ListResourcesRequest{
+		Namespace:           apidefaults.Namespace,
+		ResourceType:        types.KindDatabaseServer,
+		PredicateExpression: makeDiscoveredNameOrNamePredicate(m.cf.DatabaseService),
+		// TODO(gabrielcorado): support requesting access.
+		UseSearchAsRoles: false,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	db, err := chooseOneDatabase(m.cf, databases)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// TODO(gabrielcorado): support having the flags empty and assume the values
+	// based on the role and database.
+	if m.cf.DatabaseUser == "" || m.cf.DatabaseName == "" {
+		return trace.BadParameter("You must specify --db-user and --db-name flags used to connect to the database")
+	}
+
+	m.dbURI = mcp.NewDatabaseResourceURI(m.siteName, db.GetName(), mcp.WithDatabaseUser(m.cf.DatabaseUser), mcp.WithDatabaseName(m.cf.DatabaseName))
+	return trace.Wrap(runMCPConfig(m.cf, &m.clientConfig, m))
+}
+
+func (m *mcpDBConfigCommand) printInstructions(w io.Writer, configFormat mcpconfig.ConfigFormat) error {
+	config := mcpconfig.NewConfig(configFormat)
+	// Since the database is being added to a "fresh" config file the database
+	// will always be new and we can ignore the additional message as well.
+	if _, _, err := m.addDatabaseToConfig(config, m.dbURI); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := fmt.Fprintf(w, "Here is a sample JSON configuration for launching Teleport MCP servers using %s format:\n", configFormat); err != nil {
+		return trace.Wrap(err)
+	}
+	if err := config.Write(w, mcpconfig.FormatJSONOption(m.clientConfig.jsonFormat)); err != nil {
+		return trace.Wrap(err)
+	}
+	if _, err := fmt.Fprintf(w, `
+If you already have an entry for %q server, add the following database resource URI to the command arguments list:
+%s
+
+`, mcpDBConfigName, m.dbURI.String()); err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(m.clientConfig.printFooterNotes(w))
+}
+
+// TODO(gabrielcorado): support updating multiple databases at once.
+func (m *mcpDBConfigCommand) updateConfig(w io.Writer, config *mcpconfig.FileConfig) error {
+	preexistentDB, commandChanged, err := m.addDatabaseToConfig(config, m.dbURI)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := config.Save(mcpconfig.FormatJSONOption(m.clientConfig.jsonFormat)); err != nil {
+		return trace.Wrap(err)
+	}
+
+	templateData := struct {
+		Name          string
+		ConfigPath    string
+		ConfigName    string
+		PreexistentDB bool
+		EnvChanged    bool
+		OverwriteEnv  bool
+	}{
+		Name:          m.dbURI.GetDatabaseServiceName(),
+		ConfigPath:    config.Path(),
+		ConfigName:    mcpDBConfigName,
+		PreexistentDB: preexistentDB,
+		EnvChanged:    commandChanged,
+		OverwriteEnv:  m.overwriteEnv,
+	}
+
+	return trace.Wrap(mcpDBConfigMessageTemplate.Execute(m.cf.Stdout(), templateData))
+}
+
+// addDatabaseToConfig adds the provided database, merging with existent
+// databases configured. This function returns a additional message to be
+// displayed to users.
+func (m *mcpDBConfigCommand) addDatabaseToConfig(config mcpConfig, dbURI mcp.ResourceURI) (bool, bool, error) {
+	var (
+		dbs        []string
+		updated    bool
+		envChanged bool
+		server     = makeLocalMCPServer(m.cf, nil /* args */)
+	)
+	if existentServer, ok := config.GetMCPServers()[mcpDBConfigName]; ok {
+		// For most common cases we want to keep the environment variables
+		// unchanged. However, in case users want a "fresh start" they can
+		// provide a flag so we overwrite them with default values.
+		if !maps.Equal(server.Envs, existentServer.Envs) {
+			envChanged = true
+			if !m.overwriteEnv {
+				server.Envs = existentServer.Envs
+			}
+		}
+
+		for _, arg := range existentServer.Args {
+			// We're only interested in resources, any flags or other command
+			// parts will be discarded.
+			uri, err := mcp.ParseResourceURI(arg)
+			if err != nil {
+				continue
+			}
+
+			if !uri.IsDatabase() {
+				return false, false, trace.BadParameter("resource %q on config is not a database", uri.String())
+			}
+
+			if uri.WithoutParams().Equal(dbURI.WithoutParams()) {
+				dbs = append(dbs, dbURI.String())
+				updated = true
+			} else {
+				dbs = append(dbs, uri.String())
+			}
+		}
+	}
+
+	if !updated {
+		dbs = append(dbs, dbURI.String())
+	}
+
+	server.Args = append([]string{"mcp", "db", "start"}, dbs...)
+	return updated, envChanged, trace.Wrap(config.PutMCPServer(mcpDBConfigName, server))
+}
+
+var (
+	// defaultDBMCPRegistry is the default database access MCP servers registry.
+	defaultDBMCPRegistry = map[string]dbmcp.NewServerFunc{
+		defaults.ProtocolPostgres:    pgmcp.NewServer,
+		defaults.ProtocolCockroachDB: pgmcp.NewServerForCockroachDB,
+	}
+)
+
+// mcpDBConfigName is the configuration name that is managed by the config
+// command.
+const mcpDBConfigName = "teleport-databases"
+
+// mcpDBConfigMessageTemplate is the MCP db config message template.
+var mcpDBConfigMessageTemplate = template.Must(template.New("").Funcs(template.FuncMap{
+	"quote": func(s string) string { return fmt.Sprintf("%q", s) },
+}).Parse(`{{ if .PreexistentDB -}}Updated{{ else }}Added{{ end }} database {{ .Name | quote }} on the client configuration at:
+{{ .ConfigPath }}
+
+Teleport database access MCP server is named {{ .ConfigName | quote }} in this configuration.
+
+You may need to restart your client to reload these new configurations.
+
+{{- if (and (.EnvChanged) (not .OverwriteEnv)) }}
+
+Environment variables have changed, but existing values will be preserved.
+To overwrite them, rerun this command with the --overwrite flag.
+{{- end }}
+`))
diff --git a/tool/tsh/common/mcp_db_test.go b/tool/tsh/common/mcp_db_test.go
new file mode 100644
index 0000000000000..a4b28e7b2ae67
--- /dev/null
+++ b/tool/tsh/common/mcp_db_test.go
@@ -0,0 +1,469 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package common
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/trace"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcptransport "github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	dbmcp "github.com/gravitational/teleport/lib/client/db/mcp"
+	clientmcp "github.com/gravitational/teleport/lib/client/mcp"
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
+)
+
+func TestMCPDBCommand(t *testing.T) {
+	tmpHomePath := t.TempDir()
+	connector := mockConnector(t)
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetDatabaseUsers([]string{"postgres", "root"})
+	alice.SetDatabaseNames([]string{"postgres", "defaultdb"})
+	alice.SetRoles([]string{"access"})
+
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName("root"),
+		testserver.WithBootstrap(connector, alice),
+		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.Databases.Enabled = true
+			cfg.Databases.Databases = []servicecfg.Database{
+				{
+					Name:     "postgres1",
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "external-pg:5432",
+				},
+				{
+					Name:     "postgres2",
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "external-pg:5432",
+				},
+				{
+					Name:     "cockroach",
+					Protocol: defaults.ProtocolCockroachDB,
+					URI:      "external-cockroach:5432",
+				},
+				{
+					Name:     "mysql-local",
+					Protocol: defaults.ProtocolMySQL,
+					URI:      "external-mysql:3306",
+				},
+			}
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
+
+	authServer := authProcess.GetAuthServer()
+	require.NotNil(t, authServer)
+
+	proxyAddr, err := authProcess.ProxyWebAddr()
+	require.NoError(t, err)
+
+	err = Run(t.Context(), []string{
+		"login", "--insecure", "--debug", "--proxy", proxyAddr.String(),
+	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, alice, connector.GetName()))
+	require.NoError(t, err)
+
+	stdin, writer := io.Pipe()
+	reader, stdout := io.Pipe()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	executionCh := make(chan error)
+	go func() {
+		executionCh <- Run(ctx, []string{
+			"mcp",
+			"db",
+			"start",
+			"teleport://clusters/root/databases/postgres1?dbUser=postgres&dbName=postgres",
+			"teleport://clusters/root/databases/postgres2?dbUser=postgres&dbName=postgres",
+			"teleport://clusters/root/databases/cockroach?dbUser=root&dbName=defaultdb",
+		}, setHomePath(tmpHomePath), func(c *CLIConf) error {
+			c.overrideStdin = stdin
+			c.OverrideStdout = stdout
+			// MCP server logs are going to be discarded.
+			c.overrideStderr = io.Discard
+
+			// Fake a query tool for each database.
+			addDBQueryTool := func(protocol string, nsc *dbmcp.NewServerConfig) {
+				nsc.RootServer.AddTool(
+					mcp.NewTool(dbmcp.ToolName(protocol, "query")),
+					func(context.Context, mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+						return nil, trace.NotImplemented("not implemented")
+					},
+				)
+			}
+			c.databaseMCPRegistryOverride = map[string]dbmcp.NewServerFunc{
+				defaults.ProtocolPostgres: func(ctx context.Context, nsc *dbmcp.NewServerConfig) (dbmcp.Server, error) {
+					addDBQueryTool(defaults.ProtocolPostgres, nsc)
+					return &testDatabaseMCP{}, nil
+				},
+				defaults.ProtocolCockroachDB: func(ctx context.Context, nsc *dbmcp.NewServerConfig) (dbmcp.Server, error) {
+					addDBQueryTool(defaults.ProtocolCockroachDB, nsc)
+					return &testDatabaseMCP{}, nil
+				},
+			}
+			return nil
+		})
+	}()
+
+	cltTransport := mcptransport.NewIO(reader, writer, nil /* logging */)
+	require.NoError(t, cltTransport.Start(t.Context()))
+	clt := mcpclient.NewClient(cltTransport)
+	require.NoError(t, clt.Start(t.Context()))
+	defer clt.Close()
+
+	req := mcp.InitializeRequest{}
+	req.Params.ProtocolVersion = mcp.LATEST_PROTOCOL_VERSION
+	req.Params.ClientInfo = mcp.Implementation{
+		Name:    "test-client",
+		Version: "1.0.0",
+	}
+
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		_, err = clt.Initialize(t.Context(), req)
+		require.NoError(collect, err)
+		require.NoError(collect, clt.Ping(t.Context()))
+	}, time.Second, 100*time.Millisecond)
+
+	tools, err := clt.ListTools(t.Context(), mcp.ListToolsRequest{})
+	require.NoError(t, err)
+	var toolNames []string
+	for _, tool := range tools.Tools {
+		toolNames = append(toolNames, tool.Name)
+	}
+	require.ElementsMatch(t, []string{
+		"teleport_list_databases",
+		"teleport_postgres_query",
+		"teleport_cockroachdb_query",
+	}, toolNames)
+
+	// Stop the MCP server command and wait until it is finished.
+	cancel()
+	select {
+	case err := <-executionCh:
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(10 * time.Second):
+		require.Fail(t, "expected the execution to be completed")
+	}
+}
+
+func TestMCPDBCommandFailures(t *testing.T) {
+	tmpHomePath := t.TempDir()
+	connector := mockConnector(t)
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetDatabaseUsers([]string{"postgres"})
+	alice.SetDatabaseNames([]string{"postgres"})
+	alice.SetRoles([]string{"access"})
+	clusterName := "root"
+
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithClusterName(clusterName),
+		testserver.WithBootstrap(connector, alice),
+		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.Databases.Enabled = true
+			cfg.Databases.Databases = []servicecfg.Database{
+				{
+					Name:     "postgres1",
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "external-pg:5432",
+				},
+				{
+					Name:     "postgres2",
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "external-pg:5432",
+				},
+				{
+					Name:     "mysql-local",
+					Protocol: defaults.ProtocolMySQL,
+					URI:      "external-mysql:3306",
+				},
+			}
+		}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
+
+	authServer := authProcess.GetAuthServer()
+	require.NotNil(t, authServer)
+
+	proxyAddr, err := authProcess.ProxyWebAddr()
+	require.NoError(t, err)
+
+	withMockedMCPServers := func(c *CLIConf) error {
+		c.databaseMCPRegistryOverride = map[string]dbmcp.NewServerFunc{
+			defaults.ProtocolPostgres: func(ctx context.Context, nsc *dbmcp.NewServerConfig) (dbmcp.Server, error) {
+				return &testDatabaseMCP{}, nil
+			},
+		}
+		return nil
+	}
+
+	err = Run(t.Context(), []string{
+		"login", "--insecure", "--debug", "--proxy", proxyAddr.String(),
+	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, alice, connector.GetName()))
+	require.NoError(t, err)
+
+	t.Run("different clusters", func(t *testing.T) {
+		err := Run(t.Context(), []string{
+			"mcp",
+			"db",
+			"start",
+			"teleport://clusters/root/databases/postgres1?dbUser=postgres&dbName=postgres",
+			"teleport://clusters/other/databases/postgres2?dbUser=postgres&dbName=postgres",
+		}, setHomePath(tmpHomePath), withMockedMCPServers)
+		require.Error(t, err)
+	})
+
+	t.Run("duplicated databases", func(t *testing.T) {
+		err := Run(t.Context(), []string{
+			"mcp",
+			"db",
+			"start",
+			"teleport://clusters/root/databases/postgres1?dbUser=postgres&dbName=postgres",
+			"teleport://clusters/root/databases/postgres1?dbUser=readonly&dbName=postgres",
+		}, setHomePath(tmpHomePath), withMockedMCPServers)
+		require.Error(t, err)
+	})
+}
+
+func TestMCPDBConfigCommand(t *testing.T) {
+	clusterName := "root"
+	db0, err := types.NewDatabaseV3(types.Metadata{
+		Name: "pg",
+	}, types.DatabaseSpecV3{
+		Protocol: "protocol",
+		URI:      "uri",
+	})
+	require.NoError(t, err)
+	db1, err := types.NewDatabaseV3(types.Metadata{
+		Name: "another",
+	}, types.DatabaseSpecV3{
+		Protocol: "protocol",
+		URI:      "uri",
+	})
+	require.NoError(t, err)
+
+	dbURI0 := clientmcp.NewDatabaseResourceURI(clusterName, db0.GetName(), clientmcp.WithDatabaseUser("readonly"), clientmcp.WithDatabaseName("dbname"))
+	dbURI0Updated := clientmcp.NewDatabaseResourceURI(clusterName, db0.GetName(), clientmcp.WithDatabaseUser("rw"), clientmcp.WithDatabaseName("anotherdb"))
+	dbURI1 := clientmcp.NewDatabaseResourceURI(clusterName, db1.GetName(), clientmcp.WithDatabaseUser("rw"), clientmcp.WithDatabaseName("dbname"))
+
+	for name, tc := range map[string]struct {
+		cf                *CLIConf
+		overwriteEnv      bool
+		databasesGetter   databasesGetter
+		assertError       require.ErrorAssertionFunc
+		initialDatabases  []string
+		expectedDatabases []string
+		initialEnv        map[string]string
+		expectedEnv       map[string]string
+	}{
+		"add database to empty config": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI0.GetDatabaseUser(),
+				DatabaseName:    dbURI0.GetDatabaseName(),
+			},
+			databasesGetter:   &mockDatabasesGetter{dbs: []types.Database{db0, db1}},
+			assertError:       require.NoError,
+			expectedDatabases: []string{dbURI0.String()},
+			expectedEnv:       map[string]string{},
+		},
+		"append database to config": {
+			cf: &CLIConf{
+				DatabaseService: dbURI1.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI1.GetDatabaseUser(),
+				DatabaseName:    dbURI1.GetDatabaseName(),
+			},
+			databasesGetter:   &mockDatabasesGetter{dbs: []types.Database{db0, db1}},
+			assertError:       require.NoError,
+			initialDatabases:  []string{dbURI0.String()},
+			expectedDatabases: []string{dbURI0.String(), dbURI1.String()},
+			expectedEnv:       map[string]string{},
+		},
+		"update existent database": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0Updated.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI0Updated.GetDatabaseUser(),
+				DatabaseName:    dbURI0Updated.GetDatabaseName(),
+			},
+			databasesGetter:   &mockDatabasesGetter{dbs: []types.Database{db0, db1}},
+			assertError:       require.NoError,
+			initialDatabases:  []string{dbURI0.String(), dbURI1.String()},
+			expectedDatabases: []string{dbURI0Updated.String(), dbURI1.String()},
+			expectedEnv:       map[string]string{},
+		},
+		"database not found": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI0.GetDatabaseUser(),
+				DatabaseName:    dbURI0.GetDatabaseName(),
+			},
+			databasesGetter: &mockDatabasesGetter{err: trace.NotFound("database not found")},
+			assertError:     require.Error,
+		},
+		"missing connection params": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0Updated.GetDatabaseServiceName(),
+			},
+			databasesGetter: &mockDatabasesGetter{dbs: []types.Database{db0}},
+			assertError:     require.Error,
+		},
+		"keep current environment setting": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI0.GetDatabaseUser(),
+				DatabaseName:    dbURI0.GetDatabaseName(),
+				DebugSetByUser:  true,
+				Debug:           true,
+			},
+			databasesGetter:   &mockDatabasesGetter{dbs: []types.Database{db0, db1}},
+			assertError:       require.NoError,
+			initialDatabases:  []string{dbURI0.String()},
+			expectedDatabases: []string{dbURI0.String()},
+			initialEnv:        map[string]string{"test": "hello"},
+			expectedEnv:       map[string]string{"test": "hello"},
+		},
+		"reset environment setting": {
+			cf: &CLIConf{
+				DatabaseService: dbURI0.GetDatabaseServiceName(),
+				DatabaseUser:    dbURI0.GetDatabaseUser(),
+				DatabaseName:    dbURI0.GetDatabaseName(),
+			},
+			overwriteEnv:      true,
+			databasesGetter:   &mockDatabasesGetter{dbs: []types.Database{db0, db1}},
+			assertError:       require.NoError,
+			initialDatabases:  []string{dbURI0.String()},
+			expectedDatabases: []string{dbURI0.String()},
+			initialEnv:        map[string]string{"test": "hello"},
+			expectedEnv:       map[string]string{},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			configPath := setupMockDBMCPConfig(t, tc.cf, tc.initialDatabases, tc.initialEnv)
+			var buf bytes.Buffer
+			tc.cf.Context = context.Background()
+			tc.cf.Proxy = "proxy:3080"
+			tc.cf.HomePath = t.TempDir()
+			tc.cf.OverrideStdout = &buf
+			mustCreateEmptyProfile(t, tc.cf)
+
+			cmd := &mcpDBConfigCommand{
+				clientConfig: mcpClientConfigFlags{
+					clientConfig: configPath,
+					jsonFormat:   string(mcpconfig.FormatJSONPretty),
+				},
+				cf:              tc.cf,
+				ctx:             t.Context(),
+				siteName:        clusterName,
+				databasesGetter: tc.databasesGetter,
+				overwriteEnv:    tc.overwriteEnv,
+			}
+
+			err := cmd.run()
+			tc.assertError(t, err)
+			if err != nil {
+				return
+			}
+
+			jsonConfig, err := mcpconfig.LoadConfigFromFile(configPath, mcpconfig.ConfigFormatClaude)
+			require.NoError(t, err)
+			mcpCmd, ok := jsonConfig.GetMCPServers()[mcpDBConfigName]
+			require.True(t, ok, "expected configuration to include database access server definition, but got nothing")
+			require.Empty(t, cmp.Diff(mcpCmd.Args, tc.expectedDatabases, cmpopts.EquateEmpty(), cmpopts.IgnoreSliceElements(func(arg string) bool {
+				// Only assert database resources on the args.
+				_, err := clientmcp.ParseResourceURI(arg)
+				return err != nil
+			})))
+			require.Empty(t, cmp.Diff(mcpCmd.Envs, tc.expectedEnv, cmpopts.EquateEmpty(), cmpopts.IgnoreMapEntries(func(key string, _ string) bool {
+				// Ignore default fields, only look for additional ones.
+				switch key {
+				case types.HomeEnvVar, debugEnvVar, osLogEnvVar:
+					return true
+				default:
+					return false
+				}
+			})))
+		})
+	}
+}
+
+func setupMockDBMCPConfig(t *testing.T, cf *CLIConf, databasesURIs []string, additionalEnv map[string]string) string {
+	t.Helper()
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.json")
+	config, err := mcpconfig.LoadConfigFromFile(configPath, mcpconfig.ConfigFormatClaude)
+	require.NoError(t, err)
+	require.NoError(t, config.PutMCPServer("local-everything", mcpconfig.MCPServer{
+		Command: "npx",
+		Args:    []string{"-y", "@modelcontextprotocol/server-everything"},
+	}))
+	if len(databasesURIs) > 0 {
+		srv := makeLocalMCPServer(cf, append([]string{"mcp", "db", "start"}, databasesURIs...))
+		for name, value := range additionalEnv {
+			srv.AddEnv(name, value)
+		}
+		require.NoError(t, config.PutMCPServer(mcpDBConfigName, srv))
+	}
+	require.NoError(t, config.Save(mcpconfig.FormatJSONPretty))
+	return config.Path()
+}
+
+// testDatabaseMCP is a noop database MCP server.
+type testDatabaseMCP struct{}
+
+func (s *testDatabaseMCP) Close(_ context.Context) error { return nil }
+
+// mockDatabaseGetter is a fetch databases mock.
+type mockDatabasesGetter struct {
+	dbs []types.Database
+	err error
+}
+
+func (m *mockDatabasesGetter) ListDatabases(_ context.Context, _ *proto.ListResourcesRequest) ([]types.Database, error) {
+	return m.dbs, m.err
+}
diff --git a/tool/tsh/common/mcp_test.go b/tool/tsh/common/mcp_test.go
new file mode 100644
index 0000000000000..9cc75248b63e2
--- /dev/null
+++ b/tool/tsh/common/mcp_test.go
@@ -0,0 +1,152 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	mcpconfig "github.com/gravitational/teleport/lib/client/mcp/config"
+)
+
+func Test_getLoggingOptsWithDefault(t *testing.T) {
+	tests := []struct {
+		name          string
+		cf            *CLIConf
+		debugEnvValue string
+		osLogEnvValue string
+		checkDebug    require.BoolAssertionFunc
+		checkOSLog    require.BoolAssertionFunc
+	}{
+		{
+			name:       "debug enabled by default",
+			cf:         &CLIConf{},
+			checkDebug: require.True,
+			checkOSLog: require.False,
+		},
+		{
+			name: "enabled by flag",
+			cf: &CLIConf{
+				DebugSetByUser: true,
+				Debug:          true,
+				OSLogSetByUser: true,
+				OSLog:          true,
+			},
+			checkDebug: require.True,
+			checkOSLog: require.True,
+		},
+		{
+			name: "disabled by flag",
+			cf: &CLIConf{
+				DebugSetByUser: true,
+			},
+			checkDebug: require.False,
+			checkOSLog: require.False,
+		},
+		{
+			name:          "disabled by env",
+			cf:            &CLIConf{},
+			debugEnvValue: "false",
+			osLogEnvValue: "false",
+			checkDebug:    require.False,
+			checkOSLog:    require.False,
+		},
+		{
+			name:          "enabled by env",
+			cf:            &CLIConf{},
+			debugEnvValue: "true",
+			osLogEnvValue: "true",
+			checkDebug:    require.True,
+			checkOSLog:    require.True,
+		},
+		{
+			name:          "bad env",
+			cf:            &CLIConf{},
+			debugEnvValue: "what",
+			osLogEnvValue: "what",
+			checkDebug:    require.True,
+			checkOSLog:    require.False,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(debugEnvVar, tt.debugEnvValue)
+			t.Setenv(osLogEnvVar, tt.osLogEnvValue)
+			opts := getLoggingOptsForMCPServer(tt.cf)
+			tt.checkDebug(t, opts.debug)
+			tt.checkOSLog(t, opts.osLog)
+		})
+	}
+}
+
+func Test_getMCPConfigFormat(t *testing.T) {
+	for name, tc := range map[string]struct {
+		clientConfig   string
+		format         string
+		expectedFormat mcpconfig.ConfigFormat
+		expectedErr    require.ErrorAssertionFunc
+	}{
+		"client config set and no format": {
+			clientConfig:   "/path/to/.vscode/mcp.json", // This path indicates VSCode format.
+			expectedFormat: mcpconfig.ConfigFormatVSCode,
+			expectedErr:    require.NoError,
+		},
+		"only format set": {
+			format:         string(mcpconfig.ConfigFormatVSCode),
+			expectedFormat: mcpconfig.ConfigFormatVSCode,
+			expectedErr:    require.NoError,
+		},
+		"client config and format mismatch": {
+			clientConfig: "/path/to/.vscode/mcp.json", // This path indicates VSCode format.
+			format:       string(mcpconfig.ConfigFormatClaude),
+			expectedErr:  require.Error,
+		},
+		"client config alias and format mismatch": {
+			clientConfig: mcpClientConfigClaude,
+			format:       string(mcpconfig.ConfigFormatVSCode),
+			expectedErr:  require.Error,
+		},
+		"client config and format alias mismatch": {
+			clientConfig: "/path/to/.vscode/mcp.json", // This path indicates VSCode format.
+			format:       cursorConfigFormatAlias,
+			expectedErr:  require.Error,
+		},
+		"invalid format value": {
+			format:      "random-value",
+			expectedErr: require.Error,
+		},
+		"empty values": {
+			expectedFormat: mcpconfig.DefaultConfigFormat,
+			expectedErr:    require.NoError,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			flags := &mcpClientConfigFlags{
+				clientConfig: tc.clientConfig,
+				configFormat: tc.format,
+			}
+
+			res, err := flags.format()
+			tc.expectedErr(t, err)
+			require.Equal(t, tc.expectedFormat, res)
+		})
+	}
+}
diff --git a/tool/tsh/common/proxy.go b/tool/tsh/common/proxy.go
index a8cc0b832a472..e332d4fe11f28 100644
--- a/tool/tsh/common/proxy.go
+++ b/tool/tsh/common/proxy.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
+	apiutils "github.com/gravitational/teleport/api/utils"
 	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/db/dbcmd"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -51,8 +52,8 @@ import (
 // onProxyCommandSSH creates a local ssh proxy, dialing a node and transferring
 // data through stdin and stdout, to be used as an OpenSSH and PuTTY proxy
 // command.
-func onProxyCommandSSH(cf *CLIConf) error {
-	tc, err := makeClient(cf)
+func onProxyCommandSSH(cf *CLIConf, initFunc ClientInitFunc) error {
+	tc, err := initFunc(cf)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -173,9 +174,22 @@ func onProxyCommandDB(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
+	if cf.LocalProxyAddr != "" && cf.LocalProxyPort != "" {
+		return trace.BadParameter("either the address or port for the local proxy can be specified, not both")
+	}
 	addr := "localhost:0"
 	randomPort := true
-	if cf.LocalProxyPort != "" {
+	if cf.LocalProxyAddr != "" {
+		host, _, err := net.SplitHostPort(cf.LocalProxyAddr)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if !cf.InsecureListenAnywhere && !apiutils.IsLoopback(host) {
+			return trace.BadParameter("only loopback addresses are allowed for listener without --insecure-listen-anywhere switch, got %q", cf.LocalProxyAddr)
+		}
+		randomPort = false
+		addr = cf.LocalProxyAddr
+	} else if cf.LocalProxyPort != "" {
 		randomPort = false
 		addr = fmt.Sprintf("127.0.0.1:%s", cf.LocalProxyPort)
 	}
@@ -226,9 +240,11 @@ func onProxyCommandDB(cf *CLIConf) error {
 			return trace.Wrap(err)
 		}
 
-		commands, err := dbcmd.NewCmdBuilder(tc, profile, dbInfo.RouteToDatabase, rootCluster,
-			opts...,
-		).GetConnectCommandAlternatives(cf.Context)
+		cb, err := dbcmd.NewCmdBuilder(tc, profile, dbInfo.RouteToDatabase, rootCluster, dbInfo.getDatabaseForDBCmd, opts...)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		commands, err := cb.GetConnectCommandAlternatives(cf.Context)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -300,30 +316,14 @@ func makeDatabaseCommandOptions(ctx context.Context, tc *libclient.TeleportClien
 	var err error
 	opts := append([]dbcmd.ConnectCommandFunc{
 		dbcmd.WithLogger(logger),
-		dbcmd.WithGetDatabaseFunc(dbInfo.getDatabaseForDBCmd),
 	}, extraOpts...)
 
 	if opts, err = maybeAddDBUserPassword(ctx, tc, dbInfo, opts); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if opts, err = maybeAddGCPMetadata(ctx, tc, dbInfo, opts); err != nil {
-		return nil, trace.Wrap(err)
-	}
 	return maybeAddOracleOptions(ctx, tc, dbInfo, opts), nil
 }
 
-func maybeAddGCPMetadata(ctx context.Context, tc *libclient.TeleportClient, dbInfo *databaseInfo, opts []dbcmd.ConnectCommandFunc) ([]dbcmd.ConnectCommandFunc, error) {
-	if !requiresGCPMetadata(dbInfo.Protocol) {
-		return opts, nil
-	}
-	db, err := dbInfo.GetDatabase(ctx, tc)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	gcp := db.GetGCP()
-	return append(opts, dbcmd.WithGCP(gcp)), nil
-}
-
 func maybeAddGCPMetadataTplArgs(ctx context.Context, tc *libclient.TeleportClient, dbInfo *databaseInfo, templateArgs map[string]any) {
 	if !requiresGCPMetadata(dbInfo.Protocol) {
 		return
@@ -501,6 +501,10 @@ func onProxyCommandApp(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
+	if err := checkProxyMCPCompatibility(cf.command, app); err != nil {
+		return trace.Wrap(err)
+	}
+
 	proxyApp, err := newLocalProxyAppWithPortMapping(cf.Context, tc, profile, appInfo.RouteToApp, app, portMapping, cf.InsecureSkipVerify)
 	if err != nil {
 		return trace.Wrap(err)
@@ -530,6 +534,26 @@ func onProxyCommandApp(cf *CLIConf) error {
 	return nil
 }
 
+func checkProxyMCPCompatibility(command string, app types.Application) error {
+	if !app.IsMCP() {
+		switch command {
+		case "proxy mcp":
+			return trace.BadParameter("%q is not an MCP application", app.GetName())
+		default:
+			// tsh proxy app
+			return nil
+		}
+	}
+
+	mcpTransport := types.GetMCPServerTransportType(app.GetURI())
+	switch mcpTransport {
+	case types.MCPTransportHTTP:
+		return nil
+	default:
+		return trace.BadParameter("MCP applications with %s transport are not supported. Please see 'tsh mcp config --help' for more details.", mcpTransport)
+	}
+}
+
 // onProxyCommandAWS creates local proxes for AWS apps.
 func onProxyCommandAWS(cf *CLIConf) error {
 	if err := checkProxyAWSFormatCompatibility(cf); err != nil {
diff --git a/tool/tsh/common/proxy_test.go b/tool/tsh/common/proxy_test.go
index 27e22ab88207d..d198e6f33d1de 100644
--- a/tool/tsh/common/proxy_test.go
+++ b/tool/tsh/common/proxy_test.go
@@ -69,9 +69,9 @@ import (
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/teleagent"
+	"github.com/gravitational/teleport/lib/sshagent"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/testutils"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
@@ -262,10 +262,15 @@ func TestWithRsync(t *testing.T) {
 	serverOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname("node01"),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 	}
 
-	process := testserver.MakeTestServer(t, serverOpts...)
+	process, err := testserver.NewTeleportProcess(t.TempDir(), serverOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
 	tshHome, _ := mustLogin(t, process, accessUser, connector.GetName())
 
 	testBin, err := os.Executable()
@@ -394,7 +399,7 @@ func TestWithRsync(t *testing.T) {
 					if !assert.NoError(t, err) {
 						return
 					}
-					sshCert, tlsCert, err := asrv.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+					sshCert, tlsCert, err := asrv.GenerateUserTestCertsWithContext(ctx, auth.GenerateUserTestCertsRequest{
 						SSHPubKey:      sshPubKey,
 						TLSPubKey:      tlsPubKey,
 						Username:       accessUser.GetName(),
@@ -622,7 +627,7 @@ func TestProxySSHJumpHost(t *testing.T) {
 				rootServerOpts := []testserver.TestServerOptFunc{
 					testserver.WithBootstrap(connector, accessUser),
 					testserver.WithHostname("node01"),
-					testserver.WithClusterName(t, "root"),
+					testserver.WithClusterName("root"),
 					testserver.WithAuthConfig(
 						func(cfg *servicecfg.AuthConfig) {
 							cfg.NetworkingConfig.SetProxyListenerMode(rootListenerMode)
@@ -631,20 +636,30 @@ func TestProxySSHJumpHost(t *testing.T) {
 						},
 					),
 				}
-				rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+				rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					require.NoError(t, rootServer.Close())
+					require.NoError(t, rootServer.Wait())
+				})
 
 				leafServerOpts := []testserver.TestServerOptFunc{
 					testserver.WithBootstrap(accessUser),
 					testserver.WithHostname("node02"),
-					testserver.WithClusterName(t, "leaf"),
+					testserver.WithClusterName("leaf"),
 					testserver.WithAuthConfig(
 						func(cfg *servicecfg.AuthConfig) {
 							cfg.NetworkingConfig.SetProxyListenerMode(leafListenerMode)
 						},
 					),
 				}
-				leafServer := testserver.MakeTestServer(t, leafServerOpts...)
-				testserver.SetupTrustedCluster(ctx, t, rootServer, leafServer)
+				leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...)
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					require.NoError(t, leafServer.Close())
+					require.NoError(t, leafServer.Wait())
+				})
+				SetupTrustedCluster(ctx, t, rootServer, leafServer)
 
 				rootProxyAddr, err := rootServer.ProxyWebAddr()
 				require.NoError(t, err)
@@ -986,21 +1001,19 @@ func createAgent(t *testing.T) (agent.ExtendedAgent, string) {
 	keyring, ok := agent.NewKeyring().(agent.ExtendedAgent)
 	require.True(t, ok)
 
-	teleAgent := teleagent.NewServer(func() (teleagent.Agent, error) {
-		return teleagent.NopCloser(keyring), nil
-	})
+	agentServer := sshagent.NewServer(sshagent.NewStaticClientGetter(keyring))
 
 	// Start the SSH agent.
-	err := teleAgent.ListenUnixSocket(sockDir, sockName, nil)
+	err := agentServer.ListenUnixSocket(sockDir, sockName, nil)
 	require.NoError(t, err)
-	go teleAgent.Serve()
+	go agentServer.Serve()
 	t.Cleanup(func() {
-		teleAgent.Close()
+		agentServer.Close()
 	})
 
-	t.Setenv(teleport.SSHAuthSock, teleAgent.Path)
+	t.Setenv(teleport.SSHAuthSock, agentServer.Path)
 
-	return keyring, teleAgent.Path
+	return keyring, agentServer.Path
 }
 
 func disableAgent(t *testing.T) {
@@ -1013,7 +1026,7 @@ func (s *suite) setMockSSOLogin(t *testing.T) CliOption {
 }
 
 // deprecated: Use mustLogin instead which requires migrating from newTestSuite to
-// tools/teleport/testenv.MakeTestServer.
+// tools/teleport/testenv.NewTeleportProcess.
 func mustLoginLegacy(t *testing.T, s *suite, args ...string) (tshHome, kubeConfig string) {
 	tshHome = t.TempDir()
 	kubeConfig = filepath.Join(t.TempDir(), teleport.KubeConfigFile)
@@ -1035,7 +1048,7 @@ func mustLoginLegacy(t *testing.T, s *suite, args ...string) (tshHome, kubeConfi
 // login with new temp tshHome and set it in Env. This is useful
 // when running "ssh" commands with a tsh "ProxyCommand".
 // deprecated: Create a new helper that depends on mustLogin instead which requires migrating from
-// newTestSuite to tools/teleport/testenv.MakeTestServer.
+// newTestSuite to tools/teleport/testenv.NewTeleportProcess.
 func mustLoginSetEnvLegacy(t *testing.T, s *suite, args ...string) (tshHome, kubeConfig string) {
 	tshHome, kubeConfig = mustLoginLegacy(t, s, args...)
 	t.Setenv(types.HomeEnvVar, tshHome)
@@ -1468,14 +1481,22 @@ func TestProxyAppWithIdentity(t *testing.T) {
 		userName    = "admin"
 	)
 
+	appServer := testserver.StartDummyHTTPServer(appName)
+	t.Cleanup(appServer.Close)
+
 	rootServerOpts := []testserver.TestServerOptFunc{
-		testserver.WithClusterName(t, clusterName),
-		testserver.WithTestApp(t, appName),
+		testserver.WithClusterName(clusterName),
+		testserver.WithTestApp(appName, appServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		}),
 	}
-	process := testserver.MakeTestServer(t, rootServerOpts...)
+	process, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
 	authServer := process.GetAuthServer()
 
 	// create admin role and user.
@@ -1530,7 +1551,7 @@ func TestProxyAppWithIdentity(t *testing.T) {
 	// make other auth API calls beyond just accessing the app.
 	tlsPub, err := privateKey.MarshalTLSPublicKey()
 	require.NoError(t, err)
-	sshCert, tlsCert, err := authServer.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+	sshCert, tlsCert, err := authServer.GenerateUserTestCertsWithContext(ctx, auth.GenerateUserTestCertsRequest{
 		SSHPubKey:      privateKey.MarshalSSHPublicKey(),
 		TLSPubKey:      tlsPub,
 		Username:       userName,
@@ -1566,7 +1587,7 @@ func TestProxyAppWithIdentity(t *testing.T) {
 		"proxy", "app", appName,
 		"--port", port,
 	}
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "tsh proxy app",
 		Task: func(ctx context.Context) error {
 			return Run(ctx, tshArgs)
@@ -1613,7 +1634,7 @@ func TestProxyAppMultiPort(t *testing.T) {
 	connector := mockConnector(t)
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, user),
-		testserver.WithClusterName(t, clusterName),
+		testserver.WithClusterName(clusterName),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps = servicecfg.AppsConfig{
@@ -1629,7 +1650,12 @@ func TestProxyAppMultiPort(t *testing.T) {
 			}
 		}),
 	}
-	process := testserver.MakeTestServer(t, rootServerOpts...)
+	process, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
 
 	tshHome, _ := mustLogin(t, process, user, connector.GetName())
 
@@ -1644,7 +1670,7 @@ func TestProxyAppMultiPort(t *testing.T) {
 		"proxy", "app", appName,
 		"--port", fmt.Sprintf("%s:%d", fooProxyPort, fooServerPort),
 	}
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "tsh proxy app (foo)",
 		Task: func(ctx context.Context) error {
 			return Run(ctx, fooTshArgs, setHomePath(tshHome))
@@ -1660,7 +1686,7 @@ func TestProxyAppMultiPort(t *testing.T) {
 		"proxy", "app", appName,
 		"--port", fooNoTargetPortProxyPort, // No target port.
 	}
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "tsh proxy app (foo no target port)",
 		Task: func(ctx context.Context) error {
 			return Run(ctx, fooNoTargetPortTshArgs, setHomePath(tshHome))
@@ -1677,7 +1703,7 @@ func TestProxyAppMultiPort(t *testing.T) {
 		"proxy", "app", appName,
 		"--port", fmt.Sprintf("%s:%d", barProxyPort, barServerPort),
 	}
-	utils.RunTestBackgroundTask(ctx, t, &utils.TestBackgroundTask{
+	testutils.RunTestBackgroundTask(ctx, t, &testutils.TestBackgroundTask{
 		Name: "tsh proxy app (bar)",
 		Task: func(ctx context.Context) error {
 			return Run(ctx, barTshArgs, setHomePath(tshHome))
@@ -1731,3 +1757,61 @@ func mustDialLocalAppProxy(t *testing.T, port string, expectedName string) {
 		require.Equal(t, expectedName, r.Header.Get("Server"), "the response header \"Server\" does not have the expected value")
 	}, 5*time.Second, 50*time.Millisecond)
 }
+
+func Test_checkProxyMCPCompatibility(t *testing.T) {
+	tests := []struct {
+		name        string
+		command     string
+		appURI      string
+		checkResult require.ErrorAssertionFunc
+	}{
+		{
+			name:        "streamable HTTP allowed for tsh proxy app",
+			command:     "proxy app",
+			appURI:      "mcp+http://example.com/mcp",
+			checkResult: require.NoError,
+		},
+		{
+			name:        "streamable HTTP allowed for tsh proxy mcp",
+			command:     "proxy mcp",
+			appURI:      "mcp+http://example.com/mcp",
+			checkResult: require.NoError,
+		},
+		{
+			name:        "unsupported transport fails for tsh proxy app",
+			command:     "proxy app",
+			appURI:      "mcp+sse+http://example.com/sse",
+			checkResult: require.Error,
+		},
+		{
+			name:        "unsupported transport fails for tsh proxy mcp",
+			command:     "proxy mcp",
+			appURI:      "mcp+sse+http://example.com/sse",
+			checkResult: require.Error,
+		},
+		{
+			name:        "regular app allowed for tsh proxy app",
+			command:     "proxy app",
+			appURI:      "http://example.com",
+			checkResult: require.NoError,
+		},
+		{
+			name:        "regular app fails for tsh proxy mcp",
+			command:     "proxy mcp",
+			appURI:      "http://example.com",
+			checkResult: require.Error,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			app, err := types.NewAppV3(types.Metadata{
+				Name: t.Name(),
+			}, types.AppSpecV3{
+				URI: tt.appURI,
+			})
+			require.NoError(t, err)
+			tt.checkResult(t, checkProxyMCPCompatibility(tt.command, app))
+		})
+	}
+}
diff --git a/tool/tsh/common/reexec_unix.go b/tool/tsh/common/reexec_unix.go
new file mode 100644
index 0000000000000..4a707ab8a62ca
--- /dev/null
+++ b/tool/tsh/common/reexec_unix.go
@@ -0,0 +1,69 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build unix
+
+package common
+
+import (
+	"os"
+	"syscall"
+
+	"github.com/gravitational/trace"
+)
+
+func isValidForkSignalFd(fd uint64) bool {
+	// Don't allow stdin, stdout, or stderr.
+	return fd > 2
+}
+
+// newSignalFile creates a signaling file for --fork-after-authentication from
+// a file descriptor.
+func newSignalFile(fd uint64) *os.File {
+	syscall.CloseOnExec(int(fd))
+	return os.NewFile(uintptr(fd), "disown")
+}
+
+// replaceStdin returns a file for /dev/null that should be used from now
+// on instead of stdin.
+func replaceStdin() (*os.File, error) {
+	devNull, err := os.Open(os.DevNull)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	rc, err := devNull.SyscallConn()
+	if err != nil {
+		_ = devNull.Close()
+		return nil, trace.Wrap(err)
+	}
+	var dupErr error
+	if ctrlErr := rc.Control(func(fd uintptr) {
+		dupErr = dup2(int(fd), syscall.Stdin)
+		// dup2() is sufficient here as the three stdio file
+		// descriptors must not be O_CLOEXEC. Darwin does not have
+		// dup3(), so would need to resort to syscall.ForkLock
+		// shenanigans if we did need to set O_CLOEXEC.
+	}); ctrlErr != nil {
+		_ = devNull.Close()
+		return nil, trace.Wrap(ctrlErr)
+	}
+	if dupErr != nil {
+		// this is the error from dup2
+		_ = devNull.Close()
+		return nil, trace.Wrap(err)
+	}
+	return devNull, err
+}
diff --git a/tool/tsh/common/reexec_windows.go b/tool/tsh/common/reexec_windows.go
new file mode 100644
index 0000000000000..bbfc96a077089
--- /dev/null
+++ b/tool/tsh/common/reexec_windows.go
@@ -0,0 +1,45 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build windows
+
+package common
+
+import (
+	"os"
+	"syscall"
+
+	"github.com/gravitational/trace"
+)
+
+func isValidForkSignalFd(fd uint64) bool {
+	// Don't allow NULL.
+	return fd != 0
+}
+
+// newSignalFile creates a signaling file for --fork-after-authentication from
+// a file descriptor.
+func newSignalFile(fd uint64) *os.File {
+	syscall.CloseOnExec(syscall.Handle(fd))
+	return os.NewFile(uintptr(fd), "disown")
+}
+
+// replaceStdin returns a file for /dev/null that should be used from now
+// on instead of stdin.
+func replaceStdin() (*os.File, error) {
+	devNull, err := os.Open(os.DevNull)
+	return devNull, trace.Wrap(err)
+}
diff --git a/tool/tsh/common/scopes.go b/tool/tsh/common/scopes.go
new file mode 100644
index 0000000000000..57dfd0578c005
--- /dev/null
+++ b/tool/tsh/common/scopes.go
@@ -0,0 +1,164 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package common
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	scopedaccessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
+	"github.com/gravitational/teleport/lib/asciitable"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/itertools/stream"
+	"github.com/gravitational/teleport/lib/scopes"
+	scopedutils "github.com/gravitational/teleport/lib/scopes/utils"
+)
+
+// scopesCommands is a set of commands for viewing and managing Teleport scopes.
+type scopesCommands struct {
+	ls *scopesLSCommand
+}
+
+// newScopesCommand registers a new set of scopes commands with the provided app.
+func newScopesCommand(app *kingpin.Application) scopesCommands {
+	scopes := app.Command("scopes", "View and manage Teleport scopes.").Alias("scoped")
+	cmds := scopesCommands{
+		ls: newScopesLSCommand(scopes),
+	}
+	return cmds
+}
+
+// scopesLSCommand implements `tsh scopes ls` command, which is intended to support users
+// in discovering which scopes they have been granted access to. Notably, this command does
+// not actually return all scopes that are extant/in-use, or even all scopes that are extant/in-use
+// for which the user's privileges might grant access.  Instead, it returns only those scopes
+// *at which* the user is directly assigned privileges.  So, for example, if a user has access
+// to nodes in /staging/east and /staging/west, but said access is determined by a role assigned
+// at /staging, this command will only show /staging. The intent is not to provide a comprehensive
+// overview, but rather to provide the set of most obvious targets for `tsh login --scope=...`.
+type scopesLSCommand struct {
+	*kingpin.CmdClause
+	verbose bool
+}
+
+// newScopesLSCommand registers a new `tsh scopes ls` command.
+func newScopesLSCommand(parent *kingpin.CmdClause) *scopesLSCommand {
+	c := &scopesLSCommand{
+		CmdClause: parent.Command("ls", "List scopes at which user has assigned privileges."),
+	}
+	c.Flag("verbose", "Show table with details of per-scope privileges.").Short('v').BoolVar(&c.verbose)
+	return c
+}
+
+func (c *scopesLSCommand) run(cf *CLIConf) error {
+	ctx, cancel := context.WithCancel(cf.Context)
+	defer cancel()
+
+	tc, err := makeClient(cf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	var assignments []*scopedaccessv1.ScopedRoleAssignment
+	if err := tc.WithRootClusterClient(ctx, func(clt authclient.ClientI) error {
+		assignments, err = stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, clt.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			// note that we are using the AllCallerAssignments flag here rather than just looking for
+			// our assignments by username. This flag suppresses standard scope-pinning, which allows
+			// us to see assignments in parent/orthogonal scopes. Generally, scoped commands only show
+			// the subset of state subject to the currently pinned scope, but the purpose of 'tsh scopes ls'
+			// is specifically to discover potential 'tsh login --scope=...' targets, so we want to see
+			// everything regardless of current scope.
+			AllCallerAssignments: true,
+		}))
+		return trace.Wrap(err)
+	}); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if c.verbose {
+		// in verbose mode, we produce a table showing each scope and the roles
+		// assigned at that scope so that users can get a sense of the specific
+		// privileges they have at each scope.
+		type assignmentTableRow struct {
+			scope string
+			roles []string
+		}
+
+		var rows []*assignmentTableRow
+		for _, assignment := range assignments {
+		SubAssignments:
+			for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+				for _, row := range rows {
+					if scopes.Compare(row.scope, subAssignment.GetScope()) == scopes.Equivalent {
+						row.roles = append(row.roles, subAssignment.GetRole())
+						continue SubAssignments
+					}
+				}
+				rows = append(rows, &assignmentTableRow{
+					scope: subAssignment.GetScope(),
+					roles: []string{subAssignment.GetRole()},
+				})
+			}
+		}
+
+		// scope sort order differs subtly from lexographic order, so we need a custom sort func here
+		slices.SortFunc(rows, func(a, b *assignmentTableRow) int {
+			return scopes.Sort(a.scope, b.scope)
+		})
+
+		table := asciitable.MakeTable([]string{"Scope", "Roles"})
+		for _, row := range rows {
+			slices.Sort(row.roles)
+			table.AddRow([]string{
+				row.scope,
+				strings.Join(row.roles, ", "),
+			})
+		}
+
+		fmt.Fprint(cf.Stdout(), table.AsBuffer().String())
+		return nil
+	}
+
+	// when not in verbose mode, the default output is a simple newline-delimited
+	// list of scopes. this keeps things simple, and has the nice upside of producing
+	// an output compatible with visualization tools like `tree` when piped appropriately.
+	var assignedScopes []string
+	for _, assignment := range assignments {
+		for _, subAssignment := range assignment.GetSpec().GetAssignments() {
+			assignedScopes = append(assignedScopes, subAssignment.GetScope())
+		}
+	}
+
+	// apply canonical sorting and deduplication
+	slices.SortFunc(assignedScopes, scopes.Sort)
+	assignedScopes = slices.CompactFunc(assignedScopes, func(a, b string) bool {
+		return scopes.Compare(a, b) == scopes.Equivalent
+	})
+
+	for _, scope := range assignedScopes {
+		fmt.Fprintln(cf.Stdout(), scope)
+	}
+
+	return nil
+}
diff --git a/tool/tsh/common/tctl_test.go b/tool/tsh/common/tctl_test.go
index 94958414f93fb..13c9a763386c3 100644
--- a/tool/tsh/common/tctl_test.go
+++ b/tool/tsh/common/tctl_test.go
@@ -140,7 +140,7 @@ func TestRemoteTctlWithProfile(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			err := common.TryRun(tt.commands, tt.args)
+			err := common.TryRun(context.Background(), tt.commands, tt.args)
 			if tt.wantErrContains != "" {
 				var exitError *toolcommon.ExitCodeError
 				require.ErrorAs(t, err, &exitError)
diff --git a/tool/tsh/common/testdata/Test_mcpListCommand/JSON_format.golden b/tool/tsh/common/testdata/Test_mcpListCommand/JSON_format.golden
new file mode 100644
index 0000000000000..2b6b15f764aee
--- /dev/null
+++ b/tool/tsh/common/testdata/Test_mcpListCommand/JSON_format.golden
@@ -0,0 +1,71 @@
+[
+  {
+    "kind": "app",
+    "sub_kind": "mcp",
+    "version": "v3",
+    "metadata": {
+      "name": "allow-read",
+      "description": "description",
+      "labels": {
+        "env": "dev",
+        "teleport.internal/app-sub-kind": "mcp"
+      }
+    },
+    "spec": {
+      "uri": "mcp+stdio://",
+      "insecure_skip_verify": false,
+      "mcp": {
+        "command": "test",
+        "args": [
+          "arg"
+        ],
+        "run_as_host_user": "test"
+      }
+    },
+    "permissions": {
+      "mcp": {
+        "tools": {
+          "allowed": [
+            "read_*"
+          ]
+        }
+      }
+    }
+  },
+  {
+    "kind": "app",
+    "sub_kind": "mcp",
+    "version": "v3",
+    "metadata": {
+      "name": "deny-write",
+      "description": "description",
+      "labels": {
+        "env": "dev",
+        "teleport.internal/app-sub-kind": "mcp"
+      }
+    },
+    "spec": {
+      "uri": "mcp+stdio://",
+      "insecure_skip_verify": false,
+      "mcp": {
+        "command": "test",
+        "args": [
+          "arg"
+        ],
+        "run_as_host_user": "test"
+      }
+    },
+    "permissions": {
+      "mcp": {
+        "tools": {
+          "allowed": [
+            "*"
+          ],
+          "denied": [
+            "write_*"
+          ]
+        }
+      }
+    }
+  }
+]
diff --git a/tool/tsh/common/testdata/Test_mcpListCommand/YAML_format.golden b/tool/tsh/common/testdata/Test_mcpListCommand/YAML_format.golden
new file mode 100644
index 0000000000000..5cefd6878e259
--- /dev/null
+++ b/tool/tsh/common/testdata/Test_mcpListCommand/YAML_format.golden
@@ -0,0 +1,47 @@
+- kind: app
+  metadata:
+    description: description
+    labels:
+      env: dev
+      teleport.internal/app-sub-kind: mcp
+    name: allow-read
+  permissions:
+    mcp:
+      tools:
+        allowed:
+        - read_*
+  spec:
+    insecure_skip_verify: false
+    mcp:
+      args:
+      - arg
+      command: test
+      run_as_host_user: test
+    uri: mcp+stdio://
+  sub_kind: mcp
+  version: v3
+- kind: app
+  metadata:
+    description: description
+    labels:
+      env: dev
+      teleport.internal/app-sub-kind: mcp
+    name: deny-write
+  permissions:
+    mcp:
+      tools:
+        allowed:
+        - '*'
+        denied:
+        - write_*
+  spec:
+    insecure_skip_verify: false
+    mcp:
+      args:
+      - arg
+      command: test
+      run_as_host_user: test
+    uri: mcp+stdio://
+  sub_kind: mcp
+  version: v3
+
diff --git a/tool/tsh/common/testdata/Test_mcpListCommand/text_format.golden b/tool/tsh/common/testdata/Test_mcpListCommand/text_format.golden
new file mode 100644
index 0000000000000..fa7a65eda8bae
--- /dev/null
+++ b/tool/tsh/common/testdata/Test_mcpListCommand/text_format.golden
@@ -0,0 +1,5 @@
+Name       Description Type  Allowed Tools       Labels  
+---------- ----------- ----- ------------------- ------- 
+allow-read description stdio [read_*]            env=dev 
+deny-write description stdio [*], except: [wr... env=dev 
+
diff --git a/tool/tsh/common/testdata/Test_mcpListCommand/text_format_in_verbose.golden b/tool/tsh/common/testdata/Test_mcpListCommand/text_format_in_verbose.golden
new file mode 100644
index 0000000000000..5d3190a89aa04
--- /dev/null
+++ b/tool/tsh/common/testdata/Test_mcpListCommand/text_format_in_verbose.golden
@@ -0,0 +1,5 @@
+Name       Description Type  Labels                                     Command Args Allowed Tools          
+---------- ----------- ----- ------------------------------------------ ------- ---- ---------------------- 
+allow-read description stdio env=dev,teleport.internal/app-sub-kind=mcp test    arg  [read_*]               
+deny-write description stdio env=dev,teleport.internal/app-sub-kind=mcp test    arg  [*], except: [write_*] 
+
diff --git a/tool/tsh/common/testdata/Test_mcpListCommand/text_format_with_rbac_warning.golden b/tool/tsh/common/testdata/Test_mcpListCommand/text_format_with_rbac_warning.golden
new file mode 100644
index 0000000000000..16faf81d466c0
--- /dev/null
+++ b/tool/tsh/common/testdata/Test_mcpListCommand/text_format_with_rbac_warning.golden
@@ -0,0 +1,8 @@
+Name      Description Type  Allowed Tools Labels  
+--------- ----------- ----- ------------- ------- 
+no-access description stdio (none) [!]    env=dev 
+
+[!] Warning: you do not have access to any tools on the MCP server.
+Please contact your Teleport administrator to ensure your Teleport role has
+appropriate 'allow.mcp.tools' set. For details on MCP access RBAC, see:
+https://goteleport.com/docs/enroll-resources/mcp-access/rbac/
diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go
index 550811255519b..6d9c493a2aaa2 100644
--- a/tool/tsh/common/tsh.go
+++ b/tool/tsh/common/tsh.go
@@ -20,10 +20,12 @@ package common
 
 import (
 	"bytes"
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"maps"
 	"net"
 	"net/url"
@@ -64,22 +66,25 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/accesslist"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys/hardwarekey"
 	"github.com/gravitational/teleport/api/utils/keys/piv"
 	"github.com/gravitational/teleport/api/utils/prompt"
+	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
-	"github.com/gravitational/teleport/lib/autoupdate/tools"
+	autoupdateagent "github.com/gravitational/teleport/lib/autoupdate/agent"
+	autoupdatetools "github.com/gravitational/teleport/lib/autoupdate/tools"
 	"github.com/gravitational/teleport/lib/benchmark"
 	benchmarkdb "github.com/gravitational/teleport/lib/benchmark/db"
 	"github.com/gravitational/teleport/lib/client"
 	dbprofile "github.com/gravitational/teleport/lib/client/db"
+	dbmcp "github.com/gravitational/teleport/lib/client/db/mcp"
 	"github.com/gravitational/teleport/lib/client/identityfile"
+	"github.com/gravitational/teleport/lib/client/reexec"
 	"github.com/gravitational/teleport/lib/defaults"
 	dtauthn "github.com/gravitational/teleport/lib/devicetrust/authn"
 	dtenroll "github.com/gravitational/teleport/lib/devicetrust/enroll"
@@ -87,10 +92,10 @@ import (
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/observability/tracing"
+	"github.com/gravitational/teleport/lib/scopes"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/shell"
-	"github.com/gravitational/teleport/lib/sshutils/sftp"
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
@@ -141,8 +146,14 @@ var accessRequestModes = []string{
 	accessRequestModeRole,
 }
 
+// ClientInitFunc defines a function that initiates a connection to
+// the Teleport cluster using the CLI configuration.
+type ClientInitFunc func(cf *CLIConf) (*client.TeleportClient, error)
+
 // CLIConf stores command line arguments and flags:
 type CLIConf struct {
+	// Scope constrains the current operation to a specific target scope
+	Scope string
 	// UserHost contains "[login]@hostname" argument to SSH command
 	UserHost string
 	// Commands to execute on a remote host
@@ -180,6 +191,8 @@ type CLIConf struct {
 	AssumeStartTimeRaw string
 	// ResourceKind is the resource kind to search for
 	ResourceKind string
+	// RequestableRoles allows users to search for requestable roles.
+	RequestableRoles bool
 	// Username is the Teleport user's username (to login into proxies)
 	Username string
 	// ExplicitUsername is true if Username was initially set by the end-user
@@ -187,6 +200,10 @@ type CLIConf struct {
 	ExplicitUsername bool
 	// Proxy keeps the hostname:port of the Teleport proxy to use
 	Proxy string
+	// Relay is the address of the relay to use, "none" to explicitly disable
+	// the use of a relay, or "default" to use the cluster-provided address even
+	// if a different address was specified at login time.
+	Relay string
 	// TTL defines how long a session must be active (in minutes)
 	MinsToLive int32
 	// SSH Port on a remote SSH host
@@ -438,6 +455,10 @@ type CLIConf struct {
 	// GlobalTshConfigPath is a path to global TSH config. Can be overridden with TELEPORT_GLOBAL_TSH_CONFIG.
 	GlobalTshConfigPath string
 
+	// InsecureListenAnywhere, when set, allows local proxy listener to use any address other than loopback addresses (127/8).
+	InsecureListenAnywhere bool
+	// LocalProxyAddr is an address used by local proxy listener.
+	LocalProxyAddr string
 	// LocalProxyPort is a port used by local proxy listener.
 	LocalProxyPort string
 	// LocalProxyPortMapping is a listening port and an optional target port used by local proxy
@@ -452,6 +473,14 @@ type CLIConf struct {
 	Exec string
 	// AWSRole is Amazon Role ARN or role name that will be used for AWS CLI access.
 	AWSRole string
+	// AppLoginAWSEnvOutput indicates whether tsh will output the AWS credentials as an export shell script instead of writing them to `~/.aws/config`.
+	// Only applicable to apps using AWS Roles Anywhere integration.
+	// E.g.,
+	//
+	//   export AWS_ACCESS_KEY_ID=ABCD
+	//   export AWS_SECRET_ACCESS_KEY=1234
+	//   export AWS_SESSION_TOKEN=abcd
+	AppLoginAWSEnvOutput bool
 	// AWSCommandArgs contains arguments that will be forwarded to AWS CLI binary.
 	AWSCommandArgs []string
 	// AWSEndpointURLMode is an AWS proxy mode that serves an AWS endpoint URL
@@ -498,7 +527,10 @@ type CLIConf struct {
 	TraceExporter string
 
 	// TracingProvider is the provider to use to create tracers, from which spans can be created.
-	TracingProvider oteltrace.TracerProvider
+	TracingProvider *tracing.Provider
+	// waitingForTracingClient will be set to true if the tracing provider is
+	// waiting for a *tracing.Client to be reported to it after logging in.
+	waitingForTracingClient bool
 
 	// disableAccessRequest disables automatic resource access requests. Deprecated in favor of RequestType.
 	disableAccessRequest bool
@@ -527,9 +559,15 @@ type CLIConf struct {
 	// kubeNamespace allows to configure the default Kubernetes namespace.
 	kubeNamespace string
 
-	// kubeAllNamespaces allows users to search for pods in every namespace.
+	// kubeAllNamespaces allows users to search for resources in every namespace.
 	kubeAllNamespaces bool
 
+	// kubeResourceKind allows to search for resources.
+	kubeResourceKind string
+
+	// kubeAPIGroup allows to search for CRD and unknown resources.
+	kubeAPIGroup string
+
 	// KubeConfigPath is the location of the Kubeconfig for the current test.
 	// Setting this value allows Teleport tests to run `tsh login` commands in
 	// parallel.
@@ -618,6 +656,27 @@ type CLIConf struct {
 	// atomic here is overkill as the CLIConf is generally consumed sequentially. However, occasionally
 	// we need concurrency safety, such as for [forEachProfileParallel].
 	clientStoreSet int32
+
+	// ForkAfterAuthentication indicates that tsh should go into the background
+	// after authentication.
+	ForkAfterAuthentication bool
+	// forkSignalFd is the file descriptor for the child process to signal the
+	// parent when re-execing.
+	forkSignalFd uint64
+	// forkKillFd is the file descriptor for the child process to check the
+	// parent's state when re-execing.
+	forkKillFd uint64
+
+	// checkManagedUpdates initiates check of managed update after client connects to cluster.
+	checkManagedUpdates bool
+
+	// databaseMCPRegistryOverride overrides database access MCP servers
+	// registry. used in tests.
+	databaseMCPRegistryOverride dbmcp.Registry
+}
+
+func (c *CLIConf) isForkAuthChild() bool {
+	return isValidForkSignalFd(c.forkSignalFd) && isValidForkSignalFd(c.forkKillFd)
 }
 
 // Stdout returns the stdout writer.
@@ -719,27 +778,31 @@ const (
 	bindAddrEnvVar            = "TELEPORT_LOGIN_BIND_ADDR"
 	browserEnvVar             = "TELEPORT_LOGIN_BROWSER"
 	proxyEnvVar               = "TELEPORT_PROXY"
+	relayEnvVar               = "TELEPORT_RELAY"
 	headlessEnvVar            = "TELEPORT_HEADLESS"
 	headlessSkipConfirmEnvVar = "TELEPORT_HEADLESS_SKIP_CONFIRM"
 	// TELEPORT_SITE uses the older deprecated "site" terminology to refer to a
 	// cluster. All new code should use TELEPORT_CLUSTER instead.
-	siteEnvVar               = "TELEPORT_SITE"
-	userEnvVar               = "TELEPORT_USER"
-	addKeysToAgentEnvVar     = "TELEPORT_ADD_KEYS_TO_AGENT"
-	useLocalSSHAgentEnvVar   = "TELEPORT_USE_LOCAL_SSH_AGENT"
-	globalTshConfigEnvVar    = "TELEPORT_GLOBAL_TSH_CONFIG"
-	mfaModeEnvVar            = "TELEPORT_MFA_MODE"
-	mlockModeEnvVar          = "TELEPORT_MLOCK_MODE"
-	identityFileEnvVar       = "TELEPORT_IDENTITY_FILE"
-	gcloudSecretEnvVar       = "TELEPORT_GCLOUD_SECRET"
-	awsAccessKeyIDEnvVar     = "TELEPORT_AWS_ACCESS_KEY_ID"
-	awsSecretAccessKeyEnvVar = "TELEPORT_AWS_SECRET_ACCESS_KEY"
-	awsRegionEnvVar          = "TELEPORT_AWS_REGION"
-	awsKeystoreEnvVar        = "TELEPORT_AWS_KEYSTORE"
-	awsWorkgroupEnvVar       = "TELEPORT_AWS_WORKGROUP"
-	proxyKubeConfigEnvVar    = "TELEPORT_KUBECONFIG"
-	noResumeEnvVar           = "TELEPORT_NO_RESUME"
-	requestModeEnvVar        = "TELEPORT_REQUEST_MODE"
+	siteEnvVar                = "TELEPORT_SITE"
+	userEnvVar                = "TELEPORT_USER"
+	addKeysToAgentEnvVar      = "TELEPORT_ADD_KEYS_TO_AGENT"
+	useLocalSSHAgentEnvVar    = "TELEPORT_USE_LOCAL_SSH_AGENT"
+	globalTshConfigEnvVar     = "TELEPORT_GLOBAL_TSH_CONFIG"
+	mfaModeEnvVar             = "TELEPORT_MFA_MODE"
+	mlockModeEnvVar           = "TELEPORT_MLOCK_MODE"
+	identityFileEnvVar        = "TELEPORT_IDENTITY_FILE"
+	gcloudSecretEnvVar        = "TELEPORT_GCLOUD_SECRET"
+	awsAccessKeyIDEnvVar      = "TELEPORT_AWS_ACCESS_KEY_ID"
+	awsSecretAccessKeyEnvVar  = "TELEPORT_AWS_SECRET_ACCESS_KEY"
+	awsRegionEnvVar           = "TELEPORT_AWS_REGION"
+	awsKeystoreEnvVar         = "TELEPORT_AWS_KEYSTORE"
+	awsWorkgroupEnvVar        = "TELEPORT_AWS_WORKGROUP"
+	proxyKubeConfigEnvVar     = "TELEPORT_KUBECONFIG"
+	noResumeEnvVar            = "TELEPORT_NO_RESUME"
+	requestModeEnvVar         = "TELEPORT_REQUEST_MODE"
+	mcpClientConfigEnvVar     = "TELEPORT_MCP_CLIENT_CONFIG"
+	mcpConfigJSONFormatEnvVar = "TELEPORT_MCP_CONFIG_JSON_FORMAT"
+	toolsCheckUpdateEnvVar    = "TELEPORT_TOOLS_CHECK_UPDATE"
 
 	clusterHelp = "Specify the Teleport cluster to connect"
 	browserHelp = "Set to 'none' to suppress browser opening on login"
@@ -772,10 +835,6 @@ type CliOption func(*CLIConf) error
 //
 // DO NOT RUN TESTS that call Run() in parallel (unless you taken precautions).
 func Run(ctx context.Context, args []string, opts ...CliOption) error {
-	if err := tools.CheckAndUpdateLocal(ctx, args); err != nil {
-		return trace.Wrap(err)
-	}
-
 	cf := CLIConf{
 		Context:            ctx,
 		TracingProvider:    tracing.NoopProvider(),
@@ -783,9 +842,26 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		DTAutoEnroll:       dtenroll.AutoEnroll,
 	}
 
+	// We need to parse the arguments before executing managed updates to identify
+	// the profile name and the required version for the current cluster.
+	// All other commands and flags may change between versions, so full parsing
+	// should be performed only after managed updates are applied.
+	var proxyArg string
+	muApp := utils.InitHiddenCLIParser()
+	muApp.Flag("proxy", "Teleport proxy address").Envar(proxyEnvVar).Hidden().StringVar(&proxyArg)
+	muApp.Flag("check-update", "Check for availability of managed update.").Envar(toolsCheckUpdateEnvVar).Hidden().BoolVar(&cf.checkManagedUpdates)
+	if _, err := muApp.Parse(utils.FilterArguments(args, muApp.Model())); err != nil {
+		slog.WarnContext(ctx, "can't identify current profile", "error", err)
+	}
+	// Check local update for specific proxy from configuration.
+	name := utils.TryHost(strings.TrimPrefix(strings.ToLower(proxyArg), "https://"))
+	if err := autoupdatetools.CheckAndUpdateLocal(ctx, name, args); err != nil {
+		return trace.Wrap(err)
+	}
+
 	// run early to enable debug logging if env var is set.
 	// this makes it possible to debug early startup functionality, particularly command aliases.
-	if err := initLogger(&cf, parseLoggingOptsFromEnv()); err != nil {
+	if _, err := initLogger(&cf, utils.LoggingForCLI, parseLoggingOptsFromEnv()); err != nil {
 		printInitLoggerError(err)
 	}
 
@@ -797,6 +873,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 
 	app.Flag("login", "Remote host login").Short('l').Envar(loginEnvVar).StringVar(&cf.NodeLogin)
 	app.Flag("proxy", "Teleport proxy address").Envar(proxyEnvVar).StringVar(&cf.Proxy)
+	app.Flag("relay", "Teleport relay address, \"none\" to explicitly disable the use of a relay, or \"default\" to use the cluster-provided address even if a different address was specified at login time.").Envar(relayEnvVar).StringVar(&cf.Relay)
 	app.Flag("nocache", "do not cache cluster discovery locally").Hidden().BoolVar(&cf.NoCache)
 	app.Flag("user", "Teleport user, defaults to current local user").Envar(userEnvVar).StringVar(&cf.Username)
 	app.Flag("mem-profile", "Write memory profile to file").Hidden().StringVar(&memProfile)
@@ -812,6 +889,10 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	app.Flag("cert-format", "SSH certificate format").StringVar(&cf.CertificateFormat)
 	app.Flag("trace", "Capture and export distributed traces").Hidden().BoolVar(&cf.SampleTraces)
 	app.Flag("trace-exporter", "An OTLP exporter URL to send spans to. Note - only tsh spans will be included.").Hidden().StringVar(&cf.TraceExporter)
+	// This flag only applies to tsh ssh; it's defined here to make configuring
+	// the re-exec command easier.
+	app.Flag("fork-signal-fd", "File descriptor to signal parent on when forked. Overrides --fork-after-authentication. For internal use only.").Hidden().Uint64Var(&cf.forkSignalFd)
+	app.Flag("fork-kill-fd", "File descriptor to check parent health on when forked. For internal use only.").Hidden().Uint64Var(&cf.forkKillFd)
 
 	if !moduleCfg.IsBoringBinary() {
 		// The user is *never* allowed to do this in FIPS mode.
@@ -858,6 +939,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		StringVar(&cf.MlockMode)
 	app.HelpFlag.Short('h')
 	app.Flag("piv-slot", "Specify a PIV slot key to use for Hardware Key support instead of the default. Ex: \"9d\"").Envar("TELEPORT_PIV_SLOT").StringVar(&cf.PIVSlot)
+	app.Flag("check-update", "Check for availability of managed update.").Envar(toolsCheckUpdateEnvVar).Hidden().BoolVar(&cf.checkManagedUpdates)
 
 	ver := app.Command("version", "Print the tsh client and Proxy server versions for the current context.")
 	ver.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)).Short('f').Default(teleport.Text).EnumVar(&cf.Format, defaults.DefaultFormats...)
@@ -891,6 +973,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	ssh.Flag("log-dir", "Directory to log separated command output, when executing on multiple nodes. If set, output from each node will also be labeled in the terminal.").StringVar(&cf.SSHLogDir)
 	ssh.Flag("no-resume", "Disable SSH connection resumption").Envar(noResumeEnvVar).BoolVar(&cf.DisableSSHResumption)
 	ssh.Flag("relogin", "Permit performing an authentication attempt on a failed command").Default("true").BoolVar(&cf.Relogin)
+	ssh.Flag("fork-after-authentication", "Run in background after authentication is complete.").Short('f').BoolVar(&cf.ForkAfterAuthentication)
 	// The following flags are OpenSSH compatibility flags. They are used for
 	// users that alias "ssh" to "tsh ssh." The following OpenSSH flags are
 	// implemented. From "man 1 ssh":
@@ -957,6 +1040,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	appLogin := apps.Command("login", "Retrieve short-lived certificate for an app.")
 	appLogin.Arg("app", "App name to retrieve credentials for. Can be obtained from `tsh apps ls` output.").Required().StringVar(&cf.AppName)
 	appLogin.Flag("aws-role", "(For AWS CLI access only) Amazon IAM role ARN or role name.").StringVar(&cf.AWSRole)
+	appLogin.Flag("env", "(For AWS CLI access only) Obtain credentials as plain text in order to load into environments variables. Required when using per-session MFA.").Hidden().BoolVar(&cf.AppLoginAWSEnvOutput)
 	appLogin.Flag("azure-identity", "(For Azure CLI access only) Azure managed identity name.").StringVar(&cf.AzureIdentity)
 	appLogin.Flag("gcp-service-account", "(For GCP CLI access only) GCP service account name.").StringVar(&cf.GCPServiceAccount)
 	appLogin.Flag("target-port", "Port to which connections made using this cert should be routed to. Valid only for multi-port TCP apps.").Uint16Var(&cf.TargetPort)
@@ -990,9 +1074,11 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	proxySSH.Flag("relogin", "Permit performing an authentication attempt on a failed command").Default("true").BoolVar(&cf.Relogin)
 	proxyDB := proxy.Command("db", "Start local TLS proxy for database connections when using Teleport in single-port mode.")
 	// don't require <db> positional argument, user can select with --labels/--query alone.
-	proxyDB.Arg("db", "The name of the database to start local proxy for").StringVar(&cf.DatabaseService)
-	proxyDB.Flag("port", "Specifies the source port used by proxy db listener").Short('p').StringVar(&cf.LocalProxyPort)
-	proxyDB.Flag("tunnel", "Open authenticated tunnel using database's client certificate so clients don't need to authenticate").BoolVar(&cf.LocalProxyTunnel)
+	proxyDB.Arg("db", "The name of the database to start local proxy for.").StringVar(&cf.DatabaseService)
+	proxyDB.Flag("insecure-listen-anywhere", "Allows the local proxy to listen on any address without restrictions. WARNING: this will expose unsecured listener to anyone in the network. Only use when network access is otherwise restricted.").BoolVar(&cf.InsecureListenAnywhere)
+	proxyDB.Flag("listen", "Specifies the source address used by proxy db listener. Mutually exclusive with --port.").StringVar(&cf.LocalProxyAddr)
+	proxyDB.Flag("port", "Specifies the source port used by proxy db listener.").Short('p').StringVar(&cf.LocalProxyPort)
+	proxyDB.Flag("tunnel", "Open authenticated tunnel using database's client certificate so clients don't need to authenticate.").BoolVar(&cf.LocalProxyTunnel)
 	proxyDB.Flag("db-user", "Database user to log in as.").Short('u').StringVar(&cf.DatabaseUser)
 	proxyDB.Flag("db-name", "Database name to log in to.").Short('n').StringVar(&cf.DatabaseName)
 	proxyDB.Flag("db-roles", "List of comma separate database roles to use for auto-provisioned user.").Short('r').StringVar(&cf.DatabaseRoles)
@@ -1007,6 +1093,11 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	proxyApp.Flag("port", "Specifies the listening port used by by the proxy app listener. Accepts an optional target port of a multi-port TCP app after a colon, e.g. \"1234:5678\"").Short('p').StringVar(&cf.LocalProxyPortMapping)
 	proxyApp.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName)
 
+	proxyMCP := proxy.Command("mcp", "Start local proxy for MCP access.")
+	proxyMCP.Arg("app", "The name of the MCP application to start local proxy for.").Required().StringVar(&cf.AppName)
+	proxyMCP.Flag("port", "Specifies the listening port used by by the proxy app listener.").Short('p').StringVar(&cf.LocalProxyPortMapping)
+	proxyMCP.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName)
+
 	proxyAWS := proxy.Command("aws", "Start local proxy for AWS access.")
 	proxyAWS.Flag("app", "Optional Name of the AWS application to use if logged into multiple.").StringVar(&cf.AppName)
 	proxyAWS.Flag("port", "Specifies the source port used by the proxy listener.").Short('p').StringVar(&cf.LocalProxyPort)
@@ -1155,6 +1246,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	login.Flag("request-nowait", "Finish without waiting for request resolution").BoolVar(&cf.NoWait)
 	login.Flag("request-id", "Login with the roles requested in the given request").StringVar(&cf.RequestID)
 	login.Arg("cluster", clusterHelp).StringVar(&cf.SiteName)
+	login.Flag("scope", "Scope pins credentials to a given scope.").StringVar(&cf.Scope)
 	login.Flag("browser", browserHelp).StringVar(&cf.Browser)
 	login.Flag("kube-cluster", "Name of the Kubernetes cluster to login to").StringVar(&cf.KubernetesCluster)
 	login.Flag("verbose", "Show extra status information").Short('v').BoolVar(&cf.Verbose)
@@ -1275,10 +1367,60 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	reqReview.Flag("assume-start-time", "Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z)").StringVar(&cf.AssumeStartTimeRaw)
 
 	reqSearch := req.Command("search", "Search for resources to request access to.")
-	reqSearch.Flag("kind",
-		fmt.Sprintf("Resource kind to search for (%s)",
-			strings.Join(types.RequestableResourceKinds, ", ")),
-	).Required().EnumVar(&cf.ResourceKind, types.RequestableResourceKinds...)
+	reqSearch.Flag("kind", fmt.Sprintf("Resource kind to search for (%s).  Mutually exclusive with --roles.", strings.Join(types.RequestableResourceKinds, ", "))).StringVar(&cf.ResourceKind)
+	reqSearch.Flag("roles", "List requestable roles instead of searching for resources. Mutually exclusive with --kind.").BoolVar(&cf.RequestableRoles)
+	reqSearch.Flag("kube-kind", fmt.Sprintf("Kubernetes resource kind name (plural) to search for. Required with --kind=%q Ex: pods, deployments, namespaces, etc.", types.KindKubernetesResource)).StringVar(&cf.kubeResourceKind)
+	reqSearch.Flag("kube-api-group", "Kubernetes API group to search for resources.").StringVar(&cf.kubeAPIGroup)
+	reqSearch.Flag("format", defaults.FormatFlagDescription(defaults.DefaultFormats...)).Short('f').Default(teleport.Text).EnumVar(&cf.Format, defaults.DefaultFormats...)
+	reqSearch.PreAction(func(*kingpin.ParseContext) error {
+		if cf.RequestableRoles && cf.ResourceKind != "" {
+			return trace.BadParameter("only one of --kind and --roles may be specified")
+		}
+		if !cf.RequestableRoles && cf.ResourceKind == "" {
+			return trace.BadParameter("one of --kind and --roles is required")
+		}
+
+		// in --roles mode we don't care about resource kinds or kube flags.
+		if cf.RequestableRoles {
+			return nil
+		}
+
+		// TODO(@creack): DELETE IN v20.0.0. Allow legacy kinds with a warning for now.
+		if slices.Contains(types.LegacyRequestableKubeResourceKinds, cf.ResourceKind) {
+			cf.kubeAPIGroup = types.KubernetesResourcesV7KindGroups[cf.ResourceKind]
+			if cf.ResourceKind == types.KindKubeNamespace {
+				cf.kubeResourceKind = "namespaces"
+			} else {
+				cf.kubeResourceKind = types.KubernetesResourcesKindsPlurals[cf.ResourceKind]
+			}
+			originalKubeKind := cf.ResourceKind
+			cf.ResourceKind = types.KindKubernetesResource
+
+			nsFlag := fmt.Sprintf("--kube-namespace=%q", cf.kubeNamespace)
+			if cf.kubeAllNamespaces {
+				nsFlag = "--all-kube-namespaces"
+			}
+			fmt.Fprintf(os.Stderr, "Warning: %q is deprecated, use:\n", originalKubeKind)
+			fmt.Fprintf(os.Stderr, ">tsh request search --kind=%q --kube-kind=%q --kube-api-group=%q %s\n\n", types.KindKubernetesResource, cf.kubeResourceKind, cf.kubeAPIGroup, nsFlag)
+		}
+		switch cf.ResourceKind {
+		case types.KindKubernetesResource:
+			if cf.kubeResourceKind == "" {
+				return trace.BadParameter("--kube-kind is required when using --kind=%q", types.KindKubernetesResource)
+			}
+			if _, ok := types.KubernetesCoreResourceKinds[cf.kubeResourceKind]; !ok && cf.kubeAPIGroup == "" && cf.kubeResourceKind != types.KindKubeNamespace {
+				return trace.BadParameter("--kube-api-group is required for resource kind %q", cf.kubeResourceKind)
+			}
+		case "":
+			return trace.BadParameter("required flag --kind not provided")
+		default:
+			if !slices.Contains(types.RequestableResourceKinds, cf.ResourceKind) {
+				return trace.BadParameter("--kind must be one of %s, got %q", strings.Join(types.RequestableResourceKinds, ", "), cf.ResourceKind)
+			}
+		}
+		return nil
+	})
+
 	reqSearch.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
 	reqSearch.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
 	reqSearch.Flag("labels", labelHelp).StringVar(&cf.Labels)
@@ -1306,6 +1448,8 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	mfa := newMFACommand(app)
 	// SCAN subcommands.
 	scan := newScanCommand(app)
+	// scopes subcommands.
+	scopes := newScopesCommand(app)
 
 	config := app.Command("config", "Print OpenSSH configuration details.")
 	config.Flag("port", "SSH port on a remote host").Short('p').Int32Var(&cf.NodePort)
@@ -1319,6 +1463,9 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		puttyConfig.Hidden()
 	}
 
+	// Client-tools managed updates commands.
+	updateCommand := newUpdateCommand(app)
+
 	// FIDO2, TouchID and WebAuthnWin commands.
 	f2 := fido2.NewCommand(app)
 	tid := touchid.NewCommand(app)
@@ -1331,6 +1478,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	workloadIdentityCmd := newWorkloadIdentityCommands(app)
 
 	vnetCommand := newVnetCommand(app)
+	vnetSSHAutoConfigCommand := newVnetSSHAutoConfigCommand(app)
 	vnetAdminSetupCommand := newVnetAdminSetupCommand(app)
 	vnetDaemonCommand := newVnetDaemonCommand(app)
 	vnetServiceCommand := newVnetServiceCommand(app)
@@ -1339,15 +1487,24 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 
 	gitCmd := newGitCommands(app)
 	pivCmd := newPIVCommands(app)
+	mcpCmd := newMCPCommands(app, &cf)
 
 	if runtime.GOOS == constants.WindowsOS {
 		bench.Hidden()
 	}
 
-	var err error
-	cf.executablePath, err = os.Executable()
-	if err != nil {
-		return trace.Wrap(err)
+	if reExecPath := autoupdatetools.GetReExecPath(); reExecPath != "" {
+		// Always prefer Client Tools Managed Updates re-exec path (~/.tsh/bin/) if set
+		cf.executablePath = reExecPath
+	} else {
+		// Otherwise, use the Agent Managed Updates stable path, if available
+		var err error
+		cf.executablePath, err = autoupdateagent.StableExecutable()
+		if errors.Is(err, autoupdateagent.ErrUnstableExecutable) {
+			logger.WarnContext(ctx, "Templates may be rendered with an unstable path to the tsh executable; reinstall tsh with Managed Updates to prevent instability")
+		} else if err != nil {
+			return trace.Wrap(err, "determining executable path")
+		}
 	}
 
 	// configs
@@ -1379,6 +1536,33 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		}
 	}
 
+	// Handle fork after authentication.
+	if cf.ForkAfterAuthentication && !cf.isForkAuthChild() {
+		if len(cf.RemoteCommand) == 0 {
+			return trace.BadParameter("fork after authentication not allowed for interactive sessions")
+		}
+		forkParams := reexec.ForkAuthenticateParams{
+			GetArgs: func(signalFd, killFd uint64) []string {
+				return append([]string{
+					// fd flags go immediately after `tsh`.
+					"--fork-signal-fd", strconv.FormatUint(signalFd, 10),
+					"--fork-kill-fd", strconv.FormatUint(killFd, 10),
+				}, args...)
+			},
+			Stdin:  cf.Stdin(),
+			Stdout: cf.Stdout(),
+			Stderr: cf.Stderr(),
+		}
+		if err := reexec.RunForkAuthenticate(cf.Context, forkParams); err != nil {
+			var execErr *exec.ExitError
+			if errors.As(trace.Unwrap(err), &execErr) {
+				err = &common.ExitCodeError{Code: execErr.ExitCode()}
+			}
+			return trace.Wrap(err)
+		}
+		return nil
+	}
+
 	// Remove HTTPS:// in proxy parameter as https is automatically added
 	cf.Proxy = strings.TrimPrefix(cf.Proxy, "https://")
 	cf.Proxy = strings.TrimPrefix(cf.Proxy, "HTTPS://")
@@ -1430,19 +1614,13 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	// Enable debug logging if requested by --debug.
 	// If TELEPORT_DEBUG was set and --debug/--no-debug was not passed, debug logs were already
 	// enabled by a prior call to initLogger.
-	if err := initLogger(&cf, parseLoggingOptsFromEnvAndArgv(&cf)); err != nil {
+	if _, err := initLogger(&cf, utils.LoggingForCLI, parseLoggingOptsFromEnvAndArgv(&cf)); err != nil {
 		printInitLoggerError(err)
 	}
 
 	stopTracing := initializeTracing(&cf)
 	defer stopTracing()
 
-	// start the span for the command and update the config context so that all spans created
-	// in the future will be rooted at this span.
-	ctx, span := cf.tracer.Start(cf.Context, command)
-	cf.Context = ctx
-	defer span.End()
-
 	if err := client.ValidateAgentKeyOption(cf.AddKeysToAgent); err != nil {
 		return trace.Wrap(err)
 	}
@@ -1491,11 +1669,23 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		defer runtimetrace.Stop()
 	}
 
+	// print tsh version when --debug flag is set
+	// to diagnose potential client version mismatch
+	if cf.Debug && command != ver.FullCommand() {
+		logger.InfoContext(ctx, "Initializing tsh",
+			"version", slog.GroupValue(
+				slog.String("teleport", teleport.Version),
+				slog.String("teleport_git", teleport.Gitref),
+				slog.String("go", runtime.Version()),
+			),
+		)
+	}
+
 	switch command {
 	case ver.FullCommand():
 		err = onVersion(&cf)
 	case ssh.FullCommand():
-		err = onSSH(&cf)
+		err = onSSH(&cf, wrapInitClientWithUpdateCheck(makeClient, args))
 	case resolve.FullCommand():
 		err = onResolve(&cf)
 		// If quiet was specified for this command and
@@ -1627,12 +1817,16 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		err = kube.join.run(&cf)
 	case scan.keys.FullCommand():
 		err = scan.keys.run(&cf)
+	case scopes.ls.FullCommand():
+		err = scopes.ls.run(&cf)
 	case proxySSH.FullCommand():
-		err = onProxyCommandSSH(&cf)
+		err = onProxyCommandSSH(&cf, wrapInitClientWithUpdateCheck(makeClient, args))
 	case proxyDB.FullCommand():
 		err = onProxyCommandDB(&cf)
 	case proxyApp.FullCommand():
 		err = onProxyCommandApp(&cf)
+	case proxyMCP.FullCommand():
+		err = onProxyCommandApp(&cf)
 	case proxyAWS.FullCommand():
 		err = onProxyCommandAWS(&cf)
 	case proxyAzure.FullCommand():
@@ -1723,6 +1917,8 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		err = workloadIdentityCmd.issueX509.run(&cf)
 	case vnetCommand.FullCommand():
 		err = vnetCommand.run(&cf)
+	case vnetSSHAutoConfigCommand.FullCommand():
+		err = vnetSSHAutoConfigCommand.run(&cf)
 	case vnetAdminSetupCommand.FullCommand():
 		err = vnetAdminSetupCommand.run(&cf)
 	case vnetDaemonCommand.FullCommand():
@@ -1745,6 +1941,18 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		err = gitCmd.clone.run(&cf)
 	case pivCmd.agent.FullCommand():
 		err = pivCmd.agent.run(&cf)
+	case updateCommand.update.FullCommand():
+		err = updateCommand.update.run(&cf)
+	case mcpCmd.dbStart.FullCommand():
+		err = mcpCmd.dbStart.run()
+	case mcpCmd.dbConfig.FullCommand():
+		err = mcpCmd.dbConfig.run()
+	case mcpCmd.connect.FullCommand():
+		err = mcpCmd.connect.run()
+	case mcpCmd.list.FullCommand():
+		err = mcpCmd.list.run()
+	case mcpCmd.config.FullCommand():
+		err = mcpCmd.config.run()
 	default:
 		// Handle commands that might not be available.
 		switch {
@@ -1762,6 +1970,14 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
 		return handleUnimplementedError(ctx, err, cf)
 	}
 
+	// A FIPS build of tsh is attempting to use a non-FIPS key returned by the cluster.
+	var fipsErr *sshutils.FIPSError
+	if moduleCfg.IsBoringBinary() && errors.As(err, &fipsErr) {
+		return trace.Wrap(err,
+			"tsh is running in FIPS mode, but the cluster is not FIPS-compliant. Use a non-FIPS tsh binary to connect to the cluster.",
+		)
+	}
+
 	return trace.Wrap(err)
 }
 
@@ -1769,9 +1985,14 @@ func initializeTracing(cf *CLIConf) func() {
 	cf.TracingProvider = tracing.NoopProvider()
 	cf.tracer = cf.TracingProvider.Tracer(teleport.ComponentTSH)
 
-	// flush ensures that the spans are all attempted to be written when tsh exits.
+	// flush ends the root span and ensures that the spans are all attempted to be written when tsh exits.
+	var rootSpan oteltrace.Span
 	flush := func(provider *tracing.Provider) func() {
 		return func() {
+			if rootSpan != nil {
+				rootSpan.End()
+			}
+
 			shutdownCtx, cancel := context.WithTimeout(context.WithoutCancel(cf.Context), time.Second)
 			defer cancel()
 			err := provider.Shutdown(shutdownCtx)
@@ -1816,13 +2037,10 @@ func initializeTracing(cf *CLIConf) func() {
 
 		cf.TracingProvider = provider
 		cf.tracer = provider.Tracer(teleport.ComponentTSH)
+		// Start the root span for the command and update the config context so
+		// that all spans created in the future will be rooted at this span.
+		cf.Context, rootSpan = cf.tracer.Start(cf.Context, cf.command)
 		return flush(provider)
-	// The login command cannot forward spans to Auth since there is no way to get
-	// an authenticated client to forward with until after the authentication ceremony
-	// is complete. However, if the user explicitly provided an exporter then the login
-	// spans can be sent directly to it.
-	case cf.command == "login":
-		return func() {}
 	// All commands besides ssh are only traced if the user explicitly requested
 	// tracing. For ssh, a random number of spans may be sampled if the Proxy is
 	// for a Cloud tenant.
@@ -1831,6 +2049,32 @@ func initializeTracing(cf *CLIConf) func() {
 	case cf.SampleTraces:
 	}
 
+	// A login may be required to get a working Teleport client. Set up the
+	// tracing provider to wait for a client so that the initial login can be
+	// traced. Spans will be buffered in memory until the client is provided.
+	provider, err := tracing.NewTraceProvider(cf.Context,
+		tracing.Config{
+			Service:              teleport.ComponentTSH,
+			SamplingRate:         samplingRate,
+			WaitForDelayedClient: true,
+		})
+	if err != nil {
+		logger.DebugContext(cf.Context, "failed to set up span forwarding", "error", err)
+		return func() {}
+	}
+	cf.TracingProvider = provider
+	cf.tracer = provider.Tracer(teleport.ComponentTSH)
+	// Start the root span for the command and update the config context so
+	// that all spans created in the future will be rooted at this span.
+	cf.Context, rootSpan = cf.tracer.Start(cf.Context, cf.command)
+
+	if cf.command == "login" {
+		// Don't call RetryWithRelogin below if the user is trying to log in.
+		// Rely on [onLogin] to set the delayed client on the tracing provider.
+		cf.waitingForTracingClient = true
+		return flush(provider)
+	}
+
 	// Parse the config to determine if forwarding is needed for Cloud and
 	// to get a handle to an Auth client.
 	tc, err := makeClient(cf)
@@ -1839,32 +2083,20 @@ func initializeTracing(cf *CLIConf) func() {
 		return func() {}
 	}
 
-	var provider *tracing.Provider
 	if err := client.RetryWithRelogin(cf.Context, tc, func() error {
 		clt, err := tc.NewTracingClient(cf.Context)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-
-		p, err := tracing.NewTraceProvider(cf.Context,
-			tracing.Config{
-				Service:      teleport.ComponentTSH,
-				Client:       clt,
-				SamplingRate: samplingRate,
-			})
-		if err != nil {
+		if err := provider.SetClient(cf.Context, clt); err != nil {
 			return trace.NewAggregate(err, clt.Close())
 		}
-
-		provider = p
 		return nil
 	}); err != nil {
 		logger.DebugContext(cf.Context, "failed to set up span forwarding", "error", err)
 		return func() {}
 	}
 
-	cf.TracingProvider = provider
-	cf.tracer = provider.Tracer(teleport.ComponentTSH)
 	return flush(provider)
 }
 
@@ -1882,7 +2114,7 @@ func onVersion(cf *CLIConf) error {
 		proxyPublicAddr = ppa
 	}
 
-	reExecFromVersion := tools.GetReExecFromVersion(cf.Context)
+	reExecFromVersion := autoupdatetools.GetReExecFromVersion(cf.Context)
 	format := strings.ToLower(cf.Format)
 	switch format {
 	case teleport.Text, "":
@@ -1969,7 +2201,8 @@ func serializeVersion(format string, proxyVersion string, proxyPublicAddress str
 }
 
 // onLogin logs in with remote proxy and gets signed certificates
-func onLogin(cf *CLIConf, reExecArgs ...string) error {
+func onLogin(cf *CLIConf, reExecArgs ...string) (err error) {
+	showAlerts := true
 	autoRequest := true
 	// special case: --request-roles=no disables auto-request behavior.
 	if cf.DesiredRoles == "no" {
@@ -2004,16 +2237,55 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 		}
 	}
 
+	if cf.Scope != "" {
+		// auto-request behavior is incompatible with scopes
+		autoRequest = false
+		// alerts don't support scoping yet, reduce log spam by disabling lookup attempts
+		showAlerts = false
+
+		// client-side validation of scopes isn't strictly necessary, but scope syntax is easy to mess
+		// up (especially accidentally omitting the leading slash), so its nice to find out if the scope
+		// is malformed before going through authentication.
+		if err := scopes.StrongValidate(cf.Scope); err != nil {
+			return trace.Wrap(err)
+		}
+
+		// TODO(fspmarshall/scopes): this is a clunky way to handle the forced reauth on scope change,
+		// look into doing something smarter.
+		profile, profiles = nil, nil
+	}
+
 	// make the teleport client and retrieve the certificate from the proxy:
 	tc, err := makeClient(cf)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
+	// If the user requested tracing and the login succeeds (even if the user
+	// was already logged in) report the tracing client to the trace provider
+	// to that spans can be exported.
+	if cf.waitingForTracingClient {
+		defer func() {
+			if err != nil {
+				logger.DebugContext(cf.Context, "Login failed, unable to export traced spans")
+				return
+			}
+			tracingClient, err := tc.NewTracingClient(cf.Context)
+			if err != nil {
+				logger.DebugContext(cf.Context, "Failed to create tracing client after login", "error", err)
+				return
+			}
+			if err := cf.TracingProvider.SetClient(cf.Context, tracingClient); err != nil {
+				logger.DebugContext(cf.Context, "Failed to set tracing client on trace provider after login", "error", err)
+				tracingClient.Close()
+			}
+		}()
+	}
+
 	// The user is not logged in and has typed in `tsh --proxy=... login`, if
 	// the running binary needs to be updated, update and re-exec.
 	if profile == nil {
-		if err := tools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
+		if err := autoupdatetools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -2027,11 +2299,11 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 		// in case if parameters match, re-fetch kube clusters and print
 		// current status
 		case cf.Proxy == "" && cf.SiteName == "" && cf.DesiredRoles == "" && cf.RequestID == "" && cf.IdentityFileOut == "" ||
-			host(cf.Proxy) == host(profile.ProxyURL.Host) && cf.SiteName == profile.Cluster && cf.DesiredRoles == "" && cf.RequestID == "":
+			utils.TryHost(cf.Proxy) == utils.TryHost(profile.ProxyURL.Host) && cf.SiteName == profile.Cluster && cf.DesiredRoles == "" && cf.RequestID == "":
 
 			// The user has typed `tsh login`, if the running binary needs to
 			// be updated, update and re-exec.
-			if err := tools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
+			if err := autoupdatetools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
 				return trace.Wrap(err)
 			}
 
@@ -2043,15 +2315,15 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 				return trace.Wrap(err)
 			}
 
-			return trace.Wrap(printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)))
+			return trace.Wrap(printLoginInformation(cf, profile, profiles))
 
 		// if the proxy names match but nothing else is specified; show motd and update active profile and kube configs
-		case host(cf.Proxy) == host(profile.ProxyURL.Host) &&
+		case utils.TryHost(cf.Proxy) == utils.TryHost(profile.ProxyURL.Host) &&
 			cf.SiteName == "" && cf.DesiredRoles == "" && cf.RequestID == "" && cf.IdentityFileOut == "":
 
 			// The user has typed `tsh login`, if the running binary needs to
 			// be updated, update and re-exec.
-			if err := tools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
+			if err := autoupdatetools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
 				return trace.Wrap(err)
 			}
 
@@ -2073,13 +2345,13 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 				}
 
 				// Print status to show information of the logged in user.
-				return trace.Wrap(printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)))
+				return trace.Wrap(printLoginInformation(cf, profile, profiles))
 			}
 
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but cluster is specified, treat this as selecting a new cluster
 		// for the same proxy
-		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && cf.SiteName != "":
+		case (cf.Proxy == "" || utils.TryHost(cf.Proxy) == utils.TryHost(profile.ProxyURL.Host)) && cf.SiteName != "":
 			_, err := tc.PingAndShowMOTD(cf.Context)
 			if err != nil {
 				return trace.Wrap(err)
@@ -2105,11 +2377,11 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 			}
 
 			// Print status to show information of the logged in user.
-			return trace.Wrap(printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)))
+			return trace.Wrap(printLoginInformation(cf, profile, profiles))
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but desired roles or request ID is specified, treat this as a
 		// privilege escalation request for the same login session.
-		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && (cf.DesiredRoles != "" || cf.RequestID != "") && cf.IdentityFileOut == "":
+		case (cf.Proxy == "" || utils.TryHost(cf.Proxy) == utils.TryHost(profile.ProxyURL.Host)) && (cf.DesiredRoles != "" || cf.RequestID != "") && cf.IdentityFileOut == "":
 			_, err := tc.PingAndShowMOTD(cf.Context)
 			if err != nil {
 				return trace.Wrap(err)
@@ -2121,13 +2393,13 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 				return trace.Wrap(err)
 			}
 			// Print status to show information of the logged in user.
-			return trace.Wrap(printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)))
+			return trace.Wrap(printLoginInformation(cf, profile, profiles))
 
 		// otherwise just pass through to standard login
 		default:
 			// The user is logged in and has typed in `tsh --proxy=... login`, if
 			// the running binary needs to be updated, update and re-exec.
-			if err := tools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
+			if err := autoupdatetools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
 				return trace.Wrap(err)
 			}
 		}
@@ -2161,7 +2433,6 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 		}
 		return trace.Wrap(err)
 	}
-
 	tc.AllowStdinHijack = false
 
 	// the login operation may update the username and should be considered the more
@@ -2226,6 +2497,16 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 		}
 	}
 
+	// at login time we store the CLI override for the relay address in the profile
+	switch cf.Relay {
+	case "", "default":
+		tc.ProfileRelayAddr = ""
+	case "none":
+		tc.ProfileRelayAddr = "none"
+	default:
+		tc.ProfileRelayAddr = cf.Relay
+	}
+
 	// Regular login without -i flag.
 	if err := tc.SaveProfile(true); err != nil {
 		return trace.Wrap(err)
@@ -2272,7 +2553,7 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 	}
 
 	// Print status to show information of the logged in user.
-	if err := printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)); err != nil {
+	if err := printLoginInformation(cf, profile, profiles); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -2280,10 +2561,12 @@ func onLogin(cf *CLIConf, reExecArgs ...string) error {
 	// don't use the alert API very heavily. If we start to make more use of it, we
 	// could probably add a separate `tsh alerts ls` command, and truncate the list
 	// with a message like "run 'tsh alerts ls' to view N additional alerts".
-	if err := common.ShowClusterAlerts(cf.Context, clusterClient.CurrentCluster(), os.Stderr, map[string]string{
-		types.AlertOnLogin: "yes",
-	}, types.AlertSeverity_LOW); err != nil {
-		logger.WarnContext(cf.Context, "Failed to display cluster alerts", "error", err)
+	if showAlerts {
+		if err := common.ShowClusterAlerts(cf.Context, clusterClient.CurrentCluster(), os.Stderr, map[string]string{
+			types.AlertOnLogin: "yes",
+		}, types.AlertSeverity_LOW); err != nil {
+			logger.WarnContext(cf.Context, "Failed to display cluster alerts", "error", err)
+		}
 	}
 
 	return nil
@@ -2295,10 +2578,10 @@ func onLogout(cf *CLIConf) error {
 	active, available, err := cf.FullProfileStatus()
 	if err != nil && !trace.IsCompareFailed(err) {
 		if trace.IsNotFound(err) {
-			fmt.Printf("All users logged out.\n")
+			fmt.Fprintf(cf.Stdout(), "All users logged out.\n")
 			return nil
 		} else if trace.IsAccessDenied(err) {
-			fmt.Printf("%v: Logged in user does not have the correct permissions\n", err)
+			fmt.Fprintf(cf.Stdout(), "%v: Logged in user does not have the correct permissions\n", err)
 			return nil
 		}
 		return trace.Wrap(err)
@@ -2316,7 +2599,33 @@ func onLogout(cf *CLIConf) error {
 
 	switch {
 	// Proxy and username for key to remove.
-	case proxyHost != "" && cf.Username != "":
+	case proxyHost != "":
+		// In the event --user flag is not supplied, and there is only one identity,
+		// we can simply log out the single identity.
+		if cf.Username == "" {
+			clientStore := cf.getClientStore()
+			usernames, err := clientStore.GetIdentities(proxyHost)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if len(usernames) == 0 {
+				fmt.Fprintf(cf.Stdout(), "All users logged out.\n")
+				return nil
+			}
+
+			logger.DebugContext(cf.Context, "No --user flag provided, but identities found for proxy",
+				"proxy_host", proxyHost,
+				"users", usernames)
+
+			if len(usernames) > 1 {
+				fmt.Fprintf(cf.Stdout(), "Specify --user to log out a specific user from %q or remove the --proxy flag to log out all users from all proxies.\n", proxyHost)
+				return nil
+			}
+
+			cf.Username = usernames[0]
+		}
+
 		tc, err := makeClient(cf)
 		if err != nil {
 			return trace.Wrap(err)
@@ -2345,26 +2654,53 @@ func onLogout(cf *CLIConf) error {
 		err = tc.Logout()
 		if err != nil {
 			if trace.IsNotFound(err) {
-				fmt.Printf("User %v already logged out from %v.\n", cf.Username, proxyHost)
+				fmt.Fprintf(cf.Stdout(), "User %v already logged out from %v.\n", cf.Username, proxyHost)
 				return trace.Wrap(&common.ExitCodeError{Code: 1})
 			}
 			return trace.Wrap(err)
 		}
 
 		// Remove Teleport related entries from kubeconfig.
+
+		if profile != nil {
+			logger.DebugContext(cf.Context, "Removing Teleport related entries from kubeconfig", "profile", profile.Name)
+			err = kubeconfig.RemoveByProfileName("", profile.Name)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
+
+		// TODO(espadolini): DELETE IN v20 (maybe, files could be left over from really old versions)
 		logger.DebugContext(cf.Context, "Removing Teleport related entries from kubeconfig", "cluster_addr", tc.KubeClusterAddr())
 		err = kubeconfig.RemoveByServerAddr("", tc.KubeClusterAddr())
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
-		fmt.Printf("Logged out %v from %v.\n", cf.Username, proxyHost)
+		fmt.Fprintf(cf.Stdout(), "Logged out %v from %v.\n", cf.Username, proxyHost)
 	// Remove all keys.
 	case proxyHost == "" && cf.Username == "":
-		tc, err := makeClient(cf)
+		proxy, err := cf.getClientStore().CurrentProfile()
+		if err != nil && !trace.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+
+		if proxy == "" {
+			// If there's no current profile, try to use the first profile.
+			if len(profiles) > 0 {
+				proxy = profiles[0].ProxyURL.Host
+			} else {
+				fmt.Printf("All users logged out.\n")
+				return nil
+			}
+		}
+
+		tc, err := makeClientForProxy(cf, proxy)
 		if err != nil {
 			return trace.Wrap(err)
 		}
+
+		// TODO(espadolini): DELETE IN v20 (maybe, files could be left over from really old versions)
 		logger.DebugContext(cf.Context, "Removing Teleport related entries from kubeconfig", "cluster_addr", tc.KubeClusterAddr())
 		if err = kubeconfig.RemoveByServerAddr("", tc.KubeClusterAddr()); err != nil {
 			return trace.Wrap(err)
@@ -2372,8 +2708,8 @@ func onLogout(cf *CLIConf) error {
 
 		// Remove Teleport related entries from kubeconfig for all clusters.
 		for _, profile := range profiles {
-			logger.DebugContext(cf.Context, "Removing Teleport related entries from kubeconfig", "cluster", profile.Cluster)
-			err = kubeconfig.RemoveByClusterName("", profile.Cluster)
+			logger.DebugContext(cf.Context, "Removing Teleport related entries from kubeconfig", "profile", profile.Name)
+			err = kubeconfig.RemoveByProfileName("", profile.Name)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -2413,7 +2749,7 @@ func onLogout(cf *CLIConf) error {
 			return trace.Wrap(tc.SAMLSingleLogout(ctx, sloURL))
 		})
 		if err != nil {
-			fmt.Printf("We were unable to log you out of your SAML identity provider: %v", err)
+			fmt.Fprintf(cf.Stdout(), "We were unable to log you out of your SAML identity provider: %v\n", err)
 		}
 
 		// Remove all keys from disk and the running agent.
@@ -2422,11 +2758,9 @@ func onLogout(cf *CLIConf) error {
 			return trace.Wrap(err)
 		}
 
-		fmt.Printf("Logged out all users from all proxies.\n")
-	case proxyHost != "" && cf.Username == "":
-		fmt.Printf("Specify --user to log out a specific user from %q or remove the --proxy flag to log out all users from all proxies.\n", proxyHost)
+		fmt.Fprintf(cf.Stdout(), "Logged out all users from all proxies.\n")
 	case proxyHost == "" && cf.Username != "":
-		fmt.Printf("Specify --proxy to log out user %q from a specific proxy or remove the --user flag to log out all users from all proxies.\n", cf.Username)
+		fmt.Fprintf(cf.Stdout(), "Specify --proxy to log out user %q from a specific proxy or remove the --user flag to log out all users from all proxies.\n", cf.Username)
 	}
 	return nil
 }
@@ -2705,14 +3039,31 @@ func listNodesAllClusters(cf *CLIConf) error {
 
 func printNodesWithClusters(nodes []nodeListing, verbose bool, output io.Writer) error {
 	var rows [][]string
+	var withScope bool
 	for _, n := range nodes {
-		rows = append(rows, getNodeRow(n.Proxy, n.Cluster, n.Node, verbose))
+		if n.Node.GetScope() != "" {
+			withScope = true
+			break
+		}
 	}
+
+	for _, n := range nodes {
+		rows = append(rows, getNodeRow(n.Proxy, n.Cluster, n.Node, withScope, verbose))
+	}
+
 	var t asciitable.Table
 	if verbose {
-		t = asciitable.MakeTable([]string{"Proxy", "Cluster", "Node Name", "Node ID", "Address", "Labels"}, rows...)
+		if withScope {
+			t = asciitable.MakeTable([]string{"Scope", "Proxy", "Cluster", "Node Name", "Node ID", "Address", "Labels"}, rows...)
+		} else {
+			t = asciitable.MakeTable([]string{"Proxy", "Cluster", "Node Name", "Node ID", "Address", "Labels"}, rows...)
+		}
 	} else {
-		t = asciitable.MakeTableWithTruncatedColumn([]string{"Proxy", "Cluster", "Node Name", "Address", "Labels"}, rows, "Labels")
+		if withScope {
+			t = asciitable.MakeTableWithTruncatedColumn([]string{"Scope", "Proxy", "Cluster", "Node Name", "Address", "Labels"}, rows, "Labels")
+		} else {
+			t = asciitable.MakeTableWithTruncatedColumn([]string{"Proxy", "Cluster", "Node Name", "Address", "Labels"}, rows, "Labels")
+		}
 	}
 	if _, err := fmt.Fprintln(output, t.AsBuffer().String()); err != nil {
 		return trace.Wrap(err)
@@ -2839,6 +3190,9 @@ func executeAccessRequest(cf *CLIConf, tc *client.TeleportClient) error {
 			if strings.Contains(err.Error(), services.InvalidKubernetesKindAccessRequest) {
 				return trace.BadParameter("%s\nTry searching for specific kinds with:\n> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND", err.Error())
 			}
+			if strings.Contains(err.Error(), services.CannotRequestRole) {
+				return trace.BadParameter("%s\nHint: run \"tsh request search --roles\" to list requestable roles.", err.Error())
+			}
 			return trace.Wrap(err)
 		}
 		cf.RequestID = req.GetName()
@@ -2916,16 +3270,25 @@ func serializeNodes(nodes []types.Server, format string) (string, error) {
 	return string(out), trace.Wrap(err)
 }
 
-func getNodeRow(proxy, cluster string, node types.Server, verbose bool) []string {
+func getNodeRow(proxy, cluster string, node types.Server, withScope bool, verbose bool) []string {
 	// Reusable function to get addr or tunnel for each node
 	getAddr := func(n types.Server) string {
-		if n.GetUseTunnel() {
+		switch {
+		case n.GetUseTunnel() && n.GetRelayGroup() != "":
+			return "⟵ Tunnel (relay)"
+		case n.GetUseTunnel():
 			return "⟵ Tunnel"
+		default:
+			return n.GetAddr()
 		}
-		return n.GetAddr()
 	}
 
 	row := make([]string, 0)
+
+	if withScope {
+		row = append(row, node.GetScope())
+	}
+
 	if proxy != "" && cluster != "" {
 		row = append(row, proxy, cluster)
 	}
@@ -2941,19 +3304,30 @@ func getNodeRow(proxy, cluster string, node types.Server, verbose bool) []string
 
 func printNodesAsText[T types.Server](output io.Writer, nodes []T, verbose bool) error {
 	var rows [][]string
+	var withScope bool
+	for _, n := range nodes {
+		if n.GetScope() != "" {
+			withScope = true
+			break
+		}
+	}
 	for _, n := range nodes {
-		rows = append(rows, getNodeRow("", "", n, verbose))
+		rows = append(rows, getNodeRow("", "", n, withScope, verbose))
 	}
 	var t asciitable.Table
 	switch verbose {
 	// In verbose mode, print everything on a single line and include the Node
 	// ID (UUID). Useful for machines that need to parse the output of "tsh ls".
 	case true:
-		t = asciitable.MakeTable([]string{"Node Name", "Node ID", "Address", "Labels"}, rows...)
+		t = asciitable.MakeTable([]string{"Scope", "Node Name", "Node ID", "Address", "Labels"}, rows...)
 	// In normal mode chunk the labels and print two per line and allow multiple
 	// lines per node.
 	case false:
-		t = asciitable.MakeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
+		if withScope {
+			t = asciitable.MakeTableWithTruncatedColumn([]string{"Scope", "Node Name", "Address", "Labels"}, rows, "Labels")
+		} else {
+			t = asciitable.MakeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
+		}
 	}
 	if _, err := fmt.Fprintln(output, t.AsBuffer().String()); err != nil {
 		return trace.Wrap(err)
@@ -3202,14 +3576,7 @@ func getDBUsers(db types.Database, accessChecker services.AccessChecker) *dbUser
 		)
 		return &dbUsers{}
 	}
-	var denied []string
-	allowed := users.Allowed()
-	if users.WildcardAllowed() {
-		// start the list with *.
-		allowed = append([]string{types.Wildcard}, allowed...)
-		// only include denied users if the wildcard is allowed.
-		denied = append(denied, users.Denied()...)
-	}
+	allowed, denied := users.ToEntities()
 	return &dbUsers{
 		Allowed: allowed,
 		Denied:  denied,
@@ -3274,9 +3641,6 @@ func formatUsersForDB(database types.Database, accessChecker services.AccessChec
 	}
 
 	dbUsers := getDBUsers(database, accessChecker)
-	if len(dbUsers.Allowed) == 0 {
-		return "(none)"
-	}
 
 	// Add a note for auto-provisioned user.
 	if database.IsAutoUsersEnabled() {
@@ -3293,10 +3657,7 @@ func formatUsersForDB(database types.Database, accessChecker services.AccessChec
 		}
 	}
 
-	if len(dbUsers.Denied) == 0 {
-		return fmt.Sprintf("%v", dbUsers.Allowed)
-	}
-	return fmt.Sprintf("%v, except: %v", dbUsers.Allowed, dbUsers.Denied)
+	return common.FormatAllowedEntities(dbUsers.Allowed, dbUsers.Denied)
 }
 
 // TODO(greedy52) more refactoring on db printing and move them to db_print.go.
@@ -3701,8 +4062,15 @@ func getAutoResourceRequest(ctx context.Context, tc *client.TeleportClient, requ
 	req.SetDryRun(true)
 	req.SetRequestReason("Dry run, this request will not be created. If you see this, there is a bug.")
 	if err := tc.WithRootClusterClient(ctx, func(clt authclient.ClientI) error {
-		req, err = clt.CreateAccessRequestV2(ctx, req)
-		return trace.Wrap(err)
+		dryRunReq, err := clt.CreateAccessRequestV2(ctx, req)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		// Copying the computed roles here is not strictly necessary but avoids requiring
+		// the server to recompute the roles when the real request is created, which can be
+		// an expensive operation.
+		req.SetRoles(dryRunReq.GetRoles())
+		return nil
 	}); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4003,7 +4371,30 @@ func onResolve(cf *CLIConf) error {
 }
 
 // onSSH executes 'tsh ssh' command
-func onSSH(cf *CLIConf) error {
+func onSSH(cf *CLIConf, initFunc ClientInitFunc) error {
+	// Handle fork after authentication.
+	var disownSignal *os.File
+	var forkAuthSuccessful atomic.Bool
+	if cf.isForkAuthChild() {
+		ctx, cancel := context.WithCancel(cf.Context)
+		cf.Context = ctx
+		// Prep files.
+		disownSignal = newSignalFile(cf.forkSignalFd)
+		defer disownSignal.Close()
+		killSignal := newSignalFile(cf.forkKillFd)
+		defer killSignal.Close()
+
+		// Watch kill signal to check when parent exits. If the read returns before
+		// the child finishes authentication, the parent has died and the child
+		// needs to die too.
+		go func() {
+			err := <-reexec.NotifyFileSignal(killSignal)
+			if err != nil && !forkAuthSuccessful.Load() {
+				cancel()
+			}
+		}()
+	}
+
 	// If "tsh ssh -V" is invoked, tsh is in OpenSSH compatibility mode, show
 	// the version and exit.
 	if cf.ShowVersion {
@@ -4029,7 +4420,7 @@ func onSSH(cf *CLIConf) error {
 		return trace.BadParameter("required argument '[user@]host' not provided")
 	}
 
-	tc, err := makeClient(cf)
+	tc, err := initFunc(cf)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -4041,7 +4432,7 @@ func onSSH(cf *CLIConf) error {
 		cf.RemoteCommand = cf.RemoteCommand[1:]
 	}
 
-	tc.Stdin = os.Stdin
+	tc.Stdin = cf.Stdin()
 	err = retryWithAccessRequest(cf, tc, func() error {
 		sshFunc := func() error {
 			var opts []func(*client.SSHOptions)
@@ -4049,6 +4440,18 @@ func onSSH(cf *CLIConf) error {
 				opts = append(opts, client.WithLocalCommandExecutor(runLocalCommand))
 			}
 
+			if disownSignal != nil {
+				opts = append(opts, client.WithForkAfterAuthentication(func() error {
+					newStdin, err := replaceStdin()
+					if err != nil {
+						return trace.Wrap(err)
+					}
+					tc.Stdin = newStdin
+					forkAuthSuccessful.Store(true)
+					return trace.Wrap(reexec.SignalAndClose(disownSignal))
+				}))
+			}
+
 			return tc.SSH(cf.Context, cf.RemoteCommand, opts...)
 		}
 		if !cf.Relogin {
@@ -4204,18 +4607,17 @@ func onSCP(cf *CLIConf) error {
 		}
 	}
 
+	sftpReq := client.SFTPRequest{
+		Sources:       cf.CopySpec[:len(cf.CopySpec)-1],
+		Destination:   cf.CopySpec[len(cf.CopySpec)-1],
+		Recursive:     cf.RecursiveCopy,
+		PreserveAttrs: cf.PreserveAttrs,
+	}
+	if !cf.Quiet {
+		sftpReq.ProgressWriter = cf.Stdout()
+	}
 	err = executor(cf.Context, tc, func() error {
-		return trace.Wrap(tc.SFTP(
-			cf.Context,
-			cf.CopySpec[:len(cf.CopySpec)-1],
-			cf.CopySpec[len(cf.CopySpec)-1],
-			sftp.Options{
-				Recursive:      cf.RecursiveCopy,
-				PreserveAttrs:  cf.PreserveAttrs,
-				Quiet:          cf.Quiet,
-				ProgressWriter: cf.Stdout(),
-			},
-		))
+		return trace.Wrap(tc.SFTP(cf.Context, sftpReq))
 	})
 
 	// don't print context canceled errors to the user
@@ -4233,6 +4635,23 @@ func makeClient(cf *CLIConf) (*client.TeleportClient, error) {
 	return tc, trace.Wrap(err)
 }
 
+// wrapInitClientWithUpdateCheck wraps the client initialization function to the Teleport cluster,
+// adding a managed update check immediately after the connection is established.
+func wrapInitClientWithUpdateCheck(clientInitFunc ClientInitFunc, reExecArgs []string) ClientInitFunc {
+	return func(cf *CLIConf) (*client.TeleportClient, error) {
+		tc, err := clientInitFunc(cf)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if cf.checkManagedUpdates {
+			if err := autoupdatetools.CheckAndUpdateRemote(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify, reExecArgs); err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
+		return tc, nil
+	}
+}
+
 // makeClient takes the command-line configuration and a proxy address and constructs & returns
 // a fully configured TeleportClient object
 func makeClientForProxy(cf *CLIConf, proxy string) (*client.TeleportClient, error) {
@@ -4385,6 +4804,7 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 	}
 
 	// Check if this host has a matching proxy template.
+	c.ProxyTemplates = cf.TSHConfig.ProxyTemplates
 	expanded, tMatched := cf.TSHConfig.ProxyTemplates.Apply(fullHostName)
 	if !tMatched && useProxyTemplate {
 		return nil, trace.BadParameter("proxy jump contains {{proxy}} variable but did not match any of the templates in tsh config")
@@ -4520,6 +4940,10 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 	if len(rPorts) > 0 {
 		c.RemoteForwardPorts = rPorts
 	}
+
+	// TODO(fspmarshall/scopes): decide if we want some kind of persistence for the CLI arg.
+	c.Scope = cf.Scope
+
 	if cf.SiteName != "" {
 		c.SiteName = cf.SiteName
 	}
@@ -4651,6 +5075,17 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 	c.DisplayParticipantRequirements = cf.displayParticipantRequirements
 	c.SSHLogDir = cf.SSHLogDir
 	c.DisableSSHResumption = cf.DisableSSHResumption
+
+	switch cf.Relay {
+	case "":
+	case "none":
+		c.RelayAddr = ""
+	case "default":
+		c.RelayAddr = c.ProfileDefaultRelayAddr
+	default:
+		c.RelayAddr = cf.Relay
+	}
+
 	return c, nil
 }
 
@@ -4739,7 +5174,7 @@ func (c *CLIConf) ProfileStatus() (*client.ProfileStatus, error) {
 }
 
 func (c *CLIConf) FullProfileStatus() (*client.ProfileStatus, []*client.ProfileStatus, error) {
-	currentProfile, profiles, err := c.getClientStore().FullProfileStatus()
+	currentProfile, profiles, err := c.getClientStore().FullProfileStatus(c.Proxy)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -4948,19 +5383,26 @@ func onShow(cf *CLIConf) error {
 	return nil
 }
 
-// printStatus prints the status of the profile.
-func printStatus(debug bool, p *profileInfo, env map[string]string, isActive bool) {
-	var prefix string
-	humanDuration := "EXPIRED"
-	duration := time.Until(p.ValidUntil)
-	if duration.Nanoseconds() > 0 {
-		humanDuration = fmt.Sprintf("valid for %v", duration.Round(time.Minute))
-		// If certificate is valid for less than a minute, display "<1m" instead of "0s".
-		if duration < time.Minute {
-			humanDuration = "valid for <1m"
-		}
+func humanFriendlyValidUntilDuration(validUntil time.Time, clock clockwork.Clock) string {
+	duration := clock.Until(validUntil)
+	switch {
+	case duration <= 0:
+		return "EXPIRED"
+	case duration < time.Minute:
+		return "valid for <1m"
+	default:
+		return fmt.Sprintf("valid for %s",
+			// Since duration is truncated to minute, duration.String() always
+			// ends with 0s.
+			strings.TrimRight(duration.Truncate(time.Minute).String(), "0s"),
+		)
 	}
+}
 
+// printStatus prints the status of the profile.
+func printStatus(w io.Writer, debug bool, p *profileInfo, env map[string]string, isActive bool) {
+	clock := clockwork.NewRealClock()
+	var prefix string
 	proxyURL := p.getProxyURLLine(isActive, env)
 	cluster := p.getClusterLine(isActive, env)
 	kubeCluster := p.getKubeClusterLine(isActive, env)
@@ -4970,74 +5412,102 @@ func printStatus(debug bool, p *profileInfo, env map[string]string, isActive boo
 		prefix = "  "
 	}
 
-	fmt.Printf("%vProfile URL:        %v\n", prefix, proxyURL)
-	fmt.Printf("  Logged in as:       %v\n", p.Username)
+	fmt.Fprintf(w, "%vProfile URL:        %v\n", prefix, proxyURL)
+	if debug {
+		switch {
+		case p.RelayAddr == "" && p.DefaultRelayAddr != "":
+			fmt.Fprintf(w, "  Relay address:      %v (default)\n", p.DefaultRelayAddr)
+		case p.RelayAddr != "" && p.DefaultRelayAddr != "":
+			fmt.Fprintf(w, "  Relay address:      %v (default: %v)\n", p.RelayAddr, p.DefaultRelayAddr)
+		case p.RelayAddr != "" && p.DefaultRelayAddr == "":
+			fmt.Fprintf(w, "  Relay address:      %v (no default)\n", p.RelayAddr)
+		default:
+			fmt.Fprintf(w, "  Relay address:      (none)\n")
+		}
+	} else if relayAddr := cmp.Or(p.RelayAddr, p.DefaultRelayAddr); relayAddr != "" {
+		fmt.Fprintf(w, "  Relay address:      %v\n", relayAddr)
+	}
+	fmt.Fprintf(w, "  Logged in as:       %v\n", p.Username)
 	if len(p.ActiveRequests) != 0 {
-		fmt.Printf("  Active requests:    %v\n", strings.Join(p.ActiveRequests, ", "))
+		fmt.Fprintf(w, "  Active requests:    %v\n", strings.Join(p.ActiveRequests, ", "))
 	}
 
 	if cluster != "" {
-		fmt.Printf("  Cluster:            %v\n", cluster)
+		fmt.Fprintf(w, "  Cluster:            %v\n", cluster)
+	}
+	if p.Scope != "" {
+		fmt.Fprintf(w, "  Scope:              %v\n", p.Scope)
+		fmt.Fprintf(w, "  Scoped Roles:\n")
+
+		assignedScopes := slices.Collect(maps.Keys(p.ScopedRoles))
+		slices.Sort(assignedScopes)
+		for _, scope := range assignedScopes {
+			fmt.Fprintf(w, "    %s: %v\n", scope, rolesToString(debug, p.ScopedRoles[scope]))
+		}
+	} else {
+		fmt.Fprintf(w, "  Roles:              %v\n", rolesToString(debug, p.Roles))
 	}
-	fmt.Printf("  Roles:              %v\n", rolesToString(debug, p.Roles))
 	if debug {
 		var count int
 		for k, v := range p.Traits {
+			if len(v) == 0 {
+				continue
+			}
 			if count == 0 {
-				fmt.Printf("  Traits:             %v: %v\n", k, v)
+				fmt.Fprintf(w, "  Traits:             %v: %v\n", k, v)
 			} else {
-				fmt.Printf("                      %v: %v\n", k, v)
+				fmt.Fprintf(w, "                      %v: %v\n", k, v)
 			}
 			count = count + 1
 		}
 	}
 	if len(p.Logins) > 0 {
-		fmt.Printf("  Logins:             %v\n", strings.Join(p.Logins, ", "))
+		fmt.Fprintf(w, "  Logins:             %v\n", strings.Join(p.Logins, ", "))
 	}
 	if p.KubernetesEnabled {
-		fmt.Printf("  Kubernetes:         enabled\n")
+		fmt.Fprintf(w, "  Kubernetes:         enabled\n")
 		if kubeCluster != "" {
-			fmt.Printf("  Kubernetes cluster: %q\n", kubeCluster)
+			fmt.Fprintf(w, "  Kubernetes cluster: %q\n", kubeCluster)
 		}
 		if len(p.KubernetesUsers) > 0 {
-			fmt.Printf("  Kubernetes users:   %v\n", strings.Join(p.KubernetesUsers, ", "))
+			fmt.Fprintf(w, "  Kubernetes users:   %v\n", strings.Join(p.KubernetesUsers, ", "))
 		}
 		if len(p.KubernetesGroups) > 0 {
-			fmt.Printf("  Kubernetes groups:  %v\n", strings.Join(p.KubernetesGroups, ", "))
+			fmt.Fprintf(w, "  Kubernetes groups:  %v\n", strings.Join(p.KubernetesGroups, ", "))
 		}
 	} else {
-		fmt.Printf("  Kubernetes:         disabled\n")
+		fmt.Fprintf(w, "  Kubernetes:         disabled\n")
 	}
 	if len(p.Databases) != 0 {
-		fmt.Printf("  Databases:          %v\n", strings.Join(p.Databases, ", "))
+		fmt.Fprintf(w, "  Databases:          %v\n", strings.Join(p.Databases, ", "))
 	}
 	if len(p.AllowedResourceIDs) > 0 {
 		allowedResourcesStr, err := types.ResourceIDsToString(p.AllowedResourceIDs)
 		if err != nil {
 			logger.WarnContext(context.Background(), "failed to marshal allowed resource IDs to string", "error", err)
 		} else {
-			fmt.Printf("  Allowed Resources:  %s\n", allowedResourcesStr)
+			fmt.Fprintf(w, "  Allowed Resources:  %s\n", allowedResourcesStr)
 		}
 	}
 	if p.GitHubIdentity != nil {
-		fmt.Printf("  GitHub username:    %s\n", p.GitHubIdentity.Username)
+		fmt.Fprintf(w, "  GitHub username:    %s\n", p.GitHubIdentity.Username)
 	}
-	fmt.Printf("  Valid until:        %v [%v]\n", p.ValidUntil, humanDuration)
-	fmt.Printf("  Extensions:         %v\n", strings.Join(p.Extensions, ", "))
+	fmt.Fprintf(w, "  Valid until:        %v [%v]\n", p.ValidUntil, humanFriendlyValidUntilDuration(p.ValidUntil, clock))
+	fmt.Fprintf(w, "  Extensions:         %v\n", strings.Join(p.Extensions, ", "))
 
 	if debug {
 		first := true
 		for k, v := range p.CriticalOptions {
 			if first {
-				fmt.Printf("  Critical options:   %v: %v\n", k, v)
+				fmt.Fprintf(w, "  Critical options:   %v: %v\n", k, v)
 			} else {
-				fmt.Printf("                      %v: %v\n", k, v)
+				fmt.Fprintf(w, "                      %v: %v\n", k, v)
 			}
 			first = false
 		}
 	}
 
-	fmt.Printf("\n")
+	fmt.Fprintf(w, "\n")
 }
 
 func isOktaRole(role string) bool {
@@ -5070,7 +5540,7 @@ func rolesToString(debug bool, roles []string) string {
 }
 
 // printLoginInformation displays the provided profile information to the user.
-func printLoginInformation(cf *CLIConf, profile *client.ProfileStatus, profiles []*client.ProfileStatus, accessListsToReview []*accesslist.AccessList) error {
+func printLoginInformation(cf *CLIConf, profile *client.ProfileStatus, profiles []*client.ProfileStatus) error {
 	env := getTshEnv()
 	active, others := makeAllProfileInfo(profile, profiles, env)
 
@@ -5089,12 +5559,12 @@ func printLoginInformation(cf *CLIConf, profile *client.ProfileStatus, profiles
 
 		// Print the active profile.
 		if profile != nil {
-			printStatus(cf.Debug, active, env, true)
+			printStatus(cf.Stdout(), cf.Debug, active, env, true)
 		}
 
 		// Print all other profiles.
 		for _, p := range others {
-			printStatus(cf.Debug, p, env, false)
+			printStatus(cf.Stdout(), cf.Debug, p, env, false)
 		}
 
 		// Print relevant active env vars, if they are set.
@@ -5108,21 +5578,6 @@ func printLoginInformation(cf *CLIConf, profile *client.ProfileStatus, profiles
 		}
 	}
 
-	if len(accessListsToReview) > 0 {
-		fmt.Printf("Access lists that need to be reviewed:\n")
-		for _, accessList := range accessListsToReview {
-			var msg string
-			nextAuditDate := accessList.Spec.Audit.NextAuditDate.Format(time.DateOnly)
-			if time.Now().After(accessList.Spec.Audit.NextAuditDate) {
-				msg = fmt.Sprintf("review is overdue (%v)", nextAuditDate)
-			} else {
-				msg = fmt.Sprintf("review is required by %v", nextAuditDate)
-			}
-			fmt.Printf("\t%s (%v)\n", accessList.Spec.Title, msg)
-		}
-		fmt.Println()
-	}
-
 	return nil
 }
 
@@ -5140,31 +5595,16 @@ func onStatus(cf *CLIConf) error {
 		}
 		return trace.Wrap(err)
 	}
-
-	// make the teleport client and retrieve the certificate from the proxy:
-	tc, err := makeClient(cf)
-	if err != nil {
-		logger.WarnContext(cf.Context, "Failed to make client for retrieving cluster alerts", "error", err)
-		return trace.Wrap(err)
+	if profile == nil && len(profiles) == 0 {
+		return trace.NotFound("Not logged in.")
 	}
 
-	// `tsh status` should run without requiring user interaction.
-	// To achieve this, we avoid remote calls that might prompt for
-	// hardware key touch or require a PIN.
-	hardwareKeyInteractionRequired := tc.PrivateKeyPolicy.MFAVerified()
-
-	var accessListsToReview []*accesslist.AccessList
-	if hardwareKeyInteractionRequired {
-		logger.DebugContext(cf.Context, "Skipping fetching access lists to review due to Hardware Key PIN/Touch requirement")
-	} else {
-		accessListsToReview = cf.getAccessListsToReview(tc)
-	}
-	if err := printLoginInformation(cf, profile, profiles, accessListsToReview); err != nil {
+	if err = printLoginInformation(cf, profile, profiles); err != nil {
 		return trace.Wrap(err)
 	}
 
 	if profile == nil {
-		return trace.NotFound("Not logged in.")
+		return trace.NotFound("No active profile.")
 	}
 
 	duration := time.Until(profile.ValidUntil)
@@ -5172,6 +5612,18 @@ func onStatus(cf *CLIConf) error {
 		return trace.NotFound("Active profile expired.")
 	}
 
+	// make the teleport client and retrieve the certificate from the proxy:
+	tc, err := makeClient(cf)
+	if err != nil {
+		logger.WarnContext(cf.Context, "Failed to make client for retrieving cluster alerts", "error", err)
+		return trace.Wrap(err)
+	}
+
+	// `tsh status` should run without requiring user interaction.
+	// To achieve this, we avoid remote calls that might prompt for
+	// hardware key touch or require a PIN.
+	hardwareKeyInteractionRequired := tc.PrivateKeyPolicy.MFAVerified()
+
 	if hardwareKeyInteractionRequired {
 		logger.DebugContext(cf.Context, "Skipping cluster alerts due to Hardware Key PIN/Touch requirement")
 	} else {
@@ -5186,10 +5638,14 @@ func onStatus(cf *CLIConf) error {
 
 type profileInfo struct {
 	ProxyURL           string                 `json:"profile_url"`
+	RelayAddr          string                 `json:"relay_addr,omitempty"`
+	DefaultRelayAddr   string                 `json:"default_relay_addr,omitempty"`
 	Username           string                 `json:"username"`
 	ActiveRequests     []string               `json:"active_requests,omitempty"`
 	Cluster            string                 `json:"cluster"`
 	Roles              []string               `json:"roles,omitempty"`
+	Scope              string                 `json:"scope,omitempty"`
+	ScopedRoles        map[string][]string    `json:"scoped_roles,omitempty"`
 	Traits             wrappers.Traits        `json:"traits,omitempty"`
 	Logins             []string               `json:"logins,omitempty"`
 	KubernetesEnabled  bool                   `json:"kubernetes_enabled"`
@@ -5236,10 +5692,14 @@ func makeProfileInfo(p *client.ProfileStatus, env map[string]string, isActive bo
 	selectedKubeCluster, _ := kubeconfig.SelectedKubeCluster("", p.Cluster)
 	out := &profileInfo{
 		ProxyURL:           p.ProxyURL.String(),
+		RelayAddr:          p.RelayAddr,
+		DefaultRelayAddr:   p.DefaultRelayAddr,
 		Username:           p.Username,
 		ActiveRequests:     p.ActiveRequests,
 		Cluster:            p.Cluster,
 		Roles:              p.Roles,
+		Scope:              p.Scope,
+		ScopedRoles:        p.ScopedRoles,
 		Traits:             p.Traits,
 		Logins:             logins,
 		KubernetesEnabled:  p.KubeEnabled,
@@ -5340,17 +5800,6 @@ func getTshEnv() map[string]string {
 	return env
 }
 
-// host is a utility function that extracts
-// host from the host:port pair, in case of any error
-// returns the original value
-func host(in string) string {
-	out, err := utils.Host(in)
-	if err != nil {
-		return in
-	}
-	return out
-}
-
 func awaitRequestResolution(ctx context.Context, clt authclient.ClientI, req types.AccessRequest) (types.AccessRequest, error) {
 	filter := types.AccessRequestFilter{
 		User: req.GetUser(),
@@ -5399,7 +5848,11 @@ func awaitRequestResolution(ctx context.Context, clt authclient.ClientI, req typ
 					return nil, trace.BadParameter("unexpected resource type %T", event.Resource)
 				}
 			case types.OpDelete:
-				return nil, trace.Errorf("request %s has expired or been deleted...", event.Resource.GetName())
+				// Delete events are not filtered, only return if the deleted
+				// request matches the request we're waiting for.
+				if event.Resource.GetName() == req.GetName() {
+					return nil, trace.Errorf("request %s has expired or been deleted...", event.Resource.GetName())
+				}
 			default:
 				logger.WarnContext(ctx, "Skipping unknown event type", "event_type", event.Type)
 			}
@@ -5836,7 +6289,8 @@ func updateKubeConfigOnLogin(cf *CLIConf, tc *client.TeleportClient) error {
 	if len(cf.KubernetesCluster) == 0 {
 		return nil
 	}
-	kubeStatus, err := fetchKubeStatus(cf.Context, tc)
+	const ignoreRelayFalse = false
+	kubeStatus, err := fetchKubeStatus(cf.Context, tc, ignoreRelayFalse)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -5862,28 +6316,6 @@ func onHeadlessApprove(cf *CLIConf) error {
 	return trace.Wrap(err)
 }
 
-// getAccessListsToReview will return access lists that the logged in user needs to review. On error,
-// this will return an empty list.
-func (cf *CLIConf) getAccessListsToReview(tc *client.TeleportClient) []*accesslist.AccessList {
-	clusterClient, err := tc.ConnectToCluster(cf.Context)
-	if err != nil {
-		logger.DebugContext(cf.Context, "Error connecting to the cluster", "error", err)
-		return nil
-	}
-	defer func() {
-		clusterClient.Close()
-	}()
-
-	// Get the access lists to review. If the call returns NotImplemented, ignore it, as we may be communicating with an OSS
-	// server, which does not support access lists.
-	accessListsToReview, err := clusterClient.AuthClient.AccessListClient().GetAccessListsToReview(cf.Context)
-	if err != nil && !trace.IsNotImplemented(err) {
-		logger.DebugContext(cf.Context, "Error getting access lists to review", "error", err)
-	}
-
-	return accessListsToReview
-}
-
 var mlockModes = []string{mlockModeNo, mlockModeAuto, mlockModeBestEffort, mlockModeStrict}
 
 const (
diff --git a/tool/tsh/common/tsh_helper_test.go b/tool/tsh/common/tsh_helper_test.go
index bf1438505e9a8..41510dbeb71e1 100644
--- a/tool/tsh/common/tsh_helper_test.go
+++ b/tool/tsh/common/tsh_helper_test.go
@@ -50,7 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
 type suite struct {
@@ -98,7 +98,7 @@ func (s *suite) setupRootCluster(t *testing.T, options testSuiteOptions) {
 
 	cfg := servicecfg.MakeDefaultConfig()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	err := config.ApplyFileConfig(fileConfig, cfg)
 	require.NoError(t, err)
 	cfg.FileDescriptors = dynAddr.Descriptors
@@ -195,7 +195,7 @@ func (s *suite) setupLeafCluster(t *testing.T, options testSuiteOptions) {
 
 	cfg := servicecfg.MakeDefaultConfig()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	err := config.ApplyFileConfig(fileConfig, cfg)
 	require.NoError(t, err)
 	cfg.FileDescriptors = dynAddr.Descriptors
diff --git a/tool/tsh/common/tsh_test.go b/tool/tsh/common/tsh_test.go
index 81b56f63fe03e..5bb0d2501f58c 100644
--- a/tool/tsh/common/tsh_test.go
+++ b/tool/tsh/common/tsh_test.go
@@ -51,6 +51,7 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	otlp "go.opentelemetry.io/proto/otlp/trace/v1"
@@ -84,9 +85,12 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/identityfile"
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	"github.com/gravitational/teleport/lib/cryptosuites/cryptosuitestest"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/modules/modulestest"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -95,6 +99,7 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/log/logtest"
 	"github.com/gravitational/teleport/tool/common"
 	testserver "github.com/gravitational/teleport/tool/teleport/testenv"
 )
@@ -129,9 +134,13 @@ func TestMain(m *testing.M) {
 	modules.SetModules(&cliModules{})
 	modules.SetInsecureTestMode(true)
 
-	utils.InitLoggerForTests()
-	cryptosuites.PrecomputeRSATestKeys(m)
-	os.Exit(m.Run())
+	logtest.InitLogger(testing.Verbose)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cryptosuitestest.PrecomputeRSAKeys(ctx)
+	exitCode := m.Run()
+	cancel()
+	os.Exit(exitCode)
 }
 
 func BenchmarkInit(b *testing.B) {
@@ -201,10 +210,11 @@ func handleReexec() {
 		})
 	}
 
-	// Allows test to refer to tsh binary in tests.
-	// Needed for tests that generate OpenSSH config by tsh config command where
-	// tsh proxy ssh command is used as ProxyCommand.
-	if os.Getenv(tshBinMainTestEnv) != "" {
+	// Re-exec tsh commands. Needed for:
+	// - Tests that generate OpenSSH config by tsh config command where
+	//   tsh proxy ssh command is used as ProxyCommand.
+	// - Fork after authentication.
+	if os.Getenv(tshBinMainTestEnv) != "" || (len(os.Args) >= 2 && os.Args[1] == "--fork-signal-fd") {
 		if os.Getenv(tshBinMainTestOneshotEnv) != "" {
 			// unset this env var so child processes started by 'tsh ssh'
 			// will be executed correctly below.
@@ -224,8 +234,7 @@ func handleReexec() {
 		os.Exit(0)
 	}
 
-	// If the test is re-executing itself, execute the command that comes over
-	// the pipe. Used to test tsh ssh command.
+	// Re-exec teleport commands. Used to test tsh ssh command.
 	if srv.IsReexec() {
 		srv.RunAndExit(os.Args[1])
 	}
@@ -233,6 +242,10 @@ func handleReexec() {
 
 type cliModules struct{}
 
+func (p *cliModules) GenerateLongTermResourceGrouping(_ context.Context, _ modules.AccessResourcesGetter, _ types.AccessRequest) (*types.LongTermResourceGrouping, error) {
+	return &types.LongTermResourceGrouping{}, nil
+}
+
 func (p *cliModules) GenerateAccessRequestPromotions(_ context.Context, _ modules.AccessResourcesGetter, _ types.AccessRequest) (*types.AccessRequestAllowedPromotions, error) {
 	return &types.AccessRequestAllowedPromotions{}, nil
 }
@@ -456,6 +469,29 @@ func TestNoEnvVars(t *testing.T) {
 	require.NoError(t, trace.NewAggregate(err, ctx.Err()))
 }
 
+// TestDefaultPrintUsage verifies that the main `kingpin.Application` parser has not been
+// previously terminated, and that it correctly prints the usage message when using the
+// global `--help` flag or the `help` command, and both are identical.
+func TestDefaultPrintUsage(t *testing.T) {
+	t.Parallel()
+	testExecutable, err := os.Executable()
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	cmd := exec.CommandContext(ctx, testExecutable, "version", "--help")
+	cmd.Env = []string{fmt.Sprintf("%s=1", tshBinMainTestEnv), "TELEPORT_TOOLS_VERSION=off"}
+	flagOutput, err := cmd.CombinedOutput()
+	require.NoError(t, err)
+	require.Contains(t, string(flagOutput), "Print the tsh client and Proxy server versions for the current context")
+
+	cmd = exec.CommandContext(ctx, testExecutable, "help", "version")
+	cmd.Env = []string{fmt.Sprintf("%s=1", tshBinMainTestEnv), "TELEPORT_TOOLS_VERSION=off"}
+	commandOutput, err := cmd.CombinedOutput()
+	require.NoError(t, err)
+	require.Equal(t, string(flagOutput), string(commandOutput))
+}
+
 func TestFailedLogin(t *testing.T) {
 	t.Parallel()
 	tmpHomePath := t.TempDir()
@@ -1214,19 +1250,23 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 
 	stage1Hostname := "test-stage-1"
 	node := makeTestSSHNode(t, rootAuthAddr, withHostname(stage1Hostname), withSSHLabel("env", "stage"))
-	sshHostID := node.Config.HostUUID
+	sshHostID, err := node.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	stage2Hostname := "test-stage-2"
 	node2 := makeTestSSHNode(t, rootAuthAddr, withHostname(stage2Hostname), withSSHLabel("env", "stage"))
-	sshHostID2 := node2.Config.HostUUID
+	sshHostID2, err := node2.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	prodHostname := "test-prod-1"
 	nodeProd := makeTestSSHNode(t, rootAuthAddr, withHostname(prodHostname), withSSHLabel("env", "prod"))
-	sshHostID3 := nodeProd.Config.HostUUID
+	sshHostID3, err := nodeProd.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	leafHostname := "leaf-node"
 	leafNode := makeTestSSHNode(t, leafAuthAddr, withHostname(leafHostname), withSSHLabel("animal", "llama"))
-	sshLeafHostID := leafNode.Config.HostUUID
+	sshLeafHostID, err := leafNode.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	hasNodes := func(asrv *auth.Server, hostIDs ...string) func() bool {
 		return func() bool {
@@ -1938,7 +1978,7 @@ func TestNoRelogin(t *testing.T) {
 // ssh server using a resource access request when "tsh ssh" fails with
 // AccessDenied.
 func TestSSHAccessRequest(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
@@ -1999,15 +2039,18 @@ func TestSSHAccessRequest(t *testing.T) {
 
 	sshHostname := "test-ssh-server"
 	node := makeTestSSHNode(t, authAddr, withHostname(sshHostname), withSSHLabel("access", "true"))
-	sshHostID := node.Config.HostUUID
+	sshHostID, err := node.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	sshHostname2 := "test-ssh-server-2"
 	node2 := makeTestSSHNode(t, authAddr, withHostname(sshHostname2), withSSHLabel("access", "true"))
-	sshHostID2 := node2.Config.HostUUID
+	sshHostID2, err := node2.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	sshHostnameNoAccess := "test-ssh-server-no-access"
 	nodeNoAccess := makeTestSSHNode(t, authAddr, withHostname(sshHostnameNoAccess), withSSHLabel("access", "false"))
-	sshHostIDNoAccess := nodeNoAccess.Config.HostUUID
+	sshHostIDNoAccess, err := nodeNoAccess.WaitForHostID(ctx)
+	require.NoError(t, err)
 
 	hasNodes := func(hostIDs ...string) func() bool {
 		return func() bool {
@@ -2375,9 +2418,147 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 	require.NoError(t, err)
 }
 
+// TestSSHAccessRequestWait tests that "tsh ssh" automatically creates an
+// access request when required and properly waits for it to be approved.
+func TestSSHAccessRequestWait(t *testing.T) {
+	// Access requests require enterprise.
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// Set up a requester role the user will have.
+	requester, err := types.NewRole("requester", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				Roles:         []string{"node-access"},
+				SearchAsRoles: []string{"node-access"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Set up an access role the user will automatically request.
+	user, err := user.Current()
+	require.NoError(t, err)
+	nodeAccessRole, err := types.NewRole("node-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			NodeLabels: types.Labels{
+				"access": {"true"},
+			},
+			Logins: []string{user.Username},
+		},
+	})
+	require.NoError(t, err)
+
+	// Use a mock auth connector so the user can log in for the test.
+	connector := mockConnector(t)
+
+	// Create the test user with the requester role.
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetRoles([]string{"requester"})
+
+	// Create the cluster with our user and roles.
+	rootAuth, rootProxy := makeTestServers(t,
+		withBootstrap(requester, nodeAccessRole, connector, alice),
+	)
+
+	authAddr, err := rootAuth.AuthAddr()
+	require.NoError(t, err)
+
+	proxyAddr, err := rootProxy.ProxyWebAddr()
+	require.NoError(t, err)
+
+	// Make the SSH node our test user will access.
+	sshHostname := "test-ssh-server"
+	node := makeTestSSHNode(t, authAddr, withHostname(sshHostname), withSSHLabel("access", "true"))
+	sshHostID, err := node.WaitForHostID(ctx)
+	require.NoError(t, err)
+
+	tmpHomePath := t.TempDir()
+
+	// Log the user in.
+	err = Run(ctx, []string{
+		"login",
+		"--insecure",
+		"--proxy", proxyAddr.String(),
+		"--user", "alice",
+	}, setHomePath(tmpHomePath), setMockSSOLogin(rootAuth.GetAuthServer(), alice, connector.GetName()))
+	require.NoError(t, err)
+
+	// Wait for the proxy to see the node so that future SSH attempts may
+	// succeed, the most reliable way seems to make an SSH attempt and look for
+	// an AccessDenied error.
+	require.EventuallyWithT(t, func(t *assert.CollectT) {
+		var output strings.Builder
+		err = Run(ctx, []string{
+			"ssh", "--disable-access-request",
+			fmt.Sprintf("%s@%s", user.Username, sshHostID),
+		}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
+			cf.overrideStderr = &output
+			return nil
+		})
+		require.Error(t, err)
+		require.Contains(t, output.String(), "access denied")
+	}, 10*time.Second, 100*time.Millisecond, "node never showed up")
+
+	// Initialize an access request watcher.
+	requestWatcher, err := rootAuth.GetAuthServer().NewWatcher(ctx, types.Watch{
+		Name:  types.KindAccessRequest,
+		Kinds: []types.WatchKind{{Kind: types.KindAccessRequest}},
+	})
+	require.NoError(t, err)
+	evt := <-requestWatcher.Events()
+	require.Equal(t, types.OpInit, evt.Type)
+
+	// In the background, start the SSH attempt. It should automatically create
+	// an access request, wait for it to be approved, and then run the echo
+	// command on the server.
+	sshErr := make(chan error, 1)
+	go func() {
+		sshErr <- Run(ctx, []string{
+			"ssh",
+			"--request-reason", "reason here to bypass prompt",
+			fmt.Sprintf("%s@%s", user.Username, sshHostID),
+			"echo", "test",
+		}, setHomePath(tmpHomePath))
+	}()
+
+	// Wait to see the new access request created.
+	evt = <-requestWatcher.Events()
+	require.Equal(t, types.OpPut, evt.Type)
+	originalRequestID := evt.Resource.GetName()
+
+	// Create, then delete, an extraneous access request, to validate that tsh
+	// does not stop waiting for request approval when a different access
+	// request gets deleted.
+	otherRequestID := uuid.NewString()
+	req, err := types.NewAccessRequest(otherRequestID, "alice", "node-access")
+	require.NoError(t, err)
+	err = rootAuth.GetAuthServer().CreateAccessRequest(ctx, req)
+	require.NoError(t, err)
+	err = rootAuth.GetAuthServer().DeleteAccessRequest(ctx, otherRequestID)
+	require.NoError(t, err)
+
+	// Approve the original access request.
+	err = rootAuth.GetAuthServer().SetAccessRequestState(ctx, types.AccessRequestUpdate{
+		RequestID: originalRequestID,
+		State:     types.RequestState_APPROVED,
+	})
+	require.NoError(t, err)
+
+	// Wait for the SSH attempt to succeed.
+	select {
+	case <-time.After(10 * time.Second):
+		t.Error("SSH attempt with automatic access request timed out")
+	case err := <-sshErr:
+		assert.NoError(t, err, "SSH attempt with automatic access request failed")
+	}
+}
+
 // TestSSHCommand tests that a user can access a single SSH node and run commands.
 func TestSSHCommands(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
@@ -2401,7 +2582,7 @@ func TestSSHCommands(t *testing.T) {
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname(sshHostname),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 		testserver.WithSSHLabel(accessRoleName, "true"),
 		testserver.WithSSHPublicAddrs("127.0.0.1:0"),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
@@ -2410,7 +2591,12 @@ func TestSSHCommands(t *testing.T) {
 			cfg.SSH.DisableCreateHostUser = true
 		}),
 	}
-	rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
@@ -2882,7 +3068,7 @@ func TestSSHHeadlessCLIFlags(t *testing.T) {
 }
 
 func TestSSHHeadless(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
@@ -2920,7 +3106,7 @@ func TestSSHHeadless(t *testing.T) {
 	bob.SetRoles([]string{"requester"})
 
 	sshHostname := "test-ssh-host"
-	server := testserver.MakeTestServer(t,
+	server, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Hostname = sshHostname
 			cfg.Auth.Enabled = true
@@ -2944,6 +3130,11 @@ func TestSSHHeadless(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, server.Close())
+		require.NoError(t, server.Wait())
+	})
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		found, err := server.GetAuthServer().GetNodes(ctx, apidefaults.Namespace)
@@ -3012,7 +3203,7 @@ func TestSSHHeadless(t *testing.T) {
 }
 
 func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	agentKeyring, _ := createAgent(t)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -3039,7 +3230,7 @@ func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
 
 	sshHostname := "test-ssh-host"
 
-	server := testserver.MakeTestServer(t,
+	server, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Hostname = sshHostname
 			cfg.Auth.Enabled = true
@@ -3061,6 +3252,11 @@ func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
 				},
 			}
 		}))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, server.Close())
+		require.NoError(t, server.Wait())
+	})
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		found, err := server.GetAuthServer().GetNodes(ctx, apidefaults.Namespace)
@@ -3867,7 +4063,7 @@ func withSSHLabel(key, value string) testServerOptFunc {
 	})
 }
 
-// deprecated: Use `tools/teleport/testenv.MakeTestServer` instead.
+// deprecated: Use `tools/teleport/testenv.NewTeleportProcess` instead.
 func makeTestSSHNode(t *testing.T, authAddr *utils.NetAddr, opts ...testServerOptFunc) *service.TeleportProcess {
 	var options testServersOpts
 	for _, opt := range opts {
@@ -3888,7 +4084,7 @@ func makeTestSSHNode(t *testing.T, authAddr *utils.NetAddr, opts ...testServerOp
 	cfg.SSH.Addr = *utils.MustParseAddr("127.0.0.1:0")
 	cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr}
 	cfg.SSH.DisableCreateHostUser = true
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	// Disabling debug service for tests so that it doesn't break if the data
 	// directory path is too long.
 	cfg.DebugService.Enabled = false
@@ -3900,7 +4096,7 @@ func makeTestSSHNode(t *testing.T, authAddr *utils.NetAddr, opts ...testServerOp
 	return runTeleport(t, cfg)
 }
 
-// deprecated: Use `tools/teleport/testenv.MakeTestServer` instead.
+// deprecated: Use `tools/teleport/testenv.NewTeleportProcess` instead.
 func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.TeleportProcess, proxy *service.TeleportProcess) {
 	t.Helper()
 
@@ -3937,7 +4133,7 @@ func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.Tel
 	cfg.Proxy.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: net.JoinHostPort("127.0.0.1", ports.Pop())}
 	cfg.Proxy.ReverseTunnelListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: net.JoinHostPort("127.0.0.1", ports.Pop())}
 	cfg.Proxy.DisableWebInterface = true
-	cfg.Logger = utils.NewSlogLoggerForTests()
+	cfg.Logger = logtest.NewLogger()
 	// Disabling debug service for tests so that it doesn't break if the data
 	// directory path is too long.
 	cfg.DebugService.Enabled = false
@@ -3989,7 +4185,7 @@ func mockSSOLogin(authServer *auth.Server, user types.User) client.SSOLoginFunc
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		sshCert, tlsCert, err := authServer.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+		sshCert, tlsCert, err := authServer.GenerateUserTestCertsWithContext(ctx, auth.GenerateUserTestCertsRequest{
 			SSHPubKey:               keyRing.SSHPrivateKey.MarshalSSHPublicKey(),
 			TLSPubKey:               tlsPub,
 			Username:                user.GetName(),
@@ -4029,7 +4225,7 @@ func mockHeadlessLogin(t *testing.T, authServer *auth.Server, user types.User) c
 		require.NoError(t, err)
 		tlsPub, err := keyRing.TLSPrivateKey.MarshalTLSPublicKey()
 		require.NoError(t, err)
-		sshCert, tlsCert, err := authServer.GenerateUserTestCerts(auth.GenerateUserTestCertsRequest{
+		sshCert, tlsCert, err := authServer.GenerateUserTestCertsWithContext(ctx, auth.GenerateUserTestCertsRequest{
 			SSHPubKey:      keyRing.SSHPrivateKey.MarshalSSHPublicKey(),
 			TLSPubKey:      tlsPub,
 			Username:       user.GetName(),
@@ -4297,6 +4493,7 @@ func TestSerializeDatabases(t *testing.T) {
         },
         "iam_policy_status": "IAM_POLICY_STATUS_UNSPECIFIED",
         "elasticache": {},
+        "elasticache_serverless": {},
         "secret_store": {},
         "memorydb": {},
         "opensearch": {},
@@ -4305,10 +4502,10 @@ func TestSerializeDatabases(t *testing.T) {
         "docdb": {}
       },
       "mysql": {},
-      "oracle": {
-        "audit_user": ""
+      "oracle": {},
+      "gcp": {
+        "alloydb": {}
       },
-      "gcp": {},
       "azure": {
 	    "redis": {}
 	  },
@@ -4330,6 +4527,7 @@ func TestSerializeDatabases(t *testing.T) {
         },
         "iam_policy_status": "IAM_POLICY_STATUS_UNSPECIFIED",
         "elasticache": {},
+        "elasticache_serverless": {},
         "secret_store": {},
         "memorydb": {},
         "opensearch": {},
@@ -5305,7 +5503,7 @@ func TestForwardingTraces(t *testing.T) {
 			proxyAddr, err := proxyProcess.ProxyWebAddr()
 			require.NoError(t, err)
 
-			// --trace should have no impact on login, since login is ignored
+			// --trace should cause the login to be traced.
 			err = Run(context.Background(), []string{
 				"login",
 				"--insecure",
@@ -5314,12 +5512,13 @@ func TestForwardingTraces(t *testing.T) {
 			}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, alice, connector.GetName()))
 			require.NoError(t, err)
 
-			if traceCfg.Enabled && traceCfg.SamplingRate > 0 {
+			if traceCfg.Enabled {
 				collector.WaitForExport()
 			}
 
-			// ensure login doesn't generate any spans from tsh if spans are being sampled
-			loginAssertion := spanAssertion(false, !traceCfg.Enabled || traceCfg.SamplingRate <= 0)
+			// Ensure login spans from tsh are forwarded to the exporter if
+			// tracing is enabled on the auth service.
+			loginAssertion := spanAssertion(true, !traceCfg.Enabled)
 			loginAssertion(t, collector.Spans())
 
 			err = Run(context.Background(), []string{
@@ -5519,8 +5718,20 @@ func TestShowSessions(t *testing.T) {
 		"db_protocol": "postgres",
 		"db_uri": "",
 		"session_start": "0001-01-01T00:00:00Z",
-		"session_stop": "0001-01-01T00:00:00Z"
-    } ]`
+		"session_stop": "0001-01-01T00:00:00Z",
+		"participants": ["someParticipant"]
+    },
+	{
+		"app_name": "someApp",
+		"ei": 0,
+		"event": "",
+		"server_id": "",
+		"session_chunk_id": "someChunkID",
+		"sid": "",
+		"time": "0001-01-01T00:00:00Z",
+		"uid": "someID5",
+		"user": "someUser"
+	} ]`
 	sessions := []events.AuditEvent{
 		&events.SessionEnd{
 			Metadata: events.Metadata{
@@ -5556,8 +5767,21 @@ func TestShowSessions(t *testing.T) {
 			DatabaseMetadata: events.DatabaseMetadata{
 				DatabaseProtocol: "postgres",
 			},
-			StartTime: time.Time{},
-			EndTime:   time.Time{},
+			StartTime:    time.Time{},
+			EndTime:      time.Time{},
+			Participants: []string{"someParticipant"},
+		},
+		&events.AppSessionChunk{
+			Metadata: events.Metadata{
+				ID: "someID5",
+			},
+			UserMetadata: events.UserMetadata{
+				User: "someUser",
+			},
+			AppMetadata: events.AppMetadata{
+				AppName: "someApp",
+			},
+			SessionChunkID: "someChunkID",
 		},
 	}
 	var buf bytes.Buffer
@@ -5599,7 +5823,12 @@ func TestMakeProfileInfo_NoInternalLogins(t *testing.T) {
 }
 
 func TestBenchmarkPostgres(t *testing.T) {
-	t.Parallel()
+	// Set insecure mode to allow db agent to establish reverse tunnel.
+	isInsecure := lib.IsInsecureDevMode()
+	lib.SetInsecureDevMode(true)
+	t.Cleanup(func() {
+		lib.SetInsecureDevMode(isInsecure)
+	})
 
 	// Canceling the context right after the test ensures the local proxy
 	// started by the benchmark command is closed and the remaining connections
@@ -5615,8 +5844,8 @@ func TestBenchmarkPostgres(t *testing.T) {
 	alice.SetDatabaseNames([]string{"*"})
 	alice.SetRoles([]string{"access"})
 
-	authProcess := testserver.MakeTestServer(
-		t,
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
 		testserver.WithBootstrap(connector, alice),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -5635,6 +5864,11 @@ func TestBenchmarkPostgres(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -5648,7 +5882,7 @@ func TestBenchmarkPostgres(t *testing.T) {
 	}, setHomePath(tmpHomePath), setMockSSOLogin(authServer, alice, connector.GetName()))
 	require.NoError(t, err)
 
-	benchmarkErrorLineParser := regexp.MustCompile("`host=(.+) +user=(.+) database=(.+)`: (.+)$")
+	benchmarkErrorLineParser := regexp.MustCompile("`host=(.+?) +user=(.+?) database=(.+?)`: (.+)$")
 	args := []string{
 		"bench", "postgres", "--insecure",
 		// Benchmark options to limit benchmark to a single execution.
@@ -5667,16 +5901,16 @@ func TestBenchmarkPostgres(t *testing.T) {
 		"connect to database": {
 			database:            "postgres-local",
 			additionalFlags:     []string{"--db-user", "username", "--db-name", "database"},
-			expectedErrContains: "server error",
+			expectedErrContains: "lookup external-pg",
 			// When connecting to Teleport databases, it will use a local proxy.
 			expectedHost:     "127.0.0.1",
 			expectedUser:     "username",
 			expectedDatabase: "database",
 		},
 		"direct connection": {
-			database:            "postgres://direct_user@test:5432/direct_database",
-			expectedErrContains: "hostname resolving error",
-			expectedHost:        "test",
+			database:            "postgres://direct_user@direct-pg:5432/direct_database",
+			expectedErrContains: "lookup direct-pg",
+			expectedHost:        "direct-pg",
 			expectedUser:        "direct_user",
 			expectedDatabase:    "direct_database",
 		},
@@ -5737,8 +5971,8 @@ func TestBenchmarkMySQL(t *testing.T) {
 	alice.SetDatabaseNames([]string{"*"})
 	alice.SetRoles([]string{"access"})
 
-	authProcess := testserver.MakeTestServer(
-		t,
+	authProcess, err := testserver.NewTeleportProcess(
+		t.TempDir(),
 		testserver.WithBootstrap(connector, alice),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -5757,6 +5991,11 @@ func TestBenchmarkMySQL(t *testing.T) {
 			}
 		}),
 	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, authProcess.Close())
+		require.NoError(t, authProcess.Wait())
+	})
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -5872,6 +6111,17 @@ func TestLogout(t *testing.T) {
 				require.NoError(t, os.Remove(privKeyPath))
 			},
 		},
+		{
+			name: "TLS cert is present but SSH cert is missing",
+			modifyKeyDir: func(t *testing.T, homePath string) {
+				tlsCertPath := keypaths.TLSCertPath(homePath, clientKeyRing.ProxyHost, clientKeyRing.Username)
+				err := os.WriteFile(tlsCertPath, []byte(fixtures.TLSCACertPEM), 0o600)
+				require.NoError(t, err)
+				sshCertPath := keypaths.SSHCertPath(homePath, clientKeyRing.ProxyHost, clientKeyRing.Username, clientKeyRing.ClusterName)
+				_, err = os.ReadFile(sshCertPath)
+				require.ErrorIs(t, err, os.ErrNotExist)
+			},
+		},
 		{
 			name: "TLS private key missing",
 			modifyKeyDir: func(t *testing.T, homePath string) {
@@ -5892,6 +6142,13 @@ func TestLogout(t *testing.T) {
 				require.NoError(t, err)
 			},
 		},
+		{
+			name: "current profile missing",
+			modifyKeyDir: func(t *testing.T, homePath string) {
+				currentProfileFilePath := keypaths.CurrentProfileFilePath(homePath)
+				require.NoError(t, os.Remove(currentProfileFilePath))
+			},
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
@@ -6076,7 +6333,7 @@ func TestListingResourcesAcrossClusters(t *testing.T) {
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname("node01"),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 		testserver.WithDebugApp(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			// Enable DB
@@ -6090,12 +6347,17 @@ func TestListingResourcesAcrossClusters(t *testing.T) {
 			}
 		}),
 	}
-	rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 
 	leafServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname("node02"),
-		testserver.WithClusterName(t, "leaf"),
+		testserver.WithClusterName("leaf"),
 		testserver.WithDebugApp(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			// Enable DB
@@ -6109,8 +6371,13 @@ func TestListingResourcesAcrossClusters(t *testing.T) {
 			}
 		}),
 	}
-	leafServer := testserver.MakeTestServer(t, leafServerOpts...)
-	testserver.SetupTrustedCluster(ctx, t, rootServer, leafServer)
+	leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, leafServer.Close())
+		require.NoError(t, leafServer.Wait())
+	})
+	SetupTrustedCluster(ctx, t, rootServer, leafServer)
 
 	var (
 		rootNode, leafNode *types.ServerV2
@@ -6438,6 +6705,33 @@ func testListingResources[T any](t *testing.T, pack listPack[T], unmarshalFunc f
 	}
 }
 
+func TestStatusPrintsProfilesIfNoActiveProfile(t *testing.T) {
+	t.Parallel()
+
+	buf := bytes.NewBuffer([]byte{})
+
+	err := Run(context.Background(), []string{
+		"status",
+	}, setHomePath(t.TempDir()), func(c *CLIConf) error {
+		c.OverrideStdout = buf
+		profile := &profile.Profile{
+			WebProxyAddr: "proxy:3080",
+			Username:     "testuser",
+		}
+		// setCurrent is false, so there is no active profile.
+		err := c.getClientStore().SaveProfile(profile, false)
+		require.NoError(t, err)
+		return nil
+	})
+
+	require.Contains(t, buf.String(),
+		` Profile URL:        https://proxy:3080
+  Logged in as:       testuser
+  Cluster:            proxy`)
+	require.True(t, trace.IsNotFound(err))
+	require.ErrorContains(t, err, "No active profile.")
+}
+
 // TestProxyTemplates verifies proxy templates apply properly to client config.
 func TestProxyTemplatesMakeClient(t *testing.T) {
 	t.Parallel()
@@ -6616,7 +6910,7 @@ func TestRolesToString(t *testing.T) {
 // TestResolve tests that host resolution works for various inputs and
 // that proxy templates are respected.
 func TestResolve(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
@@ -6640,7 +6934,7 @@ func TestResolve(t *testing.T) {
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname(sshHostname),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 		testserver.WithSSHPublicAddrs("127.0.0.1:0"),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = true
@@ -6652,9 +6946,14 @@ func TestResolve(t *testing.T) {
 			}
 		}),
 	}
-	rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 
-	node := testserver.MakeTestServer(t,
+	node, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses())
 			cfg.Hostname = "second-node"
@@ -6667,6 +6966,11 @@ func TestResolve(t *testing.T) {
 				"env":    "dev",
 			}
 		}))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, node.Close())
+		require.NoError(t, node.Wait())
+	})
 
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
@@ -6908,7 +7212,7 @@ func TestVersionCompatibilityFlags(t *testing.T) {
 // TestSCP validates that tsh scp correctly copy file content while also
 // ensuring that proxy templates are respected.
 func TestSCP(t *testing.T) {
-	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
@@ -6932,7 +7236,7 @@ func TestSCP(t *testing.T) {
 	rootServerOpts := []testserver.TestServerOptFunc{
 		testserver.WithBootstrap(connector, accessUser),
 		testserver.WithHostname(sshHostname),
-		testserver.WithClusterName(t, "root"),
+		testserver.WithClusterName("root"),
 		testserver.WithSSHPublicAddrs("127.0.0.1:0"),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = true
@@ -6944,13 +7248,19 @@ func TestSCP(t *testing.T) {
 			}
 		}),
 	}
-	rootServer := testserver.MakeTestServer(t, rootServerOpts...)
+	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
 
 	// Create a second server to test ambiguous matching.
-	testserver.MakeTestServer(t,
+	const secondServerHostname = "second-node"
+	server, err := testserver.NewTeleportProcess(t.TempDir(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses())
-			cfg.Hostname = "second-node"
+			cfg.Hostname = secondServerHostname
 			cfg.Auth.Enabled = false
 			cfg.Proxy.Enabled = false
 			cfg.SSH.Enabled = true
@@ -6960,6 +7270,11 @@ func TestSCP(t *testing.T) {
 				"env":    "dev",
 			}
 		}))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, server.Close())
+		require.NoError(t, server.Wait())
+	})
 
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
@@ -7142,6 +7457,42 @@ func TestSCP(t *testing.T) {
 				filepath.Base(sourceFile2): expectedFile2,
 			},
 		},
+		{
+			name:   "two hosts without templates",
+			source: []string{sshHostname + ":" + sourceFile1},
+			destination: func(t *testing.T, dir string) string {
+				createFile(t, dir, targetFile1)
+				return secondServerHostname + ":" + filepath.Join(dir, targetFile1)
+			},
+			assertion: require.NoError,
+			expected: map[string][]byte{
+				targetFile1: expectedFile1,
+			},
+		},
+		{
+			name:   "two hosts with templates",
+			source: []string{"shark.example.com:" + sourceFile1},
+			destination: func(t *testing.T, dir string) string {
+				createFile(t, dir, targetFile1)
+				return "2.3.4.5:" + filepath.Join(dir, targetFile1)
+			},
+			assertion: require.NoError,
+			expected: map[string][]byte{
+				targetFile1: expectedFile1,
+			},
+		},
+		{
+			name:   "two hosts, one no matching host",
+			source: []string{"2.3.4.5:" + sourceFile1},
+			destination: func(t *testing.T, dir string) string {
+				createFile(t, dir, targetFile1)
+				return "asdf.example.com:" + filepath.Join(dir, targetFile1)
+			},
+			assertion: func(tt require.TestingT, err error, i ...any) {
+				require.Error(tt, err, i...)
+				require.ErrorContains(tt, err, "no matching hosts", i...)
+			},
+		},
 	}
 
 	for _, test := range tests {
@@ -7456,3 +7807,241 @@ func prepareCLIOptionForReadingLoggingOpts() (func(t *testing.T) loggingOpts, Cl
 
 	return mustReadLoggingOpts, setLoggingOptsFromCLIConf
 }
+
+func TestSSHForkAfterAuthentication(t *testing.T) {
+	u, err := user.Current()
+	require.NoError(t, err)
+
+	// Create resources.
+	accessRole, err := types.NewRole("node-access", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			NodeLabels: types.Labels{
+				types.Wildcard: []string{types.Wildcard},
+			},
+			Logins: []string{u.Username},
+		},
+	})
+	require.NoError(t, err)
+	connector := mockConnector(t)
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetRoles([]string{accessRole.GetName()})
+
+	tsrv, err := testserver.NewTeleportProcess(t.TempDir(),
+		testserver.WithSSHLabel("foo", "bar"),
+		testserver.WithBootstrap(connector, accessRole, alice),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, tsrv.Close())
+		require.NoError(t, tsrv.Wait())
+	})
+	t.Cleanup(func() { require.NoError(t, tsrv.Close()) })
+	// We don't need a real second node for multi-node exec, tsh ssh should fail before that.
+	fakeNode, err := types.NewNode("fake", types.SubKindTeleportNode, types.ServerSpecV2{}, map[string]string{"foo": "bar"})
+	require.NoError(t, err)
+	_, err = tsrv.GetAuthServer().UpsertNode(t.Context(), fakeNode)
+	require.NoError(t, err)
+
+	// Use env var instead of homedir mock to preserve across the re-exec.
+	tmpHomeDir := filepath.Join(t.TempDir(), ".tsh")
+	t.Setenv(types.HomeEnvVar, tmpHomeDir)
+	proxyAddr, err := tsrv.ProxyWebAddr()
+	require.NoError(t, err)
+
+	err = Run(t.Context(), []string{
+		"login",
+		"--insecure",
+		"--proxy", proxyAddr.Addr,
+	}, setMockSSOLogin(tsrv.GetAuthServer(), alice, connector.GetName()))
+	require.NoError(t, err)
+
+	tests := []struct {
+		name                string
+		target              string
+		command             []string
+		assertRun           assert.ErrorAssertionFunc
+		assertCommandEffect func(t *testing.T, testFile string) bool
+	}{
+		{
+			name:      "ok",
+			target:    tsrv.Config.Hostname,
+			command:   []string{"echo", "hello", ">", "test.txt"},
+			assertRun: assert.NoError,
+			assertCommandEffect: func(t *testing.T, testFile string) bool {
+				return assert.EventuallyWithT(t, func(collect *assert.CollectT) {
+					assert.FileExists(collect, testFile)
+				}, 3*time.Second, 100*time.Millisecond)
+			},
+		},
+		{
+			name:      "stdin is closed after disowning",
+			target:    tsrv.Config.Hostname,
+			command:   []string{"read", "&&", "echo", "should not happen", ">", "test.txt"},
+			assertRun: assert.NoError,
+			assertCommandEffect: func(t *testing.T, testFile string) bool {
+				return assert.Never(t, func() bool {
+					_, err := os.Stat(testFile)
+					return !errors.Is(err, os.ErrNotExist)
+				}, 3*time.Second, time.Second)
+			},
+		},
+		{
+			name:      "not allowed on multiple nodes",
+			target:    "foo=bar",
+			command:   []string{"echo", "hello", ">", "test.txt"},
+			assertRun: assert.Error,
+		},
+		{
+			name:      "not allowed for interactive commands",
+			target:    tsrv.Config.Hostname,
+			command:   []string{},
+			assertRun: assert.Error,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			// Configure command with a real file path.
+			testFile := filepath.Join(t.TempDir(), "test.txt")
+			cmd := make([]string, 0, len(tc.command))
+			for _, arg := range tc.command {
+				cmd = append(cmd, strings.ReplaceAll(arg, "test.txt", testFile))
+			}
+
+			err := Run(t.Context(), append([]string{
+				"ssh",
+				"--insecure",
+				"-f",
+				u.Username + "@" + tc.target,
+			}, cmd...))
+			tc.assertRun(t, err)
+			if tc.assertCommandEffect != nil {
+				tc.assertCommandEffect(t, testFile)
+			}
+		})
+	}
+}
+
+func Test_humanFriendlyValidUntilDuration(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	tests := []struct {
+		name   string
+		input  time.Time
+		expect string
+	}{
+		{
+			name:   "expired",
+			input:  clock.Now().Add(-time.Minute),
+			expect: "EXPIRED",
+		},
+		{
+			name:   "less than one minute",
+			input:  clock.Now().Add(time.Second * 30),
+			expect: "valid for <1m",
+		},
+		{
+			name:   "truncate",
+			input:  clock.Now().Add(time.Minute*5 + time.Second*50),
+			expect: "valid for 5m",
+		},
+		{
+			name:   "hours",
+			input:  clock.Now().Add(time.Hour*12 + time.Minute*34 + time.Second*10),
+			expect: "valid for 12h34m",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := humanFriendlyValidUntilDuration(test.input, clock)
+			require.Equal(t, test.expect, actual)
+		})
+	}
+}
+
+func TestDebugVersionOutput(t *testing.T) {
+	t.Setenv(tshBinMainTestEnv, "1")
+	testExecutable, err := os.Executable()
+	require.NoError(t, err)
+
+	output, err := exec.Command(testExecutable, "logout", "--debug").CombinedOutput()
+	require.NoError(t, err)
+
+	vers := []string{
+		teleport.Version,
+		teleport.Gitref,
+		runtime.Version(),
+	}
+
+	require.Contains(t, string(output), "Initializing tsh version")
+	for _, v := range vers {
+		require.Contains(t, string(output), v)
+	}
+}
+
+func TestLogoutOneIdentity(t *testing.T) {
+	tmpHomePath := t.TempDir()
+	connector := mockConnector(t)
+
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetRoles([]string{"access"})
+
+	rootServer, err := testserver.NewTeleportProcess(
+		t.TempDir(),
+		testserver.WithBootstrap(connector, alice))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, rootServer.Close())
+		require.NoError(t, rootServer.Wait())
+	})
+
+	authServer := rootServer.GetAuthServer()
+	require.NotNil(t, authServer)
+	proxyAddr, err := rootServer.ProxyWebAddr()
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		command []string
+		envMap  map[string]string
+	}{
+		{
+			name:    "--proxy flag set",
+			command: []string{"logout", "--proxy", proxyAddr.String()},
+		},
+		{
+			name:    "TELEPORT_PROXY set",
+			command: []string{"logout"},
+			envMap: map[string]string{
+				proxyEnvVar: proxyAddr.String(),
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			for k, v := range tc.envMap {
+				t.Setenv(k, v)
+			}
+
+			err = Run(context.Background(), []string{
+				"login",
+				"--insecure",
+				"--proxy", proxyAddr.String()},
+				setHomePath(tmpHomePath),
+				setMockSSOLogin(authServer, alice, connector.GetName()))
+			require.NoError(t, err)
+
+			buf := bytes.NewBuffer([]byte{})
+			err := Run(context.Background(), tc.command,
+				setHomePath(tmpHomePath),
+				func(cf *CLIConf) error {
+					cf.OverrideStdout = buf
+					return nil
+				})
+			require.NoError(t, err)
+			require.Contains(t, buf.String(), fmt.Sprintf("Logged out %v from %v.\n", alice.GetName(), proxyAddr.Host()))
+		})
+	}
+}
diff --git a/tool/tsh/common/vnet.go b/tool/tsh/common/vnet.go
index 5d01ff4e67ae0..256e9cf3a832e 100644
--- a/tool/tsh/common/vnet.go
+++ b/tool/tsh/common/vnet.go
@@ -23,6 +23,7 @@ import (
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/lib/vnet"
 )
 
@@ -77,6 +78,22 @@ func (c *vnetCommand) run(cf *CLIConf) error {
 	return trace.Wrap(vnetProcess.Wait())
 }
 
+type vnetSSHAutoConfigCommand struct {
+	*kingpin.CmdClause
+}
+
+func newVnetSSHAutoConfigCommand(app *kingpin.Application) *vnetSSHAutoConfigCommand {
+	cmd := &vnetSSHAutoConfigCommand{
+		CmdClause: app.Command("vnet-ssh-autoconfig", "Automatically include VNet's generated OpenSSH-compatible config file in ~/.ssh/config."),
+	}
+	return cmd
+}
+
+func (c *vnetSSHAutoConfigCommand) run(cf *CLIConf) error {
+	err := vnet.AutoConfigureOpenSSH(cf.Context, profile.FullProfilePath(cf.HomePath))
+	return trace.Wrap(err)
+}
+
 func newVnetAdminSetupCommand(app *kingpin.Application) vnetCLICommand {
 	return newPlatformVnetAdminSetupCommand(app)
 }
@@ -104,6 +121,7 @@ type vnetCommandNotSupported struct{}
 func (vnetCommandNotSupported) FullCommand() string {
 	return ""
 }
+
 func (vnetCommandNotSupported) run(*CLIConf) error {
 	panic("vnetCommandNotSupported.run should never be called, this is a bug")
 }
diff --git a/tool/tsh/common/vnet_client_application.go b/tool/tsh/common/vnet_client_application.go
index b9ee5c1ed4103..a4e8c9a87241f 100644
--- a/tool/tsh/common/vnet_client_application.go
+++ b/tool/tsh/common/vnet_client_application.go
@@ -100,6 +100,22 @@ func (p *vnetClientApplication) ReissueAppCert(ctx context.Context, appInfo *vne
 	return cert, trace.Wrap(err)
 }
 
+// UserTLSCert returns the user TLS certificate for the given profile.
+func (p *vnetClientApplication) UserTLSCert(ctx context.Context, profileName string) (tls.Certificate, error) {
+	profile, err := p.clientStore.GetProfile(profileName)
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err, "loading user profile %s", profileName)
+	}
+	tlsConfig, err := profile.TLSConfig()
+	if err != nil {
+		return tls.Certificate{}, trace.Wrap(err, "loading TLS config for profile")
+	}
+	if len(tlsConfig.Certificates) == 0 {
+		return tls.Certificate{}, trace.Errorf("user tls config has no certificates")
+	}
+	return tlsConfig.Certificates[0], nil
+}
+
 // GetDialOptions returns ALPN dial options for the profile.
 func (p *vnetClientApplication) GetDialOptions(ctx context.Context, profileName string) (*vnetv1.DialOptions, error) {
 	profile, err := p.clientStore.GetProfile(profileName)
@@ -111,18 +127,21 @@ func (p *vnetClientApplication) GetDialOptions(ctx context.Context, profileName
 		AlpnConnUpgradeRequired: profile.TLSRoutingConnUpgradeRequired,
 		InsecureSkipVerify:      p.cf.InsecureSkipVerify,
 	}
-	if dialOpts.AlpnConnUpgradeRequired {
-		dialOpts.RootClusterCaCertPool, err = p.getRootClusterCACertPoolPEM(ctx, profileName)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
+	dialOpts.RootClusterCaCertPool, err = p.getRootClusterCACertPoolPEM(ctx, profileName)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 	return dialOpts, nil
 }
 
-// OnNewConnection gets called before each VNet connection. It's a noop as tsh doesn't need to do
+// OnNewSSHSession gets called before each VNet SSH connection. It's a noop as
+// tsh doesn't need to do anything extra here.
+func (p *vnetClientApplication) OnNewSSHSession(ctx context.Context, profileName, rootClusterName string) {
+}
+
+// OnNewAppConnection gets called before each VNet app connection. It's a noop as tsh doesn't need to do
 // anything extra here.
-func (p *vnetClientApplication) OnNewConnection(_ context.Context, _ *vnetv1.AppKey) error {
+func (p *vnetClientApplication) OnNewAppConnection(_ context.Context, _ *vnetv1.AppKey) error {
 	return nil
 }
 
diff --git a/tool/tsh/common/vnet_daemon_darwin.go b/tool/tsh/common/vnet_daemon_darwin.go
index 69efccc050624..41d2668a43de6 100644
--- a/tool/tsh/common/vnet_daemon_darwin.go
+++ b/tool/tsh/common/vnet_daemon_darwin.go
@@ -61,7 +61,7 @@ func (c *vnetDaemonCommand) run(cf *CLIConf) error {
 		level = slog.LevelDebug
 	}
 
-	if err := utils.InitLogger(utils.LoggingForDaemon, level, utils.WithOSLog(subsystem)); err != nil {
+	if _, err := utils.InitLogger(utils.LoggingForDaemon, level, utils.WithOSLog(subsystem)); err != nil {
 		return trace.Wrap(err, "initializing logger")
 	}
 
diff --git a/tool/tsh/common/workload_identity.go b/tool/tsh/common/workload_identity.go
index 4727ec9bf9c78..681cbf4c5e144 100644
--- a/tool/tsh/common/workload_identity.go
+++ b/tool/tsh/common/workload_identity.go
@@ -38,7 +38,7 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 	"github.com/gravitational/teleport/lib/tbot/workloadidentity"
 )
 
@@ -96,7 +96,7 @@ func (c *issueX509Command) run(cf *CLIConf) error {
 	}
 	tc.AllowHeadless = true
 
-	selector := config.WorkloadIdentitySelector{}
+	selector := bot.WorkloadIdentitySelector{}
 	switch {
 	case c.nameSelector != "" && c.labelSelector != "":
 		return trace.BadParameter("cannot specify both name and label selectors")
@@ -157,6 +157,11 @@ func (c *issueX509Command) run(cf *CLIConf) error {
 			)
 		}
 
+		// Create directory if it does not exist.
+		if err := os.MkdirAll(c.outputDirectory, teleport.PrivateDirMode); err != nil {
+			return trace.Wrap(err, "creating output directory")
+		}
+
 		// Write private key
 		privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
 		if err != nil {
diff --git a/tool/tsh/common/workload_identity_test.go b/tool/tsh/common/workload_identity_test.go
index 948142e70fc5f..0561185f29d52 100644
--- a/tool/tsh/common/workload_identity_test.go
+++ b/tool/tsh/common/workload_identity_test.go
@@ -166,14 +166,14 @@ func TestWorkloadIdentityIssueX509(t *testing.T) {
 	}, time.Second*5, 100*time.Millisecond)
 
 	homeDir, _ := mustLoginLegacy(t, s)
-	temp := t.TempDir()
+	outDir := filepath.Join(t.TempDir(), "out")
 	err = Run(
 		ctx,
 		[]string{
 			"workload-identity",
 			"issue-x509",
 			"--insecure",
-			"--output", temp,
+			"--output", outDir,
 			"--credential-ttl", "10m",
 			"--name-selector", "my-workload-identity",
 		},
@@ -181,7 +181,7 @@ func TestWorkloadIdentityIssueX509(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	certPEM, err := os.ReadFile(filepath.Join(temp, "svid.pem"))
+	certPEM, err := os.ReadFile(filepath.Join(outDir, "svid.pem"))
 	require.NoError(t, err)
 	certs, err := tlsca.ParseCertificatePEMs(certPEM)
 	require.NoError(t, err)
@@ -191,7 +191,7 @@ func TestWorkloadIdentityIssueX509(t *testing.T) {
 	// Sanity check we generated an ECDSA public key (test suite uses
 	// balanced-v1 algorithm suite).
 	require.IsType(t, (*ecdsa.PublicKey)(nil), certs[0].PublicKey)
-	keyPEM, err := os.ReadFile(filepath.Join(temp, "svid_key.pem"))
+	keyPEM, err := os.ReadFile(filepath.Join(outDir, "svid_key.pem"))
 	require.NoError(t, err)
 	keyBlock, _ := pem.Decode(keyPEM)
 	privateKey, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
@@ -200,7 +200,7 @@ func TestWorkloadIdentityIssueX509(t *testing.T) {
 	require.Implements(t, (*crypto.Signer)(nil), privateKey)
 	require.Equal(t, certs[0].PublicKey, privateKey.(crypto.Signer).Public())
 
-	bundlePEM, err := os.ReadFile(filepath.Join(temp, "svid_bundle.pem"))
+	bundlePEM, err := os.ReadFile(filepath.Join(outDir, "svid_bundle.pem"))
 	require.NoError(t, err)
 	bundleBlock, _ := pem.Decode(bundlePEM)
 	_, err = x509.ParseCertificate(bundleBlock.Bytes)
diff --git a/tsconfig.base.json b/tsconfig.base.json
index a81723e3f9382..0acd410d53ad9 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -14,6 +14,7 @@
     "lib": ["dom", "dom.iterable", "esnext"],
     "jsx": "react-jsx",
     "strictBindCallApply": true,
+    "noImplicitThis": true,
     "noEmitHelpers": true,
     "resolveJsonModule": true,
     "skipLibCheck": true,
diff --git a/tsconfig.node.json b/tsconfig.node.json
index f6a4b6a620fa9..1ae9b1ec24717 100644
--- a/tsconfig.node.json
+++ b/tsconfig.node.json
@@ -6,11 +6,14 @@
     "target": "ESNext",
     "module": "ESNext",
     "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "skipLibCheck": true,
     "allowSyntheticDefaultImports": true
   },
   "include": [
     "e/web/**/*.mts",
     "web/**/*.mts",
+    "web/.storybook/*.mts",
     "web/packages/build/vite",
     "web/packages/teleterm/csp.ts"
   ]
diff --git a/version.mk b/version.mk
index c37997842db0d..c90518d03b7e6 100644
--- a/version.mk
+++ b/version.mk
@@ -21,7 +21,7 @@ setver: validate-semver helm-version tsh-version
 # The weird -i usage is to make the sed commands work the same on both Linux and Mac. Test on both platforms if you change it.
 .PHONY:helm-version
 helm-version:
-	for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \
+	for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator teleport-relay event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \
 		sed -i'.bak' -e "s_^\\.version:\ .*_.version: \\&version \"$${VERSION}\"_g" examples/chart/$${CHART}/Chart.yaml || exit 1; \
 		rm -f examples/chart/$${CHART}/Chart.yaml.bak; \
 	done
diff --git a/web/.storybook/main.mts b/web/.storybook/main.mts
new file mode 100644
index 0000000000000..dee81c7046b41
--- /dev/null
+++ b/web/.storybook/main.mts
@@ -0,0 +1,68 @@
+/*
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import type { StorybookConfig } from '@storybook/react-vite';
+
+const enterpriseTeleportExists = fs.existsSync(
+  path.join(__dirname, '/../../e/web')
+);
+
+function createStoriesPaths() {
+  const stories = ['../packages/**/*.story.@(ts|tsx|js|jsx)'];
+
+  // include enterprise stories if available (**/* pattern ignores dot dir names)
+  if (enterpriseTeleportExists) {
+    stories.unshift('../../e/web/**/*.story.@(ts|tsx|js|jsx)');
+  }
+
+  return stories;
+}
+
+const config: StorybookConfig = {
+  stories: createStoriesPaths(),
+  framework: {
+    name: '@storybook/react-vite',
+    options: { builder: { viteConfigPath: 'web/.storybook/vite.config.mts' } },
+  },
+  staticDirs: ['public'],
+  addons: [],
+  viteFinal(config) {
+    return {
+      ...config,
+      server: {
+        ...config.server,
+        allowedHosts: resolveAllowedHosts(),
+      },
+    };
+  },
+};
+
+function resolveAllowedHosts() {
+  if (process.env.VITE_HOST) {
+    const { hostname } = new URL(`https://${process.env.VITE_HOST}`);
+
+    return [hostname];
+  }
+
+  return [];
+}
+
+export default config;
diff --git a/web/.storybook/main.ts b/web/.storybook/main.ts
deleted file mode 100644
index 99296485babe9..0000000000000
--- a/web/.storybook/main.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-import type { StorybookConfig } from '@storybook/react-vite';
-
-const enterpriseTeleportExists = fs.existsSync(
-  path.join(__dirname, '/../../e/web')
-);
-
-function createStoriesPaths() {
-  const stories = ['../packages/**/*.story.@(ts|tsx|js|jsx)'];
-
-  // include enterprise stories if available (**/* pattern ignores dot dir names)
-  if (enterpriseTeleportExists) {
-    stories.unshift('../../e/web/**/*.story.@(ts|tsx|js|jsx)');
-  }
-
-  return stories;
-}
-
-const config: StorybookConfig = {
-  stories: createStoriesPaths(),
-  framework: {
-    name: '@storybook/react-vite',
-    options: { builder: { viteConfigPath: 'web/.storybook/vite.config.mts' } },
-  },
-  staticDirs: ['public'],
-  addons: [
-    '@storybook/addon-toolbars',
-    '@storybook/addon-controls',
-    '@storybook/addon-actions',
-  ],
-  viteFinal(config) {
-    return {
-      ...config,
-      server: {
-        ...config.server,
-        allowedHosts: resolveAllowedHosts(),
-      },
-    };
-  },
-};
-
-function resolveAllowedHosts() {
-  if (process.env.VITE_HOST) {
-    const { hostname } = new URL(`https://${process.env.VITE_HOST}`);
-
-    return [hostname];
-  }
-
-  return [];
-}
-
-export default config;
diff --git a/web/.storybook/preview.tsx b/web/.storybook/preview.tsx
index faaab63222bb5..f7414453a74b4 100644
--- a/web/.storybook/preview.tsx
+++ b/web/.storybook/preview.tsx
@@ -16,11 +16,12 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Preview } from '@storybook/react';
+import { Preview } from '@storybook/react-vite';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { http, HttpResponse } from 'msw';
 import { initialize, mswLoader } from 'msw-storybook-addon';
 import { ComponentType, PropsWithChildren } from 'react';
+import { sb } from 'storybook/test';
 
 import Box from '../packages/design/src/Box';
 import { bblpTheme, darkTheme, lightTheme } from '../packages/design/src/theme';
@@ -73,6 +74,8 @@ initialize(
   ]
 );
 
+sb.mock(import('../packages/teleport/src/services/recordings/metadata.ts'));
+
 history.init();
 
 Logger.init(new ConsoleService());
@@ -147,7 +150,12 @@ const preview: Preview = {
     controls: { expanded: true, disableSaveFromUI: true },
   },
   argTypes: { userContext: { table: { disable: true } } },
-  loaders: [mswLoader],
+  loaders: [
+    mswLoader,
+    () => {
+      queryClient.clear();
+    },
+  ],
   decorators: [
     (Story, meta) => (
       <QueryClientProvider client={queryClient}>
diff --git a/web/@types/static-files.d.ts b/web/@types/static-files.d.ts
index be8d1b844ba77..fe6a6637bc3ee 100644
--- a/web/@types/static-files.d.ts
+++ b/web/@types/static-files.d.ts
@@ -23,6 +23,11 @@ declare module '*.svg' {
   export default content;
 }
 
+declare module '*.svg?no-inline' {
+  const content: string;
+  export default content;
+}
+
 declare module '*.png' {
   const content: string;
   export default content;
diff --git a/web/README.md b/web/README.md
index e21b75e107c23..717c59330750d 100644
--- a/web/README.md
+++ b/web/README.md
@@ -28,10 +28,6 @@ pnpm install
 
 You will also need the following tools installed:
 * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-* The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required:
-  `curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh`
-* [`binaryen`](https://github.com/WebAssembly/binaryen) (which contains `wasm-opt`) is required to be installed manually
-    on linux aarch64 (64-bit ARM). You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
 To build the Teleport open source version
 
@@ -39,7 +35,12 @@ To build the Teleport open source version
 pnpm build-ui-oss
 ```
 
-The resulting output will be in the `webassets` folder.
+The resulting output will be in the `webassets` folder. By default, the webassets are compressed with Brotli. If you 
+want to disable this for faster local builds, set the environment variable `VITE_DISABLE_COMPRESSION` to any value:
+
+```
+VITE_DISABLE_COMPRESSION=1 pnpm build-ui-oss
+```
 
 ### Docker Build
 
diff --git a/web/__mocks__/react-markdown.js b/web/__mocks__/react-markdown.js
deleted file mode 100644
index 9bed155671a2c..0000000000000
--- a/web/__mocks__/react-markdown.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Manually mocks react-markdown for testing due to ES modules
-// https://jestjs.io/docs/manual-mocks
-function ReactMarkdown({ children }) {
-  return <>{children}</>;
-}
-
-export default ReactMarkdown;
diff --git a/web/packages/build/eslint.config.mjs b/web/packages/build/eslint.config.mjs
index 0f1c4c08106df..51ae18bd1b8eb 100644
--- a/web/packages/build/eslint.config.mjs
+++ b/web/packages/build/eslint.config.mjs
@@ -21,12 +21,43 @@ import jestPlugin from 'eslint-plugin-jest';
 import jestDomPlugin from 'eslint-plugin-jest-dom';
 import reactPlugin from 'eslint-plugin-react';
 import reactHooksPlugin from 'eslint-plugin-react-hooks';
+import storybook from 'eslint-plugin-storybook';
 import testingLibraryPlugin from 'eslint-plugin-testing-library';
 import unusedImportsPlugin from 'eslint-plugin-unused-imports';
 import globals from 'globals';
 import tseslint from 'typescript-eslint';
 
+const commonNoRestrictedImportsPaths = [
+  {
+    name: 'usehooks-ts',
+    importNames: ['useResizeObserver'],
+    message:
+      "Use 'useResizeObserver' from 'design/utils/useResizeObserver' instead.",
+  },
+  {
+    name: 'usehooks-ts',
+    importNames: ['useCopyToClipboard'],
+    message:
+      "Use 'copyToClipboard' from 'design/utils/copyToClipboard' instead.",
+  },
+];
+
 export default tseslint.config(
+  {
+    // Citing from the ESLint docs:
+    // https://eslint.org/docs/latest/use/configure/configuration-files#specifying-files-and-ignores
+    //
+    // "By default, ESLint lints files that match the patterns **/*.js, **/*.cjs, and **/*.mjs.
+    // Those files are always matched unless you explicitly exclude them using global ignores."
+    //
+    // "Configuration objects without files or ignores are automatically applied to any file that is
+    // matched by any other configuration object."
+    //
+    // Since no configs apply rules to jsx files specifically, we need to specify them manually.
+    // And just to be future-proof we specify other non-default extensions used in the project.
+    files: ['**/*.ts', '**/*.mts', '**/*.tsx', '**/*.jsx'],
+  },
+  { linterOptions: { reportUnusedDisableDirectives: 'error' } },
   {
     ignores: [
       '**/dist/**',
@@ -37,10 +68,14 @@ export default tseslint.config(
       // WASM generated files
       '**/ironrdp/pkg/**',
       'web/packages/teleterm/build',
+      // allows for eslint-plugin-storybook to also lint
+      // configuration files inside the .storybook folder
+      '!.storybook',
     ],
   },
   eslint.configs.recommended,
   ...tseslint.configs.recommended,
+  ...storybook.configs['flat/recommended'],
   reactPlugin.configs.flat.recommended,
   reactPlugin.configs.flat['jsx-runtime'],
   {
@@ -154,5 +189,90 @@ export default tseslint.config(
     rules: {
       '@typescript-eslint/no-require-imports': 'warn',
     },
+  },
+
+  /*
+   * Restricted imports
+   *
+   * If an import is caught by these rules, it means that the imported package needs to be moved
+   * elsewhere in the dependency tree.
+   * https://github.com/gravitational/teleport/issues/54872
+   */
+  {
+    files: ['web/packages/shared/**/*.{ts,tsx,js,jsx}'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['teleport/*', 'e-teleport/*', 'teleterm/*'],
+            },
+          ],
+          paths: commonNoRestrictedImportsPaths,
+        },
+      ],
+    },
+  },
+  {
+    files: ['web/packages/teleport/**/*.{ts,tsx,js,jsx}'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['e-teleport/*', 'teleterm/*'],
+            },
+          ],
+          paths: commonNoRestrictedImportsPaths,
+        },
+      ],
+    },
+  },
+  {
+    files: ['e/web/teleport/**/*.{ts,tsx,js,jsx}'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['teleterm/*'],
+            },
+          ],
+          paths: commonNoRestrictedImportsPaths,
+        },
+      ],
+    },
+  },
+  {
+    files: ['web/packages/teleterm/**/*.{ts,tsx,js,jsx}'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['teleport/*', 'e-teleport/*'],
+            },
+          ],
+          paths: commonNoRestrictedImportsPaths,
+        },
+      ],
+    },
+  },
+
+  {
+    // Anything but the packages which have more specific patterns written out above.
+    files: ['web/packages/!(teleterm|teleport|shared)/**/*.{ts,tsx,js,jsx}'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          paths: commonNoRestrictedImportsPaths,
+        },
+      ],
+    },
   }
 );
diff --git a/web/packages/build/jest/config.js b/web/packages/build/jest/config.js
index 8cfab8d09bdb2..fd729e145bcb3 100644
--- a/web/packages/build/jest/config.js
+++ b/web/packages/build/jest/config.js
@@ -23,7 +23,10 @@ module.exports = {
   moduleNameMapper: {
     // mock all imports to asset files
     '\\.(css|scss|stylesheet)$': path.join(__dirname, 'mockStyles.js'),
-    '\\.(png|svg|yaml|yaml\\?raw)$': path.join(__dirname, 'mockFiles.js'),
+    '\\.(png|svg|svg\\?no-inline|yaml|yaml\\?raw)$': path.join(
+      __dirname,
+      'mockFiles.js'
+    ),
     '^shared/(.*)$': '<rootDir>/web/packages/shared/$1',
     '^design($|/.*)': '<rootDir>/web/packages/design/src/$1',
     '^teleport($|/.*)': '<rootDir>/web/packages/teleport/src/$1',
diff --git a/web/packages/build/jest/jest-environment-patched-jsdom.js b/web/packages/build/jest/jest-environment-patched-jsdom.js
index cf8505da1c6c7..f479624e114e1 100644
--- a/web/packages/build/jest/jest-environment-patched-jsdom.js
+++ b/web/packages/build/jest/jest-environment-patched-jsdom.js
@@ -36,6 +36,12 @@ export default class PatchedJSDOMEnvironment extends JSDOMEnvironment {
       global.Element.prototype.scrollIntoView = () => {};
     }
 
+    // TODO(ryanclark): Remove this once JSDOM provides scrollTo.
+    // https://github.com/jsdom/jsdom/issues/2751
+    if (!global.Element.prototype.scrollTo) {
+      global.Element.prototype.scrollTo = () => {};
+    }
+
     // TODO(gzdunek): Remove this once JSDOM provides matchMedia.
     // https://github.com/jsdom/jsdom/issues/3522
     if (!global.matchMedia) {
diff --git a/web/packages/build/jest/jest.d.ts b/web/packages/build/jest/jest.d.ts
index 5d6a9cfeb8793..22d3c094cd110 100644
--- a/web/packages/build/jest/jest.d.ts
+++ b/web/packages/build/jest/jest.d.ts
@@ -18,7 +18,6 @@
 
 // Ignore no-empty-interface in order to explicitly follow the types from Jest docs.
 // Otherwise ESLint would autofix them.
-/* eslint-disable @typescript-eslint/no-empty-interface */
 
 // https://jestjs.io/docs/27.x/expect#expectextendmatchers
 // https://redd.one/blog/practical-guide-to-custom-jest-matchers
diff --git a/web/packages/build/package.json b/web/packages/build/package.json
index 3e4d12346069d..9255560d43298 100644
--- a/web/packages/build/package.json
+++ b/web/packages/build/package.json
@@ -25,6 +25,7 @@
     "eslint-plugin-jest-dom": "^5.5.0",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^5.2.0",
+    "eslint-plugin-storybook": "^9.0.17",
     "eslint-plugin-testing-library": "^7.1.1",
     "eslint-plugin-unused-imports": "^4.1.4",
     "globals": "^16.0.0",
@@ -33,6 +34,7 @@
     "jsdom": "^26.1.0",
     "rollup-plugin-visualizer": "^5.14.0",
     "typescript-eslint": "^8.32.0",
+    "vite-plugin-compression": "^0.5.1",
     "vite-plugin-wasm": "^3.4.1",
     "vite-tsconfig-paths": "^5.1.4"
   }
diff --git a/web/packages/build/vite/config.ts b/web/packages/build/vite/config.ts
index dec8a64bb7581..36d129c5c2dff 100644
--- a/web/packages/build/vite/config.ts
+++ b/web/packages/build/vite/config.ts
@@ -21,6 +21,7 @@ import { resolve } from 'path';
 
 import { visualizer } from 'rollup-plugin-visualizer';
 import { defineConfig, type UserConfig } from 'vite';
+import compression from 'vite-plugin-compression';
 import wasm from 'vite-plugin-wasm';
 
 import { generateAppHashFile } from './apphash';
@@ -98,6 +99,18 @@ export function createViteConfig(
 
     if (mode === 'production') {
       config.base = '/web';
+
+      if (!process.env.VITE_DISABLE_COMPRESSION) {
+        config.plugins.push(
+          compression({
+            algorithm: 'brotliCompress',
+            deleteOriginFile: true,
+            filter: /\.(js|svg|wasm)$/,
+            threshold: 1024 * 10, // 10KB
+            verbose: false,
+          })
+        );
+      }
     } else {
       config.plugins.push(htmlPlugin(target));
       // siteName matches everything between the slashes.
@@ -127,13 +140,15 @@ export function createViteConfig(
           secure: false,
           ws: true,
         },
-        // /webapi/sites/:site/desktopplayback/:sid
-        '^\\/v[0-9]+\\/webapi\\/sites\\/(.*?)\\/desktopplayback\\/(.*?)': {
-          target: `wss://${target}`,
-          changeOrigin: false,
-          secure: false,
-          ws: true,
-        },
+        // /webapi/sites/:site/(desktopplayback|sessionrecording|ttyplayback)/:sid
+        '^(\\/v[0-9]+\\/webapi\\/sites\\/(.*?)\\/(desktopplayback|sessionrecording|ttyplayback)\\/(.*?))(\\/ws)?':
+          {
+            target: `wss://${target}`,
+            changeOrigin: true,
+            secure: false,
+            ws: true,
+            rewriteWsOrigin: true, // rewrite the origin so Teleport doesn't reject the connection
+          },
         '^\\/v[0-9]+\\/webapi\\/assistant\\/(.*?)': {
           target: `https://${target}`,
           changeOrigin: false,
diff --git a/web/packages/build/vite/gen-event-reference-config.mts b/web/packages/build/vite/gen-event-reference-config.mts
new file mode 100644
index 0000000000000..2fcba5fb97da4
--- /dev/null
+++ b/web/packages/build/vite/gen-event-reference-config.mts
@@ -0,0 +1,33 @@
+import path from 'node:path';
+
+import { defineConfig } from 'vite';
+
+import { tsconfigPathsPlugin } from './tsconfigPaths.mjs';
+
+const rootDirectory = path.resolve(
+  __dirname,
+  '../../teleport/src/services/audit/gen-event-reference'
+);
+const outputDirectory = path.resolve(
+  __dirname,
+  '../../teleport/src/services/audit/gen-event-reference/dist'
+);
+
+export default defineConfig(() => ({
+  plugins: [tsconfigPathsPlugin()],
+  build: {
+    outDir: outputDirectory,
+    minify: false,
+    cssMinify: false,
+    reportCompressedSize: false,
+    lib: {
+      name: 'gen-event-reference',
+      fileName: 'gen-event-reference',
+      entry: path.resolve(rootDirectory, 'index.ts'),
+      formats: ['cjs' as const],
+    },
+    rollupOptions: {
+      external: ['node:fs'],
+    },
+  },
+}));
diff --git a/web/packages/design/src/Alert/Alert.controls.story.tsx b/web/packages/design/src/Alert/Alert.controls.story.tsx
index de4ef503c9005..181f7721a3d35 100644
--- a/web/packages/design/src/Alert/Alert.controls.story.tsx
+++ b/web/packages/design/src/Alert/Alert.controls.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { Alert, AlertKind, AlertProps } from './Alert';
 
diff --git a/web/packages/design/src/Alert/Alert.story.tsx b/web/packages/design/src/Alert/Alert.story.tsx
index aaa83b3bafd00..61ec4c2348c50 100644
--- a/web/packages/design/src/Alert/Alert.story.tsx
+++ b/web/packages/design/src/Alert/Alert.story.tsx
@@ -16,11 +16,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { action } from '@storybook/addon-actions';
+import { action } from 'storybook/actions';
 
 import { Restore } from 'design/Icon';
 
-import { Box } from '..';
+import { Box, Flex, Text } from '..';
 import { Alert, AlertProps, Banner } from './Alert';
 
 export default {
@@ -40,6 +40,49 @@ export const Simple = () => (
   </Box>
 );
 
+export const Wrapping = () => (
+  <Box maxWidth="300px">
+    <Alert kind="neutral" wrapContents>
+      <Flex flexDirection="column" gap={1}>
+        <Text>Some neutral message</Text>
+        <Text typography="body2" bold={false}>
+          Some more information or extended description, which may be long
+          enough to wrap to multiple lines. Note how the icon stays aligned with
+          the top despite this.
+        </Text>
+      </Flex>
+    </Alert>
+    <Alert
+      kind="warning"
+      primaryAction={{ content: 'Okay', onClick: () => {} }}
+      wrapContents
+    >
+      <Flex flexDirection="column" gap={1}>
+        <Text>Some warning</Text>
+        <Text typography="body2" bold={false}>
+          This is a warning message with an action button. When the text wraps
+          here, the button should stay centre-aligned as well.
+        </Text>
+      </Flex>
+    </Alert>
+    <Alert
+      kind="danger"
+      primaryAction={{ content: 'Action', onClick: () => {} }}
+      wrapContents
+    >
+      Some error alert with an action
+    </Alert>
+    <Alert
+      kind="danger"
+      primaryAction={{ content: 'Action', onClick: () => {} }}
+      secondaryAction={{ content: 'Cancel', onClick: () => {} }}
+      wrapContents
+    >
+      Some error alert with two actions
+    </Alert>
+  </Box>
+);
+
 export const Actionable = () => (
   <Box maxWidth="700px">
     <Alert kind="neutral" {...commonProps}>
diff --git a/web/packages/design/src/Alert/Alert.test.tsx b/web/packages/design/src/Alert/Alert.test.tsx
index d5eedcf377f2b..b422f37003e67 100644
--- a/web/packages/design/src/Alert/Alert.test.tsx
+++ b/web/packages/design/src/Alert/Alert.test.tsx
@@ -16,6 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { createMemoryHistory } from 'history';
+import { MemoryRouter, Router } from 'react-router';
+
 import { render, screen, theme, userEvent } from 'design/utils/testing';
 
 import { Alert, Banner } from '.';
@@ -107,7 +110,7 @@ describe('Banner', () => {
     expect(primaryCallback).toHaveBeenCalled();
   });
 
-  test('action buttons as links', async () => {
+  test('action buttons as external links', async () => {
     render(
       <Banner
         primaryAction={{
@@ -125,9 +128,60 @@ describe('Banner', () => {
       'href',
       'https://goteleport.com/1'
     );
+    expect(screen.getByRole('link', { name: 'Primary Link' })).toHaveAttribute(
+      'target',
+      '_blank'
+    );
     expect(
       screen.getByRole('link', { name: 'Secondary Link' })
     ).toHaveAttribute('href', 'https://goteleport.com/2');
+    expect(
+      screen.getByRole('link', { name: 'Secondary Link' })
+    ).toHaveAttribute('target', '_blank');
+  });
+
+  test('action buttons as internal links', async () => {
+    const user = userEvent.setup();
+    const history = createMemoryHistory({
+      initialEntries: ['/'],
+    });
+    const push = jest.spyOn(history, 'push');
+
+    render(
+      <MemoryRouter>
+        <Router history={history}>
+          <Banner
+            primaryAction={{
+              content: 'Primary Link',
+              linkTo: 'primary-route',
+            }}
+            secondaryAction={{
+              content: 'Secondary Link',
+              linkTo: 'secondary-route',
+            }}
+          />
+        </Router>
+      </MemoryRouter>
+    );
+
+    expect(screen.getByRole('link', { name: 'Primary Link' })).toHaveAttribute(
+      'href',
+      '/primary-route'
+    );
+    expect(
+      screen.getByRole('link', { name: 'Primary Link' })
+    ).not.toHaveAttribute('target');
+    await user.click(screen.getByRole('link', { name: 'Primary Link' }));
+    expect(push).toHaveBeenCalledWith('primary-route');
+
+    expect(
+      screen.getByRole('link', { name: 'Secondary Link' })
+    ).toHaveAttribute('href', '/secondary-route');
+    expect(
+      screen.getByRole('link', { name: 'Secondary Link' })
+    ).not.toHaveAttribute('target');
+    await user.click(screen.getByRole('link', { name: 'Secondary Link' }));
+    expect(push).toHaveBeenCalledWith('secondary-route');
   });
 
   test('dismiss button', async () => {
diff --git a/web/packages/design/src/Alert/Alert.tsx b/web/packages/design/src/Alert/Alert.tsx
index aab553808134f..eb68afae4137c 100644
--- a/web/packages/design/src/Alert/Alert.tsx
+++ b/web/packages/design/src/Alert/Alert.tsx
@@ -17,6 +17,7 @@
  */
 
 import React, { useState } from 'react';
+import { Link } from 'react-router-dom';
 import styled, { useTheme } from 'styled-components';
 import { color, ColorProps, style } from 'styled-system';
 
@@ -137,16 +138,25 @@ interface Props<K> {
  */
 export interface Action {
   content: React.ReactNode;
+  /**
+   * a link that takes user out of the app (new tab)
+   */
   href?: string;
+  /**
+   * a link that takes you to a different route within the app
+   */
+  linkTo?: string;
   onClick?: (event: React.MouseEvent) => void;
 }
 
 export interface AlertProps
-  extends Props<AlertKind>,
-    SpaceProps,
-    WidthProps,
-    ColorProps {
+  extends Props<AlertKind>, SpaceProps, WidthProps, ColorProps {
   linkColor?: string;
+  /**
+   * If specified, the alert's contents will wrap for narrower screens
+   * or vertical layouts.
+   */
+  wrapContents?: boolean;
 }
 
 interface ThemedAlertProps extends AlertPropsWithRequiredKind {
@@ -180,6 +190,7 @@ export const Alert = ({
   bg,
   onDismiss,
   alignItems = 'center',
+  wrapContents = false,
   ...otherProps
 }: AlertProps) => {
   const alertIconSize = kind === 'neutral' ? 'large' : 'small';
@@ -196,8 +207,12 @@ export const Alert = ({
 
   return (
     <OuterContainer bg={bg} kind={kind} {...otherProps}>
-      <InnerContainer kind={kind} alignItems={alignItems}>
-        <IconContainer kind={kind}>
+      <InnerContainer
+        kind={kind}
+        alignItems={alignItems}
+        wrapContents={wrapContents}
+      >
+        <IconContainer kind={kind} wrapContents={wrapContents}>
           <StatusIcon
             kind={iconKind(kind)}
             customIcon={icon}
@@ -212,6 +227,7 @@ export const Alert = ({
             // Thanks to it, each error line is nicely indented with tab,
             //  instead od being treated as a one, long line.
             white-space: pre-wrap;
+            flex-shrink: ${wrapContents ? 0 : 1};
           `}
         >
           <Text typography="h3">{children}</Text>
@@ -224,6 +240,7 @@ export const Alert = ({
           dismissible={dismissible}
           dismissed={dismissed}
           onDismiss={onDismissClick}
+          wrapContents={wrapContents}
         />
       </InnerContainer>
     </OuterContainer>
@@ -253,13 +270,18 @@ const OuterContainer = styled.div<AlertPropsWithRequiredKind>`
 
 /** Renders a transparent color overlay. */
 const InnerContainer = styled.div<
-  Pick<WithRequired<AlertProps, 'kind' | 'alignItems'>, 'kind' | 'alignItems'>
+  Pick<
+    WithRequired<AlertProps, 'kind' | 'alignItems'>,
+    'kind' | 'alignItems' | 'wrapContents'
+  >
 >`
   padding: 12px 16px;
   overflow: auto;
   word-break: break-word;
   display: flex;
   align-items: ${p => p.alignItems};
+  gap: ${p => (p.wrapContents ? p.theme.space[3] : 0)}px;
+  flex-wrap: ${p => (p.wrapContents ? 'wrap' : 'initial')};
 
   ${backgroundColor}
 `;
@@ -307,10 +329,22 @@ const iconContainerStyles = ({
   }
 };
 
-const IconContainer = styled.div<{ kind: AlertKind }>`
+const IconContainer = styled.div<{ kind: AlertKind; wrapContents?: boolean }>`
   border-radius: 50%;
   line-height: 0;
-  margin-right: ${p => p.theme.space[3]}px;
+
+  ${p =>
+    p.wrapContents
+      ? `
+  align-self: flex-start;
+  margin-right: 0;
+  margin-top: ${p.theme.space[1]}px;
+  flex-shrink: 0;
+  flex-grow: 0;
+`
+      : `
+  margin-right: ${p.theme.space[3]}px;
+`}
 
   ${iconContainerStyles}
 `;
@@ -330,6 +364,7 @@ const ActionButtons = ({
   dismissible,
   dismissed,
   onDismiss,
+  wrapContents,
 }: {
   kind: AlertKind | BannerKind;
   primaryAction?: Action;
@@ -337,11 +372,16 @@ const ActionButtons = ({
   dismissible?: boolean;
   dismissed: boolean;
   onDismiss: () => void;
+  wrapContents?: boolean;
 }) => {
   if (!(primaryAction || secondaryAction || dismissible)) return;
 
   return (
-    <Flex ml={5} gap={2}>
+    <Flex
+      ml={wrapContents ? 7 : 5}
+      gap={2}
+      flexBasis={wrapContents ? '100%' : 'auto'}
+    >
       {primaryAction && (
         <ActionButton {...primaryButtonProps(kind)} action={primaryAction} />
       )}
@@ -363,7 +403,7 @@ const ActionButtons = ({
 
 /** Renders either a regular or a link button, depending on the action. */
 export const ActionButton = ({
-  action: { href, content, onClick },
+  action: { href, content, onClick, linkTo },
   fill,
   intent,
   inputAlignment = false,
@@ -376,33 +416,36 @@ export const ActionButton = ({
   inputAlignment?: boolean;
   disabled?: boolean;
   title?: string;
-}) =>
-  href ? (
-    <Button
-      as="a"
-      href={href}
-      target="_blank"
-      fill={fill}
-      intent={intent}
-      onClick={onClick}
-      inputAlignment={inputAlignment}
-      disabled={disabled}
-      title={title}
-    >
-      {content}
-    </Button>
-  ) : (
-    <Button
-      fill={fill}
-      intent={intent}
-      onClick={onClick}
-      inputAlignment={inputAlignment}
-      disabled={disabled}
-      title={title}
-    >
-      {content}
-    </Button>
-  );
+}) => {
+  const sharedProps = {
+    fill,
+    intent,
+    onClick,
+    disabled,
+    title,
+    // Prevent props being passed to underlying React element
+    // and removes "React does not recognize <field> on a DOM element"
+    // error.
+    $inputAlignment: inputAlignment,
+  };
+
+  if (href) {
+    return (
+      <Button {...sharedProps} as="a" href={href} target="_blank">
+        {content}
+      </Button>
+    );
+  }
+
+  if (linkTo) {
+    return (
+      <Button {...sharedProps} as={Link} to={linkTo}>
+        {content}
+      </Button>
+    );
+  }
+  return <Button {...sharedProps}>{content}</Button>;
+};
 
 export const Danger = (props: AlertProps) => <Alert kind="danger" {...props} />;
 export const Info = (props: AlertProps) => <Alert kind="info" {...props} />;
diff --git a/web/packages/design/src/Box/Box.tsx b/web/packages/design/src/Box/Box.tsx
index 8405e8a58643e..480c8f715bd30 100644
--- a/web/packages/design/src/Box/Box.tsx
+++ b/web/packages/design/src/Box/Box.tsx
@@ -17,10 +17,22 @@
  */
 
 import styled from 'styled-components';
+import {
+  fontFamily,
+  fontSize,
+  fontWeight,
+  position,
+  type FontFamilyProps,
+  type FontSizeProps,
+  type FontWeightProps,
+  type PositionProps,
+} from 'styled-system';
 
 import {
   alignSelf,
   AlignSelfProps,
+  background,
+  BackgroundProps,
   BorderProps,
   borders,
   BordersProps,
@@ -55,7 +67,8 @@ import {
 } from '../system';
 
 export interface BoxProps
-  extends MaxWidthProps,
+  extends
+    MaxWidthProps,
     MinWidthProps,
     SpaceProps,
     HeightProps,
@@ -71,7 +84,12 @@ export interface BoxProps
     BorderProps,
     BordersProps,
     BoxShadowProps,
-    OverflowProps {}
+    OverflowProps,
+    BackgroundProps,
+    FontFamilyProps,
+    FontSizeProps,
+    PositionProps,
+    FontWeightProps {}
 
 const Box = styled.div<BoxProps>`
   box-sizing: border-box;
@@ -91,6 +109,11 @@ const Box = styled.div<BoxProps>`
   ${borders}
   ${boxShadow}
   ${overflow}
+  ${background}
+  ${fontFamily}
+  ${fontSize}
+  ${position}
+  ${fontWeight}
 `;
 
 Box.displayName = 'Box';
diff --git a/web/packages/design/src/Button/Button.tsx b/web/packages/design/src/Button/Button.tsx
index 5347822c91521..adebda8c63b24 100644
--- a/web/packages/design/src/Button/Button.tsx
+++ b/web/packages/design/src/Button/Button.tsx
@@ -63,7 +63,7 @@ export type ButtonProps<E extends React.ElementType> =
        * size of input margins, thus allowing alignment between input text and
        * button labels.
        */
-      inputAlignment?: boolean;
+      $inputAlignment?: boolean;
 
       /**
        * If set to true, renders a button with the smallest horizontal paddings.
@@ -359,7 +359,7 @@ const horizontalPadding = <E extends React.ElementType>(
   if (props.compact) {
     return 4;
   }
-  if (props.inputAlignment) {
+  if (props.$inputAlignment) {
     return 16;
   }
   if (props.size === 'small') {
@@ -468,6 +468,9 @@ const StyledButton = styled.button.withConfig({
 export const ButtonPrimary = <E extends React.ElementType = 'button'>(
   props: ButtonProps<E>
 ) => <Button fill="filled" intent="primary" {...props} />;
+export const ButtonPrimaryBorder = <E extends React.ElementType = 'button'>(
+  props: ButtonProps<E>
+) => <Button fill="border" intent="primary" {...props} />;
 export const ButtonSecondary = <E extends React.ElementType = 'button'>(
   props: ButtonProps<E>
 ) => <Button fill="filled" intent="neutral" {...props} />;
diff --git a/web/packages/design/src/Button/buttons.story.tsx b/web/packages/design/src/Button/buttons.story.tsx
index e3c4e2cd16ea2..5320f1ab0dc44 100644
--- a/web/packages/design/src/Button/buttons.story.tsx
+++ b/web/packages/design/src/Button/buttons.story.tsx
@@ -26,6 +26,7 @@ import {
   ButtonBorder,
   ButtonFill,
   ButtonPrimary,
+  ButtonPrimaryBorder,
   ButtonProps,
   ButtonSecondary,
   ButtonText,
@@ -84,50 +85,58 @@ export const Buttons = () => {
             </Fragment>
           ))}
         </tbody>
-      </Table>{' '}
+      </Table>
+
       <Flex gap={3}>
         <ButtonPrimary>Primary</ButtonPrimary>
+        <ButtonPrimaryBorder>Primary (border)</ButtonPrimaryBorder>
         <ButtonSecondary>Secondary</ButtonSecondary>
         <ButtonBorder>Border</ButtonBorder>
         <ButtonWarning>Warning</ButtonWarning>
       </Flex>
+
       <Flex gap={3} alignItems="center">
         <Button size="extra-large">Extra large</Button>
         <Button size="large">Large</Button>
         <Button size="medium">Medium</Button>
         <Button size="small">Small</Button>
       </Flex>
+
       <Flex flexDirection="column" gap={3} alignItems="flex-start">
         <Input
           defaultValue="Padding of buttons below should match padding of this input"
           width="480px"
         />
-        <Button size="extra-large" inputAlignment>
+        <Button size="extra-large" $inputAlignment>
           Extra large with input alignment
         </Button>
-        <Button size="large" inputAlignment>
+        <Button size="large" $inputAlignment>
           Large with input alignment
         </Button>
-        <Button size="medium" inputAlignment>
+        <Button size="medium" $inputAlignment>
           Medium with input alignment
         </Button>
-        <Button size="small" inputAlignment>
+        <Button size="small" $inputAlignment>
           Small with input alignment
         </Button>
       </Flex>
+
       <Button block>block = true</Button>
+
       <Flex gap={3}>
         <Button disabled>Disabled</Button>
         <Box className="teleport-button__force-focus-visible">
           <Button>Focused</Button>
         </Box>
       </Flex>
+
       <Flex gap={3}>
         <ButtonPrimary gap={2}>
           <icons.AddUsers />
           Add users
         </ButtonPrimary>
       </Flex>
+
       <Flex gap={3} alignItems="center">
         <ButtonWithMenu
           text="Button with menu"
@@ -167,6 +176,27 @@ export const Buttons = () => {
           {menuItemsForButtonWithMenu}
         </ButtonWithMenu>
       </Flex>
+
+      <Stack gap={3}>
+        <ButtonWithMenu
+          text={`width={${constantWidth}}`}
+          width={constantWidth}
+          size="small"
+          onClick={() => alert('Button with menu')}
+        >
+          {menuItemsForButtonWithMenu}
+        </ButtonWithMenu>
+
+        <ButtonWithMenu
+          text={`buttonWidth={${constantWidth}}`}
+          buttonWidth={constantWidth}
+          size="small"
+          onClick={() => alert('Button with menu')}
+        >
+          {menuItemsForButtonWithMenu}
+        </ButtonWithMenu>
+      </Stack>
+
       <Flex gap={3}>
         <Button as="a" href="https://example.com" target="_blank">
           Link as button
@@ -181,10 +211,12 @@ export const Buttons = () => {
           <icons.Link />
         </ButtonIcon>
       </Flex>
+
       <Flex gap={3}>
         <ButtonLink href="">Button Link</ButtonLink>
         <ButtonText>Button Text</ButtonText>
       </Flex>
+
       <Flex gap={3} flexDirection="column" alignItems="flex-start">
         {[2, 1, 0].map(size => (
           <Flex gap={3} key={`size-${size}`}>
@@ -322,3 +354,5 @@ const Emphasis = styled.span`
   text-decoration-line: underline;
   text-decoration-color: red;
 `;
+
+const constantWidth = 150;
diff --git a/web/packages/design/src/Button/index.ts b/web/packages/design/src/Button/index.ts
index a184620e777bf..28f636f6a7b21 100644
--- a/web/packages/design/src/Button/index.ts
+++ b/web/packages/design/src/Button/index.ts
@@ -19,6 +19,7 @@
 export {
   Button,
   ButtonPrimary,
+  ButtonPrimaryBorder,
   ButtonWarning,
   ButtonSecondary,
   ButtonBorder,
diff --git a/web/packages/design/src/ButtonSelect/ButtonSelect.story.tsx b/web/packages/design/src/ButtonSelect/ButtonSelect.story.tsx
new file mode 100644
index 0000000000000..1155b6db356ac
--- /dev/null
+++ b/web/packages/design/src/ButtonSelect/ButtonSelect.story.tsx
@@ -0,0 +1,150 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryFn, StoryObj } from '@storybook/react-vite';
+import { action } from 'storybook/actions';
+import { useArgs } from 'storybook/preview-api';
+
+import Flex from 'design/Flex';
+import { H2 } from 'design/Text';
+
+import { ButtonSelect } from './ButtonSelect';
+
+const defaultArgs = {
+  fullWidth: false,
+  disabled: false,
+  onChange: action('onChange'),
+} as const;
+
+type StoryMeta = Meta<typeof ButtonSelect>;
+
+type Story = StoryObj<typeof ButtonSelect>;
+
+export default {
+  title: 'Design/ButtonSelect',
+  component: ButtonSelect,
+  argTypes: {
+    options: {
+      control: false,
+      description: 'Array of options to display in the button select',
+      table: {
+        type: {
+          summary:
+            '{ value: (string | number | bigint), label: string, disabled?: boolean, tooltip?: string }[]',
+        },
+      },
+    },
+    activeValue: {
+      control: false,
+      description: 'The value of the currently active option',
+      table: { type: { summary: 'string | number | bigint' } },
+    },
+    onChange: {
+      control: false,
+      description: 'Callback function called when the active button changes',
+      table: {
+        type: { summary: '(selectedValue: string | number | bigint) => void' },
+      },
+    },
+    fullWidth: {
+      control: { type: 'boolean' },
+      description:
+        'If true, the button select will take the full width of its container',
+      table: { defaultValue: { summary: 'false' } },
+    },
+    disabled: {
+      control: { type: 'boolean' },
+      description: 'If true, all options will be disabled',
+      table: { defaultValue: { summary: 'false' } },
+    },
+  },
+  args: defaultArgs,
+  render: (args => {
+    const [{ activeValue }, updateArgs] =
+      useArgs<NonNullable<StoryMeta['args']>>();
+    const onChange = (value: typeof activeValue) => {
+      value ??= args.options[0]?.value;
+      updateArgs({ activeValue: value });
+      args.onChange?.(value);
+    };
+
+    return (
+      <Flex flexDirection="column" gap={3} maxWidth="600px">
+        <ButtonSelect
+          {...args}
+          activeValue={activeValue ?? args.options[0]?.value}
+          onChange={onChange}
+        />
+        <H2>{`Active Value: ${activeValue ?? args.options[0]?.value}`}</H2>
+      </Flex>
+    );
+  }) satisfies StoryFn<typeof ButtonSelect>,
+} satisfies StoryMeta;
+
+const WithTwoOptions: Story = {
+  args: {
+    options: [
+      { value: '1', label: 'Option 1' },
+      { value: '2', label: 'Option 2' },
+    ],
+  },
+};
+
+const WithFourOptions: Story = {
+  args: {
+    options: [
+      { value: '1', label: 'Option 1' },
+      { value: '2', label: 'Option 2' },
+      { value: '3', label: 'Option 3' },
+      { value: '4', label: 'Option 4' },
+    ],
+  },
+};
+
+const WithDisabledOption: Story = {
+  args: {
+    options: [
+      { value: '1', label: 'Option 1' },
+      { value: '2', label: 'Option 2' },
+      {
+        value: '3',
+        label: 'Option 3',
+        disabled: true,
+        tooltip: 'Option 3 is disabled',
+      },
+      { value: '4', label: 'Option 4' },
+    ],
+  },
+};
+
+const WithNonStringValues: Story = {
+  args: {
+    options: [
+      { value: 1, label: 'Option 1' },
+      { value: 2, label: 'Option 2' },
+      { value: 3, label: 'Option 3' },
+    ],
+  },
+};
+
+export {
+  WithTwoOptions,
+  WithFourOptions,
+  WithDisabledOption,
+  WithNonStringValues,
+};
diff --git a/web/packages/design/src/ButtonSelect/ButtonSelect.test.tsx b/web/packages/design/src/ButtonSelect/ButtonSelect.test.tsx
new file mode 100644
index 0000000000000..02534e291b60a
--- /dev/null
+++ b/web/packages/design/src/ButtonSelect/ButtonSelect.test.tsx
@@ -0,0 +1,73 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { render, screen } from 'design/utils/testing';
+
+import { ButtonSelect } from './ButtonSelect';
+
+describe('ButtonSelect', () => {
+  const options = [
+    { value: '1', label: 'Option 1' },
+    { value: '2', label: 'Option 2' },
+    { value: '3', label: 'Option 3' },
+  ];
+  const activeValue = '1';
+
+  function renderButtonSelect() {
+    const onChange = jest.fn();
+    render(
+      <ButtonSelect
+        options={options}
+        activeValue={activeValue}
+        onChange={onChange}
+      />
+    );
+    return { buttons: screen.getAllByRole('button'), onChange };
+  }
+
+  it('renders buttons with correct labels', () => {
+    const { buttons } = renderButtonSelect();
+    expect(buttons).toHaveLength(options.length);
+    expect(buttons[0]).toHaveTextContent('Option 1');
+    expect(buttons[1]).toHaveTextContent('Option 2');
+    expect(buttons[2]).toHaveTextContent('Option 3');
+    expect(buttons[0]).toHaveAttribute('aria-label', 'Option 1');
+    expect(buttons[1]).toHaveAttribute('aria-label', 'Option 2');
+    expect(buttons[2]).toHaveAttribute('aria-label', 'Option 3');
+  });
+
+  it('applies data-active attribute correctly', () => {
+    const { buttons } = renderButtonSelect();
+    expect(buttons).toHaveLength(options.length);
+    expect(buttons[0]).toHaveAttribute('aria-checked', 'true');
+    expect(buttons[1]).toHaveAttribute('aria-checked', 'false');
+    expect(buttons[2]).toHaveAttribute('aria-checked', 'false');
+  });
+
+  it('calls onChange with the correct value when a button is clicked', () => {
+    const { buttons, onChange } = renderButtonSelect();
+    buttons[1].click();
+    expect(onChange).toHaveBeenCalledWith('2');
+  });
+
+  it('does not call onChange if the clicked button is already active', () => {
+    const { buttons, onChange } = renderButtonSelect();
+    buttons[0].click();
+    expect(onChange).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/packages/design/src/ButtonSelect/ButtonSelect.tsx b/web/packages/design/src/ButtonSelect/ButtonSelect.tsx
new file mode 100644
index 0000000000000..03e63d73133bf
--- /dev/null
+++ b/web/packages/design/src/ButtonSelect/ButtonSelect.tsx
@@ -0,0 +1,128 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import { Button } from 'design/Button';
+import Flex, { FlexProps } from 'design/Flex';
+import { HoverTooltip } from 'design/Tooltip';
+
+type OptionValue = string | number | bigint;
+
+type Option<T> = {
+  value: T;
+  label: string;
+  disabled?: boolean;
+  tooltip?: string;
+};
+
+type ButtonSelectProps<T extends readonly Option<OptionValue>[]> = {
+  options: T;
+  activeValue: T[number]['value'];
+  onChange: (selectedValue: T[number]['value']) => void;
+  fullWidth?: boolean;
+  disabled?: boolean;
+};
+
+/**
+ * ButtonSelect is a segmented button that allows users to select one of the provided options.
+ *
+ * Each option must have a unique `value` and a `label` that will be displayed on the button.
+ *
+ * @property options - The options to display in the button select. Each option should have a unique `value` and a `label` to display on the button.
+ * @property activeValue - The value of the currently active option.
+ * @property onChange - Callback function that is called when the active button changes. Receives the value of the newly selected button.
+ *
+ * @example
+ * const options = [
+ *   { value: '1', label: 'Option 1' },
+ *   { value: '2', label: 'Option 2' },
+ * ];
+ * const [activeValue, setActiveValue] = useState('1');
+ * return (
+ *   <ButtonSelect
+ *     options={options}
+ *     activeValue={activeValue}
+ *     onChange={setactiveValue}
+ *   />
+ * );
+ */
+export const ButtonSelect = <T extends readonly Option<OptionValue>[]>({
+  options,
+  activeValue,
+  onChange,
+  disabled = false,
+  fullWidth = false,
+}: ButtonSelectProps<T> & FlexProps) => {
+  const updateValue = (newValue: T[number]['value']) => {
+    if (activeValue !== newValue) {
+      onChange(newValue);
+    }
+  };
+
+  return (
+    <Wrapper $fullWidth={fullWidth}>
+      {options.map(option => {
+        const isActive = activeValue === option.value;
+        return (
+          <HoverTooltip tipContent={option.tooltip} key={option.label}>
+            <ButtonSelectButton
+              aria-label={option.label}
+              aria-checked={isActive}
+              onClick={() =>
+                !(option.disabled || disabled) && updateValue(option.value)
+              }
+              intent={isActive ? 'primary' : 'neutral'}
+              disabled={option.disabled || disabled}
+            >
+              {option.label}
+            </ButtonSelectButton>
+          </HoverTooltip>
+        );
+      })}
+    </Wrapper>
+  );
+};
+
+const Wrapper = styled(Flex)<{ $fullWidth?: boolean }>`
+  ${({ $fullWidth }) => !$fullWidth && 'width: min-content;'}
+  & > * {
+    min-width: fit-content;
+  }
+`;
+
+const ButtonSelectButton = styled(Button)`
+  flex: 1 1 0;
+  border-radius: 0px;
+
+  &:focus-visible {
+    border-radius: 0px;
+  }
+
+  &:first-child,
+  &:first-child:focus-visible {
+    border-top-left-radius: 4px;
+    border-bottom-left-radius: 4px;
+  }
+
+  &:last-child,
+  &:last-child:focus-visible {
+    border-top-right-radius: 4px;
+    border-bottom-right-radius: 4px;
+  }
+`;
diff --git a/web/packages/design/src/ButtonSelect/index.ts b/web/packages/design/src/ButtonSelect/index.ts
new file mode 100644
index 0000000000000..a28e72278ca19
--- /dev/null
+++ b/web/packages/design/src/ButtonSelect/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { ButtonSelect } from './ButtonSelect';
diff --git a/web/packages/design/src/ButtonWithMenu/ButtonWithMenu.tsx b/web/packages/design/src/ButtonWithMenu/ButtonWithMenu.tsx
index 6d53ae18947f7..b9a785dd6c409 100644
--- a/web/packages/design/src/ButtonWithMenu/ButtonWithMenu.tsx
+++ b/web/packages/design/src/ButtonWithMenu/ButtonWithMenu.tsx
@@ -60,6 +60,14 @@ export const ButtonWithMenu = <Element extends ElementType = 'button'>(
     MenuIcon?: ComponentType<IconProps>;
     size?: ButtonSize;
     forwardedAs?: Element;
+    /**
+     * Width of just the Button part of the component. Ignored if width is set.
+     */
+    buttonWidth?: ComponentPropsWithoutRef<typeof Flex>['width'];
+    /**
+     * Width of the whole component (Button + menu Button). buttonWidth is ignored if width is set.
+     */
+    width?: ComponentPropsWithoutRef<typeof Flex>['width'];
   } & ComponentPropsWithoutRef<typeof ButtonBorder<Element>>
 ) => {
   const {
@@ -67,6 +75,8 @@ export const ButtonWithMenu = <Element extends ElementType = 'button'>(
     MenuIcon = icons.MoreVert,
     children,
     size = 'medium',
+    width,
+    buttonWidth,
     ...buttonBorderProps
   } = props;
 
@@ -74,7 +84,7 @@ export const ButtonWithMenu = <Element extends ElementType = 'button'>(
   const [isOpen, setIsOpen] = useState(false);
 
   return (
-    <Flex>
+    <Flex width={width}>
       <ButtonBorder
         css={`
           border-top-right-radius: 0;
@@ -82,6 +92,7 @@ export const ButtonWithMenu = <Element extends ElementType = 'button'>(
         `}
         size={size}
         {...buttonBorderProps}
+        width={width ? '100%' : buttonWidth}
       >
         {text}
       </ButtonBorder>
diff --git a/web/packages/design/src/Checkbox/Checkbox.story.tsx b/web/packages/design/src/Checkbox/Checkbox.story.tsx
index 833520adf2f71..5950df7e4187b 100644
--- a/web/packages/design/src/Checkbox/Checkbox.story.tsx
+++ b/web/packages/design/src/Checkbox/Checkbox.story.tsx
@@ -85,7 +85,7 @@ export const Checkbox = () => (
         </td>
       </tr>
       <tr>
-        <th rowSpan={4}>Disabled</th>
+        <th rowSpan={3}>Disabled</th>
         <th>Default</th>
         <td>
           <CheckboxInput disabled />
@@ -118,6 +118,40 @@ export const Checkbox = () => (
           <CheckboxInput size="small" disabled checked />
         </td>
       </tr>
+      <tr>
+        <th rowSpan={3}>Read Only</th>
+        <th>Default</th>
+        <td>
+          <CheckboxInput readOnly />
+          <CheckboxInput readOnly checked />
+        </td>
+        <td>
+          <CheckboxInput size="small" readOnly />
+          <CheckboxInput size="small" readOnly checked />
+        </td>
+      </tr>
+      <tr className="teleport-checkbox__force-hover">
+        <th>Hover</th>
+        <td>
+          <CheckboxInput readOnly />
+          <CheckboxInput readOnly checked />
+        </td>
+        <td>
+          <CheckboxInput size="small" readOnly />
+          <CheckboxInput size="small" readOnly checked />
+        </td>
+      </tr>
+      <tr className="teleport-checkbox__force-active">
+        <th>Active</th>
+        <td>
+          <CheckboxInput readOnly />
+          <CheckboxInput readOnly checked />
+        </td>
+        <td>
+          <CheckboxInput size="small" readOnly />
+          <CheckboxInput size="small" readOnly checked />
+        </td>
+      </tr>
     </Table>
     <label>
       <CheckboxInput size="small" defaultChecked={false} /> Uncontrolled
diff --git a/web/packages/design/src/Checkbox/Checkbox.tsx b/web/packages/design/src/Checkbox/Checkbox.tsx
index 5616e8689dc1f..687f3ff839740 100644
--- a/web/packages/design/src/Checkbox/Checkbox.tsx
+++ b/web/packages/design/src/Checkbox/Checkbox.tsx
@@ -33,11 +33,15 @@ interface CheckboxInputProps {
   disabled?: boolean;
   id?: string;
   name?: string;
-  readOnly?: boolean;
   role?: string;
   type?: 'checkbox' | 'radio';
   value?: string;
 
+  // TODO: remove field.
+  // Checkbox does not have a readonly property
+  // and this field is equivalent to field "disabled".
+  readOnly?: boolean;
+
   // TODO(bl-nero): Support the "indeterminate" property.
 
   // Container properties
@@ -62,7 +66,12 @@ export const CheckboxInput = forwardRef<HTMLInputElement, CheckboxInputProps>(
             because we want to be able to use this component both with and
             without surrounding labels. Instead, we use absolute positioning and
             an actually rendered input with a custom appearance. */}
-          <CheckboxInternal ref={ref} cbSize={size} {...inputProps} />
+          <CheckboxInternal
+            ref={ref}
+            cbSize={size}
+            {...inputProps}
+            disabled={inputProps.disabled || inputProps.readOnly}
+          />
           <Checkmark />
         </InnerWrapper>
       </OuterWrapper>
diff --git a/web/packages/design/src/CollapsibleInfoSection/CollapsibleInfoSection.story.tsx b/web/packages/design/src/CollapsibleInfoSection/CollapsibleInfoSection.story.tsx
index d45ed204889a7..2991c626d1b63 100644
--- a/web/packages/design/src/CollapsibleInfoSection/CollapsibleInfoSection.story.tsx
+++ b/web/packages/design/src/CollapsibleInfoSection/CollapsibleInfoSection.story.tsx
@@ -16,8 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { action } from '@storybook/addon-actions';
-import { Meta, StoryFn, type StoryObj } from '@storybook/react';
+import { Meta, StoryFn, type StoryObj } from '@storybook/react-vite';
+import { action } from 'storybook/actions';
 import styled from 'styled-components';
 
 import { Flex, H2, Text } from 'design';
diff --git a/web/packages/design/src/DataTable/Cells.tsx b/web/packages/design/src/DataTable/Cells.tsx
index ed539043c39e1..98e2a983dc3ac 100644
--- a/web/packages/design/src/DataTable/Cells.tsx
+++ b/web/packages/design/src/DataTable/Cells.tsx
@@ -22,6 +22,7 @@ import { Theme } from 'design/theme';
 
 import { displayDate } from '../datetime';
 import Flex from '../Flex';
+import { makeLabelTag } from '../formatters';
 import * as Icons from '../Icon';
 import Label from '../Label';
 import {
@@ -129,7 +130,7 @@ export const ClickableLabelCell = ({
   onClick: (label: LabelDescription) => void;
 }) => {
   const $labels = labels.map((label, index) => {
-    const labelText = `${label.name}: ${label.value}`;
+    const labelText = makeLabelTag(label);
 
     return (
       <Label
diff --git a/web/packages/design/src/DataTable/InputSearch/InputSearch.test.tsx b/web/packages/design/src/DataTable/InputSearch/InputSearch.test.tsx
new file mode 100644
index 0000000000000..cadbe626dcb5c
--- /dev/null
+++ b/web/packages/design/src/DataTable/InputSearch/InputSearch.test.tsx
@@ -0,0 +1,67 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import { Providers, render, screen, userEvent } from 'design/utils/testing';
+
+import InputSearch from './InputSearch';
+
+describe('InputSearch', () => {
+  test('renders', async () => {
+    renderComponent({
+      searchValue: '',
+      setSearchValue: jest.fn(),
+    });
+
+    expect(screen.getByPlaceholderText('Search...')).toBeInTheDocument();
+  });
+
+  test('submits a search', async () => {
+    const setSearchValue = jest.fn();
+
+    const { user } = renderComponent({
+      searchValue: '',
+      setSearchValue,
+    });
+
+    const input = screen.getByPlaceholderText('Search...');
+    await user.click(input);
+    await user.paste('Lorem ipsum delor sit amet.');
+    await user.type(input, '{enter}');
+
+    expect(setSearchValue).toHaveBeenCalledTimes(1);
+    expect(setSearchValue).toHaveBeenLastCalledWith(
+      'Lorem ipsum delor sit amet.'
+    );
+  });
+});
+
+function renderComponent(props: ComponentProps<typeof InputSearch>) {
+  const user = userEvent.setup();
+  return {
+    ...render(<InputSearch {...props} />, { wrapper: makeWrapper() }),
+    user,
+  };
+}
+
+function makeWrapper() {
+  return (props: PropsWithChildren) => {
+    return <Providers>{props.children}</Providers>;
+  };
+}
diff --git a/web/packages/design/src/DataTable/InputSearch/InputSearch.tsx b/web/packages/design/src/DataTable/InputSearch/InputSearch.tsx
index 4708f19cc9969..d6b75f958fad0 100644
--- a/web/packages/design/src/DataTable/InputSearch/InputSearch.tsx
+++ b/web/packages/design/src/DataTable/InputSearch/InputSearch.tsx
@@ -37,6 +37,7 @@ export default function InputSearch({
   bigInputSize = false,
   autoFocus = false,
   placeholder = 'Search...',
+  isDisabled = false,
 }: Props) {
   function submitSearch(e: FormEvent<HTMLFormElement>) {
     e.preventDefault(); // prevent form default
@@ -57,10 +58,13 @@ export default function InputSearch({
           defaultValue={searchValue}
           name={searchInputName}
           autoFocus={autoFocus}
+          disabled={isDisabled}
         />
         <ChildWrapperBackground>
           <ChildWrapper>{children}</ChildWrapper>
         </ChildWrapperBackground>
+        {/* Required to submit a form with multiple inputs using keyboard [ENTER] */}
+        <input type="submit" style={{ display: 'none' }} />
       </Form>
     </WrapperBackground>
   );
@@ -73,6 +77,7 @@ type Props = {
   bigInputSize?: boolean;
   autoFocus?: boolean;
   placeholder?: string;
+  isDisabled?: boolean;
 };
 
 const ChildWrapper = styled.div`
diff --git a/web/packages/design/src/DataTable/Table.tsx b/web/packages/design/src/DataTable/Table.tsx
index 661193a45065b..3bfd0907c2eff 100644
--- a/web/packages/design/src/DataTable/Table.tsx
+++ b/web/packages/design/src/DataTable/Table.tsx
@@ -151,6 +151,15 @@ export default function Table<T>(props: TableProps<T>) {
       return <tbody>{rows}</tbody>;
     }
 
+    // if we provide infiniteScrollProps, we want to not render anything if
+    // the fetch status is loading. this is so that the existing items dont dissapear
+    // during the fetch, but also, we dont want the empty text to show while fetching
+    // and lastly, the infinite scroll page will usually provide its own loading
+    // indicator at the bottom of the component
+    if (props.infiniteScrollProps?.fetchStatus === 'loading') {
+      return <tbody></tbody>;
+    }
+
     return (
       <EmptyIndicator
         emptyText={emptyText}
@@ -349,7 +358,7 @@ function ServersideTable<T>({
   return (
     <>
       <StyledPanel>
-        {serversideProps?.serversideSearchPanel}
+        <Box width="100%">{serversideProps?.serversideSearchPanel}</Box>
         {(showTopPager || showBothPager) && (
           <ServerSidePager
             nextPage={nextPage}
diff --git a/web/packages/design/src/DataTable/sort.test.ts b/web/packages/design/src/DataTable/sort.test.ts
new file mode 100644
index 0000000000000..41783d0dc3bb2
--- /dev/null
+++ b/web/packages/design/src/DataTable/sort.test.ts
@@ -0,0 +1,50 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { formatSortType, parseSortType } from './sort';
+
+describe('parseSortType', () => {
+  it.each`
+    input               | expected
+    ${'name:asc'}       | ${{ fieldName: 'name', dir: 'ASC' }}
+    ${'name:desc'}      | ${{ fieldName: 'name', dir: 'DESC' }}
+    ${'NAME:asc'}       | ${{ fieldName: 'NAME', dir: 'ASC' }}
+    ${'NAME:ASC'}       | ${{ fieldName: 'NAME', dir: 'ASC' }}
+    ${''}               | ${null}
+    ${'name'}           | ${{ fieldName: 'name', dir: 'ASC' }}
+    ${':asc'}           | ${null}
+    ${':desc'}          | ${null}
+    ${'name:asc:blah'}  | ${{ fieldName: 'name', dir: 'ASC' }}
+    ${'name:desc:blah'} | ${{ fieldName: 'name', dir: 'DESC' }}
+    ${'name:blah'}      | ${{ fieldName: 'name', dir: 'ASC' }}
+  `('should parse "$input"', ({ input, expected }) => {
+    expect(parseSortType(input)).toEqual(expected);
+  });
+});
+
+describe('formatSortType', () => {
+  it.each`
+    input                                 | expected
+    ${{ fieldName: 'name', dir: 'ASC' }}  | ${'name:asc'}
+    ${{ fieldName: 'name', dir: 'DESC' }} | ${'name:desc'}
+    ${{ fieldName: '', dir: 'ASC' }}      | ${':asc'}
+    ${{ fieldName: 'UPPER', dir: 'ASC' }} | ${'UPPER:asc'}
+  `('should format $input', ({ input, expected }) => {
+    expect(formatSortType(input)).toEqual(expected);
+  });
+});
diff --git a/web/packages/design/src/DataTable/sort.ts b/web/packages/design/src/DataTable/sort.ts
new file mode 100644
index 0000000000000..e106037b79b60
--- /dev/null
+++ b/web/packages/design/src/DataTable/sort.ts
@@ -0,0 +1,43 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { SortType } from './types';
+
+/**
+ * parseSortType converts the "fieldname:dir" format into {fieldName: "", dir: ""}
+ * @param sort the sort string to parse
+ * @returns the parsed sort type or null if the sort string is invalid
+ */
+export function parseSortType(sort: string): SortType | null {
+  if (!sort) return null;
+  const [fieldName, dir] = sort.split(':');
+  if (!fieldName) return null;
+  return {
+    fieldName,
+    dir: dir?.toLowerCase() === 'desc' ? 'DESC' : 'ASC',
+  };
+}
+
+/**
+ * formatSortType converts a SortType ({fieldName: "", dir: ""}) to the "fieldname:dir" format
+ * @param sortType the sort to format
+ * @returns the formatted sort string
+ */
+export function formatSortType(sortType: SortType): string {
+  return `${sortType.fieldName}:${sortType.dir.toLowerCase()}`;
+}
diff --git a/web/packages/design/src/DataTable/types.ts b/web/packages/design/src/DataTable/types.ts
index f121438484094..0a684179e76bb 100644
--- a/web/packages/design/src/DataTable/types.ts
+++ b/web/packages/design/src/DataTable/types.ts
@@ -25,6 +25,9 @@ import { Pagination } from './useTable';
 export type TableProps<T> = {
   data: T[];
   columns: TableColumn<T>[];
+  infiniteScrollProps?: {
+    fetchStatus: FetchStatus;
+  };
   emptyText: string;
   /**
    * Optional button that is rendered below emptyText if there's no data, during processing or on
diff --git a/web/packages/design/src/FieldRadio/FieldRadio.story.tsx b/web/packages/design/src/FieldRadio/FieldRadio.story.tsx
index 4671b4d97cb93..7a2bd81e87639 100644
--- a/web/packages/design/src/FieldRadio/FieldRadio.story.tsx
+++ b/web/packages/design/src/FieldRadio/FieldRadio.story.tsx
@@ -16,58 +16,79 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
+
 import Box from 'design/Box';
 import { H1 } from 'design/Text';
 
-import { FieldRadio } from './FieldRadio';
+import { FieldRadio as Component } from './FieldRadio';
+
+type StoryProps = {
+  readOnly?: boolean;
+  disabled?: boolean;
+};
 
-export default {
+const meta: Meta<StoryProps> = {
   title: 'Shared',
+  component: FieldRadio,
+  args: {
+    readOnly: false,
+    disabled: false,
+  },
 };
+export default meta;
 
-export const FieldRadioStory = () => (
-  <Box width={600}>
-    <H1 mb={2}>Group 1</H1>
-    <FieldRadio
-      name="grp1"
-      label="Unchecked radio button"
-      defaultChecked={false}
-    />
-    <FieldRadio
-      name="grp1"
-      label="Checked radio button"
-      defaultChecked={true}
-    />
-    <FieldRadio name="grp1" label="Disabled radio button" disabled />
-    <FieldRadio name="grp1" size="small" label="Small radio button" />
-    <H1 mb={2}>Group 2</H1>
-    <FieldRadio
-      name="grp2"
-      label="Radio button with helper text"
-      helperText="I'm a helpful helper text"
-    />
-    <FieldRadio
-      name="grp2"
-      size="small"
-      label="Small radio button with helper text"
-      helperText="Another helpful helper text"
-    />
-    <FieldRadio
-      name="grp2"
-      disabled
-      label="Disabled radio button with helper text"
-      helperText="There's nothing you can do here"
-      defaultChecked={true}
-    />
-    <FieldRadio
-      name="grp2"
-      label="You must choose. But choose wisely, for while the true Grail will
+export function FieldRadio(props: StoryProps) {
+  return (
+    <Box width={600}>
+      <H1 mb={2}>Group 1</H1>
+      <Component
+        name="grp1"
+        label="Unchecked radio button"
+        defaultChecked={false}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        name="grp1"
+        label="Checked radio button"
+        defaultChecked={true}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        name="grp1"
+        size="small"
+        label="Small radio button"
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <H1 mb={2}>Group 2</H1>
+      <Component
+        name="grp2"
+        label="Radio button with helper text"
+        helperText="I'm a helpful helper text"
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        name="grp2"
+        size="small"
+        label="Small radio button with helper text"
+        helperText="Another helpful helper text"
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        name="grp2"
+        label="You must choose. But choose wisely, for while the true Grail will
       bring you life, the false Grail will take it from you."
-      helperText="I was chosen because I was the bravest and the most worthy.
+        helperText="I was chosen because I was the bravest and the most worthy.
       The honor was mine until another came to challenge me to single combat. I
       pass it to you who vanquished me."
-    />
-  </Box>
-);
-
-FieldRadioStory.storyName = 'FieldRadio';
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+    </Box>
+  );
+}
diff --git a/web/packages/design/src/FieldRadio/FieldRadio.tsx b/web/packages/design/src/FieldRadio/FieldRadio.tsx
index c0ff56ea91b9b..f16b4146c97b9 100644
--- a/web/packages/design/src/FieldRadio/FieldRadio.tsx
+++ b/web/packages/design/src/FieldRadio/FieldRadio.tsx
@@ -32,7 +32,15 @@ interface FieldRadioProps extends SpaceProps {
   helperText?: ReactNode;
   checked?: boolean;
   defaultChecked?: boolean;
+  /**
+   * Disables and mutes all values.
+   */
   disabled?: boolean;
+  /**
+   * Disables radio but does not mute values
+   * to remain readable.
+   */
+  readOnly?: boolean;
   size?: RadioButtonSize;
   value?: string;
   autoFocus?: boolean;
@@ -49,6 +57,7 @@ export const FieldRadio = forwardRef<HTMLInputElement, FieldRadioProps>(
       checked,
       defaultChecked,
       disabled,
+      readOnly,
       size,
       value,
       autoFocus,
@@ -63,7 +72,7 @@ export const FieldRadio = forwardRef<HTMLInputElement, FieldRadioProps>(
     const helperTypography = size === 'small' ? 'body3' : 'body2';
     return (
       <Box mb={3} lineHeight={0} {...styles}>
-        <StyledLabel disabled={disabled}>
+        <StyledLabel disabled={disabled} readOnly={readOnly}>
           <Flex flexDirection="row" gap={2}>
             {/* Nudge the small-size radio button to better align with the
                 label. */}
@@ -74,6 +83,7 @@ export const FieldRadio = forwardRef<HTMLInputElement, FieldRadioProps>(
                 checked={checked}
                 defaultChecked={defaultChecked}
                 disabled={disabled}
+                readOnly={readOnly}
                 name={name}
                 value={value}
                 autoFocus={autoFocus}
@@ -95,7 +105,10 @@ export const FieldRadio = forwardRef<HTMLInputElement, FieldRadioProps>(
   }
 );
 
-const StyledLabel = styled(LabelInput)<{ disabled?: boolean }>`
+const StyledLabel = styled(LabelInput)<{
+  disabled?: boolean;
+  readOnly?: boolean;
+}>`
   // Typically, a short label in a wide container means a lot of whitespace that
   // acts as a click target for a radio button. To avoid this, we use
   // inline-flex to wrap the label around its content.
@@ -104,5 +117,6 @@ const StyledLabel = styled(LabelInput)<{ disabled?: boolean }>`
   gap: ${props => props.theme.space[2]}px;
   margin-bottom: 0;
   line-height: 0;
-  cursor: ${props => (props.disabled ? 'not-allowed' : 'pointer')};
+  cursor: ${props =>
+    props.disabled || props.readOnly ? 'not-allowed' : 'pointer'};
 `;
diff --git a/web/packages/design/src/Flex/Flex.tsx b/web/packages/design/src/Flex/Flex.tsx
index 019ffc34dcb32..8a7d64f5a7578 100644
--- a/web/packages/design/src/Flex/Flex.tsx
+++ b/web/packages/design/src/Flex/Flex.tsx
@@ -17,6 +17,7 @@
  */
 
 import styled from 'styled-components';
+import { flexShrink, type FlexShrinkProps } from 'styled-system';
 
 import {
   alignItems,
@@ -42,7 +43,8 @@ import {
 import Box, { BoxProps } from '../Box';
 
 export interface FlexProps
-  extends BoxProps,
+  extends
+    BoxProps,
     AlignItemsProps,
     JustifyContentProps,
     FlexWrapProps,
@@ -51,7 +53,8 @@ export interface FlexProps
     BoxShadowProps,
     RowGapProps,
     ColumnGapProps,
-    GapProps {
+    GapProps,
+    FlexShrinkProps {
   /**
    * Uses inline-flex instead of just flex as the display property.
    */
@@ -71,6 +74,7 @@ const Flex = styled(Box)<FlexProps>`
   ${rowGap}
   ${columnGap}
   ${gap}
+  ${flexShrink}
 
   ${props =>
     props.fullWidth &&
diff --git a/web/packages/design/src/Flex/Stack.story.tsx b/web/packages/design/src/Flex/Stack.story.tsx
index 94c3dc8bedfe2..facc5d688f404 100644
--- a/web/packages/design/src/Flex/Stack.story.tsx
+++ b/web/packages/design/src/Flex/Stack.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import styled from 'styled-components';
 
 import Box from 'design/Box';
diff --git a/web/packages/design/src/Icon/Icons.story.tsx b/web/packages/design/src/Icon/Icons.story.tsx
index 3d4ca62fd1825..fe4066fc3a7a0 100644
--- a/web/packages/design/src/Icon/Icons.story.tsx
+++ b/web/packages/design/src/Icon/Icons.story.tsx
@@ -90,6 +90,7 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.CircleArrowRight} text="CircleArrowRight" />
     <IconBox IconCmpt={Icon.CircleCheck} text="CircleCheck" />
     <IconBox IconCmpt={Icon.CircleCross} text="CircleCross" />
+    <IconBox IconCmpt={Icon.CircleDashed} text="CircleDashed" />
     <IconBox IconCmpt={Icon.CirclePause} text="CirclePause" />
     <IconBox IconCmpt={Icon.CirclePlay} text="CirclePlay" />
     <IconBox IconCmpt={Icon.CircleStop} text="CircleStop" />
@@ -104,6 +105,8 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.Config} text="Config" />
     <IconBox IconCmpt={Icon.Contract} text="Contract" />
     <IconBox IconCmpt={Icon.Copy} text="Copy" />
+    <IconBox IconCmpt={Icon.CornersIn} text="CornersIn" />
+    <IconBox IconCmpt={Icon.CornersOut} text="CornersOut" />
     <IconBox IconCmpt={Icon.CreditCard} text="CreditCard" />
     <IconBox IconCmpt={Icon.Cross} text="Cross" />
     <IconBox IconCmpt={Icon.Crown} text="Crown" />
@@ -121,14 +124,19 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.EqualizersVertical} text="EqualizersVertical" />
     <IconBox IconCmpt={Icon.Expand} text="Expand" />
     <IconBox IconCmpt={Icon.Facebook} text="Facebook" />
+    <IconBox IconCmpt={Icon.FastForward} text="FastForward" />
+    <IconBox IconCmpt={Icon.FilmStrip} text="FilmStrip" />
     <IconBox IconCmpt={Icon.FingerprintSimple} text="FingerprintSimple" />
     <IconBox IconCmpt={Icon.Floppy} text="Floppy" />
     <IconBox IconCmpt={Icon.FlowArrow} text="FlowArrow" />
     <IconBox IconCmpt={Icon.FolderPlus} text="FolderPlus" />
     <IconBox IconCmpt={Icon.FolderShared} text="FolderShared" />
+    <IconBox IconCmpt={Icon.Git} text="Git" />
     <IconBox IconCmpt={Icon.GitHub} text="GitHub" />
     <IconBox IconCmpt={Icon.Google} text="Google" />
     <IconBox IconCmpt={Icon.Graph} text="Graph" />
+    <IconBox IconCmpt={Icon.GridFour} text="GridFour" />
+    <IconBox IconCmpt={Icon.GridNine} text="GridNine" />
     <IconBox IconCmpt={Icon.Hashtag} text="Hashtag" />
     <IconBox IconCmpt={Icon.Headset} text="Headset" />
     <IconBox IconCmpt={Icon.Home} text="Home" />
@@ -163,6 +171,7 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.Memory} text="Memory" />
     <IconBox IconCmpt={Icon.Minus} text="Minus" />
     <IconBox IconCmpt={Icon.MinusCircle} text="MinusCircle" />
+    <IconBox IconCmpt={Icon.ModelContextProtocol} text="ModelContextProtocol" />
     <IconBox IconCmpt={Icon.Moon} text="Moon" />
     <IconBox IconCmpt={Icon.MoreHoriz} text="MoreHoriz" />
     <IconBox IconCmpt={Icon.MoreVert} text="MoreVert" />
@@ -173,8 +182,10 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.NotificationsActive} text="NotificationsActive" />
     <IconBox IconCmpt={Icon.PaperPlane} text="PaperPlane" />
     <IconBox IconCmpt={Icon.Password} text="Password" />
+    <IconBox IconCmpt={Icon.Pause} text="Pause" />
     <IconBox IconCmpt={Icon.Pencil} text="Pencil" />
     <IconBox IconCmpt={Icon.Planet} text="Planet" />
+    <IconBox IconCmpt={Icon.Play} text="Play" />
     <IconBox IconCmpt={Icon.Plugs} text="Plugs" />
     <IconBox IconCmpt={Icon.PlugsConnected} text="PlugsConnected" />
     <IconBox IconCmpt={Icon.Plus} text="Plus" />
@@ -188,6 +199,8 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.Restore} text="Restore" />
     <IconBox IconCmpt={Icon.RocketLaunch} text="RocketLaunch" />
     <IconBox IconCmpt={Icon.Rows} text="Rows" />
+    <IconBox IconCmpt={Icon.RowsComfortable} text="RowsComfortable" />
+    <IconBox IconCmpt={Icon.RowsDense} text="RowsDense" />
     <IconBox IconCmpt={Icon.Ruler} text="Ruler" />
     <IconBox IconCmpt={Icon.Run} text="Run" />
     <IconBox IconCmpt={Icon.Scan} text="Scan" />
@@ -197,6 +210,8 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.ShieldWarning} text="ShieldWarning" />
     <IconBox IconCmpt={Icon.Sliders} text="Sliders" />
     <IconBox IconCmpt={Icon.SlidersVertical} text="SlidersVertical" />
+    <IconBox IconCmpt={Icon.SortAscending} text="SortAscending" />
+    <IconBox IconCmpt={Icon.SortDescending} text="SortDescending" />
     <IconBox IconCmpt={Icon.Speed} text="Speed" />
     <IconBox IconCmpt={Icon.Spinner} text="Spinner" />
     <IconBox IconCmpt={Icon.SquaresFour} text="SquaresFour" />
@@ -216,6 +231,7 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.UsbDrive} text="UsbDrive" />
     <IconBox IconCmpt={Icon.User} text="User" />
     <IconBox IconCmpt={Icon.UserAdd} text="UserAdd" />
+    <IconBox IconCmpt={Icon.UserCheck} text="UserCheck" />
     <IconBox IconCmpt={Icon.UserCircleGear} text="UserCircleGear" />
     <IconBox IconCmpt={Icon.UserFocus} text="UserFocus" />
     <IconBox IconCmpt={Icon.UserIdBadge} text="UserIdBadge" />
@@ -232,6 +248,7 @@ export const Icons = () => (
     <IconBox IconCmpt={Icon.Wifi} text="Wifi" />
     <IconBox IconCmpt={Icon.Windows} text="Windows" />
     <IconBox IconCmpt={Icon.Wrench} text="Wrench" />
+    <IconBox IconCmpt={Icon.XCheck} text="XCheck" />
     <IconBox IconCmpt={Icon.Youtube} text="Youtube" />
   </Flex>
 );
diff --git a/web/packages/design/src/Icon/Icons/Add.tsx b/web/packages/design/src/Icon/Icons/Add.tsx
index 5c6ed4a2f4055..2174b097cfd93 100644
--- a/web/packages/design/src/Icon/Icons/Add.tsx
+++ b/web/packages/design/src/Icon/Icons/Add.tsx
@@ -59,7 +59,7 @@ export const Add = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 3.75C12.75 3.33579 12.4142 3 12 3C11.5858 3 11.25 3.33579 11.25 3.75V11.25H3.75C3.33579 11.25 3 11.5858 3 12C3 12.4142 3.33579 12.75 3.75 12.75H11.25V20.25C11.25 20.6642 11.5858 21 12 21C12.4142 21 12.75 20.6642 12.75 20.25V12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H12.75V3.75Z" />
+      <path d="M12.75 3.75a.75.75 0 0 0-1.5 0v7.5h-7.5a.75.75 0 0 0 0 1.5h7.5v7.5a.75.75 0 0 0 1.5 0v-7.5h7.5a.75.75 0 0 0 0-1.5h-7.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/AddCircle.tsx b/web/packages/design/src/Icon/Icons/AddCircle.tsx
index c0ba971ebc4c4..9d81bdb3117f5 100644
--- a/web/packages/design/src/Icon/Icons/AddCircle.tsx
+++ b/web/packages/design/src/Icon/Icons/AddCircle.tsx
@@ -59,11 +59,11 @@ export const AddCircle = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M7.5 12C7.5 11.5858 7.83579 11.25 8.25 11.25H11.25V8.25C11.25 7.83579 11.5858 7.5 12 7.5C12.4142 7.5 12.75 7.83579 12.75 8.25V11.25H15.75C16.1642 11.25 16.5 11.5858 16.5 12C16.5 12.4142 16.1642 12.75 15.75 12.75H12.75V15.75C12.75 16.1642 12.4142 16.5 12 16.5C11.5858 16.5 11.25 16.1642 11.25 15.75V12.75H8.25C7.83579 12.75 7.5 12.4142 7.5 12Z" />
+      <path d="M7.5 12a.75.75 0 0 1 .75-.75h3v-3a.75.75 0 0 1 1.5 0v3h3a.75.75 0 0 1 0 1.5h-3v3a.75.75 0 0 1-1.5 0v-3h-3A.75.75 0 0 1 7.5 12" />
       <path
         fillRule="evenodd"
+        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365 9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12M12 3.75a8.25 8.25 0 1 0 0 16.5 8.25 8.25 0 0 0 0-16.5"
         clipRule="evenodd"
-        d="M2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12ZM12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.5563 7.44365 20.25 12 20.25C16.5563 20.25 20.25 16.5563 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/AddUsers.tsx b/web/packages/design/src/Icon/Icons/AddUsers.tsx
index 291d1107fd1e0..bd5f08ecf9a2d 100644
--- a/web/packages/design/src/Icon/Icons/AddUsers.tsx
+++ b/web/packages/design/src/Icon/Icons/AddUsers.tsx
@@ -61,10 +61,10 @@ export const AddUsers = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 9.375a6.375 6.375 0 1 1 9.755 5.406c2.003.656 3.723 1.885 5.07 3.486a.75.75 0 0 1-1.15.966c-1.798-2.141-4.315-3.483-7.3-3.483s-5.502 1.342-7.3 3.483a.75.75 0 0 1-1.15-.966c1.347-1.601 3.067-2.83 5.07-3.486A6.37 6.37 0 0 1 3.75 9.375M10.125 4.5a4.875 4.875 0 1 0 0 9.75 4.875 4.875 0 0 0 0-9.75"
         clipRule="evenodd"
-        d="M3.75 9.375C3.75 5.85418 6.60418 3 10.125 3C13.6458 3 16.5 5.85418 16.5 9.375C16.5 11.6544 15.3037 13.6544 13.5047 14.7814C15.508 15.4374 17.2277 16.6655 18.5742 18.2674C18.8407 18.5845 18.7997 19.0576 18.4826 19.3241C18.1655 19.5907 17.6924 19.5496 17.4259 19.2326C15.6266 17.0918 13.1097 15.75 10.125 15.75C7.14033 15.75 4.62341 17.0918 2.82416 19.2326C2.55765 19.5496 2.08455 19.5907 1.76746 19.3241C1.45037 19.0576 1.40937 18.5845 1.67588 18.2674C3.0223 16.6655 4.74199 15.4374 6.7453 14.7814C4.9463 13.6544 3.75 11.6544 3.75 9.375ZM10.125 4.5C7.43261 4.5 5.25 6.68261 5.25 9.375C5.25 12.0674 7.43261 14.25 10.125 14.25C12.8174 14.25 15 12.0674 15 9.375C15 6.68261 12.8174 4.5 10.125 4.5Z"
       />
-      <path d="M21.75 10.5C21.75 10.0858 21.4142 9.75 21 9.75C20.5858 9.75 20.25 10.0858 20.25 10.5V12H18.75C18.3358 12 18 12.3358 18 12.75C18 13.1642 18.3358 13.5 18.75 13.5H20.25V15C20.25 15.4142 20.5858 15.75 21 15.75C21.4142 15.75 21.75 15.4142 21.75 15V13.5H23.25C23.6642 13.5 24 13.1642 24 12.75C24 12.3358 23.6642 12 23.25 12H21.75V10.5Z" />
+      <path d="M21.75 10.5a.75.75 0 0 0-1.5 0V12h-1.5a.75.75 0 0 0 0 1.5h1.5V15a.75.75 0 0 0 1.5 0v-1.5h1.5a.75.75 0 0 0 0-1.5h-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/AlarmRing.tsx b/web/packages/design/src/Icon/Icons/AlarmRing.tsx
index 74c7d81373360..45ceaae91fd32 100644
--- a/web/packages/design/src/Icon/Icons/AlarmRing.tsx
+++ b/web/packages/design/src/Icon/Icons/AlarmRing.tsx
@@ -59,14 +59,13 @@ export const AlarmRing = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M5.78033 2.78033C6.07322 2.48744 6.07322 2.01256 5.78033 1.71967C5.48744 1.42678 5.01256 1.42678 4.71967 1.71967L1.71967 4.71967C1.42678 5.01256 1.42678 5.48744 1.71967 5.78033C2.01256 6.07322 2.48744 6.07322 2.78033 5.78033L5.78033 2.78033Z" />
-      <path d="M12.75 6.75C12.75 6.33579 12.4142 6 12 6C11.5858 6 11.25 6.33579 11.25 6.75V12C11.25 12.4142 11.5858 12.75 12 12.75H17.25C17.6642 12.75 18 12.4142 18 12C18 11.5858 17.6642 11.25 17.25 11.25H12.75V6.75Z" />
+      <path d="M5.78 2.78a.75.75 0 0 0-1.06-1.06l-3 3a.75.75 0 0 0 1.06 1.06zm6.97 3.97a.75.75 0 0 0-1.5 0V12c0 .414.336.75.75.75h5.25a.75.75 0 0 0 0-1.5h-4.5z" />
       <path
         fillRule="evenodd"
+        d="M12 3a9 9 0 1 0 0 18 9 9 0 0 0 0-18m-7.5 9a7.5 7.5 0 1 1 15 0 7.5 7.5 0 0 1-15 0"
         clipRule="evenodd"
-        d="M12 3C7.02944 3 3 7.02944 3 12C3 16.9706 7.02944 21 12 21C16.9706 21 21 16.9706 21 12C21 7.02944 16.9706 3 12 3ZM4.5 12C4.5 7.85786 7.85786 4.5 12 4.5C16.1421 4.5 19.5 7.85786 19.5 12C19.5 16.1421 16.1421 19.5 12 19.5C7.85786 19.5 4.5 16.1421 4.5 12Z"
       />
-      <path d="M18.2197 1.71967C18.5126 1.42678 18.9874 1.42678 19.2803 1.71967L22.2803 4.71967C22.5732 5.01256 22.5732 5.48744 22.2803 5.78033C21.9874 6.07322 21.5126 6.07322 21.2197 5.78033L18.2197 2.78033C17.9268 2.48744 17.9268 2.01256 18.2197 1.71967Z" />
+      <path d="M18.22 1.72a.75.75 0 0 1 1.06 0l3 3a.75.75 0 0 1-1.06 1.06l-3-3a.75.75 0 0 1 0-1.06" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/AmazonAws.tsx b/web/packages/design/src/Icon/Icons/AmazonAws.tsx
index 0b95de05e7b49..4118516ef80bf 100644
--- a/web/packages/design/src/Icon/Icons/AmazonAws.tsx
+++ b/web/packages/design/src/Icon/Icons/AmazonAws.tsx
@@ -59,7 +59,7 @@ export const AmazonAws = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M7.19944 10.7777C7.19944 11.049 7.22877 11.2681 7.28011 11.4285C7.33879 11.5899 7.41211 11.7659 7.51479 11.9566C7.55146 12.0143 7.56612 12.073 7.56612 12.1243C7.56612 12.1976 7.52211 12.271 7.42679 12.3443L6.96571 12.6514C6.91266 12.69 6.84696 12.7143 6.77576 12.7174L6.77503 12.7174C6.70171 12.7174 6.62836 12.6807 6.55596 12.6147C6.46091 12.5127 6.37416 12.4003 6.29838 12.2803L6.29288 12.271C6.22585 12.1595 6.15007 12.0181 6.08027 11.8731L6.06553 11.8392C5.49535 12.512 4.7776 12.8485 3.9141 12.8485C3.29992 12.8485 2.80951 12.6734 2.45109 12.3223C2.09266 11.9703 1.91026 11.5028 1.91026 10.917C1.91026 10.2955 2.12934 9.78952 2.57576 9.41002C3.02219 9.02959 3.61434 8.83894 4.36785 8.83894C4.61718 8.83894 4.87293 8.86094 5.14335 8.89761C5.41468 8.93429 5.69336 8.99294 5.98486 9.05894V8.52451C5.98486 7.96809 5.86843 7.58033 5.64111 7.35393C5.40735 7.1266 5.01228 7.01751 4.44943 7.01751C4.19275 7.01751 3.92875 7.04593 3.65835 7.11193C3.38794 7.17793 3.12392 7.2586 2.86817 7.36126C2.79901 7.39346 2.71391 7.42586 2.62634 7.45267L2.61149 7.45658C2.5771 7.46808 2.53733 7.47564 2.4961 7.47764L2.49507 7.47768C2.39239 7.47768 2.34107 7.40435 2.34107 7.25126V6.89283C2.34107 6.7755 2.35574 6.6875 2.39239 6.63616C2.44718 6.57063 2.51591 6.51864 2.5942 6.48445L2.59772 6.48308C2.85347 6.35108 3.16055 6.24108 3.51898 6.15308C3.84921 6.06503 4.22837 6.01446 4.61932 6.01446C4.63404 6.01446 4.64872 6.01452 4.66339 6.01467L4.66113 6.01465C5.53196 6.01465 6.16814 6.21265 6.57789 6.60773C6.98032 7.00191 7.18472 7.60231 7.18472 8.40716L7.19944 10.7777ZM4.22942 11.8906C4.4705 11.8906 4.71893 11.8466 4.98293 11.7586C5.24601 11.6705 5.48068 11.5101 5.67776 11.291C5.79508 11.1517 5.88308 10.9977 5.92708 10.8217C5.97016 10.6466 6.00041 10.434 6.00041 10.1855V9.87846C5.81882 9.83137 5.59025 9.78769 5.35757 9.75712L5.32666 9.75381C5.12051 9.72616 4.88189 9.71018 4.63961 9.70981H4.63915C4.14873 9.70981 3.79032 9.80514 3.54832 10.0031C3.30725 10.2002 3.19082 10.478 3.19082 10.8437C3.19082 11.1875 3.2779 11.4441 3.46125 11.6192C3.63632 11.8026 3.89207 11.8906 4.22942 11.8906ZM10.1053 12.6807C9.97328 12.6807 9.88528 12.6587 9.8266 12.6074C9.76793 12.5634 9.7166 12.4607 9.6726 12.3223L7.95385 6.66555C7.92265 6.58023 7.8994 6.48087 7.88834 6.37785L7.88784 6.3722C7.88784 6.25487 7.94652 6.18887 8.06292 6.18887H8.78068C8.9191 6.18887 9.01443 6.21179 9.06485 6.2622C9.12443 6.3062 9.16843 6.40887 9.21153 6.5482L10.4417 11.3919L11.583 6.5482C11.6196 6.40152 11.6636 6.3062 11.7214 6.2622C11.7963 6.2156 11.8871 6.18795 11.9845 6.18795C11.9951 6.18795 12.0057 6.18827 12.0162 6.18893L12.0147 6.18887H12.5995C12.7389 6.18887 12.8342 6.21179 12.8929 6.2622C12.9506 6.3062 13.0029 6.40887 13.0313 6.5482L14.1872 11.4505L15.4532 6.5482C15.4972 6.40152 15.5485 6.3062 15.5998 6.2622C15.6722 6.21562 15.7605 6.18795 15.8553 6.18795C15.8657 6.18795 15.8761 6.18829 15.8863 6.18893L15.8849 6.18887H16.566C16.6824 6.18887 16.7493 6.24845 16.7493 6.3722C16.7493 6.40887 16.7411 6.44552 16.7338 6.48952C16.7207 6.55954 16.703 6.62105 16.68 6.67996L16.6824 6.67287L14.9197 12.3287C14.8757 12.4754 14.8243 12.5698 14.7657 12.6138C14.6943 12.6602 14.607 12.6878 14.5132 12.6878C14.5043 12.6878 14.4955 12.6876 14.4867 12.6871L14.4879 12.6872H13.8581C13.7197 12.6872 13.6244 12.6652 13.5648 12.6138C13.5071 12.5625 13.4557 12.4672 13.4273 12.3205L12.2925 7.60148L11.165 12.3132C11.1283 12.4598 11.0852 12.5552 11.0275 12.6065C10.9679 12.6578 10.8652 12.6798 10.7342 12.6798L10.1053 12.6807ZM19.5067 12.8778C19.1262 12.8778 18.7458 12.8338 18.3801 12.7467C18.0143 12.6587 17.7292 12.5634 17.5386 12.4534C17.4212 12.3883 17.3415 12.315 17.3121 12.249C17.2848 12.1886 17.2686 12.1181 17.2681 12.0438V11.6706C17.2681 11.5175 17.3268 11.4441 17.4359 11.4441C17.4799 11.4441 17.5239 11.4515 17.5679 11.4661C17.6119 11.4808 17.6779 11.5101 17.7512 11.5395C17.9996 11.6495 18.27 11.7366 18.5561 11.7952C18.8485 11.8539 19.1336 11.8832 19.4269 11.8832C19.8871 11.8832 20.2464 11.8026 20.4948 11.6412C20.7245 11.5007 20.8755 11.2512 20.8755 10.9665C20.8755 10.9594 20.8754 10.9524 20.8752 10.9454L20.8752 10.9464C20.8754 10.9404 20.8755 10.9332 20.8755 10.9261C20.8755 10.7351 20.8003 10.5616 20.6779 10.4337L20.6782 10.434C20.5462 10.2955 20.2968 10.1709 19.9384 10.0535L18.8778 9.72354C18.3434 9.55579 17.9483 9.30736 17.7072 8.97829C17.4802 8.68827 17.3425 8.3188 17.3406 7.91723V7.91678C17.3406 7.6097 17.4075 7.33928 17.5386 7.1046C17.6706 6.87085 17.8456 6.66552 18.0656 6.5051C18.2856 6.33643 18.5331 6.21177 18.8265 6.12467C19.1198 6.03667 19.4269 6 19.7487 6C19.9091 6 20.0777 6.00733 20.2391 6.02933C20.4068 6.05133 20.5599 6.08065 20.7139 6.11C20.8606 6.14667 20.9999 6.18333 21.131 6.22642C21.263 6.27043 21.3657 6.31443 21.439 6.35843C21.5271 6.40341 21.6007 6.46525 21.6579 6.54023L21.659 6.54177C21.7002 6.60307 21.7248 6.67854 21.7248 6.75976C21.7248 6.76788 21.7245 6.77596 21.724 6.78395L21.7241 6.78285V7.1266C21.7241 7.2806 21.6654 7.36128 21.5554 7.36128C21.4519 7.34912 21.3579 7.31797 21.2738 7.2713L21.2776 7.27328C20.8796 7.09292 20.4145 6.98779 19.9249 6.98779C19.9068 6.98779 19.8886 6.98794 19.8706 6.98822L19.8733 6.98818C19.4562 6.98818 19.1262 7.05326 18.8998 7.1926C18.6725 7.33193 18.5561 7.54368 18.5561 7.84343C18.5561 8.04876 18.6294 8.22476 18.7761 8.36319C18.9218 8.50251 19.1922 8.64186 19.58 8.76651L20.6195 9.09469C21.1457 9.26336 21.527 9.49802 21.7534 9.79777C21.9798 10.0975 22.0898 10.4413 22.0898 10.8217C22.0898 11.1361 22.0238 11.4221 21.9001 11.6705C21.7681 11.9199 21.5921 12.139 21.3657 12.315C21.1383 12.4983 20.8679 12.6294 20.5535 12.7247C20.2235 12.8265 19.8807 12.8778 19.5067 12.8778V12.8778ZM20.8899 16.4345C18.4827 18.2128 14.9847 19.1561 11.978 19.1561C7.76319 19.1561 3.96633 17.5978 1.09716 15.0072C0.870734 14.8028 1.07516 14.5242 1.34649 14.6855C4.4485 16.4849 8.2756 17.5758 12.2338 17.5758C14.905 17.5758 17.8383 17.0193 20.5388 15.8781C20.9413 15.6947 21.285 16.1411 20.8899 16.4345ZM21.8928 15.2923C21.5848 14.8981 19.8578 15.1026 19.0749 15.1979C18.8412 15.2272 18.8045 15.0219 19.0172 14.8679C20.3922 13.9026 22.6536 14.1804 22.9167 14.5021C23.1798 14.8321 22.8434 17.0927 21.5554 18.1752C21.3584 18.3439 21.1677 18.2559 21.2557 18.0368C21.549 17.3126 22.1999 15.681 21.8928 15.2923Z" />
+      <path d="M7.2 10.778q.002.408.08.65c.059.162.132.338.235.529a.3.3 0 0 1 .051.167q.002.11-.14.22l-.46.307a.35.35 0 0 1-.19.066h-.001q-.11-.001-.219-.102a2.3 2.3 0 0 1-.258-.335l-.005-.009a5 5 0 0 1-.213-.398l-.014-.034q-.856 1.01-2.152 1.01-.923 0-1.463-.527-.538-.528-.54-1.405c0-.621.218-1.127.665-1.507.446-.38 1.038-.571 1.792-.571.25 0 .505.022.775.059.272.036.55.095.842.16v-.533q-.002-.834-.344-1.171c-.234-.227-.629-.336-1.192-.336-.256 0-.52.028-.79.094a6 6 0 0 0-.79.25c-.07.031-.155.064-.243.09l-.015.005a.4.4 0 0 1-.115.02q-.155.002-.155-.226v-.358q-.002-.177.051-.257a.55.55 0 0 1 .202-.152h.004q.383-.2.921-.33a4.3 4.3 0 0 1 1.144-.14h-.002c.871 0 1.507.199 1.917.594.402.394.607.994.607 1.8zM4.23 11.89q.359 0 .753-.132c.263-.088.498-.249.695-.468.117-.14.205-.293.25-.47.042-.174.072-.387.072-.636v-.307a6 6 0 0 0-.642-.12l-.031-.004a5 5 0 0 0-.687-.044c-.491 0-.85.095-1.092.293q-.358.294-.357.84c0 .345.087.601.27.776q.262.274.768.272m5.875.79c-.132 0-.22-.022-.278-.074-.06-.044-.11-.146-.154-.285l-1.72-5.656a1.2 1.2 0 0 1-.065-.288v-.006c0-.117.059-.183.175-.183h.718q.207-.001.284.073c.06.044.103.147.147.286l1.23 4.844 1.141-4.844c.037-.146.08-.242.138-.286a.5.5 0 0 1 .295-.073h-.001.585q.207-.001.293.073c.058.044.11.147.138.286l1.156 4.903 1.266-4.903c.044-.146.096-.242.147-.286a.47.47 0 0 1 .286-.073h-.001.681c.116 0 .183.06.183.183 0 .037-.008.074-.015.118q-.02.103-.054.19l.002-.007-1.762 5.656q-.067.218-.154.285a.46.46 0 0 1-.28.073h.002-.63q-.206.002-.293-.073c-.058-.052-.11-.147-.138-.294L12.292 7.6l-1.128 4.712c-.037.147-.08.242-.137.293-.06.052-.163.074-.294.074zm9.402.197c-.38 0-.761-.044-1.127-.131s-.65-.184-.841-.294c-.118-.065-.198-.138-.227-.204a.5.5 0 0 1-.044-.205v-.373c0-.153.059-.227.168-.227q.066 0 .132.022c.044.015.11.044.183.074q.375.166.805.255c.293.059.578.088.87.088q.694 0 1.069-.242a.79.79 0 0 0 .38-.696v.001-.02a.7.7 0 0 0-.197-.492q-.2-.206-.74-.38l-1.06-.33c-.535-.168-.93-.417-1.17-.746a1.73 1.73 0 0 1-.367-1.06v-.001q0-.46.198-.812a1.9 1.9 0 0 1 .527-.6 2.3 2.3 0 0 1 .76-.38c.294-.088.6-.125.923-.125.16 0 .329.007.49.03.168.021.32.05.475.08q.22.054.417.116a1.6 1.6 0 0 1 .308.132.64.64 0 0 1 .219.182l.001.002a.4.4 0 0 1 .065.242v-.001.344c0 .154-.059.234-.169.234a.8.8 0 0 1-.281-.09l.004.002a3.3 3.3 0 0 0-1.407-.285h.002c-.417 0-.747.065-.973.205-.227.139-.344.35-.344.65q0 .311.22.52c.146.14.416.279.804.404l1.04.328c.526.168.907.403 1.133.703q.339.451.337 1.024c0 .314-.066.6-.19.849a2 2 0 0 1-.534.644 2.4 2.4 0 0 1-.812.41 3.5 3.5 0 0 1-1.047.153m1.383 3.557c-2.407 1.778-5.905 2.721-8.912 2.721-4.215 0-8.012-1.558-10.88-4.149-.227-.204-.023-.483.248-.322 3.103 1.8 6.93 2.89 10.888 2.89 2.671 0 5.604-.556 8.305-1.697.402-.183.746.263.35.556m1.003-1.143c-.308-.394-2.035-.19-2.818-.094-.234.03-.27-.176-.058-.33 1.375-.965 3.637-.688 3.9-.366.263.33-.074 2.59-1.362 3.673-.197.169-.387.08-.3-.138.294-.724.945-2.356.638-2.745" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Apartment.tsx b/web/packages/design/src/Icon/Icons/Apartment.tsx
index dbacc005e643f..e11eba96c72c1 100644
--- a/web/packages/design/src/Icon/Icons/Apartment.tsx
+++ b/web/packages/design/src/Icon/Icons/Apartment.tsx
@@ -61,8 +61,8 @@ export const Apartment = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.14 1.635 3.39 7.052a.86.86 0 0 0-.287.293.8.8 0 0 0-.103.384V19.5H1.5a.75.75 0 0 0 0 1.5h21a.75.75 0 0 0 0-1.5H21V9a1.5 1.5 0 0 0-1.5-1.5h-6V2.31a.82.82 0 0 0-.463-.716.95.95 0 0 0-.898.04M19.5 19.5V9h-6v10.5zm-7.5 0V3.485L4.5 8.128V19.5zM9.75 9.75a.75.75 0 0 1 .75.75V12A.75.75 0 0 1 9 12v-1.5a.75.75 0 0 1 .75-.75m-2.25.75a.75.75 0 0 0-1.5 0V12a.75.75 0 0 0 1.5 0zM6.75 15a.75.75 0 0 1 .75.75v1.5a.75.75 0 0 1-1.5 0v-1.5a.75.75 0 0 1 .75-.75m3.75.75a.75.75 0 0 0-1.5 0v1.5a.75.75 0 0 0 1.5 0z"
         clipRule="evenodd"
-        d="M12.1394 1.63455L3.38938 7.05159C3.33527 7.08512 3.28556 7.12402 3.24106 7.16746C3.18686 7.22037 3.14038 7.28002 3.10307 7.34494C3.07319 7.39694 3.0496 7.4516 3.03257 7.50793C3.01089 7.57964 2.99985 7.65406 3 7.72911V19.5H1.5C1.08579 19.5 0.75 19.8358 0.75 20.25C0.75 20.6642 1.08579 21 1.5 21H3H4.5H12H13.5H20.25H22.5C22.9142 21 23.25 20.6642 23.25 20.25C23.25 19.8358 22.9142 19.5 22.5 19.5H21V9C21 8.60218 20.842 8.22065 20.5607 7.93934C20.2794 7.65804 19.8978 7.5 19.5 7.5H13.5V2.31003C13.4998 2.0159 13.3168 1.73254 13.0375 1.59388C12.7582 1.45522 12.4028 1.47131 12.1394 1.63455ZM19.5 19.5V9H13.5V19.5H19.5ZM12 19.5V8.25V3.48503L4.5 8.12821V19.5H12ZM9.75 9.75C10.1642 9.75 10.5 10.0858 10.5 10.5V12C10.5 12.4142 10.1642 12.75 9.75 12.75C9.33579 12.75 9 12.4142 9 12V10.5C9 10.0858 9.33579 9.75 9.75 9.75ZM7.5 10.5C7.5 10.0858 7.16421 9.75 6.75 9.75C6.33579 9.75 6 10.0858 6 10.5V12C6 12.4142 6.33579 12.75 6.75 12.75C7.16421 12.75 7.5 12.4142 7.5 12V10.5ZM6.75 15C7.16421 15 7.5 15.3358 7.5 15.75V17.25C7.5 17.6642 7.16421 18 6.75 18C6.33579 18 6 17.6642 6 17.25V15.75C6 15.3358 6.33579 15 6.75 15ZM10.5 15.75C10.5 15.3358 10.1642 15 9.75 15C9.33579 15 9 15.3358 9 15.75V17.25C9 17.6642 9.33579 18 9.75 18C10.1642 18 10.5 17.6642 10.5 17.25V15.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Apple.tsx b/web/packages/design/src/Icon/Icons/Apple.tsx
index 111db50141e78..6ca984ad87357 100644
--- a/web/packages/design/src/Icon/Icons/Apple.tsx
+++ b/web/packages/design/src/Icon/Icons/Apple.tsx
@@ -59,11 +59,11 @@ export const Apple = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M17.077 3.47585e-07H16.9714C16.0332 -0.000382264 15.1214 0.31512 14.3796 0.896899C13.6376 1.47877 13.1077 2.29397 12.8731 3.21429C12.7563 3.67264 13.0284 4.14015 13.4808 4.2585C13.9333 4.37684 14.3948 4.10121 14.5117 3.64286C14.6524 3.09067 14.9704 2.60155 15.4155 2.25243C15.8607 1.9033 16.4082 1.714 16.9712 1.71429H17.077C17.5443 1.71429 17.9231 1.33053 17.9231 0.857143C17.9231 0.383757 17.5443 3.47585e-07 17.077 3.47585e-07Z" />
+      <path d="M17.077 0h-.106c-.938 0-1.85.315-2.591.897a4.3 4.3 0 0 0-1.507 2.317.86.86 0 0 0 .608 1.044.845.845 0 0 0 1.03-.615c.141-.552.46-1.041.905-1.39.445-.35.992-.539 1.555-.539h.106a.85.85 0 0 0 .846-.857.85.85 0 0 0-.846-.857" />
       <path
         fillRule="evenodd"
+        d="M20.25 12.689c0-1.827.96-3.503 2.112-4.808q.298-.337.607-.64l.031-.03v-.003l-.027-.026a6.4 6.4 0 0 0-1.37-.983c-1.232-.67-2.738-1.055-4.102-1.055a7.17 7.17 0 0 0-4.583 1.65 7.18 7.18 0 0 0-4.482-1.65c-4.225-.06-7.541 3.57-7.433 7.918.046 1.864.45 3.7 1.19 5.401a14.1 14.1 0 0 0 3.123 4.513c.68.66 1.58 1.026 2.515 1.024h10.048a3.6 3.6 0 0 0 1.451-.304c.459-.203.872-.5 1.214-.875C22.36 20.818 23 18.91 23 18.91c-1.924-1.36-2.75-3.638-2.75-6.22m-2.753-5.831h.004c.993 0 2.06.259 2.952.675-1.04 1.39-1.895 3.153-1.895 5.155 0 2.454.665 4.9 2.37 6.678A11.8 11.8 0 0 1 19.3 21.66c-.184.2-.404.358-.647.466a1.9 1.9 0 0 1-.767.16H7.828a1.92 1.92 0 0 1-1.342-.548l-.001-.001a12.4 12.4 0 0 1-2.743-3.964 12.7 12.7 0 0 1-1.048-4.753c-.085-3.454 2.53-6.206 5.719-6.161h.003a5.5 5.5 0 0 1 3.433 1.265 1.676 1.676 0 0 0 2.137 0 5.5 5.5 0 0 1 3.51-1.265"
         clipRule="evenodd"
-        d="M20.2503 12.6885C20.2503 10.8617 21.2104 9.18633 22.3618 7.8807C22.5598 7.65619 22.7635 7.44262 22.9689 7.24108L23 7.2107V7.20834L22.9727 7.18196C22.5842 6.80922 22.1173 6.47909 21.6024 6.19883C20.3708 5.52851 18.8646 5.14357 17.5006 5.14357C15.8348 5.13958 14.2177 5.72178 12.9178 6.7935C11.6451 5.74377 10.0671 5.16289 8.43586 5.14357C4.21051 5.08464 0.894855 8.7145 1.00255 13.0621C1.04855 14.9259 1.45349 16.7617 2.19391 18.4634C2.93434 20.1651 3.99555 21.6989 5.31611 22.9758C5.99635 23.6353 6.89622 24.0017 7.83093 24H17.8787C18.3777 24.0021 18.8719 23.8985 19.3303 23.6958C19.7888 23.493 20.2018 23.1954 20.5436 22.8214C22.3596 20.818 23 18.9087 23 18.9087C21.0764 17.5499 20.2503 15.2706 20.2503 12.6885ZM17.4966 6.85785H17.5006C18.4941 6.85785 19.5616 7.11688 20.4532 7.53346C19.4135 8.92276 18.558 10.6857 18.558 12.6885C18.558 15.1422 19.223 17.5872 20.928 19.3658C20.5921 19.9868 20.0663 20.8127 19.2997 21.6591C19.1159 21.8595 18.8956 22.0175 18.6532 22.1247C18.4099 22.2323 18.1488 22.2868 17.8857 22.2857L7.83093 22.2857L7.8278 22.2857C7.33368 22.2866 6.85323 22.0931 6.48616 21.7373L6.48464 21.7358C5.32607 20.6155 4.3936 19.2685 3.74247 17.772C3.09132 16.2755 2.73482 14.6598 2.69433 13.0191C2.60876 9.56495 5.22391 6.81322 8.41256 6.85769L8.41607 6.85773C9.66236 6.8725 10.8712 7.31616 11.8493 8.12289C12.4715 8.63602 13.3639 8.6361 13.9861 8.12306C14.9851 7.29941 16.2239 6.85481 17.4966 6.85785Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Application.tsx b/web/packages/design/src/Icon/Icons/Application.tsx
index d4170c24141d0..9a716aae0dd49 100644
--- a/web/packages/design/src/Icon/Icons/Application.tsx
+++ b/web/packages/design/src/Icon/Icons/Application.tsx
@@ -59,12 +59,11 @@ export const Application = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M6.375 8.8125C6.89277 8.8125 7.3125 8.39277 7.3125 7.875C7.3125 7.35723 6.89277 6.9375 6.375 6.9375C5.85723 6.9375 5.4375 7.35723 5.4375 7.875C5.4375 8.39277 5.85723 8.8125 6.375 8.8125Z" />
-      <path d="M11.0625 7.875C11.0625 8.39277 10.6428 8.8125 10.125 8.8125C9.60723 8.8125 9.1875 8.39277 9.1875 7.875C9.1875 7.35723 9.60723 6.9375 10.125 6.9375C10.6428 6.9375 11.0625 7.35723 11.0625 7.875Z" />
+      <path d="M6.375 8.813a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.875m4.688-.938a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M2.25 5.25a1.5 1.5 0 0 1 1.5-1.5h16.5a1.5 1.5 0 0 1 1.5 1.5v13.5a1.5 1.5 0 0 1-1.5 1.5H3.75a1.5 1.5 0 0 1-1.5-1.5zm18 0H3.75v13.5h16.5z"
         clipRule="evenodd"
-        d="M2.25 5.25C2.25 4.42157 2.92157 3.75 3.75 3.75H20.25C21.0784 3.75 21.75 4.42157 21.75 5.25V18.75C21.75 19.5784 21.0784 20.25 20.25 20.25H3.75C2.92157 20.25 2.25 19.5784 2.25 18.75V5.25ZM20.25 5.25H3.75V18.75H20.25V5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Archive.tsx b/web/packages/design/src/Icon/Icons/Archive.tsx
index 338a6a76d63b0..04ce58c97a3ba 100644
--- a/web/packages/design/src/Icon/Icons/Archive.tsx
+++ b/web/packages/design/src/Icon/Icons/Archive.tsx
@@ -59,11 +59,11 @@ export const Archive = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 6.75C12.75 6.33579 12.4142 6 12 6C11.5858 6 11.25 6.33579 11.25 6.75V12.4393L9.53033 10.7197C9.23744 10.4268 8.76256 10.4268 8.46967 10.7197C8.17678 11.0126 8.17678 11.4874 8.46967 11.7803L11.4697 14.7803C11.5416 14.8522 11.6245 14.9065 11.7129 14.9431C11.8013 14.9798 11.8983 15 12 15C12.1017 15 12.1987 14.9798 12.2871 14.9431C12.3755 14.9065 12.4584 14.8522 12.5303 14.7803L15.5303 11.7803C15.8232 11.4874 15.8232 11.0126 15.5303 10.7197C15.2374 10.4268 14.7626 10.4268 14.4697 10.7197L12.75 12.4393V6.75Z" />
+      <path d="M12.75 6.75a.75.75 0 0 0-1.5 0v5.69l-1.72-1.72a.75.75 0 0 0-1.06 1.06l3 3a.75.75 0 0 0 1.06 0l3-3a.75.75 0 1 0-1.06-1.06l-1.72 1.72z" />
       <path
         fillRule="evenodd"
+        d="M4.5 3A1.5 1.5 0 0 0 3 4.5v15A1.5 1.5 0 0 0 4.5 21h15a1.5 1.5 0 0 0 1.5-1.5v-15A1.5 1.5 0 0 0 19.5 3zm0 16.5v-3.75h2.69L9 17.561c.282.281.663.439 1.06.439h3.88a1.5 1.5 0 0 0 1.06-.439l1.81-1.811h2.69v3.75zm12.31-5.25h2.69V4.5h-15v9.75h2.69c.397 0 .778.158 1.06.439l1.81 1.811h3.88l1.81-1.811c.281-.28.663-.439 1.06-.439"
         clipRule="evenodd"
-        d="M4.5 3C3.67157 3 3 3.67157 3 4.5V19.5C3 20.3284 3.67157 21 4.5 21H19.5C20.3284 21 21 20.3284 21 19.5V4.5C21 3.67157 20.3284 3 19.5 3H4.5ZM4.5 19.5V15.75H7.18934L9.00059 17.5613C9.28168 17.842 9.66302 17.9998 10.0603 18H13.94C14.3373 17.9998 14.7186 17.8417 14.9997 17.561L16.8107 15.75H19.5V19.5H4.5ZM16.8103 14.25H19.5V4.5H4.5V14.25H7.18969C7.58698 14.2502 7.96832 14.408 8.24941 14.6887L10.0607 16.5H13.9393L15.7503 14.689C16.0314 14.4083 16.413 14.2502 16.8103 14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ArrowBack.tsx b/web/packages/design/src/Icon/Icons/ArrowBack.tsx
index 3c083daee01fc..5d040eaf31ab2 100644
--- a/web/packages/design/src/Icon/Icons/ArrowBack.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowBack.tsx
@@ -59,8 +59,7 @@ export const ArrowBack = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.0303 5.78033C11.3232 5.48744 11.3232 5.01256 11.0303 4.71967C10.7374 4.42678 10.2626 4.42678 9.96967 4.71967L3.21967 11.4697C3.07322 11.6161 3 11.8081 3 12C3 12.1017 3.02024 12.1987 3.05691 12.2871C3.09268 12.3735 3.14531 12.4547 3.2148 12.5254" />
-      <path d="M3.22014 12.5308L9.96967 19.2803C10.2626 19.5732 10.7374 19.5732 11.0303 19.2803C11.3232 18.9874 11.3232 18.5126 11.0303 18.2197L5.56066 12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H5.56066L11.0303 5.78033" />
+      <path d="M11.03 5.78a.75.75 0 1 0-1.06-1.06l-6.75 6.75a.75.75 0 0 0-.005 1.055m.005.005 6.75 6.75a.75.75 0 1 0 1.06-1.06l-5.47-5.47h14.69a.75.75 0 0 0 0-1.5H5.56l5.47-5.47" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowDown.tsx b/web/packages/design/src/Icon/Icons/ArrowDown.tsx
index 185cdece515c9..7217995c16875 100644
--- a/web/packages/design/src/Icon/Icons/ArrowDown.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowDown.tsx
@@ -59,7 +59,7 @@ export const ArrowDown = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 3.75C12.75 3.33579 12.4142 3 12 3C11.5858 3 11.25 3.33579 11.25 3.75V18.4393L5.78033 12.9697C5.48744 12.6768 5.01256 12.6768 4.71967 12.9697C4.42678 13.2626 4.42678 13.7374 4.71967 14.0303L11.4697 20.7803C11.5416 20.8522 11.6245 20.9065 11.7129 20.9431C11.7901 20.9751 11.8738 20.9946 11.9614 20.999C11.9742 20.9997 11.9871 21 12 21C12.1919 21 12.3839 20.9268 12.5303 20.7803L19.2803 14.0303C19.5732 13.7374 19.5732 13.2626 19.2803 12.9697C18.9874 12.6768 18.5126 12.6768 18.2197 12.9697L12.75 18.4393V3.75Z" />
+      <path d="M12.75 3.75a.75.75 0 0 0-1.5 0v14.69l-5.47-5.47a.75.75 0 0 0-1.06 1.06l6.75 6.75a.75.75 0 0 0 1.06 0l6.75-6.75a.75.75 0 1 0-1.06-1.06l-5.47 5.47z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowFatLinesUp.tsx b/web/packages/design/src/Icon/Icons/ArrowFatLinesUp.tsx
index 45caeec4808d1..de42df82db72d 100644
--- a/web/packages/design/src/Icon/Icons/ArrowFatLinesUp.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowFatLinesUp.tsx
@@ -61,11 +61,10 @@ export const ArrowFatLinesUp = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M11.47 1.72a.75.75 0 0 1 1.06 0l9 9A.75.75 0 0 1 21 12h-3.75v2.25a.75.75 0 0 1-.75.75h-9a.75.75 0 0 1-.75-.75V12H3a.75.75 0 0 1-.53-1.28zM4.81 10.5H7.5a.75.75 0 0 1 .75.75v2.25h7.5v-2.25a.75.75 0 0 1 .75-.75h2.69L12 3.31z"
         clipRule="evenodd"
-        d="M11.4697 1.71967C11.7626 1.42678 12.2375 1.42678 12.5304 1.71967L21.5304 10.7197C21.7449 10.9342 21.809 11.2568 21.6929 11.537C21.5768 11.8173 21.3034 12 21 12H17.25V14.25C17.25 14.6642 16.9142 15 16.5 15H7.50002C7.08581 15 6.75002 14.6642 6.75002 14.25V12H3.00002C2.69668 12 2.4232 11.8173 2.30711 11.537C2.19103 11.2568 2.25519 10.9342 2.46969 10.7197L11.4697 1.71967ZM4.81068 10.5H7.50002C7.91424 10.5 8.25002 10.8358 8.25002 11.25V13.5H15.75V11.25C15.75 10.8358 16.0858 10.5 16.5 10.5H19.1894L12 3.31066L4.81068 10.5Z"
       />
-      <path d="M6.75 20.25C6.75 19.8358 7.08579 19.5 7.5 19.5H16.5C16.9142 19.5 17.25 19.8358 17.25 20.25C17.25 20.6642 16.9142 21 16.5 21H7.5C7.08579 21 6.75 20.6642 6.75 20.25Z" />
-      <path d="M7.5 16.5C7.08579 16.5 6.75 16.8358 6.75 17.25C6.75 17.6642 7.08579 18 7.5 18H16.5C16.9142 18 17.25 17.6642 17.25 17.25C17.25 16.8358 16.9142 16.5 16.5 16.5H7.5Z" />
+      <path d="M6.75 20.25a.75.75 0 0 1 .75-.75h9a.75.75 0 0 1 0 1.5h-9a.75.75 0 0 1-.75-.75m.75-3.75a.75.75 0 0 0 0 1.5h9a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowForward.tsx b/web/packages/design/src/Icon/Icons/ArrowForward.tsx
index 0453d29fc5774..aef1aec1b74b6 100644
--- a/web/packages/design/src/Icon/Icons/ArrowForward.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowForward.tsx
@@ -59,7 +59,7 @@ export const ArrowForward = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M14.0303 4.71967C13.7374 4.42678 13.2626 4.42678 12.9697 4.71967C12.6768 5.01256 12.6768 5.48744 12.9697 5.78033L18.4393 11.25H3.75C3.33579 11.25 3 11.5858 3 12C3 12.4142 3.33579 12.75 3.75 12.75H18.4393L12.9697 18.2197C12.6768 18.5126 12.6768 18.9874 12.9697 19.2803C13.2626 19.5732 13.7374 19.5732 14.0303 19.2803L20.7803 12.5303C20.9268 12.3839 21 12.1919 21 12C21 11.8983 20.9798 11.8013 20.9431 11.7129C20.9065 11.6245 20.8522 11.5416 20.7803 11.4697L14.0303 4.71967Z" />
+      <path d="M14.03 4.72a.75.75 0 1 0-1.06 1.06l5.47 5.47H3.75a.75.75 0 0 0 0 1.5h14.69l-5.47 5.47a.75.75 0 1 0 1.06 1.06l6.75-6.75a.747.747 0 0 0 0-1.06z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowLeft.tsx b/web/packages/design/src/Icon/Icons/ArrowLeft.tsx
index 7546e06847736..c98c1ac9b7b1d 100644
--- a/web/packages/design/src/Icon/Icons/ArrowLeft.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowLeft.tsx
@@ -59,8 +59,7 @@ export const ArrowLeft = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.0303 5.78033C11.3232 5.48744 11.3232 5.01256 11.0303 4.71967C10.7374 4.42678 10.2626 4.42678 9.96967 4.71967L3.21967 11.4697C3.07322 11.6161 3 11.8081 3 12C3 12.1017 3.02024 12.1987 3.05691 12.2871C3.09268 12.3735 3.14531 12.4547 3.2148 12.5254" />
-      <path d="M3.22014 12.5308L9.96967 19.2803C10.2626 19.5732 10.7374 19.5732 11.0303 19.2803C11.3232 18.9874 11.3232 18.5126 11.0303 18.2197L5.56066 12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H5.56066L11.0303 5.78033" />
+      <path d="M11.03 5.78a.75.75 0 1 0-1.06-1.06l-6.75 6.75a.75.75 0 0 0-.005 1.055m.005.005 6.75 6.75a.75.75 0 1 0 1.06-1.06l-5.47-5.47h14.69a.75.75 0 0 0 0-1.5H5.56l5.47-5.47" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowLineLeft.tsx b/web/packages/design/src/Icon/Icons/ArrowLineLeft.tsx
index b37403bc1694d..5f0ddd9b8c1bf 100644
--- a/web/packages/design/src/Icon/Icons/ArrowLineLeft.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowLineLeft.tsx
@@ -59,8 +59,7 @@ export const ArrowLineLeft = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M4.5 3.75C4.5 3.33579 4.16421 3 3.75 3C3.33579 3 3 3.33579 3 3.75V20.25C3 20.6642 3.33579 21 3.75 21C4.16421 21 4.5 20.6642 4.5 20.25V3.75Z" />
-      <path d="M14.0303 4.71967C13.7374 4.42678 13.2626 4.42678 12.9697 4.71967L6.21967 11.4697C6.14776 11.5416 6.09351 11.6245 6.05691 11.7129C6.02024 11.8013 6 11.8983 6 12C6 12.1919 6.07322 12.3839 6.21967 12.5303L12.9697 19.2803C13.2626 19.5732 13.7374 19.5732 14.0303 19.2803C14.3232 18.9874 14.3232 18.5126 14.0303 18.2197L8.56066 12.75H21.25C21.6642 12.75 22 12.4142 22 12C22 11.5858 21.6642 11.25 21.25 11.25H8.56066L14.0303 5.78033C14.3232 5.48744 14.3232 5.01256 14.0303 4.71967Z" />
+      <path d="M4.5 3.75a.75.75 0 0 0-1.5 0v16.5a.75.75 0 0 0 1.5 0zm9.53.97a.75.75 0 0 0-1.06 0l-6.75 6.75a.75.75 0 0 0 0 1.06l6.75 6.75a.75.75 0 1 0 1.06-1.06l-5.47-5.47h12.69a.75.75 0 0 0 0-1.5H8.56l5.47-5.47a.75.75 0 0 0 0-1.06" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowRight.tsx b/web/packages/design/src/Icon/Icons/ArrowRight.tsx
index 53f102b391611..adba3cff621ea 100644
--- a/web/packages/design/src/Icon/Icons/ArrowRight.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowRight.tsx
@@ -59,7 +59,7 @@ export const ArrowRight = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M14.0303 4.71967C13.7374 4.42678 13.2626 4.42678 12.9697 4.71967C12.6768 5.01256 12.6768 5.48744 12.9697 5.78033L18.4393 11.25H3.75C3.33579 11.25 3 11.5858 3 12C3 12.4142 3.33579 12.75 3.75 12.75H18.4393L12.9697 18.2197C12.6768 18.5126 12.6768 18.9874 12.9697 19.2803C13.2626 19.5732 13.7374 19.5732 14.0303 19.2803L20.7803 12.5303C20.9268 12.3839 21 12.1919 21 12C21 11.8983 20.9798 11.8013 20.9431 11.7129C20.9065 11.6245 20.8522 11.5416 20.7803 11.4697L14.0303 4.71967Z" />
+      <path d="M14.03 4.72a.75.75 0 1 0-1.06 1.06l5.47 5.47H3.75a.75.75 0 0 0 0 1.5h14.69l-5.47 5.47a.75.75 0 1 0 1.06 1.06l6.75-6.75a.747.747 0 0 0 0-1.06z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowSquareIn.tsx b/web/packages/design/src/Icon/Icons/ArrowSquareIn.tsx
index f327282447b91..fe949d5611c6c 100644
--- a/web/packages/design/src/Icon/Icons/ArrowSquareIn.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowSquareIn.tsx
@@ -59,8 +59,8 @@ export const ArrowSquareIn = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M7.5 3C7.10217 3 6.72064 3.15804 6.43934 3.43934C6.15804 3.72064 6 4.10217 6 4.5V9C6 9.41421 6.33579 9.75 6.75 9.75C7.16421 9.75 7.5 9.41421 7.5 9V4.5H19.5V16.5H15C14.5858 16.5 14.25 16.8358 14.25 17.25C14.25 17.6642 14.5858 18 15 18H19.5C19.8978 18 20.2794 17.842 20.5607 17.5607C20.842 17.2794 21 16.8978 21 16.5V4.5C21 4.10218 20.842 3.72065 20.5607 3.43934C20.2794 3.15804 19.8978 3 19.5 3H7.5Z" />
-      <path d="M11.7803 12.2197C11.9363 12.3757 12.0092 12.5833 11.9991 12.7875L12 18.7499C12.0001 19.1641 11.6643 19.4999 11.2501 19.5C10.8359 19.5001 10.5001 19.1643 10.5 18.7501L10.4993 14.5613L4.28033 20.7803C3.98744 21.0732 3.51256 21.0732 3.21967 20.7803C2.92678 20.4874 2.92678 20.0126 3.21967 19.7197L9.43869 13.5007L5.24988 13.5C4.83567 13.4999 4.49994 13.1641 4.5 12.7499C4.50006 12.3357 4.8359 11.9999 5.25012 12L11.2125 12.0009C11.4168 11.9908 11.6243 12.0637 11.7803 12.2197Z" />
+      <path d="M7.5 3A1.5 1.5 0 0 0 6 4.5V9a.75.75 0 0 0 1.5 0V4.5h12v12H15a.75.75 0 0 0 0 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-12A1.5 1.5 0 0 0 19.5 3z" />
+      <path d="M11.78 12.22a.75.75 0 0 1 .22.567v5.963a.75.75 0 0 1-1.5 0v-4.189l-6.22 6.22a.75.75 0 0 1-1.06-1.061l6.219-6.22h-4.19A.75.75 0 0 1 5.25 12h5.963a.75.75 0 0 1 .567.22" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowSquareOut.tsx b/web/packages/design/src/Icon/Icons/ArrowSquareOut.tsx
index b8237a4b8d252..a898295cd2343 100644
--- a/web/packages/design/src/Icon/Icons/ArrowSquareOut.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowSquareOut.tsx
@@ -61,8 +61,8 @@ export const ArrowSquareOut = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M13.5 3.75a.75.75 0 0 1 .75-.75h5.962a.75.75 0 0 1 .787.787L21 9.75a.75.75 0 0 1-1.5 0V5.561l-6.22 6.22a.75.75 0 1 1-1.06-1.061l6.219-6.22h-4.19a.75.75 0 0 1-.749-.75M4.5 6A1.5 1.5 0 0 0 3 7.5v12A1.5 1.5 0 0 0 4.5 21h12a1.5 1.5 0 0 0 1.5-1.5v-6.75a.75.75 0 0 0-1.5 0v6.75h-12v-12h6.75a.75.75 0 0 0 0-1.5z"
         clipRule="evenodd"
-        d="M13.5 3.74988C13.5001 3.33567 13.8359 2.99994 14.2501 3L20.2125 3.00093C20.4167 2.99077 20.6243 3.06369 20.7803 3.21967C20.9363 3.37565 21.0092 3.58324 20.9991 3.78747L21 9.74988C21.0001 10.1641 20.6643 10.4999 20.2501 10.5C19.8359 10.5001 19.5001 10.1643 19.5 9.75012L19.4993 5.56132L13.2803 11.7803C12.9874 12.0732 12.5126 12.0732 12.2197 11.7803C11.9268 11.4874 11.9268 11.0126 12.2197 10.7197L18.4387 4.50065L14.2499 4.5C13.8357 4.49994 13.4999 4.1641 13.5 3.74988ZM4.5 6C4.10217 6 3.72064 6.15804 3.43934 6.43934C3.15804 6.72064 3 7.10217 3 7.5V19.5C3 19.8978 3.15804 20.2794 3.43934 20.5607C3.72065 20.842 4.10218 21 4.5 21H16.5C16.8978 21 17.2794 20.842 17.5607 20.5607C17.842 20.2794 18 19.8978 18 19.5V12.75C18 12.3358 17.6642 12 17.25 12C16.8358 12 16.5 12.3358 16.5 12.75V19.5H4.5L4.5 7.5H11.25C11.6642 7.5 12 7.16421 12 6.75C12 6.33579 11.6642 6 11.25 6H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ArrowUp.tsx b/web/packages/design/src/Icon/Icons/ArrowUp.tsx
index 348883c5c463d..b93c9c4a0861a 100644
--- a/web/packages/design/src/Icon/Icons/ArrowUp.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowUp.tsx
@@ -59,7 +59,7 @@ export const ArrowUp = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.419 3.27032C11.438 3.24878 11.4582 3.22866 11.4796 3.20995C11.7698 2.93002 12.2302 2.93002 12.5204 3.20995C12.5418 3.22866 12.562 3.24878 12.581 3.27032L19.2803 9.96967C19.5732 10.2626 19.5732 10.7374 19.2803 11.0303C18.9874 11.3232 18.5126 11.3232 18.2197 11.0303L12.75 5.56066V20.2499C12.75 20.6641 12.4142 20.9999 12 20.9999C11.5858 20.9999 11.25 20.6641 11.25 20.2499V5.56066L5.78033 11.0303C5.48744 11.3232 5.01256 11.3232 4.71967 11.0303C4.42678 10.7374 4.42678 10.2626 4.71967 9.96967L11.419 3.27032Z" />
+      <path d="m11.419 3.27.06-.06a.75.75 0 0 1 1.041 0l.061.06 6.7 6.7a.75.75 0 1 1-1.061 1.06l-5.47-5.47v14.69a.75.75 0 0 1-1.5 0V5.56l-5.47 5.47a.75.75 0 1 1-1.06-1.06z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowsIn.tsx b/web/packages/design/src/Icon/Icons/ArrowsIn.tsx
index e07e1dff510cb..f2103d8b1d823 100644
--- a/web/packages/design/src/Icon/Icons/ArrowsIn.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowsIn.tsx
@@ -59,7 +59,7 @@ export const ArrowsIn = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M4.201 3.823a.93.93 0 0 0-.214.129c-.212.191-.29.605-.163.86.035.07.975 1.041 2.09 2.158L7.94 9l-1.04.001c-.922.001-1.058.009-1.202.074-.33.15-.512.505-.425.83.067.25.15.362.363.487l.184.108h2.06c1.863 0 2.072-.007 2.184-.068.16-.088.366-.323.405-.463.017-.06.031-1.018.031-2.129V5.82l-.1-.174c-.246-.43-.858-.512-1.188-.159C9.016 5.696 9 5.806 9 6.909V7.94L6.97 5.911c-1.401-1.4-2.076-2.047-2.179-2.09a.778.778 0 0 0-.59.002m14.999 0c-.089.038-.883.803-2.17 2.088L15 7.94V6.909c0-1.103-.016-1.213-.212-1.422-.33-.353-.942-.271-1.188.159l-.1.174v2.06c0 1.863.007 2.072.068 2.184.088.16.323.366.463.405.06.017 1.018.031 2.129.031h2.02l.184-.108c.42-.247.513-.752.207-1.116-.216-.256-.313-.274-1.471-.275L16.06 9l2.029-2.03c1.4-1.401 2.047-2.076 2.09-2.179.113-.275.038-.66-.165-.839a.815.815 0 0 0-.814-.129M5.595 13.635a.73.73 0 0 0 .103 1.29c.144.065.28.073 1.202.074L7.94 15l-2.026 2.03c-1.115 1.116-2.055 2.088-2.09 2.158-.127.255-.049.669.163.86a.799.799 0 0 0 .804.131c.103-.043.778-.69 2.179-2.09L9 16.06l.001 1.04c.001.922.009 1.058.074 1.202.15.33.505.512.83.425.25-.067.362-.15.487-.363l.108-.184v-2.02c0-1.111-.014-2.069-.031-2.129-.042-.152-.262-.392-.417-.457-.103-.043-.552-.054-2.203-.054H5.776l-.181.115m8.303-.04c-.156.095-.33.302-.368.438-.017.059-.03 1.016-.03 2.127v2.02l.108.184c.247.42.752.513 1.116.207.256-.216.274-.313.275-1.471L15 16.06l2.03 2.029c1.401 1.4 2.076 2.047 2.179 2.09.275.113.66.038.839-.165a.802.802 0 0 0 .131-.805c-.043-.103-.69-.778-2.09-2.179L16.06 15l1.04-.001c.922-.001 1.058-.009 1.202-.074a.73.73 0 0 0 .103-1.29l-.181-.115h-2.102c-1.977 0-2.109.005-2.224.075" />
+      <path d="M4.201 3.823a1 1 0 0 0-.214.129c-.212.191-.29.605-.163.86.035.07.975 1.041 2.09 2.158L7.94 9l-1.04.001c-.922.001-1.058.009-1.202.074-.33.15-.512.505-.425.83.067.25.15.362.363.487l.184.108h2.06c1.863 0 2.072-.007 2.184-.068.16-.088.366-.323.405-.463.017-.06.031-1.018.031-2.129V5.82l-.1-.174c-.246-.43-.858-.512-1.188-.159C9.016 5.696 9 5.806 9 6.909V7.94L6.97 5.911c-1.401-1.4-2.076-2.047-2.179-2.09a.78.78 0 0 0-.59.002m14.999 0c-.089.038-.883.803-2.17 2.088L15 7.94V6.909c0-1.103-.016-1.213-.212-1.422-.33-.353-.942-.271-1.188.159l-.1.174v2.06c0 1.863.007 2.072.068 2.184.088.16.323.366.463.405.06.017 1.018.031 2.129.031h2.02l.184-.108c.42-.247.513-.752.207-1.116-.216-.256-.313-.274-1.471-.275L16.06 9l2.029-2.03c1.4-1.401 2.047-2.076 2.09-2.179.113-.275.038-.66-.165-.839a.82.82 0 0 0-.814-.129M5.595 13.635a.73.73 0 0 0 .103 1.29c.144.065.28.073 1.202.074L7.94 15l-2.026 2.03c-1.115 1.116-2.055 2.088-2.09 2.158-.127.255-.049.669.163.86a.8.8 0 0 0 .804.131c.103-.043.778-.69 2.179-2.09L9 16.06l.001 1.04c.001.922.009 1.058.074 1.202.15.33.505.512.83.425.25-.067.362-.15.487-.363l.108-.184v-2.02c0-1.111-.014-2.069-.031-2.129-.042-.152-.262-.392-.417-.457-.103-.043-.552-.054-2.203-.054H5.776zm8.303-.04c-.156.095-.33.302-.368.438-.017.059-.03 1.016-.03 2.127v2.02l.108.184c.247.42.752.513 1.116.207.256-.216.274-.313.275-1.471L15 16.06l2.03 2.029c1.401 1.4 2.076 2.047 2.179 2.09.275.113.66.038.839-.165a.8.8 0 0 0 .131-.805c-.043-.103-.69-.778-2.09-2.179L16.06 15l1.04-.001c.922-.001 1.058-.009 1.202-.074a.73.73 0 0 0 .103-1.29l-.181-.115h-2.102c-1.977 0-2.109.005-2.224.075" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ArrowsOut.tsx b/web/packages/design/src/Icon/Icons/ArrowsOut.tsx
index 1aad6fa766e9f..034b2aa720910 100644
--- a/web/packages/design/src/Icon/Icons/ArrowsOut.tsx
+++ b/web/packages/design/src/Icon/Icons/ArrowsOut.tsx
@@ -59,7 +59,7 @@ export const ArrowsOut = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M4.18 3.827a.696.696 0 0 0-.344.341c-.072.141-.076.273-.076 2.568 0 1.612.014 2.456.043 2.531.093.249.438.491.697.491.259 0 .604-.242.697-.491.028-.071.043-.628.043-1.539V6.302l2.07 2.065c1.991 1.986 2.077 2.066 2.261 2.104.195.04.383.018.534-.063.129-.069.331-.317.358-.439.013-.06.03-.129.037-.153a.904.904 0 0 0-.028-.24c-.039-.19-.102-.258-2.105-2.266L6.302 5.24h1.426c.911 0 1.468-.015 1.539-.043.249-.093.491-.438.491-.697 0-.259-.242-.604-.491-.697-.075-.029-.918-.042-2.54-.041-2.136.001-2.441.009-2.547.065m10.52-.01c-.24.107-.461.44-.459.692.002.252.247.596.492.688.071.028.628.043 1.539.043h1.426l-2.065 2.07c-1.986 1.991-2.066 2.077-2.104 2.261a.791.791 0 0 0 .063.534c.069.129.317.331.439.358.06.013.129.03.153.037a.904.904 0 0 0 .24-.028c.19-.039.258-.102 2.266-2.105l2.07-2.065v1.426c0 .911.015 1.468.043 1.539.093.249.438.491.697.491.259 0 .604-.242.697-.491.029-.075.043-.919.043-2.531 0-2.295-.004-2.427-.076-2.568a.635.635 0 0 0-.374-.346c-.127-.054-.477-.062-2.559-.06-1.925.001-2.435.012-2.531.055m-5.28 9.769c-.066.034-1.033.974-2.15 2.088L5.24 17.7v-1.428c0-.911-.015-1.468-.043-1.539a.75.75 0 0 0-.697-.464.75.75 0 0 0-.697.464c-.029.075-.043.919-.043 2.531 0 2.295.004 2.427.076 2.568.086.169.17.251.352.343.114.058.396.065 2.547.065 1.613 0 2.457-.014 2.532-.043.249-.093.491-.438.491-.697 0-.259-.242-.604-.491-.697-.071-.028-.628-.043-1.539-.043H6.302l2.065-2.07c2.003-2.008 2.066-2.076 2.105-2.266a.904.904 0 0 0 .028-.24 3.046 3.046 0 0 1-.037-.153c-.029-.134-.235-.374-.387-.453-.146-.076-.504-.072-.656.008m4.52-.019c-.335.184-.486.501-.411.862.038.184.118.27 2.104 2.261l2.065 2.07h-1.426c-.911 0-1.468.015-1.539.043-.249.093-.491.438-.491.697 0 .259.242.604.491.697.075.029.919.043 2.531.043 2.295 0 2.427-.004 2.568-.076a.682.682 0 0 0 .343-.352c.058-.114.065-.396.065-2.547 0-1.613-.014-2.457-.043-2.532a.75.75 0 0 0-.697-.464.75.75 0 0 0-.697.464c-.028.071-.043.628-.043 1.539V17.7l-2.03-2.026c-1.116-1.115-2.088-2.055-2.158-2.09-.146-.073-.513-.083-.632-.017" />
+      <path d="M4.18 3.827a.7.7 0 0 0-.344.341c-.072.141-.076.273-.076 2.568q0 2.418.043 2.531c.093.249.438.491.697.491s.604-.242.697-.491c.028-.071.043-.628.043-1.539V6.302l2.07 2.065c1.991 1.986 2.077 2.066 2.261 2.104.195.04.383.018.534-.063.129-.069.331-.317.358-.439.013-.06.03-.129.037-.153a1 1 0 0 0-.028-.24c-.039-.19-.102-.258-2.105-2.266L6.302 5.24h1.426c.911 0 1.468-.015 1.539-.043.249-.093.491-.438.491-.697s-.242-.604-.491-.697c-.075-.029-.918-.042-2.54-.041-2.136.001-2.441.009-2.547.065m10.52-.01c-.24.107-.461.44-.459.692s.247.596.492.688c.071.028.628.043 1.539.043h1.426l-2.065 2.07c-1.986 1.991-2.066 2.077-2.104 2.261a.8.8 0 0 0 .063.534c.069.129.317.331.439.358.06.013.129.03.153.037a1 1 0 0 0 .24-.028c.19-.039.258-.102 2.266-2.105l2.07-2.065v1.426c0 .911.015 1.468.043 1.539.093.249.438.491.697.491s.604-.242.697-.491q.043-.113.043-2.531c0-2.295-.004-2.427-.076-2.568a.64.64 0 0 0-.374-.346c-.127-.054-.477-.062-2.559-.06-1.925.001-2.435.012-2.531.055m-5.28 9.769c-.066.034-1.033.974-2.15 2.088L5.24 17.7v-1.428c0-.911-.015-1.468-.043-1.539a.75.75 0 0 0-.697-.464.75.75 0 0 0-.697.464q-.043.113-.043 2.531c0 2.295.004 2.427.076 2.568.086.169.17.251.352.343.114.058.396.065 2.547.065q2.42 0 2.532-.043c.249-.093.491-.438.491-.697s-.242-.604-.491-.697c-.071-.028-.628-.043-1.539-.043H6.302l2.065-2.07c2.003-2.008 2.066-2.076 2.105-2.266a1 1 0 0 0 .028-.24 3 3 0 0 1-.037-.153c-.029-.134-.235-.374-.387-.453-.146-.076-.504-.072-.656.008m4.52-.019c-.335.184-.486.501-.411.862.038.184.118.27 2.104 2.261l2.065 2.07h-1.426c-.911 0-1.468.015-1.539.043-.249.093-.491.438-.491.697s.242.604.491.697q.113.043 2.531.043c2.295 0 2.427-.004 2.568-.076a.68.68 0 0 0 .343-.352c.058-.114.065-.396.065-2.547q0-2.42-.043-2.532a.75.75 0 0 0-.697-.464.75.75 0 0 0-.697.464c-.028.071-.043.628-.043 1.539V17.7l-2.03-2.026c-1.116-1.115-2.088-2.055-2.158-2.09-.146-.073-.513-.083-.632-.017" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/BellRinging.tsx b/web/packages/design/src/Icon/Icons/BellRinging.tsx
index 3a54175c3f896..32a4b63eb261f 100644
--- a/web/packages/design/src/Icon/Icons/BellRinging.tsx
+++ b/web/packages/design/src/Icon/Icons/BellRinging.tsx
@@ -59,13 +59,13 @@ export const BellRinging = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M17.6535 1.61784C17.3043 1.39503 16.8406 1.49748 16.6178 1.84667C16.395 2.19586 16.4975 2.65955 16.8467 2.88235C18.1822 3.73448 19.2653 4.9284 19.9839 6.34027C20.1717 6.70942 20.6233 6.85638 20.9925 6.66851C21.3616 6.48064 21.5086 6.02908 21.3207 5.65992C20.4808 4.00954 19.2146 2.61393 17.6535 1.61784Z" />
+      <path d="M17.654 1.618a.75.75 0 1 0-.807 1.264 8.9 8.9 0 0 1 3.137 3.458.75.75 0 1 0 1.337-.68 10.4 10.4 0 0 0-3.668-4.042" />
       <path
         fillRule="evenodd"
+        d="M8.326 18.75h-3.83a1.5 1.5 0 0 1-1.29-2.25c.548-.949 1.294-2.767 1.294-6a7.5 7.5 0 0 1 15 0c0 3.233.747 5.05 1.296 6a1.5 1.5 0 0 1-.545 2.047 1.5 1.5 0 0 1-.748.203h-3.829a3.749 3.749 0 0 1-7.348 0m.676-1.5H4.504C5.192 16.061 6 13.982 6 10.5a6 6 0 1 1 12 0c0 3.482.809 5.56 1.497 6.75zm5.12 1.5a2.25 2.25 0 0 1-4.243 0z"
         clipRule="evenodd"
-        d="M8.32575 18.75H4.49537C4.23284 18.7484 3.97531 18.6779 3.74853 18.5457C3.52176 18.4134 3.33368 18.2239 3.2031 17.9961C3.07251 17.7683 3.004 17.5103 3.0044 17.2477C3.0048 16.9852 3.0741 16.7274 3.20537 16.5C3.75374 15.5514 4.49988 13.7325 4.49988 10.5C4.49988 8.51088 5.29006 6.60322 6.69658 5.1967C8.1031 3.79018 10.0108 3 11.9999 3C13.989 3 15.8967 3.79018 17.3032 5.1967C18.7097 6.60322 19.4999 8.51088 19.4999 10.5C19.4999 13.7333 20.2467 15.5507 20.7958 16.4992C20.9273 16.7269 20.997 16.9858 20.9972 17.2487C20.9975 17.5115 20.9286 17.7698 20.7976 17.9977C20.6666 18.2256 20.478 18.415 20.2507 18.5471C20.0234 18.6791 19.7654 18.7491 19.5025 18.75L19.4999 18.75H15.6742C15.5283 19.4651 15.1754 20.1279 14.6516 20.6516C13.9484 21.3549 12.9946 21.75 12 21.75C11.0054 21.75 10.0516 21.3549 9.34835 20.6516C8.82456 20.1279 8.47173 19.4651 8.32575 18.75ZM9.00162 17.25L9 17.25L8.99838 17.25L4.5044 17.25C5.19161 16.0611 5.99988 13.9815 5.99988 10.5C5.99988 8.9087 6.63202 7.38258 7.75724 6.25736C8.88246 5.13214 10.4086 4.5 11.9999 4.5C13.5912 4.5 15.1173 5.13214 16.2425 6.25736C17.3677 7.38258 17.9999 8.9087 17.9999 10.5C17.9999 13.9822 18.809 16.0609 19.4972 17.25L15.0025 17.25L15 17.25L14.9975 17.25L9.00162 17.25ZM14.1213 18.75C14.0105 19.0634 13.8305 19.3514 13.591 19.591C13.169 20.0129 12.5967 20.25 12 20.25C11.4033 20.25 10.831 20.0129 10.409 19.591C10.1695 19.3514 9.9895 19.0634 9.87868 18.75H14.1213Z"
       />
-      <path d="M7.38226 1.84667C7.60507 2.19586 7.50261 2.65955 7.15343 2.88235C5.81794 3.73448 4.73476 4.9284 4.01623 6.34027C3.82836 6.70942 3.3768 6.85638 3.00764 6.66851C2.63849 6.48064 2.49153 6.02908 2.6794 5.65992C3.51931 4.00954 4.78548 2.61393 6.34658 1.61784C6.69577 1.39503 7.15946 1.49748 7.38226 1.84667Z" />
+      <path d="M7.382 1.847a.75.75 0 0 1-.229 1.035A8.9 8.9 0 0 0 4.016 6.34a.75.75 0 0 1-1.337-.68 10.4 10.4 0 0 1 3.668-4.042.75.75 0 0 1 1.035.229" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/BookOpenText.tsx b/web/packages/design/src/Icon/Icons/BookOpenText.tsx
index 390229125f213..5255690304005 100644
--- a/web/packages/design/src/Icon/Icons/BookOpenText.tsx
+++ b/web/packages/design/src/Icon/Icons/BookOpenText.tsx
@@ -59,13 +59,11 @@ export const BookOpenText = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M15 7.25C14.5858 7.25 14.25 7.58579 14.25 8C14.25 8.41421 14.5858 8.75 15 8.75H18.75C19.1642 8.75 19.5 8.41421 19.5 8C19.5 7.58579 19.1642 7.25 18.75 7.25H15Z" />
-      <path d="M14.25 11C14.25 10.5858 14.5858 10.25 15 10.25H18.75C19.1642 10.25 19.5 10.5858 19.5 11C19.5 11.4142 19.1642 11.75 18.75 11.75H15C14.5858 11.75 14.25 11.4142 14.25 11Z" />
-      <path d="M15 13.25C14.5858 13.25 14.25 13.5858 14.25 14C14.25 14.4142 14.5858 14.75 15 14.75H18.75C19.1642 14.75 19.5 14.4142 19.5 14C19.5 13.5858 19.1642 13.25 18.75 13.25H15Z" />
+      <path d="M15 7.25a.75.75 0 0 0 0 1.5h3.75a.75.75 0 0 0 0-1.5zM14.25 11a.75.75 0 0 1 .75-.75h3.75a.75.75 0 0 1 0 1.5H15a.75.75 0 0 1-.75-.75m.75 2.25a.75.75 0 0 0 0 1.5h3.75a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M1.94 3.94A1.5 1.5 0 0 1 3 3.5h6A3.75 3.75 0 0 1 12 5a3.75 3.75 0 0 1 3-1.5h6A1.5 1.5 0 0 1 22.5 5v12a1.5 1.5 0 0 1-1.5 1.5h-6a2.25 2.25 0 0 0-2.25 2.25.75.75 0 0 1-1.5 0A2.25 2.25 0 0 0 9 18.5H3A1.5 1.5 0 0 1 1.5 17V5c0-.398.158-.78.44-1.06m10.81 13.81V7.25A2.25 2.25 0 0 1 15 5h6v12h-6a3.75 3.75 0 0 0-2.25.75M10.591 5.659c.422.422.659.994.659 1.591v10.5A3.75 3.75 0 0 0 9 17H3V5h6a2.25 2.25 0 0 1 1.591.659"
         clipRule="evenodd"
-        d="M1.93934 3.93934C2.22064 3.65804 2.60217 3.5 3 3.5H9C9.99456 3.5 10.9484 3.89509 11.6517 4.59835C11.7779 4.72456 11.8941 4.85884 12 4.99998C12.1059 4.85884 12.2221 4.72456 12.3484 4.59835C13.0516 3.89509 14.0054 3.5 15 3.5H21C21.3978 3.5 21.7794 3.65804 22.0607 3.93934C22.342 4.22065 22.5 4.60218 22.5 5V17C22.5 17.3978 22.342 17.7794 22.0607 18.0607C21.7794 18.342 21.3978 18.5 21 18.5H15C14.4033 18.5 13.831 18.7371 13.409 19.159C12.9871 19.581 12.75 20.1533 12.75 20.75C12.75 21.1642 12.4142 21.5 12 21.5C11.5858 21.5 11.25 21.1642 11.25 20.75C11.25 20.1533 11.0129 19.581 10.591 19.159C10.169 18.7371 9.59674 18.5 9 18.5H3C2.60218 18.5 2.22065 18.342 1.93934 18.0607C1.65803 17.7794 1.5 17.3978 1.5 17V5C1.5 4.60218 1.65804 4.22064 1.93934 3.93934ZM12.75 17.75V7.25C12.75 6.65326 12.9871 6.08097 13.409 5.65901C13.831 5.23705 14.4033 5 15 5L21 5V17H15C14.1839 17 13.3953 17.266 12.75 17.75ZM10.591 5.65901C11.0129 6.08097 11.25 6.65326 11.25 7.25V17.75C10.6047 17.266 9.81606 17 9 17H3V5L9 5C9.59674 5 10.169 5.23705 10.591 5.65901Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Bots.tsx b/web/packages/design/src/Icon/Icons/Bots.tsx
index 130d566fef584..5a64c208330e5 100644
--- a/web/packages/design/src/Icon/Icons/Bots.tsx
+++ b/web/packages/design/src/Icon/Icons/Bots.tsx
@@ -61,15 +61,14 @@ export const Bots = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M8.625 18h6.75a2.625 2.625 0 0 0 0-5.25h-6.75a2.625 2.625 0 0 0 0 5.25m0-3.75a1.125 1.125 0 0 0 0 2.25H9.75v-2.25zm5.625 2.25h1.125a1.125 1.125 0 0 0 0-2.25H14.25zm-3-2.25v2.25h1.5v-2.25z"
         clipRule="evenodd"
-        d="M8.625 18H15.375C16.8247 18 18 16.8247 18 15.375C18 13.9253 16.8247 12.75 15.375 12.75H8.625C7.17525 12.75 6 13.9253 6 15.375C6 16.8247 7.17525 18 8.625 18ZM8.625 14.25C8.00368 14.25 7.5 14.7537 7.5 15.375C7.5 15.9963 8.00368 16.5 8.625 16.5H9.75V14.25H8.625ZM14.25 16.5H15.375C15.9963 16.5 16.5 15.9963 16.5 15.375C16.5 14.7537 15.9963 14.25 15.375 14.25H14.25V16.5ZM11.25 14.25V16.5H12.75V14.25H11.25Z"
       />
-      <path d="M7.875 11.0625C8.39277 11.0625 8.8125 10.6428 8.8125 10.125C8.8125 9.60723 8.39277 9.1875 7.875 9.1875C7.35723 9.1875 6.9375 9.60723 6.9375 10.125C6.9375 10.6428 7.35723 11.0625 7.875 11.0625Z" />
-      <path d="M17.0625 10.125C17.0625 10.6428 16.6428 11.0625 16.125 11.0625C15.6072 11.0625 15.1875 10.6428 15.1875 10.125C15.1875 9.60723 15.6072 9.1875 16.125 9.1875C16.6428 9.1875 17.0625 9.60723 17.0625 10.125Z" />
+      <path d="M7.875 11.063a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.874m9.188-.937a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M12.75 1.5a.75.75 0 0 0-1.5 0v3h-6a3 3 0 0 0-3 3V18a3 3 0 0 0 3 3h13.5a3 3 0 0 0 3-3V7.5a3 3 0 0 0-3-3h-6zM5.25 6a1.5 1.5 0 0 0-1.5 1.5V18a1.5 1.5 0 0 0 1.5 1.5h13.5a1.5 1.5 0 0 0 1.5-1.5V7.5a1.5 1.5 0 0 0-1.5-1.5z"
         clipRule="evenodd"
-        d="M12.75 1.5C12.75 1.08579 12.4142 0.75 12 0.75C11.5858 0.75 11.25 1.08579 11.25 1.5V4.5H5.25C3.59315 4.5 2.25 5.84315 2.25 7.5V18C2.25 19.6569 3.59315 21 5.25 21H18.75C20.4069 21 21.75 19.6569 21.75 18V7.5C21.75 5.84315 20.4069 4.5 18.75 4.5H12.75V1.5ZM5.25 6C4.42157 6 3.75 6.67157 3.75 7.5V18C3.75 18.8284 4.42157 19.5 5.25 19.5H18.75C19.5784 19.5 20.25 18.8284 20.25 18V7.5C20.25 6.67157 19.5784 6 18.75 6H5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Broadcast.tsx b/web/packages/design/src/Icon/Icons/Broadcast.tsx
index 903cee7d5cf57..6e7193ba64d1f 100644
--- a/web/packages/design/src/Icon/Icons/Broadcast.tsx
+++ b/web/packages/design/src/Icon/Icons/Broadcast.tsx
@@ -59,14 +59,12 @@ export const Broadcast = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M5.03521 5.17777C5.32539 4.8822 5.32102 4.40734 5.02545 4.11716C4.72987 3.82697 4.25502 3.83134 3.96483 4.12692C1.90172 6.22834 0.74585 9.05558 0.74585 12.0005C0.74585 14.9454 1.90172 17.7726 3.96483 19.874C4.25502 20.1696 4.72987 20.174 5.02545 19.8838C5.32102 19.5936 5.32539 19.1187 5.03521 18.8232C3.24745 17.0022 2.24585 14.5523 2.24585 12.0005C2.24585 9.44862 3.24745 6.99872 5.03521 5.17777Z" />
-      <path d="M18.9746 4.11716C19.2701 3.82697 19.745 3.83134 20.0352 4.12692C22.0983 6.22834 23.2542 9.05558 23.2542 12.0005C23.2542 14.9454 22.0983 17.7726 20.0352 19.874C19.745 20.1696 19.2701 20.174 18.9746 19.8838C18.679 19.5936 18.6746 19.1187 18.9648 18.8232C20.7526 17.0022 21.7542 14.5523 21.7542 12.0005C21.7542 9.44862 20.7526 6.99872 18.9648 5.17777C18.6746 4.8822 18.679 4.40734 18.9746 4.11716Z" />
-      <path d="M7.52697 8.00042C7.80335 7.69189 7.77728 7.21774 7.46875 6.94136C7.16022 6.66499 6.68606 6.69106 6.40969 6.99959C5.17841 8.37413 4.49756 10.1546 4.49756 12C4.49756 13.8454 5.17841 15.6259 6.40969 17.0004C6.68606 17.309 7.16022 17.335 7.46875 17.0587C7.77728 16.7823 7.80335 16.3081 7.52697 15.9996C6.54214 14.9002 5.99756 13.476 5.99756 12C5.99756 10.524 6.54214 9.09985 7.52697 8.00042Z" />
-      <path d="M16.5311 6.94136C16.8396 6.66499 17.3138 6.69106 17.5901 6.99959C18.8214 8.37413 19.5023 10.1546 19.5023 12C19.5023 13.8454 18.8214 15.6259 17.5901 17.0004C17.3138 17.309 16.8396 17.335 16.5311 17.0587C16.2226 16.7823 16.1965 16.3081 16.4729 15.9996C17.4577 14.9002 18.0023 13.476 18.0023 12C18.0023 10.524 17.4577 9.09985 16.4729 8.00042C16.1965 7.69189 16.2226 7.21774 16.5311 6.94136Z" />
+      <path d="M5.035 5.178a.75.75 0 0 0-1.07-1.051 11.24 11.24 0 0 0 0 15.747.75.75 0 1 0 1.07-1.05 9.74 9.74 0 0 1 0-13.646m13.94-1.061a.75.75 0 0 1 1.06.01 11.24 11.24 0 0 1 0 15.747.75.75 0 1 1-1.07-1.05 9.74 9.74 0 0 0 0-13.646.75.75 0 0 1 .01-1.06" />
+      <path d="M7.527 8A.75.75 0 1 0 6.41 7a7.494 7.494 0 0 0 0 10 .75.75 0 1 0 1.117-1 5.994 5.994 0 0 1 0-8m9.004-1.059a.75.75 0 0 1 1.06.059 7.494 7.494 0 0 1 0 10 .75.75 0 1 1-1.118-1 5.995 5.995 0 0 0 0-8 .75.75 0 0 1 .058-1.059" />
       <path
         fillRule="evenodd"
+        d="M8.25 12a3.75 3.75 0 1 1 7.5 0 3.75 3.75 0 0 1-7.5 0M12 9.75a2.25 2.25 0 1 0 0 4.5 2.25 2.25 0 0 0 0-4.5"
         clipRule="evenodd"
-        d="M8.25 12C8.25 9.92893 9.92893 8.25 12 8.25C14.0711 8.25 15.75 9.92893 15.75 12C15.75 14.0711 14.0711 15.75 12 15.75C9.92893 15.75 8.25 14.0711 8.25 12ZM12 9.75C10.7574 9.75 9.75 10.7574 9.75 12C9.75 13.2426 10.7574 14.25 12 14.25C13.2426 14.25 14.25 13.2426 14.25 12C14.25 10.7574 13.2426 9.75 12 9.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/BroadcastSlash.tsx b/web/packages/design/src/Icon/Icons/BroadcastSlash.tsx
index ab8e6327b4c29..09c9a5a3f7ab8 100644
--- a/web/packages/design/src/Icon/Icons/BroadcastSlash.tsx
+++ b/web/packages/design/src/Icon/Icons/BroadcastSlash.tsx
@@ -61,12 +61,11 @@ export const BroadcastSlash = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.06 1.94A.75.75 0 1 0 2 3l1.56 1.56a11.24 11.24 0 0 0 .405 15.314.75.75 0 1 0 1.07-1.05 9.74 9.74 0 0 1-.411-13.2L6.22 7.22A7.494 7.494 0 0 0 6.41 17a.75.75 0 0 0 1.117-1 5.995 5.995 0 0 1-.24-7.714l1.609 1.61a3.75 3.75 0 0 0 5.208 5.208L21 22a.75.75 0 0 0 1.06-1.06zm9.95 12.07-3.02-3.02a2.25 2.25 0 0 0 3.022 3.022"
         clipRule="evenodd"
-        d="M3.0606 1.9394C2.76771 1.6465 2.29284 1.6465 1.99994 1.9394C1.70705 2.23229 1.70705 2.70716 1.99994 3.00006L3.56067 4.56078C1.75137 6.60933 0.74585 9.25367 0.74585 12.0004C0.74585 14.9452 1.90172 17.7725 3.96483 19.8739C4.25502 20.1695 4.72987 20.1739 5.02545 19.8837C5.32102 19.5935 5.32539 19.1186 5.03521 18.8231C3.24745 17.0021 2.24585 14.5522 2.24585 12.0004C2.24585 9.65146 3.09447 7.38894 4.62368 5.6238L6.2198 7.21991C5.1086 8.56169 4.49756 10.2517 4.49756 11.9999C4.49756 13.8453 5.17841 15.6258 6.40969 17.0003C6.68606 17.3088 7.16022 17.3349 7.46875 17.0585C7.77728 16.7822 7.80335 16.308 7.52697 15.9995C6.54214 14.9 5.99756 13.4759 5.99756 11.9999C5.99756 10.6489 6.45381 9.3413 7.28632 8.28643L8.89555 9.89566C8.48843 10.4955 8.25 11.2201 8.25 11.9997C8.25 14.0707 9.92893 15.7497 12 15.7497C12.7795 15.7497 13.5042 15.5112 14.104 15.1041L20.9999 22.0001C21.2928 22.2929 21.7677 22.2929 22.0606 22.0001C22.3535 21.7072 22.3535 21.2323 22.0606 20.9394L3.0606 1.9394ZM13.0106 14.0107L9.98897 10.9891C9.83593 11.2929 9.75 11.636 9.75 11.9997C9.75 13.2423 10.7574 14.2497 12 14.2497C12.3637 14.2497 12.7068 14.1637 13.0106 14.0107Z"
       />
-      <path d="M20.0352 4.1268C19.745 3.83123 19.2701 3.82686 18.9746 4.11704C18.679 4.40723 18.6746 4.88208 18.9648 5.17766C20.7526 6.99861 21.7542 9.44851 21.7542 12.0004C21.7542 13.5527 21.3835 15.0673 20.6907 16.4256C20.5025 16.7946 20.649 17.2463 21.018 17.4345C21.387 17.6227 21.8387 17.4762 22.0269 17.1072C22.8264 15.5398 23.2542 13.7918 23.2542 12.0004C23.2542 9.05546 22.0983 6.22822 20.0352 4.1268Z" />
-      <path d="M17.5901 6.99948C17.3138 6.69095 16.8396 6.66488 16.5311 6.94125C16.2226 7.21762 16.1965 7.69178 16.4729 8.00031C17.4577 9.09974 18.0023 10.5239 18.0023 11.9999C18.0023 12.6076 17.91 13.2064 17.7326 13.7775C17.6098 14.1731 17.8309 14.5933 18.2265 14.7162C18.6221 14.839 19.0423 14.6179 19.1652 14.2223C19.3869 13.5084 19.5023 12.7596 19.5023 11.9999C19.5023 10.1545 18.8214 8.37402 17.5901 6.99948Z" />
-      <path d="M12.954 8.37229C12.5534 8.26715 12.1433 8.5067 12.0382 8.90735C11.9331 9.308 12.1726 9.71802 12.5733 9.82316C13.3876 10.0369 14.0227 10.6976 14.2001 11.5253C14.2868 11.9303 14.6855 12.1883 15.0905 12.1015C15.4956 12.0147 15.7535 11.6161 15.6668 11.211C15.3704 9.82755 14.3134 8.72904 12.954 8.37229Z" />
+      <path d="M20.035 4.127a.75.75 0 0 0-1.07 1.05 9.74 9.74 0 0 1 1.726 11.249.75.75 0 1 0 1.336.681 11.24 11.24 0 0 0-1.992-12.98" />
+      <path d="M17.59 7a.75.75 0 1 0-1.117 1 6 6 0 0 1 1.26 5.778.75.75 0 0 0 1.432.444A7.49 7.49 0 0 0 17.59 7m-4.636 1.372a.75.75 0 1 0-.38 1.451 2.26 2.26 0 0 1 1.626 1.702.75.75 0 1 0 1.467-.314 3.76 3.76 0 0 0-2.713-2.839" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Bubble.tsx b/web/packages/design/src/Icon/Icons/Bubble.tsx
index b14de9605dff2..b56aceb95ae88 100644
--- a/web/packages/design/src/Icon/Icons/Bubble.tsx
+++ b/web/packages/design/src/Icon/Icons/Bubble.tsx
@@ -61,8 +61,8 @@ export const Bubble = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M6.062 4.27a9.75 9.75 0 1 1 1.356 16.337l-3.193 1.065a1.5 1.5 0 0 1-1.897-1.898l1.068-3.189A9.75 9.75 0 0 1 6.062 4.27m6.477-.5A8.25 8.25 0 0 0 4.86 16.134a.75.75 0 0 1 .062.613L3.751 20.25l3.505-1.169a.75.75 0 0 1 .613.062 8.25 8.25 0 1 0 4.67-15.373"
         clipRule="evenodd"
-        d="M6.06203 4.2699C7.9386 2.82839 10.2754 2.11853 12.6367 2.27267C14.9979 2.42681 17.2226 3.43444 18.8958 5.10767C20.5691 6.78091 21.5767 9.00556 21.7308 11.3669C21.885 13.7281 21.1751 16.0649 19.7336 17.9415C18.2921 19.818 16.2173 21.1063 13.8961 21.5661C11.6873 22.0037 9.39885 21.6626 7.41772 20.6073L4.22529 21.672C3.96099 21.7601 3.67736 21.7729 3.40621 21.7089C3.13505 21.6449 2.88708 21.5067 2.69007 21.3097C2.49307 21.1127 2.35483 20.8647 2.29083 20.5935C2.22684 20.3224 2.23963 20.0388 2.32777 19.7745L3.39597 16.5853C2.34083 14.6043 1.99988 12.316 2.43738 10.1074C2.89719 7.78619 4.18547 5.71142 6.06203 4.2699ZM12.5389 3.76949C10.5409 3.63906 8.56367 4.23971 6.9758 5.45945C5.38794 6.67919 4.29786 8.43477 3.90879 10.3989C3.51972 12.363 3.85823 14.4015 4.86119 16.1345C4.96898 16.3208 4.99158 16.5443 4.92323 16.7484L3.75073 20.249L7.25603 19.08C7.45985 19.012 7.68304 19.0347 7.869 19.1423C9.60196 20.1453 11.6405 20.4838 13.6046 20.0947C15.5687 19.7056 17.3243 18.6156 18.5441 17.0277C19.7638 15.4398 20.3644 13.4626 20.234 11.4646C20.1036 9.46655 19.251 7.58415 17.8352 6.16833C16.4194 4.75252 14.537 3.89991 12.5389 3.76949Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CCAmex.tsx b/web/packages/design/src/Icon/Icons/CCAmex.tsx
index 4a37623407611..d59856e757f1f 100644
--- a/web/packages/design/src/Icon/Icons/CCAmex.tsx
+++ b/web/packages/design/src/Icon/Icons/CCAmex.tsx
@@ -59,7 +59,7 @@ export const CCAmex = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M2.13628 9.95985H2.98611L2.55642 8.9286L2.13628 9.95985ZM8.06597 14.9824L8.77257 14.2281L8.10417 13.4737H6.54774V13.9416H7.90365V14.4668H6.54774V14.9824H8.06597ZM9.57465 14.2376L10.52 15.288V13.2159L9.57465 14.2376ZM12.3247 13.7888C12.3247 13.5597 12.1528 13.4737 11.9427 13.4737H11.1406V14.1326H11.9332C12.1528 14.1326 12.3247 14.0276 12.3247 13.7888ZM15.0842 13.7506C15.0842 13.5119 14.8741 13.4737 14.6832 13.4737H13.9002V14.0562H14.6736C14.8837 14.0562 15.0842 14.0085 15.0842 13.7506ZM12.4297 9.301C12.4297 9.06228 12.2196 9.02409 12.0286 9.02409H11.2457V9.597H12.0191C12.2292 9.597 12.4297 9.54926 12.4297 9.301ZM16.8125 9.95985H17.6623L17.2422 8.9286L16.8125 9.95985ZM7.67448 8.47982V11.0675H7.04427V9.04319L6.1467 11.0675H5.60243L4.70486 9.04319V11.0675H3.44444L3.20573 10.4946H1.91667L1.67795 11.0675H1.00955L2.11719 8.47982H3.03385L4.0842 10.9338V8.47982H5.09635L5.90799 10.2368L6.64323 8.47982H7.67448ZM12.9835 13.7888C12.9835 14.8296 11.8472 14.6578 11.1406 14.6578V15.5267H9.9375L9.17361 14.6673L8.38108 15.5267H5.93663V12.939H8.41927L9.18316 13.7888L9.96615 12.939H11.9427C12.5252 12.939 12.9835 13.1395 12.9835 13.7888ZM10.2049 10.5328V11.0675H8.13281V8.47982H10.2049V9.02409H8.75347V9.49197H10.1667V10.0171H8.75347V10.5328H10.2049ZM23 15.8704V18.0571C23 18.7541 22.4366 19.3366 21.7396 19.3366H2.26042C1.56337 19.3366 1 18.7541 1 18.0571V11.5831H2.0599L2.29861 11.0007H2.82378L3.0625 11.5831H5.1441V11.1439L5.32552 11.5831H6.40451L6.59549 11.1343V11.5831H11.7613V10.6378L11.8568 10.6283C11.9427 10.6283 11.9523 10.6951 11.9523 10.7619V11.5831H14.6163V11.3635C15.237 11.6882 16.0868 11.5831 16.7361 11.5831L16.9748 11.0007H17.5096L17.7483 11.5831H19.9158V11.0293L20.2405 11.5831H21.9783V7.97374H20.2596V8.39388L20.0208 7.97374H18.2543V8.39388L18.0347 7.97374H15.6571C15.3038 7.97374 14.9314 8.01194 14.6163 8.18381V7.97374H12.974V8.18381C12.783 8.01194 12.5252 7.97374 12.2769 7.97374H6.28038L5.86979 8.89996L5.4592 7.97374H3.56858V8.39388L3.35851 7.97374H1.74479L1 9.68294V5.94944C1 5.25239 1.56337 4.66992 2.26042 4.66992H21.7396C22.4366 4.66992 23 5.25239 23 5.94944V12.4234H21.8542C21.5868 12.4234 21.3003 12.4711 21.0807 12.6335V12.4234H19.3906C19.1519 12.4234 18.8273 12.4616 18.6458 12.6335V12.4234H15.6285V12.6335C15.3993 12.4711 15.0651 12.4234 14.7977 12.4234H12.8021V12.6335C12.6016 12.4425 12.191 12.4234 11.9332 12.4234H9.69879L9.18316 12.9772L8.70573 12.4234H5.37326V16.0328H8.64844L9.17361 15.4694L9.67014 16.0328H11.6849V15.1829H11.8854C12.1719 15.1829 12.4679 15.1734 12.7448 15.0588V16.0328H14.4062V15.0875H14.4826C14.5781 15.0875 14.5972 15.097 14.5972 15.202V16.0328H19.6484C19.9253 16.0328 20.2691 15.9755 20.4887 15.8036V16.0328H22.0929C22.3984 16.0328 22.7231 16.0041 23 15.8704ZM15.7622 13.6361C15.7622 13.9225 15.6094 14.209 15.3229 14.3236C15.6667 14.4477 15.7335 14.6769 15.7335 15.0111V15.5267H15.1128V15.097C15.1128 14.6578 14.9696 14.5814 14.559 14.5814H13.9002V15.5267H13.2795V12.939H14.75C15.237 12.939 15.7622 13.025 15.7622 13.6361ZM13.1172 9.17687C13.1172 9.47287 12.9549 9.75933 12.678 9.87391C13.0313 9.99805 13.0885 10.2177 13.0885 10.5614V11.0675H12.4679C12.4583 10.5137 12.6016 10.1317 11.9141 10.1317H11.2457V11.0675H10.6345V8.47982L12.0955 8.48937C12.592 8.48937 13.1172 8.56575 13.1172 9.17687ZM18.1684 14.992V15.5267H16.1059V12.939H18.1684V13.4737H16.7266V13.9416H18.1398V14.4668H16.7266V14.9824L18.1684 14.992ZM14.1007 8.47982V11.0675H13.4705V8.47982H14.1007ZM20.7179 14.7055C20.7179 15.3166 20.2977 15.5267 19.7439 15.5267H18.5408V14.9729H19.7439C19.8967 14.9729 20.0686 14.9347 20.0686 14.7342C20.0686 14.1803 18.474 14.9442 18.474 13.7125C18.474 13.1873 18.875 12.939 19.3524 12.939H20.5938V13.4833H19.4575C19.2951 13.4833 19.1137 13.5119 19.1137 13.722C19.1137 14.2854 20.7179 13.4642 20.7179 14.7055ZM23 14.2281V15.1925C22.8186 15.4599 22.4653 15.5267 22.1597 15.5267H20.9661V14.9729H22.1597C22.3125 14.9729 22.4748 14.9251 22.4748 14.7342C22.4748 14.1899 20.8802 14.9442 20.8802 13.7125C20.8802 13.1873 21.2908 12.939 21.7682 12.939H23V13.4833H21.8733C21.7014 13.4833 21.5295 13.5119 21.5295 13.722C21.5295 14.1803 22.6085 13.7125 23 14.2281ZM21.4245 8.48937V11.0675H20.546L19.3811 9.12912V11.0675H18.1207L17.8724 10.4946H16.5929L16.3542 11.0675H15.638C14.7882 11.0675 14.4062 10.6283 14.4062 9.79753C14.4062 8.9286 14.7977 8.47982 15.6762 8.47982H16.2778V9.04319C15.6285 9.03364 15.0365 8.89041 15.0365 9.77843C15.0365 10.2177 15.1415 10.5232 15.638 10.5232H15.9149L16.7934 8.48937H17.7196L18.7604 10.9338V8.48937H19.7057L20.7943 10.2845V8.48937H21.4245Z" />
+      <path d="M2.136 9.96h.85l-.43-1.031zm5.93 5.022.707-.754-.669-.754H6.548v.468h1.356v.525H6.548v.515zm1.509-.744.945 1.05v-2.072zm2.75-.45c0-.228-.172-.314-.382-.314h-.802v.659h.792c.22 0 .392-.105.392-.344m2.76-.037c0-.24-.21-.277-.402-.277H13.9v.582h.774c.21 0 .41-.047.41-.305M12.43 9.3c0-.239-.21-.277-.401-.277h-.783v.573h.773c.21 0 .41-.048.41-.296m4.383.659h.85l-.42-1.031zM7.674 8.48v2.588h-.63V9.043l-.897 2.025h-.545l-.897-2.025v2.025h-1.26l-.24-.573H1.918l-.239.573H1.01L2.117 8.48h.917l1.05 2.454V8.48h1.012l.812 1.757.735-1.757zm5.31 5.309c0 1.04-1.137.869-1.843.869v.869H9.938l-.764-.86-.793.86H5.937v-2.588h2.482l.764.85.783-.85h1.977c.582 0 1.04.2 1.04.85m-2.78-3.256v.535H8.134V8.48h2.072v.544H8.753v.468h1.414v.525H8.753v.516zM23 15.87v2.187c0 .697-.563 1.28-1.26 1.28H2.26c-.697 0-1.26-.583-1.26-1.28v-6.474h1.06l.239-.582h.525l.239.582h2.081v-.44l.182.44h1.079l.19-.449v.45h5.166v-.946l.096-.01c.086 0 .095.067.095.134v.821h2.664v-.22c.621.325 1.47.22 2.12.22l.239-.582h.535l.238.582h2.168v-.554l.325.554h1.737v-3.61H20.26v.42l-.24-.42h-1.766v.42l-.22-.42h-2.377c-.353 0-.726.039-1.04.21v-.21h-1.643v.21c-.191-.171-.449-.21-.697-.21H6.28l-.41.927-.41-.926H3.568v.42l-.21-.42H1.745L1 9.683V5.949c0-.697.563-1.28 1.26-1.28h19.48c.697 0 1.26.583 1.26 1.28v6.474h-1.146c-.267 0-.554.048-.773.21v-.21h-1.69c-.24 0-.564.039-.745.21v-.21h-3.017v.21c-.23-.162-.564-.21-.831-.21h-1.996v.21c-.2-.19-.611-.21-.869-.21H9.7l-.516.554-.477-.554H5.373v3.61h3.275l.526-.564.496.564h2.015v-.85h.2c.287 0 .583-.01.86-.124v.974h1.661v-.946h.077c.095 0 .114.01.114.115v.83h5.051c.277 0 .621-.056.84-.228v.229h1.605c.305 0 .63-.029.907-.163m-7.238-2.234c0 .287-.153.573-.44.688.345.124.412.353.412.687v.516h-.621v-.43c0-.44-.143-.516-.554-.516H13.9v.946h-.62v-2.588h1.47c.487 0 1.012.086 1.012.697m-2.645-4.46c0 .297-.162.583-.439.698.353.124.41.344.41.687v.507h-.62c-.01-.554.134-.936-.554-.936h-.668v.936h-.612V8.48l1.461.01c.497 0 1.022.076 1.022.687m5.051 5.816v.535h-2.062V12.94h2.062v.535h-1.441v.468h1.413v.525h-1.413v.515zM14.101 8.48v2.588h-.63V8.48zm6.617 6.226c0 .61-.42.82-.974.82H18.54v-.553h1.203c.153 0 .325-.038.325-.239 0-.554-1.595.21-1.595-1.021 0-.526.401-.774.878-.774h1.242v.544h-1.137c-.162 0-.343.029-.343.239 0 .563 1.604-.258 1.604.984M23 14.228v.965c-.181.267-.535.334-.84.334h-1.194v-.554h1.194c.152 0 .315-.048.315-.239 0-.544-1.595.21-1.595-1.021 0-.526.41-.774.888-.774H23v.544h-1.127c-.172 0-.344.029-.344.239 0 .458 1.08-.01 1.471.506M21.424 8.49v2.579h-.878L19.381 9.13v1.939h-1.26l-.249-.573h-1.28l-.238.573h-.716c-.85 0-1.232-.44-1.232-1.27 0-.87.392-1.318 1.27-1.318h.602v.563c-.65-.01-1.241-.153-1.241.735 0 .44.104.745.601.745h.277l.878-2.034h.927l1.04 2.445V8.489h.946l1.088 1.795V8.49z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/CCDiscover.tsx b/web/packages/design/src/Icon/Icons/CCDiscover.tsx
index 7598078b826e7..f82332c8d54ed 100644
--- a/web/packages/design/src/Icon/Icons/CCDiscover.tsx
+++ b/web/packages/design/src/Icon/Icons/CCDiscover.tsx
@@ -59,7 +59,7 @@ export const CCDiscover = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.98872 10.867C3.98872 11.1725 3.86458 11.4685 3.64497 11.6691C3.45399 11.8409 3.19618 11.9173 2.79514 11.9173H2.63281V9.81662H2.79514C3.19618 9.81662 3.44444 9.88346 3.64497 10.0744C3.86458 10.2654 3.98872 10.5614 3.98872 10.867ZM20.947 10.2463C20.947 10.571 20.737 10.7428 20.3359 10.7428H20.1545V9.77843H20.3455C20.737 9.77843 20.947 9.94075 20.947 10.2463ZM4.62847 10.867C4.62847 9.93121 3.93142 9.27235 2.91927 9.27235H2.01215V12.452H2.91927C3.3967 12.452 3.75 12.347 4.05556 12.0892C4.4184 11.7836 4.62847 11.3349 4.62847 10.867ZM4.91493 12.452H5.53559V9.27235H4.91493V12.452ZM7.97049 11.4876C7.97049 10.9816 7.76042 10.7524 7.05382 10.4946C6.68142 10.3609 6.57639 10.2654 6.57639 10.0935C6.57639 9.89301 6.76736 9.74023 7.03472 9.74023C7.22569 9.74023 7.37847 9.81662 7.5408 9.99805L7.86545 9.57791C7.59809 9.33919 7.27344 9.22461 6.92969 9.22461C6.36632 9.22461 5.93663 9.6161 5.93663 10.1317C5.93663 10.571 6.13715 10.8001 6.71962 11.0102C6.95833 11.0961 7.08247 11.1439 7.14931 11.1916C7.27344 11.268 7.33073 11.3826 7.33073 11.5163C7.33073 11.7741 7.13021 11.9651 6.8533 11.9651C6.55729 11.9651 6.31858 11.8218 6.17535 11.5449L5.77431 11.9269C6.06076 12.347 6.40451 12.538 6.8724 12.538C7.5217 12.538 7.97049 12.1083 7.97049 11.4876ZM10.625 12.347V11.6118C10.3767 11.86 10.1571 11.9651 9.88021 11.9651C9.25 11.9651 8.81076 11.5067 8.81076 10.867C8.81076 10.2559 9.2691 9.76888 9.85156 9.76888C10.1476 9.76888 10.3672 9.87391 10.625 10.1317V9.39648C10.3576 9.2628 10.1285 9.20551 9.86111 9.20551C8.92535 9.20551 8.17101 9.94075 8.17101 10.867C8.17101 11.8027 8.90625 12.5284 9.85156 12.5284C10.1189 12.5284 10.3481 12.4807 10.625 12.347ZM22.3889 18.1144V13.0822C20.8611 14.0371 15.4852 17.0927 6.79601 18.7255H21.7778C22.112 18.7255 22.3889 18.4486 22.3889 18.1144ZM14.263 10.8861C14.263 9.93121 13.4896 9.15777 12.5347 9.15777C11.5799 9.15777 10.8064 9.93121 10.8064 10.8861C10.8064 11.8409 11.5799 12.6144 12.5347 12.6144C13.4896 12.6144 14.263 11.8409 14.263 10.8861ZM15.7144 12.538L17.0894 9.27235H16.4115L15.5521 11.4112L14.7023 9.27235H14.0243L15.3802 12.538H15.7144ZM17.3663 12.452H19.1233V11.9173H17.987V11.0579H19.0851V10.5232H17.987V9.81662H19.1233V9.27235H17.3663V12.452ZM21.0998 12.452H21.8637L20.8611 11.1152C21.329 11.0197 21.5868 10.7046 21.5868 10.2177C21.5868 9.6161 21.1762 9.27235 20.4601 9.27235H19.5339V12.452H20.1545V11.1821H20.2405L21.0998 12.452ZM23 5.94944V18.0571C23 18.7637 22.4366 19.3366 21.7396 19.3366H2.26042C1.56337 19.3366 1 18.7637 1 18.0571V5.94944C1 5.24284 1.56337 4.66992 2.26042 4.66992H21.7396C22.4366 4.66992 23 5.24284 23 5.94944Z" />
+      <path d="M3.989 10.867c0 .305-.124.601-.344.802-.191.172-.449.248-.85.248h-.162v-2.1h.162c.401 0 .65.066.85.257.22.191.344.487.344.793m16.958-.62c0 .324-.21.496-.611.496h-.181v-.965h.19c.392 0 .602.163.602.468m-16.319.62c0-.936-.697-1.595-1.709-1.595h-.907v3.18h.907c.478 0 .831-.105 1.137-.363.362-.305.572-.754.572-1.222m.287 1.585h.62v-3.18h-.62zm3.055-.964c0-.506-.21-.736-.916-.993-.373-.134-.478-.23-.478-.401 0-.201.191-.354.459-.354.19 0 .343.077.506.258l.324-.42a1.38 1.38 0 0 0-.935-.353c-.564 0-.993.391-.993.907 0 .439.2.668.783.878.238.086.362.134.43.182a.36.36 0 0 1 .18.324c0 .258-.2.45-.477.45a.73.73 0 0 1-.678-.421l-.4.382c.286.42.63.611 1.097.611.65 0 1.098-.43 1.098-1.05m2.655.859v-.735c-.248.248-.468.353-.745.353-.63 0-1.07-.458-1.07-1.098 0-.611.46-1.098 1.042-1.098.296 0 .515.105.773.363v-.736a1.6 1.6 0 0 0-.764-.19c-.936 0-1.69.735-1.69 1.661 0 .936.735 1.661 1.68 1.661.268 0 .497-.047.774-.181m11.764 5.767v-5.032c-1.528.955-6.904 4.01-15.593 5.643h14.982a.615.615 0 0 0 .61-.61m-8.126-7.228a1.728 1.728 0 1 0-3.456 0 1.728 1.728 0 0 0 3.456 0m1.451 1.652 1.375-3.266h-.677l-.86 2.14-.85-2.14h-.678l1.356 3.266zm1.652-.086h1.757v-.535h-1.136v-.86h1.098v-.534h-1.098v-.706h1.136v-.545h-1.757zm3.734 0h.764l-1.003-1.337c.468-.095.726-.41.726-.897 0-.602-.41-.946-1.127-.946h-.926v3.18h.62v-1.27h.087zM23 5.949v12.108a1.27 1.27 0 0 1-1.26 1.28H2.26A1.27 1.27 0 0 1 1 18.057V5.95c0-.706.563-1.28 1.26-1.28h19.48c.697 0 1.26.574 1.26 1.28" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/CCMasterCard.tsx b/web/packages/design/src/Icon/Icons/CCMasterCard.tsx
index ce752556192f8..d8d169fbc2e38 100644
--- a/web/packages/design/src/Icon/Icons/CCMasterCard.tsx
+++ b/web/packages/design/src/Icon/Icons/CCMasterCard.tsx
@@ -59,7 +59,7 @@ export const CCMasterCard = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.6849 6.70378C10.8924 6.1786 9.9566 5.89214 9.00174 5.89214C6.31858 5.89214 4.14149 8.06923 4.14149 10.7428C4.14149 13.426 6.31858 15.6031 9.00174 15.6031C9.9566 15.6031 10.8924 15.3166 11.6849 14.7914C9.12587 12.7099 9.14497 8.78537 11.6849 6.70378ZM12 6.93294C9.53646 8.87131 9.52691 12.6335 12 14.5623C14.4731 12.6335 14.4635 8.87131 12 6.93294ZM12.3151 6.70378C14.8455 8.78537 14.8837 12.7194 12.3151 14.7914C13.1076 15.3166 14.053 15.6031 14.9983 15.6031C17.6814 15.6031 19.8585 13.426 19.8585 10.7428C19.8585 8.06923 17.6814 5.89214 14.9983 5.89214C14.0434 5.89214 13.1076 6.1786 12.3151 6.70378ZM19.3906 13.5979H19.4575V13.5692H19.2951V13.5979H19.362V13.7602H19.3906V13.5979ZM19.6675 13.7602H19.7057V13.5692H19.658L19.6007 13.6934L19.5434 13.5692H19.4957V13.7602H19.5243V13.617L19.5816 13.7411H19.6198L19.6675 13.617V13.7602ZM19.5911 17.9616V17.9807H19.5434V17.952H19.5911V17.9616ZM19.5911 18.0475H19.6198L19.5816 17.9998C19.6007 17.9998 19.6007 17.9902 19.6102 17.9902C19.6198 17.9807 19.6198 17.9711 19.6198 17.9616C19.6198 17.952 19.6198 17.9425 19.6102 17.9329C19.6007 17.9329 19.5911 17.9234 19.572 17.9234H19.5148V18.0475H19.5434V17.9998H19.553L19.5911 18.0475ZM7.5408 17.3982C7.5408 17.1691 7.68403 16.9876 7.93229 16.9876C8.16146 16.9876 8.31424 17.1691 8.31424 17.3982C8.31424 17.6369 8.16146 17.8088 7.93229 17.8088C7.68403 17.8088 7.5408 17.6274 7.5408 17.3982ZM12.0573 16.9781C12.2387 16.9781 12.3628 17.0831 12.3915 17.2836H11.7231C11.7517 17.1022 11.8663 16.9781 12.0573 16.9781ZM15.4566 17.3982C15.4566 17.1691 15.5998 16.9876 15.8385 16.9876C16.0773 16.9876 16.23 17.1691 16.23 17.3982C16.23 17.6369 16.0773 17.8088 15.8385 17.8088C15.5998 17.8088 15.4566 17.6274 15.4566 17.3982ZM18.0538 17.3982C18.0538 17.1691 18.2066 16.9876 18.4453 16.9876C18.6745 16.9876 18.8368 17.1691 18.8368 17.3982C18.8368 17.6369 18.6745 17.8088 18.4453 17.8088C18.2066 17.8088 18.0538 17.6274 18.0538 17.3982ZM19.5625 18.0857C19.553 18.0857 19.5434 18.0857 19.5243 18.0762C19.5148 18.0762 19.5052 18.0666 19.4957 18.0571C19.4861 18.0475 19.4766 18.038 19.4766 18.0284C19.4766 18.0189 19.467 17.9998 19.467 17.9902C19.467 17.9807 19.467 17.9616 19.4766 17.952C19.4766 17.9329 19.4861 17.9234 19.4957 17.9138C19.5052 17.9043 19.5148 17.9043 19.5243 17.8947C19.5339 17.8852 19.553 17.8852 19.5625 17.8852C19.572 17.8852 19.5911 17.8852 19.6007 17.8947C19.6102 17.9043 19.6293 17.9043 19.6389 17.9138C19.6484 17.9234 19.6484 17.9329 19.658 17.952C19.658 17.9616 19.6675 17.9711 19.6675 17.9902C19.6675 17.9998 19.658 18.0093 19.658 18.0284C19.6484 18.038 19.6484 18.0475 19.6389 18.0571C19.6293 18.0666 19.6198 18.0762 19.6007 18.0762C19.5911 18.0857 19.5816 18.0857 19.5625 18.0857ZM6.71962 18.0475H7.00608V17.2359C7.00608 16.9303 6.80556 16.7298 6.49045 16.7203C6.32812 16.7203 6.15625 16.768 6.04167 16.9494C5.95573 16.8062 5.8125 16.7203 5.61198 16.7203C5.4783 16.7203 5.34462 16.768 5.23958 16.9112V16.7585H4.95312V18.0475H5.23958V17.3314C5.23958 17.1022 5.36372 16.9876 5.55469 16.9876C5.74566 16.9876 5.84115 17.1118 5.84115 17.3314V18.0475H6.11806V17.3314C6.11806 17.1022 6.25174 16.9876 6.43316 16.9876C6.62413 16.9876 6.71962 17.1118 6.71962 17.3314V18.0475ZM8.30469 18.0475H8.5816V16.7585H8.30469V16.9112C8.2092 16.7967 8.07552 16.7203 7.8941 16.7203C7.53125 16.7203 7.25434 17.0067 7.25434 17.3982C7.25434 17.7897 7.53125 18.0762 7.8941 18.0762C8.07552 18.0762 8.2092 18.0093 8.30469 17.8852V18.0475ZM10.0043 17.656C10.0043 17.4269 9.83247 17.3123 9.55556 17.2741L9.42188 17.255C9.29774 17.2359 9.20226 17.2072 9.20226 17.1213C9.20226 17.0354 9.28819 16.9781 9.44097 16.9781C9.61285 16.9781 9.76562 17.0354 9.85156 17.0831L9.96615 16.8539C9.83247 16.768 9.65104 16.7203 9.44097 16.7203C9.11632 16.7203 8.90625 16.8826 8.90625 17.1404C8.90625 17.3505 9.05903 17.4746 9.35503 17.5128L9.47917 17.5319C9.64149 17.5605 9.70833 17.5987 9.70833 17.6656C9.70833 17.7706 9.6033 17.8279 9.41233 17.8279C9.22135 17.8279 9.07812 17.7611 8.98264 17.6942L8.85851 17.9138C9.01128 18.0189 9.20226 18.0762 9.41233 18.0762C9.78472 18.0762 10.0043 17.9043 10.0043 17.656ZM11.2457 17.9807L11.1693 17.742C11.0833 17.7897 10.9974 17.8088 10.921 17.8088C10.7778 17.8088 10.7396 17.7229 10.7396 17.5987V17.0163H11.1979V16.7585H10.7396V16.367H10.4531V16.7585H10.1858V17.0163H10.4531V17.5987C10.4531 17.8947 10.5677 18.0762 10.9019 18.0762C11.0165 18.0762 11.1597 18.038 11.2457 17.9807ZM12.0668 16.7203C11.6944 16.7203 11.4271 16.9972 11.4271 17.3982C11.4271 17.8088 11.704 18.0762 12.0859 18.0762C12.2769 18.0762 12.4583 18.0284 12.6111 17.8947L12.4774 17.6847C12.3724 17.7706 12.2292 17.8279 12.105 17.8279C11.9236 17.8279 11.7613 17.742 11.7135 17.5128H12.678V17.3982C12.678 16.9972 12.4297 16.7203 12.0668 16.7203ZM13.5851 16.7203C13.4227 16.7203 13.3177 16.7967 13.2509 16.9112V16.7585H12.9644V18.0475H13.2509V17.3218C13.2509 17.1118 13.3368 16.9876 13.5278 16.9876C13.5851 16.9876 13.6424 16.9972 13.6997 17.0258L13.7856 16.7585C13.7188 16.7298 13.6424 16.7203 13.5851 16.7203ZM13.8715 17.3982C13.8715 17.7897 14.1389 18.0762 14.559 18.0762C14.75 18.0762 14.8837 18.038 15.0174 17.9234L14.8837 17.6942C14.7786 17.7706 14.6736 17.8184 14.5495 17.8088C14.3203 17.8088 14.158 17.6465 14.158 17.3982C14.158 17.15 14.3203 16.9876 14.5495 16.9876C14.6736 16.9876 14.7786 17.0258 14.8837 17.1022L15.0174 16.873C14.8837 16.768 14.75 16.7203 14.559 16.7203C14.1389 16.7203 13.8715 17.0067 13.8715 17.3982ZM16.2109 18.0475H16.4974V16.7585H16.2109V16.9112C16.125 16.7967 15.9913 16.7203 15.8099 16.7203C15.447 16.7203 15.1606 17.0067 15.1606 17.3982C15.1606 17.7897 15.447 18.0762 15.8099 18.0762C15.9913 18.0762 16.125 18.0093 16.2109 17.8852V18.0475ZM17.4809 16.7203C17.3186 16.7203 17.2135 16.7967 17.1467 16.9112V16.7585H16.8698V18.0475H17.1467V17.3218C17.1467 17.1118 17.2422 16.9876 17.4236 16.9876C17.4809 16.9876 17.5382 16.9972 17.5955 17.0258L17.6814 16.7585C17.6241 16.7298 17.5382 16.7203 17.4809 16.7203ZM18.8177 18.0475H19.0946V16.2333H18.8177V16.9112C18.7318 16.7967 18.5981 16.7203 18.4071 16.7203C18.0538 16.7203 17.7674 17.0067 17.7674 17.3982C17.7674 17.7897 18.0538 18.0762 18.4071 18.0762C18.5981 18.0762 18.7318 18.0093 18.8177 17.8852V18.0475ZM19.5625 17.8566C19.553 17.8566 19.5339 17.8661 19.5148 17.8661C19.4957 17.8756 19.4861 17.8852 19.4766 17.8947C19.4575 17.9043 19.4479 17.9234 19.4479 17.9329C19.4384 17.952 19.4384 17.9711 19.4384 17.9902C19.4384 17.9998 19.4384 18.0189 19.4479 18.038C19.4479 18.0475 19.4575 18.0666 19.4766 18.0762C19.4861 18.0857 19.4957 18.0953 19.5148 18.1048C19.5339 18.1144 19.553 18.1144 19.5625 18.1144C19.5816 18.1144 19.6007 18.1144 19.6198 18.1048C19.6293 18.0953 19.6484 18.0857 19.658 18.0762C19.6675 18.0666 19.6771 18.0475 19.6866 18.038C19.6962 18.0189 19.6962 17.9998 19.6962 17.9902C19.6962 17.9711 19.6962 17.952 19.6866 17.9329C19.6771 17.9234 19.6675 17.9043 19.658 17.8947C19.6484 17.8852 19.6293 17.8756 19.6198 17.8661C19.6007 17.8661 19.5816 17.8566 19.5625 17.8566ZM23 5.89214V18.1144C23 18.7828 22.4462 19.3366 21.7778 19.3366H2.22222C1.55382 19.3366 1 18.7828 1 18.1144V5.89214C1 5.22374 1.55382 4.66992 2.22222 4.66992H21.7778C22.4462 4.66992 23 5.22374 23 5.89214Z" />
+      <path d="M11.685 6.704a4.87 4.87 0 0 0-2.683-.812 4.86 4.86 0 0 0-4.86 4.85 4.86 4.86 0 0 0 4.86 4.861c.955 0 1.89-.286 2.683-.812-2.56-2.081-2.54-6.006 0-8.087m.315.229c-2.464 1.938-2.473 5.7 0 7.63 2.473-1.93 2.464-5.692 0-7.63m.315-.23c2.53 2.082 2.569 6.016 0 8.088a4.9 4.9 0 0 0 2.683.812 4.86 4.86 0 0 0 4.86-4.86 4.86 4.86 0 0 0-4.86-4.85c-.955 0-1.89.286-2.683.81m7.076 6.895h.067v-.029h-.163v.029h.067v.162h.029zm.277.162h.038v-.19h-.048l-.057.123-.058-.124h-.047v.191h.028v-.143l.058.124h.038l.047-.124zm-.077 4.202v.019h-.048v-.029h.048zm0 .085h.029L19.582 18c.019 0 .019-.01.028-.01.01-.01.01-.019.01-.028s0-.02-.01-.03c-.01 0-.019-.009-.038-.009h-.057v.125h.028V18h.01zm-12.05-.649c0-.229.143-.41.391-.41.23 0 .382.181.382.41 0 .239-.153.41-.382.41-.248 0-.391-.18-.391-.41m4.516-.42c.182 0 .306.105.335.306h-.669c.029-.182.143-.306.334-.306m3.4.42c0-.229.143-.41.381-.41.24 0 .392.181.392.41 0 .239-.153.41-.392.41-.238 0-.381-.18-.381-.41m2.597 0c0-.229.153-.41.391-.41.23 0 .392.181.392.41 0 .239-.163.41-.392.41-.238 0-.391-.18-.391-.41m1.509.688c-.01 0-.02 0-.039-.01-.01 0-.019-.01-.028-.019-.01-.01-.02-.019-.02-.029s-.009-.028-.009-.038 0-.028.01-.038c0-.02.01-.029.019-.038.01-.01.019-.01.028-.02.01-.009.029-.009.038-.009.01 0 .03 0 .039.01s.028.01.038.019c.01.01.01.019.019.038 0 .01.01.02.01.038 0 .01-.01.02-.01.038-.01.01-.01.02-.02.03-.009.009-.018.018-.037.018-.01.01-.02.01-.038.01M6.72 18.048h.286v-.812c0-.306-.2-.506-.516-.516-.162 0-.334.048-.448.23a.47.47 0 0 0-.43-.23.44.44 0 0 0-.372.191v-.152h-.287v1.288h.287v-.716c0-.229.124-.343.315-.343.19 0 .286.124.286.343v.716h.277v-.716c0-.229.134-.343.315-.343.191 0 .287.124.287.343zm1.585 0h.277v-1.29h-.277v.153a.51.51 0 0 0-.41-.19c-.364 0-.64.286-.64.677s.276.678.64.678a.49.49 0 0 0 .41-.19zm1.7-.392c0-.23-.173-.344-.45-.382l-.133-.019c-.124-.02-.22-.048-.22-.134s.086-.143.239-.143c.172 0 .325.057.41.105l.115-.23a.97.97 0 0 0-.525-.133c-.325 0-.535.163-.535.42 0 .21.153.335.449.373l.124.019c.162.029.23.067.23.134 0 .105-.106.162-.297.162a.74.74 0 0 1-.43-.134l-.123.22a.97.97 0 0 0 .553.162c.373 0 .592-.172.592-.42m1.24.325-.076-.239a.5.5 0 0 1-.248.067c-.143 0-.181-.086-.181-.21v-.583h.458v-.257h-.458v-.392h-.287v.392h-.267v.257h.267v.583c0 .296.115.477.449.477a.7.7 0 0 0 .344-.095m.822-1.26c-.373 0-.64.276-.64.677 0 .41.277.678.659.678a.77.77 0 0 0 .525-.181l-.134-.21a.63.63 0 0 1-.372.143c-.181 0-.344-.086-.392-.315h.965v-.115c0-.4-.248-.678-.611-.678m1.518 0a.36.36 0 0 0-.334.19v-.152h-.287v1.288h.287v-.725c0-.21.086-.334.277-.334q.085-.002.172.038l.086-.267a.5.5 0 0 0-.2-.039m.286.677c0 .392.268.678.688.678.191 0 .325-.038.458-.153l-.133-.229a.5.5 0 0 1-.335.115c-.229 0-.391-.163-.391-.41 0-.249.162-.411.392-.411.124 0 .229.038.334.114l.133-.229a.68.68 0 0 0-.458-.153c-.42 0-.687.287-.687.678m2.34.65h.286v-1.29h-.286v.153a.48.48 0 0 0-.401-.19c-.363 0-.65.286-.65.677s.287.678.65.678c.181 0 .315-.067.4-.19zm1.27-1.328a.36.36 0 0 0-.334.191v-.152h-.277v1.288h.277v-.725c0-.21.095-.334.277-.334q.085-.002.172.038l.085-.267a.5.5 0 0 0-.2-.039m1.337 1.328h.277v-1.815h-.277v.678a.49.49 0 0 0-.41-.19c-.354 0-.64.286-.64.677s.286.678.64.678c.19 0 .324-.067.41-.19zm.744-.191c-.009 0-.028.01-.047.01a.1.1 0 0 0-.038.028c-.02.01-.03.028-.03.038-.009.019-.009.038-.009.057a.1.1 0 0 0 .01.048c0 .01.01.029.029.038.01.01.019.02.038.029s.038.01.047.01c.02 0 .039 0 .058-.01.01-.01.028-.02.038-.029s.02-.029.029-.038c.01-.02.01-.038.01-.048 0-.019 0-.038-.01-.057-.01-.01-.02-.029-.029-.038-.01-.01-.029-.02-.038-.029-.02 0-.038-.01-.058-.01M23 5.892v12.222a1.23 1.23 0 0 1-1.222 1.223H2.222A1.23 1.23 0 0 1 1 18.114V5.892A1.23 1.23 0 0 1 2.222 4.67h19.556A1.23 1.23 0 0 1 23 5.892" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/CCStripe.tsx b/web/packages/design/src/Icon/Icons/CCStripe.tsx
index 98acf2536c0f8..61b02c4ccbce4 100644
--- a/web/packages/design/src/Icon/Icons/CCStripe.tsx
+++ b/web/packages/design/src/Icon/Icons/CCStripe.tsx
@@ -59,7 +59,7 @@ export const CCStripe = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.2491 12.0701C16.2491 12.5093 16.1823 12.8435 16.0486 13.0822C15.934 13.2923 15.7526 13.4164 15.5521 13.4164C15.4089 13.4164 15.2752 13.3878 15.1606 13.3305V11.1916C15.4089 10.9338 15.6285 10.9052 15.7049 10.9052C16.0677 10.9052 16.2491 11.3062 16.2491 12.0701ZM20.4314 11.7263H19.3811C19.4193 11.0866 19.5911 10.7906 19.9158 10.7906C20.2405 10.7906 20.4123 11.0961 20.4314 11.7263ZM5.54514 13.0154C5.54514 12.2133 5.05816 11.8791 4.26562 11.5927C3.84549 11.4399 3.61632 11.3158 3.61632 11.1248C3.61632 10.9625 3.75 10.8765 3.97917 10.8765C4.4184 10.8765 4.85764 11.0388 5.16319 11.1916L5.33507 10.1222C5.09635 10.0076 4.59983 9.81662 3.91233 9.81662C3.42535 9.81662 3.02431 9.94075 2.73785 10.1795C2.43229 10.4277 2.27951 10.7906 2.27951 11.2203C2.27951 12.0033 2.75694 12.347 3.53993 12.6239C4.03646 12.8053 4.20833 12.9295 4.20833 13.13C4.20833 13.321 4.04601 13.426 3.75 13.426C3.38715 13.426 2.78559 13.2446 2.3941 13.0154L2.22222 14.0944C2.55642 14.2854 3.17708 14.4859 3.82639 14.4859C4.34201 14.4859 4.76215 14.3618 5.05816 14.1326C5.38281 13.8748 5.54514 13.5024 5.54514 13.0154ZM8.36198 10.9625L8.5434 9.90256H7.62674V8.6135L6.39497 8.81402L6.22309 9.90256L5.78385 9.97895L5.62153 10.9625H6.21354V13.0536C6.21354 13.5979 6.35677 13.9703 6.63368 14.1994C6.8724 14.3904 7.21615 14.4859 7.69358 14.4859C8.06597 14.4859 8.28559 14.4191 8.44792 14.3809V13.2541C8.36198 13.2732 8.16146 13.321 8.02778 13.321C7.75087 13.321 7.62674 13.1682 7.62674 12.8435V10.9625H8.36198ZM11.3793 11.2012V9.87391C11.2839 9.85482 11.1979 9.84527 11.112 9.84527C10.7109 9.84527 10.3863 10.0553 10.2622 10.4373L10.1667 9.90256H8.9158V14.4H10.3481V11.4781C10.5295 11.2585 10.7873 11.1821 11.1311 11.1821C11.2075 11.1821 11.2839 11.1821 11.3793 11.2012ZM11.7326 14.4H13.1649V9.90256H11.7326V14.4ZM17.6719 12.0224C17.6719 11.2585 17.5286 10.676 17.2422 10.3132C16.9844 9.97895 16.6311 9.81662 16.1823 9.81662C15.7717 9.81662 15.4089 9.9885 15.0651 10.3513L14.9887 9.90256H13.7283V16.0614L15.1606 15.8227V14.3809C15.3802 14.4477 15.6094 14.4859 15.8099 14.4859C16.1632 14.4859 16.6884 14.3904 17.0894 13.9512C17.4809 13.531 17.6719 12.8817 17.6719 12.0224ZM13.2031 8.69944C13.2031 8.2793 12.8689 7.9451 12.4488 7.9451C12.0286 7.9451 11.6944 8.2793 11.6944 8.69944C11.6944 9.11957 12.0286 9.46332 12.4488 9.46332C12.8689 9.46332 13.2031 9.11957 13.2031 8.69944ZM21.7778 12.1083C21.7778 11.3921 21.625 10.8288 21.3194 10.4277C21.0043 10.0267 20.5365 9.81662 19.9444 9.81662C18.7222 9.81662 17.9679 10.7142 17.9679 12.1656C17.9679 12.9677 18.1684 13.5788 18.5694 13.9607C18.9227 14.314 19.4384 14.4859 20.1068 14.4859C20.7179 14.4859 21.2812 14.3427 21.6345 14.1039L21.4818 13.1204C21.1285 13.3114 20.7179 13.4164 20.2595 13.4164C19.9826 13.4164 19.7917 13.3592 19.658 13.235C19.5052 13.1109 19.4193 12.9008 19.3906 12.6048H21.7587C21.7682 12.538 21.7778 12.2133 21.7778 12.1083ZM23 5.89214V18.1144C23 18.7828 22.4462 19.3366 21.7778 19.3366H2.22222C1.55382 19.3366 1 18.7828 1 18.1144V5.89214C1 5.22374 1.55382 4.66992 2.22222 4.66992H21.7778C22.4462 4.66992 23 5.22374 23 5.89214Z" />
+      <path d="M16.25 12.07c0 .44-.068.774-.201 1.012-.115.21-.296.334-.497.334a.9.9 0 0 1-.391-.085v-2.14c.248-.257.468-.286.544-.286.363 0 .544.401.544 1.165m4.181-.344h-1.05c.038-.64.21-.935.535-.935s.496.305.515.935m-14.886 1.29c0-.803-.487-1.137-1.28-1.423-.42-.153-.649-.277-.649-.468 0-.162.134-.248.363-.248.44 0 .879.162 1.184.315l.172-1.07a3.3 3.3 0 0 0-1.423-.305c-.487 0-.888.124-1.174.363-.306.248-.458.61-.458 1.04 0 .783.477 1.127 1.26 1.404.496.181.668.306.668.506 0 .191-.162.296-.458.296-.363 0-.964-.181-1.356-.41l-.172 1.078c.334.191.955.392 1.604.392.516 0 .936-.124 1.232-.353q.487-.387.487-1.118m2.817-2.053.181-1.06h-.916v-1.29l-1.232.201-.172 1.089-.44.076-.161.984h.592v2.09c0 .545.143.917.42 1.146.238.191.582.287 1.06.287.372 0 .592-.067.754-.105v-1.127c-.086.02-.287.067-.42.067-.277 0-.401-.153-.401-.477v-1.881zm3.017.238V9.874a1.3 1.3 0 0 0-.267-.029c-.401 0-.726.21-.85.592l-.095-.534h-1.25V14.4h1.432v-2.922c.181-.22.44-.296.783-.296.076 0 .153 0 .248.02m.354 3.199h1.432V9.903h-1.432zm5.939-2.378c0-.764-.143-1.346-.43-1.709-.258-.334-.61-.496-1.06-.496-.41 0-.773.172-1.117.534l-.076-.448h-1.26v6.158l1.432-.238V14.38c.22.067.448.105.649.105.353 0 .878-.096 1.28-.535.39-.42.582-1.07.582-1.929M13.203 8.7a.75.75 0 0 0-.754-.754.75.75 0 0 0-.755.754c0 .42.335.764.755.764s.754-.343.754-.764m8.575 3.41q0-1.078-.459-1.681c-.315-.401-.782-.611-1.375-.611-1.222 0-1.976.897-1.976 2.349 0 .802.2 1.413.601 1.795.354.353.87.525 1.538.525.61 0 1.174-.143 1.527-.382l-.152-.984a2.54 2.54 0 0 1-1.223.296c-.276 0-.467-.057-.601-.181-.153-.124-.239-.334-.267-.63h2.368c.01-.067.019-.392.019-.497M23 5.891v12.222a1.23 1.23 0 0 1-1.222 1.223H2.222A1.23 1.23 0 0 1 1 18.114V5.892A1.23 1.23 0 0 1 2.222 4.67h19.556A1.23 1.23 0 0 1 23 5.892" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/CCVisa.tsx b/web/packages/design/src/Icon/Icons/CCVisa.tsx
index bfd54fbfc1907..1e9a7afff2630 100644
--- a/web/packages/design/src/Icon/Icons/CCVisa.tsx
+++ b/web/packages/design/src/Icon/Icons/CCVisa.tsx
@@ -59,7 +59,7 @@ export const CCVisa = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M19.8585 12.9008H18.5408C18.5408 12.9008 18.6745 12.5475 19.171 11.1916C19.1615 11.2012 19.3047 10.8383 19.3811 10.6092L19.4957 11.1343C19.7917 12.5953 19.8585 12.9008 19.8585 12.9008ZM6.07031 12.2802L5.51649 9.46332C5.4401 9.07183 5.1441 8.9477 4.80035 8.9477H2.24132L2.22222 9.07183C3.97917 9.52062 5.42101 10.4755 6.07031 12.2802ZM7.77951 8.9477L6.23264 13.13L6.07031 12.2802C5.73611 11.3921 4.92448 10.571 4.00781 10.1986L5.29688 15.0684H6.96788L9.46007 8.9477H7.77951ZM9.10677 15.0779H10.6918L11.6849 8.9477H10.0998L9.10677 15.0779ZM16.4401 9.10048C16.125 8.97635 15.6285 8.84266 15.0174 8.84266C13.4514 8.84266 12.3533 9.67339 12.3438 10.867C12.3342 11.7454 13.1267 12.2324 13.7283 12.5284C14.349 12.8244 14.5495 13.025 14.5495 13.2923C14.5495 13.7029 14.053 13.8843 13.6042 13.8843C12.9644 13.8843 12.6207 13.8079 12.1146 13.5692L11.9045 13.4642L11.6849 14.8392C12.0573 15.0111 12.7352 15.1638 13.4514 15.1638C15.1128 15.1734 16.1918 14.3427 16.2109 13.0727C16.2109 12.3757 15.7812 11.8505 14.8741 11.4112C14.3203 11.1343 13.9861 10.9338 13.9861 10.6474C13.9861 10.3895 14.2726 10.1222 14.8932 10.1222C15.4089 10.1126 15.7908 10.2177 16.0773 10.3513L16.2205 10.4277L16.4401 9.10048ZM20.4983 8.9477H19.276C18.8941 8.9477 18.6076 9.06228 18.4453 9.46332L16.0964 15.0779H17.7578C18.0252 14.3236 18.092 14.1612 18.092 14.1612H20.1163C20.1163 14.1612 20.1641 14.3713 20.3073 15.0779H21.7778L20.4983 8.9477ZM23 5.89214V18.1144C23 18.7828 22.4462 19.3366 21.7778 19.3366H2.22222C1.55382 19.3366 1 18.7828 1 18.1144V5.89214C1 5.22374 1.55382 4.66992 2.22222 4.66992H21.7778C22.4462 4.66992 23 5.22374 23 5.89214Z" />
+      <path d="M19.859 12.9H18.54s.133-.353.63-1.708c-.01.01.134-.354.21-.583l.115.525c.296 1.461.363 1.767.363 1.767M6.07 12.28l-.554-2.817c-.076-.391-.372-.515-.716-.515H2.241l-.019.124c1.757.449 3.199 1.404 3.848 3.208m1.71-3.332L6.233 13.13l-.163-.85c-.334-.888-1.146-1.709-2.062-2.081l1.289 4.87h1.67L9.46 8.947zm1.327 6.13h1.585l.993-6.13H10.1zM16.44 9.1a3.9 3.9 0 0 0-1.423-.257c-1.566 0-2.664.83-2.673 2.024-.01.878.783 1.365 1.384 1.661.621.296.822.497.822.764 0 .41-.497.592-.946.592-.64 0-.983-.076-1.49-.315l-.21-.105-.22 1.375c.373.172 1.051.325 1.767.325 1.662.01 2.74-.821 2.76-2.091 0-.697-.43-1.223-1.337-1.662-.554-.277-.888-.477-.888-.764 0-.258.287-.525.907-.525.516-.01.898.096 1.184.23l.143.076zm4.058-.152h-1.222c-.382 0-.668.114-.83.515l-2.35 5.615h1.662c.267-.754.334-.917.334-.917h2.024s.048.21.191.917h1.47zM23 5.892v12.222a1.23 1.23 0 0 1-1.222 1.223H2.222A1.23 1.23 0 0 1 1 18.114V5.892A1.23 1.23 0 0 1 2.222 4.67h19.556A1.23 1.23 0 0 1 23 5.892" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Calendar.tsx b/web/packages/design/src/Icon/Icons/Calendar.tsx
index 7d8140bd01275..c7817c4e6b2de 100644
--- a/web/packages/design/src/Icon/Icons/Calendar.tsx
+++ b/web/packages/design/src/Icon/Icons/Calendar.tsx
@@ -59,12 +59,11 @@ export const Calendar = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M10.1442 10.612C10.3653 10.7487 10.4999 10.9901 10.4999 11.25V17.25C10.4999 17.6642 10.1641 18 9.74992 18C9.33571 18 8.99992 17.6642 8.99992 17.25V12.4635L8.58533 12.6708C8.21485 12.8561 7.76434 12.7059 7.5791 12.3354C7.39386 11.9649 7.54403 11.5144 7.91451 11.3292L9.41451 10.5792C9.647 10.4629 9.92311 10.4754 10.1442 10.612Z" />
-      <path d="M14.0767 12.0227C14.1762 11.9994 14.2794 11.9967 14.38 12.0147C14.4806 12.0327 14.5764 12.0711 14.6616 12.1275C14.7469 12.1839 14.8196 12.2571 14.8755 12.3426C14.9314 12.4282 14.9693 12.5242 14.9867 12.6249C15.0042 12.7256 15.0009 12.8288 14.977 12.9281C14.9531 13.0273 14.9091 13.121 14.8479 13.2027L12.15 16.7996C11.9796 17.0268 11.9521 17.3309 12.0792 17.585C12.2062 17.8391 12.4659 17.9996 12.75 17.9996H15.75C16.1642 17.9996 16.5 17.6638 16.5 17.2496C16.5 16.8354 16.1642 16.4996 15.75 16.4996H14.2501L16.0483 14.1021C16.2321 13.8568 16.3639 13.5765 16.4355 13.2785C16.5071 12.9804 16.517 12.6709 16.4647 12.3688C16.4124 12.0668 16.2989 11.7786 16.1312 11.522C15.9635 11.2654 15.7451 11.0458 15.4895 10.8766C15.2338 10.7074 14.9463 10.5923 14.6446 10.5382C14.3428 10.4841 14.0332 10.4923 13.7348 10.5622C13.4363 10.6321 13.1553 10.7622 12.9089 10.9446C12.6625 11.127 12.456 11.3578 12.3021 11.6229C12.094 11.9811 12.2158 12.4401 12.574 12.6481C12.9321 12.8562 13.3912 12.7344 13.5992 12.3763C13.6505 12.2879 13.7193 12.211 13.8015 12.1502C13.8836 12.0894 13.9773 12.046 14.0767 12.0227Z" />
+      <path d="M10.144 10.612a.75.75 0 0 1 .356.638v6a.75.75 0 0 1-1.5 0v-4.786l-.415.207a.75.75 0 1 1-.67-1.342l1.5-.75a.75.75 0 0 1 .73.033m3.932 1.411a.75.75 0 0 1 .77 1.18L12.15 16.8a.75.75 0 0 0 .6 1.2h3a.75.75 0 0 0 0-1.5h-1.5l1.798-2.398a2.25 2.25 0 1 0-3.746-2.48.75.75 0 1 0 1.297.754.75.75 0 0 1 .478-.353" />
       <path
         fillRule="evenodd"
+        d="M17.25 2.25a.75.75 0 0 0-1.5 0V3h-7.5v-.75a.75.75 0 0 0-1.5 0V3H4.5A1.5 1.5 0 0 0 3 4.5v15A1.5 1.5 0 0 0 4.5 21h15a1.5 1.5 0 0 0 1.5-1.5v-15A1.5 1.5 0 0 0 19.5 3h-2.25zM19.5 4.5h-2.25v.75a.75.75 0 0 1-1.5 0V4.5h-7.5v.75a.75.75 0 0 1-1.5 0V4.5H4.5v3h15zM4.5 9h15v10.5h-15z"
         clipRule="evenodd"
-        d="M17.25 2.25C17.25 1.83579 16.9142 1.5 16.5 1.5C16.0858 1.5 15.75 1.83579 15.75 2.25V3H8.25V2.25C8.25 1.83579 7.91421 1.5 7.5 1.5C7.08579 1.5 6.75 1.83579 6.75 2.25V3H4.5C3.67157 3 3 3.67157 3 4.5V19.5C3 20.3284 3.67157 21 4.5 21H19.5C20.3284 21 21 20.3284 21 19.5V4.5C21 3.67157 20.3284 3 19.5 3H17.25V2.25ZM19.5 4.5H17.25V5.25C17.25 5.66421 16.9142 6 16.5 6C16.0858 6 15.75 5.66421 15.75 5.25V4.5H8.25V5.25C8.25 5.66421 7.91421 6 7.5 6C7.08579 6 6.75 5.66421 6.75 5.25V4.5H4.5V7.5H19.5V4.5ZM4.5 9H19.5V19.5H4.5V9Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Camera.tsx b/web/packages/design/src/Icon/Icons/Camera.tsx
index bb781f825356c..f27591cc50c53 100644
--- a/web/packages/design/src/Icon/Icons/Camera.tsx
+++ b/web/packages/design/src/Icon/Icons/Camera.tsx
@@ -61,8 +61,8 @@ export const Camera = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3 5.25a1.5 1.5 0 0 0-1.5 1.5v10.5a1.5 1.5 0 0 0 1.5 1.5h15a1.5 1.5 0 0 0 1.5-1.5v-2.349l3.334 2.223A.75.75 0 0 0 24 16.5v-9a.75.75 0 0 0-1.166-.624L19.5 9.099V6.75a1.5 1.5 0 0 0-1.5-1.5zm16.5 5.651V13.1l3 2V8.9zM3 6.75h15v10.5H3z"
         clipRule="evenodd"
-        d="M3 5.25C2.17157 5.25 1.5 5.92157 1.5 6.75V17.25C1.5 18.0784 2.17157 18.75 3 18.75H18C18.8284 18.75 19.5 18.0784 19.5 17.25V14.9013L22.8341 17.124C23.0642 17.2775 23.3601 17.2918 23.604 17.1613C23.8478 17.0307 24.0001 16.7766 24.0001 16.5V7.5C24.0001 7.2234 23.8478 6.96926 23.604 6.83875C23.3601 6.70823 23.0642 6.72254 22.8341 6.87596L19.5 9.09867V6.75C19.5 5.92157 18.8284 5.25 18 5.25H3ZM19.5 10.9014V13.0986L22.5001 15.0986V8.90139L19.5 10.9014ZM3 6.75H18V17.25H3V6.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CardView.tsx b/web/packages/design/src/Icon/Icons/CardView.tsx
index 0683805ae8db6..a707b7d38f51a 100644
--- a/web/packages/design/src/Icon/Icons/CardView.tsx
+++ b/web/packages/design/src/Icon/Icons/CardView.tsx
@@ -61,23 +61,8 @@ export const CardView = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M5.25 3.75a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5zm9-1.5a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5zm-10.5 9a1.5 1.5 0 0 1 1.5-1.5h4.5a1.5 1.5 0 0 1 1.5 1.5v4.5a1.5 1.5 0 0 1-1.5 1.5h-4.5a1.5 1.5 0 0 1-1.5-1.5zm6 0h-4.5v4.5h4.5zm4.5-1.5a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5z"
         clipRule="evenodd"
-        d="M5.25 3.75C4.42157 3.75 3.75 4.42157 3.75 5.25V9.75C3.75 10.5784 4.42157 11.25 5.25 11.25H9.75C10.5784 11.25 11.25 10.5784 11.25 9.75V5.25C11.25 4.42157 10.5784 3.75 9.75 3.75H5.25ZM5.25 5.25H9.75V9.75H5.25V5.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M14.25 3.75C13.4216 3.75 12.75 4.42157 12.75 5.25V9.75C12.75 10.5784 13.4216 11.25 14.25 11.25H18.75C19.5784 11.25 20.25 10.5784 20.25 9.75V5.25C20.25 4.42157 19.5784 3.75 18.75 3.75H14.25ZM14.25 5.25H18.75V9.75H14.25V5.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M3.75 14.25C3.75 13.4216 4.42157 12.75 5.25 12.75H9.75C10.5784 12.75 11.25 13.4216 11.25 14.25V18.75C11.25 19.5784 10.5784 20.25 9.75 20.25H5.25C4.42157 20.25 3.75 19.5784 3.75 18.75V14.25ZM9.75 14.25H5.25V18.75H9.75V14.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M14.25 12.75C13.4216 12.75 12.75 13.4216 12.75 14.25V18.75C12.75 19.5784 13.4216 20.25 14.25 20.25H18.75C19.5784 20.25 20.25 19.5784 20.25 18.75V14.25C20.25 13.4216 19.5784 12.75 18.75 12.75H14.25ZM14.25 14.25H18.75V18.75H14.25V14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cash.tsx b/web/packages/design/src/Icon/Icons/Cash.tsx
index bdca4615dffa3..68a5063c27644 100644
--- a/web/packages/design/src/Icon/Icons/Cash.tsx
+++ b/web/packages/design/src/Icon/Icons/Cash.tsx
@@ -61,8 +61,8 @@ export const Cash = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M5.25 5.25H1.5A.75.75 0 0 0 .75 6v12c0 .414.336.75.75.75h21a.75.75 0 0 0 .75-.75V6a.75.75 0 0 0-.75-.75zm-3 5.095v3.31a5.33 5.33 0 0 1 3.594 3.595h12.312a5.33 5.33 0 0 1 3.594-3.594v-3.311a5.33 5.33 0 0 1-3.594-3.595H5.844a5.33 5.33 0 0 1-3.594 3.595M4.252 6.75H2.25v2.002A3.83 3.83 0 0 0 4.252 6.75m-.81 9.307c.345.345.62.75.81 1.193H2.25v-2.002c.443.191.848.465 1.193.81m18.308-.809v2.002h-2.002a3.83 3.83 0 0 1 2.002-2.002m0-8.498h-2.002a3.83 3.83 0 0 0 2.002 2.002zM9.75 12a2.25 2.25 0 1 1 4.5 0 2.25 2.25 0 0 1-4.5 0M12 8.25a3.75 3.75 0 1 0 0 7.5 3.75 3.75 0 0 0 0-7.5"
         clipRule="evenodd"
-        d="M5.24911 5.25H1.5C1.08579 5.25 0.75 5.58579 0.75 6V9.73572C0.749838 9.7447 0.749837 9.7537 0.75 9.76274V14.2375C0.749837 14.2465 0.749838 14.2555 0.75 14.2645V18C0.75 18.4142 1.08579 18.75 1.5 18.75H5.23018C5.24274 18.7503 5.25537 18.7503 5.26804 18.75H18.732C18.7446 18.7503 18.7573 18.7503 18.7698 18.75H22.5C22.9142 18.75 23.25 18.4142 23.25 18V14.2643C23.2502 14.2555 23.2502 14.2466 23.25 14.2377V9.76249C23.2502 9.75362 23.2502 9.74478 23.25 9.73596V6C23.25 5.58579 22.9142 5.25 22.5 5.25H18.7509H5.24911ZM2.25 10.3446V13.6557C3.09786 13.9071 3.87329 14.3667 4.50336 14.9968C5.13341 15.6268 5.59298 16.4022 5.84442 17.25H18.1556C18.407 16.4022 18.8666 15.6268 19.4966 14.9968C20.1267 14.3667 20.9021 13.9071 21.75 13.6557V10.3446C20.9021 10.0931 20.1267 9.63356 19.4966 9.00349C18.8665 8.37338 18.4069 7.5979 18.1555 6.75H5.84449C5.59307 7.5979 5.13347 8.37338 4.50336 9.00349C3.87329 9.63356 3.09786 10.0931 2.25 10.3446ZM4.25192 6.75H2.25V8.75198C2.6927 8.56125 3.09798 8.28755 3.4427 7.94283C3.78746 7.59807 4.06118 7.19275 4.25192 6.75ZM3.4427 16.0574C3.7874 16.4021 4.06108 16.8073 4.25181 17.25H2.25V15.2483C2.6927 15.439 3.09798 15.7127 3.4427 16.0574ZM21.75 15.2483V17.25H19.7482C19.9389 16.8073 20.2126 16.4021 20.5573 16.0574C20.902 15.7127 21.3073 15.439 21.75 15.2483ZM21.75 6.75H19.7481C19.9388 7.19275 20.2125 7.59807 20.5573 7.94283C20.902 8.28755 21.3073 8.56126 21.75 8.75199V6.75ZM9.75 12C9.75 10.7574 10.7574 9.75 12 9.75C13.2426 9.75 14.25 10.7574 14.25 12C14.25 13.2426 13.2426 14.25 12 14.25C10.7574 14.25 9.75 13.2426 9.75 12ZM12 8.25C9.92893 8.25 8.25 9.92893 8.25 12C8.25 14.0711 9.92893 15.75 12 15.75C14.0711 15.75 15.75 14.0711 15.75 12C15.75 9.92893 14.0711 8.25 12 8.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Chart.tsx b/web/packages/design/src/Icon/Icons/Chart.tsx
index 222e7224e658d..ab4e116013b76 100644
--- a/web/packages/design/src/Icon/Icons/Chart.tsx
+++ b/web/packages/design/src/Icon/Icons/Chart.tsx
@@ -61,8 +61,8 @@ export const Chart = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M14.25 3a.75.75 0 0 0-.75.75V7.5H9a.75.75 0 0 0-.75.75V12H4.5a.75.75 0 0 0-.75.75v6H3a.75.75 0 0 0 0 1.5h18a.75.75 0 0 0 0-1.5h-.75v-15A.75.75 0 0 0 19.5 3zm4.5 15.75V4.5H15v14.25zm-5.25 0V9H9.75v9.75zM5.25 13.5h3v5.25h-3z"
         clipRule="evenodd"
-        d="M14.25 3C13.8358 3 13.5 3.33579 13.5 3.75V7.5H9C8.58579 7.5 8.25 7.83579 8.25 8.25V12H4.5C4.08579 12 3.75 12.3358 3.75 12.75V18.75H3C2.58579 18.75 2.25 19.0858 2.25 19.5C2.25 19.9142 2.58579 20.25 3 20.25H21C21.4142 20.25 21.75 19.9142 21.75 19.5C21.75 19.0858 21.4142 18.75 21 18.75H20.25V3.75C20.25 3.33579 19.9142 3 19.5 3H14.25ZM18.75 18.75V4.5H15V18.75H18.75ZM13.5 18.75V9H9.75V18.75H13.5ZM5.25 13.5H8.25V18.75H5.25V13.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChatBubble.tsx b/web/packages/design/src/Icon/Icons/ChatBubble.tsx
index 714f83e25421d..6f2a8f13a57af 100644
--- a/web/packages/design/src/Icon/Icons/ChatBubble.tsx
+++ b/web/packages/design/src/Icon/Icons/ChatBubble.tsx
@@ -61,8 +61,8 @@ export const ChatBubble = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M2.69 4.94a1.5 1.5 0 0 1 1.06-.44h16.5a1.5 1.5 0 0 1 1.5 1.5v12a1.5 1.5 0 0 1-1.5 1.5H7.735l-3.008 2.637-.011.01A1.5 1.5 0 0 1 2.25 21V6c0-.398.158-.78.44-1.06M20.25 6H3.75v14.999l3.007-2.637.012-.01A1.5 1.5 0 0 1 7.734 18H20.25z"
         clipRule="evenodd"
-        d="M2.68934 4.93934C2.97064 4.65804 3.35217 4.5 3.75 4.5H20.25C20.6478 4.5 21.0294 4.65804 21.3107 4.93934C21.592 5.22065 21.75 5.60218 21.75 6V18C21.75 18.3978 21.592 18.7794 21.3107 19.0607C21.0294 19.342 20.6478 19.5 20.25 19.5H7.73481L4.72724 22.1368L4.71563 22.1467C4.49715 22.3305 4.23076 22.4482 3.94774 22.4858C3.66473 22.5234 3.37685 22.4795 3.11794 22.3592C2.85902 22.2389 2.63981 22.0472 2.48606 21.8066C2.33232 21.5661 2.25042 21.2866 2.25 21.0011L2.25 6C2.25 5.60217 2.40804 5.22064 2.68934 4.93934ZM20.25 6L3.75 6L3.75 20.9987L6.75714 18.3623L6.76854 18.3525C7.03885 18.1249 7.38082 18.0001 7.73416 18H20.25V6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChatCircleSparkle.tsx b/web/packages/design/src/Icon/Icons/ChatCircleSparkle.tsx
index 414ae583daaf1..4041de0b3ada9 100644
--- a/web/packages/design/src/Icon/Icons/ChatCircleSparkle.tsx
+++ b/web/packages/design/src/Icon/Icons/ChatCircleSparkle.tsx
@@ -59,13 +59,13 @@ export const ChatCircleSparkle = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M14.5 1.75C14.5 1.33579 14.1642 1 13.75 1C13.3358 1 13 1.33579 13 1.75V3.25H11.5C11.0858 3.25 10.75 3.58579 10.75 4C10.75 4.41421 11.0858 4.75 11.5 4.75H13V6.25C13 6.66421 13.3358 7 13.75 7C14.1642 7 14.5 6.66421 14.5 6.25V4.75H16C16.4142 4.75 16.75 4.41421 16.75 4C16.75 3.58579 16.4142 3.25 16 3.25H14.5V1.75Z" />
+      <path d="M14.5 1.75a.75.75 0 0 0-1.5 0v1.5h-1.5a.75.75 0 0 0 0 1.5H13v1.5a.75.75 0 0 0 1.5 0v-1.5H16a.75.75 0 0 0 0-1.5h-1.5z" />
       <path
         fillRule="evenodd"
+        d="M6.33 3.21a1.173 1.173 0 0 1 1.77.555l.002.005 1.167 3.212 3.216 1.17a1.173 1.173 0 0 1 0 2.199l-.005.002-3.214 1.169-1.168 3.213a1.173 1.173 0 0 1-2.2 0l-.002-.005-1.165-3.212-3.216-1.17a1.174 1.174 0 0 1 0-2.199l.005-.002 3.21-1.165L5.9 3.765a1.2 1.2 0 0 1 .43-.555M7 5.13l.912 2.508v.002a1.17 1.17 0 0 0 .698.698h.002l2.509.913-2.505.91-.002.002a1.17 1.17 0 0 0-.701.69l-.915 2.516-.91-2.507v-.002a1.17 1.17 0 0 0-.698-.698l-2.51-.913 2.507-.91h.003a1.17 1.17 0 0 0 .698-.699v-.002z"
         clipRule="evenodd"
-        d="M6.33014 3.21007C6.52674 3.07331 6.7605 3 7 3C7.2395 3 7.47326 3.07331 7.66986 3.21007C7.86646 3.34683 8.01648 3.54047 8.09979 3.76497L8.10154 3.76967L9.26915 6.98166L12.4852 8.15121C12.7097 8.23456 12.9033 8.38466 13.04 8.58127C13.1767 8.77787 13.25 9.01161 13.25 9.25106C13.25 9.49051 13.1767 9.72424 13.04 9.92085C12.9033 10.1175 12.7097 10.2675 12.4852 10.3509L12.4805 10.3526L9.26583 11.5217L8.09769 14.735C8.01438 14.9595 7.86434 15.1532 7.66774 15.2899C7.47114 15.4267 7.23739 15.5 6.99788 15.5C6.75838 15.5 6.52463 15.4267 6.32803 15.2899C6.13143 15.1532 5.98141 14.9595 5.89809 14.735L5.8962 14.7299L4.73075 11.5183L1.51482 10.3488C1.2903 10.2654 1.09669 10.1153 0.95998 9.91873C0.823268 9.72213 0.75 9.4884 0.75 9.24894C0.75 9.00949 0.823268 8.77576 0.95998 8.57915C1.09669 8.38254 1.29031 8.23246 1.51483 8.14911L1.51992 8.14722L4.73089 6.98155L5.90019 3.76497C5.98351 3.54047 6.13354 3.34683 6.33014 3.21007ZM7 5.13002L7.91187 7.63845L7.91249 7.64015C7.97112 7.80022 8.06393 7.9456 8.18446 8.06616C8.305 8.18672 8.45038 8.27957 8.61046 8.33822L8.61216 8.33884L11.1206 9.25106L8.6164 10.1617L8.61379 10.1627C8.45423 10.22 8.30901 10.3113 8.18811 10.4302C8.06657 10.5498 7.97254 10.6944 7.91257 10.8539L6.99815 13.3692L6.08827 10.8619L6.08751 10.8598C6.02888 10.6998 5.93607 10.5544 5.81554 10.4338C5.695 10.3133 5.54963 10.2204 5.38954 10.1618L2.88017 9.24921L5.38745 8.33899L5.38954 8.33822C5.54963 8.27957 5.695 8.18672 5.81554 8.06616C5.93607 7.9456 6.02888 7.80022 6.08751 7.64015L6.08813 7.63845L7 5.13002Z"
       />
-      <path d="M15.9102 7.51188C15.4966 7.4893 15.143 7.80629 15.1204 8.21989C15.0979 8.63348 15.4149 8.98707 15.8285 9.00965C16.84 9.06486 17.8212 9.37532 18.6804 9.91208C19.5396 10.4488 20.2489 11.1944 20.7422 12.0793C21.2355 12.9642 21.4966 13.9596 21.5014 14.9727C21.5061 15.9857 21.2543 16.9835 20.7693 17.873C20.6751 18.0458 20.6525 18.2487 20.7066 18.438L21.4137 20.9142L18.9375 20.2071C18.7484 20.1531 18.5456 20.1755 18.3729 20.2696C17.6093 20.6853 16.7646 20.9303 15.897 20.9875C15.0295 21.0448 14.1599 20.913 13.3483 20.6012C12.5367 20.2895 11.8025 19.8052 11.1964 19.1818C10.5903 18.5585 10.1268 17.811 9.83797 16.9909C9.70035 16.6003 9.27207 16.3951 8.88139 16.5327C8.49071 16.6704 8.28556 17.0986 8.42318 17.4893C8.78421 18.5142 9.36348 19.4484 10.121 20.2275C10.8784 21.0065 11.7961 21.6118 12.8104 22.0015C13.8247 22.3911 14.9116 22.5558 15.9958 22.4843C16.9756 22.4196 17.9322 22.1633 18.8117 21.7311L21.3253 22.449C21.5503 22.5133 21.789 22.5165 22.0155 22.4578C22.2423 22.3991 22.4492 22.2809 22.6148 22.1153C22.7804 21.9497 22.8987 21.7428 22.9573 21.516C23.016 21.2895 23.0129 21.0514 22.9486 20.8264L22.2307 18.3124C22.7424 17.2727 23.0068 16.1272 23.0014 14.9656C22.9954 13.6993 22.669 12.4551 22.0524 11.3489C21.4358 10.2428 20.5491 9.31086 19.4751 8.63992C18.4011 7.96897 17.1747 7.5809 15.9102 7.51188Z" />
+      <path d="M15.91 7.512a.75.75 0 1 0-.082 1.498 6 6 0 0 1 4.941 8.863.75.75 0 0 0-.062.565l.707 2.476-2.477-.707a.75.75 0 0 0-.564.063 6.004 6.004 0 0 1-8.535-3.28.75.75 0 0 0-1.415.5 7.505 7.505 0 0 0 10.389 4.241l2.513.718a1.314 1.314 0 0 0 1.624-1.623l-.718-2.514a7.5 7.5 0 0 0-6.32-10.8" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Check.tsx b/web/packages/design/src/Icon/Icons/Check.tsx
index e82758226213e..4932d112d508a 100644
--- a/web/packages/design/src/Icon/Icons/Check.tsx
+++ b/web/packages/design/src/Icon/Icons/Check.tsx
@@ -61,8 +61,8 @@ export const Check = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M21.53 6.22a.75.75 0 0 1 0 1.06l-12 12a.75.75 0 0 1-1.06 0l-5.25-5.25a.75.75 0 1 1 1.06-1.06L9 17.69 20.47 6.22a.75.75 0 0 1 1.06 0"
         clipRule="evenodd"
-        d="M21.5303 6.21967C21.8232 6.51256 21.8232 6.98744 21.5303 7.28033L9.53033 19.2803C9.23744 19.5732 8.76256 19.5732 8.46967 19.2803L3.21967 14.0303C2.92678 13.7374 2.92678 13.2626 3.21967 12.9697C3.51256 12.6768 3.98744 12.6768 4.28033 12.9697L9 17.6893L20.4697 6.21967C20.7626 5.92678 21.2374 5.92678 21.5303 6.21967Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CheckThick.tsx b/web/packages/design/src/Icon/Icons/CheckThick.tsx
index 96db8cf7b63b8..fff24bfe05065 100644
--- a/web/packages/design/src/Icon/Icons/CheckThick.tsx
+++ b/web/packages/design/src/Icon/Icons/CheckThick.tsx
@@ -61,8 +61,8 @@ export const CheckThick = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M21.457 5.293a1 1 0 0 1 0 1.414l-12 12a1 1 0 0 1-1.414 0l-5.25-5.25a1 1 0 1 1 1.414-1.414l4.543 4.543L20.043 5.293a1 1 0 0 1 1.414 0"
         clipRule="evenodd"
-        d="M21.4571 5.29289C21.8476 5.68342 21.8476 6.31658 21.4571 6.70711L9.45711 18.7071C9.06658 19.0976 8.43342 19.0976 8.04289 18.7071L2.79289 13.4571C2.40237 13.0666 2.40237 12.4334 2.79289 12.0429C3.18342 11.6524 3.81658 11.6524 4.20711 12.0429L8.75 16.5858L20.0429 5.29289C20.4334 4.90237 21.0666 4.90237 21.4571 5.29289Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Checks.tsx b/web/packages/design/src/Icon/Icons/Checks.tsx
index 581b12db4226a..230c9880728f1 100644
--- a/web/packages/design/src/Icon/Icons/Checks.tsx
+++ b/web/packages/design/src/Icon/Icons/Checks.tsx
@@ -59,8 +59,7 @@ export const Checks = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M23.0254 8.03509C23.3209 7.74484 23.3252 7.26999 23.0349 6.97447C22.7447 6.67895 22.2698 6.67467 21.9743 6.96491L14.0998 14.6988L12.3341 12.9649C12.0385 12.6747 11.5637 12.679 11.2735 12.9745C10.9832 13.2701 10.9876 13.7449 11.2831 14.0351L13.5744 16.2851C13.8661 16.5716 14.3336 16.5716 14.6254 16.2851L23.0254 8.03509Z" />
-      <path d="M14.0255 8.03509C14.3211 7.74484 14.3253 7.26999 14.0351 6.97447C13.7448 6.67895 13.27 6.67467 12.9745 6.96491L5.09997 14.6988L2.0255 11.6796C1.72996 11.3893 1.25511 11.3937 0.964884 11.6892C0.674658 11.9847 0.678963 12.4596 0.9745 12.7498L4.5745 16.2851C4.86627 16.5716 5.33378 16.5716 5.62553 16.2851L14.0255 8.03509Z" />
+      <path d="M23.025 8.035a.75.75 0 1 0-1.05-1.07L14.1 14.699l-1.766-1.734a.75.75 0 0 0-1.05 1.07l2.29 2.25a.75.75 0 0 0 1.051 0zm-8.999 0a.75.75 0 1 0-1.051-1.07L5.1 14.699l-3.074-3.02a.75.75 0 1 0-1.051 1.07l3.6 3.536a.75.75 0 0 0 1.05 0z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ChevronCircleDown.tsx b/web/packages/design/src/Icon/Icons/ChevronCircleDown.tsx
index 6379f8e59d941..c4916ab5df599 100644
--- a/web/packages/design/src/Icon/Icons/ChevronCircleDown.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronCircleDown.tsx
@@ -59,11 +59,11 @@ export const ChevronCircleDown = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M8.78033 9.96967C8.48744 9.67678 8.01256 9.67678 7.71967 9.96967C7.42678 10.2626 7.42678 10.7374 7.71967 11.0303L11.4697 14.7803C11.7626 15.0732 12.2374 15.0732 12.5303 14.7803L16.2803 11.0303C16.5732 10.7374 16.5732 10.2626 16.2803 9.96967C15.9874 9.67678 15.5126 9.67678 15.2197 9.96967L12 13.1893L8.78033 9.96967Z" />
+      <path d="M8.78 9.97a.75.75 0 0 0-1.06 1.06l3.75 3.75a.75.75 0 0 0 1.06 0l3.75-3.75a.75.75 0 1 0-1.06-1.06L12 13.19z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronCircleLeft.tsx b/web/packages/design/src/Icon/Icons/ChevronCircleLeft.tsx
index e996d8edd1d57..16dc7c8bc0a41 100644
--- a/web/packages/design/src/Icon/Icons/ChevronCircleLeft.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronCircleLeft.tsx
@@ -59,11 +59,11 @@ export const ChevronCircleLeft = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M14.0303 8.78033C14.3232 8.48744 14.3232 8.01256 14.0303 7.71967C13.7374 7.42678 13.2626 7.42678 12.9697 7.71967L9.21967 11.4697C8.92678 11.7626 8.92678 12.2374 9.21967 12.5303L12.9697 16.2803C13.2626 16.5732 13.7374 16.5732 14.0303 16.2803C14.3232 15.9874 14.3232 15.5126 14.0303 15.2197L10.8107 12L14.0303 8.78033Z" />
+      <path d="M14.03 8.78a.75.75 0 0 0-1.06-1.06l-3.75 3.75a.75.75 0 0 0 0 1.06l3.75 3.75a.75.75 0 1 0 1.06-1.06L10.81 12z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronCircleRight.tsx b/web/packages/design/src/Icon/Icons/ChevronCircleRight.tsx
index 4c3a86f8f2d2f..bcc15473ec571 100644
--- a/web/packages/design/src/Icon/Icons/ChevronCircleRight.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronCircleRight.tsx
@@ -59,11 +59,11 @@ export const ChevronCircleRight = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.0303 7.71967C10.7374 7.42678 10.2626 7.42678 9.96967 7.71967C9.67678 8.01256 9.67678 8.48744 9.96967 8.78033L13.1893 12L9.96967 15.2197C9.67678 15.5126 9.67678 15.9874 9.96967 16.2803C10.2626 16.5732 10.7374 16.5732 11.0303 16.2803L14.7803 12.5303C15.0732 12.2374 15.0732 11.7626 14.7803 11.4697L11.0303 7.71967Z" />
+      <path d="M11.03 7.72a.75.75 0 1 0-1.06 1.06L13.19 12l-3.22 3.22a.75.75 0 1 0 1.06 1.06l3.75-3.75a.75.75 0 0 0 0-1.06z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronCircleUp.tsx b/web/packages/design/src/Icon/Icons/ChevronCircleUp.tsx
index dc6367605f1d0..214a6d6382ef4 100644
--- a/web/packages/design/src/Icon/Icons/ChevronCircleUp.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronCircleUp.tsx
@@ -59,11 +59,11 @@ export const ChevronCircleUp = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.2803 12.9697L12.5303 9.21967C12.2374 8.92678 11.7626 8.92678 11.4697 9.21967L7.71967 12.9697C7.42678 13.2626 7.42678 13.7374 7.71967 14.0303C8.01256 14.3232 8.48744 14.3232 8.78033 14.0303L12 10.8107L15.2197 14.0303C15.5126 14.3232 15.9874 14.3232 16.2803 14.0303C16.5732 13.7374 16.5732 13.2626 16.2803 12.9697Z" />
+      <path d="m16.28 12.97-3.75-3.75a.75.75 0 0 0-1.06 0l-3.75 3.75a.75.75 0 1 0 1.06 1.06L12 10.81l3.22 3.22a.75.75 0 1 0 1.06-1.06" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronDown.tsx b/web/packages/design/src/Icon/Icons/ChevronDown.tsx
index 907e78d1d6470..a7e2654f5ee47 100644
--- a/web/packages/design/src/Icon/Icons/ChevronDown.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronDown.tsx
@@ -61,8 +61,8 @@ export const ChevronDown = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.97 8.47a.75.75 0 0 1 1.06 0L12 15.44l6.97-6.97a.75.75 0 1 1 1.06 1.06l-7.5 7.5a.75.75 0 0 1-1.06 0l-7.5-7.5a.75.75 0 0 1 0-1.06"
         clipRule="evenodd"
-        d="M3.96967 8.46967C4.26256 8.17678 4.73744 8.17678 5.03033 8.46967L12 15.4393L18.9697 8.46967C19.2626 8.17678 19.7374 8.17678 20.0303 8.46967C20.3232 8.76256 20.3232 9.23744 20.0303 9.53033L12.5303 17.0303C12.2374 17.3232 11.7626 17.3232 11.4697 17.0303L3.96967 9.53033C3.67678 9.23744 3.67678 8.76256 3.96967 8.46967Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronLeft.tsx b/web/packages/design/src/Icon/Icons/ChevronLeft.tsx
index f50f5ff0faae5..d58a2721f996f 100644
--- a/web/packages/design/src/Icon/Icons/ChevronLeft.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronLeft.tsx
@@ -61,8 +61,8 @@ export const ChevronLeft = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M15.53 3.97a.75.75 0 0 1 0 1.06L8.56 12l6.97 6.97a.75.75 0 1 1-1.06 1.06l-7.5-7.5a.75.75 0 0 1 0-1.06l7.5-7.5a.75.75 0 0 1 1.06 0"
         clipRule="evenodd"
-        d="M15.5303 3.96967C15.8232 4.26256 15.8232 4.73744 15.5303 5.03033L8.56066 12L15.5303 18.9697C15.8232 19.2626 15.8232 19.7374 15.5303 20.0303C15.2374 20.3232 14.7626 20.3232 14.4697 20.0303L6.96967 12.5303C6.67678 12.2374 6.67678 11.7626 6.96967 11.4697L14.4697 3.96967C14.7626 3.67678 15.2374 3.67678 15.5303 3.96967Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronRight.tsx b/web/packages/design/src/Icon/Icons/ChevronRight.tsx
index fb1f999536beb..ef3ae47997273 100644
--- a/web/packages/design/src/Icon/Icons/ChevronRight.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronRight.tsx
@@ -61,8 +61,8 @@ export const ChevronRight = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M8.47 3.97a.75.75 0 0 1 1.06 0l7.5 7.5a.75.75 0 0 1 0 1.06l-7.5 7.5a.75.75 0 0 1-1.06-1.06L15.44 12 8.47 5.03a.75.75 0 0 1 0-1.06"
         clipRule="evenodd"
-        d="M8.46967 3.96967C8.76256 3.67678 9.23744 3.67678 9.53033 3.96967L17.0303 11.4697C17.3232 11.7626 17.3232 12.2374 17.0303 12.5303L9.53033 20.0303C9.23744 20.3232 8.76256 20.3232 8.46967 20.0303C8.17678 19.7374 8.17678 19.2626 8.46967 18.9697L15.4393 12L8.46967 5.03033C8.17678 4.73744 8.17678 4.26256 8.46967 3.96967Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronUp.tsx b/web/packages/design/src/Icon/Icons/ChevronUp.tsx
index b68a8f49b9a99..dbd76b88d1b7a 100644
--- a/web/packages/design/src/Icon/Icons/ChevronUp.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronUp.tsx
@@ -61,8 +61,8 @@ export const ChevronUp = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M11.47 6.97a.75.75 0 0 1 1.06 0l7.5 7.5a.75.75 0 1 1-1.06 1.06L12 8.56l-6.97 6.97a.75.75 0 0 1-1.06-1.06z"
         clipRule="evenodd"
-        d="M11.4697 6.96967C11.7626 6.67678 12.2374 6.67678 12.5303 6.96967L20.0303 14.4697C20.3232 14.7626 20.3232 15.2374 20.0303 15.5303C19.7374 15.8232 19.2626 15.8232 18.9697 15.5303L12 8.56066L5.03033 15.5303C4.73744 15.8232 4.26256 15.8232 3.96967 15.5303C3.67678 15.2374 3.67678 14.7626 3.96967 14.4697L11.4697 6.96967Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ChevronsVertical.tsx b/web/packages/design/src/Icon/Icons/ChevronsVertical.tsx
index af8c404deb649..81be5d03a6240 100644
--- a/web/packages/design/src/Icon/Icons/ChevronsVertical.tsx
+++ b/web/packages/design/src/Icon/Icons/ChevronsVertical.tsx
@@ -59,8 +59,7 @@ export const ChevronsVertical = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.5303 2.46967C12.2374 2.17678 11.7626 2.17678 11.4697 2.46967L6.96967 6.96967C6.67678 7.26256 6.67678 7.73744 6.96967 8.03033C7.26256 8.32322 7.73744 8.32322 8.03033 8.03033L12 4.06066L15.9697 8.03033C16.2626 8.32322 16.7374 8.32322 17.0303 8.03033C17.3232 7.73744 17.3232 7.26256 17.0303 6.96967L12.5303 2.46967Z" />
-      <path d="M8.03033 15.9697C7.73744 15.6768 7.26256 15.6768 6.96967 15.9697C6.67678 16.2626 6.67678 16.7374 6.96967 17.0303L11.4697 21.5303C11.7626 21.8232 12.2374 21.8232 12.5303 21.5303L17.0303 17.0303C17.3232 16.7374 17.3232 16.2626 17.0303 15.9697C16.7374 15.6768 16.2626 15.6768 15.9697 15.9697L12 19.9393L8.03033 15.9697Z" />
+      <path d="M12.53 2.47a.75.75 0 0 0-1.06 0l-4.5 4.5a.75.75 0 0 0 1.06 1.06L12 4.06l3.97 3.97a.75.75 0 1 0 1.06-1.06zm-4.5 13.5a.75.75 0 0 0-1.06 1.06l4.5 4.5a.75.75 0 0 0 1.06 0l4.5-4.5a.75.75 0 1 0-1.06-1.06L12 19.94z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/CircleArrowLeft.tsx b/web/packages/design/src/Icon/Icons/CircleArrowLeft.tsx
index 061067863c128..cf22b2867d267 100644
--- a/web/packages/design/src/Icon/Icons/CircleArrowLeft.tsx
+++ b/web/packages/design/src/Icon/Icons/CircleArrowLeft.tsx
@@ -59,11 +59,11 @@ export const CircleArrowLeft = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M10.0607 11.25L11.7803 9.53033C12.0732 9.23744 12.0732 8.76256 11.7803 8.46967C11.4874 8.17678 11.0126 8.17678 10.7197 8.46967L7.71967 11.4697C7.64776 11.5416 7.59351 11.6245 7.55691 11.7129C7.52024 11.8013 7.5 11.8983 7.5 12C7.5 12.1017 7.52024 12.1987 7.55691 12.2871C7.59351 12.3755 7.64776 12.4584 7.71967 12.5303L10.7197 15.5303C11.0126 15.8232 11.4874 15.8232 11.7803 15.5303C12.0732 15.2374 12.0732 14.7626 11.7803 14.4697L10.0607 12.75H15.75C16.1642 12.75 16.5 12.4142 16.5 12C16.5 11.5858 16.1642 11.25 15.75 11.25H10.0607Z" />
+      <path d="m10.06 11.25 1.72-1.72a.75.75 0 0 0-1.06-1.06l-3 3a.75.75 0 0 0 0 1.06l3 3a.75.75 0 1 0 1.06-1.06l-1.72-1.72h5.69a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365 9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12M12 3.75a8.25 8.25 0 1 0 0 16.5 8.25 8.25 0 0 0 0-16.5"
         clipRule="evenodd"
-        d="M2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12ZM12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.5563 7.44365 20.25 12 20.25C16.5563 20.25 20.25 16.5563 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CircleArrowRight.tsx b/web/packages/design/src/Icon/Icons/CircleArrowRight.tsx
index 2a825ccd6a7eb..411ef150c767b 100644
--- a/web/packages/design/src/Icon/Icons/CircleArrowRight.tsx
+++ b/web/packages/design/src/Icon/Icons/CircleArrowRight.tsx
@@ -61,8 +61,8 @@ export const CircleArrowRight = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 3.75a8.25 8.25 0 1 0 0 16.5 8.25 8.25 0 0 0 0-16.5M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365 9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12m5.25 0a.75.75 0 0 1 .75-.75h5.69l-1.72-1.72a.75.75 0 0 1 1.06-1.06l3 3a.75.75 0 0 1 0 1.06l-3 3a.75.75 0 1 1-1.06-1.06l1.72-1.72H8.25A.75.75 0 0 1 7.5 12"
         clipRule="evenodd"
-        d="M12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.5563 7.44365 20.25 12 20.25C16.5563 20.25 20.25 16.5563 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75ZM2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12ZM7.5 12C7.5 11.5858 7.83579 11.25 8.25 11.25H13.9393L12.2197 9.53033C11.9268 9.23744 11.9268 8.76256 12.2197 8.46967C12.5126 8.17678 12.9874 8.17678 13.2803 8.46967L16.2803 11.4697C16.3522 11.5416 16.4065 11.6245 16.4431 11.7129C16.4798 11.8013 16.5 11.8983 16.5 12C16.5 12.1017 16.4798 12.1987 16.4431 12.2871C16.4065 12.3755 16.3522 12.4584 16.2803 12.5303L13.2803 15.5303C12.9874 15.8232 12.5126 15.8232 12.2197 15.5303C11.9268 15.2374 11.9268 14.7626 12.2197 14.4697L13.9393 12.75H8.25C7.83579 12.75 7.5 12.4142 7.5 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CircleCheck.tsx b/web/packages/design/src/Icon/Icons/CircleCheck.tsx
index 7225ede5a5cc3..4c6182f8733c4 100644
--- a/web/packages/design/src/Icon/Icons/CircleCheck.tsx
+++ b/web/packages/design/src/Icon/Icons/CircleCheck.tsx
@@ -59,11 +59,11 @@ export const CircleCheck = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.2803 10.2803C16.5732 9.98744 16.5732 9.51256 16.2803 9.21967C15.9874 8.92678 15.5126 8.92678 15.2197 9.21967L10.5 13.9393L8.78033 12.2197C8.48744 11.9268 8.01256 11.9268 7.71967 12.2197C7.42678 12.5126 7.42678 12.9874 7.71967 13.2803L9.96967 15.5303C10.2626 15.8232 10.7374 15.8232 11.0303 15.5303L16.2803 10.2803Z" />
+      <path d="M16.28 10.28a.75.75 0 1 0-1.06-1.06l-4.72 4.72-1.72-1.72a.75.75 0 0 0-1.06 1.06l2.25 2.25a.75.75 0 0 0 1.06 0z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CircleCross.tsx b/web/packages/design/src/Icon/Icons/CircleCross.tsx
index 0e3a30943ae79..607b8a744755d 100644
--- a/web/packages/design/src/Icon/Icons/CircleCross.tsx
+++ b/web/packages/design/src/Icon/Icons/CircleCross.tsx
@@ -59,11 +59,11 @@ export const CircleCross = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M15.5303 8.46967C15.8232 8.76256 15.8232 9.23744 15.5303 9.53033L13.0607 12L15.5303 14.4697C15.8232 14.7626 15.8232 15.2374 15.5303 15.5303C15.2374 15.8232 14.7626 15.8232 14.4697 15.5303L12 13.0607L9.53033 15.5303C9.23744 15.8232 8.76256 15.8232 8.46967 15.5303C8.17678 15.2374 8.17678 14.7626 8.46967 14.4697L10.9393 12L8.46967 9.53033C8.17678 9.23744 8.17678 8.76256 8.46967 8.46967C8.76256 8.17678 9.23744 8.17678 9.53033 8.46967L12 10.9393L14.4697 8.46967C14.7626 8.17678 15.2374 8.17678 15.5303 8.46967Z" />
+      <path d="M15.53 8.47a.75.75 0 0 1 0 1.06L13.06 12l2.47 2.47a.75.75 0 1 1-1.06 1.06L12 13.06l-2.47 2.47a.75.75 0 0 1-1.06-1.06L10.94 12 8.47 9.53a.75.75 0 0 1 1.06-1.06L12 10.94l2.47-2.47a.75.75 0 0 1 1.06 0" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CircleDashed.tsx b/web/packages/design/src/Icon/Icons/CircleDashed.tsx
new file mode 100644
index 0000000000000..5d9cae95e6471
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/CircleDashed.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const CircleDashed = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-circledashed"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M9.938 4.007a8.2 8.2 0 0 1 4.124 0 .75.75 0 0 0 .376-1.451 9.7 9.7 0 0 0-4.877 0 .75.75 0 1 0 .377 1.451M6.112 6.221a.75.75 0 0 0-1.07-1.053 9.7 9.7 0 0 0-2.438 4.223.75.75 0 0 0 1.446.4 8.2 8.2 0 0 1 2.062-3.57m-2.985 7.464a.75.75 0 0 1 .923.524 8.2 8.2 0 0 0 2.062 3.571.75.75 0 1 1-1.07 1.053 9.7 9.7 0 0 1-2.438-4.225.75.75 0 0 1 .523-.923m6.811 6.308a.75.75 0 1 0-.377 1.452c1.6.415 3.278.415 4.877 0a.75.75 0 0 0-.377-1.452 8.2 8.2 0 0 1-4.123 0m10.935-6.306a.75.75 0 0 1 .523.922 9.7 9.7 0 0 1-2.439 4.223.75.75 0 1 1-1.069-1.053 8.2 8.2 0 0 0 2.062-3.57.75.75 0 0 1 .923-.522m-1.916-8.52a.75.75 0 0 0-1.069 1.052 8.2 8.2 0 0 1 2.062 3.572.75.75 0 0 0 1.446-.4 9.7 9.7 0 0 0-2.439-4.224"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/CirclePause.tsx b/web/packages/design/src/Icon/Icons/CirclePause.tsx
index fbec5ef543a86..2b1f716f01697 100644
--- a/web/packages/design/src/Icon/Icons/CirclePause.tsx
+++ b/web/packages/design/src/Icon/Icons/CirclePause.tsx
@@ -59,12 +59,11 @@ export const CirclePause = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9.75 8.25C10.1642 8.25 10.5 8.58579 10.5 9V15C10.5 15.4142 10.1642 15.75 9.75 15.75C9.33579 15.75 9 15.4142 9 15V9C9 8.58579 9.33579 8.25 9.75 8.25Z" />
-      <path d="M15 9C15 8.58579 14.6642 8.25 14.25 8.25C13.8358 8.25 13.5 8.58579 13.5 9V15C13.5 15.4142 13.8358 15.75 14.25 15.75C14.6642 15.75 15 15.4142 15 15V9Z" />
+      <path d="M9.75 8.25a.75.75 0 0 1 .75.75v6A.75.75 0 0 1 9 15V9a.75.75 0 0 1 .75-.75M15 9a.75.75 0 0 0-1.5 0v6a.75.75 0 0 0 1.5 0z" />
       <path
         fillRule="evenodd"
+        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365 9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12M12 3.75a8.25 8.25 0 1 0 0 16.5 8.25 8.25 0 0 0 0-16.5"
         clipRule="evenodd"
-        d="M2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12ZM12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.5563 7.44365 20.25 12 20.25C16.5563 20.25 20.25 16.5563 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CirclePlay.tsx b/web/packages/design/src/Icon/Icons/CirclePlay.tsx
index 869fe0ef99ff4..848cb21456984 100644
--- a/web/packages/design/src/Icon/Icons/CirclePlay.tsx
+++ b/web/packages/design/src/Icon/Icons/CirclePlay.tsx
@@ -61,13 +61,13 @@ export const CirclePlay = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.916 8.376A.75.75 0 0 0 9.75 9v6a.75.75 0 0 0 1.166.624l4.5-3a.75.75 0 0 0 0-1.248zm.334 5.223V10.4l2.398 1.6z"
         clipRule="evenodd"
-        d="M10.916 8.37596C10.6859 8.22254 10.39 8.20823 10.1461 8.33875C9.90224 8.46926 9.75 8.7234 9.75 9V15C9.75 15.2766 9.90224 15.5307 10.1461 15.6613C10.39 15.7918 10.6859 15.7775 10.916 15.624L15.416 12.624C15.6247 12.4849 15.75 12.2508 15.75 12C15.75 11.7492 15.6247 11.5151 15.416 11.376L10.916 8.37596ZM11.25 13.5986V10.4014L13.6479 12L11.25 13.5986Z"
       />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CircleStop.tsx b/web/packages/design/src/Icon/Icons/CircleStop.tsx
index 48d7ef006875f..fd3ae6ec4978b 100644
--- a/web/packages/design/src/Icon/Icons/CircleStop.tsx
+++ b/web/packages/design/src/Icon/Icons/CircleStop.tsx
@@ -61,13 +61,13 @@ export const CircleStop = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M9.75 9a.75.75 0 0 0-.75.75v4.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 .75-.75v-4.5a.75.75 0 0 0-.75-.75zm.75 4.5v-3h3v3z"
         clipRule="evenodd"
-        d="M9.75 9C9.33579 9 9 9.33579 9 9.75V14.25C9 14.6642 9.33579 15 9.75 15H14.25C14.6642 15 15 14.6642 15 14.25V9.75C15 9.33579 14.6642 9 14.25 9H9.75ZM10.5 13.5V10.5H13.5V13.5H10.5Z"
       />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cli.tsx b/web/packages/design/src/Icon/Icons/Cli.tsx
index 84a6243942be5..0b76377e60a27 100644
--- a/web/packages/design/src/Icon/Icons/Cli.tsx
+++ b/web/packages/design/src/Icon/Icons/Cli.tsx
@@ -61,8 +61,8 @@ export const Cli = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M4.248 5.44a.75.75 0 1 0-.996 1.12L9.372 12l-6.12 5.44a.75.75 0 1 0 .996 1.12l6.75-6a.75.75 0 0 0 0-1.12zm7.002 11.81a.75.75 0 0 0 0 1.5h9a.75.75 0 0 0 0-1.5z"
         clipRule="evenodd"
-        d="M4.24828 5.43945C3.93869 5.16426 3.46464 5.19215 3.18945 5.50174C2.91426 5.81132 2.94215 6.28538 3.25174 6.56056L9.37111 12L3.25174 17.4395C2.94215 17.7146 2.91426 18.1887 3.18945 18.4983C3.46464 18.8079 3.93869 18.8358 4.24828 18.5606L10.9983 12.5606C11.1584 12.4182 11.25 12.2142 11.25 12C11.25 11.7858 11.1584 11.5818 10.9983 11.4395L4.24828 5.43945ZM11.25 17.25C10.8358 17.25 10.5 17.5858 10.5 18C10.5 18.4142 10.8358 18.75 11.25 18.75H20.25C20.6642 18.75 21 18.4142 21 18C21 17.5858 20.6642 17.25 20.25 17.25H11.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Clipboard.tsx b/web/packages/design/src/Icon/Icons/Clipboard.tsx
index a5f2bbf7ed6f2..553dc67729d09 100644
--- a/web/packages/design/src/Icon/Icons/Clipboard.tsx
+++ b/web/packages/design/src/Icon/Icons/Clipboard.tsx
@@ -59,12 +59,11 @@ export const Clipboard = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9 10.5C8.58579 10.5 8.25 10.8358 8.25 11.25C8.25 11.6642 8.58579 12 9 12H15C15.4142 12 15.75 11.6642 15.75 11.25C15.75 10.8358 15.4142 10.5 15 10.5H9Z" />
-      <path d="M9 13.5C8.58579 13.5 8.25 13.8358 8.25 14.25C8.25 14.6642 8.58579 15 9 15H15C15.4142 15 15.75 14.6642 15.75 14.25C15.75 13.8358 15.4142 13.5 15 13.5H9Z" />
+      <path d="M9 10.5A.75.75 0 0 0 9 12h6a.75.75 0 0 0 0-1.5zm0 3A.75.75 0 0 0 9 15h6a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M8.646 3A4.5 4.5 0 0 1 12 1.5 4.5 4.5 0 0 1 15.354 3h3.396a1.5 1.5 0 0 1 1.5 1.5v15.75a1.5 1.5 0 0 1-1.5 1.5H5.25a1.5 1.5 0 0 1-1.5-1.5V4.5A1.5 1.5 0 0 1 5.25 3zm1.233.879A3 3 0 0 1 15 6H9a3 3 0 0 1 .879-2.121M7.757 4.5H5.25v15.75h13.5V4.5h-2.507c.168.477.257.984.257 1.5v.75a.75.75 0 0 1-.75.75h-7.5a.75.75 0 0 1-.75-.75V6c0-.516.089-1.023.257-1.5"
         clipRule="evenodd"
-        d="M8.64589 3C8.70142 2.93792 8.75881 2.87723 8.81802 2.81802C9.66193 1.97411 10.8065 1.5 12 1.5C13.1935 1.5 14.3381 1.97411 15.182 2.81802C15.2412 2.87723 15.2986 2.93792 15.3541 3H18.75C19.1478 3 19.5294 3.15804 19.8107 3.43934C20.092 3.72065 20.25 4.10218 20.25 4.5V20.25C20.25 20.6478 20.092 21.0294 19.8107 21.3107C19.5294 21.592 19.1478 21.75 18.75 21.75H5.25C4.85218 21.75 4.47065 21.592 4.18934 21.3107C3.90804 21.0294 3.75 20.6478 3.75 20.25V4.5C3.75 4.10217 3.90804 3.72064 4.18934 3.43934C4.47064 3.15804 4.85217 3 5.25 3H8.64589ZM9.87868 3.87868C10.4413 3.31607 11.2044 3 12 3C12.7956 3 13.5587 3.31607 14.1213 3.87868C14.2202 3.97758 14.3115 4.08267 14.3948 4.19305C14.398 4.19746 14.4013 4.20184 14.4046 4.20617C14.7889 4.72126 15 5.34975 15 6H9C9 5.34975 9.21111 4.72126 9.59537 4.20617C9.5987 4.20183 9.60198 4.19746 9.60521 4.19305C9.6885 4.08268 9.77978 3.97758 9.87868 3.87868ZM7.75736 4.5H5.25L5.25 20.25H18.75L18.75 4.5H16.2426C16.4114 4.97731 16.5 5.48409 16.5 6V6.75C16.5 7.16421 16.1642 7.5 15.75 7.5H8.25C7.83579 7.5 7.5 7.16421 7.5 6.75V6C7.5 5.48409 7.58859 4.97731 7.75736 4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ClipboardUser.tsx b/web/packages/design/src/Icon/Icons/ClipboardUser.tsx
index 8568eed3fbac7..1fe1d7ff7a7b3 100644
--- a/web/packages/design/src/Icon/Icons/ClipboardUser.tsx
+++ b/web/packages/design/src/Icon/Icons/ClipboardUser.tsx
@@ -61,8 +61,8 @@ export const ClipboardUser = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 1 1.5-1.5h13.5a1.5 1.5 0 0 1 1.5 1.5v16.5a1.5 1.5 0 0 1-1.5 1.5H5.25a1.5 1.5 0 0 1-1.5-1.5zm15 0H5.25v16.5h13.5zM8.25 6A.75.75 0 0 1 9 5.25h6a.75.75 0 0 1 0 1.5H9A.75.75 0 0 1 8.25 6M12 10.5a2.25 2.25 0 1 0 0 4.5 2.25 2.25 0 0 0 0-4.5m2.526 5.022a3.75 3.75 0 1 0-5.052 0q-.165.071-.325.151A6.4 6.4 0 0 0 6.9 17.55a.75.75 0 1 0 1.2.9 4.874 4.874 0 0 1 7.8 0 .75.75 0 1 0 1.2-.9 6.4 6.4 0 0 0-2.574-2.028"
         clipRule="evenodd"
-        d="M3.75 3.75C3.75 2.92157 4.42157 2.25 5.25 2.25H18.75C19.5784 2.25 20.25 2.92157 20.25 3.75V20.25C20.25 21.0784 19.5784 21.75 18.75 21.75H5.25C4.42157 21.75 3.75 21.0784 3.75 20.25V3.75ZM18.75 3.75H5.25V20.25H18.75V3.75ZM8.25 6C8.25 5.58579 8.58579 5.25 9 5.25H15C15.4142 5.25 15.75 5.58579 15.75 6C15.75 6.41421 15.4142 6.75 15 6.75H9C8.58579 6.75 8.25 6.41421 8.25 6ZM12 10.5C10.7574 10.5 9.75 11.5074 9.75 12.75C9.75 13.9926 10.7574 15 12 15C13.2426 15 14.25 13.9926 14.25 12.75C14.25 11.5074 13.2426 10.5 12 10.5ZM14.5259 15.5218C15.278 14.8359 15.75 13.8481 15.75 12.75C15.75 10.6789 14.0711 9 12 9C9.92893 9 8.25 10.6789 8.25 12.75C8.25 13.8481 8.72197 14.8359 9.47412 15.5217C9.36451 15.569 9.2561 15.6195 9.14901 15.673C8.26381 16.1156 7.49381 16.7583 6.9 17.55C6.65147 17.8814 6.71863 18.3515 7.05 18.6C7.38137 18.8485 7.85147 18.7814 8.1 18.45C8.55409 17.8445 9.14291 17.3531 9.81983 17.0147C10.4968 16.6762 11.2432 16.5 12 16.5C12.7568 16.5 13.5032 16.6762 14.1802 17.0147C14.8571 17.3531 15.4459 17.8445 15.9 18.45C16.1485 18.7814 16.6186 18.8485 16.95 18.6C17.2814 18.3515 17.3485 17.8814 17.1 17.55C16.5062 16.7582 15.7362 16.1156 14.851 15.673C14.7439 15.6195 14.6355 15.569 14.5259 15.5218Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Clock.tsx b/web/packages/design/src/Icon/Icons/Clock.tsx
index b1e5f61c42b0a..cc7b74208811c 100644
--- a/web/packages/design/src/Icon/Icons/Clock.tsx
+++ b/web/packages/design/src/Icon/Icons/Clock.tsx
@@ -59,11 +59,11 @@ export const Clock = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 6.75C12.75 6.33579 12.4142 6 12 6C11.5858 6 11.25 6.33579 11.25 6.75V12C11.25 12.4142 11.5858 12.75 12 12.75H17.25C17.6642 12.75 18 12.4142 18 12C18 11.5858 17.6642 11.25 17.25 11.25H12.75V6.75Z" />
+      <path d="M12.75 6.75a.75.75 0 0 0-1.5 0V12c0 .414.336.75.75.75h5.25a.75.75 0 0 0 0-1.5h-4.5z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cloud.tsx b/web/packages/design/src/Icon/Icons/Cloud.tsx
index 15bada7610b11..6549c8db79910 100644
--- a/web/packages/design/src/Icon/Icons/Cloud.tsx
+++ b/web/packages/design/src/Icon/Icons/Cloud.tsx
@@ -61,8 +61,8 @@ export const Cloud = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M16.317 5.38A6.75 6.75 0 0 0 8.25 12a.75.75 0 0 1-1.5 0c0-.761.105-1.515.31-2.24a4.5 4.5 0 1 0-.31 8.99H15a6.75 6.75 0 0 0 1.317-13.37M7.62 8.312a6 6 0 1 0-.871 11.938H15A8.25 8.25 0 1 0 7.62 8.312"
         clipRule="evenodd"
-        d="M16.3167 5.3797C15.0074 5.11925 13.6502 5.25293 12.4168 5.76382C11.1834 6.27471 10.1291 7.13987 9.38745 8.2499C8.64575 9.35994 8.24987 10.665 8.24987 12C8.24987 12.4142 7.91408 12.75 7.49987 12.75C7.08566 12.75 6.74987 12.4142 6.74987 12C6.74987 11.2386 6.85523 10.4852 7.05972 9.76025C6.69911 9.73588 6.33588 9.75498 5.97794 9.81784C5.34949 9.92822 4.75169 10.171 4.22423 10.53C3.69676 10.8891 3.25167 11.3562 2.9185 11.9003C2.58534 12.4445 2.37171 13.0533 2.29179 13.6864C2.21187 14.3194 2.26749 14.9622 2.45495 15.5721C2.64242 16.182 2.95745 16.7451 3.37913 17.224C3.80082 17.7028 4.31952 18.0865 4.90082 18.3496C5.48212 18.6127 6.11273 18.7492 6.7508 18.75H14.9999C16.3349 18.75 17.6399 18.3541 18.75 17.6124C19.86 16.8707 20.7252 15.8165 21.2361 14.5831C21.7469 13.3497 21.8806 11.9925 21.6202 10.6831C21.3597 9.37377 20.7168 8.17104 19.7728 7.22703C18.8288 6.28303 17.6261 5.64015 16.3167 5.3797ZM7.61985 8.31247C6.98993 8.22086 6.34807 8.22988 5.71847 8.34046C4.88053 8.48762 4.08348 8.8113 3.38018 9.29002C2.67689 9.76873 2.08345 10.3915 1.63922 11.1171C1.195 11.8427 0.910159 12.6544 0.803599 13.4985C0.697039 14.3425 0.771197 15.1996 1.02115 16.0128C1.27111 16.826 1.69115 17.5768 2.2534 18.2153C2.81564 18.8538 3.50725 19.3654 4.28231 19.7162C5.05738 20.067 5.89819 20.249 6.74895 20.25H6.74987H14.9999C16.6316 20.25 18.2266 19.7661 19.5833 18.8596C20.94 17.9531 21.9975 16.6646 22.6219 15.1571C23.2463 13.6497 23.4097 11.9909 23.0913 10.3905C22.773 8.79017 21.9873 7.32016 20.8335 6.16637C19.6797 5.01259 18.2097 4.22685 16.6094 3.90853C15.009 3.5902 13.3502 3.75357 11.8427 4.378C10.3352 5.00242 9.04677 6.05984 8.14025 7.41655C7.94747 7.70506 7.77381 8.00434 7.61985 8.31247Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cluster.tsx b/web/packages/design/src/Icon/Icons/Cluster.tsx
index f9cecdf71b635..73a365d54f2f4 100644
--- a/web/packages/design/src/Icon/Icons/Cluster.tsx
+++ b/web/packages/design/src/Icon/Icons/Cluster.tsx
@@ -61,8 +61,8 @@ export const Cluster = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M9 8.25q.253 0 .495-.04l.64 1.44A3 3 0 0 0 9 12c0 .493.119.959.33 1.37l-2.407 2.14a3 3 0 1 0 .997 1.121l2.407-2.14A3 3 0 0 0 12 15c.69 0 1.326-.233 1.833-.625l2.163 1.683a3 3 0 1 0 .921-1.184l-2.163-1.682a3 3 0 0 0 .239-1.4l1.238-.412a3 3 0 1 0-.474-1.423l-1.238.412a3 3 0 0 0-3.014-1.328l-.64-1.441A3 3 0 1 0 9 8.25m0-4.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3m8.25 13.5a1.5 1.5 0 0 1 .332-.941 1.5 1.5 0 1 1-.332.941m.083-7.006-.006-.02-.007-.02a1.5 1.5 0 0 1 1.43-1.954 1.5 1.5 0 1 1-1.417 1.994m-5.958.392a1.5 1.5 0 0 0-.508 2.347l.012.013.012.014A1.497 1.497 0 0 0 13.5 12q-.002-.246-.075-.466l-.003-.009-.003-.008a1.5 1.5 0 0 0-2.014-.895l-.016.007zM3.75 18a1.5 1.5 0 1 1 3 0 1.5 1.5 0 0 1-3 0"
         clipRule="evenodd"
-        d="M9 8.25C9.16851 8.25 9.33377 8.23611 9.4947 8.2094L10.1347 9.65022C9.44331 10.1998 9 11.0481 9 12C9 12.4933 9.11905 12.9587 9.32998 13.3692L6.92314 15.5095C6.44516 15.1878 5.86951 15 5.25 15C3.59315 15 2.25 16.3431 2.25 18C2.25 19.6569 3.59315 21 5.25 21C6.90685 21 8.25 19.6569 8.25 18C8.25 17.5066 8.1309 17.041 7.91987 16.6305L10.3266 14.4903C10.8046 14.8121 11.3804 15 12 15C12.6901 15 13.3258 14.767 13.8326 14.3754L15.9961 16.0582C15.8378 16.4235 15.75 16.8265 15.75 17.25C15.75 18.9069 17.0931 20.25 18.75 20.25C20.4069 20.25 21.75 18.9069 21.75 17.25C21.75 15.5931 20.4069 14.25 18.75 14.25C18.06 14.25 17.4243 14.483 16.9175 14.8746L14.754 13.1917C14.9123 12.8264 15 12.4235 15 12C15 11.9303 14.9976 11.8611 14.9929 11.7925L16.2309 11.3799C16.7656 12.2045 17.6941 12.75 18.75 12.75C20.4069 12.75 21.75 11.4069 21.75 9.75C21.75 8.09315 20.4069 6.75 18.75 6.75C17.0931 6.75 15.75 8.09315 15.75 9.75C15.75 9.81947 15.7524 9.88839 15.757 9.95669L14.5186 10.3695C13.9839 9.54525 13.0556 9 12 9C11.8315 9 11.6662 9.01389 11.5053 9.0406L10.8652 7.5998C11.5567 7.05021 12 6.20188 12 5.25C12 3.59315 10.6569 2.25 9 2.25C7.34315 2.25 6 3.59315 6 5.25C6 6.90685 7.34315 8.25 9 8.25ZM9 3.75C8.17157 3.75 7.5 4.42157 7.5 5.25C7.5 6.07843 8.17157 6.75 9 6.75C9.20894 6.75 9.40791 6.70728 9.58864 6.63009C9.59553 6.62678 9.6025 6.62356 9.60954 6.62043C9.61626 6.61745 9.62299 6.61457 9.62975 6.6118C10.1436 6.37378 10.5 5.85352 10.5 5.25C10.5 4.42157 9.82843 3.75 9 3.75ZM17.25 17.25C17.25 16.9123 17.3616 16.6007 17.5499 16.35C17.5535 16.3457 17.5571 16.3413 17.5606 16.3369C17.5626 16.3344 17.5645 16.332 17.5664 16.3295C17.5717 16.3227 17.5769 16.3158 17.5819 16.3089C17.8568 15.968 18.278 15.75 18.75 15.75C19.5784 15.75 20.25 16.4216 20.25 17.25C20.25 18.0784 19.5784 18.75 18.75 18.75C17.9216 18.75 17.25 18.0784 17.25 17.25ZM17.3331 10.2437L17.3269 10.224L17.3202 10.2048C17.2746 10.0613 17.25 9.90854 17.25 9.75C17.25 8.92157 17.9216 8.25 18.75 8.25C19.5784 8.25 20.25 8.92157 20.25 9.75C20.25 10.5784 19.5784 11.25 18.75 11.25C18.0945 11.25 17.5373 10.8296 17.3331 10.2437ZM11.3749 10.636C10.8586 10.873 10.5 11.3946 10.5 12C10.5 12.3758 10.6382 12.7194 10.8666 12.9826L10.8786 12.9958L10.8906 13.0096C11.1649 13.3109 11.5604 13.5 12 13.5C12.4722 13.5 12.8934 13.2818 13.1684 12.9408C13.1733 12.9339 13.1784 12.9271 13.1837 12.9204C13.189 12.9135 13.1945 12.9068 13.2 12.9001C13.3884 12.6494 13.5 12.3377 13.5 12C13.5 11.8372 13.4741 11.6805 13.4261 11.5337L13.4232 11.5252L13.4204 11.5167C13.2193 10.9254 12.6593 10.5 12 10.5C11.7892 10.5 11.5885 10.5435 11.4065 10.622L11.3903 10.6294L11.3749 10.636ZM3.75 18C3.75 17.1716 4.42157 16.5 5.25 16.5C6.07843 16.5 6.75 17.1716 6.75 18C6.75 18.8284 6.07843 19.5 5.25 19.5C4.42157 19.5 3.75 18.8284 3.75 18Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Code.tsx b/web/packages/design/src/Icon/Icons/Code.tsx
index dc843fa40cd41..f11aef667c01d 100644
--- a/web/packages/design/src/Icon/Icons/Code.tsx
+++ b/web/packages/design/src/Icon/Icons/Code.tsx
@@ -61,8 +61,8 @@ export const Code = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M15.705 4.007a.75.75 0 1 0-1.41-.513l-6 16.5a.75.75 0 1 0 1.41.512zM6.576 7.77a.75.75 0 0 1-.096 1.056L2.672 12l3.808 3.174a.75.75 0 1 1-.96 1.152l-4.5-3.75a.75.75 0 0 1 0-1.152l4.5-3.75a.75.75 0 0 1 1.056.096m10.848 0a.75.75 0 0 1 1.056-.096l4.5 3.75a.75.75 0 0 1 0 1.152l-4.5 3.75a.75.75 0 1 1-.96-1.152L21.328 12 17.52 8.826a.75.75 0 0 1-.096-1.056"
         clipRule="evenodd"
-        d="M15.7048 4.00651C15.8464 3.61724 15.6455 3.18691 15.2563 3.04536C14.867 2.9038 14.4367 3.10462 14.2951 3.4939L8.29511 19.9939C8.15356 20.3832 8.35438 20.8135 8.74365 20.955C9.13293 21.0966 9.56325 20.8958 9.70481 20.5065L15.7048 4.00651ZM6.57617 7.76988C6.84134 8.08809 6.79835 8.56101 6.48014 8.82618L2.67154 12L6.48014 15.1739C6.79835 15.439 6.84134 15.9119 6.57617 16.2302C6.31099 16.5484 5.83807 16.5914 5.51986 16.3262L1.01986 12.5762C0.848867 12.4337 0.75 12.2226 0.75 12C0.75 11.7774 0.848867 11.5663 1.01986 11.4239L5.51986 7.67385C5.83807 7.40868 6.31099 7.45167 6.57617 7.76988ZM17.4239 7.76988C17.689 7.45167 18.1619 7.40868 18.4802 7.67385L22.9802 11.4239C23.1512 11.5663 23.25 11.7774 23.25 12C23.25 12.2226 23.1512 12.4337 22.9802 12.5762L18.4802 16.3262C18.1619 16.5914 17.689 16.5484 17.4239 16.2302C17.1587 15.9119 17.2017 15.439 17.5199 15.1739L21.3285 12L17.5199 8.82618C17.2017 8.56101 17.1587 8.08809 17.4239 7.76988Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cog.tsx b/web/packages/design/src/Icon/Icons/Cog.tsx
index 78e3733610bb5..bcf3c89bdfcd7 100644
--- a/web/packages/design/src/Icon/Icons/Cog.tsx
+++ b/web/packages/design/src/Icon/Icons/Cog.tsx
@@ -61,13 +61,13 @@ export const Cog = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 7.5a4.5 4.5 0 1 0 0 9 4.5 4.5 0 0 0 0-9M9 12a3 3 0 1 1 6 0 3 3 0 0 1-6 0"
         clipRule="evenodd"
-        d="M12 7.50001C9.51473 7.50001 7.50001 9.51473 7.50001 12C7.50001 14.4853 9.51473 16.5 12 16.5C14.4853 16.5 16.5 14.4853 16.5 12C16.5 9.51473 14.4853 7.50001 12 7.50001ZM9.00001 12C9.00001 10.3432 10.3432 9.00001 12 9.00001C13.6569 9.00001 15 10.3432 15 12C15 13.6569 13.6569 15 12 15C10.3432 15 9.00001 13.6569 9.00001 12Z"
       />
       <path
         fillRule="evenodd"
+        d="M10.05 2.355a.75.75 0 0 0-.66-.14c-.86.227-1.687.568-2.458 1.012a.75.75 0 0 0-.37.566l-.25 2.225a8 8 0 0 0-.287.287l-2.226.25a.75.75 0 0 0-.565.369c-.447.772-.79 1.6-1.018 2.461a.75.75 0 0 0 .139.66l1.397 1.75q-.005.204 0 .406l-1.398 1.75a.75.75 0 0 0-.139.661c.23.862.573 1.69 1.02 2.46a.75.75 0 0 0 .562.37l2.228.26q.141.148.288.288l.25 2.226a.75.75 0 0 0 .371.566c.772.445 1.6.786 2.462 1.013a.75.75 0 0 0 .659-.14l1.75-1.396q.202.005.405 0l1.75 1.398a.75.75 0 0 0 .66.139c.863-.23 1.69-.573 2.462-1.02a.75.75 0 0 0 .369-.566l.25-2.224q.146-.14.286-.287l2.226-.25a.75.75 0 0 0 .566-.37c.445-.773.785-1.6 1.013-2.462a.75.75 0 0 0-.14-.66l-1.397-1.75q.006-.202 0-.405l1.398-1.75a.75.75 0 0 0 .14-.66c-.23-.862-.573-1.69-1.021-2.461a.75.75 0 0 0-.565-.369l-2.225-.25a8 8 0 0 0-.286-.287l-.25-2.225a.75.75 0 0 0-.37-.566 10 10 0 0 0-2.461-1.018.75.75 0 0 0-.66.14l-1.75 1.397a8 8 0 0 0-.406 0zM7.77 6.464l.239-2.117q.676-.352 1.407-.579L11.082 5.1a.75.75 0 0 0 .512.163 7 7 0 0 1 .815 0 .75.75 0 0 0 .513-.162l1.665-1.33q.732.229 1.412.583l.237 2.118a.75.75 0 0 0 .248.478q.305.27.575.575a.75.75 0 0 0 .477.247l2.118.238q.356.68.585 1.41l-1.33 1.666a.75.75 0 0 0-.163.513q.024.407 0 .815a.75.75 0 0 0 .162.512l1.33 1.666a8.6 8.6 0 0 1-.58 1.411l-2.117.238a.75.75 0 0 0-.477.247q-.27.305-.575.576a.75.75 0 0 0-.248.477l-.238 2.118a8.5 8.5 0 0 1-1.41.584l-1.665-1.33a.75.75 0 0 0-.513-.163 7 7 0 0 1-.815 0 .75.75 0 0 0-.512.163l-1.667 1.33a8.6 8.6 0 0 1-1.41-.58l-.238-2.117a.75.75 0 0 0-.248-.478 7 7 0 0 1-.575-.575.75.75 0 0 0-.474-.247l-2.122-.249a8.6 8.6 0 0 1-.586-1.412L5.1 12.919a.75.75 0 0 0 .163-.513 7 7 0 0 1 0-.815.75.75 0 0 0-.163-.512L3.77 9.413q.229-.732.584-1.411l2.118-.238a.75.75 0 0 0 .477-.248q.27-.305.575-.575a.75.75 0 0 0 .248-.477"
         clipRule="evenodd"
-        d="M10.0494 2.35451C9.86397 2.20636 9.61938 2.15471 9.3899 2.21525C8.52938 2.44225 7.70284 2.7826 6.932 3.22738C6.72563 3.34645 6.58812 3.55649 6.56151 3.79326L6.31155 6.01798C6.21373 6.11116 6.11818 6.2067 6.025 6.30452L3.79936 6.5545C3.56297 6.58105 3.35318 6.71817 3.234 6.92404C2.78719 7.69583 2.44487 8.52354 2.216 9.38546C2.15501 9.61518 2.20651 9.86022 2.35483 10.0459L3.75216 11.7957C3.7489 11.9309 3.7489 12.0661 3.75216 12.2013L2.35403 13.951C2.20553 14.1368 2.154 14.3821 2.21516 14.612C2.44446 15.474 2.78756 16.3016 3.2354 17.0729C3.35404 17.2773 3.56206 17.4138 3.79675 17.4413L6.02545 17.7023C6.11908 17.8007 6.21509 17.8967 6.31341 17.9904L6.56339 20.216C6.58999 20.4529 6.72762 20.663 6.93414 20.7821C7.70618 21.2271 8.53388 21.5677 9.39556 21.795C9.62495 21.8555 9.86945 21.8039 10.0548 21.6559L11.8046 20.2585C11.9398 20.2618 12.075 20.2618 12.2101 20.2585L13.9599 21.6567C14.1457 21.8052 14.391 21.8567 14.6209 21.7955C15.4829 21.5662 16.3105 21.2231 17.0818 20.7753C17.2873 20.656 17.4241 20.4465 17.4506 20.2104L17.7005 17.9857C17.7984 17.8925 17.8939 17.797 17.9871 17.6992L20.2127 17.4492C20.4496 17.4226 20.6597 17.285 20.7788 17.0784C21.2238 16.3064 21.5645 15.4787 21.7917 14.617C21.8522 14.3876 21.8006 14.1431 21.6526 13.9577L20.2552 12.2079C20.2585 12.0728 20.2585 11.9376 20.2552 11.8024L21.6534 10.0527C21.8019 9.86684 21.8534 9.62157 21.7922 9.39169C21.5629 8.52971 21.2198 7.70212 20.772 6.93075C20.6527 6.72531 20.4432 6.58853 20.2071 6.562L17.9824 6.31203C17.8892 6.21421 17.7937 6.11867 17.6959 6.02549L17.4459 3.79985C17.4193 3.56345 17.2822 3.35367 17.0763 3.23449C16.3046 2.78768 15.4768 2.44535 14.6149 2.21649C14.3852 2.1555 14.1402 2.207 13.9544 2.35532L12.2046 3.75265C12.0695 3.74939 11.9343 3.74939 11.7991 3.75265L10.0494 2.35451ZM7.77088 6.46387L8.0087 4.34731C8.4595 4.1128 8.93034 3.91897 9.41559 3.76813L11.0818 5.09949C11.2266 5.21522 11.4092 5.2732 11.5943 5.26225C11.8657 5.24619 12.1379 5.24619 12.4094 5.26225C12.5944 5.2732 12.7769 5.21527 12.9217 5.09962L14.5873 3.7695C15.0742 3.92166 15.5465 4.11698 15.9986 4.35313L16.2365 6.47134C16.2572 6.65552 16.3453 6.82551 16.484 6.94854C16.687 7.12876 16.8791 7.32089 17.0593 7.52393C17.1824 7.66253 17.3524 7.75068 17.5365 7.77137L19.6544 8.00933C19.891 8.46106 20.0867 8.93306 20.2391 9.41968L18.9084 11.0851C18.7927 11.2299 18.7347 11.4125 18.7456 11.5976C18.7617 11.869 18.7617 12.1412 18.7456 12.4127C18.7347 12.5977 18.7926 12.7802 18.9083 12.925L20.2389 14.5913C20.0878 15.0778 19.8935 15.5499 19.6585 16.002L17.5412 16.2398C17.3571 16.2605 17.1871 16.3486 17.064 16.4873C16.8838 16.6903 16.6917 16.8824 16.4886 17.0626C16.35 17.1857 16.2619 17.3556 16.2412 17.5398L16.0032 19.6577C15.5515 19.8943 15.0795 20.09 14.5929 20.2424L12.9275 18.9117C12.7827 18.796 12.6001 18.738 12.415 18.7489C12.1435 18.765 11.8714 18.765 11.5999 18.7489C11.4149 18.738 11.2324 18.7959 11.0876 18.9116L9.4213 20.2422C8.93474 20.0911 8.46263 19.8968 8.01057 19.6618L7.77276 17.5445C7.75208 17.3604 7.66393 17.1904 7.52531 17.0673C7.32228 16.8871 7.13014 16.695 6.94993 16.4919C6.82772 16.3543 6.65913 16.2663 6.47627 16.2449L4.35405 15.9963C4.11698 15.544 3.92093 15.0713 3.76827 14.584L5.099 12.9186C5.21473 12.7738 5.27272 12.5912 5.26176 12.4061C5.2457 12.1347 5.2457 11.8625 5.26176 11.591C5.27271 11.406 5.21478 11.2235 5.09913 11.0787L3.76901 9.41304C3.92118 8.9262 4.1165 8.4539 4.35264 8.00179L6.47085 7.76388C6.65503 7.74319 6.82503 7.65504 6.94806 7.51643C7.12827 7.31339 7.3204 7.12126 7.52344 6.94104C7.66204 6.81802 7.75019 6.64804 7.77088 6.46387Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Config.tsx b/web/packages/design/src/Icon/Icons/Config.tsx
index d58b54ab9af50..bdffc1a7e70a4 100644
--- a/web/packages/design/src/Icon/Icons/Config.tsx
+++ b/web/packages/design/src/Icon/Icons/Config.tsx
@@ -59,16 +59,11 @@ export const Config = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.25 8C12.25 7.58579 12.5858 7.25 13 7.25H17C17.4142 7.25 17.75 7.58579 17.75 8C17.75 8.41421 17.4142 8.75 17 8.75H13C12.5858 8.75 12.25 8.41421 12.25 8Z" />
-      <path d="M13 11.25C12.5858 11.25 12.25 11.5858 12.25 12C12.25 12.4142 12.5858 12.75 13 12.75H17C17.4142 12.75 17.75 12.4142 17.75 12C17.75 11.5858 17.4142 11.25 17 11.25H13Z" />
-      <path d="M12.25 16C12.25 15.5858 12.5858 15.25 13 15.25H17C17.4142 15.25 17.75 15.5858 17.75 16C17.75 16.4142 17.4142 16.75 17 16.75H13C12.5858 16.75 12.25 16.4142 12.25 16Z" />
-      <path d="M7.5 7.25C7.08579 7.25 6.75 7.58579 6.75 8C6.75 8.41421 7.08579 8.75 7.5 8.75H9.5C9.91421 8.75 10.25 8.41421 10.25 8C10.25 7.58579 9.91421 7.25 9.5 7.25H7.5Z" />
-      <path d="M6.75 12C6.75 11.5858 7.08579 11.25 7.5 11.25H9.5C9.91421 11.25 10.25 11.5858 10.25 12C10.25 12.4142 9.91421 12.75 9.5 12.75H7.5C7.08579 12.75 6.75 12.4142 6.75 12Z" />
-      <path d="M7.5 15.25C7.08579 15.25 6.75 15.5858 6.75 16C6.75 16.4142 7.08579 16.75 7.5 16.75H9.5C9.91421 16.75 10.25 16.4142 10.25 16C10.25 15.5858 9.91421 15.25 9.5 15.25H7.5Z" />
+      <path d="M12.25 8a.75.75 0 0 1 .75-.75h4a.75.75 0 0 1 0 1.5h-4a.75.75 0 0 1-.75-.75m.75 3.25a.75.75 0 0 0 0 1.5h4a.75.75 0 0 0 0-1.5zM12.25 16a.75.75 0 0 1 .75-.75h4a.75.75 0 0 1 0 1.5h-4a.75.75 0 0 1-.75-.75M7.5 7.25a.75.75 0 0 0 0 1.5h2a.75.75 0 0 0 0-1.5zM6.75 12a.75.75 0 0 1 .75-.75h2a.75.75 0 0 1 0 1.5h-2a.75.75 0 0 1-.75-.75m.75 3.25a.75.75 0 0 0 0 1.5h2a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M2.25 3.9c0-.777.55-1.65 1.5-1.65h16.5c.95 0 1.5.873 1.5 1.65v16.2c0 .777-.55 1.65-1.5 1.65H3.75c-.95 0-1.5-.873-1.5-1.65zm1.541-.15a.26.26 0 0 0-.041.15v16.2a.26.26 0 0 0 .041.15h16.418a.26.26 0 0 0 .041-.15V3.9a.26.26 0 0 0-.041-.15z"
         clipRule="evenodd"
-        d="M2.25 3.9C2.25 3.12257 2.79934 2.25 3.75 2.25H20.25C21.2007 2.25 21.75 3.12257 21.75 3.9V20.1C21.75 20.8774 21.2007 21.75 20.25 21.75H3.75C2.79934 21.75 2.25 20.8774 2.25 20.1V3.9ZM3.79101 3.75C3.77346 3.77438 3.75 3.82494 3.75 3.9V20.1C3.75 20.1751 3.77346 20.2256 3.79101 20.25H20.209C20.2265 20.2256 20.25 20.1751 20.25 20.1V3.9C20.25 3.82494 20.2265 3.77438 20.209 3.75H3.79101Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Contract.tsx b/web/packages/design/src/Icon/Icons/Contract.tsx
index e2c4263e20c32..bd77e1a3d5fc6 100644
--- a/web/packages/design/src/Icon/Icons/Contract.tsx
+++ b/web/packages/design/src/Icon/Icons/Contract.tsx
@@ -59,10 +59,7 @@ export const Contract = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M15.75 4.5C15.75 4.08579 15.4142 3.75 15 3.75C14.5858 3.75 14.25 4.08579 14.25 4.5V9C14.25 9.41421 14.5858 9.75 15 9.75H19.5C19.9142 9.75 20.25 9.41421 20.25 9C20.25 8.58579 19.9142 8.25 19.5 8.25H15.75V4.5Z" />
-      <path d="M4.5 14.25C4.08579 14.25 3.75 14.5858 3.75 15C3.75 15.4142 4.08579 15.75 4.5 15.75H8.25V19.5C8.25 19.9142 8.58579 20.25 9 20.25C9.41421 20.25 9.75 19.9142 9.75 19.5V15C9.75 14.5858 9.41421 14.25 9 14.25H4.5Z" />
-      <path d="M14.25 15C14.25 14.5858 14.5858 14.25 15 14.25H19.5C19.9142 14.25 20.25 14.5858 20.25 15C20.25 15.4142 19.9142 15.75 19.5 15.75H15.75V19.5C15.75 19.9142 15.4142 20.25 15 20.25C14.5858 20.25 14.25 19.9142 14.25 19.5V15Z" />
-      <path d="M9.75 4.5C9.75 4.08579 9.41421 3.75 9 3.75C8.58579 3.75 8.25 4.08579 8.25 4.5V8.25H4.5C4.08579 8.25 3.75 8.58579 3.75 9C3.75 9.41421 4.08579 9.75 4.5 9.75H9C9.41421 9.75 9.75 9.41421 9.75 9V4.5Z" />
+      <path d="M15.75 4.5a.75.75 0 0 0-1.5 0V9c0 .414.336.75.75.75h4.5a.75.75 0 0 0 0-1.5h-3.75zM4.5 14.25a.75.75 0 0 0 0 1.5h3.75v3.75a.75.75 0 0 0 1.5 0V15a.75.75 0 0 0-.75-.75zm9.75.75a.75.75 0 0 1 .75-.75h4.5a.75.75 0 0 1 0 1.5h-3.75v3.75a.75.75 0 0 1-1.5 0zM9.75 4.5a.75.75 0 0 0-1.5 0v3.75H4.5a.75.75 0 0 0 0 1.5H9A.75.75 0 0 0 9.75 9z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Copy.tsx b/web/packages/design/src/Icon/Icons/Copy.tsx
index 5647e8e260c53..ce6c1d3c04a1b 100644
--- a/web/packages/design/src/Icon/Icons/Copy.tsx
+++ b/web/packages/design/src/Icon/Icons/Copy.tsx
@@ -59,11 +59,11 @@ export const Copy = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M6.75 3C6.33579 3 6 3.33579 6 3.75C6 4.16421 6.33579 4.5 6.75 4.5H19.5V17.25C19.5 17.6642 19.8358 18 20.25 18C20.6642 18 21 17.6642 21 17.25V3.75C21 3.33579 20.6642 3 20.25 3H6.75Z" />
+      <path d="M6.75 3a.75.75 0 0 0 0 1.5H19.5v12.75a.75.75 0 0 0 1.5 0V3.75a.75.75 0 0 0-.75-.75z" />
       <path
         fillRule="evenodd"
+        d="M3.75 6a.75.75 0 0 0-.75.75v13.5c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75V6.75a.75.75 0 0 0-.75-.75zm.75 13.5v-12h12v12z"
         clipRule="evenodd"
-        d="M3.75 6C3.33579 6 3 6.33579 3 6.75V20.25C3 20.6642 3.33579 21 3.75 21H17.25C17.6642 21 18 20.6642 18 20.25V6.75C18 6.33579 17.6642 6 17.25 6H3.75ZM4.5 19.5V7.5H16.5V19.5H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/CornersIn.tsx b/web/packages/design/src/Icon/Icons/CornersIn.tsx
new file mode 100644
index 0000000000000..adbb7170d7690
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/CornersIn.tsx
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const CornersIn = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-cornersin"
+      {...otherProps}
+      ref={ref}
+    >
+      <path d="M14.25 9V4.5c0-.41.34-.75.75-.75s.75.34.75.75v3.75h3.75c.41 0 .75.34.75.75s-.34.75-.75.75H15c-.41 0-.75-.34-.75-.75M9 14.25H4.5c-.41 0-.75.34-.75.75s.34.75.75.75h3.75v3.75c0 .41.34.75.75.75s.75-.34.75-.75V15c0-.41-.34-.75-.75-.75m10.5 0H15c-.41 0-.75.34-.75.75v4.5c0 .41.34.75.75.75s.75-.34.75-.75v-3.75h3.75c.41 0 .75-.34.75-.75s-.34-.75-.75-.75M9 3.75c-.41 0-.75.34-.75.75v3.75H4.5c-.41 0-.75.34-.75.75s.34.75.75.75H9c.41 0 .75-.34.75-.75V4.5c0-.41-.34-.75-.75-.75" />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/CornersOut.tsx b/web/packages/design/src/Icon/Icons/CornersOut.tsx
new file mode 100644
index 0000000000000..36d50b03731f1
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/CornersOut.tsx
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const CornersOut = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-cornersout"
+      {...otherProps}
+      ref={ref}
+    >
+      <path d="M20.25 4.5v3.75c0 .41-.34.75-.75.75s-.75-.34-.75-.75v-3h-3c-.41 0-.75-.34-.75-.75s.34-.75.75-.75h3.75c.41 0 .75.34.75.75m-12 14.25h-3v-3c0-.41-.34-.75-.75-.75s-.75.34-.75.75v3.75c0 .41.34.75.75.75h3.75c.41 0 .75-.34.75-.75s-.34-.75-.75-.75M19.5 15c-.41 0-.75.34-.75.75v3h-3c-.41 0-.75.34-.75.75s.34.75.75.75h3.75c.41 0 .75-.34.75-.75v-3.75c0-.41-.34-.75-.75-.75M8.25 3.75H4.5c-.41 0-.75.34-.75.75v3.75c0 .41.34.75.75.75s.75-.34.75-.75v-3h3c.41 0 .75-.34.75-.75s-.34-.75-.75-.75" />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/CreditCard.tsx b/web/packages/design/src/Icon/Icons/CreditCard.tsx
index feab4fbd36da2..83ef3d87f828b 100644
--- a/web/packages/design/src/Icon/Icons/CreditCard.tsx
+++ b/web/packages/design/src/Icon/Icons/CreditCard.tsx
@@ -61,8 +61,8 @@ export const CreditCard = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3 4.5A1.5 1.5 0 0 0 1.5 6v12A1.5 1.5 0 0 0 3 19.5h18a1.5 1.5 0 0 0 1.5-1.5V6A1.5 1.5 0 0 0 21 4.5zm18 3.75V6H3v2.25zM3 9.75h18V18H3zM15.75 15a.75.75 0 0 0 0 1.5h3a.75.75 0 0 0 0-1.5zm-5.25.75a.75.75 0 0 1 .75-.75h1.5a.75.75 0 0 1 0 1.5h-1.5a.75.75 0 0 1-.75-.75"
         clipRule="evenodd"
-        d="M3 4.5C2.17157 4.5 1.5 5.17157 1.5 6V9V18C1.5 18.8284 2.17157 19.5 3 19.5H21C21.8284 19.5 22.5 18.8284 22.5 18V9V6C22.5 5.17157 21.8284 4.5 21 4.5H3ZM21 8.25V6H3V8.25H21ZM3 9.75H21V18H3V9.75ZM15.75 15C15.3358 15 15 15.3358 15 15.75C15 16.1642 15.3358 16.5 15.75 16.5H18.75C19.1642 16.5 19.5 16.1642 19.5 15.75C19.5 15.3358 19.1642 15 18.75 15H15.75ZM10.5 15.75C10.5 15.3358 10.8358 15 11.25 15H12.75C13.1642 15 13.5 15.3358 13.5 15.75C13.5 16.1642 13.1642 16.5 12.75 16.5H11.25C10.8358 16.5 10.5 16.1642 10.5 15.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Cross.tsx b/web/packages/design/src/Icon/Icons/Cross.tsx
index a7d33893527b4..c3ea260e3668a 100644
--- a/web/packages/design/src/Icon/Icons/Cross.tsx
+++ b/web/packages/design/src/Icon/Icons/Cross.tsx
@@ -59,7 +59,7 @@ export const Cross = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M19.2803 5.78033C19.5732 5.48744 19.5732 5.01256 19.2803 4.71967C18.9874 4.42678 18.5126 4.42678 18.2197 4.71967L12 10.9393L5.78033 4.71967C5.48744 4.42678 5.01256 4.42678 4.71967 4.71967C4.42678 5.01256 4.42678 5.48744 4.71967 5.78033L10.9393 12L4.71967 18.2197C4.42678 18.5126 4.42678 18.9874 4.71967 19.2803C5.01256 19.5732 5.48744 19.5732 5.78033 19.2803L12 13.0607L18.2197 19.2803C18.5126 19.5732 18.9874 19.5732 19.2803 19.2803C19.5732 18.9874 19.5732 18.5126 19.2803 18.2197L13.0607 12L19.2803 5.78033Z" />
+      <path d="M19.28 5.78a.75.75 0 0 0-1.06-1.06L12 10.94 5.78 4.72a.75.75 0 0 0-1.06 1.06L10.94 12l-6.22 6.22a.75.75 0 1 0 1.06 1.06L12 13.06l6.22 6.22a.75.75 0 1 0 1.06-1.06L13.06 12z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Crown.tsx b/web/packages/design/src/Icon/Icons/Crown.tsx
index a77187a9e3dbd..dc625113a5d12 100644
--- a/web/packages/design/src/Icon/Icons/Crown.tsx
+++ b/web/packages/design/src/Icon/Icons/Crown.tsx
@@ -59,10 +59,7 @@ export const Crown = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        d="M11.789 2.284a1.205 1.205 0 0 0-.615.322c-.047.052-.98 1.579-2.074 3.394a1143.919 1143.919 0 0 1-1.999 3.312c-.006.007-1.104-.533-2.438-1.2L2.236 6.9l-.348.001c-.399.001-.528.051-.798.312-.201.193-.33.501-.33.786 0 .149.416 1.472 1.764 5.608.971 2.977 1.79 5.462 1.82 5.521.126.243.514.418.786.352.072-.017.319-.121.55-.232 3.45-1.65 9.19-1.65 12.64 0 .231.111.483.216.56.235.266.064.65-.111.776-.355.03-.059.843-2.52 1.807-5.468 1.967-6.022 1.883-5.707 1.658-6.164-.212-.43-.58-.638-1.08-.609-.28.016-.311.03-2.707 1.226-1.333.666-2.428 1.206-2.435 1.199-.006-.007-.905-1.497-1.998-3.312-1.093-1.815-2.034-3.35-2.093-3.411-.134-.142-.46-.297-.668-.318a1.69 1.69 0 0 0-.351.013m2.131 5c1.072 1.784 1.966 3.229 2.05 3.315.258.261.625.38.98.317.121-.021.977-.425 2.36-1.114 1.193-.595 2.17-1.071 2.17-1.059 0 .052-2.891 8.88-2.917 8.908-.016.017-.197-.033-.403-.111-1.033-.394-2.522-.748-3.78-.897-1.41-.168-3.35-.168-4.76 0-1.266.15-2.74.5-3.78.897-.206.078-.387.128-.403.111-.021-.023-2.709-8.231-2.895-8.842-.023-.075.344.095 2.19 1.016l2.218 1.107.275-.001c.327 0 .596-.11.813-.332.078-.08.997-1.57 2.042-3.31 1.045-1.741 1.909-3.166 1.92-3.166.011-.001.875 1.422 1.92 3.161"
-        fillRule="evenodd"
-      />
+      <path d="M11.789 2.284a1.2 1.2 0 0 0-.615.322c-.047.052-.98 1.579-2.074 3.394a1144 1144 0 0 1-1.999 3.312c-.006.007-1.104-.533-2.438-1.2L2.236 6.9l-.348.001c-.399.001-.528.051-.798.312-.201.193-.33.501-.33.786 0 .149.416 1.472 1.764 5.608.971 2.977 1.79 5.462 1.82 5.521.126.243.514.418.786.352.072-.017.319-.121.55-.232 3.45-1.65 9.19-1.65 12.64 0 .231.111.483.216.56.235.266.064.65-.111.776-.355.03-.059.843-2.52 1.807-5.468 1.967-6.022 1.883-5.707 1.658-6.164-.212-.43-.58-.638-1.08-.609-.28.016-.311.03-2.707 1.226-1.333.666-2.428 1.206-2.435 1.199-.006-.007-.905-1.497-1.998-3.312s-2.034-3.35-2.093-3.411c-.134-.142-.46-.297-.668-.318a1.7 1.7 0 0 0-.351.013m2.131 5c1.072 1.784 1.966 3.229 2.05 3.315.258.261.625.38.98.317.121-.021.977-.425 2.36-1.114 1.193-.595 2.17-1.071 2.17-1.059 0 .052-2.891 8.88-2.917 8.908-.016.017-.197-.033-.403-.111-1.033-.394-2.522-.748-3.78-.897-1.41-.168-3.35-.168-4.76 0-1.266.15-2.74.5-3.78.897-.206.078-.387.128-.403.111-.021-.023-2.709-8.231-2.895-8.842-.023-.075.344.095 2.19 1.016l2.218 1.107.275-.001q.489 0 .813-.332c.078-.08.997-1.57 2.042-3.31 1.045-1.741 1.909-3.166 1.92-3.166.011-.001.875 1.422 1.92 3.161" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Database.tsx b/web/packages/design/src/Icon/Icons/Database.tsx
index 793293815064b..cd878232aac6b 100644
--- a/web/packages/design/src/Icon/Icons/Database.tsx
+++ b/web/packages/design/src/Icon/Icons/Database.tsx
@@ -61,8 +61,8 @@ export const Database = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M6.526 4.976C5.134 5.736 4.5 6.66 4.5 7.5s.634 1.765 2.026 2.524c1.362.743 3.297 1.226 5.474 1.226s4.111-.483 5.474-1.226C18.867 9.264 19.5 8.34 19.5 7.5s-.634-1.765-2.026-2.524C16.112 4.233 14.177 3.75 12 3.75s-4.112.483-5.474 1.226M5.807 3.66C4.213 4.53 3 5.854 3 7.5v9c0 1.646 1.213 2.97 2.807 3.84 1.623.886 3.814 1.41 6.193 1.41s4.57-.524 6.193-1.41C19.787 19.47 21 18.146 21 16.5v-9c0-1.646-1.213-2.97-2.807-3.84C16.57 2.774 14.379 2.25 12 2.25s-4.57.524-6.193 1.41M19.5 14.94v1.56c0 .84-.634 1.765-2.026 2.524-1.363.743-3.297 1.226-5.474 1.226s-4.111-.483-5.474-1.226C5.134 18.264 4.5 17.34 4.5 16.5v-1.56c.387.339.83.64 1.307.9 1.623.886 3.814 1.41 6.193 1.41s4.57-.524 6.193-1.41a7.3 7.3 0 0 0 1.307-.9M4.5 12c0 .84.634 1.765 2.026 2.524 1.363.743 3.297 1.226 5.474 1.226s4.111-.483 5.474-1.226C18.867 13.764 19.5 12.84 19.5 12v-1.56a7.3 7.3 0 0 1-1.307.9c-1.623.886-3.814 1.41-6.193 1.41s-4.57-.524-6.193-1.41a7.3 7.3 0 0 1-1.307-.9z"
         clipRule="evenodd"
-        d="M6.52551 4.97644C5.1342 5.73534 4.5 6.66048 4.5 7.5C4.5 8.33952 5.1342 9.26466 6.52551 10.0236C7.88846 10.767 9.82259 11.25 12 11.25C14.1774 11.25 16.1115 10.767 17.4745 10.0236C18.8658 9.26466 19.5 8.33952 19.5 7.5C19.5 6.66048 18.8658 5.73534 17.4745 4.97644C16.1115 4.23301 14.1774 3.75 12 3.75C9.82259 3.75 7.88846 4.23301 6.52551 4.97644ZM5.80723 3.6596C4.21263 4.52938 3 5.85424 3 7.5V12V16.5C3 18.1458 4.21266 19.4706 5.80727 20.3404C7.43024 21.2257 9.62111 21.75 12 21.75C14.3789 21.75 16.5698 21.2257 18.1927 20.3404C19.7873 19.4706 21 18.1458 21 16.5V12V7.5C21 5.85424 19.7874 4.52938 18.1928 3.6596C16.5698 2.77434 14.3789 2.25 12 2.25C9.62106 2.25 7.43019 2.77434 5.80723 3.6596ZM19.5 14.9404V16.5C19.5 17.3395 18.8658 18.2647 17.4745 19.0236C16.1115 19.767 14.1774 20.25 12 20.25C9.82264 20.25 7.88851 19.767 6.52554 19.0236C5.13421 18.2647 4.5 17.3395 4.5 16.5V14.9404C4.88666 15.2788 5.32984 15.58 5.80727 15.8404C7.43024 16.7257 9.62111 17.25 12 17.25C14.3789 17.25 16.5698 16.7257 18.1927 15.8404C18.6702 15.58 19.1133 15.2788 19.5 14.9404ZM4.5 12C4.5 12.8395 5.13421 13.7647 6.52554 14.5236C7.88851 15.267 9.82264 15.75 12 15.75C14.1774 15.75 16.1115 15.267 17.4745 14.5236C18.8658 13.7647 19.5 12.8395 19.5 12V10.4404C19.1134 10.7788 18.6702 11.08 18.1928 11.3404C16.5698 12.2257 14.3789 12.75 12 12.75C9.62106 12.75 7.43019 12.2257 5.80723 11.3404C5.32982 11.08 4.88664 10.7788 4.5 10.4404V12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Desktop.tsx b/web/packages/design/src/Icon/Icons/Desktop.tsx
index 7e15189e5d7eb..6bb454631695f 100644
--- a/web/packages/design/src/Icon/Icons/Desktop.tsx
+++ b/web/packages/design/src/Icon/Icons/Desktop.tsx
@@ -61,8 +61,8 @@ export const Desktop = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.75 18.75h6.75a2.25 2.25 0 0 0 2.25-2.25V6a2.25 2.25 0 0 0-2.25-2.25h-15A2.25 2.25 0 0 0 2.25 6v10.5a2.25 2.25 0 0 0 2.25 2.25h6.75v1.5H9a.75.75 0 0 0 0 1.5h6a.75.75 0 0 0 0-1.5h-2.25zm7.5-2.25a.75.75 0 0 1-.75.75h-15a.75.75 0 0 1-.75-.75V15h16.5zM3.75 6v7.5h16.5V6a.75.75 0 0 0-.75-.75h-15a.75.75 0 0 0-.75.75"
         clipRule="evenodd"
-        d="M12.75 18.75H19.5C20.7426 18.75 21.75 17.7426 21.75 16.5V6C21.75 4.75736 20.7426 3.75 19.5 3.75H4.5C3.25736 3.75 2.25 4.75736 2.25 6V16.5C2.25 17.7426 3.25736 18.75 4.5 18.75H11.25V20.25H9C8.58579 20.25 8.25 20.5858 8.25 21C8.25 21.4142 8.58579 21.75 9 21.75H15C15.4142 21.75 15.75 21.4142 15.75 21C15.75 20.5858 15.4142 20.25 15 20.25H12.75V18.75ZM20.25 16.5C20.25 16.9142 19.9142 17.25 19.5 17.25H4.5C4.08579 17.25 3.75 16.9142 3.75 16.5V15H20.25V16.5ZM3.75 6V13.5H20.25V6C20.25 5.58579 19.9142 5.25 19.5 5.25H4.5C4.08579 5.25 3.75 5.58579 3.75 6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Detective.tsx b/web/packages/design/src/Icon/Icons/Detective.tsx
index de53f93c6e8fd..c1d902a95544b 100644
--- a/web/packages/design/src/Icon/Icons/Detective.tsx
+++ b/web/packages/design/src/Icon/Icons/Detective.tsx
@@ -61,8 +61,8 @@ export const Detective = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M9.666 3.891a1.5 1.5 0 0 0-1.844.475l-.002.002L3.368 10.5H.75a.75.75 0 0 0 0 1.5h22.5a.75.75 0 0 0 0-1.5h-2.618L16.18 4.368l-.001-.002a1.5 1.5 0 0 0-2.372-.066l-1.206 1.398a.75.75 0 0 1-1.202 0L10.193 4.3a1.5 1.5 0 0 0-.527-.409m9.112 6.609-3.81-5.249-.018.02-1.205 1.399a2.25 2.25 0 0 1-3.49 0L9.05 5.27l-.017-.02-3.811 5.25zM3.75 16.875a3.375 3.375 0 0 1 6.73-.375h3.04a3.375 3.375 0 1 1 .172 1.5h-3.384a3.377 3.377 0 0 1-6.558-1.125M7.125 15a1.875 1.875 0 1 0 0 3.75 1.875 1.875 0 0 0 0-3.75M15 16.875a1.875 1.875 0 1 1 3.75 0 1.875 1.875 0 0 1-3.75 0"
         clipRule="evenodd"
-        d="M9.666 3.891a1.5 1.5 0 0 0-1.844.475l-.002.002L3.368 10.5H.75a.75.75 0 0 0 0 1.5h22.5a.75.75 0 0 0 0-1.5h-2.618L16.18 4.368l-.001-.002a1.5 1.5 0 0 0-2.372-.066l-1.206 1.398a.75.75 0 0 1-1.202 0L10.193 4.3a1.5 1.5 0 0 0-.527-.409Zm9.112 6.609-3.81-5.249a.657.657 0 0 1-.018.02L13.745 6.67a2.25 2.25 0 0 1-3.49 0L9.05 5.27a.737.737 0 0 1-.017-.02L5.222 10.5h13.556ZM3.75 16.875a3.375 3.375 0 0 1 6.73-.375h3.04a3.375 3.375 0 1 1 .172 1.5h-3.384a3.377 3.377 0 0 1-6.558-1.125ZM7.125 15a1.875 1.875 0 1 0 0 3.75 1.875 1.875 0 0 0 0-3.75ZM15 16.875a1.875 1.875 0 1 1 3.75 0 1.875 1.875 0 0 1-3.75 0Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/DeviceMobileCamera.tsx b/web/packages/design/src/Icon/Icons/DeviceMobileCamera.tsx
index a518902d4b9a2..4c8ecc30486e2 100644
--- a/web/packages/design/src/Icon/Icons/DeviceMobileCamera.tsx
+++ b/web/packages/design/src/Icon/Icons/DeviceMobileCamera.tsx
@@ -61,10 +61,10 @@ export const DeviceMobileCamera = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M17.25 3.75A.75.75 0 0 0 16.5 3h-9a.75.75 0 0 0-.75.75v16.5c0 .414.336.75.75.75h9a.75.75 0 0 0 .75-.75zM16.5 1.5a2.25 2.25 0 0 1 2.25 2.25v16.5a2.25 2.25 0 0 1-2.25 2.25h-9a2.25 2.25 0 0 1-2.25-2.25V3.75A2.25 2.25 0 0 1 7.5 1.5z"
         clipRule="evenodd"
-        d="M17.25 3.75C17.25 3.33579 16.9142 3 16.5 3H7.5C7.08579 3 6.75 3.33579 6.75 3.75V20.25C6.75 20.6642 7.08579 21 7.5 21H16.5C16.9142 21 17.25 20.6642 17.25 20.25V3.75ZM16.5 1.5C17.7426 1.5 18.75 2.50736 18.75 3.75V20.25C18.75 21.4926 17.7426 22.5 16.5 22.5H7.5C6.25736 22.5 5.25 21.4926 5.25 20.25V3.75C5.25 2.50736 6.25736 1.5 7.5 1.5H16.5Z"
       />
-      <path d="M12 6.5625C12.5178 6.5625 12.9375 6.14277 12.9375 5.625C12.9375 5.10723 12.5178 4.6875 12 4.6875C11.4822 4.6875 11.0625 5.10723 11.0625 5.625C11.0625 6.14277 11.4822 6.5625 12 6.5625Z" />
+      <path d="M12 6.563a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.875" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Devices.tsx b/web/packages/design/src/Icon/Icons/Devices.tsx
index 1db1796ab17d2..720e670460732 100644
--- a/web/packages/design/src/Icon/Icons/Devices.tsx
+++ b/web/packages/design/src/Icon/Icons/Devices.tsx
@@ -59,13 +59,13 @@ export const Devices = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M18 9.75C17.5858 9.75 17.25 10.0858 17.25 10.5C17.25 10.9142 17.5858 11.25 18 11.25H19.5C19.9142 11.25 20.25 10.9142 20.25 10.5C20.25 10.0858 19.9142 9.75 19.5 9.75H18Z" />
+      <path d="M18 9.75a.75.75 0 0 0 0 1.5h1.5a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M3.75 17.25h10.5V18a2.25 2.25 0 0 0 2.25 2.25H21A2.25 2.25 0 0 0 23.25 18V9A2.25 2.25 0 0 0 21 6.75h-1.5V6a2.25 2.25 0 0 0-2.25-2.25H3.75A2.25 2.25 0 0 0 1.5 6v9a2.25 2.25 0 0 0 2.25 2.25m0-12A.75.75 0 0 0 3 6v9a.75.75 0 0 0 .75.75h10.5V9a2.25 2.25 0 0 1 2.25-2.25H18V6a.75.75 0 0 0-.75-.75zm17.25 3h-4.5a.75.75 0 0 0-.75.75v9c0 .414.336.75.75.75H21a.75.75 0 0 0 .75-.75V9a.75.75 0 0 0-.75-.75"
         clipRule="evenodd"
-        d="M3.75 17.25H14.25V18C14.25 19.2426 15.2574 20.25 16.5 20.25H21C22.2426 20.25 23.25 19.2426 23.25 18V9C23.25 7.75736 22.2426 6.75 21 6.75H19.5V6C19.5 5.40326 19.2629 4.83097 18.841 4.40901C18.419 3.98705 17.8467 3.75 17.25 3.75H3.75C3.15326 3.75 2.58097 3.98705 2.15901 4.40901C1.73705 4.83097 1.5 5.40326 1.5 6V15C1.5 15.5967 1.73705 16.169 2.15901 16.591C2.58097 17.0129 3.15326 17.25 3.75 17.25ZM3.75 5.25C3.55109 5.25 3.36032 5.32902 3.21967 5.46967C3.07902 5.61032 3 5.80109 3 6V15C3 15.1989 3.07902 15.3897 3.21967 15.5303C3.36032 15.671 3.55109 15.75 3.75 15.75H14.25V9C14.25 7.75736 15.2574 6.75 16.5 6.75H18V6C18 5.80109 17.921 5.61032 17.7803 5.46967C17.6397 5.32902 17.4489 5.25 17.25 5.25H3.75ZM21 8.25H16.5C16.0858 8.25 15.75 8.58579 15.75 9V18C15.75 18.4142 16.0858 18.75 16.5 18.75H21C21.4142 18.75 21.75 18.4142 21.75 18V9C21.75 8.58579 21.4142 8.25 21 8.25Z"
       />
-      <path d="M8.25 18.75C7.83579 18.75 7.5 19.0858 7.5 19.5C7.5 19.9142 7.83579 20.25 8.25 20.25H12C12.4142 20.25 12.75 19.9142 12.75 19.5C12.75 19.0858 12.4142 18.75 12 18.75H8.25Z" />
+      <path d="M8.25 18.75a.75.75 0 0 0 0 1.5H12a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Download.tsx b/web/packages/design/src/Icon/Icons/Download.tsx
index c75abbeda14f5..7863559b1c474 100644
--- a/web/packages/design/src/Icon/Icons/Download.tsx
+++ b/web/packages/design/src/Icon/Icons/Download.tsx
@@ -59,8 +59,8 @@ export const Download = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 3C12.4142 3 12.75 3.33579 12.75 3.75V12.4393L15.2197 9.96967C15.5126 9.67678 15.9874 9.67678 16.2803 9.96967C16.5732 10.2626 16.5732 10.7374 16.2803 11.0303L12.5303 14.7803C12.4584 14.8522 12.3755 14.9065 12.2871 14.9431C12.1987 14.9798 12.1017 15 12 15C11.8983 15 11.8013 14.9798 11.7129 14.9431C11.6245 14.9065 11.5416 14.8522 11.4697 14.7803L7.71967 11.0303C7.42678 10.7374 7.42678 10.2626 7.71967 9.96967C8.01256 9.67678 8.48744 9.67678 8.78033 9.96967L11.25 12.4393V3.75C11.25 3.33579 11.5858 3 12 3Z" />
-      <path d="M3.75 13.5C4.16421 13.5 4.5 13.8358 4.5 14.25V19.5H19.5V14.25C19.5 13.8358 19.8358 13.5 20.25 13.5C20.6642 13.5 21 13.8358 21 14.25V19.5C21 19.8978 20.842 20.2794 20.5607 20.5607C20.2794 20.842 19.8978 21 19.5 21H4.5C4.10218 21 3.72065 20.842 3.43934 20.5607C3.15804 20.2794 3 19.8978 3 19.5V14.25C3 13.8358 3.33579 13.5 3.75 13.5Z" />
+      <path d="M12 3a.75.75 0 0 1 .75.75v8.69l2.47-2.47a.75.75 0 1 1 1.06 1.06l-3.75 3.75a.75.75 0 0 1-1.06 0l-3.75-3.75a.75.75 0 1 1 1.06-1.06l2.47 2.47V3.75A.75.75 0 0 1 12 3" />
+      <path d="M3.75 13.5a.75.75 0 0 1 .75.75v5.25h15v-5.25a.75.75 0 0 1 1.5 0v5.25a1.5 1.5 0 0 1-1.5 1.5h-15A1.5 1.5 0 0 1 3 19.5v-5.25a.75.75 0 0 1 .75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Earth.tsx b/web/packages/design/src/Icon/Icons/Earth.tsx
index 9d56b8350f9c4..6b787c573a2dc 100644
--- a/web/packages/design/src/Icon/Icons/Earth.tsx
+++ b/web/packages/design/src/Icon/Icons/Earth.tsx
@@ -61,8 +61,8 @@ export const Earth = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M21.75 12c0 5.214-4.093 9.472-9.24 9.737l-.064.003q-.222.01-.446.01c-5.385 0-9.75-4.365-9.75-9.75S6.615 2.25 12 2.25a9.8 9.8 0 0 1 2.101.227c4.375.96 7.649 4.86 7.649 9.523M7.189 5.298A8.2 8.2 0 0 1 12 3.75a8.3 8.3 0 0 1 1.457.128l.162.242.01.014c.126.183.245.358.351.534q.163.27.232.464a.7.7 0 0 1 .04.17c-.207.545-.83 1.278-1.644 1.915-.409.32-.83.588-1.21.773-.396.194-.675.26-.817.26h-.001c-.105 0-.235-.01-.408-.023l-.04-.004c-.154-.012-.335-.027-.517-.033-.366-.012-.9 0-1.352.26-.569.328-.935.963-1.176 1.435-.115.225-.221.458-.315.663l-.001.002a5 5 0 0 1-.24-.64A6.8 6.8 0 0 1 6.25 8c0-.599.204-1.237.435-1.758a7 7 0 0 1 .434-.818l.005-.008a1 1 0 0 0 .065-.118m-.116.084.051.034zM4.75 8.06c.007.808.142 1.608.344 2.282.198.659.492 1.305.876 1.69.298.297.683.391.955.43.272.04.568.039.8.039h.025c.264 0 .457.002.613.024a1 1 0 0 1 .128.028c.141.148.22.295.338.533l.009.018c.124.25.295.59.632.927.32.322.728.373 1.026.357l-.616 1.384a1.5 1.5 0 0 0 .27 1.63l.012.013 1.84 1.894-.182.94A8.25 8.25 0 0 1 4.75 8.06m7.764 5.488.043-.044 2.115.286h.004l4.287 2.638a8.25 8.25 0 0 1-5.594 3.71l.106-.548a1.5 1.5 0 0 0-.375-1.303l-.011-.011-1.839-1.894zm-1.055-1.093-.077.045a5 5 0 0 1-.49.25 1.8 1.8 0 0 1-.439.137c-.108-.129-.18-.267-.282-.471l-.009-.018c-.124-.25-.295-.59-.632-.927-.298-.298-.683-.392-.955-.431a4 4 0 0 0-.363-.032q.104-.226.212-.442c.245-.481.444-.732.588-.815.058-.033.215-.072.553-.06.144.004.292.016.453.029l.034.003c.163.013.352.028.527.028.483 0 1.007-.182 1.477-.412.49-.238 1-.566 1.477-.94.92-.72 1.858-1.722 2.174-2.714a1 1 0 0 0 .026-.108 1.9 1.9 0 0 0-.127-.998A8.25 8.25 0 0 1 20.25 12a8.2 8.2 0 0 1-.598 3.09l-4.192-2.58h-.003a1.5 1.5 0 0 0-.581-.208l-2.14-.288a1.5 1.5 0 0 0-1.277.44"
         clipRule="evenodd"
-        d="M21.75 12C21.75 17.214 17.6573 21.472 12.5093 21.7369C12.4882 21.7388 12.467 21.7399 12.4456 21.74C12.2979 21.7466 12.1493 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C12.7069 2.25 13.3963 2.32523 14.0605 2.46813C14.0741 2.4707 14.0876 2.47364 14.1011 2.47695C18.4759 3.4378 21.75 7.33655 21.75 12ZM7.1886 5.29753C8.54293 4.32359 10.2045 3.75 12 3.75C12.497 3.75 12.9837 3.79395 13.4565 3.87817C13.511 3.96084 13.5668 4.04248 13.6195 4.11952L13.6295 4.13416C13.7545 4.31713 13.8741 4.49211 13.98 4.66781C14.0884 4.84751 14.1664 5.00217 14.2119 5.13216C14.2408 5.2148 14.2501 5.2694 14.2526 5.30148C14.0455 5.84747 13.4222 6.57979 12.608 7.21724C12.1994 7.53724 11.7775 7.80545 11.3989 7.99002C11.0019 8.18356 10.7235 8.25013 10.5808 8.2499L10.5796 8.2499C10.4749 8.2499 10.3455 8.24061 10.1722 8.22665L10.1323 8.22342C9.97799 8.21093 9.79655 8.19623 9.61495 8.1902C9.24939 8.17806 8.71499 8.18973 8.26288 8.45031C7.69445 8.77794 7.32755 9.41263 7.08716 9.88465C6.97225 10.1103 6.8659 10.3427 6.77206 10.5478L6.77094 10.5502C6.69205 10.3824 6.60866 10.1688 6.53087 9.90948C6.36278 9.34918 6.25 8.67175 6.25 7.99999C6.25 7.40115 6.45402 6.76261 6.68536 6.24209C6.79812 5.98839 6.91101 5.77678 6.99493 5.6299C7.03675 5.55673 7.07096 5.50033 7.09382 5.4636C7.10524 5.44525 7.11379 5.43186 7.11899 5.42379L7.12404 5.41601C7.14949 5.37784 7.17097 5.33818 7.1886 5.29753ZM7.07314 5.38208L7.12404 5.41601C7.124 5.41607 7.12405 5.41603 7.07314 5.38208C7.07316 5.38207 7.07312 5.38209 7.07314 5.38208ZM4.75023 8.05928C4.75659 8.86742 4.89216 9.66726 5.09413 10.3405C5.29187 10.9996 5.58551 11.6462 5.96967 12.0303C6.26772 12.3284 6.65312 12.4223 6.92518 12.4612C7.19748 12.5001 7.49315 12.5 7.72582 12.5L7.75 12.5C8.01386 12.5 8.20701 12.5015 8.36268 12.5237C8.43553 12.5341 8.47428 12.5459 8.49074 12.5518C8.63249 12.6998 8.71009 12.8472 8.82918 13.0854L8.83804 13.1031C8.96241 13.3521 9.13313 13.6938 9.46967 14.0303C9.79092 14.3516 10.198 14.403 10.4965 14.3872L9.87963 15.7714C9.76024 16.0397 9.72219 16.337 9.77018 16.6266C9.81817 16.9163 9.95011 17.1855 10.1496 17.4008L10.1617 17.4136L12.0012 19.3081L11.82 20.2481C7.34675 20.1523 3.75 16.4962 3.75 12C3.75 10.5728 4.11241 9.2302 4.75023 8.05928ZM12.5137 13.5466C12.5287 13.5325 12.543 13.518 12.5566 13.503L14.6725 13.7886C14.6736 13.7887 14.6748 13.7892 14.6758 13.7897L18.963 16.4268C17.7319 18.3591 15.7186 19.7445 13.369 20.1369L13.4746 19.5894C13.5188 19.358 13.5079 19.1194 13.4428 18.893C13.3776 18.6666 13.2601 18.4588 13.0996 18.2863L13.0885 18.2746L11.2501 16.3812L12.5137 13.5466ZM11.4593 12.4538C11.4361 12.4677 11.4102 12.483 11.382 12.4994C11.2493 12.5762 11.0742 12.6701 10.8921 12.7481C10.7091 12.8265 10.5577 12.8721 10.4533 12.8858C10.345 12.7572 10.2733 12.6194 10.1708 12.4146L10.162 12.3968C10.0376 12.1479 9.86687 11.8062 9.53033 11.4697C9.23228 11.1716 8.84688 11.0776 8.57482 11.0388C8.45587 11.0218 8.33247 11.0122 8.21181 11.0069C8.28123 10.8564 8.35061 10.7091 8.4238 10.5654C8.66923 10.0835 8.86818 9.83275 9.01192 9.7499C9.06974 9.71658 9.22688 9.67814 9.56516 9.68938C9.70942 9.69417 9.85653 9.70605 10.0176 9.71905L10.0518 9.72181C10.2151 9.73497 10.4042 9.74987 10.579 9.7499C11.0616 9.75053 11.5857 9.56771 12.0562 9.33833C12.5453 9.09987 13.0561 8.7715 13.5328 8.39828C14.4522 7.67841 15.3907 6.67571 15.7073 5.68404C15.7186 5.64859 15.7273 5.61233 15.7332 5.57559C15.7892 5.22901 15.7205 4.90199 15.6278 4.63682C15.6209 4.61711 15.6137 4.59747 15.6064 4.57792C18.3555 5.9162 20.25 8.73686 20.25 12C20.25 13.0925 20.0377 14.1353 19.652 15.0895L15.4596 12.5107L15.4571 12.5092C15.2797 12.401 15.0819 12.3306 14.876 12.3024L12.7354 12.0135C12.4142 11.9701 12.0872 12.0319 11.804 12.1897C11.6761 12.261 11.5601 12.3501 11.4593 12.4538Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Edit.tsx b/web/packages/design/src/Icon/Icons/Edit.tsx
index 2d832f7e6021a..13377c3ce7a37 100644
--- a/web/packages/design/src/Icon/Icons/Edit.tsx
+++ b/web/packages/design/src/Icon/Icons/Edit.tsx
@@ -61,10 +61,10 @@ export const Edit = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M17.47 2.47a.75.75 0 0 1 1.06 0l3 3a.75.75 0 0 1 0 1.06l-9 9a.75.75 0 0 1-.53.22H9a.75.75 0 0 1-.75-.75v-3a.75.75 0 0 1 .22-.53zM19.94 6l-1.19 1.19-1.94-1.94L18 4.06zM9.75 12.31l6-6 1.94 1.94-6 6H9.75z"
         clipRule="evenodd"
-        d="M17.4697 2.46967C17.7626 2.17678 18.2374 2.17678 18.5303 2.46967L21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L12.5303 15.5303C12.3897 15.671 12.1989 15.75 12 15.75H9C8.58579 15.75 8.25 15.4142 8.25 15V12C8.25 11.8011 8.32902 11.6103 8.46967 11.4697L17.4697 2.46967ZM19.9393 6L18.75 7.18934L16.8107 5.25L18 4.06066L19.9393 6ZM9.75 12.3107L15.75 6.31066L17.6893 8.25L11.6893 14.25H9.75V12.3107Z"
       />
-      <path d="M4.5 3C4.10217 3 3.72064 3.15804 3.43934 3.43934C3.15804 3.72064 3 4.10217 3 4.5V19.5C3 19.8978 3.15804 20.2794 3.43934 20.5607C3.72065 20.842 4.10218 21 4.5 21H19.5C19.8978 21 20.2794 20.842 20.5607 20.5607C20.842 20.2794 21 19.8978 21 19.5V11.25C21 10.8358 20.6642 10.5 20.25 10.5C19.8358 10.5 19.5 10.8358 19.5 11.25V19.5H4.5L4.5 4.5L12.75 4.5C13.1642 4.5 13.5 4.16421 13.5 3.75C13.5 3.33579 13.1642 3 12.75 3H4.5Z" />
+      <path d="M4.5 3A1.5 1.5 0 0 0 3 4.5v15A1.5 1.5 0 0 0 4.5 21h15a1.5 1.5 0 0 0 1.5-1.5v-8.25a.75.75 0 0 0-1.5 0v8.25h-15v-15h8.25a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Ellipsis.tsx b/web/packages/design/src/Icon/Icons/Ellipsis.tsx
index 22ef42e8fc652..3845e7e99fda5 100644
--- a/web/packages/design/src/Icon/Icons/Ellipsis.tsx
+++ b/web/packages/design/src/Icon/Icons/Ellipsis.tsx
@@ -61,18 +61,8 @@ export const Ellipsis = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M1.5 12a3 3 0 1 1 6 0 3 3 0 0 1-6 0m3-1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3M9 12a3 3 0 1 1 6 0 3 3 0 0 1-6 0m3-1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3M19.5 9a3 3 0 1 0 0 6 3 3 0 0 0 0-6M18 12a1.5 1.5 0 1 1 3 0 1.5 1.5 0 0 1-3 0"
         clipRule="evenodd"
-        d="M1.5 12C1.5 10.3431 2.84315 9 4.5 9C6.15685 9 7.5 10.3431 7.5 12C7.5 13.6569 6.15685 15 4.5 15C2.84315 15 1.5 13.6569 1.5 12ZM4.5 10.5C3.67157 10.5 3 11.1716 3 12C3 12.8284 3.67157 13.5 4.5 13.5C5.32843 13.5 6 12.8284 6 12C6 11.1716 5.32843 10.5 4.5 10.5Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M9 12C9 10.3431 10.3431 9 12 9C13.6569 9 15 10.3431 15 12C15 13.6569 13.6569 15 12 15C10.3431 15 9 13.6569 9 12ZM12 10.5C11.1716 10.5 10.5 11.1716 10.5 12C10.5 12.8284 11.1716 13.5 12 13.5C12.8284 13.5 13.5 12.8284 13.5 12C13.5 11.1716 12.8284 10.5 12 10.5Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M19.5 9C17.8431 9 16.5 10.3431 16.5 12C16.5 13.6569 17.8431 15 19.5 15C21.1569 15 22.5 13.6569 22.5 12C22.5 10.3431 21.1569 9 19.5 9ZM18 12C18 11.1716 18.6716 10.5 19.5 10.5C20.3284 10.5 21 11.1716 21 12C21 12.8284 20.3284 13.5 19.5 13.5C18.6716 13.5 18 12.8284 18 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/EmailSolid.tsx b/web/packages/design/src/Icon/Icons/EmailSolid.tsx
index 00c4e28260939..3e9a7925e8397 100644
--- a/web/packages/design/src/Icon/Icons/EmailSolid.tsx
+++ b/web/packages/design/src/Icon/Icons/EmailSolid.tsx
@@ -61,8 +61,8 @@ export const EmailSolid = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3 4.5a.75.75 0 0 0-.75.75V18a1.5 1.5 0 0 0 1.5 1.5h16.5a1.5 1.5 0 0 0 1.5-1.5V5.25A.75.75 0 0 0 21 4.5zm.75 2.455V18h16.5V6.955l-7.743 7.098a.75.75 0 0 1-1.014 0zM19.072 6H4.928L12 12.483z"
         clipRule="evenodd"
-        d="M3 4.5C2.58579 4.5 2.25 4.83579 2.25 5.25V18C2.25 18.3978 2.40804 18.7794 2.68934 19.0607C2.97065 19.342 3.35218 19.5 3.75 19.5H20.25C20.6478 19.5 21.0294 19.342 21.3107 19.0607C21.592 18.7794 21.75 18.3978 21.75 18V5.25C21.75 4.83579 21.4142 4.5 21 4.5H3ZM3.75 6.9551V18H20.25V6.95502L12.5068 14.053C12.22 14.3158 11.7799 14.3158 11.4932 14.053L3.75 6.9551ZM19.072 6H4.92792L12 12.4827L19.072 6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/EnvelopeOpen.tsx b/web/packages/design/src/Icon/Icons/EnvelopeOpen.tsx
index d6897f6ab90f8..f6ad8bad82eef 100644
--- a/web/packages/design/src/Icon/Icons/EnvelopeOpen.tsx
+++ b/web/packages/design/src/Icon/Icons/EnvelopeOpen.tsx
@@ -61,8 +61,8 @@ export const EnvelopeOpen = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.416 2.376a.75.75 0 0 0-.832 0L2.595 8.369a.75.75 0 0 0-.345.63v9.751a1.5 1.5 0 0 0 1.5 1.5h16.5a1.5 1.5 0 0 0 1.5-1.5V9.013a.75.75 0 0 0-.348-.646zm7.263 6.645L12 3.9 4.321 9.02l6.283 4.48h2.793zM3.75 10.456v8.294h16.5v-8.294l-6.178 4.405a.75.75 0 0 1-.435.14h-3.273a.75.75 0 0 1-.435-.14z"
         clipRule="evenodd"
-        d="M12.416 2.37596C12.1641 2.20801 11.8359 2.20801 11.584 2.37596L2.59504 8.36858C2.54568 8.40022 2.49953 8.43803 2.4578 8.48179C2.41124 8.53051 2.37167 8.58508 2.33994 8.64388C2.27938 8.75578 2.25003 8.87799 2.25 8.99926C2.25 8.99951 2.25 8.99902 2.25 8.99926L2.25 18.75C2.25 19.1478 2.40804 19.5294 2.68934 19.8107C2.97065 20.092 3.35218 20.25 3.75 20.25H20.25C20.6478 20.25 21.0294 20.092 21.3107 19.8107C21.592 19.5294 21.75 19.1478 21.75 18.75V9.01273C21.7527 8.85774 21.7076 8.70055 21.6107 8.56465C21.5528 8.48342 21.4817 8.4172 21.4023 8.36684L12.416 2.37596ZM19.6791 9.02079L12 3.90139L4.32101 9.02071L10.6041 13.5001H13.3969L19.6791 9.02079ZM3.75 10.4558V18.75H20.25V10.456L14.0723 14.8607C13.9452 14.9514 13.793 15.0001 13.6369 15.0001H10.3641C10.208 15.0001 10.0558 14.9514 9.92874 14.8608L3.75 10.4558Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/EqualizersVertical.tsx b/web/packages/design/src/Icon/Icons/EqualizersVertical.tsx
index 0885164e6ffa7..0be55850400e2 100644
--- a/web/packages/design/src/Icon/Icons/EqualizersVertical.tsx
+++ b/web/packages/design/src/Icon/Icons/EqualizersVertical.tsx
@@ -59,12 +59,7 @@ export const EqualizersVertical = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 3C12.4142 3 12.75 3.33579 12.75 3.75V7.5H14.25C14.6642 7.5 15 7.83579 15 8.25C15 8.66421 14.6642 9 14.25 9H9.75C9.33579 9 9 8.66421 9 8.25C9 7.83579 9.33579 7.5 9.75 7.5H11.25V3.75C11.25 3.33579 11.5858 3 12 3Z" />
-      <path d="M12 10.5C12.4142 10.5 12.75 10.8358 12.75 11.25V20.25C12.75 20.6642 12.4142 21 12 21C11.5858 21 11.25 20.6642 11.25 20.25V11.25C11.25 10.8358 11.5858 10.5 12 10.5Z" />
-      <path d="M19.5 18.75C19.5 18.3358 19.1642 18 18.75 18C18.3358 18 18 18.3358 18 18.75V20.25C18 20.6642 18.3358 21 18.75 21C19.1642 21 19.5 20.6642 19.5 20.25V18.75Z" />
-      <path d="M18.75 3C19.1642 3 19.5 3.33579 19.5 3.75V15H21C21.4142 15 21.75 15.3358 21.75 15.75C21.75 16.1642 21.4142 16.5 21 16.5H16.5C16.0858 16.5 15.75 16.1642 15.75 15.75C15.75 15.3358 16.0858 15 16.5 15H18V3.75C18 3.33579 18.3358 3 18.75 3Z" />
-      <path d="M5.25 15C5.66421 15 6 15.3358 6 15.75V20.25C6 20.6642 5.66421 21 5.25 21C4.83579 21 4.5 20.6642 4.5 20.25V15.75C4.5 15.3358 4.83579 15 5.25 15Z" />
-      <path d="M6 3.75C6 3.33579 5.66421 3 5.25 3C4.83579 3 4.5 3.33579 4.5 3.75V12H3C2.58579 12 2.25 12.3358 2.25 12.75C2.25 13.1642 2.58579 13.5 3 13.5H7.5C7.91421 13.5 8.25 13.1642 8.25 12.75C8.25 12.3358 7.91421 12 7.5 12H6V3.75Z" />
+      <path d="M12 3a.75.75 0 0 1 .75.75V7.5h1.5a.75.75 0 0 1 0 1.5h-4.5a.75.75 0 0 1 0-1.5h1.5V3.75A.75.75 0 0 1 12 3m0 7.5a.75.75 0 0 1 .75.75v9a.75.75 0 0 1-1.5 0v-9a.75.75 0 0 1 .75-.75m7.5 8.25a.75.75 0 0 0-1.5 0v1.5a.75.75 0 0 0 1.5 0zM18.75 3a.75.75 0 0 1 .75.75V15H21a.75.75 0 0 1 0 1.5h-4.5a.75.75 0 0 1 0-1.5H18V3.75a.75.75 0 0 1 .75-.75M5.25 15a.75.75 0 0 1 .75.75v4.5a.75.75 0 0 1-1.5 0v-4.5a.75.75 0 0 1 .75-.75M6 3.75a.75.75 0 0 0-1.5 0V12H3a.75.75 0 0 0 0 1.5h4.5a.75.75 0 0 0 0-1.5H6z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Expand.tsx b/web/packages/design/src/Icon/Icons/Expand.tsx
index e1e9bc86467b0..0cec4170df7bd 100644
--- a/web/packages/design/src/Icon/Icons/Expand.tsx
+++ b/web/packages/design/src/Icon/Icons/Expand.tsx
@@ -59,10 +59,7 @@ export const Expand = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M15.75 3.75C15.3358 3.75 15 4.08579 15 4.5C15 4.91421 15.3358 5.25 15.75 5.25H18.75V8.25C18.75 8.66421 19.0858 9 19.5 9C19.9142 9 20.25 8.66421 20.25 8.25V4.5C20.25 4.08579 19.9142 3.75 19.5 3.75H15.75Z" />
-      <path d="M5.25 15.75C5.25 15.3358 4.91421 15 4.5 15C4.08579 15 3.75 15.3358 3.75 15.75V19.5C3.75 19.9142 4.08579 20.25 4.5 20.25H8.25C8.66421 20.25 9 19.9142 9 19.5C9 19.0858 8.66421 18.75 8.25 18.75H5.25V15.75Z" />
-      <path d="M19.5 15C19.9142 15 20.25 15.3358 20.25 15.75V19.5C20.25 19.9142 19.9142 20.25 19.5 20.25H15.75C15.3358 20.25 15 19.9142 15 19.5C15 19.0858 15.3358 18.75 15.75 18.75H18.75V15.75C18.75 15.3358 19.0858 15 19.5 15Z" />
-      <path d="M4.5 3.75C4.08579 3.75 3.75 4.08579 3.75 4.5V8.25C3.75 8.66421 4.08579 9 4.5 9C4.91421 9 5.25 8.66421 5.25 8.25V5.25H8.25C8.66421 5.25 9 4.91421 9 4.5C9 4.08579 8.66421 3.75 8.25 3.75H4.5Z" />
+      <path d="M15.75 3.75a.75.75 0 0 0 0 1.5h3v3a.75.75 0 0 0 1.5 0V4.5a.75.75 0 0 0-.75-.75zm-10.5 12a.75.75 0 0 0-1.5 0v3.75c0 .414.336.75.75.75h3.75a.75.75 0 0 0 0-1.5h-3zM19.5 15a.75.75 0 0 1 .75.75v3.75a.75.75 0 0 1-.75.75h-3.75a.75.75 0 0 1 0-1.5h3v-3a.75.75 0 0 1 .75-.75M4.5 3.75a.75.75 0 0 0-.75.75v3.75a.75.75 0 0 0 1.5 0v-3h3a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Facebook.tsx b/web/packages/design/src/Icon/Icons/Facebook.tsx
index f2b33bfac090a..7ae9928ee32a0 100644
--- a/web/packages/design/src/Icon/Icons/Facebook.tsx
+++ b/web/packages/design/src/Icon/Icons/Facebook.tsx
@@ -61,8 +61,8 @@ export const Facebook = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 3.75a8.25 8.25 0 0 0-.75 16.466V14.25H9a.75.75 0 0 1 0-1.5h2.25V10.5a3 3 0 0 1 3-3h1.5a.75.75 0 0 1 0 1.5h-1.5a1.5 1.5 0 0 0-1.5 1.5v2.25H15a.75.75 0 0 1 0 1.5h-2.25v5.966A8.251 8.251 0 0 0 12 3.75M21.75 12c0 5.385-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12 6.615 2.25 12 2.25s9.75 4.365 9.75 9.75"
         clipRule="evenodd"
-        d="M12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.3035 7.04513 19.8374 11.25 20.2164V14.25H9C8.58579 14.25 8.25 13.9142 8.25 13.5C8.25 13.0858 8.58579 12.75 9 12.75H11.25V10.5C11.25 9.70435 11.5661 8.94129 12.1287 8.37868C12.6913 7.81607 13.4544 7.5 14.25 7.5H15.75C16.1642 7.5 16.5 7.83579 16.5 8.25C16.5 8.66421 16.1642 9 15.75 9H14.25C13.8522 9 13.4706 9.15804 13.1893 9.43934C12.908 9.72064 12.75 10.1022 12.75 10.5V12.75H15C15.4142 12.75 15.75 13.0858 15.75 13.5C15.75 13.9142 15.4142 14.25 15 14.25H12.75V20.2164C16.9549 19.8374 20.25 16.3035 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75ZM21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/FastForward.tsx b/web/packages/design/src/Icon/Icons/FastForward.tsx
new file mode 100644
index 0000000000000..38ec3b7bd1b8b
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/FastForward.tsx
@@ -0,0 +1,78 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const FastForward = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-fastforward"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        stroke="#000"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        strokeWidth="1.5"
+        d="M3 6.736v10.528a.741.741 0 0 0 1.142.618l8.268-5.264a.73.73 0 0 0 0-1.236L4.142 6.118A.741.741 0 0 0 3 6.736"
+      />
+      <path
+        stroke="#000"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        strokeWidth="1.5"
+        d="M12.75 6.736v10.528a.74.74 0 0 0 1.142.618l8.268-5.264a.73.73 0 0 0 0-1.236l-8.268-5.264a.741.741 0 0 0-1.142.618"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/FilmStrip.tsx b/web/packages/design/src/Icon/Icons/FilmStrip.tsx
new file mode 100644
index 0000000000000..fb99cb85eda1e
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/FilmStrip.tsx
@@ -0,0 +1,68 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const FilmStrip = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-filmstrip"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M3.34 3.814a1.46 1.46 0 0 0-.666.413c-.226.235-.333.44-.39.752-.063.338-.062 13.774.001 14.069.113.535.516.979 1.029 1.135.279.084 17.093.084 17.372 0 .525-.16.929-.615 1.03-1.162.062-.331.062-13.711 0-14.042a1.37 1.37 0 0 0-.423-.784 1.5 1.5 0 0 0-.673-.393c-.239-.062-17.065-.05-17.28.012M6.76 6v.76h-3V5.24h3zm4.48 0v.76h-3V5.24h3zm4.52 0v.76h-3V5.24h3zm4.48 0v.76h-3V5.24h3zm-9 6v3.76H3.76V8.24h7.48zm9 0v3.76h-7.48V8.24h7.48zM6.76 18v.76h-3v-1.52h3zm4.48 0v.76h-3v-1.52h3zm4.52 0v.76h-3v-1.52h3zm4.48 0v.76h-3v-1.52h3z"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/FingerprintSimple.tsx b/web/packages/design/src/Icon/Icons/FingerprintSimple.tsx
index 1740858bc27bc..4779ffa9a741c 100644
--- a/web/packages/design/src/Icon/Icons/FingerprintSimple.tsx
+++ b/web/packages/design/src/Icon/Icons/FingerprintSimple.tsx
@@ -61,25 +61,14 @@ export const FingerprintSimple = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.126 7.097A5.25 5.25 0 0 1 15.912 8.5a.75.75 0 0 1-1.118 1 3.75 3.75 0 0 0-5.86.342c-.5.938-.553 1.754-.624 2.85q-.021.323-.048.682c-.117 1.472-.404 3.206-1.806 5.548a.75.75 0 1 1-1.287-.77c1.254-2.096 1.494-3.591 1.598-4.896q.021-.296.04-.598c.069-1.121.141-2.301.827-3.567l.042-.068a5.25 5.25 0 0 1 2.45-1.926"
         clipRule="evenodd"
-        d="M10.1264 7.09652C11.1195 6.71717 12.2044 6.64823 13.2375 6.89884C14.2706 7.14945 15.2033 7.70779 15.9122 8.50001C16.1884 8.80869 16.1621 9.28283 15.8534 9.55904C15.5448 9.83525 15.0706 9.80893 14.7944 9.50026C14.2881 8.93439 13.6218 8.53557 12.8839 8.35656C12.146 8.17756 11.3711 8.2268 10.6617 8.49777C9.96462 8.76405 9.36312 9.23213 8.93383 9.84176C8.43452 10.7802 8.38127 11.5959 8.30971 12.6921C8.29564 12.9076 8.28086 13.134 8.26184 13.3743C8.14535 14.8463 7.85803 16.5799 6.45592 18.9225C6.2432 19.2779 5.78263 19.3936 5.42721 19.1809C5.0718 18.9681 4.95612 18.5076 5.16885 18.1521C6.42332 16.0562 6.66323 14.561 6.76651 13.256C6.78214 13.0585 6.79437 12.8593 6.80672 12.6582C6.87558 11.5365 6.94802 10.3567 7.63431 9.09119C7.64696 9.06786 7.66084 9.04522 7.67589 9.02337C8.27881 8.14779 9.13334 7.47588 10.1264 7.09652Z"
       />
-      <path d="M9.24916 4.21937C8.85849 4.35704 8.43019 4.15195 8.29252 3.76128C8.15485 3.37061 8.35995 2.94231 8.75061 2.80464C10.2214 2.28635 11.795 2.12816 13.3395 2.34331C14.884 2.55847 16.3544 3.14072 17.6275 4.04125C18.9007 4.94179 19.9394 6.13437 20.6566 7.51905C21.3739 8.90374 21.7488 10.4402 21.7499 11.9996C21.7511 14.0742 21.5203 16.1425 21.062 18.1658C20.9705 18.5698 20.5688 18.8231 20.1648 18.7316C19.7608 18.6401 19.5075 18.2384 19.599 17.8344C20.0327 15.9202 20.251 13.9634 20.2499 12.0007C20.248 9.34598 18.9286 6.7989 16.7613 5.26586C14.594 3.73284 11.7529 3.33706 9.24916 4.21937Z" />
-      <path d="M5.45674 4.77313C5.74238 4.47316 6.21711 4.46154 6.51708 4.74718C6.81609 5.03191 6.82232 5.51279 6.54008 5.81064C6.24734 6.12128 5.96861 6.44567 5.6997 6.77705C5.22735 7.35915 4.72407 8.05482 4.46255 8.63049C3.81632 10.053 4.09735 11.6882 3.72771 13.1806C3.51687 14.0318 3.1524 15.1819 2.9838 15.704C2.95342 15.7981 2.92285 15.8922 2.89187 15.986C2.76166 16.3793 2.33735 16.5925 1.94413 16.4623C1.55092 16.3321 1.33771 15.9077 1.4679 15.5145C1.57247 15.1976 1.67353 14.8795 1.77251 14.5608C1.94298 14.0118 2.14251 13.3416 2.27171 12.82C2.43969 12.1418 2.46871 11.5725 2.50028 10.9533C2.5066 10.8293 2.51303 10.7033 2.52069 10.5741C2.56636 9.80353 2.65788 8.97642 3.09687 8.01008C3.44208 7.25018 4.04889 6.43087 4.53494 5.83189C4.78379 5.52522 5.01254 5.26237 5.17928 5.07595C5.27053 4.97392 5.36244 4.87237 5.45674 4.77313Z" />
+      <path d="M9.25 4.22a.75.75 0 1 1-.5-1.415 9.757 9.757 0 0 1 13 9.195 28 28 0 0 1-.688 6.166.75.75 0 1 1-1.463-.332c.434-1.914.652-3.87.65-5.833a8.32 8.32 0 0 0-3.488-6.735A8.32 8.32 0 0 0 9.25 4.219m-3.793.554a.75.75 0 0 1 1.06-.026.76.76 0 0 1 .023 1.064c-.293.31-.571.635-.84.966-.473.582-.976 1.278-1.237 1.853-.647 1.423-.366 3.058-.735 4.55-.211.852-.576 2.002-.744 2.524l-.092.282a.75.75 0 1 1-1.424-.472q.156-.474.305-.953c.17-.55.37-1.22.499-1.741.168-.678.197-1.248.228-1.867l.02-.379c.046-.77.138-1.598.577-2.564.345-.76.952-1.58 1.438-2.178a21 21 0 0 1 .922-1.059" />
       <path
         fillRule="evenodd"
+        d="M16.499 11.25a.75.75 0 0 1 .75.75 23.2 23.2 0 0 1-1.736 8.835.75.75 0 1 1-1.388-.57 21.7 21.7 0 0 0 1.625-8.264.75.75 0 0 1 .749-.75m-5.824 7.566a.75.75 0 0 1 .374.992q-.294.651-.643 1.276a.75.75 0 0 1-1.31-.732q.318-.57.587-1.162a.75.75 0 0 1 .992-.374m1.324-7.567a.75.75 0 0 1 .75.749 18.8 18.8 0 0 1-.585 4.687.75.75 0 1 1-1.453-.372c.36-1.409.541-2.858.539-4.313a.75.75 0 0 1 .749-.75"
         clipRule="evenodd"
-        d="M16.4989 11.2501C16.9131 11.2496 17.2493 11.5849 17.2499 11.9992C17.2538 15.0296 16.6636 18.0315 15.5127 20.835C15.3554 21.2181 14.9173 21.4013 14.5341 21.2439C14.1509 21.0866 13.9678 20.6485 14.1251 20.2653C15.2016 17.6432 15.7536 14.8355 15.7499 12.0011C15.7493 11.5869 16.0847 11.2507 16.4989 11.2501Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M10.675 18.8168C11.0524 18.9876 11.2199 19.4319 11.0491 19.8093C10.8529 20.243 10.6383 20.6682 10.4055 21.0848C10.2034 21.4463 9.74651 21.5757 9.38493 21.3736C9.02336 21.1715 8.89405 20.7146 9.09613 20.353C9.30832 19.9733 9.50377 19.586 9.68252 19.1909C9.85328 18.8136 10.2976 18.6461 10.675 18.8168Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M11.9986 11.2501C12.4128 11.2494 12.7492 11.5846 12.7499 11.9988C12.7527 13.5797 12.5558 15.1545 12.164 16.686C12.0613 17.0873 11.6528 17.3294 11.2515 17.2267C10.8502 17.1241 10.6081 16.7155 10.7108 16.3142C11.0713 14.9051 11.2524 13.456 11.2499 12.0014C11.2492 11.5872 11.5844 11.2509 11.9986 11.2501Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Floppy.tsx b/web/packages/design/src/Icon/Icons/Floppy.tsx
index b128d539d0eeb..f59deb3aa7910 100644
--- a/web/packages/design/src/Icon/Icons/Floppy.tsx
+++ b/web/packages/design/src/Icon/Icons/Floppy.tsx
@@ -60,8 +60,8 @@ export const Floppy = forwardRef<HTMLSpanElement, IconProps>(
       ref={ref}
     >
       <path
-        d="M4.174 3.042c-.418.082-.844.433-1.042.858l-.112.24v15.72l.112.24c.147.315.455.624.764.767l.244.113h15.72l.244-.113c.309-.143.617-.452.764-.767l.112-.24.012-5.7c.013-5.975.014-5.948-.161-6.3-.097-.195-4.271-4.394-4.581-4.608-.377-.261-.125-.251-6.31-.247-3.08.002-5.675.019-5.766.037M17.47 6.53l2.01 2.01v10.981l-1.11-.01-1.11-.011-.02-2.82-.02-2.82-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108H7.86l-.229.108a1.7 1.7 0 0 0-.743.743l-.108.229-.02 2.82-.02 2.82-1.11.011-1.11.01V4.52h10.94l2.01 2.01m-8.81-.47c-.296.105-.451.409-.406.794.049.409.265.605.717.645.159.015 1.468.021 2.909.014L14.5 7.5l.164-.094c.22-.126.304-.282.325-.602.021-.324-.09-.576-.309-.703-.137-.079-.21-.081-3-.09-2.394-.007-2.886.001-3.02.049m7.09 10.81-.01 2.63H8.26l-.01-2.63-.011-2.63h7.522l-.011 2.63"
         fillRule="evenodd"
+        d="M4.174 3.042c-.418.082-.844.433-1.042.858l-.112.24v15.72l.112.24c.147.315.455.624.764.767l.244.113h15.72l.244-.113c.309-.143.617-.452.764-.767l.112-.24.012-5.7c.013-5.975.014-5.948-.161-6.3-.097-.195-4.271-4.394-4.581-4.608-.377-.261-.125-.251-6.31-.247-3.08.002-5.675.019-5.766.037M17.47 6.53l2.01 2.01v10.981l-1.11-.01-1.11-.011-.02-2.82-.02-2.82-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108H7.86l-.229.108a1.7 1.7 0 0 0-.743.743l-.108.229-.02 2.82-.02 2.82-1.11.011-1.11.01V4.52h10.94zm-8.81-.47c-.296.105-.451.409-.406.794.049.409.265.605.717.645.159.015 1.468.021 2.909.014L14.5 7.5l.164-.094c.22-.126.304-.282.325-.602.021-.324-.09-.576-.309-.703-.137-.079-.21-.081-3-.09-2.394-.007-2.886.001-3.02.049m7.09 10.81-.01 2.63H8.26l-.01-2.63-.011-2.63h7.522z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/FlowArrow.tsx b/web/packages/design/src/Icon/Icons/FlowArrow.tsx
index 67c80917c0037..0265dda4c0b5b 100644
--- a/web/packages/design/src/Icon/Icons/FlowArrow.tsx
+++ b/web/packages/design/src/Icon/Icons/FlowArrow.tsx
@@ -59,11 +59,7 @@ export const FlowArrow = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M18.9697 3.96967C19.2626 3.67678 19.7374 3.67678 20.0303 3.96967L23.0217 6.96105C23.1625 7.09739 23.25 7.28841 23.25 7.49987C23.25 7.58706 23.2351 7.67077 23.2078 7.74861C23.1717 7.85149 23.1126 7.94809 23.0303 8.03033L20.0303 11.0303C19.7374 11.3232 19.2626 11.3232 18.9697 11.0303C18.6768 10.7374 18.6768 10.2626 18.9697 9.96967L20.7344 8.20498C20.6318 8.20146 20.5297 8.19809 20.4283 8.19501C19.7318 8.17382 19.0484 8.1653 18.3867 8.20999C17.0602 8.29956 15.8986 8.5988 14.9795 9.363C14.1846 10.024 13.8754 10.921 13.5421 12.0583C13.5235 12.1216 13.5049 12.1858 13.486 12.2508C13.1829 13.2946 12.8197 14.5456 11.8389 15.5294C10.917 16.4541 9.82114 16.8794 8.98064 17.0761C8.68127 17.1461 8.40947 17.1883 8.18218 17.2136C7.84892 18.9434 6.32705 20.25 4.5 20.25C2.42893 20.25 0.75 18.5711 0.75 16.5C0.75 14.4289 2.42893 12.75 4.5 12.75C6.29794 12.75 7.80035 14.0153 8.16535 15.704C8.30752 15.684 8.46732 15.6556 8.63896 15.6155C9.30628 15.4594 10.1143 15.1347 10.7766 14.4704C11.4794 13.7654 11.745 12.8581 12.0762 11.7267C12.085 11.6968 12.0938 11.6668 12.1026 11.6366C12.4295 10.521 12.8348 9.19553 14.0205 8.20961C15.2868 7.15675 16.8141 6.81277 18.2857 6.71339C19.0231 6.6636 19.766 6.67417 20.4739 6.6957C20.5297 6.6974 20.5852 6.69916 20.6403 6.70096L18.9697 5.03033C18.6768 4.73744 18.6768 4.26256 18.9697 3.96967ZM6.75 16.4994C6.74969 15.257 5.74245 14.25 4.5 14.25C3.25736 14.25 2.25 15.2574 2.25 16.5C2.25 17.7426 3.25736 18.75 4.5 18.75C5.74264 18.75 6.75 17.7421 6.75 16.4994C6.75 16.4996 6.75 16.4992 6.75 16.4994Z"
-      />
+      <path d="M18.97 3.97a.75.75 0 0 1 1.06 0l2.992 2.991a.75.75 0 0 1 .008 1.07l-3 3a.75.75 0 1 1-1.06-1.061l1.764-1.765-.306-.01c-.696-.021-1.38-.03-2.041.015-1.327.09-2.488.389-3.408 1.153-.794.661-1.104 1.558-1.437 2.695l-.056.193c-.303 1.044-.666 2.295-1.647 3.278-.922.925-2.018 1.35-2.858 1.547-.3.07-.572.112-.799.138a3.751 3.751 0 1 1-.017-1.51q.215-.029.474-.088c.667-.157 1.475-.481 2.138-1.146.702-.705.968-1.612 1.3-2.743l.026-.09c.327-1.116.732-2.441 1.918-3.427 1.266-1.053 2.793-1.397 4.265-1.497a23 23 0 0 1 2.354-.012l-1.67-1.67a.75.75 0 0 1 0-1.061M6.75 16.5a2.25 2.25 0 1 0-4.5 0 2.25 2.25 0 0 0 4.5 0" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/FolderPlus.tsx b/web/packages/design/src/Icon/Icons/FolderPlus.tsx
index 7560cfdbcc767..b4e2a65dbce65 100644
--- a/web/packages/design/src/Icon/Icons/FolderPlus.tsx
+++ b/web/packages/design/src/Icon/Icons/FolderPlus.tsx
@@ -59,11 +59,11 @@ export const FolderPlus = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9 13.5C9 13.0858 9.33579 12.75 9.75 12.75H11.25V11.25C11.25 10.8358 11.5858 10.5 12 10.5C12.4142 10.5 12.75 10.8358 12.75 11.25V12.75H14.25C14.6642 12.75 15 13.0858 15 13.5C15 13.9142 14.6642 14.25 14.25 14.25H12.75V15.75C12.75 16.1642 12.4142 16.5 12 16.5C11.5858 16.5 11.25 16.1642 11.25 15.75V14.25H9.75C9.33579 14.25 9 13.9142 9 13.5Z" />
+      <path d="M9 13.5a.75.75 0 0 1 .75-.75h1.5v-1.5a.75.75 0 0 1 1.5 0v1.5h1.5a.75.75 0 0 1 0 1.5h-1.5v1.5a.75.75 0 0 1-1.5 0v-1.5h-1.5A.75.75 0 0 1 9 13.5" />
       <path
         fillRule="evenodd"
+        d="M2.69 4.94a1.5 1.5 0 0 1 1.06-.44h5c.324 0 .64.105.9.3l2.6 1.95h8a1.5 1.5 0 0 1 1.5 1.5v10.583a1.417 1.417 0 0 1-1.417 1.417H3.75a1.5 1.5 0 0 1-1.5-1.5V6c0-.398.158-.78.44-1.06M8.75 6h-5v12.75h16.5V8.25h-8a1.5 1.5 0 0 1-.9-.3z"
         clipRule="evenodd"
-        d="M2.68934 4.93934C2.97064 4.65804 3.35217 4.5 3.75 4.5H8.74969C9.07421 4.5 9.38999 4.60525 9.64962 4.79995L12.2502 6.74995L20.25 6.75C20.6478 6.75 21.0294 6.90804 21.3107 7.18934C21.592 7.47065 21.75 7.85218 21.75 8.25V18.8334C21.75 19.2091 21.6008 19.5694 21.3351 19.8351C21.0694 20.1008 20.7091 20.25 20.3334 20.25H3.75C3.35218 20.25 2.97065 20.092 2.68934 19.8107C2.40804 19.5294 2.25 19.1478 2.25 18.75V6C2.25 5.60217 2.40804 5.22064 2.68934 4.93934ZM8.74969 6L3.75 6L3.75 18.75H20.25V8.25H12.2503C11.9258 8.25 11.61 8.14475 11.3504 7.95005L8.74969 6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/FolderShared.tsx b/web/packages/design/src/Icon/Icons/FolderShared.tsx
index fa68d3bf9a6cc..846c2cba4e4d5 100644
--- a/web/packages/design/src/Icon/Icons/FolderShared.tsx
+++ b/web/packages/design/src/Icon/Icons/FolderShared.tsx
@@ -59,11 +59,11 @@ export const FolderShared = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.75 4.5C3.35217 4.5 2.97064 4.65804 2.68934 4.93934C2.40804 5.22064 2.25 5.60217 2.25 6V18.75C2.25 19.1478 2.40804 19.5294 2.68934 19.8107C2.97065 20.092 3.35218 20.25 3.75 20.25H11.25C11.6642 20.25 12 19.9142 12 19.5C12 19.0858 11.6642 18.75 11.25 18.75H3.75L3.75 6L8.74969 6L11.3503 7.95C11.6099 8.1447 11.9258 8.25 12.2503 8.25H20.25V11.25C20.25 11.6642 20.5858 12 21 12C21.4142 12 21.75 11.6642 21.75 11.25V8.25C21.75 7.85218 21.592 7.47065 21.3107 7.18934C21.0294 6.90804 20.6478 6.75 20.25 6.75H12.2503L9.64969 4.8C9.39006 4.6053 9.07421 4.5 8.74969 4.5H3.75Z" />
+      <path d="M3.75 4.5A1.5 1.5 0 0 0 2.25 6v12.75a1.5 1.5 0 0 0 1.5 1.5h7.5a.75.75 0 0 0 0-1.5h-7.5V6h5l2.6 1.95c.26.195.576.3.9.3h8v3a.75.75 0 0 0 1.5 0v-3a1.5 1.5 0 0 0-1.5-1.5h-8L9.65 4.8a1.5 1.5 0 0 0-.9-.3z" />
       <path
         fillRule="evenodd"
+        d="M15 16.5a3 3 0 1 1 5.122 2.121 3.76 3.76 0 0 1 1.603 2.186.75.75 0 1 1-1.45.386C20.02 20.233 19.11 19.5 18 19.5s-2.02.733-2.275 1.693a.75.75 0 1 1-1.45-.386 3.76 3.76 0 0 1 1.604-2.186A3 3 0 0 1 15 16.5m3-1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3"
         clipRule="evenodd"
-        d="M15 16.5C15 14.8431 16.3431 13.5 18 13.5C19.6569 13.5 21 14.8431 21 16.5C21 17.3283 20.6643 18.0783 20.1215 18.6212C20.8996 19.123 21.482 19.8946 21.7247 20.8072C21.8312 21.2075 21.593 21.6184 21.1927 21.7248C20.7924 21.8313 20.3816 21.5931 20.2751 21.1928C20.02 20.2334 19.1098 19.5 17.9999 19.5C16.8901 19.5 15.9799 20.2334 15.7247 21.1928C15.6183 21.5931 15.2075 21.8313 14.8072 21.7248C14.4069 21.6184 14.1687 21.2075 14.2751 20.8072C14.5179 19.8946 15.1003 19.123 15.8785 18.6211C15.3357 18.0782 15 17.3283 15 16.5ZM18 15C17.1716 15 16.5 15.6716 16.5 16.5C16.5 17.3284 17.1716 18 18 18C18.8284 18 19.5 17.3284 19.5 16.5C19.5 15.6716 18.8284 15 18 15Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Git.tsx b/web/packages/design/src/Icon/Icons/Git.tsx
new file mode 100644
index 0000000000000..88a9017a6288b
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/Git.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const Git = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-git"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M3 0a2.997 2.997 0 0 1 1.281 5.709L6.75 9l.136.17A3.75 3.75 0 0 0 9.75 10.5h2.348a2.998 2.998 0 0 1 5.902.75 3 3 0 0 1-5.902.75H9.75a5.25 5.25 0 0 1-4.2-2.1l-1.8-2.4v6.098A2.998 2.998 0 0 1 3 19.5a3 3 0 0 1-.75-5.902V5.9A2.998 2.998 0 0 1 3 0m0 15a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3m12-5.25a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3M3 1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/GitHub.tsx b/web/packages/design/src/Icon/Icons/GitHub.tsx
index e319923a82f22..c218b88e06610 100644
--- a/web/packages/design/src/Icon/Icons/GitHub.tsx
+++ b/web/packages/design/src/Icon/Icons/GitHub.tsx
@@ -61,8 +61,8 @@ export const GitHub = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M7.125 2.25a5.63 5.63 0 0 1 4.501 2.25h2.248a5.62 5.62 0 0 1 4.501-2.25.75.75 0 0 1 .65.374 5.62 5.62 0 0 1 .503 4.473 5.37 5.37 0 0 1 .722 2.647v.756a5.25 5.25 0 0 1-4.537 5.201A3.75 3.75 0 0 1 16.5 18v3.75a.75.75 0 0 1-1.5 0V18a2.25 2.25 0 0 0-4.5 0v3.75a.75.75 0 0 1-1.5 0v-1.5H6.75A3.75 3.75 0 0 1 3 16.5a2.25 2.25 0 0 0-2.25-2.25.75.75 0 0 1 0-1.5A3.75 3.75 0 0 1 4.5 16.5a2.25 2.25 0 0 0 2.25 2.25H9V18c0-.837.28-1.645.787-2.299A5.25 5.25 0 0 1 5.25 10.5v-.756a5.37 5.37 0 0 1 .722-2.647 5.62 5.62 0 0 1 .504-4.473.75.75 0 0 1 .649-.374m7.875 12h-4.5a3.75 3.75 0 0 1-3.75-3.75v-.747a3.87 3.87 0 0 1 .668-2.141.75.75 0 0 0 .08-.692 4.12 4.12 0 0 1 .074-3.146 4.13 4.13 0 0 1 3.03 1.88.75.75 0 0 0 .632.346h3.032a.75.75 0 0 0 .632-.346 4.13 4.13 0 0 1 3.03-1.88 4.12 4.12 0 0 1 .075 3.146.75.75 0 0 0 .079.692 3.87 3.87 0 0 1 .668 2.141v.747A3.75 3.75 0 0 1 15 14.25"
         clipRule="evenodd"
-        d="M7.12482 2.25C8.06954 2.24978 8.9991 2.4875 9.82773 2.94123C10.5329 3.32738 11.1457 3.85939 11.6261 4.5H13.8739C14.3543 3.85939 14.9671 3.32738 15.6723 2.94123C16.5009 2.4875 17.4305 2.24978 18.3752 2.25C18.6429 2.25006 18.8902 2.39278 19.0242 2.62449C19.4445 3.35119 19.6966 4.16285 19.762 4.9998C19.8173 5.70844 19.7376 6.41996 19.5282 7.09681C19.9929 7.89994 20.2427 8.81191 20.25 9.74414L20.25 9.75L20.25 10.5C20.25 11.8924 19.6969 13.2277 18.7123 14.2123C17.8973 15.0273 16.842 15.5467 15.7129 15.7014C16.2204 16.3555 16.5 17.1633 16.5 18V21.75C16.5 22.1642 16.1642 22.5 15.75 22.5C15.3358 22.5 15 22.1642 15 21.75V18C15 17.4033 14.7629 16.831 14.341 16.409C13.919 15.9871 13.3467 15.75 12.75 15.75C12.1533 15.75 11.581 15.9871 11.159 16.409C10.7371 16.831 10.5 17.4033 10.5 18V21.75C10.5 22.1642 10.1642 22.5 9.75 22.5C9.33579 22.5 9 22.1642 9 21.75V20.25H6.75C5.75544 20.25 4.80161 19.8549 4.09835 19.1516C3.39509 18.4484 3 17.4946 3 16.5C3 15.9033 2.76295 15.331 2.34099 14.909C1.91903 14.4871 1.34674 14.25 0.75 14.25C0.335786 14.25 0 13.9142 0 13.5C0 13.0858 0.335786 12.75 0.75 12.75C1.74456 12.75 2.69839 13.1451 3.40165 13.8484C4.10491 14.5516 4.5 15.5054 4.5 16.5C4.5 17.0967 4.73705 17.669 5.15901 18.091C5.58097 18.5129 6.15326 18.75 6.75 18.75H9V18C9 17.1633 9.27961 16.3555 9.78707 15.7014C8.658 15.5467 7.60267 15.0273 6.78769 14.2123C5.80312 13.2277 5.25 11.8924 5.25 10.5V9.74414C5.25728 8.81191 5.50709 7.89994 5.97176 7.09681C5.76243 6.41996 5.68268 5.70844 5.73801 4.9998C5.80336 4.16285 6.05546 3.35119 6.47578 2.62449C6.6098 2.39278 6.85715 2.25006 7.12482 2.25ZM15 14.25H10.5C9.50544 14.25 8.55161 13.8549 7.84835 13.1517C7.14509 12.4484 6.75 11.4946 6.75 10.5V9.75306C6.75652 8.98906 6.98903 8.24406 7.41827 7.61196C7.55651 7.4084 7.5861 7.14997 7.49745 6.92043C7.27577 6.34642 7.18556 5.73002 7.23346 5.11655C7.26972 4.65213 7.38443 4.19833 7.57171 3.77413C8.10886 3.8325 8.63084 3.996 9.10731 4.2569C9.71496 4.58964 10.229 5.07006 10.6021 5.65385C10.7399 5.8695 10.9781 6 11.2341 6H14.2659C14.5219 6 14.7601 5.8695 14.8979 5.65385C15.271 5.07006 15.785 4.58964 16.3927 4.2569C16.8692 3.996 17.3911 3.8325 17.9283 3.77413C18.1156 4.19833 18.2303 4.65213 18.2665 5.11655C18.3144 5.73002 18.2242 6.34642 18.0025 6.92043C17.9139 7.14997 17.9435 7.4084 18.0817 7.61196C18.511 8.24406 18.7435 8.98906 18.75 9.75306V10.5C18.75 11.4946 18.3549 12.4484 17.6517 13.1517C16.9484 13.8549 15.9946 14.25 15 14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Google.tsx b/web/packages/design/src/Icon/Icons/Google.tsx
index 0c6f4b7cee93b..30f76f7654092 100644
--- a/web/packages/design/src/Icon/Icons/Google.tsx
+++ b/web/packages/design/src/Icon/Icons/Google.tsx
@@ -61,8 +61,8 @@ export const Google = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M13.357 4.623a7.5 7.5 0 1 0 6.105 8.127H12a.75.75 0 0 1 0-1.5h8.25A.75.75 0 0 1 21 12a9 9 0 1 1-2.057-5.727.75.75 0 0 1-1.157.954 7.5 7.5 0 0 0-4.429-2.604"
         clipRule="evenodd"
-        d="M13.3573 4.62289C11.6205 4.30329 9.82663 4.60681 8.29163 5.47999C6.75664 6.35317 5.579 7.74001 4.96613 9.39622C4.35326 11.0524 4.34448 12.8718 4.94134 14.5339C5.53819 16.1959 6.7024 17.594 8.2289 18.482C9.75539 19.37 11.5463 19.6908 13.2861 19.3879C15.0259 19.0851 16.6031 18.1781 17.7398 16.8266C18.7146 15.6675 19.3119 14.2453 19.4623 12.7499H12C11.5858 12.7499 11.25 12.4141 11.25 11.9999C11.25 11.5857 11.5858 11.2499 12 11.2499H20.25C20.4489 11.2499 20.6397 11.3289 20.7804 11.4696C20.921 11.6103 21 11.8011 21 12C20.9998 14.1192 20.2518 16.1703 18.8877 17.7921C17.5237 19.4139 15.6311 20.5023 13.5433 20.8657C11.4555 21.2291 9.30647 20.8441 7.47467 19.7786C5.64288 18.713 4.24583 17.0353 3.52961 15.0408C2.81338 13.0464 2.82391 10.8631 3.55935 8.87566C4.29479 6.8882 5.70796 5.224 7.54996 4.17618C9.39195 3.12836 11.5446 2.76413 13.6288 3.14765C15.713 3.53117 17.595 4.63784 18.9433 6.27273C19.2068 6.59228 19.1614 7.06498 18.8419 7.32853C18.5223 7.59208 18.0496 7.54667 17.7861 7.22711C16.6625 5.86471 15.0941 4.94249 13.3573 4.62289Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Graph.tsx b/web/packages/design/src/Icon/Icons/Graph.tsx
index abdbf3e0b02c7..1ee3931db252f 100644
--- a/web/packages/design/src/Icon/Icons/Graph.tsx
+++ b/web/packages/design/src/Icon/Icons/Graph.tsx
@@ -59,7 +59,7 @@ export const Graph = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.75 4.5C3.75 4.08579 3.41421 3.75 3 3.75C2.58579 3.75 2.25 4.08579 2.25 4.5V19.5C2.25 19.9142 2.58579 20.25 3 20.25H21C21.4142 20.25 21.75 19.9142 21.75 19.5C21.75 19.0858 21.4142 18.75 21 18.75H3.75V15.3403L9.03637 10.7148L14.55 14.85C14.8335 15.0626 15.2272 15.0478 15.4939 14.8144L21.4939 9.56444C21.8056 9.29168 21.8372 8.81786 21.5644 8.50613C21.2917 8.1944 20.8179 8.16282 20.5061 8.43558L14.9637 13.2852L9.45001 9.15001C9.1665 8.93737 8.77284 8.95221 8.50613 9.18558L3.75 13.3472V4.5Z" />
+      <path d="M3.75 4.5a.75.75 0 0 0-1.5 0v15c0 .414.336.75.75.75h18a.75.75 0 0 0 0-1.5H3.75v-3.41l5.286-4.625 5.514 4.135a.75.75 0 0 0 .944-.036l6-5.25a.75.75 0 0 0-.988-1.128l-5.542 4.85L9.45 9.15a.75.75 0 0 0-.944.036L3.75 13.347z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/GridFour.tsx b/web/packages/design/src/Icon/Icons/GridFour.tsx
new file mode 100644
index 0000000000000..7ca7dad77e334
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/GridFour.tsx
@@ -0,0 +1,68 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const GridFour = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-gridfour"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M4.772 3.834a1.54 1.54 0 0 0-.93.909l-.083.222.011 7.088.01 7.087.108.229a1.7 1.7 0 0 0 .743.743l.229.108h14.28l.229-.108a1.7 1.7 0 0 0 .743-.743l.108-.229V4.86l-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108-7.08-.009c-6.731-.008-7.09-.005-7.288.063M11.24 8.24v3h-6v-6h6zm7.52 0v3h-6v-6h6zm-7.52 7.52v3h-6v-6h6zm7.52 0v3h-6v-6h6z"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/GridNine.tsx b/web/packages/design/src/Icon/Icons/GridNine.tsx
new file mode 100644
index 0000000000000..5ae72c127a82c
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/GridNine.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const GridNine = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-gridnine"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M2.25 6a1.5 1.5 0 0 1 1.5-1.5h16.5a1.5 1.5 0 0 1 1.5 1.5v12a1.5 1.5 0 0 1-1.5 1.5H3.75a1.5 1.5 0 0 1-1.5-1.5zm1.5 9v3h4.5v-3zm4.5-1.5h-4.5v-3h4.5zm1.5 1.5v3h4.5v-3zm4.5-1.5h-4.5v-3h4.5zm1.5 1.5v3h4.5v-3zm4.5-1.5h-4.5v-3h4.5zm0-7.5v3h-4.5V6zm-6 0v3h-4.5V6zm-6 0v3h-4.5V6z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Hashtag.tsx b/web/packages/design/src/Icon/Icons/Hashtag.tsx
index b27a05bdb76b4..8d396a69e1c4a 100644
--- a/web/packages/design/src/Icon/Icons/Hashtag.tsx
+++ b/web/packages/design/src/Icon/Icons/Hashtag.tsx
@@ -61,8 +61,8 @@ export const Hashtag = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M17.238 3.884a.75.75 0 1 0-1.476-.268l-.843 4.634h-4.475l.794-4.366a.75.75 0 1 0-1.476-.268L8.919 8.25H4.5a.75.75 0 0 0 0 1.5h4.147l-.818 4.5H3a.75.75 0 0 0 0 1.5h4.556l-.794 4.366a.75.75 0 0 0 1.476.268l.842-4.634h4.476l-.794 4.366a.75.75 0 1 0 1.476.268l.842-4.634h4.42a.75.75 0 0 0 0-1.5h-4.147l.818-4.5H21a.75.75 0 0 0 0-1.5h-4.556zm-3.41 10.366.819-4.5H10.17l-.818 4.5z"
         clipRule="evenodd"
-        d="M17.2378 3.88429C17.3119 3.47676 17.0416 3.08632 16.6341 3.01223C16.2265 2.93813 15.8361 3.20843 15.762 3.61597L14.9194 8.25H10.444L11.2378 3.88429C11.3119 3.47676 11.0416 3.08632 10.6341 3.01223C10.2265 2.93813 9.83608 3.20843 9.76198 3.61597L8.91943 8.25H4.5C4.08579 8.25 3.75 8.58579 3.75 9C3.75 9.41421 4.08579 9.75 4.5 9.75H8.6467L7.82852 14.25H3C2.58579 14.25 2.25 14.5858 2.25 15C2.25 15.4142 2.58579 15.75 3 15.75H7.5558L6.76198 20.116C6.68789 20.5235 6.95819 20.9139 7.36572 20.988C7.77325 21.0621 8.16369 20.7918 8.23779 20.3843L9.08039 15.75H13.5558L12.762 20.116C12.6879 20.5235 12.9582 20.9139 13.3657 20.988C13.7733 21.0621 14.1637 20.7918 14.2378 20.3843L15.0804 15.75H19.5C19.9142 15.75 20.25 15.4142 20.25 15C20.25 14.5858 19.9142 14.25 19.5 14.25H15.3531L16.1713 9.75H21C21.4142 9.75 21.75 9.41421 21.75 9C21.75 8.58579 21.4142 8.25 21 8.25H16.444L17.2378 3.88429ZM13.8285 14.25L14.6467 9.75H10.1713L9.35311 14.25H13.8285Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Headset.tsx b/web/packages/design/src/Icon/Icons/Headset.tsx
index 77bfc140bb755..3a39a9f137799 100644
--- a/web/packages/design/src/Icon/Icons/Headset.tsx
+++ b/web/packages/design/src/Icon/Icons/Headset.tsx
@@ -61,8 +61,8 @@ export const Headset = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 2.25A9.75 9.75 0 0 0 2.25 12v5.25A2.25 2.25 0 0 0 4.5 19.5H6a2.25 2.25 0 0 0 2.25-2.25V13.5A2.25 2.25 0 0 0 6 11.25H3.784a8.25 8.25 0 0 1 16.432 0H18a2.25 2.25 0 0 0-2.25 2.25v3.75A2.25 2.25 0 0 0 18 19.5h2.25A2.25 2.25 0 0 1 18 21.75h-5.25a.75.75 0 0 0 0 1.5H18a3.75 3.75 0 0 0 3.75-3.75V12A9.75 9.75 0 0 0 12 2.25m-8.25 15v-4.5H6a.75.75 0 0 1 .75.75v3.75A.75.75 0 0 1 6 18H4.5a.75.75 0 0 1-.75-.75M18 12.75h2.25V18H18a.75.75 0 0 1-.75-.75V13.5a.75.75 0 0 1 .75-.75"
         clipRule="evenodd"
-        d="M12 2.25C10.7196 2.25 9.45176 2.50219 8.26884 2.99217C7.08591 3.48216 6.01108 4.20034 5.10571 5.10571C4.20034 6.01108 3.48216 7.08591 2.99217 8.26884C2.50219 9.45176 2.25 10.7196 2.25 12V17.25C2.25 17.8467 2.48705 18.419 2.90901 18.841C3.33097 19.2629 3.90326 19.5 4.5 19.5H6C6.59674 19.5 7.16903 19.2629 7.59099 18.841C8.01295 18.419 8.25 17.8467 8.25 17.25V13.5C8.25 12.9033 8.01295 12.331 7.59099 11.909C7.16903 11.4871 6.59674 11.25 6 11.25H3.78416C3.85959 10.4237 4.05938 9.61207 4.37799 8.84286C4.79259 7.84193 5.40029 6.93245 6.16637 6.16637C6.93245 5.40029 7.84193 4.7926 8.84286 4.37799C9.8438 3.96339 10.9166 3.75 12 3.75C13.0834 3.75 14.1562 3.96339 15.1571 4.37799C16.1581 4.7926 17.0675 5.40029 17.8336 6.16637C18.5997 6.93245 19.2074 7.84193 19.622 8.84286C19.9406 9.61207 20.1404 10.4237 20.2158 11.25H18C17.4033 11.25 16.831 11.4871 16.409 11.909C15.9871 12.331 15.75 12.9033 15.75 13.5V17.25C15.75 17.8467 15.9871 18.419 16.409 18.841C16.831 19.2629 17.4033 19.5 18 19.5H20.25C20.25 20.0967 20.0129 20.669 19.591 21.091C19.169 21.5129 18.5967 21.75 18 21.75H12.75C12.3358 21.75 12 22.0858 12 22.5C12 22.9142 12.3358 23.25 12.75 23.25H18C18.9946 23.25 19.9484 22.8549 20.6516 22.1516C21.3549 21.4484 21.75 20.4946 21.75 19.5V12C21.75 10.7196 21.4978 9.45176 21.0078 8.26884C20.5178 7.08591 19.7997 6.01108 18.8943 5.10571C17.9889 4.20034 16.9141 3.48216 15.7312 2.99217C14.5482 2.50219 13.2804 2.25 12 2.25ZM3.75 17.25V12.75H6C6.19891 12.75 6.38968 12.829 6.53033 12.9697C6.67098 13.1103 6.75 13.3011 6.75 13.5V17.25C6.75 17.4489 6.67098 17.6397 6.53033 17.7803C6.38968 17.921 6.19891 18 6 18H4.5C4.30109 18 4.11032 17.921 3.96967 17.7803C3.82902 17.6397 3.75 17.4489 3.75 17.25ZM18 12.75H20.25V18H18C17.8011 18 17.6103 17.921 17.4697 17.7803C17.329 17.6397 17.25 17.4489 17.25 17.25V13.5C17.25 13.3011 17.329 13.1103 17.4697 12.9697C17.6103 12.829 17.8011 12.75 18 12.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Home.tsx b/web/packages/design/src/Icon/Icons/Home.tsx
index 56c30696ade72..2a7f90269a2a5 100644
--- a/web/packages/design/src/Icon/Icons/Home.tsx
+++ b/web/packages/design/src/Icon/Icons/Home.tsx
@@ -61,8 +61,8 @@ export const Home = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 2.25a1.5 1.5 0 0 0-1.01.39L3.486 9.729A1.5 1.5 0 0 0 3 10.832V19.5H1.5a.75.75 0 0 0 0 1.5h21a.75.75 0 0 0 0-1.5H21v-8.668a1.5 1.5 0 0 0-.484-1.104L13.02 2.65l-.01-.01A1.5 1.5 0 0 0 12 2.25m7.5 17.25v-8.668l-.01-.01L12 3.75l-7.49 7.073-.01.01V19.5H9V15a1.5 1.5 0 0 1 1.5-1.5h3A1.5 1.5 0 0 1 15 15v4.5zm-6 0V15h-3v4.5z"
         clipRule="evenodd"
-        d="M12.0005 2.25C11.627 2.25 11.267 2.38932 10.9908 2.64071L3.48503 9.72783C3.33323 9.86734 3.21179 10.0367 3.12833 10.2252C3.04373 10.4164 3.00002 10.6232 3 10.8322V19.5H1.5C1.08579 19.5 0.75 19.8358 0.75 20.25C0.75 20.6642 1.08579 21 1.5 21H4.46753C4.47834 21.0002 4.48917 21.0004 4.5 21.0004H9C9.01083 21.0004 9.02166 21.0002 9.03247 21H14.9675C14.9783 21.0002 14.9892 21.0004 15 21.0004H19.5009C19.5118 21.0004 19.5226 21.0002 19.5334 21H22.5C22.9142 21 23.25 20.6642 23.25 20.25C23.25 19.8358 22.9142 19.5 22.5 19.5H21.0009V10.8322C21.0009 10.6231 20.9572 10.4164 20.8726 10.2252C20.7891 10.0367 20.6677 9.86733 20.5159 9.72782L13.0203 2.64995L13.0102 2.64071C12.734 2.38932 12.3739 2.25 12.0005 2.25ZM19.5009 19.5V10.8323L19.4904 10.8225L12.0005 3.75017L4.51054 10.8225L4.5 10.8323V19.5H9V15.0004C9 14.6025 9.15804 14.221 9.43934 13.9397C9.72065 13.6584 10.1022 13.5004 10.5 13.5004H13.5C13.8978 13.5004 14.2794 13.6584 14.5607 13.9397C14.842 14.221 15 14.6025 15 15.0004V19.5H19.5009ZM13.5 19.5V15.0004L10.5 15.0004L10.5 19.5H13.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Info.tsx b/web/packages/design/src/Icon/Icons/Info.tsx
index 94502c5afef96..04b34132fe8b7 100644
--- a/web/packages/design/src/Icon/Icons/Info.tsx
+++ b/web/packages/design/src/Icon/Icons/Info.tsx
@@ -59,12 +59,11 @@ export const Info = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.625 8.8125C12.1428 8.8125 12.5625 8.39277 12.5625 7.875C12.5625 7.35723 12.1428 6.9375 11.625 6.9375C11.1072 6.9375 10.6875 7.35723 10.6875 7.875C10.6875 8.39277 11.1072 8.8125 11.625 8.8125Z" />
-      <path d="M10.5 11.25C10.5 10.8358 10.8358 10.5 11.25 10.5C11.6478 10.5 12.0294 10.658 12.3107 10.9393C12.592 11.2206 12.75 11.6022 12.75 12V15.75C13.1642 15.75 13.5 16.0858 13.5 16.5C13.5 16.9142 13.1642 17.25 12.75 17.25C12.3522 17.25 11.9706 17.092 11.6893 16.8107C11.408 16.5294 11.25 16.1478 11.25 15.75V12C10.8358 12 10.5 11.6642 10.5 11.25Z" />
+      <path d="M11.625 8.813a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.875M10.5 11.25a.75.75 0 0 1 .75-.75 1.5 1.5 0 0 1 1.5 1.5v3.75a.75.75 0 0 1 0 1.5 1.5 1.5 0 0 1-1.5-1.5V12a.75.75 0 0 1-.75-.75" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Integrations.tsx b/web/packages/design/src/Icon/Icons/Integrations.tsx
index 97b6e93061d28..d6f021699a019 100644
--- a/web/packages/design/src/Icon/Icons/Integrations.tsx
+++ b/web/packages/design/src/Icon/Icons/Integrations.tsx
@@ -61,13 +61,8 @@ export const Integrations = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M23.749.251a.857.857 0 0 1 0 1.212l-3.04 3.04.576.576a3.43 3.43 0 0 1 0 4.849l-2.501 2.5.68.68a.857.857 0 0 1-1.213 1.212l-1.27-1.27-.016-.015-.014-.015-5.97-5.97-.03-.03L9.68 5.749a.857.857 0 0 1 1.212-1.212l.68.68 2.501-2.502a3.43 3.43 0 0 1 4.845 0l.578.577 3.04-3.04a.857.857 0 0 1 1.213 0m-4.913 4.806-1.13-1.129a1.715 1.715 0 0 0-2.421 0l-2.501 2.5 4.788 4.789 2.5-2.501a1.715 1.715 0 0 0 0-2.424l-1.128-1.128a1 1 0 0 1-.108-.107M4.537 9.68a.857.857 0 0 1 1.212 0l1.965 1.965L9.68 9.68a.857.857 0 1 1 1.212 1.212l-1.965 1.965 2.216 2.217 1.965-1.966a.857.857 0 0 1 1.212 1.212l-1.965 1.966 1.965 1.965a.857.857 0 1 1-1.212 1.212l-.68-.68-2.5 2.502a3.43 3.43 0 0 1-4.85 0l-.575-.576-3.04 3.04a.857.857 0 1 1-1.212-1.212l3.041-3.041-.577-.578a3.43 3.43 0 0 1 0-4.845l2.501-2.501-.68-.68a.857.857 0 0 1 0-1.212m6.68 7.892-2.502 2.5a1.714 1.714 0 0 1-2.424 0l-1.124-1.124a1 1 0 0 0-.114-.114l-1.125-1.128a1.714 1.714 0 0 1 0-2.422l2.5-2.5z"
         clipRule="evenodd"
-        d="M23.7489 0.251054C24.0837 0.585793 24.0837 1.12851 23.7489 1.46325L20.7085 4.50371L21.2845 5.07893C21.9274 5.72191 22.2891 6.59439 22.2891 7.50367C22.2891 8.41295 21.9279 9.285 21.2849 9.92798L18.784 12.4289L19.4635 13.1083C19.7982 13.4431 19.7982 13.9858 19.4635 14.3205C19.1287 14.6553 18.586 14.6553 18.2513 14.3205L16.9808 13.0501C16.9757 13.0452 16.9706 13.0402 16.9655 13.0352C16.9605 13.0301 16.9555 13.025 16.9506 13.0199L10.9808 7.05008C10.9756 7.04517 10.9705 7.04018 10.9655 7.03511C10.9604 7.03005 10.9554 7.02493 10.9505 7.01977L9.67973 5.74901C9.34499 5.41427 9.34499 4.87156 9.67973 4.53682C10.0145 4.20208 10.5572 4.20208 10.8919 4.53682L11.5717 5.21663L14.0732 2.71518C14.716 2.07355 15.5871 1.71319 16.4954 1.71319C17.4036 1.71319 18.2747 2.07355 18.9175 2.71518L19.4955 3.29233L22.5367 0.251054C22.8715 -0.0836847 23.4142 -0.0836848 23.7489 0.251054ZM18.8363 5.05681L17.7064 3.92849C17.3851 3.60777 16.9494 3.42749 16.4954 3.42749C16.0414 3.42749 15.6059 3.60758 15.2845 3.92823L12.7839 6.42883L17.5718 11.2167L20.0727 8.71583C20.3941 8.39434 20.5748 7.9583 20.5748 7.50367C20.5748 7.04903 20.3942 6.613 20.0727 6.29151L18.9441 5.16446C18.9246 5.14816 18.9057 5.13087 18.8874 5.11258C18.8694 5.09457 18.8524 5.07596 18.8363 5.05681Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M4.53682 9.67973C4.87156 9.34499 5.41427 9.34499 5.74901 9.67973L7.71437 11.6451L9.67973 9.67973C10.0145 9.34499 10.5572 9.34499 10.8919 9.67973C11.2267 10.0145 11.2267 10.5572 10.8919 10.8919L8.92657 12.8573L11.143 15.0737L13.1083 13.1083C13.4431 12.7736 13.9858 12.7736 14.3205 13.1083C14.6553 13.4431 14.6553 13.9858 14.3205 14.3205L12.3552 16.2859L14.3205 18.2513C14.6553 18.586 14.6553 19.1287 14.3205 19.4635C13.9858 19.7982 13.4431 19.7982 13.1083 19.4635L12.4286 18.7837L9.92744 21.2849C9.28446 21.9278 8.4124 22.2891 7.50311 22.2891C6.59383 22.2891 5.72178 21.9279 5.0788 21.2849L4.50343 20.7088L1.46325 23.7489C1.12851 24.0837 0.585793 24.0837 0.251054 23.7489C-0.0836848 23.4142 -0.0836847 22.8715 0.251054 22.5367L3.29205 19.4957L2.71477 18.9177C2.07314 18.2749 1.71263 17.4036 1.71263 16.4954C1.71263 15.5871 2.073 14.716 2.71463 14.0732L5.21635 11.5715L4.53682 10.8919C4.20208 10.5572 4.20208 10.0145 4.53682 9.67973ZM11.2164 17.5715L8.71525 20.0727C8.39376 20.3942 7.95775 20.5748 7.50311 20.5748C7.04847 20.5748 6.61245 20.3942 6.29096 20.0727L5.16725 18.9475C5.15015 18.9268 5.13192 18.9068 5.11258 18.8874C5.09352 18.8684 5.07378 18.8504 5.05345 18.8335L3.9278 17.7063C3.60707 17.3849 3.42694 16.9494 3.42694 16.4954C3.42694 16.0414 3.60728 15.6057 3.92793 15.2843L6.42855 12.7837L11.2164 17.5715Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Invoices.tsx b/web/packages/design/src/Icon/Icons/Invoices.tsx
index 155dde536a928..5198386afd0a6 100644
--- a/web/packages/design/src/Icon/Icons/Invoices.tsx
+++ b/web/packages/design/src/Icon/Icons/Invoices.tsx
@@ -59,12 +59,11 @@ export const Invoices = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M6.75 9.75C6.75 9.33579 7.08579 9 7.5 9H16.5C16.9142 9 17.25 9.33579 17.25 9.75C17.25 10.1642 16.9142 10.5 16.5 10.5H7.5C7.08579 10.5 6.75 10.1642 6.75 9.75Z" />
-      <path d="M6.75 12.75C6.75 12.3358 7.08579 12 7.5 12H16.5C16.9142 12 17.25 12.3358 17.25 12.75C17.25 13.1642 16.9142 13.5 16.5 13.5H7.5C7.08579 13.5 6.75 13.1642 6.75 12.75Z" />
+      <path d="M6.75 9.75A.75.75 0 0 1 7.5 9h9a.75.75 0 0 1 0 1.5h-9a.75.75 0 0 1-.75-.75m0 3A.75.75 0 0 1 7.5 12h9a.75.75 0 0 1 0 1.5h-9a.75.75 0 0 1-.75-.75" />
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 0-1.5 1.5V19.5a.75.75 0 0 0 1.085.67L6 18.839l2.665 1.333a.75.75 0 0 0 .67 0L12 18.839l2.665 1.332a.75.75 0 0 0 .67 0L18 18.839l2.665 1.332a.75.75 0 0 0 1.085-.671V5.25a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h16.5v13.037l-1.915-.958a.75.75 0 0 0-.67 0L15 18.661l-2.665-1.332a.75.75 0 0 0-.67 0L9 18.661 6.335 17.33a.75.75 0 0 0-.67 0l-1.915.957z"
         clipRule="evenodd"
-        d="M3.75 3.75C3.35217 3.75 2.97064 3.90804 2.68934 4.18934C2.40804 4.47064 2.25 4.85217 2.25 5.25V19.5C2.25 19.7599 2.38459 20.0013 2.6057 20.138C2.82681 20.2746 3.10292 20.2871 3.33541 20.1708L6 18.8385L8.66459 20.1708C8.87574 20.2764 9.12426 20.2764 9.33541 20.1708L12 18.8385L14.6646 20.1708C14.8757 20.2764 15.1243 20.2764 15.3354 20.1708L18 18.8385L20.6646 20.1708C20.8971 20.2871 21.1732 20.2746 21.3943 20.138C21.6154 20.0013 21.75 19.7599 21.75 19.5V5.25C21.75 4.85218 21.592 4.47065 21.3107 4.18934C21.0294 3.90804 20.6478 3.75 20.25 3.75H3.75ZM3.75 5.25L20.25 5.25V18.2865L18.3354 17.3292C18.1243 17.2236 17.8757 17.2236 17.6646 17.3292L15 18.6615L12.3354 17.3292C12.1243 17.2236 11.8757 17.2236 11.6646 17.3292L9 18.6615L6.33541 17.3292C6.12426 17.2236 5.87574 17.2236 5.66459 17.3292L3.75 18.2865L3.75 5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Key.tsx b/web/packages/design/src/Icon/Icons/Key.tsx
index 06594fdb5cd41..baf3e2dd809c9 100644
--- a/web/packages/design/src/Icon/Icons/Key.tsx
+++ b/web/packages/design/src/Icon/Icons/Key.tsx
@@ -59,11 +59,11 @@ export const Key = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M17.8125 7.125C17.8125 7.64277 17.3928 8.0625 16.875 8.0625C16.3572 8.0625 15.9375 7.64277 15.9375 7.125C15.9375 6.60723 16.3572 6.1875 16.875 6.1875C17.3928 6.1875 17.8125 6.60723 17.8125 7.125Z" />
+      <path d="M17.813 7.125a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M15.755 1.54a7.5 7.5 0 0 0-7.888 9.782L2.47 16.72a.75.75 0 0 0-.22.53V21c0 .414.336.75.75.75h3.75A.75.75 0 0 0 7.5 21v-1.5H9a.75.75 0 0 0 .75-.75v-1.5h1.5a.75.75 0 0 0 .53-.22l.898-.897a7.5 7.5 0 1 0 3.077-14.594m-4.062 2.454a6 6 0 1 1 1.071 10.575.75.75 0 0 0-.81.166L10.94 15.75H9a.75.75 0 0 0-.75.75V18h-1.5a.75.75 0 0 0-.75.75v1.5H3.75v-2.69l5.515-5.514a.75.75 0 0 0 .166-.81 6 6 0 0 1 2.262-7.242"
         clipRule="evenodd"
-        d="M15.7546 1.53916C14.0354 1.36504 12.3087 1.78997 10.8666 2.74211C9.42448 3.69425 8.35541 5.11517 7.84013 6.76463C7.37496 8.2537 7.38688 9.84653 7.86716 11.3221L2.46967 16.7196C2.32902 16.8603 2.25 17.051 2.25 17.2499V20.9999C2.25 21.4142 2.58579 21.7499 3 21.7499H6.75C7.16421 21.7499 7.5 21.4142 7.5 20.9999V19.4999H9C9.41421 19.4999 9.75 19.1642 9.75 18.7499V17.2499H11.25C11.4489 17.2499 11.6397 17.1709 11.7803 17.0303L12.6778 16.1328C14.1534 16.6131 15.7462 16.625 17.2353 16.1598C18.8848 15.6445 20.3057 14.5755 21.2578 13.1334C22.21 11.6913 22.6349 9.96459 22.4608 8.24531C22.2867 6.52603 21.5242 4.91962 20.3023 3.69769C19.0803 2.47576 17.4739 1.71327 15.7546 1.53916ZM11.6931 3.99389C12.8467 3.23218 14.2281 2.89223 15.6035 3.03152C16.9789 3.17082 18.264 3.7808 19.2416 4.75835C20.2191 5.73589 20.8291 7.02102 20.9684 8.39645C21.1077 9.77187 20.7678 11.1532 20.0061 12.3069C19.2443 13.4606 18.1076 14.3158 16.788 14.728C15.4685 15.1403 14.047 15.0842 12.7641 14.5692C12.4853 14.4574 12.1667 14.5225 11.9544 14.7349L10.9393 15.7499H9C8.58579 15.7499 8.25 16.0857 8.25 16.4999V17.9999H6.75C6.33579 17.9999 6 18.3357 6 18.7499V20.2499H3.75V17.5606L9.26502 12.0456C9.47739 11.8332 9.54259 11.5146 9.43072 11.2359C8.91577 9.95291 8.85967 8.53148 9.27189 7.21191C9.68412 5.89234 10.5394 4.7556 11.6931 3.99389Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/KeyHole.tsx b/web/packages/design/src/Icon/Icons/KeyHole.tsx
index ad645ee5bd63e..6ac2d8434ca8e 100644
--- a/web/packages/design/src/Icon/Icons/KeyHole.tsx
+++ b/web/packages/design/src/Icon/Icons/KeyHole.tsx
@@ -61,13 +61,13 @@ export const KeyHole = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.003 6.75a3.78 3.78 0 0 0-3.568 2.596 3.78 3.78 0 0 0 .916 3.804l-1.02 2.559a1.13 1.13 0 0 0 1.043 1.54h5.252a1.13 1.13 0 0 0 1.043-1.54l-1.015-2.558a3.78 3.78 0 0 0 .917-3.805 3.78 3.78 0 0 0-3.568-2.596M9.862 9.808a2.28 2.28 0 0 1 2.14-1.558c.962 0 1.846.643 2.141 1.558a2.28 2.28 0 0 1-.823 2.516.75.75 0 0 0-.258.885l1.01 2.54H9.929l1.013-2.54a.75.75 0 0 0-.257-.885 2.28 2.28 0 0 1-.823-2.516"
         clipRule="evenodd"
-        d="M12.0027 6.75C10.3909 6.75 8.93073 7.81239 8.4347 9.34594C8.00085 10.6873 8.37601 12.1685 9.35113 13.1503L8.33031 15.7086C8.03822 16.442 8.58432 17.2487 9.37375 17.2499H14.626C15.4154 17.2487 15.9614 16.442 15.6695 15.7086L14.6536 13.1509C15.6292 12.1691 16.0047 10.6876 15.5707 9.34594C15.0747 7.81239 13.6145 6.75 12.0027 6.75ZM9.86191 9.80757C10.1577 8.89301 11.0415 8.25 12.0027 8.25C12.9639 8.25 13.8477 8.89301 14.1435 9.80757C14.4393 10.7221 14.0995 11.7609 13.3204 12.3238C13.042 12.5249 12.9358 12.8894 13.0625 13.2086L14.0719 15.7499H9.92885L10.9424 13.2097C11.0699 12.8903 10.9638 12.5252 10.6851 12.3238C9.90592 11.7609 9.5661 10.7221 9.86191 9.80757Z"
       />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Keyboard.tsx b/web/packages/design/src/Icon/Icons/Keyboard.tsx
index a82b738caf021..f48c4e57b28ba 100644
--- a/web/packages/design/src/Icon/Icons/Keyboard.tsx
+++ b/web/packages/design/src/Icon/Icons/Keyboard.tsx
@@ -59,15 +59,11 @@ export const Keyboard = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M5.25 11.25C4.83579 11.25 4.5 11.5858 4.5 12C4.5 12.4142 4.83579 12.75 5.25 12.75H18.75C19.1642 12.75 19.5 12.4142 19.5 12C19.5 11.5858 19.1642 11.25 18.75 11.25H5.25Z" />
-      <path d="M4.5 9C4.5 8.58579 4.83579 8.25 5.25 8.25H18.75C19.1642 8.25 19.5 8.58579 19.5 9C19.5 9.41421 19.1642 9.75 18.75 9.75H5.25C4.83579 9.75 4.5 9.41421 4.5 9Z" />
-      <path d="M5.25 14.25C4.83579 14.25 4.5 14.5858 4.5 15C4.5 15.4142 4.83579 15.75 5.25 15.75H6C6.41421 15.75 6.75 15.4142 6.75 15C6.75 14.5858 6.41421 14.25 6 14.25H5.25Z" />
-      <path d="M8.25 15C8.25 14.5858 8.58579 14.25 9 14.25H15C15.4142 14.25 15.75 14.5858 15.75 15C15.75 15.4142 15.4142 15.75 15 15.75H9C8.58579 15.75 8.25 15.4142 8.25 15Z" />
-      <path d="M18 14.25C17.5858 14.25 17.25 14.5858 17.25 15C17.25 15.4142 17.5858 15.75 18 15.75H18.75C19.1642 15.75 19.5 15.4142 19.5 15C19.5 14.5858 19.1642 14.25 18.75 14.25H18Z" />
+      <path d="M5.25 11.25a.75.75 0 0 0 0 1.5h13.5a.75.75 0 0 0 0-1.5zM4.5 9a.75.75 0 0 1 .75-.75h13.5a.75.75 0 0 1 0 1.5H5.25A.75.75 0 0 1 4.5 9m.75 5.25a.75.75 0 0 0 0 1.5H6a.75.75 0 0 0 0-1.5zm3 .75a.75.75 0 0 1 .75-.75h6a.75.75 0 0 1 0 1.5H9a.75.75 0 0 1-.75-.75m9.75-.75a.75.75 0 0 0 0 1.5h.75a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M3.046 4.5c-.854 0-1.546.692-1.546 1.546v11.908c0 .854.692 1.546 1.546 1.546h17.908c.854 0 1.546-.692 1.546-1.546V6.046c0-.854-.692-1.546-1.546-1.546zM3 6.046C3 6.02 3.02 6 3.046 6h17.908c.025 0 .046.02.046.046v11.908c0 .025-.02.046-.046.046H3.046A.046.046 0 0 1 3 17.954z"
         clipRule="evenodd"
-        d="M3.04594 4.5C2.19214 4.5 1.5 5.19214 1.5 6.04594V17.9541C1.5 18.8079 2.19214 19.5 3.04594 19.5H20.9541C21.8079 19.5 22.5 18.8079 22.5 17.9541V6.04594C22.5 5.19214 21.8079 4.5 20.9541 4.5H3.04594ZM3 6.04594C3 6.02057 3.02057 6 3.04594 6H20.9541C20.9794 6 21 6.02057 21 6.04594V17.9541C21 17.9794 20.9794 18 20.9541 18H3.04594C3.02057 18 3 17.9794 3 17.9541V6.04594Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Keypair.tsx b/web/packages/design/src/Icon/Icons/Keypair.tsx
index d332e546d9c54..690a2d650e990 100644
--- a/web/packages/design/src/Icon/Icons/Keypair.tsx
+++ b/web/packages/design/src/Icon/Icons/Keypair.tsx
@@ -59,17 +59,17 @@ export const Keypair = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.5 6C15.6716 6 15 6.67157 15 7.5C15 8.32843 15.6716 9 16.5 9C17.3284 9 18 8.32843 18 7.5C18 6.67157 17.3284 6 16.5 6Z" />
+      <path d="M16.5 6a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3" />
       <path
         fillRule="evenodd"
+        d="M9.5 4v1.25h3.102a4.5 4.5 0 1 1 0 4.5H3.5A1.5 1.5 0 0 1 2 8.25v-1.5a1.5 1.5 0 0 1 1.5-1.5H5V4a1.5 1.5 0 0 1 1.5-1.5H8A1.5 1.5 0 0 1 9.5 4m4.4 4.999-.433-.749H3.5v-1.5h3V4H8v2.75h5.467l.433-.749A3 3 0 1 1 13.9 9"
         clipRule="evenodd"
-        d="M9.5 4V5.25H12.602C13.3801 3.90495 14.8344 3 16.5 3C18.9853 3 21 5.01472 21 7.5C21 9.98528 18.9853 12 16.5 12C14.8344 12 13.3801 11.0951 12.602 9.75H3.5C2.67157 9.75 2 9.07843 2 8.25V6.75C2 5.92157 2.67157 5.25 3.5 5.25H5V4C5 3.17157 5.67157 2.5 6.5 2.5H8C8.82843 2.5 9.5 3.17157 9.5 4ZM13.9004 8.99891L13.4672 8.25H3.5V6.75H6.5V4H8V6.75H13.4672L13.9004 6.00109C14.4214 5.10047 15.3915 4.5 16.5 4.5C18.1569 4.5 19.5 5.84315 19.5 7.5C19.5 9.15685 18.1569 10.5 16.5 10.5C15.3915 10.5 14.4214 9.89953 13.9004 8.99891Z"
       />
-      <path d="M8 16.5C8 17.3284 7.32843 18 6.5 18C5.67157 18 5 17.3284 5 16.5C5 15.6716 5.67157 15 6.5 15C7.32843 15 8 15.6716 8 16.5Z" />
+      <path d="M8 16.5a1.5 1.5 0 1 1-3 0 1.5 1.5 0 0 1 3 0" />
       <path
         fillRule="evenodd"
+        d="M13.5 20v-1.25h-3.102a4.5 4.5 0 1 1 0-4.5H19.5a1.5 1.5 0 0 1 1.5 1.5v1.5a1.5 1.5 0 0 1-1.5 1.5H18V20a1.5 1.5 0 0 1-1.5 1.5H15a1.5 1.5 0 0 1-1.5-1.5m-4.4-4.999.433.749H19.5v1.5h-3V20H15v-2.75H9.533l-.433.749A3 3 0 1 1 9.1 15"
         clipRule="evenodd"
-        d="M13.5 20V18.75H10.398C9.61991 20.0951 8.16564 21 6.5 21C4.01472 21 2 18.9853 2 16.5C2 14.0147 4.01472 12 6.5 12C8.16564 12 9.61991 12.9049 10.398 14.25H19.5C20.3284 14.25 21 14.9216 21 15.75V17.25C21 18.0784 20.3284 18.75 19.5 18.75H18V20C18 20.8284 17.3284 21.5 16.5 21.5H15C14.1716 21.5 13.5 20.8284 13.5 20ZM9.09957 15.0011L9.53279 15.75H19.5V17.25H16.5V20H15V17.25H9.53279L9.09957 17.9989C8.57859 18.8995 7.60853 19.5 6.5 19.5C4.84315 19.5 3.5 18.1569 3.5 16.5C3.5 14.8431 4.84315 13.5 6.5 13.5C7.60853 13.5 8.57859 14.1005 9.09957 15.0011Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Kubernetes.tsx b/web/packages/design/src/Icon/Icons/Kubernetes.tsx
index e9fea277e12cd..f6c44b2aa8d20 100644
--- a/web/packages/design/src/Icon/Icons/Kubernetes.tsx
+++ b/web/packages/design/src/Icon/Icons/Kubernetes.tsx
@@ -61,8 +61,8 @@ export const Kubernetes = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.75 2.75a.75.75 0 0 0-1.5 0v1.285A7.98 7.98 0 0 0 6.086 6.61l-1.053-.796a.75.75 0 1 0-.904 1.197l1.054.797A7.96 7.96 0 0 0 4 12q0 .756.135 1.473l-1.59.452a.75.75 0 0 0 .41 1.443l1.593-.453a8.03 8.03 0 0 0 3.529 4.059l-.879 1.97a.75.75 0 0 0 1.37.61l.879-1.97A8 8 0 0 0 12 20a8 8 0 0 0 2.552-.416l.879 1.97a.75.75 0 1 0 1.37-.61l-.878-1.97a8.03 8.03 0 0 0 3.53-4.058l1.59.452a.75.75 0 0 0 .41-1.443l-1.588-.452q.134-.717.135-1.473a7.96 7.96 0 0 0-1.185-4.192l1.054-.796a.75.75 0 1 0-.904-1.197l-1.053.796a7.98 7.98 0 0 0-5.162-2.576zM7.29 7.52a6.48 6.48 0 0 1 3.96-1.977V9.36l-.93.448zm2.159 3.51-3.06-2.312A6.47 6.47 0 0 0 5.5 12q.001.543.086 1.06l3.635-1.032zm.251 2.421L6 14.503a6.53 6.53 0 0 0 2.69 3.093l1.548-3.47zm1.923 1.252-1.562 3.503A6.5 6.5 0 0 0 12 18.5c.675 0 1.326-.103 1.938-.294l-1.562-3.503zm2.138-.576 1.547 3.47a6.53 6.53 0 0 0 2.693-3.094L14.3 13.451zm1.018-2.099 3.635 1.033q.085-.518.086-1.061a6.47 6.47 0 0 0-.888-3.282L14.55 11.03zm-1.1-2.22 3.03-2.288a6.48 6.48 0 0 0-3.96-1.977V9.36zm-2.723 1.36L12 10.665l1.044.503.258 1.13-.723.905h-1.158l-.723-.906z"
         clipRule="evenodd"
-        d="M12.7495 2.75C12.7495 2.33579 12.4137 2 11.9995 2C11.5853 2 11.2495 2.33579 11.2495 2.75V4.03474C9.20979 4.22451 7.39229 5.18004 6.08729 6.61106L5.03424 5.81548C4.70375 5.56578 4.23341 5.63129 3.98372 5.96178C3.73403 6.29228 3.79954 6.76261 4.13003 7.0123L5.18439 7.80888C4.4333 9.02771 4 10.4633 4 12C4 12.5033 4.04647 12.9957 4.13536 13.4732L2.54515 13.9251C2.14672 14.0384 1.91552 14.4532 2.02876 14.8516C2.142 15.25 2.5568 15.4812 2.95523 15.368L4.54782 14.9154C5.22303 16.64 6.47965 18.0731 8.07658 18.9735L7.19821 20.9432C7.02951 21.3215 7.19943 21.765 7.57773 21.9337C7.95604 22.1024 8.39947 21.9324 8.56817 21.5541L9.44675 19.5839C10.2486 19.8538 11.1072 20 12 20C12.8925 20 13.7508 19.8539 14.5524 19.5842L15.4309 21.5541C15.5996 21.9324 16.043 22.1024 16.4213 21.9337C16.7996 21.765 16.9695 21.3215 16.8009 20.9432L15.9227 18.9739C17.5199 18.0736 18.7767 16.6404 19.4521 14.9156L21.0438 15.368C21.4423 15.4812 21.8571 15.25 21.9703 14.8516C22.0835 14.4532 21.8523 14.0384 21.4539 13.9251L19.8646 13.4734C19.9535 12.9959 20 12.5034 20 12C20 10.4631 19.5666 9.02733 18.8153 7.8084L19.869 7.0123C20.1995 6.76261 20.265 6.29228 20.0153 5.96178C19.7656 5.63129 19.2953 5.56578 18.9648 5.81548L17.9123 6.61064C16.6072 5.17963 14.7894 4.22419 12.7495 4.03465V2.75ZM7.29042 7.52004C8.31235 6.44607 9.69781 5.72125 11.2495 5.54286V9.3614L10.3201 9.80899L7.29042 7.52004ZM9.4488 11.0307L6.38806 8.71827C5.82359 9.68147 5.5 10.8029 5.5 12C5.5 12.3613 5.52947 12.7156 5.58614 13.0609L9.22124 12.0277L9.4488 11.0307ZM9.7 13.451L5.99934 14.5028C6.54133 15.8008 7.49217 16.8854 8.69092 17.5958L10.2382 14.126L9.7 13.451ZM11.6233 14.7029L10.0612 18.2059C10.6735 18.397 11.3247 18.5 12 18.5C12.675 18.5 13.3259 18.3971 13.9379 18.2062L12.3757 14.7029H11.6233ZM13.7611 14.1267L15.3083 17.5963C16.5074 16.8859 17.4584 15.8012 18.0006 14.5031L14.2998 13.4513L13.7611 14.1267ZM14.7788 12.028L18.4138 13.0611C18.4705 12.7158 18.5 12.3613 18.5 12C18.5 10.8027 18.1763 9.68108 17.6116 8.71777L14.551 11.0301L14.7788 12.028ZM13.6793 9.80872L16.7092 7.51962C15.6871 6.44567 14.3014 5.72093 12.7495 5.54275V9.36096L13.6793 9.80872ZM10.9561 11.1676L12 10.6649L13.0438 11.1676L13.3016 12.2971L12.5793 13.2029H11.4207L10.6983 12.2971L10.9561 11.1676Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Label.tsx b/web/packages/design/src/Icon/Icons/Label.tsx
index bf9b18ecab4a3..d0d17d8c17a40 100644
--- a/web/packages/design/src/Icon/Icons/Label.tsx
+++ b/web/packages/design/src/Icon/Icons/Label.tsx
@@ -61,8 +61,8 @@ export const Label = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M2.69 4.94a1.5 1.5 0 0 1 1.06-.44h13.849a1.5 1.5 0 0 1 1.247.668l4.278 6.416a.75.75 0 0 1 0 .832l-4.278 6.416a1.5 1.5 0 0 1-1.247.668H3.75a1.5 1.5 0 0 1-1.5-1.5V6c0-.398.158-.78.44-1.06M17.597 6H3.75v12h13.848l4-6z"
         clipRule="evenodd"
-        d="M2.68934 4.93934C2.97064 4.65804 3.35217 4.5 3.75 4.5H17.5988C17.8454 4.50015 18.0888 4.56114 18.3062 4.67757C18.5237 4.79401 18.7092 4.96229 18.8461 5.1675L23.124 11.584C23.292 11.8359 23.292 12.1641 23.124 12.416L18.8462 18.8323C18.7093 19.0375 18.5237 19.206 18.3062 19.3224C18.0887 19.4389 17.8459 19.4999 17.5992 19.5H3.75C3.35218 19.5 2.97065 19.342 2.68934 19.0607C2.40804 18.7794 2.25 18.3978 2.25 18V6C2.25 5.60217 2.40804 5.22064 2.68934 4.93934ZM17.5983 6L3.75 6L3.75 18H17.5983L21.5986 12L17.5983 6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Lan.tsx b/web/packages/design/src/Icon/Icons/Lan.tsx
index 04f2dc8465353..956d73afe18cc 100644
--- a/web/packages/design/src/Icon/Icons/Lan.tsx
+++ b/web/packages/design/src/Icon/Icons/Lan.tsx
@@ -61,8 +61,8 @@ export const Lan = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M8 3.5A1.5 1.5 0 0 1 9.5 2h5A1.5 1.5 0 0 1 16 3.5v4A1.5 1.5 0 0 1 14.5 9h-1.75v2.25h3.75a2.25 2.25 0 0 1 2.25 2.25V15h1.75a1.5 1.5 0 0 1 1.5 1.5v4a1.5 1.5 0 0 1-1.5 1.5h-5a1.5 1.5 0 0 1-1.5-1.5v-4a1.5 1.5 0 0 1 1.5-1.5h1.75v-1.5a.75.75 0 0 0-.75-.75h-9a.75.75 0 0 0-.75.75V15H8.5a1.5 1.5 0 0 1 1.5 1.5v4A1.5 1.5 0 0 1 8.5 22h-5A1.5 1.5 0 0 1 2 20.5v-4A1.5 1.5 0 0 1 3.5 15h1.75v-1.5a2.25 2.25 0 0 1 2.25-2.25h3.75V9H9.5A1.5 1.5 0 0 1 8 7.5zm1.5 0h5v4h-5zm-6 13h5v4h-5zm12 0h5v4h-5z"
         clipRule="evenodd"
-        d="M8 3.5C8 2.67157 8.67157 2 9.5 2H14.5C15.3284 2 16 2.67157 16 3.5V7.5C16 8.32843 15.3284 9 14.5 9H12.75V11.25H16.5C17.7426 11.25 18.75 12.2574 18.75 13.5V15H20.5C21.3284 15 22 15.6716 22 16.5V20.5C22 21.3284 21.3284 22 20.5 22H15.5C14.6716 22 14 21.3284 14 20.5V16.5C14 15.6716 14.6716 15 15.5 15H17.25V13.5C17.25 13.0858 16.9142 12.75 16.5 12.75H7.5C7.08579 12.75 6.75 13.0858 6.75 13.5V15H8.5C9.32843 15 10 15.6716 10 16.5V20.5C10 21.3284 9.32843 22 8.5 22H3.5C2.67157 22 2 21.3284 2 20.5V16.5C2 15.6716 2.67157 15 3.5 15H5.25V13.5C5.25 12.2574 6.25736 11.25 7.5 11.25H11.25V9H9.5C8.67157 9 8 8.32843 8 7.5V3.5ZM9.5 3.5H14.5V7.5H9.5V3.5ZM3.5 16.5H8.5V20.5H3.5V16.5ZM15.5 16.5H20.5V20.5H15.5V16.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Laptop.tsx b/web/packages/design/src/Icon/Icons/Laptop.tsx
index 6fbdc4360e141..723b4e514c8b0 100644
--- a/web/packages/design/src/Icon/Icons/Laptop.tsx
+++ b/web/packages/design/src/Icon/Icons/Laptop.tsx
@@ -59,11 +59,11 @@ export const Laptop = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M10.5 7.5C10.0858 7.5 9.75 7.83579 9.75 8.25C9.75 8.66421 10.0858 9 10.5 9H13.5C13.9142 9 14.25 8.66421 14.25 8.25C14.25 7.83579 13.9142 7.5 13.5 7.5H10.5Z" />
+      <path d="M10.5 7.5a.75.75 0 0 0 0 1.5h3a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M3 6.75v9h-.75a.75.75 0 0 0-.75.75V18a2.25 2.25 0 0 0 2.25 2.25h16.5A2.25 2.25 0 0 0 22.5 18v-1.5a.75.75 0 0 0-.75-.75H21v-9a2.25 2.25 0 0 0-2.25-2.25H5.25A2.25 2.25 0 0 0 3 6.75M5.25 6a.75.75 0 0 0-.75.75v9h15v-9a.75.75 0 0 0-.75-.75zM21 17.25V18a.75.75 0 0 1-.75.75H3.75A.75.75 0 0 1 3 18v-.75z"
         clipRule="evenodd"
-        d="M3 6.75V15.75H2.25C1.83579 15.75 1.5 16.0858 1.5 16.5V18C1.5 18.5967 1.73705 19.169 2.15901 19.591C2.58097 20.0129 3.15326 20.25 3.75 20.25H20.25C20.8467 20.25 21.419 20.0129 21.841 19.591C22.2629 19.169 22.5 18.5967 22.5 18V16.5C22.5 16.0858 22.1642 15.75 21.75 15.75H21V6.75C21 6.15326 20.7629 5.58097 20.341 5.15901C19.919 4.73705 19.3467 4.5 18.75 4.5H5.25C4.65326 4.5 4.08097 4.73705 3.65901 5.15901C3.23705 5.58097 3 6.15326 3 6.75ZM5.25 6C5.05109 6 4.86032 6.07902 4.71967 6.21967C4.57902 6.36032 4.5 6.55109 4.5 6.75V15.75H19.5V6.75C19.5 6.55109 19.421 6.36032 19.2803 6.21967C19.1397 6.07902 18.9489 6 18.75 6H5.25ZM21 17.25V18C21 18.1989 20.921 18.3897 20.7803 18.5303C20.6397 18.671 20.4489 18.75 20.25 18.75H3.75C3.55109 18.75 3.36032 18.671 3.21967 18.5303C3.07902 18.3897 3 18.1989 3 18V17.25H21Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Layout.tsx b/web/packages/design/src/Icon/Icons/Layout.tsx
index a9ed1825bd0fb..0ffb243c632f5 100644
--- a/web/packages/design/src/Icon/Icons/Layout.tsx
+++ b/web/packages/design/src/Icon/Icons/Layout.tsx
@@ -59,10 +59,7 @@ export const Layout = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        d="M3.34 3.814a1.459 1.459 0 0 0-.666.413c-.226.235-.333.44-.39.752-.063.338-.062 13.774.001 14.069.113.535.516.979 1.029 1.135.279.084 17.093.084 17.372 0 .525-.16.929-.615 1.03-1.162.062-.331.062-13.711 0-14.042a1.366 1.366 0 0 0-.423-.784 1.511 1.511 0 0 0-.673-.393c-.239-.062-17.065-.05-17.28.012m16.9 3.306V9H3.76V5.24h16.48v1.88M9 14.64v4.12H3.76v-8.24H9v4.12m11.24 0v4.12h-9.72v-8.24h9.72v4.12"
-        fillRule="evenodd"
-      />
+      <path d="M3.34 3.814a1.46 1.46 0 0 0-.666.413c-.226.235-.333.44-.39.752-.063.338-.062 13.774.001 14.069.113.535.516.979 1.029 1.135.279.084 17.093.084 17.372 0 .525-.16.929-.615 1.03-1.162.062-.331.062-13.711 0-14.042a1.37 1.37 0 0 0-.423-.784 1.5 1.5 0 0 0-.673-.393c-.239-.062-17.065-.05-17.28.012m16.9 3.306V9H3.76V5.24h16.48zM9 14.64v4.12H3.76v-8.24H9zm11.24 0v4.12h-9.72v-8.24h9.72z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/License.tsx b/web/packages/design/src/Icon/Icons/License.tsx
index ccdac10d91f37..652adb3b499d9 100644
--- a/web/packages/design/src/Icon/Icons/License.tsx
+++ b/web/packages/design/src/Icon/Icons/License.tsx
@@ -61,8 +61,8 @@ export const License = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 0-1.5 1.5v12a1.5 1.5 0 0 0 1.5 1.5H12a.75.75 0 0 0 0-1.5H3.75v-12h16.5a.75.75 0 0 0 1.5 0 1.5 1.5 0 0 0-1.5-1.5zM18 8.25a3.75 3.75 0 1 0 0 7.5 3.75 3.75 0 0 0 0-7.5M12.75 12a5.25 5.25 0 1 1 9 3.674V21a.75.75 0 0 1-1.085.671L18 20.339l-2.665 1.332a.75.75 0 0 1-1.085-.67v-5.327A5.23 5.23 0 0 1 12.75 12M18 17.25a5.2 5.2 0 0 0 2.25-.505v3.042l-1.915-.958a.75.75 0 0 0-.67 0l-1.915.958v-3.042a5.2 5.2 0 0 0 2.25.505m-12-4.5a.75.75 0 0 1 .75-.75h3.75a.75.75 0 0 1 0 1.5H6.75a.75.75 0 0 1-.75-.75M6.75 9a.75.75 0 0 0 0 1.5h3.75a.75.75 0 0 0 0-1.5z"
         clipRule="evenodd"
-        d="M3.75 3.75C3.35217 3.75 2.97064 3.90804 2.68934 4.18934C2.40804 4.47064 2.25 4.85217 2.25 5.25V17.25C2.25 17.6478 2.40804 18.0294 2.68934 18.3107C2.97065 18.592 3.35218 18.75 3.75 18.75H12C12.4142 18.75 12.75 18.4142 12.75 18C12.75 17.5858 12.4142 17.25 12 17.25H3.75L3.75 5.25L20.25 5.25C20.25 5.66421 20.5858 6 21 6C21.4142 6 21.75 5.66421 21.75 5.25C21.75 4.85218 21.592 4.47065 21.3107 4.18934C21.0294 3.90804 20.6478 3.75 20.25 3.75H3.75ZM18 8.25C15.9289 8.25 14.25 9.92893 14.25 12C14.25 14.0711 15.9289 15.75 18 15.75C20.0711 15.75 21.75 14.0711 21.75 12C21.75 9.92893 20.0711 8.25 18 8.25ZM12.75 12C12.75 9.1005 15.1005 6.75 18 6.75C20.8995 6.75 23.25 9.1005 23.25 12C23.25 13.4305 22.6779 14.7273 21.75 15.6742V21.0002C21.75 21.2601 21.6154 21.5015 21.3943 21.6382C21.1732 21.7748 20.8971 21.7873 20.6646 21.671L18 20.3387L15.3354 21.671C15.1029 21.7873 14.8268 21.7748 14.6057 21.6382C14.3846 21.5015 14.25 21.2601 14.25 21.0002V15.6742C13.3221 14.7273 12.75 13.4305 12.75 12ZM18 17.25C18.8052 17.25 19.5681 17.0687 20.25 16.7448V19.7867L18.3354 18.8294C18.1243 18.7238 17.8757 18.7238 17.6646 18.8294L15.75 19.7867V16.7448C16.4319 17.0687 17.1948 17.25 18 17.25ZM6 12.75C6 12.3358 6.33579 12 6.75 12H10.5C10.9142 12 11.25 12.3358 11.25 12.75C11.25 13.1642 10.9142 13.5 10.5 13.5H6.75C6.33579 13.5 6 13.1642 6 12.75ZM6.75 9C6.33579 9 6 9.33579 6 9.75C6 10.1642 6.33579 10.5 6.75 10.5H10.5C10.9142 10.5 11.25 10.1642 11.25 9.75C11.25 9.33579 10.9142 9 10.5 9H6.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/LineSegment.tsx b/web/packages/design/src/Icon/Icons/LineSegment.tsx
index 98a3636dc2d45..6b3be83345962 100644
--- a/web/packages/design/src/Icon/Icons/LineSegment.tsx
+++ b/web/packages/design/src/Icon/Icons/LineSegment.tsx
@@ -61,8 +61,8 @@ export const LineSegment = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M16.476 8.585a3 3 0 1 0-1.06-1.06l-7.892 7.89a3 3 0 1 0 1.06 1.06zM18 4.5a1.5 1.5 0 0 0-1.067 2.554l.006.006.006.007A1.5 1.5 0 1 0 18 4.5M7.054 16.933l.006.006.007.006a1.5 1.5 0 1 1-.012-.012"
         clipRule="evenodd"
-        d="M16.4759 8.58455C16.9225 8.84852 17.4436 9 18 9C19.6569 9 21 7.65685 21 6C21 4.34315 19.6569 3 18 3C16.3431 3 15 4.34315 15 6C15 6.5563 15.1514 7.07723 15.4153 7.52383L7.52383 15.4153C7.07723 15.1514 6.5563 15 6 15C4.34315 15 3 16.3431 3 18C3 19.6569 4.34315 21 6 21C7.65685 21 9 19.6569 9 18C9 17.4436 8.84852 16.9225 8.58455 16.4759L16.4759 8.58455ZM18 4.5C17.1716 4.5 16.5 5.17157 16.5 6C16.5 6.41105 16.6653 6.78348 16.9331 7.05442C16.9352 7.05643 16.9372 7.05845 16.9393 7.06049C16.9413 7.06255 16.9434 7.06463 16.9454 7.06671C17.2164 7.3346 17.5889 7.5 18 7.5C18.8284 7.5 19.5 6.82843 19.5 6C19.5 5.17157 18.8284 4.5 18 4.5ZM7.05442 16.9331C7.05643 16.9352 7.05845 16.9372 7.06049 16.9393C7.06255 16.9413 7.06463 16.9434 7.06671 16.9454C7.3346 17.2164 7.5 17.5889 7.5 18C7.5 18.8284 6.82843 19.5 6 19.5C5.17157 19.5 4.5 18.8284 4.5 18C4.5 17.1716 5.17157 16.5 6 16.5C6.41105 16.5 6.78348 16.6653 7.05442 16.9331Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/LineSegments.tsx b/web/packages/design/src/Icon/Icons/LineSegments.tsx
index 4b1b2e4661853..f91c3f14a717f 100644
--- a/web/packages/design/src/Icon/Icons/LineSegments.tsx
+++ b/web/packages/design/src/Icon/Icons/LineSegments.tsx
@@ -60,8 +60,8 @@ export const LineSegments = forwardRef<HTMLSpanElement, IconProps>(
       ref={ref}
     >
       <path
-        d="M19.872 2.281c-1.199.142-2.18.993-2.52 2.187-.115.403-.123 1.141-.018 1.525.137.496.373.925.709 1.283l.166.177-.163.303-1.24 2.304-1.079 2-.193-.02c-.702-.072-1.391.025-1.862.264l-.204.104-.938-.938-.938-.938.1-.197c.218-.429.287-.752.287-1.335 0-.453-.015-.588-.093-.84a3.073 3.073 0 0 0-2.025-2.035c-.273-.083-.403-.098-.861-.098-.458 0-.588.015-.861.098A3.073 3.073 0 0 0 6.114 8.16c-.135.434-.135 1.247 0 1.679.157.5.368.857.74 1.253l.106.112-1.247 2.316-1.247 2.315-.123-.027c-.068-.016-.366-.026-.663-.025-.478.003-.577.016-.86.113-.471.16-.836.391-1.2.761-.569.577-.813 1.135-.849 1.943-.027.592.048.971.288 1.46A3.1 3.1 0 0 0 3 21.665c.393.106 1.128.098 1.532-.017a3.03 3.03 0 0 0 2.116-2.116c.115-.403.123-1.141.018-1.525a3.018 3.018 0 0 0-.709-1.283l-.166-.177.163-.303 1.24-2.304 1.078-2 .174.02c.096.011.381.019.634.018.497-.003.859-.085 1.255-.286l.197-.1.938.938.938.938-.1.197c-.218.429-.287.752-.287 1.335 0 .453.015.588.093.84a3.086 3.086 0 0 0 2.046 2.046c.434.135 1.246.135 1.68 0a3.086 3.086 0 0 0 2.046-2.046c.135-.434.135-1.247 0-1.679a3.01 3.01 0 0 0-.74-1.253l-.106-.112 1.247-2.316 1.247-2.315.123.027c.068.016.366.026.663.024.469-.003.582-.017.86-.109.464-.152.795-.362 1.18-.747.587-.587.833-1.141.869-1.96.043-.938-.244-1.66-.915-2.311-.659-.638-1.506-.918-2.442-.808m.757 1.525c.269.068.494.207.719.445.269.285.379.58.38 1.019 0 .283-.017.365-.122.589-.297.635-.933.978-1.597.862a1.37 1.37 0 0 1-.813-.428c-.339-.357-.458-.675-.428-1.143a1.482 1.482 0 0 1 1.861-1.344M9.653 7.658c.272.138.573.445.709.722.085.174.098.255.098.62 0 .385-.01.439-.117.65A1.481 1.481 0 0 1 9 10.486c-.591-.002-1.073-.302-1.346-.84C7.55 9.44 7.54 9.383 7.54 9c0-.365.013-.446.098-.62.173-.352.515-.664.878-.803.095-.037.273-.052.526-.045.329.009.413.026.611.126m6 6c.272.138.573.445.709.722.085.174.098.255.098.62 0 .384-.01.44-.116.648a1.496 1.496 0 0 1-1.562.829 1.511 1.511 0 0 1-1.126-.829c-.106-.208-.116-.264-.116-.648 0-.365.013-.446.098-.62.173-.352.515-.664.878-.803.095-.037.273-.052.526-.045.329.009.413.026.611.126M4.319 17.372c.254.093.591.392.736.65.532.953-.124 2.147-1.214 2.21-.2.011-.37-.003-.506-.044-1.083-.322-1.433-1.692-.636-2.489.424-.424 1.027-.546 1.62-.327"
         fillRule="evenodd"
+        d="M19.872 2.281c-1.199.142-2.18.993-2.52 2.187-.115.403-.123 1.141-.018 1.525q.205.745.709 1.283l.166.177-.163.303-1.24 2.304-1.079 2-.193-.02c-.702-.072-1.391.025-1.862.264l-.204.104-.938-.938-.938-.938.1-.197c.218-.429.287-.752.287-1.335 0-.453-.015-.588-.093-.84a3.07 3.07 0 0 0-2.025-2.035c-.273-.083-.403-.098-.861-.098s-.588.015-.861.098A3.07 3.07 0 0 0 6.114 8.16c-.135.434-.135 1.247 0 1.679.157.5.368.857.74 1.253l.106.112-1.247 2.316-1.247 2.315-.123-.027c-.068-.016-.366-.026-.663-.025-.478.003-.577.016-.86.113-.471.16-.836.391-1.2.761-.569.577-.813 1.135-.849 1.943-.027.592.048.971.288 1.46A3.1 3.1 0 0 0 3 21.665c.393.106 1.128.098 1.532-.017a3.03 3.03 0 0 0 2.116-2.116c.115-.403.123-1.141.018-1.525a3 3 0 0 0-.709-1.283l-.166-.177.163-.303 1.24-2.304 1.078-2 .174.02c.096.011.381.019.634.018.497-.003.859-.085 1.255-.286l.197-.1.938.938.938.938-.1.197c-.218.429-.287.752-.287 1.335 0 .453.015.588.093.84a3.09 3.09 0 0 0 2.046 2.046c.434.135 1.246.135 1.68 0a3.09 3.09 0 0 0 2.046-2.046c.135-.434.135-1.247 0-1.679a3 3 0 0 0-.74-1.253l-.106-.112 1.247-2.316 1.247-2.315.123.027c.068.016.366.026.663.024.469-.003.582-.017.86-.109.464-.152.795-.362 1.18-.747.587-.587.833-1.141.869-1.96.043-.938-.244-1.66-.915-2.311-.659-.638-1.506-.918-2.442-.808m.757 1.525c.269.068.494.207.719.445.269.285.379.58.38 1.019 0 .283-.017.365-.122.589-.297.635-.933.978-1.597.862a1.37 1.37 0 0 1-.813-.428c-.339-.357-.458-.675-.428-1.143a1.482 1.482 0 0 1 1.861-1.344M9.653 7.658c.272.138.573.445.709.722.085.174.098.255.098.62 0 .385-.01.439-.117.65A1.48 1.48 0 0 1 9 10.486c-.591-.002-1.073-.302-1.346-.84C7.55 9.44 7.54 9.383 7.54 9c0-.365.013-.446.098-.62.173-.352.515-.664.878-.803q.144-.055.526-.045c.329.009.413.026.611.126m6 6c.272.138.573.445.709.722.085.174.098.255.098.62 0 .384-.01.44-.116.648a1.5 1.5 0 0 1-1.562.829 1.51 1.51 0 0 1-1.126-.829c-.106-.208-.116-.264-.116-.648 0-.365.013-.446.098-.62.173-.352.515-.664.878-.803.095-.037.273-.052.526-.045.329.009.413.026.611.126M4.319 17.372c.254.093.591.392.736.65.532.953-.124 2.147-1.214 2.21q-.301.017-.506-.044c-1.083-.322-1.433-1.692-.636-2.489.424-.424 1.027-.546 1.62-.327"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Link.tsx b/web/packages/design/src/Icon/Icons/Link.tsx
index d20f71ab92765..c17c2fab1f9cd 100644
--- a/web/packages/design/src/Icon/Icons/Link.tsx
+++ b/web/packages/design/src/Icon/Icons/Link.tsx
@@ -59,8 +59,8 @@ export const Link = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.1666 6.53078L13.0962 5.60116C13.8012 4.90865 14.7511 4.52237 15.7394 4.5264C16.7286 4.53043 17.6762 4.9252 18.3757 5.62472C19.0753 6.32424 19.47 7.27183 19.4741 8.2611C19.4781 9.24938 19.0918 10.1992 18.3993 10.9042L16.1411 13.1624C15.465 13.8389 14.5559 14.2314 13.5999 14.2598C12.6439 14.2881 11.7132 13.95 10.9981 13.3148C10.6885 13.0397 10.2144 13.0677 9.93933 13.3773C9.66422 13.687 9.69222 14.161 10.0019 14.4361C11.0029 15.3255 12.3059 15.7987 13.6443 15.7591C14.9827 15.7195 16.2554 15.1698 17.202 14.2228L19.4622 11.9627L19.4665 11.9583C20.4378 10.9711 20.9797 9.63996 20.974 8.25499C20.9684 6.87002 20.4157 5.54339 19.4364 4.56406C18.4571 3.58473 17.1304 3.03205 15.7455 3.02641C14.3605 3.02077 13.0294 3.56261 12.0421 4.53393L11.1059 5.47012C10.813 5.76302 10.813 6.23789 11.1059 6.53079C11.3988 6.82368 11.8737 6.82368 12.1666 6.53078Z" />
-      <path d="M10.3997 9.74294C11.3558 9.7139 12.2867 10.0513 13.0022 10.686C13.3121 10.9609 13.7861 10.9325 14.061 10.6227C14.3359 10.3128 14.3075 9.8388 13.9977 9.56392C12.996 8.67527 11.6926 8.20297 10.3542 8.24363C9.01602 8.28429 7.74337 8.83521 6.79754 9.78267L4.53829 12.0372L4.53346 12.0421C3.56214 13.0294 3.02028 14.3605 3.02592 15.7454C3.03156 17.1304 3.58424 18.457 4.56357 19.4364C5.5429 20.4157 6.86953 20.9684 8.2545 20.974C9.63947 20.9796 10.9706 20.4378 11.9579 19.4665L12.894 18.5303C13.1869 18.2374 13.1869 17.7625 12.894 17.4696C12.6012 17.1767 12.1263 17.1767 11.8334 17.4696L10.9038 18.3993C10.1988 19.0918 9.2489 19.478 8.26061 19.474C7.27135 19.47 6.32375 19.0752 5.62423 18.3757C4.92471 17.6762 4.52994 16.7286 4.52591 15.7393C4.52189 14.7512 4.90806 13.8014 5.60041 13.0964L7.85927 10.8423C8.53491 10.1652 9.4437 9.77199 10.3997 9.74294Z" />
+      <path d="m12.167 6.53.93-.929a3.75 3.75 0 0 1 5.302 5.303l-2.258 2.258a3.75 3.75 0 0 1-5.143.153.75.75 0 0 0-.996 1.121 5.25 5.25 0 0 0 7.2-.213l2.26-2.26.005-.005a5.25 5.25 0 0 0-7.425-7.424l-.936.936a.75.75 0 1 0 1.06 1.06" />
+      <path d="M10.4 9.743a3.75 3.75 0 0 1 2.602.943.75.75 0 0 0 .996-1.122 5.25 5.25 0 0 0-7.2.219l-2.26 2.254-.005.005a5.25 5.25 0 0 0 7.425 7.425l.936-.937a.75.75 0 0 0-1.06-1.06l-.93.93A3.75 3.75 0 0 1 5.6 13.095l2.26-2.254a3.75 3.75 0 0 1 2.54-1.1" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Linkedin.tsx b/web/packages/design/src/Icon/Icons/Linkedin.tsx
index 2ce67c7542812..99eeeeb09f7e4 100644
--- a/web/packages/design/src/Icon/Icons/Linkedin.tsx
+++ b/web/packages/design/src/Icon/Icons/Linkedin.tsx
@@ -59,13 +59,11 @@ export const Linkedin = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.25 9.75C11.6063 9.75 11.9046 9.99844 11.981 10.3315C12.5359 9.95528 13.1949 9.75 13.875 9.75C14.7701 9.75 15.6286 10.1056 16.2615 10.7385C16.8944 11.3715 17.25 12.2299 17.25 13.125V16.5C17.25 16.9142 16.9142 17.25 16.5 17.25C16.0858 17.25 15.75 16.9142 15.75 16.5V13.125C15.75 12.6277 15.5525 12.1508 15.2008 11.7992C14.8492 11.4475 14.3723 11.25 13.875 11.25C13.3777 11.25 12.9008 11.4475 12.5492 11.7992C12.1975 12.1508 12 12.6277 12 13.125V16.5C12 16.9142 11.6642 17.25 11.25 17.25C10.8358 17.25 10.5 16.9142 10.5 16.5V10.5C10.5 10.0858 10.8358 9.75 11.25 9.75Z" />
-      <path d="M9 10.5C9 10.0858 8.66421 9.75 8.25 9.75C7.83579 9.75 7.5 10.0858 7.5 10.5V16.5C7.5 16.9142 7.83579 17.25 8.25 17.25C8.66421 17.25 9 16.9142 9 16.5V10.5Z" />
-      <path d="M9.1875 7.875C9.1875 8.39277 8.76777 8.8125 8.25 8.8125C7.73223 8.8125 7.3125 8.39277 7.3125 7.875C7.3125 7.35723 7.73223 6.9375 8.25 6.9375C8.76777 6.9375 9.1875 7.35723 9.1875 7.875Z" />
+      <path d="M11.25 9.75a.75.75 0 0 1 .731.582 3.375 3.375 0 0 1 5.269 2.793V16.5a.75.75 0 0 1-1.5 0v-3.375a1.875 1.875 0 1 0-3.75 0V16.5a.75.75 0 0 1-1.5 0v-6a.75.75 0 0 1 .75-.75M9 10.5a.75.75 0 0 0-1.5 0v6a.75.75 0 0 0 1.5 0zm.188-2.625a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.875 0" />
       <path
         fillRule="evenodd"
+        d="M2.25 3.75a1.5 1.5 0 0 1 1.5-1.5h16.5a1.5 1.5 0 0 1 1.5 1.5v16.5a1.5 1.5 0 0 1-1.5 1.5H3.75a1.5 1.5 0 0 1-1.5-1.5zm18 0H3.75v16.5h16.5z"
         clipRule="evenodd"
-        d="M2.25 3.75C2.25 2.92157 2.92157 2.25 3.75 2.25H20.25C21.0784 2.25 21.75 2.92157 21.75 3.75V20.25C21.75 21.0784 21.0784 21.75 20.25 21.75H3.75C2.92157 21.75 2.25 21.0784 2.25 20.25V3.75ZM20.25 3.75H3.75V20.25H20.25V3.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Linux.tsx b/web/packages/design/src/Icon/Icons/Linux.tsx
index a6a392b11e7ac..bfb5b1371a898 100644
--- a/web/packages/design/src/Icon/Icons/Linux.tsx
+++ b/web/packages/design/src/Icon/Icons/Linux.tsx
@@ -61,8 +61,8 @@ export const Linux = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M5.01 16.785c.174.49-.064 1.039-.541 1.193-.275.088-.58.119-.87.11-.533-.015-.703.176-.529.675.06.172.144.336.221.502.152.328.163.654-.004.981a8 8 0 0 0-.159.33c-.21.462-.126.654.368.78.396.1.804.156 1.2.256.87.219 1.736.451 2.602.68.432.115.863.213 1.312.082.58-.17.9-.591.778-1.177-.093-.454-.227-.927-.465-1.317-.578-.953-1.224-1.865-1.85-2.787a3.7 3.7 0 0 0-.429-.494c-.505-.515-.705-.565-1.375-.345-.163-.329-.112-.674-.055-1.011.03-.177.092-.361.187-.512.404-.64.64-1.351.891-2.057.291-.816.663-1.578 1.227-2.258.464-.56.83-1.203 1.231-1.815.144-.218.146-.462.134-.725-.064-1.367-.14-2.735-.14-4.103.002-1.687 1.414-3 3.362-2.74 2.147.286 3.429 1.88 3.365 4.055-.058 1.96.588 3.667 1.927 5.15 1.335 1.477 1.96 3.29 2.072 5.271a2 2 0 0 1-.115.743c-.049.145-.207.254-.318.377-.15.167-.311.325-.45.501-.26.329-.546.608-.976.7-.648.14-1.078-.062-1.371-.654-.039-.079-.072-.16-.12-.233-.108-.166-.216-.407-.439-.334-.144.047-.304.255-.33.412-.06.346-.123.728-.034 1.054.258.937.199 1.862.066 2.8-.075.536-.009 1.054.497 1.365.526.323 1.04.158 1.522-.15.08-.051.155-.113.226-.177.649-.593 1.403-.99 2.238-1.256a4.4 4.4 0 0 0 .924-.42c.42-.257.404-.556-.019-.818a2 2 0 0 0-.494-.235c-.502-.152-.748-.515-.854-.996-.078-.352-.1-.704.103-1.111.037.227.06.386.088.544.112.643.447 1.118 1.038 1.419.19.096.368.235.52.387.222.225.223.485.019.73-.105.125-.23.242-.366.33-.256.166-.515.334-.794.453-.976.416-1.808 1.039-2.594 1.74-.423.377-.95.34-1.465.287-.462-.047-.824-.261-1.049-.683-.13-.241-.338-.388-.61-.392-.923-.016-1.847-.017-2.77-.02-.192 0-.384.02-.576.024a2.6 2.6 0 0 0-1.471.468c-.129.09-.26.177-.386.27q-.627.461-1.362.226c-.555-.18-1.098-.404-1.66-.55-.834-.216-1.682-.376-2.522-.568-.936-.214-1.11-.534-.725-1.403.185-.417.19-.821.076-1.247a4 4 0 0 1-.132-.639c-.038-.37.09-.536.459-.597.265-.045.538-.046.804-.092.514-.088.861-.44.962-.979m10.962-2.474a6.6 6.6 0 0 0-.483-2.421c-.112-.277-.305-.522-.46-.783-.06-.101-.14-.2-.167-.31-.19-.759-.452-1.48-.938-2.109a1.18 1.18 0 0 1-.211-1.065c.036-.135.073-.27.1-.406.068-.33-.03-.486-.342-.601-.334-.124-.654-.286-.992-.39-.279-.086-.34-.271-.327-.515a1.6 1.6 0 0 1 .06-.411c.07-.23.204-.403.471-.424.28-.023.494.09.617.346.121.254.149.513.038.784-.1.243-.004.368.247.298.107-.03.251-.158.263-.256.057-.48.038-.958-.212-1.395a.96.96 0 0 0-1.138-.466c-.58.164-.857.614-.8 1.296l.033.39-.948-.07c-.016-.183-.016-.35-.048-.511a3 3 0 0 0-.163-.602c-.1-.244-.273-.433-.567-.431-.286.001-.431.198-.54.427-.246.51-.197 1.016.036 1.513.037.077.131.185.19.18.08-.008.15-.11.237-.182-.372-.212-.541-.664-.363-1.004.065-.124.234-.223.376-.269.173-.055.341.044.398.218.069.21.1.436.13.658.007.053-.041.132-.088.172-.273.238-.555.467-.83.702a.8.8 0 0 0-.161.17c-.117.183-.14.344.084.486.136.086.251.215.357.34.163.194.366.306.613.3.992-.023 1.957-.147 2.755-.829.042-.036.164-.04.199-.006.04.04.056.15.029.203-.03.06-.114.103-.184.132-.491.202-.985.395-1.476.598-.487.2-.986.283-1.509.18-.061-.011-.127-.001-.227-.001.223.314.47.529.834.506.274-.017.561-.048.813-.147.379-.15.73-.369 1.096-.55.123-.061.256-.11.39-.14.047-.01.128.046.16.094.017.027-.024.114-.062.148-.064.058-.146.093-.22.14l-1.37.859c-.177.111-.346.238-.532.331-.356.179-.605.144-.871-.15-.216-.239-.392-.512-.588-.767-.064-.083-.138-.159-.207-.238-.033.568-.322 1.003-.565 1.454-.263.489-.452.987-.185 1.503-.088.102-.166.174-.222.261-.63.978-1.133 2.001-1.123 3.206q.003.443-.038.886c-.07.773-1.018.037.924 1.676.434.365.89.703 1.32 1.073 1.025.886-.718.857.622 1.834.225.165.496.335.762.362 1.352.134 2.646.047 3.514-1.233.033-.05.364-.339.552-2.19.048-.476.274-.691.723-.798.806-.19.217-1.608.214-2.056m-5.8-8.557.118-.038c-.05-.166-.097-.334-.159-.496-.008-.021-.097-.012-.129-.015zm2.965-.181c.114-.26-.03-.464-.303-.447z"
         clipRule="evenodd"
-        d="M5.00966 16.785C5.18443 17.2744 4.94585 17.8239 4.46864 17.978C4.19422 18.0665 3.88811 18.0968 3.59811 18.0885C3.06608 18.0732 2.89626 18.2639 3.07037 18.7626C3.13042 18.9347 3.21404 19.0987 3.291 19.2645C3.44343 19.593 3.45365 19.9193 3.28739 20.2463C3.23195 20.355 3.17893 20.4648 3.12836 20.5758C2.91876 21.0375 3.00173 21.2304 3.49606 21.3557C3.89247 21.4562 4.30012 21.5123 4.69672 21.6121C5.56587 21.8307 6.43156 22.0632 7.29802 22.2926C7.73046 22.407 8.16115 22.5048 8.61018 22.3737C9.19047 22.2042 9.50928 21.7827 9.38828 21.1968C9.29463 20.7432 9.16084 20.2701 8.92348 19.8795C8.34493 18.9272 7.69939 18.0154 7.07209 17.0932C6.95036 16.9142 6.79668 16.7547 6.64445 16.5993C6.13933 16.0836 5.93911 16.0343 5.26897 16.2543C5.10593 15.925 5.1573 15.5798 5.21397 15.2429C5.24371 15.0661 5.30616 14.882 5.40127 14.7311C5.80544 14.0904 6.0408 13.3795 6.29225 12.6742C6.58326 11.8579 6.95547 11.0958 7.51918 10.4156C7.98339 9.85539 8.34904 9.21283 8.7503 8.60143C8.89377 8.38287 8.89646 8.13876 8.88415 7.87554C8.82021 6.50866 8.74319 5.14056 8.74456 3.77295C8.7463 2.08552 10.1577 0.773065 12.1056 1.03292C14.2527 1.31933 15.5347 2.91372 15.4707 5.08801C15.4132 7.04719 16.059 8.755 17.3984 10.2375C18.7333 11.7149 19.3577 13.5272 19.4703 15.5093C19.4842 15.7555 19.4341 16.0174 19.3551 16.2523C19.3064 16.3972 19.1477 16.5057 19.0369 16.6291C18.8869 16.7963 18.7255 16.9544 18.5867 17.1303C18.3272 17.4589 18.0405 17.7378 17.6107 17.8301C16.9627 17.9692 16.5327 17.7678 16.2398 17.1755C16.2012 17.0974 16.1677 17.0158 16.1205 16.9432C16.0125 16.7769 15.9042 16.5356 15.6815 16.6087C15.537 16.6561 15.3771 16.8638 15.3504 17.0212C15.2915 17.3666 15.2279 17.7491 15.3174 18.0749C15.5747 19.0117 15.5156 19.9373 15.3832 20.8759C15.3078 21.4108 15.3743 21.9294 15.8802 22.2402C16.4064 22.5634 16.9202 22.3981 17.4016 22.0903C17.482 22.0389 17.5574 21.9775 17.628 21.913C18.2769 21.3204 19.0313 20.9229 19.8664 20.6565C20.1868 20.5542 20.5026 20.4114 20.7895 20.2363C21.2095 19.98 21.1939 19.6806 20.7712 19.4192C20.6168 19.3237 20.4501 19.2366 20.2774 19.1843C19.7747 19.0324 19.5295 18.6695 19.423 18.1879C19.3451 17.8356 19.3232 17.4836 19.5264 17.0765C19.5627 17.3038 19.5859 17.4627 19.6137 17.6208C19.7263 18.2642 20.0607 18.7394 20.6518 19.0396C20.8424 19.1363 21.0205 19.2754 21.1715 19.4275C21.3944 19.652 21.3951 19.9118 21.1909 20.1561C21.0859 20.2815 20.9613 20.3991 20.8245 20.4875C20.569 20.6527 20.3097 20.8212 20.0313 20.9399C19.0546 21.3562 18.2226 21.9788 17.4373 22.6794C17.0139 23.0571 16.4876 23.02 15.9723 22.9672C15.5103 22.9198 15.1481 22.7058 14.923 22.2842C14.7939 22.0425 14.5845 21.8964 14.3139 21.8919C13.3903 21.8764 12.4663 21.875 11.5426 21.8723C11.3509 21.8717 11.1592 21.8929 10.9674 21.8959C10.4292 21.9043 9.93778 22.0557 9.49578 22.3644C9.36716 22.4543 9.23651 22.5414 9.11005 22.6343C8.69349 22.9401 8.23715 23.0183 7.7475 22.8598C7.19262 22.6804 6.65016 22.456 6.08706 22.31C5.25363 22.094 4.40575 21.9342 3.56591 21.7422C2.63011 21.5283 2.4565 21.2083 2.84118 20.3394C3.02605 19.9218 3.0305 19.5176 2.91745 19.0916C2.86174 18.8816 2.80732 18.6683 2.78502 18.4531C2.7466 18.0823 2.87512 17.9169 3.24351 17.8556C3.50921 17.8113 3.78211 17.8098 4.04752 17.7641C4.5621 17.6756 4.90933 17.3242 5.00966 16.785ZM15.9715 14.3112C15.9647 13.473 15.8014 12.6636 15.489 11.8899C15.377 11.6125 15.184 11.3679 15.0299 11.1071C14.9699 11.0057 14.8898 10.9075 14.8621 10.797C14.6727 10.0383 14.4099 9.31742 13.9244 8.68797C13.6847 8.37743 13.6099 8.01267 13.7129 7.62294C13.7485 7.48826 13.7861 7.35381 13.8138 7.21743C13.881 6.88644 13.7828 6.73145 13.4707 6.61565C13.1375 6.49207 12.8171 6.33049 12.4786 6.22597C12.2001 6.14001 12.1399 5.95475 12.1516 5.71146C12.1583 5.57327 12.1709 5.431 12.2111 5.29984C12.2813 5.07056 12.4165 4.89722 12.6832 4.8758C12.9622 4.85338 13.1768 4.96643 13.2997 5.2225C13.4213 5.47601 13.4488 5.73503 13.3378 6.0058C13.2381 6.24887 13.3344 6.37382 13.5853 6.30445C13.692 6.27495 13.8362 6.14553 13.8478 6.04778C13.9049 5.56829 13.8863 5.09007 13.6357 4.65288C13.3955 4.23387 12.96 4.05566 12.4976 4.18689C11.9188 4.35116 11.6408 4.80143 11.698 5.48252C11.7099 5.624 11.722 5.76549 11.7311 5.87225C11.415 5.84943 11.0988 5.82662 10.7827 5.80384C10.767 5.61987 10.7667 5.45266 10.7354 5.29153C10.6958 5.08783 10.6508 4.88079 10.572 4.69012C10.4712 4.44612 10.2991 4.25714 10.0053 4.25871C9.71948 4.2603 9.57386 4.4575 9.46407 4.68612C9.21947 5.19556 9.26809 5.70242 9.50143 6.19894C9.53774 6.27624 9.63247 6.3842 9.69093 6.37874C9.77074 6.37129 9.84166 6.26864 9.92786 6.19735C9.5557 5.98489 9.38705 5.53323 9.56537 5.19287C9.63017 5.06916 9.79869 4.96963 9.94079 4.92436C10.1143 4.86904 10.282 4.9684 10.3386 5.14161C10.4076 5.35295 10.4387 5.57824 10.4686 5.79991C10.4758 5.85349 10.4275 5.93228 10.3813 5.97245C10.1079 6.21024 9.82647 6.43894 9.5502 6.67359C9.49104 6.72385 9.43133 6.77923 9.39004 6.84377C9.27288 7.02688 9.25076 7.18787 9.47389 7.32958C9.61034 7.41627 9.72532 7.54468 9.83088 7.67032C9.99377 7.86406 10.1971 7.97634 10.4436 7.9705C11.4365 7.94708 12.4011 7.82271 13.199 7.14099C13.241 7.10515 13.3632 7.10167 13.398 7.13516C13.4387 7.17433 13.4535 7.28519 13.4266 7.33821C13.3962 7.3983 13.3125 7.44147 13.2429 7.47011C12.752 7.67208 12.2575 7.86505 11.7669 8.06754C11.2798 8.26853 10.7813 8.35111 10.2584 8.24866C10.1968 8.23658 10.1309 8.24702 10.0311 8.24702C10.2545 8.5608 10.5015 8.77597 10.8651 8.75343C11.1393 8.73646 11.4264 8.70522 11.6782 8.60564C12.0567 8.45596 12.4076 8.23731 12.7741 8.0559C12.8974 7.99495 13.0298 7.94566 13.1637 7.91681C13.2106 7.90662 13.292 7.96205 13.3232 8.00992C13.3405 8.0365 13.2996 8.12398 13.2617 8.15823C13.1982 8.21553 13.1157 8.25145 13.042 8.29762C12.5851 8.58388 12.1285 8.87035 11.6719 9.15704C11.495 9.26811 11.326 9.39489 11.1403 9.48807C10.7842 9.66673 10.5353 9.63158 10.2689 9.33733C10.0535 9.09946 9.87733 8.82618 9.68072 8.57101C9.6167 8.48786 9.54301 8.41217 9.47372 8.33309C9.44057 8.90144 9.15244 9.33559 8.90928 9.78683C8.64586 10.2757 8.45721 10.7743 8.72381 11.2897C8.63626 11.3918 8.55791 11.4643 8.50183 11.5514C7.8712 12.5294 7.36918 13.5524 7.37893 14.7565C7.38127 15.0519 7.36784 15.3484 7.34131 15.6425C7.27158 16.4159 6.32322 15.6801 8.2654 17.3188C8.69854 17.6842 9.15541 18.0218 9.58428 18.392C10.6102 19.2777 8.86744 19.2492 10.2068 20.2264C10.4317 20.3905 10.7033 20.5615 10.9686 20.5878C12.3212 20.7216 13.6146 20.6346 14.4826 19.355C14.5161 19.3056 14.8468 19.016 15.0348 17.1652C15.0833 16.6888 15.3095 16.4735 15.7577 16.3672C16.5636 16.1766 15.9751 14.7593 15.9715 14.3112ZM10.1722 5.75355C10.2115 5.741 10.2507 5.72843 10.29 5.71584C10.2391 5.5497 10.193 5.38165 10.1313 5.21962C10.1233 5.1985 10.0345 5.20817 10.0024 5.20527L10.1722 5.75355ZM13.1369 5.57295C13.2508 5.31262 13.1061 5.10906 12.8343 5.12625L13.1369 5.57295Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ListAddCheck.tsx b/web/packages/design/src/Icon/Icons/ListAddCheck.tsx
index ff6051a33c432..86722b9765ab3 100644
--- a/web/packages/design/src/Icon/Icons/ListAddCheck.tsx
+++ b/web/packages/design/src/Icon/Icons/ListAddCheck.tsx
@@ -59,12 +59,7 @@ export const ListAddCheck = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M8.78033 5.03033C9.07322 4.73744 9.07322 4.26256 8.78033 3.96967C8.48744 3.67678 8.01256 3.67678 7.71967 3.96967L5.25 6.43934L4.28033 5.46967C3.98744 5.17678 3.51256 5.17678 3.21967 5.46967C2.92678 5.76256 2.92678 6.23744 3.21967 6.53033L4.71967 8.03033C5.01256 8.32322 5.48744 8.32322 5.78033 8.03033L8.78033 5.03033Z" />
-      <path d="M12 5.25C11.5858 5.25 11.25 5.58579 11.25 6C11.25 6.41421 11.5858 6.75 12 6.75H20.25C20.6642 6.75 21 6.41421 21 6C21 5.58579 20.6642 5.25 20.25 5.25H12Z" />
-      <path d="M12 11.25C11.5858 11.25 11.25 11.5858 11.25 12C11.25 12.4142 11.5858 12.75 12 12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H12Z" />
-      <path d="M11.25 18C11.25 17.5858 11.5858 17.25 12 17.25H20.25C20.6642 17.25 21 17.5858 21 18C21 18.4142 20.6642 18.75 20.25 18.75H12C11.5858 18.75 11.25 18.4142 11.25 18Z" />
-      <path d="M8.78033 9.96967C9.07322 10.2626 9.07322 10.7374 8.78033 11.0303L5.78033 14.0303C5.48744 14.3232 5.01256 14.3232 4.71967 14.0303L3.21967 12.5303C2.92678 12.2374 2.92678 11.7626 3.21967 11.4697C3.51256 11.1768 3.98744 11.1768 4.28033 11.4697L5.25 12.4393L7.71967 9.96967C8.01256 9.67678 8.48744 9.67678 8.78033 9.96967Z" />
-      <path d="M8.78033 17.0303C9.07322 16.7374 9.07322 16.2626 8.78033 15.9697C8.48744 15.6768 8.01256 15.6768 7.71967 15.9697L5.25 18.4393L4.28033 17.4697C3.98744 17.1768 3.51256 17.1768 3.21967 17.4697C2.92678 17.7626 2.92678 18.2374 3.21967 18.5303L4.71967 20.0303C5.01256 20.3232 5.48744 20.3232 5.78033 20.0303L8.78033 17.0303Z" />
+      <path d="M8.78 5.03a.75.75 0 0 0-1.06-1.06L5.25 6.44l-.97-.97a.75.75 0 0 0-1.06 1.06l1.5 1.5a.75.75 0 0 0 1.06 0zm3.22.22a.75.75 0 0 0 0 1.5h8.25a.75.75 0 0 0 0-1.5zm0 6a.75.75 0 0 0 0 1.5h8.25a.75.75 0 0 0 0-1.5zM11.25 18a.75.75 0 0 1 .75-.75h8.25a.75.75 0 0 1 0 1.5H12a.75.75 0 0 1-.75-.75M8.78 9.97a.75.75 0 0 1 0 1.06l-3 3a.75.75 0 0 1-1.06 0l-1.5-1.5a.75.75 0 1 1 1.06-1.06l.97.97 2.47-2.47a.75.75 0 0 1 1.06 0m0 7.06a.75.75 0 1 0-1.06-1.06l-2.47 2.47-.97-.97a.75.75 0 0 0-1.06 1.06l1.5 1.5a.75.75 0 0 0 1.06 0z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ListMagnifyingGlass.tsx b/web/packages/design/src/Icon/Icons/ListMagnifyingGlass.tsx
index fb877475f6257..8a7b26d00177b 100644
--- a/web/packages/design/src/Icon/Icons/ListMagnifyingGlass.tsx
+++ b/web/packages/design/src/Icon/Icons/ListMagnifyingGlass.tsx
@@ -59,13 +59,11 @@ export const ListMagnifyingGlass = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3 6C3 5.58579 3.33579 5.25 3.75 5.25H20.25C20.6642 5.25 21 5.58579 21 6C21 6.41421 20.6642 6.75 20.25 6.75H3.75C3.33579 6.75 3 6.41421 3 6Z" />
-      <path d="M3 12C3 11.5858 3.33579 11.25 3.75 11.25H10.5C10.9142 11.25 11.25 11.5858 11.25 12C11.25 12.4142 10.9142 12.75 10.5 12.75H3.75C3.33579 12.75 3 12.4142 3 12Z" />
-      <path d="M3.75 17.25C3.33579 17.25 3 17.5858 3 18C3 18.4142 3.33579 18.75 3.75 18.75H12C12.4142 18.75 12.75 18.4142 12.75 18C12.75 17.5858 12.4142 17.25 12 17.25H3.75Z" />
+      <path d="M3 6a.75.75 0 0 1 .75-.75h16.5a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 6m0 6a.75.75 0 0 1 .75-.75h6.75a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 12m.75 5.25a.75.75 0 0 0 0 1.5H12a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M13.5 13.5a3.75 3.75 0 1 1 6.879 2.068l1.901 1.901a.75.75 0 0 1-1.06 1.06l-1.902-1.9A3.75 3.75 0 0 1 13.5 13.5m3.75-2.25a2.25 2.25 0 1 0 0 4.5 2.25 2.25 0 0 0 0-4.5"
         clipRule="evenodd"
-        d="M13.5 13.5C13.5 11.4289 15.1789 9.75 17.25 9.75C19.3211 9.75 21 11.4289 21 13.5C21 14.2642 20.7714 14.975 20.3789 15.5677L22.2803 17.4692C22.5732 17.7621 22.5732 18.237 22.2803 18.5299C21.9875 18.8228 21.5126 18.8228 21.2197 18.5299L19.3183 16.6285C18.7255 17.0213 18.0144 17.25 17.25 17.25C15.1789 17.25 13.5 15.5711 13.5 13.5ZM17.25 11.25C16.0074 11.25 15 12.2574 15 13.5C15 14.7426 16.0074 15.75 17.25 15.75C18.4926 15.75 19.5 14.7426 19.5 13.5C19.5 12.2574 18.4926 11.25 17.25 11.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ListThin.tsx b/web/packages/design/src/Icon/Icons/ListThin.tsx
index c6e8f676120f8..32da05c8a1bed 100644
--- a/web/packages/design/src/Icon/Icons/ListThin.tsx
+++ b/web/packages/design/src/Icon/Icons/ListThin.tsx
@@ -59,12 +59,7 @@ export const ListThin = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M5.0625 6C5.0625 6.51777 4.64277 6.9375 4.125 6.9375C3.60723 6.9375 3.1875 6.51777 3.1875 6C3.1875 5.48223 3.60723 5.0625 4.125 5.0625C4.64277 5.0625 5.0625 5.48223 5.0625 6Z" />
-      <path d="M8.25 5.25C7.83579 5.25 7.5 5.58579 7.5 6C7.5 6.41421 7.83579 6.75 8.25 6.75H20.25C20.6642 6.75 21 6.41421 21 6C21 5.58579 20.6642 5.25 20.25 5.25H8.25Z" />
-      <path d="M8.25 11.25C7.83579 11.25 7.5 11.5858 7.5 12C7.5 12.4142 7.83579 12.75 8.25 12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H8.25Z" />
-      <path d="M7.5 18C7.5 17.5858 7.83579 17.25 8.25 17.25H20.25C20.6642 17.25 21 17.5858 21 18C21 18.4142 20.6642 18.75 20.25 18.75H8.25C7.83579 18.75 7.5 18.4142 7.5 18Z" />
-      <path d="M4.125 18.9375C4.64277 18.9375 5.0625 18.5178 5.0625 18C5.0625 17.4822 4.64277 17.0625 4.125 17.0625C3.60723 17.0625 3.1875 17.4822 3.1875 18C3.1875 18.5178 3.60723 18.9375 4.125 18.9375Z" />
-      <path d="M5.0625 12C5.0625 12.5178 4.64277 12.9375 4.125 12.9375C3.60723 12.9375 3.1875 12.5178 3.1875 12C3.1875 11.4822 3.60723 11.0625 4.125 11.0625C4.64277 11.0625 5.0625 11.4822 5.0625 12Z" />
+      <path d="M5.063 6a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0m3.188-.75a.75.75 0 0 0 0 1.5h12a.75.75 0 0 0 0-1.5zm0 6a.75.75 0 0 0 0 1.5h12a.75.75 0 0 0 0-1.5zM7.5 18a.75.75 0 0 1 .75-.75h12a.75.75 0 0 1 0 1.5h-12A.75.75 0 0 1 7.5 18m-3.375.938a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.875M5.063 12a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/ListView.tsx b/web/packages/design/src/Icon/Icons/ListView.tsx
index 4187301593382..1174a3e685363 100644
--- a/web/packages/design/src/Icon/Icons/ListView.tsx
+++ b/web/packages/design/src/Icon/Icons/ListView.tsx
@@ -59,12 +59,7 @@ export const ListView = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.75 5.25C3.33579 5.25 3 5.58579 3 6C3 6.41421 3.33579 6.75 3.75 6.75H5.25C5.66421 6.75 6 6.41421 6 6C6 5.58579 5.66421 5.25 5.25 5.25H3.75Z" />
-      <path d="M9 5.25C8.58579 5.25 8.25 5.58579 8.25 6C8.25 6.41421 8.58579 6.75 9 6.75H20.25C20.6642 6.75 21 6.41421 21 6C21 5.58579 20.6642 5.25 20.25 5.25H9Z" />
-      <path d="M9 11.25C8.58579 11.25 8.25 11.5858 8.25 12C8.25 12.4142 8.58579 12.75 9 12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H9Z" />
-      <path d="M8.25 18C8.25 17.5858 8.58579 17.25 9 17.25H20.25C20.6642 17.25 21 17.5858 21 18C21 18.4142 20.6642 18.75 20.25 18.75H9C8.58579 18.75 8.25 18.4142 8.25 18Z" />
-      <path d="M3 12C3 11.5858 3.33579 11.25 3.75 11.25H5.25C5.66421 11.25 6 11.5858 6 12C6 12.4142 5.66421 12.75 5.25 12.75H3.75C3.33579 12.75 3 12.4142 3 12Z" />
-      <path d="M3.75 17.25C3.33579 17.25 3 17.5858 3 18C3 18.4142 3.33579 18.75 3.75 18.75H5.25C5.66421 18.75 6 18.4142 6 18C6 17.5858 5.66421 17.25 5.25 17.25H3.75Z" />
+      <path d="M3.75 5.25a.75.75 0 0 0 0 1.5h1.5a.75.75 0 0 0 0-1.5zm5.25 0a.75.75 0 0 0 0 1.5h11.25a.75.75 0 0 0 0-1.5zm0 6a.75.75 0 0 0 0 1.5h11.25a.75.75 0 0 0 0-1.5zM8.25 18a.75.75 0 0 1 .75-.75h11.25a.75.75 0 0 1 0 1.5H9a.75.75 0 0 1-.75-.75M3 12a.75.75 0 0 1 .75-.75h1.5a.75.75 0 0 1 0 1.5h-1.5A.75.75 0 0 1 3 12m.75 5.25a.75.75 0 0 0 0 1.5h1.5a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Lock.tsx b/web/packages/design/src/Icon/Icons/Lock.tsx
index b03e85dcbda03..d01c80c3aa538 100644
--- a/web/packages/design/src/Icon/Icons/Lock.tsx
+++ b/web/packages/design/src/Icon/Icons/Lock.tsx
@@ -61,8 +61,8 @@ export const Lock = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M7.5 7.5V5.25a4.5 4.5 0 0 1 9 0V7.5h3A1.5 1.5 0 0 1 21 9v10.5a1.5 1.5 0 0 1-1.5 1.5h-15A1.5 1.5 0 0 1 3 19.5V9a1.5 1.5 0 0 1 1.5-1.5zm2.379-4.371A3 3 0 0 1 15 5.25V7.5H9V5.25a3 3 0 0 1 .879-2.121M4.5 9v10.5h15V9z"
         clipRule="evenodd"
-        d="M7.5 7.5V5.25C7.5 4.05653 7.97411 2.91193 8.81802 2.06802C9.66193 1.22411 10.8065 0.75 12 0.75C13.1935 0.75 14.3381 1.22411 15.182 2.06802C16.0259 2.91193 16.5 4.05653 16.5 5.25V7.5H19.5C20.3284 7.5 21 8.17157 21 9V19.5C21 20.3284 20.3284 21 19.5 21H4.5C3.67157 21 3 20.3284 3 19.5V9C3 8.17157 3.67157 7.5 4.5 7.5H7.5ZM9.87868 3.12868C10.4413 2.56607 11.2044 2.25 12 2.25C12.7956 2.25 13.5587 2.56607 14.1213 3.12868C14.6839 3.69129 15 4.45435 15 5.25V7.5H9V5.25C9 4.45435 9.31607 3.69129 9.87868 3.12868ZM4.5 9V19.5H19.5V9H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/LockKey.tsx b/web/packages/design/src/Icon/Icons/LockKey.tsx
index 65b4043c5bcf5..1618ad32708f7 100644
--- a/web/packages/design/src/Icon/Icons/LockKey.tsx
+++ b/web/packages/design/src/Icon/Icons/LockKey.tsx
@@ -61,13 +61,13 @@ export const LockKey = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12.75 15.641a2.626 2.626 0 1 0-1.5 0v1.609a.75.75 0 0 0 1.5 0zM12 12a1.125 1.125 0 1 0 0 2.25A1.125 1.125 0 0 0 12 12"
         clipRule="evenodd"
-        d="M12.75 15.6413C13.8343 15.3186 14.625 14.3141 14.625 13.125C14.625 11.6753 13.4497 10.5 12 10.5C10.5503 10.5 9.375 11.6753 9.375 13.125C9.375 14.3141 10.1657 15.3186 11.25 15.6413V17.25C11.25 17.6642 11.5858 18 12 18C12.4142 18 12.75 17.6642 12.75 17.25V15.6413ZM12 12C11.3787 12 10.875 12.5037 10.875 13.125C10.875 13.7463 11.3787 14.25 12 14.25C12.6213 14.25 13.125 13.7463 13.125 13.125C13.125 12.5037 12.6213 12 12 12Z"
       />
       <path
         fillRule="evenodd"
+        d="M7.5 7.5V5.25a4.5 4.5 0 0 1 9 0V7.5h3A1.5 1.5 0 0 1 21 9v10.5a1.5 1.5 0 0 1-1.5 1.5h-15A1.5 1.5 0 0 1 3 19.5V9a1.5 1.5 0 0 1 1.5-1.5zm2.379-4.371A3 3 0 0 1 15 5.25V7.5H9V5.25a3 3 0 0 1 .879-2.121M4.5 9v10.5h15V9z"
         clipRule="evenodd"
-        d="M7.5 7.5V5.25C7.5 4.05653 7.97411 2.91193 8.81802 2.06802C9.66193 1.22411 10.8065 0.75 12 0.75C13.1935 0.75 14.3381 1.22411 15.182 2.06802C16.0259 2.91193 16.5 4.05653 16.5 5.25V7.5H19.5C20.3284 7.5 21 8.17157 21 9V19.5C21 20.3284 20.3284 21 19.5 21H4.5C3.67157 21 3 20.3284 3 19.5V9C3 8.17157 3.67157 7.5 4.5 7.5H7.5ZM9.87868 3.12868C10.4413 2.56607 11.2044 2.25 12 2.25C12.7956 2.25 13.5587 2.56607 14.1213 3.12868C14.6839 3.69129 15 4.45435 15 5.25V7.5H9V5.25C9 4.45435 9.31607 3.69129 9.87868 3.12868ZM4.5 9V19.5H19.5V9H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Logout.tsx b/web/packages/design/src/Icon/Icons/Logout.tsx
index fac3041b344a7..00fa322ed3a08 100644
--- a/web/packages/design/src/Icon/Icons/Logout.tsx
+++ b/web/packages/design/src/Icon/Icons/Logout.tsx
@@ -59,8 +59,8 @@ export const Logout = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.43934 3.43934C3.72064 3.15804 4.10217 3 4.5 3H9.75C10.1642 3 10.5 3.33579 10.5 3.75C10.5 4.16421 10.1642 4.5 9.75 4.5L4.5 4.5L4.5 19.5H9.75C10.1642 19.5 10.5 19.8358 10.5 20.25C10.5 20.6642 10.1642 21 9.75 21H4.5C4.10218 21 3.72065 20.842 3.43934 20.5607C3.15804 20.2794 3 19.8978 3 19.5V4.5C3 4.10217 3.15804 3.72064 3.43934 3.43934Z" />
-      <path d="M9 12C9 11.5858 9.33579 11.25 9.75 11.25H18.4393L15.9697 8.78033C15.6768 8.48744 15.6768 8.01256 15.9697 7.71967C16.2626 7.42678 16.7374 7.42678 17.0303 7.71967L20.7803 11.4697C20.8522 11.5416 20.9065 11.6245 20.9431 11.7129C20.9751 11.7901 20.9946 11.8738 20.999 11.9614C20.9997 11.9742 21 11.9871 21 12C21 12.1017 20.9798 12.1987 20.9431 12.2871C20.9065 12.3755 20.8522 12.4584 20.7803 12.5303L17.0303 16.2803C16.7374 16.5732 16.2626 16.5732 15.9697 16.2803C15.6768 15.9874 15.6768 15.5126 15.9697 15.2197L18.4393 12.75H9.75C9.33579 12.75 9 12.4142 9 12Z" />
+      <path d="M3.44 3.44A1.5 1.5 0 0 1 4.5 3h5.25a.75.75 0 0 1 0 1.5H4.5v15h5.25a.75.75 0 0 1 0 1.5H4.5A1.5 1.5 0 0 1 3 19.5v-15c0-.398.158-.78.44-1.06" />
+      <path d="M9 12a.75.75 0 0 1 .75-.75h8.69l-2.47-2.47a.75.75 0 0 1 1.06-1.06l3.75 3.75a.75.75 0 0 1 0 1.06l-3.75 3.75a.75.75 0 1 1-1.06-1.06l2.47-2.47H9.75A.75.75 0 0 1 9 12" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Magnifier.tsx b/web/packages/design/src/Icon/Icons/Magnifier.tsx
index 79655e11a879e..5e462d6789143 100644
--- a/web/packages/design/src/Icon/Icons/Magnifier.tsx
+++ b/web/packages/design/src/Icon/Icons/Magnifier.tsx
@@ -61,8 +61,8 @@ export const Magnifier = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.5 2.25a8.25 8.25 0 1 0 5.279 14.59l4.69 4.69a.75.75 0 1 0 1.061-1.06l-4.69-4.69A8.25 8.25 0 0 0 10.5 2.25M3.75 10.5a6.75 6.75 0 1 1 13.5 0 6.75 6.75 0 0 1-13.5 0"
         clipRule="evenodd"
-        d="M10.5 2.25C5.94365 2.25 2.25 5.94365 2.25 10.5C2.25 15.0563 5.94365 18.75 10.5 18.75C12.508 18.75 14.3484 18.0326 15.779 16.8402L20.4695 21.5306C20.7623 21.8235 21.2372 21.8235 21.5301 21.5306C21.823 21.2377 21.823 20.7628 21.5301 20.4699L16.8397 15.7796C18.0324 14.3489 18.75 12.5082 18.75 10.5C18.75 5.94365 15.0563 2.25 10.5 2.25ZM3.75 10.5C3.75 6.77208 6.77208 3.75 10.5 3.75C14.2279 3.75 17.25 6.77208 17.25 10.5C17.25 14.2279 14.2279 17.25 10.5 17.25C6.77208 17.25 3.75 14.2279 3.75 10.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/MagnifyingMinus.tsx b/web/packages/design/src/Icon/Icons/MagnifyingMinus.tsx
index 067bd5da684aa..1c6ba71e57d2a 100644
--- a/web/packages/design/src/Icon/Icons/MagnifyingMinus.tsx
+++ b/web/packages/design/src/Icon/Icons/MagnifyingMinus.tsx
@@ -60,8 +60,8 @@ export const MagnifyingMinus = forwardRef<HTMLSpanElement, IconProps>(
       ref={ref}
     >
       <path
-        d="M9.857 2.28C7.688 2.433 5.6 3.51 4.174 5.211a8.231 8.231 0 0 0 .002 10.578c1.46 1.737 3.441 2.752 5.733 2.939 1.983.161 4.131-.497 5.691-1.742l.18-.144 2.44 2.435c2.681 2.676 2.584 2.594 2.945 2.486.218-.065.533-.38.598-.598.108-.361.19-.264-2.486-2.945l-2.435-2.44.144-.18c1.457-1.825 2.074-4.374 1.614-6.669a8.269 8.269 0 0 0-5.139-6.129c-1.076-.42-2.372-.608-3.604-.522m1.531 1.541a6.733 6.733 0 0 1 5.791 5.791 6.738 6.738 0 0 1-4.374 7.226 6.785 6.785 0 0 1-4.61 0c-2.374-.875-4.052-2.966-4.374-5.45a6.683 6.683 0 0 1 1.917-5.65 6.684 6.684 0 0 1 5.65-1.917M7.092 9.843c-.454.225-.452 1.094.003 1.315.168.081.221.082 3.405.082 3.184 0 3.237-.001 3.405-.082.222-.108.335-.33.335-.658s-.113-.55-.335-.658c-.168-.081-.22-.082-3.408-.082-3.197 0-3.239.001-3.405.083"
         fillRule="evenodd"
+        d="M9.857 2.28C7.688 2.433 5.6 3.51 4.174 5.211a8.23 8.23 0 0 0 .002 10.578c1.46 1.737 3.441 2.752 5.733 2.939 1.983.161 4.131-.497 5.691-1.742l.18-.144 2.44 2.435c2.681 2.676 2.584 2.594 2.945 2.486.218-.065.533-.38.598-.598.108-.361.19-.264-2.486-2.945l-2.435-2.44.144-.18c1.457-1.825 2.074-4.374 1.614-6.669a8.27 8.27 0 0 0-5.139-6.129c-1.076-.42-2.372-.608-3.604-.522m1.531 1.541a6.73 6.73 0 0 1 5.791 5.791 6.74 6.74 0 0 1-4.374 7.226 6.8 6.8 0 0 1-4.61 0c-2.374-.875-4.052-2.966-4.374-5.45a6.68 6.68 0 0 1 1.917-5.65 6.68 6.68 0 0 1 5.65-1.917M7.092 9.843c-.454.225-.452 1.094.003 1.315.168.081.221.082 3.405.082s3.237-.001 3.405-.082c.222-.108.335-.33.335-.658s-.113-.55-.335-.658c-.168-.081-.22-.082-3.408-.082-3.197 0-3.239.001-3.405.083"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/MagnifyingPlus.tsx b/web/packages/design/src/Icon/Icons/MagnifyingPlus.tsx
index f55daafef1397..b2e43307e0155 100644
--- a/web/packages/design/src/Icon/Icons/MagnifyingPlus.tsx
+++ b/web/packages/design/src/Icon/Icons/MagnifyingPlus.tsx
@@ -60,8 +60,8 @@ export const MagnifyingPlus = forwardRef<HTMLSpanElement, IconProps>(
       ref={ref}
     >
       <path
-        d="M9.857 2.28C7.688 2.433 5.6 3.51 4.174 5.211a8.231 8.231 0 0 0 .002 10.578c1.46 1.737 3.441 2.752 5.733 2.939 1.983.161 4.131-.497 5.691-1.742l.18-.144 2.44 2.435c2.681 2.676 2.584 2.594 2.945 2.486.218-.065.533-.38.598-.598.108-.361.19-.264-2.486-2.945l-2.435-2.44.144-.18c1.457-1.825 2.074-4.374 1.614-6.669a8.269 8.269 0 0 0-5.139-6.129c-1.076-.42-2.372-.608-3.604-.522m1.531 1.541a6.733 6.733 0 0 1 5.791 5.791 6.738 6.738 0 0 1-4.374 7.226 6.785 6.785 0 0 1-4.61 0c-2.374-.875-4.052-2.966-4.374-5.45a6.683 6.683 0 0 1 1.917-5.65 6.684 6.684 0 0 1 5.65-1.917m-1.296 3.022a.505.505 0 0 0-.25.253c-.077.16-.082.241-.082 1.417V9.76H8.513c-1.178 0-1.257.005-1.418.082-.457.222-.457 1.094 0 1.316.161.077.24.082 1.418.082H9.76v1.247c0 1.178.005 1.257.082 1.418.222.457 1.094.457 1.316 0 .077-.161.082-.24.082-1.418V11.24h1.247c1.178 0 1.257-.005 1.418-.082.222-.108.335-.33.335-.658s-.113-.55-.335-.658c-.161-.077-.24-.082-1.418-.082H11.24V8.513c0-1.178-.005-1.257-.082-1.418-.155-.318-.68-.443-1.066-.252"
         fillRule="evenodd"
+        d="M9.857 2.28C7.688 2.433 5.6 3.51 4.174 5.211a8.23 8.23 0 0 0 .002 10.578c1.46 1.737 3.441 2.752 5.733 2.939 1.983.161 4.131-.497 5.691-1.742l.18-.144 2.44 2.435c2.681 2.676 2.584 2.594 2.945 2.486.218-.065.533-.38.598-.598.108-.361.19-.264-2.486-2.945l-2.435-2.44.144-.18c1.457-1.825 2.074-4.374 1.614-6.669a8.27 8.27 0 0 0-5.139-6.129c-1.076-.42-2.372-.608-3.604-.522m1.531 1.541a6.73 6.73 0 0 1 5.791 5.791 6.74 6.74 0 0 1-4.374 7.226 6.8 6.8 0 0 1-4.61 0c-2.374-.875-4.052-2.966-4.374-5.45a6.68 6.68 0 0 1 1.917-5.65 6.68 6.68 0 0 1 5.65-1.917m-1.296 3.022a.5.5 0 0 0-.25.253c-.077.16-.082.241-.082 1.417V9.76H8.513c-1.178 0-1.257.005-1.418.082-.457.222-.457 1.094 0 1.316.161.077.24.082 1.418.082H9.76v1.247c0 1.178.005 1.257.082 1.418.222.457 1.094.457 1.316 0 .077-.161.082-.24.082-1.418V11.24h1.247c1.178 0 1.257-.005 1.418-.082.222-.108.335-.33.335-.658s-.113-.55-.335-.658c-.161-.077-.24-.082-1.418-.082H11.24V8.513c0-1.178-.005-1.257-.082-1.418-.155-.318-.68-.443-1.066-.252"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Memory.tsx b/web/packages/design/src/Icon/Icons/Memory.tsx
index 8eb153a6ae295..705e68832889d 100644
--- a/web/packages/design/src/Icon/Icons/Memory.tsx
+++ b/web/packages/design/src/Icon/Icons/Memory.tsx
@@ -61,8 +61,8 @@ export const Memory = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M14.25 1.5a.75.75 0 0 1 .75.75v1.5h3.75a1.5 1.5 0 0 1 1.5 1.5V9h1.5a.75.75 0 0 1 0 1.5h-1.5v3h1.5a.75.75 0 0 1 0 1.5h-1.5v3.75a1.5 1.5 0 0 1-1.5 1.5H15v1.5a.75.75 0 0 1-1.5 0v-1.5h-3v1.5a.75.75 0 0 1-1.5 0v-1.5H5.25a1.5 1.5 0 0 1-1.5-1.5V15h-1.5a.75.75 0 0 1 0-1.5h1.5v-3h-1.5a.75.75 0 0 1 0-1.5h1.5V5.25a1.5 1.5 0 0 1 1.5-1.5H9v-1.5a.75.75 0 0 1 1.5 0v1.5h3v-1.5a.75.75 0 0 1 .75-.75m-4.5 3.75h-4.5v13.5h13.5V5.25zm0 3.75a.75.75 0 0 0-.75.75v4.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 .75-.75v-4.5a.75.75 0 0 0-.75-.75zm.75 4.5v-3h3v3z"
         clipRule="evenodd"
-        d="M14.25 1.5C14.6642 1.5 15 1.83579 15 2.25V3.75H18.75C19.5784 3.75 20.25 4.42157 20.25 5.25V9H21.75C22.1642 9 22.5 9.33579 22.5 9.75C22.5 10.1642 22.1642 10.5 21.75 10.5H20.25V13.5H21.75C22.1642 13.5 22.5 13.8358 22.5 14.25C22.5 14.6642 22.1642 15 21.75 15H20.25V18.75C20.25 19.5784 19.5784 20.25 18.75 20.25H15V21.75C15 22.1642 14.6642 22.5 14.25 22.5C13.8358 22.5 13.5 22.1642 13.5 21.75V20.25H10.5V21.75C10.5 22.1642 10.1642 22.5 9.75 22.5C9.33579 22.5 9 22.1642 9 21.75V20.25H5.25C4.42157 20.25 3.75 19.5784 3.75 18.75V15H2.25C1.83579 15 1.5 14.6642 1.5 14.25C1.5 13.8358 1.83579 13.5 2.25 13.5H3.75V10.5H2.25C1.83579 10.5 1.5 10.1642 1.5 9.75C1.5 9.33579 1.83579 9 2.25 9H3.75V5.25C3.75 4.42157 4.42157 3.75 5.25 3.75H9V2.25C9 1.83579 9.33579 1.5 9.75 1.5C10.1642 1.5 10.5 1.83579 10.5 2.25V3.75H13.5V2.25C13.5 1.83579 13.8358 1.5 14.25 1.5ZM9.75 5.25H5.25V9.75V14.25V18.75H9.75H14.25H18.75V14.25V9.75V5.25H14.25H9.75ZM9.75 9C9.33579 9 9 9.33579 9 9.75V14.25C9 14.6642 9.33579 15 9.75 15H14.25C14.6642 15 15 14.6642 15 14.25V9.75C15 9.33579 14.6642 9 14.25 9H9.75ZM10.5 13.5V10.5H13.5V13.5H10.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Minus.tsx b/web/packages/design/src/Icon/Icons/Minus.tsx
index 97727d7854100..fe0e609c58a9b 100644
--- a/web/packages/design/src/Icon/Icons/Minus.tsx
+++ b/web/packages/design/src/Icon/Icons/Minus.tsx
@@ -59,13 +59,7 @@ export const Minus = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        d="M3.75 12H20.25"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
+      <path stroke="currentColor" d="M3.75 12h16.5" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/MinusCircle.tsx b/web/packages/design/src/Icon/Icons/MinusCircle.tsx
index 11b3d787bae04..dfbcf82397700 100644
--- a/web/packages/design/src/Icon/Icons/MinusCircle.tsx
+++ b/web/packages/design/src/Icon/Icons/MinusCircle.tsx
@@ -59,11 +59,11 @@ export const MinusCircle = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M8.25 11.25C7.83579 11.25 7.5 11.5858 7.5 12C7.5 12.4142 7.83579 12.75 8.25 12.75H15.75C16.1642 12.75 16.5 12.4142 16.5 12C16.5 11.5858 16.1642 11.25 15.75 11.25H8.25Z" />
+      <path d="M8.25 11.25a.75.75 0 0 0 0 1.5h7.5a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ModelContextProtocol.tsx b/web/packages/design/src/Icon/Icons/ModelContextProtocol.tsx
new file mode 100644
index 0000000000000..ef3beaef69127
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/ModelContextProtocol.tsx
@@ -0,0 +1,66 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const ModelContextProtocol = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-modelcontextprotocol"
+      {...otherProps}
+      ref={ref}
+    >
+      <path d="M11.123 2.27a3.963 3.963 0 0 1 5.457.14l.14.148a3.96 3.96 0 0 1 .969 3.287 3.96 3.96 0 0 1 3.287.97l.148.14.047.047.14.148a3.963 3.963 0 0 1 0 5.309l-.14.148-8.22 8.22a.32.32 0 0 0 0 .454l1.689 1.688.05.057a.75.75 0 0 1-1.054 1.055l-.058-.05-1.687-1.69a1.82 1.82 0 0 1 0-2.575l8.22-8.22.168-.187a2.464 2.464 0 0 0 0-3.11l-.168-.187-.047-.047-.188-.169a2.464 2.464 0 0 0-3.11 0l-.18.163-.006.006-6.863 6.865-.058.051a.751.751 0 0 1-1.004-1.112l.087-.088 6.785-6.784.162-.179a2.465 2.465 0 0 0 0-3.11l-.17-.187a2.464 2.464 0 0 0-3.296-.168l-.187.168-9.089 9.09a.75.75 0 0 1-1.06-1.061l9.089-9.09z" />
+      <path d="M13.248 4.683a.75.75 0 0 1 1.06 1.06l-6.72 6.723a2.464 2.464 0 0 0 0 3.484l.186.169a2.465 2.465 0 0 0 3.296-.169l6.722-6.723a.75.75 0 0 1 1.06 1.06l-6.72 6.724a3.964 3.964 0 0 1-5.458.14l-.147-.14a3.964 3.964 0 0 1 0-5.606z" />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Moon.tsx b/web/packages/design/src/Icon/Icons/Moon.tsx
index f6e169b4ae512..7e649b091ddba 100644
--- a/web/packages/design/src/Icon/Icons/Moon.tsx
+++ b/web/packages/design/src/Icon/Icons/Moon.tsx
@@ -61,8 +61,8 @@ export const Moon = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.665 2.105a.75.75 0 0 1 .188.748 8.259 8.259 0 0 0 10.295 10.294.75.75 0 0 1 .934.936A9.75 9.75 0 1 1 9.917 1.918a.75.75 0 0 1 .748.187M9.1 3.85A8.25 8.25 0 1 0 20.15 14.9 9.758 9.758 0 0 1 9.1 3.85"
         clipRule="evenodd"
-        d="M10.665 2.10497C10.8608 2.30045 10.9331 2.58787 10.853 2.85274C10.4208 4.28292 10.3846 5.80356 10.7484 7.25267C11.1122 8.70177 11.8623 10.025 12.9187 11.0815C13.9752 12.138 15.2985 12.8881 16.7476 13.2518C18.1967 13.6156 19.7173 13.5794 21.1475 13.1472C21.4124 13.0672 21.6998 13.1394 21.8953 13.3353C22.0907 13.5311 22.1625 13.8186 22.082 14.0834C21.5921 15.6943 20.6932 17.151 19.4731 18.3114C18.2529 19.4718 16.7531 20.2964 15.1195 20.705C13.486 21.1135 11.7745 21.0921 10.1518 20.6427C8.52899 20.1933 7.05027 19.3313 5.85962 18.1406C4.66896 16.95 3.80696 15.4712 3.35756 13.8485C2.90817 12.2257 2.8867 10.5142 3.29524 8.8807C3.70379 7.24717 4.52843 5.7473 5.68884 4.52715C6.84925 3.307 8.30588 2.40818 9.91686 1.91821C10.1816 1.8377 10.4691 1.90948 10.665 2.10497ZM9.09969 3.84976C8.23365 4.27762 7.44627 4.85585 6.77577 5.56087C5.79389 6.5933 5.09612 7.86243 4.75042 9.24464C4.40473 10.6269 4.42289 12.075 4.80315 13.4481C5.18341 14.8213 5.9128 16.0725 6.92028 17.08C7.92775 18.0874 9.17898 18.8168 10.5521 19.1971C11.9252 19.5773 13.3734 19.5955 14.7556 19.2498C16.1378 18.9041 17.4069 18.2063 18.4394 17.2245C19.1444 16.554 19.7226 15.7666 20.1505 14.9005C18.8984 15.081 17.6183 15.017 16.3823 14.7067C14.67 14.2768 13.1064 13.3905 11.8581 12.1422C10.6097 10.8938 9.72339 9.33019 9.29354 7.61788C8.98327 6.38189 8.91922 5.10185 9.09969 3.84976Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/MoreHoriz.tsx b/web/packages/design/src/Icon/Icons/MoreHoriz.tsx
index 0bf7676adae6b..b63899bd1f511 100644
--- a/web/packages/design/src/Icon/Icons/MoreHoriz.tsx
+++ b/web/packages/design/src/Icon/Icons/MoreHoriz.tsx
@@ -59,9 +59,7 @@ export const MoreHoriz = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M4.5 13.5C5.32843 13.5 6 12.8284 6 12C6 11.1716 5.32843 10.5 4.5 10.5C3.67157 10.5 3 11.1716 3 12C3 12.8284 3.67157 13.5 4.5 13.5Z" />
-      <path d="M12 13.5C12.8284 13.5 13.5 12.8284 13.5 12C13.5 11.1716 12.8284 10.5 12 10.5C11.1716 10.5 10.5 11.1716 10.5 12C10.5 12.8284 11.1716 13.5 12 13.5Z" />
-      <path d="M19.5 13.5C20.3284 13.5 21 12.8284 21 12C21 11.1716 20.3284 10.5 19.5 10.5C18.6716 10.5 18 11.1716 18 12C18 12.8284 18.6716 13.5 19.5 13.5Z" />
+      <path d="M4.5 13.5a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0 0 3m7.5 0a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0 0 3m7.5 0a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0 0 3" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/MoreVert.tsx b/web/packages/design/src/Icon/Icons/MoreVert.tsx
index 8a3856fcc7dbe..242630d7c9c72 100644
--- a/web/packages/design/src/Icon/Icons/MoreVert.tsx
+++ b/web/packages/design/src/Icon/Icons/MoreVert.tsx
@@ -59,9 +59,7 @@ export const MoreVert = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M13.5 4.5C13.5 3.67157 12.8284 3 12 3C11.1716 3 10.5 3.67157 10.5 4.5C10.5 5.32843 11.1716 6 12 6C12.8284 6 13.5 5.32843 13.5 4.5Z" />
-      <path d="M13.5 12C13.5 11.1716 12.8284 10.5 12 10.5C11.1716 10.5 10.5 11.1716 10.5 12C10.5 12.8284 11.1716 13.5 12 13.5C12.8284 13.5 13.5 12.8284 13.5 12Z" />
-      <path d="M13.5 19.5C13.5 18.6716 12.8284 18 12 18C11.1716 18 10.5 18.6716 10.5 19.5C10.5 20.3284 11.1716 21 12 21C12.8284 21 13.5 20.3284 13.5 19.5Z" />
+      <path d="M13.5 4.5a1.5 1.5 0 1 0-3 0 1.5 1.5 0 0 0 3 0m0 7.5a1.5 1.5 0 1 0-3 0 1.5 1.5 0 0 0 3 0m0 7.5a1.5 1.5 0 1 0-3 0 1.5 1.5 0 0 0 3 0" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Mute.tsx b/web/packages/design/src/Icon/Icons/Mute.tsx
index ee416e148204c..70d45f1945925 100644
--- a/web/packages/design/src/Icon/Icons/Mute.tsx
+++ b/web/packages/design/src/Icon/Icons/Mute.tsx
@@ -61,8 +61,8 @@ export const Mute = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M14.58 2.326A.75.75 0 0 1 15 3v7.015a.75.75 0 0 1-1.5 0V4.533l-2.526 1.964a.75.75 0 0 1-.92-1.184l3.736-2.905a.75.75 0 0 1 .79-.082m-9.525.92a.75.75 0 0 0-1.11 1.009L6.895 7.5H3A1.5 1.5 0 0 0 1.5 9v6A1.5 1.5 0 0 0 3 16.5h4.243l6.547 5.092A.75.75 0 0 0 15 21v-4.585l3.945 4.34a.75.75 0 0 0 1.11-1.01l-5.241-5.765-.018-.02-6.089-6.697-.027-.03zM6.75 9H3v6h3.75zm1.5 6.383 5.25 4.083v-4.701L8.25 8.99zm9.254-5.926a.75.75 0 0 1 1.059.067 3.75 3.75 0 0 1 0 4.957.75.75 0 1 1-1.126-.992 2.25 2.25 0 0 0 0-2.974.75.75 0 0 1 .067-1.058M21.34 7a.75.75 0 1 0-1.117 1 6 6 0 0 1 0 8 .75.75 0 1 0 1.117 1 7.5 7.5 0 0 0 0-10"
         clipRule="evenodd"
-        d="M14.5794 2.32628C14.8367 2.45214 14.9999 2.71356 14.9999 3.00001V10.0153C14.9999 10.4295 14.6641 10.7653 14.2499 10.7653C13.8357 10.7653 13.4999 10.4295 13.4999 10.0153V4.53335L10.9744 6.49736C10.6474 6.75165 10.1762 6.69271 9.9219 6.36573C9.66762 6.03876 9.72656 5.56755 10.0535 5.31327L13.7895 2.40796C14.0156 2.23212 14.3221 2.20042 14.5794 2.32628ZM5.05496 3.2455C4.77633 2.93901 4.30199 2.91642 3.9955 3.19505C3.68901 3.47368 3.66642 3.94802 3.94505 4.25451L6.89535 7.49984H3C2.60217 7.49984 2.22064 7.65788 1.93934 7.93918C1.65804 8.22048 1.5 8.60201 1.5 8.99984V14.9998C1.5 15.3977 1.65803 15.7792 1.93934 16.0605C2.22065 16.3418 2.60218 16.4998 3 16.4998H7.24267L13.7895 21.5919C14.0157 21.7677 14.3222 21.7994 14.5795 21.6736C14.8368 21.5477 15 21.2863 15 20.9998V16.415L18.945 20.7545C19.2237 21.061 19.698 21.0836 20.0045 20.805C20.311 20.5263 20.3336 20.052 20.055 19.7455L14.8138 13.9802C14.8081 13.9737 14.8022 13.9672 14.7962 13.9609L8.70722 7.26298C8.69837 7.25272 8.68931 7.24275 8.68003 7.23307L5.05496 3.2455ZM6.75 8.99984H3V14.9998H6.75V8.99984ZM8.25 15.383L13.5 19.4664V14.765L8.25 8.98996V15.383ZM17.5043 9.45671C17.8151 9.18294 18.2891 9.21299 18.5628 9.52384C19.166 10.2086 19.4987 11.0898 19.4987 12.0024C19.4987 12.9149 19.166 13.7961 18.5628 14.4809C18.2891 14.7917 17.8151 14.8218 17.5043 14.548C17.1935 14.2742 17.1634 13.8003 17.4372 13.4895C17.799 13.0786 17.9987 12.5499 17.9987 12.0024C17.9987 11.4548 17.799 10.9261 17.4372 10.5152C17.1634 10.2044 17.1935 9.73048 17.5043 9.45671ZM21.3405 7.00001C21.0644 6.69127 20.5902 6.66485 20.2815 6.94099C19.9728 7.21713 19.9463 7.69127 20.2225 8.00001C21.2064 9.10005 21.7503 10.5241 21.7503 12C21.7503 13.4759 21.2064 14.9 20.2225 16C19.9463 16.3087 19.9728 16.7829 20.2815 17.059C20.5902 17.3352 21.0644 17.3087 21.3405 17C22.5704 15.625 23.2503 13.8448 23.2503 12C23.2503 10.1552 22.5704 8.37506 21.3405 7.00001Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/NewTab.tsx b/web/packages/design/src/Icon/Icons/NewTab.tsx
index 6f45612a8f486..c23169dadfce5 100644
--- a/web/packages/design/src/Icon/Icons/NewTab.tsx
+++ b/web/packages/design/src/Icon/Icons/NewTab.tsx
@@ -61,8 +61,8 @@ export const NewTab = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M13.5 3.75a.75.75 0 0 1 .75-.75h5.962a.75.75 0 0 1 .787.787L21 9.75a.75.75 0 0 1-1.5 0V5.561l-6.22 6.22a.75.75 0 1 1-1.06-1.061l6.219-6.22h-4.19a.75.75 0 0 1-.749-.75M4.5 6A1.5 1.5 0 0 0 3 7.5v12A1.5 1.5 0 0 0 4.5 21h12a1.5 1.5 0 0 0 1.5-1.5v-6.75a.75.75 0 0 0-1.5 0v6.75h-12v-12h6.75a.75.75 0 0 0 0-1.5z"
         clipRule="evenodd"
-        d="M13.5 3.74988C13.5001 3.33567 13.8359 2.99994 14.2501 3L20.2125 3.00093C20.4167 2.99077 20.6243 3.06369 20.7803 3.21967C20.9363 3.37565 21.0092 3.58324 20.9991 3.78747L21 9.74988C21.0001 10.1641 20.6643 10.4999 20.2501 10.5C19.8359 10.5001 19.5001 10.1643 19.5 9.75012L19.4993 5.56132L13.2803 11.7803C12.9874 12.0732 12.5126 12.0732 12.2197 11.7803C11.9268 11.4874 11.9268 11.0126 12.2197 10.7197L18.4387 4.50065L14.2499 4.5C13.8357 4.49994 13.4999 4.1641 13.5 3.74988ZM4.5 6C4.10217 6 3.72064 6.15804 3.43934 6.43934C3.15804 6.72064 3 7.10217 3 7.5V19.5C3 19.8978 3.15804 20.2794 3.43934 20.5607C3.72065 20.842 4.10218 21 4.5 21H16.5C16.8978 21 17.2794 20.842 17.5607 20.5607C17.842 20.2794 18 19.8978 18 19.5V12.75C18 12.3358 17.6642 12 17.25 12C16.8358 12 16.5 12.3358 16.5 12.75V19.5H4.5L4.5 7.5H11.25C11.6642 7.5 12 7.16421 12 6.75C12 6.33579 11.6642 6 11.25 6H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/NoteAdded.tsx b/web/packages/design/src/Icon/Icons/NoteAdded.tsx
index b0d27da43eb6b..a1f09c8dbdc9e 100644
--- a/web/packages/design/src/Icon/Icons/NoteAdded.tsx
+++ b/web/packages/design/src/Icon/Icons/NoteAdded.tsx
@@ -59,11 +59,11 @@ export const NoteAdded = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9 14.25C9 13.8358 9.33579 13.5 9.75 13.5H11.25V12C11.25 11.5858 11.5858 11.25 12 11.25C12.4142 11.25 12.75 11.5858 12.75 12V13.5H14.25C14.6642 13.5 15 13.8358 15 14.25C15 14.6642 14.6642 15 14.25 15H12.75V16.5C12.75 16.9142 12.4142 17.25 12 17.25C11.5858 17.25 11.25 16.9142 11.25 16.5V15H9.75C9.33579 15 9 14.6642 9 14.25Z" />
+      <path d="M9 14.25a.75.75 0 0 1 .75-.75h1.5V12a.75.75 0 0 1 1.5 0v1.5h1.5a.75.75 0 0 1 0 1.5h-1.5v1.5a.75.75 0 0 1-1.5 0V15h-1.5a.75.75 0 0 1-.75-.75" />
       <path
         fillRule="evenodd"
+        d="M5.25 2.25a1.5 1.5 0 0 0-1.5 1.5v16.5a1.5 1.5 0 0 0 1.5 1.5h13.5a1.5 1.5 0 0 0 1.5-1.5v-12a.75.75 0 0 0-.212-.522l-.008-.008-5.25-5.25a.75.75 0 0 0-.53-.22zm8.25 1.5H5.25v16.5h13.5V9h-4.5a.75.75 0 0 1-.75-.75zm4.19 3.75L15 4.81V7.5z"
         clipRule="evenodd"
-        d="M5.25 2.25C4.85217 2.25 4.47064 2.40804 4.18934 2.68934C3.90804 2.97064 3.75 3.35217 3.75 3.75V20.25C3.75 20.6478 3.90804 21.0294 4.18934 21.3107C4.47065 21.592 4.85218 21.75 5.25 21.75H18.75C19.1478 21.75 19.5294 21.592 19.8107 21.3107C20.092 21.0294 20.25 20.6478 20.25 20.25V8.25C20.25 8.047 20.1693 7.86283 20.0383 7.7278L20.0303 7.71967L14.7807 2.47004C14.6401 2.32939 14.4489 2.25 14.25 2.25H5.25ZM13.5 3.75L5.25 3.75L5.25 20.25H18.75V9H14.25C13.8358 9 13.5 8.66421 13.5 8.25V3.75ZM17.6893 7.5L15 4.81066V7.5H17.6893Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Notification.tsx b/web/packages/design/src/Icon/Icons/Notification.tsx
index 46e2747a18167..18d407d37a970 100644
--- a/web/packages/design/src/Icon/Icons/Notification.tsx
+++ b/web/packages/design/src/Icon/Icons/Notification.tsx
@@ -61,8 +61,8 @@ export const Notification = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M8.326 18.75h-3.83a1.5 1.5 0 0 1-1.29-2.25c.53-.918 1.294-3.475 1.294-6.75a7.5 7.5 0 0 1 15 0c0 3.276.764 5.831 1.296 6.75a1.5 1.5 0 0 1-.545 2.047 1.5 1.5 0 0 1-.748.203h-3.829a3.75 3.75 0 0 1-7.348 0M7.757 5.507A6 6 0 0 1 18 9.75c0 3.44.791 6.28 1.497 7.5H4.504C5.21 16.03 6 13.189 6 9.75a6 6 0 0 1 1.757-4.243M9.88 18.75a2.251 2.251 0 0 0 4.242 0z"
         clipRule="evenodd"
-        d="M8.32575 18.75H4.49537C4.23284 18.7484 3.97531 18.6779 3.74854 18.5457C3.52176 18.4134 3.33368 18.2239 3.2031 17.9961C3.07252 17.7683 3.004 17.5103 3.0044 17.2477C3.0048 16.9852 3.0741 16.7274 3.20537 16.5C3.73611 15.5819 4.49988 13.0252 4.49988 9.75C4.49988 7.76088 5.29006 5.85322 6.69658 4.4467C8.10311 3.04018 10.0108 2.25 11.9999 2.25C13.989 2.25 15.8967 3.04018 17.3032 4.4467C18.7097 5.85322 19.4999 7.76088 19.4999 9.75C19.4999 13.026 20.2644 15.5812 20.7958 16.4992C20.9273 16.7269 20.997 16.9858 20.9972 17.2487C20.9975 17.5115 20.9286 17.7698 20.7976 17.9977C20.6666 18.2256 20.478 18.415 20.2507 18.5471C20.0234 18.6791 19.7654 18.7491 19.5025 18.75L19.4999 18.75H15.6743C15.5283 19.4651 15.1754 20.1279 14.6517 20.6516C13.9484 21.3549 12.9946 21.75 12 21.75C11.0054 21.75 10.0516 21.3549 9.34835 20.6516C8.82456 20.1279 8.47173 19.4651 8.32575 18.75ZM7.75724 5.50736C8.88246 4.38214 10.4086 3.75 11.9999 3.75C13.5912 3.75 15.1173 4.38214 16.2425 5.50736C17.3677 6.63258 17.9999 8.1587 17.9999 9.75C17.9999 13.1895 18.7913 16.0301 19.4972 17.25L15.0025 17.25L15 17.25L14.9975 17.25L9.00162 17.25L9 17.25L8.99838 17.25L4.5044 17.25C5.20924 16.0304 5.99988 13.1888 5.99988 9.75C5.99988 8.1587 6.63203 6.63258 7.75724 5.50736ZM9.87868 18.75C9.9895 19.0634 10.1695 19.3514 10.409 19.591C10.831 20.0129 11.4033 20.25 12 20.25C12.5967 20.25 13.169 20.0129 13.591 19.591C13.8305 19.3514 14.0105 19.0634 14.1213 18.75H9.87868Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/NotificationsActive.tsx b/web/packages/design/src/Icon/Icons/NotificationsActive.tsx
index 1dc75203c3169..b25bb32ef9041 100644
--- a/web/packages/design/src/Icon/Icons/NotificationsActive.tsx
+++ b/web/packages/design/src/Icon/Icons/NotificationsActive.tsx
@@ -59,13 +59,13 @@ export const NotificationsActive = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M17.6535 1.61784C17.3043 1.39503 16.8406 1.49748 16.6178 1.84667C16.395 2.19586 16.4975 2.65955 16.8467 2.88235C18.1822 3.73448 19.2653 4.9284 19.9839 6.34027C20.1717 6.70942 20.6233 6.85638 20.9925 6.66851C21.3616 6.48064 21.5086 6.02908 21.3207 5.65992C20.4808 4.00954 19.2146 2.61393 17.6535 1.61784Z" />
+      <path d="M17.654 1.618a.75.75 0 1 0-.807 1.264 8.9 8.9 0 0 1 3.137 3.458.75.75 0 1 0 1.337-.68 10.4 10.4 0 0 0-3.668-4.042" />
       <path
         fillRule="evenodd"
+        d="M8.326 18.75h-3.83a1.5 1.5 0 0 1-1.29-2.25c.548-.949 1.294-2.767 1.294-6a7.5 7.5 0 0 1 15 0c0 3.233.747 5.05 1.296 6a1.5 1.5 0 0 1-.545 2.047 1.5 1.5 0 0 1-.748.203h-3.829a3.749 3.749 0 0 1-7.348 0m.676-1.5H4.504C5.192 16.061 6 13.982 6 10.5a6 6 0 1 1 12 0c0 3.482.809 5.56 1.497 6.75zm5.12 1.5a2.25 2.25 0 0 1-4.243 0z"
         clipRule="evenodd"
-        d="M8.32575 18.75H4.49537C4.23284 18.7484 3.97531 18.6779 3.74853 18.5457C3.52176 18.4134 3.33368 18.2239 3.2031 17.9961C3.07251 17.7683 3.004 17.5103 3.0044 17.2477C3.0048 16.9852 3.0741 16.7274 3.20537 16.5C3.75374 15.5514 4.49988 13.7325 4.49988 10.5C4.49988 8.51088 5.29006 6.60322 6.69658 5.1967C8.1031 3.79018 10.0108 3 11.9999 3C13.989 3 15.8967 3.79018 17.3032 5.1967C18.7097 6.60322 19.4999 8.51088 19.4999 10.5C19.4999 13.7333 20.2467 15.5507 20.7958 16.4992C20.9273 16.7269 20.997 16.9858 20.9972 17.2487C20.9975 17.5115 20.9286 17.7698 20.7976 17.9977C20.6666 18.2256 20.478 18.415 20.2507 18.5471C20.0234 18.6791 19.7654 18.7491 19.5025 18.75L19.4999 18.75H15.6742C15.5283 19.4651 15.1754 20.1279 14.6516 20.6516C13.9484 21.3549 12.9946 21.75 12 21.75C11.0054 21.75 10.0516 21.3549 9.34835 20.6516C8.82456 20.1279 8.47173 19.4651 8.32575 18.75ZM9.00162 17.25L9 17.25L8.99838 17.25L4.5044 17.25C5.19161 16.0611 5.99988 13.9815 5.99988 10.5C5.99988 8.9087 6.63202 7.38258 7.75724 6.25736C8.88246 5.13214 10.4086 4.5 11.9999 4.5C13.5912 4.5 15.1173 5.13214 16.2425 6.25736C17.3677 7.38258 17.9999 8.9087 17.9999 10.5C17.9999 13.9822 18.809 16.0609 19.4972 17.25L15.0025 17.25L15 17.25L14.9975 17.25L9.00162 17.25ZM14.1213 18.75C14.0105 19.0634 13.8305 19.3514 13.591 19.591C13.169 20.0129 12.5967 20.25 12 20.25C11.4033 20.25 10.831 20.0129 10.409 19.591C10.1695 19.3514 9.9895 19.0634 9.87868 18.75H14.1213Z"
       />
-      <path d="M7.38226 1.84667C7.60507 2.19586 7.50261 2.65955 7.15343 2.88235C5.81794 3.73448 4.73476 4.9284 4.01623 6.34027C3.82836 6.70942 3.3768 6.85638 3.00764 6.66851C2.63849 6.48064 2.49153 6.02908 2.6794 5.65992C3.51931 4.00954 4.78548 2.61393 6.34658 1.61784C6.69577 1.39503 7.15946 1.49748 7.38226 1.84667Z" />
+      <path d="M7.382 1.847a.75.75 0 0 1-.229 1.035A8.9 8.9 0 0 0 4.016 6.34a.75.75 0 0 1-1.337-.68 10.4 10.4 0 0 1 3.668-4.042.75.75 0 0 1 1.035.229" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/PaperPlane.tsx b/web/packages/design/src/Icon/Icons/PaperPlane.tsx
index 8d1129da5d3f7..b2e8b2841c689 100644
--- a/web/packages/design/src/Icon/Icons/PaperPlane.tsx
+++ b/web/packages/design/src/Icon/Icons/PaperPlane.tsx
@@ -61,8 +61,8 @@ export const PaperPlane = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M20.628 2.3a1.5 1.5 0 0 0-.786.007l-.014.004L1.834 7.768a1.5 1.5 0 0 0-.227 2.797l8.026 3.8.001.001 3.801 8.025a1.5 1.5 0 0 0 2.797-.227L21.69 4.172l.004-.014A1.5 1.5 0 0 0 20.628 2.3M11.1 13.96l3.69 7.789.004-.014L20.249 3.75 2.263 9.205l-.014.004 7.792 3.69 4.429-4.43a.75.75 0 0 1 1.06 1.061z"
         clipRule="evenodd"
-        d="M20.6279 2.29962C20.3699 2.23228 20.0987 2.2349 19.8421 2.30721L19.8279 2.31136L1.83369 7.76774C1.5431 7.85153 1.28455 8.02123 1.09204 8.25465C0.89774 8.49025 0.779978 8.77955 0.754498 9.08387C0.729019 9.3882 0.797037 9.69305 0.94946 9.95768C1.10187 10.2223 1.33142 10.4341 1.60742 10.5648L9.63261 14.3646C9.63307 14.365 9.63352 14.3655 9.63398 14.366C9.63382 14.3658 9.63413 14.3661 9.63398 14.366L13.4352 22.3906C13.5658 22.6666 13.7776 22.8962 14.0423 23.0486C14.3069 23.201 14.6118 23.2691 14.9161 23.2436C15.2204 23.2181 15.5097 23.1003 15.7453 22.906C15.9787 22.7135 16.1484 22.455 16.2322 22.1644L21.6886 4.17206L21.6928 4.15783C21.7651 3.90125 21.7677 3.63002 21.7003 3.37209C21.633 3.11415 21.4981 2.87882 21.3096 2.69032C21.1211 2.50181 20.8858 2.36695 20.6279 2.29962ZM11.1013 13.9593L14.7909 21.7487L14.795 21.7349L20.2488 3.7512L2.26319 9.20495L2.24927 9.20902L10.041 12.8983L14.4696 8.46967C14.7625 8.17678 15.2374 8.17678 15.5303 8.46967C15.8232 8.76256 15.8232 9.23744 15.5303 9.53033L11.1013 13.9593Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Password.tsx b/web/packages/design/src/Icon/Icons/Password.tsx
index 581b73f8d4324..cdec6727d9525 100644
--- a/web/packages/design/src/Icon/Icons/Password.tsx
+++ b/web/packages/design/src/Icon/Icons/Password.tsx
@@ -59,9 +59,7 @@ export const Password = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M3.75 4.5C4.16421 4.5 4.5 4.83579 4.5 5.25V18.75C4.5 19.1642 4.16421 19.5 3.75 19.5C3.33579 19.5 3 19.1642 3 18.75V5.25C3 4.83579 3.33579 4.5 3.75 4.5Z" />
-      <path d="M9.75 8.25C10.1642 8.25 10.5 8.58579 10.5 9V10.9673L12.3712 10.3592C12.7651 10.2312 13.1883 10.4467 13.3163 10.8406C13.4443 11.2346 13.2288 11.6577 12.8348 11.7857L10.9633 12.394L12.1203 13.9864C12.3637 14.3215 12.2894 14.7905 11.9543 15.034C11.6192 15.2775 11.1502 15.2032 10.9067 14.8681L9.74994 13.2759L8.59315 14.8681C8.34968 15.2032 7.88065 15.2775 7.54555 15.034C7.21044 14.7905 7.13615 14.3215 7.37962 13.9864L8.53661 12.3939L6.66536 11.7857C6.27143 11.6577 6.05587 11.2346 6.1839 10.8406C6.31193 10.4467 6.73506 10.2312 7.12899 10.3592L9 10.9673V9C9 8.58579 9.33579 8.25 9.75 8.25Z" />
-      <path d="M19.5 9C19.5 8.58579 19.1642 8.25 18.75 8.25C18.3358 8.25 18 8.58579 18 9V10.9673L16.129 10.3592C15.7351 10.2312 15.3119 10.4467 15.1839 10.8406C15.0559 11.2346 15.2714 11.6577 15.6654 11.7857L17.5366 12.3939L16.3796 13.9864C16.1361 14.3215 16.2104 14.7905 16.5455 15.034C16.8807 15.2775 17.3497 15.2032 17.5931 14.8681L18.7499 13.2759L19.9067 14.8681C20.1502 15.2032 20.6192 15.2775 20.9543 15.034C21.2894 14.7905 21.3637 14.3215 21.1203 13.9864L19.9633 12.394L21.8348 11.7857C22.2288 11.6577 22.4443 11.2346 22.3163 10.8406C22.1883 10.4467 21.7651 10.2312 21.3712 10.3592L19.5 10.9673V9Z" />
+      <path d="M3.75 4.5a.75.75 0 0 1 .75.75v13.5a.75.75 0 0 1-1.5 0V5.25a.75.75 0 0 1 .75-.75m6 3.75a.75.75 0 0 1 .75.75v1.967l1.871-.608a.75.75 0 1 1 .464 1.427l-1.872.608 1.157 1.592a.75.75 0 0 1-1.213.882L9.75 13.276l-1.157 1.592a.75.75 0 1 1-1.213-.882l1.157-1.592-1.872-.608a.75.75 0 1 1 .464-1.427L9 10.967V9a.75.75 0 0 1 .75-.75M19.5 9A.75.75 0 0 0 18 9v1.967l-1.871-.608a.75.75 0 1 0-.464 1.427l1.872.608-1.157 1.592a.75.75 0 1 0 1.213.882l1.157-1.592 1.157 1.592a.75.75 0 0 0 1.213-.882l-1.157-1.592 1.872-.608a.75.75 0 1 0-.464-1.427l-1.871.608z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Pause.tsx b/web/packages/design/src/Icon/Icons/Pause.tsx
new file mode 100644
index 0000000000000..c4b928266348f
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/Pause.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const Pause = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-pause"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M5.25 3a1.5 1.5 0 0 0-1.5 1.5v15a1.5 1.5 0 0 0 1.5 1.5H9a1.5 1.5 0 0 0 1.5-1.5v-15A1.5 1.5 0 0 0 9 3zm0 1.5H9v15H5.25zM15 3a1.5 1.5 0 0 0-1.5 1.5v15A1.5 1.5 0 0 0 15 21h3.75a1.5 1.5 0 0 0 1.5-1.5v-15a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h3.75v15H15z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Pencil.tsx b/web/packages/design/src/Icon/Icons/Pencil.tsx
index e3662f001f29c..2cecb9879c436 100644
--- a/web/packages/design/src/Icon/Icons/Pencil.tsx
+++ b/web/packages/design/src/Icon/Icons/Pencil.tsx
@@ -61,8 +61,8 @@ export const Pencil = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M16.06 2.25a1.5 1.5 0 0 0-1.06.439l-2.772 2.773-.016.016-8.773 8.773A1.5 1.5 0 0 0 3 15.31v4.19A1.5 1.5 0 0 0 4.5 21h4.19a1.5 1.5 0 0 0 1.06-.44l8.746-8.749a1 1 0 0 0 .066-.066l2.75-2.75a1.5 1.5 0 0 0-.001-2.12l-4.19-4.187a1.5 1.5 0 0 0-1.06-.439M18 10.188l2.251-2.251-4.19-4.187L13.81 6zm-5.25-3.127L4.5 15.31v4.19h4.19l8.248-8.252z"
         clipRule="evenodd"
-        d="M16.0608 2.25C15.6631 2.25 15.2817 2.4079 15.0005 2.68899L12.2278 5.46169C12.2251 5.46432 12.2224 5.46698 12.2197 5.46967C12.217 5.47235 12.2143 5.47505 12.2117 5.47777L3.43875 14.2507C3.15798 14.5318 3.00018 14.9131 3 15.3104V19.5001C3 19.8979 3.15804 20.2795 3.43934 20.5608C3.72065 20.8421 4.10218 21.0001 4.5 21.0001H8.69003C9.08733 20.9999 9.46868 20.8418 9.74977 20.561L18.4964 11.8123C18.508 11.802 18.5193 11.7914 18.5303 11.7803C18.5414 11.7692 18.5521 11.7579 18.5624 11.7463L21.3111 8.99684C21.5922 8.71556 21.7501 8.33418 21.7501 7.93653C21.7501 7.53887 21.5919 7.15714 21.3108 6.87586L17.1211 2.68899C16.8398 2.4079 16.4584 2.25 16.0608 2.25ZM17.9989 10.1883L20.2501 7.93653L16.0608 3.75L13.8107 6.00006L17.9989 10.1883ZM12.7501 7.06072L4.5 15.3108V19.5001L8.68934 19.5001L16.9384 11.2491L12.7501 7.06072Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Planet.tsx b/web/packages/design/src/Icon/Icons/Planet.tsx
index 886b8f17b68ef..b2100b6f7d111 100644
--- a/web/packages/design/src/Icon/Icons/Planet.tsx
+++ b/web/packages/design/src/Icon/Icons/Planet.tsx
@@ -61,8 +61,8 @@ export const Planet = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.073 13.151A9 9 0 0 1 17.5 4.876c1.166-.285 2.232-.42 3.116-.363.944.06 1.89.357 2.364 1.175.434.747.292 1.62-.047 2.394-.347.792-.963 1.643-1.759 2.502q-.12.13-.247.262.072.567.073 1.154a9 9 0 0 1-14.499 7.125q-.165.04-.325.076c-1.145.256-2.194.361-3.055.263-.842-.095-1.669-.41-2.101-1.157-.477-.822-.26-1.792.164-2.64.396-.794 1.052-1.65 1.889-2.516M4.5 12a7.5 7.5 0 0 1 14.814-1.667c-1.452 1.383-3.462 2.872-5.824 4.23-2.372 1.362-4.682 2.352-6.617 2.91A7.5 7.5 0 0 1 4.5 12m-1.013 2.93c-.43.515-.753.99-.961 1.407-.351.703-.299 1.063-.209 1.218l.001.001c.083.143.324.344.973.418.491.056 1.127.025 1.886-.104a9 9 0 0 1-1.69-2.94m4.893 3.64a7.5 7.5 0 0 0 11.118-6.38c-1.444 1.245-3.241 2.513-5.26 3.673-2.032 1.167-4.045 2.085-5.858 2.707m12.132-9.501c.499-.597.848-1.134 1.047-1.588.26-.594.205-.9.124-1.04-.09-.156-.38-.381-1.163-.431-.466-.03-1.036.009-1.697.121a9 9 0 0 1 1.689 2.938"
         clipRule="evenodd"
-        d="M3.07291 13.151C3.0248 12.7741 3 12.39 3 12C3 7.02944 7.02944 3 12 3C14.0713 3 15.9791 3.69968 17.5001 4.87559C18.6664 4.59121 19.732 4.45624 20.6157 4.51258C21.5599 4.57278 22.5052 4.87021 22.9799 5.68803C23.414 6.43544 23.272 7.30721 22.9328 8.08227C22.5863 8.87401 21.9697 9.72516 21.1745 10.5842C21.094 10.6711 21.0114 10.7584 20.9267 10.8461C20.9751 11.2239 21 11.6091 21 12C21 16.9706 16.9706 21 12 21C9.92928 21 8.02189 20.3007 6.50113 19.1253C6.39144 19.1521 6.28292 19.1774 6.17563 19.2014C5.03068 19.4569 3.98244 19.5621 3.12127 19.4643C2.27865 19.3685 1.4521 19.0548 1.01976 18.3074C0.543 17.4851 0.760104 16.5151 1.18372 15.667C1.58028 14.873 2.23596 14.0179 3.07291 13.151ZM4.5 12C4.5 7.85786 7.85786 4.5 12 4.5C15.5693 4.5 18.5562 6.99331 19.3141 10.3333C17.8616 11.7163 15.852 13.2054 13.4901 14.5623C11.1183 15.9249 8.80804 16.9151 6.87298 17.4739C5.71601 16.3899 4.90291 14.9432 4.61494 13.3152C4.61212 13.2929 4.60831 13.2708 4.60349 13.2487C4.53543 12.8426 4.5 12.4255 4.5 12ZM3.48749 14.9294C3.05639 15.4448 2.73445 15.9192 2.52564 16.3372C2.1747 17.0399 2.22727 17.3996 2.31746 17.5551L2.31807 17.5561C2.40053 17.6988 2.64212 17.9002 3.29064 17.9739C3.78234 18.0297 4.41766 17.9987 5.17744 17.8699C4.44092 17.0146 3.86248 16.0193 3.48749 14.9294ZM8.37965 18.5699C9.45301 19.1627 10.6871 19.5 12 19.5C16.0788 19.5 19.3971 16.244 19.4977 12.1895C18.0536 13.4349 16.257 14.7026 14.2373 15.8629C12.2061 17.0299 10.1933 17.9481 8.37965 18.5699ZM20.5118 9.06853C21.0108 8.47226 21.3596 7.93549 21.5586 7.48085C21.8187 6.88664 21.764 6.58117 21.6827 6.44132C21.5921 6.28508 21.3039 6.0595 20.5203 6.00954C20.0544 5.97984 19.4836 6.01894 18.8234 6.13106C19.559 6.98558 20.1369 7.9798 20.5118 9.06853Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Play.tsx b/web/packages/design/src/Icon/Icons/Play.tsx
new file mode 100644
index 0000000000000..bb793099541b2
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/Play.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const Play = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-play"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M6.776 2.439a1.5 1.5 0 0 1 1.502.032l.002.001 13.505 8.26h.002a1.483 1.483 0 0 1 0 2.536l-.002.001L8.28 21.53h-.002A1.499 1.499 0 0 1 6 20.276V3.725a1.5 1.5 0 0 1 .776-1.286M7.5 3.753 20.985 12 7.5 20.247z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Plugs.tsx b/web/packages/design/src/Icon/Icons/Plugs.tsx
index cfeab94172415..4fa8ffb3fee4e 100644
--- a/web/packages/design/src/Icon/Icons/Plugs.tsx
+++ b/web/packages/design/src/Icon/Icons/Plugs.tsx
@@ -59,16 +59,7 @@ export const Plugs = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M23.7489 0.251054C24.0837 0.585793 24.0837 1.12851 23.7489 1.46325L20.7085 4.50371L21.2845 5.07893C21.9274 5.72191 22.2891 6.59439 22.2891 7.50367C22.2891 8.41295 21.9279 9.285 21.2849 9.92798L18.784 12.4289L19.4635 13.1083C19.7982 13.4431 19.7982 13.9858 19.4635 14.3205C19.1287 14.6553 18.586 14.6553 18.2513 14.3205L16.9808 13.0501C16.9757 13.0452 16.9706 13.0402 16.9655 13.0352C16.9605 13.0301 16.9555 13.025 16.9506 13.0199L10.9808 7.05008C10.9756 7.04517 10.9705 7.04018 10.9655 7.03511C10.9604 7.03005 10.9554 7.02493 10.9505 7.01977L9.67973 5.74901C9.34499 5.41427 9.34499 4.87156 9.67973 4.53682C10.0145 4.20208 10.5572 4.20208 10.8919 4.53682L11.5717 5.21663L14.0732 2.71518C14.716 2.07355 15.5871 1.71319 16.4954 1.71319C17.4036 1.71319 18.2747 2.07355 18.9175 2.71518L19.4955 3.29233L22.5367 0.251054C22.8715 -0.0836847 23.4142 -0.0836848 23.7489 0.251054ZM18.8363 5.05681L17.7064 3.92849C17.3851 3.60777 16.9494 3.42749 16.4954 3.42749C16.0414 3.42749 15.6059 3.60758 15.2845 3.92823L12.7839 6.42883L17.5718 11.2167L20.0727 8.71583C20.3941 8.39434 20.5748 7.9583 20.5748 7.50367C20.5748 7.04903 20.3942 6.613 20.0727 6.29151L18.9441 5.16446C18.9246 5.14816 18.9057 5.13087 18.8874 5.11258C18.8694 5.09457 18.8524 5.07596 18.8363 5.05681Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M4.53682 9.67973C4.87156 9.34499 5.41427 9.34499 5.74901 9.67973L7.71437 11.6451L9.67973 9.67973C10.0145 9.34499 10.5572 9.34499 10.8919 9.67973C11.2267 10.0145 11.2267 10.5572 10.8919 10.8919L8.92657 12.8573L11.143 15.0737L13.1083 13.1083C13.4431 12.7736 13.9858 12.7736 14.3205 13.1083C14.6553 13.4431 14.6553 13.9858 14.3205 14.3205L12.3552 16.2859L14.3205 18.2513C14.6553 18.586 14.6553 19.1287 14.3205 19.4635C13.9858 19.7982 13.4431 19.7982 13.1083 19.4635L12.4286 18.7837L9.92744 21.2849C9.28446 21.9278 8.4124 22.2891 7.50311 22.2891C6.59383 22.2891 5.72178 21.9279 5.0788 21.2849L4.50343 20.7088L1.46325 23.7489C1.12851 24.0837 0.585793 24.0837 0.251054 23.7489C-0.0836848 23.4142 -0.0836847 22.8715 0.251054 22.5367L3.29205 19.4957L2.71477 18.9177C2.07314 18.2749 1.71263 17.4036 1.71263 16.4954C1.71263 15.5871 2.073 14.716 2.71463 14.0732L5.21635 11.5715L4.53682 10.8919C4.20208 10.5572 4.20208 10.0145 4.53682 9.67973ZM11.2164 17.5715L8.71525 20.0727C8.39376 20.3942 7.95775 20.5748 7.50311 20.5748C7.04847 20.5748 6.61245 20.3942 6.29096 20.0727L5.16725 18.9475C5.15015 18.9268 5.13192 18.9068 5.11258 18.8874C5.09352 18.8684 5.07378 18.8504 5.05345 18.8335L3.9278 17.7063C3.60707 17.3849 3.42694 16.9494 3.42694 16.4954C3.42694 16.0414 3.60728 15.6057 3.92793 15.2843L6.42855 12.7837L11.2164 17.5715Z"
-      />
+      <path d="M23.749.251a.857.857 0 0 1 0 1.212l-3.04 3.04.576.576a3.43 3.43 0 0 1 0 4.849l-2.501 2.5.68.68a.857.857 0 0 1-1.213 1.212l-1.27-1.27-.016-.015-.014-.015-5.97-5.97-.03-.03L9.68 5.749a.857.857 0 0 1 1.212-1.212l.68.68 2.501-2.502a3.43 3.43 0 0 1 4.845 0l.578.577 3.04-3.04a.857.857 0 0 1 1.213 0m-4.913 4.806-1.13-1.129a1.715 1.715 0 0 0-2.421 0l-2.501 2.5 4.788 4.789 2.5-2.501a1.715 1.715 0 0 0 0-2.424l-1.128-1.128a1 1 0 0 1-.108-.107M4.537 9.68a.857.857 0 0 1 1.212 0l1.965 1.965L9.68 9.68a.857.857 0 1 1 1.212 1.212l-1.965 1.965 2.216 2.217 1.965-1.966a.857.857 0 0 1 1.212 1.212l-1.965 1.966 1.965 1.965a.857.857 0 1 1-1.212 1.212l-.68-.68-2.5 2.502a3.43 3.43 0 0 1-4.85 0l-.575-.576-3.04 3.04a.857.857 0 1 1-1.212-1.212l3.041-3.041-.577-.578a3.43 3.43 0 0 1 0-4.845l2.501-2.501-.68-.68a.857.857 0 0 1 0-1.212m6.68 7.892-2.502 2.5a1.714 1.714 0 0 1-2.424 0l-1.124-1.124a1 1 0 0 0-.114-.114l-1.125-1.128a1.714 1.714 0 0 1 0-2.422l2.5-2.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/PlugsConnected.tsx b/web/packages/design/src/Icon/Icons/PlugsConnected.tsx
index 9e8158669cc8f..d90852eec7cce 100644
--- a/web/packages/design/src/Icon/Icons/PlugsConnected.tsx
+++ b/web/packages/design/src/Icon/Icons/PlugsConnected.tsx
@@ -61,13 +61,10 @@ export const PlugsConnected = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="m22.28 2.78-4.912 4.913.504.504a3 3 0 0 1 0 4.242l-2.186 2.186.594.595a.75.75 0 1 1-1.06 1.06l-.595-.594-2.185 2.185a3 3 0 0 1-4.243 0l-.504-.504L2.78 22.28a.75.75 0 1 1-1.06-1.06l4.912-4.913-.503-.504a3 3 0 0 1 0-4.243l2.185-2.185-.594-.595a.75.75 0 0 1 1.06-1.06l.595.594 2.186-2.186a3 3 0 0 1 4.242 0l.504.504 4.912-4.912a.75.75 0 0 1 1.061 1.06M8.232 15.785l-.009-.009-.008-.008-1.026-1.026a1.5 1.5 0 0 1 0-2.121l2.186-2.186 4.19 4.19-2.186 2.186a1.5 1.5 0 0 1-2.121 0zm7.544-7.562-.01-.01-.007-.008-1.017-1.016a1.5 1.5 0 0 0-2.12 0l-2.187 2.186 4.19 4.19 2.186-2.186a1.5 1.5 0 0 0 0-2.122l-1.016-1.016z"
         clipRule="evenodd"
-        d="M22.2801 2.78033L17.3676 7.69282L17.8715 8.1967C19.0431 9.36827 19.0431 11.2678 17.8715 12.4393L15.6857 14.6251L16.2803 15.2197C16.5732 15.5126 16.5732 15.9874 16.2803 16.2803C15.9874 16.5732 15.5126 16.5732 15.2197 16.2803L14.6251 15.6857L12.4396 17.8712C11.268 19.0428 9.36851 19.0428 8.19693 17.8712L7.69305 17.3674L2.78033 22.2801C2.48744 22.573 2.01256 22.573 1.71967 22.2801C1.42678 21.9872 1.42678 21.5123 1.71967 21.2194L6.63239 16.3067L6.12864 15.803C4.95707 14.6314 4.95707 12.7319 6.12864 11.5603L8.31415 9.37481L7.71967 8.78033C7.42678 8.48744 7.42678 8.01256 7.71967 7.71967C8.01256 7.42678 8.48744 7.42678 8.78033 7.71967L9.37481 8.31415L11.5606 6.12841C12.7321 4.95684 14.6316 4.95684 15.8032 6.12841L16.3069 6.63216L21.2194 1.71967C21.5123 1.42678 21.9872 1.42678 22.2801 1.71967C22.573 2.01256 22.573 2.48744 22.2801 2.78033ZM8.2321 15.7851L8.22345 15.7763L8.21467 15.7677L7.1893 14.7423C6.60352 14.1565 6.60352 13.2068 7.1893 12.621L9.37481 10.4355L13.5644 14.6251L11.3789 16.8106C10.7931 17.3964 9.84338 17.3964 9.25759 16.8106L8.2321 15.7851ZM15.7763 8.22345L15.7657 8.21259L15.7586 8.20512L14.7425 7.18907C14.1567 6.60329 13.207 6.60329 12.6212 7.18907L10.4355 9.37481L14.6251 13.5644L16.8108 11.3787C17.3966 10.7929 17.3966 9.84315 16.8108 9.25736L15.7947 8.24119C15.7885 8.2354 15.7823 8.22949 15.7763 8.22345Z"
       />
-      <path d="M8.76303 2.28869C9.15599 2.15771 9.58073 2.37008 9.71172 2.76303L10.4617 5.01303C10.5927 5.40599 10.3803 5.83073 9.98737 5.96172C9.59442 6.0927 9.16968 5.88033 9.03869 5.48737L8.28869 3.23737C8.15771 2.84442 8.37008 2.41968 8.76303 2.28869Z" />
-      <path d="M3.23737 8.28869C2.84442 8.15771 2.41968 8.37008 2.28869 8.76303C2.15771 9.15599 2.37008 9.58073 2.76303 9.71172L5.01303 10.4617C5.40599 10.5927 5.83073 10.3803 5.96172 9.98737C6.0927 9.59442 5.88033 9.16968 5.48737 9.03869L3.23737 8.28869Z" />
-      <path d="M18.0387 14.013C18.1697 13.6201 18.5944 13.4077 18.9874 13.5387L21.2374 14.2887C21.6303 14.4197 21.8427 14.8444 21.7117 15.2374C21.5807 15.6303 21.156 15.8427 20.763 15.7117L18.513 14.9617C18.1201 14.8307 17.9077 14.406 18.0387 14.013Z" />
-      <path d="M14.9617 18.513C14.8307 18.1201 14.406 17.9077 14.013 18.0387C13.6201 18.1697 13.4077 18.5944 13.5387 18.9874L14.2887 21.2374C14.4197 21.6303 14.8444 21.8427 15.2374 21.7117C15.6303 21.5807 15.8427 21.156 15.7117 20.763L14.9617 18.513Z" />
+      <path d="M8.763 2.289a.75.75 0 0 1 .949.474l.75 2.25a.75.75 0 0 1-1.423.474l-.75-2.25a.75.75 0 0 1 .474-.948m-5.526 6a.75.75 0 0 0-.474 1.423l2.25.75a.75.75 0 0 0 .474-1.423zm14.802 5.724a.75.75 0 0 1 .948-.474l2.25.75a.75.75 0 0 1-.474 1.423l-2.25-.75a.75.75 0 0 1-.474-.949m-3.077 4.5a.75.75 0 0 0-1.423.474l.75 2.25a.75.75 0 0 0 1.423-.474z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Plus.tsx b/web/packages/design/src/Icon/Icons/Plus.tsx
index 7047e72bc4f08..d914db1bc68df 100644
--- a/web/packages/design/src/Icon/Icons/Plus.tsx
+++ b/web/packages/design/src/Icon/Icons/Plus.tsx
@@ -59,7 +59,7 @@ export const Plus = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 3.75C12.75 3.33579 12.4142 3 12 3C11.5858 3 11.25 3.33579 11.25 3.75V11.25H3.75C3.33579 11.25 3 11.5858 3 12C3 12.4142 3.33579 12.75 3.75 12.75H11.25V20.25C11.25 20.6642 11.5858 21 12 21C12.4142 21 12.75 20.6642 12.75 20.25V12.75H20.25C20.6642 12.75 21 12.4142 21 12C21 11.5858 20.6642 11.25 20.25 11.25H12.75V3.75Z" />
+      <path d="M12.75 3.75a.75.75 0 0 0-1.5 0v7.5h-7.5a.75.75 0 0 0 0 1.5h7.5v7.5a.75.75 0 0 0 1.5 0v-7.5h7.5a.75.75 0 0 0 0-1.5h-7.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/PowerSwitch.tsx b/web/packages/design/src/Icon/Icons/PowerSwitch.tsx
index c020f964c482b..b9385d4dcb75d 100644
--- a/web/packages/design/src/Icon/Icons/PowerSwitch.tsx
+++ b/web/packages/design/src/Icon/Icons/PowerSwitch.tsx
@@ -61,13 +61,13 @@ export const PowerSwitch = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 3.75a.75.75 0 0 1 .75.75V12a.75.75 0 0 1-1.5 0V4.5a.75.75 0 0 1 .75-.75"
         clipRule="evenodd"
-        d="M12 3.75C12.4142 3.75 12.75 4.08579 12.75 4.5V12C12.75 12.4142 12.4142 12.75 12 12.75C11.5858 12.75 11.25 12.4142 11.25 12V4.5C11.25 4.08579 11.5858 3.75 12 3.75Z"
       />
       <path
         fillRule="evenodd"
+        d="M8.128 4.84a.75.75 0 0 1-.218 1.038C5.84 7.228 4.5 9.385 4.5 12a7.5 7.5 0 0 0 15 0c0-2.615-1.34-4.773-3.41-6.122a.75.75 0 1 1 .82-1.256C19.355 6.216 21 8.823 21 12a9 9 0 0 1-18 0c0-3.177 1.645-5.784 4.09-7.378a.75.75 0 0 1 1.038.218"
         clipRule="evenodd"
-        d="M8.12826 4.84038C8.35449 5.18736 8.2566 5.65203 7.90962 5.87826C5.84047 7.22733 4.5 9.38491 4.5 12C4.5 13.9891 5.29018 15.8968 6.6967 17.3033C8.10322 18.7098 10.0109 19.5 12 19.5C13.9891 19.5 15.8968 18.7098 17.3033 17.3033C18.7098 15.8968 19.5 13.9891 19.5 12C19.5 9.38491 18.1595 7.22733 16.0904 5.87826C15.7434 5.65203 15.6455 5.18736 15.8717 4.84038C16.098 4.4934 16.5626 4.39551 16.9096 4.62174C19.3555 6.21642 21 8.82321 21 12C21 14.3869 20.0518 16.6761 18.364 18.364C16.6761 20.0518 14.3869 21 12 21C9.61305 21 7.32387 20.0518 5.63604 18.364C3.94821 16.6761 3 14.3869 3 12C3 8.82321 4.64453 6.21642 7.09038 4.62174C7.43736 4.39551 7.90203 4.4934 8.12826 4.84038Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Printer.tsx b/web/packages/design/src/Icon/Icons/Printer.tsx
index f60d3e8a05c6d..f6894468f5638 100644
--- a/web/packages/design/src/Icon/Icons/Printer.tsx
+++ b/web/packages/design/src/Icon/Icons/Printer.tsx
@@ -59,11 +59,11 @@ export const Printer = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M18.5625 10.875C18.5625 11.3928 18.1428 11.8125 17.625 11.8125C17.1072 11.8125 16.6875 11.3928 16.6875 10.875C16.6875 10.3572 17.1072 9.9375 17.625 9.9375C18.1428 9.9375 18.5625 10.3572 18.5625 10.875Z" />
+      <path d="M18.563 10.875a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.875 0" />
       <path
         fillRule="evenodd"
+        d="M6 3a.75.75 0 0 0-.75.75v3H3.875C2.62 6.75 1.5 7.702 1.5 9v7.5c0 .414.336.75.75.75h3v3c0 .414.336.75.75.75h12a.75.75 0 0 0 .75-.75v-3h3a.75.75 0 0 0 .75-.75V9c0-1.298-1.12-2.25-2.375-2.25H18.75v-3A.75.75 0 0 0 18 3zM3 9c0-.36.334-.75.875-.75h16.25c.54 0 .875.39.875.75v6.75h-2.25v-1.5a.75.75 0 0 0-.75-.75H6a.75.75 0 0 0-.75.75v1.5H3zm3.75-2.25h10.5V4.5H6.75zm0 8.25h10.5v4.5H6.75z"
         clipRule="evenodd"
-        d="M6 3C5.58579 3 5.25 3.33579 5.25 3.75V6.75H3.87469C2.62094 6.75 1.5 7.70164 1.5 9V16.5C1.5 16.9142 1.83579 17.25 2.25 17.25H5.25V20.25C5.25 20.6642 5.58579 21 6 21H18C18.4142 21 18.75 20.6642 18.75 20.25V17.25H21.75C22.1642 17.25 22.5 16.9142 22.5 16.5V9C22.5 7.70164 21.3791 6.75 20.1253 6.75H18.75V3.75C18.75 3.33579 18.4142 3 18 3H6ZM3 9C3 8.64086 3.33406 8.25 3.87469 8.25H20.1253C20.6659 8.25 21 8.64086 21 9V15.75H18.75V14.25C18.75 13.8358 18.4142 13.5 18 13.5H6C5.58579 13.5 5.25 13.8358 5.25 14.25V15.75H3V9ZM6.75 6.75H17.25V4.5H6.75V6.75ZM6.75 15H17.25V19.5H6.75V15Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Profile.tsx b/web/packages/design/src/Icon/Icons/Profile.tsx
index 333340d0ecf15..576aff7e24f15 100644
--- a/web/packages/design/src/Icon/Icons/Profile.tsx
+++ b/web/packages/design/src/Icon/Icons/Profile.tsx
@@ -59,17 +59,16 @@ export const Profile = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M13.5 10.5C13.5 10.0858 13.8358 9.75 14.25 9.75H18C18.4142 9.75 18.75 10.0858 18.75 10.5C18.75 10.9142 18.4142 11.25 18 11.25H14.25C13.8358 11.25 13.5 10.9142 13.5 10.5Z" />
-      <path d="M13.5 13.5C13.5 13.0858 13.8358 12.75 14.25 12.75H18C18.4142 12.75 18.75 13.0858 18.75 13.5C18.75 13.9142 18.4142 14.25 18 14.25H14.25C13.8358 14.25 13.5 13.9142 13.5 13.5Z" />
+      <path d="M13.5 10.5a.75.75 0 0 1 .75-.75H18a.75.75 0 0 1 0 1.5h-3.75a.75.75 0 0 1-.75-.75m0 3a.75.75 0 0 1 .75-.75H18a.75.75 0 0 1 0 1.5h-3.75a.75.75 0 0 1-.75-.75" />
       <path
         fillRule="evenodd"
+        d="M6 11.25a3 3 0 1 1 5.116 2.127c.78.5 1.375 1.27 1.61 2.187a.75.75 0 1 1-1.453.372c-.241-.943-1.197-1.686-2.273-1.686-1.075 0-2.031.743-2.274 1.687a.75.75 0 0 1-1.452-.374c.235-.916.831-1.685 1.61-2.186A3 3 0 0 1 6 11.25m3-1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3"
         clipRule="evenodd"
-        d="M6 11.25C6 9.59315 7.34315 8.25 9 8.25C10.6569 8.25 12 9.59315 12 11.25C12 12.0813 11.6619 12.8336 11.1157 13.3769C11.8951 13.8779 12.4913 14.6466 12.7264 15.5638C12.8293 15.965 12.5874 16.3737 12.1862 16.4765C11.7849 16.5794 11.3763 16.3375 11.2734 15.9362C11.0316 14.9928 10.0758 14.25 8.99994 14.25C7.92473 14.25 6.96904 14.9932 6.72629 15.9369C6.62309 16.338 6.21424 16.5795 5.81309 16.4764C5.41193 16.3732 5.17039 15.9643 5.27359 15.5631C5.50926 14.647 6.10527 13.8783 6.88457 13.3772C6.33822 12.8338 6 12.0814 6 11.25ZM9 9.75C8.17157 9.75 7.5 10.4216 7.5 11.25C7.5 12.0784 8.17157 12.75 9 12.75C9.82843 12.75 10.5 12.0784 10.5 11.25C10.5 10.4216 9.82843 9.75 9 9.75Z"
       />
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 0-1.5 1.5v13.5a1.5 1.5 0 0 0 1.5 1.5h16.5a1.5 1.5 0 0 0 1.5-1.5V5.25a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h16.5v13.5H3.75z"
         clipRule="evenodd"
-        d="M3.75 3.75C2.92157 3.75 2.25 4.42157 2.25 5.25V18.75C2.25 19.5784 2.92157 20.25 3.75 20.25H20.25C21.0784 20.25 21.75 19.5784 21.75 18.75V5.25C21.75 4.42157 21.0784 3.75 20.25 3.75H3.75ZM3.75 5.25H20.25V18.75H3.75V5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/PushPin.tsx b/web/packages/design/src/Icon/Icons/PushPin.tsx
index 75923a7e06592..07b6fe470e8b9 100644
--- a/web/packages/design/src/Icon/Icons/PushPin.tsx
+++ b/web/packages/design/src/Icon/Icons/PushPin.tsx
@@ -61,8 +61,8 @@ export const PushPin = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M15.314 1.5a1.5 1.5 0 0 0-1.06.439L9.222 6.984l-.044-.014a5.7 5.7 0 0 0-1.382-.233c-1.157-.052-2.687.228-4.236 1.477a1.5 1.5 0 0 0-.12 2.232l4.526 4.526L3.97 18.97a.75.75 0 0 0 1.06 1.06l3.998-3.997 4.528 4.527.002.002a1.5 1.5 0 0 0 2.25-.155l.002-.004c.748-.995 2.112-3.236 1.238-5.624l5.014-5.03a1.5 1.5 0 0 0 0-2.12l-5.688-5.69a1.5 1.5 0 0 0-1.06-.439M9.07 8.525l.01.004a.75.75 0 0 0 .862-.143L15.313 3 21 8.69l-5.372 5.389a.75.75 0 0 0-.14.865c.861 1.72-.102 3.525-.874 4.553L4.5 9.385l.002-.002c1.23-.992 2.39-1.184 3.228-1.146a4.2 4.2 0 0 1 1.015.17 3 3 0 0 1 .326.119"
         clipRule="evenodd"
-        d="M15.3137 1.5C14.916 1.5 14.5346 1.6579 14.2533 1.93899L9.22259 6.98379L9.17877 6.97033C8.84343 6.86894 8.36922 6.76295 7.79712 6.73728C6.64021 6.68537 5.10999 6.96476 3.56147 8.21397C3.3972 8.34573 3.26251 8.5106 3.16616 8.69787C3.0696 8.88558 3.01373 9.09156 3.00223 9.30234C2.99073 9.51312 3.02384 9.72395 3.09941 9.92106C3.17486 10.1179 3.29163 10.2972 3.44076 10.4462L7.9671 14.9721L3.96967 18.9695C3.67678 19.2624 3.67678 19.7373 3.96967 20.0302C4.26256 20.3231 4.73744 20.3231 5.03033 20.0302L9.02781 16.0327L13.5557 20.5602L13.5576 20.5621C13.7091 20.7125 13.891 20.8288 14.0911 20.9033C14.2912 20.9778 14.5049 21.0087 14.7179 20.994C14.9309 20.9792 15.1383 20.9192 15.3262 20.8179C15.5141 20.7166 15.6783 20.5763 15.8076 20.4065L15.8105 20.4027C16.5585 19.4077 17.9216 17.1666 17.0481 14.7785L22.0619 9.74899C22.3425 9.46778 22.5002 9.08668 22.5002 8.68934C22.5002 8.29168 22.3422 7.91026 22.0612 7.62898L16.374 1.93899C16.0927 1.6579 15.7113 1.5 15.3137 1.5ZM9.07119 8.525L9.08036 8.52924C9.36858 8.671 9.71564 8.61365 9.9427 8.38596L15.3137 3L20.9995 8.69L15.6277 14.0787C15.4 14.3071 15.3438 14.6554 15.4881 14.9438C16.349 16.6648 15.3864 18.4693 14.6144 19.4975L4.5 9.38409L4.50233 9.38221C5.73216 8.38971 6.89163 8.19816 7.72989 8.23577C8.15552 8.25487 8.50538 8.3338 8.74467 8.40614C8.86394 8.4422 8.95443 8.47623 9.01158 8.4995C9.0401 8.51112 9.06017 8.51999 9.07119 8.525Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/PushPinFilled.tsx b/web/packages/design/src/Icon/Icons/PushPinFilled.tsx
index e1c7faa378d68..869aa3db6168a 100644
--- a/web/packages/design/src/Icon/Icons/PushPinFilled.tsx
+++ b/web/packages/design/src/Icon/Icons/PushPinFilled.tsx
@@ -59,7 +59,7 @@ export const PushPinFilled = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M14.2533 1.93899C14.5346 1.6579 14.916 1.5 15.3137 1.5C15.7113 1.5 16.0927 1.6579 16.374 1.93899L22.0612 7.62898C22.3422 7.91026 22.5002 8.29168 22.5002 8.68934C22.5002 9.08668 22.3425 9.46778 22.0619 9.74899L17.0481 14.7785C17.9216 17.1666 16.5585 19.4077 15.8105 20.4027L15.8076 20.4065C15.6783 20.5763 15.5141 20.7166 15.3262 20.8179C15.1383 20.9192 14.9309 20.9792 14.7179 20.994C14.5049 21.0087 14.2912 20.9778 14.0911 20.9033C13.891 20.8288 13.7091 20.7125 13.5576 20.5621L13.5557 20.5602L9.02781 16.0327L5.03033 20.0302C4.73744 20.3231 4.26256 20.3231 3.96967 20.0302C3.67678 19.7373 3.67678 19.2624 3.96967 18.9695L7.9671 14.9721L3.44076 10.4462C3.29163 10.2972 3.17486 10.1179 3.09941 9.92106C3.02384 9.72395 2.99073 9.51312 3.00223 9.30234C3.01373 9.09156 3.0696 8.88558 3.16616 8.69787C3.26251 8.5106 3.3972 8.34573 3.56147 8.21397C5.10999 6.96476 6.64021 6.68537 7.79712 6.73728C8.36922 6.76295 8.84343 6.86894 9.17877 6.97033L9.22259 6.98379L14.2533 1.93899Z" />
+      <path d="M14.253 1.939a1.5 1.5 0 0 1 2.121 0l5.687 5.69a1.5 1.5 0 0 1 0 2.12l-5.013 5.03c.874 2.388-.49 4.629-1.237 5.624l-.003.004a1.5 1.5 0 0 1-2.25.155l-.002-.002-4.528-4.527L5.03 20.03a.75.75 0 1 1-1.06-1.06l3.997-3.998-4.526-4.526a1.505 1.505 0 0 1-.275-1.748 1.5 1.5 0 0 1 .395-.484c1.549-1.25 3.08-1.529 4.236-1.477a5.7 5.7 0 0 1 1.382.233l.044.014z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Question.tsx b/web/packages/design/src/Icon/Icons/Question.tsx
index 1c6cde3a1d45c..7bb567f6cb2bf 100644
--- a/web/packages/design/src/Icon/Icons/Question.tsx
+++ b/web/packages/design/src/Icon/Icons/Question.tsx
@@ -59,12 +59,11 @@ export const Question = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M8.25 10.125C8.25 8.17049 10.0264 6.75 12 6.75C13.9736 6.75 15.75 8.17049 15.75 10.125C15.75 11.8276 14.402 13.1249 12.75 13.4311V13.5C12.75 13.9142 12.4142 14.25 12 14.25C11.5858 14.25 11.25 13.9142 11.25 13.5V12.75C11.25 12.3358 11.5858 12 12 12C13.3395 12 14.25 11.0692 14.25 10.125C14.25 9.18076 13.3395 8.25 12 8.25C10.6605 8.25 9.75 9.18076 9.75 10.125V10.5C9.75 10.9142 9.41421 11.25 9 11.25C8.58579 11.25 8.25 10.9142 8.25 10.5V10.125Z" />
-      <path d="M12 17.8125C12.5178 17.8125 12.9375 17.3928 12.9375 16.875C12.9375 16.3572 12.5178 15.9375 12 15.9375C11.4822 15.9375 11.0625 16.3572 11.0625 16.875C11.0625 17.3928 11.4822 17.8125 12 17.8125Z" />
+      <path d="M8.25 10.125C8.25 8.17 10.026 6.75 12 6.75s3.75 1.42 3.75 3.375c0 1.703-1.348 3-3 3.306v.069a.75.75 0 0 1-1.5 0v-.75A.75.75 0 0 1 12 12c1.34 0 2.25-.93 2.25-1.875 0-.944-.91-1.875-2.25-1.875s-2.25.93-2.25 1.875v.375a.75.75 0 0 1-1.5 0zM12 17.813a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.874" />
       <path
         fillRule="evenodd"
+        d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0"
         clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Refresh.tsx b/web/packages/design/src/Icon/Icons/Refresh.tsx
index a69d03c9ecdca..9aeef712ac881 100644
--- a/web/packages/design/src/Icon/Icons/Refresh.tsx
+++ b/web/packages/design/src/Icon/Icons/Refresh.tsx
@@ -59,7 +59,7 @@ export const Refresh = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9.18062 5.0503C10.5466 4.49607 12.0455 4.35665 13.4902 4.64945C14.935 4.94226 16.2614 5.65431 17.3037 6.69664C17.3115 6.70445 17.3195 6.71209 17.3277 6.71956L19.8193 9H17.25C16.8358 9 16.5 9.33579 16.5 9.75C16.5 10.1642 16.8358 10.5 17.25 10.5H21.7263C21.9372 10.5066 22.1496 10.4246 22.3032 10.2567C22.4081 10.1421 22.4707 10.0038 22.4919 9.86092C22.4973 9.82414 22.5 9.78706 22.5 9.75V5.25C22.5 4.83579 22.1642 4.5 21.75 4.5C21.3358 4.5 21 4.83579 21 5.25V8.04723L18.3524 5.624C17.1034 4.37972 15.5163 3.52959 13.7882 3.17934C12.0545 2.82797 10.2558 2.99528 8.61664 3.66036C6.97752 4.32544 5.57073 5.4588 4.57205 6.91883C3.57337 8.37886 3.02708 10.1008 3.00143 11.8695C2.97579 13.6383 3.47194 15.3753 4.42788 16.8637C5.38382 18.3521 6.75716 19.5257 8.37631 20.238C9.99546 20.9504 11.7886 21.1697 13.5317 20.8688C15.2749 20.5678 16.8907 19.7599 18.1772 18.5458C18.4785 18.2616 18.4922 17.7869 18.208 17.4856C17.9237 17.1844 17.449 17.1706 17.1478 17.4549C16.0756 18.4665 14.7291 19.1399 13.2765 19.3907C11.8239 19.6415 10.3296 19.4586 8.98034 18.865C7.63105 18.2714 6.48659 17.2934 5.68998 16.0531C4.89336 14.8128 4.47991 13.3652 4.50128 11.8913C4.52264 10.4173 4.97789 8.98238 5.81012 7.76569C6.64236 6.549 7.81468 5.60454 9.18062 5.0503Z" />
+      <path d="M9.18 5.05a7.5 7.5 0 0 1 8.148 1.67L19.819 9H17.25a.75.75 0 0 0 0 1.5h4.476a.75.75 0 0 0 .774-.75v-4.5a.75.75 0 0 0-1.5 0v2.797l-2.648-2.423a9 9 0 1 0-.175 12.922.75.75 0 1 0-1.03-1.091A7.501 7.501 0 1 1 9.182 5.05" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Restore.tsx b/web/packages/design/src/Icon/Icons/Restore.tsx
index 92b9e6532d2d4..f725f98e365b4 100644
--- a/web/packages/design/src/Icon/Icons/Restore.tsx
+++ b/web/packages/design/src/Icon/Icons/Restore.tsx
@@ -59,8 +59,8 @@ export const Restore = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M15.3834 3.66036C13.7442 2.99528 11.9455 2.82797 10.2118 3.17934C8.47815 3.53071 6.88646 4.38517 5.63564 5.63596L5.63228 5.63934C4.96492 6.31521 4.36728 6.9675 3.75 7.68266V6C3.75 5.58579 3.41421 5.25 3 5.25C2.58579 5.25 2.25 5.58579 2.25 6L2.25 9.74992C2.25 9.837 2.26484 9.92069 2.29213 9.99845C2.33629 10.1248 2.41485 10.241 2.52625 10.3318C2.67215 10.4507 2.84928 10.5056 3.0237 10.5H6.75C7.16421 10.5 7.5 10.1642 7.5 9.75C7.5 9.33579 7.16421 9 6.75 9H4.59695C5.3035 8.16747 5.95709 7.44536 6.69794 6.69498C7.74004 5.65355 9.0658 4.9421 10.5098 4.64945C11.9545 4.35665 13.4535 4.49607 14.8194 5.0503C16.1853 5.60454 17.3576 6.549 18.1899 7.76569C19.0221 8.98238 19.4774 10.4173 19.4987 11.8913C19.5201 13.3652 19.1066 14.8128 18.31 16.0531C17.5134 17.2934 16.369 18.2714 15.0197 18.865C13.6704 19.4586 12.1761 19.6415 10.7235 19.3907C9.27087 19.1399 7.92438 18.4665 6.85225 17.4549C6.55099 17.1706 6.07631 17.1844 5.79204 17.4856C5.50776 17.7869 5.52153 18.2616 5.8228 18.5458C7.10935 19.7599 8.72514 20.5678 10.4683 20.8688C12.2114 21.1697 14.0045 20.9504 15.6237 20.238C17.2428 19.5257 18.6162 18.3521 19.5721 16.8637C20.5281 15.3753 21.0242 13.6383 20.9986 11.8695C20.9729 10.1008 20.4266 8.37886 19.428 6.91883C18.4293 5.4588 17.0225 4.32544 15.3834 3.66036Z" />
-      <path d="M12 6.75C12.4142 6.75 12.75 7.08579 12.75 7.5V11.5754L16.1359 13.6069C16.4911 13.82 16.6062 14.2807 16.3931 14.6359C16.18 14.9911 15.7193 15.1062 15.3641 14.8931L11.6141 12.6431C11.3882 12.5076 11.25 12.2634 11.25 12V7.5C11.25 7.08579 11.5858 6.75 12 6.75Z" />
+      <path d="M15.383 3.66a9 9 0 0 0-9.747 1.976l-.004.003A41 41 0 0 0 3.75 7.683V6a.75.75 0 0 0-1.5 0v3.75a.75.75 0 0 0 .774.75H6.75a.75.75 0 0 0 0-1.5H4.597a40 40 0 0 1 2.1-2.305 7.5 7.5 0 1 1 .155 10.76.75.75 0 0 0-1.03 1.09A9 9 0 1 0 15.384 3.66" />
+      <path d="M12 6.75a.75.75 0 0 1 .75.75v4.075l3.386 2.032a.75.75 0 1 1-.772 1.286l-3.75-2.25A.75.75 0 0 1 11.25 12V7.5a.75.75 0 0 1 .75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/RocketLaunch.tsx b/web/packages/design/src/Icon/Icons/RocketLaunch.tsx
index 018328c2848b0..a489d3e0de2ed 100644
--- a/web/packages/design/src/Icon/Icons/RocketLaunch.tsx
+++ b/web/packages/design/src/Icon/Icons/RocketLaunch.tsx
@@ -61,10 +61,10 @@ export const RocketLaunch = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M19.58 3.014c-1.298-.076-4.227.073-6.694 2.539L12.44 6H6.97a1.5 1.5 0 0 0-1.06.439l-3.22 3.22a1.5 1.5 0 0 0 .849 2.545h.002l3.607.504 4.144 4.145.503 3.606v.002a1.5 1.5 0 0 0 2.546.849l3.22-3.22a1.5 1.5 0 0 0 .44-1.06v-5.47l.446-.446c2.464-2.465 2.615-5.396 2.539-6.695v-.004a1.5 1.5 0 0 0-1.401-1.4zM16.5 13.06l-3.706 3.706.487 3.483 3.22-3.22zm-3.21-5.788-.017.017-4.711 4.71L12 15.44l5.386-5.386c2.033-2.033 2.166-4.451 2.102-5.542-1.09-.063-3.506.068-5.541 2.103zM6.97 7.5h3.968l-3.705 3.706-3.483-.487z"
         clipRule="evenodd"
-        d="M19.5807 3.01429C18.2824 2.9378 15.3527 3.08652 12.8862 5.55297L12.4392 6H6.97031C6.57302 6.00018 6.19138 6.15827 5.91029 6.43904L2.6894 9.65994C2.49275 9.85701 2.35484 10.1049 2.29108 10.3759C2.22733 10.6469 2.24025 10.9303 2.32841 11.1944C2.41656 11.4585 2.57647 11.6928 2.79023 11.8712C3.00399 12.0495 3.26318 12.1649 3.53877 12.2043L3.54131 12.2047L7.14755 12.7081L11.292 16.8526L11.7954 20.4587L11.7958 20.4612C11.8352 20.7368 11.9506 20.996 12.1289 21.2098C12.3073 21.4235 12.5416 21.5834 12.8057 21.6716C13.0698 21.7597 13.3532 21.7727 13.6242 21.7089C13.8952 21.6452 14.1437 21.5067 14.3407 21.31L17.5613 18.0894C17.8421 17.8083 17.9999 17.427 18.0001 17.0297V11.5604L18.4469 11.1136C20.9114 8.64915 21.0621 5.71765 20.9856 4.41919L20.9853 4.41516C20.9619 4.05137 20.8069 3.70855 20.5491 3.45078C20.2913 3.19301 19.9485 3.03793 19.5847 3.01453L19.5807 3.01429ZM16.5001 13.0604L12.7945 16.766L13.2807 20.2488L16.5001 17.0293V13.0604ZM13.2887 7.27184C13.2832 7.27754 13.2775 7.28316 13.2718 7.28869L8.56066 11.9999L12 15.4392L17.3862 10.053C19.4192 8.01997 19.552 5.60181 19.4884 4.51145C18.3979 4.44787 15.9817 4.57885 13.9469 6.61363L13.2887 7.27184ZM6.97066 7.5L10.9392 7.5L7.23365 11.2055L3.75122 10.7194L6.97066 7.5Z"
       />
-      <path d="M6.93916 15.7259C7.33668 15.6224 7.57746 15.2177 7.47761 14.8183C7.37715 14.4164 6.96994 14.1721 6.5681 14.2726L6.75 15.0002C6.5681 14.2726 6.56758 14.2727 6.56706 14.2728L6.56595 14.2731L6.56352 14.2737L6.55781 14.2752L6.54307 14.2792C6.53179 14.2823 6.51764 14.2863 6.5008 14.2913C6.46713 14.3014 6.42262 14.3157 6.36884 14.3349C6.2614 14.3733 6.11615 14.4317 5.94584 14.5169C5.60552 14.687 5.16113 14.9659 4.71967 15.4073C3.81982 16.3072 3 17.8147 3 20.2502C3 20.6644 3.33579 21.0002 3.75 21.0002C6.18552 21.0002 7.69298 20.1804 8.59283 19.2805C9.03429 18.839 9.31316 18.3947 9.48332 18.0543C9.56847 17.884 9.62692 17.7388 9.66529 17.6313C9.6845 17.5776 9.69875 17.533 9.70885 17.4994C9.7139 17.4825 9.71792 17.4684 9.72101 17.4571L9.72497 17.4424L9.72645 17.4367L9.72707 17.4342L9.72735 17.4331C9.72748 17.4326 9.72761 17.4321 9 17.2502L9.72761 17.4321C9.82807 17.0302 9.58375 16.623 9.1819 16.5226C8.78248 16.4227 8.37777 16.6635 8.27424 17.061L8.27211 17.0684C8.26903 17.0786 8.26277 17.0986 8.25268 17.1268C8.23246 17.1834 8.19715 17.2726 8.14168 17.3835C8.03059 17.6057 7.84071 17.9113 7.53217 18.2198C7.01303 18.739 6.10675 19.318 4.53531 19.4649C4.68217 17.8934 5.26119 16.9871 5.78033 16.468C6.08887 16.1595 6.39448 15.9696 6.61666 15.8585C6.7276 15.803 6.81673 15.7677 6.87335 15.7475C6.9016 15.7374 6.92154 15.7312 6.93182 15.7281L6.93916 15.7259Z" />
+      <path d="M6.94 15.726a.75.75 0 0 0-.372-1.453L6.75 15l-.183-.727h-.003l-.006.002-.015.004a2 2 0 0 0-.174.056 4 4 0 0 0-.423.182c-.34.17-.785.449-1.226.89-.9.9-1.72 2.408-1.72 4.843 0 .414.336.75.75.75 2.436 0 3.943-.82 4.843-1.72.441-.441.72-.885.89-1.226a4 4 0 0 0 .238-.597l.004-.015.001-.005.001-.003c0-.001 0-.002-.727-.184l.728.182a.75.75 0 0 0-1.454-.371l-.002.007-.02.059c-.02.056-.055.146-.11.257a3.2 3.2 0 0 1-.61.836c-.519.519-1.425 1.098-2.997 1.245.147-1.572.726-2.478 1.245-2.997a3.3 3.3 0 0 1 .837-.61 2 2 0 0 1 .315-.13z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Rows.tsx b/web/packages/design/src/Icon/Icons/Rows.tsx
index 7b6d34f119846..8e0961b689a35 100644
--- a/web/packages/design/src/Icon/Icons/Rows.tsx
+++ b/web/packages/design/src/Icon/Icons/Rows.tsx
@@ -61,13 +61,8 @@ export const Rows = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M4.5 4.5A1.5 1.5 0 0 0 3 6v3.75a1.5 1.5 0 0 0 1.5 1.5h15a1.5 1.5 0 0 0 1.5-1.5V6a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h15v3.75h-15zm0 6.75a1.5 1.5 0 0 0-1.5 1.5V18a1.5 1.5 0 0 0 1.5 1.5h15A1.5 1.5 0 0 0 21 18v-3.75a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h15V18h-15z"
         clipRule="evenodd"
-        d="M4.5 4.5C3.67157 4.5 3 5.17157 3 6V9.75C3 10.5784 3.67157 11.25 4.5 11.25H19.5C20.3284 11.25 21 10.5784 21 9.75V6C21 5.17157 20.3284 4.5 19.5 4.5H4.5ZM4.5 6H19.5V9.75H4.5V6Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M4.5 12.75C3.67157 12.75 3 13.4216 3 14.25V18C3 18.8284 3.67157 19.5 4.5 19.5H19.5C20.3284 19.5 21 18.8284 21 18V14.25C21 13.4216 20.3284 12.75 19.5 12.75H4.5ZM4.5 14.25H19.5V18H4.5V14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/RowsComfortable.tsx b/web/packages/design/src/Icon/Icons/RowsComfortable.tsx
new file mode 100644
index 0000000000000..77a887c375964
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/RowsComfortable.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const RowsComfortable = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-rowscomfortable"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M4.5 3.5C3.67 3.5 3 4.17 3 5v3.75c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5V5c0-.83-.67-1.5-1.5-1.5zm0 1.5h15v3.75h-15zm0 8.75c-.83 0-1.5.67-1.5 1.5V19c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-3.75c0-.83-.67-1.5-1.5-1.5zm0 1.5h15V19h-15z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/RowsDense.tsx b/web/packages/design/src/Icon/Icons/RowsDense.tsx
new file mode 100644
index 0000000000000..8dc0140d92621
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/RowsDense.tsx
@@ -0,0 +1,74 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const RowsDense = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-rowsdense"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M19.5 16.12h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5m0 3.76h-15v-2.25h15zm0-10.5h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5m0 3.74h-15v-2.25h15z"
+        clipRule="evenodd"
+      />
+      <path
+        fillRule="evenodd"
+        d="M19.5 9.38h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5m0 3.74h-15v-2.25h15zm0-10.49h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5V4.13c0-.83-.67-1.5-1.5-1.5m0 3.75h-15V4.13h15z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Ruler.tsx b/web/packages/design/src/Icon/Icons/Ruler.tsx
index 31c72b147f726..20e2eb5ff4ddd 100644
--- a/web/packages/design/src/Icon/Icons/Ruler.tsx
+++ b/web/packages/design/src/Icon/Icons/Ruler.tsx
@@ -61,8 +61,8 @@ export const Ruler = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M1.94 15a1.5 1.5 0 0 0 0 2.121l4.939 4.94a1.5 1.5 0 0 0 2.121 0L22.061 9a1.5 1.5 0 0 0 0-2.121l-4.94-4.94a1.5 1.5 0 0 0-2.12 0l-3.523 3.523-.008.008-.008.008-2.984 2.984-.008.008-.008.008-2.984 2.984-.008.008-.008.008zM6 13.06l-3 3L7.94 21 21 7.94 16.06 3l-3 3 2.47 2.47a.75.75 0 0 1-1.06 1.06L12 7.06 10.06 9l2.47 2.47a.75.75 0 0 1-1.06 1.06L9 10.06 7.06 12l2.47 2.47a.75.75 0 0 1-1.06 1.06z"
         clipRule="evenodd"
-        d="M1.93958 15C1.3538 15.5858 1.3538 16.5356 1.93958 17.1214L6.87895 22.0607C7.46473 22.6465 8.41448 22.6465 9.00027 22.0607L22.061 9.00002C22.6468 8.41424 22.6468 7.46449 22.061 6.8787L17.1216 1.93934C16.5358 1.35355 15.5861 1.35355 15.0003 1.93934L11.4776 5.46205L11.4697 5.46983L11.4619 5.47772L8.47757 8.46205L8.46969 8.46983L8.46191 8.47771L5.47756 11.4621C5.47492 11.4646 5.4723 11.4672 5.46969 11.4698C5.46708 11.4724 5.46449 11.4751 5.46193 11.4777L1.93958 15ZM6.00007 13.0609L3.00024 16.0607L7.93961 21.0001L21.0003 7.93936L16.0609 3L13.0607 6.00021L15.5303 8.46983C15.8232 8.76272 15.8232 9.23759 15.5303 9.53049C15.2375 9.82338 14.7626 9.82338 14.4697 9.53049L12.0001 7.06087L10.0607 9.00021L12.5303 11.4698C12.8232 11.7627 12.8232 12.2376 12.5303 12.5305C12.2375 12.8234 11.7626 12.8234 11.4697 12.5305L9.00007 10.0609L7.06073 12.0002L9.53035 14.4698C9.82324 14.7627 9.82324 15.2376 9.53035 15.5305C9.23745 15.8234 8.76258 15.8234 8.46969 15.5305L6.00007 13.0609Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Run.tsx b/web/packages/design/src/Icon/Icons/Run.tsx
index c8151a8c4c28c..246a61230eba3 100644
--- a/web/packages/design/src/Icon/Icons/Run.tsx
+++ b/web/packages/design/src/Icon/Icons/Run.tsx
@@ -59,16 +59,8 @@ export const Run = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M10.916 8.37596C10.6859 8.22254 10.39 8.20823 10.1461 8.33875C9.90224 8.46926 9.75 8.7234 9.75 9V15C9.75 15.2766 9.90224 15.5307 10.1461 15.6613C10.39 15.7918 10.6859 15.7775 10.916 15.624L15.416 12.624C15.6247 12.4849 15.75 12.2508 15.75 12C15.75 11.7492 15.6247 11.5151 15.416 11.376L10.916 8.37596ZM11.25 13.5986V10.4014L13.6479 12L11.25 13.5986Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M12 2.25C6.61522 2.25 2.25 6.61522 2.25 12C2.25 17.3848 6.61522 21.75 12 21.75C17.3848 21.75 21.75 17.3848 21.75 12C21.75 6.61522 17.3848 2.25 12 2.25ZM3.75 12C3.75 7.44365 7.44365 3.75 12 3.75C16.5563 3.75 20.25 7.44365 20.25 12C20.25 16.5563 16.5563 20.25 12 20.25C7.44365 20.25 3.75 16.5563 3.75 12Z"
-      />
+      <path d="M10.916 8.376A.75.75 0 0 0 9.75 9v6a.75.75 0 0 0 1.166.624l4.5-3a.75.75 0 0 0 0-1.248zm.334 5.223V10.4l2.398 1.6z" />
+      <path d="M12 2.25c-5.385 0-9.75 4.365-9.75 9.75s4.365 9.75 9.75 9.75 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25M3.75 12a8.25 8.25 0 1 1 16.5 0 8.25 8.25 0 0 1-16.5 0" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Scan.tsx b/web/packages/design/src/Icon/Icons/Scan.tsx
index 1e18137fe68d2..3bf4f0af12725 100644
--- a/web/packages/design/src/Icon/Icons/Scan.tsx
+++ b/web/packages/design/src/Icon/Icons/Scan.tsx
@@ -60,8 +60,8 @@ export const Scan = forwardRef<HTMLSpanElement, IconProps>(
       ref={ref}
     >
       <path
-        d="M3.427 3.058c-.203.072-.291.158-.367.357-.055.144-.062.435-.051 2.292.011 2.077.013 2.13.093 2.238.16.214.281.273.59.287.368.017.601-.09.726-.332.078-.152.083-.237.094-1.768l.013-1.607 1.607-.013c1.531-.011 1.616-.016 1.768-.094.216-.112.34-.354.34-.668 0-.378-.141-.606-.436-.704-.212-.072-4.174-.06-4.377.012m12.753-.01c-.281.099-.42.333-.42.702 0 .314.124.556.34.668.152.078.237.083 1.768.094l1.607.013.013 1.607c.011 1.531.016 1.616.094 1.768.125.242.358.349.726.332.309-.014.43-.073.59-.287.08-.108.082-.161.093-2.258l.011-2.147-.091-.179a.68.68 0 0 0-.231-.26c-.135-.078-.212-.081-2.26-.089-1.417-.005-2.16.007-2.24.036M7.772 6.834a1.545 1.545 0 0 0-.93.909c-.083.223-.083.249-.073 4.31l.011 4.087.108.229a1.7 1.7 0 0 0 .743.743l.229.108h8.28l.229-.108a1.7 1.7 0 0 0 .743-.743l.108-.229V7.86l-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108-4.08-.009c-3.844-.009-4.092-.005-4.288.063M15.76 12v3.76H8.24V8.24h7.52V12M3.424 15.802a.637.637 0 0 0-.384.396c-.024.085-.04.969-.04 2.204 0 2.058 0 2.061.09 2.24.066.13.138.202.27.269l.18.091 2.147-.011c2.097-.011 2.15-.013 2.258-.093.208-.156.271-.282.288-.574.021-.37-.08-.605-.308-.721-.156-.08-.224-.083-1.781-.083H4.525l-.013-1.63c-.011-1.554-.016-1.638-.094-1.79-.147-.286-.591-.419-.994-.298m16.418.045a.585.585 0 0 0-.26.253c-.078.152-.083.236-.094 1.79l-.013 1.63h-1.619c-1.557 0-1.625.003-1.781.083-.228.116-.329.351-.308.721.017.292.08.418.288.574.108.08.161.082 2.258.093l2.147.011.18-.091a.55.55 0 0 0 .271-.271l.091-.18-.011-2.147c-.011-2.097-.013-2.15-.093-2.258-.157-.209-.273-.266-.585-.284-.249-.014-.319-.003-.471.076"
         fillRule="evenodd"
+        d="M3.427 3.058c-.203.072-.291.158-.367.357-.055.144-.062.435-.051 2.292.011 2.077.013 2.13.093 2.238.16.214.281.273.59.287.368.017.601-.09.726-.332.078-.152.083-.237.094-1.768l.013-1.607 1.607-.013c1.531-.011 1.616-.016 1.768-.094.216-.112.34-.354.34-.668 0-.378-.141-.606-.436-.704-.212-.072-4.174-.06-4.377.012m12.753-.01q-.42.148-.42.702c0 .314.124.556.34.668.152.078.237.083 1.768.094l1.607.013.013 1.607c.011 1.531.016 1.616.094 1.768.125.242.358.349.726.332.309-.014.43-.073.59-.287.08-.108.082-.161.093-2.258l.011-2.147-.091-.179a.7.7 0 0 0-.231-.26c-.135-.078-.212-.081-2.26-.089-1.417-.005-2.16.007-2.24.036M7.772 6.834a1.55 1.55 0 0 0-.93.909c-.083.223-.083.249-.073 4.31l.011 4.087.108.229a1.7 1.7 0 0 0 .743.743l.229.108h8.28l.229-.108a1.7 1.7 0 0 0 .743-.743l.108-.229V7.86l-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108-4.08-.009c-3.844-.009-4.092-.005-4.288.063M15.76 12v3.76H8.24V8.24h7.52zM3.424 15.802a.64.64 0 0 0-.384.396c-.024.085-.04.969-.04 2.204 0 2.058 0 2.061.09 2.24.066.13.138.202.27.269l.18.091 2.147-.011c2.097-.011 2.15-.013 2.258-.093.208-.156.271-.282.288-.574.021-.37-.08-.605-.308-.721-.156-.08-.224-.083-1.781-.083H4.525l-.013-1.63c-.011-1.554-.016-1.638-.094-1.79-.147-.286-.591-.419-.994-.298m16.418.045a.6.6 0 0 0-.26.253c-.078.152-.083.236-.094 1.79l-.013 1.63h-1.619c-1.557 0-1.625.003-1.781.083-.228.116-.329.351-.308.721.017.292.08.418.288.574.108.08.161.082 2.258.093l2.147.011.18-.091a.55.55 0 0 0 .271-.271l.091-.18-.011-2.147c-.011-2.097-.013-2.15-.093-2.258-.157-.209-.273-.266-.585-.284-.249-.014-.319-.003-.471.076"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Server.tsx b/web/packages/design/src/Icon/Icons/Server.tsx
index b07e3d373b459..588e5281b01ec 100644
--- a/web/packages/design/src/Icon/Icons/Server.tsx
+++ b/web/packages/design/src/Icon/Icons/Server.tsx
@@ -59,17 +59,17 @@ export const Server = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.875 8.4375C17.3928 8.4375 17.8125 8.01777 17.8125 7.5C17.8125 6.98223 17.3928 6.5625 16.875 6.5625C16.3572 6.5625 15.9375 6.98223 15.9375 7.5C15.9375 8.01777 16.3572 8.4375 16.875 8.4375Z" />
+      <path d="M16.875 8.438a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.875" />
       <path
         fillRule="evenodd"
+        d="M4.5 3.75A1.5 1.5 0 0 0 3 5.25v4.5a1.5 1.5 0 0 0 1.5 1.5h15a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h15v4.5h-15z"
         clipRule="evenodd"
-        d="M4.5 3.75C3.67157 3.75 3 4.42157 3 5.25V9.75C3 10.5784 3.67157 11.25 4.5 11.25H19.5C20.3284 11.25 21 10.5784 21 9.75V5.25C21 4.42157 20.3284 3.75 19.5 3.75H4.5ZM4.5 5.25H19.5V9.75H4.5V5.25Z"
       />
-      <path d="M17.8125 16.5C17.8125 17.0178 17.3928 17.4375 16.875 17.4375C16.3572 17.4375 15.9375 17.0178 15.9375 16.5C15.9375 15.9822 16.3572 15.5625 16.875 15.5625C17.3928 15.5625 17.8125 15.9822 17.8125 16.5Z" />
+      <path d="M17.813 16.5a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M4.5 12.75a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h15a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h15v4.5h-15z"
         clipRule="evenodd"
-        d="M4.5 12.75C3.67157 12.75 3 13.4216 3 14.25V18.75C3 19.5784 3.67157 20.25 4.5 20.25H19.5C20.3284 20.25 21 19.5784 21 18.75V14.25C21 13.4216 20.3284 12.75 19.5 12.75H4.5ZM4.5 14.25H19.5V18.75H4.5V14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Share.tsx b/web/packages/design/src/Icon/Icons/Share.tsx
index 525bc3e8e312f..30b7ebd88660c 100644
--- a/web/packages/design/src/Icon/Icons/Share.tsx
+++ b/web/packages/design/src/Icon/Icons/Share.tsx
@@ -61,8 +61,8 @@ export const Share = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M13.963 2.307a.75.75 0 0 1 .817.163l7.5 7.5a.75.75 0 0 1 0 1.06l-7.5 7.5A.75.75 0 0 1 13.5 18v-3.729c-5.052.283-8.632 3.36-10.05 4.87a1.125 1.125 0 0 1-1.945-.898c.38-3.283 2.268-6.152 4.668-8.187C8.346 8.212 11.01 6.99 13.5 6.782V3a.75.75 0 0 1 .463-.693M15 4.811V7.5a.75.75 0 0 1-.75.75c-2.257 0-4.915 1.09-7.107 2.95-1.888 1.601-3.366 3.719-3.944 6.081 2.004-1.842 5.857-4.531 11.05-4.531a.75.75 0 0 1 .75.75v2.69l5.69-5.69zM2.25 18.33"
         clipRule="evenodd"
-        d="M13.9629 2.30711C14.2431 2.19103 14.5657 2.25519 14.7802 2.46969L22.2802 9.96969C22.5731 10.2626 22.5731 10.7375 22.2802 11.0304L14.7802 18.5303C14.5657 18.7448 14.2431 18.809 13.9629 18.6929C13.6826 18.5768 13.4999 18.3034 13.4999 18V14.271C8.44754 14.5539 4.86823 17.6301 3.44933 19.1402C3.2893 19.3139 3.07865 19.4328 2.84717 19.4801C2.61314 19.5278 2.36998 19.4999 2.15288 19.4003C1.93579 19.3007 1.75603 19.1345 1.63965 18.926C1.52372 18.7182 1.47666 18.479 1.50519 18.2429C1.88497 14.9597 3.7728 12.0912 6.17252 10.0557C8.34631 8.21181 11.0114 6.99094 13.4999 6.78197V3.00002C13.4999 2.69668 13.6826 2.4232 13.9629 2.30711ZM14.9999 4.81068V7.50002C14.9999 7.91424 14.6641 8.25002 14.2499 8.25002C11.9934 8.25002 9.33534 9.33983 7.14282 11.1996C5.2549 12.801 3.77667 14.9185 3.1992 17.2813C5.20258 15.4393 9.05613 12.75 14.2499 12.75C14.6641 12.75 14.9999 13.0858 14.9999 13.5V16.1894L20.6892 10.5L14.9999 4.81068ZM2.24996 18.3319H2.24996H2.24996Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ShieldCheck.tsx b/web/packages/design/src/Icon/Icons/ShieldCheck.tsx
index 3972e434d1d95..ae862faaa14c8 100644
--- a/web/packages/design/src/Icon/Icons/ShieldCheck.tsx
+++ b/web/packages/design/src/Icon/Icons/ShieldCheck.tsx
@@ -59,11 +59,11 @@ export const ShieldCheck = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.2803 10.2803C16.5732 9.98744 16.5732 9.51256 16.2803 9.21967C15.9874 8.92678 15.5126 8.92678 15.2197 9.21967L10.5 13.9393L8.78033 12.2197C8.48744 11.9268 8.01256 11.9268 7.71967 12.2197C7.42678 12.5126 7.42678 12.9874 7.71967 13.2803L9.96967 15.5303C10.2626 15.8232 10.7374 15.8232 11.0303 15.5303L16.2803 10.2803Z" />
+      <path d="M16.28 10.28a.75.75 0 1 0-1.06-1.06l-4.72 4.72-1.72-1.72a.75.75 0 0 0-1.06 1.06l2.25 2.25a.75.75 0 0 0 1.06 0z" />
       <path
         fillRule="evenodd"
+        d="M4.5 3.75A1.5 1.5 0 0 0 3 5.25v5.512c0 8.42 7.144 11.2 8.53 11.658.305.104.636.104.94 0 1.384-.46 8.53-3.24 8.53-11.66V5.25a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h15v5.51c0 7.346-6.194 9.8-7.5 10.236-1.303-.432-7.5-2.884-7.5-10.234z"
         clipRule="evenodd"
-        d="M4.5 3.75C4.10217 3.75 3.72064 3.90804 3.43934 4.18934C3.15804 4.47064 3 4.85217 3 5.25V10.7616C3 19.1829 10.1444 21.9611 11.5298 22.4204C11.8348 22.5244 12.1656 22.5244 12.4706 22.4203C13.8537 21.9599 21 19.1792 21 10.7597V5.25C21 4.85218 20.842 4.47065 20.5607 4.18934C20.2794 3.90804 19.8978 3.75 19.5 3.75H4.5ZM4.5 5.25L19.5 5.25V10.7597C19.5 18.1058 13.3064 20.5606 12 20.996C10.6965 20.5635 4.5 18.112 4.5 10.7616L4.5 5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/ShieldWarning.tsx b/web/packages/design/src/Icon/Icons/ShieldWarning.tsx
index b8a1c10c32e4c..71c947be42520 100644
--- a/web/packages/design/src/Icon/Icons/ShieldWarning.tsx
+++ b/web/packages/design/src/Icon/Icons/ShieldWarning.tsx
@@ -59,12 +59,11 @@ export const ShieldWarning = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 8.25C12.4142 8.25 12.75 8.58579 12.75 9V12.75C12.75 13.1642 12.4142 13.5 12 13.5C11.5858 13.5 11.25 13.1642 11.25 12.75V9C11.25 8.58579 11.5858 8.25 12 8.25Z" />
-      <path d="M12.9375 16.125C12.9375 16.6428 12.5178 17.0625 12 17.0625C11.4822 17.0625 11.0625 16.6428 11.0625 16.125C11.0625 15.6072 11.4822 15.1875 12 15.1875C12.5178 15.1875 12.9375 15.6072 12.9375 16.125Z" />
+      <path d="M12 8.25a.75.75 0 0 1 .75.75v3.75a.75.75 0 0 1-1.5 0V9a.75.75 0 0 1 .75-.75m.938 7.875a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M3.44 4.19a1.5 1.5 0 0 1 1.06-.44h15a1.5 1.5 0 0 1 1.5 1.5v5.51c0 8.42-7.146 11.2-8.53 11.66a1.46 1.46 0 0 1-.94 0C10.144 21.961 3 19.183 3 10.762V5.25c0-.398.158-.78.44-1.06M19.5 5.25h-15v5.512c0 7.35 6.197 9.802 7.5 10.234 1.306-.435 7.5-2.89 7.5-10.236z"
         clipRule="evenodd"
-        d="M3.43934 4.18934C3.72064 3.90804 4.10217 3.75 4.5 3.75H19.5C19.8978 3.75 20.2794 3.90804 20.5607 4.18934C20.842 4.47065 21 4.85218 21 5.25V10.7597C21 19.1792 13.8537 21.9599 12.4706 22.4203C12.1656 22.5244 11.8348 22.5244 11.5298 22.4204C10.1444 21.9611 3 19.1829 3 10.7616V5.25C3 4.85217 3.15804 4.47064 3.43934 4.18934ZM19.5 5.25L4.5 5.25L4.5 10.7616C4.5 18.112 10.6965 20.5635 12 20.996C13.3064 20.5606 19.5 18.1058 19.5 10.7597V5.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Sliders.tsx b/web/packages/design/src/Icon/Icons/Sliders.tsx
index b6e0d96106c65..4becf391054b9 100644
--- a/web/packages/design/src/Icon/Icons/Sliders.tsx
+++ b/web/packages/design/src/Icon/Icons/Sliders.tsx
@@ -61,13 +61,8 @@ export const Sliders = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M6.845 8.25a3.001 3.001 0 0 0 5.81 0h7.595a.75.75 0 0 0 0-1.5h-7.594a3.001 3.001 0 0 0-5.811 0H3.75a.75.75 0 0 0 0 1.5zM8.25 7.5a1.5 1.5 0 1 1 3 0 1.5 1.5 0 0 1-3 0m4.595 9.75a3.001 3.001 0 0 0 5.81 0h1.595a.75.75 0 0 0 0-1.5h-1.594a3.001 3.001 0 0 0-5.811 0H3.75a.75.75 0 0 0 0 1.5zm1.405-.75a1.5 1.5 0 1 1 3 0 1.5 1.5 0 0 1-3 0"
         clipRule="evenodd"
-        d="M6.84451 8.25C7.17755 9.54392 8.35212 10.5 9.75 10.5C11.1479 10.5 12.3225 9.54392 12.6555 8.25H20.25C20.6642 8.25 21 7.91421 21 7.5C21 7.08579 20.6642 6.75 20.25 6.75H12.6555C12.3225 5.45608 11.1479 4.5 9.75 4.5C8.35212 4.5 7.17755 5.45608 6.84451 6.75H3.75C3.33579 6.75 3 7.08579 3 7.5C3 7.91421 3.33579 8.25 3.75 8.25H6.84451ZM8.25 7.5C8.25 6.67157 8.92157 6 9.75 6C10.5784 6 11.25 6.67157 11.25 7.5C11.25 8.32843 10.5784 9 9.75 9C8.92157 9 8.25 8.32843 8.25 7.5Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M12.8445 17.25C13.1775 18.5439 14.3521 19.5 15.75 19.5C17.1479 19.5 18.3225 18.5439 18.6555 17.25H20.25C20.6642 17.25 21 16.9142 21 16.5C21 16.0858 20.6642 15.75 20.25 15.75H18.6555C18.3225 14.4561 17.1479 13.5 15.75 13.5C14.3521 13.5 13.1775 14.4561 12.8445 15.75H3.75C3.33579 15.75 3 16.0858 3 16.5C3 16.9142 3.33579 17.25 3.75 17.25H12.8445ZM14.25 16.5C14.25 15.6716 14.9216 15 15.75 15C16.5784 15 17.25 15.6716 17.25 16.5C17.25 17.3284 16.5784 18 15.75 18C14.9216 18 14.25 17.3284 14.25 16.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/SlidersVertical.tsx b/web/packages/design/src/Icon/Icons/SlidersVertical.tsx
index 4f2fd67ddcf19..109c635df9870 100644
--- a/web/packages/design/src/Icon/Icons/SlidersVertical.tsx
+++ b/web/packages/design/src/Icon/Icons/SlidersVertical.tsx
@@ -61,18 +61,8 @@ export const SlidersVertical = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M5.25 3a.75.75 0 0 1 .75.75v6.095a3.001 3.001 0 0 1 0 5.81v4.595a.75.75 0 0 1-1.5 0v-4.594a3.001 3.001 0 0 1 0-5.811V3.75A.75.75 0 0 1 5.25 3m0 11.25a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0 0 3m7.5-3.094a3.001 3.001 0 0 0 0-5.811V3.75a.75.75 0 0 0-1.5 0v1.595a3.001 3.001 0 0 0 0 5.81v9.095a.75.75 0 0 0 1.5 0zM12 6.75a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3m9.75 9a3 3 0 0 1-2.25 2.906v1.594a.75.75 0 0 1-1.5 0v-1.594a3.001 3.001 0 0 1 0-5.811V3.75a.75.75 0 0 1 1.5 0v9.095a3 3 0 0 1 2.25 2.905m-4.5 0a1.5 1.5 0 1 1 3 0 1.5 1.5 0 0 1-3 0"
         clipRule="evenodd"
-        d="M5.25 3C5.66421 3 6 3.33579 6 3.75V9.84451C7.29392 10.1775 8.25 11.3521 8.25 12.75C8.25 14.1479 7.29392 15.3225 6 15.6555V20.25C6 20.6642 5.66421 21 5.25 21C4.83579 21 4.5 20.6642 4.5 20.25V15.6555C3.20608 15.3225 2.25 14.1479 2.25 12.75C2.25 11.3521 3.20608 10.1775 4.5 9.84451V3.75C4.5 3.33579 4.83579 3 5.25 3ZM5.25 14.25C6.07843 14.25 6.75 13.5784 6.75 12.75C6.75 11.9216 6.07843 11.25 5.25 11.25C4.42157 11.25 3.75 11.9216 3.75 12.75C3.75 13.5784 4.42157 14.25 5.25 14.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M12.75 11.1555C14.0439 10.8225 15 9.64788 15 8.25C15 6.85212 14.0439 5.67755 12.75 5.34451V3.75C12.75 3.33579 12.4142 3 12 3C11.5858 3 11.25 3.33579 11.25 3.75V5.34451C9.95608 5.67755 9 6.85212 9 8.25C9 9.64788 9.95608 10.8225 11.25 11.1555V20.25C11.25 20.6642 11.5858 21 12 21C12.4142 21 12.75 20.6642 12.75 20.25V11.1555ZM12 6.75C11.1716 6.75 10.5 7.42157 10.5 8.25C10.5 9.07843 11.1716 9.75 12 9.75C12.8284 9.75 13.5 9.07843 13.5 8.25C13.5 7.42157 12.8284 6.75 12 6.75Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M21.75 15.75C21.75 17.1479 20.7939 18.3225 19.5 18.6555V20.25C19.5 20.6642 19.1642 21 18.75 21C18.3358 21 18 20.6642 18 20.25V18.6555C16.7061 18.3225 15.75 17.1479 15.75 15.75C15.75 14.3521 16.7061 13.1775 18 12.8445V3.75C18 3.33579 18.3358 3 18.75 3C19.1642 3 19.5 3.33579 19.5 3.75V12.8445C20.7939 13.1775 21.75 14.3521 21.75 15.75ZM17.25 15.75C17.25 14.9216 17.9216 14.25 18.75 14.25C19.5784 14.25 20.25 14.9216 20.25 15.75C20.25 16.5784 19.5784 17.25 18.75 17.25C17.9216 17.25 17.25 16.5784 17.25 15.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/SortAscending.tsx b/web/packages/design/src/Icon/Icons/SortAscending.tsx
new file mode 100644
index 0000000000000..edd8f9eb0d85e
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/SortAscending.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const SortAscending = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-sortascending"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M3.75 6a.75.75 0 0 1 .75-.75h12.75a.75.75 0 0 1 0 1.5H4.5A.75.75 0 0 1 3.75 6m0 6a.75.75 0 0 1 .75-.75h6.75a.75.75 0 0 1 0 1.5H4.5a.75.75 0 0 1-.75-.75m.75 5.25a.75.75 0 0 0 0 1.5h5.25a.75.75 0 0 0 0-1.5zm8.47-2.03a.75.75 0 0 1 1.06 0l2.47 2.47V10.5a.75.75 0 0 1 1.5 0v7.19l2.47-2.47a.75.75 0 1 1 1.06 1.06l-3.75 3.75a.747.747 0 0 1-1.06 0l-3.75-3.75a.75.75 0 0 1 0-1.06"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/SortDescending.tsx b/web/packages/design/src/Icon/Icons/SortDescending.tsx
new file mode 100644
index 0000000000000..e0f8349efc7d1
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/SortDescending.tsx
@@ -0,0 +1,69 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const SortDescending = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-sortdescending"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M17.537 3.807q.134.054.243.163l3.75 3.75a.75.75 0 0 1-1.06 1.06L18 6.31v7.19a.75.75 0 0 1-1.5 0V6.31l-2.47 2.47a.75.75 0 1 1-1.06-1.06l3.75-3.75a.75.75 0 0 1 .817-.163M3.75 6a.75.75 0 0 1 .75-.75h5.25a.75.75 0 0 1 0 1.5H4.5A.75.75 0 0 1 3.75 6m0 6a.75.75 0 0 1 .75-.75h6.75a.75.75 0 0 1 0 1.5H4.5a.75.75 0 0 1-.75-.75m.75 5.25a.75.75 0 0 0 0 1.5h12.75a.75.75 0 0 0 0-1.5z"
+        clipRule="evenodd"
+      />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Speed.tsx b/web/packages/design/src/Icon/Icons/Speed.tsx
index 62316da943096..f7ad45387c996 100644
--- a/web/packages/design/src/Icon/Icons/Speed.tsx
+++ b/web/packages/design/src/Icon/Icons/Speed.tsx
@@ -61,8 +61,8 @@ export const Speed = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M22.5 15A10.5 10.5 0 0 0 12 4.5h-.037C6.15 4.52 1.5 9.315 1.5 15.106v2.144a1.5 1.5 0 0 0 1.5 1.5h18a1.5 1.5 0 0 0 1.5-1.5zm-7.078-8.324a9 9 0 0 0-2.672-.645V8.25a.75.75 0 0 1-1.5 0V6.031c-3.834.321-6.978 3.083-7.944 6.719H5.25a.75.75 0 0 1 0 1.5H3.04q-.04.424-.04.856v2.144h6.368l5.775-7.941a.75.75 0 1 1 1.214.882l-5.134 7.06H21V15q0-.378-.031-.751H18.75a.75.75 0 0 1 0-1.5h1.964a9 9 0 0 0-5.292-6.074"
         clipRule="evenodd"
-        d="M22.5 15.0001C22.5 14.4756 22.4607 13.9532 22.383 13.437C22.38 13.4009 22.3744 13.3655 22.3665 13.331C22.2365 12.5235 22.0123 11.7321 21.6972 10.9732C21.1672 9.69688 20.3904 8.53771 19.4114 7.56221C18.4324 6.5867 17.2705 5.81406 15.9923 5.28858C14.7256 4.76785 13.3693 4.5 12 4.5L11.9627 4.50007C6.15021 4.52032 1.5 9.31473 1.5 15.106V17.2501C1.5 17.6479 1.65803 18.0294 1.93934 18.3107C2.22065 18.592 2.60218 18.7501 3 18.7501H21C21.3978 18.7501 21.7794 18.592 22.0607 18.3107C22.342 18.0294 22.5 17.6479 22.5 17.2501V15.0001ZM15.422 6.67593C14.5681 6.32493 13.6669 6.10798 12.75 6.0313V8.25C12.75 8.66421 12.4142 9 12 9C11.5858 9 11.25 8.66421 11.25 8.25V6.03126C7.41626 6.35238 4.27211 9.11446 3.30644 12.75H5.25006C5.66427 12.75 6.00006 13.0858 6.00006 13.5C6.00006 13.9142 5.66427 14.25 5.25006 14.25H3.03961C3.0134 14.532 3 14.8175 3 15.106V17.2501H9.36813L15.1435 9.30892C15.3871 8.97393 15.8562 8.89987 16.1912 9.1435C16.5262 9.38713 16.6002 9.85619 16.3566 10.1912L11.2229 17.2501H21V15.0001C21 14.7493 20.9895 14.4991 20.9687 14.25H18.75C18.3358 14.25 18 13.9142 18 13.5C18 13.0858 18.3358 12.75 18.75 12.75H20.7142C20.6087 12.3414 20.4744 11.9399 20.3119 11.5485C19.8576 10.4545 19.1918 9.4609 18.3526 8.62475C17.5135 7.7886 16.5176 7.12633 15.422 6.67593Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Spinner.tsx b/web/packages/design/src/Icon/Icons/Spinner.tsx
index b659dc396ccc3..78ac696baa1c9 100644
--- a/web/packages/design/src/Icon/Icons/Spinner.tsx
+++ b/web/packages/design/src/Icon/Icons/Spinner.tsx
@@ -61,43 +61,8 @@ export const Spinner = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 2a.77.77 0 0 1 .77.77v3.076a.77.77 0 1 1-1.54 0V2.77A.77.77 0 0 1 12 2m7.07 2.93c.301.3.301.787 0 1.087l-2.175 2.176a.77.77 0 0 1-1.088-1.087l2.176-2.176c.3-.3.787-.3 1.088 0M17.385 12a.77.77 0 0 1 .769-.77h3.077a.77.77 0 0 1 0 1.54h-3.077a.77.77 0 0 1-.77-.77m-1.577 3.807c.3-.3.787-.3 1.088 0l2.176 2.176a.77.77 0 0 1-1.088 1.088l-2.176-2.176a.77.77 0 0 1 0-1.088M12 17.385a.77.77 0 0 1 .77.769v3.077a.77.77 0 0 1-1.54 0v-3.077a.77.77 0 0 1 .77-.77m-3.807-1.577c.3.3.3.787 0 1.088L6.017 19.07a.77.77 0 1 1-1.088-1.088l2.176-2.176c.3-.3.788-.3 1.088 0M2 12a.77.77 0 0 1 .77-.77h3.076a.77.77 0 1 1 0 1.54H2.77A.77.77 0 0 1 2 12m2.93-7.07c.3-.3.787-.3 1.087 0l2.176 2.176a.77.77 0 0 1-1.088 1.087L4.93 6.017a.77.77 0 0 1 0-1.087"
         clipRule="evenodd"
-        d="M12 2C12.4248 2 12.7692 2.3444 12.7692 2.76923V5.84615C12.7692 6.27099 12.4248 6.61538 12 6.61538C11.5752 6.61538 11.2308 6.27099 11.2308 5.84615V2.76923C11.2308 2.3444 11.5752 2 12 2Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M19.0709 4.92963C19.3713 5.23003 19.3713 5.71708 19.0709 6.01749L16.8949 8.19345C16.5945 8.49385 16.1074 8.49385 15.807 8.19345C15.5066 7.89304 15.5066 7.40599 15.807 7.10559L17.983 4.92963C18.2834 4.62923 18.7705 4.62923 19.0709 4.92963Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M17.3846 12C17.3846 11.5752 17.729 11.2308 18.1538 11.2308H21.2308C21.6556 11.2308 22 11.5752 22 12C22 12.4248 21.6556 12.7692 21.2308 12.7692H18.1538C17.729 12.7692 17.3846 12.4248 17.3846 12Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M15.807 15.807C16.1074 15.5066 16.5945 15.5066 16.8949 15.807L19.0709 17.983C19.3713 18.2834 19.3713 18.7704 19.0709 19.0709C18.7704 19.3713 18.2834 19.3713 17.983 19.0709L15.807 16.8949C15.5066 16.5945 15.5066 16.1074 15.807 15.807Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M12 17.3846C12.4248 17.3846 12.7692 17.729 12.7692 18.1538V21.2308C12.7692 21.6556 12.4248 22 12 22C11.5752 22 11.2308 21.6556 11.2308 21.2308V18.1538C11.2308 17.729 11.5752 17.3846 12 17.3846Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M8.19295 15.807C8.49335 16.1074 8.49335 16.5945 8.19295 16.8949L6.01699 19.0709C5.71658 19.3713 5.22953 19.3713 4.92913 19.0709C4.62873 18.7705 4.62873 18.2834 4.92913 17.983L7.10509 15.807C7.40549 15.5066 7.89254 15.5066 8.19295 15.807Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M2 12C2 11.5752 2.3444 11.2308 2.76923 11.2308H5.84615C6.27099 11.2308 6.61538 11.5752 6.61538 12C6.61538 12.4248 6.27099 12.7692 5.84615 12.7692H2.76923C2.3444 12.7692 2 12.4248 2 12Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M4.92913 4.92963C5.22953 4.62923 5.71658 4.62923 6.01699 4.92963L8.19295 7.10559C8.49335 7.40599 8.49335 7.89304 8.19295 8.19345C7.89254 8.49385 7.40549 8.49385 7.10509 8.19345L4.92913 6.01749C4.62873 5.71708 4.62873 5.23003 4.92913 4.92963Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/SquaresFour.tsx b/web/packages/design/src/Icon/Icons/SquaresFour.tsx
index 43a44c4841bc2..dab6771f2a65a 100644
--- a/web/packages/design/src/Icon/Icons/SquaresFour.tsx
+++ b/web/packages/design/src/Icon/Icons/SquaresFour.tsx
@@ -61,23 +61,8 @@ export const SquaresFour = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M5.25 3.75a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5zm9-1.5a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5zm-10.5 9a1.5 1.5 0 0 1 1.5-1.5h4.5a1.5 1.5 0 0 1 1.5 1.5v4.5a1.5 1.5 0 0 1-1.5 1.5h-4.5a1.5 1.5 0 0 1-1.5-1.5zm6 0h-4.5v4.5h4.5zm4.5-1.5a1.5 1.5 0 0 0-1.5 1.5v4.5a1.5 1.5 0 0 0 1.5 1.5h4.5a1.5 1.5 0 0 0 1.5-1.5v-4.5a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h4.5v4.5h-4.5z"
         clipRule="evenodd"
-        d="M5.25 3.75C4.42157 3.75 3.75 4.42157 3.75 5.25V9.75C3.75 10.5784 4.42157 11.25 5.25 11.25H9.75C10.5784 11.25 11.25 10.5784 11.25 9.75V5.25C11.25 4.42157 10.5784 3.75 9.75 3.75H5.25ZM5.25 5.25H9.75V9.75H5.25V5.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M14.25 3.75C13.4216 3.75 12.75 4.42157 12.75 5.25V9.75C12.75 10.5784 13.4216 11.25 14.25 11.25H18.75C19.5784 11.25 20.25 10.5784 20.25 9.75V5.25C20.25 4.42157 19.5784 3.75 18.75 3.75H14.25ZM14.25 5.25H18.75V9.75H14.25V5.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M3.75 14.25C3.75 13.4216 4.42157 12.75 5.25 12.75H9.75C10.5784 12.75 11.25 13.4216 11.25 14.25V18.75C11.25 19.5784 10.5784 20.25 9.75 20.25H5.25C4.42157 20.25 3.75 19.5784 3.75 18.75V14.25ZM9.75 14.25H5.25V18.75H9.75V14.25Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M14.25 12.75C13.4216 12.75 12.75 13.4216 12.75 14.25V18.75C12.75 19.5784 13.4216 20.25 14.25 20.25H18.75C19.5784 20.25 20.25 19.5784 20.25 18.75V14.25C20.25 13.4216 19.5784 12.75 18.75 12.75H14.25ZM14.25 14.25H18.75V18.75H14.25V14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Stars.tsx b/web/packages/design/src/Icon/Icons/Stars.tsx
index 4017a951bd74a..195c37014b65a 100644
--- a/web/packages/design/src/Icon/Icons/Stars.tsx
+++ b/web/packages/design/src/Icon/Icons/Stars.tsx
@@ -61,8 +61,8 @@ export const Stars = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.624 2.411A1.51 1.51 0 0 1 12 1.508c.591 0 1.141.36 1.376.903l.004.008 2.178 5.19 5.568.482h.002c.598.05 1.121.464 1.305 1.035.184.57.003 1.21-.452 1.6l-4.222 3.682-.002.006-.002.007 1.267 5.483v.002a1.51 1.51 0 0 1-.576 1.55 1.51 1.51 0 0 1-1.653.078l-.005-.003-4.786-2.904h-.004l-4.79 2.907a1.51 1.51 0 0 1-1.654-.078 1.51 1.51 0 0 1-.576-1.55l1.267-5.485-.004-.012-4.222-3.683a1.51 1.51 0 0 1-.452-1.6c.184-.57.708-.985 1.305-1.034l5.57-.482zM12 3.008l2.174 5.181c.213.509.702.866 1.25.915h.003L21 9.586h.005l-4.237 3.696-.002.002a1.52 1.52 0 0 0-.474 1.471l1.268 5.489v.002l-4.785-2.904a1.51 1.51 0 0 0-1.552 0L6.44 20.246v-.002l1.268-5.488a1.52 1.52 0 0 0-.474-1.473l-4.231-3.69-.007-.007 5.578-.482h.002a1.51 1.51 0 0 0 1.25-.914m0 0L12 3.008z"
         clipRule="evenodd"
-        d="M10.6238 2.41121C10.859 1.86861 11.4087 1.50781 12.0001 1.50781C12.5914 1.50781 13.1411 1.86861 13.3763 2.41121L13.3798 2.41929L15.5576 7.60931L21.1258 8.09129C21.1266 8.09136 21.1275 8.09144 21.1284 8.09151C21.7256 8.1406 22.2491 8.55547 22.4331 9.12585C22.6168 9.69526 22.4355 10.3366 21.9813 10.7257L17.7595 14.4085C17.7588 14.4097 17.7578 14.4117 17.7569 14.4144C17.756 14.4171 17.7557 14.4194 17.7555 14.4207L19.0219 19.9042C19.022 19.9046 19.0222 19.9051 19.0223 19.9056C19.157 20.4849 18.9266 21.1055 18.4464 21.4565C17.9658 21.8078 17.3038 21.8386 16.7926 21.5335L16.7879 21.5308L12.0018 18.6272L12.0001 18.6271L11.9983 18.6272L7.20755 21.5335C6.69634 21.8386 6.03435 21.8078 5.55371 21.4565C5.07333 21.1054 4.84294 20.4845 4.97795 19.9051C4.97787 19.9054 4.97802 19.9048 4.97795 19.9051L6.24457 14.4207C6.24445 14.4194 6.24408 14.4171 6.24321 14.4144C6.24235 14.4117 6.24135 14.4097 6.24065 14.4085L2.01875 10.7257C1.56459 10.3366 1.38326 9.69525 1.56699 9.12585C1.75103 8.55548 2.27451 8.1406 2.8717 8.09151L8.44226 7.60997L10.6238 2.41121ZM12.0001 3.00795L14.1741 8.18905C14.1741 8.18902 14.1741 8.18909 14.1741 8.18905C14.387 8.6976 14.8756 9.05514 15.4248 9.10405L15.4267 9.10422L21.0011 9.5861L21.0055 9.58647L16.7692 13.2818L16.7673 13.2835C16.3544 13.6462 16.1696 14.22 16.2933 14.7555C16.2933 14.7554 16.2934 14.7555 16.2933 14.7555L17.5608 20.2436L17.5613 20.2455L12.776 17.3424C12.7759 17.3424 12.776 17.3425 12.776 17.3424C12.3039 17.0554 11.6964 17.0553 11.2243 17.3423C11.2243 17.3424 11.2244 17.3423 11.2243 17.3423L6.43881 20.2455L6.43925 20.2436L7.70673 14.7556C7.70672 14.7556 7.70674 14.7555 7.70673 14.7556C7.83044 14.2201 7.64574 13.6462 7.23284 13.2835L3.00182 9.59276L2.99453 9.58648L8.57339 9.10422L8.57535 9.10405C9.12428 9.05515 9.6127 8.69796 9.8257 8.18971M9.8257 8.18971L12.0001 3.00795L9.8257 8.18971Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Sun.tsx b/web/packages/design/src/Icon/Icons/Sun.tsx
index f813885be84f2..0d47928b2edb2 100644
--- a/web/packages/design/src/Icon/Icons/Sun.tsx
+++ b/web/packages/design/src/Icon/Icons/Sun.tsx
@@ -59,19 +59,13 @@ export const Sun = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 0.75C12.4142 0.75 12.75 1.08579 12.75 1.5V3.75C12.75 4.16421 12.4142 4.5 12 4.5C11.5858 4.5 11.25 4.16421 11.25 3.75V1.5C11.25 1.08579 11.5858 0.75 12 0.75Z" />
+      <path d="M12 .75a.75.75 0 0 1 .75.75v2.25a.75.75 0 0 1-1.5 0V1.5A.75.75 0 0 1 12 .75" />
       <path
         fillRule="evenodd"
+        d="M6 12a6 6 0 1 1 12 0 6 6 0 0 1-12 0m6-4.5a4.5 4.5 0 1 0 0 9 4.5 4.5 0 0 0 0-9"
         clipRule="evenodd"
-        d="M6 12C6 8.68629 8.68629 6 12 6C15.3137 6 18 8.68629 18 12C18 15.3137 15.3137 18 12 18C8.68629 18 6 15.3137 6 12ZM12 7.5C9.51472 7.5 7.5 9.51472 7.5 12C7.5 14.4853 9.51472 16.5 12 16.5C14.4853 16.5 16.5 14.4853 16.5 12C16.5 9.51472 14.4853 7.5 12 7.5Z"
       />
-      <path d="M5.03033 3.96967C4.73744 3.67678 4.26256 3.67678 3.96967 3.96967C3.67678 4.26256 3.67678 4.73744 3.96967 5.03033L5.46967 6.53033C5.76256 6.82322 6.23744 6.82322 6.53033 6.53033C6.82322 6.23744 6.82322 5.76256 6.53033 5.46967L5.03033 3.96967Z" />
-      <path d="M6.53033 18.5303L5.03033 20.0303C4.73744 20.3232 4.26256 20.3232 3.96967 20.0303C3.67678 19.7374 3.67678 19.2626 3.96967 18.9697L5.46967 17.4697C5.76256 17.1768 6.23744 17.1768 6.53033 17.4697C6.82322 17.7626 6.82322 18.2374 6.53033 18.5303Z" />
-      <path d="M18.5303 6.53033L20.0303 5.03033C20.3232 4.73744 20.3232 4.26256 20.0303 3.96967C19.7374 3.67678 19.2626 3.67678 18.9697 3.96967L17.4697 5.46967C17.1768 5.76256 17.1768 6.23744 17.4697 6.53033C17.7626 6.82322 18.2374 6.82322 18.5303 6.53033Z" />
-      <path d="M18.5303 17.4697L20.0303 18.9697C20.3232 19.2626 20.3232 19.7374 20.0303 20.0303C19.7374 20.3232 19.2626 20.3232 18.9697 20.0303L17.4697 18.5303C17.1768 18.2374 17.1768 17.7626 17.4697 17.4697C17.7626 17.1768 18.2374 17.1768 18.5303 17.4697Z" />
-      <path d="M1.5 11.25C1.08579 11.25 0.75 11.5858 0.75 12C0.75 12.4142 1.08579 12.75 1.5 12.75H3.75C4.16421 12.75 4.5 12.4142 4.5 12C4.5 11.5858 4.16421 11.25 3.75 11.25H1.5Z" />
-      <path d="M12 19.5C12.4142 19.5 12.75 19.8358 12.75 20.25V22.5C12.75 22.9142 12.4142 23.25 12 23.25C11.5858 23.25 11.25 22.9142 11.25 22.5V20.25C11.25 19.8358 11.5858 19.5 12 19.5Z" />
-      <path d="M20.25 11.25C19.8358 11.25 19.5 11.5858 19.5 12C19.5 12.4142 19.8358 12.75 20.25 12.75H22.5C22.9142 12.75 23.25 12.4142 23.25 12C23.25 11.5858 22.9142 11.25 22.5 11.25H20.25Z" />
+      <path d="M5.03 3.97a.75.75 0 0 0-1.06 1.06l1.5 1.5a.75.75 0 0 0 1.06-1.06zm1.5 14.56-1.5 1.5a.75.75 0 0 1-1.06-1.06l1.5-1.5a.75.75 0 0 1 1.06 1.06m12-12 1.5-1.5a.75.75 0 0 0-1.06-1.06l-1.5 1.5a.75.75 0 0 0 1.06 1.06m0 10.94 1.5 1.5a.75.75 0 1 1-1.06 1.06l-1.5-1.5a.75.75 0 1 1 1.06-1.06M1.5 11.25a.75.75 0 0 0 0 1.5h2.25a.75.75 0 0 0 0-1.5zM12 19.5a.75.75 0 0 1 .75.75v2.25a.75.75 0 0 1-1.5 0v-2.25a.75.75 0 0 1 .75-.75m8.25-8.25a.75.75 0 0 0 0 1.5h2.25a.75.75 0 0 0 0-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/SyncAlt.tsx b/web/packages/design/src/Icon/Icons/SyncAlt.tsx
index 22b5755d2f84a..d45ae7bf2fcfb 100644
--- a/web/packages/design/src/Icon/Icons/SyncAlt.tsx
+++ b/web/packages/design/src/Icon/Icons/SyncAlt.tsx
@@ -59,8 +59,7 @@ export const SyncAlt = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M6.52992 6.53074C6.237 6.82322 5.76243 6.82309 5.46967 6.53033C5.17678 6.23744 5.17678 5.76256 5.46967 5.46967L5.47064 5.4687L5.47182 5.46753L5.47481 5.46457L5.48332 5.45623L5.51038 5.43027C5.53285 5.40897 5.56421 5.37987 5.60426 5.34408C5.68432 5.27253 5.79936 5.17408 5.94793 5.05781C6.24473 4.82553 6.67748 4.52047 7.23461 4.21658C8.34864 3.60893 9.97163 3 12 3C14.8872 3 17.1242 4.44416 18.6055 5.82671C18.9392 6.13816 19.2377 6.44927 19.5 6.74457V4.5C19.5 4.08579 19.8358 3.75 20.25 3.75C20.6642 3.75 21 4.08579 21 4.5V8.98545C21.0006 9.01585 20.9993 9.04617 20.9962 9.07625C20.9852 9.18485 20.9511 9.28661 20.8988 9.37651C20.8467 9.46653 20.7752 9.54668 20.6863 9.61009C20.6137 9.66212 20.5314 9.70151 20.4426 9.72503C20.3747 9.74313 20.3054 9.75127 20.2368 9.75H15.75C15.3358 9.75 15 9.41421 15 9C15 8.58579 15.3358 8.25 15.75 8.25H18.8076C18.4888 7.85082 18.0784 7.38657 17.582 6.92329C16.2508 5.68084 14.3628 4.5 12 4.5C10.2784 4.5 8.90136 5.01607 7.95289 5.53342C7.47877 5.79203 7.11465 6.04947 6.87239 6.23907C6.75142 6.33373 6.66138 6.41106 6.60375 6.46256C6.57495 6.4883 6.55431 6.50753 6.54199 6.5192L6.52992 6.53074Z" />
-      <path d="M3 15C3 14.5858 3.33579 14.25 3.75 14.25H8.25C8.66421 14.25 9 14.5858 9 15C9 15.4142 8.66421 15.75 8.25 15.75H5.19264C5.51144 16.1491 5.92174 16.6132 6.41794 17.0763C7.74914 18.3188 9.63718 19.4996 12 19.4996C13.7216 19.4996 15.0986 18.9835 16.0471 18.4662C16.5212 18.2076 16.8853 17.9501 17.1276 17.7605C17.2485 17.6659 17.3386 17.5885 17.3962 17.537C17.425 17.5113 17.4456 17.4921 17.458 17.4804L17.4701 17.4687C17.7631 17.1762 18.2375 17.1765 18.5303 17.4693C18.8232 17.7622 18.8232 18.237 18.5303 18.5299L18.5293 18.5309L18.5281 18.5321L18.5251 18.535L18.5166 18.5434L18.4896 18.5693C18.4671 18.5906 18.4357 18.6197 18.3957 18.6555C18.3156 18.7271 18.2006 18.8255 18.052 18.9418C17.7552 19.1741 17.3225 19.4791 16.7653 19.783C15.6513 20.3907 14.0283 20.9996 12 20.9996C9.11272 20.9996 6.87576 19.5554 5.39446 18.1729C5.06078 17.8615 4.76232 17.5504 4.5 17.2551V19.5C4.5 19.9142 4.16421 20.25 3.75 20.25C3.33579 20.25 3 19.9142 3 19.5V15Z" />
+      <path d="M6.53 6.53a.75.75 0 0 1-1.06-1.06v-.001l.002-.001.003-.003.008-.009.027-.026.094-.086a7 7 0 0 1 .344-.286A9.93 9.93 0 0 1 12 3c2.887 0 5.124 1.444 6.605 2.827.334.311.633.622.895.918V4.5a.75.75 0 0 1 1.5 0v4.485a.74.74 0 0 1-.101.392.75.75 0 0 1-.662.373H15.75a.75.75 0 0 1 0-1.5h3.058c-.32-.4-.73-.863-1.226-1.327C16.251 5.681 14.362 4.5 12 4.5a8.43 8.43 0 0 0-5.128 1.74 5 5 0 0 0-.33.28zM3 15a.75.75 0 0 1 .75-.75h4.5a.75.75 0 0 1 0 1.5H5.193c.318.4.729.863 1.225 1.326C7.749 18.32 9.638 19.5 12 19.5a8.43 8.43 0 0 0 5.128-1.74 5 5 0 0 0 .33-.28l.012-.011a.75.75 0 0 1 1.06 1.06v.002l-.002.001-.003.003-.008.008-.027.026-.094.087c-.08.071-.195.17-.344.286A9.93 9.93 0 0 1 12 21c-2.887 0-5.124-1.445-6.606-2.827a14 14 0 0 1-.894-.918V19.5a.75.75 0 0 1-1.5 0z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Table.tsx b/web/packages/design/src/Icon/Icons/Table.tsx
index 8a67dfdaecc70..a61d97197c438 100644
--- a/web/packages/design/src/Icon/Icons/Table.tsx
+++ b/web/packages/design/src/Icon/Icons/Table.tsx
@@ -59,10 +59,7 @@ export const Table = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path
-        d="M2.613 4.621a.901.901 0 0 0-.26.25l-.093.149-.012 6.5c-.008 4.739.001 6.565.034 6.739a1.5 1.5 0 0 0 1.288 1.223c.33.048 16.53.048 16.86 0a1.5 1.5 0 0 0 1.288-1.223c.033-.174.042-2 .034-6.739l-.012-6.5-.093-.15a.891.891 0 0 0-.264-.25l-.17-.1h-9.217l-9.216.001-.167.1M20.24 7.5V9H3.76V6h16.48v1.5M7.48 12.02v1.5H3.76v-3h3.72v1.5m12.76 0v1.5H9v-3h11.24v1.5M7.48 16.5V18H3.76v-3h3.72v1.5m12.76 0V18H9v-3h11.24v1.5"
-        fillRule="evenodd"
-      />
+      <path d="M2.613 4.621a.9.9 0 0 0-.26.25l-.093.149-.012 6.5c-.008 4.739.001 6.565.034 6.739a1.5 1.5 0 0 0 1.288 1.223c.33.048 16.53.048 16.86 0a1.5 1.5 0 0 0 1.288-1.223c.033-.174.042-2 .034-6.739l-.012-6.5-.093-.15a.9.9 0 0 0-.264-.25l-.17-.1h-9.217l-9.216.001zM20.24 7.5V9H3.76V6h16.48zM7.48 12.02v1.5H3.76v-3h3.72zm12.76 0v1.5H9v-3h11.24zM7.48 16.5V18H3.76v-3h3.72zm12.76 0V18H9v-3h11.24z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Tablet.tsx b/web/packages/design/src/Icon/Icons/Tablet.tsx
index 97e2de34ec170..851053f77e71b 100644
--- a/web/packages/design/src/Icon/Icons/Tablet.tsx
+++ b/web/packages/design/src/Icon/Icons/Tablet.tsx
@@ -61,8 +61,8 @@ export const Tablet = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 4.5v15A2.25 2.25 0 0 0 6 21.75h12a2.25 2.25 0 0 0 2.25-2.25v-15A2.25 2.25 0 0 0 18 2.25H6A2.25 2.25 0 0 0 3.75 4.5m15 0a.75.75 0 0 0-.75-.75H6a.75.75 0 0 0-.75.75v.75h13.5zm0 12.75V6.75H5.25v10.5zm-13.5 1.5h13.5v.75a.75.75 0 0 1-.75.75H6a.75.75 0 0 1-.75-.75z"
         clipRule="evenodd"
-        d="M3.75 4.5V19.5C3.75 20.7426 4.75736 21.75 6 21.75H18C19.2426 21.75 20.25 20.7426 20.25 19.5V4.5C20.25 3.25736 19.2426 2.25 18 2.25H6C4.75736 2.25 3.75 3.25736 3.75 4.5ZM18.75 4.5C18.75 4.08579 18.4142 3.75 18 3.75H6C5.58579 3.75 5.25 4.08579 5.25 4.5V5.25H18.75V4.5ZM18.75 17.25V6.75H5.25V17.25H18.75ZM5.25 18.75H18.75V19.5C18.75 19.9142 18.4142 20.25 18 20.25H6C5.58579 20.25 5.25 19.9142 5.25 19.5V18.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Tags.tsx b/web/packages/design/src/Icon/Icons/Tags.tsx
index 24fcd68ab51b7..d9cd9a288e930 100644
--- a/web/packages/design/src/Icon/Icons/Tags.tsx
+++ b/web/packages/design/src/Icon/Icons/Tags.tsx
@@ -61,8 +61,8 @@ export const Tags = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 3a.75.75 0 0 0-.75.75v8.69c0 .397.158.779.44 1.06l9.313 9.311a1.5 1.5 0 0 0 2.121 0l7.937-7.94a1.5 1.5 0 0 0 0-2.12l-9.312-9.312A1.5 1.5 0 0 0 12.44 3zm.75 9.44V4.5h7.94l9.31 9.31-7.936 7.94zm4.313-4.565a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.875 0"
         clipRule="evenodd"
-        d="M3.75 3C3.33579 3 3 3.33579 3 3.75V12.44C3.00018 12.8373 3.15835 13.2187 3.43912 13.4998L12.7533 22.8111C13.0346 23.0922 13.4159 23.2501 13.8136 23.2501C14.2112 23.2501 14.5929 23.0919 14.8742 22.8109L22.8111 14.8711C23.0922 14.5898 23.2501 14.2084 23.2501 13.8108C23.2501 13.4131 23.092 13.0316 22.811 12.7503L13.4994 3.43875C13.2183 3.15798 12.837 3.00018 12.4397 3H3.75ZM4.5 12.4393L4.5 4.5H12.4393L21.7501 13.8108L13.8136 21.7501L4.5 12.4393ZM8.8125 7.875C8.8125 8.39277 8.39277 8.8125 7.875 8.8125C7.35723 8.8125 6.9375 8.39277 6.9375 7.875C6.9375 7.35723 7.35723 6.9375 7.875 6.9375C8.39277 6.9375 8.8125 7.35723 8.8125 7.875Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Terminal.tsx b/web/packages/design/src/Icon/Icons/Terminal.tsx
index bcbf267204420..d2205ec7c6864 100644
--- a/web/packages/design/src/Icon/Icons/Terminal.tsx
+++ b/web/packages/design/src/Icon/Icons/Terminal.tsx
@@ -61,8 +61,8 @@ export const Terminal = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 0-1.5 1.5v13.5a1.5 1.5 0 0 0 1.5 1.5h16.5a1.5 1.5 0 0 0 1.5-1.5V5.25a1.5 1.5 0 0 0-1.5-1.5zm0 1.5h16.5v13.5H3.75zm3.164 3.282a.75.75 0 0 1 1.055-.118l3.75 3a.75.75 0 0 1 0 1.172l-3.75 3a.75.75 0 0 1-.937-1.172L10.049 12 7.032 9.586a.75.75 0 0 1-.118-1.054M12 15a.75.75 0 0 1 .75-.75h3.75a.75.75 0 0 1 0 1.5h-3.75A.75.75 0 0 1 12 15"
         clipRule="evenodd"
-        d="M3.75 3.75C2.92157 3.75 2.25 4.42157 2.25 5.25V18.75C2.25 19.5784 2.92157 20.25 3.75 20.25H20.25C21.0784 20.25 21.75 19.5784 21.75 18.75V5.25C21.75 4.42157 21.0784 3.75 20.25 3.75H3.75ZM3.75 5.25H20.25V18.75H3.75V5.25ZM6.91438 8.53151C7.17313 8.20806 7.6451 8.15562 7.96855 8.41438L11.7185 11.4144C11.8965 11.5567 12 11.7722 12 12C12 12.2279 11.8965 12.4433 11.7185 12.5857L7.96855 15.5857C7.6451 15.8444 7.17313 15.792 6.91438 15.4685C6.65562 15.1451 6.70806 14.6731 7.03151 14.4144L10.0494 12L7.03151 9.58568C6.70806 9.32692 6.65562 8.85495 6.91438 8.53151ZM12 15C12 14.5858 12.3358 14.25 12.75 14.25H16.5C16.9142 14.25 17.25 14.5858 17.25 15C17.25 15.4142 16.9142 15.75 16.5 15.75H12.75C12.3358 15.75 12 15.4142 12 15Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Trash.tsx b/web/packages/design/src/Icon/Icons/Trash.tsx
index 680b7d4e88b12..183d8788fc18e 100644
--- a/web/packages/design/src/Icon/Icons/Trash.tsx
+++ b/web/packages/design/src/Icon/Icons/Trash.tsx
@@ -59,12 +59,11 @@ export const Trash = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9.75 9C10.1642 9 10.5 9.33579 10.5 9.75V15.75C10.5 16.1642 10.1642 16.5 9.75 16.5C9.33579 16.5 9 16.1642 9 15.75V9.75C9 9.33579 9.33579 9 9.75 9Z" />
-      <path d="M15 15.75V9.75C15 9.33579 14.6642 9 14.25 9C13.8358 9 13.5 9.33579 13.5 9.75V15.75C13.5 16.1642 13.8358 16.5 14.25 16.5C14.6642 16.5 15 16.1642 15 15.75Z" />
+      <path d="M9.75 9a.75.75 0 0 1 .75.75v6a.75.75 0 0 1-1.5 0v-6A.75.75 0 0 1 9.75 9M15 15.75v-6a.75.75 0 0 0-1.5 0v6a.75.75 0 0 0 1.5 0" />
       <path
         fillRule="evenodd"
+        d="M9.75 1.5A2.25 2.25 0 0 0 7.5 3.75v.75H3.75a.75.75 0 0 0 0 1.5h.75v13.5A1.5 1.5 0 0 0 6 21h12a1.5 1.5 0 0 0 1.5-1.5V6h.75a.75.75 0 0 0 0-1.5H16.5v-.75a2.25 2.25 0 0 0-2.25-2.25zm5.25 3v-.75a.75.75 0 0 0-.75-.75h-4.5a.75.75 0 0 0-.75.75v.75zM6 6v13.5h12V6z"
         clipRule="evenodd"
-        d="M9.75 1.5C9.15326 1.5 8.58097 1.73705 8.15901 2.15901C7.73705 2.58097 7.5 3.15326 7.5 3.75V4.5H3.75C3.33579 4.5 3 4.83579 3 5.25C3 5.66421 3.33579 6 3.75 6H4.5V19.5C4.5 19.8978 4.65804 20.2794 4.93934 20.5607C5.22065 20.842 5.60218 21 6 21H18C18.3978 21 18.7794 20.842 19.0607 20.5607C19.342 20.2794 19.5 19.8978 19.5 19.5V6H20.25C20.6642 6 21 5.66421 21 5.25C21 4.83579 20.6642 4.5 20.25 4.5H16.5V3.75C16.5 3.15326 16.2629 2.58097 15.841 2.15901C15.419 1.73705 14.8467 1.5 14.25 1.5H9.75ZM15 4.5V3.75C15 3.55109 14.921 3.36032 14.7803 3.21967C14.6397 3.07902 14.4489 3 14.25 3H9.75C9.55109 3 9.36032 3.07902 9.21967 3.21967C9.07902 3.36032 9 3.55109 9 3.75V4.5H15ZM6 6V19.5H18V6H6Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Twitter.tsx b/web/packages/design/src/Icon/Icons/Twitter.tsx
index f69a0902f30a3..ee396788a4c17 100644
--- a/web/packages/design/src/Icon/Icons/Twitter.tsx
+++ b/web/packages/design/src/Icon/Icons/Twitter.tsx
@@ -61,8 +61,8 @@ export const Twitter = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M17.725 5.999c-.545-.488-1.381-.933-2.619-.756-1.318.188-1.914 1.132-2.191 2.228a6.7 6.7 0 0 0-.188 1.5 7 7 0 0 0 .016.616l.002.03v.004a.75.75 0 0 1-.745.83c-.788 0-2.037-.361-3.503-1.077-1.187-.58-2.564-1.415-4.03-2.556-.015 2.917.895 5.08 1.861 6.56a10.6 10.6 0 0 0 1.587 1.91 8 8 0 0 0 .668.564l.032.023.004.004a.75.75 0 0 1 .317.48c.052.269-.058.49-.213.699q-.09.121-.257.326c-.223.27-.551.638-.978 1.039a11 11 0 0 1-2.178 1.596c1.112.334 2.44.391 3.845.158a12.15 12.15 0 0 0 5.854-2.744c1.773-1.535 2.711-3.404 3.206-4.904.248-.749.382-1.4.454-1.859a9 9 0 0 0 .08-.666l.001-.03V9.97a.75.75 0 0 1 .195-.474l1.86-2.046H19.2a.75.75 0 0 1-.682-.437l.001.002-.005-.01-.03-.058a3.8 3.8 0 0 0-.759-.948m1.91-.049-.045-.069a5.3 5.3 0 0 0-.865-1c-.805-.72-2.069-1.375-3.831-1.123-2.182.311-3.085 1.967-3.434 3.346a8 8 0 0 0-.23 1.723c-.52-.134-1.224-.385-2.075-.8-1.373-.67-3.061-1.734-4.864-3.294a.75.75 0 0 0-1.237.49c-.42 4.044.737 7.014 2.018 8.975a12 12 0 0 0 2.076 2.42 10 10 0 0 1-.686.71c-.75.703-1.834 1.506-3.2 1.96a.75.75 0 0 0-.178 1.337c1.709 1.139 4.023 1.412 6.317 1.032a13.65 13.65 0 0 0 6.59-3.09c2.034-1.761 3.096-3.892 3.649-5.568.277-.839.428-1.57.511-2.096a10 10 0 0 0 .076-.588l2.828-3.11A.75.75 0 0 0 22.5 5.95zM18.52 7.015q0 .002 0 0"
         clipRule="evenodd"
-        d="M17.7251 5.99895C17.1796 5.5112 16.3437 5.06623 15.106 5.24293C13.7884 5.43098 13.1916 6.37483 12.9147 7.47128C12.7769 8.01683 12.7336 8.55889 12.7265 8.97105C12.7229 9.17528 12.7283 9.34311 12.7343 9.45773C12.7373 9.51493 12.7405 9.55858 12.7428 9.58654L12.7454 9.61636L12.7458 9.62086C12.7682 9.83223 12.6998 10.0436 12.5577 10.2017C12.4155 10.3599 12.2127 10.4502 12 10.4502C11.2118 10.4502 9.96255 10.09 8.49662 9.37416C7.30981 8.79466 5.93292 7.95868 4.46655 6.81768C4.45219 9.73459 5.36154 11.8978 6.32798 13.3777C6.89031 14.2388 7.47491 14.8725 7.9149 15.2879C8.13465 15.4954 8.3175 15.6476 8.44218 15.7458C8.50449 15.7949 8.55216 15.8304 8.58252 15.8524C8.5977 15.8634 8.60854 15.8711 8.61471 15.8754L8.61943 15.8787C8.78462 15.9901 8.89869 16.1627 8.93644 16.3584C8.98837 16.6276 8.87752 16.8497 8.72271 17.0577C8.66352 17.1372 8.57771 17.2486 8.46604 17.384C8.243 17.6544 7.91504 18.0222 7.48797 18.4226C6.93412 18.9418 6.2039 19.5248 5.3104 20.0187C6.42202 20.3528 7.74943 20.4101 9.15542 20.1768C11.2015 19.8371 13.3225 18.894 15.009 17.4335C16.782 15.8982 17.7203 14.0293 18.2155 12.529C18.4627 11.7802 18.5971 11.1298 18.6695 10.6701C18.7057 10.4406 18.7262 10.2596 18.7376 10.1387C18.7433 10.0783 18.7467 10.033 18.7486 10.0044L18.7504 9.97402L18.7506 9.96973C18.758 9.79408 18.8268 9.62605 18.9451 9.49595L20.8046 7.45046H19.2C18.9067 7.45046 18.6404 7.27948 18.5182 7.01289L18.5194 7.01541L18.5143 7.00502C18.5086 6.9937 18.4986 6.97391 18.4839 6.94699C18.4545 6.89299 18.4072 6.81114 18.3411 6.71173C18.2079 6.51146 18.0043 6.24859 17.7251 5.99895ZM19.6354 5.95046C19.621 5.928 19.6059 5.9049 19.5902 5.88123C19.4046 5.60208 19.1207 5.23465 18.7249 4.88075C17.9204 4.16143 16.6563 3.5064 14.894 3.75799C12.7116 4.06946 11.8085 5.72548 11.4603 7.10402C11.2994 7.74137 11.2439 8.35521 11.2295 8.82692C10.7091 8.69341 10.0058 8.44181 9.15478 8.02627C7.78225 7.35608 6.09403 6.29269 4.29062 4.73304C4.07922 4.55021 3.78369 4.5001 3.52384 4.60302C3.26399 4.70594 3.08292 4.94482 3.05403 5.22281C2.63387 9.26677 3.79125 12.2366 5.07206 14.1979C5.70973 15.1744 6.37513 15.8971 6.88514 16.3786C6.97828 16.4665 7.06635 16.5465 7.14825 16.6186C6.97094 16.8216 6.74127 17.0665 6.46206 17.3283C5.71237 18.0311 4.62843 18.8337 3.26285 19.2889C2.99109 19.3795 2.79466 19.617 2.75665 19.9009C2.71864 20.1849 2.84568 20.4656 3.08404 20.6245C4.79305 21.7637 7.10731 22.0372 9.40103 21.6565C11.7071 21.2737 14.0861 20.217 15.991 18.5674C18.0252 16.8058 19.0869 14.6747 19.6399 12.9992C19.9169 12.1601 20.0685 11.4287 20.1513 10.9035C20.1895 10.661 20.2131 10.4617 20.2275 10.3151L23.055 7.20496C23.2547 6.9853 23.306 6.66853 23.1859 6.39704C23.0658 6.12556 22.7969 5.95046 22.5 5.95046H19.6354ZM18.5194 7.01541C18.5196 7.01597 18.5196 7.01601 18.5194 7.01541V7.01541Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Unarchive.tsx b/web/packages/design/src/Icon/Icons/Unarchive.tsx
index db582586399d4..46dd60108cd03 100644
--- a/web/packages/design/src/Icon/Icons/Unarchive.tsx
+++ b/web/packages/design/src/Icon/Icons/Unarchive.tsx
@@ -59,11 +59,11 @@ export const Unarchive = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12.75 8.56066V14.25C12.75 14.6642 12.4142 15 12 15C11.5858 15 11.25 14.6642 11.25 14.25V8.56066L9.53033 10.2803C9.23744 10.5732 8.76256 10.5732 8.46967 10.2803C8.17678 9.98744 8.17678 9.51256 8.46967 9.21967L11.4697 6.21967C11.5416 6.14776 11.6245 6.09351 11.7129 6.05691C11.8007 6.02051 11.8969 6.0003 11.9978 6L12 6L12.0022 6C12.1031 6.0003 12.1993 6.02051 12.2871 6.05691C12.3755 6.09351 12.4584 6.14776 12.5303 6.21967L15.5303 9.21967C15.8232 9.51256 15.8232 9.98744 15.5303 10.2803C15.2374 10.5732 14.7626 10.5732 14.4697 10.2803L12.75 8.56066Z" />
+      <path d="M12.75 8.56v5.69a.75.75 0 0 1-1.5 0V8.56l-1.72 1.72a.75.75 0 1 1-1.06-1.06l3-3a.75.75 0 0 1 .528-.22h.004a.75.75 0 0 1 .528.22l3 3a.75.75 0 1 1-1.06 1.06z" />
       <path
         fillRule="evenodd"
+        d="M4.5 3A1.5 1.5 0 0 0 3 4.5v15A1.5 1.5 0 0 0 4.5 21h15a1.5 1.5 0 0 0 1.5-1.5v-15A1.5 1.5 0 0 0 19.5 3zm0 16.5v-3.75h2.69L9 17.561c.282.281.663.439 1.06.439h3.88a1.5 1.5 0 0 0 1.06-.439l1.81-1.811h2.69v3.75zm12.31-5.25h2.69V4.5h-15v9.75h2.69c.397 0 .778.158 1.06.439l1.81 1.811h3.88l1.81-1.811c.281-.28.663-.439 1.06-.439"
         clipRule="evenodd"
-        d="M4.5 3C3.67157 3 3 3.67157 3 4.5V19.5C3 20.3284 3.67157 21 4.5 21H19.5C20.3284 21 21 20.3284 21 19.5V4.5C21 3.67157 20.3284 3 19.5 3H4.5ZM4.5 19.5V15.75H7.18934L9.00059 17.5613C9.28168 17.842 9.66302 17.9998 10.0603 18H13.94C14.3373 17.9998 14.7186 17.8417 14.9997 17.561L16.8107 15.75H19.5V19.5H4.5ZM16.8103 14.25H19.5V4.5H4.5V14.25H7.18969C7.58698 14.2502 7.96832 14.408 8.24941 14.6887L10.0607 16.5H13.9393L15.7503 14.689C16.0314 14.4083 16.413 14.2502 16.8103 14.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Unlink.tsx b/web/packages/design/src/Icon/Icons/Unlink.tsx
index 4e4b6ed8d5f51..71c25958c2de1 100644
--- a/web/packages/design/src/Icon/Icons/Unlink.tsx
+++ b/web/packages/design/src/Icon/Icons/Unlink.tsx
@@ -59,12 +59,7 @@ export const Unlink = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9.75 4.5C9.75 4.08579 9.41421 3.75 9 3.75C8.58579 3.75 8.25 4.08579 8.25 4.5V6.75C8.25 7.16421 8.58579 7.5 9 7.5C9.41421 7.5 9.75 7.16421 9.75 6.75V4.5Z" />
-      <path d="M15.743 3.79607C14.5631 3.78582 13.4264 4.23939 12.5777 5.0591C12.5704 5.06617 12.5632 5.07339 12.5562 5.08075L11.4574 6.232C11.1715 6.53165 11.1825 7.00639 11.4822 7.29237C11.7818 7.57836 12.2566 7.56728 12.5426 7.26763L13.6302 6.12804C14.1949 5.58788 14.9482 5.28922 15.73 5.29601C16.5166 5.30285 17.269 5.61835 17.8252 6.17458C18.3815 6.7308 18.697 7.48324 18.7038 8.26983C18.7106 9.05162 18.4119 9.80497 17.8718 10.3696L16.7322 11.4573C16.4325 11.7432 16.4215 12.218 16.7074 12.5176C16.9934 12.8173 17.4682 12.8284 17.7678 12.5424L18.9191 11.4436C18.9264 11.4366 18.9336 11.4294 18.9407 11.4221C19.7604 10.5734 20.214 9.43668 20.2038 8.2568C20.1935 7.07691 19.7202 5.94825 18.8859 5.11392C18.0516 4.27958 16.9229 3.80632 15.743 3.79607Z" />
-      <path d="M7.26763 12.5426C7.56728 12.2566 7.57836 11.7818 7.29237 11.4822C7.00639 11.1825 6.53165 11.1715 6.232 11.4574L5.08075 12.5562C5.07339 12.5632 5.06617 12.5704 5.0591 12.5777C4.23939 13.4264 3.78582 14.5631 3.79607 15.743C3.80632 16.9229 4.27958 18.0516 5.11392 18.8859C5.94825 19.7202 7.07691 20.1935 8.2568 20.2038C9.43668 20.214 10.5734 19.7604 11.4221 18.9407C11.4294 18.9336 11.4366 18.9264 11.4436 18.9191L12.5424 17.7678C12.8284 17.4682 12.8173 16.9934 12.5176 16.7074C12.218 16.4215 11.7432 16.4325 11.4573 16.7322L10.3696 17.8718C9.80497 18.4119 9.05162 18.7106 8.26983 18.7038C7.48324 18.697 6.7308 18.3815 6.17458 17.8252C5.61835 17.269 5.30285 16.5166 5.29601 15.73C5.28922 14.9482 5.58788 14.1949 6.12804 13.6302L7.26763 12.5426Z" />
-      <path d="M16.5 15C16.5 14.5858 16.8358 14.25 17.25 14.25H19.5C19.9142 14.25 20.25 14.5858 20.25 15C20.25 15.4142 19.9142 15.75 19.5 15.75H17.25C16.8358 15.75 16.5 15.4142 16.5 15Z" />
-      <path d="M4.5 8.25C4.08579 8.25 3.75 8.58579 3.75 9C3.75 9.41421 4.08579 9.75 4.5 9.75H6.75C7.16421 9.75 7.5 9.41421 7.5 9C7.5 8.58579 7.16421 8.25 6.75 8.25H4.5Z" />
-      <path d="M15 16.5C15.4142 16.5 15.75 16.8358 15.75 17.25V19.5C15.75 19.9142 15.4142 20.25 15 20.25C14.5858 20.25 14.25 19.9142 14.25 19.5V17.25C14.25 16.8358 14.5858 16.5 15 16.5Z" />
+      <path d="M9.75 4.5a.75.75 0 0 0-1.5 0v2.25a.75.75 0 0 0 1.5 0zm5.993-.704a4.5 4.5 0 0 0-3.187 1.285l-1.099 1.151a.75.75 0 0 0 1.086 1.036l1.087-1.14a3 3 0 0 1 4.242 4.242l-1.14 1.087a.75.75 0 1 0 1.036 1.085l1.151-1.098.022-.022a4.5 4.5 0 0 0-3.198-7.626m-8.475 8.747a.75.75 0 0 0-1.036-1.086l-1.151 1.1-.022.02a4.5 4.5 0 0 0 6.385 6.342l1.098-1.151a.75.75 0 1 0-1.085-1.036l-1.087 1.14a3 3 0 0 1-4.242-4.242zM16.5 15a.75.75 0 0 1 .75-.75h2.25a.75.75 0 0 1 0 1.5h-2.25a.75.75 0 0 1-.75-.75m-12-6.75a.75.75 0 0 0 0 1.5h2.25a.75.75 0 0 0 0-1.5zM15 16.5a.75.75 0 0 1 .75.75v2.25a.75.75 0 0 1-1.5 0v-2.25a.75.75 0 0 1 .75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Unlock.tsx b/web/packages/design/src/Icon/Icons/Unlock.tsx
index 6f3b94037c557..65ebdba6e2971 100644
--- a/web/packages/design/src/Icon/Icons/Unlock.tsx
+++ b/web/packages/design/src/Icon/Icons/Unlock.tsx
@@ -61,8 +61,8 @@ export const Unlock = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M9.879 3.129A3 3 0 0 1 12 2.25c1.468 0 2.74 1.048 3.015 2.4a.75.75 0 0 0 1.47-.3C16.064 2.28 14.16.75 12 .75a4.5 4.5 0 0 0-4.5 4.5V7.5h-3A1.5 1.5 0 0 0 3 9v10.5A1.5 1.5 0 0 0 4.5 21h15a1.5 1.5 0 0 0 1.5-1.5V9a1.5 1.5 0 0 0-1.5-1.5H9V5.25a3 3 0 0 1 .879-2.121M4.5 9v10.5h15V9z"
         clipRule="evenodd"
-        d="M9.87868 3.12868C10.4413 2.56607 11.2044 2.25 12 2.25C13.4683 2.25 14.7404 3.29757 15.015 4.64933C15.0975 5.05525 15.4934 5.31746 15.8993 5.23498C16.3053 5.15251 16.5675 4.75659 16.485 4.35067C16.064 2.27868 14.1598 0.75 12 0.75C10.8065 0.75 9.66193 1.22411 8.81802 2.06802C7.97411 2.91193 7.5 4.05653 7.5 5.25V7.5H4.5C3.67157 7.5 3 8.17157 3 9V19.5C3 20.3284 3.67157 21 4.5 21H19.5C20.3284 21 21 20.3284 21 19.5V9C21 8.17157 20.3284 7.5 19.5 7.5H9V5.25C9 4.45435 9.31607 3.69129 9.87868 3.12868ZM4.5 9V19.5H19.5V9H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Upload.tsx b/web/packages/design/src/Icon/Icons/Upload.tsx
index 1cf22e0f4e46d..14d27e104f678 100644
--- a/web/packages/design/src/Icon/Icons/Upload.tsx
+++ b/web/packages/design/src/Icon/Icons/Upload.tsx
@@ -59,8 +59,8 @@ export const Upload = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M11.25 5.56066V14.25C11.25 14.6642 11.5858 15 12 15C12.4142 15 12.75 14.6642 12.75 14.25V5.56066L15.2197 8.03033C15.5126 8.32322 15.9874 8.32322 16.2803 8.03033C16.5732 7.73744 16.5732 7.26256 16.2803 6.96967L12.5303 3.21967C12.4584 3.14776 12.3755 3.09351 12.2871 3.05691C12.1987 3.02024 12.1017 3 12 3C11.8983 3 11.8013 3.02024 11.7129 3.05691C11.6245 3.09351 11.5416 3.14776 11.4697 3.21967L7.71967 6.96967C7.42678 7.26256 7.42678 7.73744 7.71967 8.03033C8.01256 8.32322 8.48744 8.32322 8.78033 8.03033L11.25 5.56066Z" />
-      <path d="M3.75 13.5C4.16421 13.5 4.5 13.8358 4.5 14.25V19.5H19.5V14.25C19.5 13.8358 19.8358 13.5 20.25 13.5C20.6642 13.5 21 13.8358 21 14.25V19.5C21 19.8978 20.842 20.2794 20.5607 20.5607C20.2794 20.842 19.8978 21 19.5 21H4.5C4.10218 21 3.72065 20.842 3.43934 20.5607C3.15804 20.2794 3 19.8978 3 19.5V14.25C3 13.8358 3.33579 13.5 3.75 13.5Z" />
+      <path d="M11.25 5.56v8.69a.75.75 0 0 0 1.5 0V5.56l2.47 2.47a.75.75 0 1 0 1.06-1.06l-3.75-3.75a.75.75 0 0 0-1.06 0L7.72 6.97a.75.75 0 0 0 1.06 1.06z" />
+      <path d="M3.75 13.5a.75.75 0 0 1 .75.75v5.25h15v-5.25a.75.75 0 0 1 1.5 0v5.25a1.5 1.5 0 0 1-1.5 1.5h-15A1.5 1.5 0 0 1 3 19.5v-5.25a.75.75 0 0 1 .75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/UsbDrive.tsx b/web/packages/design/src/Icon/Icons/UsbDrive.tsx
index edc1394598921..5796bef08def5 100644
--- a/web/packages/design/src/Icon/Icons/UsbDrive.tsx
+++ b/web/packages/design/src/Icon/Icons/UsbDrive.tsx
@@ -59,12 +59,11 @@ export const UsbDrive = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M17.0301 5.96948C16.7372 5.67659 16.2624 5.67659 15.9695 5.96948C15.6766 6.26237 15.6766 6.73725 15.9695 7.03014L16.7281 7.78877C17.021 8.08166 17.4959 8.08166 17.7888 7.78877C18.0816 7.49588 18.0816 7.021 17.7888 6.72811L17.0301 5.96948Z" />
-      <path d="M8.96585 15.0346C9.59432 15.6631 10.6133 15.6631 11.2417 15.0346C11.8702 14.4062 11.8702 13.3872 11.2417 12.7587C10.6133 12.1303 9.59432 12.1303 8.96585 12.7587C8.33738 13.3872 8.33738 14.4062 8.96585 15.0346Z" />
+      <path d="M17.03 5.97a.75.75 0 1 0-1.06 1.06l.758.759a.75.75 0 0 0 1.06-1.06zm-8.064 9.065a1.61 1.61 0 1 0 2.276-2.276 1.61 1.61 0 0 0-2.276 2.276" />
       <path
         fillRule="evenodd"
+        d="M15.478 2.59 11.63 6.44a3 3 0 0 0-2.51.853l-6.16 6.16a3 3 0 0 0 0 4.242l3.344 3.344a3 3 0 0 0 4.243 0l6.159-6.16c.62-.62.911-1.442.876-2.254l3.965-3.965a2 2 0 0 0 0-2.829l-3.24-3.24a2 2 0 0 0-2.829 0m5.009 4.302-3.241-3.24a.5.5 0 0 0-.707 0L13.12 7.068l.04.04q.104.087.201.184l3.344 3.343q.097.098.184.202l.179.179 3.418-3.418a.5.5 0 0 0 0-.707M10.18 8.354a1.5 1.5 0 0 1 1.977-.128l3.616 3.616a1.5 1.5 0 0 1-.128 1.976l-6.16 6.16a1.5 1.5 0 0 1-2.12 0L4.02 16.634a1.5 1.5 0 0 1 0-2.121z"
         clipRule="evenodd"
-        d="M15.4782 2.59067L11.6295 6.43932C10.738 6.32356 9.8045 6.60808 9.11968 7.29289L2.96022 13.4524C1.78865 14.6239 1.78865 16.5234 2.96022 17.695L6.30388 21.0386C7.47545 22.2102 9.37494 22.2102 10.5465 21.0386L16.706 14.8792C17.3255 14.2596 17.6174 13.4365 17.5817 12.6252L21.5472 8.65971C22.3282 7.87866 22.3282 6.61233 21.5472 5.83128L18.3066 2.59067C17.5255 1.80962 16.2592 1.80962 15.4782 2.59067ZM20.4865 6.89194L17.2459 3.65133C17.0507 3.45607 16.7341 3.45607 16.5388 3.65133L13.1212 7.06898L13.1612 7.10897C13.2303 7.16668 13.2974 7.22799 13.3623 7.29289L16.706 10.6365C16.7709 10.7014 16.8322 10.7686 16.8899 10.8377L17.0689 11.0167L20.4865 7.59905C20.6818 7.40378 20.6818 7.0872 20.4865 6.89194ZM10.1803 8.35355C10.7201 7.8138 11.5689 7.77138 12.1572 8.22631L15.7726 11.8417C16.2275 12.43 16.1851 13.2788 15.6453 13.8185L9.48586 19.978C8.90007 20.5638 7.95032 20.5638 7.36454 19.978L4.02088 16.6343C3.4351 16.0485 3.4351 15.0988 4.02088 14.513L10.1803 8.35355Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/User.tsx b/web/packages/design/src/Icon/Icons/User.tsx
index c215423670e17..fe10dc329e71e 100644
--- a/web/packages/design/src/Icon/Icons/User.tsx
+++ b/web/packages/design/src/Icon/Icons/User.tsx
@@ -61,8 +61,8 @@ export const User = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M12 2.25a6.75 6.75 0 0 0-3.458 12.548c-2.638.866-4.816 2.7-6.191 5.076a.75.75 0 0 0 1.298.752c1.691-2.923 4.751-4.876 8.35-4.876 3.6 0 6.66 1.953 8.352 4.876a.75.75 0 0 0 1.298-.752c-1.376-2.377-3.553-4.21-6.19-5.076A6.75 6.75 0 0 0 12 2.25M6.75 9a5.25 5.25 0 1 1 10.5 0 5.25 5.25 0 0 1-10.5 0"
         clipRule="evenodd"
-        d="M12 2.25C8.27208 2.25 5.25 5.27208 5.25 9C5.25 11.4639 6.57018 13.6195 8.54176 14.798C5.90407 15.664 3.72635 17.4974 2.35075 19.8743C2.14327 20.2328 2.2657 20.6917 2.62421 20.8991C2.98272 21.1066 3.44154 20.9842 3.64901 20.6257C5.34045 17.703 8.40021 15.75 11.9999 15.75C15.5996 15.75 18.6593 17.703 20.3507 20.6257C20.5582 20.9842 21.017 21.1066 21.3755 20.8991C21.7341 20.6917 21.8565 20.2328 21.649 19.8743C20.2734 17.4974 18.0958 15.664 15.4582 14.7981C17.4298 13.6196 18.75 11.464 18.75 9C18.75 5.27208 15.7279 2.25 12 2.25ZM6.75 9C6.75 6.1005 9.1005 3.75 12 3.75C14.8995 3.75 17.25 6.1005 17.25 9C17.25 11.8995 14.8995 14.25 12 14.25C9.1005 14.25 6.75 11.8995 6.75 9Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/UserAdd.tsx b/web/packages/design/src/Icon/Icons/UserAdd.tsx
index f04141fd86832..4732793250810 100644
--- a/web/packages/design/src/Icon/Icons/UserAdd.tsx
+++ b/web/packages/design/src/Icon/Icons/UserAdd.tsx
@@ -61,10 +61,10 @@ export const UserAdd = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 9.375a6.375 6.375 0 1 1 9.755 5.406c2.003.656 3.723 1.885 5.07 3.486a.75.75 0 0 1-1.15.966c-1.798-2.141-4.315-3.483-7.3-3.483s-5.502 1.342-7.3 3.483a.75.75 0 0 1-1.15-.966c1.347-1.601 3.067-2.83 5.07-3.486A6.37 6.37 0 0 1 3.75 9.375M10.125 4.5a4.875 4.875 0 1 0 0 9.75 4.875 4.875 0 0 0 0-9.75"
         clipRule="evenodd"
-        d="M3.75 9.375C3.75 5.85418 6.60418 3 10.125 3C13.6458 3 16.5 5.85418 16.5 9.375C16.5 11.6544 15.3037 13.6544 13.5047 14.7814C15.508 15.4374 17.2277 16.6655 18.5742 18.2674C18.8407 18.5845 18.7997 19.0576 18.4826 19.3241C18.1655 19.5907 17.6924 19.5496 17.4259 19.2326C15.6266 17.0918 13.1097 15.75 10.125 15.75C7.14033 15.75 4.62341 17.0918 2.82416 19.2326C2.55765 19.5496 2.08455 19.5907 1.76746 19.3241C1.45037 19.0576 1.40937 18.5845 1.67588 18.2674C3.0223 16.6655 4.74199 15.4374 6.7453 14.7814C4.9463 13.6544 3.75 11.6544 3.75 9.375ZM10.125 4.5C7.43261 4.5 5.25 6.68261 5.25 9.375C5.25 12.0674 7.43261 14.25 10.125 14.25C12.8174 14.25 15 12.0674 15 9.375C15 6.68261 12.8174 4.5 10.125 4.5Z"
       />
-      <path d="M21.75 10.5C21.75 10.0858 21.4142 9.75 21 9.75C20.5858 9.75 20.25 10.0858 20.25 10.5V12H18.75C18.3358 12 18 12.3358 18 12.75C18 13.1642 18.3358 13.5 18.75 13.5H20.25V15C20.25 15.4142 20.5858 15.75 21 15.75C21.4142 15.75 21.75 15.4142 21.75 15V13.5H23.25C23.6642 13.5 24 13.1642 24 12.75C24 12.3358 23.6642 12 23.25 12H21.75V10.5Z" />
+      <path d="M21.75 10.5a.75.75 0 0 0-1.5 0V12h-1.5a.75.75 0 0 0 0 1.5h1.5V15a.75.75 0 0 0 1.5 0v-1.5h1.5a.75.75 0 0 0 0-1.5h-1.5z" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/UserCheck.tsx b/web/packages/design/src/Icon/Icons/UserCheck.tsx
new file mode 100644
index 0000000000000..15312dcc0d71e
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/UserCheck.tsx
@@ -0,0 +1,70 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const UserCheck = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-usercheck"
+      {...otherProps}
+      ref={ref}
+    >
+      <path
+        fillRule="evenodd"
+        d="M9.625 3a6.375 6.375 0 0 1 3.377 11.781c1.813.593 3.394 1.655 4.677 3.038l.395.449.046.061a.75.75 0 0 1-1.142.96l-.052-.057-.346-.391c-1.77-1.912-4.157-3.091-6.955-3.091-2.985 0-5.502 1.342-7.3 3.482a.75.75 0 0 1-1.15-.964c1.348-1.603 3.068-2.832 5.072-3.488A6.375 6.375 0 0 1 9.625 3m0 1.5a4.875 4.875 0 1 0 0 9.75 4.875 4.875 0 0 0 0-9.75"
+        clipRule="evenodd"
+      />
+      <path d="M22.47 10.97a.75.75 0 1 1 1.06 1.06l-3.5 3.5a.75.75 0 0 1-1.06 0l-2-2-.052-.056a.75.75 0 0 1 1.056-1.056l.056.052 1.47 1.47z" />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/UserCircleGear.tsx b/web/packages/design/src/Icon/Icons/UserCircleGear.tsx
index 16be34e4bb583..74d4451f0272d 100644
--- a/web/packages/design/src/Icon/Icons/UserCircleGear.tsx
+++ b/web/packages/design/src/Icon/Icons/UserCircleGear.tsx
@@ -61,13 +61,13 @@ export const UserCircleGear = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M19.5 2.625a.75.75 0 0 0-1.5 0v.503a2.3 2.3 0 0 0-.712.412l-.436-.252a.75.75 0 1 0-.75 1.3l.436.25a2.3 2.3 0 0 0 0 .823l-.437.252a.75.75 0 1 0 .75 1.3l.437-.253c.208.178.449.319.712.412v.503a.75.75 0 0 0 1.5 0v-.503a2.3 2.3 0 0 0 .712-.412l.436.252a.75.75 0 0 0 .75-1.299l-.436-.252a2.3 2.3 0 0 0 0-.822l.437-.252a.75.75 0 0 0-.75-1.299l-.437.252a2.3 2.3 0 0 0-.712-.412zm0 2.625a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0"
         clipRule="evenodd"
-        d="M19.5 2.625C19.5 2.21079 19.1642 1.875 18.75 1.875C18.3358 1.875 18 2.21079 18 2.625V3.12803C17.7366 3.22114 17.4957 3.36191 17.2876 3.53999L16.8515 3.28814C16.4928 3.081 16.0341 3.20386 15.827 3.56256C15.6198 3.92126 15.7427 4.37997 16.1014 4.58711L16.5375 4.83894C16.5129 4.97221 16.5 5.1096 16.5 5.25C16.5 5.39048 16.5129 5.52794 16.5375 5.66129L16.1014 5.91314C15.7427 6.12028 15.6198 6.57899 15.827 6.93769C16.0341 7.29639 16.4928 7.41925 16.8515 7.21211L17.2878 6.96016C17.4958 7.13817 17.7366 7.27889 18 7.37197V7.875C18 8.28921 18.3358 8.625 18.75 8.625C19.1642 8.625 19.5 8.28921 19.5 7.875V7.37197C19.7633 7.27889 20.0042 7.13818 20.2122 6.96018L20.6484 7.21211C21.0071 7.41925 21.4658 7.29639 21.673 6.93769C21.8801 6.57899 21.7573 6.12028 21.3986 5.91314L20.9625 5.66132C20.9871 5.52796 21 5.39048 21 5.25C21 5.10959 20.9871 4.97219 20.9625 4.83891L21.3986 4.58711C21.7573 4.37997 21.8801 3.92126 21.673 3.56256C21.4658 3.20386 21.0071 3.081 20.6484 3.28814L20.2124 3.53997C20.0043 3.3619 19.7634 3.22114 19.5 3.12803V2.625ZM19.5 5.25C19.5 5.66421 19.1642 6 18.75 6C18.3358 6 18 5.66421 18 5.25C18 4.83579 18.3358 4.5 18.75 4.5C19.1642 4.5 19.5 4.83579 19.5 5.25Z"
       />
       <path
         fillRule="evenodd"
+        d="M16.5 11.25c0 1.433-.67 2.71-1.714 3.534a7.5 7.5 0 0 1 3.377 2.69 8.24 8.24 0 0 0 1.973-6.85.75.75 0 1 1 1.479-.248 9.74 9.74 0 0 1-3.014 8.79.7.7 0 0 1-.173.154 9.74 9.74 0 0 1-7.921 2.299 9.74 9.74 0 0 1-4.888-2.271.75.75 0 0 1-.253-.227 9.743 9.743 0 0 1 8.258-16.735.75.75 0 0 1-.249 1.478 8.243 8.243 0 0 0-7.532 13.6 7.5 7.5 0 0 1 3.37-2.68A4.5 4.5 0 1 1 16.5 11.25m-7.5 0a3 3 0 1 1 3.113 2.998h-.226A3 3 0 0 1 9 11.25m-2.047 7.253a8.24 8.24 0 0 0 10.1.008 6 6 0 0 0-4.93-2.763 5 5 0 0 1-.246 0 6 6 0 0 0-4.924 2.755"
         clipRule="evenodd"
-        d="M16.5 11.25C16.5 12.6831 15.8301 13.9597 14.7864 14.7838C15.1793 14.9411 15.5598 15.1319 15.9235 15.3551C16.8119 15.9005 17.5737 16.6229 18.1635 17.4735C18.6426 16.9353 19.052 16.3335 19.3784 15.6812C20.1605 14.1185 20.4256 12.3477 20.1356 10.6245C20.0668 10.216 20.3422 9.82919 20.7507 9.76044C21.1592 9.69169 21.546 9.96709 21.6148 10.3756C21.9576 12.4124 21.6442 14.5054 20.7199 16.3525C20.1869 17.4175 19.4667 18.369 18.6005 19.1652C18.5523 19.2244 18.4945 19.2769 18.4278 19.3201C17.836 19.8388 17.18 20.2868 16.4723 20.6517C14.6365 21.5982 12.5474 21.9369 10.5066 21.6187C8.69175 21.3358 6.99865 20.5464 5.61887 19.348C5.51509 19.2908 5.42995 19.2122 5.36617 19.1206C5.28229 19.0425 5.1997 18.9628 5.11842 18.8815C3.65792 17.421 2.69938 15.5341 2.3812 13.4933C2.06302 11.4525 2.40166 9.36341 3.34824 7.52763C4.29481 5.69185 5.80033 4.2044 7.64741 3.28006C9.49449 2.35572 11.5875 2.04233 13.6243 2.38513C14.0328 2.45387 14.3082 2.84073 14.2395 3.2492C14.1707 3.65767 13.7839 3.93307 13.3754 3.86432C11.6522 3.5743 9.88139 3.83945 8.31869 4.62147C6.756 5.40349 5.48228 6.66193 4.68144 8.21506C3.88061 9.7682 3.5941 11.5357 3.86329 13.2623C4.10727 14.8271 4.79628 16.285 5.84315 17.4643C6.43205 16.6177 7.19148 15.8985 8.07672 15.3551C8.44034 15.1319 8.8208 14.9411 9.21372 14.7839C8.16994 13.9598 7.5 12.6831 7.5 11.25C7.5 8.76472 9.51472 6.75 12 6.75C14.4853 6.75 16.5 8.76472 16.5 11.25ZM9 11.25C9 9.59315 10.3431 8.25 12 8.25C13.6569 8.25 15 9.59315 15 11.25C15 12.8691 13.7174 14.1886 12.1128 14.2479C12.0753 14.2474 12.0377 14.2471 12.0001 14.2471C11.9625 14.2471 11.9248 14.2474 11.8872 14.2479C10.2826 14.1886 9 12.8691 9 11.25ZM6.95264 18.5031C8.05115 19.356 9.3525 19.9207 10.7377 20.1366C12.4642 20.4058 14.2317 20.1193 15.7848 19.3185C16.2334 19.0872 16.6574 18.8164 17.0524 18.5107C16.5657 17.7508 15.9123 17.1083 15.1388 16.6335C14.2296 16.0754 13.1886 15.7702 12.1235 15.7483C12.0825 15.7494 12.0413 15.75 12 15.75C11.9587 15.75 11.9176 15.7494 11.8766 15.7483C10.8115 15.7703 9.7706 16.0754 8.8614 16.6335C8.09051 17.1067 7.43887 17.7466 6.95264 18.5031Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/UserFocus.tsx b/web/packages/design/src/Icon/Icons/UserFocus.tsx
index f7e68aea23336..343569a2e2bb9 100644
--- a/web/packages/design/src/Icon/Icons/UserFocus.tsx
+++ b/web/packages/design/src/Icon/Icons/UserFocus.tsx
@@ -59,14 +59,11 @@ export const UserFocus = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M16.875 3C16.4608 3 16.125 3.33579 16.125 3.75C16.125 4.16421 16.4608 4.5 16.875 4.5L19.5 4.5V7.125C19.5 7.53921 19.8358 7.875 20.25 7.875C20.6642 7.875 21 7.53921 21 7.125V4.5C21 4.10218 20.842 3.72065 20.5607 3.43934C20.2794 3.15804 19.8978 3 19.5 3H16.875Z" />
-      <path d="M21 16.875C21 16.4608 20.6642 16.125 20.25 16.125C19.8358 16.125 19.5 16.4608 19.5 16.875V19.5H16.875C16.4608 19.5 16.125 19.8358 16.125 20.25C16.125 20.6642 16.4608 21 16.875 21H19.5C19.8978 21 20.2794 20.842 20.5607 20.5607C20.842 20.2794 21 19.8978 21 19.5V16.875Z" />
-      <path d="M3.75 16.125C4.16421 16.125 4.5 16.4608 4.5 16.875V19.5H7.125C7.53921 19.5 7.875 19.8358 7.875 20.25C7.875 20.6642 7.53921 21 7.125 21H4.5C4.10218 21 3.72065 20.842 3.43934 20.5607C3.15804 20.2794 3 19.8978 3 19.5V16.875C3 16.4608 3.33579 16.125 3.75 16.125Z" />
-      <path d="M4.5 3C4.10217 3 3.72064 3.15804 3.43934 3.43934C3.15804 3.72064 3 4.10217 3 4.5V7.125C3 7.53921 3.33579 7.875 3.75 7.875C4.16421 7.875 4.5 7.53921 4.5 7.125L4.5 4.5L7.125 4.5C7.53921 4.5 7.875 4.16421 7.875 3.75C7.875 3.33579 7.53921 3 7.125 3H4.5Z" />
+      <path d="M16.875 3a.75.75 0 0 0 0 1.5H19.5v2.625a.75.75 0 0 0 1.5 0V4.5A1.5 1.5 0 0 0 19.5 3zM21 16.875a.75.75 0 0 0-1.5 0V19.5h-2.625a.75.75 0 0 0 0 1.5H19.5a1.5 1.5 0 0 0 1.5-1.5zm-17.25-.75a.75.75 0 0 1 .75.75V19.5h2.625a.75.75 0 0 1 0 1.5H4.5A1.5 1.5 0 0 1 3 19.5v-2.625a.75.75 0 0 1 .75-.75M4.5 3A1.5 1.5 0 0 0 3 4.5v2.625a.75.75 0 0 0 1.5 0V4.5h2.625a.75.75 0 0 0 0-1.5z" />
       <path
         fillRule="evenodd"
+        d="M8.25 10.5a3.75 3.75 0 1 1 6.276 2.772q.165.071.325.151A6.4 6.4 0 0 1 17.1 15.3a.75.75 0 1 1-1.2.9 4.873 4.873 0 0 0-7.8 0 .75.75 0 1 1-1.2-.9 6.4 6.4 0 0 1 2.574-2.028A3.74 3.74 0 0 1 8.25 10.5M12 8.25a2.25 2.25 0 1 0 0 4.5 2.25 2.25 0 0 0 0-4.5"
         clipRule="evenodd"
-        d="M8.25 10.5C8.25 8.42893 9.92893 6.75 12 6.75C14.0711 6.75 15.75 8.42893 15.75 10.5C15.75 11.5981 15.278 12.5859 14.5259 13.2717C14.6355 13.319 14.7439 13.3695 14.851 13.423C15.7362 13.8656 16.5062 14.5083 17.1 15.3C17.3486 15.6314 17.2814 16.1015 16.95 16.35C16.6187 16.5985 16.1486 16.5314 15.9 16.2C15.446 15.5945 14.8571 15.1031 14.1802 14.7647C13.5033 14.4262 12.7569 14.25 12 14.25C11.2432 14.25 10.4968 14.4262 9.81988 14.7647C9.14296 15.1031 8.55414 15.5945 8.10004 16.2C7.85152 16.5314 7.38141 16.5985 7.05004 16.35C6.71867 16.1015 6.65152 15.6314 6.90004 15.3C7.49386 14.5083 8.26385 13.8656 9.14906 13.423C9.25613 13.3695 9.36453 13.3191 9.47413 13.2718C8.72198 12.5859 8.25 11.5981 8.25 10.5ZM12 8.25C10.7574 8.25 9.75 9.25736 9.75 10.5C9.75 11.7426 10.7574 12.75 12 12.75C13.2426 12.75 14.25 11.7426 14.25 10.5C14.25 9.25736 13.2426 8.25 12 8.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/UserIdBadge.tsx b/web/packages/design/src/Icon/Icons/UserIdBadge.tsx
index 07a8428ecea2b..ef36c8fe535a3 100644
--- a/web/packages/design/src/Icon/Icons/UserIdBadge.tsx
+++ b/web/packages/design/src/Icon/Icons/UserIdBadge.tsx
@@ -61,8 +61,8 @@ export const UserIdBadge = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.75 3.75a1.5 1.5 0 0 1 1.5-1.5h13.5a1.5 1.5 0 0 1 1.5 1.5v16.5a1.5 1.5 0 0 1-1.5 1.5H5.25a1.5 1.5 0 0 1-1.5-1.5zm15 0H5.25v16.5h13.5zM8.25 6A.75.75 0 0 1 9 5.25h6a.75.75 0 0 1 0 1.5H9A.75.75 0 0 1 8.25 6M12 10.5a2.25 2.25 0 1 0 0 4.5 2.25 2.25 0 0 0 0-4.5m2.526 5.022a3.75 3.75 0 1 0-5.052 0q-.165.071-.325.151A6.4 6.4 0 0 0 6.9 17.55a.75.75 0 1 0 1.2.9 4.874 4.874 0 0 1 7.8 0 .75.75 0 1 0 1.2-.9 6.4 6.4 0 0 0-2.574-2.028"
         clipRule="evenodd"
-        d="M3.75 3.75C3.75 2.92157 4.42157 2.25 5.25 2.25H18.75C19.5784 2.25 20.25 2.92157 20.25 3.75V20.25C20.25 21.0784 19.5784 21.75 18.75 21.75H5.25C4.42157 21.75 3.75 21.0784 3.75 20.25V3.75ZM18.75 3.75H5.25V20.25H18.75V3.75ZM8.25 6C8.25 5.58579 8.58579 5.25 9 5.25H15C15.4142 5.25 15.75 5.58579 15.75 6C15.75 6.41421 15.4142 6.75 15 6.75H9C8.58579 6.75 8.25 6.41421 8.25 6ZM12 10.5C10.7574 10.5 9.75 11.5074 9.75 12.75C9.75 13.9926 10.7574 15 12 15C13.2426 15 14.25 13.9926 14.25 12.75C14.25 11.5074 13.2426 10.5 12 10.5ZM14.5259 15.5218C15.278 14.8359 15.75 13.8481 15.75 12.75C15.75 10.6789 14.0711 9 12 9C9.92893 9 8.25 10.6789 8.25 12.75C8.25 13.8481 8.72197 14.8359 9.47412 15.5217C9.36451 15.569 9.2561 15.6195 9.14901 15.673C8.26381 16.1156 7.49381 16.7583 6.9 17.55C6.65147 17.8814 6.71863 18.3515 7.05 18.6C7.38137 18.8485 7.85147 18.7814 8.1 18.45C8.55409 17.8445 9.14291 17.3531 9.81983 17.0147C10.4968 16.6762 11.2432 16.5 12 16.5C12.7568 16.5 13.5032 16.6762 14.1802 17.0147C14.8571 17.3531 15.4459 17.8445 15.9 18.45C16.1485 18.7814 16.6186 18.8485 16.95 18.6C17.2814 18.3515 17.3485 17.8814 17.1 17.55C16.5062 16.7582 15.7362 16.1156 14.851 15.673C14.7439 15.6195 14.6355 15.569 14.5259 15.5218Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/UserList.tsx b/web/packages/design/src/Icon/Icons/UserList.tsx
index 0105fc61cbee9..4d80d775fdf56 100644
--- a/web/packages/design/src/Icon/Icons/UserList.tsx
+++ b/web/packages/design/src/Icon/Icons/UserList.tsx
@@ -61,12 +61,10 @@ export const UserList = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3 9.75a4.5 4.5 0 1 1 7.247 3.564c1.927.82 3.456 2.465 3.98 4.5a.75.75 0 0 1-1.453.373c-.576-2.238-2.801-3.937-5.274-3.937s-4.698 1.7-5.274 3.937a.75.75 0 0 1-1.452-.374c.523-2.034 2.052-3.68 3.979-4.499A4.5 4.5 0 0 1 3 9.75m4.5-3a3 3 0 1 0 0 6 3 3 0 0 0 0-6"
         clipRule="evenodd"
-        d="M3 9.75C3 7.26472 5.01472 5.25 7.5 5.25C9.98528 5.25 12 7.26472 12 9.75C12 11.201 11.3133 12.4915 10.2471 13.3144C12.1738 14.1336 13.7029 15.7786 14.2263 17.8131C14.3295 18.2143 14.0879 18.6232 13.6868 18.7264C13.2856 18.8295 12.8768 18.588 12.7736 18.1869C12.198 15.9495 9.97296 14.25 7.49994 14.25C5.02692 14.25 2.80185 15.9495 2.22629 18.1869C2.12309 18.588 1.71424 18.8295 1.31309 18.7264C0.911933 18.6232 0.67039 18.2143 0.773585 17.8131C1.29697 15.7786 2.82616 14.1335 4.75283 13.3144C3.6867 12.4915 3 11.2009 3 9.75ZM7.5 6.75C5.84315 6.75 4.5 8.09315 4.5 9.75C4.5 11.4069 5.84315 12.75 7.5 12.75C9.15685 12.75 10.5 11.4069 10.5 9.75C10.5 8.09315 9.15685 6.75 7.5 6.75Z"
       />
-      <path d="M13.5 7.5C13.5 7.08579 13.8358 6.75 14.25 6.75H23.25C23.6642 6.75 24 7.08579 24 7.5C24 7.91421 23.6642 8.25 23.25 8.25H14.25C13.8358 8.25 13.5 7.91421 13.5 7.5Z" />
-      <path d="M14.25 11.25C13.8358 11.25 13.5 11.5858 13.5 12C13.5 12.4142 13.8358 12.75 14.25 12.75H23.25C23.6642 12.75 24 12.4142 24 12C24 11.5858 23.6642 11.25 23.25 11.25H14.25Z" />
-      <path d="M15.75 16.5C15.75 16.0858 16.0858 15.75 16.5 15.75H23.25C23.6642 15.75 24 16.0858 24 16.5C24 16.9142 23.6642 17.25 23.25 17.25H16.5C16.0858 17.25 15.75 16.9142 15.75 16.5Z" />
+      <path d="M13.5 7.5a.75.75 0 0 1 .75-.75h9a.75.75 0 0 1 0 1.5h-9a.75.75 0 0 1-.75-.75m.75 3.75a.75.75 0 0 0 0 1.5h9a.75.75 0 0 0 0-1.5zm1.5 5.25a.75.75 0 0 1 .75-.75h6.75a.75.75 0 0 1 0 1.5H16.5a.75.75 0 0 1-.75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Users.tsx b/web/packages/design/src/Icon/Icons/Users.tsx
index 8afd0f8c86000..4665d556aab1a 100644
--- a/web/packages/design/src/Icon/Icons/Users.tsx
+++ b/web/packages/design/src/Icon/Icons/Users.tsx
@@ -61,10 +61,10 @@ export const Users = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M2.25 10.125a5.62 5.62 0 0 0 2.505 4.681A9 9 0 0 0 .33 18.341a.75.75 0 1 0 1.258.818 7.5 7.5 0 0 1 12.574 0 .75.75 0 1 0 1.258-.818 9 9 0 0 0-4.425-3.535 5.625 5.625 0 1 0-8.745-4.681M7.875 6a4.125 4.125 0 1 0 0 8.25 4.125 4.125 0 0 0 0-8.25"
         clipRule="evenodd"
-        d="M2.25 10.125C2.25 12.0774 3.24472 13.7975 4.75503 14.8061C4.35355 14.9545 3.96192 15.1318 3.5833 15.3372C2.26576 16.052 1.1476 17.0845 0.33035 18.3411C0.104514 18.6883 0.202926 19.1529 0.55016 19.3787C0.897393 19.6046 1.36196 19.5062 1.58779 19.1589C2.26884 18.1118 3.20063 17.2513 4.29859 16.6557C5.3635 16.078 6.55202 15.7671 7.76231 15.7489C7.79978 15.7496 7.83735 15.75 7.875 15.75C7.91266 15.75 7.95022 15.7496 7.9877 15.7489C9.19799 15.7671 10.3865 16.078 11.4514 16.6557C12.5494 17.2513 13.4812 18.1118 14.1622 19.1589C14.3881 19.5062 14.8526 19.6046 15.1999 19.3787C15.5471 19.1529 15.6455 18.6883 15.4197 18.3411C14.6024 17.0845 13.4843 16.052 12.1667 15.3372C11.7881 15.1318 11.3965 14.9545 10.995 14.8061C12.5053 13.7975 13.5 12.0774 13.5 10.125C13.5 7.0184 10.9816 4.5 7.875 4.5C4.7684 4.5 2.25 7.0184 2.25 10.125ZM7.875 6C5.59683 6 3.75 7.84683 3.75 10.125C3.75 12.3678 5.53991 14.1925 7.76918 14.2487C7.80444 14.2483 7.83972 14.248 7.87501 14.248C7.9103 14.248 7.94557 14.2483 7.98083 14.2487C10.2101 14.1925 12 12.3678 12 10.125C12 7.84683 10.1532 6 7.875 6Z"
       />
-      <path d="M16.1254 15.75C17.3744 15.7493 18.6037 16.0607 19.7017 16.6561C20.7996 17.2514 21.7314 18.1117 22.4122 19.1588C22.6379 19.5061 23.1025 19.6046 23.4498 19.3788C23.797 19.153 23.8955 18.6884 23.6697 18.3412C22.8526 17.0845 21.7344 16.0519 20.4167 15.3374C20.0368 15.1314 19.6438 14.9538 19.2409 14.8052C19.6975 14.5009 20.1083 14.1305 20.4594 13.7049C20.9866 13.0659 21.3662 12.3184 21.571 11.5157C21.7758 10.7131 21.8008 9.87505 21.6442 9.06159C21.4876 8.24813 21.1533 7.47931 20.6651 6.81005C20.1769 6.14079 19.5469 5.58762 18.8201 5.19007C18.0934 4.79252 17.2878 4.5604 16.4609 4.5103C15.634 4.4602 14.8063 4.59335 14.0368 4.90024C13.6521 5.05369 13.4646 5.48998 13.618 5.87472C13.7715 6.25946 14.2078 6.44696 14.5925 6.29351C15.1568 6.06845 15.7638 5.97081 16.3702 6.00755C16.9765 6.04429 17.5673 6.21451 18.1003 6.50605C18.6332 6.79759 19.0952 7.20325 19.4532 7.69404C19.8112 8.18482 20.0564 8.74863 20.1713 9.34517C20.2861 9.9417 20.2678 10.5562 20.1176 11.1449C19.9674 11.7335 19.6891 12.2817 19.3024 12.7503C18.9158 13.2188 18.4305 13.5962 17.8811 13.8555C17.3317 14.1148 16.7318 14.2495 16.1243 14.25C16.1212 14.25 16.118 14.25 16.1149 14.2501C16.0777 14.2506 16.0413 14.2537 16.0056 14.2594C15.6479 14.3166 15.3746 14.6268 15.375 15.0007C15.3753 15.363 15.6325 15.6651 15.9743 15.7349C16.0231 15.7448 16.0737 15.75 16.1254 15.75Z" />
+      <path d="M16.125 15.75a7.5 7.5 0 0 1 6.287 3.409.75.75 0 1 0 1.258-.818 9 9 0 0 0-4.43-3.536 5.62 5.62 0 0 0 2.404-5.743A5.625 5.625 0 0 0 14.037 4.9a.75.75 0 0 0 .555 1.394 4.125 4.125 0 1 1 1.523 7.956.75.75 0 0 0 .01 1.5" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/UsersTriple.tsx b/web/packages/design/src/Icon/Icons/UsersTriple.tsx
index d1a58ea40fd72..af227ab7b074d 100644
--- a/web/packages/design/src/Icon/Icons/UsersTriple.tsx
+++ b/web/packages/design/src/Icon/Icons/UsersTriple.tsx
@@ -59,13 +59,13 @@ export const UsersTriple = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M18.7786 6.13958C18.3839 5.99368 17.9562 5.96138 17.5441 6.04634C17.132 6.13131 16.752 6.33013 16.4472 6.62023C16.1424 6.91033 15.9251 7.28009 15.8199 7.6875C15.7163 8.08856 15.3072 8.32974 14.9062 8.22618C14.5051 8.12263 14.2639 7.71356 14.3675 7.3125C14.5428 6.63347 14.905 6.01722 15.413 5.53371C15.921 5.05021 16.5544 4.71884 17.2412 4.57724C17.9281 4.43564 18.6409 4.48947 19.2987 4.73264C19.9565 4.9758 20.5329 5.39854 20.9625 5.95286C21.3921 6.50717 21.6576 7.17084 21.729 7.8685C21.8003 8.56616 21.6746 9.26984 21.3661 9.89964C21.1579 10.3246 20.8722 10.7044 20.5256 11.0206C20.6354 11.0679 20.7441 11.1185 20.8514 11.1721C21.7369 11.6149 22.5069 12.258 23.1003 13.0505C23.3486 13.382 23.2811 13.8521 22.9495 14.1003C22.618 14.3486 22.1479 14.2811 21.8997 13.9496C21.4461 13.3438 20.8575 12.8522 20.1806 12.5138C19.5038 12.1754 18.7573 11.9994 18.0006 12C17.9488 12 17.898 11.9948 17.8492 11.9848C17.5074 11.9151 17.2501 11.6128 17.2499 11.2504C17.2498 10.8879 17.5067 10.5854 17.8484 10.5153C17.8942 10.5059 17.9415 10.5007 17.9899 10.5001L17.9996 10.5C18.4203 10.4998 18.8326 10.3816 19.1896 10.1588C19.5466 9.93606 19.8339 9.61766 20.019 9.23978C20.2041 8.86191 20.2796 8.4397 20.2368 8.0211C20.1939 7.60251 20.0346 7.2043 19.7769 6.87171C19.5191 6.53913 19.1732 6.28548 18.7786 6.13958Z" />
+      <path d="M18.779 6.14a2.25 2.25 0 0 0-2.96 1.548.75.75 0 0 1-1.452-.375 3.75 3.75 0 1 1 6.159 3.708 6.36 6.36 0 0 1 2.574 2.03.75.75 0 1 1-1.2.899A4.87 4.87 0 0 0 18 12a.75.75 0 0 1-.01-1.5H18a2.25 2.25 0 0 0 .779-4.36" />
       <path
         fillRule="evenodd"
+        d="M7.5 13.5a4.5 4.5 0 1 1 7.238 3.572 6.86 6.86 0 0 1 3.158 2.797.75.75 0 0 1-1.292.762 5.345 5.345 0 0 0-9.208 0 .75.75 0 0 1-1.292-.762 6.84 6.84 0 0 1 3.158-2.797A4.5 4.5 0 0 1 7.5 13.5m4.5-3a3 3 0 1 0 0 6 3 3 0 0 0 0-6"
         clipRule="evenodd"
-        d="M7.5 13.5C7.5 11.0147 9.51472 9 12 9C14.4853 9 16.5 11.0147 16.5 13.5C16.5 14.9551 15.8093 16.2489 14.738 17.0715C14.9623 17.1694 15.1818 17.2796 15.3956 17.4017C16.4296 17.9926 17.2916 18.8431 17.8963 19.8692C18.1066 20.2261 17.9877 20.6859 17.6309 20.8962C17.274 21.1064 16.8143 20.9876 16.604 20.6308C16.1318 19.8296 15.4588 19.1655 14.6514 18.7041C13.8439 18.2427 12.9301 18 12.0001 18C11.0702 18 10.1563 18.2427 9.34888 18.7041C8.54145 19.1655 7.8684 19.8296 7.39627 20.6308C7.18598 20.9876 6.72621 21.1064 6.36935 20.8962C6.01249 20.6859 5.89367 20.2261 6.10397 19.8692C6.70862 18.8431 7.57059 17.9926 8.60467 17.4017C8.81834 17.2796 9.03783 17.1695 9.26212 17.0716C8.19069 16.249 7.5 14.9552 7.5 13.5ZM12 10.5C10.3431 10.5 9 11.8431 9 13.5C9 15.1569 10.3431 16.5 12 16.5C13.6569 16.5 15 15.1569 15 13.5C15 11.8431 13.6569 10.5 12 10.5Z"
       />
-      <path d="M3.81943 12.5138C4.49629 12.1754 5.24274 11.9994 5.99948 12C6.41369 12.0003 6.74973 11.6648 6.75004 11.2506C6.75035 10.842 6.42386 10.5094 6.01741 10.5002C6.01174 10.5001 6.00604 10.5 6.00033 10.5C5.57955 10.4998 5.16727 10.3816 4.8103 10.1588C4.45332 9.93606 4.16597 9.61766 3.98087 9.23978C3.79576 8.86191 3.72033 8.4397 3.76314 8.0211C3.80595 7.60251 3.96528 7.2043 4.22303 6.87171C4.48079 6.53913 4.82664 6.28548 5.22132 6.13958C5.61599 5.99368 6.04367 5.96138 6.45578 6.04634C6.86789 6.13131 7.24792 6.33013 7.55271 6.62023C7.85749 6.91033 8.07483 7.28008 8.18002 7.6875C8.28357 8.08856 8.69264 8.32974 9.0937 8.22618C9.49476 8.12263 9.73594 7.71356 9.63239 7.3125C9.45706 6.63347 9.09484 6.01722 8.58687 5.53371C8.07889 5.05021 7.44551 4.71884 6.75866 4.57724C6.0718 4.43564 5.35901 4.48947 4.70122 4.73264C4.04343 4.9758 3.467 5.39854 3.03741 5.95286C2.60782 6.50717 2.34227 7.17084 2.27092 7.8685C2.19958 8.56616 2.3253 9.26984 2.6338 9.89964C2.84196 10.3246 3.12772 10.7044 3.47436 11.0206C3.36453 11.068 3.2559 11.1185 3.14861 11.1721C2.26313 11.6149 1.49311 12.258 0.899707 13.0505C0.651428 13.382 0.718938 13.8521 1.0505 14.1003C1.38205 14.3486 1.8521 14.2811 2.10038 13.9496C2.55397 13.3438 3.14258 12.8522 3.81943 12.5138Z" />
+      <path d="M3.82 12.514A4.9 4.9 0 0 1 6 12a.75.75 0 1 0 0-1.5 2.25 2.25 0 1 1 2.18-2.812.75.75 0 1 0 1.452-.375 3.75 3.75 0 1 0-6.158 3.708A6.37 6.37 0 0 0 .9 13.05a.75.75 0 1 0 1.201.899 4.9 4.9 0 0 1 1.72-1.436" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Vault.tsx b/web/packages/design/src/Icon/Icons/Vault.tsx
index 197c030ed97b2..9d7f8f4bac881 100644
--- a/web/packages/design/src/Icon/Icons/Vault.tsx
+++ b/web/packages/design/src/Icon/Icons/Vault.tsx
@@ -61,8 +61,8 @@ export const Vault = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M2.25 5.25a1.5 1.5 0 0 1 1.5-1.5h16.5a1.5 1.5 0 0 1 1.5 1.5V18a1.5 1.5 0 0 1-1.5 1.5h-1.5V21a.75.75 0 0 1-1.5 0v-1.5H6.75V21a.75.75 0 0 1-1.5 0v-1.5h-1.5a1.5 1.5 0 0 1-1.5-1.5zm18 0v6h-1.562A4.501 4.501 0 0 0 9.75 12a4.5 4.5 0 0 0 8.938.75h1.562V18H3.75V5.25zm-3.094 6h-1.829a1.312 1.312 0 1 0 0 1.5h1.829A3.001 3.001 0 0 1 11.25 12a3 3 0 0 1 5.906-.75"
         clipRule="evenodd"
-        d="M2.25 5.25C2.25 4.42157 2.92157 3.75 3.75 3.75H20.25C21.0784 3.75 21.75 4.42157 21.75 5.25V18C21.75 18.8284 21.0784 19.5 20.25 19.5H18.75V21C18.75 21.4142 18.4142 21.75 18 21.75C17.5858 21.75 17.25 21.4142 17.25 21V19.5H6.75V21C6.75 21.4142 6.41421 21.75 6 21.75C5.58579 21.75 5.25 21.4142 5.25 21V19.5H3.75C2.92157 19.5 2.25 18.8284 2.25 18V5.25ZM20.25 5.25V11.25H18.6878C18.3307 9.12172 16.4797 7.5 14.25 7.5C11.7647 7.5 9.75 9.51472 9.75 12C9.75 14.4853 11.7647 16.5 14.25 16.5C16.4797 16.5 18.3307 14.8783 18.6878 12.75H20.25V18H3.75V5.25H20.25ZM17.1555 11.25H15.3272C15.0901 10.91 14.696 10.6875 14.25 10.6875C13.5251 10.6875 12.9375 11.2751 12.9375 12C12.9375 12.7249 13.5251 13.3125 14.25 13.3125C14.696 13.3125 15.0901 13.09 15.3272 12.75H17.1555C16.8225 14.0439 15.6479 15 14.25 15C12.5931 15 11.25 13.6569 11.25 12C11.25 10.3431 12.5931 9 14.25 9C15.6479 9 16.8225 9.95608 17.1555 11.25Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/VideoGame.tsx b/web/packages/design/src/Icon/Icons/VideoGame.tsx
index 6b97c2fab375e..a2566ab1558b9 100644
--- a/web/packages/design/src/Icon/Icons/VideoGame.tsx
+++ b/web/packages/design/src/Icon/Icons/VideoGame.tsx
@@ -59,12 +59,11 @@ export const VideoGame = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M9 8.25C9 7.83579 8.66421 7.5 8.25 7.5C7.83579 7.5 7.5 7.83579 7.5 8.25V9H6.75C6.33579 9 6 9.33579 6 9.75C6 10.1642 6.33579 10.5 6.75 10.5H7.5V11.25C7.5 11.6642 7.83579 12 8.25 12C8.66421 12 9 11.6642 9 11.25V10.5H9.75C10.1642 10.5 10.5 10.1642 10.5 9.75C10.5 9.33579 10.1642 9 9.75 9H9V8.25Z" />
-      <path d="M13.5 9.75C13.5 9.33579 13.8358 9 14.25 9H16.5C16.9142 9 17.25 9.33579 17.25 9.75C17.25 10.1642 16.9142 10.5 16.5 10.5H14.25C13.8358 10.5 13.5 10.1642 13.5 9.75Z" />
+      <path d="M9 8.25a.75.75 0 0 0-1.5 0V9h-.75a.75.75 0 0 0 0 1.5h.75v.75a.75.75 0 0 0 1.5 0v-.75h.75a.75.75 0 0 0 0-1.5H9zm4.5 1.5a.75.75 0 0 1 .75-.75h2.25a.75.75 0 0 1 0 1.5h-2.25a.75.75 0 0 1-.75-.75" />
       <path
         fillRule="evenodd"
+        d="M7.863 3.75h8.262a5.625 5.625 0 0 1 5.542 4.664L23.2 16.29a3.375 3.375 0 0 1-5.743 2.938L13.732 15h-3.464l-3.724 4.227-.033.035a3.375 3.375 0 0 1-5.71-2.973l.003-.013 1.533-7.881A5.625 5.625 0 0 1 7.863 3.75M15.731 15l2.834 3.216a1.875 1.875 0 0 0 3.157-1.66l-.819-4.213A5.62 5.62 0 0 1 16.125 15zm4.453-6.36.006.035.002.01a4.125 4.125 0 0 1-4.067 4.815H9.929a.75.75 0 0 0-.563.254l-3.93 4.462a1.875 1.875 0 0 1-3.158-1.66L3.81 8.673l.003-.013a4.125 4.125 0 0 1 4.053-3.41h8.259a4.125 4.125 0 0 1 4.059 3.39"
         clipRule="evenodd"
-        d="M7.86299 3.75L7.86465 3.75H16.125C17.6168 3.75 19.0475 4.34263 20.1024 5.39753C20.9281 6.22321 21.4706 7.27916 21.6674 8.41444L23.1986 16.2894C23.323 16.9962 23.2189 17.7242 22.9014 18.3678C22.5839 19.0114 22.0696 19.5371 21.433 19.8684C20.7965 20.1998 20.0709 20.3197 19.3616 20.2106C18.6523 20.1015 17.9962 19.7692 17.4887 19.2618C17.4774 19.2506 17.4666 19.2391 17.4561 19.2272L13.7321 15H10.2678L6.54398 19.227C6.5335 19.2389 6.52264 19.2505 6.51142 19.2617C6.00386 19.769 5.34779 20.1014 4.6385 20.2104C3.9292 20.3195 3.2036 20.1997 2.56705 19.8683C1.93051 19.5369 1.41616 19.0113 1.09869 18.3677C0.781228 17.7241 0.677175 16.9961 0.801643 16.2893L0.803948 16.2762L2.33656 8.39453C2.56636 7.09633 3.24488 5.92 4.25375 5.07105C5.26441 4.2206 6.54212 3.75293 7.86299 3.75ZM15.7312 15L18.5646 18.2163C18.8444 18.4895 19.2027 18.6685 19.5896 18.728C19.9836 18.7886 20.3868 18.722 20.7404 18.5379C21.094 18.3538 21.3798 18.0618 21.5561 17.7043C21.7316 17.3485 21.7897 16.9464 21.7222 16.5556L20.9032 12.3431C20.6776 12.7063 20.4096 13.0453 20.1024 13.3525C19.0475 14.4074 17.6168 15 16.125 15H15.7312ZM20.1839 8.63936C20.1856 8.65107 20.1876 8.6628 20.1898 8.67454L20.1917 8.68429C20.2302 8.91101 20.25 9.14199 20.25 9.375C20.25 10.469 19.8154 11.5182 19.0418 12.2918C18.2682 13.0654 17.219 13.5 16.125 13.5H9.92903C9.71363 13.5 9.50864 13.5926 9.36626 13.7542L5.4355 18.2161C5.15572 18.4893 4.79736 18.6684 4.4105 18.7279C4.01644 18.7885 3.61333 18.7219 3.25969 18.5378C2.90606 18.3537 2.62031 18.0617 2.44394 17.7041C2.26847 17.3484 2.21035 16.9462 2.27786 16.5555L3.81024 8.6744L3.81271 8.66106C3.98035 7.70704 4.47839 6.84244 5.21954 6.21877C5.96048 5.59527 6.89716 5.25234 7.86551 5.25H16.125C17.219 5.25 18.2682 5.6846 19.0418 6.45819C19.6397 7.05611 20.0351 7.8187 20.1839 8.63936Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/VolumeUp.tsx b/web/packages/design/src/Icon/Icons/VolumeUp.tsx
index 8b3d1b21618f8..dc0fb1e90e598 100644
--- a/web/packages/design/src/Icon/Icons/VolumeUp.tsx
+++ b/web/packages/design/src/Icon/Icons/VolumeUp.tsx
@@ -61,11 +61,10 @@ export const VolumeUp = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M15 3a.75.75 0 0 0-1.21-.592L7.243 7.5H3A1.5 1.5 0 0 0 1.5 9v6A1.5 1.5 0 0 0 3 16.5h4.243l6.547 5.092A.75.75 0 0 0 15 21zM8.25 8.617l5.25-4.084v14.933l-5.25-4.083zM6.75 9H3v6h3.75z"
         clipRule="evenodd"
-        d="M15 3.00001C15 2.71356 14.8368 2.45212 14.5795 2.32627C14.3222 2.20042 14.0157 2.23213 13.7895 2.40799L7.24267 7.50001H3C2.60217 7.50001 2.22064 7.65804 1.93934 7.93935C1.65804 8.22065 1.5 8.60218 1.5 9.00001V15C1.5 15.3978 1.65803 15.7794 1.93934 16.0607C2.22065 16.342 2.60218 16.5 3 16.5H7.24267L13.7895 21.592C14.0157 21.7679 14.3222 21.7996 14.5795 21.6737C14.8368 21.5479 15 21.2865 15 21V3.00001ZM8.25 8.61682L13.5 4.53349V19.4665L8.25 15.3832V8.61682ZM6.75 9.00001H3V15H6.75V9.00001Z"
       />
-      <path d="M17.5043 9.45476C17.8151 9.18099 18.2891 9.21104 18.5628 9.52188C19.166 10.2067 19.4987 11.0879 19.4987 12.0004C19.4987 12.9129 19.166 13.7941 18.5628 14.4789C18.2891 14.7898 17.8151 14.8198 17.5043 14.546C17.1935 14.2723 17.1634 13.7984 17.4372 13.4875C17.799 13.0766 17.9987 12.5479 17.9987 12.0004C17.9987 11.4529 17.799 10.9242 17.4372 10.5133C17.1634 10.2024 17.1935 9.72853 17.5043 9.45476Z" />
-      <path d="M21.3405 7.00001C21.0644 6.69127 20.5902 6.66485 20.2815 6.94099C19.9728 7.21713 19.9463 7.69127 20.2225 8.00001C21.2064 9.10005 21.7503 10.5241 21.7503 12C21.7503 13.4759 21.2064 14.9 20.2225 16C19.9463 16.3087 19.9728 16.7829 20.2815 17.059C20.5902 17.3352 21.0644 17.3087 21.3405 17C22.5704 15.625 23.2503 13.8448 23.2503 12C23.2503 10.1552 22.5704 8.37506 21.3405 7.00001Z" />
+      <path d="M17.504 9.455a.75.75 0 0 1 1.059.067 3.75 3.75 0 0 1 0 4.957.75.75 0 1 1-1.126-.991 2.25 2.25 0 0 0 0-2.975.75.75 0 0 1 .067-1.058M21.34 7a.75.75 0 1 0-1.117 1 6 6 0 0 1 0 8 .75.75 0 1 0 1.117 1 7.5 7.5 0 0 0 0-10" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/VpnKey.tsx b/web/packages/design/src/Icon/Icons/VpnKey.tsx
index f6a2e10267bf7..64b21ca6d6f14 100644
--- a/web/packages/design/src/Icon/Icons/VpnKey.tsx
+++ b/web/packages/design/src/Icon/Icons/VpnKey.tsx
@@ -59,11 +59,11 @@ export const VpnKey = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M7 14C8.10457 14 9 13.1046 9 12C9 10.8954 8.10457 10 7 10C5.89543 10 5 10.8954 5 12C5 13.1046 5.89543 14 7 14Z" />
+      <path d="M7 14a2 2 0 1 0 0-4 2 2 0 0 0 0 4" />
       <path
         fillRule="evenodd"
+        d="M7 6a6 6 0 0 1 5.456 3.5H21.5A1.5 1.5 0 0 1 23 11v2a1.5 1.5 0 0 1-1.5 1.5h-1v2A1.5 1.5 0 0 1 19 18h-2a1.5 1.5 0 0 1-1.5-1.5v-2h-3.044A6.001 6.001 0 1 1 7 6m4.093 4.126.401.874H21.5v2H19v3.5h-2V13h-5.506l-.401.874a4.501 4.501 0 1 1 0-3.748"
         clipRule="evenodd"
-        d="M7 6C9.42149 6 11.5079 7.43447 12.456 9.5H21.5C22.3284 9.5 23 10.1716 23 11V13C23 13.8284 22.3284 14.5 21.5 14.5H20.5V16.5C20.5 17.3284 19.8284 18 19 18H17C16.1716 18 15.5 17.3284 15.5 16.5V14.5H12.456C11.5079 16.5655 9.42149 18 7 18C3.68629 18 1 15.3137 1 12C1 8.68629 3.68629 6 7 6ZM11.0927 10.1257L11.494 11H21.5V13H19V16.5H17V13H11.494L11.0927 13.8743C10.3801 15.4268 8.81383 16.5 7 16.5C4.51472 16.5 2.5 14.4853 2.5 12C2.5 9.51472 4.51472 7.5 7 7.5C8.81383 7.5 10.3801 8.5732 11.0927 10.1257Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Wand.tsx b/web/packages/design/src/Icon/Icons/Wand.tsx
index 8e1ba8801f0a6..b203151adbaf6 100644
--- a/web/packages/design/src/Icon/Icons/Wand.tsx
+++ b/web/packages/design/src/Icon/Icons/Wand.tsx
@@ -61,12 +61,10 @@ export const Wand = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M3.44 16.5a1.5 1.5 0 0 0 0 2.121l1.938 1.94a1.5 1.5 0 0 0 2.121 0l9.507-9.508.047-.046L20.56 7.5a1.5 1.5 0 0 0 0-2.122L18.621 3.44a1.5 1.5 0 0 0-2.121 0zM16.5 9.439l3-3L17.56 4.5l-3 3zm-3-.878-9 9L6.439 19.5l9-9z"
         clipRule="evenodd"
-        d="M3.4391 16.5C2.85331 17.0858 2.85331 18.0356 3.4391 18.6214L5.37811 20.5604C5.9639 21.1462 6.91365 21.1462 7.49943 20.5604L17.0064 11.0534C17.0145 11.046 17.0225 11.0383 17.0303 11.0305C17.0382 11.0226 17.0458 11.0147 17.0533 11.0065L20.5601 7.49968C21.1459 6.91389 21.1459 5.96415 20.5601 5.37836L18.6211 3.43934C18.0353 2.85355 17.0856 2.85355 16.4998 3.43934L3.4391 16.5ZM16.4995 9.43899L19.4995 6.43902L17.5605 4.5L14.5605 7.49997L16.4995 9.43899ZM13.4998 8.56063L4.49976 17.5607L6.43877 19.4997L15.4388 10.4996L13.4998 8.56063Z"
       />
-      <path d="M7.50002 3.00016C7.91423 3.00016 8.25002 3.33594 8.25002 3.75016V5.25016H9.75002C10.1642 5.25016 10.5 5.58594 10.5 6.00016C10.5 6.41437 10.1642 6.75016 9.75002 6.75016H8.25002V8.25016C8.25002 8.66437 7.91423 9.00016 7.50002 9.00016C7.0858 9.00016 6.75002 8.66437 6.75002 8.25016V6.75016H5.25002C4.8358 6.75016 4.50002 6.41437 4.50002 6.00016C4.50002 5.58594 4.8358 5.25016 5.25002 5.25016H6.75002V3.75016C6.75002 3.33594 7.0858 3.00016 7.50002 3.00016Z" />
-      <path d="M21 12.0002C21 11.5859 20.6642 11.2502 20.25 11.2502C19.8358 11.2502 19.5 11.5859 19.5 12.0002V13.5002H18C17.5858 13.5002 17.25 13.8359 17.25 14.2502C17.25 14.6644 17.5858 15.0002 18 15.0002H19.5V16.5002C19.5 16.9144 19.8358 17.2502 20.25 17.2502C20.6642 17.2502 21 16.9144 21 16.5002V15.0002H22.5C22.9142 15.0002 23.25 14.6644 23.25 14.2502C23.25 13.8359 22.9142 13.5002 22.5 13.5002H21V12.0002Z" />
-      <path d="M15.75 16.5002C16.1642 16.5002 16.5 16.8359 16.5 17.2502V18.0002H17.25C17.6642 18.0002 18 18.3359 18 18.7502C18 19.1644 17.6642 19.5002 17.25 19.5002H16.5V20.2502C16.5 20.6644 16.1642 21.0002 15.75 21.0002C15.3358 21.0002 15 20.6644 15 20.2502V19.5002H14.25C13.8358 19.5002 13.5 19.1644 13.5 18.7502C13.5 18.3359 13.8358 18.0002 14.25 18.0002H15V17.2502C15 16.8359 15.3358 16.5002 15.75 16.5002Z" />
+      <path d="M7.5 3a.75.75 0 0 1 .75.75v1.5h1.5a.75.75 0 0 1 0 1.5h-1.5v1.5a.75.75 0 0 1-1.5 0v-1.5h-1.5a.75.75 0 1 1 0-1.5h1.5v-1.5A.75.75 0 0 1 7.5 3M21 12a.75.75 0 1 0-1.5 0v1.5H18a.75.75 0 1 0 0 1.5h1.5v1.5a.75.75 0 0 0 1.5 0V15h1.5a.75.75 0 0 0 0-1.5H21zm-5.25 4.5a.75.75 0 0 1 .75.75V18h.75a.75.75 0 1 1 0 1.5h-.75v.75a.75.75 0 0 1-1.5 0v-.75h-.75a.75.75 0 0 1 0-1.5H15v-.75a.75.75 0 0 1 .75-.75" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Warning.tsx b/web/packages/design/src/Icon/Icons/Warning.tsx
index 4d126599460f5..a50c4668062a5 100644
--- a/web/packages/design/src/Icon/Icons/Warning.tsx
+++ b/web/packages/design/src/Icon/Icons/Warning.tsx
@@ -59,12 +59,11 @@ export const Warning = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 9C12.4142 9 12.75 9.33579 12.75 9.75V13.5C12.75 13.9142 12.4142 14.25 12 14.25C11.5858 14.25 11.25 13.9142 11.25 13.5V9.75C11.25 9.33579 11.5858 9 12 9Z" />
-      <path d="M12 17.8125C12.5178 17.8125 12.9375 17.3928 12.9375 16.875C12.9375 16.3572 12.5178 15.9375 12 15.9375C11.4822 15.9375 11.0625 16.3572 11.0625 16.875C11.0625 17.3928 11.4822 17.8125 12 17.8125Z" />
+      <path d="M12 9a.75.75 0 0 1 .75.75v3.75a.75.75 0 0 1-1.5 0V9.75A.75.75 0 0 1 12 9m0 8.813a.937.937 0 1 0 0-1.875.937.937 0 0 0 0 1.874" />
       <path
         fillRule="evenodd"
+        d="M10.09 3.343 1.881 17.709C1.043 19.175 2.101 21 3.791 21H20.21c1.69 0 2.748-1.825 1.91-3.291L13.91 3.343c-.844-1.478-2.975-1.478-3.82 0m-6.907 15.11 8.21-14.366a.7.7 0 0 1 1.215 0l8.209 14.366a.7.7 0 0 1-.608 1.047H3.791a.7.7 0 0 1-.608-1.047"
         clipRule="evenodd"
-        d="M10.09 3.34287L1.88101 17.7086C1.04292 19.1753 2.10193 21.0001 3.79114 21.0001H20.2092C21.8984 21.0001 22.9574 19.1753 22.1193 17.7086L13.9103 3.34287C13.0657 1.86488 10.9346 1.86488 10.09 3.34287ZM3.18337 18.4528L11.3924 4.08708C11.6611 3.61681 12.3392 3.61681 12.6079 4.08708L20.8169 18.4528C21.0836 18.9195 20.7466 19.5001 20.2092 19.5001H3.79114C3.25367 19.5001 2.91671 18.9195 3.18337 18.4528Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/WarningCircle.tsx b/web/packages/design/src/Icon/Icons/WarningCircle.tsx
index 82e68a0d017d5..cd04ec6ba1dd4 100644
--- a/web/packages/design/src/Icon/Icons/WarningCircle.tsx
+++ b/web/packages/design/src/Icon/Icons/WarningCircle.tsx
@@ -59,12 +59,11 @@ export const WarningCircle = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 6.75C12.4142 6.75 12.75 7.08579 12.75 7.5V12.75C12.75 13.1642 12.4142 13.5 12 13.5C11.5858 13.5 11.25 13.1642 11.25 12.75V7.5C11.25 7.08579 11.5858 6.75 12 6.75Z" />
-      <path d="M12.9375 16.125C12.9375 16.6428 12.5178 17.0625 12 17.0625C11.4822 17.0625 11.0625 16.6428 11.0625 16.125C11.0625 15.6072 11.4822 15.1875 12 15.1875C12.5178 15.1875 12.9375 15.6072 12.9375 16.125Z" />
+      <path d="M12 6.75a.75.75 0 0 1 .75.75v5.25a.75.75 0 0 1-1.5 0V7.5a.75.75 0 0 1 .75-.75m.938 9.375a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
       <path
         fillRule="evenodd"
+        d="M2.25 12c0-5.385 4.365-9.75 9.75-9.75s9.75 4.365 9.75 9.75-4.365 9.75-9.75 9.75S2.25 17.385 2.25 12M12 3.75a8.25 8.25 0 1 0 0 16.5 8.25 8.25 0 0 0 0-16.5"
         clipRule="evenodd"
-        d="M2.25 12C2.25 6.61522 6.61522 2.25 12 2.25C17.3848 2.25 21.75 6.61522 21.75 12C21.75 17.3848 17.3848 21.75 12 21.75C6.61522 21.75 2.25 17.3848 2.25 12ZM12 3.75C7.44365 3.75 3.75 7.44365 3.75 12C3.75 16.5563 7.44365 20.25 12 20.25C16.5563 20.25 20.25 16.5563 20.25 12C20.25 7.44365 16.5563 3.75 12 3.75Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Wifi.tsx b/web/packages/design/src/Icon/Icons/Wifi.tsx
index 7c068122e6108..5fbec35e2e4e2 100644
--- a/web/packages/design/src/Icon/Icons/Wifi.tsx
+++ b/web/packages/design/src/Icon/Icons/Wifi.tsx
@@ -59,10 +59,8 @@ export const Wifi = forwardRef<HTMLSpanElement, IconProps>(
       {...otherProps}
       ref={ref}
     >
-      <path d="M12 4.5C8.27119 4.5 4.6576 5.79231 1.77441 8.15694C1.45414 8.41961 1.40744 8.89218 1.67011 9.21246C1.93278 9.53273 2.40536 9.57943 2.72563 9.31676C5.34061 7.1721 8.61805 6 12 6C15.382 6 18.6594 7.1721 21.2744 9.31676C21.5947 9.57943 22.0673 9.53273 22.3299 9.21246C22.5926 8.89218 22.5459 8.41961 22.2256 8.15694C19.3424 5.79231 15.7289 4.5 12 4.5Z" />
-      <path d="M12.9375 19.125C12.9375 19.6428 12.5178 20.0625 12 20.0625C11.4822 20.0625 11.0625 19.6428 11.0625 19.125C11.0625 18.6072 11.4822 18.1875 12 18.1875C12.5178 18.1875 12.9375 18.6072 12.9375 19.125Z" />
-      <path d="M4.78451 11.5055C6.83819 9.87969 9.38073 8.99512 12 8.99512C14.6193 8.99512 17.1619 9.87969 19.2155 11.5055C19.5403 11.7626 19.5952 12.2343 19.3381 12.559C19.081 12.8838 18.6093 12.9386 18.2845 12.6815C16.4958 11.2656 14.2814 10.4951 12 10.4951C9.7187 10.4951 7.50423 11.2656 5.71555 12.6815C5.39078 12.9386 4.91909 12.8838 4.66199 12.559C4.40489 12.2343 4.45975 11.7626 4.78451 11.5055Z" />
-      <path d="M12.0001 13.499C10.494 13.499 9.02677 13.9762 7.80888 14.8621C7.47391 15.1058 7.39988 15.5748 7.64354 15.9098C7.88719 16.2448 8.35626 16.3188 8.69123 16.0751C9.65272 15.3758 10.8111 14.999 12.0001 14.999C13.189 14.999 14.3474 15.3758 15.3089 16.0751C15.6438 16.3188 16.1129 16.2448 16.3566 15.9098C16.6002 15.5748 16.5262 15.1058 16.1912 14.8621C14.9733 13.9762 13.5061 13.499 12.0001 13.499Z" />
+      <path d="M12 4.5A16.13 16.13 0 0 0 1.774 8.157a.75.75 0 0 0 .952 1.16 14.625 14.625 0 0 1 18.548 0 .75.75 0 1 0 .952-1.16A16.13 16.13 0 0 0 12 4.5m.938 14.625a.937.937 0 1 1-1.875 0 .937.937 0 0 1 1.874 0" />
+      <path d="M4.785 11.506a11.625 11.625 0 0 1 14.43 0 .75.75 0 1 1-.93 1.175 10.125 10.125 0 0 0-12.57 0 .75.75 0 1 1-.93-1.175M12 13.499a7.13 7.13 0 0 0-4.191 1.363.75.75 0 1 0 .882 1.213 5.63 5.63 0 0 1 6.618 0 .75.75 0 1 0 .882-1.213 7.13 7.13 0 0 0-4.19-1.363" />
     </Icon>
   )
 );
diff --git a/web/packages/design/src/Icon/Icons/Windows.tsx b/web/packages/design/src/Icon/Icons/Windows.tsx
index a32fd0fa48c04..515fcaa738fb7 100644
--- a/web/packages/design/src/Icon/Icons/Windows.tsx
+++ b/web/packages/design/src/Icon/Icons/Windows.tsx
@@ -61,23 +61,8 @@ export const Windows = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M20.73 3.174a.75.75 0 0 1 .27.576v6.75a.75.75 0 0 1-.75.75h-7.5a.75.75 0 0 1-.75-.75V5.114a.75.75 0 0 1 .616-.738l7.5-1.364a.75.75 0 0 1 .614.162M13.5 5.74v4.01h6V4.649zm-9.75 7.01a.75.75 0 0 0-.75.75v3.75c0 .362.26.673.616.738l6 1.091a.75.75 0 0 0 .884-.738V13.5a.75.75 0 0 0-.75-.75zm.75 3.874V14.25H9v3.192zm8.25-3.874a.75.75 0 0 0-.75.75v5.387c0 .362.26.673.616.738l7.5 1.363A.75.75 0 0 0 21 20.25V13.5a.75.75 0 0 0-.75-.75zm.75 5.51v-4.01h6v5.101zm-3-12.6a.75.75 0 0 0-.884-.739l-6 1.092A.75.75 0 0 0 3 6.75v3.75c0 .415.336.75.75.75h6a.75.75 0 0 0 .75-.75zm-6 4.09V7.376L9 6.558V9.75z"
         clipRule="evenodd"
-        d="M20.7305 3.17418C20.9013 3.31668 21 3.52761 21 3.75001V10.5C21 10.9142 20.6642 11.25 20.25 11.25H12.75C12.3358 11.25 12 10.9142 12 10.5V5.11407C12 4.75162 12.2592 4.44103 12.6158 4.37617L20.1158 3.01211C20.3346 2.97231 20.5598 3.03168 20.7305 3.17418ZM13.5 5.73997V9.75001H19.5V4.64872L13.5 5.73997Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M3.75 12.75C3.33579 12.75 3 13.0858 3 13.5V17.25C3 17.6124 3.2592 17.923 3.6158 17.9879L9.6158 19.0791C9.83461 19.1189 10.0598 19.0596 10.2305 18.9171C10.4013 18.7746 10.5 18.5637 10.5 18.3412V13.5C10.5 13.0858 10.1642 12.75 9.75 12.75H3.75ZM4.5 16.6241V14.25H9V17.4425L4.5 16.6241Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M12.75 12.75C12.3358 12.75 12 13.0858 12 13.5V18.8869C12 19.2494 12.2592 19.56 12.6159 19.6248L20.1159 20.9879C20.3347 21.0277 20.5598 20.9683 20.7306 20.8258C20.9013 20.6833 21 20.4724 21 20.25V13.5C21 13.0858 20.6642 12.75 20.25 12.75H12.75ZM13.5 18.2609V14.25H19.5V19.3514L13.5 18.2609Z"
-      />
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M10.5 5.65919C10.5 5.43679 10.4013 5.22586 10.2305 5.08336C10.0598 4.94086 9.83461 4.88149 9.6158 4.92129L3.6158 6.01254C3.2592 6.0774 3 6.38799 3 6.75044V10.5004C3 10.9146 3.33579 11.2504 3.75 11.2504H9.75C10.1642 11.2504 10.5 10.9146 10.5 10.5004V5.65919ZM4.5 9.75044V7.37633L9 6.5579V9.75044H4.5Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/Wrench.tsx b/web/packages/design/src/Icon/Icons/Wrench.tsx
index 0cf8329385a41..dccf666166b3c 100644
--- a/web/packages/design/src/Icon/Icons/Wrench.tsx
+++ b/web/packages/design/src/Icon/Icons/Wrench.tsx
@@ -61,8 +61,8 @@ export const Wrench = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M15.874 3.822a5.25 5.25 0 0 0-5.468 7.716.75.75 0 0 1-.166.93l-6.07 5.237a1.504 1.504 0 0 0 2.126 2.126l5.235-6.07a.75.75 0 0 1 .931-.167 5.25 5.25 0 0 0 7.716-5.467l-3.17 2.925a.75.75 0 0 1-.666.182l-2.469-.531a.75.75 0 0 1-.576-.576l-.53-2.47a.75.75 0 0 1 .182-.665zm-2.417-1.394a6.75 6.75 0 0 1 4.074.313.75.75 0 0 1 .27 1.204l-3.486 3.778.347 1.615 1.615.347L20.055 6.2a.75.75 0 0 1 1.204.27 6.75 6.75 0 0 1-8.97 8.71l-4.877 5.655-.038.04a3.004 3.004 0 1 1-4.208-4.285l5.655-4.877a6.75 6.75 0 0 1 4.636-9.284"
         clipRule="evenodd"
-        d="M15.8736 3.82195C15.1887 3.7066 14.4839 3.72764 13.8005 3.88826C12.7446 4.13641 11.7914 4.70553 11.0721 5.51739C10.3528 6.32925 9.90255 7.34398 9.78336 8.42211C9.66416 9.50023 9.88183 10.5888 10.4064 11.5382C10.5781 11.8488 10.5085 12.2371 10.2398 12.4689L4.16913 17.7046C3.89801 17.9849 3.74609 18.3597 3.74609 18.7503C3.74609 19.1492 3.90454 19.5317 4.18658 19.8137C4.46861 20.0958 4.85114 20.2542 5.25 20.2542C5.64056 20.2542 6.01546 20.1023 6.29569 19.8312L11.5314 13.7605C11.7632 13.4918 12.1515 13.4222 12.4621 13.5939C13.4115 14.1185 14.5001 14.3361 15.5782 14.2169C16.6563 14.0978 17.6711 13.6475 18.4829 12.9282C19.2948 12.2089 19.8639 11.2557 20.112 10.1998C20.2727 9.51636 20.2937 8.81158 20.1784 8.12671L17.0086 11.0515C16.8294 11.2169 16.5809 11.2848 16.3424 11.2336L13.8731 10.7029C13.5846 10.641 13.3593 10.4157 13.2974 10.1272L12.7667 7.65787C12.7155 7.41942 12.7834 7.17095 12.9488 6.9917L15.8736 3.82195ZM13.4573 2.42804C14.815 2.10899 16.2381 2.21828 17.5311 2.7409C17.7594 2.83319 17.9279 3.03172 17.9818 3.27204C18.0357 3.51236 17.9682 3.76384 17.8012 3.94485L14.315 7.72304L14.6621 9.33825L16.2773 9.68533L20.0555 6.19911C20.2365 6.03208 20.4879 5.96458 20.7283 6.0185C20.9686 6.07243 21.1671 6.2409 21.2594 6.46925C21.782 7.76223 21.8913 9.18535 21.5723 10.543C21.2532 11.9006 20.5215 13.1261 19.4777 14.0509C18.4339 14.9758 17.1292 15.5546 15.743 15.7079C14.5615 15.8385 13.3702 15.6544 12.2883 15.1796L7.41169 20.8339C7.39966 20.8478 7.38711 20.8614 7.37408 20.8744C6.81074 21.4377 6.04668 21.7542 5.25 21.7542C4.45331 21.7542 3.68926 21.4377 3.12592 20.8744C2.56258 20.311 2.24609 19.547 2.24609 18.7503C2.24609 17.9536 2.56258 17.1896 3.12592 16.6262C3.13895 16.6132 3.15246 16.6006 3.16641 16.5886L8.82074 11.712C8.34586 10.6301 8.16181 9.43879 8.29244 8.25727C8.44569 6.87111 9.02454 5.56645 9.9494 4.52263C10.8743 3.47882 12.0997 2.74709 13.4573 2.42804Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/Icons/XCheck.tsx b/web/packages/design/src/Icon/Icons/XCheck.tsx
new file mode 100644
index 0000000000000..1d2636f819784
--- /dev/null
+++ b/web/packages/design/src/Icon/Icons/XCheck.tsx
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* MIT License
+
+Copyright (c) 2020 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+import { forwardRef } from 'react';
+
+import { Icon, IconProps } from '../Icon';
+
+/*
+
+THIS FILE IS GENERATED. DO NOT EDIT.
+
+*/
+
+export const XCheck = forwardRef<HTMLSpanElement, IconProps>(
+  ({ size = 24, color, ...otherProps }, ref) => (
+    <Icon
+      size={size}
+      color={color}
+      className="icon icon-xcheck"
+      {...otherProps}
+      ref={ref}
+    >
+      <path d="M19.72 14.47a.75.75 0 1 1 1.06 1.06l-5.25 5.25a.75.75 0 0 1-1.06 0l-2.25-2.25a.75.75 0 1 1 1.06-1.06L15 19.19zm-1.5-9.75a.75.75 0 1 1 1.06 1.06l-13.5 13.5a.75.75 0 0 1-1.06-1.06zM8.871 3.567a.75.75 0 0 1 1.06 1.06L7.81 6.75l2.122 2.12a.75.75 0 0 1-1.06 1.06L6.749 7.81l-2.12 2.12a.751.751 0 0 1-1.061-1.06l2.12-2.122-2.12-2.12a.75.75 0 0 1 1.061-1.06l2.12 2.12z" />
+    </Icon>
+  )
+);
diff --git a/web/packages/design/src/Icon/Icons/Youtube.tsx b/web/packages/design/src/Icon/Icons/Youtube.tsx
index 106dbc3b48c89..8b8b884dcc81b 100644
--- a/web/packages/design/src/Icon/Icons/Youtube.tsx
+++ b/web/packages/design/src/Icon/Icons/Youtube.tsx
@@ -61,13 +61,13 @@ export const Youtube = forwardRef<HTMLSpanElement, IconProps>(
     >
       <path
         fillRule="evenodd"
+        d="M10.916 8.376A.75.75 0 0 0 9.75 9v6a.75.75 0 0 0 1.166.624l4.5-3a.75.75 0 0 0 0-1.248zm.334 5.223V10.4l2.398 1.6z"
         clipRule="evenodd"
-        d="M10.916 8.37596C10.6859 8.22254 10.39 8.20823 10.1461 8.33875C9.90224 8.46926 9.75 8.7234 9.75 9V15C9.75 15.2766 9.90224 15.5307 10.1461 15.6613C10.39 15.7918 10.6859 15.7775 10.916 15.624L15.416 12.624C15.6247 12.4849 15.75 12.2508 15.75 12C15.75 11.7492 15.6247 11.5151 15.416 11.376L10.916 8.37596ZM11.25 13.5986V10.4014L13.6479 12L11.25 13.5986Z"
       />
       <path
         fillRule="evenodd"
+        d="M20.613 4.975c-1.675-.644-3.85-.944-5.557-1.088a40 40 0 0 0-2.996-.137h-.12l-.177.001a40 40 0 0 0-2.82.137c-1.707.144-3.881.445-5.557 1.092l-.006.002a2.25 2.25 0 0 0-1.354 1.544C1.792 7.44 1.5 9.148 1.5 12s.292 4.56.53 5.48a2.25 2.25 0 0 0 1.349 1.537l.007.003c1.676.647 3.85.948 5.557 1.092a40 40 0 0 0 2.997.138h.297a40 40 0 0 0 2.82-.137c1.707-.145 3.881-.446 5.557-1.093l.005-.002a2.25 2.25 0 0 0 1.354-1.537c.238-.918.53-2.63.53-5.48 0-2.852-.291-4.56-.53-5.48a2.25 2.25 0 0 0-1.353-1.544zm-8.62.275h.065l.164.001a39 39 0 0 1 2.708.131c1.678.141 3.673.428 5.14.991a.75.75 0 0 1 .449.515l.002.006c.2.773.483 2.352.483 5.106s-.283 4.335-.483 5.105l-.002.005a.75.75 0 0 1-.448.512c-1.468.565-3.463.854-5.14.996a39 39 0 0 1-2.873.132h-.28a39 39 0 0 1-2.708-.132c-1.677-.142-3.672-.43-5.14-.995a.75.75 0 0 1-.446-.512v-.005C3.282 16.334 3 14.754 3 12s.283-4.335.48-5.103l.001-.005a.75.75 0 0 1 .449-.514c1.467-.565 3.462-.853 5.14-.995a39 39 0 0 1 2.872-.133z"
         clipRule="evenodd"
-        d="M20.6128 4.97466C18.9378 4.33107 16.7637 4.03118 15.0564 3.88726C14.1933 3.81449 13.4309 3.78023 12.8839 3.76414C12.6101 3.75608 12.3898 3.75256 12.237 3.75106C12.1606 3.75031 12.1011 3.75006 12.0602 3.75L12.0131 3.75002L11.9995 3.75006L11.9869 3.75002L11.9397 3.75C11.8989 3.75006 11.8393 3.75031 11.7629 3.75107C11.6102 3.75258 11.3898 3.75612 11.116 3.76421C10.569 3.78038 9.80655 3.81479 8.9433 3.88786C7.23598 4.03239 5.06156 4.33347 3.38632 4.97967L3.37998 4.98218C3.04759 5.11388 2.75137 5.32289 2.51587 5.5919C2.28095 5.86024 2.1132 6.18056 2.02642 6.52644C1.79238 7.4391 1.5 9.14812 1.5 12.0001C1.5 14.8517 1.79232 16.5606 2.03062 17.4802C2.11783 17.8242 2.28518 18.1427 2.51901 18.4097C2.75345 18.6774 3.048 18.8857 3.37854 19.0174L3.38633 19.0204C5.06157 19.6666 7.23598 19.9678 8.9433 20.1123C9.80655 20.1854 10.569 20.2198 11.116 20.2359C11.3898 20.244 11.6102 20.2476 11.7629 20.2491C11.8393 20.2498 11.8989 20.2501 11.9397 20.2501L11.9869 20.2501L12.0005 20.2501L12.0131 20.2501L12.0603 20.2501C12.1011 20.2501 12.1607 20.2498 12.2371 20.2491C12.3898 20.2476 12.6102 20.244 12.884 20.2359C13.431 20.2198 14.1935 20.1854 15.0567 20.1123C16.764 19.9678 18.9384 19.6667 20.6137 19.0205L20.6194 19.0182C20.9509 18.8872 21.2466 18.6793 21.4821 18.4115C21.717 18.1445 21.8852 17.8256 21.9729 17.4809C22.2114 16.5629 22.5037 14.8519 22.5037 12.0001C22.5037 9.14916 22.2116 7.44042 21.9733 6.52068C21.8865 6.1752 21.7188 5.85527 21.4841 5.58722C21.2486 5.31821 20.9524 5.10916 20.62 4.97746L20.6128 4.97466ZM11.9929 5.25005L11.9953 5.25012L12.0046 5.25006L12.0071 5.25005L12.0169 5.25001L12.0581 5.25C12.095 5.25005 12.1503 5.25028 12.2222 5.25099C12.3662 5.2524 12.5767 5.25575 12.8397 5.26349C13.3662 5.27898 14.1005 5.31199 14.9304 5.38195C16.6078 5.52336 18.6034 5.81041 20.0706 6.37325C20.1801 6.41722 20.2777 6.48643 20.3555 6.57526C20.434 6.66493 20.49 6.77203 20.5189 6.88766L20.5206 6.89434C20.7209 7.66657 21.0037 9.24597 21.0037 12.0001C21.0037 14.7544 20.7209 16.3354 20.5207 17.1054L20.5195 17.1099C20.4903 17.2251 20.4342 17.3317 20.3557 17.4209C20.2778 17.5096 20.1801 17.5785 20.0705 17.6222C18.6035 18.1874 16.6078 18.4756 14.9302 18.6176C14.1003 18.6879 13.366 18.721 12.8396 18.7366C12.5767 18.7444 12.3661 18.7477 12.2222 18.7492C12.1502 18.7499 12.0949 18.7501 12.0581 18.7501L12.0169 18.7501L12.0071 18.7501L12.0047 18.75L11.995 18.7501L11.9929 18.7501L11.9831 18.7501L11.9419 18.7501C11.9051 18.7501 11.8498 18.7499 11.7778 18.7492C11.6339 18.7477 11.4233 18.7444 11.1604 18.7366C10.634 18.721 9.8997 18.6879 9.06982 18.6176C7.39262 18.4757 5.39752 18.1875 3.93068 17.6227C3.82183 17.5787 3.7248 17.5098 3.64743 17.4214C3.56929 17.3322 3.51344 17.2257 3.48443 17.1107L3.48316 17.1058C3.28282 16.3336 3 14.7542 3 12.0001C3 9.24621 3.28279 7.66507 3.4799 6.89718L3.48111 6.89234C3.50997 6.77671 3.56598 6.66962 3.64448 6.57995C3.72234 6.49101 3.82012 6.42174 3.92983 6.37778C5.39675 5.81273 7.39229 5.52452 9.06982 5.38252C9.8997 5.31227 10.634 5.27912 11.1604 5.26356C11.4233 5.25579 11.6339 5.25242 11.7778 5.25099C11.8498 5.25028 11.9051 5.25005 11.9419 5.25L11.9831 5.25001L11.9929 5.25005Z"
       />
     </Icon>
   )
diff --git a/web/packages/design/src/Icon/README.md b/web/packages/design/src/Icon/README.md
index d6b61dda44adc..26a6b0b0beec0 100644
--- a/web/packages/design/src/Icon/README.md
+++ b/web/packages/design/src/Icon/README.md
@@ -2,13 +2,25 @@
 
 #### Steps:
 
-1. Download the SVG file of the icon from Google Drive and rename it, ensuring that it is capitalized. This is the name that will be used in the app (eg. `ArrowBack.svg`).
-   1. PLEASE NOTE: If you are looking at icons in Figma, _please contact the design team to get an 
-      exported version_. All icons must be converted from vector lines to outlines in order to be 
-      rendered correctly in the product. Exporting an icon without preparing it will cause 
-      unpredictable rendering, such as the fill color not being updated or the entire shape being 
-      filled in with color, rather than just the outlines.
+1. Download the SVG file of the icon from Google Drive and rename it, ensuring that it is capitalized. This is the name
+   that will be used in the app (eg. `ArrowBack.svg`).
+    1. PLEASE NOTE: If you are looking at icons in Figma, _please contact the design team to get an
+       exported version_. All icons must be converted from vector lines to outlines in order to be
+       rendered correctly in the product. Exporting an icon without preparing it will cause
+       unpredictable rendering, such as the fill color not being updated or the entire shape being
+       filled in with color, rather than just the outlines.
 2. Add the file to the `assets/` folder in this directory.
-3. Run `pnpm process-icons`.
+3. Ensure that the icon does not contain unnecessary `clipPath` elements (this will be a single 24x24 rect in a
+   `clipPath` element). If it does, delete the `g` element (keeping the `path`) that references the `clipPath`, and the
+   `defs` element that contains the `clipPath`. This is necessary to ensure that the icon optimizes correctly (
+   see https://github.com/gravitational/teleport/pull/56614 as an example).
+4. Run `pnpm process-icons`.
 
-A full collection of exported icons ready for download can be found in [Google Drive](https://drive.google.com/drive/folders/19068OCcyob6iqjpY3JB4t2NGiRmnuw2D?usp=drive_link). The same icons and others that require preparation before exporting can be found [in Figma](https://www.figma.com/file/Gpjs9vjhzUKF1GDbeG9JGE/Application-Design-System?type=design&node-id=7371-35911&mode=design&t=ior9gA5q20atPjr9-0).
+A full collection of exported icons ready for download can be found
+in [Google Drive](https://drive.google.com/drive/folders/19068OCcyob6iqjpY3JB4t2NGiRmnuw2D?usp=drive_link). The same
+icons and others that require preparation before exporting can be
+found [in Figma](https://www.figma.com/file/Gpjs9vjhzUKF1GDbeG9JGE/Application-Design-System?type=design&node-id=7371-35911&mode=design&t=ior9gA5q20atPjr9-0).
+
+If the collection does not include the icon you need, please contact the Design
+team or follow the instructions in the "Icon Consistency" section of the above
+Figma link to prepare a new icon.
diff --git a/web/packages/design/src/Icon/assets/Camera.svg b/web/packages/design/src/Icon/assets/Camera.svg
index 1d65b9c3b933a..074b5e6994a39 100644
--- a/web/packages/design/src/Icon/assets/Camera.svg
+++ b/web/packages/design/src/Icon/assets/Camera.svg
@@ -1,10 +1,3 @@
 <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7371_37022)">
 <path fill-rule="evenodd" clip-rule="evenodd" d="M3 5.25C2.17157 5.25 1.5 5.92157 1.5 6.75V17.25C1.5 18.0784 2.17157 18.75 3 18.75H18C18.8284 18.75 19.5 18.0784 19.5 17.25V14.9013L22.8341 17.124C23.0642 17.2775 23.3601 17.2918 23.604 17.1613C23.8478 17.0307 24.0001 16.7766 24.0001 16.5V7.5C24.0001 7.2234 23.8478 6.96926 23.604 6.83875C23.3601 6.70823 23.0642 6.72254 22.8341 6.87596L19.5 9.09867V6.75C19.5 5.92157 18.8284 5.25 18 5.25H3ZM19.5 10.9014V13.0986L22.5001 15.0986V8.90139L19.5 10.9014ZM3 6.75H18V17.25H3V6.75Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_7371_37022">
-<rect width="24" height="24" fill="white"/>
-</clipPath>
-</defs>
 </svg>
diff --git a/web/packages/design/src/Icon/assets/CircleDashed.svg b/web/packages/design/src/Icon/assets/CircleDashed.svg
new file mode 100644
index 0000000000000..94ef7eb01b63a
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/CircleDashed.svg
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M9.9384 4.00738C11.2903 3.65639 12.7095 3.65639 14.0615 4.00738C14.4624 4.11146 14.8718 3.87083 14.9759 3.4699C15.08 3.06898 14.8393 2.65959 14.4384 2.55551C12.8393 2.14035 11.1606 2.14035 9.56148 2.55551C9.16055 2.65959 8.91992 3.06898 9.024 3.4699C9.12809 3.87083 9.53748 4.11146 9.9384 4.00738ZM6.11156 6.2205C6.40215 5.92533 6.39843 5.45047 6.10326 5.15987C5.80808 4.86928 5.33322 4.873 5.04263 5.16817C3.8838 6.34527 3.04452 7.79863 2.60423 9.39067C2.49382 9.7899 2.72795 10.203 3.12718 10.3135C3.52641 10.4239 3.93955 10.1897 4.04996 9.7905C4.42221 8.44447 5.1318 7.21571 6.11156 6.2205ZM3.1274 13.6855C3.52666 13.5752 3.93973 13.8094 4.05002 14.2087C4.42201 15.5553 5.13161 16.7847 6.11162 17.7804C6.40218 18.0756 6.39841 18.5505 6.1032 18.841C5.80799 19.1316 5.33313 19.1278 5.04257 18.8326C3.88344 17.6549 3.04414 16.2009 2.60417 14.6081C2.49388 14.2088 2.72814 13.7958 3.1274 13.6855ZM9.9384 19.993C9.53748 19.8889 9.12809 20.1295 9.024 20.5305C8.91992 20.9314 9.16055 21.3408 9.56148 21.4449C11.1606 21.86 12.8393 21.86 14.4384 21.4449C14.8393 21.3408 15.08 20.9314 14.9759 20.5305C14.8718 20.1295 14.4624 19.8889 14.0615 19.993C12.7095 20.344 11.2903 20.344 9.9384 19.993ZM20.8728 13.6865C21.272 13.7969 21.5061 14.2101 21.3957 14.6093C20.9554 16.2013 20.1161 17.6547 18.9573 18.8318C18.6667 19.127 18.1919 19.1307 17.8967 18.8401C17.6015 18.5495 17.5978 18.0746 17.8884 17.7795C18.8681 16.7842 19.5777 15.5555 19.95 14.2095C20.0604 13.8102 20.4735 13.5761 20.8728 13.6865ZM18.9574 5.16726C18.6668 4.87205 18.192 4.86828 17.8967 5.15884C17.6015 5.4494 17.5978 5.92425 17.8883 6.21946C18.8683 7.21515 19.5779 8.44454 19.9499 9.79118C20.0602 10.1904 20.4733 10.4247 20.8725 10.3144C21.2718 10.2041 21.5061 9.79105 21.3958 9.39179C20.9558 7.79902 20.1165 6.34493 18.9574 5.16726Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/CornersIn.svg b/web/packages/design/src/Icon/assets/CornersIn.svg
new file mode 100644
index 0000000000000..a91cc99354f95
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/CornersIn.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path d="M14.25,9v-4.5c0-.41.34-.75.75-.75s.75.34.75.75v3.75h3.75c.41,0,.75.34.75.75s-.34.75-.75.75h-4.5c-.41,0-.75-.34-.75-.75ZM9,14.25h-4.5c-.41,0-.75.34-.75.75s.34.75.75.75h3.75v3.75c0,.41.34.75.75.75s.75-.34.75-.75v-4.5c0-.41-.34-.75-.75-.75ZM19.5,14.25h-4.5c-.41,0-.75.34-.75.75v4.5c0,.41.34.75.75.75s.75-.34.75-.75v-3.75h3.75c.41,0,.75-.34.75-.75s-.34-.75-.75-.75ZM9,3.75c-.41,0-.75.34-.75.75v3.75h-3.75c-.41,0-.75.34-.75.75s.34.75.75.75h4.5c.41,0,.75-.34.75-.75v-4.5c0-.41-.34-.75-.75-.75Z"/>
+</svg>
\ No newline at end of file
diff --git a/web/packages/design/src/Icon/assets/CornersOut.svg b/web/packages/design/src/Icon/assets/CornersOut.svg
new file mode 100644
index 0000000000000..2e6a13aab6b05
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/CornersOut.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path d="M20.25,4.5v3.75c0,.41-.34.75-.75.75s-.75-.34-.75-.75v-3h-3c-.41,0-.75-.34-.75-.75s.34-.75.75-.75h3.75c.41,0,.75.34.75.75ZM8.25,18.75h-3v-3c0-.41-.34-.75-.75-.75s-.75.34-.75.75v3.75c0,.41.34.75.75.75h3.75c.41,0,.75-.34.75-.75s-.34-.75-.75-.75ZM19.5,15c-.41,0-.75.34-.75.75v3h-3c-.41,0-.75.34-.75.75s.34.75.75.75h3.75c.41,0,.75-.34.75-.75v-3.75c0-.41-.34-.75-.75-.75ZM8.25,3.75h-3.75c-.41,0-.75.34-.75.75v3.75c0,.41.34.75.75.75s.75-.34.75-.75v-3h3c.41,0,.75-.34.75-.75s-.34-.75-.75-.75Z"/>
+</svg>
\ No newline at end of file
diff --git a/web/packages/design/src/Icon/assets/FastForward.svg b/web/packages/design/src/Icon/assets/FastForward.svg
new file mode 100644
index 0000000000000..79e5ef336c4a8
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/FastForward.svg
@@ -0,0 +1,4 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M3 6.73614V17.2643C3.00114 17.3968 3.0378 17.5267 3.10616 17.6402C3.17451 17.7538 3.27206 17.847 3.38865 17.9101C3.50524 17.9732 3.63661 18.0038 3.76909 17.9989C3.90156 17.994 4.03029 17.9536 4.14187 17.8821L12.4097 12.618C12.5139 12.5521 12.5997 12.4608 12.6591 12.3528C12.7186 12.2448 12.7497 12.1235 12.7497 12.0002C12.7497 11.8769 12.7186 11.7556 12.6591 11.6476C12.5997 11.5396 12.5139 11.4483 12.4097 11.3824L4.14187 6.11833C4.03029 6.04676 3.90156 6.00641 3.76909 6.00149C3.63661 5.99656 3.50524 6.02724 3.38865 6.09032C3.27206 6.1534 3.17451 6.24659 3.10616 6.36017C3.0378 6.47375 3.00114 6.60358 3 6.73614Z" stroke="black" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M12.75 6.73614V17.2643C12.7511 17.3968 12.7878 17.5267 12.8562 17.6402C12.9245 17.7538 13.0221 17.847 13.1387 17.9101C13.2552 17.9732 13.3866 18.0038 13.5191 17.9989C13.6516 17.994 13.7803 17.9536 13.8919 17.8821L22.1597 12.618C22.2639 12.5521 22.3497 12.4608 22.4091 12.3528C22.4686 12.2448 22.4997 12.1235 22.4997 12.0002C22.4997 11.8769 22.4686 11.7556 22.4091 11.6476C22.3497 11.5396 22.2639 11.4483 22.1597 11.3824L13.8919 6.11833C13.7803 6.04676 13.6516 6.00641 13.5191 6.00149C13.3866 5.99656 13.2552 6.02724 13.1387 6.09032C13.0221 6.1534 12.9245 6.24659 12.8562 6.36017C12.7878 6.47375 12.7511 6.60358 12.75 6.73614Z" stroke="black" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/FilmStrip.svg b/web/packages/design/src/Icon/assets/FilmStrip.svg
new file mode 100644
index 0000000000000..78dc964bf042c
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/FilmStrip.svg
@@ -0,0 +1 @@
+<svg width="24" height="24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M3.34 3.814a1.459 1.459 0 0 0-.666.413c-.226.235-.333.44-.39.752-.063.338-.062 13.774.001 14.069.113.535.516.979 1.029 1.135.279.084 17.093.084 17.372 0 .525-.16.929-.615 1.03-1.162.062-.331.062-13.711 0-14.042a1.366 1.366 0 0 0-.423-.784 1.511 1.511 0 0 0-.673-.393c-.239-.062-17.065-.05-17.28.012M6.76 6v.76h-3V5.24h3V6m4.48 0v.76h-3V5.24h3V6m4.52 0v.76h-3V5.24h3V6m4.48 0v.76h-3V5.24h3V6m-9 6v3.76H3.76V8.24h7.48V12m9 0v3.76h-7.48V8.24h7.48V12M6.76 18v.76h-3v-1.52h3V18m4.48 0v.76h-3v-1.52h3V18m4.52 0v.76h-3v-1.52h3V18m4.48 0v.76h-3v-1.52h3V18" fill-rule="evenodd" fill="#000"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/Icon/assets/Git.svg b/web/packages/design/src/Icon/assets/Git.svg
new file mode 100644
index 0000000000000..1ef5397ff3cd2
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/Git.svg
@@ -0,0 +1,3 @@
+<svg width="18" height="20" viewBox="0 0 18 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M3 0C4.65685 0 6 1.34315 6 3C6 4.19782 5.29628 5.22806 4.28125 5.70898L6.75 9L6.88574 9.1709C7.21349 9.55867 7.61777 9.87673 8.07324 10.1045C8.59385 10.3647 9.16798 10.5 9.75 10.5H12.0977C12.431 9.20646 13.6024 8.25 15 8.25C16.6569 8.25 18 9.59315 18 11.25C18 12.9069 16.6569 14.25 15 14.25C13.6024 14.25 12.431 13.2935 12.0977 12H9.75C8.93496 12 8.13133 11.8098 7.40234 11.4453C6.67347 11.0808 6.03878 10.5523 5.5498 9.90039L3.75 7.5V13.5977C5.04354 13.931 6 15.1024 6 16.5C6 18.1569 4.65685 19.5 3 19.5C1.34315 19.5 0 18.1569 0 16.5C0 15.1024 0.956465 13.931 2.25 13.5977V5.90137C0.956585 5.56799 0 4.39752 0 3C0 1.34315 1.34315 0 3 0ZM3 15C2.17157 15 1.5 15.6716 1.5 16.5C1.5 17.3284 2.17157 18 3 18C3.82843 18 4.5 17.3284 4.5 16.5C4.5 15.6716 3.82843 15 3 15ZM15 9.75C14.1716 9.75 13.5 10.4216 13.5 11.25C13.5 12.0784 14.1716 12.75 15 12.75C15.8284 12.75 16.5 12.0784 16.5 11.25C16.5 10.4216 15.8284 9.75 15 9.75ZM3 1.5C2.17157 1.5 1.5 2.17157 1.5 3C1.5 3.82843 2.17157 4.5 3 4.5C3.82843 4.5 4.5 3.82843 4.5 3C4.5 2.17157 3.82843 1.5 3 1.5Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/GridFour.svg b/web/packages/design/src/Icon/assets/GridFour.svg
new file mode 100644
index 0000000000000..d10876e5d7aa4
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/GridFour.svg
@@ -0,0 +1,2 @@
+
+<svg width="24" height="24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.772 3.834a1.54 1.54 0 0 0-.93.909l-.083.222.011 7.088.01 7.087.108.229a1.7 1.7 0 0 0 .743.743l.229.108h14.28l.229-.108a1.7 1.7 0 0 0 .743-.743l.108-.229V4.86l-.108-.229a1.7 1.7 0 0 0-.743-.743l-.229-.108-7.08-.009c-6.731-.008-7.09-.005-7.288.063M11.24 8.24v3h-6v-6h6v3m7.52 0v3h-6v-6h6v3m-7.52 7.52v3h-6v-6h6v3m7.52 0v3h-6v-6h6v3" fill="#000" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/Icon/assets/GridNine.svg b/web/packages/design/src/Icon/assets/GridNine.svg
new file mode 100644
index 0000000000000..d9b59ef47a95a
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/GridNine.svg
@@ -0,0 +1,8 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path
+    clip-rule="evenodd"
+    d="M2.25 6a1.5 1.5 0 0 1 1.5-1.5h16.5a1.5 1.5 0 0 1 1.5 1.5v12a1.5 1.5 0 0 1-1.5 1.5H3.75a1.5 1.5 0 0 1-1.5-1.5V6Zm1.5 9v3h4.5v-3h-4.5Zm4.5-1.5h-4.5v-3h4.5v3Zm1.5 1.5v3h4.5v-3h-4.5Zm4.5-1.5h-4.5v-3h4.5v3Zm1.5 1.5v3h4.5v-3h-4.5Zm4.5-1.5h-4.5v-3h4.5v3Zm0-7.5v3h-4.5V6h4.5Zm-6 0v3h-4.5V6h4.5Zm-6 0v3h-4.5V6h4.5Z"
+    fill="currentColor"
+    fill-rule="evenodd"
+  />
+</svg>
diff --git a/web/packages/design/src/Icon/assets/ModelContextProtocol.svg b/web/packages/design/src/Icon/assets/ModelContextProtocol.svg
new file mode 100644
index 0000000000000..a6b46810e2d12
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/ModelContextProtocol.svg
@@ -0,0 +1,4 @@
+<svg width="24" height="25" viewBox="0 0 24 25" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.1233 2.2703C12.6791 0.86452 15.081 0.911433 16.5803 2.41092L16.7209 2.55838C17.5524 3.4788 17.8739 4.69486 17.6887 5.84549C18.8391 5.66026 20.0553 5.98289 20.9758 6.81424L21.1243 6.95487L21.1711 7.00174L21.3118 7.15018C22.672 8.65578 22.672 10.9532 21.3118 12.4588L21.1711 12.6072L12.9514 20.8269C12.8263 20.9522 12.8266 21.1557 12.9514 21.281L14.6399 22.9685L14.6907 23.0262C14.9309 23.3207 14.9145 23.7555 14.6399 24.0301C14.3653 24.3046 13.9305 24.3211 13.636 24.0808L13.5784 24.0301L11.8909 22.3416C11.1803 21.6304 11.18 20.4774 11.8909 19.7664L20.1106 11.5467L20.2795 11.3592C21.0161 10.4561 21.0161 9.15286 20.2795 8.24979L20.1106 8.06229L20.0637 8.01542L19.8762 7.84647C18.9731 7.11019 17.6698 7.10988 16.7668 7.84647L16.5862 8.00858L16.5803 8.01542L9.71702 14.8797L9.65941 14.9314C9.36492 15.1712 8.92994 15.1539 8.6555 14.8797C8.36294 14.5869 8.3632 14.112 8.6555 13.8191L8.74241 13.7312L15.5266 6.94706L15.6887 6.76834C16.4254 5.86531 16.4253 4.5611 15.6887 3.65799L15.5198 3.47147C14.6179 2.56954 13.1904 2.51313 12.2229 3.30252L12.0364 3.47147L2.94749 12.5603C2.65469 12.8527 2.17973 12.8527 1.88695 12.5603C1.59418 12.2676 1.59447 11.7927 1.88695 11.4998L10.9758 2.41092L11.1233 2.2703Z" fill="black"/>
+<path d="M13.2483 4.68338C13.5412 4.39063 14.016 4.39054 14.3088 4.68338C14.6012 4.97627 14.6014 5.45119 14.3088 5.74393L7.58714 12.4656C6.62517 13.4276 6.62514 14.9879 7.58714 15.95L7.77366 16.1189C8.74111 16.9077 10.1688 16.8515 11.0705 15.95L17.7922 9.22733C18.0851 8.93474 18.5599 8.93474 18.8528 9.22733C19.1452 9.52018 19.1453 9.99509 18.8528 10.2879L12.1311 17.0105C10.6319 18.5096 8.2298 18.5563 6.67406 17.1512L6.52659 17.0105C4.97888 15.4627 4.97885 12.9529 6.52659 11.4051L13.2483 4.68338Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/Pause.svg b/web/packages/design/src/Icon/assets/Pause.svg
new file mode 100644
index 0000000000000..81b8ac27dfe3a
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/Pause.svg
@@ -0,0 +1,4 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M5.25 3C4.42157 3 3.75 3.67157 3.75 4.5V19.5C3.75 20.3284 4.42157 21 5.25 21H9C9.82843 21 10.5 20.3284 10.5 19.5V4.5C10.5 3.67157 9.82843 3 9 3H5.25ZM5.25 4.5H9V19.5H5.25V4.5Z" fill="black"/>
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M15 3C14.1716 3 13.5 3.67157 13.5 4.5V19.5C13.5 20.3284 14.1716 21 15 21H18.75C19.5784 21 20.25 20.3284 20.25 19.5V4.5C20.25 3.67157 19.5784 3 18.75 3H15ZM15 4.5H18.75V19.5H15V4.5Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/Play.svg b/web/packages/design/src/Icon/assets/Play.svg
new file mode 100644
index 0000000000000..825a2cd09a502
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/Play.svg
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M6.77625 2.43895C7.00729 2.31174 7.26778 2.24769 7.53146 2.25326C7.79514 2.25884 8.05269 2.33384 8.27814 2.4707L8.28027 2.47199L21.7848 10.7314C21.7854 10.7318 21.786 10.7321 21.7865 10.7325C22.004 10.8645 22.1839 11.0503 22.3089 11.272C22.4341 11.4943 22.5 11.7451 22.5 12.0003C22.5 12.2554 22.4341 12.5062 22.3089 12.7285C22.1839 12.9502 22.004 13.136 21.7865 13.268C21.786 13.2684 21.7854 13.2687 21.7848 13.2691L8.28027 21.5285L8.27814 21.5298C8.05269 21.6667 7.79514 21.7417 7.53146 21.7472C7.26778 21.7528 7.00729 21.6888 6.77625 21.5616C6.54522 21.4343 6.35181 21.2485 6.21553 21.0227C6.07925 20.7969 6.00491 20.5391 6.00001 20.2754L5.99976 20.2615L5.99989 3.72507C6.00478 3.46138 6.07925 3.20364 6.21553 2.97784C6.35181 2.75204 6.54522 2.56616 6.77625 2.43895ZM7.49989 3.75301L20.9845 12.0003L7.49989 20.2475V3.75301Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/RowsComfortable.svg b/web/packages/design/src/Icon/assets/RowsComfortable.svg
new file mode 100644
index 0000000000000..cd5fc4c7a4529
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/RowsComfortable.svg
@@ -0,0 +1,8 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path
+    clip-rule="evenodd"
+    d="M4.5 3.5C3.67 3.5 3 4.17 3 5v3.75c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5V5c0-.83-.67-1.5-1.5-1.5h-15Zm0 1.5h15v3.75h-15V5ZM4.5 13.75c-.83 0-1.5.67-1.5 1.5V19c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-3.75c0-.83-.67-1.5-1.5-1.5h-15Zm0 1.5h15V19h-15v-3.75Z"
+    fill="currentColor"
+    fill-rule="evenodd"
+  />
+</svg>
diff --git a/web/packages/design/src/Icon/assets/RowsDense.svg b/web/packages/design/src/Icon/assets/RowsDense.svg
new file mode 100644
index 0000000000000..f2f5d881374ad
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/RowsDense.svg
@@ -0,0 +1,14 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path
+    clip-rule="evenodd"
+    d="M19.5 16.12h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5Zm0 3.76h-15v-2.25h15v2.25Zm0-10.5h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5Zm0 3.74h-15v-2.25h15v2.25Z"
+    fill="currentColor"
+    fill-rule="evenodd"
+  />
+  <path
+    clip-rule="evenodd"
+    d="M19.5 9.38h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5v-2.25c0-.83-.67-1.5-1.5-1.5Zm0 3.74h-15v-2.25h15v2.25Zm0-10.49h-15c-.83 0-1.5.67-1.5 1.5v2.25c0 .83.67 1.5 1.5 1.5h15c.83 0 1.5-.67 1.5-1.5V4.13c0-.83-.67-1.5-1.5-1.5Zm0 3.75h-15V4.13h15v2.25Z"
+    fill="currentColor"
+    fill-rule="evenodd"
+  />
+</svg>
diff --git a/web/packages/design/src/Icon/assets/SortAscending.svg b/web/packages/design/src/Icon/assets/SortAscending.svg
new file mode 100644
index 0000000000000..6eaa904283ef0
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/SortAscending.svg
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M3.75 6C3.75 5.58579 4.08579 5.25 4.5 5.25H17.25C17.6642 5.25 18 5.58579 18 6C18 6.41421 17.6642 6.75 17.25 6.75H4.5C4.08579 6.75 3.75 6.41421 3.75 6ZM3.75 12C3.75 11.5858 4.08579 11.25 4.5 11.25H11.25C11.6642 11.25 12 11.5858 12 12C12 12.4142 11.6642 12.75 11.25 12.75H4.5C4.08579 12.75 3.75 12.4142 3.75 12ZM4.5 17.25C4.08579 17.25 3.75 17.5858 3.75 18C3.75 18.4142 4.08579 18.75 4.5 18.75H9.75C10.1642 18.75 10.5 18.4142 10.5 18C10.5 17.5858 10.1642 17.25 9.75 17.25H4.5ZM12.9697 15.2197C13.2626 14.9268 13.7374 14.9268 14.0303 15.2197L16.5 17.6893V10.5C16.5 10.0858 16.8358 9.75 17.25 9.75C17.6642 9.75 18 10.0858 18 10.5V17.6893L20.4697 15.2197C20.7626 14.9268 21.2374 14.9268 21.5303 15.2197C21.8232 15.5126 21.8232 15.9874 21.5303 16.2803L17.7803 20.0303C17.6339 20.1768 17.4419 20.25 17.25 20.25C17.1483 20.25 17.0513 20.2298 16.9629 20.1931C16.8745 20.1565 16.7916 20.1022 16.7197 20.0303L12.9697 16.2803C12.6768 15.9874 12.6768 15.5126 12.9697 15.2197Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/SortDescending.svg b/web/packages/design/src/Icon/assets/SortDescending.svg
new file mode 100644
index 0000000000000..413d5e4bc5e9f
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/SortDescending.svg
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M17.5371 3.80691C17.6255 3.84351 17.7084 3.89776 17.7803 3.96967L21.5303 7.71967C21.8232 8.01256 21.8232 8.48744 21.5303 8.78033C21.2374 9.07322 20.7626 9.07322 20.4697 8.78033L18 6.31066V13.5C18 13.9142 17.6642 14.25 17.25 14.25C16.8358 14.25 16.5 13.9142 16.5 13.5V6.31066L14.0303 8.78033C13.7374 9.07322 13.2626 9.07322 12.9697 8.78033C12.6768 8.48744 12.6768 8.01256 12.9697 7.71967L16.7197 3.96967C16.8661 3.82322 17.0581 3.75 17.25 3.75C17.3517 3.75 17.4487 3.77024 17.5371 3.80691ZM3.75 6C3.75 5.58579 4.08579 5.25 4.5 5.25H9.75C10.1642 5.25 10.5 5.58579 10.5 6C10.5 6.41421 10.1642 6.75 9.75 6.75H4.5C4.08579 6.75 3.75 6.41421 3.75 6ZM3.75 12C3.75 11.5858 4.08579 11.25 4.5 11.25H11.25C11.6642 11.25 12 11.5858 12 12C12 12.4142 11.6642 12.75 11.25 12.75H4.5C4.08579 12.75 3.75 12.4142 3.75 12ZM4.5 17.25C4.08579 17.25 3.75 17.5858 3.75 18C3.75 18.4142 4.08579 18.75 4.5 18.75H17.25C17.6642 18.75 18 18.4142 18 18C18 17.5858 17.6642 17.25 17.25 17.25H4.5Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/Sun.svg b/web/packages/design/src/Icon/assets/Sun.svg
index 23ba77790472a..78cdba2e4d4b5 100644
--- a/web/packages/design/src/Icon/assets/Sun.svg
+++ b/web/packages/design/src/Icon/assets/Sun.svg
@@ -1,18 +1,11 @@
 <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7371_36294)">
-<path d="M12 0.75C12.4142 0.75 12.75 1.08579 12.75 1.5V3.75C12.75 4.16421 12.4142 4.5 12 4.5C11.5858 4.5 11.25 4.16421 11.25 3.75V1.5C11.25 1.08579 11.5858 0.75 12 0.75Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M6 12C6 8.68629 8.68629 6 12 6C15.3137 6 18 8.68629 18 12C18 15.3137 15.3137 18 12 18C8.68629 18 6 15.3137 6 12ZM12 7.5C9.51472 7.5 7.5 9.51472 7.5 12C7.5 14.4853 9.51472 16.5 12 16.5C14.4853 16.5 16.5 14.4853 16.5 12C16.5 9.51472 14.4853 7.5 12 7.5Z" fill="black"/>
-<path d="M5.03033 3.96967C4.73744 3.67678 4.26256 3.67678 3.96967 3.96967C3.67678 4.26256 3.67678 4.73744 3.96967 5.03033L5.46967 6.53033C5.76256 6.82322 6.23744 6.82322 6.53033 6.53033C6.82322 6.23744 6.82322 5.76256 6.53033 5.46967L5.03033 3.96967Z" fill="black"/>
-<path d="M6.53033 18.5303L5.03033 20.0303C4.73744 20.3232 4.26256 20.3232 3.96967 20.0303C3.67678 19.7374 3.67678 19.2626 3.96967 18.9697L5.46967 17.4697C5.76256 17.1768 6.23744 17.1768 6.53033 17.4697C6.82322 17.7626 6.82322 18.2374 6.53033 18.5303Z" fill="black"/>
-<path d="M18.5303 6.53033L20.0303 5.03033C20.3232 4.73744 20.3232 4.26256 20.0303 3.96967C19.7374 3.67678 19.2626 3.67678 18.9697 3.96967L17.4697 5.46967C17.1768 5.76256 17.1768 6.23744 17.4697 6.53033C17.7626 6.82322 18.2374 6.82322 18.5303 6.53033Z" fill="black"/>
-<path d="M18.5303 17.4697L20.0303 18.9697C20.3232 19.2626 20.3232 19.7374 20.0303 20.0303C19.7374 20.3232 19.2626 20.3232 18.9697 20.0303L17.4697 18.5303C17.1768 18.2374 17.1768 17.7626 17.4697 17.4697C17.7626 17.1768 18.2374 17.1768 18.5303 17.4697Z" fill="black"/>
-<path d="M1.5 11.25C1.08579 11.25 0.75 11.5858 0.75 12C0.75 12.4142 1.08579 12.75 1.5 12.75H3.75C4.16421 12.75 4.5 12.4142 4.5 12C4.5 11.5858 4.16421 11.25 3.75 11.25H1.5Z" fill="black"/>
-<path d="M12 19.5C12.4142 19.5 12.75 19.8358 12.75 20.25V22.5C12.75 22.9142 12.4142 23.25 12 23.25C11.5858 23.25 11.25 22.9142 11.25 22.5V20.25C11.25 19.8358 11.5858 19.5 12 19.5Z" fill="black"/>
-<path d="M20.25 11.25C19.8358 11.25 19.5 11.5858 19.5 12C19.5 12.4142 19.8358 12.75 20.25 12.75H22.5C22.9142 12.75 23.25 12.4142 23.25 12C23.25 11.5858 22.9142 11.25 22.5 11.25H20.25Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_7371_36294">
-<rect width="24" height="24" fill="white"/>
-</clipPath>
-</defs>
+  <path d="M12 0.75C12.4142 0.75 12.75 1.08579 12.75 1.5V3.75C12.75 4.16421 12.4142 4.5 12 4.5C11.5858 4.5 11.25 4.16421 11.25 3.75V1.5C11.25 1.08579 11.5858 0.75 12 0.75Z" fill="black"/>
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M6 12C6 8.68629 8.68629 6 12 6C15.3137 6 18 8.68629 18 12C18 15.3137 15.3137 18 12 18C8.68629 18 6 15.3137 6 12ZM12 7.5C9.51472 7.5 7.5 9.51472 7.5 12C7.5 14.4853 9.51472 16.5 12 16.5C14.4853 16.5 16.5 14.4853 16.5 12C16.5 9.51472 14.4853 7.5 12 7.5Z" fill="black"/>
+  <path d="M5.03033 3.96967C4.73744 3.67678 4.26256 3.67678 3.96967 3.96967C3.67678 4.26256 3.67678 4.73744 3.96967 5.03033L5.46967 6.53033C5.76256 6.82322 6.23744 6.82322 6.53033 6.53033C6.82322 6.23744 6.82322 5.76256 6.53033 5.46967L5.03033 3.96967Z" fill="black"/>
+  <path d="M6.53033 18.5303L5.03033 20.0303C4.73744 20.3232 4.26256 20.3232 3.96967 20.0303C3.67678 19.7374 3.67678 19.2626 3.96967 18.9697L5.46967 17.4697C5.76256 17.1768 6.23744 17.1768 6.53033 17.4697C6.82322 17.7626 6.82322 18.2374 6.53033 18.5303Z" fill="black"/>
+  <path d="M18.5303 6.53033L20.0303 5.03033C20.3232 4.73744 20.3232 4.26256 20.0303 3.96967C19.7374 3.67678 19.2626 3.67678 18.9697 3.96967L17.4697 5.46967C17.1768 5.76256 17.1768 6.23744 17.4697 6.53033C17.7626 6.82322 18.2374 6.82322 18.5303 6.53033Z" fill="black"/>
+  <path d="M18.5303 17.4697L20.0303 18.9697C20.3232 19.2626 20.3232 19.7374 20.0303 20.0303C19.7374 20.3232 19.2626 20.3232 18.9697 20.0303L17.4697 18.5303C17.1768 18.2374 17.1768 17.7626 17.4697 17.4697C17.7626 17.1768 18.2374 17.1768 18.5303 17.4697Z" fill="black"/>
+  <path d="M1.5 11.25C1.08579 11.25 0.75 11.5858 0.75 12C0.75 12.4142 1.08579 12.75 1.5 12.75H3.75C4.16421 12.75 4.5 12.4142 4.5 12C4.5 11.5858 4.16421 11.25 3.75 11.25H1.5Z" fill="black"/>
+  <path d="M12 19.5C12.4142 19.5 12.75 19.8358 12.75 20.25V22.5C12.75 22.9142 12.4142 23.25 12 23.25C11.5858 23.25 11.25 22.9142 11.25 22.5V20.25C11.25 19.8358 11.5858 19.5 12 19.5Z" fill="black"/>
+  <path d="M20.25 11.25C19.8358 11.25 19.5 11.5858 19.5 12C19.5 12.4142 19.8358 12.75 20.25 12.75H22.5C22.9142 12.75 23.25 12.4142 23.25 12C23.25 11.5858 22.9142 11.25 22.5 11.25H20.25Z" fill="black"/>
 </svg>
diff --git a/web/packages/design/src/Icon/assets/UserCheck.svg b/web/packages/design/src/Icon/assets/UserCheck.svg
new file mode 100644
index 0000000000000..5ccaa8b822e64
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/UserCheck.svg
@@ -0,0 +1,4 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M9.62495 3C13.1457 3.00003 15.9999 5.8542 15.9999 9.375C15.9999 11.6552 14.8019 13.6545 13.0019 14.7812C14.8151 15.3745 16.3964 16.4357 17.6787 17.8193L18.0742 18.2676L18.1201 18.3291C18.3338 18.6433 18.2795 19.0744 17.9824 19.3242C17.6852 19.5739 17.2512 19.5535 16.9785 19.2891L16.9257 19.2324L16.58 18.8408C14.8101 16.9295 12.4231 15.75 9.62495 15.75C6.64034 15.75 4.12341 17.0918 2.32417 19.2324C2.05771 19.5494 1.58461 19.5906 1.26753 19.3242C0.950477 19.0577 0.909329 18.5847 1.17573 18.2676C2.5226 16.6651 4.24282 15.4361 6.24702 14.7803C4.44757 13.6534 3.24995 11.6548 3.24995 9.375C3.24995 5.85418 6.10413 3 9.62495 3ZM9.62495 4.5C6.93256 4.5 4.74995 6.68261 4.74995 9.375C4.74995 12.0674 6.93256 14.25 9.62495 14.25C12.3173 14.25 14.4999 12.0674 14.4999 9.375C14.4999 6.68263 12.3173 4.50003 9.62495 4.5Z" fill="black"/>
+<path d="M22.4697 10.9697C22.7626 10.6768 23.2373 10.6768 23.5302 10.9697C23.8231 11.2626 23.8231 11.7374 23.5302 12.0303L20.0302 15.5303C19.7373 15.8231 19.2625 15.8231 18.9697 15.5303L16.9697 13.5303L16.9179 13.4736C16.6776 13.1791 16.6951 12.7443 16.9697 12.4697C17.2443 12.1951 17.679 12.1777 17.9736 12.418L18.0302 12.4697L19.4999 13.9395L22.4697 10.9697Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/assets/XCheck.svg b/web/packages/design/src/Icon/assets/XCheck.svg
new file mode 100644
index 0000000000000..25076c4e7aced
--- /dev/null
+++ b/web/packages/design/src/Icon/assets/XCheck.svg
@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M19.7199 14.4696C20.0128 14.1767 20.4875 14.1767 20.7804 14.4696C21.0731 14.7625 21.0733 15.2373 20.7804 15.5301L15.5304 20.7801C15.2376 21.0729 14.7628 21.0728 14.4699 20.7801L12.2199 18.5301C11.927 18.2373 11.9271 17.7625 12.2199 17.4696C12.5128 17.1767 12.9875 17.1767 13.2804 17.4696L15.0002 19.1893L19.7199 14.4696Z" fill="black"/>
+<path d="M18.2199 4.7196C18.5128 4.4267 18.9875 4.4267 19.2804 4.7196C19.5731 5.01251 19.5733 5.48732 19.2804 5.78014L5.78043 19.2801C5.4876 19.5729 5.01276 19.5728 4.71989 19.2801C4.42703 18.9873 4.4271 18.5125 4.71989 18.2196L18.2199 4.7196Z" fill="black"/>
+<path d="M8.87125 3.56725C9.1641 3.27441 9.6389 3.2745 9.9318 3.56725C10.2247 3.86014 10.2247 4.33491 9.9318 4.6278L7.80973 6.74889L9.9318 8.87096C10.2247 9.16383 10.2246 9.63861 9.9318 9.93151C9.63891 10.2244 9.16415 10.2244 8.87125 9.93151L6.74918 7.81042L4.62907 9.93151C4.33617 10.2244 3.86044 10.2244 3.56754 9.93151C3.27492 9.63874 3.2751 9.16384 3.56754 8.87096L5.68864 6.74889L3.56754 4.62878C3.27492 4.33601 3.2751 3.86111 3.56754 3.56823C3.86044 3.27534 4.33617 3.27534 4.62907 3.56823L6.74918 5.68835L8.87125 3.56725Z" fill="black"/>
+</svg>
diff --git a/web/packages/design/src/Icon/index.ts b/web/packages/design/src/Icon/index.ts
index 1f9e1993dfe39..58a7137e8d15d 100644
--- a/web/packages/design/src/Icon/index.ts
+++ b/web/packages/design/src/Icon/index.ts
@@ -79,6 +79,7 @@ export { CircleArrowLeft } from './Icons/CircleArrowLeft';
 export { CircleArrowRight } from './Icons/CircleArrowRight';
 export { CircleCheck } from './Icons/CircleCheck';
 export { CircleCross } from './Icons/CircleCross';
+export { CircleDashed } from './Icons/CircleDashed';
 export { CirclePause } from './Icons/CirclePause';
 export { CirclePlay } from './Icons/CirclePlay';
 export { CircleStop } from './Icons/CircleStop';
@@ -93,6 +94,8 @@ export { Cog } from './Icons/Cog';
 export { Config } from './Icons/Config';
 export { Contract } from './Icons/Contract';
 export { Copy } from './Icons/Copy';
+export { CornersIn } from './Icons/CornersIn';
+export { CornersOut } from './Icons/CornersOut';
 export { CreditCard } from './Icons/CreditCard';
 export { Cross } from './Icons/Cross';
 export { Crown } from './Icons/Crown';
@@ -110,14 +113,19 @@ export { EnvelopeOpen } from './Icons/EnvelopeOpen';
 export { EqualizersVertical } from './Icons/EqualizersVertical';
 export { Expand } from './Icons/Expand';
 export { Facebook } from './Icons/Facebook';
+export { FastForward } from './Icons/FastForward';
+export { FilmStrip } from './Icons/FilmStrip';
 export { FingerprintSimple } from './Icons/FingerprintSimple';
 export { Floppy } from './Icons/Floppy';
 export { FlowArrow } from './Icons/FlowArrow';
 export { FolderPlus } from './Icons/FolderPlus';
 export { FolderShared } from './Icons/FolderShared';
+export { Git } from './Icons/Git';
 export { GitHub } from './Icons/GitHub';
 export { Google } from './Icons/Google';
 export { Graph } from './Icons/Graph';
+export { GridFour } from './Icons/GridFour';
+export { GridNine } from './Icons/GridNine';
 export { Hashtag } from './Icons/Hashtag';
 export { Headset } from './Icons/Headset';
 export { Home } from './Icons/Home';
@@ -152,6 +160,7 @@ export { MagnifyingPlus } from './Icons/MagnifyingPlus';
 export { Memory } from './Icons/Memory';
 export { Minus } from './Icons/Minus';
 export { MinusCircle } from './Icons/MinusCircle';
+export { ModelContextProtocol } from './Icons/ModelContextProtocol';
 export { Moon } from './Icons/Moon';
 export { MoreHoriz } from './Icons/MoreHoriz';
 export { MoreVert } from './Icons/MoreVert';
@@ -162,8 +171,10 @@ export { Notification } from './Icons/Notification';
 export { NotificationsActive } from './Icons/NotificationsActive';
 export { PaperPlane } from './Icons/PaperPlane';
 export { Password } from './Icons/Password';
+export { Pause } from './Icons/Pause';
 export { Pencil } from './Icons/Pencil';
 export { Planet } from './Icons/Planet';
+export { Play } from './Icons/Play';
 export { Plugs } from './Icons/Plugs';
 export { PlugsConnected } from './Icons/PlugsConnected';
 export { Plus } from './Icons/Plus';
@@ -177,6 +188,8 @@ export { Refresh } from './Icons/Refresh';
 export { Restore } from './Icons/Restore';
 export { RocketLaunch } from './Icons/RocketLaunch';
 export { Rows } from './Icons/Rows';
+export { RowsComfortable } from './Icons/RowsComfortable';
+export { RowsDense } from './Icons/RowsDense';
 export { Ruler } from './Icons/Ruler';
 export { Run } from './Icons/Run';
 export { Scan } from './Icons/Scan';
@@ -186,6 +199,8 @@ export { ShieldCheck } from './Icons/ShieldCheck';
 export { ShieldWarning } from './Icons/ShieldWarning';
 export { Sliders } from './Icons/Sliders';
 export { SlidersVertical } from './Icons/SlidersVertical';
+export { SortAscending } from './Icons/SortAscending';
+export { SortDescending } from './Icons/SortDescending';
 export { Speed } from './Icons/Speed';
 export { Spinner } from './Icons/Spinner';
 export { SquaresFour } from './Icons/SquaresFour';
@@ -205,6 +220,7 @@ export { Upload } from './Icons/Upload';
 export { UsbDrive } from './Icons/UsbDrive';
 export { User } from './Icons/User';
 export { UserAdd } from './Icons/UserAdd';
+export { UserCheck } from './Icons/UserCheck';
 export { UserCircleGear } from './Icons/UserCircleGear';
 export { UserFocus } from './Icons/UserFocus';
 export { UserIdBadge } from './Icons/UserIdBadge';
@@ -221,4 +237,5 @@ export { WarningCircle } from './Icons/WarningCircle';
 export { Wifi } from './Icons/Wifi';
 export { Windows } from './Icons/Windows';
 export { Wrench } from './Icons/Wrench';
+export { XCheck } from './Icons/XCheck';
 export { Youtube } from './Icons/Youtube';
diff --git a/web/packages/design/src/Icon/script/script.js b/web/packages/design/src/Icon/script/script.js
index 2c7bd08de515e..7da160cb7db2d 100644
--- a/web/packages/design/src/Icon/script/script.js
+++ b/web/packages/design/src/Icon/script/script.js
@@ -31,6 +31,8 @@ only do so in that directory and then run the script. Do not edit any of the gen
 const fs = require('fs');
 const path = require('path');
 
+const { optimize } = require('svgo');
+
 const basePath = 'web/packages/design/src/Icon';
 
 const svgAssetsPath = basePath + '/assets';
@@ -43,8 +45,12 @@ function createIconComponent(svgFilePath) {
   const svgContent = fs.readFileSync(svgFilePath, 'utf-8');
   const templateContent = fs.readFileSync(iconComponentTemplate, 'utf-8');
 
+  const { data } = optimize(svgContent, {
+    multipass: true,
+  });
+
   // Get `path` elements.
-  const pathElements = svgContent.match(/<path[^>]*\/>/g);
+  const pathElements = data.match(/<path[^>]*\/>/g);
 
   // Remove `fill` attributes from the path elements, and convert `fill-rule` and `clip-rule` to JSX attributes.
   const processedPathElements = pathElements.map(path =>
@@ -52,6 +58,9 @@ function createIconComponent(svgFilePath) {
       .replace(/fill="[^"]*"/g, '')
       .replace(/fill-rule/g, 'fillRule')
       .replace(/clip-rule/g, 'clipRule')
+      .replace(/stroke-linecap/g, 'strokeLinecap')
+      .replace(/stroke-linejoin/g, 'strokeLinejoin')
+      .replace(/stroke-width/g, 'strokeWidth')
   );
 
   const iconName = path.basename(svgFilePath, '.svg');
diff --git a/web/packages/design/src/Image/Image.tsx b/web/packages/design/src/Image/Image.tsx
index 90d4c4c8675d7..fddd04fb8afa7 100644
--- a/web/packages/design/src/Image/Image.tsx
+++ b/web/packages/design/src/Image/Image.tsx
@@ -37,7 +37,8 @@ import {
 } from 'design/system';
 
 interface ImageProps
-  extends SpaceProps,
+  extends
+    SpaceProps,
     ColorProps,
     WidthProps,
     HeightProps,
diff --git a/web/packages/design/src/Input/Input.tsx b/web/packages/design/src/Input/Input.tsx
index fe3b7feca968c..4a6d87cfaed07 100644
--- a/web/packages/design/src/Input/Input.tsx
+++ b/web/packages/design/src/Input/Input.tsx
@@ -298,6 +298,14 @@ const StyledInput = styled.input<{ hasIcon: boolean; inputSize: InputSize }>`
 
   &:read-only {
     cursor: not-allowed;
+
+    &:hover {
+      border: 1px solid
+        ${props => props.theme.colors.interactive.tonal.neutral[2]};
+    }
+    &:focus-visible {
+      border-color: ${props => props.theme.colors.interactive.tonal.neutral[2]};
+    }
   }
 
   &:disabled {
diff --git a/web/packages/design/src/Label/Label.tsx b/web/packages/design/src/Label/Label.tsx
index a72264116f885..dd552724505fe 100644
--- a/web/packages/design/src/Label/Label.tsx
+++ b/web/packages/design/src/Label/Label.tsx
@@ -19,15 +19,29 @@
 import React from 'react';
 import styled from 'styled-components';
 
-import { space, SpaceProps } from '../system';
+import { border, BorderProps, space, SpaceProps } from '../system';
 import { Theme } from '../theme';
 
-const kind = ({ kind, theme }: { kind?: LabelKind; theme: Theme }) => {
+const kind = ({
+  kind,
+  theme,
+  withHoverState = false,
+}: {
+  kind?: LabelKind;
+  theme: Theme;
+  withHoverState?: boolean;
+}) => {
   if (kind === 'secondary') {
     return {
       backgroundColor: theme.colors.spotBackground[0],
       color: theme.colors.text.main,
-      fontWeight: 400,
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          text: theme.colors.text.primaryInverse,
+          background: theme.colors.interactive.tonal.neutral[1],
+        },
+      }),
     };
   }
 
@@ -35,6 +49,12 @@ const kind = ({ kind, theme }: { kind?: LabelKind; theme: Theme }) => {
     return {
       backgroundColor: theme.colors.warning.main,
       color: theme.colors.text.primaryInverse,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['alert'].hover,
+        },
+      }),
     };
   }
 
@@ -42,6 +62,12 @@ const kind = ({ kind, theme }: { kind?: LabelKind; theme: Theme }) => {
     return {
       backgroundColor: theme.colors.error.main,
       color: theme.colors.text.primaryInverse,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['danger'].hover,
+        },
+      }),
     };
   }
 
@@ -49,6 +75,97 @@ const kind = ({ kind, theme }: { kind?: LabelKind; theme: Theme }) => {
     return {
       backgroundColor: theme.colors.success.main,
       color: theme.colors.text.primaryInverse,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['success'].hover,
+        },
+      }),
+    };
+  }
+
+  if (kind === 'outline-success') {
+    return {
+      color: theme.colors.success.main,
+      backgroundColor: theme.colors.interactive.tonal.success[0],
+      borderColor: theme.colors.success.main,
+      borderWidth: 1,
+      borderStyle: 'solid',
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['success'].hover,
+        },
+      }),
+    };
+  }
+
+  if (kind === 'outline-primary') {
+    return {
+      color: theme.colors.brand,
+      backgroundColor: 'transparent',
+      borderColor: theme.colors.brand,
+      borderWidth: 1,
+      borderStyle: 'solid',
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['primary'].hover,
+        },
+      }),
+    };
+  }
+
+  if (kind === 'outline-secondary') {
+    return {
+      color: theme.colors.text.main,
+      backgroundColor: 'transparent',
+      borderColor: theme.colors.interactive.tonal.neutral[0],
+      borderWidth: 1,
+      borderStyle: 'solid',
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          text: theme.colors.text.primaryInverse,
+          background: theme.colors.interactive.tonal.neutral[1],
+        },
+      }),
+    };
+  }
+
+  if (kind === 'outline-warning') {
+    return {
+      color: theme.colors.dataVisualisation.primary.sunflower,
+      backgroundColor: theme.colors.interactive.tonal.alert[0],
+      borderColor: theme.colors.interactive.tonal.alert[2],
+      borderWidth: 1,
+      borderStyle: 'solid',
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['alert'].hover,
+        },
+      }),
+    };
+  }
+
+  if (kind === 'outline-danger') {
+    return {
+      color: theme.colors.interactive.solid.danger.default,
+      backgroundColor: theme.colors.interactive.tonal.danger[0],
+      borderColor: theme.colors.interactive.tonal.danger[2],
+      borderWidth: 1,
+      borderStyle: 'solid',
+      fontWeight: theme.fontWeights.regular,
+      ...(withHoverState && {
+        '&:hover': {
+          color: theme.colors.text.primaryInverse,
+          backgroundColor: theme.colors.interactive.solid['danger'].hover,
+        },
+      }),
     };
   }
 
@@ -56,6 +173,12 @@ const kind = ({ kind, theme }: { kind?: LabelKind; theme: Theme }) => {
   return {
     backgroundColor: theme.colors.brand,
     color: theme.colors.text.primaryInverse,
+    ...(withHoverState && {
+      '&:hover': {
+        color: theme.colors.text.primaryInverse,
+        backgroundColor: theme.colors.interactive.solid['primary'].hover,
+      },
+    }),
   };
 };
 
@@ -64,25 +187,34 @@ export type LabelKind =
   | 'secondary'
   | 'warning'
   | 'danger'
-  | 'success';
+  | 'success'
+  | 'outline-secondary'
+  | 'outline-warning'
+  | 'outline-danger'
+  | 'outline-primary'
+  | 'outline-success';
 
-interface LabelProps extends SpaceProps {
+export type LabelProps = {
   kind?: LabelKind;
+  withHoverState?: boolean;
   children?: React.ReactNode;
-}
+} & SpaceProps &
+  BorderProps;
 
 const Label = styled.div<LabelProps>`
   box-sizing: border-box;
-  border-radius: 10px;
+  border-radius: 999px;
   display: inline-block;
   font-size: 10px;
   font-weight: 500;
   padding: 0 8px;
   margin: 1px 0;
   vertical-align: middle;
+  overflow: hidden;
 
   ${kind}
   ${space}
+  ${border}
 `;
 
 export default Label;
@@ -101,3 +233,12 @@ export const Warning = (props: LabelPropsWithoutKind) => (
 export const Danger = (props: LabelPropsWithoutKind) => (
   <Label kind="danger" {...props} />
 );
+export const SecondaryOutlined = (props: LabelPropsWithoutKind) => (
+  <Label kind="outline-secondary" {...props} />
+);
+export const WarningOutlined = (props: LabelPropsWithoutKind) => (
+  <Label kind="outline-warning" {...props} />
+);
+export const DangerOutlined = (props: LabelPropsWithoutKind) => (
+  <Label kind="outline-danger" {...props} />
+);
diff --git a/web/packages/design/src/Label/LabelButtonWithIcon.tsx b/web/packages/design/src/Label/LabelButtonWithIcon.tsx
new file mode 100644
index 0000000000000..79de7a8ed9adb
--- /dev/null
+++ b/web/packages/design/src/Label/LabelButtonWithIcon.tsx
@@ -0,0 +1,78 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React, { PropsWithChildren } from 'react';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import { IconProps } from 'design/Icon/Icon';
+
+import Label, { LabelProps } from './Label';
+
+export function LabelButtonWithIcon({
+  IconLeft,
+  IconRight,
+  children,
+  title,
+  withHoverState = false,
+  ...labelProps
+}: {
+  IconLeft?: React.ComponentType<IconProps>;
+  IconRight?: React.ComponentType<IconProps>;
+  onClick?: () => void;
+  title?: string;
+  withHoverState?: boolean;
+} & LabelProps &
+  PropsWithChildren) {
+  const Icon = IconLeft ?? IconRight;
+
+  let icon;
+  if (Icon) {
+    icon = (
+      <ButtonIcon>
+        <Icon size="small" />
+      </ButtonIcon>
+    );
+  }
+
+  return (
+    <LabelWithHoverAffect
+      {...labelProps}
+      title={title}
+      withHoverState={withHoverState}
+      tabIndex={0}
+    >
+      <Flex gap={1} alignItems="center">
+        {IconLeft && icon}
+        {children}
+        {IconRight && icon}
+      </Flex>
+    </LabelWithHoverAffect>
+  );
+}
+
+const ButtonIcon = styled.div`
+  align-items: center;
+  display: flex;
+`;
+
+const LabelWithHoverAffect = styled(Label)`
+  &:hover {
+    cursor: ${p => (p.withHoverState ? 'pointer' : 'default')};
+  }
+`;
diff --git a/web/packages/design/src/Label/index.ts b/web/packages/design/src/Label/index.ts
index 500af263e629f..c473f82cd189a 100644
--- a/web/packages/design/src/Label/index.ts
+++ b/web/packages/design/src/Label/index.ts
@@ -16,8 +16,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import Label, { Danger, Primary, Secondary, Warning } from './Label';
+import Label, {
+  Danger,
+  DangerOutlined,
+  Primary,
+  Secondary,
+  SecondaryOutlined,
+  Warning,
+  WarningOutlined,
+} from './Label';
 
 export default Label;
 export { Primary, Secondary, Warning, Danger };
+export { SecondaryOutlined, WarningOutlined, DangerOutlined };
 export type { LabelKind } from './Label';
diff --git a/web/packages/design/src/LabelState/LabelState.tsx b/web/packages/design/src/LabelState/LabelState.tsx
index 80667986ee0c1..0846eb3e300c9 100644
--- a/web/packages/design/src/LabelState/LabelState.tsx
+++ b/web/packages/design/src/LabelState/LabelState.tsx
@@ -85,11 +85,7 @@ const kinds = ({ theme, kind, shadow }: ThemedKindsProps) => {
 };
 
 interface LabelStateProps
-  extends SpaceProps,
-    KindsProps,
-    WidthProps,
-    ColorProps,
-    FontSizeProps {}
+  extends SpaceProps, KindsProps, WidthProps, ColorProps, FontSizeProps {}
 
 const LabelState = styled.span<LabelStateProps>`
   box-sizing: border-box;
diff --git a/web/packages/design/src/Menu/MenuItemIcon.jsx b/web/packages/design/src/Menu/MenuItemIcon.jsx
index c6bbd3a3bd003..f299174fd6923 100644
--- a/web/packages/design/src/Menu/MenuItemIcon.jsx
+++ b/web/packages/design/src/Menu/MenuItemIcon.jsx
@@ -26,8 +26,8 @@ const MenuItemIcon = styled.span`
     color: ${props => props.theme.colors.text.main};
   }
   svg {
-    height: ${props => `${props.size}px` || '18px'};
-    height: ${props => `${props.size}px` || '18px'};
+    height: ${props => (props.size && `${props.size}px`) || '18px'};
+    height: ${props => (props.size && `${props.size}px`) || '18px'};
   }
 `;
 
diff --git a/web/packages/design/src/RadioButton/RadioButton.story.tsx b/web/packages/design/src/RadioButton/RadioButton.story.tsx
index 9e609247d5c62..b71fc86f5866f 100644
--- a/web/packages/design/src/RadioButton/RadioButton.story.tsx
+++ b/web/packages/design/src/RadioButton/RadioButton.story.tsx
@@ -85,7 +85,7 @@ export const RadioButtonStory = () => (
         </td>
       </tr>
       <tr>
-        <th rowSpan={4}>Disabled</th>
+        <th rowSpan={3}>Disabled</th>
         <th>Default</th>
         <td>
           <RadioButton name="dis-def-lg" disabled />
@@ -118,6 +118,40 @@ export const RadioButtonStory = () => (
           <RadioButton name="dis-act-sm" size="small" disabled checked />
         </td>
       </tr>
+      <tr>
+        <th rowSpan={3}>Read Only</th>
+        <th>Default</th>
+        <td>
+          <RadioButton name="ro-def-lg" readOnly />
+          <RadioButton name="ro-def-lg" readOnly checked />
+        </td>
+        <td>
+          <RadioButton name="ro-def-sm" size="small" readOnly />
+          <RadioButton name="ro-def-sm" size="small" readOnly checked />
+        </td>
+      </tr>
+      <tr className="teleport-radio-button__force-hover">
+        <th>Hover</th>
+        <td>
+          <RadioButton name="ro-hov-lg" readOnly />
+          <RadioButton name="ro-hov-lg" readOnly checked />
+        </td>
+        <td>
+          <RadioButton name="ro-hov-sm" size="small" readOnly />
+          <RadioButton name="ro-hov-sm" size="small" readOnly checked />
+        </td>
+      </tr>
+      <tr className="teleport-radio-button__force-active">
+        <th>Active</th>
+        <td>
+          <RadioButton name="ro-act-lg" readOnly />
+          <RadioButton name="ro-act-lg" readOnly checked />
+        </td>
+        <td>
+          <RadioButton name="ro-act-sm" size="small" readOnly />
+          <RadioButton name="ro-act-sm" size="small" readOnly checked />
+        </td>
+      </tr>
     </Table>
     <label>
       <RadioButton size="small" name="uncontrolled" defaultChecked={false} />{' '}
diff --git a/web/packages/design/src/RadioButton/RadioButton.tsx b/web/packages/design/src/RadioButton/RadioButton.tsx
index a1701409a1b8f..408db5c5b08c6 100644
--- a/web/packages/design/src/RadioButton/RadioButton.tsx
+++ b/web/packages/design/src/RadioButton/RadioButton.tsx
@@ -31,10 +31,14 @@ interface RadioButtonProps {
   disabled?: boolean;
   id?: string;
   name?: string;
-  readonly?: boolean;
   role?: string;
   value?: string;
 
+  // TODO: remove field.
+  // Radio does not have a readonly property
+  // and this field is equivalent to field "disabled".
+  readOnly?: boolean;
+
   // Container properties
   className?: string;
   style?: React.CSSProperties;
@@ -62,7 +66,12 @@ export const RadioButton = forwardRef<HTMLInputElement, RadioButtonProps>(
             trick, because we want to be able to use this component both with
             and without surrounding labels. Instead, we use absolute positioning
             and an actually rendered input with a custom appearance. */}
-          <RadioButtonInternal ref={ref} rbSize={size} {...inputProps} />
+          <RadioButtonInternal
+            ref={ref}
+            rbSize={size}
+            {...inputProps}
+            disabled={inputProps.disabled || inputProps.readOnly}
+          />
           <Indicator rbSize={size} />
         </InnerWrapper>
       </OuterWrapper>
diff --git a/web/packages/design/src/ResourceIcon/ResourceIcon.story.tsx b/web/packages/design/src/ResourceIcon/ResourceIcon.story.tsx
index 811f3ad50e46a..1fed1edde6a46 100644
--- a/web/packages/design/src/ResourceIcon/ResourceIcon.story.tsx
+++ b/web/packages/design/src/ResourceIcon/ResourceIcon.story.tsx
@@ -19,7 +19,7 @@
 import React, { PropsWithChildren } from 'react';
 import { useTheme } from 'styled-components';
 
-import { Flex, Text } from 'design';
+import { Flex, Stack, Text } from 'design';
 import { ResourceIcon } from 'design/ResourceIcon';
 
 import { iconNames } from './resourceIconSpecs';
@@ -43,6 +43,21 @@ export const Icons = () => {
   );
 };
 
+export const StandardSizes = () => {
+  return (
+    <Stack flexWrap="wrap" gap={2}>
+      <ResourceIcon name={'1password'} size="small" />
+      Small
+      <ResourceIcon name={'1password'} size="medium" />
+      Medium
+      <ResourceIcon name={'1password'} size="large" />
+      Large
+      <ResourceIcon name={'1password'} size="extra-large" />
+      Extra Large
+    </Stack>
+  );
+};
+
 const IconBox: React.FC<PropsWithChildren<{ text: string }>> = ({
   children,
   text,
diff --git a/web/packages/design/src/ResourceIcon/assets/activemq.svg b/web/packages/design/src/ResourceIcon/assets/activemq.svg
index 75a8559e53df7..5fc21cbff997b 100644
--- a/web/packages/design/src/ResourceIcon/assets/activemq.svg
+++ b/web/packages/design/src/ResourceIcon/assets/activemq.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M18.1123 35.9617L11.3585 24.1032L18.5279 11.8523L32.0578 11.9319L39.0405 0L53.2348 0.0834519L60.2596 12.4178L53.4525 24.0496L60.2693 36.0186L53.3561 47.8315L60.1437 59.7491L52.9743 72L38.78 71.9166L32.0518 60.103L18.2748 60.022L11.25 47.6877L18.1123 35.9617Z" fill="white"/>
-<path d="M52.3033 46.7004L39.9031 46.6619L33.7363 35.9037L39.9698 25.1841L52.37 25.2226L58.5368 35.9807L52.3033 46.7004Z" fill="#C12766"/>
-<path d="M31.6158 58.3933L19.2156 58.3548L13.0488 47.5966L19.2823 36.877L31.6825 36.9155L37.8493 47.6736L31.6158 58.3933Z" fill="#3E489F"/>
-<path d="M52.3033 70.5354L39.9031 70.4969L33.7363 59.7387L39.9698 49.019L52.37 49.0575L58.5368 59.8157L52.3033 70.5354Z" fill="#714099"/>
-<path d="M31.6158 35.008L19.2156 34.9695L13.0488 24.2114L19.2823 13.4917L31.6825 13.5302L37.8493 24.2884L31.6158 35.008Z" fill="#78932C"/>
-<path d="M52.3033 23.3151L39.9031 23.2766L33.7363 12.5185L39.9698 1.79883L52.37 1.83733L58.5368 12.5955L52.3033 23.3151Z" fill="#CF242A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M46.7784 15.2998C48.0771 15.0944 49.0701 13.9699 49.0701 12.6134C49.0701 11.1113 47.8524 9.89355 46.3503 9.89355C44.8481 9.89355 43.6304 11.1113 43.6304 12.6134C43.6304 12.9291 43.6842 13.2322 43.7831 13.5141L27.7583 22.5716C27.2594 21.9696 26.5061 21.5862 25.6632 21.5862C24.1611 21.5862 22.9434 22.804 22.9434 24.3061C22.9434 25.6475 23.9144 26.7621 25.1919 26.9853V45.012C23.9144 45.2352 22.9434 46.3498 22.9434 47.6912C22.9434 49.1933 24.1611 50.4111 25.6632 50.4111C26.5036 50.4111 27.255 50.0299 27.7539 49.4311L43.8113 58.8561C43.6944 59.1595 43.6303 59.4892 43.6303 59.8339C43.6303 61.336 44.848 62.5537 46.3501 62.5537C47.8523 62.5537 49.07 61.336 49.07 59.8339C49.07 58.4775 48.0771 57.353 46.7784 57.1475V38.6851C48.0771 38.4798 49.0701 37.3552 49.0701 35.9988C49.0701 34.6423 48.0771 33.5178 46.7784 33.3124V15.2998ZM45.879 57.1547V38.6779C45.2089 38.5609 44.6232 38.1986 44.2176 37.687L28.2101 46.7347C28.3219 47.0323 28.3831 47.3546 28.3831 47.6912C28.3831 48.0304 28.321 48.355 28.2076 48.6545L44.2694 58.0821C44.6723 57.604 45.237 57.2668 45.879 57.1547ZM45.879 15.2926C45.2089 15.1755 44.6232 14.8133 44.2176 14.3017L28.2101 23.3494C28.3219 23.647 28.3831 23.9694 28.3831 24.3061C28.3831 24.6293 28.3267 24.9394 28.2232 25.227L44.2415 34.2809C44.646 33.7849 45.222 33.4344 45.879 33.3196V15.2926ZM26.0914 26.9924C26.772 26.8848 27.3687 26.5247 27.7825 26.0111L43.7959 35.0622C43.6888 35.3542 43.6304 35.6696 43.6304 35.9988C43.6304 36.3144 43.6842 36.6176 43.7831 36.8995L27.7585 45.9568C27.3458 45.4589 26.759 45.1104 26.0914 45.0049V26.9924Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M18.112 35.962 11.36 24.103l7.169-12.25 13.53.079L39.04 0l14.194.083 7.025 12.335-6.807 11.632 6.816 11.969-6.913 11.813 6.788 11.917L52.974 72l-14.194-.083-6.728-11.814-13.777-.081-7.025-12.334z"/><path fill="#c12766" d="m52.303 46.7-12.4-.038-6.167-10.758 6.234-10.72 12.4.039 6.167 10.758z"/><path fill="#3e489f" d="m31.616 58.393-12.4-.038-6.167-10.758 6.233-10.72 12.4.038 6.167 10.759z"/><path fill="#714099" d="m52.303 70.535-12.4-.038-6.167-10.758 6.234-10.72 12.4.038 6.167 10.759z"/><path fill="#78932c" d="m31.616 35.008-12.4-.039-6.167-10.758 6.233-10.72 12.4.04 6.167 10.757z"/><path fill="#cf242a" d="m52.303 23.315-12.4-.038-6.167-10.759 6.234-10.72 12.4.04 6.167 10.758z"/><path fill="#fff" fill-rule="evenodd" d="M46.778 15.3a2.72 2.72 0 1 0-2.995-1.786l-16.025 9.058a2.72 2.72 0 1 0-2.566 4.414v18.026a2.72 2.72 0 1 0 2.562 4.42l16.057 9.424a2.72 2.72 0 1 0 2.967-1.709V38.686a2.72 2.72 0 0 0 0-5.373zm-.899 41.855V38.678a2.72 2.72 0 0 1-1.661-.991L28.21 46.735a2.7 2.7 0 0 1-.002 1.92l16.061 9.427a2.72 2.72 0 0 1 1.61-.927m0-41.862a2.72 2.72 0 0 1-1.661-.991L28.21 23.349a2.7 2.7 0 0 1 .013 1.878l16.019 9.054a2.7 2.7 0 0 1 1.637-.961zm-19.788 11.7a2.72 2.72 0 0 0 1.691-.982l16.014 9.051a2.7 2.7 0 0 0-.013 1.838L27.76 45.957c-.413-.498-1-.847-1.668-.952z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/adobe.svg b/web/packages/design/src/ResourceIcon/assets/adobe.svg
index 18bedd7671d51..7547b48de6683 100644
--- a/web/packages/design/src/ResourceIcon/assets/adobe.svg
+++ b/web/packages/design/src/ResourceIcon/assets/adobe.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M26.6441 4H0V68L26.6441 4Z" fill="#FA0C00"/>
-<path d="M45.3906 4H72V68L45.3906 4Z" fill="#FA0C00"/>
-<path d="M52.9757 67.9998L36.0171 27.5879L24.3701 55.1335H36.7809L41.8493 67.9998H52.9757Z" fill="#FA0C00"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fa0c00" d="M26.644 4H0v64zM45.39 4H72v64zm7.586 64L36.017 27.588 24.37 55.133h12.41L41.85 68z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-dark.svg b/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-dark.svg
index dc01b19a577a9..3bf5e480d10ad 100644
--- a/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M64.5888 16.4874C59.5285 11.0286 52.3962 7.96054 44.9851 8.00038C37.7333 8.00038 30.3619 11.1083 25.6204 16.1288C24.7438 16.0491 23.8672 15.9694 23.0304 15.9694C8.80576 15.9694 0 27.9229 0 38.9998C0.039845 44.9766 2.35086 50.7143 6.4549 55.0972C10.7582 59.6794 16.7349 62.2693 23.0304 62.2693H44.9851C59.8871 62.2693 72 50.0369 72 35.0552C71.9203 28.162 69.2905 21.5477 64.5888 16.4874ZM22.5921 58.3645C12.0332 58.3645 3.50636 49.7978 3.50636 39.2389C3.50636 28.7597 11.9934 20.2328 22.5124 20.1531C27.1743 20.1531 31.7167 21.8665 35.1832 24.9744L35.2629 25.0541L43.192 33.1825C44.5069 34.5372 44.4671 36.6888 43.1123 38.0037C41.7576 39.3186 39.606 39.2787 38.2911 37.924L30.4815 29.8753C25.3813 25.4924 17.6912 26.0502 13.3082 31.1504C11.3957 33.3418 10.3597 36.1708 10.3597 39.0795C10.3597 45.7735 16.0575 51.4315 22.7914 51.4315H24.3453V51.4713C26.5766 54.5792 32.8323 58.3645 32.8323 58.3645H22.5921ZM61.72 51.5112C57.4565 55.9738 51.5595 58.4841 45.3835 58.5239C39.5263 58.5239 33.5495 55.8941 28.9673 51.3518L18.5279 40.8327C17.2131 39.478 17.2529 37.3263 18.5678 36.0115C19.2053 35.3739 20.0421 35.0552 20.9585 35.0552C21.8749 35.0552 22.7515 35.4138 23.389 36.0911L33.7886 46.4907C37.0957 49.7978 41.3193 51.6706 45.3835 51.6706C49.7266 51.6706 53.8705 49.8775 56.8589 46.6899C59.9269 43.5422 61.6403 39.3186 61.6403 34.9356C61.6403 25.9307 54.3088 18.639 45.3038 18.5992C41.8771 18.5992 39.0481 19.2765 36.259 21.2289C36.2191 21.1891 35.4621 20.711 34.6253 20.193C34.1074 19.8742 33.5495 19.5555 33.0714 19.3164C32.5932 19.0375 31.1588 18.3601 30.3221 18.0015C30.1229 17.9218 29.8439 17.8023 29.7244 17.7624H29.7642C34.0675 13.7381 39.4067 11.7857 45.3038 11.7857C58.0941 11.7857 68.4139 22.1454 68.4538 34.9356C68.4538 41.1116 66.0631 47.0884 61.72 51.5112Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M64.589 16.487A26.56 26.56 0 0 0 44.985 8c-7.252 0-14.623 3.108-19.365 8.129-.876-.08-1.753-.16-2.59-.16C8.806 15.97 0 27.923 0 39c.04 5.978 2.35 11.715 6.455 16.098A22.7 22.7 0 0 0 23.03 62.27h21.955C59.887 62.27 72 50.037 72 35.055a27.73 27.73 0 0 0-7.411-18.568M22.592 58.365c-10.559 0-19.086-8.567-19.086-19.126 0-10.48 8.487-19.006 19.006-19.086 4.662 0 9.205 1.713 12.671 4.821l.08.08 7.929 8.128a3.403 3.403 0 0 1-.08 4.822 3.403 3.403 0 0 1-4.82-.08l-7.81-8.049c-5.1-4.383-12.79-3.825-17.174 1.275-1.912 2.192-2.948 5.02-2.948 7.93 0 6.694 5.698 12.352 12.431 12.352h1.554v.04c2.232 3.107 8.487 6.892 8.487 6.892zM61.72 51.51c-4.264 4.463-10.16 6.973-16.336 7.013-5.858 0-11.834-2.63-16.417-7.172l-10.44-10.52a3.44 3.44 0 0 1 .04-4.82c.638-.638 1.475-.957 2.392-.957s1.793.359 2.43 1.036l10.4 10.4c3.307 3.307 7.53 5.18 11.594 5.18a15.7 15.7 0 0 0 11.477-4.98 16.85 16.85 0 0 0 4.781-11.754c0-9.005-7.331-16.297-16.336-16.337-3.427 0-6.256.677-9.045 2.63-.04-.04-.797-.518-1.634-1.036a21 21 0 0 0-1.554-.877c-.478-.278-1.912-.956-2.749-1.314-.2-.08-.478-.2-.598-.24h.04c4.304-4.024 9.643-5.976 15.54-5.976 12.79 0 23.11 10.36 23.15 23.15 0 6.176-2.39 12.152-6.734 16.575"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-light.svg b/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-light.svg
index 7ce17ca1b3d79..fde27032bb220 100644
--- a/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/adobecreativecloud-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M64.5888 16.4874C59.5285 11.0286 52.3962 7.96054 44.9851 8.00038C37.7333 8.00038 30.3619 11.1083 25.6204 16.1288C24.7438 16.0491 23.8672 15.9694 23.0304 15.9694C8.80576 15.9694 0 27.9229 0 38.9998C0.039845 44.9766 2.35086 50.7143 6.4549 55.0972C10.7582 59.6794 16.7349 62.2693 23.0304 62.2693H44.9851C59.8871 62.2693 72 50.0369 72 35.0552C71.9203 28.162 69.2905 21.5477 64.5888 16.4874ZM22.5921 58.3645C12.0332 58.3645 3.50636 49.7978 3.50636 39.2389C3.50636 28.7597 11.9934 20.2328 22.5124 20.1531C27.1743 20.1531 31.7167 21.8665 35.1832 24.9744L35.2629 25.0541L43.192 33.1825C44.5069 34.5372 44.4671 36.6888 43.1123 38.0037C41.7576 39.3186 39.606 39.2787 38.2911 37.924L30.4815 29.8753C25.3813 25.4924 17.6912 26.0502 13.3082 31.1504C11.3957 33.3418 10.3597 36.1708 10.3597 39.0795C10.3597 45.7735 16.0575 51.4315 22.7914 51.4315H24.3453V51.4713C26.5766 54.5792 32.8323 58.3645 32.8323 58.3645H22.5921ZM61.72 51.5112C57.4565 55.9738 51.5595 58.4841 45.3835 58.5239C39.5263 58.5239 33.5495 55.8941 28.9673 51.3518L18.5279 40.8327C17.2131 39.478 17.2529 37.3263 18.5678 36.0115C19.2053 35.3739 20.0421 35.0552 20.9585 35.0552C21.8749 35.0552 22.7515 35.4138 23.389 36.0911L33.7886 46.4907C37.0957 49.7978 41.3193 51.6706 45.3835 51.6706C49.7266 51.6706 53.8705 49.8775 56.8589 46.6899C59.9269 43.5422 61.6403 39.3186 61.6403 34.9356C61.6403 25.9307 54.3088 18.639 45.3038 18.5992C41.8771 18.5992 39.0481 19.2765 36.259 21.2289C36.2191 21.1891 35.4621 20.711 34.6253 20.193C34.1074 19.8742 33.5495 19.5555 33.0714 19.3164C32.5932 19.0375 31.1588 18.3601 30.3221 18.0015C30.1229 17.9218 29.8439 17.8023 29.7244 17.7624H29.7642C34.0675 13.7381 39.4067 11.7857 45.3038 11.7857C58.0941 11.7857 68.4139 22.1454 68.4538 34.9356C68.4538 41.1116 66.0631 47.0884 61.72 51.5112Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M64.589 16.487A26.56 26.56 0 0 0 44.985 8c-7.252 0-14.623 3.108-19.365 8.129-.876-.08-1.753-.16-2.59-.16C8.806 15.97 0 27.923 0 39c.04 5.978 2.35 11.715 6.455 16.098A22.7 22.7 0 0 0 23.03 62.27h21.955C59.887 62.27 72 50.037 72 35.055a27.73 27.73 0 0 0-7.411-18.568M22.592 58.365c-10.559 0-19.086-8.567-19.086-19.126 0-10.48 8.487-19.006 19.006-19.086 4.662 0 9.205 1.713 12.671 4.821l.08.08 7.929 8.128a3.403 3.403 0 0 1-.08 4.822 3.403 3.403 0 0 1-4.82-.08l-7.81-8.049c-5.1-4.383-12.79-3.825-17.174 1.275-1.912 2.192-2.948 5.02-2.948 7.93 0 6.694 5.698 12.352 12.431 12.352h1.554v.04c2.232 3.107 8.487 6.892 8.487 6.892zM61.72 51.51c-4.264 4.463-10.16 6.973-16.336 7.013-5.858 0-11.834-2.63-16.417-7.172l-10.44-10.52a3.44 3.44 0 0 1 .04-4.82c.638-.638 1.475-.957 2.392-.957s1.793.359 2.43 1.036l10.4 10.4c3.307 3.307 7.53 5.18 11.594 5.18a15.7 15.7 0 0 0 11.477-4.98 16.85 16.85 0 0 0 4.781-11.754c0-9.005-7.331-16.297-16.336-16.337-3.427 0-6.256.677-9.045 2.63-.04-.04-.797-.518-1.634-1.036a21 21 0 0 0-1.554-.877c-.478-.278-1.912-.956-2.749-1.314-.2-.08-.478-.2-.598-.24h.04c4.304-4.024 9.643-5.976 15.54-5.976 12.79 0 23.11 10.36 23.15 23.15 0 6.176-2.39 12.152-6.734 16.575"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/adobemarketo.svg b/web/packages/design/src/ResourceIcon/assets/adobemarketo.svg
index 6d1c4a5d7230e..69ce1bc1fa04a 100644
--- a/web/packages/design/src/ResourceIcon/assets/adobemarketo.svg
+++ b/web/packages/design/src/ResourceIcon/assets/adobemarketo.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11687)">
-<path d="M12.75 0.901855H59.25C66.3 0.901855 72 6.60186 72 13.6519V58.3519C72 65.4019 66.3 71.1019 59.25 71.1019H12.75C5.7 71.1019 0 65.4019 0 58.3519V13.6519C0 6.60186 5.7 0.901855 12.75 0.901855Z" fill="#EB1000"/>
-<path d="M55.9805 53.7016H47.4305C46.6805 53.7016 45.9905 53.2816 45.6905 52.5616L36.4205 30.8416C36.3605 30.6316 36.1205 30.5116 35.9105 30.5716C35.7905 30.6016 35.6705 30.7216 35.6405 30.8416L29.8505 44.6116C29.7305 44.8516 29.8505 45.1516 30.1205 45.2416C30.1805 45.2716 30.2405 45.2716 30.3005 45.2716H36.6605C37.0505 45.2716 37.4105 45.5116 37.5605 45.8716L40.3505 52.0816C40.5905 52.6516 40.3205 53.3416 39.7505 53.5816C39.6005 53.6416 39.4505 53.6716 39.3005 53.6716H16.1105C15.5405 53.6716 15.0605 53.1916 15.0605 52.6216C15.0605 52.4716 15.0905 52.3516 15.1505 52.2016L29.8805 17.1316C30.1805 16.3816 30.9305 15.8716 31.7405 15.9016H40.2305C41.0405 15.9016 41.7905 16.3816 42.0905 17.1316L56.9405 52.2016C57.1805 52.7416 56.9105 53.3716 56.4005 53.5816C56.2505 53.6416 56.1305 53.6716 55.9805 53.7016Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11687">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16907_11687)"><path fill="#eb1000" d="M12.75.902h46.5C66.3.902 72 6.602 72 13.652v44.7c0 7.05-5.7 12.75-12.75 12.75h-46.5C5.7 71.102 0 65.402 0 58.352v-44.7C0 6.602 5.7.902 12.75.902"/><path fill="#fff" d="M55.98 53.702h-8.55c-.75 0-1.44-.42-1.74-1.14l-9.27-21.72c-.06-.21-.3-.33-.51-.27-.12.03-.24.15-.27.27l-5.79 13.77c-.12.24 0 .54.27.63.06.03.12.03.18.03h6.36c.39 0 .75.24.9.6l2.79 6.21c.24.57-.03 1.26-.6 1.5q-.225.09-.45.09H16.11c-.57 0-1.05-.48-1.05-1.05 0-.15.03-.27.09-.42l14.73-35.07c.3-.75 1.05-1.26 1.86-1.23h8.49c.81 0 1.56.48 1.86 1.23l14.85 35.07c.24.54-.03 1.17-.54 1.38-.15.06-.27.09-.42.12"/></g><defs><clipPath id="clip0_16907_11687"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/airbase.svg b/web/packages/design/src/ResourceIcon/assets/airbase.svg
index 532ba633678e5..107ed578d8504 100644
--- a/web/packages/design/src/ResourceIcon/assets/airbase.svg
+++ b/web/packages/design/src/ResourceIcon/assets/airbase.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M30.0672 72L2.37988 48.6474V7.72662L30.07 31.2519L70 0L70.0026 40.5324L30.0672 72ZM30.07 57.8418L59.0052 35.223V22.6619L30.0672 45.4533L13.3772 31.3812V43.554L30.07 57.8418Z" fill="#FF6448"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff6448" d="M30.067 72 2.38 48.647V7.727l27.69 23.525L70 0l.003 40.532zm.003-14.158 28.935-22.619V22.662L30.067 45.453l-16.69-14.072v12.173z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/airtable.svg b/web/packages/design/src/ResourceIcon/assets/airtable.svg
index 3b127070f91d9..2c4ce2c9179fb 100644
--- a/web/packages/design/src/ResourceIcon/assets/airtable.svg
+++ b/web/packages/design/src/ResourceIcon/assets/airtable.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M32.1505 6.6452L5.307 17.7525C3.81425 18.3703 3.82971 20.491 5.33183 21.0864L32.2872 31.7758C34.6556 32.7151 37.2931 32.7151 39.6615 31.7758L66.6173 21.086C68.119 20.491 68.1352 18.3707 66.6417 17.7529L39.799 6.64479C37.3501 5.63142 34.599 5.63142 32.1501 6.64479" fill="#FCB400"/>
-<path d="M38.3662 37.6123V64.3162C38.3662 65.586 39.6469 66.4561 40.8275 65.988L70.8641 54.3293C71.1991 54.1965 71.4864 53.9661 71.6889 53.668C71.8914 53.3699 71.9996 53.0178 71.9995 52.6575V25.954C71.9995 24.6838 70.7188 23.8141 69.5382 24.2822L39.5016 35.9409C39.1667 36.0738 38.8794 36.3042 38.677 36.6023C38.4745 36.9004 38.3662 37.252 38.3662 37.6123Z" fill="#18BFFF"/>
-<path d="M31.3519 38.9901L22.4377 43.2942L21.5326 43.7317L2.71528 52.748C1.52287 53.3235 0 52.4542 0 51.1291V26.0657C0 25.5863 0.245808 25.1724 0.57545 24.8611C0.710685 24.7264 0.864108 24.6114 1.03125 24.5192C1.48054 24.2494 2.12192 24.1774 2.66726 24.3931L31.2021 35.6994C32.6525 36.2749 32.7665 38.3068 31.3519 38.9901Z" fill="#F82B60"/>
-<path d="M31.3526 38.9901L22.4384 43.2942L0.576172 24.8607C0.711433 24.7262 0.864855 24.6112 1.03197 24.5192C1.48126 24.2494 2.12264 24.1774 2.66798 24.3931L31.2028 35.6994C32.6532 36.2749 32.7672 38.3068 31.3526 38.9901Z" fill="black" fill-opacity="0.25"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fcb400" d="M32.15 6.645 5.308 17.753c-1.493.617-1.477 2.738.025 3.333l26.955 10.69c2.369.94 5.006.94 7.374 0l26.956-10.69c1.502-.595 1.518-2.715.025-3.333L39.799 6.645a10 10 0 0 0-7.649 0"/><path fill="#18bfff" d="M38.366 37.612v26.704c0 1.27 1.28 2.14 2.462 1.672l30.036-11.659A1.8 1.8 0 0 0 72 52.657V25.955c0-1.27-1.28-2.14-2.46-1.672L39.501 35.941a1.8 1.8 0 0 0-1.136 1.671"/><path fill="#f82b60" d="m31.352 38.99-8.914 4.304-.905.438-18.818 9.016C1.523 53.324 0 52.454 0 51.129V26.066c0-.48.246-.894.575-1.205q.206-.203.456-.342c.45-.27 1.09-.342 1.636-.126L31.202 35.7c1.45.576 1.564 2.608.15 3.291"/><path fill="#000" fill-opacity=".25" d="m31.353 38.99-8.915 4.304L.576 24.861q.204-.203.456-.342c.45-.27 1.09-.342 1.636-.126L31.203 35.7c1.45.576 1.564 2.608.15 3.291"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/algolia-dark.svg b/web/packages/design/src/ResourceIcon/assets/algolia-dark.svg
index d86e310c734cc..d86487a922b01 100644
--- a/web/packages/design/src/ResourceIcon/assets/algolia-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/algolia-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15935_6722)">
-<path d="M35.999 0.000488281C16.3256 0.000488281 0.287666 15.852 0.0037966 35.4461C-0.284396 55.3455 15.8717 71.8349 35.7872 71.9501C41.9372 71.9861 47.861 70.4827 53.122 67.6258C53.6349 67.3479 53.7142 66.6423 53.2776 66.2563L49.9086 63.2726C49.2242 62.6664 48.2501 62.4951 47.4071 62.8522C43.7355 64.4131 39.7455 65.2109 35.633 65.1605C19.5404 64.9632 6.53856 51.5827 6.79505 35.5023C7.04866 19.6248 20.0519 6.78721 35.999 6.78721H65.2059V58.6675L48.6348 43.9536C48.0988 43.477 47.2774 43.5706 46.8451 44.1422C44.1851 47.6616 39.8522 49.8504 35.0393 49.5192C28.3634 49.0584 22.954 43.6872 22.454 37.0186C21.856 29.064 28.1645 22.3997 35.999 22.3997C43.0857 22.3997 48.9216 27.8501 49.5311 34.7765C49.5858 35.3928 49.864 35.9674 50.3265 36.3778L54.6422 40.201C55.1321 40.6344 55.9088 40.3694 56.0298 39.7258C56.3411 38.0626 56.4506 36.3303 56.3281 34.5533C55.6336 24.4243 47.423 16.2754 37.2829 15.6518C25.6572 14.9362 15.938 24.024 15.6296 35.4159C15.3284 46.5183 24.431 56.0885 35.5422 56.3333C40.1807 56.4355 44.4805 54.9783 47.9547 52.4525L69.6066 71.6333C70.5345 72.4555 72 71.7974 72 70.5576V1.36561C72 0.611048 71.389 0.000488281 70.634 0.000488281H35.999Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15935_6722">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15935_6722)"><path fill="#fff" d="M35.999 0C16.326 0 .288 15.852.004 35.446c-.288 19.9 15.868 36.389 35.783 36.504 6.15.036 12.074-1.467 17.335-4.324a.842.842 0 0 0 .156-1.37l-3.37-2.983a2.38 2.38 0 0 0-2.5-.42 29.1 29.1 0 0 1-11.775 2.307C19.54 64.963 6.539 51.584 6.795 35.503 7.049 19.625 20.052 6.787 35.999 6.787h29.207v51.88L48.635 43.954a1.22 1.22 0 0 0-1.79.188c-2.66 3.52-6.993 5.708-11.806 5.377-6.676-.46-12.085-5.832-12.585-12.5-.598-7.955 5.71-14.62 13.545-14.62 7.087 0 12.923 5.451 13.532 12.377a2.42 2.42 0 0 0 .796 1.602l4.315 3.823a.843.843 0 0 0 1.388-.475c.311-1.663.42-3.396.298-5.173-.694-10.129-8.905-18.278-19.045-18.901-11.626-.716-21.345 8.372-21.653 19.764-.302 11.102 8.801 20.673 19.912 20.917a20.27 20.27 0 0 0 12.413-3.88l21.652 19.18c.927.823 2.393.164 2.393-1.075V1.366C72 .61 71.389 0 70.634 0z"/></g><defs><clipPath id="clip0_15935_6722"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/algolia-light.svg b/web/packages/design/src/ResourceIcon/assets/algolia-light.svg
index 333d64d748be0..a9df8dd4cf567 100644
--- a/web/packages/design/src/ResourceIcon/assets/algolia-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/algolia-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15935_6723)">
-<path d="M35.999 0C16.3256 0 0.287666 15.8515 0.0037966 35.4456C-0.284396 55.345 15.8717 71.8344 35.7872 71.9496C41.9372 71.9856 47.861 70.4822 53.122 67.6253C53.6349 67.3474 53.7142 66.6418 53.2776 66.2558L49.9086 63.2722C49.2242 62.6659 48.2501 62.4946 47.4071 62.8517C43.7355 64.4126 39.7455 65.2104 35.633 65.16C19.5404 64.9627 6.53856 51.5822 6.79505 35.5018C7.04866 19.6243 20.0519 6.78672 35.999 6.78672H65.2059V58.667L48.6348 43.9531C48.0988 43.4765 47.2774 43.5701 46.8451 44.1418C44.1851 47.6611 39.8522 49.8499 35.0393 49.5187C28.3634 49.0579 22.954 43.6867 22.454 37.0181C21.856 29.0635 28.1645 22.3992 35.999 22.3992C43.0857 22.3992 48.9216 27.8496 49.5311 34.776C49.5858 35.3923 49.864 35.9669 50.3265 36.3773L54.6422 40.2005C55.1321 40.6339 55.9088 40.369 56.0298 39.7253C56.3411 38.0621 56.4506 36.3298 56.3281 34.5528C55.6336 24.4238 47.423 16.2749 37.2829 15.6514C25.6572 14.9357 15.938 24.0235 15.6296 35.4154C15.3284 46.5178 24.431 56.088 35.5422 56.3328C40.1807 56.435 44.4805 54.9778 47.9547 52.452L69.6066 71.6328C70.5345 72.455 72 71.797 72 70.5571V1.36512C72 0.61056 71.389 0 70.634 0H35.999Z" fill="#003DFF"/>
-</g>
-<defs>
-<clipPath id="clip0_15935_6723">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15935_6723)"><path fill="#003dff" d="M35.999 0C16.326 0 .288 15.852.004 35.446-.284 55.345 15.872 71.834 35.787 71.95c6.15.036 12.074-1.468 17.335-4.325a.842.842 0 0 0 .156-1.37l-3.37-2.983a2.38 2.38 0 0 0-2.5-.42 29.1 29.1 0 0 1-11.775 2.308C19.54 64.963 6.539 51.582 6.795 35.502 7.049 19.624 20.052 6.787 35.999 6.787h29.207v51.88L48.635 43.953a1.22 1.22 0 0 0-1.79.189c-2.66 3.52-6.993 5.708-11.806 5.377-6.676-.461-12.085-5.832-12.585-12.5-.598-7.955 5.71-14.62 13.545-14.62 7.087 0 12.923 5.45 13.532 12.377a2.42 2.42 0 0 0 .796 1.601l4.315 3.823a.843.843 0 0 0 1.388-.475c.311-1.663.42-3.395.298-5.172-.694-10.13-8.905-18.278-19.045-18.902-11.626-.715-21.345 8.372-21.653 19.764-.302 11.103 8.801 20.673 19.912 20.918a20.27 20.27 0 0 0 12.413-3.881l21.652 19.18c.927.823 2.393.165 2.393-1.075V1.365C72 .611 71.389 0 70.634 0z"/></g><defs><clipPath id="clip0_15935_6723"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/altisales-dark.svg b/web/packages/design/src/ResourceIcon/assets/altisales-dark.svg
index 871f7d6b7276b..4151387a6e1b9 100644
--- a/web/packages/design/src/ResourceIcon/assets/altisales-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/altisales-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M20 63.0005H0L27 9.00049H45L72 63.0005H52L36 27.0005L20 63.0005Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M20 63H0L27 9h18l27 54H52L36 27z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/altisales-light.svg b/web/packages/design/src/ResourceIcon/assets/altisales-light.svg
index db26062cf3449..add3068c0fb3d 100644
--- a/web/packages/design/src/ResourceIcon/assets/altisales-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/altisales-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M20 63.0005H0L27 9.00049H45L72 63.0005H52L36 27.0005L20 63.0005Z" fill="#071D72"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#071d72" d="M20 63H0L27 9h18l27 54H52L36 27z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ansible-dark.svg b/web/packages/design/src/ResourceIcon/assets/ansible-dark.svg
index 65ca51cd2c281..c843863d3e172 100644
--- a/web/packages/design/src/ResourceIcon/assets/ansible-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ansible-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_13585_14240)">
-<path d="M31.851 34.419L45.909 45.504L36.603 22.518L31.851 34.419ZM36 0C16.113 0 0 16.113 0 36C0 55.887 16.113 72 36 72C55.887 72 72 55.887 72 36C72 16.113 55.887 0 36 0ZM53.391 51.915C53.3828 52.2511 53.3084 52.5822 53.1719 52.8895C53.0354 53.1967 52.8396 53.4739 52.5957 53.7053C52.3518 53.9366 52.0646 54.1175 51.7507 54.2376C51.4367 54.3577 51.102 54.4146 50.766 54.405C50.058 54.405 49.518 54.135 48.774 53.526L30.204 38.526L23.967 54.135H18.573L34.314 16.32C34.4908 15.8601 34.8066 15.4668 35.2174 15.1947C35.6282 14.9227 36.1136 14.7854 36.606 14.802C37.0906 14.7838 37.5682 14.9214 37.9688 15.1946C38.3695 15.4678 38.672 15.8622 38.832 16.32L53.154 50.802C53.289 51.135 53.394 51.504 53.394 51.846L53.391 51.915Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_13585_14240">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_13585_14240)"><path fill="#fff" d="m31.851 34.419 14.058 11.085-9.306-22.986zM36 0C16.113 0 0 16.113 0 36s16.113 36 36 36 36-16.113 36-36S55.887 0 36 0m17.391 51.915a2.554 2.554 0 0 1-2.625 2.49c-.708 0-1.248-.27-1.992-.879l-18.57-15-6.237 15.609h-5.394L34.314 16.32a2.37 2.37 0 0 1 2.292-1.518 2.27 2.27 0 0 1 2.226 1.518l14.322 34.482c.135.333.24.702.24 1.044z"/></g><defs><clipPath id="clip0_13585_14240"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ansible-light.svg b/web/packages/design/src/ResourceIcon/assets/ansible-light.svg
index fe6ae0ba3b955..4907bc9faedad 100644
--- a/web/packages/design/src/ResourceIcon/assets/ansible-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ansible-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_13585_14240)">
-<path d="M31.851 34.419L45.909 45.504L36.603 22.518L31.851 34.419ZM36 0C16.113 0 0 16.113 0 36C0 55.887 16.113 72 36 72C55.887 72 72 55.887 72 36C72 16.113 55.887 0 36 0ZM53.391 51.915C53.3828 52.2511 53.3084 52.5822 53.1719 52.8895C53.0354 53.1967 52.8396 53.4739 52.5957 53.7053C52.3518 53.9366 52.0646 54.1175 51.7507 54.2376C51.4367 54.3577 51.102 54.4146 50.766 54.405C50.058 54.405 49.518 54.135 48.774 53.526L30.204 38.526L23.967 54.135H18.573L34.314 16.32C34.4908 15.8601 34.8066 15.4668 35.2174 15.1947C35.6282 14.9227 36.1136 14.7854 36.606 14.802C37.0906 14.7838 37.5682 14.9214 37.9688 15.1946C38.3695 15.4678 38.672 15.8622 38.832 16.32L53.154 50.802C53.289 51.135 53.394 51.504 53.394 51.846L53.391 51.915Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_13585_14240">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_13585_14240)"><path fill="#000" d="m31.851 34.419 14.058 11.085-9.306-22.986zM36 0C16.113 0 0 16.113 0 36s16.113 36 36 36 36-16.113 36-36S55.887 0 36 0m17.391 51.915a2.554 2.554 0 0 1-2.625 2.49c-.708 0-1.248-.27-1.992-.879l-18.57-15-6.237 15.609h-5.394L34.314 16.32a2.37 2.37 0 0 1 2.292-1.518 2.27 2.27 0 0 1 2.226 1.518l14.322 34.482c.135.333.24.702.24 1.044z"/></g><defs><clipPath id="clip0_13585_14240"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/anthem.svg b/web/packages/design/src/ResourceIcon/assets/anthem.svg
index 709cc29020e7a..c45755076b1be 100644
--- a/web/packages/design/src/ResourceIcon/assets/anthem.svg
+++ b/web/packages/design/src/ResourceIcon/assets/anthem.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15935_6768)">
-<path d="M72 51.9703H51.9559L51.9615 72.0005H20.0526V51.9703H0V20.0307H20.0526V0.000488281H51.9559V20.0307H72V51.9703Z" fill="#009DE1"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M31.4296 27.6342H18.1625H18.154C19.1415 25.5099 20.4834 23.5879 22.1207 21.9525C25.6991 18.3782 30.6363 16.1611 36.0967 16.1611C40.3672 16.1611 46.4522 18.766 49.7183 21.59C52.1827 23.7143 52.63 24.5404 54.0647 27.6426H40.4516C39.135 27.6426 38.0716 27.2549 37.4639 26.6226C36.6706 25.8133 36.6115 24.6163 37.7002 23.2928C39.6076 20.9493 37.945 18.8671 35.9364 18.7828C33.9193 18.707 32.2651 20.9493 34.1809 23.2928C35.2612 24.6163 35.2021 25.8218 34.4172 26.6226C33.8011 27.2633 32.7462 27.6426 31.4296 27.6342ZM29.5824 40.3918C27.3337 44.5823 24.5795 49.715 23.7326 51.3053C19.2174 47.6805 16.3311 42.1252 16.3311 35.9039C16.3311 33.552 16.7446 31.2675 17.4957 29.1769C20.5594 29.2465 23.4117 29.5581 25.7618 29.8149C27.1083 29.9619 28.29 30.091 29.2522 30.1463C32.0794 30.3149 34.1725 31.8154 32.2567 35.4065C31.6839 36.4753 30.6951 38.3182 29.5824 40.3918ZM37.6918 38.6605C38.1813 39.495 47.0682 52.3337 47.0682 52.3337C43.9371 54.4244 40.249 55.6467 36.0967 55.6467C31.9444 55.6467 28.0959 54.3822 24.9142 52.1904C26.5768 49.7795 33.7336 39.3939 34.1725 38.6605C34.6704 37.8259 35.0924 37.3201 35.9279 37.3201C36.7634 37.3201 37.1854 37.8344 37.6918 38.6605ZM54.6808 29.1431C55.4488 31.2506 55.8624 33.5267 55.8624 35.9039V35.9123C55.8624 42.2516 52.8663 47.8912 48.2076 51.5076C47.9544 51.0018 41.5318 38.9892 39.5992 35.4065C37.6918 31.8238 39.7764 30.3149 42.6206 30.1463C43.5762 30.0895 44.7498 29.9572 46.0873 29.8065C48.5182 29.5325 51.4906 29.1975 54.6808 29.1431ZM22.8956 25.0536H32.002C32.002 24.4776 31.7284 24.0768 31.4266 23.6345C30.8935 22.8533 30.272 21.9427 30.9133 19.709C27.8244 20.375 24.9042 22.3813 22.8956 25.0536ZM40.948 19.709C44.0454 20.375 46.6785 22.7607 48.9741 25.0536H39.8593C39.8593 24.4818 40.1317 24.0834 40.4328 23.6431C40.9664 22.8628 41.59 21.9507 40.948 19.709ZM28.8371 51.3548C28.8371 51.3548 35.3525 41.0788 35.9349 41.0788C36.5172 41.0788 43.041 51.3548 43.041 51.3548C41.1168 52.358 38.6862 52.8553 35.9349 52.8553C33.1835 52.8553 30.7529 52.3495 28.8371 51.3548ZM42.871 32.8176L42.8722 32.8175V32.8091C43.463 32.8091 52.6538 32.0588 52.6538 32.0588C53.8185 38.5667 51.8942 43.2453 48.8897 46.9966C48.8897 46.9966 42.7879 35.4813 42.1296 34.2337C41.4548 32.9784 42.1288 32.9019 42.871 32.8176ZM19.2244 32.0672C19.2244 32.0672 28.4151 32.8175 28.9975 32.8175V32.8259C29.757 32.9018 30.4153 32.9861 29.757 34.2422C29.0819 35.4898 22.98 47.005 22.98 47.005C19.9755 43.2537 18.0512 38.5751 19.2244 32.0672Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15935_6768">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15935_6768)"><path fill="#009de1" d="M72 51.97H51.956L51.96 72H20.054V51.97H0V20.03h20.053V0h31.903v20.03H72z"/><path fill="#fff" fill-rule="evenodd" d="M31.43 27.634H18.154a19.9 19.9 0 0 1 3.967-5.681 19.7 19.7 0 0 1 13.976-5.792c4.27 0 10.355 2.605 13.621 5.429 2.465 2.124 2.912 2.95 4.347 6.053H40.452c-1.317 0-2.38-.388-2.988-1.02-.793-.81-.852-2.007.236-3.33 1.908-2.344.245-4.426-1.764-4.51-2.017-.076-3.67 2.166-1.755 4.51 1.08 1.323 1.021 2.529.236 3.33-.616.64-1.67 1.02-2.987 1.011m-1.848 12.758a6970 6970 0 0 0-5.85 10.913c-4.515-3.624-7.4-9.18-7.4-15.401 0-2.352.413-4.637 1.164-6.727 3.063.07 5.916.381 8.266.638 1.346.147 2.528.276 3.49.331 2.827.169 4.92 1.67 3.005 5.26zm8.11-1.732c.49.835 9.376 13.674 9.376 13.674-3.13 2.09-6.819 3.313-10.971 3.313s-8.001-1.265-11.183-3.457c1.663-2.41 8.82-12.796 9.258-13.53.498-.834.92-1.34 1.756-1.34.835 0 1.257.514 1.764 1.34m16.989-9.517a19.7 19.7 0 0 1 1.181 6.76v.01c0 6.339-2.996 11.978-7.654 15.595-.254-.506-6.676-12.519-8.609-16.102-1.907-3.582.177-5.091 3.022-5.26.955-.056 2.129-.189 3.466-.34 2.431-.274 5.404-.608 8.594-.663m-31.785-4.09h9.106c0-.575-.274-.976-.575-1.419-.534-.78-1.155-1.691-.514-3.925-3.089.666-6.009 2.672-8.017 5.345m18.052-5.344c3.097.666 5.73 3.052 8.026 5.345H39.86c0-.572.273-.97.574-1.41.533-.781 1.157-1.693.515-3.935m-12.11 31.646s6.514-10.276 7.097-10.276c.582 0 7.106 10.276 7.106 10.276-1.924 1.003-4.355 1.5-7.106 1.5s-5.182-.505-7.098-1.5M42.87 32.818v-.009c.591 0 9.782-.75 9.782-.75 1.164 6.508-.76 11.186-3.764 14.938 0 0-6.102-11.516-6.76-12.763-.675-1.256-.001-1.332.741-1.416m-23.647-.75s9.191.75 9.773.75v.008c.76.076 1.418.16.76 1.416-.675 1.248-6.777 12.763-6.777 12.763-3.004-3.751-4.929-8.43-3.756-14.938" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15935_6768"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/apollo.io-dark.svg b/web/packages/design/src/ResourceIcon/assets/apollo.io-dark.svg
index e0ebe2dd94b8a..54ea8c0c472a6 100644
--- a/web/packages/design/src/ResourceIcon/assets/apollo.io-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/apollo.io-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 65.6197L35.9272 6.25049L72 65.7505H60.9743L35.9272 23.6407L16.4077 56.5906C16.5688 56.5906 16.7298 56.5918 16.8909 56.593C17.2936 56.596 17.6963 56.599 18.099 56.5834C18.5236 56.5688 18.9483 56.5251 19.3583 56.4453C22.0966 55.9006 23.9563 53.7793 25.3767 51.5419C27.1218 48.7834 28.7747 45.9612 30.4269 43.1402C31.4504 41.3926 32.4736 39.6456 33.5182 37.9145L35.9124 34.0938L41.3158 43.0721L37.1279 50.0456C36.6789 50.7947 36.231 51.5449 35.783 52.2953C34.602 54.2737 33.4201 56.2534 32.2151 58.2177C30.7948 60.5349 28.9716 62.4454 26.5629 63.7602C24.337 64.9733 21.811 65.6197 19.2412 65.6197H0Z" fill="white"/>
-<path d="M47.6992 15.2065H57.8544L52.9709 24.1559L47.6992 15.2065Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M0 65.62 35.927 6.25 72 65.75H60.974L35.927 23.64l-19.52 32.95q.243 0 .484.003c.403.003.805.006 1.208-.01.425-.014.85-.058 1.26-.138 2.738-.544 4.597-2.666 6.018-4.903 1.745-2.759 3.398-5.58 5.05-8.402a463 463 0 0 1 3.091-5.226l2.394-3.82 5.404 8.978-4.188 6.974q-.674 1.124-1.345 2.25a573 573 0 0 1-3.568 5.922c-1.42 2.317-3.243 4.227-5.652 5.542a15.3 15.3 0 0 1-7.322 1.86zm47.7-50.413h10.154l-4.883 8.949z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/apollo.io-light.svg b/web/packages/design/src/ResourceIcon/assets/apollo.io-light.svg
index 6425236a4cc04..e9da92d43276d 100644
--- a/web/packages/design/src/ResourceIcon/assets/apollo.io-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/apollo.io-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 65.6197L35.9272 6.25049L72 65.7505H60.9743L35.9272 23.6407L16.4077 56.5906C16.5688 56.5906 16.7298 56.5918 16.8909 56.593C17.2936 56.596 17.6963 56.599 18.099 56.5834C18.5236 56.5688 18.9483 56.5251 19.3583 56.4453C22.0966 55.9006 23.9563 53.7793 25.3767 51.5419C27.1218 48.7834 28.7747 45.9612 30.4269 43.1402C31.4504 41.3926 32.4736 39.6456 33.5182 37.9145L35.9124 34.0938L41.3158 43.0721L37.1279 50.0456C36.6789 50.7947 36.231 51.5449 35.783 52.2953C34.602 54.2737 33.4201 56.2534 32.2151 58.2177C30.7948 60.5349 28.9716 62.4454 26.5629 63.7602C24.337 64.9733 21.811 65.6197 19.2412 65.6197H0Z" fill="black"/>
-<path d="M47.6992 15.2065H57.8544L52.9709 24.1559L47.6992 15.2065Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M0 65.62 35.927 6.25 72 65.75H60.974L35.927 23.64l-19.52 32.95q.243 0 .484.003c.403.003.805.006 1.208-.01.425-.014.85-.058 1.26-.138 2.738-.544 4.597-2.666 6.018-4.903 1.745-2.759 3.398-5.58 5.05-8.402a463 463 0 0 1 3.091-5.226l2.394-3.82 5.404 8.978-4.188 6.974q-.674 1.124-1.345 2.25a573 573 0 0 1-3.568 5.922c-1.42 2.317-3.243 4.227-5.652 5.542a15.3 15.3 0 0 1-7.322 1.86zm47.7-50.413h10.154l-4.883 8.949z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/apple-dark.svg b/web/packages/design/src/ResourceIcon/assets/apple-dark.svg
index 56c33d21cb5ee..d44679a38f89b 100644
--- a/web/packages/design/src/ResourceIcon/assets/apple-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/apple-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6726_30056)">
-<path d="M63.0967 24.5422C60.7432 25.9831 58.7938 27.9975 57.4308 30.397C56.0679 32.7964 55.336 35.5025 55.3036 38.2618C55.3129 41.3675 56.2331 44.4021 57.95 46.99C59.667 49.5779 62.1054 51.6052 64.9632 52.821C63.8364 56.4563 62.1689 59.9014 60.0166 63.0403C56.937 67.4736 53.7168 71.9065 48.8172 71.9065C43.9177 71.9065 42.6575 69.06 37.0111 69.06C31.5047 69.06 29.5447 72 25.0648 72C20.585 72 17.4588 67.8934 13.8655 62.8537C9.11892 55.7937 6.51027 47.5141 6.35254 39.0082C6.35254 25.0089 15.4523 17.5895 24.4115 17.5895C29.1715 17.5895 33.138 20.7157 36.1246 20.7157C38.9711 20.7157 43.4044 17.4025 48.8172 17.4025C51.6003 17.3307 54.3584 17.9443 56.8485 19.1893C59.3386 20.4344 61.4843 22.2726 63.0967 24.5422ZM46.2509 11.4763C48.637 8.66943 49.9877 5.12878 50.0774 1.44584C50.0814 0.960317 50.0345 0.475716 49.9373 0C45.8386 0.400378 42.0485 2.35389 39.3443 5.45984C36.9352 8.1549 35.5336 11.601 35.3777 15.2125C35.3795 15.6517 35.4265 16.0895 35.5178 16.5191C35.8409 16.5802 36.169 16.6115 36.4978 16.6127C38.3868 16.4624 40.2254 15.9295 41.9021 15.0466C43.5787 14.1636 45.0583 12.9489 46.2509 11.4763Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_6726_30056">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6726_30056)"><path fill="#fff" d="M63.097 24.542a16.31 16.31 0 0 0-7.793 13.72 15.87 15.87 0 0 0 9.66 14.559 38 38 0 0 1-4.947 10.22c-3.08 4.433-6.3 8.865-11.2 8.865s-6.16-2.846-11.806-2.846c-5.506 0-7.466 2.94-11.946 2.94s-7.606-4.107-11.2-9.146a44.2 44.2 0 0 1-7.512-23.846c0-14 9.1-21.418 18.059-21.418 4.76 0 8.726 3.126 11.713 3.126 2.846 0 7.28-3.314 12.692-3.314a16.98 16.98 0 0 1 14.28 7.14M46.25 11.476a16.1 16.1 0 0 0 3.826-10.03A7 7 0 0 0 49.937 0a16.12 16.12 0 0 0-10.593 5.46 15.65 15.65 0 0 0-3.966 9.753q.003.66.14 1.306.486.092.98.094a13.98 13.98 0 0 0 9.753-5.137"/></g><defs><clipPath id="clip0_6726_30056"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/apple-light.svg b/web/packages/design/src/ResourceIcon/assets/apple-light.svg
index 9742ccded58d2..884d59050dbd8 100644
--- a/web/packages/design/src/ResourceIcon/assets/apple-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/apple-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6726_30055)">
-<path d="M63.0967 24.5422C60.7432 25.9831 58.7938 27.9975 57.4308 30.397C56.0679 32.7964 55.336 35.5025 55.3036 38.2618C55.3129 41.3675 56.2331 44.4021 57.95 46.99C59.667 49.5779 62.1054 51.6052 64.9632 52.821C63.8364 56.4563 62.1689 59.9014 60.0166 63.0403C56.937 67.4736 53.7168 71.9065 48.8172 71.9065C43.9177 71.9065 42.6575 69.06 37.0111 69.06C31.5047 69.06 29.5447 72 25.0648 72C20.585 72 17.4588 67.8934 13.8655 62.8537C9.11892 55.7937 6.51027 47.5141 6.35254 39.0082C6.35254 25.0089 15.4523 17.5895 24.4115 17.5895C29.1715 17.5895 33.138 20.7157 36.1246 20.7157C38.9711 20.7157 43.4044 17.4025 48.8172 17.4025C51.6003 17.3307 54.3584 17.9443 56.8485 19.1893C59.3386 20.4344 61.4843 22.2726 63.0967 24.5422ZM46.2509 11.4763C48.637 8.66943 49.9877 5.12878 50.0774 1.44584C50.0814 0.960317 50.0345 0.475716 49.9373 0C45.8386 0.400378 42.0485 2.35389 39.3443 5.45984C36.9352 8.1549 35.5336 11.601 35.3777 15.2125C35.3795 15.6517 35.4265 16.0895 35.5178 16.5191C35.8409 16.5802 36.169 16.6115 36.4978 16.6127C38.3868 16.4624 40.2254 15.9295 41.9021 15.0466C43.5787 14.1636 45.0583 12.9489 46.2509 11.4763Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_6726_30055">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6726_30055)"><path fill="#000" d="M63.097 24.542a16.31 16.31 0 0 0-7.793 13.72 15.87 15.87 0 0 0 9.66 14.559 38 38 0 0 1-4.947 10.22c-3.08 4.433-6.3 8.865-11.2 8.865s-6.16-2.846-11.806-2.846c-5.506 0-7.466 2.94-11.946 2.94s-7.606-4.107-11.2-9.146a44.2 44.2 0 0 1-7.512-23.846c0-14 9.1-21.418 18.059-21.418 4.76 0 8.726 3.126 11.713 3.126 2.846 0 7.28-3.314 12.692-3.314a16.98 16.98 0 0 1 14.28 7.14M46.25 11.476a16.1 16.1 0 0 0 3.826-10.03A7 7 0 0 0 49.937 0a16.12 16.12 0 0 0-10.593 5.46 15.65 15.65 0 0 0-3.966 9.753q.003.66.14 1.306.486.092.98.094a13.98 13.98 0 0 0 9.753-5.137"/></g><defs><clipPath id="clip0_6726_30055"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/application.svg b/web/packages/design/src/ResourceIcon/assets/application.svg
index 911451a9092bb..c849072f5a3d8 100644
--- a/web/packages/design/src/ResourceIcon/assets/application.svg
+++ b/web/packages/design/src/ResourceIcon/assets/application.svg
@@ -1,183 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6722_31908)">
-<path opacity="0.9" d="M66.4625 30.4897L66.459 31.3636V31.3724L66.4533 33.4854L37.2129 16.9245L27.8189 11.6012L25.6774 10.389L25.6864 7.3916L27.8353 8.6074L31.9651 10.9476L33.3495 9.89479L33.3751 9.90911L36.9484 11.9253L37.058 11.988L41.0472 14.2369L41.0619 14.2691L42.222 16.7562L42.8293 17.1018V17.0982L41.7495 14.7275C41.7332 14.6899 41.7386 14.6612 41.7586 14.6541C41.7642 14.6505 41.7714 14.6505 41.7806 14.6541C41.7842 14.6541 41.7896 14.6577 41.7934 14.6594L44.876 16.407L46.1676 18.9926L66.4661 30.4897H66.4625Z" fill="#C9D7DD"/>
-<path opacity="0.9" d="M37.2075 16.9242L37.1363 41.8236L25.9053 35.4582C25.7376 35.3634 25.6008 35.1306 25.6008 34.9408L25.6719 10.3887L37.2093 16.9242H37.2075Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M66.4442 33.4855L66.3785 56.2719L66.3731 58.0501C66.3731 58.1127 66.3586 58.1647 66.3311 58.2004C66.3183 58.2185 66.3019 58.2327 66.2837 58.2434C66.2291 58.2756 66.1525 58.2703 66.0685 58.222L37.1327 41.8222V41.8169L37.1381 39.6933L37.2038 16.9229H37.2074L66.4442 33.4836V33.4855Z" fill="white"/>
-<path opacity="0.9" d="M66.4716 28.0506V28.3657L66.4661 30.4894L46.1676 18.9923L44.876 16.4085L41.7951 14.6609C41.7951 14.6609 41.7861 14.6555 41.7806 14.6555C41.7714 14.652 41.7659 14.652 41.7586 14.6555C41.7405 14.6627 41.7348 14.6931 41.7514 14.7272L42.8312 17.0996H42.8277L42.2221 16.7541L41.091 14.2849L41.0619 14.2688L37.058 11.9876L36.9484 11.9249L33.3915 9.89805L33.3751 9.91058L31.9668 10.9491L27.8353 8.60885L25.6883 7.39306L25.6956 4.94179C25.6956 4.83078 25.7431 4.75916 25.8159 4.73767C25.8671 4.72156 25.9326 4.7323 26.0021 4.77169L27.8443 5.81558L47.8549 17.1569H47.8584L66.1689 27.5368C66.3385 27.6335 66.4754 27.8644 66.4735 28.0542L66.4716 28.0506Z" fill="#6E17FF"/>
-<g opacity="0.7">
-<path opacity="0.7" d="M66.4716 28.0506V28.3657L66.4661 30.4894L46.1676 18.9923L44.876 16.4085L41.7951 14.6609C41.7951 14.6609 41.7861 14.6555 41.7806 14.6555C41.7714 14.652 41.7659 14.652 41.7586 14.6555C41.7405 14.6627 41.7348 14.6931 41.7514 14.7272L42.8312 17.0996H42.8277L42.2221 16.7541L41.091 14.2849L41.0619 14.2688L37.058 11.9876L36.9484 11.9249L33.3915 9.89805L33.3751 9.91058L31.9668 10.9491L27.8353 8.60885L25.6883 7.39306L25.6956 4.94179C25.6956 4.83078 25.7431 4.75916 25.8159 4.73767C25.8671 4.72156 25.9326 4.7323 26.0021 4.77169L27.8443 5.81558L47.8549 17.1569H47.8584L66.1689 27.5368C66.3385 27.6335 66.4754 27.8644 66.4735 28.0542L66.4716 28.0506Z" fill="url(#paint0_linear_6722_31908)"/>
-</g>
-<path opacity="0.9" d="M33.6305 22.9492L33.572 22.9186V22.915L33.6305 22.9492Z" fill="#7808FF"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M27.0071 6.45451C27.2242 6.57806 27.3993 6.87529 27.3993 7.1206C27.3993 7.36591 27.2223 7.4626 27.0053 7.34084C26.7882 7.21908 26.6131 6.92006 26.6148 6.67654C26.6167 6.43303 26.7918 6.33276 27.0088 6.4563L27.0071 6.45451Z" fill="white"/>
-<path opacity="0.9" d="M28.1106 7.07366C28.3277 7.1972 28.5028 7.49443 28.5028 7.73973C28.5028 7.98504 28.3258 8.08174 28.1088 7.95997C27.8917 7.83822 27.7166 7.5392 27.7185 7.29568C27.7202 7.05217 27.8955 6.9519 28.1125 7.07544L28.1106 7.07366Z" fill="white"/>
-<path opacity="0.9" d="M29.2488 7.76116C29.4661 7.88472 29.6411 8.18193 29.6411 8.42724C29.6411 8.67254 29.4642 8.76925 29.2471 8.64748C29.0301 8.52573 28.8548 8.22671 28.8567 7.98319C28.8586 7.73967 29.0337 7.63939 29.2507 7.76295L29.2488 7.76116Z" fill="white"/>
-</g>
-<path opacity="0.9" d="M43.7578 16.3427C44.046 16.5057 44.2777 16.9014 44.2759 17.2255C44.2759 17.5496 44.0405 17.6803 43.7542 17.5174C43.4679 17.3544 43.2345 16.9605 43.2362 16.6364C43.2362 16.3123 43.4696 16.1816 43.7578 16.3445V16.3427Z" fill="#7808FF"/>
-<path opacity="0.9" d="M62.9639 29.1949C63.1117 29.2791 63.2303 29.4815 63.2303 29.6479L63.2265 30.8262C63.2265 30.9926 63.1062 31.0606 62.9584 30.9765L30.9545 12.8382C30.8068 12.7541 30.6882 12.5517 30.6882 12.3852L30.6917 11.207C30.6917 11.0405 30.8122 10.9725 30.96 11.0566L62.9639 29.1949Z" fill="white"/>
-<path opacity="0.9" d="M62.2361 29.1802C62.2361 29.1802 62.2416 29.1855 62.2433 29.1891L62.351 29.6261L62.3583 29.6349L62.7084 29.8337C62.7084 29.8337 62.7177 29.848 62.7122 29.8499L62.4295 29.9214V29.9286L62.5334 30.3637C62.5334 30.3637 62.5315 30.3728 62.526 30.3709C62.526 30.3709 62.5244 30.3692 62.5225 30.3673L62.2416 29.9752L62.2324 29.9697L61.9496 30.0415C61.9496 30.0415 61.9479 30.0415 61.946 30.0415C61.9423 30.0396 61.9387 30.0325 61.9406 30.027L62.0499 29.7138V29.7029L61.7655 29.3108C61.7655 29.3108 61.7636 29.2949 61.7691 29.2984L62.1192 29.497H62.1266L62.2361 29.1819C62.2361 29.1819 62.2397 29.1783 62.2416 29.1802H62.2361Z" fill="#6E17FF"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M65.5122 30.9009V30.9851L64.2899 30.2922V30.208L65.5122 30.9009Z" fill="#7808FF"/>
-<path opacity="0.9" d="M65.5122 31.2837V31.3698L64.2899 30.6769V30.5908L65.5122 31.2837Z" fill="#7808FF"/>
-<path opacity="0.9" d="M65.5122 31.6695V31.7537L64.2899 31.0626V30.9766L65.5122 31.6695Z" fill="#7808FF"/>
-<path opacity="0.9" d="M65.5122 32.0542V32.1384L64.2899 31.4455V31.3613L65.5122 32.0542Z" fill="#7808FF"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M26.6715 8.90614C26.6879 8.9151 26.7043 8.93122 26.7171 8.95091C26.7481 8.99566 26.7517 9.05119 26.7261 9.06909L26.427 9.29649L27.3848 9.83903C27.4249 9.8605 27.4558 9.91603 27.4558 9.96078C27.4558 10.0056 27.423 10.0235 27.3848 10.0002L26.4379 9.46301L26.7225 9.97331C26.7481 10.0199 26.7463 10.07 26.7171 10.0843C26.7026 10.0897 26.686 10.0879 26.6696 10.079C26.6514 10.0682 26.6314 10.0467 26.6167 10.0217L26.2263 9.32334L26.2208 9.31259C26.2118 9.29468 26.2064 9.27858 26.2045 9.26425C26.2045 9.25352 26.2045 9.24277 26.2045 9.23381L26.2082 9.22128L26.2154 9.21053L26.2192 9.20696L26.6167 8.90257C26.6314 8.89182 26.6514 8.89361 26.6715 8.90614Z" fill="white"/>
-<path opacity="0.9" d="M26.2028 9.26758C26.2028 9.26758 26.2044 9.28194 26.2082 9.28914C26.2118 9.2981 26.2156 9.30708 26.221 9.31607C26.2118 9.2981 26.2063 9.28194 26.2044 9.26758H26.2028Z" fill="white"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M28.8968 10.1401C28.9169 10.1508 28.9369 10.1723 28.9516 10.1991L29.3475 10.953L29.351 10.9619L29.3584 10.9816L29.3619 10.9995C29.3638 11.0121 29.3638 11.0228 29.3619 11.03L29.3584 11.0425L29.3529 11.0532L29.3456 11.0604L28.9461 11.3218C28.9314 11.3308 28.9134 11.329 28.8932 11.3182C28.8749 11.3075 28.8586 11.2914 28.8458 11.2699C28.8166 11.2234 28.8147 11.1714 28.8422 11.1535L29.1285 10.9673L28.1818 10.4301C28.1417 10.4069 28.1107 10.3531 28.1107 10.3084C28.1107 10.2636 28.1417 10.2457 28.1818 10.269L29.1375 10.8115L28.8422 10.2475C28.8166 10.1991 28.822 10.1508 28.8512 10.1383C28.864 10.1329 28.8804 10.1365 28.8968 10.1454V10.1401Z" fill="white"/>
-<path opacity="0.9" d="M29.3565 11.041L29.3546 11.0445L29.351 11.0516L29.3565 11.041Z" fill="white"/>
-</g>
-<path opacity="0.9" d="M26.1589 19.2412L26.2063 19.3146L26.1698 19.3415L26.1224 19.2698L26.1589 19.2412Z" fill="#7808FF"/>
-<path opacity="0.9" d="M37.0725 12.7847C37.3479 12.9405 37.5706 13.3183 37.5687 13.6281C37.5668 13.9379 37.3443 14.0632 37.0689 13.9074L34.1266 12.2404C33.8511 12.0846 33.6286 11.7068 33.6303 11.3971C33.6303 11.0873 33.8547 10.962 34.1301 11.1177L37.0725 12.7847Z" fill="#6E17FF"/>
-<path opacity="0.9" d="M47.8529 17.1534L27.8426 5.81384L26.0002 4.76995C25.929 4.73056 25.8652 4.71981 25.8142 4.73593L27.9465 3.83707C28.0013 3.812 28.0741 3.81737 28.1526 3.86393L68.3194 26.6272C68.4873 26.7238 68.624 26.9549 68.624 27.1447L68.6168 29.5834H68.615L66.4644 30.4894L66.4699 28.3676V28.0507C66.4715 27.8609 66.3349 27.63 66.1651 27.5332L47.8548 17.1552" fill="#562ED0"/>
-<path d="M68.5133 32.6055L68.4421 57.1701C68.4421 57.2669 68.4056 57.333 68.3491 57.3634H68.3473L68.329 57.3706L66.2313 58.2551C66.2313 58.2551 66.2423 58.2444 66.2458 58.239C66.2714 58.2033 66.2878 58.1512 66.2878 58.0887V58.0761C66.2878 58.1405 66.2714 58.1907 66.2458 58.2266C66.233 58.2444 66.215 58.2606 66.1984 58.2694L66.2313 58.2551C66.2204 58.2658 66.2112 58.2749 66.1984 58.2803C66.1438 58.3124 66.0672 58.307 65.9832 58.2587L37.0474 41.861L25.82 35.4973C25.6523 35.4005 25.5154 35.1696 25.5154 34.9798L25.5866 10.4277L37.124 16.9632L66.3609 33.5241V33.5115L66.3718 33.5062L68.515 32.6036L68.5133 32.6055Z" fill="#FDFEFE"/>
-<path opacity="0.9" d="M68.5986 32.5847L68.5274 57.1493C68.5274 57.2461 68.4909 57.3122 68.4345 57.3426H68.4326L68.4162 57.3497L66.2837 58.2488C66.302 58.2398 66.3185 58.2236 66.3311 58.2058C66.3586 58.1699 66.3731 58.118 66.3731 58.0553L66.3786 56.2773L66.4443 33.4907L66.4535 33.4854L68.5986 32.583V32.5847Z" fill="#EDF1F3"/>
-<path opacity="0.8" d="M68.5986 32.5772L68.5275 57.1418C68.5275 57.2385 68.4909 57.3047 68.4345 57.3351H68.4326L68.4143 57.3422L66.3167 58.2268C66.3167 58.2268 66.3276 58.2161 66.3311 58.2106C66.3568 58.175 66.3731 58.1229 66.3731 58.0603V58.0478C66.3731 58.1122 66.3568 58.1624 66.3311 58.1983C66.3183 58.2161 66.3003 58.2323 66.2837 58.2411L66.3167 58.2268C66.3057 58.2375 66.2965 58.2465 66.2837 58.252C66.2291 58.2841 66.1525 58.2787 66.0685 58.2304L37.1327 41.8326L25.9053 35.4689C25.7376 35.3722 25.6008 35.1413 25.6008 34.9515L25.6719 10.3994L37.2094 16.9349L66.4462 33.4958V33.4832L66.4571 33.4779L68.6003 32.5753L68.5986 32.5772Z" fill="url(#paint1_linear_6722_31908)"/>
-<path opacity="0.9" d="M66.4644 30.489L66.4443 33.4899L68.5986 32.5839L68.6186 29.583L66.4644 30.489Z" fill="#ABC1C6"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M44.8487 29.1435C44.9654 29.2099 45.0621 29.3728 45.0603 29.5054C45.0584 29.6379 44.9635 29.6916 44.8468 29.6253L39.0024 26.3128C38.8857 26.2465 38.7889 26.0836 38.7908 25.9511C38.7927 25.8186 38.8876 25.7649 39.0043 25.8311L44.8487 29.1435Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M51.5759 27.8093C51.6927 27.8754 51.7894 28.0385 51.7875 28.171C51.7856 28.3034 51.691 28.3572 51.5741 28.2908L39.0024 21.1663C38.8857 21.1 38.7889 20.9371 38.7908 20.8046C38.7927 20.6721 38.8876 20.6184 39.0043 20.6846L51.5759 27.8093Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M51.5759 29.5104C51.6927 29.5767 51.7894 29.7396 51.7875 29.8721C51.7856 30.0045 51.691 30.0582 51.5741 29.9921L39.0024 22.8675C38.8857 22.8012 38.7889 22.6383 38.7908 22.5058C38.7927 22.3733 38.8876 22.3195 39.0043 22.3858L51.5759 29.5104Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M51.5759 31.0484C51.6927 31.1147 51.7894 31.2776 51.7875 31.4101C51.7856 31.5427 51.691 31.5965 51.5741 31.5301L39.0024 24.4055C38.8857 24.3393 38.7889 24.1763 38.7908 24.0438C38.7927 23.9113 38.8876 23.8576 39.0043 23.9239L51.5759 31.0484Z" fill="#EDF1F3"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M33.8383 18.1456C33.9551 18.2118 34.0518 18.3748 34.0499 18.5073C34.0483 18.6398 33.9534 18.6935 33.8367 18.6273L27.9921 15.3147C27.8754 15.2485 27.7788 15.0855 27.7805 14.953C27.7824 14.8205 27.8772 14.7668 27.994 14.8331L33.8383 18.1456Z" fill="white"/>
-<path opacity="0.9" d="M33.8383 19.8575C33.9551 19.9237 34.0518 20.0867 34.0499 20.2192C34.0483 20.3517 33.9534 20.4054 33.8367 20.3392L27.9921 17.0266C27.8754 16.9604 27.7788 16.7974 27.7805 16.6649C27.7824 16.5324 27.8772 16.4787 27.994 16.545L33.8383 19.8575Z" fill="white"/>
-</g>
-<path opacity="0.9" d="M55.3374 35.3178L55.3338 36.1917V36.2005L55.3281 38.3135L26.0877 21.7526L16.6937 16.4293L14.5522 15.2171L14.5612 12.2197L16.7101 13.4355L20.8399 15.7758L22.2243 14.7229L22.2499 14.7372L25.8232 16.7534L25.9328 16.8161L29.922 19.065L29.9367 19.0972L31.0969 21.5843L31.7041 21.9299V21.9263L30.6243 19.5556C30.608 19.518 30.6134 19.4894 30.6334 19.4822C30.639 19.4786 30.6462 19.4786 30.6554 19.4822C30.659 19.4822 30.6644 19.4858 30.6682 19.4876L33.7508 21.2352L35.0424 23.8207L55.3409 35.3178H55.3374Z" fill="#C9D7DD"/>
-<path opacity="0.9" d="M26.0823 21.7523L26.0111 46.6517L14.7802 40.2864C14.6124 40.1915 14.4756 39.9587 14.4756 39.7689L14.5467 15.2168L26.0842 21.7523H26.0823Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M55.3191 38.3136L55.2534 61.1001L55.248 62.8782C55.248 62.9408 55.2335 62.9929 55.206 63.0285C55.1932 63.0466 55.1768 63.0609 55.1585 63.0716C55.104 63.1037 55.0273 63.0984 54.9434 63.0502L26.0076 46.6503V46.6451L26.013 44.5214L26.0787 21.751H26.0823L55.3191 38.3118V38.3136Z" fill="white"/>
-<path opacity="0.9" d="M55.3464 32.8787V33.1938L55.3409 35.3175L35.0424 23.8204L33.7508 21.2366L30.6699 19.489C30.6699 19.489 30.6609 19.4837 30.6554 19.4837C30.6462 19.4801 30.6407 19.4801 30.6334 19.4837C30.6153 19.4908 30.6097 19.5213 30.6262 19.5553L31.706 21.9278H31.7025L31.0969 21.5822L29.9659 19.113L29.9367 19.0969L25.9328 16.8158L25.8232 16.7531L22.2663 14.7262L22.2499 14.7387L20.8416 15.7772L16.7101 13.437L14.5631 12.2212L14.5705 9.76992C14.5705 9.65891 14.6179 9.58728 14.6907 9.5658C14.742 9.54968 14.8074 9.56042 14.8769 9.59982L16.7191 10.6437L36.7297 21.9851H36.7332L55.0437 32.3649C55.2133 32.4616 55.3502 32.6925 55.3483 32.8823L55.3464 32.8787Z" fill="#6E17FF"/>
-<g opacity="0.7">
-<path opacity="0.7" d="M55.3464 32.8787V33.1938L55.3409 35.3175L35.0424 23.8204L33.7508 21.2366L30.6699 19.489C30.6699 19.489 30.6609 19.4837 30.6554 19.4837C30.6462 19.4801 30.6407 19.4801 30.6334 19.4837C30.6153 19.4908 30.6097 19.5213 30.6262 19.5553L31.706 21.9278H31.7025L31.0969 21.5822L29.9659 19.113L29.9367 19.0969L25.9328 16.8158L25.8232 16.7531L22.2663 14.7262L22.2499 14.7387L20.8416 15.7772L16.7101 13.437L14.5631 12.2212L14.5705 9.76992C14.5705 9.65891 14.6179 9.58728 14.6907 9.5658C14.742 9.54968 14.8074 9.56042 14.8769 9.59982L16.7191 10.6437L36.7297 21.9851H36.7332L55.0437 32.3649C55.2133 32.4616 55.3502 32.6925 55.3483 32.8823L55.3464 32.8787Z" fill="url(#paint2_linear_6722_31908)"/>
-</g>
-<path opacity="0.9" d="M22.5053 27.7773L22.4468 27.7468V27.7432L22.5053 27.7773Z" fill="#7808FF"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M15.882 11.2826C16.0991 11.4062 16.2741 11.7034 16.2741 11.9487C16.2741 12.194 16.0972 12.2907 15.8801 12.169C15.6631 12.0472 15.488 11.7482 15.4897 11.5047C15.4916 11.2612 15.6667 11.1609 15.8837 11.2844L15.882 11.2826Z" fill="white"/>
-<path opacity="0.9" d="M16.9855 11.9018C17.2026 12.0253 17.3776 12.3226 17.3776 12.5679C17.3776 12.8132 17.2007 12.9099 16.9836 12.7881C16.7666 12.6663 16.5915 12.3673 16.5934 12.1238C16.5951 11.8803 16.7704 11.78 16.9874 11.9036L16.9855 11.9018Z" fill="white"/>
-<path opacity="0.9" d="M18.1237 12.5893C18.341 12.7128 18.516 13.0101 18.516 13.2554C18.516 13.5007 18.3391 13.5974 18.122 13.4756C17.905 13.3539 17.7297 13.0548 17.7316 12.8113C17.7335 12.5678 17.9085 12.4675 18.1256 12.5911L18.1237 12.5893Z" fill="white"/>
-</g>
-<path opacity="0.9" d="M32.6326 21.1709C32.9208 21.3338 33.1526 21.7295 33.1507 22.0536C33.1507 22.3777 32.9154 22.5084 32.629 22.3455C32.3427 22.1825 32.1093 21.7886 32.111 21.4645C32.111 21.1404 32.3444 21.0097 32.6326 21.1727V21.1709Z" fill="#7808FF"/>
-<path opacity="0.9" d="M51.8388 34.0231C51.9866 34.1072 52.1052 34.3096 52.1052 34.4761L52.1014 35.6543C52.1014 35.8208 51.9811 35.8888 51.8333 35.8046L19.8294 17.6664C19.6816 17.5822 19.563 17.3799 19.563 17.2133L19.5666 16.0352C19.5666 15.8686 19.6871 15.8006 19.8349 15.8848L51.8388 34.0231Z" fill="white"/>
-<path opacity="0.9" d="M51.111 34.0084C51.111 34.0084 51.1165 34.0136 51.1182 34.0172L51.2258 34.4542L51.2332 34.463L51.5833 34.6618C51.5833 34.6618 51.5926 34.6761 51.5871 34.678L51.3043 34.7496V34.7567L51.4083 35.1919C51.4083 35.1919 51.4064 35.2009 51.4009 35.199C51.4009 35.199 51.3992 35.1973 51.3973 35.1954L51.1165 34.8033L51.1072 34.7978L50.8245 34.8696C50.8245 34.8696 50.8228 34.8696 50.8209 34.8696C50.8171 34.8677 50.8136 34.8606 50.8155 34.8552L50.9248 34.542V34.531L50.6404 34.1389C50.6404 34.1389 50.6385 34.123 50.644 34.1265L50.9941 34.3251H51.0014L51.111 34.01C51.111 34.01 51.1146 34.0065 51.1165 34.0084H51.111Z" fill="#6E17FF"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M54.3871 35.7291V35.8132L53.1648 35.1203V35.0361L54.3871 35.7291Z" fill="#7808FF"/>
-<path opacity="0.9" d="M54.3871 36.1119V36.1979L53.1648 35.505V35.4189L54.3871 36.1119Z" fill="#7808FF"/>
-<path opacity="0.9" d="M54.3871 36.4976V36.5818L53.1648 35.8908V35.8047L54.3871 36.4976Z" fill="#7808FF"/>
-<path opacity="0.9" d="M54.3871 36.8824V36.9666L53.1648 36.2736V36.1895L54.3871 36.8824Z" fill="#7808FF"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M15.5464 13.7343C15.5628 13.7432 15.5791 13.7593 15.592 13.779C15.623 13.8238 15.6266 13.8793 15.601 13.8972L15.3019 14.1246L16.2597 14.6672C16.2998 14.6886 16.3306 14.7442 16.3306 14.7889C16.3306 14.8337 16.2979 14.8516 16.2597 14.8283L15.3128 14.2911L15.5974 14.8014C15.623 14.848 15.6211 14.8981 15.592 14.9125C15.5775 14.9178 15.5609 14.916 15.5445 14.9071C15.5262 14.8963 15.5063 14.8748 15.4916 14.8498L15.1012 14.1515L15.0957 14.1407C15.0867 14.1228 15.0812 14.1067 15.0793 14.0924C15.0793 14.0816 15.0793 14.0709 15.0793 14.0619L15.0831 14.0494L15.0903 14.0387L15.094 14.0351L15.4916 13.7307C15.5063 13.7199 15.5263 13.7217 15.5464 13.7343Z" fill="white"/>
-<path opacity="0.9" d="M15.0776 14.0957C15.0776 14.0957 15.0793 14.1101 15.0831 14.1173C15.0867 14.1262 15.0904 14.1352 15.0959 14.1442C15.0867 14.1262 15.0812 14.1101 15.0793 14.0957H15.0776Z" fill="white"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M17.7717 14.9682C17.7918 14.9789 17.8117 15.0004 17.8264 15.0273L18.2223 15.7811L18.2259 15.7901L18.2333 15.8097L18.2368 15.8276C18.2387 15.8402 18.2387 15.8509 18.2368 15.8581L18.2333 15.8706L18.2278 15.8814L18.2204 15.8885L17.821 16.1499C17.8063 16.1589 17.7882 16.1571 17.7681 16.1464C17.7498 16.1356 17.7335 16.1195 17.7206 16.098C17.6915 16.0515 17.6896 15.9995 17.7171 15.9816L18.0034 15.7954L17.0567 15.2583C17.0166 15.235 16.9855 15.1813 16.9855 15.1365C16.9855 15.0917 17.0166 15.0738 17.0567 15.0971L18.0124 15.6396L17.7171 15.0756C17.6915 15.0273 17.6969 14.9789 17.7261 14.9664C17.7389 14.961 17.7553 14.9646 17.7717 14.9736V14.9682Z" fill="white"/>
-<path opacity="0.9" d="M18.2313 15.8691L18.2295 15.8727L18.2259 15.8797L18.2313 15.8691Z" fill="white"/>
-</g>
-<path opacity="0.9" d="M15.0337 24.0693L15.0812 24.1427L15.0446 24.1696L14.9972 24.098L15.0337 24.0693Z" fill="#7808FF"/>
-<path opacity="0.9" d="M25.9473 17.6129C26.2227 17.7686 26.4454 18.1465 26.4435 18.4562C26.4416 18.766 26.2191 18.8913 25.9437 18.7355L23.0014 17.0685C22.726 16.9128 22.5035 16.535 22.5051 16.2252C22.5051 15.9154 22.7295 15.7901 23.0049 15.9459L25.9473 17.6129Z" fill="#6E17FF"/>
-<path opacity="0.9" d="M36.7278 21.9815L16.7175 10.642L14.8751 9.59807C14.8039 9.55868 14.7401 9.54794 14.6891 9.56405L16.8214 8.6652C16.8762 8.64013 16.949 8.6455 17.0275 8.69205L57.1943 31.4554C57.3622 31.5519 57.4989 31.783 57.4989 31.9728L57.4917 34.4116H57.4898L55.3393 35.3175L55.3447 33.1958V32.8788C55.3464 32.689 55.2098 32.4581 55.0399 32.3614L36.7297 21.9833" fill="#562ED0"/>
-<path d="M57.4734 37.4053L57.4023 61.9699C57.4023 62.0667 57.3658 62.1328 57.3093 62.1632H57.3074L57.2891 62.1704L55.1915 63.0549C55.1915 63.0549 55.2024 63.0442 55.206 63.0388C55.2316 63.0031 55.2479 62.951 55.2479 62.8885V62.8759C55.2479 62.9403 55.2316 62.9905 55.206 63.0264C55.1932 63.0442 55.1751 63.0604 55.1585 63.0692L55.1915 63.0549C55.1806 63.0656 55.1713 63.0747 55.1585 63.0801C55.1039 63.1122 55.0273 63.1068 54.9434 63.0585L26.0075 46.6608L14.7802 40.2971C14.6124 40.2003 14.4756 39.9694 14.4756 39.7796L14.5467 15.2275L26.0842 21.763L55.321 38.3239V38.3113L55.3319 38.306L57.4751 37.4034L57.4734 37.4053Z" fill="#FDFEFE"/>
-<path opacity="0.9" d="M57.4734 37.4128L57.4023 61.9774C57.4023 62.0742 57.3657 62.1403 57.3093 62.1707H57.3074L57.291 62.1779L55.1585 63.0769C55.1768 63.0679 55.1934 63.0517 55.2059 63.0339C55.2334 62.998 55.2479 62.9462 55.2479 62.8834L55.2534 61.1054L55.3191 38.3188L55.3283 38.3135L57.4734 37.4111V37.4128Z" fill="#EDF1F3"/>
-<path opacity="0.8" d="M57.4734 37.4053L57.4023 61.9699C57.4023 62.0667 57.3658 62.1328 57.3093 62.1632H57.3074L57.2891 62.1704L55.1915 63.0549C55.1915 63.0549 55.2024 63.0442 55.206 63.0388C55.2316 63.0031 55.2479 62.951 55.2479 62.8885V62.8759C55.2479 62.9403 55.2316 62.9905 55.206 63.0264C55.1932 63.0442 55.1751 63.0604 55.1585 63.0692L55.1915 63.0549C55.1806 63.0656 55.1713 63.0747 55.1585 63.0801C55.1039 63.1122 55.0273 63.1068 54.9434 63.0585L26.0075 46.6608L14.7802 40.2971C14.6124 40.2003 14.4756 39.9694 14.4756 39.7796L14.5467 15.2275L26.0842 21.763L55.321 38.3239V38.3113L55.3319 38.306L57.4751 37.4034L57.4734 37.4053Z" fill="url(#paint3_linear_6722_31908)"/>
-<path opacity="0.9" d="M55.3392 35.3171L55.3191 38.318L57.4734 37.412L57.4934 34.4111L55.3392 35.3171Z" fill="#ABC1C6"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M33.7235 33.9717C33.8403 34.038 33.937 34.2009 33.9351 34.3335C33.9332 34.466 33.8384 34.5197 33.7217 34.4534L27.8773 31.1409C27.7606 31.0747 27.6638 30.9117 27.6657 30.7792C27.6676 30.6467 27.7624 30.593 27.8792 30.6592L33.7235 33.9717Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M40.4508 32.6374C40.5675 32.7036 40.6643 32.8667 40.6624 32.9991C40.6605 33.1316 40.5659 33.1853 40.4489 33.119L27.8773 25.9944C27.7606 25.9282 27.6638 25.7652 27.6657 25.6327C27.6676 25.5002 27.7624 25.4465 27.8792 25.5127L40.4508 32.6374Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M40.4508 34.3385C40.5675 34.4048 40.6643 34.5677 40.6624 34.7002C40.6605 34.8326 40.5659 34.8864 40.4489 34.8202L27.8773 27.6956C27.7606 27.6293 27.6638 27.4664 27.6657 27.3339C27.6676 27.2014 27.7624 27.1477 27.8792 27.2139L40.4508 34.3385Z" fill="#EDF1F3"/>
-<path opacity="0.9" d="M40.4508 35.8765C40.5675 35.9429 40.6643 36.1057 40.6624 36.2382C40.6605 36.3709 40.5659 36.4246 40.4489 36.3583L27.8773 29.2337C27.7606 29.1674 27.6638 29.0045 27.6657 28.872C27.6676 28.7395 27.7624 28.6858 27.8792 28.752L40.4508 35.8765Z" fill="#EDF1F3"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M22.7132 22.9737C22.8299 23.04 22.9266 23.2029 22.9248 23.3354C22.9231 23.4679 22.8282 23.5216 22.7115 23.4554L16.8669 20.1429C16.7502 20.0766 16.6536 19.9137 16.6553 19.7812C16.6572 19.6487 16.7521 19.5949 16.8688 19.6612L22.7132 22.9737Z" fill="white"/>
-<path opacity="0.9" d="M22.7132 24.6856C22.8299 24.7519 22.9266 24.9148 22.9248 25.0473C22.9231 25.1798 22.8282 25.2335 22.7115 25.1673L16.8669 21.8548C16.7502 21.7885 16.6536 21.6256 16.6553 21.4931C16.6572 21.3606 16.7521 21.3069 16.8688 21.3731L22.7132 24.6856Z" fill="white"/>
-</g>
-<path d="M44.2741 40.5052L44.2705 41.3791V41.3881L44.2651 43.5009L15.0228 26.9401L5.62859 21.6168L3.48706 20.4046L3.4963 17.4072L5.64496 18.623L9.77478 20.9632L11.1594 19.9104L11.1848 19.9247L14.7583 21.9409L14.8677 22.0036L18.8571 24.2525L18.8715 24.2847L20.0317 26.7718L20.6392 27.1174V27.1138L19.5592 24.7431C19.5428 24.7055 19.5483 24.6769 19.5685 24.6697C19.5739 24.6661 19.5813 24.6661 19.5903 24.6697C19.5941 24.6697 19.5995 24.6733 19.6031 24.6751L22.6859 26.4227L23.9773 29.0082L44.276 40.5052H44.2741Z" fill="#C9D7DD"/>
-<path d="M15.019 26.9398L14.9481 51.8392L3.71694 45.4738C3.54922 45.3789 3.41235 45.1461 3.41235 44.9563L3.48351 20.4043L15.0209 26.9398H15.019Z" fill="url(#paint4_linear_6722_31908)"/>
-<path d="M44.2559 43.5011L44.1902 66.2877L44.1847 68.0657C44.1847 68.1284 44.1702 68.1803 44.1427 68.2162C44.1302 68.234 44.1136 68.2483 44.0955 68.259C44.0407 68.2913 43.9641 68.2859 43.8802 68.2376L14.9443 51.8379V51.8325L14.9498 49.709L15.0155 26.9385H15.0193L44.2559 43.4994V43.5011Z" fill="white"/>
-<path d="M44.2815 38.0664V38.3814L44.276 40.5049L23.9773 29.0079L22.6859 26.4241L19.605 24.6765C19.605 24.6765 19.5958 24.6712 19.5903 24.6712C19.5813 24.6676 19.5758 24.6676 19.5685 24.6712C19.5502 24.6783 19.5447 24.7088 19.5611 24.7428L20.6411 27.1153H20.6373L20.0317 26.7697L18.9007 24.3005L18.8716 24.2844L14.8677 22.0032L14.7583 21.9406L11.2014 19.9137L11.1848 19.9262L9.77668 20.9647L5.64497 18.6245L3.49799 17.4087L3.50533 14.9574C3.50533 14.8464 3.55277 14.7748 3.62582 14.7533C3.67683 14.7372 3.74253 14.7479 3.8118 14.7873L5.65421 15.8312L25.6645 27.1726H25.6683L43.9786 37.5523C44.1484 37.6491 44.285 37.88 44.2834 38.0699L44.2815 38.0664Z" fill="#6E17FF"/>
-<g opacity="0.7">
-<path opacity="0.7" d="M44.2815 38.0664V38.3814L44.276 40.5049L23.9773 29.0079L22.6859 26.4241L19.605 24.6765C19.605 24.6765 19.5958 24.6712 19.5903 24.6712C19.5813 24.6676 19.5758 24.6676 19.5685 24.6712C19.5502 24.6783 19.5447 24.7088 19.5611 24.7428L20.6411 27.1153H20.6373L20.0317 26.7697L18.9007 24.3005L18.8716 24.2844L14.8677 22.0032L14.7583 21.9406L11.2014 19.9137L11.1848 19.9262L9.77668 20.9647L5.64497 18.6245L3.49799 17.4087L3.50533 14.9574C3.50533 14.8464 3.55277 14.7748 3.62582 14.7533C3.67683 14.7372 3.74253 14.7479 3.8118 14.7873L5.65421 15.8312L25.6645 27.1726H25.6683L43.9786 37.5523C44.1484 37.6491 44.285 37.88 44.2834 38.0699L44.2815 38.0664Z" fill="url(#paint5_linear_6722_31908)"/>
-</g>
-<path d="M11.4424 32.9647L11.3819 32.9342V32.9307L11.4424 32.9647Z" fill="#7808FF"/>
-<path d="M4.81688 16.4701C5.03393 16.5937 5.2092 16.8909 5.2092 17.1362C5.2092 17.3815 5.03225 17.4782 4.8152 17.3565C4.59794 17.2347 4.42287 16.9357 4.42476 16.6922C4.42665 16.4487 4.60171 16.3484 4.81876 16.4719L4.81688 16.4701Z" fill="white"/>
-<path d="M5.9206 17.0883C6.13765 17.2118 6.31271 17.5091 6.31271 17.7544C6.31271 17.9997 6.13576 18.0964 5.91871 17.9746C5.70166 17.8529 5.52659 17.5538 5.52827 17.3103C5.53016 17.0668 5.70523 16.9665 5.92228 17.0901L5.9206 17.0883Z" fill="white"/>
-<path d="M7.06061 17.7758C7.27766 17.8993 7.45273 18.1966 7.45273 18.4419C7.45273 18.6872 7.27577 18.7839 7.05872 18.6621C6.84167 18.5404 6.66661 18.2413 6.66829 17.9978C6.67018 17.7543 6.84524 17.654 7.06229 17.7776L7.06061 17.7758Z" fill="white"/>
-<path d="M21.5696 26.3584C21.8578 26.5213 22.0893 26.917 22.0876 27.2411C22.0858 27.5652 21.8523 27.6959 21.5658 27.533C21.2795 27.37 21.0461 26.9761 21.0477 26.652C21.0477 26.3279 21.2814 26.1972 21.5696 26.3602V26.3584Z" fill="#7808FF"/>
-<path d="M40.7737 39.2105C40.9214 39.2947 41.04 39.497 41.04 39.6635L41.0365 40.8417C41.0365 41.0082 40.916 41.0764 40.7682 40.9922L8.7643 22.8539C8.61652 22.7697 8.49792 22.5674 8.49792 22.4009L8.5017 21.2227C8.5017 21.0562 8.62198 20.9881 8.76976 21.0723L40.7737 39.2105Z" fill="white"/>
-<path d="M40.0459 39.1958C40.0459 39.1958 40.0513 39.2013 40.0532 39.2049L40.1609 39.6417L40.168 39.6507L40.5184 39.8493C40.5184 39.8493 40.5274 39.8638 40.522 39.8655L40.2392 39.937V39.9444L40.3433 40.3793C40.3433 40.3793 40.3414 40.3884 40.336 40.3865C40.336 40.3865 40.3341 40.3848 40.3322 40.3829L40.0513 39.9908L40.0423 39.9855L39.7596 40.0571C39.7596 40.0571 39.7577 40.0571 39.7558 40.0571C39.7522 40.0552 39.7486 40.0481 39.7503 40.0428L39.8599 39.7294V39.7187L39.5753 39.3266C39.5753 39.3266 39.5734 39.3105 39.579 39.314L39.9292 39.5128H39.9365L40.0459 39.1977C40.0459 39.1977 40.0497 39.194 40.0513 39.1958H40.0459Z" fill="#6E17FF"/>
-<path d="M43.3239 40.9166V41.0007L42.1017 40.3078V40.2236L43.3239 40.9166Z" fill="#7808FF"/>
-<path d="M43.3239 41.3003V41.3845L42.1017 40.6933V40.6074L43.3239 41.3003Z" fill="#7808FF"/>
-<path d="M43.3239 41.6851V41.7693L42.1017 41.0764V40.9922L43.3239 41.6851Z" fill="#7808FF"/>
-<path d="M43.3239 42.068V42.154L42.1017 41.4609V41.377L43.3239 42.068Z" fill="#7808FF"/>
-<path d="M4.48125 18.9218C4.49763 18.9307 4.51421 18.9468 4.52701 18.9665C4.55787 19.0113 4.56165 19.0668 4.53604 19.0847L4.23691 19.3121L5.19453 19.8547C5.23463 19.8761 5.2657 19.9316 5.2657 19.9764C5.2657 20.0212 5.23274 20.0391 5.19453 20.0158L4.24783 19.4786L4.53247 19.9889C4.55787 20.0355 4.55619 20.0856 4.52701 20.1C4.51232 20.1053 4.49594 20.1035 4.47957 20.0946C4.46131 20.0838 4.44116 20.0624 4.42667 20.0373L4.03624 19.339L4.03078 19.3282C4.02154 19.3103 4.01608 19.2942 4.0144 19.2799C4.0144 19.2691 4.0144 19.2584 4.0144 19.2494L4.01798 19.2369L4.02532 19.2262L4.02889 19.2226L4.42667 18.9182C4.44116 18.9074 4.46131 18.9092 4.48125 18.9218Z" fill="white"/>
-<path d="M4.01251 19.2812C4.01251 19.2812 4.0144 19.2956 4.01797 19.3028C4.02175 19.3118 4.02531 19.3208 4.03077 19.3297C4.02175 19.3118 4.01608 19.2956 4.0144 19.2812H4.01251Z" fill="white"/>
-<path d="M6.70671 20.1557C6.72666 20.1664 6.74681 20.1879 6.7615 20.2148L7.15719 20.9686L7.16097 20.9775L7.1681 20.9972L7.17188 21.0151C7.17377 21.0277 7.17377 21.0384 7.17188 21.0456L7.1681 21.0581L7.16264 21.0689L7.15551 21.076L6.75604 21.3374C6.74135 21.3464 6.72309 21.3446 6.70315 21.3339C6.68488 21.3231 6.6683 21.307 6.65571 21.2855C6.62653 21.239 6.62464 21.187 6.65193 21.1691L6.93846 20.9829L5.99154 20.4458C5.95145 20.4225 5.92059 20.3688 5.92059 20.324C5.92059 20.2792 5.95145 20.2613 5.99154 20.2846L6.94748 20.8271L6.65193 20.2631C6.62653 20.2148 6.63199 20.1664 6.66116 20.1539C6.67376 20.1485 6.69034 20.1521 6.70671 20.1611V20.1557Z" fill="white"/>
-<path d="M7.16812 21.0557L7.16644 21.0592L7.16266 21.0662L7.16812 21.0557Z" fill="white"/>
-<path d="M3.96863 29.2568L4.01607 29.3303L3.97975 29.3571L3.93231 29.2837L3.96863 29.2568Z" fill="#7808FF"/>
-<path d="M14.8841 22.8004C15.1597 22.9561 15.3822 23.334 15.3803 23.6437C15.3784 23.9535 15.1559 24.0788 14.8805 23.923L11.9382 22.256C11.6628 22.1003 11.4403 21.7225 11.4422 21.4127C11.4422 21.1029 11.6665 20.9776 11.942 21.1334L14.8841 22.8004Z" fill="#6E17FF"/>
-<path d="M25.6629 27.169L5.65235 15.8295L3.80994 14.7856C3.73878 14.7462 3.67497 14.7354 3.62396 14.7516L5.75625 13.8527C5.81104 13.8276 5.88409 13.833 5.96239 13.8796L46.1294 36.6428C46.2971 36.7396 46.4339 36.9705 46.4339 37.1602L46.4266 39.599H46.4247L44.2741 40.505L44.2796 38.3832V38.0664C44.2815 37.8764 44.1446 37.6455 43.975 37.5488L25.6646 27.1708" fill="#562ED0"/>
-<path d="M46.4102 42.6005L46.3391 67.1649C46.3391 67.2617 46.3025 67.328 46.2461 67.3584H46.2442L46.2278 67.3656L44.0955 68.2644C44.1136 68.2554 44.1302 68.2392 44.1427 68.2214C44.1702 68.1857 44.1847 68.1337 44.1847 68.0711L44.1902 66.2929L44.2559 43.5065L44.2651 43.501L46.4102 42.5986V42.6005Z" fill="#8BABB5"/>
-<path opacity="0.8" d="M44.2815 68.1779L44.1282 68.2426C44.1282 68.2426 44.1392 68.2316 44.1427 68.2264C44.1683 68.1905 44.1847 68.1387 44.1847 68.0759V68.0635C44.1847 68.1279 44.1683 68.1779 44.1427 68.2138C44.1301 68.2316 44.1119 68.2478 44.0955 68.2568L44.1282 68.2426C44.1173 68.2533 44.1081 68.2621 44.0955 68.2675C44.0407 68.2997 43.9641 68.2944 43.8801 68.2461L14.9443 51.8482L3.71694 45.4845C3.54922 45.3879 3.41235 45.1568 3.41235 44.967L3.48351 20.415L15.0209 26.9505L44.2578 43.5113V43.4989L44.2687 43.4935L44.276 43.4899L44.2851 68.1779H44.2815Z" fill="url(#paint6_linear_6722_31908)"/>
-<path d="M44.276 40.5053L44.2559 43.5064L46.4102 42.6005L46.4285 39.5977L44.276 40.5053Z" fill="#95B7BF"/>
-<path d="M22.6603 39.1563C22.777 39.2226 22.8738 39.3855 22.8719 39.518C22.8702 39.6506 22.7753 39.7044 22.6586 39.638L16.814 36.3254C16.6973 36.2593 16.6008 36.0964 16.6024 35.9637C16.6043 35.8313 16.6992 35.7775 16.8159 35.8439L22.6603 39.1563Z" fill="#EDF1F3"/>
-<path d="M29.3876 37.8248C29.5045 37.8912 29.6011 38.0541 29.5992 38.1865C29.5992 38.319 29.5026 38.3727 29.3859 38.3066L16.814 31.1819C16.6973 31.1157 16.6008 30.9527 16.6024 30.8202C16.6043 30.6877 16.6992 30.634 16.8159 30.7003L29.3876 37.8248Z" fill="#EDF1F3"/>
-<path d="M29.3876 39.5261C29.5045 39.5922 29.6011 39.7551 29.5992 39.8878C29.5992 40.0202 29.5026 40.074 29.3859 40.0077L16.814 32.883C16.6973 32.8169 16.6008 32.6538 16.6024 32.5213C16.6043 32.3889 16.6992 32.3351 16.8159 32.4015L29.3876 39.5261Z" fill="#EDF1F3"/>
-<path d="M29.3876 41.0642C29.5045 41.1303 29.6011 41.2934 29.5992 41.4259C29.5992 41.5583 29.5026 41.6121 29.3859 41.5457L16.814 34.4213C16.6973 34.355 16.6008 34.1921 16.6024 34.0596C16.6043 33.927 16.6992 33.8732 16.8159 33.9396L29.3876 41.0642Z" fill="#EDF1F3"/>
-<path d="M11.6499 28.1612C11.7666 28.2275 11.8634 28.3904 11.8615 28.5229C11.8598 28.6554 11.765 28.7091 11.6482 28.6429L5.80365 25.3304C5.68694 25.2641 5.59038 25.1011 5.59206 24.9687C5.59395 24.8362 5.68883 24.7824 5.80554 24.8487L11.6499 28.1612Z" fill="white"/>
-<path d="M11.6499 29.8731C11.7666 29.9394 11.8634 30.1023 11.8615 30.2348C11.8598 30.3673 11.765 30.421 11.6482 30.3548L5.80365 27.0422C5.68694 26.976 5.59038 26.8131 5.59206 26.6806C5.59395 26.5481 5.68883 26.4944 5.80554 26.5606L11.6499 29.8731Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_6722_31908" x1="81.5133" y1="31.7642" x2="16.0078" y2="4.52398" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6722_31908" x1="74.0782" y1="36.1081" x2="57.2333" y2="35.0082" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.12" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="0.3" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint2_linear_6722_31908" x1="70.3881" y1="36.5923" x2="4.88257" y2="9.3521" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint3_linear_6722_31908" x1="62.953" y1="40.9362" x2="46.1081" y2="39.8363" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.12" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="0.3" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint4_linear_6722_31908" x1="-5" y1="23" x2="57.5" y2="72" gradientUnits="userSpaceOnUse">
-<stop stop-color="#EDF1F3"/>
-<stop offset="1" stop-color="#8DA5B1"/>
-</linearGradient>
-<linearGradient id="paint5_linear_6722_31908" x1="59.323" y1="41.7799" x2="-6.18238" y2="14.5396" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint6_linear_6722_31908" x1="55.9211" y1="66.486" x2="2.46733" y2="28.2661" gradientUnits="userSpaceOnUse">
-<stop offset="0.13" stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.29" stop-color="#4C7F8E" stop-opacity="0.3"/>
-<stop offset="0.46" stop-color="#4C7F8E" stop-opacity="0.13"/>
-<stop offset="0.62" stop-color="#4C7F8E" stop-opacity="0.03"/>
-<stop offset="0.75" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<clipPath id="clip0_6722_31908">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6722_31908)"><path fill="#c9d7dd" d="m66.463 30.49-.004.874v.008l-.006 2.113-29.24-16.56-9.394-5.324-2.142-1.212.01-2.997 2.148 1.215 4.13 2.34 1.384-1.052.026.014 3.573 2.016.11.063 3.99 2.249.014.032 1.16 2.487.607.346v-.004l-1.08-2.37c-.016-.038-.01-.067.01-.074q.007-.006.022 0l.012.005 3.083 1.748 1.292 2.586L66.466 30.49z" opacity=".9"/><path fill="#edf1f3" d="m37.208 16.924-.072 24.9-11.23-6.366a.66.66 0 0 1-.305-.517l.07-24.552z" opacity=".9"/><path fill="#fff" d="m66.444 33.486-.066 22.786-.005 1.778a.25.25 0 0 1-.042.15.2.2 0 0 1-.047.043c-.055.033-.132.027-.216-.021l-28.935-16.4v-.005l.005-2.124.066-22.77h.003l29.237 16.56z" opacity=".9"/><path fill="#6e17ff" d="M66.472 28.05v.316l-.006 2.123-20.298-11.497-1.292-2.584-3.08-1.747s-.01-.005-.015-.005q-.013-.006-.022 0c-.019.007-.024.037-.008.071l1.08 2.373h-.003l-.606-.346-1.131-2.47-.03-.015-4.003-2.281-.11-.063-3.556-2.027-.017.013-1.408 1.038-4.132-2.34-2.147-1.216.008-2.451c0-.111.047-.183.12-.204.051-.016.117-.006.186.034l1.842 1.044 20.01 11.34h.004l18.31 10.38c.17.098.307.328.305.518z" opacity=".9"/><path fill="url(#paint0_linear_6722_31908)" d="M66.472 28.05v.316l-.006 2.123-20.298-11.497-1.292-2.584-3.08-1.747s-.01-.005-.015-.005q-.013-.006-.022 0c-.019.007-.024.037-.008.071l1.08 2.373h-.003l-.606-.346-1.131-2.47-.03-.015-4.003-2.281-.11-.063-3.556-2.027-.017.013-1.408 1.038-4.132-2.34-2.147-1.216.008-2.451c0-.111.047-.183.12-.204.051-.016.117-.006.186.034l1.842 1.044 20.01 11.34h.004l18.31 10.38c.17.098.307.328.305.518z" opacity=".7"/><path fill="#7808ff" d="m33.63 22.95-.058-.031v-.004z" opacity=".9"/><path fill="#fff" d="M27.007 6.455c.217.123.392.42.392.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.002-.244.177-.344.394-.22zm1.103.619c.218.123.393.42.393.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.001-.244.176-.344.393-.22zm1.139.687c.217.124.392.42.392.666s-.177.342-.394.22a.84.84 0 0 1-.39-.664c.002-.243.177-.344.394-.22z" opacity=".9"/><path fill="#7808ff" d="M43.758 16.343c.288.163.52.558.518.883 0 .324-.236.454-.522.291s-.52-.556-.518-.88c0-.325.234-.455.522-.293z" opacity=".9"/><path fill="#fff" d="M62.964 29.195a.58.58 0 0 1 .266.453l-.003 1.178c0 .167-.12.235-.269.15L30.954 12.839a.58.58 0 0 1-.266-.453l.004-1.178c0-.167.12-.235.268-.15z" opacity=".9"/><path fill="#6e17ff" d="M62.236 29.18s.006.006.007.01l.108.436.007.009.35.199s.01.014.004.016l-.283.071v.008l.104.435s-.002.009-.007.007l-.004-.004-.28-.392-.01-.005-.282.072h-.004c-.004-.002-.007-.01-.005-.015l.109-.313v-.011l-.284-.392s-.002-.016.003-.013l.35.199h.008l.11-.315s.003-.004.005-.002z" opacity=".9"/><path fill="#7808ff" d="M65.512 30.9v.085l-1.222-.693v-.084zm0 .384v.086l-1.222-.693v-.086zm0 .386v.084l-1.222-.691v-.086zm0 .384v.084l-1.222-.692v-.085z" opacity=".9"/><g fill="#fff" opacity=".9"><path d="M26.672 8.906a.14.14 0 0 1 .045.045c.031.045.035.1.01.118l-.3.227.958.543c.04.021.07.077.07.122s-.032.063-.07.04l-.947-.538.285.51c.025.047.023.097-.006.111a.06.06 0 0 1-.047-.005.2.2 0 0 1-.053-.057l-.39-.699-.006-.01a.2.2 0 0 1-.017-.049v-.03l.004-.013.007-.01.004-.004.398-.304q.022-.016.055.003" opacity=".9"/><path d="M26.203 9.268s.001.014.005.021l.013.027a.2.2 0 0 1-.017-.048z" opacity=".9"/></g><g fill="#fff" opacity=".9"><path d="M28.897 10.14q.031.017.055.06l.395.753.004.009.007.02.004.018a.1.1 0 0 1 0 .03l-.004.013-.005.01-.007.007-.4.262q-.023.013-.053-.004a.14.14 0 0 1-.047-.048c-.03-.047-.031-.099-.004-.117l.287-.186-.947-.537a.15.15 0 0 1-.071-.122c0-.044.03-.062.07-.039l.956.543-.295-.564c-.025-.049-.02-.097.01-.11q.019-.007.045.007z" opacity=".9"/><path d="m29.357 11.041-.002.003-.004.008z" opacity=".9"/></g><path fill="#7808ff" d="m26.159 19.241.047.074-.036.026-.048-.071z" opacity=".9"/><path fill="#6e17ff" d="M37.073 12.785c.275.155.498.533.496.843s-.225.435-.5.28l-2.942-1.668c-.276-.155-.498-.533-.497-.843 0-.31.225-.435.5-.28z" opacity=".9"/><path fill="#562ed0" d="m47.853 17.153-20.01-11.34L26 4.77q-.108-.059-.186-.034l2.133-.899c.054-.025.127-.02.206.027l40.166 22.763a.66.66 0 0 1 .305.518l-.007 2.438h-.002l-2.15.906.005-2.121v-.317a.65.65 0 0 0-.305-.518l-18.31-10.378" opacity=".9"/><path fill="#fdfefe" d="m68.513 32.606-.07 24.564c0 .097-.037.163-.094.193h-.002l-.018.008-2.098.884s.011-.01.015-.016a.26.26 0 0 0 .042-.15v-.013a.26.26 0 0 1-.042.15.2.2 0 0 1-.048.043l.033-.014q-.014.016-.033.025c-.054.032-.13.027-.215-.021L37.047 41.86 25.82 35.497a.66.66 0 0 1-.305-.517l.072-24.552 11.537 6.535 29.237 16.561v-.013l.01-.005 2.144-.902z"/><path fill="#edf1f3" d="m68.599 32.585-.072 24.564c0 .097-.036.163-.093.194h-.001l-.017.007-2.132.899a.13.13 0 0 0 .047-.043.25.25 0 0 0 .042-.15l.006-1.779.065-22.786.01-.006 2.145-.902z" opacity=".9"/><path fill="url(#paint1_linear_6722_31908)" d="m68.599 32.577-.072 24.565c0 .096-.036.163-.093.193h-.001l-.019.007-2.097.885.014-.016a.26.26 0 0 0 .042-.15v-.013a.26.26 0 0 1-.042.15.2.2 0 0 1-.047.043l.033-.014q-.015.016-.033.025c-.055.032-.132.027-.216-.022L37.134 41.833l-11.228-6.364a.66.66 0 0 1-.304-.517l.07-24.553 11.538 6.536 29.237 16.56v-.012l.011-.005 2.143-.903z" opacity=".8"/><path fill="#abc1c6" d="m66.464 30.489-.02 3 2.155-.905.02-3.001z" opacity=".9"/><path fill="#edf1f3" d="M44.849 29.144a.46.46 0 0 1 .211.361c-.002.133-.096.187-.213.12l-5.845-3.312a.46.46 0 0 1-.211-.362c.002-.132.097-.186.213-.12zm6.727-1.334c.117.065.213.229.212.361s-.097.186-.214.12l-12.572-7.125a.46.46 0 0 1-.211-.361c.002-.133.097-.187.213-.12zm0 1.7a.46.46 0 0 1 .212.362c-.002.133-.097.186-.214.12l-12.572-7.125a.46.46 0 0 1-.211-.361c.002-.133.097-.186.213-.12zm0 1.538a.46.46 0 0 1 .212.362c-.002.133-.097.186-.214.12l-12.572-7.125a.46.46 0 0 1-.211-.361c.002-.133.097-.186.213-.12z" opacity=".9"/><path fill="#fff" d="M33.838 18.146a.46.46 0 0 1 .212.361c-.002.133-.097.186-.213.12l-5.845-3.312a.46.46 0 0 1-.212-.362c.002-.133.097-.186.214-.12zm0 1.712a.46.46 0 0 1 .212.361c-.002.133-.097.186-.213.12l-5.845-3.312a.46.46 0 0 1-.212-.362c.002-.133.097-.186.214-.12z" opacity=".9"/><path fill="#c9d7dd" d="m55.337 35.318-.003.874v.008l-.006 2.113-29.24-16.56-9.394-5.324-2.142-1.212.01-2.997 2.148 1.215 4.13 2.34 1.384-1.052.026.014 3.573 2.016.11.063 3.989 2.249.015.032 1.16 2.487.607.346v-.004l-1.08-2.37c-.016-.038-.01-.067.01-.074q.008-.005.021 0 .007.002.013.006l3.083 1.747 1.291 2.586 20.299 11.497z" opacity=".9"/><path fill="#edf1f3" d="m26.082 21.752-.07 24.9-11.232-6.366a.66.66 0 0 1-.304-.517l.07-24.552 11.538 6.535z" opacity=".9"/><path fill="#fff" d="M55.32 38.314 55.252 61.1l-.005 1.778a.25.25 0 0 1-.042.15.2.2 0 0 1-.048.044c-.054.032-.13.026-.215-.022l-28.935-16.4v-.005l.005-2.124.066-22.77h.003l29.237 16.56z" opacity=".9"/><path fill="#6e17ff" d="M55.346 32.879v.315l-.005 2.124L35.042 23.82l-1.291-2.583-3.081-1.748s-.01-.005-.015-.005q-.012-.006-.022 0c-.018.007-.023.037-.007.071l1.08 2.373h-.003l-.606-.346-1.131-2.469-.03-.016-4.003-2.281-.11-.063-3.557-2.027-.016.013-1.408 1.038-4.132-2.34-2.147-1.216.007-2.451c0-.111.048-.183.12-.204q.08-.025.187.034l1.842 1.044 20.01 11.341h.004l18.31 10.38c.17.097.307.328.305.517z" opacity=".9"/><path fill="url(#paint2_linear_6722_31908)" d="M55.346 32.879v.315l-.005 2.124L35.042 23.82l-1.291-2.583-3.081-1.748s-.01-.005-.015-.005q-.012-.006-.022 0c-.018.007-.023.037-.007.071l1.08 2.373h-.003l-.606-.346-1.131-2.469-.03-.016-4.003-2.281-.11-.063-3.557-2.027-.016.013-1.408 1.038-4.132-2.34-2.147-1.216.007-2.451c0-.111.048-.183.12-.204q.08-.025.187.034l1.842 1.044 20.01 11.341h.004l18.31 10.38c.17.097.307.328.305.517z" opacity=".7"/><path fill="#7808ff" d="m22.505 27.777-.058-.03v-.004z" opacity=".9"/><path fill="#fff" d="M15.882 11.283c.217.123.392.42.392.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.002-.244.177-.344.394-.22zm1.104.619c.217.123.392.42.392.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.001-.244.176-.344.393-.22zm1.138.688c.217.123.392.42.392.665s-.177.342-.394.22a.84.84 0 0 1-.39-.664c.002-.243.177-.344.394-.22z" opacity=".9"/><path fill="#7808ff" d="M32.633 21.17c.288.164.52.56.518.884 0 .324-.236.454-.522.292s-.52-.557-.518-.881c0-.325.233-.455.522-.292z" opacity=".9"/><path fill="#fff" d="M51.839 34.023a.58.58 0 0 1 .266.453l-.004 1.178c0 .167-.12.235-.268.15L19.83 17.667a.58.58 0 0 1-.266-.453l.004-1.178c0-.166.12-.234.268-.15z" opacity=".9"/><path fill="#6e17ff" d="M51.111 34.008s.006.006.007.01l.108.436.007.009.35.199s.01.014.004.016l-.283.072v.007l.104.435s-.002.009-.007.007l-.004-.004-.28-.392-.01-.005-.282.072h-.004c-.004-.002-.007-.01-.005-.015l.109-.313v-.011l-.285-.392s-.002-.016.004-.013l.35.2h.007l.11-.316q.002-.002.006-.002z" opacity=".9"/><path fill="#7808ff" d="M54.387 35.73v.083l-1.222-.693v-.084zm0 .382v.086l-1.222-.693v-.086zm0 .386v.084l-1.222-.691v-.086zm0 .384v.085l-1.222-.693v-.084z" opacity=".9"/><g fill="#fff" opacity=".9"><path d="M15.546 13.734a.14.14 0 0 1 .046.045c.031.045.035.1.009.118l-.3.228.959.542c.04.022.07.077.07.122s-.032.063-.07.04l-.947-.538.284.51c.026.047.024.097-.005.111a.06.06 0 0 1-.048-.005.2.2 0 0 1-.052-.057l-.39-.698-.006-.011a.2.2 0 0 1-.017-.049v-.03l.004-.013.007-.01.004-.004.398-.304q.023-.016.054.003" opacity=".9"/><path d="M15.078 14.096s.001.014.005.021l.013.027a.2.2 0 0 1-.017-.048z" opacity=".9"/></g><g fill="#fff" opacity=".9"><path d="M17.772 14.968q.031.017.054.06l.396.753.004.01.007.019.004.018a.1.1 0 0 1 0 .03l-.004.013-.005.01-.008.008-.399.26q-.023.014-.053-.003a.14.14 0 0 1-.047-.048c-.03-.046-.031-.098-.004-.116l.286-.187-.946-.537a.15.15 0 0 1-.072-.121c0-.045.032-.063.072-.04l.955.543-.295-.564c-.025-.049-.02-.097.01-.11q.019-.006.045.008z" opacity=".9"/><path d="m18.231 15.87-.002.003-.003.007z" opacity=".9"/></g><path fill="#7808ff" d="m15.034 24.07.047.073-.036.027-.048-.072z" opacity=".9"/><path fill="#6e17ff" d="M25.947 17.613c.276.156.498.534.497.843-.002.31-.225.435-.5.28L23 17.068c-.275-.155-.498-.533-.496-.843 0-.31.225-.435.5-.28z" opacity=".9"/><path fill="#562ed0" d="m36.728 21.982-20.01-11.34-1.843-1.044q-.108-.059-.186-.034l2.132-.899c.055-.025.128-.02.206.027l40.167 22.763a.66.66 0 0 1 .305.518l-.007 2.439h-.002l-2.15.906.005-2.122v-.317a.65.65 0 0 0-.305-.518L36.73 21.983" opacity=".9"/><path fill="#fdfefe" d="m57.473 37.405-.07 24.565c0 .097-.037.163-.094.193h-.002l-.018.007-2.098.885s.011-.01.015-.016a.26.26 0 0 0 .042-.15v-.013a.26.26 0 0 1-.042.15.2.2 0 0 1-.048.043l.033-.014q-.014.016-.033.025c-.054.032-.13.027-.215-.021L26.008 46.66 14.78 40.297a.66.66 0 0 1-.304-.517l.07-24.553 11.538 6.536 29.237 16.56v-.012l.01-.005 2.144-.903z"/><path fill="#edf1f3" d="m57.473 37.413-.07 24.564c0 .097-.037.163-.094.194h-.002l-.016.007-2.133.899a.13.13 0 0 0 .048-.043.25.25 0 0 0 .042-.15l.005-1.779.066-22.786.01-.006 2.144-.902z" opacity=".9"/><path fill="url(#paint3_linear_6722_31908)" d="m57.473 37.405-.07 24.565c0 .097-.037.163-.094.193h-.002l-.018.007-2.098.885s.011-.01.015-.016a.26.26 0 0 0 .042-.15v-.013a.26.26 0 0 1-.042.15.2.2 0 0 1-.048.043l.033-.014q-.014.016-.033.025c-.054.032-.13.027-.215-.021L26.008 46.66 14.78 40.297a.66.66 0 0 1-.304-.517l.07-24.553 11.538 6.536 29.237 16.56v-.012l.01-.005 2.144-.903z" opacity=".8"/><path fill="#abc1c6" d="m55.34 35.317-.02 3.001 2.153-.906.02-3z" opacity=".9"/><path fill="#edf1f3" d="M33.724 33.972a.46.46 0 0 1 .211.361c-.002.133-.097.187-.213.12l-5.845-3.312a.46.46 0 0 1-.211-.362c.002-.132.096-.186.213-.12zm6.726-1.335c.117.067.214.23.212.362-.002.133-.096.186-.213.12l-12.572-7.125a.46.46 0 0 1-.211-.361c.002-.133.096-.186.213-.12zm0 1.702a.46.46 0 0 1 .212.361c-.002.133-.096.186-.213.12l-12.572-7.124a.46.46 0 0 1-.211-.362c.002-.133.096-.186.213-.12zm0 1.538a.46.46 0 0 1 .212.361c-.002.133-.096.187-.213.12l-12.572-7.124a.46.46 0 0 1-.211-.362c.002-.133.096-.186.213-.12z" opacity=".9"/><path fill="#fff" d="M22.713 22.974a.46.46 0 0 1 .212.361c-.002.133-.097.187-.213.12l-5.845-3.312a.46.46 0 0 1-.212-.362c.002-.132.097-.186.214-.12zm0 1.712a.46.46 0 0 1 .212.361c-.002.133-.097.186-.213.12l-5.845-3.312a.46.46 0 0 1-.212-.362c.002-.132.097-.186.214-.12z" opacity=".9"/><path fill="#c9d7dd" d="m44.274 40.505-.004.874v.01l-.005 2.112-29.242-16.56-9.394-5.324-2.142-1.212.01-2.998 2.148 1.216 4.13 2.34 1.384-1.053.026.015 3.573 2.016.11.063 3.99 2.249.014.032 1.16 2.487.607.345v-.003l-1.08-2.37c-.016-.038-.01-.067.01-.074q.008-.006.021 0 .007.001.013.005l3.083 1.748 1.291 2.585 20.299 11.497z"/><path fill="url(#paint4_linear_6722_31908)" d="m15.019 26.94-.07 24.9-11.232-6.366a.66.66 0 0 1-.305-.518l.072-24.552z"/><path fill="#fff" d="m44.256 43.501-.066 22.787-.005 1.778a.25.25 0 0 1-.042.15.2.2 0 0 1-.047.043c-.055.032-.132.027-.216-.021l-28.936-16.4v-.005l.006-2.124.066-22.77h.003l29.237 16.56z"/><path fill="#6e17ff" d="M44.282 38.066v.315l-.006 2.124-20.299-11.497-1.291-2.584-3.081-1.747s-.01-.006-.015-.006q-.012-.005-.021 0c-.019.007-.024.038-.008.072l1.08 2.372h-.004l-.605-.345L18.9 24.3l-.03-.016-4.003-2.28-.11-.063-3.557-2.027-.016.012-1.408 1.039-4.132-2.34-2.147-1.216.007-2.452c0-.11.048-.182.12-.204.052-.016.118-.005.187.034l1.842 1.044 20.01 11.342h.004l18.31 10.38a.65.65 0 0 1 .305.517z"/><path fill="url(#paint5_linear_6722_31908)" d="M44.282 38.066v.315l-.006 2.124-20.299-11.497-1.291-2.584-3.081-1.747s-.01-.006-.015-.006q-.012-.005-.021 0c-.019.007-.024.038-.008.072l1.08 2.372h-.004l-.605-.345L18.9 24.3l-.03-.016-4.003-2.28-.11-.063-3.557-2.027-.016.012-1.408 1.039-4.132-2.34-2.147-1.216.007-2.452c0-.11.048-.182.12-.204.052-.016.118-.005.187.034l1.842 1.044 20.01 11.342h.004l18.31 10.38a.65.65 0 0 1 .305.517z" opacity=".7"/><path fill="#7808ff" d="m11.442 32.965-.06-.03v-.004z"/><path fill="#fff" d="M4.817 16.47c.217.124.392.42.392.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.002-.243.177-.344.394-.22zm1.103.618c.218.124.393.421.393.666s-.177.342-.394.22a.84.84 0 0 1-.39-.664c.001-.243.176-.343.393-.22zm1.14.688c.218.123.393.42.393.666 0 .245-.177.342-.394.22a.84.84 0 0 1-.39-.664c.001-.244.176-.344.393-.22z"/><path fill="#7808ff" d="M21.57 26.358c.288.163.52.559.518.883s-.236.455-.522.292-.52-.557-.518-.881c0-.324.233-.455.522-.292z"/><path fill="#fff" d="M40.774 39.21a.58.58 0 0 1 .266.453l-.004 1.179c0 .166-.12.234-.268.15L8.764 22.854a.58.58 0 0 1-.266-.453l.004-1.178c0-.167.12-.235.268-.15z"/><path fill="#6e17ff" d="m40.046 39.196.007.009.108.437.007.009.35.198s.01.015.004.017l-.283.071v.007l.104.435s-.002.01-.007.008l-.004-.004-.28-.392-.01-.005-.282.071h-.004q-.007-.005-.006-.014l.11-.314v-.01l-.285-.392s-.002-.017.004-.013l.35.199h.008l.109-.315s.004-.004.005-.002z"/><path fill="#7808ff" d="M43.324 40.917V41l-1.222-.693v-.084zm0 .383v.085l-1.222-.692v-.086zm0 .385v.084l-1.222-.693v-.084zm0 .383v.086l-1.222-.693v-.084z"/><path fill="#fff" d="M4.481 18.922a.14.14 0 0 1 .046.044c.03.045.035.1.009.119l-.3.227.959.543a.15.15 0 0 1 .07.121c0 .045-.032.063-.07.04l-.947-.537.284.51c.026.046.024.097-.005.111a.06.06 0 0 1-.047-.005.2.2 0 0 1-.053-.058l-.39-.698-.006-.01a.14.14 0 0 1-.017-.05v-.03l.004-.012.007-.01.004-.004.398-.305q.022-.015.054.004"/><path fill="#fff" d="M4.013 19.281s.001.015.005.022q.005.013.013.027a.2.2 0 0 1-.017-.049zm2.694.875q.031.017.054.059l.396.754.004.008.007.02.004.018a.1.1 0 0 1 0 .03l-.004.013-.005.01-.007.008-.4.261q-.023.014-.053-.003a.14.14 0 0 1-.047-.049c-.03-.046-.031-.098-.004-.116l.286-.186-.946-.537a.15.15 0 0 1-.071-.122c0-.045.03-.063.07-.04l.956.543-.295-.564c-.025-.048-.02-.097.01-.11q.019-.006.045.008z"/><path fill="#fff" d="m7.168 21.056-.002.003-.003.007z"/><path fill="#7808ff" d="m3.969 29.257.047.073-.036.027-.048-.073z"/><path fill="#6e17ff" d="M14.884 22.8c.276.156.498.534.496.844s-.224.435-.5.279l-2.942-1.667c-.275-.156-.498-.534-.496-.843 0-.31.224-.435.5-.28z"/><path fill="#562ed0" d="m25.663 27.169-20.01-11.34-1.843-1.043q-.108-.059-.186-.034l2.132-.9c.055-.024.128-.019.206.028L46.13 36.643a.66.66 0 0 1 .305.517l-.007 2.439h-.002l-2.15.906.005-2.122v-.317a.65.65 0 0 0-.305-.517L25.665 27.17"/><path fill="#8babb5" d="m46.41 42.6-.07 24.565c0 .097-.038.163-.094.193h-.002l-.016.008-2.133.898a.13.13 0 0 0 .048-.043.25.25 0 0 0 .042-.15l.005-1.778.066-22.787.01-.005 2.144-.902z"/><path fill="url(#paint6_linear_6722_31908)" d="m44.282 68.178-.154.065.015-.017a.26.26 0 0 0 .042-.15v-.012a.26.26 0 0 1-.042.15.2.2 0 0 1-.047.043l.032-.014q-.015.016-.032.025c-.055.032-.132.026-.216-.022L14.944 51.848 3.717 45.484a.66.66 0 0 1-.305-.517l.072-24.552 11.537 6.536 29.237 16.56V43.5l.01-.006.008-.003.01 24.688z" opacity=".8"/><path fill="#95b7bf" d="m44.276 40.505-.02 3.001 2.154-.906.019-3.002z"/><path fill="#edf1f3" d="M22.66 39.156c.117.067.214.23.212.362-.002.133-.097.186-.213.12l-5.845-3.313a.46.46 0 0 1-.212-.361c.002-.133.097-.186.214-.12zm6.728-1.331c.116.066.213.23.211.361 0 .133-.096.187-.213.12l-12.572-7.124a.46.46 0 0 1-.212-.362c.002-.132.097-.186.214-.12zm0 1.701a.46.46 0 0 1 .211.362c0 .132-.096.186-.213.12l-12.572-7.125a.46.46 0 0 1-.212-.362c.002-.132.097-.186.214-.12zm0 1.538c.116.066.213.23.211.362 0 .132-.096.186-.213.12L16.814 34.42a.46.46 0 0 1-.212-.361c.002-.133.097-.187.214-.12z"/><path fill="#fff" d="M11.65 28.161c.117.066.213.23.211.362-.001.132-.096.186-.213.12L5.804 25.33a.46.46 0 0 1-.212-.361c.002-.133.097-.187.214-.12zm0 1.712c.117.066.213.23.211.362-.001.132-.096.186-.213.12l-5.844-3.313a.46.46 0 0 1-.212-.361c.002-.133.097-.187.214-.12z"/></g><defs><linearGradient id="paint0_linear_6722_31908" x1="81.513" x2="16.008" y1="31.764" y2="4.524" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint1_linear_6722_31908" x1="74.078" x2="57.233" y1="36.108" y2="35.008" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".12" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset=".3" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint2_linear_6722_31908" x1="70.388" x2="4.883" y1="36.592" y2="9.352" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint3_linear_6722_31908" x1="62.953" x2="46.108" y1="40.936" y2="39.836" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".12" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset=".3" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint4_linear_6722_31908" x1="-5" x2="57.5" y1="23" y2="72" gradientUnits="userSpaceOnUse"><stop stop-color="#edf1f3"/><stop offset="1" stop-color="#8da5b1"/></linearGradient><linearGradient id="paint5_linear_6722_31908" x1="59.323" x2="-6.182" y1="41.78" y2="14.54" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint6_linear_6722_31908" x1="55.921" x2="2.467" y1="66.486" y2="28.266" gradientUnits="userSpaceOnUse"><stop offset=".13" stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".29" stop-color="#4c7f8e" stop-opacity=".3"/><stop offset=".46" stop-color="#4c7f8e" stop-opacity=".13"/><stop offset=".62" stop-color="#4c7f8e" stop-opacity=".03"/><stop offset=".75" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><clipPath id="clip0_6722_31908"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/argocd.svg b/web/packages/design/src/ResourceIcon/assets/argocd.svg
index b419034be124e..6e7b66749e4b1 100644
--- a/web/packages/design/src/ResourceIcon/assets/argocd.svg
+++ b/web/packages/design/src/ResourceIcon/assets/argocd.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M68.9933 44.2085C65.3189 59.0129 51.9409 69.9856 36 69.9856C20.0257 69.9856 6.62498 58.9669 2.98369 44.1153C2.69617 44.5652 2.19228 44.8636 1.61871 44.8636C0.724719 44.8636 0 44.1389 0 43.2449V30.4247C0 29.5307 0.724719 28.806 1.61871 28.806C2.02696 28.806 2.39991 28.9572 2.68467 29.2065C5.8295 13.6845 19.5502 2 36 2C52.489 2 66.2359 13.7402 69.3376 29.3176C69.6194 29.0797 69.9836 28.9363 70.3813 28.9363C71.2753 28.9363 72 29.661 72 30.555V43.3751C72 44.2691 71.2753 44.9938 70.3813 44.9938C69.7921 44.9938 69.2764 44.679 68.9933 44.2085ZM36 68.6907C54.0585 68.6907 68.6978 54.0513 68.6978 35.9928C68.6978 17.9343 54.0585 3.29496 36 3.29496C17.9415 3.29496 3.30214 17.9343 3.30214 35.9928C3.30214 54.0513 17.9415 68.6907 36 68.6907Z" fill="#B3D1F3"/>
-<circle cx="36" cy="35.9928" r="32.6978" fill="#E3F6FD"/>
-<circle cx="36" cy="35.9921" r="27.1943" fill="#CDEDF7"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M22.7146 12.2685C23.0444 12.8003 22.8807 13.4988 22.3488 13.8286C14.9362 18.426 10.0036 26.6338 10.0036 35.9928C10.0036 41.9046 11.9706 47.3537 15.2864 51.7257C15.6646 52.2243 15.5669 52.9351 15.0683 53.3133C14.5697 53.6914 13.859 53.5938 13.4808 53.0951C9.87656 48.3428 7.7374 42.416 7.7374 35.9928C7.7374 25.8173 13.1033 16.8961 21.1544 11.9027C21.6862 11.5729 22.3847 11.7366 22.7146 12.2685Z" fill="white"/>
-<ellipse cx="25.6468" cy="10.8511" rx="1.61871" ry="1.61871" fill="white"/>
-<path d="M50.8585 66.575C46.3697 68.7599 41.328 69.9857 36 69.9857C30.8639 69.9857 25.9939 68.8467 21.6287 66.8074C20.9355 55.1138 20.45 43.4014 20.45 31.7004C20.45 23.0537 27.7108 15.8564 36.2462 15.8564C44.8267 15.8564 52.0423 23.1745 52.0423 31.7004C52.0423 43.3364 51.6168 54.967 50.8585 66.575Z" fill="#FF733E"/>
-<path d="M35.1015 15.8997C39.2944 18.7953 42.1002 23.6422 42.1002 28.9588C42.1002 30.1824 42.0954 31.406 42.0861 32.6295C42.0795 33.4979 42.0672 34.3547 42.0494 35.2H52.0295C52.038 34.0335 52.0423 32.867 52.0423 31.7004C52.0423 23.1745 44.8267 15.8564 36.2461 15.8564C35.8618 15.8564 35.4801 15.871 35.1015 15.8997Z" fill="#FF6B3C"/>
-<path d="M30.3669 55.2236C30.3669 62.0847 33.2178 64.4059 36.1295 64.4179C39.2151 64.4298 41.8921 62.0847 41.8921 55.3435C37.6951 58.6795 34.8896 58.6795 30.3669 55.2236Z" fill="white"/>
-<path d="M30.3669 55.2236C30.3669 62.0847 33.2178 64.4058 36.1295 64.4178C39.2151 64.4298 41.8921 62.0847 41.8921 55.3435C41.8921 58.207 39.4964 60.9687 36.1295 60.9687C32.7626 60.9686 30.3669 58.207 30.3669 55.2236Z" fill="black"/>
-<path d="M24.8957 49.3047C29.5116 49.3047 33.2536 45.5627 33.2536 40.9468C33.2536 36.3308 29.5116 32.5889 24.8957 32.5889C20.2797 32.5889 16.5378 36.3308 16.5378 40.9468C16.5378 45.5627 20.2797 49.3047 24.8957 49.3047Z" stroke="#FF6042" stroke-width="1.5"/>
-<path d="M47.4281 49.3047C52.044 49.3047 55.786 45.5627 55.786 40.9468C55.786 36.3308 52.044 32.5889 47.4281 32.5889C42.8121 32.5889 39.0702 36.3308 39.0702 40.9468C39.0702 45.5627 42.8121 49.3047 47.4281 49.3047Z" stroke="#FF6042" stroke-width="1.5"/>
-<ellipse cx="24.8957" cy="40.9468" rx="7.60791" ry="7.60792" fill="white"/>
-<ellipse cx="47.4281" cy="40.9468" rx="7.60791" ry="7.60792" fill="white"/>
-<ellipse cx="24.8957" cy="39.6517" rx="2.42806" ry="2.42806" fill="black"/>
-<ellipse cx="29.7194" cy="23.5621" rx="2.26619" ry="2.26619" fill="#FFA978"/>
-<ellipse cx="47.4281" cy="39.6517" rx="2.42806" ry="2.42806" fill="#D9D9D9"/>
-<ellipse cx="47.4281" cy="39.6517" rx="2.42806" ry="2.42806" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#b3d1f3" fill-rule="evenodd" d="M68.993 44.209C65.32 59.013 51.941 69.986 36 69.986c-15.974 0-29.375-11.02-33.016-25.87A1.618 1.618 0 0 1 0 43.244v-12.82a1.619 1.619 0 0 1 2.685-1.219C5.83 13.685 19.55 2 36 2c16.489 0 30.236 11.74 33.338 27.318A1.619 1.619 0 0 1 72 30.555v12.82a1.619 1.619 0 0 1-3.007.834M36 68.69c18.059 0 32.698-14.64 32.698-32.698 0-18.059-14.64-32.698-32.698-32.698S3.302 17.935 3.302 35.993 17.942 68.69 36 68.69" clip-rule="evenodd"/><circle cx="36" cy="35.993" r="32.698" fill="#e3f6fd"/><circle cx="36" cy="35.992" r="27.194" fill="#cdedf7"/><path fill="#fff" fill-rule="evenodd" d="M22.715 12.269c.33.531.166 1.23-.366 1.56-7.413 4.597-12.345 12.805-12.345 22.164 0 5.912 1.967 11.36 5.282 15.733a1.133 1.133 0 0 1-1.805 1.37 28.2 28.2 0 0 1-5.744-17.103c0-10.176 5.366-19.097 13.417-24.09a1.133 1.133 0 0 1 1.56.365" clip-rule="evenodd"/><circle cx="25.647" cy="10.851" r="1.619" fill="#fff"/><path fill="#ff733e" d="M50.859 66.575A33.86 33.86 0 0 1 36 69.985a33.9 33.9 0 0 1-14.371-3.178C20.935 55.114 20.45 43.401 20.45 31.7c0-8.646 7.26-15.844 15.796-15.844 8.58 0 15.796 7.318 15.796 15.844 0 11.636-.425 23.267-1.184 34.875"/><path fill="#ff6b3c" d="M35.102 15.9c4.192 2.895 6.998 7.742 6.998 13.059q0 1.835-.014 3.67-.01 1.303-.037 2.571h9.98q.013-1.75.013-3.5c0-8.526-7.215-15.844-15.796-15.844q-.576 0-1.145.044"/><path fill="#fff" d="M30.367 55.224c0 6.86 2.85 9.182 5.762 9.194 3.086.012 5.763-2.333 5.763-9.075-4.197 3.336-7.002 3.336-11.525-.12"/><path fill="#000" d="M30.367 55.224c0 6.86 2.85 9.182 5.762 9.194 3.086.012 5.763-2.333 5.763-9.075 0 2.864-2.396 5.626-5.763 5.626s-5.762-2.762-5.762-5.745"/><path stroke="#ff6042" stroke-width="1.5" d="M24.896 49.305a8.358 8.358 0 1 0 0-16.716 8.358 8.358 0 0 0 0 16.716Zm22.532 0a8.358 8.358 0 1 0 0-16.716 8.358 8.358 0 0 0 0 16.716Z"/><circle cx="24.896" cy="40.947" r="7.608" fill="#fff"/><circle cx="47.428" cy="40.947" r="7.608" fill="#fff"/><circle cx="24.896" cy="39.652" r="2.428" fill="#000"/><circle cx="29.719" cy="23.562" r="2.266" fill="#ffa978"/><circle cx="47.428" cy="39.652" r="2.428" fill="#d9d9d9"/><circle cx="47.428" cy="39.652" r="2.428" fill="#000"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/asana.svg b/web/packages/design/src/ResourceIcon/assets/asana.svg
index fe065f356cb36..483eeefa01cc0 100644
--- a/web/packages/design/src/ResourceIcon/assets/asana.svg
+++ b/web/packages/design/src/ResourceIcon/assets/asana.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M56.3874 37.9485C52.2467 37.9485 48.2756 39.5934 45.3477 42.5213C42.4198 45.4493 40.7749 49.4204 40.7749 53.5611C40.7749 57.7018 42.4198 61.6729 45.3477 64.6008C48.2756 67.5287 52.2467 69.1736 56.3874 69.1736C60.5281 69.1736 64.4993 67.5287 67.4272 64.6008C70.3551 61.6729 72 57.7018 72 53.5611C72 49.4204 70.3551 45.4493 67.4272 42.5213C64.4993 39.5934 60.5281 37.9485 56.3874 37.9485ZM15.8284 37.9515C13.7602 37.9227 11.707 38.3052 9.78789 39.0768C7.86881 39.8483 6.12219 40.9935 4.64949 42.4458C3.17679 43.8982 2.00738 45.6287 1.2092 47.5368C0.411028 49.445 0 51.4927 0 53.5611C0 55.6294 0.411028 57.6772 1.2092 59.5853C2.00738 61.4935 3.17679 63.224 4.64949 64.6763C6.12219 66.1287 7.86881 67.2739 9.78789 68.0454C11.707 68.8169 13.7602 69.1994 15.8284 69.1706C19.9307 69.1135 23.8455 67.4438 26.7263 64.5226C29.607 61.6015 31.2221 57.6637 31.2221 53.5611C31.2221 49.4584 29.607 45.5207 26.7263 42.5995C23.8455 39.6784 19.9307 38.0087 15.8284 37.9515ZM51.7175 18.4362C51.7175 22.5765 50.0727 26.5473 47.1451 29.4749C44.2174 32.4025 40.2467 34.0473 36.1064 34.0473C31.9661 34.0473 27.9954 32.4025 25.0677 29.4749C22.1401 26.5473 20.4954 22.5765 20.4954 18.4362C20.4954 14.2959 22.1401 10.3252 25.0677 7.39756C27.9954 4.46993 31.9661 2.8252 36.1064 2.8252C40.2467 2.8252 44.2174 4.46993 47.1451 7.39756C50.0727 10.3252 51.7175 14.2959 51.7175 18.4362Z" fill="#F06A6A"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#f06a6a" d="M56.387 37.949a15.613 15.613 0 1 0 0 31.225 15.613 15.613 0 0 0 0-31.226m-40.559.003a15.61 15.61 0 0 0-6.04 30.093 15.612 15.612 0 1 0 6.04-30.093m35.89-19.516a15.611 15.611 0 1 1-31.223 0 15.611 15.611 0 0 1 31.223 0"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/assemble-dark.svg b/web/packages/design/src/ResourceIcon/assets/assemble-dark.svg
index ccb61a129a40f..e0ae3c4626747 100644
--- a/web/packages/design/src/ResourceIcon/assets/assemble-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/assemble-dark.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15935_6797)">
-<path d="M64.9235 19.1928V56.1351L57.9216 60.3082V23.3658L26.1543 3.93318L32.7545 0.000488281L64.9235 19.1928Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M7.07715 15.3853V53.5284L14.3107 57.6366V44.9447L31.6999 55.9353V67.5834L39.0101 72.0006H39.0771V34.6888L7.07715 15.3853ZM14.3107 27.7774L31.6999 38.7776V47.4096L14.3107 36.912V27.7774Z" fill="white"/>
-<path d="M19.8307 7.38525L51.9997 26.5837V63.5188L51.8084 63.6339L44.9977 67.6929V30.7677L13.2305 11.3288L19.8307 7.38525Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15935_6797">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_15935_6797)"><path d="M64.924 19.193v36.942l-7.002 4.173V23.366L26.154 3.933 32.754 0z"/><path fill-rule="evenodd" d="M7.077 15.385v38.143l7.234 4.109V44.945L31.7 55.935v11.648l7.31 4.418h.067V34.689zm7.234 12.392 17.389 11v8.633L14.31 36.912z" clip-rule="evenodd"/><path d="M19.83 7.385 52 26.584v36.935l-.192.115-6.81 4.059V30.768L13.23 11.328z"/></g><defs><clipPath id="clip0_15935_6797"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/assemble-light.svg b/web/packages/design/src/ResourceIcon/assets/assemble-light.svg
index b747f0a1b1103..ac0a6ef920015 100644
--- a/web/packages/design/src/ResourceIcon/assets/assemble-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/assemble-light.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15935_6796)">
-<path d="M7.0752 15.3848V53.528L14.3087 57.6361V44.9442L31.6979 55.9349V67.5827L39.0081 72.0003H39.0752V34.6884L7.0752 15.3848ZM14.3087 27.777L31.6979 38.777V47.4092L14.3087 36.9116V27.777Z" fill="#071447"/>
-<path d="M64.9216 19.1929V56.1351L57.9196 60.3082V23.3659L26.1523 3.93318L32.7525 0.000488281L64.9216 19.1929Z" fill="#0FC4FA"/>
-<path d="M51.9987 26.5836L19.8298 7.38525L13.2295 11.3288L44.9967 30.7677V67.6929L51.8073 63.634L51.9987 63.5185V26.5836Z" fill="#2881FF"/>
-</g>
-<defs>
-<clipPath id="clip0_15935_6796">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15935_6796)"><path fill="#071447" d="M7.075 15.385v38.143l7.234 4.108V44.944l17.389 10.99v11.649L39.008 72h.067V34.688zm7.234 12.392 17.389 11v8.632l-17.39-10.497z"/><path fill="#0fc4fa" d="M64.922 19.193v36.942l-7.002 4.173V23.366L26.152 3.933 32.752 0z"/><path fill="#2881ff" d="M51.999 26.584 19.829 7.385l-6.6 3.944 31.768 19.439v36.925l6.81-4.059.192-.115z"/></g><defs><clipPath id="clip0_15935_6796"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/atlassian.svg b/web/packages/design/src/ResourceIcon/assets/atlassian.svg
index 27966152d56a5..a1ee277bedc3d 100644
--- a/web/packages/design/src/ResourceIcon/assets/atlassian.svg
+++ b/web/packages/design/src/ResourceIcon/assets/atlassian.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6887)">
-<path d="M21.4346 33.1156C20.395 31.868 18.7315 32.0759 17.8997 33.5315L0.224727 68.8815C-0.399096 70.3371 0.640609 72.0006 2.0962 72.0006H26.6331C27.4649 72.0006 28.0887 71.5847 28.5046 70.7529C33.9111 59.7321 30.584 43.0968 21.4346 33.1156Z" fill="url(#paint0_linear_15936_6887)"/>
-<path d="M34.3262 1.09218C24.553 16.6878 25.1768 33.9469 31.623 47.0472C38.0692 60.1474 43.0598 69.9207 43.4756 70.7524C43.8915 71.5842 44.5153 72.0001 45.3471 72.0001H69.8841C71.5477 72.0001 72.3794 70.3366 71.7556 68.881C71.7556 68.881 38.693 2.75571 37.8612 1.09218C37.2374 -0.363409 35.158 -0.363409 34.3262 1.09218Z" fill="#0082FF"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15936_6887" x1="31.0334" y1="38.6373" x2="12.4124" y2="70.8889" gradientUnits="userSpaceOnUse">
-<stop stop-color="#0050D3"/>
-<stop offset="0.923" stop-color="#0082FF"/>
-</linearGradient>
-<clipPath id="clip0_15936_6887">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_6887)"><path fill="url(#paint0_linear_15936_6887)" d="M21.435 33.116c-1.04-1.248-2.703-1.04-3.535.416L.225 68.882C-.4 70.337.64 72 2.096 72h24.537q1.248 0 1.872-1.248c5.406-11.02 2.079-27.656-7.07-37.637"/><path fill="#0082ff" d="M34.326 1.092c-9.773 15.596-9.15 32.855-2.703 45.955 6.446 13.1 11.437 22.874 11.853 23.705Q44.1 72 45.347 72h24.537c1.664 0 2.495-1.663 1.872-3.119L37.86 1.092c-.624-1.455-2.703-1.455-3.535 0"/></g><defs><linearGradient id="paint0_linear_15936_6887" x1="31.033" x2="12.412" y1="38.637" y2="70.889" gradientUnits="userSpaceOnUse"><stop stop-color="#0050d3"/><stop offset=".923" stop-color="#0082ff"/></linearGradient><clipPath id="clip0_15936_6887"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/atlassianbitbucket.svg b/web/packages/design/src/ResourceIcon/assets/atlassianbitbucket.svg
index 42a7786b56c3a..6f1798682f0f0 100644
--- a/web/packages/design/src/ResourceIcon/assets/atlassianbitbucket.svg
+++ b/web/packages/design/src/ResourceIcon/assets/atlassianbitbucket.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M2.3359 4.00068C1.99934 3.99634 1.66591 4.06572 1.35902 4.20396C1.05213 4.34219 0.779221 4.54593 0.55945 4.80086C0.33968 5.0558 0.178378 5.35575 0.0868678 5.67965C-0.00464189 6.00356 -0.0241404 6.34357 0.0297414 6.67582L9.81937 66.1054C9.94134 66.8327 10.3157 67.4937 10.8766 67.9724C11.4375 68.4511 12.1492 68.7168 12.8866 68.7229H59.8514C60.4042 68.73 60.9411 68.5384 61.3644 68.1828C61.7877 67.8272 62.0692 67.3314 62.1576 66.7858L71.9703 6.69888C72.0241 6.36664 72.0046 6.02662 71.9131 5.70272C71.8216 5.37881 71.6603 5.07886 71.4406 4.82393C71.2208 4.56899 70.9479 4.36526 70.641 4.22702C70.3341 4.08879 70.0007 4.0194 69.6641 4.02374L2.3359 4.00068ZM43.5584 46.9528H28.5684L24.5096 25.7593H47.1906L43.5584 46.9528Z" fill="#2684FF"/>
-<path d="M68.8334 25.7598H47.1901L43.5579 46.9533H28.5679L10.8682 67.9739C11.4292 68.459 12.1444 68.7288 12.886 68.735H59.8624C60.4152 68.7421 60.9521 68.5504 61.3754 68.1948C61.7987 67.8393 62.0802 67.3435 62.1686 66.7978L68.8334 25.7598Z" fill="url(#paint0_linear_16885_15603)"/>
-<defs>
-<linearGradient id="paint0_linear_16885_15603" x1="73.8377" y1="31.6866" x2="38.0693" y2="59.6141" gradientUnits="userSpaceOnUse">
-<stop offset="0.18" stop-color="#0052CC"/>
-<stop offset="1" stop-color="#2684FF"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#2684ff" d="M2.336 4A2.306 2.306 0 0 0 .03 6.677l9.79 59.43a3.14 3.14 0 0 0 3.067 2.617H59.85a2.306 2.306 0 0 0 2.307-1.937L71.97 6.699a2.308 2.308 0 0 0-2.306-2.675zm41.222 42.953h-14.99L24.51 25.759h22.68z"/><path fill="url(#paint0_linear_16885_15603)" d="M68.833 25.76H47.19l-3.632 21.193h-14.99l-17.7 21.02a3.13 3.13 0 0 0 2.018.762h46.976a2.306 2.306 0 0 0 2.307-1.937z"/><defs><linearGradient id="paint0_linear_16885_15603" x1="73.838" x2="38.069" y1="31.687" y2="59.614" gradientUnits="userSpaceOnUse"><stop offset=".18" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/atlassianjiraservicemanagement.svg b/web/packages/design/src/ResourceIcon/assets/atlassianjiraservicemanagement.svg
index d1351dcc222ca..f923a09a20511 100644
--- a/web/packages/design/src/ResourceIcon/assets/atlassianjiraservicemanagement.svg
+++ b/web/packages/design/src/ResourceIcon/assets/atlassianjiraservicemanagement.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6913)">
-<path d="M41.4841 28.436L61.0707 28.5561C63.5799 28.5723 65.0012 31.4382 63.4957 33.4456L34.589 72.0003C25.5019 65.2092 23.6397 52.3367 30.4308 43.2496L41.4841 28.436Z" fill="url(#paint0_linear_15936_6913)"/>
-<path d="M30.4149 43.2493L10.9413 43.1293C8.43388 43.1131 7.01256 40.2526 8.51274 38.2452L37.1435 0.000488281C46.2306 6.79162 48.0926 19.6641 41.3017 28.7512L30.4149 43.2493Z" fill="#1D7AFC"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15936_6913" x1="40.7086" y1="31.3301" x2="48.9434" y2="56.2248" gradientUnits="userSpaceOnUse">
-<stop stop-color="#0055CC"/>
-<stop offset="1" stop-color="#1D7AFC"/>
-</linearGradient>
-<clipPath id="clip0_15936_6913">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_6913)"><path fill="url(#paint0_linear_15936_6913)" d="m41.484 28.436 19.587.12c2.509.016 3.93 2.882 2.425 4.89L34.589 72c-9.087-6.79-10.95-19.663-4.158-28.75z"/><path fill="#1d7afc" d="m30.415 43.25-19.474-.12c-2.507-.017-3.928-2.877-2.428-4.885L37.143 0c9.088 6.792 10.95 19.664 4.159 28.751z"/></g><defs><linearGradient id="paint0_linear_15936_6913" x1="40.709" x2="48.943" y1="31.33" y2="56.225" gradientUnits="userSpaceOnUse"><stop stop-color="#05c"/><stop offset="1" stop-color="#1d7afc"/></linearGradient><clipPath id="clip0_15936_6913"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/atlassianstatuspage.svg b/web/packages/design/src/ResourceIcon/assets/atlassianstatuspage.svg
index c0c57a6fef450..57b905c7541b6 100644
--- a/web/packages/design/src/ResourceIcon/assets/atlassianstatuspage.svg
+++ b/web/packages/design/src/ResourceIcon/assets/atlassianstatuspage.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M35.9984 62.0344C45.3345 62.0344 52.903 54.6128 52.903 45.4579C52.903 36.3026 45.3345 28.8813 35.9984 28.8813C26.6622 28.8813 19.0938 36.3026 19.0938 45.4579C19.0938 54.6128 26.6622 62.0344 35.9984 62.0344Z" fill="url(#paint0_linear_15936_6932)"/>
-<path d="M0.452185 26.3239L9.53233 36.8382C10.2085 37.6909 11.4643 37.7856 12.2371 37.0276C26.9199 24.1453 45.0802 24.1453 59.763 37.0276C60.5356 37.6909 61.7914 37.5962 62.4676 36.8382L71.5478 26.3239C72.224 25.5661 72.1275 24.3347 71.3545 23.6717C50.1031 5.39004 21.8968 5.39004 0.645379 23.6717C-0.1274 24.3347 -0.223997 25.5661 0.452185 26.3239Z" fill="#2684FF"/>
-<defs>
-<linearGradient id="paint0_linear_15936_6932" x1="36.0055" y1="56.3207" x2="36.0055" y2="27.0019" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2684FF"/>
-<stop offset="0.824" stop-color="#0052CC"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_15936_6932)" d="M35.998 62.034c9.337 0 16.905-7.421 16.905-16.576S45.335 28.88 35.998 28.88c-9.336 0-16.904 7.422-16.904 16.577s7.568 16.576 16.904 16.576"/><path fill="#2684ff" d="m.452 26.324 9.08 10.514c.677.853 1.932.948 2.705.19 14.683-12.883 32.843-12.883 47.526 0 .773.663 2.028.568 2.705-.19l9.08-10.514c.676-.758.58-1.99-.194-2.652C50.105 5.39 21.898 5.39.645 23.672c-.772.663-.869 1.894-.193 2.652"/><defs><linearGradient id="paint0_linear_15936_6932" x1="36.005" x2="36.005" y1="56.321" y2="27.002" gradientUnits="userSpaceOnUse"><stop stop-color="#2684ff"/><stop offset=".824" stop-color="#0052cc"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/auth0-dark.svg b/web/packages/design/src/ResourceIcon/assets/auth0-dark.svg
index 37e34ce2c576c..75a732a80764c 100644
--- a/web/packages/design/src/ResourceIcon/assets/auth0-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/auth0-dark.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M10.1525 31.2569C21.9575 29.3124 31.2036 19.5532 33.148 7.75537L33.7988 2.08057C33.9578 1.17694 33.3505 -0.0736913 32.2082 0.0130697C23.2877 0.707045 14.8803 3.64927 10.1886 5.56497C7.86811 6.51198 6.35001 8.77467 6.35001 11.2831V29.7894C6.35001 30.8884 7.33316 31.7197 8.41751 31.546L10.1525 31.2641V31.2569Z" fill="white"/>
-<path d="M38.8398 7.75377C40.7845 19.5588 50.0305 29.3109 61.8355 31.2553L63.5705 31.5373C64.6548 31.7179 65.6378 30.8794 65.6378 29.7807V11.2743C65.6378 8.76583 64.1197 6.51036 61.7993 5.55615C57.1149 3.64045 48.7003 0.698231 39.7796 0.00423303C38.6375 -0.0825055 38.0446 1.18257 38.1821 2.07174L38.8326 7.74653L38.8398 7.75377Z" fill="white"/>
-<path d="M61.8281 36.4334C45.7001 39.6142 38.2109 50.3349 38.2109 70.634C38.2109 71.6533 39.2229 72.3546 40.0687 71.7907C47.4857 66.7883 63.8087 53.7325 65.4931 37.3948C65.5584 35.3347 62.9848 36.3033 61.8281 36.4334Z" fill="white"/>
-<path d="M10.157 36.4422C26.285 39.623 33.7742 50.3437 33.7742 70.6428C33.7742 71.6621 32.7622 72.3634 31.9164 71.7995C24.4994 66.797 8.17621 53.7413 6.49184 37.4036C6.42678 35.3435 9.00031 36.3121 10.157 36.4422Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M10.153 31.257c11.805-1.945 21.05-11.704 22.995-23.502l.65-5.674c.16-.904-.448-2.155-1.59-2.068-8.92.694-17.328 3.636-22.02 5.552a6.18 6.18 0 0 0-3.838 5.718V29.79a1.78 1.78 0 0 0 2.068 1.757l1.735-.282zM38.84 7.754c1.944 11.805 11.19 21.557 22.996 23.501l1.735.282a1.777 1.777 0 0 0 2.067-1.756V11.274a6.185 6.185 0 0 0-3.839-5.718C57.115 3.64 48.7.698 39.78.004c-1.142-.087-1.734 1.179-1.597 2.068l.65 5.675zm22.988 28.679C45.7 39.614 38.211 50.335 38.211 70.634c0 1.02 1.012 1.72 1.858 1.157 7.417-5.003 23.74-18.058 25.424-34.396.065-2.06-2.508-1.092-3.665-.962m-51.671.009c16.128 3.181 23.617 13.902 23.617 34.2 0 1.02-1.012 1.721-1.858 1.157C24.5 66.798 8.176 53.741 6.492 37.404c-.065-2.06 2.508-1.092 3.665-.962"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/auth0-light.svg b/web/packages/design/src/ResourceIcon/assets/auth0-light.svg
index e8b28497c7ca7..dba59f8bcadd1 100644
--- a/web/packages/design/src/ResourceIcon/assets/auth0-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/auth0-light.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M10.1525 31.2569C21.9575 29.3124 31.2036 19.5532 33.148 7.75537L33.7988 2.08057C33.9578 1.17694 33.3505 -0.0736913 32.2082 0.0130697C23.2877 0.707045 14.8803 3.64927 10.1886 5.56497C7.86811 6.51198 6.35001 8.77467 6.35001 11.2831V29.7894C6.35001 30.8884 7.33316 31.7197 8.41751 31.546L10.1525 31.2641V31.2569Z" fill="black"/>
-<path d="M38.8398 7.75377C40.7845 19.5588 50.0305 29.3109 61.8355 31.2553L63.5705 31.5373C64.6548 31.7179 65.6378 30.8794 65.6378 29.7807V11.2743C65.6378 8.76583 64.1197 6.51036 61.7993 5.55615C57.1149 3.64045 48.7003 0.698231 39.7796 0.00423303C38.6375 -0.0825055 38.0446 1.18257 38.1821 2.07174L38.8326 7.74653L38.8398 7.75377Z" fill="black"/>
-<path d="M61.8281 36.4334C45.7001 39.6142 38.2109 50.3349 38.2109 70.634C38.2109 71.6533 39.2229 72.3546 40.0687 71.7907C47.4857 66.7883 63.8087 53.7325 65.4931 37.3948C65.5584 35.3347 62.9848 36.3033 61.8281 36.4334Z" fill="black"/>
-<path d="M10.157 36.4422C26.285 39.623 33.7742 50.3437 33.7742 70.6428C33.7742 71.6621 32.7622 72.3634 31.9164 71.7995C24.4994 66.797 8.17621 53.7413 6.49184 37.4036C6.42678 35.3435 9.00031 36.3121 10.157 36.4422Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M10.153 31.257c11.805-1.945 21.05-11.704 22.995-23.502l.65-5.674c.16-.904-.448-2.155-1.59-2.068-8.92.694-17.328 3.636-22.02 5.552a6.18 6.18 0 0 0-3.838 5.718V29.79a1.78 1.78 0 0 0 2.068 1.757l1.735-.282zM38.84 7.754c1.944 11.805 11.19 21.557 22.996 23.501l1.735.282a1.777 1.777 0 0 0 2.067-1.756V11.274a6.185 6.185 0 0 0-3.839-5.718C57.115 3.64 48.7.698 39.78.004c-1.142-.087-1.734 1.179-1.597 2.068l.65 5.675zm22.988 28.679C45.7 39.614 38.211 50.335 38.211 70.634c0 1.02 1.012 1.72 1.858 1.157 7.417-5.003 23.74-18.058 25.424-34.396.065-2.06-2.508-1.092-3.665-.962m-51.671.009c16.128 3.181 23.617 13.902 23.617 34.2 0 1.02-1.012 1.721-1.858 1.157C24.5 66.798 8.176 53.741 6.492 37.404c-.065-2.06 2.508-1.092 3.665-.962"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/avalara.svg b/web/packages/design/src/ResourceIcon/assets/avalara.svg
index a554db1080c88..ae447d8ea4809 100644
--- a/web/packages/design/src/ResourceIcon/assets/avalara.svg
+++ b/web/packages/design/src/ResourceIcon/assets/avalara.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6938)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M59.0799 72.0004H71.6292L60.5595 45.5112C57.5588 48.7035 54.7374 52.0599 52.1084 55.5646L59.0799 72.0004Z" fill="#FF6600"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M30.1318 47.6379L27.0586 54.8905C31.4787 61.4729 34.4002 67.14 36.0074 69.8535C39.1382 64.5468 46.782 48.7863 62.6226 34.0422L60.8757 29.9229C50.591 37.5179 41.8341 47.2326 36.0242 54.6409C36.0185 54.6519 32.3079 50.095 30.1318 47.6379Z" fill="#059BD2"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.5398 0.000488281H30.4612L0.370117 72H12.918L34.6744 20.6874L35.7081 17.9024H36.2915L37.3223 20.6874L43.7685 35.896C46.7173 32.9567 49.8155 30.171 53.0504 27.5502L41.5398 0.000488281Z" fill="#FF6600"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_6938">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_15936_6938)" clip-rule="evenodd"><path fill="#f60" d="M59.08 72h12.55L60.56 45.511a118 118 0 0 0-8.452 10.054z"/><path fill="#059bd2" d="m30.132 47.638-3.073 7.253c4.42 6.582 7.341 12.249 8.948 14.962 3.131-5.306 10.775-21.067 26.616-35.81l-1.747-4.12C50.59 37.518 41.834 47.233 36.024 54.64c-.005.01-3.716-4.546-5.892-7.003"/><path fill="#f60" d="M41.54 0H30.46L.371 72h12.547l21.756-51.313 1.034-2.785h.584l1.03 2.785 6.447 15.209a121 121 0 0 1 9.281-8.346z"/></g><defs><clipPath id="clip0_15936_6938"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/aws-account.svg b/web/packages/design/src/ResourceIcon/assets/aws-account.svg
index 7495e38130bd0..6c7f2bf41da43 100644
--- a/web/packages/design/src/ResourceIcon/assets/aws-account.svg
+++ b/web/packages/design/src/ResourceIcon/assets/aws-account.svg
@@ -1,6 +1 @@
-<svg width="2048px" height="2048px" viewBox="0 0 2048 2048" fill="none" xmlns="http://www.w3.org/2000/svg">
-  <path fill="#F7A80D" d="M957.8 1775L294.42 1537L283.79 1533.2L283.79 1522L283.79 549.69L283.79 527.37L304.92 534.57L968.3 760.61L979.17 764.31L979.17 775.73L979.17 1760L979.17 1782.7z" />
-  <path fill="#F7A80D" d="M1753.6 1537L1090.2 1775L1068.8 1782.7L1068.8 1760L1068.8 775.73L1068.8 764.31L1079.7 760.61L1743.1 534.57L1764.2 527.37L1764.2 549.69L1764.2 1522L1764.2 1533.2z" />
-  <path fill="#F7A80D" d="M363.66 461.6L1035 272.63L1044.2 272.81L1666.8 473.53L1667 503.84L1044.5 715.19L1034.4 715.19L362.97 492.1z" />
-  <path fill="none" d="M0 0h2048v2048H0Z" />
-</svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="2048" height="2048" fill="none" viewBox="0 0 2048 2048"><path fill="#f7a80d" d="m957.8 1775-663.38-238-10.63-3.8V527.37l21.13 7.2L968.3 760.61l10.87 3.7V1782.7zm795.8-238-663.4 238-21.4 7.7V764.31l10.9-3.7 663.4-226.04 21.1-7.2V1533.2zM363.66 461.6 1035 272.63l9.2.18 622.6 200.72.2 30.31-622.5 211.35h-10.1L362.97 492.1z"/><path d="M0 0h2048v2048H0Z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/aws-dark.svg b/web/packages/design/src/ResourceIcon/assets/aws-dark.svg
index 293635d0851c6..45e1ae81d7c76 100644
--- a/web/packages/design/src/ResourceIcon/assets/aws-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/aws-dark.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M20.2899 30.0369C20.2899 30.923 20.3856 31.6414 20.5533 32.1682C20.7448 32.695 20.9843 33.2697 21.3196 33.8923C21.4393 34.0839 21.4872 34.2755 21.4872 34.4431C21.4872 34.6826 21.3435 34.922 21.0322 35.1615L19.5236 36.1672C19.3081 36.3109 19.0925 36.3828 18.901 36.3828C18.6615 36.3828 18.422 36.263 18.1826 36.0475C17.8473 35.6883 17.56 35.3052 17.3205 34.922C17.081 34.5149 16.8416 34.06 16.5782 33.5092C14.7103 35.7123 12.3636 36.8138 9.53789 36.8138C7.52639 36.8138 5.92198 36.2391 4.7486 35.0896C3.57522 33.9402 2.97656 32.4076 2.97656 30.4919C2.97656 28.4565 3.69496 26.8042 5.15569 25.559C6.61643 24.3137 8.55609 23.6911 11.0226 23.6911C11.8368 23.6911 12.6749 23.763 13.5609 23.8827C14.4469 24.0024 15.3569 24.194 16.3147 24.4095V22.6614C16.3147 20.8415 15.9316 19.5723 15.1893 18.83C14.423 18.0877 13.1299 17.7285 11.286 17.7285C10.4479 17.7285 9.58579 17.8242 8.69977 18.0398C7.81375 18.2553 6.95168 18.5187 6.11355 18.8539C5.73041 19.0216 5.44305 19.1174 5.27542 19.1652C5.1078 19.2131 4.98807 19.2371 4.89228 19.2371C4.55703 19.2371 4.3894 18.9976 4.3894 18.4947V17.3214C4.3894 16.9382 4.4373 16.6509 4.55703 16.4832C4.67676 16.3156 4.89228 16.148 5.22753 15.9804C6.06566 15.5493 7.07141 15.1901 8.24478 14.9028C9.41816 14.5915 10.6634 14.4478 11.9804 14.4478C14.8301 14.4478 16.9134 15.0943 18.2544 16.3875C19.5715 17.6806 20.242 19.6442 20.242 22.2783V30.0369H20.2899ZM10.5676 33.6768C11.3578 33.6768 12.172 33.5331 13.0341 33.2458C13.8962 32.9584 14.6624 32.4316 15.309 31.7132C15.6921 31.2582 15.9795 30.7553 16.1232 30.1806C16.2669 29.6059 16.3626 28.9115 16.3626 28.0973V27.0915C15.6682 26.9239 14.9258 26.7802 14.1596 26.6844C13.3933 26.5887 12.6509 26.5408 11.9086 26.5408C10.3042 26.5408 9.1308 26.8521 8.34057 27.4986C7.55034 28.1452 7.16719 29.0551 7.16719 30.2525C7.16719 31.3779 7.45455 32.2161 8.05321 32.7908C8.62793 33.3895 9.46605 33.6768 10.5676 33.6768ZM29.7966 36.263C29.3656 36.263 29.0782 36.1912 28.8866 36.0236C28.6951 35.8799 28.5274 35.5446 28.3838 35.0896L22.7563 16.579C22.6127 16.1001 22.5408 15.7888 22.5408 15.6212C22.5408 15.238 22.7324 15.0225 23.1155 15.0225H25.4623C25.9173 15.0225 26.2286 15.0943 26.3962 15.262C26.5878 15.4057 26.7315 15.7409 26.8751 16.1959L30.8981 32.0484L34.6338 16.1959C34.7535 15.717 34.8972 15.4057 35.0888 15.262C35.2803 15.1183 35.6156 15.0225 36.0466 15.0225H37.9623C38.4173 15.0225 38.7286 15.0943 38.9202 15.262C39.1118 15.4057 39.2794 15.7409 39.3752 16.1959L43.1587 32.24L47.3015 16.1959C47.4451 15.717 47.6128 15.4057 47.7804 15.262C47.972 15.1183 48.2833 15.0225 48.7143 15.0225H50.9413C51.3245 15.0225 51.54 15.2141 51.54 15.6212C51.54 15.7409 51.516 15.8606 51.4921 16.0043C51.4682 16.148 51.4203 16.3396 51.3245 16.603L45.5534 35.1136C45.4097 35.5925 45.2421 35.9038 45.0505 36.0475C44.8589 36.1912 44.5476 36.287 44.1405 36.287H42.0811C41.6262 36.287 41.3148 36.2151 41.1233 36.0475C40.9317 35.8799 40.7641 35.5686 40.6683 35.0896L36.9566 19.6442L33.2688 35.0657C33.1491 35.5446 33.0054 35.8559 32.8139 36.0236C32.6223 36.1912 32.287 36.263 31.856 36.263H29.7966ZM60.5678 36.9096C59.3226 36.9096 58.0774 36.7659 56.8801 36.4785C55.6827 36.1912 54.7488 35.8799 54.1262 35.5207C53.7431 35.3052 53.4797 35.0657 53.3839 34.8502C53.2881 34.6347 53.2402 34.3952 53.2402 34.1797V32.9584C53.2402 32.4555 53.4318 32.2161 53.791 32.2161C53.9346 32.2161 54.0783 32.24 54.222 32.2879C54.3657 32.3358 54.5812 32.4316 54.8207 32.5274C55.6348 32.8866 56.5209 33.1739 57.4548 33.3655C58.4126 33.5571 59.3465 33.6529 60.3044 33.6529C61.813 33.6529 62.9864 33.3895 63.8006 32.8626C64.6148 32.3358 65.0458 31.5695 65.0458 30.5877C65.0458 29.9172 64.8303 29.3664 64.3992 28.9115C63.9682 28.4565 63.154 28.0494 61.9807 27.6662L58.5084 26.5887C56.7603 26.0379 55.4672 25.2237 54.677 24.1461C53.8867 23.0925 53.4797 21.9191 53.4797 20.6739C53.4797 19.6681 53.6952 18.7821 54.1262 18.0158C54.5572 17.2495 55.132 16.579 55.8504 16.0522C56.5687 15.5014 57.3829 15.0943 58.3408 14.807C59.2986 14.5196 60.3044 14.3999 61.358 14.3999C61.8849 14.3999 62.4356 14.4238 62.9625 14.4957C63.5132 14.5675 64.0161 14.6633 64.519 14.7591C64.9979 14.8788 65.4529 14.9986 65.8839 15.1422C66.315 15.2859 66.6502 15.4296 66.8897 15.5733C67.2249 15.7649 67.4644 15.9564 67.6081 16.1719C67.7517 16.3635 67.8236 16.6269 67.8236 16.9622V18.0877C67.8236 18.5905 67.632 18.8539 67.2728 18.8539C67.0813 18.8539 66.7699 18.7582 66.3629 18.5666C64.9979 17.944 63.4653 17.6327 61.7651 17.6327C60.4002 17.6327 59.3226 17.8482 58.5803 18.3032C57.8379 18.7582 57.4548 19.4526 57.4548 20.4344C57.4548 21.1049 57.6942 21.6796 58.1732 22.1346C58.6521 22.5896 59.5381 23.0446 60.8073 23.4517L64.2077 24.5293C65.9318 25.08 67.177 25.8463 67.9194 26.8281C68.6617 27.8099 69.0209 28.9354 69.0209 30.1806C69.0209 31.2103 68.8054 32.1442 68.3983 32.9584C67.9673 33.7726 67.3926 34.491 66.6502 35.0657C65.9079 35.6644 65.0219 36.0954 63.9922 36.4067C62.9146 36.742 61.7891 36.9096 60.5678 36.9096Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M65.0942 48.5475C57.2158 54.3665 45.7694 57.4556 35.9274 57.4556C22.1342 57.4556 9.70599 52.355 0.318971 43.878C-0.423369 43.2075 0.247132 42.2975 1.13315 42.8243C11.2865 48.7152 23.8105 52.2832 36.7655 52.2832C45.5059 52.2832 55.1085 50.4633 63.9447 46.7276C65.2618 46.1289 66.3873 47.5897 65.0942 48.5475Z" fill="#FF9900"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M68.375 44.8121C67.3693 43.519 61.7179 44.1895 59.1556 44.5008C58.3893 44.5965 58.2696 43.926 58.964 43.4232C63.466 40.2622 70.8654 41.1722 71.7275 42.2258C72.5896 43.3034 71.488 50.7029 67.2735 54.247C66.6269 54.7977 66.0043 54.5104 66.2917 53.792C67.2495 51.4213 69.3808 46.0812 68.375 44.8121Z" fill="#FF9900"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M20.29 30.037c0 .886.096 1.604.263 2.131.192.527.431 1.102.767 1.724.12.192.167.383.167.551 0 .24-.143.479-.455.718l-1.508 1.006c-.216.144-.431.216-.623.216-.24 0-.479-.12-.718-.336a7.4 7.4 0 0 1-.863-1.125 19 19 0 0 1-.742-1.413q-2.802 3.305-7.04 3.305c-2.012 0-3.616-.575-4.79-1.724s-1.771-2.682-1.771-4.598c0-2.036.718-3.688 2.179-4.933s3.4-1.868 5.867-1.868c.814 0 1.652.072 2.538.192s1.796.311 2.754.527v-1.75c0-1.82-.383-3.089-1.126-3.831-.766-.742-2.06-1.101-3.903-1.101-.838 0-1.7.095-2.586.31a19 19 0 0 0-2.586.815c-.384.168-.67.263-.839.311a1.5 1.5 0 0 1-.383.072c-.335 0-.503-.24-.503-.742V17.32c0-.383.048-.67.168-.838s.335-.335.67-.503q1.258-.646 3.018-1.077c1.173-.312 2.418-.455 3.735-.455 2.85 0 4.933.646 6.274 1.94 1.317 1.293 1.988 3.256 1.988 5.89v7.759zm-9.722 3.64c.79 0 1.604-.144 2.466-.431s1.628-.814 2.275-1.533c.383-.455.67-.958.814-1.532s.24-1.27.24-2.084v-1.006a20 20 0 0 0-2.203-.407 18 18 0 0 0-2.251-.143c-1.605 0-2.778.311-3.568.958-.79.646-1.174 1.556-1.174 2.754 0 1.125.288 1.963.886 2.538.575.599 1.413.886 2.515.886m19.229 2.586c-.431 0-.719-.072-.91-.24-.192-.143-.36-.478-.503-.933l-5.628-18.511c-.143-.479-.215-.79-.215-.958 0-.383.191-.598.575-.598h2.346c.455 0 .767.071.934.239.192.144.335.479.48.934l4.022 15.852 3.736-15.852c.12-.479.263-.79.455-.934.191-.144.527-.24.958-.24h1.915c.455 0 .767.072.958.24.192.144.36.479.455.934L43.16 32.24l4.14-16.044c.144-.479.312-.79.48-.934.191-.144.502-.24.933-.24h2.227c.383 0 .599.192.599.6 0 .119-.024.239-.048.382a3.4 3.4 0 0 1-.167.599l-5.772 18.51q-.214.719-.502.934c-.192.144-.503.24-.91.24h-2.06c-.455 0-.766-.072-.958-.24s-.359-.478-.455-.957l-3.711-15.446-3.688 15.422c-.12.479-.264.79-.455.958-.192.167-.527.239-.958.239zm30.77.647c-1.244 0-2.49-.144-3.687-.431s-2.131-.6-2.754-.958c-.383-.216-.646-.455-.742-.67a1.7 1.7 0 0 1-.144-.671v-1.222c0-.502.192-.742.551-.742q.215 0 .431.072c.144.048.36.144.599.24.814.359 1.7.646 2.634.837.958.192 1.892.288 2.85.288 1.508 0 2.681-.264 3.496-.79.814-.527 1.245-1.293 1.245-2.275 0-.67-.216-1.222-.647-1.677-.43-.455-1.245-.862-2.418-1.245l-3.473-1.077c-1.748-.551-3.04-1.365-3.831-2.443-.79-1.053-1.197-2.227-1.197-3.472q0-1.509.646-2.658a6.2 6.2 0 0 1 1.724-1.964c.719-.55 1.533-.958 2.49-1.245.959-.287 1.964-.407 3.018-.407.527 0 1.078.024 1.605.096.55.072 1.053.167 1.556.263.479.12.934.24 1.365.383q.646.216 1.006.431c.335.192.574.383.718.599q.216.287.216.79v1.126c0 .502-.192.766-.551.766-.192 0-.503-.096-.91-.287q-2.048-.934-4.598-.934c-1.365 0-2.442.215-3.185.67s-1.125 1.15-1.125 2.131c0 .67.24 1.246.718 1.7.48.456 1.365.91 2.634 1.318l3.4 1.077c1.725.551 2.97 1.317 3.712 2.3.743.98 1.102 2.106 1.102 3.352 0 1.03-.216 1.963-.623 2.777a6.4 6.4 0 0 1-1.748 2.108c-.742.598-1.628 1.03-2.658 1.34a11.4 11.4 0 0 1-3.424.504"/><path fill="#f90" fill-rule="evenodd" d="M65.094 48.548c-7.878 5.819-19.325 8.908-29.167 8.908-13.793 0-26.221-5.101-35.608-13.578-.742-.67-.072-1.58.814-1.054 10.154 5.891 22.678 9.46 35.633 9.46 8.74 0 18.343-1.82 27.179-5.556 1.317-.6 2.442.862 1.15 1.82" clip-rule="evenodd"/><path fill="#f90" fill-rule="evenodd" d="M68.375 44.812c-1.006-1.293-6.657-.622-9.22-.311-.766.096-.885-.575-.191-1.078 4.502-3.16 11.901-2.25 12.764-1.197.862 1.077-.24 8.477-4.454 12.021-.647.55-1.27.263-.982-.455.957-2.37 3.089-7.71 2.083-8.98" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/aws-light.svg b/web/packages/design/src/ResourceIcon/assets/aws-light.svg
index 46fa69e02369c..8f9c690dea8ca 100644
--- a/web/packages/design/src/ResourceIcon/assets/aws-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/aws-light.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M20.2899 30.0369C20.2899 30.923 20.3856 31.6414 20.5533 32.1682C20.7448 32.695 20.9843 33.2697 21.3196 33.8923C21.4393 34.0839 21.4872 34.2755 21.4872 34.4431C21.4872 34.6826 21.3435 34.922 21.0322 35.1615L19.5236 36.1672C19.3081 36.3109 19.0925 36.3828 18.901 36.3828C18.6615 36.3828 18.422 36.263 18.1826 36.0475C17.8473 35.6883 17.56 35.3052 17.3205 34.922C17.081 34.5149 16.8416 34.06 16.5782 33.5092C14.7103 35.7123 12.3636 36.8138 9.53789 36.8138C7.52639 36.8138 5.92198 36.2391 4.7486 35.0896C3.57522 33.9402 2.97656 32.4076 2.97656 30.4919C2.97656 28.4565 3.69496 26.8042 5.15569 25.559C6.61643 24.3137 8.55609 23.6911 11.0226 23.6911C11.8368 23.6911 12.6749 23.763 13.5609 23.8827C14.4469 24.0024 15.3569 24.194 16.3147 24.4095V22.6614C16.3147 20.8415 15.9316 19.5723 15.1893 18.83C14.423 18.0877 13.1299 17.7285 11.286 17.7285C10.4479 17.7285 9.58579 17.8242 8.69977 18.0398C7.81375 18.2553 6.95168 18.5187 6.11355 18.8539C5.73041 19.0216 5.44305 19.1174 5.27542 19.1652C5.1078 19.2131 4.98807 19.2371 4.89228 19.2371C4.55703 19.2371 4.3894 18.9976 4.3894 18.4947V17.3214C4.3894 16.9382 4.4373 16.6509 4.55703 16.4832C4.67676 16.3156 4.89228 16.148 5.22753 15.9804C6.06566 15.5493 7.07141 15.1901 8.24478 14.9028C9.41816 14.5915 10.6634 14.4478 11.9804 14.4478C14.8301 14.4478 16.9134 15.0943 18.2544 16.3875C19.5715 17.6806 20.242 19.6442 20.242 22.2783V30.0369H20.2899ZM10.5676 33.6768C11.3578 33.6768 12.172 33.5331 13.0341 33.2458C13.8962 32.9584 14.6624 32.4316 15.309 31.7132C15.6921 31.2582 15.9795 30.7553 16.1232 30.1806C16.2669 29.6059 16.3626 28.9115 16.3626 28.0973V27.0915C15.6682 26.9239 14.9258 26.7802 14.1596 26.6844C13.3933 26.5887 12.6509 26.5408 11.9086 26.5408C10.3042 26.5408 9.1308 26.8521 8.34057 27.4986C7.55034 28.1452 7.16719 29.0551 7.16719 30.2525C7.16719 31.3779 7.45455 32.2161 8.05321 32.7908C8.62793 33.3895 9.46605 33.6768 10.5676 33.6768ZM29.7966 36.263C29.3656 36.263 29.0782 36.1912 28.8866 36.0236C28.6951 35.8799 28.5274 35.5446 28.3838 35.0896L22.7563 16.579C22.6127 16.1001 22.5408 15.7888 22.5408 15.6212C22.5408 15.238 22.7324 15.0225 23.1155 15.0225H25.4623C25.9173 15.0225 26.2286 15.0943 26.3962 15.262C26.5878 15.4057 26.7315 15.7409 26.8751 16.1959L30.8981 32.0484L34.6338 16.1959C34.7535 15.717 34.8972 15.4057 35.0888 15.262C35.2803 15.1183 35.6156 15.0225 36.0466 15.0225H37.9623C38.4173 15.0225 38.7286 15.0943 38.9202 15.262C39.1118 15.4057 39.2794 15.7409 39.3752 16.1959L43.1587 32.24L47.3015 16.1959C47.4451 15.717 47.6128 15.4057 47.7804 15.262C47.972 15.1183 48.2833 15.0225 48.7143 15.0225H50.9413C51.3245 15.0225 51.54 15.2141 51.54 15.6212C51.54 15.7409 51.516 15.8606 51.4921 16.0043C51.4682 16.148 51.4203 16.3396 51.3245 16.603L45.5534 35.1136C45.4097 35.5925 45.2421 35.9038 45.0505 36.0475C44.8589 36.1912 44.5476 36.287 44.1405 36.287H42.0811C41.6262 36.287 41.3148 36.2151 41.1233 36.0475C40.9317 35.8799 40.7641 35.5686 40.6683 35.0896L36.9566 19.6442L33.2688 35.0657C33.1491 35.5446 33.0054 35.8559 32.8139 36.0236C32.6223 36.1912 32.287 36.263 31.856 36.263H29.7966ZM60.5678 36.9096C59.3226 36.9096 58.0774 36.7659 56.8801 36.4785C55.6827 36.1912 54.7488 35.8799 54.1262 35.5207C53.7431 35.3052 53.4797 35.0657 53.3839 34.8502C53.2881 34.6347 53.2402 34.3952 53.2402 34.1797V32.9584C53.2402 32.4555 53.4318 32.2161 53.791 32.2161C53.9346 32.2161 54.0783 32.24 54.222 32.2879C54.3657 32.3358 54.5812 32.4316 54.8207 32.5274C55.6348 32.8866 56.5209 33.1739 57.4548 33.3655C58.4126 33.5571 59.3465 33.6529 60.3044 33.6529C61.813 33.6529 62.9864 33.3895 63.8006 32.8626C64.6148 32.3358 65.0458 31.5695 65.0458 30.5877C65.0458 29.9172 64.8303 29.3664 64.3992 28.9115C63.9682 28.4565 63.154 28.0494 61.9807 27.6662L58.5084 26.5887C56.7603 26.0379 55.4672 25.2237 54.677 24.1461C53.8867 23.0925 53.4797 21.9191 53.4797 20.6739C53.4797 19.6681 53.6952 18.7821 54.1262 18.0158C54.5572 17.2495 55.132 16.579 55.8504 16.0522C56.5687 15.5014 57.3829 15.0943 58.3408 14.807C59.2986 14.5196 60.3044 14.3999 61.358 14.3999C61.8849 14.3999 62.4356 14.4238 62.9625 14.4957C63.5132 14.5675 64.0161 14.6633 64.519 14.7591C64.9979 14.8788 65.4529 14.9986 65.8839 15.1422C66.315 15.2859 66.6502 15.4296 66.8897 15.5733C67.2249 15.7649 67.4644 15.9564 67.6081 16.1719C67.7517 16.3635 67.8236 16.6269 67.8236 16.9622V18.0877C67.8236 18.5905 67.632 18.8539 67.2728 18.8539C67.0813 18.8539 66.7699 18.7582 66.3629 18.5666C64.9979 17.944 63.4653 17.6327 61.7651 17.6327C60.4002 17.6327 59.3226 17.8482 58.5803 18.3032C57.8379 18.7582 57.4548 19.4526 57.4548 20.4344C57.4548 21.1049 57.6942 21.6796 58.1732 22.1346C58.6521 22.5896 59.5381 23.0446 60.8073 23.4517L64.2077 24.5293C65.9318 25.08 67.177 25.8463 67.9194 26.8281C68.6617 27.8099 69.0209 28.9354 69.0209 30.1806C69.0209 31.2103 68.8054 32.1442 68.3983 32.9584C67.9673 33.7726 67.3926 34.491 66.6502 35.0657C65.9079 35.6644 65.0219 36.0954 63.9922 36.4067C62.9146 36.742 61.7891 36.9096 60.5678 36.9096Z" fill="#252F3E"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M65.0942 48.5475C57.2158 54.3665 45.7694 57.4556 35.9274 57.4556C22.1342 57.4556 9.70599 52.355 0.318971 43.878C-0.423369 43.2075 0.247132 42.2975 1.13315 42.8243C11.2865 48.7152 23.8105 52.2832 36.7655 52.2832C45.5059 52.2832 55.1085 50.4633 63.9447 46.7276C65.2618 46.1289 66.3873 47.5897 65.0942 48.5475Z" fill="#FF9900"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M68.375 44.8121C67.3693 43.519 61.7179 44.1895 59.1556 44.5008C58.3893 44.5965 58.2696 43.926 58.964 43.4232C63.466 40.2622 70.8654 41.1722 71.7275 42.2258C72.5896 43.3034 71.488 50.7029 67.2735 54.247C66.6269 54.7977 66.0043 54.5104 66.2917 53.792C67.2495 51.4213 69.3808 46.0812 68.375 44.8121Z" fill="#FF9900"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#252f3e" d="M20.29 30.037c0 .886.096 1.604.263 2.131.192.527.431 1.102.767 1.724.12.192.167.383.167.551 0 .24-.143.479-.455.718l-1.508 1.006c-.216.144-.431.216-.623.216-.24 0-.479-.12-.718-.336a7.4 7.4 0 0 1-.863-1.125 19 19 0 0 1-.742-1.413q-2.802 3.305-7.04 3.305c-2.012 0-3.616-.575-4.79-1.724s-1.771-2.682-1.771-4.598c0-2.036.718-3.688 2.179-4.933s3.4-1.868 5.867-1.868c.814 0 1.652.072 2.538.192s1.796.311 2.754.527v-1.75c0-1.82-.383-3.089-1.126-3.831-.766-.742-2.06-1.101-3.903-1.101-.838 0-1.7.095-2.586.31a19 19 0 0 0-2.586.815c-.384.168-.67.263-.839.311a1.5 1.5 0 0 1-.383.072c-.335 0-.503-.24-.503-.742V17.32c0-.383.048-.67.168-.838s.335-.335.67-.503q1.258-.646 3.018-1.077c1.173-.312 2.418-.455 3.735-.455 2.85 0 4.933.646 6.274 1.94 1.317 1.293 1.988 3.256 1.988 5.89v7.759zm-9.722 3.64c.79 0 1.604-.144 2.466-.431s1.628-.814 2.275-1.533c.383-.455.67-.958.814-1.532s.24-1.27.24-2.084v-1.006a20 20 0 0 0-2.203-.407 18 18 0 0 0-2.251-.143c-1.605 0-2.778.311-3.568.958-.79.646-1.174 1.556-1.174 2.754 0 1.125.288 1.963.886 2.538.575.599 1.413.886 2.515.886m19.229 2.586c-.431 0-.719-.072-.91-.24-.192-.143-.36-.478-.503-.933l-5.628-18.511c-.143-.479-.215-.79-.215-.958 0-.383.191-.598.575-.598h2.346c.455 0 .767.071.934.239.192.144.335.479.48.934l4.022 15.852 3.736-15.852c.12-.479.263-.79.455-.934.191-.144.527-.24.958-.24h1.915c.455 0 .767.072.958.24.192.144.36.479.455.934L43.16 32.24l4.14-16.044c.144-.479.312-.79.48-.934.191-.144.502-.24.933-.24h2.227c.383 0 .599.192.599.6 0 .119-.024.239-.048.382a3.4 3.4 0 0 1-.167.599l-5.772 18.51q-.214.719-.502.934c-.192.144-.503.24-.91.24h-2.06c-.455 0-.766-.072-.958-.24s-.359-.478-.455-.957l-3.711-15.446-3.688 15.422c-.12.479-.264.79-.455.958-.192.167-.527.239-.958.239zm30.77.647c-1.244 0-2.49-.144-3.687-.431s-2.131-.6-2.754-.958c-.383-.216-.646-.455-.742-.67a1.7 1.7 0 0 1-.144-.671v-1.222c0-.502.192-.742.551-.742q.215 0 .431.072c.144.048.36.144.599.24.814.359 1.7.646 2.634.837.958.192 1.892.288 2.85.288 1.508 0 2.681-.264 3.496-.79.814-.527 1.245-1.293 1.245-2.275 0-.67-.216-1.222-.647-1.677-.43-.455-1.245-.862-2.418-1.245l-3.473-1.077c-1.748-.551-3.04-1.365-3.831-2.443-.79-1.053-1.197-2.227-1.197-3.472q0-1.509.646-2.658a6.2 6.2 0 0 1 1.724-1.964c.719-.55 1.533-.958 2.49-1.245.959-.287 1.964-.407 3.018-.407.527 0 1.078.024 1.605.096.55.072 1.053.167 1.556.263.479.12.934.24 1.365.383q.646.216 1.006.431c.335.192.574.383.718.599q.216.287.216.79v1.126c0 .502-.192.766-.551.766-.192 0-.503-.096-.91-.287q-2.048-.934-4.598-.934c-1.365 0-2.442.215-3.185.67s-1.125 1.15-1.125 2.131c0 .67.24 1.246.718 1.7.48.456 1.365.91 2.634 1.318l3.4 1.077c1.725.551 2.97 1.317 3.712 2.3.743.98 1.102 2.106 1.102 3.352 0 1.03-.216 1.963-.623 2.777a6.4 6.4 0 0 1-1.748 2.108c-.742.598-1.628 1.03-2.658 1.34a11.4 11.4 0 0 1-3.424.504"/><path fill="#f90" fill-rule="evenodd" d="M65.094 48.548c-7.878 5.819-19.325 8.908-29.167 8.908-13.793 0-26.221-5.101-35.608-13.578-.742-.67-.072-1.58.814-1.054 10.154 5.891 22.678 9.46 35.633 9.46 8.74 0 18.343-1.82 27.179-5.556 1.317-.6 2.442.862 1.15 1.82" clip-rule="evenodd"/><path fill="#f90" fill-rule="evenodd" d="M68.375 44.812c-1.006-1.293-6.657-.622-9.22-.311-.766.096-.885-.575-.191-1.078 4.502-3.16 11.901-2.25 12.764-1.197.862 1.077-.24 8.477-4.454 12.021-.647.55-1.27.263-.982-.455.957-2.37 3.089-7.71 2.083-8.98" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsaurora.svg b/web/packages/design/src/ResourceIcon/assets/awsaurora.svg
new file mode 100644
index 0000000000000..5cab7701b2492
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsaurora.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M24.365 28.348c-7.44 0-15.36-2.256-15.36-6.432s7.9-6.432 15.36-6.432 15.36 2.256 15.36 6.432-7.93 6.432-15.36 6.432m0-10.944c-7.68 0-13.44 2.381-13.44 4.512s5.76 4.512 13.44 4.512 13.44-2.38 13.44-4.512-5.77-4.512-13.44-4.512"/><path d="M39.754 22.204h-1.92v16.32h1.92zM24.355 59.52c-7.43 0-15.36-2.228-15.36-6.366v-30.95h1.92v30.97c0 2.112 5.76 4.464 13.44 4.464s13.44-2.352 13.44-4.464v-3.13h1.92v3.13c.039 4.137-7.92 6.345-15.36 6.345"/><path d="M24.365 39.197c-7.43 0-15.36-2.256-15.36-6.432h1.92c0 2.13 5.76 4.512 13.44 4.512s13.44-2.381 13.44-4.512h1.92c-.02 4.176-7.92 6.432-15.36 6.432m-.005 10.559C16.93 49.756 9 47.5 9 43.324h1.92c0 2.131 5.76 4.512 13.44 4.512a29.9 29.9 0 0 0 9.274-1.344l.614 1.815a31.7 31.7 0 0 1-9.888 1.45"/><path d="M46.896 60.355a.96.96 0 0 1-.96-.96c0-6.596-7.536-14.15-14.16-14.15a.96.96 0 1 1 0-1.92c6.614 0 14.16-7.547 14.16-14.16a.96.96 0 1 1 1.92 0c0 6.614 7.536 14.16 14.16 14.16a.96.96 0 1 1 0 1.92c-6.624 0-14.16 7.535-14.16 14.15a.96.96 0 0 1-.96.96M36.48 44.285a19.7 19.7 0 0 1 10.416 10.434 19.66 19.66 0 0 1 10.445-10.435A19.68 19.68 0 0 1 46.896 33.84 19.72 19.72 0 0 1 36.48 44.284m16.714-23.04h-1.92v5.76h1.92z"/><path d="M55.114 23.164h-5.76v1.92h5.76zm-12.48-11.519h-1.92v5.76h1.92z"/><path d="M44.554 13.565h-5.76v1.92h5.76z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awscommandlineinterface.svg b/web/packages/design/src/ResourceIcon/assets/awscommandlineinterface.svg
new file mode 100644
index 0000000000000..ed5995babce33
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awscommandlineinterface.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.909" y1="86.909" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#b0084d"/><stop offset="1" stop-color="#ff4f8b"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M59.04 59.04h-6.72v-1.92h5.76V14.88H13.92v42.24H40.8v1.92H12.96a.96.96 0 0 1-.96-.96V13.92a.96.96 0 0 1 .96-.96h46.08a.96.96 0 0 1 .96.96v44.16a.96.96 0 0 1-.96.96"/><path d="M59.04 20.64H12.96v1.92h46.08zM17.76 16.8h-1.92v1.92h1.92zm3.84 0h-1.92v1.92h1.92zm3.84 0h-1.92v1.92h1.92zm-2.4 31.978-1.354-1.363 8.535-8.525-8.535-8.535 1.354-1.363 9.216 9.216a.96.96 0 0 1 0 1.354zm25.44-5.098h-14.4v1.92h14.4z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsdynamodb.svg b/web/packages/design/src/ResourceIcon/assets/awsdynamodb.svg
new file mode 100644
index 0000000000000..5356736aa3474
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsdynamodb.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="#3b48cc" d="M72 0H0v72h72z"/><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="m48.24 38.861-6.346 6.336a15.6 15.6 0 0 0 3.284-1.334 2.48 2.48 0 0 1 1.142 1.728c0 1.756-3.725 3.667-9.254 4.444a40.5 40.5 0 0 1-5.146.365h-.96c-7.757-.182-13.44-2.63-13.44-4.8a2.48 2.48 0 0 1 1.142-1.728c3.015 1.68 7.901 2.679 13.258 2.679h.106l.537-1.92h-.643c-5.28 0-10.176-1.047-12.778-2.698-1.036-.682-1.612-1.42-1.622-2.064v-4.445c2.938 2.247 8.794 3.418 14.4 3.418.758 0 1.517 0 2.256-.067l.547-1.92a39 39 0 0 1-2.803.096c-8.237 0-14.4-2.525-14.4-4.8a2.48 2.48 0 0 1 1.142-1.728c2.65 1.488 6.72 2.419 11.338 2.63l.048-1.92c-4.54-.22-8.64-1.2-10.906-2.65-1.027-.662-1.603-1.41-1.622-2.064v-4.435c2.938 2.247 8.794 3.418 14.4 3.418h.211l1.018-1.92H31.92c-8.237 0-14.4-2.525-14.4-4.8s6.163-4.8 14.4-4.8a34.5 34.5 0 0 1 8.237.96h5.27c-2.88-1.757-7.853-2.88-13.507-2.88-7.91 0-16.32 2.342-16.32 6.72v7.728a3.9 3.9 0 0 0 1.45 2.832 3.9 3.9 0 0 0-1.45 2.88v7.68a3.9 3.9 0 0 0 1.45 2.88 3.9 3.9 0 0 0-1.45 2.88v7.68a1 1 0 0 0 0 .201c.26 4.215 8.515 6.48 16.32 6.48s16.06-2.265 16.32-6.499a.7.7 0 0 0 0-.201v-7.68a3.84 3.84 0 0 0-1.45-2.88 3.9 3.9 0 0 0 1.45-2.88zm-1.92 14.4c0 2.266-6.163 4.8-14.4 4.8s-14.4-2.506-14.4-4.8v-4.416c2.938 2.227 8.794 3.399 14.4 3.399s11.462-1.172 14.4-3.399z"/><path d="M20.4 27.62a1.2 1.2 0 1 0 0-2.4 1.2 1.2 0 0 0 0 2.4m0 13.44a1.2 1.2 0 1 0 0-2.4 1.2 1.2 0 0 0 0 2.4m0 13.44a1.2 1.2 0 1 0 0-2.4 1.2 1.2 0 0 0 0 2.4m13.92-5.079a.96.96 0 0 1-.48-.134.96.96 0 0 1-.442-1.104l5.396-17.962H33.36a.96.96 0 0 1-.854-1.42l5.76-11.52a.96.96 0 0 1 .854-.529H51.6a.96.96 0 0 1 .96 1.258l-2.458 7.382h5.386a.96.96 0 0 1 .691 1.623l-21.12 22.08a.96.96 0 0 1-.739.326m.595-21.12h5.165a.96.96 0 0 1 .922 1.229l-4.618 15.36 16.81-17.568H48.72a.96.96 0 0 1-.96-1.267l2.458-7.373h-10.56z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsec2.svg b/web/packages/design/src/ResourceIcon/assets/awsec2.svg
new file mode 100644
index 0000000000000..e8cb78a6b7a9a
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsec2.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.912" x2="86.912" y1="86.909" y2="-14.915" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#c8511b"/><stop offset="1" stop-color="#f90"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M58.07 38.88h-4.8v-1.92h4.8V13.92H35.03v4.8h-1.92v-4.8A1.92 1.92 0 0 1 35.03 12h23.04a1.92 1.92 0 0 1 1.92 1.92v23.04a1.92 1.92 0 0 1-1.92 1.92M36.95 60H13.91a1.92 1.92 0 0 1-1.92-1.92V35.04a1.92 1.92 0 0 1 1.92-1.92h4.8v1.92h-4.8v23.04h23.04v-4.8h1.92v4.8A1.92 1.92 0 0 1 36.95 60"/><path d="M51.36 27.36v-1.92h-2.88a2.09 2.09 0 0 0-1.92-1.92v-2.88h-1.92v2.88h-2.88v-2.88h-1.92v2.88h-2.88v-2.88h-1.92v2.88h-2.88v-2.88h-1.92v2.88h-2.88v-2.88h-1.92v2.88a2.09 2.09 0 0 0-1.92 1.92h-2.88v1.92h2.88v2.88h-2.88v1.92h2.88v2.88h-2.88v1.92h2.88v2.88h-2.88v1.92h2.88v2.88h-2.88v1.92h2.88a2.09 2.09 0 0 0 1.92 1.92v2.88h1.92v-2.88h2.88v2.88h1.92v-2.88h2.88v2.88h1.92v-2.88h2.88v2.88h1.92v-2.88h2.88v2.88h1.92v-2.88a2.09 2.09 0 0 0 1.92-1.92h2.88v-1.92h-2.88v-2.88h2.88v-1.92h-2.88v-2.88h2.88v-1.92h-2.88v-2.88h2.88v-1.92h-2.88v-2.88zm-4.8 19.027a.173.173 0 0 1-.173.173H25.613a.173.173 0 0 1-.173-.173V25.612a.173.173 0 0 1 .173-.172h20.774a.173.173 0 0 1 .173.172z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awselasticache.svg b/web/packages/design/src/ResourceIcon/assets/awselasticache.svg
new file mode 100644
index 0000000000000..88c218500db43
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awselasticache.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="#3b48cc" d="M72 0H0v72h72z"/><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M36.02 25.92c-6.442 0-12.98 1.68-12.98 4.896v21.888c0 3.216 6.509 4.896 12.95 4.896s12.97-1.68 12.97-4.896V30.816c0-3.216-6.518-4.896-12.94-4.896m0 29.76c-7.143 0-11.06-1.92-11.06-2.976v-4.618c2.4 1.46 6.72 2.218 11.03 2.218s8.64-.759 11.021-2.208v4.608c.029 1.056-3.869 2.976-10.992 2.976m0-7.296c-7.143 0-11.031-1.92-11.031-2.976V40.8c2.4 1.45 6.72 2.208 11.03 2.208s8.64-.758 11.021-2.208v4.608c0 1.008-3.898 2.976-11.02 2.976m0-7.296c-7.143 0-11.031-1.92-11.031-2.976v-4.618c2.4 1.46 6.72 2.218 11.03 2.218s8.64-.759 11.021-2.218v4.618c0 1.008-3.898 2.976-11.02 2.976m0-7.296c-7.143 0-11.06-1.968-11.06-2.976s3.84-2.976 11.03-2.976 11.05 1.968 11.05 2.976-3.898 2.976-11.02 2.976"/><path d="M59.52 18.423a.96.96 0 0 0 .96-.96V15.36a.96.96 0 0 0-.96-.96H12.48a.96.96 0 0 0-.96.96v2.093a.96.96 0 0 0 .96.96 2.132 2.132 0 0 1 0 4.243.96.96 0 0 0-.96.96V40.32a.96.96 0 0 0 .96.96h8.64v-1.92h-3.84v-.96h3.84v-1.92h-4.8a.96.96 0 0 0-.96.96v1.92h-1.92V24.452a4.09 4.09 0 0 0 0-7.824v-.308h45.12v.317a4.1 4.1 0 0 0 0 7.805V39.36h-.96v-1.92a.96.96 0 0 0-.96-.96h-5.76v1.92h4.8v.96h-4.8v1.92h8.64a.96.96 0 0 0 .96-.96V23.616a.96.96 0 0 0-.96-.96 2.13 2.13 0 0 1 0-4.233"/><path d="M35.52 24v-4.8a.96.96 0 0 0-.96-.96h-6.72a.96.96 0 0 0-.96.96v5.76h1.92v-4.8h4.8V24zm9.6.96V19.2a.96.96 0 0 0-.96-.96h-6.72a.96.96 0 0 0-.96.96V24h1.92v-3.84h4.8v4.8zm5.76 7.68v1.92h2.88a.96.96 0 0 0 .96-.96V19.2a.96.96 0 0 0-.96-.96h-6.72a.96.96 0 0 0-.96.96v6.72H48v-5.76h4.8v12.48zM19.2 20.16H24v5.76h1.92V19.2a.96.96 0 0 0-.96-.96h-6.72a.96.96 0 0 0-.96.96v14.4a.96.96 0 0 0 .96.96h2.88v-1.92H19.2z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awselasticblockstore.svg b/web/packages/design/src/ResourceIcon/assets/awselasticblockstore.svg
new file mode 100644
index 0000000000000..7262cce67ae38
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awselasticblockstore.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.909" y1="86.909" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#1b660f"/><stop offset="1" stop-color="#6cae3e"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M47.491 24.855a3 3 0 0 0-.086-.375c-.855-2.61-6.163-3.964-11.405-3.964s-10.56 1.353-11.405 3.964a3 3 0 0 0-.086.375q-.015.182 0 .365v21.436c0 3.092 5.76 4.704 11.52 4.704s11.52-1.612 11.52-4.704V25.22a2.3 2.3 0 0 0-.058-.365m-11.52-2.42c5.491 0 8.775 1.44 9.466 2.42-.71.96-3.994 2.41-9.466 2.41s-8.755-1.421-9.465-2.41c.72-.98 4.003-2.42 9.494-2.42zm9.6 24.221c0 .96-3.389 2.784-9.6 2.784s-9.6-1.843-9.6-2.784v-19.45c2.18 1.306 5.904 1.978 9.6 1.978s7.421-.672 9.6-1.977z"/><path d="M24.595 24.48a3 3 0 0 0-.086.375q-.015-.188 0-.374zm22.925 0q.015.187 0 .375a3 3 0 0 0-.086-.374zm-25.238-3.562-1.364 1.364-6.998-6.999v5.357H12v-7.68a.96.96 0 0 1 .96-.96h7.68v1.92h-5.357zM60 12.96v7.68h-1.92v-5.357l-6.998 6.999-1.364-1.364 6.999-6.998H51.36V12h7.68a.96.96 0 0 1 .96.96M15.283 58.08h5.357V60h-7.68a.96.96 0 0 1-.96-.96v-7.68h1.92v5.357l6.998-6.998 1.364 1.363zM60 51.36v7.68a.96.96 0 0 1-.96.96h-7.68v-1.92h5.357l-6.999-6.998 1.364-1.363 6.998 6.998V51.36z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awselasticcontainerservice.svg b/web/packages/design/src/ResourceIcon/assets/awselasticcontainerservice.svg
new file mode 100644
index 0000000000000..428a1468e48c5
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awselasticcontainerservice.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.912" x2="86.912" y1="86.909" y2="-14.915" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#c8511b"/><stop offset="1" stop-color="#f90"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M35.798 61.862a.96.96 0 0 1-.508-.134L13.44 49.133a1.02 1.02 0 0 1-.509-.883V22.733a1.02 1.02 0 0 1 .509-.883l20.093-11.578a.96.96 0 0 1 1.507.864v11.05a1.01 1.01 0 0 1-.48.854L24.509 28.8v13.382l11.318 6.538 9.898-5.76a.96.96 0 0 1 .96 0l9.523 5.472a1.02 1.02 0 0 1 .509.883.96.96 0 0 1-.509.874l-19.92 11.52a.96.96 0 0 1-.49.153M14.88 47.558l21.437 12.375L54.72 49.296l-7.68-4.426-10.205 5.895a1.07 1.07 0 0 1-1.046 0L23.04 43.41a1.01 1.01 0 0 1-.509-.873V28.282a.96.96 0 0 1 .509-.874l10.051-5.76v-8.813l-18.24 10.56z"/><path d="M58.022 47.04a1.1 1.1 0 0 1-.508-.134L48 41.405a.96.96 0 0 1-.509-.874V28.906L37.44 23.107a1.01 1.01 0 0 1-.509-.873v-11.05a.96.96 0 0 1 .5-.864.96.96 0 0 1 .96 0L58.56 21.907a1.01 1.01 0 0 1 .509.874v23.203a1.02 1.02 0 0 1-.509.883c-.16.106-.346.165-.538.173m-8.582-7.152 7.68 4.416v-20.88l-18.24-10.56v8.765l10.08 5.837a.96.96 0 0 1 .509.873z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awselasticsearchservice.svg b/web/packages/design/src/ResourceIcon/assets/awselasticsearchservice.svg
new file mode 100644
index 0000000000000..539179d18ea2a
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awselasticsearchservice.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#4d27a8"/><stop offset="1" stop-color="#a166ff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M21.6 26.16h-8.64a.96.96 0 0 0-.96.96v30.72a.96.96 0 0 0 .96.96h8.64a.96.96 0 0 0 .96-.96V27.12a.96.96 0 0 0-.96-.96m-.96 30.72h-6.72v-28.8h6.72zm14.4-4.397v5.356a.96.96 0 0 1-.96.96h-8.64a.96.96 0 0 1-.96-.96V41.28a14.2 14.2 0 0 0 1.92 5.03v10.56h6.72v-5.03q.934.397 1.92.644m0-31.124v3.398q-.987.265-1.92.681v-3.12H26.4v8.64a14.2 14.2 0 0 0-1.92 5.03V21.36a.96.96 0 0 1 .96-.96h8.64a.96.96 0 0 1 .96.96M45.6 53.25v3.63h-6.72v-3.84q-.965.003-1.92-.125v4.925a.96.96 0 0 0 .96.96h8.64a.96.96 0 0 0 .96-.96v-2.67zm.96-40.53h-8.64a.96.96 0 0 0-.96.96v10.685a14 14 0 0 1 1.92-.125v-9.6h6.72v11.28q1.011.535 1.92 1.229v-13.44a.96.96 0 0 0-.96-.99m12.48 4.801H50.4a.96.96 0 0 0-.96.96v10.406c.74.799 1.385 1.682 1.92 2.63V19.44h6.72v29.52L60 50.88v-32.4a.96.96 0 0 0-.96-.96"/><path d="m58.838 52.464-8.64-8.64a12.48 12.48 0 1 0-5.51 5.827l8.496 8.487a3.995 3.995 0 1 0 5.654-5.645zM28.32 38.621a10.56 10.56 0 1 1 21.119 0 10.56 10.56 0 0 1-21.119 0m29.155 18.134a2.083 2.083 0 0 1-2.937 0l-8.18-8.179a12.7 12.7 0 0 0 2.88-3.043l8.256 8.294a2.074 2.074 0 0 1-.019 2.928"/><path d="M34.627 43.2a6.202 6.202 0 1 1 7.383-9.966l-1.143 1.546a4.283 4.283 0 0 0-5.097 6.883z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsfargate.svg b/web/packages/design/src/ResourceIcon/assets/awsfargate.svg
new file mode 100644
index 0000000000000..2758c27207784
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsfargate.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.912" x2="86.912" y1="86.909" y2="-14.915" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#c8511b"/><stop offset="1" stop-color="#f90"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="#d86613" d="M72 0H0v72h72z"/><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M23.798 34.954q.105.122.23.22.217.187.452.346l.106.058q.232.144.48.26l.297.124h.202l.24.105c.451.164.96.356 1.517.528l.873.26.47.124c2.4.589 4.864.876 7.335.855a26.6 26.6 0 0 0 10.944-2.093 4.26 4.26 0 0 0 2.496-3.84V18.125a1.52 1.52 0 0 0-.864-1.363l-11.923-5.568a1.46 1.46 0 0 0-1.277 0l-11.952 5.568a1.52 1.52 0 0 0-.864 1.363V31.95a4.26 4.26 0 0 0 1.046 2.803q.09.109.192.202m4.896.134-.806-.24c-.518-.163-.96-.336-1.354-.47l-.345-.144-.327-.154a3 3 0 0 1-.316-.163l-.24-.182-.125-.135a.3.3 0 0 0-.077-.077l-.077-.086a2.32 2.32 0 0 1-.566-1.526V19.277l10.56 4.944v11.75a26.7 26.7 0 0 1-5.904-.767zm17.472-1.017a23.9 23.9 0 0 1-9.216 1.92V24.403l10.56-4.8v12.288a2.32 2.32 0 0 1-1.344 2.18M36 13.008l10.618 4.954-10.445 4.685-.077-.048-10.32-4.8z"/><path d="m52.589 26.573-.538 1.843c4.31 1.268 6.989 3.072 6.989 4.704 0 3.178-9.466 6.72-23.04 6.72s-23.04-3.542-23.04-6.72c0-1.632 2.678-3.436 6.989-4.704l-.538-1.843c-5.395 1.584-8.371 3.917-8.371 6.547 0 5.607 12.864 8.64 24.96 8.64s24.96-3.033 24.96-8.64c0-2.63-2.976-4.953-8.371-6.547m-.058 18.202-4.464-1.92a1.25 1.25 0 0 0-1.094 0l-4.56 1.968a1.17 1.17 0 0 0-.653 1.056v4.944l-4.253-1.862a1.29 1.29 0 0 0-1.094 0l-4.282 1.852V45.86a1.2 1.2 0 0 0-.71-1.085l-4.474-1.92a1.23 1.23 0 0 0-1.085 0l-4.57 1.968a1.17 1.17 0 0 0-.652 1.056v5.837a1.2 1.2 0 0 0 .71 1.084l4.464 1.92h.106c.152.066.315.102.48.106a.96.96 0 0 0 .48-.105l4.31-1.853v4.944a1.2 1.2 0 0 0 .71 1.075l4.455 1.92h.067c.163.075.34.115.519.115.17.002.338-.038.49-.115l4.579-1.968a1.19 1.19 0 0 0 .652-1.056v-4.915l4.263 1.852h.115c.164.072.34.11.518.116.154-.006.305-.045.442-.115l4.589-1.92a1.17 1.17 0 0 0 .653-1.056V45.86a1.2 1.2 0 0 0-.71-1.085m-5.03-.077 2.62 1.114-2.457 1.008-2.544-1.095zm-10.56 6.125 2.62 1.114-2.457.96-2.544-1.056zm-10.56-6.125 2.611 1.123-2.458.96L24 45.725zm-3.84 2.496 2.88 1.229v4.032l-2.88-1.238zm4.8 5.251v-3.84l2.88-1.18v3.84zm5.76.864 2.88 1.239v4.012l-2.88-1.238zm4.8 5.261v-3.85l2.88-1.19v3.84zm5.76-11.376 2.88 1.229v4.032l-2.88-1.239zm4.8 5.26v-3.84l2.88-1.19v3.84z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsiamidentitycenter.svg b/web/packages/design/src/ResourceIcon/assets/awsiamidentitycenter.svg
new file mode 100644
index 0000000000000..924b0c9e27d9b
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsiamidentitycenter.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.915" x2="86.909" y1="86.912" y2="-14.912" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#bd0816"/><stop offset="1" stop-color="#ff5252"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M24 45.168h-2.559c-5.03 0-9.167-3.667-9.436-8.322v-.614a8.44 8.44 0 0 1 6.22-8.447v-.672a12.48 12.48 0 0 1 7.526-11.077 12.98 12.98 0 0 1 14.168 2.678 13.4 13.4 0 0 1 2.88 4.031 5.85 5.85 0 0 1 3.561-1.21c2.688 0 5.51 1.872 6.047 6.029 4.896 1.17 7.574 4.252 7.574 8.764 0 4.799-2.62 7.976-7.2 8.725l-.306-1.92c2.543-.413 5.586-1.92 5.586-6.825 0-3.772-2.256-6.124-6.72-6.988a.96.96 0 0 1-.777-.883c-.22-3.666-2.4-4.962-4.194-4.962a3.95 3.95 0 0 0-3.13 1.555.96.96 0 0 1-1.66-.25 12.1 12.1 0 0 0-2.995-4.655A11.13 11.13 0 0 0 26.46 17.83a10.67 10.67 0 0 0-6.316 9.282q.002.625.077 1.248a.5.5 0 0 1 0 .115.96.96 0 0 1-.816.96c-2.102.528-5.52 2.12-5.52 6.776v.51c.212 3.637 3.514 6.507 7.517 6.517H24z"/><path fill-rule="evenodd" d="M37 47a6 6 0 1 0 0-12 6 6 0 0 0 0 12m0 2c1.955 0 3.745-.7 5.135-1.865l6.95 6.951-3.5 3.5L47 59l3.5-3.5L54 59l1.414-1.414-11.917-11.917A8 8 0 1 0 37 49" clip-rule="evenodd"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsidentityandaccessmanagementiam.svg b/web/packages/design/src/ResourceIcon/assets/awsidentityandaccessmanagementiam.svg
new file mode 100644
index 0000000000000..51ccb0cae7cdd
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsidentityandaccessmanagementiam.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#bd0816"/><stop offset="1" stop-color="#ff5252"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M57.312 18.24H14.688A2.7 2.7 0 0 0 12 20.928v30.144a2.697 2.697 0 0 0 2.688 2.688h42.624A2.697 2.697 0 0 0 60 51.072V20.928a2.697 2.697 0 0 0-2.688-2.688m.768 32.832a.77.77 0 0 1-.768.768H14.688a.77.77 0 0 1-.768-.768V20.928a.77.77 0 0 1 .768-.768h42.624a.77.77 0 0 1 .768.768z"/><path d="M48.48 30.72h-9.6v1.92h9.6zm5.76 0h-1.92v1.92h1.92zm-19.478 3.168a.96.96 0 0 0-.682-.288H20.64v-4.8a3.49 3.49 0 0 1 1.44-2.736 5.5 5.5 0 0 1 3.36-1.104 5.33 5.33 0 0 1 3.456 1.21 3.5 3.5 0 0 1 1.344 2.63v4.8h1.92v-5.184a4.87 4.87 0 0 0-2.026-3.84 7.6 7.6 0 0 0-4.694-1.536c-3.706 0-6.72 2.41-6.72 5.366V33.6H16.8a.96.96 0 0 0-.96.96V48a.96.96 0 0 0 .96.96h17.28a.96.96 0 0 0 .96-.96V34.56a.96.96 0 0 0-.278-.672M33.12 38.4h-2.88v1.92h2.88v1.92h-2.88v1.92h2.88v2.88H17.76V35.52h15.36z"/><path d="M25.44 37.027a2.813 2.813 0 0 0-.96 5.453v2.64h1.92v-2.64a2.812 2.812 0 0 0-.96-5.453m0 4.032a1.22 1.22 0 1 1 0-2.44 1.22 1.22 0 0 1 0 2.44M45.6 35.52h-6.72v1.92h6.72zm8.64 0h-4.8v1.92h4.8zm-2.88 4.8H38.88v1.92h12.48z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awskeyspaces.svg b/web/packages/design/src/ResourceIcon/assets/awskeyspaces.svg
new file mode 100644
index 0000000000000..0fde6e0530c55
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awskeyspaces.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><linearGradient xlink:href="#a" id="b" x1="0" x2="7200" y1="7200" y2="0" gradientUnits="userSpaceOnUse"/><linearGradient xlink:href="#a" id="c" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"/><clipPath id="d"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#d)"><path fill="url(#b)" d="M72 0H0v72h72z"/><path fill="url(#c)" d="M72 0H0v72h72z"/><g fill="#fff"><path fill-rule="evenodd" d="m55.29 29.76 2.7 3.03a2.6 2.6 0 0 1-.81.972q-.51.378-1.14.468l-2.1-3.63-2.103 3.63a2.5 2.5 0 0 1-1.137-.468 2.7 2.7 0 0 1-.81-.972l2.697-3.03-3.447-.81a2.7 2.7 0 0 1-.063-.48c0-.68.264-1.28.783-1.8l3.24 1.59-.42-3.873a3.1 3.1 0 0 1 1.26-.267q.688 0 1.26.267l-.42 3.873 3.24-1.59q.782.78.78 1.8.002.181-.06.48zm-7.44 17.46v2.98q-2.438 1.261-5.628 1.26-4.954-.001-7.581-2.833-2.626-2.835-2.625-8.21 0-5.338 2.709-8.254 2.71-2.92 7.665-2.919 2.817 0 5.292 1.176v2.98c-1.599-.505-3.162-.757-4.704-.757-2.352 0-4.05.597-5.082 1.788-1.035 1.191-1.557 3.084-1.557 5.691v.546q.002 3.821 1.578 5.604c1.047 1.191 2.709 1.788 4.977 1.788q2.266-.001 4.956-.84m-6.476-26.61c.535-.531.626-.904.626-1.11s-.09-.579-.626-1.11c-.543-.538-1.43-1.115-2.687-1.642C36.18 15.698 32.58 15 28.5 15s-7.681.697-10.187 1.748c-1.257.527-2.144 1.104-2.687 1.642-.535.531-.626.904-.626 1.11s.09.579.626 1.11c.543.538 1.43 1.115 2.687 1.642C20.82 23.302 24.42 24 28.5 24s7.681-.697 10.187-1.748c1.257-.527 2.144-1.104 2.687-1.642M28.5 26c8.56 0 15.5-2.91 15.5-6.5S37.06 13 28.5 13 13 15.91 13 19.5 19.94 26 28.5 26" clip-rule="evenodd"/><path d="M44 19.43h-2v7h2zM28.355 57.035c-7.43 0-15.36-2.228-15.36-6.365V19.43h1.92v31.259c0 2.112 5.76 4.464 13.44 4.464 2.827 0 5.394-.319 7.51-.827l.573 1.805c-2.473.598-5.314.904-8.083.904"/><path d="M28.365 36.712c-7.43 0-15.36-2.256-15.36-6.432h1.92c0 2.131 5.76 4.512 13.44 4.512q.832 0 1.635-.036v1.92q-.818.036-1.635.036m-.005 10.56c-7.43 0-15.36-2.256-15.36-6.432h1.92c0 2.131 5.76 4.512 13.44 4.512q.82.011 1.64-.023v1.921q-.82.032-1.64.022"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsmanagementconsole.svg b/web/packages/design/src/ResourceIcon/assets/awsmanagementconsole.svg
new file mode 100644
index 0000000000000..57fed2e5d13b3
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsmanagementconsole.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.909" y1="86.909" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#b0084d"/><stop offset="1" stop-color="#ff4f8b"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><path fill="#fff" d="M59.04 59.04h-6.72v-1.92h5.76V22.56H13.92v34.56H40.8v1.92H12.96a.96.96 0 0 1-.96-.96V13.92a.96.96 0 0 1 .96-.96h46.08a.96.96 0 0 1 .96.96v44.16a.96.96 0 0 1-.96.96m-45.12-38.4h44.16v-5.76H13.92zm24.653 33.523h-5.146a.96.96 0 0 1-.96-.96v-.854a13.3 13.3 0 0 1-2.505-1.037l-.605.605a.96.96 0 0 1-1.354 0l-3.638-3.629a.96.96 0 0 1-.279-.682.96.96 0 0 1 .279-.681l.614-.605a12.5 12.5 0 0 1-1.046-2.506h-.893a.96.96 0 0 1-.96-.96v-5.136a.96.96 0 0 1 .96-.96h.864c.263-.87.617-1.71 1.056-2.505l-.595-.653a.96.96 0 0 1 0-1.354l3.638-3.638a.96.96 0 0 1 1.354 0l.614.614c.794-.43 1.63-.777 2.496-1.036v-.864a.96.96 0 0 1 .96-.96h5.146a.96.96 0 0 1 .96.96v.873c.868.25 1.705.599 2.496 1.037l.614-.624a.96.96 0 0 1 1.354 0l3.638 3.638a.96.96 0 0 1 0 1.354l-.614.614a12 12 0 0 1 1.037 2.506h.902a.96.96 0 0 1 .96.96v5.136a.96.96 0 0 1-.96.96h-.864a12 12 0 0 1-1.056 2.544l.614.605a.96.96 0 0 1 0 1.363l-3.638 3.629a.96.96 0 0 1-1.354 0l-.604-.605c-.796.434-1.636.782-2.506 1.037v.854a.96.96 0 0 1-.98.96m-4.186-1.92h3.226v-.633a.96.96 0 0 1 .739-.96 10.8 10.8 0 0 0 3.331-1.373.96.96 0 0 1 1.19.134l.452.451 2.275-2.275-.48-.441a.96.96 0 0 1-.134-1.19 10.2 10.2 0 0 0 1.372-3.313.96.96 0 0 1 .96-.749H48v-3.216h-.643a.96.96 0 0 1-.96-.748 10.5 10.5 0 0 0-1.373-3.322.96.96 0 0 1 .096-1.19l.46-.461-2.255-2.237-.461.47a.96.96 0 0 1-1.2.125 10.3 10.3 0 0 0-3.264-1.401.96.96 0 0 1-.74-.96v-.634h-3.273v.653a.96.96 0 0 1-.749.96 10.8 10.8 0 0 0-3.312 1.373.96.96 0 0 1-1.19-.135l-.46-.451-2.276 2.237.46.46a.96.96 0 0 1 .135 1.2 10.6 10.6 0 0 0-1.373 3.313.96.96 0 0 1-.96.748H24v3.216h.643a.96.96 0 0 1 .96.75 10.7 10.7 0 0 0 1.373 3.32.96.96 0 0 1-.096 1.191l-.46.451 2.255 2.314.461-.46a.96.96 0 0 1 1.19-.126A10.7 10.7 0 0 0 33.6 50.67a.96.96 0 0 1 .749.96zM36 45.446a5.166 5.166 0 1 1 5.165-5.126A5.175 5.175 0 0 1 36 45.446m0-8.4a3.245 3.245 0 1 0 0 6.49 3.245 3.245 0 0 0 0-6.49M25.44 18.72h-1.92V16.8h1.92zm-3.84 0h-1.92V16.8h1.92zm-3.84 0h-1.92V16.8h1.92z"/></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsmemorydb.svg b/web/packages/design/src/ResourceIcon/assets/awsmemorydb.svg
new file mode 100644
index 0000000000000..cdd61a68d51d3
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsmemorydb.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="0" x2="7200" y1="7200" y2="0" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path fill-rule="evenodd" d="M41.374 20.61c.535-.531.626-.904.626-1.11s-.09-.579-.626-1.11c-.543-.538-1.43-1.115-2.687-1.642C36.18 15.698 32.58 15 28.5 15s-7.681.697-10.187 1.748c-1.257.527-2.144 1.104-2.687 1.642-.535.531-.626.904-.626 1.11s.09.579.626 1.11c.543.538 1.43 1.115 2.687 1.642C20.82 23.302 24.42 24 28.5 24s7.681-.697 10.187-1.748c1.257-.527 2.144-1.104 2.687-1.642M28.5 26c8.56 0 15.5-2.91 15.5-6.5S37.06 13 28.5 13 13 15.91 13 19.5 19.94 26 28.5 26" clip-rule="evenodd"/><path d="M44 19.43h-2v14h2z"/><path fill-rule="evenodd" d="M19.103 55.807q.09-.958.258-1.89c-2.761-.874-4.446-2.086-4.446-3.228v-31.26h-1.92v31.24c0 2.346 2.548 4.078 6.108 5.138" clip-rule="evenodd"/><path d="M20.882 46.472C24.842 39.068 32.803 34 41.993 34c1.702 0 3.362.174 4.961.504l.404-1.959A26.5 26.5 0 0 0 41.993 32c-9.937 0-18.571 5.482-22.875 13.528zm28.055-11.471a24 24 0 0 1 4.588 1.895l.95-1.76a26 26 0 0 0-4.97-2.052z"/><path fill-rule="evenodd" d="M55.89 43.61A19.94 19.94 0 0 1 62 58H22q0-1.013.099-2C23.102 45.893 31.629 38 42 38c4.675 0 8.975 1.604 12.38 4.291l5.206-5.205L61 38.5zM24.11 56c.995-9 8.625-16 17.89-16 4.122 0 7.92 1.386 10.955 3.717l-8.039 8.038A6.002 6.002 0 0 0 36.084 56zm22.375-2.985A6 6 0 0 1 47.917 56H59.89a17.95 17.95 0 0 0-5.414-10.975zM42 53a4 4 0 0 1 3.874 3h-7.748c.444-1.725 2.01-3 3.874-3" clip-rule="evenodd"/><path d="M24.84 34.62a29 29 0 0 0-2.063 1.666c-5.341-.835-9.772-2.884-9.772-6.006h1.92c0 1.79 4.063 3.756 9.914 4.34m-7.763 8.547a29 29 0 0 0-.928 1.679C14.218 43.819 13 42.476 13 40.84h1.92c0 .785.783 1.605 2.156 2.327"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsrds.svg b/web/packages/design/src/ResourceIcon/assets/awsrds.svg
new file mode 100644
index 0000000000000..c77369a6ea54b
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsrds.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><path fill="#fff" d="M46.512 27.1c0-2.783-5.462-4.07-10.56-4.07s-10.56 1.287-10.56 4.07q-.006.211.048.413v17.329c-.048 2.88 5.424 4.108 10.56 4.108s10.56-1.267 10.56-4.05V27.1zm-10.54-2.14c5.596 0 8.64 1.526 8.64 2.15s-3.025 2.15-8.64 2.15-8.64-1.516-8.64-2.15 3.042-2.15 8.64-2.15m8.64 19.949c0 .614-3.034 2.13-8.64 2.13s-8.64-1.516-8.64-2.13v-3.034c2.025 1.104 5.423 1.632 8.64 1.632s6.585-.518 8.64-1.603zm0-5.463c0 .615-3.025 2.15-8.64 2.15s-8.64-1.535-8.64-2.15h.028V35.78c2.026 1.094 5.424 1.622 8.64 1.622s6.586-.518 8.64-1.603zm0-6.115c0 .624-3.025 2.16-8.64 2.16s-8.64-1.536-8.64-2.16h.028v-3.744c2.045 1.085 5.405 1.584 8.64 1.584s6.634-.518 8.64-1.622zM15.274 58.09H21.6v1.92h-8.64a.96.96 0 0 1-.96-.96v-8.64h1.92v6.307l7.2-7.19 1.344 1.353zM60 50.41v8.64a.96.96 0 0 1-.96.96H50.4v-1.92h6.326l-7.094-7.114 1.354-1.344 7.094 7.085v-6.308zm0-37.44v8.64h-1.92v-6.336l-7.094 7.094-1.354-1.353 7.085-7.085H50.4v-1.92h8.64a.96.96 0 0 1 .96.96m-37.536 8.15-1.344 1.344-7.2-7.19v6.316H12v-8.64a.96.96 0 0 1 .96-.96h8.64v1.92h-6.326zm-1.19 23.481c-5.866-2.112-9.226-5.337-9.226-8.841s3.36-6.72 9.226-8.842l.652 1.805c-4.982 1.795-7.958 4.425-7.958 7.037s2.976 5.241 7.958 7.036zm28.915.212-.615-1.824c5.328-1.796 8.506-4.503 8.506-7.23s-3.178-5.433-8.506-7.238l.615-1.814C56.419 28.8 60 32.121 60 35.76s-3.58 6.94-9.811 9.053"/></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsredshift.svg b/web/packages/design/src/ResourceIcon/assets/awsredshift.svg
new file mode 100644
index 0000000000000..f61095a3330d8
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsredshift.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.918" y1="86.909" y2="-14.918" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#2e27ad"/><stop offset="1" stop-color="#527fff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="#3b48cc" d="M72 0H0v72h72z"/><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M36 60c-7.91 0-16.32-2.295-16.32-6.548V18.548h1.92v34.906c0 1.92 5.482 4.627 14.4 4.627s14.4-2.688 14.4-4.627V18.547h1.92v34.906C52.32 57.705 43.91 60 36 60"/><path d="M36 60c-7.91 0-16.32-2.295-16.32-6.548V18.548h1.92v34.906c0 1.92 5.482 4.627 14.4 4.627s14.4-2.688 14.4-4.627V18.547h1.92v34.906C52.32 57.705 43.91 60 36 60"/><path d="M36 25.085c-7.91 0-16.32-2.295-16.32-6.538S28.09 12 36 12s16.32 2.294 16.32 6.547-8.41 6.538-16.32 6.538m0-11.165c-8.918 0-14.4 2.688-14.4 4.627s5.482 4.618 14.4 4.618 14.4-2.688 14.4-4.618S44.918 13.92 36 13.92m-2.721 23.959-.426 1.872 5.823 1.324.425-1.872zm10.327-5.735-2.22 5.626 1.785.704 2.22-5.625zm-14.703 7.989-1.96 4.592 1.767.753 1.96-4.591z"/><path d="M26.88 50.66a3.36 3.36 0 1 1 0-6.721 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.88 1.44 1.44 0 0 0 0-2.88m3.84-4.204a3.36 3.36 0 1 1 0-6.72 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.878 1.44 1.44 0 0 0 0-2.878m10.56 6.825a3.36 3.36 0 1 1 0-6.72 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.88 1.44 1.44 0 0 0 0-2.88m3.84-5.28a3.36 3.36 0 1 1 3.36-3.36v.048a3.37 3.37 0 0 1-3.36 3.312m0-4.8a1.44 1.44 0 1 0 .001 2.88 1.44 1.44 0 0 0-.001-2.88"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awsredshift2.svg b/web/packages/design/src/ResourceIcon/assets/awsredshift2.svg
new file mode 100644
index 0000000000000..6fbc30b1285db
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awsredshift2.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.918" x2="86.909" y1="86.918" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#4d27a8"/><stop offset="1" stop-color="#a166ff"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M36 60c-7.91 0-16.32-2.295-16.32-6.548V18.548h1.92v34.906c0 1.92 5.482 4.627 14.4 4.627s14.4-2.688 14.4-4.627V18.547h1.92v34.906C52.32 57.705 43.91 60 36 60"/><path d="M36 60c-7.91 0-16.32-2.295-16.32-6.548V18.548h1.92v34.906c0 1.92 5.482 4.627 14.4 4.627s14.4-2.688 14.4-4.627V18.547h1.92v34.906C52.32 57.705 43.91 60 36 60"/><path d="M36 25.085c-7.91 0-16.32-2.295-16.32-6.538S28.09 12 36 12s16.32 2.294 16.32 6.547-8.41 6.538-16.32 6.538m0-11.165c-8.918 0-14.4 2.688-14.4 4.627s5.482 4.618 14.4 4.618 14.4-2.688 14.4-4.618S44.918 13.92 36 13.92m-2.721 23.959-.426 1.872 5.823 1.324.425-1.872zm10.327-5.735-2.22 5.626 1.785.704 2.22-5.625zm-14.703 7.989-1.96 4.592 1.767.753 1.96-4.591z"/><path d="M26.88 50.66a3.36 3.36 0 1 1 0-6.721 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.88 1.44 1.44 0 0 0 0-2.88m3.84-4.204a3.36 3.36 0 1 1 0-6.72 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.878 1.44 1.44 0 0 0 0-2.878m10.56 6.825a3.36 3.36 0 1 1 0-6.72 3.36 3.36 0 0 1 0 6.72m0-4.8a1.44 1.44 0 1 0 0 2.88 1.44 1.44 0 0 0 0-2.88m3.84-5.28a3.36 3.36 0 1 1 3.36-3.36v.048a3.37 3.37 0 0 1-3.36 3.312m0-4.8a1.44 1.44 0 1 0 .001 2.88 1.44 1.44 0 0 0-.001-2.88"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awssimplestorageservices3.svg b/web/packages/design/src/ResourceIcon/assets/awssimplestorageservices3.svg
new file mode 100644
index 0000000000000..afb53d39685fc
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awssimplestorageservices3.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.909" y1="86.909" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#1b660f"/><stop offset="1" stop-color="#6cae3e"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><path fill="#fff" d="M58.973 38.458c-.279-1.507-1.987-2.573-3.159-3.331-.374-.24-1.401-.625-1.488-.96-.006-.24.027-.48.096-.71l.96-6.903c.279-2.026.548-4.051.826-6.077.25-1.862-.643-3.11-2.16-4.157-3.091-2.14-7.123-3.005-10.762-3.6a53.6 53.6 0 0 0-13.804-.451 38.4 38.4 0 0 0-12.03 2.88c-2.054.96-4.742 2.458-4.406 5.078.96 7.796 2.093 15.571 3.14 23.357l1.44 10.685a3.97 3.97 0 0 0 2.361 3.197c2.976 1.613 6.663 2.073 9.984 2.38 4.416.4 8.866.203 13.229-.585 2.765-.509 7.91-1.344 8.352-4.8.547-4.282 1.152-8.563 1.728-12.835l.211-1.306c1.565.375 6.029 1.171 5.482-1.862M34.608 13.92c5.76 0 12.355.653 17.52 3.495.797.441 2.65 1.43 2.093 2.601s-2.285 1.757-3.341 2.18a30 30 0 0 1-4.637 1.295 59.8 59.8 0 0 1-20.793.432 25.7 25.7 0 0 1-8.948-2.62c-.69-.394-1.833-1.104-1.516-2.045a2.9 2.9 0 0 1 1.132-1.21 20 20 0 0 1 6.912-2.793 48.3 48.3 0 0 1 11.578-1.335m15.053 40.464c-.144 1.123-1.997 1.68-2.88 1.997a28.4 28.4 0 0 1-5.645 1.267c-4.26.567-8.576.567-12.835 0a21.4 21.4 0 0 1-7.68-2.083 1.92 1.92 0 0 1-1.152-1.66c-.96-7.614-2.055-15.226-3.082-22.84l-1.113-8.255a22.3 22.3 0 0 0 7.008 2.457c2.631.536 5.297.886 7.977 1.047 5.26.377 10.548.083 15.735-.874a23.3 23.3 0 0 0 7.881-2.63L51.84 37.882a116 116 0 0 1-14.227-5.76 4 4 0 0 1-.586-.279c-.259-.192-.192-.096-.317-.393-.24-.547-.297-.96-.806-1.411a2.16 2.16 0 1 0-1.19 3.84c.33-.055.653-.152.96-.288.374-.116.374-.096.768.086a122 122 0 0 0 14.4 5.914c.739.24.73 0 .73.614q-.048.701-.183 1.392l-.615 4.58zM34.848 31.68c0 .26-.365.23-.46.067s.46-.432.46-.067M53.76 38.4l.288-2.121c.96.547 2.592 1.372 3.024 2.467-.94.384-2.429-.125-3.312-.346"/></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/awssinglesignon.svg b/web/packages/design/src/ResourceIcon/assets/awssinglesignon.svg
new file mode 100644
index 0000000000000..00e310153dab6
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/awssinglesignon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><linearGradient id="a" x1="-14.909" x2="86.909" y1="86.909" y2="-14.909" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#bd0816"/><stop offset="1" stop-color="#ff5252"/></linearGradient><clipPath id="b"><path d="M0 0h72v72H0z"/></clipPath><g clip-path="url(#b)"><path fill="url(#a)" d="M72 0H0v72h72z"/><g fill="#fff"><path d="M28.306 43.402h-6.864c-5.03 0-9.168-3.667-9.436-8.323v-.615a8.44 8.44 0 0 1 6.22-8.448v-.672a12.48 12.48 0 0 1 7.527-11.078 12.98 12.98 0 0 1 14.17 2.678 13.4 13.4 0 0 1 2.88 4.032 5.85 5.85 0 0 1 3.56-1.21c2.689 0 5.511 1.873 6.049 6.03 4.896 1.17 7.574 4.252 7.574 8.764 0 4.8-2.62 7.978-7.2 8.727l-.307-1.92c2.544-.413 5.587-1.92 5.587-6.826 0-3.773-2.256-6.125-6.72-6.989a.96.96 0 0 1-.777-.883c-.221-3.667-2.4-4.963-4.196-4.963a3.95 3.95 0 0 0-3.13 1.555.96.96 0 0 1-1.66-.25 12.1 12.1 0 0 0-2.995-4.655 11.125 11.125 0 0 0-12.125-2.295 10.68 10.68 0 0 0-6.317 9.283q.002.627.077 1.248a.5.5 0 0 1 0 .116.96.96 0 0 1-.816.96c-2.102.528-5.52 2.121-5.52 6.777v.51c.211 3.637 3.514 6.508 7.517 6.517h6.902z"/><path d="M59.026 58.762h-2.822a.96.96 0 0 1-.672-.269l-1.7-1.65h-4.406a.96.96 0 0 1-.96-.96v-2.487l-1.353-1.354h-2.487a.96.96 0 0 1-.96-.96V48.48l-.364-.585a9.9 9.9 0 0 1-3.313.576 9.753 9.753 0 0 1-5.25-17.98c.249-.164.527-.318.796-.462s.605-.288.902-.413q.723-.269 1.479-.422a5.5 5.5 0 0 1 .777-.125h.692q.3-.051.604-.057a9.783 9.783 0 0 1 9.764 9.696 8.7 8.7 0 0 1-.586 3.379l10.56 10.56c.175.184.275.427.278.681v4.503a.96.96 0 0 1-.979.931m-2.429-1.92h1.47v-3.14L47.342 42.98a.96.96 0 0 1-.211-1.037c.49-1 .727-2.104.691-3.216a7.853 7.853 0 0 0-7.843-7.843q-.172-.015-.346 0h-.69a4 4 0 0 0-.586.086 8.5 8.5 0 0 0-1.2.336c-.192.086-.461.202-.72.336s-.432.24-.644.374a7.834 7.834 0 0 0 7.508 13.719.96.96 0 0 1 1.219.355l.96 1.507a.96.96 0 0 1 .144.51v1.92h1.92a.96.96 0 0 1 .681.277l1.92 1.92a.96.96 0 0 1 .279.682v1.92h3.84a.96.96 0 0 1 .672.269zm-18.24-16.32a3.47 3.47 0 0 1-2.505-1.056 3.55 3.55 0 0 1 .005-5.016 3.547 3.547 0 0 1 5.016.005 3.47 3.47 0 0 1 1.056 2.505 3.59 3.59 0 0 1-3.543 3.562zm0-5.05a1.6 1.6 0 0 0-1.142.47 1.63 1.63 0 0 0-.356 1.777c.083.198.204.377.356.528a1.603 1.603 0 0 0 2.304 0c.306-.305.479-.72.48-1.152a1.6 1.6 0 0 0-.48-1.143 1.68 1.68 0 0 0-1.19-.432z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/azure.svg b/web/packages/design/src/ResourceIcon/assets/azure.svg
index 15678607d7278..a62615c7a79ff 100644
--- a/web/packages/design/src/ResourceIcon/assets/azure.svg
+++ b/web/packages/design/src/ResourceIcon/assets/azure.svg
@@ -1,23 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M24.0028 2.05795H45.3083L23.1911 67.5888C22.9638 68.2622 22.531 68.8473 21.9537 69.2618C21.3764 69.6763 20.6837 69.8994 19.973 69.8995H3.39202C2.85354 69.8996 2.32278 69.7714 1.84366 69.5257C1.36453 69.2799 0.950814 68.9236 0.636725 68.4862C0.322635 68.0488 0.117204 67.5429 0.0374279 67.0104C-0.0423487 66.4778 0.00582197 65.9339 0.177954 65.4237L20.7838 4.36867C21.0111 3.69501 21.4439 3.10961 22.0214 2.69493C22.5988 2.28024 23.2919 2.05799 24.0028 2.05795Z" fill="url(#paint0_linear_6709_29491)"/>
-<path d="M54.9621 46.0117H21.1767C20.8626 46.0114 20.5557 46.1056 20.2959 46.2822C20.0362 46.4588 19.8356 46.7095 19.7204 47.0017C19.6051 47.2939 19.5806 47.614 19.6499 47.9204C19.7192 48.2268 19.8791 48.5051 20.1089 48.7193L41.8186 68.9823C42.4507 69.5719 43.2829 69.8998 44.1473 69.8996H63.2779L54.9621 46.0117Z" fill="#0078D4"/>
-<path d="M24.0024 2.05813C23.2837 2.05537 22.5829 2.28249 22.0025 2.70631C21.422 3.13013 20.9923 3.72845 20.776 4.41386L0.202893 65.3682C0.0191804 65.8803 -0.0384958 66.4291 0.0347438 66.9682C0.107983 67.5073 0.309984 68.0208 0.623658 68.4653C0.937332 68.9098 1.35345 69.2722 1.83681 69.5219C2.32018 69.7716 2.85656 69.9012 3.4006 69.8997H20.4095C21.043 69.7865 21.635 69.5072 22.1253 69.0903C22.6155 68.6734 22.9862 68.1339 23.1997 67.5268L27.3024 55.4356L41.9571 69.1044C42.5713 69.6123 43.3416 69.8932 44.1386 69.8997H63.198L54.8388 46.0118L30.4706 46.0176L45.3848 2.05813H24.0024Z" fill="url(#paint1_linear_6709_29491)"/>
-<path d="M51.2156 4.36556C50.9887 3.69299 50.5565 3.10856 49.9799 2.6946C49.4033 2.28064 48.7113 2.05802 48.0015 2.05811H24.2568C24.9666 2.05815 25.6585 2.28081 26.2351 2.69475C26.8117 3.10869 27.2439 3.69306 27.4709 4.36556L48.0776 65.423C48.2499 65.9334 48.2981 66.4774 48.2184 67.0101C48.1387 67.5427 47.9333 68.0488 47.6192 68.4863C47.3052 68.9239 46.8914 69.2804 46.4122 69.5263C45.933 69.7722 45.4021 69.9005 44.8635 69.9005H68.609C69.1476 69.9003 69.6783 69.772 70.1574 69.526C70.6365 69.28 71.0502 68.9235 71.3642 68.486C71.6782 68.0485 71.8835 67.5425 71.9631 67.0099C72.0428 66.4772 71.9945 65.9333 71.8223 65.423L51.2156 4.36556Z" fill="url(#paint2_linear_6709_29491)"/>
-<defs>
-<linearGradient id="paint0_linear_6709_29491" x1="31.768" y1="7.08525" x2="9.64178" y2="72.4516" gradientUnits="userSpaceOnUse">
-<stop stop-color="#114A8B"/>
-<stop offset="1" stop-color="#0669BC"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6709_29491" x1="38.6793" y1="37.5479" x2="33.5611" y2="39.2785" gradientUnits="userSpaceOnUse">
-<stop stop-opacity="0.3"/>
-<stop offset="0.071" stop-opacity="0.2"/>
-<stop offset="0.321" stop-opacity="0.1"/>
-<stop offset="0.623" stop-opacity="0.05"/>
-<stop offset="1" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint2_linear_6709_29491" x1="35.8653" y1="5.17889" x2="60.1533" y2="69.8866" gradientUnits="userSpaceOnUse">
-<stop stop-color="#3CCBF4"/>
-<stop offset="1" stop-color="#2892DF"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_6709_29491)" d="M24.003 2.058h21.305l-22.117 65.53a3.4 3.4 0 0 1-3.218 2.312H3.392a3.392 3.392 0 0 1-3.214-4.476L20.784 4.369a3.4 3.4 0 0 1 3.219-2.311"/><path fill="#0078d4" d="M54.962 46.012H21.177a1.564 1.564 0 0 0-1.068 2.707l21.71 20.263c.632.59 1.464.918 2.328.918h19.13z"/><path fill="url(#paint1_linear_6709_29491)" d="M24.002 2.058a3.37 3.37 0 0 0-3.226 2.356L.203 65.368A3.388 3.388 0 0 0 3.4 69.9h17.01a3.64 3.64 0 0 0 2.79-2.373l4.102-12.091 14.655 13.668a3.47 3.47 0 0 0 2.182.796h19.059l-8.36-23.888-24.367.006 14.914-43.96z"/><path fill="url(#paint2_linear_6709_29491)" d="M51.216 4.366A3.39 3.39 0 0 0 48 2.058H24.258a3.39 3.39 0 0 1 3.214 2.308l20.607 61.057a3.392 3.392 0 0 1-3.215 4.477H68.61a3.392 3.392 0 0 0 3.213-4.477z"/><defs><linearGradient id="paint0_linear_6709_29491" x1="31.768" x2="9.642" y1="7.085" y2="72.452" gradientUnits="userSpaceOnUse"><stop stop-color="#114a8b"/><stop offset="1" stop-color="#0669bc"/></linearGradient><linearGradient id="paint1_linear_6709_29491" x1="38.679" x2="33.561" y1="37.548" y2="39.279" gradientUnits="userSpaceOnUse"><stop stop-opacity=".3"/><stop offset=".071" stop-opacity=".2"/><stop offset=".321" stop-opacity=".1"/><stop offset=".623" stop-opacity=".05"/><stop offset="1" stop-opacity="0"/></linearGradient><linearGradient id="paint2_linear_6709_29491" x1="35.865" x2="60.153" y1="5.179" y2="69.887" gradientUnits="userSpaceOnUse"><stop stop-color="#3ccbf4"/><stop offset="1" stop-color="#2892df"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/bill.svg b/web/packages/design/src/ResourceIcon/assets/bill.svg
index 12b193f8f8085..b11f95d9cd2d4 100644
--- a/web/packages/design/src/ResourceIcon/assets/bill.svg
+++ b/web/packages/design/src/ResourceIcon/assets/bill.svg
@@ -1,8 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M10.875 25.7309V13.9639L22.3701 22.8593C26.351 25.9804 27.106 30.5233 27.0128 30.4096C24.4211 27.1896 20.9598 25.7766 18.577 25.7387L10.875 25.7309Z" fill="#FF9C6C"/>
-<path d="M41.8463 28.2695H33.2451V59.392H41.8463V28.2695Z" fill="#FF5A0A"/>
-<path d="M56.9264 13.5771H48.3252V59.3927H56.9264V13.5771Z" fill="#FF5A0A"/>
-<path d="M71.9996 13.5771H63.3984V59.3927H71.9996V13.5771Z" fill="#FF5A0A"/>
-<path d="M18.4039 48.6413C18.4039 50.0275 17.2014 51.1654 15.842 51.1654H8.50048V36.352H15.842C17.2099 36.352 18.4039 37.4767 18.4039 38.8762V48.6413ZM8.55774 28.2805V13.5962H0V59.3884H17.9087C22.9468 59.3884 27.0285 55.1027 27.0285 49.8126V37.8563C27.0285 32.5662 22.9468 28.2805 17.9087 28.2805H8.55774Z" fill="#FF5A0A"/>
-<path d="M37.4939 23.8434C40.5972 23.8434 43.1129 21.3277 43.1129 18.2244C43.1129 15.1212 40.5972 12.6055 37.4939 12.6055C34.3907 12.6055 31.875 15.1212 31.875 18.2244C31.875 21.3277 34.3907 23.8434 37.4939 23.8434Z" fill="#FF5A0A"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff9c6c" d="M10.875 25.73V13.965L22.37 22.86c3.981 3.121 4.736 7.664 4.643 7.55-2.592-3.22-6.053-4.632-8.436-4.67z"/><path fill="#ff5a0a" d="M41.846 28.27h-8.6v31.122h8.6zm15.08-14.693h-8.6v45.816h8.6zm15.074 0h-8.602v45.816H72zM18.404 48.641c0 1.387-1.203 2.524-2.562 2.524H8.5V36.352h7.342c1.368 0 2.562 1.125 2.562 2.524zm-9.846-20.36V13.596H0v45.792h17.909c5.038 0 9.12-4.285 9.12-9.575V37.856c0-5.29-4.082-9.576-9.12-9.576zm28.936-4.438a5.619 5.619 0 1 0 0-11.238 5.619 5.619 0 0 0 0 11.238"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/bonusly.svg b/web/packages/design/src/ResourceIcon/assets/bonusly.svg
index df5154ba4955e..e436cc0827644 100644
--- a/web/packages/design/src/ResourceIcon/assets/bonusly.svg
+++ b/web/packages/design/src/ResourceIcon/assets/bonusly.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M71.284 21.9725C70.0118 17.8337 67.382 14.2517 63.8243 11.8123C60.2067 9.31895 56.1936 7.46353 51.9571 6.32551C44.7958 4.36358 37.4292 3.26077 30.0105 3.04004H25.4971C23.9819 3.04004 22.5287 3.6458 21.4573 4.72405C20.3858 5.80231 19.7839 7.26474 19.7839 8.78962V20.2888C19.7839 24.9541 19.7839 29.217 20.0614 33.8743C20.3143 37.3157 21.6937 41.3898 24.7216 43.4185C26.0854 44.3933 27.6494 45.0471 29.2982 45.3315C30.9469 45.6159 32.638 45.5235 34.2463 45.0613C36.0084 44.4824 37.5945 43.4602 38.8542 42.0919C40.114 40.7235 41.0058 39.0541 41.445 37.2419C41.8897 35.4304 41.8666 33.5347 41.3781 31.7349C40.8895 29.9349 39.9516 28.2906 38.6536 26.9583C35.3891 23.566 31.3899 23.566 26.2479 23.6729V15.9027C26.2756 15.4509 26.3958 15.0098 26.6008 14.607C26.8059 14.2042 27.0914 13.8483 27.4396 13.5618C27.9158 13.2196 28.4866 13.0358 29.0719 13.0361C32.5987 12.8857 36.1157 13.5079 39.38 14.8595C43.4858 16.691 46.9738 19.6847 49.4189 23.4758C51.0018 26.196 51.979 29.2298 52.2832 32.3674C52.5874 35.505 52.2112 38.6717 51.1807 41.6487C50.1501 44.6257 48.4897 47.342 46.3142 49.6102C44.1387 51.8786 41.5 53.6445 38.5802 54.7862C35.5177 55.972 32.2247 56.4303 28.9573 56.1254C25.69 55.8204 22.5368 54.7607 19.7431 53.0285C9.13292 46.2933 9.27166 33.0693 9.3043 21.7509L9.41858 13.1182V13.069C9.41858 11.7548 8.27595 12.0915 7.78624 12.3297C6.3151 13.0246 5.02223 14.0503 4.00738 15.3277C1.02021 19.1306 0.318306 24.1492 0 28.8392V34.2521C0.154643 40.6589 1.32281 46.9999 3.46056 53.0368C5.00648 57.3196 7.60683 61.1374 11.0183 64.1334C14.4828 66.9622 18.7288 68.6484 23.1792 68.9631H27.4722C30.2237 68.7044 32.9402 68.1537 35.5768 67.3204C42.9822 64.9199 49.8284 61.0363 55.7034 55.9033C61.8188 50.8233 66.7035 44.4075 69.9863 37.1433C72.1135 32.3802 72.5712 27.0315 71.284 21.9725Z" fill="#22BA50"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#22ba50" d="M71.284 21.973a19.13 19.13 0 0 0-7.46-10.16 38.5 38.5 0 0 0-11.867-5.487A93.6 93.6 0 0 0 30.011 3.04h-4.514a5.7 5.7 0 0 0-4.04 1.684 5.77 5.77 0 0 0-1.673 4.066v11.499c0 4.665 0 8.928.277 13.585.253 3.442 1.633 7.516 4.66 9.545a11.09 11.09 0 0 0 9.525 1.643 10.9 10.9 0 0 0 4.608-2.97 11 11 0 0 0 2.591-4.85 11 11 0 0 0-.067-5.507 10.96 10.96 0 0 0-2.724-4.777c-3.265-3.392-7.264-3.392-12.406-3.285v-7.77a3.3 3.3 0 0 1 1.192-2.341 2.8 2.8 0 0 1 1.632-.526A24.2 24.2 0 0 1 39.38 14.86a23.2 23.2 0 0 1 10.039 8.616 21.91 21.91 0 0 1 1.762 18.173 21.8 21.8 0 0 1-4.867 7.961 21.6 21.6 0 0 1-7.734 5.176 21.2 21.2 0 0 1-18.837-1.758C9.133 46.294 9.272 33.07 9.304 21.752l.115-8.633v-.049c0-1.314-1.143-.978-1.633-.74a10.6 10.6 0 0 0-3.779 2.999C1.02 19.13.318 24.149 0 28.839v5.413a60.7 60.7 0 0 0 3.46 18.785 26.94 26.94 0 0 0 7.558 11.096 21.64 21.64 0 0 0 12.161 4.83h4.293a39 39 0 0 0 8.105-1.643 57.6 57.6 0 0 0 20.126-11.417 52.5 52.5 0 0 0 14.283-18.76 23.2 23.2 0 0 0 1.298-15.17"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/box.svg b/web/packages/design/src/ResourceIcon/assets/box.svg
index 21729535d282b..78451b3f34be4 100644
--- a/web/packages/design/src/ResourceIcon/assets/box.svg
+++ b/web/packages/design/src/ResourceIcon/assets/box.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M71.3652 51.084C72.264 52.3423 72.0842 53.9601 71.0057 54.859C69.7473 55.7578 67.9497 55.578 67.0509 54.4994L60.7593 46.4102L54.6474 54.3197C53.7486 55.578 51.951 55.578 50.6927 54.6792C49.4343 53.7804 49.2546 52.1625 50.1534 50.9042L57.3438 41.5566L50.1534 32.209C49.2546 30.9507 49.6141 29.1531 50.6927 28.2543C51.951 27.3555 53.7486 27.715 54.6474 28.7936L60.7593 36.8828L67.0509 29.1531C67.9497 27.8948 69.5676 27.715 71.0057 28.6138C72.264 29.5126 72.264 31.3102 71.3652 32.5686L64.3545 41.7364L71.3652 51.084ZM38.6487 50.0054C33.9749 50.0054 30.1999 46.4102 30.1999 41.7364C30.1999 37.2424 33.9749 33.4674 38.6487 33.4674C43.3224 33.4674 47.0974 37.2424 47.0974 41.7364C46.9177 46.4102 43.1427 50.0054 38.6487 50.0054ZM13.8416 50.0054C9.16782 50.0054 5.39284 46.4102 5.39284 41.7364C5.39284 37.2424 9.16782 33.4674 13.8416 33.4674C18.5154 33.4674 22.2904 37.2424 22.2904 41.7364C22.2904 46.4102 18.5154 50.0054 13.8416 50.0054ZM38.6487 28.0745C33.4356 28.0745 28.7618 30.9507 26.4249 35.265C24.088 30.9507 19.4142 28.0745 14.0214 28.0745C10.7857 28.0745 7.90949 29.1531 5.5726 30.771V19.2662C5.5726 17.8282 4.31427 16.5698 2.87618 16.5698C1.25833 16.5698 0 17.8282 0 19.2662V41.9162C0.179761 49.4661 6.29164 55.3982 13.8416 55.3982C19.2344 55.3982 23.9082 52.3423 26.2451 48.028C28.582 52.3423 33.2558 55.3982 38.4689 55.3982C46.1986 55.3982 52.4903 49.2864 52.4903 41.5566C52.67 34.1864 46.3784 28.0745 38.6487 28.0745Z" fill="#0061D5"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0061d5" d="M71.365 51.084c.899 1.258.72 2.876-.36 3.775-1.258.899-3.055.719-3.954-.36l-6.292-8.089-6.112 7.91c-.898 1.258-2.696 1.258-3.954.36-1.259-.9-1.438-2.517-.54-3.776l7.19-9.347-7.19-9.348c-.898-1.258-.539-3.056.54-3.955 1.258-.899 3.056-.539 3.954.54l6.112 8.089 6.292-7.73c.899-1.258 2.517-1.438 3.955-.54 1.258.9 1.258 2.697.36 3.956l-7.011 9.167zM38.65 50.005c-4.674 0-8.45-3.595-8.45-8.269 0-4.494 3.776-8.269 8.45-8.269s8.448 3.775 8.448 8.27c-.18 4.673-3.954 8.268-8.448 8.268m-24.807 0c-4.674 0-8.45-3.595-8.45-8.269 0-4.494 3.776-8.269 8.45-8.269s8.448 3.775 8.448 8.27c0 4.673-3.775 8.268-8.448 8.268m24.807-21.93c-5.213 0-9.887 2.876-12.224 7.19-2.337-4.314-7.01-7.19-12.404-7.19-3.235 0-6.112 1.078-8.448 2.696V19.266c0-1.438-1.259-2.696-2.697-2.696C1.258 16.57 0 17.828 0 19.266v22.65c.18 7.55 6.292 13.482 13.842 13.482 5.392 0 10.066-3.056 12.403-7.37 2.337 4.314 7.01 7.37 12.224 7.37 7.73 0 14.021-6.112 14.021-13.841.18-7.37-6.112-13.483-13.841-13.483"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/browserstack.svg b/web/packages/design/src/ResourceIcon/assets/browserstack.svg
index b31284bcb0cde..4d6980a4da267 100644
--- a/web/packages/design/src/ResourceIcon/assets/browserstack.svg
+++ b/web/packages/design/src/ResourceIcon/assets/browserstack.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6825)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 36.0005C72 55.8833 55.8828 72.0005 36 72.0005C16.1178 72.0005 0 55.8833 0 36.0005C0 16.1183 16.1178 0.000488281 36 0.000488281C55.8828 0.000488281 72 16.1183 72 36.0005Z" fill="#ECB360"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.4 32.4005C62.4 50.2944 48.4305 64.8005 31.2 64.8005C13.9688 64.8005 0 50.2944 0 32.4005C0 14.5066 13.9688 0.000488281 31.2 0.000488281C48.4305 0.000488281 62.4 14.5066 62.4 32.4005Z" fill="#D76835"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M64.7996 28.8001C64.7996 44.7062 52.4426 57.6005 37.1986 57.6005C21.9566 57.6005 9.59961 44.7062 9.59961 28.8001C9.59961 12.8948 21.9566 0.000488281 37.1986 0.000488281C52.4426 0.000488281 64.7996 12.8948 64.7996 28.8001Z" fill="#D33A41"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.401 31.2006C62.401 45.7802 51.1182 57.6003 37.2006 57.6003C23.2831 57.6003 12.001 45.7802 12.001 31.2006C12.001 16.6197 23.2831 4.80029 37.2006 4.80029C51.1182 4.80029 62.401 16.6197 62.401 31.2006Z" fill="#B6CB46"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M60.001 33.5998C60.001 46.8546 49.2555 57.6001 36.0006 57.6001C22.7464 57.6001 12.001 46.8546 12.001 33.5998C12.001 20.3449 22.7464 9.6001 36.0006 9.6001C49.2555 9.6001 60.001 20.3449 60.001 33.5998Z" fill="#66AD4A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.401 28.8001C50.401 39.4039 41.8048 48.0001 31.201 48.0001C20.5965 48.0001 12.001 39.4039 12.001 28.8001C12.001 18.1962 20.5965 9.6001 31.201 9.6001C41.8048 9.6001 50.401 18.1962 50.401 28.8001Z" fill="#AED7DC"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M52.7992 26.4001C52.7992 35.6782 45.2778 43.2001 35.9989 43.2001C26.7199 43.2001 19.1992 35.6782 19.1992 26.4001C19.1992 17.1213 26.7199 9.6001 35.9989 9.6001C45.2778 9.6001 52.7992 17.1213 52.7992 26.4001Z" fill="#5BB1CF"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M52.8 27.6001C52.8 36.2158 46.3531 43.2005 38.4 43.2005C30.4469 43.2005 24 36.2158 24 27.6001C24 18.9852 30.4469 12.0005 38.4 12.0005C46.3531 12.0005 52.8 18.9852 52.8 27.6001Z" fill="#25A8C3"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.9997 43.2003C29.3728 43.2003 24 37.2902 24 29.9999C24 22.7097 29.3728 16.8003 35.9997 16.8003C42.6272 16.8003 48 22.7097 48 29.9999C48 37.2902 42.6272 43.2003 35.9997 43.2003Z" fill="#1B1A18"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M42.5487 26.1948C41.4071 28.1047 39.1625 29.2092 37.5345 28.6602C35.9065 28.1119 35.5125 26.1182 36.6532 24.2077C37.7949 22.2973 40.0394 21.1934 41.6674 21.7417C43.2954 22.29 43.6895 24.2837 42.5487 26.1948Z" fill="#FFFFFE"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_6825">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_15936_6825)" clip-rule="evenodd"><path fill="#ecb360" d="M72 36c0 19.883-16.117 36-36 36S0 55.884 0 36 16.118 0 36 0s36 16.118 36 36"/><path fill="#d76835" d="M62.4 32.4c0 17.894-13.97 32.4-31.2 32.4C13.969 64.8 0 50.295 0 32.4S13.969 0 31.2 0c17.23 0 31.2 14.507 31.2 32.4"/><path fill="#d33a41" d="M64.8 28.8c0 15.906-12.357 28.8-27.601 28.8-15.242 0-27.6-12.894-27.6-28.8C9.6 12.895 21.958 0 37.2 0c15.244 0 27.6 12.895 27.6 28.8"/><path fill="#b6cb46" d="M62.401 31.2c0 14.58-11.283 26.4-25.2 26.4S12 45.78 12 31.2 23.282 4.8 37.2 4.8s25.2 11.82 25.2 26.4"/><path fill="#66ad4a" d="M60.001 33.6c0 13.255-10.745 24-24 24s-24-10.745-24-24 10.745-24 24-24 24 10.745 24 24"/><path fill="#aed7dc" d="M50.401 28.8c0 10.604-8.596 19.2-19.2 19.2-10.605 0-19.2-8.596-19.2-19.2s8.596-19.2 19.2-19.2 19.2 8.596 19.2 19.2"/><path fill="#5bb1cf" d="M52.8 26.4c0 9.278-7.522 16.8-16.801 16.8-9.28 0-16.8-7.522-16.8-16.8S26.72 9.6 36 9.6s16.8 7.521 16.8 16.8"/><path fill="#25a8c3" d="M52.8 27.6c0 8.616-6.447 15.6-14.4 15.6S24 36.217 24 27.6 30.447 12 38.4 12s14.4 6.985 14.4 15.6"/><path fill="#1b1a18" d="M36 43.2c-6.627 0-12-5.91-12-13.2s5.373-13.2 12-13.2S48 22.71 48 30s-5.373 13.2-12 13.2"/><path fill="#fffffe" d="M42.549 26.195c-1.142 1.91-3.386 3.014-5.014 2.465s-2.022-2.542-.882-4.452c1.142-1.91 3.386-3.015 5.014-2.466s2.023 2.542.882 4.453"/></g><defs><clipPath id="clip0_15936_6825"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/calendly.svg b/web/packages/design/src/ResourceIcon/assets/calendly.svg
index 000af76a7419d..c9c898bd861f6 100644
--- a/web/packages/design/src/ResourceIcon/assets/calendly.svg
+++ b/web/packages/design/src/ResourceIcon/assets/calendly.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6865)">
-<path d="M62.522 39.2558C65.1271 39.7295 67.5907 40.7886 69.727 42.3532C71.7808 43.8737 71.3834 45.5908 71.0718 46.6072C68.5325 54.8431 63.1229 61.8947 55.8259 66.4806C48.5289 71.0666 39.8289 72.8826 31.3066 71.5987C22.7844 70.3147 15.0056 66.016 9.38368 59.4837C3.76179 52.9513 0.669922 44.6189 0.669922 36.0005C0.669922 27.3821 3.76179 19.0496 9.38368 12.5173C15.0056 5.98499 22.7844 1.68627 31.3066 0.402316C39.8289 -0.881642 48.5289 0.934364 55.8259 5.52034C63.1229 10.1063 68.5325 17.1579 71.0718 25.3938C71.3834 26.4102 71.7808 28.1273 69.727 29.6477C67.5906 31.2117 65.127 32.2701 62.522 32.7431C62.5208 32.7236 62.5208 32.704 62.522 32.6845C62.2971 31.4345 61.9468 30.2104 61.4762 29.0308C63.6284 28.6991 65.6704 27.8588 67.4327 26.5796C67.4314 26.5762 67.4299 26.5725 67.4284 26.5688C67.4225 26.5544 67.4159 26.5381 67.4159 26.5231C65.1474 19.1776 60.3194 12.8894 53.8089 8.80091C47.2984 4.71237 39.5373 3.09473 31.9355 4.24182C24.3337 5.38892 17.3956 9.22465 12.3814 15.0522C7.36717 20.8798 4.60961 28.3126 4.60961 36.0005C4.60961 43.6883 7.36717 51.1211 12.3814 56.9487C17.3956 62.7763 24.3337 66.6121 31.9355 67.7592C39.5373 68.9062 47.2984 67.2886 53.8089 63.2001C60.3194 59.1115 65.1474 52.8234 67.4159 45.4778C67.4177 45.4726 67.4197 45.4673 67.4218 45.4619C67.4272 45.4478 67.4327 45.4335 67.4327 45.4214C65.6701 44.1423 63.6283 43.3014 61.4762 42.9681C61.9473 41.7901 62.2977 40.5673 62.522 39.3186V39.2558Z" fill="#006BFF"/>
-<path d="M49.095 46.6888C46.8091 48.7175 43.9543 51.2418 38.7779 51.2418H35.6826C31.9368 51.2418 28.5299 49.8803 26.0913 47.4124C23.7091 45.001 22.3978 41.7007 22.3978 38.1181V33.8829C22.3978 30.3003 23.7091 27 26.0913 24.5886C28.5299 22.1207 31.9368 20.7612 35.6826 20.7612H38.7779C43.9605 20.7612 46.8091 23.2835 49.095 25.3122L49.1301 25.3431C51.4891 27.4216 53.5432 29.2315 58.977 29.2315C59.8099 29.2313 60.6414 29.1649 61.4638 29.0329L61.4449 28.9848C61.1178 28.1725 60.7342 27.3842 60.2967 26.6256L56.6472 20.3032C55.0014 17.453 52.6344 15.0863 49.7841 13.4409C46.9337 11.7954 43.7005 10.9292 40.4093 10.9294H33.1081C29.8169 10.9292 26.5836 11.7954 23.7333 13.4409C20.8829 15.0863 18.5159 17.453 16.8701 20.3032L13.2206 26.6256C11.5753 29.4761 10.7092 32.7093 10.7092 36.0005C10.7092 39.2917 11.5753 42.5249 13.2206 45.3753L16.8701 51.6978C18.5159 54.5479 20.8829 56.9147 23.7333 58.5601C26.5836 60.2055 29.8169 61.0717 33.1081 61.0716H40.4093C43.7005 61.0717 46.9337 60.2055 49.7841 58.5601C52.6344 56.9147 55.0014 54.5479 56.6472 51.6978L60.2967 45.3858C60.7342 44.6272 61.1178 43.8389 61.4449 43.0267L61.4638 42.9807C60.6418 42.8441 59.8102 42.7742 58.977 42.7715C53.5213 42.7715 51.4726 44.5856 49.1016 46.6851L49.095 46.6909V46.6888Z" fill="#006BFF"/>
-<path d="M38.7779 24.599H35.6825C29.9813 24.599 26.2355 28.671 26.2355 33.8829V38.118C26.2355 43.3299 29.9813 47.4019 35.6825 47.4019H38.7779C42.505 47.4019 44.4285 45.6969 46.5496 43.8167C49.156 41.5064 52.0607 38.9316 58.977 38.9316C60.1655 38.9303 61.3516 39.0395 62.5199 39.2579C62.9005 37.1029 62.9005 34.898 62.5199 32.743C61.3514 32.9604 60.1654 33.0696 58.977 33.0693C52.0579 33.0693 49.1535 30.4942 46.5476 28.1836C44.4273 26.3037 42.5046 24.599 38.7779 24.599Z" fill="#006BFF"/>
-<path d="M58.9767 29.24C59.8099 29.2373 60.6415 29.1674 61.4634 29.0309C61.934 30.2105 62.2843 31.4346 62.5091 32.6846V32.7432C61.3408 32.9608 60.1547 33.0693 58.9663 33.0673C52.05 33.0673 49.1453 30.4932 46.5389 28.1834C44.4178 26.3037 42.4943 24.5991 38.7671 24.5991H35.6718C29.9706 24.5991 26.2248 28.6711 26.2248 33.883V38.1265C26.2248 43.3384 29.9706 47.4125 35.6718 47.4125H38.7671C42.4939 47.4125 44.4166 45.7073 46.5369 43.8269C49.1428 41.5159 52.0472 38.9401 58.9663 38.9401C60.1547 38.9391 61.3406 39.0476 62.5091 39.2643C62.5103 39.2851 62.5103 39.3061 62.5091 39.327C62.2859 40.576 61.9355 41.7989 61.4634 42.9766C60.6411 42.8445 59.8096 42.7781 58.9767 42.7779C53.5411 42.7779 51.4874 44.589 49.1295 46.6684L49.0968 46.6972C46.8087 48.7259 43.9602 51.2482 38.7776 51.2482H35.6823C31.9344 51.2482 28.5296 49.8888 26.0909 47.4209C23.7088 45.0094 22.3975 41.7091 22.3975 38.1265V33.8913C22.3975 30.3087 23.7088 27.0084 26.0909 24.597C28.5296 22.1291 31.9344 20.7676 35.6823 20.7676H38.7776C43.9602 20.7676 46.8087 23.2919 49.0968 25.3206L49.101 25.3244C51.4709 27.4247 53.5192 29.24 58.9767 29.24Z" fill="#0AE8F0"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_6865">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_6865)"><path fill="#006bff" d="M62.522 39.256a17.5 17.5 0 0 1 7.205 3.097c2.054 1.52 1.656 3.238 1.345 4.254a36 36 0 1 1 0-21.213c.311 1.016.709 2.733-1.345 4.254a17.5 17.5 0 0 1-7.205 3.095v-.059a19 19 0 0 0-1.046-3.653 13.7 13.7 0 0 0 5.957-2.451l-.005-.011a.1.1 0 0 1-.012-.046 32.118 32.118 0 1 0 .006 18.939q.009-.022.01-.04a13.7 13.7 0 0 0-5.956-2.454c.471-1.178.822-2.4 1.046-3.65z"/><path fill="#006bff" d="M49.095 46.689c-2.286 2.029-5.14 4.553-10.317 4.553h-3.095c-3.746 0-7.153-1.362-9.592-3.83-2.382-2.411-3.693-5.711-3.693-9.294v-4.235c0-3.583 1.311-6.883 3.693-9.294 2.439-2.468 5.846-3.828 9.592-3.828h3.095c5.183 0 8.031 2.523 10.317 4.551l.035.031c2.36 2.079 4.413 3.889 9.847 3.889q1.251 0 2.487-.2l-.02-.047q-.49-1.219-1.147-2.36l-3.65-6.322A18.75 18.75 0 0 0 40.41 10.93h-7.3a18.75 18.75 0 0 0-16.239 9.374l-3.65 6.323a18.75 18.75 0 0 0 0 18.75l3.65 6.322a18.75 18.75 0 0 0 16.238 9.374h7.301a18.75 18.75 0 0 0 16.238-9.374l3.65-6.312a19 19 0 0 0 1.148-2.36l.019-.045a15.5 15.5 0 0 0-2.487-.21c-5.456 0-7.504 1.815-9.875 3.914l-.007.006z"/><path fill="#006bff" d="M38.778 24.599h-3.096c-5.7 0-9.447 4.072-9.447 9.284v4.235c0 5.212 3.746 9.284 9.447 9.284h3.096c3.727 0 5.65-1.705 7.772-3.585 2.606-2.31 5.51-4.885 12.427-4.885a19 19 0 0 1 3.543.326c.38-2.155.38-4.36 0-6.515a19.3 19.3 0 0 1-3.543.326c-6.92 0-9.823-2.575-12.43-4.885-2.12-1.88-4.042-3.585-7.77-3.585"/><path fill="#0ae8f0" d="M58.977 29.24a15.5 15.5 0 0 0 2.486-.21c.471 1.18.821 2.405 1.046 3.655v.058a19 19 0 0 1-3.543.324c-6.916 0-9.82-2.574-12.427-4.884-2.121-1.88-4.045-3.584-7.772-3.584h-3.095c-5.701 0-9.447 4.072-9.447 9.284v4.243c0 5.212 3.746 9.287 9.447 9.287h3.095c3.727 0 5.65-1.706 7.77-3.586 2.606-2.311 5.51-4.887 12.43-4.887a19.3 19.3 0 0 1 3.542.324v.063a18.6 18.6 0 0 1-1.046 3.65 16 16 0 0 0-2.486-.2c-5.436 0-7.49 1.812-9.847 3.891l-.033.03c-2.288 2.028-5.137 4.55-10.32 4.55h-3.095c-3.748 0-7.152-1.36-9.591-3.827-2.382-2.412-3.693-5.712-3.693-9.294V33.89c0-3.582 1.31-6.883 3.693-9.294 2.439-2.468 5.843-3.83 9.591-3.83h3.096c5.182 0 8.03 2.525 10.319 4.554l.004.003c2.37 2.1 4.418 3.916 9.876 3.916"/></g><defs><clipPath id="clip0_15936_6865"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/calm.svg b/web/packages/design/src/ResourceIcon/assets/calm.svg
index 23094622f110e..e02e60cf7ea15 100644
--- a/web/packages/design/src/ResourceIcon/assets/calm.svg
+++ b/web/packages/design/src/ResourceIcon/assets/calm.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_6870)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M55.9688 0.000488281H16.0312C7.1775 0.000488281 0 7.17799 0 16.0317V55.9692C0 64.823 7.1775 72.0005 16.0312 72.0005H55.9688C64.8225 72.0005 72 64.823 72 55.9692V16.0317C72 7.17799 64.8225 0.000488281 55.9688 0.000488281Z" fill="url(#paint0_linear_15936_6870)"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M8.30647 27.4336C7.32213 28.6672 6.49404 30.0177 5.84103 31.4544C5.17616 32.922 4.67497 34.4975 4.41003 36.1344C3.13766 45.1147 8.59503 46.5435 9.52541 46.7184C14.3089 47.2764 17.8318 44.6692 19.4968 43.07C20.097 46.0676 23.0895 46.1036 24.4018 44.7502C24.7365 44.4048 25.0048 43.9807 25.213 43.5386C25.9915 46.3719 28.4839 45.4072 28.777 45.2812C30.1663 44.7603 31.6193 42.8225 32.647 41.1975C33.2995 43.4261 34.5595 45.8139 36.9799 45.558C38.4385 45.5225 42.0958 41.6295 42.4339 42.1374C42.7714 42.5576 42.8614 43.3293 42.8389 44.4808C42.8164 45.6322 43.7299 45.6901 44.1439 45.576C44.7823 45.3988 45.1845 44.1376 45.8533 43.0413C46.3776 42.1818 46.7685 41.6953 47.2888 41.1226C47.551 40.8403 48.7384 39.6095 49.576 40.0275C50.4135 40.4448 50.499 41.3038 50.557 41.7785C50.6211 42.255 50.6217 42.7601 50.6419 43.3125C50.6177 45.2193 51.5121 45.4888 51.7647 45.5591C53.8341 46.1188 53.9623 42.2218 55.4805 40.7756C55.6228 40.6282 56.9492 39.2568 57.7069 41.4945C58.801 45.5388 62.1681 47.0508 66.7007 44.802C67.5417 44.3846 67.7065 44.2215 68.1655 43.8795C68.2204 43.8385 68.265 43.7854 68.296 43.7243C68.3269 43.6632 68.3433 43.5958 68.3438 43.5273V43.5217C68.3436 43.445 68.3234 43.3696 68.2852 43.3031C68.247 43.2366 68.1921 43.1812 68.1259 43.1425C68.0596 43.1037 67.9845 43.0829 67.9077 43.0821C67.831 43.0814 67.7554 43.1007 67.6885 43.1381L67.6862 43.1392C67.2222 43.3968 65.6787 43.9132 65.191 44.0887C63.3612 44.388 61.1213 44.3205 60.0177 41.6441C59.6852 40.8375 59.3562 40.1113 58.7875 39.348C58.1445 38.4851 56.0397 37.458 54.0737 39.3103C53.563 39.7788 53.1861 40.2975 52.8587 40.8144C52.726 41.0259 52.6028 41.2385 52.4863 41.4511L52.4638 41.3668C52.29 40.7671 51.7343 38.5515 49.4235 38.1915C49.1063 38.1656 47.8204 38.0205 46.0418 39.9746C45.4202 40.653 44.9027 41.3741 44.4207 42.1036L44.419 42.1065C44.334 41.7099 44.2311 41.3488 44.1293 41.1907C42.6178 38.8614 40.3285 40.721 39.3424 41.4151C37.1335 42.9705 36.1092 45.0618 34.7625 40.3115C34.5876 39.6387 34.4481 38.9571 34.3446 38.2696C35.6867 35.9859 38.4188 29.0373 36.8505 24.3787C36.7487 24.0845 36.202 22.581 34.8897 22.6777C34.7012 22.6963 33.2061 22.5388 32.3888 26.7238C31.6238 30.7693 31.7925 35.9836 31.9782 37.7122C31.9995 37.8916 32.0383 38.2455 32.1081 38.7078C30.8143 40.9252 29.1156 43.4463 28.0806 43.5633C26.7362 43.7163 27.1108 42.4749 26.2896 39.717C26.1484 39.3592 25.695 37.6543 23.6543 37.7392C22.6564 37.7803 21.5995 38.0407 20.1567 39.6213C17.8144 42.1875 12.4718 46.0473 8.65072 43.6218C8.23559 43.299 6.17122 41.6081 6.93172 36.5433C7.15672 35.1545 7.58309 33.7831 8.15741 32.5029C8.71809 31.2461 9.42214 30.0583 10.2555 28.9631C14.1818 24.134 17.5815 23.5698 18.2526 23.5991C19.9738 23.5991 20.4205 25.83 20.4188 25.8097C20.4253 25.9047 20.4509 25.9974 20.4939 26.0824C20.5369 26.1673 20.5966 26.2427 20.6692 26.3042C20.7419 26.3658 20.8262 26.412 20.9171 26.4404C21.008 26.4688 21.1037 26.4786 21.1984 26.4694C21.2932 26.4601 21.3851 26.4319 21.4688 26.3865C21.5525 26.3411 21.6263 26.2794 21.6857 26.205C21.7451 26.1306 21.789 26.045 21.8148 25.9534C21.8405 25.8617 21.8477 25.7658 21.8357 25.6713C21.8323 25.6516 21.8391 24.9423 21.5443 24.2685C21.2749 23.391 20.4992 22.5753 20.0475 22.2744C19.4907 21.8863 18.7532 21.6787 17.8842 21.6787C15.3867 21.6787 11.8035 23.3898 8.30647 27.4336ZM34.0273 34.4818C34.0088 26.6169 35.0067 24.8321 35.0803 24.9688C35.4612 25.6764 36.2813 30.1044 34.0431 34.9447L34.0273 34.4818ZM21.0792 42.2088C21.1084 40.1276 23.6959 38.8198 24.3906 40.2682C24.4474 40.3863 24.4862 40.5202 24.5228 40.6518C24.4024 41.0343 24.354 41.652 23.9473 42.4895C23.5182 43.3743 22.8437 43.8136 22.257 43.8136C21.6073 43.8136 21.064 43.2759 21.0792 42.2088Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15936_6870" x1="0" y1="0.000488281" x2="0" y2="72.0005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#60B4E7"/>
-<stop offset="1" stop-color="#6461E0"/>
-</linearGradient>
-<clipPath id="clip0_15936_6870">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_15936_6870)" clip-rule="evenodd"><path fill="url(#paint0_linear_15936_6870)" d="M55.969 0H16.03C7.178 0 0 7.178 0 16.032v39.937c0 8.854 7.178 16.032 16.031 16.032H55.97C64.823 72 72 64.823 72 55.969V16.032C72 7.178 64.823 0 55.969 0"/><path fill="#fff" d="M8.306 27.434a19.2 19.2 0 0 0-2.465 4.02 18.6 18.6 0 0 0-1.431 4.68c-1.272 8.98 4.185 10.41 5.115 10.584 4.784.558 8.307-2.049 9.972-3.648.6 2.998 3.593 3.034 4.905 1.68a4.5 4.5 0 0 0 .811-1.211c.778 2.833 3.27 1.868 3.564 1.742 1.39-.52 2.842-2.459 3.87-4.084.653 2.23 1.913 4.617 4.333 4.361 1.459-.035 5.116-3.928 5.454-3.42.337.42.427 1.191.405 2.343-.023 1.151.89 1.21 1.305 1.095.638-.177 1.04-1.438 1.71-2.535.524-.86.915-1.346 1.435-1.918.262-.283 1.45-1.514 2.287-1.095.837.417.923 1.276.981 1.75.064.477.065.982.085 1.535-.024 1.906.87 2.176 1.123 2.246 2.07.56 2.197-3.337 3.715-4.783.143-.148 1.47-1.52 2.227.718 1.094 4.045 4.461 5.557 8.994 3.308.84-.417 1.006-.58 1.465-.922a.45.45 0 0 0 .178-.353v-.005a.44.44 0 0 0-.655-.384l-.003.001c-.464.258-2.007.774-2.495.95-1.83.299-4.07.232-5.173-2.445-.333-.806-.662-1.533-1.23-2.296-.643-.863-2.748-1.89-4.714-.038-.511.469-.888.987-1.215 1.504q-.199.319-.373.637l-.022-.084c-.174-.6-.73-2.815-3.04-3.175-.318-.026-1.604-.172-3.382 1.783-.622.678-1.14 1.4-1.621 2.129l-.002.002c-.085-.396-.188-.757-.29-.915-1.511-2.33-3.8-.47-4.787.224-2.209 1.556-3.233 3.647-4.58-1.103a20 20 0 0 1-.417-2.042c1.342-2.284 4.074-9.233 2.505-13.891-.101-.295-.648-1.798-1.96-1.701-.189.018-1.684-.14-2.501 4.046-.765 4.045-.597 9.26-.41 10.988.02.18.06.533.13.996-1.295 2.217-2.993 4.738-4.028 4.855-1.345.153-.97-1.088-1.791-3.846-.142-.358-.595-2.063-2.636-1.978-.998.041-2.055.302-3.497 1.882-2.343 2.566-7.685 6.426-11.506 4-.415-.322-2.48-2.013-1.72-7.078.226-1.389.652-2.76 1.226-4.04a18 18 0 0 1 2.098-3.54c3.927-4.829 7.326-5.393 7.998-5.364 1.72 0 2.168 2.231 2.166 2.21a.712.712 0 1 0 1.417-.138c-.004-.02.003-.729-.292-1.402-.27-.878-1.045-1.694-1.497-1.995-.556-.388-1.294-.595-2.163-.595-2.497 0-6.08 1.71-9.578 5.755m25.721 7.048c-.018-7.865.98-9.65 1.053-9.513.381.707 1.201 5.135-1.037 9.976zM21.08 42.209c.03-2.081 2.617-3.39 3.312-1.94.056.117.095.251.132.383-.12.382-.169 1-.576 1.837-.429.885-1.103 1.325-1.69 1.325-.65 0-1.193-.538-1.178-1.605"/></g><defs><linearGradient id="paint0_linear_15936_6870" x1="0" x2="0" y1="0" y2="72.001" gradientUnits="userSpaceOnUse"><stop stop-color="#60b4e7"/><stop offset="1" stop-color="#6461e0"/></linearGradient><clipPath id="clip0_15936_6870"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/captivateiq-dark.svg b/web/packages/design/src/ResourceIcon/assets/captivateiq-dark.svg
index 65e891fa97fe9..4c0dc25dc0631 100644
--- a/web/packages/design/src/ResourceIcon/assets/captivateiq-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/captivateiq-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.3123 12.3008C61.4459 12.3008 71.9996 22.8545 71.9996 35.9881C71.9996 44.4311 67.7781 51.936 60.9768 55.9229L65.1983 67.4148H55.8172L52.7683 59.2063C51.3612 59.4408 49.7195 59.6754 48.3123 59.6754C35.1788 59.6754 24.625 49.1216 24.625 35.9881C24.625 22.8545 35.1788 12.3008 48.3123 12.3008ZM48.3123 20.7438C40.8074 20.7438 34.7097 27.5451 34.7097 35.9881C34.7097 44.4311 40.8074 51.2324 48.3123 51.2324C55.8172 51.2324 61.9149 44.4311 61.9149 35.9881C61.9149 27.5451 55.8172 20.7438 48.3123 20.7438Z" fill="white"/>
-<path d="M6.33224 20.5088H0V13.0039H21.5765V20.5088H15.4788V51.4664H21.5765V59.2059H0V51.4664H6.33224V20.5088Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M48.312 12.3A23.62 23.62 0 0 1 72 35.989c0 8.443-4.222 15.948-11.023 19.935l4.221 11.492h-9.38l-3.05-8.209c-1.407.235-3.049.47-4.456.47a23.62 23.62 0 0 1-23.687-23.688 23.62 23.62 0 0 1 23.687-23.687m0 8.444c-7.505 0-13.602 6.801-13.602 15.244s6.097 15.244 13.602 15.244 13.603-6.8 13.603-15.244-6.098-15.244-13.603-15.244" clip-rule="evenodd"/><path fill="#fff" d="M6.332 20.509H0v-7.505h21.577v7.505h-6.098v30.957h6.098v7.74H0v-7.74h6.332z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/captivateiq-light.svg b/web/packages/design/src/ResourceIcon/assets/captivateiq-light.svg
index 8cb0f1f7c43d6..cf225b91179e5 100644
--- a/web/packages/design/src/ResourceIcon/assets/captivateiq-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/captivateiq-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.3123 12.3008C61.4459 12.3008 71.9996 22.8545 71.9996 35.9881C71.9996 44.4311 67.7781 51.936 60.9768 55.9229L65.1983 67.4148H55.8172L52.7683 59.2063C51.3612 59.4408 49.7195 59.6754 48.3123 59.6754C35.1788 59.6754 24.625 49.1216 24.625 35.9881C24.625 22.8545 35.1788 12.3008 48.3123 12.3008ZM48.3123 20.7438C40.8074 20.7438 34.7097 27.5451 34.7097 35.9881C34.7097 44.4311 40.8074 51.2324 48.3123 51.2324C55.8172 51.2324 61.9149 44.4311 61.9149 35.9881C61.9149 27.5451 55.8172 20.7438 48.3123 20.7438Z" fill="black"/>
-<path d="M6.33224 20.5088H0V13.0039H21.5765V20.5088H15.4788V51.4664H21.5765V59.2059H0V51.4664H6.33224V20.5088Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M48.312 12.3A23.62 23.62 0 0 1 72 35.989c0 8.443-4.222 15.948-11.023 19.935l4.221 11.492h-9.38l-3.05-8.209c-1.407.235-3.049.47-4.456.47a23.62 23.62 0 0 1-23.687-23.688 23.62 23.62 0 0 1 23.687-23.687m0 8.444c-7.505 0-13.602 6.801-13.602 15.244s6.097 15.244 13.602 15.244 13.603-6.8 13.603-15.244-6.098-15.244-13.603-15.244" clip-rule="evenodd"/><path fill="#000" d="M6.332 20.509H0v-7.505h21.577v7.505h-6.098v30.957h6.098v7.74H0v-7.74h6.332z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/careerminds-dark.svg b/web/packages/design/src/ResourceIcon/assets/careerminds-dark.svg
index ae8338e0df0f1..bd5246fc6b762 100644
--- a/web/packages/design/src/ResourceIcon/assets/careerminds-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/careerminds-dark.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 36.0005C0 49.2555 10.7452 60.0005 24 60.0005V12.0005C10.7452 12.0005 0 22.7457 0 36.0005Z" fill="white"/>
-<path d="M25.5 37.5005C25.5 49.9269 35.5736 60.0005 48 60.0005V34.5005C48 22.0741 37.9264 12.0005 25.5 12.0005V37.5005Z" fill="white"/>
-<path d="M49.5 37.5005C49.5 49.9269 59.5736 60.0005 72 60.0005V34.5005C72 22.0741 61.9264 12.0005 49.5 12.0005V37.5005Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M0 36c0 13.255 10.745 24 24 24V12C10.745 12 0 22.747 0 36m25.5 1.5C25.5 49.928 35.574 60 48 60V34.5C48 22.075 37.926 12 25.5 12zm24 0C49.5 49.928 59.574 60 72 60V34.5C72 22.075 61.926 12 49.5 12z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/careerminds-light.svg b/web/packages/design/src/ResourceIcon/assets/careerminds-light.svg
index 8153335c9df42..c12c0ceca1e09 100644
--- a/web/packages/design/src/ResourceIcon/assets/careerminds-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/careerminds-light.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 36.0005C0 49.2555 10.7452 60.0005 24 60.0005V12.0005C10.7452 12.0005 0 22.7457 0 36.0005Z" fill="#1D264A"/>
-<path d="M25.5 37.5005C25.5 49.9269 35.5736 60.0005 48 60.0005V34.5005C48 22.0741 37.9264 12.0005 25.5 12.0005V37.5005Z" fill="#C6E8E6"/>
-<path d="M49.5 37.5005C49.5 49.9269 59.5736 60.0005 72 60.0005V34.5005C72 22.0741 61.9264 12.0005 49.5 12.0005V37.5005Z" fill="#C6E8E6"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1d264a" d="M0 36c0 13.255 10.745 24 24 24V12C10.745 12 0 22.747 0 36"/><path fill="#c6e8e6" d="M25.5 37.5C25.5 49.928 35.574 60 48 60V34.5C48 22.075 37.926 12 25.5 12zm24 0C49.5 49.928 59.574 60 72 60V34.5C72 22.075 61.926 12 49.5 12z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/carta-dark.svg b/web/packages/design/src/ResourceIcon/assets/carta-dark.svg
index 0fd791a64736d..3c96e8ad43e8f 100644
--- a/web/packages/design/src/ResourceIcon/assets/carta-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/carta-dark.svg
@@ -1,8 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M13.9065 41.7616C14.5819 42.0423 15.3065 42.1855 16.0379 42.1827C18.178 42.1827 20.0196 41.1862 21.0464 39.3208L19.2236 38.4699C18.9472 39.0033 18.5308 39.4514 18.0192 39.7662C17.5075 40.0809 16.9198 40.2505 16.3191 40.2567C14.5273 40.2567 12.7448 38.9501 12.7448 36.5613C12.7448 34.1176 14.6109 32.8845 16.1785 32.8845C16.7375 32.8803 17.2887 33.016 17.7819 33.2792C18.2751 33.5424 18.6946 33.9248 19.0022 34.3916L20.7847 33.3503C19.8314 31.6775 18.049 30.9607 16.1432 30.9607C13.4788 30.9607 10.5052 33.0446 10.5052 36.5923C10.4965 37.3247 10.6334 38.0515 10.9079 38.7306C11.1825 39.4097 11.5892 40.0275 12.1045 40.548C12.6185 41.0684 13.2311 41.481 13.9065 41.7616Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M21.9096 36.5706C21.9096 39.7383 24.2018 42.1827 27.4207 42.1827C28.9053 42.1827 30.3042 41.5236 31.026 40.5646V41.8842H33.2274V31.2383H31.026V32.5543C30.3395 31.5895 28.9075 30.9607 27.4207 30.9607C24.1809 30.9607 21.9096 33.3402 21.9096 36.5706ZM31.0664 36.5778C31.0664 38.6329 29.6682 40.1615 27.6355 40.1615C25.5574 40.1615 24.1564 38.6112 24.1564 36.5439C24.1564 34.504 25.6029 32.9941 27.6355 32.9941C29.6675 32.9941 31.0664 34.5228 31.0664 36.5778Z" fill="white"/>
-<path d="M44.3499 33.2948V41.8784H46.64V33.2948H48.9914V31.1684H46.64V28.0217H44.3715V31.1677H42.6554V33.2948H44.3499Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.7593 36.5706C49.7593 39.7383 52.0466 42.1827 55.2683 42.1827C56.753 42.1827 58.1518 41.5236 58.8736 40.5646V41.8842H61.0772V31.2383H58.8736V32.5543C58.1872 31.5895 56.7551 30.9607 55.2683 30.9607C52.0278 30.9607 49.7593 33.3402 49.7593 36.5706ZM58.9162 36.5778C58.9162 38.6329 57.5151 40.1615 55.4832 40.1615C53.4058 40.1615 52.0069 38.6112 52.0069 36.5439C52.0069 34.504 53.4505 32.9941 55.4824 32.9941C57.5151 32.9941 58.9162 34.5228 58.9162 36.5778Z" fill="white"/>
-<path d="M35.4952 31.221V41.8669H37.7853V36.9384C37.7853 34.1983 39.2317 32.9985 40.9428 33.1968V31.1381C40.6861 31.0761 40.423 31.0465 40.159 31.0516C38.9433 31.0516 38.0261 31.8758 37.5928 33.0706V31.221H35.4952Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M0 20.0005V51.6164H72V20.0005H0ZM2.1632 49.4532V22.1637H69.8368V49.4532H2.1632Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M13.907 41.762c.675.28 1.4.423 2.13.42 2.141 0 3.983-.996 5.01-2.861l-1.823-.851a3.31 3.31 0 0 1-2.905 1.787c-1.792 0-3.574-1.307-3.574-3.696 0-2.443 1.866-3.676 3.434-3.676a3.35 3.35 0 0 1 2.823 1.507l1.783-1.042c-.954-1.673-2.736-2.39-4.642-2.39-2.664 0-5.638 2.085-5.638 5.632a5.53 5.53 0 0 0 3.401 5.17"/><path fill="#fff" fill-rule="evenodd" d="M21.91 36.57c0 3.168 2.292 5.613 5.51 5.613 1.485 0 2.884-.66 3.606-1.618v1.32h2.201V31.237h-2.201v1.316c-.686-.965-2.119-1.593-3.605-1.593-3.24 0-5.511 2.38-5.511 5.61m9.156.008c0 2.055-1.398 3.583-3.43 3.583-2.079 0-3.48-1.55-3.48-3.617 0-2.04 1.447-3.55 3.48-3.55s3.43 1.529 3.43 3.584" clip-rule="evenodd"/><path fill="#fff" d="M44.35 33.295v8.583h2.29v-8.583h2.351v-2.127H46.64v-3.146h-2.269v3.146h-1.716v2.127z"/><path fill="#fff" fill-rule="evenodd" d="M49.76 36.57c0 3.168 2.287 5.613 5.508 5.613 1.485 0 2.884-.66 3.606-1.618v1.32h2.203V31.237h-2.203v1.316c-.687-.965-2.119-1.593-3.606-1.593-3.24 0-5.509 2.38-5.509 5.61m9.156.008c0 2.055-1.4 3.583-3.433 3.583-2.077 0-3.476-1.55-3.476-3.617 0-2.04 1.444-3.55 3.475-3.55 2.033 0 3.434 1.529 3.434 3.584" clip-rule="evenodd"/><path fill="#fff" d="M35.495 31.221v10.646h2.29v-4.929c0-2.74 1.447-3.94 3.158-3.741v-2.059a3 3 0 0 0-.784-.086c-1.216 0-2.133.824-2.566 2.019v-1.85z"/><path fill="#fff" fill-rule="evenodd" d="M0 20v31.616h72V20.001zm2.163 29.453v-27.29h67.674v27.29z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/carta-light.svg b/web/packages/design/src/ResourceIcon/assets/carta-light.svg
index 35d567b40f3f9..7e50feef5b5be 100644
--- a/web/packages/design/src/ResourceIcon/assets/carta-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/carta-light.svg
@@ -1,8 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M13.9065 41.7616C14.5819 42.0423 15.3065 42.1855 16.0379 42.1827C18.178 42.1827 20.0196 41.1862 21.0464 39.3208L19.2236 38.4699C18.9472 39.0033 18.5308 39.4514 18.0192 39.7662C17.5075 40.0809 16.9198 40.2505 16.3191 40.2567C14.5273 40.2567 12.7448 38.9501 12.7448 36.5613C12.7448 34.1176 14.6109 32.8845 16.1785 32.8845C16.7375 32.8803 17.2887 33.016 17.7819 33.2792C18.2751 33.5424 18.6946 33.9248 19.0022 34.3916L20.7847 33.3503C19.8314 31.6775 18.049 30.9607 16.1432 30.9607C13.4788 30.9607 10.5052 33.0446 10.5052 36.5923C10.4965 37.3247 10.6334 38.0515 10.9079 38.7306C11.1825 39.4097 11.5892 40.0275 12.1045 40.548C12.6185 41.0684 13.2311 41.481 13.9065 41.7616Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M21.9096 36.5706C21.9096 39.7383 24.2018 42.1827 27.4207 42.1827C28.9053 42.1827 30.3042 41.5236 31.026 40.5646V41.8842H33.2274V31.2383H31.026V32.5543C30.3395 31.5895 28.9075 30.9607 27.4207 30.9607C24.1809 30.9607 21.9096 33.3402 21.9096 36.5706ZM31.0664 36.5778C31.0664 38.6329 29.6682 40.1615 27.6355 40.1615C25.5574 40.1615 24.1564 38.6112 24.1564 36.5439C24.1564 34.504 25.6029 32.9941 27.6355 32.9941C29.6675 32.9941 31.0664 34.5228 31.0664 36.5778Z" fill="black"/>
-<path d="M44.3499 33.2948V41.8784H46.64V33.2948H48.9914V31.1684H46.64V28.0217H44.3715V31.1677H42.6554V33.2948H44.3499Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.7593 36.5706C49.7593 39.7383 52.0466 42.1827 55.2683 42.1827C56.753 42.1827 58.1518 41.5236 58.8736 40.5646V41.8842H61.0772V31.2383H58.8736V32.5543C58.1872 31.5895 56.7551 30.9607 55.2683 30.9607C52.0278 30.9607 49.7593 33.3402 49.7593 36.5706ZM58.9162 36.5778C58.9162 38.6329 57.5151 40.1615 55.4832 40.1615C53.4058 40.1615 52.0069 38.6112 52.0069 36.5439C52.0069 34.504 53.4505 32.9941 55.4824 32.9941C57.5151 32.9941 58.9162 34.5228 58.9162 36.5778Z" fill="black"/>
-<path d="M35.4952 31.221V41.8669H37.7853V36.9384C37.7853 34.1983 39.2317 32.9985 40.9428 33.1968V31.1381C40.6861 31.0761 40.423 31.0465 40.159 31.0516C38.9433 31.0516 38.0261 31.8758 37.5928 33.0706V31.221H35.4952Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M0 20.0005V51.6164H72V20.0005H0ZM2.1632 49.4532V22.1637H69.8368V49.4532H2.1632Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M13.907 41.762c.675.28 1.4.423 2.13.42 2.141 0 3.983-.996 5.01-2.861l-1.823-.851a3.31 3.31 0 0 1-2.905 1.787c-1.792 0-3.574-1.307-3.574-3.696 0-2.443 1.866-3.676 3.434-3.676a3.35 3.35 0 0 1 2.823 1.507l1.783-1.042c-.954-1.673-2.736-2.39-4.642-2.39-2.664 0-5.638 2.085-5.638 5.632a5.53 5.53 0 0 0 3.401 5.17"/><path fill="#000" fill-rule="evenodd" d="M21.91 36.57c0 3.168 2.292 5.613 5.51 5.613 1.485 0 2.884-.66 3.606-1.618v1.32h2.201V31.237h-2.201v1.316c-.686-.965-2.119-1.593-3.605-1.593-3.24 0-5.511 2.38-5.511 5.61m9.156.008c0 2.055-1.398 3.583-3.43 3.583-2.079 0-3.48-1.55-3.48-3.617 0-2.04 1.447-3.55 3.48-3.55s3.43 1.529 3.43 3.584" clip-rule="evenodd"/><path fill="#000" d="M44.35 33.295v8.583h2.29v-8.583h2.351v-2.127H46.64v-3.146h-2.269v3.146h-1.716v2.127z"/><path fill="#000" fill-rule="evenodd" d="M49.76 36.57c0 3.168 2.287 5.613 5.508 5.613 1.485 0 2.884-.66 3.606-1.618v1.32h2.203V31.237h-2.203v1.316c-.687-.965-2.119-1.593-3.606-1.593-3.24 0-5.509 2.38-5.509 5.61m9.156.008c0 2.055-1.4 3.583-3.433 3.583-2.077 0-3.476-1.55-3.476-3.617 0-2.04 1.444-3.55 3.475-3.55 2.033 0 3.434 1.529 3.434 3.584" clip-rule="evenodd"/><path fill="#000" d="M35.495 31.221v10.646h2.29v-4.929c0-2.74 1.447-3.94 3.158-3.741v-2.059a3 3 0 0 0-.784-.086c-1.216 0-2.133.824-2.566 2.019v-1.85z"/><path fill="#000" fill-rule="evenodd" d="M0 20v31.616h72V20.001zm2.163 29.453v-27.29h67.674v27.29z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/checkly.svg b/web/packages/design/src/ResourceIcon/assets/checkly.svg
index d04c1bd13b56a..a91da73d20d6d 100644
--- a/web/packages/design/src/ResourceIcon/assets/checkly.svg
+++ b/web/packages/design/src/ResourceIcon/assets/checkly.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7005)">
-<path d="M70.5743 44.9234V15.1051C70.5743 6.76335 63.8114 0.000488281 55.4714 0.000488281H16.5279C8.18704 0.000488281 1.42418 6.76336 1.42418 15.1042V44.9243C0.698177 67.3206 16.1585 66.322 18.4565 66.322L35.9705 67.4809V67.4852H36.0288V67.4809L53.5428 66.322C55.8417 66.322 71.302 67.3232 70.576 44.9243L70.5743 44.9234Z" fill="#0075FF"/>
-<path d="M46.1366 35.0486C63.1294 23.3598 64.4229 33.0258 57.5966 47.6975L57.5992 47.6992C55.4786 51.4578 60.1243 52.9878 64.0517 53.5132C64.0535 53.5158 61.68 60.7972 56.5714 64.9475L47.8029 67.0218L44.9734 67.9072C44.9503 67.909 41.0074 69.0952 40.4134 69.2615L31.5934 69.2598C30.9985 69.0927 27.0557 67.9055 27.0334 67.9055L24.2048 67.0192L15.4354 64.945C10.3268 60.7947 7.95251 53.5132 7.95508 53.5107C11.8799 52.9861 16.5282 51.4552 14.4068 47.6975C7.58137 33.0241 8.87394 23.3598 25.8677 35.0486C29.0485 33.7252 32.0151 33.4569 35.9494 33.3738C35.9582 33.3754 35.9671 33.376 35.976 33.3755H36.0548C39.9891 33.4595 42.9531 33.7252 46.1366 35.0486Z" fill="white"/>
-<path d="M14.8401 33.1908C14.5761 33.2465 14.3103 33.3237 14.0823 33.4702C13.3478 33.946 13.5192 35.0345 13.5801 35.776C13.6975 37.1945 14.0086 38.6165 14.3798 40.0008C14.6339 40.9693 14.9626 41.9167 15.3629 42.8345C15.81 42.1428 16.3097 41.4865 16.8578 40.8717C17.2766 40.3987 17.7189 39.9469 18.1829 39.5182C20.6155 37.2682 23.0369 36.1497 23.0369 36.1497C20.7012 34.4705 17.8512 32.5411 14.8426 33.1882L14.8401 33.1908ZM57.1598 33.1908C57.4238 33.2465 57.6895 33.3237 57.9176 33.4702C58.6521 33.946 58.4807 35.0345 58.4207 35.776C58.3033 37.1945 57.9921 38.6165 57.6201 40.0008C57.3659 40.9693 57.0373 41.9167 56.637 42.8345C56.1902 42.1428 55.6907 41.4866 55.143 40.8717C54.7239 40.3986 54.2813 39.9469 53.817 39.5182C51.3844 37.2682 48.9638 36.1497 48.9638 36.1497C51.2987 34.4705 54.1487 32.5411 57.1581 33.1882L57.1598 33.1908ZM40.4018 69.244L40.3675 69.1669C39.9038 68.1229 38.9567 67.3729 37.899 66.9846C36.65 66.5331 35.2812 66.541 34.0375 67.0069C33.0004 67.4011 32.0918 68.1434 31.6298 69.1669L31.5964 69.244C31.5936 69.2489 31.5914 69.2541 31.5895 69.2594C32.5204 70.7809 34.1438 71.98 35.9721 72.0006H36.0261C37.857 71.9826 39.477 70.7851 40.4104 69.262C40.4077 69.2568 40.4054 69.2513 40.4035 69.2457L40.4018 69.244ZM33.7487 54.0494C33.3308 53.5955 32.854 53.1997 32.3309 52.8725C31.7676 52.5202 31.1657 52.2338 30.5369 52.0188C29.868 51.79 29.1763 51.6342 28.4738 51.5543C27.7349 51.4703 26.9867 51.4685 26.2469 51.55C25.4695 51.6331 24.7006 51.8088 23.9635 52.0703C23.1766 52.3497 22.4258 52.726 21.7289 53.1863C20.9671 53.6934 20.27 54.2915 19.6529 54.9674C18.9518 55.7294 18.3501 56.5788 17.8384 57.4788C17.2478 58.5318 16.7637 59.641 16.3932 60.79C15.956 62.1455 15.6331 63.5352 15.4281 64.9446C15.3972 65.1546 15.3655 65.362 15.3363 65.5754V65.5669C15.3158 65.6997 15.2618 66.004 15.2438 66.196C19.1841 66.6537 23.1226 67.192 27.0269 67.9043C26.9592 67.8931 27.4684 65.6911 27.5327 65.4674C27.6964 64.8863 27.8969 64.3111 28.1764 63.7746C28.5689 63.0194 29.1209 62.3886 29.8427 61.9351C30.5147 61.5134 31.2604 61.2271 31.9641 60.8637C32.7707 60.4471 33.5464 59.9448 34.1952 59.3063C34.8338 58.6823 35.0412 57.9837 35.0318 57.0974C35.0231 56.5405 34.9051 55.9906 34.6847 55.4791C34.4541 54.9536 34.1381 54.4699 33.7495 54.0477L33.7487 54.0494ZM56.7544 66.196C56.7338 66.0014 56.6824 65.6997 56.6618 65.5669V65.5754C56.6353 65.3611 56.6018 65.1546 56.5693 64.9446C56.3645 63.5352 56.0419 62.1455 55.605 60.79C55.2337 59.641 54.7496 58.5316 54.1598 57.478C53.6481 56.5788 53.0455 55.7294 52.3453 54.9666C51.7273 54.2916 51.0299 53.6938 50.2684 53.1863C49.5721 52.7245 48.822 52.3498 48.0347 52.0703C47.2975 51.8088 46.5287 51.6331 45.7512 51.55C45.0108 51.4691 44.2637 51.4705 43.5235 51.5543C42.8212 51.6331 42.1296 51.7889 41.4612 52.0188C40.8347 52.2348 40.2278 52.5185 39.6672 52.8725C39.1439 53.1996 38.6668 53.5954 38.2487 54.0494C37.8593 54.4711 37.5432 54.9549 37.3135 55.4808C37.0919 55.9923 36.9739 56.5426 36.9664 57.1C36.9578 57.9854 37.1644 58.6823 37.8021 59.3088C38.4518 59.9466 39.2275 60.4488 40.0341 60.8663C40.737 61.2297 41.4835 61.5134 42.1555 61.9377C42.8772 62.3903 43.4292 63.022 43.8218 63.7771C44.0987 64.3137 44.3018 64.888 44.4664 65.47C44.529 65.6929 45.039 67.8957 44.9712 67.9069C48.8755 67.1946 52.8141 66.6554 56.7544 66.1977V66.196Z" fill="#002F66"/>
-<path d="M28.451 59.212C28.6813 59.212 28.9093 59.1667 29.1221 59.0785C29.3349 58.9904 29.5282 58.8612 29.691 58.6984C29.8539 58.5355 29.9831 58.3422 30.0712 58.1294C30.1593 57.9167 30.2047 57.6886 30.2047 57.4583C30.2047 57.228 30.1593 57 30.0712 56.7872C29.9831 56.5744 29.8539 56.3811 29.691 56.2182C29.5282 56.0554 29.3349 55.9262 29.1221 55.8381C28.9093 55.75 28.6813 55.7046 28.451 55.7046C27.9859 55.7046 27.5398 55.8894 27.2109 56.2182C26.882 56.5471 26.6973 56.9932 26.6973 57.4583C26.6973 57.9234 26.882 58.3695 27.2109 58.6984C27.5398 59.0273 27.9859 59.212 28.451 59.212ZM43.5479 59.212C43.7782 59.212 44.0062 59.1667 44.219 59.0785C44.4318 58.9904 44.6251 58.8612 44.7879 58.6984C44.9508 58.5355 45.08 58.3422 45.1681 58.1294C45.2562 57.9167 45.3016 57.6886 45.3016 57.4583C45.3016 57.228 45.2562 57 45.1681 56.7872C45.08 56.5744 44.9508 56.3811 44.7879 56.2182C44.6251 56.0554 44.4318 55.9262 44.219 55.8381C44.0062 55.75 43.7782 55.7046 43.5479 55.7046C43.0827 55.7046 42.6367 55.8894 42.3078 56.2182C41.9789 56.5471 41.7941 56.9932 41.7941 57.4583C41.7941 57.9234 41.9789 58.3695 42.3078 58.6984C42.6367 59.0273 43.0827 59.212 43.5479 59.212Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7005">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_7005)"><path fill="#0075ff" d="M70.574 44.923V15.105C70.574 6.763 63.811 0 55.471 0H16.528C8.187 0 1.424 6.763 1.424 15.104v29.82C.698 67.321 16.16 66.322 18.457 66.322l17.514 1.159v.004h.058v-.004l17.514-1.159c2.299 0 17.759 1.001 17.033-21.398z"/><path fill="#fff" d="M46.137 35.049c16.992-11.69 18.286-2.023 11.46 12.648l.002.002c-2.12 3.759 2.525 5.289 6.453 5.814.001.003-2.372 7.284-7.48 11.435l-8.77 2.074-2.829.885c-.023.002-3.966 1.188-4.56 1.355l-8.82-.002c-.594-.167-4.537-1.355-4.56-1.355l-2.828-.886-8.77-2.074c-5.108-4.15-7.482-11.432-7.48-11.434 3.925-.525 8.573-2.056 6.452-5.814C7.58 33.024 8.874 23.36 25.867 35.05c3.182-1.324 6.148-1.592 10.082-1.675l.027.002h.079c3.934.084 6.898.35 10.082 1.673"/><path fill="#002f66" d="M14.84 33.19c-.264.056-.53.134-.758.28-.734.476-.563 1.565-.502 2.306.117 1.418.429 2.84.8 4.225.254.968.583 1.916.983 2.834q.672-1.04 1.495-1.963.628-.71 1.325-1.354c2.433-2.25 4.854-3.368 4.854-3.368-2.336-1.68-5.186-3.609-8.194-2.962zm42.32 0c.264.056.53.134.758.28.734.476.563 1.565.503 2.306-.118 1.418-.429 2.84-.8 4.225a19.4 19.4 0 0 1-.984 2.834 16 16 0 0 0-1.494-1.963 19 19 0 0 0-1.326-1.354c-2.433-2.25-4.853-3.368-4.853-3.368 2.335-1.68 5.185-3.609 8.194-2.962zM40.402 69.245l-.035-.077c-.463-1.044-1.41-1.794-2.468-2.182a5.6 5.6 0 0 0-3.861.022c-1.038.394-1.946 1.136-2.408 2.16l-.034.077-.006.015c.93 1.522 2.554 2.721 4.382 2.742h.054c1.831-.018 3.451-1.216 4.384-2.739l-.006-.016zM33.749 54.05a7 7 0 0 0-1.418-1.176 8.7 8.7 0 0 0-1.794-.854 9.8 9.8 0 0 0-2.063-.465 10 10 0 0 0-2.227-.004 10 10 0 0 0-2.283.52 10.3 10.3 0 0 0-2.235 1.116 11.3 11.3 0 0 0-2.076 1.781 13.7 13.7 0 0 0-1.815 2.512 18 18 0 0 0-1.445 3.311 25.5 25.5 0 0 0-.965 4.155c-.03.21-.062.417-.092.63v-.008c-.02.133-.074.437-.092.629 3.94.458 7.879.996 11.783 1.708-.068-.01.441-2.213.506-2.437a9 9 0 0 1 .643-1.692 4.7 4.7 0 0 1 1.667-1.84c.672-.422 1.417-.708 2.121-1.071.807-.417 1.582-.92 2.231-1.558.639-.624.846-1.322.837-2.209a4.3 4.3 0 0 0-.347-1.618 5.2 5.2 0 0 0-.936-1.431zm23.005 12.147c-.02-.195-.072-.496-.092-.63v.01c-.027-.215-.06-.421-.093-.631a25.5 25.5 0 0 0-.964-4.155 18.3 18.3 0 0 0-1.445-3.312 13.8 13.8 0 0 0-1.815-2.511 11.4 11.4 0 0 0-2.077-1.78 10.2 10.2 0 0 0-2.233-1.117 10 10 0 0 0-2.284-.52c-.74-.08-1.487-.08-2.227.004a9.7 9.7 0 0 0-2.063.465c-.626.216-1.233.5-1.794.854a7 7 0 0 0-1.418 1.176c-.39.422-.706.906-.936 1.432a4.2 4.2 0 0 0-.347 1.619c-.008.885.198 1.582.836 2.209.65.638 1.425 1.14 2.232 1.557.703.364 1.45.647 2.122 1.072.721.452 1.273 1.084 1.666 1.84.277.536.48 1.11.644 1.692.063.223.573 2.426.505 2.437 3.905-.712 7.843-1.252 11.783-1.71z"/><path fill="#fff" d="M28.451 59.212a1.752 1.752 0 1 0 0-3.505 1.752 1.752 0 0 0 0 3.505m15.097 0a1.752 1.752 0 1 0 0-3.505 1.752 1.752 0 0 0 0 3.505"/></g><defs><clipPath id="clip0_15936_7005"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/checkr.svg b/web/packages/design/src/ResourceIcon/assets/checkr.svg
index 77a7bf6f63ef1..e66fb5b12a981 100644
--- a/web/packages/design/src/ResourceIcon/assets/checkr.svg
+++ b/web/packages/design/src/ResourceIcon/assets/checkr.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 8.00049C0 3.58221 3.58172 0.000488281 8 0.000488281H64C68.4183 0.000488281 72 3.58221 72 8.00049V64.0005C72 68.4188 68.4183 72.0005 64 72.0005H8C3.58172 72.0005 0 68.4188 0 64.0005V8.00049Z" fill="#009BB5"/>
-<path d="M37.1476 47.9581C30.8292 47.9581 25.9872 42.7027 25.9872 35.9709C25.9872 29.2393 30.7702 24.1019 37.1476 24.1019C41.5763 24.1019 45.5327 26.4048 47.4813 30.5973L58.2285 26.8771C54.8626 18.374 46.9498 13.0005 37.2657 13.0005C23.9795 13.0005 14 22.8028 14 35.8527C14 48.9027 24.0385 59.0005 37.0886 59.0005C46.9498 59.0005 55.0987 53.3908 58.3464 44.5922L47.4222 40.8129C45.7688 45.2416 41.6944 47.9581 37.1476 47.9581Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#009bb5" d="M0 8a8 8 0 0 1 8-8h56a8 8 0 0 1 8 8v56a8 8 0 0 1-8 8H8a8 8 0 0 1-8-8z"/><path fill="#fff" d="M37.148 47.958c-6.319 0-11.16-5.255-11.16-11.987S30.77 24.1 37.147 24.1c4.428 0 8.385 2.304 10.333 6.496l10.747-3.72C54.862 18.373 46.949 13 37.265 13 23.98 13 14 22.803 14 35.853S24.039 59 37.089 59c9.86 0 18.01-5.61 21.257-14.409l-10.924-3.78c-1.653 4.43-5.728 7.146-10.274 7.146"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/chillipiper.svg b/web/packages/design/src/ResourceIcon/assets/chillipiper.svg
index 43ab29f20e858..ee8682f97ef8c 100644
--- a/web/packages/design/src/ResourceIcon/assets/chillipiper.svg
+++ b/web/packages/design/src/ResourceIcon/assets/chillipiper.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7027)">
-<path d="M64.5773 19.7596C64.1804 20.4472 63.3055 20.6469 62.5947 20.293C58.3293 18.1691 53.7174 16.7521 48.9957 16.1074C48.3131 16.0142 47.9022 15.2872 48.1433 14.6419C48.2864 14.2584 48.6365 13.9813 49.0457 13.9666C50.5074 13.914 51.9732 13.9781 53.4247 14.1585C54.0709 14.2388 54.7155 13.9434 55.0209 13.3683C56.8134 9.99139 57.9151 6.1911 58.136 2.15611C58.153 1.8434 58.2558 1.54012 58.4449 1.29059C58.6417 1.03135 58.8428 0.775799 59.0486 0.524039C59.8038 -0.400524 61.2241 -0.0403909 61.4466 1.13247C62.2833 5.54594 62.0181 10.1554 60.6662 14.4424C60.4089 15.2586 60.7991 16.1494 61.5738 16.513C62.4317 16.9157 63.265 17.3619 64.071 17.8489C64.7309 18.2476 64.9626 19.0919 64.5773 19.7596Z" fill="#FF5721"/>
-<path d="M47.5121 40.1875C46.5087 39.8932 46.116 38.7021 46.6878 37.8268C49.0513 34.2088 50.9528 30.5539 52.5719 26.402C52.7752 25.8804 52.5815 25.2814 52.0854 25.0216C50.3985 24.1383 49.0031 24.0459 47.2146 23.9442C47.1242 23.9389 47.0339 23.9341 46.9431 23.9295C46.5107 23.908 46.1319 24.2075 46.0329 24.6289C45.7983 25.6532 45.5371 26.6698 45.2522 27.678C44.7469 29.4675 44.1641 31.2297 43.5089 32.9632C43.0471 34.184 42.5489 35.3901 42.0159 36.5805C41.6696 37.3538 40.7612 37.6939 39.9947 37.3328C38.8225 36.7807 37.6708 36.1849 36.5423 35.5479C35.8672 35.1668 35.5952 34.3409 35.8742 33.6176C36.7202 31.4244 37.4604 29.1784 38.0885 26.887C38.3234 26.0342 38.5414 25.1746 38.7444 24.3093C38.7785 24.1642 38.8121 24.0186 38.8448 23.8735C38.8539 23.8344 38.8628 23.7953 38.8716 23.7563L38.8805 23.7169L38.8807 23.7157L38.8891 23.6783C38.8907 23.6708 38.8924 23.6634 38.8941 23.6559C38.8955 23.6497 38.8969 23.6434 38.8984 23.6372C39.0068 23.1534 39.1102 22.6678 39.2087 22.1803C39.5801 20.3427 41.1279 18.9301 43.002 18.9887C51.2886 19.2477 59.227 21.8152 66.0436 26.3815C67.4705 27.3373 67.9943 29.1673 67.3354 30.7533C66.7781 32.0951 66.1811 33.4161 65.5453 34.7151C64.6513 36.5436 63.6807 38.3279 62.6382 40.0642C61.8045 41.4528 60.2741 42.2711 58.6579 42.1643C54.9221 41.9178 51.1849 41.2645 47.5121 40.1875Z" fill="#FF5721"/>
-<path d="M37.6725 41.513C38.5114 41.931 38.8368 42.9749 38.3335 43.7653C36.753 46.247 35.0153 48.6285 33.1417 50.8968C32.6167 51.5324 33.4416 52.441 34.0639 51.9002C36.7388 49.5756 39.2554 47.0688 41.5817 44.3956C42.0202 43.8917 42.7246 43.7109 43.3534 43.9361C47.27 45.3384 51.2815 46.2427 55.306 46.6712C56.3411 46.7814 56.8686 47.9993 56.1833 48.7829C53.1647 52.2338 49.819 55.3904 46.194 58.205C44.7004 59.3647 42.8009 59.8835 40.9343 59.58C35.588 58.7105 30.4012 56.8726 25.7084 54.1665C24.8753 53.6859 24.7141 52.5673 25.3272 51.8261C25.6403 51.4477 25.9495 51.0658 26.2548 50.6808C28.7251 47.5667 30.9334 44.2471 32.8516 40.7662C33.2908 39.9692 34.3046 39.6884 35.0956 40.1387C35.9416 40.6203 36.801 41.0788 37.6725 41.513Z" fill="#FF5721"/>
-<path d="M20.3875 57.6726C20.9378 57.1647 21.7663 57.1023 22.392 57.5134C26.2868 60.0712 30.5821 62.0034 35.0732 63.2409C35.8668 63.4595 36.0039 64.5516 35.2633 64.9109C34.3635 65.3478 33.4533 65.7659 32.5331 66.1654C31.0176 66.8233 29.4754 67.43 27.9077 67.9839C20.9572 70.4377 13.6292 71.7831 6.26598 71.9995C4.19014 72.0605 3.67047 69.2255 5.50334 68.2493C7.41212 67.2324 9.27448 66.1287 11.0825 64.9423C14.3782 62.781 17.4919 60.3454 20.3875 57.6726Z" fill="#FF5721"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7027">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#ff5721" clip-path="url(#clip0_15936_7027)"><path d="M64.577 19.76c-.397.687-1.271.887-1.982.533a43.9 43.9 0 0 0-13.6-4.186c-.682-.093-1.093-.82-.852-1.465.143-.384.493-.66.903-.675a27.5 27.5 0 0 1 4.379.191c.646.08 1.29-.215 1.596-.79a27 27 0 0 0 3.115-11.212 1.57 1.57 0 0 1 .309-.865q.295-.39.604-.767a1.349 1.349 0 0 1 2.398.608 27.44 27.44 0 0 1-.78 13.31 1.72 1.72 0 0 0 .907 2.071q1.287.605 2.497 1.336a1.41 1.41 0 0 1 .506 1.91M47.512 40.188c-1.003-.295-1.396-1.486-.824-2.361a61 61 0 0 0 5.884-11.425c.203-.522.01-1.12-.487-1.38-1.687-.884-3.082-.976-4.87-1.078l-.272-.014a.896.896 0 0 0-.91.699 64.6 64.6 0 0 1-4.017 11.952 1.51 1.51 0 0 1-2.021.752 53 53 0 0 1-3.453-1.785c-.675-.381-.947-1.207-.668-1.93a70.5 70.5 0 0 0 2.998-9.862l.008-.04.01-.038q0-.011.004-.022l.004-.019q.163-.726.31-1.457c.372-1.837 1.92-3.25 3.794-3.191a43.75 43.75 0 0 1 23.042 7.392c1.427.956 1.95 2.786 1.291 4.372a71 71 0 0 1-4.697 9.311 4.32 4.32 0 0 1-3.98 2.1 51.7 51.7 0 0 1-11.146-1.977m-9.839 1.326c.838.418 1.164 1.462.66 2.252a72 72 0 0 1-5.191 7.132c-.525.635.3 1.544.922 1.003a76 76 0 0 0 7.518-7.504 1.62 1.62 0 0 1 1.771-.46 51.7 51.7 0 0 0 11.953 2.735c1.035.11 1.563 1.328.877 2.112a71.7 71.7 0 0 1-9.989 9.422c-1.494 1.16-3.393 1.678-5.26 1.375a45 45 0 0 1-15.226-5.413c-.833-.481-.994-1.6-.38-2.34q.469-.57.927-1.146a71.4 71.4 0 0 0 6.597-9.915 1.64 1.64 0 0 1 2.244-.627q1.269.722 2.577 1.374m-17.285 16.16a1.635 1.635 0 0 1 2.004-.16 44.8 44.8 0 0 0 12.681 5.728c.794.218.93 1.31.19 1.67a71 71 0 0 1-7.355 3.073A71.4 71.4 0 0 1 6.266 72c-2.076.06-2.596-2.775-.763-3.75a71 71 0 0 0 5.58-3.308 71.7 71.7 0 0 0 9.305-7.27"/></g><defs><clipPath id="clip0_15936_7027"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cilium-dark.svg b/web/packages/design/src/ResourceIcon/assets/cilium-dark.svg
index 52ffaa0e2c090..ba9b93c955620 100644
--- a/web/packages/design/src/ResourceIcon/assets/cilium-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cilium-dark.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.968 39.5996H52.2313L46.7997 49.1139L52.2313 58.4995H62.968L68.3994 49.1139L62.968 39.5996Z" fill="#8061A9"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.968 14.3994H52.2313L46.7997 23.9136L52.2313 33.2992H62.968L68.3994 23.9136L62.968 14.3994Z" fill="#F17323"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 2.39941H30.6313L25.1997 11.9136L30.6313 21.2992H41.368L46.7997 11.9136L41.368 2.39941Z" fill="#F8C517"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.7684 14.3994H9.03171L3.60007 23.9136L9.03171 33.2992H19.7684L25.1999 23.9136L19.7684 14.3994Z" fill="#CADD72"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 27H30.6313L25.1997 36.5143L30.6313 45.8999H41.368L46.7997 36.5143L41.368 27Z" fill="#E82629"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.7684 39.5996H9.03171L3.60007 49.1139L9.03171 58.4995H19.7684L25.1999 49.1139L19.7684 39.5996Z" fill="#98C93E"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 51.5996H30.6313L25.1997 61.1139L30.6313 70.4995H41.368L46.7997 61.1139L41.368 51.5996Z" fill="#628AC6"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#8061a9" fill-rule="evenodd" d="M62.968 39.6H52.231L46.8 49.114l5.43 9.386h10.737l5.431-9.386z" clip-rule="evenodd"/><path fill="#f17323" fill-rule="evenodd" d="M62.968 14.4H52.231L46.8 23.913l5.431 9.385h10.737l5.431-9.385z" clip-rule="evenodd"/><path fill="#f8c517" fill-rule="evenodd" d="M41.368 2.4H30.631L25.2 11.913l5.431 9.385h10.737l5.432-9.385z" clip-rule="evenodd"/><path fill="#cadd72" fill-rule="evenodd" d="M19.768 14.4H9.032L3.6 23.913l5.432 9.385h10.736l5.432-9.385z" clip-rule="evenodd"/><path fill="#e82629" fill-rule="evenodd" d="M41.368 27H30.631L25.2 36.514l5.43 9.386h10.737l5.432-9.386z" clip-rule="evenodd"/><path fill="#98c93e" fill-rule="evenodd" d="M19.768 39.6H9.032L3.6 49.114 9.032 58.5h10.736l5.432-9.386z" clip-rule="evenodd"/><path fill="#628ac6" fill-rule="evenodd" d="M41.368 51.6H30.631L25.2 61.114l5.43 9.386h10.737l5.432-9.386z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cilium-light.svg b/web/packages/design/src/ResourceIcon/assets/cilium-light.svg
index 08528502ec132..c7445b4eb204b 100644
--- a/web/packages/design/src/ResourceIcon/assets/cilium-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cilium-light.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.968 39.5996H52.2313L46.7996 49.1139L52.2313 58.4995H62.968L68.3994 49.1139L62.968 39.5996Z" fill="#8061A9"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.968 14.3994H52.2313L46.7996 23.9136L52.2313 33.2992H62.968L68.3994 23.9136L62.968 14.3994Z" fill="#F17323"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 2.39941H30.6313L25.1997 11.9136L30.6313 21.2992H41.368L46.7996 11.9136L41.368 2.39941Z" fill="#F8C517"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.7684 14.3994H9.0317L3.60007 23.9136L9.0317 33.2992H19.7684L25.1999 23.9136L19.7684 14.3994Z" fill="#CADD72"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 27H30.6313L25.1997 36.5143L30.6313 45.8999H41.368L46.7996 36.5143L41.368 27Z" fill="#E82629"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.7684 39.5996H9.0317L3.60007 49.1139L9.0317 58.4995H19.7684L25.1999 49.1139L19.7684 39.5996Z" fill="#98C93E"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.368 51.5996H30.6313L25.1997 61.1139L30.6313 70.4995H41.368L46.7996 61.1139L41.368 51.5996Z" fill="#628AC6"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M40.822 44.3502H31.1779L26.299 36.0574L31.1779 27.6509H40.822L45.7008 36.0574L40.822 44.3502ZM42.5612 24.6006H29.4L22.8 36.0391L29.4 47.4005H42.5612L49.1997 36.0391L42.5612 24.6006Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.3998 49.2002L22.8 60.6387L29.3998 71.9999H42.5612L49.1997 60.6387L42.5612 49.2002H29.3998ZM26.2987 60.657L31.1777 52.2505H40.8218L45.7008 60.657L40.8218 68.9498H31.1777L26.2987 60.657Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.3998 0L22.8 11.4386L29.3998 22.7997H42.5612L49.1997 11.4386L42.5612 0H29.3998ZM26.2987 11.4566L31.1777 3.05028H40.8218L45.7008 11.4566L40.8218 19.7495H31.1777L26.2987 11.4566Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.9995 37.2002L44.3996 48.6387L50.9995 59.9999H64.1608L70.7993 48.6387L64.1608 37.2002H50.9995ZM47.8987 48.6568L52.7775 40.2503H62.4216L67.3003 48.6568L62.4216 56.9498H52.7775L47.8987 48.6568Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.9995 12L44.3996 23.4387L50.9995 34.7999H64.1608L70.7993 23.4387L64.1608 12H50.9995ZM47.8987 23.4568L52.7775 15.0503H62.4216L67.3003 23.4568L62.4216 31.7496H52.7775L47.8987 23.4568Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M7.79984 37.2002L1.2 48.6387L7.79984 59.9999H20.9613L27.5997 48.6387L20.9613 37.2002H7.79984ZM4.69894 48.6568L9.57773 40.2503H19.2219L24.1008 48.6568L19.2219 56.9498H9.57773L4.69894 48.6568Z" fill="#363736"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M7.79984 12L1.2 23.4387L7.79984 34.7999H20.9613L27.5997 23.4387L20.9613 12H7.79984ZM4.69894 23.4568L9.57773 15.0503H19.2219L24.1008 23.4568L19.2219 31.7496H9.57773L4.69894 23.4568Z" fill="#363736"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#8061a9" fill-rule="evenodd" d="M62.968 39.6H52.231L46.8 49.114l5.43 9.386h10.737l5.431-9.386z" clip-rule="evenodd"/><path fill="#f17323" fill-rule="evenodd" d="M62.968 14.4H52.231L46.8 23.913l5.431 9.385h10.737l5.431-9.385z" clip-rule="evenodd"/><path fill="#f8c517" fill-rule="evenodd" d="M41.368 2.4H30.631L25.2 11.913l5.431 9.385h10.737l5.432-9.385z" clip-rule="evenodd"/><path fill="#cadd72" fill-rule="evenodd" d="M19.768 14.4H9.032L3.6 23.913l5.432 9.385h10.736l5.432-9.385z" clip-rule="evenodd"/><path fill="#e82629" fill-rule="evenodd" d="M41.368 27H30.631L25.2 36.514l5.43 9.386h10.737l5.432-9.386z" clip-rule="evenodd"/><path fill="#98c93e" fill-rule="evenodd" d="M19.768 39.6H9.032L3.6 49.114 9.032 58.5h10.736l5.432-9.386z" clip-rule="evenodd"/><path fill="#628ac6" fill-rule="evenodd" d="M41.368 51.6H30.631L25.2 61.114l5.43 9.386h10.737l5.432-9.386z" clip-rule="evenodd"/><path fill="#363736" fill-rule="evenodd" d="M40.822 44.35h-9.644l-4.879-8.293 4.879-8.406h9.644l4.879 8.406zm1.74-19.75H29.4l-6.6 11.44 6.6 11.36h13.161L49.2 36.04zM29.4 49.2l-6.6 11.44L29.4 72h13.16l6.64-11.36-6.64-11.44zm-3.101 11.457 4.879-8.406h9.644l4.879 8.406-4.88 8.293h-9.643zM29.4 0l-6.6 11.439 6.6 11.36h13.16L49.2 11.44 42.56 0zm-3.101 11.457 4.879-8.407h9.644l4.879 8.407-4.88 8.293h-9.643zM51 37.2l-6.6 11.44L51 60h13.16l6.64-11.36-6.64-11.44zm-3.101 11.457 4.879-8.407h9.644l4.878 8.407-4.878 8.293h-9.644zM51 12l-6.6 11.439 6.6 11.36h13.16l6.64-11.36L64.16 12zm-3.101 11.457 4.879-8.407h9.644l4.878 8.407-4.878 8.293h-9.644zM7.8 37.2 1.2 48.64 7.8 60h13.16l6.64-11.36-6.64-11.44zM4.699 48.657l4.879-8.407h9.644l4.879 8.407-4.88 8.293H9.579zM7.8 12 1.2 23.439l6.6 11.36h13.16L27.6 23.44 20.96 12zM4.699 23.457l4.879-8.407h9.644l4.879 8.407-4.88 8.293H9.579z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/circleci-dark.svg b/web/packages/design/src/ResourceIcon/assets/circleci-dark.svg
index 9ed37ddf2e06a..edf6de5137aa5 100644
--- a/web/packages/design/src/ResourceIcon/assets/circleci-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/circleci-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M36.0624 0C19.2907 0 5.21618 11.5138 1.25505 27.0801C1.22821 27.1934 1.20996 27.3088 1.20996 27.4293C1.20996 28.3759 1.97613 29.1433 2.92123 29.1433H17.4023C18.0919 29.1433 18.682 28.7309 18.9543 28.1421C21.9295 21.6525 28.4672 17.1418 36.0624 17.1418C46.4535 17.1418 54.8816 25.5866 54.8816 36.0004C54.8816 46.4146 46.4535 54.8592 36.0624 54.8592C28.4672 54.8592 21.932 50.3479 18.9568 43.8563L18.9543 43.8601C18.682 43.2702 18.0919 42.8584 17.4023 42.8584H2.92123C1.97613 42.8584 1.20996 43.6237 1.20996 44.5729C1.20996 44.69 1.22821 44.802 1.25255 44.9143C5.2126 60.4815 19.2875 72 36.0624 72C55.9035 72 71.991 55.8801 71.991 36.0004C71.991 16.1184 55.9035 0 36.0624 0ZM27.5071 36.0004C27.5071 31.2678 31.3385 27.4293 36.0624 27.4293C40.7861 27.4293 44.6158 31.2678 44.6158 36.0004C44.6158 40.7334 40.7861 44.5729 36.0624 44.5729C31.3385 44.5729 27.5071 40.7334 27.5071 36.0004Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M36.062 0C19.291 0 5.216 11.514 1.255 27.08a1.5 1.5 0 0 0-.045.35c0 .946.766 1.713 1.711 1.713h14.481c.69 0 1.28-.412 1.552-1 2.976-6.49 9.513-11.001 17.108-11.001 10.392 0 18.82 8.445 18.82 18.858 0 10.415-8.428 18.86-18.82 18.86-7.595 0-14.13-4.512-17.105-11.004l-.003.004a1.71 1.71 0 0 0-1.552-1.002H2.922c-.946 0-1.712.766-1.712 1.715 0 .117.018.229.043.341C5.213 60.481 19.288 72 36.063 72c19.84 0 35.928-16.12 35.928-36 0-19.882-16.087-36-35.929-36m-8.555 36c0-4.732 3.831-8.57 8.555-8.57s8.554 3.838 8.554 8.57-3.83 8.573-8.554 8.573c-4.723 0-8.555-3.84-8.555-8.573" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/circleci-light.svg b/web/packages/design/src/ResourceIcon/assets/circleci-light.svg
index 022aa1873c870..cf745484e6fd3 100644
--- a/web/packages/design/src/ResourceIcon/assets/circleci-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/circleci-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M36.0624 0C19.2907 0 5.21618 11.5138 1.25505 27.0801C1.22821 27.1934 1.20996 27.3088 1.20996 27.4293C1.20996 28.3759 1.97613 29.1433 2.92123 29.1433H17.4023C18.0919 29.1433 18.682 28.7309 18.9543 28.1421C21.9295 21.6525 28.4672 17.1418 36.0624 17.1418C46.4535 17.1418 54.8816 25.5866 54.8816 36.0004C54.8816 46.4146 46.4535 54.8592 36.0624 54.8592C28.4672 54.8592 21.932 50.3479 18.9568 43.8563L18.9543 43.8601C18.682 43.2702 18.0919 42.8584 17.4023 42.8584H2.92123C1.97613 42.8584 1.20996 43.6237 1.20996 44.5729C1.20996 44.69 1.22821 44.802 1.25255 44.9143C5.2126 60.4815 19.2875 72 36.0624 72C55.9035 72 71.991 55.8801 71.991 36.0004C71.991 16.1184 55.9035 0 36.0624 0ZM27.5071 36.0004C27.5071 31.2678 31.3385 27.4293 36.0624 27.4293C40.7861 27.4293 44.6158 31.2678 44.6158 36.0004C44.6158 40.7334 40.7861 44.5729 36.0624 44.5729C31.3385 44.5729 27.5071 40.7334 27.5071 36.0004Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M36.062 0C19.291 0 5.216 11.514 1.255 27.08a1.5 1.5 0 0 0-.045.35c0 .946.766 1.713 1.711 1.713h14.481c.69 0 1.28-.412 1.552-1 2.976-6.49 9.513-11.001 17.108-11.001 10.392 0 18.82 8.445 18.82 18.858 0 10.415-8.428 18.86-18.82 18.86-7.595 0-14.13-4.512-17.105-11.004l-.003.004a1.71 1.71 0 0 0-1.552-1.002H2.922c-.946 0-1.712.766-1.712 1.715 0 .117.018.229.043.341C5.213 60.481 19.288 72 36.063 72c19.84 0 35.928-16.12 35.928-36 0-19.882-16.087-36-35.929-36m-8.555 36c0-4.732 3.831-8.57 8.555-8.57s8.554 3.838 8.554 8.57-3.83 8.573-8.554 8.573c-4.723 0-8.555-3.84-8.555-8.573" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/clari.svg b/web/packages/design/src/ResourceIcon/assets/clari.svg
index 69af69994d976..03821518f40cd 100644
--- a/web/packages/design/src/ResourceIcon/assets/clari.svg
+++ b/web/packages/design/src/ResourceIcon/assets/clari.svg
@@ -1,8 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M69.8651 17.0269L47.9727 22.9736C48.8583 27.0809 49.325 31.4357 49.325 36.0048C49.325 40.5739 48.8547 44.9251 47.9727 49.0361L69.8651 54.9829C71.2653 49.0508 72.0002 42.55 72.0002 36.0086C72.0002 29.4672 71.2653 22.9588 69.8651 17.0269Z" fill="#00D7B8"/>
-<path d="M14.4317 10.8813L0 36.0014L22.84 18.8632C20.6496 15.5796 17.7979 12.8759 14.4317 10.8813Z" fill="#5F3AD7"/>
-<path d="M14.4317 61.1261L0 36.0024L22.84 53.1406C20.6496 56.428 17.7979 59.1316 14.4317 61.1261Z" fill="#5F3AD7"/>
-<path d="M40.7606 5.42041L0 36.0041L47.9746 22.9729C46.5708 16.4535 44.1121 10.5509 40.7606 5.42041Z" fill="#0280FF"/>
-<path d="M40.7606 66.5852L0 36.0015L47.9746 49.0329C46.5708 55.5559 44.1121 61.4584 40.7606 66.5852Z" fill="#0280FF"/>
-<path d="M49.3308 36.0016C49.3308 31.4325 48.8604 27.0813 47.9784 22.9702L0 36.0016L47.9746 49.033C48.8641 44.9181 49.3308 40.578 49.3308 36.0016Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#00d7b8" d="m69.865 17.027-21.892 5.947c.885 4.107 1.352 8.462 1.352 13.03 0 4.57-.47 8.921-1.352 13.032l21.892 5.947C71.265 49.05 72 42.55 72 36.009s-.735-13.05-2.135-18.982"/><path fill="#5f3ad7" d="M14.432 10.881 0 36.001l22.84-17.138a26 26 0 0 0-8.408-7.982m0 50.245L0 36.002l22.84 17.139a26 26 0 0 1-8.408 7.985"/><path fill="#0280ff" d="M40.76 5.42 0 36.004l47.975-13.031C46.57 16.453 44.112 10.55 40.76 5.42"/><path fill="#0280ff" d="M40.76 66.585 0 36.002l47.975 13.03c-1.404 6.524-3.863 12.426-7.214 17.553"/><path fill="#fff" d="M49.33 36.002c0-4.57-.47-8.92-1.352-13.032L0 36.002l47.975 13.031c.89-4.115 1.356-8.455 1.356-13.031"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/clearbit.svg b/web/packages/design/src/ResourceIcon/assets/clearbit.svg
index 08934e2edebe7..e4b159124cdb8 100644
--- a/web/packages/design/src/ResourceIcon/assets/clearbit.svg
+++ b/web/packages/design/src/ResourceIcon/assets/clearbit.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 14.0005C0 6.2685 6.26801 0.000488281 14 0.000488281H36V72.0005H14C6.26801 72.0005 0 65.7325 0 58.0005V14.0005Z" fill="url(#paint0_linear_15936_7068)"/>
-<path d="M36 36.0005H72V58.0005C72 65.7325 65.732 72.0005 58 72.0005H36V36.0005Z" fill="url(#paint1_linear_15936_7068)"/>
-<path d="M36 0.000488281H58C65.732 0.000488281 72 6.2685 72 14.0005V36.0005H36V0.000488281Z" fill="url(#paint2_linear_15936_7068)"/>
-<defs>
-<linearGradient id="paint0_linear_15936_7068" x1="18" y1="0.000488281" x2="18" y2="72.0005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#1BA5FD"/>
-<stop offset="1" stop-color="#148DFC"/>
-</linearGradient>
-<linearGradient id="paint1_linear_15936_7068" x1="54" y1="36.0005" x2="54" y2="72.0005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#DEF2FE"/>
-<stop offset="1" stop-color="#DCF1FE"/>
-</linearGradient>
-<linearGradient id="paint2_linear_15936_7068" x1="54" y1="0.000488281" x2="54" y2="36.0005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#56BBFD"/>
-<stop offset="1" stop-color="#51B5FD"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_15936_7068)" d="M0 14C0 6.27 6.268 0 14 0h22v72H14C6.268 72 0 65.734 0 58z"/><path fill="url(#paint1_linear_15936_7068)" d="M36 36h36v22c0 7.733-6.268 14-14 14H36z"/><path fill="url(#paint2_linear_15936_7068)" d="M36 0h22c7.732 0 14 6.269 14 14v22H36z"/><defs><linearGradient id="paint0_linear_15936_7068" x1="18" x2="18" y1="0" y2="72.001" gradientUnits="userSpaceOnUse"><stop stop-color="#1ba5fd"/><stop offset="1" stop-color="#148dfc"/></linearGradient><linearGradient id="paint1_linear_15936_7068" x1="54" x2="54" y1="36.001" y2="72.001" gradientUnits="userSpaceOnUse"><stop stop-color="#def2fe"/><stop offset="1" stop-color="#dcf1fe"/></linearGradient><linearGradient id="paint2_linear_15936_7068" x1="54" x2="54" y1="0" y2="36.001" gradientUnits="userSpaceOnUse"><stop stop-color="#56bbfd"/><stop offset="1" stop-color="#51b5fd"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/clearfeed.svg b/web/packages/design/src/ResourceIcon/assets/clearfeed.svg
index c891beb2a3f2b..9b2331af8aa2d 100644
--- a/web/packages/design/src/ResourceIcon/assets/clearfeed.svg
+++ b/web/packages/design/src/ResourceIcon/assets/clearfeed.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7074)">
-<path d="M66 0.000488281H6C2.68629 0.000488281 0 2.68678 0 6.00049V66.0005C0 69.3142 2.68629 72.0005 6 72.0005H66C69.3137 72.0005 72 69.3142 72 66.0005V6.00049C72 2.68678 69.3137 0.000488281 66 0.000488281Z" fill="url(#paint0_linear_15936_7074)"/>
-<path d="M49.7554 43.8943C52.0478 45.2159 52.8686 48.1973 51.058 50.1271C49.1404 52.1711 46.8176 53.8183 44.219 54.9533C40.1464 56.7319 35.611 57.1583 31.2782 56.1699C26.9456 55.1815 23.0436 52.8305 20.1454 49.4615C17.2471 46.0927 15.505 41.8835 15.1747 37.4517C14.8444 33.0201 15.9433 28.5991 18.3102 24.8379C20.677 21.0765 24.1872 18.1729 28.3256 16.5532C32.464 14.9334 37.0124 14.6828 41.3038 15.8381C44.0418 16.5753 46.5832 17.8601 48.7826 19.5972C50.8592 21.2373 50.4896 24.3073 48.4184 25.9543C46.347 27.6011 43.3438 27.1287 40.9862 25.9271C40.2964 25.5757 39.5684 25.2947 38.8126 25.0913C36.4998 24.4687 34.0486 24.6037 31.8182 25.4767C29.588 26.3495 27.6962 27.9145 26.4206 29.9415C25.145 31.9685 24.5528 34.3511 24.7308 36.7395C24.9088 39.1279 25.8476 41.3965 27.4096 43.2119C28.9716 45.0275 31.0744 46.2947 33.4096 46.8273C35.7446 47.3601 38.1888 47.1303 40.3836 46.1717C41.101 45.8583 41.7794 45.4727 42.4094 45.0227C44.563 43.4851 47.463 42.5727 49.7554 43.8943Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15936_7074" x1="8.64825e-07" y1="1.26049" x2="72" y2="72.0005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#C784DA"/>
-<stop offset="1" stop-color="#6D55FF"/>
-</linearGradient>
-<clipPath id="clip0_15936_7074">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_7074)"><path fill="url(#paint0_linear_15936_7074)" d="M66 0H6a6 6 0 0 0-6 6v60a6 6 0 0 0 6 6h60a6 6 0 0 0 6-6V6a6 6 0 0 0-6-6"/><path fill="#fff" d="M49.755 43.894c2.293 1.322 3.114 4.303 1.303 6.233a20.783 20.783 0 1 1-2.275-30.53c2.076 1.64 1.707 4.71-.365 6.357s-5.074 1.175-7.432-.027a11.2 11.2 0 1 0 1.423 19.096c2.154-1.538 5.054-2.45 7.346-1.129"/></g><defs><linearGradient id="paint0_linear_15936_7074" x1="0" x2="72" y1="1.26" y2="72.001" gradientUnits="userSpaceOnUse"><stop stop-color="#c784da"/><stop offset="1" stop-color="#6d55ff"/></linearGradient><clipPath id="clip0_15936_7074"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/clickhouse-dark.svg b/web/packages/design/src/ResourceIcon/assets/clickhouse-dark.svg
index 3320d994eb435..639b5b73413e0 100644
--- a/web/packages/design/src/ResourceIcon/assets/clickhouse-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/clickhouse-dark.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7349_35924)">
-<path d="M7.1583 0H0.841478C0.376743 0 0 0.376752 0 0.8415V71.1585C0 71.6232 0.376743 72 0.841478 72H7.1583C7.62303 72 7.99978 71.6232 7.99978 71.1585V0.8415C7.99978 0.376752 7.62303 0 7.1583 0Z" fill="#FCFF74"/>
-<path d="M23.1593 0H16.8425C16.3777 0 16.001 0.376752 16.001 0.8415V71.1585C16.001 71.6232 16.3777 72 16.8425 72H23.1593C23.624 72 24.0008 71.6232 24.0008 71.1585V0.8415C24.0008 0.376752 23.624 0 23.1593 0Z" fill="#FCFF74"/>
-<path d="M32.8415 0H39.1583C39.623 0 39.9998 0.376752 39.9998 0.8415V71.1585C39.9998 71.6232 39.623 72 39.1583 72H32.8415C32.3767 72 32 71.6232 32 71.1585V0.8415C32 0.376752 32.3767 0 32.8415 0Z" fill="#FCFF74"/>
-<path d="M55.1563 0H48.8395C48.3748 0 47.998 0.376752 47.998 0.8415V71.1585C47.998 71.6232 48.3748 72 48.8395 72H55.1563C55.6211 72 55.9978 71.6232 55.9978 71.1585V0.8415C55.9978 0.376752 55.6211 0 55.1563 0Z" fill="#FCFF74"/>
-<path d="M64.8415 28.0005H71.1583C71.623 28.0005 71.9998 28.3772 71.9998 28.842V43.159C71.9998 43.6238 71.623 44.0005 71.1583 44.0005H64.8415C64.3767 44.0005 64 43.6238 64 43.159V28.842C64 28.3772 64.3767 28.0005 64.8415 28.0005Z" fill="#FCFF74"/>
-</g>
-<defs>
-<clipPath id="clip0_7349_35924">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fcff74" clip-path="url(#clip0_7349_35924)"><path d="M7.158 0H.841A.84.84 0 0 0 0 .842v70.317c0 .464.377.841.841.841h6.317A.84.84 0 0 0 8 71.159V.84A.84.84 0 0 0 7.158 0M23.16 0h-6.317A.84.84 0 0 0 16 .842v70.317c0 .464.377.841.841.841h6.317a.84.84 0 0 0 .842-.841V.84a.84.84 0 0 0-.841-.84m9.683 0h6.316c.465 0 .842.377.842.842v70.317a.84.84 0 0 1-.842.841h-6.316a.84.84 0 0 1-.842-.841V.84c0-.464.377-.841.842-.841M55.156 0H48.84a.84.84 0 0 0-.842.842v70.317c0 .464.377.841.842.841h6.316a.84.84 0 0 0 .842-.841V.84a.84.84 0 0 0-.842-.84m9.686 28h6.316c.465 0 .842.377.842.842v14.317a.84.84 0 0 1-.842.842h-6.317a.84.84 0 0 1-.841-.842V28.842c0-.465.377-.841.841-.841"/></g><defs><clipPath id="clip0_7349_35924"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/clickhouse-light.svg b/web/packages/design/src/ResourceIcon/assets/clickhouse-light.svg
index 0eaef5486d266..14991254c44ba 100644
--- a/web/packages/design/src/ResourceIcon/assets/clickhouse-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/clickhouse-light.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7349_35925)">
-<path d="M7.1583 0H0.841478C0.376743 0 0 0.376752 0 0.8415V71.1585C0 71.6232 0.376743 72 0.841478 72H7.1583C7.62303 72 7.99978 71.6232 7.99978 71.1585V0.8415C7.99978 0.376752 7.62303 0 7.1583 0Z" fill="black"/>
-<path d="M23.1593 0H16.8425C16.3777 0 16.001 0.376752 16.001 0.8415V71.1585C16.001 71.6232 16.3777 72 16.8425 72H23.1593C23.624 72 24.0008 71.6232 24.0008 71.1585V0.8415C24.0008 0.376752 23.624 0 23.1593 0Z" fill="black"/>
-<path d="M32.8415 0H39.1583C39.623 0 39.9998 0.376752 39.9998 0.8415V71.1585C39.9998 71.6232 39.623 72 39.1583 72H32.8415C32.3767 72 32 71.6232 32 71.1585V0.8415C32 0.376752 32.3767 0 32.8415 0Z" fill="black"/>
-<path d="M55.1563 0H48.8395C48.3748 0 47.998 0.376752 47.998 0.8415V71.1585C47.998 71.6232 48.3748 72 48.8395 72H55.1563C55.6211 72 55.9978 71.6232 55.9978 71.1585V0.8415C55.9978 0.376752 55.6211 0 55.1563 0Z" fill="black"/>
-<path d="M64.8415 28.0005H71.1583C71.623 28.0005 71.9998 28.3772 71.9998 28.842V43.159C71.9998 43.6238 71.623 44.0005 71.1583 44.0005H64.8415C64.3767 44.0005 64 43.6238 64 43.159V28.842C64 28.3772 64.3767 28.0005 64.8415 28.0005Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_7349_35925">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#000" clip-path="url(#clip0_7349_35925)"><path d="M7.158 0H.841A.84.84 0 0 0 0 .842v70.317c0 .464.377.841.841.841h6.317A.84.84 0 0 0 8 71.159V.84A.84.84 0 0 0 7.158 0M23.16 0h-6.317A.84.84 0 0 0 16 .842v70.317c0 .464.377.841.841.841h6.317a.84.84 0 0 0 .842-.841V.84a.84.84 0 0 0-.841-.84m9.683 0h6.316c.465 0 .842.377.842.842v70.317a.84.84 0 0 1-.842.841h-6.316a.84.84 0 0 1-.842-.841V.84c0-.464.377-.841.842-.841M55.156 0H48.84a.84.84 0 0 0-.842.842v70.317c0 .464.377.841.842.841h6.316a.84.84 0 0 0 .842-.841V.84a.84.84 0 0 0-.842-.84m9.686 28h6.316c.465 0 .842.377.842.842v14.317a.84.84 0 0 1-.842.842h-6.317a.84.84 0 0 1-.841-.842V28.842c0-.465.377-.841.841-.841"/></g><defs><clipPath id="clip0_7349_35925"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cloudflare.svg b/web/packages/design/src/ResourceIcon/assets/cloudflare.svg
index 4894c644bc9ef..0a636e22fdde3 100644
--- a/web/packages/design/src/ResourceIcon/assets/cloudflare.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cloudflare.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M57.8026 33.3833C57.5612 33.3833 57.3232 33.3921 57.0851 33.3998C57.0465 33.4018 57.0086 33.4107 56.9732 33.4261C56.9102 33.4475 56.8535 33.4843 56.8083 33.5332C56.7631 33.582 56.7308 33.6414 56.7143 33.7058L55.694 37.2703C55.2541 38.8029 55.4175 40.2182 56.157 41.2571C56.835 42.2182 57.9628 42.7821 59.3319 42.8479L64.8667 43.1836C65.0313 43.1924 65.1739 43.2714 65.2606 43.4019C65.3059 43.4716 65.3346 43.5509 65.3443 43.6335C65.354 43.7161 65.3445 43.7998 65.3165 43.8781C65.2719 44.0054 65.1917 44.1172 65.0852 44.2001C64.9788 44.2829 64.8508 44.3334 64.7164 44.3454L58.9655 44.6812C55.841 44.826 52.4796 47.3756 51.3002 50.4848L50.8855 51.5819C50.8676 51.6273 50.8609 51.6764 50.8658 51.725C50.8707 51.7736 50.8872 51.8204 50.9138 51.8614C50.9404 51.9023 50.9764 51.9364 51.0188 51.9607C51.0612 51.9849 51.1088 51.9988 51.1576 52.001H70.9643C71.0795 52.0014 71.1916 51.9641 71.2835 51.8948C71.3755 51.8254 71.4422 51.7278 71.4733 51.617C71.8251 50.3525 72.0023 49.0458 71.9999 47.7333C71.9999 39.8123 65.6489 33.3921 57.8114 33.3921" fill="#FBAD41"/>
-<path d="M49.158 51.5401L49.5244 50.251C49.9654 48.7184 49.802 47.3032 49.0636 46.2642C48.3834 45.3032 47.2567 44.7393 45.8865 44.6734L19.924 44.3377C19.8432 44.3362 19.764 44.3157 19.6927 44.2778C19.6214 44.2398 19.56 44.1856 19.5137 44.1194C19.4681 44.0498 19.4393 43.9706 19.4294 43.888C19.4195 43.8054 19.4288 43.7217 19.4566 43.6433C19.5016 43.5151 19.5827 43.4028 19.6902 43.3199C19.7977 43.2369 19.9269 43.1869 20.0622 43.1759L46.2672 42.8402C49.3785 42.6965 52.7399 40.1457 53.9193 37.0366L55.4135 33.087C55.4744 32.9196 55.4895 32.739 55.4574 32.5637C53.7548 24.8599 46.9441 19.0903 38.8015 19.0903C31.2953 19.0903 24.9267 23.9856 22.6415 30.7908C21.1029 29.6208 19.176 29.0817 17.2537 29.2834C13.6553 29.6455 10.759 32.5769 10.4013 36.2148C10.3087 37.1235 10.3756 38.0412 10.5988 38.9269C4.71843 39.1024 0.000976562 43.9713 0.000976562 49.9548C0.000976562 50.4957 0.0393745 51.0289 0.117267 51.5489C0.13277 51.6709 0.192265 51.783 0.284582 51.8642C0.376898 51.9454 0.495684 51.9901 0.618634 51.9899H48.5656C48.7006 51.9877 48.8312 51.9418 48.938 51.8592C49.0448 51.7765 49.122 51.6615 49.158 51.5314" fill="#F6821F"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fbad41" d="M57.803 33.383c-.242 0-.48.01-.718.017a.3.3 0 0 0-.112.026.4.4 0 0 0-.259.28l-1.02 3.564c-.44 1.533-.277 2.948.463 3.987.678.961 1.806 1.525 3.175 1.59l5.535.337a.496.496 0 0 1 .477.45.54.54 0 0 1-.027.244.7.7 0 0 1-.6.467l-5.751.336c-3.125.145-6.486 2.695-7.666 5.804l-.414 1.097a.306.306 0 0 0 .272.419h19.806a.53.53 0 0 0 .51-.384c.351-1.264.528-2.571.526-3.884 0-7.92-6.351-14.34-14.189-14.34"/><path fill="#f6821f" d="m49.158 51.54.366-1.289c.441-1.533.278-2.948-.46-3.987-.68-.96-1.807-1.525-3.178-1.59l-25.962-.336a.51.51 0 0 1-.41-.219.54.54 0 0 1-.057-.476.7.7 0 0 1 .605-.467l26.205-.336c3.111-.144 6.473-2.694 7.652-5.803l1.495-3.95c.06-.167.075-.348.043-.523-1.702-7.704-8.513-13.474-16.656-13.474-7.506 0-13.874 4.896-16.16 11.7a7.6 7.6 0 0 0-5.387-1.507c-3.599.362-6.495 3.294-6.853 6.932a7.8 7.8 0 0 0 .198 2.712C4.719 39.102 0 43.97 0 49.955q0 .812.116 1.594a.505.505 0 0 0 .502.44h47.947a.625.625 0 0 0 .592-.458"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cloudzero.svg b/web/packages/design/src/ResourceIcon/assets/cloudzero.svg
index 98a811f899d25..5495d07d9c2a9 100644
--- a/web/packages/design/src/ResourceIcon/assets/cloudzero.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cloudzero.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M58.5328 7.38784L47.5472 1.04587L36.0002 7.71243L24.4533 1.04541L11.5469 8.49662L11.5474 21.8302L0 28.4967V41.1821C0 50.7736 5.16013 59.7123 13.4677 64.5081L24.4533 70.8505L36.0002 64.184L47.5472 70.8505L60.4531 63.3998V50.0662L72 43.3996V30.7143C72 21.1223 66.8394 12.1841 58.5328 7.38784ZM46.1887 30.0661V41.8303L36.0002 47.7127L25.8117 41.8303V30.0661L36.0002 24.1828L46.1887 30.0661ZM23.0944 42.0148L14.1048 47.205V36.6406L23.0944 31.4504V42.0148ZM15.3038 49.2815L24.2933 44.0918L33.4424 49.3735L24.4533 54.5637L16.0764 49.7277L15.3038 49.2815ZM38.5581 49.3735L47.7072 44.0918L56.6962 49.2815L47.5472 54.5637L38.5581 49.3735ZM34.8013 21.7377L25.6518 27.0199V16.64L34.8013 11.3578V21.7377ZM22.0549 29.2814L12.9059 34.5631L3.9168 29.3734L13.0659 24.0912L18.0364 26.9612L22.0549 29.2814ZM24.4533 14.5635L15.4637 9.37283L24.4533 4.18356L33.4424 9.37283L24.4533 14.5635ZM46.9059 14.1936L38.5576 9.37283L47.5472 4.1831L57.1739 9.74088C64.6431 14.053 69.2826 22.0896 69.2826 30.7143V41.8299L60.2935 47.0196V37.3809C60.2935 27.8457 55.1635 18.9607 46.9059 14.1931V14.1936ZM25.6522 56.6407L34.8013 51.3581V61.7384L25.6518 67.0206L25.6522 56.6407ZM48.7461 56.6407L57.7357 51.4505V61.8305L48.7461 67.0206V56.6407Z" fill="#FE552E"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fe552e" d="M58.533 7.388 47.547 1.046 36 7.712 24.453 1.045 11.547 8.497V21.83L0 28.497v12.685c0 9.592 5.16 18.53 13.468 23.326l10.985 6.343L36 64.183l11.547 6.666 12.906-7.45V50.066L72 43.4V30.714c0-9.592-5.16-18.53-13.467-23.326M46.189 30.066V41.83L36 47.713 25.812 41.83V30.066L36 24.183zM23.094 42.015l-8.99 5.19V36.641l8.99-5.19zm-7.79 7.267 8.99-5.19 9.148 5.282-8.989 5.19-8.377-4.836zm23.254.092 9.15-5.282 8.988 5.19-9.149 5.282zm-3.757-27.636-9.15 5.282V16.64l9.15-5.282zM22.055 29.28l-9.15 5.282-8.988-5.19 9.149-5.282 4.97 2.87zm2.398-14.717-8.99-5.191 8.99-5.19 8.99 5.19zm22.453-.37-8.348-4.821 8.99-5.19 9.626 5.558c7.47 4.312 12.109 12.349 12.109 20.973V41.83l-8.99 5.19v-9.64c0-9.534-5.13-18.42-13.387-23.187M25.652 56.64l9.15-5.283v10.38l-9.15 5.283zm23.094 0 8.99-5.19v10.38l-8.99 5.19z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cockroach-dark.svg b/web/packages/design/src/ResourceIcon/assets/cockroach-dark.svg
index a0e961ee8bc7c..f5508c4abcd80 100644
--- a/web/packages/design/src/ResourceIcon/assets/cockroach-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cockroach-dark.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<rect x="5.09766" width="61.8053" height="72" fill="url(#pattern0)"/>
-<defs>
-<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_6709_29498" transform="matrix(0.00515464 0 0 0.00442478 -0.484536 0)"/>
-</pattern>
-<image id="image0_6709_29498" width="408" height="308" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZgAAAE0CAMAAAAmO9XyAAAAAXNSR0IArs4c6QAAAwBQTFRFR3BM/////////////////////////////////v7/R177////JFL/////////////////////QVL/////////RUv8////////V0P9OZL1////J5P7JtHvVUn9JXT6J07+X0f9RoH4Rnj5FlT/JN7uVEj9GZH2U0/7HeTtH5j2Mkn+////XD/9I9vvWEX9NYj4O03+KMLyR3/3E1X/OWL8G5j2G+jtGFP/Yzv+U1f8Flf/JJ31Nkv+ZjT/SHb5IOfuH+ruTXv5TWr6SX75HO7tSnz4FZj4YED+RIj3J8zxDYz6////OJL3EJT4BYT5Xj79JK/0BX77PH74INPwRKb0F1v/AXr8SET+KcvvT2f6WVv7OaL0Qqr0N630QGr6IFH+SIb4JePtU2H7O5z1ObvyTnn5OZH3NcXxFeXuQYD4JNjuAnb8NcjwUW75He7sSIv3AYj5////aDL/IlP+GvbsFvbsHVT/FVX/GVX/V2P7U2r6J1T+DVb/WV77QXT5XEb+EVb/QoH4UW75QHr5QW/6R0n9X0P+RoH4OF38QYr3XFT8W1n8LVb9QY/3SEL+QYX4M1n9Snr4SH34ZTn+HvLsCIv5DY/5QUb+Vj/+UEX+WEr9BYb6T3L5An77PGL7QJX2ZzX/P0r+FfDtKlD+YUD+Pmj7IO7tA4L6W0z9Mk39Tz/+THf5Vmf6CVj/KOLuUEn9OU39TnT5VkT+Ann7Epn3XD3+RYb4Xk/9Yj3+L0b/Or3yVk/9VFP8JefuKt7uL9TvLdnvIbb0Fp73Pp31TV/7I+vtFZP4DJT4YEn9G03/LlD9OoD4OEL/N8LxOo73FlD/J0j/H77zFeruAHP8N0j+PKb0Ms/wHMfyF93vGs/xUVn8WHD6KJ/1JK70TZb2EFL/NYj4SWX7O4j3M8vwKKb1Vnr5KpP3IUv/SZ/1NsfxHp32FeTuF9bwMY/3NpP2UIz3HZT3KJj2Rmv6Mpf2Oq/zU4P4RIv3IJj3Rqf0QT//OLbzCVb/Lpz1P7bzQq/0H6L2ZWnYsgAAAQB0Uk5TAGAgv4Cg30D+ASDvIBCQcM+eEDBQQL6vYCARECDfMICgf1/vaJBAMDlg3V+AEHCQv4FA2VDti2C9sJOA7+ff38W8ms/vcMPPot6krt5vgFDh29/vfLK/n1Lf16jfzftw36Dv7+LvT5+576Dvte+f7+///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////4UKHckAAB8KSURBVHja7d15fBTl/QfwvY9s9iDZzZ1whHCGhFMI932fWlBUXqh41NrjRz3RQkRAKxZUfiiS2gJWaQQLlZ8KqOCBWrzRohWP1qK1Vq1FS7X6s8czM88z8zwzz8w8M9lN8nrl+/mHsJmdnX3e85wzu/F4WjUFPeeU1HbpMmzKqFGjtm7d+r9SRo2aMqyhS23dnExeaxxCaVXvWbOnT18wb968S/5PySXz5i1YMH/47KE9qso9HS15CGTKqB+q2bqVwKDs27fv7rvvvv7666cMq6nLFOTmCMqretdPn/fTn/4S52dSMM1v1VyyYP7swVUdRaWGJjHC7FNhGlGamqY0ZFmnvMes6fNuu+22n5JQNMSG1vntb+cN7xAww374QycwTY+gnFkzJys45RfWT7799ttvI2FofmlKs6BDwNTxXSxhHkXpX5Np2Qv3mC2hkHBtTKrNrA4Bk7GFuVuFaVJgJJc3URaOH+y6/Zo+5JlnnrmdI3Mb06T9TGcj4/ToGJ3MKK7LVn3f32iEeQrFhQ1WUXK7ea1hqg1lc0kH6f2HWcGYtWRvEpin/nje+IGOWrD6ISeeofMb82rzS2aURmwWdBCYOpsKo8E0NzU36yrMU3+UsrCb4DSnfMTkEydYl2d+I0XURsKZ3UFgMjwXZzCff/65SLVBTdgJJToWHJ2MfpRGbDpIF6PrZLaadDEyTDMN85QKg1w+X716dDfrl7lw8gk1hOUBOQYccxtJp8NM/IcJwjRrMEyFUVxWr15hQVM+YsgJKg/o8hsHNgs6DAzVyYwaNaxLl5ra2hIltbXy4lmlVmGaOS0ZhlmBcuqkUjuWL098+QAvhGXI5MnTp8+ePau3ktmz5cWz/9FwZncYGKmTGTWspm5Onul0Pi9TUtswxRZm1apVp3bjsXzwAQI58SXORw888OSTT+plhkyv792j1Hw1rces+gXzEE6H6WI8BXU9BRdYes6pGcbA6CoMgnn+eT1Nb8TywQdfqiofffQkmweGTK7vLbg2Wd5jlgdiUsHqGs4zwmAXBMPS9JgpsXz2mcbCwgyZPKsHlGn2cGr7P8WFeV7Ou1Nxk1Q6+QPF5TNVhXaZPAJQsp68bg0yjLHCPP8uStdyqXP5K3H5TGVRYSbPKodSzFHn1G0cBbNKqzBSZvbuMVNz+Ux1+c9//gMqrVFvFkowhgrz7rt/RdFcPlNVUIaMAJVWyMDxn+t6GOLyV83lbY1lMvQrrVZt6kdTFeY4U2EUFpSPoLK0RbqNZmFIhVFdgKXNaE6VXY4fP65zefttDDO3N5RSG9GwMH//+98pF2BpU5rjMozq8s033ygu0Ii1cbpKMC9JLp8iGOLyPrC0ccqnHj/+0ksI5lPG5f2zAKZNUzrhuAzzKXH5RnF5//25pVA6behyquKiwWAWkGnbJYCL9S7fEJd33nln7oVQQm00JLv5ZrohU2BUFxS4xNU247GVLAxVYRSXd54YAKXUrlwwzBNPgExbuBhgRsx6m2UBmTZyuZl2WdIDjdLmUu0YyLSNi67CLJJHx6WL2ArzyiuvgExrumzQYD6VYdSZ/gidC8i0qssGXUs2QvvlCJ0LyLRaJt2qVJgbVRhmgf+MuU8wLq/8DmRaZ15564YNN8gwNyouS3TX9Kvm0i6/Q+kOpZb7VF2gg5lpuNm1Yi7r8rvTekG55Tp5o2+VYSQXGWYmZ7GyYi7NIslUQMnlNgWjdzIwXBdVBrMcO3ZsWj8ou5xm3M6dkosCs27dSzNNFvcrpjEux459G8oupwPl+wnMQzdKMDNNL7ogGdrl2LFToPRyOCC7836lJbvhIRlmpsXFsIppjMsnn8DQLHcd//cYmHU/sLxIqcgQlk8+gaFZzjr+hXeyMDYfCqs4jWJBGQMDgNxk/HUsTDe7J/RiXD755DtQhjnpYK5DMDslmBsQzI03drV/Snfa5Y033oBuJicdDIK5H8OgCtNV5EkDiMsbcmCemYNMuBrDKC3ZBLFnfYdiQYHZTPZnMFczMOcI3jXWbxrF8sbHH8NsJtsN2X0I5k4NRvhuvorTKBYUGDNnNwtZmEnizzyDZvn4Y2jMsppJ992HWrLryGh5qpPnnkKxoMDILJsN2Xk0zA3nOLotud8YiuXVVyfCyCyLU8tlUkumwnRz9uxeFAvKWCjPbGXwsmV0jRnn9PnnaipSoP/PWs/Pwjj+fEXFRIrl1VdhzSxLKVkuw1yNYcY538MpxOQuOTCZyU7PfyYLM9D5LnrRLHfdNRGqTDbSZTkDM9rNPsZSLFBlslRhbmJh6t3spDvNggJD5ixUGB2Mqz/n0o91uQvm/1moMATmOnlJZrS73YzFIpfjf2HI3PIKw9aYce52c4rCgnPXXTDLbGmFWauDmeRuP2fQLhINVJkWVhgZZrkGM9DdfipYl8sv/z6UbcsqjB7G7R/728i6XH45DMxaVmEwzDIMc7/bPY25TAcDc5kWpKBSgrmJgrkgazAw/W9BSvbqYUa73dXYy6DKZC+VCGZt1mB0MhOhfN0ms5eCua/lMDobGDG77vpZGPluDPd9DB0ZBiaZbsfKhzkwbv+A7MTLjIHu32XXz4Pp6W5f/Tgul0H377LrRzB7mRkmgunmbl+9OC4boft3lZ6HDTCo9693t7PuGzcaXDZuhO7fVdd/+PDhvYaJjMvV5W9vlKKHgbbMXUvGwijj5Z3uev+JGzfqaKT/QVvmZhJzGMOsxYtlGMbVV5D22r5940bNRv0Z2jIXLdn1KgxdY9y1Zd/fTslo2Q5tmYuWzATmAhdtWb+J2+WwKijQljkfk92twNDDMuWqf1fnO+v+9NPbSWiX7duhLXOaWi6M1Mm4qDJjnqZkqDz9NLRlTjPMFOZWx1Wm+4EDT8vRqaCMhZJ2loK7KZgzz6QmMjtvdVplKsYcIDISzpixGEUOrJc5yxwapi7DwDi9GfPcXbsOUDTdT9FYDhyAD5g5HCxTMGt7ehoomJ23bnB0q8wZu3YpMgrO9z29NJYDB86FsnaUKQjmegxTKX3WT7sdA8E4+axfxZiDuyiaMRUez8QDWmDA7Ch5+yiYLuiBOgIjtWUbnHyobOzBg4qMQiM1XedqLrt2wW1MjroYDCPPMEukRxq0iYz0MUzhbmbA4wcPqjS7lJarO0GRAp2Mk9RgmGYJRr7HDzVm9AeXRT8g2/1xlIOqzRi5flTsogIzGUezGALTvFfqYqQMpoZlGzbc8AOhj2P0euyxxzWag6R6jMEo0mMwk3GSfSpM89oGUosYGKFvk6mY9thjCo0CQ4Zg5x6kAjMZ8fSkYerInHMh/T0/Dz10Trm9y+uPERnJRv24cncaBpbLnPT9MkyjDJNRuc7TfTOWjUy/ae+9/jpNow7AehEU6VHo/Z30/QpMI4Jp1h6edDXzXXJf2HylzEXvvafKSDaUwGkHH1cDX8jopO/XYKZQj4/HM0ylLfviC8tB80V/eU+RwTT08Gus5vI49P7iGSW7KE1ZA/V4wQT6O8uQjMVC84AXX/wLTcN8ifx3ZBIF7DQob9EU7MMwUktWx6wILLyTbsssZJCLJPMXLPP6NGaG3/0xKjD3F02G7mIy7HiNtGUSDJJZZyIz4OEXNRmJhh17naGqGH4FsR+UyTC6e2K74RqDq8w6vsyAh1GwjEyjG3pVvE4FhmWiqd33oNyS6QZlSroynQyS4YzNLvr6ayKj0Bj+GNZpRAWhwV/KEh8tP/igAtPEDMrw0EyDkavMurN085nyRV9/TckgGmPRT3tPy0VQ4qKj5QdRkEtjY1PzMOOvx6tfV65UmS0TmNWZ0kUnT37N0HzXuI/vEhVUn74LJS6YKQSmqam5C2fQNkHtZJQqs4X+cyWlZ588ycos6seb5Gg5H0pcdBpDwdTyhtMTFBi1ymxZot4422PJaydVGZnmfN4q5QDN5cUXocQF86AG01TCneiMRjB0ldmy5VvKb771Ggol8/XD53OnKWe8SAXWlwXnlzJMowKT4W6SN1pry7BMPRoClNe/9poqo9DwXSgYVKdghimWPHsYJLOBlkEwqKMpXXToEC1z0tTFU/UwlSooc7GJP4bZI8GYfXdM3gQMcyOpMluWLDl0SCezyOxqWgUN0wPK3AnMnj17LGA85ROU7l/tZbZsOXRIk5FpFplesZFg/kXSG8pcbEVGhlFcmiy2m6qvMqzMayfPsriS9i8qACOWEsnljj2KjNWG9TfoZA4domnOsnouwLiDuUMERpJZqfxFTI6MpYvnfMXk31K+BWUuCnMHgam03nSqBEPLbFFlrF08Z/9bC8CIpU4cpnyCmczZ5QCT7dRKLmIwntKLV668WYL5QpWRaZbY3XWmwPxTDsAIwtxBYHbvtoPxTFq5UvkT8lqdkWhs+/Oz/6kFYAT7GCcwnnESjF7mLA/A5BBmswhM6UpGRqEpFYf58MMPAcYZzGYEs9t+865GGYE/LodN5EyCMs8FTPnFOpl1AhXG8yEVmGDmBMZTv1KTkWlE/hojDdMNylwoGeIiwQh8M/nAlbQMohH47GwpNvm9lAuhzIXSU4bZLAzjOZXIKDTnCDyl6vdUBkKZCyUPuezYjGEyAk/ouoqREfl85kAaBi6UiaUAuagwJSKlvEqTQTQiFeBCyuVvpVDmYtmxQ4HZLQjjuRjLKDQiz5iETeRAiQumkoKpFXnCuFWUjNB3AHT9m5YfQIkLZgoFc7rIE+pXqTIrbxb6CoCpFMwEKHHBNOC2TILpL9QwrVql0QjN48dRMOOgxAVTQ8FUijxh8IpVGo3QrOQcBPIPnKlQ4oKpU2HWrFkj8oSBK4gMohGalfyDSlcoccHMwTBrpIjMMKtWUDIiMFU0DEz8hWeYyGX95vWyyxqR8XLeihUajcis5EKN5U9/gom/8AwTuaAoMHXCMJhGpIp1RR5qCqDEhScy6zWY0x3ArBCFGUe5XADlLT5epmBEhmV5q1eoEYKZQMHAaNnBeJmCWVMgArNaoxGAKSAob6GMh/IWTgkNkxGDUWlEruAoJErgMpmDYRkNUycKg2kEYCa9RaUnlLd4RlIwDeIwso0ATAMNA6XtIP01lzUjHcGsXi0A8z2N5T7o+52kdv36TQRmm31bk3ePI5ieb1391n0kNVDaDpKRYDZJNtu2basTgLnnHgcwk67GKMtQBkNpO5n7r9+kRILpLwSj0tjDNGgsy5blQWk76mQUl21SRhaIwWAd+5I+j6AsX778TChrZ1NMCmZbxgHMPfYwGY1l+fIuUNbOOhkapsYJzD22MONVleXLbyqBsnbWyYykYPpkF2ahqoICXYybTmbbNrG2LO/nPxeH6blMVbnpJuhinKZOc/n1rzvbw0gRg6nRWG5aC7MYp8mjYfqIwSg0djALNZa1azNQ0i7aMsyCkhGEkWID0/PNNzHK2rVrK6GcHaezWl9QarIH00WGkVn27oXBsvP0VFVQRmYPpvLRRx/FLHv3Qkvmpi07evQogbFpy/J+LAxTglwefURh2Qstmau2jIbpbwMjRQimQXJ55JHm5ua9ew9DS+ZqjknD/LrAHubHAjB5qktz8+HDcPGy5W1ZZwEYJZYwp8sujygu0JK5y2IaxnKJWRymUnZpakIwjY2wTuayLRuJYBSae++9d3E2YEqwC0pjYyOsk7lMDaoyR+/F6ZMNmMrdlAt0/W6T0VhQMi2HKZE+cUNcGmES4777p1zutRgx598ixR6mcvduhWbPnsZG6PpbUGUol+eey9jA3PLjW6xhShSXPXKg629JRlIuz/W3g1Fw8uwqjOxyB1SYFs3+KReLKkPB3GIOo1SYzZtllzvgSkzLRsyUi3mVEYOplFkkGOnLamCs3PIq8xzJ0JbAlKxZg2EkFxgrt7zKqC7P9SkQgMk3qzAIRv6Gmh1QYbJRZZ6jY7Jilv+Tn/zEDqZWug9aYtmxAypMVqoMDTMy3xRGpeFvkie5rF+/Xvqk+g6oMNmrMr9QMt8CBuPwYU5XXBSYHadDuWahyvyCyjUZaxgULkzJpk2yiwKzBypMFrKYgeH2/7YwBX02bdq0XpWphVLNRvrQMNcMdwPTeRMNUwlfuZCVZDQVKRnnMPmbGBhYJctS+jMwnMYs/xpLmGifTbQMrJJlK/kUyzW8xixfftwUpmabAvPVVzIM9PzZGzJTLLzGLF/7HQdm8NGjRxWXryQaGCpnccjc51IUqdylfy8dlG8Oc801hl/2QTAvvIBhvqqECpPN/v9SJv2dwPSXXVAUGOj5s5rhrExncRjphk5FRnaBhizLjdkgVobtZvJJS2eEGXyvCiPJ9MmHssxpY1adb4AhNOxv+uzfr8K8AA1Z7huzQQVGGAUnnxk17N8vybyAYaAhy2VjdoWc+VEuzKWX0jDz9yvBMNCQ5SJVhARnuD1M5yP799M0cItfTrL4Cjba0Cz/iit4MJ2PHDlCw3SGMsxN5utkhlIwUnQwQ48cYWT6QAnmrJuhWa666orBLIyCQ2AGH8HBMtDB5LCbqcYkONVVBpgrCExV9Z//zMDAx8dymKE0iyaTfxUlk6+6MDLQweQ0na9io8jkyz/TMIoLJTMcyi7HAwCeTL76XwxTVf3sn2mZI9Dx534AQAyulHNVdYaGQUEwmepnn32WhoGOP/fJH4RJ1AzVwwx9VolKAy6tIlOtg7myc776owSz+OVnWZmRMCBrpUGzXmY485+XUWiZI7AS00rJXGmZl1/WaCSYoVBirTadkcr/WiYmMIgGXFpV5lpjWBhCAxPL1pW51iRXXvmHl2kZcGkvMtf+QQqRgXas1TO4GkP8CIcjAy5tM2r+ES9/wEEu1fCXLtpoDcBahlwUgLQTGUwzCNZh2iwF8yWHX6EYZcClTTP8VyQ6mOHwqbG2TWdV5v/VIBmYvrT94GyQUaYali3bxRBALwPdS/tszqB7aT+rAFSlqYbZfntqztTR2XxoxtpXFldLLNWLoSTa4xhgECzCtMsxANzUB4FAIBAIBAKBQCAQCAQCgUAgEAgEAoFAIBAIBAKBQCAQCAQCgUAgEAgEAoFAIO4TjUbLfCjoXyiM9qNSlk74Y0vlpIqThTmy8YWl+Np/ecTlAw0LbsaksMzszOZtLRWHeVWIhgkKScjry4VNUN55oP3DhJVSENtMn5iff2bzt5aqQjDN2z7qDfG2DvoAxh2M/NS+UQdbo+0Dhu0L/SbbxgJRgHELw6Ox2hptz1aEaDJmvm0xwLiHWbrU73Oy9dJYIe2S0H4RIdH2DDBiMBEq5pUgbNyYeUbMpy8p+dGiZFr6RbwwnUhFAMYJTEIbYnmTCb9W1KyMsnUk6aNTGE76I4aKEND6kzgzrA3GAEYcxqubFHhDEZ4MhvEaZxEpXJfI+DxJaiLLIm+biACMSxipZCOc3sAUxhPFLVcRLnzc74cKuZPBEMC4hpFKDzdcIjCeMoUixnQwIbMJS8BvsnQjtGoT5WyYLRjBYxDbjHegOhiz/ZjDqDKxuAgM7lQihfSQwnwiGTa+h8Jkotjv9wcD4TKrdxwNJ4P+VMjvT6TpJQQejKFYtP+jl0t7w/pZtHYMaYtjoA41bbGKES3zJopToZS/OBmmjoKGwTvi7ccCRm2PAkIw+Hdp6Wf/Uofnb9SXoCc9xV6z91sWoLdLecssYAJ+Odp51Vf+f1ru52J4VkwXJLNvv8kxRMNB9hB8ZmtR9Og2qJa8BlMWSFFvORwVhiE9uFZlrGB82u98S8XaUWqoZpiscpd42KJTJsGmMPgogvpK7dWGJnQPWpYwHAOHJupNGTZLcg41bFj0COphwrrlqmCZMEw0petlBGHwW+wr6uLlLREkoqZjPzoBUxi/oTklMAHOCkSYdwxsWUnVIMWdh5fpCy7A2UoHE7BeObGE8aR1p5UVTKE2Xk45qzABeomAaiT0bUQhr+xMYbyGCkNgkpzz2OQY2NFLmW4xQzvUOHeIagXDo6N3Yw0TVYoiEheAUQoi4uO1IWIusaJEMhmYoU2hyrhdHnqRWCgUwgVjBhMPGccfyiuR5lB+flB3DBH9MfiMoyG0VahT0uv1BorIZgnOCFF+CXSgMXykTBnGyH4CgYS6F/q8soFJsBIWMFHlqFNaPUuLuSQNKwRh7rqNWiyxgDI5iqcTqPzMYBKcEgtoZYIAUMHOSHWiaxd9DEXGYwirW4W1zhFvFuacaZGitLy7eDhZhGwM642RIvwsX4DQxAVh1BUb+wkmHi331Q4sLtbv40MqinNmt0njaRhJ0BsWBk1gwrymSGs+QmGeeZGPcwz6MaluiQlvxvFjXsPnDelhYl5jKx0QhSlj5vPmMKS3k1+92EkX4+e2e96IflEUn9QRr9DMnxR1X36jqesTgtxjIIXlo8uKPS+oGq89HOK+hnGFvpDzaEgUBjdQIR1MlE0ZGRxG5DeRcrB+7DUZWSf1ZRUy1iELGHaBSA+jW5AwG917jUOfEOdafYxtuMk7itus5we4J6hPFEY5+yPs1v4gkxTplSN9qTIMOqkwPrNfxNnxYVBsrSxgvApBw/TlPZVzDEXsMYSN1YXTiIZsFj3C/NPAq+uY7WCCVE2wuVAWIacTb6Bi3cMETY+fvN9iuzUeuniwoqF6BbhlYn4MPvYYwvzqWszphi3OoDB/khfXQdjAkBUwERi1U3SwHpM0L28/3Y7EbS9IUzBkXB00GZj35Z6r5sdg01uyDUTQdpWQ08Nou3EKExaAUW8RcADjN++OmE41bbuWoMGQjt+4tB3glkmxOs436wGtbuohwx4CY9vBhpnpZmvAqEXhACZmvqmPniDYj8BVGHVR3GfyZmLcEuG2vHHrWV406kv72SWEuO2bN7se43cFU8hsLU28qcTUxYlY2lnnX2icnenRktRRpwQulKnz0ITZm0lxCz9t0UwFOCZlhd4EfS9jkCmhcK5hyNTfZzmPiafJIgS1VCZyg5JZe0s1Cgnq52J7GG3ZhLPXAK+ZKbQ6hmLeOSbd9JsyWTz22lbtLMEUM4tl5jN/+qpaUHiCmbZ6G3ShhGxbR+VFi6ml9JQYTNjqGILGE6LM6+cuRDM9oyfnMH6mWbZaK8OVppNZU27RuVoVtTMY7sKzEIzVXv0WV4QiMT8NE7A9KbMEE2NOPqvV5bIQqVxpq8ahVWBi/CPgwqSdwKRplkgkkkqk4962gClk5w9WMOpNZ6Q7TbYQxm+ASQjCBOMxbmPmtinzG1dBI7FUwltIvYmgwDvKIoyXvYRpCYNrV7Hl7IRbKD4LGGedP6lYaW5jZtX5+2xPDmo9PxQIx3VlFBSd+WQFBncxZLRsA6OuKguv+/ushqr0cNl+PKFdnJI1ZvAaMy6M5VyFmWd5dZdReDCFtteisgKjX3e1hgmSBc+48BTTYoLJzHEStidikJlKebiNGRfGqplkT5wQ/QImMHHbhcJswFAjLUcw+EVi9p9Psmj0vJwlmaQtjLoOw2vM+DBBwSUZk9VHPEIOMsyx3MLgE0ZtyYSasoi2V/M+IRq2XcRMcRYx/bbzGK355DRmfBiv+WSdWXAImLynBAOTsJv6ZwEmarjcZA2jXfUnV1PMzvCyhN9uaUl3fvrt3q/hLhlOY8aHwRuaL/sn6Qlv0mZ1OWx3CrUchqybRtJiMHQ1Iaud/IKkbio3vVCmu96Eq1YqKgzDacz4MKQVDJusPZBj8PO30t8mFbM5hVoMo9601skjBENasiR98W8p5y5F+SOAfvb1U2X8Ffqg7rQ271U5t8gaGjMTmDD3binD5W0/t6TwvFo70oDJRYdolmDUm9voLtz+pnKy3qneBBbU3S6N7+lVSwcLBqO805B6d+QuJ/ZjtdFk0hwGY2pX301gSL+gOzu8uvcf5J0ZZcVLTU4hVibq82cDJlqmfg480tcjAhNP6OpXWL1lLlhI7nWnbttQS4cIpijAKO/ifMogHS1LhixukVUxE3YwcfXSGnUMSf2KW5IzNdJu2g0aTiHq1udoOGi4RVYQhr7pxZembr0PeARgCtWlvYh6nni1O0hDxQEvSpK6gOHXdwVLYwmfBIjw0ineJRXtRsxg2id9B4pXvuveCoZUx7ANjHYWBfExaPfqz9APBWJe9ZMc9IpmkDPXDSULpeIMB/yce5fFYOhLXxYrtKRH8DNJxbjbJyMWFztnGNpA+RtNAgEKL2VSeoI3lWuYpDEzhaHOIvkYimO8O9CK1DbAK31WNYHtDNcF49w7z93BmH0+PMntJs3DnOPhkOkNNey8jy9YpF/SScecwugas4DFdFbgGHwx/vV0w2g7XpRjmKJCjzMY/Qkb5L7diH6/PMFIgDfMjjiEYRszCxjqjnHqGHQ9Pe/jBqiP50yDOOdaJGswob5mUxWzJxjH7uGiiJHFuJkvEYnYbiSf2KGIibEJDNOYBSznfoGQ7TEYzgz5FkDe/NSne+ORWDI7MLFg2HwOyf8WDZPJZCKlFXokEkuYbOZVNzPfSKYp4m/n7STFuKqrPN5J3jAt/2i6tsoeQ6ew9ctLha28vrxXw1lcGAzhTSORSFFSbRN98ubG+VhSO05tM10CJp8rRG2TSZJhizV+XzqQmFFUNMN8v2Qz+ZCTNpc+42i7oiL77dxEPQbzM8PnTRQVpUJFnQJhu+sa4SR63506JcNxT3vIfwHp0NuW7BARIQAAAABJRU5ErkJggg=="/>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#pattern0)" d="M5.098 0h61.805v72H5.098z"/><defs><pattern id="pattern0" width="1" height="1" patternContentUnits="objectBoundingBox"><use xlink:href="#image0_6709_29498" transform="matrix(.00515 0 0 .00442 -.485 0)"/></pattern><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZgAAAE0CAMAAAAmO9XyAAAAAXNSR0IArs4c6QAAAwBQTFRFR3BM/////////////////////////////////v7/R177////JFL/////////////////////QVL/////////RUv8////////V0P9OZL1////J5P7JtHvVUn9JXT6J07+X0f9RoH4Rnj5FlT/JN7uVEj9GZH2U0/7HeTtH5j2Mkn+////XD/9I9vvWEX9NYj4O03+KMLyR3/3E1X/OWL8G5j2G+jtGFP/Yzv+U1f8Flf/JJ31Nkv+ZjT/SHb5IOfuH+ruTXv5TWr6SX75HO7tSnz4FZj4YED+RIj3J8zxDYz6////OJL3EJT4BYT5Xj79JK/0BX77PH74INPwRKb0F1v/AXr8SET+KcvvT2f6WVv7OaL0Qqr0N630QGr6IFH+SIb4JePtU2H7O5z1ObvyTnn5OZH3NcXxFeXuQYD4JNjuAnb8NcjwUW75He7sSIv3AYj5////aDL/IlP+GvbsFvbsHVT/FVX/GVX/V2P7U2r6J1T+DVb/WV77QXT5XEb+EVb/QoH4UW75QHr5QW/6R0n9X0P+RoH4OF38QYr3XFT8W1n8LVb9QY/3SEL+QYX4M1n9Snr4SH34ZTn+HvLsCIv5DY/5QUb+Vj/+UEX+WEr9BYb6T3L5An77PGL7QJX2ZzX/P0r+FfDtKlD+YUD+Pmj7IO7tA4L6W0z9Mk39Tz/+THf5Vmf6CVj/KOLuUEn9OU39TnT5VkT+Ann7Epn3XD3+RYb4Xk/9Yj3+L0b/Or3yVk/9VFP8JefuKt7uL9TvLdnvIbb0Fp73Pp31TV/7I+vtFZP4DJT4YEn9G03/LlD9OoD4OEL/N8LxOo73FlD/J0j/H77zFeruAHP8N0j+PKb0Ms/wHMfyF93vGs/xUVn8WHD6KJ/1JK70TZb2EFL/NYj4SWX7O4j3M8vwKKb1Vnr5KpP3IUv/SZ/1NsfxHp32FeTuF9bwMY/3NpP2UIz3HZT3KJj2Rmv6Mpf2Oq/zU4P4RIv3IJj3Rqf0QT//OLbzCVb/Lpz1P7bzQq/0H6L2ZWnYsgAAAQB0Uk5TAGAgv4Cg30D+ASDvIBCQcM+eEDBQQL6vYCARECDfMICgf1/vaJBAMDlg3V+AEHCQv4FA2VDti2C9sJOA7+ff38W8ms/vcMPPot6krt5vgFDh29/vfLK/n1Lf16jfzftw36Dv7+LvT5+576Dvte+f7+///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////4UKHckAAB8KSURBVHja7d15fBTl/QfwvY9s9iDZzZ1whHCGhFMI932fWlBUXqh41NrjRz3RQkRAKxZUfiiS2gJWaQQLlZ8KqOCBWrzRohWP1qK1Vq1FS7X6s8czM88z8zwzz8w8M9lN8nrl+/mHsJmdnX3e85wzu/F4WjUFPeeU1HbpMmzKqFGjtm7d+r9SRo2aMqyhS23dnExeaxxCaVXvWbOnT18wb968S/5PySXz5i1YMH/47KE9qso9HS15CGTKqB+q2bqVwKDs27fv7rvvvv7666cMq6nLFOTmCMqretdPn/fTn/4S52dSMM1v1VyyYP7swVUdRaWGJjHC7FNhGlGamqY0ZFmnvMes6fNuu+22n5JQNMSG1vntb+cN7xAww374QycwTY+gnFkzJys45RfWT7799ttvI2FofmlKs6BDwNTxXSxhHkXpX5Np2Qv3mC2hkHBtTKrNrA4Bk7GFuVuFaVJgJJc3URaOH+y6/Zo+5JlnnrmdI3Mb06T9TGcj4/ToGJ3MKK7LVn3f32iEeQrFhQ1WUXK7ea1hqg1lc0kH6f2HWcGYtWRvEpin/nje+IGOWrD6ISeeofMb82rzS2aURmwWdBCYOpsKo8E0NzU36yrMU3+UsrCb4DSnfMTkEydYl2d+I0XURsKZ3UFgMjwXZzCff/65SLVBTdgJJToWHJ2MfpRGbDpIF6PrZLaadDEyTDMN85QKg1w+X716dDfrl7lw8gk1hOUBOQYccxtJp8NM/IcJwjRrMEyFUVxWr15hQVM+YsgJKg/o8hsHNgs6DAzVyYwaNaxLl5ra2hIltbXy4lmlVmGaOS0ZhlmBcuqkUjuWL098+QAvhGXI5MnTp8+ePau3ktmz5cWz/9FwZncYGKmTGTWspm5Onul0Pi9TUtswxRZm1apVp3bjsXzwAQI58SXORw888OSTT+plhkyv792j1Hw1rces+gXzEE6H6WI8BXU9BRdYes6pGcbA6CoMgnn+eT1Nb8TywQdfqiofffQkmweGTK7vLbg2Wd5jlgdiUsHqGs4zwmAXBMPS9JgpsXz2mcbCwgyZPKsHlGn2cGr7P8WFeV7Ou1Nxk1Q6+QPF5TNVhXaZPAJQsp68bg0yjLHCPP8uStdyqXP5K3H5TGVRYSbPKodSzFHn1G0cBbNKqzBSZvbuMVNz+Ux1+c9//gMqrVFvFkowhgrz7rt/RdFcPlNVUIaMAJVWyMDxn+t6GOLyV83lbY1lMvQrrVZt6kdTFeY4U2EUFpSPoLK0RbqNZmFIhVFdgKXNaE6VXY4fP65zefttDDO3N5RSG9GwMH//+98pF2BpU5rjMozq8s033ygu0Ii1cbpKMC9JLp8iGOLyPrC0ccqnHj/+0ksI5lPG5f2zAKZNUzrhuAzzKXH5RnF5//25pVA6behyquKiwWAWkGnbJYCL9S7fEJd33nln7oVQQm00JLv5ZrohU2BUFxS4xNU247GVLAxVYRSXd54YAKXUrlwwzBNPgExbuBhgRsx6m2UBmTZyuZl2WdIDjdLmUu0YyLSNi67CLJJHx6WL2ArzyiuvgExrumzQYD6VYdSZ/gidC8i0qssGXUs2QvvlCJ0LyLRaJt2qVJgbVRhmgf+MuU8wLq/8DmRaZ15564YNN8gwNyouS3TX9Kvm0i6/Q+kOpZb7VF2gg5lpuNm1Yi7r8rvTekG55Tp5o2+VYSQXGWYmZ7GyYi7NIslUQMnlNgWjdzIwXBdVBrMcO3ZsWj8ou5xm3M6dkosCs27dSzNNFvcrpjEux459G8oupwPl+wnMQzdKMDNNL7ogGdrl2LFToPRyOCC7836lJbvhIRlmpsXFsIppjMsnn8DQLHcd//cYmHU/sLxIqcgQlk8+gaFZzjr+hXeyMDYfCqs4jWJBGQMDgNxk/HUsTDe7J/RiXD755DtQhjnpYK5DMDslmBsQzI03drV/Snfa5Y033oBuJicdDIK5H8OgCtNV5EkDiMsbcmCemYNMuBrDKC3ZBLFnfYdiQYHZTPZnMFczMOcI3jXWbxrF8sbHH8NsJtsN2X0I5k4NRvhuvorTKBYUGDNnNwtZmEnizzyDZvn4Y2jMsppJ992HWrLryGh5qpPnnkKxoMDILJsN2Xk0zA3nOLotud8YiuXVVyfCyCyLU8tlUkumwnRz9uxeFAvKWCjPbGXwsmV0jRnn9PnnaipSoP/PWs/Pwjj+fEXFRIrl1VdhzSxLKVkuw1yNYcY538MpxOQuOTCZyU7PfyYLM9D5LnrRLHfdNRGqTDbSZTkDM9rNPsZSLFBlslRhbmJh6t3spDvNggJD5ixUGB2Mqz/n0o91uQvm/1moMATmOnlJZrS73YzFIpfjf2HI3PIKw9aYce52c4rCgnPXXTDLbGmFWauDmeRuP2fQLhINVJkWVhgZZrkGM9DdfipYl8sv/z6UbcsqjB7G7R/728i6XH45DMxaVmEwzDIMc7/bPY25TAcDc5kWpKBSgrmJgrkgazAw/W9BSvbqYUa73dXYy6DKZC+VCGZt1mB0MhOhfN0ms5eCua/lMDobGDG77vpZGPluDPd9DB0ZBiaZbsfKhzkwbv+A7MTLjIHu32XXz4Pp6W5f/Tgul0H377LrRzB7mRkmgunmbl+9OC4boft3lZ6HDTCo9693t7PuGzcaXDZuhO7fVdd/+PDhvYaJjMvV5W9vlKKHgbbMXUvGwijj5Z3uev+JGzfqaKT/QVvmZhJzGMOsxYtlGMbVV5D22r5940bNRv0Z2jIXLdn1KgxdY9y1Zd/fTslo2Q5tmYuWzATmAhdtWb+J2+WwKijQljkfk92twNDDMuWqf1fnO+v+9NPbSWiX7duhLXOaWi6M1Mm4qDJjnqZkqDz9NLRlTjPMFOZWx1Wm+4EDT8vRqaCMhZJ2loK7KZgzz6QmMjtvdVplKsYcIDISzpixGEUOrJc5yxwapi7DwDi9GfPcXbsOUDTdT9FYDhyAD5g5HCxTMGt7ehoomJ23bnB0q8wZu3YpMgrO9z29NJYDB86FsnaUKQjmegxTKX3WT7sdA8E4+axfxZiDuyiaMRUez8QDWmDA7Ch5+yiYLuiBOgIjtWUbnHyobOzBg4qMQiM1XedqLrt2wW1MjroYDCPPMEukRxq0iYz0MUzhbmbA4wcPqjS7lJarO0GRAp2Mk9RgmGYJRr7HDzVm9AeXRT8g2/1xlIOqzRi5flTsogIzGUezGALTvFfqYqQMpoZlGzbc8AOhj2P0euyxxzWag6R6jMEo0mMwk3GSfSpM89oGUosYGKFvk6mY9thjCo0CQ4Zg5x6kAjMZ8fSkYerInHMh/T0/Dz10Trm9y+uPERnJRv24cncaBpbLnPT9MkyjDJNRuc7TfTOWjUy/ae+9/jpNow7AehEU6VHo/Z30/QpMI4Jp1h6edDXzXXJf2HylzEXvvafKSDaUwGkHH1cDX8jopO/XYKZQj4/HM0ylLfviC8tB80V/eU+RwTT08Gus5vI49P7iGSW7KE1ZA/V4wQT6O8uQjMVC84AXX/wLTcN8ifx3ZBIF7DQob9EU7MMwUktWx6wILLyTbsssZJCLJPMXLPP6NGaG3/0xKjD3F02G7mIy7HiNtGUSDJJZZyIz4OEXNRmJhh17naGqGH4FsR+UyTC6e2K74RqDq8w6vsyAh1GwjEyjG3pVvE4FhmWiqd33oNyS6QZlSroynQyS4YzNLvr6ayKj0Bj+GNZpRAWhwV/KEh8tP/igAtPEDMrw0EyDkavMurN085nyRV9/TckgGmPRT3tPy0VQ4qKj5QdRkEtjY1PzMOOvx6tfV65UmS0TmNWZ0kUnT37N0HzXuI/vEhVUn74LJS6YKQSmqam5C2fQNkHtZJQqs4X+cyWlZ588ycos6seb5Gg5H0pcdBpDwdTyhtMTFBi1ymxZot4422PJaydVGZnmfN4q5QDN5cUXocQF86AG01TCneiMRjB0ldmy5VvKb771Ggol8/XD53OnKWe8SAXWlwXnlzJMowKT4W6SN1pry7BMPRoClNe/9poqo9DwXSgYVKdghimWPHsYJLOBlkEwqKMpXXToEC1z0tTFU/UwlSooc7GJP4bZI8GYfXdM3gQMcyOpMluWLDl0SCezyOxqWgUN0wPK3AnMnj17LGA85ROU7l/tZbZsOXRIk5FpFplesZFg/kXSG8pcbEVGhlFcmiy2m6qvMqzMayfPsriS9i8qACOWEsnljj2KjNWG9TfoZA4domnOsnouwLiDuUMERpJZqfxFTI6MpYvnfMXk31K+BWUuCnMHgam03nSqBEPLbFFlrF08Z/9bC8CIpU4cpnyCmczZ5QCT7dRKLmIwntKLV668WYL5QpWRaZbY3XWmwPxTDsAIwtxBYHbvtoPxTFq5UvkT8lqdkWhs+/Oz/6kFYAT7GCcwnnESjF7mLA/A5BBmswhM6UpGRqEpFYf58MMPAcYZzGYEs9t+865GGYE/LodN5EyCMs8FTPnFOpl1AhXG8yEVmGDmBMZTv1KTkWlE/hojDdMNylwoGeIiwQh8M/nAlbQMohH47GwpNvm9lAuhzIXSU4bZLAzjOZXIKDTnCDyl6vdUBkKZCyUPuezYjGEyAk/ouoqREfl85kAaBi6UiaUAuagwJSKlvEqTQTQiFeBCyuVvpVDmYtmxQ4HZLQjjuRjLKDQiz5iETeRAiQumkoKpFXnCuFWUjNB3AHT9m5YfQIkLZgoFc7rIE+pXqTIrbxb6CoCpFMwEKHHBNOC2TILpL9QwrVql0QjN48dRMOOgxAVTQ8FUijxh8IpVGo3QrOQcBPIPnKlQ4oKpU2HWrFkj8oSBK4gMohGalfyDSlcoccHMwTBrpIjMMKtWUDIiMFU0DEz8hWeYyGX95vWyyxqR8XLeihUajcis5EKN5U9/gom/8AwTuaAoMHXCMJhGpIp1RR5qCqDEhScy6zWY0x3ArBCFGUe5XADlLT5epmBEhmV5q1eoEYKZQMHAaNnBeJmCWVMgArNaoxGAKSAob6GMh/IWTgkNkxGDUWlEruAoJErgMpmDYRkNUycKg2kEYCa9RaUnlLd4RlIwDeIwso0ATAMNA6XtIP01lzUjHcGsXi0A8z2N5T7o+52kdv36TQRmm31bk3ePI5ieb1391n0kNVDaDpKRYDZJNtu2basTgLnnHgcwk67GKMtQBkNpO5n7r9+kRILpLwSj0tjDNGgsy5blQWk76mQUl21SRhaIwWAd+5I+j6AsX778TChrZ1NMCmZbxgHMPfYwGY1l+fIuUNbOOhkapsYJzD22MONVleXLbyqBsnbWyYykYPpkF2ahqoICXYybTmbbNrG2LO/nPxeH6blMVbnpJuhinKZOc/n1rzvbw0gRg6nRWG5aC7MYp8mjYfqIwSg0djALNZa1azNQ0i7aMsyCkhGEkWID0/PNNzHK2rVrK6GcHaezWl9QarIH00WGkVn27oXBsvP0VFVQRmYPpvLRRx/FLHv3Qkvmpi07evQogbFpy/J+LAxTglwefURh2Qstmau2jIbpbwMjRQimQXJ55JHm5ua9ew9DS+ZqjknD/LrAHubHAjB5qktz8+HDcPGy5W1ZZwEYJZYwp8sujygu0JK5y2IaxnKJWRymUnZpakIwjY2wTuayLRuJYBSae++9d3E2YEqwC0pjYyOsk7lMDaoyR+/F6ZMNmMrdlAt0/W6T0VhQMi2HKZE+cUNcGmES4777p1zutRgx598ixR6mcvduhWbPnsZG6PpbUGUol+eey9jA3PLjW6xhShSXPXKg629JRlIuz/W3g1Fw8uwqjOxyB1SYFs3+KReLKkPB3GIOo1SYzZtllzvgSkzLRsyUi3mVEYOplFkkGOnLamCs3PIq8xzJ0JbAlKxZg2EkFxgrt7zKqC7P9SkQgMk3qzAIRv6Gmh1QYbJRZZ6jY7Jilv+Tn/zEDqZWug9aYtmxAypMVqoMDTMy3xRGpeFvkie5rF+/Xvqk+g6oMNmrMr9QMt8CBuPwYU5XXBSYHadDuWahyvyCyjUZaxgULkzJpk2yiwKzBypMFrKYgeH2/7YwBX02bdq0XpWphVLNRvrQMNcMdwPTeRMNUwlfuZCVZDQVKRnnMPmbGBhYJctS+jMwnMYs/xpLmGifTbQMrJJlK/kUyzW8xixfftwUpmabAvPVVzIM9PzZGzJTLLzGLF/7HQdm8NGjRxWXryQaGCpnccjc51IUqdylfy8dlG8Oc801hl/2QTAvvIBhvqqECpPN/v9SJv2dwPSXXVAUGOj5s5rhrExncRjphk5FRnaBhizLjdkgVobtZvJJS2eEGXyvCiPJ9MmHssxpY1adb4AhNOxv+uzfr8K8AA1Z7huzQQVGGAUnnxk17N8vybyAYaAhy2VjdoWc+VEuzKWX0jDz9yvBMNCQ5SJVhARnuD1M5yP799M0cItfTrL4Cjba0Cz/iit4MJ2PHDlCw3SGMsxN5utkhlIwUnQwQ48cYWT6QAnmrJuhWa666orBLIyCQ2AGH8HBMtDB5LCbqcYkONVVBpgrCExV9Z//zMDAx8dymKE0iyaTfxUlk6+6MDLQweQ0na9io8jkyz/TMIoLJTMcyi7HAwCeTL76XwxTVf3sn2mZI9Dx534AQAyulHNVdYaGQUEwmepnn32WhoGOP/fJH4RJ1AzVwwx9VolKAy6tIlOtg7myc776owSz+OVnWZmRMCBrpUGzXmY485+XUWiZI7AS00rJXGmZl1/WaCSYoVBirTadkcr/WiYmMIgGXFpV5lpjWBhCAxPL1pW51iRXXvmHl2kZcGkvMtf+QQqRgXas1TO4GkP8CIcjAy5tM2r+ES9/wEEu1fCXLtpoDcBahlwUgLQTGUwzCNZh2iwF8yWHX6EYZcClTTP8VyQ6mOHwqbG2TWdV5v/VIBmYvrT94GyQUaYali3bxRBALwPdS/tszqB7aT+rAFSlqYbZfntqztTR2XxoxtpXFldLLNWLoSTa4xhgECzCtMsxANzUB4FAIBAIBAKBQCAQCAQCgUAgEAgEAoFAIBAIBAKBQCAQCAQCgUAgEAgEAoFAIO4TjUbLfCjoXyiM9qNSlk74Y0vlpIqThTmy8YWl+Np/ecTlAw0LbsaksMzszOZtLRWHeVWIhgkKScjry4VNUN55oP3DhJVSENtMn5iff2bzt5aqQjDN2z7qDfG2DvoAxh2M/NS+UQdbo+0Dhu0L/SbbxgJRgHELw6Ox2hptz1aEaDJmvm0xwLiHWbrU73Oy9dJYIe2S0H4RIdH2DDBiMBEq5pUgbNyYeUbMpy8p+dGiZFr6RbwwnUhFAMYJTEIbYnmTCb9W1KyMsnUk6aNTGE76I4aKEND6kzgzrA3GAEYcxqubFHhDEZ4MhvEaZxEpXJfI+DxJaiLLIm+biACMSxipZCOc3sAUxhPFLVcRLnzc74cKuZPBEMC4hpFKDzdcIjCeMoUixnQwIbMJS8BvsnQjtGoT5WyYLRjBYxDbjHegOhiz/ZjDqDKxuAgM7lQihfSQwnwiGTa+h8Jkotjv9wcD4TKrdxwNJ4P+VMjvT6TpJQQejKFYtP+jl0t7w/pZtHYMaYtjoA41bbGKES3zJopToZS/OBmmjoKGwTvi7ccCRm2PAkIw+Hdp6Wf/Uofnb9SXoCc9xV6z91sWoLdLecssYAJ+Odp51Vf+f1ru52J4VkwXJLNvv8kxRMNB9hB8ZmtR9Og2qJa8BlMWSFFvORwVhiE9uFZlrGB82u98S8XaUWqoZpiscpd42KJTJsGmMPgogvpK7dWGJnQPWpYwHAOHJupNGTZLcg41bFj0COphwrrlqmCZMEw0petlBGHwW+wr6uLlLREkoqZjPzoBUxi/oTklMAHOCkSYdwxsWUnVIMWdh5fpCy7A2UoHE7BeObGE8aR1p5UVTKE2Xk45qzABeomAaiT0bUQhr+xMYbyGCkNgkpzz2OQY2NFLmW4xQzvUOHeIagXDo6N3Yw0TVYoiEheAUQoi4uO1IWIusaJEMhmYoU2hyrhdHnqRWCgUwgVjBhMPGccfyiuR5lB+flB3DBH9MfiMoyG0VahT0uv1BorIZgnOCFF+CXSgMXykTBnGyH4CgYS6F/q8soFJsBIWMFHlqFNaPUuLuSQNKwRh7rqNWiyxgDI5iqcTqPzMYBKcEgtoZYIAUMHOSHWiaxd9DEXGYwirW4W1zhFvFuacaZGitLy7eDhZhGwM642RIvwsX4DQxAVh1BUb+wkmHi331Q4sLtbv40MqinNmt0njaRhJ0BsWBk1gwrymSGs+QmGeeZGPcwz6MaluiQlvxvFjXsPnDelhYl5jKx0QhSlj5vPmMKS3k1+92EkX4+e2e96IflEUn9QRr9DMnxR1X36jqesTgtxjIIXlo8uKPS+oGq89HOK+hnGFvpDzaEgUBjdQIR1MlE0ZGRxG5DeRcrB+7DUZWSf1ZRUy1iELGHaBSA+jW5AwG917jUOfEOdafYxtuMk7itus5we4J6hPFEY5+yPs1v4gkxTplSN9qTIMOqkwPrNfxNnxYVBsrSxgvApBw/TlPZVzDEXsMYSN1YXTiIZsFj3C/NPAq+uY7WCCVE2wuVAWIacTb6Bi3cMETY+fvN9iuzUeuniwoqF6BbhlYn4MPvYYwvzqWszphi3OoDB/khfXQdjAkBUwERi1U3SwHpM0L28/3Y7EbS9IUzBkXB00GZj35Z6r5sdg01uyDUTQdpWQ08Nou3EKExaAUW8RcADjN++OmE41bbuWoMGQjt+4tB3glkmxOs436wGtbuohwx4CY9vBhpnpZmvAqEXhACZmvqmPniDYj8BVGHVR3GfyZmLcEuG2vHHrWV406kv72SWEuO2bN7se43cFU8hsLU28qcTUxYlY2lnnX2icnenRktRRpwQulKnz0ITZm0lxCz9t0UwFOCZlhd4EfS9jkCmhcK5hyNTfZzmPiafJIgS1VCZyg5JZe0s1Cgnq52J7GG3ZhLPXAK+ZKbQ6hmLeOSbd9JsyWTz22lbtLMEUM4tl5jN/+qpaUHiCmbZ6G3ShhGxbR+VFi6ml9JQYTNjqGILGE6LM6+cuRDM9oyfnMH6mWbZaK8OVppNZU27RuVoVtTMY7sKzEIzVXv0WV4QiMT8NE7A9KbMEE2NOPqvV5bIQqVxpq8ahVWBi/CPgwqSdwKRplkgkkkqk4962gClk5w9WMOpNZ6Q7TbYQxm+ASQjCBOMxbmPmtinzG1dBI7FUwltIvYmgwDvKIoyXvYRpCYNrV7Hl7IRbKD4LGGedP6lYaW5jZtX5+2xPDmo9PxQIx3VlFBSd+WQFBncxZLRsA6OuKguv+/ushqr0cNl+PKFdnJI1ZvAaMy6M5VyFmWd5dZdReDCFtteisgKjX3e1hgmSBc+48BTTYoLJzHEStidikJlKebiNGRfGqplkT5wQ/QImMHHbhcJswFAjLUcw+EVi9p9Psmj0vJwlmaQtjLoOw2vM+DBBwSUZk9VHPEIOMsyx3MLgE0ZtyYSasoi2V/M+IRq2XcRMcRYx/bbzGK355DRmfBiv+WSdWXAImLynBAOTsJv6ZwEmarjcZA2jXfUnV1PMzvCyhN9uaUl3fvrt3q/hLhlOY8aHwRuaL/sn6Qlv0mZ1OWx3CrUchqybRtJiMHQ1Iaud/IKkbio3vVCmu96Eq1YqKgzDacz4MKQVDJusPZBj8PO30t8mFbM5hVoMo9601skjBENasiR98W8p5y5F+SOAfvb1U2X8Ffqg7rQ271U5t8gaGjMTmDD3binD5W0/t6TwvFo70oDJRYdolmDUm9voLtz+pnKy3qneBBbU3S6N7+lVSwcLBqO805B6d+QuJ/ZjtdFk0hwGY2pX301gSL+gOzu8uvcf5J0ZZcVLTU4hVibq82cDJlqmfg480tcjAhNP6OpXWL1lLlhI7nWnbttQS4cIpijAKO/ifMogHS1LhixukVUxE3YwcfXSGnUMSf2KW5IzNdJu2g0aTiHq1udoOGi4RVYQhr7pxZembr0PeARgCtWlvYh6nni1O0hDxQEvSpK6gOHXdwVLYwmfBIjw0ineJRXtRsxg2id9B4pXvuveCoZUx7ANjHYWBfExaPfqz9APBWJe9ZMc9IpmkDPXDSULpeIMB/yce5fFYOhLXxYrtKRH8DNJxbjbJyMWFztnGNpA+RtNAgEKL2VSeoI3lWuYpDEzhaHOIvkYimO8O9CK1DbAK31WNYHtDNcF49w7z93BmH0+PMntJs3DnOPhkOkNNey8jy9YpF/SScecwugas4DFdFbgGHwx/vV0w2g7XpRjmKJCjzMY/Qkb5L7diH6/PMFIgDfMjjiEYRszCxjqjnHqGHQ9Pe/jBqiP50yDOOdaJGswob5mUxWzJxjH7uGiiJHFuJkvEYnYbiSf2KGIibEJDNOYBSznfoGQ7TEYzgz5FkDe/NSne+ORWDI7MLFg2HwOyf8WDZPJZCKlFXokEkuYbOZVNzPfSKYp4m/n7STFuKqrPN5J3jAt/2i6tsoeQ6ew9ctLha28vrxXw1lcGAzhTSORSFFSbRN98ubG+VhSO05tM10CJp8rRG2TSZJhizV+XzqQmFFUNMN8v2Qz+ZCTNpc+42i7oiL77dxEPQbzM8PnTRQVpUJFnQJhu+sa4SR63506JcNxT3vIfwHp0NuW7BARIQAAAABJRU5ErkJggg==" id="image0_6709_29498" width="408" height="308"/></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cockroach-light.svg b/web/packages/design/src/ResourceIcon/assets/cockroach-light.svg
index 552ae45c5aae8..724fb4c83e9e2 100644
--- a/web/packages/design/src/ResourceIcon/assets/cockroach-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cockroach-light.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<rect x="7" width="57.5385" height="72" fill="url(#pattern0)"/>
-<defs>
-<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_6709_29501" transform="scale(0.00534759 0.0042735)"/>
-</pattern>
-<image id="image0_6709_29501" width="187" height="234" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALsAAADqCAYAAAD6QjQ4AAAACXBIWXMAABYlAAAWJQFJUiTwAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAD0rSURBVHgB7X0LkCRHeeafWT27K56t4LBXlkA1GIiVQli9INnLhbjtkQFJOGzNcuewfXbcziqMTwh8mlWcw4cv8PbguLM5n9lZhy9QAKGd9YHh/GBH+AGYQNOyOWvDkr0tToYljL0lLAUL0p1aloRmd7ryv8yqzMo/s6p6ZnbnUf34dmsqK6uqu7r6y6++/8+sagZrxO5d+8I4iOsBjxvI2CsZsMsB2NXJSgYhAqvLujrKRWQgy7yuVqgJ1ZylZbPMGIvUrrLcla/XTeqRRcjZ4yDYM4zxx2OGXehB1O1+IYIxKozZ+q5dy/UVsdzgKL97yQeWzPGViCLUG4WMCV3EULEAWMKWZErokTADJX8wYqaeQ8TSfSLJq2cBRFe+boSoJtGdmNgh+bHYXctRMrpQrzfqu3q1BnK8Xi5OygO/Wh5QQ24WZpuz9JDyu+tDIqSmk19Pl92yehXu1Ou5/LCqgbBHBQRnBYsfrS1DZ60fdIwNwK47Q/m3WVPEBX41ohQ+SWYuxS3hpiYrkMkuk/XM1tFlQ/i0rNebbZlXpvsBdIGJSDUIWX4UAuxA3JON4EsdevjsB6+8af75f35RkbopN6ynB8C8T0mWGcsO213HsvVYSnbwlnn6Wiwlt21Iqsyzskf67EqRzLm8MiDvyI/9qKxpr8jy8rnPRDDGpeGlsw0uxH7GURIaG/JMN+SlN12HmmSa4D7JGVpyO+vLSJ5U0O1KGgEj23r7mv3chpG8UUc1AkmUY+w1r/qRpd5Kr5n/tAWEZ7SeZYftbJ8jO+gGwsn2zN2OuVbHIbPaj5VdDXhhA5DvEyHIBsBZu4f8wZUnFzowRjnqs3VpFxucs2nJ0+s1sesJcYxiO0QHS3hDaIQSVQfINQhGCE9JnJU9YnuEz5YZeQ96JSCkzxpEIKbZFa94y7ws3m0/OSW5R3hfnYu2p+Tz6mz9OsiuVR+97bDY6ngNhaVXDZTk55L8DBbhwsSDy+fujWDUUf/lppSK/dIhN+X5aaaE1d+oR2hD+IzQZYT3CY4FVoZR0vuE77MNW60BUKJTZdfrAj7Jdr/shqbkw5J7JgpUPX0Fb32BuueIDU4dJWSuXODjMwVfI9lNGb0rgN03OSBpe/j9cRwvrjz58dFQfaXetZ3SmgQHEeJpeQ7qRWSmRGbOupJ6Q2ZiXVyFL65jTnBKtmOe2hdaGare1NoA2QdII4DOs99d3MtCGZSeFxPP5M/O6jbGlMtJbfZbL9l5FqjmFZuXXAHKbU/uNZxliOQ+9wuoLaxE88NF/HqrDhMXJLH5QdDWJOVIf5K7dcSbe8Rn6Cs6UXW9Xc7KlAanRYSn24DTEPx1buMA0jiSvwvPffezh5KqK15+w5Jc29R7eWeMLDMGLtmzQ4Y8qfU6j+i+ckORCpeuL7MuvID0BQ1h9Xkk/yxcEHACovkIBhW7W015Sg5CLCTRoe4TOiFpjsBkjpaspr7M2lDPXqbqeasD4AektkzJS9YVNQAG4Pp9s627LCumn/vOH96fkv0VN0rfzkp8u1rSL+d5drotlpC9LDtTpMhpK7x4sheu6+fpWf6KkZzqdNu2THEuxP/w307AIECp+Mv43ZKMs2opIyolacY/qtb+er/OXd/fs+v9IW9tnO1YOeHzlgVc9c8IbsvmPVjeviT1K2xlcvncYpQs7n7ZPunbcck5eUATkITAjCi5Ny9TcdfHK/BVFThPTF6wvZeedOr1sTFeSPCyxkC9vd4uUsSPV2AOog9HUDVc9WtNeZhHZKlplVmvM2TPqTYUZ1co2cvKetvC9CL2U3SvjmZkfJtSRnhjX3K5d7utfU1zgrDz/Hf+1960XiL17Tu1b2fe3zypDRHy9YSkJWSnJC5S2iIVdlTdI7tT5we161Z7bj9btg3YbRm0Yybm4MyH27CdCKWK8x2piiNVcb3eU/F8Wat0IeHXXqaenRLaWpsS4jMoITw6HUvOdobYej1VefPeDvHBrGMLL5z7vUPp+2hc8fJ9S3KpmVaWkNzMWXaI4DSIAmXHArL71sYnaT9iOsR3Atq8evdX8dUaA3ivA7SBRoyxVnzmQydgK5GQfNfd8kvUJNf1DtlXKxvSErI69X5d/zLzyY7pkAC3vqAhlBIeIJeGpPaFWhVGGwdAXtllYlUE09/7zu/en9ZrXPmyt85LFbvbELkv2ZMZyw6fEllWdwXwrts46L6GMEFd1tcd0jr+3KtzvL1nYwhJcypdRmwobxy+lSlU+bQ+EshacObICdhM7Pn1EGLekgdzMCWZPp+EuJdGeMirdxHJjVrT18opeQGxncYgezO52UYk9ZxlB2MJqcbPUPU2xHZy6pbU6VdD3ke/kBAXJk2PevbayrdzxpeocpO9FHkjUAO1GD4ul8/KTppn5TwK5LpYTsty6nbbFzVOZXd9Ooxhoo41mRpjLJTkfKU8zEnBalczZKH8KKE8I3VwrhR8bQrdV+W5R2Ceqbrb2KCwIWT7JZ1WkvR/98GNJf2eoyGIXkuWDlpygTv3Ce0RGQHyyp3t7wWqHoldstOGAG7jgGRcSle+VkdK6eMiSeeKbg2hW+vFkdpiefnislt12T+wDMuyj6AXCpk65Vz27DIeghqEyEWYNgoI3auF2Ruj7z15YtIsZdVhvVm/EK+cTQgN8KD83s/KK9Kj0OtF55ZPRbDNqNdn6rVdvYbAWjJITZLseuBc5o55va9CE8vTT8WLA1UAN56AXENK6ux6ee4U6X/l0kivSM4kyTHJjzvkdJf1H+MMHKUn+/jk9RtIjuzFxJZ/IynGsi8iloInVJ+EnL4XQXd+2wfjTVz5nsaEWAlFwBvyq7hengt5Dlnne/903yGzDYMBR11+SBBMKj9vSmXeL6saKRHLsjBm8Fle/cszNADFgTS425nXRaVsNUn6/7g+0odH6/ASVFZyVpKqntUXKbomqxOT5ciOBfW+whc1gqTcRURJZvEgqHkMbei2BnqE6cCT3Ye67MHLe02BvCkjiP2o1N8jcFH2Jn9FoISH0tRkztYAZNuBuqz3agfgzOFo1QO/7pjs5xAt+UYpyZGs88ju9mjCKkSn5b6k76KQpEZYlFeVR+HcB9swZBg6svuoh7NhHPMmBMHtkkjTa83auMoPkFd8gKJsTUZ2sNvIHRZA5emLSN842oQePyo3b7gEJ18NZnGYXiakzeaU3ACFKce8b5cEFyeAxYvw/PnOoCv3ahh6svt4efiBaZkDmGaM367uqPKDU6rs61H13LYJaFlbm6++/0Sy1JCWBWvHZWm6n4qr/VkRqZ1tMb9cUsbEYkmC90QbnvilNowQRo7sFC8NPzgjPfzt0sZP5wkPeYUHWMXPg24oAC7R6Vym3liwIAknu/WNZXFV3JmrvbJUo/6T28a3NKTO+u8TMg+3CNHhNowoRprsBrvCVhgEvCmAHWGchUisjGt71Na0AdBlcOsdhQfIE98vQyHpWT/VLyV7uiA9eFuW5+Cbv9iGMcZk97Hr9b/W5DyYkV0dB7HEztgGAJBPUYKj+v1J7pOdrPd9Oi37tsbZTgWa4hgsv2QeokPj+3MJxmQvwS7Za4kYzMpOLuntpdr3SztSK0PKKbx5WQMwSq6J7tcX1yGta0tHvgB/9+9PwBiFGJN9Ddi157eUtz+C2uK4/pyofkF9X0VnZGRpIamLGgM4io6K5MqqPPaeNozRF2OyrwMT1x6dYSw4YpS+P+l9G0PLTP/1Tz8rILUGuq+glDxmvTnojEm+VozJfhGYeNNvzwCrHVFjdkww6vt1JyOTnWVLdkaWc+qelF1Vt9tgW776XK9zqA1jrAtjsl8CJt700RnB+RHIlD6fhkxB5owquqftqLfJq7jKysjMSm9M8kvAmOyXisZHwxpMzEqy341s9fSjq+jE6mCZwqtOIGzFf/NzJ2CMS0INxrhE7OpKal9P1dshOvHtrMDG5BwOMntBSF8mlL29YQxjXCrGyn4J2NU4LtOTsJQGrEA6ooB0SKktXWqzUvLrJdp7qufyfeZXHv6pwzDGRWNM9ouEJHqTCXZSErruEzyzM2ToQM6+mBKRdsejZ7UO2pdd9vyBbnvcWXQxGJP9IvDS606oMefzZUpePMxALZZlY1jumyhSd40IgE8tnzoQwRjrwpjs68QrrvuUTDmKlvHlglmPTtU8N0SYGPGcfXFMOrjBKhR8SQwiFDAm/DoxJvs6UJdEV5kRAa6CFyq608kE4EedvnunM4Q+ZLcLXYZi6oW/OjB+QvEaMSb7GvGqaz91XCr2jBkj4/ry1chObEqBwht7Y9LsPnIZG1vucsBDz/3lTyzCGKtiTPY14NXXfvq4AJzJ3cpXYF/cGz9oGtKsS35C5X6A4G63gwkcZc99M6yA9GZ7xmZeaL/rBIzRFxzG6Ivv2/Pp45J9MxzsP0b++v+yWixax9o7dsZ7X3jo9lnosb1ym4iZPVi6L9NlU5dMXK/nemLunDO28PLmnx2EMfpirOx9sPuNnzkuOTsDTrDJ1mVfsm0Q5/75r3+sRV+/vu/zIQb8JKjHSRtkaq3Lnoo7Ze/bUzbruS/fMlb4EozJXoIfUESX9iD1D2VEdwnvDwjTt/p1MRCHu6duWyh7r/pNfz7PMB1u4BDZn8Cuo/d5mFXqyS4CuST828eEL8CY7AW48g2/f1yemBkbXJaQ3HhyzpwbtQnZoxjYge7D71w1Y1K/6UstaVWO5AnOsjKWJd8zr6/Xc5zqfuEdbRjDwZjsHl77+j+Q6UVo5YnNi5W8tA46QS0+cO7UbdFa3/tVb1ualm9zHNQzMItsjGNf9M0bpC69MiSUlz2svanun71znJYkGJOdIHzdHyhlbSVPEzOqnnl1XpB9yWdh9Ly9HD93oNs5sO5u/XpzKZxgfEm+bZilLD3ip9kaT+W18mcPImAo7RPs7S5ORTBGgjHZNV73uj/KKXpKdF5iZaCQ9ALgxLdPv30GLgG7JeExqCUDzFbz7ukc9b2voCyM7gNIumEjITuexoRPMSa7xA+GfzgtO3ZOulbFKnqhV0+Sti7ZJenmvtX50RZsAHY3HwphB6YKr9+qr8JrG5OQnFuVl38jEcdK4Ud+8NjI59n3hCfDAIPjRXlxTnPmegr0dmoe6PXJnLENI7rCufZbI/miUzKT3kny7Nzm203OPV2W784Du6zz79n2AQ+DnRMnYYzRVvY9u0+GbAdou2B8uZZOT9ldBfcGeElF/+ZXp1qwCQinT9d7F1aUwjfKcu9ZYGrtS1rWD/1P5hzmn/rUvxzp8fAjrey8xk7KHsvQqLZ6zBzHkv5RJL2iiaqnW0hWbRrRFaLFvd3ajokpqeadrEeVWQVn3FN6bsrM9rqmvbOz3/+zp2ZhhDGyyv6m13zuqNTCWePTHSUHquB2fS5Q5TB35rG3tWALoBQeBSQKb1Q8U3YtWYlPTw7fqryv+sjZ3qcWfngkU5IjSfYfuuqP75Zf+7wlNSU494htf2PVJTrOfe1rW0N0A0n4UF59pO2SQas+ZBqYZsTmZdYG04FoOyemzt27N4IRw8iRvSF9OgbBWaroKZHpMiU8d7x6csMG4LHHvnHTtlgCRXgZlC5JjxKC9uU5YnMoIDmQhoDtcx+/YQpGDCNFdkV0xiVRpE8vVHTIKzsw79ezOV/sfGPfAdhGKMIHEzuW5OGECdm5R2zuBapkXdIQkn3Y/Lf/x96RClhHKkANIGgx5KEZSqsCUjskl9lBusjzU7JN0IHzOw/BNkMGrZG83hyQ6c4uZ15gGjhpxzRQNWU5sWxis7tnTzdhhDAyyn7j9/+pGlU4n7cqqaIzvy6v7NFKLKY6kcx/VwR7fvrrMxiw4xhYO1Noa1gaxKaKjllZ/YQj1sTUuQ+Phn8fCWVv7P58KGctJ43oKzrywk6kNCXJu0HFiK5w5jPXLDCZ42davRlRdRb4as6Iquv1Na5s3XEYEYwE2XcKXJJfbT2xLdq60Jy6tTCG9My5vygQ/NCpihHd4Mwnr2nJgPUY80lObU3NTsyb5PrmFR98bCTy70NP9n3f9/kjkt4hB15wm5xVdFp2VZ3NPRTdUOkbmndi0OI86HCi8Czn0TW5HbKztG6CHdndOh3CkGOoPfu++udDNgFnGcm0sILsi/HrzE87Al/4y2+9ZdsD0rVgz51nQ+lUTmOAdevftU8PkHh2SJYFI8tplqb9xAeuGep05FAru1SspUS10d4kzXwV9xXd/osCzgcmNXfm3smIBXBANdhE3YlyU2XPlrNyug0ErHnlb54ZajsztGS/6V988Yj04iEDllE8JT2lferXGZ3r1KP0u1PtaO9ADYt97Hcm25LwxxhJOWaBaY05gSrXJOc1x9cf2X306yEMKYaS7E1lXxBaTBPceHL/MResIEDVDWJOEj2CAcRj85OzsqG208dukBw7zys8D7yAdYLXJ3bUhjY7M5RkFwFvUXJb0hN1p4FpZm2S9dEDT+xtwQAjAHZYKTc3Cs5ZouimzlH7hORMET2Zww7evOr43zdhCDF0ZG++6s9npGIfTAnNckTPuXckNketYbitQwE2Ap3fvKoj+T2XkJqnhDepSKv2ft6dWZ8vc+/146frMGQYPmVHOMJIUOo6dJJj19tQ+yJPxsKXntw7HMNfJ3rzktRd5d0tyV1lT307s0S3V4PwFbteMXTB6lCRvVn/siJ6aJXadiI5AShRdnMFSMoC52BI0GlNduVlygarhuSFhCfWxmRnasHdu0+eDWGIMDRkb9aXQpl1my0MSMHLtBDPzs0VAHn7C+eGbIxIvJyoe0JiTgLSIJ+Z4b6VkcHqzlpwFIYIQ0P2gMct+TXVrYVhWdd/5tWd1COnTl2VFmDIoNSd1fBEYmVqNkjN5h7xeU1vN5GuhxqbvupL/9SEIcFQkP1Wqeqgg9Isr46ZSXFMi005OmNjoj89d90JGEIwDBbTNKOr5plXdxSdZ51OMJFuEwTsCAwJhoLsK4AtlpHbobwlPPrBqa2XUxuGFI/80qtlRxPr5jqUMvui1dybSH3zqr8cDnUfeLIrVZdfyUGX3GYJCqlPrItONwZD/csVMig9wXxf7ufavTmYudyuNlEbCnUfeLL3AI72U/TydXYJz7/4IAwzatgxHUuZP6dED1yCF9Q3w9PfbsKAY6DJLlW9KT/ANIPif9CH5Jn2M9ZZ7A7WGJj1IoiDdhKksjTXruYJ+U0DKMjQOJkZOcEQePeBJnsPcKaM6KuTP62RJ+BxGHKceu/lEagUJCW8P2UenSi8S/xm+PWnmjDAGFiyK68eAD8Iq1K8f+AqCd+GEYDka8QNqYuIHnjlIFFzd3kCBlrdB5bsQkALSqi8mp7bOgX1DJnhh0w6PZojuR5GUEp+bWNAB6qyrhmeHVx1H0iyJxkYnmZgoEy1Gcspe5JbZ3aeenZ4FkYA0o5kNqaQ5JlfL7M4ev3OYGDVfSDJrlS9iOh9A1KWX5f8jXEknlsu+d1Nx8Ww9OkgnHh3UxcU2JpsG9AdUdAMv/tMAwYQA0f2Zn2pzhjfD4Tg5qlea/9n9w6CiREhe6rmUGRfGCu2MwXbqP0hEDMwgBg4sk/IVKM88yGDYje+tn82QB0ZOGoOmsS6LvAsC1Vzv17ZQMYPhs88M3Dj3Qfu2+bIj7janJ+KaF2s7CPzQDT90AR9BeRGpbXas5TETP/AAlV0MBaHmbOmwOqyagYGDANF9ltfttSUFibMUdazMOljMMCjNcv793SzEEYAyYjQ7HmtDPJl99zQBpDZGCASw9jtMGAYKLILHsz4Cp5fJiRn2RfjzkkzmIhHhezB1fY8gCWyX4aChkDOq/mHINOQzzzThAHCwJA9DUzZ7TmtZp45YXQOAE4DMMt2EpwP3b2WRUCOddPgMzkgig5ASe9eCcHswSjpExc0DQOEgSH7LgjUzzfWQY9lLJyYmUNW51yWC9S+xoLrYQQgP20DfPuSnaNia5PuB+DJiZ0PWKA6MGRHMJ1IUKDq1Ko4vjLdmai8/4UB4kDmjNeDd5y80JBfdJ3pE5QFqpk+0Loym5g3iipQDYJgYNR9IMiux6w36emmBLaK7qs8aEWHrHFQtddfcGOmfna4rYyIG24/hLn4MSdYJxJQrOTJi7mSIxl0EAYEA6LsQRMoyVmBdQFwLsuOhSHkp8qVLe+qDbW6M6jdbi0KeL6cXA1ZMbGdZUauomldc1CszECQHdXoRvOtJPBVx1oWLx+sN/dsDWQ7mfUDFWitF/JjNqntA2L5rHXR2wLzSvlz7i/xnXwGBgCVJ3tyMzWzFsa5EGsFd22MW2dUyKo5I8qWNgDOg4G5FK8Xt/1hbzrNsRsxIBbGUBf12UVShuI5QN7ucOADkXOvPNljaWHI1wKOnYG8jaH+09iZvI0B8hoJ6j9/1eDfdlYELmx60CWprXMIn5Xd9S7RwalLrAxW38pUnuyyM0SrLiGtkzGwftNVebMP5G0MI1cBfSlHGNyhq2WY/jSG8jMfdOxesob8RVLvlLXSG6h1yS8c2HlaTufBC9XPylSa7KojyVgYIB7bBla+ndFrmb34Up+a7sxIG2CkIUDz568a7NvOfPQwboEmrFVhfSoNcVWFJrZTNkRXZUEUP9vP2B49D4L9UHFUmuwyh9u0JPf9umdngFyGTYmqe3ZVoFcC61+TWTDYt51RTB/HkCeqXmBZgFwXkeg8UWpD7GxZQE7N7cTUczLHyn4pCJBPuyRXcL8uU7YpRd61mxEbw8gXnO2WazTNO4dF3QORqboLci4zNQefxF1Av54oPrKCOqi//rnnmlBhVNyzc/fSaBmrl/UfKt6gHm7KjlGiF7cPl/SmKIbgYZ5S1ZugVd3AOWXGm2vC5hQdxF65HKUWBkrU3K9LXrkJFUZlyf6O+ldUR0+oTn36S83kq/MJbOokLgTiwfMrEy1Z0c1vx5xt3f1BpySh8Quv+78D+2xySfQ6Bzxu7Rz5iJSkJbZEkvvYqWsui5Dh/SnRWbqt0H5d6AYgmOvhVR1U27dXV9kDaJCkcFKFCfE9D54Us3ln8dw10WJ3sotAnrVOrwCOyjNSz8jm/Oh73jCY91nWekncEeZWkICTlj3FjoSI55NVMS7SxmAaCPPrDOGTnbDSvamVJTvKLu60REhaYkHMZgjiQbP/73/nDfNyXdtNRYJXhlwZ9eYBsJOz4WDdevZT9+Ld8hPMUqsCTtbFnXy/HjDeOrX3skhVP3LNZW25vssE9LEvjF4RknkNqjv0orJkl77RU3ar4lnc5RA9CVLdB5QiO6S+sJKYlryk16DS+vD8juA4DAh++iiGKLDlEj1dx3yC+3VJNoUt/MXe2gn6mihYx6QerZozh/A2TamDVs6bUFFUkuxqiIC0K2H6XVlC+x1BdLWa95aXnd9D+sy5Sek9YS5dz9zXAm9/gHzyguH0XXueOwIVhyK6lNQl+VHqjl0BcPPlZp5X6YhhMOe/Lhe9+5mn3DmFF2RK1X4/VBSVJPtKsDO9FDKmbUU/oqbeXf5tFz2g9NNPTs4zxtvZ9jn/XqDq9AoA2HrfnucPQoUhv8ST8jjDZAGhMHOyytRqv5VF/usKUWv7Pp0Gqlk5e0910qp7f0AlyS5UCosEjFlMRfw3el5cMHy07PUmavEB+T1EDrnBK7PyCTnO33Xt85X8En/2t/BoQjAv8FRYi6rLzqBj7Ztc+2Lw8HU7Okzl3GkmpjBApa8H9Tc8U81zVUmyc870rXKpahvboq2h+aNTu+k2geBLZa+3EE125Zd1yCc3Tezk4BJe3eVz8s49z4RQIfzcb+AReVLcNCklvEdGv07l0r88NdE3zSpjoU5u35ylYU46U8RiTPa1ApVSMU+Bs1mBBZHo9VF2hU8+8Zq2fN1j6etYptsxZSxvYRjYBsYhnNixY2m2UY0Mzb/7r3hQzloy3QeOqgNYgoOn7h75g5VgatU3isWj1L446cYi354Qno/JvhY0638tic7r9vtzyY1FFgQgUvn11V77k996zazKxQN5CVPAMs9OVF8eT9iDnUuwzZhpSTEQsAB+SO0t9vPpTIjDX7gt79N9CPV7U32uDmkjQBugqmXglbyJvXrKHvTCZK7VN0vlEgKiQ0a1TX9Vp+DADsh9uzS4dRoQ0FiBudXp1HjfW148DtsESfRQno+l5KxQ8mmwgrp8qlAc++K7dsyv4e1gIhadbMhAFpRCXs2TnlXU21QzSK0g2VkDqYc2FgM8z26Cx3SjDqwRC9EVMs0GB1QZGeGEQ2jdU0ve22yfvjXOvO/GrSf8zC9jyGKbYnRCDZ/gfp1tBNGLvVoL1oikk0kHqaW2JUd6qIfffjGEiqF6ZGfyEmgUnVoJSm6j9pr00kmeXsc7KMK3wQwncMU8ARbsk/WI633k/5n3//CLR2CLcKckOudS0RHC7Ah9a1FURwJHRXQBfKp9gK33ycVtn+TGujjDCLL1KDVLVM7KVDBAFWFW1CnG7Lt0sjKM2Br+OKwTC/94RUvueQKy1yV2idQBaXToNTjgrPX+fec3nfCK6CuorIsmeh8vnp/s9qwnDn3hwOo+3QfG+Phqau50LCny93ASKobKkR25enIVuGqbkYzlgkdFwMUn37hmG+O8V7xjVjamjtOY6JzWU+LTqw7H1vtvWtk0wt85K4neM0SHYkLTgy0PSOf+5Gcm2nBRwI5RbFfd0zpm7UtWlg0khIqhUmRv7n4oVPNUYYlvVnA8OhC/zS6K6AoL0eVdDFZkwCrVzic6IbZ5P6dM5vLbbd39ry5s+Dh4RfRYBqNMWRdPpXM2paA7P9teEv1zPzvRgovFStDxPHlajsFR80zVhbrxRjfOCqFqyh6ip+pFwwWQDgBj4nG4BCycuSISjE/RDA2aq4gXmBaqv55LgZv9xf2947BBeM9d2IgFLCFY0jhivhavnpCPLX7u4CUQHdTvqMbd1YNSV/UR2diz90PMMOmwMd6ZBoVm2RDOquvFK7vBwpnLZYZGHLDvSRsTWAsF2dWE7M3IDGf+Q3Pl9GwTL6nj6c47sQkqvShSRUc99fXmAAWqLs8NVz3Hl4ZTb00zMowEoMxXebTr0vLYxvSFzJc3/CyMm1MHcIb1JsHqujMLhfjEmVe3UWhieFeXDPS4Sl5HHm9D8Pj0nbde3Jf93l/AgygS6+I1GHRJbebUyrj2JcKYHVg8tDHnB9QPrVE1TywMestuOTxbreEV1bIxySOpkwL15OArrh0Tk1w+L1nZDe47c/mCjLrmMs6UkT473mJrI/cLZWfM0noJf+cdeARj1TOqUabedO7XJcEoRPF5PrX43vVnXsrA1BWUBqlOvICF84kVqNTNL5Uiu2DB1Uh7NKnKg2dtNNFELdjQX7v7xGOXt+SrzhWTnBHyu1aG8jE9QAwnhDj9/nf2Vn3ExOwM1u86iMclSVo5cqcvZmdkwoI6+b7RipBEP7xxRE/e5oJ4lio5qnKs5wWZGtloZVy842qoECpFdgYiUwLau5mpLFln8D14IYINhiJ8cg8rIw2M5Q62EPSqIKe69Mwn3/8uPFLyVnDnT2N4YQWXEHEm3R8LXgygqDqfXoSIn994oidvpWwR8ex5SwOetZHzXnw5VAjV8uyYZmNK1Rzy5Xa0d0OV3eATX31lK1F4cI8lh5LsTLqDKYjW+348Pu4Hru/5txcajEmiS5/vuJIsIgWnxRcGqnqdJLr01GzqMx/YeKInn0DEkSFxnvSYKDl4ao8Yh1AhVIvsAbrK7ufVWc5LR7CJ+FhHEp7BXOHQBQIsC1jJdjLgnFl5hTh953Tq4+/6Sbx7oldTwxxCx5aY10z+2BVFribbT91WB71NI3oCX9FjTfq4wK8b4vfGnr0UMjdb90kOzjLaIDBZxzZF1Sk+9rcvb6mgNT2W7CgKgX2CWb1PGIA4/b5/LZbkh5331pXvWKLmySyxF2zq9/7zjg0L1IvARRBBgaL3mzPgr4QKoWLZGPJ99iF91iAQN53sCh975OUtGU/MOdZZpz59+HwsUH01YrEJJUBSQIS+OXaprLJDTFqX1iYqukYP044lJzAl1iVReDOnPr5CqAzZ94UPab+OfUjPwB8ysFW4VxKeB+ywb2PK7As6HsbfIH+FKAo48y3HmaK4tzVETxAH3RzB/fx60hiAqHu1OpaqZWPInHbR50hvPDTfXM/u46MPvURaD3ZIAHZzRF0jEAr8t6/YZaS3UydASfQPbxHRDYQ/oU1DUhsTk3mFUBmyxxBbv068cSHpYftw76nLFkRPTMli1xyPwmrH5NgZZP2JDUTpIbe+w1fY1MIWE71z22WRq+olcxqwVovr1SG7jO2z+04t6fUagNxgLPPoku3Axx9+WQc5qrudMK/wrmfJ+EuI69Shv7+tL7A2EZOKvjDPtiRWyaEgEEVRXo+9sY0pB3NEzyN9NZTd4N6vXNaWR3KPKmeNEfJiTCv9umzbInX3lF9lXeDCNhJdIcmnow5OvdRj7BHf1FcI1SF7TWu4UXCfPEk9usuAz8I24qP/e9e8zMjMQwHRM2Be3RHzKg59bE1SJ9OLC/dusUf3kOs4SghtiI8ZwZFmZiqEio16pN4cHWX31T7dHrdP5TSW+cScnJ0uTNEUyDyiu12BVbGNQe/DEOe2m+gJCgJSdNKRmuhpJiZV+gqhMmTvARSQG7XKozeGXU/Itr2HbqHNuj124Y6ctyIq7teZcqHu+d5eQPu+jwUtqAJidFQbaX7dUXqj7tVie/XuQQVLbH8wGJBMTVLHWSV66D7elgErE3OZ5TAoKiOUKD7Zl6p8fOk3X2wYbP48F5giGSqQEl03ggqhOmSXXf8244JO1qVsnEyVsAuShw6ltuoiVL54YgsLCxWwLxpG1alfRxKoYqb8WSPYdptJUR2yB0HXyb7kVN2zMvoKUBXMSzsjjyh5lmTCU0pagL4qTxsBWRVJvsxBRdA4/kw9y7Lk8uvoDheITdAKY7L3gx+IOp1KXl3F4h+p7jWr7gC51CNtweg3Ai9Alfn0dpVUHdSYHmJXaGCaeXlicXBsY/oDdQbGHf+C5RkZDiFUCIm6Ix5z84xg52VqX2Bh4pXqqHqCZXCsS6beJu2oCU7XQW8coBaic+atEfXkJvWYLKs/jEyQt8VVgVb3cgsDbh0Zsm43F3D/wmcqpeoKYb+gNGdlUssTQYVQvTy77jiiKk7HxqR1xr9XqztaQam7nLWzCl+9ablkYoydhCpC31vqq3vexqTLomKKVDWyR4bMtMc0R3JbV6k7YQxiFPc73zO6/p2W6TbGr8cvwv1QNazEIfa1MZi3MRcu7QFWG42KBajC9ea6toDkRvHr+/Z8HaoGDvGimvuE9yf05omqy06khUVWqSyGglA3wwtC7KwnFd3OJqPsybqxZ+8DFiEZG4MFqUZL/GycTAgVw73tyyJUzzR3vDjrb2l0WQh8EKqImNXRIXaBsvuqL8aevRRSGB63JDYWpiAbo1brul1xUEkrw5nn2wvITTqDsx5ULkQbqgiU8VFsnyxg1RvcBkDGz6CoVpBdrefGcOxmQSqd6/WU5KYhXJi4UMmfNBGIqV8t8OVO2Zt6UNvUG6cvFhizq2GNym7WI/YqZcdqUCWoR0eTSz8D68/TZUVvZucsuYO9ksoukHU4M887JSuYXUZS1ht2FxZ55fy6AotFmPyqO0cwvytpkgjqkmTspe3pRnhh59beNrkaKkV2RNEFFqRloIRPyW0DVssZSagQKogAMMqG89JhDZoThuiZ2Cf1lcutZ0h+XED5ADREt+ROGoACR5pJ63YPTY6VvQwxxB2enFGmvbqr5VTVDfFFBXPtClyqdOm9CzlFB6OOlVT1a//LE430CV8psUk/R1pOVAnTJ5llHYLVCk4VKuXZV3ZAhPRSCFhobRUyZQF2fbOxrt8P2xIImHCJSw4eC7x7ejcSVBI7VrBO04x+J5KbkjR3LVVrEJhCpcgedabUyMFu5tOziSoJgH36QDIPoaKdS26ngFvn3n6HUGWsxEEDvECUBqtIG0AsdF285t+m3SpU8AfEUnUvVXRwOaSmF+ClIVQZRR/ErxfeugpBBad+jt0luciWDeFlNiqCiqGCQ3zFo2VqTgeIUbGciKuZfmQ+uQFKU47ZuipC8OsLU4vCHSqQ1cl5cAEql0KtHNllKrFjvbr99vPCiKSDiVeS7CkKxj+Y3yIi9dlvE1URQjSQ+PSU5K6aJ8vkSQPPx89XjuzVyrNDkn6MGEvboOVCmoeBLBNj8uxmLa/cL7MlyGVcSpYrjGt/6YmGJG8ds9y6Puck107XZWnHub3jAHU1xEHcoTYG+tgYK5bY2Neo2ICwZT33VH1Nv3pXIQQrIvR7TsusS1qXKH4le4ErR3aZkYlQPzgUHSNTHN9pqGxMCFWD/4wY9MrGwuiWy6B6kERuYhHBCbmBBKj6DqXKZWIUKkd2BaYHUVEbQ2O4zM8TxZcfpAlVg6/YRWU/I1MxoID9TibGC1RdVU+XRcCXoIKoJNnl6Xq8OBvj1dEgFWA/VBVFqq7LVbYxjZmzdUnyBs28UHKDc9OGVXdxofc4VBCVJLsA1s7UW8NR9BwS8jcr15OqDxr7lcly1cje2wWNLPPSR92B3KwhSd996jevq6Rnr1w2JkXc1r9erdXbz8ZAVkt4EkLq3auTBdDk9YfCmEFgtD5bWSGIFTHtZltA3ypJMjP55QehoqiksqthA/IURzSXjjmdB/BN8AXYNQ0VQja8F71y7vBTma/Sg0ClhZG5f3Z93qoInWMXhcuwErehoqgk2RWkStxvbtErIr175TcNge2HCgFxFcJjulF6lxJWzcbUJYmbSALPXLrRD1TlJIuVtDAKlSW7pEMnI3c2EtJjDABQFy8byPRNVcu3O8QuPHzI/cBvBRD3YkJ0kZ/MoC+P9E/fu7cNFUV1yS7UHfpuyjErMcjV6rLy7E2oCgipiwmPznaiQmzvxdKvZ+Qmqu40AJJnV08SENiGCqOyZE+H+7IOdetOqpE8Ki9TfKbGLFUp3+4qtiG8sS3+vCp59j3/5uvqgPY7Dz6KhfeYDD8To5bj6j3vhqDCNkYhfjCv4sbcAECWq7G1sjdyf2WGDiCU5NRNI0AnQK0QmqBuwxM0KLVlEEWBKqq7xSvr1xWqTXbOk4cNWa9eBhKqskTZQ6gSiJ3JCF4wx4rcxCFP9wy1MHQ0Yy5gzdaL6OlP3tiGCqPSZI8eeVtbjZNRZZPLLY7wKBBqHGagEvBaKFX2wjlsO/ZM/x9F7P1OTykJUk1Qmqm+7kyS/9tQcVTcxoA6qff7BoY+JczNyejlKlkZAyeWZg7xMbM2lTDtKgsTZj2iIgs+vbHsgvSaqsYqFqHiqDzZMRkUVpCTIUGp8wNjyaMdKmJlSEBql5ktZ3VYGa6zFTaTPKORWBiX4Db7Quvi8y9WtufUYACUXaYgmRoC4EgjmRfVQ4WsjEaR8zKpSCy5hW+Lcc07v6pIvt/PqUNRnp3Ug8zCdBenKvkYEIrKkz0dOgD2hg4oyb17DGIsuPumG7bXytAx69mx5lSe5dV++zAtg+TQDv6iRDf+3cvCJNtU9HnyHqqv7ApCnCDZFijLvTt5ePWI5e3sYFrOV61qZ7YRe249rc7zQaCjHKmFMRMiOH5e+vX4n1cqnV83GAiyx0lvqhnNaL16sZ2x6h9gcGRbh/0iFP5qHishOttezx7Kg522wSi1LJTcxM+ngelCt119C6MwEGRXVoahuL/U7NKxM2S9/NeECjxACftV+o1hm8AviBmj2ja/Tq2MXoeubxdx9bMwBoNhY0Bd9dmCLtm6glKO/LWXzMI2w8m2J2qvJR+J9JuMzDbg2rc9on5s4KDJwtgJc8Gp7VxKLE3U/eLNA2FhFAaG7N+UHUwAaK0McenWuFgnb7didzff8k2oJNCbtk/epaqL0PflxQpvrQ2r+MAvHwND9hR4zCc0kHKe9smkbMxB2CbkVJ38y5bMUIFt4Pp1Nz0sL4B40Hh1x6Zgcb7dKL+IL8zBAGGgyH6h15vPHoSf1OSksbjMcKZ5Q/V+aKz8M2wpmuomDXWblCF3MqEd5QhIcuqYWZh2t31bBAOEgSJ7knNH3aNKvXmGIrVXkF/mNqQh+6k6TZJmR73F2Zg9jYcAe70ZN+h01R1QOGput8EFGDAMmI1RQHLpNDk7dJ7pXmBl5CqZhqyEuturTkZ6TAkGW38Taijf2A1M1a/6EnVHEXtePVmOun9xywkYMAwc2c8kgar6rR5qVcwc7VgZoEGsmiVpyCZsIbK+XkfVVVkQry70cjptFfY0liCYwJbTaYQkIEXhBKjU2kBVf9FvFQygsisRNz2qVCWJkiPN1FjSJ51MW6buy2DGqNuj0yQyEwhLeDmJrfUxoQpMEwKbK4tDanei1kbAYAWmBgNJ9h0qUE2eB5n3v25mRi9jRrcmbKG6oyY4aJLboY16rn9UFHXdVim7UvWJYKLl5M9Jo/PVPjnurCHAQvfUgQgGEANJ9o66PxXTNKQ/USW1NsZV97dvkbpnik2tSqbsaK2LyYRsnWeflAeVqToNQmlgSrMwZr1YWRlIVVcYSLIrGHUvIjwlOU3vadI3YQvUXY0DExDLd9QT6gkKiA92vtloKFWH2kccO4Veg1PHKdwsjM63L3Q7g6nqCgNL9k6ShjSdTLZzJqfm6C4rQjHBj97y5jOwuVhOyC18kmMByQ3RxZYo+zQT8XTOk4u8TwevMTDAgcvAUAws2RVqUt3RU3c/KDWZD88bq5+lmd3sEZGOihP1tkovwGZmxKY/N6Zx7ZeVaB9NCazfX88ht0yJnyh9++nOgTYMMAaa7J1kNKRSd4UiC2OWhdcAEoodgU0eEWmsi6BKDgXlTOVj2Cw09iyp2YxkbZj58XVNOLBe3WCgya7ATWbGS/FRkqNTNuqO9Z38siO3btqN2csggCq5sMpZQnrYXGUPpQ85UqTqWKDqmKh5nCi+TPUuPf3YT7ZhwDHwZE8zM/GxMgUHS24ArzHIuRr+24RNgvXsggSrVM1jrwFsjrI39nxe3Undku8Tmh5R8Oek5zQlubUyLBZ3wBBg4MmuwHsil5mx6u6Q21H/pAkwPHLLm78GG41loJ49dtUdSIcSWKUXmzegfVIezcH06uEFyVluvdS+LJw78zMRDAGGguxJZgbEMarkkCsX1QlF9qYszN66CcFqPvvipyHjzKunyz3YaLz5jV9UP+TwANAgNLmCqPNA5sRm2TRkcqUZeK9uMBRkT6DUHcXZvGUpzr97dSpYnYQNxTIhdBHJ88uwwTYmsS8ALRWUOgruDOzqo+oCjw2LqisMDdkT7w7iHqvuwvPsbh3SgBVFHdjEfbc1NvYXDa09Sb17OvqF5t5jz7dvuLLLBtyzQakoSjF6Sp6RPz6LKyr4Hx4Mj7JLdP5mapGBWCoPSG1DyCyN6dBJx7xvqJ3JK3kvWzakTxtBL5nHG9ipdMPr/xgCIR6g1gRIw7K2JtaEj/VYmLQsi3PnokMRDBGGiuwKnOE9Rf7cDsjCTNFtF72ey9QcbJSdWV7WJO8RUhfYl5yVuXTc8PrkmUUtmVUJrQd3/TpmRCeqnjUCcfbcPxwc6N7SIgwd2R9+eKojv7x5S2zhEB3AJTidZOdPXQZzn72tcZrBBkCYDiWH5N4yKcMGdCo1woToU/L1jmSKTaZUwXtAGwFkFiclfSzO3wxDiKEju0IcywwC4lmad3eJTsfR0E6dpKyGEnzk1sbDcKkoCkRT+yKs0hPVFxuj7JNMwH1WvV1/bj4nFGRe0u3g2LnovREMIYaS7Emwynp3uGNiKPGpoiMluplUZ9PUpfj3ZdWDmgtMRc6+CCf9eGkB6g+/7o+gxsRH5OuH9H2owud8upmrAXLSvsSwMlRBKcVQkl3hkUfe0ZZf4Mk024LgE98qegw5S6NG+CF8Fi7Rv9u0Yy/LtmSBqqP6Zv3FB6j7wj9Qs5YM0KexgNCYI7dXp3pNWTw3rKquMLRkV+jF/A5pV55xglD0vTpCfmRiosZ1xJXP3vKmv7pI/77cJxgV+Xr1nuLibMy+8NNqNiUD0iO58S5AMy9kLqiFSc7Pwreiu4YuKKUYarIrOyME3uF2z1tig29fnK78hISJf7/lh74CFwPqxW25l1d2iC9a2ZvhcTWblK99X5bR8RQ7p+yCpiCT6Szng3lf6Xow1GRX+JvO22XuHeYBaWeSr/BIiE/UV5VZ4t8Pv/26JVgvyrIuwlH5nkP49b8HXC6nB9QgL9eyiMyLA1mGTO3tYC8GvXui6HAEQ46hJ7vCeRHMyS/9LCU25oiPXiMw+ehk+giogHXP2gm/TG1MgYoL2nuaEX19Aeq+8H/CMu64T2AvdDw4eGoOfp2JXZL189E/HR6YJ/FeCkaC7OlNHvEd6UNPYqC5d0puayXywSuX+Xe5MLkewme9o4mN6WV2Jg1Ue0kdVXaxDrLve21ir1ty32mr6D1wB5XlSQ96O1CTEGejJw8fhhHBSJBd4VTntrYk/D1Ofj0XrJoOH0/h03JdBPiA3HGy2VgL4ZctkZFmYXrO2BjhK/EasO+196nP0EoCUuhBfliCGxhDbjn5fM/gkHYelWFkyK7wUOddqmd1ySd4jviYr0+HA4tQBLEi/OXNcPWfEbK9pSKfeaFlo/Br6FS68cqPqdmMfM0jZYQGr1fWTzPqRvah6NwHIhghjBTZFZbh/LsT/45kdCSxK253PlX7bDncsXJBEp5dvtp75ZXdHR8jSM5doBlbXg5N9L0yLXo0n86ktqWXy6+D08HUm4++/ctD23lUhpEje6dzoCu/7ndDcl+Qq+hQpu7OdgnpGxMv2fmRd1z7J31y8MvWoniBqrUuPVfhRbln37f7o2q2lwXwgCRs3Qa1htSCqLcoXpe+/9l//PavjIxPpxg5sis83PmxDjA19t3Lq+sMjBO05oieqfOM3Pi+H92zWEp4E3TSQNX6dl/ty22MJvokD8RnE6ITNbdzksIkPh70Oq30ZwWujJRPpxhJsis81PmJeZV2Kw1QvUbgZms0SdEQ/o9yhE/vQY29/T0lpwpv7IeHfbuPqtkkTqhcurrjyLcvNnfu12eqnq5DHvfeHZ1rRTCiGFmyKzz01QOHJVGWnJ7UQlvj2xCngczIne+7+Y2/7xF+GYqI6XQqZcGpCVpdz37jlSnRYUJlgdzBXVS9hZeRASc70zO9pPf8/VNzHRhh1GDEsTOAd5+Pxd+CGhqLaVJS/6qBhqnEbBHIKj1ceEYxvfmG37sDVs5jOzqkV8fJIDSzk0l7ZsON6bNuyHYKmuh7cSKQRO/V/X3QdIShvQvLDoegozvVExRg7pvnPjRyAamPkVZ2hbYMWDG4cLPpYS1OQ8ZQOHaGZGwESyyNajSXp+NVlu1+ZHuRszBuWWHfa5OHnO1lnD+AyYA0ut6zKbkrjyAqr+6+ihck0VswxpjsCqc6PxP1YpQpSTNCkvhsSiDHkgh3G1XH4gZOTCQdT+p16f2lwrEfPZfwuk5t+yOvVSMTYIZxUNaljtlrWL8P2poYv28bARlkllqX0yvLL4xk5qUIG3L72bBg33Wfbkor84A8Kcz+Wjzq3yhDUlYnDq3roBYkLUeSnHcw4A9k6zLLY++UysbYWzvTRvVL3ghH0bEs5p5ZM35Hj+TJxvSk26RLwliisxc43Byd+40IxkgwJruHfdd+akYy/XhGcNTEThZRnzBTD0DJnD3RIK1Tj9SuO57fkNohqXuboE9ol+jWh4Mht/daAgzR+ZjoHgIYw8ETT322c9WrD7D00RrkCQVIH7/hz8ltf/Yez110HWSkJqMpwe/IctelDSEG+pRfuo8ZwkvjipTowZjoBRiTvQBPPHWyfdWrf0IJepMRwjOr2mDrrbK6xKZzo/gC/CHGAPSxHmQdesFywXq3sSSvI4keS6L/9wjGyGFM9hI88dT97av+xY8zUM+CREpuVbZKDYR0RWoPDmkRAPPjcMoI7ip3gZLTcekJ0VESfT6CMQoxJnsfPPH051LCJ4+1pv7dDhMmHj3Ln5crfN66uEpNiV9kabz0ZzbhWcbZzd8cE70vxmRfBU88/ceS8O9S8ep+qeiMkhuQEt8SHQsIbtXZH0tPrw6YtzfZMvX2Dtkl0S/cfObc70QwRl+Myb4GPPH0n7Zf+6p3PStpeQuo/kjwSY6EqPkGgCUK71uTzP/nAlNv2XZWSaL3JNHvjWCMVTFOPa4DN+757Zn0aVuS8L66IyW9XkZRUKctj82HWz8PfupR5FKS5FmVkug4Jvo6MCb7OnHjG4425Fl7QLLu8hzZvZw5zcKA/pVtG7DScTE2d24JTrYxuXSbaz99fuWym6PufBfGWDPGwwXWiYf//nAn4PBmlc9GLPTQ4Hr1mNTToNMd5wJkrI21LDGxOXo7WFkYE/3iMFb2i0Rjz6+HwQp7QKYmJ6k9cXPqkKm6XecGq34vanF92lcqyx86891PtGCMi8I4QL1InHv6y93vf+VNJzhjuyURG1k2xqQjaWbGm1yrUpCOJFcEvT3KKOGeb3z3E78BY1w0xsq+AXjz6+dakpO/ioqSkFdyP2jNkT17Whl6fj3Z9yxH8e6vPbUw0jdebATGZN8gNMLWNGOxytRcjiQL4wSpJBg1DxS1qcXCTMxpxuHdZ84tRDDGJWNM9g1EI/xPIahhvSAmHTU3ao/okdvvGc22UVsf+8Z3FsZj0TcQY8++gTjX/Up3d/0tJwSwXZK1PyKVmyG1NZDvNUVSr68GzwCP7/rGd373wzDGhmKs7JuEN4X3zDDEj6h8vLU11IsT0mv1F8q2MDa2LZuEMdk3EY1wNhTpzzNO0sAzm9sUJAoc25bNxpjsW4DrrrqrJRn9q6gGkqFH+KRzCu6Qat6GMTYVY7JvEfbsvjPkgZDBazxpglD559iLL8Jc1F0Y94aOMXy49qo7Wtf+wMz/e+MVM9MwxhhjjLEZ+P8xHNC2n+NRkgAAAABJRU5ErkJggg=="/>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#pattern0)" d="M7 0h57.538v72H7z"/><defs><pattern id="pattern0" width="1" height="1" patternContentUnits="objectBoundingBox"><use xlink:href="#image0_6709_29501" transform="scale(.00535 .00427)"/></pattern><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALsAAADqCAYAAAD6QjQ4AAAACXBIWXMAABYlAAAWJQFJUiTwAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAD0rSURBVHgB7X0LkCRHeeafWT27K56t4LBXlkA1GIiVQli9INnLhbjtkQFJOGzNcuewfXbcziqMTwh8mlWcw4cv8PbguLM5n9lZhy9QAKGd9YHh/GBH+AGYQNOyOWvDkr0tToYljL0lLAUL0p1aloRmd7ryv8yqzMo/s6p6ZnbnUf34dmsqK6uqu7r6y6++/8+sagZrxO5d+8I4iOsBjxvI2CsZsMsB2NXJSgYhAqvLujrKRWQgy7yuVqgJ1ZylZbPMGIvUrrLcla/XTeqRRcjZ4yDYM4zxx2OGXehB1O1+IYIxKozZ+q5dy/UVsdzgKL97yQeWzPGViCLUG4WMCV3EULEAWMKWZErokTADJX8wYqaeQ8TSfSLJq2cBRFe+boSoJtGdmNgh+bHYXctRMrpQrzfqu3q1BnK8Xi5OygO/Wh5QQ24WZpuz9JDyu+tDIqSmk19Pl92yehXu1Ou5/LCqgbBHBQRnBYsfrS1DZ60fdIwNwK47Q/m3WVPEBX41ohQ+SWYuxS3hpiYrkMkuk/XM1tFlQ/i0rNebbZlXpvsBdIGJSDUIWX4UAuxA3JON4EsdevjsB6+8af75f35RkbopN6ynB8C8T0mWGcsO213HsvVYSnbwlnn6Wiwlt21Iqsyzskf67EqRzLm8MiDvyI/9qKxpr8jy8rnPRDDGpeGlsw0uxH7GURIaG/JMN+SlN12HmmSa4D7JGVpyO+vLSJ5U0O1KGgEj23r7mv3chpG8UUc1AkmUY+w1r/qRpd5Kr5n/tAWEZ7SeZYftbJ8jO+gGwsn2zN2OuVbHIbPaj5VdDXhhA5DvEyHIBsBZu4f8wZUnFzowRjnqs3VpFxucs2nJ0+s1sesJcYxiO0QHS3hDaIQSVQfINQhGCE9JnJU9YnuEz5YZeQ96JSCkzxpEIKbZFa94y7ws3m0/OSW5R3hfnYu2p+Tz6mz9OsiuVR+97bDY6ngNhaVXDZTk55L8DBbhwsSDy+fujWDUUf/lppSK/dIhN+X5aaaE1d+oR2hD+IzQZYT3CY4FVoZR0vuE77MNW60BUKJTZdfrAj7Jdr/shqbkw5J7JgpUPX0Fb32BuueIDU4dJWSuXODjMwVfI9lNGb0rgN03OSBpe/j9cRwvrjz58dFQfaXetZ3SmgQHEeJpeQ7qRWSmRGbOupJ6Q2ZiXVyFL65jTnBKtmOe2hdaGare1NoA2QdII4DOs99d3MtCGZSeFxPP5M/O6jbGlMtJbfZbL9l5FqjmFZuXXAHKbU/uNZxliOQ+9wuoLaxE88NF/HqrDhMXJLH5QdDWJOVIf5K7dcSbe8Rn6Cs6UXW9Xc7KlAanRYSn24DTEPx1buMA0jiSvwvPffezh5KqK15+w5Jc29R7eWeMLDMGLtmzQ4Y8qfU6j+i+ckORCpeuL7MuvID0BQ1h9Xkk/yxcEHACovkIBhW7W015Sg5CLCTRoe4TOiFpjsBkjpaspr7M2lDPXqbqeasD4AektkzJS9YVNQAG4Pp9s627LCumn/vOH96fkv0VN0rfzkp8u1rSL+d5drotlpC9LDtTpMhpK7x4sheu6+fpWf6KkZzqdNu2THEuxP/w307AIECp+Mv43ZKMs2opIyolacY/qtb+er/OXd/fs+v9IW9tnO1YOeHzlgVc9c8IbsvmPVjeviT1K2xlcvncYpQs7n7ZPunbcck5eUATkITAjCi5Ny9TcdfHK/BVFThPTF6wvZeedOr1sTFeSPCyxkC9vd4uUsSPV2AOog9HUDVc9WtNeZhHZKlplVmvM2TPqTYUZ1co2cvKetvC9CL2U3SvjmZkfJtSRnhjX3K5d7utfU1zgrDz/Hf+1960XiL17Tu1b2fe3zypDRHy9YSkJWSnJC5S2iIVdlTdI7tT5we161Z7bj9btg3YbRm0Yybm4MyH27CdCKWK8x2piiNVcb3eU/F8Wat0IeHXXqaenRLaWpsS4jMoITw6HUvOdobYej1VefPeDvHBrGMLL5z7vUPp+2hc8fJ9S3KpmVaWkNzMWXaI4DSIAmXHArL71sYnaT9iOsR3Atq8evdX8dUaA3ivA7SBRoyxVnzmQydgK5GQfNfd8kvUJNf1DtlXKxvSErI69X5d/zLzyY7pkAC3vqAhlBIeIJeGpPaFWhVGGwdAXtllYlUE09/7zu/en9ZrXPmyt85LFbvbELkv2ZMZyw6fEllWdwXwrts46L6GMEFd1tcd0jr+3KtzvL1nYwhJcypdRmwobxy+lSlU+bQ+EshacObICdhM7Pn1EGLekgdzMCWZPp+EuJdGeMirdxHJjVrT18opeQGxncYgezO52UYk9ZxlB2MJqcbPUPU2xHZy6pbU6VdD3ke/kBAXJk2PevbayrdzxpeocpO9FHkjUAO1GD4ul8/KTppn5TwK5LpYTsty6nbbFzVOZXd9Ooxhoo41mRpjLJTkfKU8zEnBalczZKH8KKE8I3VwrhR8bQrdV+W5R2Ceqbrb2KCwIWT7JZ1WkvR/98GNJf2eoyGIXkuWDlpygTv3Ce0RGQHyyp3t7wWqHoldstOGAG7jgGRcSle+VkdK6eMiSeeKbg2hW+vFkdpiefnislt12T+wDMuyj6AXCpk65Vz27DIeghqEyEWYNgoI3auF2Ruj7z15YtIsZdVhvVm/EK+cTQgN8KD83s/KK9Kj0OtF55ZPRbDNqNdn6rVdvYbAWjJITZLseuBc5o55va9CE8vTT8WLA1UAN56AXENK6ux6ee4U6X/l0kivSM4kyTHJjzvkdJf1H+MMHKUn+/jk9RtIjuzFxJZ/IynGsi8iloInVJ+EnL4XQXd+2wfjTVz5nsaEWAlFwBvyq7hengt5Dlnne/903yGzDYMBR11+SBBMKj9vSmXeL6saKRHLsjBm8Fle/cszNADFgTS425nXRaVsNUn6/7g+0odH6/ASVFZyVpKqntUXKbomqxOT5ciOBfW+whc1gqTcRURJZvEgqHkMbei2BnqE6cCT3Ye67MHLe02BvCkjiP2o1N8jcFH2Jn9FoISH0tRkztYAZNuBuqz3agfgzOFo1QO/7pjs5xAt+UYpyZGs88ju9mjCKkSn5b6k76KQpEZYlFeVR+HcB9swZBg6svuoh7NhHPMmBMHtkkjTa83auMoPkFd8gKJsTUZ2sNvIHRZA5emLSN842oQePyo3b7gEJ18NZnGYXiakzeaU3ACFKce8b5cEFyeAxYvw/PnOoCv3ahh6svt4efiBaZkDmGaM367uqPKDU6rs61H13LYJaFlbm6++/0Sy1JCWBWvHZWm6n4qr/VkRqZ1tMb9cUsbEYkmC90QbnvilNowQRo7sFC8NPzgjPfzt0sZP5wkPeYUHWMXPg24oAC7R6Vym3liwIAknu/WNZXFV3JmrvbJUo/6T28a3NKTO+u8TMg+3CNHhNowoRprsBrvCVhgEvCmAHWGchUisjGt71Na0AdBlcOsdhQfIE98vQyHpWT/VLyV7uiA9eFuW5+Cbv9iGMcZk97Hr9b/W5DyYkV0dB7HEztgGAJBPUYKj+v1J7pOdrPd9Oi37tsbZTgWa4hgsv2QeokPj+3MJxmQvwS7Za4kYzMpOLuntpdr3SztSK0PKKbx5WQMwSq6J7tcX1yGta0tHvgB/9+9PwBiFGJN9Ddi157eUtz+C2uK4/pyofkF9X0VnZGRpIamLGgM4io6K5MqqPPaeNozRF2OyrwMT1x6dYSw4YpS+P+l9G0PLTP/1Tz8rILUGuq+glDxmvTnojEm+VozJfhGYeNNvzwCrHVFjdkww6vt1JyOTnWVLdkaWc+qelF1Vt9tgW776XK9zqA1jrAtjsl8CJt700RnB+RHIlD6fhkxB5owquqftqLfJq7jKysjMSm9M8kvAmOyXisZHwxpMzEqy341s9fSjq+jE6mCZwqtOIGzFf/NzJ2CMS0INxrhE7OpKal9P1dshOvHtrMDG5BwOMntBSF8mlL29YQxjXCrGyn4J2NU4LtOTsJQGrEA6ooB0SKktXWqzUvLrJdp7qufyfeZXHv6pwzDGRWNM9ouEJHqTCXZSErruEzyzM2ToQM6+mBKRdsejZ7UO2pdd9vyBbnvcWXQxGJP9IvDS606oMefzZUpePMxALZZlY1jumyhSd40IgE8tnzoQwRjrwpjs68QrrvuUTDmKlvHlglmPTtU8N0SYGPGcfXFMOrjBKhR8SQwiFDAm/DoxJvs6UJdEV5kRAa6CFyq608kE4EedvnunM4Q+ZLcLXYZi6oW/OjB+QvEaMSb7GvGqaz91XCr2jBkj4/ry1chObEqBwht7Y9LsPnIZG1vucsBDz/3lTyzCGKtiTPY14NXXfvq4AJzJ3cpXYF/cGz9oGtKsS35C5X6A4G63gwkcZc99M6yA9GZ7xmZeaL/rBIzRFxzG6Ivv2/Pp45J9MxzsP0b++v+yWixax9o7dsZ7X3jo9lnosb1ym4iZPVi6L9NlU5dMXK/nemLunDO28PLmnx2EMfpirOx9sPuNnzkuOTsDTrDJ1mVfsm0Q5/75r3+sRV+/vu/zIQb8JKjHSRtkaq3Lnoo7Ze/bUzbruS/fMlb4EozJXoIfUESX9iD1D2VEdwnvDwjTt/p1MRCHu6duWyh7r/pNfz7PMB1u4BDZn8Cuo/d5mFXqyS4CuST828eEL8CY7AW48g2/f1yemBkbXJaQ3HhyzpwbtQnZoxjYge7D71w1Y1K/6UstaVWO5AnOsjKWJd8zr6/Xc5zqfuEdbRjDwZjsHl77+j+Q6UVo5YnNi5W8tA46QS0+cO7UbdFa3/tVb1ualm9zHNQzMItsjGNf9M0bpC69MiSUlz2svanun71znJYkGJOdIHzdHyhlbSVPEzOqnnl1XpB9yWdh9Ly9HD93oNs5sO5u/XpzKZxgfEm+bZilLD3ip9kaT+W18mcPImAo7RPs7S5ORTBGgjHZNV73uj/KKXpKdF5iZaCQ9ALgxLdPv30GLgG7JeExqCUDzFbz7ukc9b2voCyM7gNIumEjITuexoRPMSa7xA+GfzgtO3ZOulbFKnqhV0+Sti7ZJenmvtX50RZsAHY3HwphB6YKr9+qr8JrG5OQnFuVl38jEcdK4Ud+8NjI59n3hCfDAIPjRXlxTnPmegr0dmoe6PXJnLENI7rCufZbI/miUzKT3kny7Nzm203OPV2W784Du6zz79n2AQ+DnRMnYYzRVvY9u0+GbAdou2B8uZZOT9ldBfcGeElF/+ZXp1qwCQinT9d7F1aUwjfKcu9ZYGrtS1rWD/1P5hzmn/rUvxzp8fAjrey8xk7KHsvQqLZ6zBzHkv5RJL2iiaqnW0hWbRrRFaLFvd3ajokpqeadrEeVWQVn3FN6bsrM9rqmvbOz3/+zp2ZhhDGyyv6m13zuqNTCWePTHSUHquB2fS5Q5TB35rG3tWALoBQeBSQKb1Q8U3YtWYlPTw7fqryv+sjZ3qcWfngkU5IjSfYfuuqP75Zf+7wlNSU494htf2PVJTrOfe1rW0N0A0n4UF59pO2SQas+ZBqYZsTmZdYG04FoOyemzt27N4IRw8iRvSF9OgbBWaroKZHpMiU8d7x6csMG4LHHvnHTtlgCRXgZlC5JjxKC9uU5YnMoIDmQhoDtcx+/YQpGDCNFdkV0xiVRpE8vVHTIKzsw79ezOV/sfGPfAdhGKMIHEzuW5OGECdm5R2zuBapkXdIQkn3Y/Lf/x96RClhHKkANIGgx5KEZSqsCUjskl9lBusjzU7JN0IHzOw/BNkMGrZG83hyQ6c4uZ15gGjhpxzRQNWU5sWxis7tnTzdhhDAyyn7j9/+pGlU4n7cqqaIzvy6v7NFKLKY6kcx/VwR7fvrrMxiw4xhYO1Noa1gaxKaKjllZ/YQj1sTUuQ+Phn8fCWVv7P58KGctJ43oKzrywk6kNCXJu0HFiK5w5jPXLDCZ42davRlRdRb4as6Iquv1Na5s3XEYEYwE2XcKXJJfbT2xLdq60Jy6tTCG9My5vygQ/NCpihHd4Mwnr2nJgPUY80lObU3NTsyb5PrmFR98bCTy70NP9n3f9/kjkt4hB15wm5xVdFp2VZ3NPRTdUOkbmndi0OI86HCi8Czn0TW5HbKztG6CHdndOh3CkGOoPfu++udDNgFnGcm0sILsi/HrzE87Al/4y2+9ZdsD0rVgz51nQ+lUTmOAdevftU8PkHh2SJYFI8tplqb9xAeuGep05FAru1SspUS10d4kzXwV9xXd/osCzgcmNXfm3smIBXBANdhE3YlyU2XPlrNyug0ErHnlb54ZajsztGS/6V988Yj04iEDllE8JT2lferXGZ3r1KP0u1PtaO9ADYt97Hcm25LwxxhJOWaBaY05gSrXJOc1x9cf2X306yEMKYaS7E1lXxBaTBPceHL/MResIEDVDWJOEj2CAcRj85OzsqG208dukBw7zys8D7yAdYLXJ3bUhjY7M5RkFwFvUXJb0hN1p4FpZm2S9dEDT+xtwQAjAHZYKTc3Cs5ZouimzlH7hORMET2Zww7evOr43zdhCDF0ZG++6s9npGIfTAnNckTPuXckNketYbitQwE2Ap3fvKoj+T2XkJqnhDepSKv2ft6dWZ8vc+/146frMGQYPmVHOMJIUOo6dJJj19tQ+yJPxsKXntw7HMNfJ3rzktRd5d0tyV1lT307s0S3V4PwFbteMXTB6lCRvVn/siJ6aJXadiI5AShRdnMFSMoC52BI0GlNduVlygarhuSFhCfWxmRnasHdu0+eDWGIMDRkb9aXQpl1my0MSMHLtBDPzs0VAHn7C+eGbIxIvJyoe0JiTgLSIJ+Z4b6VkcHqzlpwFIYIQ0P2gMct+TXVrYVhWdd/5tWd1COnTl2VFmDIoNSd1fBEYmVqNkjN5h7xeU1vN5GuhxqbvupL/9SEIcFQkP1Wqeqgg9Isr46ZSXFMi005OmNjoj89d90JGEIwDBbTNKOr5plXdxSdZ51OMJFuEwTsCAwJhoLsK4AtlpHbobwlPPrBqa2XUxuGFI/80qtlRxPr5jqUMvui1dybSH3zqr8cDnUfeLIrVZdfyUGX3GYJCqlPrItONwZD/csVMig9wXxf7ufavTmYudyuNlEbCnUfeLL3AI72U/TydXYJz7/4IAwzatgxHUuZP6dED1yCF9Q3w9PfbsKAY6DJLlW9KT/ANIPif9CH5Jn2M9ZZ7A7WGJj1IoiDdhKksjTXruYJ+U0DKMjQOJkZOcEQePeBJnsPcKaM6KuTP62RJ+BxGHKceu/lEagUJCW8P2UenSi8S/xm+PWnmjDAGFiyK68eAD8Iq1K8f+AqCd+GEYDka8QNqYuIHnjlIFFzd3kCBlrdB5bsQkALSqi8mp7bOgX1DJnhh0w6PZojuR5GUEp+bWNAB6qyrhmeHVx1H0iyJxkYnmZgoEy1Gcspe5JbZ3aeenZ4FkYA0o5kNqaQ5JlfL7M4ev3OYGDVfSDJrlS9iOh9A1KWX5f8jXEknlsu+d1Nx8Ww9OkgnHh3UxcU2JpsG9AdUdAMv/tMAwYQA0f2Zn2pzhjfD4Tg5qlea/9n9w6CiREhe6rmUGRfGCu2MwXbqP0hEDMwgBg4sk/IVKM88yGDYje+tn82QB0ZOGoOmsS6LvAsC1Vzv17ZQMYPhs88M3Dj3Qfu2+bIj7janJ+KaF2s7CPzQDT90AR9BeRGpbXas5TETP/AAlV0MBaHmbOmwOqyagYGDANF9ltfttSUFibMUdazMOljMMCjNcv793SzEEYAyYjQ7HmtDPJl99zQBpDZGCASw9jtMGAYKLILHsz4Cp5fJiRn2RfjzkkzmIhHhezB1fY8gCWyX4aChkDOq/mHINOQzzzThAHCwJA9DUzZ7TmtZp45YXQOAE4DMMt2EpwP3b2WRUCOddPgMzkgig5ASe9eCcHswSjpExc0DQOEgSH7LgjUzzfWQY9lLJyYmUNW51yWC9S+xoLrYQQgP20DfPuSnaNia5PuB+DJiZ0PWKA6MGRHMJ1IUKDq1Ko4vjLdmai8/4UB4kDmjNeDd5y80JBfdJ3pE5QFqpk+0Loym5g3iipQDYJgYNR9IMiux6w36emmBLaK7qs8aEWHrHFQtddfcGOmfna4rYyIG24/hLn4MSdYJxJQrOTJi7mSIxl0EAYEA6LsQRMoyVmBdQFwLsuOhSHkp8qVLe+qDbW6M6jdbi0KeL6cXA1ZMbGdZUauomldc1CszECQHdXoRvOtJPBVx1oWLx+sN/dsDWQ7mfUDFWitF/JjNqntA2L5rHXR2wLzSvlz7i/xnXwGBgCVJ3tyMzWzFsa5EGsFd22MW2dUyKo5I8qWNgDOg4G5FK8Xt/1hbzrNsRsxIBbGUBf12UVShuI5QN7ucOADkXOvPNljaWHI1wKOnYG8jaH+09iZvI0B8hoJ6j9/1eDfdlYELmx60CWprXMIn5Xd9S7RwalLrAxW38pUnuyyM0SrLiGtkzGwftNVebMP5G0MI1cBfSlHGNyhq2WY/jSG8jMfdOxesob8RVLvlLXSG6h1yS8c2HlaTufBC9XPylSa7KojyVgYIB7bBla+ndFrmb34Up+a7sxIG2CkIUDz568a7NvOfPQwboEmrFVhfSoNcVWFJrZTNkRXZUEUP9vP2B49D4L9UHFUmuwyh9u0JPf9umdngFyGTYmqe3ZVoFcC61+TWTDYt51RTB/HkCeqXmBZgFwXkeg8UWpD7GxZQE7N7cTUczLHyn4pCJBPuyRXcL8uU7YpRd61mxEbw8gXnO2WazTNO4dF3QORqboLci4zNQefxF1Av54oPrKCOqi//rnnmlBhVNyzc/fSaBmrl/UfKt6gHm7KjlGiF7cPl/SmKIbgYZ5S1ZugVd3AOWXGm2vC5hQdxF65HKUWBkrU3K9LXrkJFUZlyf6O+ldUR0+oTn36S83kq/MJbOokLgTiwfMrEy1Z0c1vx5xt3f1BpySh8Quv+78D+2xySfQ6Bzxu7Rz5iJSkJbZEkvvYqWsui5Dh/SnRWbqt0H5d6AYgmOvhVR1U27dXV9kDaJCkcFKFCfE9D54Us3ln8dw10WJ3sotAnrVOrwCOyjNSz8jm/Oh73jCY91nWekncEeZWkICTlj3FjoSI55NVMS7SxmAaCPPrDOGTnbDSvamVJTvKLu60REhaYkHMZgjiQbP/73/nDfNyXdtNRYJXhlwZ9eYBsJOz4WDdevZT9+Ld8hPMUqsCTtbFnXy/HjDeOrX3skhVP3LNZW25vssE9LEvjF4RknkNqjv0orJkl77RU3ar4lnc5RA9CVLdB5QiO6S+sJKYlryk16DS+vD8juA4DAh++iiGKLDlEj1dx3yC+3VJNoUt/MXe2gn6mihYx6QerZozh/A2TamDVs6bUFFUkuxqiIC0K2H6XVlC+x1BdLWa95aXnd9D+sy5Sek9YS5dz9zXAm9/gHzyguH0XXueOwIVhyK6lNQl+VHqjl0BcPPlZp5X6YhhMOe/Lhe9+5mn3DmFF2RK1X4/VBSVJPtKsDO9FDKmbUU/oqbeXf5tFz2g9NNPTs4zxtvZ9jn/XqDq9AoA2HrfnucPQoUhv8ST8jjDZAGhMHOyytRqv5VF/usKUWv7Pp0Gqlk5e0910qp7f0AlyS5UCosEjFlMRfw3el5cMHy07PUmavEB+T1EDrnBK7PyCTnO33Xt85X8En/2t/BoQjAv8FRYi6rLzqBj7Ztc+2Lw8HU7Okzl3GkmpjBApa8H9Tc8U81zVUmyc870rXKpahvboq2h+aNTu+k2geBLZa+3EE125Zd1yCc3Tezk4BJe3eVz8s49z4RQIfzcb+AReVLcNCklvEdGv07l0r88NdE3zSpjoU5u35ylYU46U8RiTPa1ApVSMU+Bs1mBBZHo9VF2hU8+8Zq2fN1j6etYptsxZSxvYRjYBsYhnNixY2m2UY0Mzb/7r3hQzloy3QeOqgNYgoOn7h75g5VgatU3isWj1L446cYi354Qno/JvhY0638tic7r9vtzyY1FFgQgUvn11V77k996zazKxQN5CVPAMs9OVF8eT9iDnUuwzZhpSTEQsAB+SO0t9vPpTIjDX7gt79N9CPV7U32uDmkjQBugqmXglbyJvXrKHvTCZK7VN0vlEgKiQ0a1TX9Vp+DADsh9uzS4dRoQ0FiBudXp1HjfW148DtsESfRQno+l5KxQ8mmwgrp8qlAc++K7dsyv4e1gIhadbMhAFpRCXs2TnlXU21QzSK0g2VkDqYc2FgM8z26Cx3SjDqwRC9EVMs0GB1QZGeGEQ2jdU0ve22yfvjXOvO/GrSf8zC9jyGKbYnRCDZ/gfp1tBNGLvVoL1oikk0kHqaW2JUd6qIfffjGEiqF6ZGfyEmgUnVoJSm6j9pr00kmeXsc7KMK3wQwncMU8ARbsk/WI633k/5n3//CLR2CLcKckOudS0RHC7Ah9a1FURwJHRXQBfKp9gK33ycVtn+TGujjDCLL1KDVLVM7KVDBAFWFW1CnG7Lt0sjKM2Br+OKwTC/94RUvueQKy1yV2idQBaXToNTjgrPX+fec3nfCK6CuorIsmeh8vnp/s9qwnDn3hwOo+3QfG+Phqau50LCny93ASKobKkR25enIVuGqbkYzlgkdFwMUn37hmG+O8V7xjVjamjtOY6JzWU+LTqw7H1vtvWtk0wt85K4neM0SHYkLTgy0PSOf+5Gcm2nBRwI5RbFfd0zpm7UtWlg0khIqhUmRv7n4oVPNUYYlvVnA8OhC/zS6K6AoL0eVdDFZkwCrVzic6IbZ5P6dM5vLbbd39ry5s+Dh4RfRYBqNMWRdPpXM2paA7P9teEv1zPzvRgovFStDxPHlajsFR80zVhbrxRjfOCqFqyh6ip+pFwwWQDgBj4nG4BCycuSISjE/RDA2aq4gXmBaqv55LgZv9xf2947BBeM9d2IgFLCFY0jhivhavnpCPLX7u4CUQHdTvqMbd1YNSV/UR2diz90PMMOmwMd6ZBoVm2RDOquvFK7vBwpnLZYZGHLDvSRsTWAsF2dWE7M3IDGf+Q3Pl9GwTL6nj6c47sQkqvShSRUc99fXmAAWqLs8NVz3Hl4ZTb00zMowEoMxXebTr0vLYxvSFzJc3/CyMm1MHcIb1JsHqujMLhfjEmVe3UWhieFeXDPS4Sl5HHm9D8Pj0nbde3Jf93l/AgygS6+I1GHRJbebUyrj2JcKYHVg8tDHnB9QPrVE1TywMestuOTxbreEV1bIxySOpkwL15OArrh0Tk1w+L1nZDe47c/mCjLrmMs6UkT473mJrI/cLZWfM0noJf+cdeARj1TOqUabedO7XJcEoRPF5PrX43vVnXsrA1BWUBqlOvICF84kVqNTNL5Uiu2DB1Uh7NKnKg2dtNNFELdjQX7v7xGOXt+SrzhWTnBHyu1aG8jE9QAwnhDj9/nf2Vn3ExOwM1u86iMclSVo5cqcvZmdkwoI6+b7RipBEP7xxRE/e5oJ4lio5qnKs5wWZGtloZVy842qoECpFdgYiUwLau5mpLFln8D14IYINhiJ8cg8rIw2M5Q62EPSqIKe69Mwn3/8uPFLyVnDnT2N4YQWXEHEm3R8LXgygqDqfXoSIn994oidvpWwR8ex5SwOetZHzXnw5VAjV8uyYZmNK1Rzy5Xa0d0OV3eATX31lK1F4cI8lh5LsTLqDKYjW+348Pu4Hru/5txcajEmiS5/vuJIsIgWnxRcGqnqdJLr01GzqMx/YeKInn0DEkSFxnvSYKDl4ao8Yh1AhVIvsAbrK7ufVWc5LR7CJ+FhHEp7BXOHQBQIsC1jJdjLgnFl5hTh953Tq4+/6Sbx7oldTwxxCx5aY10z+2BVFribbT91WB71NI3oCX9FjTfq4wK8b4vfGnr0UMjdb90kOzjLaIDBZxzZF1Sk+9rcvb6mgNT2W7CgKgX2CWb1PGIA4/b5/LZbkh5331pXvWKLmySyxF2zq9/7zjg0L1IvARRBBgaL3mzPgr4QKoWLZGPJ99iF91iAQN53sCh975OUtGU/MOdZZpz59+HwsUH01YrEJJUBSQIS+OXaprLJDTFqX1iYqukYP044lJzAl1iVReDOnPr5CqAzZ94UPab+OfUjPwB8ysFW4VxKeB+ywb2PK7As6HsbfIH+FKAo48y3HmaK4tzVETxAH3RzB/fx60hiAqHu1OpaqZWPInHbR50hvPDTfXM/u46MPvURaD3ZIAHZzRF0jEAr8t6/YZaS3UydASfQPbxHRDYQ/oU1DUhsTk3mFUBmyxxBbv068cSHpYftw76nLFkRPTMli1xyPwmrH5NgZZP2JDUTpIbe+w1fY1MIWE71z22WRq+olcxqwVovr1SG7jO2z+04t6fUagNxgLPPoku3Axx9+WQc5qrudMK/wrmfJ+EuI69Shv7+tL7A2EZOKvjDPtiRWyaEgEEVRXo+9sY0pB3NEzyN9NZTd4N6vXNaWR3KPKmeNEfJiTCv9umzbInX3lF9lXeDCNhJdIcmnow5OvdRj7BHf1FcI1SF7TWu4UXCfPEk9usuAz8I24qP/e9e8zMjMQwHRM2Be3RHzKg59bE1SJ9OLC/dusUf3kOs4SghtiI8ZwZFmZiqEio16pN4cHWX31T7dHrdP5TSW+cScnJ0uTNEUyDyiu12BVbGNQe/DEOe2m+gJCgJSdNKRmuhpJiZV+gqhMmTvARSQG7XKozeGXU/Itr2HbqHNuj124Y6ctyIq7teZcqHu+d5eQPu+jwUtqAJidFQbaX7dUXqj7tVie/XuQQVLbH8wGJBMTVLHWSV66D7elgErE3OZ5TAoKiOUKD7Zl6p8fOk3X2wYbP48F5giGSqQEl03ggqhOmSXXf8244JO1qVsnEyVsAuShw6ltuoiVL54YgsLCxWwLxpG1alfRxKoYqb8WSPYdptJUR2yB0HXyb7kVN2zMvoKUBXMSzsjjyh5lmTCU0pagL4qTxsBWRVJvsxBRdA4/kw9y7Lk8uvoDheITdAKY7L3gx+IOp1KXl3F4h+p7jWr7gC51CNtweg3Ai9Alfn0dpVUHdSYHmJXaGCaeXlicXBsY/oDdQbGHf+C5RkZDiFUCIm6Ix5z84xg52VqX2Bh4pXqqHqCZXCsS6beJu2oCU7XQW8coBaic+atEfXkJvWYLKs/jEyQt8VVgVb3cgsDbh0Zsm43F3D/wmcqpeoKYb+gNGdlUssTQYVQvTy77jiiKk7HxqR1xr9XqztaQam7nLWzCl+9ablkYoydhCpC31vqq3vexqTLomKKVDWyR4bMtMc0R3JbV6k7YQxiFPc73zO6/p2W6TbGr8cvwv1QNazEIfa1MZi3MRcu7QFWG42KBajC9ea6toDkRvHr+/Z8HaoGDvGimvuE9yf05omqy06khUVWqSyGglA3wwtC7KwnFd3OJqPsybqxZ+8DFiEZG4MFqUZL/GycTAgVw73tyyJUzzR3vDjrb2l0WQh8EKqImNXRIXaBsvuqL8aevRRSGB63JDYWpiAbo1brul1xUEkrw5nn2wvITTqDsx5ULkQbqgiU8VFsnyxg1RvcBkDGz6CoVpBdrefGcOxmQSqd6/WU5KYhXJi4UMmfNBGIqV8t8OVO2Zt6UNvUG6cvFhizq2GNym7WI/YqZcdqUCWoR0eTSz8D68/TZUVvZucsuYO9ksoukHU4M887JSuYXUZS1ht2FxZ55fy6AotFmPyqO0cwvytpkgjqkmTspe3pRnhh59beNrkaKkV2RNEFFqRloIRPyW0DVssZSagQKogAMMqG89JhDZoThuiZ2Cf1lcutZ0h+XED5ADREt+ROGoACR5pJ63YPTY6VvQwxxB2enFGmvbqr5VTVDfFFBXPtClyqdOm9CzlFB6OOlVT1a//LE430CV8psUk/R1pOVAnTJ5llHYLVCk4VKuXZV3ZAhPRSCFhobRUyZQF2fbOxrt8P2xIImHCJSw4eC7x7ejcSVBI7VrBO04x+J5KbkjR3LVVrEJhCpcgedabUyMFu5tOziSoJgH36QDIPoaKdS26ngFvn3n6HUGWsxEEDvECUBqtIG0AsdF285t+m3SpU8AfEUnUvVXRwOaSmF+ClIVQZRR/ErxfeugpBBad+jt0luciWDeFlNiqCiqGCQ3zFo2VqTgeIUbGciKuZfmQ+uQFKU47ZuipC8OsLU4vCHSqQ1cl5cAEql0KtHNllKrFjvbr99vPCiKSDiVeS7CkKxj+Y3yIi9dlvE1URQjSQ+PSU5K6aJ8vkSQPPx89XjuzVyrNDkn6MGEvboOVCmoeBLBNj8uxmLa/cL7MlyGVcSpYrjGt/6YmGJG8ds9y6Puck107XZWnHub3jAHU1xEHcoTYG+tgYK5bY2Neo2ICwZT33VH1Nv3pXIQQrIvR7TsusS1qXKH4le4ErR3aZkYlQPzgUHSNTHN9pqGxMCFWD/4wY9MrGwuiWy6B6kERuYhHBCbmBBKj6DqXKZWIUKkd2BaYHUVEbQ2O4zM8TxZcfpAlVg6/YRWU/I1MxoID9TibGC1RdVU+XRcCXoIKoJNnl6Xq8OBvj1dEgFWA/VBVFqq7LVbYxjZmzdUnyBs28UHKDc9OGVXdxofc4VBCVJLsA1s7UW8NR9BwS8jcr15OqDxr7lcly1cje2wWNLPPSR92B3KwhSd996jevq6Rnr1w2JkXc1r9erdXbz8ZAVkt4EkLq3auTBdDk9YfCmEFgtD5bWSGIFTHtZltA3ypJMjP55QehoqiksqthA/IURzSXjjmdB/BN8AXYNQ0VQja8F71y7vBTma/Sg0ClhZG5f3Z93qoInWMXhcuwErehoqgk2RWkStxvbtErIr175TcNge2HCgFxFcJjulF6lxJWzcbUJYmbSALPXLrRD1TlJIuVtDAKlSW7pEMnI3c2EtJjDABQFy8byPRNVcu3O8QuPHzI/cBvBRD3YkJ0kZ/MoC+P9E/fu7cNFUV1yS7UHfpuyjErMcjV6rLy7E2oCgipiwmPznaiQmzvxdKvZ+Qmqu40AJJnV08SENiGCqOyZE+H+7IOdetOqpE8Ki9TfKbGLFUp3+4qtiG8sS3+vCp59j3/5uvqgPY7Dz6KhfeYDD8To5bj6j3vhqDCNkYhfjCv4sbcAECWq7G1sjdyf2WGDiCU5NRNI0AnQK0QmqBuwxM0KLVlEEWBKqq7xSvr1xWqTXbOk4cNWa9eBhKqskTZQ6gSiJ3JCF4wx4rcxCFP9wy1MHQ0Yy5gzdaL6OlP3tiGCqPSZI8eeVtbjZNRZZPLLY7wKBBqHGagEvBaKFX2wjlsO/ZM/x9F7P1OTykJUk1Qmqm+7kyS/9tQcVTcxoA6qff7BoY+JczNyejlKlkZAyeWZg7xMbM2lTDtKgsTZj2iIgs+vbHsgvSaqsYqFqHiqDzZMRkUVpCTIUGp8wNjyaMdKmJlSEBql5ktZ3VYGa6zFTaTPKORWBiX4Db7Quvi8y9WtufUYACUXaYgmRoC4EgjmRfVQ4WsjEaR8zKpSCy5hW+Lcc07v6pIvt/PqUNRnp3Ug8zCdBenKvkYEIrKkz0dOgD2hg4oyb17DGIsuPumG7bXytAx69mx5lSe5dV++zAtg+TQDv6iRDf+3cvCJNtU9HnyHqqv7ApCnCDZFijLvTt5ePWI5e3sYFrOV61qZ7YRe249rc7zQaCjHKmFMRMiOH5e+vX4n1cqnV83GAiyx0lvqhnNaL16sZ2x6h9gcGRbh/0iFP5qHishOttezx7Kg522wSi1LJTcxM+ngelCt119C6MwEGRXVoahuL/U7NKxM2S9/NeECjxACftV+o1hm8AviBmj2ja/Tq2MXoeubxdx9bMwBoNhY0Bd9dmCLtm6glKO/LWXzMI2w8m2J2qvJR+J9JuMzDbg2rc9on5s4KDJwtgJc8Gp7VxKLE3U/eLNA2FhFAaG7N+UHUwAaK0McenWuFgnb7didzff8k2oJNCbtk/epaqL0PflxQpvrQ2r+MAvHwND9hR4zCc0kHKe9smkbMxB2CbkVJ38y5bMUIFt4Pp1Nz0sL4B40Hh1x6Zgcb7dKL+IL8zBAGGgyH6h15vPHoSf1OSksbjMcKZ5Q/V+aKz8M2wpmuomDXWblCF3MqEd5QhIcuqYWZh2t31bBAOEgSJ7knNH3aNKvXmGIrVXkF/mNqQh+6k6TZJmR73F2Zg9jYcAe70ZN+h01R1QOGput8EFGDAMmI1RQHLpNDk7dJ7pXmBl5CqZhqyEuturTkZ6TAkGW38Taijf2A1M1a/6EnVHEXtePVmOun9xywkYMAwc2c8kgar6rR5qVcwc7VgZoEGsmiVpyCZsIbK+XkfVVVkQry70cjptFfY0liCYwJbTaYQkIEXhBKjU2kBVf9FvFQygsisRNz2qVCWJkiPN1FjSJ51MW6buy2DGqNuj0yQyEwhLeDmJrfUxoQpMEwKbK4tDanei1kbAYAWmBgNJ9h0qUE2eB5n3v25mRi9jRrcmbKG6oyY4aJLboY16rn9UFHXdVim7UvWJYKLl5M9Jo/PVPjnurCHAQvfUgQgGEANJ9o66PxXTNKQ/USW1NsZV97dvkbpnik2tSqbsaK2LyYRsnWeflAeVqToNQmlgSrMwZr1YWRlIVVcYSLIrGHUvIjwlOU3vadI3YQvUXY0DExDLd9QT6gkKiA92vtloKFWH2kccO4Veg1PHKdwsjM63L3Q7g6nqCgNL9k6ShjSdTLZzJqfm6C4rQjHBj97y5jOwuVhOyC18kmMByQ3RxZYo+zQT8XTOk4u8TwevMTDAgcvAUAws2RVqUt3RU3c/KDWZD88bq5+lmd3sEZGOihP1tkovwGZmxKY/N6Zx7ZeVaB9NCazfX88ht0yJnyh9++nOgTYMMAaa7J1kNKRSd4UiC2OWhdcAEoodgU0eEWmsi6BKDgXlTOVj2Cw09iyp2YxkbZj58XVNOLBe3WCgya7ATWbGS/FRkqNTNuqO9Z38siO3btqN2csggCq5sMpZQnrYXGUPpQ85UqTqWKDqmKh5nCi+TPUuPf3YT7ZhwDHwZE8zM/GxMgUHS24ArzHIuRr+24RNgvXsggSrVM1jrwFsjrI39nxe3Undku8Tmh5R8Oek5zQlubUyLBZ3wBBg4MmuwHsil5mx6u6Q21H/pAkwPHLLm78GG41loJ49dtUdSIcSWKUXmzegfVIezcH06uEFyVluvdS+LJw78zMRDAGGguxJZgbEMarkkCsX1QlF9qYszN66CcFqPvvipyHjzKunyz3YaLz5jV9UP+TwANAgNLmCqPNA5sRm2TRkcqUZeK9uMBRkT6DUHcXZvGUpzr97dSpYnYQNxTIhdBHJ88uwwTYmsS8ALRWUOgruDOzqo+oCjw2LqisMDdkT7w7iHqvuwvPsbh3SgBVFHdjEfbc1NvYXDa09Sb17OvqF5t5jz7dvuLLLBtyzQakoSjF6Sp6RPz6LKyr4Hx4Mj7JLdP5mapGBWCoPSG1DyCyN6dBJx7xvqJ3JK3kvWzakTxtBL5nHG9ipdMPr/xgCIR6g1gRIw7K2JtaEj/VYmLQsi3PnokMRDBGGiuwKnOE9Rf7cDsjCTNFtF72ey9QcbJSdWV7WJO8RUhfYl5yVuXTc8PrkmUUtmVUJrQd3/TpmRCeqnjUCcfbcPxwc6N7SIgwd2R9+eKojv7x5S2zhEB3AJTidZOdPXQZzn72tcZrBBkCYDiWH5N4yKcMGdCo1woToU/L1jmSKTaZUwXtAGwFkFiclfSzO3wxDiKEju0IcywwC4lmad3eJTsfR0E6dpKyGEnzk1sbDcKkoCkRT+yKs0hPVFxuj7JNMwH1WvV1/bj4nFGRe0u3g2LnovREMIYaS7Emwynp3uGNiKPGpoiMluplUZ9PUpfj3ZdWDmgtMRc6+CCf9eGkB6g+/7o+gxsRH5OuH9H2owud8upmrAXLSvsSwMlRBKcVQkl3hkUfe0ZZf4Mk024LgE98qegw5S6NG+CF8Fi7Rv9u0Yy/LtmSBqqP6Zv3FB6j7wj9Qs5YM0KexgNCYI7dXp3pNWTw3rKquMLRkV+jF/A5pV55xglD0vTpCfmRiosZ1xJXP3vKmv7pI/77cJxgV+Xr1nuLibMy+8NNqNiUD0iO58S5AMy9kLqiFSc7Pwreiu4YuKKUYarIrOyME3uF2z1tig29fnK78hISJf7/lh74CFwPqxW25l1d2iC9a2ZvhcTWblK99X5bR8RQ7p+yCpiCT6Szng3lf6Xow1GRX+JvO22XuHeYBaWeSr/BIiE/UV5VZ4t8Pv/26JVgvyrIuwlH5nkP49b8HXC6nB9QgL9eyiMyLA1mGTO3tYC8GvXui6HAEQ46hJ7vCeRHMyS/9LCU25oiPXiMw+ehk+giogHXP2gm/TG1MgYoL2nuaEX19Aeq+8H/CMu64T2AvdDw4eGoOfp2JXZL189E/HR6YJ/FeCkaC7OlNHvEd6UNPYqC5d0puayXywSuX+Xe5MLkewme9o4mN6WV2Jg1Ue0kdVXaxDrLve21ir1ty32mr6D1wB5XlSQ96O1CTEGejJw8fhhHBSJBd4VTntrYk/D1Ofj0XrJoOH0/h03JdBPiA3HGy2VgL4ZctkZFmYXrO2BjhK/EasO+196nP0EoCUuhBfliCGxhDbjn5fM/gkHYelWFkyK7wUOddqmd1ySd4jviYr0+HA4tQBLEi/OXNcPWfEbK9pSKfeaFlo/Br6FS68cqPqdmMfM0jZYQGr1fWTzPqRvah6NwHIhghjBTZFZbh/LsT/45kdCSxK253PlX7bDncsXJBEp5dvtp75ZXdHR8jSM5doBlbXg5N9L0yLXo0n86ktqWXy6+D08HUm4++/ctD23lUhpEje6dzoCu/7ndDcl+Qq+hQpu7OdgnpGxMv2fmRd1z7J31y8MvWoniBqrUuPVfhRbln37f7o2q2lwXwgCRs3Qa1htSCqLcoXpe+/9l//PavjIxPpxg5sis83PmxDjA19t3Lq+sMjBO05oieqfOM3Pi+H92zWEp4E3TSQNX6dl/ty22MJvokD8RnE6ITNbdzksIkPh70Oq30ZwWujJRPpxhJsis81PmJeZV2Kw1QvUbgZms0SdEQ/o9yhE/vQY29/T0lpwpv7IeHfbuPqtkkTqhcurrjyLcvNnfu12eqnq5DHvfeHZ1rRTCiGFmyKzz01QOHJVGWnJ7UQlvj2xCngczIne+7+Y2/7xF+GYqI6XQqZcGpCVpdz37jlSnRYUJlgdzBXVS9hZeRASc70zO9pPf8/VNzHRhh1GDEsTOAd5+Pxd+CGhqLaVJS/6qBhqnEbBHIKj1ceEYxvfmG37sDVs5jOzqkV8fJIDSzk0l7ZsON6bNuyHYKmuh7cSKQRO/V/X3QdIShvQvLDoegozvVExRg7pvnPjRyAamPkVZ2hbYMWDG4cLPpYS1OQ8ZQOHaGZGwESyyNajSXp+NVlu1+ZHuRszBuWWHfa5OHnO1lnD+AyYA0ut6zKbkrjyAqr+6+ihck0VswxpjsCqc6PxP1YpQpSTNCkvhsSiDHkgh3G1XH4gZOTCQdT+p16f2lwrEfPZfwuk5t+yOvVSMTYIZxUNaljtlrWL8P2poYv28bARlkllqX0yvLL4xk5qUIG3L72bBg33Wfbkor84A8Kcz+Wjzq3yhDUlYnDq3roBYkLUeSnHcw4A9k6zLLY++UysbYWzvTRvVL3ghH0bEs5p5ZM35Hj+TJxvSk26RLwliisxc43Byd+40IxkgwJruHfdd+akYy/XhGcNTEThZRnzBTD0DJnD3RIK1Tj9SuO57fkNohqXuboE9ol+jWh4Mht/daAgzR+ZjoHgIYw8ETT322c9WrD7D00RrkCQVIH7/hz8ltf/Yez110HWSkJqMpwe/IctelDSEG+pRfuo8ZwkvjipTowZjoBRiTvQBPPHWyfdWrf0IJepMRwjOr2mDrrbK6xKZzo/gC/CHGAPSxHmQdesFywXq3sSSvI4keS6L/9wjGyGFM9hI88dT97av+xY8zUM+CREpuVbZKDYR0RWoPDmkRAPPjcMoI7ip3gZLTcekJ0VESfT6CMQoxJnsfPPH051LCJ4+1pv7dDhMmHj3Ln5crfN66uEpNiV9kabz0ZzbhWcbZzd8cE70vxmRfBU88/ceS8O9S8ep+qeiMkhuQEt8SHQsIbtXZH0tPrw6YtzfZMvX2Dtkl0S/cfObc70QwRl+Myb4GPPH0n7Zf+6p3PStpeQuo/kjwSY6EqPkGgCUK71uTzP/nAlNv2XZWSaL3JNHvjWCMVTFOPa4DN+757Zn0aVuS8L66IyW9XkZRUKctj82HWz8PfupR5FKS5FmVkug4Jvo6MCb7OnHjG4425Fl7QLLu8hzZvZw5zcKA/pVtG7DScTE2d24JTrYxuXSbaz99fuWym6PufBfGWDPGwwXWiYf//nAn4PBmlc9GLPTQ4Hr1mNTToNMd5wJkrI21LDGxOXo7WFkYE/3iMFb2i0Rjz6+HwQp7QKYmJ6k9cXPqkKm6XecGq34vanF92lcqyx86891PtGCMi8I4QL1InHv6y93vf+VNJzhjuyURG1k2xqQjaWbGm1yrUpCOJFcEvT3KKOGeb3z3E78BY1w0xsq+AXjz6+dakpO/ioqSkFdyP2jNkT17Whl6fj3Z9yxH8e6vPbUw0jdebATGZN8gNMLWNGOxytRcjiQL4wSpJBg1DxS1qcXCTMxpxuHdZ84tRDDGJWNM9g1EI/xPIahhvSAmHTU3ao/okdvvGc22UVsf+8Z3FsZj0TcQY8++gTjX/Up3d/0tJwSwXZK1PyKVmyG1NZDvNUVSr68GzwCP7/rGd373wzDGhmKs7JuEN4X3zDDEj6h8vLU11IsT0mv1F8q2MDa2LZuEMdk3EY1wNhTpzzNO0sAzm9sUJAoc25bNxpjsW4DrrrqrJRn9q6gGkqFH+KRzCu6Qat6GMTYVY7JvEfbsvjPkgZDBazxpglD559iLL8Jc1F0Y94aOMXy49qo7Wtf+wMz/e+MVM9MwxhhjjLEZ+P8xHNC2n+NRkgAAAABJRU5ErkJggg==" id="image0_6709_29501" width="187" height="234"/></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/coefficient-dark.svg b/web/packages/design/src/ResourceIcon/assets/coefficient-dark.svg
index d790db28ebb23..1c2989ba84a71 100644
--- a/web/packages/design/src/ResourceIcon/assets/coefficient-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/coefficient-dark.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7122)">
-<path d="M61.8133 14.0804L61.8161 14.0828C62.0818 14.3125 62.3521 14.5461 62.6305 14.7842V14.7803C62.9779 14.4294 63.3177 14.0781 63.6548 13.7296C64.4239 12.9345 65.1793 12.1535 65.9797 11.4234C66.6449 10.8204 66.5165 10.4431 65.9097 9.96077C65.4388 9.58598 64.9796 9.19374 64.5203 8.80149C63.6782 8.08236 62.8362 7.36322 61.9225 6.75159C50.0506 -1.20713 37.5446 -2.19127 24.778 4.1298C10.5526 11.1744 2.98674 26.9285 5.83415 42.5464C8.86827 59.1757 23.1792 71.5184 39.9874 71.9852C48.1446 72.2107 55.5665 69.9469 62.2026 65.205C63.2675 64.4436 64.265 63.5875 65.2972 62.7015L65.2993 62.6997C65.7748 62.2917 66.2575 61.8773 66.7577 61.463C65.5207 60.2532 64.4471 59.2029 63.3735 58.1487L63.3675 58.1429C62.5605 57.3514 62.5545 57.3455 61.7086 58.1332C57.4336 62.1242 52.4079 64.6955 46.6742 65.7302C40.8938 66.7727 35.2184 66.2514 29.7531 63.9719C22.4712 60.93 17.1421 55.8071 13.7928 48.7002C11.0388 42.8615 10.327 36.696 11.5795 30.3633C13.3883 21.2259 18.4607 14.3525 26.4934 9.73129C32.2271 6.43651 38.4665 5.35123 45.0248 6.16811C50.7041 6.87607 55.757 9.05832 60.1799 12.6915C60.7259 13.1404 61.2598 13.6019 61.8133 14.0804Z" fill="white"/>
-<path d="M58.7854 27.1153C59.0876 27.6251 59.3952 28.1441 59.7216 28.6683L59.7293 28.6644C60.2001 28.4721 60.6748 28.2776 61.1525 28.0818C62.23 27.6403 63.3224 27.1927 64.4167 26.7506C64.9062 26.5534 64.7772 26.2574 64.6416 25.9462C64.6274 25.9137 64.6132 25.8809 64.5995 25.8482C60.8419 16.8236 51.1638 10.312 41.3924 10.417C31.1386 10.5259 23.2733 14.9954 18.3837 24.0433C13.9025 32.3365 14.1592 40.8126 18.7649 49.0164C22.0907 54.9329 27.1826 58.7917 33.6787 60.7678C39.1518 62.4327 44.5704 62.207 49.9424 60.2776C50.5492 60.0598 50.7554 59.8341 50.4559 59.1729C49.8918 57.9281 49.4017 56.6484 48.9271 55.3686C48.7015 54.7618 48.437 54.6412 47.7913 54.8668C42.2054 56.8195 36.7673 56.4811 31.5354 53.6493C26.1868 50.7552 22.8804 46.2701 21.5345 40.3886C19.644 32.1381 23.3744 23.5804 30.6913 19.0875C39.3113 13.7934 50.8293 15.9679 56.8431 24.0783C57.5478 25.0276 58.1548 26.0515 58.7854 27.1153Z" fill="white"/>
-<path d="M48.1447 29.3479C46.7365 28.076 45.3089 27.1813 43.6208 26.7262C37.7003 25.1157 31.671 29.6242 31.5699 35.7779C31.5037 39.8818 33.3553 42.9548 37.0001 44.7209C40.7189 46.5219 44.3054 45.9928 47.5145 43.3244C47.5452 43.2989 47.5751 43.273 47.6045 43.2476C47.8621 43.0252 48.0803 42.8368 48.4364 43.1999C49.2819 44.0591 50.1371 44.9086 51.0186 45.7843C51.3822 46.1454 51.7504 46.5111 52.124 46.8836C52.0332 46.9796 51.9502 47.0735 51.8705 47.1635C51.7112 47.3436 51.5652 47.5086 51.3967 47.6461C46.826 51.427 41.668 52.5745 36.0627 50.5946C30.5001 48.6302 27.0615 44.608 26.0267 38.7615C24.4669 29.9393 30.4146 21.9105 39.2446 20.7863C43.8581 20.199 47.8996 21.5332 51.4394 24.5128C52.0307 25.0107 52.1046 25.3297 51.4978 25.9054C50.6635 26.6892 49.8758 27.5236 49.0762 28.3707C48.7686 28.6966 48.4592 29.0244 48.1447 29.3519V29.3479Z" fill="white"/>
-<path d="M46.3111 36.2695C46.3111 39.0477 44.0589 41.2998 41.2807 41.2998C38.5025 41.2998 36.2503 39.0477 36.2503 36.2695C36.2503 33.4913 38.5025 31.2391 41.2807 31.2391C44.0589 31.2391 46.3111 33.4913 46.3111 36.2695Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7122">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_15936_7122)"><path d="m61.813 14.08.003.003q.398.345.814.701v-.004q.52-.526 1.025-1.05c.769-.796 1.524-1.577 2.325-2.307.665-.603.536-.98-.07-1.462a52 52 0 0 1-1.39-1.16c-.842-.719-1.684-1.438-2.597-2.05C50.05-1.206 37.545-2.19 24.777 4.13 10.553 11.174 2.987 26.929 5.834 42.546c3.034 16.63 17.345 28.972 34.153 29.44 8.158.225 15.58-2.04 22.216-6.781 1.064-.761 2.062-1.617 3.094-2.503l.002-.002c.476-.408.958-.823 1.459-1.237-1.237-1.21-2.31-2.26-3.384-3.314l-.007-.006c-.806-.792-.812-.797-1.658-.01-4.275 3.991-9.301 6.562-15.035 7.597-5.78 1.043-11.456.521-16.92-1.758C22.47 60.93 17.141 55.807 13.792 48.7c-2.754-5.839-3.466-12.004-2.213-18.337 1.808-9.137 6.88-16.01 14.913-20.632 5.734-3.294 11.974-4.38 18.532-3.563 5.68.708 10.732 2.89 15.155 6.523.546.45 1.08.91 1.633 1.39"/><path d="M58.785 27.115c.303.51.61 1.03.937 1.553l.007-.004 1.424-.582c1.077-.442 2.17-.89 3.264-1.331.49-.198.36-.494.225-.805l-.042-.098c-3.758-9.024-13.436-15.536-23.208-15.431-10.253.109-18.119 4.578-23.008 13.626-4.482 8.294-4.225 16.77.38 24.973 3.327 5.917 8.419 9.776 14.915 11.752 5.473 1.665 10.891 1.439 16.263-.49.607-.218.813-.444.514-1.105-.564-1.245-1.054-2.525-1.529-3.804-.225-.607-.49-.728-1.136-.502-5.586 1.953-11.024 1.614-16.256-1.218-5.348-2.894-8.655-7.379-10-13.26-1.891-8.25 1.84-16.809 9.156-21.302 8.62-5.294 20.138-3.12 26.152 4.991.705.95 1.312 1.974 1.942 3.037"/><path d="M48.145 29.348c-1.409-1.272-2.836-2.167-4.524-2.622-5.92-1.61-11.95 2.898-12.051 9.052-.066 4.104 1.785 7.177 5.43 8.943 3.719 1.8 7.305 1.272 10.514-1.397l.09-.076c.258-.223.476-.411.832-.048a300 300 0 0 0 2.583 2.584l1.105 1.1q-.134.144-.254.28c-.159.18-.305.345-.473.482-4.571 3.781-9.729 4.929-15.334 2.949-5.563-1.965-9.002-5.987-10.036-11.833-1.56-8.823 4.388-16.851 13.218-17.976 4.613-.587 8.655.747 12.194 3.727.592.498.666.817.059 1.392-.834.784-1.622 1.619-2.422 2.466q-.46.49-.931.98z"/><path d="M46.311 36.27a5.03 5.03 0 1 1-10.06 0 5.03 5.03 0 0 1 10.06 0"/></g><defs><clipPath id="clip0_15936_7122"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/coefficient-light.svg b/web/packages/design/src/ResourceIcon/assets/coefficient-light.svg
index 5171bdef97e9f..cf4b1a3535a42 100644
--- a/web/packages/design/src/ResourceIcon/assets/coefficient-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/coefficient-light.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7121)">
-<path d="M61.8133 14.0804L61.8161 14.0828C62.0818 14.3125 62.3521 14.5461 62.6305 14.7842V14.7803C62.9779 14.4294 63.3177 14.0781 63.6548 13.7296C64.4239 12.9345 65.1793 12.1535 65.9797 11.4234C66.6449 10.8204 66.5165 10.4431 65.9097 9.96077C65.4388 9.58598 64.9796 9.19374 64.5203 8.80149C63.6782 8.08236 62.8362 7.36322 61.9225 6.75159C50.0506 -1.20713 37.5446 -2.19127 24.778 4.1298C10.5526 11.1744 2.98674 26.9285 5.83415 42.5464C8.86827 59.1757 23.1792 71.5184 39.9874 71.9852C48.1446 72.2107 55.5665 69.9469 62.2026 65.205C63.2675 64.4436 64.265 63.5875 65.2972 62.7015L65.2993 62.6997C65.7748 62.2917 66.2575 61.8773 66.7577 61.463C65.5207 60.2532 64.4471 59.2029 63.3735 58.1487L63.3675 58.1429C62.5605 57.3514 62.5545 57.3455 61.7086 58.1332C57.4336 62.1242 52.4079 64.6955 46.6742 65.7302C40.8938 66.7727 35.2184 66.2514 29.7531 63.9719C22.4712 60.93 17.1421 55.8071 13.7928 48.7002C11.0388 42.8615 10.327 36.696 11.5795 30.3633C13.3883 21.2259 18.4607 14.3525 26.4934 9.73129C32.2271 6.43651 38.4665 5.35123 45.0248 6.16811C50.7041 6.87607 55.757 9.05832 60.1799 12.6915C60.7259 13.1404 61.2598 13.6019 61.8133 14.0804Z" fill="#3053FF"/>
-<path d="M58.7854 27.1153C59.0876 27.6251 59.3952 28.1441 59.7216 28.6683L59.7293 28.6644C60.2001 28.4721 60.6748 28.2776 61.1525 28.0818C62.23 27.6403 63.3224 27.1927 64.4167 26.7506C64.9062 26.5534 64.7772 26.2574 64.6416 25.9462C64.6274 25.9137 64.6132 25.8809 64.5995 25.8482C60.8419 16.8236 51.1638 10.312 41.3924 10.417C31.1386 10.5259 23.2733 14.9954 18.3837 24.0433C13.9025 32.3365 14.1592 40.8126 18.7649 49.0164C22.0907 54.9329 27.1826 58.7917 33.6787 60.7678C39.1518 62.4327 44.5704 62.207 49.9424 60.2776C50.5492 60.0598 50.7554 59.8341 50.4559 59.1729C49.8918 57.9281 49.4017 56.6484 48.9271 55.3686C48.7015 54.7618 48.437 54.6412 47.7913 54.8668C42.2054 56.8195 36.7673 56.4811 31.5354 53.6493C26.1868 50.7552 22.8804 46.2701 21.5345 40.3886C19.644 32.1381 23.3744 23.5804 30.6913 19.0875C39.3113 13.7934 50.8293 15.9679 56.8431 24.0783C57.5478 25.0276 58.1548 26.0515 58.7854 27.1153Z" fill="#3053FF"/>
-<path d="M48.1447 29.3479C46.7365 28.076 45.3089 27.1813 43.6208 26.7262C37.7003 25.1157 31.671 29.6242 31.5699 35.7779C31.5037 39.8818 33.3553 42.9548 37.0001 44.7209C40.7189 46.5219 44.3054 45.9928 47.5145 43.3244C47.5452 43.2989 47.5751 43.273 47.6045 43.2476C47.8621 43.0252 48.0803 42.8368 48.4364 43.1999C49.2819 44.0591 50.1371 44.9086 51.0186 45.7843C51.3822 46.1454 51.7504 46.5111 52.124 46.8836C52.0332 46.9796 51.9502 47.0735 51.8705 47.1635C51.7112 47.3436 51.5652 47.5086 51.3967 47.6461C46.826 51.427 41.668 52.5745 36.0627 50.5946C30.5001 48.6302 27.0615 44.608 26.0267 38.7615C24.4669 29.9393 30.4146 21.9105 39.2446 20.7863C43.8581 20.199 47.8996 21.5332 51.4394 24.5128C52.0307 25.0107 52.1046 25.3297 51.4978 25.9054C50.6635 26.6892 49.8758 27.5236 49.0762 28.3707C48.7686 28.6966 48.4592 29.0244 48.1447 29.3519V29.3479Z" fill="#3053FF"/>
-<path d="M46.3111 36.2695C46.3111 39.0477 44.0589 41.2998 41.2807 41.2998C38.5025 41.2998 36.2503 39.0477 36.2503 36.2695C36.2503 33.4913 38.5025 31.2391 41.2807 31.2391C44.0589 31.2391 46.3111 33.4913 46.3111 36.2695Z" fill="#3053FF"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7121">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#3053ff" clip-path="url(#clip0_15936_7121)"><path d="m61.813 14.08.003.003q.398.345.814.701v-.004q.52-.526 1.025-1.05c.769-.796 1.524-1.577 2.325-2.307.665-.603.536-.98-.07-1.462a52 52 0 0 1-1.39-1.16c-.842-.719-1.684-1.438-2.597-2.05C50.05-1.206 37.545-2.19 24.777 4.13 10.553 11.174 2.987 26.929 5.834 42.546c3.034 16.63 17.345 28.972 34.153 29.44 8.158.225 15.58-2.04 22.216-6.781 1.064-.761 2.062-1.617 3.094-2.503l.002-.002c.476-.408.958-.823 1.459-1.237-1.237-1.21-2.31-2.26-3.384-3.314l-.007-.006c-.806-.792-.812-.797-1.658-.01-4.275 3.991-9.301 6.562-15.035 7.597-5.78 1.043-11.456.521-16.92-1.758C22.47 60.93 17.141 55.807 13.792 48.7c-2.754-5.839-3.466-12.004-2.213-18.337 1.808-9.137 6.88-16.01 14.913-20.632 5.734-3.294 11.974-4.38 18.532-3.563 5.68.708 10.732 2.89 15.155 6.523.546.45 1.08.91 1.633 1.39"/><path d="M58.785 27.115c.303.51.61 1.03.937 1.553l.007-.004 1.424-.582c1.077-.442 2.17-.89 3.264-1.331.49-.198.36-.494.225-.805l-.042-.098c-3.758-9.024-13.436-15.536-23.208-15.431-10.253.109-18.119 4.578-23.008 13.626-4.482 8.294-4.225 16.77.38 24.973 3.327 5.917 8.419 9.776 14.915 11.752 5.473 1.665 10.891 1.439 16.263-.49.607-.218.813-.444.514-1.105-.564-1.245-1.054-2.525-1.529-3.804-.225-.607-.49-.728-1.136-.502-5.586 1.953-11.024 1.614-16.256-1.218-5.348-2.894-8.655-7.379-10-13.26-1.891-8.25 1.84-16.809 9.156-21.302 8.62-5.294 20.138-3.12 26.152 4.991.705.95 1.312 1.974 1.942 3.037"/><path d="M48.145 29.348c-1.409-1.272-2.836-2.167-4.524-2.622-5.92-1.61-11.95 2.898-12.051 9.052-.066 4.104 1.785 7.177 5.43 8.943 3.719 1.8 7.305 1.272 10.514-1.397l.09-.076c.258-.223.476-.411.832-.048a300 300 0 0 0 2.583 2.584l1.105 1.1q-.134.144-.254.28c-.159.18-.305.345-.473.482-4.571 3.781-9.729 4.929-15.334 2.949-5.563-1.965-9.002-5.987-10.036-11.833-1.56-8.823 4.388-16.851 13.218-17.976 4.613-.587 8.655.747 12.194 3.727.592.498.666.817.059 1.392-.834.784-1.622 1.619-2.422 2.466q-.46.49-.931.98z"/><path d="M46.311 36.27a5.03 5.03 0 1 1-10.06 0 5.03 5.03 0 0 1 10.06 0"/></g><defs><clipPath id="clip0_15936_7121"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/conveyor.svg b/web/packages/design/src/ResourceIcon/assets/conveyor.svg
index c24a1da31ae7d..c96a406530a27 100644
--- a/web/packages/design/src/ResourceIcon/assets/conveyor.svg
+++ b/web/packages/design/src/ResourceIcon/assets/conveyor.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7140)">
-<path d="M34.2366 0.0185555C34.6254 0.00654068 35.0157 0.000488281 35.4077 0.000488281C38.9346 0.000488281 42.3455 0.490647 45.5729 1.40542L34.7096 16.1134C31.9261 19.882 27.5862 22.065 22.8488 22.071C18.1116 22.077 13.7687 19.9197 10.9704 16.1057L8.01044 12.1108C10.2433 9.63817 12.8174 7.46991 15.66 5.67735L19.2586 10.6801C21.015 13.1219 24.6968 13.1316 26.4665 10.6991L34.2366 0.0185555Z" fill="#33C69F"/>
-<path d="M54.2746 28.8338L72 34.5108C71.8401 30.6465 71.0603 26.9395 69.7561 23.4826L56.9779 19.4672C54.0658 18.5523 52.9596 15.0816 54.8034 12.6842C56.0076 11.1184 57.203 9.54615 58.3793 7.96142C55.7644 5.88881 52.8538 4.16244 49.7192 2.85314L46.9315 6.62748C44.1479 10.3961 43.3784 15.1308 44.8365 19.5646C46.2945 23.9983 49.7223 27.3944 54.2746 28.8338Z" fill="#33C69F"/>
-<path d="M47.9536 69.833L47.9629 51.0623C47.9549 46.4029 50.1464 42.1324 54.0231 39.3817C57.8093 36.6452 62.6128 35.8978 67.1652 37.3371L71.9164 38.8548C71.6467 42.234 70.9023 45.4823 69.7489 48.535C68.8902 48.2603 68.0318 47.9844 67.1734 47.7084L67.1711 47.7076C66.0174 47.3368 64.8637 46.9659 63.7091 46.598C60.8802 45.6969 58.0065 47.7799 58.0065 50.703V64.3311C54.999 66.6526 51.6125 68.5214 47.9536 69.833Z" fill="#33C69F"/>
-<path d="M43.7808 71.0551C41.0913 71.6735 38.2879 72.0005 35.4068 72.0005C34.8548 72.0005 34.3056 71.9887 33.7596 71.9648V65.5501C33.7596 62.585 30.8054 60.4882 27.9364 61.4034C24.7366 62.4239 21.5318 63.4308 18.3269 64.4377C17.0782 64.83 15.8277 65.2229 14.5794 65.616C11.4273 63.4698 8.63435 60.85 6.30715 57.8612L24.5624 52.0067C29.0698 50.5745 33.884 51.3334 37.7167 54.0725C41.5496 56.8118 43.771 61.0811 43.779 65.7404L43.7808 71.0551Z" fill="#33C69F"/>
-<path d="M5.31091 15.484C3.14536 18.5478 1.45155 21.9583 0.33288 25.6135C2.97351 29.2229 5.6166 32.8316 8.30305 36.4078C10.0973 38.7965 9.02525 42.2272 6.16419 43.1793L0 45.2303C0.870385 48.4656 2.18746 51.5223 3.88242 54.3327L9.06369 52.6825C13.5711 51.2501 17.0227 47.8801 18.4842 43.4033C19.9602 39.0158 19.1983 34.2908 16.4001 30.4769L5.31091 15.484Z" fill="#33C69F"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7140">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#33c69f" clip-path="url(#clip0_15936_7140)"><path d="M34.237.019Q34.82 0 35.407 0c3.528 0 6.939.49 10.166 1.405L34.71 16.113c-2.784 3.769-7.124 5.952-11.861 5.958s-9.08-2.151-11.879-5.965L8.01 12.11a36.7 36.7 0 0 1 7.65-6.434l3.599 5.003c1.756 2.442 5.438 2.452 7.208.02zm20.038 28.815L72 34.51a35.3 35.3 0 0 0-2.244-11.028l-12.778-4.016c-2.912-.915-4.018-4.385-2.175-6.783a347 347 0 0 0 3.576-4.723 36.7 36.7 0 0 0-8.66-5.108l-2.788 3.774c-2.783 3.77-3.553 8.504-2.094 12.938 1.457 4.433 4.885 7.83 9.438 9.269m-6.321 41 .009-18.77c-.008-4.66 2.183-8.93 6.06-11.681 3.786-2.737 8.59-3.484 13.142-2.045l4.751 1.518a35.3 35.3 0 0 1-2.167 9.68q-1.288-.412-2.576-.827h-.002q-1.73-.557-3.462-1.11c-2.829-.901-5.703 1.182-5.703 4.105v13.628a36.8 36.8 0 0 1-10.052 5.502m-4.174 1.222a37.3 37.3 0 0 1-10.02.91V65.55c0-2.965-2.955-5.062-5.824-4.147-3.2 1.02-6.404 2.028-9.61 3.035l-3.747 1.178a36.6 36.6 0 0 1-8.272-7.755l18.255-5.854c4.508-1.432 9.322-.674 13.155 2.066s6.054 7.008 6.062 11.667zM5.31 15.484a35.6 35.6 0 0 0-4.977 10.13c2.64 3.609 5.284 7.218 7.97 10.794 1.794 2.389.722 5.82-2.139 6.771L0 45.23a35.5 35.5 0 0 0 3.882 9.103l5.182-1.65c4.507-1.433 7.959-4.803 9.42-9.28 1.476-4.387.714-9.112-2.084-12.926z"/></g><defs><clipPath id="clip0_15936_7140"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cronitor.svg b/web/packages/design/src/ResourceIcon/assets/cronitor.svg
index 970d4c51b3805..98b3d9d7ee1d8 100644
--- a/web/packages/design/src/ResourceIcon/assets/cronitor.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cronitor.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 10.0005C0 4.47764 4.47715 0.000488281 10 0.000488281H62C67.5228 0.000488281 72 4.47764 72 10.0005V62.0005C72 67.5233 67.5228 72.0005 62 72.0005H10C4.47715 72.0005 0 67.5233 0 62.0005V10.0005Z" fill="#0B1643"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M38 20.6255C29.5086 20.6255 22.625 27.5091 22.625 36.0005C22.625 44.4919 29.5086 51.3755 38 51.3755C42.3989 51.3755 46.3581 49.5362 49.1684 46.5674L58.1555 55.0746C53.1054 60.4096 45.9378 63.7505 38 63.7505C22.6741 63.7505 10.25 51.3264 10.25 36.0005C10.25 20.6746 22.6741 8.25049 38 8.25049C44.8637 8.25049 51.1593 10.7503 56.0022 14.8816L47.9708 24.2964C45.2832 22.0037 41.8105 20.6255 38 20.6255Z" fill="white"/>
-<circle cx="38" cy="36" r="8" fill="#50CC84"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0b1643" d="M0 10C0 4.479 4.477 0 10 0h52c5.523 0 10 4.478 10 10v52c0 5.523-4.477 10-10 10H10C4.477 72 0 67.524 0 62z"/><path fill="#fff" fill-rule="evenodd" d="M38 20.626c-8.491 0-15.375 6.883-15.375 15.375 0 8.49 6.884 15.375 15.375 15.375 4.399 0 8.358-1.84 11.168-4.809l8.988 8.508A27.7 27.7 0 0 1 38 63.75c-15.326 0-27.75-12.425-27.75-27.75S22.674 8.25 38 8.25c6.864 0 13.16 2.5 18.002 6.63l-8.031 9.415A15.3 15.3 0 0 0 38 20.626" clip-rule="evenodd"/><circle cx="38" cy="36" r="8" fill="#50cc84"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cultureamp-dark.svg b/web/packages/design/src/ResourceIcon/assets/cultureamp-dark.svg
index 604e07cf46f09..dd3f1b9ad9d6b 100644
--- a/web/packages/design/src/ResourceIcon/assets/cultureamp-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cultureamp-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4413)">
-<path d="M57.6346 45.3616C57.85 45.7203 57.9243 46.1464 57.8429 46.5566C57.0824 50.0121 55.232 53.1318 52.5647 55.4564C52.4184 55.5671 52.2954 55.7056 52.2026 55.8637C52.1693 55.9362 52.152 56.0149 52.152 56.0946C52.152 56.1744 52.1693 56.2531 52.2026 56.3254C52.2558 56.3873 52.3229 56.4361 52.3983 56.4674C52.4739 56.499 52.5555 56.5124 52.6372 56.5066C53.0235 56.4037 53.3968 56.2578 53.7506 56.072C55.3152 55.1833 56.6975 54.0068 57.8247 52.6044C58.5038 51.7806 59.1737 50.9567 59.8165 50.1056C61.027 48.4247 61.9228 46.5383 62.4603 44.5378C62.949 42.9173 63.3655 41.2785 63.8725 39.658C64.0797 39.0637 64.3308 38.4858 64.6241 37.9288C64.7419 37.7573 64.8786 37.5994 65.0314 37.458H65.1582C65.2848 37.8834 65.4389 38.2909 65.5293 38.7255C65.7661 40.0921 65.7997 41.4863 65.629 42.863C65.4411 44.6545 65.0741 46.4227 64.5335 48.1411C64.1548 49.1973 63.6437 50.2011 63.0125 51.1287C61.426 53.7436 59.5524 56.1728 57.4264 58.3715C55.8603 59.884 54.1671 61.2591 52.3654 62.4819C52.2341 62.5492 52.1147 62.638 52.0125 62.7445C51.9071 62.8713 51.8523 63.0323 51.8586 63.1972C51.8964 63.2708 51.9516 63.3338 52.0194 63.3812C52.0872 63.4287 52.1657 63.4586 52.2478 63.4687C52.6264 63.4662 53.0036 63.4177 53.3704 63.3238C55.0432 62.8418 56.6078 62.0426 57.9786 60.9699C61.8132 58.1429 64.9274 54.4519 67.0683 50.1962C68.4327 47.4195 69.3173 44.432 69.6848 41.3599C69.9051 39.4207 69.9264 37.464 69.7483 35.5206C69.5929 34.5246 69.6235 33.5084 69.8387 32.5239C69.8957 32.2982 69.9778 32.0794 70.0832 31.8719C70.3276 31.401 70.6808 31.374 70.9161 31.8719C71.1637 32.3431 71.3464 32.8457 71.4594 33.3657C71.9564 35.8561 72.1118 38.4023 71.921 40.9345C71.5697 45.0484 70.5354 49.0749 68.861 52.8489C67.1652 56.7347 64.6189 60.1906 61.4099 62.9616C60.3688 63.8671 59.373 64.7725 58.2956 65.6235C57.0016 66.5643 55.6153 67.3713 54.1581 68.0316C50.9429 69.629 47.521 70.7717 43.991 71.4266C41.8275 71.8022 39.6304 71.948 37.4362 71.8612C36.359 71.8612 35.2724 71.789 34.1952 71.7346C31.7595 71.5998 29.3564 71.1117 27.0608 70.2859C23.7369 69.1293 20.542 67.6303 17.5276 65.8137C14.0122 63.6582 11.0141 60.7558 8.74569 57.3122C7.62587 55.6928 6.65038 53.9782 5.83047 52.188C5.78867 52.0817 5.72141 51.9873 5.63458 51.9131C5.54776 51.839 5.44402 51.7871 5.33252 51.7625C4.73716 51.6145 4.18328 51.3329 3.71273 50.9392C3.2422 50.5455 2.86733 50.0499 2.61646 49.4901C1.94513 47.8506 1.42393 46.1538 1.05927 44.4201C0.395767 41.6214 0.0405593 38.7586 0 35.8827C0.0271921 34.0618 0.193662 32.2458 0.497946 30.4504C0.841602 28.0111 1.44872 25.6161 2.30865 23.3073C3.06919 21.2868 4.1381 19.3964 5.47737 17.7032C6.25598 16.7254 6.89878 15.6299 7.65926 14.634C12.4858 8.25496 19.3961 3.76988 27.1877 1.95911C28.6905 1.59697 30.1935 1.21672 31.7145 0.936059C33.0724 0.682561 34.4305 0.5196 35.8246 0.392849C37.4362 0.247994 39.0477 0.121245 40.6684 0.103138C47.1698 0.0126086 53.5388 1.94573 58.8932 5.63484C59.5034 6.00389 60.0532 6.46503 60.5226 7.00192C60.8696 7.42441 61.1004 7.92986 61.1928 8.46859C61.2285 8.59534 61.301 8.7087 61.401 8.79452C62.6775 10.0258 64.0356 11.1937 65.2125 12.5155C67.0829 14.5589 68.4365 17.0208 69.1599 19.6949C69.4913 20.775 69.6067 21.9098 69.4996 23.0345C69.3922 24.1591 69.0646 25.2517 68.5351 26.2497C67.6496 27.7405 66.4045 28.9856 64.9137 29.8711C63.2552 30.9995 61.2657 31.5384 59.2643 31.401C57.3933 31.3156 55.6174 30.5531 54.2668 29.2554C52.8479 27.7809 51.3359 26.3989 49.74 25.1179C48.6899 24.3212 47.6033 23.5699 46.508 22.8546C45.1836 22.0588 43.7166 21.5298 42.1894 21.2974C40.4521 20.9797 38.6829 20.8733 36.9202 20.9806C33.0666 21.054 29.338 22.3614 26.2822 24.7106C23.9923 26.4407 22.1075 28.6499 20.7597 31.1838C19.9964 32.7214 19.515 34.3834 19.3383 36.0909C19.1909 37.1442 19.1063 38.2053 19.0848 39.2686C19.1702 42.2998 19.9606 45.2694 21.3935 47.9418C22.4521 50.015 23.861 51.8894 25.558 53.4828C27.1364 54.9011 28.8851 56.1176 30.7639 57.104C32.9022 58.2633 35.2637 58.9515 37.6898 59.123C40.8758 59.4556 44.0939 58.9727 47.0421 57.7197C48.455 57.0554 49.7561 56.176 50.8988 55.1122C52.8725 53.4148 54.5281 51.3789 55.7878 49.1006C56.2586 48.2769 56.5845 47.3715 56.9829 46.5025C57.1005 46.2399 57.2363 45.9773 57.372 45.7239C57.455 45.6009 57.5523 45.4886 57.6619 45.3889" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4413">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4413)"><path fill="#fff" d="M57.635 45.362c.215.358.29.784.208 1.195a16.5 16.5 0 0 1-5.278 8.9c-.147.11-.27.249-.362.407a.55.55 0 0 0 0 .461.52.52 0 0 0 .434.182q.581-.156 1.114-.435a14.3 14.3 0 0 0 4.074-3.468 75 75 0 0 0 1.991-2.498 17.1 17.1 0 0 0 2.644-5.568c.489-1.62.905-3.26 1.413-4.88q.311-.892.751-1.73.178-.257.407-.47h.127c.127.425.28.833.371 1.267.237 1.367.27 2.761.1 4.138a27 27 0 0 1-1.096 5.278 13.3 13.3 0 0 1-1.52 2.988 41 41 0 0 1-5.587 7.243 38 38 0 0 1-5.06 4.11 1.3 1.3 0 0 0-.353.263.67.67 0 0 0-.154.452.5.5 0 0 0 .389.272 4.7 4.7 0 0 0 1.122-.145 13.6 13.6 0 0 0 4.609-2.354 30.3 30.3 0 0 0 9.09-10.774 27.4 27.4 0 0 0 2.616-8.836c.22-1.94.241-3.896.063-5.84a8.2 8.2 0 0 1 .09-2.996q.087-.34.245-.652c.245-.471.598-.498.833 0 .248.471.43.974.543 1.494.497 2.49.653 5.036.462 7.569a37.2 37.2 0 0 1-3.06 11.914 28.3 28.3 0 0 1-7.451 10.113c-1.041.905-2.037 1.81-3.114 2.662a23.6 23.6 0 0 1-4.138 2.408 38.7 38.7 0 0 1-10.167 3.395 31 31 0 0 1-6.555.434c-1.077 0-2.164-.072-3.24-.126a25.2 25.2 0 0 1-7.135-1.45 51 51 0 0 1-9.533-4.471 28.1 28.1 0 0 1-8.782-8.502 33.6 33.6 0 0 1-2.916-5.124.7.7 0 0 0-.497-.425 4.05 4.05 0 0 1-2.717-2.273 29.3 29.3 0 0 1-1.557-5.07A39.4 39.4 0 0 1 0 35.883a36 36 0 0 1 .498-5.433c.344-2.439.95-4.834 1.81-7.143a21 21 0 0 1 3.17-5.604c.778-.978 1.42-2.073 2.181-3.069A34.2 34.2 0 0 1 27.188 1.959c1.503-.362 3.006-.742 4.527-1.023a44 44 0 0 1 4.11-.543c1.611-.145 3.223-.272 4.843-.29a31.35 31.35 0 0 1 18.225 5.532c.61.369 1.16.83 1.63 1.367.347.422.577.928.67 1.467.035.126.108.24.208.326 1.276 1.23 2.635 2.399 3.812 3.72a17.34 17.34 0 0 1 3.947 7.18 8.6 8.6 0 0 1-.625 6.555 10.4 10.4 0 0 1-3.621 3.621 8.95 8.95 0 0 1-5.65 1.53 7.72 7.72 0 0 1-4.997-2.146 48 48 0 0 0-4.527-4.137 56 56 0 0 0-3.232-2.263 11.8 11.8 0 0 0-4.319-1.558 22 22 0 0 0-5.269-.316 18 18 0 0 0-10.638 3.73 19.7 19.7 0 0 0-5.522 6.473 14.4 14.4 0 0 0-1.422 4.907 27 27 0 0 0-.253 3.178c.085 3.03.876 6 2.308 8.673a20.2 20.2 0 0 0 4.165 5.54 25.6 25.6 0 0 0 5.206 3.622 17.05 17.05 0 0 0 6.926 2.019c3.186.333 6.404-.15 9.352-1.403a15 15 0 0 0 3.857-2.608 21.9 21.9 0 0 0 4.889-6.011c.47-.824.797-1.73 1.195-2.599.117-.262.253-.525.389-.778q.125-.185.29-.335"/></g><defs><clipPath id="clip0_8803_4413"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/cultureamp-light.svg b/web/packages/design/src/ResourceIcon/assets/cultureamp-light.svg
index 3d849e67c254b..ba69502df061f 100644
--- a/web/packages/design/src/ResourceIcon/assets/cultureamp-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/cultureamp-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4414)">
-<path d="M57.6346 45.3616C57.85 45.7203 57.9243 46.1464 57.8429 46.5566C57.0824 50.0121 55.232 53.1318 52.5647 55.4564C52.4184 55.5671 52.2954 55.7056 52.2026 55.8637C52.1693 55.9362 52.152 56.0149 52.152 56.0946C52.152 56.1744 52.1693 56.2531 52.2026 56.3254C52.2558 56.3873 52.3229 56.4361 52.3983 56.4674C52.4739 56.499 52.5555 56.5124 52.6372 56.5066C53.0235 56.4037 53.3968 56.2578 53.7506 56.072C55.3152 55.1833 56.6975 54.0068 57.8247 52.6044C58.5038 51.7806 59.1737 50.9567 59.8165 50.1056C61.027 48.4247 61.9228 46.5383 62.4603 44.5378C62.949 42.9173 63.3655 41.2785 63.8725 39.658C64.0797 39.0637 64.3308 38.4858 64.6241 37.9288C64.7419 37.7573 64.8786 37.5994 65.0314 37.458H65.1582C65.2848 37.8834 65.4389 38.2909 65.5293 38.7255C65.7661 40.0921 65.7997 41.4863 65.629 42.863C65.4411 44.6545 65.0741 46.4227 64.5335 48.1411C64.1548 49.1973 63.6437 50.2011 63.0125 51.1287C61.426 53.7436 59.5524 56.1728 57.4264 58.3715C55.8603 59.884 54.1671 61.2591 52.3654 62.4819C52.2341 62.5492 52.1147 62.638 52.0125 62.7445C51.9071 62.8713 51.8523 63.0323 51.8586 63.1972C51.8964 63.2708 51.9516 63.3338 52.0194 63.3812C52.0872 63.4287 52.1657 63.4586 52.2478 63.4687C52.6264 63.4662 53.0036 63.4177 53.3704 63.3238C55.0432 62.8418 56.6078 62.0426 57.9786 60.9699C61.8132 58.1429 64.9274 54.4519 67.0683 50.1962C68.4327 47.4195 69.3173 44.432 69.6848 41.3599C69.9051 39.4207 69.9264 37.464 69.7483 35.5206C69.5929 34.5246 69.6235 33.5084 69.8387 32.5239C69.8957 32.2982 69.9778 32.0794 70.0832 31.8719C70.3276 31.401 70.6808 31.374 70.9161 31.8719C71.1637 32.3431 71.3464 32.8457 71.4594 33.3657C71.9564 35.8561 72.1118 38.4023 71.921 40.9345C71.5697 45.0484 70.5354 49.0749 68.861 52.8489C67.1652 56.7347 64.6189 60.1906 61.4099 62.9616C60.3688 63.8671 59.373 64.7725 58.2956 65.6235C57.0016 66.5643 55.6153 67.3713 54.1581 68.0316C50.9429 69.629 47.521 70.7717 43.991 71.4266C41.8275 71.8022 39.6304 71.948 37.4362 71.8612C36.359 71.8612 35.2724 71.789 34.1952 71.7346C31.7595 71.5998 29.3564 71.1117 27.0608 70.2859C23.7369 69.1293 20.542 67.6303 17.5276 65.8137C14.0122 63.6582 11.0141 60.7558 8.74569 57.3122C7.62587 55.6928 6.65038 53.9782 5.83047 52.188C5.78867 52.0817 5.72141 51.9873 5.63458 51.9131C5.54776 51.839 5.44402 51.7871 5.33252 51.7625C4.73716 51.6145 4.18328 51.3329 3.71273 50.9392C3.2422 50.5455 2.86733 50.0499 2.61646 49.4901C1.94513 47.8506 1.42393 46.1538 1.05927 44.4201C0.395767 41.6214 0.0405593 38.7586 0 35.8827C0.0271921 34.0618 0.193662 32.2458 0.497946 30.4504C0.841602 28.0111 1.44872 25.6161 2.30865 23.3073C3.06919 21.2868 4.1381 19.3964 5.47737 17.7032C6.25598 16.7254 6.89878 15.6299 7.65926 14.634C12.4858 8.25496 19.3961 3.76988 27.1877 1.95911C28.6905 1.59697 30.1935 1.21672 31.7145 0.936059C33.0724 0.682561 34.4305 0.5196 35.8246 0.392849C37.4362 0.247994 39.0477 0.121245 40.6684 0.103138C47.1698 0.0126086 53.5388 1.94573 58.8932 5.63484C59.5034 6.00389 60.0532 6.46503 60.5226 7.00192C60.8696 7.42441 61.1004 7.92986 61.1928 8.46859C61.2285 8.59534 61.301 8.7087 61.401 8.79452C62.6775 10.0258 64.0356 11.1937 65.2125 12.5155C67.0829 14.5589 68.4365 17.0208 69.1599 19.6949C69.4913 20.775 69.6067 21.9098 69.4996 23.0345C69.3922 24.1591 69.0646 25.2517 68.5351 26.2497C67.6496 27.7405 66.4045 28.9856 64.9137 29.8711C63.2552 30.9995 61.2657 31.5384 59.2643 31.401C57.3933 31.3156 55.6174 30.5531 54.2668 29.2554C52.8479 27.7809 51.3359 26.3989 49.74 25.1179C48.6899 24.3212 47.6033 23.5699 46.508 22.8546C45.1836 22.0588 43.7166 21.5298 42.1894 21.2974C40.4521 20.9797 38.6829 20.8733 36.9202 20.9806C33.0666 21.054 29.338 22.3614 26.2822 24.7106C23.9923 26.4407 22.1075 28.6499 20.7597 31.1838C19.9964 32.7214 19.515 34.3834 19.3383 36.0909C19.1909 37.1442 19.1063 38.2053 19.0848 39.2686C19.1702 42.2998 19.9606 45.2694 21.3935 47.9418C22.4521 50.015 23.861 51.8894 25.558 53.4828C27.1364 54.9011 28.8851 56.1176 30.7639 57.104C32.9022 58.2633 35.2637 58.9515 37.6898 59.123C40.8758 59.4556 44.0939 58.9727 47.0421 57.7197C48.455 57.0554 49.7561 56.176 50.8988 55.1122C52.8725 53.4148 54.5281 51.3789 55.7878 49.1006C56.2586 48.2769 56.5845 47.3715 56.9829 46.5025C57.1005 46.2399 57.2363 45.9773 57.372 45.7239C57.455 45.6009 57.5523 45.4886 57.6619 45.3889" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4414">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4414)"><path fill="#000" d="M57.635 45.362c.215.358.29.784.208 1.195a16.5 16.5 0 0 1-5.278 8.9c-.147.11-.27.249-.362.407a.55.55 0 0 0 0 .461.52.52 0 0 0 .434.182q.581-.156 1.114-.435a14.3 14.3 0 0 0 4.074-3.468 75 75 0 0 0 1.991-2.498 17.1 17.1 0 0 0 2.644-5.568c.489-1.62.905-3.26 1.413-4.88q.311-.892.751-1.73.178-.257.407-.47h.127c.127.425.28.833.371 1.267.237 1.367.27 2.761.1 4.138a27 27 0 0 1-1.096 5.278 13.3 13.3 0 0 1-1.52 2.988 41 41 0 0 1-5.587 7.243 38 38 0 0 1-5.06 4.11 1.3 1.3 0 0 0-.353.263.67.67 0 0 0-.154.452.5.5 0 0 0 .389.272 4.7 4.7 0 0 0 1.122-.145 13.6 13.6 0 0 0 4.609-2.354 30.3 30.3 0 0 0 9.09-10.774 27.4 27.4 0 0 0 2.616-8.836c.22-1.94.241-3.896.063-5.84a8.2 8.2 0 0 1 .09-2.996q.087-.34.245-.652c.245-.471.598-.498.833 0 .248.471.43.974.543 1.494.497 2.49.653 5.036.462 7.569a37.2 37.2 0 0 1-3.06 11.914 28.3 28.3 0 0 1-7.451 10.113c-1.041.905-2.037 1.81-3.114 2.662a23.6 23.6 0 0 1-4.138 2.408 38.7 38.7 0 0 1-10.167 3.395 31 31 0 0 1-6.555.434c-1.077 0-2.164-.072-3.24-.126a25.2 25.2 0 0 1-7.135-1.45 51 51 0 0 1-9.533-4.471 28.1 28.1 0 0 1-8.782-8.502 33.6 33.6 0 0 1-2.916-5.124.7.7 0 0 0-.497-.425 4.05 4.05 0 0 1-2.717-2.273 29.3 29.3 0 0 1-1.557-5.07A39.4 39.4 0 0 1 0 35.883a36 36 0 0 1 .498-5.433c.344-2.439.95-4.834 1.81-7.143a21 21 0 0 1 3.17-5.604c.778-.978 1.42-2.073 2.181-3.069A34.2 34.2 0 0 1 27.188 1.959c1.503-.362 3.006-.742 4.527-1.023a44 44 0 0 1 4.11-.543c1.611-.145 3.223-.272 4.843-.29a31.35 31.35 0 0 1 18.225 5.532c.61.369 1.16.83 1.63 1.367.347.422.577.928.67 1.467.035.126.108.24.208.326 1.276 1.23 2.635 2.399 3.812 3.72a17.34 17.34 0 0 1 3.947 7.18 8.6 8.6 0 0 1-.625 6.555 10.4 10.4 0 0 1-3.621 3.621 8.95 8.95 0 0 1-5.65 1.53 7.72 7.72 0 0 1-4.997-2.146 48 48 0 0 0-4.527-4.137 56 56 0 0 0-3.232-2.263 11.8 11.8 0 0 0-4.319-1.558 22 22 0 0 0-5.269-.316 18 18 0 0 0-10.638 3.73 19.7 19.7 0 0 0-5.522 6.473 14.4 14.4 0 0 0-1.422 4.907 27 27 0 0 0-.253 3.178c.085 3.03.876 6 2.308 8.673a20.2 20.2 0 0 0 4.165 5.54 25.6 25.6 0 0 0 5.206 3.622 17.05 17.05 0 0 0 6.926 2.019c3.186.333 6.404-.15 9.352-1.403a15 15 0 0 0 3.857-2.608 21.9 21.9 0 0 0 4.889-6.011c.47-.824.797-1.73 1.195-2.599.117-.262.253-.525.389-.778q.125-.185.29-.335"/></g><defs><clipPath id="clip0_8803_4414"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/database.svg b/web/packages/design/src/ResourceIcon/assets/database.svg
index a64e426130502..e02dffea8c975 100644
--- a/web/packages/design/src/ResourceIcon/assets/database.svg
+++ b/web/packages/design/src/ResourceIcon/assets/database.svg
@@ -1,121 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M58.9418 45.7831L58.9067 56.5104C58.9007 58.5824 57.8535 60.6524 55.7611 62.4924C54.7981 63.3393 53.6159 64.1391 52.2105 64.867C52.0776 64.9371 51.9423 65.0054 51.8055 65.0719C42.8076 69.5126 28.519 69.4443 19.625 64.867C15.082 62.5295 12.8136 59.4584 12.8233 56.3931L12.8565 45.6836C18.7862 46.9199 50.7118 45.7831 58.9418 45.7831Z" fill="#C9D7DD"/>
-<path d="M58.9418 45.7831L58.9067 56.5104C58.9007 58.5824 57.8535 60.6524 55.7611 62.4924C54.7981 63.3393 53.6159 64.1391 52.2105 64.867C52.0776 64.9371 51.9423 65.0054 51.8055 65.0719C42.8076 69.5126 28.519 69.4443 19.625 64.867C15.082 62.5295 12.8136 59.4584 12.8233 56.3931L12.8565 45.6836C18.7862 46.9199 50.7118 45.7831 58.9418 45.7831Z" fill="url(#paint0_linear_6722_31909)" fill-opacity="0.8"/>
-<path d="M58.9418 45.7831L58.9067 56.5104C58.9007 58.5824 57.8535 60.6524 55.7611 62.4924C54.7981 63.3393 53.6159 64.1391 52.2105 64.867C52.0776 64.9371 51.9423 65.0054 51.8055 65.0719C42.8076 69.5126 28.519 69.4443 19.625 64.867C15.082 62.5295 12.8136 59.4584 12.8233 56.3931L12.8565 45.6836C18.7862 46.9199 50.7118 45.7831 58.9418 45.7831Z" fill="url(#paint1_linear_6722_31909)"/>
-<path d="M52.1395 37.3094C61.1665 41.9571 61.2156 49.4921 52.247 54.1398C43.2786 58.7873 28.6887 58.7873 19.6615 54.1398C10.6342 49.4921 10.5853 41.9571 19.5558 37.3094C28.5242 32.6618 43.1141 32.6618 52.1413 37.3094H52.1395Z" fill="white"/>
-<path d="M52.1395 37.3094C61.1665 41.9571 61.2156 49.4921 52.247 54.1398C43.2786 58.7873 28.6887 58.7873 19.6615 54.1398C10.6342 49.4921 10.5853 41.9571 19.5558 37.3094C28.5242 32.6618 43.1141 32.6618 52.1413 37.3094H52.1395Z" fill="url(#paint2_linear_6722_31909)" fill-opacity="0.6"/>
-<path d="M55.7353 51.7711V62.3911C54.7723 63.2378 53.59 64.0377 52.1847 64.7655C52.0515 64.8359 51.9165 64.904 51.7794 64.9705L51.748 54.2918C51.8127 54.2607 51.8754 54.2295 51.938 54.1963C52.0084 54.1612 52.079 54.1241 52.1494 54.089C52.9284 53.687 53.6408 53.2656 54.2867 52.8246C54.4024 52.7448 54.5177 52.6647 54.6313 52.5828C54.8563 52.4208 55.0737 52.2548 55.2811 52.0891C55.3771 52.013 55.4711 51.935 55.565 51.857C55.6118 51.8159 55.6589 51.7769 55.7057 51.7358L55.7353 51.7711Z" fill="#9693D3"/>
-<path d="M23.6718 55.7946V66.5335C22.1961 66.0613 20.7808 65.4625 19.4988 64.8029C18.0914 64.079 16.923 63.2478 15.9521 62.405V51.7206C15.9639 51.707 15.9736 51.6953 15.9854 51.6816C15.9893 51.6856 15.9951 51.6895 15.999 51.6934L16.0147 51.7049C16.044 51.7324 16.0814 51.7636 16.1243 51.8007C16.1596 51.8298 16.2632 51.9196 16.4063 52.0368C16.6548 52.2396 16.8563 52.3977 17.0444 52.5323C17.1579 52.6142 17.2772 52.704 17.3947 52.784C17.4162 52.7976 17.4376 52.8133 17.4593 52.8269C17.4729 52.8366 17.4808 52.8424 17.4808 52.8424C17.6864 52.9869 17.9114 53.1332 18.1403 53.2737C18.1638 53.2894 18.1874 53.303 18.2109 53.3166C18.618 53.5703 19.0486 53.8181 19.5085 54.056C19.5789 54.0932 19.6535 54.1343 19.7259 54.1693C19.7903 54.2023 19.8413 54.2316 19.9059 54.263C20.0566 54.3371 20.2172 54.419 20.3718 54.4892C20.4305 54.5166 20.4969 54.5439 20.5576 54.5711C20.5655 54.575 20.5715 54.5771 20.5772 54.581C20.589 54.5868 20.5948 54.5889 20.5987 54.5907C20.6183 54.6004 20.64 54.6103 20.6615 54.62C20.7261 54.6493 20.7907 54.6823 20.8532 54.7098C20.9178 54.7391 20.9765 54.7643 21.0411 54.7936C21.1057 54.821 21.1685 54.8503 21.2331 54.8755C21.2428 54.8815 21.2545 54.8854 21.2642 54.8893C21.2781 54.8951 21.2917 54.9009 21.3074 54.9069C21.3309 54.9184 21.3563 54.9283 21.3817 54.9399C21.4209 54.9556 21.4599 54.9731 21.5012 54.9888C22.0805 55.2327 22.7478 55.4882 23.4995 55.7342C23.5583 55.7536 23.6169 55.7732 23.6758 55.7907L23.6718 55.7946Z" fill="white" fill-opacity="0.5"/>
-<path d="M25.0538 54.0912C24.8442 54.3506 24.5939 54.6589 24.3843 54.9182C24.1554 55.2012 23.9029 55.5115 23.6738 55.7945C23.6152 55.7749 23.5563 55.7555 23.4977 55.7377C22.7479 55.4919 22.0787 55.2365 21.4992 54.9926C21.4582 54.9769 21.4189 54.9593 21.3799 54.9436C21.3564 54.9321 21.331 54.9222 21.3054 54.9106C21.28 54.9007 21.2565 54.8892 21.2311 54.8792C21.1665 54.8539 21.1039 54.8248 21.0393 54.7973C20.9726 54.7701 20.9161 54.7426 20.8515 54.7136C20.7887 54.6861 20.7241 54.6549 20.6595 54.6238C20.638 54.6139 20.6166 54.6042 20.5969 54.5945C20.593 54.5924 20.5852 54.5887 20.5755 54.5848C20.5695 54.5809 20.5637 54.5788 20.5559 54.5749C20.4952 54.5476 20.4306 54.5204 20.3699 54.4929C20.2152 54.4207 20.0549 54.3409 19.9039 54.2666C19.8396 54.2354 19.7886 54.2061 19.7239 54.1731C19.6536 54.1378 19.579 54.0969 19.5068 54.0598C19.0466 53.8237 18.616 53.5759 18.2089 53.3204C18.1854 53.3068 18.1621 53.2932 18.1385 53.2775C17.9075 53.1369 17.6844 52.9906 17.479 52.8462C17.479 52.8462 17.4691 52.8404 17.4573 52.8307C17.4359 52.8171 17.4144 52.8014 17.3927 52.7878C17.2752 52.7077 17.1559 52.6179 17.0424 52.536C16.8545 52.4015 16.6529 52.2434 16.4043 52.0403C16.2615 51.9233 16.1558 51.8336 16.1226 51.8042C16.0794 51.7673 16.0441 51.7362 16.0129 51.7087L15.9972 51.6969C15.9972 51.6969 15.9873 51.6893 15.9834 51.6854C16.4475 51.1136 16.9113 50.5419 17.3752 49.9722C17.6336 50.2103 18.0035 50.5341 18.4692 50.8913C19.8511 51.9508 21.0707 52.5242 21.9202 52.9205C22.7168 53.2911 23.7698 53.7224 25.0517 54.0969L25.0538 54.0912Z" fill="white" fill-opacity="0.48"/>
-<path d="M55.7273 51.8317C55.7273 51.8317 55.7174 51.8414 55.7116 51.8453C55.6549 51.894 55.5981 51.9429 55.5413 51.9898C55.3103 52.1848 55.0657 52.3761 54.8112 52.5653C54.7016 52.6454 54.588 52.7273 54.4726 52.8072C54.3219 52.9126 54.1673 53.0179 54.0088 53.1212C53.9245 53.1759 53.8403 53.2306 53.7542 53.2853C53.631 53.3633 53.5036 53.4413 53.3765 53.5175C53.2472 53.5936 53.1182 53.6716 52.9851 53.7457C52.7855 53.8588 52.5819 53.9721 52.3724 54.0833C52.302 54.1202 52.2314 54.1574 52.161 54.1925C52.0318 54.2589 51.9007 54.3252 51.7696 54.3896L50.4482 52.7077C50.5814 52.6433 50.7125 52.5771 50.8417 52.5106C52.2492 51.7867 53.4176 50.9848 54.3494 50.1323L55.7273 51.8296V51.8317Z" fill="#AF9FE7"/>
-<path d="M50.7951 37.0207C59.0746 41.2839 59.1196 48.1947 50.8929 52.458C42.6662 56.7212 29.286 56.7212 21.0065 52.458C12.7269 48.1947 12.6819 41.2839 20.9086 37.0207C29.1351 32.7574 42.5155 32.7574 50.7951 37.0207Z" fill="#7220FF"/>
-<path d="M50.7951 37.0207C59.0746 41.2839 59.1196 48.1947 50.8929 52.458C42.6662 56.7212 29.286 56.7212 21.0065 52.458C12.7269 48.1947 12.6819 41.2839 20.9086 37.0207C29.1351 32.7574 42.5155 32.7574 50.7951 37.0207Z" fill="url(#paint3_radial_6722_31909)" fill-opacity="0.64"/>
-<path d="M58.9154 30.6629L58.8804 41.3902C58.8744 43.4623 57.8271 45.5323 55.7348 47.3722C54.7718 48.2192 53.5895 49.019 52.1841 49.7469C52.0512 49.817 51.916 49.8853 51.7791 49.9518C42.7812 54.3925 28.4927 54.3242 19.5986 49.7469C15.0557 47.4094 12.7872 44.3383 12.7969 41.273L12.8301 30.5635C18.7598 31.7998 50.6854 30.6629 58.9154 30.6629Z" fill="#C9D7DD"/>
-<path d="M58.9154 30.6629L58.8804 41.3902C58.8744 43.4623 57.8271 45.5323 55.7348 47.3722C54.7718 48.2192 53.5895 49.019 52.1841 49.7469C52.0512 49.817 51.916 49.8853 51.7791 49.9518C42.7812 54.3925 28.4927 54.3242 19.5986 49.7469C15.0557 47.4094 12.7872 44.3383 12.7969 41.273L12.8301 30.5635C18.7598 31.7998 50.6854 30.6629 58.9154 30.6629Z" fill="url(#paint4_linear_6722_31909)" fill-opacity="0.8"/>
-<path d="M58.9154 30.6629L58.8804 41.3902C58.8744 43.4623 57.8271 45.5323 55.7348 47.3722C54.7718 48.2192 53.5895 49.019 52.1841 49.7469C52.0512 49.817 51.916 49.8853 51.7791 49.9518C42.7812 54.3925 28.4927 54.3242 19.5986 49.7469C15.0557 47.4094 12.7872 44.3383 12.7969 41.273L12.8301 30.5635C18.7598 31.7998 50.6854 30.6629 58.9154 30.6629Z" fill="url(#paint5_linear_6722_31909)" fill-opacity="0.8"/>
-<path d="M52.1121 22.2054C61.1394 26.853 61.1883 34.3882 52.2197 39.0359C43.2513 43.6833 28.6614 43.6833 19.6341 39.0359C10.6069 34.3882 10.558 26.853 19.5284 22.2054C28.4968 17.5578 43.0868 17.5578 52.114 22.2054H52.1121Z" fill="white"/>
-<path d="M52.1121 22.2054C61.1394 26.853 61.1883 34.3882 52.2197 39.0359C43.2513 43.6833 28.6614 43.6833 19.6341 39.0359C10.6069 34.3882 10.558 26.853 19.5284 22.2054C28.4968 17.5578 43.0868 17.5578 52.114 22.2054H52.1121Z" fill="url(#paint6_linear_6722_31909)" fill-opacity="0.6"/>
-<path d="M50.7677 21.9166C59.0473 26.1799 59.0923 33.0907 50.8656 37.354C42.6389 41.6173 29.2586 41.6173 20.9791 37.354C12.6996 33.0907 12.6546 26.1799 20.8813 21.9166C29.108 17.6534 42.4882 17.6534 50.7677 21.9166Z" fill="#7220FF"/>
-<path d="M50.7677 21.9166C59.0473 26.1799 59.0923 33.0907 50.8656 37.354C42.6389 41.6173 29.2586 41.6173 20.9791 37.354C12.6996 33.0907 12.6546 26.1799 20.8813 21.9166C29.108 17.6534 42.4882 17.6534 50.7677 21.9166Z" fill="url(#paint7_radial_6722_31909)" fill-opacity="0.64"/>
-<path d="M23.6445 40.6882V51.4273C22.1687 50.9551 20.7537 50.356 19.4715 49.6965C18.0643 48.9726 16.8957 48.1416 15.9248 47.2986V36.6142C15.9366 36.6006 15.9463 36.5888 15.958 36.5752C15.962 36.5791 15.968 36.583 15.9719 36.587L15.9876 36.5987C16.0169 36.626 16.054 36.6571 16.097 36.6943C16.1323 36.7236 16.2361 36.8133 16.379 36.9303C16.6275 37.1332 16.8292 37.2913 17.017 37.426C17.1306 37.508 17.2499 37.5977 17.3673 37.6776C17.3888 37.6912 17.4105 37.7069 17.432 37.7205C17.4456 37.7302 17.4534 37.7362 17.4534 37.7362C17.659 37.8807 17.884 38.027 18.1132 38.1673C18.1365 38.183 18.16 38.1966 18.1836 38.2102C18.5907 38.464 19.0213 38.7117 19.4812 38.9498C19.5518 38.9867 19.6261 39.0278 19.6986 39.0629C19.7632 39.0961 19.814 39.1254 19.8786 39.1566C20.0293 39.2307 20.1899 39.3126 20.3445 39.383C20.4031 39.4102 20.4698 39.4374 20.5305 39.4649C20.5383 39.4688 20.5441 39.4707 20.5499 39.4746C20.5617 39.4806 20.5677 39.4824 20.5716 39.4843C20.5912 39.4942 20.6127 39.5039 20.6341 39.5136C20.6987 39.5429 20.7633 39.5761 20.8259 39.6033C20.8905 39.6327 20.9493 39.658 21.014 39.6873C21.0786 39.7146 21.1411 39.7439 21.2057 39.7693C21.2154 39.775 21.2272 39.779 21.2371 39.7829C21.2507 39.7887 21.2643 39.7947 21.28 39.8004C21.3036 39.8122 21.329 39.8219 21.3546 39.8337C21.3936 39.8491 21.4328 39.8669 21.4739 39.8823C22.0531 40.1263 22.7207 40.382 23.4723 40.6277C23.531 40.6473 23.5898 40.6667 23.6484 40.6843L23.6445 40.6882Z" fill="white" fill-opacity="0.5"/>
-<path d="M25.0262 38.9869C24.8169 39.2465 24.5663 39.5549 24.357 39.8142C24.1278 40.0972 23.8754 40.4075 23.6464 40.6905C23.5876 40.6709 23.529 40.6512 23.4701 40.6337C22.7206 40.3879 22.0511 40.1322 21.4717 39.8885C21.4306 39.8729 21.3916 39.8553 21.3524 39.8396C21.3288 39.8279 21.3034 39.8182 21.2781 39.8064C21.2524 39.7967 21.2291 39.7849 21.2035 39.7752C21.1391 39.7499 21.0764 39.7205 21.0117 39.6933C20.9453 39.6661 20.8885 39.6386 20.8239 39.6095C20.7614 39.5821 20.6967 39.5509 20.6321 39.5198C20.6104 39.5099 20.589 39.5002 20.5694 39.4905C20.5654 39.4884 20.5576 39.4845 20.5479 39.4805C20.5421 39.4769 20.5361 39.4748 20.5283 39.4709C20.4676 39.4436 20.403 39.4162 20.3423 39.3889C20.1877 39.3167 20.0273 39.2369 19.8766 39.1625C19.812 39.1314 19.761 39.1021 19.6964 39.0691C19.626 39.0338 19.5517 38.9929 19.4792 38.9558C19.0193 38.7197 18.5887 38.4719 18.1816 38.2164C18.1581 38.2028 18.1345 38.1889 18.111 38.1735C17.88 38.0329 17.6568 37.8866 17.4514 37.7422C17.4514 37.7422 17.4415 37.7364 17.43 37.7267C17.4083 37.7129 17.3868 37.6974 17.3654 37.6838C17.2479 37.6037 17.1284 37.5139 17.0148 37.432C16.827 37.2972 16.6255 37.1394 16.3768 36.9363C16.2339 36.8193 16.1282 36.7295 16.095 36.7002C16.0518 36.6633 16.0167 36.6319 15.9854 36.6047L15.9697 36.5929C15.9697 36.5929 15.96 36.5851 15.9561 36.5814C16.4199 36.0095 16.8837 35.4379 17.3476 34.8682C17.6061 35.1063 17.976 35.4301 18.4419 35.7871C19.8237 36.8465 21.0431 37.4202 21.8926 37.8162C22.6892 38.1871 23.7422 38.6182 25.0244 38.9929L25.0262 38.9869Z" fill="white" fill-opacity="0.48"/>
-<path d="M55.7353 36.7707V47.3907C54.7723 48.2374 53.59 49.0372 52.1847 49.765C52.0515 49.8354 51.9165 49.9035 51.7794 49.97L51.748 39.2914C51.8127 39.2602 51.8754 39.229 51.938 39.1958C52.0084 39.1607 52.079 39.1236 52.1494 39.0885C52.9284 38.6865 53.6408 38.2651 54.2867 37.8241C54.4024 37.7443 54.5177 37.6642 54.6313 37.5823C54.8563 37.4203 55.0737 37.2544 55.2811 37.0887C55.3771 37.0125 55.471 36.9345 55.565 36.8565C55.6118 36.8154 55.6589 36.7764 55.7057 36.7354L55.7353 36.7707Z" fill="#9693D3"/>
-<path d="M55.6997 36.7279C55.6997 36.7279 55.6901 36.7376 55.6841 36.7416C55.6273 36.7902 55.5705 36.8392 55.5137 36.8858C55.2827 37.081 55.0381 37.2723 54.7838 37.4616C54.6742 37.5414 54.5607 37.6233 54.4451 37.7034C54.2944 37.8089 54.1397 37.9141 53.9812 38.0175C53.897 38.0722 53.813 38.1269 53.7267 38.1816C53.6034 38.2596 53.4763 38.3376 53.3489 38.4137C53.2199 38.4896 53.0907 38.5679 52.9575 38.6419C52.7579 38.755 52.5544 38.8683 52.3448 38.9796C52.2744 39.0165 52.2041 39.0536 52.1334 39.0887C52.0042 39.1552 51.8731 39.2214 51.7421 39.2858L50.4209 37.6039C50.5541 37.5396 50.6851 37.4731 50.8144 37.4069C52.2216 36.6829 53.3902 35.881 54.3218 35.0283L55.6997 36.7259V36.7279Z" fill="#B1A1E7"/>
-<path d="M58.8883 15.5775L58.853 26.3048C58.8473 28.3769 57.8 30.447 55.7076 32.287C54.7446 33.1337 53.5624 33.9337 52.157 34.6615C52.0239 34.7316 51.8889 34.7999 51.7518 34.8664C42.7541 39.3071 28.4656 39.2388 19.5713 34.6615C15.0283 32.324 12.7599 29.253 12.7696 26.1877L12.803 15.478C17.5203 15.478 50.654 15.5775 58.8883 15.5775Z" fill="#C9D7DD"/>
-<path d="M58.8883 15.5775L58.853 26.3048C58.8473 28.3769 57.8 30.447 55.7076 32.287C54.7446 33.1337 53.5624 33.9337 52.157 34.6615C52.0239 34.7316 51.8889 34.7999 51.7518 34.8664C42.7541 39.3071 28.4656 39.2388 19.5713 34.6615C15.0283 32.324 12.7599 29.253 12.7696 26.1877L12.803 15.478C17.5203 15.478 50.654 15.5775 58.8883 15.5775Z" fill="url(#paint8_linear_6722_31909)" fill-opacity="0.8"/>
-<path d="M58.8883 15.5775L58.853 26.3048C58.8473 28.3769 57.8 30.447 55.7076 32.287C54.7446 33.1337 53.5624 33.9337 52.157 34.6615C52.0239 34.7316 51.8889 34.7999 51.7518 34.8664C42.7541 39.3071 28.4656 39.2388 19.5713 34.6615C15.0283 32.324 12.7599 29.253 12.7696 26.1877L12.803 15.478C17.5203 15.478 50.654 15.5775 58.8883 15.5775Z" fill="url(#paint9_linear_6722_31909)" fill-opacity="0.8"/>
-<path d="M52.0848 7.09994C61.112 11.7475 61.1609 19.2828 52.1926 23.9304C43.2239 28.5779 28.634 28.5779 19.6068 23.9304C10.5796 19.2828 10.5306 11.7475 19.5011 7.09994C28.4697 2.45236 43.0596 2.45236 52.0869 7.09994H52.0848Z" fill="white"/>
-<path d="M52.0848 7.09994C61.112 11.7475 61.1609 19.2828 52.1926 23.9304C43.2239 28.5779 28.634 28.5779 19.6068 23.9304C10.5796 19.2828 10.5306 11.7475 19.5011 7.09994C28.4697 2.45236 43.0596 2.45236 52.0869 7.09994H52.0848Z" fill="url(#paint10_linear_6722_31909)" fill-opacity="0.6"/>
-<path d="M50.7394 6.81118C59.0189 11.0744 59.0639 17.9853 50.8372 22.2485C42.6106 26.5117 29.2303 26.5117 20.9508 22.2485C12.6713 17.9853 12.6263 11.0744 20.8529 6.81118C29.0796 2.54797 42.4599 2.54797 50.7394 6.81118Z" fill="#7220FF"/>
-<path d="M50.7394 6.81118C59.0189 11.0744 59.0639 17.9853 50.8372 22.2485C42.6106 26.5117 29.2303 26.5117 20.9508 22.2485C12.6713 17.9853 12.6263 11.0744 20.8529 6.81118C29.0796 2.54797 42.4599 2.54797 50.7394 6.81118Z" fill="url(#paint11_radial_6722_31909)" fill-opacity="0.64"/>
-<path d="M23.6191 25.5847V36.3235C22.1433 35.8514 20.728 35.2525 19.4461 34.593C18.0386 33.8691 16.8703 33.0379 15.8994 32.1951V21.5107C15.9112 21.497 15.9209 21.4853 15.9326 21.4717C15.9366 21.4756 15.9423 21.4795 15.9463 21.4834L15.962 21.4951C15.9913 21.5224 16.0286 21.5536 16.0716 21.5907C16.1069 21.62 16.2105 21.7097 16.3536 21.8268C16.6021 22.0297 16.8036 22.1878 16.9916 22.3224C17.1049 22.4043 17.2245 22.4941 17.342 22.5741C17.3634 22.5877 17.3849 22.6033 17.4066 22.617C17.4202 22.6267 17.428 22.6326 17.428 22.6326C17.6336 22.777 17.8586 22.9233 18.0876 23.0638C18.1111 23.0794 18.1346 23.0931 18.1582 23.1067C18.5653 23.3604 18.9959 23.6082 19.4558 23.8462C19.5262 23.8833 19.6007 23.9242 19.6732 23.9594C19.7376 23.9925 19.7886 24.0218 19.8532 24.053C20.0039 24.1272 20.1643 24.2091 20.3191 24.2794C20.3777 24.3067 20.4442 24.334 20.5049 24.3613C20.5127 24.3652 20.5187 24.3671 20.5245 24.3711C20.5363 24.3769 20.542 24.3789 20.546 24.3808C20.5656 24.3906 20.5873 24.4003 20.6087 24.4101C20.6733 24.4393 20.738 24.4725 20.8005 24.4998C20.8651 24.5291 20.9237 24.5545 20.9883 24.5837C21.0529 24.611 21.1157 24.6403 21.1803 24.6657C21.19 24.6715 21.2018 24.6754 21.2115 24.6793C21.2253 24.6852 21.239 24.691 21.2546 24.6969C21.2782 24.7086 21.3036 24.7183 21.329 24.73C21.3682 24.7457 21.4072 24.7632 21.4485 24.7788C22.0277 25.0227 22.6951 25.2783 23.4467 25.5242C23.5056 25.5437 23.5642 25.5632 23.623 25.5808L23.6191 25.5847Z" fill="white" fill-opacity="0.5"/>
-<path d="M24.9989 23.8835C24.7896 24.143 24.5389 24.4512 24.3296 24.7107C24.1005 24.9937 23.848 25.3039 23.6191 25.5868C23.5602 25.5673 23.5016 25.5478 23.4428 25.5302C22.6932 25.2844 22.0238 25.0288 21.4446 24.7849C21.4032 24.7693 21.3642 24.7517 21.325 24.7361C21.3015 24.7244 21.2761 24.7146 21.2507 24.7029C21.2253 24.6932 21.2018 24.6815 21.1764 24.6717C21.1118 24.6464 21.049 24.6171 20.9844 24.5898C20.9179 24.5625 20.8612 24.5352 20.7966 24.5059C20.734 24.4786 20.6694 24.4473 20.6048 24.4161C20.5833 24.4064 20.5616 24.3966 20.542 24.3869C20.5381 24.3849 20.5305 24.381 20.5206 24.3771C20.5148 24.3732 20.5088 24.3713 20.5009 24.3673C20.4402 24.34 20.3759 24.3127 20.3152 24.2854C20.1606 24.2132 19.9999 24.1332 19.8492 24.0591C19.7846 24.0279 19.7336 23.9986 19.6692 23.9654C19.5986 23.9303 19.5243 23.8893 19.4519 23.8523C18.9919 23.6162 18.5613 23.3684 18.1542 23.1128C18.1307 23.0991 18.1072 23.0855 18.0836 23.0699C17.8529 22.9294 17.6297 22.783 17.4241 22.6386C17.4241 22.6386 17.4144 22.6328 17.4026 22.623C17.3809 22.6094 17.3595 22.5938 17.338 22.5801C17.2206 22.5001 17.1012 22.4104 16.9877 22.3284C16.7996 22.1938 16.5982 22.0358 16.3496 21.8328C16.2066 21.7158 16.1009 21.626 16.0676 21.5967C16.0247 21.5597 15.9894 21.5285 15.958 21.5011L15.9423 21.4894C15.9423 21.4894 15.9326 21.4816 15.9287 21.4777C16.3926 20.9061 16.8564 20.3344 17.3202 19.7646C17.5787 20.0027 17.9486 20.3266 18.4146 20.6836C19.7964 21.7431 21.0158 22.3167 21.8652 22.7128C22.6619 23.0835 23.7149 23.5147 24.997 23.8893L24.9989 23.8835Z" fill="white" fill-opacity="0.48"/>
-<path d="M55.7079 21.667V32.2869C54.7449 33.1337 53.5627 33.9337 52.1573 34.6615C52.0242 34.7316 51.8892 34.7999 51.7521 34.8664L51.7207 24.1878C51.7853 24.1566 51.8481 24.1254 51.9106 24.0922C51.9812 24.0571 52.0516 24.02 52.122 23.9849C52.9011 23.583 53.6135 23.1615 54.2594 22.7206C54.375 22.6406 54.4904 22.5606 54.6039 22.4786C54.8289 22.3167 55.0463 22.1508 55.2538 21.985C55.3498 21.9089 55.4437 21.8309 55.5376 21.7528C55.5845 21.7118 55.6316 21.6728 55.6786 21.6318L55.7079 21.667Z" fill="#9693D3"/>
-<path d="M55.6724 21.6242C55.6724 21.6242 55.6627 21.634 55.6567 21.6379C55.5999 21.6867 55.5432 21.7355 55.4864 21.7823C55.2556 21.9774 55.0108 22.1686 54.7565 22.3579C54.6469 22.4379 54.5333 22.5198 54.4177 22.5998C54.267 22.7052 54.1124 22.8105 53.9539 22.9139C53.8696 22.9686 53.7856 23.0232 53.6996 23.0778C53.5761 23.1559 53.4489 23.2339 53.3218 23.31C53.1926 23.3861 53.0633 23.4642 52.9302 23.5383C52.7306 23.6514 52.527 23.7646 52.3175 23.8758C52.2471 23.9129 52.1767 23.95 52.1061 23.9851C51.9771 24.0514 51.8458 24.1178 51.7147 24.1822L50.3936 22.5003C50.5267 22.4359 50.6578 22.3696 50.787 22.3032C52.1942 21.5794 53.3629 20.7775 54.2945 19.9248L55.6724 21.6223V21.6242Z" fill="#B1A1E9"/>
-<defs>
-<linearGradient id="paint0_linear_6722_31909" x1="67.9084" y1="57.6303" x2="5.61081" y2="55.9318" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.12" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="0.3" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6722_31909" x1="67.9065" y1="57.6322" x2="5.60897" y2="55.9318" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint2_linear_6722_31909" x1="12.8577" y1="45.7246" x2="58.9412" y2="45.7246" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.5"/>
-</linearGradient>
-<radialGradient id="paint3_radial_6722_31909" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(64.9544 28.4942) scale(66.2693 66.0593)">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</radialGradient>
-<linearGradient id="paint4_linear_6722_31909" x1="67.882" y1="42.5102" x2="5.58445" y2="40.8117" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.12" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="0.3" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint5_linear_6722_31909" x1="67.8801" y1="42.512" x2="5.5826" y2="40.8117" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint6_linear_6722_31909" x1="12.8304" y1="30.6206" x2="58.9138" y2="30.6206" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.5"/>
-</linearGradient>
-<radialGradient id="paint7_radial_6722_31909" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(64.927 13.3903) scale(66.2693 66.0593)">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</radialGradient>
-<linearGradient id="paint8_linear_6722_31909" x1="67.8549" y1="27.4248" x2="5.5571" y2="25.7264" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.12" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="0.3" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint9_linear_6722_31909" x1="67.8531" y1="27.4266" x2="5.55522" y2="25.7263" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint10_linear_6722_31909" x1="12.8033" y1="15.5151" x2="58.8865" y2="15.5151" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.5"/>
-</linearGradient>
-<radialGradient id="paint11_radial_6722_31909" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(64.8987 -1.71328) scale(66.2693 66.0593)">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</radialGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#c9d7dd" d="m58.942 45.783-.035 10.727c-.006 2.072-1.053 4.142-3.146 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.405.205c-8.998 4.44-23.287 4.372-32.181-.205-4.543-2.338-6.811-5.409-6.802-8.474l.034-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="url(#paint0_linear_6722_31909)" fill-opacity=".8" d="m58.942 45.783-.035 10.727c-.006 2.072-1.053 4.142-3.146 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.405.205c-8.998 4.44-23.287 4.372-32.181-.205-4.543-2.338-6.811-5.409-6.802-8.474l.034-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="url(#paint1_linear_6722_31909)" d="m58.942 45.783-.035 10.727c-.006 2.072-1.053 4.142-3.146 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.405.205c-8.998 4.44-23.287 4.372-32.181-.205-4.543-2.338-6.811-5.409-6.802-8.474l.034-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="#fff" d="M52.14 37.31c9.026 4.647 9.076 12.182.107 16.83-8.968 4.647-23.558 4.647-32.585 0s-9.077-12.183-.106-16.83c8.968-4.648 23.558-4.648 32.585 0z"/><path fill="url(#paint2_linear_6722_31909)" fill-opacity=".6" d="M52.14 37.31c9.026 4.647 9.076 12.182.107 16.83-8.968 4.647-23.558 4.647-32.585 0s-9.077-12.183-.106-16.83c8.968-4.648 23.558-4.648 32.585 0z"/><path fill="#9693d3" d="M55.735 51.771v10.62c-.963.847-2.145 1.647-3.55 2.375q-.2.105-.406.204l-.031-10.678q.097-.046.19-.096l.211-.107a20 20 0 0 0 2.138-1.264q.173-.12.344-.242a16 16 0 0 0 .934-.726l.14-.121z"/><path fill="#fff" fill-opacity=".5" d="M23.672 55.795v10.739a27.6 27.6 0 0 1-4.173-1.731 17.8 17.8 0 0 1-3.547-2.398V51.721l.033-.04q.007.008.014.012l.016.012q.044.04.11.096c.035.029.138.119.281.236.249.203.45.36.638.495.114.082.233.172.35.252l.065.043.022.015c.205.145.43.291.66.432l.07.043q.61.38 1.298.739c.07.037.145.078.217.113.064.033.115.063.18.094.15.074.311.156.466.226.058.028.125.055.186.082l.02.01.02.01.064.029.191.09.188.084.192.082q.016.009.031.013l.043.018.075.033q.058.025.12.049a25 25 0 0 0 1.998.745q.087.03.176.057z"/><path fill="#fff" fill-opacity=".48" d="m25.054 54.091-.67.827-.71.877-.176-.057a26 26 0 0 1-1.999-.745l-.12-.05-.074-.032-.074-.032q-.096-.039-.192-.082c-.066-.027-.123-.054-.187-.083q-.095-.043-.192-.09l-.063-.03-.021-.01-.02-.01-.186-.081c-.155-.072-.315-.152-.466-.226-.064-.032-.115-.06-.18-.094-.07-.035-.145-.076-.217-.113a17 17 0 0 1-1.369-.782c-.23-.141-.454-.287-.659-.432l-.022-.015-.064-.043c-.118-.08-.237-.17-.35-.252a13 13 0 0 1-.639-.496 13 13 0 0 1-.391-.331l-.016-.012-.014-.012 1.392-1.713c.259.238.628.562 1.094.92 1.382 1.059 2.602 1.632 3.451 2.028.797.371 1.85.802 3.132 1.177z"/><path fill="#af9fe7" d="M55.727 51.832s-.01.01-.015.013l-.17.145a15 15 0 0 1-1.533 1.131q-.126.083-.255.164-.185.117-.377.233-.194.115-.392.228-.299.17-.613.337l-.211.11-.391.197-1.322-1.682q.2-.097.394-.197c1.407-.724 2.576-1.526 3.507-2.379l1.378 1.698z"/><path fill="#7220ff" d="M50.795 37.02c8.28 4.264 8.325 11.175.098 15.438s-21.607 4.263-29.886 0-8.325-11.174-.098-15.437c8.226-4.264 21.607-4.264 29.886 0"/><path fill="url(#paint3_radial_6722_31909)" fill-opacity=".64" d="M50.795 37.02c8.28 4.264 8.325 11.175.098 15.438s-21.607 4.263-29.886 0-8.325-11.174-.098-15.437c8.226-4.264 21.607-4.264 29.886 0"/><path fill="#c9d7dd" d="M58.915 30.663 58.88 41.39c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.406.205c-8.998 4.44-23.286 4.372-32.18-.205-4.543-2.338-6.812-5.409-6.802-8.474l.033-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="url(#paint4_linear_6722_31909)" fill-opacity=".8" d="M58.915 30.663 58.88 41.39c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.406.205c-8.998 4.44-23.286 4.372-32.18-.205-4.543-2.338-6.812-5.409-6.802-8.474l.033-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="url(#paint5_linear_6722_31909)" fill-opacity=".8" d="M58.915 30.663 58.88 41.39c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.145 1.647-3.55 2.375q-.2.105-.406.205c-8.998 4.44-23.286 4.372-32.18-.205-4.543-2.338-6.812-5.409-6.802-8.474l.033-10.71c5.93 1.237 37.855.1 46.085.1"/><path fill="#fff" d="M52.112 22.205c9.027 4.648 9.076 12.183.108 16.83-8.969 4.648-23.559 4.648-32.586 0s-9.076-12.182-.106-16.83c8.969-4.647 23.559-4.647 32.586 0z"/><path fill="url(#paint6_linear_6722_31909)" fill-opacity=".6" d="M52.112 22.205c9.027 4.648 9.076 12.183.108 16.83-8.969 4.648-23.559 4.648-32.586 0s-9.076-12.182-.106-16.83c8.969-4.647 23.559-4.647 32.586 0z"/><path fill="#7220ff" d="M50.768 21.917c8.28 4.263 8.324 11.174.098 15.437-8.227 4.263-21.607 4.263-29.887 0s-8.324-11.174-.098-15.437c8.227-4.264 21.607-4.264 29.887 0"/><path fill="url(#paint7_radial_6722_31909)" fill-opacity=".64" d="M50.768 21.917c8.28 4.263 8.324 11.174.098 15.437-8.227 4.263-21.607 4.263-29.887 0s-8.324-11.174-.098-15.437c8.227-4.264 21.607-4.264 29.887 0"/><path fill="#fff" fill-opacity=".5" d="M23.645 40.688v10.74a27.6 27.6 0 0 1-4.174-1.731 17.8 17.8 0 0 1-3.546-2.398V36.614l.033-.039.014.012.016.012q.044.04.109.095c.035.03.14.12.282.236.248.203.45.361.638.496.114.082.233.172.35.252l.065.043.021.015a13 13 0 0 0 .73.474c.408.254.838.502 1.298.74.07.037.145.078.218.113.064.033.115.062.18.094.15.074.31.156.465.226.06.027.126.054.186.082l.02.01.022.01.062.029c.065.029.13.062.192.09l.188.083q.096.043.192.082l.031.014q.02.01.043.017l.075.034.119.048a26 26 0 0 0 2.174.802z"/><path fill="#fff" fill-opacity=".48" d="m25.026 38.987-.669.827c-.23.283-.482.593-.71.877l-.177-.057a26 26 0 0 1-1.998-.745l-.12-.05-.074-.033q-.037-.016-.075-.03-.096-.04-.191-.083c-.067-.027-.123-.054-.188-.084q-.095-.041-.192-.09l-.063-.029-.021-.01-.02-.01-.186-.081a20 20 0 0 1-.465-.227c-.065-.03-.116-.06-.18-.093-.071-.035-.145-.076-.218-.113a17 17 0 0 1-1.368-.783c-.231-.14-.454-.286-.66-.43l-.021-.016-.065-.043c-.117-.08-.237-.17-.35-.252-.188-.135-.39-.293-.638-.496a13 13 0 0 1-.282-.236l-.11-.095-.015-.012-.014-.012 1.392-1.713c.258.238.628.562 1.094.92 1.382 1.059 2.601 1.632 3.45 2.028.797.371 1.85.802 3.132 1.177z"/><path fill="#9693d3" d="M55.735 36.77v10.62c-.963.847-2.145 1.647-3.55 2.375q-.2.106-.406.205l-.031-10.679q.097-.045.19-.095l.211-.107a20 20 0 0 0 2.138-1.265q.173-.12.344-.242.339-.244.65-.493.143-.114.284-.233l.14-.12z"/><path fill="#b1a1e7" d="m55.7 36.728-.016.014-.17.144a15 15 0 0 1-1.533 1.131l-.254.165q-.186.117-.378.232-.193.116-.391.228-.3.17-.613.338-.105.056-.212.109l-.39.197-1.322-1.682q.2-.096.393-.197c1.408-.724 2.576-1.526 3.508-2.379l1.378 1.698z"/><path fill="#c9d7dd" d="m58.888 15.578-.035 10.727c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.146 1.647-3.551 2.374q-.2.105-.405.205c-8.998 4.441-23.286 4.373-32.18-.205-4.544-2.337-6.812-5.408-6.802-8.473l.033-10.71c4.717 0 37.851.1 46.085.1"/><path fill="url(#paint8_linear_6722_31909)" fill-opacity=".8" d="m58.888 15.578-.035 10.727c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.146 1.647-3.551 2.374q-.2.105-.405.205c-8.998 4.441-23.286 4.373-32.18-.205-4.544-2.337-6.812-5.408-6.802-8.473l.033-10.71c4.717 0 37.851.1 46.085.1"/><path fill="url(#paint9_linear_6722_31909)" fill-opacity=".8" d="m58.888 15.578-.035 10.727c-.006 2.072-1.053 4.142-3.145 5.982-.963.847-2.146 1.647-3.551 2.374q-.2.105-.405.205c-8.998 4.441-23.286 4.373-32.18-.205-4.544-2.337-6.812-5.408-6.802-8.473l.033-10.71c4.717 0 37.851.1 46.085.1"/><path fill="#fff" d="M52.085 7.1c9.027 4.648 9.076 12.183.108 16.83-8.97 4.648-23.559 4.648-32.586 0S10.53 11.748 19.5 7.1c8.969-4.648 23.559-4.648 32.586 0z"/><path fill="url(#paint10_linear_6722_31909)" fill-opacity=".6" d="M52.085 7.1c9.027 4.648 9.076 12.183.108 16.83-8.97 4.648-23.559 4.648-32.586 0S10.53 11.748 19.5 7.1c8.969-4.648 23.559-4.648 32.586 0z"/><path fill="#7220ff" d="M50.74 6.811c8.279 4.263 8.324 11.174.097 15.438-8.226 4.263-21.607 4.263-29.886 0-8.28-4.264-8.325-11.175-.098-15.438s21.607-4.263 29.886 0"/><path fill="url(#paint11_radial_6722_31909)" fill-opacity=".64" d="M50.74 6.811c8.279 4.263 8.324 11.174.097 15.438-8.226 4.263-21.607 4.263-29.886 0-8.28-4.264-8.325-11.175-.098-15.438s21.607-4.263 29.886 0"/><path fill="#fff" fill-opacity=".5" d="M23.62 25.585v10.739a27.5 27.5 0 0 1-4.174-1.731 17.8 17.8 0 0 1-3.547-2.398V21.511l.034-.04.013.012.016.012.11.096c.035.029.139.119.282.236.248.203.45.36.638.495.113.082.232.172.35.252l.065.043.021.016a13 13 0 0 0 .73.474q.61.38 1.298.74c.07.036.145.077.217.112.065.034.116.063.18.094.15.074.311.156.466.226.059.028.125.055.186.082l.02.01.021.01.063.03c.064.028.129.061.191.089l.188.084.192.082q.016.009.032.013l.043.018q.035.017.074.033l.12.049a25 25 0 0 0 1.998.745q.088.03.176.057z"/><path fill="#fff" fill-opacity=".48" d="m24.999 23.884-.67.827-.71.876q-.088-.03-.176-.057a26 26 0 0 1-1.998-.745l-.12-.049q-.035-.017-.074-.033l-.075-.031-.192-.082c-.066-.027-.123-.055-.187-.084q-.095-.042-.192-.09l-.063-.03-.021-.009-.02-.01c-.06-.027-.125-.054-.186-.082-.154-.072-.315-.152-.466-.226-.064-.031-.115-.06-.18-.094-.07-.035-.145-.076-.217-.113q-.688-.355-1.298-.74-.035-.019-.07-.042a12 12 0 0 1-.66-.431s-.01-.006-.021-.016l-.065-.043c-.117-.08-.237-.17-.35-.252-.188-.134-.39-.292-.638-.495a13 13 0 0 1-.282-.236l-.11-.096-.016-.012s-.01-.007-.013-.011q.695-.859 1.391-1.713c.259.238.629.562 1.095.919 1.381 1.06 2.6 1.633 3.45 2.029.797.37 1.85.802 3.132 1.176z"/><path fill="#9693d3" d="M55.708 21.667v10.62c-.963.847-2.145 1.647-3.55 2.374q-.2.105-.406.205l-.031-10.678q.096-.046.19-.096l.211-.107q1.17-.603 2.137-1.264.174-.12.345-.242a16 16 0 0 0 .934-.726l.14-.121z"/><path fill="#b1a1e9" d="m55.672 21.624-.015.014-.17.144a15 15 0 0 1-1.533 1.132q-.126.083-.254.164-.187.117-.378.232-.194.116-.392.228a25 25 0 0 1-.824.447q-.194.1-.391.197L50.394 22.5q.2-.096.393-.197c1.407-.724 2.576-1.526 3.508-2.378l1.377 1.697z"/><defs><linearGradient id="paint0_linear_6722_31909" x1="67.908" x2="5.611" y1="57.63" y2="55.932" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".12" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset=".3" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint1_linear_6722_31909" x1="67.906" x2="5.609" y1="57.632" y2="55.932" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint2_linear_6722_31909" x1="12.858" x2="58.941" y1="45.725" y2="45.725" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".5"/></linearGradient><linearGradient id="paint4_linear_6722_31909" x1="67.882" x2="5.584" y1="42.51" y2="40.812" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".12" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset=".3" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint5_linear_6722_31909" x1="67.88" x2="5.583" y1="42.512" y2="40.812" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint6_linear_6722_31909" x1="12.83" x2="58.914" y1="30.621" y2="30.621" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".5"/></linearGradient><linearGradient id="paint8_linear_6722_31909" x1="67.855" x2="5.557" y1="27.425" y2="25.726" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".12" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset=".3" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint9_linear_6722_31909" x1="67.853" x2="5.555" y1="27.427" y2="25.726" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint10_linear_6722_31909" x1="12.803" x2="58.886" y1="15.515" y2="15.515" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".5"/></linearGradient><radialGradient id="paint3_radial_6722_31909" cx="0" cy="0" r="1" gradientTransform="matrix(66.2693 0 0 66.0593 64.954 28.494)" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></radialGradient><radialGradient id="paint7_radial_6722_31909" cx="0" cy="0" r="1" gradientTransform="matrix(66.2693 0 0 66.0593 64.927 13.39)" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></radialGradient><radialGradient id="paint11_radial_6722_31909" cx="0" cy="0" r="1" gradientTransform="matrix(66.2693 0 0 66.0593 64.899 -1.713)" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></radialGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/datadog-dark.svg b/web/packages/design/src/ResourceIcon/assets/datadog-dark.svg
index 8c0474e7e91a0..a05cf76706b8a 100644
--- a/web/packages/design/src/ResourceIcon/assets/datadog-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/datadog-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17025_11967)">
-<path d="M28.3145 18.9162C30.8032 17.2203 34.0093 17.8869 33.4729 18.398C32.4499 19.3725 33.8109 19.0844 33.9578 20.8827C34.0657 22.2072 33.6332 22.9365 33.261 23.3515C32.4841 23.4531 31.5397 23.6428 30.4025 24.0126C29.7295 24.2316 29.1446 24.4745 28.632 24.7189C28.4971 24.6308 28.3502 24.5229 28.1764 24.3729C26.421 22.8508 26.4798 20.1669 28.3145 18.9162ZM43.1801 29.4003C43.6316 29.0503 45.6839 28.3909 47.5837 28.1663C48.5813 28.0488 50.0034 27.9806 50.3065 28.1504C50.9089 28.4829 50.9089 29.5122 50.4962 30.4629C49.8954 31.8438 49.0463 33.3698 48.0845 33.4952C46.5155 33.7024 45.0323 32.8532 43.3388 31.5882C42.7341 31.1335 42.3627 30.032 43.1801 29.4003ZM46.0426 15.9529C48.359 17.0306 48.0559 19.0812 48.1202 20.2859C48.1376 20.6319 48.1321 20.8652 48.1027 21.0255C47.7821 20.8517 47.275 20.724 46.4711 20.7597C46.2362 20.7692 46.0076 20.797 45.7862 20.8319C44.9315 20.374 44.4205 19.478 43.953 18.5257C43.9102 18.4376 43.8768 18.3591 43.8451 18.2829C43.8316 18.248 43.8173 18.2107 43.8038 18.1789C43.7983 18.1615 43.7943 18.148 43.788 18.1321C43.5316 17.3187 43.7038 17.156 43.8118 16.9052C43.9237 16.6489 44.3419 16.4378 43.7237 16.2243C43.6705 16.2045 43.6046 16.1934 43.53 16.1791C43.9395 15.6712 45.1656 15.5482 46.0426 15.9529ZM33.4141 40.4709C30.9183 38.8686 28.336 36.5704 27.2067 35.2983C27.017 35.1554 27.048 34.5213 27.048 34.5213C28.0669 35.3133 32.2944 38.3337 36.7647 39.713C38.3416 40.2003 40.7612 40.3844 42.8603 39.1948C44.4641 38.2853 46.3949 36.7005 47.5472 35.0673L47.7583 35.4332C47.7504 35.676 47.2202 36.8593 46.9504 37.3346C47.4377 37.6148 47.8012 37.6909 48.3432 37.8393L52.0445 37.2624C53.373 35.1165 54.3253 31.6557 53.3103 28.3615C52.7309 26.4719 49.7105 22.7095 49.4939 22.5024C48.7352 21.7731 49.6209 18.9559 48.117 15.8823C46.5274 12.6309 42.3857 9.24071 40.5866 7.76543C41.1167 8.1527 44.3816 9.46927 45.9037 11.3064C46.0465 11.1168 46.1052 10.1303 46.2362 9.88035C44.9291 8.16857 44.8276 5.12277 44.8276 4.30855C44.8276 2.8158 44.0689 1.12387 44.0689 1.12387C44.0689 1.12387 45.3759 2.15871 45.714 3.94111C46.1132 6.05207 46.9639 7.71464 48.0892 9.12167C50.2192 11.7746 52.1429 13.1357 53.115 12.1556C54.2784 10.9779 51.935 5.71003 48.9415 2.76977C45.4474 -0.661711 44.5339 -0.219681 42.4841 0.512009C40.8485 1.0953 39.9644 5.73939 35.7013 5.64733C34.9791 5.56321 33.1189 5.51798 32.1992 5.52591C32.6785 4.85692 33.0896 4.34029 33.0896 4.34029C33.0896 4.34029 31.6595 4.91564 30.4406 5.64495L30.3469 5.50449C30.758 4.63789 31.2 4.09031 31.2 4.09031C31.2 4.09031 30.0573 4.77677 29.0145 5.59893C29.2041 4.56567 29.9223 3.91096 29.9223 3.91096C29.9223 3.91096 28.4788 4.17126 26.6401 6.19412C24.5505 6.7655 24.0482 7.14087 22.3832 7.87812C19.6755 7.28769 18.3986 6.33458 17.1813 4.57996C16.2543 3.23958 14.6045 3.03642 12.9189 3.72923C10.4611 4.74502 7.35263 6.13619 7.35263 6.13619C7.35263 6.13619 8.36605 6.09492 9.42232 6.14015C7.97639 6.68773 6.58761 7.44085 6.58761 7.44085C6.58761 7.44085 7.26454 7.41704 8.10019 7.43133C7.52325 7.91065 7.20423 8.13921 6.65427 8.50347C5.33215 9.46371 4.26001 10.5732 4.26001 10.5732C4.26001 10.5732 5.15756 10.1645 5.96385 9.9351C5.4004 11.2263 4.28302 12.177 4.48856 13.7578C4.68617 15.2014 6.45826 18.175 8.74538 20.0002C8.94299 20.1589 12.0674 23.05 14.4243 21.8628C16.7797 20.6771 17.709 19.6209 18.0963 18.0012C18.5518 16.141 18.2923 14.7339 17.3193 10.6962C16.9987 9.36372 16.1631 6.61948 15.7599 5.30688L15.8496 5.2426C16.6202 6.86867 18.5923 11.1549 19.3866 14.034C20.627 18.5233 20.2398 20.8009 19.6723 21.6358C17.9606 24.1539 13.5744 24.4864 11.5793 23.0913C11.2738 27.925 12.3538 30.0534 12.7197 31.1256C12.538 32.358 13.3363 34.6467 13.3363 34.6467C13.3363 34.6467 13.426 33.6063 13.7918 33.058C13.8894 34.2809 14.5061 35.7339 14.5061 35.7339C14.5061 35.7339 14.4688 34.8364 14.7489 34.0611C15.1441 34.7301 15.4338 34.8888 15.8075 35.3911C16.1813 36.6982 16.9305 37.6528 16.9305 37.6528C16.9305 37.6528 16.8091 36.9521 16.8757 36.2228C18.7049 37.9798 19.02 40.5439 19.2017 42.5144C19.7144 47.9314 10.6603 52.239 8.90569 55.6277C7.57563 57.6347 6.77887 60.8098 9.03108 62.6819C14.4751 67.203 12.384 68.4473 15.1092 70.4345C18.8478 73.1597 23.5252 71.9391 25.1172 69.7226C27.3337 66.634 26.7647 63.7207 25.9409 60.9955C25.2973 58.8647 23.5482 55.3245 21.3849 53.9548C19.174 52.5541 17.0241 52.2922 15.2028 52.4795L15.3711 52.2859C17.9907 51.7653 20.7294 52.051 22.711 53.3286C24.9608 54.7746 27.0186 57.2545 28.0947 61.0558C29.3153 60.882 29.4875 60.8035 30.6048 60.6448L28.0892 41.0621L33.4141 40.4709ZM34.868 65.0167L34.5783 62.301L40.2359 53.6715L46.6584 55.5475L52.181 46.3236L58.8011 50.6908L63.8309 40.1423L65.6188 59.3528L34.868 65.0167ZM65.6855 36.2085L45.4712 39.8725C44.9704 40.5177 43.7324 41.651 43.1372 41.9462C40.5842 43.2318 38.859 42.8596 37.3678 42.4723C36.4092 42.2295 35.8536 42.093 35.0577 41.7351L30.1239 42.412L33.1189 67.3998L67.7473 61.1574L65.6855 36.2085Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_17025_11967">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17025_11967)"><path fill="#fff" d="M28.315 18.916c2.488-1.696 5.694-1.03 5.158-.518-1.023.974.338.686.485 2.485.108 1.324-.325 2.053-.697 2.469-.777.101-1.721.29-2.859.66a15 15 0 0 0-1.77.707 4 4 0 0 1-.456-.346c-1.755-1.522-1.696-4.206.139-5.457M43.18 29.4c.452-.35 2.504-1.01 4.404-1.234.997-.117 2.42-.185 2.722-.016.603.333.603 1.362.19 2.313-.6 1.38-1.45 2.907-2.412 3.032-1.569.207-3.052-.642-4.745-1.907-.605-.454-.976-1.556-.159-2.188m2.863-13.447c2.316 1.078 2.013 3.128 2.077 4.333.018.346.012.58-.017.74-.32-.174-.828-.302-1.632-.266-.235.01-.463.037-.685.072-.855-.458-1.366-1.354-1.833-2.306a4 4 0 0 1-.108-.243l-.041-.104-.016-.047c-.256-.813-.084-.976.024-1.227.112-.256.53-.467-.088-.68-.053-.02-.12-.032-.194-.046.41-.508 1.636-.63 2.513-.226M33.414 40.47c-2.496-1.602-5.078-3.9-6.207-5.173-.19-.143-.159-.777-.159-.777 1.019.792 5.246 3.813 9.717 5.192 1.577.487 3.996.671 6.095-.518 1.604-.91 3.535-2.495 4.687-4.128l.211.366c-.008.243-.538 1.426-.808 1.902.488.28.851.356 1.393.504l3.701-.577c1.329-2.145 2.281-5.606 1.266-8.9-.58-1.89-3.6-5.652-3.816-5.86-.759-.729.127-3.546-1.377-6.62-1.59-3.251-5.731-6.641-7.53-8.117.53.388 3.795 1.704 5.317 3.541.142-.19.201-1.176.332-1.426-1.307-1.711-1.408-4.757-1.408-5.571 0-1.493-.76-3.185-.76-3.185s1.308 1.035 1.646 2.817c.4 2.111 1.25 3.774 2.375 5.18 2.13 2.654 4.054 4.015 5.026 3.035 1.163-1.178-1.18-6.446-4.174-9.386C45.448-.662 44.534-.22 42.485.512c-1.636.583-2.52 5.227-6.783 5.135-.722-.084-2.582-.129-3.502-.121.48-.67.89-1.186.89-1.186s-1.43.576-2.648 1.305l-.094-.14c.411-.867.853-1.415.853-1.415s-1.143.687-2.185 1.509c.19-1.033.907-1.688.907-1.688s-1.443.26-3.282 2.283c-2.09.572-2.592.947-4.257 1.684-2.707-.59-3.984-1.543-5.202-3.298-.927-1.34-2.577-1.544-4.262-.85-2.458 1.015-5.566 2.406-5.566 2.406s1.013-.041 2.07.004c-1.447.548-2.835 1.3-2.835 1.3s.677-.023 1.512-.009c-.577.48-.896.708-1.446 1.072-1.322.96-2.394 2.07-2.394 2.07s.898-.409 1.704-.638c-.564 1.291-1.681 2.242-1.475 3.823.197 1.443 1.97 4.417 4.256 6.242.198.159 3.322 3.05 5.68 1.863 2.355-1.186 3.284-2.242 3.671-3.862.456-1.86.196-3.267-.777-7.305-.32-1.332-1.156-4.077-1.56-5.39l.09-.063c.771 1.626 2.743 5.912 3.538 8.791 1.24 4.49.853 6.767.285 7.602-1.711 2.518-6.098 2.85-8.093 1.455-.305 4.834.775 6.962 1.14 8.035-.181 1.232.617 3.52.617 3.52s.09-1.04.456-1.588c.097 1.223.714 2.676.714 2.676s-.037-.898.243-1.673c.395.67.685.828 1.058 1.33a7.3 7.3 0 0 0 1.123 2.262s-.12-.7-.054-1.43c1.829 1.757 2.144 4.32 2.326 6.291.512 5.417-8.542 9.725-10.296 13.114-1.33 2.007-2.127 5.182.125 7.054 5.444 4.521 3.353 5.765 6.078 7.752 3.739 2.726 8.416 1.505 10.008-.711 2.217-3.089 1.648-6.002.824-8.727-.644-2.131-2.393-5.672-4.556-7.041-2.211-1.4-4.36-1.663-6.182-1.475l.168-.194c2.62-.52 5.358-.235 7.34 1.043 2.25 1.446 4.308 3.925 5.384 7.727 1.22-.174 1.393-.252 2.51-.411L28.09 41.062zm1.454 24.546-.29-2.716 5.658-8.63 6.422 1.877 5.523-9.224 6.62 4.367 5.03-10.549 1.788 19.21zm30.818-28.808L45.47 39.872c-.5.646-1.739 1.779-2.334 2.074-2.553 1.286-4.278.914-5.77.526-.958-.242-1.513-.379-2.31-.737l-4.933.677L33.119 67.4l34.628-6.243z"/></g><defs><clipPath id="clip0_17025_11967"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/datadog-light.svg b/web/packages/design/src/ResourceIcon/assets/datadog-light.svg
index e851c4436d798..0ebc6169d70f0 100644
--- a/web/packages/design/src/ResourceIcon/assets/datadog-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/datadog-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17025_11966)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M58.7047 51.1224L52.7147 47.1713L47.7176 55.5182L41.9058 53.8189L36.7886 61.6294L37.0509 64.0879L64.8739 58.9614L63.2578 41.5773L58.7047 51.1224ZM32.7576 43.6272L37.2216 43.0134C37.9439 43.338 38.4467 43.4616 39.3127 43.6819C40.6614 44.0333 42.2228 44.3705 44.5351 43.2051C45.0732 42.9386 46.1941 41.9136 46.6473 41.3292L64.937 38.0113L66.8028 60.5926L35.4693 66.2396L32.7576 43.6272ZM66.7321 35.4905L64.9269 35.8344L61.4585 0L2.35999 6.85275L9.64072 65.9361L16.5582 64.9321C16.0058 64.1434 15.1456 63.1891 13.6767 61.9674C11.6394 60.2748 12.36 57.4 13.5615 55.5846C15.1515 52.5173 23.3437 48.6192 22.8796 43.7164C22.7131 41.9338 22.4297 39.6131 20.775 38.0231C20.7128 38.6832 20.8246 39.3188 20.8246 39.3188C20.8246 39.3188 20.1452 38.4519 19.8063 37.2697C19.47 36.8165 19.206 36.6719 18.8486 36.0665C18.5939 36.7669 18.6275 37.5791 18.6275 37.5791C18.6275 37.5791 18.0717 36.2658 17.9817 35.1576C17.6521 35.6537 17.5689 36.5962 17.5689 36.5962C17.5689 36.5962 16.8466 34.5261 17.0114 33.4112C16.6818 32.4408 15.7048 30.5153 15.9814 26.1388C17.785 27.4026 21.7554 27.1024 23.3025 24.8221C23.8162 24.067 24.1677 22.0053 23.046 17.9433C22.3255 15.3384 20.5412 11.4597 19.8459 9.9882L19.7626 10.0479C20.1292 11.2335 20.8851 13.719 21.1752 14.9239C22.053 18.5789 22.2885 19.8511 21.8765 21.5361C21.5258 23.0009 20.685 23.9594 18.5535 25.0306C16.422 26.1052 13.5935 23.4902 13.4144 23.3456C11.3434 21.6959 9.74162 19.0044 9.56252 17.6969C9.3767 16.2658 10.3874 15.4065 10.8969 14.2361C10.1679 14.4446 9.35484 14.8146 9.35484 14.8146C9.35484 14.8146 10.3252 13.8106 11.5217 12.942C12.0169 12.6141 12.3078 12.4056 12.83 11.9717C12.0741 11.9591 11.4603 11.981 11.4603 11.981C11.4603 11.981 12.7207 11.2999 14.0273 10.8038C13.0713 10.7618 12.1565 10.7971 12.1565 10.7971C12.1565 10.7971 14.969 9.5392 17.1905 8.61597C18.7183 7.98955 20.2108 8.17454 21.0491 9.38701C22.1497 10.9753 23.3059 11.838 25.756 12.3728C27.2603 11.706 27.7177 11.363 29.6079 10.8484C31.2719 9.01873 32.5785 8.78161 32.5785 8.78161C32.5785 8.78161 31.9302 9.37608 31.757 10.3102C32.7004 9.56695 33.7347 8.94642 33.7347 8.94642C33.7347 8.94642 33.3344 9.44082 32.9611 10.2262L33.0477 10.3548C34.1484 9.69475 35.4424 9.17428 35.4424 9.17428C35.4424 9.17428 35.0724 9.64178 34.6386 10.2472C35.4685 10.2405 37.1518 10.2825 37.8051 10.3565C41.662 10.4414 42.4625 6.23727 43.9423 5.71007C45.7955 5.04833 46.6237 4.6481 49.7819 7.74992C52.4919 10.4128 54.6091 15.1795 53.558 16.2473C52.6768 17.1336 50.938 15.9017 49.0108 13.4995C47.9926 12.2273 47.2224 10.7239 46.8617 8.81272C46.5573 7.20001 45.3726 6.26417 45.3726 6.26417C45.3726 6.26417 46.0604 7.7928 46.0604 9.14317C46.0604 9.88058 46.1529 12.6377 47.3351 14.1848C47.2182 14.411 47.1635 15.3039 47.034 15.4746C45.6585 13.8123 42.7046 12.6225 42.2228 12.2719C43.8532 13.608 47.6008 16.677 49.0403 19.6182C50.4016 22.3997 49.5994 24.9491 50.2881 25.6091C50.484 25.7983 53.2158 29.202 53.7413 30.9122C54.6578 33.893 53.796 37.025 52.5961 38.9682L49.2454 39.4904C48.7552 39.3541 48.4248 39.286 47.985 39.0313C48.2272 38.6024 48.709 37.5329 48.714 37.3126L48.5248 36.9805C47.4822 38.4578 45.735 39.8923 44.2837 40.7163C42.3843 41.7925 40.1948 41.6269 38.7695 41.1855C34.7243 39.9377 30.8994 37.2041 29.977 36.4861C29.977 36.4861 29.9484 37.0595 30.1225 37.1882C31.1424 38.3384 33.4791 40.4195 35.7375 41.8699L30.9229 42.3996L33.1991 60.1226C32.1901 60.2672 32.0328 60.3379 30.928 60.4951C29.9543 57.0553 28.0919 54.8094 26.0562 53.5011C24.261 52.3475 21.7848 52.0876 19.4145 52.5568L19.2623 52.7334C20.9103 52.5619 22.856 52.8007 24.8547 54.0661C26.8163 55.3063 28.3971 58.5099 28.9789 60.4388C29.7239 62.9041 30.2393 65.5409 28.234 68.3358C26.8071 70.3227 22.6416 71.4208 19.2766 69.0455C20.1755 70.4909 21.3905 71.6731 23.0259 71.8959C25.4542 72.2255 27.7589 71.8042 29.3455 70.1755C30.7001 68.7831 31.4182 65.8713 31.229 62.8048L33.3723 62.4937L34.1458 67.9978L69.6271 63.7255L66.7321 35.4905ZM45.1455 20.5431C45.0463 20.7693 44.8908 20.9173 45.1245 21.653L45.1388 21.6951L45.1758 21.7901L45.2734 22.0104C45.6946 22.8714 46.1571 23.6836 46.9298 24.0981C47.1299 24.0645 47.3367 24.0418 47.5512 24.0309C48.2768 23.9989 48.735 24.1141 49.026 24.2705C49.052 24.1259 49.0579 23.914 49.0419 23.6021C48.9856 22.5115 49.258 20.6566 47.1619 19.6804C46.3706 19.313 45.2607 19.4265 44.8908 19.8848C44.958 19.8932 45.0186 19.9075 45.0657 19.9234C45.6248 20.1193 45.2456 20.3119 45.1455 20.5431ZM51.0204 30.7188C50.7455 30.5675 49.4607 30.6272 48.5576 30.7348C46.8373 30.9374 44.9799 31.5344 44.5729 31.8523C43.833 32.424 44.1693 33.4213 44.7159 33.8307C46.2487 34.9759 47.5924 35.7436 49.0108 35.557C49.8819 35.4426 50.6496 34.0636 51.1936 32.8125C51.5661 31.9506 51.5661 31.0207 51.0204 30.7188ZM35.7896 21.8935C36.2748 21.4327 33.3731 20.8273 31.1214 22.3627C29.4607 23.4953 29.4078 25.9236 30.9978 27.3C31.1567 27.4362 31.2879 27.5329 31.4106 27.612C31.8747 27.3934 32.4036 27.1722 33.0124 26.9746C34.0407 26.6408 34.8958 26.4684 35.5988 26.3768C35.9351 26.0009 36.3261 25.3392 36.2286 24.141C36.0957 22.5157 34.8639 22.7738 35.7896 21.8935Z" fill="#632CA6"/>
-</g>
-<defs>
-<clipPath id="clip0_17025_11966">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17025_11966)"><path fill="#632ca6" fill-rule="evenodd" d="m58.705 51.122-5.99-3.95-4.997 8.346-5.812-1.7-5.117 7.811.262 2.459 27.823-5.127-1.616-17.384zm-25.947-7.495 4.464-.614c.722.325 1.225.449 2.09.669 1.35.351 2.91.688 5.223-.477.538-.266 1.66-1.291 2.112-1.876l18.29-3.318 1.866 22.582-31.334 5.647zm33.974-8.137-1.805.344L61.458 0 2.36 6.853l7.28 59.083 6.918-1.004c-.552-.789-1.412-1.743-2.881-2.965-2.038-1.692-1.317-4.567-.115-6.382 1.59-3.068 9.782-6.966 9.318-11.869-.167-1.782-.45-4.103-2.105-5.693-.062.66.05 1.296.05 1.296s-.68-.867-1.019-2.05c-.336-.453-.6-.597-.957-1.203-.255.7-.221 1.513-.221 1.513s-.556-1.313-.646-2.421c-.33.496-.413 1.438-.413 1.438s-.722-2.07-.558-3.185c-.33-.97-1.306-2.896-1.03-7.272 1.804 1.264 5.774.963 7.321-1.317.514-.755.866-2.817-.256-6.879-.72-2.605-2.505-6.483-3.2-7.955l-.083.06c.366 1.185 1.122 3.671 1.412 4.876.878 3.655 1.113 4.927.701 6.612-.35 1.465-1.191 2.423-3.323 3.495-2.131 1.074-4.96-1.54-5.139-1.685-2.07-1.65-3.672-4.342-3.851-5.65-.186-1.43.824-2.29 1.334-3.46-.73.209-1.542.579-1.542.579s.97-1.004 2.167-1.873a13 13 0 0 0 1.308-.97c-.756-.013-1.37.009-1.37.009s1.26-.681 2.567-1.177c-.956-.042-1.87-.007-1.87-.007s2.812-1.258 5.034-2.181c1.527-.626 3.02-.441 3.858.771 1.1 1.588 2.257 2.451 4.707 2.986 1.504-.667 1.962-1.01 3.852-1.525 1.664-1.83 2.97-2.066 2.97-2.066s-.648.594-.821 1.528c.943-.743 1.978-1.364 1.978-1.364s-.4.495-.774 1.28l.087.129c1.1-.66 2.394-1.18 2.394-1.18s-.37.467-.803 1.072c.83-.006 2.513.036 3.166.11 3.857.084 4.657-4.12 6.137-4.647 1.853-.662 2.682-1.062 5.84 2.04 2.71 2.663 4.827 7.43 3.776 8.497-.881.887-2.62-.345-4.547-2.748a10.4 10.4 0 0 1-2.15-4.686c-.304-1.613-1.488-2.549-1.488-2.549s.687 1.529.687 2.88c0 .737.093 3.494 1.275 5.04-.117.227-.172 1.12-.301 1.29-1.376-1.662-4.33-2.851-4.811-3.202 1.63 1.336 5.378 4.405 6.817 7.346 1.362 2.782.56 5.331 1.248 5.991.196.19 2.928 3.593 3.453 5.303.917 2.981.055 6.113-1.145 8.056l-3.35.522c-.49-.136-.821-.204-1.261-.459.242-.429.724-1.498.729-1.718l-.19-.333c-1.042 1.478-2.789 2.912-4.24 3.736-1.9 1.076-4.09.91-5.514.47-4.046-1.248-7.87-3.982-8.793-4.7 0 0-.029.574.145.702 1.02 1.15 3.357 3.231 5.615 4.682l-4.814.53 2.276 17.723c-1.009.144-1.166.215-2.271.372-.974-3.44-2.836-5.686-4.872-6.994-1.795-1.154-4.271-1.413-6.642-.944l-.152.176c1.648-.171 3.594.068 5.593 1.333 1.961 1.24 3.542 4.444 4.124 6.373.745 2.465 1.26 5.102-.745 7.897-1.427 1.987-5.592 3.085-8.957.71.898 1.445 2.113 2.627 3.749 2.85 2.428.33 4.733-.092 6.32-1.72 1.354-1.393 2.072-4.305 1.883-7.371l2.143-.311.774 5.504 35.481-4.273zM45.146 20.543c-.1.226-.255.374-.022 1.11l.015.042.037.095.097.22c.422.861.884 1.674 1.657 2.088q.3-.05.621-.067c.726-.032 1.184.083 1.475.24.026-.145.032-.357.016-.669-.056-1.09.216-2.945-1.88-3.922-.791-.367-1.901-.253-2.271.205a1 1 0 0 1 .175.038c.559.196.18.389.08.62M51.02 30.72c-.275-.152-1.56-.092-2.462.016-1.72.202-3.578.8-3.985 1.117-.74.572-.404 1.57.143 1.979 1.533 1.145 2.876 1.913 4.295 1.726.87-.114 1.639-1.493 2.183-2.745.372-.861.372-1.791-.174-2.093m-15.23-8.826c.485-.46-2.417-1.066-4.669.47-1.66 1.132-1.713 3.56-.123 4.937.159.136.29.233.413.312.464-.219.993-.44 1.601-.637a14.3 14.3 0 0 1 2.587-.598c.336-.376.727-1.038.63-2.236-.133-1.625-1.365-1.367-.44-2.247" clip-rule="evenodd"/></g><defs><clipPath id="clip0_17025_11966"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/dealhub.svg b/web/packages/design/src/ResourceIcon/assets/dealhub.svg
index 9b9709ea4e5a2..0366e524476fd 100644
--- a/web/packages/design/src/ResourceIcon/assets/dealhub.svg
+++ b/web/packages/design/src/ResourceIcon/assets/dealhub.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7178)">
-<path d="M55.8815 56.0608C61.1898 50.8613 64.249 43.7885 64.4028 36.3596H72C71.8993 45.8412 68.0622 54.9002 61.3218 61.5694C54.5814 68.2386 45.4821 71.9794 36 71.9794C26.5179 71.9794 17.4186 68.2386 10.6782 61.5694C3.93783 54.9002 0.100659 45.8412 0 36.3596V36.0289C0.000251098 30.8176 1.13159 25.6685 3.31588 20.9371C5.50017 16.2057 8.68538 12.0047 12.6515 8.62434C16.6177 5.24395 21.2703 2.76468 26.2881 1.35773C31.3058 -0.049219 36.5692 -0.350322 41.7146 0.475215V8.1982C37.5871 7.3578 33.3244 7.44509 29.2348 8.45377C25.1451 9.46245 21.3307 11.3673 18.0674 14.0306C14.804 16.6939 12.1732 20.0491 10.3653 23.8536C8.55736 27.658 7.61741 31.8167 7.61343 36.0289V36.3596C7.76725 43.7885 10.8264 50.8613 16.1347 56.0608C21.443 61.2603 28.5776 64.1724 36.0081 64.1724C43.4386 64.1724 50.5733 61.2603 55.8815 56.0608Z" fill="#F24D4A"/>
-<path d="M27.328 44.9359C29.6441 47.2024 32.7535 48.4748 35.9937 48.4823C39.0871 48.4761 42.0674 47.3172 44.3524 45.2314C46.6414 43.142 48.0678 40.2731 48.3519 37.1869H48.4047V2.64551C50.904 3.63364 53.2762 4.91742 55.4704 6.46947V36.3268C55.4005 41.2531 53.467 45.9701 50.0591 49.5282C46.6512 53.0863 42.0219 55.2213 37.1032 55.5034H37.0281C36.6832 55.5223 36.3377 55.5318 35.9915 55.5318H35.8272C30.7388 55.4831 25.871 53.4475 22.2627 49.8594C18.6545 46.2712 16.5917 41.4148 16.5146 36.3268V36.0529C16.5227 30.8967 18.572 25.9534 22.2146 22.3039C25.8573 18.6544 30.7967 16.5958 35.9529 16.5781H35.9996C37.8113 16.5793 39.614 16.834 41.3552 17.3348V24.8732C39.6842 24.07 37.8536 23.654 35.9996 23.656H35.6629C35.6257 23.656 35.5886 23.6555 35.5521 23.6551C35.4809 23.6542 35.4121 23.6533 35.3504 23.656C35.2921 23.6585 35.2346 23.6634 35.1725 23.6687C35.1351 23.6719 35.0961 23.6753 35.0543 23.6783C35.0267 23.6803 34.9974 23.6823 34.9676 23.6844C34.8769 23.6906 34.7822 23.697 34.7195 23.7047C34.6902 23.7083 34.6608 23.7134 34.6315 23.7184C34.5777 23.7278 34.5238 23.7371 34.47 23.7371C34.4317 23.7421 34.3936 23.7468 34.3556 23.7516C34.2689 23.7624 34.1828 23.7731 34.0968 23.7858L33.8939 23.8203C33.851 23.8282 33.8075 23.8359 33.7636 23.8437C33.6725 23.8598 33.5799 23.8762 33.4882 23.8954L33.3299 23.9319C33.1818 23.9643 33.0337 23.9968 32.8877 24.0353L32.7518 24.0739C32.7121 24.0852 32.6722 24.0963 32.6323 24.1074C32.5215 24.1384 32.4103 24.1694 32.3014 24.2037L32.1614 24.2504C32.1348 24.2592 32.1083 24.268 32.0818 24.2768C31.9629 24.3163 31.8451 24.3553 31.7273 24.3985L31.5529 24.4674C31.5184 24.4809 31.484 24.4942 31.4496 24.5075C31.3544 24.5443 31.2598 24.5808 31.1674 24.6196L30.9159 24.7332C30.8727 24.7538 30.8258 24.7744 30.7779 24.7954C30.7266 24.8179 30.6741 24.8409 30.6237 24.8651C30.5095 24.9204 30.3982 24.9788 30.2861 25.0376C30.2668 25.0477 30.2475 25.0578 30.2282 25.0679L30.1064 25.1409C28.1382 26.2065 26.4942 27.7838 25.348 29.7062C24.2018 31.6286 23.596 33.8249 23.5946 36.0631V36.3369C23.6692 39.5806 25.009 42.6666 27.328 44.9359Z" fill="#F24D4A"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7178">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#f24d4a" clip-path="url(#clip0_15936_7178)"><path d="M55.882 56.06a28.4 28.4 0 0 0 8.52-19.7H72a36.002 36.002 0 0 1-72 0v-.331A36.01 36.01 0 0 1 41.715.475v7.723a28.43 28.43 0 0 0-34.102 27.83v.332a28.4 28.4 0 0 0 48.269 19.7"/><path d="M27.328 44.936a12.43 12.43 0 0 0 8.666 3.546 12.435 12.435 0 0 0 12.358-11.295h.053V2.646a33.7 33.7 0 0 1 7.065 3.823v29.858a19.485 19.485 0 0 1-18.367 19.176h-.075q-.517.03-1.036.029h-.165a19.5 19.5 0 0 1-19.312-19.205v-.274a19.506 19.506 0 0 1 19.438-19.475H36c1.811.001 3.614.256 5.355.757v7.538A12.3 12.3 0 0 0 36 23.656h-.447q-.108-.004-.203 0l-.178.013-.118.01-.086.005c-.091.007-.186.013-.249.02l-.087.014a1 1 0 0 1-.162.02l-.114.014q-.13.015-.26.034l-.202.034-.13.024a9 9 0 0 0-.276.051l-.158.037q-.223.047-.442.103l-.136.039-.12.033q-.166.046-.33.097l-.14.046-.08.027q-.179.058-.355.121l-.174.07-.103.04q-.144.054-.283.112l-.251.113-.138.062q-.078.034-.154.07-.17.084-.338.173l-.058.03-.122.073a12.43 12.43 0 0 0-6.511 10.922v.274a12.43 12.43 0 0 0 3.733 8.599"/></g><defs><clipPath id="clip0_15936_7178"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/deel-dark.svg b/web/packages/design/src/ResourceIcon/assets/deel-dark.svg
index a449f2b1f262a..48fcad9ddf0de 100644
--- a/web/packages/design/src/ResourceIcon/assets/deel-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/deel-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7187)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.9263 16.771C11.8894 16.771 0 25.0477 0 43.6731C0 63.3552 12.3482 70.5752 24.9305 70.5752C36.733 70.5752 41.8464 63.0832 41.8464 63.0832V69.2599H55.1999C54.8847 65.6252 54.7291 61.5489 54.7291 57.0317V2.00049H41.8422V24.3309C41.8422 24.3309 36.8248 16.771 24.9263 16.771ZM43.2458 43.6731C43.2458 53.7402 37.345 60.687 28.2178 60.687C19.3345 60.687 13.408 54.4179 13.408 43.6731C13.408 32.9283 19.095 26.6591 28.2178 26.6591C37.3408 26.6591 43.2458 33.2536 43.2458 43.6731ZM72.0001 57.1802H59.5859V69.218H72.0001V57.1802Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7187">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_7187)"><path fill="#fff" fill-rule="evenodd" d="M24.926 16.771C11.89 16.771 0 25.048 0 43.673c0 19.682 12.348 26.902 24.93 26.902 11.803 0 16.916-7.492 16.916-7.492v6.177H55.2q-.471-5.453-.47-12.228V2H41.841v22.33s-5.017-7.559-16.916-7.559m18.32 26.902c0 10.067-5.901 17.014-15.028 17.014-8.884 0-14.81-6.27-14.81-17.014s5.687-17.014 14.81-17.014 15.028 6.595 15.028 17.014M72 57.18H59.586v12.038H72z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15936_7187"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/deel-light.svg b/web/packages/design/src/ResourceIcon/assets/deel-light.svg
index 4546d5e4db918..2616de7dfed2d 100644
--- a/web/packages/design/src/ResourceIcon/assets/deel-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/deel-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15936_7187)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.9263 16.771C11.8894 16.771 0 25.0477 0 43.6731C0 63.3552 12.3482 70.5752 24.9305 70.5752C36.733 70.5752 41.8464 63.0832 41.8464 63.0832V69.2599H55.1999C54.8847 65.6252 54.7291 61.5489 54.7291 57.0317V2.00049H41.8422V24.3309C41.8422 24.3309 36.8248 16.771 24.9263 16.771ZM43.2458 43.6731C43.2458 53.7402 37.345 60.687 28.2178 60.687C19.3345 60.687 13.408 54.4179 13.408 43.6731C13.408 32.9283 19.095 26.6591 28.2178 26.6591C37.3408 26.6591 43.2458 33.2536 43.2458 43.6731ZM72.0001 57.1802H59.5859V69.218H72.0001V57.1802Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15936_7187">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15936_7187)"><path fill="#000" fill-rule="evenodd" d="M24.926 16.771C11.89 16.771 0 25.048 0 43.673c0 19.682 12.348 26.902 24.93 26.902 11.803 0 16.916-7.492 16.916-7.492v6.177H55.2q-.471-5.453-.47-12.228V2H41.841v22.33s-5.017-7.559-16.916-7.559m18.32 26.902c0 10.067-5.901 17.014-15.028 17.014-8.884 0-14.81-6.27-14.81-17.014s5.687-17.014 14.81-17.014 15.028 6.595 15.028 17.014M72 57.18H59.586v12.038H72z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15936_7187"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/desktop.svg b/web/packages/design/src/ResourceIcon/assets/desktop.svg
index 8d3cd3748fc4a..1b18c5aa4ad3a 100644
--- a/web/packages/design/src/ResourceIcon/assets/desktop.svg
+++ b/web/packages/design/src/ResourceIcon/assets/desktop.svg
@@ -1,141 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7996_40513)">
-<g opacity="0.2">
-<path opacity="0.2" d="M66.5296 29.653L66.4306 64.5298C66.4306 65.041 66.0688 65.248 65.6224 64.9906L48.0634 54.853L37.0006 48.4504L18.421 37.7404C17.9764 37.483 17.6182 36.862 17.6182 36.3508L17.7172 1.47401C17.7172 0.962812 18.079 0.757611 18.5236 1.01321L65.725 28.2616C66.1696 28.519 66.5296 29.14 66.5278 29.6512L66.5296 29.653Z" fill="#4C7F8E"/>
-</g>
-<g filter="url(#filter0_ddd_7996_40513)">
-<path d="M27.8398 56.1601V52.5601L38.9998 58.9501V62.6401L27.8398 56.1601Z" fill="#C7D5DB"/>
-<path d="M27.8398 56.1602L25.5898 57.4202L41.4298 66.6002L38.9998 62.6402L27.8398 56.1602Z" fill="url(#paint0_linear_7996_40513)"/>
-<path d="M41.43 66.6L44.76 64.62C44.76 64.62 45.75 65.61 45.39 66.15C45.03 66.69 42.33 68.4 41.7 68.4C41.07 68.4 25.68 59.22 25.68 59.22C25.23 58.95 25.05 58.41 25.05 58.41C25.05 58.41 24.6 57.69 25.32 57.33L28.11 55.71L27.84 56.16L25.59 57.42L41.43 66.6Z" fill="#5E2AD8"/>
-<path d="M42.33 60.6602L44.76 64.6202L41.43 66.6002L39 62.6402L42.33 60.6602Z" fill="#EFF1F3"/>
-<path d="M42.33 60.6598V58.5898H39V62.6398L42.33 60.6598Z" fill="#83A2AC"/>
-<path d="M60.5715 31.7735L60.4725 66.6503C60.4725 66.9041 60.3807 67.0841 60.2367 67.1669L56.9607 69.0713C57.1065 68.9885 57.1947 68.8085 57.1965 68.5547L57.2955 33.6779C57.2973 33.1667 56.9373 32.5439 56.4927 32.2883L9.2931 5.03634C9.0699 4.90674 8.8665 4.89414 8.7207 4.98054L11.9967 3.07614C12.1425 2.98974 12.3459 3.00234 12.5691 3.13194L59.7687 30.3839C60.2133 30.6413 60.5733 31.2623 60.5715 31.7735Z" fill="#EFF1F3"/>
-<path d="M29.5971 47.8978C29.6547 47.9302 29.7015 48.0112 29.7015 48.0778V48.9652C29.6979 49.0318 29.6511 49.0588 29.5935 49.0246L28.6161 48.4594C28.5585 48.427 28.5117 48.346 28.5117 48.2794V47.392C28.5153 47.3272 28.5621 47.3002 28.6197 47.3326L29.5971 47.8978Z" fill="white"/>
-<path d="M31.5229 49.0101C31.5805 49.0425 31.6273 49.1235 31.6273 49.1901V50.0775C31.6237 50.1441 31.5769 50.1711 31.5211 50.1369L30.5419 49.5717C30.4843 49.5393 30.4375 49.4583 30.4375 49.3917V48.5043C30.4411 48.4395 30.4879 48.4125 30.5437 48.4449L31.5229 49.0101Z" fill="#F4F6F7"/>
-<path d="M13.9423 37.8789L13.9333 40.9137L10.5907 38.9841C10.2523 38.7879 9.97868 38.3145 9.98048 37.9257L9.98588 35.5947L13.9423 37.8789Z" fill="#98B3BC"/>
-<path d="M27.4711 45.6893L55.8121 62.0531L55.8049 64.3193C55.8049 64.7459 55.5007 64.9187 55.1299 64.7045L10.6537 39.0221C10.2451 38.7863 9.97868 38.3255 9.98048 37.9475C9.98048 38.3129 10.2523 38.7863 10.5907 38.9807L13.9333 40.9103L13.9423 37.8755L13.9387 40.9139L27.4639 48.7223L27.4729 45.6875L27.4711 45.6893ZM29.6995 48.9671V48.0797C29.7031 48.0149 29.6563 47.9339 29.5987 47.8997L28.6213 47.3345C28.5637 47.3021 28.5169 47.3273 28.5169 47.3939V48.2813C28.5133 48.3479 28.5601 48.4289 28.6177 48.4613L29.5951 49.0265C29.6527 49.0589 29.6995 49.0337 29.6995 48.9671ZM31.6237 50.0795V49.1921C31.6273 49.1273 31.5805 49.0463 31.5229 49.0121L30.5437 48.4469C30.4861 48.4145 30.4393 48.4415 30.4393 48.5063V49.3937C30.4357 49.4603 30.4825 49.5413 30.5401 49.5737L31.5193 50.1389C31.5769 50.1713 31.6237 50.1443 31.6237 50.0795Z" fill="#C8D6DC"/>
-<path d="M48.0941 58.5569C48.1242 58.5785 48.1492 58.6069 48.1672 58.6401C48.1852 58.6733 48.1956 58.7103 48.1978 58.7483V59.6803C48.1978 59.7469 48.1499 59.7802 48.0941 59.7469L47.1134 59.1478C47.0825 59.1291 47.0567 59.1025 47.0386 59.0704C47.0204 59.0384 47.0105 59.0019 47.0098 58.9647V58.041C47.0098 57.9661 47.0576 57.9411 47.1134 57.9744L48.0941 58.5569Z" fill="white"/>
-<path d="M53.8666 61.8588C53.8988 61.8798 53.9255 61.9081 53.9445 61.9414C53.9635 61.9746 53.9742 62.0118 53.9758 62.05V62.9811C53.9758 63.0476 53.9254 63.0725 53.8666 63.0392L52.825 62.449C52.7928 62.428 52.7661 62.3997 52.7471 62.3664C52.7282 62.3332 52.7174 62.296 52.7158 62.2578V61.3268C52.7158 61.2603 52.7662 61.2353 52.825 61.2686L53.8666 61.8588Z" fill="#5E2AD8"/>
-<path d="M50.0215 59.6772C50.0533 59.6943 50.0799 59.7205 50.0981 59.7527C50.1163 59.785 50.1254 59.8219 50.1245 59.8593V60.7863C50.1245 60.8608 50.0769 60.8856 50.0215 60.8525L49.0474 60.2649C49.016 60.2443 48.9896 60.2165 48.9704 60.1834C48.9511 60.1504 48.9395 60.1131 48.9365 60.0745V59.1475C48.9365 59.073 48.984 59.0482 49.0395 59.0813L50.0215 59.6772Z" fill="#F4F6F7"/>
-<path d="M51.9408 60.7631C51.9746 60.7823 52.0026 60.8102 52.0218 60.8438C52.041 60.8773 52.0507 60.9154 52.05 60.9539V61.8831C52.05 61.9494 51.9996 61.9743 51.9408 61.9411L50.9076 61.3521C50.8739 61.3321 50.8455 61.3042 50.8251 61.271C50.8046 61.2378 50.7926 61.2001 50.79 61.1613V60.2321C50.79 60.1658 50.8404 60.1326 50.8992 60.1741L51.9408 60.7631Z" fill="#E4EAED"/>
-<path d="M13.9455 37.8809L27.4707 45.6893L27.4617 48.7241L13.9365 40.9157L13.9455 37.8809ZM16.2297 41.3891L16.2333 40.1057C16.2333 40.0211 16.1739 39.9167 16.1001 39.8753L14.9841 39.2309C14.9103 39.1877 14.8509 39.2219 14.8509 39.3065L14.8473 40.5899C14.8473 40.6745 14.9067 40.7771 14.9805 40.8203L16.0965 41.4647C16.1703 41.5061 16.2297 41.4719 16.2297 41.3891Z" fill="#D3DEE3"/>
-<path d="M16.1005 39.875C16.1743 39.9164 16.2337 40.0208 16.2337 40.1054L16.2301 41.3888C16.2301 41.4734 16.1689 41.5076 16.0969 41.4644L14.9809 40.82C14.9071 40.7768 14.8477 40.6742 14.8477 40.5896L14.8513 39.3062C14.8513 39.2216 14.9125 39.1874 14.9845 39.2306L16.1005 39.875Z" fill="white"/>
-<path d="M55.8917 34.1492L55.8125 62.051L27.4715 45.689L13.9463 37.8806L9.98633 35.5946L10.0655 7.69103C10.0673 7.26443 10.3715 7.09163 10.7441 7.30583L55.2203 32.9846C55.5911 33.1988 55.8953 33.7226 55.8917 34.1492Z" fill="white"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M55.8917 34.1492L55.8125 62.051L27.4715 45.689L13.9463 37.8806L9.98633 35.5946L10.0655 7.69103C10.0673 7.26443 10.3715 7.09163 10.7441 7.30583L55.2203 32.9846C55.5911 33.1988 55.8953 33.7226 55.8917 34.1492Z" fill="url(#paint1_linear_7996_40513)"/>
-</g>
-<path d="M10.7441 7.30626L14.0201 5.40186L58.4963 31.0807L55.2203 32.9851L10.7441 7.30626Z" fill="white"/>
-<path d="M37.1914 55.5295C37.351 55.6352 37.4839 55.777 37.5792 55.9437C37.6746 56.1103 37.7299 56.2972 37.7405 56.4892C37.7405 56.8438 37.4919 56.9794 37.1914 56.8021L29.1097 52.1081C28.9495 52.0031 28.8162 51.8614 28.7208 51.6946C28.6253 51.5278 28.5704 51.3407 28.5605 51.1484C28.5605 50.8042 28.8092 50.6582 29.12 50.8355L37.1914 55.5295Z" fill="white"/>
-<path d="M56.5843 32.333L9.38474 5.08285C8.94014 4.82545 8.57834 5.03245 8.57654 5.54365L8.47754 40.4204C8.47754 40.9316 8.83574 41.5544 9.28034 41.8118L27.8581 52.5236L38.9209 58.9262L56.4799 69.0639C56.9245 69.3213 57.2863 69.1143 57.2881 68.6031L57.3871 33.7262C57.3871 33.215 57.0289 32.5922 56.5843 32.3366V32.333ZM36.6133 56.2802L30.4393 52.7162C30.2071 52.5812 30.0181 52.2537 30.0181 51.9873C30.0181 51.7209 30.2089 51.611 30.4411 51.746L36.6151 55.3118C36.8473 55.445 37.0363 55.7744 37.0363 56.0408C37.0363 56.3072 36.8455 56.417 36.6133 56.282V56.2802ZM55.8121 62.0546L55.8049 64.3208C55.8049 64.7474 55.5007 64.9202 55.1281 64.7043L10.5727 38.9768C10.2433 38.786 9.97874 38.327 9.97874 37.8573L10.0651 7.69105C10.0651 7.26445 10.3711 7.09165 10.7419 7.30585L55.2181 32.9846C55.5889 33.1988 55.8931 33.7226 55.8913 34.1492L55.8121 62.051" fill="#EFF1F3"/>
-<path d="M56.5843 32.333L9.38474 5.08285C8.94014 4.82545 8.57834 5.03245 8.57654 5.54365L8.47754 40.4204C8.47754 40.9316 8.83574 41.5544 9.28034 41.8118L27.8581 52.5236L38.9209 58.9262L56.4799 69.0639C56.9245 69.3213 57.2863 69.1143 57.2881 68.6031L57.3871 33.7262C57.3871 33.215 57.0289 32.5922 56.5843 32.3366V32.333ZM55.8121 62.0546L55.8049 64.3208C55.8049 64.7474 55.5007 64.9202 55.1281 64.7043L10.5727 38.9768C10.2433 38.786 9.97874 38.327 9.97874 37.8573L10.0651 7.69105C10.0651 7.26445 10.3711 7.09165 10.7419 7.30585L55.2181 32.9846C55.5889 33.1988 55.8931 33.7226 55.8913 34.1492L55.8121 62.051" fill="url(#paint2_radial_7996_40513)"/>
-<path d="M10.6534 39.0237C10.6282 39.0093 10.6048 38.9913 10.5796 38.9751L10.5742 38.9787L28.711 49.4511L10.6534 39.0255V39.0237ZM29.6686 49.0335C29.6686 49.0335 29.6506 49.0389 29.6416 49.0389C29.6506 49.0389 29.6614 49.0389 29.6686 49.0335ZM29.6344 49.0407C29.6218 49.0407 29.6074 49.0353 29.593 49.0263C29.6074 49.0353 29.6218 49.0389 29.6344 49.0407ZM11.7712 38.2803L11.1358 38.6493L11.7694 39.1173V38.2803H11.7712ZM53.9434 63.0537C53.9434 63.0537 53.9326 63.0537 53.929 63.0573C53.9344 63.0573 53.9398 63.0573 53.9434 63.0537ZM52.0192 61.9431C52.0192 61.9431 52.0066 61.9467 51.9994 61.9467C52.0066 61.9467 52.0138 61.9467 52.0192 61.9431ZM51.985 61.9503C51.9724 61.9503 51.958 61.9449 51.9436 61.9359C51.958 61.9449 51.9724 61.9485 51.985 61.9503ZM52.0498 61.8747L51.9454 61.9359C51.9796 61.9161 52.0156 61.8945 52.0498 61.8747ZM50.0608 60.8379C50.0482 60.8379 50.0338 60.8325 50.0194 60.8235C50.0338 60.8325 50.0482 60.8361 50.0608 60.8379ZM50.0932 60.8307C50.0932 60.8307 50.077 60.8361 50.068 60.8361C50.077 60.8361 50.086 60.8361 50.0932 60.8307ZM48.169 59.7201C48.16 59.7255 48.1474 59.7273 48.1366 59.7273C48.1492 59.7273 48.16 59.7273 48.169 59.7201ZM31.5946 50.1441C31.5856 50.1495 31.573 50.1513 31.5622 50.1513C31.5748 50.1513 31.5856 50.1513 31.5946 50.1441ZM53.659 61.7955L53.3854 61.9539C53.4754 61.9017 53.5672 61.8495 53.659 61.7955ZM47.8846 58.4619L47.6902 58.5753C47.755 58.5375 47.818 58.5015 47.8846 58.4619ZM47.0458 58.0137C47.0278 58.0245 47.0152 58.0479 47.0152 58.0803C47.0152 58.0479 47.026 58.0245 47.0458 58.0137Z" fill="#EFF1F3"/>
-<path d="M10.5928 38.9822L10.6108 38.993C10.6108 38.993 10.6 38.9858 10.5946 38.9822H10.5928ZM11.7718 38.2964L11.1472 38.66L11.77 39.119V38.2964H11.7718Z" fill="#C8D6DC"/>
-<path d="M11.7711 38.2101L11.6236 38.1255L10.9521 38.5161L11.7694 39.1173L11.7711 38.2101Z" fill="#98B3BC"/>
-<path d="M9.38477 5.08311L12.6626 3.17871L59.8622 30.4289L56.5844 32.3333L9.38477 5.08311Z" fill="#EFF1F3"/>
-<path d="M60.5715 31.7735L60.4725 66.6503C60.4725 66.9041 60.3807 67.0841 60.2367 67.1669L56.9607 69.0713C57.1065 68.9885 57.1947 68.8085 57.1965 68.5547L57.2955 33.6779C57.2973 33.1667 56.9373 32.5439 56.4927 32.2883L9.2931 5.03634C9.0699 4.90674 8.8665 4.89414 8.7207 4.98054L11.9967 3.07614C12.1425 2.98974 12.3459 3.00234 12.5691 3.13194L59.7687 30.3839C60.2133 30.6413 60.5733 31.2623 60.5715 31.7735Z" fill="#5E2AD8"/>
-<path d="M60.5715 31.7032L60.4725 66.58C60.4725 66.8338 60.3807 67.0138 60.2367 67.0966L56.9607 69.001C57.1065 68.9182 57.1947 68.7382 57.1965 68.4844L57.2955 33.6076C57.2973 33.0964 56.9373 32.4736 56.4927 32.218L9.2931 4.96602C9.0699 4.83642 8.8665 4.82382 8.7207 4.91022L11.9967 3.00582C12.1425 2.91942 12.3459 2.93202 12.5691 3.06162L59.7687 30.3118C60.2133 30.5692 60.5733 31.1902 60.5715 31.7014V31.7032Z" fill="url(#paint3_radial_7996_40513)"/>
-<path d="M13.01 20.4998L13.9928 21.9506L13.982 25.5146V26.3516L13.5536 25.7396L13.5572 24.701C13.5572 24.6254 13.505 24.5336 13.4384 24.494L13.001 24.242L13.0118 20.498L13.01 20.4998Z" fill="#E6EAEC"/>
-<path d="M13.4369 24.4979C13.5035 24.5357 13.5575 24.6293 13.5557 24.7049L13.5521 25.7435V26.2061C13.5521 26.2817 13.4963 26.3123 13.4297 26.2745L12.1247 25.5203C12.0581 25.4825 12.0041 25.3889 12.0059 25.3133L12.0095 23.8121C12.0095 23.7365 12.0635 23.7059 12.1301 23.7437L12.9977 24.2441L13.4351 24.4961L13.4369 24.4979Z" fill="#5E2AD8"/>
-<path d="M15.7358 22.0734L15.7268 25.4124C15.7898 25.5564 15.8528 25.7022 15.914 25.8462C15.9104 26.109 15.9068 26.3718 15.9032 26.6346C15.2624 26.262 14.6216 25.8894 13.9808 25.5168L13.9916 21.9528L13.0088 20.502L15.734 22.0752L15.7358 22.0734Z" fill="#B0C4C9"/>
-<path d="M13.5072 32.733C13.5738 32.7708 13.6278 32.8644 13.626 32.94L13.6224 33.9786V34.4412C13.6224 34.5168 13.5666 34.5474 13.5 34.5096L12.195 33.7554C12.1284 33.7176 12.0744 33.624 12.0762 33.5484L12.0798 32.049C12.0798 31.9734 12.1338 31.9428 12.2004 31.9806L13.068 32.481L13.5054 32.733H13.5072Z" fill="#5E2AD8"/>
-<path d="M16.5958 34.747V35.0296L14.5762 33.8632V33.5806L16.5958 34.747Z" fill="#B0C4C9"/>
-<path d="M13.0803 28.7367L14.0631 30.1875L14.0523 33.7569V34.5885L13.6239 33.9765L13.6275 32.9379C13.6275 32.8623 13.5735 32.7687 13.5087 32.7309L13.0713 32.4789L13.0821 28.7349L13.0803 28.7367Z" fill="#E6EAEC"/>
-<path d="M16.5977 34.2935L16.5959 34.5761L14.5781 33.4097V33.1289L16.5977 34.2935Z" fill="#B0C4C9"/>
-<path d="M16.0482 32.1551V32.2955L14.583 31.4495V31.3091L16.0482 32.1551Z" fill="#B0C4C9"/>
-<path d="M16.1605 32.4503L16.7851 32.8103L16.7779 35.6651L14.4307 34.3097V33.9785L14.4415 30.6953L15.8041 31.4819L16.1641 31.6907V32.4503H16.1605ZM16.5961 34.1243V33.3701L14.5801 32.2037V32.9579L16.5961 34.1243ZM16.5943 35.0297V34.7471L14.5765 33.5807V33.8633L16.5943 35.0297ZM16.5943 34.5761V34.2935L14.5765 33.1271V33.4097L16.5943 34.5761ZM16.5979 33.1919V32.9093L14.5801 31.7429V32.0255L16.5979 33.1919ZM14.5801 31.3091V31.4495L16.0453 32.2955V32.1551L14.5801 31.3091Z" fill="#E6EAEC"/>
-<path d="M16.5995 33.37L16.5977 34.1224L14.5781 32.9578L14.5817 32.2036L16.5995 33.37Z" fill="#B0C4C9"/>
-<path d="M16.6016 32.9092L16.5998 33.1918L14.582 32.0254V31.7446L16.6016 32.9092Z" fill="#B0C4C9"/>
-<path d="M16.162 31.6904L16.7848 32.81L16.1602 32.45L16.162 31.6904Z" fill="#B0C4C9"/>
-<path d="M15.8053 30.31L15.8017 31.4818L14.4391 30.6952L14.4301 33.9802L14.0521 33.757L14.0611 30.1876L13.0801 28.7368L15.8053 30.31Z" fill="#B0C4C9"/>
-<path d="M12.8861 11.9048L16.3691 15.1808L16.3601 18.1454L12.8789 14.873L12.8861 11.9048Z" fill="#5E2AD8"/>
-<path d="M12.4634 15.5319L15.4532 18.4245L15.3182 18.4173L14.1212 18.3507L11.2016 15.4905L11.0576 15.3501L12.4634 15.5319Z" fill="#E6EAEC"/>
-<path d="M11.0575 15.3501L11.2015 15.4905L14.1211 18.3507L15.3181 18.4173L15.4531 18.4245V18.5469L14.1211 18.4731L11.0557 15.4725L11.0575 15.3501Z" fill="#B0C4C9"/>
-<path d="M14.5223 16.4932L15.4565 17.3716V17.4166C15.4565 17.5048 15.3935 17.5408 15.3161 17.4958L14.6591 17.116C14.5817 17.071 14.5205 16.963 14.5205 16.8766V16.4932H14.5223Z" fill="#E6EAEC"/>
-<path d="M14.521 16.7396V16.8764C14.521 16.9646 14.5822 17.0726 14.6596 17.1158L15.3166 17.4956C15.394 17.5406 15.4552 17.5046 15.457 17.4164V17.3714L16.0942 17.9708C16.0438 18.1022 15.5344 17.9366 14.9152 17.5784C14.2618 17.2022 13.7326 16.754 13.7344 16.5812C13.7344 16.4444 14.0638 16.5182 14.5228 16.7396H14.521Z" fill="#B0C4C9"/>
-<path d="M12.7981 11.7466L16.4575 15.1882L16.4485 18.304L16.0921 17.9692L15.4549 17.3698L14.5207 16.4914L12.7891 14.8642L12.7981 11.7466ZM16.3603 18.1456L16.3693 15.1792L12.8863 11.905L12.8773 14.8714L16.3603 18.1456Z" fill="#E6EAEC"/>
-<path d="M13.0859 11.8312L16.6535 15.1972L16.6445 18.3112L16.4483 18.304L16.4573 15.1882L12.7979 11.7466L13.0859 11.8312Z" fill="#B0C4C9"/>
-<path d="M22.1332 21.3225C22.1998 21.3603 22.252 21.4521 22.252 21.5277L22.2483 22.5645V23.0271C22.2483 23.1027 22.1926 23.1333 22.1278 23.0955L20.8209 22.3413C20.7543 22.3035 20.7021 22.2117 20.7021 22.1361L20.7057 20.6349C20.7057 20.5593 20.7597 20.5287 20.8263 20.5665L21.694 21.0669L22.1313 21.3189L22.1332 21.3225Z" fill="#5E2AD8"/>
-<path d="M21.7061 17.3247L21.8681 17.5641L22.6871 18.7755L22.6763 22.5087V23.1765L22.2479 22.5645L22.2515 21.5277C22.2515 21.4521 22.1993 21.3603 22.1327 21.3225L21.6953 21.0705L21.7061 17.3265V17.3247Z" fill="#E6EAEC"/>
-<path d="M24.4313 18.8979L24.4294 19.4703L22.2047 17.7405L22.2029 17.8917L21.8681 17.5479V17.5641L21.7061 17.3247L24.4313 18.8979Z" fill="#B0C4C9"/>
-<path d="M21.8682 17.5479L22.203 17.8917L23.8644 19.6017L23.8554 23.0451L23.8536 23.7291L22.6764 22.5087L22.6872 18.7755L21.8682 17.5641V17.5479Z" fill="#B0C4C9"/>
-<path d="M22.2049 17.7407L24.4297 19.4705L24.7879 19.7477L24.7771 23.8931L23.8555 23.0453L23.8645 19.6019L22.2031 17.8919L22.2049 17.7407Z" fill="#E6EAEC"/>
-<path d="M22.2456 27.0305L22.242 28.0727L23.1492 28.5965C23.1492 29.1743 22.7406 29.4065 22.2384 29.1167C21.7362 28.8269 21.333 28.1267 21.333 27.5489C21.333 26.9729 21.7416 26.7407 22.2438 27.0305H22.2456Z" fill="#E6EAEC"/>
-<path d="M23.3076 30.2236L24.9186 31.1542L24.9168 31.3468L23.3076 30.418V30.2236Z" fill="#5E2AD8"/>
-<path d="M22.2459 27.0303C22.7481 27.3201 23.1513 28.0203 23.1513 28.5963L22.2441 28.0725L22.2477 27.0303H22.2459Z" fill="#5E2AD8"/>
-<path d="M24.9228 29.3148L24.921 30.0132L23.8662 29.4048L23.868 28.7046L24.9228 29.3148Z" fill="#5E2AD8"/>
-<path d="M24.9245 28.7261L24.9227 29.3147L23.8679 28.7045L23.8661 29.4047L24.9209 30.0131L24.9191 30.6629L23.8643 30.0545L23.8661 29.6333V29.5397L23.8697 28.1177L24.9245 28.7261Z" fill="#E6EAEC"/>
-<path d="M25.3743 28.3571C25.4247 28.3859 25.4679 28.4579 25.4661 28.5173L25.4553 32.1335C25.4553 32.1929 25.4139 32.2163 25.3617 32.1857L20.9229 29.6225C20.8725 29.5937 20.8293 29.5217 20.8311 29.4623L20.8419 25.8461C20.8419 25.7867 20.8833 25.7633 20.9355 25.7921L25.3743 28.3553V28.3571ZM24.9225 29.3129V28.7243L23.8695 28.1159L23.8659 29.5379L23.5239 29.3399V28.7639L23.1513 28.5479V28.5947C23.1513 28.0187 22.7481 27.3185 22.2459 27.0287C21.7437 26.7389 21.3369 26.9711 21.3351 27.5471C21.3351 28.1249 21.7383 28.8251 22.2405 29.1149C22.7427 29.4047 23.1495 29.1725 23.1513 28.5947V28.6433L23.4429 28.8125V29.3885L23.8659 29.6333V30.0545L24.9207 30.6629V30.0131L24.9243 29.3129H24.9225ZM24.9189 31.3451V31.1525L23.3097 30.2237V30.0131L22.7985 29.7179V29.9285L21.4233 29.1347V29.3273L22.7967 30.1211V30.3047L23.3079 30.5999V30.4163L24.9189 31.3451Z" fill="#B0C4C9"/>
-<path d="M23.5258 28.7653L23.524 29.3413L23.866 29.5393V29.6329L23.4412 29.3881L23.443 28.8139L23.1514 28.6447V28.5493L23.5258 28.7653Z" fill="#5E2AD8"/>
-<path d="M21.4219 29.3288V29.1362L22.7971 29.9282V30.1226L21.4219 29.3288Z" fill="#5E2AD8"/>
-<path d="M23.3079 30.013V30.2236V30.418L23.3061 30.6016L22.7949 30.3064L22.7967 30.1228V29.9284V29.7178L23.3079 30.013Z" fill="#E6EAEC"/>
-<path d="M24.2946 36.3978V36.5544L23.04 35.829V35.6724L24.2946 36.3978Z" fill="#B0C4C9"/>
-<path d="M22.4637 35.0242C22.5321 35.0638 22.5861 35.1574 22.5861 35.2348L22.5807 36.8854C22.5807 36.9628 22.5249 36.9952 22.4583 36.9556L21.0453 36.1402C20.9769 36.1006 20.9229 36.007 20.9229 35.9296L20.9283 34.279C20.9283 34.2016 20.9841 34.1692 21.0507 34.2088L22.4637 35.0242Z" fill="#E6EAEC"/>
-<path d="M22.7155 34.8243C22.8073 34.8765 22.8811 35.0061 22.8811 35.1123L22.8739 37.3533C22.8739 37.4595 22.7983 37.5027 22.7065 37.4487L21.2035 36.5811L20.7877 36.3417C20.6959 36.2895 20.6221 36.1599 20.6221 36.0537L20.6293 33.8127C20.6293 33.7065 20.7049 33.6651 20.7967 33.7173L21.2125 33.9567L22.7155 34.8243ZM22.5787 36.8853L22.5841 35.2347C22.5841 35.1573 22.5301 35.0619 22.4617 35.0241L21.0487 34.2087C20.9803 34.1691 20.9263 34.2015 20.9263 34.2789L20.9209 35.9295C20.9209 36.0069 20.9749 36.1023 21.0433 36.1401L22.4563 36.9555C22.5247 36.9951 22.5787 36.9627 22.5787 36.8853Z" fill="#B0C4C9"/>
-<path d="M24.2927 37.1699V37.3265L23.0381 36.6029V36.4463L24.2927 37.1699Z" fill="#B0C4C9"/>
-<path d="M24.2945 36.7592L24.2927 36.9158L23.0381 36.1922L23.0399 36.0356L24.2945 36.7592Z" fill="#B0C4C9"/>
-<path d="M23.5925 34.0596L24.6239 35.811L23.5889 35.2134L23.5925 34.0596Z" fill="#B0C4C9"/>
-<path d="M23.5891 35.2132L24.6259 35.8108L24.6151 39.805L21.2041 37.8358L21.2077 36.5794L22.7107 37.447C22.8025 37.4992 22.8781 37.4578 22.8781 37.3516L22.8853 35.1106C22.8853 35.0044 22.8115 34.8766 22.7197 34.8226L21.2167 33.955L21.2203 32.686L23.5945 34.0576L23.5909 35.2114L23.5891 35.2132ZM24.2911 37.708V37.5514L23.0365 36.8278V36.9844L24.2911 37.708ZM24.2929 36.916V36.7594L23.0383 36.0358V36.1924L24.2929 36.916ZM24.2929 37.3264V37.1698L23.0383 36.4462V36.6028L24.2929 37.3264ZM24.2947 36.5524V36.3958L23.0401 35.6722V35.8288L24.2947 36.5524Z" fill="#E6EAEC"/>
-<path d="M24.2907 37.5511V37.7077L23.0361 36.9841V36.8257L24.2907 37.5511Z" fill="#B0C4C9"/>
-<path d="M41.1583 31.505L41.1349 39.7058L33.9961 35.5856L34.0195 27.3848L41.1583 31.505Z" fill="#C8D6DC"/>
-<path d="M48.7561 35.8936L48.7327 44.0926L41.5957 39.9724L41.6191 31.7734L48.7561 35.8936Z" fill="#C8D6DC"/>
-<path d="M41.1339 40.2369L41.1105 48.4377L33.9717 44.3157L33.9951 36.1167L41.1339 40.2369Z" fill="#C8D6DC"/>
-<path d="M48.7307 44.6236L48.7073 52.8244L41.5703 48.7042L41.5937 40.5034L48.7307 44.6236Z" fill="#C8D6DC"/>
-<path d="M11.8441 37.2073L11.8423 38.1631L11.0107 37.6825L11.0125 36.7285L11.8441 37.2073Z" fill="white"/>
-<path d="M12.7299 37.7185L12.7281 38.6743L11.8965 38.1937L11.8983 37.2397L12.7299 37.7185Z" fill="white"/>
-<path d="M11.842 38.2262L11.8384 39.1802L11.0068 38.7014L11.0104 37.7456L11.842 38.2262Z" fill="white"/>
-<path d="M12.7278 38.7374L12.7242 39.6932L11.8926 39.2126L11.8962 38.2568L12.7278 38.7374Z" fill="white"/>
-</g>
-</g>
-<defs>
-<filter id="filter0_ddd_7996_40513" x="-5.52246" y="-10.0493" width="80.0938" height="94.2236" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dy="1"/>
-<feGaussianBlur stdDeviation="7"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.12 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_7996_40513"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dy="5"/>
-<feGaussianBlur stdDeviation="4"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.14 0"/>
-<feBlend mode="normal" in2="effect1_dropShadow_7996_40513" result="effect2_dropShadow_7996_40513"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feMorphology radius="1" operator="erode" in="SourceAlpha" result="effect3_dropShadow_7996_40513"/>
-<feOffset dy="3"/>
-<feGaussianBlur stdDeviation="2.5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.2 0"/>
-<feBlend mode="normal" in2="effect2_dropShadow_7996_40513" result="effect3_dropShadow_7996_40513"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect3_dropShadow_7996_40513" result="shape"/>
-</filter>
-<linearGradient id="paint0_linear_7996_40513" x1="36.4798" y1="61.0202" x2="25.6798" y2="57.4202" gradientUnits="userSpaceOnUse">
-<stop offset="0.107383" stop-color="#8CACB7"/>
-<stop offset="1" stop-color="#C9D7DD"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7996_40513" x1="146.23" y1="-10.9606" x2="-5.62507" y2="50.2358" gradientUnits="userSpaceOnUse">
-<stop offset="0.35" stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.44" stop-color="#4C7F8E" stop-opacity="0.47"/>
-<stop offset="0.54" stop-color="#4C7F8E" stop-opacity="0.37"/>
-<stop offset="0.65" stop-color="#4C7F8E" stop-opacity="0.21"/>
-<stop offset="0.75" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint2_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(32.9323 37.0706) scale(28.5336 28.5336)">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</radialGradient>
-<radialGradient id="paint3_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(81.9375 7.51122) scale(86.6808 86.6808)">
-<stop stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.13" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.21" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.54" stop-color="white" stop-opacity="0"/>
-</radialGradient>
-<clipPath id="clip0_7996_40513">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_7996_40513)"><path fill="#4c7f8e" d="m66.53 29.653-.1 34.877c0 .511-.361.718-.808.46L48.063 54.854 37.001 48.45 18.42 37.74c-.445-.257-.803-.878-.803-1.39l.1-34.876c0-.511.361-.716.806-.46l47.201 27.248c.445.257.805.878.803 1.39z" opacity=".2"/><g filter="url(#filter0_ddd_7996_40513)"><path fill="#c7d5db" d="M27.84 56.16v-3.6L39 58.95v3.69z"/><path fill="url(#paint0_linear_7996_40513)" d="m27.84 56.16-2.25 1.26 15.84 9.18L39 62.64z"/><path fill="#5e2ad8" d="m41.43 66.6 3.33-1.98s.99.99.63 1.53-3.06 2.25-3.69 2.25-16.02-9.18-16.02-9.18c-.45-.27-.63-.81-.63-.81s-.45-.72.27-1.08l2.79-1.62-.27.45-2.25 1.26z"/><path fill="#eff1f3" d="m42.33 60.66 2.43 3.96-3.33 1.98L39 62.64z"/><path fill="#83a2ac" d="M42.33 60.66v-2.07H39v4.05z"/><path fill="#eff1f3" d="m60.572 31.774-.1 34.876c0 .254-.091.434-.235.517L56.96 69.07c.145-.082.234-.263.236-.516l.098-34.877c.002-.511-.358-1.134-.802-1.39L9.293 5.036c-.223-.13-.426-.142-.572-.055l3.276-1.905c.146-.086.349-.074.572.056l47.2 27.252c.444.257.804.878.803 1.39"/><path fill="#fff" d="M29.597 47.898a.23.23 0 0 1 .104.18v.887c-.003.067-.05.094-.108.06l-.977-.566a.23.23 0 0 1-.104-.18v-.887c.003-.065.05-.092.108-.06z"/><path fill="#f4f6f7" d="M31.523 49.01a.23.23 0 0 1 .104.18v.888c-.003.066-.05.093-.106.059l-.98-.565a.23.23 0 0 1-.104-.18v-.888c.004-.064.05-.091.107-.06z"/><path fill="#98b3bc" d="m13.942 37.879-.009 3.035-3.342-1.93c-.339-.196-.612-.67-.61-1.058l.005-2.331z"/><path fill="#c8d6dc" d="m27.471 45.69 28.341 16.363-.007 2.266c0 .427-.304.6-.675.385L10.654 39.022c-.409-.236-.675-.697-.674-1.075 0 .366.272.84.61 1.034l3.343 1.93.01-3.035-.004 3.038 13.525 7.808.009-3.035zm2.229 3.277v-.887a.22.22 0 0 0-.101-.18l-.978-.566c-.057-.032-.104-.007-.104.06v.887a.22.22 0 0 0 .1.18l.978.566c.058.032.105.007.105-.06m1.924 1.113v-.888a.22.22 0 0 0-.101-.18l-.98-.565c-.057-.033-.104-.006-.104.06v.887a.22.22 0 0 0 .101.18l.98.565c.057.032.104.005.104-.06"/><path fill="#fff" d="M48.094 58.557a.25.25 0 0 1 .104.191v.932c0 .067-.048.1-.104.067l-.98-.6a.22.22 0 0 1-.104-.183v-.923c0-.075.048-.1.103-.067z"/><path fill="#5e2ad8" d="M53.867 61.859a.24.24 0 0 1 .109.191v.931c0 .067-.05.091-.11.058l-1.041-.59a.24.24 0 0 1-.11-.191v-.931c0-.067.051-.092.11-.058z"/><path fill="#f4f6f7" d="M50.022 59.677a.2.2 0 0 1 .076.076q.027.05.026.106v.927c0 .075-.047.1-.102.066l-.975-.587a.26.26 0 0 1-.11-.19v-.928c0-.074.047-.099.102-.066z"/><path fill="#e4eaed" d="M51.94 60.763a.22.22 0 0 1 .11.19v.93c0 .066-.05.091-.11.058l-1.032-.589a.24.24 0 0 1-.118-.19v-.93c0-.066.05-.1.11-.058z"/><path fill="#d3dee3" d="m13.946 37.88 13.525 7.81-.01 3.034-13.524-7.808zm2.284 3.51.003-1.284a.3.3 0 0 0-.133-.23l-1.116-.645c-.074-.043-.133-.01-.133.075l-.004 1.284c0 .084.06.187.133.23l1.116.645c.074.041.134.007.134-.076"/><path fill="#fff" d="M16.1 39.875a.3.3 0 0 1 .134.23l-.004 1.284c0 .084-.061.119-.133.075l-1.116-.644a.3.3 0 0 1-.133-.23l.003-1.284c0-.084.061-.119.133-.075zm39.792-5.725-.08 27.901-28.34-16.362-13.526-7.808-3.96-2.286.08-27.904c.001-.427.305-.6.678-.385L55.22 32.985c.371.214.675.738.672 1.164"/><path fill="url(#paint1_linear_7996_40513)" d="m55.892 34.15-.08 27.901-28.34-16.362-13.526-7.808-3.96-2.286.08-27.904c.001-.427.305-.6.678-.385L55.22 32.985c.371.214.675.738.672 1.164" opacity=".8"/><path fill="#fff" d="m10.744 7.306 3.276-1.904L58.496 31.08l-3.276 1.904zM37.191 55.53a1.23 1.23 0 0 1 .55.96c0 .354-.25.49-.55.312l-8.081-4.694a1.22 1.22 0 0 1-.55-.96c0-.344.25-.49.56-.312z"/><path fill="#eff1f3" d="m56.584 32.333-47.2-27.25c-.444-.258-.806-.05-.807.46l-.1 34.877c0 .512.359 1.134.803 1.392l18.578 10.712 11.063 6.402L56.48 69.064c.445.257.806.05.808-.46l.1-34.878c0-.511-.36-1.134-.804-1.39zM36.614 56.28l-6.175-3.564a.94.94 0 0 1-.42-.729c0-.266.19-.376.422-.241l6.174 3.566a.93.93 0 0 1 .421.729c0 .266-.19.376-.423.241zm19.198 5.775-.007 2.266c0 .426-.304.6-.677.383L10.573 38.977c-.33-.191-.594-.65-.594-1.12l.086-30.166c0-.427.306-.6.677-.385l44.476 25.679c.37.214.675.738.673 1.164l-.079 27.902"/><path fill="url(#paint2_radial_7996_40513)" d="m56.584 32.333-47.2-27.25c-.444-.258-.806-.05-.807.46l-.1 34.877c0 .512.359 1.134.803 1.392l18.578 10.712 11.063 6.402L56.48 69.064c.445.257.806.05.808-.46l.1-34.878c0-.511-.36-1.134-.804-1.39zm-.772 29.722-.007 2.266c0 .426-.304.6-.677.383L10.573 38.977c-.33-.191-.594-.65-.594-1.12l.086-30.166c0-.427.306-.6.677-.385l44.476 25.679c.37.214.675.738.673 1.164l-.079 27.902"/><path fill="#eff1f3" d="m10.653 39.024-.073-.049-.006.004L28.711 49.45 10.653 39.026zm19.016 10.01s-.018.005-.027.005q.015.001.027-.006m-.035.007a.1.1 0 0 1-.041-.015.1.1 0 0 0 .041.015M11.771 38.28l-.635.368.633.468v-.837zm42.172 24.773s-.01 0-.014.003q.008 0 .014-.003m-1.924-1.11s-.012.003-.02.003q.012.001.02-.004m-.034.006a.1.1 0 0 1-.041-.014.1.1 0 0 0 .041.014m.065-.075-.105.06zm-1.99-1.037a.1.1 0 0 1-.04-.014.1.1 0 0 0 .04.014m.033-.007s-.016.005-.025.005q.014.001.025-.005m-1.924-1.11a.1.1 0 0 1-.032.006q.018.002.032-.007m-16.574-9.577a.1.1 0 0 1-.033.007q.02.002.033-.007m22.064 11.651-.274.159zm-5.774-3.333-.195.113zm-.84-.448c-.017.01-.03.034-.03.066q0-.049.03-.066"/><path fill="#c8d6dc" d="m10.593 38.982.018.011-.016-.01zm1.179-.686-.625.364.623.459v-.823z"/><path fill="#98b3bc" d="m11.771 38.21-.147-.084-.672.39.817.601z"/><path fill="#eff1f3" d="m9.385 5.083 3.278-1.904 47.2 27.25-3.279 1.904z"/><path fill="#5e2ad8" d="m60.572 31.774-.1 34.876c0 .254-.091.434-.235.517L56.96 69.07c.145-.082.234-.263.236-.516l.098-34.877c.002-.511-.358-1.134-.802-1.39L9.293 5.036c-.223-.13-.426-.142-.572-.055l3.276-1.905c.146-.086.349-.074.572.056l47.2 27.252c.444.257.804.878.803 1.39"/><path fill="url(#paint3_radial_7996_40513)" d="m60.572 31.703-.1 34.877c0 .254-.091.434-.235.517L56.96 69c.145-.083.234-.263.236-.517l.098-34.876c.002-.512-.358-1.134-.802-1.39L9.293 4.966c-.223-.13-.426-.142-.572-.056l3.276-1.904c.146-.087.349-.074.572.056l47.2 27.25c.444.257.804.878.803 1.39z"/><path fill="#e6eaec" d="m13.01 20.5.983 1.45-.011 3.565v.837l-.428-.612.003-1.039a.27.27 0 0 0-.119-.207l-.437-.252.01-3.744z"/><path fill="#5e2ad8" d="M13.437 24.498c.067.038.12.131.119.207l-.004 1.039v.462c0 .076-.056.106-.122.069l-1.305-.755a.26.26 0 0 1-.12-.207l.004-1.5c0-.076.054-.107.121-.07l.868.501.437.252z"/><path fill="#b0c4c9" d="m15.736 22.073-.01 3.34q.096.216.188.433l-.01.789-1.923-1.118.01-3.564-.982-1.451 2.725 1.573z"/><path fill="#5e2ad8" d="M13.507 32.733c.067.038.12.131.119.207l-.004 1.039v.462c0 .076-.055.106-.122.069l-1.305-.755a.26.26 0 0 1-.119-.207l.004-1.499c0-.076.054-.106.12-.068l.868.5.437.252z"/><path fill="#b0c4c9" d="M16.596 34.747v.283l-2.02-1.167v-.282z"/><path fill="#e6eaec" d="m13.08 28.737.983 1.45-.01 3.57v.832l-.43-.612.005-1.04a.27.27 0 0 0-.12-.206l-.437-.252.011-3.744z"/><path fill="#b0c4c9" d="m16.598 34.294-.002.282-2.018-1.166v-.281zm-.55-2.139v.14l-1.465-.846v-.14z"/><path fill="#e6eaec" d="m16.16 32.45.625.36-.007 2.855-2.347-1.355v-.332l.01-3.283 1.363.787.36.209v.76zm.436 1.674v-.754l-2.016-1.166v.754zm-.002.906v-.283l-2.018-1.166v.282zm0-.454v-.282l-2.018-1.167v.283zm.004-1.384v-.283l-2.018-1.166v.283zm-2.018-1.883v.14l1.465.846v-.14z"/><path fill="#b0c4c9" d="m16.6 33.37-.002.752-2.02-1.164.004-.754zm.002-.46-.002.282-2.018-1.167v-.28zm-.44-1.22.623 1.12-.625-.36z"/><path fill="#b0c4c9" d="m15.805 30.31-.003 1.172-1.363-.787-.009 3.285-.378-.223.01-3.57-.982-1.45z"/><path fill="#5e2ad8" d="m12.886 11.905 3.483 3.276-.009 2.964-3.481-3.272z"/><path fill="#e6eaec" d="m12.463 15.532 2.99 2.892-.135-.007-1.197-.066-2.92-2.86-.143-.14z"/><path fill="#b0c4c9" d="m11.058 15.35.143.14 2.92 2.86 1.197.067.135.007v.123l-1.332-.074-3.065-3z"/><path fill="#e6eaec" d="m14.522 16.493.934.879v.045c0 .088-.062.124-.14.079l-.657-.38a.3.3 0 0 1-.139-.24v-.383z"/><path fill="#b0c4c9" d="M14.521 16.74v.136a.3.3 0 0 0 .139.24l.657.38c.077.045.138.009.14-.08v-.045l.637.6c-.05.131-.56-.034-1.179-.393-.653-.376-1.182-.824-1.18-.997 0-.137.329-.063.788.159z"/><path fill="#e6eaec" d="m12.798 11.747 3.66 3.441-.01 3.116-.356-.335-.637-.6-.934-.878-1.732-1.627zm3.562 6.399.01-2.967-3.484-3.274-.009 2.966z"/><path fill="#b0c4c9" d="m13.086 11.831 3.568 3.366-.01 3.114-.196-.007.01-3.116-3.66-3.441z"/><path fill="#5e2ad8" d="M22.133 21.323a.26.26 0 0 1 .119.205l-.004 1.037v.462c0 .076-.055.106-.12.069l-1.307-.755a.26.26 0 0 1-.119-.205l.004-1.501c0-.076.054-.106.12-.069l.868.5.437.253z"/><path fill="#e6eaec" d="m21.706 17.325.162.24.82 1.21-.012 3.734v.668l-.428-.613.003-1.036a.26.26 0 0 0-.118-.205l-.438-.253.011-3.744z"/><path fill="#b0c4c9" d="m24.431 18.898-.002.572-2.224-1.73-.002.152-.335-.344v.016l-.162-.24z"/><path fill="#b0c4c9" d="m21.868 17.548.335.344 1.661 1.71-.009 3.443-.001.684-1.178-1.22.011-3.733-.819-1.212z"/><path fill="#e6eaec" d="m22.205 17.74 2.225 1.73.358.278-.01 4.145-.922-.848.008-3.443-1.66-1.71zm.041 9.29-.004 1.043.907.523c0 .578-.408.81-.91.52-.503-.29-.906-.99-.906-1.567 0-.576.409-.808.91-.518z"/><path fill="#5e2ad8" d="m23.308 30.224 1.61.93-.001.193-1.61-.929zm-1.062-3.194c.502.29.905.99.905 1.566l-.907-.523.004-1.043zm2.677 2.285-.002.698-1.055-.608.002-.7z"/><path fill="#e6eaec" d="m24.925 28.726-.002.589-1.055-.61-.002.7 1.055.608-.002.65-1.055-.608.002-.422v-.093l.004-1.422z"/><path fill="#b0c4c9" d="M25.374 28.357a.2.2 0 0 1 .092.16l-.01 3.616c0 .06-.042.083-.094.053l-4.44-2.564a.2.2 0 0 1-.09-.16l.01-3.616c0-.06.041-.083.094-.054l4.438 2.563zm-.451.956v-.589l-1.053-.608-.004 1.422-.342-.198v-.576l-.373-.216v.047c0-.576-.403-1.276-.905-1.566s-.91-.058-.91.518c0 .578.402 1.278.905 1.568.502.29.909.058.91-.52v.048l.292.17v.576l.423.244v.422l1.055.608v-.65zm-.004 2.032v-.192l-1.61-.93v-.21l-.51-.295v.21l-1.376-.793v.192l1.374.794v.184l.51.295v-.184z"/><path fill="#5e2ad8" d="m23.526 28.765-.002.576.342.198v.094l-.425-.245.002-.574-.292-.17v-.095zm-2.104.564v-.193l1.375.792v.195z"/><path fill="#e6eaec" d="M23.308 30.013v.405l-.002.184-.511-.296.002-.183v-.405z"/><path fill="#b0c4c9" d="M24.295 36.398v.156l-1.255-.725v-.157z"/><path fill="#e6eaec" d="M22.464 35.024c.068.04.122.133.122.21l-.005 1.651c0 .078-.056.11-.123.07l-1.413-.815a.27.27 0 0 1-.122-.21l.005-1.651c0-.077.056-.11.123-.07z"/><path fill="#b0c4c9" d="M22.716 34.824a.37.37 0 0 1 .165.288l-.007 2.241c0 .106-.076.15-.168.096l-1.503-.868-.415-.24a.37.37 0 0 1-.166-.287l.007-2.241c0-.107.076-.148.168-.096l.415.24zm-.137 2.061.005-1.65a.27.27 0 0 0-.122-.21l-1.413-.816c-.069-.04-.123-.008-.123.07l-.005 1.65c0 .078.054.173.122.211l1.413.816c.069.04.123.007.123-.07m1.714.284v.157l-1.255-.724v-.157zm.002-.41-.002.156-1.255-.724.002-.156zm-.702-2.7 1.03 1.751-1.034-.598z"/><path fill="#e6eaec" d="m23.59 35.213 1.036.598-.01 3.994-3.412-1.97.004-1.256 1.503.868c.091.052.167.01.167-.095l.007-2.241a.37.37 0 0 0-.165-.288l-1.503-.868.003-1.269 2.375 1.372-.004 1.153zm.701 2.495v-.157l-1.255-.723v.156zm.002-.792v-.157l-1.255-.723v.156zm0 .41v-.156l-1.255-.724v.157zm.002-.774v-.156l-1.255-.724v.157z"/><path fill="#b0c4c9" d="M24.29 37.551v.157l-1.254-.724v-.158z"/><path fill="#c8d6dc" d="m41.158 31.505-.023 8.2-7.139-4.12.023-8.2zm7.598 4.389-.023 8.199-7.137-4.12.023-8.2zm-7.622 4.343-.023 8.2-7.14-4.121.024-8.2zm7.596 4.387-.023 8.2-7.137-4.12.024-8.2z"/><path fill="#fff" d="m11.844 37.207-.002.956-.831-.48.002-.955zm.886.512-.002.955-.832-.48.002-.954zm-.888.507-.004.954-.831-.479.003-.955zm.886.511-.004.956-.831-.48.003-.956z"/></g></g><defs><radialGradient id="paint2_radial_7996_40513" cx="0" cy="0" r="1" gradientTransform="translate(32.932 37.07)scale(28.5336)" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></radialGradient><radialGradient id="paint3_radial_7996_40513" cx="0" cy="0" r="1" gradientTransform="translate(81.938 7.511)scale(86.6808)" gradientUnits="userSpaceOnUse"><stop stop-color="#fff" stop-opacity=".6"/><stop offset=".13" stop-color="#fff" stop-opacity=".42"/><stop offset=".21" stop-color="#fff" stop-opacity=".3"/><stop offset=".54" stop-color="#fff" stop-opacity="0"/></radialGradient><linearGradient id="paint0_linear_7996_40513" x1="36.48" x2="25.68" y1="61.02" y2="57.42" gradientUnits="userSpaceOnUse"><stop offset=".107" stop-color="#8cacb7"/><stop offset="1" stop-color="#c9d7dd"/></linearGradient><linearGradient id="paint1_linear_7996_40513" x1="146.23" x2="-5.625" y1="-10.961" y2="50.236" gradientUnits="userSpaceOnUse"><stop offset=".35" stop-color="#4c7f8e" stop-opacity=".5"/><stop offset=".44" stop-color="#4c7f8e" stop-opacity=".47"/><stop offset=".54" stop-color="#4c7f8e" stop-opacity=".37"/><stop offset=".65" stop-color="#4c7f8e" stop-opacity=".21"/><stop offset=".75" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><clipPath id="clip0_7996_40513"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath><filter id="filter0_ddd_7996_40513" width="80.094" height="94.224" x="-5.522" y="-10.049" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="1"/><feGaussianBlur stdDeviation="7"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.12 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_7996_40513"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="5"/><feGaussianBlur stdDeviation="4"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.14 0"/><feBlend in2="effect1_dropShadow_7996_40513" result="effect2_dropShadow_7996_40513"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feMorphology in="SourceAlpha" radius="1" result="effect3_dropShadow_7996_40513"/><feOffset dy="3"/><feGaussianBlur stdDeviation="2.5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.2 0"/><feBlend in2="effect2_dropShadow_7996_40513" result="effect3_dropShadow_7996_40513"/><feBlend in="SourceGraphic" in2="effect3_dropShadow_7996_40513" result="shape"/></filter></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/digicert-dark.svg b/web/packages/design/src/ResourceIcon/assets/digicert-dark.svg
index 51a8a466d9be8..153582c56ff9e 100644
--- a/web/packages/design/src/ResourceIcon/assets/digicert-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/digicert-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7203)">
-<path d="M10.4902 45.3729C10.4902 37.3007 12.6573 30.935 16.8559 26.1134C21.19 21.2917 26.6076 18.8809 33.3525 18.8809C35.5196 18.8809 37.5783 19.1246 39.5015 19.7206C41.4248 20.2082 42.8604 20.9125 43.944 21.7793C45.0275 22.6461 46.0026 23.3504 46.8424 24.1901C47.6821 25.0298 48.278 25.6258 48.6573 26.2488L49.0094 27.0885H49.2532C49.1449 26.1134 49.0094 24.9215 49.0094 23.7296V0.000488281H58.7611V70.7815H49.497V65.9599L49.6054 62.6009H49.3616C49.2532 62.8447 49.0094 63.1969 48.7656 63.5761C48.5218 63.9553 47.9259 64.768 47.0862 65.8515C46.2464 66.935 45.1629 67.9102 43.944 68.7499C42.7521 69.5897 41.181 70.321 39.1223 71.0253C37.0636 71.7567 34.8966 72.0005 32.6212 72.0005C25.7679 72.0005 20.3503 69.5897 16.3683 64.6596C12.5489 59.7025 10.4902 53.3368 10.4902 45.3729ZM20.4857 45.3729C20.4857 50.8989 21.813 55.233 24.4677 58.619C27.1223 61.8696 30.5896 63.549 34.8153 63.549C38.9056 63.549 42.3999 61.9779 45.2984 58.9711C48.0613 55.9644 49.5241 51.3865 49.5241 45.2375C49.5241 40.3075 48.3322 36.0818 45.7859 32.5874C43.2668 28.9847 39.7724 27.1698 35.1945 27.1698C31.1042 27.1698 27.6099 28.7409 24.7115 31.9915C21.813 35.4046 20.4857 39.7386 20.4857 45.3729Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7203">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15937_7203)"><path fill="#fff" d="M10.49 45.373c0-8.072 2.167-14.438 6.366-19.26 4.334-4.821 9.752-7.232 16.496-7.232 2.168 0 4.226.244 6.15.84 1.923.487 3.358 1.192 4.442 2.058 1.084.867 2.059 1.571 2.898 2.411.84.84 1.436 1.436 1.815 2.059l.352.84h.244c-.108-.976-.244-2.167-.244-3.36V0h9.752v70.782h-9.264V65.96l.108-3.36h-.243c-.109.245-.353.597-.596.976-.244.38-.84 1.192-1.68 2.276s-1.923 2.058-3.142 2.898c-1.192.84-2.763 1.571-4.822 2.275-2.058.732-4.225.975-6.5.975-6.854 0-12.272-2.41-16.254-7.34-3.82-4.957-5.878-11.323-5.878-19.287m9.996 0c0 5.526 1.327 9.86 3.982 13.246 2.654 3.25 6.122 4.93 10.347 4.93 4.09 0 7.585-1.571 10.483-4.578 2.763-3.007 4.226-7.584 4.226-13.733 0-4.93-1.192-9.156-3.738-12.65-2.52-3.603-6.014-5.418-10.592-5.418-4.09 0-7.584 1.57-10.483 4.821-2.898 3.414-4.225 7.748-4.225 13.382"/></g><defs><clipPath id="clip0_15937_7203"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/digicert-light.svg b/web/packages/design/src/ResourceIcon/assets/digicert-light.svg
index dd8e05479a396..47a4ff8ac905b 100644
--- a/web/packages/design/src/ResourceIcon/assets/digicert-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/digicert-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7202)">
-<path d="M10.4902 45.3729C10.4902 37.3007 12.6573 30.935 16.8559 26.1134C21.19 21.2917 26.6076 18.8809 33.3525 18.8809C35.5196 18.8809 37.5783 19.1246 39.5015 19.7206C41.4248 20.2082 42.8604 20.9125 43.944 21.7793C45.0275 22.6461 46.0026 23.3504 46.8424 24.1901C47.6821 25.0298 48.278 25.6258 48.6573 26.2488L49.0094 27.0885H49.2532C49.1449 26.1134 49.0094 24.9215 49.0094 23.7296V0.000488281H58.7611V70.7815H49.497V65.9599L49.6054 62.6009H49.3616C49.2532 62.8447 49.0094 63.1969 48.7656 63.5761C48.5218 63.9553 47.9259 64.768 47.0862 65.8515C46.2464 66.935 45.1629 67.9102 43.944 68.7499C42.7521 69.5897 41.181 70.321 39.1223 71.0253C37.0636 71.7567 34.8966 72.0005 32.6212 72.0005C25.7679 72.0005 20.3503 69.5897 16.3683 64.6596C12.5489 59.7025 10.4902 53.3368 10.4902 45.3729ZM20.4857 45.3729C20.4857 50.8989 21.813 55.233 24.4677 58.619C27.1223 61.8696 30.5896 63.549 34.8153 63.549C38.9056 63.549 42.3999 61.9779 45.2984 58.9711C48.0613 55.9644 49.5241 51.3865 49.5241 45.2375C49.5241 40.3075 48.3322 36.0818 45.7859 32.5874C43.2668 28.9847 39.7724 27.1698 35.1945 27.1698C31.1042 27.1698 27.6099 28.7409 24.7115 31.9915C21.813 35.4046 20.4857 39.7386 20.4857 45.3729Z" fill="#0174C3"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7202">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15937_7202)"><path fill="#0174c3" d="M10.49 45.373c0-8.072 2.167-14.438 6.366-19.26 4.334-4.821 9.752-7.232 16.496-7.232 2.168 0 4.226.244 6.15.84 1.923.487 3.358 1.192 4.442 2.058 1.084.867 2.059 1.571 2.898 2.411.84.84 1.436 1.436 1.815 2.059l.352.84h.244c-.108-.976-.244-2.167-.244-3.36V0h9.752v70.782h-9.264V65.96l.108-3.36h-.243c-.109.245-.353.597-.596.976-.244.38-.84 1.192-1.68 2.276s-1.923 2.058-3.142 2.898c-1.192.84-2.763 1.571-4.822 2.275-2.058.732-4.225.975-6.5.975-6.854 0-12.272-2.41-16.254-7.34-3.82-4.957-5.878-11.323-5.878-19.287m9.996 0c0 5.526 1.327 9.86 3.982 13.246 2.654 3.25 6.122 4.93 10.347 4.93 4.09 0 7.585-1.571 10.483-4.578 2.763-3.007 4.226-7.584 4.226-13.733 0-4.93-1.192-9.156-3.738-12.65-2.52-3.603-6.014-5.418-10.592-5.418-4.09 0-7.584 1.57-10.483 4.821-2.898 3.414-4.225 7.748-4.225 13.382"/></g><defs><clipPath id="clip0_15937_7202"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/digitalocean.svg b/web/packages/design/src/ResourceIcon/assets/digitalocean.svg
index 1c76227671057..bec69aae3ac03 100644
--- a/web/packages/design/src/ResourceIcon/assets/digitalocean.svg
+++ b/web/packages/design/src/ResourceIcon/assets/digitalocean.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7226)">
-<path d="M36.0492 58.0586V72.0005C59.5966 72.0005 77.921 49.2487 70.2146 24.53C66.7894 13.7528 58.2266 5.11402 47.4376 1.77824C22.777 -5.91969 0 12.4698 0 35.9913H13.9573C13.9573 21.2797 28.5995 9.81829 44.1837 15.4635C49.9207 17.5162 54.5447 22.135 56.5998 27.8656C62.2511 43.4327 50.8628 58.0586 36.0492 58.0586Z" fill="#0069FF"/>
-<path d="M22.1748 58.1448H36.0463V44.2886H22.1748V58.1448Z" fill="#0069FF"/>
-<path d="M22.1731 68.8405H11.4697V58.1498L22.1731 58.1489V68.8405Z" fill="#0069FF"/>
-<path d="M2.4873 58.1498H11.3925V49.2544H2.4873V58.1498Z" fill="#0069FF"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7226">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#0069ff" clip-path="url(#clip0_15937_7226)"><path d="M36.05 58.059V72c23.546 0 41.87-22.751 34.164-47.47C66.789 13.753 58.227 5.114 47.438 1.778 22.777-5.92 0 12.47 0 35.991h13.957c0-14.711 14.642-26.173 30.227-20.527 5.737 2.052 10.36 6.671 12.416 12.402 5.651 15.567-5.737 30.193-20.55 30.193"/><path d="M22.175 58.145h13.871V44.289H22.175zm-.002 10.695H11.47V58.15l10.703-.001zM2.487 58.15h8.906v-8.896H2.486z"/></g><defs><clipPath id="clip0_15937_7226"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/discord.svg b/web/packages/design/src/ResourceIcon/assets/discord.svg
index 8f19bbd201f16..b6eb67a6cebd6 100644
--- a/web/packages/design/src/ResourceIcon/assets/discord.svg
+++ b/web/packages/design/src/ResourceIcon/assets/discord.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6211_26693)">
-<path d="M60.991 13.5701C56.2605 11.4043 51.2666 9.86791 46.1368 9C45.4348 10.2549 44.7997 11.546 44.234 12.8679C38.7698 12.0445 33.2131 12.0445 27.7489 12.8679C27.1829 11.5461 26.5478 10.255 25.8461 9C20.713 9.87524 15.7158 11.4153 10.9806 13.5814C1.57994 27.4899 -0.968436 41.0529 0.30575 54.4233C5.81101 58.4908 11.973 61.5843 18.5238 63.5691C19.9988 61.5852 21.3041 59.4806 22.4256 57.2775C20.2954 56.4819 18.2393 55.5003 16.2812 54.344C16.7965 53.9703 17.3006 53.5852 17.7876 53.2114C23.4852 55.8909 29.7038 57.2801 35.9999 57.2801C42.2961 57.2801 48.5147 55.8909 54.2123 53.2114C54.705 53.6135 55.209 53.9986 55.7187 54.344C53.7568 55.5021 51.697 56.4856 49.5629 57.2831C50.6831 59.4852 51.9884 61.5881 53.4648 63.5691C60.0212 61.5922 66.1879 58.5003 71.6941 54.429C73.1892 38.9235 69.1401 25.4851 60.991 13.5701ZM24.0396 46.2006C20.4889 46.2006 17.5554 42.9783 17.5554 39.0142C17.5554 35.05 20.3869 31.7994 24.0283 31.7994C27.6696 31.7994 30.5804 35.05 30.5181 39.0142C30.4558 42.9783 27.6583 46.2006 24.0396 46.2006ZM47.9603 46.2006C44.4039 46.2006 41.4818 42.9783 41.4818 39.0142C41.4818 35.05 44.3133 31.7994 47.9603 31.7994C51.6073 31.7994 54.4955 35.05 54.4332 39.0142C54.3709 42.9783 51.579 46.2006 47.9603 46.2006Z" fill="#5865F2"/>
-</g>
-<defs>
-<clipPath id="clip0_6211_26693">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6211_26693)"><path fill="#5865f2" d="M60.991 13.57A59.5 59.5 0 0 0 46.137 9a41 41 0 0 0-1.903 3.868 55.3 55.3 0 0 0-16.485 0A41 41 0 0 0 25.846 9a60 60 0 0 0-14.865 4.581C1.58 27.49-.97 41.053.306 54.423a59.9 59.9 0 0 0 18.218 9.146 44 44 0 0 0 3.902-6.291 39 39 0 0 1-6.145-2.934 68 68 0 0 0 1.507-1.133 42.8 42.8 0 0 0 36.424 0c.493.403.997.788 1.507 1.133a39 39 0 0 1-6.156 2.94 43.6 43.6 0 0 0 3.902 6.285 59.6 59.6 0 0 0 18.23-9.14C73.188 38.923 69.14 25.485 60.99 13.57M24.04 46.2c-3.551 0-6.485-3.222-6.485-7.186s2.832-7.215 6.473-7.215 6.552 3.251 6.49 7.215-2.86 7.187-6.478 7.187m23.92 0c-3.556 0-6.478-3.222-6.478-7.186S44.313 31.8 47.96 31.8s6.535 3.251 6.473 7.215-2.854 7.187-6.473 7.187"/></g><defs><clipPath id="clip0_6211_26693"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/dmarcian.svg b/web/packages/design/src/ResourceIcon/assets/dmarcian.svg
index f789e6a50edb2..bce836f90f586 100644
--- a/web/packages/design/src/ResourceIcon/assets/dmarcian.svg
+++ b/web/packages/design/src/ResourceIcon/assets/dmarcian.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M49.4538 5.61142L49.9594 28.883C48.3959 27.7566 46.1661 26.831 43.5935 26.831H25.3992C15.483 27.0751 14.2344 35.7648 14.2344 36.8619V46.5758C14.2344 51.7867 18.1053 54.7753 21.1844 56.129C22.4866 56.7014 23.9834 56.6051 24.5286 56.6051H45.7268C54.8165 55.0413 58.3618 49.2431 58.3618 44.6921V5.61084L49.4538 5.61142ZM27.6899 32.9099H43.6895C45.9144 32.9099 49.8035 34.6197 49.9545 39.9702V44.4109C49.9545 49.2753 45.0148 50.4572 44.3163 50.5661C43.8853 50.6381 27.8224 50.6753 27.8224 50.6753C23.3607 50.5052 22.8448 46.6908 22.8448 45.937V37.8C23.0291 33.6429 26.6303 32.8742 27.6899 32.9099Z" fill="#39B34A"/>
-<path d="M47.7059 17.279C43.3916 16.4247 39.4032 16.1752 36.6762 16.2222C16.2171 16.1239 0.134975 26.1161 0.442823 41.6833C0.686586 54.0197 8.494 65.2992 30.6281 66.3498C36.2653 66.6175 41.5427 65.5067 46.6579 63.9882L45.0853 58.7592C40.6496 60.2554 37.6395 60.9194 31.9025 60.7658C8.84859 60.1486 7.75976 46.7249 7.40035 42.2939C7.38978 42.1637 7.37985 42.0412 7.37 41.927C7.40131 24.4642 26.3369 22.8492 33.164 22.7874C39.0445 22.7602 43.8893 23.3333 47.859 24.3274L47.7059 17.279Z" fill="white" fill-opacity="0.18"/>
-<path d="M48.2704 58.0957C49.6043 58.6326 51.4474 59.0984 54.2004 59.4384C57.6959 59.87 70.6142 57.2527 71.5155 41.8053C72.099 31.8016 67.0126 25.5749 60.3608 21.7727V31.0389C63.5088 34.4599 64.4959 38.3975 64.3328 41.7222C63.9702 49.119 60.5146 50.6056 59.241 50.9137C59.0437 50.9616 58.8139 50.9619 58.5672 50.933C56.7006 54.0269 53.3343 56.7447 48.2704 58.0957Z" fill="white" fill-opacity="0.18"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#39b34a" d="m49.454 5.611.505 23.272a11 11 0 0 0-6.366-2.052H25.4c-9.916.244-11.165 8.934-11.165 10.03v9.715c0 5.21 3.871 8.2 6.95 9.553 1.303.572 2.8.476 3.345.476h21.198c9.09-1.564 12.635-7.362 12.635-11.913V5.611zM27.69 32.91h16c2.224 0 6.114 1.71 6.265 7.06v4.44c0 4.865-4.94 6.047-5.639 6.156-.43.072-16.494.11-16.494.11-4.461-.17-4.977-3.985-4.977-4.739V37.8c.184-4.157 3.785-4.926 4.845-4.89"/><path fill="#fff" fill-opacity=".18" d="M47.706 17.279c-4.314-.854-8.303-1.104-11.03-1.057C16.217 16.124.135 26.116.443 41.683.687 54.02 8.494 65.3 30.628 66.35c5.637.268 10.915-.843 16.03-2.362l-1.573-5.229c-4.435 1.496-7.446 2.16-13.183 2.007C8.85 60.149 7.76 46.725 7.4 42.294l-.03-.367c.031-17.463 18.967-19.078 25.794-19.14 5.88-.027 10.725.546 14.695 1.54zm.564 40.817c1.334.537 3.177 1.002 5.93 1.342 3.496.432 16.414-2.185 17.316-17.633.583-10.003-4.503-16.23-11.155-20.032v9.266c3.148 3.42 4.135 7.358 3.972 10.683-.363 7.397-3.818 8.884-5.092 9.192a2 2 0 0 1-.674.019c-1.866 3.094-5.233 5.812-10.297 7.163"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/docker-dark.svg b/web/packages/design/src/ResourceIcon/assets/docker-dark.svg
index 0ebede5ba7bb7..25d00f45d0069 100644
--- a/web/packages/design/src/ResourceIcon/assets/docker-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/docker-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M70.8288 30.8755C69.0634 29.6846 64.4255 29.1769 61.0537 30.0866C60.8723 26.7205 59.14 23.8835 55.9709 21.4099L54.7986 20.621L54.0168 21.8044C52.4807 24.1411 51.8333 27.256 52.0615 30.0876C52.2429 31.8322 52.8477 33.7926 54.0168 35.2154C49.6274 37.767 45.5825 37.1876 27.6664 37.1876H0.00622723C-0.0748408 41.2421 0.575837 49.0401 5.52419 55.3886C6.07033 56.0898 6.66981 56.7686 7.32049 57.4217C11.344 61.4591 17.4231 64.4201 26.5134 64.4276C40.3803 64.4404 52.2621 56.9279 59.4899 38.7654C61.8686 38.8049 68.1461 39.1919 71.2181 33.2432C71.2928 33.1427 72 31.6654 72 31.6654L70.8288 30.8765V30.8755ZM18.0577 26.6916H10.2795V34.4864H18.0577V26.6916ZM28.107 26.6916H20.3287V34.4864H28.107V26.6916ZM38.1562 26.6916H30.378V34.4864H38.1562V26.6916ZM48.2055 26.6916H40.4272V34.4864H48.2055V26.6916ZM8.01063 26.6916H0.230231V34.4864H8.0085V26.6916H8.01063ZM18.0599 16.8455H10.2816V24.6403H18.0599V16.8455ZM28.1091 16.8455H20.3308V24.6403H28.1091V16.8455ZM38.1584 16.8455H30.3801V24.6403H38.1584V16.8455ZM38.1552 7.00049H30.3769V14.7953H38.1552V7.00049Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M70.829 30.876c-1.766-1.191-6.403-1.7-9.775-.79-.182-3.365-1.914-6.202-5.083-8.676l-1.172-.789-.782 1.183c-1.536 2.337-2.184 5.452-1.956 8.284.182 1.744.787 3.705 1.956 5.127-4.39 2.552-8.434 1.973-26.35 1.973H.006c-.082 4.054.569 11.852 5.517 18.2q.82 1.053 1.796 2.034c4.024 4.037 10.103 6.998 19.193 7.006 13.867.012 25.75-7.5 32.977-25.663 2.379.04 8.656.427 11.728-5.522.075-.1.782-1.578.782-1.578zm-52.771-4.184H10.28v7.794h7.778zm10.049 0h-7.778v7.794h7.778zm10.05 0h-7.779v7.794h7.778zm10.049 0h-7.779v7.794h7.779zm-40.195 0H.23v7.794h7.778v-7.794zm10.049-9.846h-7.778v7.794h7.778zm10.05 0h-7.78v7.794h7.78zm10.048 0H30.38v7.794h7.778zM38.155 7h-7.778v7.795h7.778z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/docker-light.svg b/web/packages/design/src/ResourceIcon/assets/docker-light.svg
index 9f4a0c7601e9c..550a0e3728ea1 100644
--- a/web/packages/design/src/ResourceIcon/assets/docker-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/docker-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M70.8288 30.8755C69.0634 29.6846 64.4255 29.1769 61.0537 30.0866C60.8723 26.7205 59.14 23.8835 55.9709 21.4099L54.7986 20.621L54.0168 21.8044C52.4807 24.1411 51.8333 27.256 52.0615 30.0876C52.2429 31.8322 52.8477 33.7926 54.0168 35.2154C49.6274 37.767 45.5825 37.1876 27.6664 37.1876H0.00622723C-0.0748408 41.2421 0.575837 49.0401 5.52419 55.3886C6.07033 56.0898 6.66981 56.7686 7.32049 57.4217C11.344 61.4591 17.4231 64.4201 26.5134 64.4276C40.3803 64.4404 52.2621 56.9279 59.4899 38.7654C61.8686 38.8049 68.1461 39.1919 71.2181 33.2432C71.2928 33.1427 72 31.6654 72 31.6654L70.8288 30.8765V30.8755ZM18.0577 26.6916H10.2795V34.4864H18.0577V26.6916ZM28.107 26.6916H20.3287V34.4864H28.107V26.6916ZM38.1562 26.6916H30.378V34.4864H38.1562V26.6916ZM48.2055 26.6916H40.4272V34.4864H48.2055V26.6916ZM8.01063 26.6916H0.230231V34.4864H8.0085V26.6916H8.01063ZM18.0599 16.8455H10.2816V24.6403H18.0599V16.8455ZM28.1091 16.8455H20.3308V24.6403H28.1091V16.8455ZM38.1584 16.8455H30.3801V24.6403H38.1584V16.8455ZM38.1552 7.00049H30.3769V14.7953H38.1552V7.00049Z" fill="#1D63ED"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1d63ed" d="M70.829 30.876c-1.766-1.191-6.403-1.7-9.775-.79-.182-3.365-1.914-6.202-5.083-8.676l-1.172-.789-.782 1.183c-1.536 2.337-2.184 5.452-1.956 8.284.182 1.744.787 3.705 1.956 5.127-4.39 2.552-8.434 1.973-26.35 1.973H.006c-.082 4.054.569 11.852 5.517 18.2q.82 1.053 1.796 2.034c4.024 4.037 10.103 6.998 19.193 7.006 13.867.012 25.75-7.5 32.977-25.663 2.379.04 8.656.427 11.728-5.522.075-.1.782-1.578.782-1.578zm-52.771-4.184H10.28v7.794h7.778zm10.049 0h-7.778v7.794h7.778zm10.05 0h-7.779v7.794h7.778zm10.049 0h-7.779v7.794h7.779zm-40.195 0H.23v7.794h7.778v-7.794zm10.049-9.846h-7.778v7.794h7.778zm10.05 0h-7.78v7.794h7.78zm10.048 0H30.38v7.794h7.778zM38.155 7h-7.778v7.795h7.778z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/docusign-dark.svg b/web/packages/design/src/ResourceIcon/assets/docusign-dark.svg
index a87d456baecbe..d2f99394c665d 100644
--- a/web/packages/design/src/ResourceIcon/assets/docusign-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/docusign-dark.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7273)">
-<path d="M51.8533 51.8505V70.2516C51.8533 71.2187 51.0727 71.9998 50.1063 71.9998H1.74703C0.780588 71.9998 0 71.2187 0 70.2516V21.8957C0 20.9286 0.780588 20.1475 1.74703 20.1475H20.15L51.8533 51.8505Z" fill="#4C00FF"/>
-<path d="M71.9998 25.8722C71.9998 41.336 62.9673 51.8133 51.8532 51.8505L20.1465 20.1505V1.74721C20.1465 0.780724 20.9271 9.92453e-05 21.8935 9.92453e-05H49.1397C62.0752 -0.0370734 71.9998 10.3713 71.9998 25.8722Z" fill="#FF5252"/>
-<path d="M51.2213 30.816C51.6302 31.2249 51.85 31.7453 51.85 32.3029V51.8504H21.9C20.9336 51.8504 20.1504 51.0669 20.1504 50.1004L20.1465 20.1504H39.624C40.1816 20.1504 40.7391 20.3333 41.1108 20.7422L51.2213 30.816Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7273">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15937_7273)"><path fill="#4c00ff" d="M51.853 51.85v18.402c0 .967-.78 1.748-1.747 1.748H1.747A1.746 1.746 0 0 1 0 70.252V21.896c0-.967.78-1.748 1.747-1.748H20.15z"/><path fill="#ff5252" d="M72 25.872c0 15.464-9.033 25.941-20.147 25.978l-31.707-31.7V1.748c0-.966.781-1.747 1.747-1.747H49.14C62.075-.037 72 10.371 72 25.872"/><path fill="#fff" d="M51.221 30.816c.41.409.629.93.629 1.487V51.85H21.9a1.75 1.75 0 0 1-1.75-1.75l-.003-29.95h19.477c.558 0 1.115.183 1.487.592z"/></g><defs><clipPath id="clip0_15937_7273"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/docusign-light.svg b/web/packages/design/src/ResourceIcon/assets/docusign-light.svg
index 95b9a3563d923..5f4d9749a2be1 100644
--- a/web/packages/design/src/ResourceIcon/assets/docusign-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/docusign-light.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7273)">
-<path d="M51.8533 51.8505V70.2516C51.8533 71.2187 51.0727 71.9998 50.1063 71.9998H1.74703C0.780588 71.9998 0 71.2187 0 70.2516V21.8957C0 20.9286 0.780588 20.1475 1.74703 20.1475H20.15L51.8533 51.8505Z" fill="#4C00FF"/>
-<path d="M71.9998 25.8722C71.9998 41.336 62.9673 51.8133 51.8532 51.8505L20.1465 20.1505V1.74721C20.1465 0.780724 20.9271 9.92453e-05 21.8935 9.92453e-05H49.1397C62.0752 -0.0370734 71.9998 10.3713 71.9998 25.8722Z" fill="#FF5252"/>
-<path d="M51.2213 30.816C51.6302 31.2249 51.85 31.7453 51.85 32.3029V51.8504H21.9C20.9336 51.8504 20.1504 51.0669 20.1504 50.1004L20.1465 20.1504H39.624C40.1816 20.1504 40.7391 20.3333 41.1108 20.7422L51.2213 30.816Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7273">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15937_7273)"><path fill="#4c00ff" d="M51.853 51.85v18.402c0 .967-.78 1.748-1.747 1.748H1.747A1.746 1.746 0 0 1 0 70.252V21.896c0-.967.78-1.748 1.747-1.748H20.15z"/><path fill="#ff5252" d="M72 25.872c0 15.464-9.033 25.941-20.147 25.978l-31.707-31.7V1.748c0-.966.781-1.747 1.747-1.747H49.14C62.075-.037 72 10.371 72 25.872"/><path fill="#000" d="M51.221 30.816c.41.409.629.93.629 1.487V51.85H21.9a1.75 1.75 0 0 1-1.75-1.75l-.003-29.95h19.477c.558 0 1.115.183 1.487.592z"/></g><defs><clipPath id="clip0_15937_7273"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/donut.svg b/web/packages/design/src/ResourceIcon/assets/donut.svg
index 33f24465699b0..e94ad5ae28563 100644
--- a/web/packages/design/src/ResourceIcon/assets/donut.svg
+++ b/web/packages/design/src/ResourceIcon/assets/donut.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15937_7289)">
-<path d="M36 72.0005C55.8822 72.0005 72 55.8827 72 36.0005C72 16.1182 55.8822 0.000488281 36 0.000488281C16.1177 0.000488281 0 16.1182 0 36.0005C0 55.8827 16.1177 72.0005 36 72.0005Z" fill="#380089"/>
-<path d="M36.0006 65.049C51.9136 65.049 64.8137 52.149 64.8137 36.2359C64.8137 20.3229 51.9136 7.42285 36.0006 7.42285C20.0876 7.42285 7.1875 20.3229 7.1875 36.2359C7.1875 52.149 20.0876 65.049 36.0006 65.049Z" fill="#FF90FF"/>
-<path d="M54.5631 39.5876C53.5979 39.5876 52.6722 39.2042 51.9897 38.5217C51.3073 37.8392 50.9238 36.9136 50.9238 35.9484V25.6458C50.9238 24.6789 51.3079 23.7516 51.9917 23.0678C52.6754 22.3841 53.6027 22 54.5696 22C55.5366 22 56.4639 22.3841 57.1476 23.0678C57.8314 23.7516 58.2155 24.6789 58.2155 25.6458V35.9484C58.2155 36.4274 58.1209 36.9017 57.9372 37.3441C57.7535 37.7865 57.4842 38.1882 57.1449 38.5264C56.8056 38.8645 56.4029 39.1323 55.9598 39.3144C55.5168 39.4965 55.0421 39.5894 54.5631 39.5876Z" fill="#380089"/>
-<path d="M17.4371 39.5876C16.4719 39.5876 15.5463 39.2042 14.8638 38.5217C14.1813 37.8392 13.7979 36.9136 13.7979 35.9484V25.6458C13.7979 24.6789 14.182 23.7516 14.8657 23.0678C15.5494 22.3841 16.4767 22 17.4437 22C18.4106 22 19.3379 22.3841 20.0217 23.0678C20.7054 23.7516 21.0895 24.6789 21.0895 25.6458V35.9484C21.0895 36.4274 20.9949 36.9017 20.8112 37.3441C20.6275 37.7865 20.3583 38.1882 20.0189 38.5264C19.6796 38.8645 19.2769 39.1323 18.8338 39.3144C18.3908 39.4965 17.9161 39.5894 17.4371 39.5876Z" fill="#380089"/>
-<path d="M48.2793 35.8041C48.2793 39.0607 46.9855 42.184 44.6827 44.4868C42.3799 46.7896 39.2566 48.0833 36 48.0833C32.7433 48.0833 29.62 46.7896 27.3172 44.4868C25.0144 42.184 23.7207 39.0607 23.7207 35.8041V31.5103H48.2793V35.8041Z" fill="#380089"/>
-<path d="M43.5673 36.066C43.4861 38.0166 42.6541 39.8604 41.2452 41.2118C39.8363 42.5633 37.9596 43.3179 36.0073 43.3179C34.055 43.3179 32.1782 42.5633 30.7693 41.2118C29.3604 39.8604 28.5285 38.0166 28.4473 36.066C28.552 36.0398 43.6196 36.0398 43.5673 36.066Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15937_7289">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15937_7289)"><path fill="#380089" d="M36 72c19.882 0 36-16.117 36-36S55.882 0 36 0 0 16.118 0 36s16.118 36 36 36"/><path fill="#ff90ff" d="M36 65.049c15.914 0 28.814-12.9 28.814-28.813S51.914 7.423 36 7.423 7.188 20.323 7.188 36.236 20.088 65.049 36 65.049"/><path fill="#380089" d="M54.563 39.588a3.64 3.64 0 0 1-3.64-3.64V25.646a3.646 3.646 0 0 1 7.292 0v10.302a3.64 3.64 0 0 1-3.652 3.64m-37.126 0a3.64 3.64 0 0 1-3.64-3.64V25.646a3.646 3.646 0 0 1 7.293 0v10.302a3.64 3.64 0 0 1-3.653 3.64m30.843-3.784a12.28 12.28 0 0 1-24.56 0V31.51h24.56z"/><path fill="#fff" d="M43.567 36.066a7.566 7.566 0 0 1-15.12 0c.105-.026 15.173-.026 15.12 0"/></g><defs><clipPath id="clip0_15937_7289"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/drata-dark.svg b/web/packages/design/src/ResourceIcon/assets/drata-dark.svg
index 4809ee406327e..e4c1a80e2c81b 100644
--- a/web/packages/design/src/ResourceIcon/assets/drata-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/drata-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.7324 70.0022C51.7657 64.6385 44.0219 61.6782 35.9988 61.6938C27.6856 61.6938 20.0783 64.8146 14.2676 70.0022H0L0.331072 69.5226L9.77868 51.847L24.4723 24.3221L31.5586 37.5307L23.5253 52.5651C27.5704 51.3448 31.7737 50.7296 35.9988 50.7394C40.3465 50.7394 44.5506 51.365 48.5209 52.6138L44.3144 44.7363V44.6876L43.3699 42.9106L39.2608 35.2254L35.9988 29.125L28.9149 15.9164L31.746 10.6339L36.0475 2.61035L71.6689 69.5226L72 70.0022H57.7324Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M57.732 70.002A32.42 32.42 0 0 0 36 61.694c-8.313 0-15.92 3.12-21.731 8.308H0l.331-.48L9.78 51.848l14.693-27.525 7.087 13.209-8.034 15.034A42.8 42.8 0 0 1 36 50.74c4.347 0 8.552.626 12.522 1.875l-4.207-7.878v-.048l-.944-1.777-4.11-7.686-3.261-6.1-7.084-13.209 2.831-5.282 4.302-8.024 35.62 66.913.332.48z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/drata-light.svg b/web/packages/design/src/ResourceIcon/assets/drata-light.svg
index ea24568d32402..c3b6a80e56e80 100644
--- a/web/packages/design/src/ResourceIcon/assets/drata-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/drata-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.7324 70.0022C51.7657 64.6385 44.0219 61.6782 35.9988 61.6938C27.6856 61.6938 20.0783 64.8146 14.2676 70.0022H0L0.331072 69.5226L9.77868 51.847L24.4723 24.3221L31.5586 37.5307L23.5253 52.5651C27.5704 51.3448 31.7737 50.7296 35.9988 50.7394C40.3465 50.7394 44.5506 51.365 48.5209 52.6138L44.3144 44.7363V44.6876L43.3699 42.9106L39.2608 35.2254L35.9988 29.125L28.9149 15.9164L31.746 10.6339L36.0475 2.61035L71.6689 69.5226L72 70.0022H57.7324Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M57.732 70.002A32.42 32.42 0 0 0 36 61.694c-8.313 0-15.92 3.12-21.731 8.308H0l.331-.48L9.78 51.848l14.693-27.525 7.087 13.209-8.034 15.034A42.8 42.8 0 0 1 36 50.74c4.347 0 8.552.626 12.522 1.875l-4.207-7.878v-.048l-.944-1.777-4.11-7.686-3.261-6.1-7.084-13.209 2.831-5.282 4.302-8.024 35.62 66.913.332.48z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/drift-dark.svg b/web/packages/design/src/ResourceIcon/assets/drift-dark.svg
index ff0d2a47db1cb..db6f2f83bf49f 100644
--- a/web/packages/design/src/ResourceIcon/assets/drift-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/drift-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7336)">
-<path d="M58.7041 0.387845C58.8976 0.387845 59.285 0.387845 59.4789 0.387845C60.4472 0.581525 61.028 1.54992 60.4471 2.32463C60.2533 2.51831 60.2533 2.71199 60.0597 2.71199L42.2413 23.0482C42.2413 23.0482 41.8539 23.4356 41.8539 23.6292C41.273 24.5976 41.8539 25.566 43.2096 25.7597C43.4035 25.7597 43.7909 25.7597 43.7909 25.7597H49.9884C49.9884 25.7597 50.3757 25.7597 50.5696 25.7597C51.7314 25.9534 52.3127 26.9218 51.7314 27.8902C51.5379 28.0838 51.1505 28.4712 51.1505 28.4712L37.9804 43.3843C37.7869 43.5782 37.593 43.7717 37.593 43.9656C37.0121 44.9339 37.593 45.9022 38.9487 45.9022C39.3361 45.9022 43.4035 45.9022 43.7909 45.9022C44.3718 45.9022 44.953 46.2896 45.34 46.6769C45.5339 47.2578 45.3401 47.8391 44.953 48.2265C44.7591 48.42 44.5656 48.6139 44.5656 48.6139L13.7705 71.4677C13.7705 71.4677 13.3831 71.8551 13.1896 71.8551C12.8022 72.049 12.6087 72.049 12.2213 71.8551C12.0275 71.6616 11.8339 71.4677 12.0275 71.0803C12.0275 70.8868 12.2213 70.4994 12.2213 70.4994L20.5493 53.2622L20.7432 52.6809C21.3241 51.5188 20.7432 50.5505 19.581 50.357C19.3871 50.357 19.1936 50.357 19.1936 50.357H13.3831C13.1896 50.357 12.9958 50.357 12.6087 50.357C11.6401 50.1631 11.0592 49.3883 11.4466 48.42C11.4466 48.2265 11.8339 47.8391 11.8339 47.8391L22.2924 30.408C22.2924 30.408 22.4862 30.2143 22.4862 30.0206C23.0671 29.0522 22.2924 28.0838 21.1306 27.8902C20.5493 27.8902 19.581 27.8902 19.581 27.8902C19.581 27.8902 16.8696 27.8902 14.9327 27.8902H14.3518C13.3831 27.8902 12.8022 27.5028 12.8022 26.7281C12.8022 26.3407 12.8022 25.9534 12.9958 25.7597L16.0949 20.143L26.5533 1.74359L26.7472 1.35624C27.3281 0.387845 28.1029 0.000488281 29.4585 0.000488281L58.7041 0.387845Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7336">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7336)"><path fill="#fff" d="M58.704.388h.775c.968.194 1.549 1.162.968 1.937-.194.193-.194.387-.387.387L42.24 23.048s-.387.388-.387.581c-.581.969 0 1.937 1.356 2.13h7.36c1.161.194 1.743 1.163 1.161 2.131l-.58.581-13.17 14.913c-.194.194-.388.388-.388.582-.58.968 0 1.936 1.356 1.936h4.842c.58 0 1.162.388 1.549.775.194.58 0 1.162-.387 1.55l-.387.387L13.77 71.468s-.387.387-.58.387c-.388.194-.581.194-.969 0-.194-.193-.387-.387-.194-.775 0-.193.194-.58.194-.58l8.328-17.238.194-.581c.581-1.162 0-2.13-1.162-2.324h-6.972c-.969-.194-1.55-.969-1.162-1.937 0-.194.387-.58.387-.58l10.458-17.432s.194-.194.194-.387c.581-.969-.194-1.937-1.355-2.13h-6.779c-.969 0-1.55-.388-1.55-1.163 0-.387 0-.775.194-.968l3.099-5.617 10.458-18.4.194-.387C27.328.388 28.103 0 29.46 0z"/></g><defs><clipPath id="clip0_15940_7336"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/drift-light.svg b/web/packages/design/src/ResourceIcon/assets/drift-light.svg
index bf20aa24d43e5..63d5ea2c9ba57 100644
--- a/web/packages/design/src/ResourceIcon/assets/drift-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/drift-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7336)">
-<path d="M58.7041 0.387845C58.8976 0.387845 59.285 0.387845 59.4789 0.387845C60.4472 0.581525 61.028 1.54992 60.4471 2.32463C60.2533 2.51831 60.2533 2.71199 60.0597 2.71199L42.2413 23.0482C42.2413 23.0482 41.8539 23.4356 41.8539 23.6292C41.273 24.5976 41.8539 25.566 43.2096 25.7597C43.4035 25.7597 43.7909 25.7597 43.7909 25.7597H49.9884C49.9884 25.7597 50.3757 25.7597 50.5696 25.7597C51.7314 25.9534 52.3127 26.9218 51.7314 27.8902C51.5379 28.0838 51.1505 28.4712 51.1505 28.4712L37.9804 43.3843C37.7869 43.5782 37.593 43.7717 37.593 43.9656C37.0121 44.9339 37.593 45.9022 38.9487 45.9022C39.3361 45.9022 43.4035 45.9022 43.7909 45.9022C44.3718 45.9022 44.953 46.2896 45.34 46.6769C45.5339 47.2578 45.3401 47.8391 44.953 48.2265C44.7591 48.42 44.5656 48.6139 44.5656 48.6139L13.7705 71.4677C13.7705 71.4677 13.3831 71.8551 13.1896 71.8551C12.8022 72.049 12.6087 72.049 12.2213 71.8551C12.0275 71.6616 11.8339 71.4677 12.0275 71.0803C12.0275 70.8868 12.2213 70.4994 12.2213 70.4994L20.5493 53.2622L20.7432 52.6809C21.3241 51.5188 20.7432 50.5505 19.581 50.357C19.3871 50.357 19.1936 50.357 19.1936 50.357H13.3831C13.1896 50.357 12.9958 50.357 12.6087 50.357C11.6401 50.1631 11.0592 49.3883 11.4466 48.42C11.4466 48.2265 11.8339 47.8391 11.8339 47.8391L22.2924 30.408C22.2924 30.408 22.4862 30.2143 22.4862 30.0206C23.0671 29.0522 22.2924 28.0838 21.1306 27.8902C20.5493 27.8902 19.581 27.8902 19.581 27.8902C19.581 27.8902 16.8696 27.8902 14.9327 27.8902H14.3518C13.3831 27.8902 12.8022 27.5028 12.8022 26.7281C12.8022 26.3407 12.8022 25.9534 12.9958 25.7597L16.0949 20.143L26.5533 1.74359L26.7472 1.35624C27.3281 0.387845 28.1029 0.000488281 29.4585 0.000488281L58.7041 0.387845Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7336">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7336)"><path fill="#000" d="M58.704.388h.775c.968.194 1.549 1.162.968 1.937-.194.193-.194.387-.387.387L42.24 23.048s-.387.388-.387.581c-.581.969 0 1.937 1.356 2.13h7.36c1.161.194 1.743 1.163 1.161 2.131l-.58.581-13.17 14.913c-.194.194-.388.388-.388.582-.58.968 0 1.936 1.356 1.936h4.842c.58 0 1.162.388 1.549.775.194.58 0 1.162-.387 1.55l-.387.387L13.77 71.468s-.387.387-.58.387c-.388.194-.581.194-.969 0-.194-.193-.387-.387-.194-.775 0-.193.194-.58.194-.58l8.328-17.238.194-.581c.581-1.162 0-2.13-1.162-2.324h-6.972c-.969-.194-1.55-.969-1.162-1.937 0-.194.387-.58.387-.58l10.458-17.432s.194-.194.194-.387c.581-.969-.194-1.937-1.355-2.13h-6.779c-.969 0-1.55-.388-1.55-1.163 0-.387 0-.775.194-.968l3.099-5.617 10.458-18.4.194-.387C27.328.388 28.103 0 29.46 0z"/></g><defs><clipPath id="clip0_15940_7336"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/dropbox.svg b/web/packages/design/src/ResourceIcon/assets/dropbox.svg
index 9368d04ce78a1..32ee6cbb6b5ec 100644
--- a/web/packages/design/src/ResourceIcon/assets/dropbox.svg
+++ b/web/packages/design/src/ResourceIcon/assets/dropbox.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M17.9992 5.4751L0 16.9218L17.9992 28.3685L36.0015 16.9218L54.0009 28.3685L72 16.9218L54.0009 5.4751L36.0015 16.9218L17.9992 5.4751Z" fill="#0061FE"/>
-<path d="M17.9992 51.2619L0 39.815L17.9992 28.3682L36.0015 39.815L17.9992 51.2619Z" fill="#0061FE"/>
-<path d="M36.001 39.815L54.0004 28.3682L71.9995 39.815L54.0004 51.2619L36.001 39.815Z" fill="#0061FE"/>
-<path d="M36.0022 66.5242L18 55.0775L36.0022 43.6309L54.0016 55.0775L36.0022 66.5242Z" fill="#0061FE"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0061fe" d="M18 5.475 0 16.922l18 11.447 18.002-11.447L54 28.369l18-11.447L54 5.475 36.003 16.922z"/><path fill="#0061fe" d="M18 51.262 0 39.815l18-11.447 18.002 11.447z"/><path fill="#0061fe" d="m36.001 39.815 18-11.447L72 39.815 54 51.262zm.001 26.709L18 55.078 36.002 43.63l18 11.447z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/duo-dark.svg b/web/packages/design/src/ResourceIcon/assets/duo-dark.svg
index 6dbcf8ef55b60..e6d2180c48696 100644
--- a/web/packages/design/src/ResourceIcon/assets/duo-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/duo-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 0.000488281H40C57.6731 0.000488281 72 14.3274 72 32.0005V34.0005H0V0.000488281Z" fill="white"/>
-<path d="M0 38.0005H72V40.0005C72 57.6736 57.6731 72.0005 40 72.0005H0V38.0005Z" fill="white" fill-opacity="0.72"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M0 0h40c17.673 0 32 14.327 32 32v2H0z"/><path fill="#fff" fill-opacity=".72" d="M0 38h72v2c0 17.674-14.327 32-32 32H0z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/duo-light.svg b/web/packages/design/src/ResourceIcon/assets/duo-light.svg
index 9001a7383adf0..1435d4db47053 100644
--- a/web/packages/design/src/ResourceIcon/assets/duo-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/duo-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 0.000488281H40C57.6731 0.000488281 72 14.3274 72 32.0005V34.0005H0V0.000488281Z" fill="#74BF4B"/>
-<path d="M0 38.0005H72V40.0005C72 57.6736 57.6731 72.0005 40 72.0005H0V38.0005Z" fill="#89C966"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#74bf4b" d="M0 0h40c17.673 0 32 14.327 32 32v2H0z"/><path fill="#89c966" d="M0 38h72v2c0 17.674-14.327 32-32 32H0z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/dynamo.svg b/web/packages/design/src/ResourceIcon/assets/dynamo.svg
index f26fce0bb9358..54fca23f30fc9 100644
--- a/web/packages/design/src/ResourceIcon/assets/dynamo.svg
+++ b/web/packages/design/src/ResourceIcon/assets/dynamo.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M45.0849 71.8757H45.9588L60.2224 64.742L60.4598 64.4064V7.46508L60.2224 7.12775L45.9588 0H45.0742L45.0849 71.8757Z" fill="#5294CF"/>
-<path d="M26.5226 71.8757H25.6366L11.3851 64.742L11.0959 64.2444L10.9492 7.75507L11.3851 7.12775L25.6366 0H26.5336L26.5226 71.8757Z" fill="#1F5B98"/>
-<path d="M25.6621 0H45.9452V71.8757H25.6621V0Z" fill="#2D72B8"/>
-<path d="M67.6891 34.3233L67.2071 34.2164L60.325 33.5746L60.2229 33.6254L45.9465 33.0544H25.6625L11.3859 33.6254V22.7372L11.3709 22.7452L11.3859 22.7133L25.6625 19.4048H45.9465L60.2229 22.7133L65.4711 25.5034V23.7096L67.6891 23.4669L67.4594 23.019L60.4368 17.9967L60.2229 18.0662L45.9465 13.6418H25.6625L11.3859 18.0662V7.12793L3.91992 15.8758V23.5158L3.97771 23.4739L6.13789 23.7096V25.5402L3.91992 26.7274V34.3292L3.97771 34.3233L6.13789 34.3551V37.5458L4.27414 37.5737L3.91992 37.5398V45.1447L6.13789 46.3375V48.1894L4.01284 48.424L3.91992 48.3543V55.993L11.3859 64.7421V53.8049L25.6625 58.2292H45.9465L60.265 53.7919L60.4553 53.8754L67.3854 48.927L67.6891 48.434L65.4711 48.1894V46.3747L65.1804 46.2586L60.4368 48.8159L60.265 49.1747L45.9465 52.464V52.468H25.6625V52.464L11.3859 49.1607V38.2327L25.6625 38.8017V38.8157H45.9465L60.2229 38.2327L60.5479 38.3822L67.2185 37.8077L67.6891 37.5777L65.4711 37.5458V34.3551L67.6891 34.3233Z" fill="#1A476F"/>
-<path d="M60.2227 53.8049V64.7421L67.6889 55.993V48.4041L60.2658 53.7919L60.2227 53.8049ZM60.2227 49.1847L60.2658 49.1747L67.6889 45.1815V37.5458L60.2227 38.2327V49.1847ZM60.2658 22.7233L60.2227 22.7133V33.6254L67.6889 34.3233V26.6913L60.2658 22.7233ZM60.2658 18.109L67.6889 23.4669V15.8778L60.2227 7.12793V18.0662L60.2658 18.0811V18.109Z" fill="#2D72B8"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#5294cf" d="M45.085 71.876h.874l14.263-7.134.238-.336V7.466l-.238-.338L45.96 0h-.885z"/><path fill="#1f5b98" d="M26.523 71.876h-.886l-14.252-7.134-.29-.498-.146-56.489.436-.627L25.637 0h.897z"/><path fill="#2d72b8" d="M25.662 0h20.283v71.876H25.662z"/><path fill="#1a476f" d="m67.69 34.323-.483-.107-6.882-.641-.102.05-14.276-.57H25.663l-14.277.57V22.737l-.015.008.015-.032 14.277-3.308h20.284l14.276 3.308 5.248 2.79V23.71l2.218-.243-.23-.448-7.022-5.022-.214.07-14.276-4.425H25.663l-14.277 4.424V7.128L3.92 15.876v7.64l.058-.042 2.16.236v1.83L3.92 26.727v7.602l.058-.006 2.16.032v3.19l-1.864.029-.354-.034v7.605l2.218 1.192v1.852l-2.125.235-.093-.07v7.639l7.466 8.75V53.804l14.277 4.424h20.284l14.318-4.437.19.083 6.93-4.948.304-.493-2.218-.245v-1.814l-.29-.116-4.744 2.557-.172.359-14.318 3.289v.004H25.663v-.004L11.386 49.16V38.233l14.277.569v.014h20.284l14.276-.583.325.15 6.67-.575.471-.23-2.218-.032v-3.19z"/><path fill="#2d72b8" d="M60.223 53.805v10.937l7.466-8.749v-7.589l-7.423 5.388zm0-4.62.043-.01 7.423-3.993v-7.636l-7.466.687zm.043-26.462-.043-.01v10.912l7.466.698v-7.632zm0-4.614 7.423 5.358v-7.59l-7.466-8.75v10.94l.043.014z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ec2.svg b/web/packages/design/src/ResourceIcon/assets/ec2.svg
index 29ef54d1a1da0..1c82e0a30cc37 100644
--- a/web/packages/design/src/ResourceIcon/assets/ec2.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ec2.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M7.6599 13.4082L4.5 14.904V57.096L7.6599 58.5918L20.448 37.0935L7.6599 13.4082Z" fill="#9D5025"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M15.0249 56.9565L7.66016 58.5918V13.4082L15.0249 15.0003V56.9565Z" fill="#F58536"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M11.1436 11.7547L15.0244 9.92676L33.4591 37.8979L15.0244 62.0728L11.1436 60.2449V11.7547Z" fill="#9D5025"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.2089 59.6149L15.0244 62.0728V9.92676L24.2089 12.3928V59.6149Z" fill="#F58536"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.3486 7.8712L24.2086 5.5708L51.403 40.9588L24.2086 66.4279L19.3486 64.1275V7.8712Z" fill="#9D5025"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.99 62.3527L24.209 66.4288V5.5708L35.99 9.655V62.3527Z" fill="#F58536"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.707 2.9736L35.9908 0L65.4118 38.0376L35.9908 72L29.707 69.0264V2.9736Z" fill="#9D5025"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M67.4992 57.0879L35.9902 72V0L67.4992 14.913V57.0879Z" fill="#F58536"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#9d5025" fill-rule="evenodd" d="M7.66 13.408 4.5 14.904v42.192l3.16 1.496 12.788-21.498z" clip-rule="evenodd"/><path fill="#f58536" fill-rule="evenodd" d="M15.025 56.957 7.66 58.592V13.408L15.025 15z" clip-rule="evenodd"/><path fill="#9d5025" fill-rule="evenodd" d="m11.144 11.755 3.88-1.828 18.435 27.97-18.435 24.176-3.88-1.828z" clip-rule="evenodd"/><path fill="#f58536" fill-rule="evenodd" d="m24.209 59.615-9.185 2.458V9.927l9.185 2.466z" clip-rule="evenodd"/><path fill="#9d5025" fill-rule="evenodd" d="m19.349 7.871 4.86-2.3 27.194 35.388-27.194 25.469-4.86-2.3z" clip-rule="evenodd"/><path fill="#f58536" fill-rule="evenodd" d="m35.99 62.353-11.781 4.076V5.57L35.99 9.655z" clip-rule="evenodd"/><path fill="#9d5025" fill-rule="evenodd" d="M29.707 2.974 35.991 0l29.42 38.038L35.992 72l-6.284-2.974z" clip-rule="evenodd"/><path fill="#f58536" fill-rule="evenodd" d="M67.5 57.088 35.99 72V0L67.5 14.913z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/eks.svg b/web/packages/design/src/ResourceIcon/assets/eks.svg
index 7ba86b3c6fb08..4840d7e2ca839 100644
--- a/web/packages/design/src/ResourceIcon/assets/eks.svg
+++ b/web/packages/design/src/ResourceIcon/assets/eks.svg
@@ -1,39 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6706_29487)">
-<mask id="mask0_6706_29487" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="29" y="24" width="17" height="22">
-<path d="M29.1719 24.715H32.1281V33.4343L40.6407 24.715H44.5433L35.2028 34.3217L45.1338 45.4067H41.3508L32.1282 35.0611V45.4067H29.1721L29.1719 24.715Z" fill="white"/>
-</mask>
-<g mask="url(#mask0_6706_29487)">
-<path d="M29.1719 24.715H32.1281V33.4343L40.6407 24.715H44.5433L35.2028 34.3217L45.1338 45.4067H41.3508L32.1282 35.0611V45.4067H29.1721V24.7149" fill="url(#paint0_linear_6706_29487)"/>
-</g>
-<mask id="mask1_6706_29487" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="38" y="0" width="30" height="51">
-<path d="M38.4326 16.5033L52.9916 24.9088C53.1135 24.9795 53.2147 25.0809 53.2851 25.2029C53.3555 25.3249 53.3926 25.4633 53.3927 25.6042V42.4156C53.3927 42.7022 53.5468 42.9674 53.7948 43.1109L66.7871 50.6124C67.3225 50.9218 67.9917 50.5341 67.9917 49.9171V17.1748C67.9917 16.8882 67.8387 16.6233 67.5913 16.4796L39.2369 0.108929C38.7014 -0.200066 38.0312 0.187267 38.0312 0.805256V15.808C38.0312 16.0953 38.1846 16.3595 38.4334 16.5033H38.4326Z" fill="white"/>
-</mask>
-<g mask="url(#mask1_6706_29487)">
-<path d="M38.4326 16.5033L52.9916 24.9088C53.1135 24.9795 53.2147 25.0809 53.2851 25.2029C53.3555 25.3249 53.3926 25.4633 53.3927 25.6042V42.4156C53.3927 42.7022 53.5468 42.9674 53.7948 43.1109L66.7871 50.6124C67.3225 50.9218 67.9917 50.5341 67.9917 49.9171V17.1748C67.9917 16.8882 67.8387 16.6233 67.5913 16.4796L39.2369 0.108929C38.7014 -0.200066 38.0312 0.187267 38.0312 0.805256V15.808C38.0312 16.0953 38.1846 16.3595 38.4334 16.5033" fill="url(#paint1_linear_6706_29487)"/>
-</g>
-<mask id="mask2_6706_29487" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="4" y="-1" width="62" height="73">
-<path d="M50.9597 46.629L36.4007 55.0346C36.1527 55.1784 35.8458 55.1784 35.5977 55.0346L19.0072 45.4561C18.8851 45.3854 18.7837 45.2838 18.7131 45.1616C18.6425 45.0394 18.6053 44.9009 18.6051 44.7598V25.6023C18.6054 25.4614 18.6427 25.3229 18.7133 25.2009C18.7838 25.0789 18.8852 24.9775 19.0073 24.907L33.5663 16.502C33.6884 16.4316 33.7899 16.3304 33.8604 16.2084C33.9309 16.0864 33.9681 15.948 33.9682 15.807V0.804085C33.9682 0.186096 33.2984 -0.200363 32.7629 0.107765L4.4082 16.4793C4.15996 16.6231 4.00781 16.888 4.00781 17.1746V53.1895C4.00781 53.4767 4.16083 53.741 4.4082 53.8858L35.5977 71.8921C35.8457 72.036 36.1526 72.036 36.4007 71.8921L64.7553 55.522C65.2908 55.2126 65.2908 54.4398 64.7553 54.1307L51.7631 46.629C51.5139 46.4853 51.2079 46.4853 50.9597 46.629Z" fill="white"/>
-</mask>
-<g mask="url(#mask2_6706_29487)">
-<path d="M50.9597 46.629L36.4007 55.0346C36.1527 55.1784 35.8458 55.1784 35.5977 55.0346L19.0072 45.4561C18.8851 45.3854 18.7837 45.2838 18.7131 45.1616C18.6425 45.0394 18.6053 44.9009 18.6051 44.7598V25.6023C18.6054 25.4614 18.6427 25.3229 18.7133 25.2009C18.7838 25.0789 18.8852 24.9775 19.0073 24.907L33.5663 16.502C33.6884 16.4316 33.7898 16.3304 33.8604 16.2084C33.9309 16.0864 33.9681 15.948 33.9682 15.807V0.804092C33.9682 0.186104 33.2984 -0.200363 32.7629 0.107765L4.4082 16.4794C4.15996 16.6231 4.00781 16.888 4.00781 17.1746V53.1895C4.00781 53.4767 4.16083 53.741 4.4082 53.8858L35.5977 71.8921C35.8457 72.036 36.1526 72.036 36.4007 71.8921L64.7553 55.522C65.2908 55.2127 65.2908 54.4398 64.7553 54.1307L51.7631 46.629C51.5139 46.4853 51.2079 46.4853 50.9597 46.629Z" fill="url(#paint2_linear_6706_29487)"/>
-</g>
-</g>
-<defs>
-<linearGradient id="paint0_linear_6706_29487" x1="42.8139" y1="44.8748" x2="30.1142" y2="23.9491" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4F66B9"/>
-<stop offset="1" stop-color="#484FAB"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6706_29487" x1="71.1604" y1="47.8197" x2="42.3727" y2="-1.74721" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4F66B9"/>
-<stop offset="1" stop-color="#484FAB"/>
-</linearGradient>
-<linearGradient id="paint2_linear_6706_29487" x1="42.5466" y1="68.0684" x2="11.158" y2="12.6514" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C68BB"/>
-<stop offset="1" stop-color="#5180C9"/>
-</linearGradient>
-<clipPath id="clip0_6706_29487">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6706_29487)"><mask id="mask0_6706_29487" width="17" height="22" x="29" y="24" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M29.172 24.715h2.956v8.72l8.513-8.72h3.902l-9.34 9.607 9.93 11.085h-3.782L32.128 35.06v10.346h-2.956z"/></mask><g mask="url(#mask0_6706_29487)"><path fill="url(#paint0_linear_6706_29487)" d="M29.172 24.715h2.956v8.72l8.513-8.72h3.902l-9.34 9.607 9.93 11.085h-3.782L32.128 35.06v10.346h-2.956z"/></g><mask id="mask1_6706_29487" width="30" height="51" x="38" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="m38.433 16.503 14.559 8.406a.8.8 0 0 1 .4.695v16.812c0 .286.155.551.403.695l12.992 7.501a.803.803 0 0 0 1.205-.695V17.175a.8.8 0 0 0-.4-.695L39.236.109a.804.804 0 0 0-1.206.696v15.003c0 .287.154.552.402.695"/></mask><g mask="url(#mask1_6706_29487)"><path fill="url(#paint1_linear_6706_29487)" d="m38.433 16.503 14.559 8.406a.8.8 0 0 1 .4.695v16.812c0 .286.155.551.403.695l12.992 7.501a.803.803 0 0 0 1.205-.695V17.175a.8.8 0 0 0-.4-.695L39.236.109a.804.804 0 0 0-1.206.696v15.003c0 .287.154.552.402.695"/></g><mask id="mask2_6706_29487" width="62" height="73" x="4" y="-1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M50.96 46.629 36.4 55.035a.8.8 0 0 1-.802 0l-16.59-9.579a.8.8 0 0 1-.403-.696V25.602a.8.8 0 0 1 .402-.695l14.56-8.405a.8.8 0 0 0 .401-.695V.804a.804.804 0 0 0-1.205-.696L4.408 16.479a.8.8 0 0 0-.4.696V53.19c0 .287.153.551.4.696l31.19 18.006a.8.8 0 0 0 .803 0l28.354-16.37a.803.803 0 0 0 0-1.391l-12.992-7.502a.8.8 0 0 0-.803 0"/></mask><g mask="url(#mask2_6706_29487)"><path fill="url(#paint2_linear_6706_29487)" d="M50.96 46.629 36.4 55.035a.8.8 0 0 1-.802 0l-16.59-9.579a.8.8 0 0 1-.403-.696V25.602a.8.8 0 0 1 .402-.695l14.56-8.405a.8.8 0 0 0 .401-.695V.804a.804.804 0 0 0-1.205-.696L4.408 16.479a.8.8 0 0 0-.4.696V53.19c0 .287.153.551.4.696l31.19 18.006a.8.8 0 0 0 .803 0l28.354-16.37a.803.803 0 0 0 0-1.391l-12.992-7.502a.8.8 0 0 0-.803 0"/></g></g><defs><linearGradient id="paint0_linear_6706_29487" x1="42.814" x2="30.114" y1="44.875" y2="23.949" gradientUnits="userSpaceOnUse"><stop stop-color="#4f66b9"/><stop offset="1" stop-color="#484fab"/></linearGradient><linearGradient id="paint1_linear_6706_29487" x1="71.16" x2="42.373" y1="47.82" y2="-1.747" gradientUnits="userSpaceOnUse"><stop stop-color="#4f66b9"/><stop offset="1" stop-color="#484fab"/></linearGradient><linearGradient id="paint2_linear_6706_29487" x1="42.547" x2="11.158" y1="68.068" y2="12.651" gradientUnits="userSpaceOnUse"><stop stop-color="#4c68bb"/><stop offset="1" stop-color="#5180c9"/></linearGradient><clipPath id="clip0_6706_29487"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/elastic.svg b/web/packages/design/src/ResourceIcon/assets/elastic.svg
index 5aab370297e73..d2206cbb41a09 100644
--- a/web/packages/design/src/ResourceIcon/assets/elastic.svg
+++ b/web/packages/design/src/ResourceIcon/assets/elastic.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6734_29892)">
-<path d="M72 37.7208C72.0067 34.7992 71.1103 31.9469 69.4326 29.5548C67.7553 27.1627 65.3792 25.3477 62.6301 24.3586C62.8804 23.0835 63.0063 21.7871 63.0068 20.4877C63.0093 16.1864 61.6475 11.9953 59.1178 8.51666C56.5881 5.03806 53.0205 2.45123 48.9277 1.1281C44.8354 -0.195036 40.4285 -0.186317 36.3411 1.153C32.2537 2.49232 28.6963 5.09326 26.1803 8.58182C24.3241 7.14345 22.0498 6.34913 19.7017 6.31929C17.3536 6.28945 15.0597 7.02565 13.1676 8.41635C11.2754 9.80709 9.88804 11.7766 9.21558 14.0266C8.54316 16.2765 8.62229 18.6843 9.44101 20.8852C6.68543 21.8896 4.30355 23.7138 2.61569 26.1124C0.927856 28.511 0.0150461 31.3689 4.82473e-05 34.3018C-0.00759797 37.2335 0.893758 40.0955 2.58002 42.4936C4.26626 44.8919 6.6545 46.7085 9.4159 47.6932C9.17147 48.9679 9.04676 50.2623 9.04346 51.56C9.03935 55.8561 10.3998 60.0426 12.9285 63.5161C15.4572 66.989 19.0236 69.5694 23.1135 70.8851C27.2034 72.2004 31.6054 72.1833 35.6847 70.8353C39.7641 69.4878 43.31 66.8794 45.8113 63.3863C47.6623 64.8284 49.9325 65.6273 52.2785 65.6625C54.6246 65.6976 56.9178 64.9665 58.8106 63.5805C60.7039 62.1941 62.0932 60.2285 62.7678 57.9816C63.4428 55.7344 63.3667 53.3289 62.5506 51.129C65.3076 50.1263 67.6913 48.3025 69.3798 45.9038C71.0688 43.505 71.9815 40.6461 71.9958 37.7124" fill="white"/>
-<path d="M28.3063 31.0333L44.0622 38.227L59.9645 24.2999C60.1934 23.1507 60.3073 21.9815 60.3035 20.8097C60.3027 17.0162 59.0878 13.3225 56.8364 10.2691C54.5854 7.21575 51.4162 4.96302 47.7921 3.84056C44.1685 2.71809 40.2808 2.78483 36.6978 4.031C33.1147 5.27717 30.0246 7.63733 27.8795 10.7662L25.2305 24.4673L28.3063 31.0333Z" fill="#FEC514"/>
-<path d="M11.9977 47.7183C11.7654 48.8854 11.6491 50.0727 11.6504 51.2628C11.6505 55.0723 12.8716 58.7813 15.1346 61.8454C17.3976 64.91 20.5832 67.1681 24.224 68.2888C27.8647 69.4095 31.7689 69.3337 35.3634 68.0724C38.9579 66.8116 42.0536 64.4312 44.1958 61.2813L46.8197 47.6095L43.317 40.9138L27.5025 33.7075L11.9977 47.7183Z" fill="#00BFB3"/>
-<path d="M11.9014 20.4542L22.6982 23.0028L25.0627 10.7245C23.5941 9.61096 21.8044 9.00307 19.9615 8.99186C18.1185 8.9806 16.3215 9.56669 14.8395 10.6623C13.3576 11.7578 12.2704 13.304 11.7407 15.0692C11.211 16.8344 11.2674 18.7237 11.9014 20.4542Z" fill="#F04E98"/>
-<path d="M10.9646 23.0234C8.59562 23.8228 6.53467 25.3406 5.06839 27.3657C3.60209 29.3907 2.80334 31.8224 2.78321 34.3225C2.7815 36.7388 3.51528 39.0983 4.88698 41.0874C6.25864 43.0767 8.20329 44.6012 10.4624 45.4583L25.6115 31.7655L22.8286 25.8231L10.9646 23.0234Z" fill="#1BA9F5"/>
-<path d="M46.9668 61.2812C48.4332 62.3889 50.2184 62.9932 52.056 63.0029C53.8935 63.0125 55.685 62.4279 57.1627 61.3356C58.6408 60.2434 59.7255 58.7021 60.2557 56.9424C60.7855 55.1831 60.7319 53.2991 60.103 51.5724L49.3145 49.0615L46.9668 61.2812Z" fill="#93C90E"/>
-<path d="M49.159 46.2199L61.0355 48.9944C63.4058 48.1972 65.4681 46.6802 66.9349 44.6543C68.4017 42.6289 69.1993 40.1961 69.2169 37.6954C69.2148 35.2842 68.4795 32.9307 67.109 30.9471C65.738 28.9635 63.7967 27.4435 61.5419 26.5889L46.0078 40.1896L49.159 46.2199Z" fill="#0077CC"/>
-</g>
-<defs>
-<clipPath id="clip0_6734_29892">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6734_29892)"><path fill="#fff" d="M72 37.72a14.16 14.16 0 0 0-9.37-13.361c.25-1.276.376-2.572.377-3.871A20.334 20.334 0 0 0 26.18 8.582 10.8 10.8 0 0 0 9.441 20.885 14.36 14.36 0 0 0 0 34.302a14.18 14.18 0 0 0 9.416 13.391 21 21 0 0 0-.373 3.867 20.28 20.28 0 0 0 26.642 19.275 20.28 20.28 0 0 0 10.126-7.449 10.785 10.785 0 0 0 16.74-12.257 14.35 14.35 0 0 0 9.445-13.417"/><path fill="#fec514" d="m28.306 31.033 15.756 7.194L59.965 24.3a17.6 17.6 0 0 0 .338-3.49A17.767 17.767 0 0 0 27.88 10.766l-2.65 13.701z"/><path fill="#00bfb3" d="M11.998 47.718a18 18 0 0 0-.348 3.545A17.814 17.814 0 0 0 44.196 61.28l2.624-13.67-3.503-6.695-15.814-7.206z"/><path fill="#f04e98" d="m11.901 20.454 10.797 2.549 2.365-12.278a8.529 8.529 0 0 0-13.162 9.73"/><path fill="#1ba9f5" d="M10.965 23.023a12.03 12.03 0 0 0-8.182 11.3 11.9 11.9 0 0 0 7.68 11.135l15.149-13.692-2.783-5.943z"/><path fill="#93c90e" d="M46.967 61.281a8.518 8.518 0 0 0 13.289-4.339 8.5 8.5 0 0 0-.153-5.37l-10.788-2.51z"/><path fill="#07c" d="m49.159 46.22 11.877 2.774a12.01 12.01 0 0 0 8.18-11.299 11.89 11.89 0 0 0-7.674-11.106l-15.534 13.6z"/></g><defs><clipPath id="clip0_6734_29892"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/email-dark.svg b/web/packages/design/src/ResourceIcon/assets/email-dark.svg
index 65630b9a90a51..de303c8ac09ae 100644
--- a/web/packages/design/src/ResourceIcon/assets/email-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/email-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M0 17C0 12.0294 4.02944 8 9 8H63C67.9706 8 72 12.0294 72 17V55C72 59.9706 67.9706 64 63 64H9C4.02944 64 0 59.9706 0 55V17ZM2 17C2 13.134 5.13401 10 9 10H63C66.866 10 70 13.134 70 17V17.9525C70 20.3911 68.7309 22.6539 66.6501 23.9255L39.6501 40.4255C37.4094 41.7948 34.5906 41.7948 32.3498 40.4255L5.34985 23.9255C3.26907 22.6539 2 20.3911 2 17.9525V17ZM70 23.6095V55C70 58.866 66.866 62 63 62H9C5.13401 62 2 58.866 2 55V23.6095C2.63832 24.3995 3.41457 25.0867 4.30695 25.632L31.3069 42.132C34.188 43.8926 37.812 43.8926 40.693 42.132L67.693 25.632C68.5854 25.0867 69.3617 24.3995 70 23.6095Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M0 17a9 9 0 0 1 9-9h54a9 9 0 0 1 9 9v38a9 9 0 0 1-9 9H9a9 9 0 0 1-9-9zm2 0a7 7 0 0 1 7-7h54a7 7 0 0 1 7 7v.953a7 7 0 0 1-3.35 5.973l-27 16.5a7 7 0 0 1-7.3 0l-27-16.5A7 7 0 0 1 2 17.953zm68 6.61V55a7 7 0 0 1-7 7H9a7 7 0 0 1-7-7V23.61a9 9 0 0 0 2.307 2.022l27 16.5a9 9 0 0 0 9.386 0l27-16.5A9 9 0 0 0 70 23.609" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/email-light.svg b/web/packages/design/src/ResourceIcon/assets/email-light.svg
index e397b02003ce9..40c1eda71fcb0 100644
--- a/web/packages/design/src/ResourceIcon/assets/email-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/email-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M0 17C0 12.0294 4.02944 8 9 8H63C67.9706 8 72 12.0294 72 17V55C72 59.9706 67.9706 64 63 64H9C4.02944 64 0 59.9706 0 55V17ZM2 17C2 13.134 5.13401 10 9 10H63C66.866 10 70 13.134 70 17V17.9525C70 20.3911 68.7309 22.6539 66.6501 23.9255L39.6501 40.4255C37.4094 41.7948 34.5906 41.7948 32.3498 40.4255L5.34985 23.9255C3.26907 22.6539 2 20.3911 2 17.9525V17ZM70 23.6095V55C70 58.866 66.866 62 63 62H9C5.13401 62 2 58.866 2 55V23.6095C2.63832 24.3995 3.41457 25.0867 4.30695 25.632L31.3069 42.132C34.188 43.8926 37.812 43.8926 40.693 42.132L67.693 25.632C68.5854 25.0867 69.3617 24.3995 70 23.6095Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M0 17a9 9 0 0 1 9-9h54a9 9 0 0 1 9 9v38a9 9 0 0 1-9 9H9a9 9 0 0 1-9-9zm2 0a7 7 0 0 1 7-7h54a7 7 0 0 1 7 7v.953a7 7 0 0 1-3.35 5.973l-27 16.5a7 7 0 0 1-7.3 0l-27-16.5A7 7 0 0 1 2 17.953zm68 6.61V55a7 7 0 0 1-7 7H9a7 7 0 0 1-7-7V23.61a9 9 0 0 0 2.307 2.022l27 16.5a9 9 0 0 0 9.386 0l27-16.5A9 9 0 0 0 70 23.609" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/entra-id.svg b/web/packages/design/src/ResourceIcon/assets/entra-id.svg
index 0ed35fb73bcf4..0d6fedf14d16a 100644
--- a/web/packages/design/src/ResourceIcon/assets/entra-id.svg
+++ b/web/packages/design/src/ResourceIcon/assets/entra-id.svg
@@ -1,9 +1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="uuid-f8d4d392-7c12-4bd9-baff-66fbf7814b91" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
-  <path d="m3.802,14.032c.388.242,1.033.511,1.715.511.621,0,1.198-.18,1.676-.487,0,0,.001,0,.002-.001l1.805-1.128v4.073c-.286,0-.574-.078-.824-.234l-4.374-2.734Z" fill="#225086"/>
-  <path d="m7.853,1.507L.353,9.967c-.579.654-.428,1.642.323,2.111,0,0,2.776,1.735,3.126,1.954.388.242,1.033.511,1.715.511.621,0,1.198-.18,1.676-.487,0,0,.001,0,.002-.001l1.805-1.128-4.364-2.728,4.365-4.924V1s0,0,0,0c-.424,0-.847.169-1.147.507Z" fill="#6df"/>
-  <polygon points="4.636 10.199 4.688 10.231 9 12.927 9.001 12.927 9.001 12.927 9.001 5.276 9 5.275 4.636 10.199" fill="#cbf8ff"/>
-  <path d="m17.324,12.078c.751-.469.902-1.457.323-2.111l-4.921-5.551c-.397-.185-.842-.291-1.313-.291-.925,0-1.752.399-2.302,1.026l-.109.123h0s4.364,4.924,4.364,4.924h0s0,0,0,0l-4.365,2.728v4.073c.287,0,.573-.078.823-.234l7.5-4.688Z" fill="#074793"/>
-  <path d="m9.001,1v4.275s.109-.123.109-.123c.55-.627,1.377-1.026,2.302-1.026.472,0,.916.107,1.313.291l-2.579-2.909c-.299-.338-.723-.507-1.146-.507Z" fill="#0294e4"/>
-  <polygon points="13.365 10.199 13.365 10.199 13.365 10.199 9.001 5.276 9.001 12.926 13.365 10.199" fill="#96bcc2"/>
-</svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" data-name="Layer 1" viewBox="0 0 18 18"><path fill="#225086" d="M3.802 14.032c.388.242 1.033.511 1.715.511.621 0 1.198-.18 1.676-.487l.002-.001L9 12.927V17a1.56 1.56 0 0 1-.824-.234z"/><path fill="#6df" d="m7.853 1.507-7.5 8.46c-.579.654-.428 1.642.323 2.111l3.126 1.954c.388.242 1.033.511 1.715.511.621 0 1.198-.18 1.676-.487l.002-.001L9 12.927l-4.364-2.728 4.365-4.924V1c-.424 0-.847.169-1.147.507Z"/><path fill="#cbf8ff" d="m4.636 10.199.052.032L9 12.927h.001V5.276L9 5.275z"/><path fill="#074793" d="M17.324 12.078c.751-.469.902-1.457.323-2.111l-4.921-5.551a3.1 3.1 0 0 0-1.313-.291c-.925 0-1.752.399-2.302 1.026l-.109.123 4.364 4.924-4.365 2.728v4.073c.287 0 .573-.078.823-.234l7.5-4.688Z"/><path fill="#0294e4" d="M9.001 1v4.275l.109-.123a3.05 3.05 0 0 1 2.302-1.026c.472 0 .916.107 1.313.291l-2.579-2.909A1.52 1.52 0 0 0 9 1.001Z"/><path fill="#96bcc2" d="M13.365 10.199 9.001 5.276v7.65z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/eventbrite.svg b/web/packages/design/src/ResourceIcon/assets/eventbrite.svg
index ebb1891089b5e..18c0c8f697514 100644
--- a/web/packages/design/src/ResourceIcon/assets/eventbrite.svg
+++ b/web/packages/design/src/ResourceIcon/assets/eventbrite.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7348)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M31.6285 17.3938C39.5887 15.5914 47.5313 18.8564 51.9516 25.029L16.7776 32.9893C17.9891 25.5432 23.6682 19.1962 31.6285 17.3938ZM52.1496 46.6759C49.3681 50.7038 45.1677 53.5322 40.3895 54.5948C32.382 56.4061 24.3863 53.0879 19.9806 46.8355L55.2669 38.8516L61.014 37.5515L72 35.0635C71.933 32.7032 71.6261 30.3559 71.084 28.0577C66.6134 9.07011 47.283 -2.76979 27.9143 1.61218C8.53668 5.99711 -3.54257 24.9463 0.93101 43.9339C5.40459 62.9214 24.732 74.7584 44.1037 70.3764C55.521 67.7939 64.4002 60.1528 68.8531 50.4315L52.1467 46.6789L52.1496 46.6759Z" fill="#F05537"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7348">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7348)"><path fill="#f05537" fill-rule="evenodd" d="M31.629 17.394c7.96-1.803 15.902 1.462 20.323 7.635l-35.174 7.96c1.211-7.446 6.89-13.793 14.85-15.595m20.52 29.282a19.4 19.4 0 0 1-11.76 7.919c-8.007 1.811-16.003-1.507-20.408-7.76l35.286-7.983 5.747-1.3L72 35.063a35 35 0 0 0-.916-7.005C66.614 9.07 47.283-2.77 27.914 1.612 8.537 5.997-3.543 24.946.931 43.934 5.405 62.92 24.732 74.758 44.104 70.376 55.52 67.794 64.4 60.153 68.854 50.431L52.146 46.68z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15940_7348"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/excalidraw.svg b/web/packages/design/src/ResourceIcon/assets/excalidraw.svg
index 4b523b8bd27ac..f75f6886e5540 100644
--- a/web/packages/design/src/ResourceIcon/assets/excalidraw.svg
+++ b/web/packages/design/src/ResourceIcon/assets/excalidraw.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7303)">
-<path d="M71.8391 59.3458C71.776 59.2881 71.6989 59.2478 71.6154 59.2289C71.5319 59.21 71.445 59.2131 71.3631 59.238C67.5996 53.678 62.8121 48.4055 58.1772 43.3126L57.4138 42.4773C57.4138 42.3785 57.3689 42.2886 57.306 42.2078C57.23 42.1121 57.1212 42.048 57.0006 42.0281L56.8479 41.8665L56.7401 41.7856C56.6054 41.4982 56.2641 41.2826 55.8868 41.4713C54.4676 42.1988 53.1921 43.2407 51.9346 44.2018C50.255 45.4863 48.6112 46.8246 47.0663 48.2618C46.4375 48.8456 45.8178 49.4564 45.2968 50.1391C45.0453 50.4714 45.2339 50.7858 45.5393 50.9205C44.4435 51.9984 43.3387 53.1211 42.2339 54.2798C42.1351 54.3876 42.0812 54.5313 42.0902 54.6751C42.0992 54.8188 42.171 54.9535 42.2878 55.0433L44.2279 56.5254C44.2279 56.5254 44.2369 56.5523 44.2549 56.5613C47.0304 59.3009 51.8987 63.1003 57.0545 67.1244C57.818 67.7262 58.5904 68.328 59.3629 68.9298C59.7132 69.3519 60.0455 69.7741 60.3689 70.1873C60.5396 70.4118 60.8629 70.4568 61.0875 70.2861C61.2042 70.3759 61.321 70.4747 61.4378 70.5645C61.4909 70.6058 61.5516 70.6363 61.6164 70.6541C61.6812 70.6719 61.749 70.6768 61.8157 70.6685C61.8824 70.6601 61.9468 70.6387 62.0053 70.6055C62.0637 70.5722 62.1151 70.5278 62.1564 70.4747C62.2192 70.3939 62.2462 70.2951 62.2552 70.1963C62.2911 70.1963 62.318 70.2232 62.345 70.2232C62.4797 70.2232 62.6234 70.1693 62.7222 70.0615L71.8661 60.0734C71.9116 60.0242 71.9469 59.9664 71.9698 59.9034C71.9927 59.8404 72.0027 59.7734 71.9994 59.7065C71.996 59.6396 71.9793 59.574 71.9503 59.5136C71.9212 59.4532 71.8804 59.3992 71.8302 59.3548L71.8391 59.3458ZM45.5842 55.8876C45.6471 55.9685 45.71 56.0403 45.7729 56.1122C46.8148 56.9925 47.9286 57.9446 49.0603 58.9146L44.4615 55.4026C44.4615 55.4026 44.174 55.205 43.9944 55.0793C43.8956 55.0074 43.8058 54.9355 43.7159 54.8637L43.3746 54.5763C43.3746 54.5763 43.4375 54.5134 43.4644 54.4774L43.7788 54.1631C45.3238 52.6002 47.9735 49.9953 49.3388 48.7199C47.8927 50.175 44.9645 54.4415 45.5932 55.8876H45.5842ZM61.33 68.292L57.5395 65.3998C56.0575 63.8638 54.4586 62.3458 52.8329 60.8817C54.8808 62.4626 56.6323 63.801 56.8928 64.0345C58.8779 65.804 58.788 65.4806 60.1533 66.6483L61.7971 67.8429C61.6354 67.9867 61.4737 68.1393 61.321 68.2831L61.33 68.292ZM62.2821 69.0196L62.2102 68.9657C62.354 68.8489 62.5067 68.7412 62.6504 68.6244L62.2911 69.0196H62.2821ZM2.16439 10.366C2.29014 11.0127 2.4069 11.6504 2.52367 12.2612C3.14344 15.5846 3.7183 18.5757 4.81413 20.8482L5.24527 22.5728C5.41593 23.2284 5.65845 24.0458 5.88301 24.2165C8.44293 26.48 12.3681 29.8573 16.5628 33.037C16.7514 33.1807 17.0119 33.1717 17.1916 33.028C17.2006 33.046 17.2185 33.055 17.2275 33.0639C17.3263 33.1538 17.4431 33.1987 17.5688 33.1987C17.7125 33.1987 17.8473 33.1448 17.9461 33.028C23.3174 27.0549 27.3145 22.1416 30.1618 18.0278C30.3415 17.8032 30.4313 17.5427 30.4223 17.2733C30.602 17.0577 30.7906 16.8421 30.9613 16.6625C31.0132 16.6091 31.0526 16.5449 31.0767 16.4743C31.1007 16.4038 31.1087 16.3289 31.1001 16.2549C31.0915 16.1809 31.0665 16.1098 31.0269 16.0466C30.9874 15.9835 30.9343 15.93 30.8714 15.89C30.8604 15.7675 30.8063 15.653 30.7187 15.5667C29.4702 14.363 28.545 13.4918 27.6109 12.6205C25.9582 11.0756 24.2516 9.47673 20.6317 5.87488C20.6138 5.85691 20.5868 5.83895 20.5689 5.82098C20.5139 5.76397 20.4462 5.72086 20.3713 5.69523C19.3742 5.34493 17.3263 4.99463 14.7484 4.54552C10.9579 3.8988 5.76624 3.00058 1.0955 1.60834H1.05957V1.59936C1.05957 1.59936 1.04161 1.59936 1.03263 1.61732H1.02365L1.05957 1.59936C1.05957 1.59936 0.781128 1.60834 0.727235 1.63529C0.655378 1.67122 0.601486 1.71613 0.556575 1.77002C0.511664 1.82392 0.475734 1.87781 0.134411 1.94967C-0.206912 2.02153 0.206269 1.94967 0.233216 1.94967H0.134411V1.97661C0.197287 2.28201 0.179322 2.49758 0.278126 2.84789C0.260162 2.93771 0.466753 3.76406 0.4937 3.8449L2.13744 10.366H2.16439ZM29.9642 16.2403C29.9642 16.2403 29.9373 16.2762 29.9283 16.2852L29.3534 15.6475C29.5511 15.8361 29.7487 16.0247 29.9642 16.2403ZM23.5959 24.6746C23.5959 24.6746 23.533 24.7464 23.506 24.7824L23.4881 24.7644C23.524 24.7375 23.5599 24.7015 23.6048 24.6746H23.5959ZM19.9581 6.6204C20.2725 6.93477 21.521 8.10246 21.8084 8.38989C20.506 7.79706 17.2634 6.28806 15.7544 5.80302C17.2365 6.0635 19.2844 6.39584 19.9581 6.6204ZM2.73026 4.13233C3.48476 5.42577 4.07759 9.96177 4.67041 14.372C4.33807 12.9528 4.05064 11.5696 3.78118 10.2402C3.3141 7.94078 2.88296 5.88386 2.28115 4.06048C2.4069 4.06946 2.5596 4.08742 2.72128 4.10539C2.72128 4.11437 2.72128 4.12335 2.73924 4.13233H2.73026ZM2.46978 3.04549C2.26319 3.02753 2.07456 3.00956 1.91288 3.00058C1.89492 2.96465 1.88594 2.92872 1.87695 2.8928L2.46978 3.05448V3.04549ZM71.0218 2.38979C71.0577 2.1832 70.0337 1.276 70.3571 1.25804C71.1206 1.22211 71.1296 0.0454439 70.3571 0.0813726C69.3421 0.135266 68.3181 0.368801 67.3301 0.557427C65.5516 0.889768 63.7821 1.25804 62.0126 1.64427C58.0695 2.4886 54.1353 3.37783 50.246 4.43773C49.0244 4.77007 47.6771 5.06648 46.5543 5.6593C46.1771 5.85691 46.195 6.26111 46.4016 6.51261C46.3208 6.55752 46.2399 6.58447 46.1501 6.59345C45.8178 6.65633 45.4854 6.71022 45.1531 6.76411C45.0701 6.77737 44.9917 6.81098 44.9249 6.86195C44.8581 6.91291 44.805 6.97965 44.7703 7.05617C44.7356 7.1327 44.7204 7.21664 44.7261 7.30047C44.7317 7.38431 44.7581 7.46543 44.8028 7.53658C42.7189 10.3211 40.3476 13.3211 37.7787 16.4739C35.2547 19.3571 32.6319 22.429 29.9463 25.5818C21.494 35.5161 11.91 46.7797 1.29311 56.696C1.08652 56.8847 1.07754 57.208 1.26617 57.4146C1.31108 57.4685 1.37395 57.5044 1.43683 57.5314C1.29311 57.6661 1.1494 57.8009 1.00568 57.9266C0.915862 58.0074 0.879933 58.1063 0.861969 58.214C0.790112 58.2859 0.718255 58.3667 0.655379 58.4386C0.466754 58.6452 0.475735 58.9685 0.682325 59.1572C0.888915 59.3458 1.21227 59.3368 1.4009 59.1302C1.43683 59.0943 1.47275 59.0494 1.50868 59.0135C1.57919 58.939 1.66414 58.8797 1.75835 58.8391C1.85256 58.7986 1.95404 58.7777 2.0566 58.7777C2.15916 58.7777 2.26064 58.7986 2.35484 58.8391C2.44905 58.8797 2.534 58.939 2.60451 59.0135C3.22428 59.6781 3.80812 60.3069 4.35604 60.8907L3.11649 59.8578C3.01266 59.7713 2.87886 59.7294 2.74425 59.7412C2.60965 59.753 2.48516 59.8175 2.39792 59.9207C2.21828 60.1362 2.24522 60.4596 2.4608 60.6392L15.7724 71.8041C15.8712 71.8849 15.988 71.9208 16.1047 71.9208C16.2395 71.9208 16.3652 71.8669 16.464 71.7681L16.7874 71.4448C16.8814 71.4869 16.9861 71.4992 17.0873 71.4799C17.1885 71.4606 17.2813 71.4108 17.3533 71.337C35.3984 53.211 49.9316 39.5131 66.5756 27.2704C66.7283 27.1626 66.8001 26.983 66.7822 26.8123C66.8801 26.8016 66.9729 26.7629 67.0494 26.7007C67.1259 26.6386 67.1828 26.5557 67.2133 26.462C70.2852 17.0667 70.8781 8.74917 71.0577 4.66228C71.0577 4.63534 71.0667 4.61737 71.0757 4.59941C71.0936 4.5545 71.1026 4.50959 71.1116 4.47366C71.1385 4.37485 71.1565 4.303 71.1565 4.303C71.39 3.60239 71.3092 2.92872 71.0218 2.37183V2.38979ZM38.7578 17.0936C39.5662 16.1685 40.3656 15.2613 41.156 14.381C35.9823 21.1895 27.4133 31.6807 15.2784 44.1479C23.542 35.0041 31.8685 25.5279 38.7578 17.0936ZM9.52079 64.5285L9.49384 64.5016C9.59265 64.5195 9.6645 64.5375 9.67348 64.5375C9.62301 64.5282 9.57126 64.5282 9.52079 64.5375V64.5285ZM15.7185 70.2951L15.6736 70.2591L15.7005 70.2322C15.7185 70.2322 15.7275 70.2502 15.7365 70.2502C15.7365 70.2681 15.7185 70.2771 15.7095 70.2951H15.7185ZM23.2276 63.8189L24.4671 62.5255C24.4761 62.5345 24.4851 62.5524 24.4941 62.5704C24.0719 62.9836 23.6498 63.4057 23.2186 63.8189H23.2276ZM25.2396 61.8339C25.4731 61.5644 25.7426 61.25 26.0211 60.9177C26.03 60.9087 26.039 60.8907 26.057 60.8817C29.0121 57.8368 32.0571 54.7559 35.2008 51.675C35.2188 51.657 35.2457 51.6391 35.2637 51.6211C36.0362 51.0283 36.8985 50.3726 37.7069 49.7528C33.6469 53.6331 29.5241 57.6392 25.2396 61.8428V61.8339ZM44.686 11.6414C43.0153 13.8151 41.183 16.6355 39.6291 18.8901C34.7248 25.995 18.9341 43.3934 18.5838 43.7258C16.1496 46.0791 8.8112 53.1211 4.13148 57.5314C4.00573 57.6482 3.90693 57.747 3.82609 57.8458C3.76063 57.7777 3.70935 57.6972 3.67524 57.6091C3.64112 57.5211 3.62484 57.4271 3.62735 57.3326C3.62986 57.2382 3.6511 57.1452 3.68984 57.0591C3.72858 56.9729 3.78405 56.8953 3.85303 56.8308C26.1468 35.8125 39.674 18.3062 45.1711 10.6803C45.0543 10.9768 44.9555 11.3001 44.677 11.6594L44.686 11.6414ZM59.5156 18.0188L59.5066 18.0368C59.5066 18.0188 59.4886 17.9739 59.5156 18.0188ZM53.4077 21.8991C51.3777 20.7224 50.4256 18.9619 50.9735 17.1834L51.1442 16.5906C51.2161 16.42 51.2969 16.2493 51.3957 16.0786C51.9257 15.1984 52.7341 14.4169 53.6592 13.9588C53.7041 13.9409 53.749 13.9319 53.794 13.9229C53.7466 13.7999 53.7341 13.6663 53.758 13.5367C53.8029 13.2582 53.9826 13.0157 54.3508 13.0157C54.9526 13.0157 56.8209 13.5726 57.5305 14.1834C57.7461 14.3541 57.9527 14.5427 58.1413 14.7493C58.4108 15.0636 58.806 15.5756 59.0036 15.9439C59.1204 15.9978 59.2102 16.5008 59.3449 16.7613C59.4707 17.1745 59.5246 17.5966 59.5066 18.0188C59.5066 18.0368 59.5066 18.0367 59.5156 18.0457C59.4886 18.1086 59.5156 18.3781 59.4797 18.405C59.3898 19.0517 59.1563 19.6895 58.806 20.2464C58.7701 20.2913 58.7431 20.3452 58.7072 20.3901C58.7072 20.3991 58.6892 20.408 58.6803 20.426C58.4108 20.8122 58.0964 21.1715 57.7102 21.441C56.5784 22.2404 55.258 22.4829 53.9377 22.1506C53.7634 22.0842 53.5926 22.0092 53.4257 21.926L53.4077 21.8991ZM68.0217 20.435C67.5816 22.2763 67.0427 24.1985 66.4049 26.1656C66.378 26.2375 66.378 26.3093 66.378 26.3722C66.2882 26.3812 66.2073 26.4171 66.1355 26.471C62.1474 29.3992 58.294 32.4172 54.4766 35.552C57.7731 32.5699 61.1144 29.6058 64.5636 26.6147C65.5628 25.7462 66.2322 24.5598 66.4588 23.2554L66.9618 20.2284L66.9888 20.1386C67.2133 19.5008 68.1924 19.7793 68.0397 20.435H68.0217Z" fill="#6965DB"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7303">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7303)"><path fill="#6965db" d="M71.84 59.346a.49.49 0 0 0-.477-.108c-3.763-5.56-8.55-10.832-13.186-15.925l-.763-.836a.44.44 0 0 0-.108-.27.5.5 0 0 0-.305-.179l-.153-.161-.108-.081c-.135-.288-.476-.503-.853-.315-1.42.728-2.695 1.77-3.952 2.73-1.68 1.285-3.324 2.624-4.869 4.06-.629.585-1.248 1.195-1.77 1.878-.25.332-.062.647.243.781a147 147 0 0 0-3.305 3.36.54.54 0 0 0-.144.395c.01.144.081.279.198.368l1.94 1.482s.009.027.027.036c2.775 2.74 7.644 6.54 12.8 10.563q1.146.903 2.308 1.806c.35.422.682.844 1.006 1.257.17.225.494.27.718.1.117.089.234.188.35.277a.51.51 0 0 0 .72-.09.5.5 0 0 0 .098-.278c.036 0 .063.027.09.027a.52.52 0 0 0 .377-.162l9.144-9.988a.504.504 0 0 0-.036-.718zm-26.256-3.458q.095.118.189.224c1.042.88 2.156 1.833 3.287 2.803l-4.599-3.512-.467-.324q-.145-.108-.278-.215l-.341-.288s.063-.063.09-.099l.314-.314c1.545-1.563 4.194-4.168 5.56-5.443-1.446 1.455-4.374 5.721-3.746 7.168zM61.33 68.292 57.54 65.4a94 94 0 0 0-4.707-4.518c2.048 1.58 3.8 2.919 4.06 3.152 1.985 1.77 1.895 1.447 3.26 2.614l1.644 1.195c-.162.144-.323.296-.476.44zm.952.728-.072-.054c.144-.117.297-.225.44-.342l-.359.396zM2.164 10.366c.126.647.243 1.284.36 1.895.62 3.324 1.194 6.315 2.29 8.587l.431 1.725c.17.655.413 1.473.638 1.643 2.56 2.264 6.485 5.641 10.68 8.821a.51.51 0 0 0 .629-.009c.009.018.026.027.035.036q.152.135.342.135a.48.48 0 0 0 .377-.171c5.371-5.973 9.368-10.886 12.216-15 .18-.225.27-.485.26-.755.18-.215.369-.43.54-.61a.503.503 0 0 0-.09-.773.52.52 0 0 0-.153-.323 244 244 0 0 0-3.108-2.947c-1.653-1.544-3.36-3.143-6.98-6.745-.017-.018-.044-.036-.062-.054a.5.5 0 0 0-.198-.126c-.997-.35-3.045-.7-5.623-1.15-3.79-.646-8.982-1.544-13.652-2.937H1.06V1.6s-.018 0-.027.018h-.01L1.06 1.6s-.279.01-.333.036a.5.5 0 0 0-.17.135c-.045.054-.081.108-.423.18-.34.072.072 0 .1 0h-.1v.027c.063.305.045.52.144.87-.018.09.189.917.216.998l1.643 6.521zm27.8 5.874s-.027.036-.036.045l-.575-.637c.198.188.396.377.611.592m-6.368 8.435s-.063.071-.09.107l-.018-.018c.036-.026.072-.062.117-.09zM19.958 6.62c.315.315 1.563 1.482 1.85 1.77-1.302-.593-4.545-2.102-6.054-2.587 1.483.26 3.53.593 4.204.817M2.73 4.132c.755 1.294 1.348 5.83 1.94 10.24-.332-1.42-.62-2.802-.889-4.132-.467-2.3-.898-4.356-1.5-6.18.126.01.279.027.44.045 0 .01 0 .018.018.027zm-.26-1.087c-.207-.017-.395-.035-.557-.044a.5.5 0 0 1-.036-.108l.593.161zm68.552-.655c.036-.207-.988-1.114-.665-1.132.764-.036.773-1.213 0-1.177-1.015.054-2.039.288-3.027.476-1.778.333-3.548.701-5.317 1.087-3.943.845-7.878 1.734-11.767 2.794-1.222.332-2.569.628-3.692 1.221-.377.198-.359.602-.152.854a.6.6 0 0 1-.252.08c-.332.063-.665.117-.997.171a.508.508 0 0 0-.35.773c-2.084 2.784-4.455 5.784-7.024 8.937a903 903 0 0 0-7.833 9.108C21.494 35.516 11.91 46.78 1.293 56.696a.51.51 0 0 0-.027.719c.045.053.108.09.17.116-.143.135-.287.27-.43.396a.47.47 0 0 0-.144.287 5 5 0 0 0-.207.225.51.51 0 0 0 .027.718.51.51 0 0 0 .719-.027c.036-.036.072-.08.108-.117a.755.755 0 0 1 1.096 0c.62.665 1.203 1.294 1.751 1.878l-1.24-1.033a.51.51 0 0 0-.718.063.51.51 0 0 0 .063.718l13.311 11.165c.1.08.216.117.333.117.134 0 .26-.054.359-.153l.323-.323a.5.5 0 0 0 .566-.108C35.398 53.211 49.932 39.513 66.576 27.27a.5.5 0 0 0 .206-.458.51.51 0 0 0 .431-.35c3.072-9.395 3.665-17.713 3.845-21.8a.13.13 0 0 1 .018-.063c.018-.045.027-.09.036-.125l.044-.171c.234-.7.153-1.374-.134-1.931zM38.758 17.094a268 268 0 0 1 2.398-2.713c-5.174 6.808-13.743 17.3-25.878 29.767 8.264-9.144 16.59-18.62 23.48-27.054M9.52 64.529l-.027-.027c.099.017.17.035.18.035a.4.4 0 0 0-.153 0zm6.198 5.766-.045-.036.027-.027c.018 0 .026.018.035.018 0 .018-.018.027-.027.045zm7.509-6.476 1.24-1.294a.2.2 0 0 1 .026.045c-.422.414-.844.836-1.275 1.249zm2.012-1.985c.233-.27.503-.584.781-.916.009-.01.018-.027.036-.036 2.955-3.045 6-6.126 9.144-9.207.018-.018.045-.036.063-.054.772-.593 1.634-1.248 2.443-1.868a1326 1326 0 0 0-12.467 12.09zM44.686 11.64c-1.67 2.174-3.503 4.995-5.057 7.25-4.904 7.104-20.695 24.502-21.045 24.835A2064 2064 0 0 1 4.13 57.53a3 3 0 0 0-.305.315.713.713 0 0 1 .027-1.015C26.146 35.811 39.673 18.305 45.17 10.68c-.117.296-.215.62-.494.978zm14.83 6.378-.01.018c0-.018-.017-.063.01-.018m-6.108 3.88c-2.03-1.177-2.982-2.937-2.434-4.716l.17-.592c.072-.171.153-.342.252-.512.53-.88 1.338-1.662 2.263-2.12a1 1 0 0 1 .135-.036.7.7 0 0 1-.036-.386c.045-.279.225-.521.593-.521.602 0 2.47.557 3.18 1.167.215.171.422.36.61.566.27.315.665.827.863 1.195.116.054.206.557.34.817.127.413.18.836.163 1.258 0 .018 0 .018.009.027-.027.063 0 .332-.036.359a4.7 4.7 0 0 1-.674 1.841c-.036.045-.063.1-.099.144 0 .01-.018.018-.027.036-.27.386-.584.746-.97 1.015-1.132.8-2.452 1.042-3.772.71a6 6 0 0 1-.512-.225zm14.614-1.464a76 76 0 0 1-1.617 5.73c-.027.073-.027.144-.027.207a.5.5 0 0 0-.243.099 272 272 0 0 0-11.658 9.081 640 640 0 0 1 10.087-8.937 5.76 5.76 0 0 0 1.895-3.36l.503-3.027.027-.09c.224-.637 1.203-.359 1.05.297z"/></g><defs><clipPath id="clip0_15940_7303"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/figma.svg b/web/packages/design/src/ResourceIcon/assets/figma.svg
index f81d6f21c552c..37bd064441fe9 100644
--- a/web/packages/design/src/ResourceIcon/assets/figma.svg
+++ b/web/packages/design/src/ResourceIcon/assets/figma.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M36 36C36 32.8174 37.2643 29.7652 39.5147 27.5147C41.7652 25.2643 44.8174 24 48 24C51.1826 24 54.2348 25.2643 56.4853 27.5147C58.7357 29.7652 60 32.8174 60 36C60 39.1826 58.7357 42.2348 56.4853 44.4853C54.2348 46.7357 51.1826 48 48 48C44.8174 48 41.7652 46.7357 39.5147 44.4853C37.2643 42.2348 36 39.1826 36 36Z" fill="#1ABCFE"/>
-<path d="M12 60C12 56.8174 13.2643 53.7652 15.5147 51.5147C17.7652 49.2643 20.8174 48 24 48H36V60C36 63.1826 34.7357 66.2348 32.4853 68.4853C30.2348 70.7357 27.1826 72 24 72C20.8174 72 17.7652 70.7357 15.5147 68.4853C13.2643 66.2348 12 63.1826 12 60Z" fill="#0ACF83"/>
-<path d="M36 0V24H48C51.1826 24 54.2348 22.7357 56.4853 20.4853C58.7357 18.2348 60 15.1826 60 12C60 8.8174 58.7357 5.76515 56.4853 3.51472C54.2348 1.26428 51.1826 0 48 0L36 0Z" fill="#FF7262"/>
-<path d="M12 12C12 15.1826 13.2643 18.2348 15.5147 20.4853C17.7652 22.7357 20.8174 24 24 24H36V0H24C20.8174 0 17.7652 1.26428 15.5147 3.51472C13.2643 5.76515 12 8.8174 12 12Z" fill="#F24E1E"/>
-<path d="M12 36C12 39.1826 13.2643 42.2348 15.5147 44.4853C17.7652 46.7357 20.8174 48 24 48H36V24H24C20.8174 24 17.7652 25.2643 15.5147 27.5147C13.2643 29.7652 12 32.8174 12 36Z" fill="#A259FF"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1abcfe" d="M36 36a12 12 0 1 1 24 0 12 12 0 0 1-24 0"/><path fill="#0acf83" d="M12 60a12 12 0 0 1 12-12h12v12a12 12 0 0 1-24 0"/><path fill="#ff7262" d="M36 0v24h12a12 12 0 0 0 0-24z"/><path fill="#f24e1e" d="M12 12a12 12 0 0 0 12 12h12V0H24a12 12 0 0 0-12 12"/><path fill="#a259ff" d="M12 36a12 12 0 0 0 12 12h12V24H24a12 12 0 0 0-12 12"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/fontawesome.svg b/web/packages/design/src/ResourceIcon/assets/fontawesome.svg
index ce75c781f7196..fc1dbd97c76e8 100644
--- a/web/packages/design/src/ResourceIcon/assets/fontawesome.svg
+++ b/web/packages/design/src/ResourceIcon/assets/fontawesome.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7353)">
-<path d="M12.8989 13.5005C14.9501 12.2053 16.3125 9.91822 16.3125 7.31299C16.3125 3.27442 13.0386 0.000488281 9 0.000488281C4.96143 0.000488281 1.6875 3.27442 1.6875 7.31299C1.6875 9.65447 2.78802 11.7389 4.5 13.0773V72.0005H13.5V63.0005H66.038C68.0882 63.0005 69.75 61.3386 69.75 59.2884C69.75 58.7687 69.6411 58.2552 69.43 57.7805L60.75 38.2505L69.43 18.7204C69.6411 18.2457 69.75 17.7321 69.75 17.2127C69.75 15.1625 68.0882 13.5005 66.038 13.5005H12.8989Z" fill="#538DD7"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7353">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7353)"><path fill="#538dd7" d="M12.899 13.5a7.312 7.312 0 1 0-8.399-.423v58.924h9v-9h52.538a3.712 3.712 0 0 0 3.392-5.22l-8.68-19.53 8.68-19.53a3.712 3.712 0 0 0-3.392-5.22z"/></g><defs><clipPath id="clip0_15940_7353"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/foqal.svg b/web/packages/design/src/ResourceIcon/assets/foqal.svg
index 13663f8ffca1e..9b770b95d7ee7 100644
--- a/web/packages/design/src/ResourceIcon/assets/foqal.svg
+++ b/web/packages/design/src/ResourceIcon/assets/foqal.svg
@@ -1,22 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7363)">
-<path d="M70.1106 15.1501C69.9136 15.0024 69.6674 14.9039 69.4704 14.9531C65.2847 15.5933 59.474 18.4494 59.474 18.4494C59.5725 18.4001 59.6217 18.4001 59.671 18.3509C59.671 18.3509 59.0801 18.6956 58.7354 18.8926C55.7808 20.6653 53.9095 22.1426 51.9398 23.9154C46.8185 28.5935 42.1403 33.7148 37.5607 38.9347C37.1175 39.4271 36.5266 39.6733 35.9357 39.6733C35.3447 39.6733 34.7538 39.4271 34.3106 38.9347C29.731 33.7148 25.0529 28.5443 19.9316 23.9154C17.9618 22.0934 16.0413 20.6161 13.136 18.8926C12.7913 18.6956 12.2003 18.3509 12.2003 18.3509C12.2988 18.4001 12.3481 18.4001 12.3973 18.4494C12.3973 18.4494 6.5866 15.5933 2.40091 14.9531C2.15469 14.9039 1.95772 15.0024 1.76074 15.1501C2.0562 14.8054 2.35166 14.5592 2.74561 14.4114C7.02979 12.7372 9.24574 11.9985 13.7269 10.8167C17.1739 9.93028 20.7687 9.8318 24.1665 10.7182C25.9393 11.1614 27.6135 11.8508 28.6969 12.7864C30.6666 14.4607 32.8333 16.4797 34.6553 18.4002C35.0493 18.7941 35.4925 18.9418 35.9849 18.9418C36.4773 18.9911 36.9698 18.7941 37.3145 18.4002C39.1365 16.5289 41.3032 14.4607 43.2729 12.7864C44.3563 11.8508 46.0798 11.1614 47.8033 10.7182C51.2011 9.8318 54.7959 9.93028 58.2429 10.8167C62.7733 11.9493 64.94 12.6879 69.2242 14.4114C69.6182 14.5592 69.9629 14.8546 70.1106 15.1501Z" fill="#4A89AF"/>
-<path d="M71.932 29.4308C71.932 29.48 71.932 29.48 71.932 29.5293C71.8335 34.0104 70.9963 37.8514 68.4849 40.3628C61.8371 47.0107 55.2877 53.8063 48.7875 60.6019C46.0792 63.4088 40.9578 60.9466 40.9086 56.5147C40.9086 54.9881 40.8594 53.5601 40.8594 52.329C40.8101 49.7683 41.6965 47.3062 43.223 45.5334C47.7534 40.3136 52.4808 35.2415 57.6021 30.5634C58.3408 29.9232 58.6855 29.6278 59.4241 28.9876C59.8673 28.5444 60.2613 28.249 60.5075 28.052C60.606 28.0027 60.6552 27.9535 60.7045 27.9043C60.7537 27.9043 60.7537 27.855 60.803 27.855C61.5908 27.1656 61.7878 26.1315 61.7878 25.4913C61.8371 24.9004 61.7878 23.6693 60.9999 22.4382C60.9014 22.2905 60.8522 22.1428 60.7537 22.0443C60.6552 21.9458 60.606 21.7981 60.5075 21.6996C60.4582 21.5519 60.3598 21.4534 60.3105 21.3549C60.0643 20.9609 59.8673 20.6162 59.6211 20.2715C59.5719 20.173 59.4734 20.0746 59.4241 19.9761C59.2272 19.6314 59.0302 19.2867 58.784 18.8927C59.0794 18.745 59.3256 18.5972 59.5719 18.4495C63.0681 16.4798 65.3826 15.5934 69.5683 14.9532C69.8145 14.904 70.0115 15.0025 70.2084 15.1502C70.4054 15.38 70.5531 15.6755 70.6516 16.0366C70.6516 16.0858 70.6516 16.0858 70.6516 16.0858C71.0456 17.4647 71.2918 18.8927 71.4888 20.3208C71.538 20.567 71.538 20.764 71.5873 21.0102C71.6365 21.3056 71.6365 21.5519 71.6857 21.7981C71.9812 24.3587 72.0797 26.9686 71.932 29.4308Z" fill="#4A89AF"/>
-<path d="M28.7458 45.632C30.2724 47.3555 31.1588 49.8176 31.1095 52.4275C31.1095 53.6094 31.0603 55.0867 31.0603 56.6132C31.011 61.0451 25.8897 63.5073 23.1813 60.7004C16.6812 53.9049 10.1318 47.1093 3.48397 40.4614C1.0218 37.95 0.184663 34.109 0.0369333 29.6279C0.0369333 29.5786 0.0369333 29.5786 0.0369333 29.5294C-0.0615536 27.0179 0.0369287 24.4081 0.332389 21.8474C0.381633 21.5519 0.381639 21.3057 0.430882 21.0595C0.480125 20.8133 0.480124 20.6163 0.529367 20.3701C0.726341 18.942 0.972557 17.514 1.3665 16.1352C1.3665 16.0859 1.3665 16.0859 1.3665 16.0859C1.46499 15.7248 1.61272 15.4293 1.80969 15.1995C2.00667 15.0518 2.25288 14.9533 2.44986 15.0026C6.63555 15.6427 8.94999 16.5291 12.4463 18.4988C12.7417 18.6466 12.988 18.7943 13.2342 18.942C12.988 19.3852 12.791 19.6807 12.594 20.0254C12.5448 20.1239 12.4463 20.2224 12.397 20.3208C12.1508 20.6655 11.9538 21.0103 11.7076 21.4042C11.6584 21.5027 11.5599 21.6504 11.5106 21.7489C11.4122 21.8474 11.3629 21.9459 11.2644 22.0936C11.1659 22.2413 11.1167 22.3398 11.0182 22.4876C10.2303 23.7186 10.2303 24.9497 10.2303 25.5406C10.2796 26.1808 10.4273 27.2149 11.2152 27.9043C11.2644 27.9043 11.2644 27.9536 11.3137 27.9536C11.4122 28.0028 11.4614 28.0521 11.5106 28.1013C11.7569 28.2983 12.1016 28.643 12.594 29.0369C13.3327 29.6278 13.6774 29.9726 14.416 30.6127C19.5373 35.2908 24.2647 40.3629 28.7458 45.632Z" fill="#4A89AF"/>
-<path opacity="0.3" d="M71.4894 20.3208C67.7469 22.4875 64.2014 24.9989 60.7543 27.855C61.5422 27.1656 61.7392 26.1315 61.7392 25.4913C61.7884 24.9004 61.7392 23.6693 60.9513 22.4382C60.8528 22.2905 60.8036 22.1428 60.7051 22.0443C60.6066 21.9458 60.5574 21.7981 60.4589 21.6996C60.4096 21.5519 60.3111 21.4534 60.2619 21.3549C60.0157 20.9609 59.8187 20.6162 59.5725 20.2715C59.5233 20.173 59.4248 20.0746 59.3755 19.9761C59.1785 19.6314 58.9816 19.2867 58.7354 18.8927C59.0308 18.745 59.277 18.5972 59.5232 18.4495C63.0195 16.4798 65.334 15.5934 69.5197 14.9532C69.7659 14.904 69.9629 15.0025 70.1598 15.1502C70.406 15.4457 70.5538 15.7411 70.6523 16.0858C71.0462 17.4647 71.3417 18.8927 71.4894 20.3208Z" fill="url(#paint0_linear_15940_7363)"/>
-<path opacity="0.3" d="M1.36643 16.0858C1.46492 15.7411 1.61265 15.4457 1.85887 15.1502C2.05584 15.0025 2.25282 14.904 2.49903 14.9532C6.68472 15.5934 8.99916 16.4798 12.4954 18.4495C12.7417 18.5972 12.9879 18.745 13.2833 18.8927C13.0371 19.2867 12.8401 19.6314 12.6432 19.9761C12.5939 20.0746 12.4954 20.173 12.4462 20.2715C12.2 20.6162 12.003 20.9609 11.7568 21.3549C11.7076 21.4534 11.6091 21.5519 11.5598 21.6996C11.5106 21.7981 11.4121 21.9458 11.3136 22.0443C11.2151 22.1428 11.1659 22.2905 11.0674 22.4382C10.2795 23.6693 10.2302 24.9004 10.2795 25.4913C10.2795 26.1315 10.4765 27.1656 11.2644 27.855C7.81732 24.9989 4.2718 22.4875 0.529297 20.3208C0.726271 18.8927 0.972486 17.4647 1.36643 16.0858Z" fill="url(#paint1_linear_15940_7363)"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15940_7363" x1="66.8113" y1="23.4231" x2="63.2657" y2="18.2033" gradientUnits="userSpaceOnUse">
-<stop stop-opacity="0"/>
-<stop offset="1"/>
-</linearGradient>
-<linearGradient id="paint1_linear_15940_7363" x1="5.60137" y1="23.0784" x2="8.99916" y2="17.5139" gradientUnits="userSpaceOnUse">
-<stop stop-opacity="0"/>
-<stop offset="1"/>
-</linearGradient>
-<clipPath id="clip0_15940_7363">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7363)"><path fill="#4a89af" d="M70.11 15.15c-.196-.148-.443-.246-.64-.197-4.185.64-9.996 3.496-9.996 3.496.099-.049.148-.049.197-.098 0 0-.59.345-.936.542-2.954 1.772-4.825 3.25-6.795 5.022-5.121 4.679-9.8 9.8-14.38 15.02a2.18 2.18 0 0 1-1.624.738 2.18 2.18 0 0 1-1.625-.738c-4.58-5.22-9.258-10.39-14.38-15.02-1.97-1.822-3.89-3.299-6.795-5.022-.345-.197-.936-.542-.936-.542.099.05.148.05.197.098 0 0-5.81-2.856-9.996-3.496-.246-.05-.443.05-.64.197.295-.345.59-.59.985-.739 4.284-1.674 6.5-2.412 10.98-3.594 3.448-.887 7.043-.985 10.44-.099 1.773.443 3.447 1.133 4.53 2.068 1.97 1.675 4.137 3.694 5.96 5.614.393.394.837.542 1.329.542a1.56 1.56 0 0 0 1.33-.542c1.822-1.871 3.988-3.94 5.958-5.614 1.083-.935 2.807-1.625 4.53-2.068 3.398-.886 6.993-.788 10.44.099 4.53 1.132 6.697 1.87 10.981 3.594.394.148.739.444.887.74"/><path fill="#4a89af" d="M71.932 29.43v.1c-.099 4.48-.936 8.321-3.447 10.833-6.648 6.648-13.197 13.443-19.697 20.239-2.709 2.807-7.83.345-7.88-4.087 0-1.527-.049-2.955-.049-4.186-.049-2.56.837-5.023 2.364-6.796 4.53-5.22 9.258-10.291 14.38-14.97.738-.64 1.082-.935 1.821-1.575.443-.444.837-.739 1.084-.936.098-.05.147-.099.197-.148.049 0 .049-.049.098-.049.788-.69.985-1.724.985-2.364.05-.59 0-1.822-.788-3.053-.099-.147-.148-.295-.246-.394-.099-.098-.148-.246-.246-.344-.05-.148-.148-.247-.198-.345-.246-.394-.443-.739-.689-1.084-.05-.098-.148-.196-.197-.295-.197-.345-.394-.69-.64-1.083.295-.148.542-.296.788-.444 3.496-1.97 5.81-2.856 9.996-3.496.246-.049.444.05.64.197q.296.345.444.887v.049c.394 1.379.64 2.807.837 4.235.049.246.049.443.098.69.05.295.05.54.099.787.295 2.56.394 5.17.246 7.633M28.746 45.632c1.526 1.724 2.413 4.186 2.364 6.796 0 1.181-.05 2.659-.05 4.185-.049 4.432-5.17 6.894-7.879 4.087-6.5-6.795-13.05-13.59-19.697-20.239C1.022 37.95.184 34.11.037 29.628v-.099c-.099-2.511 0-5.12.295-7.682.05-.295.05-.541.099-.788.05-.246.05-.443.098-.689.197-1.428.444-2.856.838-4.235v-.05a2.25 2.25 0 0 1 .443-.886c.197-.147.443-.246.64-.196 4.186.64 6.5 1.526 9.996 3.496.296.148.542.295.788.443-.246.443-.443.739-.64 1.083-.05.099-.148.197-.197.296-.246.345-.443.69-.69 1.083-.049.099-.147.246-.196.345-.099.098-.148.197-.247.345-.098.147-.147.246-.246.394-.788 1.23-.788 2.462-.788 3.053.05.64.197 1.674.985 2.363.05 0 .05.05.099.05.098.049.147.098.197.147.246.197.59.542 1.083.936.739.59 1.083.936 1.822 1.576 5.121 4.678 9.849 9.75 14.33 15.019"/><path fill="url(#paint0_linear_15940_7363)" d="M71.49 20.32c-3.744 2.169-7.29 4.68-10.737 7.536.788-.69.985-1.724.985-2.364.05-.59 0-1.822-.788-3.053-.098-.147-.147-.295-.246-.394-.098-.098-.148-.246-.246-.344-.05-.148-.148-.247-.197-.345-.246-.394-.443-.739-.69-1.084-.049-.098-.147-.196-.197-.295-.197-.345-.393-.69-.64-1.083a11 11 0 0 0 .788-.444c3.496-1.97 5.811-2.856 9.997-3.496.246-.049.443.05.64.197.246.296.394.591.492.936a25 25 0 0 1 .837 4.235" opacity=".3"/><path fill="url(#paint1_linear_15940_7363)" d="M1.366 16.086c.099-.345.247-.64.493-.936.197-.148.394-.246.64-.197 4.186.64 6.5 1.527 9.996 3.497.247.147.493.295.788.443-.246.394-.443.738-.64 1.083-.05.099-.148.197-.197.296-.246.344-.443.689-.69 1.083-.048.098-.147.197-.196.345a1.5 1.5 0 0 1-.246.344c-.099.099-.148.247-.247.394a5.03 5.03 0 0 0-.787 3.053c0 .64.197 1.675.984 2.364C7.817 24.999 4.272 22.488.53 20.321c.197-1.428.443-2.856.837-4.235" opacity=".3"/></g><defs><linearGradient id="paint0_linear_15940_7363" x1="66.811" x2="63.266" y1="23.423" y2="18.203" gradientUnits="userSpaceOnUse"><stop stop-opacity="0"/><stop offset="1"/></linearGradient><linearGradient id="paint1_linear_15940_7363" x1="5.601" x2="8.999" y1="23.078" y2="17.514" gradientUnits="userSpaceOnUse"><stop stop-opacity="0"/><stop offset="1"/></linearGradient><clipPath id="clip0_15940_7363"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/fossa.svg b/web/packages/design/src/ResourceIcon/assets/fossa.svg
index e6a3e591103c2..fa2800558ee27 100644
--- a/web/packages/design/src/ResourceIcon/assets/fossa.svg
+++ b/web/packages/design/src/ResourceIcon/assets/fossa.svg
@@ -1,22 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7383)">
-<path d="M0.519712 27.7638C-0.811607 24.8108 0.503033 21.3378 3.45603 20.0065L42.221 2.52997C45.174 1.19865 48.647 2.51329 49.9783 5.4663L67.4549 44.2313C68.7862 47.1842 67.4716 50.6573 64.5184 51.9886L25.7537 69.465C22.8006 70.7965 19.3275 69.4817 17.9962 66.5287L0.519712 27.7638Z" fill="#06132D"/>
-<path d="M0.519715 27.7656C0.0784675 26.787 -0.0721204 25.7511 0.0312577 24.755L8.04308 23.1108C7.68251 21.9304 7.43506 20.705 7.43506 19.6457C7.43506 19.1488 7.46303 18.6587 7.51742 18.1773C8.20971 12.0487 13.1811 7.29541 19.2114 7.29541C21.8464 7.29541 24.279 8.20286 26.2406 9.73623C26.6847 10.0833 27.1045 10.4625 27.4972 10.8705C29.049 12.4313 31.8508 12.4313 40 12.4313C45.6835 12.4313 50.8842 14.3918 55.1655 17.63C55.3386 17.7611 55.5 17.9052 55.6541 18.0575C55.9043 18.3048 56.1352 18.5736 56.3657 18.8422C56.4558 18.947 56.5459 19.0519 56.637 19.1553C58.958 21.7909 64.7613 24.3224 70.585 24.8908V32.2223C69.6975 36.2581 68.0225 38.817 65.9911 40.9862C64.9678 42.0788 63.7663 43.0725 62.3529 44.1063C61.4817 44.6591 60.4289 44.8354 59.4086 44.6824C55.6007 44.1114 52.5928 43.9525 50.6375 43.9525C33.7172 43.9525 21.3585 53.3225 20.4394 69.2165C19.3972 68.6238 18.5266 67.7073 17.9962 66.5305L0.519715 27.7656Z" fill="#53B18A"/>
-<mask id="mask0_15940_7383" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="2" width="68" height="68">
-<path d="M0.519703 27.7653C-0.8116 24.8123 0.503039 21.3393 3.45604 20.0078L42.2209 2.53142C45.1739 1.20012 48.6471 2.51476 49.9784 5.46776L67.4548 44.2326C68.7861 47.1856 67.4715 50.6588 64.5185 51.9901L25.7536 69.4665C22.8006 70.7978 19.3274 69.4832 17.9961 66.5302L0.519703 27.7653Z" fill="#031E3D"/>
-</mask>
-<g mask="url(#mask0_15940_7383)">
-<path d="M10.7393 50.4303L20.3853 71.8206C20.3847 71.4951 20.3844 71.2225 20.3844 71.1409C20.3844 54.3182 32.697 44.2351 49.9091 43.959C35.125 44.0916 21.5459 46.4896 10.7393 50.4303Z" fill="#66C0EE"/>
-<path d="M49.1549 43.9775C34.5161 44.3243 21.4776 48.3675 12.6104 54.5794L20.3855 71.8207C20.3848 71.4952 20.3845 71.2226 20.3845 71.141C20.3845 54.5652 32.3385 44.5326 49.1549 43.9775Z" fill="#1F60E0"/>
-<path d="M43.8538 44.4897C31.3144 46.3472 20.9159 52.8672 15.7891 61.6277L20.3853 71.82C20.3847 71.4945 20.3844 71.2218 20.3844 71.1403C20.3844 56.3657 29.8814 46.7895 43.8538 44.4897Z" fill="#4321B1"/>
-</g>
-<path d="M7.60361 23.2061C13.0952 22.3634 20.3979 21.7753 28.599 21.5749C26.091 19.9468 25.2855 17.1645 24.5033 14.4631C23.589 11.3048 22.7067 8.25737 19.1732 7.29497C12.2717 7.15753 7.35156 12.7248 7.35156 20.4953C7.35156 21.3906 7.44047 22.3083 7.60361 23.2061Z" fill="#4321B1"/>
-<path d="M70.6145 32.2217C70.6145 32.2217 72.4907 31.8595 71.8771 26.2758C71.7854 25.4422 71.2637 24.7858 70.6145 24.6877C70.3342 24.6453 70.0597 24.6152 69.8171 24.6152C68.4795 24.6152 67.9167 24.7375 67.1583 25.4797L65.1084 27.4769C64.9168 27.6635 64.9248 27.9741 65.1259 28.1505C67.663 30.3774 69.8908 32.2217 70.6145 32.2217Z" fill="#4321B1"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M51.4715 25.0216C52.6082 24.9663 53.499 24.1491 53.5386 23.1637L53.5374 23.165C53.5832 22.0242 52.4886 21.1426 51.1971 21.2053C50.124 21.2576 50.0012 21.2774 46.6064 22.0888C46.4004 22.1381 46.3437 22.3743 46.5114 22.4891C50.2761 25.0799 50.3346 25.0771 51.4715 25.0216Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7383">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7383)"><path fill="#06132d" d="M.52 27.764a5.865 5.865 0 0 1 2.936-7.757L42.221 2.53a5.865 5.865 0 0 1 7.757 2.936l17.477 38.765a5.865 5.865 0 0 1-2.937 7.758L25.754 69.465a5.865 5.865 0 0 1-7.758-2.936z"/><path fill="#53b18a" d="M.52 27.766a5.84 5.84 0 0 1-.489-3.011l8.012-1.644c-.36-1.18-.608-2.406-.608-3.465q0-.746.082-1.469C8.21 12.05 13.181 7.295 19.211 7.295c2.635 0 5.068.908 7.03 2.441q.667.521 1.256 1.134c1.552 1.561 4.354 1.561 12.503 1.561 5.684 0 10.884 1.96 15.166 5.199q.258.198.488.428c.25.247.481.516.712.784q.135.158.271.313c2.321 2.636 8.124 5.167 13.948 5.736v7.331c-.887 4.036-2.562 6.595-4.594 8.764-1.023 1.093-2.225 2.087-3.638 3.12-.871.553-1.924.73-2.944.576-3.808-.57-6.816-.73-8.771-.73-16.92 0-29.28 9.37-30.199 25.265a5.84 5.84 0 0 1-2.443-2.686z"/><mask id="mask0_15940_7383" width="68" height="68" x="0" y="2" maskUnits="userSpaceOnUse" style="mask-type:alpha"><path fill="#031e3d" d="M.52 27.765a5.865 5.865 0 0 1 2.936-7.757L42.221 2.53a5.865 5.865 0 0 1 7.757 2.937l17.477 38.765a5.865 5.865 0 0 1-2.936 7.757L25.754 69.466a5.865 5.865 0 0 1-7.758-2.936z"/></mask><g mask="url(#mask0_15940_7383)"><path fill="#66c0ee" d="m10.74 50.43 9.645 21.39v-.68c0-16.822 12.312-26.905 29.524-27.181-14.784.133-28.363 2.53-39.17 6.471"/><path fill="#1f60e0" d="M49.155 43.978c-14.639.346-27.677 4.39-36.545 10.601l7.776 17.242-.002-.68c0-16.576 11.955-26.608 28.77-27.164"/><path fill="#4321b1" d="M43.854 44.49c-12.54 1.857-22.938 8.377-28.065 17.138l4.596 10.192v-.68c0-14.774 9.496-24.35 23.469-26.65"/></g><path fill="#4321b1" d="M7.604 23.206c5.491-.843 12.794-1.43 20.995-1.631-2.508-1.628-3.314-4.41-4.096-7.112-.914-3.158-1.796-6.206-5.33-7.168-6.901-.137-11.821 5.43-11.821 13.2 0 .896.088 1.813.252 2.711m63.011 9.016s1.876-.363 1.262-5.946c-.092-.834-.613-1.49-1.262-1.588a5.5 5.5 0 0 0-.798-.073c-1.337 0-1.9.123-2.659.865l-2.05 1.997a.46.46 0 0 0 .018.674c2.537 2.226 4.765 4.07 5.489 4.07"/><path fill="#fff" fill-rule="evenodd" d="M51.472 25.022c1.136-.056 2.027-.873 2.067-1.858l-.002.001c.046-1.14-1.048-2.022-2.34-1.96-1.073.053-1.196.072-4.59.884-.207.05-.263.285-.096.4 3.765 2.59 3.824 2.588 4.96 2.533" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15940_7383"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/frame.io-dark.svg b/web/packages/design/src/ResourceIcon/assets/frame.io-dark.svg
index 82609a62c8ecb..78423c3bf5f85 100644
--- a/web/packages/design/src/ResourceIcon/assets/frame.io-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/frame.io-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7386)">
-<path d="M8.11625 72.0005C5.17695 72.0005 3.23084 68.9341 4.29389 66.2024C8.03248 56.5724 9.94555 46.3307 9.93531 36.0005C9.93531 25.3487 7.93625 15.165 4.29389 5.79861C3.23084 3.06684 5.17695 0.000488281 8.11625 0.000488281C9.71507 0.000488281 11.1657 0.949194 11.7544 2.43155C15.9675 13.1213 18.1244 24.5104 18.1115 36.0005C18.1244 47.4905 15.9675 58.8797 11.7544 69.5694C11.461 70.2923 10.9574 70.9104 10.3088 71.3439C9.66014 71.7773 8.89634 72.006 8.11625 72.0005ZM27.7172 63.8475C25.0278 63.8475 23.088 61.2746 23.6958 58.6593C25.4207 51.2299 26.2897 43.6275 26.2857 36.0005C26.2857 28.2075 25.3899 20.6221 23.6958 13.3417C23.088 10.7264 25.0278 8.15343 27.7193 8.15343C29.5511 8.15343 31.1605 9.37743 31.5819 11.1563C33.5008 19.2982 34.4673 27.6355 34.4619 36.0005C34.4619 44.5515 33.4645 52.8676 31.5819 60.8447C31.3713 61.7078 30.8751 62.4743 30.1739 63.0199C29.4727 63.5654 28.6077 63.8578 27.7193 63.8497M46.2466 51.6224C43.7817 51.6224 41.8885 49.4581 42.1193 47.0144C42.8102 39.688 42.8102 32.3129 42.1193 24.9866C41.8885 22.5428 43.7817 20.3786 46.2445 20.3786C48.2986 20.3786 50.0351 21.9012 50.232 23.9363C51.0065 31.9604 51.0065 40.0405 50.232 48.0647C50.0351 50.1019 48.2965 51.6224 46.2445 51.6224M62.957 30.7911L65.2927 33.1205C65.6718 33.4982 65.9725 33.9471 66.1777 34.4413C66.383 34.9355 66.4886 35.4654 66.4886 36.0005C66.4886 36.5356 66.383 37.0655 66.1777 37.5597C65.9725 38.0539 65.6718 38.5028 65.2927 38.8805L62.957 41.2099C61.2417 42.9231 58.3045 41.7097 58.3045 39.2892V32.7097C58.3045 30.2913 61.2395 29.0779 62.957 30.789" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7386">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7386)"><path fill="#fff" d="M8.116 72c-2.939 0-4.885-3.066-3.822-5.798a83.2 83.2 0 0 0 5.641-30.201c0-10.652-1.999-20.836-5.641-30.202C3.23 3.067 5.177 0 8.116 0c1.6 0 3.05.95 3.638 2.432A91.3 91.3 0 0 1 18.112 36a91.3 91.3 0 0 1-6.358 33.568A3.9 3.9 0 0 1 8.116 72m19.601-8.153c-2.69 0-4.629-2.572-4.021-5.188a100 100 0 0 0 2.59-22.658 100 100 0 0 0-2.59-22.66c-.608-2.615 1.332-5.188 4.023-5.188 1.832 0 3.441 1.224 3.863 3.003a108 108 0 0 1 2.88 24.845c0 8.55-.998 16.867-2.88 24.844a3.94 3.94 0 0 1-3.863 3.005m18.528-12.228c-2.465 0-4.358-2.164-4.128-4.608.691-7.326.691-14.701 0-22.027-.23-2.444 1.663-4.608 4.126-4.608 2.054 0 3.79 1.522 3.987 3.557.775 8.024.775 16.105 0 24.129-.197 2.037-1.935 3.557-3.987 3.557m16.712-20.83 2.336 2.328a4.065 4.065 0 0 1 0 5.76l-2.336 2.33c-1.715 1.713-4.653.5-4.653-1.92v-6.58c0-2.419 2.935-3.632 4.653-1.921"/></g><defs><clipPath id="clip0_15940_7386"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/frame.io-light.svg b/web/packages/design/src/ResourceIcon/assets/frame.io-light.svg
index 307285feaf115..9bd3e484c0940 100644
--- a/web/packages/design/src/ResourceIcon/assets/frame.io-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/frame.io-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7386)">
-<path d="M8.11625 72.0005C5.17695 72.0005 3.23084 68.9341 4.29389 66.2024C8.03248 56.5724 9.94555 46.3307 9.93531 36.0005C9.93531 25.3487 7.93625 15.165 4.29389 5.79861C3.23084 3.06684 5.17695 0.000488281 8.11625 0.000488281C9.71507 0.000488281 11.1657 0.949194 11.7544 2.43155C15.9675 13.1213 18.1244 24.5104 18.1115 36.0005C18.1244 47.4905 15.9675 58.8797 11.7544 69.5694C11.461 70.2923 10.9574 70.9104 10.3088 71.3439C9.66014 71.7773 8.89634 72.006 8.11625 72.0005ZM27.7172 63.8475C25.0278 63.8475 23.088 61.2746 23.6958 58.6593C25.4207 51.2299 26.2897 43.6275 26.2857 36.0005C26.2857 28.2075 25.3899 20.6221 23.6958 13.3417C23.088 10.7264 25.0278 8.15343 27.7193 8.15343C29.5511 8.15343 31.1605 9.37743 31.5819 11.1563C33.5008 19.2982 34.4673 27.6355 34.4619 36.0005C34.4619 44.5515 33.4645 52.8676 31.5819 60.8447C31.3713 61.7078 30.8751 62.4743 30.1739 63.0199C29.4727 63.5654 28.6077 63.8578 27.7193 63.8497M46.2466 51.6224C43.7817 51.6224 41.8885 49.4581 42.1193 47.0144C42.8102 39.688 42.8102 32.3129 42.1193 24.9866C41.8885 22.5428 43.7817 20.3786 46.2445 20.3786C48.2986 20.3786 50.0351 21.9012 50.232 23.9363C51.0065 31.9604 51.0065 40.0405 50.232 48.0647C50.0351 50.1019 48.2965 51.6224 46.2445 51.6224M62.957 30.7911L65.2927 33.1205C65.6718 33.4982 65.9725 33.9471 66.1777 34.4413C66.383 34.9355 66.4886 35.4654 66.4886 36.0005C66.4886 36.5356 66.383 37.0655 66.1777 37.5597C65.9725 38.0539 65.6718 38.5028 65.2927 38.8805L62.957 41.2099C61.2417 42.9231 58.3045 41.7097 58.3045 39.2892V32.7097C58.3045 30.2913 61.2395 29.0779 62.957 30.789" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7386">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7386)"><path fill="#000" d="M8.116 72c-2.939 0-4.885-3.066-3.822-5.798a83.2 83.2 0 0 0 5.641-30.201c0-10.652-1.999-20.836-5.641-30.202C3.23 3.067 5.177 0 8.116 0c1.6 0 3.05.95 3.638 2.432A91.3 91.3 0 0 1 18.112 36a91.3 91.3 0 0 1-6.358 33.568A3.9 3.9 0 0 1 8.116 72m19.601-8.153c-2.69 0-4.629-2.572-4.021-5.188a100 100 0 0 0 2.59-22.658 100 100 0 0 0-2.59-22.66c-.608-2.615 1.332-5.188 4.023-5.188 1.832 0 3.441 1.224 3.863 3.003a108 108 0 0 1 2.88 24.845c0 8.55-.998 16.867-2.88 24.844a3.94 3.94 0 0 1-3.863 3.005m18.528-12.228c-2.465 0-4.358-2.164-4.128-4.608.691-7.326.691-14.701 0-22.027-.23-2.444 1.663-4.608 4.126-4.608 2.054 0 3.79 1.522 3.987 3.557.775 8.024.775 16.105 0 24.129-.197 2.037-1.935 3.557-3.987 3.557m16.712-20.83 2.336 2.328a4.065 4.065 0 0 1 0 5.76l-2.336 2.33c-1.715 1.713-4.653.5-4.653-1.92v-6.58c0-2.419 2.935-3.632 4.653-1.921"/></g><defs><clipPath id="clip0_15940_7386"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/g2.svg b/web/packages/design/src/ResourceIcon/assets/g2.svg
index 7f0ca4b20c876..d727f1e5ab7b0 100644
--- a/web/packages/design/src/ResourceIcon/assets/g2.svg
+++ b/web/packages/design/src/ResourceIcon/assets/g2.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15941_7413)">
-<path d="M36 72.0005C55.8822 72.0005 72 55.8827 72 36.0005C72 16.1182 55.8822 0.000488281 36 0.000488281C16.1177 0.000488281 0 16.1182 0 36.0005C0 55.8827 16.1177 72.0005 36 72.0005Z" fill="#FF492C"/>
-<path d="M24.6097 36.0006C24.6097 42.4806 29.8873 47.7582 36.3673 47.7582C39.1803 47.7578 41.8993 46.7458 44.0281 44.907L48.4777 52.6254C44.9641 55.1968 40.7213 56.5791 36.3673 56.571C25.0057 56.571 15.7969 47.3622 15.7969 36.0006C15.7969 24.639 25.0057 15.4302 36.3673 15.4302C37.7186 15.43 39.0667 15.5626 40.3921 15.8262L36.3673 24.243C29.8873 24.243 24.6097 29.5206 24.6097 36.0006Z" fill="white"/>
-<path d="M45.4325 27.5764H51.5813V30.1252H42.2789V29.6932C42.2789 28.1164 42.5885 26.8132 43.2221 25.7764C43.8557 24.7396 44.9501 23.8252 46.5269 23.026L47.2541 22.6732C48.5357 22.0252 48.8669 21.4708 48.8669 20.8012C48.8669 20.002 48.1829 19.426 47.0669 19.426C45.7493 19.426 44.7485 20.11 44.0573 21.5068L42.2789 19.7212C42.6677 18.886 43.2941 18.2164 44.1365 17.698C44.9725 17.1649 45.9458 16.8871 46.9373 16.8988C48.2189 16.8988 49.3133 17.2372 50.2421 17.9212C51.1709 18.6052 51.6389 19.5556 51.6389 20.758C51.6389 22.6732 50.5589 23.8468 48.5357 24.8836L47.4053 25.4596C46.1957 26.0716 45.5981 26.6116 45.4325 27.5764Z" fill="white"/>
-<path d="M40.5797 33.0628H50.7605L55.8509 41.8756L50.7605 50.6956L45.6701 41.8756H35.4893L40.5797 33.0628Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15941_7413">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15941_7413)"><path fill="#ff492c" d="M36 72c19.882 0 36-16.117 36-36S55.882 0 36 0 0 16.118 0 36s16.118 36 36 36"/><path fill="#fff" d="M24.61 36c0 6.48 5.277 11.758 11.757 11.758a11.72 11.72 0 0 0 7.661-2.851l4.45 7.718a20.44 20.44 0 0 1-12.11 3.946c-11.362 0-20.571-9.209-20.571-20.57s9.209-20.57 20.57-20.57c1.352-.001 2.7.132 4.025.395l-4.025 8.417c-6.48 0-11.757 5.278-11.757 11.758"/><path fill="#fff" d="M45.433 27.576h6.148v2.55H42.28v-.433c0-1.577.31-2.88.943-3.917.634-1.036 1.728-1.95 3.305-2.75l.727-.353c1.282-.648 1.613-1.202 1.613-1.872 0-.799-.684-1.375-1.8-1.375-1.318 0-2.318.684-3.01 2.08l-1.778-1.785c.389-.835 1.015-1.505 1.857-2.023a5.1 5.1 0 0 1 2.801-.8c1.282 0 2.376.34 3.305 1.023.929.684 1.397 1.635 1.397 2.837 0 1.915-1.08 3.089-3.103 4.126l-1.13.576c-1.21.612-1.808 1.152-1.974 2.116m-4.853 5.487h10.18l5.09 8.813-5.09 8.82-5.09-8.82H35.49z"/></g><defs><clipPath id="clip0_15941_7413"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/gable.svg b/web/packages/design/src/ResourceIcon/assets/gable.svg
index 0150b738c1b21..8eb5dcd723581 100644
--- a/web/packages/design/src/ResourceIcon/assets/gable.svg
+++ b/web/packages/design/src/ResourceIcon/assets/gable.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M36.2221 3.12997C39.628 3.12997 42.7804 4.93623 44.4238 7.82562L60.9651 35.9682L61.156 36.3126C63.4788 40.7421 61.7727 46.211 57.2962 48.6089C55.1163 49.7785 52.5673 50.0558 50.187 49.3821C47.8241 48.7339 45.8125 47.1792 44.5898 45.0559L36.291 31.1881L17.5866 64.1296C16.7856 65.5238 15.6416 66.6902 14.2632 67.5181C12.8847 68.3459 11.3175 68.8077 9.71045 68.8597L9.35671 68.8691C7.28305 68.8723 5.26502 68.1985 3.60923 66.9501C-0.0690306 64.1891 -1.07077 59.0583 1.2301 55.0044L27.9922 7.86632C28.8239 6.42069 30.0234 5.22098 31.4689 4.38909C32.9144 3.5572 34.5543 3.12278 36.2221 3.12997ZM63.0343 50.938C65.4116 50.9396 67.691 51.8847 69.3721 53.5658C71.0531 55.2468 71.9982 57.5262 71.9998 59.9035C71.9982 62.2808 71.0531 64.5603 69.3721 66.2413C67.691 67.9223 65.4116 68.8674 63.0343 68.8691C60.657 68.8674 58.3775 67.9223 56.6965 66.2413C55.0155 64.5603 54.0704 62.2808 54.0687 59.9035C54.0704 57.5262 55.0155 55.2468 56.6965 53.5658C58.3775 51.8847 60.657 50.9396 63.0343 50.938ZM36.2221 8.76475C34.8259 8.76475 33.5518 9.49414 32.8944 10.6461L6.12923 57.7874C5.21514 59.3995 5.60645 61.403 6.9901 62.4423C7.68506 62.962 8.49271 63.2343 9.35671 63.2343C10.756 63.2343 12.0301 62.5018 12.6844 61.3498L33.7772 24.2041C34.0203 23.7757 34.3715 23.4185 34.7957 23.1681C35.22 22.9178 35.7024 22.7831 36.195 22.7774C36.6875 22.7717 37.1729 22.8952 37.6028 23.1357C38.0327 23.3761 38.3921 23.725 38.6451 24.1477L49.4544 42.2197C49.9397 43.0681 50.7317 43.6816 51.7115 43.9571C52.7007 44.2388 53.7337 44.1261 54.6353 43.6441C56.4322 42.6799 57.0739 40.523 56.1285 38.8545L39.5466 10.6493C39.2073 10.0704 38.7212 9.59134 38.1375 9.26045C37.5538 8.92956 36.8931 8.75857 36.2221 8.76475ZM63.0343 56.5728C61.1998 56.5728 59.7035 58.0691 59.7035 59.9035C59.7035 61.738 61.1998 63.2343 63.0343 63.2343C64.8687 63.2343 66.3651 61.738 66.3651 59.9035C66.3651 58.0691 64.8687 56.5728 63.0343 56.5728Z" fill="#8D2DF2"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#8d2df2" d="M36.222 3.13c3.406 0 6.558 1.806 8.202 4.696l16.541 28.142.191.345c2.323 4.43.617 9.898-3.86 12.296a9.54 9.54 0 0 1-7.109.773 9.3 9.3 0 0 1-5.597-4.326l-8.3-13.868L17.587 64.13a9.44 9.44 0 0 1-7.877 4.73l-.353.01a9.52 9.52 0 0 1-5.748-1.92c-3.678-2.76-4.68-7.892-2.379-11.946L27.992 7.866a9.45 9.45 0 0 1 8.23-4.736m26.812 47.808A8.97 8.97 0 0 1 72 59.903a8.97 8.97 0 0 1-8.966 8.966 8.97 8.97 0 0 1-8.965-8.965 8.97 8.97 0 0 1 8.965-8.966M36.222 8.765c-1.396 0-2.67.73-3.328 1.881L6.13 57.787c-.914 1.613-.523 3.616.861 4.655a3.9 3.9 0 0 0 2.367.792c1.399 0 2.673-.732 3.327-1.884l21.093-37.146a2.818 2.818 0 0 1 4.868-.056l10.81 18.072a3.72 3.72 0 0 0 2.257 1.737c.989.282 2.022.17 2.923-.313 1.797-.964 2.439-3.121 1.494-4.79L39.547 10.65a3.81 3.81 0 0 0-3.325-1.884m26.812 47.808a3.337 3.337 0 0 0-3.33 3.33 3.337 3.337 0 0 0 3.33 3.331 3.337 3.337 0 0 0 3.331-3.33 3.337 3.337 0 0 0-3.33-3.331"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/gem-dark.svg b/web/packages/design/src/ResourceIcon/assets/gem-dark.svg
index 4e0bf767d9c32..59343877afbe8 100644
--- a/web/packages/design/src/ResourceIcon/assets/gem-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/gem-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M54 45.0004L35.9999 27.0005L54 9.00049V45.0004ZM0 27.0005L18 9.00049H54L72 27.0005L54 45.0004L35.9999 63.0004L0 27.0005Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M54 45 36 27 54 9zM0 27 18 9h36l18 18-18 18-18 18z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/gem-light.svg b/web/packages/design/src/ResourceIcon/assets/gem-light.svg
index 0a0f204092cd4..ebec9bc8cc21a 100644
--- a/web/packages/design/src/ResourceIcon/assets/gem-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/gem-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M54 45.0004L35.9999 27.0005L54 9.00049V45.0004ZM0 27.0005L18 9.00049H54L72 27.0005L54 45.0004L35.9999 63.0004L0 27.0005Z" fill="#0D62FF"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0d62ff" fill-rule="evenodd" d="M54 45 36 27 54 9zM0 27 18 9h36l18 18-18 18-18 18z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/git-dark.svg b/web/packages/design/src/ResourceIcon/assets/git-dark.svg
index cb1a374e8badc..f866e76f785ce 100644
--- a/web/packages/design/src/ResourceIcon/assets/git-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/git-dark.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="92pt" height="92pt" viewBox="0 0 92 92"><defs><clipPath id="a"><path d="M0 .113h91.887V92H0Zm0 0"/></clipPath></defs><g clip-path="url(#a)"><path style="stroke:none;fill-rule:nonzero;fill:#fff;fill-opacity:1" d="M90.156 41.965 50.036 1.848a5.918 5.918 0 0 0-8.372 0l-8.328 8.332 10.566 10.566a7.03 7.03 0 0 1 7.23 1.684 7.034 7.034 0 0 1 1.669 7.277l10.187 10.184a7.028 7.028 0 0 1 7.278 1.672 7.04 7.04 0 0 1 0 9.957 7.05 7.05 0 0 1-9.965 0 7.044 7.044 0 0 1-1.528-7.66l-9.5-9.497V59.36a7.04 7.04 0 0 1 1.86 11.29 7.04 7.04 0 0 1-9.957 0 7.04 7.04 0 0 1 0-9.958 7.06 7.06 0 0 1 2.304-1.539V33.926a7.049 7.049 0 0 1-3.82-9.234L29.242 14.272 1.73 41.777a5.925 5.925 0 0 0 0 8.371L41.852 90.27a5.925 5.925 0 0 0 8.37 0l39.934-39.934a5.925 5.925 0 0 0 0-8.371"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="92pt" height="92pt" viewBox="0 0 92 92"><defs><clipPath id="a"><path d="M0 .113h91.887V92H0Zm0 0"/></clipPath></defs><g clip-path="url(#a)"><path d="M90.156 41.965 50.036 1.848a5.92 5.92 0 0 0-8.372 0l-8.328 8.332 10.566 10.566a7.03 7.03 0 0 1 7.23 1.684 7.03 7.03 0 0 1 1.669 7.277l10.187 10.184a7.03 7.03 0 0 1 7.278 1.672 7.04 7.04 0 0 1 0 9.957 7.05 7.05 0 0 1-9.965 0 7.04 7.04 0 0 1-1.528-7.66l-9.5-9.497V59.36a7.04 7.04 0 0 1 1.86 11.29 7.04 7.04 0 0 1-9.957 0 7.04 7.04 0 0 1 0-9.958 7.1 7.1 0 0 1 2.304-1.539V33.926a7.05 7.05 0 0 1-3.82-9.234l-10.418-10.42L1.73 41.777a5.925 5.925 0 0 0 0 8.371L41.852 90.27a5.925 5.925 0 0 0 8.37 0l39.934-39.934a5.925 5.925 0 0 0 0-8.371" style="stroke:none;fill-rule:nonzero;fill:#fff;fill-opacity:1"/></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/git-light.svg b/web/packages/design/src/ResourceIcon/assets/git-light.svg
index 5bf444b9be0ca..eef17034ea4d8 100644
--- a/web/packages/design/src/ResourceIcon/assets/git-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/git-light.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="92pt" height="92pt" viewBox="0 0 92 92"><defs><clipPath id="a"><path d="M0 .113h91.887V92H0Zm0 0"/></clipPath></defs><g clip-path="url(#a)"><path style="stroke:none;fill-rule:nonzero;fill:#f03c2e;fill-opacity:1" d="M90.156 41.965 50.036 1.848a5.918 5.918 0 0 0-8.372 0l-8.328 8.332 10.566 10.566a7.03 7.03 0 0 1 7.23 1.684 7.034 7.034 0 0 1 1.669 7.277l10.187 10.184a7.028 7.028 0 0 1 7.278 1.672 7.04 7.04 0 0 1 0 9.957 7.05 7.05 0 0 1-9.965 0 7.044 7.044 0 0 1-1.528-7.66l-9.5-9.497V59.36a7.04 7.04 0 0 1 1.86 11.29 7.04 7.04 0 0 1-9.957 0 7.04 7.04 0 0 1 0-9.958 7.06 7.06 0 0 1 2.304-1.539V33.926a7.049 7.049 0 0 1-3.82-9.234L29.242 14.272 1.73 41.777a5.925 5.925 0 0 0 0 8.371L41.852 90.27a5.925 5.925 0 0 0 8.37 0l39.934-39.934a5.925 5.925 0 0 0 0-8.371"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="92pt" height="92pt" viewBox="0 0 92 92"><defs><clipPath id="a"><path d="M0 .113h91.887V92H0Zm0 0"/></clipPath></defs><g clip-path="url(#a)"><path d="M90.156 41.965 50.036 1.848a5.92 5.92 0 0 0-8.372 0l-8.328 8.332 10.566 10.566a7.03 7.03 0 0 1 7.23 1.684 7.03 7.03 0 0 1 1.669 7.277l10.187 10.184a7.03 7.03 0 0 1 7.278 1.672 7.04 7.04 0 0 1 0 9.957 7.05 7.05 0 0 1-9.965 0 7.04 7.04 0 0 1-1.528-7.66l-9.5-9.497V59.36a7.04 7.04 0 0 1 1.86 11.29 7.04 7.04 0 0 1-9.957 0 7.04 7.04 0 0 1 0-9.958 7.1 7.1 0 0 1 2.304-1.539V33.926a7.05 7.05 0 0 1-3.82-9.234l-10.418-10.42L1.73 41.777a5.925 5.925 0 0 0 0 8.371L41.852 90.27a5.925 5.925 0 0 0 8.37 0l39.934-39.934a5.925 5.925 0 0 0 0-8.371" style="stroke:none;fill-rule:nonzero;fill:#f03c2e;fill-opacity:1"/></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/github-dark.svg b/web/packages/design/src/ResourceIcon/assets/github-dark.svg
index 90cc47bb0d656..538e590d3d42e 100644
--- a/web/packages/design/src/ResourceIcon/assets/github-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/github-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="71" viewBox="0 0 72 71" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7805_38670)">
-<path d="M36 0C55.89 0 72 16.11 72 36C71.9981 43.5429 69.6308 50.8953 65.2313 57.0223C60.8318 63.1493 54.6217 67.7424 47.475 70.155C45.675 70.515 45 69.39 45 68.445C45 67.23 45.045 63.36 45.045 58.545C45.045 55.17 43.92 53.01 42.615 51.885C50.625 50.985 59.04 47.925 59.04 34.11C59.04 30.15 57.645 26.955 55.35 24.435C55.71 23.535 56.97 19.845 54.99 14.895C54.99 14.895 51.975 13.905 45.09 18.585C42.21 17.775 39.15 17.37 36.09 17.37C33.03 17.37 29.97 17.775 27.09 18.585C20.205 13.95 17.19 14.895 17.19 14.895C15.21 19.845 16.47 23.535 16.83 24.435C14.535 26.955 13.14 30.195 13.14 34.11C13.14 47.88 21.51 50.985 29.52 51.885C28.485 52.785 27.54 54.36 27.225 56.7C25.155 57.645 19.98 59.175 16.74 53.73C16.065 52.65 14.04 49.995 11.205 50.04C8.19001 50.085 9.99001 51.75 11.25 52.425C12.78 53.28 14.535 56.475 14.94 57.51C15.66 59.535 18 63.405 27.045 61.74C27.045 64.755 27.09 67.59 27.09 68.445C27.09 69.39 26.415 70.47 24.615 70.155C17.4449 67.7684 11.2083 63.1846 6.79001 57.0539C2.37171 50.9232 -0.00396216 43.5569 4.96041e-06 36C4.96041e-06 16.11 16.11 0 36 0Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_7805_38670">
-<rect width="72" height="70.2238" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="71" fill="none" viewBox="0 0 72 71"><g clip-path="url(#clip0_7805_38670)"><path fill="#fff" d="M36 0c19.89 0 36 16.11 36 36a36.06 36.06 0 0 1-24.525 34.155c-1.8.36-2.475-.765-2.475-1.71 0-1.215.045-5.085.045-9.9 0-3.375-1.125-5.535-2.43-6.66 8.01-.9 16.425-3.96 16.425-17.775 0-3.96-1.395-7.155-3.69-9.675.36-.9 1.62-4.59-.36-9.54 0 0-3.015-.99-9.9 3.69-2.88-.81-5.94-1.215-9-1.215s-6.12.405-9 1.215c-6.885-4.635-9.9-3.69-9.9-3.69-1.98 4.95-.72 8.64-.36 9.54-2.295 2.52-3.69 5.76-3.69 9.675 0 13.77 8.37 16.875 16.38 17.775-1.035.9-1.98 2.475-2.295 4.815-2.07.945-7.245 2.475-10.485-2.97-.675-1.08-2.7-3.735-5.535-3.69-3.015.045-1.215 1.71.045 2.385 1.53.855 3.285 4.05 3.69 5.085.72 2.025 3.06 5.895 12.105 4.23 0 3.015.045 5.85.045 6.705 0 .945-.675 2.025-2.475 1.71A35.98 35.98 0 0 1 0 36C0 16.11 16.11 0 36 0"/></g><defs><clipPath id="clip0_7805_38670"><path fill="#fff" d="M0 0h72v70.224H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/github-light.svg b/web/packages/design/src/ResourceIcon/assets/github-light.svg
index d274ee6eb2993..7b2c19b74fce4 100644
--- a/web/packages/design/src/ResourceIcon/assets/github-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/github-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7805_38669)">
-<path d="M36 0C55.89 0 72 16.11 72 36C71.9981 43.5429 69.6308 50.8953 65.2313 57.0223C60.8318 63.1493 54.6217 67.7424 47.475 70.155C45.675 70.515 45 69.39 45 68.445C45 67.23 45.045 63.36 45.045 58.545C45.045 55.17 43.92 53.01 42.615 51.885C50.625 50.985 59.04 47.925 59.04 34.11C59.04 30.15 57.645 26.955 55.35 24.435C55.71 23.535 56.97 19.845 54.99 14.895C54.99 14.895 51.975 13.905 45.09 18.585C42.21 17.775 39.15 17.37 36.09 17.37C33.03 17.37 29.97 17.775 27.09 18.585C20.205 13.95 17.19 14.895 17.19 14.895C15.21 19.845 16.47 23.535 16.83 24.435C14.535 26.955 13.14 30.195 13.14 34.11C13.14 47.88 21.51 50.985 29.52 51.885C28.485 52.785 27.54 54.36 27.225 56.7C25.155 57.645 19.98 59.175 16.74 53.73C16.065 52.65 14.04 49.995 11.205 50.04C8.19001 50.085 9.99001 51.75 11.25 52.425C12.78 53.28 14.535 56.475 14.94 57.51C15.66 59.535 18 63.405 27.045 61.74C27.045 64.755 27.09 67.59 27.09 68.445C27.09 69.39 26.415 70.47 24.615 70.155C17.4449 67.7684 11.2083 63.1846 6.79001 57.0539C2.37171 50.9232 -0.00396216 43.5569 4.96041e-06 36C4.96041e-06 16.11 16.11 0 36 0Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_7805_38669">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_7805_38669)"><path fill="#000" d="M36 0c19.89 0 36 16.11 36 36a36.06 36.06 0 0 1-24.525 34.155c-1.8.36-2.475-.765-2.475-1.71 0-1.215.045-5.085.045-9.9 0-3.375-1.125-5.535-2.43-6.66 8.01-.9 16.425-3.96 16.425-17.775 0-3.96-1.395-7.155-3.69-9.675.36-.9 1.62-4.59-.36-9.54 0 0-3.015-.99-9.9 3.69-2.88-.81-5.94-1.215-9-1.215s-6.12.405-9 1.215c-6.885-4.635-9.9-3.69-9.9-3.69-1.98 4.95-.72 8.64-.36 9.54-2.295 2.52-3.69 5.76-3.69 9.675 0 13.77 8.37 16.875 16.38 17.775-1.035.9-1.98 2.475-2.295 4.815-2.07.945-7.245 2.475-10.485-2.97-.675-1.08-2.7-3.735-5.535-3.69-3.015.045-1.215 1.71.045 2.385 1.53.855 3.285 4.05 3.69 5.085.72 2.025 3.06 5.895 12.105 4.23 0 3.015.045 5.85.045 6.705 0 .945-.675 2.025-2.475 1.71A35.98 35.98 0 0 1 0 36C0 16.11 16.11 0 36 0"/></g><defs><clipPath id="clip0_7805_38669"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/gitlab.svg b/web/packages/design/src/ResourceIcon/assets/gitlab.svg
index e3e600b098e8c..d8f69183085f4 100644
--- a/web/packages/design/src/ResourceIcon/assets/gitlab.svg
+++ b/web/packages/design/src/ResourceIcon/assets/gitlab.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M70.8015 28.5721L70.7003 28.3134L60.9006 2.73808C60.7012 2.23681 60.3481 1.81159 59.8921 1.52342C59.4358 1.24014 58.9035 1.10371 58.3672 1.13253C57.8308 1.16136 57.3163 1.35406 56.8929 1.68462C56.4743 2.02467 56.1706 2.48545 56.0232 3.00425L49.4063 23.2486H22.6125L15.9956 3.00425C15.8521 2.48262 15.5477 2.01954 15.1258 1.68087C14.7025 1.35031 14.1879 1.15761 13.6516 1.12878C13.1152 1.09996 12.583 1.23639 12.1267 1.51967C11.6716 1.809 11.3189 2.23386 11.1182 2.73433L1.29967 28.2985L1.2022 28.5571C-0.208521 32.2431 -0.382652 36.2878 0.706063 40.0814C1.79478 43.875 4.08732 47.2118 7.23802 49.5888L7.27176 49.615L7.36173 49.6787L22.2901 60.8581L29.6755 66.4478L34.1743 69.8444C34.7005 70.2439 35.343 70.4602 36.0037 70.4602C36.6645 70.4602 37.307 70.2439 37.8332 69.8444L42.332 66.4478L49.7174 60.8581L64.7357 49.6113L64.7732 49.5813C67.9169 47.2039 70.2041 43.8705 71.2911 40.082C72.3782 36.2936 72.2064 32.2546 70.8015 28.5721Z" fill="#E24329"/>
-<path d="M70.8015 28.5722L70.7003 28.3135C65.9253 29.2936 61.4256 31.3162 57.5227 34.2368L36 50.511C43.3292 56.0557 49.7099 60.8732 49.7099 60.8732L64.7282 49.6263L64.7657 49.5963C67.9139 47.219 70.2046 43.8835 71.2932 40.0918C72.3817 36.3001 72.2092 32.2573 70.8015 28.5722Z" fill="#FC6D26"/>
-<path d="M22.29 60.8733L29.6755 66.463L34.1742 69.8596C34.7005 70.2591 35.343 70.4754 36.0037 70.4754C36.6644 70.4754 37.307 70.2591 37.8332 69.8596L42.332 66.463L49.7174 60.8733C49.7174 60.8733 43.3292 56.0409 36 50.5112C28.6708 56.0409 22.29 60.8733 22.29 60.8733Z" fill="#FCA326"/>
-<path d="M14.4735 34.2367C10.5738 31.3101 6.0751 29.2822 1.29967 28.2983L1.2022 28.557C-0.208521 32.243 -0.382652 36.2877 0.706063 40.0813C1.79478 43.8749 4.08732 47.2117 7.23802 49.5886L7.27176 49.6149L7.36173 49.6786L22.2901 60.858C22.2901 60.858 28.6633 56.0406 36 50.4959L14.4735 34.2367Z" fill="#FC6D26"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#e24329" d="m70.802 28.572-.102-.259-9.8-25.575a2.55 2.55 0 0 0-1.008-1.215 2.62 2.62 0 0 0-3 .162c-.418.34-.721.8-.869 1.32l-6.617 20.244H22.613L15.996 3.004a2.57 2.57 0 0 0-.87-1.323 2.62 2.62 0 0 0-3-.161 2.6 2.6 0 0 0-1.008 1.214L1.3 28.3l-.098.258A18.2 18.2 0 0 0 7.238 49.59l.034.026.09.064L22.29 60.86l7.386 5.589 4.498 3.396a3.025 3.025 0 0 0 3.66 0l4.498-3.396 7.385-5.59 15.019-11.247.037-.03a18.205 18.205 0 0 0 6.029-21.009"/><path fill="#fc6d26" d="m70.802 28.572-.102-.258a33.1 33.1 0 0 0-13.177 5.923L36 50.51c7.33 5.545 13.71 10.362 13.71 10.362l15.018-11.247.038-.03A18.205 18.205 0 0 0 70.8 28.572"/><path fill="#fca326" d="m22.29 60.873 7.386 5.59 4.498 3.397a3.026 3.026 0 0 0 3.66 0l4.498-3.397 7.385-5.59S43.33 56.041 36 50.511c-7.33 5.53-13.71 10.362-13.71 10.362"/><path fill="#fc6d26" d="M14.474 34.237A33.1 33.1 0 0 0 1.3 28.298l-.098.259a18.2 18.2 0 0 0 6.036 21.032l.034.026.09.064L22.29 60.858 36 50.496z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/gmail.svg b/web/packages/design/src/ResourceIcon/assets/gmail.svg
index da9434c52066a..24bb46c219aab 100644
--- a/web/packages/design/src/ResourceIcon/assets/gmail.svg
+++ b/web/packages/design/src/ResourceIcon/assets/gmail.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4393)">
-<path d="M4.90909 63H16.3636V35.189L0 22.9194V58.0921C0 60.8078 2.20091 63 4.90909 63Z" fill="#4285F4"/>
-<path d="M55.6367 63H67.0913C69.8076 63 72.0004 60.7996 72.0004 58.0921V22.9194L55.6367 35.189" fill="#34A853"/>
-<path d="M55.6367 13.9217V35.189L72.0004 22.9194V16.3757C72.0004 10.3063 65.0704 6.8463 60.2185 10.4863" fill="#FBBC04"/>
-<path d="M16.3633 35.1886V13.9214L35.9996 28.6448L55.636 13.9214V35.1886L35.9996 49.9121" fill="#EA4335"/>
-<path d="M0 16.3757V22.9194L16.3636 35.189V13.9217L11.7818 10.4863C6.92182 6.8463 0 10.3063 0 16.3757Z" fill="#C5221F"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4393">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4393)"><path fill="#4285f4" d="M4.91 63h11.454V35.189L0 22.919v35.173C0 60.808 2.2 63 4.91 63"/><path fill="#34a853" d="M55.637 63H67.09c2.717 0 4.91-2.2 4.91-4.908V22.92L55.636 35.19"/><path fill="#fbbc04" d="M55.637 13.922v21.267L72 22.919v-6.543c0-6.07-6.93-9.53-11.782-5.89"/><path fill="#ea4335" d="M16.363 35.189V13.92L36 28.645 55.636 13.92v21.27L36 49.912"/><path fill="#c5221f" d="M0 16.376v6.543l16.364 12.27V13.922l-4.582-3.436C6.922 6.846 0 10.306 0 16.376"/></g><defs><clipPath id="clip0_8803_4393"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/go1-dark.svg b/web/packages/design/src/ResourceIcon/assets/go1-dark.svg
index f5c49faf5b696..2f79cc662bcac 100644
--- a/web/packages/design/src/ResourceIcon/assets/go1-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/go1-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15941_7440)">
-<path d="M52.3571 42.8945H71.9996V38.6375H64.6106V22.469C64.6106 19.787 62.8556 18.0005 60.1691 18.0005V22.2125H52.4381V26.4695H56.0696C58.1171 26.4695 59.6156 25.4435 60.1691 23.828V38.633H52.3571V42.8945ZM40.9946 38.8985H35.9096C35.3245 38.9038 34.744 38.7935 34.2016 38.5738C33.6593 38.3541 33.1657 38.0294 32.7492 37.6183C32.3327 37.2073 32.0015 36.718 31.7747 36.1785C31.5479 35.6391 31.43 35.0602 31.4276 34.475V30.65C31.4276 28.2245 33.3941 26.2265 35.9141 26.2265H40.9991C41.587 26.217 42.1709 26.324 42.7171 26.5414C43.2633 26.7588 43.7611 27.0823 44.1816 27.4932C44.6021 27.9041 44.937 28.3942 45.167 28.9353C45.397 29.4763 45.5175 30.0576 45.5216 30.6455V34.475C45.5175 35.0635 45.3969 35.6453 45.1667 36.1869C44.9364 36.7285 44.6012 37.2192 44.1803 37.6304C43.7593 38.0417 43.2611 38.3656 42.7143 38.5832C42.1675 38.8009 41.583 38.908 40.9946 38.8985ZM26.8196 32.549C26.8196 38.9795 31.5176 43.3175 38.0111 43.3175H38.9111C45.4001 43.3175 50.1386 38.9795 50.1386 32.549C50.1386 26.1185 45.3911 21.7895 38.8976 21.7895H38.0021C31.5176 21.7895 26.8196 26.1275 26.8196 32.549ZM15.9701 55.319H8.15812C6.06112 55.319 4.56712 54.041 4.56712 52.2905V51.9485C4.56712 50.162 6.06112 48.8435 8.15812 48.8435H15.9746C18.0671 48.8435 19.6016 50.162 19.6016 51.9485V52.2905C19.6016 54.041 18.0716 55.3145 15.9746 55.3145L15.9701 55.319ZM14.5166 37.364H9.52162C7.09162 37.364 5.12062 35.5325 5.12062 33.152V30.5105C5.1229 29.9378 5.23903 29.3713 5.46224 28.8439C5.68546 28.3165 6.0113 27.8388 6.42083 27.4385C6.83035 27.0382 7.31538 26.7233 7.84771 26.5121C8.38004 26.301 8.94904 26.1977 9.52162 26.2085H14.5166C16.9511 26.2085 18.9176 28.0805 18.9176 30.5105V33.1025C18.9176 35.5325 16.9511 37.3595 14.5211 37.3595L14.5166 37.364ZM24.2051 51.998C24.2051 47.3585 21.0011 44.636 14.3456 44.636H5.97562C4.94512 44.636 4.31062 43.9925 4.31062 43.187C4.31062 42.332 4.95412 41.702 5.97562 41.702H12.2981C18.8321 41.702 23.5301 37.571 23.5301 31.532V22.127C21.6941 22.127 20.1101 23.2745 19.4261 24.854C17.7206 22.9325 15.1106 21.7895 11.7851 21.7895H11.0966C5.20612 21.7895 0.508117 25.7855 0.508117 31.703C0.508117 34.727 1.75012 37.0175 3.79312 38.5565C1.61962 39.1865 0.0761172 40.937 0.0761172 43.1915C0.0761172 45.275 1.35862 46.9355 3.28462 47.66C1.23712 48.803 -0.00488281 50.594 -0.00488281 53.024C-0.00488281 57.11 4.00912 59.7425 11.8661 59.7425H12.3386C20.1956 59.7425 24.2051 56.975 24.2051 51.998Z" fill="#D4FF26"/>
-</g>
-<defs>
-<clipPath id="clip0_15941_7440">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15941_7440)"><path fill="#d4ff26" d="M52.357 42.895H72v-4.257h-7.39V22.469c0-2.682-1.754-4.469-4.44-4.469v4.212h-7.732v4.258h3.632c2.047 0 3.546-1.026 4.1-2.642v14.805h-7.813zm-11.362-3.997H35.91a4.44 4.44 0 0 1-4.482-4.423V30.65c0-2.425 1.966-4.423 4.486-4.423H41a4.45 4.45 0 0 1 4.523 4.418v3.83a4.456 4.456 0 0 1-4.527 4.423M26.82 32.55c0 6.43 4.698 10.769 11.191 10.769h.9c6.49 0 11.228-4.338 11.228-10.769 0-6.43-4.748-10.76-11.241-10.76h-.896c-6.484 0-11.182 4.339-11.182 10.76M15.97 55.32H8.158c-2.097 0-3.59-1.278-3.59-3.029v-.341c0-1.787 1.493-3.105 3.59-3.105h7.817c2.092 0 3.627 1.318 3.627 3.105v.342c0 1.75-1.53 3.024-3.627 3.024zm-1.453-17.955H9.522c-2.43 0-4.401-1.831-4.401-4.212V30.51a4.32 4.32 0 0 1 4.4-4.302h4.996c2.434 0 4.4 1.873 4.4 4.303v2.592c0 2.43-1.966 4.256-4.396 4.256zm9.688 14.634c0-4.64-3.204-7.362-9.86-7.362h-8.37c-1.03 0-1.664-.644-1.664-1.449 0-.855.643-1.485 1.665-1.485h6.322c6.534 0 11.232-4.131 11.232-10.17v-9.405c-1.836 0-3.42 1.148-4.104 2.727-1.705-1.921-4.315-3.064-7.64-3.064h-.69c-5.89 0-10.588 3.996-10.588 9.913 0 3.024 1.242 5.314 3.285 6.854-2.173.63-3.717 2.38-3.717 4.634 0 2.084 1.283 3.744 3.209 4.469-2.048 1.143-3.29 2.934-3.29 5.364 0 4.086 4.014 6.718 11.871 6.718h.473c7.857 0 11.866-2.767 11.866-7.744"/></g><defs><clipPath id="clip0_15941_7440"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/go1-light.svg b/web/packages/design/src/ResourceIcon/assets/go1-light.svg
index 04010a940db99..434c610559ea4 100644
--- a/web/packages/design/src/ResourceIcon/assets/go1-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/go1-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15941_7439)">
-<path d="M52.3571 42.8945H71.9996V38.6375H64.6106V22.469C64.6106 19.787 62.8556 18.0005 60.1691 18.0005V22.2125H52.4381V26.4695H56.0696C58.1171 26.4695 59.6156 25.4435 60.1691 23.828V38.633H52.3571V42.8945ZM40.9946 38.8985H35.9096C35.3245 38.9038 34.744 38.7935 34.2016 38.5738C33.6593 38.3541 33.1657 38.0294 32.7492 37.6183C32.3327 37.2073 32.0015 36.718 31.7747 36.1785C31.5479 35.6391 31.43 35.0602 31.4276 34.475V30.65C31.4276 28.2245 33.3941 26.2265 35.9141 26.2265H40.9991C41.587 26.217 42.1709 26.324 42.7171 26.5414C43.2633 26.7588 43.7611 27.0823 44.1816 27.4932C44.6021 27.9041 44.937 28.3942 45.167 28.9353C45.397 29.4763 45.5175 30.0576 45.5216 30.6455V34.475C45.5175 35.0635 45.3969 35.6453 45.1667 36.1869C44.9364 36.7285 44.6012 37.2192 44.1803 37.6304C43.7593 38.0417 43.2611 38.3656 42.7143 38.5832C42.1675 38.8009 41.583 38.908 40.9946 38.8985ZM26.8196 32.549C26.8196 38.9795 31.5176 43.3175 38.0111 43.3175H38.9111C45.4001 43.3175 50.1386 38.9795 50.1386 32.549C50.1386 26.1185 45.3911 21.7895 38.8976 21.7895H38.0021C31.5176 21.7895 26.8196 26.1275 26.8196 32.549ZM15.9701 55.319H8.15812C6.06112 55.319 4.56712 54.041 4.56712 52.2905V51.9485C4.56712 50.162 6.06112 48.8435 8.15812 48.8435H15.9746C18.0671 48.8435 19.6016 50.162 19.6016 51.9485V52.2905C19.6016 54.041 18.0716 55.3145 15.9746 55.3145L15.9701 55.319ZM14.5166 37.364H9.52162C7.09162 37.364 5.12062 35.5325 5.12062 33.152V30.5105C5.1229 29.9378 5.23903 29.3713 5.46224 28.8439C5.68546 28.3165 6.0113 27.8388 6.42083 27.4385C6.83035 27.0382 7.31538 26.7233 7.84771 26.5121C8.38004 26.301 8.94904 26.1977 9.52162 26.2085H14.5166C16.9511 26.2085 18.9176 28.0805 18.9176 30.5105V33.1025C18.9176 35.5325 16.9511 37.3595 14.5211 37.3595L14.5166 37.364ZM24.2051 51.998C24.2051 47.3585 21.0011 44.636 14.3456 44.636H5.97562C4.94512 44.636 4.31062 43.9925 4.31062 43.187C4.31062 42.332 4.95412 41.702 5.97562 41.702H12.2981C18.8321 41.702 23.5301 37.571 23.5301 31.532V22.127C21.6941 22.127 20.1101 23.2745 19.4261 24.854C17.7206 22.9325 15.1106 21.7895 11.7851 21.7895H11.0966C5.20612 21.7895 0.508117 25.7855 0.508117 31.703C0.508117 34.727 1.75012 37.0175 3.79312 38.5565C1.61962 39.1865 0.0761172 40.937 0.0761172 43.1915C0.0761172 45.275 1.35862 46.9355 3.28462 47.66C1.23712 48.803 -0.00488281 50.594 -0.00488281 53.024C-0.00488281 57.11 4.00912 59.7425 11.8661 59.7425H12.3386C20.1956 59.7425 24.2051 56.975 24.2051 51.998Z" fill="#114954"/>
-</g>
-<defs>
-<clipPath id="clip0_15941_7439">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15941_7439)"><path fill="#114954" d="M52.357 42.895H72v-4.257h-7.39V22.469c0-2.682-1.754-4.469-4.44-4.469v4.212h-7.732v4.258h3.632c2.047 0 3.546-1.026 4.1-2.642v14.805h-7.813zm-11.362-3.997H35.91a4.44 4.44 0 0 1-4.482-4.423V30.65c0-2.425 1.966-4.423 4.486-4.423H41a4.45 4.45 0 0 1 4.523 4.418v3.83a4.456 4.456 0 0 1-4.527 4.423M26.82 32.55c0 6.43 4.698 10.769 11.191 10.769h.9c6.49 0 11.228-4.338 11.228-10.769 0-6.43-4.748-10.76-11.241-10.76h-.896c-6.484 0-11.182 4.339-11.182 10.76M15.97 55.32H8.158c-2.097 0-3.59-1.278-3.59-3.029v-.341c0-1.787 1.493-3.105 3.59-3.105h7.817c2.092 0 3.627 1.318 3.627 3.105v.342c0 1.75-1.53 3.024-3.627 3.024zm-1.453-17.955H9.522c-2.43 0-4.401-1.831-4.401-4.212V30.51a4.32 4.32 0 0 1 4.4-4.302h4.996c2.434 0 4.4 1.873 4.4 4.303v2.592c0 2.43-1.966 4.256-4.396 4.256zm9.688 14.634c0-4.64-3.204-7.362-9.86-7.362h-8.37c-1.03 0-1.664-.644-1.664-1.449 0-.855.643-1.485 1.665-1.485h6.322c6.534 0 11.232-4.131 11.232-10.17v-9.405c-1.836 0-3.42 1.148-4.104 2.727-1.705-1.921-4.315-3.064-7.64-3.064h-.69c-5.89 0-10.588 3.996-10.588 9.913 0 3.024 1.242 5.314 3.285 6.854-2.173.63-3.717 2.38-3.717 4.634 0 2.084 1.283 3.744 3.209 4.469-2.048 1.143-3.29 2.934-3.29 5.364 0 4.086 4.014 6.718 11.871 6.718h.473c7.857 0 11.866-2.767 11.866-7.744"/></g><defs><clipPath id="clip0_15941_7439"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/goldcast.svg b/web/packages/design/src/ResourceIcon/assets/goldcast.svg
index c39bf2e4a590a..659697f591436 100644
--- a/web/packages/design/src/ResourceIcon/assets/goldcast.svg
+++ b/web/packages/design/src/ResourceIcon/assets/goldcast.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15941_7453)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M51.5031 36.0005C51.5031 18.6008 37.3997 4.4974 20 4.4974V0.000488281C39.8833 0.000488281 56 16.1172 56 36.0005C56 55.8838 39.8833 72.0005 20 72.0005V67.5036C37.3997 67.5036 51.5031 53.4001 51.5031 36.0005Z" fill="#FF4C00"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M38.001 36.0003C38.001 26.0588 29.9416 17.9994 20 17.9994V13.5024C32.4252 13.5024 42.4979 23.5752 42.4979 36.0003C42.4979 48.4248 32.4257 58.502 20 58.502V54.005C29.941 54.005 38.001 45.9425 38.001 36.0003Z" fill="#FF4C00"/>
-</g>
-<defs>
-<clipPath id="clip0_15941_7453">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#ff4c00" fill-rule="evenodd" clip-path="url(#clip0_15941_7453)" clip-rule="evenodd"><path d="M51.503 36C51.503 18.6 37.4 4.498 20 4.498V0c19.883 0 36 16.117 36 36 0 19.884-16.117 36-36 36v-4.496C37.4 67.504 51.503 53.4 51.503 36"/><path d="M38.001 36c0-9.941-8.06-18-18.001-18v-4.498c12.425 0 22.498 10.073 22.498 22.498S32.426 58.502 20 58.502v-4.497c9.941 0 18.001-8.062 18.001-18.005"/></g><defs><clipPath id="clip0_15941_7453"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/google.svg b/web/packages/design/src/ResourceIcon/assets/google.svg
index f06ca6633d0ab..c5aa451b0bece 100644
--- a/web/packages/design/src/ResourceIcon/assets/google.svg
+++ b/web/packages/design/src/ResourceIcon/assets/google.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M71.5598 36.8182C71.5598 34.2655 71.3308 31.8109 70.9053 29.4546H37V43.3963H56.3745C55.5236 47.88 52.9708 51.6763 49.1418 54.229V63.2944H60.8254C67.6326 57.0108 71.5598 47.7818 71.5598 36.8182Z" fill="#4285F4"/>
-<path d="M36.9984 72.0002C46.7183 72.0002 54.8674 68.7929 60.8237 63.2948L49.1402 54.2294C45.9329 56.3893 41.842 57.6984 36.9984 57.6984C27.6384 57.6984 19.6857 51.3821 16.8385 42.873H4.86035V52.1676C10.784 63.9166 22.9257 72.0002 36.9984 72.0002Z" fill="#34A853"/>
-<path d="M16.8399 42.8392C16.1199 40.6792 15.6945 38.3883 15.6945 35.9992C15.6945 33.6101 16.1199 31.3192 16.8399 29.1592V19.8647H4.8618C2.40727 24.7084 1 30.1738 1 35.9992C1 41.8246 2.40727 47.2901 4.8618 52.1337L14.189 44.8683L16.8399 42.8392Z" fill="#FBBC05"/>
-<path d="M36.9984 14.3345C42.3002 14.3345 47.0129 16.1672 50.7765 19.7017L61.0856 9.39269C54.8347 3.56726 46.7183 0 36.9984 0C22.9257 0 10.784 8.0836 4.86035 19.8654L16.8385 29.1599C19.6857 20.6508 27.6384 14.3345 36.9984 14.3345Z" fill="#EA4335"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#4285f4" d="M71.56 36.818a41.4 41.4 0 0 0-.655-7.363H37v13.941h19.374c-.85 4.484-3.403 8.28-7.232 10.833v9.065h11.683c6.808-6.283 10.735-15.512 10.735-26.476"/><path fill="#34a853" d="M36.998 72c9.72 0 17.87-3.207 23.826-8.705L49.14 54.229c-3.207 2.16-7.298 3.47-12.142 3.47-9.36 0-17.312-6.317-20.16-14.826H4.86v9.295C10.784 63.917 22.926 72 36.998 72"/><path fill="#fbbc05" d="M16.84 42.84c-.72-2.16-1.146-4.452-1.146-6.84 0-2.39.426-4.68 1.146-6.84v-9.295H4.862A35.56 35.56 0 0 0 1 35.999a35.55 35.55 0 0 0 3.862 16.135l9.327-7.266z"/><path fill="#ea4335" d="M36.998 14.335c5.302 0 10.015 1.832 13.779 5.367l10.309-10.31C54.835 3.568 46.718 0 36.998 0 22.926 0 10.784 8.084 4.86 19.865l11.98 9.295c2.847-8.51 10.8-14.825 20.16-14.825"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googleanalytics.svg b/web/packages/design/src/ResourceIcon/assets/googleanalytics.svg
index 7c65953800a91..e223169689401 100644
--- a/web/packages/design/src/ResourceIcon/assets/googleanalytics.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googleanalytics.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15942_7488)">
-<path d="M49.9102 8.5914V62.5914C49.9102 68.6337 54.0788 72.0005 58.5011 72.0005C62.592 72.0005 67.092 69.1369 67.092 62.5914V9.00049C67.092 3.4614 63.0011 0.000488281 58.5011 0.000488281C54.0011 0.000488281 49.9102 3.81731 49.9102 8.5914Z" fill="#F9AB00"/>
-<path d="M27.4102 36.0006V62.5915C27.4102 68.6338 31.5788 72.0006 36.0011 72.0006C40.092 72.0006 44.592 69.1369 44.592 62.5915V36.4097C44.592 30.8706 40.5011 27.4097 36.0011 27.4097C31.5011 27.4097 27.4102 31.2265 27.4102 36.0006Z" fill="#E37400"/>
-<path d="M13.5011 72.0007C18.2457 72.0007 22.092 68.1544 22.092 63.4098C22.092 58.6651 18.2457 54.8188 13.5011 54.8188C8.75644 54.8188 4.91016 58.6651 4.91016 63.4098C4.91016 68.1544 8.75644 72.0007 13.5011 72.0007Z" fill="#E37400"/>
-</g>
-<defs>
-<clipPath id="clip0_15942_7488">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15942_7488)"><path fill="#f9ab00" d="M49.91 8.591v54c0 6.043 4.169 9.41 8.591 9.41 4.091 0 8.591-2.864 8.591-9.41V9.001c0-5.54-4.09-9-8.59-9S49.91 3.816 49.91 8.59"/><path fill="#e37400" d="M27.41 36v26.592c0 6.042 4.169 9.409 8.591 9.409 4.091 0 8.591-2.864 8.591-9.41V36.41c0-5.54-4.09-9-8.59-9S27.41 31.227 27.41 36M13.501 72a8.59 8.59 0 1 0 0-17.181 8.59 8.59 0 0 0 0 17.182"/></g><defs><clipPath id="clip0_15942_7488"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googlecalendar.svg b/web/packages/design/src/ResourceIcon/assets/googlecalendar.svg
index cc03a26a99429..85573b499babb 100644
--- a/web/packages/design/src/ResourceIcon/assets/googlecalendar.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googlecalendar.svg
@@ -1,18 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4391)">
-<path d="M54.9479 17.0524L37.8954 15.1577L17.0532 17.0524L15.1582 35.9999L17.0529 54.9474L36.0004 57.3159L54.9479 54.9474L56.8426 35.5265L54.9479 17.0524Z" fill="white"/>
-<path d="M24.8258 46.4494C23.4095 45.4925 22.4289 44.0953 21.8936 42.2478L25.1811 40.8931C25.4795 42.03 26.0004 42.9109 26.7442 43.5362C27.4833 44.1616 28.3833 44.4694 29.4348 44.4694C30.5102 44.4694 31.4339 44.1425 32.2058 43.4887C32.9776 42.835 33.3664 42.0012 33.3664 40.9925C33.3664 39.96 32.9589 39.1165 32.1442 38.4631C31.3295 37.8097 30.3064 37.4825 29.0842 37.4825H27.1848V34.2285H28.8898C29.9414 34.2285 30.8273 33.9444 31.5473 33.376C32.2673 32.8075 32.6273 32.0306 32.6273 31.0406C32.6273 30.1597 32.3051 29.4585 31.6611 28.9329C31.017 28.4073 30.202 28.1419 29.212 28.1419C28.2458 28.1419 27.4782 28.3979 26.9098 28.9141C26.3414 29.4304 25.9292 30.0651 25.6689 30.8135L22.4148 29.4588C22.8458 28.2366 23.637 27.1566 24.7973 26.2235C25.958 25.2904 27.4404 24.8213 29.2404 24.8213C30.5714 24.8213 31.7698 25.0773 32.8311 25.5935C33.892 26.1097 34.7258 26.8251 35.3273 27.7344C35.9289 28.6485 36.2273 29.6719 36.2273 30.8085C36.2273 31.9691 35.948 32.9494 35.3889 33.7547C34.8298 34.56 34.1429 35.1756 33.3282 35.6069V35.8009C34.4036 36.2509 35.2798 36.9378 35.9714 37.8616C36.6582 38.7853 37.0038 39.8891 37.0038 41.1775C37.0038 42.466 36.677 43.6169 36.0232 44.626C35.3694 45.635 34.4648 46.4307 33.3185 47.0085C32.1676 47.5863 30.8745 47.88 29.4392 47.88C27.7767 47.8847 26.242 47.4063 24.8258 46.4494Z" fill="#1A73E8"/>
-<path d="M44.9998 30.1358L41.4092 32.7458L39.6045 30.008L46.0798 25.3374H48.562V47.3683H44.9998V30.1358Z" fill="#1A73E8"/>
-<path d="M54.9476 72L72 54.9476L63.4738 51.1582L54.9476 54.9476L51.1582 63.4738L54.9476 72Z" fill="#EA4335"/>
-<path d="M13.2627 63.474L17.0521 72.0002H54.9467V54.9478H17.0521L13.2627 63.474Z" fill="#34A853"/>
-<path d="M5.68404 0C2.54376 0 0 2.54376 0 5.68404V54.9472L8.52624 58.7365L17.0525 54.9472V17.0525H54.9472L58.7365 8.52624L54.9475 0H5.68404Z" fill="#4285F4"/>
-<path d="M0 54.9478V66.3162C0 69.4568 2.54376 72.0002 5.68404 72.0002H17.0525V54.9478H0Z" fill="#188038"/>
-<path d="M54.9473 17.0525V54.9472H71.9997V17.0525L63.4735 13.2632L54.9473 17.0525Z" fill="#FBBC04"/>
-<path d="M71.9997 17.0525V5.68404C71.9997 2.5434 69.456 0 66.3157 0H54.9473V17.0525H71.9997Z" fill="#1967D2"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4391">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4391)"><path fill="#fff" d="m54.948 17.052-17.053-1.894-20.842 1.894L15.158 36l1.895 18.947L36 57.316l18.948-2.369 1.895-19.42z"/><path fill="#1a73e8" d="M24.826 46.45c-1.416-.958-2.397-2.355-2.932-4.202l3.287-1.355q.448 1.705 1.563 2.643c.74.626 1.64.933 2.69.933q1.614 0 2.772-.98 1.159-.982 1.16-2.496 0-1.55-1.222-2.53c-.814-.653-1.838-.98-3.06-.98h-1.9v-3.254h1.706q1.577 0 2.657-.853 1.08-.852 1.08-2.335 0-1.32-.966-2.108-.965-.79-2.449-.791-1.45-.001-2.302.772a4.5 4.5 0 0 0-1.241 1.9l-3.254-1.355q.644-1.834 2.382-3.235 1.742-1.402 4.443-1.403 1.998-.001 3.591.772 1.593.776 2.496 2.141.901 1.37.9 3.074 0 1.74-.838 2.947a5.8 5.8 0 0 1-2.06 1.852v.194a6.26 6.26 0 0 1 2.642 2.06q1.032 1.385 1.033 3.317t-.98 3.448c-.655 1.009-1.56 1.805-2.706 2.383-1.15.577-2.443.871-3.879.871q-2.491.006-4.613-1.43M45 30.136l-3.59 2.61-1.805-2.738 6.475-4.67h2.482v22.03H45z"/><path fill="#ea4335" d="M54.948 72 72 54.948l-8.526-3.79-8.526 3.79-3.79 8.526z"/><path fill="#34a853" d="M13.263 63.474 17.053 72h37.894V54.948H17.052z"/><path fill="#4285f4" d="M5.684 0A5.683 5.683 0 0 0 0 5.684v49.263l8.526 3.79 8.526-3.79V17.053h37.895l3.79-8.527L54.947 0z"/><path fill="#188038" d="M0 54.948v11.368A5.68 5.68 0 0 0 5.684 72h11.369V54.948z"/><path fill="#fbbc04" d="M54.947 17.053v37.894H72V17.052l-8.526-3.789z"/><path fill="#1967d2" d="M72 17.053V5.683A5.68 5.68 0 0 0 66.316 0H54.947v17.053z"/></g><defs><clipPath id="clip0_8803_4391"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googlecloudprovider.svg b/web/packages/design/src/ResourceIcon/assets/googlecloudprovider.svg
index d2b89aaf9b478..c06a70e3dbf20 100644
--- a/web/packages/design/src/ResourceIcon/assets/googlecloudprovider.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googlecloudprovider.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6706_29779)">
-<path d="M45.8438 22.7812L48.1062 22.8726L54.2602 16.7693L54.5625 14.0625C51.0371 10.9765 46.7766 8.94827 42.1835 7.94929C37.5904 6.95032 32.8164 7.1291 28.3123 8.46875C23.8083 9.8084 19.7229 12.2647 16.4422 15.6056C13.1615 18.9465 10.7937 23.0617 9.5625 27.5625C10.2481 27.2838 11.0075 27.2386 11.7218 27.434L24.0299 25.421C24.0299 25.421 24.4261 24.6858 24.75 24.75C27.3872 21.8775 31.2618 19.8207 35.1676 19.5261C39.0735 19.2315 42.7988 20.3373 45.8438 22.7812Z" fill="#EA4335"/>
-<path d="M63.0578 27.6963C61.6192 22.4255 58.6656 17.6871 54.5594 14.0625L45.8438 22.7812C47.6744 24.2695 49.0732 26.1729 50.0661 28.3075C51.0589 30.4422 51.5516 32.7733 51.507 35.125V36.6763C52.5336 36.6763 53.5502 36.8775 54.4987 37.2684C55.4471 37.6593 56.309 38.2323 57.0349 38.9545C57.7608 39.6768 58.3367 40.5343 58.7296 41.478C59.1224 42.4217 59.3246 43.4332 59.3246 44.4546C59.3246 45.4761 59.1224 46.4875 58.7296 47.4312C58.3367 48.3749 57.7608 49.2324 57.0349 49.9547C56.309 50.677 55.4471 51.2499 54.4987 51.6408C53.5502 52.0317 52.5336 52.2329 51.507 52.2329L35.7188 52.3125L34.3125 53.806V63.1356L35.7188 64.6869L51.507 64.6869C55.8731 64.7207 60.1342 63.3554 63.66 60.7929C67.1857 58.2304 69.7889 54.6068 71.0843 50.4582C72.3798 46.3095 72.2988 41.8562 70.8532 37.7569C69.4077 33.6577 66.6745 30.1302 63.0578 27.6963Z" fill="#4285F4"/>
-<path d="M20.2148 64.6872L35.7188 64.6875V52.3125L20.2148 52.1714C19.1009 52.1711 18.1695 51.9315 17.1562 51.4688L14.7907 52.1494L8.48827 58.4073L7.875 60.75C11.4093 63.4185 15.7861 64.7064 20.2148 64.6872Z" fill="#34A853"/>
-<path d="M20.2134 24.1032C15.9769 24.1285 11.8541 25.4762 8.4209 27.958C4.98766 30.4399 2.41538 33.932 1.06334 37.9466C-0.288692 41.9611 -0.352967 46.2977 0.879497 50.3506C2.11196 54.4035 4.51682 58.1676 7.875 60.7501L17.1562 51.4689C16.0037 50.9482 14.8457 50.1711 14.0668 49.1748C13.2879 48.1786 12.7624 47.0082 12.5353 45.7642C12.3082 44.5201 12.3864 43.2396 12.7631 42.0324C13.1398 40.8252 13.8037 39.7275 14.698 38.8333C15.5923 37.9391 16.6902 37.2752 17.8975 36.8985C19.1048 36.5219 20.3855 36.4437 21.6296 36.6708C22.8738 36.8978 24.0443 37.4233 25.0407 38.2021C26.037 38.9809 26.8296 39.9898 27.3503 41.1422L36.4197 32.0738C34.5161 29.5854 32.0627 27.5711 29.2512 26.1884C26.4398 24.8057 23.3465 24.092 20.2134 24.1032Z" fill="#FBBC05"/>
-</g>
-<defs>
-<clipPath id="clip0_6706_29779">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6706_29779)"><path fill="#ea4335" d="m45.844 22.781 2.262.092 6.154-6.104.303-2.706c-3.526-3.087-7.786-5.115-12.38-6.114a27.9 27.9 0 0 0-13.87.52 27.7 27.7 0 0 0-11.87 7.137 27.4 27.4 0 0 0-6.88 11.957 3.37 3.37 0 0 1 2.159-.129l12.308-2.013s.396-.735.72-.671c2.637-2.872 6.512-4.93 10.418-5.224s7.63.811 10.676 3.255"/><path fill="#4285f4" d="M63.058 27.696a28.03 28.03 0 0 0-8.499-13.634l-8.715 8.72c1.83 1.488 3.23 3.39 4.222 5.526a15.5 15.5 0 0 1 1.441 6.817v1.551a7.85 7.85 0 0 1 5.528 2.279 7.746 7.746 0 0 1 0 11 7.85 7.85 0 0 1-5.528 2.278l-15.788.08-1.407 1.493v9.33l1.407 1.55h15.788a20.4 20.4 0 0 0 12.153-3.893 20.24 20.24 0 0 0 7.424-10.335 20.14 20.14 0 0 0-.23-12.701 20.25 20.25 0 0 0-7.796-10.06"/><path fill="#34a853" d="M20.215 64.687h15.504V52.314l-15.504-.142c-1.114 0-2.046-.24-3.059-.702l-2.365.68-6.303 6.258-.613 2.343c3.534 2.669 7.911 3.956 12.34 3.937"/><path fill="#fbbc05" d="M20.213 24.103a20.34 20.34 0 0 0-19.15 13.844A20.33 20.33 0 0 0 .88 50.35c1.233 4.053 3.638 7.817 6.996 10.4l9.281-9.282c-1.152-.52-2.31-1.298-3.09-2.294a7.816 7.816 0 0 1 10.975-10.973 7.8 7.8 0 0 1 2.31 2.94l9.069-9.068a20.31 20.31 0 0 0-16.207-7.97"/></g><defs><clipPath id="clip0_6706_29779"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googledrive.svg b/web/packages/design/src/ResourceIcon/assets/googledrive.svg
index d4a196c20d73c..d053273ffd71d 100644
--- a/web/packages/design/src/ResourceIcon/assets/googledrive.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googledrive.svg
@@ -1,8 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M5.4433 58.9642L8.61856 64.4487C9.27835 65.6034 10.2268 66.5106 11.3402 67.1704L22.6804 47.5415H0C0 48.8199 0.329897 50.0982 0.989691 51.2528L5.4433 58.9642Z" fill="#0066DA"/>
-<path d="M36 24.4487L24.6598 4.81982C23.5464 5.47962 22.5979 6.38683 21.9381 7.54147L0.989691 43.8301C0.342031 44.9599 0.00086232 46.2393 0 47.5415H22.6804L36 24.4487Z" fill="#00AC47"/>
-<path d="M60.6592 67.1704C61.7726 66.5106 62.7211 65.6034 63.3809 64.4487L64.7005 62.1807L71.0098 51.2528C71.6695 50.0982 71.9994 48.8199 71.9994 47.5415H49.3174L54.1438 57.026L60.6592 67.1704Z" fill="#EA4335"/>
-<path d="M36.0004 24.4486L47.3406 4.81977C46.2272 4.15998 44.9488 3.83008 43.6292 3.83008H28.3715C27.0519 3.83008 25.7736 4.20121 24.6602 4.81977L36.0004 24.4486Z" fill="#00832D"/>
-<path d="M49.3192 47.5415H22.68L11.3398 67.1704C12.4532 67.8302 13.7316 68.1601 15.0512 68.1601H56.9481C58.2677 68.1601 59.546 67.7889 60.6594 67.1704L49.3192 47.5415Z" fill="#2684FC"/>
-<path d="M60.5361 25.6858L50.0619 7.54147C49.4021 6.38683 48.4536 5.47962 47.3402 4.81982L36 24.4487L49.3196 47.5415H71.9588C71.9588 46.2631 71.6289 44.9848 70.9691 43.8301L60.5361 25.6858Z" fill="#FFBA00"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0066da" d="M5.443 58.964 8.62 64.45c.66 1.154 1.608 2.062 2.721 2.721l11.34-19.629H0c0 1.279.33 2.557.99 3.712z"/><path fill="#00ac47" d="M36 24.449 24.66 4.819c-1.114.66-2.062 1.568-2.722 2.722L.99 43.831A7.5 7.5 0 0 0 0 47.54h22.68z"/><path fill="#ea4335" d="M60.66 67.17c1.113-.66 2.061-1.567 2.72-2.721l1.32-2.268 6.31-10.928c.66-1.155.99-2.433.99-3.712H49.316l4.827 9.485z"/><path fill="#00832d" d="m36 24.449 11.34-19.63c-1.113-.659-2.391-.989-3.71-.989H28.37c-1.32 0-2.597.371-3.71.99z"/><path fill="#2684fc" d="M49.32 47.542H22.68L11.34 67.17c1.113.66 2.392.99 3.711.99h41.897c1.32 0 2.598-.371 3.711-.99z"/><path fill="#ffba00" d="M60.536 25.686 50.062 7.54c-.66-1.154-1.608-2.061-2.722-2.721L36 24.449 49.32 47.54h22.639c0-1.278-.33-2.556-.99-3.71z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googletagmanager.svg b/web/packages/design/src/ResourceIcon/assets/googletagmanager.svg
index ddc797e134325..bb6444b6c79ea 100644
--- a/web/packages/design/src/ResourceIcon/assets/googletagmanager.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googletagmanager.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15942_7531)">
-<path d="M42.2617 69.0509L29.7637 56.8643L56.6047 29.4556L69.5445 42.1372L42.2617 69.0509Z" fill="#8AB4F8"/>
-<path d="M42.3152 15.1704L29.8622 2.45605L2.63255 29.427C-0.877518 32.937 -0.877518 38.6273 2.63255 42.1414L29.4531 69.1369L42.1352 57.2734L21.7007 35.7842L42.3152 15.1704Z" fill="#4285F4"/>
-<path d="M69.3642 29.6356L42.3637 2.63602C38.8495 -0.878021 33.1508 -0.878021 29.6366 2.63602C26.1224 6.15006 26.1224 11.8486 29.6366 15.3626L56.6371 42.3622C60.1513 45.8763 65.85 45.8763 69.3642 42.3622C72.8784 38.8482 72.8784 33.1497 69.3642 29.6356Z" fill="#8AB4F8"/>
-<path d="M35.7937 72.0008C40.6514 72.0008 44.5893 68.063 44.5893 63.2055C44.5893 58.348 40.6514 54.4102 35.7937 54.4102C30.936 54.4102 26.998 58.348 26.998 63.2055C26.998 68.063 30.936 72.0008 35.7937 72.0008Z" fill="#246FDB"/>
-</g>
-<defs>
-<clipPath id="clip0_15942_7531">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15942_7531)"><path fill="#8ab4f8" d="M42.262 69.05 29.764 56.865l26.84-27.408 12.94 12.681z"/><path fill="#4285f4" d="M42.315 15.17 29.862 2.456 2.632 29.427c-3.51 3.51-3.51 9.2 0 12.714l26.821 26.996 12.682-11.864-20.434-21.489z"/><path fill="#8ab4f8" d="m69.364 29.636-27-27a9 9 0 0 0-12.727 12.727l27 27a9 9 0 0 0 12.727-12.727"/><path fill="#246fdb" d="M35.794 72a8.795 8.795 0 1 0 0-17.59 8.796 8.796 0 1 0 0 17.59"/></g><defs><clipPath id="clip0_15942_7531"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/googlevoice.svg b/web/packages/design/src/ResourceIcon/assets/googlevoice.svg
index 8b0531e225405..36f1ca83a0c65 100644
--- a/web/packages/design/src/ResourceIcon/assets/googlevoice.svg
+++ b/web/packages/design/src/ResourceIcon/assets/googlevoice.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15942_7542)">
-<path d="M37.9238 14.3979V31.6751C37.9238 32.7406 38.7877 33.6044 39.8531 33.6044H57.1303C57.1303 28.3061 55.9497 22.547 52.4655 19.0628C48.9812 15.5786 43.2222 14.3979 37.9238 14.3979Z" fill="#00832D"/>
-<path d="M56.756 71.6431C48.6933 72.9677 38.9317 70.5776 29.5732 64.9914L32.7119 57.9941L39.8244 54.7114L50.9682 61.0752L56.756 71.6431Z" fill="#00832D"/>
-<path d="M0.835149 15.7227C-0.489435 23.7853 1.87178 33.547 7.48687 42.9054L14.6857 39.5364L17.7668 32.6255L11.7198 22.7487L0.835149 15.7227Z" fill="#00832D"/>
-<path d="M40.8034 0.000488281C39.2196 0.000488281 37.9238 1.29628 37.9238 2.88002V14.3981C48.5205 14.3981 57.1303 23.0079 57.1303 33.6046H68.6484C70.2322 33.6046 71.528 32.3088 71.528 30.7251C71.528 13.7646 57.7638 0.000488281 40.8034 0.000488281Z" fill="#34A853"/>
-<path d="M68.7918 65.0205C70.318 63.552 70.3756 61.162 68.9358 59.6358L55.0565 44.835C53.5303 43.3953 51.1691 43.424 49.7005 44.8926L39.8525 54.7118L56.7554 71.6147C61.3338 70.9524 64.7605 68.9943 67.8704 65.8844L68.7918 65.0205Z" fill="#34A853"/>
-<path d="M7.51562 42.9054C10.0496 47.1095 13.4187 51.3424 17.2484 55.1722C21.0782 59.002 25.3975 62.4286 29.6016 64.9626L39.8816 54.7115L17.7668 32.6255" fill="#34A853"/>
-<path d="M25.167 25.4554L26.7507 23.9293C28.6224 22.0576 28.6224 18.9765 26.7507 17.1048L13.7065 4.06051C11.8348 2.18881 8.75367 2.18881 6.88198 4.06051L6.42125 4.37726C3.39774 7.40077 1.58364 11.3169 0.834961 15.7226L17.7666 32.6255L25.167 25.4554Z" fill="#34A853"/>
-</g>
-<defs>
-<clipPath id="clip0_15942_7542">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15942_7542)"><path fill="#00832d" d="M37.924 14.398v17.277a1.93 1.93 0 0 0 1.93 1.93H57.13c0-5.299-1.18-11.058-4.665-14.542-3.484-3.484-9.243-4.665-14.541-4.665m18.832 57.245c-8.063 1.325-17.824-1.065-27.183-6.652l3.139-6.997 7.112-3.283 11.144 6.364zM.835 15.723c-1.324 8.062 1.037 17.824 6.652 27.182l7.199-3.369 3.08-6.91-6.046-9.877z"/><path fill="#34a853" d="M40.803 0a2.89 2.89 0 0 0-2.88 2.88v11.518c10.597 0 19.207 8.61 19.207 19.207h11.518a2.89 2.89 0 0 0 2.88-2.88C71.528 13.765 57.764 0 40.803 0m27.989 65.02a3.817 3.817 0 0 0 .144-5.384l-13.88-14.801a3.833 3.833 0 0 0-5.355.058l-9.849 9.819 16.903 16.903c4.579-.663 8.005-2.62 11.115-5.73z"/><path fill="#34a853" d="M7.516 42.905c2.534 4.204 5.903 8.437 9.732 12.267 3.83 3.83 8.15 7.257 12.354 9.79l10.28-10.25-22.115-22.086m7.4-7.171 1.584-1.526c1.871-1.871 1.871-4.952 0-6.824L13.706 4.06c-1.871-1.872-4.952-1.872-6.824 0l-.46.316C3.397 7.401 1.583 11.317.834 15.723l16.932 16.903z"/></g><defs><clipPath id="clip0_15942_7542"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/grafana.svg b/web/packages/design/src/ResourceIcon/assets/grafana.svg
index 7234c90d0c45c..219a2860d1281 100644
--- a/web/packages/design/src/ResourceIcon/assets/grafana.svg
+++ b/web/packages/design/src/ResourceIcon/assets/grafana.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6726_30099)">
-<path d="M68.6579 31.862C68.5302 30.6489 68.3386 29.2441 67.9555 27.7117C67.5724 26.1792 66.9339 24.5191 66.1038 22.7312C65.2099 21.0072 64.1244 19.1555 62.6558 17.4315C62.0811 16.7292 61.4426 16.0906 60.8041 15.3883C61.8257 11.3656 59.5909 7.85377 59.5909 7.85377C55.696 7.59836 53.2696 9.06695 52.3757 9.70547C52.248 9.64162 52.0564 9.57777 51.9287 9.51391C51.2902 9.25851 50.5878 9.0031 49.8855 8.74769C49.1831 8.55614 48.4807 8.30073 47.7783 8.17303C47.076 7.98147 46.3097 7.85377 45.5435 7.72606C45.4158 7.72606 45.2881 7.66221 45.1604 7.66221C43.5003 2.29866 38.6475 0 38.6475 0C33.0924 3.5757 32.007 8.36458 32.007 8.36458C32.007 8.36458 32.007 8.49229 31.9431 8.61999C31.6238 8.68384 31.3684 8.81154 31.0492 8.8754C30.6661 9.0031 30.2191 9.1308 29.836 9.32236C29.4529 9.51391 29.0059 9.64162 28.6228 9.83317C27.7927 10.2163 27.0265 10.5994 26.1964 11.0464C25.4302 11.4933 24.664 11.9403 23.9616 12.4511C23.8339 12.3872 23.7701 12.3234 23.7701 12.3234C16.2994 9.45006 9.65884 12.8981 9.65884 12.8981C9.08417 20.8795 12.6599 25.86 13.3622 26.7539C13.1707 27.2647 13.043 27.7117 12.8514 28.2225C12.2768 30.0103 11.8936 31.862 11.6382 33.7776C11.5744 34.033 11.5744 34.3523 11.5105 34.6077C4.61455 37.9918 2.57129 45.0155 2.57129 45.0155C8.31795 51.6561 15.0862 52.0392 15.0862 52.0392C15.9163 53.5716 16.9379 55.0402 18.0234 56.3811C18.4704 56.9558 18.9812 57.4666 19.492 58.0413C17.3849 64.0433 19.8113 69.0876 19.8113 69.0876C26.2603 69.343 30.4745 66.2781 31.3684 65.5758C32.007 65.7673 32.6455 65.9589 33.284 66.1504C35.2634 66.6612 37.3067 66.9805 39.2861 67.0444C39.7969 67.0444 40.3077 67.0444 40.8185 67.0444H41.0739H41.2655H41.5847H41.904C44.905 71.3863 50.2686 71.9609 50.2686 71.9609C54.0358 67.9383 54.2912 64.0433 54.2912 63.1494C54.2912 63.1494 54.2912 63.1494 54.2912 63.0856C54.2912 63.0217 54.2912 62.9578 54.2912 62.9578C54.2912 62.894 54.2912 62.8301 54.2912 62.7663C55.0574 62.1916 55.8237 61.617 56.5899 60.9784C58.1223 59.6376 59.3994 58.0413 60.5487 56.3811C60.6764 56.2534 60.7403 56.0619 60.868 55.9342C65.146 56.1896 68.1471 53.2524 68.1471 53.2524C67.4447 48.7828 64.8906 46.6118 64.3798 46.2287C64.3798 46.2287 64.3798 46.2287 64.316 46.1648L64.2521 46.101L64.1883 46.0371C64.1883 45.7817 64.2521 45.5263 64.2521 45.2071C64.316 44.6962 64.316 44.2493 64.316 43.7385V43.3554V43.1638V43.0999C64.316 42.9722 64.316 43.0361 64.316 42.9722V42.653V42.2699C64.316 42.1422 64.316 42.0145 64.316 41.8868C64.316 41.7591 64.316 41.6314 64.2521 41.5037L64.1883 41.1205L64.1244 40.7374C64.0605 40.2266 63.9328 39.7797 63.869 39.2688C63.422 37.3533 62.6558 35.5016 61.698 33.9053C60.6764 32.2451 59.4632 30.8404 58.0585 29.5634C56.6537 28.3502 55.1213 27.3286 53.4612 26.6262C51.801 25.86 50.1409 25.413 48.4169 25.2215C47.5868 25.0937 46.6929 25.0937 45.8628 25.0937H45.5435H45.4797H45.352H45.2243H44.905C44.7773 25.0937 44.6496 25.0937 44.5858 25.0937C44.1388 25.1576 43.6918 25.2214 43.3087 25.2853C41.5847 25.6046 39.9884 26.2431 38.5837 27.0732C37.179 27.9032 35.9658 28.9887 34.9441 30.2019C33.9225 31.4151 33.1563 32.6921 32.6455 34.0968C32.1347 35.4377 31.8154 36.9063 31.7515 38.2472C31.7515 38.5665 31.7515 38.9496 31.7515 39.2688C31.7515 39.3327 31.7515 39.4604 31.7515 39.5243V39.7797C31.7515 39.9712 31.7515 40.0989 31.8154 40.2905C31.8792 40.9928 32.007 41.6314 32.1985 42.2699C32.5816 43.5469 33.1563 44.6962 33.9225 45.7179C34.6887 46.7395 35.5188 47.5057 36.4766 48.1442C37.4344 48.7828 38.3921 49.2297 39.4138 49.549C40.4354 49.8682 41.3932 49.9959 42.2871 49.9321C42.4148 49.9321 42.5425 49.9321 42.6063 49.9321C42.6702 49.9321 42.7341 49.9321 42.7979 49.9321C42.8618 49.9321 42.9256 49.9321 42.9895 49.9321C43.1172 49.9321 43.181 49.9321 43.3087 49.9321H43.3726H43.4364C43.5003 49.9321 43.5641 49.9321 43.628 49.9321C43.7557 49.9321 43.8834 49.8682 43.9472 49.8682C44.0749 49.8682 44.1388 49.8044 44.2665 49.8044C44.458 49.7405 44.7135 49.6767 44.905 49.6128C45.2881 49.4851 45.6712 49.2936 46.0543 49.1659C46.4375 48.9743 46.7567 48.7828 47.0121 48.5912C47.076 48.5273 47.2037 48.4635 47.2675 48.3996C47.5868 48.1442 47.6506 47.6973 47.3952 47.378C47.1398 47.1226 46.7567 47.0588 46.4375 47.1865C46.3736 47.2503 46.3097 47.2503 46.182 47.3142C45.9266 47.4419 45.6074 47.5696 45.352 47.6334C45.0327 47.6973 44.7135 47.825 44.3942 47.8888C44.2026 47.8888 44.0749 47.9527 43.8834 47.9527C43.8195 47.9527 43.6918 47.9527 43.628 47.9527C43.5641 47.9527 43.4364 47.9527 43.3726 47.9527C43.3087 47.9527 43.181 47.9527 43.1172 47.9527C42.9895 47.9527 42.9256 47.9527 42.7979 47.9527H42.7341H42.6702C42.6063 47.9527 42.6063 47.9527 42.5425 47.9527C42.4786 47.9527 42.3509 47.9527 42.2871 47.8888C41.5847 47.7611 40.8185 47.5696 40.1161 47.2503C39.4138 46.9311 38.7114 46.4841 38.1367 45.9094C37.4982 45.3348 36.9874 44.6962 36.5404 43.93C36.0935 43.1638 35.8381 42.3337 35.7104 41.5037C35.6465 41.0567 35.5827 40.6097 35.6465 40.1628C35.6465 40.0351 35.6465 39.9074 35.6465 39.7797V39.7158V39.652C35.6465 39.5881 35.6465 39.5242 35.6465 39.4604C35.6465 39.205 35.7104 39.0134 35.7742 38.758C36.0935 36.8425 37.0512 34.9908 38.5198 33.586C38.9029 33.2029 39.2861 32.8837 39.733 32.6283C40.18 32.309 40.6269 32.0536 41.0739 31.862C41.5209 31.6705 42.0317 31.4789 42.5425 31.3512C43.0533 31.2235 43.5641 31.0958 44.0749 31.0958C44.3303 31.0958 44.5858 31.032 44.8412 31.032C44.905 31.032 44.9689 31.032 45.0327 31.032H45.2243H45.352H45.4158H45.6074C46.1821 31.0958 46.7567 31.1597 47.2675 31.2874C48.353 31.5428 49.4385 31.9259 50.4601 32.5006C52.5034 33.6499 54.2274 35.3739 55.249 37.481C55.7598 38.5026 56.1429 39.652 56.3345 40.8651C56.3983 41.1844 56.3983 41.4398 56.4622 41.7591V41.9506V42.1422C56.4622 42.206 56.4622 42.2699 56.4622 42.3337C56.4622 42.3976 56.4622 42.4614 56.4622 42.5253V42.7168V42.9084C56.4622 43.0361 56.4622 43.2915 56.4622 43.4192C56.4622 43.7385 56.3983 44.0577 56.3983 44.377C56.3345 44.6962 56.3345 45.0155 56.2706 45.3348C56.2068 45.654 56.1429 45.9733 56.0791 46.2925C55.9514 46.9311 55.696 47.5057 55.5044 48.1442C55.0574 49.3574 54.4189 50.5068 53.6527 51.5284C52.1203 53.6355 50.0132 55.3595 47.6506 56.445C46.4375 56.9558 45.2243 57.4027 43.9472 57.5943C43.3087 57.722 42.6702 57.7859 42.0317 57.7859H41.904H41.7763H41.5847H41.2655H41.0739H41.0101C40.6908 57.7859 40.3077 57.7859 39.9884 57.722C38.5837 57.5943 37.2428 57.3389 35.9019 56.9558C34.561 56.5727 33.284 56.0619 32.0708 55.4233C29.6444 54.1463 27.4735 52.2946 25.7495 50.1875C24.9194 49.102 24.1532 47.9527 23.5147 46.7395C22.8762 45.5263 22.4292 44.2493 22.0461 42.9722C21.663 41.6952 21.4714 40.3543 21.4076 39.0134V38.758V38.6942V38.6303V38.5026V38.3111V38.2472V38.1834V38.0557V37.7364V37.6725V37.5448C21.4076 37.3533 21.4076 37.2256 21.4076 37.034C21.4076 36.3955 21.4714 35.6931 21.5991 34.9908C21.663 34.2884 21.7907 33.6499 21.9184 32.9475C22.0461 32.2451 22.2376 31.6066 22.4292 30.9043C22.8123 29.5634 23.2593 28.2863 23.8339 27.0732C24.9833 24.6468 26.4519 22.4758 28.1758 20.7518C28.6228 20.3049 29.0698 19.9218 29.5806 19.5386C29.7721 19.3471 30.2191 18.964 30.7299 18.6447C31.2407 18.3255 31.7515 18.0062 32.3262 17.7508C32.5816 17.6231 32.837 17.4954 33.1563 17.3677C33.284 17.3038 33.4117 17.24 33.6033 17.1761C33.731 17.1123 33.8587 17.0484 34.0502 16.9846C34.6249 16.7292 35.1995 16.5376 35.7742 16.3461C35.9019 16.2822 36.0935 16.2822 36.2212 16.2183C36.3489 16.1545 36.5404 16.1545 36.6681 16.0906C36.9874 16.0268 37.2428 15.9629 37.5621 15.8352C37.6898 15.7714 37.8813 15.7714 38.009 15.7075C38.1367 15.7075 38.3283 15.6437 38.456 15.6437C38.5837 15.6437 38.7752 15.5798 38.903 15.5798L39.1584 15.516L39.4138 15.4521C39.5415 15.4521 39.733 15.3883 39.8607 15.3883C40.0523 15.3883 40.18 15.3244 40.3715 15.3244C40.4992 15.3244 40.7547 15.2606 40.8824 15.2606C41.0101 15.2606 41.0739 15.2606 41.2016 15.1967H41.3932H41.5209H41.6486C41.8401 15.1967 41.9678 15.1967 42.1594 15.1329H42.4148H42.4786H42.6063C42.7341 15.1329 42.9256 15.1329 43.0533 15.1329C43.628 15.1329 44.2026 15.1329 44.7773 15.1329C45.9266 15.1967 47.076 15.3244 48.1615 15.516C50.3324 15.8991 52.4395 16.6015 54.2912 17.5592C56.1429 18.4532 57.8669 19.6025 59.2717 20.8157C59.3355 20.8795 59.4632 20.9434 59.5271 21.0711C59.5909 21.1349 59.7186 21.1988 59.7825 21.3265C59.974 21.4542 60.1017 21.6458 60.2933 21.7735C60.4848 21.9012 60.6125 22.0927 60.8041 22.2204C60.9318 22.412 61.1234 22.5397 61.2511 22.7312C61.8896 23.3697 62.4643 24.0721 62.9751 24.7106C63.9967 26.0515 64.8268 27.3924 65.4653 28.6694C65.5291 28.7333 65.5291 28.7971 65.593 28.9249C65.6568 28.9887 65.6568 29.0526 65.7207 29.1803C65.7845 29.308 65.8484 29.4995 65.9761 29.6272C66.0399 29.7549 66.1038 29.9465 66.1677 30.0742C66.2315 30.2019 66.2954 30.3934 66.3592 30.5211C66.6146 31.0958 66.8062 31.6705 66.9977 32.2451C67.317 33.1391 67.5085 33.9053 67.7001 34.5438C67.7639 34.7992 68.0194 34.9908 68.2748 34.9908C68.594 34.9908 68.7856 34.7354 68.7856 34.4161C68.7217 33.6499 68.7217 32.8198 68.6579 31.862Z" fill="url(#paint0_linear_6726_30099)"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_6726_30099" x1="35.6784" y1="88.1861" x2="35.6784" y2="22.5132" gradientUnits="userSpaceOnUse">
-<stop stop-color="#FCEE1F"/>
-<stop offset="1" stop-color="#F15B2A"/>
-</linearGradient>
-<clipPath id="clip0_6726_30099">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6726_30099)"><path fill="url(#paint0_linear_6726_30099)" d="M68.658 31.862c-.128-1.213-.32-2.618-.703-4.15s-1.021-3.193-1.851-4.98c-.894-1.725-1.98-3.576-3.448-5.3-.575-.703-1.213-1.341-1.852-2.044 1.022-4.022-1.213-7.534-1.213-7.534-3.895-.256-6.321 1.213-7.215 1.851-.128-.063-.32-.127-.447-.191-.639-.255-1.341-.51-2.044-.766-.702-.192-1.404-.447-2.107-.575-.702-.192-1.468-.32-2.234-.447-.128 0-.256-.064-.384-.064C43.5 2.3 38.648 0 38.648 0c-5.556 3.576-6.641 8.365-6.641 8.365s0 .127-.064.255c-.32.064-.575.192-.894.255-.383.128-.83.256-1.213.447-.383.192-.83.32-1.213.511a43 43 0 0 0-2.427 1.213c-.766.447-1.532.894-2.234 1.405a.8.8 0 0 1-.192-.128c-7.47-2.873-14.111.575-14.111.575-.575 7.982 3 12.962 3.703 13.856-.191.51-.319.958-.51 1.468-.575 1.788-.958 3.64-1.214 5.556-.064.255-.064.574-.127.83-6.896 3.384-8.94 10.408-8.94 10.408 5.747 6.64 12.515 7.023 12.515 7.023.83 1.533 1.852 3.001 2.937 4.342.447.575.958 1.086 1.469 1.66-2.107 6.002.32 11.047.32 11.047 6.448.255 10.662-2.81 11.556-3.512l1.916.574c1.98.511 4.023.83 6.002.894h2.618c3.001 4.342 8.365 4.917 8.365 4.917 3.767-4.023 4.022-7.918 4.022-8.812v-.383a55 55 0 0 0 2.299-1.788c1.532-1.34 2.81-2.937 3.959-4.597.127-.128.191-.32.319-.447 4.278.256 7.28-2.682 7.28-2.682-.703-4.47-3.257-6.64-3.768-7.023l-.064-.064-.064-.064-.064-.064c0-.255.064-.51.064-.83.064-.51.064-.958.064-1.468v-1.852c0-.128 0-.256-.064-.383l-.064-.383-.064-.384c-.063-.51-.191-.957-.255-1.468a19 19 0 0 0-2.171-5.364c-1.022-1.66-2.235-3.065-3.64-4.342-1.404-1.213-2.937-2.234-4.597-2.937a16.1 16.1 0 0 0-5.044-1.405c-.83-.127-1.724-.127-2.554-.127h-1.278c-.446.064-.893.127-1.276.191-1.724.32-3.32.958-4.725 1.788s-2.618 1.916-3.64 3.129-1.788 2.49-2.299 3.895c-.51 1.34-.83 2.81-.894 4.15v1.533c0 .191 0 .319.064.51a10 10 0 0 0 .384 1.98 10.9 10.9 0 0 0 1.724 3.448 10.2 10.2 0 0 0 2.554 2.426 11.3 11.3 0 0 0 2.937 1.405q1.532.48 2.873.383h1.341c.128 0 .255-.064.32-.064.127 0 .19-.064.319-.064.191-.064.447-.127.638-.191.383-.128.766-.32 1.15-.447q.575-.288.957-.575c.064-.064.192-.127.255-.191a.72.72 0 0 0 .128-1.022.89.89 0 0 0-.958-.191c-.063.063-.127.063-.255.127a4.4 4.4 0 0 1-.83.32c-.32.063-.638.191-.958.255-.191 0-.32.064-.51.064h-1.342c-.063 0-.191 0-.255-.064-.702-.128-1.468-.32-2.17-.639-.703-.319-1.406-.766-1.98-1.34a8 8 0 0 1-1.597-1.98c-.447-.766-.702-1.596-.83-2.426-.063-.447-.127-.894-.063-1.341v-.703c0-.255.063-.447.127-.702a9.34 9.34 0 0 1 2.746-5.172c.383-.383.766-.702 1.213-.958q.67-.478 1.34-.766a10 10 0 0 1 1.47-.51c.51-.128 1.021-.256 1.532-.256.255 0 .51-.064.766-.064h.766c.575.064 1.15.128 1.66.255 1.086.256 2.171.639 3.193 1.214 2.043 1.149 3.767 2.873 4.789 4.98a11.7 11.7 0 0 1 1.085 3.384c.064.32.064.575.128.894v1.66c0 .32-.064.639-.064.958-.064.32-.064.639-.127.958l-.192.957c-.128.64-.383 1.214-.575 1.852a13.4 13.4 0 0 1-1.851 3.384 15.5 15.5 0 0 1-6.002 4.917c-1.214.51-2.427.958-3.704 1.15a9.7 9.7 0 0 1-1.915.19H41.01c-.32 0-.702 0-1.022-.063a22 22 0 0 1-4.086-.766 20 20 0 0 1-3.831-1.533c-2.427-1.277-4.597-3.128-6.321-5.236-.83-1.085-1.597-2.234-2.235-3.447-.639-1.214-1.086-2.49-1.469-3.768s-.575-2.618-.638-3.959v-1.979c0-.639.063-1.34.191-2.043.064-.703.192-1.341.32-2.044.127-.702.319-1.34.51-2.043.383-1.34.83-2.618 1.405-3.83 1.15-2.427 2.618-4.598 4.342-6.322.447-.447.894-.83 1.405-1.213a7.2 7.2 0 0 1 1.149-.894c.51-.32 1.021-.639 1.596-.894.256-.128.511-.256.83-.383a3 3 0 0 1 .447-.192c.128-.064.256-.128.447-.191.575-.256 1.15-.447 1.724-.639.128-.064.32-.064.447-.128.128-.064.32-.064.447-.127a4.7 4.7 0 0 0 .894-.256c.128-.064.32-.064.447-.128.128 0 .32-.063.447-.063.128 0 .32-.064.447-.064l.255-.064.256-.064c.127 0 .319-.064.447-.064.191 0 .319-.064.51-.064.128 0 .384-.063.511-.063.128 0 .192 0 .32-.064h.447c.191 0 .319 0 .51-.064h2.618a29 29 0 0 1 3.384.383c2.171.383 4.279 1.086 6.13 2.043a23.2 23.2 0 0 1 4.98 3.257c.065.064.192.127.256.255.064.064.192.128.255.255.192.128.32.32.511.447.192.128.32.32.511.447.128.192.32.32.447.511.639.639 1.213 1.341 1.724 1.98a25 25 0 0 1 2.49 3.958c.064.064.064.128.128.256.064.064.064.128.128.255.063.128.127.32.255.447.064.128.128.32.192.447.063.128.127.32.191.447.256.575.447 1.15.639 1.724.319.894.51 1.66.702 2.299.064.255.32.447.575.447.319 0 .51-.256.51-.575-.063-.766-.063-1.596-.127-2.554"/></g><defs><linearGradient id="paint0_linear_6726_30099" x1="35.678" x2="35.678" y1="88.186" y2="22.513" gradientUnits="userSpaceOnUse"><stop stop-color="#fcee1f"/><stop offset="1" stop-color="#f15b2a"/></linearGradient><clipPath id="clip0_6726_30099"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/grammarly.svg b/web/packages/design/src/ResourceIcon/assets/grammarly.svg
index 56d5b4b23cd4f..bbb1ede8b824d 100644
--- a/web/packages/design/src/ResourceIcon/assets/grammarly.svg
+++ b/web/packages/design/src/ResourceIcon/assets/grammarly.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15942_7557)">
-<path d="M0 36.0037C0 16.3103 16.1157 0.350586 36.0017 0.350586C55.8875 0.350586 72 16.3103 72 36.0037C72 53.2329 59.6662 67.6042 43.2616 70.9314C40.9186 71.4074 38.4901 71.6538 36.0116 71.6538H0V36.0037Z" fill="#027E6F"/>
-<path d="M60.9118 32.6266H44.6892L40.8689 39.1801H54.2459C52.1497 50.5779 39.3503 58.3381 26.5591 51.7747C23.8086 50.3647 21.5689 48.1848 20.1218 45.4609C12.7633 31.5869 22.8156 17.6288 36.0808 17.6288C41.5499 17.6288 46.4752 20.0006 49.8582 23.7608L53.2862 17.8801C48.4028 13.3017 41.6619 10.6357 34.3115 11.1481C21.7976 12.0026 11.6517 22.2749 11.0426 34.6795C10.3483 48.9219 21.8443 60.7215 36.0723 60.7215C50.3005 60.7215 61.1371 49.583 61.1371 35.8976C61.1371 34.7852 61.0538 33.6943 60.9118 32.6266Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15942_7557">
-<rect width="72" height="72.001" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15942_7557)"><path fill="#027e6f" d="M0 36.004C0 16.31 16.116.35 36.002.35S72 16.31 72 36.004c0 17.229-12.334 31.6-28.738 34.927a36.4 36.4 0 0 1-7.25.723H0z"/><path fill="#fff" d="M60.912 32.627H44.689l-3.82 6.553h13.377C52.15 50.578 39.35 58.338 26.559 51.775c-2.75-1.41-4.99-3.59-6.437-6.314-7.359-13.874 2.694-27.832 15.959-27.832a18.5 18.5 0 0 1 13.777 6.132l3.428-5.88a25.07 25.07 0 0 0-18.974-6.733c-12.514.855-22.66 11.127-23.27 23.531-.694 14.243 10.802 26.042 25.03 26.042s25.065-11.138 25.065-24.823c0-1.113-.083-2.204-.225-3.271"/></g><defs><clipPath id="clip0_15942_7557"><path fill="#fff" d="M0 0h72v72.001H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/grubhub.svg b/web/packages/design/src/ResourceIcon/assets/grubhub.svg
index a973ca3a6c0f2..9edeee3f4739e 100644
--- a/web/packages/design/src/ResourceIcon/assets/grubhub.svg
+++ b/web/packages/design/src/ResourceIcon/assets/grubhub.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15942_7464)">
-<path d="M61.8458 21.6036C61.7097 21.4339 61.6051 21.2239 61.5856 21.0022C60.9303 13.6497 59.8831 8.77365 59.8831 8.77365C59.7184 7.93183 58.9916 7.31271 58.1579 7.21331L52.2873 6.50315C52.2365 6.49697 52.1848 6.49354 52.1321 6.49354C51.4474 6.49354 50.8921 7.04884 50.8921 7.7339V9.77336C50.8915 9.81425 50.858 9.84708 50.8171 9.84708C50.7986 9.84708 50.7815 9.84027 50.7682 9.82912C47.2521 6.66236 43.2934 3.58847 38.9076 0.88068C38.0729 0.322893 37.0815 0.000488281 36.0022 0.000488281L35.9994 0.000798293C34.9201 0.000798293 33.9284 0.322893 33.0937 0.88068C12.8271 13.3929 1.67164 33.7331 1.24108 34.8502C1.1184 35.1101 1.0498 35.4003 1.0498 35.7068C1.0498 36.6453 1.69378 37.4335 2.56413 37.6537L8.40237 38.7773C9.18219 38.991 9.77301 39.6618 9.86142 40.482C9.90906 41.513 11.0123 64.5345 12.3984 70.5061C12.6253 71.3663 13.4106 72.0005 14.342 72.0005H14.386C17.7919 71.9153 20.9119 71.8587 24.2806 71.8135H24.2707L24.302 71.8129C24.3881 71.8118 24.4742 71.8106 24.5609 71.8095C24.9208 71.8095 25.2126 71.5144 25.2126 71.1541C25.2126 71.1489 25.2126 71.1432 25.2122 71.1375C25.0756 69.1273 24.7811 64.5311 24.5426 59.6918C24.5368 59.5705 24.5271 59.4179 24.5213 59.2949C24.4992 58.874 24.2676 58.5074 23.9282 58.301C22.1765 57.2527 20.9757 55.3783 20.8642 53.2163C20.5579 45.1424 20.4024 35.8122 20.8444 28.5111C20.8797 27.9035 21.3783 27.4166 21.9968 27.4057C22.6454 27.3946 23.1802 27.9112 23.1917 28.5597C23.1923 28.5907 23.1917 28.6213 23.1899 28.6517C22.9018 33.5185 22.8758 39.2723 22.9811 44.9492C22.9944 45.7163 23.6275 46.328 24.3949 46.3147C25.1621 46.3011 25.7734 45.6681 25.7601 44.9006C25.6548 39.1852 25.683 33.3942 25.9788 28.5111C26.0138 27.9035 26.5124 27.4166 27.1309 27.4057C27.7794 27.3946 28.3146 27.9112 28.3257 28.5597C28.3264 28.5907 28.3257 28.6213 28.3239 28.6517C28.0374 33.4927 28.0104 39.2118 28.1136 44.8597C28.1136 44.8606 28.1136 44.8619 28.1136 44.8631C28.1288 45.6281 28.7606 46.2367 29.5259 46.2234C30.2896 46.21 30.8985 45.5826 30.8901 44.8201C30.7864 39.1307 30.8161 33.3714 31.11 28.5111C31.1454 27.9035 31.644 27.4166 32.2625 27.4057C32.911 27.3946 33.4459 27.9112 33.4573 28.5597C33.4579 28.5907 33.4573 28.6213 33.4554 28.6517C33.0355 35.7493 33.1727 44.7333 33.4617 52.6142C33.4617 52.6192 33.4641 52.6829 33.4641 52.6879C33.4654 52.7279 33.4663 52.7678 33.4669 52.8078C33.4669 52.8081 33.4669 52.8081 33.4669 52.8084C33.4672 52.8341 33.4672 52.8601 33.4672 52.8861C33.4672 55.0414 32.3857 56.9442 30.7359 58.0814C30.4417 58.2855 30.2425 58.6132 30.2165 58.9947C30.2165 58.9947 30.0716 60.2048 30.607 66.0695C30.8564 68.6298 31.0468 70.4038 31.1348 71.2061C31.1698 71.5104 31.4278 71.746 31.7412 71.746C31.9236 71.7454 32.1064 71.7449 32.2931 71.7443H32.2854C33.4099 71.7397 34.5701 71.7374 35.7755 71.7368H36.0007H36.2261C37.7496 71.7374 39.2012 71.7408 40.6001 71.7477L43.9119 71.7769C43.9131 71.7769 43.9143 71.7769 43.9156 71.7769C44.2308 71.7769 44.4888 71.5384 44.5343 71.2307C45.3012 64.2028 45.4814 60.2562 45.4814 60.2562C45.4814 59.9011 45.2101 59.6346 44.854 59.5797L40.8312 59.025C40.195 58.9129 39.8172 58.5211 39.6812 58.039C39.5979 57.7468 39.6308 57.418 39.6308 57.418C41.2617 33.9932 48.9849 26.099 48.9849 26.099C49.2128 25.8668 49.3596 25.7754 49.3596 25.7754C49.5635 25.6274 49.8146 25.5397 50.0859 25.5397C50.6096 25.5397 51.0575 25.8662 51.2381 26.3261C51.2381 26.3261 51.3015 26.4893 51.3377 26.8891C52.0043 34.2525 51.679 46.7824 51.2665 56.5574C50.9165 64.8542 50.4932 71.3663 50.4932 71.3663C50.4929 71.3708 50.4929 71.3754 50.4929 71.3794C50.4929 71.6459 50.7091 71.8621 50.9757 71.8621C53.1681 71.8987 55.3272 71.9439 57.6153 72.0005H57.6592C58.5907 72.0005 59.3764 71.3663 59.6029 70.5061C60.9892 64.5345 62.0923 41.513 62.1404 40.482C62.2284 39.6618 62.8192 38.991 63.5993 38.7773L69.4371 37.6537C70.3075 37.4335 70.9514 36.6453 70.9514 35.7068C70.9514 35.4003 70.8828 35.1101 70.7604 34.8502C70.5397 34.2772 67.4955 28.6437 61.8458 21.6036Z" fill="#FF8000"/>
-</g>
-<defs>
-<clipPath id="clip0_15942_7464">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15942_7464)"><path fill="#ff8000" d="M61.846 21.604c-.136-.17-.24-.38-.26-.602-.656-7.352-1.703-12.228-1.703-12.228-.165-.842-.891-1.461-1.725-1.56l-5.87-.71a1.24 1.24 0 0 0-1.395 1.23v2.04a.075.075 0 0 1-.125.055c-3.516-3.167-7.475-6.24-11.86-8.948A5.2 5.2 0 0 0 36.002 0H36a5.2 5.2 0 0 0-2.905.88C12.827 13.393 1.672 33.733 1.24 34.85a2.01 2.01 0 0 0 1.323 2.803l5.838 1.123a2 2 0 0 1 1.46 1.705c.047 1.031 1.15 24.052 2.536 30.024A2.01 2.01 0 0 0 14.341 72h.044a810 810 0 0 1 9.895-.187h-.01l.031-.001.259-.004c.36 0 .652-.295.652-.655v-.016a656 656 0 0 1-.67-11.446l-.022-.397a1.24 1.24 0 0 0-.593-.994 6.3 6.3 0 0 1-3.064-5.085c-.306-8.074-.462-17.404-.02-24.705a1.175 1.175 0 1 1 2.346.14c-.288 4.868-.314 10.621-.209 16.298a1.39 1.39 0 0 0 2.78-.048c-.106-5.716-.078-11.507.218-16.39a1.175 1.175 0 1 1 2.345.14c-.287 4.842-.314 10.56-.21 16.209v.003a1.388 1.388 0 0 0 2.776-.043c-.104-5.69-.074-11.449.22-16.309a1.175 1.175 0 1 1 2.345.14c-.42 7.098-.282 16.082.007 23.963l.002.074.003.12v.078a6.3 6.3 0 0 1-2.731 5.195 1.2 1.2 0 0 0-.52.914s-.144 1.21.391 7.075c.25 2.56.44 4.334.528 5.136a.61.61 0 0 0 .606.54l.552-.002h-.008a973 973 0 0 1 3.49-.007h.451c1.524 0 2.975.004 4.374.01l3.312.03h.004a.63.63 0 0 0 .618-.546c.767-7.028.947-10.975.947-10.975 0-.355-.27-.621-.627-.676l-4.023-.555c-.636-.112-1.014-.504-1.15-.986-.083-.292-.05-.621-.05-.621 1.63-23.425 9.354-31.319 9.354-31.319.228-.232.375-.324.375-.324a1.24 1.24 0 0 1 1.879.55c0 .001.063.164.099.564.666 7.363.341 19.893-.072 29.668-.35 8.297-.773 14.81-.773 14.81v.012c0 .267.216.483.483.483 2.192.037 4.351.082 6.64.139h.043a2.01 2.01 0 0 0 1.944-1.495c1.386-5.972 2.49-28.993 2.537-30.024a2 2 0 0 1 1.46-1.705l5.837-1.123a2.01 2.01 0 0 0 1.323-2.804c-.22-.573-3.264-6.206-8.914-13.246"/></g><defs><clipPath id="clip0_15942_7464"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/guideline-dark.svg b/web/packages/design/src/ResourceIcon/assets/guideline-dark.svg
index 4942f712e201c..46954e93691db 100644
--- a/web/packages/design/src/ResourceIcon/assets/guideline-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/guideline-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M45.8527 0.84825L45.2723 6.2235C44.1135 3.11175 40.6373 0 34.2608 0C30.4943 0 27.8865 0.84825 25.2787 2.2635C19.773 5.6565 16.875 11.88 16.875 19.5165C16.875 27.72 20.0632 33.66 25.2787 36.7718C27.8865 38.1848 30.7845 39.033 33.9705 39.033C40.0567 39.033 42.6645 36.2048 43.533 33.9413V39.6C43.533 43.56 40.347 46.6695 36 46.953C31.653 47.2365 28.467 45.54 27.8865 41.8612L19.1925 46.1047C21.222 52.0447 27.306 55.4377 36.2902 55.4377C47.3017 55.44 55.125 49.5 55.125 39.0375V0.846H45.8527V0.84825ZM41.2178 28.0012C39.8115 29.103 38.0767 29.7017 36.2902 29.7017C34.5038 29.7017 32.769 29.103 31.3628 28.0012C29.3355 26.3047 28.1767 23.76 28.1767 19.5188C28.1767 15.273 29.3355 12.7282 31.3628 11.0317C32.769 9.93002 34.5038 9.33134 36.2902 9.33134C38.0767 9.33134 39.8115 9.93002 41.2178 11.0317C43.2428 12.7282 44.4037 15.273 44.4037 19.5165C44.1135 23.76 42.9547 26.0235 41.2155 28.0012H41.2178ZM55.125 59.2042V72H16.875V64.6875H47.7517V59.2042H55.125Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="m45.853.848-.58 5.376C44.112 3.111 40.636 0 34.26 0c-3.767 0-6.375.848-8.982 2.264-5.506 3.393-8.404 9.616-8.404 17.253 0 8.203 3.188 14.143 8.404 17.255 2.608 1.413 5.506 2.261 8.692 2.261 6.086 0 8.694-2.828 9.562-5.092V39.6c0 3.96-3.186 7.07-7.533 7.353s-7.533-1.413-8.113-5.092l-8.695 4.244c2.03 5.94 8.114 9.333 17.098 9.333 11.012.002 18.835-5.938 18.835-16.4V.846h-9.272zm-4.635 27.153a7.99 7.99 0 0 1-9.855 0c-2.027-1.696-3.186-4.241-3.186-8.482 0-4.246 1.159-6.79 3.186-8.487a7.99 7.99 0 0 1 9.855 0c2.025 1.696 3.186 4.241 3.186 8.485-.29 4.243-1.45 6.506-3.189 8.484zm13.907 31.203V72h-38.25v-7.312h30.877v-5.484z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/guideline-light.svg b/web/packages/design/src/ResourceIcon/assets/guideline-light.svg
index 3c2953b03be2f..f22dbb4af19e1 100644
--- a/web/packages/design/src/ResourceIcon/assets/guideline-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/guideline-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M45.8527 0.84825L45.2723 6.2235C44.1135 3.11175 40.6373 0 34.2607 0C30.4943 0 27.8865 0.84825 25.2787 2.2635C19.773 5.6565 16.875 11.88 16.875 19.5165C16.875 27.72 20.0632 33.66 25.2787 36.7718C27.8865 38.1847 30.7845 39.033 33.9705 39.033C40.0567 39.033 42.6645 36.2048 43.533 33.9412V39.6C43.533 43.56 40.347 46.6695 36 46.953C31.653 47.2365 28.467 45.54 27.8865 41.8612L19.1925 46.1047C21.222 52.0448 27.306 55.4378 36.2902 55.4378C47.3018 55.44 55.125 49.5 55.125 39.0375V0.846H45.8527V0.84825ZM41.2178 28.0012C39.8115 29.103 38.0767 29.7017 36.2902 29.7017C34.5038 29.7017 32.769 29.103 31.3628 28.0012C29.3355 26.3047 28.1767 23.76 28.1767 19.5188C28.1767 15.273 29.3355 12.7282 31.3628 11.0317C32.769 9.93002 34.5038 9.33134 36.2902 9.33134C38.0767 9.33134 39.8115 9.93002 41.2178 11.0317C43.2428 12.7282 44.4037 15.273 44.4037 19.5165C44.1135 23.76 42.9548 26.0235 41.2155 28.0012H41.2178ZM55.125 59.2043V72H16.875V64.6875H47.7517V59.2043H55.125Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="m45.853.848-.58 5.376C44.112 3.111 40.636 0 34.26 0c-3.767 0-6.375.848-8.982 2.264-5.506 3.393-8.404 9.616-8.404 17.253 0 8.203 3.188 14.143 8.404 17.255 2.608 1.413 5.506 2.261 8.692 2.261 6.086 0 8.694-2.828 9.562-5.092V39.6c0 3.96-3.186 7.07-7.533 7.353s-7.533-1.413-8.113-5.092l-8.695 4.244c2.03 5.94 8.114 9.333 17.098 9.333 11.012.002 18.835-5.938 18.835-16.4V.846h-9.272zm-4.635 27.153a7.99 7.99 0 0 1-9.855 0c-2.027-1.696-3.186-4.241-3.186-8.482 0-4.246 1.159-6.79 3.186-8.487a7.99 7.99 0 0 1 9.855 0c2.025 1.696 3.186 4.241 3.186 8.485-.29 4.243-1.45 6.506-3.189 8.484zm13.907 31.203V72h-38.25v-7.312h30.877v-5.484z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/hackerone-dark.svg b/web/packages/design/src/ResourceIcon/assets/hackerone-dark.svg
index 6732e904ae4bd..3c9bba3214c77 100644
--- a/web/packages/design/src/ResourceIcon/assets/hackerone-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/hackerone-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16877_8554)">
-<path d="M25.4307 0.894368C24.4366 0.297212 23.3462 0.000488281 21.959 0.000488281C20.4717 0.000488281 19.2811 0.297212 18.3872 0.894368C17.497 1.48782 17 2.28155 17 3.27557V68.6289C17 69.4227 17.497 70.2164 18.3872 70.91C19.3812 71.6036 20.4717 72.0005 21.8588 72.0005C23.1014 72.0042 24.3142 71.6221 25.3305 70.91C26.3208 70.2164 26.8178 69.4227 26.8178 68.6289V3.27557C26.918 2.28155 26.421 1.48782 25.4307 0.894368ZM33.661 35.2067C33.0676 35.8039 32.7671 36.5976 32.9674 37.7845C33.0676 38.9751 33.5609 40.0656 34.5549 41.0596C35.4451 42.0499 36.5355 42.7435 37.7261 43.0439C38.9167 43.3407 39.8106 43.1404 40.4041 42.6471L45.6598 39.372V68.6289C45.6598 69.4227 46.1568 70.2164 47.0507 70.91C47.9408 71.6036 49.1315 72.0005 50.5186 72.0005C51.9095 72.0005 53.1001 71.6036 54.0904 70.91C55.0808 70.2164 55.5778 69.4227 55.5778 68.6289V29.1573C55.5778 28.167 55.0808 27.4734 54.0904 26.8762C53.1001 26.2828 51.9095 25.9861 50.4222 25.9861C48.9349 25.9861 47.8444 26.2828 46.9505 26.8762L33.661 35.2067Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16877_8554">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16877_8554)"><path fill="#fff" d="M25.43.894C24.438.297 23.347 0 21.96 0q-2.23 0-3.572.894C17.497 1.488 17 2.282 17 3.276v65.353c0 .794.497 1.587 1.387 2.281.994.694 2.085 1.09 3.472 1.09a6 6 0 0 0 3.471-1.09c.99-.694 1.488-1.487 1.488-2.281V3.276c.1-.994-.397-1.788-1.387-2.382m8.231 34.313c-.593.597-.894 1.39-.694 2.578.1 1.19.594 2.28 1.588 3.275.89.99 1.98 1.683 3.171 1.984 1.19.297 2.085.096 2.678-.397l5.256-3.275v29.257c0 .794.497 1.587 1.39 2.281.89.694 2.082 1.09 3.469 1.09 1.39 0 2.581-.396 3.571-1.09s1.488-1.487 1.488-2.281V29.157c0-.99-.497-1.684-1.488-2.28-.99-.594-2.18-.89-3.668-.89s-2.578.296-3.471.89z"/></g><defs><clipPath id="clip0_16877_8554"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/hackerone-light.svg b/web/packages/design/src/ResourceIcon/assets/hackerone-light.svg
index 42c4d9c064047..0e5b9db2a46d4 100644
--- a/web/packages/design/src/ResourceIcon/assets/hackerone-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/hackerone-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16877_8554)">
-<path d="M25.4307 0.894368C24.4366 0.297212 23.3462 0.000488281 21.959 0.000488281C20.4717 0.000488281 19.2811 0.297212 18.3872 0.894368C17.497 1.48782 17 2.28155 17 3.27557V68.6289C17 69.4227 17.497 70.2164 18.3872 70.91C19.3812 71.6036 20.4717 72.0005 21.8588 72.0005C23.1014 72.0042 24.3142 71.6221 25.3305 70.91C26.3208 70.2164 26.8178 69.4227 26.8178 68.6289V3.27557C26.918 2.28155 26.421 1.48782 25.4307 0.894368ZM33.661 35.2067C33.0676 35.8039 32.7671 36.5976 32.9674 37.7845C33.0676 38.9751 33.5609 40.0656 34.5549 41.0596C35.4451 42.0499 36.5355 42.7435 37.7261 43.0439C38.9167 43.3407 39.8106 43.1404 40.4041 42.6471L45.6598 39.372V68.6289C45.6598 69.4227 46.1568 70.2164 47.0507 70.91C47.9408 71.6036 49.1315 72.0005 50.5186 72.0005C51.9095 72.0005 53.1001 71.6036 54.0904 70.91C55.0808 70.2164 55.5778 69.4227 55.5778 68.6289V29.1573C55.5778 28.167 55.0808 27.4734 54.0904 26.8762C53.1001 26.2828 51.9095 25.9861 50.4222 25.9861C48.9349 25.9861 47.8444 26.2828 46.9505 26.8762L33.661 35.2067Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16877_8554">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16877_8554)"><path fill="#000" d="M25.43.894C24.438.297 23.347 0 21.96 0q-2.23 0-3.572.894C17.497 1.488 17 2.282 17 3.276v65.353c0 .794.497 1.587 1.387 2.281.994.694 2.085 1.09 3.472 1.09a6 6 0 0 0 3.471-1.09c.99-.694 1.488-1.487 1.488-2.281V3.276c.1-.994-.397-1.788-1.387-2.382m8.231 34.313c-.593.597-.894 1.39-.694 2.578.1 1.19.594 2.28 1.588 3.275.89.99 1.98 1.683 3.171 1.984 1.19.297 2.085.096 2.678-.397l5.256-3.275v29.257c0 .794.497 1.587 1.39 2.281.89.694 2.082 1.09 3.469 1.09 1.39 0 2.581-.396 3.571-1.09s1.488-1.487 1.488-2.281V29.157c0-.99-.497-1.684-1.488-2.28-.99-.594-2.18-.89-3.668-.89s-2.578.296-3.471.89z"/></g><defs><clipPath id="clip0_16877_8554"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/headliner.svg b/web/packages/design/src/ResourceIcon/assets/headliner.svg
index 9df59c430c1a1..89259e3dc2df2 100644
--- a/web/packages/design/src/ResourceIcon/assets/headliner.svg
+++ b/web/packages/design/src/ResourceIcon/assets/headliner.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16877_15408)">
-<path d="M36 2.81213C40.4813 2.81213 44.828 3.68929 48.9162 5.41971C50.8811 6.25126 52.7788 7.28038 54.5526 8.47887C56.3112 9.66649 57.9635 11.03 59.4659 12.5324C60.9683 14.0349 62.3319 15.6871 63.5195 17.4457C64.7179 19.2196 65.7471 21.1151 66.5786 23.0821C68.309 27.1726 69.1862 31.5171 69.1862 35.9983C69.1862 40.4796 68.309 44.8263 66.5786 48.9145C65.7471 50.8794 64.7179 52.7771 63.5195 54.5508C62.3319 56.3095 60.9683 57.9618 59.4659 59.4642C57.9635 60.9666 56.3112 62.3302 54.5526 63.5177C52.7788 64.7163 50.8833 65.7454 48.9162 66.5769C44.8258 68.3074 40.4813 69.1845 36 69.1845C31.5188 69.1845 27.172 68.3074 23.0838 66.5769C21.1189 65.7454 19.2212 64.7163 17.4475 63.5177C15.6888 62.3302 14.0365 60.9666 12.5341 59.4642C11.0317 57.9618 9.66818 56.3095 8.48056 54.5508C7.28207 52.7771 6.25294 50.8816 5.42139 48.9145C3.69097 44.8241 2.81383 40.4796 2.81383 35.9983C2.81383 31.5171 3.69097 27.1704 5.42139 23.0821C6.25294 21.1172 7.28207 19.2196 8.48056 17.4457C9.66818 15.6871 11.0317 14.0349 12.5341 12.5324C14.0365 11.03 15.6888 9.66649 17.4475 8.47887C19.2212 7.28038 21.1167 6.25126 23.0838 5.41971C27.172 3.68929 31.5188 2.81213 36 2.81213ZM36 0.000488281C16.1165 0.000488281 0 16.117 0 36.0005C0 55.8818 16.1165 72.0005 36 72.0005C55.8835 72.0005 72 55.884 72 36.0005C71.9979 16.117 55.8813 0.000488281 36 0.000488281ZM50.3775 54.9438C46.2002 58.0399 41.2651 59.6748 36.3322 59.6748C33.7355 59.6748 31.141 59.2948 28.6528 58.5133C26.1647 57.7316 23.7873 56.5506 21.6182 54.9417C20.9951 54.4793 20.1136 54.6095 19.6512 55.2348C19.1887 55.8579 19.319 56.7394 19.9443 57.2018C22.376 59.0039 25.04 60.3262 27.8104 61.1968C30.583 62.0674 33.4619 62.4865 36.3322 62.4865C41.886 62.4865 47.403 60.6475 52.0514 57.2018C52.6745 56.7394 52.807 55.8579 52.3445 55.2348C51.882 54.6117 51.0028 54.4814 50.3775 54.9438ZM39.4478 39.4527V44.4745C39.4478 47.7248 42.0814 50.3583 45.3317 50.3583C48.582 50.3583 51.2155 47.7248 51.2155 44.4745V23.2167C51.2155 19.9664 48.582 17.3329 45.3317 17.3329C42.0814 17.3329 39.4478 19.9664 39.4478 23.2167V35.9897H32.5479V23.2167C32.5479 19.9664 29.9143 17.3329 26.664 17.3329C23.4138 17.3329 20.7802 19.9664 20.7802 23.2167V44.4745C20.7802 47.7248 23.4138 50.3583 26.664 50.3583C29.9143 50.3583 32.5479 47.7248 32.5479 44.4745V39.4527H39.4478Z" fill="url(#paint0_linear_16877_15408)"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_16877_15408" x1="7.52373e-07" y1="34.3626" x2="323.527" y2="103.372" gradientUnits="userSpaceOnUse">
-<stop stop-color="#5DBEFC"/>
-<stop offset="1" stop-color="#DD92FE"/>
-</linearGradient>
-<clipPath id="clip0_16877_15408">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16877_15408)"><path fill="url(#paint0_linear_16877_15408)" d="M36 2.812c4.481 0 8.828.877 12.916 2.608a33.2 33.2 0 0 1 10.55 7.112 33.4 33.4 0 0 1 4.053 4.914 33 33 0 0 1 3.06 5.636 33 33 0 0 1 2.607 12.916c0 4.482-.877 8.828-2.607 12.917a33.2 33.2 0 0 1-7.113 10.55 33.4 33.4 0 0 1-4.913 4.053 33 33 0 0 1-5.637 3.059A33 33 0 0 1 36 69.185c-4.481 0-8.828-.878-12.916-2.608a33.2 33.2 0 0 1-10.55-7.113 33.4 33.4 0 0 1-4.053-4.913 33 33 0 0 1-3.06-5.637 33 33 0 0 1-2.607-12.916c0-4.48.877-8.828 2.607-12.916a33.2 33.2 0 0 1 7.113-10.55 33.4 33.4 0 0 1 4.914-4.053 33 33 0 0 1 5.636-3.06A33 33 0 0 1 36 2.813M36 0C16.117 0 0 16.117 0 36s16.116 36 36 36c19.883 0 36-16.116 36-36-.002-19.883-16.119-36-36-36m14.377 54.944c-4.177 3.096-9.112 4.73-14.045 4.73-2.596 0-5.191-.38-7.68-1.16a23.7 23.7 0 0 1-7.034-3.572 1.405 1.405 0 1 0-1.674 2.26 26.6 26.6 0 0 0 7.866 3.995 28.5 28.5 0 0 0 8.522 1.29c5.554 0 11.071-1.84 15.72-5.285a1.406 1.406 0 1 0-1.674-2.258m-10.93-15.491v5.021a5.883 5.883 0 0 0 5.885 5.884 5.883 5.883 0 0 0 5.883-5.883V23.217a5.883 5.883 0 0 0-5.883-5.884 5.883 5.883 0 0 0-5.884 5.884V35.99h-6.9V23.217a5.883 5.883 0 0 0-5.884-5.884 5.883 5.883 0 0 0-5.884 5.884v21.258a5.883 5.883 0 0 0 5.884 5.883 5.883 5.883 0 0 0 5.884-5.883v-5.022z"/></g><defs><linearGradient id="paint0_linear_16877_15408" x1="0" x2="323.527" y1="34.363" y2="103.372" gradientUnits="userSpaceOnUse"><stop stop-color="#5dbefc"/><stop offset="1" stop-color="#dd92fe"/></linearGradient><clipPath id="clip0_16877_15408"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/hootsuite.svg b/web/packages/design/src/ResourceIcon/assets/hootsuite.svg
index 1deee23487ac5..8f761a475dfcf 100644
--- a/web/packages/design/src/ResourceIcon/assets/hootsuite.svg
+++ b/web/packages/design/src/ResourceIcon/assets/hootsuite.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16877_15572)">
-<path d="M35.8336 8.94334C28.2165 8.88877 19.7468 13.5795 13.549 20.5476C9.05805 25.6026 3.40253 39.5728 0.628472 46.8655C-0.548507 49.9693 0.0072561 53.4645 2.08892 56.0501C6.97406 62.0691 17.1419 71.8628 36.8271 71.9991C54.8582 72.1271 64.0488 64.0975 68.3584 58.1994C70.7459 54.9282 71.4812 50.7347 70.3489 46.8464C68.4316 40.2627 64.417 28.8763 57.8176 21.0071C50.2877 12.0435 43.4435 8.99608 35.8336 8.94334Z" fill="#FF4C46"/>
-<path d="M42.2573 27.2316C53.4162 19.4678 59.4656 26.2071 62.8599 33.6831C65.312 39.071 66.1803 49.1583 58.2201 50.7041C52.1225 51.8932 46.4881 45.7156 42.3211 39.9479C41.8933 39.3573 41.0677 39.2252 40.477 39.653C40.3657 39.7336 40.2678 39.8311 40.1866 39.9418C37.4407 43.7281 30.5679 55.1071 20.2964 52.299C10.5831 49.6399 8.44888 38.7137 12.4884 31.1608C18.466 19.7719 27.1984 16.0611 42.2573 27.2316Z" fill="white"/>
-<path d="M36.2861 51.7167C37.5632 53.1234 40.2281 55.988 41.8237 57.3591C42.1309 57.6252 42.5941 57.5983 42.8684 57.2984L47.1601 52.5722C47.2229 52.5181 47.23 52.4234 47.1759 52.3606C47.1321 52.3096 47.0598 52.294 46.9989 52.3224C43.5395 53.628 39.6774 53.318 36.4706 51.4771C36.3895 51.4455 36.2982 51.4856 36.2666 51.5667C36.2471 51.6168 36.2544 51.6733 36.2861 51.7167Z" fill="white"/>
-<path d="M40.6112 42.9129L36.2294 47.9955C36.0311 48.2183 36.051 48.5598 36.2739 48.7581C36.2869 48.7697 36.3004 48.7807 36.3145 48.7909C37.3078 49.5144 39.7344 51.0881 42.1055 51.1076C43.9067 51.0661 45.6756 50.6196 47.2808 49.8013C47.5454 49.6634 47.6482 49.3373 47.5104 49.0727C47.4906 49.0346 47.4662 48.9988 47.4379 48.9665L42.1035 42.8879C41.7158 42.4847 41.0745 42.4722 40.6713 42.8599C40.6531 42.8775 40.6354 42.8958 40.6185 42.9147L40.6112 42.9129Z" fill="white"/>
-<path d="M55.2695 34.0451C56.5599 36.0482 55.9821 38.7179 53.979 40.0082C51.976 41.2985 49.3063 40.7207 48.016 38.7177C46.7381 36.734 47.2911 34.0918 49.2572 32.787C51.1307 31.4461 53.7364 31.8778 55.0773 33.7512C55.1455 33.8465 55.2096 33.9445 55.2695 34.0451Z" fill="#FF4C46"/>
-<path d="M40.1995 27.2293C41.4281 28.2053 43.1293 28.3287 44.4858 27.54L71.6082 11.7424C71.9628 11.5279 72.0762 11.0666 71.8617 10.712C71.7196 10.4771 71.4606 10.3387 71.1864 10.3509L41.8275 12.7818L8.34119 0.0518968C7.87637 -0.112628 7.36614 0.130813 7.20162 0.595635C7.07653 0.948959 7.18546 1.34276 7.47432 1.58162L40.1995 27.2293Z" fill="#FF4C46"/>
-<path d="M28.2331 31.6473C25.9876 32.4127 24.8712 34.7976 25.5403 37.0187C26.3057 39.2641 28.6906 40.3805 30.9116 39.7115C33.1571 38.946 34.2552 36.531 33.6044 34.3402C33.6105 34.3257 33.5959 34.2844 33.5685 34.2348C32.8775 32.073 30.6714 30.9306 28.5711 31.5277C28.4747 31.5032 28.3539 31.5752 28.2331 31.6473Z" fill="#FF4C46"/>
-</g>
-<defs>
-<clipPath id="clip0_16877_15572">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16877_15572)"><path fill="#ff4c46" d="M35.834 8.943c-7.618-.054-16.087 4.637-22.285 11.605C9.059 25.603 3.403 39.573.629 46.866a9.36 9.36 0 0 0 1.46 9.184C6.974 62.07 17.142 71.863 36.827 72c18.031.127 27.222-7.903 31.531-13.8a13.06 13.06 0 0 0 1.99-11.354c-1.916-6.583-5.931-17.97-12.53-25.839-7.53-8.964-14.374-12.01-21.984-12.064"/><path fill="#fff" d="M42.257 27.232c11.16-7.764 17.209-1.025 20.603 6.451 2.452 5.388 3.32 15.475-4.64 17.021-6.097 1.19-11.732-4.988-15.899-10.756a1.32 1.32 0 0 0-2.134-.006c-2.746 3.786-9.62 15.165-19.89 12.357-9.714-2.66-11.848-13.585-7.809-21.138 5.978-11.39 14.71-15.1 29.77-3.93"/><path fill="#fff" d="M36.286 51.717c1.277 1.406 3.942 4.271 5.538 5.642a.75.75 0 0 0 1.044-.06l4.292-4.727a.15.15 0 0 0-.161-.25 12.37 12.37 0 0 1-10.528-.845.158.158 0 0 0-.185.24m4.325-8.804-4.382 5.083a.54.54 0 0 0 .086.795c.993.723 3.42 2.297 5.79 2.317a12 12 0 0 0 5.176-1.307.54.54 0 0 0 .157-.834l-5.335-6.08a1.013 1.013 0 0 0-1.485.028z"/><path fill="#ff4c46" d="M55.27 34.045a4.314 4.314 0 1 1-6.013-1.258 4.17 4.17 0 0 1 6.013 1.258M40.2 27.23a3.81 3.81 0 0 0 4.286.31l27.122-15.798a.75.75 0 0 0-.422-1.391l-29.359 2.43L8.342.052a.893.893 0 0 0-.867 1.53zm-11.967 4.417c-2.245.766-3.362 3.15-2.693 5.372.766 2.245 3.15 3.361 5.372 2.693 2.245-.766 3.343-3.181 2.692-5.372.007-.014-.008-.056-.035-.105-.692-2.162-2.898-3.304-4.998-2.707-.096-.025-.217.047-.338.12"/></g><defs><clipPath id="clip0_16877_15572"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ibm-dark.svg b/web/packages/design/src/ResourceIcon/assets/ibm-dark.svg
index ef037b921ad6c..6de836135f02e 100644
--- a/web/packages/design/src/ResourceIcon/assets/ibm-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ibm-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 47.6497V49.5532H62.5263V47.6497H72ZM49.2632 47.6497V49.5532H39.7895V47.6497H49.2632ZM56.6547 47.6497L55.8926 49.5532L55.1405 47.6497H56.6547ZM35.4316 47.6497C34.0723 48.8318 32.2795 49.5532 30.2779 49.5532H15.1579V47.6497H35.4316ZM13.2632 47.6497V49.5532H0V47.6497H13.2632ZM49.2632 43.8428V45.7463H39.7895V43.8428H49.2632ZM58.1361 43.8428L57.3986 45.7463H54.3988L53.6557 43.8428H58.1361ZM37.3263 43.8428C37.1553 44.5196 36.8821 45.1586 36.5305 45.7463H15.1579V43.8428H37.3263ZM13.2632 43.8428V45.7463H0V43.8428H13.2632ZM72 43.8428V45.7463H62.5263V43.8428H72ZM68.2105 40.0359V41.9394H62.5263V40.0359H68.2105ZM49.2632 40.0359V41.9394H43.5789V40.0359H49.2632ZM59.6225 40.0359L58.8781 41.9394H52.9118L52.1615 40.0359H59.6225ZM37.0611 40.0359C37.2313 40.6428 37.3263 41.2803 37.3263 41.9394H30.3158V40.0359H37.0611ZM24.6316 40.0359V41.9394H18.9474V40.0359H24.6316ZM9.47368 40.0359V41.9394H3.78947V40.0359H9.47368ZM68.2105 36.2291V38.1325H62.5263V36.2291H68.2105ZM49.2632 36.2291V38.1325H43.5789V36.2291H49.2632ZM61.1072 36.2291L60.3664 38.1325H51.4042L50.6691 36.2291H61.1072ZM34.7305 36.2291C35.384 36.7663 35.9467 37.4102 36.3789 38.1325H18.9474V36.2291H34.7305ZM9.47368 36.2291V38.1325H3.78947V36.2291H9.47368ZM55.364 32.4222L55.8947 33.9607L56.4251 32.4222H68.2105V34.3256H62.5263V32.5765L61.8821 34.3256H49.8884L49.2632 32.5763V34.3256H43.5789V32.4222H55.364ZM9.47368 32.4222V34.3256H3.78947V32.4222H9.47368ZM36.3789 32.4222C35.9467 33.1444 35.384 33.7881 34.7305 34.3256H18.9474V32.4222H36.3789ZM68.2105 28.6153V30.5187H57.0825L57.7532 28.6153H68.2105ZM54.0426 28.6153L54.7133 30.5187H43.5789V28.6153H54.0426ZM37.3263 28.6153C37.3263 29.2742 37.2313 29.9117 37.0611 30.5187H30.3158V28.6153H37.3263ZM24.6316 28.6153V30.5187H18.9474V28.6153H24.6316ZM9.47368 28.6153V30.5187H3.78947V28.6153H9.47368ZM52.7306 24.8084L53.3891 26.7118H39.7897L39.7895 24.8084H52.7306ZM72 24.8084V26.7118H58.3933L59.0777 24.8084H72ZM36.5305 24.8084C36.8821 25.396 37.1553 26.035 37.3263 26.7118H15.1579V24.8084H36.5305ZM13.2632 24.8084V26.7118H0V24.8084H13.2632ZM51.4001 21.0015L52.0712 22.9049H39.7897L39.7895 21.0015H51.4001ZM72 21.0015V22.9049H59.7337L60.389 21.0015H72ZM30.2779 21.0015C32.2649 21.0015 34.0725 21.7229 35.4316 22.9049H15.1579V21.0015H30.2779ZM13.2632 21.0015V22.9049H0V21.0015H13.2632Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M72 47.65v1.903h-9.474V47.65zm-22.737 0v1.903H39.79V47.65zm7.392 0-.762 1.903-.752-1.903zm-21.223 0a7.8 7.8 0 0 1-5.154 1.903h-15.12V47.65zm-22.169 0v1.903H0V47.65zm36-3.807v1.903H39.79v-1.903zm8.873 0-.737 1.903h-3l-.743-1.903zm-20.81 0a7.1 7.1 0 0 1-.795 1.903H15.158v-1.903zm-24.063 0v1.903H0v-1.903zm58.737 0v1.903h-9.474v-1.903zm-3.79-3.807v1.903h-5.684v-1.903zm-18.947 0v1.903H43.58v-1.903zm10.36 0-.745 1.903h-5.966l-.75-1.903zm-22.562 0c.17.607.265 1.244.265 1.903h-7.01v-1.903zm-12.43 0v1.903h-5.684v-1.903zm-15.157 0v1.903H3.789v-1.903zm58.736-3.807v1.904h-5.684v-1.904zm-18.947 0v1.904H43.58v-1.904zm11.844 0-.74 1.904h-8.963l-.735-1.904zm-26.376 0a7.4 7.4 0 0 1 1.648 1.904H18.947v-1.904zm-25.257 0v1.904H3.789v-1.904zm45.89-3.807.53 1.539.531-1.539H68.21v1.904h-5.684v-1.75l-.644 1.75H49.888l-.625-1.75v1.75H43.58v-1.904zm-45.89 0v1.904H3.789v-1.904zm26.905 0a7.4 7.4 0 0 1-1.648 1.904H18.947v-1.904zm31.832-3.807v1.904H57.082l.67-1.904zm-14.168 0 .67 1.904H43.58v-1.904zm-16.717 0c0 .66-.095 1.297-.265 1.904h-6.745v-1.904zm-12.694 0v1.904h-5.685v-1.904zm-15.158 0v1.904H3.789v-1.904zm43.257-3.807.658 1.904h-13.6v-1.904zm19.269 0v1.904H58.393l.685-1.904zm-35.47 0c.352.588.625 1.227.796 1.904H15.158v-1.904zm-23.267 0v1.904H0v-1.904zM51.4 21.002l.671 1.903H39.79V21zm20.6 0v1.903H59.734L60.389 21zm-41.722 0a7.83 7.83 0 0 1 5.154 1.903H15.158V21zm-17.015 0v1.903H0V21z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ibm-light.svg b/web/packages/design/src/ResourceIcon/assets/ibm-light.svg
index 1721048355a02..73bfcd328b0f4 100644
--- a/web/packages/design/src/ResourceIcon/assets/ibm-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ibm-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 47.6497V49.5532H62.5263V47.6497H72ZM49.2632 47.6497V49.5532H39.7895V47.6497H49.2632ZM56.6547 47.6497L55.8926 49.5532L55.1405 47.6497H56.6547ZM35.4316 47.6497C34.0723 48.8318 32.2795 49.5532 30.2779 49.5532H15.1579V47.6497H35.4316ZM13.2632 47.6497V49.5532H0V47.6497H13.2632ZM49.2632 43.8428V45.7463H39.7895V43.8428H49.2632ZM58.1361 43.8428L57.3986 45.7463H54.3988L53.6557 43.8428H58.1361ZM37.3263 43.8428C37.1553 44.5196 36.8821 45.1586 36.5305 45.7463H15.1579V43.8428H37.3263ZM13.2632 43.8428V45.7463H0V43.8428H13.2632ZM72 43.8428V45.7463H62.5263V43.8428H72ZM68.2105 40.0359V41.9394H62.5263V40.0359H68.2105ZM49.2632 40.0359V41.9394H43.5789V40.0359H49.2632ZM59.6225 40.0359L58.8781 41.9394H52.9118L52.1615 40.0359H59.6225ZM37.0611 40.0359C37.2313 40.6428 37.3263 41.2803 37.3263 41.9394H30.3158V40.0359H37.0611ZM24.6316 40.0359V41.9394H18.9474V40.0359H24.6316ZM9.47368 40.0359V41.9394H3.78947V40.0359H9.47368ZM68.2105 36.2291V38.1325H62.5263V36.2291H68.2105ZM49.2632 36.2291V38.1325H43.5789V36.2291H49.2632ZM61.1072 36.2291L60.3664 38.1325H51.4042L50.6691 36.2291H61.1072ZM34.7305 36.2291C35.384 36.7663 35.9467 37.4102 36.3789 38.1325H18.9474V36.2291H34.7305ZM9.47368 36.2291V38.1325H3.78947V36.2291H9.47368ZM55.364 32.4222L55.8947 33.9607L56.4251 32.4222H68.2105V34.3256H62.5263V32.5765L61.8821 34.3256H49.8884L49.2632 32.5763V34.3256H43.5789V32.4222H55.364ZM9.47368 32.4222V34.3256H3.78947V32.4222H9.47368ZM36.3789 32.4222C35.9467 33.1444 35.384 33.7881 34.7305 34.3256H18.9474V32.4222H36.3789ZM68.2105 28.6153V30.5187H57.0825L57.7532 28.6153H68.2105ZM54.0426 28.6153L54.7133 30.5187H43.5789V28.6153H54.0426ZM37.3263 28.6153C37.3263 29.2742 37.2313 29.9117 37.0611 30.5187H30.3158V28.6153H37.3263ZM24.6316 28.6153V30.5187H18.9474V28.6153H24.6316ZM9.47368 28.6153V30.5187H3.78947V28.6153H9.47368ZM52.7306 24.8084L53.3891 26.7118H39.7897L39.7895 24.8084H52.7306ZM72 24.8084V26.7118H58.3933L59.0777 24.8084H72ZM36.5305 24.8084C36.8821 25.396 37.1553 26.035 37.3263 26.7118H15.1579V24.8084H36.5305ZM13.2632 24.8084V26.7118H0V24.8084H13.2632ZM51.4001 21.0015L52.0712 22.9049H39.7897L39.7895 21.0015H51.4001ZM72 21.0015V22.9049H59.7337L60.389 21.0015H72ZM30.2779 21.0015C32.2649 21.0015 34.0725 21.7229 35.4316 22.9049H15.1579V21.0015H30.2779ZM13.2632 21.0015V22.9049H0V21.0015H13.2632Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M72 47.65v1.903h-9.474V47.65zm-22.737 0v1.903H39.79V47.65zm7.392 0-.762 1.903-.752-1.903zm-21.223 0a7.8 7.8 0 0 1-5.154 1.903h-15.12V47.65zm-22.169 0v1.903H0V47.65zm36-3.807v1.903H39.79v-1.903zm8.873 0-.737 1.903h-3l-.743-1.903zm-20.81 0a7.1 7.1 0 0 1-.795 1.903H15.158v-1.903zm-24.063 0v1.903H0v-1.903zm58.737 0v1.903h-9.474v-1.903zm-3.79-3.807v1.903h-5.684v-1.903zm-18.947 0v1.903H43.58v-1.903zm10.36 0-.745 1.903h-5.966l-.75-1.903zm-22.562 0c.17.607.265 1.244.265 1.903h-7.01v-1.903zm-12.43 0v1.903h-5.684v-1.903zm-15.157 0v1.903H3.789v-1.903zm58.736-3.807v1.904h-5.684v-1.904zm-18.947 0v1.904H43.58v-1.904zm11.844 0-.74 1.904h-8.963l-.735-1.904zm-26.376 0a7.4 7.4 0 0 1 1.648 1.904H18.947v-1.904zm-25.257 0v1.904H3.789v-1.904zm45.89-3.807.53 1.539.531-1.539H68.21v1.904h-5.684v-1.75l-.644 1.75H49.888l-.625-1.75v1.75H43.58v-1.904zm-45.89 0v1.904H3.789v-1.904zm26.905 0a7.4 7.4 0 0 1-1.648 1.904H18.947v-1.904zm31.832-3.807v1.904H57.082l.67-1.904zm-14.168 0 .67 1.904H43.58v-1.904zm-16.717 0c0 .66-.095 1.297-.265 1.904h-6.745v-1.904zm-12.694 0v1.904h-5.685v-1.904zm-15.158 0v1.904H3.789v-1.904zm43.257-3.807.658 1.904h-13.6v-1.904zm19.269 0v1.904H58.393l.685-1.904zm-35.47 0c.352.588.625 1.227.796 1.904H15.158v-1.904zm-23.267 0v1.904H0v-1.904zM51.4 21.002l.671 1.903H39.79V21zm20.6 0v1.903H59.734L60.389 21zm-41.722 0a7.83 7.83 0 0 1 5.154 1.903H15.158V21zm-17.015 0v1.903H0V21z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/inkeep.svg b/web/packages/design/src/ResourceIcon/assets/inkeep.svg
index cf2a169cd52a2..5d035128c51e8 100644
--- a/web/packages/design/src/ResourceIcon/assets/inkeep.svg
+++ b/web/packages/design/src/ResourceIcon/assets/inkeep.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M72 9.55592V56.8159C72 59.4476 69.7396 61.531 67.1209 61.3117L38.1225 59.0638C34.7044 58.7897 31.2864 59.5572 28.3094 61.2294L18.3032 66.8491C17.4212 67.3425 16.4564 66.3283 17.0077 65.4784L22.0245 57.8302L26.683 50.7028C27.1792 49.9353 28.144 49.5789 29.026 49.853C36.3307 52.2105 44.6003 49.4966 48.9832 42.8079C54.2205 34.7759 51.9326 24.03 43.8836 18.8215C35.807 13.5856 25.0015 15.8884 19.7642 23.8929C15.3813 30.6091 16.2634 39.2168 21.3629 44.8913C21.9694 45.5766 22.0521 46.5909 21.5283 47.3584L15.6294 56.4048C15.271 56.9256 14.6646 57.2271 14.0306 57.1997L3.22511 56.3773C1.37825 56.2403 0 54.76 0 52.9507V13.3938C0 11.6119 1.37825 10.1042 3.19755 9.96712L67.1209 5.03278C69.7396 4.84089 72 6.92427 72 9.55592ZM34.3185 21.508C27.7305 21.508 22.3828 26.8261 22.3828 33.3778C22.3828 36.5577 23.6508 39.4635 25.7182 41.6017C26.9862 42.8902 28.5299 43.9044 30.2665 44.5349C31.5345 45.0009 32.8851 45.2477 34.3185 45.2477C40.9066 45.2477 46.2542 39.9295 46.2542 33.3778C46.2542 26.7987 40.9066 21.508 34.3185 21.508Z" fill="url(#paint0_linear_15942_7478)"/>
-<defs>
-<linearGradient id="paint0_linear_15942_7478" x1="3.57494" y1="57.1475" x2="54.0016" y2="22.9389" gradientUnits="userSpaceOnUse">
-<stop stop-color="#00BFEA"/>
-<stop offset="1" stop-color="#26D6FF"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_15942_7478)" d="M72 9.556v47.26c0 2.632-2.26 4.715-4.88 4.496l-28.998-2.248a17.24 17.24 0 0 0-9.813 2.165l-10.006 5.62c-.882.493-1.847-.52-1.295-1.37l5.017-7.649 4.658-7.127a2.07 2.07 0 0 1 2.343-.85c7.305 2.358 15.574-.356 19.957-7.045 5.238-8.032 2.95-18.778-5.1-23.986-8.076-5.236-18.882-2.934-24.119 5.07-4.383 6.717-3.5 15.325 1.599 21 .606.685.69 1.699.165 2.466l-5.899 9.047c-.358.52-.964.822-1.598.795l-10.806-.823C1.378 56.24 0 54.76 0 52.951V13.394a3.446 3.446 0 0 1 3.198-3.427L67.12 5.033C69.74 4.84 72 6.924 72 9.556M34.319 21.508c-6.589 0-11.936 5.318-11.936 11.87 0 3.18 1.268 6.086 3.335 8.224a12.25 12.25 0 0 0 4.549 2.933 11.7 11.7 0 0 0 4.052.713c6.588 0 11.935-5.318 11.935-11.87 0-6.58-5.347-11.87-11.935-11.87"/><defs><linearGradient id="paint0_linear_15942_7478" x1="3.575" x2="54.002" y1="57.148" y2="22.939" gradientUnits="userSpaceOnUse"><stop stop-color="#00bfea"/><stop offset="1" stop-color="#26d6ff"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/instruqt-dark.svg b/web/packages/design/src/ResourceIcon/assets/instruqt-dark.svg
index 03239ad0c2fb4..6a32537ccf78a 100644
--- a/web/packages/design/src/ResourceIcon/assets/instruqt-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/instruqt-dark.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16897_17221)">
-<path d="M40.3818 9.59131C40.3268 9.64624 40.272 9.72866 40.217 9.78359C39.6675 10.3055 39.0083 10.7175 38.2941 11.0197C37.5524 11.3219 36.7832 11.4592 35.9867 11.4592C35.1901 11.4592 34.3935 11.3219 33.6519 11.0197C32.8827 10.7175 32.1958 10.2231 31.6191 9.64624V14.2062H40.3818V9.59131Z" fill="#BE78FF"/>
-<path d="M33.6247 11.0196C34.3663 11.3218 35.1629 11.4591 35.9597 11.4591C36.7563 11.4591 37.5253 11.3218 38.2671 11.0196C38.9813 10.7175 39.613 10.3054 40.1899 9.7835C40.2448 9.72857 40.2998 9.64615 40.3546 9.59122C40.8217 9.09676 41.1787 8.54739 41.4534 7.94306C41.783 7.22886 41.9479 6.48719 41.9479 5.71805C41.9479 4.94889 41.783 4.20722 41.4534 3.5205C41.1514 2.83376 40.7118 2.20197 40.1899 1.68004C39.6405 1.15813 39.0087 0.74609 38.2945 0.471396C37.5802 0.141764 36.7836 -0.0230515 35.9871 0.00441813C34.3939 0.0318859 32.8831 0.636212 31.7567 1.70751C31.2074 2.22944 30.7954 2.86123 30.4931 3.54797C30.1911 4.23469 30.0262 5.00384 30.0538 5.74552C30.0538 6.51465 30.1911 7.28379 30.4931 7.97053C30.7678 8.60232 31.1524 9.15171 31.6194 9.64615C32.1689 10.223 32.8555 10.69 33.6247 11.0196Z" fill="white"/>
-<path d="M30.1346 28.7923C29.5303 28.1881 28.7612 27.7761 27.9096 27.6112C27.0581 27.4464 26.179 27.5288 25.3824 27.8584C24.5858 28.1881 23.8991 28.7374 23.4321 29.4516C22.9651 30.1658 22.6904 31.0174 22.6904 31.8689C22.6904 33.0227 23.1574 34.1214 23.954 34.9455C24.7781 35.7695 25.8769 36.2091 27.0306 36.2091C27.8822 36.2091 28.7338 35.9618 29.448 35.4674C30.162 35.0005 30.7115 34.3137 31.0412 33.5171C31.3708 32.7205 31.4531 31.8415 31.2884 30.99C31.1509 30.1658 30.7389 29.3966 30.1346 28.7923Z" fill="white"/>
-<path d="M48.9505 33.5445C49.2801 32.7479 49.3625 31.8689 49.1977 31.0174C49.0328 30.1658 48.6208 29.3966 48.0166 28.7923C47.4123 28.1881 46.6431 27.7761 45.7915 27.6112C44.94 27.4464 44.061 27.5288 43.2643 27.8584C42.4677 28.1881 41.781 28.7374 41.3141 29.4516C40.8471 30.1658 40.5723 31.0174 40.5723 31.8689C40.5723 33.0227 41.0394 34.1214 41.836 34.9455C42.66 35.7695 43.7588 36.2091 44.9126 36.2091C45.7641 36.2091 46.6157 35.9618 47.3297 35.4674C48.0715 35.0279 48.6208 34.3412 48.9505 33.5445Z" fill="white"/>
-<path d="M20.7974 53.1299H11.7051V61.7828H20.7974V53.1575V53.1299Z" fill="#FF50A4"/>
-<path d="M62.6037 31.8688C62.6037 22.1173 54.6924 14.2061 44.9409 14.2061H40.3809H31.6183H27.0583C17.3067 14.2061 9.39551 22.1173 9.39551 31.8688C9.39551 41.6205 17.3067 49.5316 27.0308 49.5316H27.1132C26.7836 50.1634 26.3441 50.7403 25.7947 51.2347C24.4762 52.4434 22.6632 53.1301 20.7953 53.1577V61.8103C24.7783 61.8103 28.624 60.4644 31.6183 58.0747V62.8542H40.3259V58.0471C43.3202 60.437 47.1659 61.7829 51.1489 61.7829V53.1301C49.281 53.1301 47.468 52.4434 46.1495 51.2073C45.6002 50.7128 45.1606 50.136 44.831 49.5042H44.9133C54.665 49.5316 62.6037 41.6205 62.6037 31.8688ZM27.0308 40.8239C22.0863 40.8239 18.0758 36.8134 18.0758 31.8688C18.0758 26.9244 22.0863 22.9139 27.0308 22.9139H44.9133C49.8579 22.9139 53.8684 26.9244 53.8684 31.8688C53.8684 36.8134 49.8579 40.8239 44.9133 40.8239H27.0308Z" fill="white"/>
-<path d="M51.1758 53.1575V61.7828H60.268V53.1299H51.1758V53.1575Z" fill="#0598FF"/>
-<path d="M31.6191 66.9752V72.0019H40.3544V66.9752V62.8271H31.6191V66.9752Z" fill="#FF8F28"/>
-</g>
-<defs>
-<clipPath id="clip0_16897_17221">
-<rect width="72" height="72.0003" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16897_17221)"><path fill="#be78ff" d="M40.382 9.591c-.055.055-.11.138-.165.193a6.4 6.4 0 0 1-1.923 1.236c-.742.302-1.51.44-2.307.44a6.2 6.2 0 0 1-2.335-.44c-.77-.303-1.456-.797-2.033-1.374v4.56h8.763z"/><path fill="#fff" d="M33.625 11.02c.741.302 1.538.44 2.335.44s1.565-.138 2.307-.44a6.8 6.8 0 0 0 1.923-1.236c.055-.055.11-.138.165-.193a6 6 0 0 0 1.098-1.648q.495-1.071.495-2.225c0-.77-.165-1.51-.495-2.197A6.1 6.1 0 0 0 40.19 1.68 5.7 5.7 0 0 0 38.295.471a5.1 5.1 0 0 0-2.308-.467c-1.593.028-3.104.632-4.23 1.704a5.7 5.7 0 0 0-1.264 1.84 5.1 5.1 0 0 0-.44 2.198c0 .769.138 1.538.44 2.225.275.631.66 1.18 1.126 1.675a6.1 6.1 0 0 0 2.006 1.374m-3.49 17.772a4.3 4.3 0 0 0-2.225-1.18 4.4 4.4 0 0 0-2.528.246 4.27 4.27 0 0 0-1.95 1.594 4.47 4.47 0 0 0-.742 2.417 4.44 4.44 0 0 0 1.264 3.077 4.32 4.32 0 0 0 3.077 1.263c.851 0 1.703-.247 2.417-.742a4.27 4.27 0 0 0 1.593-1.95 4.4 4.4 0 0 0 .247-2.527 4.1 4.1 0 0 0-1.153-2.198m18.815 4.753a4.4 4.4 0 0 0 .248-2.528 4.29 4.29 0 0 0-3.407-3.406 4.4 4.4 0 0 0-2.527.247 4.27 4.27 0 0 0-1.95 1.594 4.47 4.47 0 0 0-.742 2.417 4.44 4.44 0 0 0 1.264 3.077 4.32 4.32 0 0 0 3.077 1.263 4.25 4.25 0 0 0 2.417-.742c.742-.44 1.29-1.126 1.62-1.922"/><path fill="#ff50a4" d="M20.797 53.13h-9.092v8.653h9.092z"/><path fill="#fff" d="M62.604 31.869c0-9.752-7.912-17.663-17.663-17.663H27.058c-9.751 0-17.662 7.911-17.662 17.663s7.91 17.663 17.635 17.663h.082a6 6 0 0 1-1.318 1.703c-1.319 1.208-3.132 1.895-5 1.923v8.652c3.983 0 7.829-1.346 10.823-3.735v4.78h8.708v-4.808c2.994 2.39 6.84 3.736 10.823 3.736V53.13c-1.868 0-3.681-.687-5-1.923a6 6 0 0 1-1.318-1.703h.082c9.752.028 17.69-7.883 17.69-17.635M27.03 40.824a8.957 8.957 0 0 1-8.955-8.955 8.957 8.957 0 0 1 8.955-8.955h17.882a8.957 8.957 0 0 1 8.955 8.955 8.957 8.957 0 0 1-8.955 8.955z"/><path fill="#0598ff" d="M51.176 53.158v8.625h9.092V53.13h-9.092z"/><path fill="#ff8f28" d="M31.62 66.975v5.027h8.734v-9.175H31.62z"/></g><defs><clipPath id="clip0_16897_17221"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/instruqt-light.svg b/web/packages/design/src/ResourceIcon/assets/instruqt-light.svg
index 840bb57c1e516..a17f8d4d65fa3 100644
--- a/web/packages/design/src/ResourceIcon/assets/instruqt-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/instruqt-light.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16897_17220)">
-<path d="M40.3818 9.59131C40.3268 9.64624 40.272 9.72866 40.217 9.78359C39.6675 10.3055 39.0083 10.7175 38.2941 11.0197C37.5524 11.3219 36.7832 11.4592 35.9867 11.4592C35.1901 11.4592 34.3935 11.3219 33.6519 11.0197C32.8827 10.7175 32.1958 10.2231 31.6191 9.64624V14.2062H40.3818V9.59131Z" fill="#BE78FF"/>
-<path d="M33.6247 11.0196C34.3663 11.3218 35.1629 11.4591 35.9597 11.4591C36.7563 11.4591 37.5253 11.3218 38.2671 11.0196C38.9813 10.7175 39.613 10.3054 40.1899 9.7835C40.2448 9.72857 40.2998 9.64615 40.3546 9.59122C40.8217 9.09676 41.1787 8.54739 41.4534 7.94306C41.783 7.22886 41.9479 6.48719 41.9479 5.71805C41.9479 4.94889 41.783 4.20722 41.4534 3.5205C41.1514 2.83376 40.7118 2.20197 40.1899 1.68004C39.6405 1.15813 39.0087 0.74609 38.2945 0.471396C37.5802 0.141764 36.7836 -0.0230515 35.9871 0.00441813C34.3939 0.0318859 32.8831 0.636212 31.7567 1.70751C31.2074 2.22944 30.7954 2.86123 30.4931 3.54797C30.1911 4.23469 30.0262 5.00384 30.0538 5.74552C30.0538 6.51465 30.1911 7.28379 30.4931 7.97053C30.7678 8.60232 31.1524 9.15171 31.6194 9.64615C32.1689 10.223 32.8555 10.69 33.6247 11.0196Z" fill="#181C32"/>
-<path d="M30.1346 28.7923C29.5303 28.1881 28.7612 27.7761 27.9096 27.6112C27.0581 27.4464 26.179 27.5288 25.3824 27.8584C24.5858 28.1881 23.8991 28.7374 23.4321 29.4516C22.9651 30.1658 22.6904 31.0174 22.6904 31.8689C22.6904 33.0227 23.1574 34.1214 23.954 34.9455C24.7781 35.7695 25.8769 36.2091 27.0306 36.2091C27.8822 36.2091 28.7338 35.9618 29.448 35.4674C30.162 35.0005 30.7115 34.3137 31.0412 33.5171C31.3708 32.7205 31.4531 31.8415 31.2884 30.99C31.1509 30.1658 30.7389 29.3966 30.1346 28.7923Z" fill="#181C32"/>
-<path d="M48.9505 33.5445C49.2801 32.7479 49.3625 31.8689 49.1977 31.0174C49.0328 30.1658 48.6208 29.3966 48.0166 28.7923C47.4123 28.1881 46.6431 27.7761 45.7915 27.6112C44.94 27.4464 44.061 27.5288 43.2643 27.8584C42.4677 28.1881 41.781 28.7374 41.3141 29.4516C40.8471 30.1658 40.5723 31.0174 40.5723 31.8689C40.5723 33.0227 41.0394 34.1214 41.836 34.9455C42.66 35.7695 43.7588 36.2091 44.9126 36.2091C45.7641 36.2091 46.6157 35.9618 47.3297 35.4674C48.0715 35.0279 48.6208 34.3412 48.9505 33.5445Z" fill="#181C32"/>
-<path d="M20.7974 53.1299H11.7051V61.7828H20.7974V53.1575V53.1299Z" fill="#FF50A4"/>
-<path d="M62.6037 31.8688C62.6037 22.1173 54.6924 14.2061 44.9409 14.2061H40.3809H31.6183H27.0583C17.3067 14.2061 9.39551 22.1173 9.39551 31.8688C9.39551 41.6205 17.3067 49.5316 27.0308 49.5316H27.1132C26.7836 50.1634 26.3441 50.7403 25.7947 51.2347C24.4762 52.4434 22.6632 53.1301 20.7953 53.1577V61.8103C24.7783 61.8103 28.624 60.4644 31.6183 58.0747V62.8542H40.3259V58.0471C43.3202 60.437 47.1659 61.7829 51.1489 61.7829V53.1301C49.281 53.1301 47.468 52.4434 46.1495 51.2073C45.6002 50.7128 45.1606 50.136 44.831 49.5042H44.9133C54.665 49.5316 62.6037 41.6205 62.6037 31.8688ZM27.0308 40.8239C22.0863 40.8239 18.0758 36.8134 18.0758 31.8688C18.0758 26.9244 22.0863 22.9139 27.0308 22.9139H44.9133C49.8579 22.9139 53.8684 26.9244 53.8684 31.8688C53.8684 36.8134 49.8579 40.8239 44.9133 40.8239H27.0308Z" fill="#181C32"/>
-<path d="M51.1758 53.1575V61.7828H60.268V53.1299H51.1758V53.1575Z" fill="#0598FF"/>
-<path d="M31.6191 66.9752V72.0019H40.3544V66.9752V62.8271H31.6191V66.9752Z" fill="#FF8F28"/>
-</g>
-<defs>
-<clipPath id="clip0_16897_17220">
-<rect width="72" height="72.0003" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16897_17220)"><path fill="#be78ff" d="M40.382 9.591c-.055.055-.11.138-.165.193a6.4 6.4 0 0 1-1.923 1.236c-.742.302-1.51.44-2.307.44a6.2 6.2 0 0 1-2.335-.44c-.77-.303-1.456-.797-2.033-1.374v4.56h8.763z"/><path fill="#181c32" d="M33.625 11.02c.741.302 1.538.44 2.335.44s1.565-.138 2.307-.44a6.8 6.8 0 0 0 1.923-1.236c.055-.055.11-.138.165-.193a6 6 0 0 0 1.098-1.648q.495-1.071.495-2.225c0-.77-.165-1.51-.495-2.197A6.1 6.1 0 0 0 40.19 1.68 5.7 5.7 0 0 0 38.295.471a5.1 5.1 0 0 0-2.308-.467c-1.593.028-3.104.632-4.23 1.704a5.7 5.7 0 0 0-1.264 1.84 5.1 5.1 0 0 0-.44 2.198c0 .769.138 1.538.44 2.225.275.631.66 1.18 1.126 1.675a6.1 6.1 0 0 0 2.006 1.374m-3.49 17.772a4.3 4.3 0 0 0-2.225-1.18 4.4 4.4 0 0 0-2.528.246 4.27 4.27 0 0 0-1.95 1.594 4.47 4.47 0 0 0-.742 2.417 4.44 4.44 0 0 0 1.264 3.077 4.32 4.32 0 0 0 3.077 1.263c.851 0 1.703-.247 2.417-.742a4.27 4.27 0 0 0 1.593-1.95 4.4 4.4 0 0 0 .247-2.527 4.1 4.1 0 0 0-1.153-2.198m18.815 4.753a4.4 4.4 0 0 0 .248-2.528 4.29 4.29 0 0 0-3.407-3.406 4.4 4.4 0 0 0-2.527.247 4.27 4.27 0 0 0-1.95 1.594 4.47 4.47 0 0 0-.742 2.417 4.44 4.44 0 0 0 1.264 3.077 4.32 4.32 0 0 0 3.077 1.263 4.25 4.25 0 0 0 2.417-.742c.742-.44 1.29-1.126 1.62-1.922"/><path fill="#ff50a4" d="M20.797 53.13h-9.092v8.653h9.092z"/><path fill="#181c32" d="M62.604 31.869c0-9.752-7.912-17.663-17.663-17.663H27.058c-9.751 0-17.662 7.911-17.662 17.663s7.91 17.663 17.635 17.663h.082a6 6 0 0 1-1.318 1.703c-1.319 1.208-3.132 1.895-5 1.923v8.652c3.983 0 7.829-1.346 10.823-3.735v4.78h8.708v-4.808c2.994 2.39 6.84 3.736 10.823 3.736V53.13c-1.868 0-3.681-.687-5-1.923a6 6 0 0 1-1.318-1.703h.082c9.752.028 17.69-7.883 17.69-17.635M27.03 40.824a8.957 8.957 0 0 1-8.955-8.955 8.957 8.957 0 0 1 8.955-8.955h17.882a8.957 8.957 0 0 1 8.955 8.955 8.957 8.957 0 0 1-8.955 8.955z"/><path fill="#0598ff" d="M51.176 53.158v8.625h9.092V53.13h-9.092z"/><path fill="#ff8f28" d="M31.62 66.975v5.027h8.734v-9.175H31.62z"/></g><defs><clipPath id="clip0_16897_17220"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/intellimize.svg b/web/packages/design/src/ResourceIcon/assets/intellimize.svg
index 77a9bd01b9dda..22ae7be5545b2 100644
--- a/web/packages/design/src/ResourceIcon/assets/intellimize.svg
+++ b/web/packages/design/src/ResourceIcon/assets/intellimize.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17268)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.7041 0.00146484H63V72.0015H43V17.4196C50.2279 12.3208 56.8346 6.47831 62.7041 0.00146484Z" fill="#079815"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29 27.0015V72.0015H9V36.7544C15.8448 33.8442 22.5219 30.5903 29 27.0015Z" fill="#079815"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17268">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#079815" fill-rule="evenodd" clip-path="url(#clip0_16904_17268)" clip-rule="evenodd"><path d="M62.704.001H63v72H43V17.42A119.7 119.7 0 0 0 62.704 0M29 27.002v45H9V36.753a214 214 0 0 0 20-9.752"/></g><defs><clipPath id="clip0_16904_17268"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/intune.svg b/web/packages/design/src/ResourceIcon/assets/intune.svg
new file mode 100644
index 0000000000000..bacb7b8ae1665
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/intune.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_22352_5880)" d="M0 11.726c0-9.196 12.024-14.23 19.968-8.36l17.268 12.752L51.809 7.86C59.512 3.66 71.854 6.672 72 18.153v42.312c0 9.195-11.671 13.99-19.615 8.12L34.802 55.553l-14.59 8.26c-7.775 4.24-20.2.987-20.2-10.187 0-13.411-.012-8.261-.012-41.9"/><path fill="url(#paint1_radial_22352_5880)" d="M0 11.726c0-9.196 12.024-14.23 19.968-8.36l17.268 12.752L51.809 7.86C59.512 3.66 71.854 6.672 72 18.153v42.312c0 9.195-11.671 13.99-19.615 8.12L34.802 55.553l-14.59 8.26c-7.775 4.24-20.2.987-20.2-10.187 0-13.411-.012-8.261-.012-41.9"/><path fill="url(#paint2_radial_22352_5880)" d="M0 11.726c0-9.196 12.024-14.23 19.968-8.36l17.268 12.752L51.809 7.86C59.512 3.66 71.854 6.672 72 18.153v42.312c0 9.195-11.671 13.99-19.615 8.12L34.802 55.553l-14.59 8.26c-7.775 4.24-20.2.987-20.2-10.187 0-13.411-.012-8.261-.012-41.9"/><path fill="url(#paint3_radial_22352_5880)" d="M19.968 3.366C12.024-2.504 0 2.53 0 11.726v41.38c0-1.006.513-3.009.513-3.009 2.369-7.744 12.44-10.648 19.409-5.544l32.463 24.031C60.33 74.454 72 69.66 72 60.464v-42.31c0 7.855-10.268 15.74-19.967 8.908z"/><path fill="url(#paint4_radial_22352_5880)" fill-opacity=".25" d="M19.968 3.366C12.024-2.504 0 2.53 0 11.726v41.38c0-1.006.513-3.009.513-3.009 2.369-7.744 12.44-10.648 19.409-5.544l32.463 24.031C60.33 74.454 72 69.66 72 60.464v-42.31c0 7.855-10.268 15.74-19.967 8.908z"/><path fill="url(#paint5_radial_22352_5880)" fill-opacity=".55" d="M19.968 3.366C12.024-2.504 0 2.53 0 11.726v41.38c0-1.006.513-3.009.513-3.009 2.369-7.744 12.44-10.648 19.409-5.544l32.463 24.031C60.33 74.454 72 69.66 72 60.464v-42.31c0 7.855-10.268 15.74-19.967 8.908z"/><path fill="url(#paint6_linear_22352_5880)" d="M19.968 26.817C12.024 20.947 0 25.98 0 35.177V11.726c0-9.196 12.024-14.23 19.968-8.36l32.065 23.696C61.733 33.895 72 26.009 72 18.153v24c0 9.196-12.024 14.23-19.967 8.36z"/><path fill="url(#paint7_radial_22352_5880)" fill-opacity=".35" d="M19.968 26.817C12.024 20.947 0 25.98 0 35.177V11.726c0-9.196 12.024-14.23 19.968-8.36l32.065 23.696C61.733 33.895 72 26.009 72 18.153v24c0 9.196-12.024 14.23-19.967 8.36z"/><defs><radialGradient id="paint1_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(110.224 35.318 18.018)scale(52.6046 39.4051)" gradientUnits="userSpaceOnUse"><stop offset=".423" stop-color="#004aff" stop-opacity=".1"/><stop offset=".729" stop-color="#014db9"/><stop offset=".836" stop-color="#014db9" stop-opacity=".9"/><stop offset=".955" stop-color="#014db9" stop-opacity="0"/></radialGradient><radialGradient id="paint2_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(-73.643 50.892 28.085)scale(41.8802 51.0154)" gradientUnits="userSpaceOnUse"><stop offset=".091" stop-color="#004aff" stop-opacity=".1"/><stop offset=".56" stop-color="#014db9"/><stop offset=".749" stop-color="#014db9" stop-opacity=".99"/><stop offset="1" stop-color="#014db9" stop-opacity="0"/></radialGradient><radialGradient id="paint3_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(134.068 39.31 17.156)scale(101.512 78.1873)" gradientUnits="userSpaceOnUse"><stop offset=".249" stop-color="#23c0fe"/><stop offset=".717" stop-color="#23c0fe"/><stop offset=".995" stop-color="#1c91ff"/></radialGradient><radialGradient id="paint4_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(45.91 3 28.622)scale(72.6223 17.2762)" gradientUnits="userSpaceOnUse"><stop offset=".165" stop-color="#096dd6" stop-opacity="0"/><stop offset=".484" stop-color="#096dd6"/><stop offset=".901" stop-color="#0876de" stop-opacity=".814"/><stop offset="1" stop-color="#029aff" stop-opacity="0"/></radialGradient><radialGradient id="paint5_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(91.61 13.28 55.686)scale(11.6638 10.504)" gradientUnits="userSpaceOnUse"><stop stop-color="#0068b3"/><stop offset=".93" stop-color="#006cb8" stop-opacity="0"/></radialGradient><radialGradient id="paint7_radial_22352_5880" cx="0" cy="0" r="1" gradientTransform="rotate(69.461 5.43 9.133)scale(17.9395 14.4898)" gradientUnits="userSpaceOnUse"><stop stop-color="#ccf9ff" stop-opacity=".93"/><stop offset="1" stop-color="#35ddff"/></radialGradient><linearGradient id="paint0_linear_22352_5880" x1="30.747" x2="56.443" y1="71.157" y2="16.174" gradientUnits="userSpaceOnUse"><stop offset=".02" stop-color="#1169da"/><stop offset=".435" stop-color="#0151bd"/><stop offset=".614" stop-color="#014db7"/><stop offset="1" stop-color="#126ad9"/></linearGradient><linearGradient id="paint6_linear_22352_5880" x1="20.526" x2="32.649" y1="17.427" y2="68.938" gradientUnits="userSpaceOnUse"><stop stop-color="#92eefe"/><stop offset=".565" stop-color="#35ddff"/><stop offset="1" stop-color="#08b1f9"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ipstack.svg b/web/packages/design/src/ResourceIcon/assets/ipstack.svg
index 07989dece9678..0086c3172601d 100644
--- a/web/packages/design/src/ResourceIcon/assets/ipstack.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ipstack.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17285)">
-<path d="M16.0238 17.546L2.60295 22.5344C6.24772 13.5151 13.3674 6.33368 22.3712 2.62713L21.182 11.0132C18.2322 11.4302 16.0238 13.9476 16.0238 16.9283C16.0083 17.129 15.9774 17.3452 16.0238 17.546ZM24.5025 41.2834L0.224572 39.9089C1.08943 47.5537 4.36356 54.7197 9.58362 60.3876C10.5411 58.21 12.6879 56.82 15.0508 56.82C15.6531 56.82 16.24 56.9127 16.8114 57.0826L25.599 43.044C25.1203 42.5344 24.7496 41.932 24.5025 41.2834ZM26.3558 34.2718L22.2477 22.936H22.0778C20.4716 22.936 18.9272 22.2719 17.7998 21.129L1.07399 27.3529C0.394455 30.1483 0.0546875 33.0054 0.0546875 35.878L24.3635 37.2525C24.6878 36.0788 25.3828 35.044 26.3403 34.2873L26.3558 34.2718ZM29.9697 44.9591C29.7071 44.9591 29.4446 44.9127 29.182 44.9127L19.962 59.6463C20.6261 60.6347 20.9813 61.8084 20.9813 62.9976C20.9813 64.7737 20.1627 66.4571 18.7728 67.5845C24.0392 70.4725 29.9388 71.986 35.9465 72.0015C36.7341 72.0015 37.5835 71.9551 38.3712 71.9088L29.9851 44.9436L29.9697 44.9591ZM47.9773 6.96689C47.9619 5.37616 48.5951 3.84721 49.738 2.73524C45.3828 0.91285 40.6878 -0.0137892 35.9619 0.00165475C32.7959 0.00165475 29.6299 0.418641 26.5565 1.23717L25.0585 11.8781C25.8461 12.3568 26.5102 13.0055 27.0044 13.7777L47.9619 7.24488V6.98233L47.9773 6.96689ZM63.9927 43.9398C63.9927 46.8896 61.8306 49.4069 58.9117 49.8548L54.4947 66.7968C64.626 60.7119 71.1124 50.0401 71.8846 38.2409L63.9464 43.1367C63.9464 43.4456 63.9927 43.6618 63.9927 43.9243V43.9398ZM59.6684 8.8665C59.1897 10.3028 58.1858 11.5074 56.8422 12.2178L59.6684 38.1637C60.6105 38.4263 61.4754 38.905 62.1858 39.5691L71.9464 33.5151C71.2514 24.0016 66.8499 15.1368 59.6839 8.85105L59.6684 8.8665ZM55.653 38.3799L52.8731 12.8356C51.5758 12.5885 50.402 11.909 49.5217 10.936L27.9002 17.685C27.7303 19.1367 27.0199 20.4804 25.9079 21.4379L30.0932 32.9591C33.1202 33.0054 35.6222 35.2911 35.9619 38.3027L52.5951 41.2525C53.2283 39.9707 54.3094 38.9514 55.6376 38.3799H55.653ZM52.1627 45.2679L35.0353 42.2255C34.6801 42.7506 34.2476 43.2293 33.7534 43.6309L42.4484 71.3374C44.9503 70.8895 47.3905 70.1636 49.738 69.1752L54.9889 49.0517C53.5526 48.2486 52.5179 46.8741 52.1627 45.2525V45.2679ZM12.0083 62.7814C13.2284 63.8779 14.5257 64.8818 15.8848 65.7775C17.1357 65.376 17.9851 64.2177 18.0006 62.905C18.0006 61.2679 16.6878 59.9243 15.0508 59.9088C15.0353 59.9088 15.0199 59.9088 15.0045 59.9088C13.4137 59.9397 12.1164 61.1907 12.0083 62.7814ZM32.9658 38.9514C32.9658 37.2989 31.6222 35.9552 29.9697 35.9552C28.3172 35.9552 26.9735 37.2989 26.9735 38.9514C26.9735 40.6039 28.3172 41.9475 29.9697 41.9475C31.6067 41.9475 32.9504 40.6348 32.9658 38.9977C32.9658 38.9822 32.9658 38.9668 32.9658 38.9514ZM21.9851 13.9785C20.3326 13.9785 18.989 15.3221 18.989 16.9746C18.989 18.6271 20.3326 19.9707 21.9851 19.9707C23.6376 19.9707 24.9813 18.6271 24.9813 16.9746C24.9813 15.3375 23.6685 13.9939 22.0315 13.9785C22.016 13.9785 22.0006 13.9785 21.9851 13.9785ZM58.0005 46.9359C59.653 46.9359 60.9966 45.5923 60.9966 43.9398C60.9966 42.2873 59.653 40.9436 58.0005 40.9436C56.348 40.9436 55.0043 42.2873 55.0043 43.9398C55.0043 45.5768 56.3171 46.9205 57.9542 46.9359C57.9696 46.9359 57.985 46.9359 58.0005 46.9359ZM56.9812 6.6889C55.6839 5.76226 54.3248 4.91284 52.9194 4.17153C51.375 4.78929 50.6337 6.51901 51.236 8.06341C51.8538 9.60781 53.5835 10.3491 55.1279 9.7468C56.2708 9.29893 57.0121 8.18696 57.0121 6.95144C56.9812 6.87422 56.9657 6.78156 56.9657 6.6889H56.9812Z" fill="#E97C2A"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17285">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17285)"><path fill="#e97c2a" d="M16.024 17.546 2.603 22.534A36.18 36.18 0 0 1 22.37 2.627l-1.189 8.386c-2.95.417-5.158 2.935-5.158 5.915-.016.201-.047.417 0 .618m8.479 23.737L.225 39.91a36.23 36.23 0 0 0 9.359 20.479 5.97 5.97 0 0 1 5.467-3.568c.602 0 1.189.093 1.76.263l8.789-14.04a5.4 5.4 0 0 1-1.096-1.76m1.853-7.011-4.108-11.336h-.17a6.03 6.03 0 0 1-4.278-1.807L1.074 27.353a36 36 0 0 0-1.02 8.525l24.31 1.374a5.73 5.73 0 0 1 1.976-2.965zm3.614 10.687c-.263 0-.525-.046-.788-.046l-9.22 14.733a6.03 6.03 0 0 1 1.02 3.352 5.92 5.92 0 0 1-2.21 4.587A35.9 35.9 0 0 0 35.948 72c.787 0 1.636-.046 2.424-.092l-8.386-26.965zM47.977 6.967a5.82 5.82 0 0 1 1.761-4.232A35.4 35.4 0 0 0 35.962.002c-3.166 0-6.332.417-9.406 1.235l-1.498 10.641a6 6 0 0 1 1.946 1.9l20.958-6.533v-.263zM63.993 43.94a5.99 5.99 0 0 1-5.081 5.915l-4.417 16.942c10.131-6.085 16.617-16.757 17.39-28.556l-7.939 4.896c0 .309.047.525.047.787zM59.668 8.867a5.9 5.9 0 0 1-2.826 3.35l2.826 25.947a6.1 6.1 0 0 1 2.518 1.405l9.76-6.054A36.33 36.33 0 0 0 59.684 8.851zM55.653 38.38l-2.78-25.544a6.07 6.07 0 0 1-3.351-1.9L27.9 17.685a5.86 5.86 0 0 1-1.992 3.753l4.185 11.521a6 6 0 0 1 5.869 5.344l16.633 2.95a6.06 6.06 0 0 1 3.043-2.873zm-3.49 6.888-17.128-3.043a6.5 6.5 0 0 1-1.282 1.406l8.695 27.706a34.4 34.4 0 0 0 7.29-2.162l5.25-20.123a5.77 5.77 0 0 1-2.825-3.8zM12.008 62.78a33 33 0 0 0 3.877 2.997A3.05 3.05 0 0 0 18 62.905a2.99 2.99 0 0 0-2.95-2.996h-.046a3.07 3.07 0 0 0-2.997 2.872m20.958-23.83a3 3 0 0 0-2.996-2.996 3 3 0 0 0-2.996 2.996 3 3 0 0 0 2.996 2.996 2.99 2.99 0 0 0 2.996-2.95zM21.986 13.98a3 3 0 0 0-2.997 2.996 3 3 0 0 0 2.996 2.996 3 3 0 0 0 2.996-2.996 2.99 2.99 0 0 0-2.95-2.997zM58 46.936a3 3 0 0 0 2.996-2.996A3 3 0 0 0 58 40.944a3 3 0 0 0-2.997 2.996 2.99 2.99 0 0 0 2.95 2.996zM56.98 6.689a35.5 35.5 0 0 0-4.062-2.517 3 3 0 0 0-1.683 3.891 3 3 0 0 0 3.892 1.684 2.99 2.99 0 0 0 1.884-2.796.7.7 0 0 1-.046-.262z"/></g><defs><clipPath id="clip0_16904_17285"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/jamf.svg b/web/packages/design/src/ResourceIcon/assets/jamf.svg
index e3ac9f28689d9..b4cffcf32c0b2 100644
--- a/web/packages/design/src/ResourceIcon/assets/jamf.svg
+++ b/web/packages/design/src/ResourceIcon/assets/jamf.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7335_35918)">
-<path d="M1.21112 1.69061C1.94567 0.956061 2.93325 0.530117 3.97162 0.5V0.619731H34.7424C37.2567 0.619731 39.1724 2.89461 38.6935 5.40896L34.9819 23.1291C32.4675 34.1443 23.9666 35.5811 17.7406 35.5811H4.21108C2.05593 35.5811 0.259969 33.6654 0.259969 31.63L0.0205078 4.45111C0.0506244 3.41274 0.476569 2.42516 1.21112 1.69061Z" fill="#788EB1"/>
-<path d="M39.5324 25.1642C41.8073 16.9028 47.3149 12.9517 56.5341 12.9517C56.5341 12.9517 68.2677 12.4728 68.2677 12.353C70.1834 12.353 71.7399 14.0293 71.7399 15.8252L71.9794 67.4291C71.9794 69.5843 70.3032 71.1408 68.2677 71.1408L3.73293 71.5C1.81724 71.5 0.260742 69.8237 0.260742 68.0278V57.8507C0.260742 55.6955 1.93697 54.139 3.97239 54.139H19.8966C26.8409 54.139 30.7921 51.3852 33.0669 44.9198L39.5324 25.1642Z" fill="#788EB1"/>
-</g>
-<defs>
-<clipPath id="clip0_7335_35918">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#788eb1" clip-path="url(#clip0_7335_35918)"><path d="M1.211 1.69A4.07 4.07 0 0 1 3.971.5v.12h30.771a4.02 4.02 0 0 1 3.952 4.789l-3.712 17.72C32.468 34.144 23.967 35.581 17.74 35.581H4.21c-2.154 0-3.95-1.916-3.95-3.951L.02 4.451a4.07 4.07 0 0 1 1.191-2.76"/><path d="M39.532 25.164c2.275-8.261 7.783-12.212 17.002-12.212 0 0 11.734-.48 11.734-.599 1.915 0 3.472 1.676 3.472 3.472l.24 51.604c0 2.155-1.677 3.712-3.712 3.712L3.733 71.5C1.817 71.5.26 69.824.26 68.028V57.85c0-2.155 1.676-3.712 3.711-3.712h15.925c6.944 0 10.895-2.754 13.17-9.22z"/></g><defs><clipPath id="clip0_7335_35918"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/jenkins.svg b/web/packages/design/src/ResourceIcon/assets/jenkins.svg
index 09cfb625f8d8f..da82bfe019d18 100644
--- a/web/packages/design/src/ResourceIcon/assets/jenkins.svg
+++ b/web/packages/design/src/ResourceIcon/assets/jenkins.svg
@@ -1,67 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29904)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M61.128 34.6949C61.128 48.9598 49.8223 60.5239 35.8759 60.5239C21.9298 60.5239 10.624 48.9598 10.624 34.6949C10.624 20.4296 21.9298 8.86531 35.8759 8.86531C49.8223 8.86531 61.128 20.4296 61.128 34.6949Z" fill="#D33833"/>
-<path d="M11.6536 41.0918C11.6536 41.0918 9.8255 14.1563 34.6448 13.3866L32.9134 10.5007L19.4457 15.0221L15.5976 19.4471L12.2308 25.8926L10.3066 33.3961L10.8838 38.3983" fill="#EF3D3A"/>
-<path d="M18.5809 17.0746C14.1504 21.6079 11.4087 27.867 11.4087 34.7912C11.4087 41.714 14.1504 47.9739 18.5809 52.5063C23.0136 57.0387 29.1224 59.8355 35.876 59.8355C42.6298 59.8355 48.739 57.0387 53.1713 52.5063C57.6015 47.9739 60.3437 41.714 60.3437 34.7912C60.3437 27.867 57.6015 21.6079 53.1713 17.0746C48.739 12.5431 42.6298 9.74634 35.876 9.74576C29.1224 9.74634 23.0136 12.5431 18.5809 17.0746ZM17.4594 53.6028C12.7508 48.7873 9.83984 42.1322 9.83984 34.7912C9.83984 27.4491 12.7508 20.7946 17.4594 15.9788C22.1669 11.1622 28.6833 8.17667 35.876 8.17754C43.0687 8.17667 49.5858 11.1622 54.2925 15.9788C59.0015 20.7946 61.9128 27.4496 61.9123 34.7912C61.9128 42.1322 59.0015 48.7873 54.2925 53.6028C49.5858 58.4192 43.0687 61.4043 35.876 61.4043C28.6833 61.4043 22.1669 58.4192 17.4594 53.6028Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M46.5063 34.8379L42.6582 35.4151L37.4634 35.9923L34.0963 36.0884L30.8257 35.9923L28.3244 35.2226L26.1118 32.8177L24.3802 27.9116L23.9955 26.8533L21.6867 26.0839L20.3399 23.8713L19.3779 20.6967L20.4363 17.9069L22.9372 17.0411L24.9574 18.0033L25.9196 20.1195L27.074 19.927L27.4586 19.4462L27.074 17.2336L26.9776 14.4437L27.5548 10.5959L27.5322 8.39795L29.2863 5.59367L32.3647 3.38101L37.752 1.07224L43.7162 1.93803L48.9109 5.68977L51.316 9.53761L52.8551 12.3275L53.2398 19.2537L52.0854 25.2181L49.9692 30.509L47.949 33.2988" fill="#F0D6B7"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M43.2354 51.4804L29.4789 52.0576V54.3664L30.6332 62.447L30.056 63.1206L20.4364 59.8497L19.7628 58.6953L18.8008 47.8251L16.5886 41.2835L16.1074 39.7444L23.8031 34.4536L26.2083 33.4914L28.3245 36.0887L30.1522 37.7242L32.2688 38.3975L33.2306 38.6861L34.385 43.6883L35.2508 44.7465L37.4635 43.9769L35.9241 46.9593L44.2934 50.9032L43.2354 51.4804Z" fill="#335061"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M20.4358 17.907L22.9367 17.0412L24.9569 18.0034L25.9191 20.1196L27.0735 19.9271L27.3621 18.7728L26.7849 16.5604L27.3621 11.2693L26.8809 8.38333L28.6125 6.36316L32.3642 3.3811L31.306 1.93812L26.0151 4.53548L23.8025 6.26705L22.552 8.96052L20.628 11.5579L20.0508 14.6363L20.4358 17.907Z" fill="#6D6B6D"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.3803 8.86463C24.3803 8.86463 25.8233 5.30539 31.5952 3.57382C37.3671 1.84225 31.8838 2.32305 31.8838 2.32305L25.6311 4.7282L23.226 7.13306L22.168 9.05713L24.3803 8.86463Z" fill="#DCD9D8"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M21.4938 17.2339C21.4938 17.2339 19.4736 10.4999 27.1695 9.53796L26.8809 8.38358L21.5901 9.63435L20.0508 14.6366L20.4358 17.9072L21.4938 17.2339Z" fill="#DCD9D8"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.5723 26.1805L25.8318 24.96C25.8318 24.96 26.4003 25.0261 26.4964 25.6994C26.5924 26.373 26.881 32.4335 31.0175 35.7044C31.3948 36.0028 27.9394 35.223 27.9394 35.223L24.8609 30.4133" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M42.2733 24.3525C42.2733 24.3525 42.4976 21.4366 43.2828 21.6608C44.0681 21.8851 44.0681 22.6703 44.0681 22.6703C44.0681 22.6703 42.1611 23.9041 42.2733 24.3525Z" fill="#F7E4CD"/>
-<path d="M50.2572 13.6746C50.2572 13.6746 48.6717 14.0093 48.5257 15.4061C48.3796 16.8032 50.2572 15.6947 50.5458 15.5986" fill="#F7E4CD"/>
-<path d="M38.6175 13.7708C38.6175 13.7708 36.501 14.0594 36.501 15.406C36.501 16.7528 38.9062 16.6567 39.5795 16.0795" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M25.5349 20.0235C25.5349 20.0235 21.8792 17.8108 21.4946 19.9274C21.1098 22.0437 20.2438 23.583 22.0718 25.7954L20.8212 25.4107L19.6669 22.4287L19.2822 19.5427L21.4946 17.2337L23.9958 17.4261L25.4388 18.5805L25.5349 20.0235Z" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M27.2657 13.9634C27.2657 13.9634 28.9011 5.49801 37.1744 3.86254C43.9856 2.51625 47.5636 4.15114 48.9104 5.69022C48.9104 5.69022 42.8499 -1.52438 37.078 0.687994C31.3061 2.90065 27.0735 6.94099 27.1696 9.53806C27.3334 13.9616 27.2657 13.9634 27.2657 13.9634Z" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.5842 6.65211C49.5842 6.65211 46.7946 6.55601 46.6982 9.05726C46.6982 9.05726 46.698 9.44196 46.8904 9.82666C46.8904 9.82666 49.1034 7.3254 50.45 8.67228" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M37.3692 10.087C37.3692 10.087 36.8889 6.2478 33.6157 8.4798C31.4994 9.92278 31.6919 11.9429 32.0766 12.3276C32.4613 12.7126 32.3567 13.4875 32.6496 12.9556C32.9424 12.4237 32.846 10.6922 33.9043 10.2114C34.9625 9.73028 36.6972 9.19292 37.3692 10.087Z" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M28.3245 36.0885L19.282 40.1288C19.282 40.1288 23.0337 55.0397 21.1096 59.6572L19.7628 59.1764L19.6666 53.5006L17.1658 42.7265L16.1074 39.7442L25.5347 33.3953L28.3245 36.0885Z" fill="#49728B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.2543 44.3357L30.5372 45.9009V51.6729H28.9979C28.9979 51.6729 28.8057 47.6325 28.8057 47.1514C28.8057 46.6703 28.9979 44.9388 28.9979 44.9388" fill="#49728B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.286 52.5391L24.957 52.7313L26.2078 53.5971L29.286 54.0781" fill="#49728B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.1006 51.5765L47.6598 51.4803L48.5256 60.3307L44.87 60.8115L44.1006 51.5765Z" fill="#335061"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M45.0625 51.5767L50.4497 51.2881C50.4497 51.2881 52.6621 45.7086 52.6621 45.42C52.6621 45.1314 54.5861 37.3394 54.5861 37.3394L50.2572 32.8183L49.3914 32.0486L47.0827 34.3573V43.3038L45.0625 51.5767Z" fill="#335061"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M47.4673 50.9033L44.1006 51.5767L44.5814 54.2704C45.8319 54.8476 47.9484 53.3082 47.9484 53.3082" fill="#49728B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M47.5645 34.0686L54.2982 39.0708L54.4907 36.762L49.3921 32.0484L47.5645 34.0686Z" fill="#49728B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M32.6246 70.5288L30.6329 62.447L29.6423 56.4838L29.4785 52.0575L38.4927 51.5777L44.1009 51.5767L43.5909 61.6785L44.4567 69.4706L44.3606 70.9135L37.0498 71.4907L32.6246 70.5288Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M42.8501 51.4805C42.8501 51.4805 42.3693 61.4853 43.8123 68.6038C43.8123 68.6038 40.9263 70.4318 36.6934 70.9126L44.7741 70.624L45.736 70.0468L44.5817 54.2705L44.2931 50.9031" fill="#DCD9D8"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.6899 59.562L52.4416 58.5038L59.5601 58.119L60.6184 54.8484L58.6943 49.1726L56.4819 48.884L53.4035 49.8459L50.45 51.288L48.8821 51.0003L47.6602 51.4804" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.6221 57.6371C48.6221 57.6371 51.123 56.4829 51.508 56.5791L50.45 51.288L51.7005 50.8072C51.7005 50.8072 52.5663 55.8093 52.5663 56.3865C52.5663 56.3865 57.9532 56.6751 58.4343 56.6751C58.4343 56.6751 59.5887 54.4625 59.3001 52.1537L60.3584 55.2321L60.4545 56.9637L58.9154 59.2725L57.1838 59.6572L54.2979 59.5611L53.336 58.3106L49.9689 58.7914L48.9107 59.1764" fill="#DCD9D8"/>
-<path d="M44.8416 50.8081L42.7254 45.4209L40.5127 42.2463C40.5127 42.2463 40.9935 40.8994 41.6671 40.8994C42.3407 40.8994 43.8797 40.8994 43.8797 40.8994L45.996 41.6691L45.8038 45.2284L44.8416 50.8081Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M45.2557 48.9792C45.2557 48.9792 42.562 43.7847 42.562 43.0151C42.562 43.0151 43.0428 41.8607 43.7164 42.1493C44.3899 42.4379 45.8329 43.2073 45.8329 43.2073V41.3796L42.562 40.7061L40.3496 40.9947L44.1013 49.845L44.8707 49.9414" fill="#DCD9D8"/>
-<path d="M33.4905 36.2823L30.8255 35.9926L28.3242 35.2229V36.0887L29.5464 37.4364L33.3943 39.168" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.19 36.5706C29.19 36.5706 32.1723 37.8214 33.1343 37.5328L33.23 38.686L30.5369 38.11L28.9014 36.9556L29.19 36.5706Z" fill="#DCD9D8"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.6798 41.2271C47.0475 41.1791 45.5728 40.9852 44.2816 40.621C44.3693 40.0917 44.2051 39.5722 44.337 39.191C44.6969 38.9319 45.3001 38.9359 45.8441 38.875C45.3736 38.6438 44.7128 38.5523 44.1699 38.686C44.1572 38.3186 43.9924 38.0909 43.8926 37.8034C44.8103 37.4759 46.9768 35.3284 48.1955 36.0395C48.7762 36.3778 49.0229 38.3096 49.068 39.249C49.1055 40.0282 48.9973 40.8144 48.6798 41.2271Z" fill="#D33833"/>
-<path d="M48.6798 41.2271C47.0475 41.1791 45.5728 40.9852 44.2816 40.621C44.3693 40.0917 44.2051 39.5722 44.337 39.191C44.6969 38.9319 45.3001 38.9359 45.8441 38.875C45.3736 38.6438 44.7128 38.5523 44.1699 38.686C44.1572 38.3186 43.9924 38.0909 43.8926 37.8034C44.8103 37.4759 46.9768 35.3284 48.1955 36.0395C48.7762 36.3778 49.0229 38.3096 49.068 39.249C49.1055 40.0282 48.9973 40.8144 48.6798 41.2271Z" stroke="#D33833" stroke-width="2.5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M40.8737 38.5585C40.8694 38.682 40.8642 38.8064 40.8593 38.9311C40.3496 39.2659 39.5269 39.2618 38.9676 39.5432C39.7921 39.5793 40.4411 39.7778 41.0027 40.0578C40.9903 40.3689 40.9785 40.6797 40.9664 40.9908C40.0322 41.6303 39.1788 42.5827 38.0789 43.1824C37.5589 43.466 35.7337 44.1959 35.1804 44.0669C34.8674 43.9942 34.8392 43.6057 34.7141 43.2396C34.4475 42.4554 33.8336 41.2072 33.7801 40.0269C33.7119 38.536 33.5614 36.0373 35.1681 36.3444C36.4643 36.5917 37.9718 37.1888 38.9754 37.7372C39.5886 38.0725 39.9433 38.4869 40.8737 38.5585Z" fill="#D33833"/>
-<path d="M40.8737 38.5585C40.8694 38.682 40.8642 38.8064 40.8593 38.9311C40.3496 39.2659 39.5269 39.2618 38.9676 39.5432C39.7921 39.5793 40.4411 39.7778 41.0027 40.0578C40.9903 40.3689 40.9785 40.6797 40.9664 40.9908C40.0322 41.6303 39.1788 42.5827 38.0789 43.1824C37.5589 43.466 35.7337 44.1959 35.1804 44.0669C34.8674 43.9942 34.8392 43.6057 34.7141 43.2396C34.4475 42.4554 33.8336 41.2072 33.7801 40.0269C33.7119 38.536 33.5614 36.0373 35.1681 36.3444C36.4643 36.5917 37.9718 37.1888 38.9754 37.7372C39.5886 38.0725 39.9433 38.4869 40.8737 38.5585Z" stroke="#D33833" stroke-width="2.5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.8016 40.3377C41.6591 39.5256 41.4943 39.2939 41.5581 38.5854C43.724 37.1412 44.1306 41.0658 41.8016 40.3377Z" fill="#D33833"/>
-<path d="M41.8016 40.3377C41.6591 39.5256 41.4943 39.2939 41.5581 38.5854C43.724 37.1412 44.1306 41.0658 41.8016 40.3377Z" stroke="#D33833" stroke-width="2.5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.9377 40.9961C44.9377 40.9961 44.2641 40.0339 44.7452 39.7453C45.2263 39.4567 45.7074 39.7456 45.996 39.2645C46.2846 38.7834 45.996 38.4948 46.0921 37.9176C46.1882 37.3405 46.6696 37.2441 47.1504 37.148C47.6312 37.0519 48.9783 36.8594 49.1705 37.3405L48.5933 35.6089L47.4389 35.2242L43.7833 37.3405L43.5908 38.3987V40.515" fill="#EF3D3A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M34.8368 44.1704C34.7213 42.6691 34.599 41.1699 34.4629 39.67C34.2593 37.4305 35.0008 37.8213 36.9421 37.8213C37.2386 37.8213 38.7677 38.1748 38.8771 38.3985C39.4018 39.47 37.9998 39.2319 39.4814 40.04C40.7322 40.722 42.9417 39.6259 42.4364 38.1099C42.1535 37.7728 40.9628 38.0048 40.536 37.7835C39.7845 37.3939 39.0329 37.0043 38.2814 36.6147C37.3252 36.1186 35.1153 35.3954 34.0958 36.0886C31.5128 37.8452 34.2589 42.2345 35.1803 44.067" fill="#EF3D3A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M37.3684 10.0869C34.7465 9.47626 33.4436 11.1842 32.6489 12.9556C31.9392 12.7836 32.2216 11.8185 32.4009 11.3267C32.8702 10.0361 34.7615 8.31813 36.3068 8.55102C36.9718 8.65116 37.8718 9.25924 37.3684 10.0869Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.1441 13.073C50.1853 13.0748 50.2272 13.0762 50.2685 13.0779C50.8609 14.3088 51.3738 15.6127 52.1212 16.6992C51.6205 17.8655 48.3297 18.8975 48.3805 16.8034C49.0921 16.4923 50.3207 16.7399 50.9516 16.3425C50.5868 15.3414 50.0604 14.4892 50.1441 13.073Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M38.7114 13.1051C39.2735 14.1356 39.4565 15.2184 40.2556 15.9974C40.6155 16.348 41.3154 16.7754 40.9685 17.7506C40.8874 17.9806 40.2949 18.4934 39.9529 18.5941C38.7036 18.963 35.7925 18.6703 36.7783 17.1128C37.8115 17.161 39.2002 17.7838 39.9725 17.0337C39.3795 16.0857 38.3222 14.2101 38.7114 13.1051Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.6744 23.5791C47.7933 24.7875 45.6958 26.1015 42.6136 25.7967C41.955 25.2241 41.7039 23.95 42.3438 23.1085C42.6768 23.681 42.4676 24.7341 43.3957 24.8925C45.1446 25.1918 47.18 23.8227 48.438 23.3442C49.2181 22.0291 48.3708 21.5454 47.6681 20.699C46.2294 18.9648 44.2996 16.8153 44.3697 14.2191C44.9512 13.7975 45.0014 14.8627 45.0848 15.0566C45.8361 16.8148 47.7266 19.0632 49.1064 20.5679C49.4452 20.9385 50.0031 21.2941 50.0651 21.5391C50.2441 22.2516 49.5996 23.1053 49.6744 23.5791Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.8763 22.3072C24.2867 21.9707 24.1464 20.4885 23.4542 20.4463C22.465 20.3863 22.6454 22.3692 22.6493 23.5288C21.9684 22.9106 21.8487 21.0073 22.3489 20.0299C21.7788 19.7499 21.5242 20.3387 21.208 20.5462C21.6144 17.5938 25.5268 19.1768 24.8763 22.3072Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.8721 24.8088C49.9965 26.4754 48.7579 28.3109 46.1885 28.3643C46.1363 27.826 46.0962 27.007 46.1914 26.6829C48.1556 26.4942 49.3682 25.4945 50.8721 24.8088Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M38.5625 25.8891C40.2013 26.7508 43.213 26.8435 45.4404 26.7782C45.5599 27.2663 45.557 27.8691 45.5616 28.4642C42.6985 28.6071 39.3133 27.8986 38.5625 25.8891Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M38.2515 27.4958C39.3847 30.341 43.2796 30.0135 46.5641 29.935C46.4195 30.3044 46.1061 30.7407 45.7165 30.8986C44.664 31.3269 41.761 31.6518 40.2999 30.8758C39.3732 30.3832 38.7778 29.2701 38.2701 28.6175C38.0249 28.3024 36.804 27.4975 38.2515 27.4958Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.5374 43.1904C48.2076 45.4681 46.9352 47.8074 45.3574 49.8164C46.0189 47.8715 46.302 44.6164 46.4018 42.1348C47.7857 41.4872 48.9706 42.2805 49.5374 43.1904Z" fill="#81B0C4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M56.6936 51.3767C55.2047 51.6748 54.1586 53.1218 52.7061 53.0289C53.5043 51.9036 54.9031 51.4292 56.6936 51.3767Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.3502 53.7066C56.1367 53.8348 54.7113 54.0313 53.4805 53.93C54.0631 53.04 56.3081 53.3471 57.3502 53.7066Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.7715 55.7159C56.4076 55.7455 54.7124 55.7183 53.416 55.6095C54.1828 54.7859 56.887 55.3039 57.7715 55.7159Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M46.9716 61.213C47.1673 62.9259 47.8464 64.6614 47.7612 66.5373C47.0071 66.7916 46.574 67.014 45.5636 67.0127C45.4923 65.4184 45.279 62.9813 45.3428 61.4615C45.8398 61.4944 46.5725 61.1065 46.9716 61.213Z" fill="#DCD9D8"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.7724 35.969C44.0875 36.416 43.5043 36.9742 42.8466 37.4515C41.388 37.5237 40.5921 37.3505 39.5205 36.513C39.5381 36.4458 39.6458 36.4758 39.6498 36.3932C41.2111 37.089 43.1958 36.1098 44.7724 35.969Z" fill="#F0D6B7"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M36.5762 46.6119C37.0051 44.7531 38.686 43.7904 40.2123 42.7667C41.7878 44.7662 42.7459 47.3375 43.801 49.8188C41.3081 49.0674 38.761 47.8481 36.5762 46.6119Z" fill="#81B0C4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M45.3432 61.4616C45.2794 62.9813 45.4927 65.4185 45.5639 67.0128C46.5743 67.0141 47.0075 66.7917 47.7616 66.5374C47.8467 64.6615 47.1677 62.926 46.972 61.2131C46.5729 61.1066 45.8401 61.4945 45.3432 61.4616ZM29.6107 52.8185C30.2769 58.9434 31.2419 64.0921 33.0118 69.5158C36.9399 70.7085 41.6754 70.8124 45.1475 69.7362C44.51 66.675 44.7885 62.9482 44.4159 59.6815C44.1351 57.2262 44.2783 54.7558 43.8933 52.2508C39.6861 51.3755 33.7395 52.0462 29.6107 52.8185ZM44.8881 52.2892C44.8526 54.9197 45.0058 57.5145 45.2067 60.1483C46.2167 59.9966 46.9022 59.8954 47.8407 59.6897C47.5359 57.1541 47.5734 54.3009 46.9527 52.058C46.2352 52.0649 45.6035 52.0497 44.8881 52.2892ZM50.0121 51.8652C49.5327 51.7553 48.9746 51.861 48.5166 51.8699C48.7319 54.0141 49.2542 56.3803 49.438 58.6311C50.1587 58.6535 50.5437 58.3137 51.1364 58.1994C51.1682 56.2236 50.9639 53.5016 50.0121 51.8652ZM57.7707 58.954C59.2728 58.5892 60.2174 56.7494 59.7972 54.86C59.5152 53.5902 59.0131 51.1991 58.4757 50.3868C58.0786 49.7859 57.0018 48.9993 56.1421 49.5498C54.7436 50.4454 52.2798 50.7053 51.26 51.7894C51.7713 53.4921 51.9301 55.8308 52.141 57.9883C53.8882 58.0972 56.0379 57.5075 57.491 58.1333C56.4766 58.4619 55.1603 58.4645 54.2838 58.9434C55.0001 59.2893 56.6772 59.2194 57.7707 58.954ZM43.8018 49.8188C42.7467 47.3375 41.7885 44.7661 40.2131 42.7667C38.6867 43.7903 37.0059 44.7531 36.5769 46.6119C38.7618 47.848 41.3089 49.0673 43.8018 49.8188ZM46.4026 42.135C46.3027 44.6165 46.0196 47.8717 45.3582 49.8166C46.9359 47.8076 48.2083 45.4682 49.5382 43.1906C48.9714 42.2807 47.7864 41.4873 46.4026 42.135ZM43.4543 41.0874C42.8566 41.023 42.3493 41.7745 41.5721 41.4495C41.394 41.6464 41.2321 41.8596 41.0506 42.0518C42.7672 44.1205 43.5472 47.0555 44.873 49.4866C45.5844 47.1513 45.5025 44.5929 45.6592 42.044C44.6817 42.1061 44.1394 41.1601 43.4543 41.0874ZM41.5585 38.5852C41.4947 39.2937 41.6595 39.5255 41.8021 40.3376C44.1311 41.0657 43.7244 37.1411 41.5585 38.5852ZM38.9759 37.7373C37.9724 37.189 36.4648 36.5919 35.1686 36.3446C33.5619 36.0372 33.7124 38.5362 33.7806 40.0271C33.8342 41.2074 34.448 42.4556 34.7146 43.2397C34.8397 43.6059 34.8679 43.9944 35.181 44.0671C35.7343 44.196 37.5594 43.4662 38.0795 43.1826C39.1793 42.5829 40.0327 41.6305 40.9669 40.991C40.979 40.6799 40.9909 40.369 41.0033 40.0579C40.4417 39.778 39.7926 39.5794 38.9681 39.5434C39.5274 39.262 40.3502 39.266 40.8598 38.9313C40.8647 38.8066 40.8699 38.6822 40.8743 38.5587C39.9438 38.4871 39.5892 38.0727 38.9759 37.7373ZM29.3906 35.9962C28.5577 36.8418 31.7266 37.9945 32.7356 38.0565C32.73 37.5215 33.0405 37.017 32.978 36.6332C31.7796 36.4228 30.2048 36.5616 29.3906 35.9962ZM39.6506 36.3933C39.6466 36.4759 39.5389 36.4459 39.5213 36.5131C40.5929 37.3506 41.3888 37.5238 42.8474 37.4516C43.5051 36.9743 44.0884 36.4161 44.7732 35.9691C43.1966 36.11 41.2119 37.0892 39.6506 36.3933ZM49.0681 39.249C49.023 38.3096 48.7763 36.3778 48.1956 36.0395C46.9769 35.3281 44.8104 37.4759 43.8927 37.8034C43.9925 38.0909 44.1573 38.3186 44.17 38.686C44.7129 38.5523 45.3738 38.6438 45.8442 38.875C45.3002 38.9359 44.697 38.9318 44.3371 39.191C44.2052 39.5722 44.3694 40.0917 44.2817 40.621C45.5729 40.9852 47.0476 41.1791 48.6799 41.227C48.9974 40.8143 49.1056 40.0282 49.0681 39.249ZM27.9884 36.8141C27.7269 36.6277 25.9576 34.3256 25.7152 34.4211C22.5136 35.6837 19.5199 37.8669 16.8448 39.9318C19.3954 45.4048 20.425 52.11 20.6069 58.5727C23.5287 59.9393 26.0951 61.9093 30.0599 62.115C29.6011 58.8689 29.1823 55.9728 28.9218 52.9166C27.9256 52.4967 26.4964 52.9356 25.5641 52.7864C25.5562 51.6629 26.9879 52.2944 27.1072 51.5389C27.197 50.9674 26.3194 50.9242 26.6052 50.0243C27.334 50.2892 27.7167 50.8744 28.494 51.0942C29.2043 49.5404 28.4841 46.7912 28.5865 45.4925C28.6059 45.2486 28.7082 44.1416 29.2544 44.3358C29.7378 44.5078 29.2268 47.2801 29.2798 48.5092C29.328 49.6416 29.143 50.7373 29.6016 51.4482C33.4328 50.9268 37.326 50.5897 41.4714 50.4759C40.5594 50.0846 39.476 49.7143 38.2882 49.0448C37.6443 48.6818 35.6146 47.9265 35.4288 47.3149C35.1323 46.3403 36.2066 45.8212 36.3904 44.9857C34.4565 46.0405 34.0791 43.9747 33.6217 42.5113C33.2072 41.1858 32.9712 40.1956 32.8695 39.4311C31.2036 38.6369 29.4224 37.8326 27.9884 36.8141ZM47.376 34.6996C50.0435 33.4061 50.5243 39.5338 49.4787 41.5078C49.6404 42.0966 50.1962 42.322 50.423 42.8512C48.9344 45.5178 47.2811 48.007 45.7622 50.6422C46.8921 49.9389 48.5059 50.5164 49.8354 49.9899C50.3214 49.7977 50.6732 48.6852 51.0412 47.7951C52.0533 45.3465 53.1159 42.2593 53.5886 39.9226C53.6954 39.3901 53.9863 38.23 53.9211 37.7561C53.8048 36.9076 52.6536 36.2785 52.068 35.7538C50.9893 34.7847 50.3099 33.9319 49.1847 33.0257C48.7284 33.6993 47.7492 34.1518 47.376 34.6996ZM21.8879 11.044C20.6168 12.4425 20.8829 15.063 21.0368 16.9273C23.3343 15.482 26.3837 17.0416 26.3549 19.4998C27.4518 19.4707 26.7647 18.1299 26.5663 17.2661C25.9179 14.4448 27.6587 11.3796 26.6452 8.7996C24.6775 8.9488 23.0609 9.75254 21.8879 11.044ZM30.9826 2.92697C28.1051 3.74255 24.4173 5.83341 23.2348 8.41837C24.1504 8.28532 24.786 7.82357 25.6892 7.76643C26.0306 7.7442 26.4778 7.90957 26.8701 7.81203C27.6519 7.61809 28.3117 5.86516 28.9015 5.21294C29.4765 4.576 30.1675 4.30386 30.6404 3.72321C30.9443 3.5766 31.3935 3.5867 31.4108 3.13043C31.2791 2.9896 31.1404 2.88224 30.9826 2.92697ZM45.9616 3.69405C42.975 2.00895 37.9196 0.74144 34.7426 2.32525C32.179 3.60344 28.7138 5.71826 27.5324 8.39816C28.6361 10.9843 27.2055 13.3539 27.1142 15.9796C27.0657 17.3767 27.772 18.5963 27.8261 20.1172C27.4484 20.7402 26.2946 20.817 25.4959 20.7743C25.227 19.4289 24.7564 17.9166 23.3709 17.7648C21.4105 17.5504 19.9771 19.1729 19.888 20.8684C19.7826 22.8623 21.4195 26.167 23.7395 25.9375C24.6358 25.8489 24.8559 24.9505 25.8324 24.9598C26.3617 26.0158 25.016 26.3473 24.8776 27.1026C24.8415 27.2977 24.9892 28.0602 25.0751 28.4177C25.4965 30.1588 26.4359 32.4122 27.3605 33.7377C28.534 35.4191 30.8397 35.6724 33.3201 35.8372C33.7631 34.8828 35.3952 34.9613 36.4586 35.211C35.1842 34.7062 33.9993 33.4826 33.0174 32.3995C31.8895 31.1568 30.747 29.8238 30.6893 28.1996C32.8207 31.1565 34.5816 33.7388 38.4573 35.0395C41.39 36.0231 44.815 34.5888 47.0684 33.0064C48.0034 32.3487 48.5616 31.3051 49.2262 30.3499C51.713 26.7727 52.8735 21.6669 52.6184 16.7181C52.5133 14.6771 52.5179 12.6431 51.8331 11.27C51.1174 9.83421 48.6966 8.54967 47.2796 9.84835C47.017 8.45213 48.458 7.58865 50.1506 8.09109C48.9437 6.53355 47.677 4.662 45.9616 3.69405ZM51.526 49.7444C53.8599 48.5842 58.2206 46.6215 59.6838 49.7487C60.2237 50.9014 60.8572 52.8499 61.1368 54.0399C61.5319 55.7186 60.7086 59.247 58.983 59.8103C57.459 60.3078 55.6807 60.2775 53.8449 59.9087C53.6287 59.7289 53.3881 59.4155 53.2198 59.0888C51.909 59.038 50.6816 59.1592 49.6461 59.698C49.7442 60.6674 49.0886 60.823 48.4739 61.0226C48.0182 62.8295 49.3855 65.1891 49.0583 66.8367C48.8248 68.0105 47.3807 68.192 46.3192 68.4116C46.2846 69.0638 46.3657 69.6083 46.4381 70.1602C46.1954 71.0545 45.1068 71.5636 44.0754 71.6882C40.6818 72.0963 35.5291 72.2796 32.2649 71.1059C31.3541 68.8716 30.6365 66.1542 29.8778 63.603C26.6943 63.9429 24.1194 62.2293 21.6921 61.1066C20.8517 60.717 19.6891 60.5024 19.3751 59.8334C19.0707 59.1857 19.1953 57.9445 19.1198 56.7719C18.9275 53.7772 18.763 50.8886 17.9721 47.8223C17.617 46.4463 16.9981 45.2322 16.5663 43.9063C16.1673 42.6775 15.47 41.1589 15.2882 39.9335C15.0186 38.1174 16.7287 38.0164 17.8222 37.2294C19.5126 36.0124 20.8395 35.3394 22.6703 34.241C23.2125 33.9158 24.8477 33.0924 25.0337 32.7132C25.4035 31.9614 24.399 30.9014 24.1305 30.3121C23.7057 29.3802 23.4842 28.5886 23.4233 27.6691C21.8876 27.4264 20.7234 26.5124 20.0201 25.4818C18.8569 23.7762 18.0501 20.6208 19.0566 18.2205C19.1355 18.0315 19.5292 17.6598 19.5872 17.3694C19.7018 16.7977 19.3717 16.0376 19.3512 15.4295C19.2454 12.3098 19.879 9.6218 21.9792 8.68098C22.8318 5.2845 25.8834 4.15524 28.7584 2.46724C29.8331 1.83637 31.0178 1.4332 32.2413 0.982994C36.6303 -0.632278 43.3643 -0.328094 47.0069 2.42683C48.5515 3.59507 51.0204 6.06169 51.9035 7.84752C54.2359 12.5623 54.0703 20.4418 52.4389 26.1771C52.2195 26.947 51.9015 28.0789 51.4573 29.0039C51.1477 29.6497 50.1852 30.9421 50.3021 31.5123C50.4224 32.1019 52.4966 33.6768 52.9413 34.1057C53.7422 34.8782 55.2636 35.9036 55.3869 36.8785C55.5193 37.916 54.9297 39.3353 54.631 40.3364C53.6325 43.6775 52.6582 46.7658 51.526 49.7444Z" fill="#231F20"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.955 26.6172C36.0816 26.4487 36.7777 26.1927 37.7517 26.6617C37.7517 26.6617 36.5974 26.8542 36.6934 28.7788L36.2124 28.6824C36.2124 28.6824 35.7152 26.9373 35.955 26.6172Z" fill="#F7E4CD"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.3893 43.1595C44.3893 43.4516 44.1524 43.6885 43.8601 43.6885C43.568 43.6885 43.3311 43.4516 43.3311 43.1595C43.3311 42.8675 43.568 42.6303 43.8601 42.6303C44.1524 42.6303 44.3893 42.8675 44.3893 43.1595Z" fill="#1D1919"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.9186 45.6127C44.9186 45.9048 44.6817 46.1416 44.3893 46.1416C44.0973 46.1416 43.8604 45.9048 43.8604 45.6127C43.8604 45.3206 44.0973 45.0834 44.3893 45.0834C44.6817 45.0834 44.9186 45.3206 44.9186 45.6127Z" fill="#1D1919"/>
-</g>
-<defs>
-<clipPath id="clip0_6709_29904">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6709_29904)"><path fill="#d33833" fill-rule="evenodd" d="M61.128 34.695c0 14.265-11.306 25.829-25.252 25.829S10.624 48.96 10.624 34.694c0-14.264 11.306-25.829 25.252-25.829s25.252 11.565 25.252 25.83" clip-rule="evenodd"/><path fill="#ef3d3a" d="M11.654 41.092s-1.828-26.936 22.99-27.705l-1.73-2.886-13.468 4.521-3.848 4.425-3.367 6.446-1.924 7.503.577 5.002"/><path fill="#231f20" d="M18.58 17.075c-4.43 4.533-7.171 10.792-7.171 17.716 0 6.923 2.741 13.183 7.172 17.715 4.433 4.533 10.541 7.33 17.295 7.33s12.863-2.797 17.295-7.33c4.43-4.532 7.173-10.792 7.173-17.715 0-6.924-2.742-13.183-7.173-17.716-4.432-4.532-10.541-7.329-17.295-7.33-6.754.001-12.862 2.798-17.295 7.33m-1.12 36.528c-4.71-4.816-7.62-11.47-7.62-18.812s2.91-13.996 7.62-18.812c4.707-4.817 11.223-7.802 18.416-7.801 7.193-.001 13.71 2.984 18.417 7.8 4.709 4.817 7.62 11.472 7.62 18.813s-2.911 13.996-7.62 18.812c-4.707 4.816-11.224 7.801-18.417 7.801s-13.71-2.985-18.417-7.801"/><path fill="#f0d6b7" fill-rule="evenodd" d="m46.506 34.838-3.848.577-5.195.577-3.367.096-3.27-.096-2.502-.77-2.212-2.404-1.732-4.906-.384-1.059-2.31-.77-1.346-2.212-.962-3.174 1.058-2.79 2.501-.866 2.02.962.963 2.116 1.154-.192.385-.48-.385-2.213-.096-2.79.577-3.848-.023-2.198 1.754-2.804 3.079-2.213 5.387-2.309 5.964.866 5.195 3.752 2.405 3.848 1.54 2.79.384 6.926-1.155 5.964-2.116 5.291-2.02 2.79" clip-rule="evenodd"/><path fill="#335061" fill-rule="evenodd" d="m43.235 51.48-13.756.578v2.308l1.154 8.081-.577.674-9.62-3.271-.673-1.155-.962-10.87-2.212-6.542-.482-1.539 7.696-5.29 2.405-.963 2.117 2.598 1.827 1.635 2.117.674.962.288 1.154 5.002.866 1.058 2.213-.77-1.54 2.983 8.37 3.944z" clip-rule="evenodd"/><path fill="#6d6b6d" fill-rule="evenodd" d="m20.436 17.907 2.5-.866 2.02.962.963 2.117 1.154-.193.29-1.154-.578-2.213.577-5.29-.481-2.887 1.732-2.02 3.751-2.982-1.058-1.443-5.29 2.597-2.213 1.732-1.251 2.694-1.924 2.597-.577 3.078z" clip-rule="evenodd"/><path fill="#dcd9d8" fill-rule="evenodd" d="M24.38 8.865s1.443-3.56 7.215-5.291.289-1.251.289-1.251L25.63 4.728l-2.405 2.405-1.058 1.924zm-2.886 8.369s-2.02-6.734 5.676-7.696l-.29-1.154-5.29 1.25-1.54 5.003.386 3.27z" clip-rule="evenodd"/><path fill="#f7e4cd" fill-rule="evenodd" d="m24.572 26.18 1.26-1.22s.568.066.664.74.385 6.734 4.522 10.004c.377.299-3.079-.481-3.079-.481l-3.078-4.81m17.412-6.06s.225-2.916 1.01-2.692.785 1.01.785 1.01-1.907 1.233-1.795 1.681" clip-rule="evenodd"/><path fill="#f7e4cd" d="M50.257 13.675s-1.585.334-1.731 1.731 1.731.289 2.02.193M38.618 13.77s-2.117.29-2.117 1.636c0 1.347 2.405 1.25 3.079.673"/><path fill="#f7e4cd" fill-rule="evenodd" d="M25.535 20.024s-3.656-2.213-4.04-.097c-.385 2.117-1.251 3.656.577 5.868l-1.25-.384-1.155-2.982-.385-2.886 2.213-2.31 2.5.193 1.444 1.155zm1.731-6.061s1.635-8.465 9.908-10.1c6.812-1.347 10.39.288 11.736 1.827 0 0-6.06-7.214-11.832-5.002s-10.005 6.253-9.908 8.85c.163 4.424.096 4.425.096 4.425m22.318-7.311s-2.79-.096-2.886 2.405c0 0 0 .385.192.77 0 0 2.213-2.502 3.56-1.155" clip-rule="evenodd"/><path fill="#f7e4cd" fill-rule="evenodd" d="M37.37 10.087s-.481-3.84-3.754-1.607c-2.117 1.443-1.924 3.463-1.54 3.848.385.385.28 1.16.574.628.292-.532.196-2.264 1.254-2.745 1.058-.48 2.793-1.018 3.465-.124" clip-rule="evenodd"/><path fill="#49728b" fill-rule="evenodd" d="m28.325 36.089-9.043 4.04s3.752 14.91 1.828 19.528l-1.347-.48-.096-5.676-2.501-10.774-1.059-2.983 9.428-6.349zm.929 8.247 1.283 1.565v5.772h-1.54s-.191-4.04-.191-4.522c0-.48.192-2.212.192-2.212m.288 7.601-4.329.191 1.25.866 3.079.481" clip-rule="evenodd"/><path fill="#335061" fill-rule="evenodd" d="m44.1 51.577 3.56-.097.866 8.85-3.656.482z" clip-rule="evenodd"/><path fill="#335061" fill-rule="evenodd" d="m45.063 51.577 5.387-.289s2.212-5.58 2.212-5.868 1.924-8.08 1.924-8.08l-4.329-4.522-.866-.77-2.308 2.31v8.946z" clip-rule="evenodd"/><path fill="#49728b" fill-rule="evenodd" d="m47.467 50.903-3.366.674.48 2.693c1.25.578 3.367-.962 3.367-.962m-.383-19.239 6.733 5.002.193-2.309-5.099-4.714z" clip-rule="evenodd"/><path fill="#fff" fill-rule="evenodd" d="m32.625 70.529-1.992-8.082-.99-5.963-.165-4.427 9.015-.48H44.1l-.51 10.102.866 7.792-.096 1.442-7.311.578z" clip-rule="evenodd"/><path fill="#dcd9d8" fill-rule="evenodd" d="M42.85 51.48s-.48 10.005.962 17.124c0 0-2.886 1.828-7.119 2.309l8.081-.289.962-.577-1.154-15.776-.289-3.368" clip-rule="evenodd"/><path fill="#fff" fill-rule="evenodd" d="m48.69 59.562 3.752-1.058 7.118-.385 1.058-3.27-1.924-5.676-2.212-.289-3.078.962-2.954 1.442L48.882 51l-1.222.48" clip-rule="evenodd"/><path fill="#dcd9d8" fill-rule="evenodd" d="M48.622 57.637s2.501-1.154 2.886-1.058l-1.058-5.291 1.25-.48s.866 5.001.866 5.578c0 0 5.387.29 5.868.29 0 0 1.155-2.214.866-4.522l1.058 3.078.097 1.732-1.54 2.309-1.731.384-2.886-.096-.962-1.25-3.367.48-1.058.385" clip-rule="evenodd"/><path fill="#fff" d="m44.842 50.808-2.117-5.387-2.212-3.175s.48-1.347 1.154-1.347h2.213l2.116.77-.192 3.56z"/><path fill="#dcd9d8" fill-rule="evenodd" d="M45.256 48.98s-2.694-5.195-2.694-5.965c0 0 .48-1.154 1.154-.866.674.289 2.117 1.058 2.117 1.058V41.38l-3.271-.674-2.212.289 3.751 8.85.77.096" clip-rule="evenodd"/><path fill="#fff" d="m33.49 36.282-2.665-.29-2.5-.77v.867l1.221 1.347 3.848 1.732"/><path fill="#dcd9d8" fill-rule="evenodd" d="M29.19 36.57s2.982 1.251 3.944.963l.096 1.153-2.693-.576-1.636-1.154z" clip-rule="evenodd"/><path fill="#d33833" fill-rule="evenodd" d="M48.68 41.227c-1.633-.048-3.107-.242-4.398-.606.087-.53-.077-1.049.055-1.43.36-.26.963-.255 1.507-.316-.47-.231-1.131-.323-1.674-.189-.013-.367-.178-.595-.277-.883.917-.327 3.084-2.475 4.303-1.764.58.339.827 2.27.872 3.21.038.78-.07 1.565-.388 1.978" clip-rule="evenodd"/><path stroke="#d33833" stroke-width="2.5" d="M48.68 41.227c-1.633-.048-3.107-.242-4.398-.606.087-.53-.077-1.049.055-1.43.36-.26.963-.255 1.507-.316-.47-.231-1.131-.323-1.674-.189-.013-.367-.178-.595-.277-.883.917-.327 3.084-2.475 4.303-1.764.58.339.827 2.27.872 3.21.038.78-.07 1.565-.388 1.978Z"/><path fill="#d33833" fill-rule="evenodd" d="m40.874 38.559-.015.372c-.51.335-1.332.33-1.891.612a4.9 4.9 0 0 1 2.035.515l-.037.933c-.934.64-1.787 1.592-2.887 2.191-.52.284-2.345 1.014-2.899.885-.313-.073-.34-.461-.466-.827-.267-.785-.88-2.033-.934-3.213-.068-1.491-.219-3.99 1.388-3.683 1.296.248 2.804.845 3.807 1.393.614.335.968.75 1.899.822" clip-rule="evenodd"/><path stroke="#d33833" stroke-width="2.5" d="m40.874 38.559-.015.372c-.51.335-1.332.33-1.891.612a4.9 4.9 0 0 1 2.035.515l-.037.933c-.934.64-1.787 1.592-2.887 2.191-.52.284-2.345 1.014-2.899.885-.313-.073-.34-.461-.466-.827-.267-.785-.88-2.033-.934-3.213-.068-1.491-.219-3.99 1.388-3.683 1.296.248 2.804.845 3.807 1.393.614.335.968.75 1.899.822Z"/><path fill="#d33833" fill-rule="evenodd" d="M41.802 40.338c-.143-.812-.308-1.044-.244-1.753 2.166-1.444 2.573 2.48.244 1.753" clip-rule="evenodd"/><path stroke="#d33833" stroke-width="2.5" d="M41.802 40.338c-.143-.812-.308-1.044-.244-1.753 2.166-1.444 2.573 2.48.244 1.753Z"/><path fill="#ef3d3a" fill-rule="evenodd" d="M44.938 40.996s-.674-.962-.193-1.25c.481-.29.962 0 1.251-.482.289-.48 0-.77.096-1.346.096-.578.578-.674 1.058-.77s1.828-.289 2.02.192l-.577-1.731-1.154-.385-3.656 2.117-.192 1.058v2.116m-8.754 3.655q-.172-2.25-.374-4.5c-.204-2.24.538-1.849 2.48-1.849.296 0 1.825.354 1.934.578.525 1.071-.877.833.604 1.641 1.251.682 3.46-.414 2.955-1.93-.282-.337-1.473-.105-1.9-.327l-2.255-1.168c-.956-.496-3.166-1.22-4.185-.526-2.583 1.756.163 6.145 1.084 7.978" clip-rule="evenodd"/><path fill="#231f20" fill-rule="evenodd" d="M37.368 10.087c-2.622-.61-3.924 1.097-4.72 2.869-.709-.172-.426-1.137-.247-1.63.47-1.29 2.36-3.008 3.906-2.775.665.1 1.565.708 1.061 1.536m12.776 2.986.125.005c.592 1.23 1.105 2.535 1.852 3.621-.5 1.166-3.791 2.198-3.74.104.711-.31 1.94-.063 2.57-.46-.364-1.002-.89-1.854-.807-3.27m-11.433.032c.563 1.03.745 2.113 1.545 2.892.36.351 1.06.778.712 1.754-.08.23-.673.742-1.015.843-1.25.369-4.16.076-3.175-1.481 1.034.048 2.422.67 3.194-.08-.593-.947-1.65-2.823-1.26-3.928M49.674 23.58c-1.88 1.208-3.978 2.522-7.06 2.217-.659-.573-.91-1.847-.27-2.689.333.573.124 1.626 1.052 1.784 1.749.3 3.784-1.07 5.042-1.548.78-1.315-.067-1.799-.77-2.645-1.439-1.734-3.368-3.884-3.298-6.48.581-.421.631.644.715.838.751 1.758 2.642 4.006 4.021 5.51.34.372.897.727.96.972.178.713-.466 1.566-.392 2.04m-24.798-1.272c-.59-.336-.73-1.819-1.422-1.86-.989-.06-.809 1.922-.805 3.082-.68-.618-.8-2.522-.3-3.5-.57-.28-.825.31-1.141.517.406-2.952 4.319-1.37 3.668 1.761m25.996 2.502c-.876 1.666-2.114 3.502-4.684 3.555-.052-.538-.092-1.357.003-1.681 1.965-.189 3.177-1.189 4.681-1.874M38.563 25.89c1.638.86 4.65.953 6.877.888.12.488.117 1.091.122 1.686-2.863.143-6.249-.565-7-2.575m-.31 1.607c1.133 2.845 5.028 2.518 8.312 2.439-.145.37-.458.806-.847.964-1.053.428-3.956.753-5.417-.023-.927-.493-1.522-1.606-2.03-2.259-.245-.315-1.466-1.12-.019-1.121" clip-rule="evenodd"/><path fill="#81b0c4" fill-rule="evenodd" d="M49.537 43.19c-1.33 2.278-2.602 4.617-4.18 6.626.662-1.945.945-5.2 1.045-7.681 1.384-.648 2.569.146 3.135 1.055" clip-rule="evenodd"/><path fill="#231f20" fill-rule="evenodd" d="M56.694 51.377c-1.49.298-2.535 1.745-3.988 1.652.798-1.125 2.197-1.6 3.988-1.652m.656 2.33c-1.213.128-2.639.324-3.87.223.583-.89 2.828-.583 3.87-.223m.422 2.009c-1.364.03-3.06.002-4.356-.107.767-.823 3.471-.305 4.356.107" clip-rule="evenodd"/><path fill="#dcd9d8" fill-rule="evenodd" d="M46.972 61.213c.195 1.713.874 3.448.79 5.324-.755.255-1.188.477-2.198.476-.072-1.595-.285-4.032-.221-5.552.497.033 1.23-.355 1.629-.248" clip-rule="evenodd"/><path fill="#f0d6b7" fill-rule="evenodd" d="M44.772 35.969c-.684.447-1.268 1.005-1.925 1.483-1.459.072-2.255-.102-3.327-.939.018-.067.126-.037.13-.12 1.561.696 3.546-.283 5.122-.424" clip-rule="evenodd"/><path fill="#81b0c4" fill-rule="evenodd" d="M36.576 46.612c.43-1.859 2.11-2.822 3.636-3.845 1.576 2 2.534 4.57 3.589 7.052-2.493-.752-5.04-1.97-7.225-3.207" clip-rule="evenodd"/><path fill="#231f20" fill-rule="evenodd" d="M45.343 61.462c-.064 1.52.15 3.956.22 5.55 1.011.002 1.444-.22 2.199-.475.085-1.876-.594-3.611-.79-5.324-.4-.106-1.132.282-1.629.249m-15.732-8.644c.666 6.125 1.63 11.274 3.4 16.698 3.929 1.192 8.664 1.296 12.136.22-.637-3.061-.358-6.788-.731-10.055-.28-2.455-.138-4.925-.523-7.43-4.207-.875-10.154-.205-14.282.568m15.277-.529c-.035 2.63.118 5.225.319 7.86 1.01-.152 1.695-.254 2.634-.46-.305-2.535-.268-5.388-.888-7.631-.718.007-1.35-.008-2.065.231m5.124-.424c-.48-.11-1.037-.004-1.495.005.215 2.144.737 4.51.921 6.761.72.023 1.106-.317 1.698-.432.032-1.975-.172-4.697-1.124-6.334m7.759 7.089c1.502-.365 2.446-2.205 2.026-4.094-.282-1.27-.784-3.66-1.321-4.473-.397-.601-1.474-1.388-2.334-.837-1.398.895-3.862 1.155-4.882 2.24.511 1.702.67 4.04.881 6.198 1.747.11 3.897-.48 5.35.145-1.014.329-2.33.331-3.207.81.716.346 2.393.276 3.487.011M43.8 49.819c-1.054-2.482-2.013-5.053-3.588-7.052-1.526 1.023-3.207 1.986-3.636 3.845 2.185 1.236 4.732 2.455 7.225 3.207m2.602-7.684c-.1 2.482-.383 5.737-1.045 7.682 1.578-2.01 2.85-4.349 4.18-6.626-.567-.91-1.752-1.704-3.135-1.056m-2.949-1.048c-.597-.064-1.105.688-1.882.362-.178.197-.34.41-.521.603 1.716 2.069 2.496 5.004 3.822 7.435.711-2.336.63-4.894.786-7.443-.977.062-1.52-.884-2.205-.957m-1.895-2.502c-.064.709.1.94.243 1.753 2.33.728 1.922-3.197-.243-1.753m-2.583-.848c-1.004-.548-2.511-1.145-3.807-1.392-1.607-.308-1.457 2.191-1.388 3.682.053 1.18.667 2.429.934 3.213.125.366.153.754.466.827.553.129 2.378-.6 2.899-.884 1.1-.6 1.953-1.553 2.887-2.192l.036-.933a4.9 4.9 0 0 0-2.035-.515c.56-.281 1.382-.277 1.892-.612l.014-.372c-.93-.072-1.285-.486-1.898-.822m-9.585-1.74c-.833.845 2.336 1.998 3.345 2.06-.006-.535.305-1.04.242-1.424-1.198-.21-2.773-.071-3.587-.637m10.26.396c-.004.083-.112.053-.13.12 1.072.838 1.868 1.01 3.326.939.658-.478 1.241-1.036 1.926-1.483-1.576.141-3.561 1.12-5.122.424m9.417 2.856c-.045-.94-.292-2.871-.872-3.21-1.22-.71-3.386 1.437-4.303 1.764.1.288.264.516.277.883.543-.134 1.204-.042 1.674.189-.544.06-1.147.057-1.507.316-.132.381.032.9-.055 1.43 1.29.364 2.766.558 4.398.606.317-.413.426-1.199.388-1.978m-21.08-2.435c-.261-.186-2.03-2.488-2.273-2.393-3.201 1.263-6.195 3.446-8.87 5.51 2.55 5.474 3.58 12.179 3.762 18.642 2.922 1.366 5.488 3.336 9.453 3.542-.459-3.246-.878-6.142-1.138-9.198-.996-.42-2.426.019-3.358-.13-.008-1.124 1.424-.493 1.543-1.248.09-.572-.788-.615-.502-1.515.729.265 1.112.85 1.889 1.07.71-1.554-.01-4.303.093-5.602.019-.243.121-1.35.667-1.156.484.172-.027 2.944.026 4.173.048 1.133-.137 2.228.322 2.94 3.83-.522 7.724-.86 11.87-.973-.913-.391-1.996-.762-3.184-1.431-.644-.363-2.673-1.119-2.86-1.73-.296-.975.779-1.494.962-2.33-1.934 1.056-2.31-1.01-2.768-2.474-.415-1.325-.65-2.315-.752-3.08-1.666-.794-3.448-1.598-4.882-2.617M47.376 34.7c2.668-1.294 3.148 4.834 2.103 6.808.161.589.717.814.944 1.343-1.489 2.667-3.142 5.156-4.66 7.791 1.13-.703 2.743-.126 4.072-.652.486-.192.838-1.305 1.206-2.195 1.012-2.449 2.075-5.536 2.548-7.872.106-.533.397-1.693.332-2.167-.116-.848-1.267-1.477-1.853-2.002-1.079-.97-1.758-1.822-2.883-2.728-.457.673-1.436 1.126-1.809 1.674M21.888 11.044c-1.271 1.399-1.005 4.019-.851 5.883 2.297-1.445 5.347.115 5.318 2.573 1.097-.03.41-1.37.211-2.234-.648-2.821 1.093-5.886.08-8.466-1.969.149-3.585.953-4.758 2.244m9.095-8.117c-2.878.816-6.566 2.906-7.748 5.491.915-.133 1.551-.594 2.454-.652.342-.022.789.144 1.181.046.782-.194 1.442-1.947 2.031-2.6.576-.636 1.267-.908 1.74-1.489.303-.146.753-.136.77-.593-.132-.14-.27-.248-.428-.203m14.979.767C42.975 2.009 37.92.741 34.742 2.325c-2.563 1.278-6.028 3.393-7.21 6.073 1.104 2.586-.326 4.956-.418 7.582-.048 1.397.658 2.616.712 4.137-.378.623-1.531.7-2.33.657-.269-1.345-.74-2.857-2.125-3.01-1.96-.214-3.394 1.409-3.483 3.104-.105 1.994 1.531 5.299 3.851 5.07.897-.09 1.117-.987 2.093-.978.53 1.056-.816 1.387-.954 2.143-.037.195.111.957.197 1.315.422 1.74 1.36 3.994 2.285 5.32 1.174 1.681 3.48 1.934 5.96 2.1.443-.955 2.075-.877 3.139-.627-1.275-.505-2.46-1.728-3.442-2.811-1.128-1.243-2.27-2.576-2.328-4.2 2.132 2.957 3.893 5.539 7.768 6.84 2.933.983 6.358-.451 8.611-2.034.935-.657 1.494-1.7 2.158-2.656 2.487-3.577 3.648-8.683 3.392-13.632-.105-2.04-.1-4.075-.785-5.448-.716-1.436-3.136-2.72-4.553-1.422-.263-1.396 1.178-2.26 2.87-1.757-1.206-1.557-2.473-3.429-4.188-4.397m5.564 46.05c2.334-1.16 6.695-3.123 8.158.005.54 1.152 1.173 3.1 1.453 4.29.395 1.68-.428 5.208-2.154 5.771-1.524.498-3.302.468-5.138.099-.216-.18-.457-.493-.625-.82-1.311-.051-2.538.07-3.574.609.098.97-.557 1.125-1.172 1.325-.456 1.806.912 4.166.584 5.814-.233 1.173-1.677 1.355-2.739 1.575-.034.652.047 1.196.12 1.748-.244.895-1.332 1.404-2.364 1.528-3.393.408-8.546.592-11.81-.582-.91-2.234-1.628-4.952-2.387-7.503-3.184.34-5.759-1.374-8.186-2.496-.84-.39-2.003-.605-2.317-1.274-.304-.647-.18-1.889-.255-3.061-.193-2.995-.357-5.883-1.148-8.95-.355-1.376-.974-2.59-1.406-3.916-.399-1.228-1.096-2.747-1.278-3.972-.27-1.817 1.44-1.918 2.534-2.705 1.69-1.217 3.018-1.89 4.848-2.988.542-.325 2.178-1.149 2.364-1.528.37-.752-.635-1.812-.903-2.4-.425-.933-.647-1.724-.708-2.644-1.535-.243-2.7-1.157-3.403-2.187-1.163-1.706-1.97-4.861-.963-7.261.079-.19.472-.561.53-.852.115-.571-.215-1.331-.236-1.94-.106-3.12.528-5.807 2.628-6.748.853-3.396 3.904-4.526 6.78-6.214 1.074-.63 2.259-1.034 3.482-1.484 4.39-1.615 11.123-1.311 14.766 1.444 1.544 1.168 4.013 3.635 4.897 5.42 2.332 4.715 2.166 12.595.535 18.33-.22.77-.538 1.902-.982 2.827-.31.646-1.272 1.938-1.155 2.508.12.59 2.195 2.165 2.64 2.594.8.772 2.322 1.798 2.445 2.773.132 1.037-.457 2.456-.756 3.457-.998 3.342-1.973 6.43-3.105 9.408" clip-rule="evenodd"/><path fill="#f7e4cd" fill-rule="evenodd" d="M35.955 26.617c.127-.168.823-.424 1.797.045 0 0-1.155.192-1.059 2.117l-.48-.097s-.498-1.745-.258-2.065" clip-rule="evenodd"/><path fill="#1d1919" fill-rule="evenodd" d="M44.39 43.16a.53.53 0 1 1-1.059 0 .53.53 0 0 1 1.058 0m.53 2.453a.53.53 0 1 1-1.059 0 .53.53 0 0 1 1.059 0" clip-rule="evenodd"/></g><defs><clipPath id="clip0_6709_29904"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/jetbrains.svg b/web/packages/design/src/ResourceIcon/assets/jetbrains.svg
index 3c615ce14c82e..e7959955f143a 100644
--- a/web/packages/design/src/ResourceIcon/assets/jetbrains.svg
+++ b/web/packages/design/src/ResourceIcon/assets/jetbrains.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17291)">
-<path d="M22.8825 4.11896L4.1175 22.884C1.48085 25.522 -0.000201089 29.0992 2.04786e-08 32.829L2.04786e-08 66.3765C2.04786e-08 69.4815 2.52 72.0015 5.625 72.0015H39.1725C42.9075 72.0015 46.4737 70.5165 49.1175 67.884L67.8825 49.119C70.515 46.4865 72 42.909 72 39.174V5.62646C72 2.52146 69.48 0.00146484 66.375 0.00146484H32.8275C29.0925 0.00146484 25.5263 1.48647 22.8825 4.11896Z" fill="url(#paint0_linear_16904_17291)"/>
-<path d="M54 18.0015H9V63.0015H54V18.0015Z" fill="black"/>
-<path d="M33.75 52.8765H14.625V57.3765H33.75V52.8765Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_16904_17291" x1="0.956251" y1="70.5615" x2="70.4475" y2="2.03771" gradientUnits="userSpaceOnUse">
-<stop stop-color="#FF9419"/>
-<stop offset="0.43" stop-color="#FF021D"/>
-<stop offset="0.99" stop-color="#E600FF"/>
-</linearGradient>
-<clipPath id="clip0_16904_17291">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17291)"><path fill="url(#paint0_linear_16904_17291)" d="M22.883 4.119 4.118 22.884A14.07 14.07 0 0 0 0 32.829v33.547a5.627 5.627 0 0 0 5.625 5.625h33.548c3.734 0 7.3-1.485 9.944-4.117l18.765-18.765A14.07 14.07 0 0 0 72 39.174V5.626A5.627 5.627 0 0 0 66.375.001H32.828a14.1 14.1 0 0 0-9.946 4.118"/><path fill="#000" d="M54 18.002H9v45h45z"/><path fill="#fff" d="M33.75 52.877H14.625v4.5H33.75z"/></g><defs><linearGradient id="paint0_linear_16904_17291" x1=".956" x2="70.448" y1="70.561" y2="2.038" gradientUnits="userSpaceOnUse"><stop stop-color="#ff9419"/><stop offset=".43" stop-color="#ff021d"/><stop offset=".99" stop-color="#e600ff"/></linearGradient><clipPath id="clip0_16904_17291"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/jira.svg b/web/packages/design/src/ResourceIcon/assets/jira.svg
index f4e0ec18388c1..1d8d65b3cbb1c 100644
--- a/web/packages/design/src/ResourceIcon/assets/jira.svg
+++ b/web/packages/design/src/ResourceIcon/assets/jira.svg
@@ -1,27 +1 @@
-<svg width="76" height="80" viewBox="0 0 76 80" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g filter="url(#filter0_d_6218_26586)">
-<path d="M71.1652 34.0502L40.9223 3.04358L37.9538 0L15.2251 23.3025L4.83493 34.0502C3.72169 35.1917 3.72169 36.9985 4.83493 38.0449L25.6153 59.3501L37.9538 72L60.6821 48.6975L61.0531 48.3171L71.1652 38.0449C72.2783 36.9034 72.2783 35.0966 71.1652 34.0502ZM37.9538 46.7001L27.5635 36.0476L37.9538 25.395L48.344 36.0476L37.9538 46.7001Z" fill="#2684FF"/>
-<path d="M37.9599 25.4C31.1783 18.466 31.1684 7.02902 37.9499 0L15.1699 23.3667L27.5352 36L37.9599 25.4Z" fill="url(#paint0_linear_6218_26586)"/>
-<path d="M48.4188 35.9053L37.9602 46.7002C44.8159 53.7292 44.8059 64.971 37.9502 72.0003L60.7402 48.6335L48.4188 35.9053Z" fill="url(#paint1_linear_6218_26586)"/>
-</g>
-<defs>
-<filter id="filter0_d_6218_26586" x="-2" y="0" width="80" height="80" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dy="4"/>
-<feGaussianBlur stdDeviation="2"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_6218_26586"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_6218_26586" result="shape"/>
-</filter>
-<linearGradient id="paint0_linear_6218_26586" x1="36.1179" y1="14.5758" x2="21.2635" y2="29.1035" gradientUnits="userSpaceOnUse">
-<stop offset="0.176" stop-color="#0052CC"/>
-<stop offset="1" stop-color="#2684FF"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6218_26586" x1="39.9693" y1="57.2577" x2="54.7933" y2="42.7998" gradientUnits="userSpaceOnUse">
-<stop offset="0.176" stop-color="#0052CC"/>
-<stop offset="1" stop-color="#2684FF"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="76" height="80" fill="none" viewBox="0 0 76 80"><g filter="url(#filter0_d_6218_26586)"><path fill="#2684ff" d="M71.165 34.05 40.922 3.044 37.954 0 15.225 23.303 4.835 34.05c-1.113 1.142-1.113 2.949 0 3.995l20.78 21.305L37.954 72l22.728-23.303.371-.38 10.112-10.272c1.113-1.142 1.113-2.948 0-3.995M37.954 46.7l-10.39-10.652 10.39-10.653 10.39 10.653z"/><path fill="url(#paint0_linear_6218_26586)" d="M37.96 25.4c-6.782-6.934-6.792-18.371-.01-25.4L15.17 23.367 27.535 36z"/><path fill="url(#paint1_linear_6218_26586)" d="M48.419 35.905 37.96 46.7c6.856 7.03 6.846 18.271-.01 25.3l22.79-23.367z"/></g><defs><linearGradient id="paint0_linear_6218_26586" x1="36.118" x2="21.264" y1="14.576" y2="29.104" gradientUnits="userSpaceOnUse"><stop offset=".176" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient><linearGradient id="paint1_linear_6218_26586" x1="39.969" x2="54.793" y1="57.258" y2="42.8" gradientUnits="userSpaceOnUse"><stop offset=".176" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient><filter id="filter0_d_6218_26586" width="80" height="80" x="-2" y="0" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="4"/><feGaussianBlur stdDeviation="2"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_6218_26586"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_6218_26586" result="shape"/></filter></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kaiser-dark.svg b/web/packages/design/src/ResourceIcon/assets/kaiser-dark.svg
index 062b9696279f2..037362de54eb4 100644
--- a/web/packages/design/src/ResourceIcon/assets/kaiser-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kaiser-dark.svg
@@ -1,27 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17415)">
-<path d="M45.2826 22.7402C44.461 22.0235 43.5146 21.4645 42.4909 21.0913L40.9229 53.1113L48.8776 30.9849C49.1154 29.4105 48.904 27.8008 48.2678 26.3418C47.6317 24.8829 46.5967 23.6343 45.2826 22.7402Z" fill="white"/>
-<path d="M32.1602 20.8231L36.8257 52.8047L41.3768 20.8231C38.4025 19.7224 35.1343 19.7224 32.1602 20.8231Z" fill="white"/>
-<path d="M28.3047 22.7027C26.9941 23.5999 25.9617 24.849 25.3259 26.3071C24.6902 27.7652 24.4767 29.3734 24.7099 30.9474L32.6645 53.0737L31.0965 21.0537C30.073 21.4269 29.1266 21.9859 28.3047 22.7027Z" fill="white"/>
-<path d="M12.3125 25.7315C17.5901 35.0498 23.0206 44.9052 28.2982 53.9934C26.4243 46.324 24.4738 33.1708 21.7968 29.5279C20.6157 28.2038 19.1447 27.1719 17.4992 26.5133C15.8537 25.8546 14.0784 25.587 12.3125 25.7315Z" fill="white"/>
-<path d="M2.91016 30.4096L24.5941 55.6422L11.1707 25.8848C9.53536 25.9316 7.93432 26.3661 6.49857 27.1525C5.06282 27.9391 3.83315 29.0552 2.91016 30.4096Z" fill="white"/>
-<path d="M48.3077 37.2361L44.7129 54.5306C49.3403 46.4393 53.9296 38.5016 58.404 30.4103C56.2145 30.3162 54.0525 30.9283 52.2353 32.1569C50.4182 33.3852 49.0417 35.1655 48.3077 37.2361Z" fill="white"/>
-<path d="M59.6975 30.4095L48.2246 56.0255L68.3405 33.9758C67.2187 32.8215 65.8732 31.9096 64.3869 31.2963C62.9005 30.6829 61.3046 30.3812 59.6975 30.4095Z" fill="white"/>
-<path d="M0.0776754 41.8375C7.15268 47.3212 14.1512 52.9199 21.2644 58.3652L2.14282 31.292C0.46596 34.5379 -0.250568 38.1968 0.0776754 41.8375Z" fill="white"/>
-<path d="M70.8252 37.1595C70.4169 36.28 69.8459 35.4862 69.1425 34.8203L51.8184 58.6722C58.7021 53.5337 65.3564 48.2801 71.9726 43.0266C72.1126 41.0036 71.7167 38.9796 70.8252 37.1595Z" fill="white"/>
-<path d="M0.0820312 52.8431L18.5536 61.3946C12.4346 55.2589 6.2392 49.3152 0.0820312 43.2563V52.8431Z" fill="white"/>
-<path d="M71.9712 53.4952V44.752L54.5322 61.7399C60.4599 59.0171 65.9287 56.3328 71.9712 53.4952Z" fill="white"/>
-<path d="M0.0820312 61.3565C5.6273 62.5836 11.555 64.1559 16.7178 65.1912L0.0820312 54.1855V61.3565Z" fill="white"/>
-<path d="M71.97 61.8548V55.144C66.7307 58.4803 61.3383 61.9315 56.4814 65.4211L71.97 61.8548Z" fill="white"/>
-<path d="M0.120117 69.716H16.3736L0.120117 62.7368V69.716Z" fill="white"/>
-<path d="M71.9787 69.7157V63.3501C66.6247 65.6509 61.9972 67.5683 56.9492 69.7157H71.9787Z" fill="white"/>
-<path d="M66.3527 21.9356C66.4237 20.9782 66.2967 20.0164 65.98 19.1103C65.6634 18.2043 65.1637 17.3735 64.5122 16.6699C63.8608 15.9663 63.0715 15.4051 62.1938 15.0213C61.3162 14.6375 60.369 14.4395 59.4116 14.4395C58.454 14.4395 57.5068 14.6375 56.6292 15.0213C55.7515 15.4051 54.9622 15.9663 54.3108 16.6699C53.6593 17.3735 53.1596 18.2043 52.843 19.1103C52.5263 20.0164 52.3993 20.9782 52.4703 21.9356C52.3556 30.8706 66.6969 31.3691 66.3527 21.9356Z" fill="white"/>
-<path d="M19.9295 16.8734C20.3883 7.05649 5.244 7.43998 5.81766 16.8734C5.28224 26.6136 20.8472 26.767 19.9295 16.8734Z" fill="white"/>
-<path d="M36.8356 18.7527C37.8913 18.8064 38.9467 18.6399 39.9351 18.2638C40.9234 17.8878 41.8233 17.3104 42.578 16.5681C43.3326 15.8258 43.9256 14.9348 44.3195 13.9512C44.7134 12.9675 44.8997 11.9127 44.8666 10.8532C44.9962 9.74485 44.8828 8.62148 44.5346 7.56152C44.1865 6.50158 43.6118 5.53059 42.8507 4.71634C42.0896 3.90208 41.1606 3.26418 40.1281 2.84715C39.0959 2.43011 37.9853 2.244 36.8738 2.3018C35.765 2.25469 34.6593 2.45009 33.6334 2.87444C32.6075 3.29879 31.6859 3.94193 30.9327 4.7592C30.1794 5.57648 29.6126 6.54832 29.2715 7.60728C28.9304 8.66623 28.8233 9.78693 28.9575 10.8916C28.8957 11.9434 29.0576 12.9963 29.4322 13.9807C29.8068 14.9651 30.3857 15.8585 31.1305 16.6017C31.8752 17.3449 32.769 17.921 33.7526 18.2918C34.7361 18.6627 35.787 18.8198 36.8356 18.7527Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17415">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_16904_17415)"><path d="M45.283 22.74a8.9 8.9 0 0 0-2.792-1.649l-1.568 32.02 7.955-22.126a8.46 8.46 0 0 0-.61-4.643 8.43 8.43 0 0 0-2.985-3.602M32.16 20.823l4.666 31.982 4.55-31.982a13.28 13.28 0 0 0-9.216 0m-3.855 1.88a8.47 8.47 0 0 0-2.98 3.604 8.5 8.5 0 0 0-.615 4.64l7.954 22.127-1.568-32.02a8.9 8.9 0 0 0-2.791 1.649m-15.992 3.029C17.59 35.05 23.02 44.905 28.298 53.993c-1.874-7.669-3.824-20.822-6.501-24.465a11.5 11.5 0 0 0-4.298-3.015 11.44 11.44 0 0 0-5.186-.782M2.91 30.41l21.684 25.232-13.423-29.757a10.34 10.34 0 0 0-4.672 1.267A10.4 10.4 0 0 0 2.91 30.41m45.398 6.826-3.595 17.295c4.627-8.092 9.217-16.03 13.691-24.12a10.23 10.23 0 0 0-6.169 1.746 10.27 10.27 0 0 0-3.927 5.08m11.39-6.827L48.225 56.026l20.116-22.05a11.75 11.75 0 0 0-8.643-3.566M.078 41.838C7.153 47.32 14.15 52.92 21.264 58.365L2.143 31.292A19.2 19.2 0 0 0 .078 41.837m70.747-4.677a7.7 7.7 0 0 0-1.683-2.34L51.819 58.672c6.884-5.138 13.538-10.392 20.155-15.645a11.53 11.53 0 0 0-1.148-5.867M.082 52.843l18.472 8.552C12.434 55.259 6.239 49.315.082 43.256zm71.889.652v-8.743L54.532 61.74c5.928-2.723 11.397-5.407 17.44-8.245M.082 61.357c5.545 1.227 11.473 2.799 16.636 3.834L.082 54.185zm71.888.498v-6.711c-5.24 3.336-10.632 6.788-15.489 10.277zM.12 69.716h16.254L.12 62.736zm71.859 0V63.35c-5.354 2.3-9.982 4.218-15.03 6.366z"/><path d="M66.353 21.936a7 7 0 0 0-1.84-5.266 6.96 6.96 0 0 0-5.101-2.23 6.94 6.94 0 0 0-5.101 2.23 6.98 6.98 0 0 0-1.84 5.266c-.115 8.935 14.226 9.433 13.882 0M19.93 16.873c.458-9.817-14.686-9.433-14.112 0-.536 9.74 15.03 9.894 14.112 0m16.906 1.88a7.63 7.63 0 0 0 5.742-2.185 7.67 7.67 0 0 0 2.289-5.715 7.69 7.69 0 0 0-2.016-6.137 7.65 7.65 0 0 0-5.977-2.414 7.63 7.63 0 0 0-5.941 2.457 7.67 7.67 0 0 0-1.976 6.133 7.46 7.46 0 0 0 2.174 5.71 7.42 7.42 0 0 0 5.705 2.15"/></g><defs><clipPath id="clip0_16904_17415"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kaiser-light.svg b/web/packages/design/src/ResourceIcon/assets/kaiser-light.svg
index 1717f1c2f8333..fd377d5736c7b 100644
--- a/web/packages/design/src/ResourceIcon/assets/kaiser-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kaiser-light.svg
@@ -1,27 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17374)">
-<path d="M45.2826 22.7402C44.461 22.0235 43.5146 21.4645 42.4909 21.0913L40.9229 53.1113L48.8776 30.9849C49.1154 29.4105 48.904 27.8008 48.2678 26.3418C47.6317 24.8829 46.5967 23.6343 45.2826 22.7402Z" fill="#006BA6"/>
-<path d="M32.1602 20.8231L36.8257 52.8047L41.3768 20.8231C38.4025 19.7224 35.1343 19.7224 32.1602 20.8231Z" fill="#006BA6"/>
-<path d="M28.3047 22.7027C26.9941 23.5999 25.9617 24.849 25.3259 26.3071C24.6902 27.7652 24.4767 29.3734 24.7099 30.9474L32.6645 53.0737L31.0965 21.0537C30.073 21.4269 29.1266 21.9859 28.3047 22.7027Z" fill="#006BA6"/>
-<path d="M12.3125 25.7315C17.5901 35.0498 23.0206 44.9052 28.2982 53.9934C26.4243 46.324 24.4738 33.1708 21.7968 29.5279C20.6157 28.2038 19.1447 27.1719 17.4992 26.5133C15.8537 25.8546 14.0784 25.587 12.3125 25.7315Z" fill="#006BA6"/>
-<path d="M2.91016 30.4096L24.5941 55.6422L11.1707 25.8848C9.53536 25.9316 7.93432 26.3661 6.49857 27.1525C5.06282 27.9391 3.83315 29.0552 2.91016 30.4096Z" fill="#006BA6"/>
-<path d="M48.3077 37.2361L44.7129 54.5306C49.3403 46.4393 53.9296 38.5016 58.404 30.4103C56.2145 30.3162 54.0525 30.9283 52.2353 32.1569C50.4182 33.3852 49.0417 35.1655 48.3077 37.2361Z" fill="#006BA6"/>
-<path d="M59.6975 30.4095L48.2246 56.0255L68.3405 33.9758C67.2187 32.8215 65.8732 31.9096 64.3869 31.2963C62.9005 30.6829 61.3046 30.3812 59.6975 30.4095Z" fill="#006BA6"/>
-<path d="M0.0776754 41.8375C7.15268 47.3212 14.1512 52.9199 21.2644 58.3652L2.14282 31.292C0.46596 34.5379 -0.250568 38.1968 0.0776754 41.8375Z" fill="#006BA6"/>
-<path d="M70.8252 37.1595C70.4169 36.28 69.8459 35.4862 69.1425 34.8203L51.8184 58.6722C58.7021 53.5337 65.3564 48.2801 71.9726 43.0266C72.1126 41.0036 71.7167 38.9796 70.8252 37.1595Z" fill="#006BA6"/>
-<path d="M0.0820312 52.8431L18.5536 61.3946C12.4346 55.2589 6.2392 49.3152 0.0820312 43.2563V52.8431Z" fill="#006BA6"/>
-<path d="M71.9712 53.4952V44.752L54.5322 61.7399C60.4599 59.0171 65.9287 56.3328 71.9712 53.4952Z" fill="#006BA6"/>
-<path d="M0.0820312 61.3565C5.6273 62.5836 11.555 64.1559 16.7178 65.1912L0.0820312 54.1855V61.3565Z" fill="#006BA6"/>
-<path d="M71.97 61.8548V55.144C66.7307 58.4803 61.3383 61.9315 56.4814 65.4211L71.97 61.8548Z" fill="#006BA6"/>
-<path d="M0.120117 69.716H16.3736L0.120117 62.7368V69.716Z" fill="#006BA6"/>
-<path d="M71.9787 69.7157V63.3501C66.6247 65.6509 61.9972 67.5683 56.9492 69.7157H71.9787Z" fill="#006BA6"/>
-<path d="M66.3527 21.9356C66.4237 20.9782 66.2967 20.0164 65.98 19.1103C65.6634 18.2043 65.1637 17.3735 64.5122 16.6699C63.8608 15.9663 63.0715 15.4051 62.1938 15.0213C61.3162 14.6375 60.369 14.4395 59.4116 14.4395C58.454 14.4395 57.5068 14.6375 56.6292 15.0213C55.7515 15.4051 54.9622 15.9663 54.3108 16.6699C53.6593 17.3735 53.1596 18.2043 52.843 19.1103C52.5263 20.0164 52.3993 20.9782 52.4703 21.9356C52.3556 30.8706 66.6969 31.3691 66.3527 21.9356Z" fill="#006BA6"/>
-<path d="M19.9295 16.8734C20.3883 7.05649 5.244 7.43998 5.81766 16.8734C5.28224 26.6136 20.8472 26.767 19.9295 16.8734Z" fill="#006BA6"/>
-<path d="M36.8356 18.7527C37.8913 18.8064 38.9467 18.6399 39.9351 18.2638C40.9234 17.8878 41.8233 17.3104 42.578 16.5681C43.3326 15.8258 43.9256 14.9348 44.3195 13.9512C44.7134 12.9675 44.8997 11.9127 44.8666 10.8532C44.9962 9.74485 44.8828 8.62148 44.5346 7.56152C44.1865 6.50158 43.6118 5.53059 42.8507 4.71634C42.0896 3.90208 41.1606 3.26418 40.1281 2.84715C39.0959 2.43011 37.9853 2.244 36.8738 2.3018C35.765 2.25469 34.6593 2.45009 33.6334 2.87444C32.6075 3.29879 31.6859 3.94193 30.9327 4.7592C30.1794 5.57648 29.6126 6.54832 29.2715 7.60728C28.9304 8.66623 28.8233 9.78693 28.9575 10.8916C28.8957 11.9434 29.0576 12.9963 29.4322 13.9807C29.8068 14.9651 30.3857 15.8585 31.1305 16.6017C31.8752 17.3449 32.769 17.921 33.7526 18.2918C34.7361 18.6627 35.787 18.8198 36.8356 18.7527Z" fill="#006BA6"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17374">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#006ba6" clip-path="url(#clip0_16904_17374)"><path d="M45.283 22.74a8.9 8.9 0 0 0-2.792-1.649l-1.568 32.02 7.955-22.126a8.46 8.46 0 0 0-.61-4.643 8.43 8.43 0 0 0-2.985-3.602M32.16 20.823l4.666 31.982 4.55-31.982a13.28 13.28 0 0 0-9.216 0m-3.855 1.88a8.47 8.47 0 0 0-2.98 3.604 8.5 8.5 0 0 0-.615 4.64l7.954 22.127-1.568-32.02a8.9 8.9 0 0 0-2.791 1.649m-15.992 3.029C17.59 35.05 23.02 44.905 28.298 53.993c-1.874-7.669-3.824-20.822-6.501-24.465a11.5 11.5 0 0 0-4.298-3.015 11.44 11.44 0 0 0-5.186-.782M2.91 30.41l21.684 25.232-13.423-29.757a10.34 10.34 0 0 0-4.672 1.267A10.4 10.4 0 0 0 2.91 30.41m45.398 6.826-3.595 17.295c4.627-8.092 9.217-16.03 13.691-24.12a10.23 10.23 0 0 0-6.169 1.746 10.27 10.27 0 0 0-3.927 5.08m11.39-6.827L48.225 56.026l20.116-22.05a11.75 11.75 0 0 0-8.643-3.566M.078 41.838C7.153 47.32 14.15 52.92 21.264 58.365L2.143 31.292A19.2 19.2 0 0 0 .078 41.837m70.747-4.677a7.7 7.7 0 0 0-1.683-2.34L51.819 58.672c6.884-5.138 13.538-10.392 20.155-15.645a11.53 11.53 0 0 0-1.148-5.867M.082 52.843l18.472 8.552C12.434 55.259 6.239 49.315.082 43.256zm71.889.652v-8.743L54.532 61.74c5.928-2.723 11.397-5.407 17.44-8.245M.082 61.357c5.545 1.227 11.473 2.799 16.636 3.834L.082 54.185zm71.888.498v-6.711c-5.24 3.336-10.632 6.788-15.489 10.277zM.12 69.716h16.254L.12 62.736zm71.859 0V63.35c-5.354 2.3-9.982 4.218-15.03 6.366z"/><path d="M66.353 21.936a7 7 0 0 0-1.84-5.266 6.96 6.96 0 0 0-5.101-2.23 6.94 6.94 0 0 0-5.101 2.23 6.98 6.98 0 0 0-1.84 5.266c-.115 8.935 14.226 9.433 13.882 0M19.93 16.873c.458-9.817-14.686-9.433-14.112 0-.536 9.74 15.03 9.894 14.112 0m16.906 1.88a7.63 7.63 0 0 0 5.742-2.185 7.67 7.67 0 0 0 2.289-5.715 7.69 7.69 0 0 0-2.016-6.137 7.65 7.65 0 0 0-5.977-2.414 7.63 7.63 0 0 0-5.941 2.457 7.67 7.67 0 0 0-1.976 6.133 7.46 7.46 0 0 0 2.174 5.71 7.42 7.42 0 0 0 5.705 2.15"/></g><defs><clipPath id="clip0_16904_17374"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kisi-dark.svg b/web/packages/design/src/ResourceIcon/assets/kisi-dark.svg
index 66cf38ba96777..bd4c8fa3ef482 100644
--- a/web/packages/design/src/ResourceIcon/assets/kisi-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kisi-dark.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7393)">
-<path d="M38.2351 35.9979C38.2351 46.5563 29.6759 55.1155 19.1175 55.1155C8.55921 55.1155 0 46.5563 0 35.9979C0 25.4396 8.55921 16.8804 19.1175 16.8804C29.6759 16.8804 38.2351 25.4396 38.2351 35.9979Z" fill="white"/>
-<path d="M72 53.8405V18.1542H36.3136V18.1595C37.5754 23.9049 38.2396 29.8735 38.2396 35.9976C38.2396 42.1202 37.5754 48.0888 36.3136 53.8341V53.8405H72Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7393">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_15940_7393)"><path d="M38.235 35.998c0 10.558-8.56 19.118-19.117 19.118C8.559 55.116 0 46.555 0 35.998S8.56 16.88 19.118 16.88s19.117 8.56 19.117 19.118"/><path d="M72 53.84V18.155H36.314v.006a83 83 0 0 1 1.926 17.838c0 6.122-.665 12.09-1.926 17.836v.006z"/></g><defs><clipPath id="clip0_15940_7393"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kisi-light.svg b/web/packages/design/src/ResourceIcon/assets/kisi-light.svg
index a51a7d89d2d31..33bec9dda9acd 100644
--- a/web/packages/design/src/ResourceIcon/assets/kisi-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kisi-light.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7393)">
-<path d="M38.2351 35.9979C38.2351 46.5563 29.6759 55.1155 19.1175 55.1155C8.55921 55.1155 0 46.5563 0 35.9979C0 25.4396 8.55921 16.8804 19.1175 16.8804C29.6759 16.8804 38.2351 25.4396 38.2351 35.9979Z" fill="black"/>
-<path d="M72 53.8405V18.1542H36.3136V18.1595C37.5754 23.9049 38.2396 29.8735 38.2396 35.9976C38.2396 42.1202 37.5754 48.0888 36.3136 53.8341V53.8405H72Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7393">
-<rect width="72" height="72" fill="black" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#000" clip-path="url(#clip0_15940_7393)"><path d="M38.235 35.998c0 10.558-8.56 19.118-19.117 19.118C8.559 55.116 0 46.555 0 35.998S8.56 16.88 19.118 16.88s19.117 8.56 19.117 19.118"/><path d="M72 53.84V18.155H36.314v.006a83 83 0 0 1 1.926 17.838c0 6.122-.665 12.09-1.926 17.836v.006z"/></g><defs><clipPath id="clip0_15940_7393"><path fill="#000" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kollide.svg b/web/packages/design/src/ResourceIcon/assets/kollide.svg
index 2f8cd5e4a047d..1a0c7994757da 100644
--- a/web/packages/design/src/ResourceIcon/assets/kollide.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kollide.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15940_7400)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M34.0834 1.30861C35.2121 0.181082 36.8585 -0.260357 38.3979 0.152716L56.6929 5.05522C58.2329 5.46889 59.4379 6.67206 59.8509 8.21325L71.8477 52.9847C72.2608 54.5271 71.8199 56.1705 70.6918 57.301L57.2992 70.6919C56.1711 71.8212 54.5253 72.2608 52.9836 71.8484L8.21244 59.8509C6.67185 59.4384 5.46691 58.2335 5.05562 56.6935L0.15196 38.3983C-0.260519 36.8565 0.180326 35.2125 1.30903 34.085L34.0834 1.30861ZM35.9981 24.0005H19.4981V27.0005L25.4981 30.0005V58.5005H35.9981V46.5005L31.4981 43.5005H37.4981L46.4981 58.5005H58.4981L47.2481 40.5005L58.4981 24.0005H46.4981L38.9981 36.0005H35.9981V24.0005Z" fill="#7450F6"/>
-</g>
-<defs>
-<clipPath id="clip0_15940_7400">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15940_7400)"><path fill="#7450f6" fill-rule="evenodd" d="M34.083 1.309A4.47 4.47 0 0 1 38.398.153l18.295 4.902a4.47 4.47 0 0 1 3.158 3.158l11.997 44.772a4.47 4.47 0 0 1-1.156 4.316l-13.393 13.39a4.47 4.47 0 0 1-4.315 1.157L8.212 59.851a4.46 4.46 0 0 1-3.156-3.157L.152 38.398a4.47 4.47 0 0 1 1.157-4.313zM35.998 24h-16.5v3l6 3v28.5h10.5v-12l-4.5-3h6l9 15h12l-11.25-18L58.498 24h-12l-7.5 12h-3z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15940_7400"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kube.svg b/web/packages/design/src/ResourceIcon/assets/kube.svg
index ce24325fa591b..fcfa19e21dfcd 100644
--- a/web/packages/design/src/ResourceIcon/assets/kube.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kube.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6722_31933)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.8286 1.13627C35.8536 1.13629 35.878 1.13631 35.9017 1.13631C36.652 1.13631 37.6947 1.2237 38.7027 1.7229L62.4816 13.1056L62.519 13.1256C64.062 13.9485 65.3874 15.3334 65.9534 17.1444L65.9751 17.2137L71.9351 42.8575L71.9477 42.9652C72.1567 44.7413 71.7403 46.5556 70.6638 48.0627L70.6301 48.1099L54.1867 68.4498C52.9709 70.0809 51.0505 71.0299 48.9667 70.8408H22.8382L22.781 70.8374C20.9555 70.7301 19.1893 69.8882 17.936 68.635L17.8633 68.5623L1.32906 48.1099L1.29531 48.0627C0.219206 46.5561 -0.220888 44.7042 0.105569 42.8543L0.113939 42.8069L5.9673 17.1301L5.96885 17.1235C6.41865 15.2119 7.67373 13.7226 9.36525 12.929L33.2889 1.39857L33.4824 1.3502C34.3425 1.13518 35.2506 1.13585 35.8286 1.13627Z" fill="white"/>
-<path d="M35.826 40.7778L37.9288 39.7654L38.474 37.5068L36.9943 35.6376H34.6578L33.178 37.5068L33.7232 39.7654L35.826 40.7778Z" fill="#326DE6"/>
-<path d="M50.9352 39.6096C51.0909 37.9741 51.013 36.3386 50.6236 34.703C50.2342 33.0675 49.6112 31.5099 48.7544 30.108L42.9133 35.404C42.7575 35.5597 42.6797 35.7155 42.6018 35.9492C42.446 36.6501 42.8354 37.351 43.5364 37.5068L50.9352 39.6096Z" fill="#326DE6"/>
-<path d="M40.0317 31.7435L46.418 27.2264C44.0815 24.8899 41.0441 23.4101 37.6173 23.0207L38.0846 30.8868C38.0846 31.1205 38.1625 31.2762 38.3183 31.432C38.7077 31.9772 39.4865 32.055 40.0317 31.7435Z" fill="#326DE6"/>
-<path d="M33.879 22.9428L32.3213 23.2544C29.5955 23.8774 27.1032 25.2793 25.0783 27.2264L31.5425 31.8214C31.5913 31.8377 31.6366 31.8539 31.68 31.8695C31.8446 31.9284 31.9807 31.9772 32.1656 31.9772C32.8665 31.9772 33.4896 31.432 33.4896 30.7311L33.879 22.9428Z" fill="#326DE6"/>
-<path d="M28.583 35.2482L22.8197 30.108C21.1063 32.9896 20.3275 36.3386 20.5611 39.6096L28.1157 37.4289C28.4272 37.351 28.583 37.2731 28.7388 37.0395C29.2061 36.4943 29.1282 35.7155 28.583 35.2482Z" fill="#326DE6"/>
-<path d="M29.2061 41.9461L21.4957 43.2701C22.5861 46.3854 24.7668 49.1112 27.4927 50.9025L30.4522 43.7374C30.6079 43.5037 30.6079 43.1922 30.5301 42.9585C30.4522 42.3355 29.8291 41.9461 29.2061 41.9461Z" fill="#326DE6"/>
-<path d="M35.826 53.3169C36.9943 53.3169 38.0846 53.1611 39.175 52.9275C39.7201 52.7717 40.1874 52.6938 40.6547 52.6159L36.9164 45.8402C36.6827 45.6065 36.527 45.4508 36.2933 45.295C35.7481 44.9835 35.1251 45.1392 34.7357 45.6065L30.9195 52.538C32.4771 53.0053 34.1905 53.3169 35.826 53.3169Z" fill="#326DE6"/>
-<path d="M44.0036 50.8246C45.8728 49.6564 47.5083 48.0209 48.6766 46.1517C49.2996 45.295 49.7669 44.2825 50.1563 43.1922L42.3681 41.8682C42.1345 41.8682 41.9008 41.9461 41.6672 42.024C41.122 42.2576 40.8105 42.8807 40.9662 43.5037L44.0036 50.8246Z" fill="#326DE6"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M61.6049 14.8432C62.7731 15.4663 63.7077 16.4787 64.0971 17.7248L70.0161 43.1923C70.1719 44.5163 69.8604 45.8403 69.0816 46.9306L52.6484 67.2579C51.7917 68.4261 50.4677 69.0492 49.0659 68.8934H22.8975C21.5735 68.8155 20.2495 68.1925 19.3149 67.2579L2.88181 46.9306C2.10299 45.8403 1.79146 44.5163 2.0251 43.1923L7.86626 17.5691C8.17779 16.2451 9.03449 15.2326 10.2027 14.6874L33.9567 3.23877C34.5798 3.08301 35.2807 3.08301 35.9038 3.08301C36.5269 3.08301 37.2278 3.16089 37.8508 3.47242L61.6049 14.8432ZM60.281 42.1018C60.281 42.1797 60.3589 42.1797 60.4368 42.1797C61.1377 42.3355 61.7608 42.9585 61.8386 43.8152C61.605 44.4383 60.9819 44.9056 60.281 44.9056C60.1252 44.9056 60.0474 44.9056 59.8916 44.8277C59.8468 44.7829 59.8278 44.7639 59.8049 44.7558C59.7879 44.7498 59.7689 44.7498 59.7358 44.7498C59.6446 44.7498 59.5801 44.7231 59.5266 44.701C59.4888 44.6853 59.4566 44.672 59.4243 44.672C59.1932 44.6142 59.005 44.5136 58.7961 44.4019C58.7233 44.363 58.6481 44.3228 58.5676 44.2825C58.4118 44.2825 58.2561 44.2047 58.1003 44.1268H58.0224C57.2436 43.8152 56.3869 43.5816 55.5302 43.4258H55.4523C55.2187 43.4258 54.985 43.5037 54.8293 43.6595C54.8293 43.6595 54.8293 43.7374 54.7514 43.7374L54.1283 43.6595C52.7264 48.0988 49.689 51.8371 45.7171 54.2514L45.9507 54.8745C45.9507 54.8745 45.8728 54.8745 45.8728 54.9524C45.7171 55.186 45.7171 55.4976 45.7949 55.7312C46.1065 56.51 46.4959 57.2888 47.041 57.9898V58.1455C47.1968 58.3013 47.2747 58.3792 47.3526 58.535C47.5862 58.7686 47.742 59.0023 47.8977 59.3138C47.9756 59.3917 48.0535 59.4696 48.0535 59.5474C48.0535 59.5474 48.1314 59.5474 48.1314 59.6253C48.2872 60.0147 48.2872 60.4041 48.2093 60.7935C48.1314 61.183 47.8199 61.4945 47.5083 61.6502C47.4596 61.6665 47.4142 61.6828 47.3708 61.6983C47.2063 61.7573 47.0702 61.806 46.8853 61.806C46.2622 61.806 45.7171 61.4166 45.4055 60.8714C45.3276 60.8714 45.3276 60.7935 45.3276 60.7935C45.2887 60.7546 45.2692 60.7157 45.2498 60.6767C45.2303 60.6378 45.2108 60.5988 45.1719 60.5599C45.0161 60.3263 44.9382 60.0147 44.8603 59.7032L44.7046 59.2359V59.158C44.4709 58.3013 44.0815 57.5225 43.6921 56.7437C43.5364 56.51 43.3027 56.3543 43.0691 56.2764C43.0691 56.1985 43.0691 56.1985 42.9912 56.1985L42.6797 55.6533C42.4815 55.7128 42.2783 55.7773 42.0713 55.843C41.4649 56.0354 40.8261 56.2381 40.1874 56.3543C38.7855 56.7437 37.3837 56.8994 35.9818 56.8994C33.6453 56.8994 31.3868 56.51 29.2061 55.6533L28.8945 56.2764C28.8945 56.3153 28.8945 56.3348 28.8848 56.3445C28.8751 56.3543 28.8556 56.3543 28.8166 56.3543C28.583 56.4321 28.3494 56.5879 28.1936 56.8216C27.8042 57.6004 27.4148 58.3792 27.1811 59.2359L27.0254 59.7032C26.9864 59.859 26.928 59.9953 26.8696 60.1315C26.8112 60.2678 26.7528 60.4041 26.7138 60.5599C26.636 60.6378 26.5581 60.7157 26.5581 60.7935C26.4802 60.7935 26.4802 60.8714 26.4802 60.8714C26.1687 61.4166 25.6235 61.806 25.0004 61.806C24.8447 61.806 24.611 61.7281 24.4553 61.6502C23.7543 61.2608 23.4428 60.3263 23.8322 59.5474C23.9101 59.5474 23.9101 59.4696 23.9101 59.4696C23.949 59.4306 23.9685 59.3917 23.988 59.3527C24.0074 59.3138 24.0269 59.2748 24.0658 59.2359C24.1683 59.0993 24.2558 58.9627 24.3348 58.8393C24.4361 58.6811 24.5235 58.5446 24.611 58.4571C24.7668 58.3013 24.8447 58.2234 24.9225 58.0677V57.9898C25.3898 57.2888 25.8571 56.51 26.1687 55.7312C26.2465 55.4976 26.2465 55.186 26.0908 54.9524C26.0908 54.9524 26.0129 54.9524 26.0129 54.8745L26.4023 54.3293C25.6235 53.9399 25.0004 53.4726 24.2995 52.9275C21.2621 50.591 19.0814 47.3978 17.9132 43.8152L17.2122 43.8931C17.2122 43.8931 17.2122 43.8152 17.1343 43.8152C16.9786 43.6595 16.7449 43.5816 16.5113 43.5816H16.4334C15.4988 43.7374 14.72 43.971 13.8633 44.2825H13.7854C13.6296 44.2825 13.4739 44.3604 13.3181 44.4383C13.2311 44.4673 13.1334 44.5071 13.0288 44.5496C12.8525 44.6214 12.657 44.7009 12.4614 44.7498C12.4378 44.7498 12.4 44.7427 12.3586 44.7349C12.2635 44.7169 12.1499 44.6955 12.1499 44.7498C12.1499 44.7888 12.1499 44.8082 12.1402 44.818C12.1304 44.8277 12.1109 44.8277 12.072 44.8277C11.9162 44.9056 11.8384 44.9056 11.6826 44.9056C10.9817 44.9835 10.2807 44.5162 10.125 43.8152C9.96919 42.9585 10.5144 42.1797 11.3711 42.024C11.4489 41.9461 11.4489 41.9461 11.5268 41.9461C11.6181 41.9461 11.6826 41.9194 11.736 41.8972C11.7738 41.8816 11.8061 41.8682 11.8384 41.8682C11.9941 41.8682 12.1499 41.8487 12.3057 41.8293C12.4614 41.8098 12.6172 41.7903 12.7729 41.7903C12.9287 41.7124 13.0845 41.7124 13.2402 41.7124C14.1748 41.6345 15.0315 41.4788 15.8882 41.2451C16.1219 41.0894 16.3555 40.9336 16.4334 40.7C16.4334 40.7 16.5113 40.7 16.5113 40.6221L17.1343 40.4663C16.4334 36.027 17.4459 31.5099 19.8602 27.6936C19.8992 27.6158 19.9381 27.5574 19.977 27.4989C20.016 27.4405 20.0549 27.3821 20.0939 27.3042L19.6418 26.8521C19.6773 26.6281 19.5351 26.3561 19.3929 26.2139C18.7699 25.5908 17.991 25.1235 17.2122 24.6562L16.7449 24.4226C16.4334 24.2668 16.1219 24.1111 15.8882 23.9553C15.8103 23.9553 15.6546 23.7995 15.6546 23.7995C15.6546 23.7995 15.6546 23.7217 15.5767 23.7217C14.9536 23.1765 14.7979 22.2419 15.2652 21.541C15.4988 21.1516 15.8882 20.9958 16.3555 20.9958C16.7449 20.9958 17.1343 21.1516 17.4459 21.3852L17.5237 21.4631C17.5627 21.502 17.6016 21.5215 17.6406 21.541C17.6795 21.5604 17.7185 21.5799 17.7574 21.6188C17.8742 21.7357 17.9716 21.8525 18.0689 21.9693C18.1663 22.0861 18.2636 22.203 18.3805 22.3198C18.404 22.3434 18.4347 22.3669 18.4683 22.3927C18.5455 22.452 18.6377 22.5227 18.692 22.6313C19.2372 23.2544 19.9381 23.8774 20.639 24.4226C20.7948 24.5005 20.9506 24.5784 21.1063 24.5784C21.1976 24.5784 21.2621 24.5516 21.3155 24.5295C21.3533 24.5138 21.3856 24.5005 21.4179 24.5005H21.4957L21.963 24.812C24.5331 22.0861 27.8821 20.1391 31.5425 19.3603C31.6774 19.3378 31.8107 19.3153 31.9426 19.2931C32.7244 19.1612 33.4575 19.0375 34.1905 18.9709L34.2684 18.3478V18.192C34.502 18.0363 34.5799 17.8026 34.6578 17.569C34.6578 16.6344 34.6578 15.7777 34.502 14.921V14.8431C34.502 14.6873 34.502 14.5316 34.4242 14.3758C34.3463 14.0643 34.2684 13.7528 34.2684 13.4412V13.0518C34.2684 12.6624 34.4242 12.273 34.7357 11.9615C35.1251 11.5721 35.5924 11.3384 36.0597 11.4163C36.8385 11.4942 37.4616 12.273 37.3837 13.0518V13.5191C37.3447 13.6749 37.3253 13.8306 37.3058 13.9864C37.2863 14.1422 37.2668 14.2979 37.2279 14.4537C37.2279 14.5316 37.2084 14.6095 37.189 14.6873C37.1695 14.7652 37.15 14.8431 37.15 14.921V14.9989C36.9943 15.9335 36.9943 16.7902 36.9943 17.6469C37.0721 17.8805 37.15 18.1142 37.3837 18.2699V18.192L37.4616 18.8151C41.122 19.2045 44.7046 20.6064 47.5862 22.865C47.8977 23.1765 48.2287 23.488 48.5597 23.7995C48.8907 24.1111 49.2217 24.4226 49.5333 24.7341L50.1563 24.3447H50.2342C50.3121 24.4226 50.4679 24.4226 50.5457 24.4226C50.7015 24.4226 50.8573 24.3447 51.013 24.2668C51.714 23.7995 52.4149 23.1765 52.9601 22.5534C52.9837 22.5299 53.0144 22.5063 53.0479 22.4805C53.1252 22.4212 53.2173 22.3505 53.2716 22.2419C53.4274 22.0083 53.661 21.7746 53.8947 21.541C53.9725 21.541 54.0504 21.4631 54.1283 21.3852L54.2062 21.3073C54.5177 21.0737 54.9071 20.9179 55.2965 20.9179C55.686 20.9179 56.1532 21.1516 56.3869 21.4631C56.9321 22.164 56.7763 23.0986 56.0754 23.6438C56.0754 23.6735 56.0867 23.6919 56.0964 23.7076C56.1121 23.733 56.1235 23.7514 56.0754 23.7995C56.0364 23.8385 55.9975 23.858 55.9585 23.8774C55.9196 23.8969 55.8807 23.9164 55.8417 23.9553C55.686 24.0332 55.5497 24.1111 55.4134 24.189C55.2771 24.2668 55.1408 24.3447 54.985 24.4226L54.5177 24.6562C53.7389 25.1235 53.038 25.5908 52.337 26.2139C52.1813 26.3697 52.1034 26.6812 52.1034 26.9148V26.9927L51.6361 27.46C52.8822 29.4071 53.8168 31.5878 54.362 33.8463C54.8293 36.1049 54.985 38.4414 54.6735 40.7L55.2965 40.8557C55.3744 41.0894 55.6081 41.323 55.8417 41.4009C56.6984 41.6345 57.633 41.7903 58.4897 41.8682H58.5676C58.7234 41.9461 58.8791 41.9461 59.0349 41.9461C59.3464 41.9461 59.6579 41.9461 59.9695 42.024C60.1252 42.024 60.281 42.024 60.281 42.1018ZM19.6418 26.8521L19.6266 26.8369V26.9148C19.6333 26.8945 19.6384 26.8735 19.6418 26.8521Z" fill="#326DE6"/>
-</g>
-<defs>
-<clipPath id="clip0_6722_31933">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6722_31933)"><path fill="#fff" fill-rule="evenodd" d="M35.829 1.136h.073c.75 0 1.793.088 2.8.587l23.78 11.383.037.02c1.543.822 2.868 2.207 3.434 4.018l.022.07 5.96 25.644.013.107c.209 1.776-.208 3.59-1.284 5.098l-.034.047-16.443 20.34c-1.216 1.63-3.136 2.58-5.22 2.39H22.838l-.057-.003c-1.825-.107-3.592-.949-4.845-2.202l-.073-.073L1.33 48.11l-.034-.047a6.86 6.86 0 0 1-1.19-5.209l.009-.047L5.967 17.13l.002-.006a6.13 6.13 0 0 1 3.396-4.195L33.29 1.399l.193-.049c.86-.215 1.769-.214 2.347-.214" clip-rule="evenodd"/><path fill="#326de6" d="m35.826 40.778 2.103-1.013.545-2.258-1.48-1.87h-2.336l-1.48 1.87.545 2.258zm15.109-1.168c.156-1.636.078-3.271-.311-4.907a15.8 15.8 0 0 0-1.87-4.595l-5.84 5.296c-.157.156-.234.311-.312.545-.156.701.233 1.402.934 1.558zm-10.903-7.866 6.386-4.518c-2.337-2.336-5.374-3.816-8.8-4.205l.467 7.866c0 .233.078.39.233.545.39.545 1.169.623 1.714.312m-6.153-8.801-1.558.311c-2.725.623-5.218 2.025-7.243 3.972l6.465 4.595.137.048c.165.06.3.108.486.108.7 0 1.324-.545 1.324-1.246zm-5.296 12.305-5.763-5.14a16.4 16.4 0 0 0-2.259 9.502l7.555-2.181c.311-.078.467-.156.623-.39.467-.545.39-1.324-.156-1.79m.623 6.697-7.71 1.324c1.09 3.115 3.27 5.841 5.997 7.633l2.96-7.166c.155-.233.155-.545.077-.779-.078-.622-.7-1.012-1.324-1.012m6.62 11.371c1.168 0 2.259-.156 3.349-.39a13 13 0 0 1 1.48-.311l-3.739-6.776c-.233-.234-.389-.39-.623-.545-.545-.312-1.168-.156-1.557.311l-3.816 6.932c1.557.467 3.27.779 4.906.779m8.178-2.492a14.9 14.9 0 0 0 4.673-4.673c.623-.857 1.09-1.87 1.48-2.96l-7.789-1.324c-.233 0-.467.078-.7.156-.546.234-.858.857-.702 1.48z"/><path fill="#326de6" fill-rule="evenodd" d="M61.605 14.843c1.168.623 2.103 1.636 2.492 2.882l5.92 25.467c.155 1.324-.157 2.648-.935 3.739L52.648 67.258c-.856 1.168-2.18 1.791-3.582 1.635H22.898c-1.325-.078-2.648-.7-3.583-1.635L2.882 46.93a4.9 4.9 0 0 1-.857-3.739L7.866 17.57a4.18 4.18 0 0 1 2.337-2.882L33.957 3.24c.623-.156 1.324-.156 1.947-.156s1.324.078 1.947.39zM60.28 42.102c0 .078.078.078.156.078.7.156 1.324.779 1.402 1.635a1.69 1.69 0 0 1-1.558 1.09c-.156 0-.234 0-.39-.077-.044-.045-.063-.064-.086-.072-.017-.006-.036-.006-.07-.006-.09 0-.155-.027-.208-.049a.3.3 0 0 0-.103-.029c-.23-.058-.419-.158-.628-.27q-.109-.06-.228-.12c-.156 0-.312-.077-.468-.155h-.078a13 13 0 0 0-2.492-.701h-.078a.88.88 0 0 0-.623.233s0 .078-.078.078l-.623-.078c-1.402 4.44-4.439 8.178-8.41 10.592l.233.624s-.078 0-.078.077c-.156.234-.156.546-.078.78.311.778.7 1.557 1.246 2.258v.155c.156.156.234.234.312.39.233.234.389.467.545.779.078.078.155.156.155.233 0 0 .078 0 .078.078.156.39.156.78.078 1.169s-.39.7-.7.856l-.138.048c-.165.06-.3.108-.486.108-.623 0-1.168-.39-1.48-.935-.077 0-.077-.078-.077-.078a.4.4 0 0 1-.078-.116.4.4 0 0 0-.078-.117c-.156-.234-.234-.545-.312-.857l-.155-.467v-.078c-.234-.857-.623-1.636-1.013-2.414a1.2 1.2 0 0 0-.623-.468c0-.078 0-.078-.078-.078l-.311-.545q-.299.09-.609.19c-.606.192-1.245.395-1.884.511-1.401.39-2.803.545-4.205.545-2.337 0-4.595-.389-6.776-1.246l-.311.623c0 .04 0 .059-.01.068s-.03.01-.068.01a1.2 1.2 0 0 0-.623.468c-.39.778-.78 1.557-1.013 2.414l-.156.467a3 3 0 0 1-.155.428 3 3 0 0 0-.156.429c-.078.078-.156.156-.156.233-.078 0-.078.078-.078.078-.311.546-.857.935-1.48.935-.155 0-.389-.078-.545-.156-.7-.39-1.012-1.324-.623-2.103.078 0 .078-.077.078-.077a.4.4 0 0 0 .078-.117.4.4 0 0 1 .078-.117c.102-.137.19-.273.269-.397.101-.158.188-.294.276-.382.156-.156.234-.234.311-.39v-.077c.468-.701.935-1.48 1.247-2.259.078-.233.078-.545-.078-.779 0 0-.078 0-.078-.078l.39-.545c-.78-.39-1.403-.856-2.104-1.401-3.037-2.337-5.218-5.53-6.386-9.113l-.7.078s0-.078-.079-.078a.88.88 0 0 0-.623-.233h-.078c-.934.155-1.713.389-2.57.7h-.078c-.155 0-.311.078-.467.156-.087.03-.185.07-.29.112a4 4 0 0 1-.567.2 1 1 0 0 1-.102-.015c-.095-.018-.21-.04-.21.015 0 .039 0 .058-.009.068-.01.01-.03.01-.068.01-.156.078-.234.078-.39.078-.7.078-1.401-.39-1.557-1.09a1.52 1.52 0 0 1 1.246-1.792c.078-.078.078-.078.156-.078a.5.5 0 0 0 .209-.049c.038-.015.07-.029.102-.029.156 0 .312-.02.468-.039.155-.02.311-.039.467-.039.156-.078.312-.078.467-.078a14.5 14.5 0 0 0 2.648-.467c.234-.156.467-.311.545-.545 0 0 .078 0 .078-.078l.623-.156c-.7-4.439.312-8.956 2.726-12.772.04-.078.078-.137.117-.195a2 2 0 0 0 .117-.195l-.452-.452c.035-.224-.107-.496-.25-.638-.622-.623-1.401-1.09-2.18-1.558l-.467-.233a9 9 0 0 1-.857-.468c-.078 0-.233-.155-.233-.155s0-.078-.078-.078c-.623-.546-.78-1.48-.312-2.181.234-.39.623-.545 1.09-.545.39 0 .78.156 1.09.39l.079.077a.4.4 0 0 0 .117.078c.039.02.078.039.116.078.117.117.215.233.312.35s.195.234.312.35q.036.035.087.074c.078.059.17.13.224.238.545.623 1.246 1.246 1.947 1.792.156.078.312.155.467.155a.5.5 0 0 0 .21-.049.3.3 0 0 1 .102-.029h.078l.467.312c2.57-2.726 5.92-4.673 9.58-5.452l.4-.067c.781-.132 1.515-.255 2.247-.322l.078-.623v-.156c.234-.156.312-.39.39-.623 0-.935 0-1.791-.156-2.648v-.078c0-.156 0-.311-.078-.467-.078-.312-.156-.623-.156-.935v-.39c0-.389.156-.778.468-1.09.39-.389.856-.623 1.324-.545.779.078 1.402.857 1.324 1.636v.467c-.04.156-.059.312-.078.467s-.04.312-.078.468c0 .078-.02.155-.039.233a1 1 0 0 0-.039.234v.078c-.156.934-.156 1.791-.156 2.648.078.234.156.467.39.623v-.078l.078.623c3.66.39 7.243 1.791 10.124 4.05.312.312.643.623.974.934s.662.624.973.935l.623-.39h.078c.078.079.234.079.312.079.156 0 .311-.078.467-.156a10.2 10.2 0 0 0 1.947-1.714q.037-.034.088-.073c.077-.059.17-.13.224-.238.155-.234.389-.467.623-.701.077 0 .155-.078.233-.156l.078-.078c.312-.233.701-.39 1.09-.39s.857.235 1.09.546c.546.701.39 1.636-.31 2.18 0 .03.01.049.02.065.016.025.028.043-.02.091a.4.4 0 0 1-.117.078.4.4 0 0 0-.117.078c-.156.078-.292.156-.429.234-.136.078-.272.156-.428.234l-.467.233c-.78.468-1.48.935-2.181 1.558-.156.156-.234.467-.234.7v.079l-.467.467a21.1 21.1 0 0 1 2.726 6.386c.467 2.259.623 4.595.311 6.854l.624.156a.94.94 0 0 0 .545.545c.856.233 1.791.39 2.648.467h.078c.155.078.311.078.467.078.311 0 .623 0 .934.078.156 0 .312 0 .312.078m-40.64-15.25-.014-.015v.078a.4.4 0 0 0 .015-.063" clip-rule="evenodd"/></g><defs><clipPath id="clip0_6722_31933"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/kubeserver.svg b/web/packages/design/src/ResourceIcon/assets/kubeserver.svg
index daa1681dd2611..e0cd6397915a4 100644
--- a/web/packages/design/src/ResourceIcon/assets/kubeserver.svg
+++ b/web/packages/design/src/ResourceIcon/assets/kubeserver.svg
@@ -1,179 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M36.1246 59.7439V68.2484C35.5281 68.2503 34.9315 68.127 34.4755 67.8762L8.97093 53.9059C8.51493 53.655 8.28693 53.3266 8.28693 52.9999L8.31162 44.499C8.31162 44.7441 8.44085 44.9892 8.69723 45.2017C8.739 45.2379 8.7847 45.2721 8.83593 45.3044C8.88531 45.3386 8.93862 45.3709 8.99562 45.4013L34.4982 59.3716C34.9486 59.6186 35.5357 59.742 36.1228 59.7439H36.1246Z" fill="#C9D7DD"/>
-<path d="M63.7797 44.5588C63.7797 44.5759 63.7758 44.5948 63.774 44.6119C63.7606 44.6993 63.7301 44.7884 63.6828 44.874C63.6731 44.8911 63.6636 44.9082 63.6523 44.9252C63.6429 44.9405 63.6334 44.9557 63.6219 44.9707C63.6124 44.9841 63.6048 44.9954 63.5953 45.0069C63.5914 45.0106 63.5896 45.0146 63.5877 45.0164C63.5783 45.0298 63.5667 45.0411 63.5554 45.0545C63.5441 45.0695 63.5307 45.0829 63.5173 45.0962C63.4813 45.1341 63.4433 45.1682 63.4033 45.2024C63.3863 45.2158 63.3692 45.2292 63.3521 45.2442C63.3387 45.2539 63.3256 45.2633 63.3122 45.2746C63.3085 45.2786 63.3027 45.2822 63.299 45.2841C63.2893 45.2917 63.2799 45.2975 63.2686 45.3051C63.2439 45.3222 63.2192 45.3392 63.1924 45.3545C63.1659 45.3697 63.1393 45.3868 63.1107 45.402L37.7734 59.3723C37.3193 59.6229 36.7209 59.7464 36.1243 59.7446C35.5373 59.7427 34.9502 59.6192 34.5 59.3723L8.99534 45.402C8.93834 45.3697 8.88503 45.3374 8.83565 45.3051C8.78626 45.2709 8.73872 45.2368 8.69695 45.2024C8.44057 44.9899 8.31134 44.7448 8.31134 44.4997C8.31134 44.175 8.53565 43.8522 8.98403 43.6034L34.3213 29.633C35.2236 29.1354 36.6886 29.1354 37.5948 29.633L63.0976 43.6034C63.5764 43.8656 63.8044 44.2149 63.7776 44.5606L63.7797 44.5588Z" fill="white"/>
-<g opacity="0.6">
-<path d="M63.7797 44.5654C63.7797 44.5827 63.7758 44.6016 63.774 44.6187C63.7606 44.7059 63.7301 44.7952 63.6828 44.8808C63.6731 44.8979 63.6636 44.915 63.6523 44.932C63.6429 44.9473 63.6334 44.9623 63.6219 44.9775C63.6124 44.9909 63.6048 45.0022 63.5953 45.0137C63.5914 45.0174 63.5896 45.0214 63.5877 45.0232C63.5783 45.0364 63.5667 45.0479 63.5554 45.061C63.5441 45.0763 63.5307 45.0897 63.5173 45.1028C63.4813 45.1409 63.4433 45.175 63.4033 45.2092C63.3863 45.2226 63.3692 45.236 63.3521 45.251C63.3387 45.2607 63.3256 45.2701 63.3122 45.2814C63.3085 45.2854 63.3027 45.289 63.299 45.2909C63.2893 45.2985 63.2799 45.3043 63.2686 45.3119C63.2439 45.329 63.2192 45.346 63.1924 45.3613C63.1659 45.3765 63.1393 45.3936 63.1107 45.4086L37.7734 59.3791C37.3193 59.6297 36.7209 59.7532 36.1243 59.7514C35.5373 59.7495 34.9502 59.626 34.5 59.3791L8.99534 45.4067C8.93834 45.3744 8.88503 45.3421 8.83565 45.31C8.78626 45.2757 8.73872 45.2415 8.69695 45.2073C8.44057 44.9946 8.31134 44.7497 8.31134 44.5047C8.31134 44.18 8.53565 43.8571 8.98403 43.6083L34.3213 29.6378C35.2236 29.1403 36.6886 29.1403 37.5948 29.6378L63.0976 43.6083C63.5764 43.8703 63.8044 44.2199 63.7776 44.5654H63.7797Z" fill="url(#paint0_linear_7996_40426)"/>
-</g>
-<path d="M59.3568 44.5559C59.3568 44.5712 59.355 44.5845 59.3511 44.5998C59.3398 44.6738 59.3132 44.7498 59.2751 44.8199C59.2675 44.8333 59.2581 44.8485 59.2505 44.8638C59.241 44.8751 59.2334 44.8885 59.2258 44.9016C59.2181 44.9132 59.2105 44.9226 59.2029 44.9321C59.2011 44.9358 59.1992 44.9378 59.1953 44.9415C59.1877 44.9528 59.1782 44.9623 59.1688 44.9738C59.1593 44.9852 59.1478 44.9967 59.1365 45.0098C59.106 45.0422 59.0737 45.0708 59.0395 45.101C59.0395 45.101 59.034 45.1049 59.0319 45.1086C58.9618 45.0516 58.878 44.9946 58.785 44.9434L37.3368 33.1952C36.5748 32.7772 35.3418 32.7772 34.5838 33.1952L13.278 44.9434C13.1868 44.9928 13.1088 45.0461 13.0387 45.1031C13.0387 45.1031 13.0348 45.101 13.0348 45.0992C12.8183 44.9187 12.7119 44.7135 12.7119 44.5086C12.7119 44.2349 12.9 43.9635 13.278 43.7545L34.5838 32.0062C35.3418 31.5865 36.5748 31.5865 37.3368 32.0062L58.785 43.7545C59.1877 43.9748 59.3797 44.2693 59.3568 44.5598V44.5559Z" fill="#6E17FF"/>
-<path d="M59.0322 45.1049C59.0209 45.1144 59.0094 45.1238 58.9962 45.1333C58.9847 45.1409 58.9734 45.1504 58.9621 45.158C58.9581 45.1598 58.9544 45.1637 58.9505 45.1656C58.9411 45.1714 58.9334 45.1769 58.9258 45.1827C58.9051 45.196 58.8841 45.2092 58.8612 45.2244C58.8386 45.2378 58.8158 45.251 58.7929 45.2644L37.4871 57.0128C37.1052 57.2235 36.6017 57.328 36.1002 57.3262C35.6061 57.3241 35.1123 57.2198 34.7341 57.0128L13.2878 45.2644C13.2402 45.2378 13.1948 45.2113 13.153 45.1827C13.1131 45.1561 13.075 45.1275 13.0408 45.0991C13.1091 45.0421 13.189 44.989 13.2801 44.9397L34.5859 33.1912C35.344 32.7735 36.577 32.7735 37.339 33.1912L58.7871 44.9397C58.8804 44.9909 58.9621 45.046 59.0341 45.1049H59.0322Z" fill="#C9D7DD"/>
-<path d="M59.0322 45.1068C59.0209 45.1163 59.0094 45.1258 58.9962 45.1352C58.9847 45.1428 58.9734 45.1523 58.9621 45.1599C58.9581 45.162 58.9544 45.1657 58.9505 45.1675C58.9411 45.1733 58.9334 45.1791 58.9258 45.1846C58.9051 45.198 58.8841 45.2114 58.8612 45.2264C58.8386 45.2398 58.8158 45.2532 58.7929 45.2663L37.4871 57.0148C37.1052 57.2255 36.6017 57.33 36.1002 57.3282C35.6061 57.3263 35.1123 57.2218 34.7341 57.0148L13.2878 45.2663C13.2402 45.2398 13.1948 45.2132 13.153 45.1846C13.1131 45.1581 13.075 45.1297 13.0408 45.1011C13.1091 45.0441 13.189 44.991 13.2801 44.9416L34.5859 33.1932C35.344 32.7755 36.577 32.7755 37.339 33.1932L58.7871 44.9416C58.8804 44.9928 58.9621 45.048 59.0341 45.1068H59.0322Z" fill="url(#paint1_linear_7996_40426)"/>
-<path d="M63.7837 44.5088L63.759 53.0133C63.759 53.3362 63.5329 53.6609 63.0863 53.9078L37.749 67.8781C37.3006 68.125 36.7136 68.2485 36.1246 68.2503V59.7458C36.7212 59.7479 37.3196 59.6244 37.7737 59.3736L63.111 45.4033C63.1396 45.388 63.1662 45.3709 63.1929 45.3557C63.2195 45.3405 63.2442 45.3234 63.2689 45.3063C63.2802 45.2987 63.2896 45.2929 63.2993 45.2856C63.3049 45.2816 63.3088 45.2779 63.3125 45.2759C63.3259 45.2664 63.339 45.2569 63.3524 45.2456C63.3695 45.2323 63.3884 45.2189 63.4036 45.2039C63.4454 45.1697 63.4835 45.1335 63.5176 45.0975C63.531 45.0841 63.5444 45.0709 63.5557 45.0557C63.567 45.0423 63.5767 45.031 63.588 45.0176C63.5917 45.0139 63.5938 45.0119 63.5956 45.0082C63.6051 44.9969 63.6146 44.9835 63.6222 44.9722C63.6337 44.9569 63.6432 44.9417 63.6526 44.9265C63.6639 44.9094 63.6734 44.8923 63.6831 44.8753C63.7304 44.7899 63.7609 44.7024 63.7743 44.6131C63.7779 44.596 63.7798 44.5771 63.7798 44.56C63.7819 44.5429 63.7837 44.5259 63.7837 44.5088Z" fill="#C9D7DD"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M63.7837 44.5162L63.759 53.0209C63.759 53.3438 63.5329 53.6685 63.0863 53.9154L37.749 67.8857C37.3006 68.1326 36.7135 68.2561 36.1246 68.2579C35.5281 68.26 34.9315 68.1366 34.4755 67.8857L8.97093 53.9154C8.51493 53.6646 8.28693 53.3362 8.28693 53.0094L8.31162 44.5088C8.31162 44.7536 8.44085 44.9987 8.69723 45.2115C8.739 45.2475 8.7847 45.2816 8.83593 45.3139C8.88531 45.3481 8.93862 45.3804 8.99562 45.4109L34.4982 59.3812C34.9486 59.6281 35.5357 59.7516 36.1228 59.7534C36.7193 59.7552 37.3177 59.632 37.7718 59.3812L63.1092 45.4109C63.1378 45.3956 63.1643 45.3786 63.1908 45.3633C63.2174 45.3481 63.2423 45.331 63.267 45.3139C63.2783 45.3063 63.2878 45.3006 63.2972 45.2929C63.303 45.2893 63.3067 45.2856 63.3106 45.2835C63.324 45.274 63.3372 45.2646 63.3505 45.2533C63.3676 45.2399 63.3865 45.2265 63.4018 45.2115C63.4435 45.1771 63.4816 45.1411 63.5158 45.1051C63.5292 45.0917 63.5423 45.0783 63.5539 45.0633C63.5652 45.0499 63.5746 45.0386 63.5862 45.0253C63.5898 45.0216 63.5917 45.0195 63.5938 45.0158C63.6032 45.0045 63.6127 44.9911 63.6203 44.9798C63.6316 44.9646 63.6411 44.9493 63.6508 44.9341C63.6621 44.917 63.6715 44.8999 63.681 44.8829C63.7285 44.7973 63.759 44.71 63.7724 44.6207C63.7761 44.6036 63.7779 44.5847 63.7779 44.5676C63.7798 44.5506 63.7818 44.5335 63.7818 44.5162H63.7837Z" fill="url(#paint2_linear_7996_40426)"/>
-</g>
-<path d="M63.7837 44.5202L63.759 53.0247C63.759 53.3476 63.5329 53.6723 63.0863 53.9192L37.749 67.8897C37.3006 68.1367 36.7135 68.2601 36.1246 68.262C35.5281 68.2638 34.9315 68.1404 34.4755 67.8897L8.97093 53.9174C8.51493 53.6667 8.28693 53.3381 8.28693 53.0114L8.31162 44.5107C8.31162 44.7556 8.44085 45.0007 8.69723 45.2134C8.739 45.2494 8.7847 45.2836 8.83593 45.3159C8.88531 45.35 8.93862 45.3824 8.99562 45.4128L34.4982 59.3831C34.9486 59.63 35.5357 59.7535 36.1228 59.7554C36.7193 59.7574 37.3177 59.634 37.7718 59.3831L63.1092 45.4128C63.1378 45.3976 63.1643 45.3805 63.1908 45.3653C63.2174 45.35 63.2423 45.333 63.267 45.3159C63.2783 45.3083 63.2878 45.3027 63.2972 45.2951C63.303 45.2912 63.3067 45.2875 63.3106 45.2857C63.324 45.276 63.3372 45.2665 63.3505 45.2552C63.3676 45.2418 63.3865 45.2287 63.4018 45.2134C63.4435 45.1793 63.4816 45.143 63.5158 45.107C63.5292 45.0937 63.5423 45.0805 63.5539 45.0653C63.5652 45.0519 63.5746 45.0406 63.5862 45.0272C63.5898 45.0235 63.5917 45.0217 63.5938 45.0177C63.6032 45.0064 63.6127 44.993 63.6203 44.9817C63.6316 44.9665 63.6411 44.9513 63.6508 44.936C63.6621 44.919 63.6715 44.9019 63.681 44.8848C63.7285 44.7994 63.759 44.712 63.7724 44.6227C63.7761 44.6056 63.7779 44.5867 63.7779 44.5696C63.7798 44.5525 63.7818 44.5354 63.7818 44.5184L63.7837 44.5202Z" fill="url(#paint3_linear_7996_40426)"/>
-<path d="M36.1246 46.9928V55.4973C35.5281 55.4992 34.9315 55.3759 34.4755 55.1251L8.97093 41.1566C8.51493 40.906 8.28693 40.5774 8.28693 40.2506L8.31162 31.75C8.31162 31.9948 8.44085 32.2399 8.69723 32.4527C8.739 32.4887 8.7847 32.5228 8.83593 32.5552C8.88531 32.5893 8.93862 32.6216 8.99562 32.6521L34.4982 46.6224C34.9486 46.8693 35.5357 46.9928 36.1228 46.9946L36.1246 46.9928Z" fill="#C9D7DD"/>
-<path d="M63.7797 31.8087C63.7797 31.8258 63.7758 31.8447 63.774 31.8618C63.7606 31.9493 63.7301 32.0386 63.6828 32.1239C63.6731 32.141 63.6637 32.1581 63.6523 32.1752C63.6429 32.1904 63.6334 32.2056 63.6219 32.2209C63.6124 32.234 63.6048 32.2456 63.5953 32.2569C63.5914 32.2606 63.5896 32.2645 63.5877 32.2663C63.5783 32.2797 63.5667 32.291 63.5554 32.3044C63.5441 32.3196 63.5307 32.3328 63.5173 32.3462C63.4813 32.384 63.4433 32.4184 63.4033 32.4526C63.3863 32.4657 63.3692 32.4791 63.3521 32.4943C63.3387 32.5038 63.3256 32.5133 63.3122 32.5246C63.3085 32.5285 63.3027 32.5322 63.299 32.5343C63.2893 32.5419 63.2799 32.5474 63.2686 32.555C63.2439 32.5721 63.2192 32.5892 63.1926 32.6044C63.1659 32.6196 63.1393 32.6367 63.111 32.6519L37.7734 46.6223C37.3195 46.8731 36.7209 46.9966 36.1243 46.9945C35.5373 46.9926 34.9502 46.8692 34.5 46.6223L8.99534 32.6519C8.93834 32.6196 8.88503 32.5873 8.83565 32.555C8.78626 32.5209 8.73872 32.4867 8.69695 32.4526C8.44057 32.2398 8.31134 31.9947 8.31134 31.7499C8.31134 31.4249 8.53565 31.1021 8.98403 30.8534L34.3232 16.883C35.2257 16.3854 36.6904 16.3854 37.5969 16.883L63.0994 30.8534C63.5783 31.1155 63.8063 31.4649 63.7797 31.8106V31.8087Z" fill="white"/>
-<g opacity="0.6">
-<path d="M63.7797 31.8144C63.7797 31.8317 63.7758 31.8506 63.774 31.8677C63.7606 31.955 63.7301 32.0443 63.6828 32.1299C63.6731 32.147 63.6637 32.164 63.6523 32.1811C63.6429 32.1963 63.6334 32.2116 63.6219 32.2266C63.6124 32.24 63.6048 32.2513 63.5953 32.2628C63.5914 32.2665 63.5896 32.2704 63.5877 32.2723C63.5783 32.2854 63.5667 32.297 63.5554 32.3101C63.5441 32.3253 63.5307 32.3387 63.5173 32.3521C63.4813 32.39 63.4433 32.4241 63.4033 32.4583C63.3863 32.4716 63.3692 32.485 63.3521 32.5C63.3387 32.5097 63.3256 32.5192 63.3122 32.5305C63.3085 32.5344 63.3027 32.5381 63.299 32.54C63.2893 32.5476 63.2799 32.5533 63.2686 32.561C63.2439 32.578 63.2192 32.5951 63.1926 32.6103C63.1659 32.6256 63.1393 32.6426 63.111 32.6579L37.7734 46.6282C37.3195 46.8788 36.7209 47.0023 36.1243 47.0004C35.5373 46.9986 34.9502 46.8751 34.5 46.6282L8.99534 32.6579C8.93834 32.6256 8.88503 32.5933 8.83565 32.561C8.78626 32.5268 8.73872 32.4926 8.69695 32.4583C8.44057 32.2457 8.31134 32.0006 8.31134 31.7556C8.31134 31.4309 8.53565 31.108 8.98403 30.8592L34.3232 16.8888C35.2257 16.3912 36.6904 16.3912 37.5969 16.8888L63.0994 30.8592C63.5783 31.1214 63.8063 31.4708 63.7797 31.8165V31.8144Z" fill="url(#paint4_linear_7996_40426)"/>
-</g>
-<path d="M59.3568 31.805C59.3568 31.8202 59.355 31.8336 59.3511 31.8488C59.3398 31.9229 59.3132 31.9988 59.2751 32.069C59.2675 32.0824 59.2581 32.0976 59.2505 32.1128C59.241 32.1241 59.2334 32.1375 59.2258 32.1507C59.2181 32.1622 59.2105 32.1717 59.2029 32.1811C59.2011 32.1848 59.1992 32.1869 59.1953 32.1906C59.1877 32.2019 59.1782 32.2116 59.1688 32.2229C59.1593 32.2342 59.1478 32.2458 59.1365 32.2589C59.106 32.2912 59.0737 32.3198 59.0395 32.3501C59.0395 32.3501 59.034 32.354 59.0319 32.3577C58.9618 32.3007 58.878 32.2437 58.785 32.1924L37.3368 20.4441C36.5748 20.0263 35.3418 20.0263 34.5838 20.4441L13.278 32.1924C13.1868 32.2418 13.1088 32.2951 13.0387 32.3521C13.0387 32.3521 13.0348 32.3501 13.0348 32.3482C12.8183 32.1678 12.7119 31.9626 12.7119 31.7577C12.7119 31.484 12.9 31.2126 13.278 31.0035L34.5838 19.2552C35.3418 18.8355 36.5748 18.8355 37.3368 19.2552L58.785 31.0035C59.1877 31.2239 59.3797 31.5184 59.3568 31.8089V31.805Z" fill="#6E17FF"/>
-<path d="M59.0322 32.354C59.0209 32.3634 59.0094 32.3729 58.9962 32.3824C58.9847 32.39 58.9734 32.3994 58.9621 32.4071C58.9581 32.4089 58.9544 32.4128 58.9505 32.4147C58.9411 32.4204 58.9334 32.426 58.9258 32.4317C58.9051 32.4451 58.8841 32.4583 58.8612 32.4735C58.8386 32.4869 58.8158 32.5001 58.7929 32.5134L37.4871 44.2619C37.1052 44.4726 36.6017 44.5771 36.1002 44.5753C35.6061 44.5732 35.1123 44.4689 34.7341 44.2619L13.2878 32.5134C13.2402 32.4869 13.1948 32.4604 13.153 32.4317C13.1131 32.4052 13.075 32.3768 13.0408 32.3482C13.1091 32.2912 13.189 32.2381 13.2801 32.1887L34.5859 20.4403C35.344 20.0225 36.577 20.0225 37.339 20.4403L58.7871 32.1887C58.8804 32.24 58.9621 32.2951 59.0341 32.354H59.0322Z" fill="#C9D7DD"/>
-<path d="M59.0322 32.3559C59.0209 32.3653 59.0094 32.3748 58.9962 32.3843C58.9847 32.3919 58.9734 32.4016 58.9621 32.409C58.9581 32.411 58.9544 32.4147 58.9505 32.4166C58.9411 32.4223 58.9334 32.4281 58.9258 32.4336C58.9051 32.447 58.8841 32.4604 58.8612 32.4754C58.8386 32.4888 58.8158 32.5022 58.7929 32.5153L37.4871 44.2638C37.1052 44.4745 36.6017 44.579 36.1002 44.5772C35.6061 44.5753 35.1123 44.4708 34.7341 44.2638L13.2878 32.5153C13.2402 32.4888 13.1948 32.4623 13.153 32.4336C13.1131 32.4071 13.075 32.3787 13.0408 32.3501C13.1091 32.2931 13.189 32.24 13.2801 32.1906L34.5859 20.4423C35.344 20.0244 36.577 20.0244 37.339 20.4423L58.7871 32.1906C58.8804 32.2419 58.9621 32.297 59.0341 32.3559H59.0322Z" fill="url(#paint5_linear_7996_40426)"/>
-<path d="M63.7837 31.7578L63.759 40.2624C63.759 40.5852 63.5329 40.9099 63.0863 41.1568L37.749 55.1271C37.3006 55.374 36.7136 55.4975 36.1246 55.4993V46.9948C36.7212 46.9969 37.3196 46.8734 37.7737 46.6226L63.111 32.6523C63.1396 32.637 63.1662 32.62 63.1929 32.6047C63.2195 32.5895 63.2442 32.5724 63.2689 32.5554C63.2802 32.5477 63.2896 32.542 63.2993 32.5346C63.3049 32.5307 63.3088 32.527 63.3125 32.5249C63.3259 32.5154 63.339 32.506 63.3524 32.4947C63.3695 32.4813 63.3884 32.4681 63.4036 32.4529C63.4454 32.4187 63.4835 32.3825 63.5176 32.3465C63.531 32.3331 63.5444 32.32 63.5557 32.3047C63.567 32.2914 63.5767 32.28 63.588 32.2667C63.5917 32.263 63.5938 32.2609 63.5956 32.2572C63.6051 32.2459 63.6146 32.2325 63.6222 32.2212C63.6337 32.206 63.6432 32.1907 63.6526 32.1755C63.6639 32.1584 63.6734 32.1414 63.6831 32.1243C63.7304 32.0389 63.7609 31.9514 63.7743 31.8621C63.7779 31.845 63.7798 31.8261 63.7798 31.809C63.7819 31.792 63.7837 31.7749 63.7837 31.7578Z" fill="#C9D7DD"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M63.7837 31.7673L63.759 40.2718C63.759 40.5947 63.5329 40.9194 63.0863 41.1663L37.749 55.1368C37.3006 55.3835 36.7135 55.507 36.1246 55.509C35.5281 55.5109 34.9315 55.3874 34.4755 55.1368L8.97093 41.1644C8.51493 40.9136 8.28693 40.5852 8.28693 40.2584L8.31162 31.7578C8.31162 32.0027 8.44085 32.2477 8.69723 32.4605C8.739 32.4965 8.7847 32.5307 8.83593 32.563C8.88531 32.5971 8.93862 32.6294 8.99562 32.6599L34.4982 46.6302C34.9486 46.8771 35.5357 47.0006 36.1228 47.0024C36.7193 47.0045 37.3177 46.881 37.7718 46.6302L63.1092 32.6599C63.1378 32.6447 63.1643 32.6276 63.1908 32.6124C63.2174 32.5971 63.2423 32.58 63.267 32.563C63.2783 32.5554 63.2878 32.5496 63.2972 32.542C63.303 32.5383 63.3067 32.5346 63.3106 32.5325C63.324 32.523 63.3372 32.5136 63.3505 32.5023C63.3676 32.4889 63.3865 32.4755 63.4018 32.4605C63.4435 32.4261 63.4816 32.3901 63.5158 32.3541C63.5292 32.3407 63.5423 32.3276 63.5539 32.3124C63.5652 32.299 63.5746 32.2877 63.5862 32.2743C63.5898 32.2706 63.5917 32.2685 63.5938 32.2648C63.6032 32.2535 63.6127 32.2401 63.6203 32.2288C63.6316 32.2136 63.6411 32.1984 63.6508 32.1831C63.6621 32.166 63.6715 32.149 63.681 32.1319C63.7285 32.0463 63.759 31.959 63.7724 31.8697C63.7761 31.8527 63.7779 31.8337 63.7779 31.8167C63.7798 31.7996 63.7818 31.7825 63.7818 31.7652L63.7837 31.7673Z" fill="url(#paint6_linear_7996_40426)"/>
-</g>
-<path d="M63.7837 31.7693L63.759 40.2739C63.759 40.5967 63.5329 40.9214 63.0863 41.1683L37.749 55.1389C37.3006 55.3858 36.7135 55.5093 36.1246 55.5111C35.5281 55.513 34.9315 55.3895 34.4755 55.1389L8.97093 41.1683C8.51493 40.9177 8.28693 40.5891 8.28693 40.2626L8.31162 31.7617C8.31162 32.0068 8.44085 32.2516 8.69723 32.4644C8.739 32.5004 8.7847 32.5348 8.83593 32.5669C8.88531 32.6013 8.93862 32.6336 8.99562 32.6638L34.4982 46.6343C34.9486 46.8813 35.5357 47.0047 36.1228 47.0066C36.7193 47.0084 37.3177 46.8849 37.7718 46.6343L63.1092 32.6638C63.1378 32.6486 63.1643 32.6315 63.1908 32.6163C63.2174 32.6013 63.2423 32.5842 63.267 32.5669C63.2783 32.5595 63.2878 32.5537 63.2972 32.5461C63.303 32.5422 63.3067 32.5385 63.3106 32.5366C63.324 32.5272 63.3372 32.5177 63.3505 32.5062C63.3676 32.493 63.3865 32.4796 63.4018 32.4644C63.4435 32.4303 63.4816 32.3943 63.5158 32.358C63.5292 32.3449 63.5423 32.3315 63.5539 32.3163C63.5652 32.3031 63.5746 32.2916 63.5862 32.2784C63.5898 32.2745 63.5917 32.2726 63.5938 32.2687C63.6032 32.2574 63.6127 32.244 63.6203 32.2327C63.6316 32.2175 63.6411 32.2023 63.6508 32.1873C63.6621 32.1699 63.6715 32.1529 63.681 32.1358C63.7285 32.0504 63.759 31.9629 63.7724 31.8739C63.7761 31.8568 63.7779 31.8376 63.7779 31.8206C63.7798 31.8035 63.7818 31.7864 63.7818 31.7693H63.7837Z" fill="url(#paint7_linear_7996_40426)"/>
-<g opacity="0.4">
-<path opacity="0.4" d="M60.7263 36.8221C61.4408 36.4215 62.0279 36.7462 62.0297 37.5439C62.0315 38.3435 61.4502 39.3234 60.7358 39.7242L39.1831 51.8239C38.4686 52.2245 37.8816 51.8999 37.8797 51.1021C37.8779 50.3045 38.4592 49.3226 39.1755 48.922L60.7282 36.8221H60.7263Z" fill="white"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M42.3643 47.7982C42.8051 47.5568 43.1623 47.7507 43.1642 48.2293C43.1642 48.7079 42.809 49.2908 42.3701 49.532C41.9312 49.7734 41.5703 49.5795 41.5682 49.1009C41.5682 48.6223 41.9236 48.0375 42.3643 47.7982Z" fill="white"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M50.6368 43.1703C51.0776 42.9289 51.4346 43.1227 51.4366 43.6014C51.4366 44.08 51.0813 44.6629 50.6423 44.904C50.2034 45.1454 49.8425 44.9516 49.8406 44.473C49.8406 43.9944 50.196 43.4094 50.6368 43.1703Z" fill="white"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M58.6805 38.5774C59.1212 38.3362 59.4785 38.5299 59.4803 39.0085C59.4822 39.4871 59.1252 40.07 58.6862 40.3114C58.2473 40.5526 57.8864 40.3587 57.8846 39.8801C57.8846 39.4017 58.2397 38.8167 58.6805 38.5774Z" fill="white"/>
-</g>
-<g opacity="0.4">
-<path opacity="0.4" d="M60.7264 49.326C61.4409 48.9254 62.028 49.2501 62.0298 50.0478C62.0317 50.8475 61.4504 51.8273 60.7359 52.2281L39.1832 64.3278C38.4688 64.7284 37.8817 64.4038 37.8798 63.606C37.878 62.8084 38.4593 61.8265 39.1756 61.4259L60.7283 49.326H60.7264Z" fill="white"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M42.3643 60.3011C42.8051 60.0598 43.1623 60.2536 43.1642 60.7322C43.1642 61.2108 42.809 61.7938 42.3701 62.0349C41.9312 62.2763 41.5703 62.0824 41.5682 61.6038C41.5682 61.1252 41.9236 60.5404 42.3643 60.3011Z" fill="white"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M50.6368 55.6732C51.0776 55.4318 51.4346 55.6257 51.4366 56.1043C51.4366 56.5829 51.0813 57.1658 50.6423 57.407C50.2034 57.6484 49.8425 57.4545 49.8406 56.9759C49.8406 56.4973 50.196 55.9123 50.6368 55.6732Z" fill="white"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M58.6807 51.0813C59.1214 50.8402 59.4787 51.0338 59.4805 51.5124C59.4824 51.991 59.1254 52.5739 58.6864 52.8153C58.2475 53.0565 57.8866 52.8626 57.8847 52.384C57.8847 51.9056 58.2399 51.3206 58.6807 51.0813Z" fill="white"/>
-</g>
-<path d="M36.1246 34.2437V42.7485C35.5281 42.7503 34.9315 42.6269 34.4755 42.376L8.97093 28.4057C8.51493 28.155 8.28693 27.8265 8.28693 27.4998L8.31162 18.999C8.31162 19.244 8.44085 19.489 8.69723 19.7017C8.739 19.7378 8.7847 19.772 8.83593 19.8043C8.88531 19.8385 8.93862 19.8708 8.99562 19.9011L34.4982 33.8715C34.9486 34.1184 35.5357 34.2419 36.1228 34.2437H36.1246Z" fill="#C9D7DD"/>
-<path d="M63.7797 19.0577C63.7797 19.0748 63.7758 19.0938 63.774 19.1109C63.7606 19.1982 63.7301 19.2875 63.6828 19.373C63.6731 19.39 63.6637 19.4071 63.6523 19.4242C63.6429 19.4394 63.6334 19.4546 63.6219 19.4698C63.6124 19.4831 63.6048 19.4945 63.5953 19.5059C63.5914 19.5097 63.5896 19.5135 63.5877 19.5154C63.5783 19.5287 63.5667 19.5401 63.5554 19.5534C63.5441 19.5686 63.5307 19.5819 63.5173 19.5952C63.4813 19.6332 63.4433 19.6673 63.4033 19.7015C63.3863 19.7148 63.3692 19.7281 63.3521 19.7433C63.3387 19.7528 63.3256 19.7623 63.3122 19.7737C63.3085 19.7775 63.3027 19.7813 63.299 19.7832C63.2893 19.7908 63.2799 19.7965 63.2686 19.8041C63.2439 19.8212 63.2192 19.8383 63.1926 19.8535C63.1659 19.8687 63.1393 19.8857 63.111 19.9009L37.7734 33.8713C37.3195 34.1221 36.7209 34.2456 36.1243 34.2435C35.5373 34.2417 34.9502 34.1182 34.5 33.8713L8.99534 19.9009C8.93834 19.8687 8.88503 19.8364 8.83565 19.8041C8.78626 19.7699 8.73872 19.7357 8.69695 19.7015C8.44057 19.4888 8.31134 19.2438 8.31134 18.9988C8.31134 18.6741 8.53565 18.3512 8.98403 18.1024L34.3232 4.13198C35.2257 3.63439 36.6904 3.63439 37.5969 4.13198L63.0994 18.1024C63.5783 18.3645 63.8063 18.7139 63.7797 19.0596V19.0577Z" fill="white"/>
-<g opacity="0.6">
-<path d="M63.7797 19.0636C63.7797 19.0807 63.7758 19.0996 63.774 19.1167C63.7606 19.2041 63.7301 19.2934 63.6828 19.3788C63.6731 19.3959 63.6637 19.413 63.6523 19.4301C63.6429 19.4453 63.6334 19.4605 63.6219 19.4757C63.6124 19.489 63.6048 19.5004 63.5953 19.5118C63.5914 19.5156 63.5896 19.5194 63.5877 19.5213C63.5783 19.5346 63.5667 19.546 63.5554 19.5592C63.5441 19.5744 63.5307 19.5877 63.5173 19.601C63.4813 19.639 63.4433 19.6732 63.4033 19.7074C63.3863 19.7207 63.3692 19.734 63.3521 19.7492C63.3387 19.7587 63.3256 19.7682 63.3122 19.7795C63.3085 19.7833 63.3027 19.7872 63.299 19.789C63.2893 19.7966 63.2799 19.8023 63.2686 19.8099C63.2439 19.827 63.2192 19.8441 63.1926 19.8593C63.1659 19.8745 63.1393 19.8916 63.111 19.9068L37.7734 33.8772C37.3195 34.1278 36.7209 34.2513 36.1243 34.2494C35.5373 34.2476 34.9502 34.1241 34.5 33.8772L8.99534 19.9068C8.93834 19.8745 8.88503 19.8422 8.83565 19.8099C8.78626 19.7758 8.73872 19.7416 8.69695 19.7074C8.44057 19.4947 8.31134 19.2497 8.31134 19.0047C8.31134 18.6799 8.53565 18.3571 8.98403 18.1083L34.3232 4.13784C35.2257 3.64025 36.6904 3.64025 37.5969 4.13784L63.0994 18.1083C63.5783 18.3703 63.8063 18.7198 63.7797 19.0654V19.0636Z" fill="url(#paint8_linear_7996_40426)"/>
-</g>
-<path d="M59.3568 19.0559C59.3568 19.0711 59.355 19.0844 59.3511 19.0996C59.3398 19.1737 59.3132 19.2496 59.2751 19.3199C59.2675 19.3332 59.2581 19.3484 59.2505 19.3636C59.241 19.375 59.2334 19.3883 59.2258 19.4016C59.2181 19.413 59.2105 19.4225 59.2029 19.432C59.2011 19.4357 59.1992 19.4377 59.1953 19.4414C59.1877 19.4528 59.1782 19.4624 59.1688 19.4737C59.1593 19.4851 59.1478 19.4965 59.1365 19.5098C59.106 19.5421 59.0737 19.5706 59.0395 19.601C59.0395 19.601 59.034 19.6048 59.0319 19.6086C58.9618 19.5516 58.878 19.4946 58.785 19.4434L37.3368 7.69498C36.5748 7.27716 35.3418 7.27716 34.5838 7.69498L13.278 19.4396C13.1868 19.4889 13.1088 19.5421 13.0387 19.5991C13.0387 19.5991 13.0348 19.5972 13.0348 19.5953C12.8183 19.4149 12.7119 19.2098 12.7119 19.0046C12.7119 18.7312 12.9 18.4596 13.278 18.2507L34.5838 6.50229C35.3418 6.08257 36.5748 6.08257 37.3368 6.50229L58.785 18.2507C59.1877 18.471 59.3797 18.7653 59.3568 19.0559Z" fill="#6E17FF"/>
-<path d="M59.0319 19.603C59.0206 19.6125 59.0091 19.622 58.9959 19.6315C58.9844 19.6391 58.9731 19.6486 58.9618 19.6562C58.9578 19.6581 58.9542 19.6619 58.9502 19.6638C58.9408 19.6695 58.9332 19.6752 58.9255 19.6809C58.9048 19.6942 58.8838 19.7075 58.8609 19.7227C58.8381 19.736 58.8155 19.7492 58.7926 19.7625L37.4869 31.511C37.1049 31.7217 36.6014 31.8262 36.0999 31.8244C35.6059 31.8223 35.112 31.718 34.7338 31.511L13.2856 19.7644C13.2381 19.7378 13.1926 19.7113 13.1506 19.6828C13.1109 19.6562 13.0729 19.6277 13.0387 19.5992C13.107 19.5422 13.1869 19.4891 13.278 19.4397L34.5838 7.69129C35.3418 7.27347 36.5748 7.27347 37.3368 7.69129L58.785 19.4397C58.878 19.4909 58.9597 19.546 59.0319 19.6049V19.603Z" fill="#C9D7DD"/>
-<path d="M59.0319 19.6068C59.0206 19.6163 59.0091 19.6258 58.9959 19.6353C58.9844 19.6429 58.9731 19.6524 58.9618 19.66C58.9578 19.6619 58.9542 19.6657 58.9502 19.6676C58.9408 19.6733 58.9332 19.679 58.9255 19.6847C58.9048 19.698 58.8838 19.7113 58.8609 19.7265C58.8381 19.7398 58.8155 19.7531 58.7926 19.7664L37.4869 31.5147C37.1049 31.7256 36.6014 31.8299 36.0999 31.8281C35.6059 31.8263 35.112 31.7217 34.7338 31.5147L13.2856 19.7664C13.2381 19.7398 13.1926 19.7132 13.1506 19.6847C13.1109 19.6581 13.0729 19.6296 13.0387 19.6012C13.107 19.5442 13.1869 19.491 13.278 19.4416L34.5838 7.69325C35.3418 7.27543 36.5748 7.27543 37.3368 7.69325L58.785 19.4416C58.878 19.4929 58.9597 19.548 59.0319 19.6068Z" fill="url(#paint9_linear_7996_40426)"/>
-<path d="M63.7837 19.0068L63.759 27.5114C63.759 27.8343 63.5329 28.159 63.0863 28.4059L37.749 42.3762C37.3006 42.6232 36.7136 42.7466 36.1246 42.7487V34.2439C36.7212 34.246 37.3196 34.1225 37.7737 33.8717L63.111 19.9014C63.1396 19.8862 63.1662 19.8691 63.1929 19.8539C63.2195 19.8387 63.2442 19.8216 63.2689 19.8045C63.2802 19.7969 63.2896 19.7912 63.2993 19.7836C63.3049 19.7798 63.3088 19.776 63.3125 19.7741C63.3259 19.7646 63.339 19.7551 63.3524 19.7437C63.3695 19.7304 63.3884 19.7171 63.4036 19.7019C63.4454 19.6678 63.4835 19.6317 63.5176 19.5956C63.531 19.5823 63.5444 19.569 63.5557 19.5538C63.567 19.5405 63.5767 19.5291 63.588 19.5158C63.5917 19.512 63.5938 19.5101 63.5956 19.5063C63.6051 19.4949 63.6146 19.4816 63.6222 19.4702C63.6337 19.4551 63.6432 19.4399 63.6526 19.4247C63.6639 19.4076 63.6734 19.3905 63.6831 19.3734C63.7304 19.2879 63.7609 19.2006 63.7743 19.1113C63.7779 19.0942 63.7798 19.0752 63.7798 19.0581C63.7819 19.041 63.7837 19.0239 63.7837 19.0068Z" fill="#C9D7DD"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M63.7837 19.0164L63.759 27.5209C63.759 27.8438 63.5329 28.1685 63.0863 28.4155L37.749 42.386C37.3006 42.6329 36.7135 42.7561 36.1246 42.7582C35.5281 42.76 34.9315 42.6366 34.4755 42.386L8.97093 28.4155C8.51493 28.1648 8.28693 27.8362 8.28693 27.5095L8.31162 19.0088C8.31162 19.2538 8.44085 19.4988 8.69723 19.7115C8.739 19.7476 8.7847 19.7818 8.83593 19.814C8.88531 19.8482 8.93862 19.8805 8.99562 19.9109L34.4982 33.8814C34.9486 34.1281 35.5357 34.2516 36.1228 34.2537C36.7193 34.2555 37.3177 34.132 37.7718 33.8814L63.1092 19.9109C63.1378 19.8957 63.1643 19.8786 63.1908 19.8634C63.2174 19.8482 63.2423 19.8311 63.267 19.814C63.2783 19.8064 63.2878 19.8007 63.2972 19.7932C63.303 19.7893 63.3067 19.7855 63.3106 19.7836C63.324 19.7742 63.3372 19.7647 63.3505 19.7533C63.3676 19.74 63.3865 19.7267 63.4018 19.7115C63.4435 19.6773 63.4816 19.6412 63.5158 19.6051C63.5292 19.5918 63.5423 19.5785 63.5539 19.5634C63.5652 19.5501 63.5746 19.5387 63.5862 19.5254C63.5898 19.5216 63.5917 19.5197 63.5938 19.5159C63.6032 19.5045 63.6127 19.4912 63.6203 19.4798C63.6316 19.4646 63.6411 19.4494 63.6508 19.4342C63.6621 19.4171 63.6715 19.4 63.681 19.3829C63.7285 19.2975 63.759 19.2101 63.7724 19.1208C63.7761 19.1037 63.7779 19.0847 63.7779 19.0677C63.7798 19.0506 63.7818 19.0335 63.7818 19.0164H63.7837Z" fill="url(#paint10_linear_7996_40426)"/>
-</g>
-<path d="M63.7837 19.0174L63.759 27.5219C63.759 27.8448 63.5329 28.1695 63.0863 28.4164L37.749 42.3869C37.3006 42.6338 36.7135 42.7573 36.1246 42.7591C35.5281 42.761 34.9315 42.6375 34.4755 42.3869L8.97093 28.4164C8.51493 28.1657 8.28693 27.8372 8.28693 27.5105L8.31162 19.0098C8.31162 19.2548 8.44085 19.4998 8.69723 19.7125C8.739 19.7486 8.7847 19.7827 8.83593 19.815C8.88531 19.8492 8.93862 19.8815 8.99562 19.9119L34.4982 33.8824C34.9486 34.1293 35.5357 34.2527 36.1228 34.2546C36.7193 34.2564 37.3177 34.133 37.7718 33.8824L63.1092 19.9119C63.1378 19.8967 63.1643 19.8796 63.1908 19.8644C63.2174 19.8492 63.2423 19.8321 63.267 19.815C63.2783 19.8074 63.2878 19.8017 63.2972 19.7941C63.303 19.7903 63.3067 19.7865 63.3106 19.7846C63.324 19.7751 63.3372 19.7656 63.3505 19.7543C63.3676 19.741 63.3865 19.7276 63.4018 19.7125C63.4435 19.6783 63.4816 19.6422 63.5158 19.6061C63.5292 19.5928 63.5423 19.5795 63.5539 19.5643C63.5652 19.551 63.5746 19.5396 63.5862 19.5263C63.5898 19.5225 63.5917 19.5206 63.5938 19.5168C63.6032 19.5055 63.6127 19.4921 63.6203 19.4808C63.6316 19.4656 63.6411 19.4504 63.6508 19.4352C63.6621 19.4181 63.6715 19.401 63.681 19.3839C63.7285 19.2984 63.759 19.2111 63.7724 19.1218C63.7761 19.1047 63.7779 19.0857 63.7779 19.0686C63.7798 19.0515 63.7818 19.0345 63.7818 19.0174H63.7837Z" fill="url(#paint11_linear_7996_40426)"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M60.7263 24.0721C61.4408 23.6714 62.0279 23.9962 62.0297 24.7938C62.0315 25.5934 61.4502 26.5734 60.7358 26.9741L39.1831 39.0739C38.4686 39.4745 37.8816 39.1498 37.8797 38.3522C37.8779 37.5545 38.4592 36.5726 39.1755 36.1719L60.7282 24.0721H60.7263Z" fill="white"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M42.3643 35.0491C42.8051 34.8079 43.1623 35.0015 43.1642 35.4802C43.1642 35.9588 42.809 36.5419 42.3701 36.7831C41.9312 37.0242 41.5703 36.8304 41.5682 36.352C41.5682 35.8734 41.9236 35.2884 42.3643 35.0491Z" fill="#6E17FF"/>
-</g>
-<g opacity="0.9">
-<path opacity="0.9" d="M50.6368 30.4182C51.0776 30.177 51.4346 30.3707 51.4366 30.8494C51.4366 31.328 51.0813 31.9109 50.6423 32.1521C50.2016 32.3935 49.8425 32.1996 49.8406 31.721C49.8406 31.2424 50.196 30.6575 50.6368 30.4182Z" fill="#6E17FF"/>
-</g>
-<g opacity="0.5">
-<path opacity="0.5" d="M58.6805 25.8264C59.1212 25.5852 59.4785 25.7789 59.4803 26.2576C59.4822 26.7362 59.1252 27.3192 58.6862 27.5604C58.2473 27.8016 57.8864 27.6079 57.8846 27.1293C57.8846 26.6507 58.2397 26.0657 58.6805 25.8264Z" fill="#6E17FF"/>
-</g>
-<path d="M46.086 14.0937C46.2665 14.1943 46.4506 14.3235 46.5399 14.4754L50.1688 20.2204C50.3285 20.5129 50.3075 20.832 50.0606 21.0998L44.4159 26.2333C44.0776 26.4764 43.6046 26.6416 43.0613 26.691L32.3952 27.3291C31.8669 27.3747 31.3558 27.2873 30.9949 27.0841C30.9531 27.0613 30.915 27.0366 30.879 27.01L23.2583 22.7312C22.8956 22.5014 22.6883 22.1823 22.6883 21.8765L23.7847 15.8637C23.874 15.5579 24.1646 15.292 24.6169 15.1116L33.7327 11.8773C34.2076 11.7121 34.749 11.6855 35.2468 11.788L45.4779 13.8012C45.7041 13.8771 45.9074 13.9911 46.0897 14.0937H46.086Z" fill="#6E17FF"/>
-<path d="M46.0897 14.0937C46.2702 14.1943 46.4545 14.3235 46.5438 14.4754L50.1727 20.2204C50.3321 20.5129 50.3114 20.832 50.0642 21.0998L44.4196 26.2333C44.0815 26.4764 43.6085 26.6416 43.065 26.691L32.3988 27.3291C31.8706 27.3747 31.3597 27.2873 30.9985 27.0841C30.9568 27.0613 30.9187 27.0366 30.8827 27.01L23.262 22.7312C22.8992 22.5014 22.6922 22.1823 22.6922 21.8765L23.7884 15.8637C23.8777 15.5579 24.1685 15.292 24.6205 15.1116L33.7364 11.8773C34.2113 11.7121 34.7529 11.6855 35.2507 11.788L45.4816 13.8012C45.7078 13.8771 45.9111 13.9911 46.0934 14.0937H46.0897Z" fill="url(#paint12_linear_7996_40426)"/>
-<path d="M42.0832 24.6551C42.2426 24.7957 42.2426 24.9989 42.0165 25.1527C41.7696 25.2154 41.4523 25.1907 41.2471 25.0767C41.2014 25.0521 41.1788 25.0388 41.1578 25.0008C41.1578 24.9843 41.1502 24.9717 41.1349 24.9628C41.0895 24.9381 41.0913 24.9115 41.0666 24.8982C40.9983 24.8355 40.9755 24.771 40.9298 24.695C40.8862 24.6703 40.8615 24.6323 40.8405 24.5943C40.681 24.4044 40.4985 24.224 40.2952 24.0588C40.204 24.0075 40.1129 23.9828 40.0236 23.9828L39.8203 23.8689C38.1273 24.3645 36.163 24.4804 34.3067 24.2259L34.1946 24.3664C34.0369 24.3798 33.9476 24.4291 33.9019 24.4804C33.7672 24.6589 33.6569 24.8488 33.6133 25.0539C33.5676 25.1299 33.5676 25.1565 33.5447 25.1945C33.5447 25.2705 33.5239 25.335 33.4783 25.411C33.4783 25.4357 33.4783 25.4623 33.4575 25.4737C33.391 25.5895 33.2789 25.6522 33.142 25.7035C33.0073 25.7547 32.8266 25.7547 32.6918 25.7282C32.6006 25.7035 32.5342 25.6902 32.4656 25.6522C32.2833 25.5496 32.2376 25.3977 32.3041 25.2572C32.3041 25.2059 32.3251 25.1945 32.3269 25.1679C32.3479 25.1052 32.4163 25.0407 32.4846 24.9761L32.5739 24.8754C32.7772 24.6836 32.8893 24.4937 33.0015 24.3019C33.0243 24.2392 33.0015 24.1746 32.9558 24.1233L33.0243 23.9581C32.7299 23.8689 32.3897 23.7796 32.0953 23.6656C31.5746 23.5004 31.1205 23.2953 30.712 23.0674C30.0319 22.6857 29.4866 22.2527 29.0989 21.7551L28.8273 21.8064C28.6905 21.7817 28.5783 21.7684 28.4664 21.7817C28.1281 21.8443 27.7879 21.9089 27.4727 22.0115L27.2923 22.0627C27.1801 22.1007 27.0661 22.114 26.9539 22.152C26.9085 22.152 26.8646 22.152 26.8418 22.1653C26.5473 22.2033 26.2776 22.1767 26.0953 22.076C26.0496 22.0513 26.0041 22.0001 25.9813 21.9621C25.888 21.7836 26.0687 21.5803 26.4068 21.5158C26.4979 21.5158 26.5189 21.5025 26.5644 21.5025C26.7241 21.4892 26.8591 21.4645 26.9482 21.4645C27.0396 21.4645 27.085 21.4645 27.1515 21.4512C27.5145 21.3999 27.8736 21.3486 28.1909 21.2727C28.282 21.248 28.3732 21.1967 28.3942 21.1321L28.6639 21.0809C28.5499 20.889 28.5043 20.7105 28.4567 20.5073C28.2479 19.628 28.5366 18.7487 29.2321 17.9719L29.0059 17.8693C29.0059 17.7934 28.9603 17.7421 28.8919 17.7041C28.5518 17.5636 28.2573 17.4743 27.9172 17.385C27.8489 17.3471 27.7806 17.3337 27.7139 17.3224C27.6227 17.2977 27.4879 17.2711 27.3739 17.2331C27.3587 17.2255 27.334 17.1989 27.3112 17.1875C27.1688 17.1704 27.1459 17.1571 27.1021 17.1324C26.8665 17.0033 26.8171 16.8305 26.9634 16.6994C27.1667 16.5342 27.5505 16.4943 27.8449 16.6102C27.8743 16.6102 27.8971 16.6146 27.9135 16.6235C27.9589 16.6482 28.0046 16.6482 28.0256 16.6614C28.1168 16.7127 28.2289 16.7507 28.3201 16.802C28.3884 16.8153 28.432 16.84 28.4777 16.8647C28.774 17.0052 29.0687 17.1192 29.3858 17.2217C29.4979 17.235 29.6119 17.2464 29.7013 17.2217L29.9729 17.2977C31.0522 16.4563 32.6537 15.8828 34.4625 15.6549C34.5289 15.6435 34.5746 15.6416 34.6429 15.6302V15.4821C34.7152 15.4517 34.7533 15.3833 34.7533 15.3377C34.7533 15.1326 34.66 14.9294 34.5689 14.7262C34.546 14.6882 34.5232 14.6502 34.5006 14.6122C34.4549 14.5362 34.4092 14.4584 34.3866 14.3957C34.3637 14.3824 34.3637 14.3349 34.3637 14.3311C34.339 14.1146 34.5652 13.9361 34.9033 13.8981C35.0837 13.8734 35.2434 13.9114 35.3782 13.9874C35.4922 14.052 35.5607 14.1412 35.5833 14.2286C35.5833 14.2799 35.6062 14.2932 35.6062 14.3178C35.6062 14.3938 35.5854 14.4584 35.5854 14.5344C35.5854 14.559 35.6083 14.597 35.5854 14.6369C35.5644 14.8268 35.5873 15.0452 35.6348 15.2484C35.6576 15.2864 35.6803 15.3244 35.7241 15.3491C35.7677 15.3738 35.8153 15.3738 35.8381 15.3871L35.9064 15.5276C37.4436 15.5029 38.9823 15.7308 40.2744 16.2037C40.5917 16.331 40.8862 16.4449 41.1578 16.5741L41.3611 16.4848C41.5187 16.4715 41.608 16.4468 41.6994 16.4221C41.971 16.2683 42.2179 16.1297 42.4213 15.9625C42.4877 15.9246 42.5334 15.8999 42.5563 15.86C42.6227 15.7973 42.691 15.7327 42.7822 15.6815L42.8943 15.6188C43.0065 15.5561 43.1641 15.5162 43.3446 15.5162C43.5423 15.5162 43.7228 15.5447 43.8405 15.6112C43.8576 15.6207 43.8746 15.6321 43.888 15.6435C44.0913 15.784 44.0477 16.0138 43.7987 16.1278L43.6637 16.2037C43.5518 16.2417 43.4606 16.293 43.3485 16.3329C43.3028 16.3576 43.2345 16.3709 43.1906 16.3956C42.8526 16.5361 42.6036 16.6766 42.3566 16.8153C42.313 16.8666 42.2673 16.9178 42.2883 16.9805L42.1533 17.0831C43.1071 17.7459 43.7436 18.5606 43.9298 19.402C43.9298 19.6052 43.9545 19.8217 43.9563 20.0268L44.2508 20.0648C44.2736 20.1028 44.3193 20.1294 44.3401 20.1408C44.3858 20.1654 44.4541 20.1787 44.5226 20.192C44.8626 20.23 45.2466 20.2433 45.5846 20.23C45.6303 20.23 45.6986 20.2433 45.7651 20.23C45.8773 20.2167 46.012 20.2167 46.1489 20.2167C46.1717 20.23 46.2174 20.23 46.261 20.23C46.4643 20.2433 46.6219 20.2813 46.7359 20.3459C46.8499 20.4104 46.9185 20.5244 46.8956 20.6136C46.8518 20.8169 46.5366 20.9441 46.1736 20.9194C46.0824 20.946 46.0596 20.9327 46.0159 20.9327C45.8791 20.908 45.7669 20.8947 45.6303 20.8701C45.5618 20.8568 45.4935 20.8454 45.427 20.8321C45.0659 20.7808 44.7259 20.7428 44.3422 20.7314C44.2508 20.7314 44.1389 20.7694 44.0724 20.8074L43.7777 20.8207C43.5765 21.3429 43.2174 21.8519 42.7233 22.3115C42.2066 22.7578 41.5757 23.1643 40.831 23.4833L40.9679 23.6106C40.9222 23.6619 40.924 23.7378 40.9679 23.7891C41.1502 23.9676 41.3763 24.1461 41.6043 24.2981C41.6479 24.3494 41.6936 24.3741 41.7391 24.4006C41.8305 24.4519 41.9216 24.5032 41.9881 24.5659C42.0338 24.5906 42.0793 24.6171 42.0564 24.6304C42.0338 24.6437 42.0564 24.6551 42.0793 24.6684L42.0832 24.6551ZM37.5082 23.3808C37.9374 23.3428 38.3669 23.2535 38.7943 23.1377L36.9096 21.6468C36.8413 21.6088 36.7501 21.5841 36.6608 21.5576C36.4346 21.5063 36.163 21.5576 36.028 21.6848L34.7932 23.3789C35.6766 23.4928 36.6246 23.4928 37.5061 23.3789L37.5082 23.3808ZM32.8969 20.004C33.0091 19.9907 33.1003 19.9413 33.1439 19.8901C33.3017 19.7761 33.2332 19.609 33.0527 19.5083L30.4252 18.4638C29.8399 19.1513 29.686 19.9546 29.9634 20.6934L32.8988 20.0059L32.8969 20.004ZM34.6201 16.5285C33.2865 16.7203 32.0913 17.14 31.2116 17.7136L34.0427 18.5929C34.1567 18.6309 34.225 18.6442 34.3372 18.6309C34.6316 18.6176 34.8329 18.4771 34.8103 18.3118L34.6201 16.5285ZM32.7811 22.9364C32.9844 22.999 33.1439 23.0636 33.3017 23.1263L34.1738 21.4075C34.1738 21.3315 34.1738 21.2803 34.1491 21.2157C34.1244 21.1663 34.0806 21.1245 34.0236 21.0922C33.9172 21.0334 33.7672 21.0049 33.6056 21.0125L30.4898 21.5215C30.8071 21.8519 31.2174 22.1843 31.6923 22.4521C32.0325 22.6439 32.3955 22.7958 32.7811 22.9364ZM39.37 16.9615C38.3953 16.6178 37.2649 16.4392 36.1116 16.4278L36.6645 18.2359C36.7102 18.2871 36.7328 18.3251 36.8013 18.3631C37.0046 18.4771 37.3446 18.4904 37.546 18.3764L39.9135 17.1666L39.37 16.9634V16.9615ZM40.0596 22.6838C40.5783 22.4407 41.0286 22.1615 41.3897 21.8291C41.7488 21.4987 42.0186 21.1416 42.1743 20.7713L38.9406 20.682C38.8494 20.682 38.783 20.6953 38.6918 20.72C38.4428 20.8093 38.3535 20.9878 38.5132 21.1283L40.0596 22.6819V22.6838ZM42.3262 19.9185C42.3225 19.1551 41.8646 18.4144 40.981 17.7915L38.8399 19.1532C38.7735 19.1912 38.7506 19.2291 38.7506 19.2804C38.7241 19.3735 38.7906 19.4628 38.9027 19.5273C38.9729 19.5672 39.0622 19.5976 39.1573 19.6109L42.3243 19.9167L42.3262 19.9185ZM36.4651 19.3697L35.4922 19.4324L34.9983 19.8901L35.3175 20.3991L36.2237 20.5776L37.0369 20.2984L37.147 19.7495L36.4669 19.3678" fill="white"/>
-<path d="M34.6142 15.483L34.6368 15.4697V15.4754C34.6368 15.4754 34.6218 15.4811 34.6142 15.483Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_7996_40426" x1="3.86758" y1="26.0653" x2="31.1547" y2="37.8182" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.63"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.65"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.7"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7996_40426" x1="33.6815" y1="28.6314" x2="34.2587" y2="32.6748" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint2_linear_7996_40426" x1="66.7115" y1="57.4365" x2="1.90524" y2="53.3918" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint3_linear_7996_40426" x1="65.5032" y1="59.6471" x2="8" y2="47" gradientUnits="userSpaceOnUse">
-<stop offset="0.37" stop-color="white" stop-opacity="0"/>
-<stop offset="0.59" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.67" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.8" stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.948142" stop-color="white" stop-opacity="0.6"/>
-<stop offset="1" stop-color="#DDDDDD" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint4_linear_7996_40426" x1="3.86742" y1="13.3164" x2="31.1547" y2="25.0706" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.52"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.63"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.65"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.7"/>
-</linearGradient>
-<linearGradient id="paint5_linear_7996_40426" x1="3.86799" y1="15.8804" x2="4.05791" y2="19.9257" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint6_linear_7996_40426" x1="66.7115" y1="44.6855" x2="1.90524" y2="40.6408" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint7_linear_7996_40426" x1="65.5032" y1="46.8969" x2="8.00041" y2="34.2489" gradientUnits="userSpaceOnUse">
-<stop offset="0.37" stop-color="white" stop-opacity="0"/>
-<stop offset="0.59" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.67" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.8" stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.948142" stop-color="white" stop-opacity="0.6"/>
-<stop offset="1" stop-color="#DDDDDD" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint8_linear_7996_40426" x1="3.86742" y1="0.567375" x2="31.1547" y2="12.3215" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.5"/>
-</linearGradient>
-<linearGradient id="paint9_linear_7996_40426" x1="33.6812" y1="3.1295" x2="34.2584" y2="7.17483" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint10_linear_7996_40426" x1="66.7115" y1="31.9365" x2="1.90524" y2="27.892" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint11_linear_7996_40426" x1="65.5032" y1="34.145" x2="8.00041" y2="21.4969" gradientUnits="userSpaceOnUse">
-<stop offset="0.37" stop-color="white" stop-opacity="0"/>
-<stop offset="0.59" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.67" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.8" stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.948142" stop-color="white" stop-opacity="0.6"/>
-<stop offset="1" stop-color="#DDDDDD" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint12_linear_7996_40426" x1="52.6311" y1="24.4138" x2="22.5171" y2="16.1521" gradientUnits="userSpaceOnUse">
-<stop offset="0.57" stop-color="white" stop-opacity="0"/>
-<stop offset="0.79" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.42"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#c9d7dd" d="M36.125 59.744v8.504c-.597.002-1.194-.121-1.65-.372L8.971 53.906c-.456-.251-.684-.58-.684-.906l.025-8.501c0 .245.129.49.385.703q.063.054.139.102.075.052.16.097l25.502 13.97c.45.248 1.038.371 1.625.373z"/><path fill="#fff" d="M63.78 44.559q-.001.027-.006.053a.8.8 0 0 1-.091.262l-.03.051-.031.046-.027.036-.007.01-.033.037a2 2 0 0 1-.152.148q-.026.02-.05.042l-.04.03-.014.01-.03.021q-.037.026-.077.05l-.081.047-25.338 13.97c-.454.25-1.052.374-1.649.373-.587-.002-1.174-.126-1.624-.373L8.995 45.402a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.337-13.97c.903-.498 2.368-.498 3.274 0l25.503 13.97c.478.263.706.612.68.958z"/><path fill="url(#paint0_linear_7996_40426)" d="M63.78 44.565q-.001.028-.006.054a.8.8 0 0 1-.091.262l-.03.051-.031.045q-.013.02-.027.037-.005.005-.007.01l-.033.037a2 2 0 0 1-.152.148q-.026.02-.05.042l-.04.03-.014.01-.03.02q-.037.027-.077.05-.039.025-.081.048l-25.338 13.97c-.454.25-1.052.374-1.649.372-.587-.002-1.174-.125-1.624-.372L8.995 45.407a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.337-13.97c.903-.498 2.368-.498 3.274 0l25.503 13.97c.478.262.706.612.68.957z" opacity=".6"/><path fill="#6e17ff" d="M59.357 44.556a.7.7 0 0 1-.082.264q-.013.02-.024.044-.015.017-.025.038l-.023.03-.008.01-.026.032-.032.036q-.046.046-.098.091l-.007.008a2 2 0 0 0-.247-.166L37.337 33.195c-.762-.418-1.995-.418-2.753 0L13.278 44.943q-.136.075-.24.16l-.003-.004c-.217-.18-.323-.385-.323-.59 0-.274.188-.545.566-.755l21.306-11.748c.758-.42 1.99-.42 2.753 0l21.448 11.749c.403.22.595.514.572.805z"/><path fill="#c9d7dd" d="m59.032 45.105-.036.028-.034.025-.012.008-.024.017-.065.041-.068.04-21.306 11.749c-.382.21-.885.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.288 45.264a2 2 0 0 1-.247-.165q.102-.085.24-.16l21.305-11.748c.758-.418 1.991-.418 2.753 0L58.787 44.94q.14.076.247.165z"/><path fill="url(#paint1_linear_7996_40426)" d="m59.032 45.107-.036.028-.034.025-.012.008q-.014.008-.024.017l-.065.041-.068.04-21.306 11.749c-.382.21-.885.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.288 45.266a2 2 0 0 1-.247-.165q.102-.085.24-.16l21.305-11.748c.758-.417 1.991-.417 2.753 0l21.448 11.749q.14.076.247.165z"/><path fill="#c9d7dd" d="m63.784 44.509-.025 8.504c0 .323-.226.648-.673.895L37.75 67.878c-.448.247-1.035.37-1.624.372v-8.504c.596.002 1.195-.122 1.649-.372l25.337-13.97.082-.048.076-.05.03-.02.014-.01.04-.03q.026-.02.05-.042.063-.051.115-.107.02-.019.038-.041l.032-.038.008-.01.026-.036.03-.046.031-.05a.8.8 0 0 0 .1-.367"/><path fill="url(#paint2_linear_7996_40426)" d="m63.784 44.516-.025 8.505c0 .323-.226.648-.673.894L37.75 67.885c-.448.248-1.035.371-1.624.373-.597.002-1.194-.121-1.65-.372L8.971 53.916c-.456-.251-.684-.58-.684-.907l.025-8.5c0 .245.129.49.385.703q.063.053.139.102.075.05.16.097l25.502 13.97c.45.247 1.038.37 1.625.372.596.002 1.195-.121 1.649-.372l25.337-13.97q.043-.023.082-.048.039-.023.076-.05l.03-.02.014-.01.04-.03q.026-.019.05-.041a1.3 1.3 0 0 0 .153-.149l.032-.038.008-.01.026-.035q.017-.022.03-.046.018-.026.031-.051a.8.8 0 0 0 .097-.315q.004-.026.004-.052z" opacity=".8"/><path fill="url(#paint3_linear_7996_40426)" d="m63.784 44.52-.025 8.505c0 .323-.226.647-.673.894L37.75 67.89c-.448.248-1.035.371-1.624.373-.597.002-1.194-.122-1.65-.372L8.971 53.917c-.456-.25-.684-.579-.684-.906l.025-8.5c0 .245.129.49.385.702q.063.054.139.103.075.05.16.097l25.502 13.97c.45.247 1.038.37 1.625.372.596.002 1.195-.121 1.649-.372l25.337-13.97q.043-.023.082-.048.039-.023.076-.05l.03-.02.014-.01q.02-.013.04-.03.026-.019.05-.042a1.3 1.3 0 0 0 .153-.148l.032-.038q.006-.004.008-.01l.026-.035q.017-.022.03-.046.018-.025.031-.051a.8.8 0 0 0 .097-.315q.004-.026.004-.052z"/><path fill="#c9d7dd" d="M36.125 46.993v8.504c-.597.002-1.194-.121-1.65-.372L8.971 41.157c-.456-.251-.684-.58-.684-.906l.025-8.501c0 .245.129.49.385.703q.063.054.139.102.075.052.16.097l25.502 13.97c.45.247 1.038.37 1.625.373z"/><path fill="#fff" d="M63.78 31.809q-.001.027-.006.053a.8.8 0 0 1-.091.262l-.03.051-.031.046q-.013.02-.027.036l-.007.01-.033.037q-.016.023-.038.042a1.5 1.5 0 0 1-.218.188l-.03.021-.076.05-.082.047-25.338 13.97c-.454.251-1.052.375-1.649.373-.587-.002-1.174-.126-1.624-.373L8.995 32.652a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.34-13.97c.902-.498 2.366-.498 3.273 0l25.502 13.97c.48.262.707.612.68.958z"/><path fill="url(#paint4_linear_7996_40426)" d="M63.78 31.814q-.001.028-.006.054a.8.8 0 0 1-.091.262l-.03.051-.031.046-.027.036-.007.01-.033.037a1.5 1.5 0 0 1-.256.23l-.03.021-.076.05-.082.047-25.338 13.97c-.454.25-1.052.374-1.649.372-.587-.001-1.174-.125-1.624-.372L8.995 32.658a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.34-13.97c.902-.498 2.366-.498 3.273 0l25.502 13.97c.48.262.707.612.68.957z" opacity=".6"/><path fill="#6e17ff" d="M59.357 31.805a.7.7 0 0 1-.082.264q-.013.02-.024.044-.015.017-.025.038l-.03.04-.027.032-.032.036q-.046.046-.098.091l-.007.008a2 2 0 0 0-.247-.166L37.337 20.444c-.762-.418-1.995-.418-2.753 0L13.278 32.192q-.136.075-.24.16l-.003-.004c-.217-.18-.323-.385-.323-.59 0-.274.188-.545.566-.755l21.306-11.748c.758-.42 1.99-.42 2.753 0l21.448 11.749c.403.22.595.514.572.805z"/><path fill="#c9d7dd" d="m59.032 32.354-.036.028-.034.025-.012.008-.024.017-.065.041-.068.04-21.306 11.749c-.382.21-.885.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.288 32.513a2 2 0 0 1-.247-.165q.102-.085.24-.16L34.585 20.44c.758-.418 1.991-.418 2.753 0l21.449 11.75q.14.076.247.165z"/><path fill="url(#paint5_linear_7996_40426)" d="m59.032 32.356-.036.028-.034.025-.012.008q-.014.008-.024.017l-.065.041-.068.04-21.306 11.749c-.382.21-.885.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.288 32.515a2 2 0 0 1-.247-.165q.102-.085.24-.16l21.305-11.748c.758-.418 1.991-.418 2.753 0l21.448 11.749q.14.076.247.165z"/><path fill="#c9d7dd" d="m63.784 31.758-.025 8.504c0 .323-.226.648-.673.895L37.75 55.127c-.448.247-1.035.37-1.624.372v-8.504c.596.002 1.195-.122 1.649-.372l25.337-13.97.082-.048q.039-.023.076-.05l.03-.02.014-.01.04-.03q.026-.02.05-.042.063-.051.115-.107.02-.019.038-.041l.032-.038.008-.01.026-.036.03-.045.031-.052a.8.8 0 0 0 .1-.366"/><path fill="url(#paint6_linear_7996_40426)" d="m63.784 31.767-.025 8.505c0 .323-.226.647-.673.894L37.75 55.136c-.448.247-1.035.371-1.624.373-.597.002-1.194-.122-1.65-.372L8.971 41.164c-.456-.25-.684-.579-.684-.906l.025-8.5c0 .245.129.49.385.703q.063.053.139.102.075.05.16.097l25.502 13.97c.45.247 1.038.37 1.625.372.596.002 1.195-.121 1.649-.372l25.337-13.97q.043-.023.082-.048.039-.023.076-.049l.03-.021.014-.01.04-.03q.026-.02.05-.041a1.3 1.3 0 0 0 .153-.149l.032-.038.008-.01.026-.035q.017-.022.03-.046.018-.026.031-.051a.8.8 0 0 0 .097-.315q.004-.026.004-.052z" opacity=".8"/><path fill="url(#paint7_linear_7996_40426)" d="m63.784 31.77-.025 8.504c0 .323-.226.647-.673.894L37.75 55.138c-.448.248-1.035.371-1.624.373-.597.002-1.194-.122-1.65-.372L8.971 41.169c-.456-.251-.684-.58-.684-.906l.025-8.501c0 .245.129.49.385.702q.063.054.139.103.075.051.16.097l25.502 13.97c.45.247 1.038.37 1.625.373.596.001 1.195-.122 1.649-.373l25.337-13.97q.043-.023.082-.048a1 1 0 0 0 .076-.05l.03-.02.014-.01.04-.03q.026-.019.05-.042a1 1 0 0 0 .153-.148l.032-.038q.006-.004.008-.01l.026-.035q.017-.022.03-.046.018-.026.031-.051a.8.8 0 0 0 .097-.315q.004-.027.004-.052z"/><path fill="#fff" d="M60.726 36.822c.715-.4 1.302-.076 1.304.722.002.8-.58 1.78-1.294 2.18l-21.553 12.1c-.714.4-1.301.076-1.303-.722s.58-1.78 1.295-2.18l21.553-12.1z" opacity=".4"/><path fill="#fff" d="M42.364 47.798c.441-.241.798-.047.8.431 0 .479-.355 1.062-.794 1.303s-.8.048-.802-.431c0-.479.356-1.063.796-1.303" opacity=".5"/><path fill="#fff" d="M50.637 43.17c.44-.241.798-.047.8.431 0 .479-.356 1.062-.795 1.303s-.8.048-.801-.431c0-.479.355-1.064.796-1.303" opacity=".9"/><path fill="#fff" d="M58.68 38.577c.441-.24.798-.047.8.431.002.48-.355 1.062-.794 1.303-.439.242-.8.048-.801-.43 0-.48.355-1.064.796-1.304" opacity=".5"/><path fill="#fff" d="M60.726 49.326c.715-.4 1.302-.076 1.304.722.002.8-.58 1.78-1.294 2.18l-21.553 12.1c-.714.4-1.301.076-1.303-.722s.58-1.78 1.296-2.18l21.552-12.1z" opacity=".4"/><path fill="#fff" d="M42.364 60.301c.441-.241.798-.047.8.431 0 .479-.355 1.062-.794 1.303s-.8.047-.802-.431c0-.479.356-1.064.796-1.303" opacity=".5"/><path fill="#fff" d="M50.637 55.673c.44-.241.798-.047.8.431 0 .479-.356 1.062-.795 1.303s-.8.048-.801-.431c0-.479.355-1.064.796-1.303" opacity=".9"/><path fill="#fff" d="M58.68 51.081c.441-.24.799-.047.8.431.002.479-.355 1.062-.794 1.303-.438.242-.8.048-.801-.431 0-.478.355-1.063.796-1.303" opacity=".5"/><path fill="#c9d7dd" d="M36.125 34.244v8.505c-.597.001-1.194-.122-1.65-.373L8.971 28.406c-.456-.251-.684-.58-.684-.906l.025-8.501c0 .245.129.49.385.703q.063.054.139.102.075.052.16.097l25.502 13.97c.45.247 1.038.37 1.625.373z"/><path fill="#fff" d="M63.78 19.058q-.001.027-.006.053a.8.8 0 0 1-.091.262l-.03.051-.031.046-.027.036-.007.01q-.015.019-.033.037a2 2 0 0 1-.152.148q-.026.02-.05.042l-.054.04-.03.021-.076.05-.082.047-25.338 13.97c-.454.251-1.052.375-1.649.372-.587-.001-1.174-.125-1.624-.372L8.995 19.901a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.34-13.97c.902-.498 2.366-.498 3.273 0l25.502 13.97c.48.262.707.612.68.958z"/><path fill="url(#paint8_linear_7996_40426)" d="M63.78 19.064q-.001.026-.006.053a.8.8 0 0 1-.091.262l-.03.051-.031.046-.027.036-.007.01q-.015.019-.033.037a2 2 0 0 1-.152.148q-.026.02-.05.042l-.054.04-.03.02q-.037.027-.076.05l-.082.048-25.338 13.97c-.454.25-1.052.374-1.649.372-.587-.001-1.174-.125-1.624-.372L8.995 19.907a2 2 0 0 1-.298-.2c-.256-.212-.386-.457-.386-.702 0-.325.225-.648.673-.897l25.34-13.97c.902-.498 2.366-.498 3.273 0l25.502 13.97c.48.262.707.612.68.957z" opacity=".6"/><path fill="#6e17ff" d="M59.357 19.056a.7.7 0 0 1-.082.264q-.013.02-.024.044-.015.017-.025.038l-.03.04-.027.032-.032.036q-.046.046-.098.091l-.007.008a2 2 0 0 0-.247-.166L37.337 7.695c-.762-.418-1.995-.418-2.753 0L13.278 19.44q-.136.073-.24.16l-.003-.005c-.217-.18-.323-.385-.323-.59 0-.274.188-.545.566-.754L34.584 6.502c.758-.42 1.99-.42 2.753 0l21.448 11.749c.403.22.595.514.572.805"/><path fill="#c9d7dd" d="m59.032 19.603-.036.028-.034.025-.012.008q-.014.008-.025.017l-.064.042-.068.04L37.487 31.51c-.382.21-.886.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.286 19.764a2 2 0 0 1-.247-.165q.102-.085.239-.16L34.584 7.692c.758-.418 1.99-.418 2.753 0L58.785 19.44q.14.076.247.165z"/><path fill="url(#paint9_linear_7996_40426)" d="m59.032 19.607-.036.028-.034.025-.012.008q-.014.008-.025.017l-.064.042-.068.04-21.306 11.748c-.382.21-.886.315-1.387.313-.494-.002-.988-.106-1.366-.313L13.286 19.766a2 2 0 0 1-.247-.165q.102-.085.239-.16L34.584 7.694c.758-.418 1.99-.418 2.753 0l21.448 11.749q.14.076.247.165"/><path fill="#c9d7dd" d="m63.784 19.007-.025 8.504c0 .323-.226.648-.673.895L37.75 42.376c-.448.247-1.035.37-1.624.373v-8.505c.596.002 1.195-.121 1.649-.372l25.337-13.97.082-.048q.039-.023.076-.05l.03-.02.014-.01.04-.03q.026-.02.05-.042.063-.052.115-.106.02-.02.038-.042l.032-.038.008-.01.026-.036.03-.045q.017-.026.031-.052a.8.8 0 0 0 .1-.366"/><path fill="url(#paint10_linear_7996_40426)" d="m63.784 19.016-.025 8.505c0 .323-.226.648-.673.895L37.75 42.386c-.448.247-1.035.37-1.624.372-.597.002-1.194-.121-1.65-.372L8.971 28.416c-.456-.251-.684-.58-.684-.907l.025-8.5c0 .245.129.49.385.703q.063.054.139.102.075.051.16.097l25.502 13.97c.45.247 1.038.37 1.625.373.596.002 1.195-.122 1.649-.373l25.337-13.97q.043-.023.082-.048.039-.023.076-.049l.03-.02q.008-.008.014-.01l.04-.03q.026-.02.05-.043a1.3 1.3 0 0 0 .153-.148l.032-.038q.006-.003.008-.01l.026-.035q.017-.022.03-.046.018-.025.031-.051a.8.8 0 0 0 .097-.315q.004-.026.004-.052z" opacity=".8"/><path fill="url(#paint11_linear_7996_40426)" d="m63.784 19.017-.025 8.505c0 .323-.226.648-.673.894L37.75 42.386c-.448.248-1.035.371-1.624.373-.597.002-1.194-.121-1.65-.372L8.971 28.417c-.456-.251-.684-.58-.684-.907l.025-8.5c0 .245.129.49.385.702q.063.054.139.103.075.05.16.097l25.502 13.97c.45.247 1.038.37 1.625.373.596.001 1.195-.122 1.649-.373l25.337-13.97q.043-.023.082-.048.039-.023.076-.049l.03-.02q.008-.008.014-.01l.04-.03q.026-.02.05-.043a1.3 1.3 0 0 0 .153-.148l.032-.038q.006-.003.008-.01l.026-.035q.017-.022.03-.046.018-.025.031-.051a.8.8 0 0 0 .097-.315q.004-.025.004-.052z"/><path fill="#fff" d="M60.726 24.072c.715-.4 1.302-.076 1.304.722.002.8-.58 1.78-1.294 2.18l-21.553 12.1c-.714.4-1.301.076-1.303-.722s.58-1.78 1.295-2.18l21.553-12.1z" opacity=".8"/><path fill="#6e17ff" d="M42.364 35.05c.441-.242.798-.048.8.43 0 .479-.355 1.062-.794 1.303s-.8.047-.802-.431c0-.479.356-1.064.796-1.303" opacity=".5"/><path fill="#6e17ff" d="M50.637 30.418c.44-.241.798-.047.8.431 0 .479-.356 1.062-.795 1.303-.44.242-.8.048-.801-.431 0-.479.355-1.064.796-1.303" opacity=".9"/><path fill="#6e17ff" d="M58.68 25.826c.441-.24.798-.047.8.432.002.478-.355 1.061-.794 1.302s-.8.048-.801-.43c0-.48.355-1.064.796-1.304" opacity=".5"/><path fill="#6e17ff" d="M46.086 14.094c.18.1.365.23.454.381l3.629 5.745a.72.72 0 0 1-.108.88l-5.645 5.133c-.338.243-.811.409-1.355.458l-10.666.638c-.528.046-1.04-.042-1.4-.245a1 1 0 0 1-.116-.074l-7.62-4.279c-.363-.23-.57-.549-.57-.855l1.096-6.012c.089-.306.38-.572.832-.752l9.116-3.235a2.9 2.9 0 0 1 1.514-.089l10.23 2.013c.227.076.43.19.613.293z"/><path fill="url(#paint12_linear_7996_40426)" d="M46.09 14.094c.18.1.364.23.454.381l3.629 5.745a.72.72 0 0 1-.109.88l-5.644 5.133c-.339.243-.812.409-1.355.458l-10.666.638c-.528.046-1.04-.042-1.4-.245a1 1 0 0 1-.116-.074l-7.621-4.279c-.363-.23-.57-.549-.57-.855l1.096-6.012c.09-.306.38-.572.832-.752l9.116-3.235a2.9 2.9 0 0 1 1.515-.089l10.23 2.013c.227.076.43.19.612.293z"/><path fill="#fff" d="M42.083 24.655c.16.14.16.344-.066.498-.247.062-.565.038-.77-.076-.046-.025-.068-.038-.09-.076a.04.04 0 0 0-.022-.038c-.045-.025-.044-.052-.068-.065-.069-.062-.092-.127-.137-.203a.24.24 0 0 1-.09-.1q-.24-.287-.545-.536a.55.55 0 0 0-.271-.076l-.204-.114c-1.693.495-3.657.611-5.513.357l-.112.14c-.158.014-.247.063-.293.114a1.5 1.5 0 0 0-.289.574c-.045.076-.045.103-.068.14a.4.4 0 0 1-.067.217c0 .025 0 .051-.02.063-.067.116-.18.178-.316.23a.9.9 0 0 1-.45.024c-.091-.025-.158-.038-.226-.076-.183-.102-.228-.254-.162-.395 0-.051.021-.062.023-.09.02-.062.09-.126.158-.19l.089-.102c.203-.191.315-.381.428-.573.022-.063 0-.127-.046-.179l.068-.165c-.294-.09-.634-.178-.929-.292a7.4 7.4 0 0 1-1.383-.599c-.68-.381-1.225-.814-1.613-1.312l-.272.051a1.2 1.2 0 0 0-.36-.024 8 8 0 0 0-.994.23l-.18.05c-.113.039-.227.052-.34.09-.044 0-.088 0-.111.013-.295.038-.564.012-.747-.089a.34.34 0 0 1-.114-.114c-.093-.178.088-.382.426-.446.09 0 .112-.013.157-.013.16-.014.295-.038.384-.038.092 0 .137 0 .203-.014a11 11 0 0 0 1.04-.178c.091-.025.182-.076.203-.14l.27-.052a1.9 1.9 0 0 1-.207-.574c-.21-.879.08-1.758.775-2.535l-.226-.103c0-.076-.046-.127-.114-.165-.34-.14-.635-.23-.975-.319a.6.6 0 0 0-.203-.063c-.091-.024-.226-.05-.34-.089-.015-.008-.04-.034-.063-.046-.142-.017-.165-.03-.209-.055-.236-.129-.285-.302-.139-.433.204-.165.587-.205.882-.089q.044 0 .069.014c.045.024.09.024.112.037.09.052.203.09.294.141.068.013.112.038.158.063.296.14.59.254.908.357a.9.9 0 0 0 .315 0l.272.076c1.08-.842 2.68-1.415 4.49-1.643.066-.011.112-.013.18-.025v-.148c.072-.03.11-.099.11-.144 0-.205-.093-.409-.184-.612l-.068-.114a1.4 1.4 0 0 1-.114-.216c-.023-.014-.023-.061-.023-.065-.025-.216.201-.395.54-.433.18-.025.34.013.474.09a.4.4 0 0 1 .205.24c0 .052.023.065.023.09 0 .076-.02.14-.02.216 0 .025.022.063 0 .103-.022.19.001.408.049.611.023.038.045.076.09.101.043.025.09.025.113.038l.068.14c1.538-.024 3.076.204 4.368.677.318.127.612.24.884.37l.203-.09a1.6 1.6 0 0 0 .338-.062c.272-.154.519-.292.722-.46.067-.037.112-.062.135-.102.067-.063.135-.127.226-.178l.112-.063a.94.94 0 0 1 .45-.103c.198 0 .379.029.496.095q.028.015.048.032c.203.141.16.37-.09.485l-.134.076c-.112.038-.203.089-.316.129-.045.025-.114.038-.157.063-.338.14-.587.28-.834.42-.044.05-.09.102-.069.165l-.135.102c.954.663 1.59 1.478 1.777 2.319 0 .203.025.42.026.625l.295.038a.24.24 0 0 0 .09.076.7.7 0 0 0 .182.051c.34.038.724.051 1.062.038.045 0 .114.013.18 0 .112-.013.247-.013.384-.013.023.013.068.013.112.013q.304.019.475.116c.114.064.183.178.16.268-.044.203-.36.33-.722.305-.092.027-.114.014-.158.014-.137-.025-.25-.038-.386-.063l-.203-.038a10 10 0 0 0-1.085-.1.6.6 0 0 0-.27.075l-.294.014c-.201.522-.56 1.03-1.055 1.49a7.3 7.3 0 0 1-1.892 1.172l.137.128a.135.135 0 0 0 0 .178c.182.179.408.357.636.51.044.05.09.075.135.102.092.05.183.102.25.165.045.025.09.051.067.064s0 .025.023.038zm-4.575-1.274c.43-.038.859-.128 1.286-.243l-1.884-1.491c-.069-.038-.16-.063-.25-.09-.225-.05-.497 0-.632.128l-1.235 1.694c.884.114 1.832.114 2.713 0zm-4.611-3.377a.4.4 0 0 0 .247-.114c.158-.114.09-.281-.091-.382l-2.628-1.044c-.585.687-.739 1.49-.462 2.23l2.936-.688zm1.723-3.476c-1.334.192-2.529.612-3.408 1.186l2.83.879a.6.6 0 0 0 .295.038c.295-.013.496-.154.473-.32zm-1.839 6.408c.203.063.363.128.52.19l.873-1.719c0-.076 0-.127-.025-.191a.3.3 0 0 0-.125-.124.8.8 0 0 0-.418-.08l-3.116.51c.317.33.727.662 1.202.93.34.192.703.344 1.09.484m6.589-5.974c-.975-.344-2.105-.523-3.258-.534l.552 1.808c.046.051.069.09.137.127.204.114.544.127.745.013l2.367-1.21-.543-.203zm.69 5.722c.518-.243.969-.523 1.33-.855.359-.33.629-.687.784-1.058l-3.233-.089a1 1 0 0 0-.25.038c-.248.09-.338.268-.178.408l1.547 1.554zm2.266-2.765c-.004-.764-.461-1.505-1.345-2.128l-2.141 1.362c-.067.038-.09.076-.09.127-.026.093.04.183.153.247.07.04.16.07.254.084l3.167.306zm-5.86-.55-.974.063-.494.458.32.51.906.178.813-.28.11-.548-.68-.382"/><path fill="#fff" d="m34.614 15.483.023-.013v.005z"/><defs><linearGradient id="paint0_linear_7996_40426" x1="3.868" x2="31.155" y1="26.065" y2="37.818" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".63"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".65"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".7"/></linearGradient><linearGradient id="paint1_linear_7996_40426" x1="33.681" x2="34.259" y1="28.631" y2="32.675" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint2_linear_7996_40426" x1="66.712" x2="1.905" y1="57.437" y2="53.392" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint3_linear_7996_40426" x1="65.503" x2="8" y1="59.647" y2="47" gradientUnits="userSpaceOnUse"><stop offset=".37" stop-color="#fff" stop-opacity="0"/><stop offset=".59" stop-color="#fff" stop-opacity=".3"/><stop offset=".67" stop-color="#fff" stop-opacity=".42"/><stop offset=".8" stop-color="#fff" stop-opacity=".6"/><stop offset=".948" stop-color="#fff" stop-opacity=".6"/><stop offset="1" stop-color="#ddd" stop-opacity=".6"/></linearGradient><linearGradient id="paint4_linear_7996_40426" x1="3.867" x2="31.155" y1="13.316" y2="25.071" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".52"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".63"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".65"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".7"/></linearGradient><linearGradient id="paint5_linear_7996_40426" x1="3.868" x2="4.058" y1="15.88" y2="19.926" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint6_linear_7996_40426" x1="66.712" x2="1.905" y1="44.685" y2="40.641" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint7_linear_7996_40426" x1="65.503" x2="8" y1="46.897" y2="34.249" gradientUnits="userSpaceOnUse"><stop offset=".37" stop-color="#fff" stop-opacity="0"/><stop offset=".59" stop-color="#fff" stop-opacity=".3"/><stop offset=".67" stop-color="#fff" stop-opacity=".42"/><stop offset=".8" stop-color="#fff" stop-opacity=".6"/><stop offset=".948" stop-color="#fff" stop-opacity=".6"/><stop offset="1" stop-color="#ddd" stop-opacity=".6"/></linearGradient><linearGradient id="paint8_linear_7996_40426" x1="3.867" x2="31.155" y1=".567" y2="12.322" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".5"/></linearGradient><linearGradient id="paint9_linear_7996_40426" x1="33.681" x2="34.258" y1="3.13" y2="7.175" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint10_linear_7996_40426" x1="66.712" x2="1.905" y1="31.936" y2="27.892" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint11_linear_7996_40426" x1="65.503" x2="8" y1="34.145" y2="21.497" gradientUnits="userSpaceOnUse"><stop offset=".37" stop-color="#fff" stop-opacity="0"/><stop offset=".59" stop-color="#fff" stop-opacity=".3"/><stop offset=".67" stop-color="#fff" stop-opacity=".42"/><stop offset=".8" stop-color="#fff" stop-opacity=".6"/><stop offset=".948" stop-color="#fff" stop-opacity=".6"/><stop offset="1" stop-color="#ddd" stop-opacity=".6"/></linearGradient><linearGradient id="paint12_linear_7996_40426" x1="52.631" x2="22.517" y1="24.414" y2="16.152" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#fff" stop-opacity="0"/><stop offset=".79" stop-color="#fff" stop-opacity=".3"/><stop offset=".87" stop-color="#fff" stop-opacity=".42"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/laptop.svg b/web/packages/design/src/ResourceIcon/assets/laptop.svg
index ac0d8fe9b88a1..c2c9e9cdf07d9 100644
--- a/web/packages/design/src/ResourceIcon/assets/laptop.svg
+++ b/web/packages/design/src/ResourceIcon/assets/laptop.svg
@@ -1,310 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_11114_7617)">
-<g filter="url(#filter0_d_11114_7617)">
-<g opacity="0.7">
-<path d="M68.0228 56.875C68.0228 56.875 67.9811 56.9166 67.9478 56.9333C67.9311 56.9499 67.9061 56.9583 67.8895 56.9749L42.2532 71.8437C41.9699 72.0102 41.5366 72.0435 41.1867 71.9352C41.1367 71.9186 41.0867 71.9019 41.0368 71.877L40.9618 71.8353L2.1782 49.4989C2.11155 49.4656 2.06156 49.4156 2.0199 49.374C2.00324 49.3574 1.99491 49.3407 1.98657 49.3324C1.96991 49.3157 1.96158 49.2991 1.95325 49.2824C1.92825 49.2325 1.91992 49.1825 1.91992 49.1409V47.2677C1.91992 47.1345 2.01157 47.0013 2.18653 46.8931L26.3648 32.8818C26.3648 32.8818 26.4315 32.9318 26.4648 32.9484L68.0228 56.8833C68.1061 56.8001 68.1561 56.7085 68.1561 56.6169" fill="#121929"/>
-</g>
-</g>
-<path d="M68.1727 54.7441V56.6172C68.1727 56.7504 68.081 56.8836 67.9061 56.9835L42.2698 71.844C41.9198 72.0521 41.3366 72.0521 40.9867 71.844L2.20313 49.5075C2.02817 49.4076 1.93652 49.2744 1.93652 49.1412V47.2681C1.93652 47.4013 2.0365 47.5345 2.21147 47.6344L40.995 69.9708C41.3533 70.1706 41.9282 70.1706 42.2781 69.9708L67.9144 55.1104C68.0894 55.0105 68.1727 54.8773 68.181 54.7441H68.1727Z" fill="#CAD5DB"/>
-<path d="M68.1727 54.7441V56.6172C68.1727 56.7504 68.081 56.8836 67.9061 56.9835L42.2698 71.844C41.9198 72.0521 41.3366 72.0521 40.9867 71.844L2.20313 49.5075C2.02817 49.4076 1.93652 49.2744 1.93652 49.1412V47.2681C1.93652 47.4013 2.0365 47.5345 2.21147 47.6344L40.995 69.9708C41.3533 70.1706 41.9282 70.1706 42.2781 69.9708L67.9144 55.1104C68.0894 55.0105 68.1727 54.8773 68.181 54.7441H68.1727Z" fill="#CAD5DB"/>
-<path d="M67.9062 54.3612C68.2645 54.5693 68.2645 54.894 67.9062 55.1021L42.2699 69.9626C41.92 70.1707 41.3451 70.1707 40.9868 69.9626L2.20326 47.6261C1.84501 47.418 1.84501 47.0933 2.20326 46.8852L27.8396 32.0247C28.1895 31.8166 28.7644 31.8166 29.1226 32.0247L67.9062 54.3612Z" fill="#F3F4F5"/>
-<path d="M69.8474 23.5412L69.764 53.1205C69.764 53.3203 69.6891 53.4619 69.5724 53.5285L68.2644 54.2861C68.3477 54.2111 68.3977 54.0862 68.3977 53.9197L68.481 24.3404C68.481 23.9325 68.1977 23.4329 67.8395 23.2331L29.0559 0.89669C28.8726 0.788463 28.7143 0.780138 28.5977 0.855065L30.0224 0.0308739C30.1307 -0.00242681 30.264 0.0225457 30.4139 0.105797L69.1975 22.4422C69.5558 22.6504 69.839 23.1416 69.839 23.5495L69.8474 23.5412Z" fill="#587E8B"/>
-<path d="M69.8474 23.5412L69.764 53.1205C69.764 53.3203 69.6891 53.4619 69.5724 53.5285L68.2644 54.2861C68.3477 54.2111 68.3977 54.0862 68.3977 53.9197L68.481 24.3404C68.481 23.9325 68.1977 23.4329 67.8395 23.2331L29.0559 0.89669C28.8726 0.788463 28.7143 0.780138 28.5977 0.855065L30.0224 0.0308739C30.1307 -0.00242681 30.264 0.0225457 30.4139 0.105797L69.1975 22.4422C69.5558 22.6504 69.839 23.1416 69.839 23.5495L69.8474 23.5412Z" fill="#CAD5DB"/>
-<path d="M67.8483 23.2331C68.2065 23.4413 68.4898 23.9325 68.4898 24.3404L68.4065 53.9197C68.4065 54.3277 68.1149 54.4942 67.7649 54.2861L28.9814 31.9496C28.6231 31.7415 28.3398 31.2503 28.3398 30.8424L28.4232 1.26301C28.4232 0.855077 28.7148 0.696896 29.0647 0.8967L67.8483 23.2331Z" fill="#E2E6E7"/>
-<path d="M66.0734 23.5661C66.3984 23.7576 66.665 24.2155 66.665 24.5901L66.59 51.905C66.59 52.2797 66.3234 52.4295 65.9901 52.2464L30.1726 31.6166C29.8477 31.4251 29.5811 30.9672 29.5811 30.5926L29.656 3.27767C29.656 2.90304 29.9226 2.75319 30.2559 2.94467L66.0734 23.5745V23.5661Z" fill="white"/>
-<g opacity="0.8">
-<path d="M32.3385 6.18311C32.3968 6.21641 32.4468 6.30799 32.4468 6.37459V7.77322C32.4468 7.83982 32.3884 7.87312 32.3301 7.83982L31.1054 7.13218C31.0471 7.09888 30.9971 7.0073 30.9971 6.9407V5.54207C30.9971 5.47547 31.0554 5.44217 31.1137 5.47547L32.3385 6.18311Z" fill="#587E8B"/>
-</g>
-<g opacity="0.8">
-<path d="M34.7379 7.66504C34.7962 7.69834 34.8462 7.78992 34.8462 7.85652V9.25515C34.8462 9.32175 34.7879 9.35505 34.7295 9.32175L33.5048 8.61411C33.4465 8.58081 33.3965 8.48923 33.3965 8.42263V7.024C33.3965 6.9574 33.4548 6.9241 33.5131 6.9574L34.7379 7.66504Z" fill="#587E8B"/>
-</g>
-<g opacity="0.8">
-<path d="M65.2555 48.5742C65.3138 48.6075 65.3638 48.6991 65.3638 48.7657V50.1643C65.3638 50.2309 65.3054 50.2642 65.2471 50.2309L64.0224 49.5233C63.9641 49.49 63.9141 49.3984 63.9141 49.3318V47.9332C63.9141 47.8666 63.9724 47.8333 64.0307 47.8666L65.2555 48.5742Z" fill="#587E8B"/>
-</g>
-<g opacity="0.8">
-<path d="M32.3385 8.76367C32.3968 8.79697 32.4468 8.88855 32.4468 8.95515V10.3538C32.4468 10.4204 32.3884 10.4537 32.3301 10.4204L31.1054 9.71274C31.0471 9.67944 30.9971 9.58786 30.9971 9.52126V8.12263C30.9971 8.05603 31.0554 8.02273 31.1137 8.05603L32.3385 8.76367Z" fill="#587E8B"/>
-</g>
-<g opacity="0.8">
-<path d="M32.3385 11.1616C32.3968 11.1949 32.4468 11.2865 32.4468 11.3531V12.7517C32.4468 12.8183 32.3884 12.8516 32.3301 12.8183L31.1054 12.1107C31.0471 12.0774 30.9971 11.9858 30.9971 11.9192V10.5206C30.9971 10.454 31.0554 10.4207 31.1137 10.454L32.3385 11.1616Z" fill="#587E8B"/>
-</g>
-<path d="M33.9383 56.2589C34.1216 56.3588 34.1216 56.5336 33.9383 56.6335L28.2895 59.9053C28.1145 60.0052 27.8229 60.0052 27.6396 59.9053L17.4168 54.0194C17.2335 53.9112 17.2335 53.7447 17.4168 53.6448L23.0656 50.373C23.2406 50.2731 23.5322 50.2648 23.7155 50.373L33.9383 56.2589Z" fill="#617D8A"/>
-<path d="M26.5985 36.4202C26.6818 36.4702 26.6901 36.5451 26.5985 36.5951L25.1904 37.4109C25.1071 37.4609 24.9655 37.4609 24.8822 37.4109L23.4658 36.5951C23.3825 36.5451 23.3825 36.4702 23.4658 36.4202L24.8738 35.6044C24.9572 35.5544 25.0905 35.5544 25.1821 35.6044L26.5985 36.4202Z" fill="#CAD5DB"/>
-<path d="M29.0067 37.9022C29.09 37.9521 29.0983 38.027 29.0067 38.077L27.5986 38.8929C27.5153 38.9428 27.3737 38.9428 27.2904 38.8929L25.874 38.077C25.7907 38.027 25.7907 37.9521 25.874 37.9022L27.282 37.0863C27.3654 37.0363 27.4987 37.0363 27.5903 37.0863L29.0067 37.9022Z" fill="#CAD5DB"/>
-<path d="M31.4725 39.3841C31.5558 39.434 31.5642 39.509 31.4725 39.5589L30.0645 40.3748C29.9812 40.4247 29.8395 40.4247 29.7562 40.3748L28.3398 39.5589C28.2565 39.509 28.2565 39.434 28.3398 39.3841L29.7479 38.5682C29.8312 38.5183 29.9645 38.5183 30.0561 38.5682L31.4725 39.3841Z" fill="#CAD5DB"/>
-<path d="M33.9715 40.866C34.0548 40.916 34.0632 40.9909 33.9715 41.0409L32.5635 41.8567C32.4802 41.9067 32.3385 41.9067 32.2552 41.8567L30.8389 41.0409C30.7555 40.9909 30.7555 40.916 30.8389 40.866L32.2469 40.0502C32.3302 40.0002 32.4635 40.0002 32.5552 40.0502L33.9715 40.866Z" fill="#CAD5DB"/>
-<path d="M36.5135 42.3563C36.5968 42.4062 36.6052 42.4811 36.5135 42.5311L35.1055 43.347C35.0222 43.3969 34.8805 43.3969 34.7972 43.347L33.3808 42.5311C33.2975 42.4811 33.2975 42.4062 33.3808 42.3563L34.7889 41.5404C34.8722 41.4904 35.0055 41.4904 35.0972 41.5404L36.5135 42.3563Z" fill="#CAD5DB"/>
-<path d="M39.1209 43.8377C39.2043 43.8877 39.2126 43.9626 39.1209 44.0125L37.7129 44.8284C37.6296 44.8784 37.488 44.8784 37.4046 44.8284L35.9883 44.0125C35.905 43.9626 35.905 43.8877 35.9883 43.8377L37.3963 43.0218C37.4796 42.9719 37.6129 42.9719 37.7046 43.0218L39.1209 43.8377Z" fill="#CAD5DB"/>
-<path d="M41.787 45.3201C41.8703 45.3701 41.8786 45.445 41.787 45.495L40.3789 46.3108C40.2956 46.3608 40.154 46.3608 40.0707 46.3108L38.6543 45.495C38.571 45.445 38.571 45.3701 38.6543 45.3201L40.0623 44.5043C40.1456 44.4543 40.2789 44.4543 40.3706 44.5043L41.787 45.3201Z" fill="#CAD5DB"/>
-<path d="M44.3612 46.8099C44.4445 46.8598 44.4528 46.9348 44.3612 46.9847L42.9531 47.8006C42.8698 47.8505 42.7282 47.8505 42.6449 47.8006L41.2285 46.9847C41.1452 46.9348 41.1452 46.8598 41.2285 46.8099L42.6365 45.994C42.7199 45.9441 42.8532 45.9441 42.9448 45.994L44.3612 46.8099Z" fill="#CAD5DB"/>
-<path d="M46.9354 48.2918C47.0187 48.3418 47.027 48.4167 46.9354 48.4666L45.5274 49.2825C45.444 49.3325 45.3024 49.3325 45.2191 49.2825L43.8027 48.4666C43.7194 48.4167 43.7194 48.3418 43.8027 48.2918L45.2108 47.4759C45.2941 47.426 45.4274 47.426 45.519 47.4759L46.9354 48.2918Z" fill="#CAD5DB"/>
-<path d="M49.4686 49.7737C49.5519 49.8237 49.5603 49.8986 49.4686 49.9486L48.0606 50.7644C47.9772 50.8144 47.8356 50.8144 47.7523 50.7644L46.3359 49.9486C46.2526 49.8986 46.2526 49.8237 46.3359 49.7737L47.744 48.9579C47.8273 48.9079 47.9606 48.9079 48.0522 48.9579L49.4686 49.7737Z" fill="#CAD5DB"/>
-<path d="M52.1268 51.264C52.2101 51.3139 52.2185 51.3889 52.1268 51.4388L50.7188 52.2547C50.6355 52.3046 50.4938 52.3046 50.4105 52.2547L48.9941 51.4388C48.9108 51.3889 48.9108 51.3139 48.9941 51.264L50.4022 50.4481C50.4855 50.3982 50.6188 50.3982 50.7104 50.4481L52.1268 51.264Z" fill="#CAD5DB"/>
-<path d="M54.701 52.7459C54.7843 52.7959 54.7927 52.8708 54.701 52.9207L53.293 53.7366C53.2097 53.7866 53.068 53.7866 52.9847 53.7366L51.5683 52.9207C51.485 52.8708 51.485 52.7959 51.5683 52.7459L52.9764 51.93C53.0597 51.8801 53.193 51.8801 53.2847 51.93L54.701 52.7459Z" fill="#CAD5DB"/>
-<path d="M57.284 54.2278C57.3674 54.2778 57.3757 54.3527 57.284 54.4027L55.876 55.2185C55.7927 55.2685 55.651 55.2685 55.5677 55.2185L54.1514 54.4027C54.068 54.3527 54.068 54.2778 54.1514 54.2278L55.5594 53.412C55.6427 53.362 55.776 53.362 55.8677 53.412L57.284 54.2278Z" fill="#CAD5DB"/>
-<path d="M61.3659 56.6172L59.9578 57.4331C59.8745 57.483 59.7329 57.483 59.6496 57.4331L58.3915 56.7088L58.2332 56.6172L56.9668 55.8846C56.8835 55.8346 56.8835 55.7597 56.9668 55.7098L58.3832 54.8939C58.4665 54.844 58.5998 54.844 58.6914 54.8939L59.9578 55.6265L60.1161 55.7181L61.3742 56.4424C61.4575 56.4923 61.4658 56.5673 61.3742 56.6172H61.3659Z" fill="#587E8B"/>
-<path d="M21.3905 39.1844C21.4738 39.2343 21.4821 39.3093 21.3905 39.3592L19.9824 40.1751C19.8991 40.225 19.7575 40.225 19.6742 40.1751L18.2578 39.3592C18.1745 39.3093 18.1745 39.2343 18.2578 39.1844L19.6658 38.3685C19.7492 38.3186 19.8825 38.3186 19.9741 38.3685L21.3905 39.1844Z" fill="#CAD5DB"/>
-<path d="M23.7987 40.6746C23.882 40.7246 23.8903 40.7995 23.7987 40.8494L22.3906 41.6653C22.3073 41.7153 22.1657 41.7153 22.0824 41.6653L20.666 40.8494C20.5827 40.7995 20.5827 40.7246 20.666 40.6746L22.074 39.8588C22.1574 39.8088 22.2907 39.8088 22.3823 39.8588L23.7987 40.6746Z" fill="#CAD5DB"/>
-<path d="M26.2645 42.1566C26.3478 42.2065 26.3562 42.2814 26.2645 42.3314L24.8565 43.1473C24.7731 43.1972 24.6315 43.1972 24.5482 43.1473L23.1318 42.3314C23.0485 42.2814 23.0485 42.2065 23.1318 42.1566L24.5399 41.3407C24.6232 41.2907 24.7565 41.2907 24.8481 41.3407L26.2645 42.1566Z" fill="#CAD5DB"/>
-<path d="M28.7635 43.6385C28.8468 43.6884 28.8552 43.7634 28.7635 43.8133L27.3555 44.6292C27.2722 44.6791 27.1305 44.6791 27.0472 44.6292L25.6308 43.8133C25.5475 43.7634 25.5475 43.6884 25.6308 43.6385L27.0389 42.8226C27.1222 42.7727 27.2555 42.7727 27.3472 42.8226L28.7635 43.6385Z" fill="#CAD5DB"/>
-<path d="M31.2967 45.1287C31.38 45.1787 31.3884 45.2536 31.2967 45.3036L29.8887 46.1194C29.8054 46.1694 29.6637 46.1694 29.5804 46.1194L28.164 45.3036C28.0807 45.2536 28.0807 45.1787 28.164 45.1287L29.5721 44.3129C29.6554 44.2629 29.7887 44.2629 29.8804 44.3129L31.2967 45.1287Z" fill="#CAD5DB"/>
-<path d="M33.9129 46.6102C33.9963 46.6601 34.0046 46.735 33.9129 46.785L32.5049 47.6009C32.4216 47.6508 32.2799 47.6508 32.1966 47.6009L30.7803 46.785C30.6969 46.735 30.6969 46.6601 30.7803 46.6102L32.1883 45.7943C32.2716 45.7443 32.4049 45.7443 32.4966 45.7943L33.9129 46.6102Z" fill="#CAD5DB"/>
-<path d="M36.5711 48.0926C36.6545 48.1425 36.6628 48.2175 36.5711 48.2674L35.1631 49.0833C35.0798 49.1332 34.9382 49.1332 34.8548 49.0833L33.4385 48.2674C33.3551 48.2175 33.3551 48.1425 33.4385 48.0926L34.8465 47.2767C34.9298 47.2268 35.0631 47.2268 35.1548 47.2767L36.5711 48.0926Z" fill="#CAD5DB"/>
-<path d="M39.1454 49.5823C39.2287 49.6323 39.237 49.7072 39.1454 49.7572L37.7373 50.573C37.654 50.623 37.5124 50.623 37.4291 50.573L36.0127 49.7572C35.9294 49.7072 35.9294 49.6323 36.0127 49.5823L37.4207 48.7665C37.504 48.7165 37.6373 48.7165 37.729 48.7665L39.1454 49.5823Z" fill="#CAD5DB"/>
-<path d="M41.7274 51.0643C41.8107 51.1142 41.819 51.1891 41.7274 51.2391L40.3194 52.055C40.236 52.1049 40.0944 52.1049 40.0111 52.055L38.5947 51.2391C38.5114 51.1891 38.5114 51.1142 38.5947 51.0643L40.0028 50.2484C40.0861 50.1984 40.2194 50.1984 40.311 50.2484L41.7274 51.0643Z" fill="#CAD5DB"/>
-<path d="M44.2528 52.5462C44.3361 52.5962 44.3444 52.6711 44.2528 52.721L42.8447 53.5369C42.7614 53.5868 42.6198 53.5868 42.5365 53.5369L41.1201 52.721C41.0368 52.6711 41.0368 52.5962 41.1201 52.5462L42.5281 51.7303C42.6115 51.6804 42.7448 51.6804 42.8364 51.7303L44.2528 52.5462Z" fill="#CAD5DB"/>
-<path d="M46.9188 54.0281C47.0021 54.0781 47.0105 54.153 46.9188 54.203L45.5108 55.0188C45.4275 55.0688 45.2858 55.0688 45.2025 55.0188L43.7861 54.203C43.7028 54.153 43.7028 54.0781 43.7861 54.0281L45.1942 53.2123C45.2775 53.1623 45.4108 53.1623 45.5024 53.2123L46.9188 54.0281Z" fill="#CAD5DB"/>
-<path d="M49.4842 55.5184C49.5675 55.5683 49.5759 55.6432 49.4842 55.6932L48.0762 56.5091C47.9929 56.559 47.8512 56.559 47.7679 56.5091L46.3515 55.6932C46.2682 55.6432 46.2682 55.5683 46.3515 55.5184L47.7596 54.7025C47.8429 54.6526 47.9762 54.6526 48.0679 54.7025L49.4842 55.5184Z" fill="#CAD5DB"/>
-<path d="M52.0672 57.0003C52.1506 57.0503 52.1589 57.1252 52.0672 57.1751L50.6592 57.991C50.5759 58.0409 50.4342 58.0409 50.3509 57.991L48.9346 57.1751C48.8512 57.1252 48.8512 57.0503 48.9346 57.0003L50.3426 56.1844C50.4259 56.1345 50.5592 56.1345 50.6509 56.1844L52.0672 57.0003Z" fill="#CAD5DB"/>
-<path d="M56.1579 59.3897L54.7498 60.2056C54.6665 60.2555 54.5249 60.2555 54.4415 60.2056L53.1835 59.4813L53.0252 59.3897L51.7588 58.6571C51.6755 58.6071 51.6755 58.5322 51.7588 58.4822L53.1751 57.6664C53.2585 57.6164 53.3918 57.6164 53.4834 57.6664L54.7498 58.399L54.9081 58.4906L56.1662 59.2149C56.2495 59.2648 56.2578 59.3397 56.1662 59.3897H56.1579Z" fill="#CAD5DB"/>
-<path d="M23.9735 37.744C24.0568 37.7939 24.0651 37.8688 23.9735 37.9188L22.5654 38.7347C22.4821 38.7846 22.3405 38.7846 22.2572 38.7347L20.8408 37.9188C20.7575 37.8688 20.7575 37.7939 20.8408 37.744L22.2488 36.9281C22.3322 36.8781 22.4655 36.8781 22.5571 36.9281L23.9735 37.744Z" fill="#CAD5DB"/>
-<path d="M26.6483 39.3255C26.7316 39.3754 26.7399 39.4504 26.6483 39.5003L25.2403 40.3162C25.1569 40.3661 25.0153 40.3661 24.932 40.3162L23.5156 39.5003C23.4323 39.4504 23.4323 39.3754 23.5156 39.3255L24.9237 38.5096C25.007 38.4597 25.1403 38.4597 25.2319 38.5096L26.6483 39.3255Z" fill="#CAD5DB"/>
-<path d="M29.3143 40.8074C29.3976 40.8574 29.406 40.9323 29.3143 40.9823L27.9063 41.7981C27.823 41.8481 27.6813 41.8481 27.598 41.7981L26.1816 40.9823C26.0983 40.9323 26.0983 40.8574 26.1816 40.8074L27.5897 39.9916C27.673 39.9416 27.8063 39.9416 27.8979 39.9916L29.3143 40.8074Z" fill="#CAD5DB"/>
-<path d="M31.9881 42.3895C32.0715 42.4394 32.0798 42.5143 31.9881 42.5643L30.5801 43.3802C30.4968 43.4301 30.3551 43.4301 30.2718 43.3802L28.8555 42.5643C28.7721 42.5143 28.7721 42.4394 28.8555 42.3895L30.2635 41.5736C30.3468 41.5236 30.4801 41.5236 30.5718 41.5736L31.9881 42.3895Z" fill="#CAD5DB"/>
-<path d="M34.6629 43.9378C34.7463 43.9878 34.7546 44.0627 34.6629 44.1126L33.2549 44.9285C33.1716 44.9785 33.0299 44.9785 32.9466 44.9285L31.5303 44.1126C31.4469 44.0627 31.4469 43.9878 31.5303 43.9378L32.9383 43.1219C33.0216 43.072 33.1549 43.072 33.2466 43.1219L34.6629 43.9378Z" fill="#CAD5DB"/>
-<path d="M37.329 45.3699C37.4123 45.4199 37.4206 45.4948 37.329 45.5448L35.9209 46.3606C35.8376 46.4106 35.696 46.4106 35.6126 46.3606L34.1963 45.5448C34.113 45.4948 34.113 45.4199 34.1963 45.3699L35.6043 44.5541C35.6876 44.5041 35.8209 44.5041 35.9126 44.5541L37.329 45.3699Z" fill="#CAD5DB"/>
-<path d="M40.0038 46.9349C40.0871 46.9848 40.0954 47.0597 40.0038 47.1097L38.5957 47.9256C38.5124 47.9755 38.3708 47.9755 38.2875 47.9256L36.8711 47.1097C36.7878 47.0597 36.7878 46.9848 36.8711 46.9349L38.2791 46.119C38.3624 46.0691 38.4957 46.0691 38.5874 46.119L40.0038 46.9349Z" fill="#CAD5DB"/>
-<path d="M42.6698 48.45C42.7531 48.5 42.7614 48.5749 42.6698 48.6248L41.2617 49.4407C41.1784 49.4907 41.0368 49.4907 40.9535 49.4407L39.5371 48.6248C39.4538 48.5749 39.4538 48.5 39.5371 48.45L40.9451 47.6341C41.0285 47.5842 41.1618 47.5842 41.2534 47.6341L42.6698 48.45Z" fill="#CAD5DB"/>
-<path d="M45.3436 50.0232C45.4269 50.0732 45.4353 50.1481 45.3436 50.1981L43.9356 51.0139C43.8522 51.0639 43.7106 51.0639 43.6273 51.0139L42.2109 50.1981C42.1276 50.1481 42.1276 50.0732 42.2109 50.0232L43.619 49.2074C43.7023 49.1574 43.8356 49.1574 43.9272 49.2074L45.3436 50.0232Z" fill="#CAD5DB"/>
-<path d="M48.0184 51.6053C48.1017 51.6552 48.1101 51.7302 48.0184 51.7801L46.6104 52.596C46.5271 52.6459 46.3854 52.6459 46.3021 52.596L44.8857 51.7801C44.8024 51.7302 44.8024 51.6552 44.8857 51.6053L46.2938 50.7894C46.3771 50.7395 46.5104 50.7395 46.602 50.7894L48.0184 51.6053Z" fill="#CAD5DB"/>
-<path d="M50.6844 53.1624C50.7677 53.2124 50.7761 53.2873 50.6844 53.3372L49.2764 54.1531C49.1931 54.2031 49.0514 54.2031 48.9681 54.1531L47.5517 53.3372C47.4684 53.2873 47.4684 53.2124 47.5517 53.1624L48.9598 52.3465C49.0431 52.2966 49.1764 52.2966 49.2681 52.3465L50.6844 53.1624Z" fill="#CAD5DB"/>
-<path d="M53.3592 54.7855C53.4425 54.8354 53.4509 54.9103 53.3592 54.9603L51.9512 55.7762C51.8679 55.8261 51.7262 55.8261 51.6429 55.7762L50.2265 54.9603C50.1432 54.9103 50.1432 54.8354 50.2265 54.7855L51.6346 53.9696C51.7179 53.9196 51.8512 53.9196 51.9429 53.9696L53.3592 54.7855Z" fill="#CAD5DB"/>
-<path d="M56.0252 56.3841C56.1086 56.434 56.1169 56.509 56.0252 56.5589L54.6172 57.3748C54.5339 57.4247 54.3923 57.4247 54.3089 57.3748L52.8926 56.5589C52.8092 56.509 52.8092 56.434 52.8926 56.3841L54.3006 55.5682C54.3839 55.5183 54.5172 55.5183 54.6089 55.5682L56.0252 56.3841Z" fill="#CAD5DB"/>
-<path d="M58.7 57.8909C58.7834 57.9409 58.7917 58.0158 58.7 58.0658L57.292 58.8816C57.2087 58.9316 57.0671 58.9316 56.9837 58.8816L55.5674 58.0658C55.4841 58.0158 55.4841 57.9409 55.5674 57.8909L56.9754 57.0751C57.0587 57.0251 57.192 57.0251 57.2837 57.0751L58.7 57.8909Z" fill="#CAD5DB"/>
-<path d="M18.6336 40.5164C18.717 40.5664 18.7253 40.6413 18.6336 40.6912L17.2256 41.5071C17.1423 41.5571 17.0007 41.5571 16.9173 41.5071L15.501 40.6912C15.4176 40.6413 15.4176 40.5664 15.501 40.5164L16.909 39.7005C16.9923 39.6506 17.1256 39.6506 17.2173 39.7005L18.6336 40.5164Z" fill="#CAD5DB"/>
-<path d="M21.2997 42.0985C21.383 42.1484 21.3913 42.2233 21.2997 42.2733L19.8916 43.0892C19.8083 43.1391 19.6667 43.1391 19.5834 43.0892L18.167 42.2733C18.0837 42.2233 18.0837 42.1484 18.167 42.0985L19.575 41.2826C19.6583 41.2326 19.7916 41.2326 19.8833 41.2826L21.2997 42.0985Z" fill="#CAD5DB"/>
-<path d="M23.9745 43.5799C24.0578 43.6298 24.0661 43.7048 23.9745 43.7547L22.5664 44.5706C22.4831 44.6205 22.3415 44.6205 22.2582 44.5706L20.8418 43.7547C20.7585 43.7048 20.7585 43.6298 20.8418 43.5799L22.2498 42.764C22.3331 42.7141 22.4664 42.7141 22.5581 42.764L23.9745 43.5799Z" fill="#CAD5DB"/>
-<path d="M26.6483 45.1619C26.7316 45.2119 26.7399 45.2868 26.6483 45.3368L25.2403 46.1526C25.1569 46.2026 25.0153 46.2026 24.932 46.1526L23.5156 45.3368C23.4323 45.2868 23.4323 45.2119 23.5156 45.1619L24.9237 44.3461C25.007 44.2961 25.1403 44.2961 25.2319 44.3461L26.6483 45.1619Z" fill="#CAD5DB"/>
-<path d="M29.3153 46.7103C29.3986 46.7602 29.4069 46.8351 29.3153 46.8851L27.9072 47.701C27.8239 47.7509 27.6823 47.7509 27.599 47.701L26.1826 46.8851C26.0993 46.8351 26.0993 46.7602 26.1826 46.7103L27.5906 45.8944C27.674 45.8444 27.8073 45.8444 27.8989 45.8944L29.3153 46.7103Z" fill="#CAD5DB"/>
-<path d="M31.9891 48.1424C32.0724 48.1923 32.0808 48.2673 31.9891 48.3172L30.5811 49.1331C30.4978 49.183 30.3561 49.183 30.2728 49.1331L28.8564 48.3172C28.7731 48.2673 28.7731 48.1923 28.8564 48.1424L30.2645 47.3265C30.3478 47.2766 30.4811 47.2766 30.5727 47.3265L31.9891 48.1424Z" fill="#CAD5DB"/>
-<path d="M34.6639 49.7073C34.7472 49.7573 34.7556 49.8322 34.6639 49.8822L33.2559 50.698C33.1726 50.748 33.0309 50.748 32.9476 50.698L31.5312 49.8822C31.4479 49.8322 31.4479 49.7573 31.5312 49.7073L32.9393 48.8915C33.0226 48.8415 33.1559 48.8415 33.2475 48.8915L34.6639 49.7073Z" fill="#CAD5DB"/>
-<path d="M37.3299 51.2225C37.4132 51.2724 37.4216 51.3473 37.3299 51.3973L35.9219 52.2132C35.8386 52.2631 35.6969 52.2631 35.6136 52.2132L34.1973 51.3973C34.1139 51.3473 34.1139 51.2724 34.1973 51.2225L35.6053 50.4066C35.6886 50.3567 35.8219 50.3567 35.9136 50.4066L37.3299 51.2225Z" fill="#CAD5DB"/>
-<path d="M40.0038 52.7962C40.0871 52.8461 40.0954 52.9211 40.0038 52.971L38.5957 53.7869C38.5124 53.8368 38.3708 53.8368 38.2875 53.7869L36.8711 52.971C36.7878 52.9211 36.7878 52.8461 36.8711 52.7962L38.2791 51.9803C38.3624 51.9304 38.4957 51.9304 38.5874 51.9803L40.0038 52.7962Z" fill="#CAD5DB"/>
-<path d="M42.6698 54.3777C42.7531 54.4277 42.7614 54.5026 42.6698 54.5526L41.2617 55.3684C41.1784 55.4184 41.0368 55.4184 40.9535 55.3684L39.5371 54.5526C39.4538 54.5026 39.4538 54.4277 39.5371 54.3777L40.9451 53.5619C41.0285 53.5119 41.1618 53.5119 41.2534 53.5619L42.6698 54.3777Z" fill="#CAD5DB"/>
-<path d="M45.3446 55.9349C45.4279 55.9848 45.4362 56.0598 45.3446 56.1097L43.9365 56.9256C43.8532 56.9755 43.7116 56.9755 43.6283 56.9256L42.2119 56.1097C42.1286 56.0598 42.1286 55.9848 42.2119 55.9349L43.6199 55.119C43.7033 55.0691 43.8366 55.0691 43.9282 55.119L45.3446 55.9349Z" fill="#CAD5DB"/>
-<path d="M48.0194 57.5579C48.1027 57.6079 48.111 57.6828 48.0194 57.7328L46.6113 58.5486C46.528 58.5986 46.3864 58.5986 46.3031 58.5486L44.8867 57.7328C44.8034 57.6828 44.8034 57.6079 44.8867 57.5579L46.2947 56.7421C46.3781 56.6921 46.5114 56.6921 46.603 56.7421L48.0194 57.5579Z" fill="#CAD5DB"/>
-<path d="M50.6854 59.1565C50.7687 59.2065 50.777 59.2814 50.6854 59.3314L49.2774 60.1472C49.194 60.1972 49.0524 60.1972 48.9691 60.1472L47.5527 59.3314C47.4694 59.2814 47.4694 59.2065 47.5527 59.1565L48.9608 58.3407C49.0441 58.2907 49.1774 58.2907 49.269 58.3407L50.6854 59.1565Z" fill="#CAD5DB"/>
-<path d="M53.3602 60.6634C53.4435 60.7133 53.4519 60.7883 53.3602 60.8382L51.9522 61.6541C51.8688 61.704 51.7272 61.704 51.6439 61.6541L50.2275 60.8382C50.1442 60.7883 50.1442 60.7133 50.2275 60.6634L51.6356 59.8475C51.7189 59.7976 51.8522 59.7976 51.9438 59.8475L53.3602 60.6634Z" fill="#CAD5DB"/>
-<path d="M30.1551 34.2308C30.2384 34.2807 30.2468 34.3557 30.1551 34.4056L28.7471 35.2215C28.6638 35.2714 28.5221 35.2714 28.4388 35.2215L27.0224 34.4056C26.9391 34.3557 26.9391 34.2807 27.0224 34.2308L28.4305 33.4149C28.5138 33.365 28.6471 33.365 28.7388 33.4149L30.1551 34.2308Z" fill="#5E2AD6"/>
-<path d="M30.1551 34.2308C30.2384 34.2807 30.2468 34.3557 30.1551 34.4056L28.7471 35.2215C28.6638 35.2714 28.5221 35.2714 28.4388 35.2215L27.0224 34.4056C26.9391 34.3557 26.9391 34.2807 27.0224 34.2308L28.4305 33.4149C28.5138 33.365 28.6471 33.365 28.7388 33.4149L30.1551 34.2308Z" fill="url(#paint0_linear_11114_7617)"/>
-<path d="M65.3143 54.3025C65.3976 54.3525 65.406 54.4274 65.3143 54.4774L63.9063 55.2932C63.823 55.3432 63.6813 55.3432 63.598 55.2932L62.1816 54.4774C62.0983 54.4274 62.0983 54.3525 62.1816 54.3025L63.5897 53.4867C63.673 53.4367 63.8063 53.4367 63.8979 53.4867L65.3143 54.3025Z" fill="#5E2AD6"/>
-<path d="M65.3143 54.303C65.3976 54.353 65.406 54.4279 65.3143 54.4779L63.9063 55.2937C63.823 55.3437 63.6813 55.3437 63.598 55.2937L62.1816 54.4779C62.0983 54.4279 62.0983 54.353 62.1816 54.303L63.5897 53.4872C63.673 53.4372 63.8063 53.4372 63.8979 53.4872L65.3143 54.303Z" fill="url(#paint1_linear_11114_7617)"/>
-<g opacity="0.7">
-<path d="M69.839 23.5412L69.7557 53.1206C69.7557 53.3204 69.6807 53.4619 69.5724 53.5368L68.2643 54.2944C68.1644 54.386 68.0144 54.4026 67.8478 54.336L67.9061 54.3693C68.0894 54.4776 68.1727 54.6108 68.1727 54.744C68.1727 54.744 68.1727 54.7689 68.1727 54.7773C68.1727 54.7773 68.1727 54.7689 68.1727 54.7606V56.6088C68.1727 56.742 68.081 56.8752 67.9061 56.9751L42.2698 71.8356C41.9198 72.0437 41.3366 72.0437 40.9867 71.8356L2.20313 49.4991C2.02817 49.3992 1.93652 49.266 1.93652 49.1328V47.2596C1.93652 47.1264 2.02817 46.9849 2.20313 46.885L27.8394 32.0246C28.1644 31.8414 28.6643 31.8248 29.0225 31.9746L28.9725 31.9496C28.6226 31.7415 28.331 31.2503 28.331 30.8424L28.4143 1.26303C28.4143 1.04657 28.4976 0.896716 28.6226 0.83844C28.6393 0.830114 28.6643 0.82179 28.6893 0.813465C28.6726 0.813465 28.6476 0.821791 28.6309 0.830116L30.0223 0.0225725C30.1306 -0.0107282 30.2639 0.0142474 30.4139 0.0974992L69.1975 22.434C69.5557 22.6421 69.839 23.1333 69.839 23.5412Z" fill="url(#paint2_linear_11114_7617)"/>
-</g>
-<path d="M69.839 23.5329L69.7557 53.1123C69.7557 53.3121 69.6807 53.4536 69.5724 53.5285L68.2643 54.2861C68.1644 54.3777 68.0144 54.3943 67.8477 54.3277L67.9061 54.361C68.0894 54.4693 68.1727 54.6025 68.1727 54.7357C68.1727 54.7357 68.1727 54.7606 68.1727 54.769C68.1727 54.769 68.1727 54.7606 68.1727 54.7523V56.6005C68.1727 56.7337 68.081 56.8669 67.9061 56.9668L42.2698 71.8273C41.9198 72.0354 41.3366 72.0354 40.9867 71.8273L2.20313 49.4908C2.02817 49.3909 1.93652 49.2577 1.93652 49.1245V47.2513C1.93652 47.1181 2.02817 46.9766 2.20313 46.8767L27.8394 32.0163C28.1644 31.8331 28.6643 31.8165 29.0225 31.9663L28.9725 31.9413C28.6226 31.7332 28.331 31.242 28.331 30.8341L28.4143 1.25472C28.4143 1.03827 28.4976 0.888415 28.6226 0.830139C28.6393 0.821814 28.6643 0.813486 28.6893 0.805161C28.6726 0.805161 28.6476 0.813487 28.6309 0.821812L30.0223 0.0142717C30.1306 -0.019029 30.2639 0.00594666 30.4139 0.0891984L69.1975 22.4257C69.5557 22.6338 69.839 23.125 69.839 23.5329Z" fill="url(#paint3_linear_11114_7617)"/>
-<path d="M39.1992 13.7878C39.1992 12.2496 40.8631 11.2872 42.1964 12.0541L63.573 24.3504C64.1934 24.7072 64.5758 25.3684 64.5758 26.084V43.702C64.5758 45.2402 62.9119 46.2027 61.5785 45.4357L40.202 33.1394C39.5816 32.7826 39.1992 32.1215 39.1992 31.4058V13.7878Z" fill="#6E17FF" fill-opacity="0.2"/>
-<path d="M38.0762 14.4616C38.0762 12.9234 39.7401 11.961 41.0734 12.728L62.45 25.0242C63.0703 25.3811 63.4527 26.0422 63.4527 26.7579V44.3759C63.4527 45.9141 61.7888 46.8765 60.4555 46.1095L39.0789 33.8133C38.4586 33.4564 38.0762 32.7953 38.0762 32.0796V14.4616Z" fill="#6E17FF" fill-opacity="0.8"/>
-<g filter="url(#filter1_d_11114_7617)">
-<g filter="url(#filter2_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 16.8438C39.9639 16.7361 40.1011 16.6986 40.2088 16.7601L40.4334 16.8884C40.5411 16.9499 40.5785 17.0871 40.517 17.1948C40.4555 17.3025 40.3183 17.3399 40.2106 17.2784L39.986 17.1501C39.8783 17.0886 39.8409 16.9514 39.9024 16.8438ZM44.6184 19.5375C44.6799 19.4298 44.8171 19.3924 44.9248 19.4539L47.1705 20.7367C47.2782 20.7982 47.3156 20.9353 47.2541 21.043C47.1926 21.1507 47.0554 21.1882 46.9477 21.1267L44.702 19.8439C44.5943 19.7824 44.5569 19.6452 44.6184 19.5375ZM47.7624 21.3334C47.8239 21.2257 47.9611 21.1882 48.0688 21.2498L48.7425 21.6346C48.8502 21.6961 48.8876 21.8333 48.8261 21.941C48.7646 22.0487 48.6274 22.0861 48.5197 22.0246L47.846 21.6398C47.7383 21.5782 47.7009 21.4411 47.7624 21.3334ZM49.3382 22.2335C49.3997 22.1258 49.5369 22.0883 49.6446 22.1498L51.4374 23.1739C51.5451 23.2354 51.5825 23.3726 51.521 23.4803C51.4595 23.588 51.3223 23.6254 51.2146 23.5639L49.4218 22.5398C49.3141 22.4783 49.2767 22.3412 49.3382 22.2335ZM52.0293 23.7706C52.0908 23.6629 52.2279 23.6255 52.3356 23.687L52.5602 23.8153C52.6679 23.8768 52.7053 24.0139 52.6438 24.1216C52.5823 24.2293 52.4451 24.2668 52.3374 24.2053L52.1129 24.077C52.0052 24.0155 51.9677 23.8783 52.0293 23.7706ZM53.1521 24.412C53.2136 24.3043 53.3508 24.2668 53.4585 24.3284L55.9288 25.7394C56.0365 25.8009 56.0739 25.9381 56.0124 26.0458C55.9509 26.1535 55.8137 26.1909 55.706 26.1294L53.2357 24.7184C53.128 24.6568 53.0906 24.5197 53.1521 24.412ZM56.5207 26.3361C56.5822 26.2284 56.7194 26.191 56.8271 26.2525L58.3991 27.1504C58.5068 27.2119 58.5442 27.3491 58.4827 27.4568C58.4212 27.5645 58.284 27.6019 58.1763 27.5404L56.6043 26.6425C56.4966 26.581 56.4592 26.4438 56.5207 26.3361ZM58.991 27.7471C59.0525 27.6394 59.1897 27.602 59.2974 27.6635L60.9449 28.6046C61.0526 28.6661 61.0901 28.8033 61.0286 28.911C60.967 29.0187 60.8299 29.0561 60.7222 28.9946L59.0746 28.0535C58.9669 27.992 58.9295 27.8548 58.991 27.7471Z" fill="white"/>
-</g>
-<g filter="url(#filter3_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 19.5386C39.9639 19.4309 40.1011 19.3934 40.2088 19.455L41.3317 20.0963C41.4394 20.1578 41.4768 20.295 41.4153 20.4027C41.3538 20.5104 41.2166 20.5479 41.1089 20.4863L39.986 19.845C39.8783 19.7834 39.8409 19.6463 39.9024 19.5386ZM41.9236 20.693C41.9851 20.5854 42.1222 20.5479 42.2299 20.6094L45.1494 22.277C45.2571 22.3385 45.2945 22.4757 45.233 22.5834C45.1715 22.6911 45.0343 22.7285 44.9266 22.667L42.0072 20.9994C41.8995 20.9379 41.862 20.8007 41.9236 20.693ZM45.7413 22.8737C45.8028 22.766 45.94 22.7286 46.0477 22.7901L49.6446 24.8447C49.7523 24.9062 49.7897 25.0434 49.7282 25.1511C49.6667 25.2588 49.5295 25.2962 49.4218 25.2347L45.8249 23.1801C45.7172 23.1186 45.6797 22.9814 45.7413 22.8737ZM50.2327 25.4392C50.2942 25.3315 50.4314 25.2941 50.5391 25.3556L51.8865 26.1253C51.9942 26.1868 52.0316 26.3239 51.9701 26.4316C51.9086 26.5393 51.7714 26.5768 51.6637 26.5153L50.3163 25.7456C50.2086 25.6841 50.1712 25.5469 50.2327 25.4392ZM52.4835 26.7249C52.545 26.6172 52.6821 26.5797 52.7898 26.6412L56.3779 28.6907C56.4856 28.7523 56.5231 28.8894 56.4615 28.9971C56.4 29.1048 56.2629 29.1423 56.1552 29.0808L52.5671 27.0312C52.4594 26.9697 52.4219 26.8326 52.4835 26.7249ZM56.9698 29.2875C57.0313 29.1798 57.1685 29.1423 57.2762 29.2038L60.9449 31.2994C61.0526 31.3609 61.0901 31.4981 61.0286 31.6058C60.967 31.7135 60.8299 31.7509 60.7222 31.6894L57.0534 29.5939C56.9457 29.5323 56.9083 29.3952 56.9698 29.2875Z" fill="white"/>
-</g>
-<g filter="url(#filter4_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 27.623C39.9639 27.5154 40.1011 27.4779 40.2088 27.5394L41.3317 28.1808C41.4394 28.2423 41.4768 28.3795 41.4153 28.4872C41.3538 28.5949 41.2166 28.6323 41.1089 28.5708L39.986 27.9294C39.8783 27.8679 39.8409 27.7307 39.9024 27.623ZM45.7413 30.9582C45.8028 30.8505 45.94 30.8131 46.0477 30.8746L49.6446 32.9291C49.7523 32.9907 49.7897 33.1278 49.7282 33.2355C49.6667 33.3432 49.5295 33.3807 49.4218 33.3191L45.8249 31.2646C45.7172 31.2031 45.6798 31.0659 45.7413 30.9582ZM50.2327 33.5237C50.2942 33.416 50.4314 33.3786 50.5391 33.4401L51.8865 34.2097C51.9942 34.2712 52.0316 34.4084 51.9701 34.5161C51.9086 34.6238 51.7714 34.6612 51.6637 34.5997L50.3163 33.8301C50.2086 33.7686 50.1712 33.6314 50.2327 33.5237ZM52.4835 34.8093C52.545 34.7016 52.6822 34.6642 52.7898 34.7257L55.4796 36.2621C55.5873 36.3236 55.6248 36.4608 55.5633 36.5685C55.5017 36.6762 55.3646 36.7136 55.2569 36.6521L52.5671 35.1157C52.4594 35.0542 52.4219 34.917 52.4835 34.8093ZM56.0715 36.8588C56.1331 36.7511 56.2702 36.7137 56.3779 36.7752L57.2762 37.2883C57.3839 37.3498 57.4213 37.487 57.3598 37.5947C57.2983 37.7024 57.1611 37.7398 57.0534 37.6783L56.1552 37.1652C56.0475 37.1037 56.01 36.9665 56.0715 36.8588ZM57.8681 37.885C57.9296 37.7773 58.0668 37.7399 58.1745 37.8014L60.9449 39.3839C61.0526 39.4454 61.0901 39.5826 61.0286 39.6903C60.9671 39.798 60.8299 39.8354 60.7222 39.7739L57.9517 38.1914C57.844 38.1299 57.8066 37.9927 57.8681 37.885Z" fill="white"/>
-</g>
-<g filter="url(#filter5_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 22.2334C39.9639 22.1257 40.1011 22.0883 40.2088 22.1498L40.4334 22.2781C40.5411 22.3396 40.5785 22.4767 40.517 22.5844C40.4555 22.6921 40.3183 22.7296 40.2106 22.6681L39.986 22.5398C39.8783 22.4783 39.8409 22.3411 39.9024 22.2334ZM41.0253 22.8748C41.0868 22.7671 41.224 22.7296 41.3317 22.7912L43.8019 24.2022C43.9096 24.2637 43.9471 24.4009 43.8856 24.5086C43.824 24.6163 43.6869 24.6537 43.5792 24.5922L41.1089 23.1812C41.0012 23.1196 40.9638 22.9825 41.0253 22.8748ZM44.3938 24.7989C44.4554 24.6912 44.5925 24.6538 44.7002 24.7153L47.8442 26.5111C47.9519 26.5726 47.9894 26.7098 47.9278 26.8175C47.8663 26.9252 47.7291 26.9626 47.6215 26.9011L44.4775 25.1053C44.3698 25.0438 44.3323 24.9066 44.3938 24.7989ZM54.7241 30.6995C54.7856 30.5918 54.9228 30.5544 55.0305 30.6159L57.5077 32.0309C57.6154 32.0924 57.6529 32.2296 57.5914 32.3373C57.5298 32.445 57.3927 32.4824 57.285 32.4209L54.8077 31.0059C54.7 30.9444 54.6626 30.8072 54.7241 30.6995ZM58.0927 32.6237C58.1542 32.516 58.2914 32.4785 58.3991 32.54L60.9449 33.9942C61.0526 34.0558 61.0901 34.1929 61.0286 34.3006C60.967 34.4083 60.8299 34.4458 60.7222 34.3843L58.1763 32.93C58.0686 32.8685 58.0312 32.7314 58.0927 32.6237Z" fill="white"/>
-</g>
-<g filter="url(#filter6_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 24.9282C39.9639 24.8205 40.1011 24.7831 40.2088 24.8446L40.8825 25.2294C40.9902 25.2909 41.0276 25.4281 40.9661 25.5358C40.9046 25.6435 40.7674 25.681 40.6597 25.6194L39.986 25.2346C39.8783 25.1731 39.8409 25.0359 39.9024 24.9282ZM45.9658 28.3916C46.0274 28.2839 46.1645 28.2465 46.2722 28.308L48.072 29.336C48.1797 29.3975 48.2171 29.5347 48.1556 29.6424C48.0941 29.7501 47.9569 29.7876 47.8492 29.726L46.0495 28.698C45.9418 28.6365 45.9043 28.4993 45.9658 28.3916ZM48.6607 29.9309C48.7222 29.8232 48.8594 29.7858 48.9671 29.8473L53.0094 32.1563C53.1171 32.2178 53.1545 32.355 53.093 32.4627C53.0315 32.5704 52.8943 32.6078 52.7866 32.5463L48.7443 30.2373C48.6366 30.1758 48.5992 30.0386 48.6607 29.9309ZM55.1733 33.6509C55.2348 33.5432 55.3719 33.5058 55.4796 33.5673L59.2974 35.748C59.4051 35.8095 59.4425 35.9467 59.381 36.0544C59.3195 36.1621 59.1823 36.1995 59.0746 36.138L55.2569 33.9573C55.1492 33.8958 55.1117 33.7586 55.1733 33.6509ZM59.8893 36.3447C59.9508 36.237 60.0879 36.1996 60.1956 36.2611L60.9449 36.6891C61.0526 36.7506 61.0901 36.8878 61.0286 36.9955C60.9671 37.1032 60.8299 37.1406 60.7222 37.0791L59.9729 36.6511C59.8652 36.5896 59.8277 36.4524 59.8893 36.3447Z" fill="white"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.9024 30.3179C39.9639 30.2102 40.1011 30.1727 40.2088 30.2343L40.8825 30.6191C40.9902 30.6806 41.0276 30.8178 40.9661 30.9255C40.9046 31.0332 40.7674 31.0706 40.6597 31.0091L39.986 30.6243C39.8783 30.5627 39.8409 30.4256 39.9024 30.3179ZM43.0477 32.1144C43.1092 32.0067 43.2464 31.9693 43.3541 32.0308L44.0265 32.4149C44.1342 32.4764 44.1716 32.6136 44.1101 32.7213C44.0486 32.829 43.9114 32.8664 43.8037 32.8049L43.1313 32.4208C43.0236 32.3593 42.9862 32.2221 43.0477 32.1144ZM47.3133 34.5509C47.3748 34.4432 47.512 34.4058 47.6197 34.4673L50.0899 35.8783C50.1976 35.9399 50.2351 36.077 50.1736 36.1847C50.112 36.2924 49.9749 36.3299 49.8672 36.2684L47.3969 34.8573C47.2892 34.7958 47.2517 34.6586 47.3133 34.5509ZM50.6818 36.4751C50.7433 36.3674 50.8805 36.3299 50.9882 36.3914L53.2339 37.6742C53.3416 37.7357 53.3791 37.8729 53.3175 37.9806C53.256 38.0883 53.1189 38.1257 53.0112 38.0642L50.7654 36.7815C50.6578 36.7199 50.6203 36.5828 50.6818 36.4751ZM53.8258 38.2709C53.8873 38.1632 54.0245 38.1258 54.1322 38.1873L54.8059 38.5721C54.9136 38.6336 54.9511 38.7708 54.8895 38.8785C54.828 38.9862 54.6909 39.0236 54.5832 38.9621L53.9094 38.5773C53.8018 38.5158 53.7643 38.3786 53.8258 38.2709ZM55.3978 39.1688C55.4593 39.0611 55.5965 39.0237 55.7042 39.0852L56.3779 39.47C56.4856 39.5316 56.5231 39.6687 56.4615 39.7764C56.4 39.8841 56.2629 39.9216 56.1552 39.86L55.4814 39.4752C55.3737 39.4137 55.3363 39.2765 55.3978 39.1688ZM56.9698 40.0668C57.0313 39.9591 57.1685 39.9216 57.2762 39.9831L60.9449 42.0787C61.0526 42.1402 61.0901 42.2774 61.0286 42.3851C60.9671 42.4928 60.8299 42.5302 60.7222 42.4687L57.0534 40.3731C56.9457 40.3116 56.9083 40.1745 56.9698 40.0668Z" fill="white"/>
-</g>
-<g filter="url(#filter7_d_11114_7617)">
-<g filter="url(#filter8_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.4747 25.8267C41.5362 25.719 41.6734 25.6815 41.7811 25.743L43.1578 26.5294C43.2654 26.5909 43.3029 26.7281 43.2414 26.8358C43.1799 26.9435 43.0427 26.9809 42.935 26.9194L41.5583 26.133C41.4506 26.0715 41.4132 25.9344 41.4747 25.8267Z" fill="#FFC1FF"/>
-</g>
-<g filter="url(#filter9_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.4747 31.2163C41.5362 31.1086 41.6734 31.0712 41.7811 31.1327L42.4548 31.5175C42.5625 31.579 42.5999 31.7162 42.5384 31.8239C42.4769 31.9316 42.3397 31.969 42.232 31.9075L41.5583 31.5227C41.4506 31.4612 41.4132 31.324 41.4747 31.2163ZM44.6206 33.0132C44.6821 32.9055 44.8193 32.8681 44.927 32.9296L46.7216 33.9547C46.8293 34.0163 46.8668 34.1534 46.8053 34.2611C46.7437 34.3688 46.6066 34.4063 46.4989 34.3447L44.7042 33.3196C44.5965 33.2581 44.5591 33.1209 44.6206 33.0132Z" fill="#FFC1FF"/>
-</g>
-<g filter="url(#filter10_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M50.4571 28.2627C50.5186 28.155 50.6558 28.1176 50.7635 28.1791L54.1321 30.1032C54.2398 30.1647 54.2772 30.3019 54.2157 30.4096C54.1542 30.5173 54.017 30.5547 53.9093 30.4932L50.5407 28.5691C50.433 28.5076 50.3956 28.3704 50.4571 28.2627Z" fill="#FFC1FF"/>
-</g>
-<g filter="url(#filter11_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M53.6007 32.7534C53.6622 32.6457 53.7993 32.6083 53.907 32.6698L54.5808 33.0546C54.6885 33.1161 54.7259 33.2533 54.6644 33.361C54.6029 33.4687 54.4657 33.5061 54.358 33.4446L53.6843 33.0598C53.5766 32.9983 53.5391 32.8611 53.6007 32.7534Z" fill="#FFC1FF"/>
-</g>
-<g filter="url(#filter12_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.0255 17.4854C41.087 17.3777 41.2242 17.3402 41.3318 17.4017L44.0267 18.941C44.1344 19.0026 44.1718 19.1397 44.1103 19.2474C44.0488 19.3551 43.9116 19.3926 43.8039 19.331L41.1091 17.7917C41.0014 17.7302 40.9639 17.5931 41.0255 17.4854Z" fill="#FFC1FF"/>
-</g>
-<g filter="url(#filter13_d_11114_7617)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.9229 28.7778C41.9844 28.6701 42.1216 28.6327 42.2293 28.6942L45.1487 30.3618C45.2564 30.4233 45.2939 30.5605 45.2324 30.6682C45.1708 30.7759 45.0337 30.8133 44.926 30.7518L42.0065 29.0842C41.8988 29.0227 41.8614 28.8855 41.9229 28.7778Z" fill="#FFC1FF"/>
-</g>
-</g>
-<path d="M36.7285 11.5499C36.7285 10.01 38.3957 9.04776 39.7291 9.81813L42.4662 11.3996C43.0847 11.7569 43.4657 12.417 43.4657 13.1313V13.6019C43.4657 15.1418 41.7984 16.104 40.4651 15.3337L37.728 13.7522C37.1095 13.3949 36.7285 12.7348 36.7285 12.0205V11.5499Z" fill="#00FDFE" fill-opacity="0.8"/>
-<path d="M39.7827 12.5417L38.5255 12.4051L38.4832 11.9127L39.3958 12.0519L38.616 11.0671L38.7863 10.7156L39.8568 12.112L39.7827 12.5417Z" fill="white"/>
-<path d="M40.1816 12.9126L41.7536 13.8176V14.2398L40.1816 13.3325V12.9126Z" fill="white"/>
-</g>
-<defs>
-<filter id="filter0_d_11114_7617" x="0.809922" y="31.7718" width="68.7163" height="41.5957" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="0.13" dy="0.13"/>
-<feGaussianBlur stdDeviation="0.62"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.2 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter1_d_11114_7617" x="35.873" y="12.7305" width="29.1855" height="33.7681" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset/>
-<feGaussianBlur stdDeviation="2"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.6 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter2_d_11114_7617" x="34.873" y="6.73047" width="41.1855" height="32.2939" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter3_d_11114_7617" x="34.873" y="9.42529" width="41.1855" height="32.2939" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter4_d_11114_7617" x="34.873" y="17.5098" width="41.1855" height="32.2939" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter5_d_11114_7617" x="34.873" y="12.1201" width="41.1855" height="32.2939" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter6_d_11114_7617" x="34.873" y="14.8149" width="41.1855" height="32.2939" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter7_d_11114_7617" x="36.9961" y="13.3721" width="21.6982" height="25.0024" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset/>
-<feGaussianBlur stdDeviation="2"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 0.756863 0 0 0 0 1 0 0 0 0.6 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter8_d_11114_7617" x="36.4453" y="15.7134" width="21.8252" height="21.2358" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter9_d_11114_7617" x="36.4453" y="21.103" width="25.3896" height="23.2715" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter10_d_11114_7617" x="45.4277" y="18.1494" width="23.8174" height="22.3735" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter11_d_11114_7617" x="48.5713" y="22.6401" width="21.123" height="20.834" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter12_d_11114_7617" x="35.9961" y="7.37207" width="23.1436" height="21.9888" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<filter id="filter13_d_11114_7617" x="36.8936" y="18.6646" width="23.3682" height="22.1167" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="5"/>
-<feGaussianBlur stdDeviation="5"/>
-<feComposite in2="hardAlpha" operator="out"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/>
-</filter>
-<linearGradient id="paint0_linear_11114_7617" x1="34.2043" y1="34.006" x2="25.9477" y2="34.4646" gradientUnits="userSpaceOnUse">
-<stop offset="0.4" stop-color="white" stop-opacity="0"/>
-<stop offset="0.76" stop-color="white" stop-opacity="0.05"/>
-<stop offset="0.85" stop-color="white" stop-opacity="0.26"/>
-<stop offset="0.95" stop-color="white" stop-opacity="0.5"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint1_linear_11114_7617" x1="70.5632" y1="56.1512" x2="60.6746" y2="53.5917" gradientUnits="userSpaceOnUse">
-<stop offset="0.4" stop-color="white" stop-opacity="0"/>
-<stop offset="0.76" stop-color="white" stop-opacity="0.05"/>
-<stop offset="0.85" stop-color="white" stop-opacity="0.26"/>
-<stop offset="0.95" stop-color="white" stop-opacity="0.5"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint2_linear_11114_7617" x1="-5.28697" y1="-18.4177" x2="65.1873" y2="75.2095" gradientUnits="userSpaceOnUse">
-<stop offset="0.25" stop-color="#387E8D" stop-opacity="0"/>
-<stop offset="0.75" stop-color="#387E8D" stop-opacity="0.04"/>
-<stop offset="0.91" stop-color="#387E8D" stop-opacity="0.43"/>
-<stop offset="1" stop-color="#387E8D" stop-opacity="0.6"/>
-</linearGradient>
-<linearGradient id="paint3_linear_11114_7617" x1="58.708" y1="15.0995" x2="31.8316" y2="50.6762" gradientUnits="userSpaceOnUse">
-<stop offset="0.51" stop-color="white" stop-opacity="0"/>
-<stop offset="0.82" stop-color="white" stop-opacity="0.1"/>
-<stop offset="0.87" stop-color="white" stop-opacity="0.26"/>
-<stop offset="0.96" stop-color="white" stop-opacity="0.5"/>
-<stop offset="1" stop-color="white" stop-opacity="0.6"/>
-</linearGradient>
-<clipPath id="clip0_11114_7617">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_11114_7617)"><g filter="url(#filter0_d_11114_7617)"><path fill="#121929" d="M68.023 56.875s-.042.042-.075.058c-.017.017-.042.025-.058.042L42.253 71.844c-.283.166-.716.2-1.066.091a1 1 0 0 1-.15-.058l-.075-.042L2.178 49.5c-.066-.033-.116-.083-.158-.125-.017-.017-.025-.033-.033-.042a.2.2 0 0 1-.034-.05.3.3 0 0 1-.033-.141v-1.873c0-.133.092-.267.267-.375l24.178-14.011s.067.05.1.066l41.558 23.935c.083-.083.133-.175.133-.266" opacity=".7"/></g><path fill="#cad5db" d="M68.173 54.744v1.873c0 .133-.092.267-.267.367L42.27 71.844c-.35.208-.933.208-1.283 0L2.203 49.508c-.175-.1-.266-.234-.266-.367v-1.873c0 .133.1.267.274.366l38.784 22.337c.358.2.933.2 1.283 0l25.636-14.86c.175-.1.259-.234.267-.367z"/><path fill="#cad5db" d="M68.173 54.744v1.873c0 .133-.092.267-.267.367L42.27 71.844c-.35.208-.933.208-1.283 0L2.203 49.508c-.175-.1-.266-.234-.266-.367v-1.873c0 .133.1.267.274.366l38.784 22.337c.358.2.933.2 1.283 0l25.636-14.86c.175-.1.259-.234.267-.367z"/><path fill="#f3f4f5" d="M67.906 54.361c.358.208.358.533 0 .741L42.27 69.962c-.35.209-.925.209-1.283 0L2.203 47.627c-.358-.208-.358-.533 0-.74L27.84 32.024c.35-.208.924-.208 1.283 0z"/><path fill="#587e8b" d="m69.847 23.541-.083 29.58c0 .2-.075.34-.192.407l-1.308.758c.084-.075.134-.2.134-.366l.083-29.58c0-.407-.283-.907-.641-1.107L29.056.897c-.183-.109-.342-.117-.458-.042l1.424-.824q.165-.05.392.075l38.784 22.336c.358.208.641.7.641 1.107z"/><path fill="#cad5db" d="m69.847 23.541-.083 29.58c0 .2-.075.34-.192.407l-1.308.758c.084-.075.134-.2.134-.366l.083-29.58c0-.407-.283-.907-.641-1.107L29.056.897c-.183-.109-.342-.117-.458-.042l1.424-.824q.165-.05.392.075l38.784 22.336c.358.208.641.7.641 1.107z"/><path fill="#e2e6e7" d="M67.848 23.233c.359.208.642.7.642 1.107l-.084 29.58c0 .408-.291.574-.641.366L28.98 31.95c-.358-.209-.641-.7-.641-1.108l.083-29.579c0-.408.292-.566.642-.366z"/><path fill="#fff" d="M66.073 23.566c.325.192.592.65.592 1.024l-.075 27.315c0 .375-.267.524-.6.341l-35.817-20.63c-.325-.19-.592-.649-.592-1.023l.075-27.315c0-.375.267-.525.6-.333l35.817 20.63z"/><path fill="#587e8b" d="M32.339 6.183a.25.25 0 0 1 .108.192v1.398c0 .067-.059.1-.117.067l-1.225-.708a.25.25 0 0 1-.108-.191V5.542c0-.067.058-.1.117-.067zm2.399 1.482a.25.25 0 0 1 .108.192v1.398c0 .067-.058.1-.116.067l-1.225-.708a.25.25 0 0 1-.108-.191V7.024c0-.067.058-.1.116-.067zm30.518 40.909a.25.25 0 0 1 .108.192v1.398c0 .067-.059.1-.117.067l-1.225-.708a.25.25 0 0 1-.108-.191v-1.399c0-.066.058-.1.117-.066zM32.339 8.764a.25.25 0 0 1 .108.191v1.399c0 .066-.059.1-.117.066l-1.225-.707a.25.25 0 0 1-.108-.192V8.123c0-.067.058-.1.117-.067zm0 2.398a.25.25 0 0 1 .108.191v1.399c0 .066-.059.1-.117.066l-1.225-.707a.25.25 0 0 1-.108-.192v-1.398c0-.067.058-.1.117-.067z" opacity=".8"/><path fill="#617d8a" d="M33.938 56.259c.184.1.184.275 0 .374l-5.649 3.272c-.175.1-.466.1-.65 0L17.418 54.02c-.184-.108-.184-.274 0-.374l5.649-3.272a.72.72 0 0 1 .65 0z"/><path fill="#cad5db" d="M26.599 36.42c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.408 1.482c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.466 1.482c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.499 1.482c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.542 1.49c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.606 1.482c.084.05.093.125 0 .175l-1.407.815a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.124 0-.174l1.408-.816a.34.34 0 0 1 .309 0zm2.667 1.482c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.574 1.49c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.574 1.482c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.534 1.482c.083.05.091.125 0 .175l-1.408.815a.34.34 0 0 1-.309 0l-1.416-.815c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.658 1.49c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.574 1.482c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.583 1.482c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0z"/><path fill="#587e8b" d="m61.366 56.617-1.408.816a.34.34 0 0 1-.308 0l-1.258-.724-.159-.092-1.266-.732c-.084-.05-.084-.125 0-.175l1.416-.816a.34.34 0 0 1 .308 0l1.267.733.158.091 1.258.724c.084.05.092.125 0 .175z"/><path fill="#cad5db" d="M21.39 39.184c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.409 1.491c.083.05.091.125 0 .174l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.124 0-.174l1.408-.816a.34.34 0 0 1 .308 0zm2.466 1.482c.083.05.091.124 0 .174l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.084-.05-.084-.125 0-.174l1.408-.816a.34.34 0 0 1 .308 0zm2.499 1.482c.083.05.091.124 0 .174l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.533 1.49c.083.05.091.125 0 .175l-1.408.815a.34.34 0 0 1-.309 0l-1.416-.815c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.616 1.481c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.658 1.483c.084.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.174l1.407-.816a.34.34 0 0 1 .309 0zm2.574 1.489c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.582 1.482c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.526 1.482c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.666 1.482c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.565 1.49c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zM52.067 57c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm4.091 2.39-1.408.816a.34.34 0 0 1-.309 0l-1.258-.725-.158-.091-1.266-.733c-.084-.05-.084-.125 0-.175l1.416-.816a.34.34 0 0 1 .308 0l1.267.733.158.092 1.258.724c.084.05.092.125 0 .175zM23.974 37.744c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.674 1.582c.084.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.666 1.481c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.674 1.583c.084.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.407-.815a.34.34 0 0 1 .309 0zm2.675 1.548c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.666 1.432c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.675 1.565c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.666 1.515c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.674 1.573c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.674 1.582c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.666 1.557c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.676 1.624c.083.05.09.124 0 .174l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.665 1.598c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zM58.7 57.89c.083.05.092.126 0 .176l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zM18.634 40.516c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.666 1.583c.083.05.091.124 0 .174l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.675 1.481c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.673 1.582c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.667 1.548c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.675 1.432c.082.05.09.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.409-.816a.34.34 0 0 1 .308 0zm2.674 1.565c.083.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .309 0zm2.666 1.516c.083.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.815a.34.34 0 0 1 .309 0zm2.674 1.573c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.666 1.582c.083.05.091.125 0 .175l-1.408.815a.34.34 0 0 1-.309 0l-1.416-.815c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.675 1.557c.083.05.091.125 0 .175l-1.408.816a.34.34 0 0 1-.309 0l-1.416-.816c-.083-.05-.083-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.675 1.623c.083.05.091.125 0 .175l-1.409.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0zm2.665 1.599c.084.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.815a.34.34 0 0 1 .308 0zm2.675 1.506c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0z"/><path fill="#5e2ad6" d="M30.155 34.23c.083.05.092.126 0 .176l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.409-.816a.34.34 0 0 1 .308 0z"/><path fill="url(#paint0_linear_11114_7617)" d="M30.155 34.23c.083.05.092.126 0 .176l-1.408.816a.34.34 0 0 1-.308 0l-1.417-.816c-.083-.05-.083-.125 0-.175l1.409-.816a.34.34 0 0 1 .308 0z"/><path fill="#5e2ad6" d="M65.314 54.303c.084.05.092.124 0 .174l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.124 0-.174l1.408-.816a.34.34 0 0 1 .308 0z"/><path fill="url(#paint1_linear_11114_7617)" d="M65.314 54.303c.084.05.092.125 0 .175l-1.408.816a.34.34 0 0 1-.308 0l-1.416-.816c-.084-.05-.084-.125 0-.175l1.408-.816a.34.34 0 0 1 .308 0z"/><path fill="url(#paint2_linear_11114_7617)" d="m69.839 23.541-.083 29.58c0 .2-.075.34-.184.416l-1.308.757c-.1.092-.25.109-.416.042l.058.033c.183.109.267.242.267.375v.033-.016 1.848c0 .133-.092.266-.267.366L42.27 71.835c-.35.209-.933.209-1.283 0L2.203 49.5c-.175-.1-.266-.233-.266-.366V47.26c0-.134.091-.275.266-.375l25.636-14.86c.325-.184.825-.2 1.184-.05l-.05-.025c-.35-.209-.642-.7-.642-1.108l.083-29.579c0-.216.084-.366.209-.425.016-.008.041-.016.066-.025a.2.2 0 0 0-.058.017l1.391-.807q.165-.05.392.074l38.784 22.337c.358.208.641.7.641 1.107" opacity=".7"/><path fill="url(#paint3_linear_11114_7617)" d="m69.839 23.533-.083 29.58c0 .2-.075.34-.184.416l-1.308.757c-.1.092-.25.108-.416.042l.058.033c.183.108.267.242.267.375v.033-.017V56.6c0 .134-.092.267-.267.367L42.27 71.827c-.35.208-.933.208-1.283 0L2.203 49.491c-.175-.1-.266-.233-.266-.367v-1.873c0-.133.091-.274.266-.374l25.636-14.86c.325-.184.825-.2 1.184-.05l-.05-.026c-.35-.208-.642-.699-.642-1.107l.083-29.58c0-.216.084-.366.209-.424l.066-.025a.2.2 0 0 0-.058.017l1.391-.808q.165-.05.392.075l38.784 22.337c.358.208.641.699.641 1.107"/><path fill="#6e17ff" fill-opacity=".2" d="M39.2 13.788c0-1.538 1.663-2.5 2.996-1.734L63.573 24.35a2 2 0 0 1 1.003 1.734v17.618c0 1.538-1.664 2.5-2.997 1.734L40.201 33.139a2 2 0 0 1-1.003-1.733z"/><path fill="#6e17ff" fill-opacity=".8" d="M38.076 14.462c0-1.539 1.664-2.501 2.997-1.734L62.45 25.024a2 2 0 0 1 1.003 1.734v17.618c0 1.538-1.664 2.5-2.998 1.733L39.08 33.814a2 2 0 0 1-1.003-1.733z"/><g filter="url(#filter1_d_11114_7617)"><g filter="url(#filter2_d_11114_7617)"><path fill="#fff" fill-rule="evenodd" d="M39.902 16.844a.225.225 0 0 1 .307-.084l.224.128a.225.225 0 0 1-.222.39l-.225-.128a.224.224 0 0 1-.084-.306m4.716 2.694a.225.225 0 0 1 .307-.084l2.246 1.283a.224.224 0 1 1-.223.39l-2.246-1.283a.225.225 0 0 1-.084-.306m3.144 1.795a.225.225 0 0 1 .307-.083l.673.385a.225.225 0 0 1-.222.39l-.674-.385a.225.225 0 0 1-.084-.307m1.576.9a.225.225 0 0 1 .307-.083l1.792 1.024a.225.225 0 0 1-.222.39l-1.793-1.024a.224.224 0 0 1-.084-.306m2.691 1.538a.224.224 0 0 1 .307-.084l.224.128a.224.224 0 1 1-.223.39l-.224-.128a.225.225 0 0 1-.084-.306m1.123.641a.225.225 0 0 1 .306-.084l2.47 1.411a.225.225 0 0 1-.222.39l-2.47-1.41a.225.225 0 0 1-.084-.307m3.369 1.924a.225.225 0 0 1 .306-.083l1.572.897a.225.225 0 0 1-.223.39l-1.572-.898a.225.225 0 0 1-.083-.306m2.47 1.411a.225.225 0 0 1 .306-.084l1.648.942a.225.225 0 1 1-.223.39l-1.647-.942a.225.225 0 0 1-.084-.306" clip-rule="evenodd"/></g><g filter="url(#filter3_d_11114_7617)"><path fill="#fff" fill-rule="evenodd" d="M39.902 19.539a.225.225 0 0 1 .307-.084l1.123.641a.225.225 0 0 1-.223.39l-1.123-.641a.225.225 0 0 1-.084-.306m2.022 1.154a.225.225 0 0 1 .306-.084l2.92 1.668a.225.225 0 0 1-.223.39l-2.92-1.668a.225.225 0 0 1-.083-.306m3.817 2.18a.225.225 0 0 1 .307-.083l3.597 2.055a.225.225 0 0 1-.223.39l-3.597-2.055a.225.225 0 0 1-.084-.306m4.492 2.566a.225.225 0 0 1 .306-.083l1.347.77a.224.224 0 1 1-.222.39l-1.348-.77a.225.225 0 0 1-.083-.307m2.25 1.286a.225.225 0 0 1 .307-.084l3.588 2.05a.225.225 0 0 1-.223.39l-3.588-2.05a.224.224 0 0 1-.084-.306m4.487 2.563a.225.225 0 0 1 .306-.084l3.669 2.095a.225.225 0 1 1-.223.39l-3.669-2.095a.225.225 0 0 1-.083-.306" clip-rule="evenodd"/></g><g filter="url(#filter4_d_11114_7617)"><path fill="#fff" fill-rule="evenodd" d="M39.902 27.623a.225.225 0 0 1 .307-.084l1.123.642a.225.225 0 0 1-.223.39l-1.123-.642a.225.225 0 0 1-.084-.306m5.84 3.335a.225.225 0 0 1 .306-.083l3.597 2.054a.225.225 0 0 1-.223.39l-3.597-2.054a.225.225 0 0 1-.084-.307m4.49 2.566a.225.225 0 0 1 .307-.084l1.347.77a.225.225 0 0 1-.222.39l-1.348-.77a.225.225 0 0 1-.083-.306m2.252 1.285a.224.224 0 0 1 .306-.083l2.69 1.536a.225.225 0 1 1-.223.39l-2.69-1.536a.225.225 0 0 1-.084-.307m3.587 2.05a.225.225 0 0 1 .307-.084l.898.513a.225.225 0 0 1-.223.39l-.898-.513a.225.225 0 0 1-.084-.306m1.797 1.026a.225.225 0 0 1 .306-.084l2.77 1.583a.225.225 0 1 1-.222.39l-2.77-1.583a.225.225 0 0 1-.084-.306" clip-rule="evenodd"/></g><g filter="url(#filter5_d_11114_7617)"><path fill="#fff" fill-rule="evenodd" d="M39.902 22.233a.225.225 0 0 1 .307-.083l.224.128a.224.224 0 1 1-.222.39l-.225-.128a.225.225 0 0 1-.084-.307m1.123.642a.225.225 0 0 1 .307-.084l2.47 1.411a.225.225 0 1 1-.223.39l-2.47-1.41a.225.225 0 0 1-.084-.307m3.369 1.924a.225.225 0 0 1 .306-.084l3.144 1.796a.225.225 0 1 1-.223.39l-3.144-1.796a.225.225 0 0 1-.083-.306m10.33 5.9a.225.225 0 0 1 .307-.083l2.477 1.415a.225.225 0 1 1-.223.39l-2.477-1.415a.225.225 0 0 1-.084-.306m3.369 1.925a.225.225 0 0 1 .306-.084l2.546 1.454a.225.225 0 0 1-.223.39l-2.546-1.454a.224.224 0 0 1-.083-.306" clip-rule="evenodd"/></g><g filter="url(#filter6_d_11114_7617)"><path fill="#fff" fill-rule="evenodd" d="M39.902 24.928a.225.225 0 0 1 .307-.083l.673.384a.225.225 0 0 1-.222.39l-.674-.384a.225.225 0 0 1-.084-.307m6.064 3.464a.225.225 0 0 1 .306-.084l1.8 1.028a.225.225 0 0 1-.223.39l-1.8-1.028a.225.225 0 0 1-.083-.306m2.695 1.539a.225.225 0 0 1 .306-.084l4.042 2.31a.225.225 0 0 1-.222.39l-4.043-2.31a.225.225 0 0 1-.083-.306m6.512 3.72a.224.224 0 0 1 .307-.084l3.817 2.181a.225.225 0 0 1-.222.39l-3.818-2.18a.225.225 0 0 1-.084-.307m4.716 2.694a.224.224 0 0 1 .307-.084l.749.428a.225.225 0 1 1-.223.39l-.75-.428a.225.225 0 0 1-.083-.306" clip-rule="evenodd"/></g><path fill="#fff" fill-rule="evenodd" d="M39.902 30.318a.225.225 0 0 1 .307-.084l.673.385a.225.225 0 0 1-.222.39l-.674-.385a.225.225 0 0 1-.084-.306m3.146 1.796a.225.225 0 0 1 .306-.083l.672.384a.225.225 0 0 1-.222.39l-.673-.384a.225.225 0 0 1-.083-.307m4.265 2.437a.225.225 0 0 1 .307-.084l2.47 1.411a.225.225 0 0 1-.223.39l-2.47-1.41a.225.225 0 0 1-.084-.307m3.369 1.924a.225.225 0 0 1 .306-.084l2.246 1.283a.225.225 0 1 1-.223.39l-2.246-1.282a.225.225 0 0 1-.083-.307m3.144 1.796a.225.225 0 0 1 .306-.084l.674.385a.225.225 0 1 1-.223.39l-.674-.385a.225.225 0 0 1-.083-.306m1.572.898a.225.225 0 0 1 .306-.084l.674.385a.225.225 0 1 1-.223.39l-.674-.385a.225.225 0 0 1-.083-.306m1.572.898a.225.225 0 0 1 .306-.084l3.669 2.096a.225.225 0 1 1-.223.39l-3.669-2.096a.224.224 0 0 1-.083-.306" clip-rule="evenodd"/></g><g filter="url(#filter7_d_11114_7617)"><g filter="url(#filter8_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M41.475 25.827a.225.225 0 0 1 .306-.084l1.377.786a.225.225 0 0 1-.223.39l-1.377-.786a.224.224 0 0 1-.083-.306" clip-rule="evenodd"/></g><g filter="url(#filter9_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M41.475 31.216a.225.225 0 0 1 .306-.083l.674.384a.225.225 0 0 1-.223.39l-.674-.384a.225.225 0 0 1-.083-.307m3.146 1.797a.225.225 0 0 1 .306-.083l1.795 1.025a.225.225 0 0 1-.223.39l-1.795-1.025a.225.225 0 0 1-.083-.307" clip-rule="evenodd"/></g><g filter="url(#filter10_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M50.457 28.263a.225.225 0 0 1 .306-.084l3.37 1.924a.225.225 0 0 1-.224.39l-3.368-1.924a.225.225 0 0 1-.084-.306" clip-rule="evenodd"/></g><g filter="url(#filter11_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M53.6 32.753a.224.224 0 0 1 .307-.083l.674.385a.225.225 0 0 1-.223.39l-.674-.385a.225.225 0 0 1-.083-.307" clip-rule="evenodd"/></g><g filter="url(#filter12_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M41.026 17.485a.225.225 0 0 1 .306-.083l2.695 1.539a.225.225 0 0 1-.223.39l-2.695-1.54a.224.224 0 0 1-.084-.306" clip-rule="evenodd"/></g><g filter="url(#filter13_d_11114_7617)"><path fill="#ffc1ff" fill-rule="evenodd" d="M41.923 28.778a.225.225 0 0 1 .306-.084l2.92 1.668a.225.225 0 1 1-.223.39l-2.92-1.668a.225.225 0 0 1-.083-.306" clip-rule="evenodd"/></g></g><path fill="#00fdfe" fill-opacity=".8" d="M36.729 11.55c0-1.54 1.667-2.502 3-1.732l2.737 1.582a2 2 0 0 1 1 1.731v.47c0 1.54-1.668 2.503-3 1.733l-2.738-1.582a2 2 0 0 1-1-1.732z"/><path fill="#fff" d="m39.783 12.542-1.258-.137-.042-.492.913.139-.78-.985.17-.351 1.07 1.396zm.399.371 1.572.905v.422l-1.572-.908z"/></g><defs><filter id="filter0_d_11114_7617" width="68.716" height="41.596" x=".81" y="31.772" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx=".13" dy=".13"/><feGaussianBlur stdDeviation=".62"/><feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.2 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter1_d_11114_7617" width="29.186" height="33.768" x="35.873" y="12.73" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.6 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter2_d_11114_7617" width="41.185" height="32.294" x="34.873" y="6.73" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter3_d_11114_7617" width="41.185" height="32.294" x="34.873" y="9.425" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter4_d_11114_7617" width="41.185" height="32.294" x="34.873" y="17.51" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter5_d_11114_7617" width="41.185" height="32.294" x="34.873" y="12.12" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter6_d_11114_7617" width="41.185" height="32.294" x="34.873" y="14.815" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter7_d_11114_7617" width="21.698" height="25.002" x="36.996" y="13.372" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 0.756863 0 0 0 0 1 0 0 0 0.6 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter8_d_11114_7617" width="21.825" height="21.236" x="36.445" y="15.713" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter9_d_11114_7617" width="25.39" height="23.271" x="36.445" y="21.103" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter10_d_11114_7617" width="23.817" height="22.373" x="45.428" y="18.149" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter11_d_11114_7617" width="21.123" height="20.834" x="48.571" y="22.64" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter12_d_11114_7617" width="23.144" height="21.989" x="35.996" y="7.372" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><filter id="filter13_d_11114_7617" width="23.368" height="22.117" x="36.894" y="18.665" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dx="5"/><feGaussianBlur stdDeviation="5"/><feComposite in2="hardAlpha" operator="out"/><feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/><feBlend in2="BackgroundImageFix" result="effect1_dropShadow_11114_7617"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_11114_7617" result="shape"/></filter><linearGradient id="paint0_linear_11114_7617" x1="34.204" x2="25.948" y1="34.006" y2="34.465" gradientUnits="userSpaceOnUse"><stop offset=".4" stop-color="#fff" stop-opacity="0"/><stop offset=".76" stop-color="#fff" stop-opacity=".05"/><stop offset=".85" stop-color="#fff" stop-opacity=".26"/><stop offset=".95" stop-color="#fff" stop-opacity=".5"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint1_linear_11114_7617" x1="70.563" x2="60.675" y1="56.151" y2="53.592" gradientUnits="userSpaceOnUse"><stop offset=".4" stop-color="#fff" stop-opacity="0"/><stop offset=".76" stop-color="#fff" stop-opacity=".05"/><stop offset=".85" stop-color="#fff" stop-opacity=".26"/><stop offset=".95" stop-color="#fff" stop-opacity=".5"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="paint2_linear_11114_7617" x1="-5.287" x2="65.187" y1="-18.418" y2="75.21" gradientUnits="userSpaceOnUse"><stop offset=".25" stop-color="#387e8d" stop-opacity="0"/><stop offset=".75" stop-color="#387e8d" stop-opacity=".04"/><stop offset=".91" stop-color="#387e8d" stop-opacity=".43"/><stop offset="1" stop-color="#387e8d" stop-opacity=".6"/></linearGradient><linearGradient id="paint3_linear_11114_7617" x1="58.708" x2="31.832" y1="15.1" y2="50.676" gradientUnits="userSpaceOnUse"><stop offset=".51" stop-color="#fff" stop-opacity="0"/><stop offset=".82" stop-color="#fff" stop-opacity=".1"/><stop offset=".87" stop-color="#fff" stop-opacity=".26"/><stop offset=".96" stop-color="#fff" stop-opacity=".5"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><clipPath id="clip0_11114_7617"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/leadiq.svg b/web/packages/design/src/ResourceIcon/assets/leadiq.svg
index 378328a83e38b..24b13237b0e10 100644
--- a/web/packages/design/src/ResourceIcon/assets/leadiq.svg
+++ b/web/packages/design/src/ResourceIcon/assets/leadiq.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M10.4169 18.1919C10.407 19.5732 9.84907 20.8941 8.86537 21.864C7.88183 22.8338 6.55312 23.3732 5.1718 23.3635C3.79049 23.3538 2.46956 22.7957 1.49968 21.812C0.529808 20.8284 -0.00956555 19.4998 0.000128445 18.1184C0.000128445 15.3514 2.3313 13.0938 5.31864 13.0938C6.66563 13.1103 7.95286 13.6527 8.90542 14.6052C9.85797 15.5577 10.4004 16.8449 10.4169 18.1919ZM9.31257 61.4698H1.0091V29.1913H9.31257V61.4698Z" fill="#00D586"/>
-<path d="M48.4078 53.269C44.2712 54.9166 39.6848 55.0371 35.4687 53.6086C31.2527 52.1801 27.6837 49.2962 25.4018 45.474C23.1199 41.6521 22.2743 37.142 23.0169 32.7528C23.7595 28.3638 26.0416 24.3829 29.4537 21.5243C32.8657 18.6657 37.1851 17.1164 41.6363 17.1543C46.0876 17.1922 50.38 18.8149 53.7427 21.7313C57.1054 24.6476 59.3207 28.6669 59.9882 33.0679C60.6556 37.469 59.7339 41.964 57.3867 45.7466L62.8932 51.2537C66.6548 45.9923 68.3441 39.5299 67.6417 33.101C66.9393 26.672 63.8944 20.7271 59.0871 16.4015C54.2783 12.076 48.0455 9.67298 41.5791 9.65151C35.1112 9.63004 28.8641 11.9916 24.0273 16.2851C19.1909 20.5786 16.1057 26.5032 15.3607 32.9275C14.6158 39.3516 16.2633 45.8249 19.9888 51.1113C23.7142 56.3976 29.2566 60.1264 35.5562 61.5855C41.8573 63.0445 48.4746 62.1315 54.1448 59.021L48.4078 53.269Z" fill="#00D586"/>
-<path d="M63.0943 50.918C60.7884 54.2479 57.7467 57.0033 54.2061 58.9716L63.5965 68.3624L72.0001 59.8239L63.0943 50.918Z" fill="#00D586"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#00d586" d="M10.417 18.192A5.21 5.21 0 0 1 0 18.118c0-2.767 2.331-5.024 5.319-5.024a5.16 5.16 0 0 1 5.098 5.098M9.313 61.47H1.009V29.19h8.304zm39.095-8.201a18.725 18.725 0 0 1-23.006-7.795 18.723 18.723 0 1 1 31.985.273l5.506 5.507A26.307 26.307 0 0 0 41.58 9.652 26.306 26.306 0 1 0 54.145 59.02z"/><path fill="#00d586" d="M63.094 50.918a26.4 26.4 0 0 1-8.888 8.054l9.39 9.39L72 59.824z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/leandata.svg b/web/packages/design/src/ResourceIcon/assets/leandata.svg
index 90d5dbc449507..73fde83218d83 100644
--- a/web/packages/design/src/ResourceIcon/assets/leandata.svg
+++ b/web/packages/design/src/ResourceIcon/assets/leandata.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17442)">
-<path d="M72 36.004C72 55.3839 55.9319 71.2067 36.0613 71.2067C16.1908 71.2067 0 55.3839 0 36.004C0 16.6241 16.1908 0.80127 36.0613 0.80127C55.9319 0.80127 72 16.6241 72 36.004Z" fill="#2DB66F"/>
-<path d="M51.7611 22.5117H33.1172V47.6565H51.7611V22.5117Z" fill="#58595B"/>
-<path d="M40.1095 46.9204H35.4486V24.5967H40.1095C44.8932 24.5967 47.101 26.5592 48.3276 28.2764C49.6768 30.4842 50.4128 33.1827 50.4128 35.7585C50.4128 41.5234 48.0823 46.7977 40.1095 46.9204ZM57.2816 23.0021C51.762 15.52 43.4213 15.52 38.6376 15.52H24.7773V55.1384C27.9664 55.7517 31.1555 55.2611 34.4673 55.2611C34.7126 55.2611 34.8353 55.3837 34.9579 55.5064C35.2032 55.5064 35.5712 55.7517 35.5712 55.997H39.4963C55.4417 55.997 61.2066 46.675 61.2066 35.6359C61.3293 31.0975 59.9801 26.6819 57.2816 23.0021Z" fill="white"/>
-<path d="M14.4736 15.52H24.8995V46.7977L35.4481 46.9204V55.8744H14.4736V15.52Z" fill="#58595B"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17442">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17442)"><path fill="#2db66f" d="M72 36.004c0 19.38-16.068 35.203-35.939 35.203S0 55.384 0 36.004 16.19.801 36.061.801 72 16.624 72 36.004"/><path fill="#58595b" d="M51.761 22.512H33.117v25.145h18.644z"/><path fill="#fff" d="M40.11 46.92h-4.661V24.597h4.66c4.784 0 6.992 1.962 8.219 3.68 1.349 2.207 2.085 4.906 2.085 7.481 0 5.765-2.33 11.04-10.303 11.162m17.172-23.918c-5.52-7.482-13.86-7.482-18.644-7.482h-13.86v39.618c3.188.614 6.378.123 9.69.123.245 0 .367.123.49.245.245 0 .613.246.613.491h3.925c15.946 0 21.71-9.322 21.71-20.361.123-4.539-1.226-8.954-3.924-12.634"/><path fill="#58595b" d="M14.474 15.52H24.9v31.278l10.548.122v8.954H14.474z"/></g><defs><clipPath id="clip0_16904_17442"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/lever.svg b/web/packages/design/src/ResourceIcon/assets/lever.svg
index d2dc57015a960..c93c47b029ddd 100644
--- a/web/packages/design/src/ResourceIcon/assets/lever.svg
+++ b/web/packages/design/src/ResourceIcon/assets/lever.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4392)">
-<path d="M71.3207 68.2092L57.7669 54.6533C57.3388 54.2336 56.7632 53.9985 56.1638 53.9985C55.5643 53.9985 54.9887 54.2336 54.5606 54.6533L41.0068 68.2092C40.6836 68.5174 40.4618 68.9167 40.3711 69.3539C40.2803 69.7912 40.3249 70.2458 40.4988 70.6571C40.6727 71.0685 40.9678 71.4171 41.3447 71.6567C41.7216 71.8962 42.1626 72.0153 42.6088 71.9981H69.7187C70.1624 72.0092 70.5992 71.8865 70.9721 71.6459C71.3451 71.4053 71.637 71.058 71.8099 70.6492C71.9827 70.2404 72.0285 69.789 71.9412 69.3538C71.854 68.9186 71.6377 68.5198 71.3207 68.2092Z" fill="#C3C6CC"/>
-<path d="M71.7721 19.5207L67.5264 6.91651C67.3349 6.3465 67.0294 5.82138 66.6287 5.37305L0.515625 71.4833C0.903613 71.8306 1.41042 72.0151 1.93086 71.9985H20.7091C21.2339 72.0011 21.7541 71.9001 22.2398 71.7012C22.7255 71.5024 23.1672 71.2097 23.5395 70.8398L70.8721 23.5076C71.3866 22.998 71.7446 22.3519 71.9041 21.6455C72.0635 20.9392 72.0177 20.2019 71.7721 19.5207Z" fill="#E1E3E6"/>
-<path d="M65.0836 4.47053L52.4793 0.227131C51.7981 -0.018485 51.0608 -0.0642681 50.3544 0.0951834C49.6481 0.254635 49.002 0.612674 48.4923 1.12711L1.15751 48.4592C0.412896 49.2127 -0.00293089 50.2304 0.00102188 51.2896V70.0677C-0.015507 70.5882 0.169005 71.095 0.516262 71.4829L66.6293 5.37284C66.1804 4.97072 65.6545 4.66377 65.0836 4.47053Z" fill="#C3C6CC"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4392">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4392)"><path fill="#c3c6cc" d="M71.32 68.21 57.768 54.652a2.29 2.29 0 0 0-3.206 0L41.007 68.21A2.2 2.2 0 0 0 42.609 72h27.11a2.21 2.21 0 0 0 1.602-3.79"/><path fill="#e1e3e6" d="M71.772 19.52 67.526 6.918a4.4 4.4 0 0 0-.897-1.544L.516 71.483c.388.348.894.532 1.415.516h18.778a4 4 0 0 0 2.83-1.16l47.333-47.331a3.8 3.8 0 0 0 .9-3.987"/><path fill="#c3c6cc" d="M65.084 4.47 52.479.228a3.8 3.8 0 0 0-3.987.9L1.158 48.46A4 4 0 0 0 0 51.29v18.779c-.017.52.168 1.027.515 1.415L66.63 5.373a4.5 4.5 0 0 0-1.545-.902"/></g><defs><clipPath id="clip0_8803_4392"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/linkedin-dark.svg b/web/packages/design/src/ResourceIcon/assets/linkedin-dark.svg
index 2c6069f4e952a..087b6d55affc8 100644
--- a/web/packages/design/src/ResourceIcon/assets/linkedin-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/linkedin-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17446)">
-<path d="M66.6 0.00146484H5.4C3.96783 0.00146484 2.59432 0.570392 1.58162 1.58309C0.568927 2.59578 0 3.9693 0 5.40146V66.6015C0 68.0336 0.568927 69.4071 1.58162 70.4198C2.59432 71.4325 3.96783 72.0015 5.4 72.0015H66.6C68.0322 72.0015 69.4057 71.4325 70.4184 70.4198C71.4311 69.4071 72 68.0336 72 66.6015V5.40146C72 3.9693 71.4311 2.59578 70.4184 1.58309C69.4057 0.570392 68.0322 0.00146484 66.6 0.00146484ZM21.6 61.2015H10.8V28.8015H21.6V61.2015ZM16.2 22.5015C14.9623 22.4661 13.7624 22.0667 12.7503 21.3533C11.7382 20.6399 10.9588 19.6441 10.5095 18.4903C10.0601 17.3364 9.96075 16.0757 10.2238 14.8658C10.4868 13.6558 11.1006 12.5501 11.9884 11.687C12.8762 10.8238 13.9987 10.2414 15.2156 10.0126C16.4325 9.78372 17.6899 9.91855 18.8306 10.4002C19.9714 10.8819 20.9449 11.689 21.6295 12.7208C22.3141 13.7526 22.6795 14.9632 22.68 16.2015C22.6516 17.8947 21.954 19.5079 20.7398 20.6884C19.5256 21.8689 17.8934 22.5207 16.2 22.5015ZM61.2 61.2015H50.4V44.1375C50.4 39.0255 48.24 37.1895 45.432 37.1895C44.6087 37.2443 43.8044 37.4612 43.0652 37.8278C42.326 38.1943 41.6665 38.7034 41.1245 39.3256C40.5826 39.9478 40.169 40.6709 39.9074 41.4534C39.6457 42.2359 39.5413 43.0624 39.6 43.8855C39.5821 44.053 39.5821 44.2219 39.6 44.3895V61.2015H28.8V28.8015H39.24V33.4815C40.2931 31.8795 41.7399 30.5747 43.4419 29.6922C45.1438 28.8097 47.0439 28.3791 48.96 28.4415C54.54 28.4415 61.056 31.5375 61.056 41.6175L61.2 61.2015Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17446">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17446)"><path fill="#fff" d="M66.6.001H5.4a5.4 5.4 0 0 0-5.4 5.4v61.2a5.4 5.4 0 0 0 5.4 5.4h61.2a5.4 5.4 0 0 0 5.4-5.4v-61.2a5.4 5.4 0 0 0-5.4-5.4m-45 61.2H10.8v-32.4h10.8zm-5.4-38.7a6.3 6.3 0 1 1 6.48-6.3 6.41 6.41 0 0 1-6.48 6.3m45 38.7H50.4V44.139c0-5.112-2.16-6.948-4.968-6.948a6.263 6.263 0 0 0-5.832 6.696 2.4 2.4 0 0 0 0 .503v16.813H28.8v-32.4h10.44v4.68a11.2 11.2 0 0 1 9.72-5.04c5.58 0 12.096 3.096 12.096 13.176z"/></g><defs><clipPath id="clip0_16904_17446"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/linkedin-light.svg b/web/packages/design/src/ResourceIcon/assets/linkedin-light.svg
index 83a6dc11d0614..0f936973b6d3a 100644
--- a/web/packages/design/src/ResourceIcon/assets/linkedin-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/linkedin-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17445)">
-<path d="M66.6 0.00146484H5.4C3.96783 0.00146484 2.59432 0.570392 1.58162 1.58309C0.568927 2.59578 0 3.9693 0 5.40146V66.6015C0 68.0336 0.568927 69.4071 1.58162 70.4198C2.59432 71.4325 3.96783 72.0015 5.4 72.0015H66.6C68.0322 72.0015 69.4057 71.4325 70.4184 70.4198C71.4311 69.4071 72 68.0336 72 66.6015V5.40146C72 3.9693 71.4311 2.59578 70.4184 1.58309C69.4057 0.570392 68.0322 0.00146484 66.6 0.00146484ZM21.6 61.2015H10.8V28.8015H21.6V61.2015ZM16.2 22.5015C14.9623 22.4661 13.7624 22.0667 12.7503 21.3533C11.7382 20.6399 10.9588 19.6441 10.5095 18.4903C10.0601 17.3364 9.96075 16.0757 10.2238 14.8658C10.4868 13.6558 11.1006 12.5501 11.9884 11.687C12.8762 10.8238 13.9987 10.2414 15.2156 10.0126C16.4325 9.78372 17.6899 9.91855 18.8306 10.4002C19.9714 10.8819 20.9449 11.689 21.6295 12.7208C22.3141 13.7526 22.6795 14.9632 22.68 16.2015C22.6516 17.8947 21.954 19.5079 20.7398 20.6884C19.5256 21.8689 17.8934 22.5207 16.2 22.5015ZM61.2 61.2015H50.4V44.1375C50.4 39.0255 48.24 37.1895 45.432 37.1895C44.6087 37.2443 43.8044 37.4612 43.0652 37.8278C42.326 38.1943 41.6665 38.7034 41.1245 39.3256C40.5826 39.9478 40.169 40.6709 39.9074 41.4534C39.6457 42.2359 39.5413 43.0624 39.6 43.8855C39.5821 44.053 39.5821 44.2219 39.6 44.3895V61.2015H28.8V28.8015H39.24V33.4815C40.2931 31.8795 41.7399 30.5747 43.4419 29.6922C45.1438 28.8097 47.0439 28.3791 48.96 28.4415C54.54 28.4415 61.056 31.5375 61.056 41.6175L61.2 61.2015Z" fill="#0A66C2"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17445">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17445)"><path fill="#0a66c2" d="M66.6.001H5.4a5.4 5.4 0 0 0-5.4 5.4v61.2a5.4 5.4 0 0 0 5.4 5.4h61.2a5.4 5.4 0 0 0 5.4-5.4v-61.2a5.4 5.4 0 0 0-5.4-5.4m-45 61.2H10.8v-32.4h10.8zm-5.4-38.7a6.3 6.3 0 1 1 6.48-6.3 6.41 6.41 0 0 1-6.48 6.3m45 38.7H50.4V44.139c0-5.112-2.16-6.948-4.968-6.948a6.263 6.263 0 0 0-5.832 6.696 2.4 2.4 0 0 0 0 .503v16.813H28.8v-32.4h10.44v4.68a11.2 11.2 0 0 1 9.72-5.04c5.58 0 12.096 3.096 12.096 13.176z"/></g><defs><clipPath id="clip0_16904_17445"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/linux-dark.svg b/web/packages/design/src/ResourceIcon/assets/linux-dark.svg
index f2a8b1509f31c..d5c24177b8113 100644
--- a/web/packages/design/src/ResourceIcon/assets/linux-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/linux-dark.svg
@@ -1,566 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29667)">
-<path d="M18.4983 34.4271C19.4308 32.3968 21.0478 30.5742 22.5661 28.8629C24.0844 27.1516 23.8255 27.418 23.9237 27.3087C24.0219 27.1995 24.1173 27.0933 24.2068 26.9925C24.6214 26.5256 24.8864 26.1971 24.987 26.0059L26.857 26.644C26.7626 27.1826 26.6247 27.7076 26.4987 28.1873L26.4973 28.1924C26.3683 28.6834 26.2513 29.1283 26.171 29.5722C25.9503 30.804 25.695 32.2242 25.0339 33.512C24.6406 34.2795 24.1309 34.9462 23.6494 35.5436C23.5412 35.678 23.4353 35.8078 23.3318 35.9347L23.3318 35.9347C22.9572 36.3939 22.6143 36.8142 22.3072 37.2684C21.7674 38.066 21.3591 38.9407 20.9131 39.8964L20.913 39.8966C20.8431 40.0462 20.7724 40.1978 20.7001 40.3514L20.6991 40.3535L20.6102 40.5408C20.3368 41.1165 20.0886 41.6391 19.8945 42.1823C19.3645 43.6821 19.2816 45.3468 19.5878 46.9486C19.7006 47.541 19.8536 48.0489 20.1004 48.4644L20.1014 48.4661C20.3589 48.9016 20.7436 49.2789 21.2432 49.7473C21.7428 50.2157 26.553 54.2534 26.5946 54.2856L26.7209 54.3831C27.5298 55.0069 28.5261 55.7755 29.1779 56.8448C29.4637 57.3143 29.7047 57.8804 29.7751 58.51C29.8458 59.1426 29.7348 59.8522 29.3435 60.4568L29.3429 60.4577C29.023 60.951 28.5609 61.3047 28.0759 61.5189L28.0731 61.5201C27.5862 61.7334 27.0709 61.8142 26.5827 61.8037C25.6292 61.7884 24.7686 61.4368 24.0911 61.1291L24.0881 61.1277C22.7983 60.5367 21.5741 59.8183 20.4296 58.9904L20.4283 58.9895C17.9059 57.1587 15.7639 54.762 14.3323 51.9612C13.9955 51.3079 13.6808 50.5927 13.4807 49.8214C13.2756 49.0419 13.1928 48.1876 13.334 47.3335C13.5061 46.2943 13.9978 45.3735 14.3961 44.6277L14.4478 44.5308C15.0088 43.4773 15.5584 42.4451 16.0567 41.3925C16.6026 40.2358 17.0794 39.0668 17.4262 37.874L17.4267 37.8724C17.5043 37.6069 17.5805 37.3177 17.6603 37.0147L17.6603 37.0146C17.8773 36.191 18.1212 35.2651 18.4952 34.4341L18.4983 34.4271Z" fill="#A7ABBD"/>
-<path d="M58.3945 54.115C57.9751 54.4421 57.4181 54.6366 56.9923 54.7621C56.5665 54.8876 46.5 24 50.9645 25.8414C51.1556 26.1238 51.2377 26.2527 51.3088 26.3643L51.3088 26.3643C51.4206 26.5398 51.5051 26.6725 51.9428 27.2915L51.9446 27.2941C52.0921 27.504 52.2602 27.7217 52.4441 27.9575L52.5022 28.0319C52.6648 28.2401 52.8392 28.4634 52.9998 28.6836C53.4165 29.256 53.9062 29.7784 54.4468 30.355L54.4468 30.355L54.5324 30.4463C55.0904 31.0418 55.698 31.6978 56.2082 32.4492C57.1866 33.8907 58.0089 35.4428 58.6518 37.0702C59.507 39.2382 60.1854 41.4955 60.59 43.8169C60.8824 45.5007 61.0655 47.3517 60.7047 49.1619L60.7044 49.1635L60.6679 49.3455L60.6679 49.3455C60.525 50.0614 60.3567 50.9044 60.0669 51.6922C59.7469 52.5621 59.2513 53.4489 58.3945 54.115Z" fill="#A7ABBD"/>
-<path d="M24.9666 11.2838C25.019 9.2699 25.3526 7.37275 26.2463 5.57299C27.1428 3.76177 28.6022 2.22588 30.3923 1.26248C32.0764 0.352513 33.9168 0 35.7094 0C38.3067 0 40.8783 0.784573 42.9413 2.28145C44.2331 3.21759 45.3098 4.41253 46.1518 5.73531C46.871 6.86345 47.4325 8.1012 47.785 9.4028L47.7879 9.41361C48.243 11.1717 48.253 13.1573 48.2625 15.0397V15.0404C48.2633 15.2039 48.2641 15.3666 48.2652 15.5284C48.2795 17.6171 48.3378 19.5962 48.8995 21.378C49.4363 23.0759 50.0716 24.2733 50.8238 25.5794C50.9372 25.7764 51.0536 25.9763 51.1728 26.1809L51.1733 26.1819C52.1491 28.1581 52.6114 28.6519 53.4241 30.437C54.9374 33.7691 56.1016 37.3156 56.5863 40.9955C57.0711 44.6756 56.8628 48.5044 55.6968 52.0809C54.5308 55.6575 50.6708 70.9064 50.6708 70.9064L50.6653 70.9076C50.0906 71.0342 49.5189 71.0567 48.9956 71.0415C47.4041 70.9953 45.8389 70.5953 44.4054 70.229C44.0818 70.1463 43.7649 70.0653 43.456 69.9905L43.4544 69.9901C42.3584 69.7228 41.2514 69.5041 40.1362 69.3338C36.7911 68.8511 32.8647 68.5721 29.3934 69.2825C25.9221 69.9929 27.1447 69.7787 25.6837 70.1743C24.2226 70.5699 22.6136 71.0055 20.9655 71.0417L20.9614 71.0418C20.4522 71.0509 19.8955 71.025 19.3355 70.8979L19.3298 70.8966C18.7668 70.7653 18.1819 70.5229 17.6787 70.1235L17.6758 70.1211C16.9042 69.5039 16.4442 68.607 16.2774 67.7126C16.1106 66.8182 17.2413 63.3131 17.427 62.9932C17.6127 62.6733 17.8071 62.3598 17.9926 62.0606L17.9926 62.0606L17.9972 62.0532C18.1862 61.7484 18.3661 61.4582 18.5353 61.1666C18.6533 60.9607 18.7638 60.7598 18.8764 60.5538C17.4604 58.6405 16.402 56.4444 15.8693 54.1026C15.106 50.7417 15.457 47.203 16.5957 44.0079C17 42.8704 17.4991 41.7806 17.9839 40.7341L18.0711 40.546C18.5307 39.5547 18.9725 38.6019 19.3428 37.6241C19.6558 36.7958 19.9148 35.9598 20.1838 35.0914C20.2879 34.7554 20.3935 34.4145 20.5044 34.0673C20.8933 32.8491 21.3362 31.5911 21.9717 30.3945C22.4228 29.547 23.0391 28.7537 23.5888 28.0462C23.7534 27.8343 23.912 27.6302 24.0584 27.4345C24.726 26.5425 25.2208 25.7395 25.4054 24.8339C25.488 24.1508 25.4494 23.7283 25.3919 23.1008C25.3345 22.4733 25.2893 22.1857 25.1329 19.5C24.9764 16.8143 24.8983 14.0032 24.9666 11.2838Z" fill="#A7ABBD"/>
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="#020204"/>
-<path d="M29.1032 21.5232C28.8536 21.8366 28.6928 22.2138 28.5929 22.6021C28.4959 22.9904 28.4598 23.3925 28.4432 23.7947C28.4127 24.5962 28.4626 25.4116 28.249 26.1854C28.0216 27.0119 27.5141 27.7302 27.0176 28.4263C26.1551 29.6356 25.2842 30.8781 24.8599 32.3008C24.6019 33.1606 24.516 34.0731 24.6075 34.9689C23.6451 36.3833 22.8103 37.8893 22.1169 39.4563C21.0686 41.8331 20.3503 44.3625 20.0979 46.9473C19.7873 50.1118 20.1922 53.3679 21.443 56.2911C22.3444 58.4072 23.6923 60.3403 25.4312 61.849C26.3132 62.6145 27.295 63.2663 28.3433 63.7821C31.9793 65.571 36.4723 65.5738 40.0472 63.6684C41.9165 62.6727 43.4946 61.2167 45.0144 59.744C45.9297 58.8565 46.8421 57.9468 47.541 56.8818C48.8862 54.8267 49.3549 52.3306 49.6461 49.8927C50.1536 45.6327 50.1703 41.1287 48.301 37.2653C47.6575 35.934 46.8005 34.7082 45.7716 33.6459C45.4998 31.7877 44.959 29.9656 44.1741 28.2599C43.6055 27.0257 42.915 25.8526 42.388 24.6045C42.1717 24.0915 41.9831 23.5645 41.7446 23.0625C41.5033 22.5605 41.2093 22.0779 40.8044 21.6924C40.3939 21.2986 39.8808 21.0185 39.34 20.841C38.7992 20.6607 38.2278 20.5803 37.6593 20.5525C36.5194 20.4943 35.3795 20.6441 34.2396 20.5969C33.3327 20.5609 32.4286 20.4028 31.5217 20.4555C31.0696 20.4832 30.6175 20.5636 30.196 20.7356C29.7744 20.9048 29.3861 21.1682 29.1032 21.5232Z" fill="#FDFDFB"/>
-<mask id="mask0_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask0_6709_29667)">
-<g opacity="0.25" filter="url(#filter0_f_6709_29667)">
-<path d="M25.0922 32.9444C25.3335 33.3077 24.9397 34.5641 30.6003 33.7598C30.6003 33.7598 29.6046 33.8679 28.6256 34.0954C27.103 34.6057 25.7773 35.1742 24.7511 35.9286C23.7388 36.6774 22.9955 37.6509 22.0664 38.4857C22.0664 38.4857 23.5724 35.7345 23.9468 34.9052C24.324 34.0759 23.8858 34.1148 24.1825 32.8945C24.4793 31.6741 25.2059 30.501 25.2059 30.501C25.2059 30.501 24.6124 32.2261 25.0922 32.9444Z" fill="url(#paint0_radial_6709_29667)"/>
-</g>
-</g>
-<mask id="mask1_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask1_6709_29667)">
-<g opacity="0.42" filter="url(#filter1_f_6709_29667)">
-<path d="M43.2886 32.6142C42.1349 33.4185 41.4582 33.3242 40.0604 33.4795C38.6598 33.6376 34.874 33.5793 34.874 33.5793C34.874 33.5793 35.4204 33.571 36.6379 33.7957C37.8527 34.0231 40.3294 34.2394 41.7244 34.7691C43.1222 35.3016 43.6298 35.4542 44.4784 35.9895C45.6849 36.7521 46.5724 37.9475 47.7261 38.7851C47.7261 38.7851 47.7816 37.6757 47.3157 36.8464C46.8497 36.0172 45.5961 34.7109 45.2273 33.4906C44.8612 32.2703 44.6837 29.874 44.6837 29.874C44.6837 29.874 44.4396 31.8127 43.2886 32.6142Z" fill="url(#paint1_radial_6709_29667)"/>
-</g>
-</g>
-<mask id="mask2_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask2_6709_29667)">
-<g opacity="0.2" filter="url(#filter2_f_6709_29667)">
-<path d="M32.4425 30.9009C32.3981 31.2476 32.3426 31.5942 32.2761 31.9381C32.2428 32.1073 32.2039 32.2765 32.1429 32.4374C32.0791 32.5982 31.9876 32.7535 31.86 32.8672C31.7463 32.9699 31.6104 33.0392 31.4718 33.103C30.9337 33.3471 30.3596 33.5107 29.7744 33.5856C30.0074 33.6022 30.2404 33.6244 30.4761 33.6494C30.6231 33.666 30.7701 33.6826 30.9115 33.7187C31.0557 33.7575 31.1972 33.813 31.3164 33.899C31.4468 33.996 31.5494 34.1264 31.6271 34.2706C31.7796 34.5535 31.8295 34.8808 31.8573 35.2053C31.8933 35.6157 31.8961 36.0317 31.8656 36.4422C31.8933 36.1676 31.9516 35.8931 32.0375 35.6324C32.1956 35.1553 32.4452 34.7116 32.7836 34.3427C32.9195 34.1985 33.0665 34.0626 33.2273 33.9489C33.7238 33.5994 34.3561 33.4469 34.958 33.5301C34.345 33.5551 33.7266 33.3637 33.2384 32.9948C32.9888 32.8062 32.7725 32.5733 32.6227 32.3015C32.3898 31.8799 32.3232 31.3668 32.4425 30.9009Z" fill="url(#paint2_radial_6709_29667)"/>
-</g>
-</g>
-<mask id="mask3_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask3_6709_29667)">
-<g opacity="0.11" filter="url(#filter3_f_6709_29667)">
-<path d="M30.9666 39.0352C30.6726 40.1529 30.4702 41.2955 30.3648 42.4493C30.2122 44.0773 30.2483 45.7164 30.1595 47.3499C30.0874 48.7339 29.9238 50.1345 30.1651 51.5018C30.2788 52.1535 30.484 52.7886 30.7752 53.3821C30.8196 53.1547 30.8557 52.9273 30.8751 52.6971C30.9777 51.5877 30.7919 50.4756 30.7281 49.3662C30.6171 47.4193 30.8862 45.4723 30.9971 43.5254C31.0803 42.0305 31.072 40.53 30.9666 39.0352Z" fill="black"/>
-</g>
-</g>
-<mask id="mask4_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask4_6709_29667)">
-<g opacity="0.75" filter="url(#filter4_f_6709_29667)">
-<path d="M50.4443 37.3955C50.73 37.3511 52.48 38.8405 52.2415 39.3952C52.003 39.9471 51.5509 39.6143 51.2292 39.617C50.9075 39.6226 50.0283 40.0219 49.8813 39.7696C49.7315 39.5172 50.2696 38.9292 50.5497 38.4355C50.7771 38.0389 50.1614 37.4399 50.4443 37.3955Z" fill="#7C7C7C"/>
-</g>
-</g>
-<mask id="mask5_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask5_6709_29667)">
-<g filter="url(#filter5_f_6709_29667)">
-<path d="M39.7503 4.08401C39.1374 4.51666 39.4036 5.05748 39.6671 5.5983C39.9306 6.1419 39.0875 7.70334 39.0791 7.7699C39.0708 7.83647 40.7376 6.97948 41.1925 6.41924C41.7305 5.76194 43.0867 7.31229 43.0119 7.07655C43.0146 6.65498 40.3632 3.65412 39.7503 4.08401Z" fill="#7C7C7C"/>
-</g>
-</g>
-<mask id="mask6_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask6_6709_29667)">
-<g filter="url(#filter6_f_6709_29667)">
-<path d="M44.3949 22.2529C43.879 22.7244 44.6389 23.4316 44.9967 24.2609C45.2213 24.7767 45.8398 25.5061 46.4389 25.3897C46.891 25.3009 47.1683 24.6519 47.1267 24.1971C47.0435 23.3151 46.3002 23.1071 45.7594 22.8048C45.3323 22.5663 44.7582 21.9229 44.3949 22.2529Z" fill="#838384"/>
-</g>
-</g>
-<path d="M23.7909 28.9872C22.0991 30.9064 20.3602 32.7674 19.4061 34.8447C18.9319 35.8986 18.71 37.044 18.3855 38.1534C18.0194 39.4125 17.5202 40.6329 16.9599 41.8199C16.4413 42.9154 15.87 43.9859 15.3014 45.0537C14.8854 45.833 14.4639 46.6262 14.3196 47.4971C14.2059 48.1849 14.2697 48.8949 14.4472 49.5689C14.6219 50.2428 14.9021 50.8863 15.221 51.5047C16.5744 54.1534 18.6074 56.4331 21.0147 58.1804C22.1074 58.9708 23.2751 59.6559 24.5037 60.2189C25.1693 60.5212 25.8682 60.793 26.6004 60.8041C26.9665 60.8124 27.3354 60.7514 27.671 60.6044C28.0038 60.4574 28.3033 60.2216 28.503 59.9138C28.7471 59.5366 28.8303 59.0679 28.7803 58.6214C28.7304 58.1748 28.5557 57.7477 28.3227 57.365C27.7514 56.4276 26.85 55.7481 25.9819 55.0769C24.1071 53.6264 22.296 52.0927 20.5599 50.4786C20.0717 50.0209 19.5808 49.5522 19.2397 48.9754C18.9069 48.4151 18.7266 47.7772 18.6046 47.1366C18.269 45.381 18.355 43.5339 18.9513 41.8476C19.187 41.1875 19.4949 40.558 19.7944 39.9256C20.3103 38.8301 20.7984 37.7124 21.4779 36.7084C22.3238 35.4576 23.4553 34.3982 24.1431 33.0558C24.7256 31.9215 24.9613 30.6485 25.186 29.3949C25.3635 28.4131 25.699 27.4535 25.871 26.4717C25.5354 27.1096 24.4538 28.1552 23.7909 28.9872Z" fill="#020204"/>
-<mask id="mask7_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="14" y="26" width="15" height="35">
-<path d="M23.7899 28.9877C22.0981 30.9069 20.3592 32.7679 19.4051 34.8452C18.9309 35.8991 18.709 37.0445 18.3845 38.1539C18.0184 39.413 17.5192 40.6333 16.959 41.8204C16.4403 42.9159 15.869 43.9864 15.3005 45.0542C14.8844 45.8335 14.4629 46.6267 14.3187 47.4976C14.2049 48.1854 14.2687 48.8954 14.4462 49.5694C14.621 50.2433 14.9011 50.8867 15.22 51.5052C16.5735 54.1539 18.6064 56.4336 21.0137 58.1809C22.1065 58.9713 23.2741 59.6563 24.5027 60.2194C25.1683 60.5217 25.8672 60.7935 26.5994 60.8046C26.9655 60.8129 27.3344 60.7519 27.67 60.6049C28.0028 60.4579 28.3023 60.2221 28.502 59.9143C28.7461 59.5371 28.8293 59.0684 28.7794 58.6219C28.7294 58.1753 28.5547 57.7482 28.3217 57.3655C27.7504 56.4281 26.849 55.7486 25.981 55.0774C24.1061 53.6269 22.2951 52.0932 20.5589 50.479C20.0708 50.0214 19.5799 49.5527 19.2387 48.9758C18.9059 48.4156 18.7256 47.7777 18.6036 47.1371C18.268 45.3815 18.354 43.5344 18.9503 41.8481C19.186 41.188 19.4939 40.5585 19.7934 39.9261C20.3093 38.8306 20.7974 37.7129 21.4769 36.7089C22.3228 35.4581 23.4544 34.3987 24.1422 33.0563C24.7246 31.922 24.9603 30.649 25.185 29.3954C25.3625 28.4136 25.6981 27.454 25.87 26.4722C25.5344 27.1101 24.4528 28.1556 23.7899 28.9877Z" fill="white"/>
-</mask>
-<g mask="url(#mask7_6709_29667)">
-<g opacity="0.95" filter="url(#filter7_f_6709_29667)">
-<path d="M21.8436 35.9736C21.2889 36.4839 20.8091 37.0746 20.4208 37.7236C19.7829 38.7886 19.4085 39.9867 18.9426 41.1377C18.5987 41.9947 18.1965 42.8572 18.1494 43.7808C18.1244 44.255 18.1937 44.7293 18.2104 45.2036C18.227 45.6778 18.1827 46.1715 17.9497 46.5847C17.7555 46.9314 17.4311 47.2032 17.0566 47.3363C17.5642 47.5055 18.0135 47.8328 18.3324 48.2599C18.5987 48.6204 18.7706 49.0392 19.0008 49.4192C19.1894 49.7298 19.4196 50.0183 19.7053 50.2429C19.9882 50.4703 20.3293 50.6312 20.6871 50.6756C21.1835 50.7393 21.6994 50.5757 22.0655 50.2374C21.6051 45.9247 22.0266 41.5232 23.2969 37.3769C23.3773 37.1162 23.4605 36.8527 23.4827 36.5809C23.5021 36.3064 23.4494 36.0179 23.283 35.8016C23.197 35.6851 23.0778 35.5936 22.9419 35.5354C22.8087 35.4799 22.659 35.4577 22.5148 35.4771C22.3705 35.4938 22.2291 35.5492 22.1126 35.6352C21.9961 35.724 21.9018 35.8404 21.8436 35.9736Z" fill="#7C7C7C"/>
-</g>
-</g>
-<path d="M51.1876 36.2562C52.6408 37.4266 53.5644 39.1933 53.8501 41.0376C54.0719 42.4743 53.9277 43.9525 53.6032 45.3697C53.2787 46.7897 52.7795 48.1598 52.2803 49.5299C52.0834 50.0735 51.8837 50.6254 51.806 51.1995C51.7256 51.7764 51.7755 52.3838 52.0529 52.8941C52.3718 53.4793 52.9653 53.8814 53.6032 54.07C54.2328 54.2586 54.9123 54.2531 55.5502 54.095C56.1881 53.9369 57.2614 53.7317 57.78 53.3267C59.0974 52.3033 59.4108 50.5256 59.7242 48.9669C60.0487 47.3389 59.8906 45.6332 59.6049 43.9886C59.2139 41.7449 58.5566 39.5538 57.7218 37.4377C57.1061 35.879 56.3184 34.3925 55.381 33.0113C54.4602 31.6551 53.1567 30.5984 52.1915 29.2727C51.856 28.8123 51.4538 28.3353 51.1265 27.8693C50.4165 26.8654 50.5774 27.054 50.1364 26.4022C49.8175 25.9307 49.3127 25.7699 48.783 25.5646C48.2505 25.3594 47.657 25.2984 47.1078 25.4509C46.3867 25.6534 45.796 26.2247 45.4826 26.9042C45.1692 27.5865 45.1137 28.3686 45.2358 29.1091C45.3939 30.0631 45.8293 30.9506 46.323 31.7827C46.8776 32.7229 47.5211 33.6298 48.3614 34.3287C49.2378 35.0581 50.2973 35.5407 51.1876 36.2562Z" fill="#020204"/>
-<mask id="mask8_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="25" width="15" height="30">
-<path d="M51.1866 36.2562C52.6399 37.4266 53.5634 39.1933 53.8491 41.0376C54.071 42.4743 53.9267 43.9525 53.6023 45.3697C53.2778 46.7897 52.7785 48.1598 52.2793 49.5299C52.0824 50.0735 51.8827 50.6254 51.8051 51.1995C51.7246 51.7764 51.7746 52.3838 52.0519 52.8941C52.3708 53.4793 52.9644 53.8814 53.6023 54.07C54.2318 54.2586 54.9113 54.2531 55.5492 54.095C56.1871 53.9369 57.2604 53.7317 57.779 53.3267C59.0964 52.3033 59.4098 50.5256 59.7232 48.9669C60.0477 47.3389 59.8896 45.6332 59.604 43.9886C59.2129 41.7449 58.5556 39.5538 57.7208 37.4377C57.1051 35.879 56.3174 34.3925 55.38 33.0113C54.4592 31.6551 53.1557 30.5984 52.1906 29.2727C51.855 28.8123 51.4528 28.3353 51.1256 27.8693C50.4156 26.8654 50.5764 27.054 50.1355 26.4022C49.8165 25.9307 49.3117 25.7699 48.782 25.5646C48.2495 25.3594 47.656 25.2984 47.1069 25.4509C46.3858 25.6534 45.795 26.2247 45.4816 26.9042C45.1682 27.5865 45.1128 28.3686 45.2348 29.1091C45.3929 30.0631 45.8283 30.9506 46.322 31.7827C46.8767 32.7229 47.5201 33.6298 48.3605 34.3287C49.2369 35.0581 50.2963 35.5407 51.1866 36.2562Z" fill="white"/>
-</mask>
-<g mask="url(#mask8_6709_29667)">
-<g filter="url(#filter8_f_6709_29667)">
-<path d="M47.7646 34.0015C47.8811 34.1124 48.0032 34.2261 48.128 34.3315C49.021 35.0609 49.4953 35.8791 50.4022 36.5946C51.8832 37.765 53.3836 39.7841 53.6748 41.6284C53.9023 43.0678 53.6027 43.8499 53.2366 45.5445C52.8705 47.2419 51.8333 49.6437 51.2703 51.28C51.0484 51.9317 51.7251 51.6627 51.6364 52.3505C51.592 52.6889 51.5864 53.03 51.628 53.3684C51.6336 53.3046 51.6364 53.2353 51.6447 53.1715C51.7529 52.234 52.0385 51.3327 52.3519 50.4479C52.9538 48.7478 53.6443 47.0782 54.1214 45.331C54.5984 43.5865 54.5457 42.3301 54.2961 40.8297C53.9827 38.941 52.8844 37.1992 51.3313 36.0483C50.2302 35.2356 48.935 34.7142 47.7646 34.0015Z" fill="#838384"/>
-</g>
-</g>
-<path d="M15.7484 49.6268C16.1311 49.4687 16.561 49.4382 16.9659 49.5131C17.3736 49.588 17.7591 49.7655 18.1002 49.9957C18.7853 50.4616 19.2928 51.1383 19.7782 51.8095C20.8959 53.346 21.9692 54.9157 22.9454 56.5465C23.7359 57.8722 24.4597 59.2395 25.375 60.4793C25.9713 61.2919 26.6424 62.0435 27.2415 62.8505C27.8405 63.6604 28.3703 64.5368 28.6365 65.5075C28.9832 66.7694 28.8473 68.1589 28.2482 69.321C27.8267 70.1391 27.1777 70.8408 26.39 71.3151C25.6024 71.7893 24.7731 72.0001 23.8523 72.0001C22.3907 72.0001 20.9624 71.2152 19.6034 70.6744C16.8355 69.5706 13.8291 69.2267 10.9753 68.3669C10.0989 68.1034 9.23633 67.79 8.35437 67.5487C7.96055 67.4406 7.56395 67.3463 7.1923 67.1771C6.82066 67.0107 6.47398 66.7583 6.26875 66.4089C6.11066 66.1371 6.04688 65.8181 6.04688 65.5047C6.04688 65.1885 6.12453 64.8779 6.2327 64.5839C6.44625 63.9932 6.79293 63.4579 7.0259 62.8727C7.40586 61.9187 7.4752 60.8675 7.4225 59.8414C7.37258 58.818 7.20617 57.8001 7.13684 56.7767C7.10355 56.3191 7.09246 55.8559 7.18121 55.4039C7.26719 54.9546 7.46133 54.5136 7.79137 54.1974C8.09645 53.9034 8.49859 53.7287 8.91461 53.6427C9.32785 53.5568 9.75496 53.554 10.1765 53.5623C10.5981 53.5706 11.0224 53.5956 11.444 53.5595C11.8655 53.5262 12.2899 53.4319 12.656 53.2212C13.0054 53.0215 13.2911 52.7247 13.5268 52.4002C13.7626 52.0757 13.9539 51.7207 14.1509 51.3685C14.345 51.0191 14.5475 50.6696 14.8054 50.359C15.0605 50.0484 15.3767 49.7793 15.7484 49.6268Z" fill="url(#paint3_linear_6709_29667)"/>
-<mask id="mask9_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="49" width="23" height="23">
-<path d="M15.7484 49.6268C16.1311 49.4687 16.561 49.4382 16.9659 49.5131C17.3736 49.588 17.7591 49.7655 18.1002 49.9957C18.7853 50.4616 19.2928 51.1383 19.7782 51.8095C20.8959 53.346 21.9692 54.9157 22.9454 56.5465C23.7359 57.8722 24.4597 59.2395 25.375 60.4793C25.9713 61.2919 26.6424 62.0435 27.2415 62.8505C27.8405 63.6604 28.3703 64.5368 28.6365 65.5075C28.9832 66.7694 28.8473 68.1589 28.2482 69.321C27.8267 70.1391 27.1777 70.8408 26.39 71.3151C25.6024 71.7893 24.7731 72.0001 23.8523 72.0001C22.3907 72.0001 20.9624 71.2152 19.6034 70.6744C16.8355 69.5706 13.8291 69.2267 10.9753 68.3669C10.0989 68.1034 9.23633 67.79 8.35437 67.5487C7.96055 67.4406 7.56395 67.3463 7.1923 67.1771C6.82066 67.0107 6.47398 66.7583 6.26875 66.4089C6.11066 66.1371 6.04688 65.8181 6.04688 65.5047C6.04688 65.1885 6.12453 64.8779 6.2327 64.5839C6.44625 63.9932 6.79293 63.4579 7.0259 62.8727C7.40586 61.9187 7.4752 60.8675 7.4225 59.8414C7.37258 58.818 7.20617 57.8001 7.13684 56.7767C7.10355 56.3191 7.09246 55.8559 7.18121 55.4039C7.26719 54.9546 7.46133 54.5136 7.79137 54.1974C8.09645 53.9034 8.49859 53.7287 8.91461 53.6427C9.32785 53.5568 9.75496 53.554 10.1765 53.5623C10.5981 53.5706 11.0224 53.5956 11.444 53.5595C11.8655 53.5262 12.2899 53.4319 12.656 53.2212C13.0054 53.0215 13.2911 52.7247 13.5268 52.4002C13.7626 52.0757 13.9539 51.7207 14.1509 51.3685C14.345 51.0191 14.5475 50.6696 14.8054 50.359C15.0605 50.0484 15.3767 49.7793 15.7484 49.6268Z" fill="white"/>
-</mask>
-<g mask="url(#mask9_6709_29667)">
-<g filter="url(#filter9_f_6709_29667)">
-<path d="M16.3532 50.2842C16.6999 50.1456 17.0937 50.1289 17.457 50.2121C17.8231 50.2953 18.1643 50.4728 18.4582 50.703C19.0518 51.1606 19.4622 51.8041 19.8588 52.4392C20.8073 53.9757 21.7337 55.5316 22.6101 57.1152C23.2757 58.3106 23.908 59.5281 24.7234 60.6236C25.2643 61.3502 25.8827 62.0186 26.4347 62.737C26.9866 63.4553 27.4775 64.2374 27.7215 65.111C28.0377 66.2343 27.9101 67.4795 27.3665 68.5113C26.9727 69.2545 26.3736 69.8869 25.647 70.3084C24.9231 70.73 24.0745 70.9408 23.2369 70.902C21.9001 70.8409 20.677 70.1726 19.4179 69.7205C17.0022 68.8441 14.3868 68.7248 11.9074 68.0425C11.0199 67.8013 10.1546 67.4795 9.2643 67.2549C8.8677 67.1551 8.46555 67.0718 8.09114 66.9138C7.71672 66.7557 7.36449 66.5116 7.15926 66.1594C7.00949 65.8959 6.94848 65.5881 6.9568 65.2858C6.96789 64.9834 7.04278 64.6839 7.15094 64.401C7.36727 63.8352 7.70563 63.3249 7.92196 62.7591C8.25199 61.9049 8.2936 60.9647 8.23258 60.0523C8.17156 59.1398 8.01071 58.2329 7.95524 57.3204C7.93305 56.91 7.9275 56.4967 8.01071 56.0974C8.09391 55.6952 8.26864 55.3069 8.55985 55.0185C8.87602 54.7051 9.30867 54.5359 9.74965 54.4666C10.1879 54.4 10.6344 54.4305 11.0754 54.4693C11.5191 54.5082 11.9629 54.5581 12.4066 54.5331C12.8504 54.5054 13.2997 54.3972 13.6657 54.1476C13.9986 53.923 14.2482 53.5929 14.4395 53.2407C14.6309 52.8885 14.7668 52.5085 14.9138 52.1369C15.058 51.7625 15.2161 51.3908 15.4435 51.058C15.6709 50.728 15.9788 50.4368 16.3532 50.2842Z" fill="#D99A03"/>
-</g>
-</g>
-<mask id="mask10_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="49" width="23" height="23">
-<path d="M15.7484 49.6268C16.1311 49.4687 16.561 49.4382 16.9659 49.5131C17.3736 49.588 17.7591 49.7655 18.1002 49.9957C18.7853 50.4616 19.2928 51.1383 19.7782 51.8095C20.8959 53.346 21.9692 54.9157 22.9454 56.5465C23.7359 57.8722 24.4597 59.2395 25.375 60.4793C25.9713 61.2919 26.6424 62.0435 27.2415 62.8505C27.8405 63.6604 28.3703 64.5368 28.6365 65.5075C28.9832 66.7694 28.8473 68.1589 28.2482 69.321C27.8267 70.1391 27.1777 70.8408 26.39 71.3151C25.6024 71.7893 24.7731 72.0001 23.8523 72.0001C22.3907 72.0001 20.9624 71.2152 19.6034 70.6744C16.8355 69.5706 13.8291 69.2267 10.9753 68.3669C10.0989 68.1034 9.23633 67.79 8.35437 67.5487C7.96055 67.4406 7.56395 67.3463 7.1923 67.1771C6.82066 67.0107 6.47398 66.7583 6.26875 66.4089C6.11066 66.1371 6.04688 65.8181 6.04688 65.5047C6.04688 65.1885 6.12453 64.8779 6.2327 64.5839C6.44625 63.9932 6.79293 63.4579 7.0259 62.8727C7.40586 61.9187 7.4752 60.8675 7.4225 59.8414C7.37258 58.818 7.20617 57.8001 7.13684 56.7767C7.10355 56.3191 7.09246 55.8559 7.18121 55.4039C7.26719 54.9546 7.46133 54.5136 7.79137 54.1974C8.09645 53.9034 8.49859 53.7287 8.91461 53.6427C9.32785 53.5568 9.75496 53.554 10.1765 53.5623C10.5981 53.5706 11.0224 53.5956 11.444 53.5595C11.8655 53.5262 12.2899 53.4319 12.656 53.2212C13.0054 53.0215 13.2911 52.7247 13.5268 52.4002C13.7626 52.0757 13.9539 51.7207 14.1509 51.3685C14.345 51.0191 14.5475 50.6696 14.8054 50.359C15.0605 50.0484 15.3767 49.7793 15.7484 49.6268Z" fill="white"/>
-</mask>
-<g mask="url(#mask10_6709_29667)">
-<g filter="url(#filter10_f_6709_29667)">
-<path d="M16.0283 49.4156C16.3667 49.2492 16.7633 49.2159 17.1322 49.2908C17.501 49.3657 17.8449 49.546 18.1362 49.7817C18.7158 50.2532 19.0874 50.9272 19.4313 51.5872C20.219 53.1015 20.9567 54.6491 21.8997 56.0774C22.5875 57.1119 23.3779 58.0743 24.0713 59.106C25.0115 60.5011 25.777 62.0375 26.0931 63.6822C26.3039 64.7916 26.2984 65.9869 25.7659 66.9826C25.4137 67.6399 24.8451 68.1779 24.1712 68.5135C23.5 68.8519 22.7262 68.9878 21.9746 68.9212C20.7903 68.8186 19.717 68.2362 18.6021 67.8285C16.6246 67.1102 14.4863 66.9354 12.4506 66.3918C11.5936 66.1644 10.7505 65.8677 9.8824 65.6874C9.4969 65.607 9.10584 65.5487 8.73975 65.4101C8.37365 65.2714 8.02697 65.0412 7.83838 64.7028C7.70803 64.4643 7.66365 64.187 7.68307 63.9152C7.70248 63.6461 7.78291 63.3827 7.8883 63.1303C8.10186 62.6311 8.41525 62.1707 8.57889 61.6548C8.82295 60.8921 8.72311 60.0684 8.54006 59.2891C8.35979 58.5125 8.09631 57.7498 8.01588 56.9566C7.97982 56.6044 7.97982 56.2438 8.06303 55.8972C8.14346 55.5505 8.30709 55.2177 8.56502 54.9708C8.89783 54.6519 9.36377 54.491 9.82971 54.4467C10.2929 54.4023 10.7588 54.4633 11.2192 54.5299C11.6796 54.5964 12.1455 54.6685 12.6087 54.6463C13.0746 54.6269 13.5489 54.5049 13.9122 54.2192C14.2728 53.9363 14.5002 53.5176 14.6305 53.0849C14.7609 52.6495 14.8025 52.1974 14.8552 51.7481C14.9079 51.2988 14.9744 50.844 15.1492 50.4252C15.3239 50.0064 15.6179 49.6209 16.0283 49.4156Z" fill="#F5BD0C"/>
-</g>
-</g>
-<mask id="mask11_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="49" width="23" height="23">
-<path d="M15.7484 49.6268C16.1311 49.4687 16.561 49.4382 16.9659 49.5131C17.3736 49.588 17.7591 49.7655 18.1002 49.9957C18.7853 50.4616 19.2928 51.1383 19.7782 51.8095C20.8959 53.346 21.9692 54.9157 22.9454 56.5465C23.7359 57.8722 24.4597 59.2395 25.375 60.4793C25.9713 61.2919 26.6424 62.0435 27.2415 62.8505C27.8405 63.6604 28.3703 64.5368 28.6365 65.5075C28.9832 66.7694 28.8473 68.1589 28.2482 69.321C27.8267 70.1391 27.1777 70.8408 26.39 71.3151C25.6024 71.7893 24.7731 72.0001 23.8523 72.0001C22.3907 72.0001 20.9624 71.2152 19.6034 70.6744C16.8355 69.5706 13.8291 69.2267 10.9753 68.3669C10.0989 68.1034 9.23633 67.79 8.35437 67.5487C7.96055 67.4406 7.56395 67.3463 7.1923 67.1771C6.82066 67.0107 6.47398 66.7583 6.26875 66.4089C6.11066 66.1371 6.04688 65.8181 6.04688 65.5047C6.04688 65.1885 6.12453 64.8779 6.2327 64.5839C6.44625 63.9932 6.79293 63.4579 7.0259 62.8727C7.40586 61.9187 7.4752 60.8675 7.4225 59.8414C7.37258 58.818 7.20617 57.8001 7.13684 56.7767C7.10355 56.3191 7.09246 55.8559 7.18121 55.4039C7.26719 54.9546 7.46133 54.5136 7.79137 54.1974C8.09645 53.9034 8.49859 53.7287 8.91461 53.6427C9.32785 53.5568 9.75496 53.554 10.1765 53.5623C10.5981 53.5706 11.0224 53.5956 11.444 53.5595C11.8655 53.5262 12.2899 53.4319 12.656 53.2212C13.0054 53.0215 13.2911 52.7247 13.5268 52.4002C13.7626 52.0757 13.9539 51.7207 14.1509 51.3685C14.345 51.0191 14.5475 50.6696 14.8054 50.359C15.0605 50.0484 15.3767 49.7793 15.7484 49.6268Z" fill="white"/>
-</mask>
-<g mask="url(#mask11_6709_29667)">
-<g filter="url(#filter11_f_6709_29667)">
-<path d="M20.2471 53.1987C20.8711 54.3247 21.2511 55.6172 21.8695 56.7543C22.4381 57.7999 23.0843 58.876 23.6612 59.8383C23.9191 60.2682 24.5182 60.9283 25.1228 61.9517C25.6719 62.878 26.2266 64.1732 26.5372 64.6087C26.3597 64.0983 25.9936 62.731 25.5554 61.7576C25.1477 60.8479 24.6707 60.3292 24.3795 59.8383C23.8026 58.876 23.1786 58.0079 22.5851 57.0899C21.7669 55.8224 21.1429 54.4052 20.2471 53.1987Z" fill="url(#paint4_linear_6709_29667)"/>
-</g>
-</g>
-<mask id="mask12_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask12_6709_29667)">
-<g opacity="0.2" filter="url(#filter12_f_6709_29667)">
-<path d="M61.1549 60.798C61.0439 61.1669 60.872 61.5246 60.6529 61.8519C60.1675 62.5702 59.4603 63.1138 58.7559 63.613C57.555 64.4645 56.3014 65.2466 55.1809 66.2145C54.4321 66.8635 53.747 67.5929 53.1147 68.3584C52.5739 69.0129 52.0636 69.7007 51.4451 70.2832C50.8211 70.8711 50.0889 71.3482 49.2984 71.6061C48.3361 71.9195 47.321 71.9056 46.3946 71.6671C45.7457 71.5007 45.1105 71.2123 44.7084 70.6881C44.3062 70.1639 44.1759 69.4567 44.1287 68.7633C44.0455 67.5375 44.1925 66.2866 44.3257 65.0414C44.4366 64.0069 44.5392 62.9724 44.5808 61.9407C44.6557 60.063 44.5309 58.2048 44.2785 56.3799C44.2341 56.0721 44.1898 55.7642 44.2147 55.4508C44.2397 55.1346 44.3451 54.8074 44.5669 54.5633C44.7722 54.3387 45.0578 54.2055 45.3407 54.1418C45.6236 54.0752 45.9121 54.0724 46.1977 54.0641C46.8717 54.0475 47.5456 54.0059 48.2085 54.0669C48.6273 54.1029 49.0377 54.1806 49.4537 54.2194C50.1499 54.286 50.8737 54.2527 51.5727 54.0475C52.3243 53.8256 53.0398 53.4123 53.8053 53.2986C54.1187 53.2515 54.4321 53.257 54.7371 53.3014C55.0478 53.343 55.3584 53.429 55.5969 53.6203C55.78 53.7646 55.9131 53.9615 56.0157 54.1723C56.171 54.4884 56.2653 54.8351 56.3208 55.1929C56.3679 55.5091 56.3873 55.8336 56.4678 56.1386C56.6009 56.6406 56.906 57.0677 57.2693 57.4144C57.6354 57.7611 58.0597 58.0357 58.4868 58.3075C58.9112 58.5765 59.3383 58.8427 59.7903 59.0646C60.0039 59.17 60.223 59.2643 60.4255 59.3835C60.6307 59.5056 60.8193 59.6526 60.9552 59.8467C61.1382 60.1102 61.2103 60.4569 61.1549 60.798Z" fill="url(#paint5_linear_6709_29667)"/>
-</g>
-</g>
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="url(#paint6_linear_6709_29667)"/>
-<mask id="mask13_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="21" height="22">
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="white"/>
-</mask>
-<g mask="url(#mask13_6709_29667)">
-<g filter="url(#filter13_f_6709_29667)">
-<path d="M65.1801 60.9398C65.0331 61.3086 64.8251 61.6553 64.5644 61.9576C63.9903 62.6288 63.197 63.0698 62.4066 63.4664C61.0532 64.1431 59.6554 64.7366 58.3851 65.552C57.5365 66.0984 56.7488 66.739 56.0138 67.4324C55.387 68.0231 54.7908 68.6555 54.0863 69.1547C53.3735 69.6622 52.5526 70.0255 51.6873 70.1531C50.6334 70.3084 49.5462 70.1087 48.5672 69.69C47.8849 69.396 47.2248 68.98 46.8282 68.3504C46.4344 67.7236 46.3429 66.9581 46.3429 66.2176C46.3373 64.9113 46.5842 63.6189 46.8171 62.3348C47.0113 61.267 47.1943 60.1965 47.3108 59.1176C47.5216 57.154 47.5133 55.1738 47.3801 53.2046C47.3579 52.8746 47.333 52.5418 47.3829 52.2145C47.4328 51.8873 47.5687 51.5628 47.8183 51.3464C48.0541 51.144 48.3703 51.0552 48.6809 51.0414C48.9887 51.0247 49.2966 51.0746 49.6044 51.119C50.3283 51.2244 51.0549 51.3048 51.7622 51.4879C52.2087 51.6044 52.6441 51.7597 53.0879 51.8762C53.8311 52.0759 54.6105 52.1702 55.3732 52.0814C56.1969 51.9871 56.9956 51.682 57.8221 51.7014C58.1633 51.7098 58.4988 51.7736 58.8233 51.8734C59.1534 51.976 59.4806 52.123 59.7247 52.3671C59.9077 52.5529 60.0326 52.7859 60.1352 53.0271C60.2822 53.3849 60.382 53.7677 60.3876 54.1559C60.3959 54.5609 60.3099 54.9658 60.3626 55.3679C60.407 55.6924 60.5456 56.0003 60.7231 56.2776C60.8979 56.555 61.1114 56.8073 61.325 57.057C61.7354 57.5423 62.1459 58.036 62.6618 58.4076C63.247 58.832 63.9431 59.0816 64.5477 59.4754C64.728 59.5946 64.9027 59.7278 65.0303 59.9025C65.2466 60.1965 65.3021 60.5959 65.1801 60.9398Z" fill="#CD8907"/>
-</g>
-</g>
-<mask id="mask14_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="21" height="22">
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="white"/>
-</mask>
-<g mask="url(#mask14_6709_29667)">
-<g filter="url(#filter14_f_6709_29667)">
-<path d="M65.0963 60.5208C64.9299 60.8952 64.7164 61.2419 64.464 61.5497C63.876 62.2653 63.08 62.7562 62.2452 63.0723C60.8668 63.5937 59.3636 63.6631 58.013 64.2566C57.1892 64.6171 56.446 65.1607 55.6944 65.6766C55.0898 66.0898 54.4685 66.492 53.8029 66.7804C53.0485 67.1105 52.2498 67.2935 51.4455 67.4239C50.9351 67.5043 50.4165 67.5653 49.9006 67.5376C49.3848 67.5098 48.8689 67.3878 48.4113 67.1243C48.0674 66.9246 47.7568 66.639 47.571 66.2646C47.3685 65.8513 47.3324 65.366 47.3352 64.8945C47.3491 63.6464 47.6181 62.4095 47.6098 61.1587C47.6015 60.0687 47.3851 58.9954 47.3241 57.9082C47.2049 55.817 47.6542 53.6926 47.2576 51.643C47.1965 51.313 47.1106 50.9857 47.1133 50.6501C47.1161 50.4837 47.1411 50.3145 47.1993 50.1592C47.2603 50.0067 47.3546 49.8652 47.4794 49.7654C47.5876 49.685 47.7124 49.635 47.8428 49.6101C47.9703 49.5879 48.1035 49.5934 48.2338 49.6128C48.4917 49.6544 48.7386 49.7543 48.991 49.8292C49.7121 50.0455 50.4748 50.04 51.2097 50.2036C51.6701 50.3034 52.1139 50.4726 52.5715 50.5946C53.3342 50.8054 54.1329 50.8942 54.9178 50.8027C55.7609 50.7028 56.5846 50.3977 57.4333 50.4199C57.7828 50.4282 58.1267 50.492 58.4623 50.5919C58.7978 50.6917 59.1334 50.8332 59.3886 51.0911C59.5689 51.2769 59.702 51.5126 59.8074 51.7567C59.9655 52.1145 60.0736 52.5028 60.0708 52.8966C60.0681 53.1018 60.0376 53.3043 60.0182 53.5095C60.0015 53.7148 59.996 53.9228 60.0431 54.1197C60.093 54.3194 60.1957 54.4996 60.3121 54.6633C60.4286 54.8269 60.5617 54.9739 60.6838 55.1348C61.0221 55.5813 61.2662 56.1027 61.5297 56.6047C61.7932 57.1067 62.0899 57.6031 62.5087 57.9664C63.0773 58.4573 63.8122 58.6542 64.4473 59.0453C64.6332 59.159 64.8107 59.2921 64.941 59.4752C65.0464 59.6194 65.1157 59.7941 65.1435 59.9772C65.1684 60.1575 65.1518 60.3488 65.0963 60.5208Z" fill="#F5C021"/>
-</g>
-</g>
-<mask id="mask15_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="21" height="22">
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="white"/>
-</mask>
-<g mask="url(#mask15_6709_29667)">
-<g filter="url(#filter15_f_6709_29667)">
-<path d="M47.1169 51.36C47.899 51.1493 48.5646 51.7428 49.1332 52.1893C49.4993 52.5027 50.0318 52.425 50.4811 52.4389C51.2271 52.4139 51.9676 52.5637 52.7137 52.4722C54.1836 52.3474 55.623 51.9868 57.0985 51.9258C57.8029 51.8814 58.5961 51.8398 59.2035 52.2503C59.4504 52.4223 59.8137 53.1461 60.055 52.8743C59.9551 52.1144 59.3921 51.3794 58.6377 51.177C58.0442 51.0827 57.4452 51.2463 56.8461 51.1936C55.0739 51.152 53.31 50.822 51.5322 50.9163C50.2952 50.9274 49.0611 50.8691 47.8241 50.822C47.3388 50.7221 47.1668 51.152 46.9033 51.3184C46.9727 51.3711 46.9976 51.3878 47.1169 51.36Z" fill="url(#paint7_linear_6709_29667)"/>
-</g>
-</g>
-<mask id="mask16_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="21" height="22">
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="white"/>
-</mask>
-<g mask="url(#mask16_6709_29667)">
-<g opacity="0.35" filter="url(#filter16_f_6709_29667)">
-<path d="M57.4919 53.0325C57.3588 52.769 57.1147 52.5721 56.8401 52.4584C56.5683 52.3447 56.2688 52.3058 55.972 52.3086C55.3813 52.3142 54.7933 52.4667 54.2026 52.4168C53.7061 52.3724 53.2347 52.1866 52.7493 52.0673C52.2473 51.9453 51.7148 51.8981 51.2184 52.034C50.6859 52.1783 50.2172 52.536 49.9232 53.002C49.6625 53.4124 49.5404 53.8978 49.5016 54.3831C49.4628 54.8685 49.5044 55.3538 49.5543 55.8392C49.5876 56.1887 49.6292 56.5381 49.7124 56.8792C49.7984 57.2204 49.9287 57.5532 50.134 57.8389C50.4307 58.2493 50.8717 58.5433 51.346 58.718C52.1225 59.0037 53.0045 58.9898 53.7672 58.6764C55.1206 58.0885 56.266 57.0346 56.9622 55.7366C57.2145 55.2706 57.4087 54.7742 57.5335 54.2639C57.5834 54.0587 57.6222 53.8506 57.6222 53.6399C57.625 53.4319 57.589 53.2183 57.4919 53.0325Z" fill="url(#paint8_radial_6709_29667)"/>
-</g>
-</g>
-<mask id="mask17_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="21" height="22">
-<path d="M65.2518 62.8256C64.625 63.5689 63.7541 64.0598 62.886 64.5035C61.4078 65.2551 59.8741 65.918 58.4846 66.8249C57.5527 67.4323 56.693 68.145 55.8887 68.9133C55.2008 69.5706 54.5491 70.2723 53.7781 70.8297C52.9987 71.3927 52.1001 71.8004 51.1488 71.9419C50.8854 71.9807 50.6219 72.0001 50.3556 72.0001C49.4571 72.0001 48.5585 71.7838 47.732 71.4232C46.9831 71.0988 46.2621 70.63 45.8294 69.9367C45.3967 69.2378 45.2969 68.3863 45.2969 67.5626C45.2941 66.1121 45.5631 64.6755 45.8155 63.2444C46.0263 62.0546 46.226 60.8648 46.3563 59.6639C46.5921 57.484 46.5893 55.2791 46.434 53.0881C46.4063 52.722 46.3758 52.3531 46.4312 51.9898C46.4867 51.6265 46.6365 51.2631 46.9138 51.0246C47.1717 50.8027 47.5156 50.7029 47.8568 50.6863C48.1951 50.6668 48.5335 50.7195 48.8691 50.7695C49.6595 50.8859 50.4583 50.9747 51.2321 51.1799C51.7202 51.3075 52.1972 51.4795 52.6826 51.6126C53.4979 51.8317 54.3494 51.9371 55.1842 51.84C56.0856 51.7346 56.962 51.3963 57.8689 51.4184C58.2405 51.4268 58.6094 51.4961 58.9644 51.6098C59.3249 51.7235 59.6827 51.8872 59.949 52.159C60.1514 52.3642 60.2929 52.6221 60.3983 52.8911C60.5563 53.2905 60.6423 53.7176 60.6784 54.1447C60.7089 54.5247 60.7033 54.9102 60.7755 55.2846C60.8947 55.8975 61.2192 56.4606 61.6186 56.9404C62.0207 57.4229 62.5005 57.8306 62.9803 58.2328C63.4601 58.6349 63.9399 59.0343 64.4558 59.3865C64.6971 59.5529 64.9467 59.7082 65.1769 59.8885C65.4071 60.0716 65.6179 60.2823 65.7621 60.5375C65.8869 60.7622 65.9535 61.0145 65.9535 61.2725C65.9535 61.4167 65.934 61.5609 65.8897 61.7051C65.7649 62.1017 65.5347 62.4872 65.2518 62.8256Z" fill="white"/>
-</mask>
-<g mask="url(#mask17_6709_29667)">
-<g opacity="0.35" filter="url(#filter17_f_6709_29667)">
-<path d="M57.4919 52.2777C57.3588 52.0864 57.1147 51.9449 56.8401 51.8617C56.5683 51.7785 56.2688 51.7535 55.972 51.7535C55.3813 51.7591 54.7933 51.87 54.2026 51.8312C53.7061 51.8007 53.2347 51.6648 52.7493 51.5816C52.2473 51.4928 51.7148 51.4568 51.2184 51.5566C50.6859 51.6592 50.2172 51.9172 49.9232 52.2555C49.6625 52.5523 49.5404 52.9045 49.5016 53.254C49.4628 53.6034 49.5044 53.9557 49.5543 54.3051C49.5876 54.5575 49.6292 54.8126 49.7124 55.0595C49.7984 55.3063 49.9287 55.5476 50.134 55.7528C50.4307 56.0496 50.8717 56.2604 51.346 56.388C52.1225 56.596 53.0045 56.5849 53.7672 56.3575C55.1206 55.9331 56.266 55.1704 56.9622 54.233C57.2145 53.8946 57.4087 53.5369 57.5335 53.168C57.5834 53.0182 57.6222 52.8685 57.6222 52.7187C57.625 52.5662 57.589 52.4109 57.4919 52.2777Z" fill="url(#paint9_radial_6709_29667)"/>
-</g>
-</g>
-<path d="M58.6179 50.567C58.5208 50.3036 58.3489 50.0706 58.1409 49.882C57.9329 49.6934 57.686 49.5492 57.4281 49.4382C56.9122 49.2191 56.3492 49.1359 55.7945 49.0333C55.2759 48.9362 54.7573 48.817 54.2359 48.7282C53.6923 48.6367 53.132 48.5757 52.594 48.6977C52.1253 48.8031 51.6898 49.0472 51.3348 49.3717C50.9798 49.6962 50.7025 50.1011 50.5028 50.5393C50.1506 51.3131 50.0396 52.1812 50.1062 53.0271C50.1561 53.6566 50.317 54.3056 50.7302 54.7799C51.0658 55.1654 51.5401 55.4067 52.0282 55.5509C52.8713 55.8005 53.7893 55.7866 54.6241 55.5148C56.0025 55.0517 57.2229 54.1337 58.0493 52.9383C58.3211 52.5417 58.5541 52.1118 58.6595 51.6459C58.7399 51.2909 58.7427 50.9082 58.6179 50.567Z" fill="#020204"/>
-<mask id="mask18_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="50" y="48" width="9" height="8">
-<path d="M58.6179 50.567C58.5208 50.3036 58.3489 50.0706 58.1409 49.882C57.9329 49.6934 57.686 49.5492 57.4281 49.4382C56.9122 49.2191 56.3492 49.1359 55.7945 49.0333C55.2759 48.9362 54.7573 48.817 54.2359 48.7282C53.6923 48.6367 53.132 48.5757 52.594 48.6977C52.1253 48.8031 51.6898 49.0472 51.3348 49.3717C50.9798 49.6962 50.7025 50.1011 50.5028 50.5393C50.1506 51.3131 50.0396 52.1812 50.1062 53.0271C50.1561 53.6566 50.317 54.3056 50.7302 54.7799C51.0658 55.1654 51.5401 55.4067 52.0282 55.5509C52.8713 55.8005 53.7893 55.7866 54.6241 55.5148C56.0025 55.0517 57.2229 54.1337 58.0493 52.9383C58.3211 52.5417 58.5541 52.1118 58.6595 51.6459C58.7399 51.2909 58.7427 50.9082 58.6179 50.567Z" fill="white"/>
-</mask>
-<g mask="url(#mask18_6709_29667)">
-<g filter="url(#filter18_f_6709_29667)">
-<path d="M52.8876 48.4456C52.7573 48.4539 52.6297 48.4678 52.4993 48.4927C51.6701 48.6397 50.9101 49.1639 50.483 49.8878C50.1807 50.4008 50.0448 51.0055 50.0864 51.599C50.1058 51.183 50.214 50.7753 50.4165 50.4119C50.7576 49.7935 51.3789 49.3275 52.075 49.1999C52.5021 49.1223 52.9431 49.1694 53.373 49.2221C53.789 49.2748 54.205 49.3303 54.6127 49.4163C55.245 49.5549 55.8691 49.7657 56.3988 50.1346C56.5208 50.2206 56.6373 50.3176 56.7344 50.4341C56.8314 50.5478 56.9063 50.681 56.9368 50.828C56.9784 51.0443 56.9174 51.2717 56.8092 51.4631C56.7011 51.6572 56.5541 51.8236 56.3988 51.9789C56.2712 52.1065 56.1381 52.2258 56.0022 52.345C56.6151 52.2258 57.2336 52.0594 57.7439 51.7044C57.9574 51.5518 58.1544 51.3715 58.2819 51.1441C58.4095 50.9139 58.4622 50.6366 58.4012 50.3814C58.3568 50.2095 58.2625 50.0514 58.146 49.9183C58.0296 49.7851 57.8881 49.677 57.7439 49.5744C57.1032 49.1251 56.3544 48.8394 55.5778 48.7451C55.0786 48.6536 54.5766 48.5759 54.0746 48.5149C53.6836 48.465 53.2814 48.4234 52.8876 48.4456Z" fill="url(#paint10_radial_6709_29667)"/>
-</g>
-</g>
-<mask id="mask19_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="50" y="48" width="9" height="8">
-<path d="M58.6179 50.567C58.5208 50.3036 58.3489 50.0706 58.1409 49.882C57.9329 49.6934 57.686 49.5492 57.4281 49.4382C56.9122 49.2191 56.3492 49.1359 55.7945 49.0333C55.2759 48.9362 54.7573 48.817 54.2359 48.7282C53.6923 48.6367 53.132 48.5757 52.594 48.6977C52.1253 48.8031 51.6898 49.0472 51.3348 49.3717C50.9798 49.6962 50.7025 50.1011 50.5028 50.5393C50.1506 51.3131 50.0396 52.1812 50.1062 53.0271C50.1561 53.6566 50.317 54.3056 50.7302 54.7799C51.0658 55.1654 51.5401 55.4067 52.0282 55.5509C52.8713 55.8005 53.7893 55.7866 54.6241 55.5148C56.0025 55.0517 57.2229 54.1337 58.0493 52.9383C58.3211 52.5417 58.5541 52.1118 58.6595 51.6459C58.7399 51.2909 58.7427 50.9082 58.6179 50.567Z" fill="white"/>
-</mask>
-<g mask="url(#mask19_6709_29667)">
-<g filter="url(#filter19_f_6709_29667)">
-<path d="M52.8876 48.4456C52.7573 48.4539 52.6297 48.4678 52.4993 48.4927C51.6701 48.6397 50.9101 49.1639 50.483 49.8878C50.1807 50.4008 50.0448 51.0055 50.0864 51.599C50.1058 51.183 50.214 50.7753 50.4165 50.4119C50.7576 49.7935 51.3789 49.3275 52.075 49.1999C52.5021 49.1223 52.9431 49.1694 53.373 49.2221C53.789 49.2748 54.205 49.3303 54.6127 49.4163C55.245 49.5549 55.8691 49.7657 56.3988 50.1346C56.5208 50.2206 56.6373 50.3176 56.7344 50.4341C56.8314 50.5478 56.9063 50.681 56.9368 50.828C56.9784 51.0443 56.9174 51.2717 56.8092 51.4631C56.7011 51.6572 56.5541 51.8236 56.3988 51.9789C56.2712 52.1065 56.1381 52.2258 56.0022 52.345C56.6151 52.2258 57.2336 52.0594 57.7439 51.7044C57.9574 51.5518 58.1544 51.3715 58.2819 51.1441C58.4095 50.9139 58.4622 50.6366 58.4012 50.3814C58.3568 50.2095 58.2625 50.0514 58.146 49.9183C58.0296 49.7851 57.8881 49.677 57.7439 49.5744C57.1032 49.1251 56.3544 48.8394 55.5778 48.7451C55.0786 48.6536 54.5766 48.5759 54.0746 48.5149C53.6836 48.465 53.2814 48.4234 52.8876 48.4456Z" fill="url(#paint11_linear_6709_29667)"/>
-</g>
-</g>
-<path d="M29.4685 11.6169C29.0442 11.6391 28.6365 11.836 28.3259 12.1272C28.0125 12.4184 27.7934 12.8012 27.6575 13.2033C27.3884 14.0132 27.4495 14.8896 27.5105 15.741C27.5659 16.5093 27.6242 17.2941 27.9126 18.0097C28.0568 18.3702 28.2593 18.7058 28.5283 18.9832C28.7974 19.2577 29.1385 19.4713 29.5129 19.5628C29.8624 19.6516 30.2395 19.6349 30.5834 19.5268C30.9301 19.4158 31.2435 19.2189 31.5042 18.9665C31.8814 18.5977 32.1338 18.1151 32.2808 17.6075C32.4278 17.1 32.4694 16.5675 32.4611 16.0378C32.45 15.3777 32.364 14.7148 32.1588 14.088C31.9508 13.4612 31.6207 12.8677 31.1603 12.3935C30.9384 12.1633 30.6833 11.9636 30.3976 11.8221C30.1092 11.6807 29.7875 11.6003 29.4685 11.6169Z" fill="url(#paint12_radial_6709_29667)"/>
-<path d="M28.4427 15.1419C28.354 15.6799 28.3512 16.2429 28.5342 16.7532C28.6563 17.0916 28.8587 17.3994 29.1028 17.6629C29.2609 17.8349 29.4439 17.9902 29.6547 18.0928C29.8683 18.1954 30.1123 18.237 30.3425 18.1815C30.5533 18.1289 30.7364 17.993 30.8723 17.8238C31.0082 17.6546 31.0997 17.4521 31.1635 17.2441C31.3548 16.6312 31.3243 15.9628 31.133 15.3499C30.9971 14.9033 30.7669 14.4735 30.4119 14.1739C30.2399 14.0297 30.0402 13.916 29.8239 13.8661C29.6076 13.8134 29.3718 13.8273 29.1694 13.9188C28.9447 14.0214 28.77 14.2155 28.6563 14.4346C28.5426 14.6537 28.4843 14.8978 28.4427 15.1419Z" fill="#020204"/>
-<mask id="mask20_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="28" y="13" width="4" height="6">
-<path d="M28.4427 15.1419C28.354 15.6799 28.3512 16.2429 28.5342 16.7532C28.6563 17.0916 28.8587 17.3994 29.1028 17.6629C29.2609 17.8349 29.4439 17.9902 29.6547 18.0928C29.8683 18.1954 30.1123 18.237 30.3425 18.1815C30.5533 18.1289 30.7364 17.993 30.8723 17.8238C31.0082 17.6546 31.0997 17.4521 31.1635 17.2441C31.3548 16.6312 31.3243 15.9628 31.133 15.3499C30.9971 14.9033 30.7669 14.4735 30.4119 14.1739C30.2399 14.0297 30.0402 13.916 29.8239 13.8661C29.6076 13.8134 29.3718 13.8273 29.1694 13.9188C28.9447 14.0214 28.77 14.2155 28.6563 14.4346C28.5426 14.6537 28.4843 14.8978 28.4427 15.1419Z" fill="white"/>
-</mask>
-<g mask="url(#mask20_6709_29667)">
-<g filter="url(#filter20_f_6709_29667)">
-<path d="M29.5766 14.7532C29.6348 14.9057 29.829 14.9612 29.9371 15.0832C30.0397 15.1997 30.1479 15.3245 30.2061 15.4715C30.3143 15.7516 30.098 16.1676 30.3254 16.3673C30.3947 16.4283 30.539 16.4311 30.6083 16.3673C30.8829 16.1177 30.8219 15.6157 30.7137 15.2607C30.6138 14.9418 30.3726 14.6367 30.073 14.4842C29.9343 14.412 29.7263 14.3538 29.6071 14.4536C29.5322 14.5202 29.5405 14.6589 29.5766 14.7532Z" fill="url(#paint13_linear_6709_29667)"/>
-</g>
-</g>
-<mask id="mask21_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="11" width="6" height="9">
-<path d="M29.4685 11.6169C29.0442 11.6391 28.6365 11.836 28.3259 12.1272C28.0125 12.4184 27.7934 12.8012 27.6575 13.2033C27.3884 14.0132 27.4495 14.8896 27.5105 15.741C27.5659 16.5093 27.6242 17.2941 27.9126 18.0097C28.0568 18.3702 28.2593 18.7058 28.5283 18.9832C28.7974 19.2577 29.1385 19.4713 29.5129 19.5628C29.8624 19.6516 30.2395 19.6349 30.5834 19.5268C30.9301 19.4158 31.2435 19.2189 31.5042 18.9665C31.8814 18.5977 32.1338 18.1151 32.2808 17.6075C32.4278 17.1 32.4694 16.5675 32.4611 16.0378C32.45 15.3777 32.364 14.7148 32.1588 14.088C31.9508 13.4612 31.6207 12.8677 31.1603 12.3935C30.9384 12.1633 30.6833 11.9636 30.3976 11.8221C30.1092 11.6807 29.7875 11.6003 29.4685 11.6169Z" fill="white"/>
-</mask>
-<g mask="url(#mask21_6709_29667)">
-<path d="M28.5498 13.3309C29.1932 12.9481 29.9726 12.8594 30.7186 12.9287C31.4619 13.0008 32.1802 13.2172 32.9013 13.4141C33.431 13.5583 33.9663 13.6914 34.4628 13.9244C34.9564 14.1574 35.4168 14.5013 35.6914 14.9783C35.7358 15.0532 35.7718 15.1336 35.819 15.2085C35.8661 15.2834 35.9216 15.3527 35.9909 15.4054C36.0603 15.4581 36.149 15.4942 36.235 15.4886C36.2794 15.4858 36.3237 15.4748 36.3598 15.4526C36.3986 15.4304 36.4319 15.3971 36.4513 15.3583C36.4735 15.3139 36.4818 15.2612 36.479 15.2113C36.4763 15.1614 36.4652 15.1114 36.4513 15.0615C36.271 14.4042 35.8439 13.8467 35.5222 13.2449C35.3281 12.8844 35.1672 12.5072 34.9731 12.1466C34.2991 10.9124 33.1925 9.94452 31.9361 9.31495C30.6798 8.68538 29.2764 8.38307 27.8731 8.30264C26.2478 8.20557 24.6198 8.39971 23.0168 8.6826C22.3206 8.80463 21.6134 8.94885 21.0005 9.29553C20.6926 9.46748 20.4097 9.68936 20.1906 9.9667C19.9688 10.2413 19.8135 10.5713 19.7608 10.9208C19.7136 11.2591 19.7635 11.6058 19.8828 11.9248C19.9993 12.2437 20.1823 12.5349 20.3986 12.7984C20.8258 13.3281 21.3777 13.7386 21.8852 14.1934C22.3928 14.6455 22.8615 15.1475 23.43 15.5219C23.7129 15.7105 24.0208 15.8658 24.348 15.9573C24.6753 16.0489 25.0247 16.0738 25.3576 16.0045C25.7015 15.9351 26.0232 15.766 26.3033 15.5496C26.5834 15.3361 26.8247 15.0781 27.0549 14.8119C27.5153 14.2766 27.9452 13.6914 28.5498 13.3309Z" fill="url(#paint14_radial_6709_29667)"/>
-</g>
-<g filter="url(#filter21_f_6709_29667)">
-<path d="M31.222 11.1425C31.821 11.7027 32.2648 12.3961 32.5671 13.1283C32.4339 12.3212 32.2259 11.6694 31.699 11.1425C31.3773 10.8402 31.0084 10.5739 30.5952 10.3881C30.2291 10.2245 29.8269 10.1218 29.5939 10.1191C29.3637 10.1135 29.3083 10.1191 29.2611 10.1218C29.2112 10.1246 29.1752 10.1246 29.3249 10.144C29.4747 10.1607 29.8103 10.2522 30.1708 10.4131C30.5314 10.5739 30.8975 10.8402 31.222 11.1425Z" fill="url(#paint15_linear_6709_29667)"/>
-</g>
-<path d="M37.0013 11.6171C36.3385 12.0747 35.781 12.7098 35.5092 13.4698C35.1653 14.4266 35.2957 15.4971 35.6285 16.4567C35.9668 17.4413 36.5354 18.3787 37.3924 18.9695C37.8195 19.2662 38.3159 19.4687 38.8318 19.5297C39.3504 19.5907 39.8857 19.5048 40.3489 19.2662C40.9091 18.9723 41.339 18.4592 41.6052 17.8851C41.8715 17.3082 41.9852 16.6731 42.0212 16.038C42.0656 15.2337 41.988 14.4127 41.7217 13.65C41.4333 12.8208 40.9119 12.0553 40.1741 11.5783C39.808 11.3398 39.3892 11.1761 38.9538 11.1151C38.5184 11.0541 38.0691 11.1012 37.6586 11.2593C37.4257 11.3509 37.2093 11.4757 37.0013 11.6171Z" fill="url(#paint16_radial_6709_29667)"/>
-<path d="M38.5345 13.6247C38.2849 13.6414 38.0408 13.7273 37.8272 13.8605C37.6165 13.9936 37.4362 14.1739 37.2947 14.3819C37.0091 14.7951 36.8843 15.2999 36.8649 15.8019C36.851 16.1763 36.8926 16.5562 37.0174 16.9112C37.1422 17.2662 37.3502 17.5963 37.6414 17.8348C37.9382 18.0816 38.3126 18.2286 38.6981 18.248C39.0836 18.2647 39.4719 18.1537 39.7881 17.9346C40.0404 17.7599 40.2429 17.5186 40.3871 17.2468C40.5313 16.9778 40.6201 16.6783 40.6589 16.3732C40.7283 15.8379 40.6506 15.2777 40.401 14.7951C40.1542 14.3125 39.7326 13.9159 39.225 13.7301C39.0032 13.6497 38.7674 13.6081 38.5345 13.6247Z" fill="#020204"/>
-<mask id="mask22_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="36" y="13" width="5" height="6">
-<path d="M38.5335 13.6247C38.2839 13.6414 38.0398 13.7273 37.8263 13.8605C37.6155 13.9936 37.4352 14.1739 37.2938 14.3819C37.0081 14.7951 36.8833 15.2999 36.8639 15.8019C36.85 16.1763 36.8916 16.5562 37.0164 16.9112C37.1412 17.2662 37.3492 17.5963 37.6404 17.8348C37.9372 18.0816 38.3116 18.2286 38.6971 18.248C39.0826 18.2647 39.4709 18.1537 39.7871 17.9346C40.0395 17.7599 40.2419 17.5186 40.3861 17.2468C40.5304 16.9778 40.6191 16.6783 40.6579 16.3732C40.7273 15.8379 40.6496 15.2777 40.4 14.7951C40.1532 14.3125 39.7316 13.9159 39.2241 13.7301C39.0022 13.6497 38.7665 13.6081 38.5335 13.6247Z" fill="white"/>
-</mask>
-<g mask="url(#mask22_6709_29667)">
-<g filter="url(#filter22_f_6709_29667)">
-<path d="M40.0788 15.7991C40.3562 15.5217 39.8819 14.7867 39.5103 14.4844C39.2412 14.2681 38.4619 14.0379 38.4952 14.2764C38.5285 14.5122 38.8807 14.8173 39.1137 15.0502C39.4049 15.3359 39.9457 15.9322 40.0788 15.7991Z" fill="url(#paint17_linear_6709_29667)"/>
-</g>
-</g>
-<mask id="mask23_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="35" y="11" width="8" height="9">
-<path d="M37.0013 11.6171C36.3385 12.0747 35.781 12.7098 35.5092 13.4698C35.1653 14.4266 35.2957 15.4971 35.6285 16.4567C35.9668 17.4413 36.5354 18.3787 37.3924 18.9695C37.8195 19.2662 38.3159 19.4687 38.8318 19.5297C39.3504 19.5907 39.8857 19.5048 40.3489 19.2662C40.9091 18.9723 41.339 18.4592 41.6052 17.8851C41.8715 17.3082 41.9852 16.6731 42.0212 16.038C42.0656 15.2337 41.988 14.4127 41.7217 13.65C41.4333 12.8208 40.9119 12.0553 40.1741 11.5783C39.808 11.3398 39.3892 11.1761 38.9538 11.1151C38.5184 11.0541 38.0691 11.1012 37.6586 11.2593C37.4257 11.3509 37.2093 11.4757 37.0013 11.6171Z" fill="white"/>
-</mask>
-<g mask="url(#mask23_6709_29667)">
-<path d="M34.4914 14.0383C35.0627 13.564 35.7256 13.2035 36.4328 12.9844C37.8889 12.5351 39.5391 12.7126 40.826 13.5307C41.2697 13.8108 41.6663 14.1603 42.0795 14.4876C42.49 14.8121 42.9282 15.1171 43.4247 15.2919C43.6937 15.3862 43.9793 15.4416 44.2622 15.4111C44.5174 15.3862 44.7642 15.2891 44.975 15.1449C45.1858 14.9979 45.3633 14.8037 45.4964 14.5846C45.7627 14.1464 45.8486 13.6139 45.8015 13.1036C45.71 12.0802 45.1331 11.1789 44.6505 10.2719C44.498 9.98905 44.3538 9.70061 44.1707 9.43713C43.6133 8.62452 42.7202 8.08924 41.7856 7.77585C40.8509 7.46245 39.8636 7.34874 38.8845 7.22671C38.4463 7.17124 38.0054 7.11299 37.5699 7.16569C37.0679 7.22671 36.5965 7.42917 36.1056 7.55397C35.8726 7.61499 35.6369 7.65659 35.4067 7.72315C35.1765 7.78971 34.949 7.88124 34.7604 8.031C34.4886 8.2501 34.3167 8.58014 34.2418 8.92128C34.1669 9.26518 34.1836 9.62018 34.239 9.96686C34.3472 10.6602 34.6079 11.3342 34.5829 12.0358C34.5663 12.5157 34.4138 12.9899 34.4332 13.4697C34.4387 13.6112 34.4665 13.8996 34.4914 14.0383Z" fill="url(#paint18_linear_6709_29667)"/>
-</g>
-<g filter="url(#filter23_f_6709_29667)">
-<path d="M39.3095 9.64795C39.1957 9.79217 39.0931 9.94748 39.0127 10.1194C39.5258 10.2304 40.0139 10.4412 40.4521 10.7324C41.3008 11.2954 41.9442 12.1163 42.3963 13.0315C42.5017 12.9151 42.596 12.7903 42.6792 12.6516C42.2243 11.6975 41.5698 10.835 40.6934 10.2526C40.2718 9.97521 39.8031 9.76166 39.3095 9.64795Z" fill="url(#paint19_linear_6709_29667)"/>
-</g>
-<mask id="mask24_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0452 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1388 18.3115 42.1661 17.5377 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8452 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5652 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask24_6709_29667)">
-<g filter="url(#filter24_f_6709_29667)">
-<path d="M28.5448 25.7749C28.9525 26.9564 29.7706 27.9632 30.7413 28.748C31.063 29.0115 31.4042 29.2528 31.7841 29.422C32.1613 29.5939 32.5801 29.691 32.9934 29.655C33.3983 29.6217 33.7838 29.4608 34.1388 29.2611C34.4938 29.0614 34.8211 28.8201 35.165 28.6038C35.7529 28.2294 36.3825 27.9271 36.9954 27.5943C37.7304 27.1921 38.4459 26.7345 39.0644 26.1687C39.3501 25.9108 39.6136 25.6279 39.927 25.406C40.2404 25.1814 40.6175 25.0205 41.0003 25.0483C41.2887 25.0677 41.5577 25.1897 41.8406 25.2507C41.9821 25.2812 42.1263 25.2951 42.2705 25.2729C42.412 25.2507 42.5506 25.1925 42.6505 25.0871C42.7725 24.9595 42.828 24.7765 42.8196 24.599C42.8141 24.4242 42.7531 24.2523 42.6699 24.097C42.5063 23.7836 42.2566 23.5146 42.1457 23.179C42.0459 22.8794 42.0653 22.5577 42.0736 22.2443C42.0819 21.9282 42.0764 21.6009 41.9321 21.3208C41.8212 21.11 41.6354 20.9408 41.4246 20.8299C41.2138 20.7162 40.9753 20.6579 40.7368 20.6357C40.2598 20.5914 39.7827 20.6857 39.3029 20.7106C38.6706 20.7467 38.0327 20.669 37.3976 20.7051C36.6072 20.755 35.8306 20.9824 35.0374 20.9852C34.1332 20.988 33.2291 20.6912 32.3361 20.8326C31.9505 20.8937 31.5845 21.0323 31.2184 21.1544C30.8495 21.2792 30.4695 21.3873 30.0813 21.3818C29.6403 21.3735 29.2132 21.2209 28.7722 21.1904C28.5531 21.1738 28.3284 21.1904 28.1204 21.2681C27.9152 21.3457 27.7294 21.4872 27.6268 21.6841C27.5685 21.795 27.5408 21.9226 27.5352 22.0474C27.5297 22.175 27.5463 22.2998 27.5768 22.4246C27.6379 22.6687 27.7516 22.8989 27.8431 23.1318C28.1759 23.9833 28.248 24.9124 28.5448 25.7749Z" fill="black" fill-opacity="0.258824"/>
-</g>
-</g>
-<mask id="mask25_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="1" width="40" height="70">
-<path d="M35.7093 1C34.0453 1 32.3756 1.32727 30.8669 2.14266C29.2638 3.0052 27.9492 4.38637 27.1422 6.01715C26.3323 7.64793 26.0161 9.38965 25.9662 11.3089C25.8747 14.9532 26.0494 18.775 26.324 22.239C26.3961 23.2929 26.5292 23.9086 26.3933 24.993C25.944 27.295 23.9305 28.8425 22.8544 30.8644C21.6702 33.0942 21.171 35.6153 20.2779 37.9782C19.4597 40.1387 18.3115 42.1661 17.5378 44.3433C16.4533 47.3857 16.1288 50.7305 16.8444 53.8811C17.3908 56.2829 18.5306 58.535 20.0671 60.4625C19.8453 60.8619 19.6289 61.2696 19.4015 61.6662C18.6887 62.8948 17.8179 64.0624 17.4129 65.4242C17.2105 66.1037 17.1301 66.8303 17.2604 67.5292C17.3908 68.2281 17.7458 68.8965 18.3004 69.3403C18.6638 69.6287 19.1047 69.8173 19.5568 69.9227C20.0089 70.0253 20.4776 70.0503 20.9435 70.042C22.7102 70.0031 24.4242 69.4678 26.1326 69.0186C27.1477 68.7523 28.1683 68.5166 29.1917 68.303C32.836 67.557 36.9019 67.8565 40.2827 68.3446C41.4281 68.5193 42.5653 68.744 43.6913 69.0186C45.4552 69.4457 47.2108 69.9893 49.0246 70.042C49.5016 70.0558 49.9842 70.0336 50.4501 69.931C50.9161 69.8256 51.3681 69.637 51.7398 69.3403C52.2972 68.8965 52.6522 68.2253 52.7826 67.5264C52.9129 66.8275 52.8325 66.0981 52.6273 65.4159C52.2168 64.0513 51.3376 62.8893 50.611 61.6662C50.3226 61.1808 50.0563 60.6871 49.7706 60.2018C51.9617 57.7418 53.7256 54.8962 54.7462 51.7705C55.8583 48.3592 56.0636 44.6844 55.5949 41.1261C55.1261 37.5678 53.9974 34.1176 52.5136 30.8505C50.6498 26.7569 49.0828 25.2759 47.9457 21.6787C46.7199 17.7904 47.7322 13.1893 46.8197 9.66422C46.4952 8.46609 45.9766 7.32066 45.3082 6.2723C44.5261 5.04367 43.5332 3.94539 42.3545 3.09117C40.4741 1.72664 38.1111 1 35.7093 1Z" fill="white"/>
-</mask>
-<g mask="url(#mask25_6709_29667)">
-<g opacity="0.3" filter="url(#filter25_f_6709_29667)">
-<path d="M27.411 22.4106C28.2014 22.8987 28.9114 23.5006 29.5077 24.1828C30.0596 24.818 30.5283 25.5391 31.2522 26.0078C31.7597 26.3406 32.3727 26.5264 32.9939 26.5846C33.7233 26.6512 34.4611 26.543 35.1655 26.3517C35.8173 26.1769 36.4468 25.9273 37.0237 25.6001C38.1248 24.976 39.0428 24.0608 40.2548 23.6503C40.5182 23.5588 40.7928 23.495 41.048 23.3841C41.3031 23.2759 41.5444 23.1095 41.6664 22.8766C41.7829 22.6491 41.7774 22.3912 41.8162 22.1444C41.8578 21.8781 41.9493 21.623 41.9993 21.3595C42.0492 21.096 42.0547 20.8159 41.9327 20.5746C41.8301 20.3749 41.6443 20.2168 41.4307 20.1142C41.2172 20.0144 40.9759 19.97 40.7346 19.9589C40.2575 19.9367 39.7833 20.0504 39.3035 20.0893C38.6711 20.1419 38.0332 20.0671 37.3981 20.0865C36.6077 20.1087 35.8284 20.2723 35.0379 20.3084C34.1366 20.3472 33.238 20.2141 32.3366 20.1863C31.9456 20.1725 31.5517 20.178 31.169 20.2418C30.7835 20.3028 30.4063 20.4221 30.0818 20.6218C29.7656 20.8131 29.5077 21.0766 29.2193 21.3012C29.075 21.415 28.9197 21.5176 28.7533 21.598C28.5841 21.6757 28.3983 21.7311 28.2097 21.7394C28.1127 21.7422 28.0128 21.7367 27.9185 21.7505C27.7549 21.7727 27.6051 21.8587 27.5108 21.9807C27.4165 22.1055 27.3805 22.2636 27.411 22.4106Z" fill="black"/>
-</g>
-</g>
-<path d="M31.4685 17.2328C31.8928 16.7586 32.1812 16.1789 32.5862 15.6908C32.7886 15.4467 33.0244 15.2221 33.2989 15.064C33.5735 14.9059 33.8952 14.8171 34.2114 14.8449C34.5636 14.8754 34.8937 15.0501 35.1516 15.2914C35.4095 15.5327 35.6009 15.8378 35.7534 16.1567C35.9004 16.4646 36.0169 16.7891 36.2277 17.0553C36.4523 17.3382 36.7657 17.5296 37.0514 17.7542C37.1928 17.8652 37.3315 17.9844 37.4424 18.1259C37.5562 18.2673 37.6421 18.4309 37.681 18.6084C37.717 18.7887 37.6976 18.9773 37.6366 19.1493C37.5728 19.3212 37.4674 19.4765 37.3343 19.6041C37.0708 19.8593 36.7103 19.9979 36.3469 20.0478C35.6203 20.1505 34.8853 19.9341 34.1504 19.9535C33.4099 19.9757 32.6832 20.2364 31.9399 20.2115C31.5711 20.1976 31.1939 20.1061 30.8888 19.8953C30.7363 19.7871 30.6031 19.6512 30.5061 19.4932C30.4118 19.3351 30.3535 19.152 30.3452 18.9662C30.3397 18.7887 30.3813 18.6112 30.4534 18.4503C30.5227 18.2867 30.6226 18.1397 30.7335 18.0011C30.9581 17.7265 31.2327 17.4991 31.4685 17.2328Z" fill="url(#paint20_radial_6709_29667)"/>
-<path d="M27.4424 21.8152C27.459 21.8873 27.484 21.9538 27.52 22.0176C27.5838 22.123 27.6781 22.209 27.778 22.2811C27.8778 22.356 27.986 22.417 28.0914 22.4808C28.6488 22.833 29.1037 23.3239 29.5086 23.8453C30.0494 24.5442 30.5292 25.318 31.2531 25.8255C31.7634 26.1861 32.3736 26.3885 32.9948 26.4523C33.7242 26.5244 34.462 26.408 35.1664 26.2C35.8182 26.0086 36.4477 25.7396 37.0246 25.3818C38.1257 24.7051 39.0437 23.7122 40.2557 23.2657C40.5191 23.1686 40.7937 23.0993 41.0489 22.98C41.304 22.858 41.5453 22.6805 41.6673 22.4253C41.7838 22.1812 41.7783 21.8984 41.8171 21.6293C41.8587 21.3437 41.9502 21.0663 42.0002 20.7807C42.0501 20.495 42.0556 20.1899 41.9336 19.9264C41.831 19.7101 41.6452 19.5382 41.4316 19.43C41.218 19.3191 40.9768 19.2691 40.7355 19.258C40.2584 19.2359 39.7842 19.3579 39.3044 19.4023C38.672 19.4605 38.0341 19.3773 37.399 19.3967C36.6086 19.4217 35.8293 19.5992 35.0388 19.638C34.1375 19.6796 33.2389 19.5409 32.3375 19.5049C31.9464 19.4882 31.5526 19.4938 31.1671 19.5603C30.7816 19.6241 30.4044 19.7573 30.0827 19.9791C29.7693 20.1955 29.5197 20.4894 29.2312 20.7391C29.087 20.8639 28.9317 20.9776 28.7598 21.0608C28.5906 21.144 28.402 21.1967 28.2106 21.1911C28.1136 21.1884 28.0109 21.1745 27.9194 21.2022C27.8612 21.2216 27.8085 21.2577 27.7641 21.2993C27.7197 21.3437 27.6837 21.3936 27.6504 21.4435C27.57 21.56 27.5006 21.6848 27.4424 21.8152Z" fill="url(#paint21_radial_6709_29667)"/>
-<mask id="mask26_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="19" width="16" height="8">
-<path d="M27.4434 21.8156C27.46 21.8877 27.485 21.9543 27.521 22.0181C27.5848 22.1235 27.6791 22.2095 27.7789 22.2816C27.8788 22.3565 27.987 22.4175 28.0923 22.4813C28.6498 22.8335 29.1046 23.3244 29.5096 23.8458C30.0504 24.5447 30.5302 25.3185 31.2541 25.826C31.7644 26.1866 32.3745 26.389 32.9958 26.4528C33.7252 26.5249 34.4629 26.4085 35.1674 26.2004C35.8191 26.0091 36.4487 25.7401 37.0256 25.3823C38.1266 24.7056 39.0446 23.7127 40.2566 23.2661C40.5201 23.1691 40.7947 23.0997 41.0498 22.9805C41.305 22.8585 41.5463 22.681 41.6683 22.4258C41.7848 22.1817 41.7793 21.8988 41.8181 21.6298C41.8597 21.3442 41.9512 21.0668 42.0011 20.7811C42.0511 20.4955 42.0566 20.1904 41.9346 19.9269C41.832 19.7106 41.6461 19.5386 41.4326 19.4305C41.219 19.3195 40.9777 19.2696 40.7364 19.2585C40.2594 19.2363 39.7852 19.3584 39.3054 19.4027C38.673 19.461 38.0351 19.3778 37.4 19.3972C36.6096 19.4222 35.8302 19.5997 35.0398 19.6385C34.1384 19.6801 33.2398 19.5414 32.3385 19.5054C31.9474 19.4887 31.5536 19.4943 31.1681 19.5608C30.7826 19.6246 30.4054 19.7577 30.0837 19.9796C29.7703 20.196 29.5207 20.4899 29.2322 20.7395C29.088 20.8643 28.9327 20.9781 28.7607 21.0613C28.5916 21.1445 28.403 21.1972 28.2116 21.1916C28.1145 21.1888 28.0119 21.175 27.9204 21.2027C27.8621 21.2221 27.8095 21.2582 27.7651 21.2998C27.7207 21.3442 27.6846 21.3941 27.6514 21.444C27.5709 21.5605 27.5016 21.6853 27.4434 21.8156Z" fill="white"/>
-</mask>
-<g mask="url(#mask26_6709_29667)">
-<g filter="url(#filter26_f_6709_29667)">
-<path d="M30.9816 22.7885C30.89 23.1685 30.9455 23.5845 31.1369 23.9284C31.3255 24.2723 31.6472 24.5385 32.0216 24.6634C32.4931 24.8214 33.0256 24.7438 33.4666 24.5136C33.7245 24.3805 33.9575 24.1919 34.1044 23.9423C34.1793 23.8202 34.232 23.6816 34.2514 23.5373C34.2681 23.3959 34.257 23.2461 34.2071 23.1102C34.1516 22.9632 34.0518 22.8329 33.9325 22.7303C33.8105 22.6277 33.669 22.5528 33.5165 22.5028C33.2169 22.403 32.7482 22.3198 32.4321 22.3143C31.8718 22.3032 31.0731 22.4085 30.9816 22.7885Z" fill="#D9B30D"/>
-</g>
-</g>
-<mask id="mask27_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="19" width="16" height="8">
-<path d="M27.4414 21.8152C27.458 21.8873 27.483 21.9538 27.5191 22.0176C27.5829 22.123 27.6771 22.209 27.777 22.2811C27.8768 22.356 27.985 22.417 28.0904 22.4808C28.6479 22.833 29.1027 23.3239 29.5076 23.8453C30.0484 24.5442 30.5282 25.318 31.2521 25.8255C31.7624 26.1861 32.3726 26.3885 32.9938 26.4523C33.7232 26.5244 34.461 26.408 35.1654 26.2C35.8172 26.0086 36.4468 25.7396 37.0236 25.3818C38.1247 24.7051 39.0427 23.7122 40.2547 23.2657C40.5182 23.1686 40.7927 23.0993 41.0479 22.98C41.303 22.858 41.5443 22.6805 41.6664 22.4253C41.7828 22.1812 41.7773 21.8984 41.8161 21.6293C41.8577 21.3437 41.9493 21.0663 41.9992 20.7807C42.0491 20.495 42.0546 20.1899 41.9326 19.9264C41.83 19.7101 41.6442 19.5382 41.4306 19.43C41.2171 19.3191 40.9758 19.2691 40.7345 19.258C40.2575 19.2359 39.7832 19.3579 39.3034 19.4023C38.6711 19.4605 38.0332 19.3773 37.398 19.3967C36.6076 19.4217 35.8283 19.5992 35.0379 19.638C34.1365 19.6796 33.2379 19.5409 32.3365 19.5049C31.9455 19.4882 31.5516 19.4938 31.1661 19.5603C30.7806 19.6241 30.4034 19.7573 30.0817 19.9791C29.7683 20.1955 29.5187 20.4894 29.2303 20.7391C29.0861 20.8639 28.9307 20.9776 28.7588 21.0608C28.5896 21.144 28.401 21.1967 28.2096 21.1911C28.1126 21.1884 28.01 21.1745 27.9184 21.2022C27.8602 21.2216 27.8075 21.2577 27.7631 21.2993C27.7188 21.3437 27.6827 21.3936 27.6494 21.4435C27.569 21.56 27.4996 21.6848 27.4414 21.8152Z" fill="white"/>
-</mask>
-<g mask="url(#mask27_6709_29667)">
-<g filter="url(#filter27_f_6709_29667)">
-<path d="M29.4296 19.8206C29.1078 20.0092 28.8 20.2172 28.4977 20.4307C28.3396 20.5444 28.1787 20.6637 28.0955 20.8384C28.0373 20.9605 28.0234 21.0991 28.0206 21.235C28.0206 21.3737 28.029 21.5096 28.0096 21.6455C27.9985 21.737 27.9735 21.8285 27.9707 21.9201C27.968 21.9672 27.9707 22.0144 27.9818 22.0587C27.9957 22.1031 28.0179 22.1475 28.0484 22.1808C28.09 22.2251 28.1455 22.2529 28.2037 22.2695C28.2619 22.2862 28.3202 22.2945 28.3812 22.3084C28.6613 22.3749 28.9054 22.5469 29.1189 22.741C29.3325 22.9324 29.5266 23.1515 29.7513 23.3317C30.3559 23.8254 31.1574 24.0307 31.9395 24.0417C32.7216 24.0556 33.4954 23.892 34.2581 23.72C34.8572 23.5841 35.4562 23.4455 36.0303 23.2319C36.9178 22.9046 37.7388 22.411 38.4488 21.7925C38.7733 21.5124 39.0756 21.2045 39.4389 20.9771C39.7578 20.7746 40.1156 20.6415 40.4429 20.4501C40.4734 20.4335 40.5011 20.4141 40.5261 20.3947C40.5538 20.3725 40.576 20.3448 40.5926 20.317C40.6176 20.2643 40.6176 20.2005 40.601 20.1451C40.5843 20.0896 40.551 20.0397 40.515 19.9925C40.4734 19.9426 40.429 19.8982 40.3791 19.8539C40.038 19.5626 39.5776 19.4573 39.1283 19.4212C38.6817 19.3879 38.2297 19.4129 37.7887 19.338C37.3727 19.2687 36.9789 19.1134 36.5767 18.9858C36.1551 18.8499 35.7253 18.7445 35.2898 18.6724C34.2609 18.5032 33.2042 18.5365 32.1864 18.7473C31.2184 18.9497 30.281 19.3158 29.4296 19.8206Z" fill="#604405"/>
-</g>
-</g>
-<path d="M29.3273 18.7362C28.8669 19.0468 28.4509 19.4268 28.0987 19.8566C27.899 20.1035 27.7159 20.3725 27.6161 20.672C27.5357 20.9106 27.5079 21.1602 27.458 21.407C27.4386 21.4985 27.4164 21.59 27.4192 21.6843C27.4192 21.7287 27.4247 21.7759 27.4386 21.823C27.4525 21.8674 27.4774 21.909 27.5079 21.9423C27.5634 21.9977 27.6383 22.0282 27.7132 22.0449C27.7908 22.0588 27.8685 22.0615 27.9461 22.0699C28.2928 22.1115 28.6118 22.2779 28.9002 22.4775C29.1886 22.6745 29.4549 22.9074 29.7516 23.0932C30.4034 23.5065 31.1827 23.6895 31.9565 23.72C32.7275 23.7506 33.4986 23.6341 34.2585 23.4815C34.8603 23.3623 35.4594 23.2181 36.0307 22.9934C36.9071 22.6467 37.6975 22.117 38.4491 21.554C38.793 21.2988 39.1314 21.0354 39.4393 20.7386C39.5419 20.636 39.6445 20.5334 39.7554 20.4391C39.8664 20.3475 39.9912 20.2671 40.1298 20.2227C40.3406 20.1562 40.568 20.1756 40.7872 20.2116C40.9508 20.2394 41.1144 20.2754 41.2808 20.2699C41.364 20.2643 41.4472 20.2505 41.5249 20.22C41.6025 20.1895 41.6746 20.1423 41.7273 20.0757C41.7967 19.9925 41.8327 19.8816 41.8327 19.7734C41.8327 19.6625 41.7995 19.5543 41.744 19.46C41.6331 19.2715 41.4417 19.1439 41.242 19.0551C40.9674 18.9331 40.6707 18.8749 40.3795 18.8027C39.4836 18.5864 38.6128 18.2675 37.7891 17.857C37.3786 17.6545 36.9792 17.4299 36.5771 17.2136C36.1611 16.9917 35.7395 16.7781 35.2902 16.6395C34.2807 16.3344 33.1824 16.4342 32.1867 16.7809C31.0829 17.1636 30.0845 17.8459 29.3273 18.7362Z" fill="url(#paint22_linear_6709_29667)"/>
-<mask id="mask28_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="16" width="15" height="8">
-<path d="M29.3273 18.7362C28.8669 19.0468 28.4509 19.4268 28.0987 19.8566C27.899 20.1035 27.7159 20.3725 27.6161 20.672C27.5357 20.9106 27.5079 21.1602 27.458 21.407C27.4386 21.4985 27.4164 21.59 27.4192 21.6843C27.4192 21.7287 27.4247 21.7759 27.4386 21.823C27.4525 21.8674 27.4774 21.909 27.5079 21.9423C27.5634 21.9977 27.6383 22.0282 27.7132 22.0449C27.7908 22.0588 27.8685 22.0615 27.9461 22.0699C28.2928 22.1115 28.6118 22.2779 28.9002 22.4775C29.1886 22.6745 29.4549 22.9074 29.7516 23.0932C30.4034 23.5065 31.1827 23.6895 31.9565 23.72C32.7275 23.7506 33.4986 23.6341 34.2585 23.4815C34.8603 23.3623 35.4594 23.2181 36.0307 22.9934C36.9071 22.6467 37.6975 22.117 38.4491 21.554C38.793 21.2988 39.1314 21.0354 39.4393 20.7386C39.5419 20.636 39.6445 20.5334 39.7554 20.4391C39.8664 20.3475 39.9912 20.2671 40.1298 20.2227C40.3406 20.1562 40.568 20.1756 40.7872 20.2116C40.9508 20.2394 41.1144 20.2754 41.2808 20.2699C41.364 20.2643 41.4472 20.2505 41.5249 20.22C41.6025 20.1895 41.6746 20.1423 41.7273 20.0757C41.7967 19.9925 41.8327 19.8816 41.8327 19.7734C41.8327 19.6625 41.7995 19.5543 41.744 19.46C41.6331 19.2715 41.4417 19.1439 41.242 19.0551C40.9674 18.9331 40.6707 18.8749 40.3795 18.8027C39.4836 18.5864 38.6128 18.2675 37.7891 17.857C37.3786 17.6545 36.9792 17.4299 36.5771 17.2136C36.1611 16.9917 35.7395 16.7781 35.2902 16.6395C34.2807 16.3344 33.1824 16.4342 32.1867 16.7809C31.0829 17.1636 30.0845 17.8459 29.3273 18.7362Z" fill="white"/>
-</mask>
-<g mask="url(#mask28_6709_29667)">
-<g filter="url(#filter28_f_6709_29667)">
-<path d="M36.4021 18.9582C36.3466 18.8917 36.2689 18.8418 36.1857 18.8168C36.1025 18.7918 36.0138 18.7918 35.9278 18.8057C35.7559 18.8362 35.6005 18.9277 35.4563 19.0276C35.0486 19.3077 34.6881 19.6544 34.3719 20.0371C33.9559 20.5446 33.612 21.1298 33.4955 21.7761C33.4761 21.8842 33.465 21.9979 33.4761 22.1061C33.49 22.217 33.5316 22.3252 33.612 22.4029C33.6785 22.4722 33.7728 22.5138 33.8671 22.5277C33.9642 22.5415 34.0641 22.5277 34.1556 22.4971C34.3386 22.4361 34.4912 22.3058 34.6382 22.1782C35.4341 21.4627 36.1552 20.6084 36.4437 19.5767C36.4714 19.4741 36.4964 19.3687 36.4964 19.2605C36.4964 19.1524 36.4686 19.0442 36.4021 18.9582Z" fill="#F6DA4A"/>
-</g>
-</g>
-<g opacity="0.8" filter="url(#filter29_f_6709_29667)">
-<path d="M31.7625 17.38C31.549 17.3107 31.1995 17.6851 31.3132 17.8765C31.3437 17.9292 31.4408 17.9957 31.5074 17.9597C31.6044 17.907 31.6849 17.7128 31.7903 17.638C31.8596 17.588 31.8457 17.405 31.7625 17.38Z" fill="url(#paint23_radial_6709_29667)"/>
-</g>
-<g opacity="0.8" filter="url(#filter30_f_6709_29667)">
-<path d="M34.4912 17.4799C34.5466 17.6574 34.8323 17.6269 34.9987 17.7129C35.1429 17.7878 35.2594 17.9514 35.4231 17.9569C35.5784 17.9597 35.8224 17.9015 35.8418 17.7462C35.8668 17.5437 35.57 17.4133 35.3787 17.3385C35.1318 17.2442 34.8157 17.1942 34.5855 17.3218C34.5328 17.3523 34.4745 17.4217 34.4912 17.4799Z" fill="url(#paint24_radial_6709_29667)"/>
-</g>
-<mask id="mask29_6709_29667" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="16" width="16" height="11">
-<path d="M27.4404 21.8147C27.4571 21.8868 27.482 21.9533 27.5181 22.0171C27.5819 22.1225 27.6762 22.2085 27.776 22.2806C27.8759 22.3555 27.984 22.4165 28.0894 22.4803C28.6469 22.8325 29.1017 23.3234 29.5066 23.8448C30.0475 24.5437 30.5273 25.3175 31.2511 25.8251C31.7614 26.1856 32.3716 26.3881 32.9929 26.4518C33.7223 26.524 34.46 26.4075 35.1645 26.1995C35.8162 26.0081 36.4458 25.7391 37.0227 25.3813C38.1237 24.7046 39.0417 23.7117 40.2537 23.2652C40.5172 23.1681 40.7918 23.0988 41.0469 22.9795C41.3021 22.8575 41.5434 22.68 41.6654 22.4248C41.7819 22.1808 41.7763 21.8979 41.8152 21.6288C41.8568 21.3432 41.9483 21.0658 41.9982 20.7802C42.0481 20.4945 42.0537 20.1894 41.9316 19.926C41.829 19.7096 41.6432 19.5377 41.4296 19.4295C41.2161 19.3186 40.9748 19.2686 40.7335 19.2576C40.2565 19.2354 39.7822 19.3574 39.3024 19.4018C38.6701 19.46 38.0322 19.3768 37.3971 19.3962C36.6066 19.4212 35.8273 19.5987 35.0369 19.6375C34.1355 19.6791 33.2369 19.5404 32.3355 19.5044C31.9445 19.4877 31.5507 19.4933 31.1652 19.5599C30.7796 19.6236 30.4025 19.7568 30.0807 19.9786C29.7673 20.195 29.5177 20.489 29.2293 20.7386C29.0851 20.8634 28.9298 20.9771 28.7578 21.0603C28.5886 21.1435 28.4 21.1962 28.2087 21.1906C28.1116 21.1879 28.009 21.174 27.9175 21.2017C27.8592 21.2211 27.8065 21.2572 27.7621 21.2988C27.7178 21.3432 27.6817 21.3931 27.6484 21.443C27.568 21.5595 27.4987 21.6843 27.4404 21.8147Z" fill="white"/>
-<path d="M29.3273 18.7362C28.8669 19.0468 28.4509 19.4268 28.0987 19.8566C27.899 20.1035 27.7159 20.3725 27.6161 20.672C27.5357 20.9106 27.5079 21.1602 27.458 21.407C27.4386 21.4985 27.4164 21.59 27.4192 21.6843C27.4192 21.7287 27.4247 21.7759 27.4386 21.823C27.4525 21.8674 27.4774 21.909 27.5079 21.9423C27.5634 21.9977 27.6383 22.0282 27.7132 22.0449C27.7908 22.0588 27.8685 22.0615 27.9461 22.0699C28.2928 22.1115 28.6118 22.2779 28.9002 22.4775C29.1886 22.6745 29.4549 22.9074 29.7516 23.0932C30.4034 23.5065 31.1827 23.6895 31.9565 23.72C32.7275 23.7506 33.4986 23.6341 34.2585 23.4815C34.8603 23.3623 35.4594 23.2181 36.0307 22.9934C36.9071 22.6467 37.6975 22.117 38.4491 21.554C38.793 21.2988 39.1314 21.0354 39.4393 20.7386C39.5419 20.636 39.6445 20.5334 39.7554 20.4391C39.8664 20.3475 39.9912 20.2671 40.1298 20.2227C40.3406 20.1562 40.568 20.1756 40.7872 20.2116C40.9508 20.2394 41.1144 20.2754 41.2808 20.2699C41.364 20.2643 41.4472 20.2505 41.5249 20.22C41.6025 20.1895 41.6746 20.1423 41.7273 20.0757C41.7967 19.9925 41.8327 19.8816 41.8327 19.7734C41.8327 19.6625 41.7995 19.5543 41.744 19.46C41.6331 19.2715 41.4417 19.1439 41.242 19.0551C40.9674 18.9331 40.6707 18.8749 40.3795 18.8027C39.4836 18.5864 38.6128 18.2675 37.7891 17.857C37.3786 17.6545 36.9792 17.4299 36.5771 17.2136C36.1611 16.9917 35.7395 16.7781 35.2902 16.6395C34.2807 16.3344 33.1824 16.4342 32.1867 16.7809C31.0829 17.1636 30.0845 17.8459 29.3273 18.7362Z" fill="white"/>
-</mask>
-<g mask="url(#mask29_6709_29667)">
-<g filter="url(#filter31_f_6709_29667)">
-<path d="M41.8991 20.1784C41.8733 20.4026 41.7768 20.6174 41.6306 20.7755C41.4845 20.9336 41.3007 21.0221 41.1197 21.0215C40.9389 21.0217 40.7755 20.9329 40.6653 20.7749C40.555 20.6168 40.507 20.4023 40.5317 20.1784C40.5442 20.0672 40.5743 19.9571 40.6202 19.8543C40.6662 19.7516 40.7271 19.6582 40.7995 19.5797C40.8719 19.5011 40.9543 19.4388 41.0421 19.3964C41.1299 19.354 41.2213 19.3323 41.3111 19.3325C41.4008 19.3324 41.4872 19.3542 41.5654 19.3967C41.6435 19.4392 41.7118 19.5015 41.7664 19.58C41.821 19.6586 41.8609 19.7519 41.8836 19.8546C41.9064 19.9572 41.9116 20.0673 41.8991 20.1784Z" fill="url(#paint25_linear_6709_29667)"/>
-</g>
-</g>
-</g>
-<defs>
-<filter id="filter0_f_6709_29667" x="20.7864" y="29.221" width="11.0942" height="10.5449" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.64" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter1_f_6709_29667" x="32.914" y="27.914" width="16.7745" height="12.8311" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.98" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter2_f_6709_29667" x="28.4144" y="29.5409" width="7.90359" height="8.2615" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.68" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter3_f_6709_29667" x="27.5381" y="36.5352" width="6.01562" height="19.3472" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.25" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter4_f_6709_29667" x="46.2955" y="33.8345" width="9.5282" height="9.5785" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.78" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter5_f_6709_29667" x="35.6191" y="0.581992" width="10.8555" height="10.6514" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.73" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter6_f_6709_29667" x="42.6607" y="20.6006" width="6.03016" height="6.36121" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.78" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter7_f_6709_29667" x="15.0966" y="33.5102" width="10.3497" height="19.1388" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.98" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter8_f_6709_29667" x="45.3846" y="31.6215" width="11.4788" height="24.1267" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.19" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter9_f_6709_29667" x="0.196054" y="43.4016" width="34.4555" height="34.2651" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="3.38" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter10_f_6709_29667" x="3.47871" y="45.0529" width="26.9439" height="28.0846" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="2.1" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter11_f_6709_29667" x="19.6071" y="52.5587" width="7.57004" height="12.6902" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.32" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter12_f_6709_29667" x="40.2045" y="49.3656" width="24.8684" height="26.3781" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.95" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter13_f_6709_29667" x="38.1028" y="42.7981" width="35.3814" height="35.6475" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="4.12" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter14_f_6709_29667" x="40.8733" y="43.3557" width="30.521" height="30.4287" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="3.12" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter15_f_6709_29667" x="46.0833" y="49.9871" width="14.7914" height="3.76744" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.41" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter16_f_6709_29667" x="44.5863" y="47.0517" width="17.9357" height="16.7707" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="2.45" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter17_f_6709_29667" x="47.2463" y="49.2566" width="12.6157" height="9.51955" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.12" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter18_f_6709_29667" x="48.3191" y="46.6795" width="11.8677" height="7.42576" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.88" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter19_f_6709_29667" x="48.3191" y="46.6795" width="11.8677" height="7.42576" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.88" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter20_f_6709_29667" x="28.6698" y="13.5204" width="3.01488" height="3.77367" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.44" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter21_f_6709_29667" x="28.9778" y="9.8767" width="3.82961" height="3.49172" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.12" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter22_f_6709_29667" x="37.5941" y="13.2753" width="3.46797" height="3.44307" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.45" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter23_f_6709_29667" x="38.7527" y="9.38795" width="4.18602" height="3.90379" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.13" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter24_f_6709_29667" x="24.0342" y="17.124" width="22.2861" height="16.0386" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.75" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter25_f_6709_29667" x="25.8004" y="18.3561" width="17.8318" height="9.84844" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.8" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter26_f_6709_29667" x="29.3985" y="20.7735" width="6.40031" height="5.51262" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.77" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter27_f_6709_29667" x="26.6697" y="17.2645" width="15.2426" height="8.07803" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.65" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter28_f_6709_29667" x="32.0117" y="17.3364" width="5.94441" height="6.65682" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.73" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter29_f_6709_29667" x="31.091" y="17.1716" width="0.943945" height="0.998145" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.1" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter30_f_6709_29667" x="34.2883" y="17.0451" width="1.75547" height="1.11191" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.1" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<filter id="filter31_f_6709_29667" x="40.0654" y="18.8725" width="2.29988" height="2.60896" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.23" result="effect1_foregroundBlur_6709_29667"/>
-</filter>
-<radialGradient id="paint0_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(23.0149 34.6112) scale(5.26953 4.99219)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<radialGradient id="paint1_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(40.9201 37.4982) scale(6.54531 4.99219)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<radialGradient id="paint2_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(32.1762 36.3535) scale(2.59316 2.77344)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<linearGradient id="paint3_linear_6709_29667" x1="12.4757" y1="54.5302" x2="23.8829" y2="73.6697" gradientUnits="userSpaceOnUse">
-<stop stop-color="#B98309"/>
-<stop offset="1" stop-color="#382605"/>
-</linearGradient>
-<linearGradient id="paint4_linear_6709_29667" x1="23.9274" y1="59.4722" x2="27.5162" y2="66.2339" gradientUnits="userSpaceOnUse">
-<stop stop-color="#EBC40C"/>
-<stop offset="1" stop-color="#EBC40C" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint5_linear_6709_29667" x1="46.7968" y1="59.7857" x2="47.7037" y2="66.3782" gradientUnits="userSpaceOnUse">
-<stop/>
-<stop offset="1" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint6_linear_6709_29667" x1="48.0648" y1="71.1736" x2="59.5579" y2="52.5417" gradientUnits="userSpaceOnUse">
-<stop stop-color="#3E2A06"/>
-<stop offset="1" stop-color="#AD780A"/>
-</linearGradient>
-<linearGradient id="paint7_linear_6709_29667" x1="51.2021" y1="51.1077" x2="50.8638" y2="54.1501" gradientUnits="userSpaceOnUse">
-<stop stop-color="#F3CD0C"/>
-<stop offset="1" stop-color="#F3CD0C" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint8_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(53.1154 54.9517) rotate(15) scale(5.45258 5.72438)">
-<stop stop-color="#110800"/>
-<stop offset="0.59" stop-color="#A65A00" stop-opacity="0.8"/>
-<stop offset="1" stop-color="#FF921E" stop-opacity="0"/>
-</radialGradient>
-<radialGradient id="paint9_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(53.1154 53.6644) rotate(-2.42) scale(5.47477 4.12133)">
-<stop stop-color="#110800"/>
-<stop offset="0.59" stop-color="#A65A00" stop-opacity="0.8"/>
-<stop offset="1" stop-color="#FF921E" stop-opacity="0"/>
-</radialGradient>
-<radialGradient id="paint10_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(57.2585 49.9848) rotate(23.5) scale(1.92754 0.890273)">
-<stop stop-color="#7C7C7C"/>
-<stop offset="1" stop-color="#7C7C7C" stop-opacity="0.33"/>
-</radialGradient>
-<linearGradient id="paint11_linear_6709_29667" x1="52.0001" y1="49.1417" x2="52.7157" y2="49.1112" gradientUnits="userSpaceOnUse">
-<stop stop-color="#7C7C7C"/>
-<stop offset="1" stop-color="#7C7C7C" stop-opacity="0.33"/>
-</linearGradient>
-<radialGradient id="paint12_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(30.0343 15.2584) rotate(-0.6) scale(2.84 4.34875)">
-<stop stop-color="#FEFEFC"/>
-<stop offset="0.75" stop-color="#FEFEFC"/>
-<stop offset="1" stop-color="#D4D4D4"/>
-</radialGradient>
-<linearGradient id="paint13_linear_6709_29667" x1="29.424" y1="13.935" x2="30.8191" y2="16.4283" gradientUnits="userSpaceOnUse">
-<stop stop-color="#757574" stop-opacity="0"/>
-<stop offset="0.25" stop-color="#757574"/>
-<stop offset="0.5" stop-color="#757574"/>
-<stop offset="1" stop-color="#757574" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint14_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(29.5898 13.1312) rotate(-9.35) scale(1.7334 1.60027)">
-<stop stop-color="#C8C8C8"/>
-<stop offset="1" stop-color="#797978"/>
-</radialGradient>
-<linearGradient id="paint15_linear_6709_29667" x1="29.2306" y1="10.0165" x2="32.2509" y2="13.1005" gradientUnits="userSpaceOnUse">
-<stop stop-color="#646464" stop-opacity="0"/>
-<stop offset="0.31" stop-color="#646464" stop-opacity="0.58"/>
-<stop offset="0.47" stop-color="#646464"/>
-<stop offset="0.73" stop-color="#646464" stop-opacity="0.26"/>
-<stop offset="1" stop-color="#646464" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint16_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(38.7902 15.2586) rotate(-1.8) scale(3.78297 4.34875)">
-<stop stop-color="#FEFEFC"/>
-<stop offset="0.75" stop-color="#FEFEFC"/>
-<stop offset="1" stop-color="#D4D4D4"/>
-</radialGradient>
-<linearGradient id="paint17_linear_6709_29667" x1="38.7365" y1="14.1045" x2="40.3423" y2="16.0071" gradientUnits="userSpaceOnUse">
-<stop stop-color="#949494" stop-opacity="0.39"/>
-<stop offset="0.5" stop-color="#949494"/>
-<stop offset="1" stop-color="#949494" stop-opacity="0.39"/>
-</linearGradient>
-<linearGradient id="paint18_linear_6709_29667" x1="37.3592" y1="11.0485" x2="42.4678" y2="14.0383" gradientUnits="userSpaceOnUse">
-<stop stop-color="#747474"/>
-<stop offset="0.13" stop-color="#8C8C8C"/>
-<stop offset="0.25" stop-color="#A4A4A4"/>
-<stop offset="0.5" stop-color="#D4D4D4"/>
-<stop offset="0.62" stop-color="#D4D4D4"/>
-<stop offset="1" stop-color="#7C7C7C"/>
-</linearGradient>
-<linearGradient id="paint19_linear_6709_29667" x1="39.0959" y1="9.75334" x2="42.4961" y2="12.965" gradientUnits="userSpaceOnUse">
-<stop stop-color="#646464" stop-opacity="0"/>
-<stop offset="0.31" stop-color="#646464" stop-opacity="0.58"/>
-<stop offset="0.47" stop-color="#646464"/>
-<stop offset="0.73" stop-color="#646464" stop-opacity="0.26"/>
-<stop offset="1" stop-color="#646464" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint20_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(33.127 17.6738) rotate(-36) scale(3.17281 2.87883)">
-<stop stop-color="#020204"/>
-<stop offset="0.73" stop-color="#020204"/>
-<stop offset="1" stop-color="#5C5C5C"/>
-</radialGradient>
-<radialGradient id="paint21_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(36.4921 20.5837) rotate(-22.4) scale(7.52988 5.28894)">
-<stop stop-color="#D2940A"/>
-<stop offset="0.75" stop-color="#D89C08"/>
-<stop offset="0.87" stop-color="#B67E07"/>
-<stop offset="1" stop-color="#946106"/>
-</radialGradient>
-<linearGradient id="paint22_linear_6709_29667" x1="27.7048" y1="20.2089" x2="41.2059" y2="20.1035" gradientUnits="userSpaceOnUse">
-<stop stop-color="#AD780A"/>
-<stop offset="0.12" stop-color="#D89E08"/>
-<stop offset="0.25" stop-color="#EDB80B"/>
-<stop offset="0.39" stop-color="#EBC80D"/>
-<stop offset="0.53" stop-color="#F5D838"/>
-<stop offset="0.77" stop-color="#F6D811"/>
-<stop offset="1" stop-color="#F5CD31"/>
-</linearGradient>
-<radialGradient id="paint23_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(31.5933 17.6075) scale(0.366094 0.393828)">
-<stop stop-color="#3A2903"/>
-<stop offset="0.55" stop-color="#735208"/>
-<stop offset="1" stop-color="#AC8C04"/>
-</radialGradient>
-<radialGradient id="paint24_radial_6709_29667" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(35.0708 17.5576) scale(0.771016 0.449297)">
-<stop stop-color="#3A2903"/>
-<stop offset="0.55" stop-color="#735208"/>
-<stop offset="1" stop-color="#AC8C04"/>
-</radialGradient>
-<linearGradient id="paint25_linear_6709_29667" x1="41.1974" y1="19.718" x2="41.1974" y2="20.7165" gradientUnits="userSpaceOnUse">
-<stop stop-color="#F5CE2D"/>
-<stop offset="1" stop-color="#D79B08"/>
-</linearGradient>
-<clipPath id="clip0_6709_29667">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6709_29667)"><path fill="#a7abbd" d="M18.498 34.427c.933-2.03 2.55-3.853 4.068-5.564s1.26-1.445 1.358-1.554l.283-.317c.414-.466.68-.795.78-.986l1.87.638a19 19 0 0 1-.358 1.543l-.002.005c-.129.491-.246.936-.326 1.38-.22 1.232-.476 2.652-1.137 3.94-.393.767-.903 1.434-1.385 2.032l-.317.39c-.375.46-.718.88-1.025 1.334-.54.798-.948 1.673-1.394 2.628q-.104.225-.213.455v.002l-.09.188c-.273.576-.521 1.098-.715 1.641-.53 1.5-.613 3.165-.307 4.767.113.592.266 1.1.512 1.515l.001.002c.258.436.643.813 1.142 1.281.5.469 5.31 4.506 5.352 4.539l.126.097c.809.624 1.805 1.392 2.457 2.462.286.47.527 1.035.597 1.665.07.633-.04 1.342-.431 1.947h-.001a2.9 2.9 0 0 1-1.267 1.062l-.003.001a3.5 3.5 0 0 1-1.49.284c-.954-.016-1.814-.367-2.492-.675l-.003-.001a21.6 21.6 0 0 1-3.658-2.138h-.002c-2.522-1.831-4.664-4.228-6.096-7.029-.337-.653-.651-1.368-.851-2.14-.205-.78-.288-1.633-.147-2.487.172-1.04.664-1.96 1.062-2.706l.052-.097c.56-1.054 1.11-2.086 1.609-3.139.546-1.156 1.022-2.325 1.37-3.518v-.002c.077-.265.154-.554.233-.857.217-.824.461-1.75.835-2.58zm39.897 19.688c-.42.327-.977.522-1.403.647-.425.126-10.492-30.762-6.027-28.92.19.282.273.41.344.522.112.176.196.308.634.927l.002.003c.147.21.315.428.5.663l.057.075c.163.208.337.431.498.652.416.572.906 1.094 1.447 1.671l.085.091c.558.596 1.166 1.252 1.676 2.003a23.8 23.8 0 0 1 2.444 4.621c.855 2.168 1.533 4.426 1.938 6.747.292 1.684.475 3.535.115 5.345v.002l-.037.181c-.143.716-.311 1.56-.601 2.347-.32.87-.816 1.757-1.672 2.423"/><path fill="#a7abbd" d="M24.967 11.284c.052-2.014.386-3.911 1.28-5.711a9.9 9.9 0 0 1 4.145-4.31C32.076.352 33.917 0 35.71 0c2.598 0 5.17.785 7.232 2.281 1.292.937 2.369 2.132 3.21 3.454a13.3 13.3 0 0 1 1.634 3.668l.003.01c.455 1.759.465 3.744.475 5.627l.002.488c.014 2.09.073 4.068.635 5.85.536 1.698 1.172 2.895 1.924 4.201l.349.602c.976 1.977 1.438 2.47 2.251 4.256 1.513 3.332 2.678 6.879 3.162 10.558.485 3.68.277 7.51-.89 11.086-1.165 3.576-5.025 18.825-5.025 18.825l-.006.002a6.8 6.8 0 0 1-1.67.133c-1.59-.046-3.156-.446-4.59-.812q-.485-.126-.949-.239h-.002a39 39 0 0 0-3.318-.656c-3.345-.483-7.271-.762-10.743-.052-3.47.71-2.248.497-3.71.892-1.46.396-3.07.831-4.718.868h-.004a6.8 6.8 0 0 1-1.625-.144l-.006-.001a4.2 4.2 0 0 1-1.651-.773l-.003-.003c-.772-.617-1.232-1.514-1.399-2.408-.166-.895.964-4.4 1.15-4.72s.38-.633.566-.932l.004-.008c.19-.305.37-.595.538-.886.118-.206.229-.407.341-.613-1.416-1.913-2.474-4.11-3.007-6.451-.763-3.361-.412-6.9.727-10.095.404-1.138.903-2.227 1.388-3.274l.087-.188c.46-.991.901-1.944 1.272-2.922.313-.828.572-1.664.84-2.533q.156-.504.321-1.024c.39-1.218.832-2.476 1.468-3.672.45-.848 1.067-1.641 1.617-2.349q.248-.318.47-.611c.667-.892 1.162-1.695 1.346-2.601.083-.683.044-1.106-.013-1.733-.058-.628-.103-.915-.26-3.601-.156-2.686-.234-5.497-.165-8.216"/><path fill="#020204" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/><path fill="#fdfdfb" d="M29.103 21.523c-.25.314-.41.69-.51 1.08-.097.387-.133.79-.15 1.192-.03.801.02 1.617-.194 2.39-.227.827-.735 1.545-1.231 2.241-.863 1.21-1.734 2.452-2.158 3.875a6.9 6.9 0 0 0-.252 2.668 28.5 28.5 0 0 0-2.491 4.487c-1.048 2.377-1.767 4.906-2.02 7.491-.31 3.165.095 6.42 1.346 9.344.901 2.116 2.25 4.05 3.988 5.558a13.6 13.6 0 0 0 2.912 1.933c3.636 1.789 8.13 1.792 11.704-.114 1.87-.995 3.448-2.451 4.967-3.924.916-.888 1.828-1.797 2.527-2.862 1.345-2.055 1.814-4.551 2.105-6.99.508-4.26.524-8.763-1.345-12.627a13.9 13.9 0 0 0-2.53-3.62 19.8 19.8 0 0 0-1.597-5.385c-.569-1.234-1.259-2.407-1.786-3.655-.216-.514-.405-1.04-.643-1.543-.242-.502-.536-.984-.94-1.37a3.8 3.8 0 0 0-1.465-.851c-.54-.18-1.112-.26-1.68-.289-1.14-.058-2.28.092-3.42.045-.907-.036-1.811-.194-2.718-.142a4.2 4.2 0 0 0-1.326.28 2.66 2.66 0 0 0-1.093.788"/><mask id="mask0_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter0_f_6709_29667)" mask="url(#mask0_6709_29667)" opacity=".25"><path fill="url(#paint0_radial_6709_29667)" d="M25.092 32.944c.242.364-.152 1.62 5.508.816 0 0-.995.108-1.974.335-1.523.51-2.849 1.08-3.875 1.834-1.012.748-1.756 1.722-2.685 2.557 0 0 1.506-2.751 1.88-3.58.378-.83-.06-.791.236-2.011.297-1.22 1.024-2.394 1.024-2.394s-.594 1.725-.114 2.443"/></g><mask id="mask1_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter1_f_6709_29667)" mask="url(#mask1_6709_29667)" opacity=".42"><path fill="url(#paint1_radial_6709_29667)" d="M43.289 32.614c-1.154.805-1.83.71-3.229.866-1.4.158-5.186.1-5.186.1s.546-.009 1.764.216c1.215.227 3.691.443 5.086.973 1.398.533 1.906.685 2.754 1.22 1.207.763 2.094 1.959 3.248 2.796 0 0 .056-1.11-.41-1.939s-1.72-2.135-2.089-3.355c-.366-1.22-.543-3.617-.543-3.617s-.244 1.939-1.395 2.74"/></g><mask id="mask2_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter2_f_6709_29667)" mask="url(#mask2_6709_29667)" opacity=".2"><path fill="url(#paint2_radial_6709_29667)" d="M32.443 30.9q-.067.522-.167 1.038a3 3 0 0 1-.133.5 1.1 1.1 0 0 1-.283.43c-.114.102-.25.171-.388.235a6 6 0 0 1-1.698.483q.349.025.702.063c.147.017.294.034.436.07.144.038.285.094.404.18.13.097.233.227.311.372.153.282.203.61.23.934.036.41.04.827.009 1.237a4 4 0 0 1 .172-.81 3.6 3.6 0 0 1 .746-1.29 2.46 2.46 0 0 1 2.174-.813 2.7 2.7 0 0 1-1.72-.534 2.2 2.2 0 0 1-.615-.694 1.94 1.94 0 0 1-.18-1.4"/></g><mask id="mask3_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter3_f_6709_29667)" mask="url(#mask3_6709_29667)" opacity=".11"><path fill="#000" d="M30.967 39.035a21 21 0 0 0-.602 3.414c-.153 1.628-.117 3.267-.205 4.9-.073 1.385-.236 2.786.005 4.153.114.651.319 1.287.61 1.88q.069-.34.1-.685c.103-1.11-.083-2.221-.147-3.33-.11-1.948.158-3.895.27-5.842a36 36 0 0 0-.031-4.49"/></g><mask id="mask4_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter4_f_6709_29667)" mask="url(#mask4_6709_29667)" opacity=".75"><path fill="#7c7c7c" d="M50.444 37.396c.286-.045 2.036 1.444 1.797 2-.238.551-.69.218-1.012.221-.322.006-1.2.405-1.348.153-.15-.253.389-.84.669-1.335.227-.396-.389-.995-.106-1.04"/></g><mask id="mask5_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter5_f_6709_29667)" mask="url(#mask5_6709_29667)"><path fill="#7c7c7c" d="M39.75 4.084c-.613.433-.346.973-.083 1.514.264.544-.58 2.105-.588 2.172-.008.066 1.659-.79 2.114-1.35.538-.658 1.894.892 1.819.657.003-.422-2.649-3.423-3.262-2.993"/></g><mask id="mask6_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter6_f_6709_29667)" mask="url(#mask6_6709_29667)"><path fill="#838384" d="M44.395 22.253c-.516.471.244 1.179.602 2.008.224.516.843 1.245 1.442 1.129.452-.09.73-.738.688-1.193-.084-.882-.827-1.09-1.368-1.392-.427-.239-1-.882-1.364-.552"/></g><path fill="#020204" d="M23.79 28.987c-1.69 1.92-3.43 3.78-4.384 5.858-.474 1.054-.696 2.199-1.02 3.308-.367 1.26-.866 2.48-1.426 3.667-.519 1.095-1.09 2.166-1.659 3.234-.416.779-.837 1.572-.981 2.443-.114.688-.05 1.398.127 2.072.175.674.455 1.317.774 1.936 1.353 2.648 3.386 4.928 5.794 6.675 1.092.79 2.26 1.476 3.489 2.039.665.302 1.364.574 2.096.585.366.008.735-.053 1.071-.2.333-.147.632-.382.832-.69.244-.377.327-.846.277-1.293s-.224-.873-.457-1.256c-.572-.937-1.473-1.617-2.341-2.288a79 79 0 0 1-5.422-4.598c-.488-.458-.98-.927-1.32-1.504-.333-.56-.513-1.198-.635-1.838-.336-1.756-.25-3.603.346-5.29.236-.66.544-1.289.843-1.921.516-1.096 1.004-2.214 1.684-3.218.846-1.25 1.977-2.31 2.665-3.652.583-1.134.818-2.407 1.043-3.661.177-.982.513-1.942.685-2.923-.336.638-1.417 1.683-2.08 2.515"/><mask id="mask7_6709_29667" width="15" height="35" x="14" y="26" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M23.79 28.988c-1.692 1.919-3.43 3.78-4.385 5.857-.474 1.054-.696 2.2-1.02 3.309-.367 1.259-.866 2.48-1.426 3.666-.519 1.096-1.09 2.166-1.658 3.234-.417.78-.838 1.573-.982 2.444-.114.687-.05 1.397.127 2.071.175.674.455 1.318.774 1.936 1.353 2.649 3.386 4.929 5.794 6.676 1.093.79 2.26 1.475 3.489 2.038.665.303 1.364.575 2.096.586.366.008.735-.053 1.071-.2a1.9 1.9 0 0 0 .832-.69c.244-.378.327-.847.277-1.293-.05-.447-.224-.874-.457-1.257-.572-.937-1.473-1.616-2.341-2.288a79 79 0 0 1-5.422-4.598c-.488-.458-.98-.926-1.32-1.503-.333-.56-.513-1.198-.635-1.839-.336-1.755-.25-3.603.346-5.289.236-.66.544-1.29.843-1.922.516-1.095 1.004-2.213 1.684-3.217.846-1.25 1.977-2.31 2.665-3.653.583-1.134.818-2.407 1.043-3.66.178-.982.513-1.942.685-2.924-.336.638-1.417 1.684-2.08 2.516"/></mask><g filter="url(#filter7_f_6709_29667)" mask="url(#mask7_6709_29667)" opacity=".95"><path fill="#7c7c7c" d="M21.844 35.974a7.9 7.9 0 0 0-1.423 1.75c-.638 1.065-1.012 2.263-1.478 3.414-.344.857-.747 1.72-.794 2.643-.025.474.045.948.061 1.423.017.474-.027.968-.26 1.38a1.68 1.68 0 0 1-.893.752c.507.17.957.497 1.275.924.267.36.439.78.669 1.16.188.31.419.598.704.823.283.227.624.388.982.433a1.73 1.73 0 0 0 1.378-.439 32.3 32.3 0 0 1 1.232-12.86c.08-.26.163-.524.186-.796.02-.275-.034-.563-.2-.78a.83.83 0 0 0-.768-.324.85.85 0 0 0-.402.158.86.86 0 0 0-.27.339"/></g><path fill="#020204" d="M51.188 36.256c1.453 1.17 2.376 2.937 2.662 4.782.222 1.436.078 2.915-.247 4.332-.324 1.42-.824 2.79-1.323 4.16-.197.544-.396 1.095-.474 1.67-.08.576-.03 1.184.247 1.694.319.585.912.987 1.55 1.176a3.7 3.7 0 0 0 1.947.025c.638-.158 1.711-.363 2.23-.768 1.317-1.024 1.63-2.801 1.944-4.36.325-1.628.167-3.334-.12-4.978-.39-2.244-1.047-4.435-1.882-6.551a22.8 22.8 0 0 0-2.341-4.427c-.92-1.356-2.224-2.413-3.19-3.738-.335-.46-.737-.938-1.065-1.404-.71-1.004-.549-.815-.99-1.467-.319-.471-.823-.632-1.353-.837-.532-.206-1.126-.267-1.675-.114-.721.202-1.312.774-1.625 1.453-.314.683-.37 1.465-.247 2.205.158.954.593 1.842 1.087 2.674.555.94 1.198 1.847 2.038 2.546.877.73 1.936 1.212 2.827 1.927"/><mask id="mask8_6709_29667" width="15" height="30" x="45" y="25" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M51.187 36.256c1.453 1.17 2.376 2.937 2.662 4.782.222 1.436.078 2.915-.247 4.332-.324 1.42-.823 2.79-1.323 4.16-.197.544-.396 1.095-.474 1.67-.08.576-.03 1.184.247 1.694.319.585.912.987 1.55 1.176a3.7 3.7 0 0 0 1.947.025c.638-.158 1.711-.363 2.23-.768 1.317-1.024 1.63-2.801 1.944-4.36.325-1.628.167-3.334-.119-4.978-.391-2.244-1.048-4.435-1.883-6.551a22.8 22.8 0 0 0-2.341-4.427c-.92-1.356-2.224-2.413-3.19-3.738-.335-.46-.737-.938-1.064-1.404-.71-1.004-.55-.815-.99-1.467-.32-.471-.824-.632-1.354-.837-.532-.206-1.126-.267-1.675-.114-.721.202-1.312.774-1.625 1.453-.314.683-.37 1.465-.247 2.205.158.954.593 1.842 1.087 2.674.555.94 1.198 1.847 2.038 2.546.877.73 1.936 1.212 2.827 1.927"/></mask><g filter="url(#filter8_f_6709_29667)" mask="url(#mask8_6709_29667)"><path fill="#838384" d="M47.765 34.002c.116.11.238.224.363.33.893.729 1.367 1.547 2.274 2.263 1.481 1.17 2.982 3.19 3.273 5.033.227 1.44-.072 2.222-.438 3.916-.367 1.698-1.404 4.1-1.967 5.736-.222.652.455.383.366 1.07-.044.339-.05.68-.008 1.018.006-.063.008-.133.017-.197.108-.937.393-1.838.707-2.723.602-1.7 1.292-3.37 1.77-5.117.476-1.745.424-3 .174-4.501-.313-1.889-1.412-3.63-2.965-4.782-1.1-.812-2.396-1.334-3.566-2.047"/></g><path fill="url(#paint3_linear_6709_29667)" d="M15.748 49.627a2.17 2.17 0 0 1 1.218-.114 3 3 0 0 1 1.134.483c.685.466 1.193 1.142 1.678 1.813 1.118 1.537 2.191 3.107 3.167 4.738.79 1.325 1.515 2.693 2.43 3.932.596.813 1.267 1.565 1.866 2.371.6.81 1.13 1.687 1.396 2.657a5.33 5.33 0 0 1-.389 3.814 5 5 0 0 1-1.858 1.994c-.788.474-1.617.685-2.538.685-1.461 0-2.89-.785-4.249-1.326-2.768-1.103-5.774-1.447-8.628-2.307-.876-.264-1.739-.577-2.62-.818-.394-.108-.791-.203-1.163-.372-.371-.166-.718-.419-.923-.768a1.8 1.8 0 0 1-.222-.904c0-.316.078-.627.186-.921.213-.59.56-1.126.793-1.711.38-.954.45-2.005.397-3.032-.05-1.023-.217-2.04-.286-3.064-.033-.458-.045-.921.044-1.373.086-.45.28-.89.61-1.207.305-.294.708-.468 1.124-.554.413-.086.84-.089 1.262-.08.421.008.845.033 1.267-.004.422-.033.846-.127 1.212-.338.35-.2.635-.496.87-.82.237-.325.428-.68.625-1.033.194-.349.396-.698.654-1.009.255-.31.572-.58.943-.732"/><mask id="mask9_6709_29667" width="23" height="23" x="6" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.748 49.627a2.17 2.17 0 0 1 1.218-.114 3 3 0 0 1 1.134.483c.685.466 1.193 1.142 1.678 1.813 1.118 1.537 2.191 3.107 3.167 4.738.79 1.325 1.515 2.693 2.43 3.932.596.813 1.267 1.565 1.866 2.371.6.81 1.13 1.687 1.396 2.657a5.33 5.33 0 0 1-.389 3.814 5 5 0 0 1-1.858 1.994c-.788.474-1.617.685-2.538.685-1.461 0-2.89-.785-4.249-1.326-2.768-1.103-5.774-1.447-8.628-2.307-.876-.264-1.739-.577-2.62-.818-.394-.108-.791-.203-1.163-.372-.371-.166-.718-.419-.923-.768a1.8 1.8 0 0 1-.222-.904c0-.316.078-.627.186-.921.213-.59.56-1.126.793-1.711.38-.954.45-2.005.397-3.032-.05-1.023-.217-2.04-.286-3.064-.033-.458-.045-.921.044-1.373.086-.45.28-.89.61-1.207.305-.294.708-.468 1.124-.554.413-.086.84-.089 1.262-.08.421.008.845.033 1.267-.004.422-.033.846-.127 1.212-.338.35-.2.635-.496.87-.82.237-.325.428-.68.625-1.033.194-.349.396-.698.654-1.009.255-.31.572-.58.943-.732"/></mask><g filter="url(#filter9_f_6709_29667)" mask="url(#mask9_6709_29667)"><path fill="#d99a03" d="M16.353 50.284c.347-.138.74-.155 1.104-.072.366.083.707.26 1.001.491.594.458 1.004 1.101 1.4 1.736a114 114 0 0 1 2.752 4.676c.666 1.196 1.298 2.413 2.113 3.509.541.726 1.16 1.395 1.712 2.113s1.043 1.5 1.287 2.374a4.67 4.67 0 0 1-.356 3.4 4.54 4.54 0 0 1-1.719 1.797 4.4 4.4 0 0 1-2.41.594c-1.337-.061-2.56-.73-3.82-1.181-2.415-.877-5.03-.996-7.51-1.678-.887-.242-1.752-.564-2.643-.788-.396-.1-.798-.183-1.173-.341-.374-.158-.727-.402-.932-.755a1.7 1.7 0 0 1-.202-.873c.01-.303.086-.602.194-.885.216-.566.555-1.076.771-1.642.33-.854.372-1.794.31-2.707-.06-.912-.221-1.82-.277-2.732-.022-.41-.027-.823.056-1.223.083-.402.258-.79.549-1.078.316-.314.749-.483 1.19-.552.438-.067.884-.036 1.325.002.444.04.888.09 1.332.064.443-.028.893-.136 1.259-.385.333-.225.582-.555.774-.907.19-.352.327-.733.474-1.104.144-.374.302-.746.53-1.079.227-.33.535-.621.91-.774"/></g><mask id="mask10_6709_29667" width="23" height="23" x="6" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.748 49.627a2.17 2.17 0 0 1 1.218-.114 3 3 0 0 1 1.134.483c.685.466 1.193 1.142 1.678 1.813 1.118 1.537 2.191 3.107 3.167 4.738.79 1.325 1.515 2.693 2.43 3.932.596.813 1.267 1.565 1.866 2.371.6.81 1.13 1.687 1.396 2.657a5.33 5.33 0 0 1-.389 3.814 5 5 0 0 1-1.858 1.994c-.788.474-1.617.685-2.538.685-1.461 0-2.89-.785-4.249-1.326-2.768-1.103-5.774-1.447-8.628-2.307-.876-.264-1.739-.577-2.62-.818-.394-.108-.791-.203-1.163-.372-.371-.166-.718-.419-.923-.768a1.8 1.8 0 0 1-.222-.904c0-.316.078-.627.186-.921.213-.59.56-1.126.793-1.711.38-.954.45-2.005.397-3.032-.05-1.023-.217-2.04-.286-3.064-.033-.458-.045-.921.044-1.373.086-.45.28-.89.61-1.207.305-.294.708-.468 1.124-.554.413-.086.84-.089 1.262-.08.421.008.845.033 1.267-.004.422-.033.846-.127 1.212-.338.35-.2.635-.496.87-.82.237-.325.428-.68.625-1.033.194-.349.396-.698.654-1.009.255-.31.572-.58.943-.732"/></mask><g filter="url(#filter10_f_6709_29667)" mask="url(#mask10_6709_29667)"><path fill="#f5bd0c" d="M16.028 49.416c.339-.167.735-.2 1.104-.125s.713.255 1.004.49c.58.472.951 1.146 1.295 1.806.788 1.514 1.526 3.062 2.469 4.49.688 1.035 1.478 1.997 2.171 3.029.94 1.395 1.706 2.932 2.022 4.576.21 1.11.205 2.305-.327 3.3a3.67 3.67 0 0 1-1.595 1.531 4.1 4.1 0 0 1-2.196.408c-1.185-.102-2.258-.685-3.373-1.093-1.977-.718-4.116-.893-6.151-1.436-.857-.228-1.7-.524-2.569-.705-.385-.08-.776-.138-1.142-.277s-.713-.369-.902-.707a1.43 1.43 0 0 1-.155-.788c.02-.269.1-.532.205-.785.214-.499.527-.96.69-1.475.245-.763.145-1.587-.038-2.366-.18-.776-.444-1.54-.524-2.332a3.2 3.2 0 0 1 .047-1.06c.08-.346.244-.68.502-.926.333-.32.799-.48 1.265-.524.463-.045.929.016 1.39.083.46.066.925.139 1.389.116.466-.02.94-.141 1.303-.427.36-.283.588-.701.718-1.134.13-.435.172-.888.225-1.337.053-.45.12-.904.294-1.323.175-.419.469-.804.88-1.01"/></g><mask id="mask11_6709_29667" width="23" height="23" x="6" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.748 49.627a2.17 2.17 0 0 1 1.218-.114 3 3 0 0 1 1.134.483c.685.466 1.193 1.142 1.678 1.813 1.118 1.537 2.191 3.107 3.167 4.738.79 1.325 1.515 2.693 2.43 3.932.596.813 1.267 1.565 1.866 2.371.6.81 1.13 1.687 1.396 2.657a5.33 5.33 0 0 1-.389 3.814 5 5 0 0 1-1.858 1.994c-.788.474-1.617.685-2.538.685-1.461 0-2.89-.785-4.249-1.326-2.768-1.103-5.774-1.447-8.628-2.307-.876-.264-1.739-.577-2.62-.818-.394-.108-.791-.203-1.163-.372-.371-.166-.718-.419-.923-.768a1.8 1.8 0 0 1-.222-.904c0-.316.078-.627.186-.921.213-.59.56-1.126.793-1.711.38-.954.45-2.005.397-3.032-.05-1.023-.217-2.04-.286-3.064-.033-.458-.045-.921.044-1.373.086-.45.28-.89.61-1.207.305-.294.708-.468 1.124-.554.413-.086.84-.089 1.262-.08.421.008.845.033 1.267-.004.422-.033.846-.127 1.212-.338.35-.2.635-.496.87-.82.237-.325.428-.68.625-1.033.194-.349.396-.698.654-1.009.255-.31.572-.58.943-.732"/></mask><g filter="url(#filter11_f_6709_29667)" mask="url(#mask11_6709_29667)"><path fill="url(#paint4_linear_6709_29667)" d="M20.247 53.199c.624 1.126 1.004 2.418 1.622 3.555a88 88 0 0 0 1.792 3.084c.258.43.857 1.09 1.462 2.114.549.926 1.104 2.221 1.414 2.657-.177-.51-.543-1.878-.982-2.851-.407-.91-.884-1.429-1.175-1.92-.577-.962-1.201-1.83-1.795-2.748-.818-1.268-1.442-2.685-2.338-3.891"/></g><mask id="mask12_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter12_f_6709_29667)" mask="url(#mask12_6709_29667)" opacity=".2"><path fill="url(#paint5_linear_6709_29667)" d="M61.155 60.798a4 4 0 0 1-.502 1.054c-.486.718-1.193 1.262-1.897 1.761-1.201.852-2.455 1.634-3.575 2.602a18 18 0 0 0-2.066 2.143c-.541.655-1.051 1.343-1.67 1.925-.624.588-1.356 1.065-2.147 1.323-.962.314-1.977.3-2.903.061-.65-.166-1.285-.455-1.687-.979s-.532-1.231-.58-1.925c-.083-1.226.065-2.476.198-3.722.11-1.034.213-2.069.255-3.1.075-1.878-.05-3.736-.303-5.561-.044-.308-.088-.616-.063-.93s.13-.643.352-.887c.205-.224.49-.358.774-.421.283-.067.571-.07.857-.078.674-.017 1.348-.058 2.01.003.42.036.83.114 1.246.152.696.067 1.42.034 2.119-.172.751-.221 1.467-.635 2.232-.748a3.2 3.2 0 0 1 .932.002c.31.042.621.128.86.32.183.144.316.34.419.551.155.316.25.663.305 1.02.047.317.066.642.147.947.133.502.438.929.801 1.275.366.347.79.622 1.218.893.424.27.851.536 1.303.758.214.105.433.2.636.319.205.122.393.269.53.463.182.263.254.61.199.951"/></g><path fill="url(#paint6_linear_6709_29667)" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/><mask id="mask13_6709_29667" width="21" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/></mask><g filter="url(#filter13_f_6709_29667)" mask="url(#mask13_6709_29667)"><path fill="#cd8907" d="M65.18 60.94a3.6 3.6 0 0 1-.616 1.018c-.574.67-1.367 1.112-2.157 1.508-1.354.677-2.752 1.27-4.022 2.086a16.5 16.5 0 0 0-2.371 1.88c-.627.591-1.223 1.224-1.928 1.723-.712.507-1.533.87-2.399.998-1.054.155-2.14-.044-3.12-.463-.682-.294-1.342-.71-1.739-1.34-.394-.626-.485-1.392-.485-2.132-.006-1.307.241-2.6.474-3.883.194-1.068.377-2.139.494-3.217.21-1.964.202-3.944.07-5.913-.023-.33-.048-.663.002-.99.05-.328.186-.652.435-.869.236-.202.552-.29.863-.305.308-.016.616.034.923.078.724.105 1.45.186 2.158.369.447.116.882.272 1.326.388.743.2 1.523.294 2.285.205.824-.094 1.623-.399 2.45-.38a3.7 3.7 0 0 1 1 .172c.33.103.658.25.902.494.183.186.308.419.41.66.147.358.247.74.253 1.129.008.405-.078.81-.025 1.212.044.324.183.632.36.91.175.277.388.53.602.779.41.485.82.979 1.337 1.35.585.425 1.281.675 1.886 1.068.18.12.355.253.482.428.217.294.272.693.15 1.037"/></g><mask id="mask14_6709_29667" width="21" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/></mask><g filter="url(#filter14_f_6709_29667)" mask="url(#mask14_6709_29667)"><path fill="#f5c021" d="M65.096 60.52c-.166.375-.38.722-.632 1.03-.588.715-1.384 1.206-2.219 1.522-1.378.522-2.881.591-4.232 1.185-.824.36-1.567.904-2.319 1.42-.604.413-1.226.815-1.891 1.103-.755.33-1.553.513-2.357.644-.51.08-1.03.141-1.545.114-.516-.028-1.032-.15-1.49-.414-.344-.2-.654-.485-.84-.86-.203-.413-.239-.898-.236-1.37.014-1.248.283-2.485.275-3.735-.008-1.09-.225-2.164-.286-3.25-.12-2.092.33-4.216-.066-6.266-.062-.33-.147-.657-.145-.993.003-.166.028-.335.086-.49a.96.96 0 0 1 .28-.395.9.9 0 0 1 .364-.155c.127-.022.26-.017.39.003.259.041.506.141.758.216.721.216 1.484.211 2.219.375.46.1.904.269 1.361.39.763.211 1.562.3 2.347.209.843-.1 1.667-.405 2.515-.383.35.008.694.072 1.03.172.335.1.67.241.926.5a2.2 2.2 0 0 1 .418.665c.158.358.267.746.264 1.14-.003.205-.033.407-.053.613-.017.205-.022.413.025.61.05.2.153.38.27.543.116.164.249.31.37.472.34.446.583.968.847 1.47.263.502.56.998.979 1.361.568.491 1.303.688 1.938 1.08a1.6 1.6 0 0 1 .494.43c.105.143.175.318.203.501.024.18.008.372-.048.544"/></g><mask id="mask15_6709_29667" width="21" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/></mask><g filter="url(#filter15_f_6709_29667)" mask="url(#mask15_6709_29667)"><path fill="url(#paint7_linear_6709_29667)" d="M47.117 51.36c.782-.21 1.448.383 2.016.83.366.313.899.235 1.348.249.746-.025 1.487.125 2.233.033 1.47-.125 2.909-.485 4.385-.546.704-.045 1.497-.086 2.105.324.246.172.61.896.851.624-.1-.76-.663-1.495-1.417-1.697-.594-.094-1.193.07-1.792.017-1.772-.042-3.536-.372-5.314-.278-1.237.011-2.47-.047-3.708-.094-.485-.1-.657.33-.92.496.069.053.094.07.213.042"/></g><mask id="mask16_6709_29667" width="21" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/></mask><g filter="url(#filter16_f_6709_29667)" mask="url(#mask16_6709_29667)" opacity=".35"><path fill="url(#paint8_radial_6709_29667)" d="M57.492 53.033a1.26 1.26 0 0 0-.652-.575 2.2 2.2 0 0 0-.868-.15c-.59.006-1.179.159-1.77.109-.496-.045-.967-.23-1.453-.35-.502-.122-1.034-.169-1.53-.033a2.25 2.25 0 0 0-1.296.968c-.26.41-.383.896-.421 1.381-.04.485.002.97.052 1.456a7 7 0 0 0 .158 1.04c.086.341.217.674.422.96.297.41.738.704 1.212.879a3.37 3.37 0 0 0 2.421-.042 6.68 6.68 0 0 0 3.195-2.94c.252-.465.447-.962.571-1.472.05-.205.09-.413.09-.624a1.3 1.3 0 0 0-.131-.608"/></g><mask id="mask17_6709_29667" width="21" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.252 62.826c-.627.743-1.498 1.234-2.366 1.678-1.478.751-3.012 1.414-4.401 2.32a18 18 0 0 0-2.596 2.09c-.688.657-1.34 1.358-2.11 1.916-.78.563-1.679.97-2.63 1.112a5.4 5.4 0 0 1-.793.058c-.899 0-1.797-.216-2.624-.577-.749-.324-1.47-.793-1.903-1.486-.432-.7-.532-1.55-.532-2.374-.003-1.45.266-2.888.519-4.319.21-1.19.41-2.38.54-3.58.236-2.18.233-4.385.078-6.576-.028-.366-.058-.735-.003-1.098.056-.364.206-.727.483-.965.258-.222.602-.322.943-.339.338-.02.676.033 1.012.084.79.116 1.59.205 2.363.41.488.127.965.3 1.45.433.816.219 1.667.324 2.502.227.902-.105 1.778-.444 2.685-.422a3.9 3.9 0 0 1 1.095.192c.36.114.719.277.985.549.202.205.344.463.45.732.157.4.243.827.28 1.254.03.38.024.765.096 1.14.12.613.444 1.176.844 1.655.402.483.882.89 1.361 1.293.48.402.96.801 1.476 1.154.241.166.49.321.72.502.231.183.442.393.586.648a1.5 1.5 0 0 1 .128 1.168 3.4 3.4 0 0 1-.638 1.12"/></mask><g filter="url(#filter17_f_6709_29667)" mask="url(#mask17_6709_29667)" opacity=".35"><path fill="url(#paint9_radial_6709_29667)" d="M57.492 52.278c-.133-.192-.377-.333-.652-.416a3 3 0 0 0-.868-.108c-.59.005-1.179.116-1.77.077-.496-.03-.967-.166-1.453-.25-.502-.088-1.034-.124-1.53-.024-.533.102-1.002.36-1.296.698-.26.297-.383.65-.421.999-.04.35.002.702.052 1.051.034.252.075.508.158.755.086.246.217.488.422.693.297.297.738.507 1.212.635a4.57 4.57 0 0 0 2.421-.03c1.354-.425 2.499-1.188 3.195-2.125.252-.338.447-.696.571-1.065.05-.15.09-.3.09-.45a.7.7 0 0 0-.131-.44"/></g><path fill="#020204" d="M58.618 50.567a1.76 1.76 0 0 0-.477-.685 2.6 2.6 0 0 0-.713-.444c-.516-.219-1.079-.302-1.633-.405-.52-.097-1.038-.216-1.56-.305-.543-.091-1.103-.152-1.641-.03-.469.105-.904.35-1.26.674-.354.324-.632.73-.831 1.167-.352.774-.463 1.642-.397 2.488.05.63.211 1.279.624 1.753.336.385.81.627 1.298.77.843.25 1.761.237 2.596-.035a6.85 6.85 0 0 0 3.425-2.577c.272-.396.505-.826.61-1.292.08-.355.084-.738-.041-1.079"/><mask id="mask18_6709_29667" width="9" height="8" x="50" y="48" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M58.618 50.567a1.76 1.76 0 0 0-.477-.685 2.6 2.6 0 0 0-.713-.444c-.516-.219-1.079-.302-1.633-.405-.52-.097-1.038-.216-1.56-.305-.543-.091-1.103-.152-1.641-.03-.469.105-.904.35-1.26.674-.354.324-.632.73-.831 1.167-.352.774-.463 1.642-.397 2.488.05.63.211 1.279.624 1.753.336.385.81.627 1.298.77.843.25 1.761.237 2.596-.035a6.85 6.85 0 0 0 3.425-2.577c.272-.396.505-.826.61-1.292.08-.355.084-.738-.041-1.079"/></mask><g filter="url(#filter18_f_6709_29667)" mask="url(#mask18_6709_29667)"><path fill="url(#paint10_radial_6709_29667)" d="M52.888 48.446a2.98 2.98 0 0 0-2.405 1.442 3 3 0 0 0-.397 1.711c.02-.416.128-.824.33-1.187a2.44 2.44 0 0 1 1.659-1.212c.427-.078.868-.03 1.298.022.416.053.832.108 1.24.194.632.139 1.256.35 1.786.719.122.086.238.183.335.3a.9.9 0 0 1 .203.393.95.95 0 0 1-.128.635c-.108.194-.255.36-.41.516a8 8 0 0 1-.397.366c.613-.12 1.232-.286 1.742-.64.213-.153.41-.334.538-.56.128-.231.18-.508.12-.764a1.15 1.15 0 0 0-.256-.463 2.3 2.3 0 0 0-.402-.344 4.8 4.8 0 0 0-2.166-.829 25 25 0 0 0-1.503-.23c-.391-.05-.794-.092-1.187-.07"/></g><mask id="mask19_6709_29667" width="9" height="8" x="50" y="48" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M58.618 50.567a1.76 1.76 0 0 0-.477-.685 2.6 2.6 0 0 0-.713-.444c-.516-.219-1.079-.302-1.633-.405-.52-.097-1.038-.216-1.56-.305-.543-.091-1.103-.152-1.641-.03-.469.105-.904.35-1.26.674-.354.324-.632.73-.831 1.167-.352.774-.463 1.642-.397 2.488.05.63.211 1.279.624 1.753.336.385.81.627 1.298.77.843.25 1.761.237 2.596-.035a6.85 6.85 0 0 0 3.425-2.577c.272-.396.505-.826.61-1.292.08-.355.084-.738-.041-1.079"/></mask><g filter="url(#filter19_f_6709_29667)" mask="url(#mask19_6709_29667)"><path fill="url(#paint11_linear_6709_29667)" d="M52.888 48.446a2.98 2.98 0 0 0-2.405 1.442 3 3 0 0 0-.397 1.711c.02-.416.128-.824.33-1.187a2.44 2.44 0 0 1 1.659-1.212c.427-.078.868-.03 1.298.022.416.053.832.108 1.24.194.632.139 1.256.35 1.786.719.122.086.238.183.335.3a.9.9 0 0 1 .203.393.95.95 0 0 1-.128.635c-.108.194-.255.36-.41.516a8 8 0 0 1-.397.366c.613-.12 1.232-.286 1.742-.64.213-.153.41-.334.538-.56.128-.231.18-.508.12-.764a1.15 1.15 0 0 0-.256-.463 2.3 2.3 0 0 0-.402-.344 4.8 4.8 0 0 0-2.166-.829 25 25 0 0 0-1.503-.23c-.391-.05-.794-.092-1.187-.07"/></g><path fill="url(#paint12_radial_6709_29667)" d="M29.469 11.617a1.84 1.84 0 0 0-1.143.51 2.6 2.6 0 0 0-.669 1.076c-.269.81-.207 1.687-.146 2.538.055.768.113 1.553.402 2.269.144.36.346.696.615.973.27.275.61.488.985.58.35.089.726.072 1.07-.036.347-.111.66-.308.921-.56.377-.37.63-.852.777-1.36.147-.507.188-1.04.18-1.57a6.6 6.6 0 0 0-.302-1.949c-.208-.627-.538-1.22-.999-1.694a2.8 2.8 0 0 0-.762-.572 1.9 1.9 0 0 0-.93-.205"/><path fill="#020204" d="M28.443 15.142c-.089.538-.092 1.1.091 1.611.122.339.325.646.569.91.158.172.34.327.552.43s.457.144.688.088a1 1 0 0 0 .53-.357 1.7 1.7 0 0 0 .29-.58c.192-.613.161-1.281-.03-1.894-.136-.447-.366-.876-.721-1.176a1.4 1.4 0 0 0-.588-.308 1.02 1.02 0 0 0-.655.053 1.13 1.13 0 0 0-.513.516 2.4 2.4 0 0 0-.213.707"/><mask id="mask20_6709_29667" width="4" height="6" x="28" y="13" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M28.443 15.142c-.089.538-.092 1.1.091 1.611.122.339.325.646.569.91.158.172.34.327.552.43s.457.144.688.088a1 1 0 0 0 .53-.357 1.7 1.7 0 0 0 .29-.58c.192-.613.161-1.281-.03-1.894-.136-.447-.366-.876-.721-1.176a1.4 1.4 0 0 0-.588-.308 1.02 1.02 0 0 0-.655.053 1.13 1.13 0 0 0-.513.516 2.4 2.4 0 0 0-.213.707"/></mask><g filter="url(#filter20_f_6709_29667)" mask="url(#mask20_6709_29667)"><path fill="url(#paint13_linear_6709_29667)" d="M29.577 14.753c.058.153.252.208.36.33.103.117.21.242.27.389.107.28-.109.696.118.895.07.061.214.064.283 0 .275-.25.214-.751.106-1.106a1.35 1.35 0 0 0-.641-.777c-.139-.072-.347-.13-.466-.03-.075.066-.066.205-.03.3"/></g><mask id="mask21_6709_29667" width="6" height="9" x="27" y="11" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M29.469 11.617a1.84 1.84 0 0 0-1.143.51 2.6 2.6 0 0 0-.669 1.076c-.269.81-.207 1.687-.146 2.538.055.768.113 1.553.402 2.269.144.36.346.696.615.973.27.275.61.488.985.58.35.089.726.072 1.07-.036.347-.111.66-.308.921-.56.377-.37.63-.852.777-1.36.147-.507.188-1.04.18-1.57a6.6 6.6 0 0 0-.302-1.949c-.208-.627-.538-1.22-.999-1.694a2.8 2.8 0 0 0-.762-.572 1.9 1.9 0 0 0-.93-.205"/></mask><g mask="url(#mask21_6709_29667)"><path fill="url(#paint14_radial_6709_29667)" d="M28.55 13.33c.643-.382 1.423-.47 2.169-.401.743.072 1.461.288 2.182.485.53.144 1.065.277 1.562.51.493.233.954.577 1.228 1.054.045.075.08.156.128.23a.7.7 0 0 0 .172.197c.07.053.158.09.244.084a.3.3 0 0 0 .125-.036.23.23 0 0 0 .091-.095.3.3 0 0 0 .028-.147.7.7 0 0 0-.028-.15c-.18-.657-.607-1.214-.929-1.816-.194-.36-.355-.738-.549-1.098-.674-1.235-1.78-2.202-3.037-2.832s-2.66-.932-4.063-1.012c-1.625-.097-3.253.097-4.856.38-.696.122-1.404.266-2.017.613-.307.171-.59.393-.81.67a2 2 0 0 0-.43.955c-.046.338.003.685.123 1.004.116.319.3.61.516.873.427.53.979.94 1.486 1.395.508.453.976.955 1.545 1.329.283.188.59.344.918.435.327.092.677.117 1.01.047.343-.069.665-.238.945-.454.28-.214.522-.472.752-.738.46-.535.89-1.12 1.495-1.481"/></g><g filter="url(#filter21_f_6709_29667)"><path fill="url(#paint15_linear_6709_29667)" d="M31.222 11.143a5.7 5.7 0 0 1 1.345 1.985c-.133-.807-.341-1.459-.868-1.985a4 4 0 0 0-1.104-.755c-.366-.163-.768-.266-1.001-.269-.23-.005-.286 0-.333.003-.05.003-.086.003.064.022.15.017.485.108.846.27.36.16.727.426 1.051.729"/></g><path fill="url(#paint16_radial_6709_29667)" d="M37.001 11.617c-.662.458-1.22 1.093-1.492 1.853-.344.957-.213 2.027.12 2.987.338.984.906 1.922 1.763 2.512.427.297.924.5 1.44.56a2.65 2.65 0 0 0 1.517-.263c.56-.294.99-.807 1.256-1.38.267-.578.38-1.213.416-1.848.045-.804-.033-1.625-.3-2.388-.288-.83-.81-1.595-1.547-2.072a3 3 0 0 0-1.22-.463 2.6 2.6 0 0 0-1.295.144c-.233.092-.45.217-.658.358"/><path fill="#020204" d="M38.535 13.625c-.25.016-.494.102-.708.236-.21.133-.39.313-.532.52-.286.414-.41.919-.43 1.42a3 3 0 0 0 .152 1.11c.125.355.333.685.624.924.297.247.672.394 1.057.413a1.8 1.8 0 0 0 1.09-.313 1.95 1.95 0 0 0 .6-.688c.143-.27.232-.569.27-.874a2.7 2.7 0 0 0-.257-1.578 2.2 2.2 0 0 0-1.176-1.065 1.7 1.7 0 0 0-.69-.105"/><mask id="mask22_6709_29667" width="5" height="6" x="36" y="13" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M38.534 13.625c-.25.016-.494.102-.708.236-.21.133-.39.313-.532.52-.286.414-.41.919-.43 1.42a3 3 0 0 0 .152 1.11c.125.355.333.685.624.924.297.247.672.394 1.057.413a1.8 1.8 0 0 0 1.09-.313 1.95 1.95 0 0 0 .6-.688c.143-.27.232-.569.27-.874a2.7 2.7 0 0 0-.257-1.578 2.2 2.2 0 0 0-1.176-1.065 1.7 1.7 0 0 0-.69-.105"/></mask><g filter="url(#filter22_f_6709_29667)" mask="url(#mask22_6709_29667)"><path fill="url(#paint17_linear_6709_29667)" d="M40.079 15.8c.277-.278-.197-1.013-.569-1.316-.269-.216-1.048-.446-1.015-.208.034.236.386.541.619.774.29.286.832.882.965.75"/></g><mask id="mask23_6709_29667" width="8" height="9" x="35" y="11" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M37.001 11.617c-.662.458-1.22 1.093-1.492 1.853-.344.957-.213 2.027.12 2.987.338.984.906 1.922 1.763 2.512.427.297.924.5 1.44.56a2.65 2.65 0 0 0 1.517-.263c.56-.294.99-.807 1.256-1.38.267-.578.38-1.213.416-1.848.045-.804-.033-1.625-.3-2.388-.288-.83-.81-1.595-1.547-2.072a3 3 0 0 0-1.22-.463 2.6 2.6 0 0 0-1.295.144c-.233.092-.45.217-.658.358"/></mask><g mask="url(#mask23_6709_29667)"><path fill="url(#paint18_linear_6709_29667)" d="M34.491 14.038a5.7 5.7 0 0 1 1.942-1.054c1.456-.449 3.106-.271 4.393.547.444.28.84.63 1.254.957.41.324.848.63 1.345.804.269.094.554.15.837.12a1.54 1.54 0 0 0 .713-.267 1.9 1.9 0 0 0 .521-.56c.267-.439.353-.971.305-1.481-.091-1.024-.668-1.925-1.15-2.832-.153-.283-.297-.571-.48-.835-.558-.812-1.45-1.348-2.385-1.661-.935-.314-1.922-.427-2.901-.55-.439-.055-.88-.113-1.315-.06-.502.06-.974.263-1.464.388-.233.061-.47.103-.7.17-.23.066-.457.157-.646.307-.271.22-.443.55-.518.89-.075.344-.058.7-.003 1.046.108.693.369 1.367.344 2.069-.017.48-.17.954-.15 1.434.006.141.034.43.058.568"/></g><g filter="url(#filter23_f_6709_29667)"><path fill="url(#paint19_linear_6709_29667)" d="M39.31 9.648c-.114.144-.217.3-.297.471a4.2 4.2 0 0 1 1.44.613c.848.563 1.491 1.384 1.943 2.3q.159-.174.283-.38c-.455-.954-1.11-1.817-1.986-2.4a4.3 4.3 0 0 0-1.383-.604"/></g><mask id="mask24_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter24_f_6709_29667)" mask="url(#mask24_6709_29667)"><path fill="#000" fill-opacity=".259" d="M28.545 25.775c.407 1.181 1.226 2.188 2.196 2.973a4.7 4.7 0 0 0 1.043.674c.377.172.796.269 1.21.233.404-.033.79-.194 1.145-.394s.682-.44 1.026-.657c.588-.375 1.218-.677 1.83-1.01.735-.402 1.45-.86 2.07-1.425.285-.258.549-.541.862-.763.313-.225.69-.386 1.073-.358.289.02.558.142.84.203.142.03.286.044.43.022a.66.66 0 0 0 .38-.186.66.66 0 0 0 .17-.488 1.16 1.16 0 0 0-.15-.502c-.164-.313-.413-.582-.524-.918-.1-.3-.08-.621-.072-.935.008-.316.002-.643-.142-.923a1.2 1.2 0 0 0-.507-.491 1.8 1.8 0 0 0-.688-.194c-.477-.045-.954.05-1.434.075-.632.036-1.27-.042-1.905-.006-.79.05-1.567.277-2.36.28-.905.003-1.809-.294-2.702-.152-.385.06-.751.2-1.118.321-.369.125-.748.233-1.137.228-.44-.009-.868-.161-1.309-.192a1.5 1.5 0 0 0-.652.078.9.9 0 0 0-.493.416.9.9 0 0 0-.092.363q-.006.191.042.378c.06.244.175.474.266.707.333.851.405 1.78.702 2.643"/></g><mask id="mask25_6709_29667" width="40" height="70" x="16" y="1" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.71 1c-1.665 0-3.334.327-4.843 1.143a8.9 8.9 0 0 0-3.725 3.874c-.81 1.63-1.126 3.373-1.176 5.292-.091 3.644.083 7.466.358 10.93.072 1.054.205 1.67.07 2.754-.45 2.302-2.463 3.85-3.54 5.871-1.184 2.23-1.683 4.751-2.576 7.114-.818 2.16-1.966 4.188-2.74 6.365-1.085 3.043-1.41 6.387-.694 9.538.547 2.402 1.687 4.654 3.223 6.581-.222.4-.438.808-.666 1.204-.712 1.229-1.583 2.396-1.988 3.758-.203.68-.283 1.406-.153 2.105s.486 1.368 1.04 1.811a3.2 3.2 0 0 0 1.257.583c.452.102.92.127 1.387.119 1.766-.039 3.48-.574 5.189-1.023a62 62 0 0 1 3.059-.716c3.644-.746 7.71-.447 11.09.042q1.72.261 3.41.674c1.763.427 3.519.97 5.333 1.023a6 6 0 0 0 1.425-.111c.466-.105.918-.294 1.29-.59.557-.444.912-1.116 1.043-1.815s.05-1.428-.156-2.11c-.41-1.365-1.29-2.527-2.016-3.75-.288-.485-.555-.979-.84-1.464 2.19-2.46 3.955-5.306 4.975-8.431 1.112-3.412 1.318-7.087.849-10.645s-1.598-7.008-3.081-10.275c-1.864-4.094-3.431-5.575-4.568-9.172-1.226-3.889-.214-8.49-1.126-12.015a12.3 12.3 0 0 0-1.512-3.392c-.782-1.228-1.775-2.327-2.953-3.18C40.475 1.726 38.11 1 35.709 1"/></mask><g filter="url(#filter25_f_6709_29667)" mask="url(#mask25_6709_29667)" opacity=".3"><path fill="#000" d="M27.411 22.41c.79.489 1.5 1.09 2.097 1.773.552.635 1.02 1.356 1.744 1.825.508.333 1.12.518 1.742.577.73.066 1.467-.042 2.172-.233a8 8 0 0 0 1.858-.752c1.1-.624 2.019-1.54 3.23-1.95.264-.091.539-.155.794-.266.255-.108.496-.274.618-.507.117-.228.111-.486.15-.733.042-.266.133-.521.183-.784.05-.264.056-.544-.066-.785a1.1 1.1 0 0 0-.502-.46 1.9 1.9 0 0 0-.696-.156c-.477-.022-.952.091-1.431.13-.633.053-1.27-.022-1.906-.002-.79.022-1.57.185-2.36.221-.901.04-1.8-.094-2.701-.122a6 6 0 0 0-1.168.056c-.386.06-.763.18-1.087.38-.316.191-.574.455-.863.68a2.6 2.6 0 0 1-.466.296 1.5 1.5 0 0 1-.543.141c-.097.003-.197-.002-.291.011a.63.63 0 0 0-.408.23.54.54 0 0 0-.1.43"/></g><path fill="url(#paint20_radial_6709_29667)" d="M31.469 17.233c.424-.474.712-1.054 1.117-1.542.203-.244.438-.469.713-.627s.596-.247.912-.22c.353.031.683.206.94.447.258.242.45.547.602.866.147.308.264.632.475.898.224.283.538.475.823.7.142.11.28.23.391.37.114.142.2.306.239.483.036.18.017.37-.044.541-.064.172-.17.328-.303.455-.263.255-.624.394-.987.444-.727.103-1.462-.114-2.197-.095-.74.023-1.467.283-2.21.259-.369-.014-.746-.106-1.051-.317a1.4 1.4 0 0 1-.383-.402 1.14 1.14 0 0 1-.16-.527 1.2 1.2 0 0 1 .107-.516c.07-.163.17-.31.28-.449.225-.274.5-.502.735-.768"/><path fill="url(#paint21_radial_6709_29667)" d="M27.442 21.815a.8.8 0 0 0 .078.203.9.9 0 0 0 .258.263c.1.075.208.136.313.2.558.352 1.013.843 1.418 1.364.54.7 1.02 1.473 1.744 1.98.51.361 1.12.564 1.742.627.73.072 1.467-.044 2.171-.252a7.6 7.6 0 0 0 1.859-.818c1.1-.677 2.019-1.67 3.23-2.116.264-.097.539-.167.794-.286.255-.122.496-.3.618-.555.117-.244.111-.527.15-.796.042-.285.133-.563.183-.848s.056-.591-.066-.855a1.1 1.1 0 0 0-.502-.496 1.7 1.7 0 0 0-.697-.172c-.477-.022-.95.1-1.43.144-.633.058-1.27-.025-1.906-.005-.79.025-1.57.202-2.36.241-.901.042-1.8-.097-2.702-.133a5.5 5.5 0 0 0-1.17.055 2.7 2.7 0 0 0-1.084.42c-.314.215-.563.51-.852.76-.144.124-.3.238-.471.32-.17.084-.358.137-.55.131-.096-.003-.2-.017-.29.011a.4.4 0 0 0-.156.097 1 1 0 0 0-.114.145q-.12.174-.208.371"/><mask id="mask26_6709_29667" width="16" height="8" x="27" y="19" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.443 21.816a.8.8 0 0 0 .078.202.9.9 0 0 0 .258.264c.1.075.208.136.313.2.558.352 1.013.842 1.418 1.364.54.699 1.02 1.473 1.744 1.98.51.36 1.12.563 1.742.627.73.072 1.467-.044 2.171-.253a7.6 7.6 0 0 0 1.859-.818c1.1-.676 2.019-1.67 3.23-2.116.264-.097.539-.166.794-.285.255-.123.496-.3.618-.555.117-.244.111-.527.15-.796.042-.286.133-.563.183-.849.05-.285.056-.59-.066-.854a1.1 1.1 0 0 0-.502-.497 1.7 1.7 0 0 0-.697-.171c-.477-.023-.95.1-1.43.144-.633.058-1.27-.025-1.906-.006-.79.025-1.57.203-2.36.242-.902.041-1.8-.098-2.701-.134a5.5 5.5 0 0 0-1.17.056 2.7 2.7 0 0 0-1.085.419c-.314.216-.563.51-.852.76a2.2 2.2 0 0 1-.471.321c-.17.084-.358.136-.55.13-.096-.002-.2-.016-.29.012a.4.4 0 0 0-.156.097 1 1 0 0 0-.114.144q-.12.175-.208.372"/></mask><g filter="url(#filter26_f_6709_29667)" mask="url(#mask26_6709_29667)"><path fill="#d9b30d" d="M30.982 22.789a1.59 1.59 0 0 0 1.04 1.875c.471.157 1.004.08 1.445-.15a1.55 1.55 0 0 0 .637-.572c.075-.122.128-.26.147-.405a.9.9 0 0 0-.044-.427.96.96 0 0 0-.275-.38 1.2 1.2 0 0 0-.416-.227 4.3 4.3 0 0 0-1.084-.189c-.56-.01-1.359.095-1.45.474"/></g><mask id="mask27_6709_29667" width="16" height="8" x="27" y="19" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.441 21.815a.7.7 0 0 0 .078.203.9.9 0 0 0 .258.263c.1.075.208.136.313.2.558.352 1.013.843 1.418 1.364.54.7 1.02 1.473 1.744 1.98.51.361 1.12.564 1.742.627.73.072 1.467-.044 2.171-.252a7.6 7.6 0 0 0 1.859-.818c1.1-.677 2.019-1.67 3.23-2.116.264-.097.539-.167.794-.286.255-.122.496-.3.618-.555.117-.244.111-.527.15-.796.042-.285.133-.563.183-.848s.056-.591-.066-.855a1.1 1.1 0 0 0-.502-.496 1.7 1.7 0 0 0-.697-.172c-.477-.022-.95.1-1.43.144-.633.058-1.27-.025-1.906-.005-.79.025-1.57.202-2.36.241-.901.042-1.8-.097-2.701-.133a5.5 5.5 0 0 0-1.17.055 2.7 2.7 0 0 0-1.085.42c-.314.215-.563.51-.852.76-.144.124-.3.238-.471.32-.17.084-.358.137-.55.131-.096-.003-.199-.017-.29.011a.4.4 0 0 0-.156.097 1 1 0 0 0-.114.145q-.12.174-.208.371"/></mask><g filter="url(#filter27_f_6709_29667)" mask="url(#mask27_6709_29667)"><path fill="#604405" d="M29.43 19.82c-.322.19-.63.397-.932.61-.158.114-.32.234-.402.408a1 1 0 0 0-.075.397c0 .139.008.275-.011.41-.012.092-.037.183-.04.275a.5.5 0 0 0 .012.139.3.3 0 0 0 .066.122.34.34 0 0 0 .156.088c.058.017.116.026.177.04.28.066.524.238.738.432.213.191.408.41.632.59.605.494 1.406.7 2.188.71.783.015 1.556-.149 2.32-.321.598-.136 1.197-.274 1.771-.488a7.8 7.8 0 0 0 2.419-1.44c.324-.28.627-.588.99-.815.319-.202.677-.335 1.004-.527a1 1 0 0 0 .083-.055.3.3 0 0 0 .067-.078.25.25 0 0 0 .008-.172.5.5 0 0 0-.086-.152 1.3 1.3 0 0 0-.136-.14c-.341-.29-.801-.396-1.25-.432-.447-.033-.9-.008-1.34-.083-.416-.07-.81-.225-1.212-.352a9 9 0 0 0-1.287-.314 8.5 8.5 0 0 0-3.104.075 9 9 0 0 0-2.756 1.074"/></g><path fill="url(#paint22_linear_6709_29667)" d="M29.327 18.736c-.46.31-.876.69-1.228 1.12-.2.247-.383.516-.483.816-.08.239-.108.488-.158.735-.02.091-.042.183-.039.277a.5.5 0 0 0 .02.139.3.3 0 0 0 .069.12c.055.055.13.085.205.102.078.014.155.016.233.025.347.041.666.208.954.407.289.197.555.43.852.616.651.413 1.43.596 2.204.627.771.03 1.543-.086 2.302-.238.602-.12 1.201-.264 1.773-.489.876-.346 1.666-.876 2.418-1.439.344-.255.682-.519.99-.815a6 6 0 0 1 .316-.3 1.2 1.2 0 0 1 .375-.216c.21-.067.438-.047.657-.011.164.027.327.063.494.058a.8.8 0 0 0 .244-.05.5.5 0 0 0 .202-.144.48.48 0 0 0 .106-.303.6.6 0 0 0-.089-.313c-.11-.189-.302-.316-.502-.405-.275-.122-.571-.18-.862-.252a12.3 12.3 0 0 1-2.59-.946c-.411-.203-.81-.427-1.213-.643-.416-.222-.837-.436-1.287-.574-1.01-.306-2.108-.206-3.103.14a6.6 6.6 0 0 0-2.86 1.956"/><mask id="mask28_6709_29667" width="15" height="8" x="27" y="16" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M29.327 18.736c-.46.31-.876.69-1.228 1.12-.2.247-.383.516-.483.816-.08.239-.108.488-.158.735-.02.091-.042.183-.039.277a.5.5 0 0 0 .02.139.3.3 0 0 0 .069.12c.055.055.13.085.205.102.078.014.155.016.233.025.347.041.666.208.954.407.289.197.555.43.852.616.651.413 1.43.596 2.204.627.771.03 1.543-.086 2.302-.238.602-.12 1.201-.264 1.773-.489.876-.346 1.666-.876 2.418-1.439.344-.255.682-.519.99-.815a6 6 0 0 1 .316-.3 1.2 1.2 0 0 1 .375-.216c.21-.067.438-.047.657-.011.164.027.327.063.494.058a.8.8 0 0 0 .244-.05.5.5 0 0 0 .202-.144.48.48 0 0 0 .106-.303.6.6 0 0 0-.089-.313c-.11-.189-.302-.316-.502-.405-.275-.122-.571-.18-.862-.252a12.3 12.3 0 0 1-2.59-.946c-.411-.203-.81-.427-1.213-.643-.416-.222-.837-.436-1.287-.574-1.01-.306-2.108-.206-3.103.14a6.6 6.6 0 0 0-2.86 1.956"/></mask><g filter="url(#filter28_f_6709_29667)" mask="url(#mask28_6709_29667)"><path fill="#f6da4a" d="M36.402 18.958a.46.46 0 0 0-.216-.141.6.6 0 0 0-.258-.011c-.172.03-.328.122-.472.222a5.4 5.4 0 0 0-1.084 1.01c-.416.507-.76 1.092-.876 1.738-.02.108-.031.222-.02.33.014.111.056.22.136.297.066.07.16.11.255.125.097.014.197 0 .289-.03.183-.062.335-.192.482-.32.796-.715 1.517-1.57 1.806-2.601a1.3 1.3 0 0 0 .052-.317.5.5 0 0 0-.094-.302"/></g><g filter="url(#filter29_f_6709_29667)" opacity=".8"><path fill="url(#paint23_radial_6709_29667)" d="M31.763 17.38c-.214-.07-.564.305-.45.497.03.052.128.119.194.083.097-.053.178-.247.283-.322.07-.05.056-.233-.027-.258"/></g><g filter="url(#filter30_f_6709_29667)" opacity=".8"><path fill="url(#paint24_radial_6709_29667)" d="M34.491 17.48c.056.177.341.147.508.233.144.075.26.238.424.244.155.003.4-.056.419-.21.025-.203-.272-.334-.463-.409-.247-.094-.563-.144-.793-.016-.053.03-.111.1-.095.158"/></g><mask id="mask29_6709_29667" width="16" height="11" x="27" y="16" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.44 21.815a.8.8 0 0 0 .078.202.9.9 0 0 0 .258.264c.1.075.208.136.313.2.558.351 1.013.842 1.418 1.364.54.699 1.02 1.473 1.744 1.98.51.36 1.12.563 1.742.627.73.072 1.467-.045 2.171-.253a7.6 7.6 0 0 0 1.859-.818c1.1-.676 2.019-1.67 3.23-2.116.264-.097.539-.166.794-.285.255-.122.496-.3.618-.555.117-.244.111-.527.15-.796.042-.286.133-.563.183-.849s.056-.59-.066-.854a1.1 1.1 0 0 0-.502-.496 1.7 1.7 0 0 0-.697-.172c-.476-.023-.95.1-1.43.144-.633.058-1.27-.025-1.906-.006-.79.025-1.57.203-2.36.241-.901.042-1.8-.097-2.701-.133a5.5 5.5 0 0 0-1.17.056 2.7 2.7 0 0 0-1.085.419c-.314.216-.563.51-.852.76a2.2 2.2 0 0 1-.471.321c-.17.084-.358.136-.55.13-.096-.002-.199-.016-.29.012a.4.4 0 0 0-.156.097 1 1 0 0 0-.114.144q-.12.175-.208.372"/><path fill="#fff" d="M29.327 18.736c-.46.31-.876.69-1.228 1.12-.2.247-.383.516-.483.816-.08.239-.108.488-.158.735-.02.091-.042.183-.039.277a.5.5 0 0 0 .02.139.3.3 0 0 0 .069.12c.055.055.13.085.205.102.078.014.155.016.233.025.347.041.666.208.954.407.289.197.555.43.852.616.651.413 1.43.596 2.204.627.771.03 1.543-.086 2.302-.238.602-.12 1.201-.264 1.773-.489.876-.346 1.666-.876 2.418-1.439.344-.255.682-.519.99-.815a6 6 0 0 1 .316-.3 1.2 1.2 0 0 1 .375-.216c.21-.067.438-.047.657-.011.164.027.327.063.494.058a.8.8 0 0 0 .244-.05.5.5 0 0 0 .202-.144.48.48 0 0 0 .106-.303.6.6 0 0 0-.089-.313c-.11-.189-.302-.316-.502-.405-.275-.122-.571-.18-.862-.252a12.3 12.3 0 0 1-2.59-.946c-.411-.203-.81-.427-1.213-.643-.416-.222-.837-.436-1.287-.574-1.01-.306-2.108-.206-3.103.14a6.6 6.6 0 0 0-2.86 1.956"/></mask><g filter="url(#filter31_f_6709_29667)" mask="url(#mask29_6709_29667)"><path fill="url(#paint25_linear_6709_29667)" d="M41.9 20.178a1.07 1.07 0 0 1-.27.598.7.7 0 0 1-.51.245.55.55 0 0 1-.455-.246.88.88 0 0 1-.133-.597 1.1 1.1 0 0 1 .088-.324q.07-.155.18-.274a.8.8 0 0 1 .242-.184.6.6 0 0 1 .27-.064q.135 0 .253.065a.6.6 0 0 1 .201.183.8.8 0 0 1 .118.275 1 1 0 0 1 .015.323"/></g></g><defs><filter id="filter0_f_6709_29667" width="11.094" height="10.545" x="20.786" y="29.221" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".64"/></filter><filter id="filter1_f_6709_29667" width="16.774" height="12.831" x="32.914" y="27.914" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".98"/></filter><filter id="filter2_f_6709_29667" width="7.904" height="8.261" x="28.414" y="29.541" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".68"/></filter><filter id="filter3_f_6709_29667" width="6.016" height="19.347" x="27.538" y="36.535" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.25"/></filter><filter id="filter4_f_6709_29667" width="9.528" height="9.579" x="46.295" y="33.834" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.78"/></filter><filter id="filter5_f_6709_29667" width="10.855" height="10.651" x="35.619" y=".582" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.73"/></filter><filter id="filter6_f_6709_29667" width="6.03" height="6.361" x="42.661" y="20.601" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".78"/></filter><filter id="filter7_f_6709_29667" width="10.35" height="19.139" x="15.097" y="33.51" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".98"/></filter><filter id="filter8_f_6709_29667" width="11.479" height="24.127" x="45.385" y="31.622" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.19"/></filter><filter id="filter9_f_6709_29667" width="34.456" height="34.265" x=".196" y="43.402" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="3.38"/></filter><filter id="filter10_f_6709_29667" width="26.944" height="28.085" x="3.479" y="45.053" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="2.1"/></filter><filter id="filter11_f_6709_29667" width="7.57" height="12.69" x="19.607" y="52.559" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".32"/></filter><filter id="filter12_f_6709_29667" width="24.868" height="26.378" x="40.205" y="49.366" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.95"/></filter><filter id="filter13_f_6709_29667" width="35.381" height="35.648" x="38.103" y="42.798" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="4.12"/></filter><filter id="filter14_f_6709_29667" width="30.521" height="30.429" x="40.873" y="43.356" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="3.12"/></filter><filter id="filter15_f_6709_29667" width="14.791" height="3.767" x="46.083" y="49.987" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".41"/></filter><filter id="filter16_f_6709_29667" width="17.936" height="16.771" x="44.586" y="47.052" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="2.45"/></filter><filter id="filter17_f_6709_29667" width="12.616" height="9.52" x="47.246" y="49.257" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.12"/></filter><filter id="filter18_f_6709_29667" width="11.868" height="7.426" x="48.319" y="46.679" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".88"/></filter><filter id="filter19_f_6709_29667" width="11.868" height="7.426" x="48.319" y="46.679" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".88"/></filter><filter id="filter20_f_6709_29667" width="3.015" height="3.774" x="28.67" y="13.52" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".44"/></filter><filter id="filter21_f_6709_29667" width="3.83" height="3.492" x="28.978" y="9.877" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".12"/></filter><filter id="filter22_f_6709_29667" width="3.468" height="3.443" x="37.594" y="13.275" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".45"/></filter><filter id="filter23_f_6709_29667" width="4.186" height="3.904" x="38.753" y="9.388" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".13"/></filter><filter id="filter24_f_6709_29667" width="22.286" height="16.039" x="24.034" y="17.124" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation="1.75"/></filter><filter id="filter25_f_6709_29667" width="17.832" height="9.848" x="25.8" y="18.356" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".8"/></filter><filter id="filter26_f_6709_29667" width="6.4" height="5.513" x="29.398" y="20.773" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".77"/></filter><filter id="filter27_f_6709_29667" width="15.243" height="8.078" x="26.67" y="17.265" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".65"/></filter><filter id="filter28_f_6709_29667" width="5.944" height="6.657" x="32.012" y="17.336" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".73"/></filter><filter id="filter29_f_6709_29667" width=".944" height=".998" x="31.091" y="17.172" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".1"/></filter><filter id="filter30_f_6709_29667" width="1.755" height="1.112" x="34.288" y="17.045" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".1"/></filter><filter id="filter31_f_6709_29667" width="2.3" height="2.609" x="40.065" y="18.872" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29667" stdDeviation=".23"/></filter><radialGradient id="paint0_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(5.26953 0 0 4.99219 23.015 34.611)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint1_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(6.54531 0 0 4.99219 40.92 37.498)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint2_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(2.59316 0 0 2.77344 32.176 36.353)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint8_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="rotate(15 -182.142 229.202)scale(5.45258 5.72438)" gradientUnits="userSpaceOnUse"><stop stop-color="#110800"/><stop offset=".59" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="paint9_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(5.46989 -.23117 .17402 4.11765 53.115 53.664)" gradientUnits="userSpaceOnUse"><stop stop-color="#110800"/><stop offset=".59" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="paint10_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(1.76767 .7686 -.355 .81643 57.258 49.985)" gradientUnits="userSpaceOnUse"><stop stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></radialGradient><radialGradient id="paint12_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="rotate(-.6 1472.074 -2860.409)scale(2.84 4.34875)" gradientUnits="userSpaceOnUse"><stop stop-color="#fefefc"/><stop offset=".75" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="paint14_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(1.71037 -.28162 .25999 1.579 29.59 13.13)" gradientUnits="userSpaceOnUse"><stop stop-color="#c8c8c8"/><stop offset="1" stop-color="#797978"/></radialGradient><radialGradient id="paint16_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="rotate(-1.8 505.051 -1227)scale(3.78297 4.34875)" gradientUnits="userSpaceOnUse"><stop stop-color="#fefefc"/><stop offset=".75" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="paint20_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="rotate(-36 43.76 -42.14)scale(3.17281 2.87883)" gradientUnits="userSpaceOnUse"><stop stop-color="#020204"/><stop offset=".73" stop-color="#020204"/><stop offset="1" stop-color="#5c5c5c"/></radialGradient><radialGradient id="paint21_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="rotate(-22.4 70.224 -81.857)scale(7.52988 5.28894)" gradientUnits="userSpaceOnUse"><stop stop-color="#d2940a"/><stop offset=".75" stop-color="#d89c08"/><stop offset=".87" stop-color="#b67e07"/><stop offset="1" stop-color="#946106"/></radialGradient><radialGradient id="paint23_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(.3661 0 0 .39383 31.593 17.608)" gradientUnits="userSpaceOnUse"><stop stop-color="#3a2903"/><stop offset=".55" stop-color="#735208"/><stop offset="1" stop-color="#ac8c04"/></radialGradient><radialGradient id="paint24_radial_6709_29667" cx="0" cy="0" r="1" gradientTransform="matrix(.77102 0 0 .4493 35.07 17.558)" gradientUnits="userSpaceOnUse"><stop stop-color="#3a2903"/><stop offset=".55" stop-color="#735208"/><stop offset="1" stop-color="#ac8c04"/></radialGradient><linearGradient id="paint3_linear_6709_29667" x1="12.476" x2="23.883" y1="54.53" y2="73.67" gradientUnits="userSpaceOnUse"><stop stop-color="#b98309"/><stop offset="1" stop-color="#382605"/></linearGradient><linearGradient id="paint4_linear_6709_29667" x1="23.927" x2="27.516" y1="59.472" y2="66.234" gradientUnits="userSpaceOnUse"><stop stop-color="#ebc40c"/><stop offset="1" stop-color="#ebc40c" stop-opacity="0"/></linearGradient><linearGradient id="paint5_linear_6709_29667" x1="46.797" x2="47.704" y1="59.786" y2="66.378" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity="0"/></linearGradient><linearGradient id="paint6_linear_6709_29667" x1="48.065" x2="59.558" y1="71.174" y2="52.542" gradientUnits="userSpaceOnUse"><stop stop-color="#3e2a06"/><stop offset="1" stop-color="#ad780a"/></linearGradient><linearGradient id="paint7_linear_6709_29667" x1="51.202" x2="50.864" y1="51.108" y2="54.15" gradientUnits="userSpaceOnUse"><stop stop-color="#f3cd0c"/><stop offset="1" stop-color="#f3cd0c" stop-opacity="0"/></linearGradient><linearGradient id="paint11_linear_6709_29667" x1="52" x2="52.716" y1="49.142" y2="49.111" gradientUnits="userSpaceOnUse"><stop stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></linearGradient><linearGradient id="paint13_linear_6709_29667" x1="29.424" x2="30.819" y1="13.935" y2="16.428" gradientUnits="userSpaceOnUse"><stop stop-color="#757574" stop-opacity="0"/><stop offset=".25" stop-color="#757574"/><stop offset=".5" stop-color="#757574"/><stop offset="1" stop-color="#757574" stop-opacity="0"/></linearGradient><linearGradient id="paint15_linear_6709_29667" x1="29.231" x2="32.251" y1="10.017" y2="13.101" gradientUnits="userSpaceOnUse"><stop stop-color="#646464" stop-opacity="0"/><stop offset=".31" stop-color="#646464" stop-opacity=".58"/><stop offset=".47" stop-color="#646464"/><stop offset=".73" stop-color="#646464" stop-opacity=".26"/><stop offset="1" stop-color="#646464" stop-opacity="0"/></linearGradient><linearGradient id="paint17_linear_6709_29667" x1="38.736" x2="40.342" y1="14.104" y2="16.007" gradientUnits="userSpaceOnUse"><stop stop-color="#949494" stop-opacity=".39"/><stop offset=".5" stop-color="#949494"/><stop offset="1" stop-color="#949494" stop-opacity=".39"/></linearGradient><linearGradient id="paint18_linear_6709_29667" x1="37.359" x2="42.468" y1="11.049" y2="14.038" gradientUnits="userSpaceOnUse"><stop stop-color="#747474"/><stop offset=".13" stop-color="#8c8c8c"/><stop offset=".25" stop-color="#a4a4a4"/><stop offset=".5" stop-color="#d4d4d4"/><stop offset=".62" stop-color="#d4d4d4"/><stop offset="1" stop-color="#7c7c7c"/></linearGradient><linearGradient id="paint19_linear_6709_29667" x1="39.096" x2="42.496" y1="9.753" y2="12.965" gradientUnits="userSpaceOnUse"><stop stop-color="#646464" stop-opacity="0"/><stop offset=".31" stop-color="#646464" stop-opacity=".58"/><stop offset=".47" stop-color="#646464"/><stop offset=".73" stop-color="#646464" stop-opacity=".26"/><stop offset="1" stop-color="#646464" stop-opacity="0"/></linearGradient><linearGradient id="paint22_linear_6709_29667" x1="27.705" x2="41.206" y1="20.209" y2="20.104" gradientUnits="userSpaceOnUse"><stop stop-color="#ad780a"/><stop offset=".12" stop-color="#d89e08"/><stop offset=".25" stop-color="#edb80b"/><stop offset=".39" stop-color="#ebc80d"/><stop offset=".53" stop-color="#f5d838"/><stop offset=".77" stop-color="#f6d811"/><stop offset="1" stop-color="#f5cd31"/></linearGradient><linearGradient id="paint25_linear_6709_29667" x1="41.197" x2="41.197" y1="19.718" y2="20.716" gradientUnits="userSpaceOnUse"><stop stop-color="#f5ce2d"/><stop offset="1" stop-color="#d79b08"/></linearGradient><clipPath id="clip0_6709_29667"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/linux-light.svg b/web/packages/design/src/ResourceIcon/assets/linux-light.svg
index 057de6081cbc9..ca2d6300d827c 100644
--- a/web/packages/design/src/ResourceIcon/assets/linux-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/linux-light.svg
@@ -1,563 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29666)">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="#020204"/>
-<path d="M29.0059 20.8124C28.7528 21.1302 28.5896 21.5127 28.4884 21.9064C28.39 22.3002 28.3534 22.708 28.3365 23.1158C28.3056 23.9286 28.3562 24.7555 28.1396 25.5402C27.909 26.3783 27.3943 27.1067 26.8909 27.8127C26.0162 29.0389 25.1331 30.2989 24.7028 31.7417C24.4412 32.6136 24.354 33.5389 24.4468 34.4474C23.4709 35.8817 22.6243 37.4089 21.9212 38.998C20.8581 41.4083 20.1296 43.9733 19.8737 46.5946C19.5587 49.8036 19.9693 53.1055 21.2378 56.0699C22.1518 58.2158 23.5187 60.1761 25.2821 61.7061C26.1765 62.4824 27.1721 63.1433 28.2353 63.6664C31.9225 65.4805 36.4787 65.4833 40.104 63.5511C41.9996 62.5414 43.6 61.0649 45.1412 59.5714C46.0693 58.6714 46.9946 57.7489 47.7034 56.6689C49.0675 54.5849 49.5428 52.0536 49.8381 49.5814C50.3528 45.2614 50.3696 40.6939 48.474 36.7761C47.8215 35.4261 46.9525 34.183 45.909 33.1058C45.6334 31.2214 45.085 29.3736 44.289 27.6439C43.7125 26.3924 43.0121 25.2027 42.4778 23.9371C42.2584 23.4167 42.0671 22.8824 41.8253 22.3733C41.5806 21.8642 41.2825 21.3749 40.8718 20.9839C40.4556 20.5846 39.9353 20.3005 39.3868 20.1205C38.8384 19.9377 38.259 19.8561 37.6825 19.828C36.5265 19.7689 35.3706 19.9208 34.2146 19.873C33.295 19.8364 32.3781 19.6761 31.4584 19.7296C31 19.7577 30.5415 19.8392 30.114 20.0136C29.6865 20.1852 29.2928 20.4524 29.0059 20.8124Z" fill="#FDFDFB"/>
-<mask id="mask0_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask0_6709_29666)">
-<g opacity="0.25" filter="url(#filter0_f_6709_29666)">
-<path d="M24.9386 32.3943C25.1832 32.7628 24.7839 34.0368 30.5242 33.2212C30.5242 33.2212 29.5145 33.3309 28.5217 33.5615C26.9776 34.079 25.6332 34.6556 24.5926 35.4206C23.5661 36.1799 22.8123 37.1671 21.8701 38.0137C21.8701 38.0137 23.3973 35.2237 23.777 34.3828C24.1595 33.5418 23.7151 33.5812 24.0161 32.3437C24.317 31.1062 25.0539 29.9165 25.0539 29.9165C25.0539 29.9165 24.452 31.6659 24.9386 32.3943Z" fill="url(#paint0_radial_6709_29666)"/>
-</g>
-</g>
-<mask id="mask1_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask1_6709_29666)">
-<g opacity="0.42" filter="url(#filter1_f_6709_29666)">
-<path d="M43.3915 32.0595C42.2215 32.8751 41.5353 32.7795 40.1178 32.937C38.6975 33.0973 34.8584 33.0383 34.8584 33.0383C34.8584 33.0383 35.4125 33.0298 36.6471 33.2576C37.879 33.4883 40.3906 33.7076 41.8053 34.2448C43.2228 34.7848 43.7375 34.9395 44.5981 35.4823C45.8215 36.2558 46.7215 37.468 47.8915 38.3173C47.8915 38.3173 47.9478 37.1923 47.4753 36.3514C47.0028 35.5104 45.7315 34.1858 45.3575 32.9483C44.9862 31.7108 44.8062 29.2808 44.8062 29.2808C44.8062 29.2808 44.5587 31.2467 43.3915 32.0595Z" fill="url(#paint1_radial_6709_29666)"/>
-</g>
-</g>
-<mask id="mask2_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask2_6709_29666)">
-<g opacity="0.2" filter="url(#filter2_f_6709_29666)">
-<path d="M32.3921 30.3218C32.3471 30.6733 32.2909 31.0249 32.2234 31.3737C32.1896 31.5452 32.1503 31.7168 32.0884 31.8799C32.0237 32.043 31.9309 32.2005 31.8015 32.3158C31.6862 32.4199 31.5484 32.4902 31.4078 32.5549C30.8621 32.8024 30.28 32.9683 29.6865 33.0443C29.9228 33.0612 30.159 33.0837 30.3981 33.109C30.5471 33.1258 30.6962 33.1427 30.8396 33.1793C30.9859 33.2187 31.1293 33.2749 31.2503 33.3621C31.3825 33.4605 31.4865 33.5927 31.5653 33.739C31.72 34.0258 31.7706 34.3577 31.7987 34.6868C31.8353 35.103 31.8381 35.5249 31.8071 35.9412C31.8353 35.6627 31.8943 35.3843 31.9815 35.1199C32.1418 34.6362 32.395 34.1862 32.7381 33.8121C32.8759 33.6658 33.025 33.528 33.1881 33.4127C33.6915 33.0583 34.3328 32.9037 34.9431 32.988C34.3215 33.0133 33.6943 32.8193 33.1993 32.4452C32.9462 32.254 32.7268 32.0177 32.575 31.7421C32.3387 31.3146 32.2712 30.7943 32.3921 30.3218Z" fill="url(#paint2_radial_6709_29666)"/>
-</g>
-</g>
-<mask id="mask3_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask3_6709_29666)">
-<g opacity="0.11" filter="url(#filter3_f_6709_29666)">
-<path d="M30.8957 38.5708C30.5976 39.7042 30.3923 40.863 30.2854 42.033C30.1307 43.6839 30.1673 45.3461 30.0773 47.0027C30.0041 48.4061 29.8382 49.8264 30.0829 51.213C30.1982 51.8739 30.4063 52.518 30.7016 53.1199C30.7466 52.8892 30.7832 52.6586 30.8029 52.4252C30.9069 51.3002 30.7185 50.1724 30.6538 49.0474C30.5413 47.073 30.8141 45.0986 30.9266 43.1242C31.011 41.6083 31.0026 40.0867 30.8957 38.5708Z" fill="black"/>
-</g>
-</g>
-<mask id="mask4_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask4_6709_29666)">
-<g opacity="0.75" filter="url(#filter4_f_6709_29666)">
-<path d="M50.6479 36.9082C50.9376 36.8632 52.7123 38.3735 52.4704 38.936C52.2285 39.4957 51.7701 39.1582 51.4439 39.161C51.1176 39.1667 50.226 39.5716 50.077 39.3157C49.9251 39.0598 50.4707 38.4635 50.7548 37.9629C50.9854 37.5607 50.361 36.9532 50.6479 36.9082Z" fill="#7C7C7C"/>
-</g>
-</g>
-<mask id="mask5_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask5_6709_29666)">
-<g filter="url(#filter5_f_6709_29666)">
-<path d="M39.8027 3.12757C39.1812 3.56632 39.4512 4.11475 39.7184 4.66319C39.9855 5.21444 39.1305 6.79788 39.1221 6.86538C39.1137 6.93288 40.804 6.06382 41.2652 5.49569C41.8109 4.82913 43.1862 6.40132 43.1102 6.16225C43.113 5.73475 40.4243 2.69163 39.8027 3.12757Z" fill="#7C7C7C"/>
-</g>
-</g>
-<mask id="mask6_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask6_6709_29666)">
-<g filter="url(#filter6_f_6709_29666)">
-<path d="M44.5135 21.552C43.9904 22.0302 44.761 22.7474 45.1238 23.5883C45.3517 24.1114 45.9788 24.8511 46.5863 24.733C47.0448 24.643 47.326 23.9849 47.2838 23.5236C47.1995 22.6292 46.4457 22.4183 45.8973 22.1117C45.4642 21.8699 44.882 21.2174 44.5135 21.552Z" fill="#838384"/>
-</g>
-</g>
-<path d="M23.6195 28.381C21.9038 30.3273 20.1404 32.2145 19.1729 34.321C18.692 35.3898 18.467 36.5513 18.1379 37.6763C17.7666 38.9532 17.2604 40.1907 16.6923 41.3945C16.1663 42.5054 15.587 43.591 15.0104 44.6738C14.5885 45.4641 14.161 46.2685 14.0148 47.1516C13.8995 47.8491 13.9641 48.5691 14.1441 49.2526C14.3213 49.936 14.6054 50.5885 14.9288 51.2157C16.3013 53.9016 18.3629 56.2135 20.8041 57.9854C21.9123 58.787 23.0963 59.4816 24.3423 60.0526C25.0173 60.3591 25.726 60.6348 26.4685 60.646C26.8398 60.6545 27.2138 60.5926 27.5541 60.4435C27.8916 60.2945 28.1954 60.0554 28.3979 59.7432C28.6454 59.3607 28.7298 58.8854 28.6791 58.4326C28.6285 57.9798 28.4513 57.5466 28.2151 57.1585C27.6357 56.2079 26.7216 55.5188 25.8413 54.8382C23.9401 53.3673 22.1035 51.812 20.3429 50.1751C19.8479 49.711 19.3501 49.2357 19.0041 48.6507C18.6666 48.0826 18.4838 47.4357 18.3601 46.786C18.0198 45.0057 18.107 43.1326 18.7116 41.4226C18.9507 40.7532 19.2629 40.1148 19.5666 39.4735C20.0898 38.3626 20.5848 37.2291 21.2738 36.211C22.1316 34.9426 23.2791 33.8682 23.9766 32.507C24.5673 31.3566 24.8063 30.0657 25.0341 28.7945C25.2141 27.7988 25.5545 26.8257 25.7288 25.8301C25.3885 26.477 24.2916 27.5373 23.6195 28.381Z" fill="#020204"/>
-<mask id="mask7_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="13" y="25" width="16" height="36">
-<path d="M23.6195 28.381C21.9038 30.3273 20.1404 32.2145 19.1729 34.321C18.692 35.3898 18.467 36.5513 18.1379 37.6763C17.7666 38.9532 17.2604 40.1907 16.6923 41.3945C16.1663 42.5054 15.587 43.591 15.0104 44.6738C14.5885 45.4641 14.161 46.2685 14.0148 47.1516C13.8995 47.8491 13.9641 48.5691 14.1441 49.2526C14.3213 49.936 14.6054 50.5885 14.9288 51.2157C16.3013 53.9016 18.3629 56.2135 20.8041 57.9854C21.9123 58.787 23.0963 59.4816 24.3423 60.0526C25.0173 60.3591 25.726 60.6348 26.4685 60.646C26.8398 60.6545 27.2138 60.5926 27.5541 60.4435C27.8916 60.2945 28.1954 60.0554 28.3979 59.7432C28.6454 59.3607 28.7298 58.8854 28.6791 58.4326C28.6285 57.9798 28.4513 57.5466 28.2151 57.1585C27.6357 56.2079 26.7216 55.5188 25.8413 54.8382C23.9401 53.3673 22.1035 51.812 20.3429 50.1751C19.8479 49.711 19.3501 49.2357 19.0041 48.6507C18.6666 48.0826 18.4838 47.4357 18.3601 46.786C18.0198 45.0057 18.107 43.1326 18.7116 41.4226C18.9507 40.7532 19.2629 40.1148 19.5666 39.4735C20.0898 38.3626 20.5848 37.2291 21.2738 36.211C22.1316 34.9426 23.2791 33.8682 23.9766 32.507C24.5673 31.3566 24.8063 30.0657 25.0341 28.7945C25.2141 27.7988 25.5545 26.8257 25.7288 25.8301C25.3885 26.477 24.2916 27.5373 23.6195 28.381Z" fill="white"/>
-</mask>
-<g mask="url(#mask7_6709_29666)">
-<g opacity="0.95" filter="url(#filter7_f_6709_29666)">
-<path d="M21.6454 35.4655C21.0829 35.983 20.5963 36.5821 20.2026 37.2402C19.5557 38.3202 19.176 39.5352 18.7035 40.7024C18.3548 41.5715 17.947 42.4461 17.8991 43.3827C17.8738 43.8636 17.9441 44.3446 17.961 44.8255C17.9779 45.3065 17.9329 45.8071 17.6966 46.2261C17.4998 46.5777 17.1707 46.8533 16.791 46.9883C17.3057 47.1599 17.7613 47.4918 18.0848 47.9249C18.3548 48.2905 18.5291 48.7152 18.7626 49.1005C18.9538 49.4155 19.1873 49.708 19.477 49.9358C19.7638 50.1665 20.1098 50.3296 20.4726 50.3746C20.976 50.4393 21.4991 50.2733 21.8704 49.9302C21.4035 45.5568 21.831 41.0933 23.1191 36.8886C23.2007 36.6243 23.2851 36.3571 23.3076 36.0815C23.3273 35.803 23.2738 35.5105 23.1051 35.2911C23.0179 35.173 22.897 35.0802 22.7591 35.0211C22.6241 34.9649 22.4723 34.9424 22.326 34.9621C22.1798 34.979 22.0363 35.0352 21.9182 35.1224C21.8001 35.2124 21.7045 35.3305 21.6454 35.4655Z" fill="#7C7C7C"/>
-</g>
-</g>
-<path d="M51.4011 35.7524C52.8749 36.9393 53.8115 38.7308 54.1011 40.6011C54.3261 42.058 54.1799 43.5571 53.8508 44.9943C53.5218 46.4343 53.0155 47.8236 52.5093 49.213C52.3096 49.7643 52.1071 50.3239 52.0283 50.9061C51.9468 51.4911 51.9974 52.1071 52.2786 52.6246C52.6021 53.218 53.204 53.6258 53.8508 53.8171C54.4893 54.0083 55.1783 54.0027 55.8252 53.8424C56.4721 53.6821 57.5605 53.4739 58.0865 53.0633C59.4224 52.0255 59.7402 50.2227 60.058 48.6421C60.3871 46.9911 60.2268 45.2614 59.9371 43.5936C59.5405 41.3183 58.874 39.0964 58.0274 36.9505C57.403 35.3699 56.6043 33.8624 55.6536 32.4618C54.7199 31.0864 53.398 30.0149 52.4193 28.6705C52.079 28.2036 51.6711 27.7199 51.3393 27.2474C50.6193 26.2293 50.7824 26.4205 50.3352 25.7596C50.0118 25.2814 49.4999 25.1183 48.9627 24.9102C48.4227 24.7021 47.8208 24.6402 47.264 24.7949C46.5327 25.0002 45.9336 25.5796 45.6158 26.2686C45.298 26.9605 45.2418 27.7536 45.3655 28.5046C45.5258 29.4721 45.9674 30.3721 46.468 31.2158C47.0305 32.1693 47.683 33.0889 48.5352 33.7977C49.424 34.5374 50.4983 35.0268 51.4011 35.7524Z" fill="#020204"/>
-<mask id="mask8_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="24" width="16" height="30">
-<path d="M51.4011 35.7524C52.8749 36.9393 53.8115 38.7308 54.1011 40.6011C54.3261 42.058 54.1799 43.5571 53.8508 44.9943C53.5218 46.4343 53.0155 47.8236 52.5093 49.213C52.3096 49.7643 52.1071 50.3239 52.0283 50.9061C51.9468 51.4911 51.9974 52.1071 52.2786 52.6246C52.6021 53.218 53.204 53.6258 53.8508 53.8171C54.4893 54.0083 55.1783 54.0027 55.8252 53.8424C56.4721 53.6821 57.5605 53.4739 58.0865 53.0633C59.4224 52.0255 59.7402 50.2227 60.058 48.6421C60.3871 46.9911 60.2268 45.2614 59.9371 43.5936C59.5405 41.3183 58.874 39.0964 58.0274 36.9505C57.403 35.3699 56.6043 33.8624 55.6536 32.4618C54.7199 31.0864 53.398 30.0149 52.4193 28.6705C52.079 28.2036 51.6711 27.7199 51.3393 27.2474C50.6193 26.2293 50.7824 26.4205 50.3352 25.7596C50.0118 25.2814 49.4999 25.1183 48.9627 24.9102C48.4227 24.7021 47.8208 24.6402 47.264 24.7949C46.5327 25.0002 45.9336 25.5796 45.6158 26.2686C45.298 26.9605 45.2418 27.7536 45.3655 28.5046C45.5258 29.4721 45.9674 30.3721 46.468 31.2158C47.0305 32.1693 47.683 33.0889 48.5352 33.7977C49.424 34.5374 50.4983 35.0268 51.4011 35.7524Z" fill="white"/>
-</mask>
-<g mask="url(#mask8_6709_29666)">
-<g filter="url(#filter8_f_6709_29666)">
-<path d="M47.9307 33.4658C48.0488 33.5783 48.1725 33.6936 48.2991 33.8005C49.2047 34.5402 49.6857 35.3699 50.6054 36.0955C52.1072 37.2824 53.6288 39.3299 53.9241 41.2002C54.1547 42.6599 53.851 43.453 53.4797 45.1714C53.1085 46.8927 52.0566 49.3283 51.4857 50.9877C51.2607 51.6486 51.9469 51.3758 51.8569 52.0733C51.8119 52.4164 51.8063 52.7624 51.8485 53.1055C51.8541 53.0408 51.8569 52.9705 51.8654 52.9058C51.975 51.9552 52.2647 51.0411 52.5825 50.1439C53.1929 48.4199 53.8932 46.7268 54.3769 44.9549C54.8607 43.1858 54.8072 41.9118 54.5541 40.3902C54.2363 38.4749 53.1225 36.7086 51.5475 35.5414C50.431 34.7174 49.1175 34.1886 47.9307 33.4658Z" fill="#838384"/>
-</g>
-</g>
-<path d="M15.4631 49.3116C15.8512 49.1512 16.2872 49.1203 16.6978 49.1962C17.1112 49.2722 17.5022 49.4522 17.8481 49.6856C18.5428 50.1581 19.0575 50.8444 19.5497 51.525C20.6831 53.0831 21.7716 54.675 22.7616 56.3287C23.5631 57.6731 24.2972 59.0597 25.2253 60.3169C25.83 61.1409 26.5106 61.9031 27.1181 62.7216C27.7256 63.5428 28.2628 64.4316 28.5328 65.4159C28.8844 66.6956 28.7466 68.1047 28.1391 69.2831C27.7116 70.1128 27.0534 70.8244 26.2547 71.3053C25.4559 71.7862 24.615 72 23.6812 72C22.1991 72 20.7506 71.2041 19.3725 70.6556C16.5656 69.5362 13.5169 69.1875 10.6228 68.3156C9.73406 68.0484 8.85938 67.7306 7.965 67.4859C7.56562 67.3762 7.16344 67.2806 6.78656 67.1091C6.40969 66.9403 6.05813 66.6844 5.85 66.33C5.68969 66.0544 5.625 65.7309 5.625 65.4131C5.625 65.0925 5.70375 64.7775 5.81344 64.4794C6.03 63.8803 6.38156 63.3375 6.61781 62.7441C7.00312 61.7766 7.07344 60.7106 7.02 59.67C6.96938 58.6322 6.80062 57.6 6.73031 56.5622C6.69656 56.0981 6.68531 55.6284 6.77531 55.17C6.8625 54.7144 7.05937 54.2672 7.39406 53.9466C7.70344 53.6484 8.11125 53.4712 8.53312 53.3841C8.95219 53.2969 9.38531 53.2941 9.81281 53.3025C10.2403 53.3109 10.6706 53.3362 11.0981 53.2997C11.5256 53.2659 11.9559 53.1703 12.3272 52.9566C12.6816 52.7541 12.9712 52.4531 13.2103 52.1241C13.4494 51.795 13.6434 51.435 13.8431 51.0778C14.04 50.7234 14.2453 50.3691 14.5069 50.0541C14.7656 49.7391 15.0863 49.4662 15.4631 49.3116Z" fill="url(#paint3_linear_6709_29666)"/>
-<mask id="mask9_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="5" y="49" width="24" height="23">
-<path d="M15.4631 49.3116C15.8512 49.1512 16.2872 49.1203 16.6978 49.1962C17.1112 49.2722 17.5022 49.4522 17.8481 49.6856C18.5428 50.1581 19.0575 50.8444 19.5497 51.525C20.6831 53.0831 21.7716 54.675 22.7616 56.3287C23.5631 57.6731 24.2972 59.0597 25.2253 60.3169C25.83 61.1409 26.5106 61.9031 27.1181 62.7216C27.7256 63.5428 28.2628 64.4316 28.5328 65.4159C28.8844 66.6956 28.7466 68.1047 28.1391 69.2831C27.7116 70.1128 27.0534 70.8244 26.2547 71.3053C25.4559 71.7862 24.615 72 23.6812 72C22.1991 72 20.7506 71.2041 19.3725 70.6556C16.5656 69.5362 13.5169 69.1875 10.6228 68.3156C9.73406 68.0484 8.85938 67.7306 7.965 67.4859C7.56562 67.3762 7.16344 67.2806 6.78656 67.1091C6.40969 66.9403 6.05813 66.6844 5.85 66.33C5.68969 66.0544 5.625 65.7309 5.625 65.4131C5.625 65.0925 5.70375 64.7775 5.81344 64.4794C6.03 63.8803 6.38156 63.3375 6.61781 62.7441C7.00312 61.7766 7.07344 60.7106 7.02 59.67C6.96938 58.6322 6.80062 57.6 6.73031 56.5622C6.69656 56.0981 6.68531 55.6284 6.77531 55.17C6.8625 54.7144 7.05937 54.2672 7.39406 53.9466C7.70344 53.6484 8.11125 53.4712 8.53312 53.3841C8.95219 53.2969 9.38531 53.2941 9.81281 53.3025C10.2403 53.3109 10.6706 53.3362 11.0981 53.2997C11.5256 53.2659 11.9559 53.1703 12.3272 52.9566C12.6816 52.7541 12.9712 52.4531 13.2103 52.1241C13.4494 51.795 13.6434 51.435 13.8431 51.0778C14.04 50.7234 14.2453 50.3691 14.5069 50.0541C14.7656 49.7391 15.0863 49.4662 15.4631 49.3116Z" fill="white"/>
-</mask>
-<g mask="url(#mask9_6709_29666)">
-<g filter="url(#filter9_f_6709_29666)">
-<path d="M16.0764 49.9783C16.4279 49.8377 16.8273 49.8208 17.1958 49.9052C17.567 49.9896 17.9129 50.1696 18.2111 50.403C18.8129 50.8671 19.2292 51.5196 19.6314 52.1637C20.5933 53.7218 21.5326 55.2996 22.4214 56.9055C23.0964 58.1177 23.7376 59.3524 24.5645 60.4633C25.1129 61.2002 25.7401 61.878 26.2998 62.6065C26.8595 63.3349 27.3573 64.128 27.6048 65.014C27.9254 66.153 27.7961 67.4158 27.2448 68.4621C26.8454 69.2158 26.2379 69.8571 25.5011 70.2846C24.767 70.7121 23.9064 70.9258 23.057 70.8865C21.7014 70.8246 20.4611 70.1468 19.1842 69.6883C16.7345 68.7996 14.0823 68.6786 11.5679 67.9868C10.6679 67.7421 9.79044 67.4158 8.88763 67.188C8.48544 67.0868 8.07763 67.0024 7.69794 66.8421C7.31826 66.6818 6.96107 66.4343 6.75294 66.0771C6.60107 65.8099 6.53919 65.4977 6.54763 65.1911C6.55888 64.8846 6.63482 64.5808 6.74451 64.294C6.96388 63.7202 7.30701 63.2027 7.52638 62.629C7.86107 61.7627 7.90326 60.8093 7.84138 59.884C7.77951 58.9587 7.61638 58.039 7.56013 57.1137C7.53763 56.6974 7.53201 56.2783 7.61638 55.8733C7.70076 55.4655 7.87794 55.0718 8.17326 54.7793C8.49388 54.4615 8.93263 54.2899 9.37982 54.2196C9.82419 54.1521 10.277 54.183 10.7242 54.2224C11.1742 54.2618 11.6242 54.3124 12.0742 54.2871C12.5242 54.259 12.9798 54.1493 13.3511 53.8962C13.6886 53.6683 13.9417 53.3337 14.1358 52.9765C14.3298 52.6193 14.4676 52.234 14.6167 51.8571C14.7629 51.4774 14.9233 51.1005 15.1539 50.763C15.3845 50.4283 15.6967 50.133 16.0764 49.9783Z" fill="#D99A03"/>
-</g>
-</g>
-<mask id="mask10_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="5" y="49" width="24" height="23">
-<path d="M15.4631 49.3116C15.8512 49.1512 16.2872 49.1203 16.6978 49.1962C17.1112 49.2722 17.5022 49.4522 17.8481 49.6856C18.5428 50.1581 19.0575 50.8444 19.5497 51.525C20.6831 53.0831 21.7716 54.675 22.7616 56.3287C23.5631 57.6731 24.2972 59.0597 25.2253 60.3169C25.83 61.1409 26.5106 61.9031 27.1181 62.7216C27.7256 63.5428 28.2628 64.4316 28.5328 65.4159C28.8844 66.6956 28.7466 68.1047 28.1391 69.2831C27.7116 70.1128 27.0534 70.8244 26.2547 71.3053C25.4559 71.7862 24.615 72 23.6812 72C22.1991 72 20.7506 71.2041 19.3725 70.6556C16.5656 69.5362 13.5169 69.1875 10.6228 68.3156C9.73406 68.0484 8.85938 67.7306 7.965 67.4859C7.56562 67.3762 7.16344 67.2806 6.78656 67.1091C6.40969 66.9403 6.05813 66.6844 5.85 66.33C5.68969 66.0544 5.625 65.7309 5.625 65.4131C5.625 65.0925 5.70375 64.7775 5.81344 64.4794C6.03 63.8803 6.38156 63.3375 6.61781 62.7441C7.00312 61.7766 7.07344 60.7106 7.02 59.67C6.96938 58.6322 6.80062 57.6 6.73031 56.5622C6.69656 56.0981 6.68531 55.6284 6.77531 55.17C6.8625 54.7144 7.05937 54.2672 7.39406 53.9466C7.70344 53.6484 8.11125 53.4712 8.53312 53.3841C8.95219 53.2969 9.38531 53.2941 9.81281 53.3025C10.2403 53.3109 10.6706 53.3362 11.0981 53.2997C11.5256 53.2659 11.9559 53.1703 12.3272 52.9566C12.6816 52.7541 12.9712 52.4531 13.2103 52.1241C13.4494 51.795 13.6434 51.435 13.8431 51.0778C14.04 50.7234 14.2453 50.3691 14.5069 50.0541C14.7656 49.7391 15.0863 49.4662 15.4631 49.3116Z" fill="white"/>
-</mask>
-<g mask="url(#mask10_6709_29666)">
-<g filter="url(#filter10_f_6709_29666)">
-<path d="M15.7475 49.0976C16.0906 48.9289 16.4928 48.8951 16.8669 48.9711C17.2409 49.047 17.5897 49.2298 17.885 49.4689C18.4728 49.947 18.8497 50.6304 19.1984 51.2998C19.9972 52.8354 20.7453 54.4048 21.7016 55.8532C22.3991 56.9023 23.2006 57.8782 23.9038 58.9245C24.8572 60.3392 25.6334 61.8973 25.9541 63.5651C26.1678 64.6901 26.1622 65.9023 25.6222 66.912C25.265 67.5786 24.6884 68.1242 24.005 68.4645C23.3244 68.8076 22.5397 68.9454 21.7775 68.8779C20.5766 68.7739 19.4881 68.1832 18.3575 67.7698C16.3522 67.0414 14.1838 66.8642 12.1194 66.3129C11.2503 66.0823 10.3953 65.7814 9.515 65.5986C9.12407 65.517 8.7275 65.4579 8.35625 65.3173C7.985 65.1767 7.63344 64.9432 7.44219 64.6001C7.31 64.3582 7.265 64.077 7.28469 63.8014C7.30438 63.5286 7.38594 63.2614 7.49282 63.0054C7.70938 62.4992 8.02719 62.0323 8.19313 61.5092C8.44063 60.7357 8.33938 59.9004 8.15375 59.1101C7.97094 58.3226 7.70375 57.5492 7.62219 56.7448C7.58563 56.3876 7.58563 56.022 7.67 55.6704C7.75157 55.3189 7.9175 54.9814 8.17907 54.7311C8.51657 54.4076 8.98907 54.2445 9.46157 54.1995C9.93125 54.1545 10.4038 54.2164 10.8706 54.2839C11.3375 54.3514 11.81 54.4245 12.2797 54.402C12.7522 54.3823 13.2331 54.2586 13.6016 53.9689C13.9672 53.682 14.1978 53.2573 14.33 52.8186C14.4622 52.377 14.5044 51.9186 14.5578 51.4629C14.6113 51.0073 14.6788 50.5461 14.8559 50.1214C15.0331 49.6967 15.3313 49.3057 15.7475 49.0976Z" fill="#F5BD0C"/>
-</g>
-</g>
-<mask id="mask11_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="5" y="49" width="24" height="23">
-<path d="M15.4631 49.3116C15.8512 49.1512 16.2872 49.1203 16.6978 49.1962C17.1112 49.2722 17.5022 49.4522 17.8481 49.6856C18.5428 50.1581 19.0575 50.8444 19.5497 51.525C20.6831 53.0831 21.7716 54.675 22.7616 56.3287C23.5631 57.6731 24.2972 59.0597 25.2253 60.3169C25.83 61.1409 26.5106 61.9031 27.1181 62.7216C27.7256 63.5428 28.2628 64.4316 28.5328 65.4159C28.8844 66.6956 28.7466 68.1047 28.1391 69.2831C27.7116 70.1128 27.0534 70.8244 26.2547 71.3053C25.4559 71.7862 24.615 72 23.6812 72C22.1991 72 20.7506 71.2041 19.3725 70.6556C16.5656 69.5362 13.5169 69.1875 10.6228 68.3156C9.73406 68.0484 8.85938 67.7306 7.965 67.4859C7.56562 67.3762 7.16344 67.2806 6.78656 67.1091C6.40969 66.9403 6.05813 66.6844 5.85 66.33C5.68969 66.0544 5.625 65.7309 5.625 65.4131C5.625 65.0925 5.70375 64.7775 5.81344 64.4794C6.03 63.8803 6.38156 63.3375 6.61781 62.7441C7.00312 61.7766 7.07344 60.7106 7.02 59.67C6.96938 58.6322 6.80062 57.6 6.73031 56.5622C6.69656 56.0981 6.68531 55.6284 6.77531 55.17C6.8625 54.7144 7.05937 54.2672 7.39406 53.9466C7.70344 53.6484 8.11125 53.4712 8.53312 53.3841C8.95219 53.2969 9.38531 53.2941 9.81281 53.3025C10.2403 53.3109 10.6706 53.3362 11.0981 53.2997C11.5256 53.2659 11.9559 53.1703 12.3272 52.9566C12.6816 52.7541 12.9712 52.4531 13.2103 52.1241C13.4494 51.795 13.6434 51.435 13.8431 51.0778C14.04 50.7234 14.2453 50.3691 14.5069 50.0541C14.7656 49.7391 15.0863 49.4662 15.4631 49.3116Z" fill="white"/>
-</mask>
-<g mask="url(#mask11_6709_29666)">
-<g filter="url(#filter11_f_6709_29666)">
-<path d="M20.0254 52.9341C20.6582 54.076 21.0435 55.3866 21.6707 56.5397C22.2473 57.6 22.9026 58.6913 23.4876 59.6672C23.7491 60.1031 24.3566 60.7725 24.9698 61.8103C25.5266 62.7497 26.0891 64.0631 26.4041 64.5047C26.2241 63.9872 25.8529 62.6006 25.4085 61.6135C24.9951 60.691 24.5113 60.165 24.216 59.6672C23.631 58.6913 22.9982 57.811 22.3963 56.88C21.5666 55.5947 20.9338 54.1575 20.0254 52.9341Z" fill="url(#paint4_linear_6709_29666)"/>
-</g>
-</g>
-<mask id="mask12_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask12_6709_29666)">
-<g opacity="0.2" filter="url(#filter12_f_6709_29666)">
-<path d="M61.5093 60.6404C61.3968 61.0145 61.2224 61.3773 61.0002 61.7092C60.508 62.4376 59.7908 62.9889 59.0765 63.4951C57.8587 64.3585 56.5874 65.1517 55.4512 66.1332C54.6918 66.7914 53.9971 67.531 53.3558 68.3073C52.8074 68.971 52.2899 69.6685 51.6627 70.2592C51.0299 70.8554 50.2874 71.3392 49.4858 71.6007C48.5099 71.9185 47.4805 71.9045 46.5412 71.6626C45.883 71.4939 45.239 71.2014 44.8312 70.6698C44.4233 70.1382 44.2912 69.421 44.2433 68.7179C44.159 67.4748 44.308 66.2064 44.443 64.9435C44.5555 63.8945 44.6596 62.8454 44.7018 61.7992C44.7777 59.8951 44.6512 58.0107 44.3952 56.1601C44.3502 55.8479 44.3052 55.5357 44.3305 55.2179C44.3558 54.8973 44.4627 54.5654 44.6877 54.3179C44.8958 54.0901 45.1855 53.9551 45.4724 53.8904C45.7593 53.8229 46.0518 53.8201 46.3415 53.8117C47.0249 53.7948 47.7083 53.7526 48.3805 53.8145C48.8052 53.851 49.2215 53.9298 49.6433 53.9692C50.3493 54.0367 51.0833 54.0029 51.7921 53.7948C52.5543 53.5698 53.2799 53.1507 54.0562 53.0354C54.374 52.9876 54.6918 52.9932 55.0012 53.0382C55.3162 53.0804 55.6312 53.1676 55.873 53.3617C56.0587 53.5079 56.1937 53.7076 56.2977 53.9214C56.4552 54.242 56.5508 54.5935 56.6071 54.9564C56.6549 55.277 56.6746 55.606 56.7562 55.9154C56.8912 56.4245 57.2005 56.8576 57.569 57.2092C57.9402 57.5607 58.3705 57.8392 58.8037 58.1148C59.234 58.3876 59.6671 58.6576 60.1255 58.8826C60.3421 58.9895 60.5643 59.0851 60.7696 59.206C60.9777 59.3298 61.169 59.4789 61.3068 59.6757C61.4924 59.9429 61.5655 60.2945 61.5093 60.6404Z" fill="url(#paint5_linear_6709_29666)"/>
-</g>
-</g>
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="url(#paint6_linear_6709_29666)"/>
-<mask id="mask13_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="22" height="22">
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="white"/>
-</mask>
-<g mask="url(#mask13_6709_29666)">
-<g filter="url(#filter13_f_6709_29666)">
-<path d="M65.5909 60.7838C65.4418 61.1579 65.2309 61.5094 64.9665 61.816C64.3843 62.4966 63.5799 62.9438 62.7784 63.346C61.4059 64.0323 59.9884 64.6341 58.7003 65.461C57.8396 66.0151 57.0409 66.6648 56.2956 67.3679C55.6599 67.9669 55.0553 68.6082 54.3409 69.1144C53.6181 69.6291 52.7856 69.9976 51.9081 70.1269C50.8393 70.2844 49.7368 70.0819 48.744 69.6573C48.0521 69.3591 47.3827 68.9373 46.9806 68.2988C46.5812 67.6632 46.4884 66.8869 46.4884 66.136C46.4827 64.8113 46.7331 63.5007 46.9693 62.1985C47.1662 61.1157 47.3518 60.0301 47.4699 58.936C47.6837 56.9448 47.6753 54.9366 47.5403 52.9398C47.5178 52.6051 47.4924 52.2676 47.5431 51.9357C47.5937 51.6038 47.7315 51.2748 47.9846 51.0554C48.2237 50.8501 48.5443 50.7601 48.8593 50.746C49.1715 50.7291 49.4837 50.7798 49.7959 50.8248C50.5299 50.9316 51.2668 51.0132 51.984 51.1988C52.4368 51.3169 52.8784 51.4744 53.3284 51.5926C54.0821 51.7951 54.8724 51.8907 55.6459 51.8007C56.4812 51.7051 57.2912 51.3957 58.1293 51.4154C58.4752 51.4238 58.8156 51.4885 59.1446 51.5897C59.4793 51.6938 59.8112 51.8429 60.0587 52.0904C60.2443 52.2788 60.3709 52.5151 60.4749 52.7598C60.624 53.1226 60.7252 53.5107 60.7309 53.9044C60.7393 54.3151 60.6521 54.7257 60.7056 55.1335C60.7506 55.4626 60.8912 55.7748 61.0712 56.056C61.2484 56.3373 61.4649 56.5932 61.6815 56.8463C62.0978 57.3385 62.514 57.8391 63.0371 58.216C63.6306 58.6463 64.3365 58.8994 64.9496 59.2988C65.1324 59.4198 65.3096 59.5548 65.439 59.7319C65.6584 60.0301 65.7146 60.4351 65.5909 60.7838Z" fill="#CD8907"/>
-</g>
-</g>
-<mask id="mask14_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="22" height="22">
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="white"/>
-</mask>
-<g mask="url(#mask14_6709_29666)">
-<g filter="url(#filter14_f_6709_29666)">
-<path d="M65.5058 60.3592C65.3371 60.7389 65.1205 61.0905 64.8646 61.4027C64.2683 62.1283 63.4612 62.6261 62.6146 62.9467C61.2168 63.4755 59.6924 63.5458 58.3227 64.1477C57.4874 64.5133 56.7337 65.0645 55.9715 65.5877C55.3583 66.0067 54.7283 66.4145 54.0533 66.707C53.2883 67.0417 52.4783 67.2273 51.6627 67.3595C51.1452 67.4411 50.6193 67.503 50.0962 67.4748C49.573 67.4467 49.0499 67.323 48.5858 67.0558C48.2371 66.8533 47.9221 66.5636 47.7337 66.1839C47.5283 65.7648 47.4918 65.2727 47.4946 64.7945C47.5087 63.5289 47.7815 62.2745 47.773 61.0061C47.7646 59.9008 47.5452 58.8123 47.4833 57.7098C47.3624 55.5892 47.818 53.4348 47.4158 51.3564C47.354 51.0217 47.2668 50.6898 47.2696 50.3495C47.2724 50.1808 47.2977 50.0092 47.3568 49.8517C47.4187 49.697 47.5143 49.5536 47.6408 49.4523C47.7505 49.3708 47.8771 49.3202 48.0093 49.2948C48.1387 49.2723 48.2737 49.278 48.4058 49.2977C48.6674 49.3398 48.9177 49.4411 49.1737 49.517C49.9049 49.7364 50.6783 49.7308 51.4237 49.8967C51.8905 49.998 52.3405 50.1695 52.8046 50.2933C53.578 50.507 54.388 50.597 55.184 50.5042C56.039 50.403 56.8743 50.0936 57.7349 50.1161C58.0893 50.1245 58.438 50.1892 58.7783 50.2905C59.1187 50.3917 59.459 50.5352 59.7177 50.7967C59.9005 50.9852 60.0355 51.2242 60.1424 51.4717C60.3027 51.8345 60.4124 52.2283 60.4096 52.6277C60.4068 52.8358 60.3758 53.0411 60.3562 53.2492C60.3393 53.4573 60.3337 53.6683 60.3815 53.868C60.4321 54.0705 60.5362 54.2533 60.6543 54.4192C60.7724 54.5852 60.9074 54.7342 61.0312 54.8973C61.3743 55.3502 61.6218 55.8789 61.889 56.388C62.1562 56.897 62.4571 57.4005 62.8818 57.7689C63.4583 58.2667 64.2037 58.4664 64.8477 58.863C65.0362 58.9783 65.2162 59.1133 65.3483 59.2989C65.4552 59.4452 65.5255 59.6223 65.5537 59.808C65.579 59.9908 65.5621 60.1848 65.5058 60.3592Z" fill="#F5C021"/>
-</g>
-</g>
-<mask id="mask15_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="22" height="22">
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="white"/>
-</mask>
-<g mask="url(#mask15_6709_29666)">
-<g filter="url(#filter15_f_6709_29666)">
-<path d="M47.2732 51.0695C48.0663 50.8557 48.7413 51.4576 49.3179 51.9104C49.6891 52.2282 50.2291 52.1495 50.6848 52.1635C51.4413 52.1382 52.1923 52.2901 52.9488 52.1973C54.4395 52.0707 55.8991 51.7051 57.3954 51.6432C58.1098 51.5982 58.9141 51.556 59.5301 51.9723C59.7804 52.1467 60.1488 52.8807 60.3935 52.6051C60.2923 51.8345 59.7213 51.0892 58.9563 50.8839C58.3545 50.7882 57.747 50.9542 57.1395 50.9007C55.3423 50.8585 53.5535 50.5239 51.7507 50.6195C50.4963 50.6307 49.2448 50.5717 47.9904 50.5239C47.4982 50.4226 47.3238 50.8585 47.0566 51.0273C47.127 51.0807 47.1523 51.0976 47.2732 51.0695Z" fill="url(#paint7_linear_6709_29666)"/>
-</g>
-</g>
-<mask id="mask16_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="22" height="22">
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="white"/>
-</mask>
-<g mask="url(#mask16_6709_29666)">
-<g opacity="0.35" filter="url(#filter16_f_6709_29666)">
-<path d="M57.7941 52.7655C57.6591 52.4983 57.4116 52.2986 57.1332 52.1833C56.8575 52.068 56.5538 52.0286 56.2528 52.0314C55.6538 52.037 55.0575 52.1917 54.4585 52.1411C53.955 52.0961 53.4769 51.9077 52.9847 51.7867C52.4757 51.663 51.9357 51.6152 51.4322 51.753C50.8922 51.8992 50.4169 52.262 50.1188 52.7345C49.8544 53.1508 49.7307 53.643 49.6913 54.1352C49.6519 54.6274 49.6941 55.1195 49.7447 55.6117C49.7785 55.9661 49.8207 56.3205 49.905 56.6664C49.9922 57.0124 50.1244 57.3499 50.3325 57.6395C50.6335 58.0558 51.0807 58.3539 51.5616 58.5311C52.3491 58.8208 53.2435 58.8067 54.0169 58.4889C55.3894 57.8927 56.551 56.8239 57.2569 55.5077C57.5128 55.0352 57.7097 54.5317 57.8363 54.0142C57.8869 53.8061 57.9263 53.5952 57.9263 53.3814C57.9291 53.1705 57.8925 52.9539 57.7941 52.7655Z" fill="url(#paint8_radial_6709_29666)"/>
-</g>
-</g>
-<mask id="mask17_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="45" y="50" width="22" height="22">
-<path d="M65.6637 62.6963C65.0281 63.4501 64.1449 63.9479 63.2646 64.3979C61.7656 65.1601 60.2103 65.8323 58.8012 66.752C57.8562 67.3679 56.9843 68.0907 56.1687 68.8698C55.4712 69.5363 54.8103 70.2479 54.0284 70.8132C53.2381 71.3841 52.3268 71.7976 51.3621 71.941C51.0949 71.9804 50.8278 72.0001 50.5578 72.0001C49.6465 72.0001 48.7353 71.7807 47.8971 71.4151C47.1378 71.086 46.4065 70.6107 45.9678 69.9076C45.529 69.1988 45.4278 68.3354 45.4278 67.5001C45.4249 66.0291 45.6978 64.5723 45.9537 63.121C46.1674 61.9145 46.3699 60.7079 46.5021 59.4901C46.7412 57.2795 46.7384 55.0435 46.5809 52.8216C46.5528 52.4504 46.5218 52.0763 46.5781 51.7079C46.6343 51.3395 46.7862 50.971 47.0674 50.7291C47.329 50.5041 47.6778 50.4029 48.0237 50.386C48.3668 50.3663 48.7099 50.4198 49.0503 50.4704C49.8518 50.5885 50.6618 50.6785 51.4465 50.8866C51.9415 51.016 52.4253 51.1904 52.9174 51.3254C53.7443 51.5476 54.6078 51.6545 55.4543 51.556C56.3684 51.4491 57.2571 51.106 58.1768 51.1285C58.5537 51.137 58.9278 51.2073 59.2878 51.3226C59.6534 51.4379 60.0162 51.6038 60.2862 51.8795C60.4915 52.0876 60.6349 52.3491 60.7418 52.622C60.9021 53.027 60.9893 53.4601 61.0259 53.8932C61.0568 54.2785 61.0512 54.6695 61.1243 55.0491C61.2453 55.6707 61.5743 56.2416 61.9793 56.7282C62.3871 57.2176 62.8737 57.631 63.3603 58.0388C63.8468 58.4466 64.3334 58.8516 64.8565 59.2088C65.1012 59.3776 65.3543 59.5351 65.5878 59.7179C65.8212 59.9035 66.0349 60.1173 66.1812 60.376C66.3078 60.6038 66.3753 60.8598 66.3753 61.1213C66.3753 61.2676 66.3556 61.4138 66.3106 61.5601C66.184 61.9623 65.9506 62.3532 65.6637 62.6963Z" fill="white"/>
-</mask>
-<g mask="url(#mask17_6709_29666)">
-<g opacity="0.35" filter="url(#filter17_f_6709_29666)">
-<path d="M57.7941 52.0002C57.6591 51.8061 57.4116 51.6627 57.1332 51.5783C56.8575 51.4939 56.5538 51.4686 56.2528 51.4686C55.6538 51.4742 55.0575 51.5867 54.4585 51.5473C53.955 51.5164 53.4769 51.3786 52.9847 51.2942C52.4757 51.2042 51.9357 51.1677 51.4322 51.2689C50.8922 51.373 50.4169 51.6345 50.1188 51.9777C49.8544 52.2786 49.7307 52.6358 49.6913 52.9902C49.6519 53.3445 49.6941 53.7017 49.7447 54.0561C49.7785 54.312 49.8207 54.5708 49.905 54.8211C49.9922 55.0714 50.1244 55.3161 50.3325 55.5242C50.6335 55.8252 51.0807 56.0389 51.5616 56.1683C52.3491 56.3792 53.2435 56.368 54.0169 56.1373C55.3894 55.707 56.551 54.9336 57.2569 53.983C57.5128 53.6398 57.7097 53.277 57.8363 52.903C57.8869 52.7511 57.9263 52.5992 57.9263 52.4473C57.9291 52.2927 57.8925 52.1352 57.7941 52.0002Z" fill="url(#paint9_radial_6709_29666)"/>
-</g>
-</g>
-<path d="M58.9363 50.2652C58.8378 49.998 58.6635 49.7618 58.4525 49.5705C58.2416 49.3793 57.9913 49.233 57.7297 49.1205C57.2066 48.8983 56.6356 48.814 56.0731 48.7099C55.5472 48.6115 55.0213 48.4905 54.4925 48.4005C53.9413 48.3077 53.3731 48.2458 52.8275 48.3696C52.3522 48.4765 51.9106 48.724 51.5506 49.053C51.1906 49.3821 50.9094 49.7927 50.7069 50.2371C50.3497 51.0218 50.2372 51.9021 50.3047 52.7599C50.3553 53.3983 50.5185 54.0565 50.9375 54.5374C51.2778 54.9283 51.7588 55.173 52.2538 55.3193C53.1088 55.5724 54.0397 55.5583 54.8863 55.2827C56.2841 54.813 57.5216 53.8821 58.3597 52.6699C58.6353 52.2677 58.8716 51.8318 58.9785 51.3593C59.06 50.9993 59.0628 50.6112 58.9363 50.2652Z" fill="#020204"/>
-<mask id="mask18_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="50" y="48" width="10" height="8">
-<path d="M58.9363 50.2652C58.8378 49.998 58.6635 49.7618 58.4525 49.5705C58.2416 49.3793 57.9913 49.233 57.7297 49.1205C57.2066 48.8983 56.6356 48.814 56.0731 48.7099C55.5472 48.6115 55.0213 48.4905 54.4925 48.4005C53.9413 48.3077 53.3731 48.2458 52.8275 48.3696C52.3522 48.4765 51.9106 48.724 51.5506 49.053C51.1906 49.3821 50.9094 49.7927 50.7069 50.2371C50.3497 51.0218 50.2372 51.9021 50.3047 52.7599C50.3553 53.3983 50.5185 54.0565 50.9375 54.5374C51.2778 54.9283 51.7588 55.173 52.2538 55.3193C53.1088 55.5724 54.0397 55.5583 54.8863 55.2827C56.2841 54.813 57.5216 53.8821 58.3597 52.6699C58.6353 52.2677 58.8716 51.8318 58.9785 51.3593C59.06 50.9993 59.0628 50.6112 58.9363 50.2652Z" fill="white"/>
-</mask>
-<g mask="url(#mask18_6709_29666)">
-<g filter="url(#filter18_f_6709_29666)">
-<path d="M53.1254 48.1136C52.9932 48.1221 52.8638 48.1361 52.7317 48.1614C51.8907 48.3105 51.1201 48.8421 50.687 49.5761C50.3804 50.0964 50.2426 50.7096 50.2848 51.3114C50.3045 50.8896 50.4142 50.4761 50.6195 50.1077C50.9654 49.4805 51.5954 49.008 52.3013 48.8786C52.7345 48.7999 53.1817 48.8477 53.6176 48.9011C54.0395 48.9546 54.4613 49.0108 54.8748 49.098C55.516 49.2386 56.1488 49.4524 56.686 49.8264C56.8098 49.9136 56.9279 50.0121 57.0263 50.1302C57.1248 50.2455 57.2007 50.3805 57.2317 50.5296C57.2738 50.7489 57.212 50.9796 57.1023 51.1736C56.9926 51.3705 56.8435 51.5392 56.686 51.6967C56.5567 51.8261 56.4217 51.9471 56.2838 52.068C56.9054 51.9471 57.5326 51.7783 58.0501 51.4183C58.2667 51.2636 58.4663 51.0808 58.5957 50.8502C58.7251 50.6168 58.7785 50.3355 58.7167 50.0768C58.6717 49.9024 58.576 49.7421 58.4579 49.6071C58.3398 49.4721 58.1963 49.3624 58.0501 49.2583C57.4004 48.8027 56.641 48.513 55.8535 48.4174C55.3473 48.3246 54.8382 48.2458 54.3292 48.1839C53.9326 48.1333 53.5248 48.0911 53.1254 48.1136Z" fill="url(#paint10_radial_6709_29666)"/>
-</g>
-</g>
-<mask id="mask19_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="50" y="48" width="10" height="8">
-<path d="M58.9363 50.2652C58.8378 49.998 58.6635 49.7618 58.4525 49.5705C58.2416 49.3793 57.9913 49.233 57.7297 49.1205C57.2066 48.8983 56.6356 48.814 56.0731 48.7099C55.5472 48.6115 55.0213 48.4905 54.4925 48.4005C53.9413 48.3077 53.3731 48.2458 52.8275 48.3696C52.3522 48.4765 51.9106 48.724 51.5506 49.053C51.1906 49.3821 50.9094 49.7927 50.7069 50.2371C50.3497 51.0218 50.2372 51.9021 50.3047 52.7599C50.3553 53.3983 50.5185 54.0565 50.9375 54.5374C51.2778 54.9283 51.7588 55.173 52.2538 55.3193C53.1088 55.5724 54.0397 55.5583 54.8863 55.2827C56.2841 54.813 57.5216 53.8821 58.3597 52.6699C58.6353 52.2677 58.8716 51.8318 58.9785 51.3593C59.06 50.9993 59.0628 50.6112 58.9363 50.2652Z" fill="white"/>
-</mask>
-<g mask="url(#mask19_6709_29666)">
-<g filter="url(#filter19_f_6709_29666)">
-<path d="M53.1254 48.1136C52.9932 48.1221 52.8638 48.1361 52.7317 48.1614C51.8907 48.3105 51.1201 48.8421 50.687 49.5761C50.3804 50.0964 50.2426 50.7096 50.2848 51.3114C50.3045 50.8896 50.4142 50.4761 50.6195 50.1077C50.9654 49.4805 51.5954 49.008 52.3013 48.8786C52.7345 48.7999 53.1817 48.8477 53.6176 48.9011C54.0395 48.9546 54.4613 49.0108 54.8748 49.098C55.516 49.2386 56.1488 49.4524 56.686 49.8264C56.8098 49.9136 56.9279 50.0121 57.0263 50.1302C57.1248 50.2455 57.2007 50.3805 57.2317 50.5296C57.2738 50.7489 57.212 50.9796 57.1023 51.1736C56.9926 51.3705 56.8435 51.5392 56.686 51.6967C56.5567 51.8261 56.4217 51.9471 56.2838 52.068C56.9054 51.9471 57.5326 51.7783 58.0501 51.4183C58.2667 51.2636 58.4663 51.0808 58.5957 50.8502C58.7251 50.6168 58.7785 50.3355 58.7167 50.0768C58.6717 49.9024 58.576 49.7421 58.4579 49.6071C58.3398 49.4721 58.1963 49.3624 58.0501 49.2583C57.4004 48.8027 56.641 48.513 55.8535 48.4174C55.3473 48.3246 54.8382 48.2458 54.3292 48.1839C53.9326 48.1333 53.5248 48.0911 53.1254 48.1136Z" fill="url(#paint11_linear_6709_29666)"/>
-</g>
-</g>
-<path d="M29.3767 10.7664C28.9464 10.7889 28.533 10.9885 28.218 11.2839C27.9002 11.5792 27.678 11.9673 27.5402 12.3751C27.2673 13.1964 27.3292 14.0851 27.3911 14.9485C27.4473 15.7276 27.5064 16.5235 27.7989 17.2492C27.9452 17.6148 28.1505 17.9551 28.4233 18.2364C28.6961 18.5148 29.042 18.7314 29.4217 18.8242C29.7761 18.9142 30.1586 18.8973 30.5073 18.7876C30.8589 18.6751 31.1767 18.4754 31.4411 18.2195C31.8236 17.8454 32.0795 17.356 32.2286 16.8414C32.3777 16.3267 32.4198 15.7867 32.4114 15.2495C32.4002 14.5801 32.313 13.9079 32.1049 13.2723C31.8939 12.6367 31.5592 12.0348 31.0924 11.5539C30.8674 11.3204 30.6086 11.1179 30.3189 10.9745C30.0264 10.831 29.7002 10.7495 29.3767 10.7664Z" fill="url(#paint12_radial_6709_29666)"/>
-<path d="M28.3361 14.3409C28.2461 14.8866 28.2433 15.4575 28.4289 15.975C28.5527 16.3181 28.758 16.6303 29.0055 16.8975C29.1658 17.0719 29.3514 17.2294 29.5652 17.3334C29.7818 17.4375 30.0293 17.4797 30.2627 17.4234C30.4764 17.37 30.6621 17.2322 30.7999 17.0606C30.9377 16.8891 31.0305 16.6837 31.0952 16.4728C31.2893 15.8512 31.2583 15.1734 31.0643 14.5519C30.9264 14.0991 30.693 13.6631 30.333 13.3594C30.1586 13.2131 29.9561 13.0978 29.7368 13.0472C29.5174 12.9937 29.2783 13.0078 29.073 13.1006C28.8452 13.2047 28.668 13.4016 28.5527 13.6237C28.4374 13.8459 28.3783 14.0934 28.3361 14.3409Z" fill="#020204"/>
-<mask id="mask20_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="28" y="13" width="4" height="5">
-<path d="M28.3361 14.3409C28.2461 14.8866 28.2433 15.4575 28.4289 15.975C28.5527 16.3181 28.758 16.6303 29.0055 16.8975C29.1658 17.0719 29.3514 17.2294 29.5652 17.3334C29.7818 17.4375 30.0293 17.4797 30.2627 17.4234C30.4764 17.37 30.6621 17.2322 30.7999 17.0606C30.9377 16.8891 31.0305 16.6837 31.0952 16.4728C31.2893 15.8512 31.2583 15.1734 31.0643 14.5519C30.9264 14.0991 30.693 13.6631 30.333 13.3594C30.1586 13.2131 29.9561 13.0978 29.7368 13.0472C29.5174 12.9937 29.2783 13.0078 29.073 13.1006C28.8452 13.2047 28.668 13.4016 28.5527 13.6237C28.4374 13.8459 28.3783 14.0934 28.3361 14.3409Z" fill="white"/>
-</mask>
-<g mask="url(#mask20_6709_29666)">
-<g filter="url(#filter20_f_6709_29666)">
-<path d="M29.4861 13.9471C29.5452 14.1018 29.7421 14.158 29.8518 14.2818C29.9558 14.3999 30.0655 14.5265 30.1246 14.6755C30.2343 14.9596 30.0149 15.3815 30.2455 15.584C30.3158 15.6459 30.4621 15.6487 30.5324 15.584C30.8108 15.3309 30.7489 14.8218 30.6393 14.4618C30.538 14.1384 30.2933 13.829 29.9896 13.6743C29.8489 13.6012 29.638 13.5421 29.5171 13.6434C29.4411 13.7109 29.4496 13.8515 29.4861 13.9471Z" fill="url(#paint13_linear_6709_29666)"/>
-</g>
-</g>
-<mask id="mask21_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="10" width="6" height="9">
-<path d="M29.3767 10.7664C28.9464 10.7889 28.533 10.9885 28.218 11.2839C27.9002 11.5792 27.678 11.9673 27.5402 12.3751C27.2673 13.1964 27.3292 14.0851 27.3911 14.9485C27.4473 15.7276 27.5064 16.5235 27.7989 17.2492C27.9452 17.6148 28.1505 17.9551 28.4233 18.2364C28.6961 18.5148 29.042 18.7314 29.4217 18.8242C29.7761 18.9142 30.1586 18.8973 30.5073 18.7876C30.8589 18.6751 31.1767 18.4754 31.4411 18.2195C31.8236 17.8454 32.0795 17.356 32.2286 16.8414C32.3777 16.3267 32.4198 15.7867 32.4114 15.2495C32.4002 14.5801 32.313 13.9079 32.1049 13.2723C31.8939 12.6367 31.5592 12.0348 31.0924 11.5539C30.8674 11.3204 30.6086 11.1179 30.3189 10.9745C30.0264 10.831 29.7002 10.7495 29.3767 10.7664Z" fill="white"/>
-</mask>
-<g mask="url(#mask21_6709_29666)">
-<path d="M28.4453 12.5046C29.0978 12.1165 29.8881 12.0265 30.6447 12.0968C31.3984 12.1699 32.1269 12.3893 32.8581 12.589C33.3953 12.7352 33.9381 12.8702 34.4416 13.1065C34.9422 13.3427 35.4091 13.6915 35.6875 14.1752C35.7325 14.2512 35.7691 14.3327 35.8169 14.4087C35.8647 14.4846 35.9209 14.5549 35.9912 14.6083C36.0616 14.6618 36.1516 14.6983 36.2387 14.6927C36.2837 14.6899 36.3287 14.6787 36.3653 14.6562C36.4047 14.6337 36.4384 14.5999 36.4581 14.5605C36.4806 14.5155 36.4891 14.4621 36.4862 14.4115C36.4834 14.3608 36.4722 14.3102 36.4581 14.2596C36.2753 13.593 35.8422 13.0277 35.5159 12.4174C35.3191 12.0518 35.1559 11.6693 34.9591 11.3037C34.2756 10.0521 33.1534 9.07054 31.8794 8.4321C30.6053 7.79366 29.1822 7.4871 27.7591 7.40554C26.1109 7.3071 24.46 7.50397 22.8344 7.79085C22.1284 7.9146 21.4112 8.06085 20.7897 8.41241C20.4775 8.58679 20.1906 8.81179 19.9684 9.09304C19.7434 9.37147 19.5859 9.70616 19.5325 10.0605C19.4847 10.4037 19.5353 10.7552 19.6562 11.0787C19.7744 11.4021 19.96 11.6974 20.1794 11.9646C20.6125 12.5018 21.1722 12.918 21.6869 13.3793C22.2016 13.8377 22.6769 14.3468 23.2534 14.7265C23.5403 14.9177 23.8525 15.0752 24.1844 15.168C24.5162 15.2608 24.8706 15.2862 25.2081 15.2158C25.5569 15.1455 25.8831 14.974 26.1672 14.7546C26.4512 14.538 26.6959 14.2765 26.9294 14.0065C27.3962 13.4637 27.8322 12.8702 28.4453 12.5046Z" fill="url(#paint14_radial_6709_29666)"/>
-</g>
-<g filter="url(#filter21_f_6709_29666)">
-<path d="M31.1545 10.2853C31.762 10.8535 32.212 11.5566 32.5185 12.2991C32.3835 11.4806 32.1726 10.8197 31.6382 10.2853C31.312 9.97877 30.9379 9.70877 30.5189 9.52034C30.1476 9.3544 29.7398 9.25034 29.5035 9.24752C29.2701 9.2419 29.2138 9.24752 29.166 9.25034C29.1154 9.25315 29.0789 9.25315 29.2307 9.27284C29.3826 9.28971 29.7229 9.38252 30.0885 9.54565C30.4542 9.70877 30.8254 9.97877 31.1545 10.2853Z" fill="url(#paint15_linear_6709_29666)"/>
-</g>
-<path d="M37.0154 10.7666C36.3432 11.2307 35.7779 11.8747 35.5023 12.6454C35.1535 13.6157 35.2857 14.7013 35.6232 15.6744C35.9664 16.6729 36.5429 17.6235 37.412 18.2226C37.8451 18.5235 38.3485 18.7288 38.8717 18.7907C39.3976 18.8526 39.9404 18.7654 40.4101 18.5235C40.9782 18.2254 41.4142 17.7051 41.6842 17.1229C41.9542 16.5379 42.0695 15.8938 42.106 15.2497C42.151 14.4341 42.0723 13.6016 41.8023 12.8282C41.5098 11.9872 40.981 11.211 40.2329 10.7272C39.8617 10.4854 39.437 10.3194 38.9954 10.2576C38.5539 10.1957 38.0982 10.2435 37.682 10.4038C37.4457 10.4966 37.2264 10.6232 37.0154 10.7666Z" fill="url(#paint16_radial_6709_29666)"/>
-<path d="M38.5707 12.8025C38.3176 12.8194 38.0701 12.9066 37.8535 13.0416C37.6398 13.1766 37.457 13.3594 37.3135 13.5703C37.0238 13.9894 36.8973 14.5013 36.8776 15.0103C36.8635 15.39 36.9057 15.7753 37.0323 16.1353C37.1588 16.4953 37.3698 16.83 37.6651 17.0719C37.966 17.3222 38.3457 17.4713 38.7366 17.4909C39.1276 17.5078 39.5213 17.3953 39.842 17.1731C40.0979 16.9959 40.3032 16.7513 40.4495 16.4756C40.5957 16.2028 40.6857 15.8991 40.7251 15.5897C40.7954 15.0469 40.7166 14.4788 40.4635 13.9894C40.2132 13.5 39.7857 13.0978 39.271 12.9094C39.046 12.8278 38.807 12.7856 38.5707 12.8025Z" fill="#020204"/>
-<mask id="mask22_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="36" y="12" width="5" height="6">
-<path d="M38.5707 12.8025C38.3176 12.8194 38.0701 12.9066 37.8535 13.0416C37.6398 13.1766 37.457 13.3594 37.3135 13.5703C37.0238 13.9894 36.8973 14.5013 36.8776 15.0103C36.8635 15.39 36.9057 15.7753 37.0323 16.1353C37.1588 16.4953 37.3698 16.83 37.6651 17.0719C37.966 17.3222 38.3457 17.4713 38.7366 17.4909C39.1276 17.5078 39.5213 17.3953 39.842 17.1731C40.0979 16.9959 40.3032 16.7513 40.4495 16.4756C40.5957 16.2028 40.6857 15.8991 40.7251 15.5897C40.7954 15.0469 40.7166 14.4788 40.4635 13.9894C40.2132 13.5 39.7857 13.0978 39.271 12.9094C39.046 12.8278 38.807 12.7856 38.5707 12.8025Z" fill="white"/>
-</mask>
-<g mask="url(#mask22_6709_29666)">
-<g filter="url(#filter22_f_6709_29666)">
-<path d="M40.1373 15.0075C40.4185 14.7262 39.9376 13.9809 39.5607 13.6743C39.2879 13.455 38.4976 13.2215 38.5313 13.4634C38.5651 13.7025 38.9223 14.0118 39.1585 14.2481C39.4538 14.5378 40.0023 15.1425 40.1373 15.0075Z" fill="url(#paint17_linear_6709_29666)"/>
-</g>
-</g>
-<mask id="mask23_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="35" y="10" width="8" height="9">
-<path d="M37.0154 10.7666C36.3432 11.2307 35.7779 11.8747 35.5023 12.6454C35.1535 13.6157 35.2857 14.7013 35.6232 15.6744C35.9664 16.6729 36.5429 17.6235 37.412 18.2226C37.8451 18.5235 38.3485 18.7288 38.8717 18.7907C39.3976 18.8526 39.9404 18.7654 40.4101 18.5235C40.9782 18.2254 41.4142 17.7051 41.6842 17.1229C41.9542 16.5379 42.0695 15.8938 42.106 15.2497C42.151 14.4341 42.0723 13.6016 41.8023 12.8282C41.5098 11.9872 40.981 11.211 40.2329 10.7272C39.8617 10.4854 39.437 10.3194 38.9954 10.2576C38.5539 10.1957 38.0982 10.2435 37.682 10.4038C37.4457 10.4966 37.2264 10.6232 37.0154 10.7666Z" fill="white"/>
-</mask>
-<g mask="url(#mask23_6709_29666)">
-<path d="M34.4703 13.2218C35.0496 12.7408 35.7218 12.3752 36.439 12.153C37.9156 11.6974 39.589 11.8774 40.894 12.7071C41.344 12.9912 41.7462 13.3455 42.1653 13.6774C42.5815 14.0065 43.0259 14.3158 43.5293 14.493C43.8021 14.5887 44.0918 14.6449 44.3787 14.614C44.6374 14.5887 44.8878 14.4902 45.1015 14.344C45.3153 14.1949 45.4953 13.998 45.6303 13.7758C45.9003 13.3315 45.9874 12.7915 45.9396 12.274C45.8468 11.2362 45.2618 10.3221 44.7724 9.40241C44.6178 9.11553 44.4715 8.82303 44.2859 8.55584C43.7206 7.73178 42.8149 7.18897 41.8671 6.87116C40.9193 6.55334 39.9181 6.43803 38.9253 6.31428C38.4809 6.25803 38.0337 6.19897 37.5921 6.25241C37.0831 6.31428 36.6049 6.51959 36.1071 6.64616C35.8709 6.70803 35.6318 6.75022 35.3984 6.81772C35.1649 6.88522 34.9343 6.97803 34.7431 7.12991C34.4674 7.35209 34.2931 7.68678 34.2171 8.03272C34.1412 8.38147 34.1581 8.74147 34.2143 9.09303C34.324 9.79616 34.5884 10.4796 34.5631 11.1912C34.5462 11.6777 34.3915 12.1587 34.4112 12.6452C34.4168 12.7887 34.4449 13.0812 34.4703 13.2218Z" fill="url(#paint18_linear_6709_29666)"/>
-</g>
-<g filter="url(#filter23_f_6709_29666)">
-<path d="M39.3556 8.76953C39.2403 8.91578 39.1362 9.07328 39.0547 9.24766C39.575 9.36016 40.07 9.57391 40.5144 9.86922C41.375 10.4402 42.0275 11.2727 42.4859 12.2008C42.5928 12.0827 42.6884 11.9561 42.7728 11.8155C42.3116 10.848 41.6478 9.97328 40.7591 9.38266C40.3316 9.10141 39.8562 8.88484 39.3556 8.76953Z" fill="url(#paint19_linear_6709_29666)"/>
-</g>
-<mask id="mask24_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask24_6709_29666)">
-<g filter="url(#filter24_f_6709_29666)">
-<path d="M28.4399 25.1238C28.8533 26.3219 29.683 27.3429 30.6674 28.1388C30.9936 28.406 31.3395 28.6507 31.7249 28.8223C32.1074 28.9966 32.532 29.0951 32.9511 29.0585C33.3617 29.0248 33.7527 28.8616 34.1127 28.6591C34.4727 28.4566 34.8045 28.2119 35.1533 27.9926C35.7495 27.6129 36.388 27.3063 37.0095 26.9688C37.7549 26.561 38.4805 26.0969 39.1077 25.5232C39.3974 25.2616 39.6645 24.9748 39.9824 24.7498C40.3002 24.5219 40.6827 24.3588 41.0708 24.3869C41.3633 24.4066 41.6361 24.5304 41.923 24.5923C42.0664 24.6232 42.2127 24.6373 42.3589 24.6148C42.5024 24.5923 42.643 24.5332 42.7442 24.4263C42.868 24.2969 42.9242 24.1113 42.9158 23.9313C42.9102 23.7541 42.8483 23.5798 42.7639 23.4223C42.598 23.1044 42.3449 22.8316 42.2324 22.4913C42.1311 22.1876 42.1508 21.8613 42.1592 21.5435C42.1677 21.2229 42.162 20.891 42.0158 20.6069C41.9033 20.3932 41.7149 20.2216 41.5011 20.1091C41.2874 19.9938 41.0455 19.9348 40.8036 19.9123C40.3199 19.8673 39.8361 19.9629 39.3495 19.9882C38.7083 20.0248 38.0614 19.946 37.4174 19.9826C36.6158 20.0332 35.8283 20.2638 35.0239 20.2666C34.107 20.2694 33.1902 19.9685 32.2845 20.112C31.8936 20.1738 31.5224 20.3144 31.1511 20.4382C30.777 20.5648 30.3917 20.6744 29.998 20.6688C29.5508 20.6604 29.1177 20.5057 28.6705 20.4748C28.4483 20.4579 28.2205 20.4748 28.0095 20.5535C27.8014 20.6323 27.613 20.7757 27.5089 20.9754C27.4499 21.0879 27.4217 21.2173 27.4161 21.3438C27.4105 21.4732 27.4274 21.5998 27.4583 21.7263C27.5202 21.9738 27.6355 22.2073 27.7283 22.4435C28.0658 23.307 28.1389 24.2491 28.4399 25.1238Z" fill="black" fill-opacity="0.258824"/>
-</g>
-</g>
-<mask id="mask25_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="16" y="0" width="41" height="71">
-<path d="M35.705 0C34.0175 0 32.3244 0.331875 30.7944 1.15875C29.1687 2.03344 27.8356 3.43406 27.0172 5.08781C26.1959 6.74156 25.8753 8.50781 25.8247 10.4541C25.7319 14.1497 25.9091 18.0253 26.1875 21.5381C26.2606 22.6069 26.3956 23.2313 26.2578 24.3309C25.8022 26.6653 23.7603 28.2347 22.6691 30.285C21.4681 32.5462 20.9619 35.1028 20.0562 37.4991C19.2266 39.69 18.0622 41.7459 17.2775 43.9538C16.1778 47.0391 15.8487 50.4309 16.5744 53.6259C17.1284 56.0616 18.2844 58.3453 19.8425 60.3C19.6175 60.705 19.3981 61.1184 19.1675 61.5206C18.4447 62.7666 17.5616 63.9506 17.1509 65.3316C16.9456 66.0206 16.8641 66.7575 16.9962 67.4662C17.1284 68.175 17.4884 68.8528 18.0509 69.3028C18.4194 69.5953 18.8666 69.7866 19.325 69.8934C19.7834 69.9975 20.2587 70.0228 20.7312 70.0144C22.5228 69.975 24.2609 69.4322 25.9934 68.9766C27.0228 68.7066 28.0578 68.4675 29.0956 68.2509C32.7912 67.4944 36.9144 67.7981 40.3428 68.2931C41.5044 68.4703 42.6575 68.6981 43.7994 68.9766C45.5881 69.4097 47.3684 69.9609 49.2078 70.0144C49.6916 70.0284 50.1809 70.0059 50.6534 69.9019C51.1259 69.795 51.5844 69.6038 51.9612 69.3028C52.5266 68.8528 52.8866 68.1722 53.0187 67.4634C53.1509 66.7547 53.0694 66.015 52.8612 65.3231C52.445 63.9394 51.5534 62.7609 50.8166 61.5206C50.5241 61.0284 50.2541 60.5278 49.9644 60.0356C52.1862 57.5409 53.975 54.6553 55.01 51.4856C56.1378 48.0262 56.3459 44.2997 55.8706 40.6912C55.3953 37.0828 54.2506 33.5841 52.7459 30.2709C50.8559 26.1197 49.2669 24.6178 48.1138 20.97C46.8706 17.0269 47.8972 12.3609 46.9719 8.78625C46.6428 7.57125 46.1169 6.40969 45.4391 5.34656C44.6459 4.10063 43.6391 2.98688 42.4437 2.12063C40.5369 0.736875 38.1406 0 35.705 0Z" fill="white"/>
-</mask>
-<g mask="url(#mask25_6709_29666)">
-<g opacity="0.3" filter="url(#filter25_f_6709_29666)">
-<path d="M27.29 21.7123C28.0916 22.2073 28.8116 22.8176 29.4163 23.5095C29.976 24.1535 30.4513 24.8848 31.1853 25.3601C31.7 25.6976 32.3216 25.886 32.9516 25.9451C33.6913 26.0126 34.4394 25.9029 35.1538 25.7088C35.8147 25.5317 36.4532 25.2785 37.0382 24.9467C38.1547 24.3138 39.0857 23.3857 40.3147 22.9695C40.5819 22.8767 40.8603 22.812 41.1191 22.6995C41.3778 22.5898 41.6225 22.421 41.7463 22.1848C41.8644 21.9542 41.8588 21.6926 41.8982 21.4423C41.9403 21.1723 42.0332 20.9135 42.0838 20.6463C42.1344 20.3792 42.14 20.0951 42.0163 19.8504C41.9122 19.6479 41.7238 19.4876 41.5072 19.3835C41.2907 19.2823 41.046 19.2373 40.8013 19.226C40.3175 19.2035 39.8366 19.3188 39.35 19.3582C38.7088 19.4117 38.0619 19.3357 37.4178 19.3554C36.6163 19.3779 35.826 19.5438 35.0244 19.5804C34.1103 19.6198 33.1991 19.4848 32.285 19.4567C31.8885 19.4426 31.4891 19.4482 31.101 19.5129C30.71 19.5748 30.3275 19.6957 29.9985 19.8982C29.6778 20.0923 29.4163 20.3595 29.1238 20.5873C28.9775 20.7026 28.82 20.8067 28.6513 20.8882C28.4797 20.967 28.2913 21.0232 28.1 21.0317C28.0016 21.0345 27.9003 21.0288 27.8047 21.0429C27.6388 21.0654 27.4869 21.1526 27.3913 21.2763C27.2957 21.4029 27.2591 21.5632 27.29 21.7123Z" fill="black"/>
-</g>
-</g>
-<path d="M31.4042 16.4613C31.8345 15.9804 32.127 15.3926 32.5376 14.8976C32.743 14.6501 32.982 14.4223 33.2605 14.262C33.5389 14.1016 33.8651 14.0116 34.1858 14.0398C34.543 14.0707 34.8776 14.2479 35.1392 14.4926C35.4008 14.7373 35.5948 15.0466 35.7495 15.3701C35.8986 15.6823 36.0167 16.0113 36.2305 16.2813C36.4583 16.5682 36.7761 16.7623 37.0658 16.9901C37.2092 17.1026 37.3498 17.2235 37.4623 17.367C37.5776 17.5104 37.6648 17.6763 37.7042 17.8563C37.7408 18.0392 37.7211 18.2304 37.6592 18.4048C37.5945 18.5792 37.4876 18.7366 37.3526 18.866C37.0855 19.1248 36.7198 19.2654 36.3514 19.316C35.6145 19.4201 34.8692 19.2007 34.1239 19.2204C33.373 19.2429 32.6361 19.5073 31.8823 19.482C31.5083 19.4679 31.1258 19.3751 30.8164 19.1613C30.6617 19.0516 30.5267 18.9138 30.4283 18.7535C30.3326 18.5932 30.2736 18.4076 30.2651 18.2191C30.2595 18.0391 30.3017 17.8591 30.3748 17.696C30.4451 17.5301 30.5464 17.381 30.6589 17.2404C30.8867 16.962 31.1651 16.7313 31.4042 16.4613Z" fill="url(#paint20_radial_6709_29666)"/>
-<path d="M27.3213 21.108C27.3382 21.1812 27.3635 21.2487 27.4 21.3134C27.4647 21.4202 27.5604 21.5074 27.6616 21.5805C27.7629 21.6565 27.8725 21.7184 27.9794 21.783C28.5447 22.1402 29.006 22.638 29.4166 23.1668C29.965 23.8755 30.4516 24.6602 31.1857 25.1749C31.7032 25.5405 32.3219 25.7459 32.9519 25.8105C33.6916 25.8837 34.4397 25.7655 35.1541 25.5546C35.815 25.3605 36.4535 25.0877 37.0385 24.7249C38.155 24.0387 39.086 23.0318 40.315 22.579C40.5822 22.4805 40.8607 22.4102 41.1194 22.2893C41.3782 22.1655 41.6228 21.9855 41.7466 21.7268C41.8647 21.4793 41.8591 21.1924 41.8985 20.9196C41.9407 20.6299 42.0335 20.3487 42.0841 20.059C42.1347 19.7693 42.1404 19.4599 42.0166 19.1927C41.9125 18.9734 41.7241 18.799 41.5075 18.6893C41.291 18.5768 41.0463 18.5262 40.8016 18.5149C40.3179 18.4924 39.8369 18.6162 39.3504 18.6612C38.7091 18.7202 38.0622 18.6359 37.4182 18.6555C36.6166 18.6809 35.8263 18.8609 35.0247 18.9002C34.1107 18.9424 33.1994 18.8018 32.2854 18.7652C31.8888 18.7484 31.4894 18.754 31.0985 18.8215C30.7075 18.8862 30.325 19.0212 29.9988 19.2462C29.681 19.4655 29.4279 19.7637 29.1354 20.0168C28.9891 20.1434 28.8316 20.2587 28.6572 20.343C28.4857 20.4274 28.2944 20.4809 28.1004 20.4752C28.0019 20.4724 27.8979 20.4584 27.805 20.4865C27.746 20.5062 27.6925 20.5427 27.6475 20.5849C27.6025 20.6299 27.566 20.6805 27.5322 20.7312C27.4507 20.8493 27.3804 20.9759 27.3213 21.108Z" fill="url(#paint21_radial_6709_29666)"/>
-<mask id="mask26_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="18" width="16" height="8">
-<path d="M27.3213 21.108C27.3382 21.1812 27.3635 21.2487 27.4 21.3134C27.4647 21.4202 27.5604 21.5074 27.6616 21.5805C27.7629 21.6565 27.8725 21.7184 27.9794 21.783C28.5447 22.1402 29.006 22.638 29.4166 23.1668C29.965 23.8755 30.4516 24.6602 31.1857 25.1749C31.7032 25.5405 32.3219 25.7459 32.9519 25.8105C33.6916 25.8837 34.4397 25.7655 35.1541 25.5546C35.815 25.3605 36.4535 25.0877 37.0385 24.7249C38.155 24.0387 39.086 23.0318 40.315 22.579C40.5822 22.4805 40.8607 22.4102 41.1194 22.2893C41.3782 22.1655 41.6228 21.9855 41.7466 21.7268C41.8647 21.4793 41.8591 21.1924 41.8985 20.9196C41.9407 20.6299 42.0335 20.3487 42.0841 20.059C42.1347 19.7693 42.1404 19.4599 42.0166 19.1927C41.9125 18.9734 41.7241 18.799 41.5075 18.6893C41.291 18.5768 41.0463 18.5262 40.8016 18.5149C40.3179 18.4924 39.8369 18.6162 39.3504 18.6612C38.7091 18.7202 38.0622 18.6359 37.4182 18.6555C36.6166 18.6809 35.8263 18.8609 35.0247 18.9002C34.1107 18.9424 33.1994 18.8018 32.2854 18.7652C31.8888 18.7484 31.4894 18.754 31.0985 18.8215C30.7075 18.8862 30.325 19.0212 29.9988 19.2462C29.681 19.4655 29.4279 19.7637 29.1354 20.0168C28.9891 20.1434 28.8316 20.2587 28.6572 20.343C28.4857 20.4274 28.2944 20.4809 28.1004 20.4752C28.0019 20.4724 27.8979 20.4584 27.805 20.4865C27.746 20.5062 27.6925 20.5427 27.6475 20.5849C27.6025 20.6299 27.566 20.6805 27.5322 20.7312C27.4507 20.8493 27.3804 20.9759 27.3213 21.108Z" fill="white"/>
-</mask>
-<g mask="url(#mask26_6709_29666)">
-<g filter="url(#filter26_f_6709_29666)">
-<path d="M30.9099 22.095C30.8171 22.4803 30.8733 22.9022 31.0674 23.2509C31.2586 23.5997 31.5849 23.8697 31.9646 23.9963C32.4427 24.1566 32.9827 24.0778 33.4299 23.8444C33.6915 23.7094 33.9277 23.5181 34.0768 23.265C34.1527 23.1413 34.2061 23.0006 34.2258 22.8544C34.2427 22.7109 34.2315 22.5591 34.1808 22.4213C34.1246 22.2722 34.0233 22.14 33.9024 22.0359C33.7786 21.9319 33.6352 21.8559 33.4805 21.8053C33.1768 21.7041 32.7015 21.6197 32.3808 21.6141C31.8127 21.6028 31.0027 21.7097 30.9099 22.095Z" fill="#D9B30D"/>
-</g>
-</g>
-<mask id="mask27_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="18" width="16" height="8">
-<path d="M27.3203 21.108C27.3372 21.1812 27.3625 21.2487 27.3991 21.3134C27.4637 21.4202 27.5594 21.5074 27.6606 21.5805C27.7619 21.6565 27.8716 21.7184 27.9784 21.783C28.5438 22.1402 29.005 22.638 29.4156 23.1668C29.9641 23.8755 30.4506 24.6602 31.1847 25.1749C31.7022 25.5405 32.3209 25.7459 32.9509 25.8105C33.6906 25.8837 34.4387 25.7655 35.1531 25.5546C35.8141 25.3605 36.4525 25.0877 37.0375 24.7249C38.1541 24.0387 39.085 23.0318 40.3141 22.579C40.5812 22.4805 40.8597 22.4102 41.1184 22.2893C41.3772 22.1655 41.6219 21.9855 41.7456 21.7268C41.8637 21.4793 41.8581 21.1924 41.8975 20.9196C41.9397 20.6299 42.0325 20.3487 42.0831 20.059C42.1338 19.7693 42.1394 19.4599 42.0156 19.1927C41.9116 18.9734 41.7231 18.799 41.5066 18.6893C41.29 18.5768 41.0453 18.5262 40.8006 18.5149C40.3169 18.4924 39.8359 18.6162 39.3494 18.6612C38.7081 18.7202 38.0613 18.6359 37.4172 18.6555C36.6156 18.6809 35.8253 18.8609 35.0237 18.9002C34.1097 18.9424 33.1984 18.8018 32.2844 18.7652C31.8878 18.7484 31.4884 18.754 31.0975 18.8215C30.7066 18.8862 30.3241 19.0212 29.9978 19.2462C29.68 19.4655 29.4269 19.7637 29.1344 20.0168C28.9881 20.1434 28.8306 20.2587 28.6562 20.343C28.4847 20.4274 28.2934 20.4809 28.0994 20.4752C28.0009 20.4724 27.8969 20.4584 27.8041 20.4865C27.745 20.5062 27.6916 20.5427 27.6466 20.5849C27.6016 20.6299 27.565 20.6805 27.5312 20.7312C27.4497 20.8493 27.3794 20.9759 27.3203 21.108Z" fill="white"/>
-</mask>
-<g mask="url(#mask27_6709_29666)">
-<g filter="url(#filter27_f_6709_29666)">
-<path d="M29.3368 19.0858C29.0106 19.2771 28.6984 19.488 28.3918 19.7046C28.2315 19.8199 28.0684 19.9408 27.984 20.118C27.925 20.2418 27.9109 20.3824 27.9081 20.5202C27.9081 20.6608 27.9165 20.7986 27.8968 20.9365C27.8856 21.0293 27.8603 21.1221 27.8575 21.2149C27.8546 21.2627 27.8575 21.3105 27.8687 21.3555C27.8828 21.4005 27.9053 21.4455 27.9362 21.4793C27.9784 21.5243 28.0346 21.5524 28.0937 21.5693C28.1528 21.5861 28.2118 21.5946 28.2737 21.6086C28.5578 21.6761 28.8053 21.8505 29.0218 22.0474C29.2384 22.2415 29.4353 22.4636 29.6631 22.6465C30.2762 23.1471 31.089 23.3552 31.8821 23.3665C32.6753 23.3805 33.46 23.2146 34.2334 23.0402C34.8409 22.9024 35.4484 22.7618 36.0306 22.5452C36.9306 22.2133 37.7631 21.7127 38.4831 21.0855C38.8121 20.8015 39.1187 20.4893 39.4871 20.2586C39.8106 20.0533 40.1734 19.9183 40.5053 19.7243C40.5362 19.7074 40.5643 19.6877 40.5896 19.668C40.6178 19.6455 40.6403 19.6174 40.6571 19.5893C40.6825 19.5358 40.6825 19.4711 40.6656 19.4149C40.6487 19.3586 40.615 19.308 40.5784 19.2602C40.5362 19.2096 40.4912 19.1646 40.4406 19.1196C40.0946 18.8243 39.6278 18.7174 39.1721 18.6808C38.7193 18.6471 38.2609 18.6724 37.8137 18.5965C37.3918 18.5261 36.9925 18.3686 36.5846 18.2393C36.1571 18.1015 35.7212 17.9946 35.2796 17.9215C34.2362 17.7499 33.1646 17.7836 32.1325 17.9974C31.1509 18.2027 30.2003 18.574 29.3368 19.0858Z" fill="#604405"/>
-</g>
-</g>
-<path d="M29.2331 17.986C28.7662 18.301 28.3443 18.6864 27.9872 19.1223C27.7847 19.3726 27.599 19.6454 27.4978 19.9492C27.4162 20.191 27.3881 20.4442 27.3375 20.6945C27.3178 20.7873 27.2953 20.8801 27.2981 20.9757C27.2981 21.0207 27.3037 21.0685 27.3178 21.1164C27.3318 21.1614 27.3572 21.2035 27.3881 21.2373C27.4443 21.2935 27.5203 21.3245 27.5962 21.3414C27.675 21.3554 27.7537 21.3582 27.8325 21.3667C28.184 21.4089 28.5075 21.5776 28.8 21.7801C29.0925 21.9798 29.3625 22.216 29.6634 22.4045C30.3243 22.8235 31.1147 23.0092 31.8993 23.0401C32.6812 23.071 33.4631 22.9529 34.2337 22.7982C34.844 22.6773 35.4515 22.531 36.0309 22.3032C36.9197 21.9517 37.7212 21.4145 38.4834 20.8435C38.8322 20.5848 39.1753 20.3176 39.4875 20.0167C39.5915 19.9126 39.6956 19.8085 39.8081 19.7129C39.9206 19.6201 40.0472 19.5385 40.1878 19.4935C40.4015 19.426 40.6322 19.4457 40.8543 19.4823C41.0203 19.5104 41.1862 19.547 41.355 19.5414C41.4393 19.5357 41.5237 19.5217 41.6025 19.4907C41.6812 19.4598 41.7543 19.412 41.8078 19.3445C41.8781 19.2601 41.9147 19.1476 41.9147 19.0379C41.9147 18.9254 41.8809 18.8157 41.8247 18.7201C41.7122 18.5289 41.5181 18.3995 41.3156 18.3095C41.0372 18.1857 40.7362 18.1267 40.4409 18.0535C39.5325 17.8342 38.6493 17.5107 37.814 17.0945C37.3978 16.8892 36.9928 16.6614 36.585 16.442C36.1631 16.217 35.7356 16.0004 35.28 15.8598C34.2562 15.5504 33.1425 15.6517 32.1328 16.0032C31.0134 16.3914 30.0009 17.0832 29.2331 17.986Z" fill="url(#paint22_linear_6709_29666)"/>
-<mask id="mask28_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="15" width="15" height="9">
-<path d="M29.2331 17.986C28.7662 18.301 28.3443 18.6864 27.9872 19.1223C27.7847 19.3726 27.599 19.6454 27.4978 19.9492C27.4162 20.191 27.3881 20.4442 27.3375 20.6945C27.3178 20.7873 27.2953 20.8801 27.2981 20.9757C27.2981 21.0207 27.3037 21.0685 27.3178 21.1164C27.3318 21.1614 27.3572 21.2035 27.3881 21.2373C27.4443 21.2935 27.5203 21.3245 27.5962 21.3414C27.675 21.3554 27.7537 21.3582 27.8325 21.3667C28.184 21.4089 28.5075 21.5776 28.8 21.7801C29.0925 21.9798 29.3625 22.216 29.6634 22.4045C30.3243 22.8235 31.1147 23.0092 31.8993 23.0401C32.6812 23.071 33.4631 22.9529 34.2337 22.7982C34.844 22.6773 35.4515 22.531 36.0309 22.3032C36.9197 21.9517 37.7212 21.4145 38.4834 20.8435C38.8322 20.5848 39.1753 20.3176 39.4875 20.0167C39.5915 19.9126 39.6956 19.8085 39.8081 19.7129C39.9206 19.6201 40.0472 19.5385 40.1878 19.4935C40.4015 19.426 40.6322 19.4457 40.8543 19.4823C41.0203 19.5104 41.1862 19.547 41.355 19.5414C41.4393 19.5357 41.5237 19.5217 41.6025 19.4907C41.6812 19.4598 41.7543 19.412 41.8078 19.3445C41.8781 19.2601 41.9147 19.1476 41.9147 19.0379C41.9147 18.9254 41.8809 18.8157 41.8247 18.7201C41.7122 18.5289 41.5181 18.3995 41.3156 18.3095C41.0372 18.1857 40.7362 18.1267 40.4409 18.0535C39.5325 17.8342 38.6493 17.5107 37.814 17.0945C37.3978 16.8892 36.9928 16.6614 36.585 16.442C36.1631 16.217 35.7356 16.0004 35.28 15.8598C34.2562 15.5504 33.1425 15.6517 32.1328 16.0032C31.0134 16.3914 30.0009 17.0832 29.2331 17.986Z" fill="white"/>
-</mask>
-<g mask="url(#mask28_6709_29666)">
-<g filter="url(#filter28_f_6709_29666)">
-<path d="M36.4082 18.211C36.3519 18.1435 36.2732 18.0929 36.1888 18.0676C36.1044 18.0423 36.0144 18.0423 35.9272 18.0563C35.7529 18.0873 35.5954 18.1801 35.4491 18.2813C35.0357 18.5654 34.6701 18.9169 34.3494 19.3051C33.9276 19.8198 33.5788 20.4132 33.4607 21.0685C33.441 21.1782 33.4297 21.2935 33.441 21.4032C33.4551 21.5157 33.4972 21.6254 33.5788 21.7041C33.6463 21.7744 33.7419 21.8166 33.8376 21.8307C33.936 21.8448 34.0372 21.8307 34.1301 21.7998C34.3157 21.7379 34.4704 21.6057 34.6194 21.4763C35.4266 20.7507 36.1579 19.8844 36.4504 18.8382C36.4785 18.7341 36.5038 18.6273 36.5038 18.5176C36.5038 18.4079 36.4757 18.2982 36.4082 18.211Z" fill="#F6DA4A"/>
-</g>
-</g>
-<g opacity="0.8" filter="url(#filter29_f_6709_29666)">
-<path d="M31.7028 16.6106C31.4862 16.5403 31.1318 16.92 31.2471 17.1141C31.2781 17.1675 31.3765 17.235 31.444 17.1984C31.5424 17.145 31.624 16.9481 31.7309 16.8722C31.8012 16.8216 31.7871 16.6359 31.7028 16.6106Z" fill="url(#paint23_radial_6709_29666)"/>
-</g>
-<g opacity="0.8" filter="url(#filter30_f_6709_29666)">
-<path d="M34.4697 16.7122C34.526 16.8922 34.8157 16.8613 34.9844 16.9485C35.1307 17.0244 35.2488 17.1903 35.4147 17.196C35.5722 17.1988 35.8197 17.1397 35.8394 16.9822C35.8647 16.7769 35.5638 16.6447 35.3697 16.5688C35.1194 16.4732 34.7988 16.4225 34.5654 16.5519C34.5119 16.5828 34.4529 16.6532 34.4697 16.7122Z" fill="url(#paint24_radial_6709_29666)"/>
-</g>
-<mask id="mask29_6709_29666" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="27" y="15" width="16" height="11">
-<path d="M27.3203 21.108C27.3372 21.1812 27.3625 21.2487 27.3991 21.3134C27.4637 21.4202 27.5594 21.5074 27.6606 21.5805C27.7619 21.6565 27.8716 21.7184 27.9784 21.783C28.5438 22.1402 29.005 22.638 29.4156 23.1668C29.9641 23.8755 30.4506 24.6602 31.1847 25.1749C31.7022 25.5405 32.3209 25.7459 32.9509 25.8105C33.6906 25.8837 34.4387 25.7655 35.1531 25.5546C35.8141 25.3605 36.4525 25.0877 37.0375 24.7249C38.1541 24.0387 39.085 23.0318 40.3141 22.579C40.5812 22.4805 40.8597 22.4102 41.1184 22.2893C41.3772 22.1655 41.6219 21.9855 41.7456 21.7268C41.8637 21.4793 41.8581 21.1924 41.8975 20.9196C41.9397 20.6299 42.0325 20.3487 42.0831 20.059C42.1338 19.7693 42.1394 19.4599 42.0156 19.1927C41.9116 18.9734 41.7231 18.799 41.5066 18.6893C41.29 18.5768 41.0453 18.5262 40.8006 18.5149C40.3169 18.4924 39.8359 18.6162 39.3494 18.6612C38.7081 18.7202 38.0613 18.6359 37.4172 18.6555C36.6156 18.6809 35.8253 18.8609 35.0237 18.9002C34.1097 18.9424 33.1984 18.8018 32.2844 18.7652C31.8878 18.7484 31.4884 18.754 31.0975 18.8215C30.7066 18.8862 30.3241 19.0212 29.9978 19.2462C29.68 19.4655 29.4269 19.7637 29.1344 20.0168C28.9881 20.1434 28.8306 20.2587 28.6562 20.343C28.4847 20.4274 28.2934 20.4809 28.0994 20.4752C28.0009 20.4724 27.8969 20.4584 27.8041 20.4865C27.745 20.5062 27.6916 20.5427 27.6466 20.5849C27.6016 20.6299 27.565 20.6805 27.5312 20.7312C27.4497 20.8493 27.3794 20.9759 27.3203 21.108Z" fill="white"/>
-<path d="M29.2331 17.986C28.7662 18.301 28.3443 18.6864 27.9872 19.1223C27.7847 19.3726 27.599 19.6454 27.4978 19.9492C27.4162 20.191 27.3881 20.4442 27.3375 20.6945C27.3178 20.7873 27.2953 20.8801 27.2981 20.9757C27.2981 21.0207 27.3037 21.0685 27.3178 21.1164C27.3318 21.1614 27.3572 21.2035 27.3881 21.2373C27.4443 21.2935 27.5203 21.3245 27.5962 21.3414C27.675 21.3554 27.7537 21.3582 27.8325 21.3667C28.184 21.4089 28.5075 21.5776 28.8 21.7801C29.0925 21.9798 29.3625 22.216 29.6634 22.4045C30.3243 22.8235 31.1147 23.0092 31.8993 23.0401C32.6812 23.071 33.4631 22.9529 34.2337 22.7982C34.844 22.6773 35.4515 22.531 36.0309 22.3032C36.9197 21.9517 37.7212 21.4145 38.4834 20.8435C38.8322 20.5848 39.1753 20.3176 39.4875 20.0167C39.5915 19.9126 39.6956 19.8085 39.8081 19.7129C39.9206 19.6201 40.0472 19.5385 40.1878 19.4935C40.4015 19.426 40.6322 19.4457 40.8543 19.4823C41.0203 19.5104 41.1862 19.547 41.355 19.5414C41.4393 19.5357 41.5237 19.5217 41.6025 19.4907C41.6812 19.4598 41.7543 19.412 41.8078 19.3445C41.8781 19.2601 41.9147 19.1476 41.9147 19.0379C41.9147 18.9254 41.8809 18.8157 41.8247 18.7201C41.7122 18.5289 41.5181 18.3995 41.3156 18.3095C41.0372 18.1857 40.7362 18.1267 40.4409 18.0535C39.5325 17.8342 38.6493 17.5107 37.814 17.0945C37.3978 16.8892 36.9928 16.6614 36.585 16.442C36.1631 16.217 35.7356 16.0004 35.28 15.8598C34.2562 15.5504 33.1425 15.6517 32.1328 16.0032C31.0134 16.3914 30.0009 17.0832 29.2331 17.986Z" fill="white"/>
-</mask>
-<g mask="url(#mask29_6709_29666)">
-<g filter="url(#filter31_f_6709_29666)">
-<path d="M41.9819 19.4486C41.9558 19.676 41.8579 19.8938 41.7096 20.0542C41.5614 20.2145 41.3751 20.3042 41.1916 20.3036C41.0082 20.3037 40.8425 20.2138 40.7307 20.0535C40.6189 19.8932 40.5702 19.6757 40.5953 19.4486C40.608 19.3359 40.6384 19.2242 40.685 19.12C40.7316 19.0158 40.7934 18.9211 40.8668 18.8414C40.9402 18.7617 41.0238 18.6986 41.1129 18.6556C41.2019 18.6126 41.2946 18.5906 41.3856 18.5908C41.4766 18.5907 41.5643 18.6128 41.6435 18.6559C41.7227 18.699 41.792 18.7621 41.8474 18.8418C41.9028 18.9215 41.9431 19.0161 41.9662 19.1202C41.9893 19.2243 41.9946 19.3359 41.9819 19.4486Z" fill="url(#paint25_linear_6709_29666)"/>
-</g>
-</g>
-</g>
-<defs>
-<filter id="filter0_f_6709_29666" x="20.5901" y="28.6365" width="11.2143" height="10.6572" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.64" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter1_f_6709_29666" x="32.8984" y="27.3208" width="16.9552" height="12.9566" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.98" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter2_f_6709_29666" x="28.3265" y="28.9618" width="7.97684" height="8.33914" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.68" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter3_f_6709_29666" x="27.4541" y="36.0708" width="6.0293" height="19.5488" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.25" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter4_f_6709_29666" x="46.4908" y="33.3472" width="9.56238" height="9.61316" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.78" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter5_f_6709_29666" x="35.6621" y="-0.375039" width="10.9112" height="10.7042" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.73" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter6_f_6709_29666" x="42.7769" y="19.8985" width="6.07117" height="6.40711" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.78" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter7_f_6709_29666" x="14.831" y="32.9951" width="10.4405" height="19.3531" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.98" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter8_f_6709_29666" x="45.5507" y="31.0858" width="11.5735" height="24.3996" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.19" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter9_f_6709_29666" x="-0.213125" y="43.094" width="34.7505" height="34.5571" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="3.38" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter10_f_6709_29666" x="3.08027" y="44.7326" width="27.2047" height="28.3619" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="2.1" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter11_f_6709_29666" x="19.3854" y="52.2941" width="7.65891" height="12.8508" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.32" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter12_f_6709_29666" x="40.3187" y="49.102" width="25.1086" height="26.6398" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.95" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter13_f_6709_29666" x="38.2483" y="42.5027" width="35.647" height="35.9175" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="4.12" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter14_f_6709_29666" x="41.0295" y="43.0403" width="30.7759" height="30.6817" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="3.12" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter15_f_6709_29666" x="46.2366" y="49.6888" width="14.9769" height="3.79771" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.41" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter16_f_6709_29666" x="44.7758" y="46.7694" width="18.051" height="16.8688" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="2.45" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter17_f_6709_29666" x="47.4358" y="48.968" width="12.731" height="9.59084" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.12" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter18_f_6709_29666" x="48.5173" y="46.3474" width="11.9848" height="7.48045" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.88" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter19_f_6709_29666" x="48.5173" y="46.3474" width="11.9848" height="7.48045" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.88" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter20_f_6709_29666" x="28.579" y="12.7094" width="3.03246" height="3.80199" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.44" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter21_f_6709_29666" x="28.8821" y="9.00512" width="3.87648" height="3.5342" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.12" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter22_f_6709_29666" x="37.6303" y="12.4608" width="3.49141" height="3.46602" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.45" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter23_f_6709_29666" x="38.7947" y="8.50953" width="4.23777" height="3.95115" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.13" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter24_f_6709_29666" x="23.915" y="16.4004" width="22.502" height="16.1655" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="1.75" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter25_f_6709_29666" x="25.6793" y="17.6231" width="18.0379" height="9.9417" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.8" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter26_f_6709_29666" x="29.3262" y="20.0733" width="6.44719" height="5.54729" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.77" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter27_f_6709_29666" x="26.5564" y="16.512" width="15.4213" height="8.15518" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.65" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter28_f_6709_29666" x="31.9765" y="16.5869" width="5.98738" height="6.70906" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.73" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter29_f_6709_29666" x="31.0246" y="16.4021" width="0.951758" height="1.00693" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.1" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter30_f_6709_29666" x="34.2668" y="16.2741" width="1.77402" height="1.12217" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.1" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<filter id="filter31_f_6709_29666" x="40.1289" y="18.1308" width="2.31941" height="2.63289" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feGaussianBlur stdDeviation="0.23" result="effect1_foregroundBlur_6709_29666"/>
-</filter>
-<radialGradient id="paint0_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(22.832 34.0846) scale(5.34375 5.0625)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<radialGradient id="paint1_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(40.9896 37.0123) scale(6.6375 5.0625)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<radialGradient id="paint2_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(32.1221 35.8512) scale(2.62969 2.8125)">
-<stop/>
-<stop offset="1" stop-opacity="0.25"/>
-</radialGradient>
-<linearGradient id="paint3_linear_6709_29666" x1="12.1444" y1="54.2841" x2="23.7122" y2="73.6931" gradientUnits="userSpaceOnUse">
-<stop stop-color="#B98309"/>
-<stop offset="1" stop-color="#382605"/>
-</linearGradient>
-<linearGradient id="paint4_linear_6709_29666" x1="23.7576" y1="59.296" x2="27.397" y2="66.1528" gradientUnits="userSpaceOnUse">
-<stop stop-color="#EBC40C"/>
-<stop offset="1" stop-color="#EBC40C" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint5_linear_6709_29666" x1="46.949" y1="59.6139" x2="47.8687" y2="66.2992" gradientUnits="userSpaceOnUse">
-<stop/>
-<stop offset="1" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint6_linear_6709_29666" x1="48.2346" y1="71.162" x2="59.8896" y2="52.2676" gradientUnits="userSpaceOnUse">
-<stop stop-color="#3E2A06"/>
-<stop offset="1" stop-color="#AD780A"/>
-</linearGradient>
-<linearGradient id="paint7_linear_6709_29666" x1="51.416" y1="50.8135" x2="51.0729" y2="53.8989" gradientUnits="userSpaceOnUse">
-<stop stop-color="#F3CD0C"/>
-<stop offset="1" stop-color="#F3CD0C" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint8_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(53.356 54.7117) rotate(15) scale(5.52938 5.805)">
-<stop stop-color="#110800"/>
-<stop offset="0.59" stop-color="#A65A00" stop-opacity="0.8"/>
-<stop offset="1" stop-color="#FF921E" stop-opacity="0"/>
-</radialGradient>
-<radialGradient id="paint9_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(53.356 53.4064) rotate(-2.42) scale(5.55188 4.17938)">
-<stop stop-color="#110800"/>
-<stop offset="0.59" stop-color="#A65A00" stop-opacity="0.8"/>
-<stop offset="1" stop-color="#FF921E" stop-opacity="0"/>
-</radialGradient>
-<radialGradient id="paint10_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(57.5579 49.6746) rotate(23.5) scale(1.95469 0.902812)">
-<stop stop-color="#7C7C7C"/>
-<stop offset="1" stop-color="#7C7C7C" stop-opacity="0.33"/>
-</radialGradient>
-<linearGradient id="paint11_linear_6709_29666" x1="52.2254" y1="48.8196" x2="52.951" y2="48.7886" gradientUnits="userSpaceOnUse">
-<stop stop-color="#7C7C7C"/>
-<stop offset="1" stop-color="#7C7C7C" stop-opacity="0.33"/>
-</linearGradient>
-<radialGradient id="paint12_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(29.9505 14.4592) rotate(-0.6) scale(2.88 4.41)">
-<stop stop-color="#FEFEFC"/>
-<stop offset="0.75" stop-color="#FEFEFC"/>
-<stop offset="1" stop-color="#D4D4D4"/>
-</radialGradient>
-<linearGradient id="paint13_linear_6709_29666" x1="29.3314" y1="13.1174" x2="30.7461" y2="15.6459" gradientUnits="userSpaceOnUse">
-<stop stop-color="#757574" stop-opacity="0"/>
-<stop offset="0.25" stop-color="#757574"/>
-<stop offset="0.5" stop-color="#757574"/>
-<stop offset="1" stop-color="#757574" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint14_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(29.5 12.3021) rotate(-9.35) scale(1.75781 1.62281)">
-<stop stop-color="#C8C8C8"/>
-<stop offset="1" stop-color="#797978"/>
-</radialGradient>
-<linearGradient id="paint15_linear_6709_29666" x1="29.1351" y1="9.14346" x2="32.1979" y2="12.271" gradientUnits="userSpaceOnUse">
-<stop stop-color="#646464" stop-opacity="0"/>
-<stop offset="0.31" stop-color="#646464" stop-opacity="0.58"/>
-<stop offset="0.47" stop-color="#646464"/>
-<stop offset="0.73" stop-color="#646464" stop-opacity="0.26"/>
-<stop offset="1" stop-color="#646464" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint16_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(38.8295 14.4594) rotate(-1.8) scale(3.83625 4.41)">
-<stop stop-color="#FEFEFC"/>
-<stop offset="0.75" stop-color="#FEFEFC"/>
-<stop offset="1" stop-color="#D4D4D4"/>
-</radialGradient>
-<linearGradient id="paint17_linear_6709_29666" x1="38.776" y1="13.289" x2="40.4044" y2="15.2184" gradientUnits="userSpaceOnUse">
-<stop stop-color="#949494" stop-opacity="0.39"/>
-<stop offset="0.5" stop-color="#949494"/>
-<stop offset="1" stop-color="#949494" stop-opacity="0.39"/>
-</linearGradient>
-<linearGradient id="paint18_linear_6709_29666" x1="37.3784" y1="10.1899" x2="42.559" y2="13.2218" gradientUnits="userSpaceOnUse">
-<stop stop-color="#747474"/>
-<stop offset="0.13" stop-color="#8C8C8C"/>
-<stop offset="0.25" stop-color="#A4A4A4"/>
-<stop offset="0.5" stop-color="#D4D4D4"/>
-<stop offset="0.62" stop-color="#D4D4D4"/>
-<stop offset="1" stop-color="#7C7C7C"/>
-</linearGradient>
-<linearGradient id="paint19_linear_6709_29666" x1="39.1391" y1="8.87641" x2="42.5872" y2="12.1333" gradientUnits="userSpaceOnUse">
-<stop stop-color="#646464" stop-opacity="0"/>
-<stop offset="0.31" stop-color="#646464" stop-opacity="0.58"/>
-<stop offset="0.47" stop-color="#646464"/>
-<stop offset="0.73" stop-color="#646464" stop-opacity="0.26"/>
-<stop offset="1" stop-color="#646464" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint20_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(33.0861 16.9085) rotate(-36) scale(3.2175 2.91937)">
-<stop stop-color="#020204"/>
-<stop offset="0.73" stop-color="#020204"/>
-<stop offset="1" stop-color="#5C5C5C"/>
-</radialGradient>
-<radialGradient id="paint21_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(36.4985 19.8593) rotate(-22.4) scale(7.63594 5.36344)">
-<stop stop-color="#D2940A"/>
-<stop offset="0.75" stop-color="#D89C08"/>
-<stop offset="0.87" stop-color="#B67E07"/>
-<stop offset="1" stop-color="#946106"/>
-</radialGradient>
-<linearGradient id="paint22_linear_6709_29666" x1="27.5878" y1="19.4795" x2="41.279" y2="19.3726" gradientUnits="userSpaceOnUse">
-<stop stop-color="#AD780A"/>
-<stop offset="0.12" stop-color="#D89E08"/>
-<stop offset="0.25" stop-color="#EDB80B"/>
-<stop offset="0.39" stop-color="#EBC80D"/>
-<stop offset="0.53" stop-color="#F5D838"/>
-<stop offset="0.77" stop-color="#F6D811"/>
-<stop offset="1" stop-color="#F5CD31"/>
-</linearGradient>
-<radialGradient id="paint23_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(31.5312 16.8412) scale(0.37125 0.399375)">
-<stop stop-color="#3A2903"/>
-<stop offset="0.55" stop-color="#735208"/>
-<stop offset="1" stop-color="#AC8C04"/>
-</radialGradient>
-<radialGradient id="paint24_radial_6709_29666" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(35.0575 16.791) scale(0.781875 0.455625)">
-<stop stop-color="#3A2903"/>
-<stop offset="0.55" stop-color="#735208"/>
-<stop offset="1" stop-color="#AC8C04"/>
-</radialGradient>
-<linearGradient id="paint25_linear_6709_29666" x1="41.2703" y1="18.9818" x2="41.2703" y2="19.9943" gradientUnits="userSpaceOnUse">
-<stop stop-color="#F5CE2D"/>
-<stop offset="1" stop-color="#D79B08"/>
-</linearGradient>
-<clipPath id="clip0_6709_29666">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6709_29666)"><path fill="#020204" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/><path fill="#fdfdfb" d="M29.006 20.812c-.253.318-.416.7-.518 1.094a6 6 0 0 0-.151 1.21c-.031.813.02 1.64-.197 2.424-.231.838-.746 1.567-1.25 2.273-.874 1.226-1.757 2.486-2.187 3.929a7 7 0 0 0-.256 2.705 29 29 0 0 0-2.526 4.551c-1.063 2.41-1.791 4.975-2.047 7.597-.315 3.209.095 6.51 1.364 9.475.914 2.146 2.28 4.106 4.044 5.636a13.8 13.8 0 0 0 2.953 1.96c3.688 1.815 8.244 1.817 11.869-.115 1.896-1.01 3.496-2.486 5.037-3.98.928-.9 1.854-1.822 2.562-2.902 1.364-2.084 1.84-4.615 2.135-7.088.515-4.32.532-8.887-1.364-12.805a14.1 14.1 0 0 0-2.565-3.67 20 20 0 0 0-1.62-5.462c-.577-1.252-1.277-2.441-1.811-3.707-.22-.52-.41-1.055-.653-1.564s-.543-.998-.953-1.39a3.9 3.9 0 0 0-1.485-.863 6.4 6.4 0 0 0-1.705-.292c-1.156-.06-2.311.093-3.467.045-.92-.037-1.837-.197-2.757-.143-.458.028-.916.11-1.344.284a2.7 2.7 0 0 0-1.108.798"/><mask id="mask0_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter0_f_6709_29666)" mask="url(#mask0_6709_29666)" opacity=".25"><path fill="url(#paint0_radial_6709_29666)" d="M24.939 32.394c.244.369-.155 1.643 5.585.827 0 0-1.01.11-2.002.34-1.544.518-2.889 1.095-3.93 1.86-1.026.759-1.78 1.746-2.722 2.593 0 0 1.527-2.79 1.907-3.631.383-.841-.062-.802.24-2.04.3-1.237 1.037-2.427 1.037-2.427s-.602 1.75-.115 2.478"/></g><mask id="mask1_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter1_f_6709_29666)" mask="url(#mask1_6709_29666)" opacity=".42"><path fill="url(#paint1_radial_6709_29666)" d="M43.392 32.06c-1.17.815-1.857.72-3.274.877-1.42.16-5.26.101-5.26.101s.555-.008 1.79.22c1.231.23 3.743.45 5.157.987 1.418.54 1.932.695 2.793 1.237 1.224.774 2.124 1.986 3.294 2.835 0 0 .056-1.125-.417-1.966-.472-.84-1.744-2.165-2.117-3.403-.372-1.237-.552-3.667-.552-3.667s-.247 1.966-1.414 2.779"/></g><mask id="mask2_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter2_f_6709_29666)" mask="url(#mask2_6709_29666)" opacity=".2"><path fill="url(#paint2_radial_6709_29666)" d="M32.392 30.322q-.067.527-.169 1.052a3 3 0 0 1-.135.506c-.064.163-.157.32-.287.436a1.5 1.5 0 0 1-.393.239 6 6 0 0 1-1.722.49q.355.025.712.064c.15.017.298.034.442.07.146.04.29.096.41.183.133.099.236.23.315.377.155.287.206.619.234.948.036.416.04.838.008 1.254.028-.278.087-.557.175-.821a3.6 3.6 0 0 1 .756-1.308c.138-.146.287-.284.45-.4a2.5 2.5 0 0 1 1.755-.424 2.73 2.73 0 0 1-1.744-.543 2.3 2.3 0 0 1-.624-.703 1.97 1.97 0 0 1-.183-1.42"/></g><mask id="mask3_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter3_f_6709_29666)" mask="url(#mask3_6709_29666)" opacity=".11"><path fill="#000" d="M30.896 38.57a21 21 0 0 0-.61 3.463c-.155 1.65-.119 3.313-.209 4.97-.073 1.403-.239 2.823.006 4.21.115.66.323 1.305.619 1.907q.07-.345.1-.695c.105-1.125-.084-2.253-.148-3.378-.113-1.974.16-3.948.273-5.923a36 36 0 0 0-.031-4.553"/></g><mask id="mask4_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter4_f_6709_29666)" mask="url(#mask4_6709_29666)" opacity=".75"><path fill="#7c7c7c" d="M50.648 36.908c.29-.045 2.064 1.465 1.822 2.028-.242.56-.7.222-1.026.225-.326.006-1.218.41-1.367.155-.152-.256.394-.852.678-1.353.23-.402-.394-1.01-.107-1.055"/></g><mask id="mask5_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter5_f_6709_29666)" mask="url(#mask5_6709_29666)"><path fill="#7c7c7c" d="M39.803 3.128c-.622.438-.352.987-.085 1.535.267.551-.588 2.135-.596 2.202s1.682-.801 2.143-1.37c.546-.666 1.921.906 1.845.667.003-.427-2.686-3.47-3.307-3.034"/></g><mask id="mask6_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter6_f_6709_29666)" mask="url(#mask6_6709_29666)"><path fill="#838384" d="M44.514 21.552c-.524.478.247 1.195.61 2.036.228.523.855 1.263 1.462 1.145.459-.09.74-.748.698-1.21-.084-.894-.838-1.105-1.387-1.411-.433-.242-1.015-.895-1.383-.56"/></g><path fill="#020204" d="M23.62 28.381c-1.716 1.946-3.48 3.834-4.447 5.94-.481 1.069-.706 2.23-1.035 3.355-.371 1.277-.878 2.515-1.446 3.718-.526 1.111-1.105 2.197-1.682 3.28-.421.79-.849 1.595-.995 2.478-.116.697-.05 1.417.13 2.1.176.684.46 1.337.784 1.964 1.372 2.686 3.434 4.998 5.875 6.77a21 21 0 0 0 3.538 2.067c.675.306 1.384.582 2.127.593.37.008.745-.053 1.085-.203.338-.148.641-.388.844-.7.247-.382.332-.858.281-1.31s-.228-.886-.464-1.275c-.58-.95-1.493-1.64-2.374-2.32a80 80 0 0 1-5.498-4.663c-.495-.464-.993-.94-1.339-1.524-.337-.568-.52-1.215-.644-1.865-.34-1.78-.253-3.653.352-5.363.239-.67.55-1.308.855-1.95.523-1.11 1.018-2.244 1.707-3.262.858-1.268 2.005-2.343 2.703-3.704.59-1.15.83-2.441 1.057-3.712.18-.996.52-1.97.695-2.965-.34.647-1.437 1.707-2.11 2.551"/><mask id="mask7_6709_29666" width="16" height="36" x="13" y="25" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M23.62 28.381c-1.716 1.946-3.48 3.834-4.447 5.94-.481 1.069-.706 2.23-1.035 3.355-.371 1.277-.878 2.515-1.446 3.718-.526 1.111-1.105 2.197-1.682 3.28-.421.79-.849 1.595-.995 2.478-.116.697-.05 1.417.13 2.1.176.684.46 1.337.784 1.964 1.372 2.686 3.434 4.998 5.875 6.77a21 21 0 0 0 3.538 2.067c.675.306 1.384.582 2.127.593.37.008.745-.053 1.085-.203.338-.148.641-.388.844-.7.247-.382.332-.858.281-1.31s-.228-.886-.464-1.275c-.58-.95-1.493-1.64-2.374-2.32a80 80 0 0 1-5.498-4.663c-.495-.464-.993-.94-1.339-1.524-.337-.568-.52-1.215-.644-1.865-.34-1.78-.253-3.653.352-5.363.239-.67.55-1.308.855-1.95.523-1.11 1.018-2.244 1.707-3.262.858-1.268 2.005-2.343 2.703-3.704.59-1.15.83-2.441 1.057-3.712.18-.996.52-1.97.695-2.965-.34.647-1.437 1.707-2.11 2.551"/></mask><g filter="url(#filter7_f_6709_29666)" mask="url(#mask7_6709_29666)" opacity=".95"><path fill="#7c7c7c" d="M21.645 35.466a8 8 0 0 0-1.442 1.774c-.647 1.08-1.027 2.295-1.5 3.462-.348.87-.756 1.744-.804 2.68-.025.482.045.963.062 1.444.017.48-.028.981-.264 1.4a1.7 1.7 0 0 1-.906.762c.515.172.97.504 1.294.937.27.366.444.79.678 1.175.19.316.424.608.714.836.287.23.633.394.996.439a1.75 1.75 0 0 0 1.397-.445 32.8 32.8 0 0 1 1.25-13.041c.08-.265.165-.532.188-.808.02-.278-.034-.57-.203-.79a.84.84 0 0 0-.779-.329.86.86 0 0 0-.408.16.9.9 0 0 0-.273.343"/></g><path fill="#020204" d="M51.401 35.752c1.474 1.187 2.41 2.979 2.7 4.85.225 1.456.079 2.955-.25 4.392-.33 1.44-.835 2.83-1.342 4.219-.2.551-.402 1.11-.48 1.693-.082.585-.032 1.201.25 1.719.323.593.925 1 1.572 1.192a3.76 3.76 0 0 0 1.974.025c.647-.16 1.735-.368 2.261-.779 1.336-1.038 1.654-2.84 1.972-4.42.33-1.652.169-3.382-.12-5.05-.398-2.275-1.064-4.497-1.91-6.643a23 23 0 0 0-2.374-4.488c-.934-1.376-2.256-2.447-3.235-3.792-.34-.466-.748-.95-1.08-1.423-.72-1.018-.557-.826-1.004-1.487-.323-.479-.835-.642-1.372-.85-.54-.208-1.142-.27-1.699-.115-.731.205-1.33.785-1.648 1.474-.318.692-.374 1.485-.25 2.236.16.967.601 1.867 1.102 2.71.563.954 1.215 1.874 2.067 2.583.889.74 1.963 1.229 2.866 1.954"/><mask id="mask8_6709_29666" width="16" height="30" x="45" y="24" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M51.401 35.752c1.474 1.187 2.41 2.979 2.7 4.85.225 1.456.079 2.955-.25 4.392-.33 1.44-.835 2.83-1.342 4.219-.2.551-.402 1.11-.48 1.693-.082.585-.032 1.201.25 1.719.323.593.925 1 1.572 1.192a3.76 3.76 0 0 0 1.974.025c.647-.16 1.735-.368 2.261-.779 1.336-1.038 1.654-2.84 1.972-4.42.33-1.652.169-3.382-.12-5.05-.398-2.275-1.064-4.497-1.91-6.643a23 23 0 0 0-2.374-4.488c-.934-1.376-2.256-2.447-3.235-3.792-.34-.466-.748-.95-1.08-1.423-.72-1.018-.557-.826-1.004-1.487-.323-.479-.835-.642-1.372-.85-.54-.208-1.142-.27-1.699-.115-.731.205-1.33.785-1.648 1.474-.318.692-.374 1.485-.25 2.236.16.967.601 1.867 1.102 2.71.563.954 1.215 1.874 2.067 2.583.889.74 1.963 1.229 2.866 1.954"/></mask><g filter="url(#filter8_f_6709_29666)" mask="url(#mask8_6709_29666)"><path fill="#838384" d="M47.93 33.466c.119.112.242.228.37.334.905.74 1.386 1.57 2.305 2.296 1.502 1.186 3.024 3.234 3.32 5.104.23 1.46-.074 2.253-.445 3.971-.371 1.722-1.423 4.157-1.994 5.817-.225.66.46.388.37 1.085a4 4 0 0 0-.008 1.032c.006-.064.009-.134.017-.2.11-.95.4-1.864.718-2.761.61-1.724 1.31-3.417 1.794-5.19.484-1.768.43-3.042.177-4.564-.318-1.915-1.431-3.681-3.007-4.849-1.116-.824-2.43-1.352-3.616-2.075"/></g><path fill="url(#paint3_linear_6709_29666)" d="M15.463 49.312c.388-.16.824-.192 1.235-.116.413.076.804.256 1.15.49.695.472 1.21 1.158 1.702 1.839 1.133 1.558 2.222 3.15 3.212 4.804.801 1.344 1.535 2.73 2.463 3.988.605.824 1.286 1.586 1.893 2.405.608.82 1.145 1.71 1.415 2.694a5.4 5.4 0 0 1-.394 3.867 5.1 5.1 0 0 1-1.884 2.022c-.8.481-1.64.695-2.574.695-1.482 0-2.93-.796-4.309-1.344-2.806-1.12-5.855-1.469-8.75-2.34-.888-.268-1.763-.585-2.657-.83-.4-.11-.802-.205-1.178-.377-.377-.169-.729-.425-.937-.779a1.83 1.83 0 0 1-.225-.917c0-.32.079-.635.188-.934.217-.599.569-1.142.805-1.735.385-.967.455-2.033.402-3.074-.05-1.038-.22-2.07-.29-3.108-.033-.464-.045-.934.045-1.392.087-.456.284-.903.62-1.223.308-.299.716-.476 1.138-.563.42-.087.852-.09 1.28-.081.427.008.858.033 1.285-.003.428-.034.858-.13 1.23-.343.354-.203.643-.504.882-.833.24-.329.433-.689.633-1.046.197-.355.402-.709.664-1.024.259-.315.58-.588.956-.742"/><mask id="mask9_6709_29666" width="24" height="23" x="5" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.463 49.312c.388-.16.824-.192 1.235-.116.413.076.804.256 1.15.49.695.472 1.21 1.158 1.702 1.839 1.133 1.558 2.222 3.15 3.212 4.804.801 1.344 1.535 2.73 2.463 3.988.605.824 1.286 1.586 1.893 2.405.608.82 1.145 1.71 1.415 2.694a5.4 5.4 0 0 1-.394 3.867 5.1 5.1 0 0 1-1.884 2.022c-.8.481-1.64.695-2.574.695-1.482 0-2.93-.796-4.309-1.344-2.806-1.12-5.855-1.469-8.75-2.34-.888-.268-1.763-.585-2.657-.83-.4-.11-.802-.205-1.178-.377-.377-.169-.729-.425-.937-.779a1.83 1.83 0 0 1-.225-.917c0-.32.079-.635.188-.934.217-.599.569-1.142.805-1.735.385-.967.455-2.033.402-3.074-.05-1.038-.22-2.07-.29-3.108-.033-.464-.045-.934.045-1.392.087-.456.284-.903.62-1.223.308-.299.716-.476 1.138-.563.42-.087.852-.09 1.28-.081.427.008.858.033 1.285-.003.428-.034.858-.13 1.23-.343.354-.203.643-.504.882-.833.24-.329.433-.689.633-1.046.197-.355.402-.709.664-1.024.259-.315.58-.588.956-.742"/></mask><g filter="url(#filter9_f_6709_29666)" mask="url(#mask9_6709_29666)"><path fill="#d99a03" d="M16.076 49.978c.352-.14.751-.157 1.12-.073a2.6 2.6 0 0 1 1.015.498c.602.464 1.018 1.117 1.42 1.76a116 116 0 0 1 2.79 4.743c.675 1.212 1.317 2.446 2.143 3.557.549.737 1.176 1.415 1.736 2.143.56.729 1.057 1.522 1.305 2.408a4.73 4.73 0 0 1-.36 3.448 4.6 4.6 0 0 1-1.744 1.823 4.5 4.5 0 0 1-2.444.602c-1.356-.062-2.596-.74-3.873-1.199-2.45-.888-5.102-1.01-7.616-1.701-.9-.245-1.778-.571-2.68-.799-.403-.101-.81-.186-1.19-.346s-.737-.408-.945-.765a1.7 1.7 0 0 1-.205-.886 2.8 2.8 0 0 1 .197-.897c.219-.574.562-1.091.781-1.665.335-.866.377-1.82.315-2.745-.061-.925-.225-1.845-.28-2.77-.023-.417-.029-.836.055-1.24.085-.409.262-.802.557-1.095.32-.318.76-.49 1.207-.56.444-.067.897-.036 1.344.003.45.04.9.09 1.35.065.45-.028.906-.138 1.277-.39.338-.229.59-.563.785-.92.194-.358.332-.743.48-1.12.147-.38.307-.757.538-1.094.23-.335.543-.63.922-.785"/></g><mask id="mask10_6709_29666" width="24" height="23" x="5" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.463 49.312c.388-.16.824-.192 1.235-.116.413.076.804.256 1.15.49.695.472 1.21 1.158 1.702 1.839 1.133 1.558 2.222 3.15 3.212 4.804.801 1.344 1.535 2.73 2.463 3.988.605.824 1.286 1.586 1.893 2.405.608.82 1.145 1.71 1.415 2.694a5.4 5.4 0 0 1-.394 3.867 5.1 5.1 0 0 1-1.884 2.022c-.8.481-1.64.695-2.574.695-1.482 0-2.93-.796-4.309-1.344-2.806-1.12-5.855-1.469-8.75-2.34-.888-.268-1.763-.585-2.657-.83-.4-.11-.802-.205-1.178-.377-.377-.169-.729-.425-.937-.779a1.83 1.83 0 0 1-.225-.917c0-.32.079-.635.188-.934.217-.599.569-1.142.805-1.735.385-.967.455-2.033.402-3.074-.05-1.038-.22-2.07-.29-3.108-.033-.464-.045-.934.045-1.392.087-.456.284-.903.62-1.223.308-.299.716-.476 1.138-.563.42-.087.852-.09 1.28-.081.427.008.858.033 1.285-.003.428-.034.858-.13 1.23-.343.354-.203.643-.504.882-.833.24-.329.433-.689.633-1.046.197-.355.402-.709.664-1.024.259-.315.58-.588.956-.742"/></mask><g filter="url(#filter10_f_6709_29666)" mask="url(#mask10_6709_29666)"><path fill="#f5bd0c" d="M15.748 49.098a1.76 1.76 0 0 1 1.119-.127c.374.076.723.259 1.018.498.588.478.965 1.161 1.313 1.83.8 1.536 1.547 3.106 2.504 4.554.697 1.05 1.499 2.025 2.202 3.072.953 1.414 1.73 2.972 2.05 4.64.214 1.125.208 2.337-.332 3.347a3.7 3.7 0 0 1-1.617 1.552 4.16 4.16 0 0 1-2.227.414c-1.201-.104-2.29-.695-3.42-1.108-2.006-.729-4.174-.906-6.239-1.457-.869-.23-1.724-.532-2.604-.714-.39-.082-.788-.141-1.159-.282s-.723-.374-.914-.717a1.45 1.45 0 0 1-.157-.799c.02-.272.1-.54.208-.796.216-.506.534-.973.7-1.496.248-.773.146-1.609-.04-2.399-.182-.787-.45-1.56-.53-2.365a3.2 3.2 0 0 1 .047-1.075c.082-.351.248-.689.51-.939.337-.323.81-.486 1.282-.532.47-.044.942.017 1.409.085.466.067.939.14 1.409.118.472-.02.953-.143 1.322-.433.365-.287.596-.712.728-1.15.132-.442.174-.9.228-1.356.053-.456.12-.917.298-1.342.177-.424.475-.815.892-1.023"/></g><mask id="mask11_6709_29666" width="24" height="23" x="5" y="49" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M15.463 49.312c.388-.16.824-.192 1.235-.116.413.076.804.256 1.15.49.695.472 1.21 1.158 1.702 1.839 1.133 1.558 2.222 3.15 3.212 4.804.801 1.344 1.535 2.73 2.463 3.988.605.824 1.286 1.586 1.893 2.405.608.82 1.145 1.71 1.415 2.694a5.4 5.4 0 0 1-.394 3.867 5.1 5.1 0 0 1-1.884 2.022c-.8.481-1.64.695-2.574.695-1.482 0-2.93-.796-4.309-1.344-2.806-1.12-5.855-1.469-8.75-2.34-.888-.268-1.763-.585-2.657-.83-.4-.11-.802-.205-1.178-.377-.377-.169-.729-.425-.937-.779a1.83 1.83 0 0 1-.225-.917c0-.32.079-.635.188-.934.217-.599.569-1.142.805-1.735.385-.967.455-2.033.402-3.074-.05-1.038-.22-2.07-.29-3.108-.033-.464-.045-.934.045-1.392.087-.456.284-.903.62-1.223.308-.299.716-.476 1.138-.563.42-.087.852-.09 1.28-.081.427.008.858.033 1.285-.003.428-.034.858-.13 1.23-.343.354-.203.643-.504.882-.833.24-.329.433-.689.633-1.046.197-.355.402-.709.664-1.024.259-.315.58-.588.956-.742"/></mask><g filter="url(#filter11_f_6709_29666)" mask="url(#mask11_6709_29666)"><path fill="url(#paint4_linear_6709_29666)" d="M20.025 52.934c.633 1.142 1.019 2.453 1.646 3.606.576 1.06 1.232 2.151 1.817 3.127.261.436.869 1.105 1.482 2.143.557.94 1.12 2.253 1.434 2.695-.18-.518-.551-1.904-.995-2.891-.414-.923-.898-1.449-1.193-1.947-.585-.976-1.218-1.856-1.82-2.787-.83-1.285-1.462-2.723-2.37-3.946"/></g><mask id="mask12_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter12_f_6709_29666)" mask="url(#mask12_6709_29666)" opacity=".2"><path fill="url(#paint5_linear_6709_29666)" d="M61.51 60.64a4 4 0 0 1-.51 1.07c-.492.728-1.21 1.279-1.923 1.785-1.218.864-2.49 1.657-3.626 2.638a18 18 0 0 0-2.095 2.174c-.549.664-1.066 1.361-1.693 1.952-.633.596-1.376 1.08-2.177 1.342-.976.317-2.005.303-2.945.062-.658-.17-1.302-.462-1.71-.993-.408-.532-.54-1.249-.588-1.952-.084-1.243.065-2.512.2-3.775.113-1.048.217-2.098.259-3.144.076-1.904-.05-3.788-.307-5.639-.045-.312-.09-.624-.065-.942.026-.32.133-.653.358-.9.208-.228.497-.363.784-.428.287-.067.58-.07.87-.078.683-.017 1.366-.06 2.038.003.425.036.841.115 1.263.154.706.068 1.44.034 2.15-.174.761-.225 1.487-.644 2.263-.76.318-.047.636-.042.945.003.315.042.63.13.872.324.186.146.32.346.425.56.157.32.253.672.31 1.034.047.321.067.65.148.96.135.509.444.942.813 1.293.371.352.801.63 1.235.906.43.273.863.543 1.322.768.216.106.438.202.644.323a1.7 1.7 0 0 1 .537.47c.185.267.258.618.202.964"/></g><path fill="url(#paint6_linear_6709_29666)" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/><mask id="mask13_6709_29666" width="22" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/></mask><g filter="url(#filter13_f_6709_29666)" mask="url(#mask13_6709_29666)"><path fill="#cd8907" d="M65.59 60.784c-.148.374-.36.725-.624 1.032-.582.68-1.386 1.128-2.188 1.53-1.372.686-2.79 1.288-4.078 2.115-.86.554-1.66 1.204-2.404 1.907-.636.599-1.24 1.24-1.955 1.746-.723.515-1.555.884-2.433 1.013-1.069.157-2.171-.045-3.164-.47-.692-.298-1.361-.72-1.763-1.358-.4-.636-.493-1.412-.493-2.163-.005-1.325.245-2.635.481-3.937.197-1.083.383-2.169.5-3.263.215-1.991.206-4 .071-5.996-.022-.335-.048-.672.003-1.004.05-.332.188-.661.442-.88.239-.206.56-.296.874-.31.313-.017.625.034.937.079.734.107 1.47.188 2.188.374.453.118.894.275 1.344.394.754.202 1.544.298 2.318.208.835-.096 1.645-.405 2.483-.386.346.009.687.074 1.016.175.334.104.666.253.914.5.185.189.312.425.416.67.149.363.25.75.256 1.144.008.411-.079.822-.025 1.23.045.329.185.64.365.922.177.281.394.537.61.79.417.493.833.993 1.356 1.37.594.43 1.3.683 1.913 1.083.182.12.36.256.489.433.22.298.276.703.152 1.052"/></g><mask id="mask14_6709_29666" width="22" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/></mask><g filter="url(#filter14_f_6709_29666)" mask="url(#mask14_6709_29666)"><path fill="#f5c021" d="M65.506 60.36c-.169.379-.385.73-.641 1.043-.597.725-1.404 1.223-2.25 1.544-1.398.528-2.923.599-4.292 1.2-.836.366-1.59.917-2.352 1.44-.613.42-1.243.828-1.918 1.12-.765.335-1.575.52-2.39.653-.518.081-1.044.143-1.567.115s-1.046-.152-1.51-.42c-.349-.202-.664-.491-.852-.871-.206-.42-.242-.911-.24-1.39.015-1.265.288-2.52.279-3.788-.008-1.105-.228-2.194-.29-3.296-.12-2.12.335-4.275-.067-6.354-.062-.334-.15-.666-.146-1.007.002-.168.028-.34.087-.497a1 1 0 0 1 .284-.4.9.9 0 0 1 .368-.157 1.3 1.3 0 0 1 .397.003c.261.042.512.143.768.219.73.22 1.504.214 2.25.38.467.101.916.273 1.38.396.774.214 1.584.304 2.38.211.855-.101 1.69-.41 2.55-.388.355.008.704.073 1.044.175.34.1.681.244.94.506.182.188.317.427.424.675.16.362.27.756.268 1.156-.003.208-.034.413-.054.621a2 2 0 0 0 .026.619c.05.203.154.385.272.551s.253.315.377.478c.343.453.59.982.858 1.491.267.509.568 1.013.993 1.38.576.499 1.322.698 1.966 1.095.188.115.368.25.5.436.107.146.177.323.206.509a1.3 1.3 0 0 1-.048.551"/></g><mask id="mask15_6709_29666" width="22" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/></mask><g filter="url(#filter15_f_6709_29666)" mask="url(#mask15_6709_29666)"><path fill="url(#paint7_linear_6709_29666)" d="M47.273 51.07c.793-.214 1.468.388 2.045.84.371.318.911.24 1.367.254.756-.026 1.507.126 2.264.033 1.49-.126 2.95-.492 4.446-.554.715-.045 1.52-.087 2.135.33.25.174.619.908.864.632-.102-.77-.673-1.516-1.438-1.721-.602-.096-1.209.07-1.817.017-1.797-.043-3.586-.377-5.388-.282-1.255.012-2.506-.047-3.76-.095-.493-.101-.667.334-.934.503.07.054.095.07.216.042"/></g><mask id="mask16_6709_29666" width="22" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/></mask><g filter="url(#filter16_f_6709_29666)" mask="url(#mask16_6709_29666)" opacity=".35"><path fill="url(#paint8_radial_6709_29666)" d="M57.794 52.766a1.28 1.28 0 0 0-.66-.583 2.2 2.2 0 0 0-.881-.152c-.6.006-1.196.16-1.794.11-.504-.045-.982-.233-1.474-.354-.51-.124-1.05-.172-1.553-.034a2.28 2.28 0 0 0-1.313.981c-.265.417-.388.909-.428 1.401s.003.985.054 1.477c.034.354.076.709.16 1.054.087.346.22.684.428.974.3.416.748.714 1.229.891.787.29 1.681.276 2.455-.042a6.77 6.77 0 0 0 3.24-2.981c.256-.473.453-.976.58-1.494.05-.208.09-.419.09-.633a1.3 1.3 0 0 0-.133-.615"/></g><mask id="mask17_6709_29666" width="22" height="22" x="45" y="50" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M65.664 62.696c-.636.754-1.52 1.252-2.4 1.702-1.498.762-3.054 1.434-4.463 2.354a18.3 18.3 0 0 0-2.632 2.118c-.698.666-1.359 1.378-2.14 1.943-.79.571-1.702.985-2.667 1.128q-.4.06-.804.06c-.911 0-1.823-.22-2.66-.586-.76-.329-1.492-.804-1.93-1.507-.439-.71-.54-1.573-.54-2.408-.003-1.47.27-2.928.526-4.379.213-1.207.416-2.413.548-3.63.24-2.212.236-4.447.079-6.67-.028-.37-.06-.745-.003-1.113s.208-.737.49-.979c.261-.225.61-.326.956-.343.343-.02.686.034 1.026.084.802.119 1.612.209 2.397.417.494.129.978.303 1.47.438.827.223 1.69.33 2.537.231.914-.107 1.803-.45 2.723-.427.377.008.75.078 1.11.194.366.115.73.28 1 .556.205.209.348.47.455.743.16.405.247.838.284 1.271.03.386.025.776.098 1.156.121.622.45 1.193.855 1.68.408.489.895.902 1.381 1.31.487.408.973.813 1.496 1.17.245.169.498.326.732.509.233.185.447.4.593.658a1.53 1.53 0 0 1 .13 1.184c-.127.402-.36.793-.647 1.136"/></mask><g filter="url(#filter17_f_6709_29666)" mask="url(#mask17_6709_29666)" opacity=".35"><path fill="url(#paint9_radial_6709_29666)" d="M57.794 52c-.135-.194-.382-.337-.66-.422a3 3 0 0 0-.881-.11c-.6.006-1.196.119-1.794.08-.504-.032-.982-.17-1.474-.254-.51-.09-1.05-.126-1.553-.025-.54.104-1.015.366-1.313.709-.265.3-.388.658-.428 1.012s.003.712.054 1.066c.034.256.076.515.16.765.087.25.22.495.428.703.3.301.748.515 1.229.644.787.211 1.681.2 2.455-.03 1.372-.431 2.534-1.204 3.24-2.155.256-.343.453-.706.58-1.08.05-.152.09-.304.09-.456a.73.73 0 0 0-.133-.447"/></g><path fill="#020204" d="M58.936 50.265a1.8 1.8 0 0 0-.483-.694 2.6 2.6 0 0 0-.723-.45c-.523-.223-1.094-.307-1.657-.411-.526-.099-1.052-.22-1.58-.31-.552-.092-1.12-.154-1.666-.03a2.84 2.84 0 0 0-1.276.683c-.36.33-.642.74-.844 1.184-.357.785-.47 1.665-.402 2.523.05.638.214 1.297.633 1.777.34.391.82.636 1.316.782a4.47 4.47 0 0 0 2.632-.036 6.95 6.95 0 0 0 3.474-2.613c.275-.402.512-.838.618-1.31.082-.36.085-.749-.042-1.095"/><mask id="mask18_6709_29666" width="10" height="8" x="50" y="48" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M58.936 50.265a1.8 1.8 0 0 0-.483-.694 2.6 2.6 0 0 0-.723-.45c-.523-.223-1.094-.307-1.657-.411-.526-.099-1.052-.22-1.58-.31-.552-.092-1.12-.154-1.666-.03a2.84 2.84 0 0 0-1.276.683c-.36.33-.642.74-.844 1.184-.357.785-.47 1.665-.402 2.523.05.638.214 1.297.633 1.777.34.391.82.636 1.316.782a4.47 4.47 0 0 0 2.632-.036 6.95 6.95 0 0 0 3.474-2.613c.275-.402.512-.838.618-1.31.082-.36.085-.749-.042-1.095"/></mask><g filter="url(#filter18_f_6709_29666)" mask="url(#mask18_6709_29666)"><path fill="url(#paint10_radial_6709_29666)" d="M53.125 48.114a3.02 3.02 0 0 0-2.438 1.462 3 3 0 0 0-.402 1.735c.02-.421.13-.835.335-1.203a2.47 2.47 0 0 1 1.681-1.23c.433-.078.88-.03 1.317.023.421.054.843.11 1.257.197.641.14 1.274.354 1.811.728.124.088.242.186.34.304.099.115.175.25.206.4.042.219-.02.45-.13.644-.11.197-.258.365-.416.523-.13.13-.264.25-.402.371.621-.12 1.249-.29 1.766-.65.217-.154.416-.337.546-.568.13-.233.183-.514.12-.773a1.2 1.2 0 0 0-.258-.47 2.3 2.3 0 0 0-.408-.349 4.86 4.86 0 0 0-2.197-.84 26 26 0 0 0-1.524-.234c-.396-.05-.804-.093-1.204-.07"/></g><mask id="mask19_6709_29666" width="10" height="8" x="50" y="48" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M58.936 50.265a1.8 1.8 0 0 0-.483-.694 2.6 2.6 0 0 0-.723-.45c-.523-.223-1.094-.307-1.657-.411-.526-.099-1.052-.22-1.58-.31-.552-.092-1.12-.154-1.666-.03a2.84 2.84 0 0 0-1.276.683c-.36.33-.642.74-.844 1.184-.357.785-.47 1.665-.402 2.523.05.638.214 1.297.633 1.777.34.391.82.636 1.316.782a4.47 4.47 0 0 0 2.632-.036 6.95 6.95 0 0 0 3.474-2.613c.275-.402.512-.838.618-1.31.082-.36.085-.749-.042-1.095"/></mask><g filter="url(#filter19_f_6709_29666)" mask="url(#mask19_6709_29666)"><path fill="url(#paint11_linear_6709_29666)" d="M53.125 48.114a3.02 3.02 0 0 0-2.438 1.462 3 3 0 0 0-.402 1.735c.02-.421.13-.835.335-1.203a2.47 2.47 0 0 1 1.681-1.23c.433-.078.88-.03 1.317.023.421.054.843.11 1.257.197.641.14 1.274.354 1.811.728.124.088.242.186.34.304.099.115.175.25.206.4.042.219-.02.45-.13.644-.11.197-.258.365-.416.523-.13.13-.264.25-.402.371.621-.12 1.249-.29 1.766-.65.217-.154.416-.337.546-.568.13-.233.183-.514.12-.773a1.2 1.2 0 0 0-.258-.47 2.3 2.3 0 0 0-.408-.349 4.86 4.86 0 0 0-2.197-.84 26 26 0 0 0-1.524-.234c-.396-.05-.804-.093-1.204-.07"/></g><path fill="url(#paint12_radial_6709_29666)" d="M29.377 10.766c-.43.023-.844.223-1.159.518-.318.295-.54.683-.678 1.091-.273.821-.21 1.71-.149 2.573.056.78.115 1.575.408 2.301.146.366.352.706.624.987.273.279.619.495.999.588.354.09.737.073 1.085-.036.352-.113.67-.313.934-.569.383-.374.639-.863.788-1.378s.19-1.054.182-1.592a6.7 6.7 0 0 0-.306-1.977c-.211-.635-.546-1.237-1.013-1.718a2.8 2.8 0 0 0-.773-.58 1.9 1.9 0 0 0-.942-.208"/><path fill="#020204" d="M28.336 14.34c-.09.547-.093 1.117.093 1.635.124.343.329.655.577.923a1.9 1.9 0 0 0 .56.435c.216.105.463.147.697.09.213-.053.4-.19.537-.362.138-.172.23-.377.295-.588.194-.622.163-1.3-.03-1.921-.139-.453-.372-.889-.732-1.193a1.45 1.45 0 0 0-.596-.312 1.03 1.03 0 0 0-.664.054 1.14 1.14 0 0 0-.52.523 2.4 2.4 0 0 0-.217.717"/><mask id="mask20_6709_29666" width="4" height="5" x="28" y="13" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M28.336 14.34c-.09.547-.093 1.117.093 1.635.124.343.329.655.577.923a1.9 1.9 0 0 0 .56.435c.216.105.463.147.697.09.213-.053.4-.19.537-.362.138-.172.23-.377.295-.588.194-.622.163-1.3-.03-1.921-.139-.453-.372-.889-.732-1.193a1.45 1.45 0 0 0-.596-.312 1.03 1.03 0 0 0-.664.054 1.14 1.14 0 0 0-.52.523 2.4 2.4 0 0 0-.217.717"/></mask><g filter="url(#filter20_f_6709_29666)" mask="url(#mask20_6709_29666)"><path fill="url(#paint13_linear_6709_29666)" d="M29.486 13.947c.06.155.256.211.366.335.104.118.213.245.273.393.11.285-.11.707.12.909.07.062.217.065.287 0 .279-.253.217-.762.107-1.122a1.37 1.37 0 0 0-.65-.788c-.14-.073-.351-.132-.472-.03-.076.067-.067.207-.03.303"/></g><mask id="mask21_6709_29666" width="6" height="9" x="27" y="10" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M29.377 10.766c-.43.023-.844.223-1.159.518-.318.295-.54.683-.678 1.091-.273.821-.21 1.71-.149 2.573.056.78.115 1.575.408 2.301.146.366.352.706.624.987.273.279.619.495.999.588.354.09.737.073 1.085-.036.352-.113.67-.313.934-.569.383-.374.639-.863.788-1.378s.19-1.054.182-1.592a6.7 6.7 0 0 0-.306-1.977c-.211-.635-.546-1.237-1.013-1.718a2.8 2.8 0 0 0-.773-.58 1.9 1.9 0 0 0-.942-.208"/></mask><g mask="url(#mask21_6709_29666)"><path fill="url(#paint14_radial_6709_29666)" d="M28.445 12.505c.653-.389 1.443-.479 2.2-.408.753.073 1.482.292 2.213.492.537.146 1.08.281 1.584.518.5.236.967.585 1.245 1.068.046.076.082.158.13.234a.7.7 0 0 0 .174.2c.07.053.16.09.248.084a.3.3 0 0 0 .126-.037.23.23 0 0 0 .093-.096.3.3 0 0 0 .028-.149.7.7 0 0 0-.028-.151c-.183-.667-.616-1.232-.942-1.843-.197-.365-.36-.748-.557-1.113-.683-1.252-1.806-2.233-3.08-2.872s-2.697-.945-4.12-1.026c-1.648-.099-3.299.098-4.925.385-.706.124-1.423.27-2.044.621-.312.175-.6.4-.822.681a2.04 2.04 0 0 0-.436.967c-.047.344.003.695.124 1.019.118.323.304.618.523.886.434.537.993.953 1.508 1.414.515.459.99.968 1.566 1.348.287.19.6.348.931.441s.687.118 1.024.048c.349-.07.675-.242.96-.461.283-.217.528-.479.761-.748.467-.543.903-1.137 1.516-1.502"/></g><g filter="url(#filter21_f_6709_29666)"><path fill="url(#paint15_linear_6709_29666)" d="M31.155 10.285a5.75 5.75 0 0 1 1.364 2.014c-.136-.818-.346-1.48-.88-2.014a4.1 4.1 0 0 0-1.12-.765c-.371-.166-.78-.27-1.015-.272-.234-.006-.29 0-.338.002-.05.003-.087.003.065.023.152.017.492.11.857.273.366.163.737.433 1.066.74"/></g><path fill="url(#paint16_radial_6709_29666)" d="M37.015 10.767c-.672.464-1.237 1.108-1.513 1.878-.349.97-.216 2.056.121 3.03.343.998.92 1.948 1.789 2.548.433.3.937.506 1.46.568a2.7 2.7 0 0 0 1.538-.268c.568-.298 1.004-.818 1.274-1.4.27-.585.386-1.23.422-1.873.045-.816-.034-1.648-.304-2.422-.292-.84-.821-1.617-1.57-2.1a3.1 3.1 0 0 0-1.237-.47 2.65 2.65 0 0 0-1.313.146c-.236.093-.456.22-.667.363"/><path fill="#020204" d="M38.57 12.803a1.56 1.56 0 0 0-.717.239 1.9 1.9 0 0 0-.54.528c-.29.42-.416.931-.435 1.44-.014.38.028.765.154 1.125.127.36.338.695.633.937.301.25.68.4 1.072.419.39.017.784-.096 1.105-.318.256-.177.461-.422.608-.697.146-.273.236-.577.275-.886a2.74 2.74 0 0 0-.261-1.6 2.23 2.23 0 0 0-1.193-1.08 1.7 1.7 0 0 0-.7-.107"/><mask id="mask22_6709_29666" width="5" height="6" x="36" y="12" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M38.57 12.803a1.56 1.56 0 0 0-.717.239 1.9 1.9 0 0 0-.54.528c-.29.42-.416.931-.435 1.44-.014.38.028.765.154 1.125.127.36.338.695.633.937.301.25.68.4 1.072.419.39.017.784-.096 1.105-.318.256-.177.461-.422.608-.697.146-.273.236-.577.275-.886a2.74 2.74 0 0 0-.261-1.6 2.23 2.23 0 0 0-1.193-1.08 1.7 1.7 0 0 0-.7-.107"/></mask><g filter="url(#filter22_f_6709_29666)" mask="url(#mask22_6709_29666)"><path fill="url(#paint17_linear_6709_29666)" d="M40.137 15.008c.282-.282-.2-1.027-.576-1.334-.273-.219-1.063-.452-1.03-.21.034.239.391.548.627.784.296.29.844.895.98.76"/></g><mask id="mask23_6709_29666" width="8" height="9" x="35" y="10" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M37.015 10.767c-.672.464-1.237 1.108-1.513 1.878-.349.97-.216 2.056.121 3.03.343.998.92 1.948 1.789 2.548.433.3.937.506 1.46.568a2.7 2.7 0 0 0 1.538-.268c.568-.298 1.004-.818 1.274-1.4.27-.585.386-1.23.422-1.873.045-.816-.034-1.648-.304-2.422-.292-.84-.821-1.617-1.57-2.1a3.1 3.1 0 0 0-1.237-.47 2.65 2.65 0 0 0-1.313.146c-.236.093-.456.22-.667.363"/></mask><g mask="url(#mask23_6709_29666)"><path fill="url(#paint18_linear_6709_29666)" d="M34.47 13.222a5.8 5.8 0 0 1 1.969-1.069c1.477-.456 3.15-.276 4.455.554.45.284.852.638 1.271.97.416.33.86.639 1.364.816.273.096.563.152.85.121.258-.025.509-.124.723-.27.213-.15.393-.346.528-.568.27-.444.357-.985.31-1.502-.093-1.038-.678-1.952-1.168-2.872-.154-.286-.3-.579-.486-.846-.565-.824-1.471-1.367-2.419-1.685s-1.949-.433-2.942-.557c-.444-.056-.891-.115-1.333-.062-.509.062-.987.268-1.485.394-.236.062-.475.104-.709.172s-.464.16-.655.312c-.276.222-.45.557-.526.903-.076.348-.059.708-.003 1.06.11.703.374 1.387.35 2.098-.018.487-.172.968-.153 1.454.006.144.034.436.06.577"/></g><g filter="url(#filter23_f_6709_29666)"><path fill="url(#paint19_linear_6709_29666)" d="M39.356 8.77c-.116.146-.22.303-.301.478a4.3 4.3 0 0 1 1.46.621c.86.571 1.513 1.404 1.97 2.332q.161-.176.288-.386c-.461-.967-1.125-1.842-2.014-2.432a4.4 4.4 0 0 0-1.403-.613"/></g><mask id="mask24_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter24_f_6709_29666)" mask="url(#mask24_6709_29666)"><path fill="#000" fill-opacity=".259" d="M28.44 25.124c.413 1.198 1.243 2.219 2.227 3.015.327.267.672.512 1.058.683.382.175.807.273 1.226.236.41-.033.802-.196 1.162-.399.36-.202.691-.447 1.04-.666.596-.38 1.235-.687 1.857-1.024.745-.408 1.47-.872 2.098-1.446.29-.261.556-.548.874-.773.318-.228.7-.391 1.089-.363.292.02.565.143.852.205.143.031.29.045.436.023a.67.67 0 0 0 .385-.189.67.67 0 0 0 .172-.495 1.2 1.2 0 0 0-.152-.509c-.166-.318-.42-.59-.532-.93-.1-.304-.081-.63-.073-.948.009-.321.003-.653-.143-.937a1.2 1.2 0 0 0-.515-.498 1.8 1.8 0 0 0-.697-.197c-.484-.045-.968.05-1.455.076-.64.037-1.288-.042-1.932-.005-.801.05-1.589.28-2.393.284-.917.002-1.834-.299-2.74-.155-.39.062-.762.202-1.133.326-.374.127-.76.236-1.153.23-.447-.008-.88-.162-1.328-.193-.222-.017-.45 0-.66.078a.93.93 0 0 0-.501.422.9.9 0 0 0-.093.369c-.006.13.011.256.042.382.062.248.178.481.27.718.338.863.41 1.805.712 2.68"/></g><mask id="mask25_6709_29666" width="41" height="71" x="16" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M35.705 0c-1.687 0-3.38.332-4.91 1.159a9.04 9.04 0 0 0-3.778 3.929c-.821 1.654-1.142 3.42-1.192 5.366-.093 3.696.084 7.571.363 11.084.073 1.069.208 1.693.07 2.793-.456 2.334-2.498 3.904-3.589 5.954-1.2 2.261-1.707 4.818-2.613 7.214-.83 2.191-1.994 4.247-2.779 6.455-1.1 3.085-1.428 6.477-.703 9.672.554 2.436 1.71 4.72 3.268 6.674-.224.405-.444.818-.674 1.22-.723 1.247-1.606 2.43-2.017 3.812-.205.689-.287 1.425-.155 2.134s.492 1.387 1.055 1.837c.368.292.816.484 1.274.59s.934.13 1.406.121c1.792-.039 3.53-.582 5.262-1.037q1.545-.403 3.103-.726c3.695-.757 7.818-.453 11.247.042q1.742.266 3.456.684c1.79.433 3.57.984 5.409 1.037.484.014.973-.008 1.445-.112.473-.107.931-.298 1.308-.6.566-.45.926-1.13 1.058-1.839.132-.708.05-1.448-.158-2.14-.416-1.384-1.308-2.562-2.044-3.802-.293-.493-.563-.993-.853-1.485 2.222-2.495 4.011-5.38 5.046-8.55 1.128-3.46 1.336-7.186.86-10.795-.475-3.608-1.62-7.107-3.124-10.42-1.89-4.151-3.48-5.653-4.632-9.301-1.243-3.943-.217-8.61-1.142-12.184a12.5 12.5 0 0 0-1.533-3.44c-.793-1.245-1.8-2.36-2.995-3.225C40.537.737 38.14 0 35.705 0"/></mask><g filter="url(#filter25_f_6709_29666)" mask="url(#mask25_6709_29666)" opacity=".3"><path fill="#000" d="M27.29 21.712a9.4 9.4 0 0 1 2.126 1.797c.56.645 1.035 1.376 1.77 1.851.514.338 1.136.526 1.766.585.74.068 1.487-.042 2.202-.236.66-.177 1.3-.43 1.884-.762 1.117-.633 2.048-1.561 3.277-1.977.267-.093.545-.158.804-.27.259-.11.504-.279.627-.515.118-.23.113-.492.152-.743.042-.27.135-.529.186-.796s.056-.55-.068-.796a1.1 1.1 0 0 0-.509-.466 1.9 1.9 0 0 0-.706-.158c-.483-.023-.964.093-1.451.132-.641.054-1.288-.022-1.932-.003-.802.023-1.592.189-2.394.225-.914.04-1.825-.095-2.739-.123a6 6 0 0 0-1.184.056 3 3 0 0 0-1.102.385c-.321.194-.583.462-.875.69a2.6 2.6 0 0 1-.473.3 1.5 1.5 0 0 1-.551.144c-.098.003-.2-.003-.295.01a.64.64 0 0 0-.414.234.55.55 0 0 0-.101.436"/></g><path fill="url(#paint20_radial_6709_29666)" d="M31.404 16.461c.43-.48.723-1.068 1.134-1.563.205-.248.444-.476.723-.636s.604-.25.925-.222c.357.03.692.208.953.453.262.244.456.554.61.877.15.312.268.641.481.911.228.287.546.481.836.71.143.112.284.233.396.376.116.143.203.31.242.49a1.04 1.04 0 0 1-.045.548 1.24 1.24 0 0 1-.306.461c-.267.259-.633.4-1.002.45-.736.104-1.482-.115-2.227-.096-.751.023-1.488.287-2.242.262-.374-.014-.756-.107-1.066-.32a1.4 1.4 0 0 1-.388-.409 1.15 1.15 0 0 1-.163-.534c-.006-.18.037-.36.11-.523.07-.166.171-.315.284-.456.228-.278.506-.509.745-.779"/><path fill="url(#paint21_radial_6709_29666)" d="M27.321 21.108a.8.8 0 0 0 .079.205c.065.107.16.194.262.268.1.076.21.137.317.202.566.357 1.027.855 1.438 1.384.548.708 1.035 1.493 1.769 2.008.517.366 1.136.57 1.766.636.74.073 1.488-.046 2.202-.256a7.7 7.7 0 0 0 1.884-.83c1.117-.686 2.048-1.693 3.277-2.146.267-.099.546-.169.804-.29.26-.123.504-.304.628-.562.118-.248.112-.535.151-.807.043-.29.135-.571.186-.861s.056-.6-.067-.866a1.12 1.12 0 0 0-.51-.504 1.7 1.7 0 0 0-.705-.174c-.484-.023-.965.101-1.452.146-.64.06-1.288-.025-1.932-.006-.801.026-1.592.206-2.393.245-.914.042-1.826-.098-2.74-.135a5.6 5.6 0 0 0-1.186.056c-.392.065-.774.2-1.1.425-.318.22-.571.518-.864.77a2.2 2.2 0 0 1-.478.327 1.2 1.2 0 0 1-.557.132c-.098-.003-.202-.017-.295.011a.4.4 0 0 0-.157.099 1 1 0 0 0-.116.146 2.4 2.4 0 0 0-.21.377"/><mask id="mask26_6709_29666" width="16" height="8" x="27" y="18" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.321 21.108a.8.8 0 0 0 .079.205c.065.107.16.194.262.268.1.076.21.137.317.202.566.357 1.027.855 1.438 1.384.548.708 1.035 1.493 1.769 2.008.517.366 1.136.57 1.766.636.74.073 1.488-.046 2.202-.256a7.7 7.7 0 0 0 1.884-.83c1.117-.686 2.048-1.693 3.277-2.146.267-.099.546-.169.804-.29.26-.123.504-.304.628-.562.118-.248.112-.535.151-.807.043-.29.135-.571.186-.861s.056-.6-.067-.866a1.12 1.12 0 0 0-.51-.504 1.7 1.7 0 0 0-.705-.174c-.484-.023-.965.101-1.452.146-.64.06-1.288-.025-1.932-.006-.801.026-1.592.206-2.393.245-.914.042-1.826-.098-2.74-.135a5.6 5.6 0 0 0-1.186.056c-.392.065-.774.2-1.1.425-.318.22-.571.518-.864.77a2.2 2.2 0 0 1-.478.327 1.2 1.2 0 0 1-.557.132c-.098-.003-.202-.017-.295.011a.4.4 0 0 0-.157.099 1 1 0 0 0-.116.146 2.4 2.4 0 0 0-.21.377"/></mask><g filter="url(#filter26_f_6709_29666)" mask="url(#mask26_6709_29666)"><path fill="#d9b30d" d="M30.91 22.095a1.61 1.61 0 0 0 1.055 1.901c.478.16 1.018.082 1.465-.152.261-.135.498-.326.647-.579a1.05 1.05 0 0 0 .149-.41.94.94 0 0 0-.045-.434 1 1 0 0 0-.279-.385 1.3 1.3 0 0 0-.422-.23 4.3 4.3 0 0 0-1.1-.192c-.567-.011-1.377.096-1.47.481"/></g><mask id="mask27_6709_29666" width="16" height="8" x="27" y="18" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.32 21.108q.025.108.08.205c.064.107.16.194.26.268.102.076.212.137.318.202.566.357 1.027.855 1.438 1.384.548.708 1.035 1.493 1.769 2.008.517.366 1.136.57 1.766.636.74.073 1.488-.046 2.202-.256a7.7 7.7 0 0 0 1.885-.83c1.116-.686 2.047-1.693 3.276-2.146.267-.099.546-.169.804-.29.26-.123.504-.304.628-.562.118-.248.112-.535.151-.807.043-.29.136-.571.186-.861s.056-.6-.067-.866a1.1 1.1 0 0 0-.51-.504 1.7 1.7 0 0 0-.705-.174c-.484-.023-.965.101-1.452.146-.64.06-1.288-.025-1.932-.006-.801.026-1.592.206-2.393.245-.914.042-1.826-.098-2.74-.135a5.6 5.6 0 0 0-1.186.056c-.391.065-.774.2-1.1.425-.318.22-.571.518-.864.77a2.2 2.2 0 0 1-.478.327 1.2 1.2 0 0 1-.557.132c-.098-.003-.202-.017-.295.011a.4.4 0 0 0-.157.099 1 1 0 0 0-.116.146 2.4 2.4 0 0 0-.21.377"/></mask><g filter="url(#filter27_f_6709_29666)" mask="url(#mask27_6709_29666)"><path fill="#604405" d="M29.337 19.086c-.326.191-.639.402-.945.619-.16.115-.324.236-.408.413a1 1 0 0 0-.076.402c0 .14.008.279-.011.416-.011.093-.037.186-.04.279a.5.5 0 0 0 .012.14c.014.046.036.09.067.124a.34.34 0 0 0 .158.09c.059.017.118.026.18.04.284.067.531.241.748.438.216.194.413.417.641.6.613.5 1.426.708 2.22.72.792.014 1.577-.152 2.35-.327.608-.138 1.215-.278 1.798-.495a7.9 7.9 0 0 0 2.452-1.46c.33-.284.636-.596 1.004-.826.324-.206.686-.34 1.018-.535a1 1 0 0 0 .085-.056.3.3 0 0 0 .067-.079.25.25 0 0 0 .009-.174.5.5 0 0 0-.088-.155 1.3 1.3 0 0 0-.137-.14c-.346-.296-.813-.403-1.269-.44-.453-.033-.911-.008-1.358-.084-.422-.07-.822-.227-1.23-.357a9 9 0 0 0-1.304-.317 8.6 8.6 0 0 0-3.148.075 9.2 9.2 0 0 0-2.795 1.089"/></g><path fill="url(#paint22_linear_6709_29666)" d="M29.233 17.986c-.467.315-.889.7-1.246 1.136-.202.25-.388.523-.49.827-.08.242-.109.495-.16.745-.02.093-.042.186-.039.282q0 .069.02.14a.3.3 0 0 0 .07.121.4.4 0 0 0 .208.104c.079.014.158.017.236.026.352.042.675.21.968.413.293.2.563.436.863.624.661.42 1.452.605 2.236.636.782.031 1.564-.087 2.335-.242.61-.12 1.218-.267 1.797-.495.889-.351 1.69-.889 2.452-1.46a10 10 0 0 0 1.005-.826c.104-.104.208-.209.32-.304.113-.093.24-.175.38-.22.213-.067.444-.047.666-.01.166.027.332.064.501.058a.8.8 0 0 0 .248-.05.5.5 0 0 0 .205-.146.5.5 0 0 0 .107-.307.63.63 0 0 0-.09-.318c-.113-.191-.307-.32-.51-.41-.278-.124-.579-.183-.874-.256a12.5 12.5 0 0 1-2.627-.96c-.416-.205-.821-.433-1.229-.652-.422-.225-.85-.442-1.305-.582-1.024-.31-2.138-.208-3.147.143a6.7 6.7 0 0 0-2.9 1.983"/><mask id="mask28_6709_29666" width="15" height="9" x="27" y="15" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M29.233 17.986c-.467.315-.889.7-1.246 1.136-.202.25-.388.523-.49.827-.08.242-.109.495-.16.745-.02.093-.042.186-.039.282q0 .069.02.14a.3.3 0 0 0 .07.121.4.4 0 0 0 .208.104c.079.014.158.017.236.026.352.042.675.21.968.413.293.2.563.436.863.624.661.42 1.452.605 2.236.636.782.031 1.564-.087 2.335-.242.61-.12 1.218-.267 1.797-.495.889-.351 1.69-.889 2.452-1.46a10 10 0 0 0 1.005-.826c.104-.104.208-.209.32-.304.113-.093.24-.175.38-.22.213-.067.444-.047.666-.01.166.027.332.064.501.058a.8.8 0 0 0 .248-.05.5.5 0 0 0 .205-.146.5.5 0 0 0 .107-.307.63.63 0 0 0-.09-.318c-.113-.191-.307-.32-.51-.41-.278-.124-.579-.183-.874-.256a12.5 12.5 0 0 1-2.627-.96c-.416-.205-.821-.433-1.229-.652-.422-.225-.85-.442-1.305-.582-1.024-.31-2.138-.208-3.147.143a6.7 6.7 0 0 0-2.9 1.983"/></mask><g filter="url(#filter28_f_6709_29666)" mask="url(#mask28_6709_29666)"><path fill="#f6da4a" d="M36.408 18.211a.46.46 0 0 0-.22-.143.6.6 0 0 0-.26-.012c-.175.031-.333.124-.479.225a5.4 5.4 0 0 0-1.1 1.024c-.421.515-.77 1.108-.888 1.764-.02.11-.031.225-.02.334a.5.5 0 0 0 .138.301c.067.07.163.113.259.127.098.014.2 0 .292-.031.186-.062.34-.194.49-.324.807-.725 1.538-1.592 1.83-2.638.028-.104.054-.21.054-.32s-.028-.22-.096-.307"/></g><g filter="url(#filter29_f_6709_29666)" opacity=".8"><path fill="url(#paint23_radial_6709_29666)" d="M31.703 16.61c-.217-.07-.571.31-.456.504.031.053.13.121.197.084.098-.053.18-.25.287-.326.07-.05.056-.236-.028-.261"/></g><g filter="url(#filter30_f_6709_29666)" opacity=".8"><path fill="url(#paint24_radial_6709_29666)" d="M34.47 16.712c.056.18.346.15.514.236.147.076.265.242.43.248.158.003.406-.056.425-.214.026-.205-.275-.337-.47-.413-.25-.096-.57-.146-.804-.017-.053.03-.112.101-.095.16"/></g><mask id="mask29_6709_29666" width="16" height="11" x="27" y="15" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M27.32 21.108q.025.108.08.205c.064.107.16.194.26.268.102.076.212.137.318.202.566.357 1.027.855 1.438 1.384.548.708 1.035 1.493 1.769 2.008.517.366 1.136.57 1.766.636.74.073 1.488-.046 2.202-.256a7.7 7.7 0 0 0 1.885-.83c1.116-.686 2.047-1.693 3.276-2.146.267-.099.546-.169.804-.29.26-.123.504-.304.628-.562.118-.248.112-.535.151-.807.043-.29.136-.571.186-.861s.056-.6-.067-.866a1.1 1.1 0 0 0-.51-.504 1.7 1.7 0 0 0-.705-.174c-.484-.023-.965.101-1.452.146-.64.06-1.288-.025-1.932-.006-.801.026-1.592.206-2.393.245-.914.042-1.826-.098-2.74-.135a5.6 5.6 0 0 0-1.186.056c-.391.065-.774.2-1.1.425-.318.22-.571.518-.864.77a2.2 2.2 0 0 1-.478.327 1.2 1.2 0 0 1-.557.132c-.098-.003-.202-.017-.295.011a.4.4 0 0 0-.157.099 1 1 0 0 0-.116.146 2.4 2.4 0 0 0-.21.377"/><path fill="#fff" d="M29.233 17.986c-.467.315-.889.7-1.246 1.136-.202.25-.388.523-.49.827-.08.242-.109.495-.16.745-.02.093-.042.186-.039.282q0 .069.02.14a.3.3 0 0 0 .07.121.4.4 0 0 0 .208.104c.079.014.158.017.236.026.352.042.675.21.968.413.293.2.563.436.863.624.661.42 1.452.605 2.236.636.782.031 1.564-.087 2.335-.242.61-.12 1.218-.267 1.797-.495.889-.351 1.69-.889 2.452-1.46a10 10 0 0 0 1.005-.826c.104-.104.208-.209.32-.304.113-.093.24-.175.38-.22.213-.067.444-.047.666-.01.166.027.332.064.501.058a.8.8 0 0 0 .248-.05.5.5 0 0 0 .205-.146.5.5 0 0 0 .107-.307.63.63 0 0 0-.09-.318c-.113-.191-.307-.32-.51-.41-.278-.124-.579-.183-.874-.256a12.5 12.5 0 0 1-2.627-.96c-.416-.205-.821-.433-1.229-.652-.422-.225-.85-.442-1.305-.582-1.024-.31-2.138-.208-3.147.143a6.7 6.7 0 0 0-2.9 1.983"/></mask><g filter="url(#filter31_f_6709_29666)" mask="url(#mask29_6709_29666)"><path fill="url(#paint25_linear_6709_29666)" d="M41.982 19.449a1.1 1.1 0 0 1-.272.605.72.72 0 0 1-.518.25.56.56 0 0 1-.461-.25.9.9 0 0 1-.136-.605q.02-.171.09-.329t.182-.279a.8.8 0 0 1 .246-.185.6.6 0 0 1 .273-.065q.136 0 .258.065.12.065.203.186t.12.278.015.329"/></g></g><defs><filter id="filter0_f_6709_29666" width="11.214" height="10.657" x="20.59" y="28.637" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".64"/></filter><filter id="filter1_f_6709_29666" width="16.955" height="12.957" x="32.898" y="27.321" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".98"/></filter><filter id="filter2_f_6709_29666" width="7.977" height="8.339" x="28.326" y="28.962" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".68"/></filter><filter id="filter3_f_6709_29666" width="6.029" height="19.549" x="27.454" y="36.071" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.25"/></filter><filter id="filter4_f_6709_29666" width="9.562" height="9.613" x="46.491" y="33.347" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.78"/></filter><filter id="filter5_f_6709_29666" width="10.911" height="10.704" x="35.662" y="-.375" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.73"/></filter><filter id="filter6_f_6709_29666" width="6.071" height="6.407" x="42.777" y="19.898" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".78"/></filter><filter id="filter7_f_6709_29666" width="10.441" height="19.353" x="14.831" y="32.995" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".98"/></filter><filter id="filter8_f_6709_29666" width="11.573" height="24.4" x="45.551" y="31.086" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.19"/></filter><filter id="filter9_f_6709_29666" width="34.751" height="34.557" x="-.213" y="43.094" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="3.38"/></filter><filter id="filter10_f_6709_29666" width="27.205" height="28.362" x="3.08" y="44.733" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="2.1"/></filter><filter id="filter11_f_6709_29666" width="7.659" height="12.851" x="19.385" y="52.294" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".32"/></filter><filter id="filter12_f_6709_29666" width="25.109" height="26.64" x="40.319" y="49.102" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.95"/></filter><filter id="filter13_f_6709_29666" width="35.647" height="35.917" x="38.248" y="42.503" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="4.12"/></filter><filter id="filter14_f_6709_29666" width="30.776" height="30.682" x="41.029" y="43.04" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="3.12"/></filter><filter id="filter15_f_6709_29666" width="14.977" height="3.798" x="46.237" y="49.689" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".41"/></filter><filter id="filter16_f_6709_29666" width="18.051" height="16.869" x="44.776" y="46.769" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="2.45"/></filter><filter id="filter17_f_6709_29666" width="12.731" height="9.591" x="47.436" y="48.968" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.12"/></filter><filter id="filter18_f_6709_29666" width="11.985" height="7.48" x="48.517" y="46.347" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".88"/></filter><filter id="filter19_f_6709_29666" width="11.985" height="7.48" x="48.517" y="46.347" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".88"/></filter><filter id="filter20_f_6709_29666" width="3.032" height="3.802" x="28.579" y="12.709" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".44"/></filter><filter id="filter21_f_6709_29666" width="3.876" height="3.534" x="28.882" y="9.005" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".12"/></filter><filter id="filter22_f_6709_29666" width="3.491" height="3.466" x="37.63" y="12.461" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".45"/></filter><filter id="filter23_f_6709_29666" width="4.238" height="3.951" x="38.795" y="8.51" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".13"/></filter><filter id="filter24_f_6709_29666" width="22.502" height="16.166" x="23.915" y="16.4" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation="1.75"/></filter><filter id="filter25_f_6709_29666" width="18.038" height="9.942" x="25.679" y="17.623" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".8"/></filter><filter id="filter26_f_6709_29666" width="6.447" height="5.547" x="29.326" y="20.073" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".77"/></filter><filter id="filter27_f_6709_29666" width="15.421" height="8.155" x="26.556" y="16.512" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".65"/></filter><filter id="filter28_f_6709_29666" width="5.987" height="6.709" x="31.977" y="16.587" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".73"/></filter><filter id="filter29_f_6709_29666" width=".952" height="1.007" x="31.025" y="16.402" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".1"/></filter><filter id="filter30_f_6709_29666" width="1.774" height="1.122" x="34.267" y="16.274" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".1"/></filter><filter id="filter31_f_6709_29666" width="2.319" height="2.633" x="40.129" y="18.131" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_6709_29666" stdDeviation=".23"/></filter><radialGradient id="paint0_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(5.34375 0 0 5.0625 22.832 34.085)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint1_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(6.6375 0 0 5.0625 40.99 37.012)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint2_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(2.62969 0 0 2.8125 32.122 35.851)" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity=".25"/></radialGradient><radialGradient id="paint8_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(15 -181.11 229.995)scale(5.52938 5.805)" gradientUnits="userSpaceOnUse"><stop stop-color="#110800"/><stop offset=".59" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="paint9_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(5.54693 -.23442 .17647 4.17565 53.356 53.406)" gradientUnits="userSpaceOnUse"><stop stop-color="#110800"/><stop offset=".59" stop-color="#a65a00" stop-opacity=".8"/><stop offset="1" stop-color="#ff921e" stop-opacity="0"/></radialGradient><radialGradient id="paint10_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(23.5 -90.63 163.196)scale(1.9547 .90281)" gradientUnits="userSpaceOnUse"><stop stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></radialGradient><radialGradient id="paint12_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(-.6 1395.715 -2852.806)scale(2.88 4.41)" gradientUnits="userSpaceOnUse"><stop stop-color="#fefefc"/><stop offset=".75" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="paint14_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(-9.35 89.969 -174.22)scale(1.75781 1.62281)" gradientUnits="userSpaceOnUse"><stop stop-color="#c8c8c8"/><stop offset="1" stop-color="#797978"/></radialGradient><radialGradient id="paint16_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(-1.8 479.634 -1228.65)scale(3.83625 4.41)" gradientUnits="userSpaceOnUse"><stop stop-color="#fefefc"/><stop offset=".75" stop-color="#fefefc"/><stop offset="1" stop-color="#d4d4d4"/></radialGradient><radialGradient id="paint20_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(-36 42.563 -42.46)scale(3.2175 2.91937)" gradientUnits="userSpaceOnUse"><stop stop-color="#020204"/><stop offset=".73" stop-color="#020204"/><stop offset="1" stop-color="#5c5c5c"/></radialGradient><radialGradient id="paint21_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="rotate(-22.4 68.398 -82.236)scale(7.63594 5.36344)" gradientUnits="userSpaceOnUse"><stop stop-color="#d2940a"/><stop offset=".75" stop-color="#d89c08"/><stop offset=".87" stop-color="#b67e07"/><stop offset="1" stop-color="#946106"/></radialGradient><radialGradient id="paint23_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(.37125 0 0 .39937 31.531 16.841)" gradientUnits="userSpaceOnUse"><stop stop-color="#3a2903"/><stop offset=".55" stop-color="#735208"/><stop offset="1" stop-color="#ac8c04"/></radialGradient><radialGradient id="paint24_radial_6709_29666" cx="0" cy="0" r="1" gradientTransform="matrix(.78187 0 0 .45563 35.057 16.791)" gradientUnits="userSpaceOnUse"><stop stop-color="#3a2903"/><stop offset=".55" stop-color="#735208"/><stop offset="1" stop-color="#ac8c04"/></radialGradient><linearGradient id="paint3_linear_6709_29666" x1="12.144" x2="23.712" y1="54.284" y2="73.693" gradientUnits="userSpaceOnUse"><stop stop-color="#b98309"/><stop offset="1" stop-color="#382605"/></linearGradient><linearGradient id="paint4_linear_6709_29666" x1="23.758" x2="27.397" y1="59.296" y2="66.153" gradientUnits="userSpaceOnUse"><stop stop-color="#ebc40c"/><stop offset="1" stop-color="#ebc40c" stop-opacity="0"/></linearGradient><linearGradient id="paint5_linear_6709_29666" x1="46.949" x2="47.869" y1="59.614" y2="66.299" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-opacity="0"/></linearGradient><linearGradient id="paint6_linear_6709_29666" x1="48.235" x2="59.89" y1="71.162" y2="52.268" gradientUnits="userSpaceOnUse"><stop stop-color="#3e2a06"/><stop offset="1" stop-color="#ad780a"/></linearGradient><linearGradient id="paint7_linear_6709_29666" x1="51.416" x2="51.073" y1="50.813" y2="53.899" gradientUnits="userSpaceOnUse"><stop stop-color="#f3cd0c"/><stop offset="1" stop-color="#f3cd0c" stop-opacity="0"/></linearGradient><linearGradient id="paint11_linear_6709_29666" x1="52.225" x2="52.951" y1="48.82" y2="48.789" gradientUnits="userSpaceOnUse"><stop stop-color="#7c7c7c"/><stop offset="1" stop-color="#7c7c7c" stop-opacity=".33"/></linearGradient><linearGradient id="paint13_linear_6709_29666" x1="29.331" x2="30.746" y1="13.117" y2="15.646" gradientUnits="userSpaceOnUse"><stop stop-color="#757574" stop-opacity="0"/><stop offset=".25" stop-color="#757574"/><stop offset=".5" stop-color="#757574"/><stop offset="1" stop-color="#757574" stop-opacity="0"/></linearGradient><linearGradient id="paint15_linear_6709_29666" x1="29.135" x2="32.198" y1="9.143" y2="12.271" gradientUnits="userSpaceOnUse"><stop stop-color="#646464" stop-opacity="0"/><stop offset=".31" stop-color="#646464" stop-opacity=".58"/><stop offset=".47" stop-color="#646464"/><stop offset=".73" stop-color="#646464" stop-opacity=".26"/><stop offset="1" stop-color="#646464" stop-opacity="0"/></linearGradient><linearGradient id="paint17_linear_6709_29666" x1="38.776" x2="40.404" y1="13.289" y2="15.218" gradientUnits="userSpaceOnUse"><stop stop-color="#949494" stop-opacity=".39"/><stop offset=".5" stop-color="#949494"/><stop offset="1" stop-color="#949494" stop-opacity=".39"/></linearGradient><linearGradient id="paint18_linear_6709_29666" x1="37.378" x2="42.559" y1="10.19" y2="13.222" gradientUnits="userSpaceOnUse"><stop stop-color="#747474"/><stop offset=".13" stop-color="#8c8c8c"/><stop offset=".25" stop-color="#a4a4a4"/><stop offset=".5" stop-color="#d4d4d4"/><stop offset=".62" stop-color="#d4d4d4"/><stop offset="1" stop-color="#7c7c7c"/></linearGradient><linearGradient id="paint19_linear_6709_29666" x1="39.139" x2="42.587" y1="8.876" y2="12.133" gradientUnits="userSpaceOnUse"><stop stop-color="#646464" stop-opacity="0"/><stop offset=".31" stop-color="#646464" stop-opacity=".58"/><stop offset=".47" stop-color="#646464"/><stop offset=".73" stop-color="#646464" stop-opacity=".26"/><stop offset="1" stop-color="#646464" stop-opacity="0"/></linearGradient><linearGradient id="paint22_linear_6709_29666" x1="27.588" x2="41.279" y1="19.48" y2="19.373" gradientUnits="userSpaceOnUse"><stop stop-color="#ad780a"/><stop offset=".12" stop-color="#d89e08"/><stop offset=".25" stop-color="#edb80b"/><stop offset=".39" stop-color="#ebc80d"/><stop offset=".53" stop-color="#f5d838"/><stop offset=".77" stop-color="#f6d811"/><stop offset="1" stop-color="#f5cd31"/></linearGradient><linearGradient id="paint25_linear_6709_29666" x1="41.27" x2="41.27" y1="18.982" y2="19.994" gradientUnits="userSpaceOnUse"><stop stop-color="#f5ce2d"/><stop offset="1" stop-color="#d79b08"/></linearGradient><clipPath id="clip0_6709_29666"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/loom.svg b/web/packages/design/src/ResourceIcon/assets/loom.svg
index 1694123a879bd..c6b594abceac8 100644
--- a/web/packages/design/src/ResourceIcon/assets/loom.svg
+++ b/web/packages/design/src/ResourceIcon/assets/loom.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4404)">
-<path d="M72 32.232H50.0665L69.061 21.264L65.2942 14.736L46.2974 25.704L57.2617 6.708L50.7359 2.94L39.7691 21.9312V0H32.2309V21.9336L21.2641 2.94L14.7359 6.708L25.7002 25.6992L6.70816 14.736L2.93902 21.264L21.9335 32.232H0V39.7704H21.9311L2.93902 50.7384L6.70576 57.2664L25.7026 46.2984L14.7359 65.2944L21.2617 69.0624L32.2309 50.0688V72H39.7691V49.5984L50.9374 68.9424L57.0578 65.4096L45.8871 46.0608L65.2894 57.264L69.0586 50.736L50.0665 39.768H71.9976L72 32.232ZM36 46.248C34.6543 46.2482 33.3218 45.9832 32.0786 45.4682C30.8353 44.9532 29.7056 44.1983 28.7539 43.2466C27.8023 42.2949 27.0474 41.1649 26.5323 39.9214C26.0172 38.6778 25.752 37.3449 25.7518 35.9988C25.7517 34.6527 26.0165 33.3197 26.5314 32.0761C27.0462 30.8324 27.8008 29.7023 28.7522 28.7503C29.7036 27.7984 30.8332 27.0432 32.0763 26.5279C33.3195 26.0126 34.6519 25.7474 35.9976 25.7472C38.7153 25.7469 41.3218 26.8265 43.2437 28.7486C45.1656 30.6707 46.2455 33.2778 46.2458 35.9964C46.2461 38.715 45.1668 41.3223 43.2454 43.2449C41.3239 45.1674 38.7177 46.2477 36 46.248Z" fill="#625DF5"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4404">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4404)"><path fill="#625df5" d="M72 32.232H50.066l18.995-10.968-3.767-6.528-18.997 10.968L57.262 6.708 50.736 2.94 39.769 21.931V0h-7.538v21.934L21.264 2.94l-6.528 3.768L25.7 25.699 6.708 14.736 2.94 21.264l18.995 10.968H0v7.538h21.931L2.94 50.738l3.767 6.528 18.997-10.968-10.967 18.996 6.526 3.768L32.23 50.07V72h7.538V49.598l11.168 19.344 6.12-3.532-11.17-19.35L65.29 57.265l3.77-6.528-18.992-10.968h21.93zM36 46.248a10.24 10.24 0 0 1-9.468-6.327 10.255 10.255 0 0 1 5.544-13.393 10.245 10.245 0 0 1 14.17 9.468A10.253 10.253 0 0 1 36 46.248"/></g><defs><clipPath id="clip0_8803_4404"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/lucid.co-dark.svg b/web/packages/design/src/ResourceIcon/assets/lucid.co-dark.svg
index 6f751e2e14632..6994d66dcd8ff 100644
--- a/web/packages/design/src/ResourceIcon/assets/lucid.co-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/lucid.co-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M35.9999 0L11 14.4V72L35.9999 57.5998V0Z" fill="white"/>
-<path d="M60.9997 71.1032V43.2002L36 57.6001V71.1032H60.9997Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M36 0 11 14.4V72l25-14.4zm25 71.103V43.2L36 57.6v13.503z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/lucid.co-light.svg b/web/packages/design/src/ResourceIcon/assets/lucid.co-light.svg
index 7c6b31c2951b1..c23baecfa6bea 100644
--- a/web/packages/design/src/ResourceIcon/assets/lucid.co-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/lucid.co-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M35.9999 0L11 14.4V72L35.9999 57.5998V0Z" fill="black"/>
-<path d="M60.9997 71.1032V43.2002L36 57.6001V71.1032H60.9997Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M36 0 11 14.4V72l25-14.4zm25 71.103V43.2L36 57.6v13.503z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/lusha-dark.svg b/web/packages/design/src/ResourceIcon/assets/lusha-dark.svg
index e6ba6ca2fdb60..ca3e290d24a84 100644
--- a/web/packages/design/src/ResourceIcon/assets/lusha-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/lusha-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17455)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.5931 17.4754C57.5931 18.8483 57.4129 20.0992 57.0793 21.235C71.2091 29.5387 63.9357 56.5547 61.8065 63.4363C61.7478 63.6263 61.4213 63.5532 61.4274 63.3546C61.4966 61.0698 61.1411 57.8652 59.5737 54.7804C59.6208 55.1861 59.6448 55.5986 59.6448 56.017C59.6448 61.8902 54.8855 66.6512 49.0145 66.6512C43.1435 66.6512 38.3842 61.8902 38.3842 56.017C38.3842 54.9272 38.5478 53.8759 38.8524 52.886C38.7674 52.8636 38.6779 52.8409 38.5849 52.8179C37.9691 52.6667 37.3223 52.5476 36.8912 52.5476C36.462 52.5476 35.841 52.6639 35.2554 52.8115C35.1477 52.8386 35.045 52.8658 34.9494 52.8921C35.2529 53.8806 35.416 54.9302 35.416 56.0181C35.416 61.891 30.6566 66.6523 24.7857 66.6523C19.3572 66.6523 14.8791 62.5819 14.2348 57.3255C13.1395 61.6914 13.1138 66.4247 13.3027 71.8267C13.3086 71.9956 13.0913 72.0695 13.0069 71.923C8.27685 63.7096 3.919 46.6993 7.07017 34.1571C9.88997 22.9337 17.7893 17.5248 22.7497 15.6703C23.6528 6.86781 31.0875 0.00146484 40.1255 0.00146484C49.7726 0.00146484 57.5931 7.82483 57.5931 17.4754ZM20.2338 46.4053C21.6136 45.7502 23.1568 45.3836 24.7857 45.3836C28.5958 45.3836 31.9378 47.389 33.8145 50.4021C34.0161 50.3414 34.2899 50.2631 34.6017 50.1845C35.2249 50.0275 36.114 49.8395 36.8912 49.8395C37.6665 49.8395 38.5799 50.0291 39.2226 50.1869C39.521 50.2603 39.7868 50.3331 39.9912 50.3921C41.869 47.3841 45.2082 45.3828 49.0145 45.3828C49.4293 45.3828 49.8385 45.4066 50.2408 45.4528C46.5818 41.1196 45.155 35.0706 44.6389 31.2667C32.4171 36.5577 24.8612 41.4001 20.2338 46.4053ZM56.3646 56.017C56.3646 60.0794 53.0728 63.3707 49.0145 63.3707C44.9562 63.3707 41.6644 60.0794 41.6644 56.017C41.6644 51.9546 44.9562 48.663 49.0145 48.663C53.0728 48.663 56.3646 51.9546 56.3646 56.017ZM32.1357 56.0181C32.1357 60.0805 28.8439 63.3718 24.7857 63.3718C20.7275 63.3718 17.4356 60.0805 17.4356 56.0181C17.4356 51.9554 20.7275 48.6641 24.7857 48.6641C28.8439 48.6641 32.1357 51.9554 32.1357 56.0181Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17455">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17455)"><path fill="#fff" fill-rule="evenodd" d="M57.593 17.475c0 1.373-.18 2.624-.514 3.76 14.13 8.304 6.857 35.32 4.727 42.201-.058.19-.385.117-.379-.081.07-2.285-.286-5.49-1.853-8.575q.07.61.07 1.237c0 5.873-4.758 10.634-10.63 10.634-5.87 0-10.63-4.76-10.63-10.634 0-1.09.164-2.141.468-3.131l-.267-.068c-.616-.151-1.263-.27-1.694-.27-.429 0-1.05.116-1.636.264l-.306.08c.304.989.467 2.038.467 3.126 0 5.873-4.76 10.634-10.63 10.634-5.429 0-9.907-4.07-10.551-9.327-1.095 4.366-1.121 9.1-.932 14.502.006.169-.212.243-.296.096-4.73-8.213-9.088-25.224-5.937-37.766C9.89 22.934 17.79 17.525 22.75 15.67 23.653 6.868 31.087.001 40.126.001c9.647 0 17.467 7.824 17.467 17.474m-37.36 28.93a10.6 10.6 0 0 1 4.553-1.021c3.81 0 7.152 2.005 9.029 5.018.201-.06.475-.139.787-.218.623-.156 1.512-.344 2.29-.344.774 0 1.688.19 2.33.347.299.073.565.146.77.205a10.62 10.62 0 0 1 10.249-4.94c-3.66-4.332-5.086-10.381-5.602-14.185C32.417 36.557 24.86 41.4 20.234 46.405m36.132 9.612a7.35 7.35 0 0 1-7.35 7.354 7.35 7.35 0 0 1-7.35-7.354 7.35 7.35 0 0 1 7.35-7.354 7.35 7.35 0 0 1 7.35 7.354m-24.23.001a7.35 7.35 0 0 1-7.35 7.354 7.35 7.35 0 0 1-7.35-7.354 7.35 7.35 0 0 1 7.35-7.354 7.35 7.35 0 0 1 7.35 7.354" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16904_17455"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/lusha-light.svg b/web/packages/design/src/ResourceIcon/assets/lusha-light.svg
index 6298c579dba26..eed95c395008e 100644
--- a/web/packages/design/src/ResourceIcon/assets/lusha-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/lusha-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16904_17455)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.5931 17.4754C57.5931 18.8483 57.4129 20.0992 57.0793 21.235C71.2091 29.5387 63.9357 56.5547 61.8065 63.4363C61.7478 63.6263 61.4213 63.5532 61.4274 63.3546C61.4966 61.0698 61.1411 57.8652 59.5737 54.7804C59.6208 55.1861 59.6448 55.5986 59.6448 56.017C59.6448 61.8902 54.8855 66.6512 49.0145 66.6512C43.1435 66.6512 38.3842 61.8902 38.3842 56.017C38.3842 54.9272 38.5478 53.8759 38.8524 52.886C38.7674 52.8636 38.6779 52.8409 38.5849 52.8179C37.9691 52.6667 37.3223 52.5476 36.8912 52.5476C36.462 52.5476 35.841 52.6639 35.2554 52.8115C35.1477 52.8386 35.045 52.8658 34.9494 52.8921C35.2529 53.8806 35.416 54.9302 35.416 56.0181C35.416 61.891 30.6566 66.6523 24.7857 66.6523C19.3572 66.6523 14.8791 62.5819 14.2348 57.3255C13.1395 61.6914 13.1138 66.4247 13.3027 71.8267C13.3086 71.9956 13.0913 72.0695 13.0069 71.923C8.27685 63.7096 3.919 46.6993 7.07017 34.1571C9.88997 22.9337 17.7893 17.5248 22.7497 15.6703C23.6528 6.86781 31.0875 0.00146484 40.1255 0.00146484C49.7726 0.00146484 57.5931 7.82483 57.5931 17.4754ZM20.2338 46.4053C21.6136 45.7502 23.1568 45.3836 24.7857 45.3836C28.5958 45.3836 31.9378 47.389 33.8145 50.4021C34.0161 50.3414 34.2899 50.2631 34.6017 50.1845C35.2249 50.0275 36.114 49.8395 36.8912 49.8395C37.6665 49.8395 38.5799 50.0291 39.2226 50.1869C39.521 50.2603 39.7868 50.3331 39.9912 50.3921C41.869 47.3841 45.2082 45.3828 49.0145 45.3828C49.4293 45.3828 49.8385 45.4066 50.2408 45.4528C46.5818 41.1196 45.155 35.0706 44.6389 31.2667C32.4171 36.5577 24.8612 41.4001 20.2338 46.4053ZM56.3646 56.017C56.3646 60.0794 53.0728 63.3707 49.0145 63.3707C44.9562 63.3707 41.6644 60.0794 41.6644 56.017C41.6644 51.9546 44.9562 48.663 49.0145 48.663C53.0728 48.663 56.3646 51.9546 56.3646 56.017ZM32.1357 56.0181C32.1357 60.0805 28.8439 63.3718 24.7857 63.3718C20.7275 63.3718 17.4356 60.0805 17.4356 56.0181C17.4356 51.9554 20.7275 48.6641 24.7857 48.6641C28.8439 48.6641 32.1357 51.9554 32.1357 56.0181Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16904_17455">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00146484)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16904_17455)"><path fill="#000" fill-rule="evenodd" d="M57.593 17.475c0 1.373-.18 2.624-.514 3.76 14.13 8.304 6.857 35.32 4.727 42.201-.058.19-.385.117-.379-.081.07-2.285-.286-5.49-1.853-8.575q.07.61.07 1.237c0 5.873-4.758 10.634-10.63 10.634-5.87 0-10.63-4.76-10.63-10.634 0-1.09.164-2.141.468-3.131l-.267-.068c-.616-.151-1.263-.27-1.694-.27-.429 0-1.05.116-1.636.264l-.306.08c.304.989.467 2.038.467 3.126 0 5.873-4.76 10.634-10.63 10.634-5.429 0-9.907-4.07-10.551-9.327-1.095 4.366-1.121 9.1-.932 14.502.006.169-.212.243-.296.096-4.73-8.213-9.088-25.224-5.937-37.766C9.89 22.934 17.79 17.525 22.75 15.67 23.653 6.868 31.087.001 40.126.001c9.647 0 17.467 7.824 17.467 17.474m-37.36 28.93a10.6 10.6 0 0 1 4.553-1.021c3.81 0 7.152 2.005 9.029 5.018.201-.06.475-.139.787-.218.623-.156 1.512-.344 2.29-.344.774 0 1.688.19 2.33.347.299.073.565.146.77.205a10.62 10.62 0 0 1 10.249-4.94c-3.66-4.332-5.086-10.381-5.602-14.185C32.417 36.557 24.86 41.4 20.234 46.405m36.132 9.612a7.35 7.35 0 0 1-7.35 7.354 7.35 7.35 0 0 1-7.35-7.354 7.35 7.35 0 0 1 7.35-7.354 7.35 7.35 0 0 1 7.35 7.354m-24.23.001a7.35 7.35 0 0 1-7.35 7.354 7.35 7.35 0 0 1-7.35-7.354 7.35 7.35 0 0 1 7.35-7.354 7.35 7.35 0 0 1 7.35 7.354" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16904_17455"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mailgun.svg b/web/packages/design/src/ResourceIcon/assets/mailgun.svg
index 28af8a8ed86fb..a62d1d881587e 100644
--- a/web/packages/design/src/ResourceIcon/assets/mailgun.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mailgun.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_4751)">
-<path d="M35.9967 41.1457C38.8355 41.1457 41.1369 38.8443 41.1369 36.0054C41.1369 33.1666 38.8355 30.8652 35.9967 30.8652C33.1578 30.8652 30.8564 33.1666 30.8564 36.0054C30.8564 38.8443 33.1578 41.1457 35.9967 41.1457Z" fill="#EB5454"/>
-<path d="M60.4216 39.8627C58.2928 39.8627 56.5645 38.1344 56.5645 36.0057C56.5645 24.6423 47.3522 15.4374 35.9963 15.4374C24.6404 15.4374 15.428 24.6497 15.428 36.0057C15.428 47.3616 24.6404 56.5739 35.9963 56.5739C43.8438 56.5739 50.6678 52.1829 54.1317 45.7149C58.6117 48.6225 64.6717 48.1107 68.6029 44.1796C70.8651 41.9173 71.9926 38.9578 71.9926 35.9982C71.9926 16.1198 55.8747 0.00195312 35.9963 0.00195312C16.1179 0.00195312 0 16.1272 0 36.0057C0 55.8841 16.1179 72.002 35.9963 72.002C45.9355 72.002 54.9401 67.9743 61.4526 61.4545L56.0008 56.0028C50.8829 61.1207 43.8142 64.2879 36.0037 64.2879C20.3828 64.2879 7.72144 51.6266 7.72144 36.0057C7.72144 20.3848 20.3754 7.72339 35.9963 7.72339C51.6172 7.72339 64.2786 20.3848 64.2786 36.0057C64.2786 38.1344 62.5503 39.8627 60.4216 39.8627ZM35.9963 48.8599C28.8979 48.8599 23.1421 43.104 23.1421 36.0057C23.1421 28.9073 28.8979 23.1514 35.9963 23.1514C43.0947 23.1514 48.8505 28.9073 48.8505 36.0057C48.8505 43.104 43.0947 48.8599 35.9963 48.8599Z" fill="#EB5454"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_4751">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#eb5454" clip-path="url(#clip0_16907_4751)"><path d="M35.997 41.146a5.14 5.14 0 1 0 0-10.28 5.14 5.14 0 0 0 0 10.28"/><path d="M60.422 39.863a3.86 3.86 0 0 1-3.857-3.857c0-11.364-9.213-20.569-20.569-20.569S15.428 24.65 15.428 36.006s9.212 20.568 20.568 20.568c7.848 0 14.672-4.391 18.136-10.86 4.48 2.909 10.54 2.397 14.47-1.534a11.53 11.53 0 0 0 3.39-8.182C71.993 16.12 55.876.002 35.997.002S0 16.127 0 36.006s16.118 35.996 35.996 35.996c9.94 0 18.944-4.028 25.457-10.547L56 56.003c-5.118 5.118-12.187 8.285-19.997 8.285-15.621 0-28.283-12.661-28.283-28.282S20.375 7.723 35.996 7.723 64.28 20.385 64.28 36.006a3.86 3.86 0 0 1-3.857 3.857M35.996 48.86c-7.098 0-12.854-5.756-12.854-12.854 0-7.099 5.756-12.855 12.854-12.855 7.099 0 12.854 5.756 12.854 12.855 0 7.098-5.755 12.854-12.854 12.854"/></g><defs><clipPath id="clip0_16907_4751"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mariadb-dark.svg b/web/packages/design/src/ResourceIcon/assets/mariadb-dark.svg
index f4d837f981cc7..e5e3b84dd0502 100644
--- a/web/packages/design/src/ResourceIcon/assets/mariadb-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mariadb-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M1.1601 56.7439C5.43168 56.8724 6.59176 56.7605 9.96842 55.2938C12.8396 54.0467 16.6803 50.6866 20.0735 49.6011C25.0535 48.0019 30.3941 48.2422 35.6932 48.8678C37.4664 49.0791 39.248 49.3733 40.5199 49.2365C42.5045 48.0185 42.5998 44.7123 43.8303 44.4471C43.4947 50.8441 40.7519 54.9375 38.0092 58.6498C43.7888 57.6305 47.6503 54.0219 49.987 49.5556C50.6955 48.2008 51.8721 45.9842 52.4107 44.4595C52.8375 45.4705 51.8556 46.1126 52.3154 47.2147C56.036 44.1446 57.7927 40.6478 59.3008 35.5269C61.0492 29.6022 62.8432 24.5103 63.9701 22.7578C65.068 21.0466 66.7791 19.9901 68.3411 18.8963C70.1143 17.6493 71.7012 16.3525 71.9746 13.9784C72.1818 12.18 71.1031 11.4683 69.3934 12.4289C68.4571 12.9551 67.5954 13.0711 66.6217 13.1001C65.7765 13.125 64.8484 13.0877 63.7132 13.2037C54.3373 14.1649 53.9023 23.3295 47.0868 30.058C46.6476 30.4847 45.8977 31.1145 45.4005 31.4874C43.2958 33.0576 41.0419 33.9194 38.6679 34.8267C34.8231 36.2934 31.1771 36.7201 27.5726 37.9879C24.9252 38.916 22.4641 39.9808 20.2889 41.4682C19.7462 41.8411 19.0087 42.504 18.5364 42.8893C17.2603 43.9333 16.4234 45.0893 15.6114 46.2825C14.7745 47.5089 13.9707 48.7725 12.7402 49.9782C10.7473 51.9337 3.30624 50.5499 0.683628 52.3646C0.393608 52.5676 0.157439 52.8079 0 53.098C1.42938 53.7484 2.38644 53.3507 4.03127 53.5288C4.23428 55.0991 0.625634 56.0272 1.1601 56.7439Z" fill="#C0765A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M60.5898 17.0815C61.9156 18.2333 64.6998 17.3094 64.2026 15.0182C62.1394 14.8442 60.9462 15.5444 60.5898 17.0815Z" fill="#1F305F"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#c0765a" d="M1.16 56.744c4.272.128 5.432.017 8.808-1.45 2.872-1.247 6.712-4.607 10.106-5.693 4.98-1.6 10.32-1.359 15.62-.733 1.772.211 3.554.505 4.826.368 1.984-1.217 2.08-4.524 3.31-4.789-.335 6.397-3.078 10.49-5.82 14.203 5.779-1.02 9.64-4.628 11.977-9.094.709-1.355 1.885-3.572 2.424-5.096.426 1.01-.555 1.653-.096 2.755 3.721-3.07 5.478-6.567 6.986-11.688 1.748-5.925 3.542-11.017 4.67-12.77 1.097-1.71 2.808-2.767 4.37-3.86 1.773-1.248 3.36-2.544 3.634-4.919.207-1.798-.872-2.51-2.582-1.55-.936.527-1.798.643-2.771.672-.846.025-1.774-.012-2.909.104-9.376.96-9.81 10.125-16.626 16.854-.44.427-1.19 1.056-1.687 1.43-2.104 1.57-4.358 2.431-6.732 3.339-3.845 1.466-7.49 1.893-11.095 3.16-2.648.929-5.109 1.994-7.284 3.481-.543.373-1.28 1.036-1.753 1.421-1.276 1.044-2.113 2.2-2.925 3.393-.837 1.227-1.64 2.49-2.87 3.696-1.994 1.956-9.435.572-12.057 2.387-.29.203-.527.443-.684.733 1.43.65 2.386.253 4.031.43.203 1.571-3.405 2.5-2.87 3.216"/><path fill="#1f305f" fill-rule="evenodd" d="M60.59 17.082c1.326 1.151 4.11.227 3.613-2.064-2.064-.174-3.257.526-3.613 2.063" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mariadb-light.svg b/web/packages/design/src/ResourceIcon/assets/mariadb-light.svg
index 124e33c63ca3d..206096af7613c 100644
--- a/web/packages/design/src/ResourceIcon/assets/mariadb-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mariadb-light.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M70.424 11.865C69.3188 11.9015 69.6386 12.3994 67.2459 12.9905C64.829 13.5857 61.906 13.2213 59.3068 14.3144C52.5053 17.1646 51.4041 28.1846 43.303 32.4477C37.9913 35.4477 32.5744 36.1359 27.7324 37.6541C23.8458 39.2128 21.4288 40.2452 18.5787 42.7026C16.3682 44.6095 15.8297 46.4597 13.518 48.8523C11.1739 52.0385 2.28742 49.2086 0 53.2045C1.20646 53.9859 1.90278 54.2004 4.02016 53.9211C3.58291 54.751 0.797547 55.8441 1.30361 57.0668C1.30361 57.0668 8.03631 58.2935 13.7123 54.8684C16.3601 53.7915 18.8418 51.5122 22.9551 50.9657C28.283 50.2572 34.2869 52.0831 40.7281 52.5972C39.3962 55.2288 38.0237 56.7834 36.5541 58.9534C36.1007 59.4433 36.9428 59.8765 38.5055 59.5809C41.3152 58.8846 43.3516 58.1316 45.3718 56.7348C48.0074 54.917 49.141 53.2531 51.3636 50.6175C53.2948 53.7146 60.1044 54.3948 61.5011 51.7187C58.902 50.6175 58.3473 44.8888 59.238 42.4152C60.2906 40.0589 61.0477 36.727 61.8979 33.6299C62.663 30.8405 63.1367 26.5855 64.0517 24.4074C65.1448 21.6989 67.2702 20.8528 68.8654 19.4155C70.4605 17.9783 72.0475 16.7799 71.9989 13.4925C71.9827 12.4237 71.4321 11.8326 70.424 11.865Z" fill="#1F305F"/>
-<path d="M2.03204 56.4998C6.20607 56.6253 7.33966 56.516 10.6392 55.0828C13.4448 53.8642 17.1978 50.5808 20.5135 49.5201C25.3798 47.9574 30.5984 48.1922 35.7765 48.8035C37.5092 49.01 39.2501 49.2975 40.493 49.1638C42.4323 47.9736 42.5254 44.7429 43.7278 44.4838C43.3998 50.7347 40.7197 54.7346 38.0396 58.3621C43.6873 57.3662 47.4605 53.8399 49.7439 49.4756C50.4362 48.1517 51.5859 45.9858 52.1123 44.4959C52.5292 45.4837 51.5698 46.1113 52.0191 47.1882C55.6547 44.1882 57.3713 40.7713 58.8449 35.7673C60.5534 29.9779 62.3064 25.0023 63.4076 23.2897C64.4805 21.6177 66.1525 20.5853 67.6788 19.5165C69.4116 18.2979 70.9622 17.0307 71.2294 14.7109C69.3994 14.5409 68.9784 14.1198 68.7071 13.1968C67.7922 13.7109 66.9501 13.8243 65.9987 13.8526C65.1728 13.8769 64.2659 13.8405 63.1566 13.9539C53.9948 14.8931 53.5697 23.8484 46.9099 30.4232C46.4808 30.8402 45.748 31.4556 45.2621 31.82C43.2055 33.3544 41.0031 34.1965 38.6833 35.0831C34.9263 36.5163 31.3636 36.9333 27.8414 38.1721C25.2544 39.079 22.8495 40.1195 20.724 41.5729C20.1937 41.9372 19.4731 42.585 19.0115 42.9615C17.7646 43.9817 16.9468 45.1113 16.1533 46.2773C15.3355 47.4756 14.5501 48.7104 13.3476 49.8885C11.4003 51.7994 4.12917 50.4472 1.56645 52.2205C1.28306 52.4189 1.05228 52.6537 0.898438 52.9371C2.29518 53.5727 3.23038 53.184 4.83764 53.3581C5.03602 54.8925 1.50978 55.7994 2.03204 56.4998Z" fill="#C0765A"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M60.1045 17.7432C61.4 18.8687 64.1206 17.9659 63.6348 15.7271C61.6186 15.557 60.4527 16.2412 60.1045 17.7432Z" fill="#1F305F"/>
-<path d="M69.1444 15.1239C68.8003 15.8486 68.1404 16.7798 68.1404 18.6218C68.1363 18.9376 67.9015 19.1562 67.8975 18.6664C67.9137 16.8648 68.3914 16.0875 68.8974 15.0672C69.1282 14.6502 69.2699 14.8203 69.1444 15.1239Z" fill="#1F305F"/>
-<path d="M68.7968 14.8527C68.3879 15.541 67.4082 16.8 67.2503 18.6381C67.2219 18.9539 66.9628 19.1482 67.0033 18.6624C67.1814 16.8729 67.9628 15.7515 68.5579 14.7758C68.8251 14.379 68.9506 14.5612 68.7968 14.8527Z" fill="#1F305F"/>
-<path d="M68.481 14.4921C68.0154 15.1439 66.5093 16.6581 66.1936 18.4718C66.1369 18.7835 65.8656 18.9536 65.9466 18.4759C66.2745 16.7067 67.5741 15.314 68.2461 14.395C68.5457 14.0184 68.6591 14.2128 68.481 14.4921Z" fill="#1F305F"/>
-<path d="M68.197 14.0879C67.6464 14.6709 65.8489 16.598 65.2821 18.351C65.1809 18.6506 64.8894 18.7842 65.0352 18.3186C65.606 16.6101 67.1809 14.7721 67.9784 13.9583C68.3307 13.6304 68.4116 13.8409 68.197 14.0879Z" fill="#1F305F"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1f305f" fill-rule="evenodd" d="M70.424 11.865c-1.105.037-.785.534-3.178 1.126-2.417.595-5.34.23-7.94 1.323-6.8 2.85-7.902 13.87-16.003 18.134-5.312 3-10.729 3.688-15.57 5.206-3.887 1.559-6.304 2.591-9.154 5.049-2.21 1.906-2.75 3.757-5.061 6.15-2.344 3.185-11.23.356-13.518 4.352 1.206.78 1.903.995 4.02.716-.437.83-3.222 1.923-2.716 3.146 0 0 6.732 1.227 12.408-2.199 2.648-1.077 5.13-3.356 9.243-3.902 5.328-.709 11.332 1.117 17.773 1.631-1.332 2.632-2.704 4.186-4.174 6.356-.453.49.389.923 1.951.628 2.81-.696 4.847-1.45 6.867-2.846 2.635-1.818 3.769-3.482 5.992-6.117 1.93 3.097 8.74 3.777 10.137 1.1-2.599-1.1-3.154-6.83-2.263-9.303 1.053-2.356 1.81-5.688 2.66-8.785.765-2.79 1.239-7.045 2.154-9.223 1.093-2.708 3.218-3.554 4.813-4.991 1.596-1.438 3.183-2.636 3.134-5.924-.016-1.068-.567-1.66-1.575-1.627" clip-rule="evenodd"/><path fill="#c0765a" d="M2.032 56.5c4.174.125 5.308.016 8.607-1.417 2.806-1.219 6.559-4.502 9.875-5.563 4.866-1.563 10.084-1.328 15.263-.717 1.732.207 3.473.495 4.716.36 1.94-1.19 2.032-4.42 3.235-4.68-.328 6.252-3.008 10.252-5.688 13.88 5.647-.997 9.42-4.523 11.704-8.887.692-1.324 1.842-3.49 2.368-4.98.417.988-.542 1.615-.093 2.692 3.636-3 5.352-6.417 6.826-11.42 1.708-5.79 3.461-10.766 4.563-12.478 1.073-1.672 2.745-2.705 4.27-3.773 1.734-1.22 3.284-2.486 3.551-4.806-1.83-.17-2.25-.591-2.522-1.514-.915.514-1.757.627-2.708.656-.826.024-1.733-.012-2.842.1-9.162.94-9.587 9.895-16.247 16.47a20 20 0 0 1-1.648 1.397c-2.056 1.534-4.259 2.377-6.579 3.263-3.757 1.433-7.32 1.85-10.842 3.09-2.587.906-4.992 1.947-7.117 3.4-.53.364-1.25 1.012-1.712 1.389-1.247 1.02-2.065 2.15-2.859 3.315-.817 1.199-1.603 2.433-2.805 3.611-1.948 1.911-9.219.56-11.782 2.333a2.1 2.1 0 0 0-.668.716c1.397.636 2.332.247 3.94.421.198 1.535-3.328 2.441-2.806 3.142"/><path fill="#1f305f" fill-rule="evenodd" d="M60.105 17.743c1.295 1.126 4.016.223 3.53-2.016-2.016-.17-3.182.514-3.53 2.016" clip-rule="evenodd"/><path fill="#1f305f" d="M69.144 15.124c-.344.725-1.004 1.656-1.004 3.498-.004.316-.239.534-.243.044.017-1.801.494-2.579 1-3.599.231-.417.373-.247.247.057"/><path fill="#1f305f" d="M68.797 14.853c-.41.688-1.389 1.947-1.547 3.785-.028.316-.287.51-.247.024.178-1.79.96-2.91 1.555-3.886.267-.397.393-.215.239.077m-.316-.361c-.466.652-1.972 2.166-2.287 3.98-.057.311-.328.482-.247.004.328-1.77 1.627-3.162 2.3-4.081.299-.377.412-.182.234.097m-.284-.404c-.55.583-2.348 2.51-2.915 4.263-.101.3-.393.433-.247-.032.571-1.709 2.146-3.547 2.943-4.36.353-.329.434-.118.219.129"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mattermost-dark.svg b/web/packages/design/src/ResourceIcon/assets/mattermost-dark.svg
index 9ceaf90816e9a..b5f9256d3925f 100644
--- a/web/packages/design/src/ResourceIcon/assets/mattermost-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mattermost-dark.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6218_26587)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M56.9928 7.24321L57.3831 14.7902C63.4988 21.5565 65.9277 31.142 62.8916 40.1637C58.3374 53.6095 43.3301 60.6793 29.3205 55.9516C15.3109 51.2239 7.72049 36.4769 12.2747 23.0312C15.3542 13.9661 23.1181 7.80706 32.1398 6.20224L36.9976 0.433566C21.7735 0.0432046 7.46025 9.45525 2.29881 24.636C-3.99035 43.2866 5.98555 63.4986 24.6362 69.7878C43.2868 76.0769 63.4988 66.101 69.788 47.4504C74.906 32.3565 69.2675 16.1348 56.9928 7.24321Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.2751 29.5375L48.0149 18.9544L47.798 12.8821L47.6679 7.59055C47.6679 7.59055 47.7113 5.03151 47.6245 4.46766C47.6245 4.33754 47.5812 4.25079 47.5378 4.16404V4.0773C47.451 3.9038 47.2775 3.77368 47.104 3.68693C46.8872 3.60019 46.6703 3.64356 46.4968 3.73031C46.4968 3.73031 46.4534 3.73031 46.4534 3.77368C46.3667 3.81705 46.2799 3.86043 46.1932 3.94717C45.7595 4.38091 44.2414 6.41946 44.2414 6.41946L40.945 10.5399L37.0848 15.2677L30.4486 23.5086C30.4486 23.5086 27.4125 27.2821 28.0631 31.9664C28.7137 36.6508 32.2269 38.9062 34.9161 39.8171C37.6052 40.7279 41.7691 41.0315 45.1089 37.7351C48.3619 34.3954 48.2751 29.5375 48.2751 29.5375Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_6218_26587">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" fill-rule="evenodd" clip-path="url(#clip0_6218_26587)" clip-rule="evenodd"><path d="m56.993 7.243.39 7.547c6.116 6.767 8.545 16.352 5.509 25.374C58.337 53.609 43.33 60.679 29.32 55.952s-21.6-19.475-17.045-32.92c3.08-9.066 10.843-15.225 19.865-16.83L36.998.434C21.774.044 7.46 9.455 2.298 24.636c-6.288 18.65 3.688 38.863 22.338 45.152S63.5 66.1 69.788 47.45c5.118-15.094-.52-31.315-12.795-40.207"/><path d="m48.275 29.538-.26-10.584-.217-6.072-.13-5.291s.043-2.56-.044-3.123a.6.6 0 0 0-.086-.304v-.087c-.087-.173-.26-.303-.434-.39a.73.73 0 0 0-.607.043s-.044 0-.044.044c-.086.043-.173.086-.26.173-.433.434-1.952 2.472-1.952 2.472l-3.296 4.12-3.86 4.729-6.636 8.24s-3.036 3.774-2.386 8.458 4.164 6.94 6.853 7.851 6.853 1.215 10.193-2.082c3.253-3.34 3.166-8.197 3.166-8.197"/></g><defs><clipPath id="clip0_6218_26587"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mattermost-light.svg b/web/packages/design/src/ResourceIcon/assets/mattermost-light.svg
index 54abd3768d86a..73a9158b6cb85 100644
--- a/web/packages/design/src/ResourceIcon/assets/mattermost-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mattermost-light.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8350_41949)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M56.9928 7.24321L57.3831 14.7902C63.4988 21.5565 65.9277 31.142 62.8916 40.1637C58.3374 53.6095 43.3301 60.6793 29.3205 55.9516C15.3109 51.2239 7.72049 36.4769 12.2747 23.0312C15.3542 13.9661 23.1181 7.80706 32.1398 6.20224L36.9976 0.433566C21.7735 0.0432046 7.46025 9.45525 2.29881 24.636C-3.99035 43.2866 5.98555 63.4986 24.6362 69.7878C43.2868 76.0769 63.4988 66.101 69.788 47.4504C74.906 32.3565 69.2675 16.1348 56.9928 7.24321V7.24321Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M48.2751 29.5375L48.0149 18.9544L47.798 12.8821L47.6679 7.59055C47.6679 7.59055 47.7113 5.03151 47.6245 4.46766C47.6245 4.33754 47.5812 4.25079 47.5378 4.16404V4.0773C47.451 3.9038 47.2775 3.77368 47.104 3.68693C46.8872 3.60019 46.6703 3.64356 46.4968 3.73031C46.4968 3.73031 46.4534 3.73031 46.4534 3.77368C46.3667 3.81705 46.2799 3.86043 46.1932 3.94717C45.7595 4.38091 44.2414 6.41946 44.2414 6.41946L40.945 10.5399L37.0848 15.2677L30.4486 23.5086C30.4486 23.5086 27.4125 27.2821 28.0631 31.9665C28.7137 36.6508 32.2269 38.9062 34.9161 39.8171C37.6052 40.7279 41.7691 41.0315 45.1089 37.7351C48.3619 34.3954 48.2751 29.5375 48.2751 29.5375V29.5375Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_8350_41949">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#000" fill-rule="evenodd" clip-path="url(#clip0_8350_41949)" clip-rule="evenodd"><path d="m56.993 7.243.39 7.547c6.116 6.767 8.545 16.352 5.509 25.374C58.337 53.609 43.33 60.679 29.32 55.952s-21.6-19.475-17.045-32.92c3.08-9.066 10.843-15.225 19.865-16.83L36.998.434C21.774.044 7.46 9.455 2.298 24.636c-6.288 18.65 3.688 38.863 22.338 45.152S63.5 66.1 69.788 47.45c5.118-15.094-.52-31.315-12.795-40.207"/><path d="m48.275 29.538-.26-10.584-.217-6.072-.13-5.291s.043-2.56-.044-3.123a.6.6 0 0 0-.086-.304v-.087c-.087-.173-.26-.303-.434-.39a.73.73 0 0 0-.607.043s-.044 0-.044.044c-.086.043-.173.086-.26.173-.433.434-1.952 2.472-1.952 2.472l-3.296 4.12-3.86 4.729-6.636 8.24s-3.036 3.774-2.386 8.459 4.164 6.94 6.853 7.85 6.853 1.215 10.193-2.082c3.253-3.34 3.166-8.197 3.166-8.197"/></g><defs><clipPath id="clip0_8350_41949"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/maxio-dark.svg b/web/packages/design/src/ResourceIcon/assets/maxio-dark.svg
index db41fc2770270..3ea7fe3aff22e 100644
--- a/web/packages/design/src/ResourceIcon/assets/maxio-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/maxio-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11690)">
-<path d="M21.215 0.00360693L17.8264 3.39225L28.6687 14.1403V23.2412L27.5557 24.2566L12.2084 9.00857L8.91734 12.2996L24.1671 27.6453L23.2476 28.6624H14.2426L3.40025 17.8167L0.0595703 21.1574L12.306 33.4055H33.4168V12.1078L21.215 0.00195312V0.00360693ZM50.7817 0.00360693L54.172 3.39225L43.3297 14.1403V23.2412L44.4427 24.2566L59.7883 9.00857L63.0794 12.2996L47.8313 27.6453L48.7509 28.6624H57.7542L68.5965 17.8167L71.9372 21.1574L59.6908 33.4055H38.5833V12.1078L50.7817 0.00195312V0.00360693ZM21.215 72.0003L17.8264 68.6116L28.6687 57.8636V48.7627L27.5557 47.7473L12.2084 62.9953L8.91734 59.7043L24.1671 44.3586L23.2476 43.3415H14.2426L3.40025 54.1872L0.0595703 50.8465L12.306 38.5984H33.4168V59.8961L21.2167 72.002L21.215 72.0003ZM50.7817 72.0003L54.172 68.6116L43.3297 57.8636V48.7627L44.4427 47.7473L59.7883 62.9953L63.0794 59.7043L47.8313 44.3586L48.7509 43.3415H57.7542L68.5965 54.1872L71.9372 50.8465L59.6908 38.5984H38.5833V59.8961L50.7834 72.002L50.7817 72.0003Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11690">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16907_11690)"><path fill="#fff" d="m21.215.004-3.389 3.388L28.67 14.14v9.101l-1.113 1.016L12.208 9.009l-3.29 3.29 15.25 15.346-.92 1.017h-9.005L3.4 17.817l-3.34 3.34 12.246 12.249h21.11V12.108L21.216.002zm29.567 0 3.39 3.388L43.33 14.14v9.101l1.113 1.016L59.788 9.009l3.291 3.29-15.248 15.346.92 1.017h9.003l10.843-10.845 3.34 3.34-12.246 12.249H38.583V12.108L50.782.002zM21.215 72l-3.389-3.388L28.67 57.864v-9.101l-1.113-1.016-15.348 15.248-3.29-3.29 15.25-15.346-.92-1.017h-9.005L3.4 54.187l-3.34-3.34 12.246-12.249h21.11v21.298l-12.2 12.106zm29.567 0 3.39-3.388L43.33 57.864v-9.101l1.113-1.016 15.345 15.248 3.291-3.29-15.248-15.346.92-1.017h9.003l10.843 10.845 3.34-3.34-12.246-12.249H38.583v21.298l12.2 12.106z"/></g><defs><clipPath id="clip0_16907_11690"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/maxio-light.svg b/web/packages/design/src/ResourceIcon/assets/maxio-light.svg
index ac9e0ce9f4b82..b651e396d8665 100644
--- a/web/packages/design/src/ResourceIcon/assets/maxio-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/maxio-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11690)">
-<path d="M21.215 0.00360693L17.8264 3.39225L28.6687 14.1403V23.2412L27.5557 24.2566L12.2084 9.00857L8.91734 12.2996L24.1671 27.6453L23.2476 28.6624H14.2426L3.40025 17.8167L0.0595703 21.1574L12.306 33.4055H33.4168V12.1078L21.215 0.00195312V0.00360693ZM50.7817 0.00360693L54.172 3.39225L43.3297 14.1403V23.2412L44.4427 24.2566L59.7883 9.00857L63.0794 12.2996L47.8313 27.6453L48.7509 28.6624H57.7542L68.5965 17.8167L71.9372 21.1574L59.6908 33.4055H38.5833V12.1078L50.7817 0.00195312V0.00360693ZM21.215 72.0003L17.8264 68.6116L28.6687 57.8636V48.7627L27.5557 47.7473L12.2084 62.9953L8.91734 59.7043L24.1671 44.3586L23.2476 43.3415H14.2426L3.40025 54.1872L0.0595703 50.8465L12.306 38.5984H33.4168V59.8961L21.2167 72.002L21.215 72.0003ZM50.7817 72.0003L54.172 68.6116L43.3297 57.8636V48.7627L44.4427 47.7473L59.7883 62.9953L63.0794 59.7043L47.8313 44.3586L48.7509 43.3415H57.7542L68.5965 54.1872L71.9372 50.8465L59.6908 38.5984H38.5833V59.8961L50.7834 72.002L50.7817 72.0003Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11690">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16907_11690)"><path fill="#000" d="m21.215.004-3.389 3.388L28.67 14.14v9.101l-1.113 1.016L12.208 9.009l-3.29 3.29 15.25 15.346-.92 1.017h-9.005L3.4 17.817l-3.34 3.34 12.246 12.249h21.11V12.108L21.216.002zm29.567 0 3.39 3.388L43.33 14.14v9.101l1.113 1.016L59.788 9.009l3.291 3.29-15.248 15.346.92 1.017h9.003l10.843-10.845 3.34 3.34-12.246 12.249H38.583V12.108L50.782.002zM21.215 72l-3.389-3.388L28.67 57.864v-9.101l-1.113-1.016-15.348 15.248-3.29-3.29 15.25-15.346-.92-1.017h-9.005L3.4 54.187l-3.34-3.34 12.246-12.249h21.11v21.298l-12.2 12.106zm29.567 0 3.39-3.388L43.33 57.864v-9.101l1.113-1.016 15.345 15.248 3.291-3.29-15.248-15.346.92-1.017h9.003l10.843 10.845 3.34-3.34-12.246-12.249H38.583v21.298l12.2 12.106z"/></g><defs><clipPath id="clip0_16907_11690"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcp-dark.svg b/web/packages/design/src/ResourceIcon/assets/mcp-dark.svg
new file mode 100644
index 0000000000000..2a9ecdee5c019
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcp-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" fill-rule="evenodd" style="flex:none;line-height:1;fill:#fff" viewBox="0 0 24 24"><title>ModelContextProtocol</title><path d="M15.688 2.343a2.59 2.59 0 0 0-3.61 0l-9.626 9.44a.863.863 0 0 1-1.203 0 .823.823 0 0 1 0-1.18l9.626-9.44a4.313 4.313 0 0 1 6.016 0 4.12 4.12 0 0 1 1.204 3.54 4.3 4.3 0 0 1 3.609 1.18l.05.05a4.115 4.115 0 0 1 0 5.9l-8.706 8.537a.274.274 0 0 0 0 .393l1.788 1.754a.823.823 0 0 1 0 1.18.863.863 0 0 1-1.203 0l-1.788-1.753a1.92 1.92 0 0 1 0-2.754l8.706-8.538a2.47 2.47 0 0 0 0-3.54l-.05-.049a2.59 2.59 0 0 0-3.607-.003l-7.172 7.034-.002.002-.098.097a.863.863 0 0 1-1.204 0 .823.823 0 0 1 0-1.18l7.273-7.133a2.47 2.47 0 0 0-.003-3.537"/><path d="M14.485 4.703a.823.823 0 0 0 0-1.18.863.863 0 0 0-1.204 0l-7.119 6.982a4.115 4.115 0 0 0 0 5.9 4.314 4.314 0 0 0 6.016 0l7.12-6.982a.823.823 0 0 0 0-1.18.863.863 0 0 0-1.204 0l-7.119 6.982a2.59 2.59 0 0 1-3.61 0 2.47 2.47 0 0 1 0-3.54z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcp-light.svg b/web/packages/design/src/ResourceIcon/assets/mcp-light.svg
new file mode 100644
index 0000000000000..ac7466ba13aee
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcp-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" fill-rule="evenodd" style="flex:none;line-height:1;fill:#000" viewBox="0 0 24 24"><title>ModelContextProtocol</title><path d="M15.688 2.343a2.59 2.59 0 0 0-3.61 0l-9.626 9.44a.863.863 0 0 1-1.203 0 .823.823 0 0 1 0-1.18l9.626-9.44a4.313 4.313 0 0 1 6.016 0 4.12 4.12 0 0 1 1.204 3.54 4.3 4.3 0 0 1 3.609 1.18l.05.05a4.115 4.115 0 0 1 0 5.9l-8.706 8.537a.274.274 0 0 0 0 .393l1.788 1.754a.823.823 0 0 1 0 1.18.863.863 0 0 1-1.203 0l-1.788-1.753a1.92 1.92 0 0 1 0-2.754l8.706-8.538a2.47 2.47 0 0 0 0-3.54l-.05-.049a2.59 2.59 0 0 0-3.607-.003l-7.172 7.034-.002.002-.098.097a.863.863 0 0 1-1.204 0 .823.823 0 0 1 0-1.18l7.273-7.133a2.47 2.47 0 0 0-.003-3.537"/><path d="M14.485 4.703a.823.823 0 0 0 0-1.18.863.863 0 0 0-1.204 0l-7.119 6.982a4.115 4.115 0 0 0 0 5.9 4.314 4.314 0 0 0 6.016 0l7.12-6.982a.823.823 0 0 0 0-1.18.863.863 0 0 0-1.204 0l-7.119 6.982a2.59 2.59 0 0 1-3.61 0 2.47 2.47 0 0 1 0-3.54z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcpcursor-dark.svg b/web/packages/design/src/ResourceIcon/assets/mcpcursor-dark.svg
new file mode 100644
index 0000000000000..8aff822401a73
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcpcursor-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="126" height="28" fill="none" viewBox="0 0 126 28"><rect width="126" height="28" fill="#000" fill-opacity=".9" rx="4"/><mask id="mask0_262_7" width="13" height="16" x="8" y="6" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M8 10.247v7.506l6.5 3.753 6.5-3.753v-7.506l-6.5-3.753z"/></mask><g mask="url(#mask0_262_7)"><path fill="url(#pattern0_262_7)" d="M6.016 5.637H22.76v16.744H6.016z"/></g><path fill="#fff" fill-opacity=".9" d="m27.479 19 3.561-9.864h1.237v1.73h-.465L29.093 19zm1.715-2.666.431-1.23h4.491l.43 1.23zM34.643 19l-2.714-8.135v-1.73h.772L36.256 19zm5.175.123q-.93 0-1.627-.465-.69-.471-1.074-1.333-.375-.86-.375-2.03v-.014q0-1.176.376-2.037.375-.861 1.066-1.326.69-.471 1.634-.472.512 0 .957.164.444.158.786.452.342.286.54.69h.11V8.664h1.49V19h-1.49v-1.169h-.11q-.218.403-.554.697-.334.288-.772.445-.438.15-.957.15m.424-1.271q.615 0 1.066-.308.45-.308.69-.882.24-.58.24-1.367v-.014q0-.792-.246-1.367a1.93 1.93 0 0 0-.69-.882q-.445-.314-1.06-.314t-1.067.314q-.444.308-.683.882-.233.567-.233 1.367v.014q0 .793.233 1.367.239.574.683.882.45.308 1.067.308m8.087 1.271q-.93 0-1.627-.465-.69-.471-1.073-1.333-.377-.86-.377-2.03v-.014q0-1.176.377-2.037.376-.861 1.066-1.326.69-.471 1.634-.472.511 0 .957.164.444.158.786.452.342.286.54.69h.11V8.664h1.49V19h-1.49v-1.169h-.11q-.218.403-.554.697-.334.288-.772.445-.438.15-.957.15m.423-1.271q.615 0 1.067-.308.45-.308.69-.882.24-.58.24-1.367v-.014q0-.792-.247-1.367-.24-.574-.69-.882-.444-.314-1.06-.314-.615 0-1.066.314-.444.308-.684.882-.232.567-.232 1.367v.014q0 .793.232 1.367.24.574.684.882.45.308 1.066.308m11.718 1.196q-1.217 0-1.764-.465-.54-.471-.54-1.538v-4.3h-1.162v-1.169h1.162V9.703h1.518v1.873h1.593v1.17h-1.593v3.937q0 .6.239.868.24.26.793.26.165 0 .28-.007l.28-.02v1.189a7 7 0 0 1-.382.047 3 3 0 0 1-.424.028m5.325.096q-1.085 0-1.88-.465a3.1 3.1 0 0 1-1.21-1.326q-.423-.87-.423-2.058v-.014q-.001-1.196.424-2.057a3.1 3.1 0 0 1 1.216-1.326q.793-.465 1.873-.465 1.088 0 1.873.465.786.457 1.21 1.326.43.861.431 2.057v.014q0 1.19-.43 2.057a3.1 3.1 0 0 1-1.21 1.327q-.78.465-1.874.465m0-1.245q.636 0 1.08-.307.445-.314.677-.896.233-.58.233-1.401v-.014q0-.826-.233-1.408-.232-.58-.677-.889-.444-.315-1.08-.314-.636 0-1.08.314-.444.309-.683.889-.233.581-.233 1.408v.014q0 .82.233 1.401.24.582.683.896.444.307 1.08.307m12.75 1.34q-1.367 0-2.372-.629-.998-.629-1.538-1.784t-.54-2.748v-.013q0-1.6.54-2.755t1.538-1.785 2.372-.629q1.087 0 1.962.431a3.84 3.84 0 0 1 1.442 1.176q.568.752.69 1.73v.04h-1.524l-.007-.027a2.5 2.5 0 0 0-.499-1.053 2.5 2.5 0 0 0-.888-.69 2.74 2.74 0 0 0-1.176-.246q-.882 0-1.531.465-.643.465-.998 1.319-.35.848-.349 2.024v.013q0 1.162.349 2.017.356.855.998 1.32.649.464 1.538.464.65 0 1.175-.219.533-.219.89-.622.354-.41.484-.964l.014-.027h1.531l-.006.034a3.5 3.5 0 0 1-.698 1.661q-.554.71-1.421 1.108-.87.39-1.976.39m8.135-.095q-.834 0-1.408-.322a2.07 2.07 0 0 1-.855-.943q-.28-.623-.28-1.497v-4.806h1.483v4.457q0 .916.363 1.374.362.458 1.182.458.438 0 .78-.13a1.55 1.55 0 0 0 .574-.39q.233-.252.342-.608a2.6 2.6 0 0 0 .116-.806v-4.355h1.49V19h-1.49v-1.121h-.11a2.1 2.1 0 0 1-.485.683 2.1 2.1 0 0 1-.738.431q-.424.15-.964.15M92.32 19v-7.424h1.483v1.121h.117q.198-.594.697-.923.506-.327 1.244-.328a3 3 0 0 1 .65.069v1.367a4 4 0 0 0-.8-.082q-.569 0-.999.219-.423.217-.67.615-.239.39-.239.93V19zm7.889.144q-.896 0-1.559-.26-.663-.267-1.053-.732a2.03 2.03 0 0 1-.457-1.093v-.014h1.49v.014q.143.417.547.676.403.26 1.066.26.458 0 .8-.13.348-.13.547-.362a.8.8 0 0 0 .198-.533v-.014a.75.75 0 0 0-.28-.588q-.28-.24-.923-.39l-1.19-.273q-.697-.157-1.155-.43a1.8 1.8 0 0 1-.677-.67 1.95 1.95 0 0 1-.219-.944v-.007q0-.65.37-1.148.369-.506 1.018-.786.657-.287 1.497-.287.848 0 1.477.266.636.26 1.005.725.37.457.437 1.066v.007h-1.422v-.014q-.102-.39-.492-.649-.382-.26-1.012-.26-.403 0-.717.13-.315.123-.5.349a.8.8 0 0 0-.177.52v.013q0 .233.116.41.123.171.383.308.26.13.67.232l1.182.267q1.067.252 1.586.731.527.48.527 1.285v.014q0 .684-.404 1.21-.402.519-1.1.813-.69.288-1.579.288m7.711 0q-1.087 0-1.88-.465a3.1 3.1 0 0 1-1.21-1.326q-.424-.87-.424-2.058v-.014q0-1.196.424-2.057a3.1 3.1 0 0 1 1.217-1.326q.793-.465 1.873-.465 1.087 0 1.873.465.786.457 1.21 1.326.43.861.431 2.057v.014q0 1.19-.431 2.057a3.1 3.1 0 0 1-1.21 1.327q-.779.465-1.873.465m0-1.245q.636 0 1.08-.307.444-.314.677-.896.232-.58.232-1.401v-.014q0-.826-.232-1.408-.233-.58-.677-.889-.444-.315-1.08-.314-.636 0-1.08.314-.444.309-.684.889-.232.581-.232 1.408v.014q0 .82.232 1.401.24.582.684.896.444.307 1.08.307M112.917 19v-7.424h1.484v1.121h.116q.198-.594.697-.923.506-.327 1.244-.328a3 3 0 0 1 .65.069v1.367a4 4 0 0 0-.8-.082q-.567 0-.998.219-.424.217-.67.615-.24.39-.239.93V19z"/><defs><pattern id="pattern0_262_7" width="1" height="1" patternContentUnits="objectBoundingBox"><use xlink:href="#image0_262_7" transform="scale(.00685)"/></pattern><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJIAAACSCAIAAAAhGQTZAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAiX0lEQVR4nO2deZgV1ZnGJ4/GRFwGk5gEFdQYjUtEiAoBIQG3UROXgMSwydbQ7C02iguIyBaiJiKCKLLJEkVEcdwGdXDcYwZQiEEUFBpkM2okJsElmfk99T73y8epure7ga5iue8f97l9t751fvV+y6m6df7t34oqqqiiiiqqqKKKKqqoonZ3DRw48Mwzz8z6WxRVZY0ZM+auu+669tprTz755LPOOuvHP/5x1t+oqMo0bty4O++8E2w9e/b89re/3aRJk7PPPvvcc88twttFddttt0Fr0qRJYBsxYkTbtm2/9rWvffe73wXYf0Q655xzsv6ORTndeuutEydOhNnkyZPHjh1LkBw0aFCrVq1q166N4Ro0aPCjH/0Iwwle0XbZa+jQoXfccQfApk6dOmHChN/85jc333zzsGHD+vbte+GFF4INwx177LGNGjWCHHnu/PPPhxwImzVrlvV331s1fvx4TAYwsN1+++0ESZiNHDmSYqR79+4/+clP/j3SEUccQW3ywx/+EHLUljC74IILBC/rLdjLBCRQ3X333URF3Maf+OyWW24ZPXo0/hswYECnTp3OO+88mB188MHf+ta3MNwPfvCDpk2bEiEhR5HCs8DjFgtmvTV7gbAUDgMYJqP0oG4kmYkZKW348OFYrXfv3u3bt8dMMDvooIO+8Y1v1KtX76STTjrttNMgh+datmwJLSoUkUM8kvWW7aFq06YNxoLZ9OnTsRr3A2aExxtuuKG8vJwIedlll0EFbAceeCDprU6dOpSUp5xyCknujDPOwHMip96AcKqYSSDNeiv3LIEHVFOmTKG+J6XFmY0aNYpKBKv179+/S5cuMAaJsB1yyCHf/OY3jzzySAxHqGzcuDH1iDyngAlgDCd4xZi5c0RxTzAkKsKMWlHAVID8+te/htmvfvUrmBEehwwZMnDgwF69enXs2JHqHyRgO+CAA6gniZOHHXYYGa5+/fqESlxl5M6KJHjnRwJhscPbflFcwAlg06ZNIzbeEQlgMpkxowyhub7xxhuxWllZWUlJSbt27S655BKQkNhq1apFYfL1r3+dBg7DnXDCCbRxp59+epMmTUSuRYsWABY5hOGwHeS4U5zSrLZgg8lIY2CzqCiTwQwLGjNSGuFx8ODBWK1Pnz5ESBLbRRddBA9hw3OkN+IknQCGoxkgVJLkKE8gR54LyPmYScI78cQTsx6M3UGwwVv3RFJUNJMpMAbMbrrpJsLjNddcc8UVV5SWlhIhSWz02sK2//77g430RpykMDnqqKMwHKHy1FNPJcl5ckp1FjAVM4sdXuWiWVYaU3GPyeQwAbPAyMs8M2Lp9ddfj9X69u1LhKT0b926NV4BhrBxS3ojTtLAYThKyu9///uESpKcyDVv3lzR0sipPTg3kpqEYsxMEAYCkqUxXysGJoMZdaMxI6URHgcNGkSLTTHSuXPnX/ziFz/72c8Ya0gIG8Uk6Y04eeihh1KYYLjjjz+eUNmwYUOSHOUJLUFALoiZSniYr3gk4V9SGsNhQRrzJrPAKGYqHWFGo0YlgtX69evXo0ePyy+/nMRGPYI/IAEwYbM4SWFSt25dDEczQBtHqCTJVYWcJTzI8QhvzHrYspMOtSiNBcCsXDSTweyXv/ylfAYzyhCYER6vvvpqslrv3r27detGhCSxUY/gD2H76le/6rERJzHc0UcfjeEUKkWOwtKTU5FiAdPIwcwS3t44sQItFffWjfm6w4B5k4kZtT7MLKVRiZSXl2M1ihEiZNu2benYfvrTn2qOX9ho3cCmowHESTMcJSK1CaHSkpyRC4qUODwrVfYWeAw3xiIqWjfmHWZpzGcyC4zymZiR0giPV111laxGMUINSYQEm0KZx6aqxAx3+OGHY7jvfe97GI5QST+gJJdIzsMzcpbwiJw8yBuzHteaFHgANnnyZHwWB2a1okVFMxnM5DNiI8yo+K+77jrC45VXXonVevbs2bVrVyLkz3/+cxIbcYxhDbBRlYCNepIGjk6gXr16GI5mgNrEQmU+cmfmFGQ7dg6f8LIe3RoQPFTc61CLFYpGK0hjHphMZsyU0qgeqUSwGi129+7dO3XqRIS89NJLSWxgY3wZfbB95StfMWw+TmI4SkoMR21iodKT0xxK4DlvuyDh6QDsngOPcdfMvdJYUCVaGrs5JwFDoyJZMjOfKaURHin6ZTWKkQ4dOlD6EyFptHUUjdEXtlq1aqkqETbFSW84C5VKcnHP5QuYATxLeLt3h8fWggdUANOxsXxFh3dY3GTqz4wZKY3wSCVSVlaG1aj7KUbatWtHhKRjox7RRH4iNh8nab3JcMcddxyGU6hUkoOcCsvAc/GAGdjOEh53dtcmATagorKnaLTpxKDiiIdEA2YmEzMCozGz8Ni3b19ZjXZNEfLiiy9ml9f+7rGpmFR6U5xUJyDDqRlQqGSsRc5HS2wX91w+26nD09fYnQ4DqX1WQxYkMAFTMIzbKw7MkhnMVDriM5hRifTv358CEqt16dKFYoQasnXr1iQ2xouBY2RxjMemuRKLkxiODGeGoxnAcIRKS3LyXJDn4uQKwLNjQLw3ayYFxRDr7FLVHQYsCIaJ9ooDk8kQwMxnpDSYER5lNep+rGYRksTGYDF2hm2//fYTNqoSGQ5sxEkVJhjuyCOPPOaYYzBcECpVngTkgoBZKTxVKzrXbxdNeACjIQMY2IJJKfOWOjCj5e1ldYeAeZOpBjFmhEcqkV69elFAYjXaNYoRIiSlvxIbo8aw5sOm9KY4SYaj9cZwxx57LIYLQmWcnG8MEgOmJ+enNBUD+JOYnDWonDAWdQdRkXIxmPaNGyvRWx6YHDYkEsDoz2BGbIQZZQjVI+GRSqS0tJSsRt0vqxEhSWx2YkEcm6W3IE7SCchwagZ8qKw6uaDITHQeX0zOy35iBULGDGD5Gi9zlRnLB0OzV+AwgBEY48wIj95qFCNt2rQhQiqxqR5hQBluYaPjVjEpwwlbouHUDGA4hcpKyRUOmIHzrFrRae18SAbAoDIuEsB0LrC1XDKWWSrRVUIVp2XAZDICo2oQmFlKoxIxq1GM+AipEoCBY0ALYFOcVANXwHCESpHzhWVhcvGYGYdnCY8/Uy01GWgIQQtIVj4YgICBJOtI1+Q0KCf5CalKVAJD/SMJFQ6jboQWXVo+kzGIDCvOwCIMffC1v/SlL+2zzz777rvvl7/8ZSrM/fff33KeTjYRP5xHBsJ8UMR/gMSCYokLwYkRT40kL6rsFFqpSU5Nnc5wshOQeJwPT4MZZf2iRYuWLFny/PPPP+f0P0l61mlhHv13Ts9EejqnpyItWLDgvyI9+eSTTzzxxGOPPfboo48+8sgj8+fPnzdv3oMPPvjAAw/cf//999133+zZs2fNmjVjxozp06dPmzaN4khTLVhfbYZqIpWyxAY1jqpy2QWpe1VVEfOpqvRbkLvvvntSJLZ6cqQpU6ZMnTpVt2haTtMj3XvvvXbHxFfSbVx85zmR2AVrkBm7GJmfLayoqPi/onaGvvjiC3amGmQmbJp8I6+wT23evDnrrd5dBa2PP/74o48+evzxxwmV1Ec1i420T/InqVBzU4gTuz777LOsB2E301//+teNGzdu2LBh3bp1JSUlZMeaPUVF2HAb5OiWqOIoDahKFi9enPVQ7B7aunXrn/70p/ci/fnPf545c6ZOHatxbDqZgluSHImUbhd4lHYkvNWrV2c9LLuuPv/88w8//HD9+vVitmnTphUrVhCxbKo6DWw6QkGoxHOQ0+EuWmCKui1btmQ9RLuW/vnPfzImConv5URWo46lhaDn0ym2NY5Nc0hEywsvvLBVq1aQI1R2iHTZZZfRe1Huk3KzHq5dQn/7298wlgeGiJMvvvgijaaA6bdbNY6NxGYzpHS7OF3k2rdvT7RsF2n48OH0dlkPWpb69NNPwbMukmdGnARkWVkZVtNsSxrYsJrOaNMJMNwnyYkccVIBUydRcef222/ni2Y9gGmLSEMMZMMDYBIZ7uGHH9aPtYSNqqRmfyBibtN8qGa1CZWXXHIJ0ZIKBVqynWImLEtLS+fNm/eXv/wl68FMQ6QxtjRIY148VVFRwW6N1ZpFgpx+VF6z2OQ2YbOzJwJyagwED/9deuml5eXlzz333D/+8Y+sB7YGRRrbvHlzPCp64cLJkyczjM1yygab5rN5kCQHOaIlkDCZwQObzmBEI0aMWLp0adbDu/OVL40FAuqyZcsoCBo3buynlZs0aZJGkNRJbQDzBwBhKXJ4TqnOw5MgCsWJEyeykVkP9c4R8YOuOV8aM+nZDz74YPDgwQ0aNPAHBNLGJsPph7M2dSJymvoCkmKmZPB4ioT30EMPEVWyHvbtF2nsk08+2bhxY2FgYobYUxcuXAgwHbrzB3QwX41jUybTgT5h86dVe3KyneD5nGdn7NDh0b6w/VkjqLb+/ve/V5rGPLb1kXr06IHVgkNxKWGLu01X91CoFFTI0RUoYHp4QdjU4yNHjly1alXWIKqqzz//nFhXAJg9vs6Jon/u3Lm6vIY/jip+jRo1SsltATY7UULk8ByvuThS3HkGT+IF1CzTp09nOLKGUkiksS1btmCaOLB1BUXR/+6777LhWM0fBzdyaWPTCRH+zDKRU57ztrNSxWKm1SxIvyUsKSmZP38+8SdrQKF8Gks0WWFsWG3cuHEnn3xyvjMY6OHSy21WTOpUFguVRs5sd1GkwHYBP6QfXtDhvfzyy1mT+pe2bt36/vvvG4OAU6XMSIGvvvoqzVnDhg0b5RSQSwmbfowkt4HN/2QvkVzgPEt4np/d6pVjxoxZs2ZNtsC++OILjJIvXXnle+q9aNb4qquugsrpOcXhpeo2wya3eXi6Tmqi7SzbyXnGz8QjvIC3479p06YxcOkDszS2du3awmYqLJg9+eSTVCI6X1an73lygsfjqQZJq0qCcwI10Wzk8sGzsGkSTj3F6/nAjh07kvA+/fTT1JjpjAEBqzQGFpCKlw4dOoDk1Jzi5FLFZhdZScTmA6aHF2Q7gxeIx3n2wki6JkFZWdmiRYtqGhg7B2lsbaQdMRniE4gTM2bM0FW+7NRKnV3pBbmUsOmM0kRsJv9LPQ/PyHl4XgaMl/FinQDRokULPmr06NGMSE0A06EWDfcOApPw6/Lly3XJruCkWO85YeOR9LBZevPYEn+a7ksVX6d450kemDGzH4qdccYZvGbKlCkM8c4CRhrToZaKioqdAkzg6UFvvPFGXXtU2ERO8E5zglwa2DR9pQFVD2DYznQKwqaRU54LikyTHokzs/KHgEnpRau3YMGCHWdGj6g0trNMJmwU/S+99BJIdK2hBpEa5hSQSwmbD5JBnDxzWwU/X7B+XJ4L4BktA3ZeTr5k1T9q1qwZzqOw3u7DQJ999pnmqHYQmCFfm9O6qFfr168fVqtfv/4pkRrk5MlZwOTPVINkYWyJ5DTp7CtMwbvAyUyWyEyfTLbT1f1JeNRsVQdGGtOhlu0A5t+yNo8o+h955BH95qN+pFNyCqKlxUweSQObfgDow5cf0OAnQ8G1WIKWPFEemOQLH/sXkGvevLnOuJ00adInn3xSGJidMbDdaSwfKhN7Ax9O93nMMcfodzrIwws8lx42nfMjf3g3eLd5cv6XlvGuLoBnwCQ7Eqs3Bp+vn5dhOLIdY9G+fftnn302H7OtW7cSuxjTapnMI6kKNgLv+PHjjz76aP2kuCrkGFL+TBtbMDPphzXxN7L+5+hGziuRWVCp6sPFDMPppAzlifLy8mXLlu1gGqsuLYnq5vXXX2cf0nXY9MO4OLl4hZI2tviEsreaBteUSM6cZ6i8fEoL9gmzmmGjSGHIGBpuSXgEQ5h9/PHHlaaxKlLJJzl4bZTVqJKOOOKI448/ntxWgFwAjwdTwsatr0qU3oIIacA0xPFLxZ2bXz42BvWOfbLHpvMymjZt2qRJE74kA9euXbs1a9Ykzk6t3bay2EFyFZHef//9hQsXQks/JuYLCFucXLy2TBVbgfQWYItfoTGYAzsnSd5n8WLEsJnVxKxx48Y8yNcj1a1YsUKnLHpX+TvbDcwcJmZrowjZuXPnww477LhI+gHxiZEKk0sPm37fnogNBW7T4CYaLriKQJxZYlbzic27TWtG0bO3bduWfpxBBJtm8XcQkqeVKMLjvffeW7du3e985zvHRpLhTojkbReESsHLAJumuILuzUbWMlDiJVHPrkwBs3zYdF14vg+BsWPHjvr5T9euXT22tTsQDPPRkvgXb7/9Nt8Eq4FNP9eX4XyS854LkhyPpIRNE1Hx9FYptmqRK4wN6axevgAOw16dOnW6PBIRsqSk5K233vLYqovK3xbQhx9+SAV06KGHUveDjdyWSM5aAk9O10BJA5vOG7cJ32DOMJ6BZAiRCy7vF8yhxGkFzIJ6hI/lPxIPu0bq0qVL55wg17NnT7CpjKyusSpFJVHykNJeffVVnFSnTh1dHEPYPLkCSU6eSwmbLkoWxEmr1+OtlZErcKmqgF8iNtsbtGJlmzZtunXr1r17925OQgi5Xr16JWKzaqK6roozq4gKyN69e9euXZvEVq9evcBwIucNF7ThutxJZtjik5O+9G8eKfF6mnFscXlsWu6QUhZvlZaWdt9WJTlBrk+fPpViqxYnT0t3Nm/evGDBAho1XeMQbDJcQM6XJ4ktAfdTwqZjY1VMb+a2xOsxVgpPrxFv/qmcRAwszS/I9evXL46tYtvCveqo4tKH8H0OPvhgipHDDz8cw4HtqKOOMmzxJBcnlx62Vq1a6ahmPL3FsfkgGU9vlWKzj+K/UCUCTBdy6hmpVx5BrqysTNhs9KsLLJGW6YMPPhg3btwBBxygS/hCLtFwVSks08AGLWHTgc1glsumS4JKPfFy0S1jF/OLM9PpCNQdwNDFtwL1SRIvHjBgANis6N8pqEzsDW+++Sad8oEHHqgLHMpwIofhCie5ABv3U8Kmkz7i6S2f4bYDGy/jtnXr1iQtIh7MhKRvTv3yi5eVl5cLW7VoFSa3evVq3aG/vv766/fbbz+7wKGutAY2C5XxfsAXlifllB42XXPT0pviZHBqSRybrr6ReAHGIFTqTz6fyrB///5i5qn0dypLEq+5+uqrE7EZnmrZy2PbsGHDCy+8AJ6DDjpIFzgMDCdywmYNeIFQqQozPWxxw/k2oFK3JQLjcT6HNCY8ASoDc0UeDYjECwYNGhRgq9RMicbSfRN/UvRTFu277766zrldmpIMZ9gKhMqAXErY9EtfO5vRTgMpECeDSjIfNh5RGiNjGTDvqkRCV155pW5Nus7rtddeK2zeXna/UmCr84iif+7cuTRqWM1jk+E8OW+4Ap2cImQa2HS11CBOBoarOjZLY6TMHj16KMQJmPfWACdPyGtgTjx13XXXgY1ipLphsID4tJUrVzZt2pSspssuGznLcNYMBFVl4qSX+gEhTAkbspMbE/vueBsQvz6tXsAn0CB7hwWRMB8t42QXf7U7lAwrVqyoFFthToEIjxMmTNhnn31q1apVOydh02IeMpyagXyh0tcmAqaDczWLjV4bbDpTP16YxKdLNLWReDVv7vP69u3bU/jlY+aBBagM0tUx8eCQIUMSsVnSqhYwRGjlA4cNG8aGA0Ornh4SKdFwvhkoPMucEjZdpFjkCsTJwHC+GOE+z/I5NFhB3REwCxzmaQXM7MrLupj5DTfcEMdWXVTo3UjcoVebM2cO/33o0KH8X/ZOIAHPloTwGc6HSjNcIrlUsenXMYkZLjCcxyZg3PLGkpISX9wnZrIAWJyWcZL8VbQZXHIbFtkOVAEzBP7FixdrgW98zD7Bfb5qs2bNiJM03b6kjNcmhUMltzWOTZe0qxRbvvlJnr388st9y+wr+8BkQQ7zzDwwo6Ur0WtllZtuugm3VQubGevdbbU6iqtTpkyBmb8SO3eGDx9OVmbotUScDKdmIDHDxclhtVSx6feDhTOcTVCR2/izbdu2mqOKMyucyeLx0DvMaCG7kD0DWkVsAhOnZaKLoL8eMWLEyJz8+gajRo0CIWMCEuBhuyDD5TOchcqUsGn5pgKG8zMmqhh5cWlpqUKiZ5ZYLhZ2mJgF9jJgQ3JiWAtgy0coLl5M0X/XXXeBZ0xO8XWVeJD/zuZDC9vZ/LLVJkbOpphttQEtaVWz2ABm2BLJWWGi9MZT3bp1sxlFTSoGzAJgQSZLBCZmtjyEASPraBUJhtKwmZ/sftWxYbWnnnoKKrc6BYvPacklWPInX5iER7Qk1VmGC6rK4OBASti0Pol+au2x+UM5WE3HxkQoXyYLasV4Ze+B+ZAoZt5hAoaUePAB2Kx6rC4tCepvvvmmFoQZ63RbTvHV3MWS0FK/fn01c5XWJjqLuWaxUUZqoRLImeHsh6Bggxl3qDvAo+nB+MxvPI3FQ2Ji3REPiVqeRbQQZYIWWGTfZ8SFrbq0TBSQjz76KJzG50S7bfdtbVy/xLsQcof9pkOHDsRAnFfgaFwG2IIMp98Y0j7jKi0mNGBb+ZBYlTSWGBILABMzVQrs+MK23cyw2qJFiyZGujtJWvsM3XnnnRMi2QrHWi2XO3wTdmKAYTvIJRouVWyenLARPEldmlsqz6PCIbFAlRjEw3zAkGo8gtWOYHvnnXew6bx582CjpW0SNTmne+65Z9KkSWIJRXnRgirb1bx58zqRgolKsHFb49h0BXldtwdyOhpAkUI0Z+i1pmF8wkmPmJ+MVuIcR2JZ77OXgMVpqUZXdUekqgo28Ngdu4944yuvvAIPv+xQAWk9JDR16lSjCEKtWQ1CEiHNT8OGDW3FODNcetjgpDUKue3evTsM/ApfPhsFDw5y8t6Kt8xBfVjYXqrCtX6URKVQRWxx8ThF/9y5c4Exc+bMWZFmz57925zui+TvIC1ppVWtDCSOBCEu1CpV7EydOnWiPSfb6WSh9LCRvRQkKRSJdbZQXpB+/Ppt/jWSEfUP5guGktESMG8vyRb84pbUEsfm/ZSPGeJdL774IsAE5v77758zZ84DkeZGejCP9Cwv4/VanoxP4HOgqLXJtKwYX5s2CcOR7WAGvJRyG7sMNQXjqybJApeXD2jBonzS4G1ljycWh3FayLwlWn5hNkJTIrZKRUpbvnw5WY2hFwzuP/TQQw9Hmj9//iM5/afTo5F0X8vLSbyF94ooHwhFeRGE7KMtWrSoG6nGseEwjMKYxnd2W4nUy88GBWte2mqXw5w8obil4pwMFZU3gRGTqaMiqYANBvHsVRgbL1i4cCGjrHE3JI899tjjjz/+xBNPPBlJiwEuiPRUfi3Iya8cyGfqw6HIDtqyZcuaXQgM0aOw1/Av8b6itmonNTSqgK2VsYbULw/sJxf8LNHomPwqh3FIxslQacVDfQe+GNiq6DBvtWXLlmEXOBkkRlwMnn76aS3sqHUetQqk1oXUkpHPR3ohEmFWt+ill156ORJ3Xon0u9/9ju6Cb7hkyRL+Xc0yk/hP+sZ8UTaPCEAc90FclbEKYmtrDGpA1OP0uiUnm1IS/oATn6YdRWsSa4lKLdm+HdgQ2wUwechzEiHPJkAiGOjVnH7/+9//byQILY60JNLSpUv5R4TipZHSYGZiG7RD8b3ZJTE+cVyLhSoVU1P5gkplsXWp1tx4kAWkBuj2SONy4u35VhPl/1YXG1Z77bXX5K1nnnnGaAWoXopknDwkcVoUySDxma9HghBWXrVqFcDeeOMN3pIqMC82jy3hG7BJ7KHsp/jP8rBHaGWx72yC/tRCXKI0meTnmeLAbO1X/t2KFSuqjo1Xvv3220CSw7y3vLE8qkROr0V6PSehQn/4wx/4/IqKij/+8Y+8ODNgJsoTbSHfhlvg+cQbX683aGvi4VQav60mbCvRMmCemZbp3Q5sMMBnQTwUM+8tT8tbSrSMk1C9EUmnR+B+nk0pk1VRfBs2ki1ke9hytp9oI/PxlPynnkaJEP+RC7XespZE9v6zub5AE3O6K6cAmJixQ/D5hbGtcuJljKkKjQCY4qEB87S8sZSlPCqEsfhYgOEz7vOWrCnlEbTYYDaVjWQICDjA8+YDHv6Dn+9G5b9gZsimawPZ48Gi2LYWtuaisHUBbKAKbjETsRFmlsZ8SIwDC1AZLfAsj2THH956661dIipWKhIem82msuXcl/OAp4ZUTajg0UsEyc/DEz8vi4cGzJKZrV9u2KwkMVcFJrMHGW75zJvMmPlSMKgvUJwWuwufuX79eoDxVNY0qiN4MBCMAhvMQCTCk/PIfJo+sGXqDV4wxR7InvKxUXO+fAgfqOGLcwq0cuVKwiD5zEymTGYm8yExHgw9LcQHbty4kVtAMgJZc9guESTJE3Ie4+LhETY1CWTwVHYCz4dN4+cRelqJzBAfxVBWig07Yh0xi2eyeFQMgBktjAV+HEZUJJPtHlGxsIAEOc0OkD9gSbVJqwe5xLDpnecPiBg/Q2WB0ZgJG+DJnZW6jWcZboBp34oHRm8yXxwqJIoZnwCnddGlyPnMPQGYF1ZjdNiF2ak9PKpNTb/6bo9B97ZTuprm5IH5Q2JiBnI+oVK38Sx4SGmemVUfiSazHCZgCHtt2rQJq/EUhVLWw1wDwknAY+9mXEAIOR8zve2U8Ah01ifED0gWYAZy3l4AG6O8KpqtsBrE+8wCYxyYOQzx4QAjzMqyWY9uDQs82sEZJjUJZjs1eUGTbgEzgOdlKc2w8d4A28pI/g6Q2HvUTQfMvMniIZG3b9iwgfqeD+H1WY9oisJkFAKaFLdSRQkv3uGpvZPtAn4GzDPj9bxR2FYmieGGh6zmmREbfWA0k3lg66LL/GOy3ay434nCZxhOe72OTnnbWbZTwFS28/A8MGl2JLDxLobbvBUIANDSzID3mZhZYPQm412ro5+4AYxHdtfifmcJNuoTNLGSL9tZe6DzNQzeTCezGgYtgI0HCYP8R8/MChAfGM1koAIYUVFVTNZjtssINpoMxATETG+7eMA0conMdPYHr8+HDQOpRbO60Rcg3mSWxgiMWC3tY2O7iyzhEb5sMlqNuU1Gi5zZTvzELBGbht6LBAY2+UyFvkxmk79msveixbJxGA9mPTa7tnr06KFDlFTkIIzXKX4yTPBmO9mJVrwSbEpjJv6Ejcp9TYJYYDSTKY2tia4Zo4lgvkPWo7KbiEHHbcRMxheK1pUbOTuAYMDsDEaeIhHiTnObFw7DzZ6ZMpmAWRojKmKyYlTcHpHYdKDZHzpXwLTy8rfbikd0TiOvAYZ3G/fBoINKYsafMpnSmGaB1ZDxSNZbv5sLqwGPyAY/HzB1KqM/L9gipE6XC7BBQvmMQl+BkRcYsHXR6l36ZVTWW7ynaOzYsSQY4OEVugULmNYYmPJh4w72ApuYERgxmaUxLR0LPGJy1tu6xwlUOj+HmInt1BvIc0p1HhuxFGwAU8YCkvmMwIillMaoO7TEw9475ZGOoEWRohN11BsYOTtZ39wmbIgqn3xGMuNB/lQaEzNek/U27TUCHkUKCY+CU+Q07+zdhoEUIbkjZnhOx8a2bNmiDnro0KFZb8pephkzZkBOE2NkO/NcgI2iQw21Ti356KOP8JlO9Mh6C/ZiyXZ4jpxHSzcnkmGj4qBipBgBEt3YxkjFqLiriGpFJ4FDUelNJQlWIzauia5IDTDuZP1Ni4oJeBQpmI+ASUmi04E3bdqkqLhnnjGwZ2jWrFn4jGgJvHeiX2Ns2LBh7dq1WX+voqog4OE8wiM1SNbfpaiiiiqqqKKKKqqooooqasf0/19W93My6U+IAAAAAElFTkSuQmCC" id="image0_262_7" width="146" height="146" preserveAspectRatio="none"/></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcpcursor-light.svg b/web/packages/design/src/ResourceIcon/assets/mcpcursor-light.svg
new file mode 100644
index 0000000000000..35765859f3f97
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcpcursor-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="126" height="28" fill="none" viewBox="0 0 126 28"><rect width="126" height="28" fill="#fff" fill-opacity=".9" rx="4"/><mask id="mask0_262_89" width="13" height="16" x="8" y="6" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M8 10.247v7.506l6.5 3.753 6.5-3.753v-7.506l-6.5-3.753z"/></mask><g mask="url(#mask0_262_89)"><path fill="url(#pattern0_262_89)" d="M6.016 5.637H22.76v16.744H6.016z"/></g><path fill="#000" fill-opacity=".9" d="m27.479 19 3.561-9.864h1.237v1.73h-.465L29.093 19zm1.715-2.666.431-1.23h4.491l.43 1.23zM34.643 19l-2.714-8.135v-1.73h.772L36.256 19zm5.175.123q-.93 0-1.627-.465-.69-.471-1.074-1.333-.375-.86-.375-2.03v-.014q0-1.176.376-2.037.375-.861 1.066-1.326.69-.471 1.634-.472.512 0 .957.164.444.158.786.452.342.286.54.69h.11V8.664h1.49V19h-1.49v-1.169h-.11q-.218.403-.554.697-.334.288-.772.445-.438.15-.957.15m.424-1.271q.615 0 1.066-.308.45-.308.69-.882.24-.58.24-1.367v-.014q0-.792-.246-1.367a1.93 1.93 0 0 0-.69-.882q-.445-.314-1.06-.314t-1.067.314q-.444.308-.683.882-.233.567-.233 1.367v.014q0 .793.233 1.367.239.574.683.882.45.308 1.067.308m8.087 1.271q-.93 0-1.627-.465-.69-.471-1.073-1.333-.377-.86-.377-2.03v-.014q0-1.176.377-2.037.376-.861 1.066-1.326.69-.471 1.634-.472.511 0 .957.164.444.158.786.452.342.286.54.69h.11V8.664h1.49V19h-1.49v-1.169h-.11q-.218.403-.554.697-.334.288-.772.445-.438.15-.957.15m.423-1.271q.615 0 1.067-.308.45-.308.69-.882.24-.58.24-1.367v-.014q0-.792-.247-1.367-.24-.574-.69-.882-.444-.314-1.06-.314-.615 0-1.066.314-.444.308-.684.882-.232.567-.232 1.367v.014q0 .793.232 1.367.24.574.684.882.45.308 1.066.308m11.718 1.196q-1.217 0-1.764-.465-.54-.471-.54-1.538v-4.3h-1.162v-1.169h1.162V9.703h1.518v1.873h1.593v1.17h-1.593v3.937q0 .6.239.868.24.26.793.26.165 0 .28-.007l.28-.02v1.189a7 7 0 0 1-.382.047 3 3 0 0 1-.424.028m5.325.096q-1.085 0-1.88-.465a3.1 3.1 0 0 1-1.21-1.326q-.423-.87-.423-2.058v-.014q-.001-1.196.424-2.057a3.1 3.1 0 0 1 1.216-1.326q.793-.465 1.873-.465 1.088 0 1.873.465.786.457 1.21 1.326.43.861.431 2.057v.014q0 1.19-.43 2.057a3.1 3.1 0 0 1-1.21 1.327q-.78.465-1.874.465m0-1.245q.636 0 1.08-.307.445-.314.677-.896.233-.58.233-1.401v-.014q0-.826-.233-1.408-.232-.58-.677-.889-.444-.315-1.08-.314-.636 0-1.08.314-.444.309-.683.889-.233.581-.233 1.408v.014q0 .82.233 1.401.24.582.683.896.444.307 1.08.307m12.75 1.34q-1.367 0-2.372-.629-.998-.629-1.538-1.784t-.54-2.748v-.013q0-1.6.54-2.755t1.538-1.785 2.372-.629q1.087 0 1.962.431a3.84 3.84 0 0 1 1.442 1.176q.568.752.69 1.73v.04h-1.524l-.007-.027a2.5 2.5 0 0 0-.499-1.053 2.5 2.5 0 0 0-.888-.69 2.74 2.74 0 0 0-1.176-.246q-.882 0-1.531.465-.643.465-.998 1.319-.35.848-.349 2.024v.013q0 1.162.349 2.017.356.855.998 1.32.649.464 1.538.464.65 0 1.175-.219.533-.219.89-.622.354-.41.484-.964l.014-.027h1.531l-.006.034a3.5 3.5 0 0 1-.698 1.661q-.554.71-1.421 1.108-.87.39-1.976.39m8.135-.095q-.834 0-1.408-.322a2.07 2.07 0 0 1-.855-.943q-.28-.623-.28-1.497v-4.806h1.483v4.457q0 .916.363 1.374.362.458 1.182.458.438 0 .78-.13a1.55 1.55 0 0 0 .574-.39q.233-.252.342-.608a2.6 2.6 0 0 0 .116-.806v-4.355h1.49V19h-1.49v-1.121h-.11a2.1 2.1 0 0 1-.485.683 2.1 2.1 0 0 1-.738.431q-.424.15-.964.15M92.32 19v-7.424h1.483v1.121h.117q.198-.594.697-.923.506-.327 1.244-.328a3 3 0 0 1 .65.069v1.367a4 4 0 0 0-.8-.082q-.569 0-.999.219-.423.217-.67.615-.239.39-.239.93V19zm7.889.144q-.896 0-1.559-.26-.663-.267-1.053-.732a2.03 2.03 0 0 1-.457-1.093v-.014h1.49v.014q.143.417.547.676.403.26 1.066.26.458 0 .8-.13.348-.13.547-.362a.8.8 0 0 0 .198-.533v-.014a.75.75 0 0 0-.28-.588q-.28-.24-.923-.39l-1.19-.273q-.697-.157-1.155-.43a1.8 1.8 0 0 1-.677-.67 1.95 1.95 0 0 1-.219-.944v-.007q0-.65.37-1.148.369-.506 1.018-.786.657-.287 1.497-.287.848 0 1.477.266.636.26 1.005.725.37.457.437 1.066v.007h-1.422v-.014q-.102-.39-.492-.649-.382-.26-1.012-.26-.403 0-.717.13-.315.123-.5.349a.8.8 0 0 0-.177.52v.013q0 .233.116.41.123.171.383.308.26.13.67.232l1.182.267q1.067.252 1.586.731.527.48.527 1.285v.014q0 .684-.404 1.21-.402.519-1.1.813-.69.288-1.579.288m7.711 0q-1.087 0-1.88-.465a3.1 3.1 0 0 1-1.21-1.326q-.424-.87-.424-2.058v-.014q0-1.196.424-2.057a3.1 3.1 0 0 1 1.217-1.326q.793-.465 1.873-.465 1.087 0 1.873.465.786.457 1.21 1.326.43.861.431 2.057v.014q0 1.19-.431 2.057a3.1 3.1 0 0 1-1.21 1.327q-.779.465-1.873.465m0-1.245q.636 0 1.08-.307.444-.314.677-.896.232-.58.232-1.401v-.014q0-.826-.232-1.408-.233-.58-.677-.889-.444-.315-1.08-.314-.636 0-1.08.314-.444.309-.684.889-.232.581-.232 1.408v.014q0 .82.232 1.401.24.582.684.896.444.307 1.08.307M112.917 19v-7.424h1.484v1.121h.116q.198-.594.697-.923.506-.327 1.244-.328a3 3 0 0 1 .65.069v1.367a4 4 0 0 0-.8-.082q-.567 0-.998.219-.424.217-.67.615-.24.39-.239.93V19z"/><defs><pattern id="pattern0_262_89" width="1" height="1" patternContentUnits="objectBoundingBox"><use xlink:href="#image0_262_89" transform="scale(.00685)"/></pattern><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJIAAACSCAIAAAAhGQTZAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAiX0lEQVR4nO2deZgV1ZnGJ4/GRFwGk5gEFdQYjUtEiAoBIQG3UROXgMSwydbQ7C02iguIyBaiJiKCKLLJEkVEcdwGdXDcYwZQiEEUFBpkM2okJsElmfk99T73y8epure7ga5iue8f97l9t751fvV+y6m6df7t34oqqqiiiiqqqKKKKqqoonZ3DRw48Mwzz8z6WxRVZY0ZM+auu+669tprTz755LPOOuvHP/5x1t+oqMo0bty4O++8E2w9e/b89re/3aRJk7PPPvvcc88twttFddttt0Fr0qRJYBsxYkTbtm2/9rWvffe73wXYf0Q655xzsv6ORTndeuutEydOhNnkyZPHjh1LkBw0aFCrVq1q166N4Ro0aPCjH/0Iwwle0XbZa+jQoXfccQfApk6dOmHChN/85jc333zzsGHD+vbte+GFF4INwx177LGNGjWCHHnu/PPPhxwImzVrlvV331s1fvx4TAYwsN1+++0ESZiNHDmSYqR79+4/+clP/j3SEUccQW3ywx/+EHLUljC74IILBC/rLdjLBCRQ3X333URF3Maf+OyWW24ZPXo0/hswYECnTp3OO+88mB188MHf+ta3MNwPfvCDpk2bEiEhR5HCs8DjFgtmvTV7gbAUDgMYJqP0oG4kmYkZKW348OFYrXfv3u3bt8dMMDvooIO+8Y1v1KtX76STTjrttNMgh+datmwJLSoUkUM8kvWW7aFq06YNxoLZ9OnTsRr3A2aExxtuuKG8vJwIedlll0EFbAceeCDprU6dOpSUp5xyCknujDPOwHMip96AcKqYSSDNeiv3LIEHVFOmTKG+J6XFmY0aNYpKBKv179+/S5cuMAaJsB1yyCHf/OY3jzzySAxHqGzcuDH1iDyngAlgDCd4xZi5c0RxTzAkKsKMWlHAVID8+te/htmvfvUrmBEehwwZMnDgwF69enXs2JHqHyRgO+CAA6gniZOHHXYYGa5+/fqESlxl5M6KJHjnRwJhscPbflFcwAlg06ZNIzbeEQlgMpkxowyhub7xxhuxWllZWUlJSbt27S655BKQkNhq1apFYfL1r3+dBg7DnXDCCbRxp59+epMmTUSuRYsWABY5hOGwHeS4U5zSrLZgg8lIY2CzqCiTwQwLGjNSGuFx8ODBWK1Pnz5ESBLbRRddBA9hw3OkN+IknQCGoxkgVJLkKE8gR54LyPmYScI78cQTsx6M3UGwwVv3RFJUNJMpMAbMbrrpJsLjNddcc8UVV5SWlhIhSWz02sK2//77g430RpykMDnqqKMwHKHy1FNPJcl5ckp1FjAVM4sdXuWiWVYaU3GPyeQwAbPAyMs8M2Lp9ddfj9X69u1LhKT0b926NV4BhrBxS3ojTtLAYThKyu9///uESpKcyDVv3lzR0sipPTg3kpqEYsxMEAYCkqUxXysGJoMZdaMxI6URHgcNGkSLTTHSuXPnX/ziFz/72c8Ya0gIG8Uk6Y04eeihh1KYYLjjjz+eUNmwYUOSHOUJLUFALoiZSniYr3gk4V9SGsNhQRrzJrPAKGYqHWFGo0YlgtX69evXo0ePyy+/nMRGPYI/IAEwYbM4SWFSt25dDEczQBtHqCTJVYWcJTzI8QhvzHrYspMOtSiNBcCsXDSTweyXv/ylfAYzyhCYER6vvvpqslrv3r27detGhCSxUY/gD2H76le/6rERJzHc0UcfjeEUKkWOwtKTU5FiAdPIwcwS3t44sQItFffWjfm6w4B5k4kZtT7MLKVRiZSXl2M1ihEiZNu2benYfvrTn2qOX9ho3cCmowHESTMcJSK1CaHSkpyRC4qUODwrVfYWeAw3xiIqWjfmHWZpzGcyC4zymZiR0giPV111laxGMUINSYQEm0KZx6aqxAx3+OGHY7jvfe97GI5QST+gJJdIzsMzcpbwiJw8yBuzHteaFHgANnnyZHwWB2a1okVFMxnM5DNiI8yo+K+77jrC45VXXonVevbs2bVrVyLkz3/+cxIbcYxhDbBRlYCNepIGjk6gXr16GI5mgNrEQmU+cmfmFGQ7dg6f8LIe3RoQPFTc61CLFYpGK0hjHphMZsyU0qgeqUSwGi129+7dO3XqRIS89NJLSWxgY3wZfbB95StfMWw+TmI4SkoMR21iodKT0xxK4DlvuyDh6QDsngOPcdfMvdJYUCVaGrs5JwFDoyJZMjOfKaURHin6ZTWKkQ4dOlD6EyFptHUUjdEXtlq1aqkqETbFSW84C5VKcnHP5QuYATxLeLt3h8fWggdUANOxsXxFh3dY3GTqz4wZKY3wSCVSVlaG1aj7KUbatWtHhKRjox7RRH4iNh8nab3JcMcddxyGU6hUkoOcCsvAc/GAGdjOEh53dtcmATagorKnaLTpxKDiiIdEA2YmEzMCozGz8Ni3b19ZjXZNEfLiiy9ml9f+7rGpmFR6U5xUJyDDqRlQqGSsRc5HS2wX91w+26nD09fYnQ4DqX1WQxYkMAFTMIzbKw7MkhnMVDriM5hRifTv358CEqt16dKFYoQasnXr1iQ2xouBY2RxjMemuRKLkxiODGeGoxnAcIRKS3LyXJDn4uQKwLNjQLw3ayYFxRDr7FLVHQYsCIaJ9ooDk8kQwMxnpDSYER5lNep+rGYRksTGYDF2hm2//fYTNqoSGQ5sxEkVJhjuyCOPPOaYYzBcECpVngTkgoBZKTxVKzrXbxdNeACjIQMY2IJJKfOWOjCj5e1ldYeAeZOpBjFmhEcqkV69elFAYjXaNYoRIiSlvxIbo8aw5sOm9KY4SYaj9cZwxx57LIYLQmWcnG8MEgOmJ+enNBUD+JOYnDWonDAWdQdRkXIxmPaNGyvRWx6YHDYkEsDoz2BGbIQZZQjVI+GRSqS0tJSsRt0vqxEhSWx2YkEcm6W3IE7SCchwagZ8qKw6uaDITHQeX0zOy35iBULGDGD5Gi9zlRnLB0OzV+AwgBEY48wIj95qFCNt2rQhQiqxqR5hQBluYaPjVjEpwwlbouHUDGA4hcpKyRUOmIHzrFrRae18SAbAoDIuEsB0LrC1XDKWWSrRVUIVp2XAZDICo2oQmFlKoxIxq1GM+AipEoCBY0ALYFOcVANXwHCESpHzhWVhcvGYGYdnCY8/Uy01GWgIQQtIVj4YgICBJOtI1+Q0KCf5CalKVAJD/SMJFQ6jboQWXVo+kzGIDCvOwCIMffC1v/SlL+2zzz777rvvl7/8ZSrM/fff33KeTjYRP5xHBsJ8UMR/gMSCYokLwYkRT40kL6rsFFqpSU5Nnc5wshOQeJwPT4MZZf2iRYuWLFny/PPPP+f0P0l61mlhHv13Ts9EejqnpyItWLDgvyI9+eSTTzzxxGOPPfboo48+8sgj8+fPnzdv3oMPPvjAAw/cf//999133+zZs2fNmjVjxozp06dPmzaN4khTLVhfbYZqIpWyxAY1jqpy2QWpe1VVEfOpqvRbkLvvvntSJLZ6cqQpU6ZMnTpVt2haTtMj3XvvvXbHxFfSbVx85zmR2AVrkBm7GJmfLayoqPi/onaGvvjiC3amGmQmbJp8I6+wT23evDnrrd5dBa2PP/74o48+evzxxwmV1Ec1i420T/InqVBzU4gTuz777LOsB2E301//+teNGzdu2LBh3bp1JSUlZMeaPUVF2HAb5OiWqOIoDahKFi9enPVQ7B7aunXrn/70p/ci/fnPf545c6ZOHatxbDqZgluSHImUbhd4lHYkvNWrV2c9LLuuPv/88w8//HD9+vVitmnTphUrVhCxbKo6DWw6QkGoxHOQ0+EuWmCKui1btmQ9RLuW/vnPfzImConv5URWo46lhaDn0ym2NY5Nc0hEywsvvLBVq1aQI1R2iHTZZZfRe1Huk3KzHq5dQn/7298wlgeGiJMvvvgijaaA6bdbNY6NxGYzpHS7OF3k2rdvT7RsF2n48OH0dlkPWpb69NNPwbMukmdGnARkWVkZVtNsSxrYsJrOaNMJMNwnyYkccVIBUydRcef222/ni2Y9gGmLSEMMZMMDYBIZ7uGHH9aPtYSNqqRmfyBibtN8qGa1CZWXXHIJ0ZIKBVqynWImLEtLS+fNm/eXv/wl68FMQ6QxtjRIY148VVFRwW6N1ZpFgpx+VF6z2OQ2YbOzJwJyagwED/9deuml5eXlzz333D/+8Y+sB7YGRRrbvHlzPCp64cLJkyczjM1yygab5rN5kCQHOaIlkDCZwQObzmBEI0aMWLp0adbDu/OVL40FAuqyZcsoCBo3buynlZs0aZJGkNRJbQDzBwBhKXJ4TqnOw5MgCsWJEyeykVkP9c4R8YOuOV8aM+nZDz74YPDgwQ0aNPAHBNLGJsPph7M2dSJymvoCkmKmZPB4ioT30EMPEVWyHvbtF2nsk08+2bhxY2FgYobYUxcuXAgwHbrzB3QwX41jUybTgT5h86dVe3KyneD5nGdn7NDh0b6w/VkjqLb+/ve/V5rGPLb1kXr06IHVgkNxKWGLu01X91CoFFTI0RUoYHp4QdjU4yNHjly1alXWIKqqzz//nFhXAJg9vs6Jon/u3Lm6vIY/jip+jRo1SsltATY7UULk8ByvuThS3HkGT+IF1CzTp09nOLKGUkiksS1btmCaOLB1BUXR/+6777LhWM0fBzdyaWPTCRH+zDKRU57ztrNSxWKm1SxIvyUsKSmZP38+8SdrQKF8Gks0WWFsWG3cuHEnn3xyvjMY6OHSy21WTOpUFguVRs5sd1GkwHYBP6QfXtDhvfzyy1mT+pe2bt36/vvvG4OAU6XMSIGvvvoqzVnDhg0b5RSQSwmbfowkt4HN/2QvkVzgPEt4np/d6pVjxoxZs2ZNtsC++OILjJIvXXnle+q9aNb4qquugsrpOcXhpeo2wya3eXi6Tmqi7SzbyXnGz8QjvIC3479p06YxcOkDszS2du3awmYqLJg9+eSTVCI6X1an73lygsfjqQZJq0qCcwI10Wzk8sGzsGkSTj3F6/nAjh07kvA+/fTT1JjpjAEBqzQGFpCKlw4dOoDk1Jzi5FLFZhdZScTmA6aHF2Q7gxeIx3n2wki6JkFZWdmiRYtqGhg7B2lsbaQdMRniE4gTM2bM0FW+7NRKnV3pBbmUsOmM0kRsJv9LPQ/PyHl4XgaMl/FinQDRokULPmr06NGMSE0A06EWDfcOApPw6/Lly3XJruCkWO85YeOR9LBZevPYEn+a7ksVX6d450kemDGzH4qdccYZvGbKlCkM8c4CRhrToZaKioqdAkzg6UFvvPFGXXtU2ERO8E5zglwa2DR9pQFVD2DYznQKwqaRU54LikyTHokzs/KHgEnpRau3YMGCHWdGj6g0trNMJmwU/S+99BJIdK2hBpEa5hSQSwmbD5JBnDxzWwU/X7B+XJ4L4BktA3ZeTr5k1T9q1qwZzqOw3u7DQJ999pnmqHYQmCFfm9O6qFfr168fVqtfv/4pkRrk5MlZwOTPVINkYWyJ5DTp7CtMwbvAyUyWyEyfTLbT1f1JeNRsVQdGGtOhlu0A5t+yNo8o+h955BH95qN+pFNyCqKlxUweSQObfgDow5cf0OAnQ8G1WIKWPFEemOQLH/sXkGvevLnOuJ00adInn3xSGJidMbDdaSwfKhN7Ax9O93nMMcfodzrIwws8lx42nfMjf3g3eLd5cv6XlvGuLoBnwCQ7Eqs3Bp+vn5dhOLIdY9G+fftnn302H7OtW7cSuxjTapnMI6kKNgLv+PHjjz76aP2kuCrkGFL+TBtbMDPphzXxN7L+5+hGziuRWVCp6sPFDMPppAzlifLy8mXLlu1gGqsuLYnq5vXXX2cf0nXY9MO4OLl4hZI2tviEsreaBteUSM6cZ6i8fEoL9gmzmmGjSGHIGBpuSXgEQ5h9/PHHlaaxKlLJJzl4bZTVqJKOOOKI448/ntxWgFwAjwdTwsatr0qU3oIIacA0xPFLxZ2bXz42BvWOfbLHpvMymjZt2qRJE74kA9euXbs1a9Ykzk6t3bay2EFyFZHef//9hQsXQks/JuYLCFucXLy2TBVbgfQWYItfoTGYAzsnSd5n8WLEsJnVxKxx48Y8yNcj1a1YsUKnLHpX+TvbDcwcJmZrowjZuXPnww477LhI+gHxiZEKk0sPm37fnogNBW7T4CYaLriKQJxZYlbzic27TWtG0bO3bduWfpxBBJtm8XcQkqeVKMLjvffeW7du3e985zvHRpLhTojkbReESsHLAJumuILuzUbWMlDiJVHPrkwBs3zYdF14vg+BsWPHjvr5T9euXT22tTsQDPPRkvgXb7/9Nt8Eq4FNP9eX4XyS854LkhyPpIRNE1Hx9FYptmqRK4wN6axevgAOw16dOnW6PBIRsqSk5K233vLYqovK3xbQhx9+SAV06KGHUveDjdyWSM5aAk9O10BJA5vOG7cJ32DOMJ6BZAiRCy7vF8yhxGkFzIJ6hI/lPxIPu0bq0qVL55wg17NnT7CpjKyusSpFJVHykNJeffVVnFSnTh1dHEPYPLkCSU6eSwmbLkoWxEmr1+OtlZErcKmqgF8iNtsbtGJlmzZtunXr1r17925OQgi5Xr16JWKzaqK6roozq4gKyN69e9euXZvEVq9evcBwIucNF7ThutxJZtjik5O+9G8eKfF6mnFscXlsWu6QUhZvlZaWdt9WJTlBrk+fPpViqxYnT0t3Nm/evGDBAho1XeMQbDJcQM6XJ4ktAfdTwqZjY1VMb+a2xOsxVgpPrxFv/qmcRAwszS/I9evXL46tYtvCveqo4tKH8H0OPvhgipHDDz8cw4HtqKOOMmzxJBcnlx62Vq1a6ahmPL3FsfkgGU9vlWKzj+K/UCUCTBdy6hmpVx5BrqysTNhs9KsLLJGW6YMPPhg3btwBBxygS/hCLtFwVSks08AGLWHTgc1glsumS4JKPfFy0S1jF/OLM9PpCNQdwNDFtwL1SRIvHjBgANis6N8pqEzsDW+++Sad8oEHHqgLHMpwIofhCie5ABv3U8Kmkz7i6S2f4bYDGy/jtnXr1iQtIh7MhKRvTv3yi5eVl5cLW7VoFSa3evVq3aG/vv766/fbbz+7wKGutAY2C5XxfsAXlifllB42XXPT0pviZHBqSRybrr6ReAHGIFTqTz6fyrB///5i5qn0dypLEq+5+uqrE7EZnmrZy2PbsGHDCy+8AJ6DDjpIFzgMDCdywmYNeIFQqQozPWxxw/k2oFK3JQLjcT6HNCY8ASoDc0UeDYjECwYNGhRgq9RMicbSfRN/UvRTFu277766zrldmpIMZ9gKhMqAXErY9EtfO5vRTgMpECeDSjIfNh5RGiNjGTDvqkRCV155pW5Nus7rtddeK2zeXna/UmCr84iif+7cuTRqWM1jk+E8OW+4Ap2cImQa2HS11CBOBoarOjZLY6TMHj16KMQJmPfWACdPyGtgTjx13XXXgY1ipLphsID4tJUrVzZt2pSspssuGznLcNYMBFVl4qSX+gEhTAkbspMbE/vueBsQvz6tXsAn0CB7hwWRMB8t42QXf7U7lAwrVqyoFFthToEIjxMmTNhnn31q1apVOydh02IeMpyagXyh0tcmAqaDczWLjV4bbDpTP16YxKdLNLWReDVv7vP69u3bU/jlY+aBBagM0tUx8eCQIUMSsVnSqhYwRGjlA4cNG8aGA0Ornh4SKdFwvhkoPMucEjZdpFjkCsTJwHC+GOE+z/I5NFhB3REwCxzmaQXM7MrLupj5DTfcEMdWXVTo3UjcoVebM2cO/33o0KH8X/ZOIAHPloTwGc6HSjNcIrlUsenXMYkZLjCcxyZg3PLGkpISX9wnZrIAWJyWcZL8VbQZXHIbFtkOVAEzBP7FixdrgW98zD7Bfb5qs2bNiJM03b6kjNcmhUMltzWOTZe0qxRbvvlJnr388st9y+wr+8BkQQ7zzDwwo6Ur0WtllZtuugm3VQubGevdbbU6iqtTpkyBmb8SO3eGDx9OVmbotUScDKdmIDHDxclhtVSx6feDhTOcTVCR2/izbdu2mqOKMyucyeLx0DvMaCG7kD0DWkVsAhOnZaKLoL8eMWLEyJz8+gajRo0CIWMCEuBhuyDD5TOchcqUsGn5pgKG8zMmqhh5cWlpqUKiZ5ZYLhZ2mJgF9jJgQ3JiWAtgy0coLl5M0X/XXXeBZ0xO8XWVeJD/zuZDC9vZ/LLVJkbOpphttQEtaVWz2ABm2BLJWWGi9MZT3bp1sxlFTSoGzAJgQSZLBCZmtjyEASPraBUJhtKwmZ/sftWxYbWnnnoKKrc6BYvPacklWPInX5iER7Qk1VmGC6rK4OBASti0Pol+au2x+UM5WE3HxkQoXyYLasV4Ze+B+ZAoZt5hAoaUePAB2Kx6rC4tCepvvvmmFoQZ63RbTvHV3MWS0FK/fn01c5XWJjqLuWaxUUZqoRLImeHsh6Bggxl3qDvAo+nB+MxvPI3FQ2Ji3REPiVqeRbQQZYIWWGTfZ8SFrbq0TBSQjz76KJzG50S7bfdtbVy/xLsQcof9pkOHDsRAnFfgaFwG2IIMp98Y0j7jKi0mNGBb+ZBYlTSWGBILABMzVQrs+MK23cyw2qJFiyZGujtJWvsM3XnnnRMi2QrHWi2XO3wTdmKAYTvIJRouVWyenLARPEldmlsqz6PCIbFAlRjEw3zAkGo8gtWOYHvnnXew6bx582CjpW0SNTmne+65Z9KkSWIJRXnRgirb1bx58zqRgolKsHFb49h0BXldtwdyOhpAkUI0Z+i1pmF8wkmPmJ+MVuIcR2JZ77OXgMVpqUZXdUekqgo28Ngdu4944yuvvAIPv+xQAWk9JDR16lSjCEKtWQ1CEiHNT8OGDW3FODNcetjgpDUKue3evTsM/ApfPhsFDw5y8t6Kt8xBfVjYXqrCtX6URKVQRWxx8ThF/9y5c4Exc+bMWZFmz57925zui+TvIC1ppVWtDCSOBCEu1CpV7EydOnWiPSfb6WSh9LCRvRQkKRSJdbZQXpB+/Ppt/jWSEfUP5guGktESMG8vyRb84pbUEsfm/ZSPGeJdL774IsAE5v77758zZ84DkeZGejCP9Cwv4/VanoxP4HOgqLXJtKwYX5s2CcOR7WAGvJRyG7sMNQXjqybJApeXD2jBonzS4G1ljycWh3FayLwlWn5hNkJTIrZKRUpbvnw5WY2hFwzuP/TQQw9Hmj9//iM5/afTo5F0X8vLSbyF94ooHwhFeRGE7KMtWrSoG6nGseEwjMKYxnd2W4nUy88GBWte2mqXw5w8obil4pwMFZU3gRGTqaMiqYANBvHsVRgbL1i4cCGjrHE3JI899tjjjz/+xBNPPBlJiwEuiPRUfi3Iya8cyGfqw6HIDtqyZcuaXQgM0aOw1/Av8b6itmonNTSqgK2VsYbULw/sJxf8LNHomPwqh3FIxslQacVDfQe+GNiq6DBvtWXLlmEXOBkkRlwMnn76aS3sqHUetQqk1oXUkpHPR3ohEmFWt+ill156ORJ3Xon0u9/9ju6Cb7hkyRL+Xc0yk/hP+sZ8UTaPCEAc90FclbEKYmtrDGpA1OP0uiUnm1IS/oATn6YdRWsSa4lKLdm+HdgQ2wUwechzEiHPJkAiGOjVnH7/+9//byQILY60JNLSpUv5R4TipZHSYGZiG7RD8b3ZJTE+cVyLhSoVU1P5gkplsXWp1tx4kAWkBuj2SONy4u35VhPl/1YXG1Z77bXX5K1nnnnGaAWoXopknDwkcVoUySDxma9HghBWXrVqFcDeeOMN3pIqMC82jy3hG7BJ7KHsp/jP8rBHaGWx72yC/tRCXKI0meTnmeLAbO1X/t2KFSuqjo1Xvv3220CSw7y3vLE8qkROr0V6PSehQn/4wx/4/IqKij/+8Y+8ODNgJsoTbSHfhlvg+cQbX683aGvi4VQav60mbCvRMmCemZbp3Q5sMMBnQTwUM+8tT8tbSrSMk1C9EUmnR+B+nk0pk1VRfBs2ki1ke9hytp9oI/PxlPynnkaJEP+RC7XespZE9v6zub5AE3O6K6cAmJixQ/D5hbGtcuJljKkKjQCY4qEB87S8sZSlPCqEsfhYgOEz7vOWrCnlEbTYYDaVjWQICDjA8+YDHv6Dn+9G5b9gZsimawPZ48Gi2LYWtuaisHUBbKAKbjETsRFmlsZ8SIwDC1AZLfAsj2THH956661dIipWKhIem82msuXcl/OAp4ZUTajg0UsEyc/DEz8vi4cGzJKZrV9u2KwkMVcFJrMHGW75zJvMmPlSMKgvUJwWuwufuX79eoDxVNY0qiN4MBCMAhvMQCTCk/PIfJo+sGXqDV4wxR7InvKxUXO+fAgfqOGLcwq0cuVKwiD5zEymTGYm8yExHgw9LcQHbty4kVtAMgJZc9guESTJE3Ie4+LhETY1CWTwVHYCz4dN4+cRelqJzBAfxVBWig07Yh0xi2eyeFQMgBktjAV+HEZUJJPtHlGxsIAEOc0OkD9gSbVJqwe5xLDpnecPiBg/Q2WB0ZgJG+DJnZW6jWcZboBp34oHRm8yXxwqJIoZnwCnddGlyPnMPQGYF1ZjdNiF2ak9PKpNTb/6bo9B97ZTuprm5IH5Q2JiBnI+oVK38Sx4SGmemVUfiSazHCZgCHtt2rQJq/EUhVLWw1wDwknAY+9mXEAIOR8zve2U8Ah01ifED0gWYAZy3l4AG6O8KpqtsBrE+8wCYxyYOQzx4QAjzMqyWY9uDQs82sEZJjUJZjs1eUGTbgEzgOdlKc2w8d4A28pI/g6Q2HvUTQfMvMniIZG3b9iwgfqeD+H1WY9oisJkFAKaFLdSRQkv3uGpvZPtAn4GzDPj9bxR2FYmieGGh6zmmREbfWA0k3lg66LL/GOy3ay434nCZxhOe72OTnnbWbZTwFS28/A8MGl2JLDxLobbvBUIANDSzID3mZhZYPQm412ro5+4AYxHdtfifmcJNuoTNLGSL9tZe6DzNQzeTCezGgYtgI0HCYP8R8/MChAfGM1koAIYUVFVTNZjtssINpoMxATETG+7eMA0conMdPYHr8+HDQOpRbO60Rcg3mSWxgiMWC3tY2O7iyzhEb5sMlqNuU1Gi5zZTvzELBGbht6LBAY2+UyFvkxmk79msveixbJxGA9mPTa7tnr06KFDlFTkIIzXKX4yTPBmO9mJVrwSbEpjJv6Ejcp9TYJYYDSTKY2tia4Zo4lgvkPWo7KbiEHHbcRMxheK1pUbOTuAYMDsDEaeIhHiTnObFw7DzZ6ZMpmAWRojKmKyYlTcHpHYdKDZHzpXwLTy8rfbikd0TiOvAYZ3G/fBoINKYsafMpnSmGaB1ZDxSNZbv5sLqwGPyAY/HzB1KqM/L9gipE6XC7BBQvmMQl+BkRcYsHXR6l36ZVTWW7ynaOzYsSQY4OEVugULmNYYmPJh4w72ApuYERgxmaUxLR0LPGJy1tu6xwlUOj+HmInt1BvIc0p1HhuxFGwAU8YCkvmMwIillMaoO7TEw9475ZGOoEWRohN11BsYOTtZ39wmbIgqn3xGMuNB/lQaEzNek/U27TUCHkUKCY+CU+Q07+zdhoEUIbkjZnhOx8a2bNmiDnro0KFZb8pephkzZkBOE2NkO/NcgI2iQw21Ti356KOP8JlO9Mh6C/ZiyXZ4jpxHSzcnkmGj4qBipBgBEt3YxkjFqLiriGpFJ4FDUelNJQlWIzauia5IDTDuZP1Ni4oJeBQpmI+ASUmi04E3bdqkqLhnnjGwZ2jWrFn4jGgJvHeiX2Ns2LBh7dq1WX+voqog4OE8wiM1SNbfpaiiiiqqqKKKKqqooooqasf0/19W93My6U+IAAAAAElFTkSuQmCC" id="image0_262_89" width="146" height="146" preserveAspectRatio="none"/></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcpvscode.svg b/web/packages/design/src/ResourceIcon/assets/mcpvscode.svg
new file mode 100644
index 0000000000000..d7466ef8e06cf
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcpvscode.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="84" height="20" aria-label="VS Code: tsh"><title>VS Code: tsh</title><g shape-rendering="crispEdges"><path fill="#555" d="M0 0h57v20H0z"/><path fill="#0098ff" d="M57 0h27v20H57z"/></g><g fill="#fff" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="110" text-anchor="middle" text-rendering="geometricPrecision"><text x="295" y="140" textLength="470" transform="scale(.1)">VS Code</text><text x="695" y="140" textLength="170" transform="scale(.1)">tsh</text></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mcpvscodeinsiders.svg b/web/packages/design/src/ResourceIcon/assets/mcpvscodeinsiders.svg
new file mode 100644
index 0000000000000..63c5dfed8ad2f
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/mcpvscodeinsiders.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="132" height="20" aria-label="VS Code Insiders: tsh"><title>VS Code Insiders: tsh</title><g shape-rendering="crispEdges"><path fill="#555" d="M0 0h105v20H0z"/><path fill="#24bfa5" d="M105 0h27v20h-27z"/></g><g fill="#fff" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="110" text-anchor="middle" text-rendering="geometricPrecision"><text x="535" y="140" textLength="950" transform="scale(.1)">VS Code Insiders</text><text x="1175" y="140" textLength="170" transform="scale(.1)">tsh</text></g></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/metabase.svg b/web/packages/design/src/ResourceIcon/assets/metabase.svg
index b45b0acb073d3..a9da00fec1b4b 100644
--- a/web/packages/design/src/ResourceIcon/assets/metabase.svg
+++ b/web/packages/design/src/ResourceIcon/assets/metabase.svg
@@ -1,31 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6726_30100)">
-<path d="M11.8414 22.7914C14.224 22.7914 16.1554 20.829 16.1554 18.4084C16.1554 15.9877 14.224 14.0254 11.8414 14.0254C9.4588 14.0254 7.52734 15.9877 7.52734 18.4084C7.52734 20.829 9.4588 22.7914 11.8414 22.7914Z" fill="#509EE3"/>
-<path d="M11.8414 35.0638C14.224 35.0638 16.1554 33.1015 16.1554 30.6808C16.1554 28.2602 14.224 26.2979 11.8414 26.2979C9.4588 26.2979 7.52734 28.2602 7.52734 30.6808C7.52734 33.1015 9.4588 35.0638 11.8414 35.0638Z" fill="#509EE3"/>
-<path opacity="0.2" d="M23.9205 22.7914C26.3031 22.7914 28.2345 20.829 28.2345 18.4084C28.2345 15.9877 26.3031 14.0254 23.9205 14.0254C21.5379 14.0254 19.6064 15.9877 19.6064 18.4084C19.6064 20.829 21.5379 22.7914 23.9205 22.7914Z" fill="#509EE3"/>
-<path d="M23.9205 35.183C26.3031 35.183 28.2345 33.2206 28.2345 30.8C28.2345 28.3793 26.3031 26.417 23.9205 26.417C21.5379 26.417 19.6064 28.3793 19.6064 30.8C19.6064 33.2206 21.5379 35.183 23.9205 35.183Z" fill="#509EE3"/>
-<path opacity="0.2" d="M35.9996 22.7914C38.3822 22.7914 40.3136 20.829 40.3136 18.4084C40.3136 15.9877 38.3822 14.0254 35.9996 14.0254C33.617 14.0254 31.6855 15.9877 31.6855 18.4084C31.6855 20.829 33.617 22.7914 35.9996 22.7914Z" fill="#509EE3"/>
-<path opacity="0.2" d="M35.9996 8.76598C38.3822 8.76598 40.3136 6.80365 40.3136 4.38299C40.3136 1.96233 38.3822 0 35.9996 0C33.617 0 31.6855 1.96233 31.6855 4.38299C31.6855 6.80365 33.617 8.76598 35.9996 8.76598Z" fill="#509EE3"/>
-<path opacity="0.2" d="M35.9996 35.183C38.3822 35.183 40.3136 33.2206 40.3136 30.8C40.3136 28.3793 38.3822 26.417 35.9996 26.417C33.617 26.417 31.6855 28.3793 31.6855 30.8C31.6855 33.2206 33.617 35.183 35.9996 35.183Z" fill="#509EE3"/>
-<path opacity="0.2" d="M48.0787 22.7914C50.4613 22.7914 52.3927 20.829 52.3927 18.4084C52.3927 15.9877 50.4613 14.0254 48.0787 14.0254C45.6961 14.0254 43.7646 15.9877 43.7646 18.4084C43.7646 20.829 45.6961 22.7914 48.0787 22.7914Z" fill="#509EE3"/>
-<path d="M60.1588 22.7914C62.5413 22.7914 64.4728 20.829 64.4728 18.4084C64.4728 15.9877 62.5413 14.0254 60.1588 14.0254C57.7762 14.0254 55.8447 15.9877 55.8447 18.4084C55.8447 20.829 57.7762 22.7914 60.1588 22.7914Z" fill="#509EE3"/>
-<path d="M48.0787 35.183C50.4613 35.183 52.3927 33.2206 52.3927 30.8C52.3927 28.3793 50.4613 26.417 48.0787 26.417C45.6961 26.417 43.7646 28.3793 43.7646 30.8C43.7646 33.2206 45.6961 35.183 48.0787 35.183Z" fill="#509EE3"/>
-<path d="M60.1588 35.183C62.5413 35.183 64.4728 33.2206 64.4728 30.8C64.4728 28.3793 62.5413 26.417 60.1588 26.417C57.7762 26.417 55.8447 28.3793 55.8447 30.8C55.8447 33.2206 57.7762 35.183 60.1588 35.183Z" fill="#509EE3"/>
-<path d="M11.8414 47.3363C14.224 47.3363 16.1554 45.374 16.1554 42.9533C16.1554 40.5326 14.224 38.5703 11.8414 38.5703C9.4588 38.5703 7.52734 40.5326 7.52734 42.9533C7.52734 45.374 9.4588 47.3363 11.8414 47.3363Z" fill="#509EE3"/>
-<path opacity="0.2" d="M23.9205 47.4554C26.3031 47.4554 28.2345 45.4931 28.2345 43.0724C28.2345 40.6518 26.3031 38.6895 23.9205 38.6895C21.5379 38.6895 19.6064 40.6518 19.6064 43.0724C19.6064 45.4931 21.5379 47.4554 23.9205 47.4554Z" fill="#509EE3"/>
-<path d="M35.9996 47.4554C38.3822 47.4554 40.3136 45.4931 40.3136 43.0724C40.3136 40.6518 38.3822 38.6895 35.9996 38.6895C33.617 38.6895 31.6855 40.6518 31.6855 43.0724C31.6855 45.4931 33.617 47.4554 35.9996 47.4554Z" fill="#509EE3"/>
-<path opacity="0.2" d="M48.0787 47.4554C50.4613 47.4554 52.3927 45.4931 52.3927 43.0724C52.3927 40.6518 50.4613 38.6895 48.0787 38.6895C45.6961 38.6895 43.7646 40.6518 43.7646 43.0724C43.7646 45.4931 45.6961 47.4554 48.0787 47.4554Z" fill="#509EE3"/>
-<path d="M60.1588 47.4554C62.5413 47.4554 64.4728 45.4931 64.4728 43.0724C64.4728 40.6518 62.5413 38.6895 60.1588 38.6895C57.7762 38.6895 55.8447 40.6518 55.8447 43.0724C55.8447 45.4931 57.7762 47.4554 60.1588 47.4554Z" fill="#509EE3"/>
-<path d="M11.8414 59.6088C14.224 59.6088 16.1554 57.6464 16.1554 55.2258C16.1554 52.8051 14.224 50.8428 11.8414 50.8428C9.4588 50.8428 7.52734 52.8051 7.52734 55.2258C7.52734 57.6464 9.4588 59.6088 11.8414 59.6088Z" fill="#509EE3"/>
-<path opacity="0.2" d="M23.9205 59.7279C26.3031 59.7279 28.2345 57.7656 28.2345 55.3449C28.2345 52.9242 26.3031 50.9619 23.9205 50.9619C21.5379 50.9619 19.6064 52.9242 19.6064 55.3449C19.6064 57.7656 21.5379 59.7279 23.9205 59.7279Z" fill="#509EE3"/>
-<path opacity="0.2" d="M35.9996 59.7279C38.3822 59.7279 40.3136 57.7656 40.3136 55.3449C40.3136 52.9242 38.3822 50.9619 35.9996 50.9619C33.617 50.9619 31.6855 52.9242 31.6855 55.3449C31.6855 57.7656 33.617 59.7279 35.9996 59.7279Z" fill="#509EE3"/>
-<path opacity="0.2" d="M35.9996 72.0004C38.3822 72.0004 40.3136 70.038 40.3136 67.6174C40.3136 65.1967 38.3822 63.2344 35.9996 63.2344C33.617 63.2344 31.6855 65.1967 31.6855 67.6174C31.6855 70.038 33.617 72.0004 35.9996 72.0004Z" fill="#509EE3"/>
-<path opacity="0.2" d="M48.0787 59.7279C50.4613 59.7279 52.3927 57.7656 52.3927 55.3449C52.3927 52.9242 50.4613 50.9619 48.0787 50.9619C45.6961 50.9619 43.7646 52.9242 43.7646 55.3449C43.7646 57.7656 45.6961 59.7279 48.0787 59.7279Z" fill="#509EE3"/>
-<path d="M60.1588 59.7279C62.5413 59.7279 64.4728 57.7656 64.4728 55.3449C64.4728 52.9242 62.5413 50.9619 60.1588 50.9619C57.7762 50.9619 55.8447 52.9242 55.8447 55.3449C55.8447 57.7656 57.7762 59.7279 60.1588 59.7279Z" fill="#509EE3"/>
-</g>
-<defs>
-<clipPath id="clip0_6726_30100">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#509ee3" clip-path="url(#clip0_6726_30100)"><path d="M11.841 22.791c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.931-4.383-4.314-4.383s-4.314 1.963-4.314 4.383 1.932 4.383 4.314 4.383m0 12.273c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.931-4.383-4.314-4.383S7.527 28.26 7.527 30.68s1.932 4.383 4.314 4.383"/><path d="M23.92 22.791c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.93-4.383-4.314-4.383-2.382 0-4.314 1.963-4.314 4.383s1.932 4.383 4.314 4.383" opacity=".2"/><path d="M23.92 35.183c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.93-4.383-4.314-4.383-2.382 0-4.314 1.962-4.314 4.383 0 2.42 1.932 4.383 4.314 4.383"/><path d="M36 22.791c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.963-4.314 4.383 1.931 4.383 4.314 4.383m0-14.025c2.382 0 4.314-1.962 4.314-4.383C40.314 1.963 38.382 0 36 0s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383m0 26.417c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383m12.079-12.392c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.963-4.314 4.383 1.931 4.383 4.314 4.383" opacity=".2"/><path d="M60.159 22.791c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.963-4.314 4.383 1.931 4.383 4.314 4.383m-12.08 12.392c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383m12.08 0c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383M11.841 47.336c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.931-4.383-4.314-4.383s-4.314 1.963-4.314 4.383 1.932 4.383 4.314 4.383"/><path d="M23.92 47.455c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.93-4.382-4.314-4.382-2.382 0-4.314 1.962-4.314 4.382s1.932 4.383 4.314 4.383" opacity=".2"/><path d="M36 47.455c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.382-4.314-4.382s-4.314 1.962-4.314 4.382 1.931 4.383 4.314 4.383"/><path d="M48.079 47.455c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.382-4.314-4.382s-4.314 1.962-4.314 4.382 1.931 4.383 4.314 4.383" opacity=".2"/><path d="M60.159 47.455c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.382-4.314-4.382s-4.314 1.962-4.314 4.382 1.931 4.383 4.314 4.383M11.841 59.609c2.383 0 4.314-1.963 4.314-4.383s-1.931-4.383-4.314-4.383-4.314 1.962-4.314 4.383c0 2.42 1.932 4.383 4.314 4.383"/><path d="M23.92 59.728c2.383 0 4.314-1.962 4.314-4.383 0-2.42-1.93-4.383-4.314-4.383-2.382 0-4.314 1.962-4.314 4.383 0 2.42 1.932 4.383 4.314 4.383m12.08 0c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383M36 72c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.963-4.314 4.383S33.617 72 36 72m12.079-12.272c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383" opacity=".2"/><path d="M60.159 59.728c2.382 0 4.314-1.962 4.314-4.383 0-2.42-1.932-4.383-4.314-4.383s-4.314 1.962-4.314 4.383c0 2.42 1.931 4.383 4.314 4.383"/></g><defs><clipPath id="clip0_6726_30100"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoft.svg b/web/packages/design/src/ResourceIcon/assets/microsoft.svg
index e3e9d6047545f..af0bdf7dad625 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoft.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoft.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6706_29510)">
-<path d="M3.13086 3.13037H34.4352V34.4347H3.13086V3.13037Z" fill="#F35325"/>
-<path d="M37.5654 3.13037H68.8698V34.4347H37.5654V3.13037Z" fill="#81BC06"/>
-<path d="M3.13086 37.5654H34.4352V68.8698H3.13086V37.5654Z" fill="#05A6F0"/>
-<path d="M37.5654 37.5654H68.8698V68.8698H37.5654V37.5654Z" fill="#FFBA08"/>
-</g>
-<defs>
-<clipPath id="clip0_6706_29510">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6706_29510)"><path fill="#f35325" d="M3.13 3.13h31.305v31.305H3.131z"/><path fill="#81bc06" d="M37.565 3.13H68.87v31.305H37.565z"/><path fill="#05a6f0" d="M3.13 37.565h31.305V68.87H3.131z"/><path fill="#ffba08" d="M37.565 37.565H68.87V68.87H37.565z"/></g><defs><clipPath id="clip0_6706_29510"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftexcel.svg b/web/packages/design/src/ResourceIcon/assets/microsoftexcel.svg
index 2dfd2e6ad46ea..aecd1e810175b 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftexcel.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftexcel.svg
@@ -1,25 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4752)">
-<path d="M45.2093 34.3235L16.7441 29.3003V66.4171C16.7441 68.1122 18.1183 69.4863 19.8133 69.4863H68.9308C70.6258 69.4863 72 68.1122 72 66.4171V52.7422L45.2093 34.3235Z" fill="#185C37"/>
-<path d="M45.2093 2.50977H19.8133C18.1183 2.50977 16.7441 3.88389 16.7441 5.57897V19.254L45.2093 35.9981L60.279 41.0214L72 35.9981V19.254L45.2093 2.50977Z" fill="#21A366"/>
-<path d="M16.7441 19.2539H45.2093V35.9981H16.7441V19.2539Z" fill="#107C41"/>
-<path opacity="0.1" d="M37.1168 15.9053H16.7441V57.7657H37.1168C38.8096 57.7602 40.1805 56.3893 40.186 54.6965V18.9745C40.1805 17.2817 38.8096 15.9108 37.1168 15.9053Z" fill="black"/>
-<path opacity="0.2" d="M35.4424 17.5796H16.7441V59.4401H35.4424C37.1352 59.4346 38.5061 58.0636 38.5116 56.3709V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.2" d="M35.4424 17.5796H16.7441V56.0912H35.4424C37.1352 56.0857 38.5061 54.7148 38.5116 53.022V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.2" d="M33.768 17.5796H16.7441V56.0912H33.768C35.4607 56.0857 36.8317 54.7148 36.8372 53.022V20.6488C36.8317 18.956 35.4607 17.5851 33.768 17.5796Z" fill="black"/>
-<path d="M3.0692 17.5796H33.768C35.4631 17.5796 36.8372 18.9537 36.8372 20.6488V51.3476C36.8372 53.0426 35.4631 54.4168 33.768 54.4168H3.0692C1.37412 54.4168 0 53.0427 0 51.3476V20.6488C0 18.9537 1.37412 17.5796 3.0692 17.5796Z" fill="url(#paint0_linear_8803_4752)"/>
-<path d="M9.50586 45.9746L15.9624 35.9699L10.0467 26.0205H14.8054L18.0337 32.3833C18.3317 32.9878 18.536 33.4365 18.6465 33.7329H18.6884C18.9005 33.2506 19.1237 32.7824 19.3581 32.328L22.8091 26.0239H27.1777L21.1112 35.9147L27.3317 45.9745H22.6835L18.9546 38.9906C18.779 38.6934 18.6299 38.3813 18.5092 38.0579H18.454C18.3447 38.3747 18.1998 38.6781 18.022 38.9621L14.1825 45.9746H9.50586Z" fill="white"/>
-<path d="M68.9305 2.50977H45.209V19.254H71.9997V5.57897C71.9997 3.88389 70.6256 2.50977 68.9305 2.50977Z" fill="#33C481"/>
-<path d="M45.209 35.998H71.9997V52.7422H45.209V35.998Z" fill="#107C41"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_8803_4752" x1="6.39937" y1="15.1814" x2="30.4378" y2="56.815" gradientUnits="userSpaceOnUse">
-<stop stop-color="#18884F"/>
-<stop offset="0.5" stop-color="#117E43"/>
-<stop offset="1" stop-color="#0B6631"/>
-</linearGradient>
-<clipPath id="clip0_8803_4752">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4752)"><path fill="#185c37" d="M45.21 34.324 16.743 29.3v37.117a3.07 3.07 0 0 0 3.07 3.07H68.93A3.07 3.07 0 0 0 72 66.416V52.742z"/><path fill="#21a366" d="M45.21 2.51H19.812a3.07 3.07 0 0 0-3.069 3.069v13.675L45.21 35.998l15.07 5.023L72 35.998V19.254z"/><path fill="#107c41" d="M16.744 19.254H45.21v16.744H16.744z"/><path fill="#000" d="M37.117 15.905H16.744v41.86h20.373a3.08 3.08 0 0 0 3.069-3.068V18.974a3.08 3.08 0 0 0-3.07-3.069" opacity=".1"/><path fill="#000" d="M35.442 17.58H16.744v41.86h18.698a3.08 3.08 0 0 0 3.07-3.07V20.65a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="#000" d="M35.442 17.58H16.744v38.51h18.698a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="#000" d="M33.768 17.58H16.744v38.51h17.024a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="url(#paint0_linear_8803_4752)" d="M3.07 17.58h30.698a3.07 3.07 0 0 1 3.07 3.069v30.699a3.07 3.07 0 0 1-3.07 3.069H3.069A3.07 3.07 0 0 1 0 51.347V20.65a3.07 3.07 0 0 1 3.07-3.07"/><path fill="#fff" d="m9.506 45.975 6.456-10.005-5.915-9.95h4.758l3.229 6.363q.447.906.613 1.35h.041q.32-.723.67-1.405l3.451-6.304h4.369l-6.067 9.89 6.22 10.06h-4.648l-3.728-6.983a6 6 0 0 1-.446-.933h-.055q-.165.477-.432.904l-3.84 7.013z"/><path fill="#33c481" d="M68.93 2.51H45.21v16.744H72V5.579a3.07 3.07 0 0 0-3.068-3.07"/><path fill="#107c41" d="M45.209 35.998h26.79v16.744H45.21z"/></g><defs><linearGradient id="paint0_linear_8803_4752" x1="6.399" x2="30.438" y1="15.181" y2="56.815" gradientUnits="userSpaceOnUse"><stop stop-color="#18884f"/><stop offset=".5" stop-color="#117e43"/><stop offset="1" stop-color="#0b6631"/></linearGradient><clipPath id="clip0_8803_4752"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftonedrive.svg b/web/packages/design/src/ResourceIcon/assets/microsoftonedrive.svg
index 6f587666128b8..4d3b274d0ab57 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftonedrive.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftonedrive.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M27.4552 25.6794L27.4559 25.6769L42.5708 34.7306L51.5776 30.9404C53.4077 30.1491 55.3812 29.7434 57.3751 29.7454C57.7073 29.7454 58.0357 29.7604 58.3624 29.7822C57.2795 25.5599 54.9936 21.7429 51.7824 18.7952C48.5711 15.8475 44.5728 13.8959 40.2734 13.1777C35.974 12.4595 31.5585 13.0055 27.5635 14.7493C23.5685 16.4932 20.166 19.3599 17.7695 23.0011C17.8465 23.0001 17.9224 22.9953 17.9995 22.9953C21.34 22.9907 24.6153 23.9205 27.4552 25.6794Z" fill="#0364B8"/>
-<path d="M27.4566 25.6768L27.4559 25.6792C24.616 23.9203 21.3408 22.9906 18.0003 22.9951C17.9231 22.9951 17.8472 23 17.7703 23.0009C14.5007 23.0414 11.304 23.9721 8.52371 25.6929C5.74338 27.4137 3.48452 29.8596 1.98986 32.7677C0.495213 35.6759 -0.178721 38.9364 0.0404851 42.1988C0.259691 45.4612 1.36375 48.6022 3.23402 51.2843L16.5632 45.6751L22.4885 43.1817L35.6816 37.6298L42.5715 34.7304L27.4566 25.6768Z" fill="#0078D4"/>
-<path d="M58.3619 29.7825C58.0352 29.7607 57.7068 29.7456 57.3746 29.7456C55.3807 29.7437 53.4076 30.1509 51.5774 30.9421L42.5703 34.7308L45.1821 36.2952L53.7433 41.4233L57.4786 43.6607L70.2505 51.311C71.411 49.1566 72.0124 46.7454 71.9996 44.2984C71.9869 41.8514 71.3603 39.4467 70.1774 37.3045C68.9944 35.1624 67.2929 33.3513 65.2286 32.0371C63.1644 30.723 60.8034 29.9477 58.3619 29.7825Z" fill="#1490DF"/>
-<path d="M57.4802 43.6608L53.7449 41.4234L45.1837 36.2954L42.5719 34.731L35.682 37.6303L22.4889 43.1822L16.5636 45.6756L3.23438 51.2848C4.89077 53.6663 7.09892 55.6115 9.67026 56.9543C12.2416 58.2971 15.0997 58.9977 18.0006 58.9962H57.3762C60.0163 58.997 62.6073 58.2829 64.8743 56.9299C67.1413 55.5768 68.9996 53.6352 70.2521 51.3111L57.4802 43.6608Z" fill="#28A8EA"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0364b8" d="M27.455 25.68v-.003l15.116 9.054 9.007-3.79a14.6 14.6 0 0 1 6.784-1.159 22.503 22.503 0 0 0-40.592-6.78c.076-.002.152-.007.23-.007 3.34-.004 6.615.925 9.455 2.684"/><path fill="#0078d4" d="m27.457 25.677-.001.002A17.9 17.9 0 0 0 18 22.995c-.077 0-.153.005-.23.006A17.993 17.993 0 0 0 3.234 51.284l13.33-5.609 5.924-2.493 13.194-5.552 6.89-2.9z"/><path fill="#1490df" d="M58.362 29.783a14.6 14.6 0 0 0-6.785 1.16L42.57 34.73l2.612 1.564 8.561 5.128 3.736 2.238 12.772 7.65a14.626 14.626 0 0 0-11.89-21.528"/><path fill="#28a8ea" d="m57.48 43.66-3.735-2.237-8.561-5.128-2.612-1.564-6.89 2.9-13.193 5.551-5.925 2.494-13.33 5.609a17.98 17.98 0 0 0 14.767 7.711h39.375a14.62 14.62 0 0 0 12.876-7.685z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftonenote.svg b/web/packages/design/src/ResourceIcon/assets/microsoftonenote.svg
index 1e55c4f6e0ad3..25a1be47aacd4 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftonenote.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftonenote.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M55.2558 69.4865H19.81C18.1168 69.4865 16.7441 68.1139 16.7441 66.4206V5.57563C16.7441 3.88239 18.1168 2.50977 19.81 2.50977H68.9341C70.6273 2.50977 72 3.88239 72 5.57563V19.2539L55.2558 69.4865Z" fill="#CA64EA"/>
-<path d="M72.0001 35.9981L63.628 41.0214L55.2559 35.9981V19.2539H72L72.0001 35.9981Z" fill="#AE4BD5"/>
-<path d="M72 52.7422L63.6279 57.7655L55.2559 52.7422V35.998H72V52.7422Z" fill="#9332BF"/>
-<path d="M55.2559 52.7422H72V66.3468C72 68.0808 70.5944 69.4864 68.8605 69.4864H55.2559V52.7422Z" fill="#7719AA"/>
-<path opacity="0.2" d="M37.1168 15.9053H16.7441V57.7657H37.1168C38.8096 57.7602 40.1805 56.3893 40.186 54.6965V18.9745C40.1805 17.2817 38.8096 15.9108 37.1168 15.9053Z" fill="black"/>
-<path opacity="0.2" d="M35.4424 17.5796H16.7441V59.4401H35.4424C37.1352 59.4345 38.5061 58.0636 38.5116 56.3709V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.5" d="M35.4424 17.5796H16.7441V56.0912H35.4424C37.1352 56.0857 38.5061 54.7148 38.5116 53.022V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.5" d="M33.768 17.5796H16.7441V56.0912H33.7679C35.4607 56.0857 36.8316 54.7148 36.8372 53.022V20.6488C36.8317 18.956 35.4607 17.5851 33.768 17.5796Z" fill="black"/>
-<path d="M3.06922 17.5796H33.768C35.4631 17.5796 36.8372 18.9537 36.8372 20.6488V51.3476C36.8372 53.0427 35.4631 54.4168 33.768 54.4168H3.06922C1.37414 54.4168 0 53.0427 0 51.3476V20.6488C0 18.9537 1.37414 17.5796 3.06922 17.5796Z" fill="url(#paint0_linear_8803_4754)"/>
-<path d="M10.0898 26.022H14.2508L22.427 39.2499C22.7987 39.8426 23.0778 40.3198 23.2642 40.6815H23.3178C23.2166 39.7811 23.1764 38.8748 23.1972 37.9689V26.022H26.747V45.9743H22.8522L14.3696 32.3797C14.0823 31.9312 13.8293 31.4616 13.6128 30.9749H13.5458C13.6313 31.9649 13.6665 32.9585 13.6513 33.952V45.9743H10.0898V26.022Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_8803_4754" x1="6.39937" y1="15.1814" x2="30.4378" y2="56.815" gradientUnits="userSpaceOnUse">
-<stop stop-color="#8324B3"/>
-<stop offset="0.5" stop-color="#7A1BAC"/>
-<stop offset="1" stop-color="#621197"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ca64ea" d="M55.256 69.487H19.81a3.066 3.066 0 0 1-3.066-3.066V5.576A3.066 3.066 0 0 1 19.81 2.51h49.124A3.066 3.066 0 0 1 72 5.576v13.678z"/><path fill="#ae4bd5" d="m72 35.998-8.372 5.023-8.372-5.023V19.254H72z"/><path fill="#9332bf" d="m72 52.742-8.372 5.024-8.372-5.024V35.998H72z"/><path fill="#7719aa" d="M55.256 52.742H72v13.605a3.14 3.14 0 0 1-3.14 3.14H55.257z"/><path fill="#000" d="M37.117 15.905H16.744v41.86h20.373a3.08 3.08 0 0 0 3.069-3.068V18.974a3.08 3.08 0 0 0-3.07-3.069" opacity=".2"/><path fill="#000" d="M35.442 17.58H16.744v41.86h18.698a3.08 3.08 0 0 0 3.07-3.07V20.65a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="#000" d="M35.442 17.58H16.744v38.51h18.698a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".5"/><path fill="#000" d="M33.768 17.58H16.744v38.51h17.024a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".5"/><path fill="url(#paint0_linear_8803_4754)" d="M3.07 17.58h30.698a3.07 3.07 0 0 1 3.07 3.069v30.699a3.07 3.07 0 0 1-3.07 3.069H3.069A3.07 3.07 0 0 1 0 51.347V20.65a3.07 3.07 0 0 1 3.07-3.07"/><path fill="#fff" d="M10.09 26.022h4.16l8.177 13.228q.557.89.837 1.431h.054q-.152-1.351-.12-2.712V26.022h3.549v19.952h-3.895L14.37 32.38q-.432-.674-.757-1.405h-.067q.128 1.486.105 2.977v12.022H10.09z"/><defs><linearGradient id="paint0_linear_8803_4754" x1="6.399" x2="30.438" y1="15.181" y2="56.815" gradientUnits="userSpaceOnUse"><stop stop-color="#8324b3"/><stop offset=".5" stop-color="#7a1bac"/><stop offset="1" stop-color="#621197"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftoutlook.svg b/web/packages/design/src/ResourceIcon/assets/microsoftoutlook.svg
index 2138f5af4b4f9..8c90f671cd3f6 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftoutlook.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftoutlook.svg
@@ -1,39 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4756)">
-<path d="M72.0001 37.6725C72.004 37.1096 71.7131 36.5856 71.2332 36.2912H71.2248L71.1947 36.2744L46.2458 21.5061C46.1381 21.4333 46.0263 21.3667 45.9109 21.3068C44.9477 20.8098 43.8034 20.8098 42.8401 21.3068C42.7247 21.3668 42.6129 21.4333 42.5052 21.5061L17.5564 36.2744L17.5263 36.2912C16.7638 36.7653 16.53 37.7679 17.0042 38.5304C17.1439 38.7551 17.3363 38.9423 17.5648 39.0757L42.5136 53.8441C42.6217 53.9162 42.7335 53.9828 42.8485 54.0434C43.8118 54.5403 44.9561 54.5403 45.9194 54.0434C46.0344 53.9828 46.1462 53.9163 46.2543 53.8441L71.2031 39.0757C71.7015 38.7851 72.0058 38.2495 72.0001 37.6725Z" fill="#0A2767"/>
-<path d="M20.4643 27.8119H36.8368V42.8197H20.4643V27.8119ZM68.6507 12.5563V5.69114C68.6901 3.97471 67.3314 2.5509 65.615 2.50977H23.1284C21.4119 2.5509 20.0533 3.97471 20.0926 5.69114V12.5563L45.2089 19.2539L68.6507 12.5563Z" fill="#0364B8"/>
-<path d="M20.0928 12.5562H36.8369V27.6259H20.0928V12.5562Z" fill="#0078D4"/>
-<path d="M53.5811 12.5562H36.8369V27.6259L53.5811 42.6957H68.6509V27.6259L53.5811 12.5562Z" fill="#28A8EA"/>
-<path d="M36.8369 27.626H53.5811V42.6957H36.8369V27.626Z" fill="#0078D4"/>
-<path d="M36.8369 42.6958H53.5811V57.7656H36.8369V42.6958Z" fill="#0364B8"/>
-<path d="M20.4648 42.8198H36.8373V56.463H20.4648V42.8198Z" fill="#14447D"/>
-<path d="M53.5811 42.6958H68.6508V57.7656H53.5811V42.6958Z" fill="#0078D4"/>
-<path d="M71.233 38.9834L71.2012 39.0002L46.2524 53.0318C46.1436 53.0988 46.0331 53.1624 45.9175 53.2193C45.4937 53.4211 45.0335 53.535 44.5646 53.5542L43.2016 52.7572C43.0864 52.6994 42.9746 52.6351 42.8667 52.5646L17.583 38.1345H17.5713L16.7441 37.6724V66.0772C16.757 67.9723 18.3033 69.4983 20.1984 69.4863H68.5992C68.6276 69.4863 68.6527 69.4729 68.6829 69.4729C69.0832 69.4473 69.4778 69.365 69.8549 69.2284C70.0179 69.1594 70.1753 69.0776 70.3255 68.984C70.4376 68.9204 70.6302 68.7814 70.6302 68.7814C71.4879 68.1467 71.9957 67.1443 71.9999 66.0772V37.6724C71.9993 38.2157 71.7063 38.7166 71.233 38.9834Z" fill="url(#paint0_linear_8803_4756)"/>
-<path opacity="0.5" d="M70.66 37.5602V39.3016L44.5726 57.2631L17.5642 38.1463C17.5642 38.137 17.5567 38.1295 17.5475 38.1295L15.0693 36.6393V35.3835L16.0907 35.3667L18.2507 36.6058L18.3009 36.6225L18.4851 36.7397C18.4851 36.7397 43.8693 51.2235 43.9363 51.2569L44.9074 51.8262C44.9911 51.7927 45.0748 51.7592 45.1753 51.7257C45.2256 51.6922 70.3753 37.5434 70.3753 37.5434L70.66 37.5602Z" fill="#0A2767"/>
-<path d="M71.233 38.9834L71.2012 39.0018L46.2524 53.0334C46.1435 53.1004 46.033 53.164 45.9175 53.221C44.9485 53.6943 43.8155 53.6943 42.8466 53.221C42.7318 53.1641 42.6201 53.1016 42.5117 53.0334L17.5629 39.0018L17.5328 38.9834C17.0511 38.7223 16.7491 38.2203 16.7441 37.6724V66.0772C16.7561 67.972 18.3019 69.4983 20.1966 69.4863C20.1966 69.4863 20.1967 69.4863 20.1968 69.4863H68.5472C70.442 69.4984 71.9878 67.9721 71.9999 66.0773C71.9999 66.0773 71.9999 66.0773 71.9999 66.0772V37.6724C71.9993 38.2157 71.7063 38.7166 71.233 38.9834Z" fill="#1490DF"/>
-<path opacity="0.1" d="M46.6162 52.8257L46.2428 53.035C46.1346 53.1039 46.0228 53.1671 45.9079 53.2242C45.4965 53.4261 45.0492 53.5445 44.5918 53.5725L54.0841 64.7978L70.6424 68.7879C71.0961 68.4452 71.457 67.9945 71.6923 67.4768L46.6162 52.8257Z" fill="black"/>
-<path opacity="0.05" d="M48.3073 51.875L46.2428 53.0354C46.1346 53.1043 46.0228 53.1674 45.9079 53.2246C45.4965 53.4265 45.0492 53.5449 44.5918 53.5728L49.039 65.8346L70.6474 68.7832C71.4987 68.1441 71.9998 67.1419 72.0003 66.0774V65.7107L48.3073 51.875Z" fill="black"/>
-<path d="M20.2437 69.4863H68.5422C69.2854 69.4901 70.0103 69.2553 70.6101 68.8165L43.1999 52.7606C43.0847 52.7028 42.9729 52.6385 42.865 52.568L17.5813 38.1378H17.5696L16.7441 37.6724V65.9801C16.7423 67.9147 18.309 69.4844 20.2437 69.4863V69.4863Z" fill="#28A8EA"/>
-<path opacity="0.1" d="M40.186 18.9745V54.6898C40.183 55.942 39.4216 57.0676 38.2604 57.5363C37.9007 57.6909 37.5133 57.7707 37.1218 57.7708H16.7441V17.5797H20.093V15.9053H37.1218C38.8134 15.9117 40.1823 17.2829 40.186 18.9745Z" fill="black"/>
-<path opacity="0.2" d="M38.5116 20.6489V56.3642C38.5158 56.7687 38.43 57.1691 38.2604 57.5363C37.7954 58.6825 36.6843 59.4344 35.4474 59.4401H16.7441V17.5797H35.4474C35.9332 17.5749 36.412 17.696 36.8371 17.9314C37.8636 18.4485 38.5112 19.4996 38.5116 20.6489Z" fill="black"/>
-<path opacity="0.2" d="M38.5116 20.6489V53.0154C38.5034 54.7062 37.1382 56.0767 35.4474 56.0913H16.7441V17.5797H35.4474C35.9332 17.5749 36.412 17.696 36.8371 17.9314C37.8636 18.4485 38.5112 19.4996 38.5116 20.6489Z" fill="black"/>
-<path opacity="0.2" d="M36.8371 20.6488V53.0153C36.8353 54.7087 35.4664 56.0829 33.773 56.0912H16.7441V17.5796H33.7729C35.4662 17.5805 36.8381 18.9539 36.8371 20.6471C36.8371 20.6477 36.8371 20.6482 36.8371 20.6488Z" fill="black"/>
-<path d="M3.0692 17.5796H33.768C35.4631 17.5796 36.8372 18.9537 36.8372 20.6488V51.3476C36.8372 53.0426 35.4631 54.4168 33.768 54.4168H3.0692C1.37411 54.4168 0 53.0426 0 51.3476V20.6488C0 18.9537 1.37415 17.5796 3.0692 17.5796Z" fill="url(#paint1_linear_8803_4756)"/>
-<path d="M9.59289 30.4525C10.3493 28.8408 11.5703 27.4921 13.0991 26.5796C14.7922 25.6103 16.7199 25.1271 18.6699 25.1831C20.4773 25.1439 22.2608 25.6021 23.8255 26.5075C25.2966 27.3849 26.4815 28.6703 27.2362 30.208C28.0582 31.9023 28.4678 33.767 28.4318 35.6499C28.4716 37.6176 28.0501 39.5673 27.2011 41.3429C26.4284 42.9355 25.2059 44.2668 23.6848 45.1722C22.0598 46.1055 20.2101 46.5757 18.3367 46.5319C16.4907 46.5764 14.668 46.1131 13.0673 45.1923C11.5834 44.3139 10.3837 43.0269 9.61133 41.4852C8.78449 39.8153 8.36997 37.9716 8.40241 36.1086C8.36796 34.1576 8.77494 32.2241 9.59289 30.4525ZM13.3302 39.5445C13.7335 40.5634 14.4175 41.4471 15.3026 42.093C16.2043 42.7232 17.2839 43.0483 18.3836 43.0206C19.5547 43.067 20.709 42.7308 21.6721 42.0629C22.5461 41.419 23.2121 40.5329 23.5876 39.5144C24.0075 38.3769 24.2147 37.172 24.1988 35.9596C24.2118 34.7357 24.017 33.5184 23.6228 32.3596C23.2746 31.3134 22.6301 30.3909 21.7676 29.704C20.8286 29.0045 19.6773 28.6497 18.5075 28.6994C17.384 28.6703 16.2802 28.9979 15.3545 29.6354C14.4544 30.284 13.7574 31.1755 13.3452 32.2056C12.4308 34.5668 12.4261 37.1834 13.3318 39.5479L13.3302 39.5445Z" fill="white"/>
-<path d="M53.5811 12.5562H68.6508V27.6259H53.5811V12.5562Z" fill="#50D9FF"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_8803_4756" x1="44.372" y1="37.6724" x2="44.372" y2="69.4864" gradientUnits="userSpaceOnUse">
-<stop stop-color="#35B8F1"/>
-<stop offset="1" stop-color="#28A8EA"/>
-</linearGradient>
-<linearGradient id="paint1_linear_8803_4756" x1="6.39936" y1="15.1814" x2="30.4378" y2="56.815" gradientUnits="userSpaceOnUse">
-<stop stop-color="#1784D9"/>
-<stop offset="0.5" stop-color="#107AD5"/>
-<stop offset="1" stop-color="#0A63C9"/>
-</linearGradient>
-<clipPath id="clip0_8803_4756">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4756)"><path fill="#0a2767" d="M72 37.673a1.61 1.61 0 0 0-.767-1.382h-.008l-.03-.017-24.95-14.768a3.35 3.35 0 0 0-3.74 0L17.556 36.274l-.03.017a1.626 1.626 0 0 0 .039 2.785l24.949 14.768q.162.108.334.2a3.35 3.35 0 0 0 3.406-.2l24.95-14.768c.498-.29.802-.827.796-1.404"/><path fill="#0364b8" d="M20.464 27.812h16.373V42.82H20.464zm48.187-15.256V5.691a3.11 3.11 0 0 0-3.036-3.181H23.128a3.11 3.11 0 0 0-3.035 3.181v6.865l25.116 6.698z"/><path fill="#0078d4" d="M20.093 12.556h16.744v15.07H20.093z"/><path fill="#28a8ea" d="M53.581 12.556H36.837v15.07l16.744 15.07h15.07v-15.07z"/><path fill="#0078d4" d="M36.837 27.626H53.58v15.07H36.837z"/><path fill="#0364b8" d="M36.837 42.696H53.58v15.07H36.837z"/><path fill="#14447d" d="M20.465 42.82h16.372v13.643H20.465z"/><path fill="#0078d4" d="M53.581 42.696h15.07v15.07H53.58z"/><path fill="url(#paint0_linear_8803_4756)" d="m71.233 38.983-.032.017-24.949 14.032q-.161.101-.335.187a3.5 3.5 0 0 1-1.352.335l-1.363-.797a3 3 0 0 1-.335-.192l-25.284-14.43h-.012l-.827-.463v28.405a3.433 3.433 0 0 0 3.454 3.41H68.6c.029 0 .054-.014.084-.014.4-.026.795-.108 1.172-.245q.245-.103.47-.244c.113-.064.305-.203.305-.203A3.38 3.38 0 0 0 72 66.077V37.672c0 .544-.294 1.045-.767 1.311"/><path fill="#0a2767" d="M70.66 37.56v1.742L44.573 57.263 17.564 38.146a.02.02 0 0 0-.017-.017l-2.478-1.49v-1.256l1.022-.016 2.16 1.239.05.017.184.117S43.87 51.224 43.936 51.257l.971.57c.084-.034.168-.068.268-.101.05-.034 25.2-14.183 25.2-14.183z" opacity=".5"/><path fill="#1490df" d="m71.233 38.983-.032.019-24.949 14.031q-.161.102-.335.188a3.5 3.5 0 0 1-3.405-.188l-24.95-14.031-.03-.019a1.51 1.51 0 0 1-.788-1.31v28.404a3.43 3.43 0 0 0 3.453 3.41h48.35A3.43 3.43 0 0 0 72 66.076V37.672c0 .544-.294 1.045-.767 1.311"/><path fill="#000" d="m46.616 52.826-.373.209q-.162.103-.335.19a3.5 3.5 0 0 1-1.316.347l9.492 11.226 16.558 3.99a3.4 3.4 0 0 0 1.05-1.311z" opacity=".1"/><path fill="#000" d="m48.307 51.875-2.064 1.16a3.5 3.5 0 0 1-1.651.537l4.447 12.263 21.608 2.948A3.39 3.39 0 0 0 72 66.077v-.366z" opacity=".05"/><path fill="#28a8ea" d="M20.244 69.486h48.298a3.47 3.47 0 0 0 2.068-.67L43.2 52.762a3 3 0 0 1-.335-.193l-25.284-14.43h-.011l-.826-.466V65.98a3.503 3.503 0 0 0 3.5 3.506"/><path fill="#000" d="M40.186 18.975V54.69a3.08 3.08 0 0 1-1.926 2.846c-.36.155-.747.235-1.138.235H16.744V17.58h3.349v-1.675h17.029a3.076 3.076 0 0 1 3.064 3.07" opacity=".1"/><path fill="#000" d="M38.512 20.649v35.715c.004.405-.082.805-.252 1.172a3.05 3.05 0 0 1-2.813 1.904H16.744V17.58h18.703c.486-.005.965.116 1.39.351a3.04 3.04 0 0 1 1.675 2.718" opacity=".2"/><path fill="#000" d="M38.512 20.649v32.366a3.09 3.09 0 0 1-3.065 3.076H16.744V17.58h18.703c.486-.005.965.116 1.39.351a3.04 3.04 0 0 1 1.675 2.718" opacity=".2"/><path fill="#000" d="M36.837 20.649v32.366a3.08 3.08 0 0 1-3.064 3.076H16.744V17.58h17.029a3.066 3.066 0 0 1 3.064 3.067z" opacity=".2"/><path fill="url(#paint1_linear_8803_4756)" d="M3.07 17.58h30.698a3.07 3.07 0 0 1 3.07 3.069v30.699a3.07 3.07 0 0 1-3.07 3.069H3.069A3.07 3.07 0 0 1 0 51.347V20.65a3.07 3.07 0 0 1 3.07-3.07"/><path fill="#fff" d="M9.593 30.453a8.93 8.93 0 0 1 3.506-3.873 10.6 10.6 0 0 1 5.57-1.397 9.87 9.87 0 0 1 5.157 1.325 8.85 8.85 0 0 1 3.41 3.7 11.94 11.94 0 0 1 1.196 5.442 12.6 12.6 0 0 1-1.23 5.693 9.06 9.06 0 0 1-3.517 3.83 10.26 10.26 0 0 1-5.348 1.359 10.1 10.1 0 0 1-5.27-1.34 9 9 0 0 1-3.456-3.707 11.66 11.66 0 0 1-1.209-5.376 12.95 12.95 0 0 1 1.19-5.657m3.737 9.092a5.8 5.8 0 0 0 1.973 2.548c.901.63 1.98.955 3.08.928a5.4 5.4 0 0 0 3.29-.958 5.55 5.55 0 0 0 1.915-2.549 9.9 9.9 0 0 0 .61-3.554 10.8 10.8 0 0 0-.575-3.6 5.7 5.7 0 0 0-1.855-2.656 5.1 5.1 0 0 0-3.26-1.005 5.3 5.3 0 0 0-3.153.936 5.84 5.84 0 0 0-2.01 2.57 10.2 10.2 0 0 0-.013 7.343z"/><path fill="#50d9ff" d="M53.581 12.556h15.07v15.07H53.58z"/></g><defs><linearGradient id="paint0_linear_8803_4756" x1="44.372" x2="44.372" y1="37.672" y2="69.486" gradientUnits="userSpaceOnUse"><stop stop-color="#35b8f1"/><stop offset="1" stop-color="#28a8ea"/></linearGradient><linearGradient id="paint1_linear_8803_4756" x1="6.399" x2="30.438" y1="15.181" y2="56.815" gradientUnits="userSpaceOnUse"><stop stop-color="#1784d9"/><stop offset=".5" stop-color="#107ad5"/><stop offset="1" stop-color="#0a63c9"/></linearGradient><clipPath id="clip0_8803_4756"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftpowerpoint.svg b/web/packages/design/src/ResourceIcon/assets/microsoftpowerpoint.svg
index c77f97c3977a9..5ec3fff18c743 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftpowerpoint.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftpowerpoint.svg
@@ -1,23 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4755)">
-<path d="M43.5351 39.347L38.5118 2.50977H38.1367C19.8709 2.56309 5.07676 17.3572 5.02344 35.623V35.9981L43.5351 39.347Z" fill="#ED6C47"/>
-<path d="M38.8868 2.50977H38.5117V35.9981L55.2559 42.6958L72.0001 35.9981V35.6231C71.9468 17.3572 57.1526 2.56309 38.8868 2.50977Z" fill="#FF8F6B"/>
-<path d="M72.0002 35.998V36.3664C71.9478 54.6363 57.1501 69.434 38.8802 69.4864H38.1434C19.8735 69.434 5.07586 54.6363 5.02344 36.3664V35.998H72.0002Z" fill="#D35230"/>
-<path opacity="0.1" d="M40.1863 18.9695V54.7016C40.1779 55.9432 39.4255 57.0586 38.2774 57.5313C37.9119 57.6859 37.519 57.7657 37.1221 57.7657H12.9267C12.4579 57.2299 12.0058 56.6606 11.5872 56.0913C7.32127 50.4006 5.01793 43.4788 5.02348 36.3667V35.6299C5.01369 29.2149 6.88851 22.9384 10.4151 17.5797C10.7835 17.0104 11.1686 16.4411 11.5872 15.9053H37.1221C38.8091 15.9181 40.1735 17.2825 40.1863 18.9695Z" fill="black"/>
-<path opacity="0.2" d="M38.5119 20.6438V56.3759C38.5118 56.7728 38.4321 57.1657 38.2775 57.5312C37.8047 58.6793 36.6893 59.4317 35.4477 59.4401H14.4505C13.9207 58.9022 13.4124 58.3436 12.9267 57.7656C12.4579 57.2298 12.0058 56.6605 11.5872 56.0912C7.32127 50.4005 5.01793 43.4787 5.02348 36.3666V35.6298C5.01369 29.2148 6.88851 22.9383 10.4151 17.5796H35.4477C37.1347 17.5923 38.4991 18.9568 38.5119 20.6438Z" fill="black"/>
-<path opacity="0.2" d="M38.5118 20.6438V53.027C38.4991 54.714 37.1347 56.0784 35.4477 56.0912H11.5872C7.32127 50.4005 5.01793 43.4787 5.02348 36.3666V35.6298C5.01369 29.2148 6.88851 22.9383 10.4151 17.5796H35.4476C37.1347 17.5923 38.4991 18.9567 38.5118 20.6438Z" fill="black"/>
-<path opacity="0.2" d="M36.8374 20.6438V53.027C36.8247 54.714 35.4602 56.0784 33.7733 56.0912H11.5872C7.32127 50.4005 5.01793 43.4787 5.02348 36.3666V35.6298C5.01369 29.2148 6.88851 22.9383 10.4151 17.5796H33.7732C35.4602 17.5923 36.8247 18.9567 36.8374 20.6438Z" fill="black"/>
-<path d="M3.06919 17.5796H33.768C35.4631 17.5796 36.8372 18.9537 36.8372 20.6488V51.3476C36.8372 53.0427 35.463 54.4168 33.768 54.4168H3.06919C1.37415 54.4168 0 53.0427 0 51.3476V20.6488C0 18.9537 1.37415 17.5796 3.06919 17.5796Z" fill="url(#paint0_linear_8803_4755)"/>
-<path d="M18.7533 25.7657C20.7517 25.6309 22.7329 26.2114 24.3426 27.4033C25.6851 28.6019 26.4024 30.3509 26.2882 32.1469C26.3102 33.3955 25.9774 34.6247 25.3288 35.6917C24.6721 36.7404 23.7259 37.5766 22.6045 38.0995C21.3225 38.6958 19.9208 38.9902 18.5072 38.9602H14.6242V46.1769H10.6475V25.7657H18.7533ZM14.6209 35.8424H18.0434C19.1284 35.9221 20.205 35.601 21.0691 34.9399C21.7838 34.2543 22.1584 33.2875 22.0922 32.2993C22.0922 30.05 20.785 28.9254 18.1707 28.9254H14.6209V35.8424H14.6209Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_8803_4755" x1="6.39937" y1="15.1814" x2="30.4378" y2="56.815" gradientUnits="userSpaceOnUse">
-<stop stop-color="#CA4C28"/>
-<stop offset="0.5" stop-color="#C5401E"/>
-<stop offset="1" stop-color="#B62F14"/>
-</linearGradient>
-<clipPath id="clip0_8803_4755">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4755)"><path fill="#ed6c47" d="M43.535 39.347 38.512 2.51h-.375C19.87 2.563 5.077 17.357 5.023 35.623v.375z"/><path fill="#ff8f6b" d="M38.887 2.51h-.375v33.488l16.744 6.698L72 35.998v-.375C71.947 17.357 57.153 2.563 38.887 2.51"/><path fill="#d35230" d="M72 35.998v.368c-.052 18.27-14.85 33.068-33.12 33.12h-.737c-18.27-.052-33.067-14.85-33.12-33.12v-.368z"/><path fill="#000" d="M40.186 18.97v35.732a3.08 3.08 0 0 1-1.909 2.83 3 3 0 0 1-1.155.234H12.927a26 26 0 0 1-1.34-1.675 32.84 32.84 0 0 1-6.564-19.724v-.737a32.74 32.74 0 0 1 5.392-18.05 23 23 0 0 1 1.172-1.675h25.535a3.09 3.09 0 0 1 3.064 3.065" opacity=".1"/><path fill="#000" d="M38.512 20.644v35.732c0 .397-.08.79-.234 1.155a3.08 3.08 0 0 1-2.83 1.91H14.45a29 29 0 0 1-1.523-1.675 26 26 0 0 1-1.34-1.675 32.84 32.84 0 0 1-6.564-19.724v-.737a32.74 32.74 0 0 1 5.392-18.05h25.033a3.09 3.09 0 0 1 3.064 3.064" opacity=".2"/><path fill="#000" d="M38.512 20.644v32.383a3.09 3.09 0 0 1-3.064 3.064h-23.86a32.84 32.84 0 0 1-6.565-19.724v-.737a32.74 32.74 0 0 1 5.392-18.05h25.033a3.087 3.087 0 0 1 3.064 3.064" opacity=".2"/><path fill="#000" d="M36.837 20.644v32.383a3.09 3.09 0 0 1-3.064 3.064H11.587a32.84 32.84 0 0 1-6.564-19.724v-.737a32.74 32.74 0 0 1 5.392-18.05h23.358a3.087 3.087 0 0 1 3.064 3.064" opacity=".2"/><path fill="url(#paint0_linear_8803_4755)" d="M3.07 17.58h30.698a3.07 3.07 0 0 1 3.07 3.069v30.699a3.07 3.07 0 0 1-3.07 3.069H3.069A3.07 3.07 0 0 1 0 51.347V20.65a3.07 3.07 0 0 1 3.07-3.07"/><path fill="#fff" d="M18.753 25.766a8.44 8.44 0 0 1 5.59 1.637 5.86 5.86 0 0 1 1.945 4.744 6.6 6.6 0 0 1-.96 3.545 6.4 6.4 0 0 1-2.723 2.407 9.25 9.25 0 0 1-4.098.861h-3.883v7.217h-3.976V25.766zm-4.132 10.076h3.422a4.44 4.44 0 0 0 3.026-.902 3.35 3.35 0 0 0 1.023-2.64q0-3.375-3.921-3.375h-3.55z"/></g><defs><linearGradient id="paint0_linear_8803_4755" x1="6.399" x2="30.438" y1="15.181" y2="56.815" gradientUnits="userSpaceOnUse"><stop stop-color="#ca4c28"/><stop offset=".5" stop-color="#c5401e"/><stop offset="1" stop-color="#b62f14"/></linearGradient><clipPath id="clip0_8803_4755"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftteams.svg b/web/packages/design/src/ResourceIcon/assets/microsoftteams.svg
index 45bfe2d2ba9ee..b33ba72ffcbd3 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftteams.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftteams.svg
@@ -1,23 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M50.2213 27.147H68.8191C70.5761 27.147 72.0005 28.5731 72.0005 30.3323V47.2931C72.0005 53.7586 66.7656 58.9999 60.308 58.9999H60.2527C53.7952 59.0008 48.5595 53.7603 48.5586 47.2948C48.5586 47.2942 48.5586 47.2937 48.5586 47.2931V28.8117C48.5586 27.8923 49.303 27.147 50.2213 27.147Z" fill="#5059C9"/>
-<path d="M62.7907 23.7943C66.9521 23.7943 70.3256 20.4167 70.3256 16.2502C70.3256 12.0837 66.9521 8.70605 62.7907 8.70605C58.6293 8.70605 55.2559 12.0837 55.2559 16.2502C55.2559 20.4167 58.6293 23.7943 62.7907 23.7943Z" fill="#5059C9"/>
-<path d="M39.3486 23.7941C45.3595 23.7941 50.2323 18.9154 50.2323 12.8971C50.2323 6.87878 45.3595 2 39.3486 2C33.3377 2 28.4648 6.87878 28.4648 12.8971C28.4648 18.9154 33.3377 23.7941 39.3486 23.7941Z" fill="#7B83EB"/>
-<path d="M53.8611 27.147H23.1623C21.4262 27.19 20.0528 28.6325 20.0931 30.3708V49.7156C19.8507 60.147 28.0934 68.8035 38.5117 69.0588C48.9301 68.8035 57.1728 60.147 56.9303 49.7156V30.3708C56.9706 28.6325 55.5972 27.19 53.8611 27.147Z" fill="#7B83EB"/>
-<path opacity="0.1" d="M40.1857 27.147V54.2555C40.1774 55.4986 39.425 56.6154 38.2769 57.0887C37.9113 57.2436 37.5184 57.3234 37.1215 57.3234H21.5662C21.3485 56.7702 21.1476 56.217 20.9801 55.647C20.394 53.7233 20.0949 51.7235 20.0927 49.7123V30.3658C20.0524 28.6303 21.4235 27.19 23.1568 27.147H40.1857Z" fill="black"/>
-<path opacity="0.2" d="M38.5113 27.147V55.932C38.5112 56.3294 38.4315 56.7227 38.2769 57.0887C37.8041 58.2383 36.6887 58.9916 35.4471 58.9999H22.3532C22.0685 58.4467 21.8006 57.8934 21.5662 57.3234C21.3317 56.7535 21.1476 56.217 20.9801 55.647C20.394 53.7233 20.0949 51.7235 20.0927 49.7123V30.3658C20.0524 28.6303 21.4235 27.19 23.1568 27.147H38.5113Z" fill="black"/>
-<path opacity="0.2" d="M38.5113 27.147V52.579C38.4985 54.2681 37.1341 55.6342 35.4471 55.647H20.9801C20.394 53.7233 20.0949 51.7235 20.0927 49.7123V30.3658C20.0524 28.6303 21.4235 27.19 23.1568 27.147H38.5113Z" fill="black"/>
-<path opacity="0.2" d="M36.8368 27.147V52.579C36.8241 54.2681 35.4597 55.6342 33.7727 55.647H20.9801C20.394 53.7233 20.0949 51.7235 20.0927 49.7123V30.3658C20.0524 28.6303 21.4235 27.19 23.1568 27.147H36.8368Z" fill="black"/>
-<path opacity="0.1" d="M40.1862 18.48V23.7609C39.9015 23.7777 39.6336 23.7944 39.3489 23.7944C39.0643 23.7944 38.7964 23.7777 38.5117 23.7609C37.9465 23.7234 37.386 23.6336 36.8373 23.4927C33.4466 22.6887 30.6453 20.3078 29.3024 17.0886C29.0714 16.5479 28.892 15.9866 28.7666 15.4121H37.1219C38.8116 15.4185 40.1797 16.7883 40.1862 18.48Z" fill="black"/>
-<path opacity="0.2" d="M38.512 20.1563V23.7607C37.9468 23.7232 37.3863 23.6334 36.8376 23.4925C33.4469 22.6885 30.6456 20.3077 29.3027 17.0884H35.4478C37.1375 17.0948 38.5056 18.4646 38.512 20.1563Z" fill="black"/>
-<path opacity="0.2" d="M38.512 20.1563V23.7607C37.9468 23.7232 37.3863 23.6334 36.8376 23.4925C33.4469 22.6885 30.6456 20.3077 29.3027 17.0884H35.4478C37.1375 17.0948 38.5056 18.4646 38.512 20.1563Z" fill="black"/>
-<path opacity="0.2" d="M36.8376 20.1558V23.492C33.4469 22.688 30.6456 20.3072 29.3027 17.0879H33.7734C35.4631 17.0943 36.8312 18.4641 36.8376 20.1558Z" fill="black"/>
-<path d="M3.06919 17.0879H33.768C35.4631 17.0879 36.8372 18.4637 36.8372 20.1608V50.8973C36.8372 52.5944 35.463 53.9702 33.768 53.9702H3.06919C1.37411 53.9702 0 52.5944 0 50.8973V20.1608C0 18.4637 1.37414 17.0879 3.06919 17.0879Z" fill="url(#paint0_linear_6211_26694)"/>
-<path d="M26.4966 28.7867H20.3598V45.5178H16.4501V28.7867H10.3418V25.541H26.4966V28.7867Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_6211_26694" x1="6.39937" y1="14.6867" x2="30.482" y2="56.3459" gradientUnits="userSpaceOnUse">
-<stop stop-color="#5A62C3"/>
-<stop offset="0.5" stop-color="#4D55BD"/>
-<stop offset="1" stop-color="#3940AB"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#5059c9" d="M50.221 27.147H68.82a3.183 3.183 0 0 1 3.182 3.185v16.961C72 53.76 66.766 59 60.308 59h-.055c-6.458 0-11.693-5.24-11.694-11.705V28.812c0-.92.744-1.665 1.662-1.665m12.569-3.353c4.162 0 7.536-3.377 7.536-7.544s-3.374-7.544-7.535-7.544c-4.162 0-7.535 3.378-7.535 7.544 0 4.167 3.373 7.544 7.535 7.544"/><path fill="#7b83eb" d="M39.349 23.794c6.01 0 10.883-4.879 10.883-10.897S45.36 2 39.35 2c-6.011 0-10.884 4.879-10.884 10.897s4.873 10.897 10.884 10.897m14.511 3.353H23.162a3.15 3.15 0 0 0-3.069 3.224v19.345c-.242 10.431 8 19.088 18.419 19.343 10.418-.255 18.66-8.912 18.418-19.343V30.37a3.15 3.15 0 0 0-3.069-3.224"/><path fill="#000" d="M40.186 27.147v27.109a3.09 3.09 0 0 1-1.91 2.833 3 3 0 0 1-1.155.234H21.566a20 20 0 0 1-.586-1.676 20.4 20.4 0 0 1-.887-5.935V30.366a3.145 3.145 0 0 1 3.064-3.219z" opacity=".1"/><path fill="#000" d="M38.511 27.147v28.785c0 .397-.08.79-.234 1.157a3.08 3.08 0 0 1-2.83 1.91H22.353a22 22 0 0 1-.787-1.676 17 17 0 0 1-.586-1.676 20.4 20.4 0 0 1-.887-5.935V30.366a3.145 3.145 0 0 1 3.064-3.219z" opacity=".2"/><path fill="#000" d="M38.511 27.147v25.432a3.09 3.09 0 0 1-3.064 3.068H20.98a20.4 20.4 0 0 1-.887-5.935V30.366a3.145 3.145 0 0 1 3.064-3.219z" opacity=".2"/><path fill="#000" d="M36.837 27.147v25.432a3.09 3.09 0 0 1-3.064 3.068H20.98a20.4 20.4 0 0 1-.887-5.935V30.366a3.145 3.145 0 0 1 3.064-3.219z" opacity=".2"/><path fill="#000" d="M40.186 18.48v5.28c-.285.018-.552.034-.837.034s-.553-.016-.837-.033a9 9 0 0 1-1.675-.268 10.89 10.89 0 0 1-7.535-6.404 9.3 9.3 0 0 1-.535-1.677h8.355a3.08 3.08 0 0 1 3.064 3.068" opacity=".1"/><path fill="#000" d="M38.512 20.156v3.605a9 9 0 0 1-1.674-.268 10.89 10.89 0 0 1-7.535-6.405h6.145a3.08 3.08 0 0 1 3.064 3.068" opacity=".2"/><path fill="#000" d="M38.512 20.156v3.605a9 9 0 0 1-1.674-.268 10.89 10.89 0 0 1-7.535-6.405h6.145a3.08 3.08 0 0 1 3.064 3.068" opacity=".2"/><path fill="#000" d="M36.838 20.156v3.336a10.89 10.89 0 0 1-7.535-6.404h4.47a3.08 3.08 0 0 1 3.065 3.068" opacity=".2"/><path fill="url(#paint0_linear_6211_26694)" d="M3.07 17.088h30.698a3.07 3.07 0 0 1 3.07 3.073v30.736a3.07 3.07 0 0 1-3.07 3.073H3.069A3.07 3.07 0 0 1 0 50.897V20.161a3.07 3.07 0 0 1 3.07-3.073"/><path fill="#fff" d="M26.497 28.787H20.36v16.73h-3.91v-16.73h-6.108V25.54h16.155z"/><defs><linearGradient id="paint0_linear_6211_26694" x1="6.399" x2="30.482" y1="14.687" y2="56.346" gradientUnits="userSpaceOnUse"><stop stop-color="#5a62c3"/><stop offset=".5" stop-color="#4d55bd"/><stop offset="1" stop-color="#3940ab"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/microsoftword.svg b/web/packages/design/src/ResourceIcon/assets/microsoftword.svg
index 344ee760e7692..a2bef1f1e7718 100644
--- a/web/packages/design/src/ResourceIcon/assets/microsoftword.svg
+++ b/web/packages/design/src/ResourceIcon/assets/microsoftword.svg
@@ -1,24 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4753)">
-<path d="M68.9307 2.50977H19.8134C18.1183 2.50977 16.7441 3.8839 16.7441 5.57898V19.254L45.2093 27.626L72 19.254V5.57898C72 3.8839 70.6258 2.50977 68.9307 2.50977Z" fill="#41A5EE"/>
-<path d="M72 19.2539H16.7441V35.9981L45.2093 41.0213L72 35.9981V19.2539Z" fill="#2B7CD3"/>
-<path d="M16.7441 35.998V52.7422L43.5348 56.0911L72 52.7422V35.998H16.7441Z" fill="#185ABD"/>
-<path d="M19.8134 69.4864H68.9308C70.6259 69.4864 72 68.1122 72 66.4172V52.7422H16.7441V66.4172C16.7441 68.1122 18.1183 69.4864 19.8134 69.4864Z" fill="#103F91"/>
-<path opacity="0.1" d="M37.1168 15.9053H16.7441V57.7657H37.1168C38.8096 57.7602 40.1805 56.3893 40.186 54.6965V18.9745C40.1805 17.2817 38.8096 15.9108 37.1168 15.9053Z" fill="black"/>
-<path opacity="0.2" d="M35.4424 17.5796H16.7441V59.4401H35.4424C37.1352 59.4345 38.5061 58.0636 38.5116 56.3708V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.2" d="M35.4424 17.5796H16.7441V56.0912H35.4424C37.1352 56.0857 38.5061 54.7148 38.5116 53.022V20.6488C38.5061 18.956 37.1352 17.5851 35.4424 17.5796Z" fill="black"/>
-<path opacity="0.2" d="M33.7679 17.5796H16.7441V56.0912H33.7679C35.4607 56.0857 36.8317 54.7148 36.8372 53.022V20.6488C36.8317 18.956 35.4607 17.5851 33.7679 17.5796Z" fill="black"/>
-<path d="M3.06922 17.5796H33.768C35.4631 17.5796 36.8372 18.9537 36.8372 20.6488V51.3476C36.8372 53.0427 35.4631 54.4168 33.768 54.4168H3.06922C1.37413 54.4168 0 53.0427 0 51.3476V20.6488C0 18.9537 1.37413 17.5796 3.06922 17.5796Z" fill="url(#paint0_linear_8803_4753)"/>
-<path d="M12.5948 41.1184C12.6551 41.5922 12.6953 42.0042 12.7137 42.3575H12.784C12.8108 42.0226 12.8666 41.619 12.9514 41.1469C13.0363 40.6747 13.1127 40.2756 13.1808 39.9497L16.4091 26.0218H20.5834L23.9323 39.7404C24.1269 40.5934 24.2661 41.4581 24.3492 42.329H24.4045C24.4669 41.4852 24.5833 40.6463 24.7528 39.8174L27.4234 26.0151H31.2227L26.531 45.9742H22.0921L18.9107 32.7563C18.8186 32.3762 18.7131 31.8789 18.5976 31.2678C18.4821 30.6566 18.4101 30.2095 18.3816 29.9282H18.3263C18.2895 30.253 18.2175 30.7353 18.1103 31.3749C18.0031 32.0146 17.9172 32.4878 17.8524 32.7948L14.8619 45.9708H10.3477L5.63086 26.0218H9.49875L12.4072 39.9781C12.4726 40.2644 12.5345 40.6462 12.5948 41.1184Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_8803_4753" x1="6.39937" y1="15.1814" x2="30.4378" y2="56.815" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2368C4"/>
-<stop offset="0.5" stop-color="#1A5DBE"/>
-<stop offset="1" stop-color="#1146AC"/>
-</linearGradient>
-<clipPath id="clip0_8803_4753">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4753)"><path fill="#41a5ee" d="M68.93 2.51H19.814a3.07 3.07 0 0 0-3.069 3.069v13.675l28.465 8.372L72 19.254V5.579a3.07 3.07 0 0 0-3.07-3.07"/><path fill="#2b7cd3" d="M72 19.254H16.744v16.744l28.465 5.023L72 35.998z"/><path fill="#185abd" d="M16.744 35.998v16.744l26.79 3.35L72 52.741V35.998z"/><path fill="#103f91" d="M19.813 69.486h49.118A3.07 3.07 0 0 0 72 66.417V52.742H16.744v13.675a3.07 3.07 0 0 0 3.07 3.07"/><path fill="#000" d="M37.117 15.905H16.744v41.86h20.373a3.08 3.08 0 0 0 3.069-3.068V18.974a3.08 3.08 0 0 0-3.07-3.069" opacity=".1"/><path fill="#000" d="M35.442 17.58H16.744v41.86h18.698a3.08 3.08 0 0 0 3.07-3.07V20.65a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="#000" d="M35.442 17.58H16.744v38.51h18.698a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="#000" d="M33.768 17.58H16.744v38.51h17.024a3.08 3.08 0 0 0 3.07-3.069V20.649a3.08 3.08 0 0 0-3.07-3.07" opacity=".2"/><path fill="url(#paint0_linear_8803_4753)" d="M3.07 17.58h30.698a3.07 3.07 0 0 1 3.07 3.069v30.699a3.07 3.07 0 0 1-3.07 3.069H3.069A3.07 3.07 0 0 1 0 51.347V20.65a3.07 3.07 0 0 1 3.07-3.07"/><path fill="#fff" d="M12.595 41.118q.09.71.119 1.24h.07q.04-.503.167-1.211.128-.708.23-1.197l3.228-13.928h4.174l3.35 13.718q.291 1.281.416 2.589h.055a20 20 0 0 1 .349-2.512l2.67-13.802h3.8l-4.692 19.96h-4.439l-3.181-13.219q-.14-.57-.313-1.488a18 18 0 0 1-.216-1.34h-.056q-.055.487-.216 1.447-.16.96-.258 1.42l-2.99 13.176h-4.514L5.63 26.02h3.868l2.908 13.957q.098.43.188 1.14"/></g><defs><linearGradient id="paint0_linear_8803_4753" x1="6.399" x2="30.438" y1="15.181" y2="56.815" gradientUnits="userSpaceOnUse"><stop stop-color="#2368c4"/><stop offset=".5" stop-color="#1a5dbe"/><stop offset="1" stop-color="#1146ac"/></linearGradient><clipPath id="clip0_8803_4753"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mongo-dark.svg b/web/packages/design/src/ResourceIcon/assets/mongo-dark.svg
index 38938f61bf86f..41e8c475fbe40 100644
--- a/web/packages/design/src/ResourceIcon/assets/mongo-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mongo-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M42.3943 8.02489C39.3725 4.4396 36.7703 0.798289 36.2387 0.0420152C36.1828 -0.0140051 36.0988 -0.0140051 36.0428 0.0420152C35.5112 0.798289 32.9091 4.4396 29.8873 8.02489C3.94998 41.1047 33.9724 63.4289 33.9724 63.4289L34.2242 63.597C34.448 67.0421 35.0076 72 35.0076 72H36.1268H37.246C37.246 72 37.8056 67.0701 38.0294 63.597L38.2812 63.4009C38.3092 63.4289 68.3317 41.1047 42.3943 8.02489ZM36.1268 62.9246C36.1268 62.9246 34.7838 61.7763 34.42 61.1882V61.1319L36.0428 25.1111C36.0428 24.999 36.2107 24.999 36.2107 25.1111L37.8335 61.1319V61.1882C37.4698 61.7763 36.1268 62.9246 36.1268 62.9246Z" fill="#00ED64"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#00ed64" d="M42.394 8.025A128 128 0 0 1 36.24.042a.135.135 0 0 0-.196 0 128 128 0 0 1-6.156 7.983c-25.937 33.08 4.085 55.404 4.085 55.404l.252.168c.224 3.445.784 8.403.784 8.403h2.238s.56-4.93.783-8.403l.252-.196c.028.028 30.05-22.296 4.113-55.376m-6.267 54.9s-1.343-1.149-1.707-1.737v-.056l1.623-36.02c0-.113.168-.113.168 0l1.623 36.02v.056c-.364.588-1.707 1.737-1.707 1.737"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mongo-light.svg b/web/packages/design/src/ResourceIcon/assets/mongo-light.svg
index d66b3d309a9b9..8f4f6048f8adc 100644
--- a/web/packages/design/src/ResourceIcon/assets/mongo-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mongo-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M42.3943 8.02489C39.3725 4.4396 36.7703 0.798289 36.2387 0.0420152C36.1828 -0.0140051 36.0988 -0.0140051 36.0428 0.0420152C35.5112 0.798289 32.9091 4.4396 29.8873 8.02489C3.94998 41.1047 33.9724 63.4289 33.9724 63.4289L34.2242 63.597C34.448 67.0421 35.0076 72 35.0076 72H36.1268H37.246C37.246 72 37.8056 67.0701 38.0294 63.597L38.2812 63.4009C38.3092 63.4289 68.3317 41.1047 42.3943 8.02489ZM36.1268 62.9246C36.1268 62.9246 34.7838 61.7763 34.42 61.1882V61.1319L36.0428 25.1111C36.0428 24.999 36.2107 24.999 36.2107 25.1111L37.8335 61.1319V61.1882C37.4698 61.7763 36.1268 62.9246 36.1268 62.9246Z" fill="#001E2B"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#001e2b" d="M42.394 8.025A128 128 0 0 1 36.24.042a.135.135 0 0 0-.196 0 128 128 0 0 1-6.156 7.983c-25.937 33.08 4.085 55.404 4.085 55.404l.252.168c.224 3.445.784 8.403.784 8.403h2.238s.56-4.93.783-8.403l.252-.196c.028.028 30.05-22.296 4.113-55.376m-6.267 54.9s-1.343-1.149-1.707-1.737v-.056l1.623-36.02c0-.113.168-.113.168 0l1.623 36.02v.056c-.364.588-1.707 1.737-1.707 1.737"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mysql-large-dark.svg b/web/packages/design/src/ResourceIcon/assets/mysql-large-dark.svg
index d6a289d380724..fe0bb93ecb613 100644
--- a/web/packages/design/src/ResourceIcon/assets/mysql-large-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mysql-large-dark.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29926)">
-<path d="M17.3094 56.0801H14.5314C14.4337 51.395 14.1629 46.9894 13.7203 42.8626H13.6958L9.46606 56.0801H7.35088L3.14679 42.8626H3.12202C2.81008 46.8259 2.61383 51.2314 2.53199 56.0801H-0.000976562C0.162709 50.1833 0.57235 44.6557 1.22795 39.4958H4.67116L8.67909 51.6814H8.70369L12.7362 39.4958H16.0308C16.7522 45.5389 17.1782 51.0683 17.3091 56.0801" fill="white"/>
-<path d="M29.36 43.8444C28.2287 49.9775 26.7365 54.4344 24.8843 57.2147C23.4412 59.3571 21.8603 60.4282 20.1388 60.4282C19.6798 60.4282 19.1139 60.2901 18.4424 60.0157V58.5372C18.7704 58.5852 19.1554 58.6108 19.5981 58.6108C20.4012 58.6108 21.0485 58.389 21.5409 57.9464C22.1306 57.407 22.4257 56.8008 22.4257 56.129C22.4257 55.6701 22.1955 54.7285 21.7373 53.3041L18.6884 43.8444H21.4176L23.6057 50.9194C24.0973 52.5257 24.3024 53.6471 24.2203 54.2863C25.4171 51.0923 26.2532 47.6116 26.7289 43.8444H29.3599" fill="white"/>
-<path d="M41.5296 51.483C41.5296 52.8895 41.0124 54.0441 39.9814 54.9475C38.9496 55.8469 37.5634 56.2979 35.8276 56.2979C34.204 56.2979 32.6306 55.7789 31.1064 54.7494L31.8195 53.3248C33.1311 53.9799 34.318 54.307 35.3837 54.307C36.3834 54.307 37.1658 54.0847 37.7318 53.6455C38.2966 53.2032 38.6351 52.5862 38.6351 51.8037C38.6351 50.819 37.9478 49.9773 36.6867 49.2712C35.5225 48.6328 33.1958 47.3001 33.1958 47.3001C31.9352 46.3813 31.3031 45.3954 31.3031 43.771C31.3031 42.4275 31.7745 41.3417 32.7159 40.5155C33.6594 39.6876 34.8768 39.2737 36.3675 39.2737C37.9084 39.2737 39.3095 39.6846 40.5715 40.5034L39.9304 41.9267C38.8506 41.4692 37.7858 41.2396 36.736 41.2396C35.8842 41.2396 35.2277 41.444 34.7701 41.8551C34.3099 42.2626 34.0254 42.7871 34.0254 43.4263C34.0254 44.4085 34.7277 45.2604 36.0243 45.9802C37.2031 46.6189 39.5868 47.9774 39.5868 47.9774C40.8834 48.8946 41.5296 49.8724 41.5296 51.483Z" fill="#F29111"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M46.4955 52.7622C45.8232 51.6812 45.4864 49.9464 45.4864 47.5544C45.4864 43.3783 46.7573 41.289 49.2978 41.289C50.6262 41.289 51.601 41.7887 52.2245 42.7871C52.8959 43.8687 53.2327 45.5884 53.2327 47.947C53.2327 52.1565 51.9618 54.2621 49.4212 54.2621C48.0933 54.2621 47.1181 53.7629 46.4955 52.7624M56.38 56.4799L53.3291 54.9767C53.6008 54.7541 53.8587 54.5139 54.0923 54.2359C55.3876 52.7144 56.0359 50.4623 56.0359 47.4808C56.0359 41.9942 53.8802 39.2494 49.5691 39.2494C47.4545 39.2494 45.8065 39.9452 44.6264 41.3386C43.3306 42.862 42.6836 45.1056 42.6836 48.0702C42.6836 50.9854 43.2569 53.1239 44.4044 54.4824C45.45 55.7103 47.0311 56.3251 49.1479 56.3251C49.9376 56.3251 50.6622 56.228 51.3208 56.0337L55.2938 58.3438L56.377 56.4797" fill="#F29111"/>
-<path d="M66.3387 56.0801H58.4463V39.4958H61.1021V54.04H66.3387V56.08" fill="#F29111"/>
-<path d="M68.233 56.0781H68.673V54.3907H69.249V54.0461H67.6348V54.3907H68.233V56.0781ZM71.5818 56.0781H71.9966V54.0461H71.3726L70.8649 55.4312L70.3121 54.0461H69.7109V56.0781H70.1034V54.5316H70.1257L70.7046 56.0781H71.0037L71.5818 54.5316V56.0781Z" fill="#F29111"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M69.673 33.9405C68.0679 33.9004 66.8248 34.0604 65.7823 34.5016C65.4815 34.6217 65.0007 34.6217 64.9596 35.0025C65.1211 35.1625 65.1404 35.4228 65.2818 35.6442C65.5217 36.0449 65.9421 36.5851 66.3239 36.8664C66.7451 37.1872 67.1663 37.5066 67.6081 37.7871C68.3897 38.27 69.2724 38.5494 70.0334 39.0305C70.476 39.3106 70.9156 39.671 71.3583 39.9724C71.5781 40.1326 71.7174 40.3935 71.9993 40.4927V40.432C71.8579 40.2522 71.8185 39.9916 71.6788 39.7901C71.4787 39.5913 71.2777 39.4098 71.0768 39.2103C70.4949 38.4289 69.772 37.7483 68.9917 37.1872C68.3494 36.7451 66.9448 36.1439 66.6851 35.4047C66.6851 35.4047 66.6641 35.3835 66.6444 35.3638C67.0858 35.3231 67.6081 35.1625 68.0289 35.041C68.7097 34.8612 69.3315 34.9018 70.0334 34.722C70.3547 34.6413 70.6757 34.5404 70.9979 34.4419V34.2603C70.635 33.9004 70.3753 33.4187 69.9944 33.0784C68.9724 32.1971 67.848 31.3361 66.6851 30.6136C66.0625 30.2127 65.2604 29.9535 64.5983 29.612C64.3588 29.4916 63.9582 29.4322 63.8172 29.2307C63.456 28.79 63.2546 28.2097 62.9945 27.6879C62.4134 26.587 61.8508 25.3651 61.3503 24.201C60.9896 23.4201 60.7689 22.6391 60.3275 21.9173C58.2609 18.5102 56.0156 16.4474 52.5662 14.4232C51.824 14.0019 50.9418 13.8217 49.9999 13.6012C49.4977 13.5802 48.9968 13.5412 48.4955 13.5215C48.1741 13.3807 47.8528 12.9996 47.5725 12.8194C46.4289 12.0984 43.4821 10.5357 42.6393 12.5993C42.0976 13.9026 43.4414 15.1844 43.9029 15.8459C44.2435 16.3061 44.6853 16.828 44.9249 17.3482C45.0654 17.689 45.1057 18.0504 45.2467 18.4104C45.5672 19.292 45.8675 20.2741 46.2896 21.0961C46.5094 21.517 46.7498 21.9584 47.0305 22.3373C47.1924 22.5591 47.4723 22.658 47.5327 23.0198C47.2529 23.4201 47.231 24.0212 47.0708 24.5225C46.3492 26.7869 46.6294 29.5921 47.6526 31.255C47.9727 31.7559 48.7359 32.8583 49.7587 32.4365C50.6611 32.0765 50.4606 30.9342 50.7211 29.9329C50.7811 29.6908 50.7408 29.5319 50.8608 29.3718V29.4123C51.1414 29.9726 51.423 30.5122 51.6835 31.0752C52.3061 32.0561 53.3881 33.0782 54.2913 33.7589C54.7712 34.121 55.1526 34.7411 55.7542 34.9622V34.9017H55.7148C55.5939 34.7219 55.414 34.6411 55.2533 34.5015C54.8925 34.1405 54.4923 33.6995 54.2103 33.299C53.3683 32.1773 52.6253 30.9342 51.965 29.652C51.6432 29.0293 51.363 28.3487 51.102 27.7279C50.982 27.4885 50.9821 27.1268 50.7811 27.0069C50.4794 27.4472 50.0394 27.8285 49.8191 28.3679C49.4378 29.2305 49.3979 30.2923 49.2565 31.3949C49.1768 31.4159 49.2171 31.3949 49.1768 31.4348C48.5358 31.2746 48.3151 30.6134 48.0739 30.0542C47.4722 28.6296 47.3711 26.3454 47.8935 24.702C48.0332 24.282 48.6365 22.9595 48.3948 22.5588C48.2735 22.1765 47.8729 21.9581 47.6526 21.6563C47.3925 21.2757 47.1102 20.7957 46.9315 20.374C46.4499 19.2523 46.2078 18.0094 45.688 16.8877C45.4472 16.3658 45.0251 15.8246 44.6853 15.3447C44.3035 14.8035 43.8827 14.4229 43.5815 13.7824C43.4821 13.5615 43.3416 13.2006 43.5014 12.9608C43.5408 12.8003 43.6222 12.7399 43.7829 12.6996C44.0421 12.4792 44.7852 12.7592 45.0453 12.8795C45.7878 13.1792 46.4096 13.4613 47.0305 13.8813C47.3116 14.0821 47.6124 14.4627 47.9727 14.5638H48.3948C49.0362 14.7029 49.7587 14.6027 50.3607 14.7838C51.423 15.1242 52.3854 15.6251 53.2484 16.1663C55.8746 17.8296 58.0406 20.1946 59.504 23.0195C59.7452 23.4797 59.8463 23.901 60.0666 24.3809C60.4878 25.3648 61.0097 26.3666 61.43 27.3275C61.8508 28.2694 62.2527 29.2304 62.8552 30.0131C63.1552 30.4332 64.3588 30.6536 64.9004 30.8742C65.3006 31.054 65.9232 31.2145 66.2845 31.4346C66.9662 31.8547 67.6466 32.3364 68.2894 32.798C68.6095 33.0385 69.6126 33.5388 69.673 33.9402" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.2168 16.5251C48.8766 16.5251 48.6366 16.5662 48.3945 16.6257V16.666H48.4335C48.5955 16.9858 48.8766 17.208 49.0754 17.488C49.237 17.8087 49.3775 18.1281 49.5378 18.4492C49.5575 18.4295 49.5768 18.4085 49.5768 18.4085C49.8596 18.209 49.9997 17.8888 49.9997 17.4071C49.8784 17.2658 49.8596 17.1267 49.7585 16.9858C49.6385 16.7859 49.3775 16.6857 49.2168 16.5251Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_6709_29926">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6709_29926)"><path fill="#fff" d="M17.31 56.08h-2.78q-.146-7.027-.81-13.217h-.025L9.466 56.08H7.351L3.147 42.863h-.025q-.467 5.944-.59 13.217H-.001q.245-8.845 1.229-16.584h3.443L8.68 51.68h.025l4.032-12.185h3.295q1.081 9.065 1.278 16.584m12.05-12.235q-1.697 9.2-4.476 13.37-2.164 3.214-4.745 3.214-.69 0-1.697-.412v-1.479q.492.073 1.156.074 1.204 0 1.943-.665.885-.809.885-1.817 0-.688-.689-2.825l-3.049-9.46h2.73l2.188 7.075q.737 2.41.614 3.367 1.795-4.79 2.509-10.442z"/><path fill="#f29111" d="M41.53 51.483q-.001 2.11-1.549 3.465-1.548 1.35-4.153 1.35c-1.624 0-3.197-.52-4.722-1.549l.713-1.424q1.967.982 3.565.982 1.5-.001 2.348-.662c.565-.442.903-1.059.903-1.841 0-.985-.687-1.827-1.948-2.533a305 305 0 0 1-3.491-1.97c-1.26-.92-1.893-1.906-1.893-3.53q0-2.016 1.413-3.255 1.414-1.242 3.651-1.242 2.312 0 4.205 1.23l-.642 1.423q-1.62-.687-3.194-.687-1.279 0-1.966.615c-.46.408-.745.932-.745 1.571 0 .982.703 1.834 2 2.554 1.178.639 3.562 1.997 3.562 1.997 1.296.918 1.943 1.895 1.943 3.506"/><path fill="#f29111" fill-rule="evenodd" d="M46.496 52.762q-1.01-1.62-1.01-5.208 0-6.264 3.812-6.265 1.992 0 2.926 1.498 1.008 1.622 1.009 5.16 0 6.315-3.812 6.315-1.992 0-2.925-1.5m9.884 3.718-3.05-1.503a5.7 5.7 0 0 0 .762-.741q1.944-2.283 1.944-6.755 0-8.231-6.467-8.232-3.172 0-4.943 2.09-1.942 2.285-1.942 6.731 0 4.374 1.72 6.412 1.569 1.843 4.744 1.843 1.185 0 2.173-.291l3.973 2.31 1.083-1.864" clip-rule="evenodd"/><path fill="#f29111" d="M66.339 56.08h-7.893V39.496h2.656V54.04h5.237zm1.894-.002h.44v-1.687h.576v-.345h-1.614v.345h.598zm3.349 0h.415v-2.032h-.624l-.508 1.385-.553-1.385h-.601v2.032h.392v-1.546h.023l.579 1.546h.299l.578-1.546z"/><path fill="#fff" fill-rule="evenodd" d="M69.673 33.94c-1.605-.04-2.848.12-3.89.562-.302.12-.782.12-.823.5.161.16.18.42.322.642.24.4.66.941 1.042 1.222.421.321.842.64 1.284.921.782.483 1.664.762 2.425 1.244.443.28.883.64 1.325.941.22.16.36.422.641.52v-.06c-.141-.18-.18-.44-.32-.642-.2-.199-.401-.38-.602-.58a9.6 9.6 0 0 0-2.085-2.023c-.643-.442-2.047-1.043-2.307-1.782 0 0-.02-.022-.04-.041.44-.04.963-.201 1.384-.323.68-.18 1.303-.14 2.004-.319.322-.08.643-.182.965-.28v-.182c-.363-.36-.623-.841-1.004-1.182-1.022-.88-2.146-1.742-3.309-2.464-.623-.401-1.425-.66-2.087-1.002-.24-.12-.64-.18-.78-.381-.362-.441-.563-1.021-.823-1.543A50 50 0 0 1 61.35 24.2c-.36-.78-.581-1.562-1.023-2.284-2.066-3.407-4.311-5.47-7.76-7.494-.743-.421-1.625-.601-2.567-.822-.502-.02-1.003-.06-1.505-.08-.32-.14-.642-.521-.922-.702-1.144-.72-4.09-2.283-4.934-.22-.541 1.304.802 2.585 1.264 3.247.34.46.782.982 1.022 1.502.14.341.18.702.322 1.062.32.882.62 1.864 1.043 2.686.22.421.46.862.74 1.241.162.222.442.321.503.683-.28.4-.302 1.001-.462 1.503-.722 2.264-.442 5.07.582 6.732.32.5 1.083 1.603 2.106 1.182.902-.36.702-1.503.962-2.504.06-.242.02-.401.14-.561v.04c.28.56.562 1.1.823 1.663.622.981 1.704 2.003 2.607 2.684.48.362.862.982 1.463 1.203v-.06h-.04c-.12-.18-.3-.26-.46-.4a10 10 0 0 1-1.044-1.203c-.842-1.122-1.585-2.365-2.245-3.647-.322-.623-.602-1.303-.863-1.924-.12-.24-.12-.601-.32-.721-.303.44-.743.821-.963 1.36-.381.863-.421 1.925-.562 3.028-.08.02-.04 0-.08.04-.641-.16-.862-.822-1.103-1.38-.602-1.425-.703-3.71-.18-5.353.14-.42.742-1.743.5-2.143-.12-.383-.521-.6-.741-.903a8 8 0 0 1-.721-1.282c-.482-1.122-.724-2.365-1.244-3.486-.24-.522-.663-1.063-1.003-1.543-.382-.542-.802-.922-1.104-1.563-.099-.22-.24-.581-.08-.821.04-.16.121-.221.282-.261.26-.22 1.002.06 1.262.18.743.3 1.365.581 1.986 1.001.28.201.581.582.942.683h.422c.641.139 1.364.039 1.966.22 1.062.34 2.024.841 2.887 1.382a17.8 17.8 0 0 1 6.256 6.854c.241.46.342.881.563 1.36.42.985.943 1.987 1.363 2.948.42.941.823 1.902 1.425 2.685.3.42 1.504.64 2.045.861.4.18 1.023.34 1.384.56.682.42 1.363.902 2.005 1.364.32.24 1.324.74 1.384 1.142" clip-rule="evenodd"/><path fill="#fff" fill-rule="evenodd" d="M49.217 16.525c-.34 0-.58.041-.822.1v.041h.038c.163.32.444.542.642.822.162.32.302.64.463.961l.039-.04c.283-.2.423-.52.423-1.002-.122-.141-.14-.28-.242-.421-.12-.2-.38-.3-.541-.46" clip-rule="evenodd"/></g><defs><clipPath id="clip0_6709_29926"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mysql-large-light.svg b/web/packages/design/src/ResourceIcon/assets/mysql-large-light.svg
index 0f444b0877e5d..0baa3600edb74 100644
--- a/web/packages/design/src/ResourceIcon/assets/mysql-large-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mysql-large-light.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29925)">
-<path d="M17.3094 56.0801H14.5314C14.4337 51.395 14.1629 46.9894 13.7203 42.8626H13.6958L9.46606 56.0801H7.35088L3.14679 42.8626H3.12202C2.81008 46.8259 2.61383 51.2314 2.53199 56.0801H-0.000976562C0.162709 50.1833 0.57235 44.6557 1.22795 39.4958H4.67116L8.67909 51.6814H8.70369L12.7362 39.4958H16.0308C16.7522 45.5389 17.1782 51.0683 17.3091 56.0801" fill="#00758F"/>
-<path d="M29.36 43.8444C28.2287 49.9775 26.7365 54.4344 24.8843 57.2147C23.4412 59.3571 21.8603 60.4282 20.1388 60.4282C19.6798 60.4282 19.1139 60.2901 18.4424 60.0157V58.5372C18.7704 58.5852 19.1554 58.6108 19.5981 58.6108C20.4012 58.6108 21.0485 58.389 21.5409 57.9464C22.1306 57.407 22.4257 56.8008 22.4257 56.129C22.4257 55.6701 22.1955 54.7285 21.7373 53.3041L18.6884 43.8444H21.4176L23.6057 50.9194C24.0973 52.5257 24.3024 53.6471 24.2203 54.2863C25.4171 51.0923 26.2532 47.6116 26.7289 43.8444H29.3599" fill="#00758F"/>
-<path d="M41.5296 51.483C41.5296 52.8895 41.0124 54.0441 39.9814 54.9475C38.9496 55.8469 37.5634 56.2979 35.8276 56.2979C34.204 56.2979 32.6306 55.7789 31.1064 54.7494L31.8195 53.3248C33.1311 53.9799 34.318 54.307 35.3837 54.307C36.3834 54.307 37.1658 54.0847 37.7318 53.6455C38.2966 53.2032 38.6351 52.5862 38.6351 51.8037C38.6351 50.819 37.9478 49.9773 36.6867 49.2712C35.5225 48.6328 33.1958 47.3001 33.1958 47.3001C31.9352 46.3813 31.3031 45.3954 31.3031 43.771C31.3031 42.4275 31.7745 41.3417 32.7159 40.5155C33.6594 39.6876 34.8768 39.2737 36.3675 39.2737C37.9084 39.2737 39.3095 39.6846 40.5715 40.5034L39.9304 41.9267C38.8506 41.4692 37.7858 41.2396 36.736 41.2396C35.8842 41.2396 35.2277 41.444 34.7701 41.8551C34.3099 42.2626 34.0254 42.7871 34.0254 43.4263C34.0254 44.4085 34.7277 45.2604 36.0243 45.9802C37.2031 46.6189 39.5868 47.9774 39.5868 47.9774C40.8834 48.8946 41.5296 49.8724 41.5296 51.483Z" fill="#F29111"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M46.4955 52.7622C45.8232 51.6812 45.4864 49.9464 45.4864 47.5544C45.4864 43.3783 46.7573 41.289 49.2978 41.289C50.6262 41.289 51.601 41.7887 52.2245 42.7871C52.8959 43.8687 53.2327 45.5884 53.2327 47.947C53.2327 52.1565 51.9618 54.2621 49.4212 54.2621C48.0933 54.2621 47.1181 53.7629 46.4955 52.7624M56.38 56.4799L53.3291 54.9767C53.6008 54.7541 53.8587 54.5139 54.0923 54.2359C55.3876 52.7144 56.0359 50.4623 56.0359 47.4808C56.0359 41.9942 53.8802 39.2494 49.5691 39.2494C47.4545 39.2494 45.8065 39.9452 44.6264 41.3386C43.3306 42.862 42.6836 45.1056 42.6836 48.0702C42.6836 50.9854 43.2569 53.1239 44.4044 54.4824C45.45 55.7103 47.0311 56.3251 49.1479 56.3251C49.9376 56.3251 50.6622 56.228 51.3208 56.0337L55.2938 58.3438L56.377 56.4797" fill="#F29111"/>
-<path d="M66.3387 56.0801H58.4463V39.4958H61.1021V54.04H66.3387V56.08" fill="#F29111"/>
-<path d="M68.233 56.0781H68.673V54.3907H69.249V54.0461H67.6348V54.3907H68.233V56.0781ZM71.5818 56.0781H71.9966V54.0461H71.3726L70.8649 55.4312L70.3121 54.0461H69.7109V56.0781H70.1034V54.5316H70.1257L70.7046 56.0781H71.0037L71.5818 54.5316V56.0781Z" fill="#F29111"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M69.673 33.9405C68.0679 33.9004 66.8248 34.0604 65.7823 34.5016C65.4815 34.6217 65.0007 34.6217 64.9596 35.0025C65.1211 35.1625 65.1404 35.4228 65.2818 35.6442C65.5217 36.0449 65.9421 36.5851 66.3239 36.8664C66.7451 37.1872 67.1663 37.5066 67.6081 37.7871C68.3897 38.27 69.2724 38.5494 70.0334 39.0305C70.476 39.3106 70.9156 39.671 71.3583 39.9724C71.5781 40.1326 71.7174 40.3935 71.9993 40.4927V40.432C71.8579 40.2522 71.8185 39.9916 71.6788 39.7901C71.4787 39.5913 71.2777 39.4098 71.0768 39.2103C70.4949 38.4289 69.772 37.7483 68.9917 37.1872C68.3494 36.7451 66.9448 36.1439 66.6851 35.4047C66.6851 35.4047 66.6641 35.3835 66.6444 35.3638C67.0858 35.3231 67.6081 35.1625 68.0289 35.041C68.7097 34.8612 69.3315 34.9018 70.0334 34.722C70.3547 34.6413 70.6757 34.5404 70.9979 34.4419V34.2603C70.635 33.9004 70.3753 33.4187 69.9944 33.0784C68.9724 32.1971 67.848 31.3361 66.6851 30.6136C66.0625 30.2127 65.2604 29.9535 64.5983 29.612C64.3588 29.4916 63.9582 29.4322 63.8172 29.2307C63.456 28.79 63.2546 28.2097 62.9945 27.6879C62.4134 26.587 61.8508 25.3651 61.3503 24.201C60.9896 23.4201 60.7689 22.6391 60.3275 21.9173C58.2609 18.5102 56.0156 16.4474 52.5662 14.4232C51.824 14.0019 50.9418 13.8217 49.9999 13.6012C49.4977 13.5802 48.9968 13.5412 48.4955 13.5215C48.1741 13.3807 47.8528 12.9996 47.5725 12.8194C46.4289 12.0984 43.4821 10.5357 42.6393 12.5993C42.0976 13.9026 43.4414 15.1844 43.9029 15.8459C44.2435 16.3061 44.6853 16.828 44.9249 17.3482C45.0654 17.689 45.1057 18.0504 45.2467 18.4104C45.5672 19.292 45.8675 20.2741 46.2896 21.0961C46.5094 21.517 46.7498 21.9584 47.0305 22.3373C47.1924 22.5591 47.4723 22.658 47.5327 23.0198C47.2529 23.4201 47.231 24.0212 47.0708 24.5225C46.3492 26.7869 46.6294 29.5921 47.6526 31.255C47.9727 31.7559 48.7359 32.8583 49.7587 32.4365C50.6611 32.0765 50.4606 30.9342 50.7211 29.9329C50.7811 29.6908 50.7408 29.5319 50.8608 29.3718V29.4123C51.1414 29.9726 51.423 30.5122 51.6835 31.0752C52.3061 32.0561 53.3881 33.0782 54.2913 33.7589C54.7712 34.121 55.1526 34.7411 55.7542 34.9622V34.9017H55.7148C55.5939 34.7219 55.414 34.6411 55.2533 34.5015C54.8925 34.1405 54.4923 33.6995 54.2103 33.299C53.3683 32.1773 52.6253 30.9342 51.965 29.652C51.6432 29.0293 51.363 28.3487 51.102 27.7279C50.982 27.4885 50.9821 27.1268 50.7811 27.0069C50.4794 27.4472 50.0394 27.8285 49.8191 28.3679C49.4378 29.2305 49.3979 30.2923 49.2565 31.3949C49.1768 31.4159 49.2171 31.3949 49.1768 31.4348C48.5358 31.2746 48.3151 30.6134 48.0739 30.0542C47.4722 28.6296 47.3711 26.3454 47.8935 24.702C48.0332 24.282 48.6365 22.9595 48.3948 22.5588C48.2735 22.1765 47.8729 21.9581 47.6526 21.6563C47.3925 21.2757 47.1102 20.7957 46.9315 20.374C46.4499 19.2523 46.2078 18.0094 45.688 16.8877C45.4472 16.3658 45.0251 15.8246 44.6853 15.3447C44.3035 14.8035 43.8827 14.4229 43.5815 13.7824C43.4821 13.5615 43.3416 13.2006 43.5014 12.9608C43.5408 12.8003 43.6222 12.7399 43.7829 12.6996C44.0421 12.4792 44.7852 12.7592 45.0453 12.8795C45.7878 13.1792 46.4096 13.4613 47.0305 13.8813C47.3116 14.0821 47.6124 14.4627 47.9727 14.5638H48.3948C49.0362 14.7029 49.7587 14.6027 50.3607 14.7838C51.423 15.1242 52.3854 15.6251 53.2484 16.1663C55.8746 17.8296 58.0406 20.1946 59.504 23.0195C59.7452 23.4797 59.8463 23.901 60.0666 24.3809C60.4878 25.3648 61.0097 26.3666 61.43 27.3275C61.8508 28.2694 62.2527 29.2304 62.8552 30.0131C63.1552 30.4332 64.3588 30.6536 64.9004 30.8742C65.3006 31.054 65.9232 31.2145 66.2845 31.4346C66.9662 31.8547 67.6466 32.3364 68.2894 32.798C68.6095 33.0385 69.6126 33.5388 69.673 33.9402" fill="#00758F"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M49.2168 16.5251C48.8766 16.5251 48.6366 16.5662 48.3945 16.6257V16.666H48.4335C48.5955 16.9858 48.8766 17.208 49.0754 17.488C49.237 17.8087 49.3775 18.1281 49.5378 18.4492C49.5575 18.4295 49.5768 18.4085 49.5768 18.4085C49.8596 18.209 49.9997 17.8888 49.9997 17.4071C49.8784 17.2658 49.8596 17.1267 49.7585 16.9858C49.6385 16.7859 49.3775 16.6857 49.2168 16.5251Z" fill="#00758F"/>
-</g>
-<defs>
-<clipPath id="clip0_6709_29925">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6709_29925)"><path fill="#00758f" d="M17.31 56.08h-2.78q-.146-7.027-.81-13.217h-.025L9.466 56.08H7.351L3.147 42.863h-.025q-.467 5.944-.59 13.217H-.001q.245-8.845 1.229-16.584h3.443L8.68 51.68h.025l4.032-12.185h3.295q1.081 9.065 1.278 16.584m12.05-12.235q-1.697 9.2-4.476 13.37-2.164 3.214-4.745 3.214-.69 0-1.697-.412v-1.479q.492.073 1.156.074 1.204 0 1.943-.665.885-.809.885-1.817 0-.688-.689-2.825l-3.049-9.46h2.73l2.188 7.075q.737 2.41.614 3.367 1.795-4.79 2.509-10.442z"/><path fill="#f29111" d="M41.53 51.483q-.001 2.11-1.549 3.465-1.548 1.35-4.153 1.35c-1.624 0-3.197-.52-4.722-1.549l.713-1.424q1.967.982 3.565.982 1.5-.001 2.348-.662c.565-.442.903-1.059.903-1.841 0-.985-.687-1.827-1.948-2.533a305 305 0 0 1-3.491-1.97c-1.26-.92-1.893-1.906-1.893-3.53q0-2.016 1.413-3.255 1.414-1.242 3.651-1.242 2.312 0 4.205 1.23l-.642 1.423q-1.62-.687-3.194-.687-1.279 0-1.966.615c-.46.408-.745.932-.745 1.571 0 .982.703 1.834 2 2.554 1.178.639 3.562 1.997 3.562 1.997 1.296.918 1.943 1.895 1.943 3.506"/><path fill="#f29111" fill-rule="evenodd" d="M46.496 52.762q-1.01-1.62-1.01-5.208 0-6.264 3.812-6.265 1.992 0 2.926 1.498 1.008 1.622 1.009 5.16 0 6.315-3.812 6.315-1.992 0-2.925-1.5m9.884 3.718-3.05-1.503a5.7 5.7 0 0 0 .762-.741q1.944-2.283 1.944-6.755 0-8.231-6.467-8.232-3.172 0-4.943 2.09-1.942 2.285-1.942 6.731 0 4.374 1.72 6.412 1.569 1.843 4.744 1.843 1.185 0 2.173-.291l3.973 2.31 1.083-1.864" clip-rule="evenodd"/><path fill="#f29111" d="M66.339 56.08h-7.893V39.496h2.656V54.04h5.237zm1.894-.002h.44v-1.687h.576v-.345h-1.614v.345h.598zm3.349 0h.415v-2.032h-.624l-.508 1.385-.553-1.385h-.601v2.032h.392v-1.546h.023l.579 1.546h.299l.578-1.546z"/><path fill="#00758f" fill-rule="evenodd" d="M69.673 33.94c-1.605-.04-2.848.12-3.89.562-.302.12-.782.12-.823.5.161.16.18.42.322.642.24.4.66.941 1.042 1.222.421.321.842.64 1.284.921.782.483 1.664.762 2.425 1.244.443.28.883.64 1.325.941.22.16.36.422.641.52v-.06c-.141-.18-.18-.44-.32-.642-.2-.199-.401-.38-.602-.58a9.6 9.6 0 0 0-2.085-2.023c-.643-.442-2.047-1.043-2.307-1.782 0 0-.02-.022-.04-.041.44-.04.963-.201 1.384-.323.68-.18 1.303-.14 2.004-.319.322-.08.643-.182.965-.28v-.182c-.363-.36-.623-.841-1.004-1.182-1.022-.88-2.146-1.742-3.309-2.464-.623-.401-1.425-.66-2.087-1.002-.24-.12-.64-.18-.78-.381-.362-.441-.563-1.021-.823-1.543A50 50 0 0 1 61.35 24.2c-.36-.78-.581-1.562-1.023-2.284-2.066-3.407-4.311-5.47-7.76-7.494-.743-.421-1.625-.601-2.567-.822-.502-.02-1.003-.06-1.505-.08-.32-.14-.642-.521-.922-.702-1.144-.72-4.09-2.283-4.934-.22-.541 1.304.802 2.585 1.264 3.247.34.46.782.982 1.022 1.502.14.341.18.702.322 1.062.32.882.62 1.864 1.043 2.686.22.421.46.862.74 1.241.162.222.442.321.503.683-.28.4-.302 1.001-.462 1.503-.722 2.264-.442 5.07.582 6.732.32.5 1.083 1.603 2.106 1.182.902-.36.702-1.503.962-2.504.06-.242.02-.401.14-.561v.04c.28.56.562 1.1.823 1.663.622.981 1.704 2.003 2.607 2.684.48.362.862.982 1.463 1.203v-.06h-.04c-.12-.18-.3-.26-.46-.4a10 10 0 0 1-1.044-1.203c-.842-1.122-1.585-2.365-2.245-3.647-.322-.623-.602-1.303-.863-1.924-.12-.24-.12-.601-.32-.721-.303.44-.743.821-.963 1.36-.381.863-.421 1.925-.562 3.028-.08.02-.04 0-.08.04-.641-.16-.862-.822-1.103-1.38-.602-1.425-.703-3.71-.18-5.353.14-.42.742-1.743.5-2.143-.12-.383-.521-.6-.741-.903a8 8 0 0 1-.721-1.282c-.482-1.122-.724-2.365-1.244-3.486-.24-.522-.663-1.063-1.003-1.543-.382-.542-.802-.922-1.104-1.563-.099-.22-.24-.581-.08-.821.04-.16.121-.221.282-.261.26-.22 1.002.06 1.262.18.743.3 1.365.581 1.986 1.001.28.201.581.582.942.683h.422c.641.139 1.364.039 1.966.22 1.062.34 2.024.841 2.887 1.382a17.8 17.8 0 0 1 6.256 6.854c.241.46.342.881.563 1.36.42.985.943 1.987 1.363 2.948.42.941.823 1.902 1.425 2.685.3.42 1.504.64 2.045.861.4.18 1.023.34 1.384.56.682.42 1.363.902 2.005 1.364.32.24 1.324.74 1.384 1.142" clip-rule="evenodd"/><path fill="#00758f" fill-rule="evenodd" d="M49.217 16.525c-.34 0-.58.041-.822.1v.041h.038c.163.32.444.542.642.822.162.32.302.64.463.961l.039-.04c.283-.2.423-.52.423-1.002-.122-.141-.14-.28-.242-.421-.12-.2-.38-.3-.541-.46" clip-rule="evenodd"/></g><defs><clipPath id="clip0_6709_29925"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mysql-small-dark.svg b/web/packages/design/src/ResourceIcon/assets/mysql-small-dark.svg
index 0a1adde38ee7b..50a0abec51751 100644
--- a/web/packages/design/src/ResourceIcon/assets/mysql-small-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mysql-small-dark.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6745_29863)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.319 55.3093C62.3997 55.2113 59.3644 55.6021 56.8188 56.6794C56.0843 56.9726 54.9104 56.9726 54.8099 57.9024C55.2044 58.2932 55.2515 58.9287 55.5967 59.4693C56.1826 60.4478 57.209 61.7668 58.1413 62.4536C59.1698 63.2368 60.1983 64.0168 61.277 64.7016C63.1854 65.881 65.3408 66.563 67.199 67.7378C68.2798 68.4218 69.3533 69.3019 70.4341 70.0377C70.9708 70.4289 71.3109 71.066 71.9993 71.3081V71.16C71.654 70.7209 71.5578 70.0847 71.2167 69.5926C70.7281 69.1071 70.2374 68.664 69.7467 68.1768C68.3258 66.2689 66.5607 64.6069 64.6554 63.2368C63.0871 62.1575 59.6573 60.6895 59.0233 58.8846C59.0233 58.8846 58.972 58.8327 58.9239 58.7845C60.0016 58.6852 61.277 58.2932 62.3044 57.9964C63.967 57.5573 65.4851 57.6566 67.199 57.2176C67.9837 57.0204 68.7673 56.7741 69.5541 56.5335V56.0901C68.6679 55.2113 68.0339 54.0352 67.1037 53.2042C64.6084 51.0522 61.8629 48.9498 59.0233 47.1857C57.503 46.2069 55.5444 45.5739 53.9279 44.7401C53.343 44.446 52.3647 44.3011 52.0205 43.809C51.1385 42.733 50.6468 41.316 50.0117 40.0418C48.5929 37.3537 47.2191 34.3701 45.9971 31.5277C45.1161 29.6208 44.5773 27.714 43.4996 25.9515C38.4534 17.6321 32.9709 12.5953 24.5483 7.65263C22.7361 6.62395 20.5818 6.18383 18.2821 5.64545C17.0558 5.59422 15.8327 5.49909 14.6086 5.451C13.8239 5.10706 13.0392 4.17664 12.3549 3.73653C9.56236 1.97606 2.36707 -1.83968 0.309028 3.19919C-1.01347 6.38141 2.26767 9.51138 3.39452 11.1265C4.2263 12.2503 5.30504 13.5247 5.88991 14.7949C6.2331 15.627 6.33144 16.5093 6.67567 17.3885C7.45829 19.541 8.19173 21.9392 9.22232 23.9464C9.75906 24.974 10.346 26.0518 11.0313 26.977C11.4268 27.5185 12.1101 27.76 12.2576 28.6434C11.5744 29.6209 11.521 31.0886 11.1297 32.3128C9.36775 37.8419 10.052 44.6915 12.5505 48.7518C13.3321 49.9749 15.1955 52.6668 17.693 51.6369C19.8965 50.7577 19.4068 47.9686 20.043 45.5237C20.1895 44.9324 20.0911 44.5445 20.3841 44.1536V44.2525C21.0694 45.6205 21.7568 46.9383 22.3929 48.3129C23.9132 50.7079 26.555 53.2038 28.7606 54.8658C29.9324 55.7499 30.8636 57.2642 32.3326 57.804V57.6562H32.2364C31.9413 57.2172 31.5019 57.02 31.1095 56.679C30.2285 55.7977 29.2513 54.7208 28.5629 53.7428C26.5069 51.004 24.6927 47.9686 23.0803 44.8376C22.2946 43.3173 21.6103 41.6553 20.9731 40.1395C20.6801 39.5551 20.6802 38.6718 20.1895 38.379C19.4529 39.4542 18.3783 40.3852 17.8405 41.7022C16.9093 43.8086 16.8121 46.4013 16.4668 49.0936C16.2722 49.1447 16.3705 49.0936 16.2722 49.1908C14.7069 48.7996 14.1681 47.1853 13.579 45.8198C12.1101 42.3413 11.8631 36.7637 13.1386 32.7511C13.4796 31.7256 14.9528 28.4963 14.3627 27.5178C14.0666 26.5843 13.0883 26.0511 12.5505 25.3141C11.9154 24.3847 11.226 23.2128 10.7897 22.1831C9.61363 19.4441 9.02248 16.4093 7.75333 13.6703C7.16532 12.396 6.13473 11.0746 5.30503 9.90268C4.37279 8.58128 3.34534 7.65192 2.6098 6.08798C2.36706 5.54855 2.02387 4.66727 2.41415 4.08184C2.5104 3.68981 2.7092 3.5424 3.10155 3.44413C3.73456 2.90575 5.5488 3.58945 6.1839 3.88321C7.99711 4.61499 9.51527 5.30391 11.0313 6.32945C11.7177 6.81974 12.4522 7.74913 13.3321 7.99584H14.3627C15.929 8.3356 17.693 8.09098 19.163 8.53318C21.7568 9.36428 24.1067 10.5874 26.2139 11.9088C32.6266 15.9702 37.9156 21.7451 41.4886 28.6427C42.0777 29.7665 42.3246 30.7952 42.8624 31.9671C43.8909 34.3694 45.1653 36.8157 46.1917 39.1619C47.2191 41.4618 48.2005 43.8083 49.6716 45.7194C50.404 46.7452 53.343 47.2835 54.6655 47.8221C55.6428 48.261 57.163 48.653 58.045 49.1905C59.7096 50.2163 61.3711 51.3923 62.9406 52.5195C63.7221 53.1067 66.1715 54.3285 66.319 55.3085" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M16.3702 12.7857C15.5394 12.7857 14.9535 12.886 14.3623 13.0314V13.1296H14.4575C14.853 13.9106 15.5394 14.4532 16.0249 15.1369C16.4194 15.9199 16.7625 16.6998 17.1539 17.4839C17.202 17.4358 17.2491 17.3846 17.2491 17.3846C17.9396 16.8974 18.2818 16.1154 18.2818 14.9393C17.9857 14.5943 17.9396 14.2545 17.6927 13.9105C17.3997 13.4223 16.7625 13.1777 16.3702 12.7857Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_6745_29863">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" fill-rule="evenodd" clip-path="url(#clip0_6745_29863)" clip-rule="evenodd"><path d="M66.319 55.31c-3.92-.099-6.955.292-9.5 1.37-.735.293-1.909.293-2.01 1.222.395.391.443 1.027.788 1.567.586.979 1.612 2.298 2.544 2.985 1.029.783 2.057 1.563 3.136 2.248 1.908 1.179 4.064 1.861 5.922 3.036 1.08.684 2.154 1.564 3.235 2.3.537.39.877 1.028 1.565 1.27v-.148c-.345-.44-.441-1.075-.782-1.567-.489-.486-.98-.929-1.47-1.416-1.421-1.908-3.186-3.57-5.092-4.94-1.568-1.08-4.998-2.547-5.632-4.352l-.1-.1c1.079-.1 2.354-.492 3.381-.789 1.663-.439 3.181-.34 4.895-.778.785-.198 1.568-.444 2.355-.685v-.443c-.886-.879-1.52-2.055-2.45-2.886-2.496-2.152-5.241-4.254-8.08-6.018-1.521-.98-3.48-1.612-5.096-2.446-.585-.294-1.563-.439-1.907-.931-.883-1.076-1.374-2.493-2.01-3.767-1.418-2.688-2.792-5.672-4.014-8.514-.88-1.907-1.42-3.814-2.497-5.576-5.047-8.32-10.53-13.357-18.952-18.3-1.812-1.028-3.966-1.468-6.266-2.007-1.226-.05-2.45-.146-3.673-.194-.785-.344-1.57-1.274-2.254-1.714C9.562 1.977 2.367-1.84.309 3.199c-1.322 3.182 1.959 6.312 3.086 7.928.831 1.123 1.91 2.398 2.495 3.668.343.832.441 1.714.786 2.594.782 2.152 1.516 4.55 2.546 6.557.537 1.028 1.124 2.106 1.81 3.031.395.541 1.078.783 1.226 1.666-.684.978-.737 2.446-1.128 3.67-1.762 5.529-1.078 12.378 1.42 16.439.782 1.223 2.645 3.915 5.143 2.885 2.203-.88 1.714-3.668 2.35-6.113.146-.592.048-.98.341-1.37v.098c.685 1.368 1.373 2.686 2.009 4.06 1.52 2.396 4.162 4.892 6.368 6.554 1.171.884 2.103 2.398 3.572 2.938v-.148h-.097c-.295-.439-.734-.636-1.126-.977-.881-.881-1.859-1.958-2.547-2.936-2.056-2.739-3.87-5.774-5.483-8.905-.785-1.52-1.47-3.183-2.107-4.699-.293-.584-.293-1.467-.784-1.76-.736 1.075-1.81 2.006-2.349 3.323-.93 2.107-1.028 4.7-1.373 7.392-.195.05-.096 0-.195.097-1.565-.391-2.104-2.006-2.693-3.371-1.469-3.479-1.716-9.056-.44-13.069.34-1.025 1.814-4.255 1.224-5.233-.296-.934-1.275-1.467-1.812-2.204-.636-.93-1.325-2.101-1.761-3.13-1.176-2.74-1.768-5.775-3.037-8.514-.588-1.274-1.618-2.595-2.448-3.767-.932-1.322-1.96-2.251-2.695-3.815-.243-.54-.586-1.42-.196-2.006.096-.392.295-.54.688-.638.633-.538 2.447.145 3.082.44 1.813.731 3.331 1.42 4.847 2.445.687.49 1.421 1.42 2.301 1.667h1.03c1.567.34 3.331.095 4.801.537 2.594.831 4.944 2.054 7.05 3.376 6.414 4.061 11.703 9.836 15.276 16.734.589 1.124.836 2.152 1.373 3.324 1.029 2.402 2.303 4.849 3.33 7.195 1.027 2.3 2.008 4.646 3.48 6.557.732 1.026 3.671 1.564 4.994 2.103.977.439 2.497.831 3.379 1.368 1.665 1.026 3.326 2.202 4.896 3.33.781.587 3.23 1.808 3.378 2.788"/><path d="M16.37 12.786c-.83 0-1.417.1-2.008.245v.099h.095c.396.78 1.082 1.323 1.568 2.007.394.783.738 1.563 1.129 2.347.048-.048.095-.1.095-.1.69-.487 1.033-1.269 1.033-2.445-.296-.345-.342-.684-.59-1.028-.292-.489-.93-.733-1.322-1.125"/></g><defs><clipPath id="clip0_6745_29863"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/mysql-small-light.svg b/web/packages/design/src/ResourceIcon/assets/mysql-small-light.svg
index f5fc1203441d2..0ba79a83e9a17 100644
--- a/web/packages/design/src/ResourceIcon/assets/mysql-small-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/mysql-small-light.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6745_29853)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.319 55.3093C62.3997 55.2113 59.3644 55.6021 56.8188 56.6794C56.0843 56.9726 54.9104 56.9726 54.8099 57.9024C55.2044 58.2932 55.2515 58.9287 55.5967 59.4693C56.1826 60.4478 57.209 61.7668 58.1413 62.4536C59.1698 63.2368 60.1983 64.0168 61.277 64.7016C63.1854 65.881 65.3408 66.563 67.199 67.7378C68.2798 68.4218 69.3533 69.3019 70.4341 70.0377C70.9708 70.4289 71.3109 71.066 71.9993 71.3081V71.16C71.654 70.7209 71.5578 70.0847 71.2167 69.5926C70.7281 69.1071 70.2374 68.664 69.7467 68.1768C68.3258 66.2689 66.5607 64.6069 64.6554 63.2368C63.0871 62.1575 59.6573 60.6895 59.0233 58.8846C59.0233 58.8846 58.972 58.8327 58.9239 58.7845C60.0016 58.6852 61.277 58.2932 62.3044 57.9964C63.967 57.5573 65.4851 57.6566 67.199 57.2176C67.9837 57.0204 68.7673 56.7741 69.5541 56.5335V56.0901C68.6679 55.2113 68.0339 54.0352 67.1037 53.2042C64.6084 51.0522 61.8629 48.9498 59.0233 47.1857C57.503 46.2069 55.5444 45.5739 53.9279 44.7401C53.343 44.446 52.3647 44.3011 52.0205 43.809C51.1385 42.733 50.6468 41.316 50.0117 40.0418C48.5929 37.3537 47.2191 34.3701 45.9971 31.5277C45.1161 29.6208 44.5773 27.714 43.4996 25.9515C38.4534 17.6321 32.9709 12.5953 24.5483 7.65263C22.7361 6.62395 20.5818 6.18383 18.2821 5.64545C17.0558 5.59422 15.8327 5.49909 14.6086 5.451C13.8239 5.10706 13.0392 4.17664 12.3549 3.73653C9.56236 1.97606 2.36707 -1.83968 0.309028 3.19919C-1.01347 6.38141 2.26767 9.51138 3.39452 11.1265C4.2263 12.2503 5.30504 13.5247 5.88991 14.7949C6.2331 15.627 6.33144 16.5093 6.67567 17.3885C7.45829 19.541 8.19173 21.9392 9.22232 23.9464C9.75906 24.974 10.346 26.0518 11.0313 26.977C11.4268 27.5185 12.1101 27.76 12.2576 28.6434C11.5744 29.6209 11.521 31.0886 11.1297 32.3128C9.36775 37.8419 10.052 44.6915 12.5505 48.7518C13.3321 49.9749 15.1955 52.6668 17.693 51.6369C19.8965 50.7577 19.4068 47.9686 20.043 45.5237C20.1895 44.9324 20.0911 44.5445 20.3841 44.1536V44.2525C21.0694 45.6205 21.7568 46.9383 22.3929 48.3129C23.9132 50.7079 26.555 53.2038 28.7606 54.8658C29.9324 55.7499 30.8636 57.2642 32.3326 57.804V57.6562H32.2364C31.9413 57.2172 31.5019 57.02 31.1095 56.679C30.2285 55.7977 29.2513 54.7208 28.5629 53.7428C26.5069 51.004 24.6927 47.9686 23.0803 44.8376C22.2946 43.3173 21.6103 41.6553 20.9731 40.1395C20.6801 39.5551 20.6802 38.6718 20.1895 38.379C19.4529 39.4542 18.3783 40.3852 17.8405 41.7022C16.9093 43.8086 16.8121 46.4013 16.4668 49.0936C16.2722 49.1447 16.3705 49.0936 16.2722 49.1908C14.7069 48.7996 14.1681 47.1853 13.579 45.8198C12.1101 42.3413 11.8631 36.7637 13.1386 32.7511C13.4796 31.7256 14.9528 28.4963 14.3627 27.5178C14.0666 26.5843 13.0883 26.0511 12.5505 25.3141C11.9154 24.3847 11.226 23.2128 10.7897 22.1831C9.61363 19.4441 9.02248 16.4093 7.75333 13.6703C7.16532 12.396 6.13473 11.0746 5.30503 9.90268C4.37279 8.58128 3.34534 7.65192 2.6098 6.08798C2.36706 5.54855 2.02387 4.66727 2.41415 4.08184C2.5104 3.68981 2.7092 3.5424 3.10155 3.44413C3.73456 2.90575 5.5488 3.58945 6.1839 3.88321C7.99711 4.61499 9.51527 5.30391 11.0313 6.32945C11.7177 6.81974 12.4522 7.74913 13.3321 7.99584H14.3627C15.929 8.3356 17.693 8.09098 19.163 8.53318C21.7568 9.36428 24.1067 10.5874 26.2139 11.9088C32.6266 15.9702 37.9156 21.7451 41.4886 28.6427C42.0777 29.7665 42.3246 30.7952 42.8624 31.9671C43.8909 34.3694 45.1653 36.8157 46.1917 39.1619C47.2191 41.4618 48.2005 43.8083 49.6716 45.7194C50.404 46.7452 53.343 47.2835 54.6655 47.8221C55.6428 48.261 57.163 48.653 58.045 49.1905C59.7096 50.2163 61.3711 51.3923 62.9406 52.5195C63.7221 53.1067 66.1715 54.3285 66.319 55.3085" fill="#00758F"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M16.3702 12.7857C15.5394 12.7857 14.9535 12.886 14.3623 13.0314V13.1296H14.4575C14.853 13.9106 15.5394 14.4532 16.0249 15.1369C16.4194 15.9199 16.7625 16.6998 17.1539 17.4839C17.202 17.4358 17.2491 17.3846 17.2491 17.3846C17.9396 16.8974 18.2818 16.1154 18.2818 14.9393C17.9857 14.5943 17.9396 14.2545 17.6927 13.9105C17.3997 13.4223 16.7625 13.1777 16.3702 12.7857Z" fill="#00758F"/>
-</g>
-<defs>
-<clipPath id="clip0_6745_29853">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#00758f" fill-rule="evenodd" clip-path="url(#clip0_6745_29853)" clip-rule="evenodd"><path d="M66.319 55.31c-3.92-.099-6.955.292-9.5 1.37-.735.293-1.909.293-2.01 1.222.395.391.443 1.027.788 1.567.586.979 1.612 2.298 2.544 2.985 1.029.783 2.057 1.563 3.136 2.248 1.908 1.179 4.064 1.861 5.922 3.036 1.08.684 2.154 1.564 3.235 2.3.537.39.877 1.028 1.565 1.27v-.148c-.345-.44-.441-1.075-.782-1.567-.489-.486-.98-.929-1.47-1.416-1.421-1.908-3.186-3.57-5.092-4.94-1.568-1.08-4.998-2.547-5.632-4.352l-.1-.1c1.079-.1 2.354-.492 3.381-.789 1.663-.439 3.181-.34 4.895-.778.785-.198 1.568-.444 2.355-.685v-.443c-.886-.879-1.52-2.055-2.45-2.886-2.496-2.152-5.241-4.254-8.08-6.018-1.521-.98-3.48-1.612-5.096-2.446-.585-.294-1.563-.439-1.907-.931-.883-1.076-1.374-2.493-2.01-3.767-1.418-2.688-2.792-5.672-4.014-8.514-.88-1.907-1.42-3.814-2.497-5.576-5.047-8.32-10.53-13.357-18.952-18.3-1.812-1.028-3.966-1.468-6.266-2.007-1.226-.05-2.45-.146-3.673-.194-.785-.344-1.57-1.274-2.254-1.714C9.562 1.977 2.367-1.84.309 3.199c-1.322 3.182 1.959 6.312 3.086 7.928.831 1.123 1.91 2.398 2.495 3.668.343.832.441 1.714.786 2.594.782 2.152 1.516 4.55 2.546 6.557.537 1.028 1.124 2.106 1.81 3.031.395.541 1.078.783 1.226 1.666-.684.978-.737 2.446-1.128 3.67-1.762 5.529-1.078 12.378 1.42 16.439.782 1.223 2.645 3.915 5.143 2.885 2.203-.88 1.714-3.668 2.35-6.113.146-.592.048-.98.341-1.37v.098c.685 1.368 1.373 2.686 2.009 4.06 1.52 2.396 4.162 4.892 6.368 6.554 1.171.884 2.103 2.398 3.572 2.938v-.148h-.097c-.295-.439-.734-.636-1.126-.977-.881-.881-1.859-1.958-2.547-2.936-2.056-2.739-3.87-5.774-5.483-8.905-.785-1.52-1.47-3.183-2.107-4.699-.293-.584-.293-1.467-.784-1.76-.736 1.075-1.81 2.006-2.349 3.323-.93 2.107-1.028 4.7-1.373 7.392-.195.05-.096 0-.195.097-1.565-.391-2.104-2.006-2.693-3.371-1.469-3.479-1.716-9.056-.44-13.069.34-1.025 1.814-4.255 1.224-5.233-.296-.934-1.275-1.467-1.812-2.204-.636-.93-1.325-2.101-1.761-3.13-1.176-2.74-1.768-5.775-3.037-8.514-.588-1.274-1.618-2.595-2.448-3.767-.932-1.322-1.96-2.251-2.695-3.815-.243-.54-.586-1.42-.196-2.006.096-.392.295-.54.688-.638.633-.538 2.447.145 3.082.44 1.813.731 3.331 1.42 4.847 2.445.687.49 1.421 1.42 2.301 1.667h1.03c1.567.34 3.331.095 4.801.537 2.594.831 4.944 2.054 7.05 3.376 6.414 4.061 11.703 9.836 15.276 16.734.589 1.124.836 2.152 1.373 3.324 1.029 2.402 2.303 4.849 3.33 7.195 1.027 2.3 2.008 4.646 3.48 6.557.732 1.026 3.671 1.564 4.994 2.103.977.439 2.497.831 3.379 1.368 1.665 1.026 3.326 2.202 4.896 3.33.781.587 3.23 1.808 3.378 2.788"/><path d="M16.37 12.786c-.83 0-1.417.1-2.008.245v.099h.095c.396.78 1.082 1.323 1.568 2.007.394.783.738 1.563 1.129 2.347.048-.048.095-.1.095-.1.69-.487 1.033-1.269 1.033-2.445-.296-.345-.342-.684-.59-1.028-.292-.489-.93-.733-1.322-1.125"/></g><defs><clipPath id="clip0_6745_29853"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/namecheap.svg b/web/packages/design/src/ResourceIcon/assets/namecheap.svg
index d0246d18cdea1..e36253e7d760d 100644
--- a/web/packages/design/src/ResourceIcon/assets/namecheap.svg
+++ b/web/packages/design/src/ResourceIcon/assets/namecheap.svg
@@ -1,31 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M65.2714 16.042C64.0689 16.0421 62.8883 16.3639 61.852 16.9739C60.8157 17.5839 59.9614 18.46 59.3777 19.5114L59.2406 19.7941L53.9894 30.2109L47.3076 43.3775L51.6851 52.0038L51.9249 52.475C52.5999 53.6688 53.6174 54.6327 54.8461 55.242C56.0732 54.6305 57.0902 53.6672 57.7672 52.475L58.0071 52.0038L71.1223 26.1247L71.4392 25.4993C71.8853 24.4757 72.0698 23.3573 71.9761 22.2447C71.8825 21.132 71.5136 20.0602 70.9027 19.1255C70.2918 18.1909 69.4581 17.4229 68.4765 16.8906C67.495 16.3583 66.3965 16.0785 65.28 16.0763L65.2714 16.042Z" fill="#FF5100"/>
-<path d="M24.7353 28.5748L20.3664 20.0084L20.1266 19.5372C19.4572 18.3442 18.4416 17.3823 17.214 16.7788C15.9885 17.3814 14.9734 18.3398 14.3014 19.5286L14.053 20.0084L0.920651 45.8618L0.603694 46.4786C-0.104499 48.0645 -0.172453 49.8628 0.414029 51.4976C1.00051 53.1325 2.19606 54.4774 3.75088 55.2515C5.3057 56.0256 7.0995 56.1689 8.75751 55.6516C10.4155 55.1342 11.8095 53.9961 12.6481 52.4751L12.7937 52.201L18.0792 41.7842L24.7524 28.6262L24.7353 28.5748Z" fill="#FF5100"/>
-<path d="M65.2537 16.042C64.0524 16.0427 62.8733 16.3648 61.8384 16.9749C60.8036 17.5849 59.9508 18.4607 59.3686 19.5114L59.2229 19.7941L53.9374 30.2109L47.2471 43.3775L51.6331 52.0038L51.8729 52.475C52.5453 53.6708 53.5636 54.6353 54.7941 55.242C56.0246 54.6353 57.0428 53.6708 57.7152 52.475L57.9637 52.0038L71.1217 26.1247L71.4301 25.4993C71.8761 24.4757 72.0606 23.3573 71.967 22.2447C71.8733 21.132 71.5044 20.0602 70.8935 19.1255C70.2826 18.1909 69.4489 17.4229 68.4674 16.8906C67.4859 16.3583 66.3874 16.0785 65.2708 16.0763L65.2537 16.042Z" fill="url(#paint0_linear_16907_11758)"/>
-<path d="M6.75416 55.9441C7.95115 55.9476 9.12743 55.632 10.1619 55.0297C11.1963 54.4274 12.0515 53.5602 12.6393 52.5175L12.7849 52.2348L18.079 41.8181L24.7608 28.6515L20.3833 19.9822L20.1435 19.5111C19.4663 18.316 18.4456 17.352 17.2138 16.7441C15.9851 17.3534 14.9675 18.3173 14.2926 19.5111L14.0528 19.9822L0.877592 45.8614L0.560634 46.4868C0.114576 47.5104 -0.0699285 48.6288 0.0237322 49.7414C0.117393 50.8541 0.486278 51.9259 1.09718 52.8606C1.70808 53.7952 2.54182 54.5632 3.52333 55.0955C4.50485 55.6278 5.60333 55.9076 6.71989 55.9098L6.75416 55.9441Z" fill="url(#paint1_linear_16907_11758)"/>
-<path d="M24.735 28.5746L20.3661 20.0082L20.1262 19.537C19.4538 18.3412 18.4356 17.3767 17.2051 16.7701C17.6142 16.5697 18.0416 16.409 18.4815 16.2903C19.0415 16.1484 19.617 16.0765 20.1948 16.0762H29.3437C30.5382 16.0795 31.7106 16.3981 32.7425 16.9997C33.7743 17.6014 34.6291 18.4648 35.2203 19.5027L35.4601 19.9739L47.2904 43.4116L51.6507 51.9781L51.8905 52.4492C52.5705 53.6576 53.601 54.6314 54.846 55.2419C53.9194 55.6923 52.9036 55.9294 51.8734 55.9357H42.6731C41.4799 55.9318 40.3089 55.6129 39.2785 55.0112C38.2481 54.4095 37.3949 53.5464 36.8051 52.5092L36.5566 52.038L24.735 28.5746Z" fill="#FF8C44"/>
-<defs>
-<linearGradient id="paint0_linear_16907_11758" x1="50.5537" y1="53.2631" x2="67.7037" y2="16.4874" gradientUnits="userSpaceOnUse">
-<stop stop-color="#D4202C"/>
-<stop offset="0.1" stop-color="#DC3D29" stop-opacity="0.79"/>
-<stop offset="0.2" stop-color="#E45926" stop-opacity="0.58"/>
-<stop offset="0.32" stop-color="#EA7123" stop-opacity="0.4"/>
-<stop offset="0.43" stop-color="#F08521" stop-opacity="0.25"/>
-<stop offset="0.55" stop-color="#F4941F" stop-opacity="0.14"/>
-<stop offset="0.68" stop-color="#F79F1E" stop-opacity="0.06"/>
-<stop offset="0.82" stop-color="#F8A51D" stop-opacity="0.02"/>
-<stop offset="1" stop-color="#F9A71D" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint1_linear_16907_11758" x1="21.4541" y1="18.723" x2="4.30416" y2="55.4986" gradientUnits="userSpaceOnUse">
-<stop stop-color="#D4202C"/>
-<stop offset="0.1" stop-color="#DC3D29" stop-opacity="0.79"/>
-<stop offset="0.2" stop-color="#E45926" stop-opacity="0.58"/>
-<stop offset="0.32" stop-color="#EA7123" stop-opacity="0.4"/>
-<stop offset="0.43" stop-color="#F08521" stop-opacity="0.25"/>
-<stop offset="0.55" stop-color="#F4941F" stop-opacity="0.14"/>
-<stop offset="0.68" stop-color="#F79F1E" stop-opacity="0.06"/>
-<stop offset="0.82" stop-color="#F8A51D" stop-opacity="0.02"/>
-<stop offset="1" stop-color="#F9A71D" stop-opacity="0"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff5100" d="M65.271 16.042a6.74 6.74 0 0 0-5.893 3.47l-.137.282-5.252 10.417-6.681 13.167 4.377 8.626.24.471a6.85 6.85 0 0 0 2.921 2.767 6.9 6.9 0 0 0 2.921-2.767l.24-.471 13.115-25.88.317-.625a6.732 6.732 0 0 0-6.159-9.423zM24.735 28.575l-4.369-8.567-.24-.47a6.76 6.76 0 0 0-2.912-2.76 6.8 6.8 0 0 0-2.913 2.75l-.248.48L.921 45.862l-.317.617a6.733 6.733 0 0 0 12.044 5.996l.146-.274 5.285-10.417 6.673-13.158z"/><path fill="url(#paint0_linear_16907_11758)" d="M65.254 16.042a6.73 6.73 0 0 0-5.885 3.47l-.146.282-5.286 10.417-6.69 13.167 4.386 8.626.24.471a6.8 6.8 0 0 0 2.921 2.767 6.8 6.8 0 0 0 2.921-2.767l.249-.471 13.158-25.88.308-.625a6.734 6.734 0 0 0-6.16-9.423z"/><path fill="url(#paint1_linear_16907_11758)" d="M6.754 55.944a6.73 6.73 0 0 0 5.885-3.427l.146-.282 5.294-10.417 6.682-13.166-4.378-8.67-.24-.47a6.85 6.85 0 0 0-2.93-2.768 6.85 6.85 0 0 0-2.92 2.767l-.24.471L.878 45.862l-.317.625A6.733 6.733 0 0 0 6.72 55.91z"/><path fill="#ff8c44" d="m24.735 28.575-4.369-8.567-.24-.471a6.8 6.8 0 0 0-2.92-2.767q.614-.3 1.276-.48a7 7 0 0 1 1.713-.214h9.149a6.79 6.79 0 0 1 5.876 3.427l.24.47 11.83 23.439 4.36 8.566.24.471a6.85 6.85 0 0 0 2.956 2.793 6.9 6.9 0 0 1-2.973.694h-9.2a6.78 6.78 0 0 1-5.868-3.427l-.248-.471z"/><defs><linearGradient id="paint0_linear_16907_11758" x1="50.554" x2="67.704" y1="53.263" y2="16.487" gradientUnits="userSpaceOnUse"><stop stop-color="#d4202c"/><stop offset=".1" stop-color="#dc3d29" stop-opacity=".79"/><stop offset=".2" stop-color="#e45926" stop-opacity=".58"/><stop offset=".32" stop-color="#ea7123" stop-opacity=".4"/><stop offset=".43" stop-color="#f08521" stop-opacity=".25"/><stop offset=".55" stop-color="#f4941f" stop-opacity=".14"/><stop offset=".68" stop-color="#f79f1e" stop-opacity=".06"/><stop offset=".82" stop-color="#f8a51d" stop-opacity=".02"/><stop offset="1" stop-color="#f9a71d" stop-opacity="0"/></linearGradient><linearGradient id="paint1_linear_16907_11758" x1="21.454" x2="4.304" y1="18.723" y2="55.499" gradientUnits="userSpaceOnUse"><stop stop-color="#d4202c"/><stop offset=".1" stop-color="#dc3d29" stop-opacity=".79"/><stop offset=".2" stop-color="#e45926" stop-opacity=".58"/><stop offset=".32" stop-color="#ea7123" stop-opacity=".4"/><stop offset=".43" stop-color="#f08521" stop-opacity=".25"/><stop offset=".55" stop-color="#f4941f" stop-opacity=".14"/><stop offset=".68" stop-color="#f79f1e" stop-opacity=".06"/><stop offset=".82" stop-color="#f8a51d" stop-opacity=".02"/><stop offset="1" stop-color="#f9a71d" stop-opacity="0"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/navan-dark.svg b/web/packages/design/src/ResourceIcon/assets/navan-dark.svg
index 0fb6851ef8e26..7e8c2ef4c9a78 100644
--- a/web/packages/design/src/ResourceIcon/assets/navan-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/navan-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M13.8397 43.8653H10.5606C10.378 33.396 9.92861 30.8331 8.4962 30.8331C6.53716 30.8331 4.80983 36.7453 2.92101 43.8653H0V28.1368H3.21592V35.327C4.58514 31.0578 6.20012 27.9121 8.96665 27.9121C12.969 27.9121 13.636 32.8132 13.8397 43.8653ZM29.9754 43.8653H26.9842C24 41.0777 21.3248 38.9221 19.6606 38.9221C18.9444 38.9221 18.5161 39.3434 18.3335 40.207L17.5541 43.8653H15.1317C16.9854 36.3381 17.9754 27.9121 22.5606 27.9121C27.1457 27.9121 28.1287 36.317 29.9754 43.8653ZM19.1621 36.633C19.3446 36.6049 19.5483 36.5838 19.7519 36.5838C21.5916 36.5838 23.5927 37.8477 25.7063 39.5751C24.5126 34.1824 23.5295 30.8331 22.1322 30.8331C20.9666 30.8331 20.0679 33.059 19.1691 36.633H19.1621ZM28.6905 28.1368H32.0187C33.5916 35.5095 34.687 41.169 36.3721 41.169C38.0573 41.169 39.3072 35.2848 40.8309 28.1368H43.2534C41.3856 35.664 40.4236 44.09 35.9719 44.09C31.5272 44.09 30.5372 35.664 28.6905 28.1368ZM56.8051 43.8653H53.8139C50.8227 41.0777 48.1545 38.9221 46.4903 38.9221C45.7671 38.9221 45.3458 39.3434 45.1633 40.207L44.3768 43.8653H41.9473C43.8151 36.3381 44.8051 27.9121 49.3903 27.9121C53.9754 27.9121 54.9585 36.317 56.8051 43.8653ZM45.9918 36.633C46.1744 36.6049 46.378 36.5838 46.5816 36.5838C48.4213 36.5838 50.4225 37.8477 52.536 39.5751C51.3423 34.1824 50.3593 30.8331 48.9549 30.8331C47.7894 30.8331 46.8906 33.059 45.9918 36.633ZM71.993 43.8653H68.7068C68.5313 33.396 68.0749 30.8331 66.6425 30.8331C64.6905 30.8331 62.9561 36.7453 61.0673 43.8653H58.1463V28.1368H61.3692V35.327C62.7314 31.0578 64.3534 27.9121 67.127 27.9121C71.1223 27.9121 71.7964 32.8132 72 43.8653H71.993Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M13.84 43.865h-3.28c-.182-10.469-.631-13.032-2.064-13.032-1.959 0-3.686 5.912-5.575 13.032H0V28.137h3.216v7.19c1.37-4.27 2.984-7.415 5.75-7.415 4.003 0 4.67 4.901 4.874 15.953m16.135 0h-2.99c-2.985-2.787-5.66-4.943-7.324-4.943-.717 0-1.145.421-1.328 1.285l-.779 3.658h-2.422c1.853-7.527 2.843-15.953 7.429-15.953 4.585 0 5.568 8.405 7.414 15.953m-10.813-7.232c.183-.028.386-.05.59-.05 1.84 0 3.84 1.265 5.954 2.992-1.193-5.393-2.177-8.742-3.574-8.742-1.165 0-2.064 2.226-2.963 5.8zm9.529-8.496h3.328c1.573 7.373 2.668 13.032 4.353 13.032s2.935-5.884 4.459-13.032h2.422c-1.867 7.527-2.83 15.953-7.281 15.953-4.445 0-5.435-8.426-7.282-15.953m28.114 15.728h-2.991c-2.991-2.787-5.66-4.943-7.324-4.943-.723 0-1.144.421-1.327 1.285l-.786 3.658h-2.43c1.868-7.527 2.858-15.953 7.443-15.953s5.569 8.405 7.415 15.953m-10.813-7.232a4 4 0 0 1 .59-.05c1.84 0 3.84 1.265 5.954 2.992-1.194-5.393-2.177-8.742-3.581-8.742-1.166 0-2.064 2.226-2.963 5.8m26.001 7.232h-3.286c-.176-10.469-.632-13.032-2.064-13.032-1.953 0-3.687 5.912-5.576 13.032h-2.92V28.137h3.222v7.19c1.362-4.27 2.984-7.415 5.758-7.415 3.995 0 4.67 4.901 4.873 15.953z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/navan-light.svg b/web/packages/design/src/ResourceIcon/assets/navan-light.svg
index 107aa1dfee440..902a0d49f3052 100644
--- a/web/packages/design/src/ResourceIcon/assets/navan-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/navan-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M13.8397 43.8653H10.5606C10.378 33.396 9.92861 30.8331 8.4962 30.8331C6.53716 30.8331 4.80983 36.7453 2.92101 43.8653H0V28.1368H3.21592V35.327C4.58514 31.0578 6.20012 27.9121 8.96665 27.9121C12.969 27.9121 13.636 32.8132 13.8397 43.8653ZM29.9754 43.8653H26.9842C24 41.0777 21.3248 38.9221 19.6606 38.9221C18.9444 38.9221 18.5161 39.3434 18.3335 40.207L17.5541 43.8653H15.1317C16.9854 36.3381 17.9754 27.9121 22.5606 27.9121C27.1457 27.9121 28.1287 36.317 29.9754 43.8653ZM19.1621 36.633C19.3446 36.6049 19.5483 36.5838 19.7519 36.5838C21.5916 36.5838 23.5927 37.8477 25.7063 39.5751C24.5126 34.1824 23.5295 30.8331 22.1322 30.8331C20.9666 30.8331 20.0679 33.059 19.1691 36.633H19.1621ZM28.6905 28.1368H32.0187C33.5916 35.5095 34.687 41.169 36.3721 41.169C38.0573 41.169 39.3072 35.2848 40.8309 28.1368H43.2534C41.3856 35.664 40.4236 44.09 35.9719 44.09C31.5272 44.09 30.5372 35.664 28.6905 28.1368ZM56.8051 43.8653H53.8139C50.8227 41.0777 48.1545 38.9221 46.4903 38.9221C45.7671 38.9221 45.3458 39.3434 45.1633 40.207L44.3768 43.8653H41.9473C43.8151 36.3381 44.8051 27.9121 49.3903 27.9121C53.9754 27.9121 54.9585 36.317 56.8051 43.8653ZM45.9918 36.633C46.1744 36.6049 46.378 36.5838 46.5816 36.5838C48.4213 36.5838 50.4225 37.8477 52.536 39.5751C51.3423 34.1824 50.3593 30.8331 48.9549 30.8331C47.7894 30.8331 46.8906 33.059 45.9918 36.633ZM71.993 43.8653H68.7068C68.5313 33.396 68.0749 30.8331 66.6425 30.8331C64.6905 30.8331 62.9561 36.7453 61.0673 43.8653H58.1463V28.1368H61.3692V35.327C62.7314 31.0578 64.3534 27.9121 67.127 27.9121C71.1223 27.9121 71.7964 32.8132 72 43.8653H71.993Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M13.84 43.865h-3.28c-.182-10.469-.631-13.032-2.064-13.032-1.959 0-3.686 5.912-5.575 13.032H0V28.137h3.216v7.19c1.37-4.27 2.984-7.415 5.75-7.415 4.003 0 4.67 4.901 4.874 15.953m16.135 0h-2.99c-2.985-2.787-5.66-4.943-7.324-4.943-.717 0-1.145.421-1.328 1.285l-.779 3.658h-2.422c1.853-7.527 2.843-15.953 7.429-15.953 4.585 0 5.568 8.405 7.414 15.953m-10.813-7.232c.183-.028.386-.05.59-.05 1.84 0 3.84 1.265 5.954 2.992-1.193-5.393-2.177-8.742-3.574-8.742-1.165 0-2.064 2.226-2.963 5.8zm9.529-8.496h3.328c1.573 7.373 2.668 13.032 4.353 13.032s2.935-5.884 4.459-13.032h2.422c-1.867 7.527-2.83 15.953-7.281 15.953-4.445 0-5.435-8.426-7.282-15.953m28.114 15.728h-2.991c-2.991-2.787-5.66-4.943-7.324-4.943-.723 0-1.144.421-1.327 1.285l-.786 3.658h-2.43c1.868-7.527 2.858-15.953 7.443-15.953s5.569 8.405 7.415 15.953m-10.813-7.232a4 4 0 0 1 .59-.05c1.84 0 3.84 1.265 5.954 2.992-1.194-5.393-2.177-8.742-3.581-8.742-1.166 0-2.064 2.226-2.963 5.8m26.001 7.232h-3.286c-.176-10.469-.632-13.032-2.064-13.032-1.953 0-3.687 5.912-5.576 13.032h-2.92V28.137h3.222v7.19c1.362-4.27 2.984-7.415 5.758-7.415 3.995 0 4.67 4.901 4.873 15.953z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/neverbounce-dark.svg b/web/packages/design/src/ResourceIcon/assets/neverbounce-dark.svg
index 7e4d02da7c4fd..2fb15b307f697 100644
--- a/web/packages/design/src/ResourceIcon/assets/neverbounce-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/neverbounce-dark.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11770)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M32.7099 19.6621L29.6445 24.8446H5.60844V30.3535H26.4585L23.6137 35.2567H5.60844V47.1163H16.4757L13.583 52.2987H0V19.6621H32.7099Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M37.6811 19.6621L34.7156 24.8446L64.1395 24.8751L41.916 35.98L31.0426 30.8759L28.1541 35.7703L41.8952 41.8916L66.5119 29.6237L66.591 47.1163H21.3324L18.3877 52.2987H71.9997V19.6621H37.6811Z" fill="#F5EE33"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11770">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_16907_11770)" clip-rule="evenodd"><path fill="#fff" d="m32.71 19.662-3.065 5.183H5.608v5.509h20.85l-2.844 4.903H5.608v11.86h10.868l-2.893 5.182H0V19.662z"/><path fill="#f5ee33" d="m37.681 19.662-2.965 5.183 29.423.03L41.917 35.98l-10.873-5.104-2.889 4.894 13.741 6.122 24.617-12.268.079 17.492h-45.26L18.388 52.3H72V19.662z"/></g><defs><clipPath id="clip0_16907_11770"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/neverbounce-light.svg b/web/packages/design/src/ResourceIcon/assets/neverbounce-light.svg
index 4d40e7f24cb27..77dd384d8b375 100644
--- a/web/packages/design/src/ResourceIcon/assets/neverbounce-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/neverbounce-light.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11771)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M32.7099 19.6621L29.6445 24.8446H5.60844V30.3535H26.4585L23.6137 35.2567H5.60844V47.1163H16.4757L13.583 52.2987H0V19.6621H32.7099Z" fill="#030021"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M37.6811 19.6621L34.7156 24.8446L64.1395 24.8751L41.916 35.98L31.0426 30.8759L28.1541 35.7703L41.8952 41.8916L66.5119 29.6237L66.591 47.1163H21.3324L18.3877 52.2987H71.9997V19.6621H37.6811Z" fill="#1E9FC4"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11771">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_16907_11771)" clip-rule="evenodd"><path fill="#030021" d="m32.71 19.662-3.065 5.183H5.608v5.509h20.85l-2.844 4.903H5.608v11.86h10.868l-2.893 5.182H0V19.662z"/><path fill="#1e9fc4" d="m37.681 19.662-2.965 5.183 29.423.03L41.917 35.98l-10.873-5.104-2.889 4.894 13.741 6.122 24.617-12.268.079 17.492h-45.26L18.388 52.3H72V19.662z"/></g><defs><clipPath id="clip0_16907_11771"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/notion.svg b/web/packages/design/src/ResourceIcon/assets/notion.svg
index 65b5b3d60db42..16b92f8039aa6 100644
--- a/web/packages/design/src/ResourceIcon/assets/notion.svg
+++ b/web/packages/design/src/ResourceIcon/assets/notion.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16907_11764)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M6.93132 2.94185L44.5584 0.162882C46.8538 -0.0338446 48.5884 -0.100578 50.1618 0.257031C51.803 0.630032 53.0926 1.42076 54.5966 2.51334L66.6117 10.9777L66.6277 10.9894C66.7305 11.0649 66.8341 11.1405 66.9378 11.2161C67.711 11.7799 68.4908 12.3485 69.0225 12.9659C69.8149 13.8863 70.0843 14.8809 70.0843 16.0375V62.4424C70.0843 64.0816 69.7978 65.8329 68.5965 67.2002C67.3779 68.5871 65.5755 69.1793 63.4731 69.3288L63.4625 69.3295L19.7449 71.9761L19.7318 71.9767C18.2771 72.0457 16.9249 71.9979 15.68 71.5424C14.3664 71.0618 13.3904 70.2124 12.5149 69.0965L12.5089 69.0889L3.651 57.5704L3.64356 57.5605C1.9167 55.2563 1 53.2557 1 50.8077V9.55942C1 8.1045 1.31984 6.52161 2.32979 5.22526C3.38066 3.87639 4.96312 3.11235 6.91867 2.94294L6.93132 2.94185Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.7175 2.15654L7.09129 4.93544C4.05625 5.19837 3 7.18168 3 9.55939V50.8077C3 52.6596 3.65733 54.2439 5.24397 56.361L14.0884 67.8619C15.5413 69.7138 16.8628 70.1104 19.6371 69.979L63.3312 67.3338C67.0258 67.0709 68.0843 65.3505 68.0843 62.4424V16.0374C68.0843 14.5347 67.4905 14.1017 65.7429 12.8188C65.6423 12.7464 65.5418 12.6738 65.4414 12.6012L53.4327 4.13985C50.5269 2.02734 49.3392 1.75988 44.7175 2.15654ZM20.6254 15.2781C17.0577 15.5184 16.2485 15.5728 14.2221 13.9249L9.07006 9.82685C8.54647 9.29646 8.8094 8.6346 10.1286 8.50313L46.2996 5.86023C49.3369 5.59503 50.919 6.65356 52.1068 7.57834L58.3106 12.0731C58.5758 12.2068 59.2353 12.9979 58.442 12.9979L21.0878 15.2464L20.6254 15.2781ZM16.4661 62.0457V22.6515C16.4661 20.9311 16.9942 20.1378 18.5764 20.0041L61.4793 17.4926C62.9345 17.3612 63.5918 18.286 63.5918 20.0041V59.1353C63.5918 60.8557 63.3266 62.3109 60.9512 62.4424L19.8955 64.8223C17.5201 64.9538 16.4661 64.1628 16.4661 62.0457ZM56.9936 24.764C57.2566 25.954 56.9936 27.144 55.8037 27.28L53.8249 27.6721V56.7576C52.1068 57.6824 50.5247 58.2106 49.2032 58.2106C47.0907 58.2106 46.5626 57.5487 44.9804 55.5677L32.0402 35.2087V54.9058L36.1337 55.8329C36.1337 55.8329 36.1338 58.2128 32.8313 58.2128L23.7262 58.7409C23.461 58.2106 23.7262 56.8891 24.6487 56.6262L27.0264 55.9666V29.9229L23.7262 29.6554C23.461 28.4654 24.1206 26.7473 25.9701 26.6136L35.7394 25.9563L49.2032 46.5782V28.334L45.7715 27.9396C45.5063 26.4821 46.5626 25.4236 47.8817 25.2944L56.9936 24.764Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16907_11764">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill-rule="evenodd" clip-path="url(#clip0_16907_11764)" clip-rule="evenodd"><path fill="#fff" d="M6.931 2.942 44.558.162c2.296-.196 4.03-.263 5.604.095 1.641.373 2.93 1.164 4.435 2.256l12.015 8.465.016.011.31.227c.773.564 1.553 1.133 2.084 1.75.793.92 1.062 1.915 1.062 3.072v46.404c0 1.64-.286 3.39-1.487 4.758-1.22 1.387-3.021 1.98-5.124 2.129h-.01l-43.718 2.647h-.013c-1.455.07-2.807.022-4.052-.434-1.314-.48-2.29-1.33-3.165-2.445l-.006-.008L3.65 57.57l-.007-.01C1.917 55.256 1 53.256 1 50.808V9.559c0-1.454.32-3.037 1.33-4.334 1.05-1.349 2.633-2.113 4.589-2.282z"/><path fill="#000" d="M44.718 2.157 7.09 4.935C4.056 5.198 3 7.182 3 9.56v41.249c0 1.852.657 3.436 2.244 5.553l8.844 11.5c1.453 1.853 2.775 2.25 5.55 2.118l43.693-2.645c3.695-.263 4.753-1.984 4.753-4.892V16.037c0-1.502-.594-1.935-2.341-3.218l-.302-.218L53.433 4.14c-2.906-2.113-4.094-2.38-8.715-1.983M20.625 15.278c-3.567.24-4.376.295-6.403-1.353L9.07 9.827c-.524-.53-.26-1.192 1.059-1.324l36.17-2.643c3.038-.265 4.62.794 5.808 1.718l6.204 4.495c.265.134.924.925.131.925l-37.354 2.248zm-4.159 46.768V22.652c0-1.72.528-2.514 2.11-2.648l42.903-2.511c1.456-.132 2.113.793 2.113 2.511v39.131c0 1.72-.265 3.176-2.64 3.307l-41.056 2.38c-2.376.132-3.43-.66-3.43-2.776m40.528-37.282c.263 1.19 0 2.38-1.19 2.516l-1.98.392v29.086c-1.717.924-3.3 1.453-4.62 1.453-2.113 0-2.641-.662-4.224-2.643l-12.94-20.36v19.698l4.094.927s0 2.38-3.303 2.38l-9.105.528c-.265-.53 0-1.852.923-2.115l2.377-.66V29.924l-3.3-.268c-.265-1.19.395-2.908 2.244-3.041l9.77-.658 13.463 20.622V28.334l-3.431-.394c-.266-1.458.79-2.516 2.11-2.646z"/></g><defs><clipPath id="clip0_16907_11764"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/oasisopen.svg b/web/packages/design/src/ResourceIcon/assets/oasisopen.svg
index f52e65ab7b8c1..b0760a5f79cf1 100644
--- a/web/packages/design/src/ResourceIcon/assets/oasisopen.svg
+++ b/web/packages/design/src/ResourceIcon/assets/oasisopen.svg
@@ -1,14 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M12 0.240428C12 0.160714 12 0.0797141 12.0026 0H23.988C23.9828 0.0797141 23.9828 0.160714 23.9828 0.240428C23.9806 2.96668 24.9101 5.61182 26.6173 7.73741C27.7374 9.14204 29.1596 10.2762 30.7783 11.0557C32.3969 11.8352 34.1704 12.24 35.967 12.24C37.9881 12.2389 40.0013 12.4938 41.9584 12.9985C52.2826 15.669 59.9339 25.0778 59.9339 36.2404C59.9392 41.0588 58.4871 45.7661 55.7682 49.7442C52.7276 47.0534 49.1711 45.0096 45.3154 43.7374C47.0228 41.6114 47.9523 38.9658 47.9498 36.2391C47.9487 34.1344 47.3947 32.0669 46.3432 30.2436C45.2917 28.4204 43.7796 26.9055 41.9584 25.8505C40.1944 24.8284 38.1475 24.2395 35.967 24.2395C30.1326 24.2441 24.4989 22.1097 20.1321 18.2404C18.6279 16.9127 17.2955 15.4023 16.1657 13.7443C13.539 9.89612 12 5.24442 12 0.240428Z" fill="url(#paint0_linear_7996_40361)"/>
-<path d="M29.9743 59.481C19.65 56.8106 12 47.403 12 36.2405C11.9937 31.4219 13.4449 26.7141 16.1632 22.7354C19.204 25.4259 22.7604 27.4696 26.616 28.7422C24.909 30.8683 23.98 33.514 23.9829 36.2405C23.9839 38.3452 24.5379 40.4127 25.5894 42.2359C26.6409 44.0592 28.153 45.5741 29.9743 46.629C31.7941 47.6858 33.8613 48.2416 35.9657 48.24C41.8011 48.2352 47.4359 50.3701 51.8031 54.2405C53.3072 55.5678 54.6396 57.0778 55.7695 58.7353C58.4414 62.6464 59.89 67.2636 59.9314 72H47.9485C47.8965 69.3563 46.9706 66.8042 45.3154 64.7422C44.1953 63.3375 42.773 62.2033 41.1544 61.4238C39.5357 60.6443 37.7623 60.2396 35.9657 60.2396C33.8983 60.2396 31.89 59.976 29.9743 59.481Z" fill="url(#paint1_linear_7996_40361)"/>
-<defs>
-<linearGradient id="paint0_linear_7996_40361" x1="60" y1="36" x2="12" y2="35.9999" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2148E4"/>
-<stop offset="1" stop-color="#80E8FF"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7996_40361" x1="60" y1="36" x2="12" y2="35.9999" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2148E4"/>
-<stop offset="1" stop-color="#80E8FF"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_7996_40361)" d="M12 .24q0-.12.003-.24h11.985q-.006.12-.005.24a11.96 11.96 0 0 0 2.634 7.497 11.96 11.96 0 0 0 9.35 4.503 24 24 0 0 1 5.991.758c10.325 2.671 17.976 12.08 17.976 23.242a23.9 23.9 0 0 1-4.166 13.504 29.9 29.9 0 0 0-10.453-6.007 11.96 11.96 0 0 0 2.635-7.498 12.01 12.01 0 0 0-5.992-10.388 11.9 11.9 0 0 0-5.991-1.611 23.85 23.85 0 0 1-15.835-6 24 24 0 0 1-3.966-4.496A23.9 23.9 0 0 1 12 .24"/><path fill="url(#paint1_linear_7996_40361)" d="M29.974 59.481C19.65 56.811 12 47.403 12 36.241a23.9 23.9 0 0 1 4.163-13.506 29.9 29.9 0 0 0 10.453 6.007 11.96 11.96 0 0 0-2.633 7.498 12.01 12.01 0 0 0 5.991 10.389 11.9 11.9 0 0 0 5.992 1.611 23.85 23.85 0 0 1 15.837 6 24 24 0 0 1 3.967 4.495A23.9 23.9 0 0 1 59.93 72H47.95a11.97 11.97 0 0 0-2.634-7.258 11.96 11.96 0 0 0-9.35-4.502c-2.067 0-4.075-.264-5.99-.759"/><defs><linearGradient id="paint0_linear_7996_40361" x1="60" x2="12" y1="36" y2="36" gradientUnits="userSpaceOnUse"><stop stop-color="#2148e4"/><stop offset="1" stop-color="#80e8ff"/></linearGradient><linearGradient id="paint1_linear_7996_40361" x1="60" x2="12" y1="36" y2="36" gradientUnits="userSpaceOnUse"><stop stop-color="#2148e4"/><stop offset="1" stop-color="#80e8ff"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/okta-alt.svg b/web/packages/design/src/ResourceIcon/assets/okta-alt.svg
index c3c6e69a08c80..96fa8a5515330 100644
--- a/web/packages/design/src/ResourceIcon/assets/okta-alt.svg
+++ b/web/packages/design/src/ResourceIcon/assets/okta-alt.svg
@@ -1,9 +1 @@
-<svg width="21" height="20" viewBox="0 0 21 20" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<circle cx="10.5" cy="10" r="10" fill="url(#pattern0_6364_18386)"/>
-<defs>
-<pattern id="pattern0_6364_18386" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_6364_18386" transform="translate(-0.452381) scale(0.0015873)"/>
-</pattern>
-<image id="image0_6364_18386" width="1200" height="630" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABLAAAAJ2CAIAAADAIuwLAAAKKWlDQ1BJQ0MgUHJvZmlsZQAASImVlgdUE+kWx7+Z9EZLCC1A6B3phB4gNAHp1UYMvYQQuqICsrgCK4qKCCiCLIgouCpFVhGxYFsUFbBvkEVFWRcLNtTsRHb17XvnvHfenXPP/c395rvfne+bc+YPACmRKxCkwjIApPGzhMFebszIqGgmbgrgARqQgAKgc3mZAtfAQD+A2N/xn/ZmDECSeMNEUus/x/+rycbGZfIAgAIRTo/N5KUhPIAwhycQZgEAoxHWys0SSFgfYZoQaRBhRwknLLBkLm3VAsd+eSY02B3hPADwZC5XmAAAsQTJM3N4CUgdYjPCZvzYJD7CNxF25iVykXkkGsLGaWnpEmYjrL/qX+ok/KPmqq81udyEr7zwLl9MnhOXmsr0T+cnZaULmZykTEEqN///3Jv/aWmp2X+vJzkBchw/LETSN+IMwAFxIBW5mMAfpAM+SAJZSBQi9xyEM4EAGeOC/Ky4vCxJAfd0Qb4wKSExi+mKnGIc04fPMzVmWphZmAMg+SYWlnnF+LISZGD6LVe0BADHSrFYfPhbzn8rAMeOIfvS/y2n9wYAqZMAXOjnZQtzFnKS4wUYQATSgAaUgBrQQro3ARbABjgANvAAi0EACAVRYAXggUSQhvSfCwpAESgF5WAL2AFqQQPYB/aDQ+AI6AEnwGlwHlwG18AouAtEYAo8A7PgDZiHIAgHUSAqpASpQzqQEWQBsSBnyAPyg4KhKCgGSoD4UDZUAG2AyqEqqBZqhNqgn6Dj0GnoIjQC3YYmoGnoJfQBRsFkmAarwrrwIpgFu8K+cCi8HE6AM+DVcAm8Ga6Bm+CDcDd8Gr4Mj8Ii+Bk8hwIoEoqO0kCZoFgod1QAKhoVjxKi1qHKUNWoJlQHqg81hLqBEqFmUO/RWDQVzUSboB3Q3ugwNA+dgV6HrkDXoveju9Fn0TfQE+hZ9GcMBcPAGGHsMT6YSEwCJhdTiqnGtGC6MOcwo5gpzBssFkvH6mFtsd7YKGwydg22Arsb24kdwI5gJ7FzOBxOCWeEc8IF4Li4LFwpbhfuIO4U7jpuCvcOT8Kr4y3wnvhoPB9fjK/GH8D346/jH+PnCTIEHYI9IYAQS8gnVBKaCX2Eq4QpwjxRlqhHdCKGEpOJRcQaYgfxHPEe8RWJRNIk2ZGCSEmkQlIN6TDpAmmC9J4sRzYku5OXkbPJm8mt5AHybfIrCoWiS2FToilZlM2UNsoZygPKOymqlKmUj1Ss1HqpOqluqetSz6UJ0jrSrtIrpFdLV0sflb4qPSNDkNGVcZfhyqyTqZM5LjMuMydLlTWXDZBNk62QPSB7UfaJHE5OV85DLlauRG6f3Bm5SSqKqkV1p/KoG6jN1HPUKRqWpkfzoSXTymmHaMO0WXk5eSv5cPk8+Tr5k/IiOoquS/ehp9Ir6UfoY/QPCqoKrgpxCpsUOhSuK7xVVFFkK8Yplil2Ko4qflBiKnkopShtVepRuq+MVjZUDlLOVd6jfE55RoWm4qDCUylTOaJyhwEzDBnBjDWMfYwrjDlVNVUvVYHqLtUzqjNqdDW2WrLadrV+tWl1qrqzepL6dvVT6k+Z8kxXZiqzhnmWOavB0PDWyNZo1BjWmNfU0wzTLNbs1LyvRdRiacVrbdca1JrVVtf21y7Qbte+o0PQYekk6uzUGdJ5q6unG6G7UbdH94meop6P3mq9dr17+hR9F/0M/Sb9mwZYA5ZBisFug2uGsKG1YaJhneFVI9jIxijJaLfRiDHG2M6Yb9xkPG5CNnE1yTFpN5kwpZv6mRab9pg+X6S9KHrR1kVDiz6bWZulmjWb3TWXM19sXmzeZ/7SwtCCZ1FncdOSYulpud6y1/KFlZFVnNUeq1vWVGt/643Wg9afbGxthDYdNtO22rYxtvW24ywaK5BVwbpgh7Fzs1tvd8Luvb2NfZb9Efs/HEwcUhwOODxx1HOMc2x2nHTSdOI6NTqJnJnOMc57nUUuGi5clyaXh2wtdiy7hf3Y1cA12fWg63M3MzehW5fbW3d797XuAxwUx4tTxhn2kPMI86j1eOCp6Zng2e4562XttcZrwBvj7eu91XvcR9WH59PmM7vYdvHaxWd9yb4hvrW+D/0M/YR+ff6w/2L/bf73lugs4S/pCQABPgHbAu4H6gVmBP4chA0KDKoLehRsHlwQPBRCDVkZciDkTahbaGXo3TD9sOywwXDp8GXhbeFvIzgRVRGiyEWRayMvRylHJUX1RuOiw6NboueWeizdsXRqmfWy0mVjy/WW5y2/uEJ5ReqKkyulV3JXHo3BxETEHIj5yA3gNnHnVvmsql81y3Pn7eQ9i2XHbo+djnOKq4p7HO8UXxX/JMEpYVvCdKJLYnXiTJJ7Um3Si2Tv5IbktykBKa0p4tSI1M40fFpM2nG+HD+FfzZdLT0vfURgJCgViDLsM3ZkzAp9hS2ZUObyzN4sGvLzvZKtn/1d9kSOc05dzrvc8NyjebJ5/Lwr+Yb5m/Ifr/Zc/eMa9BremsECjYKigom1rmsb10HrVq0bXK+1vmT9VKFX4f4iYlFK0S/FZsVVxa83RGzoK1EtKSyZ/M7ru/ZSqVJh6fhGh40N36O/T/p+eJPlpl2bPpfFll0qNyuvLv9Ywau49IP5DzU/iDfHbx6utKncswW7hb9lbKvL1v1VslWrqya3+W/r3s7cXrb99Y6VOy5WW1U37CTuzN4pqvGr6d2lvWvLro+1ibWjdW51nfWM+k31b3fH7r6+h72no0G1obzhw96kvbcavRq7m3Sbqvdh9+Xse9Qc3jz0I+vHthbllvKWT638VtH+4P1n22zb2g4wDlS2w+3Z7dMHlx28dohzqLfDpKOxk95Zfhgczj789KeYn8aO+B4ZPMo62nFM51h9F7WrrBvqzu+e7UnsEfVG9Y4cX3x8sM+hr+tn059bT2icqDspf7Kyn9hf0i8+tfrU3IBgYOZ0wunJwZWDd89Enrl5Nujs8DnfcxfOe54/M+Q6dOqC04UTF+0vHr/EutRz2eZy9xXrK12/WP/SNWwz3H3V9mrvNbtrfSOOI/3XXa6fvsG5cf6mz83Lo0tGR8bCxm6NLxsX3Yq99eR26u0Xd3LuzN8tvIe5V3Zf5n71A8aDpl8Nfu0U2YhOTnAmrjwMeXh3kjf57LfM3z5OlTyiPKp+rP647YnFkxPTntPXni59OvVM8Gx+pvR32d/rn+s/P/YH+48rs5GzUy+EL8QvK14pvWp9bfV6cC5w7sGbtDfzb8veKb3b/571fuhDxIfH87kfcR9rPhl86vvs+/meOE0sFnCF3C9SAIU4HB8PwMtWAChRAFCvIfph6YJm+0vjQH8rnzn5b/yu8ysjcUHXfTEbADqQECxRNwMAHEZcl43ULgRAIhlD2QC2tPzqf1lmvKXFQi1pDwBw2mLxbBUABGcAPoWIxR9OicWfjBHdUofoG/cFrSgxLKKg93IkdHvb8sJ/12l/AtQjxWjfjn1aAAAAOGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAASwoAMABAAAAAEAAAJ2AAAAANOgXjoAAEAASURBVHgB7d1PrFzVnSdw00ETt0Dyy4CEEWn5WWgGnEjwyGgiEamb52xmyGJiships4lh1cqmnWxmNFI6Ti9mSZwNmhU4m86sgrMJu/DoRSMhBQxSAkRCPKRBMVIQzxIojoaenh8u9Lp45/2pP+eeOlW/TytC9a6r7j2/z+9U637r3Lp1y7EfvHDM/xEgQIAAAQIECBAgQIBAPoE/y1eyigkQIECAAAECBAgQIEDgEwGB0DwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAIFbERAgQIBAcoG147eeO3PHxsnbN+6+fVqKq7//8Oq1Dy+/8t60L1zq559/6K7ZuLZ3boRYcO3c+HipBQyeAAECBFZG4JZjP3hhZYpRCAECBAhMK7C+dnzriQdOrR2f9oXjz3/12kebT7+aIeREeN564sEHT942Xv60j6/f+Hjz6dciSE/7Qs8nQIAAAQLVBVwyWp3UDgkQILBMApe/dd+caTCqjYAU+1mmsmcd66Vv3DtnGowjnzh+65Vvf2nWIXgdAQIECBCoKSAQ1tS0LwIECCydwCPrJ6qM+Zv331FlP53v5FylMiOEx9ps58UaHgECBAhkEBAIM3RZjQQIECBQRyAW9+rsyF4IECBAgEAfAgJhH30wCgIECBBIJhA3mElWsXIJECBAoEcBgbDHrhgTAQIECBAgQIAAAQIEGggIhA2QHYIAAQIECBAgQIAAAQI9CgiEPXbFmAgQIECAAAECBAgQINBAQCBsgOwQBAgQIECAAAECBAgQ6FFAIOyxK8ZEgAABAgQIECBAgACBBgICYQNkhyBAgAABAgQIECBAgECPAgJhj10xJgIECBAgQIAAAQIECDQQEAgbIDsEAQIECBAgQIAAAQIEehQQCHvsijERIECAAAECBAgQIECggYBA2ADZIQgQIECAAAECBAgQINCjgEDYY1eMiQABAgQIECBAgAABAg0EBMIGyA5BgAABAgQIECBAgACBHgUEwh67YkwECBAgQIAAAQIECBBoICAQNkB2CAIECBAgQIAAAQIECPQoIBD22BVjIkCAAAECBAgQIECAQAMBgbABskMQIECAAAECBAgQIECgRwGBsMeuGBMBAgQIECBAgAABAgQaCAiEDZAdggABAgQIECBAgAABAj0KCIQ9dsWYCBAgQIAAAQIECBAg0EBAIGyA7BAECBAgQIAAAQIECBDoUUAg7LErxkSAAAECBAgQIECAAIEGAgJhA2SHIECAAAECBAgQIECAQI8CAmGPXTEmAgQIECBAgAABAgQINBAQCBsgOwQBAgQIENgrsHb81r2b/E2AAAECBJoLCITNyR2QAAECBAgcO3buzB0YCBAgQIDAwgUEwoW3wAAIECBAIKPApUfv3Th5e8bK1UyAAAECPQkIhD11w1gIECBAII3AieO3bj3xgEyYpuEKJUCAQKcCAmGnjTEsAgQIEFh5gciEr3z3KxfPnvJ9wpXvtQIJECDQrYBvtHfbGgMjQKAjgfW14xt33xaLOetfOB6PY2SPrJ/Yd3wvbF+P7ds7N7Y/uHH12ofbH/wp/rvvM22cTSCy0/mH7or/btx9+5w5Ktq09fbO5Vfem20ktV71w7OnLjx8z9VrH825w50bH4/KiQdz7mqIl8cbJ94+Gydvi67tvo/KA43eO7F9a/t6vIniz/I5R27ZPL127v47YoYc+czyCVd//2G8Zxc+K8qB2UKAAIGBBG459oMXBtq13RIgQGCpBSL+bZ4+EWeWm+snYiVnnloiJcaZepzgxn/n2c8Qr/2Xv/+rWru95e/+sdauDtpPNCUus5yzHXt2/uq1jzaffnXCEFWRa88wav05VTm1DnrQfkZvn/hv5MCZuxZvnwhpW9s7W29fn6RNl79133c27jpoSBNuj4PGrJjwyZ5GgACBpRYQCJe6fQZPgEB9gbj347kzd0YIjMv4qu/9+o2Pr7zx/pXX/3Dl9fer73y2HVZMOEMHwlhiuvrdr8ycKw7xmfzsvyLXIeOZ859+9Pw7F59/Z86dzPzyaFO8iSIEfvP++rdRjbh7+ZVr8fY5aOUwrr+NFdeZBz/+wsUyjo/EYwIECAwqIBAOymvnBAgsjUCcxcaFiPG/IXJgqRDJMK5Ju/Tiuwed15YvGWhLxYQzaCCM6wy3nnjwwZO3DeRw+smXJulFRa6BCondxuxa+5//NNz+D9rzzXfQyYOupj7oVbNtj2R46cX/E8lwz5rhzv/4Wq2PDBbFOBuIVxEgQGBmgbkugpr5qF5IgACBfgRiKSNOZOe/xmyqiuKc9W8fvif+F2tTsZjT4aWkU5Uz9JOHToMx/vhW2ySBcOhKq+y/ViKacDCjD1Pia5AtjxsfDTzz2H2XHv1kyf3ir97Z7V3FMVTc1YSSnkaAAIGFCAiEC2F3UAIEuhCIKBgXmLVZ0Dio4Dj6848/IBYe5DPafuXbXx5ubfDwQ/vXQwQiCl78+qnGH6aMjycyWxw9/vfTq++Nx8Lx53hMgAABAocLCISH+/hXAgRWU2DhJ7J7WHdj4YVfvuWupHtw4h4hQ4f2uDgwbluy57j+PEQg1mzjw5RY4j7kOS3/aTcWtjyoYxEgQGA1BATC1eijKggQmEIgTmQbX9424eAi9sSv0v3kxXfjItI934yacA+r97Qqd4w8kiW+zAn8SKXdJ8Ql1pcevbfDKyoXuFa5i+MBAQIElk5AIFy6lhkwAQKzC8SPFkTA6Pziw1h1iZs0nn/2d75YGLm9wSn+J1cbLu6enLPP5kW8MpbWGyzYLqIyxyRAgEBegT/LW7rKCRBIJhDpItbfOk+Do57EnU7ji4WxCJOsRZ8pN5ahfjy8QKTB8z9/8zMH9scBAvEOip/9GPry3QMObjMBAgQIDCVghXAoWfslQKAfgfi+UyxrDPGraIPWGEuFcdubyX8zfdDBNN55pMG4h+TQB42fLogvbQ59lBXY/5K+g1ZAXgkECBBoIGCFsAGyQxAgsEiBuEw0fr9u6dLgiCzWM7e//9UoYZGCzY8d9TZYHY00mDNsT9vPpX4HTVus5xMgQCChgECYsOlKJpBI4Oa57ANLcZnoQV2JW3fEla6xYnbQE1Zs+6hlQ9+wJG4rKg1OMnNW4B00SZmeQ4AAgcwCLhnN3H21E1hxgTaXHbZBHF0/efmV99ocblFHiXuWbD3xQJM0+Jrbih7Z5VV6Bx1ZrCcQIEAgrYAVwrStVziBFRdYvXPZyISrvU4YX1SLH6Bvkwb92OOR7//VewcdWbInECBAIKeAQJiz76omsOICq3ouu8KZMNJgfNWzwcW9F557Sxo88v2/qu+gIwv3BAIECCQUEAgTNl3JBFZcIL711OAGlYtCXNVMGGuDDdLg48++ufKX3c4/M6XB+Q3tgQABAkskIBAuUbMMlQCBowVG98A4+nnL/IzIhPFzFMtcwd6xt/mt8x89/440uJe++DveQQ1u8Voc1gYCBAgQWJiAQLgwegcmQKC6wM0voX1p6C+hVR/2DDu88tdfivuvzPDCDl8SafA7G4PfQzV+gP7i8+90WH5XQ2pzU5+uSjYYAgQIEBAIzQECBFZHIC47PLUqMenwrkTojWIjAB/+tP7/9cLD97RJg+d//mb/GosdYZub+iy2RkcnQIAAgVJAICxNbCFAYCkFLp499cj6iaUc+kyDjm/cXfrGvTO9tJcXxXfVfvzo4CXED9Bf+OVbvdTc8ThiOjX4GmfHAIZGgACBpAICYdLGK5vAignEF59+ePbUihV1ZDmxtnbuzB1HPq3PJ7S5c0mkwZw/QD/t6nFMpAZLtX1ORaMiQIBAcgGBMPkEUD6BFRG48u0vrUglU5Zx+bH7pj31n/IIgzy9zZ1Lrt/4OGcajJ7t3Ph48s7FFIqJNPnzPZMAAQIEVklAIFylbqqFQFKBuFg0yVcHywbHlwnjpizl9p63jO4EO/S9f26mwdemykU9o001triDzlTPjyk0dDumGo8nEyBAgEBLAYGwpbZjESBQXyDui5jwYtFxx2/ef8cS/QpFm/tYjtJgzh+gn/Y7k3GxaEyh8RnlMQECBAikElj6O9Sl6pZiCRAoBdqvj0XYuHrto623d2L1KR7sDmnj5G1x6d3G3bfHg8YrlvHDcRtP/Xp3JN0+CJ+4OWqDxagLz721XGkwUlwMePuDG3P2bnvnxrS/tbiQXx3crTeq3rnxz7tVb968L1R8wBFvogbzZPe4HhAgQCCzgECYuftqJ7D0AnHi2OzOonEKe/mVa1tvXz8oaURE3AWNdbBYeDn/0Mk2t22Mo8Q9WqZNArujbfMg0uDWEw82AHn82Tc7pxgHj88Xzv3st+OTZ/xfh37c+HLruJY1Kr3y+vsHXcr7qcPNX4yMS4tjVsf7qPHHK0Ob2z8BAgR6ExAIe+uI8RAgMIVAnM5O8exZnxpnsZf+6d2DcuC+e42Fmksvvhv/i2R48eunGty/MSgWnoKi2Ch8X5DYGGuDDdLgj55/Z+EOBwmU2xd7aWtE9PgdyHJU1bdEmaO3w0E5cN8jxjvuwnPxv7ciE154+IvNPvrZdzA2EiBAYIUFfIdwhZurNAIrLtBgefCF7eunn3wpftN8qjQ47h4BKV4eO5n2Ph/jO5nkcayixHLKJM8c7jkbd9920M7jyt4GJ/SBfPHm4tJBw+hte2TXmafW/LVEGhz6ssyIghHR1598KfoyVRocry5WFONusWefeS1W6ce3e0yAAAECVQQEwiqMdkKAwAIEBl0ejBPZx372mzgNPWTJa/KaR7EwzmjjpHjyV037zEFBJhlMXCK779MiDTZYI400GNl73wF0u/HKG+8vamwNlgfj85SNp16eJwqO48TVpPFF2YiX4xs9JkCAAIH5BQTC+Q3tgQCBBQjE1YnDrTjFQkSsacS6RN3Cbp7RvvyLwTJALBLGxXV1xzzV3uJmleUqZcTUBmkwWnbhl29NNdoenjz/XWRmriKmyqDLg5Hcan2eMl5jxMuHnnp50A9Wxg/nMQECBDIICIQZuqxGAisoEF/MG6iqWGiKhYiZL287fFSx23P/8JufvPju4U+b+V8PWqObeYfTvvCZx+6LO8dE2IgLeuO/8bjBj4JEGlzSH6Cvsv48bY9Gz49v5c32wiNfFavrcV+f4a7djYtsY+HR5aNHNsITCBAgMKGAm8pMCOVpBAj0JXBumF9Oa3PZ4ehHESI7VTeNNbrD7+xS/YjlDmPldrjF2/JwET+WNA2WtTTbEjfwHOgGPzfb8drQX4yMD1ai6W1uWtusKQ5EgACBRQlYIVyUvOMSIDC7wEBXu7VJg6Oy424iA30bKnBml122V47ix0DLucuGMcV4L3xtqJuLxk9oDJ0GR3WOMqF1wim67qkECBA4QEAgPADGZgIEOhYY4sLIuAFG41uSxDV1EUGrMw+BU32QVXbYZjGqylB728lAC+xxpeinPyTYpOBRJoxp0ORoDkKAAIGVFRAIV7a1CiOwwgKb6yfqVhfnlPHVvrr7nGRvcR+U6ksccSlgXDU6ydGX/TmjK2+XvYr244+vdw5xO5n4dKP9L0BGJow1yfaGjkiAAIFVEhAIV6mbaiGQQmCI60XPP/vmQi47jIMOsSy5ebpyYO5wYsViVPv40aHDDEMaYnkwbvu5qLu8xprkQFdfz2DrJQQIEFhGAYFwGbtmzARSC2yur9WtP34HovovTEw+wvjCVfXT2XNn7px8AMv4zBCTBmduXKwQzvzag154/tnfLeQjldF44uprP0RxUGtsJ0CAwJECAuGRRJ5AgEBfAtVPZxe1srHLeunFd+t+D6r6JbW7Q+3hQVyaONxPGvRQ4KBjiN+jr35/0fj+bcuvDu7rY0rsy2IjAQIEJhEQCCdR8hwCBDoSqHs6G+ligb8FN2KNpZXIhBWJ4xtiq/o1wujXEBfZVsTvfFdDXE7cQxiLFWOLhJ3PPcMjQKBbAYGw29YYGAEC+whUXx68+Kt39jlM803VFwk37r6teRGDHzBuwLPw5dzBixz4APELhHWP0MPy4KiiHnJpXVt7I0CAQBsBgbCNs6MQIFBHYONkzZwT57ILXx4cucQi4ZU33q9jdHMv1c/7K45ttl1FGvQD9LPRjb+q+kcql1+5Nr7/BT6ORcK6l14vsBaHJkCAQEsBgbCltmMRIDCvQHwDat5djL2+n3PZGNSV1/8wNrR5H1Y/7593QPO9Pk70pcH5CD999fra56vsZ3cnC7wh0+4Ydh/U/VRld7ceECBAYLUFBMLV7q/qCKyaQN2c09e57OvvW984aL5uPv3aAm9iedColnH7qaq/URl36O2qL3U/VVnG/hozAQIEZhAQCGdA8xICBFZBIC5B7OpcNky3tq/Xkn1kfXV+ijB+ZCJ+nKOWTOb9VL/V0NXf99WXrbervYMyzxO1EyCQTUAgzNZx9RJYboGKOafDjNHb6XUPcyVWTevegrWHohY1hvUvHK976IofYVQZWHzEEx/0VNmVnRAgQCCPgECYp9cqJUDgMwLbH9z4zN8d/FE3o1ZfDlqIUESO3hZyF+LQ50E7/Aijk9tE9dkvoyJAgMC+AgLhviw2EiCw+gK9LW6E+M6Nf67oXn05qOLYJt9Vh7l98sH39szqd5TpMKt3mFF7mwbGQ4AAgT0CAuEeEH8SIEBgYQJbb+8s7Ni9HrjubYR6rbLRuOouGrs4s1HbHIYAAQIDCwiEAwPbPQEC9QTq/uZEvXHZ04ACD568TSYc0HeOXXe4PDhHNV5KgACBvAICYd7eq5wAAQJLIXDp0XuXYpwGuXoCGydvX72iVESAAIE9AgLhHhB/EiDQr4AViX57M+TIYpHw4tlTQx5hMfv+6dX3FnNgR51YYO3Pb534uZ5IgACBZRUQCJe1c8ZNgMDqCViOOKinPzx76vxDdx30r0u6fdnvl1PxN2CWtIOGTYAAgdUQEAhXo4+qIEBgaoGNk7dN/ZqBX1B3OWLnjx8PPN6mu48LR3sIzPG7iLXKbn8b2Lq/a1LLoe5+2qvWHb+9ESBAoL2AQNje3BEJEOhCoMNb1NTNqCt29n/i+K1bTzyw8Ex4td7vnte95+ckb6q6v2sSR+zwfj/tVSeR9xwCBAj0LCAQ9twdYyNAYK9AxTvdd3guu3G3O1js7fj4351kwvEhzfO4bv6fZyQzv7b6DxvOPJLdF7qQdZfCAwIECEwoIBBOCOVpBAh0IVDxvjIdnjhurp+opfzOzo1au+pqPwvPhNv1YKOWxgue1X+0vbdPVXobT1fvHYMhQIDAQQIC4UEythMg0KNAxdPxKO/cmTv6KTIudTu1drzWeLZ3/lRrV73tZ7GZsO6dYDZPV/sIYJI2Vfw8ZXS4c/d39A6KIfU2nkma4jkECBBYuIBAuPAWGAABAlMI1D0dP3fmzimOPfBT695Fs/pa0MDVT7f7BWbCut/MPP/Qyekqn/vZL2xfn3sf/7qDaERXn6p0NZh/ZfKIAAECfQsIhH33x+gIEPiswFbV09lYT+jn1jJ1A2HdpdTPNqGLvxaVCbc/qLn0Gj+x2PgmKNUnRj+fqsT1ohXX2EezvOJV3F28bQyCAAEC+wkIhPup2EaAQK8CdRe+IlTUjWEzs8XKRt1z2Yo3w5y5qKFfuJBMWHeFMIguPHzP0FDj+6/7Doo9f2fjrsaZdryc8cedvJfHh+QxAQIElkJAIFyKNhkkAQKfCsSXoOreLiVOx3tYJLzw8Bfr9njr7Z26O+xzb6NM2LiDda+6jBjTcvxDfFJw8eunFj49IpRGNK0+jJatqT54OyRAgMCEAgLhhFCeRoBALwJ1rxqNdbnGSzSlY0SCurc8rZtYygEfuSV+HSTGUPE3Qg454s1M+GDLE/e6i2wx/otn2wWqIT4p6GGR8PK37jtkksz8T34JZmY6LyRAYIkEBMIlapahEiDwiUD1M9oIhAu85i2SzKVH763b2upEkw8vQuDpJ1/aeOrXm0+/Gv89+8xr1298PPnLZ3tmfBNv64l2mXBru/Lq698+fE/L358Y4vOCgfLYhPMhrriu+5HK7nE7/KHF3bF5QIAAgVoCAmEtSfshQKCRwJXX3697pFiiWeDp7KVv3BsDqFtRdaIJhxdX80YOHL9tSUTTzadXLRMOwdtyBl55/Q8TNnTyp0UeW9RKe3ykcvmxQZYHo/y4gqDl4vPk4J5JgACBigICYUVMuyJAoIVAfI2w+rWIcTrb8rK9Xaa4WLT6F58ilVW/8cnugA9/cPH5OPje9cAYzOplwl+8UflTiVjkbDYDhwi0MTFi/C3XOXen4pVvf7n6Ryq7O48HjX8rcvzQHhMgQKCNgEDYxtlRCBCoKXD5lWs1d3dzXz88e6rxXQrj7PmZAVY2BjrdnwR8e2f/n2RYvUw4xCJbsxkYS7jVP1KJ6RGp7Mq3v9R4PS1WVge6WHR3wm+ur+0+9oAAAQIrKSAQrmRbFUVgxQUGyjwRz5plwkiDW088MESfLr/y3hC7nWSfh3x3ccUy4UAzML5N2maRbYiPVGKGxAWWLb/MGWuS1RfYy3ne7P8nlIe2hQABAm0EBMI2zo5CgEBNgVjiqH7N3mh8bTLhKA0OcZ3bAq8XPbLBq5QJ48rYIWZgTIn4mKBBJhwo0MYcaHaDn1gbjDXVI2fd/E+IpsiE8zPaAwECPQsIhD13x9gIEDhQYKAljjheZMJBb48RJ5dx0j9EGozBX3rx3QPJOviHVcqEA1HHxHjlu18ZOoEM95FKzLLIhNvf/+pwsfaTu8h8674Ga4O775hmX+/cPaIHBAgQaCkgELbUdiwCBKoJxBJHrIZV291nd/TjR++NO1VU/zZU7DCuCYzAOVAajB94WOD1op8lPPCvyITnfvbbA/+53j8MvVQV18cONwNjklT/MZI9tAMF2tFRRrF2iA9Wbq6uP9gyDUZFcSlsy9vA7umUPwkQIDC0gEA4tLD9EyAwlEDc03KoXR879s3774hVjooLNfFTaVe/+5X4xbnhxhyn+OVNPoc73Mx7jij1+LNvzvzyyV84yoSTP3/aZw46A2OqXP3uf9g8PdQdTaILQ9xaZtwwPliJrxTWWiqMz1NipS6WT6Ot40dp8zgiqEzYhtpRCBBoL/C5Y4883v6ojkiAAIH5Ba5e++h7D99z/NahPtiKPZ87c+fjD90VKSuONfOA45w+TiX/21/+RfUlxz1DevzZ380QCCteDvejiSN6eMbyWvDuKaH6nydv/zenv3B8oK/MRRUxPYZraww+PpKI8V/9/UczdPZIzBsf/7+hW7C+dvxv/uPdc5YQwv/9L//if//XM//p3/3bI4sa7gmRbM+eXtt6+/oQvRhu2PZMgACBIwUEwiOJPIEAgX4F4oz2Pw98jhgno6NYGArXPvy/k58LxqlwnM3/r//y7yMKxuOhESOMXZnpx/EWEghDo1kmjPP44TJhzIehM1WMP669fOju22O2v/GHP1acSNGCx87cGbGz4j733dWohEhT8a/x2yRRyL5PKzfGCyMKxucpEQWH++inPO5BW+KNPOpFDGaqQg7aoe0ECBDoQeCWYz94oYdxGAMBAgRmE4gLO+MbPrO9doZXxVV2ca1dfBEuTgfjwZ49xGLg2vHPxQ+XxYOWF7bFtwfXn3xp8rA6Pux/+fu/Gv9znse3/N0/TvvyyMzxfblpXzXD83969b3zPx/kOtWWMzAaHbE/Jl6sU8WNYWZw2POSmKjPPz7Iz5/sOdD4ny9sX//0TfTBn+KtNP5P8fnLxt23b5y8Lf67uX6i5Vt7fBgTPo5V7vj/A9GI7Q8+7UW8B+N7vLO9Eyc8qKcRIECguoBAWJ3UDgkQaCoQ38179q+/3PSQ/R3se8+9NfM9QhYbCMNy2TPhAmdgJKs9k3F97fOjEBUB+OKv3pkkNMbX/Ib+bfc9g1ztPyO0bz792p6gu9olq44AgWUXEAiXvYPGT4DAseRntLFoufHUr2eeBwsPhDHyZc+Efc7ASCYbT718ZCaMyyDf/v5XZ54/XlgKxMphrNiX220hQIBAnwJD3Yyhz2qNigCBlRSISwHj3HclS5ukqAvPvTXJ03p+TlxlN/kNaeYpZKB7RQ50Meo8lcZr47cfLn796J9uj8TYBn/Ocpbo5Z1f6bpEkoZKgEAbAYGwjbOjECAwoECc0Q76AwADDn3uXf/kxXfLrzLOvdcF7CA6GFc5NjjwEJmw20wVX8ObhDTwh/4JikmG4TkECBAgsBABgXAh7A5KgEBlgfgGXfl9qsrH6G93cRK/AsuDu66xzra8mTAyVYczcPKlquTL7LuT0AMCBAgkFBAIEzZdyQRWU+DcP/wm1YWjUWyfVyrOM72WOhP2makm/JnEuAnKKn24MM8k9FoCBAhkExAIs3VcvQRWViBu9R4391vZ8orC4vR9Je9kuLyZMC4cPf/sIL9sUTR/ig3x+w0TPju+ydlmhXbC8XgaAQIECLQREAjbODsKAQItBCIgPd7fGfkQlcddQOL0fYg997DPlpkwbnBaseQrr78fPwFScYeNdxXyvkzY2NzhCBAgsHABgXDhLTAAAgRqCkRMivus1Nxjf/v65Cfmnn+nv3HVHFEkkzZfyXvmsfvqZsL4OmtX62zxI+9TNWbz6VdlwqnEPJkAAQLLLiAQLnsHjZ8Agb0CcS1lV2fke8c339+/eOP9CEvz7WM5Xh1fCm2TTKpnwmhQtKkT5Qm/Q7g72rj0OtvXcXdr94AAAQI5BQTCnH1XNYEVF4gz8pXMhBGQkqTBmKA3vxTaaLVqiEzYJs0e+U5e/8LxI5+z5wnxZcj4Om6qWzTtEfAnAQIEUgkIhKnarVgCiQRWLxPGJZRxOV/EpDxdXN5M2HLkh8+H9bWpA2HsML6OKxMeDutfCRAgsDICAuHKtFIhBAjsFVilTBgLntnS4KidLZNV3XXCGPnGU79e+Er1tJeM7r6LIhNuPPVyJ+ucu6PygAABAgSqCwiE1UntkACBjgQiE67AfUfjNjl5rhQtZ8/yZsKoZeGfSjw45U1lxv1vXjva6Krd8eNWf/zOzo3q+7RDAgQIrIyAQLgyrVQIAQL7C8R9R88+s6xfiIrvcUWg9YvhkQmb3emk7jphTMql/lSik3XO/d/bk22NRc5Y6lz5mw9PhuFZBAgQ2EdAINwHxSYCBFZMYOvtnWW8+C1OZON7XCv8e4NTTbOWdzqpngmjiQ899fKi1qk2Tk762/QHdWSUaZfxNjORA+PC3Yi18amKy18P6q/tBAgkFxAIk08A5RPIIhBxIs4L4/fcl6XgOJGNLw3G97iWZcANxtnyTifVM+HoK3kL+TmKtT+/df7uRKZdrk9VIr7GpQHjq+vxhlpUJp/f3x4IECAwnIBAOJytPRMg0J1A/J57LNR0vlAQ56yjE9lY1uhOcNEDapwJ519bGwcbXfj62M9+03ipbX3t8+PDmPnx7qcqjcc/w4Dj85T1J1+KSwPGX3vT/7f9D358zB4TIECggYBA2ADZIQgQ6Ejg5kLNr7/33FsdnhfGkGINszyR7Yivg6G0zIRbTzxQNxOG35XX348Wt7z76Gy/PHFQq+NTlVgqXMhS50FDGt8eH/cc8nnKaPJ0/pHQeDkeEyBAoIGAQNgA2SEIEOhO4NLNBYRIX/3EwkgIcZ4dZ9vdYfU3oDitP/ez3zYY14njt1742j3VDxRLVfGtvFisjt+WrL7zcocz//JEuavRllgqjHv8RO5qM/6DhrFneyytxx2Y4srwPQuDe552MxOuwq1T99TlTwIECMwsIBDOTOeFBAgst0CclEf6irWahcfCiIKnn3wpEkKcZy+3acPRx0l/mx8Uqbu8Ni40SiYNYtXG3fPeVGZ82LuPowXxrbwG49894kEPRlEw3ssT3oEp3vvL9Y3igwq3nQABAlUEKnzRvMo47IQAAQILERjFwlgwPP/QXRcevufU2vFmw4iz2Dh/jUPHGJodtDxQrJHGOli5vf8to7P/uPvLoEOtvry2Z7SfxKr43+m1mIHf2bhrz79W+XPQCdZg/IcgxBLl5VeuTZgD9+wnPg+Ky3cvfePeR9ZP7PknfxIgQCCVwC3HfvBCqoIVS4AAgUME4gtjcYngufvvGC4jRQC78sb7V17/Q5yMHjKSZv8UUeT5xx+Y/3Bxah7rRfPvZ9o9RI4aNBPGl+Xi8shpRzXb8yN8RjnnHzo5z6/Jl4eOb8zG5w7l9upbBhp/Oc74MOWTLPfiu1UW1W9+GPTFiuYt50yJYwsBAgSmFRAIpxXzfAIEUghEMozTxAhLtU4T4z4WsZaytb3TSQ4c7+L8mSpSbvxkYlwDOb7bZo/nH/8hQ41LIqNxhzxhiH+K61TPnbmjSjKMiRdBfdBFwlJgNP5zZ+6su/g2ehPFeuAQM220SDv/h0GRBuPy78bgZQtsIUCAwOQCAuHkVp5JgEBGgVj0iK9gba6fWP/C8TjNnfwEN1bM4qTw6u8/3Nq+Hv/t/AQxzobjVHjaQQZOsEReinP0aV9bdzJFfLr06L3Vr/iNrynOdjlirepCePP0ifh4Ihq0cfK2aReuYxLG8uZiWxMjj7dPvIni7TPtxyuxEri986eYYJEAt97+5A1VC/aQ/cRc2lxfiwFP/maPvcVQ450es6X9xweH1OKfCBAgMImAQDiJkucQIEDgMwJxgn7Ij307I/wMVsM/oi9xNl/rgHFyX+WKxFrjif2MPp6IBxGxRrvd3RJhKT53GG2MYUeO2v4g/tvdbYoiFsaHCGvHPxfNGo12z39Hg9/548dDLAPuOdaRf45GGz/kGA/2fXLP1PsO2EYCBAiUAgJhaWILAQIECBAgQIAAAQIEUgj42YkUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGe9f8iAAAJZElEQVSBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikE/j+13+C9foh7ggAAAABJRU5ErkJggg=="/>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="21" height="20" fill="none" viewBox="0 0 21 20"><circle cx="10.5" cy="10" r="10" fill="url(#pattern0_6364_18386)"/><defs><pattern id="pattern0_6364_18386" width="1" height="1" patternContentUnits="objectBoundingBox"><use xlink:href="#image0_6364_18386" transform="translate(-.452)scale(.00159)"/></pattern><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABLAAAAJ2CAIAAADAIuwLAAAKKWlDQ1BJQ0MgUHJvZmlsZQAASImVlgdUE+kWx7+Z9EZLCC1A6B3phB4gNAHp1UYMvYQQuqICsrgCK4qKCCiCLIgouCpFVhGxYFsUFbBvkEVFWRcLNtTsRHb17XvnvHfenXPP/c395rvfne+bc+YPACmRKxCkwjIApPGzhMFebszIqGgmbgrgARqQgAKgc3mZAtfAQD+A2N/xn/ZmDECSeMNEUus/x/+rycbGZfIAgAIRTo/N5KUhPIAwhycQZgEAoxHWys0SSFgfYZoQaRBhRwknLLBkLm3VAsd+eSY02B3hPADwZC5XmAAAsQTJM3N4CUgdYjPCZvzYJD7CNxF25iVykXkkGsLGaWnpEmYjrL/qX+ok/KPmqq81udyEr7zwLl9MnhOXmsr0T+cnZaULmZykTEEqN///3Jv/aWmp2X+vJzkBchw/LETSN+IMwAFxIBW5mMAfpAM+SAJZSBQi9xyEM4EAGeOC/Ky4vCxJAfd0Qb4wKSExi+mKnGIc04fPMzVmWphZmAMg+SYWlnnF+LISZGD6LVe0BADHSrFYfPhbzn8rAMeOIfvS/y2n9wYAqZMAXOjnZQtzFnKS4wUYQATSgAaUgBrQQro3ARbABjgANvAAi0EACAVRYAXggUSQhvSfCwpAESgF5WAL2AFqQQPYB/aDQ+AI6AEnwGlwHlwG18AouAtEYAo8A7PgDZiHIAgHUSAqpASpQzqQEWQBsSBnyAPyg4KhKCgGSoD4UDZUAG2AyqEqqBZqhNqgn6Dj0GnoIjQC3YYmoGnoJfQBRsFkmAarwrrwIpgFu8K+cCi8HE6AM+DVcAm8Ga6Bm+CDcDd8Gr4Mj8Ii+Bk8hwIoEoqO0kCZoFgod1QAKhoVjxKi1qHKUNWoJlQHqg81hLqBEqFmUO/RWDQVzUSboB3Q3ugwNA+dgV6HrkDXoveju9Fn0TfQE+hZ9GcMBcPAGGHsMT6YSEwCJhdTiqnGtGC6MOcwo5gpzBssFkvH6mFtsd7YKGwydg22Arsb24kdwI5gJ7FzOBxOCWeEc8IF4Li4LFwpbhfuIO4U7jpuCvcOT8Kr4y3wnvhoPB9fjK/GH8D346/jH+PnCTIEHYI9IYAQS8gnVBKaCX2Eq4QpwjxRlqhHdCKGEpOJRcQaYgfxHPEe8RWJRNIk2ZGCSEmkQlIN6TDpAmmC9J4sRzYku5OXkbPJm8mt5AHybfIrCoWiS2FToilZlM2UNsoZygPKOymqlKmUj1Ss1HqpOqluqetSz6UJ0jrSrtIrpFdLV0sflb4qPSNDkNGVcZfhyqyTqZM5LjMuMydLlTWXDZBNk62QPSB7UfaJHE5OV85DLlauRG6f3Bm5SSqKqkV1p/KoG6jN1HPUKRqWpkfzoSXTymmHaMO0WXk5eSv5cPk8+Tr5k/IiOoquS/ehp9Ir6UfoY/QPCqoKrgpxCpsUOhSuK7xVVFFkK8Yplil2Ko4qflBiKnkopShtVepRuq+MVjZUDlLOVd6jfE55RoWm4qDCUylTOaJyhwEzDBnBjDWMfYwrjDlVNVUvVYHqLtUzqjNqdDW2WrLadrV+tWl1qrqzepL6dvVT6k+Z8kxXZiqzhnmWOavB0PDWyNZo1BjWmNfU0wzTLNbs1LyvRdRiacVrbdca1JrVVtf21y7Qbte+o0PQYekk6uzUGdJ5q6unG6G7UbdH94meop6P3mq9dr17+hR9F/0M/Sb9mwZYA5ZBisFug2uGsKG1YaJhneFVI9jIxijJaLfRiDHG2M6Yb9xkPG5CNnE1yTFpN5kwpZv6mRab9pg+X6S9KHrR1kVDiz6bWZulmjWb3TWXM19sXmzeZ/7SwtCCZ1FncdOSYulpud6y1/KFlZFVnNUeq1vWVGt/643Wg9afbGxthDYdNtO22rYxtvW24ywaK5BVwbpgh7Fzs1tvd8Luvb2NfZb9Efs/HEwcUhwOODxx1HOMc2x2nHTSdOI6NTqJnJnOMc57nUUuGi5clyaXh2wtdiy7hf3Y1cA12fWg63M3MzehW5fbW3d797XuAxwUx4tTxhn2kPMI86j1eOCp6Zng2e4562XttcZrwBvj7eu91XvcR9WH59PmM7vYdvHaxWd9yb4hvrW+D/0M/YR+ff6w/2L/bf73lugs4S/pCQABPgHbAu4H6gVmBP4chA0KDKoLehRsHlwQPBRCDVkZciDkTahbaGXo3TD9sOywwXDp8GXhbeFvIzgRVRGiyEWRayMvRylHJUX1RuOiw6NboueWeizdsXRqmfWy0mVjy/WW5y2/uEJ5ReqKkyulV3JXHo3BxETEHIj5yA3gNnHnVvmsql81y3Pn7eQ9i2XHbo+djnOKq4p7HO8UXxX/JMEpYVvCdKJLYnXiTJJ7Um3Si2Tv5IbktykBKa0p4tSI1M40fFpM2nG+HD+FfzZdLT0vfURgJCgViDLsM3ZkzAp9hS2ZUObyzN4sGvLzvZKtn/1d9kSOc05dzrvc8NyjebJ5/Lwr+Yb5m/Ifr/Zc/eMa9BremsECjYKigom1rmsb10HrVq0bXK+1vmT9VKFX4f4iYlFK0S/FZsVVxa83RGzoK1EtKSyZ/M7ru/ZSqVJh6fhGh40N36O/T/p+eJPlpl2bPpfFll0qNyuvLv9Ywau49IP5DzU/iDfHbx6utKncswW7hb9lbKvL1v1VslWrqya3+W/r3s7cXrb99Y6VOy5WW1U37CTuzN4pqvGr6d2lvWvLro+1ibWjdW51nfWM+k31b3fH7r6+h72no0G1obzhw96kvbcavRq7m3Sbqvdh9+Xse9Qc3jz0I+vHthbllvKWT638VtH+4P1n22zb2g4wDlS2w+3Z7dMHlx28dohzqLfDpKOxk95Zfhgczj789KeYn8aO+B4ZPMo62nFM51h9F7WrrBvqzu+e7UnsEfVG9Y4cX3x8sM+hr+tn059bT2icqDspf7Kyn9hf0i8+tfrU3IBgYOZ0wunJwZWDd89Enrl5Nujs8DnfcxfOe54/M+Q6dOqC04UTF+0vHr/EutRz2eZy9xXrK12/WP/SNWwz3H3V9mrvNbtrfSOOI/3XXa6fvsG5cf6mz83Lo0tGR8bCxm6NLxsX3Yq99eR26u0Xd3LuzN8tvIe5V3Zf5n71A8aDpl8Nfu0U2YhOTnAmrjwMeXh3kjf57LfM3z5OlTyiPKp+rP647YnFkxPTntPXni59OvVM8Gx+pvR32d/rn+s/P/YH+48rs5GzUy+EL8QvK14pvWp9bfV6cC5w7sGbtDfzb8veKb3b/571fuhDxIfH87kfcR9rPhl86vvs+/meOE0sFnCF3C9SAIU4HB8PwMtWAChRAFCvIfph6YJm+0vjQH8rnzn5b/yu8ysjcUHXfTEbADqQECxRNwMAHEZcl43ULgRAIhlD2QC2tPzqf1lmvKXFQi1pDwBw2mLxbBUABGcAPoWIxR9OicWfjBHdUofoG/cFrSgxLKKg93IkdHvb8sJ/12l/AtQjxWjfjn1aAAAAOGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAASwoAMABAAAAAEAAAJ2AAAAANOgXjoAAEAASURBVHgB7d1PrFzVnSdw00ETt0Dyy4CEEWn5WWgGnEjwyGgiEamb52xmyGJiships4lh1cqmnWxmNFI6Ti9mSZwNmhU4m86sgrMJu/DoRSMhBQxSAkRCPKRBMVIQzxIojoaenh8u9Lp45/2pP+eeOlW/TytC9a6r7j2/z+9U637r3Lp1y7EfvHDM/xEgQIAAAQIECBAgQIBAPoE/y1eyigkQIECAAAECBAgQIEDgEwGB0DwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAAGB0BwgQIAAAQIECBAgQIBAUgGBMGnjlU2AAAECBAgQIECAAIFbERAgQIBAcoG147eeO3PHxsnbN+6+fVqKq7//8Oq1Dy+/8t60L1zq559/6K7ZuLZ3boRYcO3c+HipBQyeAAECBFZG4JZjP3hhZYpRCAECBAhMK7C+dnzriQdOrR2f9oXjz3/12kebT7+aIeREeN564sEHT942Xv60j6/f+Hjz6dciSE/7Qs8nQIAAAQLVBVwyWp3UDgkQILBMApe/dd+caTCqjYAU+1mmsmcd66Vv3DtnGowjnzh+65Vvf2nWIXgdAQIECBCoKSAQ1tS0LwIECCydwCPrJ6qM+Zv331FlP53v5FylMiOEx9ps58UaHgECBAhkEBAIM3RZjQQIECBQRyAW9+rsyF4IECBAgEAfAgJhH30wCgIECBBIJhA3mElWsXIJECBAoEcBgbDHrhgTAQIECBAgQIAAAQIEGggIhA2QHYIAAQIECBAgQIAAAQI9CgiEPXbFmAgQIECAAAECBAgQINBAQCBsgOwQBAgQIECAAAECBAgQ6FFAIOyxK8ZEgAABAgQIECBAgACBBgICYQNkhyBAgAABAgQIECBAgECPAgJhj10xJgIECBAgQIAAAQIECDQQEAgbIDsEAQIECBAgQIAAAQIEehQQCHvsijERIECAAAECBAgQIECggYBA2ADZIQgQIECAAAECBAgQINCjgEDYY1eMiQABAgQIECBAgAABAg0EBMIGyA5BgAABAgQIECBAgACBHgUEwh67YkwECBAgQIAAAQIECBBoICAQNkB2CAIECBAgQIAAAQIECPQoIBD22BVjIkCAAAECBAgQIECAQAMBgbABskMQIECAAAECBAgQIECgRwGBsMeuGBMBAgQIECBAgAABAgQaCAiEDZAdggABAgQIECBAgAABAj0KCIQ9dsWYCBAgQIAAAQIECBAg0EBAIGyA7BAECBAgQIAAAQIECBDoUUAg7LErxkSAAAECBAgQIECAAIEGAgJhA2SHIECAAAECBAgQIECAQI8CAmGPXTEmAgQIECBAgAABAgQINBAQCBsgOwQBAgQIENgrsHb81r2b/E2AAAECBJoLCITNyR2QAAECBAgcO3buzB0YCBAgQIDAwgUEwoW3wAAIECBAIKPApUfv3Th5e8bK1UyAAAECPQkIhD11w1gIECBAII3AieO3bj3xgEyYpuEKJUCAQKcCAmGnjTEsAgQIEFh5gciEr3z3KxfPnvJ9wpXvtQIJECDQrYBvtHfbGgMjQKAjgfW14xt33xaLOetfOB6PY2SPrJ/Yd3wvbF+P7ds7N7Y/uHH12ofbH/wp/rvvM22cTSCy0/mH7or/btx9+5w5Ktq09fbO5Vfem20ktV71w7OnLjx8z9VrH825w50bH4/KiQdz7mqIl8cbJ94+Gydvi67tvo/KA43eO7F9a/t6vIniz/I5R27ZPL127v47YoYc+czyCVd//2G8Zxc+K8qB2UKAAIGBBG459oMXBtq13RIgQGCpBSL+bZ4+EWeWm+snYiVnnloiJcaZepzgxn/n2c8Qr/2Xv/+rWru95e/+sdauDtpPNCUus5yzHXt2/uq1jzaffnXCEFWRa88wav05VTm1DnrQfkZvn/hv5MCZuxZvnwhpW9s7W29fn6RNl79133c27jpoSBNuj4PGrJjwyZ5GgACBpRYQCJe6fQZPgEB9gbj347kzd0YIjMv4qu/9+o2Pr7zx/pXX/3Dl9fer73y2HVZMOEMHwlhiuvrdr8ycKw7xmfzsvyLXIeOZ859+9Pw7F59/Z86dzPzyaFO8iSIEfvP++rdRjbh7+ZVr8fY5aOUwrr+NFdeZBz/+wsUyjo/EYwIECAwqIBAOymvnBAgsjUCcxcaFiPG/IXJgqRDJMK5Ju/Tiuwed15YvGWhLxYQzaCCM6wy3nnjwwZO3DeRw+smXJulFRa6BCondxuxa+5//NNz+D9rzzXfQyYOupj7oVbNtj2R46cX/E8lwz5rhzv/4Wq2PDBbFOBuIVxEgQGBmgbkugpr5qF5IgACBfgRiKSNOZOe/xmyqiuKc9W8fvif+F2tTsZjT4aWkU5Uz9JOHToMx/vhW2ySBcOhKq+y/ViKacDCjD1Pia5AtjxsfDTzz2H2XHv1kyf3ir97Z7V3FMVTc1YSSnkaAAIGFCAiEC2F3UAIEuhCIKBgXmLVZ0Dio4Dj6848/IBYe5DPafuXbXx5ubfDwQ/vXQwQiCl78+qnGH6aMjycyWxw9/vfTq++Nx8Lx53hMgAABAocLCISH+/hXAgRWU2DhJ7J7WHdj4YVfvuWupHtw4h4hQ4f2uDgwbluy57j+PEQg1mzjw5RY4j7kOS3/aTcWtjyoYxEgQGA1BATC1eijKggQmEIgTmQbX9424eAi9sSv0v3kxXfjItI934yacA+r97Qqd4w8kiW+zAn8SKXdJ8Ql1pcevbfDKyoXuFa5i+MBAQIElk5AIFy6lhkwAQKzC8SPFkTA6Pziw1h1iZs0nn/2d75YGLm9wSn+J1cbLu6enLPP5kW8MpbWGyzYLqIyxyRAgEBegT/LW7rKCRBIJhDpItbfOk+Do57EnU7ji4WxCJOsRZ8pN5ahfjy8QKTB8z9/8zMH9scBAvEOip/9GPry3QMObjMBAgQIDCVghXAoWfslQKAfgfi+UyxrDPGraIPWGEuFcdubyX8zfdDBNN55pMG4h+TQB42fLogvbQ59lBXY/5K+g1ZAXgkECBBoIGCFsAGyQxAgsEiBuEw0fr9u6dLgiCzWM7e//9UoYZGCzY8d9TZYHY00mDNsT9vPpX4HTVus5xMgQCChgECYsOlKJpBI4Oa57ANLcZnoQV2JW3fEla6xYnbQE1Zs+6hlQ9+wJG4rKg1OMnNW4B00SZmeQ4AAgcwCLhnN3H21E1hxgTaXHbZBHF0/efmV99ocblFHiXuWbD3xQJM0+Jrbih7Z5VV6Bx1ZrCcQIEAgrYAVwrStVziBFRdYvXPZyISrvU4YX1SLH6Bvkwb92OOR7//VewcdWbInECBAIKeAQJiz76omsOICq3ouu8KZMNJgfNWzwcW9F557Sxo88v2/qu+gIwv3BAIECCQUEAgTNl3JBFZcIL711OAGlYtCXNVMGGuDDdLg48++ufKX3c4/M6XB+Q3tgQABAkskIBAuUbMMlQCBowVG98A4+nnL/IzIhPFzFMtcwd6xt/mt8x89/440uJe++DveQQ1u8Voc1gYCBAgQWJiAQLgwegcmQKC6wM0voX1p6C+hVR/2DDu88tdfivuvzPDCDl8SafA7G4PfQzV+gP7i8+90WH5XQ2pzU5+uSjYYAgQIEBAIzQECBFZHIC47PLUqMenwrkTojWIjAB/+tP7/9cLD97RJg+d//mb/GosdYZub+iy2RkcnQIAAgVJAICxNbCFAYCkFLp499cj6iaUc+kyDjm/cXfrGvTO9tJcXxXfVfvzo4CXED9Bf+OVbvdTc8ThiOjX4GmfHAIZGgACBpAICYdLGK5vAignEF59+ePbUihV1ZDmxtnbuzB1HPq3PJ7S5c0mkwZw/QD/t6nFMpAZLtX1ORaMiQIBAcgGBMPkEUD6BFRG48u0vrUglU5Zx+bH7pj31n/IIgzy9zZ1Lrt/4OGcajJ7t3Ph48s7FFIqJNPnzPZMAAQIEVklAIFylbqqFQFKBuFg0yVcHywbHlwnjpizl9p63jO4EO/S9f26mwdemykU9o001triDzlTPjyk0dDumGo8nEyBAgEBLAYGwpbZjESBQXyDui5jwYtFxx2/ef8cS/QpFm/tYjtJgzh+gn/Y7k3GxaEyh8RnlMQECBAikElj6O9Sl6pZiCRAoBdqvj0XYuHrto623d2L1KR7sDmnj5G1x6d3G3bfHg8YrlvHDcRtP/Xp3JN0+CJ+4OWqDxagLz721XGkwUlwMePuDG3P2bnvnxrS/tbiQXx3crTeq3rnxz7tVb968L1R8wBFvogbzZPe4HhAgQCCzgECYuftqJ7D0AnHi2OzOonEKe/mVa1tvXz8oaURE3AWNdbBYeDn/0Mk2t22Mo8Q9WqZNArujbfMg0uDWEw82AHn82Tc7pxgHj88Xzv3st+OTZ/xfh37c+HLruJY1Kr3y+vsHXcr7qcPNX4yMS4tjVsf7qPHHK0Ob2z8BAgR6ExAIe+uI8RAgMIVAnM5O8exZnxpnsZf+6d2DcuC+e42Fmksvvhv/i2R48eunGty/MSgWnoKi2Ch8X5DYGGuDDdLgj55/Z+EOBwmU2xd7aWtE9PgdyHJU1bdEmaO3w0E5cN8jxjvuwnPxv7ciE154+IvNPvrZdzA2EiBAYIUFfIdwhZurNAIrLtBgefCF7eunn3wpftN8qjQ47h4BKV4eO5n2Ph/jO5nkcayixHLKJM8c7jkbd9920M7jyt4GJ/SBfPHm4tJBw+hte2TXmafW/LVEGhz6ssyIghHR1598KfoyVRocry5WFONusWefeS1W6ce3e0yAAAECVQQEwiqMdkKAwAIEBl0ejBPZx372mzgNPWTJa/KaR7EwzmjjpHjyV037zEFBJhlMXCK779MiDTZYI400GNl73wF0u/HKG+8vamwNlgfj85SNp16eJwqO48TVpPFF2YiX4xs9JkCAAIH5BQTC+Q3tgQCBBQjE1YnDrTjFQkSsacS6RN3Cbp7RvvyLwTJALBLGxXV1xzzV3uJmleUqZcTUBmkwWnbhl29NNdoenjz/XWRmriKmyqDLg5Hcan2eMl5jxMuHnnp50A9Wxg/nMQECBDIICIQZuqxGAisoEF/MG6iqWGiKhYiZL287fFSx23P/8JufvPju4U+b+V8PWqObeYfTvvCZx+6LO8dE2IgLeuO/8bjBj4JEGlzSH6Cvsv48bY9Gz49v5c32wiNfFavrcV+f4a7djYtsY+HR5aNHNsITCBAgMKGAm8pMCOVpBAj0JXBumF9Oa3PZ4ehHESI7VTeNNbrD7+xS/YjlDmPldrjF2/JwET+WNA2WtTTbEjfwHOgGPzfb8drQX4yMD1ai6W1uWtusKQ5EgACBRQlYIVyUvOMSIDC7wEBXu7VJg6Oy424iA30bKnBml122V47ix0DLucuGMcV4L3xtqJuLxk9oDJ0GR3WOMqF1wim67qkECBA4QEAgPADGZgIEOhYY4sLIuAFG41uSxDV1EUGrMw+BU32QVXbYZjGqylB728lAC+xxpeinPyTYpOBRJoxp0ORoDkKAAIGVFRAIV7a1CiOwwgKb6yfqVhfnlPHVvrr7nGRvcR+U6ksccSlgXDU6ydGX/TmjK2+XvYr244+vdw5xO5n4dKP9L0BGJow1yfaGjkiAAIFVEhAIV6mbaiGQQmCI60XPP/vmQi47jIMOsSy5ebpyYO5wYsViVPv40aHDDEMaYnkwbvu5qLu8xprkQFdfz2DrJQQIEFhGAYFwGbtmzARSC2yur9WtP34HovovTEw+wvjCVfXT2XNn7px8AMv4zBCTBmduXKwQzvzag154/tnfLeQjldF44uprP0RxUGtsJ0CAwJECAuGRRJ5AgEBfAtVPZxe1srHLeunFd+t+D6r6JbW7Q+3hQVyaONxPGvRQ4KBjiN+jr35/0fj+bcuvDu7rY0rsy2IjAQIEJhEQCCdR8hwCBDoSqHs6G+ligb8FN2KNpZXIhBWJ4xtiq/o1wujXEBfZVsTvfFdDXE7cQxiLFWOLhJ3PPcMjQKBbAYGw29YYGAEC+whUXx68+Kt39jlM803VFwk37r6teRGDHzBuwLPw5dzBixz4APELhHWP0MPy4KiiHnJpXVt7I0CAQBsBgbCNs6MQIFBHYONkzZwT57ILXx4cucQi4ZU33q9jdHMv1c/7K45ttl1FGvQD9LPRjb+q+kcql1+5Nr7/BT6ORcK6l14vsBaHJkCAQEsBgbCltmMRIDCvQHwDat5djL2+n3PZGNSV1/8wNrR5H1Y/7593QPO9Pk70pcH5CD999fra56vsZ3cnC7wh0+4Ydh/U/VRld7ceECBAYLUFBMLV7q/qCKyaQN2c09e57OvvW984aL5uPv3aAm9iedColnH7qaq/URl36O2qL3U/VVnG/hozAQIEZhAQCGdA8xICBFZBIC5B7OpcNky3tq/Xkn1kfXV+ijB+ZCJ+nKOWTOb9VL/V0NXf99WXrbervYMyzxO1EyCQTUAgzNZx9RJYboGKOafDjNHb6XUPcyVWTevegrWHohY1hvUvHK976IofYVQZWHzEEx/0VNmVnRAgQCCPgECYp9cqJUDgMwLbH9z4zN8d/FE3o1ZfDlqIUESO3hZyF+LQ50E7/Aijk9tE9dkvoyJAgMC+AgLhviw2EiCw+gK9LW6E+M6Nf67oXn05qOLYJt9Vh7l98sH39szqd5TpMKt3mFF7mwbGQ4AAgT0CAuEeEH8SIEBgYQJbb+8s7Ni9HrjubYR6rbLRuOouGrs4s1HbHIYAAQIDCwiEAwPbPQEC9QTq/uZEvXHZ04ACD568TSYc0HeOXXe4PDhHNV5KgACBvAICYd7eq5wAAQJLIXDp0XuXYpwGuXoCGydvX72iVESAAIE9AgLhHhB/EiDQr4AViX57M+TIYpHw4tlTQx5hMfv+6dX3FnNgR51YYO3Pb534uZ5IgACBZRUQCJe1c8ZNgMDqCViOOKinPzx76vxDdx30r0u6fdnvl1PxN2CWtIOGTYAAgdUQEAhXo4+qIEBgaoGNk7dN/ZqBX1B3OWLnjx8PPN6mu48LR3sIzPG7iLXKbn8b2Lq/a1LLoe5+2qvWHb+9ESBAoL2AQNje3BEJEOhCoMNb1NTNqCt29n/i+K1bTzyw8Ex4td7vnte95+ckb6q6v2sSR+zwfj/tVSeR9xwCBAj0LCAQ9twdYyNAYK9AxTvdd3guu3G3O1js7fj4351kwvEhzfO4bv6fZyQzv7b6DxvOPJLdF7qQdZfCAwIECEwoIBBOCOVpBAh0IVDxvjIdnjhurp+opfzOzo1au+pqPwvPhNv1YKOWxgue1X+0vbdPVXobT1fvHYMhQIDAQQIC4UEythMg0KNAxdPxKO/cmTv6KTIudTu1drzWeLZ3/lRrV73tZ7GZsO6dYDZPV/sIYJI2Vfw8ZXS4c/d39A6KIfU2nkma4jkECBBYuIBAuPAWGAABAlMI1D0dP3fmzimOPfBT695Fs/pa0MDVT7f7BWbCut/MPP/Qyekqn/vZL2xfn3sf/7qDaERXn6p0NZh/ZfKIAAECfQsIhH33x+gIEPiswFbV09lYT+jn1jJ1A2HdpdTPNqGLvxaVCbc/qLn0Gj+x2PgmKNUnRj+fqsT1ohXX2EezvOJV3F28bQyCAAEC+wkIhPup2EaAQK8CdRe+IlTUjWEzs8XKRt1z2Yo3w5y5qKFfuJBMWHeFMIguPHzP0FDj+6/7Doo9f2fjrsaZdryc8cedvJfHh+QxAQIElkJAIFyKNhkkAQKfCsSXoOreLiVOx3tYJLzw8Bfr9njr7Z26O+xzb6NM2LiDda+6jBjTcvxDfFJw8eunFj49IpRGNK0+jJatqT54OyRAgMCEAgLhhFCeRoBALwJ1rxqNdbnGSzSlY0SCurc8rZtYygEfuSV+HSTGUPE3Qg454s1M+GDLE/e6i2wx/otn2wWqIT4p6GGR8PK37jtkksz8T34JZmY6LyRAYIkEBMIlapahEiDwiUD1M9oIhAu85i2SzKVH763b2upEkw8vQuDpJ1/aeOrXm0+/Gv89+8xr1298PPnLZ3tmfBNv64l2mXBru/Lq698+fE/L358Y4vOCgfLYhPMhrriu+5HK7nE7/KHF3bF5QIAAgVoCAmEtSfshQKCRwJXX3697pFiiWeDp7KVv3BsDqFtRdaIJhxdX80YOHL9tSUTTzadXLRMOwdtyBl55/Q8TNnTyp0UeW9RKe3ykcvmxQZYHo/y4gqDl4vPk4J5JgACBigICYUVMuyJAoIVAfI2w+rWIcTrb8rK9Xaa4WLT6F58ilVW/8cnugA9/cPH5OPje9cAYzOplwl+8UflTiVjkbDYDhwi0MTFi/C3XOXen4pVvf7n6Ryq7O48HjX8rcvzQHhMgQKCNgEDYxtlRCBCoKXD5lWs1d3dzXz88e6rxXQrj7PmZAVY2BjrdnwR8e2f/n2RYvUw4xCJbsxkYS7jVP1KJ6RGp7Mq3v9R4PS1WVge6WHR3wm+ur+0+9oAAAQIrKSAQrmRbFUVgxQUGyjwRz5plwkiDW088MESfLr/y3hC7nWSfh3x3ccUy4UAzML5N2maRbYiPVGKGxAWWLb/MGWuS1RfYy3ne7P8nlIe2hQABAm0EBMI2zo5CgEBNgVjiqH7N3mh8bTLhKA0OcZ3bAq8XPbLBq5QJ48rYIWZgTIn4mKBBJhwo0MYcaHaDn1gbjDXVI2fd/E+IpsiE8zPaAwECPQsIhD13x9gIEDhQYKAljjheZMJBb48RJ5dx0j9EGozBX3rx3QPJOviHVcqEA1HHxHjlu18ZOoEM95FKzLLIhNvf/+pwsfaTu8h8674Ga4O775hmX+/cPaIHBAgQaCkgELbUdiwCBKoJxBJHrIZV291nd/TjR++NO1VU/zZU7DCuCYzAOVAajB94WOD1op8lPPCvyITnfvbbA/+53j8MvVQV18cONwNjklT/MZI9tAMF2tFRRrF2iA9Wbq6uP9gyDUZFcSlsy9vA7umUPwkQIDC0gEA4tLD9EyAwlEDc03KoXR879s3774hVjooLNfFTaVe/+5X4xbnhxhyn+OVNPoc73Mx7jij1+LNvzvzyyV84yoSTP3/aZw46A2OqXP3uf9g8PdQdTaILQ9xaZtwwPliJrxTWWiqMz1NipS6WT6Ot40dp8zgiqEzYhtpRCBBoL/C5Y4883v6ojkiAAIH5Ba5e++h7D99z/NahPtiKPZ87c+fjD90VKSuONfOA45w+TiX/21/+RfUlxz1DevzZ380QCCteDvejiSN6eMbyWvDuKaH6nydv/zenv3B8oK/MRRUxPYZraww+PpKI8V/9/UczdPZIzBsf/7+hW7C+dvxv/uPdc5YQwv/9L//if//XM//p3/3bI4sa7gmRbM+eXtt6+/oQvRhu2PZMgACBIwUEwiOJPIEAgX4F4oz2Pw98jhgno6NYGArXPvy/k58LxqlwnM3/r//y7yMKxuOhESOMXZnpx/EWEghDo1kmjPP44TJhzIehM1WMP669fOju22O2v/GHP1acSNGCx87cGbGz4j733dWohEhT8a/x2yRRyL5PKzfGCyMKxucpEQWH++inPO5BW+KNPOpFDGaqQg7aoe0ECBDoQeCWYz94oYdxGAMBAgRmE4gLO+MbPrO9doZXxVV2ca1dfBEuTgfjwZ49xGLg2vHPxQ+XxYOWF7bFtwfXn3xp8rA6Pux/+fu/Gv9znse3/N0/TvvyyMzxfblpXzXD83969b3zPx/kOtWWMzAaHbE/Jl6sU8WNYWZw2POSmKjPPz7Iz5/sOdD4ny9sX//0TfTBn+KtNP5P8fnLxt23b5y8Lf67uX6i5Vt7fBgTPo5V7vj/A9GI7Q8+7UW8B+N7vLO9Eyc8qKcRIECguoBAWJ3UDgkQaCoQ38179q+/3PSQ/R3se8+9NfM9QhYbCMNy2TPhAmdgJKs9k3F97fOjEBUB+OKv3pkkNMbX/Ib+bfc9g1ztPyO0bz792p6gu9olq44AgWUXEAiXvYPGT4DAseRntLFoufHUr2eeBwsPhDHyZc+Efc7ASCYbT718ZCaMyyDf/v5XZ54/XlgKxMphrNiX220hQIBAnwJD3Yyhz2qNigCBlRSISwHj3HclS5ukqAvPvTXJ03p+TlxlN/kNaeYpZKB7RQ50Meo8lcZr47cfLn796J9uj8TYBn/Ocpbo5Z1f6bpEkoZKgEAbAYGwjbOjECAwoECc0Q76AwADDn3uXf/kxXfLrzLOvdcF7CA6GFc5NjjwEJmw20wVX8ObhDTwh/4JikmG4TkECBAgsBABgXAh7A5KgEBlgfgGXfl9qsrH6G93cRK/AsuDu66xzra8mTAyVYczcPKlquTL7LuT0AMCBAgkFBAIEzZdyQRWU+DcP/wm1YWjUWyfVyrOM72WOhP2makm/JnEuAnKKn24MM8k9FoCBAhkExAIs3VcvQRWViBu9R4391vZ8orC4vR9Je9kuLyZMC4cPf/sIL9sUTR/ig3x+w0TPju+ydlmhXbC8XgaAQIECLQREAjbODsKAQItBCIgPd7fGfkQlcddQOL0fYg997DPlpkwbnBaseQrr78fPwFScYeNdxXyvkzY2NzhCBAgsHABgXDhLTAAAgRqCkRMivus1Nxjf/v65Cfmnn+nv3HVHFEkkzZfyXvmsfvqZsL4OmtX62zxI+9TNWbz6VdlwqnEPJkAAQLLLiAQLnsHjZ8Agb0CcS1lV2fke8c339+/eOP9CEvz7WM5Xh1fCm2TTKpnwmhQtKkT5Qm/Q7g72rj0OtvXcXdr94AAAQI5BQTCnH1XNYEVF4gz8pXMhBGQkqTBmKA3vxTaaLVqiEzYJs0e+U5e/8LxI5+z5wnxZcj4Om6qWzTtEfAnAQIEUgkIhKnarVgCiQRWLxPGJZRxOV/EpDxdXN5M2HLkh8+H9bWpA2HsML6OKxMeDutfCRAgsDICAuHKtFIhBAjsFVilTBgLntnS4KidLZNV3XXCGPnGU79e+Er1tJeM7r6LIhNuPPVyJ+ucu6PygAABAgSqCwiE1UntkACBjgQiE67AfUfjNjl5rhQtZ8/yZsKoZeGfSjw45U1lxv1vXjva6Krd8eNWf/zOzo3q+7RDAgQIrIyAQLgyrVQIAQL7C8R9R88+s6xfiIrvcUWg9YvhkQmb3emk7jphTMql/lSik3XO/d/bk22NRc5Y6lz5mw9PhuFZBAgQ2EdAINwHxSYCBFZMYOvtnWW8+C1OZON7XCv8e4NTTbOWdzqpngmjiQ899fKi1qk2Tk762/QHdWSUaZfxNjORA+PC3Yi18amKy18P6q/tBAgkFxAIk08A5RPIIhBxIs4L4/fcl6XgOJGNLw3G97iWZcANxtnyTifVM+HoK3kL+TmKtT+/df7uRKZdrk9VIr7GpQHjq+vxhlpUJp/f3x4IECAwnIBAOJytPRMg0J1A/J57LNR0vlAQ56yjE9lY1uhOcNEDapwJ519bGwcbXfj62M9+03ipbX3t8+PDmPnx7qcqjcc/w4Dj85T1J1+KSwPGX3vT/7f9D358zB4TIECggYBA2ADZIQgQ6Ejg5kLNr7/33FsdnhfGkGINszyR7Yivg6G0zIRbTzxQNxOG35XX348Wt7z76Gy/PHFQq+NTlVgqXMhS50FDGt8eH/cc8nnKaPJ0/pHQeDkeEyBAoIGAQNgA2SEIEOhO4NLNBYRIX/3EwkgIcZ4dZ9vdYfU3oDitP/ez3zYY14njt1742j3VDxRLVfGtvFisjt+WrL7zcocz//JEuavRllgqjHv8RO5qM/6DhrFneyytxx2Y4srwPQuDe552MxOuwq1T99TlTwIECMwsIBDOTOeFBAgst0CclEf6irWahcfCiIKnn3wpEkKcZy+3acPRx0l/mx8Uqbu8Ni40SiYNYtXG3fPeVGZ82LuPowXxrbwG49894kEPRlEw3ssT3oEp3vvL9Y3igwq3nQABAlUEKnzRvMo47IQAAQILERjFwlgwPP/QXRcevufU2vFmw4iz2Dh/jUPHGJodtDxQrJHGOli5vf8to7P/uPvLoEOtvry2Z7SfxKr43+m1mIHf2bhrz79W+XPQCdZg/IcgxBLl5VeuTZgD9+wnPg+Ky3cvfePeR9ZP7PknfxIgQCCVwC3HfvBCqoIVS4AAgUME4gtjcYngufvvGC4jRQC78sb7V17/Q5yMHjKSZv8UUeT5xx+Y/3Bxah7rRfPvZ9o9RI4aNBPGl+Xi8shpRzXb8yN8RjnnHzo5z6/Jl4eOb8zG5w7l9upbBhp/Oc74MOWTLPfiu1UW1W9+GPTFiuYt50yJYwsBAgSmFRAIpxXzfAIEUghEMozTxAhLtU4T4z4WsZaytb3TSQ4c7+L8mSpSbvxkYlwDOb7bZo/nH/8hQ41LIqNxhzxhiH+K61TPnbmjSjKMiRdBfdBFwlJgNP5zZ+6su/g2ehPFeuAQM220SDv/h0GRBuPy78bgZQtsIUCAwOQCAuHkVp5JgEBGgVj0iK9gba6fWP/C8TjNnfwEN1bM4qTw6u8/3Nq+Hv/t/AQxzobjVHjaQQZOsEReinP0aV9bdzJFfLr06L3Vr/iNrynOdjlirepCePP0ifh4Ihq0cfK2aReuYxLG8uZiWxMjj7dPvIni7TPtxyuxEri986eYYJEAt97+5A1VC/aQ/cRc2lxfiwFP/maPvcVQ450es6X9xweH1OKfCBAgMImAQDiJkucQIEDgMwJxgn7Ij307I/wMVsM/oi9xNl/rgHFyX+WKxFrjif2MPp6IBxGxRrvd3RJhKT53GG2MYUeO2v4g/tvdbYoiFsaHCGvHPxfNGo12z39Hg9/548dDLAPuOdaRf45GGz/kGA/2fXLP1PsO2EYCBAiUAgJhaWILAQIECBAgQIAAAQIEUgj42YkUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGe9f8iAAAJZElEQVSBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikEBMIUbVYkAQIECBAgQIAAAQIESgGBsDSxhQABAgQIECBAgAABAikE/j+13+C9foh7ggAAAABJRU5ErkJggg==" id="image0_6364_18386" width="1200" height="630"/></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/okta-dark.svg b/web/packages/design/src/ResourceIcon/assets/okta-dark.svg
index 075a2ae19f027..1f243e3b58ac7 100644
--- a/web/packages/design/src/ResourceIcon/assets/okta-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/okta-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7541_35942)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.6051 0.5L38.1251 18.74C37.4251 18.66 36.7251 18.62 36.0051 18.62C35.1051 18.62 34.2251 18.68 33.3651 18.82L32.5251 9.98C32.5051 9.7 32.7251 9.46 33.0051 9.46H34.5051L33.7851 0.52C33.7651 0.24 33.9851 0 34.2451 0H39.1451C39.4251 0 39.6451 0.24 39.6051 0.52V0.5ZM27.2451 1.4C27.1651 1.14 26.8851 0.98 26.6251 1.08L22.0251 2.76C21.7651 2.86 21.6451 3.16 21.7651 3.4L25.5051 11.56L24.0851 12.08C23.8251 12.18 23.7051 12.48 23.8251 12.72L27.6451 20.74C29.0251 19.98 30.5251 19.4 32.1051 19.04L27.2651 1.4H27.2451ZM15.9651 6.48L26.5451 21.4C25.2051 22.28 23.9851 23.32 22.9451 24.52L16.6051 18.28C16.4051 18.08 16.4251 17.76 16.6251 17.58L17.7851 16.62L11.4851 10.24C11.2851 10.04 11.3051 9.72 11.5251 9.54L15.2651 6.4C15.4851 6.22 15.7851 6.26 15.9451 6.48H15.9651ZM7.08508 15.12C6.86508 14.96 6.54508 15.04 6.40508 15.28L3.96508 19.52C3.82508 19.76 3.92508 20.06 4.16508 20.18L12.2851 24.02L11.5251 25.32C11.3851 25.56 11.4851 25.88 11.7451 25.98L19.8251 29.68C20.4051 28.18 21.1851 26.78 22.1451 25.52L7.08508 15.12ZM1.10508 26.64C1.14508 26.36 1.42508 26.2 1.68508 26.26L19.3851 30.88C18.9251 32.38 18.6651 33.96 18.6251 35.6L9.76508 34.88C9.48508 34.86 9.28508 34.6 9.34508 34.32L9.60508 32.84L0.66508 32C0.38508 31.98 0.205079 31.72 0.245079 31.44L1.08508 26.62L1.10508 26.64ZM0.445079 38.6C0.165079 38.62 -0.0149205 38.88 0.0250795 39.16L0.88508 43.98C0.92508 44.26 1.20508 44.42 1.46508 44.36L10.1451 42.1L10.4051 43.58C10.4451 43.86 10.7251 44.02 10.9851 43.96L19.5451 41.6C19.0451 40.12 18.7251 38.54 18.6451 36.92L0.425079 38.6H0.445079ZM3.28508 51.28C3.14508 51.04 3.24508 50.74 3.48508 50.62L20.0051 42.78C20.6251 44.26 21.4651 45.64 22.4651 46.88L15.2251 52.04C15.0051 52.2 14.6851 52.14 14.5451 51.9L13.7851 50.58L6.40508 55.68C6.18508 55.84 5.86508 55.76 5.72508 55.52L3.26508 51.28H3.28508ZM23.3051 47.84L10.4451 60.86C10.2451 61.06 10.2651 61.38 10.4851 61.56L14.2451 64.7C14.4651 64.88 14.7651 64.84 14.9251 64.62L20.1251 57.3L21.2851 58.28C21.5051 58.46 21.8251 58.42 21.9851 58.18L27.0251 50.86C25.6651 50.02 24.4051 49 23.3251 47.84H23.3051ZM20.7651 68.74C20.5051 68.64 20.3851 68.34 20.5051 68.1L28.1251 51.46C29.5251 52.18 31.0451 52.72 32.6251 53.02L30.3851 61.62C30.3251 61.88 30.0251 62.04 29.7651 61.94L28.3451 61.42L25.9651 70.08C25.8851 70.34 25.6051 70.5 25.3451 70.4L20.7451 68.72L20.7651 68.74ZM33.8851 53.24L32.4051 71.48C32.3851 71.76 32.6051 72 32.8651 72H37.7651C38.0451 72 38.2651 71.76 38.2251 71.48L37.5051 62.54H39.0051C39.2851 62.54 39.5051 62.3 39.4851 62.02L38.6451 53.18C37.7851 53.32 36.9051 53.38 36.0051 53.38C35.2851 53.38 34.5851 53.34 33.8851 53.24ZM51.5251 3.86C51.6451 3.6 51.5251 3.32 51.2651 3.22L46.6651 1.54C46.4051 1.44 46.1251 1.6 46.0451 1.86L43.6651 10.52L42.2451 10C41.9851 9.9 41.7051 10.06 41.6251 10.32L39.3851 18.92C40.9851 19.24 42.4851 19.78 43.8851 20.48L51.5251 3.86ZM61.5651 11.12L48.7051 24.14C47.6251 22.98 46.3851 21.96 45.0051 21.12L50.0451 13.8C50.2051 13.58 50.5251 13.52 50.7451 13.7L51.9051 14.68L57.1051 7.36C57.2651 7.14 57.5851 7.1 57.7851 7.28L61.5451 10.42C61.7651 10.6 61.7651 10.92 61.5851 11.12H61.5651ZM68.5251 21.36C68.7851 21.24 68.8651 20.94 68.7251 20.7L66.2651 16.46C66.1251 16.22 65.8051 16.16 65.5851 16.3L58.2051 21.4L57.4451 20.1C57.3051 19.86 56.9851 19.78 56.7651 19.96L49.5251 25.12C50.5251 26.36 51.3451 27.74 51.9851 29.22L68.5051 21.38L68.5251 21.36ZM71.1251 28L71.9651 32.82C72.0051 33.1 71.8251 33.34 71.5451 33.38L53.3251 35.08C53.2451 33.44 52.9251 31.88 52.4251 30.4L60.9851 28.04C61.2451 27.96 61.5251 28.14 61.5651 28.42L61.8251 29.9L70.5051 27.64C70.7651 27.58 71.0451 27.74 71.0851 28.02L71.1251 28ZM70.3051 45.7C70.5651 45.76 70.8451 45.6 70.8851 45.32L71.7251 40.5C71.7651 40.22 71.5851 39.98 71.3051 39.94L62.3651 39.1L62.6251 37.62C62.6651 37.34 62.4851 37.1 62.2051 37.06L53.3451 36.34C53.3051 37.98 53.0451 39.56 52.5851 41.06L70.2851 45.68L70.3051 45.7ZM65.5851 56.7C65.4451 56.94 65.1251 57 64.9051 56.86L49.8451 46.46C50.8051 45.2 51.5851 43.8 52.1651 42.3L60.2451 46C60.5051 46.12 60.6051 46.42 60.4651 46.66L59.7051 47.96L67.8251 51.8C68.0651 51.92 68.1651 52.22 68.0251 52.46L65.5851 56.7ZM45.4451 50.56L56.0251 65.48C56.1851 65.7 56.5051 65.74 56.7051 65.56L60.4451 62.42C60.6651 62.24 60.6651 61.92 60.4851 61.72L54.1851 55.34L55.3451 54.38C55.5651 54.2 55.5651 53.88 55.3651 53.68L49.0251 47.44C47.9651 48.64 46.7651 49.7 45.4251 50.56H45.4451ZM45.3451 70.88C45.0851 70.98 44.8051 70.82 44.7251 70.56L39.8851 52.92C41.4651 52.56 42.9651 51.98 44.3451 51.22L48.1651 59.24C48.2851 59.5 48.1651 59.8 47.9051 59.88L46.4851 60.4L50.2251 68.56C50.3451 68.82 50.2251 69.1 49.9651 69.2L45.3651 70.88H45.3451Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_7541_35942">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_7541_35942)"><path fill="#fff" fill-rule="evenodd" d="m39.605.5-1.48 18.24c-.7-.08-1.4-.12-2.12-.12-.9 0-1.78.06-2.64.2l-.84-8.84c-.02-.28.2-.52.48-.52h1.5l-.72-8.94c-.02-.28.2-.52.46-.52h4.9c.28 0 .5.24.46.52zm-12.36.9c-.08-.26-.36-.42-.62-.32l-4.6 1.68c-.26.1-.38.4-.26.64l3.74 8.16-1.42.52c-.26.1-.38.4-.26.64l3.82 8.02c1.38-.76 2.88-1.34 4.46-1.7L27.265 1.4zm-11.28 5.08 10.58 14.92c-1.34.88-2.56 1.92-3.6 3.12l-6.34-6.24c-.2-.2-.18-.52.02-.7l1.16-.96-6.3-6.38c-.2-.2-.18-.52.04-.7l3.74-3.14c.22-.18.52-.14.68.08zm-8.88 8.64c-.22-.16-.54-.08-.68.16l-2.44 4.24c-.14.24-.04.54.2.66l8.12 3.84-.76 1.3a.46.46 0 0 0 .22.66l8.08 3.7c.58-1.5 1.36-2.9 2.32-4.16zm-5.98 11.52c.04-.28.32-.44.58-.38l17.7 4.62c-.46 1.5-.72 3.08-.76 4.72l-8.86-.72a.462.462 0 0 1-.42-.56l.26-1.48L.665 32c-.28-.02-.46-.28-.42-.56l.84-4.82zM.445 38.6c-.28.02-.46.28-.42.56l.86 4.82c.04.28.32.44.58.38l8.68-2.26.26 1.48c.04.28.32.44.58.38l8.56-2.36c-.5-1.48-.82-3.06-.9-4.68L.425 38.6zm2.84 12.68a.473.473 0 0 1 .2-.66l16.52-7.84c.62 1.48 1.46 2.86 2.46 4.1l-7.24 5.16a.47.47 0 0 1-.68-.14l-.76-1.32-7.38 5.1c-.22.16-.54.08-.68-.16l-2.46-4.24zm20.02-3.44-12.86 13.02c-.2.2-.18.52.04.7l3.76 3.14c.22.18.52.14.68-.08l5.2-7.32 1.16.98c.22.18.54.14.7-.1l5.04-7.32c-1.36-.84-2.62-1.86-3.7-3.02zm-2.54 20.9c-.26-.1-.38-.4-.26-.64l7.62-16.64c1.4.72 2.92 1.26 4.5 1.56l-2.24 8.6c-.06.26-.36.42-.62.32l-1.42-.52-2.38 8.66c-.08.26-.36.42-.62.32l-4.6-1.68zm13.12-15.5-1.48 18.24c-.02.28.2.52.46.52h4.9c.28 0 .5-.24.46-.52l-.72-8.94h1.5c.28 0 .5-.24.48-.52l-.84-8.84c-.86.14-1.74.2-2.64.2-.72 0-1.42-.04-2.12-.14m17.64-49.38c.12-.26 0-.54-.26-.64l-4.6-1.68c-.26-.1-.54.06-.62.32l-2.38 8.66-1.42-.52c-.26-.1-.54.06-.62.32l-2.24 8.6c1.6.32 3.1.86 4.5 1.56zm10.04 7.26-12.86 13.02a17.5 17.5 0 0 0-3.7-3.02l5.04-7.32c.16-.22.48-.28.7-.1l1.16.98 5.2-7.32c.16-.22.48-.26.68-.08l3.76 3.14c.22.18.22.5.04.7zm6.96 10.24c.26-.12.34-.42.2-.66l-2.46-4.24a.49.49 0 0 0-.68-.16l-7.38 5.1-.76-1.3c-.14-.24-.46-.32-.68-.14l-7.24 5.16c1 1.24 1.82 2.62 2.46 4.1l16.52-7.84zm2.6 6.64.84 4.82c.04.28-.14.52-.42.56l-18.22 1.7c-.08-1.64-.4-3.2-.9-4.68l8.56-2.36c.26-.08.54.1.58.38l.26 1.48 8.68-2.26c.26-.06.54.1.58.38zm-.82 17.7c.26.06.54-.1.58-.38l.84-4.82a.483.483 0 0 0-.42-.56l-8.94-.84.26-1.48a.483.483 0 0 0-.42-.56l-8.86-.72c-.04 1.64-.3 3.22-.76 4.72l17.7 4.62zm-4.72 11c-.14.24-.46.3-.68.16l-15.06-10.4c.96-1.26 1.74-2.66 2.32-4.16l8.08 3.7c.26.12.36.42.22.66l-.76 1.3 8.12 3.84c.24.12.34.42.2.66zm-20.14-6.14 10.58 14.92c.16.22.48.26.68.08l3.74-3.14c.22-.18.22-.5.04-.7l-6.3-6.38 1.16-.96c.22-.18.22-.5.02-.7l-6.34-6.24c-1.06 1.2-2.26 2.26-3.6 3.12zm-.1 20.32c-.26.1-.54-.06-.62-.32l-4.84-17.64c1.58-.36 3.08-.94 4.46-1.7l3.82 8.02c.12.26 0 .56-.26.64l-1.42.52 3.74 8.16c.12.26 0 .54-.26.64l-4.6 1.68z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_7541_35942"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/okta-light.svg b/web/packages/design/src/ResourceIcon/assets/okta-light.svg
index 0f59179983432..5782165c670f9 100644
--- a/web/packages/design/src/ResourceIcon/assets/okta-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/okta-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_7541_35943)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M39.6051 0.5L38.1251 18.74C37.4251 18.66 36.7251 18.62 36.0051 18.62C35.1051 18.62 34.2251 18.68 33.3651 18.82L32.5251 9.98C32.5051 9.7 32.7251 9.46 33.0051 9.46H34.5051L33.7851 0.52C33.7651 0.24 33.9851 0 34.2451 0H39.1451C39.4251 0 39.6451 0.24 39.6051 0.52V0.5ZM27.2451 1.4C27.1651 1.14 26.8851 0.98 26.6251 1.08L22.0251 2.76C21.7651 2.86 21.6451 3.16 21.7651 3.4L25.5051 11.56L24.0851 12.08C23.8251 12.18 23.7051 12.48 23.8251 12.72L27.6451 20.74C29.0251 19.98 30.5251 19.4 32.1051 19.04L27.2651 1.4H27.2451ZM15.9651 6.48L26.5451 21.4C25.2051 22.28 23.9851 23.32 22.9451 24.52L16.6051 18.28C16.4051 18.08 16.4251 17.76 16.6251 17.58L17.7851 16.62L11.4851 10.24C11.2851 10.04 11.3051 9.72 11.5251 9.54L15.2651 6.4C15.4851 6.22 15.7851 6.26 15.9451 6.48H15.9651ZM7.08508 15.12C6.86508 14.96 6.54508 15.04 6.40508 15.28L3.96508 19.52C3.82508 19.76 3.92508 20.06 4.16508 20.18L12.2851 24.02L11.5251 25.32C11.3851 25.56 11.4851 25.88 11.7451 25.98L19.8251 29.68C20.4051 28.18 21.1851 26.78 22.1451 25.52L7.08508 15.12ZM1.10508 26.64C1.14508 26.36 1.42508 26.2 1.68508 26.26L19.3851 30.88C18.9251 32.38 18.6651 33.96 18.6251 35.6L9.76508 34.88C9.48508 34.86 9.28508 34.6 9.34508 34.32L9.60508 32.84L0.66508 32C0.38508 31.98 0.205079 31.72 0.245079 31.44L1.08508 26.62L1.10508 26.64ZM0.445079 38.6C0.165079 38.62 -0.0149205 38.88 0.0250795 39.16L0.88508 43.98C0.92508 44.26 1.20508 44.42 1.46508 44.36L10.1451 42.1L10.4051 43.58C10.4451 43.86 10.7251 44.02 10.9851 43.96L19.5451 41.6C19.0451 40.12 18.7251 38.54 18.6451 36.92L0.425079 38.6H0.445079ZM3.28508 51.28C3.14508 51.04 3.24508 50.74 3.48508 50.62L20.0051 42.78C20.6251 44.26 21.4651 45.64 22.4651 46.88L15.2251 52.04C15.0051 52.2 14.6851 52.14 14.5451 51.9L13.7851 50.58L6.40508 55.68C6.18508 55.84 5.86508 55.76 5.72508 55.52L3.26508 51.28H3.28508ZM23.3051 47.84L10.4451 60.86C10.2451 61.06 10.2651 61.38 10.4851 61.56L14.2451 64.7C14.4651 64.88 14.7651 64.84 14.9251 64.62L20.1251 57.3L21.2851 58.28C21.5051 58.46 21.8251 58.42 21.9851 58.18L27.0251 50.86C25.6651 50.02 24.4051 49 23.3251 47.84H23.3051ZM20.7651 68.74C20.5051 68.64 20.3851 68.34 20.5051 68.1L28.1251 51.46C29.5251 52.18 31.0451 52.72 32.6251 53.02L30.3851 61.62C30.3251 61.88 30.0251 62.04 29.7651 61.94L28.3451 61.42L25.9651 70.08C25.8851 70.34 25.6051 70.5 25.3451 70.4L20.7451 68.72L20.7651 68.74ZM33.8851 53.24L32.4051 71.48C32.3851 71.76 32.6051 72 32.8651 72H37.7651C38.0451 72 38.2651 71.76 38.2251 71.48L37.5051 62.54H39.0051C39.2851 62.54 39.5051 62.3 39.4851 62.02L38.6451 53.18C37.7851 53.32 36.9051 53.38 36.0051 53.38C35.2851 53.38 34.5851 53.34 33.8851 53.24ZM51.5251 3.86C51.6451 3.6 51.5251 3.32 51.2651 3.22L46.6651 1.54C46.4051 1.44 46.1251 1.6 46.0451 1.86L43.6651 10.52L42.2451 10C41.9851 9.9 41.7051 10.06 41.6251 10.32L39.3851 18.92C40.9851 19.24 42.4851 19.78 43.8851 20.48L51.5251 3.86ZM61.5651 11.12L48.7051 24.14C47.6251 22.98 46.3851 21.96 45.0051 21.12L50.0451 13.8C50.2051 13.58 50.5251 13.52 50.7451 13.7L51.9051 14.68L57.1051 7.36C57.2651 7.14 57.5851 7.1 57.7851 7.28L61.5451 10.42C61.7651 10.6 61.7651 10.92 61.5851 11.12H61.5651ZM68.5251 21.36C68.7851 21.24 68.8651 20.94 68.7251 20.7L66.2651 16.46C66.1251 16.22 65.8051 16.16 65.5851 16.3L58.2051 21.4L57.4451 20.1C57.3051 19.86 56.9851 19.78 56.7651 19.96L49.5251 25.12C50.5251 26.36 51.3451 27.74 51.9851 29.22L68.5051 21.38L68.5251 21.36ZM71.1251 28L71.9651 32.82C72.0051 33.1 71.8251 33.34 71.5451 33.38L53.3251 35.08C53.2451 33.44 52.9251 31.88 52.4251 30.4L60.9851 28.04C61.2451 27.96 61.5251 28.14 61.5651 28.42L61.8251 29.9L70.5051 27.64C70.7651 27.58 71.0451 27.74 71.0851 28.02L71.1251 28ZM70.3051 45.7C70.5651 45.76 70.8451 45.6 70.8851 45.32L71.7251 40.5C71.7651 40.22 71.5851 39.98 71.3051 39.94L62.3651 39.1L62.6251 37.62C62.6651 37.34 62.4851 37.1 62.2051 37.06L53.3451 36.34C53.3051 37.98 53.0451 39.56 52.5851 41.06L70.2851 45.68L70.3051 45.7ZM65.5851 56.7C65.4451 56.94 65.1251 57 64.9051 56.86L49.8451 46.46C50.8051 45.2 51.5851 43.8 52.1651 42.3L60.2451 46C60.5051 46.12 60.6051 46.42 60.4651 46.66L59.7051 47.96L67.8251 51.8C68.0651 51.92 68.1651 52.22 68.0251 52.46L65.5851 56.7ZM45.4451 50.56L56.0251 65.48C56.1851 65.7 56.5051 65.74 56.7051 65.56L60.4451 62.42C60.6651 62.24 60.6651 61.92 60.4851 61.72L54.1851 55.34L55.3451 54.38C55.5651 54.2 55.5651 53.88 55.3651 53.68L49.0251 47.44C47.9651 48.64 46.7651 49.7 45.4251 50.56H45.4451ZM45.3451 70.88C45.0851 70.98 44.8051 70.82 44.7251 70.56L39.8851 52.92C41.4651 52.56 42.9651 51.98 44.3451 51.22L48.1651 59.24C48.2851 59.5 48.1651 59.8 47.9051 59.88L46.4851 60.4L50.2251 68.56C50.3451 68.82 50.2251 69.1 49.9651 69.2L45.3651 70.88H45.3451Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_7541_35943">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_7541_35943)"><path fill="#000" fill-rule="evenodd" d="m39.605.5-1.48 18.24c-.7-.08-1.4-.12-2.12-.12-.9 0-1.78.06-2.64.2l-.84-8.84c-.02-.28.2-.52.48-.52h1.5l-.72-8.94c-.02-.28.2-.52.46-.52h4.9c.28 0 .5.24.46.52zm-12.36.9c-.08-.26-.36-.42-.62-.32l-4.6 1.68c-.26.1-.38.4-.26.64l3.74 8.16-1.42.52c-.26.1-.38.4-.26.64l3.82 8.02c1.38-.76 2.88-1.34 4.46-1.7L27.265 1.4zm-11.28 5.08 10.58 14.92c-1.34.88-2.56 1.92-3.6 3.12l-6.34-6.24c-.2-.2-.18-.52.02-.7l1.16-.96-6.3-6.38c-.2-.2-.18-.52.04-.7l3.74-3.14c.22-.18.52-.14.68.08zm-8.88 8.64c-.22-.16-.54-.08-.68.16l-2.44 4.24c-.14.24-.04.54.2.66l8.12 3.84-.76 1.3a.46.46 0 0 0 .22.66l8.08 3.7c.58-1.5 1.36-2.9 2.32-4.16zm-5.98 11.52c.04-.28.32-.44.58-.38l17.7 4.62c-.46 1.5-.72 3.08-.76 4.72l-8.86-.72a.462.462 0 0 1-.42-.56l.26-1.48L.665 32c-.28-.02-.46-.28-.42-.56l.84-4.82zM.445 38.6c-.28.02-.46.28-.42.56l.86 4.82c.04.28.32.44.58.38l8.68-2.26.26 1.48c.04.28.32.44.58.38l8.56-2.36c-.5-1.48-.82-3.06-.9-4.68L.425 38.6zm2.84 12.68a.473.473 0 0 1 .2-.66l16.52-7.84c.62 1.48 1.46 2.86 2.46 4.1l-7.24 5.16a.47.47 0 0 1-.68-.14l-.76-1.32-7.38 5.1c-.22.16-.54.08-.68-.16l-2.46-4.24zm20.02-3.44-12.86 13.02c-.2.2-.18.52.04.7l3.76 3.14c.22.18.52.14.68-.08l5.2-7.32 1.16.98c.22.18.54.14.7-.1l5.04-7.32c-1.36-.84-2.62-1.86-3.7-3.02zm-2.54 20.9c-.26-.1-.38-.4-.26-.64l7.62-16.64c1.4.72 2.92 1.26 4.5 1.56l-2.24 8.6c-.06.26-.36.42-.62.32l-1.42-.52-2.38 8.66c-.08.26-.36.42-.62.32l-4.6-1.68zm13.12-15.5-1.48 18.24c-.02.28.2.52.46.52h4.9c.28 0 .5-.24.46-.52l-.72-8.94h1.5c.28 0 .5-.24.48-.52l-.84-8.84c-.86.14-1.74.2-2.64.2-.72 0-1.42-.04-2.12-.14m17.64-49.38c.12-.26 0-.54-.26-.64l-4.6-1.68c-.26-.1-.54.06-.62.32l-2.38 8.66-1.42-.52c-.26-.1-.54.06-.62.32l-2.24 8.6c1.6.32 3.1.86 4.5 1.56zm10.04 7.26-12.86 13.02a17.5 17.5 0 0 0-3.7-3.02l5.04-7.32c.16-.22.48-.28.7-.1l1.16.98 5.2-7.32c.16-.22.48-.26.68-.08l3.76 3.14c.22.18.22.5.04.7zm6.96 10.24c.26-.12.34-.42.2-.66l-2.46-4.24a.49.49 0 0 0-.68-.16l-7.38 5.1-.76-1.3c-.14-.24-.46-.32-.68-.14l-7.24 5.16c1 1.24 1.82 2.62 2.46 4.1l16.52-7.84zm2.6 6.64.84 4.82c.04.28-.14.52-.42.56l-18.22 1.7c-.08-1.64-.4-3.2-.9-4.68l8.56-2.36c.26-.08.54.1.58.38l.26 1.48 8.68-2.26c.26-.06.54.1.58.38zm-.82 17.7c.26.06.54-.1.58-.38l.84-4.82a.483.483 0 0 0-.42-.56l-8.94-.84.26-1.48a.483.483 0 0 0-.42-.56l-8.86-.72c-.04 1.64-.3 3.22-.76 4.72l17.7 4.62zm-4.72 11c-.14.24-.46.3-.68.16l-15.06-10.4c.96-1.26 1.74-2.66 2.32-4.16l8.08 3.7c.26.12.36.42.22.66l-.76 1.3 8.12 3.84c.24.12.34.42.2.66zm-20.14-6.14 10.58 14.92c.16.22.48.26.68.08l3.74-3.14c.22-.18.22-.5.04-.7l-6.3-6.38 1.16-.96c.22-.18.22-.5.02-.7l-6.34-6.24c-1.06 1.2-2.26 2.26-3.6 3.12zm-.1 20.32c-.26.1-.54-.06-.62-.32l-4.84-17.64c1.58-.36 3.08-.94 4.46-1.7l3.82 8.02c.12.26 0 .56-.26.64l-1.42.52 3.74 8.16c.12.26 0 .54-.26.64l-4.6 1.68z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_7541_35943"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/onehundredonedomain.svg b/web/packages/design/src/ResourceIcon/assets/onehundredonedomain.svg
index 3a2282ac9fc52..9de2e5e534745 100644
--- a/web/packages/design/src/ResourceIcon/assets/onehundredonedomain.svg
+++ b/web/packages/design/src/ResourceIcon/assets/onehundredonedomain.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M68.5244 10.7871H56.2091L55.788 12.05L55.4722 12.8923C54.8408 14.8922 54.8408 14.8922 51.2617 15.6291L49.9988 15.9448L49.6831 17.629C48.525 14.471 41.8941 11.1028 41.8941 11.1028L41.9995 11.2082C40.1045 10.261 37.9998 9.83984 35.8946 9.83984C33.1578 9.83984 30.4211 10.5767 28.0001 11.9451C26.5264 12.7874 25.3688 13.945 24.3162 15.2084L20.948 10.7876V10.6822L8.7377 10.7876L8.31655 11.9456L8.00081 12.8928C7.36934 14.8927 7.36934 14.8927 3.79032 15.6296L2.52737 15.9454L0.737863 26.682L4.10605 30.0503L0.316712 56.05L0.000976562 58.0498L3.6849 62.155H16.8424L18.4211 51.8394C18.7369 52.5763 19.0526 53.4181 19.4737 54.0501C19.6841 54.3658 19.8949 54.6816 20.1052 54.8924C20.1052 54.9978 20.2106 55.1027 20.2106 55.1027C21.6844 56.7869 23.2631 58.3661 24.8423 59.8394C25.8949 60.4708 26.9475 60.9974 28.1056 61.3132C29.2636 61.7343 30.4211 61.9446 31.6846 62.0501C34.1056 62.1555 36.4211 61.9446 38.8421 61.3132C42.526 60.3659 45.4736 57.7341 46.8419 54.1555C47.6842 52.2606 48.6315 45.8398 48.6315 45.8398L50.5264 33.2087L50.9475 30.0508L51.6844 30.7877L47.6848 57.8395L51.8952 62.0501H65.1582L72 15.6301L68.5244 10.7871Z" fill="#92864F"/>
-<path d="M10.6319 13.4189L10.4216 13.7346C9.47436 16.5768 9.05321 17.1029 4.84271 18.1555L3.8955 24.1556H7.79026L3.05371 55.4179H11.4747L17.8953 13.3135L10.6319 13.4189Z" fill="#FECD27"/>
-<path d="M12.8426 56.8918H1.36914L6.00078 25.5241H2.10603L3.5798 16.7872L4.10586 16.6818C8.21093 15.7346 8.31635 15.6292 9.15815 13.2082L9.47388 12.2609L9.6842 11.7349H19.8942L12.8426 56.8918ZM3.05323 55.418H11.4742L17.8949 13.3136L10.5265 13.419L10.4211 13.7347C9.47388 16.5769 9.05273 17.103 4.84223 18.1556L3.89503 24.1557H7.78978L3.05323 55.418Z" fill="white"/>
-<path d="M29.9991 57.628C27.9993 57.7334 25.9994 57.4176 24.1045 56.6807C22.5258 56.0493 21.2624 54.9966 20.5255 53.5228C19.7886 52.1545 19.2625 50.7861 19.0517 49.2074C18.9463 46.8918 19.0517 44.5757 19.4729 42.2601L21.6835 27.1025C22.1047 23.9446 22.8416 20.8921 23.9991 17.945C24.9463 15.8397 26.6304 13.9453 28.6307 12.7872C30.8414 11.5243 33.3673 10.7874 35.8937 10.8928C37.8935 10.8928 39.8933 11.3139 41.7883 12.2612C43.262 12.9981 44.525 14.1561 45.3673 15.6294C46.1042 16.9978 46.5253 18.4716 46.5253 20.0503C46.5253 22.4713 46.315 24.9977 45.8939 27.4187L43.7886 41.9448C43.4729 44.4713 42.9463 46.8923 42.2099 49.3133C41.5784 50.9974 40.6312 52.4712 39.4732 53.7342C38.3152 55.1025 36.8419 56.0498 35.1578 56.7867C33.5781 57.4176 31.894 57.7334 29.9991 57.628ZM35.9991 12.471C33.6835 12.471 31.4729 12.997 29.473 14.1551C27.6835 15.2077 26.3152 16.7864 25.3679 18.576C24.2099 21.4181 23.4735 24.3652 23.1573 27.3128L20.9466 42.5758C20.5255 44.6811 20.4206 46.8913 20.5255 49.102C20.7358 50.4703 21.1569 51.7333 21.7884 52.8913C22.4199 54.0494 23.4725 54.8912 24.6306 55.4178C26.3146 56.0493 28.2096 56.365 29.9986 56.2601C31.5773 56.2601 33.1564 55.9443 34.6302 55.4178C36.104 54.8912 37.3669 53.944 38.4196 52.7864C39.4722 51.6284 40.3145 50.26 40.8405 48.7867C41.5774 46.4711 42.1035 44.155 42.3143 41.734L44.4196 27.2079C44.8407 24.8923 45.051 22.5762 45.1565 20.1552C45.1565 18.8922 44.7353 17.5238 44.2092 16.4712C43.4724 15.3132 42.4197 14.3659 41.2622 13.7345C39.5776 12.8921 37.7881 12.471 35.9991 12.471Z" fill="white"/>
-<path d="M45.1566 20.1555C45.1566 18.8925 44.7354 17.5241 44.2094 16.4715C43.4725 15.3134 42.4198 14.3662 41.2623 13.7347C39.6836 12.8924 37.8941 12.5767 36.1046 12.5767C33.789 12.5767 31.5784 13.1027 29.5786 14.2608C27.789 15.3134 26.4207 16.8921 25.4735 18.6817C24.3154 21.5238 23.5791 24.4709 23.2628 27.4185L20.9472 42.5761C20.5261 44.6813 20.4212 46.8915 20.5261 49.1022C20.7364 50.4706 21.1576 51.7336 21.789 52.8916C22.4205 54.0497 23.4731 54.8915 24.6312 55.418C26.3153 56.0495 28.2102 56.3653 29.9992 56.2604C31.5779 56.2604 33.1571 55.9446 34.6308 55.418C36.1046 54.8915 37.3676 53.9442 38.4202 52.7867C39.4728 51.6286 40.3151 50.2603 40.8412 48.787C41.5781 46.4714 42.1041 44.1553 42.3149 41.7343L44.4202 27.2082C44.9462 24.8921 45.1566 22.4711 45.1566 20.1555ZM37.5779 19.4185C37.4725 20.9972 37.2621 22.471 36.9464 23.9448L33.4728 45.5231C33.2625 46.9969 32.9467 48.4702 32.6305 49.8386C31.999 51.7336 30.841 52.0493 30.2095 52.0493C29.578 52.0493 29.0515 51.839 28.6308 51.4178C28.1048 50.8918 27.894 50.1549 27.894 49.418C27.9994 47.8393 28.2097 46.1546 28.5254 44.5759L31.999 23.4183C32.2094 21.9445 32.5251 20.3658 32.8413 18.892C33.4728 16.8921 34.6308 16.6813 35.2623 16.6813C35.8938 16.6813 36.4204 16.8916 36.841 17.3128C37.4725 17.8399 37.6833 18.5767 37.5779 19.4185Z" fill="#FECD27"/>
-<path d="M36.947 17.2086C36.5259 16.7875 35.9998 16.5771 35.3684 16.5771C34.7369 16.5771 33.4739 16.8929 32.9474 18.7878C32.5262 20.2616 32.3159 21.8403 32.1051 23.3141L28.6315 44.5767C28.3157 46.1554 28.1054 47.84 28 49.4187C28 50.1556 28.2103 50.8925 28.7369 51.4186C29.158 51.8397 29.6841 52.0501 30.3156 52.0501C30.947 52.0501 32.2105 51.7343 32.7366 49.8394C33.1577 48.471 33.368 46.9972 33.5789 45.5239L37.0525 23.9456C37.3682 22.4718 37.5785 20.8931 37.6839 19.4193C37.6839 18.577 37.4731 17.8401 36.947 17.2086ZM35.4733 23.7348L31.9997 45.3131C31.6839 47.4184 31.3682 48.7867 31.1574 49.4182C31.0519 49.734 30.8416 50.5763 30.1047 50.5763C29.8944 50.5763 29.789 50.4709 29.5787 50.3659C29.4733 50.1556 29.3684 49.7345 29.3684 49.4187C29.4738 47.84 29.6841 46.3662 29.9998 44.787L33.4734 23.5245C33.6838 22.0507 33.9995 20.5774 34.3157 19.209C34.4212 18.8933 34.6315 18.0509 35.3684 18.0509C35.5787 18.0509 35.6841 18.1564 35.8944 18.2613C36.1047 18.577 36.2102 18.8927 36.1047 19.3139C36.1047 19.9454 35.8944 21.4187 35.4733 23.7348Z" fill="white"/>
-<path d="M58.1031 13.4189L57.9977 13.8401C57.0505 16.6823 56.524 17.2083 52.4189 18.261L51.4717 24.261H55.3664L50.6299 55.5234H59.0509L65.4715 13.4189H58.1031Z" fill="#FECD27"/>
-<path d="M60.3143 56.8918H48.8408L53.5774 25.5241H49.5777L51.0515 16.7872L51.5775 16.6818C55.6826 15.7346 55.788 15.6292 56.6298 13.2082L56.9456 12.2609L57.1559 11.7349H67.3659L60.3143 56.8918ZM50.6303 55.418H59.0513L65.472 13.3136L58.1036 13.419L57.9982 13.8401C57.051 16.6823 56.6298 17.2084 52.4193 18.261L51.4721 24.2611H55.3669L50.6303 55.418Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#92864f" d="M68.524 10.787H56.21l-.421 1.263-.316.842c-.631 2-.631 2-4.21 2.737L50 15.945l-.316 1.684c-1.158-3.158-7.789-6.526-7.789-6.526l.105.105c-1.895-.947-4-1.368-6.104-1.368-2.737 0-5.474.737-7.895 2.105-1.474.842-2.631 2-3.684 3.263l-3.368-4.42v-.106l-12.21.106-.421 1.158-.316.947c-.632 2-.632 2-4.21 2.737l-1.264.315-1.79 10.737 3.369 3.368-3.79 26-.315 2 3.684 4.105h13.157l1.58-10.316c.315.737.63 1.58 1.052 2.211.21.316.42.632.631.842 0 .106.106.21.106.21 1.473 1.685 3.052 3.264 4.631 4.737 1.053.632 2.106 1.158 3.264 1.474 1.158.421 2.315.632 3.579.737 2.42.106 4.736-.105 7.157-.737 3.684-.947 6.632-3.579 8-7.157.842-1.895 1.79-8.316 1.79-8.316l1.894-12.631.421-3.158.737.737-4 27.052 4.211 4.21h13.263L72 15.63z"/><path fill="#fecd27" d="m10.632 13.419-.21.316c-.948 2.842-1.369 3.368-5.58 4.42l-.946 6H7.79L3.054 55.419h8.42l6.421-42.104z"/><path fill="#fff" d="M12.843 56.892H1.369l4.632-31.368H2.106l1.474-8.737.526-.105c4.105-.947 4.21-1.053 5.052-3.474l.316-.947.21-.526h10.21zm-9.79-1.474h8.421l6.42-42.104-7.367.105-.106.316c-.947 2.842-1.368 3.368-5.579 4.42l-.947 6H7.79zM30 57.628c-2 .105-4-.21-5.895-.947-1.58-.632-2.843-1.684-3.58-3.158-.736-1.369-1.262-2.737-1.473-4.316-.106-2.315 0-4.631.42-6.947l2.211-15.157c.422-3.158 1.159-6.21 2.316-9.158.947-2.105 2.631-4 4.632-5.158 2.21-1.263 4.736-2 7.263-1.894 2 0 4 .42 5.894 1.368a8.5 8.5 0 0 1 3.58 3.368c.736 1.369 1.157 2.843 1.157 4.421 0 2.421-.21 4.948-.631 7.369l-2.105 14.526a44 44 0 0 1-1.58 7.368 13.6 13.6 0 0 1-2.736 4.421c-1.158 1.368-2.631 2.316-4.315 3.053a11.85 11.85 0 0 1-5.159.841m6-45.157c-2.316 0-4.527.526-6.527 1.684-1.79 1.053-3.158 2.631-4.105 4.421a32.3 32.3 0 0 0-2.21 8.737l-2.211 15.263c-.421 2.105-.526 4.315-.421 6.526q.314 2.052 1.262 3.79c.632 1.157 1.685 2 2.843 2.526 1.684.631 3.579.947 5.368.842 1.578 0 3.157-.316 4.631-.842 1.474-.527 2.737-1.474 3.79-2.632a12 12 0 0 0 2.42-4c.737-2.315 1.263-4.631 1.474-7.052l2.106-14.526c.42-2.316.631-4.632.736-7.053 0-1.263-.42-2.631-.947-3.684a8.15 8.15 0 0 0-2.947-2.736A11.7 11.7 0 0 0 36 12.47"/><path fill="#fecd27" d="M45.157 20.156c0-1.264-.422-2.632-.948-3.684a8.15 8.15 0 0 0-2.947-2.737c-1.578-.843-3.368-1.158-5.157-1.158-2.316 0-4.527.526-6.526 1.684-1.79 1.052-3.158 2.631-4.105 4.42a32.3 32.3 0 0 0-2.211 8.738l-2.316 15.157c-.42 2.105-.526 4.316-.42 6.526q.315 2.053 1.262 3.79c.631 1.158 1.684 2 2.842 2.526 1.684.632 3.58.947 5.368.842 1.579 0 3.158-.315 4.632-.842s2.737-1.474 3.79-2.631a12 12 0 0 0 2.42-4c.737-2.316 1.263-4.632 1.474-7.053l2.105-14.526c.526-2.316.737-4.737.737-7.052m-7.58-.737a31 31 0 0 1-.63 4.526l-3.474 21.578c-.21 1.474-.526 2.947-.843 4.316-.631 1.895-1.789 2.21-2.42 2.21q-.948 0-1.58-.631c-.525-.526-.736-1.263-.736-2 .105-1.579.316-3.263.631-4.842L32 23.418c.21-1.473.526-3.052.842-4.526.632-2 1.79-2.21 2.421-2.21q.948 0 1.579.63c.631.528.842 1.265.737 2.107"/><path fill="#fff" d="M36.947 17.209q-.631-.632-1.579-.632c-.631 0-1.894.316-2.42 2.21-.422 1.475-.632 3.053-.843 4.527l-3.473 21.263A38 38 0 0 0 28 49.419c0 .737.21 1.474.737 2q.631.63 1.579.631c.631 0 1.895-.316 2.42-2.21.422-1.369.632-2.843.843-4.316l3.474-21.578c.315-1.474.526-3.053.63-4.527 0-.842-.21-1.579-.736-2.21m-1.474 6.526L32 45.313c-.316 2.105-.632 3.474-.843 4.105-.105.316-.315 1.158-1.052 1.158-.21 0-.316-.105-.526-.21a2.5 2.5 0 0 1-.21-.947c.105-1.579.315-3.053.63-4.632l3.474-21.262c.21-1.474.526-2.948.843-4.316.105-.316.316-1.158 1.052-1.158.21 0 .316.105.526.21.21.316.316.632.21 1.053q0 .947-.63 4.42"/><path fill="#fecd27" d="m58.103 13.419-.105.421c-.947 2.842-1.474 3.368-5.58 4.421l-.946 6h3.894L50.63 55.523h8.42l6.422-42.104z"/><path fill="#fff" d="M60.314 56.892H48.841l4.736-31.368h-4l1.474-8.737.526-.105c4.106-.947 4.211-1.053 5.053-3.474l.316-.947.21-.526h10.21zm-9.684-1.474h8.421l6.421-42.104-7.368.105-.106.421c-.947 2.842-1.368 3.368-5.579 4.421l-.947 6h3.895z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/onelogin-dark.svg b/web/packages/design/src/ResourceIcon/assets/onelogin-dark.svg
index 445908c0508f1..42b48be831d8d 100644
--- a/web/packages/design/src/ResourceIcon/assets/onelogin-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/onelogin-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="72" height="72" rx="36" fill="white"/>
-<path d="M27 25C27 24.4477 27.4477 24 28 24H40C40.5523 24 41 24.4477 41 25V49C41 49.5523 40.5523 50 40 50H34C33.4477 50 33 49.5523 33 49V32H28C27.4477 32 27 31.5523 27 31V25Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><rect width="72" height="72" fill="#fff" rx="36"/><path fill="#000" d="M27 25a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v24a1 1 0 0 1-1 1h-6a1 1 0 0 1-1-1V32h-5a1 1 0 0 1-1-1z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/onelogin-light.svg b/web/packages/design/src/ResourceIcon/assets/onelogin-light.svg
index bd026190ab91f..024145369be2e 100644
--- a/web/packages/design/src/ResourceIcon/assets/onelogin-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/onelogin-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="72" height="72" rx="36" fill="black"/>
-<path d="M27 25C27 24.4477 27.4477 24 28 24H40C40.5523 24 41 24.4477 41 25V49C41 49.5523 40.5523 50 40 50H34C33.4477 50 33 49.5523 33 49V32H28C27.4477 32 27 31.5523 27 31V25Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><rect width="72" height="72" fill="#000" rx="36"/><path fill="#fff" d="M27 25a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v24a1 1 0 0 1-1 1h-6a1 1 0 0 1-1-1V32h-5a1 1 0 0 1-1-1z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/onepassword-dark.svg b/web/packages/design/src/ResourceIcon/assets/onepassword-dark.svg
index 5c4031cb09312..50a31a2dc133b 100644
--- a/web/packages/design/src/ResourceIcon/assets/onepassword-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/onepassword-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15934_6690)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 36C72 16.118 55.8817 0 35.9999 0C16.118 0 0 16.118 0 36C0 55.883 16.118 72 35.9999 72C55.8817 72 72 55.883 72 36ZM29.4475 16C29.1645 16.5555 29.1645 17.2826 29.1645 18.7369V26.9793C29.1645 27.3426 29.1645 27.5243 29.2104 27.6922C29.251 27.841 29.3178 27.9813 29.4077 28.1067C29.5091 28.2482 29.65 28.3627 29.932 28.5917L32.017 30.2854C32.3568 30.5615 32.5267 30.6995 32.5884 30.8657C32.6425 31.0115 32.6425 31.1718 32.5884 31.3176C32.5267 31.4837 32.3568 31.6218 32.017 31.8978L29.932 33.5916C29.6501 33.8206 29.5091 33.9351 29.4077 34.0766C29.3178 34.2019 29.251 34.3423 29.2104 34.4911C29.1645 34.6591 29.1645 34.8407 29.1645 35.204V53.263C29.1645 54.7171 29.1645 55.4442 29.4475 55.9996C29.6965 56.4886 30.0937 56.8855 30.5823 57.1344C31.1378 57.4177 31.865 57.4177 33.3192 57.4177H38.6806C40.1349 57.4177 40.862 57.4177 41.4174 57.1344C41.9061 56.8855 42.3032 56.4886 42.5524 55.9996C42.8355 55.4442 42.8355 54.7171 42.8355 53.263V45.0203C42.8355 44.657 42.8355 44.4753 42.7895 44.3078C42.7489 44.1589 42.6821 44.0182 42.5922 43.893C42.4906 43.7516 42.3497 43.6371 42.0678 43.4081L39.9829 41.7142C39.6431 41.4383 39.4731 41.3002 39.4114 41.134C39.3573 40.9883 39.3573 40.828 39.4114 40.6822C39.4731 40.516 39.643 40.378 39.9829 40.1019L42.0678 38.4082C42.3497 38.1792 42.4906 38.0646 42.5922 37.9231C42.6821 37.7978 42.7489 37.6574 42.7895 37.5087C42.8355 37.3407 42.8355 37.1591 42.8355 36.7958V18.7369C42.8355 17.2826 42.8355 16.5555 42.5524 16C42.3032 15.5114 41.9061 15.1141 41.4174 14.8652C40.862 14.5822 40.1349 14.5822 38.6806 14.5822H33.3192C31.865 14.5822 31.1378 14.5822 30.5823 14.8652C30.0937 15.1141 29.6965 15.5114 29.4475 16Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_15934_6690">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15934_6690)"><path fill="#fff" fill-rule="evenodd" d="M72 36C72 16.118 55.882 0 36 0S0 16.118 0 36s16.118 36 36 36 36-16.117 36-36M29.448 16c-.284.555-.284 1.283-.284 2.737v8.242c0 .364 0 .545.046.713q.062.225.198.415c.101.141.242.256.524.485l2.085 1.693c.34.276.51.415.571.58a.65.65 0 0 1 0 .453c-.061.166-.231.304-.571.58l-2.085 1.694c-.282.229-.423.343-.524.485q-.136.189-.198.414c-.046.168-.046.35-.046.713v18.059c0 1.454 0 2.181.284 2.737.248.489.646.886 1.134 1.134.556.284 1.283.284 2.737.284h5.362c1.454 0 2.181 0 2.736-.284A2.6 2.6 0 0 0 42.552 56c.284-.556.284-1.283.284-2.737V45.02c0-.363 0-.545-.047-.712a1.3 1.3 0 0 0-.197-.415c-.101-.141-.242-.256-.524-.485l-2.085-1.694c-.34-.276-.51-.414-.572-.58a.65.65 0 0 1 0-.452c.062-.166.232-.304.572-.58l2.085-1.694c.282-.229.423-.343.524-.485.09-.125.157-.266.197-.414.047-.168.047-.35.047-.713v-18.06c0-1.453 0-2.18-.284-2.736a2.6 2.6 0 0 0-1.135-1.135c-.555-.283-1.282-.283-2.736-.283h-5.362c-1.454 0-2.181 0-2.737.283A2.6 2.6 0 0 0 29.448 16" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15934_6690"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/onepassword-light.svg b/web/packages/design/src/ResourceIcon/assets/onepassword-light.svg
index 1691236dc3b3a..9a11defe222d5 100644
--- a/web/packages/design/src/ResourceIcon/assets/onepassword-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/onepassword-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15934_6690)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 36C72 16.118 55.8817 0 35.9999 0C16.118 0 0 16.118 0 36C0 55.883 16.118 72 35.9999 72C55.8817 72 72 55.883 72 36ZM29.4475 16C29.1645 16.5555 29.1645 17.2826 29.1645 18.7369V26.9793C29.1645 27.3426 29.1645 27.5243 29.2104 27.6922C29.251 27.841 29.3178 27.9813 29.4077 28.1067C29.5091 28.2482 29.65 28.3627 29.932 28.5917L32.017 30.2854C32.3568 30.5615 32.5267 30.6995 32.5884 30.8657C32.6425 31.0115 32.6425 31.1718 32.5884 31.3176C32.5267 31.4837 32.3568 31.6218 32.017 31.8978L29.932 33.5916C29.6501 33.8206 29.5091 33.9351 29.4077 34.0766C29.3178 34.2019 29.251 34.3423 29.2104 34.4911C29.1645 34.6591 29.1645 34.8407 29.1645 35.204V53.263C29.1645 54.7171 29.1645 55.4442 29.4475 55.9996C29.6965 56.4886 30.0937 56.8855 30.5823 57.1344C31.1378 57.4177 31.865 57.4177 33.3192 57.4177H38.6806C40.1349 57.4177 40.862 57.4177 41.4174 57.1344C41.9061 56.8855 42.3032 56.4886 42.5524 55.9996C42.8355 55.4442 42.8355 54.7171 42.8355 53.263V45.0203C42.8355 44.657 42.8355 44.4753 42.7895 44.3078C42.7489 44.1589 42.6821 44.0182 42.5922 43.893C42.4906 43.7516 42.3497 43.6371 42.0678 43.4081L39.9829 41.7142C39.6431 41.4383 39.4731 41.3002 39.4114 41.134C39.3573 40.9883 39.3573 40.828 39.4114 40.6822C39.4731 40.516 39.643 40.378 39.9829 40.1019L42.0678 38.4082C42.3497 38.1792 42.4906 38.0646 42.5922 37.9231C42.6821 37.7978 42.7489 37.6574 42.7895 37.5087C42.8355 37.3407 42.8355 37.1591 42.8355 36.7958V18.7369C42.8355 17.2826 42.8355 16.5555 42.5524 16C42.3032 15.5114 41.9061 15.1141 41.4174 14.8652C40.862 14.5822 40.1349 14.5822 38.6806 14.5822H33.3192C31.865 14.5822 31.1378 14.5822 30.5823 14.8652C30.0937 15.1141 29.6965 15.5114 29.4475 16Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_15934_6690">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15934_6690)"><path fill="#000" fill-rule="evenodd" d="M72 36C72 16.118 55.882 0 36 0S0 16.118 0 36s16.118 36 36 36 36-16.117 36-36M29.448 16c-.284.555-.284 1.283-.284 2.737v8.242c0 .364 0 .545.046.713q.062.225.198.415c.101.141.242.256.524.485l2.085 1.693c.34.276.51.415.571.58a.65.65 0 0 1 0 .453c-.061.166-.231.304-.571.58l-2.085 1.694c-.282.229-.423.343-.524.485q-.136.189-.198.414c-.046.168-.046.35-.046.713v18.059c0 1.454 0 2.181.284 2.737.248.489.646.886 1.134 1.134.556.284 1.283.284 2.737.284h5.362c1.454 0 2.181 0 2.736-.284A2.6 2.6 0 0 0 42.552 56c.284-.556.284-1.283.284-2.737V45.02c0-.363 0-.545-.047-.712a1.3 1.3 0 0 0-.197-.415c-.101-.141-.242-.256-.524-.485l-2.085-1.694c-.34-.276-.51-.414-.572-.58a.65.65 0 0 1 0-.452c.062-.166.232-.304.572-.58l2.085-1.694c.282-.229.423-.343.524-.485.09-.125.157-.266.197-.414.047-.168.047-.35.047-.713v-18.06c0-1.453 0-2.18-.284-2.736a2.6 2.6 0 0 0-1.135-1.135c-.555-.283-1.282-.283-2.736-.283h-5.362c-1.454 0-2.181 0-2.737.283A2.6 2.6 0 0 0 29.448 16" clip-rule="evenodd"/></g><defs><clipPath id="clip0_15934_6690"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/opencomp.svg b/web/packages/design/src/ResourceIcon/assets/opencomp.svg
index 8db4fd7643ee2..df65e119e8683 100644
--- a/web/packages/design/src/ResourceIcon/assets/opencomp.svg
+++ b/web/packages/design/src/ResourceIcon/assets/opencomp.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M36.004 12.8521C16.1493 12.8521 0 28.8919 0 48.6121C0 51.9871 0.477377 55.3461 1.42403 58.5846L1.5859 59.1391H10.2349L9.85461 58.1105C9.73324 57.781 9.61997 57.4596 9.5148 57.1221C8.62486 54.3818 8.17179 51.521 8.17179 48.6121C8.17179 33.3678 20.6559 20.9684 36.004 20.9684C51.3524 20.9684 63.8364 33.3678 63.8364 48.6121C63.8364 51.4166 63.4156 54.1809 62.5824 56.8328C62.4448 57.2586 62.2992 57.6847 62.1454 58.1024L61.7652 59.1311H70.4142L70.576 58.5766C71.5226 55.3381 72 51.979 72 48.604C72.0081 28.8919 55.8589 12.8521 36.004 12.8521Z" fill="#B3EBDF"/>
-<path d="M67.591 19.5305C66.8466 18.7349 65.8434 18.2688 64.7511 18.2286C63.6589 18.1804 62.6152 18.5661 61.8142 19.3055L32.5821 46.1375C31.7811 46.8688 31.3118 47.8733 31.2715 48.9581C31.231 50.043 31.6113 51.0796 32.3556 51.8751C33.1243 52.7029 34.2165 53.1769 35.3572 53.1769C36.3849 53.1769 37.3719 52.7912 38.1324 52.1002L67.3645 25.2601C68.1655 24.5288 68.6348 23.5243 68.6751 22.4395C68.7156 21.3546 68.3353 20.318 67.591 19.5224V19.5305Z" fill="#42CCB0"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#b3ebdf" d="M36.004 12.852C16.149 12.852 0 28.892 0 48.612c0 3.375.477 6.734 1.424 9.973l.162.554h8.649l-.38-1.029c-.122-.329-.235-.65-.34-.988a27.5 27.5 0 0 1-1.343-8.51c0-15.244 12.484-27.644 27.832-27.644s27.832 12.4 27.832 27.644c0 2.805-.42 5.569-1.254 8.22q-.206.643-.437 1.27l-.38 1.03h8.65l.161-.555A35.6 35.6 0 0 0 72 48.604c.008-19.712-16.141-35.752-35.996-35.752"/><path fill="#42ccb0" d="M67.591 19.53a4.07 4.07 0 0 0-2.84-1.301 4.04 4.04 0 0 0-2.937 1.076L32.582 46.138a4 4 0 0 0-1.31 2.82 4.02 4.02 0 0 0 1.084 2.917 4.1 4.1 0 0 0 3.001 1.302 4.13 4.13 0 0 0 2.775-1.077l29.233-26.84a4 4 0 0 0 1.31-2.82 4.02 4.02 0 0 0-1.084-2.918z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/openid.svg b/web/packages/design/src/ResourceIcon/assets/openid.svg
index c19d0581c74f8..3ce77a221f4ce 100644
--- a/web/packages/design/src/ResourceIcon/assets/openid.svg
+++ b/web/packages/design/src/ResourceIcon/assets/openid.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6971_33938)">
-<path d="M32.7217 7.48858V62.0031V68.8408L43.6287 63.7073V2.16014L32.7217 7.48858Z" fill="#F8931E"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M30.8067 29.2666C19.3283 31.2533 10.9071 37.7618 10.9071 45.4901C10.9071 53.6428 20.2749 60.4427 32.7212 62.0031V68.8408C14.2218 67.2051 0 57.3751 0 45.4901C0 34.0186 13.2497 24.461 30.8067 22.3389V29.2666ZM45.5428 29.2666V22.3416C52.9981 23.2427 59.6784 25.4811 64.8953 28.6416L70.4945 25.4847L72 41.1172L50.9074 36.5281L56.8201 33.1945C53.6706 31.3702 49.8177 30.0064 45.5428 29.2666Z" fill="#B3B3B3"/>
-</g>
-<defs>
-<clipPath id="clip0_6971_33938">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6971_33938)"><path fill="#f8931e" d="M32.722 7.489V68.84l10.907-5.134V2.16z"/><path fill="#b3b3b3" fill-rule="evenodd" d="M30.807 29.267c-11.479 1.986-19.9 8.495-19.9 16.223 0 8.153 9.368 14.953 21.814 16.513v6.838C14.221 67.205 0 57.375 0 45.49c0-11.472 13.25-21.03 30.807-23.152zm14.736 0v-6.925c7.455.9 14.135 3.14 19.352 6.3l5.6-3.157L72 41.117l-21.093-4.589 5.913-3.334c-3.15-1.824-7.002-3.188-11.277-3.927" clip-rule="evenodd"/></g><defs><clipPath id="clip0_6971_33938"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/opsgenie.svg b/web/packages/design/src/ResourceIcon/assets/opsgenie.svg
index 912e42191c799..0468548629047 100644
--- a/web/packages/design/src/ResourceIcon/assets/opsgenie.svg
+++ b/web/packages/design/src/ResourceIcon/assets/opsgenie.svg
@@ -1,15 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M35.9508 35.8541C45.9212 35.8541 54.0043 27.8279 54.0043 17.9271C54.0043 8.02626 45.9212 0 35.9508 0C25.9802 0 17.8975 8.02626 17.8975 17.9271C17.8975 27.8279 25.9802 35.8541 35.9508 35.8541Z" fill="url(#paint0_linear_6733_29871)"/>
-<path d="M34.4321 71.6076C22.667 64.0541 12.8289 53.8819 5.83074 41.7962C5.32363 40.7889 5.6279 39.5804 6.64213 39.0768H6.74355L20.4357 32.4298C21.3485 31.9262 22.5656 32.3292 23.0727 33.2354C29.9694 44.7168 40.2132 53.9825 52.4852 59.6226C47.9215 64.1548 42.9516 68.1833 37.5762 71.6076C36.5619 72.1112 35.3449 72.1112 34.4321 71.6076Z" fill="url(#paint1_linear_6733_29871)"/>
-<path d="M37.4714 71.6085C49.338 64.1557 59.0747 53.8828 66.174 41.8981C66.6811 40.8908 66.3771 39.6823 65.3628 39.1787H65.2615L51.5692 32.5314C50.6563 32.0278 49.4393 32.4307 48.9322 33.3373C42.0355 44.8188 31.7917 54.0844 19.5195 59.7245C23.9821 64.2563 29.0533 68.2853 34.4287 71.7092C35.3416 72.1121 36.5586 72.1121 37.4714 71.6085Z" fill="#2684FF"/>
-<defs>
-<linearGradient id="paint0_linear_6733_29871" x1="35.974" y1="5.97255" x2="35.974" y2="42.8641" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2684FF"/>
-<stop offset="0.82" stop-color="#0052CC"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6733_29871" x1="24.8289" y1="41.8316" x2="37.1321" y2="67.7622" gradientUnits="userSpaceOnUse">
-<stop stop-color="#2684FF"/>
-<stop offset="0.62" stop-color="#0052CC"/>
-</linearGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="url(#paint0_linear_6733_29871)" d="M35.95 35.854c9.971 0 18.054-8.026 18.054-17.927S45.921 0 35.951 0 17.898 8.026 17.898 17.927 25.98 35.854 35.95 35.854"/><path fill="url(#paint1_linear_6733_29871)" d="M34.432 71.608C22.667 64.054 12.83 53.882 5.831 41.796c-.507-1.007-.203-2.216.811-2.72h.102l13.692-6.646c.913-.504 2.13-.1 2.637.805 6.896 11.482 17.14 20.748 29.412 26.388-4.563 4.532-9.533 8.56-14.909 11.985-1.014.503-2.231.503-3.144 0"/><path fill="#2684ff" d="M37.471 71.609c11.867-7.453 21.604-17.726 28.703-29.71.507-1.008.203-2.217-.811-2.72h-.102L51.57 32.53c-.913-.503-2.13-.1-2.637.806-6.897 11.482-17.14 20.747-29.412 26.387 4.462 4.532 9.533 8.561 14.909 11.985.913.403 2.13.403 3.042-.1"/><defs><linearGradient id="paint0_linear_6733_29871" x1="35.974" x2="35.974" y1="5.973" y2="42.864" gradientUnits="userSpaceOnUse"><stop stop-color="#2684ff"/><stop offset=".82" stop-color="#0052cc"/></linearGradient><linearGradient id="paint1_linear_6733_29871" x1="24.829" x2="37.132" y1="41.832" y2="67.762" gradientUnits="userSpaceOnUse"><stop stop-color="#2684ff"/><stop offset=".62" stop-color="#0052cc"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/oracle.svg b/web/packages/design/src/ResourceIcon/assets/oracle.svg
new file mode 100644
index 0000000000000..e9388f7e7d796
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/oracle.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#c74634" d="M62.982 35.33A13.5 13.5 0 0 0 49.5 22.5h-27c-3.58 0-7.013 1.423-9.545 3.955A13.5 13.5 0 0 0 9 36l.018.67A13.5 13.5 0 0 0 22.5 49.5h27l.67-.018A13.5 13.5 0 0 0 63 36zm8.99 1.786A22.5 22.5 0 0 1 49.5 58.5h-27A22.5 22.5 0 0 1 .029 37.116L0 36a22.5 22.5 0 0 1 22.5-22.5h27A22.5 22.5 0 0 1 72 36z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/orbit.love.svg b/web/packages/design/src/ResourceIcon/assets/orbit.love.svg
index 82f0c0ddb32e3..c62928f867346 100644
--- a/web/packages/design/src/ResourceIcon/assets/orbit.love.svg
+++ b/web/packages/design/src/ResourceIcon/assets/orbit.love.svg
@@ -1,19 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17013_11961)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M57.6144 32.7803C57.0846 28.7966 55.5794 25.0033 53.2311 21.7333C50.8826 18.4633 47.7629 15.8168 44.1457 14.026C40.5285 12.2353 36.5246 11.3551 32.4855 11.4629C28.4464 11.5706 24.4956 12.663 20.9802 14.644C17.4648 16.625 14.4921 19.4341 12.3234 22.8246C10.1547 26.2151 8.85616 30.0833 8.54181 34.0895C8.22753 38.0957 8.90707 42.1174 10.5208 45.8013C12.1345 49.4853 14.6331 52.7189 17.797 55.2183C20.2193 54.1455 22.8679 52.8933 25.681 51.4888C22.8357 50.1331 20.4181 48.0283 18.6906 45.4029C16.963 42.7775 15.9914 39.7316 15.8813 36.5959C15.7712 33.4602 16.5267 30.3544 18.0658 27.6154C19.605 24.8765 21.869 22.6091 24.6122 21.0593C27.3554 19.5094 30.473 18.7364 33.6268 18.8239C36.7805 18.9115 39.8499 19.8564 42.5018 21.556C45.1538 23.2557 47.2871 25.6451 48.6702 28.4652C50.0533 31.2853 50.6334 34.4282 50.3475 37.5529C52.9526 35.9098 55.3886 34.3098 57.6144 32.7803ZM57.8224 35.5621C55.3292 37.3961 52.5664 39.296 49.5956 41.2119C48.2687 45.3509 45.4143 48.8363 41.6071 50.9662C37.7999 53.0961 33.3226 53.7124 29.0768 52.6911C25.8204 54.2479 22.7308 55.5955 19.9017 56.7114C23.6645 59.0913 28.0055 60.4129 32.4632 60.5356C36.9208 60.6583 41.3286 59.5776 45.2181 57.4084C49.1076 55.2391 52.3334 52.0623 54.5528 48.2157C56.7721 44.369 57.902 39.9962 57.8224 35.5621Z" fill="url(#paint0_linear_17013_11961)"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M62.1278 54.8572C62.6879 54.8577 63.2356 54.6929 63.7015 54.3838C64.1674 54.0746 64.5306 53.635 64.7453 53.1205C64.96 52.606 65.0163 52.0398 64.9073 51.4935C64.7983 50.9471 64.5289 50.4452 64.133 50.0511C63.7371 49.6571 63.2326 49.3887 62.6833 49.2798C62.134 49.1711 61.5646 49.2266 61.0471 49.4397C60.5296 49.6527 60.0873 50.0137 59.776 50.4768C59.4649 50.9399 59.2988 51.4844 59.2988 52.0414C59.2988 52.7878 59.5967 53.5036 60.1272 54.0317C60.6577 54.5597 61.3773 54.8566 62.1278 54.8572Z" fill="#00CCF5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M59.075 15.5992C59.409 15.5992 59.7355 15.5007 60.0132 15.3162C60.2909 15.1316 60.5074 14.8693 60.6352 14.5625C60.763 14.2556 60.7965 13.9178 60.7314 13.5921C60.6662 13.2663 60.5054 12.967 60.2692 12.7321C60.033 12.4973 59.7321 12.3373 59.4045 12.2725C59.0769 12.2077 58.7373 12.241 58.4287 12.3681C58.1202 12.4952 57.8564 12.7105 57.6709 12.9867C57.4853 13.2629 57.3862 13.5876 57.3862 13.9197C57.386 14.1404 57.4294 14.3589 57.5142 14.5628C57.5989 14.7667 57.7233 14.952 57.8802 15.108C58.0371 15.264 58.2234 15.3877 58.4284 15.472C58.6334 15.5563 58.8532 15.5995 59.075 15.5992Z" fill="#00CCF5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M2.25094 44.1353C2.69642 44.1353 3.13189 44.0038 3.5022 43.7576C3.87251 43.5113 4.16101 43.1613 4.33117 42.7518C4.50134 42.3424 4.54551 41.8919 4.4581 41.4575C4.3707 41.0231 4.15563 40.6242 3.84015 40.3115C3.52467 39.9986 3.12294 39.786 2.68586 39.7004C2.24877 39.6148 1.79597 39.6601 1.38478 39.8306C0.973606 40.001 0.622532 40.289 0.376024 40.6581C0.129514 41.0271 -0.00134636 41.4605 1.04448e-05 41.9036C0.00182506 42.4961 0.239777 43.0637 0.661712 43.4821C1.08364 43.9004 1.65514 44.1353 2.25094 44.1353Z" fill="#00CCF5"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M40.265 30.9495C42.6964 29.6132 45.0639 28.3451 47.3491 27.1746C47.4337 27.311 47.5251 27.4723 47.6211 27.6541C45.3564 28.8314 42.989 30.1041 40.5575 31.4426L40.265 30.9495ZM71.8465 19.0249C70.761 17.1545 64.1797 19.1408 54.8652 23.4702C54.952 23.6134 55.0388 23.7611 55.1211 23.9111C64.0449 19.6863 70.272 17.6522 71.0627 19.2885C72.306 21.4294 58.037 31.9335 39.207 42.7491C20.3769 53.5646 4.09245 60.5962 2.8493 58.4555C2.14089 57.1827 5.64411 53.7147 8.79084 50.9556C4.25928 54.5919 1.88266 57.3941 2.6642 58.7395C4.43752 61.7963 21.6017 55.785 40.7083 44.8217C59.8149 33.8585 73.6286 22.0816 71.8465 19.0249Z" fill="#00CCF5"/>
-<path d="M38.028 32.7259C37.6254 32.0388 37.4749 31.2341 37.6021 30.4489C37.7294 29.6638 38.1267 28.9469 38.726 28.4203C39.3254 27.8939 40.0898 27.5904 40.889 27.5618C41.6881 27.5332 42.4726 27.7811 43.1085 28.2634C43.7444 28.7456 44.1924 29.4323 44.3761 30.2063C44.5599 30.9803 44.468 31.7937 44.1161 32.5078C43.7643 33.222 43.1742 33.7927 42.4465 34.1226C41.7189 34.4524 40.8987 34.5211 40.1259 34.3168C39.6858 34.2075 39.2727 34.01 38.912 33.7365C38.5513 33.463 38.2505 33.1191 38.028 32.7259Z" fill="#FA00E9"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_17013_11961" x1="6.98627" y1="10.2268" x2="57.5505" y2="60.8207" gradientUnits="userSpaceOnUse">
-<stop offset="0.09375" stop-color="#FA00E9"/>
-<stop offset="1" stop-color="#3860FF"/>
-</linearGradient>
-<clipPath id="clip0_17013_11961">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17013_11961)"><path fill="url(#paint0_linear_17013_11961)" fill-rule="evenodd" d="M57.614 32.78a24.5 24.5 0 0 0-4.383-11.047 24.65 24.65 0 0 0-9.085-7.707 24.8 24.8 0 0 0-23.166.618 24.6 24.6 0 0 0-8.657 8.18 24.42 24.42 0 0 0-1.803 22.977 24.56 24.56 0 0 0 7.277 9.417 191 191 0 0 0 7.884-3.73 17.25 17.25 0 0 1-6.99-6.085 17.1 17.1 0 0 1-.625-17.787 17.2 17.2 0 0 1 6.546-6.557 17.35 17.35 0 0 1 17.89.497 17.2 17.2 0 0 1 6.168 6.91 17.1 17.1 0 0 1 1.677 9.087 222 222 0 0 0 7.267-4.773m.208 2.782a164 164 0 0 1-8.226 5.65 17.2 17.2 0 0 1-7.989 9.754 17.36 17.36 0 0 1-12.53 1.725 144 144 0 0 1-9.175 4.02 24.79 24.79 0 0 0 25.316.697 24.6 24.6 0 0 0 9.335-9.192 24.44 24.44 0 0 0 3.27-12.654" clip-rule="evenodd"/><path fill="#00ccf5" fill-rule="evenodd" d="M62.128 54.857c.56 0 1.108-.164 1.574-.473a2.8 2.8 0 0 0 1.043-1.264 2.8 2.8 0 0 0-.612-3.069 2.84 2.84 0 0 0-3.086-.611 2.83 2.83 0 0 0-1.271 1.037 2.806 2.806 0 0 0 .351 3.555 2.84 2.84 0 0 0 2 .825M59.075 15.6a1.7 1.7 0 0 0 1.56-1.037 1.67 1.67 0 0 0-.366-1.83 1.692 1.692 0 0 0-2.883 1.187 1.67 1.67 0 0 0 .494 1.188 1.7 1.7 0 0 0 1.195.491M2.25 44.135c.446 0 .882-.131 1.252-.377a2.227 2.227 0 0 0 .338-3.446 2.25 2.25 0 0 0-2.455-.481c-.411.17-.762.458-1.009.827a2.23 2.23 0 0 0 .286 2.824c.422.418.993.653 1.589.653M40.265 30.95a277 277 0 0 1 7.084-3.775q.128.205.272.48a339 339 0 0 0-7.064 3.788zm31.582-11.925c-1.086-1.87-7.667.116-16.982 4.445q.132.215.256.441c8.924-4.225 15.151-6.259 15.942-4.623 1.243 2.141-13.026 12.645-31.856 23.461S4.092 60.596 2.849 58.455c-.708-1.272 2.795-4.74 5.942-7.5-4.532 3.637-6.908 6.44-6.127 7.785 1.774 3.056 18.938-2.955 38.044-13.918 19.107-10.964 32.92-22.74 31.139-25.797" clip-rule="evenodd"/><path fill="#fa00e9" d="M38.028 32.726a3.42 3.42 0 0 1 .698-4.306 3.466 3.466 0 0 1 4.383-.157 3.43 3.43 0 0 1 1.267 1.943 3.42 3.42 0 0 1-.26 2.302 3.45 3.45 0 0 1-1.67 1.615 3.47 3.47 0 0 1-2.32.194 3.34 3.34 0 0 1-2.098-1.591"/></g><defs><linearGradient id="paint0_linear_17013_11961" x1="6.986" x2="57.55" y1="10.227" y2="60.821" gradientUnits="userSpaceOnUse"><stop offset=".094" stop-color="#fa00e9"/><stop offset="1" stop-color="#3860ff"/></linearGradient><clipPath id="clip0_17013_11961"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/orcasecurity-dark.svg b/web/packages/design/src/ResourceIcon/assets/orcasecurity-dark.svg
index 7d9e8e8901e86..c2beae7dedc71 100644
--- a/web/packages/design/src/ResourceIcon/assets/orcasecurity-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/orcasecurity-dark.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16963_13931)">
-<path d="M36.001 0.551758C31.7658 0.551758 27.8331 1.15679 23.9004 2.66937C29.6482 7.20711 34.4885 13.2574 37.2111 20.5178C45.379 20.8203 51.4294 27.1732 51.4294 35.9461C51.4294 45.0216 45.379 51.0719 37.5136 51.677C34.791 58.9374 30.2532 64.9877 24.2029 69.5254C27.8331 70.7355 31.7658 71.3405 36.001 71.3405C55.9671 71.3405 72.0004 55.9122 72.0004 35.9461C71.6979 15.9801 55.6646 0.551758 36.001 0.551758Z" fill="white"/>
-<path d="M7.25932 14.4678C6.04925 15.9804 4.83919 17.7955 3.93164 19.6105C9.07441 23.5433 12.0996 29.2911 12.0996 36.2489C12.0996 42.9043 9.07441 48.9546 4.23416 52.5848C5.1417 54.3999 6.35177 56.215 7.56183 57.7276C14.5197 53.1898 19.36 45.3244 19.36 36.2489C19.0574 26.8709 14.2172 19.0055 7.25932 14.4678Z" fill="white"/>
-<path d="M28.1324 49.8613C25.4098 56.2142 21.1746 61.3569 15.4268 65.2896C17.2419 66.4997 19.3595 67.7098 21.4771 68.3148C27.2249 64.0796 32.0651 58.3318 34.7878 51.6764C32.3677 51.6764 30.25 51.0714 28.1324 49.8613Z" fill="white"/>
-<path d="M21.1763 3.57715C19.0587 4.4847 16.9411 5.69476 15.126 6.90482C20.8738 10.535 25.109 15.9803 27.8317 22.0306C29.9493 20.8206 32.0669 20.2155 34.487 20.2155C31.7644 13.5602 26.9241 7.81237 21.1763 3.57715Z" fill="white"/>
-<path d="M13.0096 8.41748C11.4971 9.62754 9.98448 11.1401 8.77441 12.6527C15.1273 16.5854 19.665 23.2408 20.8751 31.1062C21.7826 28.081 23.5977 25.3584 25.7153 23.5433C23.2952 17.1904 18.7574 12.0477 13.0096 8.41748Z" fill="white"/>
-<path d="M21.1758 41.0884C19.6633 48.9538 15.1255 55.6092 9.0752 59.5419C10.2853 61.0544 11.7978 62.567 13.6129 63.7771C19.3607 60.1469 23.8985 55.0041 26.3186 48.6513C23.596 46.8362 22.0834 44.1135 21.1758 41.0884Z" fill="white"/>
-<path d="M2.72264 22.0308C0.907548 26.266 0 31.1062 0 35.9465C0 41.0893 1.21006 45.9295 3.02516 50.1648C7.26038 46.8371 9.68051 41.6943 9.68051 35.9465C9.68051 30.1987 6.95787 25.0559 2.72264 22.0308Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16963_13931">
-<rect width="72.0004" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_16963_13931)"><path d="M36.001.552c-4.235 0-8.168.605-12.1 2.117 5.747 4.538 10.588 10.588 13.31 17.849 8.168.302 14.218 6.655 14.218 15.428 0 9.076-6.05 15.126-13.915 15.731-2.723 7.26-7.26 13.31-13.311 17.848Q29.648 71.34 36 71.341c19.966 0 36-15.429 36-35.395C71.697 15.98 55.664.552 36 .552M7.26 14.468c-1.21 1.512-2.42 3.328-3.328 5.142 5.142 3.933 8.168 9.682 8.168 16.64 0 6.655-3.026 12.706-7.866 16.336.908 1.815 2.118 3.63 3.328 5.143C14.52 53.19 19.36 45.324 19.36 36.248c-.303-9.377-5.143-17.242-12.1-21.78"/><path d="M28.132 49.861q-4.083 9.53-12.705 15.429c1.815 1.21 3.933 2.42 6.05 3.025 5.748-4.235 10.588-9.983 13.31-16.639-2.42 0-4.537-.605-6.655-1.815M21.176 3.577c-2.117.908-4.235 2.118-6.05 3.328 5.748 3.63 9.983 9.075 12.706 15.126 2.117-1.21 4.235-1.815 6.655-1.815-2.723-6.656-7.563-12.404-13.31-16.639m-8.167 4.84a28 28 0 0 0-4.236 4.236c6.353 3.932 10.891 10.588 12.101 18.453.908-3.025 2.723-5.748 4.84-7.563-2.42-6.353-6.958-11.495-12.705-15.126m8.166 32.671c-1.513 7.866-6.05 14.521-12.1 18.454 1.21 1.512 2.722 3.025 4.537 4.235 5.748-3.63 10.285-8.773 12.706-15.126-2.723-1.815-4.236-4.538-5.143-7.563M2.723 22.03C.908 26.267 0 31.107 0 35.948c0 5.142 1.21 9.982 3.025 14.218 4.235-3.328 6.656-8.47 6.656-14.218S6.958 25.056 2.723 22.03"/></g><defs><clipPath id="clip0_16963_13931"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/orcasecurity-light.svg b/web/packages/design/src/ResourceIcon/assets/orcasecurity-light.svg
index f28458cfd91be..74d44cc24aeba 100644
--- a/web/packages/design/src/ResourceIcon/assets/orcasecurity-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/orcasecurity-light.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16963_13930)">
-<path d="M36.001 0.551758C31.7658 0.551758 27.8331 1.15679 23.9004 2.66937C29.6482 7.20711 34.4885 13.2574 37.2111 20.5178C45.379 20.8203 51.4294 27.1732 51.4294 35.9461C51.4294 45.0216 45.379 51.0719 37.5136 51.677C34.791 58.9374 30.2532 64.9877 24.2029 69.5254C27.8331 70.7355 31.7658 71.3405 36.001 71.3405C55.9671 71.3405 72.0004 55.9122 72.0004 35.9461C71.6979 15.9801 55.6646 0.551758 36.001 0.551758Z" fill="#101921"/>
-<path d="M7.25932 14.4678C6.04925 15.9804 4.83919 17.7955 3.93164 19.6105C9.07441 23.5433 12.0996 29.2911 12.0996 36.2489C12.0996 42.9043 9.07441 48.9546 4.23416 52.5848C5.1417 54.3999 6.35177 56.215 7.56183 57.7276C14.5197 53.1898 19.36 45.3244 19.36 36.2489C19.0574 26.8709 14.2172 19.0055 7.25932 14.4678Z" fill="#0080FF"/>
-<path d="M28.1324 49.8613C25.4098 56.2142 21.1746 61.3569 15.4268 65.2896C17.2419 66.4997 19.3595 67.7098 21.4771 68.3148C27.2249 64.0796 32.0651 58.3318 34.7878 51.6764C32.3677 51.6764 30.25 51.0714 28.1324 49.8613Z" fill="#0080FF"/>
-<path d="M21.1763 3.57715C19.0587 4.4847 16.9411 5.69476 15.126 6.90482C20.8738 10.535 25.109 15.9803 27.8317 22.0306C29.9493 20.8206 32.0669 20.2155 34.487 20.2155C31.7644 13.5602 26.9241 7.81237 21.1763 3.57715Z" fill="#0080FF"/>
-<path d="M13.0096 8.41748C11.4971 9.62754 9.98448 11.1401 8.77441 12.6527C15.1273 16.5854 19.665 23.2408 20.8751 31.1062C21.7826 28.081 23.5977 25.3584 25.7153 23.5433C23.2952 17.1904 18.7574 12.0477 13.0096 8.41748Z" fill="#0080FF"/>
-<path d="M21.1758 41.0884C19.6633 48.9538 15.1255 55.6092 9.0752 59.5419C10.2853 61.0544 11.7978 62.567 13.6129 63.7771C19.3607 60.1469 23.8985 55.0041 26.3186 48.6513C23.596 46.8362 22.0834 44.1135 21.1758 41.0884Z" fill="#0080FF"/>
-<path d="M2.72264 22.0308C0.907548 26.266 0 31.1062 0 35.9465C0 41.0893 1.21006 45.9295 3.02516 50.1648C7.26038 46.8371 9.68051 41.6943 9.68051 35.9465C9.68051 30.1987 6.95787 25.0559 2.72264 22.0308Z" fill="#0080FF"/>
-</g>
-<defs>
-<clipPath id="clip0_16963_13930">
-<rect width="72.0004" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16963_13930)"><path fill="#101921" d="M36.001.552c-4.235 0-8.168.605-12.1 2.117 5.747 4.538 10.588 10.588 13.31 17.849 8.168.302 14.218 6.655 14.218 15.428 0 9.076-6.05 15.126-13.915 15.731-2.723 7.26-7.26 13.31-13.311 17.848Q29.648 71.34 36 71.341c19.966 0 36-15.429 36-35.395C71.697 15.98 55.664.552 36 .552"/><path fill="#0080ff" d="M7.26 14.468c-1.21 1.512-2.42 3.328-3.328 5.142 5.142 3.933 8.168 9.682 8.168 16.64 0 6.655-3.026 12.706-7.866 16.336.908 1.815 2.118 3.63 3.328 5.143C14.52 53.19 19.36 45.324 19.36 36.248c-.303-9.377-5.143-17.242-12.1-21.78m20.872 35.393q-4.083 9.53-12.705 15.429c1.815 1.21 3.933 2.42 6.05 3.025 5.748-4.235 10.588-9.983 13.31-16.639-2.42 0-4.537-.605-6.655-1.815M21.176 3.577c-2.117.908-4.235 2.118-6.05 3.328 5.748 3.63 9.983 9.075 12.706 15.126 2.117-1.21 4.235-1.815 6.655-1.815-2.723-6.656-7.563-12.404-13.31-16.639"/><path fill="#0080ff" d="M13.01 8.417a28 28 0 0 0-4.236 4.236c6.353 3.932 10.891 10.588 12.101 18.453.908-3.025 2.723-5.748 4.84-7.563-2.42-6.353-6.958-11.495-12.705-15.126m8.166 32.671c-1.513 7.866-6.05 14.521-12.1 18.454 1.21 1.512 2.722 3.025 4.537 4.235 5.748-3.63 10.285-8.773 12.706-15.126-2.723-1.815-4.236-4.538-5.143-7.563M2.723 22.03C.908 26.267 0 31.107 0 35.948c0 5.142 1.21 9.982 3.025 14.218 4.235-3.328 6.656-8.47 6.656-14.218S6.958 25.056 2.723 22.03"/></g><defs><clipPath id="clip0_16963_13930"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/outreach.io.svg b/web/packages/design/src/ResourceIcon/assets/outreach.io.svg
index 1800bd78d7125..ef6d485623e4f 100644
--- a/web/packages/design/src/ResourceIcon/assets/outreach.io.svg
+++ b/web/packages/design/src/ResourceIcon/assets/outreach.io.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M32.0198 3.00195C43.0465 3.00195 59.7082 6.30268 67.4642 13.8719C69.4291 15.7911 72 19.55 72 25.0551C72 34.8427 63.9193 49.8597 54.9968 58.5696C50.3841 63.0719 43.0465 68.9557 33.1765 68.9557C23.5278 68.9557 16.159 62.5599 14.0258 60.4772C5.8537 52.5011 0 40.3947 0 29.1063C0 21.9835 2.0803 15.7537 7.38807 10.5759C12.3038 5.77905 20.7741 3.00195 32.0198 3.00195ZM46.0691 42.4349C49.7919 38.8 50.7949 34.3235 50.7949 31.8596C50.7949 30.0736 50.3138 27.4531 48.0243 25.2207C44.513 21.7938 40.6242 20.826 36.3938 20.826C31.0357 20.826 27.4353 22.4787 25.0377 24.821C23.1569 26.6561 21.5312 29.4774 21.5312 33.4866C21.5312 37.4933 23.7197 41.3644 26.1055 43.6903C28.3084 45.8409 31.7716 47.4329 35.2587 47.4329C38.7459 47.4329 42.3462 46.07 46.0691 42.4349Z" fill="#5951FF"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#5951ff" fill-rule="evenodd" d="M32.02 3.002c11.026 0 27.688 3.3 35.444 10.87C69.43 15.792 72 19.55 72 25.055c0 9.788-8.08 24.805-17.003 33.515-4.613 4.502-11.95 10.386-21.82 10.386-9.65 0-17.018-6.396-19.151-8.479C5.854 52.501 0 40.395 0 29.107c0-7.123 2.08-13.353 7.388-18.531 4.916-4.797 13.386-7.574 24.632-7.574m14.05 39.433c3.722-3.635 4.725-8.111 4.725-10.575 0-1.786-.481-4.407-2.77-6.64-3.512-3.426-7.4-4.394-11.631-4.394-5.358 0-8.959 1.653-11.356 3.995-1.881 1.835-3.507 4.656-3.507 8.666 0 4.006 2.189 7.877 4.575 10.203 2.202 2.15 5.666 3.743 9.153 3.743s7.087-1.363 10.81-4.998" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/pagerduty.svg b/web/packages/design/src/ResourceIcon/assets/pagerduty.svg
index 99f977df7575b..0c419d3e7657a 100644
--- a/web/packages/design/src/ResourceIcon/assets/pagerduty.svg
+++ b/web/packages/design/src/ResourceIcon/assets/pagerduty.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M22.5266 52.6787H12V71.818H22.5266V52.6787Z" fill="#06AC38"/>
-<path d="M51.6456 3.50886C45.9949 0.501266 42.0759 0 32.8253 0H12V43.5646H22.5266H23.8937H32.7342C40.9823 43.5646 47.1342 43.0633 52.557 39.4633C58.481 35.5443 61.5342 29.0278 61.5342 21.5089C61.5342 13.3519 57.7519 6.83544 51.6456 3.50886ZM35.1494 34.4506H22.5266V9.34177L34.4203 9.25063C45.2658 9.11392 50.6886 12.9418 50.6886 21.6C50.6886 30.8962 43.9899 34.4506 35.1494 34.4506Z" fill="#06AC38"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#06ac38" d="M22.527 52.679H12v19.139h10.527zm29.119-49.17C45.995.5 42.076 0 32.826 0H12v43.565h20.734c8.248 0 14.4-.502 19.823-4.102 5.924-3.919 8.977-10.435 8.977-17.954 0-8.157-3.782-14.674-9.888-18M35.149 34.45H22.527V9.34l11.893-.09c10.846-.136 16.27 3.69 16.27 12.35 0 9.296-6.7 12.85-15.54 12.85"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/panther-dark.svg b/web/packages/design/src/ResourceIcon/assets/panther-dark.svg
index 3267a0498991d..cc93308182631 100644
--- a/web/packages/design/src/ResourceIcon/assets/panther-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/panther-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M71.7166 13.7966L65.8837 24.5913C65.7593 24.8169 65.7126 25.0734 65.7515 25.3302L67.8747 41.2111C67.9756 41.9577 67.6491 42.7043 67.0269 43.1321L54.9412 51.578C54.7545 51.7104 54.6144 51.8814 54.5212 52.0913L48.5873 65.8336C48.2528 66.6037 47.545 67.1479 46.7129 67.2725L36.4782 68.7657C36.1671 68.8123 35.856 68.8123 35.5449 68.7657L25.3102 67.2725C24.478 67.1479 23.7703 66.6037 23.4358 65.8336L17.5019 52.0913C17.4164 51.8814 17.2686 51.7104 17.0819 51.578L4.99623 43.1398C4.37405 42.7043 4.04742 41.9655 4.14853 41.2189L6.27168 25.3379C6.30279 25.0814 6.25613 24.8246 6.13947 24.599L0.291048 13.7966C0.0810655 13.4 -0.0200376 12.9489 0.00329392 12.4978L0.283273 7.76932C0.337711 6.89828 0.843226 6.12835 1.62872 5.7395L4.95735 4.09073C5.89838 3.6241 7.0183 3.67854 7.91268 4.2385L15.3865 8.91257C15.6821 9.09923 16.0476 9.1459 16.382 9.04479L35.0628 3.3519C35.6772 3.16525 36.3304 3.16525 36.9448 3.3519L55.6255 9.04479C55.96 9.1459 56.3255 9.09923 56.6211 8.91257L64.0948 4.2385C64.9893 3.67854 66.1093 3.6241 67.0503 4.09073L70.371 5.7395C71.1487 6.12835 71.662 6.89828 71.7166 7.76932L71.9965 12.4978C72.0197 12.9489 71.9265 13.4 71.7086 13.7966H71.7166Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M71.717 13.797 65.884 24.59a1.16 1.16 0 0 0-.133.74l2.124 15.88a2.01 2.01 0 0 1-.848 1.921L54.94 51.578a1.23 1.23 0 0 0-.42.513l-5.934 13.743a2.44 2.44 0 0 1-1.874 1.438l-10.235 1.494a3.1 3.1 0 0 1-.933 0L25.31 67.272a2.44 2.44 0 0 1-1.874-1.438L17.502 52.09a1.2 1.2 0 0 0-.42-.513L4.996 43.14a2.01 2.01 0 0 1-.847-1.921l2.123-15.881a1.27 1.27 0 0 0-.133-.739L.291 13.797a2.5 2.5 0 0 1-.288-1.3l.28-4.728A2.42 2.42 0 0 1 1.63 5.74l3.328-1.648a3.03 3.03 0 0 1 2.956.147l7.474 4.675c.295.186.66.233.995.132l18.68-5.693a3.23 3.23 0 0 1 1.883 0l18.68 5.693c.335.1.7.054.996-.132l7.474-4.674a3.03 3.03 0 0 1 2.955-.148l3.321 1.648a2.44 2.44 0 0 1 1.346 2.03l.28 4.729c.023.45-.07.902-.288 1.299z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/panther-light.svg b/web/packages/design/src/ResourceIcon/assets/panther-light.svg
index b283e15f4ff9f..85e3a5c131892 100644
--- a/web/packages/design/src/ResourceIcon/assets/panther-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/panther-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M71.7166 13.7966L65.8837 24.5913C65.7593 24.8169 65.7126 25.0734 65.7515 25.3302L67.8747 41.2111C67.9756 41.9577 67.6491 42.7043 67.0269 43.1321L54.9412 51.578C54.7545 51.7104 54.6144 51.8814 54.5212 52.0913L48.5873 65.8336C48.2528 66.6037 47.545 67.1479 46.7129 67.2725L36.4782 68.7657C36.1671 68.8123 35.856 68.8123 35.5449 68.7657L25.3102 67.2725C24.478 67.1479 23.7703 66.6037 23.4358 65.8336L17.5019 52.0913C17.4164 51.8814 17.2686 51.7104 17.0819 51.578L4.99623 43.1398C4.37405 42.7043 4.04742 41.9655 4.14853 41.2189L6.27168 25.3379C6.30279 25.0814 6.25613 24.8246 6.13947 24.599L0.291048 13.7966C0.0810655 13.4 -0.0200376 12.9489 0.00329392 12.4978L0.283273 7.76932C0.337711 6.89828 0.843226 6.12835 1.62872 5.7395L4.95735 4.09073C5.89838 3.6241 7.0183 3.67854 7.91268 4.2385L15.3865 8.91257C15.6821 9.09923 16.0476 9.1459 16.382 9.04479L35.0628 3.3519C35.6772 3.16525 36.3304 3.16525 36.9448 3.3519L55.6255 9.04479C55.96 9.1459 56.3255 9.09923 56.6211 8.91257L64.0948 4.2385C64.9893 3.67854 66.1093 3.6241 67.0503 4.09073L70.371 5.7395C71.1487 6.12835 71.662 6.89828 71.7166 7.76932L71.9965 12.4978C72.0197 12.9489 71.9265 13.4 71.7086 13.7966H71.7166Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M71.717 13.797 65.884 24.59a1.16 1.16 0 0 0-.133.74l2.124 15.88a2.01 2.01 0 0 1-.848 1.921L54.94 51.578a1.23 1.23 0 0 0-.42.513l-5.934 13.743a2.44 2.44 0 0 1-1.874 1.438l-10.235 1.494a3.1 3.1 0 0 1-.933 0L25.31 67.272a2.44 2.44 0 0 1-1.874-1.438L17.502 52.09a1.2 1.2 0 0 0-.42-.513L4.996 43.14a2.01 2.01 0 0 1-.847-1.921l2.123-15.881a1.27 1.27 0 0 0-.133-.739L.291 13.797a2.5 2.5 0 0 1-.288-1.3l.28-4.728A2.42 2.42 0 0 1 1.63 5.74l3.328-1.648a3.03 3.03 0 0 1 2.956.147l7.474 4.675c.295.186.66.233.995.132l18.68-5.693a3.23 3.23 0 0 1 1.883 0l18.68 5.693c.335.1.7.054.996-.132l7.474-4.674a3.03 3.03 0 0 1 2.955-.148l3.321 1.648a2.44 2.44 0 0 1 1.346 2.03l.28 4.729c.023.45-.07.902-.288 1.299z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/parallels.svg b/web/packages/design/src/ResourceIcon/assets/parallels.svg
index 47ef447c0bce7..15353be98f01b 100644
--- a/web/packages/design/src/ResourceIcon/assets/parallels.svg
+++ b/web/packages/design/src/ResourceIcon/assets/parallels.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect x="18" y="0.00195312" width="12" height="72" rx="6" fill="#D82131"/>
-<rect x="42" y="0.00195312" width="12" height="72" rx="6" fill="#D82131"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><rect width="12" height="72" x="18" y=".002" fill="#d82131" rx="6"/><rect width="12" height="72" x="42" y=".002" fill="#d82131" rx="6"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/pingdom.svg b/web/packages/design/src/ResourceIcon/assets/pingdom.svg
index 068691e4b96e3..429ae0e2faa62 100644
--- a/web/packages/design/src/ResourceIcon/assets/pingdom.svg
+++ b/web/packages/design/src/ResourceIcon/assets/pingdom.svg
@@ -1,6 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M34.2708 34.1969C34.4815 34.1404 34.6858 34.0842 34.8961 34.0236C39.5113 32.7222 44.001 30.9197 48.4621 29.0525C52.8298 27.2249 57.1491 25.0303 60.9444 21.9415C64.8391 18.7733 67.9715 14.669 69.7009 9.57895C69.9444 8.87059 70.4421 7.84887 70.4902 7.07178C64.4256 15.3645 40.3682 16.2203 40.3682 16.2203L46.0455 11.0119C23.223 11.0555 7.29685 20.7428 0 25.9234C9.33806 26.9252 17.7911 30.8801 24.4092 36.836C27.6654 35.8276 30.9892 35.0993 34.2708 34.1969Z" fill="#FF6200"/>
-<path d="M72.0004 33.3825C72.0004 33.3825 49.8024 31.6849 26.7441 39.1096C29.8034 42.3056 32.3819 45.9612 34.358 49.9697C46.4815 43.2212 63.2927 34.5993 72.0004 33.3825Z" fill="#FF6200"/>
-<path d="M35.877 53.4345C37.2848 57.0546 38.2289 60.9057 38.6206 64.9172L59.7518 43.1841L35.877 53.4345Z" fill="#FF6200"/>
-<path d="M35.877 53.4345C37.2848 57.0546 38.2289 60.9057 38.6206 64.9172L59.7518 43.1841L35.877 53.4345Z" fill="#FF6200"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff6200" d="M34.27 34.197c.211-.057.416-.113.626-.173 4.615-1.302 9.105-3.104 13.566-4.972 4.368-1.827 8.687-4.022 12.482-7.11 3.895-3.169 7.028-7.273 8.757-12.363.243-.708.741-1.73.79-2.507-6.065 8.293-30.123 9.148-30.123 9.148l5.677-5.208C23.223 11.055 7.297 20.742 0 25.923c9.338 1.002 17.791 4.957 24.41 10.913 3.255-1.008 6.58-1.737 9.86-2.64M72 33.383s-22.198-1.698-45.256 5.727a43.6 43.6 0 0 1 7.614 10.86C46.482 43.22 63.293 34.6 72 33.383M35.877 53.435a43.3 43.3 0 0 1 2.744 11.482l21.13-21.733z"/><path fill="#ff6200" d="M35.877 53.435a43.3 43.3 0 0 1 2.744 11.482l21.13-21.733z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/podigee.svg b/web/packages/design/src/ResourceIcon/assets/podigee.svg
index a9c9a270b31a5..78afc7e9a4d65 100644
--- a/web/packages/design/src/ResourceIcon/assets/podigee.svg
+++ b/web/packages/design/src/ResourceIcon/assets/podigee.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14039)">
-<path d="M36 72.002C55.8823 72.002 72 55.8847 72 36.002C72 16.1196 55.8823 0.00195312 36 0.00195312C16.1177 0.00195312 0 16.1196 0 36.002C0 55.8847 16.1177 72.002 36 72.002Z" fill="#FF5630"/>
-<path d="M18.8742 28.6406H16.6249C15.8391 28.6406 15.4463 29.034 15.4463 29.8187V41.2791C15.4463 42.0648 15.8391 42.4572 16.6249 42.4572H18.8742C19.659 42.4572 20.0523 42.0648 20.0523 41.2791V29.8187C20.0523 29.034 19.659 28.6406 18.8742 28.6406Z" fill="white"/>
-<path d="M28.0606 19.3813H25.8113C25.0256 19.3813 24.6328 19.7747 24.6328 20.5594V34.6497C24.6328 35.435 25.0256 35.8284 25.8113 35.8284H28.0606C28.8456 35.8284 29.2388 35.435 29.2388 34.6497V20.5594C29.2388 19.7747 28.8456 19.3813 28.0606 19.3813Z" fill="white"/>
-<path d="M35.0004 10.9888C34.2146 10.9888 33.8223 11.3821 33.8223 12.1669V45.7442C33.8223 46.53 34.2146 46.9223 35.0004 46.9223H37.2497C38.035 46.9223 38.4282 46.53 38.4282 45.7442V12.1669C38.4282 11.3821 38.035 10.9888 37.2497 10.9888H35.0004Z" fill="white"/>
-<path d="M46.4349 36.0469H44.1854C43.3998 36.0469 43.0068 36.4403 43.0068 37.225V59.1623C43.0068 59.9484 43.3998 60.3408 44.1854 60.3408H46.4349C47.2196 60.3408 47.613 59.9484 47.613 59.1623V37.225C47.613 36.4403 47.2196 36.0469 46.4349 36.0469Z" fill="white"/>
-<path d="M55.6204 36.0469H53.3711C52.5854 36.0469 52.1924 36.4403 52.1924 37.225V48.6853C52.1924 49.4711 52.5854 49.8634 53.3711 49.8634H55.6204C56.4051 49.8634 56.7985 49.4711 56.7985 48.6853V37.225C56.7985 36.4403 56.4051 36.0469 55.6204 36.0469Z" fill="white"/>
-<path d="M64.8089 36.0469H62.5596C61.7738 36.0469 61.3809 36.4403 61.3809 37.225V41.2786C61.3809 42.0643 61.7738 42.4567 62.5596 42.4567H64.8089C65.5936 42.4567 65.987 42.0643 65.987 41.2786V37.225C65.987 36.4403 65.5936 36.0469 64.8089 36.0469Z" fill="white"/>
-<path d="M9.68772 36.0469H7.43836C6.65262 36.0469 6.25977 36.4403 6.25977 37.225V41.2786C6.25977 42.0643 6.65262 42.4567 7.43836 42.4567H9.68772C10.4725 42.4567 10.8658 42.0643 10.8658 41.2786V37.225C10.8658 36.4403 10.4725 36.0469 9.68772 36.0469Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14039">
-<rect width="72" height="72.0001" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14039)"><path fill="#ff5630" d="M36 72.002c19.882 0 36-16.117 36-36s-16.118-36-36-36-36 16.118-36 36 16.118 36 36 36"/><path fill="#fff" d="M18.874 28.64h-2.25q-1.178 0-1.178 1.179v11.46q0 1.178 1.179 1.178h2.25q1.177 0 1.177-1.178V29.82q0-1.178-1.178-1.178m9.186-9.261h-2.249q-1.178.001-1.178 1.178v14.09q0 1.18 1.178 1.18h2.25q1.178 0 1.178-1.18V20.56q0-1.177-1.178-1.178M35 10.989q-1.178 0-1.178 1.178v33.577q0 1.178 1.178 1.178h2.25q1.178 0 1.178-1.178V12.167q0-1.178-1.178-1.178zm11.435 25.058h-2.25q-1.178 0-1.178 1.178v21.937q0 1.179 1.178 1.179h2.25q1.178 0 1.178-1.179V37.225q0-1.178-1.178-1.178m9.185 0h-2.249q-1.179 0-1.179 1.178v11.46q0 1.179 1.18 1.178h2.248q1.178 0 1.178-1.178v-11.46q0-1.178-1.178-1.178m9.189 0h-2.25q-1.178 0-1.178 1.178v4.054q0 1.178 1.179 1.178h2.249q1.178 0 1.178-1.178v-4.054q0-1.178-1.178-1.178m-55.121 0h-2.25q-1.178 0-1.178 1.178v4.054q0 1.178 1.178 1.178h2.25q1.177 0 1.178-1.178v-4.054q0-1.178-1.178-1.178"/></g><defs><clipPath id="clip0_16965_14039"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/polleverywhere.svg b/web/packages/design/src/ResourceIcon/assets/polleverywhere.svg
index 5610bc2c29917..3459497975c74 100644
--- a/web/packages/design/src/ResourceIcon/assets/polleverywhere.svg
+++ b/web/packages/design/src/ResourceIcon/assets/polleverywhere.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14056)">
-<path d="M36 0.00195625C28.8799 0.00195625 21.9197 2.11332 15.9995 6.06905C10.0793 10.0248 5.46511 15.6472 2.74035 22.2253C0.0155983 28.8035 -0.697322 36.0419 0.691746 43.0252C2.08081 50.0085 5.50948 56.4231 10.5442 61.4578C15.5789 66.4925 21.9934 69.9211 28.9768 71.3102C35.9601 72.6993 43.1985 71.9864 49.7766 69.2616C56.3547 66.5369 61.9772 61.9226 65.9329 56.0025C69.8886 50.0823 72 43.1221 72 36.0019C72.002 31.2738 71.0722 26.5916 69.2637 22.223C67.4552 17.8544 64.8035 13.885 61.4602 10.5417C58.1169 7.19841 54.1476 4.54675 49.7789 2.73828C45.4103 0.929807 40.7281 -1.5038e-05 36 0.00195625ZM25.311 54.5614H13.4475V45.6124L25.362 42.4939V54.5614H25.311ZM41.9295 54.5614H30.015V14.3705L41.9295 10.7915V54.5614ZM58.548 54.5614H46.6335V27.7114L58.548 24.1325V54.5614Z" fill="#007ACC"/>
-<path d="M13.4473 54.5615H25.3108L25.3618 42.494L13.4473 45.6125V54.5615Z" fill="white"/>
-<path d="M30.0148 54.5615H41.9293V10.7915L30.0148 14.3705V54.5615Z" fill="white"/>
-<path d="M46.6333 54.5615H58.5478V24.1325L46.6333 27.7115V54.5615Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14056">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14056)"><path fill="#007acc" d="M36 .002a36 36 0 1 0 36 36 35.984 35.984 0 0 0-36-36m-10.689 54.56H13.448v-8.95l11.914-3.118V54.56zm16.618 0H30.015V14.37l11.914-3.58zm16.619 0H46.633v-26.85l11.915-3.58z"/><path fill="#fff" d="M13.447 54.562h11.864l.05-12.068-11.914 3.118zm16.568 0h11.914v-43.77L30.015 14.37zm16.618 0h11.915v-30.43l-11.915 3.58z"/></g><defs><clipPath id="clip0_16965_14056"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/portswigger.svg b/web/packages/design/src/ResourceIcon/assets/portswigger.svg
index dd48612aa715c..8dcbfbdd087b1 100644
--- a/web/packages/design/src/ResourceIcon/assets/portswigger.svg
+++ b/web/packages/design/src/ResourceIcon/assets/portswigger.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14074)">
-<path d="M72 0.00195312H0V72.002H72V0.00195312Z" fill="#FF6633"/>
-<path d="M39.8319 72.002H32.1674V60.389L42.619 47.6149H32.1674V32.0536H13.3545L32.1674 8.82776V0.00195312H39.8319V11.6149L29.3803 24.3891H39.8319V39.9503H58.6448L39.8319 63.1761V72.002Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14074">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14074)"><path fill="#f63" d="M72 .002H0v72h72z"/><path fill="#fff" d="M39.832 72.002h-7.665V60.389L42.62 47.615H32.167V32.054H13.355L32.167 8.828V.002h7.665v11.613L29.38 24.389h10.452V39.95h18.813L39.832 63.176z"/></g><defs><clipPath id="clip0_16965_14074"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/postgres.svg b/web/packages/design/src/ResourceIcon/assets/postgres.svg
index 8fc2ae0fb9469..dcde9ec2effc5 100644
--- a/web/packages/design/src/ResourceIcon/assets/postgres.svg
+++ b/web/packages/design/src/ResourceIcon/assets/postgres.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M56.6992 51.0923C56.6992 51.0923 57.845 51.2124 60.281 51.0923C62.717 50.9722 65.3945 49.8179 67.2624 48.9653C72.3299 46.254 71.9091 40.2899 67.2624 41.0651C63.2557 41.7336 61.9809 41.369 61.9809 41.369C68.9016 31.281 73.0297 13.7789 69.1444 8.06646C59.9004 -3.75301 43.7326 1.17314 43.4648 1.32088L43.3787 1.33627C41.6246 0.966915 40.7296 0.863104 38.4832 0.832324C34.4582 0.770764 31.8222 1.1434 29.5019 2.90093C29.5019 2.90093 -0.225995 -9.5 1.27258 20.403C1.6533 27.9998 8.69057 61.9195 21.5 52.5C21.5 52.5 23.7874 54.1575 25.5 54.5C28 55 30.5 55 33 54C33 54 33.0813 56.0987 33.2165 59.3503C33.3549 62.6807 33.8199 64.6686 34.5 66.5C35.8356 69.6601 39.8884 73.0172 46.1967 71.6937C51.468 70.564 54.7567 67.1966 55.121 62.2134" fill="black"/>
-<path d="M66.526 43.8712C58.3827 45.5509 57.8229 42.7938 57.8229 42.7938C66.4209 30.0357 70.0152 13.8411 66.9134 9.8776C58.4515 -0.934142 43.8034 4.17911 43.559 4.31186L43.4803 4.32595C41.8715 3.99197 40.0709 3.79301 38.0473 3.75998C34.3626 3.6996 31.5676 4.72597 29.4467 6.33434C29.4467 6.33434 3.31605 -4.43045 4.53135 19.8731C4.78988 25.0435 11.942 58.9946 20.4727 48.7398C23.5907 44.99 26.6033 41.8194 26.6033 41.8194C28.0996 42.8134 29.8909 43.3204 31.7688 43.1383C32.0341 42.913 31.9232 44.1508 31.9731 44.4745C29.7755 46.9299 30.4212 47.361 26.0281 48.2653C21.5828 49.1814 24.1942 50.8125 25.8992 51.2387C27.9662 51.7556 32.7482 52.4878 35.9794 47.9647C36 52.5 36 60.5 37 64C37.6785 65.8455 39.079 70.0562 44.8543 68.8187C49.68 67.7846 52.1807 65.1046 52.5286 60.6344C52.703 58.3897 53.5464 56 53.8176 53.7397C54.3343 49.4317 53.8996 48.0419 56.8727 48.6883C59.3369 48.9048 62.0641 48.671 64.3284 47.6186C67.9479 45.9388 70.0948 43.1342 66.526 43.8712Z" fill="#336791"/>
-<path d="M55.2525 22.2222C55.2323 22.0775 55.1394 21.9684 55.0285 21.8917C54.9176 21.8151 54.7744 21.7599 54.616 21.7224C54.298 21.647 53.883 21.6344 53.4436 21.6956C53.0042 21.7569 52.6085 21.8824 52.3231 22.0419C52.1809 22.1213 52.0581 22.2136 51.9724 22.3176C51.8865 22.4217 51.8269 22.552 51.8465 22.6967C51.8643 22.823 51.94 22.9571 52.0356 23.0759C52.1346 23.1989 52.2688 23.3233 52.4281 23.4312C52.7459 23.6464 53.1805 23.8068 53.6561 23.7406C54.1295 23.6749 54.5369 23.3994 54.8168 23.1053C54.9577 22.9573 55.071 22.7998 55.147 22.653C55.2193 22.5135 55.2714 22.3577 55.2525 22.2222Z" fill="white"/>
-<path d="M30.5609 24.6128C29.526 24.4498 28.6443 23.2664 28.7891 22.7734C28.9338 22.2804 29.9827 22.1193 30.7625 22.2429C31.7979 22.4065 32.5906 22.9099 32.5345 23.3669C32.4785 23.8234 31.5941 24.7764 30.5609 24.6128Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M67.4961 23.2061C65.9399 29.2312 63.0044 36.2825 58.8759 42.5924C58.9781 42.6875 59.1548 42.8154 59.4508 42.938C60.3358 43.3043 62.2752 43.6142 66.2667 42.7903C66.7565 42.6891 67.1989 42.6374 67.5836 42.6506C67.9458 42.663 68.3879 42.7367 68.7523 43.014C69.1881 43.3455 69.3458 43.8358 69.3016 44.2943C69.2637 44.6886 69.0843 45.0371 68.9076 45.3037C68.5445 45.8513 67.9451 46.4177 67.2475 46.9376C66.535 47.4686 65.6623 47.9941 64.6977 48.4421C63.0419 49.2105 60.4811 49.657 58.3424 49.6805C57.2707 49.6922 56.216 49.5998 55.3859 49.3418C55.3258 49.3231 55.2635 49.3024 55.1997 49.2795C54.8331 52.6584 54.0434 59.02 53.5885 61.6559C53.192 63.9556 52.5115 65.7901 51.1737 67.1806C49.8379 68.5691 47.9678 69.389 45.4629 69.926C42.3148 70.6005 40.121 69.9138 38.6098 68.6407C37.1597 67.4193 36.4683 65.7583 36.0745 64.7741C35.8229 64.1449 35.648 63.15 35.5151 61.9939C35.3783 60.8034 35.2753 59.334 35.2047 57.6881C35.1101 55.4834 35.0725 52.9417 35.0918 50.2945C33.9914 51.2391 32.4975 52.095 30.7912 52.4542C29.4287 52.7411 27.2567 52.5557 25.586 52.1341C24.7526 51.9237 23.9123 51.6234 23.3235 51.2055C23.0314 50.9983 22.6993 50.6912 22.5297 50.2541C22.3348 49.7517 22.4133 49.2327 22.6914 48.7982C23.1045 48.1526 23.7478 47.8002 24.3367 47.5814C24.9256 47.3627 25.5975 47.2296 26.1961 47.1144L26.325 47.0896C26.9051 46.9782 27.4335 46.8767 27.9166 46.7294C28.4332 46.5718 28.808 46.3865 29.0631 46.1596C29.6636 45.6259 30.0782 45.0672 30.4963 44.504C30.5828 44.3874 30.6696 44.2705 30.7582 44.1536L30.761 44.1498C30.7596 44.131 30.7583 44.1121 30.7571 44.0933C29.2779 44.0571 27.879 43.6503 26.6377 42.9576C26.5828 43.016 26.5208 43.082 26.452 43.1555C26.142 43.4867 25.6955 43.9679 25.152 44.5658C24.0644 45.7623 22.5906 47.4237 21.044 49.2844C19.8795 50.6842 18.5934 51.5038 17.1872 51.5635C15.7874 51.623 14.5515 50.9168 13.5114 49.9059C11.4593 47.9114 9.69435 44.2723 8.24818 40.3385C6.78466 36.3575 5.58841 31.9035 4.74215 28.1266C3.90067 24.371 3.38791 21.2075 3.31865 19.8224C3.00629 13.5774 4.44436 9.3802 6.97558 6.69882C9.49801 4.02675 12.9429 3.03405 16.2792 2.84274C19.6168 2.65136 22.96 3.25311 25.4425 3.8881C26.6895 4.20706 27.7324 4.53786 28.4657 4.78974C28.8051 4.90628 29.0787 5.00613 29.2762 5.08036C31.5159 3.53946 34.3801 2.59845 38.0072 2.65794C39.7914 2.68719 41.4446 2.90805 42.9732 3.27857L43.0066 3.26555C43.0959 3.23134 43.239 3.18134 43.4255 3.12158C43.8034 3.00047 44.3931 2.82856 45.1495 2.65174C46.6603 2.2986 48.8569 1.92099 51.3726 1.89762C56.4007 1.85091 62.8189 3.2263 67.4717 9.17161C68.4726 10.4506 68.819 12.511 68.7832 14.8303C68.7465 17.2083 68.3021 20.0855 67.4961 23.2061ZM55.0122 11.2371C53.0093 8.67659 50.194 6.09387 46.4216 4.44046C47.7547 4.1732 49.4764 3.93328 51.3913 3.91549C56.0574 3.87215 61.7547 5.14072 65.8825 10.4152C66.4325 11.1181 66.7999 12.5684 66.7655 14.7991C66.7319 16.971 66.3219 19.6831 65.5423 22.7014C64.1046 28.2676 61.4385 34.7669 57.7132 40.6691C57.6595 40.6015 57.6053 40.5337 57.5513 40.4663L57.5495 40.4641C57.511 40.4161 57.4724 40.3678 57.4345 40.3202C58.0036 39.4645 58.3404 38.4426 58.5397 37.4019C58.7863 36.1147 58.8391 34.7092 58.8079 33.3651C58.7766 32.0172 58.6597 30.6943 58.5533 29.572L58.5174 29.1961C58.4246 28.2247 58.3529 27.4741 58.3529 26.9761C58.3529 26.0238 58.5073 25.181 58.6793 24.2418L58.6795 24.2407C58.7119 24.064 58.7449 23.8839 58.7776 23.699C58.948 22.7355 59.0983 21.689 59.0205 20.4915C59.1256 20.3298 59.1654 20.1781 59.1766 20.1314C59.2186 19.9567 59.2157 19.7944 59.2104 19.6973C59.1989 19.4832 59.1527 19.2366 59.0924 18.9885C58.9682 18.4772 58.7424 17.7936 58.4133 17.0028C57.7534 15.4169 56.6482 13.3287 55.0122 11.2371ZM57.017 20.8123C53.5475 20.4031 51.886 21.0669 51.1297 21.9323C50.2908 22.8922 50.1774 24.5311 50.7251 26.727C51.2567 28.8581 52.3296 31.181 53.3597 33.1578C53.851 34.1007 54.3248 34.9503 54.717 35.6537L54.7775 35.7622C55.1553 36.4399 55.4915 37.0428 55.641 37.4052C55.7989 37.7879 55.9692 38.1353 56.1463 38.4541C56.3179 38.0387 56.4548 37.56 56.5578 37.0223C56.7665 35.9324 56.82 34.6857 56.7905 33.4118C56.761 32.1417 56.6504 30.8806 56.5443 29.7625L56.5075 29.3771C56.4175 28.4389 56.3349 27.5785 56.3349 26.9761C56.3349 25.8245 56.5275 24.7804 56.7006 23.8413C56.7316 23.6735 56.762 23.5087 56.7905 23.3476C56.941 22.4961 57.053 21.6889 57.017 20.8123ZM36.653 44.2433C35.9046 43.0793 34.5551 42.3438 32.9299 42.5759C32.956 42.4675 32.9851 42.3557 33.0172 42.2402C33.2118 41.5405 33.4921 40.7886 33.8115 39.9319L33.8151 39.9224C33.8637 39.7919 33.9133 39.659 33.9635 39.5235C34.134 39.0648 34.3292 38.6318 34.5499 38.142C34.6792 37.8551 34.8174 37.5486 34.9644 37.2062C35.3457 36.3181 35.7341 35.2978 36.0165 34.0533C36.5838 31.5532 36.6998 28.2555 35.6418 23.3625C35.1918 21.282 34.0458 20.0031 32.512 19.4109C31.0558 18.8485 29.3871 18.9579 27.9089 19.2988C26.4118 19.6442 24.9819 20.2566 23.9198 20.8481C23.8916 20.8637 23.8637 20.8794 23.8359 20.8952C23.856 20.6457 23.8808 20.3789 23.9111 20.0971C24.1033 18.312 24.5176 15.9544 25.3985 13.6201C26.2802 11.2836 27.61 9.02155 29.6026 7.3625C31.5761 5.71941 34.2618 4.61475 37.9741 4.67562C45.4742 4.79859 50.4078 8.6261 53.4227 12.4804C54.9336 14.412 55.9513 16.3388 56.5502 17.7781C56.7047 18.1492 56.7966 18.3921 56.9267 18.7725C53.411 18.6686 50.9903 19.0253 49.6103 20.6044C48.0707 22.3659 48.1923 24.9108 48.7672 27.2154C49.3582 29.5848 50.522 32.079 51.5701 34.0904C52.075 35.0592 52.561 35.9308 52.9521 36.6321L53.0034 36.7241C53.4216 37.4742 53.6822 37.9486 53.7755 38.1747C54.388 39.6596 55.1578 40.6961 55.7738 41.474C55.8571 41.5792 55.9346 41.6761 56.007 41.7666L56.0085 41.7685C56.2131 42.0242 56.3774 42.2295 56.5164 42.4275L56.5282 42.4444L56.5096 42.4498C56.2901 42.5135 56.0179 42.5989 55.7344 42.7266C55.1487 42.9904 54.5165 43.4346 54.0751 44.2437C53.6891 44.9515 53.4937 45.8567 53.5133 47.0083C53.3683 47.2965 53.2671 47.7103 53.2739 48.3042C53.2966 50.2871 52.0844 58.5059 51.5999 61.3127C51.2346 63.4318 50.6563 64.8077 49.7195 65.7815C48.7807 66.7572 47.3603 67.4555 45.0399 67.9529C42.4125 68.5157 40.8784 67.9133 39.9098 67.0974C38.88 66.2299 38.3392 65.0022 37.9482 64.0247C37.5571 63.0473 37.3866 60.604 37.5199 61.7635C37.3905 60.6382 37.2903 59.2208 37.2208 57.6015C37.0939 54.6453 37.1029 49.7518 37.153 47.4143C37.1545 47.3457 37.1551 47.2793 37.1548 47.2151C37.3865 46.1181 37.1615 45.0343 36.653 44.2433ZM21.7314 22.8339C21.7315 22.6805 21.7338 22.4593 21.7425 22.1799C21.7598 21.6216 21.8027 20.8292 21.9047 19.8812C22.1082 17.9907 22.55 15.4528 23.5105 12.9076C24.3489 10.686 25.5974 8.41991 27.4629 6.58109C26.8027 6.36227 25.9419 6.09877 24.9424 5.84312C22.5601 5.23374 19.4422 4.68265 16.3947 4.85739C13.3458 5.03222 10.4815 5.92462 8.44299 8.08406C6.41326 10.2342 5.03865 13.8149 5.33409 19.7216C5.3941 20.9218 5.87236 23.9412 6.71129 27.6854C7.54542 31.4082 8.71896 35.7708 10.1422 39.6422C11.5828 43.5609 13.2216 46.8102 14.9179 48.4589C15.7521 49.2697 16.4766 49.5739 17.1016 49.5474C17.7205 49.5211 18.5241 49.1581 19.4923 47.9941C21.063 46.1046 22.5573 44.4202 23.6587 43.2085C24.2081 42.6041 24.6602 42.1167 24.9761 41.7793C22.5113 39.6057 21.0722 36.1368 21.5951 32.3974C22.0836 28.9049 21.9075 25.8919 21.8077 24.1842C21.7815 23.7351 21.7313 23.283 21.7314 22.8339ZM35.2078 46.0478C35.1688 45.7688 35.0764 45.5226 34.9555 45.3346C34.6111 44.7988 34.0181 44.4589 33.2151 44.5736C33.0697 44.5944 32.8715 44.7059 32.3665 45.3723C32.2976 45.4632 32.2246 45.562 32.1469 45.6671C31.7285 46.2333 31.1747 46.9826 30.4038 47.6679C29.8394 48.1695 29.1517 48.4623 28.5054 48.6595C27.914 48.8399 27.2819 48.961 26.7252 49.0676L26.5777 49.0959C25.9545 49.2159 25.4464 49.3219 25.0393 49.4731C24.8708 49.5357 24.7431 49.5978 24.6462 49.6572C24.9523 49.8304 25.4414 50.0163 26.0799 50.1775C27.5963 50.5602 29.431 50.6784 30.3755 50.4795C32.4093 50.0514 34.0788 48.6947 34.7956 47.6707C34.9647 47.4291 35.0778 47.181 35.1458 46.9378C35.1509 46.7323 35.1563 46.5268 35.162 46.3213C35.1646 46.2276 35.1803 46.1357 35.2078 46.0478ZM57.2033 44.3506C57.1553 44.3641 57.1105 44.3767 57.0718 44.3879C56.8843 44.4423 56.718 44.4968 56.5631 44.5666C56.2718 44.6977 56.0275 44.8786 55.8466 45.2102C55.6592 45.5538 55.4884 46.1548 55.5388 47.2152C55.5883 47.255 55.7107 47.3296 55.9848 47.4148C56.5266 47.5831 57.3424 47.6734 58.3202 47.6626C60.2802 47.6411 62.5336 47.2217 63.8477 46.6119C64.6924 46.2195 65.4451 45.7642 66.0415 45.3196C66.3093 45.1201 66.5352 44.9304 66.7196 44.7574L66.6747 44.7666C62.5227 45.6236 60.1101 45.3949 58.679 44.8025C58.2609 44.6294 57.9279 44.4256 57.6643 44.2115C57.5217 44.2613 57.3469 44.3103 57.2033 44.3506ZM55.5093 47.1845C55.5093 47.1845 55.5142 47.1885 55.5193 47.1977C55.5111 47.1894 55.5093 47.1845 55.5093 47.1845ZM31.924 39.2178C31.9734 39.0856 32.0227 38.9532 32.0718 38.821C32.2637 38.3047 32.5088 37.7595 32.7502 37.2225C32.8736 36.9481 32.9961 36.6756 33.1102 36.41C33.4641 35.5856 33.803 34.6887 34.0485 33.6068C34.5371 31.4539 34.6797 28.4611 33.6694 23.7891C33.3486 22.3057 32.6239 21.6172 31.7851 21.2933C30.8687 20.9395 29.6628 20.9652 28.3624 21.2652C27.0809 21.5608 25.8282 22.0951 24.9015 22.6111C24.4373 22.8696 24.0801 23.1095 23.8532 23.294C23.8276 23.3149 23.8049 23.334 23.7848 23.3514C23.7918 23.4935 23.8024 23.6693 23.8149 23.8758C23.9118 25.476 24.1199 28.9141 23.5937 32.6769C22.8729 37.8306 26.6383 42.0632 30.9744 42.0768C31.0052 41.9504 31.0382 41.8246 31.073 41.6995C31.2927 40.9094 31.6077 40.0655 31.924 39.2178Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M56.7 51.092s1.145.12 3.581 0 5.113-1.274 6.981-2.127c5.068-2.711 4.647-8.675 0-7.9-4.006.669-5.281.304-5.281.304 6.92-10.088 11.049-27.59 7.163-33.303C59.9-3.753 43.733 1.173 43.464 1.321l-.085.015c-1.754-.37-2.65-.473-4.896-.504-4.025-.061-6.66.311-8.981 2.069 0 0-29.728-12.401-28.23 17.502C1.654 28 8.692 61.92 21.5 52.5c0 0 2.287 1.657 4 2 2.5.5 5 .5 7.5-.5 0 0 .081 2.099.217 5.35.138 3.33.603 5.319 1.283 7.15 1.336 3.16 5.388 6.517 11.697 5.194 5.271-1.13 8.56-4.497 8.924-9.48"/><path fill="#336791" d="M66.526 43.871c-8.143 1.68-8.703-1.077-8.703-1.077 8.598-12.758 12.192-28.953 9.09-32.916C58.452-.934 43.803 4.179 43.56 4.312l-.079.014c-1.608-.334-3.41-.533-5.433-.566-3.684-.06-6.48.966-8.6 2.574 0 0-26.13-10.764-24.916 13.54.259 5.17 7.411 39.12 15.942 28.866 3.118-3.75 6.13-6.92 6.13-6.92 1.497.993 3.288 1.5 5.166 1.318.265-.225.154 1.013.204 1.337-2.197 2.455-1.552 2.886-5.945 3.79-4.445.916-1.834 2.547-.129 2.974 2.067.517 6.85 1.249 10.08-3.274C36 52.5 36 60.5 37 64c.678 1.846 2.079 6.056 7.854 4.819 4.826-1.034 7.327-3.714 7.675-8.185.174-2.244 1.017-4.634 1.289-6.894.516-4.308.082-5.698 3.055-5.052 2.464.217 5.191-.017 7.455-1.07 3.62-1.68 5.767-4.484 2.198-3.747"/><path fill="#fff" d="M55.253 22.222a.5.5 0 0 0-.224-.33 1.2 1.2 0 0 0-.413-.17c-.318-.075-.733-.088-1.172-.026-.44.06-.836.186-1.12.346a1.2 1.2 0 0 0-.352.276.5.5 0 0 0-.126.379c.018.126.094.26.19.379.099.123.233.247.392.355.318.215.753.376 1.228.31.474-.066.88-.342 1.16-.636.142-.148.255-.305.331-.452.072-.14.124-.295.105-.43m-24.692 2.39c-1.034-.163-1.916-1.347-1.77-1.84.144-.493 1.193-.654 1.973-.53 1.035.164 1.828.667 1.771 1.124-.056.456-.94 1.41-1.973 1.246"/><path fill="#fff" fill-rule="evenodd" d="M67.496 23.206c-1.556 6.025-4.492 13.077-8.62 19.386.102.096.279.223.575.346.885.366 2.824.676 6.816-.148.49-.1.932-.153 1.317-.14.362.013.804.087 1.168.364.436.331.594.822.55 1.28-.038.395-.218.743-.394 1.01-.364.547-.963 1.114-1.66 1.634a14.7 14.7 0 0 1-2.55 1.504c-1.656.769-4.217 1.215-6.356 1.239-1.071.011-2.126-.081-2.956-.34l-.186-.062c-.367 3.38-1.157 9.741-1.611 12.377-.397 2.3-1.078 4.134-2.415 5.525-1.336 1.388-3.206 2.208-5.711 2.745-3.148.674-5.342-.012-6.853-1.285-1.45-1.222-2.142-2.883-2.535-3.867-.252-.63-.427-1.624-.56-2.78-.137-1.19-.24-2.66-.31-4.306a151 151 0 0 1-.113-7.394c-1.1.945-2.594 1.801-4.3 2.16-1.363.287-3.535.102-5.206-.32-.833-.21-1.674-.51-2.262-.928-.293-.208-.625-.515-.794-.952-.195-.502-.117-1.021.161-1.456.414-.645 1.057-.998 1.646-1.217.589-.218 1.26-.351 1.86-.467l.128-.024c.58-.112 1.108-.213 1.592-.36.516-.158.891-.343 1.146-.57.6-.534 1.015-1.093 1.433-1.656l.262-.35.003-.004-.004-.057a8.9 8.9 0 0 1-4.12-1.135 125 125 0 0 0-1.485 1.608 144 144 0 0 0-4.108 4.718c-1.165 1.4-2.45 2.22-3.857 2.28-1.4.059-2.636-.647-3.676-1.658-2.052-1.995-3.817-5.634-5.263-9.567-1.463-3.981-2.66-8.435-3.506-12.212-.841-3.756-1.354-6.92-1.423-8.305C3.006 13.577 4.444 9.38 6.976 6.7c2.522-2.672 5.967-3.665 9.303-3.856 3.338-.192 6.681.41 9.164 1.045 1.246.32 2.29.65 3.023.902.34.116.613.216.81.29 2.24-1.54 5.104-2.482 8.731-2.422 1.784.03 3.438.25 4.966.62l.034-.012a9 9 0 0 1 .419-.144 23 23 0 0 1 1.724-.47 29 29 0 0 1 6.223-.754C56.4 1.85 62.819 3.226 67.472 9.172c1 1.279 1.347 3.339 1.311 5.658-.037 2.378-.48 5.256-1.287 8.376M55.012 11.237c-2.003-2.56-4.818-5.143-8.59-6.797a27 27 0 0 1 4.97-.525c4.665-.043 10.363 1.226 14.49 6.5.55.703.918 2.153.883 4.384-.033 2.172-.443 4.884-1.223 7.902-1.437 5.567-4.104 12.066-7.829 17.968l-.162-.203-.002-.002-.114-.144c.569-.855.905-1.877 1.105-2.918.246-1.287.3-2.693.268-4.037-.031-1.348-.148-2.67-.255-3.793l-.036-.376c-.092-.971-.164-1.722-.164-2.22 0-.952.154-1.795.326-2.734v-.001l.099-.542c.17-.964.32-2.01.242-3.208.106-.161.145-.313.157-.36.042-.174.039-.337.033-.434a4 4 0 0 0-.118-.709 14 14 0 0 0-.679-1.985c-.66-1.586-1.765-3.674-3.4-5.766m2.005 9.575c-3.47-.409-5.131.255-5.887 1.12-.84.96-.953 2.6-.405 4.795.532 2.131 1.605 4.454 2.635 6.43.491.944.965 1.793 1.357 2.497l.06.108c.378.678.715 1.28.864 1.643.158.383.328.73.505 1.05a7.4 7.4 0 0 0 .412-1.433c.209-1.09.262-2.336.233-3.61-.03-1.27-.14-2.531-.247-3.65l-.036-.385c-.09-.938-.173-1.799-.173-2.4 0-1.152.193-2.197.366-3.136l.09-.493c.15-.852.262-1.66.226-2.536M36.653 44.243c-.748-1.164-2.098-1.9-3.723-1.667q.039-.162.087-.336c.195-.7.475-1.451.794-2.308l.004-.01.149-.398c.17-.46.365-.892.586-1.382.13-.287.267-.593.414-.936.382-.888.77-1.908 1.053-3.153.567-2.5.683-5.797-.375-10.69-.45-2.081-1.596-3.36-3.13-3.952-1.456-.562-3.125-.453-4.603-.112a15.8 15.8 0 0 0-4.073 1.596q.03-.375.075-.798c.192-1.785.607-4.143 1.487-6.477.882-2.336 2.212-4.598 4.205-6.257 1.973-1.644 4.659-2.748 8.371-2.687 7.5.123 12.434 3.95 15.449 7.804 1.51 1.932 2.528 3.859 3.127 5.298.155.371.247.614.377.995-3.516-.104-5.937.252-7.317 1.831-1.54 1.762-1.418 4.307-.843 6.611.591 2.37 1.755 4.864 2.803 6.875.505.97.991 1.84 1.382 2.542l.051.092c.419.75.68 1.225.773 1.45.612 1.486 1.382 2.522 1.998 3.3l.233.293.002.002c.204.255.368.46.507.659l.012.016-.018.006c-.22.063-.492.149-.776.277a3.44 3.44 0 0 0-1.659 1.517c-.386.708-.581 1.613-.562 2.764-.145.288-.246.702-.24 1.296.024 1.983-1.189 10.202-1.673 13.009-.365 2.119-.944 3.495-1.88 4.468-.94.976-2.36 1.674-4.68 2.172-2.627.563-4.162-.04-5.13-.856-1.03-.867-1.57-2.095-1.962-3.072-.39-.978-.561-3.421-.428-2.262-.13-1.125-.23-2.542-.3-4.161-.126-2.957-.117-7.85-.067-10.188q.003-.102.002-.199c.231-1.097.006-2.18-.502-2.972m-14.922-21.41c0-.152.003-.374.011-.653.018-.558.06-1.35.163-2.299.203-1.89.645-4.428 1.605-6.973.839-2.222 2.087-4.488 3.953-6.327a38 38 0 0 0-2.52-.738c-2.383-.61-5.5-1.16-8.548-.986-3.05.175-5.913 1.068-7.952 3.227-2.03 2.15-3.404 5.73-3.109 11.638.06 1.2.538 4.22 1.377 7.963.834 3.723 2.008 8.086 3.431 11.957 1.44 3.919 3.08 7.168 4.776 8.817.834.81 1.559 1.115 2.184 1.088.619-.026 1.422-.389 2.39-1.553a146 146 0 0 1 5.484-6.215c-2.465-2.173-3.904-5.642-3.38-9.382.488-3.492.311-6.505.212-8.213-.026-.449-.077-.901-.077-1.35m13.477 23.215a1.8 1.8 0 0 0-.252-.713c-.345-.536-.938-.876-1.74-.761-.146.02-.345.132-.85.798l-.22.295c-.418.566-.971 1.316-1.742 2-.565.502-1.252.795-1.899.992-.591.18-1.223.302-1.78.409l-.147.028c-.623.12-1.132.226-1.539.377a2.3 2.3 0 0 0-.393.184c.306.173.795.36 1.434.52 1.516.383 3.351.501 4.296.303 2.033-.429 3.703-1.785 4.42-2.81.169-.24.282-.489.35-.732l.016-.617a1 1 0 0 1 .046-.273m21.995-1.697-.131.037a4 4 0 0 0-.509.179 1.43 1.43 0 0 0-.716.643c-.188.344-.359.945-.308 2.005.05.04.172.115.446.2.542.168 1.357.258 2.335.248 1.96-.022 4.214-.441 5.528-1.051a12.6 12.6 0 0 0 2.194-1.292q.4-.302.678-.563l-.045.01c-4.152.857-6.565.628-7.996.035a4 4 0 0 1-1.015-.59c-.142.05-.317.098-.46.139m-1.694 2.834q.001-.001.01.013zm-23.585-7.967.148-.397c.192-.516.437-1.061.678-1.599q.188-.412.36-.812c.354-.824.693-1.721.938-2.803.49-2.153.632-5.146-.379-9.818-.32-1.483-1.045-2.172-1.884-2.496-.916-.354-2.122-.328-3.423-.028-1.281.296-2.534.83-3.46 1.346a7.6 7.6 0 0 0-1.049.683l-.068.057q.01.215.03.525c.097 1.6.305 5.038-.221 8.8-.721 5.155 3.044 9.387 7.38 9.4q.046-.188.099-.377c.22-.79.535-1.633.851-2.481" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/posthog-dark.svg b/web/packages/design/src/ResourceIcon/assets/posthog-dark.svg
index e19aa76e4b8af..3b082223987be 100644
--- a/web/packages/design/src/ResourceIcon/assets/posthog-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/posthog-dark.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M15.7135 38.0886C15.6471 38.2208 15.5452 38.3319 15.4193 38.4096C15.2934 38.4872 15.1483 38.5283 15.0004 38.5283C14.8525 38.5283 14.7074 38.4872 14.5815 38.4096C14.4556 38.3319 14.3537 38.2208 14.2873 38.0886L12.1811 33.9057C12.1249 33.7943 12.0957 33.6713 12.0957 33.5466C12.0957 33.4218 12.1249 33.2988 12.1811 33.1874L14.2881 29.0053C14.3546 28.8733 14.4565 28.7624 14.5823 28.6849C14.7081 28.6074 14.853 28.5664 15.0008 28.5664C15.1486 28.5664 15.2935 28.6074 15.4193 28.6849C15.5452 28.7624 15.647 28.8733 15.7135 29.0053L17.8197 33.1874C17.8759 33.2988 17.9051 33.4218 17.9051 33.5466C17.9051 33.6713 17.8759 33.7943 17.8197 33.9057L15.7135 38.0886ZM15.7135 52.9822C15.6471 53.1144 15.5452 53.2255 15.4193 53.3031C15.2934 53.3808 15.1483 53.4219 15.0004 53.4219C14.8525 53.4219 14.7074 53.3808 14.5815 53.3031C14.4556 53.2255 14.3537 53.1144 14.2873 52.9822L12.1811 48.7993C12.1249 48.6879 12.0957 48.5649 12.0957 48.4401C12.0957 48.3154 12.1249 48.1924 12.1811 48.081L14.2881 43.8989C14.3546 43.7669 14.4565 43.656 14.5823 43.5785C14.7081 43.501 14.853 43.46 15.0008 43.46C15.1486 43.46 15.2935 43.501 15.4193 43.5785C15.5452 43.656 15.647 43.7669 15.7135 43.8989L17.8197 48.081C17.8759 48.1924 17.9051 48.3154 17.9051 48.4401C17.9051 48.5649 17.8759 48.6879 17.8197 48.7993L15.7135 52.9822Z" fill="#1D4AFF"/>
-<path d="M2.50579e-07 44.1871C2.50579e-07 43.4768 0.857172 43.1208 1.36078 43.6204L10.626 52.8203C11.1313 53.3223 10.7761 54.185 10.0634 54.185H0.798111C0.586439 54.185 0.383436 54.1009 0.233762 53.9513C0.0840867 53.8016 2.50579e-07 53.5986 2.50579e-07 53.3869V44.1871ZM2.50579e-07 38.9595C2.20573e-05 39.0646 0.0208341 39.1688 0.0612397 39.2659C0.101645 39.363 0.160848 39.4512 0.235443 39.5253L14.7667 53.9528C14.9161 54.101 15.118 54.1842 15.3285 54.1842H25.0631C25.7758 54.1842 26.131 53.3223 25.6257 52.8203L1.36078 28.7269C0.857172 28.2273 2.50579e-07 28.5832 2.50579e-07 29.2935V38.9595ZM2.50579e-07 24.0651C-8.31997e-05 24.1704 0.0206777 24.2747 0.0610864 24.372C0.101495 24.4692 0.160752 24.5575 0.235443 24.6318L29.7663 53.9528C29.916 54.1012 30.1183 54.1844 30.329 54.1842H40.0636C40.7755 54.1842 41.1315 53.3223 40.6254 52.8203L1.36078 13.8341C0.857172 13.3337 2.50579e-07 13.6905 2.50579e-07 14.4008V24.0651ZM14.9997 24.0651C14.9997 24.1705 15.0206 24.2748 15.0612 24.3721C15.1017 24.4693 15.1611 24.5576 15.2359 24.6318L43.6399 52.8338C44.1427 53.3342 44.9999 52.9775 44.9999 52.2672V42.602C45 42.4967 44.9792 42.3924 44.9388 42.2952C44.8984 42.1979 44.8391 42.1096 44.7645 42.0354L16.3597 13.8341C15.8569 13.3345 14.9997 13.6905 14.9997 14.4008V24.0651ZM31.361 13.8333C30.8566 13.3337 30.0002 13.6897 30.0002 14.4V24.0651C30.0001 24.1704 30.0209 24.2747 30.0613 24.372C30.1017 24.4692 30.1609 24.5575 30.2356 24.6318L43.6391 37.9403C44.1435 38.4407 44.9999 38.0839 44.9999 37.3736V27.7085C45 27.6032 44.9792 27.4989 44.9388 27.4016C44.8984 27.3044 44.8391 27.2161 44.7645 27.1418L31.3602 13.8341L31.361 13.8333Z" fill="#F9BD2B"/>
-<path d="M63.8064 46.0489L48.4827 30.8337C47.9783 30.3333 47.1211 30.69 47.1211 31.4003V53.3867C47.1211 53.5984 47.2052 53.8014 47.3549 53.9511C47.5045 54.1007 47.7075 54.1848 47.9192 54.1848H71.2017C71.4134 54.1848 71.6164 54.1007 71.766 53.9511C71.9157 53.8014 71.9998 53.5984 71.9998 53.3867V50.2166C71.9998 49.7761 71.6423 49.4217 71.2017 49.3914C68.4151 49.2018 65.7899 48.0153 63.8064 46.0489ZM54.3217 49.4185C52.9968 49.4185 51.9217 48.3514 51.9217 47.0353C51.9217 45.7201 52.9968 44.653 54.3217 44.653C55.6465 44.653 56.7216 45.7201 56.7216 47.0353C56.7216 48.3514 55.6465 49.4185 54.3217 49.4185Z" fill="white"/>
-<path d="M2.50579e-07 53.3867C2.50579e-07 53.5984 0.0840867 53.8014 0.233762 53.9511C0.383436 54.1007 0.586439 54.1848 0.798111 54.1848H10.0642C10.7761 54.1848 11.1313 53.3221 10.6261 52.8201L1.35998 43.6202C0.857172 43.1206 2.50579e-07 43.4766 2.50579e-07 44.1869V53.3867ZM14.9997 27.3763L1.35998 13.8331C0.85797 13.3335 2.50579e-07 13.6903 2.50579e-07 14.4006V24.0657C-8.31997e-05 24.171 0.0206777 24.2753 0.0610864 24.3726C0.101495 24.4698 0.160752 24.5581 0.235443 24.6324L15.0005 39.2921L14.9997 27.3763ZM1.36078 28.7267C0.857172 28.2271 2.50579e-07 28.583 2.50579e-07 29.2933V38.9585C-8.31997e-05 39.0638 0.0206777 39.1681 0.0610864 39.2653C0.101495 39.3626 0.160752 39.4509 0.235443 39.5251L15.0005 54.1848V42.269L1.35998 28.7267H1.36078Z" fill="#1D4AFF"/>
-<path d="M30.0005 27.7077C30.0005 27.6023 29.9796 27.498 29.939 27.4007C29.8985 27.3035 29.8391 27.2152 29.7643 27.141L16.3616 13.8333C15.858 13.3337 15.0008 13.6897 15.0008 14.4V24.0651C15.0008 24.1705 15.0217 24.2748 15.0623 24.3721C15.1028 24.4693 15.1622 24.5576 15.237 24.6318L30.0013 39.2915L30.0005 27.7077ZM15 54.1842H25.0642C25.7761 54.1842 26.1321 53.3215 25.6261 52.8195L15 42.2684V54.1842ZM15 27.3757V38.9579C15 39.0632 15.0209 39.1676 15.0615 39.2648C15.102 39.3621 15.1614 39.4503 15.2362 39.5245L30.0005 54.1842V42.6012C30.0005 42.4959 29.9796 42.3916 29.939 42.2943C29.8985 42.197 29.8391 42.1088 29.7643 42.0346L15 27.3757Z" fill="#F54E00"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1d4aff" d="M15.714 38.089a.798.798 0 0 1-1.427 0l-2.106-4.183a.8.8 0 0 1 0-.719l2.107-4.182a.798.798 0 0 1 1.425 0l2.107 4.182a.8.8 0 0 1 0 .719zm0 14.893a.797.797 0 0 1-1.427 0L12.181 48.8a.8.8 0 0 1 0-.718l2.107-4.182a.798.798 0 0 1 1.425 0l2.107 4.182a.8.8 0 0 1 0 .718z"/><path fill="#f9bd2b" d="M0 44.187a.798.798 0 0 1 1.36-.567l9.266 9.2a.798.798 0 0 1-.563 1.365H.798A.8.8 0 0 1 0 53.387zm0-5.227a.8.8 0 0 0 .235.565l14.532 14.428c.15.148.351.231.562.231h9.734a.798.798 0 0 0 .563-1.364L1.36 28.727a.798.798 0 0 0-1.36.567zm0-14.895a.8.8 0 0 0 .235.567l29.531 29.32c.15.15.352.232.563.232h9.735a.798.798 0 0 0 .561-1.364L1.361 13.834A.798.798 0 0 0 0 14.401zm15 0a.8.8 0 0 0 .236.567L43.64 52.834c.503.5 1.36.143 1.36-.567v-9.665a.8.8 0 0 0-.236-.567l-28.404-28.2A.798.798 0 0 0 15 14.4zm16.36-10.232A.798.798 0 0 0 30 14.4v9.665a.8.8 0 0 0 .235.567L43.639 37.94a.798.798 0 0 0 1.36-.566v-9.666a.8.8 0 0 0-.235-.566z"/><path fill="#fff" d="M63.806 46.049 48.483 30.834a.799.799 0 0 0-1.362.566v21.987a.8.8 0 0 0 .798.798h23.283a.8.8 0 0 0 .798-.798v-3.17c0-.44-.358-.795-.798-.826a11.63 11.63 0 0 1-7.396-3.342m-9.484 3.37a2.39 2.39 0 0 1-2.4-2.384 2.39 2.39 0 0 1 2.4-2.382c1.325 0 2.4 1.067 2.4 2.382a2.39 2.39 0 0 1-2.4 2.384"/><path fill="#1d4aff" d="M0 53.387a.8.8 0 0 0 .798.798h9.266c.712 0 1.067-.863.562-1.365l-9.266-9.2a.798.798 0 0 0-1.36.567zm15-26.01L1.36 13.832c-.502-.5-1.36-.143-1.36.568v9.665a.8.8 0 0 0 .235.566l14.766 14.66zm-13.64 1.35a.798.798 0 0 0-1.36.566v9.666a.8.8 0 0 0 .235.566l14.766 14.66V42.269z"/><path fill="#f54e00" d="M30 27.708a.8.8 0 0 0-.236-.567L16.362 13.833A.798.798 0 0 0 15 14.4v9.665a.8.8 0 0 0 .236.567L30 39.292zM15 54.184h10.064a.798.798 0 0 0 .562-1.364L15 42.268zm0-26.808v11.582a.8.8 0 0 0 .236.567L30 54.185V42.6a.8.8 0 0 0-.236-.566z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/posthog-light.svg b/web/packages/design/src/ResourceIcon/assets/posthog-light.svg
index b4df75d956d61..34c2304c6d29a 100644
--- a/web/packages/design/src/ResourceIcon/assets/posthog-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/posthog-light.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M15.7135 38.0886C15.6471 38.2208 15.5452 38.3319 15.4193 38.4096C15.2934 38.4872 15.1483 38.5283 15.0004 38.5283C14.8525 38.5283 14.7074 38.4872 14.5815 38.4096C14.4556 38.3319 14.3537 38.2208 14.2873 38.0886L12.1811 33.9057C12.1249 33.7943 12.0957 33.6713 12.0957 33.5466C12.0957 33.4218 12.1249 33.2988 12.1811 33.1874L14.2881 29.0053C14.3546 28.8733 14.4565 28.7624 14.5823 28.6849C14.7081 28.6074 14.853 28.5664 15.0008 28.5664C15.1486 28.5664 15.2935 28.6074 15.4193 28.6849C15.5452 28.7624 15.647 28.8733 15.7135 29.0053L17.8197 33.1874C17.8759 33.2988 17.9051 33.4218 17.9051 33.5466C17.9051 33.6713 17.8759 33.7943 17.8197 33.9057L15.7135 38.0886ZM15.7135 52.9822C15.6471 53.1144 15.5452 53.2255 15.4193 53.3031C15.2934 53.3808 15.1483 53.4219 15.0004 53.4219C14.8525 53.4219 14.7074 53.3808 14.5815 53.3031C14.4556 53.2255 14.3537 53.1144 14.2873 52.9822L12.1811 48.7993C12.1249 48.6879 12.0957 48.5649 12.0957 48.4401C12.0957 48.3154 12.1249 48.1924 12.1811 48.081L14.2881 43.8989C14.3546 43.7669 14.4565 43.656 14.5823 43.5785C14.7081 43.501 14.853 43.46 15.0008 43.46C15.1486 43.46 15.2935 43.501 15.4193 43.5785C15.5452 43.656 15.647 43.7669 15.7135 43.8989L17.8197 48.081C17.8759 48.1924 17.9051 48.3154 17.9051 48.4401C17.9051 48.5649 17.8759 48.6879 17.8197 48.7993L15.7135 52.9822Z" fill="#1D4AFF"/>
-<path d="M2.50579e-07 44.1871C2.50579e-07 43.4768 0.857172 43.1208 1.36078 43.6204L10.626 52.8203C11.1313 53.3223 10.7761 54.185 10.0634 54.185H0.798111C0.586439 54.185 0.383436 54.1009 0.233762 53.9513C0.0840867 53.8016 2.50579e-07 53.5986 2.50579e-07 53.3869V44.1871ZM2.50579e-07 38.9595C2.20573e-05 39.0646 0.0208341 39.1688 0.0612397 39.2659C0.101645 39.363 0.160848 39.4512 0.235443 39.5253L14.7667 53.9528C14.9161 54.101 15.118 54.1842 15.3285 54.1842H25.0631C25.7758 54.1842 26.131 53.3223 25.6257 52.8203L1.36078 28.7269C0.857172 28.2273 2.50579e-07 28.5832 2.50579e-07 29.2935V38.9595ZM2.50579e-07 24.0651C-8.31997e-05 24.1704 0.0206777 24.2747 0.0610864 24.372C0.101495 24.4692 0.160752 24.5575 0.235443 24.6318L29.7663 53.9528C29.916 54.1012 30.1183 54.1844 30.329 54.1842H40.0636C40.7755 54.1842 41.1315 53.3223 40.6254 52.8203L1.36078 13.8341C0.857172 13.3337 2.50579e-07 13.6905 2.50579e-07 14.4008V24.0651ZM14.9997 24.0651C14.9997 24.1705 15.0206 24.2748 15.0612 24.3721C15.1017 24.4693 15.1611 24.5576 15.2359 24.6318L43.6399 52.8338C44.1427 53.3342 44.9999 52.9775 44.9999 52.2672V42.602C45 42.4967 44.9792 42.3924 44.9388 42.2952C44.8984 42.1979 44.8391 42.1096 44.7645 42.0354L16.3597 13.8341C15.8569 13.3345 14.9997 13.6905 14.9997 14.4008V24.0651ZM31.361 13.8333C30.8566 13.3337 30.0002 13.6897 30.0002 14.4V24.0651C30.0001 24.1704 30.0209 24.2747 30.0613 24.372C30.1017 24.4692 30.1609 24.5575 30.2356 24.6318L43.6391 37.9403C44.1435 38.4407 44.9999 38.0839 44.9999 37.3736V27.7085C45 27.6032 44.9792 27.4989 44.9388 27.4016C44.8984 27.3044 44.8391 27.2161 44.7645 27.1418L31.3602 13.8341L31.361 13.8333Z" fill="#F9BD2B"/>
-<path d="M63.8064 46.0489L48.4827 30.8337C47.9783 30.3333 47.1211 30.69 47.1211 31.4003V53.3867C47.1211 53.5984 47.2052 53.8014 47.3549 53.9511C47.5045 54.1007 47.7075 54.1848 47.9192 54.1848H71.2017C71.4134 54.1848 71.6164 54.1007 71.766 53.9511C71.9157 53.8014 71.9998 53.5984 71.9998 53.3867V50.2166C71.9998 49.7761 71.6423 49.4217 71.2017 49.3914C68.4151 49.2018 65.7899 48.0153 63.8064 46.0489ZM54.3217 49.4185C52.9968 49.4185 51.9217 48.3514 51.9217 47.0353C51.9217 45.7201 52.9968 44.653 54.3217 44.653C55.6465 44.653 56.7216 45.7201 56.7216 47.0353C56.7216 48.3514 55.6465 49.4185 54.3217 49.4185Z" fill="black"/>
-<path d="M2.50579e-07 53.3867C2.50579e-07 53.5984 0.0840867 53.8014 0.233762 53.9511C0.383436 54.1007 0.586439 54.1848 0.798111 54.1848H10.0642C10.7761 54.1848 11.1313 53.3221 10.6261 52.8201L1.35998 43.6202C0.857172 43.1206 2.50579e-07 43.4766 2.50579e-07 44.1869V53.3867ZM14.9997 27.3763L1.35998 13.8331C0.85797 13.3335 2.50579e-07 13.6903 2.50579e-07 14.4006V24.0657C-8.31997e-05 24.171 0.0206777 24.2753 0.0610864 24.3726C0.101495 24.4698 0.160752 24.5581 0.235443 24.6324L15.0005 39.2921L14.9997 27.3763ZM1.36078 28.7267C0.857172 28.2271 2.50579e-07 28.583 2.50579e-07 29.2933V38.9585C-8.31997e-05 39.0638 0.0206777 39.1681 0.0610864 39.2653C0.101495 39.3626 0.160752 39.4509 0.235443 39.5251L15.0005 54.1848V42.269L1.35998 28.7267H1.36078Z" fill="#1D4AFF"/>
-<path d="M30.0005 27.7077C30.0005 27.6023 29.9796 27.498 29.939 27.4007C29.8985 27.3035 29.8391 27.2152 29.7643 27.141L16.3616 13.8333C15.858 13.3337 15.0008 13.6897 15.0008 14.4V24.0651C15.0008 24.1705 15.0217 24.2748 15.0623 24.3721C15.1028 24.4693 15.1622 24.5576 15.237 24.6318L30.0013 39.2915L30.0005 27.7077ZM15 54.1842H25.0642C25.7761 54.1842 26.1321 53.3215 25.6261 52.8195L15 42.2684V54.1842ZM15 27.3757V38.9579C15 39.0632 15.0209 39.1676 15.0615 39.2648C15.102 39.3621 15.1614 39.4503 15.2362 39.5245L30.0005 54.1842V42.6012C30.0005 42.4959 29.9796 42.3916 29.939 42.2943C29.8985 42.197 29.8391 42.1088 29.7643 42.0346L15 27.3757Z" fill="#F54E00"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1d4aff" d="M15.714 38.089a.798.798 0 0 1-1.427 0l-2.106-4.183a.8.8 0 0 1 0-.719l2.107-4.182a.798.798 0 0 1 1.425 0l2.107 4.182a.8.8 0 0 1 0 .719zm0 14.893a.797.797 0 0 1-1.427 0L12.181 48.8a.8.8 0 0 1 0-.718l2.107-4.182a.798.798 0 0 1 1.425 0l2.107 4.182a.8.8 0 0 1 0 .718z"/><path fill="#f9bd2b" d="M0 44.187a.798.798 0 0 1 1.36-.567l9.266 9.2a.798.798 0 0 1-.563 1.365H.798A.8.8 0 0 1 0 53.387zm0-5.227a.8.8 0 0 0 .235.565l14.532 14.428c.15.148.351.231.562.231h9.734a.798.798 0 0 0 .563-1.364L1.36 28.727a.798.798 0 0 0-1.36.567zm0-14.895a.8.8 0 0 0 .235.567l29.531 29.32c.15.15.352.232.563.232h9.735a.798.798 0 0 0 .561-1.364L1.361 13.834A.798.798 0 0 0 0 14.401zm15 0a.8.8 0 0 0 .236.567L43.64 52.834c.503.5 1.36.143 1.36-.567v-9.665a.8.8 0 0 0-.236-.567l-28.404-28.2A.798.798 0 0 0 15 14.4zm16.36-10.232A.798.798 0 0 0 30 14.4v9.665a.8.8 0 0 0 .235.567L43.639 37.94a.798.798 0 0 0 1.36-.566v-9.666a.8.8 0 0 0-.235-.566z"/><path fill="#000" d="M63.806 46.049 48.483 30.834a.799.799 0 0 0-1.362.566v21.987a.8.8 0 0 0 .798.798h23.283a.8.8 0 0 0 .798-.798v-3.17c0-.44-.358-.795-.798-.826a11.63 11.63 0 0 1-7.396-3.342m-9.484 3.37a2.39 2.39 0 0 1-2.4-2.384 2.39 2.39 0 0 1 2.4-2.382c1.325 0 2.4 1.067 2.4 2.382a2.39 2.39 0 0 1-2.4 2.384"/><path fill="#1d4aff" d="M0 53.387a.8.8 0 0 0 .798.798h9.266c.712 0 1.067-.863.562-1.365l-9.266-9.2a.798.798 0 0 0-1.36.567zm15-26.01L1.36 13.832c-.502-.5-1.36-.143-1.36.568v9.665a.8.8 0 0 0 .235.566l14.766 14.66zm-13.64 1.35a.798.798 0 0 0-1.36.566v9.666a.8.8 0 0 0 .235.566l14.766 14.66V42.269z"/><path fill="#f54e00" d="M30 27.708a.8.8 0 0 0-.236-.567L16.362 13.833A.798.798 0 0 0 15 14.4v9.665a.8.8 0 0 0 .236.567L30 39.292zM15 54.184h10.064a.798.798 0 0 0 .562-1.364L15 42.268zm0-26.808v11.582a.8.8 0 0 0 .236.567L30 54.185V42.6a.8.8 0 0 0-.236-.566z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/productboard.svg b/web/packages/design/src/ResourceIcon/assets/productboard.svg
index f9b2ba7de2a06..0b7f1f35fdce0 100644
--- a/web/packages/design/src/ResourceIcon/assets/productboard.svg
+++ b/web/packages/design/src/ResourceIcon/assets/productboard.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M23.9987 36.002L47.9974 60.002H0L23.9987 36.002Z" fill="#FF2638"/>
-<path d="M0 12.002L23.9987 36.002L47.9974 12.002H0Z" fill="#FFC600"/>
-<path d="M24.001 36.002L47.9997 60.002L71.9984 36.002L47.9997 12.002L24.001 36.002Z" fill="#0079F2"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff2638" d="m23.999 36.002 23.998 24H0z"/><path fill="#ffc600" d="m0 12.002 23.999 24 23.998-24z"/><path fill="#0079f2" d="m24.001 36.002 23.999 24 23.998-24-23.998-24z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/prometheus.svg b/web/packages/design/src/ResourceIcon/assets/prometheus.svg
index 94f5f3ec86201..72fda42ebfc60 100644
--- a/web/packages/design/src/ResourceIcon/assets/prometheus.svg
+++ b/web/packages/design/src/ResourceIcon/assets/prometheus.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17033_15323)">
-<path d="M36.0003 0C16.1187 0 0 16.1171 0 35.9997C0 55.8816 16.1187 72 36.0003 72C55.8819 72 72 55.8816 72 35.9997C72 16.1171 55.8813 0 36.0003 0ZM36.0003 67.3775C30.3436 67.3775 25.7574 63.5987 25.7574 58.9387H46.2432C46.2432 63.5981 41.657 67.3775 36.0003 67.3775ZM52.9182 56.144H19.0805V50.0082H52.9189L52.9182 56.144ZM52.7969 46.8501H19.177C19.0652 46.7211 18.9509 46.5941 18.8429 46.4632C15.3792 42.2575 14.5635 40.0618 13.7713 37.8243C13.758 37.7506 17.9713 38.6851 20.9591 39.3573C20.9591 39.3573 22.4965 39.7131 24.7441 40.1228C22.586 37.593 21.3047 34.3771 21.3047 31.09C21.3047 23.8736 26.8393 17.5675 24.8426 12.4704C26.786 12.6286 28.8647 16.572 29.0051 22.7376C31.0711 19.8826 31.9357 14.6686 31.9357 11.4717C31.9357 8.16179 34.1167 4.31691 36.2983 4.1854C34.3536 7.39053 36.8021 10.1382 38.9786 16.9544C39.7949 19.5147 39.6908 23.8234 40.321 26.5558C40.53 20.8806 41.5058 12.6 45.106 9.74117C43.5178 13.3415 45.3411 17.8464 46.5882 20.0122C48.6001 23.5064 49.8199 26.1537 49.8199 31.1605C49.8199 34.5175 48.5804 37.6782 46.4897 40.1489C48.867 39.7029 50.5086 39.3007 50.5086 39.3007L58.2287 37.7944C58.2293 37.7938 57.1074 42.4074 52.7969 46.8501Z" fill="#E6522C"/>
-</g>
-<defs>
-<clipPath id="clip0_17033_15323">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17033_15323)"><path fill="#e6522c" d="M36 0C16.12 0 0 16.117 0 36s16.119 36 36 36c19.882 0 36-16.118 36-36S55.881 0 36 0m0 67.378c-5.656 0-10.243-3.78-10.243-8.44h20.486c0 4.66-4.586 8.44-10.243 8.44m16.918-11.234H19.081v-6.136h33.838zm-.121-9.294h-33.62q-.17-.192-.334-.387c-3.464-4.206-4.28-6.401-5.072-8.639-.013-.073 4.2.861 7.188 1.533 0 0 1.538.356 3.785.766-2.158-2.53-3.44-5.746-3.44-9.033 0-7.216 5.535-13.522 3.539-18.62 1.943.159 4.022 4.102 4.162 10.268 2.066-2.855 2.93-8.07 2.93-11.266 0-3.31 2.182-7.155 4.363-7.287-1.944 3.206.504 5.953 2.68 12.77.817 2.56.713 6.868 1.343 9.6.209-5.674 1.185-13.955 4.785-16.814-1.588 3.6.235 8.105 1.482 10.271 2.012 3.494 3.232 6.142 3.232 11.148 0 3.357-1.24 6.518-3.33 8.989a83 83 0 0 0 4.019-.848l7.72-1.507s-1.122 4.613-5.432 9.056"/></g><defs><clipPath id="clip0_17033_15323"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/qualified.svg b/web/packages/design/src/ResourceIcon/assets/qualified.svg
index 8d82781bb64e7..7adbbca78e02b 100644
--- a/web/packages/design/src/ResourceIcon/assets/qualified.svg
+++ b/web/packages/design/src/ResourceIcon/assets/qualified.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14095)">
-<path d="M63.0017 27.002L36.0017 0.00195312L9.0017 27.002C6.61571 29.3894 5.27539 32.6266 5.27539 36.002C5.27539 39.3773 6.61571 42.6145 9.0017 45.002L16.5017 52.502L28.5017 64.502L33.0017 69.002L36.0017 72.002L39.0017 69.002L43.5017 64.502L55.5017 52.502L63.0017 45.002C65.3877 42.6145 66.728 39.3773 66.728 36.002C66.728 32.6266 65.3877 29.3894 63.0017 27.002ZM49.6028 53.9009C49.5869 51.123 48.4771 48.4633 46.5138 46.4979L36.406 36.3901C36.3571 36.34 36.2986 36.3001 36.234 36.2729C36.1694 36.2458 36.1001 36.2317 36.03 36.2317C35.9599 36.2317 35.8906 36.2458 35.826 36.2729C35.7614 36.3001 35.703 36.34 35.654 36.3901L25.4896 46.4979C23.5229 48.4603 22.4087 51.1186 22.3885 53.8968L18.7497 50.258C18.0578 49.5687 17.5088 48.7496 17.1342 47.8476C16.7595 46.9457 16.5667 45.9786 16.5667 45.002C16.5667 44.0253 16.7595 43.0582 17.1342 42.1563C17.5088 41.2543 18.0578 40.4352 18.7497 39.7459L36.0017 22.502L53.2497 39.754C53.9416 40.4433 54.4906 41.2624 54.8652 42.1644C55.2398 43.0663 55.4327 44.0334 55.4327 45.01C55.4327 45.9867 55.2398 46.9538 54.8652 47.8557C54.4906 48.7577 53.9416 49.5768 53.2497 50.2661L49.6028 53.9009ZM60.7497 42.7499L58.6028 44.9009C58.5826 42.1227 57.4684 39.4643 55.5017 37.502L36.3777 18.378C36.3288 18.3278 36.2703 18.288 36.2057 18.2608C36.1411 18.2336 36.0718 18.2196 36.0017 18.2196C35.9316 18.2196 35.8623 18.2336 35.7977 18.2608C35.7331 18.288 35.6746 18.3278 35.6257 18.378L16.5017 37.502C14.535 39.4643 13.4208 42.1227 13.4006 44.9009L11.2537 42.7499C10.3668 41.8638 9.66322 40.8115 9.18318 39.6533C8.70314 38.4951 8.45606 37.2537 8.45606 35.9999C8.45606 34.7462 8.70314 33.5047 9.18318 32.3465C9.66322 31.1883 10.3668 30.1361 11.2537 29.2499L36.0017 4.50195L60.7497 29.2499C61.6366 30.1361 62.3402 31.1883 62.8202 32.3465C63.3003 33.5047 63.5473 34.7462 63.5473 35.9999C63.5473 37.2537 63.3003 38.4951 62.8202 39.6533C62.3402 40.8115 61.6366 41.8638 60.7497 42.7499Z" fill="#67B8C7"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14095">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14095)"><path fill="#67b8c7" d="m63.002 27.002-27-27-27 27a12.73 12.73 0 0 0 0 18l7.5 7.5 12 12 4.5 4.5 3 3 3-3 4.5-4.5 12-12 7.5-7.5a12.73 12.73 0 0 0 0-18m-13.4 26.899a10.56 10.56 0 0 0-3.088-7.403L36.406 36.39a.525.525 0 0 0-.752 0L25.49 46.498a10.56 10.56 0 0 0-3.101 7.399l-3.64-3.639a7.42 7.42 0 0 1 0-10.512l17.253-17.244L53.25 39.754a7.42 7.42 0 0 1 0 10.512zM60.75 42.75l-2.147 2.15a10.56 10.56 0 0 0-3.101-7.398L36.378 18.378a.524.524 0 0 0-.752 0L16.502 37.502a10.56 10.56 0 0 0-3.101 7.399l-2.147-2.151a9.54 9.54 0 0 1 0-13.5L36.002 4.502 60.75 29.25a9.54 9.54 0 0 1 0 13.5"/></g><defs><clipPath id="clip0_16965_14095"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/quickbooks.svg b/web/packages/design/src/ResourceIcon/assets/quickbooks.svg
index a01999810e9e8..f56ebcc309ced 100644
--- a/web/packages/design/src/ResourceIcon/assets/quickbooks.svg
+++ b/web/packages/design/src/ResourceIcon/assets/quickbooks.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14127)">
-<path d="M36.0001 72.002C55.8821 72.002 72 55.8842 72 36.002C72 16.1197 55.8821 0.00195312 36.0001 0.00195312C16.1177 0.00195312 0 16.1197 0 36.002C0 55.8842 16.1177 72.002 36.0001 72.002Z" fill="#2CA01C"/>
-<path d="M24 21.9314C16.264 21.9314 10 28.1835 10 35.887C10 43.5984 16.264 49.8426 24 49.8426H26V44.6591H24C19.144 44.6591 15.2 40.7276 15.2 35.887C15.2 31.0464 19.144 27.1149 24 27.1149H28.808V54.2286C28.808 57.0915 31.1359 59.4121 34.008 59.4121V21.9314H24ZM48.0071 49.8431C55.7433 49.8431 62.0071 43.5907 62.0071 35.8875C62.0071 28.1761 55.7433 21.9318 48.0071 21.9318H46.0073V27.1152H48.0071C52.8632 27.1152 56.8071 31.0469 56.8071 35.8875C56.8071 40.7281 52.8632 44.6593 48.0071 44.6593H43.1992V17.5459C43.1992 14.6829 40.8714 12.3623 37.9992 12.3623V49.8431H48.0071Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14127">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14127)"><path fill="#2ca01c" d="M36 72.002c19.882 0 36-16.118 36-36s-16.118-36-36-36-36 16.118-36 36 16.118 36 36 36"/><path fill="#fff" d="M24 21.931c-7.736 0-14 6.252-14 13.956 0 7.711 6.264 13.956 14 13.956h2v-5.184h-2c-4.856 0-8.8-3.931-8.8-8.772 0-4.84 3.944-8.772 8.8-8.772h4.808v27.114c0 2.863 2.328 5.183 5.2 5.183v-37.48zm24.007 27.912c7.736 0 14-6.252 14-13.955 0-7.712-6.264-13.956-14-13.956h-2v5.183h2c4.856 0 8.8 3.932 8.8 8.773s-3.944 8.771-8.8 8.771H43.2V17.546c0-2.863-2.328-5.184-5.2-5.184v37.481z"/></g><defs><clipPath id="clip0_16965_14127"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/rabbitmq.svg b/web/packages/design/src/ResourceIcon/assets/rabbitmq.svg
index 6ef232f9d737f..9ef9189c71b87 100644
--- a/web/packages/design/src/ResourceIcon/assets/rabbitmq.svg
+++ b/web/packages/design/src/ResourceIcon/assets/rabbitmq.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6841_31698)">
-<path d="M69.1126 28.8036H46.0751C45.6954 28.806 45.319 28.733 44.9677 28.5888C44.6164 28.4447 44.2972 28.2322 44.0287 27.9637C43.7602 27.6953 43.5477 27.3762 43.4035 27.025C43.2593 26.6738 43.1863 26.2975 43.1886 25.9179V2.88582C43.1887 2.50771 43.1139 2.13332 42.9686 1.78421C42.8233 1.4351 42.6104 1.11816 42.3421 0.851629C42.0739 0.585098 41.7555 0.37424 41.4054 0.231188C41.0553 0.0881358 40.6804 0.015715 40.3022 0.0180931H31.6789C31.3007 0.015715 30.9258 0.0881358 30.5757 0.231188C30.2256 0.37424 29.9072 0.585098 29.639 0.851629C29.3707 1.11816 29.1578 1.4351 29.0125 1.78421C28.8672 2.13332 28.7924 2.50771 28.7925 2.88582V25.9179C28.7948 26.2975 28.7218 26.6738 28.5776 27.025C28.4334 27.3762 28.2209 27.6953 27.9524 27.9637C27.6839 28.2322 27.3647 28.4447 27.0134 28.5888C26.6621 28.733 26.2857 28.806 25.906 28.8036H17.2827C16.903 28.806 16.5266 28.733 16.1753 28.5888C15.824 28.4447 15.5048 28.2322 15.2363 27.9637C14.9678 27.6953 14.7553 27.3762 14.6111 27.025C14.4669 26.6738 14.3939 26.2975 14.3963 25.9179V2.88582C14.3987 2.50619 14.3256 2.12986 14.1814 1.77866C14.0372 1.42746 13.8247 1.10839 13.5562 0.839939C13.2877 0.571492 12.9685 0.359019 12.6172 0.214844C12.2659 0.0706691 11.8895 -0.00233815 11.5098 5.70822e-05H2.86847C2.49026 4.96038e-05 2.11579 0.0748191 1.76659 0.220063C1.4174 0.365306 1.10039 0.578156 0.833792 0.846363C0.567197 1.11457 0.356289 1.43284 0.213203 1.78285C0.0701165 2.13287 -0.00232157 2.50771 5.70958e-05 2.88582V69.1142C-0.00233871 69.4938 0.070686 69.8701 0.214895 70.2213C0.359105 70.5725 0.571629 70.8916 0.840139 71.1601C1.10865 71.4285 1.4278 71.641 1.77909 71.7852C2.13037 71.9293 2.50679 72.0023 2.88651 71.9999H69.1126C69.4923 72.0023 69.8688 71.9293 70.2201 71.7852C70.5713 71.641 70.8905 71.4285 71.159 71.1601C71.4275 70.8916 71.64 70.5725 71.7842 70.2213C71.9285 69.8701 72.0015 69.4938 71.9991 69.1142V31.7435C72.0088 31.3593 71.9411 30.9772 71.8002 30.6197C71.6592 30.2622 71.4479 29.9366 71.1786 29.6624C70.9094 29.3882 70.5877 29.1708 70.2328 29.0233C69.8779 28.8758 69.497 28.8011 69.1126 28.8036ZM57.5307 53.2605C57.5331 53.8281 57.4233 54.3906 57.2077 54.9156C56.9921 55.4407 56.6749 55.918 56.2743 56.3202C55.8737 56.7224 55.3975 57.0415 54.8733 57.2593C54.349 57.4771 53.7868 57.5891 53.2191 57.5891H47.4462C46.8784 57.5891 46.3163 57.4771 45.792 57.2593C45.2677 57.0415 44.7916 56.7224 44.391 56.3202C43.9904 55.918 43.6732 55.4407 43.4575 54.9156C43.2419 54.3906 43.1322 53.8281 43.1345 53.2605V47.507C43.1322 46.9394 43.2419 46.3769 43.4575 45.8519C43.6732 45.3268 43.9904 44.8495 44.391 44.4473C44.7916 44.0451 45.2677 43.7259 45.792 43.5082C46.3163 43.2904 46.8784 43.1783 47.4462 43.1783H53.2191C53.7868 43.1783 54.349 43.2904 54.8733 43.5082C55.3975 43.7259 55.8737 44.0451 56.2743 44.4473C56.6749 44.8495 56.9921 45.3268 57.2077 45.8519C57.4233 46.3769 57.5331 46.9394 57.5307 47.507V53.2605Z" fill="#FF6600"/>
-</g>
-<defs>
-<clipPath id="clip0_6841_31698">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6841_31698)"><path fill="#f60" d="M69.113 28.804H46.075a2.87 2.87 0 0 1-2.886-2.886V2.886A2.865 2.865 0 0 0 40.302.018H31.68a2.87 2.87 0 0 0-2.886 2.868v23.032a2.87 2.87 0 0 1-2.887 2.886h-8.623a2.87 2.87 0 0 1-2.887-2.886V2.886A2.867 2.867 0 0 0 11.51 0H2.868A2.87 2.87 0 0 0 0 2.886v66.228A2.867 2.867 0 0 0 2.887 72h66.226a2.87 2.87 0 0 0 2.886-2.886v-37.37a2.867 2.867 0 0 0-2.886-2.94M57.53 53.26a4.31 4.31 0 0 1-4.312 4.328h-5.773a4.31 4.31 0 0 1-4.311-4.328v-5.754a4.31 4.31 0 0 1 4.311-4.329h5.773a4.31 4.31 0 0 1 4.312 4.329z"/></g><defs><clipPath id="clip0_6841_31698"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/rds.svg b/web/packages/design/src/ResourceIcon/assets/rds.svg
index 6abff0cb54a33..0eb34b9b6f4d5 100644
--- a/web/packages/design/src/ResourceIcon/assets/rds.svg
+++ b/web/packages/design/src/ResourceIcon/assets/rds.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M4.09668 56.0873L11.5766 64.8532L12.2492 64.0543V7.98594L11.5766 7.13867L4.09668 15.9013V56.0873Z" fill="#1A476F"/>
-<path d="M11.5771 64.8533L25.8696 71.999L26.4641 71.0424L26.4738 0.74869L25.8796 0L11.5771 7.12279V64.8533Z" fill="#1F5B98"/>
-<path d="M67.9847 15.9013L60.5028 7.13867L59.666 7.40371L59.8322 64.1377L60.5028 64.8532L67.9847 56.0883V15.9013Z" fill="#2D72B8"/>
-<path d="M46.2107 71.999L60.5032 64.8533V7.12279L46.2007 0L45.5244 0.915148L45.5341 70.9591L46.2107 71.999Z" fill="#5294CF"/>
-<path d="M25.8799 0H46.2003V72H25.8799V0Z" fill="#2D72B8"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1a476f" d="m4.097 56.087 7.48 8.766.672-.799V7.986l-.672-.847-7.48 8.762z"/><path fill="#1f5b98" d="M11.577 64.853 25.87 72l.594-.957.01-70.293L25.88 0 11.577 7.123z"/><path fill="#2d72b8" d="M67.985 15.901 60.503 7.14l-.837.265.166 56.734.67.715 7.483-8.765z"/><path fill="#5294cf" d="m46.21 71.999 14.293-7.146V7.123L46.201 0l-.677.915.01 70.044z"/><path fill="#2d72b8" d="M25.88 0H46.2v72H25.88z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/redhat.svg b/web/packages/design/src/ResourceIcon/assets/redhat.svg
index 663779a759372..8605d4c3d6276 100644
--- a/web/packages/design/src/ResourceIcon/assets/redhat.svg
+++ b/web/packages/design/src/ResourceIcon/assets/redhat.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M48.0515 40.1426C52.7673 40.1426 59.5904 39.17 59.5904 33.5608C59.6045 33.1279 59.5652 32.6949 59.4735 32.2716L56.6651 20.0731C56.0168 17.3891 55.4475 16.1715 50.7355 13.8155C47.0789 11.9457 39.1137 8.8584 36.7577 8.8584C34.5638 8.8584 33.9267 11.6856 31.3106 11.6856C28.7925 11.6856 26.9227 9.57463 24.5667 9.57463C22.3049 9.57463 20.831 11.1164 19.6926 14.2867C19.6926 14.2867 16.5223 23.2282 16.1152 24.525C16.0505 24.7631 16.0225 25.0097 16.0322 25.2563C16.0322 28.7319 29.716 40.1275 48.0515 40.1275M60.3141 35.8377C60.9663 38.925 60.9663 39.2492 60.9663 39.6563C60.9663 44.9338 55.0329 47.8628 47.2335 47.8628C29.6067 47.8741 14.1663 37.5453 14.1663 30.7185C14.1653 29.7682 14.359 28.8279 14.7355 27.9554C8.39497 28.272 0.188477 29.4029 0.188477 36.6481C0.188477 48.5149 28.3062 63.1411 50.5696 63.1411C67.6385 63.1411 71.9435 55.4209 71.9435 49.3254C71.9435 44.5304 67.7969 39.0871 60.3217 35.8377" fill="#EE0000"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#e00" d="M48.052 40.143c4.715 0 11.538-.973 11.538-6.582a5.3 5.3 0 0 0-.117-1.29l-2.808-12.198c-.648-2.684-1.218-3.901-5.93-6.257-3.656-1.87-11.621-4.958-13.977-4.958-2.194 0-2.831 2.828-5.447 2.828-2.518 0-4.388-2.111-6.744-2.111-2.262 0-3.736 1.541-4.874 4.712 0 0-3.17 8.941-3.578 10.238a2.4 2.4 0 0 0-.083.731c0 3.476 13.684 14.871 32.02 14.871m12.262-4.29c.652 3.088.652 3.412.652 3.82 0 5.277-5.933 8.206-13.733 8.206-17.626.011-33.067-10.318-33.067-17.144 0-.95.193-1.891.57-2.764C8.395 28.272.188 29.403.188 36.648c0 11.867 28.118 26.493 50.382 26.493 17.068 0 21.374-7.72 21.374-13.816 0-4.795-4.147-10.238-11.622-13.487"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/redshift.svg b/web/packages/design/src/ResourceIcon/assets/redshift.svg
index 2d47b879d98d7..178007a66df9e 100644
--- a/web/packages/design/src/ResourceIcon/assets/redshift.svg
+++ b/web/packages/design/src/ResourceIcon/assets/redshift.svg
@@ -1,9 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M63.1671 10.1543L68.618 12.7887V59.0772L63.1671 61.7114L54.5264 36L63.1671 10.1543Z" fill="#5294CF"/>
-<path d="M8.61192 10.1543L3.16113 12.7887V59.0772L8.61192 61.7114L22.2532 36L8.61192 10.1543Z" fill="#205B99"/>
-<path d="M35.8848 55.0536L63.1675 61.6924V10.1543L35.8848 16.8025V55.0536Z" fill="#205B99"/>
-<path d="M35.8843 55.0536L8.61133 61.6924V10.1543L35.8843 16.8025V55.0536Z" fill="#5294CF"/>
-<path d="M42.4363 72L52.8591 66.7984V5.2017L42.4363 0L32.0713 34.2372L42.4363 72Z" fill="#5294CF"/>
-<path d="M29.3405 72L18.918 66.7984V5.2017L29.3405 0L38.6136 36L29.3405 72Z" fill="#205B99"/>
-<path d="M42.437 0H29.3418V72H42.437V0Z" fill="#2E73B8"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#5294cf" d="m63.167 10.154 5.451 2.635v46.288l-5.45 2.634L54.525 36z"/><path fill="#205b99" d="m8.612 10.154-5.45 2.635v46.288l5.45 2.634L22.253 36zm27.273 44.9 27.283 6.638V10.154l-27.283 6.648z"/><path fill="#5294cf" d="M35.884 55.054 8.611 61.692V10.154l27.273 6.648z"/><path fill="#5294cf" d="m42.436 72 10.423-5.202V5.202L42.436 0 32.071 34.237z"/><path fill="#205b99" d="m29.34 72-10.422-5.202V5.202L29.341 0l9.273 36z"/><path fill="#2e73b8" d="M42.437 0H29.342v72h13.095z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/ringlead.svg b/web/packages/design/src/ResourceIcon/assets/ringlead.svg
index 641a4dfbee740..c9bbb3512fc20 100644
--- a/web/packages/design/src/ResourceIcon/assets/ringlead.svg
+++ b/web/packages/design/src/ResourceIcon/assets/ringlead.svg
@@ -1,34 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16965_14305)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M53.8966 30.6379L55.7617 40.8331L39.6409 39.9967C39.6409 39.9967 12.5137 25.1221 31.3317 2.51123C29.3788 15.8929 44.5628 22.8263 53.8966 30.6379Z" fill="#00C5EF"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M27.7057 44.9934C23.5615 46.7205 14.7171 57.8398 18.6856 70.5023C10.2886 58.9062 1.281 45.4701 6.16532 22.4829C6.50823 32.3854 14.1651 41.4013 27.7057 44.9934Z" fill="#740092"/>
-<mask id="mask0_16965_14305" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="4" y="22" width="16" height="49">
-<path d="M19.7016 22.4829H4.78516V70.5232H19.7016V22.4829Z" fill="white"/>
-</mask>
-<g mask="url(#mask0_16965_14305)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M19.7059 54.6199C17.4449 59.6165 17.0822 65.2659 18.6856 70.5106C10.2886 58.9062 1.281 45.4701 6.16532 22.4829C4.50516 32.3017 9.80347 46.8125 19.7059 54.6199Z" fill="#B31696"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M61.9798 38.0561C70.4772 49.2591 69.0888 67.2826 54.4317 71.4267L53.9466 71.5564C42.5764 74.3791 39.2017 62.5446 43.2036 57.1836C45.2736 54.4069 51.4292 52.8429 55.243 56.962C57.3339 52.8596 53.9174 49.3971 48.251 46.5075C46.9547 42.7063 44.2784 39.8585 34.8694 39.5114C25.4603 39.1643 1.97966 31.336 9.4065 0.00195312C20.8729 22.801 49.3258 21.3876 61.9798 38.0561Z" fill="#0072BF"/>
-<mask id="mask1_16965_14305" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="7" y="0" width="52" height="57">
-<path d="M58.3075 0.00195312H7.97559V56.9745H58.3075V0.00195312Z" fill="white"/>
-</mask>
-<g mask="url(#mask1_16965_14305)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M20.2582 23.5663C31.181 32.6742 45.6542 30.8844 54.5488 40.7701C58.5466 45.207 60.1984 52.0944 55.243 56.9745C57.3339 52.8722 53.9174 49.4097 48.251 46.5201C46.9547 42.7188 44.2784 39.871 34.8694 39.5239C25.4603 39.1769 1.97966 31.336 9.4065 0.00195312C10.2219 11.3471 14.0859 18.4227 20.2582 23.5663Z" fill="#2D1463"/>
-</g>
-<mask id="mask2_16965_14305" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="24" y="12" width="30" height="19">
-<path d="M53.8964 12.9321H24.833V30.6378H53.8964V12.9321Z" fill="white"/>
-</mask>
-<g mask="url(#mask2_16965_14305)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M44.4581 23.5873C47.7157 25.9918 51.0737 28.2751 53.8964 30.6378C45.3488 24.8837 34.3006 21.7473 24.833 16.0016C24.9652 14.9632 25.1791 13.9368 25.4728 12.9321C31.5489 17.0177 38.2398 20.1499 44.4581 23.5873Z" fill="#00A9E5"/>
-</g>
-<g style="mix-blend-mode:lighten" opacity="0.36">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M53.8962 30.6419C56.9835 32.6476 59.7153 35.1533 61.9796 38.0562C68.867 47.1391 69.2559 60.7131 61.3398 67.7469C59.3455 69.4846 56.9837 70.7484 54.4315 71.4435L53.9464 71.5732C42.5761 74.3959 39.2014 62.5614 43.2034 57.2004C45.2734 54.4237 51.4289 52.8597 55.2427 56.9788C57.3336 52.8764 53.9171 49.4139 48.2508 46.5243C47.2053 43.4633 45.2692 41.0211 39.6405 40.0049C39.6405 40.0049 22.9719 30.851 24.837 15.9932C34.3004 21.7473 45.3486 24.8878 53.8962 30.6419Z" fill="#00C5EF"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M18.2174 59.747C17.5066 63.3313 17.7065 67.0365 18.7986 70.5235C13.655 63.4145 8.28145 55.6029 6.01074 45.3408C10.7947 58.1287 18.1964 59.7429 18.2174 59.747Z" fill="#F10091"/>
-</g>
-<defs>
-<clipPath id="clip0_16965_14305">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16965_14305)"><path fill="#00c5ef" fill-rule="evenodd" d="m53.897 30.638 1.865 10.195-16.121-.836S12.514 25.122 31.33 2.51c-1.95 13.383 13.234 20.316 22.568 28.128" clip-rule="evenodd"/><path fill="#740092" fill-rule="evenodd" d="M27.706 44.993c-4.145 1.727-12.989 12.847-9.02 25.51C10.289 58.905 1.28 45.47 6.166 22.482c.342 9.902 8 18.918 21.54 22.51" clip-rule="evenodd"/><mask id="mask0_16965_14305" width="16" height="49" x="4" y="22" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M19.702 22.483H4.785v48.04h14.917z"/></mask><g mask="url(#mask0_16965_14305)"><path fill="#b31696" fill-rule="evenodd" d="M19.706 54.62a22.55 22.55 0 0 0-1.02 15.89C10.289 58.907 1.28 45.47 6.166 22.484c-1.66 9.819 3.637 24.33 13.54 32.137" clip-rule="evenodd"/></g><path fill="#0072bf" fill-rule="evenodd" d="M61.98 38.056c8.497 11.203 7.109 29.227-7.548 33.37l-.485.13c-11.37 2.823-14.745-9.011-10.743-14.372 2.07-2.777 8.225-4.341 12.039-.222 2.09-4.102-1.326-7.565-6.992-10.455-1.296-3.8-3.973-6.648-13.382-6.996C25.46 39.164 1.98 31.336 9.407.002 20.873 22.801 49.326 21.388 61.98 38.056" clip-rule="evenodd"/><mask id="mask1_16965_14305" width="52" height="57" x="7" y="0" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M58.308.002H7.975v56.973h50.332z"/></mask><g mask="url(#mask1_16965_14305)"><path fill="#2d1463" fill-rule="evenodd" d="M20.258 23.566c10.923 9.108 25.396 7.318 34.29 17.204 3.999 4.437 5.65 11.324.695 16.204 2.09-4.102-1.326-7.564-6.992-10.454-1.296-3.801-3.973-6.649-13.382-6.996S1.98 31.336 9.407.002c.815 11.345 4.679 18.42 10.851 23.564" clip-rule="evenodd"/></g><mask id="mask2_16965_14305" width="30" height="19" x="24" y="12" maskUnits="userSpaceOnUse" style="mask-type:luminance"><path fill="#fff" d="M53.896 12.932H24.833v17.706h29.063z"/></mask><g mask="url(#mask2_16965_14305)"><path fill="#00a9e5" fill-rule="evenodd" d="M44.458 23.587c3.258 2.405 6.616 4.688 9.438 7.05-8.547-5.753-19.595-8.89-29.063-14.635q.198-1.56.64-3.07c6.076 4.086 12.767 7.218 18.985 10.655" clip-rule="evenodd"/></g><path fill="#00c5ef" fill-rule="evenodd" d="M53.896 30.642a33.2 33.2 0 0 1 8.084 7.414c6.887 9.083 7.276 22.657-.64 29.69a17.5 17.5 0 0 1-6.909 3.698l-.485.13C42.576 74.395 39.201 62.56 43.203 57.2c2.07-2.776 8.226-4.34 12.04-.221 2.09-4.103-1.326-7.565-6.992-10.455-1.046-3.06-2.982-5.503-8.61-6.52 0 0-16.67-9.153-14.804-24.01 9.463 5.753 20.512 8.894 29.06 14.648" clip-rule="evenodd" opacity=".36" style="mix-blend-mode:lighten"/><path fill="#f10091" fill-rule="evenodd" d="M18.217 59.747a21.85 21.85 0 0 0 .582 10.776C13.655 63.416 8.28 55.604 6.01 45.342c4.784 12.788 12.185 14.402 12.206 14.406" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16965_14305"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/rippling-dark.svg b/web/packages/design/src/ResourceIcon/assets/rippling-dark.svg
index 93bf9ac63a493..e4a0f7655fcc9 100644
--- a/web/packages/design/src/ResourceIcon/assets/rippling-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/rippling-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_4735)">
-<path d="M8.65889 24.0151C8.65889 18.058 5.64122 13.1358 0 9.00195H13.1117C15.423 10.7624 17.2958 13.0336 18.5834 15.6381C19.871 18.2426 20.5386 21.1097 20.534 24.0151C20.5386 26.9205 19.871 29.7876 18.5834 32.3921C17.2958 34.9966 15.423 37.2679 13.1117 39.0283C17.3689 40.8034 19.7909 45.1358 19.7909 51.3367V63.1516H7.91876V51.3367C7.91876 45.4307 5.09966 41.2968 0.00300865 39.0313C5.64423 34.8944 8.6619 29.9752 8.6619 24.0181L8.65889 24.0151ZM34.3889 24.0151C34.3889 18.058 31.3712 13.1358 25.73 9.00195H38.8447C41.1555 10.7627 43.0276 13.0341 44.3147 15.6386C45.6018 18.243 46.269 21.11 46.264 24.0151C46.269 26.9203 45.6018 29.7872 44.3147 32.3917C43.0276 34.9961 41.1555 37.2675 38.8447 39.0283C43.0989 40.8034 45.5239 45.1358 45.5239 51.3367V63.1516H33.6487V51.3367C33.6487 45.4307 30.8266 41.2968 25.73 39.0313C31.3712 34.8944 34.3889 29.9752 34.3889 24.0181V24.0151ZM60.1248 24.0151C60.1248 18.058 57.1072 13.1358 51.466 9.00195H64.5776C66.889 10.7624 68.7617 13.0336 70.0494 15.6381C71.337 18.2426 72.0046 21.1097 72 24.0151C72.0046 26.9205 71.337 29.7876 70.0494 32.3921C68.7617 34.9966 66.889 37.2679 64.5776 39.0283C68.8349 40.8034 71.2568 45.1358 71.2568 51.3367V63.1516H59.3817V51.3367C59.3817 45.4307 56.5626 41.2968 51.466 39.0313C57.1072 34.8944 60.1248 29.9752 60.1248 24.0181V24.0151Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_4735">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_4735)"><path fill="#fff" d="M8.659 24.015c0-5.957-3.018-10.88-8.659-15.013h13.112a18.83 18.83 0 0 1 7.422 15.013 18.84 18.84 0 0 1-7.422 15.013c4.257 1.775 6.679 6.108 6.679 12.309v11.815H7.919V51.337c0-5.906-2.82-10.04-7.916-12.306 5.641-4.137 8.659-9.056 8.659-15.013zm25.73 0c0-5.957-3.018-10.88-8.659-15.013h13.115a18.83 18.83 0 0 1 7.419 15.013 18.83 18.83 0 0 1-7.42 15.013c4.255 1.775 6.68 6.108 6.68 12.309v11.815H33.649V51.337c0-5.906-2.822-10.04-7.919-12.306 5.641-4.137 8.659-9.056 8.659-15.013zm25.736 0c0-5.957-3.018-10.88-8.659-15.013h13.112A18.84 18.84 0 0 1 72 24.015a18.84 18.84 0 0 1-7.422 15.013c4.257 1.775 6.679 6.108 6.679 12.309v11.815H59.382V51.337c0-5.906-2.82-10.04-7.916-12.306 5.641-4.137 8.659-9.056 8.659-15.013z"/></g><defs><clipPath id="clip0_16966_4735"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/rippling-light.svg b/web/packages/design/src/ResourceIcon/assets/rippling-light.svg
index fc9d6213f176f..d3abe6549d0a2 100644
--- a/web/packages/design/src/ResourceIcon/assets/rippling-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/rippling-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_4735)">
-<path d="M8.65889 24.0151C8.65889 18.058 5.64122 13.1358 0 9.00195H13.1117C15.423 10.7624 17.2958 13.0336 18.5834 15.6381C19.871 18.2426 20.5386 21.1097 20.534 24.0151C20.5386 26.9205 19.871 29.7876 18.5834 32.3921C17.2958 34.9966 15.423 37.2679 13.1117 39.0283C17.3689 40.8034 19.7909 45.1358 19.7909 51.3367V63.1516H7.91876V51.3367C7.91876 45.4307 5.09966 41.2968 0.00300865 39.0313C5.64423 34.8944 8.6619 29.9752 8.6619 24.0181L8.65889 24.0151ZM34.3889 24.0151C34.3889 18.058 31.3712 13.1358 25.73 9.00195H38.8447C41.1555 10.7627 43.0276 13.0341 44.3147 15.6386C45.6018 18.243 46.269 21.11 46.264 24.0151C46.269 26.9203 45.6018 29.7872 44.3147 32.3917C43.0276 34.9961 41.1555 37.2675 38.8447 39.0283C43.0989 40.8034 45.5239 45.1358 45.5239 51.3367V63.1516H33.6487V51.3367C33.6487 45.4307 30.8266 41.2968 25.73 39.0313C31.3712 34.8944 34.3889 29.9752 34.3889 24.0181V24.0151ZM60.1248 24.0151C60.1248 18.058 57.1072 13.1358 51.466 9.00195H64.5776C66.889 10.7624 68.7617 13.0336 70.0494 15.6381C71.337 18.2426 72.0046 21.1097 72 24.0151C72.0046 26.9205 71.337 29.7876 70.0494 32.3921C68.7617 34.9966 66.889 37.2679 64.5776 39.0283C68.8349 40.8034 71.2568 45.1358 71.2568 51.3367V63.1516H59.3817V51.3367C59.3817 45.4307 56.5626 41.2968 51.466 39.0313C57.1072 34.8944 60.1248 29.9752 60.1248 24.0181V24.0151Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_4735">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_4735)"><path fill="#000" d="M8.659 24.015c0-5.957-3.018-10.88-8.659-15.013h13.112a18.83 18.83 0 0 1 7.422 15.013 18.84 18.84 0 0 1-7.422 15.013c4.257 1.775 6.679 6.108 6.679 12.309v11.815H7.919V51.337c0-5.906-2.82-10.04-7.916-12.306 5.641-4.137 8.659-9.056 8.659-15.013zm25.73 0c0-5.957-3.018-10.88-8.659-15.013h13.115a18.83 18.83 0 0 1 7.419 15.013 18.83 18.83 0 0 1-7.42 15.013c4.255 1.775 6.68 6.108 6.68 12.309v11.815H33.649V51.337c0-5.906-2.822-10.04-7.919-12.306 5.641-4.137 8.659-9.056 8.659-15.013zm25.736 0c0-5.957-3.018-10.88-8.659-15.013h13.112A18.84 18.84 0 0 1 72 24.015a18.84 18.84 0 0 1-7.422 15.013c4.257 1.775 6.679 6.108 6.679 12.309v11.815H59.382V51.337c0-5.906-2.82-10.04-7.916-12.306 5.641-4.137 8.659-9.056 8.659-15.013z"/></g><defs><clipPath id="clip0_16966_4735"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/salesforce.svg b/web/packages/design/src/ResourceIcon/assets/salesforce.svg
index d542061803d1c..fc24a1d7d4c23 100644
--- a/web/packages/design/src/ResourceIcon/assets/salesforce.svg
+++ b/web/packages/design/src/ResourceIcon/assets/salesforce.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.9623 16.2962C32.2837 13.8779 35.5177 12.3763 39.0927 12.3763C43.8449 12.3763 47.9924 15.0268 50.2004 18.9617C52.176 18.0792 54.3158 17.6244 56.4795 17.627C65.0516 17.627 72 24.6368 72 33.2853C72 41.9338 65.0516 48.9436 56.4795 48.9436C55.4314 48.9436 54.4093 48.8389 53.421 48.6397C51.4768 52.1068 47.7696 54.4502 43.5166 54.4502C41.7362 54.4502 40.0518 54.0407 38.5533 53.3076C36.5815 57.9457 31.9884 61.1963 26.6361 61.1963C21.0626 61.1963 16.3112 57.6685 14.4882 52.7226C13.676 52.894 12.8481 52.9803 12.018 52.9801C5.38064 52.9808 3.33804e-05 47.5443 3.33804e-05 40.8377C-0.00494607 38.7123 0.547255 36.6227 1.60159 34.7772C2.65593 32.9317 4.17557 31.3949 6.00902 30.3198C5.24838 28.5671 4.85703 26.6765 4.85935 24.7659C4.85935 17.0521 11.1203 10.7998 18.8436 10.7998C20.9951 10.7973 23.1181 11.2921 25.0468 12.2455C26.9755 13.1989 28.6578 14.5852 29.9623 16.2962Z" fill="#00A1E0"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M10.4289 36.935L10.7203 36.1263C10.7667 35.9877 10.8715 36.0334 10.914 36.0594C10.9951 36.1074 11.0534 36.1507 11.1581 36.2122C12.0164 36.7547 12.8117 36.7602 13.0598 36.7602C13.7023 36.7602 14.1008 36.4201 14.1008 35.961V35.9373C14.1008 35.4381 13.4866 35.2491 12.7771 35.0318L12.6196 34.9814C11.6455 34.7042 10.6037 34.3034 10.6037 33.0703V33.0451C10.6037 31.8749 11.5479 31.0583 12.8991 31.0583L13.0472 31.0568C13.8409 31.0568 14.6079 31.2875 15.1638 31.6245C15.2142 31.656 15.263 31.7143 15.2347 31.7915L14.9355 32.6002C14.8827 32.738 14.7386 32.6466 14.7386 32.6466C14.1586 32.3444 13.5168 32.1798 12.8629 32.1655C12.2896 32.1655 11.9211 32.4694 11.9211 32.8821V32.9081C11.9211 33.3892 12.5527 33.5947 13.285 33.8333L13.411 33.8727C14.3819 34.1798 15.4182 34.605 15.4182 35.7743V35.7988C15.4182 37.0626 14.5 37.8477 13.0235 37.8477C12.2983 37.8477 11.6046 37.7359 10.8707 37.3461C10.7321 37.2658 10.5951 37.1965 10.4596 37.098C10.4455 37.0776 10.3832 37.0532 10.4281 36.935H10.4289ZM32.0498 36.935L32.3419 36.1263C32.3844 35.994 32.5081 36.0429 32.5348 36.0594C32.6152 36.109 32.675 36.1507 32.7789 36.2122C33.6388 36.7547 34.4326 36.7602 34.683 36.7602C35.3232 36.7602 35.7224 36.4201 35.7224 35.961V35.9373C35.7224 35.4381 35.109 35.2491 34.3995 35.0318L34.242 34.9814C33.2664 34.7042 32.2246 34.3034 32.2246 33.0703V33.0451C32.2246 31.8749 33.1695 31.0583 34.5208 31.0583L34.668 31.0568C35.4618 31.0568 36.2295 31.2875 36.7862 31.6245C36.8351 31.656 36.8847 31.7143 36.8571 31.7915C36.8296 31.8631 36.5839 32.5246 36.5579 32.6002C36.5036 32.738 36.361 32.6466 36.361 32.6466C35.7808 32.3443 35.1387 32.1796 34.4846 32.1655C33.9113 32.1655 33.5428 32.4694 33.5428 32.8821V32.9081C33.5428 33.3892 34.1735 33.5947 34.9066 33.8333L35.0326 33.8727C36.0035 34.1798 37.039 34.605 37.039 35.7743V35.7988C37.039 37.0626 36.1216 37.8477 34.6452 37.8477C33.9192 37.8477 33.2254 37.7359 32.4923 37.3461C32.3537 37.2658 32.2167 37.1965 32.0805 37.098C32.0663 37.0776 32.0041 37.0532 32.0498 36.935ZM48.0428 33.1325C48.164 33.5388 48.2239 33.9853 48.2239 34.457C48.2239 34.9294 48.164 35.3743 48.0428 35.7806C47.9319 36.1724 47.7416 36.5372 47.4837 36.8524C47.2253 37.1584 46.9012 37.4023 46.5356 37.5658C46.1576 37.739 45.7135 37.8256 45.2143 37.8256C44.715 37.8256 44.2693 37.739 43.8929 37.5658C43.5273 37.4023 43.2032 37.1584 42.9449 36.8524C42.6872 36.5373 42.4967 36.1728 42.385 35.7814C42.2612 35.351 42.2002 34.9049 42.2039 34.457C42.2039 33.9845 42.2645 33.5388 42.385 33.1325C42.5062 32.723 42.6944 32.3624 42.9441 32.0615C43.2031 31.7543 43.5272 31.5084 43.8929 31.3418C44.2701 31.1654 44.7135 31.0765 45.2143 31.0765C45.7151 31.0765 46.1584 31.1654 46.5356 31.3418C46.912 31.5174 47.2317 31.7592 47.4837 32.0615C47.7341 32.3624 47.9231 32.723 48.0428 33.1325ZM46.8112 34.457C46.8112 33.7427 46.6789 33.1813 46.4159 32.7876C46.156 32.397 45.7623 32.208 45.2143 32.208C44.6662 32.208 44.2756 32.397 44.0189 32.7876C43.7614 33.1813 43.6299 33.7427 43.6299 34.457C43.6299 35.1704 43.7614 35.7358 44.0205 36.1326C44.2756 36.5279 44.6662 36.7193 45.2143 36.7193C45.7623 36.7193 46.156 36.5271 46.4159 36.1326C46.6773 35.7358 46.8112 35.1704 46.8112 34.457ZM58.1677 36.5279L58.4701 37.3642C58.5095 37.4666 58.4205 37.5115 58.4205 37.5115C57.9535 37.6926 57.3055 37.8217 56.6747 37.8217C55.6054 37.8217 54.7864 37.5138 54.2399 36.9059C53.6966 36.2996 53.4194 35.4751 53.4194 34.4522C53.4194 33.979 53.4879 33.5309 53.6218 33.1254C53.7557 32.7159 53.9565 32.3553 54.2211 32.0545C54.4958 31.7452 54.8346 31.4996 55.214 31.3347C55.6077 31.1591 56.0708 31.0709 56.5873 31.0709C56.9362 31.0709 57.2464 31.0922 57.5126 31.1316C57.7968 31.1757 58.1756 31.278 58.3354 31.3402C58.3646 31.3513 58.4457 31.3906 58.4126 31.4859C58.2961 31.8143 58.2165 32.0285 58.1087 32.3277C58.0614 32.4553 57.9654 32.4127 57.9654 32.4127C57.5598 32.2852 57.1708 32.2269 56.6629 32.2269C56.0526 32.2269 55.5944 32.4301 55.2951 32.8277C54.9927 33.2285 54.8234 33.7538 54.8211 34.4522C54.8187 35.2184 55.0109 35.7862 55.351 36.1374C55.6904 36.4878 56.1645 36.6649 56.7613 36.6649C57.0031 36.6649 57.2315 36.6492 57.437 36.6169C57.6401 36.5846 57.8307 36.5216 58.0102 36.4516C58.0102 36.4516 58.126 36.4082 58.1677 36.5279ZM64.4752 32.9002C64.7437 33.8404 64.6035 34.6522 64.5988 34.6971C64.5885 34.8042 64.4783 34.8058 64.4783 34.8058L60.3056 34.8026C60.3316 35.4365 60.4836 35.8854 60.7907 36.1901C61.0923 36.4886 61.5711 36.6799 62.2191 36.6807C63.2097 36.6831 63.6326 36.4838 63.9326 36.3728C63.9326 36.3728 64.0468 36.3319 64.0901 36.4453L64.3618 37.2099C64.4169 37.3382 64.3728 37.3831 64.3263 37.4091C64.0649 37.5532 63.431 37.8225 62.2246 37.8256C61.6396 37.828 61.1301 37.7445 60.7104 37.5815C60.3116 37.4338 59.9523 37.1958 59.6607 36.8862C59.382 36.5824 59.1751 36.22 59.0552 35.8255C58.926 35.3934 58.8626 34.9442 58.867 34.4932C58.867 34.0207 58.9276 33.5719 59.0497 33.1616C59.1717 32.7482 59.3615 32.3836 59.6143 32.0773C59.8762 31.7647 60.2047 31.5145 60.5757 31.345C60.9584 31.1646 61.4325 31.0765 61.9538 31.0765C62.4002 31.0765 62.8081 31.1725 63.1475 31.319C63.409 31.4308 63.672 31.6332 63.9413 31.923C64.1114 32.1056 64.3704 32.5057 64.4752 32.9002ZM60.3253 33.7719H63.3019C63.2711 33.3892 63.1963 33.0459 63.0247 32.7876C62.7632 32.397 62.4026 32.182 61.8553 32.182C61.3073 32.182 60.9183 32.397 60.6608 32.7876C60.4923 33.0459 60.3844 33.375 60.3253 33.7719ZM31.0521 32.9002C31.3198 33.8404 31.182 34.6522 31.1773 34.6971C31.1663 34.8042 31.056 34.8058 31.056 34.8058L26.8826 34.8026C26.9093 35.4365 27.0605 35.8854 27.3684 36.1901C27.67 36.4886 28.148 36.6799 28.7961 36.6807C29.7867 36.6831 30.2111 36.4838 30.5103 36.3728C30.5103 36.3728 30.6245 36.3319 30.667 36.4453L30.9395 37.2099C30.9946 37.3382 30.9505 37.3831 30.9048 37.4091C30.6418 37.5532 30.0071 37.8225 28.8024 37.8256C28.2165 37.828 27.707 37.7445 27.2881 37.5815C26.8891 37.4336 26.5297 37.1957 26.2376 36.8862C25.9597 36.5821 25.7533 36.2197 25.6337 35.8255C25.5036 35.3935 25.4396 34.9443 25.4439 34.4932C25.4439 34.0207 25.5053 33.5719 25.6266 33.1616C25.7401 32.7658 25.9324 32.3969 26.192 32.0773C26.4539 31.7649 26.7821 31.5148 27.1527 31.345C27.5369 31.1646 28.011 31.0765 28.5307 31.0765C28.9414 31.0755 29.3481 31.158 29.726 31.319C29.9875 31.4308 30.2505 31.6332 30.519 31.923C30.6891 32.1056 30.9481 32.5057 31.0521 32.9002ZM26.9015 33.7719H29.8796C29.8481 33.3892 29.7733 33.0459 29.6024 32.7876C29.3425 32.397 28.9803 32.182 28.433 32.182C27.885 32.182 27.4952 32.397 27.2393 32.7876C27.0692 33.0459 26.9621 33.375 26.9015 33.7719ZM19.542 33.5727C19.542 33.5727 19.8712 33.6018 20.2302 33.6538V33.4774C20.2302 32.9207 20.1145 32.6584 19.8869 32.4828C19.6538 32.3049 19.3058 32.2127 18.8554 32.2127C18.8554 32.2127 17.8396 32.2001 17.0364 32.6364C16.9994 32.6584 16.9686 32.671 16.9686 32.671C16.9686 32.671 16.8678 32.7065 16.8316 32.6033L16.5363 31.8096C16.4907 31.6954 16.5733 31.6434 16.5733 31.6434C16.949 31.3505 17.8592 31.1733 17.8592 31.1733C18.2288 31.1084 18.603 31.0739 18.9782 31.0702C19.8113 31.0702 20.4562 31.2639 20.8948 31.6474C21.3342 32.0324 21.5579 32.6529 21.5579 33.4892L21.5602 37.3067C21.5602 37.3067 21.5689 37.417 21.4642 37.4422C21.4642 37.4422 21.3106 37.4847 21.1728 37.517C21.0334 37.5492 20.531 37.6516 20.1208 37.7209C19.7018 37.7911 19.2778 37.8264 18.853 37.8264C18.4475 37.8264 18.0758 37.7886 17.7482 37.7138C17.4429 37.6499 17.1538 37.5245 16.8986 37.3453C16.6659 37.1764 16.4791 36.952 16.3552 36.6925C16.2269 36.4303 16.1623 36.1098 16.1623 35.7397C16.1623 35.3767 16.2387 35.053 16.3859 34.7774C16.534 34.5034 16.7371 34.2711 16.9923 34.0892C17.2558 33.9036 17.5505 33.7668 17.8624 33.6853C18.1876 33.5986 18.5333 33.5538 18.8908 33.5538C19.153 33.5538 19.3719 33.5593 19.542 33.5727ZM17.8813 36.5051C17.8789 36.5043 18.2553 36.8004 19.105 36.7484C19.7019 36.7122 20.231 36.5988 20.231 36.5988V34.7011C20.231 34.7011 19.6971 34.6137 19.0979 34.605C18.2482 34.5948 17.886 34.9074 17.8884 34.9066C17.638 35.0845 17.5159 35.3483 17.5159 35.7137C17.5159 35.9476 17.5576 36.1303 17.6419 36.2578C17.6947 36.3421 17.7175 36.3736 17.8813 36.5051ZM53.2021 31.4221C53.1627 31.5363 52.9604 32.108 52.8871 32.2978C52.8604 32.3702 52.8163 32.4198 52.7351 32.4112C52.7351 32.4112 52.4958 32.3561 52.2769 32.3561C52.1264 32.3561 51.9115 32.375 51.7178 32.4348C51.5235 32.4945 51.3467 32.6007 51.2028 32.7443C51.05 32.8915 50.9264 33.0986 50.8366 33.3585C50.7453 33.6199 50.698 34.0357 50.698 34.453V37.5618C50.6981 37.5785 50.695 37.5949 50.6887 37.6103C50.6824 37.6257 50.6731 37.6397 50.6614 37.6514C50.6497 37.6632 50.6358 37.6726 50.6204 37.679C50.6051 37.6853 50.5886 37.6886 50.572 37.6886H49.4767C49.4599 37.6888 49.4433 37.6857 49.4278 37.6795C49.4122 37.6733 49.398 37.6641 49.386 37.6524C49.374 37.6407 49.3645 37.6267 49.3579 37.6113C49.3513 37.5959 49.3478 37.5794 49.3476 37.5626V31.3379C49.3476 31.2678 49.3987 31.2119 49.4688 31.2119H50.5374C50.6083 31.2119 50.6587 31.2678 50.6587 31.3379V31.8466C50.8185 31.6324 51.1051 31.4434 51.3642 31.3269C51.6241 31.2087 51.9146 31.1221 52.4399 31.1536C52.7131 31.1702 53.0682 31.245 53.1399 31.2725C53.1539 31.2781 53.1667 31.2865 53.1774 31.2971C53.1881 31.3077 53.1967 31.3203 53.2024 31.3343C53.2082 31.3482 53.2112 31.3631 53.2111 31.3782C53.2111 31.3933 53.208 31.4083 53.2021 31.4221ZM42.9102 28.5377C42.9393 28.5495 43.0189 28.5881 42.9874 28.6826L42.6669 29.5591C42.6401 29.6252 42.6228 29.6646 42.4866 29.6236C42.3064 29.567 42.1187 29.5378 41.9298 29.537C41.7645 29.537 41.6149 29.5583 41.4826 29.6024C41.3502 29.6447 41.2302 29.7188 41.1329 29.8181C41.0035 29.9432 40.9035 30.0954 40.84 30.2638C40.6865 30.7048 40.6274 31.1749 40.6195 31.2048H41.9535C42.0661 31.2048 42.1015 31.2568 42.0905 31.3395L41.9346 32.2072C41.9094 32.3332 41.7952 32.3285 41.7952 32.3285H40.4203L39.4809 37.6485C39.4001 38.1256 39.2773 38.5946 39.1139 39.0501C38.9667 39.4352 38.8147 39.7163 38.5706 39.9848C38.3623 40.2251 38.0973 40.4097 37.7997 40.5218C37.5107 40.6282 37.1595 40.6825 36.776 40.6825C36.5933 40.6825 36.3965 40.6786 36.1642 40.6234C36.0347 40.5939 35.9072 40.5565 35.7823 40.5116C35.7311 40.4935 35.6893 40.4281 35.7193 40.3447C35.7476 40.262 35.9949 39.5856 36.0279 39.4966C36.0705 39.3895 36.1791 39.4305 36.1791 39.4305C36.2531 39.462 36.3051 39.4824 36.4036 39.5021C36.5036 39.5218 36.6374 39.5391 36.739 39.5391C36.9209 39.5391 37.0863 39.5171 37.2304 39.4683C37.4036 39.4123 37.506 39.3108 37.6115 39.1753C37.7217 39.0328 37.8115 38.8399 37.9036 38.5808C37.9958 38.3186 38.08 37.9721 38.1525 37.5524L39.0879 32.3293H38.1666C38.0564 32.3293 38.0186 32.2773 38.0312 32.1938L38.1855 31.3261C38.2099 31.2001 38.3273 31.2048 38.3273 31.2048H39.273L39.3242 30.9229C39.4659 30.0851 39.747 29.448 40.1628 29.0299C40.5809 28.6086 41.1755 28.396 41.9298 28.396C42.1456 28.396 42.3362 28.4102 42.4976 28.4393C42.6559 28.4692 42.7763 28.4968 42.9102 28.5377ZM24.2667 37.5618C24.2667 37.6327 24.2179 37.6886 24.147 37.6886H23.0406C22.9698 37.6886 22.9217 37.6319 22.9217 37.5626V28.6543C22.9217 28.5858 22.9705 28.5291 23.0398 28.5291H24.147C24.2179 28.5291 24.2667 28.5858 24.2667 28.6551V37.5618Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#00a1e0" fill-rule="evenodd" d="M29.962 16.296c2.322-2.418 5.556-3.92 9.13-3.92 4.753 0 8.9 2.65 11.108 6.586a15.35 15.35 0 0 1 6.28-1.335c8.572 0 15.52 7.01 15.52 15.658s-6.948 15.659-15.52 15.659c-1.049 0-2.07-.105-3.059-.304a11.35 11.35 0 0 1-9.904 5.81c-1.78 0-3.465-.41-4.964-1.142-1.971 4.638-6.565 7.888-11.917 7.888-5.573 0-10.325-3.527-12.148-8.473a12 12 0 0 1-2.47.257C5.381 52.98 0 47.544 0 40.838A12.16 12.16 0 0 1 6.009 30.32a13.9 13.9 0 0 1-1.15-5.554c0-7.714 6.261-13.966 13.985-13.966a13.96 13.96 0 0 1 11.118 5.496" clip-rule="evenodd"/><path fill="#fff" fill-rule="evenodd" d="m10.429 36.935.291-.809c.047-.138.151-.093.194-.067.081.048.14.092.244.153a3.5 3.5 0 0 0 1.902.548c.642 0 1.04-.34 1.04-.799v-.024c0-.499-.613-.688-1.323-.905l-.157-.05c-.974-.278-2.016-.679-2.016-1.912v-.025c0-1.17.944-1.987 2.295-1.987l.148-.001c.794 0 1.56.23 2.117.568.05.031.099.09.07.166l-.299.81c-.052.137-.196.046-.196.046a4.26 4.26 0 0 0-1.876-.481c-.573 0-.942.303-.942.716v.026c0 .481.632.687 1.364.925l.126.04c.97.307 2.007.732 2.007 1.901v.025c0 1.264-.918 2.049-2.394 2.049-.726 0-1.42-.112-2.153-.502-.139-.08-.276-.15-.411-.248-.015-.02-.077-.045-.032-.163m21.62 0 .293-.809c.042-.132.166-.083.193-.067.08.05.14.092.244.153.86.543 1.654.548 1.904.548.64 0 1.04-.34 1.04-.799v-.024c0-.499-.614-.688-1.323-.905l-.158-.05c-.976-.278-2.017-.679-2.017-1.912v-.025c0-1.17.944-1.987 2.296-1.987l.147-.001c.794 0 1.562.23 2.118.568.05.031.099.09.071.166a89 89 0 0 0-.3.81c-.053.137-.196.046-.196.046a4.26 4.26 0 0 0-1.876-.481c-.574 0-.942.303-.942.716v.026c0 .481.63.687 1.364.925l.126.04c.97.307 2.006.732 2.006 1.901v.025c0 1.264-.917 2.049-2.394 2.049-.726 0-1.42-.112-2.153-.502-.138-.08-.275-.15-.411-.248-.015-.02-.077-.045-.031-.163m15.994-3.803c.121.407.18.853.18 1.325s-.059.917-.18 1.324a3 3 0 0 1-.56 1.071 2.7 2.7 0 0 1-.947.714c-.378.173-.822.26-1.322.26-.499 0-.945-.087-1.321-.26a2.7 2.7 0 0 1-.948-.714 3 3 0 0 1-.56-1.07 4.7 4.7 0 0 1-.181-1.325c0-.473.06-.918.181-1.325.121-.409.31-.77.56-1.07.258-.308.582-.554.948-.72q.568-.265 1.321-.265t1.322.265c.376.175.696.417.948.72.25.3.44.661.559 1.07m-1.232 1.325c0-.714-.132-1.276-.395-1.67-.26-.39-.654-.579-1.202-.579s-.938.189-1.195.58c-.258.393-.39.955-.39 1.669 0 .713.132 1.279.392 1.676.255.395.645.586 1.193.586s.942-.192 1.202-.586c.261-.397.395-.963.395-1.676m11.357 2.07.302.837c.04.103-.05.148-.05.148a5.1 5.1 0 0 1-1.745.31c-1.07 0-1.889-.308-2.435-.916-.543-.606-.82-1.43-.82-2.454 0-.473.068-.921.202-1.327a3 3 0 0 1 .6-1.07c.274-.31.613-.555.992-.72.394-.176.857-.264 1.373-.264q.526 0 .926.06c.284.045.663.147.822.21.03.01.11.05.078.145-.117.328-.196.543-.304.842-.048.127-.144.085-.144.085a4.1 4.1 0 0 0-1.302-.186c-.61 0-1.069.203-1.368.6-.302.401-.472.927-.474 1.625-.002.766.19 1.334.53 1.685.34.35.813.528 1.41.528q.365 0 .676-.048c.203-.032.394-.095.573-.165 0 0 .116-.044.158.076m6.307-3.627c.269.94.129 1.752.124 1.797-.01.107-.12.109-.12.109l-4.173-.003c.026.634.178 1.082.485 1.387.301.299.78.49 1.428.49.99.003 1.414-.196 1.714-.307 0 0 .114-.041.157.072l.272.765c.055.128.01.173-.036.2-.261.143-.895.413-2.101.416-.585.002-1.095-.081-1.515-.245a2.76 2.76 0 0 1-1.05-.695 2.75 2.75 0 0 1-.605-1.06 4.5 4.5 0 0 1-.188-1.333c0-.472.06-.921.183-1.331a3 3 0 0 1 .564-1.085 2.74 2.74 0 0 1 .962-.732c.382-.18.856-.268 1.378-.268.446 0 .854.095 1.194.242q.39.168.793.604c.17.183.43.583.534.977m-4.15.872h2.977c-.03-.383-.106-.726-.277-.984-.262-.391-.622-.606-1.17-.606s-.937.215-1.194.606c-.169.258-.277.587-.336.984M31.052 32.9c.268.94.13 1.752.125 1.797-.01.107-.121.109-.121.109l-4.173-.003c.026.634.178 1.082.485 1.387.302.299.78.49 1.428.49.99.003 1.415-.196 1.714-.307 0 0 .114-.041.157.072l.272.765c.056.128.012.173-.034.2-.263.143-.898.413-2.103.416-.585.002-1.095-.081-1.514-.245a2.8 2.8 0 0 1-1.05-.695 2.8 2.8 0 0 1-.604-1.06 4.5 4.5 0 0 1-.19-1.333c0-.472.061-.921.183-1.331.113-.396.305-.765.565-1.085.262-.312.59-.562.96-.732.385-.18.859-.268 1.379-.268a3 3 0 0 1 1.195.242q.391.168.793.604c.17.183.43.583.533.977m-4.15.872h2.978c-.032-.383-.107-.726-.278-.984-.26-.391-.622-.606-1.169-.606-.548 0-.938.215-1.194.606-.17.258-.277.587-.338.984m-7.36-.2s.33.03.688.082v-.177c0-.556-.116-.819-.343-.994-.233-.178-.581-.27-1.032-.27 0 0-1.015-.013-1.819.423-.037.022-.067.035-.067.035s-.101.035-.137-.068l-.296-.793c-.045-.115.037-.167.037-.167.376-.293 1.286-.47 1.286-.47q.555-.098 1.12-.103c.832 0 1.477.194 1.916.577.44.385.663 1.006.663 1.842l.002 3.818s.009.11-.096.135c0 0-.153.043-.291.075-.14.032-.642.135-1.052.204q-.63.105-1.268.105c-.405 0-.777-.037-1.105-.112a2.3 2.3 0 0 1-.85-.369 1.7 1.7 0 0 1-.543-.652q-.192-.396-.193-.953c0-.363.077-.687.224-.963q.223-.413.606-.688a2.7 2.7 0 0 1 .87-.404q.49-.13 1.029-.131.394-.001.651.019m-1.66 2.933c-.003 0 .373.295 1.223.243a8.5 8.5 0 0 0 1.126-.15v-1.897s-.534-.087-1.133-.096c-.85-.01-1.212.302-1.21.302-.25.178-.372.441-.372.807q0 .352.126.544c.053.084.076.116.24.247m35.32-5.083c-.04.114-.242.686-.315.876-.027.072-.07.122-.152.113 0 0-.24-.055-.458-.055-.15 0-.366.019-.56.079s-.37.166-.514.31a1.54 1.54 0 0 0-.366.614c-.092.26-.139.677-.139 1.094v3.109a.126.126 0 0 1-.126.127h-1.095a.13.13 0 0 1-.13-.126v-6.225c0-.07.052-.126.122-.126h1.068c.071 0 .122.056.122.126v.509c.16-.215.446-.404.705-.52.26-.118.55-.205 1.076-.173.273.016.628.091.7.119a.113.113 0 0 1 .062.15M42.91 28.538c.03.011.109.05.077.145l-.32.876c-.027.066-.044.106-.18.065a1.9 1.9 0 0 0-.557-.087q-.249 0-.447.065a.85.85 0 0 0-.35.216 1.2 1.2 0 0 0-.293.446c-.154.44-.213.91-.22.94h1.334c.112 0 .148.053.136.136l-.155.867c-.026.126-.14.121-.14.121H40.42l-.94 5.32q-.12.718-.366 1.402c-.147.385-.3.666-.543.935-.209.24-.474.425-.771.537-.29.106-.64.16-1.024.16-.183 0-.38-.003-.612-.059a3 3 0 0 1-.382-.111c-.05-.019-.093-.084-.063-.167l.309-.848c.043-.108.151-.066.151-.066a1 1 0 0 0 .225.071c.1.02.233.037.335.037q.274.001.491-.07c.174-.057.276-.158.382-.294.11-.142.2-.335.292-.594.092-.262.176-.609.248-1.029l.936-5.223h-.921c-.11 0-.148-.052-.136-.135l.154-.868c.025-.126.142-.121.142-.121h.946l.051-.282c.142-.838.423-1.475.839-1.893.418-.421 1.013-.634 1.767-.634a3.3 3.3 0 0 1 .98.142m-18.643 9.024c0 .07-.05.127-.12.127h-1.106c-.071 0-.12-.057-.12-.126v-8.909c0-.068.05-.125.119-.125h1.107c.07 0 .12.057.12.126z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sanity.svg b/web/packages/design/src/ResourceIcon/assets/sanity.svg
index a2be3a770acc6..8bcf19a327f08 100644
--- a/web/packages/design/src/ResourceIcon/assets/sanity.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sanity.svg
@@ -1,13 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11938)">
-<path d="M64.2857 0.00195312H7.71429C3.4538 0.00195312 0 3.45576 0 7.71624V64.2877C0 68.5481 3.4538 72.002 7.71429 72.002H64.2857C68.5462 72.002 72 68.5481 72 64.2877V7.71624C72 3.45576 68.5462 0.00195312 64.2857 0.00195312Z" fill="#F03E2F"/>
-<path d="M22.1658 18.645C22.1658 24.8422 26.0744 28.5193 33.8401 30.4736L42.0944 32.3507C49.4744 33.9964 53.9487 38.1365 53.9487 44.8736C54.002 47.8115 53.029 50.676 51.1972 52.9736C51.1972 46.2622 47.6744 42.6364 39.1372 40.4507L31.0372 38.6507C24.5572 37.185 19.543 33.7907 19.543 26.4879C19.508 23.6526 20.4323 20.8888 22.1658 18.645Z" fill="white"/>
-<path d="M46.1324 43.2017C49.6553 45.4388 51.1981 48.5245 51.1981 52.9731C48.2924 56.6245 43.1753 58.6817 37.1581 58.6817C27.0267 58.6817 19.9296 53.7959 18.3867 45.2845H28.1067C29.341 49.1931 32.6581 50.9931 37.1067 50.9931C42.5067 50.9931 46.081 48.1645 46.1581 43.2017" fill="white" fill-opacity="0.701961"/>
-<path d="M27.2321 27.8248C25.6403 26.8915 24.3296 25.5463 23.4381 23.9307C22.5466 22.3151 22.1073 20.489 22.1664 18.6448C24.995 15.0448 29.8807 12.8076 35.8464 12.8076C46.1321 12.8076 52.1236 18.1562 53.5893 25.6648H44.2293C43.2007 22.7076 40.6293 20.3933 35.9236 20.3933C30.8836 20.3933 27.4378 23.2733 27.2578 27.8505" fill="white" fill-opacity="0.701961"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11938">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_11938)"><path fill="#f03e2f" d="M64.286.002H7.714A7.714 7.714 0 0 0 0 7.716v56.572a7.714 7.714 0 0 0 7.714 7.714h56.572A7.714 7.714 0 0 0 72 64.288V7.716A7.714 7.714 0 0 0 64.286.002"/><path fill="#fff" d="M22.166 18.645c0 6.197 3.908 9.874 11.674 11.829l8.254 1.877c7.38 1.645 11.855 5.785 11.855 12.523a12.63 12.63 0 0 1-2.752 8.1c0-6.712-3.523-10.338-12.06-12.523l-8.1-1.8c-6.48-1.466-11.494-4.86-11.494-12.163-.035-2.835.89-5.6 2.623-7.843"/><path fill="#fff" fill-opacity=".702" d="M46.132 43.202c3.523 2.237 5.066 5.323 5.066 9.771-2.906 3.651-8.023 5.709-14.04 5.709-10.131 0-17.228-4.886-18.771-13.397h9.72c1.234 3.908 4.551 5.708 9 5.708 5.4 0 8.974-2.829 9.051-7.791M27.232 27.825a10.26 10.26 0 0 1-5.066-9.18c2.829-3.6 7.715-5.837 13.68-5.837 10.286 0 16.278 5.348 17.743 12.857h-9.36c-1.028-2.957-3.6-5.272-8.305-5.272-5.04 0-8.486 2.88-8.666 7.458"/></g><defs><clipPath id="clip0_16966_11938"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/scim-dark.svg b/web/packages/design/src/ResourceIcon/assets/scim-dark.svg
index 5209bf2337544..6b3dccee3d6aa 100644
--- a/web/packages/design/src/ResourceIcon/assets/scim-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/scim-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M6.83155 24.1325C3.83558 24.6251 1.59961 26.557 0.981665 29.1868C0.793902 29.9857 0.787563 32.0823 0.970236 32.9442C1.23522 34.1944 2.02479 35.394 3.07646 36.1445C4.20938 36.9529 5.24684 37.3578 8.98724 38.4511C10.9825 39.0344 12.0394 39.6191 12.3223 40.2962C12.4912 40.7004 12.4905 41.5916 12.3211 41.9876C11.8049 43.194 9.87726 43.6558 7.50712 43.1408C6.26057 42.87 5.02383 42.2439 3.57137 41.1484L2.77248 40.5459L1.41127 42.2719C0.662515 43.2211 0.0284395 44.0539 0.00212371 44.1225C-0.0616489 44.2886 1.32425 45.4002 2.35191 46.0072C4.69843 47.3932 7.55648 48.0472 10.2475 47.8137C14.8378 47.4155 17.434 44.5943 17.2248 40.2318C17.1225 38.0964 16.4017 36.7037 14.8177 35.581C13.6725 34.7691 12.6505 34.3503 9.62246 33.4519C7.25049 32.7481 6.45948 32.4116 6.03218 31.925C5.23397 31.0159 5.48887 29.5228 6.54342 28.9312C7.45343 28.4208 8.98445 28.4092 10.4578 28.9015C11.4473 29.232 12.1033 29.5557 13.2478 30.2777L14.0902 30.8092L14.3146 30.4542C14.4381 30.2589 15.0002 29.3933 15.5639 28.5305L16.5888 26.9619L16.3306 26.7538C15.2616 25.8922 13.5367 24.9577 12.3381 24.5909C10.6963 24.0884 8.30888 23.8897 6.83155 24.1325ZM29.1168 24.1024C25.0666 24.6545 21.7968 27.2234 20.2001 31.1077C18.9515 34.1452 18.948 37.9051 20.191 40.9876C21.6956 44.719 24.8928 47.2781 28.8005 47.8789C30.1844 48.0917 32.2396 48.0087 33.4867 47.6896C34.484 47.4344 35.2101 47.1389 35.9071 46.7045L36.3585 46.423L35.0981 44.4865L33.8375 42.5499L33.4899 42.7272C32.5238 43.2201 30.6576 43.428 29.4713 43.1748C28.2619 42.9167 27.4085 42.4368 26.4606 41.482C25.7701 40.7862 25.5552 40.4917 25.1912 39.7417C24.5635 38.4487 24.3298 37.401 24.3366 35.9098C24.3433 34.4539 24.5475 33.5737 25.1746 32.2997C25.946 30.7322 27.2968 29.521 28.8087 29.0409C30.2031 28.5981 31.5201 28.6327 32.9563 29.1502C33.3272 29.2839 33.6956 29.4128 33.7749 29.4367C33.8757 29.4671 34.2876 28.9139 35.1483 27.592L36.3777 25.7039L36.1567 25.4626C35.8151 25.0893 34.4288 24.482 33.4518 24.2777C32.4178 24.0614 30.1039 23.9678 29.1168 24.1024ZM39.5375 36.0059V48.0112H40.8517C42.9752 48.0112 43.7235 47.6773 44.3331 46.4574C44.5851 45.9529 44.6277 45.761 44.6277 45.1306C44.6277 44.7253 44.5772 44.142 44.5155 43.8344C44.4051 43.2852 44.4077 43.2712 44.6604 43.0539C44.8972 42.8501 45.108 42.4661 45.108 42.238C45.108 42.1862 44.9973 42.0332 44.862 41.8979C44.7268 41.7627 44.6296 41.644 44.6459 41.6342C45.6552 41.0313 45.7216 40.8715 45.3482 39.9439C44.9239 38.8901 45.0968 38.4902 46.2398 37.8812C47.1469 37.3978 47.4596 36.5596 47.0066 35.8251C46.8889 35.634 46.2991 34.8077 45.696 33.989C44.104 31.8274 44.0135 31.5567 44.5521 30.569C45.0363 29.6807 44.9982 29.1513 44.3039 27.1219C43.7566 25.5226 43.4915 24.94 43.0252 24.3126L42.7931 24.0005H41.1653H39.5375V36.0059ZM50.0061 36.0059V48.0112H52.4066H54.8071L54.8317 40.1406L54.8563 32.2699L57.8755 37.1173C59.5361 39.7833 60.9407 41.9499 60.9969 41.9319C61.0531 41.9139 62.4605 39.7145 64.1245 37.0444L67.1498 32.1897L67.1744 40.1005L67.199 48.0112H69.5995H72V36.0059V24.0005L69.3828 24.001L66.7657 24.0014L63.8914 28.8963C61.4696 33.0206 61 33.7651 60.9086 33.6259C60.8488 33.5351 59.5511 31.3322 58.0246 28.7306L55.2493 24.0005H52.6277H50.0061V36.0059Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M6.832 24.133c-2.996.492-5.232 2.424-5.85 5.054-.188.799-.194 2.895-.012 3.757.265 1.25 1.055 2.45 2.106 3.2 1.133.809 2.17 1.214 5.911 2.307 1.995.583 3.052 1.168 3.335 1.845.17.404.169 1.296 0 1.692-.517 1.206-2.445 1.668-4.815 1.153-1.246-.271-2.483-.897-3.936-1.993l-.799-.602-1.36 1.726c-.75.95-1.384 1.782-1.41 1.85-.064.167 1.322 1.278 2.35 1.885 2.346 1.386 5.204 2.04 7.896 1.807 4.59-.398 7.186-3.22 6.977-7.582-.103-2.136-.823-3.528-2.407-4.651-1.146-.812-2.168-1.23-5.196-2.13-2.372-.703-3.163-1.04-3.59-1.526-.798-.91-.543-2.402.511-2.994.91-.51 2.441-.522 3.915-.03.99.331 1.645.655 2.79 1.377l.842.531.225-.355c.123-.195.685-1.06 1.249-1.924l1.025-1.568-.258-.208c-1.07-.862-2.794-1.796-3.993-2.163-1.642-.503-4.03-.701-5.506-.459m22.285-.03c-4.05.551-7.32 3.12-8.917 7.005-1.248 3.037-1.252 6.797-.009 9.88 1.505 3.731 4.702 6.29 8.61 6.89 1.383.214 3.439.13 4.686-.188.997-.256 1.723-.551 2.42-.985l.452-.282-1.26-1.937-1.261-1.936-.348.177c-.966.493-2.832.701-4.019.448-1.21-.258-2.062-.738-3.01-1.693-.69-.696-.906-.99-1.27-1.74-.627-1.293-.861-2.341-.854-3.832.006-1.456.21-2.336.838-3.61.771-1.568 2.122-2.779 3.634-3.26 1.394-.442 2.711-.407 4.147.11.371.134.74.263.819.287.1.03.513-.523 1.373-1.845l1.23-1.888-.221-.241c-.342-.374-1.728-.981-2.705-1.185-1.034-.217-3.348-.31-4.335-.176m10.42 11.903V48.01h1.315c2.123 0 2.872-.334 3.481-1.554.252-.504.295-.696.295-1.326 0-.406-.05-.989-.112-1.297-.11-.549-.108-.563.144-.78.237-.204.448-.588.448-.816 0-.052-.11-.205-.246-.34-.135-.135-.232-.254-.216-.264 1.01-.603 1.076-.763.702-1.69-.424-1.054-.251-1.454.892-2.063.907-.483 1.22-1.321.767-2.056-.118-.191-.708-1.017-1.311-1.836-1.592-2.162-1.682-2.432-1.144-3.42.484-.888.446-1.418-.248-3.447-.547-1.6-.812-2.182-1.279-2.81L42.793 24h-3.255zm10.47 0V48.01h4.8l.025-7.87.024-7.871 3.02 4.847c1.66 2.666 3.065 4.833 3.12 4.815.057-.018 1.465-2.218 3.128-4.888l3.026-4.854.024 7.91.025 7.911H72V24l-2.617.001h-2.617l-2.875 4.895c-2.421 4.125-2.891 4.87-2.982 4.73-.06-.09-1.358-2.294-2.884-4.895L55.249 24h-5.243z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/scim-light.svg b/web/packages/design/src/ResourceIcon/assets/scim-light.svg
index 0ffbf679bf43d..0a2152e25f410 100644
--- a/web/packages/design/src/ResourceIcon/assets/scim-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/scim-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M6.83155 24.1325C3.83558 24.6251 1.59961 26.557 0.981665 29.1868C0.793902 29.9857 0.787563 32.0823 0.970236 32.9442C1.23522 34.1944 2.02479 35.394 3.07646 36.1445C4.20938 36.9529 5.24684 37.3578 8.98724 38.4511C10.9825 39.0344 12.0394 39.6191 12.3223 40.2962C12.4912 40.7004 12.4905 41.5916 12.3211 41.9876C11.8049 43.194 9.87726 43.6558 7.50712 43.1408C6.26057 42.87 5.02383 42.2439 3.57137 41.1484L2.77248 40.5459L1.41127 42.2719C0.662515 43.2211 0.0284395 44.0539 0.00212371 44.1225C-0.0616489 44.2886 1.32425 45.4002 2.35191 46.0072C4.69843 47.3932 7.55648 48.0472 10.2475 47.8137C14.8378 47.4155 17.434 44.5943 17.2248 40.2318C17.1225 38.0964 16.4017 36.7037 14.8177 35.581C13.6725 34.7691 12.6505 34.3503 9.62246 33.4519C7.25049 32.7481 6.45948 32.4116 6.03218 31.925C5.23397 31.0159 5.48887 29.5228 6.54342 28.9312C7.45343 28.4208 8.98445 28.4092 10.4578 28.9015C11.4473 29.232 12.1033 29.5557 13.2478 30.2777L14.0902 30.8092L14.3146 30.4542C14.4381 30.2589 15.0002 29.3933 15.5639 28.5305L16.5888 26.9619L16.3306 26.7538C15.2616 25.8922 13.5367 24.9577 12.3381 24.5909C10.6963 24.0884 8.30888 23.8897 6.83155 24.1325ZM29.1168 24.1024C25.0666 24.6545 21.7968 27.2234 20.2001 31.1077C18.9515 34.1452 18.948 37.9051 20.191 40.9876C21.6956 44.719 24.8928 47.2781 28.8005 47.8789C30.1844 48.0917 32.2396 48.0087 33.4867 47.6896C34.484 47.4344 35.2101 47.1389 35.9071 46.7045L36.3585 46.423L35.0981 44.4865L33.8375 42.5499L33.4899 42.7272C32.5238 43.2201 30.6576 43.428 29.4713 43.1748C28.2619 42.9167 27.4085 42.4368 26.4606 41.482C25.7701 40.7862 25.5552 40.4917 25.1912 39.7417C24.5635 38.4487 24.3298 37.401 24.3366 35.9098C24.3433 34.4539 24.5475 33.5737 25.1746 32.2997C25.946 30.7322 27.2968 29.521 28.8087 29.0409C30.2031 28.5981 31.5201 28.6327 32.9563 29.1502C33.3272 29.2839 33.6956 29.4128 33.7749 29.4367C33.8757 29.4671 34.2876 28.9139 35.1483 27.592L36.3777 25.7039L36.1567 25.4626C35.8151 25.0893 34.4288 24.482 33.4518 24.2777C32.4178 24.0614 30.1039 23.9678 29.1168 24.1024ZM39.5375 36.0059V48.0112H40.8517C42.9752 48.0112 43.7235 47.6773 44.3331 46.4574C44.5851 45.9529 44.6277 45.761 44.6277 45.1306C44.6277 44.7253 44.5772 44.142 44.5155 43.8344C44.4051 43.2852 44.4077 43.2712 44.6604 43.0539C44.8972 42.8501 45.108 42.4661 45.108 42.238C45.108 42.1862 44.9973 42.0332 44.862 41.8979C44.7268 41.7627 44.6296 41.644 44.6459 41.6342C45.6552 41.0313 45.7216 40.8715 45.3482 39.9439C44.9239 38.8901 45.0968 38.4902 46.2398 37.8812C47.1469 37.3978 47.4596 36.5596 47.0066 35.8251C46.8889 35.634 46.2991 34.8077 45.696 33.989C44.104 31.8274 44.0135 31.5567 44.5521 30.569C45.0363 29.6807 44.9982 29.1513 44.3039 27.1219C43.7566 25.5226 43.4915 24.94 43.0252 24.3126L42.7931 24.0005H41.1653H39.5375V36.0059ZM50.0061 36.0059V48.0112H52.4066H54.8071L54.8317 40.1406L54.8563 32.2699L57.8755 37.1173C59.5361 39.7833 60.9407 41.9499 60.9969 41.9319C61.0531 41.9139 62.4605 39.7145 64.1245 37.0444L67.1498 32.1897L67.1744 40.1005L67.199 48.0112H69.5995H72V36.0059V24.0005L69.3828 24.001L66.7657 24.0014L63.8914 28.8963C61.4696 33.0206 61 33.7651 60.9086 33.6259C60.8488 33.5351 59.5511 31.3322 58.0246 28.7306L55.2493 24.0005H52.6277H50.0061V36.0059Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M6.832 24.133c-2.996.492-5.232 2.424-5.85 5.054-.188.799-.194 2.895-.012 3.757.265 1.25 1.055 2.45 2.106 3.2 1.133.809 2.17 1.214 5.911 2.307 1.995.583 3.052 1.168 3.335 1.845.17.404.169 1.296 0 1.692-.517 1.206-2.445 1.668-4.815 1.153-1.246-.271-2.483-.897-3.936-1.993l-.799-.602-1.36 1.726c-.75.95-1.384 1.782-1.41 1.85-.064.167 1.322 1.278 2.35 1.885 2.346 1.386 5.204 2.04 7.896 1.807 4.59-.398 7.186-3.22 6.977-7.582-.103-2.136-.823-3.528-2.407-4.651-1.146-.812-2.168-1.23-5.196-2.13-2.372-.703-3.163-1.04-3.59-1.526-.798-.91-.543-2.402.511-2.994.91-.51 2.441-.522 3.915-.03.99.331 1.645.655 2.79 1.377l.842.531.225-.355c.123-.195.685-1.06 1.249-1.924l1.025-1.568-.258-.208c-1.07-.862-2.794-1.796-3.993-2.163-1.642-.503-4.03-.701-5.506-.459m22.285-.03c-4.05.551-7.32 3.12-8.917 7.005-1.248 3.037-1.252 6.797-.009 9.88 1.505 3.731 4.702 6.29 8.61 6.89 1.383.214 3.439.13 4.686-.188.997-.256 1.723-.551 2.42-.985l.452-.282-1.26-1.937-1.261-1.936-.348.177c-.966.493-2.832.701-4.019.448-1.21-.258-2.062-.738-3.01-1.693-.69-.696-.906-.99-1.27-1.74-.627-1.293-.861-2.341-.854-3.832.006-1.456.21-2.336.838-3.61.771-1.568 2.122-2.779 3.634-3.26 1.394-.442 2.711-.407 4.147.11.371.134.74.263.819.287.1.03.513-.523 1.373-1.845l1.23-1.888-.221-.241c-.342-.374-1.728-.981-2.705-1.185-1.034-.217-3.348-.31-4.335-.176m10.42 11.903V48.01h1.315c2.123 0 2.872-.334 3.481-1.554.252-.504.295-.696.295-1.326 0-.406-.05-.989-.112-1.297-.11-.549-.108-.563.144-.78.237-.204.448-.588.448-.816 0-.052-.11-.205-.246-.34-.135-.135-.232-.254-.216-.264 1.01-.603 1.076-.763.702-1.69-.424-1.054-.251-1.454.892-2.063.907-.483 1.22-1.321.767-2.056-.118-.191-.708-1.017-1.311-1.836-1.592-2.162-1.682-2.432-1.144-3.42.484-.888.446-1.418-.248-3.447-.547-1.6-.812-2.182-1.279-2.81L42.793 24h-3.255zm10.47 0V48.01h4.8l.025-7.87.024-7.871 3.02 4.847c1.66 2.666 3.065 4.833 3.12 4.815.057-.018 1.465-2.218 3.128-4.888l3.026-4.854.024 7.91.025 7.911H72V24l-2.617.001h-2.617l-2.875 4.895c-2.421 4.125-2.891 4.87-2.982 4.73-.06-.09-1.358-2.294-2.884-4.895L55.249 24h-5.243z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/securecodewarrior-dark.svg b/web/packages/design/src/ResourceIcon/assets/securecodewarrior-dark.svg
index b6d7083f39339..fc225e0ef2235 100644
--- a/web/packages/design/src/ResourceIcon/assets/securecodewarrior-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/securecodewarrior-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11949)">
-<path d="M9 36.172V14.8022C9 14.8022 12.4959 10.1448 17.9241 6.56609C26.8594 0.676928 35.9411 0.00195312 36 0.00195312C36.0788 0.00195312 45.1618 0.70505 54.0788 6.5914C59.4507 10.1378 62.9719 14.8036 62.9719 14.8036V24.0774H54.7792V17.886C47.7126 10.2827 38.0559 8.58398 36 8.29571C33.9721 8.58398 24.2311 10.3403 17.1928 17.886V25.2305L13.673 27.9375H63.0001V41.5889C62.9888 48.4622 59.2243 54.7606 53.955 60.0002C45.8537 68.0548 36.0126 72.002 35.9719 72.002C29.9475 69.2291 23.2242 65.2634 17.9972 60.3404C12.742 55.3877 9 49.4704 9 42.8248V40.0308H19.1363L17.1942 42.8248C17.1942 48.0714 21.967 52.9678 27.0253 56.9303C29.8153 59.1155 35.9859 63.2724 35.9733 63.2724C36.0408 63.2724 43.4939 58.1748 45.0394 56.9359C49.4874 53.3643 54.8087 47.8057 54.8087 41.586V39.3978L58.7221 36.172H9Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11949">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_11949)"><path fill="#fff" d="M9 36.172v-21.37s3.496-4.657 8.924-8.236C26.86.676 35.941.002 36 .002c.079 0 9.162.703 18.079 6.59 5.372 3.546 8.893 8.212 8.893 8.212v9.273h-8.193v-6.191C47.713 10.283 38.056 8.584 36 8.296c-2.028.288-11.769 2.044-18.807 9.59v7.345l-3.52 2.706H63V41.59c-.01 6.872-3.776 13.17-9.045 18.41-8.101 8.055-17.942 12.002-17.983 12.002-6.024-2.773-12.748-6.739-17.975-11.662C12.742 55.388 9 49.47 9 42.825V40.03h10.136l-1.942 2.794c0 5.246 4.773 10.143 9.831 14.105 2.79 2.185 8.96 6.342 8.948 6.342.068 0 7.52-5.097 9.066-6.336 4.448-3.572 9.77-9.13 9.77-15.35v-2.188l3.913-3.226z"/></g><defs><clipPath id="clip0_16966_11949"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/securecodewarrior-light.svg b/web/packages/design/src/ResourceIcon/assets/securecodewarrior-light.svg
index a9d16b51a9587..4eacafa2d88df 100644
--- a/web/packages/design/src/ResourceIcon/assets/securecodewarrior-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/securecodewarrior-light.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11952)">
-<path d="M9 36.172V14.8022C9 14.8022 12.4959 10.1448 17.9241 6.56609C26.8594 0.676928 35.9411 0.00195312 36 0.00195312C36.0788 0.00195312 45.1618 0.70505 54.0788 6.5914C59.4507 10.1378 62.9719 14.8036 62.9719 14.8036V24.0774H54.7792V17.886C47.7126 10.2827 38.0559 8.58398 36 8.29571C33.9721 8.58398 24.2311 10.3403 17.1928 17.886V25.2305L13.673 27.9375H63.0001V41.5889C62.9888 48.4622 59.2243 54.7606 53.955 60.0002C45.8537 68.0548 36.0126 72.002 35.9719 72.002C29.9475 69.2291 23.2242 65.2634 17.9972 60.3404C12.742 55.3877 9 49.4704 9 42.8248V40.0308H19.1363L17.1942 42.8248C17.1942 48.0714 21.967 52.9678 27.0253 56.9303C29.8153 59.1155 35.9859 63.2724 35.9733 63.2724C36.0408 63.2724 43.4939 58.1748 45.0394 56.9359C49.4874 53.3643 54.8087 47.8057 54.8087 41.586V39.3978L58.7221 36.172H9Z" fill="#FFBE10"/>
-<path d="M35.9719 72.0019C29.9475 69.229 23.2242 65.2634 17.9972 60.3404C12.742 55.3877 9 49.4704 9 42.8248V40.0308H19.1363L17.1942 42.8248C17.1942 48.0714 21.967 52.9678 27.0253 56.9303C29.8153 59.1155 35.9859 63.2724 35.9733 63.2724L35.9719 72.0019Z" fill="#F69204"/>
-<path d="M9 36.172V14.8022C9 14.8022 12.4959 10.1448 17.9241 6.56609C26.8594 0.676928 35.9411 0.00195312 36 0.00195312V8.29571C36 8.29571 24.2311 10.3403 17.1928 17.886V25.2305L13.673 27.9375H36V36.172H9Z" fill="#F69204"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11952">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_11952)"><path fill="#ffbe10" d="M9 36.172v-21.37s3.496-4.657 8.924-8.236C26.86.676 35.941.002 36 .002c.079 0 9.162.703 18.079 6.59 5.372 3.546 8.893 8.212 8.893 8.212v9.273h-8.193v-6.191C47.713 10.283 38.056 8.584 36 8.296c-2.028.288-11.769 2.044-18.807 9.59v7.345l-3.52 2.706H63V41.59c-.01 6.872-3.776 13.17-9.045 18.41-8.101 8.055-17.942 12.002-17.983 12.002-6.024-2.773-12.748-6.739-17.975-11.662C12.742 55.388 9 49.47 9 42.825V40.03h10.136l-1.942 2.794c0 5.246 4.773 10.143 9.831 14.105 2.79 2.185 8.96 6.342 8.948 6.342.068 0 7.52-5.097 9.066-6.336 4.448-3.572 9.77-9.13 9.77-15.35v-2.188l3.913-3.226z"/><path fill="#f69204" d="M35.972 72.002c-6.024-2.773-12.748-6.739-17.975-11.662C12.742 55.388 9 49.47 9 42.825V40.03h10.136l-1.942 2.794c0 5.246 4.773 10.143 9.831 14.105 2.79 2.185 8.96 6.342 8.948 6.342zM9 36.172v-21.37s3.496-4.657 8.924-8.236C26.86.676 35.941.002 36 .002v8.294s-11.769 2.044-18.807 9.59v7.345l-3.52 2.706H36v8.235z"/></g><defs><clipPath id="clip0_16966_11952"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/semrush.svg b/web/packages/design/src/ResourceIcon/assets/semrush.svg
index 441f18bc09c47..88cc3d9b446f1 100644
--- a/web/packages/design/src/ResourceIcon/assets/semrush.svg
+++ b/web/packages/design/src/ResourceIcon/assets/semrush.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M62.0897 35.7186C62.0897 37.0597 61.4177 37.2665 59.7148 37.2665C57.9084 37.2665 57.5983 36.9565 57.3917 35.6152C57.0297 32.1578 54.7065 29.2143 50.7865 28.9069C49.5488 28.8035 49.2387 28.3383 49.2387 26.7904C49.2387 25.3459 49.4454 24.674 50.5798 24.674C57.3917 24.674 62.0897 30.1446 62.0897 35.7186ZM72 35.7186C72 25.3459 64.9813 14.4019 48.7735 14.4019H16.5561C15.906 14.4019 15.5034 14.7419 15.5034 15.3349C15.5034 15.6587 15.7455 15.9497 15.9658 16.1211C17.1465 17.0488 18.8657 18.0689 21.1727 19.2223C23.4088 20.3404 25.1362 21.0668 26.8908 21.7795C27.6145 22.0733 27.9028 22.3943 27.9028 22.8241C27.9028 23.3845 27.5083 23.7409 26.6922 23.7409H1.12079C0.364529 23.7409 0 24.2278 0 24.7202C0 25.1391 0.1469 25.4738 0.503268 25.8437C2.57891 28.0091 5.87871 30.6207 10.7019 33.6376C14.9294 36.2817 20.1525 39.1354 24.2956 41.1213C24.9921 41.4558 25.2341 41.8422 25.2179 42.2421C25.1987 42.7045 24.8342 43.0963 24.029 43.0963H12.3069C11.6405 43.0963 11.2705 43.4472 11.2705 43.9858C11.2705 44.285 11.5126 44.6659 11.8282 44.9543C14.4941 47.3726 18.7569 50.0169 24.4371 52.4352C32.0133 55.6617 39.7256 57.6012 48.3871 57.6012C64.8019 57.6012 72 45.3188 72 35.7186ZM50.5798 50.4276C42.5275 50.4276 35.8191 43.8716 35.8191 35.7186C35.8191 27.6664 42.5275 21.2164 50.5798 21.2164C58.8388 21.2164 65.2888 27.6691 65.2888 35.7186C65.2888 43.8716 58.8388 50.4276 50.5798 50.4276Z" fill="#FF642D"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff642d" d="M62.09 35.719c0 1.34-.672 1.547-2.375 1.547-1.807 0-2.117-.31-2.323-1.65-.362-3.458-2.686-6.402-6.606-6.71-1.237-.102-1.547-.568-1.547-2.116 0-1.444.206-2.116 1.34-2.116 6.813 0 11.51 5.47 11.51 11.045m9.91 0c0-10.373-7.019-21.317-23.226-21.317H16.555c-.65 0-1.053.34-1.053.933 0 .324.242.615.463.786 1.18.928 2.9 1.948 5.207 3.101 2.236 1.118 3.963 1.845 5.718 2.557.724.294 1.012.615 1.012 1.045 0 .56-.395.917-1.21.917H1.12c-.756 0-1.121.487-1.121.98 0 .418.147.753.503 1.123 2.076 2.165 5.376 4.777 10.199 7.794 4.227 2.644 9.45 5.497 13.594 7.483.696.335.938.721.922 1.121-.02.463-.384.854-1.189.854H12.307c-.667 0-1.037.351-1.037.89 0 .299.243.68.558.968 2.666 2.419 6.929 5.063 12.61 7.481 7.575 3.227 15.288 5.166 23.95 5.166C64.801 57.601 72 45.32 72 35.72M50.58 50.428c-8.052 0-14.76-6.556-14.76-14.71 0-8.052 6.708-14.502 14.76-14.502 8.259 0 14.709 6.453 14.709 14.503 0 8.153-6.45 14.709-14.71 14.709"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sendgrid.svg b/web/packages/design/src/ResourceIcon/assets/sendgrid.svg
index 386fc2cc5b9d3..59065dbcd53ac 100644
--- a/web/packages/design/src/ResourceIcon/assets/sendgrid.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sendgrid.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11984)">
-<path d="M44.8167 48.3401C46.8849 48.3401 48.554 50.0094 48.554 52.0775V68.2633C48.554 70.3317 46.8849 72.0009 44.8167 72.0009H3.73717C1.66907 72.0009 0 70.3317 0 68.2633V27.1758C0 25.1077 1.66907 23.4385 3.73717 23.4385H19.9218C21.9899 23.4385 23.659 25.1077 23.659 27.1758V45.8532C23.659 47.2208 24.7783 48.3451 26.1504 48.3451H44.8266L44.8167 48.3401Z" fill="#51A9E3"/>
-<path d="M27.1735 23.6616H45.8496C47.2171 23.6616 48.3412 24.781 48.3412 26.1534V44.8308C48.3412 46.8989 50.0103 48.5682 52.0782 48.5682H68.263C70.3309 48.5682 72 46.8989 72 44.8308V3.7384C72 1.67015 70.3309 0.000976562 68.263 0.000976562H27.1735C25.1055 0.000976562 23.4364 1.67015 23.4364 3.7384V19.9243C23.4364 21.9926 25.1055 23.6616 27.1735 23.6616Z" fill="#51A9E3"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11984">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000976562)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#51a9e3" clip-path="url(#clip0_16966_11984)"><path d="M44.817 48.34a3.73 3.73 0 0 1 3.737 3.737v16.186a3.73 3.73 0 0 1-3.737 3.738H3.737A3.73 3.73 0 0 1 0 68.263V27.176a3.73 3.73 0 0 1 3.737-3.737h16.185a3.73 3.73 0 0 1 3.737 3.737v18.677a2.5 2.5 0 0 0 2.491 2.492h18.677zM27.174 23.662H45.85a2.5 2.5 0 0 1 2.491 2.491v18.678a3.73 3.73 0 0 0 3.737 3.737h16.185A3.73 3.73 0 0 0 72 44.831V3.738A3.73 3.73 0 0 0 68.263.001h-41.09a3.73 3.73 0 0 0-3.737 3.737v16.186a3.73 3.73 0 0 0 3.738 3.738"/></g><defs><clipPath id="clip0_16966_11984"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sentry-dark.svg b/web/packages/design/src/ResourceIcon/assets/sentry-dark.svg
index 260c63c622347..a79de6e41690e 100644
--- a/web/packages/design/src/ResourceIcon/assets/sentry-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sentry-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M41.7284 6.77953C41.1296 5.78565 40.284 4.96343 39.2737 4.39267C38.2634 3.82191 37.1228 3.52197 35.9624 3.52197C34.802 3.52197 33.6614 3.82191 32.6511 4.39267C31.6408 4.96343 30.7953 5.78565 30.1964 6.77953L20.7113 23.0252C27.9575 26.643 34.1314 32.0932 38.6199 38.8348C43.1084 45.5764 45.7553 53.3748 46.298 61.4557H39.6382C39.0966 54.5288 36.7556 47.8635 32.8469 42.1192C28.9382 36.375 23.5972 31.751 17.3526 28.7048L8.57388 43.8838C12.0844 45.4582 15.1428 47.89 17.4677 50.9554C19.7926 54.0209 21.3096 57.6218 21.8789 61.4268H6.58461C6.40322 61.414 6.22788 61.3562 6.0744 61.2587C5.92092 61.1612 5.79413 61.027 5.70546 60.8683C5.61678 60.7095 5.56902 60.5312 5.56648 60.3494C5.56393 60.1675 5.60668 59.9879 5.69088 59.8268L9.92889 52.6193C8.49307 51.4213 6.85209 50.4934 5.08545 49.8804L0.890681 57.0879C0.453984 57.837 0.170484 58.6653 0.0566491 59.5249C-0.0571858 60.3844 0.000913954 61.258 0.227573 62.0949C0.454233 62.9318 0.844933 63.7153 1.37698 64.3999C1.90902 65.0845 2.5718 65.6566 3.32682 66.0829C4.32159 66.6434 5.44282 66.941 6.58461 66.9478H27.5296C27.9186 62.1477 27.0614 57.3284 25.0411 52.9569C23.0207 48.5853 19.9056 44.8096 15.9976 41.9954L19.3275 36.2294C24.2595 39.6168 28.2229 44.2318 30.8267 49.6187C33.4304 55.0057 34.5845 60.9786 34.1749 66.9478H51.9198C52.3331 57.9052 50.3658 48.9126 46.2148 40.8685C42.0637 32.8244 35.8742 26.0106 28.2648 21.108L34.9966 9.57604C35.1466 9.32471 35.3898 9.1428 35.6733 9.06991C35.9567 8.99701 36.2575 9.03904 36.5102 9.18683C37.2742 9.60487 65.7582 59.3078 66.2916 59.8844C66.3855 60.0529 66.4334 60.2432 66.4302 60.4361C66.427 60.629 66.3729 60.8176 66.2735 60.9829C66.174 61.1482 66.0326 61.2843 65.8637 61.3774C65.6948 61.4706 65.5042 61.5174 65.3114 61.5133H58.4498C58.5363 63.3488 58.5363 65.1795 58.4498 67.0054H65.3402C66.2152 67.0112 67.0825 66.8433 67.8922 66.5116C68.7018 66.1798 69.4376 65.6908 70.057 65.0727C70.6764 64.4547 71.167 63.72 71.5005 62.911C71.834 62.1021 72.0038 61.2351 71.9999 60.3601C72.0008 59.2044 71.6922 58.0696 71.1062 57.0735L41.7284 6.77953Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M41.728 6.78a6.73 6.73 0 0 0-11.532 0l-9.485 16.245a46.43 46.43 0 0 1 25.587 38.43h-6.66a39.9 39.9 0 0 0-22.285-32.75l-8.78 15.179A22.95 22.95 0 0 1 21.88 61.427H6.585a1.095 1.095 0 0 1-.894-1.6l4.238-7.208a15.5 15.5 0 0 0-4.844-2.739L.891 57.088a6.545 6.545 0 0 0 2.436 8.995c.995.56 2.116.858 3.258.865H27.53a27.97 27.97 0 0 0-11.532-24.953l3.33-5.766a34.41 34.41 0 0 1 14.847 30.719H51.92a51.72 51.72 0 0 0-23.655-45.84l6.732-11.532a1.11 1.11 0 0 1 1.513-.39c.764.419 29.248 50.122 29.782 50.698a1.096 1.096 0 0 1-.98 1.63H58.45a58 58 0 0 1 0 5.491h6.89A6.616 6.616 0 0 0 72 60.36c0-1.156-.308-2.29-.894-3.286z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sentry-light.svg b/web/packages/design/src/ResourceIcon/assets/sentry-light.svg
index 1cee84bd3a00f..0da27c9bf42c1 100644
--- a/web/packages/design/src/ResourceIcon/assets/sentry-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sentry-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M41.7284 6.77953C41.1296 5.78565 40.284 4.96343 39.2737 4.39267C38.2634 3.82191 37.1228 3.52197 35.9624 3.52197C34.802 3.52197 33.6614 3.82191 32.6511 4.39267C31.6408 4.96343 30.7953 5.78565 30.1964 6.77953L20.7113 23.0252C27.9575 26.643 34.1314 32.0932 38.6199 38.8348C43.1084 45.5764 45.7553 53.3748 46.298 61.4557H39.6382C39.0966 54.5288 36.7556 47.8635 32.8469 42.1192C28.9382 36.375 23.5972 31.751 17.3526 28.7048L8.57388 43.8838C12.0844 45.4582 15.1428 47.89 17.4677 50.9554C19.7926 54.0209 21.3096 57.6218 21.8789 61.4268H6.58461C6.40322 61.414 6.22788 61.3562 6.0744 61.2587C5.92092 61.1612 5.79413 61.027 5.70546 60.8683C5.61678 60.7095 5.56902 60.5312 5.56648 60.3494C5.56393 60.1675 5.60668 59.9879 5.69088 59.8268L9.92889 52.6193C8.49307 51.4213 6.85209 50.4934 5.08545 49.8804L0.890681 57.0879C0.453984 57.837 0.170484 58.6653 0.0566491 59.5249C-0.0571858 60.3844 0.000913954 61.258 0.227573 62.0949C0.454233 62.9318 0.844933 63.7153 1.37698 64.3999C1.90902 65.0845 2.5718 65.6566 3.32682 66.0829C4.32159 66.6434 5.44282 66.941 6.58461 66.9478H27.5296C27.9186 62.1477 27.0614 57.3284 25.0411 52.9569C23.0207 48.5853 19.9056 44.8096 15.9976 41.9954L19.3275 36.2294C24.2595 39.6168 28.2229 44.2318 30.8267 49.6187C33.4304 55.0057 34.5845 60.9786 34.1749 66.9478H51.9198C52.3331 57.9052 50.3658 48.9126 46.2148 40.8685C42.0637 32.8244 35.8742 26.0106 28.2648 21.108L34.9966 9.57604C35.1466 9.32471 35.3898 9.1428 35.6733 9.06991C35.9567 8.99701 36.2575 9.03904 36.5102 9.18683C37.2742 9.60487 65.7582 59.3078 66.2916 59.8844C66.3855 60.0529 66.4334 60.2432 66.4302 60.4361C66.427 60.629 66.3729 60.8176 66.2735 60.9829C66.174 61.1482 66.0326 61.2843 65.8637 61.3774C65.6948 61.4706 65.5042 61.5174 65.3114 61.5133H58.4498C58.5363 63.3488 58.5363 65.1795 58.4498 67.0054H65.3402C66.2152 67.0112 67.0825 66.8433 67.8922 66.5116C68.7018 66.1798 69.4376 65.6908 70.057 65.0727C70.6764 64.4547 71.167 63.72 71.5005 62.911C71.834 62.1021 72.0038 61.2351 71.9999 60.3601C72.0008 59.2044 71.6922 58.0696 71.1062 57.0735L41.7284 6.77953Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M41.728 6.78a6.73 6.73 0 0 0-11.532 0l-9.485 16.245a46.43 46.43 0 0 1 25.587 38.43h-6.66a39.9 39.9 0 0 0-22.285-32.75l-8.78 15.179A22.95 22.95 0 0 1 21.88 61.427H6.585a1.095 1.095 0 0 1-.894-1.6l4.238-7.208a15.5 15.5 0 0 0-4.844-2.739L.891 57.088a6.545 6.545 0 0 0 2.436 8.995c.995.56 2.116.858 3.258.865H27.53a27.97 27.97 0 0 0-11.532-24.953l3.33-5.766a34.41 34.41 0 0 1 14.847 30.719H51.92a51.72 51.72 0 0 0-23.655-45.84l6.732-11.532a1.11 1.11 0 0 1 1.513-.39c.764.419 29.248 50.122 29.782 50.698a1.096 1.096 0 0 1-.98 1.63H58.45a58 58 0 0 1 0 5.491h6.89A6.616 6.616 0 0 0 72 60.36c0-1.156-.308-2.29-.894-3.286z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sequoia-dark.svg b/web/packages/design/src/ResourceIcon/assets/sequoia-dark.svg
index 7e95b087b8e1e..85c100f3e4553 100644
--- a/web/packages/design/src/ResourceIcon/assets/sequoia-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sequoia-dark.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_12008)">
-<path d="M53.999 0.00195312H71.9988V18.002H53.999V0.00195312Z" fill="#3CAB48"/>
-<path d="M8.99988 56.5122V0.00195312H0V65.604L8.99988 56.5122Z" fill="#3CAB48"/>
-<path d="M15.3095 63.002L6.30957 72.002H71.9994V63.002H15.3095Z" fill="#3CAB48"/>
-<path d="M27.0009 38.604V0.00195312H18.001V47.604L27.0009 38.604Z" fill="#3CAB48"/>
-<path d="M33.3072 45.0024L24.2764 54.0024H71.9973V45.0024H33.3072Z" fill="#3CAB48"/>
-<path d="M44.9676 20.6958V0.00195312H35.9678V29.604L44.9676 20.6958Z" fill="#3CAB48"/>
-<path d="M51.3097 27.0015L42.3408 36.0015H72.0002V27.0015H51.3097Z" fill="#3CAB48"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_12008">
-<rect width="72" height="72.0002" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#3cab48" clip-path="url(#clip0_16966_12008)"><path d="M53.999.002h18v18h-18zM9 56.512V.002H0v65.602zm6.31 6.49-9 9H72v-9zM27 38.604V.002h-8.999v47.602zm6.307 6.398-9.03 9h47.72v-9zm11.661-24.306V.002h-9v29.602zm6.342 6.306-8.97 9H72v-9z"/></g><defs><clipPath id="clip0_16966_12008"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sequoia-light.svg b/web/packages/design/src/ResourceIcon/assets/sequoia-light.svg
index faa49b981d8ee..6c0ac0e3113ec 100644
--- a/web/packages/design/src/ResourceIcon/assets/sequoia-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sequoia-light.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_12007)">
-<path d="M53.999 0.00195312H71.9988V18.002H53.999V0.00195312Z" fill="#007354"/>
-<path d="M8.99988 56.5122V0.00195312H0V65.604L8.99988 56.5122Z" fill="#007354"/>
-<path d="M15.3095 63.002L6.30957 72.002H71.9994V63.002H15.3095Z" fill="#007354"/>
-<path d="M27.0009 38.604V0.00195312H18.001V47.604L27.0009 38.604Z" fill="#007354"/>
-<path d="M33.3072 45.0024L24.2764 54.0024H71.9973V45.0024H33.3072Z" fill="#007354"/>
-<path d="M44.9676 20.6958V0.00195312H35.9678V29.604L44.9676 20.6958Z" fill="#007354"/>
-<path d="M51.3097 27.0015L42.3408 36.0015H72.0002V27.0015H51.3097Z" fill="#007354"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_12007">
-<rect width="72" height="72.0002" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#007354" clip-path="url(#clip0_16966_12007)"><path d="M53.999.002h18v18h-18zM9 56.512V.002H0v65.602zm6.31 6.49-9 9H72v-9zM27 38.604V.002h-8.999v47.602zm6.307 6.398-9.03 9h47.72v-9zm11.661-24.306V.002h-9v29.602zm6.342 6.306-8.97 9H72v-9z"/></g><defs><clipPath id="clip0_16966_12007"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/server.svg b/web/packages/design/src/ResourceIcon/assets/server.svg
index 2b93095759f8d..6524f5fb28d1b 100644
--- a/web/packages/design/src/ResourceIcon/assets/server.svg
+++ b/web/packages/design/src/ResourceIcon/assets/server.svg
@@ -1,146 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6722_31907)">
-<path d="M64.0601 46.2061L64.0405 52.2624C64.0405 52.4271 63.9325 52.5918 63.7163 52.7173L36.8112 68.3033C36.5753 68.4405 36.2551 68.5034 35.9446 68.4896L35.9485 62.4019C36.2668 62.4176 36.593 62.3548 36.8328 62.2156L63.7379 46.6276C63.8068 46.5885 63.8638 46.5453 63.9089 46.4982C63.9286 46.4805 63.9443 46.4609 63.96 46.4432C63.9973 46.3963 64.0248 46.3453 64.0425 46.2962C64.0464 46.2864 64.0503 46.2765 64.0523 46.2667C64.0523 46.2648 64.0523 46.2628 64.0523 46.2608C64.0523 46.2608 64.0523 46.2589 64.0523 46.2569C64.0523 46.2532 64.0542 46.2512 64.0542 46.2473C64.0542 46.2434 64.0542 46.2394 64.0562 46.2336C64.0601 46.2237 64.0601 46.2139 64.0621 46.2041L64.0601 46.2061Z" fill="#C9D7DD"/>
-<path d="M64.0602 46.1752V46.2047C64.0602 46.2164 64.0582 46.2263 64.0543 46.2361C64.0543 46.242 64.0543 46.2459 64.0523 46.2498C64.0523 46.2535 64.0503 46.2555 64.0503 46.2594C64.0503 46.2594 64.0503 46.2614 64.0503 46.2634C64.0503 46.2653 64.0503 46.2673 64.0503 46.2692C64.0484 46.2791 64.0445 46.2889 64.0405 46.2987C64.0229 46.3498 63.9954 46.3988 63.9581 46.4458C63.9423 46.4654 63.9266 46.4831 63.907 46.5007C63.8599 46.5479 63.8029 46.5891 63.7362 46.6301L36.8309 62.2181C36.5911 62.3573 36.2649 62.4202 35.9466 62.4044C35.6891 62.3927 35.4397 62.3298 35.2451 62.2181L8.17878 46.6009C8.16482 46.593 8.15108 46.5852 8.13929 46.5773C8.11966 46.5636 8.10002 46.5518 8.08235 46.538C8.07253 46.5302 8.06271 46.5223 8.05289 46.5145C8.03718 46.5007 8.01951 46.487 8.00577 46.4732C7.98809 46.4536 7.97042 46.4359 7.95471 46.4165C7.93704 46.393 7.91936 46.3694 7.90758 46.3458C7.89776 46.3301 7.88991 46.3124 7.88402 46.2967C7.87813 46.2869 7.87617 46.2771 7.87224 46.2653C7.86046 46.2341 7.85456 46.2027 7.8526 46.1713V46.1418C7.8526 46.1418 7.8526 46.1438 7.8526 46.1458C7.8526 45.9771 7.95864 45.8104 8.17682 45.683L35.0839 30.097C35.5202 29.844 36.2335 29.844 36.6716 30.097L63.7362 45.7124C63.9561 45.8399 64.0641 46.0066 64.0641 46.1752H64.0602Z" fill="white"/>
-<path d="M64.0602 46.1752V46.2047C64.0602 46.2164 64.0582 46.2263 64.0543 46.2361C64.0543 46.242 64.0543 46.2459 64.0523 46.2498C64.0523 46.2535 64.0503 46.2555 64.0503 46.2594C64.0503 46.2594 64.0503 46.2614 64.0503 46.2634C64.0503 46.2653 64.0503 46.2673 64.0503 46.2692C64.0484 46.2791 64.0445 46.2889 64.0405 46.2987C64.0229 46.3498 63.9954 46.3988 63.9581 46.4458C63.9423 46.4654 63.9266 46.4831 63.907 46.5007C63.8599 46.5479 63.8029 46.5891 63.7362 46.6301L36.8309 62.2181C36.5911 62.3573 36.2649 62.4202 35.9466 62.4044C35.6891 62.3927 35.4397 62.3298 35.2451 62.2181L8.17878 46.6009C8.16482 46.593 8.15108 46.5852 8.13929 46.5773C8.11966 46.5636 8.10002 46.5518 8.08235 46.538C8.07253 46.5302 8.06271 46.5223 8.05289 46.5145C8.03718 46.5007 8.01951 46.487 8.00577 46.4732C7.98809 46.4536 7.97042 46.4359 7.95471 46.4165C7.93704 46.393 7.91936 46.3694 7.90758 46.3458C7.89776 46.3301 7.88991 46.3124 7.88402 46.2967C7.87813 46.2869 7.87617 46.2771 7.87224 46.2653C7.86046 46.2341 7.85456 46.2027 7.8526 46.1713V46.1418C7.8526 46.1418 7.8526 46.1438 7.8526 46.1458C7.8526 45.9771 7.95864 45.8104 8.17682 45.683L35.0839 30.097C35.5202 29.844 36.2335 29.844 36.6716 30.097L63.7362 45.7124C63.9561 45.8399 64.0641 46.0066 64.0641 46.1752H64.0602Z" fill="url(#paint0_linear_6722_31907)"/>
-<path d="M35.9465 62.4041L35.9426 68.4918C35.6812 68.482 35.4238 68.4191 35.2235 68.3035L8.15695 52.688C7.93703 52.5606 7.82684 52.3939 7.82684 52.2252L7.8467 46.1689C7.85063 46.2004 7.85652 46.2318 7.86633 46.263C7.87026 46.2728 7.87419 46.2826 7.87812 46.2944C7.88401 46.3121 7.89186 46.3278 7.90168 46.3435C7.91543 46.3671 7.93114 46.3906 7.94881 46.4142C7.96452 46.4336 7.98219 46.4513 7.99986 46.4689C8.01361 46.4847 8.02932 46.4984 8.04699 46.5121C8.05681 46.52 8.06662 46.5279 8.07644 46.5357C8.09412 46.5495 8.11375 46.5612 8.13339 46.575C8.14517 46.5828 8.15892 46.5907 8.17288 46.5985L35.2372 62.2158C35.4316 62.3275 35.6832 62.3903 35.9387 62.4021L35.9465 62.4041Z" fill="#C9D7DD"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M64.0719 46.2238L64.0523 52.2801C64.0523 52.4449 63.9443 52.6096 63.7281 52.735L36.823 68.3211C36.5871 68.4583 36.2668 68.5211 35.9564 68.5094C35.695 68.4995 35.4375 68.4347 35.2372 68.3211L8.16873 52.7056C7.9488 52.5782 7.83884 52.4115 7.83884 52.2428L7.85847 46.1865C7.8624 46.2179 7.86829 46.2494 7.87811 46.2806C7.88204 46.2904 7.88596 46.3002 7.88989 46.31C7.89578 46.3277 7.90364 46.3434 7.91345 46.3591C7.9272 46.3827 7.94291 46.4062 7.96058 46.4298C7.97629 46.4492 7.99396 46.4669 8.01163 46.4846C8.02538 46.5003 8.04109 46.514 8.05876 46.5278C8.06858 46.5356 8.0784 46.5435 8.08822 46.5513C8.10589 46.5651 8.12553 46.5769 8.14516 46.5906C8.15694 46.5985 8.17069 46.6063 8.18465 46.6139L35.251 62.2314C35.4454 62.3431 35.6969 62.4079 35.9524 62.4197C36.2708 62.4354 36.5969 62.3726 36.8367 62.2334L63.7418 46.6454C63.8108 46.6063 63.8677 46.5631 63.9129 46.516C63.9325 46.4983 63.9482 46.4787 63.9639 46.461C64.0012 46.4141 64.0287 46.363 64.0464 46.3139L64.0562 46.2845C64.0562 46.2845 64.0562 46.2786 64.0562 46.2766C64.0562 46.2766 64.0562 46.2766 64.0562 46.2747C64.0562 46.2707 64.0582 46.2688 64.0582 46.2649C64.0582 46.2609 64.0601 46.257 64.0601 46.2513C64.0641 46.2415 64.0641 46.2317 64.066 46.2219L64.0719 46.2238Z" fill="url(#paint1_linear_6722_31907)"/>
-<path opacity="0.8" d="M29.7688 60.4584C29.8572 60.5094 29.9279 60.6329 29.9279 60.7331L29.9181 64.0337C29.9181 64.1339 29.8454 64.1749 29.7571 64.124C29.6687 64.073 29.5978 63.9495 29.5978 63.8494L29.6076 60.5487C29.6076 60.4486 29.6805 60.4075 29.7688 60.4584Z" fill="white"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M13.8298 51.2202C13.9182 51.271 13.9891 51.3947 13.9891 51.4947L13.9793 54.7955C13.9793 54.8955 13.9064 54.9367 13.8181 54.8857C13.7297 54.8346 13.659 54.7111 13.659 54.6112L13.6688 51.3103C13.6688 51.2104 13.7415 51.1691 13.8298 51.2202Z" fill="white"/>
-<path opacity="0.8" d="M14.938 51.8423C15.0266 51.8933 15.0973 52.0168 15.0973 52.117L15.0874 55.4176C15.0874 55.5175 15.0148 55.5588 14.9262 55.5077C14.8378 55.4569 14.7672 55.3332 14.7672 55.2332L14.777 51.9326C14.777 51.8324 14.8496 51.7912 14.938 51.8423Z" fill="white"/>
-<path opacity="0.8" d="M16.0444 52.4828C16.1327 52.5338 16.2034 52.6575 16.2034 52.7574L16.1936 56.0581C16.1936 56.1582 16.121 56.1995 16.0326 56.1484C15.944 56.0974 15.8733 55.9739 15.8733 55.8737L15.8831 52.5731C15.8831 52.4731 15.9558 52.4319 16.0444 52.4828Z" fill="white"/>
-<path opacity="0.8" d="M17.1525 53.1225C17.2409 53.1736 17.3116 53.2971 17.3116 53.397L17.3018 56.6979C17.3018 56.7978 17.2291 56.839 17.1407 56.788C17.0524 56.7372 16.9815 56.6134 16.9815 56.5135L16.9913 53.2126C16.9913 53.1127 17.0642 53.0715 17.1525 53.1225Z" fill="white"/>
-<path opacity="0.8" d="M18.2587 53.7601C18.3471 53.8112 18.418 53.9347 18.418 54.0348L18.4082 57.3355C18.4082 57.4356 18.3353 57.4766 18.2469 57.4258C18.1585 57.3748 18.0879 57.2513 18.0879 57.1511L18.0977 53.8505C18.0977 53.7503 18.1703 53.7093 18.2587 53.7601Z" fill="white"/>
-<path opacity="0.8" d="M21.5794 55.6723C21.6678 55.7232 21.7385 55.8469 21.7385 55.9468L21.7287 59.2477C21.7287 59.3476 21.656 59.3888 21.5677 59.3378C21.4793 59.2867 21.4084 59.1633 21.4084 59.0633L21.4182 55.7625C21.4182 55.6625 21.4911 55.6213 21.5794 55.6723Z" fill="white"/>
-<path opacity="0.8" d="M22.6856 56.3071C22.774 56.3582 22.8449 56.4817 22.8449 56.5816L22.8351 59.8824C22.8351 59.9824 22.7622 60.0236 22.6738 59.9726C22.5855 59.9217 22.5148 59.798 22.5148 59.6981L22.5246 56.3974C22.5246 56.2973 22.5972 56.256 22.6856 56.3071Z" fill="white"/>
-<path opacity="0.8" d="M23.7938 56.9525C23.8823 57.0036 23.953 57.1271 23.953 57.2272L23.9432 60.5279C23.9432 60.628 23.8706 60.6692 23.782 60.6182C23.6936 60.5671 23.6229 60.4436 23.6229 60.3435L23.6327 57.0428C23.6327 56.9427 23.7054 56.9017 23.7938 56.9525Z" fill="white"/>
-<path opacity="0.8" d="M24.9001 57.5942C24.9885 57.6453 25.0592 57.7688 25.0592 57.8687L25.0494 61.1696C25.0494 61.2695 24.9767 61.3107 24.8884 61.2597C24.7998 61.2088 24.7291 61.0851 24.7291 60.9852L24.7389 57.6843C24.7389 57.5844 24.8116 57.5432 24.9001 57.5942Z" fill="white"/>
-<path opacity="0.8" d="M30.8753 61.0599C30.9637 61.111 31.0346 61.2345 31.0346 61.3346L31.0248 64.6353C31.0248 64.7354 30.9519 64.7767 30.8635 64.7256C30.7752 64.6746 30.7045 64.5511 30.7045 64.4509L30.7143 61.1503C30.7143 61.0501 30.7869 61.0091 30.8753 61.0599Z" fill="white"/>
-</g>
-<path d="M11.0657 51.9566C11.4008 51.7624 11.3999 51.1373 11.0641 50.5602C10.7284 49.9833 10.1844 49.6733 9.84953 49.8675C9.51462 50.0619 9.51528 50.687 9.85106 51.2638C10.1871 51.8407 10.7308 52.151 11.0657 51.9566Z" fill="white"/>
-</g>
-<path d="M64.0601 37.4063L64.0405 43.4626C64.0405 43.6273 63.9325 43.792 63.7163 43.9177L36.8112 59.5035C36.5753 59.6407 36.2551 59.7036 35.9446 59.6898L35.9485 53.6021C36.2668 53.6178 36.593 53.5552 36.8328 53.4158L63.7379 37.828C63.8068 37.7887 63.8638 37.7455 63.9089 37.6986C63.9286 37.681 63.9443 37.6613 63.96 37.6436C63.9973 37.5965 64.0248 37.5455 64.0425 37.4966C64.0464 37.4868 64.0503 37.477 64.0523 37.4671C64.0523 37.4652 64.0523 37.4632 64.0523 37.4612C64.0523 37.4612 64.0523 37.4593 64.0523 37.4573C64.0523 37.4534 64.0542 37.4514 64.0542 37.4475C64.0542 37.4436 64.0542 37.4396 64.0562 37.4338C64.0601 37.4239 64.0601 37.4141 64.0621 37.4043L64.0601 37.4063Z" fill="#C9D7DD"/>
-<path d="M64.0602 37.3753V37.4048C64.0602 37.4166 64.0582 37.4264 64.0543 37.4362C64.0543 37.4421 64.0543 37.446 64.0523 37.4499C64.0523 37.4539 64.0503 37.4558 64.0503 37.4598C64.0503 37.4598 64.0503 37.4617 64.0503 37.4637C64.0503 37.4656 64.0503 37.4676 64.0503 37.4696C64.0484 37.4794 64.0445 37.4892 64.0405 37.499C64.0229 37.5499 63.9954 37.599 63.9581 37.6461C63.9423 37.6657 63.9266 37.6834 63.907 37.7008C63.8599 37.748 63.8029 37.7892 63.7362 37.8304L36.8309 53.4182C36.5911 53.5576 36.2649 53.6203 35.9466 53.6046C35.6891 53.5928 35.4397 53.5302 35.2451 53.4182L8.17878 37.801C8.16482 37.7931 8.15108 37.7853 8.13929 37.7774C8.11966 37.7637 8.10002 37.7519 8.08235 37.7382C8.07253 37.7303 8.06271 37.7224 8.05289 37.7146C8.03718 37.7008 8.01951 37.6873 8.00577 37.6736C7.98809 37.6539 7.97042 37.6363 7.95471 37.6166C7.93704 37.5931 7.91936 37.5695 7.90758 37.5459C7.89776 37.5302 7.88991 37.5128 7.88402 37.4971C7.87813 37.4872 7.87617 37.4774 7.87224 37.4656C7.86046 37.4342 7.85456 37.4028 7.8526 37.3714V37.3422C7.8526 37.3422 7.8526 37.3439 7.8526 37.3459C7.8526 37.1772 7.95864 37.0105 8.17682 36.8831L35.0799 21.2972C35.5163 21.0442 36.2295 21.0442 36.6677 21.2972L63.7322 36.9126C63.9522 37.04 64.0602 37.2067 64.0602 37.3753Z" fill="white"/>
-<path d="M64.0602 37.3753V37.4048C64.0602 37.4166 64.0582 37.4264 64.0543 37.4362C64.0543 37.4421 64.0543 37.446 64.0523 37.4499C64.0523 37.4539 64.0503 37.4558 64.0503 37.4598C64.0503 37.4598 64.0503 37.4617 64.0503 37.4637C64.0503 37.4656 64.0503 37.4676 64.0503 37.4696C64.0484 37.4794 64.0445 37.4892 64.0405 37.499C64.0229 37.5499 63.9954 37.599 63.9581 37.6461C63.9423 37.6657 63.9266 37.6834 63.907 37.7008C63.8599 37.748 63.8029 37.7892 63.7362 37.8304L36.8309 53.4182C36.5911 53.5576 36.2649 53.6203 35.9466 53.6046C35.6891 53.5928 35.4397 53.5302 35.2451 53.4182L8.17878 37.801C8.16482 37.7931 8.15108 37.7853 8.13929 37.7774C8.11966 37.7637 8.10002 37.7519 8.08235 37.7382C8.07253 37.7303 8.06271 37.7224 8.05289 37.7146C8.03718 37.7008 8.01951 37.6873 8.00577 37.6736C7.98809 37.6539 7.97042 37.6363 7.95471 37.6166C7.93704 37.5931 7.91936 37.5695 7.90758 37.5459C7.89776 37.5302 7.88991 37.5128 7.88402 37.4971C7.87813 37.4872 7.87617 37.4774 7.87224 37.4656C7.86046 37.4342 7.85456 37.4028 7.8526 37.3714V37.3422C7.8526 37.3422 7.8526 37.3439 7.8526 37.3459C7.8526 37.1772 7.95864 37.0105 8.17682 36.8831L35.0799 21.2972C35.5163 21.0442 36.2295 21.0442 36.6677 21.2972L63.7322 36.9126C63.9522 37.04 64.0602 37.2067 64.0602 37.3753Z" fill="url(#paint2_linear_6722_31907)"/>
-<path d="M35.9465 53.6043L35.9426 59.692C35.6812 59.6822 35.4238 59.6195 35.2235 59.5037L8.15695 43.8884C7.93703 43.761 7.82684 43.5941 7.82684 43.4254L7.8467 37.3691C7.85063 37.4006 7.85652 37.432 7.86633 37.4634C7.87026 37.4732 7.87419 37.483 7.87812 37.4948C7.88401 37.5125 7.89186 37.528 7.90168 37.5437C7.91543 37.5673 7.93114 37.5908 7.94881 37.6144C7.96452 37.634 7.98219 37.6517 7.99986 37.6694C8.01361 37.6851 8.02932 37.6988 8.04699 37.7123C8.05681 37.7202 8.06662 37.728 8.07644 37.7359C8.09412 37.7496 8.11375 37.7614 8.13339 37.7752C8.14517 37.783 8.15892 37.7909 8.17288 37.7987L35.2372 53.416C35.4316 53.5279 35.6832 53.5905 35.9387 53.6023L35.9465 53.6043Z" fill="#C9D7DD"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M64.0719 37.3507L64.0523 43.4069C64.0523 43.5717 63.9443 43.7366 63.7281 43.8621L36.823 59.4479C36.5871 59.5853 36.2668 59.648 35.9564 59.6362C35.695 59.6264 35.4375 59.5618 35.2372 59.4479L8.16873 43.8326C7.9488 43.7052 7.83884 43.5385 7.83884 43.3699L7.85847 37.3135C7.8624 37.3449 7.86829 37.3762 7.87811 37.4076C7.88204 37.4174 7.88596 37.4272 7.88989 37.437C7.89578 37.4547 7.90364 37.4704 7.91345 37.4861C7.9272 37.5096 7.94291 37.5331 7.96058 37.5567C7.97629 37.5763 7.99396 37.5939 8.01163 37.6116C8.02538 37.6273 8.04109 37.641 8.05876 37.6547C8.06858 37.6626 8.0784 37.6704 8.08822 37.6783C8.10589 37.692 8.12553 37.7038 8.14516 37.7175C8.15694 37.7253 8.17069 37.7332 8.18465 37.741L35.251 53.3584C35.4454 53.4701 35.6969 53.5349 35.9524 53.5467C36.2708 53.5622 36.5969 53.4996 36.8367 53.3604L63.7418 37.7724C63.8108 37.7332 63.8677 37.69 63.9129 37.643C63.9325 37.6253 63.9482 37.6057 63.9639 37.5881C64.0012 37.541 64.0287 37.49 64.0464 37.441L64.0562 37.4115C64.0562 37.4115 64.0562 37.4057 64.0562 37.4037C64.0562 37.4037 64.0562 37.4037 64.0562 37.4017C64.0562 37.3978 64.0582 37.3958 64.0582 37.3919C64.0582 37.388 64.0601 37.3841 64.0601 37.3782C64.0641 37.3684 64.0641 37.3586 64.066 37.3488L64.0719 37.3507Z" fill="url(#paint3_linear_6722_31907)"/>
-<path opacity="0.8" d="M29.7688 51.5121C29.8572 51.5631 29.9279 51.6866 29.9279 51.7868L29.9181 55.0874C29.9181 55.1876 29.8454 55.2286 29.7571 55.1778C29.6687 55.1267 29.5978 55.0032 29.5978 54.9031L29.6076 51.6024C29.6076 51.5023 29.6805 51.4612 29.7688 51.5121Z" fill="white"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M13.8298 42.4936C13.9182 42.5445 13.9891 42.6682 13.9891 42.7681L13.9793 46.069C13.9793 46.1689 13.9064 46.2101 13.8181 46.1591C13.7297 46.108 13.659 45.9845 13.659 45.8846L13.6688 42.5837C13.6688 42.4838 13.7415 42.4426 13.8298 42.4936Z" fill="white"/>
-<path opacity="0.8" d="M14.938 43.1157C15.0266 43.1668 15.0973 43.2902 15.0973 43.3904L15.0874 46.691C15.0874 46.791 15.0148 46.8322 14.9262 46.7812C14.8378 46.7303 14.7672 46.6066 14.7672 46.5067L14.777 43.206C14.777 43.1059 14.8496 43.0646 14.938 43.1157Z" fill="white"/>
-<path opacity="0.8" d="M16.0444 43.7562C16.1327 43.8072 16.2034 43.931 16.2034 44.0309L16.1936 47.3315C16.1936 47.4317 16.121 47.4729 16.0326 47.4219C15.944 47.3708 15.8733 47.2473 15.8733 47.1472L15.8831 43.8465C15.8831 43.7466 15.9558 43.7054 16.0444 43.7562Z" fill="white"/>
-<path opacity="0.8" d="M17.1525 44.396C17.2409 44.447 17.3116 44.5705 17.3116 44.6704L17.3018 47.9713C17.3018 48.0712 17.2291 48.1125 17.1407 48.0614C17.0524 48.0106 16.9815 47.8869 16.9815 47.787L16.9913 44.4861C16.9913 44.3862 17.0642 44.3449 17.1525 44.396Z" fill="white"/>
-<path opacity="0.8" d="M18.2587 45.0336C18.3471 45.0846 18.418 45.2081 18.418 45.3083L18.4082 48.6089C18.4082 48.7091 18.3353 48.7501 18.2469 48.6992C18.1585 48.6482 18.0879 48.5247 18.0879 48.4246L18.0977 45.1239C18.0977 45.0238 18.1703 44.9827 18.2587 45.0336Z" fill="white"/>
-<path opacity="0.8" d="M21.5794 46.9458C21.6678 46.9966 21.7385 47.1203 21.7385 47.2203L21.7287 50.5211C21.7287 50.6211 21.656 50.6623 21.5677 50.6112C21.4793 50.5602 21.4084 50.4367 21.4084 50.3368L21.4182 47.0359C21.4182 46.936 21.4911 46.8947 21.5794 46.9458Z" fill="white"/>
-<path opacity="0.8" d="M22.6856 47.5805C22.774 47.6316 22.8449 47.7551 22.8449 47.855L22.8351 51.1559C22.8351 51.2558 22.7622 51.297 22.6738 51.246C22.5855 51.1952 22.5148 51.0715 22.5148 50.9715L22.5246 47.6709C22.5246 47.5707 22.5972 47.5295 22.6856 47.5805Z" fill="white"/>
-<path opacity="0.8" d="M23.7938 48.226C23.8823 48.277 23.953 48.4005 23.953 48.5006L23.9432 51.8013C23.9432 51.9014 23.8706 51.9427 23.782 51.8916C23.6936 51.8406 23.6229 51.7171 23.6229 51.6169L23.6327 48.3163C23.6327 48.2161 23.7054 48.1751 23.7938 48.226Z" fill="white"/>
-<path opacity="0.8" d="M24.9001 48.8677C24.9885 48.9187 25.0592 49.0422 25.0592 49.1421L25.0494 52.443C25.0494 52.5429 24.9767 52.5842 24.8884 52.5331C24.7998 52.4823 24.7291 52.3586 24.7291 52.2586L24.7389 48.9578C24.7389 48.8578 24.8116 48.8166 24.9001 48.8677Z" fill="white"/>
-<path opacity="0.8" d="M30.8753 52.3334C30.9637 52.3844 31.0346 52.5079 31.0346 52.6081L31.0248 55.9087C31.0248 56.0089 30.9519 56.0501 30.8635 55.999C30.7752 55.948 30.7045 55.8245 30.7045 55.7244L30.7143 52.4237C30.7143 52.3236 30.7869 52.2825 30.8753 52.3334Z" fill="white"/>
-</g>
-<path d="M11.0657 43.229C11.4008 43.0349 11.3999 42.4098 11.0641 41.8327C10.7284 41.2558 10.1844 40.9458 9.84953 41.1399C9.51462 41.3343 9.51528 41.9594 9.85106 42.5363C10.1871 43.1132 10.7308 43.4234 11.0657 43.229Z" fill="white"/>
-</g>
-<path d="M64.0601 28.6065L64.0405 34.6629C64.0405 34.8276 63.9325 34.9923 63.7163 35.1178L36.8112 50.7038C36.5753 50.841 36.2551 50.9037 35.9446 50.8901L35.9485 44.8024C36.2668 44.8181 36.593 44.7553 36.8328 44.6161L63.7379 29.0281C63.8068 28.9889 63.8638 28.9457 63.9089 28.8987C63.9286 28.881 63.9443 28.8614 63.96 28.8438C63.9973 28.7967 64.0248 28.7457 64.0425 28.6967C64.0464 28.6869 64.0503 28.6771 64.0523 28.6672C64.0523 28.6653 64.0523 28.6633 64.0523 28.6614C64.0523 28.6614 64.0523 28.6594 64.0523 28.6574C64.0523 28.6535 64.0542 28.6516 64.0542 28.6476C64.0542 28.6437 64.0542 28.6398 64.0562 28.6339C64.0601 28.6241 64.0601 28.6143 64.0621 28.6045L64.0601 28.6065Z" fill="#C9D7DD"/>
-<path d="M64.0602 28.5746V28.604C64.0602 28.6158 64.0582 28.6256 64.0543 28.6354C64.0543 28.6413 64.0543 28.6452 64.0523 28.6491C64.0523 28.6531 64.0503 28.655 64.0503 28.659C64.0503 28.659 64.0503 28.6609 64.0503 28.6629C64.0503 28.6648 64.0503 28.6668 64.0503 28.6688C64.0484 28.6786 64.0445 28.6884 64.0405 28.6982C64.0229 28.7492 63.9954 28.7982 63.9581 28.8453C63.9423 28.8649 63.9266 28.8825 63.907 28.9002C63.8599 28.9473 63.8029 28.9884 63.7362 29.0296L36.8309 44.6176C36.5911 44.7568 36.2649 44.8196 35.9466 44.8039C35.6891 44.7921 35.4397 44.7293 35.2451 44.6176L8.17878 29.0002C8.16482 28.9924 8.15108 28.9845 8.13929 28.9767C8.11966 28.9629 8.10002 28.9512 8.08235 28.9374C8.07253 28.9296 8.06271 28.9218 8.05289 28.9139C8.03718 28.9002 8.01951 28.8865 8.00577 28.8727C7.98809 28.8531 7.97042 28.8355 7.95471 28.8158C7.93704 28.7923 7.91936 28.7688 7.90758 28.7452C7.89776 28.7296 7.88991 28.7119 7.88402 28.6962C7.87813 28.6864 7.87617 28.6766 7.87224 28.6648C7.86046 28.6334 7.85456 28.6021 7.8526 28.5707V28.5413C7.8526 28.5413 7.8526 28.5432 7.8526 28.5452C7.8526 28.3765 7.95864 28.2098 8.17682 28.0823L35.0799 12.4964C35.5163 12.2434 36.2295 12.2434 36.6677 12.4964L63.7322 28.1118C63.9522 28.2392 64.0602 28.4059 64.0602 28.5746Z" fill="white"/>
-<path d="M64.0602 28.5746V28.604C64.0602 28.6158 64.0582 28.6256 64.0543 28.6354C64.0543 28.6413 64.0543 28.6452 64.0523 28.6491C64.0523 28.6531 64.0503 28.655 64.0503 28.659C64.0503 28.659 64.0503 28.6609 64.0503 28.6629C64.0503 28.6648 64.0503 28.6668 64.0503 28.6688C64.0484 28.6786 64.0445 28.6884 64.0405 28.6982C64.0229 28.7492 63.9954 28.7982 63.9581 28.8453C63.9423 28.8649 63.9266 28.8825 63.907 28.9002C63.8599 28.9473 63.8029 28.9884 63.7362 29.0296L36.8309 44.6176C36.5911 44.7568 36.2649 44.8196 35.9466 44.8039C35.6891 44.7921 35.4397 44.7293 35.2451 44.6176L8.17878 29.0002C8.16482 28.9924 8.15108 28.9845 8.13929 28.9767C8.11966 28.9629 8.10002 28.9512 8.08235 28.9374C8.07253 28.9296 8.06271 28.9218 8.05289 28.9139C8.03718 28.9002 8.01951 28.8865 8.00577 28.8727C7.98809 28.8531 7.97042 28.8355 7.95471 28.8158C7.93704 28.7923 7.91936 28.7688 7.90758 28.7452C7.89776 28.7296 7.88991 28.7119 7.88402 28.6962C7.87813 28.6864 7.87617 28.6766 7.87224 28.6648C7.86046 28.6334 7.85456 28.6021 7.8526 28.5707V28.5413C7.8526 28.5413 7.8526 28.5432 7.8526 28.5452C7.8526 28.3765 7.95864 28.2098 8.17682 28.0823L35.0799 12.4964C35.5163 12.2434 36.2295 12.2434 36.6677 12.4964L63.7322 28.1118C63.9522 28.2392 64.0602 28.4059 64.0602 28.5746Z" fill="url(#paint4_linear_6722_31907)"/>
-<path d="M35.9465 44.8045L35.9426 50.892C35.6812 50.8824 35.4238 50.8196 35.2235 50.7039L8.15695 35.0885C7.93703 34.961 7.82684 34.7943 7.82684 34.6257L7.8467 28.5693C7.85063 28.6007 7.85652 28.6321 7.86633 28.6635C7.87026 28.6733 7.87419 28.6831 7.87812 28.6949C7.88401 28.7125 7.89186 28.7282 7.90168 28.7439C7.91543 28.7674 7.93114 28.791 7.94881 28.8145C7.96452 28.8341 7.98219 28.8518 7.99986 28.8694C8.01361 28.8851 8.02932 28.8988 8.04699 28.9126C8.05681 28.9204 8.06662 28.9282 8.07644 28.9361C8.09412 28.9498 8.11375 28.9616 8.13339 28.9753C8.14517 28.9832 8.15892 28.991 8.17288 28.9988L35.2372 44.6162C35.4316 44.7279 35.6832 44.7908 35.9387 44.8026L35.9465 44.8045Z" fill="#C9D7DD"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M64.0719 28.6242L64.0523 34.6804C64.0523 34.8451 63.9443 35.0101 63.7281 35.1355L36.823 50.7213C36.5871 50.8588 36.2668 50.9214 35.9564 50.9096C35.695 50.8998 35.4375 50.8352 35.2372 50.7213L8.16873 35.1061C7.9488 34.9786 7.83884 34.8119 7.83884 34.6433L7.85847 28.5869C7.8624 28.6183 7.86829 28.6497 7.87811 28.6811C7.88204 28.6909 7.88596 28.7007 7.88989 28.7105C7.89578 28.7281 7.90364 28.7438 7.91345 28.7595C7.9272 28.783 7.94291 28.8066 7.96058 28.8301C7.97629 28.8497 7.99396 28.8674 8.01163 28.885C8.02538 28.9007 8.04109 28.9144 8.05876 28.9282C8.06858 28.936 8.0784 28.9439 8.08822 28.9517C8.10589 28.9654 8.12553 28.9772 8.14516 28.9909C8.15694 28.9988 8.17069 29.0066 8.18465 29.0145L35.251 44.6319C35.4454 44.7436 35.6969 44.8084 35.9524 44.8202C36.2708 44.8357 36.5969 44.773 36.8367 44.6338L63.7418 29.0458C63.8108 29.0066 63.8677 28.9635 63.9129 28.9164C63.9325 28.8988 63.9482 28.8791 63.9639 28.8615C64.0012 28.8144 64.0287 28.7634 64.0464 28.7144L64.0562 28.685C64.0562 28.685 64.0562 28.6791 64.0562 28.6771C64.0562 28.6771 64.0562 28.6771 64.0562 28.6752C64.0562 28.6712 64.0582 28.6693 64.0582 28.6654C64.0582 28.6614 64.0601 28.6575 64.0601 28.6516C64.0641 28.6418 64.0641 28.632 64.066 28.6222L64.0719 28.6242Z" fill="url(#paint5_linear_6722_31907)"/>
-</g>
-<g opacity="0.8">
-<path opacity="0.8" d="M13.8297 33.7661C13.918 33.8169 13.989 33.9406 13.989 34.0406L13.9791 37.3414C13.9791 37.4414 13.9063 37.4826 13.8179 37.4315C13.7295 37.3805 13.6588 37.257 13.6588 37.1571L13.6687 33.8562C13.6687 33.7563 13.7413 33.715 13.8297 33.7661Z" fill="white"/>
-<path opacity="0.8" d="M14.9378 34.3882C15.0264 34.4392 15.0971 34.5627 15.0971 34.6628L15.0873 37.9635C15.0873 38.0634 15.0146 38.1047 14.9261 38.0536C14.8377 38.0028 14.767 37.8791 14.767 37.7791L14.7768 34.4785C14.7768 34.3783 14.8495 34.3371 14.9378 34.3882Z" fill="white"/>
-<path opacity="0.8" d="M16.0442 35.0286C16.1326 35.0797 16.2033 35.2034 16.2033 35.3033L16.1935 38.604C16.1935 38.7041 16.1208 38.7454 16.0324 38.6943C15.9439 38.6433 15.8732 38.5198 15.8732 38.4196L15.883 35.119C15.883 35.019 15.9556 34.9778 16.0442 35.0286Z" fill="white"/>
-<path opacity="0.8" d="M17.1524 35.6684C17.2407 35.7195 17.3114 35.843 17.3114 35.9429L17.3016 39.2438C17.3016 39.3437 17.229 39.3849 17.1406 39.3339C17.0522 39.2831 16.9813 39.1593 16.9813 39.0594L16.9911 35.7585C16.9911 35.6586 17.064 35.6174 17.1524 35.6684Z" fill="white"/>
-<path opacity="0.8" d="M18.2585 36.306C18.3469 36.3571 18.4178 36.4806 18.4178 36.5807L18.408 39.8814C18.408 39.9815 18.3351 40.0225 18.2468 39.9717C18.1584 39.9207 18.0877 39.7972 18.0877 39.697L18.0975 36.3964C18.0975 36.2962 18.1702 36.2552 18.2585 36.306Z" fill="white"/>
-<path opacity="0.8" d="M21.5793 38.2182C21.6677 38.2691 21.7383 38.3928 21.7383 38.4927L21.7285 41.7936C21.7285 41.8935 21.6559 41.9347 21.5675 41.8837C21.4791 41.8326 21.4082 41.7091 21.4082 41.6092L21.4181 38.3084C21.4181 38.2084 21.4909 38.1672 21.5793 38.2182Z" fill="white"/>
-<path opacity="0.8" d="M22.6855 38.853C22.7738 38.9041 22.8447 39.0275 22.8447 39.1275L22.8349 42.4283C22.8349 42.5283 22.762 42.5695 22.6737 42.5185C22.5853 42.4676 22.5146 42.3439 22.5146 42.244L22.5244 38.9433C22.5244 38.8432 22.5971 38.8019 22.6855 38.853Z" fill="white"/>
-<path opacity="0.8" d="M23.7936 39.4984C23.8822 39.5495 23.9529 39.673 23.9529 39.7731L23.9431 43.0738C23.9431 43.1739 23.8704 43.2151 23.7818 43.1641C23.6935 43.113 23.6228 42.9895 23.6228 42.8894L23.6326 39.5887C23.6326 39.4886 23.7052 39.4476 23.7936 39.4984Z" fill="white"/>
-<path opacity="0.8" d="M24.9 40.1401C24.9884 40.1912 25.0591 40.3147 25.0591 40.4146L25.0492 43.7155C25.0492 43.8154 24.9766 43.8566 24.8882 43.8056C24.7996 43.7547 24.7289 43.631 24.7289 43.5311L24.7388 40.2302C24.7388 40.1303 24.8114 40.0891 24.9 40.1401Z" fill="white"/>
-<path opacity="0.8" d="M30.8751 43.6058C30.9635 43.6569 31.0344 43.7804 31.0344 43.8805L31.0246 47.1812C31.0246 47.2813 30.9517 47.3226 30.8634 47.2715C30.775 47.2205 30.7043 47.097 30.7043 46.9968L30.7141 43.6962C30.7141 43.596 30.7868 43.555 30.8751 43.6058Z" fill="white"/>
-</g>
-<path d="M11.0657 34.5015C11.4009 34.3073 11.4 33.6822 11.0642 33.1051C10.7284 32.5283 10.1845 32.2182 9.84959 32.4124C9.51468 32.6068 9.51534 33.2319 9.85112 33.8088C10.1871 34.3856 10.7308 34.6959 11.0657 34.5015Z" fill="white"/>
-<path d="M64.0601 19.8067L64.0405 25.8629C64.0405 26.0277 63.9325 26.1924 63.7163 26.318L36.8112 41.9039C36.5753 42.0412 36.2551 42.104 35.9446 42.0903L35.9485 36.0026C36.2668 36.0183 36.593 35.9554 36.8328 35.8162L63.7379 20.2283C63.8068 20.1891 63.8638 20.1459 63.9089 20.0989C63.9286 20.0812 63.9443 20.0616 63.96 20.044C63.9973 19.9969 64.0248 19.9459 64.0425 19.8969C64.0464 19.8871 64.0503 19.8773 64.0523 19.8675C64.0523 19.8655 64.0523 19.8635 64.0523 19.8616C64.0523 19.8616 64.0523 19.8596 64.0523 19.8576C64.0523 19.8537 64.0542 19.8518 64.0542 19.8478C64.0542 19.8439 64.0542 19.84 64.0562 19.8341C64.0601 19.8243 64.0601 19.8145 64.0621 19.8047L64.0601 19.8067Z" fill="#C9D7DD"/>
-<path d="M64.0602 19.7748V19.8042C64.0602 19.816 64.0582 19.8258 64.0543 19.8356C64.0543 19.8415 64.0543 19.8454 64.0523 19.8493C64.0523 19.8533 64.0503 19.8552 64.0503 19.8591C64.0503 19.8591 64.0503 19.8611 64.0503 19.8631C64.0503 19.865 64.0503 19.867 64.0503 19.8689C64.0484 19.8787 64.0445 19.8886 64.0405 19.8984C64.0229 19.9493 63.9954 19.9984 63.9581 20.0455C63.9423 20.0651 63.9266 20.0827 63.907 20.1004C63.8599 20.1474 63.8029 20.1886 63.7362 20.2298L36.8309 35.8177C36.5911 35.9569 36.2649 36.0197 35.9466 36.004C35.6891 35.9923 35.4397 35.9294 35.2451 35.8177L8.17878 20.2004C8.16482 20.1926 8.15108 20.1847 8.13929 20.1769C8.11966 20.1631 8.10002 20.1514 8.08235 20.1376C8.07253 20.1298 8.06271 20.1219 8.05289 20.1141C8.03718 20.1004 8.01951 20.0866 8.00577 20.0729C7.98809 20.0533 7.97042 20.0357 7.95471 20.016C7.93704 19.9925 7.91936 19.969 7.90758 19.9454C7.89776 19.9297 7.88991 19.9121 7.88402 19.8964C7.87813 19.8866 7.87617 19.8768 7.87224 19.865C7.86046 19.8336 7.85456 19.8023 7.8526 19.7709V19.7415C7.8526 19.7415 7.8526 19.7434 7.8526 19.7454C7.8526 19.5767 7.95864 19.41 8.17682 19.2825L35.0799 3.69659C35.5163 3.44359 36.2295 3.44359 36.6677 3.69659L63.7322 19.3119C63.9522 19.4394 64.0602 19.6061 64.0602 19.7748Z" fill="white"/>
-<path d="M64.0602 19.7748V19.8042C64.0602 19.816 64.0582 19.8258 64.0543 19.8356C64.0543 19.8415 64.0543 19.8454 64.0523 19.8493C64.0523 19.8533 64.0503 19.8552 64.0503 19.8591C64.0503 19.8591 64.0503 19.8611 64.0503 19.8631C64.0503 19.865 64.0503 19.867 64.0503 19.8689C64.0484 19.8787 64.0445 19.8886 64.0405 19.8984C64.0229 19.9493 63.9954 19.9984 63.9581 20.0455C63.9423 20.0651 63.9266 20.0827 63.907 20.1004C63.8599 20.1474 63.8029 20.1886 63.7362 20.2298L36.8309 35.8177C36.5911 35.9569 36.2649 36.0197 35.9466 36.004C35.6891 35.9923 35.4397 35.9294 35.2451 35.8177L8.17878 20.2004C8.16482 20.1926 8.15108 20.1847 8.13929 20.1769C8.11966 20.1631 8.10002 20.1514 8.08235 20.1376C8.07253 20.1298 8.06271 20.1219 8.05289 20.1141C8.03718 20.1004 8.01951 20.0866 8.00577 20.0729C7.98809 20.0533 7.97042 20.0357 7.95471 20.016C7.93704 19.9925 7.91936 19.969 7.90758 19.9454C7.89776 19.9297 7.88991 19.9121 7.88402 19.8964C7.87813 19.8866 7.87617 19.8768 7.87224 19.865C7.86046 19.8336 7.85456 19.8023 7.8526 19.7709V19.7415C7.8526 19.7415 7.8526 19.7434 7.8526 19.7454C7.8526 19.5767 7.95864 19.41 8.17682 19.2825L35.0799 3.69659C35.5163 3.44359 36.2295 3.44359 36.6677 3.69659L63.7322 19.3119C63.9522 19.4394 64.0602 19.6061 64.0602 19.7748Z" fill="url(#paint6_linear_6722_31907)"/>
-<path d="M35.9465 36.0037L35.9426 42.0914C35.6812 42.0816 35.4238 42.0187 35.2235 41.9031L8.15695 26.2877C7.93703 26.1602 7.82684 25.9935 7.82684 25.8249L7.8467 19.7686C7.85063 19.7999 7.85652 19.8313 7.86633 19.8627C7.87026 19.8725 7.87419 19.8823 7.87812 19.8941C7.88401 19.9117 7.89186 19.9274 7.90168 19.9431C7.91543 19.9666 7.93114 19.9902 7.94881 20.0137C7.96452 20.0333 7.98219 20.051 7.99986 20.0686C8.01361 20.0843 8.02932 20.0981 8.04699 20.1118C8.05681 20.1196 8.06662 20.1275 8.07644 20.1353C8.09412 20.149 8.11375 20.1608 8.13339 20.1745C8.14517 20.1824 8.15892 20.1902 8.17288 20.1981L35.2372 35.8154C35.4316 35.9271 35.6832 35.9899 35.9387 36.0017L35.9465 36.0037Z" fill="#C9D7DD"/>
-<g opacity="0.9">
-<path opacity="0.9" d="M64.0719 19.8966L64.0523 25.9528C64.0523 26.1176 63.9443 26.2825 63.7281 26.408L36.823 41.9938C36.5871 42.1312 36.2668 42.1939 35.9564 42.1821C35.695 42.1723 35.4375 42.1077 35.2372 41.9938L8.16873 26.3785C7.9488 26.2511 7.83884 26.0844 7.83884 25.9158L7.85847 19.8594C7.8624 19.8907 7.86829 19.9221 7.87811 19.9535C7.88204 19.9633 7.88596 19.9731 7.88989 19.9829C7.89578 20.0006 7.90364 20.0163 7.91345 20.032C7.9272 20.0555 7.94291 20.079 7.96058 20.1026C7.97629 20.1222 7.99396 20.1398 8.01163 20.1575C8.02538 20.1732 8.04109 20.1869 8.05876 20.2006C8.06858 20.2085 8.0784 20.2163 8.08822 20.2242C8.10589 20.2379 8.12553 20.2497 8.14516 20.2634C8.15694 20.2712 8.17069 20.2791 8.18465 20.2869L35.251 35.9043C35.4454 36.016 35.6969 36.0808 35.9524 36.0926C36.2708 36.1081 36.5969 36.0455 36.8367 35.9063L63.7418 20.3183C63.8108 20.2791 63.8677 20.2359 63.9129 20.1889C63.9325 20.1712 63.9482 20.1516 63.9639 20.134C64.0012 20.0869 64.0287 20.0359 64.0464 19.9869L64.0562 19.9574C64.0562 19.9574 64.0562 19.9516 64.0562 19.9496C64.0562 19.9496 64.0562 19.9496 64.0562 19.9476C64.0562 19.9437 64.0582 19.9417 64.0582 19.9378C64.0582 19.9339 64.0601 19.93 64.0601 19.9241C64.0641 19.9143 64.0641 19.9045 64.066 19.8947L64.0719 19.8966Z" fill="url(#paint7_linear_6722_31907)"/>
-</g>
-<path d="M13.8297 24.9663C13.918 25.0172 13.989 25.1408 13.989 25.2408L13.9791 28.5416C13.9791 28.6416 13.9063 28.6828 13.8179 28.6318C13.7295 28.5808 13.6588 28.4572 13.6588 28.3572L13.6687 25.0565C13.6687 24.9565 13.7413 24.9153 13.8297 24.9663Z" fill="#6E17FF"/>
-<path d="M14.9378 25.5903C15.0264 25.6413 15.0971 25.7648 15.0971 25.8649L15.0873 29.1656C15.0873 29.2656 15.0146 29.3068 14.9261 29.2558C14.8377 29.2048 14.767 29.0813 14.767 28.9813L14.7768 25.6805C14.7768 25.5805 14.8495 25.5393 14.9378 25.5903Z" fill="#6E17FF"/>
-<path d="M17.1524 26.8686C17.2407 26.9196 17.3114 27.0432 17.3114 27.1432L17.3016 30.4439C17.3016 30.544 17.229 30.5851 17.1406 30.5342C17.0522 30.4831 16.9813 30.3596 16.9813 30.2596L16.9911 26.9588C16.9911 26.8588 17.064 26.8176 17.1524 26.8686Z" fill="#6E17FF"/>
-<path d="M20.4731 28.7807C20.5614 28.8317 20.6321 28.9553 20.6321 29.0553L20.6223 32.3559C20.6223 32.4561 20.5497 32.4973 20.4613 32.4463C20.3727 32.3952 20.302 32.2717 20.302 32.1716L20.3119 28.8709C20.3119 28.7709 20.3845 28.7297 20.4731 28.7807Z" fill="#6E17FF"/>
-<path d="M21.5793 29.4184C21.6677 29.4694 21.7383 29.593 21.7383 29.693L21.7285 32.9938C21.7285 33.0937 21.6559 33.1349 21.5675 33.0839C21.4791 33.033 21.4082 32.9093 21.4082 32.8094L21.4181 29.5086C21.4181 29.4086 21.4909 29.3674 21.5793 29.4184Z" fill="#6E17FF"/>
-<path d="M23.7936 30.7006C23.8822 30.7516 23.9529 30.8752 23.9529 30.9752L23.9431 34.276C23.9431 34.376 23.8704 34.4172 23.7818 34.3661C23.6935 34.3151 23.6228 34.1916 23.6228 34.0917L23.6326 30.7908C23.6326 30.6908 23.7052 30.6496 23.7936 30.7006Z" fill="#6E17FF"/>
-<path d="M24.9 31.3403C24.9884 31.3914 25.0591 31.5149 25.0591 31.615L25.0492 34.9157C25.0492 35.0158 24.9766 35.0568 24.8882 35.006C24.7996 34.9549 24.7289 34.8314 24.7289 34.7313L24.7388 31.4306C24.7388 31.3305 24.8114 31.2893 24.9 31.3403Z" fill="#6E17FF"/>
-<path d="M29.769 34.1664C29.8573 34.2174 29.928 34.3409 29.928 34.4411L29.9182 37.7417C29.9182 37.8419 29.8455 37.8829 29.7572 37.8321C29.6688 37.781 29.5979 37.6575 29.5979 37.5574L29.6077 34.2567C29.6077 34.1566 29.6806 34.1155 29.769 34.1664Z" fill="#6E17FF"/>
-<path d="M30.8751 34.8061C30.9635 34.857 31.0344 34.9807 31.0344 35.0806L31.0246 38.3815C31.0246 38.4814 30.9517 38.5226 30.8633 38.4716C30.775 38.4205 30.7043 38.297 30.7043 38.1971L30.7141 34.8962C30.7141 34.7963 30.7868 34.7551 30.8751 34.8061Z" fill="#6E17FF"/>
-<path d="M11.0682 25.7047C11.4031 25.5104 11.4024 24.8853 11.0664 24.3084C10.7306 23.7315 10.1869 23.4213 9.8518 23.6156C9.51689 23.8098 9.51777 24.435 9.85355 25.0119C10.1893 25.5888 10.7333 25.899 11.0682 25.7047Z" fill="#6E17FF"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_6722_31907" x1="9.0001" y1="58.6005" x2="64.5019" y2="25.5971" gradientUnits="userSpaceOnUse">
-<stop stop-color="#49879A" stop-opacity="0.38"/>
-<stop offset="0.4" stop-color="#154655" stop-opacity="0.552941"/>
-<stop offset="0.7" stop-color="#154655" stop-opacity="0.73"/>
-<stop offset="0.968638" stop-color="#154655" stop-opacity="0.85"/>
-</linearGradient>
-<linearGradient id="paint1_linear_6722_31907" x1="65.0838" y1="52.1721" x2="7.10902" y2="59.1662" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint2_linear_6722_31907" x1="9.00002" y1="49.8007" x2="64.4999" y2="16.8006" gradientUnits="userSpaceOnUse">
-<stop stop-color="#49879A" stop-opacity="0.38"/>
-<stop offset="0.4" stop-color="#154655" stop-opacity="0.552941"/>
-<stop offset="0.7" stop-color="#154655" stop-opacity="0.73"/>
-<stop offset="0.968638" stop-color="#154655" stop-opacity="0.85"/>
-</linearGradient>
-<linearGradient id="paint3_linear_6722_31907" x1="65.0838" y1="43.2992" x2="7.10902" y2="50.293" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint4_linear_6722_31907" x1="9.00002" y1="41" x2="64.5" y2="8.00001" gradientUnits="userSpaceOnUse">
-<stop stop-color="#49879A" stop-opacity="0.38"/>
-<stop offset="0.4" stop-color="#154655" stop-opacity="0.552941"/>
-<stop offset="0.7" stop-color="#154655" stop-opacity="0.73"/>
-<stop offset="0.968638" stop-color="#154655" stop-opacity="0.85"/>
-</linearGradient>
-<linearGradient id="paint5_linear_6722_31907" x1="65.0838" y1="34.5726" x2="7.10902" y2="41.5664" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<linearGradient id="paint6_linear_6722_31907" x1="1.18562" y1="39.9717" x2="71.7646" y2="-1.21498" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.4" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="0.5" stop-color="#4C7F8E" stop-opacity="0.12"/>
-<stop offset="0.7" stop-color="#4C7F8E" stop-opacity="0.33"/>
-<stop offset="0.88" stop-color="#4C7F8E" stop-opacity="0.45"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0.5"/>
-</linearGradient>
-<linearGradient id="paint7_linear_6722_31907" x1="65.0838" y1="25.8451" x2="7.10902" y2="32.8389" gradientUnits="userSpaceOnUse">
-<stop stop-color="#4C7F8E" stop-opacity="0.6"/>
-<stop offset="0.11" stop-color="#4C7F8E" stop-opacity="0.55"/>
-<stop offset="0.27" stop-color="#4C7F8E" stop-opacity="0.43"/>
-<stop offset="0.45" stop-color="#4C7F8E" stop-opacity="0.22"/>
-<stop offset="0.6" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<clipPath id="clip0_6722_31907">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6722_31907)"><path fill="#c9d7dd" d="m64.06 46.206-.02 6.056c0 .165-.108.33-.324.455L36.811 68.303c-.236.138-.556.2-.866.187l.004-6.088c.318.016.644-.047.884-.186l26.905-15.588a.7.7 0 0 0 .17-.13q.029-.027.052-.055a.5.5 0 0 0 .092-.176v-.01l.002-.01.002-.013q.005-.015.006-.03z"/><path fill="#fff" d="M64.06 46.175v.03a.1.1 0 0 1-.006.031q0 .008-.002.014l-.002.01v.009l-.01.03a.5.5 0 0 1-.133.202 1 1 0 0 1-.17.13L36.83 62.217c-.24.14-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 46.601l-.04-.024q-.03-.019-.057-.039l-.03-.023-.046-.042q-.028-.029-.051-.056a.5.5 0 0 1-.071-.12q-.008-.014-.012-.032a.3.3 0 0 1-.02-.094v-.03.005c0-.169.107-.336.325-.463l26.907-15.586c.436-.253 1.15-.253 1.588 0l27.064 15.615c.22.128.328.295.328.463z"/><path fill="url(#paint0_linear_6722_31907)" d="M64.06 46.175v.03a.1.1 0 0 1-.006.031q0 .008-.002.014l-.002.01v.009l-.01.03a.5.5 0 0 1-.133.202 1 1 0 0 1-.17.13L36.83 62.217c-.24.14-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 46.601l-.04-.024q-.03-.019-.057-.039l-.03-.023-.046-.042q-.028-.029-.051-.056a.5.5 0 0 1-.071-.12q-.008-.014-.012-.032a.3.3 0 0 1-.02-.094v-.03.005c0-.169.107-.336.325-.463l26.907-15.586c.436-.253 1.15-.253 1.588 0l27.064 15.615c.22.128.328.295.328.463z"/><path fill="#c9d7dd" d="m35.947 62.404-.004 6.088a1.6 1.6 0 0 1-.72-.189L8.158 52.689c-.22-.127-.33-.294-.33-.463l.02-6.056a.5.5 0 0 0 .031.125.2.2 0 0 0 .024.05q.02.035.047.07a.7.7 0 0 0 .098.098l.03.024.056.039.04.023 27.064 15.618c.195.111.446.174.702.186z"/><g opacity=".9"><path fill="url(#paint1_linear_6722_31907)" d="m64.072 46.224-.02 6.056c0 .165-.108.33-.324.455L36.823 68.321c-.236.137-.556.2-.867.188a1.6 1.6 0 0 1-.719-.188L8.17 52.706c-.22-.128-.33-.295-.33-.463l.02-6.056q.005.045.02.094l.01.029a.2.2 0 0 0 .024.05q.021.034.048.07a1 1 0 0 0 .098.098l.03.023.056.04.04.023L35.25 62.23c.194.112.446.177.701.189.319.015.645-.047.885-.187l26.905-15.588a.7.7 0 0 0 .17-.129q.029-.027.052-.055a.5.5 0 0 0 .082-.147l.01-.03v-.009l.002-.01.002-.014q.005-.015.006-.03z" opacity=".9"/><path fill="#fff" d="M29.769 60.458a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.16.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.072-.142.16-.09M13.83 51.22a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.074.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.072-.142.16-.09m1.109.621a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.161-.09m1.106.64a.35.35 0 0 1 .16.274l-.01 3.301c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.091m1.109.64a.35.35 0 0 1 .159.274l-.01 3.3c0 .1-.073.142-.161.091a.35.35 0 0 1-.16-.274l.01-3.301c0-.1.073-.142.162-.09m1.106.637a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.09m3.321 1.911a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.09m1.107.634a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.09m1.108.645a.35.35 0 0 1 .159.274l-.01 3.3c0 .101-.072.142-.161.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.073-.141.162-.09m1.106.641c.088.051.16.175.16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.161-.09m5.975 3.465a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.161-.091" opacity=".8"/><path fill="#fff" d="M11.066 51.957c.335-.195.334-.82-.002-1.397s-.88-.887-1.214-.693c-.335.195-.335.82.001 1.397s.88.887 1.215.693"/></g><path fill="#c9d7dd" d="m64.06 37.406-.02 6.057c0 .164-.108.329-.324.455L36.811 59.504c-.236.137-.556.2-.866.186l.004-6.088c.318.016.644-.047.884-.186l26.905-15.588a.8.8 0 0 0 .17-.13q.029-.027.052-.054a.5.5 0 0 0 .092-.177v-.01l.002-.01.002-.013q.005-.015.006-.03z"/><path fill="#fff" d="M64.06 37.375v.03a.1.1 0 0 1-.006.031q0 .008-.002.014l-.002.01v.01l-.01.029a.5.5 0 0 1-.133.202 1 1 0 0 1-.17.13L36.83 53.417c-.24.14-.566.202-.884.187a1.6 1.6 0 0 1-.702-.187L8.18 37.801l-.04-.024q-.03-.019-.057-.039l-.03-.023-.046-.041-.051-.057a.5.5 0 0 1-.071-.12q-.008-.015-.012-.031a.3.3 0 0 1-.02-.095v-.029.004c0-.169.107-.335.325-.463L35.08 21.297c.436-.253 1.15-.253 1.588 0l27.064 15.616c.22.127.328.294.328.462"/><path fill="url(#paint2_linear_6722_31907)" d="M64.06 37.375v.03a.1.1 0 0 1-.006.031q0 .008-.002.014l-.002.01v.01l-.01.029a.5.5 0 0 1-.133.202 1 1 0 0 1-.17.13L36.83 53.417c-.24.14-.566.202-.884.187a1.6 1.6 0 0 1-.702-.187L8.18 37.801l-.04-.024q-.03-.019-.057-.039l-.03-.023-.046-.041-.051-.057a.5.5 0 0 1-.071-.12q-.008-.015-.012-.031a.3.3 0 0 1-.02-.095v-.029.004c0-.169.107-.335.325-.463L35.08 21.297c.436-.253 1.15-.253 1.588 0l27.064 15.616c.22.127.328.294.328.462"/><path fill="#c9d7dd" d="m35.947 53.604-.004 6.088a1.6 1.6 0 0 1-.72-.188L8.158 43.888c-.22-.127-.33-.294-.33-.463l.02-6.056a.5.5 0 0 0 .031.126 1 1 0 0 0 .07.12q.025.029.052.054.021.024.047.043l.03.024.056.04.04.023 27.064 15.617c.195.112.446.175.702.186z"/><g opacity=".9"><path fill="url(#paint3_linear_6722_31907)" d="m64.072 37.35-.02 6.057c0 .165-.108.33-.324.455L36.823 59.448c-.236.137-.556.2-.867.188a1.6 1.6 0 0 1-.719-.188L8.17 43.833c-.22-.128-.33-.294-.33-.463l.02-6.056q.005.045.02.094l.01.029a.2.2 0 0 0 .024.05l.048.07q.023.029.05.055a.3.3 0 0 0 .048.043l.03.023.056.04.04.023L35.25 53.358c.194.112.446.177.701.189.319.015.645-.047.885-.187l26.905-15.588a.8.8 0 0 0 .17-.129q.029-.027.052-.055a.5.5 0 0 0 .082-.147l.01-.03v-.009l.002-.01.002-.014q.005-.015.006-.03z" opacity=".9"/><path fill="#fff" d="M29.769 51.512a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.16.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.072-.142.16-.09M13.83 42.494a.35.35 0 0 1 .16.274l-.01 3.301c0 .1-.074.141-.162.09a.35.35 0 0 1-.159-.274l.01-3.301c0-.1.072-.141.16-.09m1.109.622a.35.35 0 0 1 .16.274l-.01 3.301c0 .1-.073.141-.162.09a.35.35 0 0 1-.159-.274l.01-3.301c0-.1.073-.141.161-.09m1.106.64a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.09m1.109.639a.35.35 0 0 1 .159.274l-.01 3.301c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.091m1.106.638a.35.35 0 0 1 .159.274l-.01 3.3c0 .101-.073.142-.161.091a.35.35 0 0 1-.16-.274l.01-3.301c0-.1.073-.141.162-.09m3.321 1.912a.35.35 0 0 1 .159.274l-.01 3.301c0 .1-.073.141-.161.09a.35.35 0 0 1-.16-.274l.01-3.301c0-.1.073-.141.161-.09m1.107.634a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.073-.142.162-.09m1.108.645a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.072.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.091m1.106.642a.35.35 0 0 1 .16.274l-.01 3.301c0 .1-.073.141-.162.09a.35.35 0 0 1-.159-.274l.01-3.301c0-.1.073-.141.161-.09m5.975 3.465c.089.051.16.175.16.275l-.01 3.3c0 .1-.073.142-.162.091a.35.35 0 0 1-.159-.275l.01-3.3c0-.1.073-.142.161-.09" opacity=".8"/><path fill="#fff" d="M11.066 43.229c.335-.194.334-.82-.002-1.396-.336-.577-.88-.887-1.214-.693-.335.194-.335.82.001 1.396.336.577.88.887 1.215.693"/></g><path fill="#c9d7dd" d="m64.06 28.607-.02 6.056c0 .165-.108.33-.324.455L36.811 50.704c-.236.137-.556.2-.866.186l.004-6.088c.318.016.644-.047.884-.186l26.905-15.588a.8.8 0 0 0 .17-.13q.029-.027.052-.054a.5.5 0 0 0 .092-.177v-.01l.002-.01.002-.013q.005-.015.006-.03z"/><path fill="#fff" d="M64.06 28.575v.029a.1.1 0 0 1-.006.031q0 .009-.002.014l-.002.01v.01l-.01.03a.5.5 0 0 1-.133.201 1 1 0 0 1-.17.13L36.83 44.618c-.24.139-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 29l-.04-.023-.057-.04-.03-.023q-.024-.02-.046-.041l-.051-.057q-.029-.036-.047-.07a.3.3 0 0 1-.024-.05q-.008-.015-.012-.031a.3.3 0 0 1-.02-.094v-.03.004c0-.169.107-.335.325-.463L35.08 12.496c.436-.253 1.15-.253 1.588 0l27.064 15.616c.22.127.328.294.328.463"/><path fill="url(#paint4_linear_6722_31907)" d="M64.06 28.575v.029a.1.1 0 0 1-.006.031q0 .009-.002.014l-.002.01v.01l-.01.03a.5.5 0 0 1-.133.201 1 1 0 0 1-.17.13L36.83 44.618c-.24.139-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 29l-.04-.023-.057-.04-.03-.023q-.024-.02-.046-.041l-.051-.057q-.029-.036-.047-.07a.3.3 0 0 1-.024-.05q-.008-.015-.012-.031a.3.3 0 0 1-.02-.094v-.03.004c0-.169.107-.335.325-.463L35.08 12.496c.436-.253 1.15-.253 1.588 0l27.064 15.616c.22.127.328.294.328.463"/><path fill="#c9d7dd" d="m35.947 44.805-.004 6.087a1.6 1.6 0 0 1-.72-.188L8.158 35.089c-.22-.128-.33-.295-.33-.463l.02-6.057q.005.047.02.095l.011.03a1 1 0 0 0 .07.12.7.7 0 0 0 .099.099l.03.023.056.04.04.023 27.064 15.617c.195.112.446.175.702.187z"/><path fill="url(#paint5_linear_6722_31907)" d="m64.072 28.624-.02 6.056c0 .165-.108.33-.324.456L36.823 50.72c-.236.138-.556.2-.867.189a1.6 1.6 0 0 1-.719-.189L8.17 35.106c-.22-.127-.33-.294-.33-.463l.02-6.056q.005.047.02.094l.01.03a1 1 0 0 0 .07.12.7.7 0 0 0 .1.097l.03.024.056.039.04.024L35.25 44.632c.194.112.446.176.701.188.319.016.645-.047.885-.186l26.905-15.588a.8.8 0 0 0 .17-.13q.029-.027.052-.055a.5.5 0 0 0 .082-.147l.01-.029v-.01l.002-.01.002-.013q.005-.015.006-.03z" opacity=".9"/><path fill="#fff" d="M13.83 33.766c.088.05.159.175.159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.09m1.108.621a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.16-.09m1.107.64c.089.05.16.174.16.274l-.01 3.301c0 .1-.073.141-.162.09a.35.35 0 0 1-.159-.274l.01-3.301c0-.1.073-.141.161-.09m1.108.639a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.09m1.107.637a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.091m3.321 1.912a.35.35 0 0 1 .158.275l-.01 3.3c0 .1-.072.142-.16.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.09m1.107.634a.35.35 0 0 1 .159.274l-.01 3.301c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.091m1.108.645a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.073-.141.162-.09m1.106.641c.088.051.16.175.16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.09m5.975 3.465a.35.35 0 0 1 .16.274l-.01 3.301c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.101.073-.142.161-.091" opacity=".8"/><path fill="#fff" d="M11.066 34.502c.335-.195.334-.82-.002-1.397s-.88-.887-1.214-.693c-.335.195-.335.82.001 1.397s.88.887 1.215.693"/><path fill="#c9d7dd" d="m64.06 19.807-.02 6.056c0 .165-.108.33-.324.455L36.811 41.904c-.236.137-.556.2-.866.186l.004-6.087c.318.015.644-.048.884-.187l26.905-15.588a.8.8 0 0 0 .17-.13q.029-.026.052-.054a.5.5 0 0 0 .092-.177v-.009l.002-.01.002-.014q.005-.015.006-.03z"/><path fill="#fff" d="M64.06 19.775v.03a.1.1 0 0 1-.006.03q0 .009-.002.014l-.002.01v.01l-.01.03a.5.5 0 0 1-.133.201 1 1 0 0 1-.17.13L36.83 35.818c-.24.139-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 20.2l-.04-.023-.057-.04-.03-.023q-.024-.02-.046-.041-.028-.028-.051-.057-.029-.035-.047-.07a.3.3 0 0 1-.024-.05q-.008-.015-.012-.031a.3.3 0 0 1-.02-.094v-.03.004c0-.168.107-.335.325-.463L35.08 3.697c.436-.253 1.15-.253 1.588 0l27.064 15.615c.22.127.328.294.328.463"/><path fill="url(#paint6_linear_6722_31907)" d="M64.06 19.775v.03a.1.1 0 0 1-.006.03q0 .009-.002.014l-.002.01v.01l-.01.03a.5.5 0 0 1-.133.201 1 1 0 0 1-.17.13L36.83 35.818c-.24.139-.566.202-.884.186a1.6 1.6 0 0 1-.702-.186L8.18 20.2l-.04-.023-.057-.04-.03-.023q-.024-.02-.046-.041-.028-.028-.051-.057-.029-.035-.047-.07a.3.3 0 0 1-.024-.05q-.008-.015-.012-.031a.3.3 0 0 1-.02-.094v-.03.004c0-.168.107-.335.325-.463L35.08 3.697c.436-.253 1.15-.253 1.588 0l27.064 15.615c.22.127.328.294.328.463"/><path fill="#c9d7dd" d="m35.947 36.004-.004 6.087a1.6 1.6 0 0 1-.72-.188L8.158 26.288c-.22-.128-.33-.294-.33-.463l.02-6.056a.5.5 0 0 0 .031.125 1 1 0 0 0 .07.12.7.7 0 0 0 .099.098l.03.023.056.04.04.023 27.064 15.617c.195.112.446.175.702.187z"/><path fill="url(#paint7_linear_6722_31907)" d="m64.072 19.897-.02 6.056c0 .165-.108.33-.324.455L36.823 41.994c-.236.137-.556.2-.867.188a1.6 1.6 0 0 1-.719-.188L8.17 26.379c-.22-.128-.33-.295-.33-.463l.02-6.057q.005.048.02.094l.01.03a.2.2 0 0 0 .024.049l.048.07q.023.03.05.055a.3.3 0 0 0 .048.044l.03.023.056.04.04.023L35.25 35.904c.194.112.446.177.701.189.319.015.645-.048.885-.187l26.905-15.588a.8.8 0 0 0 .17-.13q.029-.026.052-.054a.5.5 0 0 0 .082-.147l.01-.03v-.009l.002-.01.002-.014q.005-.015.006-.03z" opacity=".9"/><path fill="#6e17ff" d="M13.83 24.966a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.073.142-.161.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.162-.09m1.108.623a.35.35 0 0 1 .16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.16-.09m2.215 1.278a.35.35 0 0 1 .16.274l-.01 3.3c0 .101-.073.142-.161.091a.35.35 0 0 1-.16-.274l.01-3.301c0-.1.073-.141.161-.09m3.321 1.911a.35.35 0 0 1 .16.275l-.01 3.3c0 .101-.073.142-.162.091a.35.35 0 0 1-.159-.274l.01-3.301c0-.1.072-.141.161-.09m1.107.637a.35.35 0 0 1 .158.275l-.01 3.3c0 .1-.072.142-.16.09a.35.35 0 0 1-.16-.274l.01-3.3c0-.1.073-.142.161-.09m2.215 1.281a.35.35 0 0 1 .159.275l-.01 3.301c0 .1-.073.141-.161.09a.35.35 0 0 1-.16-.274l.01-3.301c0-.1.073-.141.162-.09m1.106.639c.088.051.16.175.16.275l-.01 3.3c0 .1-.073.142-.162.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.073-.142.162-.09m4.869 2.825a.35.35 0 0 1 .159.275l-.01 3.3c0 .1-.072.142-.16.091a.35.35 0 0 1-.16-.275l.01-3.3c0-.1.073-.142.161-.09m1.106.639c.088.051.16.175.16.275l-.01 3.3c0 .1-.073.142-.162.09a.35.35 0 0 1-.159-.274l.01-3.3c0-.1.073-.142.161-.09m-19.807-9.102c.335-.195.334-.82-.002-1.397-.335-.576-.88-.887-1.214-.692-.335.194-.334.819.002 1.396.335.577.88.887 1.214.693"/></g><defs><linearGradient id="paint0_linear_6722_31907" x1="9" x2="64.502" y1="58.6" y2="25.597" gradientUnits="userSpaceOnUse"><stop stop-color="#49879a" stop-opacity=".38"/><stop offset=".4" stop-color="#154655" stop-opacity=".553"/><stop offset=".7" stop-color="#154655" stop-opacity=".73"/><stop offset=".969" stop-color="#154655" stop-opacity=".85"/></linearGradient><linearGradient id="paint1_linear_6722_31907" x1="65.084" x2="7.109" y1="52.172" y2="59.166" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint2_linear_6722_31907" x1="9" x2="64.5" y1="49.801" y2="16.801" gradientUnits="userSpaceOnUse"><stop stop-color="#49879a" stop-opacity=".38"/><stop offset=".4" stop-color="#154655" stop-opacity=".553"/><stop offset=".7" stop-color="#154655" stop-opacity=".73"/><stop offset=".969" stop-color="#154655" stop-opacity=".85"/></linearGradient><linearGradient id="paint3_linear_6722_31907" x1="65.084" x2="7.109" y1="43.299" y2="50.293" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint4_linear_6722_31907" x1="9" x2="64.5" y1="41" y2="8" gradientUnits="userSpaceOnUse"><stop stop-color="#49879a" stop-opacity=".38"/><stop offset=".4" stop-color="#154655" stop-opacity=".553"/><stop offset=".7" stop-color="#154655" stop-opacity=".73"/><stop offset=".969" stop-color="#154655" stop-opacity=".85"/></linearGradient><linearGradient id="paint5_linear_6722_31907" x1="65.084" x2="7.109" y1="34.573" y2="41.566" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><linearGradient id="paint6_linear_6722_31907" x1="1.186" x2="71.765" y1="39.972" y2="-1.215" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".4" stop-color="#4c7f8e" stop-opacity="0"/><stop offset=".5" stop-color="#4c7f8e" stop-opacity=".12"/><stop offset=".7" stop-color="#4c7f8e" stop-opacity=".33"/><stop offset=".88" stop-color="#4c7f8e" stop-opacity=".45"/><stop offset="1" stop-color="#4c7f8e" stop-opacity=".5"/></linearGradient><linearGradient id="paint7_linear_6722_31907" x1="65.084" x2="7.109" y1="25.845" y2="32.839" gradientUnits="userSpaceOnUse"><stop stop-color="#4c7f8e" stop-opacity=".6"/><stop offset=".11" stop-color="#4c7f8e" stop-opacity=".55"/><stop offset=".27" stop-color="#4c7f8e" stop-opacity=".43"/><stop offset=".45" stop-color="#4c7f8e" stop-opacity=".22"/><stop offset=".6" stop-color="#4c7f8e" stop-opacity="0"/><stop offset="1" stop-color="#4c7f8e" stop-opacity="0"/></linearGradient><clipPath id="clip0_6722_31907"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/servicenow.svg b/web/packages/design/src/ResourceIcon/assets/servicenow.svg
index 58f5dd70f9639..0a14b08f83d16 100644
--- a/web/packages/design/src/ResourceIcon/assets/servicenow.svg
+++ b/web/packages/design/src/ResourceIcon/assets/servicenow.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M36.2126 3.00964C28.972 2.99453 21.8937 5.15489 15.8955 9.21064C9.89736 13.2664 5.25583 19.0305 2.5727 25.7557C-0.110419 32.4809 -0.711398 39.857 0.847671 46.9279C2.40674 53.9987 6.05395 60.4382 11.3165 65.4114C12.5509 66.5868 14.1652 67.2815 15.8674 67.3699C17.5695 67.4583 19.2471 66.9345 20.5965 65.8932C25.0488 62.5799 30.4508 60.7904 36.0006 60.7904C41.5505 60.7904 46.9524 62.5799 51.4047 65.8932C52.7671 66.9368 54.4592 67.456 56.1725 67.356C57.8857 67.2561 59.506 66.5437 60.7378 65.3488C65.9591 60.394 69.5818 53.9928 71.1415 46.9657C72.7011 39.9386 72.1267 32.6059 69.4919 25.9074C66.857 19.2089 62.2817 13.4499 56.3525 9.36862C50.4233 5.28732 43.4104 3.06969 36.2126 3M36.0006 57.1721C33.6208 57.2365 31.2529 56.8152 29.0413 55.9342C26.8297 55.0531 24.8208 53.7306 23.1372 52.0475C21.4536 50.3643 20.1306 48.3558 19.2489 46.1444C18.3673 43.933 17.9454 41.5652 18.0091 39.1854C18.0091 34.4138 19.9046 29.8376 23.2787 26.4635C26.6528 23.0894 31.229 21.1939 36.0006 21.1939C40.7723 21.1939 45.3485 23.0894 48.7226 26.4635C52.0966 29.8376 53.9922 34.4138 53.9922 39.1854C54.0559 41.5652 53.634 43.933 52.7523 46.1444C51.8707 48.3558 50.5477 50.3643 48.8641 52.0475C47.1805 53.7306 45.1716 55.0531 42.9599 55.9342C40.7483 56.8152 38.3804 57.2365 36.0006 57.1721Z" fill="#62D84E"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#62d84e" fill-rule="evenodd" d="M36.213 3.01a36.137 36.137 0 0 0-24.897 62.4 7.136 7.136 0 0 0 9.28.482 25.8 25.8 0 0 1 30.809 0 7.155 7.155 0 0 0 9.333-.544A36.138 36.138 0 0 0 36.213 3M36 57.172a17.524 17.524 0 0 1-17.992-17.987 17.991 17.991 0 0 1 35.983 0A17.524 17.524 0 0 1 36 57.172" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/shopify.svg b/web/packages/design/src/ResourceIcon/assets/shopify.svg
index 23ceaf4dbdbbc..360ccc2548750 100644
--- a/web/packages/design/src/ResourceIcon/assets/shopify.svg
+++ b/web/packages/design/src/ResourceIcon/assets/shopify.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_12025)">
-<path d="M59.8778 13.8842C59.8352 13.501 59.4946 13.3307 59.2391 13.2881C58.9836 13.2456 53.8744 13.203 53.8744 13.203C53.8744 13.203 49.5741 9.03042 49.1483 8.60465C48.7226 8.17888 47.9136 8.30661 47.573 8.39177C47.573 8.39177 46.764 8.64723 45.4015 9.073C45.1887 8.34919 44.848 7.45507 44.3797 6.56095C42.8469 3.62313 40.6329 2.09036 37.908 2.09036C37.7377 2.09036 37.5248 2.09036 37.3545 2.13294C37.2693 2.04778 37.1842 1.96263 37.099 1.8349C35.9069 0.557583 34.4167 -0.0384967 32.6284 0.00408041C29.1371 0.0892346 25.6883 2.60128 22.8357 7.11446C20.8346 10.2652 19.3444 14.2248 18.9186 17.2904C14.9163 18.5251 12.1063 19.3767 12.0637 19.4192C10.0626 20.0579 9.9774 20.1005 9.72194 22.0164C9.50905 23.4215 4.22949 64.3381 4.22949 64.3381L48.5522 72.002L67.7545 67.2333C67.7545 67.2333 59.9203 14.2248 59.8778 13.8842ZM43.1875 9.75424C42.1657 10.0523 41.0161 10.4355 39.7388 10.8187C39.6962 9.073 39.4833 6.60353 38.6744 4.47468C41.3567 4.9856 42.634 7.966 43.1875 9.75424ZM37.4396 11.5425C35.0979 12.2663 32.5858 13.0327 30.0312 13.8416C30.755 11.1167 32.1175 8.39177 33.778 6.60353C34.4167 5.9223 35.2682 5.19849 36.29 4.77272C37.2693 6.77384 37.4396 9.6265 37.4396 11.5425ZM32.671 2.34582C33.48 2.34582 34.1612 2.51613 34.7573 2.89932C33.8206 3.36767 32.8839 4.09148 32.0323 5.02818C29.8183 7.4125 28.1152 11.0741 27.434 14.6506C25.3052 15.2893 23.2615 15.9279 21.3455 16.524C22.6228 10.9038 27.3063 2.51613 32.671 2.34582Z" fill="#95BF47"/>
-<path d="M59.2386 13.2881C58.9831 13.2455 53.8739 13.2029 53.8739 13.2029C53.8739 13.2029 49.5736 9.03035 49.1478 8.60458C48.9775 8.43428 48.7646 8.34912 48.5518 8.34912V72.0019L67.754 67.2333C67.754 67.2333 59.9198 14.2673 59.8773 13.8841C59.7921 13.501 59.4941 13.3306 59.2386 13.2881Z" fill="#5E8E3E"/>
-<path d="M37.9081 23.1662L35.6941 31.5113C35.6941 31.5113 33.2246 30.3617 30.2442 30.5746C25.9013 30.8301 25.8587 33.555 25.9013 34.2788C26.1568 38.0256 35.9495 38.8346 36.503 47.5629C36.9288 54.4603 32.8414 59.1438 26.9658 59.527C19.898 59.9528 16.0234 55.8228 16.0234 55.8228L17.5136 49.4788C17.5136 49.4788 21.4307 52.4166 24.5389 52.2463C26.5826 52.1186 27.3064 50.4581 27.2212 49.2659C26.9232 44.4122 18.9187 44.6676 18.4078 36.7057C17.982 29.9785 22.41 23.1662 32.1602 22.5275C35.9921 22.1869 37.9081 23.1662 37.9081 23.1662Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_12025">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_12025)"><path fill="#95bf47" d="M59.878 13.884c-.043-.383-.383-.553-.639-.596-.255-.042-5.365-.085-5.365-.085s-4.3-4.173-4.726-4.598c-.425-.426-1.234-.298-1.575-.213 0 0-.809.255-2.172.681a14 14 0 0 0-1.021-2.512c-1.533-2.938-3.747-4.47-6.472-4.47-.17 0-.383 0-.553.042a2 2 0 0 1-.256-.298C35.907.558 34.417-.038 32.629.005c-3.492.084-6.94 2.596-9.793 7.11-2.001 3.15-3.492 7.11-3.917 10.175-4.003 1.235-6.813 2.087-6.855 2.13-2.001.638-2.087.68-2.342 2.596-.213 1.406-5.493 42.322-5.493 42.322l44.323 7.664 19.202-4.769s-7.834-53.008-7.876-53.349m-16.69-4.13c-1.022.298-2.172.681-3.45 1.065-.042-1.746-.255-4.215-1.064-6.344 2.683.51 3.96 3.491 4.514 5.28m-5.748 1.789c-2.342.723-4.854 1.49-7.409 2.299.724-2.725 2.087-5.45 3.747-7.238.639-.682 1.49-1.406 2.512-1.831.98 2 1.15 4.854 1.15 6.77m-4.77-9.198c.809 0 1.49.17 2.086.553-.936.469-1.873 1.192-2.725 2.13-2.214 2.383-3.917 6.045-4.598 9.622-2.129.638-4.172 1.277-6.088 1.873 1.277-5.62 5.96-14.008 11.325-14.178"/><path fill="#5e8e3e" d="M59.239 13.288c-.256-.043-5.365-.085-5.365-.085s-4.3-4.173-4.726-4.598a.84.84 0 0 0-.596-.256v63.653l19.202-4.769s-7.834-52.966-7.877-53.349a.76.76 0 0 0-.638-.596"/><path fill="#fff" d="m37.908 23.166-2.214 8.345s-2.47-1.15-5.45-.936c-4.343.255-4.385 2.98-4.343 3.704.256 3.747 10.049 4.556 10.602 13.284.426 6.897-3.662 11.58-9.537 11.964-7.068.426-10.943-3.704-10.943-3.704l1.49-6.344s3.918 2.938 7.026 2.767c2.044-.127 2.767-1.788 2.682-2.98-.298-4.854-8.302-4.598-8.813-12.56-.426-6.728 4.002-13.54 13.752-14.179 3.832-.34 5.748.64 5.748.64"/></g><defs><clipPath id="clip0_16966_12025"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sixsense-dark.svg b/web/packages/design/src/ResourceIcon/assets/sixsense-dark.svg
index 942511dde77e5..2de0949752dfa 100644
--- a/web/packages/design/src/ResourceIcon/assets/sixsense-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sixsense-dark.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M40.8156 24.9468C43.6011 25.5297 46.3137 26.6194 48.8078 28.2291L40.544 38.0495H40.5407C38.3075 37.0285 35.8013 36.7669 33.4053 37.3046C31.0093 37.8423 28.8552 39.1497 27.2724 41.0271C25.6928 42.9001 24.7742 45.2413 24.6587 47.6888C24.5431 50.1362 25.2371 52.5535 26.6332 54.567L18.3661 64.3874C14.4134 60.1442 12.1513 54.6004 12.0073 48.8032C11.8633 43.0059 13.8473 37.3566 17.5845 32.9224L45.3035 0L54.9915 8.10473L40.8156 24.9468Z" fill="#13BBB2"/>
-<path d="M54.1432 63.5027C46.3167 72.7965 32.8794 74.6281 22.9199 68.1993L31.1869 58.3789C33.4202 59.3999 35.9264 59.6616 38.3224 59.1239C40.7184 58.5862 42.8724 57.2787 44.4553 55.4013C46.0338 53.5277 46.9515 51.1864 47.0664 48.7391C47.1814 46.2918 46.4872 43.8748 45.0912 41.8614L53.3615 32.041C57.3141 36.2837 59.576 41.8269 59.72 47.6236C59.864 53.4203 57.8801 59.0691 54.1432 63.5027Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#13bbb2" d="M40.816 24.947a23.7 23.7 0 0 1 7.992 3.282l-8.264 9.82h-.003a11.24 11.24 0 0 0-13.269 2.978 11.15 11.15 0 0 0-.639 13.54l-8.267 9.82a23.73 23.73 0 0 1-.782-31.465L45.305 0l9.688 8.105z"/><path fill="#fff" d="M54.143 63.503c-7.826 9.293-21.264 11.125-31.223 4.696l8.267-9.82A11.24 11.24 0 0 0 44.455 55.4a11.15 11.15 0 0 0 .636-13.54l8.27-9.82a23.724 23.724 0 0 1 .782 31.462"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sixsense-light.svg b/web/packages/design/src/ResourceIcon/assets/sixsense-light.svg
index 5a925316f4d57..9f8e325866ff0 100644
--- a/web/packages/design/src/ResourceIcon/assets/sixsense-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sixsense-light.svg
@@ -1,4 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M40.8156 24.9468C43.6011 25.5297 46.3137 26.6194 48.8078 28.2291L40.544 38.0495H40.5407C38.3075 37.0285 35.8013 36.7669 33.4053 37.3046C31.0093 37.8423 28.8552 39.1497 27.2724 41.0271C25.6928 42.9001 24.7742 45.2413 24.6587 47.6888C24.5431 50.1362 25.2371 52.5535 26.6332 54.567L18.3661 64.3874C14.4134 60.1442 12.1513 54.6004 12.0073 48.8032C11.8633 43.0059 13.8473 37.3566 17.5845 32.9224L45.3035 0L54.9915 8.10473L40.8156 24.9468Z" fill="#13BBB2"/>
-<path d="M54.1432 63.5027C46.3167 72.7965 32.8794 74.6281 22.9199 68.1993L31.1869 58.3789C33.4202 59.3999 35.9264 59.6616 38.3224 59.1239C40.7184 58.5862 42.8724 57.2787 44.4553 55.4013C46.0338 53.5277 46.9515 51.1864 47.0664 48.7391C47.1814 46.2918 46.4872 43.8748 45.0912 41.8614L53.3615 32.041C57.3141 36.2837 59.576 41.8269 59.72 47.6236C59.864 53.4203 57.8801 59.0691 54.1432 63.5027Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#13bbb2" d="M40.816 24.947a23.7 23.7 0 0 1 7.992 3.282l-8.264 9.82h-.003a11.24 11.24 0 0 0-13.269 2.978 11.15 11.15 0 0 0-.639 13.54l-8.267 9.82a23.73 23.73 0 0 1-.782-31.465L45.305 0l9.688 8.105z"/><path fill="#000" d="M54.143 63.503c-7.826 9.293-21.264 11.125-31.223 4.696l8.267-9.82A11.24 11.24 0 0 0 44.455 55.4a11.15 11.15 0 0 0 .636-13.54l8.27-9.82a23.724 23.724 0 0 1 .782 31.462"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/skype.svg b/web/packages/design/src/ResourceIcon/assets/skype.svg
index 0b9427cb2d287..7b7a489d2c991 100644
--- a/web/packages/design/src/ResourceIcon/assets/skype.svg
+++ b/web/packages/design/src/ResourceIcon/assets/skype.svg
@@ -1,37 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4769)">
-<path d="M42.3733 20.952C42.3733 26.5088 40.1585 31.838 36.2162 35.7673C32.2739 39.6966 26.927 41.904 21.3517 41.904C15.7764 41.904 10.4295 39.6966 6.48716 35.7673C2.54485 31.838 0.330078 26.5088 0.330078 20.952C0.330078 15.3952 2.54485 10.066 6.48716 6.1367C10.4295 2.20744 15.7764 0 21.3517 0C26.927 0 32.2739 2.20744 36.2162 6.1367C40.1585 10.066 42.3733 15.3952 42.3733 20.952Z" fill="url(#paint0_linear_8803_4769)"/>
-<path d="M71.6699 51.0407C71.6699 53.7931 71.126 56.5186 70.0692 59.0615C69.0124 61.6044 67.4634 63.9149 65.5107 65.8611C63.558 67.8074 61.2398 69.3512 58.6885 70.4045C56.1371 71.4578 53.4026 71.9999 50.6411 71.9999C45.0639 71.9999 39.7152 69.7917 35.7715 65.8611C31.8278 61.9305 29.6123 56.5995 29.6123 51.0407C29.6123 45.482 31.8278 40.151 35.7715 36.2204C39.7152 32.2897 45.0639 30.0815 50.6411 30.0815C53.4026 30.0815 56.1371 30.6237 58.6885 31.677C61.2398 32.7303 63.558 34.2741 65.5107 36.2204C67.4634 38.1666 69.0124 40.4771 70.0692 43.02C71.126 45.5629 71.6699 48.2883 71.6699 51.0407Z" fill="url(#paint1_linear_8803_4769)"/>
-<path opacity="0.05" fill-rule="evenodd" clip-rule="evenodd" d="M0.407227 22.7446C0.733746 26.7034 2.17532 30.4886 4.5649 33.6616C6.95448 36.8346 10.1943 39.2656 13.9088 40.6728C17.6233 42.08 21.6606 42.4059 25.5528 41.6127C29.4449 40.8194 33.0327 38.9395 35.9002 36.1909C38.7678 33.4422 40.7978 29.9372 41.755 26.0821C42.7123 22.227 42.5575 18.1796 41.3088 14.4088C40.06 10.638 37.7683 7.29829 34.6992 4.77657C31.6302 2.25485 27.9094 0.654395 23.968 0.160645C18.6164 1.95083 13.7279 4.90458 9.65408 8.80952C5.58025 12.7145 2.42228 17.4736 0.407227 22.7446Z" fill="black"/>
-<path opacity="0.05" fill-rule="evenodd" clip-rule="evenodd" d="M71.6149 49.5358C71.3404 45.5288 69.9239 41.6843 67.5331 38.457C65.1424 35.2297 61.8773 32.7547 58.1241 31.3247C54.3709 29.8947 50.2867 29.5695 46.3545 30.3877C42.4224 31.2058 38.8068 33.1331 35.9355 35.9414C33.0642 38.7498 31.0573 42.3217 30.1522 46.2348C29.2471 50.1478 29.4816 54.2383 30.8281 58.0222C32.1746 61.8062 34.5767 65.1253 37.7502 67.587C40.9237 70.0488 44.7358 71.5501 48.7357 71.9134C53.9411 70.0599 58.6824 67.0991 62.6324 63.2353C66.5824 59.3715 69.6471 54.699 71.6149 49.5358Z" fill="black"/>
-<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M1.39062 27.5353C2.49478 30.913 4.43756 33.9555 7.03727 36.3783C9.63698 38.801 12.8087 40.5249 16.2558 41.3885C19.7028 42.2522 23.3126 42.2276 26.7476 41.3168C30.1825 40.4061 33.3304 38.6391 35.8967 36.1811C38.4631 33.723 40.3641 30.6542 41.422 27.2617C42.4799 23.8692 42.6601 20.2638 41.9457 16.7827C41.2313 13.3016 39.6458 10.0586 37.3373 7.35692C35.0288 4.65522 32.0728 2.58315 28.7458 1.33447C22.1894 2.7004 16.1487 5.88085 11.3121 10.5133C6.47559 15.1458 3.0378 21.0438 1.39062 27.5353Z" fill="black"/>
-<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M70.6594 44.6113C69.5715 41.1936 67.6271 38.1112 65.0113 35.6573C62.3955 33.2034 59.1952 31.4596 55.7151 30.592C52.2349 29.7244 48.5907 29.7618 45.129 30.7005C41.6674 31.6393 38.5036 33.4482 35.9386 35.9552C33.3736 38.4622 31.4928 41.5839 30.4751 45.0231C29.4575 48.4624 29.3368 52.1049 30.1247 55.604C30.9125 59.103 32.5826 62.3423 34.9761 65.0135C37.3695 67.6848 40.4067 69.6991 43.7986 70.8649C50.2711 69.4124 56.2116 66.1873 60.9555 61.5507C65.6993 56.9141 69.0593 51.0488 70.6594 44.6113Z" fill="black"/>
-<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M2.16406 29.5225C3.53183 32.6045 5.62136 35.3119 8.25609 37.416C10.8908 39.5201 13.9933 40.9591 17.3014 41.6114C20.6096 42.2637 24.0261 42.11 27.2623 41.1635C30.4985 40.217 33.4594 38.5054 35.8947 36.1733C38.3299 33.8412 40.1681 30.9572 41.2537 27.765C42.3394 24.5727 42.6407 21.1661 42.1322 17.8328C41.6237 14.4996 40.3203 11.3377 38.3321 8.6144C36.344 5.89109 33.7295 3.68637 30.7097 2.18652C23.7257 3.2736 17.2436 6.47777 12.1388 11.3663C7.03398 16.2548 3.55233 22.5922 2.16406 29.5225Z" fill="black"/>
-<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M69.8845 42.5832C68.5238 39.4655 66.4265 36.7248 63.7729 34.5965C61.1193 32.4681 57.9886 31.0158 54.6499 30.3642C51.3112 29.7126 47.8642 29.8813 44.6051 30.8557C41.3459 31.8302 38.3721 33.5812 35.9389 35.9585C33.5058 38.3357 31.6861 41.2681 30.6363 44.5038C29.5864 47.7394 29.3377 51.1815 29.9115 54.5345C30.4854 57.8874 31.8646 61.0509 33.9307 63.7533C35.9969 66.4556 38.6881 68.616 41.7733 70.0488C48.6961 68.8725 55.0956 65.6134 60.1182 60.7061C65.1408 55.7988 68.5477 49.4768 69.8845 42.5832Z" fill="black"/>
-<path d="M69.2984 36.156C69.2984 40.5139 68.4372 44.8291 66.764 48.8553C65.0907 52.8814 62.6382 56.5397 59.5465 59.6212C56.4547 62.7027 52.7843 65.1471 48.7447 66.8148C44.7052 68.4824 40.3756 69.3408 36.0032 69.3408C31.6308 69.3408 27.3012 68.4824 23.2617 66.8148C19.2221 65.1471 15.5517 62.7027 12.4599 59.6212C9.3682 56.5397 6.91569 52.8814 5.24245 48.8553C3.56921 44.8291 2.70801 40.5139 2.70801 36.156C2.70801 31.7981 3.56921 27.4829 5.24245 23.4567C6.91569 19.4306 9.3682 15.7723 12.4599 12.6908C15.5517 9.6093 19.2221 7.16493 23.2617 5.49723C27.3012 3.82954 31.6308 2.97119 36.0032 2.97119C40.3756 2.97119 44.7052 3.82954 48.7447 5.49723C52.7843 7.16493 56.4547 9.6093 59.5465 12.6908C62.6382 15.7723 65.0907 19.4306 66.764 23.4567C68.4372 27.4829 69.2984 31.7981 69.2984 36.156Z" fill="url(#paint2_linear_8803_4769)"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M26.6414 35.0038C25.2959 34.1183 24.1732 32.9339 23.3606 31.543C22.5762 30.0736 22.189 28.4248 22.2374 26.7598C22.178 24.6468 22.8991 22.586 24.263 20.971C25.6805 19.3493 27.5023 18.132 29.543 17.443C31.7626 16.6589 34.1011 16.2651 36.455 16.279C37.9951 16.2645 39.5336 16.3825 41.0534 16.6318C42.1413 16.7998 43.2098 17.0756 44.243 17.455C45.1919 17.7762 46.0484 18.3231 46.739 19.0486C47.2479 19.6456 47.5218 20.4075 47.5094 21.1918C47.5276 21.5993 47.4653 22.0063 47.3261 22.3897C47.1869 22.7731 46.9736 23.1253 46.6982 23.4262C46.4377 23.7035 46.1215 23.9226 45.7703 24.069C45.4192 24.2154 45.041 24.2859 44.6606 24.2758C44.1373 24.2715 43.621 24.1553 43.1462 23.935C41.9761 23.4113 40.7708 22.9702 39.539 22.615C38.4052 22.3161 37.2364 22.1708 36.0638 22.183C34.5356 22.1268 33.0237 22.5135 31.7102 23.2966C31.1559 23.6334 30.7023 24.1129 30.3966 24.685C30.091 25.257 29.9445 25.9006 29.9726 26.5486C29.9646 27.3994 30.2883 28.2198 30.875 28.8358C31.5723 29.5595 32.3963 30.1493 33.3062 30.5758C34.3254 31.0814 35.8454 31.7518 37.8662 32.587C38.09 32.6579 38.3082 32.7453 38.519 32.8486C40.4911 33.6287 42.3818 34.6006 44.1638 35.7502C45.5713 36.6679 46.7581 37.8859 47.639 39.3166C48.5065 40.8204 48.9409 42.5348 48.8942 44.2702C48.967 46.395 48.3582 48.4874 47.1566 50.2414C45.9331 51.9021 44.2405 53.1584 42.2966 53.8486C39.9539 54.6857 37.4783 55.0891 34.991 55.039C31.5731 55.1587 28.1714 54.5151 25.0334 53.155C24.2312 52.7978 23.5278 52.2509 22.9838 51.5614C22.5322 50.9296 22.298 50.1682 22.3166 49.3918C22.2942 48.9823 22.3609 48.5728 22.5122 48.1916C22.6634 47.8104 22.8956 47.4666 23.1926 47.1838C23.8154 46.6385 24.6239 46.3532 25.451 46.387C26.3726 46.3996 27.2778 46.6325 28.091 47.0662C29.1022 47.5718 29.8998 47.951 30.4838 48.2038C31.1508 48.4831 31.8416 48.7016 32.5478 48.8566C33.4187 49.0477 34.3083 49.1394 35.1998 49.1302C36.7764 49.2428 38.3453 48.8246 39.6566 47.9422C40.1475 47.5581 40.5399 47.0625 40.8011 46.4966C41.0624 45.9307 41.1851 45.3106 41.159 44.6878C41.1605 43.8047 40.8239 42.9545 40.2182 42.3118C39.4179 41.4855 38.4809 40.8035 37.4486 40.2958C36.2278 39.6526 34.511 38.8686 32.2982 37.9438C30.3192 37.1552 28.4241 36.1703 26.6414 35.0038Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_8803_4769" x1="18.0733" y1="0.2544" x2="24.6301" y2="41.6496" gradientUnits="userSpaceOnUse">
-<stop offset="0.012" stop-color="#00B7F0"/>
-<stop offset="0.339" stop-color="#009DE5"/>
-<stop offset="0.755" stop-color="#0082D9"/>
-<stop offset="1" stop-color="#0078D4"/>
-</linearGradient>
-<linearGradient id="paint1_linear_8803_4769" x1="32.4395" y1="61.5479" x2="68.8403" y2="40.5335" gradientUnits="userSpaceOnUse">
-<stop stop-color="#0078D4"/>
-<stop offset="0.37" stop-color="#007AD5"/>
-<stop offset="0.573" stop-color="#0082D9"/>
-<stop offset="0.735" stop-color="#0090DF"/>
-<stop offset="0.875" stop-color="#00A3E7"/>
-<stop offset="1" stop-color="#00BCF2"/>
-</linearGradient>
-<linearGradient id="paint2_linear_8803_4769" x1="23.0096" y1="13.6536" x2="56.228" y2="71.1888" gradientUnits="userSpaceOnUse">
-<stop stop-color="#00B7F0"/>
-<stop offset="1" stop-color="#007CC1"/>
-</linearGradient>
-<clipPath id="clip0_8803_4769">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4769)"><path fill="url(#paint0_linear_8803_4769)" d="M42.373 20.952a20.92 20.92 0 0 1-6.157 14.815 21.06 21.06 0 0 1-14.864 6.137 21.06 21.06 0 0 1-14.865-6.137A20.92 20.92 0 0 1 .33 20.952 20.92 20.92 0 0 1 6.487 6.137 21.06 21.06 0 0 1 21.352 0a21.06 21.06 0 0 1 14.864 6.137 20.92 20.92 0 0 1 6.157 14.815"/><path fill="url(#paint1_linear_8803_4769)" d="M71.67 51.04a20.9 20.9 0 0 1-1.6 8.022 21 21 0 0 1-4.56 6.8 21 21 0 0 1-6.822 4.543A21.1 21.1 0 0 1 50.641 72a21.06 21.06 0 0 1-14.87-6.139 20.92 20.92 0 0 1-6.159-14.82c0-5.559 2.216-10.89 6.16-14.82a21.06 21.06 0 0 1 14.87-6.14c2.76 0 5.495.543 8.046 1.596a21 21 0 0 1 6.823 4.543 21 21 0 0 1 4.558 6.8 20.9 20.9 0 0 1 1.6 8.02"/><path fill="#000" fill-rule="evenodd" d="M.407 22.745A21.02 21.02 0 1 0 23.968.16 38.2 38.2 0 0 0 .408 22.745" clip-rule="evenodd" opacity=".05"/><path fill="#000" fill-rule="evenodd" d="M71.615 49.536a21.026 21.026 0 1 0-22.88 22.377 38.2 38.2 0 0 0 22.88-22.377" clip-rule="evenodd" opacity=".05"/><path fill="#000" fill-rule="evenodd" d="M1.39 27.535a21.013 21.013 0 1 0 27.356-26.2 35.74 35.74 0 0 0-27.355 26.2" clip-rule="evenodd" opacity=".1"/><path fill="#000" fill-rule="evenodd" d="M70.66 44.611a21.019 21.019 0 1 0-26.861 26.254 35.74 35.74 0 0 0 26.86-26.254" clip-rule="evenodd" opacity=".1"/><path fill="#000" fill-rule="evenodd" d="M2.164 29.523A21.007 21.007 0 1 0 30.71 2.187 34.53 34.53 0 0 0 2.164 29.523" clip-rule="evenodd" opacity=".1"/><path fill="#000" fill-rule="evenodd" d="M69.885 42.583a21.013 21.013 0 0 0-39.249 1.92A21.015 21.015 0 0 0 41.773 70.05a34.53 34.53 0 0 0 28.112-27.466" clip-rule="evenodd" opacity=".1"/><path fill="url(#paint2_linear_8803_4769)" d="M69.298 36.156a33.1 33.1 0 0 1-2.534 12.7 33.2 33.2 0 0 1-7.217 10.765 33.3 33.3 0 0 1-10.802 7.194 33.4 33.4 0 0 1-25.483 0A33.3 33.3 0 0 1 12.46 59.62a33.2 33.2 0 0 1-7.218-10.766 33.1 33.1 0 0 1 0-25.398A33.2 33.2 0 0 1 12.46 12.69a33.3 33.3 0 0 1 10.802-7.194 33.4 33.4 0 0 1 25.483 0 33.3 33.3 0 0 1 10.802 7.194 33.2 33.2 0 0 1 7.217 10.766 33.1 33.1 0 0 1 2.534 12.699"/><path fill="#fff" fill-rule="evenodd" d="M26.641 35.004a10.46 10.46 0 0 1-3.28-3.461 9.57 9.57 0 0 1-1.124-4.783 8.6 8.6 0 0 1 2.026-5.789 12.2 12.2 0 0 1 5.28-3.528 20.4 20.4 0 0 1 6.912-1.164c1.54-.014 3.079.104 4.598.353 1.088.168 2.157.444 3.19.823a6.2 6.2 0 0 1 2.496 1.594 3.22 3.22 0 0 1 .77 2.143 3.1 3.1 0 0 1-.81 2.234 2.7 2.7 0 0 1-2.038.85 3.7 3.7 0 0 1-1.515-.341 27.4 27.4 0 0 0-3.607-1.32 13 13 0 0 0-3.475-.432 7.93 7.93 0 0 0-4.354 1.114 3.62 3.62 0 0 0-1.737 3.252c-.008.85.315 1.67.902 2.287a8.2 8.2 0 0 0 2.431 1.74q1.53.758 4.56 2.011.336.105.653.262a32.4 32.4 0 0 1 5.645 2.901 11.4 11.4 0 0 1 3.475 3.567 9.4 9.4 0 0 1 1.255 4.953 9.96 9.96 0 0 1-1.737 5.971 10.33 10.33 0 0 1-4.86 3.608 20.5 20.5 0 0 1-7.306 1.19c-3.418.12-6.82-.524-9.958-1.884a5.4 5.4 0 0 1-2.05-1.594 3.6 3.6 0 0 1-.666-2.17 2.83 2.83 0 0 1 .876-2.207 3.23 3.23 0 0 1 2.258-.797 5.8 5.8 0 0 1 2.64.68 51 51 0 0 0 2.393 1.137 11.9 11.9 0 0 0 4.716.926 7.08 7.08 0 0 0 4.457-1.188 3.92 3.92 0 0 0 1.502-3.254 3.46 3.46 0 0 0-.94-2.376 10 10 0 0 0-2.77-2.016q-1.832-.965-5.15-2.352a32 32 0 0 1-5.658-2.94" clip-rule="evenodd"/></g><defs><linearGradient id="paint0_linear_8803_4769" x1="18.073" x2="24.63" y1=".254" y2="41.65" gradientUnits="userSpaceOnUse"><stop offset=".012" stop-color="#00b7f0"/><stop offset=".339" stop-color="#009de5"/><stop offset=".755" stop-color="#0082d9"/><stop offset="1" stop-color="#0078d4"/></linearGradient><linearGradient id="paint1_linear_8803_4769" x1="32.44" x2="68.84" y1="61.548" y2="40.533" gradientUnits="userSpaceOnUse"><stop stop-color="#0078d4"/><stop offset=".37" stop-color="#007ad5"/><stop offset=".573" stop-color="#0082d9"/><stop offset=".735" stop-color="#0090df"/><stop offset=".875" stop-color="#00a3e7"/><stop offset="1" stop-color="#00bcf2"/></linearGradient><linearGradient id="paint2_linear_8803_4769" x1="23.01" x2="56.228" y1="13.654" y2="71.189" gradientUnits="userSpaceOnUse"><stop stop-color="#00b7f0"/><stop offset="1" stop-color="#007cc1"/></linearGradient><clipPath id="clip0_8803_4769"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/slab.svg b/web/packages/design/src/ResourceIcon/assets/slab.svg
index 24083d10336dc..7713a0aa89ba5 100644
--- a/web/packages/design/src/ResourceIcon/assets/slab.svg
+++ b/web/packages/design/src/ResourceIcon/assets/slab.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4396)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M63.8594 32.4143C57.9268 32.1893 56.0237 37.9738 56.0237 37.9738C55.9116 35.5586 56.0801 33.986 56.0801 33.986C56.4156 33.7618 61.4523 31.7958 61.7321 25.0008C61.8442 21.2944 58.7662 19.1598 55.1842 20.3396C53.8416 26.5168 52.5538 34.9417 53.673 43.7584C53.4497 44.4326 51.4353 49.3744 49.2524 49.3744C46.2857 49.3744 45.7825 43.2528 45.8946 39.2658C46.5655 37.8053 47.9646 34.3239 46.7897 32.9191C46.23 32.1893 45.1108 32.0764 43.4319 32.4143C43.4319 32.807 43.3198 35.4465 43.3198 35.4465C43.3198 35.4465 41.865 32.6949 38.283 32.6949C33.135 32.6949 29.7772 37.6932 29.7772 42.9165C29.7772 43.7592 29.8329 44.4882 29.8885 45.2188L29.9449 45.2745L29.8885 45.3309C28.4894 47.9147 27.2024 49.2058 25.5235 49.2058C21.8859 49.2058 21.4383 43.5898 21.4383 43.5898C24.8518 39.5464 26.6992 33.8739 26.6992 27.6967C26.6992 22.5855 24.4607 18.8227 19.8715 20.3396C18.8079 25.7314 17.4644 37.8053 18.4724 43.4213C16.4572 46.1172 14.0509 47.7462 14.0509 47.7462C14.0509 47.7462 14.4429 47.1285 14.4429 45.7237C14.4429 39.5464 3.75413 41.2875 3.75413 37.6932C3.75413 36.7384 4.53713 35.1094 7.67076 35.1094C10.5254 35.1094 12.0358 36.6263 12.7639 36.6263C14.4985 36.6263 14.2743 34.4917 14.2743 34.4917C13.4357 33.8739 10.6367 32.3014 7.61513 32.3578C2.80258 32.3578 0.731765 35.2788 0.731765 37.8617C0.731765 44.6011 11.7003 42.2423 11.7003 46.2858C11.7003 48.3639 10.4698 49.5429 7.4474 49.5429C4.81695 49.5429 2.91467 47.4091 1.7954 47.4091C-0.164144 47.4091 0.00358348 49.43 0.00358348 49.43C0.507583 49.8236 3.64204 52.4074 7.78286 52.3509C11.2528 52.2388 15.3936 50.8348 19.032 46.4543V46.3422C19.7594 48.9817 21.3819 52.3509 25.188 52.3509C28.7692 52.3509 30.84 48.3075 30.84 48.3075C30.84 48.3075 32.6319 52.3509 36.7162 52.3509C39.57 52.3509 41.8094 50.9469 43.7117 47.5777C44.6076 50.7784 46.3978 52.3509 49.1403 52.3509C52.4981 52.3509 54.4012 48.3075 54.7367 47.5212C55.3528 48.7567 57.5349 52.1824 62.0119 52.3509C69.567 52.6316 71.637 45.8366 71.7499 42.2979C71.8612 38.8722 69.9033 32.6385 63.8594 32.4143ZM57.3099 23.2597C57.3099 23.2597 59.1009 22.8669 59.0444 24.9451C58.8767 29.774 56.1349 30.9538 56.1349 30.9538C56.3578 28.3662 56.7503 25.7959 57.3099 23.2597ZM20.8787 40.1085C20.6553 31.1224 22.11 23.4282 22.11 23.4282C22.11 23.4282 23.9002 23.4847 23.9002 28.2023C23.9002 35.165 20.8787 40.1085 20.8787 40.1085ZM43.152 39.4899C43.152 45.2745 41.0248 49.2058 37.1081 49.2058C33.0229 49.2058 32.5189 44.3197 32.5189 42.8036C32.5189 40.8383 33.414 35.5029 38.2274 35.5029C41.5852 35.5029 43.1529 39.4899 43.1529 39.4343L43.152 39.4899ZM68.6711 42.5229C68.5599 45.1068 67.1051 49.5429 62.5716 49.3744C57.8703 49.1502 56.6954 44.6011 56.8075 42.635C57.0309 39.0408 59.438 35.165 63.5788 35.3344C67.6083 35.5029 68.7268 39.9399 68.6711 42.5229Z" fill="#FF4143"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4396">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4396)"><path fill="#ff4143" fill-rule="evenodd" d="M63.86 32.414c-5.933-.225-7.836 5.56-7.836 5.56-.112-2.415.056-3.988.056-3.988.336-.224 5.372-2.19 5.652-8.985.112-3.707-2.966-5.841-6.548-4.661-1.342 6.177-2.63 14.602-1.511 23.418-.223.675-2.238 5.616-4.42 5.616-2.967 0-3.47-6.121-3.358-10.108.67-1.46 2.07-4.942.895-6.347-.56-.73-1.68-.843-3.358-.505 0 .393-.112 3.032-.112 3.032s-1.455-2.751-5.037-2.751c-5.148 0-8.506 4.998-8.506 10.221 0 .843.056 1.572.111 2.303l.057.056-.056.056c-1.4 2.584-2.687 3.875-4.366 3.875-3.637 0-4.085-5.616-4.085-5.616 3.414-4.044 5.261-9.716 5.261-15.893 0-5.111-2.238-8.874-6.828-7.357-1.063 5.391-2.407 17.465-1.399 23.081-2.015 2.696-4.421 4.325-4.421 4.325s.392-.617.392-2.022c0-6.178-10.689-4.436-10.689-8.03 0-.956.783-2.585 3.917-2.585 2.854 0 4.365 1.517 5.093 1.517 1.735 0 1.51-2.134 1.51-2.134-.838-.618-3.637-2.19-6.659-2.134-4.812 0-6.883 2.92-6.883 5.504 0 6.74 10.968 4.38 10.968 8.424 0 2.078-1.23 3.257-4.253 3.257-2.63 0-4.532-2.134-5.652-2.134-1.96 0-1.791 2.021-1.791 2.021.504.394 3.638 2.977 7.779 2.92 3.47-.111 7.61-1.515 11.249-5.896v-.112c.727 2.64 2.35 6.009 6.156 6.009 3.581 0 5.652-4.044 5.652-4.044s1.792 4.044 5.876 4.044c2.854 0 5.093-1.404 6.996-4.773.896 3.2 2.686 4.773 5.428 4.773 3.358 0 5.261-4.044 5.597-4.83.616 1.236 2.798 4.661 7.275 4.83 7.555.28 9.625-6.514 9.738-10.053.111-3.426-1.847-9.66-7.89-9.884m-6.55-9.154s1.79-.393 1.734 1.685c-.167 4.829-2.91 6.009-2.91 6.009a59 59 0 0 1 1.176-7.694M20.879 40.108c-.224-8.986 1.231-16.68 1.231-16.68s1.79.057 1.79 4.774c0 6.963-3.021 11.906-3.021 11.906m22.273-.618c0 5.785-2.127 9.716-6.044 9.716-4.085 0-4.59-4.886-4.59-6.402 0-1.966.896-7.301 5.71-7.301 3.357 0 4.925 3.987 4.925 3.931zm25.52 3.033c-.112 2.584-1.567 7.02-6.1 6.851-4.702-.224-5.877-4.773-5.765-6.739.224-3.594 2.631-7.47 6.772-7.3 4.03.168 5.148 4.605 5.092 7.188" clip-rule="evenodd"/></g><defs><clipPath id="clip0_8803_4396"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/slack.svg b/web/packages/design/src/ResourceIcon/assets/slack.svg
index 832dfed8666db..0018d1179acce 100644
--- a/web/packages/design/src/ResourceIcon/assets/slack.svg
+++ b/web/packages/design/src/ResourceIcon/assets/slack.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6211_26692)">
-<path d="M15 45.2002C15 49.4002 11.6 52.7002 7.5 52.7002C3.4 52.7002 0 49.3002 0 45.2002C0 41.1002 3.4 37.7002 7.5 37.7002H15V45.2002Z" fill="#E01E5A"/>
-<path d="M18.7998 45.2002C18.7998 41.0002 22.1998 37.7002 26.2998 37.7002C30.3998 37.7002 33.7998 41.1002 33.7998 45.2002V64.1002C33.7998 68.3002 30.3998 71.6002 26.2998 71.6002C22.1998 71.6002 18.7998 68.2002 18.7998 64.1002V45.2002Z" fill="#E01E5A"/>
-<path d="M26.4004 15C22.2004 15 18.9004 11.6 18.9004 7.5C18.9004 3.4 22.3004 0 26.4004 0C30.5004 0 33.9004 3.4 33.9004 7.5V15H26.4004Z" fill="#36C5F0"/>
-<path d="M26.4 18.7998C30.6 18.7998 33.9 22.1998 33.9 26.2998C33.9 30.3998 30.5 33.7998 26.4 33.7998H7.5C3.3 33.7998 0 30.3998 0 26.2998C0 22.1998 3.4 18.7998 7.5 18.7998H26.4Z" fill="#36C5F0"/>
-<path d="M56.5 26.3999C56.5 22.1999 59.9 18.8999 64 18.8999C68.2 18.8999 71.5 22.2999 71.5 26.3999C71.5 30.4999 68.1 33.8999 64 33.8999H56.5V26.3999Z" fill="#2EB67D"/>
-<path d="M52.7998 26.4C52.7998 30.6 49.3998 33.9 45.2998 33.9C41.1998 33.9 37.7998 30.5 37.7998 26.4V7.5C37.7998 3.3 41.1998 0 45.2998 0C49.3998 0 52.7998 3.4 52.7998 7.5V26.4Z" fill="#2EB67D"/>
-<path d="M45.2002 56.5C49.4002 56.5 52.7002 59.9 52.7002 64C52.7002 68.2 49.3002 71.5 45.2002 71.5C41.1002 71.5 37.7002 68.1 37.7002 64V56.5H45.2002Z" fill="#ECB22E"/>
-<path d="M45.2002 52.7998C41.0002 52.7998 37.7002 49.3998 37.7002 45.2998C37.7002 41.1998 41.1002 37.7998 45.2002 37.7998H64.1002C68.3002 37.7998 71.6002 41.1998 71.6002 45.2998C71.6002 49.3998 68.2002 52.7998 64.1002 52.7998H45.2002Z" fill="#ECB22E"/>
-</g>
-<defs>
-<clipPath id="clip0_6211_26692">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6211_26692)"><path fill="#e01e5a" d="M15 45.2c0 4.2-3.4 7.5-7.5 7.5S0 49.3 0 45.2s3.4-7.5 7.5-7.5H15zm3.8 0c0-4.2 3.4-7.5 7.5-7.5s7.5 3.4 7.5 7.5v18.9c0 4.2-3.4 7.5-7.5 7.5s-7.5-3.4-7.5-7.5z"/><path fill="#36c5f0" d="M26.4 15c-4.2 0-7.5-3.4-7.5-7.5S22.3 0 26.4 0s7.5 3.4 7.5 7.5V15zm0 3.8c4.2 0 7.5 3.4 7.5 7.5s-3.4 7.5-7.5 7.5H7.5c-4.2 0-7.5-3.4-7.5-7.5s3.4-7.5 7.5-7.5z"/><path fill="#2eb67d" d="M56.5 26.4c0-4.2 3.4-7.5 7.5-7.5 4.2 0 7.5 3.4 7.5 7.5s-3.4 7.5-7.5 7.5h-7.5zm-3.7 0c0 4.2-3.4 7.5-7.5 7.5s-7.5-3.4-7.5-7.5V7.5c0-4.2 3.4-7.5 7.5-7.5s7.5 3.4 7.5 7.5z"/><path fill="#ecb22e" d="M45.2 56.5c4.2 0 7.5 3.4 7.5 7.5 0 4.2-3.4 7.5-7.5 7.5s-7.5-3.4-7.5-7.5v-7.5zm0-3.7c-4.2 0-7.5-3.4-7.5-7.5s3.4-7.5 7.5-7.5h18.9c4.2 0 7.5 3.4 7.5 7.5s-3.4 7.5-7.5 7.5z"/></g><defs><clipPath id="clip0_6211_26692"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/snowflake.svg b/web/packages/design/src/ResourceIcon/assets/snowflake.svg
index 9022a954f5e30..f6366df782dc4 100644
--- a/web/packages/design/src/ResourceIcon/assets/snowflake.svg
+++ b/web/packages/design/src/ResourceIcon/assets/snowflake.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_6709_29484)">
-<path d="M61.7218 54.8731L46.5235 46.0931C44.3883 44.8638 41.6579 45.5949 40.4221 47.7301C39.9433 48.5712 39.7557 49.4964 39.8463 50.3958V67.5546C39.8463 70.0068 41.8391 71.9996 44.2977 71.9996C46.7499 71.9996 48.7427 70.0068 48.7427 67.5546V57.6876L57.2574 62.6049C59.3926 63.8407 62.1294 63.1031 63.3588 60.968C64.5946 58.8328 63.8634 56.1024 61.7218 54.8731Z" fill="#29B5E8"/>
-<path d="M23.9235 36.0577C23.9493 34.4725 23.1147 32.9973 21.743 32.2015L6.54467 23.428C5.88471 23.0463 5.12771 22.8457 4.3707 22.8457C2.8114 22.8457 1.36209 23.6804 0.58567 25.0261C-0.617775 27.1095 0.100411 29.7817 2.18379 30.9851L10.9444 36.0383L2.18379 41.098C1.17445 41.6803 0.449797 42.6184 0.152172 43.7442C-0.151925 44.8701 0.00335828 46.0476 0.58567 47.057C1.36209 48.4027 2.8114 49.2374 4.36423 49.2374C5.12771 49.2374 5.88471 49.0368 6.54467 48.6551L21.743 39.8816C23.1017 39.0922 23.9364 37.63 23.9235 36.0577Z" fill="#29B5E8"/>
-<path d="M9.99321 17.2106L25.1916 25.9841C26.9644 27.0128 29.1513 26.6764 30.5488 25.3112C31.4352 24.4959 31.9852 23.3313 31.9852 22.0373V4.45145C31.9852 1.9928 29.9924 0 27.5402 0C25.0816 0 23.0888 1.9928 23.0888 4.45145V14.4608L14.4576 9.47875C12.3225 8.24295 9.59206 8.97408 8.35627 11.1092C7.12047 13.2444 7.85807 15.9748 9.99321 17.2106Z" fill="#29B5E8"/>
-<path d="M44.1688 36.7699C44.1688 37.1063 43.9747 37.5722 43.7353 37.818L37.7116 43.8417C37.4722 44.0811 36.9999 44.2752 36.6634 44.2752H35.13C34.7935 44.2752 34.3212 44.0811 34.0818 43.8417L28.0517 37.818C27.8123 37.5722 27.6182 37.1063 27.6182 36.7699V35.2364C27.6182 34.8935 27.8123 34.4277 28.0517 34.1883L34.0818 28.1581C34.3212 27.9187 34.7935 27.7246 35.13 27.7246H36.6634C36.9999 27.7246 37.4722 27.9187 37.7116 28.1581L43.7353 34.1883C43.9747 34.4277 44.1688 34.8935 44.1688 35.2364V36.7699ZM38.7921 36.0323V35.9676C38.7921 35.7217 38.6497 35.3788 38.4751 35.1976L36.6958 33.4248C36.5211 33.2436 36.1782 33.1013 35.9258 33.1013H35.8611C35.6153 33.1013 35.2723 33.2436 35.0912 33.4248L33.3184 35.1976C33.1437 35.3723 33.0013 35.7152 33.0013 35.9676V36.0323C33.0013 36.2846 33.1437 36.6275 33.3184 36.8022L35.0912 38.5815C35.2723 38.7562 35.6153 38.8985 35.8611 38.8985H35.9258C36.1782 38.8985 36.5211 38.7562 36.6958 38.5815L38.4751 36.8022C38.6497 36.6275 38.7921 36.2846 38.7921 36.0323Z" fill="#29B5E8"/>
-<path d="M46.5246 25.9841L61.723 17.2106C63.8581 15.9812 64.5957 13.2444 63.3599 11.1092C62.1241 8.97408 59.3937 8.24295 57.2586 9.47875L48.7439 14.3961V4.45145C48.7439 1.9928 46.7511 0 44.2989 0C41.8402 0 39.8474 1.9928 39.8474 4.45145V21.6879C39.7633 22.5808 39.938 23.5125 40.4233 24.3536C41.6591 26.4887 44.3895 27.2199 46.5246 25.9841Z" fill="#29B5E8"/>
-<path d="M28.239 45.5763C27.2297 45.3822 26.1491 45.544 25.1916 46.0939L9.99321 54.8739C7.85807 56.1032 7.12047 58.8336 8.35627 60.9688C9.59206 63.1104 12.3225 63.8415 14.4576 62.6057L23.0888 57.6237V67.5554C23.0888 70.0076 25.0816 72.0004 27.5402 72.0004C29.9924 72.0004 31.9852 70.0076 31.9852 67.5554V49.9695C31.9852 47.7503 30.3612 45.9128 28.239 45.5763Z" fill="#29B5E8"/>
-<path d="M71.22 24.9746C69.9907 22.833 67.2538 22.1019 65.1187 23.3377L49.9203 32.1112C48.4645 32.9523 47.6622 34.4922 47.6881 36.0579C47.6752 37.6173 48.4775 39.1377 49.9203 39.9659L65.1187 48.7459C67.2538 49.9752 69.9842 49.2441 71.22 47.1089C72.4558 44.9738 71.7182 42.2434 69.583 41.0076L60.9778 36.0385L69.583 31.0695C71.7247 29.8401 72.4558 27.1098 71.22 24.9746Z" fill="#29B5E8"/>
-</g>
-<defs>
-<clipPath id="clip0_6709_29484">
-<rect width="72" height="72.0002" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#29b5e8" clip-path="url(#clip0_6709_29484)"><path d="m61.722 54.873-15.199-8.78a4.473 4.473 0 0 0-6.1 1.637 4.46 4.46 0 0 0-.577 2.666v17.159a4.448 4.448 0 0 0 8.896 0v-9.867l8.515 4.917a4.465 4.465 0 0 0 6.102-1.637 4.45 4.45 0 0 0-1.637-6.095M23.924 36.058a4.38 4.38 0 0 0-2.181-3.856L6.545 23.428a4.36 4.36 0 0 0-2.174-.582c-1.56 0-3.009.834-3.785 2.18a4.367 4.367 0 0 0 1.598 5.96l8.76 5.052-8.76 5.06a4.3 4.3 0 0 0-2.032 2.646 4.33 4.33 0 0 0 .434 3.313 4.367 4.367 0 0 0 5.959 1.598l15.198-8.773a4.39 4.39 0 0 0 2.18-3.824M9.993 17.21l15.199 8.774a4.466 4.466 0 0 0 5.357-.673 4.43 4.43 0 0 0 1.436-3.274V4.451A4.45 4.45 0 0 0 27.54 0a4.45 4.45 0 0 0-4.451 4.451v10.01l-8.631-4.982a4.465 4.465 0 1 0-4.465 7.732M44.169 36.77c0 .336-.194.802-.434 1.048l-6.023 6.024c-.24.24-.712.433-1.049.433H35.13c-.337 0-.809-.194-1.048-.433l-6.03-6.024c-.24-.246-.434-.712-.434-1.048v-1.534c0-.342.194-.808.434-1.048l6.03-6.03c.24-.24.712-.433 1.048-.433h1.533c.337 0 .81.194 1.049.433l6.023 6.03c.24.24.434.706.434 1.048zm-5.377-.738v-.064c0-.246-.142-.59-.317-.77l-1.78-1.773a1.22 1.22 0 0 0-.77-.324h-.064c-.246 0-.589.143-.77.324l-1.773 1.773a1.25 1.25 0 0 0-.317.77v.064c0 .253.143.596.317.77l1.773 1.78c.181.174.524.316.77.316h.065c.252 0 .595-.142.77-.317l1.78-1.779c.174-.175.316-.517.316-.77m7.733-10.048 15.198-8.773a4.465 4.465 0 1 0-4.464-7.732l-8.515 4.917V4.451A4.45 4.45 0 0 0 44.299 0a4.45 4.45 0 0 0-4.452 4.451v17.237a4.5 4.5 0 0 0 .576 2.666 4.465 4.465 0 0 0 6.102 1.63M28.239 45.576a4.43 4.43 0 0 0-3.047.518l-15.199 8.78a4.46 4.46 0 0 0-1.637 6.095 4.46 4.46 0 0 0 6.102 1.637l8.63-4.982v9.931a4.448 4.448 0 0 0 8.896 0V49.97a4.45 4.45 0 0 0-3.745-4.393M71.22 24.975a4.46 4.46 0 0 0-6.101-1.637L49.92 32.11a4.47 4.47 0 0 0-2.232 3.947 4.46 4.46 0 0 0 2.232 3.908l15.199 8.78a4.467 4.467 0 1 0 4.464-7.738l-8.605-4.97 8.605-4.968a4.45 4.45 0 0 0 1.637-6.095"/></g><defs><clipPath id="clip0_6709_29484"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/spacelift-dark.svg b/web/packages/design/src/ResourceIcon/assets/spacelift-dark.svg
index a716cde4cc8d5..4bd68ddcd8647 100644
--- a/web/packages/design/src/ResourceIcon/assets/spacelift-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/spacelift-dark.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15139_23687)">
-<path d="M60.7565 37.7454C59.9821 43.0581 57.6214 46.2275 54.2798 46.4402C52.1661 46.5766 49.9582 45.5224 48.4163 43.8497C50.8853 42.2775 52.9655 40.258 54.526 37.9192C56.0866 35.5803 57.0932 32.9734 57.4812 30.2637C50.7949 32.0974 43.9989 33.5042 37.1341 34.4755C30.2533 35.5141 23.3138 36.1173 16.3569 36.2815C17.9744 39.3153 20.4262 41.9222 23.4764 43.8536C19.538 47.9112 15.3994 54.4416 15.3994 63.9997H21.0323C21.0323 56.6706 23.9049 51.5013 26.8896 48.1036C26.0471 53.3663 25.5172 58.6743 25.3026 63.9997H35.304C35.304 63.9997 33.4692 57.1358 36.4563 57.1295C39.4418 57.135 37.6078 63.9997 37.6078 63.9997H47.6084C47.4097 58.969 46.9241 53.9538 46.1538 48.9785C47.2836 49.7991 48.5317 50.4427 49.8553 50.8873C51.394 51.407 53.0372 51.6252 54.6756 51.5278C56.1528 51.4265 57.5903 51.0525 58.8999 50.4269C60.188 49.8179 61.3403 48.956 62.2883 47.8925C64.3918 45.6175 65.7553 42.4278 66.3412 38.4115L60.7565 37.7454Z" fill="white"/>
-<path d="M37.4258 36.1382C57.2929 33.2127 72.7582 27.2876 71.9713 22.9051C71.1828 18.5219 54.4398 17.34 34.5742 20.2655C14.7071 23.1911 -0.75815 29.1169 0.0287453 33.4994C0.817199 37.8826 17.5602 39.0638 37.4258 36.1382Z" fill="url(#paint0_linear_15139_23687)"/>
-<path d="M55.5152 19.2496C53.2487 14.9941 49.3665 11.6183 44.5781 9.74063C39.7889 7.86299 34.4139 7.60822 29.4346 9.02229C24.4554 10.4371 20.2046 13.4266 17.4598 17.4444C14.715 21.4623 13.6586 26.2405 14.4852 30.9042C15.5331 36.7717 58.4843 30.7718 57.3873 24.6262C57.0471 22.7474 56.4154 20.9334 55.5152 19.2496Z" fill="white"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15139_23687" x1="0.000697584" y1="28.2023" x2="71.9993" y2="28.2023" gradientUnits="userSpaceOnUse">
-<stop offset="0.082" stop-color="#82FFE8"/>
-<stop offset="0.951" stop-color="#7C47FC"/>
-</linearGradient>
-<clipPath id="clip0_15139_23687">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15139_23687)"><path fill="#fff" d="M60.757 37.745c-.775 5.313-3.136 8.483-6.477 8.695-2.114.137-4.322-.918-5.864-2.59 2.47-1.572 4.55-3.592 6.11-5.93 1.56-2.34 2.567-4.947 2.955-7.656a164 164 0 0 1-20.347 4.211 165 165 0 0 1-20.777 1.806c1.617 3.034 4.07 5.641 7.12 7.573-3.94 4.056-8.079 10.588-8.079 20.146h5.633c0-7.33 2.873-12.499 5.858-15.896A135 135 0 0 0 25.303 64h10.001s-1.835-6.864 1.152-6.87c2.986.005 1.152 6.87 1.152 6.87h10a132 132 0 0 0-1.454-15.022 13.8 13.8 0 0 0 3.701 1.91 12.7 12.7 0 0 0 4.82.64 11.7 11.7 0 0 0 4.225-1.101 10.6 10.6 0 0 0 3.388-2.535c2.104-2.275 3.467-5.464 4.053-9.48z"/><path fill="url(#paint0_linear_15139_23687)" d="M37.426 36.138c19.867-2.925 35.332-8.85 34.545-13.233-.788-4.383-17.531-5.565-37.397-2.64C14.707 23.191-.758 29.118.03 33.5c.788 4.384 17.531 5.565 37.397 2.64"/><path fill="#fff" d="M55.515 19.25c-2.266-4.256-6.148-7.632-10.937-9.51-4.79-1.877-10.164-2.132-15.143-.718s-9.23 4.405-11.975 8.422-3.801 8.797-2.975 13.46c1.048 5.868 44-.132 42.902-6.278a18.3 18.3 0 0 0-1.872-5.376"/></g><defs><linearGradient id="paint0_linear_15139_23687" x1=".001" x2="71.999" y1="28.202" y2="28.202" gradientUnits="userSpaceOnUse"><stop offset=".082" stop-color="#82ffe8"/><stop offset=".951" stop-color="#7c47fc"/></linearGradient><clipPath id="clip0_15139_23687"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/spacelift-light.svg b/web/packages/design/src/ResourceIcon/assets/spacelift-light.svg
index d94ec99930105..b63870e53d568 100644
--- a/web/packages/design/src/ResourceIcon/assets/spacelift-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/spacelift-light.svg
@@ -1,16 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15139_23687)">
-<path d="M60.7565 37.7454C59.9821 43.0581 57.6214 46.2275 54.2798 46.4402C52.1661 46.5766 49.9582 45.5224 48.4163 43.8497C50.8853 42.2775 52.9655 40.258 54.526 37.9192C56.0866 35.5803 57.0932 32.9734 57.4812 30.2637C50.7949 32.0974 43.9989 33.5042 37.1341 34.4755C30.2533 35.5141 23.3138 36.1173 16.3569 36.2815C17.9744 39.3153 20.4262 41.9222 23.4764 43.8536C19.538 47.9112 15.3994 54.4416 15.3994 63.9997H21.0323C21.0323 56.6706 23.9049 51.5013 26.8896 48.1036C26.0471 53.3663 25.5172 58.6743 25.3026 63.9997H35.304C35.304 63.9997 33.4692 57.1358 36.4563 57.1295C39.4418 57.135 37.6078 63.9997 37.6078 63.9997H47.6084C47.4097 58.969 46.9241 53.9538 46.1538 48.9785C47.2836 49.7991 48.5317 50.4427 49.8553 50.8873C51.394 51.407 53.0372 51.6252 54.6756 51.5278C56.1528 51.4265 57.5903 51.0525 58.8999 50.4269C60.188 49.8179 61.3403 48.956 62.2883 47.8925C64.3918 45.6175 65.7553 42.4278 66.3412 38.4115L60.7565 37.7454Z" fill="black"/>
-<path d="M37.4258 36.1382C57.2929 33.2127 72.7582 27.2876 71.9713 22.9051C71.1828 18.5219 54.4398 17.34 34.5742 20.2655C14.7071 23.1911 -0.75815 29.1169 0.0287453 33.4994C0.817199 37.8826 17.5602 39.0638 37.4258 36.1382Z" fill="url(#paint0_linear_15139_23687)"/>
-<path d="M55.5152 19.2496C53.2487 14.9941 49.3665 11.6183 44.5781 9.74063C39.7889 7.86299 34.4139 7.60822 29.4346 9.02229C24.4554 10.4371 20.2046 13.4266 17.4598 17.4444C14.715 21.4623 13.6586 26.2405 14.4852 30.9042C15.5331 36.7717 58.4843 30.7718 57.3873 24.6262C57.0471 22.7474 56.4154 20.9334 55.5152 19.2496Z" fill="black"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_15139_23687" x1="0.000697584" y1="28.2023" x2="71.9993" y2="28.2023" gradientUnits="userSpaceOnUse">
-<stop offset="0.082" stop-color="#82FFE8"/>
-<stop offset="0.951" stop-color="#7C47FC"/>
-</linearGradient>
-<clipPath id="clip0_15139_23687">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15139_23687)"><path fill="#000" d="M60.757 37.745c-.775 5.313-3.136 8.483-6.477 8.695-2.114.137-4.322-.918-5.864-2.59 2.47-1.572 4.55-3.592 6.11-5.93 1.56-2.34 2.567-4.947 2.955-7.656a164 164 0 0 1-20.347 4.211 165 165 0 0 1-20.777 1.806c1.617 3.034 4.07 5.641 7.12 7.573-3.94 4.056-8.079 10.588-8.079 20.146h5.633c0-7.33 2.873-12.499 5.858-15.896A135 135 0 0 0 25.303 64h10.001s-1.835-6.864 1.152-6.87c2.986.005 1.152 6.87 1.152 6.87h10a132 132 0 0 0-1.454-15.022 13.8 13.8 0 0 0 3.701 1.91 12.7 12.7 0 0 0 4.82.64 11.7 11.7 0 0 0 4.225-1.101 10.6 10.6 0 0 0 3.388-2.535c2.104-2.275 3.467-5.464 4.053-9.48z"/><path fill="url(#paint0_linear_15139_23687)" d="M37.426 36.138c19.867-2.925 35.332-8.85 34.545-13.233-.788-4.383-17.531-5.565-37.397-2.64C14.707 23.191-.758 29.118.03 33.5c.788 4.384 17.531 5.565 37.397 2.64"/><path fill="#000" d="M55.515 19.25c-2.266-4.256-6.148-7.632-10.937-9.51-4.79-1.877-10.164-2.132-15.143-.718s-9.23 4.405-11.975 8.422-3.801 8.797-2.975 13.46c1.048 5.868 44-.132 42.902-6.278a18.3 18.3 0 0 0-1.872-5.376"/></g><defs><linearGradient id="paint0_linear_15139_23687" x1=".001" x2="71.999" y1="28.202" y2="28.202" gradientUnits="userSpaceOnUse"><stop offset=".082" stop-color="#82ffe8"/><stop offset=".951" stop-color="#7c47fc"/></linearGradient><clipPath id="clip0_15139_23687"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/sparrow.svg b/web/packages/design/src/ResourceIcon/assets/sparrow.svg
index 58b0b5b896c96..063d56aaff4f8 100644
--- a/web/packages/design/src/ResourceIcon/assets/sparrow.svg
+++ b/web/packages/design/src/ResourceIcon/assets/sparrow.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M47.3678 18.0428C48.0562 16.5441 49.0363 14.7822 50.3111 13.206C51.928 11.207 54.1859 9.46242 57.3436 9.09653C64.4408 8.27411 67.7818 13.0331 68.9973 14.9478C69.9349 16.3021 70.5976 17.1577 71.451 17.3994C71.7753 17.4737 71.975 17.7706 72 18.0923V20.047C72 20.4429 71.7005 20.7398 71.3261 20.7893C69.7539 20.9378 66.1601 21.7048 66.1601 25.5153C66.1601 27.1484 66.6592 28.4598 67.2583 29.9692L67.2923 30.0587C68.058 32.066 68.9303 34.3527 68.9303 37.9366C68.9303 48.6497 59.002 53.9234 38.5946 54.0664C37.7795 56.1155 37.1168 57.9477 36.6364 59.3399C43.3748 57.113 47.9916 60.4533 48.2163 60.6266L46.6689 62.6802C46.4693 62.5318 41.8274 59.2656 35.1141 62.7792C34.9144 62.903 34.7146 62.9524 34.4901 62.9524C34.1907 62.9524 33.8912 62.8535 33.6665 62.6555C33.2673 62.3338 33.0925 61.7896 33.2422 61.2946C33.2452 61.2859 33.2501 61.271 33.2566 61.2502C33.2638 61.2278 33.2732 61.1985 33.2848 61.1625C33.49 60.5184 34.3754 57.7396 35.7935 54.0921C24.9796 54.3444 16.4006 56.6584 10.9809 58.5975C5.32497 60.6055 2.01554 62.6379 1.43969 62.9915L1.42253 63.002L0 60.8493C1.25536 60.0439 14.771 51.7045 36.8354 51.5C37.5323 49.8222 38.3182 48.0407 39.1819 46.2505C39.2569 46.1021 39.3254 45.9597 39.3941 45.8175C39.4627 45.6752 39.5313 45.533 39.6062 45.3845H39.3567C32.257 45.7094 23.6466 46.1291 14.2956 49.3319C13.1534 49.8117 11.9981 50.2694 10.8312 50.7044L10.7962 50.652C10.6167 50.7261 10.4371 50.8012 10.2572 50.8775L9.23395 48.5021C10.7233 47.8679 12.1953 47.3086 13.6479 46.8144C34.0776 38.1489 44.5863 24.4387 47.3678 18.0428ZM57.6475 11.6748C63.1433 11.038 65.6 14.5513 66.834 16.3355C67.4329 17.2015 68.0318 18.0428 68.7806 18.7356C68.506 18.8346 68.2316 18.9336 67.932 19.0573C65.1369 20.245 63.5896 22.5461 63.5896 25.54C63.5896 27.6576 64.2075 29.2362 64.8529 30.8852L64.8623 30.9094C65.6111 32.8146 66.3598 34.7694 66.3598 37.9366C66.3598 41.2256 66.3598 51.0377 39.6597 51.4806C40.2392 50.1228 40.8726 48.7163 41.5528 47.3145C41.9022 46.5972 42.2517 45.879 42.6011 45.2112C50.138 44.7907 56.0027 43.8504 58.723 38.4068C59.5965 36.65 59.5216 34.4973 58.5234 32.9136C57.6 31.4538 56.0527 30.662 54.1311 30.662C49.8135 30.662 45.3962 34.72 40.9788 42.7369C40.4048 42.7616 39.8309 42.7863 39.2318 42.8112C34.9133 43.0035 30.0587 43.229 24.8069 44.0727C29.5007 41.3113 33.8249 38.1533 37.6347 34.6704C42.7628 29.9985 47.0355 24.6481 49.2658 20.1498C50.0773 18.5131 50.9974 16.5068 52.3537 14.83C53.6924 13.1748 55.3822 11.9373 57.6475 11.6748ZM54.1559 33.2354C51.1362 33.2354 47.6422 36.5015 44.0984 42.5389C50.5872 42.0441 54.5303 41.0295 56.402 37.2685C56.8762 36.3282 56.8514 35.0912 56.3272 34.2746C55.9029 33.6065 55.1792 33.2354 54.1559 33.2354Z" fill="#3ED0DA"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#3ed0da" fill-rule="evenodd" d="M47.368 18.043c.688-1.499 1.668-3.26 2.943-4.837 1.617-1.999 3.875-3.744 7.033-4.11 7.097-.822 10.438 3.937 11.653 5.852.938 1.354 1.6 2.21 2.454 2.451.324.075.524.372.549.693v1.955c0 .396-.3.693-.674.742-1.572.149-5.166.916-5.166 4.726 0 1.633.5 2.945 1.098 4.454l.034.09c.766 2.007 1.638 4.294 1.638 7.878 0 10.713-9.928 15.986-30.335 16.13a123 123 0 0 0-1.959 5.273c6.739-2.227 11.356 1.113 11.58 1.287L46.67 62.68c-.2-.148-4.842-3.414-11.555.1-.2.123-.4.172-.624.172-.3 0-.599-.099-.824-.296a1.285 1.285 0 0 1-.41-1.406l.029-.087c.205-.645 1.09-3.423 2.509-7.07-10.814.251-19.393 2.565-24.813 4.504-5.656 2.008-8.965 4.04-9.541 4.395l-.017.01L0 60.849c1.255-.805 14.771-9.144 36.835-9.349a104 104 0 0 1 2.347-5.25c.075-.148.143-.29.212-.432s.137-.285.212-.433h-.25c-7.099.324-15.71.744-25.06 3.947q-1.715.72-3.465 1.372l-.035-.052-.539.225-1.023-2.375a63 63 0 0 1 4.414-1.688c20.43-8.665 30.938-22.375 33.72-28.771m10.28-6.368c5.495-.637 7.952 2.876 9.186 4.66.599.866 1.198 1.708 1.947 2.4-.275.1-.55.199-.849.322-2.795 1.188-4.342 3.49-4.342 6.483 0 2.118.617 3.696 1.263 5.345l.01.024c.748 1.906 1.497 3.86 1.497 7.028 0 3.289 0 13.1-26.7 13.544a95 95 0 0 1 1.893-4.166c.35-.718.699-1.436 1.048-2.104 7.537-.42 13.402-1.36 16.122-6.804.874-1.757.799-3.91-.2-5.493-.923-1.46-2.47-2.252-4.392-2.252-4.318 0-8.735 4.058-13.152 12.075-.574.025-1.148.05-1.747.074-4.319.193-9.173.418-14.425 1.262 4.694-2.762 9.018-5.92 12.828-9.403 5.128-4.672 9.4-10.022 11.63-14.52.812-1.637 1.732-3.643 3.089-5.32 1.338-1.655 3.028-2.893 5.294-3.155m-3.492 21.56c-3.02 0-6.514 3.267-10.058 9.304 6.49-.495 10.432-1.51 12.304-5.27.474-.94.45-2.178-.075-2.994-.424-.669-1.148-1.04-2.171-1.04" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/strapi.svg b/web/packages/design/src/ResourceIcon/assets/strapi.svg
new file mode 100644
index 0000000000000..ae29fccfe8e5d
--- /dev/null
+++ b/web/packages/design/src/ResourceIcon/assets/strapi.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="600" height="600" fill="none" viewBox="0 0 600 600"><path fill="#4945ff" d="M0 208C0 109.948 0 60.922 30.46 30.46 60.923 0 109.949 0 208 0h184c98.052 0 147.078 0 177.539 30.46C600 60.923 600 109.949 600 208v184c0 98.052 0 147.078-30.461 177.539S490.052 600 392 600H208c-98.052 0-147.078 0-177.54-30.461C0 539.078 0 490.052 0 392z"/><path fill="#fff" fill-rule="evenodd" d="M414 182H212v103h103v103h103V186a4 4 0 0 0-4-4" clip-rule="evenodd"/><path fill="#fff" d="M311 285h4v4h-4z"/><path fill="#9593ff" d="M212 285h99a4 4 0 0 1 4 4v99h-99a4 4 0 0 1-4-4zm103 103h103l-99.586 99.586c-1.26 1.26-3.414.367-3.414-1.414zM212 285h-98.172c-1.782 0-2.674-2.154-1.414-3.414L212 182z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/stripe-dark.svg b/web/packages/design/src/ResourceIcon/assets/stripe-dark.svg
index c5aec22b7d39a..dffa4ce83d409 100644
--- a/web/packages/design/src/ResourceIcon/assets/stripe-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/stripe-dark.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M71.9276 37.2939H62.207C62.4362 39.6215 64.1367 40.3693 66.0663 40.3693C68.0442 40.3693 69.6362 39.923 70.9508 39.2235V43.2276C69.2825 44.1874 67.3737 44.6479 65.4513 44.5542C60.6151 44.5542 57.2141 41.5391 57.2141 35.5331C57.2141 30.4798 60.0965 26.4637 64.8121 26.4637C69.5397 26.4637 72 30.4195 72 35.509C72 35.9914 71.9518 37.0286 71.9276 37.2939ZM64.7879 30.516C63.5457 30.516 62.1709 31.3964 62.1709 33.6276H67.2965C67.2965 31.3964 66.006 30.516 64.7879 30.516ZM49.3869 44.5542C47.6503 44.5542 46.5889 43.8306 45.8894 43.2999L45.8653 48.8838L40.8965 49.9331V26.7894H45.4312L45.5276 28.0195C46.5794 27.0219 47.9735 26.4651 49.4231 26.4637C52.9206 26.4637 56.201 29.5994 56.201 35.3884C56.201 41.6959 52.9447 44.5542 49.3869 44.5542ZM48.2412 30.8657C47.0955 30.8657 46.3839 31.2758 45.8653 31.8426L45.8894 39.2235C46.3719 39.7542 47.0714 40.1642 48.2412 40.1642C50.0744 40.1642 51.3045 38.1743 51.3045 35.4969C51.3045 32.9039 50.0503 30.8657 48.2412 30.8657ZM34.0583 26.7894H39.0392V44.2044H34.0583V26.7894ZM34.0583 21.121L39.0392 20.0718V24.124L34.0583 25.1853V21.1331V21.121ZM28.8482 32.3974V44.2044H23.8794V26.7894H28.3417L28.4864 28.2607C29.6925 26.126 32.1889 26.5602 32.8523 26.7894V31.3602C32.2251 31.1552 30.0905 30.8416 28.8482 32.3974ZM18.5367 38.0899C18.5367 41.0205 21.6724 40.116 22.2995 39.8507V43.9029C21.6362 44.2647 20.4422 44.5542 18.8141 44.5542C18.1355 44.574 17.46 44.4555 16.8286 44.206C16.1973 43.9565 15.6233 43.5812 15.1415 43.1028C14.6598 42.6245 14.2804 42.0532 14.0265 41.4236C13.7725 40.794 13.6493 40.1193 13.6643 39.4406L13.6764 23.5572L18.5246 22.52V26.7894H22.3116V31.0467H18.5367V38.1019V38.0899ZM12.6151 38.9341C12.6151 42.516 9.82915 44.5542 5.70452 44.5542C3.85365 44.5528 2.02281 44.171 0.325628 43.4326V38.6929C1.98995 39.5974 4.06432 40.2728 5.70452 40.2728C6.81407 40.2728 7.54975 39.9833 7.54975 39.0668C7.54975 36.6788 0 37.5713 0 32.0718C0 28.5622 2.74975 26.4637 6.77789 26.4637C8.41809 26.4637 10.0583 26.7049 11.7106 27.3683V32.0477C10.1837 31.2441 8.49087 30.8064 6.76583 30.7693C5.72864 30.7693 5.02915 31.0708 5.02915 31.8547C5.02915 34.0858 12.6151 33.0245 12.6151 38.9461V38.9341Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" fill-rule="evenodd" d="M71.928 37.294h-9.721c.23 2.328 1.93 3.075 3.86 3.075 1.977 0 3.57-.446 4.884-1.145v4.004a10.05 10.05 0 0 1-5.5 1.326c-4.836 0-8.237-3.015-8.237-9.02 0-5.054 2.883-9.07 7.598-9.07 4.728 0 7.188 3.956 7.188 9.045 0 .482-.048 1.52-.072 1.785m-7.14-6.778c-1.242 0-2.617.88-2.617 3.112h5.125c0-2.232-1.29-3.112-2.508-3.112M49.387 44.554c-1.737 0-2.798-.723-3.498-1.254l-.024 5.584-4.968 1.05V26.788h4.534l.097 1.23a5.67 5.67 0 0 1 3.895-1.555c3.498 0 6.778 3.135 6.778 8.924 0 6.308-3.256 9.166-6.814 9.166M48.24 30.866c-1.145 0-1.857.41-2.376.977l.024 7.38c.483.531 1.182.941 2.352.941 1.833 0 3.063-1.99 3.063-4.667 0-2.593-1.254-4.631-3.063-4.631m-14.183-4.077h4.981v17.415h-4.98zm0-5.668 4.981-1.05v4.053l-4.98 1.061v-4.064m-5.21 11.276v11.807H23.88V26.79h4.463l.144 1.472c1.206-2.135 3.703-1.7 4.366-1.472v4.571c-.627-.205-2.761-.518-4.004 1.037M18.537 38.09c0 2.93 3.135 2.026 3.762 1.76v4.053c-.663.362-1.857.651-3.485.651a5.005 5.005 0 0 1-5.15-5.113l.012-15.884 4.849-1.037v4.27h3.787v4.257h-3.775v7.055zm-5.922.844c0 3.582-2.786 5.62-6.91 5.62a13.5 13.5 0 0 1-5.38-1.121v-4.74c1.665.904 3.74 1.58 5.38 1.58 1.11 0 1.845-.29 1.845-1.206C7.55 36.679 0 37.57 0 32.072c0-3.51 2.75-5.608 6.778-5.608 1.64 0 3.28.24 4.933.904v4.68a11.1 11.1 0 0 0-4.945-1.279c-1.037 0-1.737.302-1.737 1.086 0 2.23 7.586 1.17 7.586 7.091z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/stripe-light.svg b/web/packages/design/src/ResourceIcon/assets/stripe-light.svg
index 5399588eadd20..9387ba2956670 100644
--- a/web/packages/design/src/ResourceIcon/assets/stripe-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/stripe-light.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M71.9276 37.2939H62.207C62.4362 39.6215 64.1367 40.3693 66.0663 40.3693C68.0442 40.3693 69.6362 39.923 70.9508 39.2235V43.2276C69.2825 44.1874 67.3737 44.6479 65.4513 44.5542C60.6151 44.5542 57.2141 41.5391 57.2141 35.5331C57.2141 30.4798 60.0965 26.4637 64.8121 26.4637C69.5397 26.4637 72 30.4195 72 35.509C72 35.9914 71.9518 37.0286 71.9276 37.2939ZM64.7879 30.516C63.5457 30.516 62.1709 31.3964 62.1709 33.6276H67.2965C67.2965 31.3964 66.006 30.516 64.7879 30.516ZM49.3869 44.5542C47.6503 44.5542 46.5889 43.8306 45.8894 43.2999L45.8653 48.8838L40.8965 49.9331V26.7894H45.4312L45.5276 28.0195C46.5794 27.0219 47.9735 26.4651 49.4231 26.4637C52.9206 26.4637 56.201 29.5994 56.201 35.3884C56.201 41.6959 52.9447 44.5542 49.3869 44.5542ZM48.2412 30.8657C47.0955 30.8657 46.3839 31.2758 45.8653 31.8426L45.8894 39.2235C46.3719 39.7542 47.0714 40.1642 48.2412 40.1642C50.0744 40.1642 51.3045 38.1743 51.3045 35.4969C51.3045 32.9039 50.0503 30.8657 48.2412 30.8657ZM34.0583 26.7894H39.0392V44.2044H34.0583V26.7894ZM34.0583 21.121L39.0392 20.0718V24.124L34.0583 25.1853V21.1331V21.121ZM28.8482 32.3974V44.2044H23.8794V26.7894H28.3417L28.4864 28.2607C29.6925 26.126 32.1889 26.5602 32.8523 26.7894V31.3602C32.2251 31.1552 30.0905 30.8416 28.8482 32.3974ZM18.5367 38.0899C18.5367 41.0205 21.6724 40.116 22.2995 39.8507V43.9029C21.6362 44.2647 20.4422 44.5542 18.8141 44.5542C18.1355 44.574 17.46 44.4555 16.8286 44.206C16.1973 43.9565 15.6233 43.5812 15.1415 43.1028C14.6598 42.6245 14.2804 42.0532 14.0265 41.4236C13.7725 40.794 13.6493 40.1193 13.6643 39.4406L13.6764 23.5572L18.5246 22.52V26.7894H22.3116V31.0467H18.5367V38.1019V38.0899ZM12.6151 38.9341C12.6151 42.516 9.82915 44.5542 5.70452 44.5542C3.85365 44.5528 2.02281 44.171 0.325628 43.4326V38.6929C1.98995 39.5974 4.06432 40.2728 5.70452 40.2728C6.81407 40.2728 7.54975 39.9833 7.54975 39.0668C7.54975 36.6788 0 37.5713 0 32.0718C0 28.5622 2.74975 26.4637 6.77789 26.4637C8.41809 26.4637 10.0583 26.7049 11.7106 27.3683V32.0477C10.1837 31.2441 8.49087 30.8064 6.76583 30.7693C5.72864 30.7693 5.02915 31.0708 5.02915 31.8547C5.02915 34.0858 12.6151 33.0245 12.6151 38.9461V38.9341Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" fill-rule="evenodd" d="M71.928 37.294h-9.721c.23 2.328 1.93 3.075 3.86 3.075 1.977 0 3.57-.446 4.884-1.145v4.004a10.05 10.05 0 0 1-5.5 1.326c-4.836 0-8.237-3.015-8.237-9.02 0-5.054 2.883-9.07 7.598-9.07 4.728 0 7.188 3.956 7.188 9.045 0 .482-.048 1.52-.072 1.785m-7.14-6.778c-1.242 0-2.617.88-2.617 3.112h5.125c0-2.232-1.29-3.112-2.508-3.112M49.387 44.554c-1.737 0-2.798-.723-3.498-1.254l-.024 5.584-4.968 1.05V26.788h4.534l.097 1.23a5.67 5.67 0 0 1 3.895-1.555c3.498 0 6.778 3.135 6.778 8.924 0 6.308-3.256 9.166-6.814 9.166M48.24 30.866c-1.145 0-1.857.41-2.376.977l.024 7.38c.483.531 1.182.941 2.352.941 1.833 0 3.063-1.99 3.063-4.667 0-2.593-1.254-4.631-3.063-4.631m-14.183-4.077h4.981v17.415h-4.98zm0-5.668 4.981-1.05v4.053l-4.98 1.061v-4.064m-5.21 11.276v11.807H23.88V26.79h4.463l.144 1.472c1.206-2.135 3.703-1.7 4.366-1.472v4.571c-.627-.205-2.761-.518-4.004 1.037M18.537 38.09c0 2.93 3.135 2.026 3.762 1.76v4.053c-.663.362-1.857.651-3.485.651a5.005 5.005 0 0 1-5.15-5.113l.012-15.884 4.849-1.037v4.27h3.787v4.257h-3.775v7.055zm-5.922.844c0 3.582-2.786 5.62-6.91 5.62a13.5 13.5 0 0 1-5.38-1.121v-4.74c1.665.904 3.74 1.58 5.38 1.58 1.11 0 1.845-.29 1.845-1.206C7.55 36.679 0 37.57 0 32.072c0-3.51 2.75-5.608 6.778-5.608 1.64 0 3.28.24 4.933.904v4.68a11.1 11.1 0 0 0-4.945-1.279c-1.037 0-1.737.302-1.737 1.086 0 2.23 7.586 1.17 7.586 7.091z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/tableau.svg b/web/packages/design/src/ResourceIcon/assets/tableau.svg
index b8e7983dff618..de24ca161a0f4 100644
--- a/web/packages/design/src/ResourceIcon/assets/tableau.svg
+++ b/web/packages/design/src/ResourceIcon/assets/tableau.svg
@@ -1,17 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_12053)">
-<path d="M34.0303 48.4819H37.9706V37.7356H47.881V33.9147H37.9706V23.1685H34.0303V33.9147H24.2393V37.7356H34.0303V48.4819Z" fill="#E8762D"/>
-<path d="M15.7616 64.0044H19.1049V54.4521H27.9407V51.4671H19.1049V41.7954H15.7616V51.4671H6.92578V54.4521H15.7616V64.0044Z" fill="#C72037"/>
-<path d="M52.8954 29.4968H56.2387V19.9445H65.1939V17.0789H56.2387V7.40723H52.8954V17.0789H44.0596V19.9445H52.8954V29.4968Z" fill="#5B879B"/>
-<path d="M34.6264 71.5266H37.4921V64.7207H43.5816V62.2132H37.4921V55.4072H34.6264V62.2132H28.6562V64.7207H34.6264V71.5266Z" fill="#5C6692"/>
-<path d="M15.881 29.4968H18.9855V19.8251H27.9407V17.0789H18.9855V7.40723H15.881V17.0789H6.92578V19.8251H15.881V29.4968Z" fill="#EB9129"/>
-<path d="M63.0444 43.8252H65.91V37.1386H71.9996V34.5118H65.91V27.8252H63.0444V34.5118H57.0742V37.1386H63.0444V43.8252Z" fill="#5C6692"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M52.8954 64.0044H56.2387V54.4521H65.1939V51.4671H56.2387V41.7954H52.8954V51.4671H44.0596V54.4521H52.8954V64.0044Z" fill="#1F457E"/>
-<path d="M43.1045 9.07895V7.0491H37.1343V0.481934H34.9851V7.0491H29.0149V9.07895H34.9851V15.6461H37.1343V9.07895H43.1045ZM5.97015 43.3476H8.1194V36.7804H14.0896V34.7506H8.1194V28.3028H5.97015V34.7506H0V36.8998L5.97015 36.7804V43.3476Z" fill="#7199A6"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_12053">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_12053)"><path fill="#e8762d" d="M34.03 48.482h3.94V37.736h9.911v-3.821h-9.91V23.169h-3.94v10.746h-9.792v3.82h9.791z"/><path fill="#c72037" d="M15.762 64.004h3.343v-9.552h8.836v-2.985h-8.836v-9.672h-3.343v9.672H6.926v2.985h8.836z"/><path fill="#5b879b" d="M52.895 29.497h3.344v-9.552h8.955v-2.866h-8.955V7.407h-3.344v9.672H44.06v2.866h8.835z"/><path fill="#5c6692" d="M34.626 71.527h2.866V64.72h6.09v-2.508h-6.09v-6.806h-2.866v6.806h-5.97v2.508h5.97z"/><path fill="#eb9129" d="M15.881 29.497h3.104v-9.672h8.956V17.08h-8.955V7.407H15.88v9.672H6.926v2.746h8.955z"/><path fill="#5c6692" d="M63.044 43.825h2.866V37.14H72v-2.627h-6.09v-6.687h-2.866v6.687h-5.97v2.627h5.97z"/><path fill="#1f457e" fill-rule="evenodd" d="M52.895 64.004h3.344v-9.552h8.955v-2.985h-8.955v-9.672h-3.344v9.672H44.06v2.985h8.835z" clip-rule="evenodd"/><path fill="#7199a6" d="M43.105 9.079v-2.03h-5.97V.482h-2.15v6.567h-5.97v2.03h5.97v6.567h2.15V9.08zM5.97 43.348h2.15V36.78h5.97v-2.03H8.12v-6.447H5.97v6.448H0V36.9l5.97-.12z"/></g><defs><clipPath id="clip0_16966_12053"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/terraform.svg b/web/packages/design/src/ResourceIcon/assets/terraform.svg
index e46fa81bbdc57..8ffd8c99a71c6 100644
--- a/web/packages/design/src/ResourceIcon/assets/terraform.svg
+++ b/web/packages/design/src/ResourceIcon/assets/terraform.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M47.2803 24.0606V46.7766L66.9603 35.4246V12.6846L47.2803 24.0606Z" fill="#7B42BC"/>
-<path d="M25.4395 12.6846L45.1194 24.0606V46.7766L25.4395 35.4126V12.6846Z" fill="#7B42BC"/>
-<path d="M3.59961 0V22.728L23.2796 34.092V11.364L3.59961 0ZM25.4396 60.636L45.1196 72V49.272L25.4396 37.908V60.636Z" fill="#7B42BC"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#7b42bc" d="M47.28 24.06v22.717l19.68-11.352v-22.74zM25.44 12.685 45.12 24.06v22.716L25.44 35.413zM3.6 0v22.728l19.68 11.364V11.364zm21.84 60.636L45.12 72V49.272L25.44 37.908z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/torq-dark.svg b/web/packages/design/src/ResourceIcon/assets/torq-dark.svg
index 2b11fad848c3a..e2191f412859c 100644
--- a/web/packages/design/src/ResourceIcon/assets/torq-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/torq-dark.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 28.5914H72V43.4081H0V28.5914Z" fill="white"/>
-<path d="M0 54.5206H40.283V69.3373H7.40836C3.31684 69.3373 0 66.0205 0 61.929V54.5206Z" fill="white"/>
-<path d="M32.1801 2.66211H64.5916C68.6832 2.66211 72 5.97895 72 10.0705V17.4788H32.1801V2.66211Z" fill="white"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#fff" d="M0 28.591h72v14.817H0zM0 54.52h40.283v14.817H7.408A7.41 7.41 0 0 1 0 61.93zM32.18 2.662h32.412A7.41 7.41 0 0 1 72 10.07v7.409H32.18z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/torq-light.svg b/web/packages/design/src/ResourceIcon/assets/torq-light.svg
index 8617f3fd480d8..eefa1762d744d 100644
--- a/web/packages/design/src/ResourceIcon/assets/torq-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/torq-light.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M0 28.5894H72V43.4061H0V28.5894Z" fill="black"/>
-<path d="M0 54.5187H40.283V69.3354H7.40836C3.31684 69.3354 0 66.0186 0 61.927V54.5187Z" fill="black"/>
-<path d="M32.1801 2.66016H64.5916C68.6832 2.66016 72 5.97699 72 10.0685V17.4769H32.1801V2.66016Z" fill="black"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#000" d="M0 28.59h72v14.816H0zm0 25.929h40.283v14.816H7.408A7.41 7.41 0 0 1 0 61.927zM32.18 2.66h32.412A7.41 7.41 0 0 1 72 10.07v7.408H32.18z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/troops.ai-dark.svg b/web/packages/design/src/ResourceIcon/assets/troops.ai-dark.svg
index d48a86fbd6d74..af058ce2a660d 100644
--- a/web/packages/design/src/ResourceIcon/assets/troops.ai-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/troops.ai-dark.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16974_12090)">
-<path d="M38.423 16.8132L35.8571 8.91624L33.2913 16.8132H24.9879L31.7055 21.6938L29.1396 29.5907L35.8571 24.7101L42.5747 29.5907L40.0088 21.6938L46.7264 16.8132H38.423Z" fill="white"/>
-<path d="M43.8571 36.1162V40.002H38.0286V57.602H33.4571V40.002H27.6286V36.1162H43.8571Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.7429 72.002L58.4857 62.8591V0.00195312H13V62.8591L35.7429 72.002ZM17.5714 4.57338H53.9143V59.7699L35.7429 67.075L17.5714 59.7699V4.57338Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16974_12090">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" clip-path="url(#clip0_16974_12090)"><path d="m38.423 16.813-2.566-7.897-2.566 7.897h-8.303l6.718 4.88-2.566 7.898 6.717-4.88 6.718 4.88-2.566-7.897 6.717-4.88zm5.434 19.303v3.886H38.03v17.6h-4.572v-17.6H27.63v-3.886z"/><path fill-rule="evenodd" d="m35.743 72.002 22.743-9.143V.002H13v62.857zM17.57 4.573h36.343V59.77l-18.171 7.305L17.57 59.77z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16974_12090"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/troops.ai-light.svg b/web/packages/design/src/ResourceIcon/assets/troops.ai-light.svg
index 6f45d01f1aedd..316fdc71e46bb 100644
--- a/web/packages/design/src/ResourceIcon/assets/troops.ai-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/troops.ai-light.svg
@@ -1,12 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16974_12089)">
-<path d="M38.423 16.8132L35.8571 8.91624L33.2913 16.8132H24.9879L31.7055 21.6938L29.1396 29.5907L35.8571 24.7101L42.5747 29.5907L40.0088 21.6938L46.7264 16.8132H38.423Z" fill="#1C437B"/>
-<path d="M43.8571 36.1162V40.002H38.0286V57.602H33.4571V40.002H27.6286V36.1162H43.8571Z" fill="#1C437B"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M35.7429 72.002L58.4857 62.8591V0.00195312H13V62.8591L35.7429 72.002ZM17.5714 4.57338H53.9143V59.7699L35.7429 67.075L17.5714 59.7699V4.57338Z" fill="#1C437B"/>
-</g>
-<defs>
-<clipPath id="clip0_16974_12089">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#1c437b" clip-path="url(#clip0_16974_12089)"><path d="m38.423 16.813-2.566-7.897-2.566 7.897h-8.303l6.718 4.88-2.566 7.898 6.717-4.88 6.718 4.88-2.566-7.897 6.717-4.88zm5.434 19.303v3.886H38.03v17.6h-4.572v-17.6H27.63v-3.886z"/><path fill-rule="evenodd" d="m35.743 72.002 22.743-9.143V.002H13v62.857zM17.57 4.573h36.343V59.77l-18.171 7.305L17.57 59.77z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16974_12089"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/twilio.svg b/web/packages/design/src/ResourceIcon/assets/twilio.svg
index 4871d461007e7..437d322151b78 100644
--- a/web/packages/design/src/ResourceIcon/assets/twilio.svg
+++ b/web/packages/design/src/ResourceIcon/assets/twilio.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11985)">
-<path d="M27 51.9251C30.8236 51.9251 33.923 48.8255 33.923 45.002C33.923 41.1784 30.8236 38.079 27 38.079C23.1764 38.079 20.0768 41.1784 20.0768 45.002C20.0768 48.8255 23.1764 51.9251 27 51.9251ZM27 33.9251C30.8236 33.9251 33.923 30.8255 33.923 27.002C33.923 23.1784 30.8236 20.0788 27 20.0788C23.1764 20.0788 20.0768 23.1784 20.0768 27.002C20.0768 30.8255 23.1764 33.9251 27 33.9251ZM45 51.9251C48.8236 51.9251 51.9232 48.8255 51.9232 45.002C51.9232 41.1784 48.8236 38.079 45 38.079C41.1764 38.079 38.0768 41.1784 38.0768 45.002C38.0768 48.8255 41.1764 51.9251 45 51.9251ZM45 33.9251C48.8236 33.9251 51.9232 30.8255 51.9232 27.002C51.9232 23.1784 48.8236 20.0788 45 20.0788C41.1764 20.0788 38.0768 23.1784 38.0768 27.002C38.0768 30.8255 41.1764 33.9251 45 33.9251ZM36 0.00195312C55.4999 0.00195312 72 16.502 72 36.002C72 55.5019 55.4999 72.002 36 72.002C16.5 72.002 0 55.5019 0 36.002C0 16.5022 16.5001 0.00195312 36 0.00195312ZM36 9.69425C21.5122 9.69425 9.69232 21.1048 9.69232 35.5187C9.69232 49.9325 21.5122 62.3097 36 62.3097C50.4878 62.3097 62.3077 49.9325 62.3077 35.5187C62.3077 21.1048 50.4878 9.69425 36 9.69425Z" fill="#F22F46"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11985">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_11985)"><path fill="#f22f46" d="M27 51.925a6.923 6.923 0 1 0 0-13.846 6.923 6.923 0 0 0 0 13.846m0-18a6.923 6.923 0 1 0 0-13.846 6.923 6.923 0 0 0 0 13.846m18 18a6.923 6.923 0 1 0 0-13.846 6.923 6.923 0 0 0 0 13.846m0-18a6.923 6.923 0 1 0 0-13.846 6.923 6.923 0 0 0 0 13.846M36 .002c19.5 0 36 16.5 36 36s-16.5 36-36 36-36-16.5-36-36 16.5-36 36-36m0 9.692c-14.488 0-26.308 11.41-26.308 25.825S21.512 62.309 36 62.309s26.308-12.376 26.308-26.79S50.488 9.694 36 9.694"/></g><defs><clipPath id="clip0_16966_11985"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/twitter-dark.svg b/web/packages/design/src/ResourceIcon/assets/twitter-dark.svg
index 3d5e4d680494e..dfc00400ffd07 100644
--- a/web/packages/design/src/ResourceIcon/assets/twitter-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/twitter-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16974_12094)">
-<path d="M43.2038 30.4895L69.4311 0.00244141H63.2161L40.4429 26.474L22.2541 0.00244141H1.27539L28.7805 40.0321L1.27539 72.0024H7.49077L31.5398 44.0476L50.7485 72.0024H71.7272L43.2023 30.4895H43.2038ZM34.691 40.3847L31.9041 36.3987L9.73026 4.68129H19.2767L37.1713 30.2782L39.9581 34.2643L63.219 67.5364H53.6725L34.691 40.3862V40.3847Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16974_12094">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16974_12094)"><path fill="#fff" d="M43.204 30.49 69.43.002h-6.215L40.443 26.474 22.254.002H1.275l27.506 40.03-27.506 31.97h6.216L31.54 44.048l19.209 27.954h20.978L43.202 30.49zm-8.513 9.895-2.787-3.986L9.73 4.68h9.547L37.17 30.278l2.787 3.986L63.22 67.536h-9.547l-18.981-27.15z"/></g><defs><clipPath id="clip0_16974_12094"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/twitter-light.svg b/web/packages/design/src/ResourceIcon/assets/twitter-light.svg
index 7c9caeb7473fd..5d84dde243328 100644
--- a/web/packages/design/src/ResourceIcon/assets/twitter-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/twitter-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16974_12094)">
-<path d="M43.2038 30.4895L69.4311 0.00244141H63.2161L40.4429 26.474L22.2541 0.00244141H1.27539L28.7805 40.0321L1.27539 72.0024H7.49077L31.5398 44.0476L50.7485 72.0024H71.7272L43.2023 30.4895H43.2038ZM34.691 40.3847L31.9041 36.3987L9.73026 4.68129H19.2767L37.1713 30.2782L39.9581 34.2643L63.219 67.5364H53.6725L34.691 40.3862V40.3847Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16974_12094">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16974_12094)"><path fill="#000" d="M43.204 30.49 69.43.002h-6.215L40.443 26.474 22.254.002H1.275l27.506 40.03-27.506 31.97h6.216L31.54 44.048l19.209 27.954h20.978L43.202 30.49zm-8.513 9.895-2.787-3.986L9.73 4.68h9.547L37.17 30.278l2.787 3.986L63.22 67.536h-9.547l-18.981-27.15z"/></g><defs><clipPath id="clip0_16974_12094"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/userorbit-dark.svg b/web/packages/design/src/ResourceIcon/assets/userorbit-dark.svg
index 9e91f115be361..9e198c9ef9d54 100644
--- a/web/packages/design/src/ResourceIcon/assets/userorbit-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/userorbit-dark.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<ellipse cx="30.2222" cy="34.2242" rx="30.2222" ry="30.2222" fill="white"/>
-<ellipse cx="56.8885" cy="52.8909" rx="15.1111" ry="15.1111" fill="#4B4EF0"/>
-<path d="M60.1924 38.142C58.9002 48.1248 52.7369 56.5797 44.1641 61.0452C42.6535 58.6928 41.7773 55.8942 41.7773 52.8909C41.7773 44.5452 48.5428 37.7798 56.8885 37.7798C58.0233 37.7798 59.129 37.9048 60.1924 38.142Z" fill="#FFC1D9"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><circle cx="30.222" cy="34.224" r="30.222" fill="#fff"/><circle cx="56.889" cy="52.891" r="15.111" fill="#4b4ef0"/><path fill="#ffc1d9" d="M60.192 38.142C58.9 48.125 52.737 56.58 44.164 61.045a15.04 15.04 0 0 1-2.387-8.154c0-8.346 6.766-15.111 15.112-15.111 1.134 0 2.24.125 3.303.362"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/userorbit-light.svg b/web/packages/design/src/ResourceIcon/assets/userorbit-light.svg
index 96798ffc48bb9..f0264b91ca8f9 100644
--- a/web/packages/design/src/ResourceIcon/assets/userorbit-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/userorbit-light.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<ellipse cx="30.2222" cy="34.2242" rx="30.2222" ry="30.2222" fill="#101144"/>
-<ellipse cx="56.8885" cy="52.8909" rx="15.1111" ry="15.1111" fill="#4B4EF0"/>
-<path d="M60.1924 38.142C58.9002 48.1248 52.7369 56.5797 44.1641 61.0452C42.6535 58.6928 41.7773 55.8942 41.7773 52.8909C41.7773 44.5452 48.5428 37.7798 56.8885 37.7798C58.0233 37.7798 59.129 37.9048 60.1924 38.142Z" fill="#FFC1D9"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><circle cx="30.222" cy="34.224" r="30.222" fill="#101144"/><circle cx="56.889" cy="52.891" r="15.111" fill="#4b4ef0"/><path fill="#ffc1d9" d="M60.192 38.142C58.9 48.125 52.737 56.58 44.164 61.045a15.04 15.04 0 0 1-2.387-8.154c0-8.346 6.766-15.111 15.112-15.111 1.134 0 2.24.125 3.303.362"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/validity.svg b/web/packages/design/src/ResourceIcon/assets/validity.svg
index 63c135e9f4a1f..0aab1581a1d99 100644
--- a/web/packages/design/src/ResourceIcon/assets/validity.svg
+++ b/web/packages/design/src/ResourceIcon/assets/validity.svg
@@ -1,5 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M61.3317 4.00098L43.7013 34.5469C40.8402 39.5027 40.8402 45.6084 43.7013 50.5642L48.3006 58.5327L70.557 19.9826C74.657 12.8786 69.5319 4.00098 61.3317 4.00098Z" fill="#1996FF"/>
-<path d="M50.5827 11.9784L55.182 4.00098H10.6692C2.46904 4.00098 -2.65608 12.8786 1.44401 19.9826H36.7137C42.436 19.9826 47.7216 16.9253 50.5827 11.9695V11.9784Z" fill="#43C462"/>
-<path d="M45.2262 63.854L27.5958 33.308C24.7346 28.3522 19.4491 25.2949 13.7268 25.2949H4.51941L26.7758 63.845C30.8759 70.949 41.1261 70.949 45.2262 63.845V63.854Z" fill="#1951C4"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#1996ff" d="m61.332 4.001-17.63 30.546a16.02 16.02 0 0 0 0 16.017l4.599 7.969 22.256-38.55C74.657 12.879 69.532 4 61.332 4"/><path fill="#43c462" d="m50.583 11.978 4.599-7.977H10.669c-8.2 0-13.325 8.878-9.225 15.982h35.27a16.02 16.02 0 0 0 13.869-8.014z"/><path fill="#1951c4" d="m45.226 63.854-17.63-30.546a16.02 16.02 0 0 0-13.87-8.013H4.52l22.257 38.55c4.1 7.104 14.35 7.104 18.45 0z"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/valimail.svg b/web/packages/design/src/ResourceIcon/assets/valimail.svg
index 2b9766423e194..03f04d82e3f88 100644
--- a/web/packages/design/src/ResourceIcon/assets/valimail.svg
+++ b/web/packages/design/src/ResourceIcon/assets/valimail.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16975_12117)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M2.53597 15.0024C5.05807 15.0266 13.0079 15.6503 19.7636 22.1852C24.2937 26.5525 27.3654 30.1979 29.6006 32.8618C32.8431 36.7199 34.2387 38.2976 35.9792 38.2976C37.7197 38.2976 39.0944 36.7199 42.3594 32.8618C44.593 30.1979 47.6647 26.5767 52.1964 22.1852C59.0907 15.5133 67.2098 15.0024 69.553 15.0024H72.001V19.6486H69.4176C67.3871 19.6695 61.0278 20.1772 55.6113 25.4663C51.2504 29.687 48.3947 33.0762 46.0966 35.8029C42.3368 40.2573 40.0823 42.9422 36.0002 42.9422C31.9197 42.9422 29.6651 40.2573 25.9053 35.8029C23.6072 33.0762 20.7499 29.687 16.3906 25.4663C12.2231 21.4374 7.47543 20.203 4.79056 19.8194V56.9016H0.000976562V15.0024H2.53597ZM72.001 40.9825V56.9032H55.5259V52.7453H67.2098V40.9809L72.001 40.9825Z" fill="#008FFB"/>
-</g>
-<defs>
-<clipPath id="clip0_16975_12117">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16975_12117)"><path fill="#008ffb" fill-rule="evenodd" d="M2.536 15.002c2.522.025 10.472.648 17.228 7.183 4.53 4.368 7.601 8.013 9.837 10.677 3.242 3.858 4.638 5.436 6.378 5.436s3.115-1.578 6.38-5.436c2.234-2.664 5.306-6.285 9.837-10.677 6.895-6.672 15.014-7.183 17.357-7.183h2.448v4.647h-2.583c-2.03.02-8.39.528-13.807 5.817-4.36 4.221-7.216 7.61-9.514 10.337-3.76 4.454-6.015 7.14-10.097 7.14-4.08 0-6.335-2.686-10.095-7.14-2.298-2.727-5.155-6.116-9.514-10.337-4.168-4.029-8.916-5.263-11.6-5.647v37.083H0v-41.9zm69.465 25.98v15.921H55.526v-4.158H67.21V40.981z" clip-rule="evenodd"/></g><defs><clipPath id="clip0_16975_12117"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/varicent-dark.svg b/web/packages/design/src/ResourceIcon/assets/varicent-dark.svg
index 861cefedeaa7a..e34e1f0b645db 100644
--- a/web/packages/design/src/ResourceIcon/assets/varicent-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/varicent-dark.svg
@@ -1,21 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16975_12141)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M15.6726 27.0897C15.6769 28.6029 15.2214 30.0835 14.3638 31.3439C13.5062 32.6044 12.2849 33.5883 10.8545 34.171C9.4241 34.7538 7.84878 34.9093 6.32784 34.6179C4.80687 34.3265 3.40861 33.6012 2.30989 32.5339C1.21116 31.4665 0.461346 30.105 0.155276 28.6216C-0.150796 27.1381 0.000629068 25.5994 0.590395 24.1999C1.18016 22.8005 2.18178 21.6033 3.46855 20.7597C4.75533 19.9161 6.26946 19.464 7.81943 19.4607C8.85012 19.4532 9.87213 19.6452 10.8264 20.0257C11.7806 20.4062 12.6481 20.9676 13.3788 21.6774C14.1094 22.3872 14.6887 23.2314 15.0832 24.1611C15.4777 25.0908 15.6795 26.0876 15.677 27.0939" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.5376 16.7893C29.5376 18.1274 29.1313 19.4355 28.3698 20.5482C27.6085 21.6609 26.5262 22.5282 25.2601 23.0405C23.9938 23.5528 22.6005 23.687 21.2561 23.4263C19.9118 23.1655 18.6768 22.5215 17.7073 21.5756C16.7378 20.6296 16.0774 19.4243 15.8095 18.112C15.5416 16.7996 15.6782 15.4392 16.2021 14.2026C16.7261 12.9661 17.6137 11.909 18.7529 11.165C19.8922 10.4209 21.2317 10.0233 22.6024 10.0225C23.5135 10.0199 24.4162 10.1931 25.2585 10.5322C26.1009 10.8713 26.8663 11.3695 27.5109 11.9983C28.1552 12.6272 28.6659 13.3741 29.0138 14.1963C29.3617 15.0185 29.5397 15.8997 29.5376 16.7893Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.2256 37.433C29.2256 38.831 28.8011 40.1976 28.0056 41.3597C27.2103 42.522 26.0797 43.4279 24.7568 43.9629C23.434 44.4978 21.9784 44.6379 20.5741 44.3651C19.1698 44.0923 17.8798 43.4194 16.8674 42.4308C15.855 41.4423 15.1655 40.183 14.8862 38.812C14.6068 37.441 14.7502 36.0199 15.2981 34.7283C15.8461 33.4368 16.7739 32.333 17.9644 31.5564C19.1549 30.7798 20.5546 30.3652 21.9864 30.3652C22.9371 30.3652 23.8784 30.548 24.7568 30.9032C25.6351 31.2584 26.4333 31.779 27.1054 32.4353C27.7775 33.0917 28.3109 33.8708 28.6746 34.7283C29.0386 35.5858 29.2256 36.505 29.2256 37.433Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.0981 26.8731C41.0981 28.0921 40.7278 29.2837 40.0342 30.2972C39.3405 31.3107 38.3545 32.1007 37.201 32.5671C36.0477 33.0336 34.7783 33.1557 33.5539 32.9178C32.3292 32.68 31.2045 32.0931 30.3217 31.2311C29.4389 30.3692 28.8374 29.271 28.594 28.0755C28.3503 26.88 28.4755 25.6407 28.9533 24.5146C29.4311 23.3884 30.2401 22.4259 31.2783 21.7486C32.3164 21.0714 33.5367 20.71 34.7854 20.71C35.6144 20.7098 36.4354 20.8691 37.2013 21.1787C37.9674 21.4884 38.6632 21.9424 39.2496 22.5147C39.8357 23.087 40.3007 23.7665 40.6179 24.5144C40.9352 25.2622 41.0983 26.0637 41.0981 26.8731Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.7606 47.0888C41.7606 48.3675 41.3722 49.6175 40.6444 50.6808C39.9167 51.7439 38.8825 52.5727 37.6726 53.0622C36.4624 53.5517 35.1309 53.6795 33.8462 53.4301C32.5614 53.1807 31.3814 52.5649 30.4552 51.6605C29.529 50.7564 28.8985 49.6042 28.6428 48.3501C28.3874 47.0958 28.5184 45.7957 29.0198 44.6144C29.521 43.4328 30.3697 42.4232 31.4588 41.7127C32.5479 41.0021 33.8282 40.6231 35.1382 40.6231C36.0083 40.6218 36.8698 40.7883 37.6739 41.1128C38.4777 41.4375 39.2083 41.9138 39.8235 42.5142C40.4387 43.1148 40.9266 43.828 41.2589 44.6131C41.5912 45.398 41.7619 46.2392 41.7606 47.0888Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M51.6906 36.1395C51.6909 37.2479 51.3545 38.3315 50.7239 39.253C50.0936 40.1748 49.1973 40.8932 48.1485 41.3174C47.0999 41.7417 45.9459 41.8529 44.8323 41.637C43.7191 41.4208 42.6962 40.8872 41.8934 40.1036C41.0907 39.32 40.5438 38.3216 40.3222 37.2346C40.1008 36.1476 40.2143 35.021 40.6487 33.997C41.0829 32.973 41.8186 32.0978 42.7625 31.482C43.7064 30.8663 44.816 30.5376 45.9513 30.5376C49.1292 30.58 51.6906 33.082 51.6906 36.1395Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M53.2839 56.0091C53.2961 56.7893 53.1495 57.564 52.8523 58.2883C52.5551 59.0127 52.1132 59.672 51.5525 60.228C50.9916 60.784 50.3234 61.2257 49.5861 61.527C48.849 61.8284 48.0576 61.9835 47.2585 61.9835C46.4593 61.9835 45.668 61.8284 44.9309 61.527C44.1936 61.2257 43.5254 60.784 42.9645 60.228C42.4038 59.672 41.9619 59.0127 41.6647 58.2883C41.3674 57.564 41.2209 56.7893 41.2331 56.0091C41.2331 52.7763 43.9262 50.1045 47.2361 50.1045C48.0309 50.1022 48.8186 50.2534 49.5533 50.549C50.2883 50.845 50.956 51.2799 51.518 51.8286C52.0802 52.3773 52.5255 53.0291 52.8284 53.7467C53.1316 54.4643 53.2862 55.233 53.2839 56.0091Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M60.5214 45.4077C60.523 46.397 60.2237 47.3643 59.6617 48.1876C59.1 49.0106 58.3006 49.6526 57.3648 50.0322C56.429 50.4115 55.3991 50.5115 54.4051 50.3193C53.4114 50.127 52.4982 49.6513 51.7814 48.9522C51.0643 48.2531 50.5761 47.3622 50.3782 46.3921C50.1799 45.4217 50.2813 44.416 50.6689 43.502C51.0565 42.588 51.713 41.8071 52.5556 41.2576C53.3981 40.7078 54.3885 40.4148 55.4017 40.415C56.7582 40.4161 58.059 40.9424 59.0187 41.8783C59.9784 42.8141 60.5188 44.0835 60.5214 45.4077Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M59.3743 27.6082C59.3743 28.4265 59.1257 29.2265 58.6599 29.9069C58.1943 30.5873 57.5326 31.1176 56.7581 31.4308C55.9836 31.7439 55.1315 31.8259 54.3094 31.6662C53.4874 31.5066 52.7324 31.1125 52.1396 30.5339C51.547 29.9552 51.1432 29.218 50.9798 28.4154C50.8164 27.6128 50.9003 26.7809 51.2209 26.0249C51.5418 25.2688 52.085 24.6226 52.7818 24.168C53.4789 23.7134 54.298 23.4707 55.1364 23.4707C57.4759 23.5131 59.3743 25.3239 59.3743 27.6082Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.6125 36.2254C66.6125 37.0437 66.3641 37.8437 65.8983 38.5241C65.4327 39.2045 64.7708 39.7348 63.9965 40.0479C63.2221 40.3612 62.3699 40.443 61.5479 40.2835C60.7259 40.1237 59.9706 39.7296 59.378 39.151C58.7854 38.5724 58.3817 37.8351 58.2183 37.0326C58.0546 36.23 58.1385 35.3981 58.4594 34.642C58.7802 33.886 59.3232 33.2398 60.0203 32.7852C60.717 32.3306 61.5365 32.0879 62.3746 32.0879C63.4985 32.0883 64.5762 32.5243 65.3709 33.3002C66.1656 34.076 66.6122 35.1282 66.6125 36.2254Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.2187 20.5818C66.2187 21.2807 66.0064 21.964 65.6086 22.5451C65.2111 23.1263 64.6458 23.5792 63.9843 23.8467C63.3229 24.1142 62.5952 24.1842 61.8929 24.0478C61.1907 23.9114 60.5458 23.5749 60.0398 23.0806C59.5334 22.5864 59.1886 21.9567 59.0491 21.2712C58.9093 20.5857 58.981 19.8751 59.2549 19.2294C59.529 18.5837 59.993 18.0318 60.5882 17.6434C61.1834 17.2551 61.8833 17.0479 62.5991 17.0479C63.5577 17.052 64.4762 17.4256 65.154 18.0874C65.8318 18.7493 66.2145 19.6458 66.2187 20.5818Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72.0011 28.5115C72.0011 29.2104 71.7889 29.8936 71.3911 30.4748C70.9934 31.056 70.428 31.5089 69.7666 31.7764C69.1051 32.0439 68.3774 32.1138 67.6751 31.9775C66.9732 31.8411 66.3281 31.5046 65.822 31.0103C65.3156 30.5161 64.9709 29.8864 64.8313 29.2009C64.6916 28.5154 64.7633 27.8048 65.0374 27.1591C65.3112 26.5133 65.7752 25.9614 66.3704 25.5731C66.9656 25.1848 67.6655 24.9775 68.3813 24.9775C69.3402 24.9816 70.2584 25.3553 70.9362 26.0171C71.6143 26.679 71.997 27.5755 72.0011 28.5115Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16975_12141">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#fff" fill-rule="evenodd" clip-path="url(#clip0_16975_12141)" clip-rule="evenodd"><path d="M15.673 27.09a7.5 7.5 0 0 1-1.31 4.254 7.8 7.8 0 0 1-3.508 2.827 8 8 0 0 1-4.527.447 7.9 7.9 0 0 1-4.018-2.084 7.6 7.6 0 0 1-2.155-3.912A7.5 7.5 0 0 1 .59 24.2a7.7 7.7 0 0 1 2.879-3.44 7.97 7.97 0 0 1 4.35-1.3 8 8 0 0 1 3.007.566c.955.38 1.822.942 2.553 1.651s1.31 1.554 1.704 2.484c.395.93.597 1.927.594 2.933M29.538 16.79a6.65 6.65 0 0 1-1.168 3.758 6.9 6.9 0 0 1-3.11 2.493 7.1 7.1 0 0 1-4.004.385 7 7 0 0 1-3.549-1.85 6.7 6.7 0 0 1-1.898-3.464 6.6 6.6 0 0 1 .393-3.91 6.8 6.8 0 0 1 2.55-3.037 7.05 7.05 0 0 1 3.85-1.142 7.1 7.1 0 0 1 2.657.51 6.9 6.9 0 0 1 2.252 1.465 6.8 6.8 0 0 1 1.503 2.198c.348.822.526 1.704.524 2.593m-.312 20.644a6.95 6.95 0 0 1-1.22 3.927 7.2 7.2 0 0 1-3.25 2.603 7.4 7.4 0 0 1-4.182.402 7.3 7.3 0 0 1-3.707-1.934 7 7 0 0 1-1.98-3.619 6.9 6.9 0 0 1 .411-4.084 7.1 7.1 0 0 1 2.666-3.172 7.39 7.39 0 0 1 6.792-.653 7.3 7.3 0 0 1 2.35 1.532 7.1 7.1 0 0 1 1.569 2.293 6.9 6.9 0 0 1 .55 2.705m11.873-10.56a6.06 6.06 0 0 1-1.064 3.424 6.3 6.3 0 0 1-2.833 2.27 6.45 6.45 0 0 1-3.647.35 6.36 6.36 0 0 1-3.232-1.686 6.1 6.1 0 0 1-1.728-3.155 6.03 6.03 0 0 1 .36-3.561 6.2 6.2 0 0 1 2.324-2.766 6.45 6.45 0 0 1 5.923-.57 6.3 6.3 0 0 1 2.049 1.336 6.2 6.2 0 0 1 1.368 2c.317.747.48 1.549.48 2.358m.662 20.216a6.36 6.36 0 0 1-1.116 3.592 6.6 6.6 0 0 1-2.971 2.381 6.77 6.77 0 0 1-3.827.368 6.67 6.67 0 0 1-3.39-1.77 6.4 6.4 0 0 1-1.813-3.31 6.3 6.3 0 0 1 .377-3.736 6.5 6.5 0 0 1 2.439-2.901 6.74 6.74 0 0 1 3.68-1.09 6.8 6.8 0 0 1 2.535.49 6.6 6.6 0 0 1 2.15 1.401 6.5 6.5 0 0 1 1.435 2.1c.332.784.503 1.625.502 2.475M51.69 36.14a5.5 5.5 0 0 1-.966 3.113 5.7 5.7 0 0 1-2.575 2.064 5.87 5.87 0 0 1-3.317.32 5.8 5.8 0 0 1-2.939-1.533 5.57 5.57 0 0 1-1.57-2.87 5.5 5.5 0 0 1 .326-3.237 5.63 5.63 0 0 1 2.114-2.515 5.84 5.84 0 0 1 3.188-.944c3.178.042 5.74 2.544 5.74 5.601m1.593 19.871a5.8 5.8 0 0 1-.432 2.278 5.9 5.9 0 0 1-1.3 1.94 6 6 0 0 1-1.966 1.299 6.15 6.15 0 0 1-4.655 0 6 6 0 0 1-1.966-1.299 5.9 5.9 0 0 1-1.3-1.94 5.8 5.8 0 0 1-.432-2.279c0-3.233 2.693-5.904 6.003-5.904a6.2 6.2 0 0 1 2.317.444c.735.296 1.403.73 1.965 1.28a5.9 5.9 0 0 1 1.31 1.918c.304.717.458 1.486.456 2.262m7.237-10.601a4.9 4.9 0 0 1-.86 2.78 5.1 5.1 0 0 1-2.296 1.844c-.936.38-1.966.48-2.96.287a5.16 5.16 0 0 1-2.624-1.367 4.96 4.96 0 0 1-1.403-2.56 4.9 4.9 0 0 1 .29-2.89 5.03 5.03 0 0 1 1.888-2.244 5.2 5.2 0 0 1 2.846-.843 5.2 5.2 0 0 1 3.617 1.463 4.94 4.94 0 0 1 1.502 3.53m-1.147-17.8c0 .819-.248 1.619-.714 2.299a4.2 4.2 0 0 1-1.902 1.524 4.33 4.33 0 0 1-2.449.235 4.27 4.27 0 0 1-2.17-1.132 4.1 4.1 0 0 1-1.16-2.119 4.05 4.05 0 0 1 .242-2.39 4.16 4.16 0 0 1 1.56-1.857 4.3 4.3 0 0 1 2.355-.697c2.34.042 4.238 1.853 4.238 4.137m7.239 8.617a4.07 4.07 0 0 1-.715 2.3 4.2 4.2 0 0 1-1.901 1.523 4.33 4.33 0 0 1-2.45.235 4.27 4.27 0 0 1-2.169-1.132 4.1 4.1 0 0 1-1.16-2.118 4.04 4.04 0 0 1 .241-2.391 4.16 4.16 0 0 1 1.561-1.857 4.3 4.3 0 0 1 2.355-.697 4.3 4.3 0 0 1 2.996 1.212 4.1 4.1 0 0 1 1.242 2.925m-.394-15.643c0 .699-.213 1.382-.61 1.963a3.6 3.6 0 0 1-1.625 1.302 3.7 3.7 0 0 1-2.091.2 3.65 3.65 0 0 1-1.853-.966 3.5 3.5 0 0 1-.99-1.81 3.46 3.46 0 0 1 .205-2.042 3.56 3.56 0 0 1 1.333-1.586 3.7 3.7 0 0 1 2.011-.595 3.68 3.68 0 0 1 2.555 1.04 3.5 3.5 0 0 1 1.065 2.494m5.782 7.93c0 .698-.212 1.382-.61 1.963a3.6 3.6 0 0 1-1.624 1.301 3.7 3.7 0 0 1-2.092.201 3.65 3.65 0 0 1-1.853-.967 3.5 3.5 0 0 1-.99-1.81 3.46 3.46 0 0 1 .205-2.04 3.55 3.55 0 0 1 1.333-1.587 3.7 3.7 0 0 1 2.011-.596 3.68 3.68 0 0 1 2.555 1.04 3.5 3.5 0 0 1 1.065 2.495"/></g><defs><clipPath id="clip0_16975_12141"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/varicent-light.svg b/web/packages/design/src/ResourceIcon/assets/varicent-light.svg
index 796350088b42e..9a930bb68e76e 100644
--- a/web/packages/design/src/ResourceIcon/assets/varicent-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/varicent-light.svg
@@ -1,21 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16975_12140)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M15.6726 27.0897C15.6769 28.6029 15.2214 30.0835 14.3638 31.3439C13.5062 32.6044 12.2849 33.5883 10.8545 34.171C9.4241 34.7538 7.84878 34.9093 6.32784 34.6179C4.80687 34.3265 3.40861 33.6012 2.30989 32.5339C1.21116 31.4665 0.461346 30.105 0.155276 28.6216C-0.150796 27.1381 0.000629068 25.5994 0.590395 24.1999C1.18016 22.8005 2.18178 21.6033 3.46855 20.7597C4.75533 19.9161 6.26946 19.464 7.81943 19.4607C8.85012 19.4532 9.87213 19.6452 10.8264 20.0257C11.7806 20.4062 12.6481 20.9676 13.3788 21.6774C14.1094 22.3872 14.6887 23.2314 15.0832 24.1611C15.4777 25.0908 15.6795 26.0876 15.677 27.0939" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.5376 16.7893C29.5376 18.1274 29.1313 19.4355 28.3698 20.5482C27.6085 21.6609 26.5262 22.5282 25.2601 23.0405C23.9938 23.5528 22.6005 23.687 21.2561 23.4263C19.9118 23.1655 18.6768 22.5215 17.7073 21.5756C16.7378 20.6296 16.0774 19.4243 15.8095 18.112C15.5416 16.7996 15.6782 15.4392 16.2021 14.2026C16.7261 12.9661 17.6137 11.909 18.7529 11.165C19.8922 10.4209 21.2317 10.0233 22.6024 10.0225C23.5135 10.0199 24.4162 10.1931 25.2585 10.5322C26.1009 10.8713 26.8663 11.3695 27.5109 11.9983C28.1552 12.6272 28.6659 13.3741 29.0138 14.1963C29.3617 15.0185 29.5397 15.8997 29.5376 16.7893Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M29.2256 37.433C29.2256 38.831 28.8011 40.1976 28.0056 41.3597C27.2103 42.522 26.0797 43.4279 24.7568 43.9629C23.434 44.4978 21.9784 44.6379 20.5741 44.3651C19.1698 44.0923 17.8798 43.4194 16.8674 42.4308C15.855 41.4423 15.1655 40.183 14.8862 38.812C14.6068 37.441 14.7502 36.0199 15.2981 34.7283C15.8461 33.4368 16.7739 32.333 17.9644 31.5564C19.1549 30.7798 20.5546 30.3652 21.9864 30.3652C22.9371 30.3652 23.8784 30.548 24.7568 30.9032C25.6351 31.2584 26.4333 31.779 27.1054 32.4353C27.7775 33.0917 28.3109 33.8708 28.6746 34.7283C29.0386 35.5858 29.2256 36.505 29.2256 37.433Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.0981 26.8731C41.0981 28.0921 40.7278 29.2837 40.0342 30.2972C39.3405 31.3107 38.3545 32.1007 37.201 32.5671C36.0477 33.0336 34.7783 33.1557 33.5539 32.9178C32.3292 32.68 31.2045 32.0931 30.3217 31.2311C29.4389 30.3692 28.8374 29.271 28.594 28.0755C28.3503 26.88 28.4755 25.6407 28.9533 24.5146C29.4311 23.3884 30.2401 22.4259 31.2783 21.7486C32.3164 21.0714 33.5367 20.71 34.7854 20.71C35.6144 20.7098 36.4354 20.8691 37.2013 21.1787C37.9674 21.4884 38.6632 21.9424 39.2496 22.5147C39.8357 23.087 40.3007 23.7665 40.6179 24.5144C40.9352 25.2622 41.0983 26.0637 41.0981 26.8731Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M41.7606 47.0888C41.7606 48.3675 41.3722 49.6175 40.6444 50.6808C39.9167 51.7439 38.8825 52.5727 37.6726 53.0622C36.4624 53.5517 35.1309 53.6795 33.8462 53.4301C32.5614 53.1807 31.3814 52.5649 30.4552 51.6605C29.529 50.7564 28.8985 49.6042 28.6428 48.3501C28.3874 47.0958 28.5184 45.7957 29.0198 44.6144C29.521 43.4328 30.3697 42.4232 31.4588 41.7127C32.5479 41.0021 33.8282 40.6231 35.1382 40.6231C36.0083 40.6218 36.8698 40.7883 37.6739 41.1128C38.4777 41.4375 39.2083 41.9138 39.8235 42.5142C40.4387 43.1148 40.9266 43.828 41.2589 44.6131C41.5912 45.398 41.7619 46.2392 41.7606 47.0888Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M51.6906 36.1395C51.6909 37.2479 51.3545 38.3315 50.7239 39.253C50.0936 40.1748 49.1973 40.8932 48.1485 41.3174C47.0999 41.7417 45.9459 41.8529 44.8323 41.637C43.7191 41.4208 42.6962 40.8872 41.8934 40.1036C41.0907 39.32 40.5438 38.3216 40.3222 37.2346C40.1008 36.1476 40.2143 35.021 40.6487 33.997C41.0829 32.973 41.8186 32.0978 42.7625 31.482C43.7064 30.8663 44.816 30.5376 45.9513 30.5376C49.1292 30.58 51.6906 33.082 51.6906 36.1395Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M53.2839 56.0091C53.2961 56.7893 53.1495 57.564 52.8523 58.2883C52.5551 59.0127 52.1132 59.672 51.5525 60.228C50.9916 60.784 50.3234 61.2257 49.5861 61.527C48.849 61.8284 48.0576 61.9835 47.2585 61.9835C46.4593 61.9835 45.668 61.8284 44.9309 61.527C44.1936 61.2257 43.5254 60.784 42.9645 60.228C42.4038 59.672 41.9619 59.0127 41.6647 58.2883C41.3674 57.564 41.2209 56.7893 41.2331 56.0091C41.2331 52.7763 43.9262 50.1045 47.2361 50.1045C48.0309 50.1022 48.8186 50.2534 49.5533 50.549C50.2883 50.845 50.956 51.2799 51.518 51.8286C52.0802 52.3773 52.5255 53.0291 52.8284 53.7467C53.1316 54.4643 53.2862 55.233 53.2839 56.0091Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M60.5214 45.4077C60.523 46.397 60.2237 47.3643 59.6617 48.1876C59.1 49.0106 58.3006 49.6526 57.3648 50.0322C56.429 50.4115 55.3991 50.5115 54.4051 50.3193C53.4114 50.127 52.4982 49.6513 51.7814 48.9522C51.0643 48.2531 50.5761 47.3622 50.3782 46.3921C50.1799 45.4217 50.2813 44.416 50.6689 43.502C51.0565 42.588 51.713 41.8071 52.5556 41.2576C53.3981 40.7078 54.3885 40.4148 55.4017 40.415C56.7582 40.4161 58.059 40.9424 59.0187 41.8783C59.9784 42.8141 60.5188 44.0835 60.5214 45.4077Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M59.3743 27.6082C59.3743 28.4265 59.1257 29.2265 58.6599 29.9069C58.1943 30.5873 57.5326 31.1176 56.7581 31.4308C55.9836 31.7439 55.1315 31.8259 54.3094 31.6662C53.4874 31.5066 52.7324 31.1125 52.1396 30.5339C51.547 29.9552 51.1432 29.218 50.9798 28.4154C50.8164 27.6128 50.9003 26.7809 51.2209 26.0249C51.5418 25.2688 52.085 24.6226 52.7818 24.168C53.4789 23.7134 54.298 23.4707 55.1364 23.4707C57.4759 23.5131 59.3743 25.3239 59.3743 27.6082Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.6125 36.2254C66.6125 37.0437 66.3641 37.8437 65.8983 38.5241C65.4327 39.2045 64.7708 39.7348 63.9965 40.0479C63.2221 40.3612 62.3699 40.443 61.5479 40.2835C60.7259 40.1237 59.9706 39.7296 59.378 39.151C58.7854 38.5724 58.3817 37.8351 58.2183 37.0326C58.0546 36.23 58.1385 35.3981 58.4594 34.642C58.7802 33.886 59.3232 33.2398 60.0203 32.7852C60.717 32.3306 61.5365 32.0879 62.3746 32.0879C63.4985 32.0883 64.5762 32.5243 65.3709 33.3002C66.1656 34.076 66.6122 35.1282 66.6125 36.2254Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M66.2187 20.5818C66.2187 21.2807 66.0064 21.964 65.6086 22.5451C65.2111 23.1263 64.6458 23.5792 63.9843 23.8467C63.3229 24.1142 62.5952 24.1842 61.8929 24.0478C61.1907 23.9114 60.5458 23.5749 60.0398 23.0806C59.5334 22.5864 59.1886 21.9567 59.0491 21.2712C58.9093 20.5857 58.981 19.8751 59.2549 19.2294C59.529 18.5837 59.993 18.0318 60.5882 17.6434C61.1834 17.2551 61.8833 17.0479 62.5991 17.0479C63.5577 17.052 64.4762 17.4256 65.154 18.0874C65.8318 18.7493 66.2145 19.6458 66.2187 20.5818Z" fill="#2B4FF4"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72.0011 28.5115C72.0011 29.2104 71.7889 29.8936 71.3911 30.4748C70.9934 31.056 70.428 31.5089 69.7666 31.7764C69.1051 32.0439 68.3774 32.1138 67.6751 31.9775C66.9732 31.8411 66.3281 31.5046 65.822 31.0103C65.3156 30.5161 64.9709 29.8864 64.8313 29.2009C64.6916 28.5154 64.7633 27.8048 65.0374 27.1591C65.3112 26.5133 65.7752 25.9614 66.3704 25.5731C66.9656 25.1848 67.6655 24.9775 68.3813 24.9775C69.3402 24.9816 70.2584 25.3553 70.9362 26.0171C71.6143 26.679 71.997 27.5755 72.0011 28.5115Z" fill="#2B4FF4"/>
-</g>
-<defs>
-<clipPath id="clip0_16975_12140">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g fill="#2b4ff4" fill-rule="evenodd" clip-path="url(#clip0_16975_12140)" clip-rule="evenodd"><path d="M15.673 27.09a7.5 7.5 0 0 1-1.31 4.254 7.8 7.8 0 0 1-3.508 2.827 8 8 0 0 1-4.527.447 7.9 7.9 0 0 1-4.018-2.084 7.6 7.6 0 0 1-2.155-3.912A7.5 7.5 0 0 1 .59 24.2a7.7 7.7 0 0 1 2.879-3.44 7.97 7.97 0 0 1 4.35-1.3 8 8 0 0 1 3.007.566c.955.38 1.822.942 2.553 1.651s1.31 1.554 1.704 2.484c.395.93.597 1.927.594 2.933M29.538 16.79a6.65 6.65 0 0 1-1.168 3.758 6.9 6.9 0 0 1-3.11 2.493 7.1 7.1 0 0 1-4.004.385 7 7 0 0 1-3.549-1.85 6.7 6.7 0 0 1-1.898-3.464 6.6 6.6 0 0 1 .393-3.91 6.8 6.8 0 0 1 2.55-3.037 7.05 7.05 0 0 1 3.85-1.142 7.1 7.1 0 0 1 2.657.51 6.9 6.9 0 0 1 2.252 1.465 6.8 6.8 0 0 1 1.503 2.198c.348.822.526 1.704.524 2.593m-.312 20.644a6.95 6.95 0 0 1-1.22 3.927 7.2 7.2 0 0 1-3.25 2.603 7.4 7.4 0 0 1-4.182.402 7.3 7.3 0 0 1-3.707-1.934 7 7 0 0 1-1.98-3.619 6.9 6.9 0 0 1 .411-4.084 7.1 7.1 0 0 1 2.666-3.172 7.39 7.39 0 0 1 6.792-.653 7.3 7.3 0 0 1 2.35 1.532 7.1 7.1 0 0 1 1.569 2.293 6.9 6.9 0 0 1 .55 2.705m11.873-10.56a6.06 6.06 0 0 1-1.064 3.424 6.3 6.3 0 0 1-2.833 2.27 6.45 6.45 0 0 1-3.647.35 6.36 6.36 0 0 1-3.232-1.686 6.1 6.1 0 0 1-1.728-3.155 6.03 6.03 0 0 1 .36-3.561 6.2 6.2 0 0 1 2.324-2.766 6.45 6.45 0 0 1 5.923-.57 6.3 6.3 0 0 1 2.049 1.336 6.2 6.2 0 0 1 1.368 2c.317.747.48 1.549.48 2.358m.662 20.216a6.36 6.36 0 0 1-1.116 3.592 6.6 6.6 0 0 1-2.971 2.381 6.77 6.77 0 0 1-3.827.368 6.67 6.67 0 0 1-3.39-1.77 6.4 6.4 0 0 1-1.813-3.31 6.3 6.3 0 0 1 .377-3.736 6.5 6.5 0 0 1 2.439-2.901 6.74 6.74 0 0 1 3.68-1.09 6.8 6.8 0 0 1 2.535.49 6.6 6.6 0 0 1 2.15 1.401 6.5 6.5 0 0 1 1.435 2.1c.332.784.503 1.625.502 2.475M51.69 36.14a5.5 5.5 0 0 1-.966 3.113 5.7 5.7 0 0 1-2.575 2.064 5.87 5.87 0 0 1-3.317.32 5.8 5.8 0 0 1-2.939-1.533 5.57 5.57 0 0 1-1.57-2.87 5.5 5.5 0 0 1 .326-3.237 5.63 5.63 0 0 1 2.114-2.515 5.84 5.84 0 0 1 3.188-.944c3.178.042 5.74 2.544 5.74 5.601m1.593 19.871a5.8 5.8 0 0 1-.432 2.278 5.9 5.9 0 0 1-1.3 1.94 6 6 0 0 1-1.966 1.299 6.15 6.15 0 0 1-4.655 0 6 6 0 0 1-1.966-1.299 5.9 5.9 0 0 1-1.3-1.94 5.8 5.8 0 0 1-.432-2.279c0-3.233 2.693-5.904 6.003-5.904a6.2 6.2 0 0 1 2.317.444c.735.296 1.403.73 1.965 1.28a5.9 5.9 0 0 1 1.31 1.918c.304.717.458 1.486.456 2.262m7.237-10.601a4.9 4.9 0 0 1-.86 2.78 5.1 5.1 0 0 1-2.296 1.844c-.936.38-1.966.48-2.96.287a5.16 5.16 0 0 1-2.624-1.367 4.96 4.96 0 0 1-1.403-2.56 4.9 4.9 0 0 1 .29-2.89 5.03 5.03 0 0 1 1.888-2.244 5.2 5.2 0 0 1 2.846-.843 5.2 5.2 0 0 1 3.617 1.463 4.94 4.94 0 0 1 1.502 3.53m-1.147-17.8c0 .819-.248 1.619-.714 2.299a4.2 4.2 0 0 1-1.902 1.524 4.33 4.33 0 0 1-2.449.235 4.27 4.27 0 0 1-2.17-1.132 4.1 4.1 0 0 1-1.16-2.119 4.05 4.05 0 0 1 .242-2.39 4.16 4.16 0 0 1 1.56-1.857 4.3 4.3 0 0 1 2.355-.697c2.34.042 4.238 1.853 4.238 4.137m7.239 8.617a4.07 4.07 0 0 1-.715 2.3 4.2 4.2 0 0 1-1.901 1.523 4.33 4.33 0 0 1-2.45.235 4.27 4.27 0 0 1-2.169-1.132 4.1 4.1 0 0 1-1.16-2.118 4.04 4.04 0 0 1 .241-2.391 4.16 4.16 0 0 1 1.561-1.857 4.3 4.3 0 0 1 2.355-.697 4.3 4.3 0 0 1 2.996 1.212 4.1 4.1 0 0 1 1.242 2.925m-.394-15.643c0 .699-.213 1.382-.61 1.963a3.6 3.6 0 0 1-1.625 1.302 3.7 3.7 0 0 1-2.091.2 3.65 3.65 0 0 1-1.853-.966 3.5 3.5 0 0 1-.99-1.81 3.46 3.46 0 0 1 .205-2.042 3.56 3.56 0 0 1 1.333-1.586 3.7 3.7 0 0 1 2.011-.595 3.68 3.68 0 0 1 2.555 1.04 3.5 3.5 0 0 1 1.065 2.494m5.782 7.93c0 .698-.212 1.382-.61 1.963a3.6 3.6 0 0 1-1.624 1.301 3.7 3.7 0 0 1-2.092.201 3.65 3.65 0 0 1-1.853-.967 3.5 3.5 0 0 1-.99-1.81 3.46 3.46 0 0 1 .205-2.04 3.55 3.55 0 0 1 1.333-1.587 3.7 3.7 0 0 1 2.011-.596 3.68 3.68 0 0 1 2.555 1.04 3.5 3.5 0 0 1 1.065 2.495"/></g><defs><clipPath id="clip0_16975_12140"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/vendr.svg b/web/packages/design/src/ResourceIcon/assets/vendr.svg
index 566e83659b764..49a0daa8cd1bf 100644
--- a/web/packages/design/src/ResourceIcon/assets/vendr.svg
+++ b/web/packages/design/src/ResourceIcon/assets/vendr.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M26.3024 3.43635L49.0232 44.7911C50.9393 48.2789 51.2065 52.5427 49.7428 56.2774L43.8863 71.2211C43.6321 71.8701 42.9388 72.1734 42.338 71.8987C42.1034 71.7915 41.9072 71.605 41.7787 71.3676L4.20161 1.91991C3.87246 1.31145 4.0622 0.529957 4.62543 0.1743C4.80633 0.0601761 5.01205 0 5.22155 0H20.7151C23.0084 0 25.132 1.30601 26.3024 3.43635ZM61.561 0.0231423C68.5478 0.0231423 68.5478 6.94117 67.3834 10.7146L66.9776 11.9246C65.9717 14.7643 63.8003 20.1222 60.4631 27.9984C60.3631 28.2345 60.1988 28.432 59.9921 28.5645C59.4934 28.8843 58.8655 28.7622 58.498 28.3056L58.3733 28.1188L43.9889 1.95059C43.8806 1.75346 43.8235 1.52841 43.8235 1.29914C43.8235 0.594427 44.3524 0.0231423 45.0047 0.0231423H61.561Z" fill="#5E2DF5"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#5e2df5" fill-rule="evenodd" d="m26.302 3.436 22.721 41.355c1.916 3.488 2.183 7.752.72 11.486l-5.857 14.944c-.254.65-.947.952-1.548.678a1.2 1.2 0 0 1-.56-.531L4.203 1.92c-.33-.609-.14-1.39.423-1.746C4.806.06 5.012 0 5.222 0h15.493c2.293 0 4.417 1.306 5.587 3.436M61.561.023c6.987 0 6.987 6.918 5.822 10.692l-.405 1.21q-1.51 4.26-6.515 16.073c-.1.236-.264.434-.47.566-.5.32-1.128.198-1.495-.258l-.125-.187L43.99 1.95a1.36 1.36 0 0 1-.165-.652c0-.705.528-1.276 1.18-1.276z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/vercel-dark.svg b/web/packages/design/src/ResourceIcon/assets/vercel-dark.svg
index 05f6c7f9abfa9..e5290d4814299 100644
--- a/web/packages/design/src/ResourceIcon/assets/vercel-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/vercel-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16975_12157)">
-<path d="M36.001 4.65234L72.001 67.0069H0.000976562L36.001 4.65234Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16975_12157">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16975_12157)"><path fill="#fff" d="m36.001 4.652 36 62.355h-72z"/></g><defs><clipPath id="clip0_16975_12157"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/vercel-light.svg b/web/packages/design/src/ResourceIcon/assets/vercel-light.svg
index bf548f14bff4f..8c578fae09bf1 100644
--- a/web/packages/design/src/ResourceIcon/assets/vercel-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/vercel-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16975_12157)">
-<path d="M36.001 4.65234L72.001 67.0069H0.000976562L36.001 4.65234Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_16975_12157">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16975_12157)"><path fill="#000" d="m36.001 4.652 36 62.355h-72z"/></g><defs><clipPath id="clip0_16975_12157"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/weavegitops.svg b/web/packages/design/src/ResourceIcon/assets/weavegitops.svg
index 415dab84a1172..97b5029b4fa5c 100644
--- a/web/packages/design/src/ResourceIcon/assets/weavegitops.svg
+++ b/web/packages/design/src/ResourceIcon/assets/weavegitops.svg
@@ -1,7 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M69.3616 22.4482L18.6423 67.548C15.4185 65.7704 12.4964 63.5131 9.9722 60.8722L63.7435 13.0586C66.0647 15.8624 67.9691 19.0239 69.3616 22.4482Z" fill="#FF4B19"/>
-<path d="M70.5842 46.0307C71.506 42.847 72 39.4815 72 36.0007C72 34.2094 71.8692 32.4487 71.6165 30.7275L30.9784 66.8631L35.5441 71.9978C35.6959 71.9997 35.8478 72.0007 36 72.0007C38.0177 72.0007 39.9966 71.8347 41.9239 71.5156L70.5842 46.0307Z" fill="#00D2FF"/>
-<path d="M29.75 71.4604V0.541578C31.7799 0.186252 33.8683 0.000976562 36 0.000976562C37.524 0.000976562 39.0258 0.0956716 40.5 0.279499V71.7225C39.0258 71.9063 37.524 72.001 36 72.001C33.8683 72.001 31.7799 71.8157 29.75 71.4604Z" fill="#00D2FF"/>
-<path d="M0.881287 43.9532L48.0048 2.05078C51.6512 3.34017 55.0278 5.20036 58.0273 7.52398L5.14092 54.5508C3.19161 51.315 1.73686 47.7476 0.881287 43.9532Z" fill="#32324B"/>
-<path d="M10 60.9006V11.1008C13.058 7.90852 16.6982 5.27835 20.75 3.38086V65.0003H14.6647C12.9937 63.7688 11.4329 62.3964 10 60.9006Z" fill="#FF4B19"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#ff4b19" d="m69.362 22.448-50.72 45.1a36.1 36.1 0 0 1-8.67-6.676L63.743 13.06a36 36 0 0 1 5.619 9.39"/><path fill="#00d2ff" d="M70.584 46.03A36 36 0 0 0 72 36c0-1.79-.13-3.551-.383-5.273L30.978 66.864l4.566 5.135a36.4 36.4 0 0 0 6.38-.482z"/><path fill="#00d2ff" d="M29.75 71.46V.542A36.4 36.4 0 0 1 40.5.28v71.443a36.4 36.4 0 0 1-10.75-.263"/><path fill="#32324b" d="M.881 43.953 48.005 2.051a36 36 0 0 1 10.022 5.473L5.141 54.551A35.8 35.8 0 0 1 .88 43.953"/><path fill="#ff4b19" d="M10 60.9V11.1a36.1 36.1 0 0 1 10.75-7.72V65h-6.085A36 36 0 0 1 10 60.9"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/windows-dark.svg b/web/packages/design/src/ResourceIcon/assets/windows-dark.svg
index 9cfce762ed57e..143573671f1d9 100644
--- a/web/packages/design/src/ResourceIcon/assets/windows-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/windows-dark.svg
@@ -1,111 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g opacity="0.2">
-<path opacity="0.2" d="M66.5292 29.653L66.4302 64.5298C66.4302 65.041 66.0684 65.248 65.622 64.9906L48.063 54.853L37.0002 48.4504L18.4206 37.7404C17.976 37.483 17.6178 36.862 17.6178 36.3508L17.7168 1.47401C17.7168 0.962812 18.0786 0.757611 18.5232 1.01321L65.7246 28.2616C66.1692 28.519 66.5292 29.14 66.5274 29.6512L66.5292 29.653Z" fill="#4C7F8E"/>
-</g>
-<path d="M27.8401 56.1596V52.5596L39.0001 58.9496V62.6396L27.8401 56.1596Z" fill="#74929F"/>
-<path d="M27.8401 56.1592L25.5901 57.4192L41.4301 66.5992L39.0001 62.6392L27.8401 56.1592Z" fill="url(#paint0_linear_7996_40513)"/>
-<path d="M41.4301 66.6L44.7601 64.62C44.7601 64.62 45.7501 65.61 45.3901 66.15C45.0301 66.69 42.33 68.4 41.7001 68.4C41.0701 68.4 25.6801 59.22 25.6801 59.22C25.2301 58.95 25.0501 58.41 25.0501 58.41C25.0501 58.41 24.6001 57.69 25.3201 57.33L28.1101 55.71L27.8401 56.16L25.5901 57.42L41.4301 66.6Z" fill="#5E2AD8"/>
-<path d="M42.3301 60.6592L44.7601 64.6192L41.4301 66.5992L39.0001 62.6392L42.3301 60.6592Z" fill="#EFF1F3"/>
-<path d="M42.3301 60.6598V58.5898H39.0001V62.6398L42.3301 60.6598Z" fill="#83A2AC"/>
-<path d="M60.5712 31.773L60.4722 66.6499C60.4722 66.9037 60.3804 67.0836 60.2364 67.1665L56.9604 69.0709C57.1062 68.9881 57.1944 68.8081 57.1962 68.5543L57.2952 33.6774C57.297 33.1662 56.937 32.5434 56.4924 32.2878L9.2928 5.03585C9.0696 4.90625 8.8662 4.89365 8.7204 4.98005L11.9964 3.07565C12.1422 2.98925 12.3456 3.00185 12.5688 3.13145L59.7684 30.3834C60.213 30.6409 60.573 31.2618 60.5712 31.773Z" fill="#EFF1F3"/>
-<path d="M29.5968 47.8973C29.6544 47.9297 29.7012 48.0107 29.7012 48.0773V48.9647C29.6976 49.0313 29.6508 49.0583 29.5932 49.0241L28.6158 48.4589C28.5582 48.4265 28.5114 48.3455 28.5114 48.2789V47.3915C28.515 47.3267 28.5618 47.2997 28.6194 47.3321L29.5968 47.8973Z" fill="white"/>
-<path d="M31.5228 49.0096C31.5804 49.042 31.6272 49.123 31.6272 49.1896V50.077C31.6236 50.1436 31.5768 50.1706 31.521 50.1364L30.5418 49.5712C30.4842 49.5388 30.4374 49.4578 30.4374 49.3912V48.5038C30.441 48.439 30.4878 48.412 30.5436 48.4444L31.5228 49.0096Z" fill="#F4F6F7"/>
-<path d="M13.9422 37.8789L13.9332 40.9137L10.5906 38.9841C10.2522 38.7879 9.97862 38.3145 9.98042 37.9257L9.98582 35.5947L13.9422 37.8789Z" fill="#98B3BC"/>
-<path d="M27.471 45.6888L55.812 62.0526L55.8048 64.3188C55.8048 64.7454 55.5006 64.9182 55.1298 64.704L10.6536 39.0216C10.245 38.7858 9.97862 38.325 9.98042 37.947C9.98042 38.3124 10.2522 38.7858 10.5906 38.9802L13.9332 40.9098L13.9422 37.875L13.9386 40.9134L27.4638 48.7218L27.4728 45.687L27.471 45.6888ZM29.6994 48.9666V48.0792C29.703 48.0144 29.6562 47.9334 29.5986 47.8992L28.6212 47.334C28.5636 47.3016 28.5168 47.3268 28.5168 47.3934V48.2808C28.5132 48.3474 28.56 48.4284 28.6176 48.4608L29.595 49.026C29.6526 49.0584 29.6994 49.0332 29.6994 48.9666ZM31.6236 50.079V49.1916C31.6272 49.1268 31.5804 49.0458 31.5228 49.0116L30.5436 48.4464C30.486 48.414 30.4392 48.441 30.4392 48.5058V49.3932C30.4356 49.4598 30.4824 49.5408 30.54 49.5732L31.5192 50.1384C31.5768 50.1708 31.6236 50.1438 31.6236 50.079Z" fill="#7C939D"/>
-<path d="M48.094 58.556C48.1241 58.5775 48.1491 58.6059 48.1671 58.6391C48.1851 58.6723 48.1955 58.7093 48.1976 58.7473V59.6794C48.1976 59.7459 48.1498 59.7792 48.094 59.7459L47.1133 59.1468C47.0824 59.1282 47.0566 59.1015 47.0384 59.0694C47.0203 59.0374 47.0104 59.001 47.0096 58.9637V58.04C47.0096 57.9651 47.0575 57.9402 47.1133 57.9735L48.094 58.556Z" fill="white"/>
-<path d="M53.8665 61.8588C53.8987 61.8798 53.9254 61.9081 53.9444 61.9414C53.9634 61.9746 53.9741 62.0118 53.9757 62.05V62.9811C53.9757 63.0476 53.9253 63.0725 53.8665 63.0392L52.8249 62.449C52.7927 62.428 52.766 62.3997 52.747 62.3664C52.728 62.3332 52.7173 62.296 52.7157 62.2578V61.3268C52.7157 61.2603 52.7661 61.2353 52.8249 61.2686L53.8665 61.8588Z" fill="#5E2AD8"/>
-<path d="M50.0214 59.6767C50.0532 59.6939 50.0798 59.72 50.098 59.7523C50.1162 59.7845 50.1253 59.8214 50.1243 59.8588V60.7858C50.1243 60.8603 50.0768 60.8851 50.0214 60.852L49.0473 60.2644C49.0159 60.2439 48.9895 60.216 48.9703 60.1829C48.951 60.1499 48.9394 60.1126 48.9364 60.074V59.147C48.9364 59.0725 48.9839 59.0477 49.0394 59.0808L50.0214 59.6767Z" fill="#F4F6F7"/>
-<path d="M51.9409 60.7626C51.9747 60.7819 52.0026 60.8097 52.0218 60.8433C52.041 60.8768 52.0508 60.9149 52.0501 60.9534V61.8826C52.0501 61.9489 51.9997 61.9738 51.9409 61.9406L50.9077 61.3516C50.8739 61.3316 50.8456 61.3037 50.8251 61.2705C50.8046 61.2373 50.7926 61.1996 50.7901 61.1608V60.2316C50.7901 60.1653 50.8405 60.1321 50.8993 60.1736L51.9409 60.7626Z" fill="#E4EAED"/>
-<path d="M13.9454 37.8809L27.4706 45.6893L27.4616 48.7241L13.9364 40.9157L13.9454 37.8809ZM16.2296 41.3891L16.2332 40.1057C16.2332 40.0211 16.1738 39.9167 16.1 39.8753L14.984 39.2309C14.9102 39.1877 14.8508 39.2219 14.8508 39.3065L14.8472 40.5899C14.8472 40.6745 14.9066 40.7771 14.9804 40.8203L16.0964 41.4647C16.1702 41.5061 16.2296 41.4719 16.2296 41.3891Z" fill="#7C939D"/>
-<path d="M16.1004 39.875C16.1742 39.9164 16.2336 40.0208 16.2336 40.1054L16.23 41.3888C16.23 41.4734 16.1688 41.5076 16.0968 41.4644L14.9808 40.82C14.907 40.7768 14.8476 40.6742 14.8476 40.5896L14.8512 39.3062C14.8512 39.2216 14.9124 39.1874 14.9844 39.2306L16.1004 39.875Z" fill="white"/>
-<path d="M55.8916 34.1483L55.8124 62.0501L27.4714 45.6881L13.9462 37.8797L9.98621 35.5937L10.0654 7.69005C10.0672 7.26345 10.3714 7.09066 10.744 7.30486L55.2202 32.9837C55.591 33.1979 55.8952 33.7217 55.8916 34.1483Z" fill="white"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M55.8916 34.1483L55.8124 62.0501L27.4714 45.6881L13.9462 37.8797L9.98621 35.5937L10.0654 7.69005C10.0672 7.26345 10.3714 7.09066 10.744 7.30486L55.2202 32.9837C55.591 33.1979 55.8952 33.7217 55.8916 34.1483Z" fill="url(#paint1_linear_7996_40513)"/>
-</g>
-<path d="M10.744 7.30577L14.02 5.40137L58.4962 31.0802L55.2202 32.9846L10.744 7.30577Z" fill="white"/>
-<path d="M37.1913 55.5295C37.3509 55.6352 37.4838 55.777 37.5791 55.9437C37.6745 56.1103 37.7297 56.2972 37.7404 56.4892C37.7404 56.8438 37.4918 56.9794 37.1913 56.8021L29.1096 52.1081C28.9494 52.0031 28.8161 51.8614 28.7206 51.6946C28.6252 51.5278 28.5703 51.3407 28.5604 51.1484C28.5604 50.8042 28.8091 50.6582 29.1199 50.8355L37.1913 55.5295Z" fill="#C0C0C0"/>
-<path d="M56.5842 32.3326L9.38462 5.08236C8.94002 4.82496 8.57822 5.03196 8.57642 5.54316L8.47742 40.42C8.47742 40.9312 8.83562 41.554 9.28022 41.8114L27.858 52.5232L38.9208 58.9258L56.4798 69.0634C56.9244 69.3208 57.2862 69.1138 57.288 68.6026L57.387 33.7258C57.387 33.2146 57.0288 32.5918 56.5842 32.3362V32.3326ZM36.6132 56.2798L30.4392 52.7158C30.207 52.5808 30.018 52.2532 30.018 51.9868C30.018 51.7204 30.2088 51.6106 30.441 51.7456L36.615 55.3114C36.8472 55.4446 37.0362 55.774 37.0362 56.0404C37.0362 56.3068 36.8454 56.4166 36.6132 56.2816V56.2798ZM55.812 62.0542L55.8048 64.3204C55.8048 64.747 55.5006 64.9198 55.128 64.7038L10.5726 38.9764C10.2432 38.7856 9.97862 38.3266 9.97862 37.8568L10.065 7.69056C10.065 7.26396 10.371 7.09116 10.7418 7.30536L55.218 32.9842C55.5888 33.1984 55.893 33.7222 55.8912 34.1488L55.812 62.0506" fill="#EFF1F3"/>
-<path d="M56.5842 32.3326L9.38462 5.08236C8.94002 4.82496 8.57822 5.03196 8.57642 5.54316L8.47742 40.42C8.47742 40.9312 8.83562 41.554 9.28022 41.8114L27.858 52.5232L38.9208 58.9258L56.4798 69.0634C56.9244 69.3208 57.2862 69.1138 57.288 68.6026L57.387 33.7258C57.387 33.2146 57.0288 32.5918 56.5842 32.3362V32.3326ZM55.812 62.0542L55.8048 64.3204C55.8048 64.747 55.5006 64.9198 55.128 64.7038L10.5726 38.9764C10.2432 38.7856 9.97862 38.3266 9.97862 37.8568L10.065 7.69056C10.065 7.26396 10.371 7.09116 10.7418 7.30536L55.218 32.9842C55.5888 33.1984 55.893 33.7222 55.8912 34.1488L55.812 62.0506" fill="url(#paint2_radial_7996_40513)"/>
-<path d="M10.6533 39.0227C10.6281 39.0083 10.6047 38.9903 10.5795 38.9741L10.5741 38.9777L28.7109 49.4501L10.6533 39.0245V39.0227ZM29.6685 49.0325C29.6685 49.0325 29.6505 49.0379 29.6415 49.0379C29.6505 49.0379 29.6613 49.0379 29.6685 49.0325ZM29.6343 49.0397C29.6217 49.0397 29.6073 49.0343 29.5929 49.0253C29.6073 49.0343 29.6217 49.0379 29.6343 49.0397ZM11.7711 38.2793L11.1357 38.6483L11.7693 39.1163V38.2793H11.7711ZM53.9433 63.0527C53.9433 63.0527 53.9325 63.0527 53.9289 63.0563C53.9343 63.0563 53.9397 63.0563 53.9433 63.0527ZM52.0191 61.9421C52.0191 61.9421 52.0065 61.9457 51.9993 61.9457C52.0065 61.9457 52.0137 61.9457 52.0191 61.9421ZM51.9849 61.9493C51.9723 61.9493 51.9579 61.9439 51.9435 61.9349C51.9579 61.9439 51.9723 61.9475 51.9849 61.9493ZM52.0497 61.8737L51.9453 61.9349C51.9795 61.9151 52.0155 61.8935 52.0497 61.8737ZM50.0607 60.8369C50.0481 60.8369 50.0337 60.8315 50.0193 60.8225C50.0337 60.8315 50.0481 60.8351 50.0607 60.8369ZM50.0931 60.8297C50.0931 60.8297 50.0769 60.8351 50.0679 60.8351C50.0769 60.8351 50.0859 60.8351 50.0931 60.8297ZM48.1689 59.7191C48.1599 59.7245 48.1473 59.7263 48.1365 59.7263C48.1491 59.7263 48.1599 59.7263 48.1689 59.7191ZM31.5945 50.1431C31.5855 50.1485 31.5729 50.1503 31.5621 50.1503C31.5747 50.1503 31.5855 50.1503 31.5945 50.1431ZM53.6589 61.7945L53.3853 61.9529C53.4753 61.9007 53.5671 61.8485 53.6589 61.7945ZM47.8845 58.4609L47.6901 58.5743C47.7549 58.5365 47.8179 58.5005 47.8845 58.4609ZM47.0457 58.0127C47.0277 58.0235 47.0151 58.0469 47.0151 58.0793C47.0151 58.0469 47.0259 58.0235 47.0457 58.0127Z" fill="#EFF1F3"/>
-<path d="M10.5924 38.9817L10.6104 38.9925C10.6104 38.9925 10.5996 38.9853 10.5942 38.9817H10.5924ZM11.7714 38.2959L11.1468 38.6595L11.7696 39.1185V38.2959H11.7714Z" fill="#C8D6DC"/>
-<path d="M11.771 38.2096L11.6234 38.125L10.952 38.5156L11.7692 39.1168L11.771 38.2096Z" fill="#98B3BC"/>
-<path d="M9.38464 5.08213L12.6624 3.17773L59.862 30.4279L56.5842 32.3323L9.38464 5.08213Z" fill="#EFF1F3"/>
-<path d="M60.5712 31.773L60.4722 66.6499C60.4722 66.9037 60.3804 67.0836 60.2364 67.1665L56.9604 69.0709C57.1062 68.9881 57.1944 68.8081 57.1962 68.5543L57.2952 33.6774C57.297 33.1662 56.937 32.5434 56.4924 32.2878L9.2928 5.03585C9.0696 4.90625 8.8662 4.89365 8.7204 4.98005L11.9964 3.07565C12.1422 2.98925 12.3456 3.00185 12.5688 3.13145L59.7684 30.3834C60.213 30.6409 60.573 31.2618 60.5712 31.773Z" fill="#5E2AD8"/>
-<path d="M60.5712 31.7027L60.4722 66.5795C60.4722 66.8333 60.3804 67.0133 60.2364 67.0961L56.9604 69.0005C57.1062 68.9177 57.1944 68.7377 57.1962 68.4839L57.2952 33.6071C57.297 33.0959 56.937 32.4731 56.4924 32.2175L9.2928 4.96553C9.0696 4.83593 8.8662 4.82334 8.7204 4.90974L11.9964 3.00533C12.1422 2.91893 12.3456 2.93154 12.5688 3.06114L59.7684 30.3113C60.213 30.5687 60.573 31.1897 60.5712 31.7009V31.7027Z" fill="url(#paint3_radial_7996_40513)"/>
-<path d="M13.0099 20.4998L13.9927 21.9506L13.9819 25.5146V26.3516L13.5535 25.7396L13.5571 24.701C13.5571 24.6254 13.5049 24.5336 13.4383 24.494L13.0009 24.242L13.0117 20.498L13.0099 20.4998Z" fill="#E6EAEC"/>
-<path d="M13.4367 24.497C13.5033 24.5348 13.5573 24.6284 13.5555 24.704L13.5519 25.7426V26.2052C13.5519 26.2808 13.4961 26.3114 13.4295 26.2736L12.1245 25.5194C12.0579 25.4816 12.0039 25.388 12.0057 25.3124L12.0093 23.8112C12.0093 23.7356 12.0633 23.705 12.1299 23.7428L12.9975 24.2432L13.4349 24.4952L13.4367 24.497Z" fill="#5E2AD8"/>
-<path d="M15.7357 22.0734L15.7267 25.4124C15.7897 25.5564 15.8527 25.7022 15.9139 25.8462C15.9103 26.109 15.9067 26.3718 15.9031 26.6346C15.2623 26.262 14.6215 25.8894 13.9807 25.5168L13.9915 21.9528L13.0087 20.502L15.7339 22.0752L15.7357 22.0734Z" fill="#B0C4C9"/>
-<path d="M13.507 32.7325C13.5736 32.7703 13.6276 32.8639 13.6258 32.9395L13.6222 33.9781V34.4407C13.6222 34.5163 13.5664 34.5469 13.4998 34.5091L12.1948 33.7549C12.1282 33.7171 12.0742 33.6235 12.076 33.5479L12.0796 32.0485C12.0796 31.9729 12.1336 31.9423 12.2002 31.9801L13.0678 32.4805L13.5052 32.7325H13.507Z" fill="#5E2AD8"/>
-<path d="M16.5957 34.7465V35.0291L14.5761 33.8627V33.5801L16.5957 34.7465Z" fill="#B0C4C9"/>
-<path d="M13.0803 28.7362L14.0631 30.187L14.0523 33.7564V34.588L13.6239 33.976L13.6275 32.9374C13.6275 32.8618 13.5735 32.7682 13.5087 32.7304L13.0713 32.4784L13.0821 28.7344L13.0803 28.7362Z" fill="#E6EAEC"/>
-<path d="M16.5975 34.2925L16.5957 34.5751L14.5779 33.4087V33.1279L16.5975 34.2925Z" fill="#B0C4C9"/>
-<path d="M16.0481 32.1546V32.295L14.5829 31.449V31.3086L16.0481 32.1546Z" fill="#B0C4C9"/>
-<path d="M16.1602 32.4493L16.7848 32.8093L16.7776 35.6641L14.4304 34.3087V33.9775L14.4412 30.6943L15.8038 31.4809L16.1638 31.6897V32.4493H16.1602ZM16.5958 34.1233V33.3691L14.5798 32.2027V32.9569L16.5958 34.1233ZM16.594 35.0287V34.7461L14.5762 33.5797V33.8623L16.594 35.0287ZM16.594 34.5751V34.2925L14.5762 33.1261V33.4087L16.594 34.5751ZM16.5976 33.1909V32.9083L14.5798 31.7419V32.0245L16.5976 33.1909ZM14.5798 31.3081V31.4485L16.045 32.2945V32.1541L14.5798 31.3081Z" fill="#E6EAEC"/>
-<path d="M16.5993 33.3695L16.5975 34.1219L14.5779 32.9573L14.5815 32.2031L16.5993 33.3695Z" fill="#B0C4C9"/>
-<path d="M16.6015 32.9087L16.5997 33.1913L14.5819 32.0249V31.7441L16.6015 32.9087Z" fill="#B0C4C9"/>
-<path d="M16.1619 31.6904L16.7847 32.81L16.1601 32.45L16.1619 31.6904Z" fill="#B0C4C9"/>
-<path d="M15.8052 30.3095L15.8016 31.4813L14.439 30.6947L14.43 33.9797L14.052 33.7565L14.061 30.1871L13.08 28.7363L15.8052 30.3095Z" fill="#B0C4C9"/>
-<path d="M12.886 11.9043L16.369 15.1803L16.36 18.1449L12.8788 14.8725L12.886 11.9043Z" fill="#5E2AD8"/>
-<path d="M12.4633 15.5314L15.4531 18.424L15.3181 18.4168L14.1211 18.3502L11.2015 15.49L11.0575 15.3496L12.4633 15.5314Z" fill="#E6EAEC"/>
-<path d="M11.0572 15.3496L11.2012 15.49L14.1208 18.3502L15.3178 18.4168L15.4528 18.424V18.5464L14.1208 18.4726L11.0554 15.472L11.0572 15.3496Z" fill="#B0C4C9"/>
-<path d="M14.5222 16.4922L15.4564 17.3706V17.4156C15.4564 17.5038 15.3934 17.5398 15.316 17.4948L14.659 17.115C14.5816 17.07 14.5204 16.962 14.5204 16.8756V16.4922H14.5222Z" fill="#E6EAEC"/>
-<path d="M14.5209 16.7391V16.8759C14.5209 16.9641 14.5821 17.0721 14.6595 17.1153L15.3165 17.4951C15.3939 17.5401 15.4551 17.5041 15.4569 17.4159V17.3709L16.0941 17.9703C16.0437 18.1017 15.5343 17.9361 14.9151 17.5779C14.2617 17.2017 13.7325 16.7535 13.7343 16.5807C13.7343 16.4439 14.0637 16.5177 14.5227 16.7391H14.5209Z" fill="#B0C4C9"/>
-<path d="M12.7978 11.7461L16.4572 15.1877L16.4482 18.3035L16.0918 17.9687L15.4546 17.3693L14.5204 16.4909L12.7888 14.8637L12.7978 11.7461ZM16.36 18.1451L16.369 15.1787L12.886 11.9045L12.877 14.8709L16.36 18.1451Z" fill="#E6EAEC"/>
-<path d="M13.0857 11.8307L16.6533 15.1967L16.6443 18.3107L16.4481 18.3035L16.4571 15.1877L12.7977 11.7461L13.0857 11.8307Z" fill="#B0C4C9"/>
-<path d="M22.133 21.322C22.1996 21.3598 22.2518 21.4516 22.2518 21.5272L22.2482 22.564V23.0266C22.2482 23.1022 22.1924 23.1328 22.1276 23.095L20.8208 22.3408C20.7542 22.303 20.702 22.2112 20.702 22.1356L20.7056 20.6344C20.7056 20.5588 20.7596 20.5282 20.8262 20.566L21.6938 21.0664L22.1312 21.3184L22.133 21.322Z" fill="#5E2AD8"/>
-<path d="M21.7059 17.3242L21.8679 17.5636L22.6869 18.775L22.6761 22.5082V23.176L22.2477 22.564L22.2513 21.5272C22.2513 21.4516 22.1991 21.3598 22.1325 21.322L21.6951 21.07L21.7059 17.326V17.3242Z" fill="#E6EAEC"/>
-<path d="M24.4312 18.8974L24.4294 19.4698L22.2046 17.74L22.2028 17.8912L21.868 17.5474V17.5636L21.706 17.3242L24.4312 18.8974Z" fill="#B0C4C9"/>
-<path d="M21.8679 17.5479L22.2027 17.8917L23.8641 19.6017L23.8551 23.0451L23.8533 23.7291L22.6761 22.5087L22.6869 18.7755L21.8679 17.5641V17.5479Z" fill="#B0C4C9"/>
-<path d="M22.2048 17.7402L24.4296 19.47L24.7878 19.7472L24.777 23.8926L23.8554 23.0448L23.8644 19.6014L22.203 17.8914L22.2048 17.7402Z" fill="#E6EAEC"/>
-<path d="M22.2455 27.0301L22.2419 28.0723L23.1491 28.5961C23.1491 29.1739 22.7405 29.4061 22.2383 29.1163C21.7361 28.8265 21.3329 28.1263 21.3329 27.5485C21.3329 26.9725 21.7415 26.7403 22.2437 27.0301H22.2455Z" fill="#E6EAEC"/>
-<path d="M23.3075 30.2227L24.9185 31.1533L24.9167 31.3459L23.3075 30.4171V30.2227Z" fill="#5E2AD8"/>
-<path d="M22.2461 27.0303C22.7483 27.3201 23.1515 28.0203 23.1515 28.5963L22.2443 28.0725L22.2479 27.0303H22.2461Z" fill="#5E2AD8"/>
-<path d="M24.9226 29.3143L24.9208 30.0127L23.866 29.4043L23.8678 28.7041L24.9226 29.3143Z" fill="#5E2AD8"/>
-<path d="M24.9245 28.7256L24.9227 29.3142L23.8679 28.704L23.8661 29.4042L24.9209 30.0126L24.9191 30.6624L23.8643 30.054L23.8661 29.6328V29.5392L23.8697 28.1172L24.9245 28.7256Z" fill="#E6EAEC"/>
-<path d="M25.3744 28.3566C25.4248 28.3854 25.468 28.4574 25.4662 28.5168L25.4554 32.133C25.4554 32.1924 25.414 32.2158 25.3618 32.1852L20.923 29.622C20.8726 29.5932 20.8294 29.5212 20.8312 29.4618L20.842 25.8456C20.842 25.7862 20.8834 25.7628 20.9356 25.7916L25.3744 28.3548V28.3566ZM24.9226 29.3124V28.7238L23.8696 28.1154L23.866 29.5374L23.524 29.3394V28.7634L23.1514 28.5474V28.5942C23.1514 28.0182 22.7482 27.318 22.246 27.0282C21.7438 26.7384 21.337 26.9706 21.3352 27.5466C21.3352 28.1244 21.7384 28.8246 22.2406 29.1144C22.7428 29.4042 23.1496 29.172 23.1514 28.5942V28.6428L23.443 28.812V29.388L23.866 29.6328V30.054L24.9208 30.6624V30.0126L24.9244 29.3124H24.9226ZM24.919 31.3446V31.152L23.3098 30.2232V30.0126L22.7986 29.7174V29.928L21.4234 29.1342V29.3268L22.7968 30.1206V30.3042L23.308 30.5994V30.4158L24.919 31.3446Z" fill="#B0C4C9"/>
-<path d="M23.5256 28.7648L23.5238 29.3408L23.8658 29.5388V29.6324L23.441 29.3876L23.4428 28.8134L23.1512 28.6442V28.5488L23.5256 28.7648Z" fill="#5E2AD8"/>
-<path d="M21.4216 29.3283V29.1357L22.7968 29.9277V30.1221L21.4216 29.3283Z" fill="#5E2AD8"/>
-<path d="M23.308 30.012V30.2226V30.417L23.3062 30.6006L22.795 30.3054L22.7968 30.1218V29.9274V29.7168L23.308 30.012Z" fill="#E6EAEC"/>
-<path d="M24.2944 36.3973V36.5539L23.0398 35.8285V35.6719L24.2944 36.3973Z" fill="#B0C4C9"/>
-<path d="M22.4637 35.0238C22.5321 35.0634 22.5861 35.157 22.5861 35.2344L22.5807 36.885C22.5807 36.9624 22.5249 36.9948 22.4583 36.9552L21.0453 36.1398C20.9769 36.1002 20.9229 36.0066 20.9229 35.9292L20.9283 34.2786C20.9283 34.2012 20.9841 34.1688 21.0507 34.2084L22.4637 35.0238Z" fill="#E6EAEC"/>
-<path d="M22.7153 34.8238C22.8071 34.876 22.881 35.0056 22.881 35.1118L22.8737 37.3528C22.8737 37.459 22.7982 37.5022 22.7064 37.4482L21.2034 36.5806L20.7876 36.3412C20.6958 36.289 20.6219 36.1594 20.6219 36.0532L20.6291 33.8122C20.6291 33.706 20.7047 33.6646 20.7965 33.7168L21.2123 33.9562L22.7153 34.8238ZM22.5785 36.8848L22.5839 35.2342C22.5839 35.1568 22.5299 35.0614 22.4615 35.0236L21.0485 34.2082C20.9801 34.1686 20.9261 34.201 20.9261 34.2784L20.9207 35.929C20.9207 36.0064 20.9747 36.1018 21.0431 36.1396L22.4561 36.955C22.5245 36.9946 22.5785 36.9622 22.5785 36.8848Z" fill="#B0C4C9"/>
-<path d="M24.2925 37.1689V37.3255L23.0379 36.6019V36.4453L24.2925 37.1689Z" fill="#B0C4C9"/>
-<path d="M24.2943 36.7588L24.2925 36.9154L23.0379 36.1918L23.0397 36.0352L24.2943 36.7588Z" fill="#B0C4C9"/>
-<path d="M23.5924 34.0586L24.6238 35.81L23.5888 35.2124L23.5924 34.0586Z" fill="#B0C4C9"/>
-<path d="M23.5888 35.2127L24.6256 35.8103L24.6148 39.8046L21.2038 37.8353L21.2074 36.5789L22.7104 37.4465C22.8022 37.4987 22.8778 37.4573 22.8778 37.3511L22.885 35.1101C22.885 35.0039 22.8112 34.8761 22.7194 34.8221L21.2164 33.9545L21.22 32.6855L23.5942 34.0571L23.5906 35.2109L23.5888 35.2127ZM24.2908 37.7075V37.551L23.0362 36.8273V36.9839L24.2908 37.7075ZM24.2926 36.9155V36.7589L23.038 36.0353V36.1919L24.2926 36.9155ZM24.2926 37.3259V37.1693L23.038 36.4457V36.6023L24.2926 37.3259ZM24.2944 36.5519V36.3953L23.0398 35.6717V35.8283L24.2944 36.5519Z" fill="#E6EAEC"/>
-<path d="M24.2907 37.5506V37.7072L23.0361 36.9836V36.8252L24.2907 37.5506Z" fill="#B0C4C9"/>
-<path d="M41.1582 31.505L41.1348 39.7058L33.996 35.5856L34.0194 27.3848L41.1582 31.505Z" fill="#C8D6DC"/>
-<path d="M48.756 35.8936L48.7326 44.0926L41.5956 39.9724L41.619 31.7734L48.756 35.8936Z" fill="#C8D6DC"/>
-<path d="M41.1338 40.2364L41.1104 48.4372L33.9716 44.3152L33.995 36.1162L41.1338 40.2364Z" fill="#C8D6DC"/>
-<path d="M48.7306 44.6231L48.7072 52.8239L41.5702 48.7037L41.5936 40.5029L48.7306 44.6231Z" fill="#C8D6DC"/>
-<path d="M11.8438 37.2073L11.842 38.1631L11.0104 37.6825L11.0122 36.7285L11.8438 37.2073Z" fill="white"/>
-<path d="M12.7298 37.7181L12.728 38.6739L11.8964 38.1933L11.8982 37.2393L12.7298 37.7181Z" fill="white"/>
-<path d="M11.8419 38.2257L11.8383 39.1797L11.0067 38.7009L11.0103 37.7451L11.8419 38.2257Z" fill="white"/>
-<path d="M12.7275 38.7374L12.7239 39.6932L11.8923 39.2126L11.8959 38.2568L12.7275 38.7374Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_7996_40513" x1="36.4801" y1="61.0192" x2="25.6801" y2="57.4192" gradientUnits="userSpaceOnUse">
-<stop offset="0.107383" stop-color="#8CACB7"/>
-<stop offset="1" stop-color="#C9D7DD"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7996_40513" x1="146.23" y1="-10.9615" x2="-5.62519" y2="50.2349" gradientUnits="userSpaceOnUse">
-<stop offset="0.35" stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.44" stop-color="#4C7F8E" stop-opacity="0.47"/>
-<stop offset="0.54" stop-color="#4C7F8E" stop-opacity="0.37"/>
-<stop offset="0.65" stop-color="#4C7F8E" stop-opacity="0.21"/>
-<stop offset="0.75" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint2_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(32.9322 37.0702) scale(28.5336 28.5336)">
-<stop offset="0.41" stop-color="#88959B" stop-opacity="0.28"/>
-<stop offset="0.615" stop-color="#88959B" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="#88959B" stop-opacity="0.619608"/>
-<stop offset="1" stop-color="#88959B" stop-opacity="0.6"/>
-</radialGradient>
-<radialGradient id="paint3_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(81.9372 7.51073) scale(86.6808 86.6808)">
-<stop stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.13" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.21" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.54" stop-color="white" stop-opacity="0"/>
-</radialGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6706_29760)"><path fill="#0dadea" d="M29.509 37.991V66.16L0 62.092v-24.1zm0-32.15v28.514H0V9.908zM72 37.99V72l-39.245-5.408v-28.6zM72 0v34.355H32.755V5.408z"/></g><defs><clipPath id="clip0_6706_29760"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/windows-light.svg b/web/packages/design/src/ResourceIcon/assets/windows-light.svg
index 9cfce762ed57e..e5a83e243d1a0 100644
--- a/web/packages/design/src/ResourceIcon/assets/windows-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/windows-light.svg
@@ -1,111 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g opacity="0.2">
-<path opacity="0.2" d="M66.5292 29.653L66.4302 64.5298C66.4302 65.041 66.0684 65.248 65.622 64.9906L48.063 54.853L37.0002 48.4504L18.4206 37.7404C17.976 37.483 17.6178 36.862 17.6178 36.3508L17.7168 1.47401C17.7168 0.962812 18.0786 0.757611 18.5232 1.01321L65.7246 28.2616C66.1692 28.519 66.5292 29.14 66.5274 29.6512L66.5292 29.653Z" fill="#4C7F8E"/>
-</g>
-<path d="M27.8401 56.1596V52.5596L39.0001 58.9496V62.6396L27.8401 56.1596Z" fill="#74929F"/>
-<path d="M27.8401 56.1592L25.5901 57.4192L41.4301 66.5992L39.0001 62.6392L27.8401 56.1592Z" fill="url(#paint0_linear_7996_40513)"/>
-<path d="M41.4301 66.6L44.7601 64.62C44.7601 64.62 45.7501 65.61 45.3901 66.15C45.0301 66.69 42.33 68.4 41.7001 68.4C41.0701 68.4 25.6801 59.22 25.6801 59.22C25.2301 58.95 25.0501 58.41 25.0501 58.41C25.0501 58.41 24.6001 57.69 25.3201 57.33L28.1101 55.71L27.8401 56.16L25.5901 57.42L41.4301 66.6Z" fill="#5E2AD8"/>
-<path d="M42.3301 60.6592L44.7601 64.6192L41.4301 66.5992L39.0001 62.6392L42.3301 60.6592Z" fill="#EFF1F3"/>
-<path d="M42.3301 60.6598V58.5898H39.0001V62.6398L42.3301 60.6598Z" fill="#83A2AC"/>
-<path d="M60.5712 31.773L60.4722 66.6499C60.4722 66.9037 60.3804 67.0836 60.2364 67.1665L56.9604 69.0709C57.1062 68.9881 57.1944 68.8081 57.1962 68.5543L57.2952 33.6774C57.297 33.1662 56.937 32.5434 56.4924 32.2878L9.2928 5.03585C9.0696 4.90625 8.8662 4.89365 8.7204 4.98005L11.9964 3.07565C12.1422 2.98925 12.3456 3.00185 12.5688 3.13145L59.7684 30.3834C60.213 30.6409 60.573 31.2618 60.5712 31.773Z" fill="#EFF1F3"/>
-<path d="M29.5968 47.8973C29.6544 47.9297 29.7012 48.0107 29.7012 48.0773V48.9647C29.6976 49.0313 29.6508 49.0583 29.5932 49.0241L28.6158 48.4589C28.5582 48.4265 28.5114 48.3455 28.5114 48.2789V47.3915C28.515 47.3267 28.5618 47.2997 28.6194 47.3321L29.5968 47.8973Z" fill="white"/>
-<path d="M31.5228 49.0096C31.5804 49.042 31.6272 49.123 31.6272 49.1896V50.077C31.6236 50.1436 31.5768 50.1706 31.521 50.1364L30.5418 49.5712C30.4842 49.5388 30.4374 49.4578 30.4374 49.3912V48.5038C30.441 48.439 30.4878 48.412 30.5436 48.4444L31.5228 49.0096Z" fill="#F4F6F7"/>
-<path d="M13.9422 37.8789L13.9332 40.9137L10.5906 38.9841C10.2522 38.7879 9.97862 38.3145 9.98042 37.9257L9.98582 35.5947L13.9422 37.8789Z" fill="#98B3BC"/>
-<path d="M27.471 45.6888L55.812 62.0526L55.8048 64.3188C55.8048 64.7454 55.5006 64.9182 55.1298 64.704L10.6536 39.0216C10.245 38.7858 9.97862 38.325 9.98042 37.947C9.98042 38.3124 10.2522 38.7858 10.5906 38.9802L13.9332 40.9098L13.9422 37.875L13.9386 40.9134L27.4638 48.7218L27.4728 45.687L27.471 45.6888ZM29.6994 48.9666V48.0792C29.703 48.0144 29.6562 47.9334 29.5986 47.8992L28.6212 47.334C28.5636 47.3016 28.5168 47.3268 28.5168 47.3934V48.2808C28.5132 48.3474 28.56 48.4284 28.6176 48.4608L29.595 49.026C29.6526 49.0584 29.6994 49.0332 29.6994 48.9666ZM31.6236 50.079V49.1916C31.6272 49.1268 31.5804 49.0458 31.5228 49.0116L30.5436 48.4464C30.486 48.414 30.4392 48.441 30.4392 48.5058V49.3932C30.4356 49.4598 30.4824 49.5408 30.54 49.5732L31.5192 50.1384C31.5768 50.1708 31.6236 50.1438 31.6236 50.079Z" fill="#7C939D"/>
-<path d="M48.094 58.556C48.1241 58.5775 48.1491 58.6059 48.1671 58.6391C48.1851 58.6723 48.1955 58.7093 48.1976 58.7473V59.6794C48.1976 59.7459 48.1498 59.7792 48.094 59.7459L47.1133 59.1468C47.0824 59.1282 47.0566 59.1015 47.0384 59.0694C47.0203 59.0374 47.0104 59.001 47.0096 58.9637V58.04C47.0096 57.9651 47.0575 57.9402 47.1133 57.9735L48.094 58.556Z" fill="white"/>
-<path d="M53.8665 61.8588C53.8987 61.8798 53.9254 61.9081 53.9444 61.9414C53.9634 61.9746 53.9741 62.0118 53.9757 62.05V62.9811C53.9757 63.0476 53.9253 63.0725 53.8665 63.0392L52.8249 62.449C52.7927 62.428 52.766 62.3997 52.747 62.3664C52.728 62.3332 52.7173 62.296 52.7157 62.2578V61.3268C52.7157 61.2603 52.7661 61.2353 52.8249 61.2686L53.8665 61.8588Z" fill="#5E2AD8"/>
-<path d="M50.0214 59.6767C50.0532 59.6939 50.0798 59.72 50.098 59.7523C50.1162 59.7845 50.1253 59.8214 50.1243 59.8588V60.7858C50.1243 60.8603 50.0768 60.8851 50.0214 60.852L49.0473 60.2644C49.0159 60.2439 48.9895 60.216 48.9703 60.1829C48.951 60.1499 48.9394 60.1126 48.9364 60.074V59.147C48.9364 59.0725 48.9839 59.0477 49.0394 59.0808L50.0214 59.6767Z" fill="#F4F6F7"/>
-<path d="M51.9409 60.7626C51.9747 60.7819 52.0026 60.8097 52.0218 60.8433C52.041 60.8768 52.0508 60.9149 52.0501 60.9534V61.8826C52.0501 61.9489 51.9997 61.9738 51.9409 61.9406L50.9077 61.3516C50.8739 61.3316 50.8456 61.3037 50.8251 61.2705C50.8046 61.2373 50.7926 61.1996 50.7901 61.1608V60.2316C50.7901 60.1653 50.8405 60.1321 50.8993 60.1736L51.9409 60.7626Z" fill="#E4EAED"/>
-<path d="M13.9454 37.8809L27.4706 45.6893L27.4616 48.7241L13.9364 40.9157L13.9454 37.8809ZM16.2296 41.3891L16.2332 40.1057C16.2332 40.0211 16.1738 39.9167 16.1 39.8753L14.984 39.2309C14.9102 39.1877 14.8508 39.2219 14.8508 39.3065L14.8472 40.5899C14.8472 40.6745 14.9066 40.7771 14.9804 40.8203L16.0964 41.4647C16.1702 41.5061 16.2296 41.4719 16.2296 41.3891Z" fill="#7C939D"/>
-<path d="M16.1004 39.875C16.1742 39.9164 16.2336 40.0208 16.2336 40.1054L16.23 41.3888C16.23 41.4734 16.1688 41.5076 16.0968 41.4644L14.9808 40.82C14.907 40.7768 14.8476 40.6742 14.8476 40.5896L14.8512 39.3062C14.8512 39.2216 14.9124 39.1874 14.9844 39.2306L16.1004 39.875Z" fill="white"/>
-<path d="M55.8916 34.1483L55.8124 62.0501L27.4714 45.6881L13.9462 37.8797L9.98621 35.5937L10.0654 7.69005C10.0672 7.26345 10.3714 7.09066 10.744 7.30486L55.2202 32.9837C55.591 33.1979 55.8952 33.7217 55.8916 34.1483Z" fill="white"/>
-<g opacity="0.8">
-<path opacity="0.8" d="M55.8916 34.1483L55.8124 62.0501L27.4714 45.6881L13.9462 37.8797L9.98621 35.5937L10.0654 7.69005C10.0672 7.26345 10.3714 7.09066 10.744 7.30486L55.2202 32.9837C55.591 33.1979 55.8952 33.7217 55.8916 34.1483Z" fill="url(#paint1_linear_7996_40513)"/>
-</g>
-<path d="M10.744 7.30577L14.02 5.40137L58.4962 31.0802L55.2202 32.9846L10.744 7.30577Z" fill="white"/>
-<path d="M37.1913 55.5295C37.3509 55.6352 37.4838 55.777 37.5791 55.9437C37.6745 56.1103 37.7297 56.2972 37.7404 56.4892C37.7404 56.8438 37.4918 56.9794 37.1913 56.8021L29.1096 52.1081C28.9494 52.0031 28.8161 51.8614 28.7206 51.6946C28.6252 51.5278 28.5703 51.3407 28.5604 51.1484C28.5604 50.8042 28.8091 50.6582 29.1199 50.8355L37.1913 55.5295Z" fill="#C0C0C0"/>
-<path d="M56.5842 32.3326L9.38462 5.08236C8.94002 4.82496 8.57822 5.03196 8.57642 5.54316L8.47742 40.42C8.47742 40.9312 8.83562 41.554 9.28022 41.8114L27.858 52.5232L38.9208 58.9258L56.4798 69.0634C56.9244 69.3208 57.2862 69.1138 57.288 68.6026L57.387 33.7258C57.387 33.2146 57.0288 32.5918 56.5842 32.3362V32.3326ZM36.6132 56.2798L30.4392 52.7158C30.207 52.5808 30.018 52.2532 30.018 51.9868C30.018 51.7204 30.2088 51.6106 30.441 51.7456L36.615 55.3114C36.8472 55.4446 37.0362 55.774 37.0362 56.0404C37.0362 56.3068 36.8454 56.4166 36.6132 56.2816V56.2798ZM55.812 62.0542L55.8048 64.3204C55.8048 64.747 55.5006 64.9198 55.128 64.7038L10.5726 38.9764C10.2432 38.7856 9.97862 38.3266 9.97862 37.8568L10.065 7.69056C10.065 7.26396 10.371 7.09116 10.7418 7.30536L55.218 32.9842C55.5888 33.1984 55.893 33.7222 55.8912 34.1488L55.812 62.0506" fill="#EFF1F3"/>
-<path d="M56.5842 32.3326L9.38462 5.08236C8.94002 4.82496 8.57822 5.03196 8.57642 5.54316L8.47742 40.42C8.47742 40.9312 8.83562 41.554 9.28022 41.8114L27.858 52.5232L38.9208 58.9258L56.4798 69.0634C56.9244 69.3208 57.2862 69.1138 57.288 68.6026L57.387 33.7258C57.387 33.2146 57.0288 32.5918 56.5842 32.3362V32.3326ZM55.812 62.0542L55.8048 64.3204C55.8048 64.747 55.5006 64.9198 55.128 64.7038L10.5726 38.9764C10.2432 38.7856 9.97862 38.3266 9.97862 37.8568L10.065 7.69056C10.065 7.26396 10.371 7.09116 10.7418 7.30536L55.218 32.9842C55.5888 33.1984 55.893 33.7222 55.8912 34.1488L55.812 62.0506" fill="url(#paint2_radial_7996_40513)"/>
-<path d="M10.6533 39.0227C10.6281 39.0083 10.6047 38.9903 10.5795 38.9741L10.5741 38.9777L28.7109 49.4501L10.6533 39.0245V39.0227ZM29.6685 49.0325C29.6685 49.0325 29.6505 49.0379 29.6415 49.0379C29.6505 49.0379 29.6613 49.0379 29.6685 49.0325ZM29.6343 49.0397C29.6217 49.0397 29.6073 49.0343 29.5929 49.0253C29.6073 49.0343 29.6217 49.0379 29.6343 49.0397ZM11.7711 38.2793L11.1357 38.6483L11.7693 39.1163V38.2793H11.7711ZM53.9433 63.0527C53.9433 63.0527 53.9325 63.0527 53.9289 63.0563C53.9343 63.0563 53.9397 63.0563 53.9433 63.0527ZM52.0191 61.9421C52.0191 61.9421 52.0065 61.9457 51.9993 61.9457C52.0065 61.9457 52.0137 61.9457 52.0191 61.9421ZM51.9849 61.9493C51.9723 61.9493 51.9579 61.9439 51.9435 61.9349C51.9579 61.9439 51.9723 61.9475 51.9849 61.9493ZM52.0497 61.8737L51.9453 61.9349C51.9795 61.9151 52.0155 61.8935 52.0497 61.8737ZM50.0607 60.8369C50.0481 60.8369 50.0337 60.8315 50.0193 60.8225C50.0337 60.8315 50.0481 60.8351 50.0607 60.8369ZM50.0931 60.8297C50.0931 60.8297 50.0769 60.8351 50.0679 60.8351C50.0769 60.8351 50.0859 60.8351 50.0931 60.8297ZM48.1689 59.7191C48.1599 59.7245 48.1473 59.7263 48.1365 59.7263C48.1491 59.7263 48.1599 59.7263 48.1689 59.7191ZM31.5945 50.1431C31.5855 50.1485 31.5729 50.1503 31.5621 50.1503C31.5747 50.1503 31.5855 50.1503 31.5945 50.1431ZM53.6589 61.7945L53.3853 61.9529C53.4753 61.9007 53.5671 61.8485 53.6589 61.7945ZM47.8845 58.4609L47.6901 58.5743C47.7549 58.5365 47.8179 58.5005 47.8845 58.4609ZM47.0457 58.0127C47.0277 58.0235 47.0151 58.0469 47.0151 58.0793C47.0151 58.0469 47.0259 58.0235 47.0457 58.0127Z" fill="#EFF1F3"/>
-<path d="M10.5924 38.9817L10.6104 38.9925C10.6104 38.9925 10.5996 38.9853 10.5942 38.9817H10.5924ZM11.7714 38.2959L11.1468 38.6595L11.7696 39.1185V38.2959H11.7714Z" fill="#C8D6DC"/>
-<path d="M11.771 38.2096L11.6234 38.125L10.952 38.5156L11.7692 39.1168L11.771 38.2096Z" fill="#98B3BC"/>
-<path d="M9.38464 5.08213L12.6624 3.17773L59.862 30.4279L56.5842 32.3323L9.38464 5.08213Z" fill="#EFF1F3"/>
-<path d="M60.5712 31.773L60.4722 66.6499C60.4722 66.9037 60.3804 67.0836 60.2364 67.1665L56.9604 69.0709C57.1062 68.9881 57.1944 68.8081 57.1962 68.5543L57.2952 33.6774C57.297 33.1662 56.937 32.5434 56.4924 32.2878L9.2928 5.03585C9.0696 4.90625 8.8662 4.89365 8.7204 4.98005L11.9964 3.07565C12.1422 2.98925 12.3456 3.00185 12.5688 3.13145L59.7684 30.3834C60.213 30.6409 60.573 31.2618 60.5712 31.773Z" fill="#5E2AD8"/>
-<path d="M60.5712 31.7027L60.4722 66.5795C60.4722 66.8333 60.3804 67.0133 60.2364 67.0961L56.9604 69.0005C57.1062 68.9177 57.1944 68.7377 57.1962 68.4839L57.2952 33.6071C57.297 33.0959 56.937 32.4731 56.4924 32.2175L9.2928 4.96553C9.0696 4.83593 8.8662 4.82334 8.7204 4.90974L11.9964 3.00533C12.1422 2.91893 12.3456 2.93154 12.5688 3.06114L59.7684 30.3113C60.213 30.5687 60.573 31.1897 60.5712 31.7009V31.7027Z" fill="url(#paint3_radial_7996_40513)"/>
-<path d="M13.0099 20.4998L13.9927 21.9506L13.9819 25.5146V26.3516L13.5535 25.7396L13.5571 24.701C13.5571 24.6254 13.5049 24.5336 13.4383 24.494L13.0009 24.242L13.0117 20.498L13.0099 20.4998Z" fill="#E6EAEC"/>
-<path d="M13.4367 24.497C13.5033 24.5348 13.5573 24.6284 13.5555 24.704L13.5519 25.7426V26.2052C13.5519 26.2808 13.4961 26.3114 13.4295 26.2736L12.1245 25.5194C12.0579 25.4816 12.0039 25.388 12.0057 25.3124L12.0093 23.8112C12.0093 23.7356 12.0633 23.705 12.1299 23.7428L12.9975 24.2432L13.4349 24.4952L13.4367 24.497Z" fill="#5E2AD8"/>
-<path d="M15.7357 22.0734L15.7267 25.4124C15.7897 25.5564 15.8527 25.7022 15.9139 25.8462C15.9103 26.109 15.9067 26.3718 15.9031 26.6346C15.2623 26.262 14.6215 25.8894 13.9807 25.5168L13.9915 21.9528L13.0087 20.502L15.7339 22.0752L15.7357 22.0734Z" fill="#B0C4C9"/>
-<path d="M13.507 32.7325C13.5736 32.7703 13.6276 32.8639 13.6258 32.9395L13.6222 33.9781V34.4407C13.6222 34.5163 13.5664 34.5469 13.4998 34.5091L12.1948 33.7549C12.1282 33.7171 12.0742 33.6235 12.076 33.5479L12.0796 32.0485C12.0796 31.9729 12.1336 31.9423 12.2002 31.9801L13.0678 32.4805L13.5052 32.7325H13.507Z" fill="#5E2AD8"/>
-<path d="M16.5957 34.7465V35.0291L14.5761 33.8627V33.5801L16.5957 34.7465Z" fill="#B0C4C9"/>
-<path d="M13.0803 28.7362L14.0631 30.187L14.0523 33.7564V34.588L13.6239 33.976L13.6275 32.9374C13.6275 32.8618 13.5735 32.7682 13.5087 32.7304L13.0713 32.4784L13.0821 28.7344L13.0803 28.7362Z" fill="#E6EAEC"/>
-<path d="M16.5975 34.2925L16.5957 34.5751L14.5779 33.4087V33.1279L16.5975 34.2925Z" fill="#B0C4C9"/>
-<path d="M16.0481 32.1546V32.295L14.5829 31.449V31.3086L16.0481 32.1546Z" fill="#B0C4C9"/>
-<path d="M16.1602 32.4493L16.7848 32.8093L16.7776 35.6641L14.4304 34.3087V33.9775L14.4412 30.6943L15.8038 31.4809L16.1638 31.6897V32.4493H16.1602ZM16.5958 34.1233V33.3691L14.5798 32.2027V32.9569L16.5958 34.1233ZM16.594 35.0287V34.7461L14.5762 33.5797V33.8623L16.594 35.0287ZM16.594 34.5751V34.2925L14.5762 33.1261V33.4087L16.594 34.5751ZM16.5976 33.1909V32.9083L14.5798 31.7419V32.0245L16.5976 33.1909ZM14.5798 31.3081V31.4485L16.045 32.2945V32.1541L14.5798 31.3081Z" fill="#E6EAEC"/>
-<path d="M16.5993 33.3695L16.5975 34.1219L14.5779 32.9573L14.5815 32.2031L16.5993 33.3695Z" fill="#B0C4C9"/>
-<path d="M16.6015 32.9087L16.5997 33.1913L14.5819 32.0249V31.7441L16.6015 32.9087Z" fill="#B0C4C9"/>
-<path d="M16.1619 31.6904L16.7847 32.81L16.1601 32.45L16.1619 31.6904Z" fill="#B0C4C9"/>
-<path d="M15.8052 30.3095L15.8016 31.4813L14.439 30.6947L14.43 33.9797L14.052 33.7565L14.061 30.1871L13.08 28.7363L15.8052 30.3095Z" fill="#B0C4C9"/>
-<path d="M12.886 11.9043L16.369 15.1803L16.36 18.1449L12.8788 14.8725L12.886 11.9043Z" fill="#5E2AD8"/>
-<path d="M12.4633 15.5314L15.4531 18.424L15.3181 18.4168L14.1211 18.3502L11.2015 15.49L11.0575 15.3496L12.4633 15.5314Z" fill="#E6EAEC"/>
-<path d="M11.0572 15.3496L11.2012 15.49L14.1208 18.3502L15.3178 18.4168L15.4528 18.424V18.5464L14.1208 18.4726L11.0554 15.472L11.0572 15.3496Z" fill="#B0C4C9"/>
-<path d="M14.5222 16.4922L15.4564 17.3706V17.4156C15.4564 17.5038 15.3934 17.5398 15.316 17.4948L14.659 17.115C14.5816 17.07 14.5204 16.962 14.5204 16.8756V16.4922H14.5222Z" fill="#E6EAEC"/>
-<path d="M14.5209 16.7391V16.8759C14.5209 16.9641 14.5821 17.0721 14.6595 17.1153L15.3165 17.4951C15.3939 17.5401 15.4551 17.5041 15.4569 17.4159V17.3709L16.0941 17.9703C16.0437 18.1017 15.5343 17.9361 14.9151 17.5779C14.2617 17.2017 13.7325 16.7535 13.7343 16.5807C13.7343 16.4439 14.0637 16.5177 14.5227 16.7391H14.5209Z" fill="#B0C4C9"/>
-<path d="M12.7978 11.7461L16.4572 15.1877L16.4482 18.3035L16.0918 17.9687L15.4546 17.3693L14.5204 16.4909L12.7888 14.8637L12.7978 11.7461ZM16.36 18.1451L16.369 15.1787L12.886 11.9045L12.877 14.8709L16.36 18.1451Z" fill="#E6EAEC"/>
-<path d="M13.0857 11.8307L16.6533 15.1967L16.6443 18.3107L16.4481 18.3035L16.4571 15.1877L12.7977 11.7461L13.0857 11.8307Z" fill="#B0C4C9"/>
-<path d="M22.133 21.322C22.1996 21.3598 22.2518 21.4516 22.2518 21.5272L22.2482 22.564V23.0266C22.2482 23.1022 22.1924 23.1328 22.1276 23.095L20.8208 22.3408C20.7542 22.303 20.702 22.2112 20.702 22.1356L20.7056 20.6344C20.7056 20.5588 20.7596 20.5282 20.8262 20.566L21.6938 21.0664L22.1312 21.3184L22.133 21.322Z" fill="#5E2AD8"/>
-<path d="M21.7059 17.3242L21.8679 17.5636L22.6869 18.775L22.6761 22.5082V23.176L22.2477 22.564L22.2513 21.5272C22.2513 21.4516 22.1991 21.3598 22.1325 21.322L21.6951 21.07L21.7059 17.326V17.3242Z" fill="#E6EAEC"/>
-<path d="M24.4312 18.8974L24.4294 19.4698L22.2046 17.74L22.2028 17.8912L21.868 17.5474V17.5636L21.706 17.3242L24.4312 18.8974Z" fill="#B0C4C9"/>
-<path d="M21.8679 17.5479L22.2027 17.8917L23.8641 19.6017L23.8551 23.0451L23.8533 23.7291L22.6761 22.5087L22.6869 18.7755L21.8679 17.5641V17.5479Z" fill="#B0C4C9"/>
-<path d="M22.2048 17.7402L24.4296 19.47L24.7878 19.7472L24.777 23.8926L23.8554 23.0448L23.8644 19.6014L22.203 17.8914L22.2048 17.7402Z" fill="#E6EAEC"/>
-<path d="M22.2455 27.0301L22.2419 28.0723L23.1491 28.5961C23.1491 29.1739 22.7405 29.4061 22.2383 29.1163C21.7361 28.8265 21.3329 28.1263 21.3329 27.5485C21.3329 26.9725 21.7415 26.7403 22.2437 27.0301H22.2455Z" fill="#E6EAEC"/>
-<path d="M23.3075 30.2227L24.9185 31.1533L24.9167 31.3459L23.3075 30.4171V30.2227Z" fill="#5E2AD8"/>
-<path d="M22.2461 27.0303C22.7483 27.3201 23.1515 28.0203 23.1515 28.5963L22.2443 28.0725L22.2479 27.0303H22.2461Z" fill="#5E2AD8"/>
-<path d="M24.9226 29.3143L24.9208 30.0127L23.866 29.4043L23.8678 28.7041L24.9226 29.3143Z" fill="#5E2AD8"/>
-<path d="M24.9245 28.7256L24.9227 29.3142L23.8679 28.704L23.8661 29.4042L24.9209 30.0126L24.9191 30.6624L23.8643 30.054L23.8661 29.6328V29.5392L23.8697 28.1172L24.9245 28.7256Z" fill="#E6EAEC"/>
-<path d="M25.3744 28.3566C25.4248 28.3854 25.468 28.4574 25.4662 28.5168L25.4554 32.133C25.4554 32.1924 25.414 32.2158 25.3618 32.1852L20.923 29.622C20.8726 29.5932 20.8294 29.5212 20.8312 29.4618L20.842 25.8456C20.842 25.7862 20.8834 25.7628 20.9356 25.7916L25.3744 28.3548V28.3566ZM24.9226 29.3124V28.7238L23.8696 28.1154L23.866 29.5374L23.524 29.3394V28.7634L23.1514 28.5474V28.5942C23.1514 28.0182 22.7482 27.318 22.246 27.0282C21.7438 26.7384 21.337 26.9706 21.3352 27.5466C21.3352 28.1244 21.7384 28.8246 22.2406 29.1144C22.7428 29.4042 23.1496 29.172 23.1514 28.5942V28.6428L23.443 28.812V29.388L23.866 29.6328V30.054L24.9208 30.6624V30.0126L24.9244 29.3124H24.9226ZM24.919 31.3446V31.152L23.3098 30.2232V30.0126L22.7986 29.7174V29.928L21.4234 29.1342V29.3268L22.7968 30.1206V30.3042L23.308 30.5994V30.4158L24.919 31.3446Z" fill="#B0C4C9"/>
-<path d="M23.5256 28.7648L23.5238 29.3408L23.8658 29.5388V29.6324L23.441 29.3876L23.4428 28.8134L23.1512 28.6442V28.5488L23.5256 28.7648Z" fill="#5E2AD8"/>
-<path d="M21.4216 29.3283V29.1357L22.7968 29.9277V30.1221L21.4216 29.3283Z" fill="#5E2AD8"/>
-<path d="M23.308 30.012V30.2226V30.417L23.3062 30.6006L22.795 30.3054L22.7968 30.1218V29.9274V29.7168L23.308 30.012Z" fill="#E6EAEC"/>
-<path d="M24.2944 36.3973V36.5539L23.0398 35.8285V35.6719L24.2944 36.3973Z" fill="#B0C4C9"/>
-<path d="M22.4637 35.0238C22.5321 35.0634 22.5861 35.157 22.5861 35.2344L22.5807 36.885C22.5807 36.9624 22.5249 36.9948 22.4583 36.9552L21.0453 36.1398C20.9769 36.1002 20.9229 36.0066 20.9229 35.9292L20.9283 34.2786C20.9283 34.2012 20.9841 34.1688 21.0507 34.2084L22.4637 35.0238Z" fill="#E6EAEC"/>
-<path d="M22.7153 34.8238C22.8071 34.876 22.881 35.0056 22.881 35.1118L22.8737 37.3528C22.8737 37.459 22.7982 37.5022 22.7064 37.4482L21.2034 36.5806L20.7876 36.3412C20.6958 36.289 20.6219 36.1594 20.6219 36.0532L20.6291 33.8122C20.6291 33.706 20.7047 33.6646 20.7965 33.7168L21.2123 33.9562L22.7153 34.8238ZM22.5785 36.8848L22.5839 35.2342C22.5839 35.1568 22.5299 35.0614 22.4615 35.0236L21.0485 34.2082C20.9801 34.1686 20.9261 34.201 20.9261 34.2784L20.9207 35.929C20.9207 36.0064 20.9747 36.1018 21.0431 36.1396L22.4561 36.955C22.5245 36.9946 22.5785 36.9622 22.5785 36.8848Z" fill="#B0C4C9"/>
-<path d="M24.2925 37.1689V37.3255L23.0379 36.6019V36.4453L24.2925 37.1689Z" fill="#B0C4C9"/>
-<path d="M24.2943 36.7588L24.2925 36.9154L23.0379 36.1918L23.0397 36.0352L24.2943 36.7588Z" fill="#B0C4C9"/>
-<path d="M23.5924 34.0586L24.6238 35.81L23.5888 35.2124L23.5924 34.0586Z" fill="#B0C4C9"/>
-<path d="M23.5888 35.2127L24.6256 35.8103L24.6148 39.8046L21.2038 37.8353L21.2074 36.5789L22.7104 37.4465C22.8022 37.4987 22.8778 37.4573 22.8778 37.3511L22.885 35.1101C22.885 35.0039 22.8112 34.8761 22.7194 34.8221L21.2164 33.9545L21.22 32.6855L23.5942 34.0571L23.5906 35.2109L23.5888 35.2127ZM24.2908 37.7075V37.551L23.0362 36.8273V36.9839L24.2908 37.7075ZM24.2926 36.9155V36.7589L23.038 36.0353V36.1919L24.2926 36.9155ZM24.2926 37.3259V37.1693L23.038 36.4457V36.6023L24.2926 37.3259ZM24.2944 36.5519V36.3953L23.0398 35.6717V35.8283L24.2944 36.5519Z" fill="#E6EAEC"/>
-<path d="M24.2907 37.5506V37.7072L23.0361 36.9836V36.8252L24.2907 37.5506Z" fill="#B0C4C9"/>
-<path d="M41.1582 31.505L41.1348 39.7058L33.996 35.5856L34.0194 27.3848L41.1582 31.505Z" fill="#C8D6DC"/>
-<path d="M48.756 35.8936L48.7326 44.0926L41.5956 39.9724L41.619 31.7734L48.756 35.8936Z" fill="#C8D6DC"/>
-<path d="M41.1338 40.2364L41.1104 48.4372L33.9716 44.3152L33.995 36.1162L41.1338 40.2364Z" fill="#C8D6DC"/>
-<path d="M48.7306 44.6231L48.7072 52.8239L41.5702 48.7037L41.5936 40.5029L48.7306 44.6231Z" fill="#C8D6DC"/>
-<path d="M11.8438 37.2073L11.842 38.1631L11.0104 37.6825L11.0122 36.7285L11.8438 37.2073Z" fill="white"/>
-<path d="M12.7298 37.7181L12.728 38.6739L11.8964 38.1933L11.8982 37.2393L12.7298 37.7181Z" fill="white"/>
-<path d="M11.8419 38.2257L11.8383 39.1797L11.0067 38.7009L11.0103 37.7451L11.8419 38.2257Z" fill="white"/>
-<path d="M12.7275 38.7374L12.7239 39.6932L11.8923 39.2126L11.8959 38.2568L12.7275 38.7374Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_7996_40513" x1="36.4801" y1="61.0192" x2="25.6801" y2="57.4192" gradientUnits="userSpaceOnUse">
-<stop offset="0.107383" stop-color="#8CACB7"/>
-<stop offset="1" stop-color="#C9D7DD"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7996_40513" x1="146.23" y1="-10.9615" x2="-5.62519" y2="50.2349" gradientUnits="userSpaceOnUse">
-<stop offset="0.35" stop-color="#4C7F8E" stop-opacity="0.5"/>
-<stop offset="0.44" stop-color="#4C7F8E" stop-opacity="0.47"/>
-<stop offset="0.54" stop-color="#4C7F8E" stop-opacity="0.37"/>
-<stop offset="0.65" stop-color="#4C7F8E" stop-opacity="0.21"/>
-<stop offset="0.75" stop-color="#4C7F8E" stop-opacity="0"/>
-<stop offset="1" stop-color="#4C7F8E" stop-opacity="0"/>
-</linearGradient>
-<radialGradient id="paint2_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(32.9322 37.0702) scale(28.5336 28.5336)">
-<stop offset="0.41" stop-color="#88959B" stop-opacity="0.28"/>
-<stop offset="0.615" stop-color="#88959B" stop-opacity="0.3"/>
-<stop offset="0.87" stop-color="#88959B" stop-opacity="0.619608"/>
-<stop offset="1" stop-color="#88959B" stop-opacity="0.6"/>
-</radialGradient>
-<radialGradient id="paint3_radial_7996_40513" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(81.9372 7.51073) scale(86.6808 86.6808)">
-<stop stop-color="white" stop-opacity="0.6"/>
-<stop offset="0.13" stop-color="white" stop-opacity="0.42"/>
-<stop offset="0.21" stop-color="white" stop-opacity="0.3"/>
-<stop offset="0.54" stop-color="white" stop-opacity="0"/>
-</radialGradient>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_6706_29761)"><path fill="#0078d4" d="M29.509 37.991V66.16L0 62.092v-24.1zm0-32.15v28.514H0V9.908zM72 37.99V72l-39.245-5.408v-28.6zM72 0v34.355H32.755V5.408z"/></g><defs><clipPath id="clip0_6706_29761"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/wiz-dark.svg b/web/packages/design/src/ResourceIcon/assets/wiz-dark.svg
index d2ad8020b02d4..c2328ab33359c 100644
--- a/web/packages/design/src/ResourceIcon/assets/wiz-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/wiz-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17688_5710)">
-<path d="M21.6472 34.0313C21.6969 34.138 21.8495 34.1343 21.8918 34.024L25.8078 23.8156C25.8989 23.5785 26.0595 23.3743 26.2685 23.2299C26.4776 23.0855 26.7254 23.0076 26.9794 23.0063L30.6305 22.9861C30.8346 22.9847 31.036 23.0329 31.2175 23.1265C31.3989 23.2201 31.5549 23.3562 31.6721 23.5234C31.7893 23.6905 31.8642 23.8836 31.8904 24.086C31.9166 24.2884 31.8932 24.4942 31.8224 24.6857L22.8319 48.5205C22.5135 49.3165 21.642 48.8888 21.3952 48.2936L16.6828 36.9356C16.6308 36.8208 16.5473 36.7231 16.442 36.6538C16.3367 36.5844 16.214 36.5463 16.088 36.5438C15.9619 36.5413 15.8378 36.5745 15.7299 36.6396C15.6219 36.7048 15.5346 36.7991 15.4781 36.9117L9.5701 48.7295C9.55843 48.7526 9.54034 48.7718 9.51801 48.7848C9.49568 48.7979 9.47005 48.8042 9.44421 48.803C9.41837 48.8019 9.39342 48.7933 9.37236 48.7783C9.35129 48.7633 9.33501 48.7425 9.32546 48.7184L0.0846285 24.6912C0.0108516 24.5 -0.0152614 24.2938 0.00854665 24.0902C0.0323547 23.8867 0.105367 23.6921 0.221274 23.5231C0.33718 23.3541 0.492493 23.2159 0.673787 23.1204C0.855081 23.025 1.0569 22.9751 1.26181 22.9751H5.22926C5.75163 22.9751 6.2225 23.2988 6.40643 23.7862L10.3205 34.0221C10.3629 34.1325 10.5192 34.138 10.567 34.0313L15.5001 23.2933C15.5534 23.177 15.6389 23.0786 15.7465 23.0095C15.8541 22.9405 15.9793 22.9037 16.1071 22.9037C16.235 22.9037 16.3601 22.9405 16.4677 23.0095C16.5753 23.0786 16.6608 23.177 16.7141 23.2933L21.6472 34.0313ZM66.5896 13.3185C66.5602 13.1751 66.253 13.1751 66.2217 13.3185C65.9936 14.4369 65.5173 16.1235 64.6215 17.0193C63.7257 17.915 62.0391 18.3914 60.9207 18.6195C60.7773 18.6508 60.7773 18.958 60.9207 18.9874C62.0391 19.2173 63.7257 19.6937 64.6215 20.5876C65.7913 21.7593 66.1941 23.3576 66.3321 24.3178C66.3431 24.3785 66.5344 24.3877 66.5454 24.327C66.7551 23.2969 67.2334 21.5459 68.1917 20.5894C69.0874 19.6937 70.7741 19.2173 71.8924 18.9874C72.0359 18.958 72.0359 18.6508 71.8924 18.6195C70.7741 18.3914 69.0874 17.915 68.1917 17.0193C67.2959 16.1235 66.8195 14.4369 66.5896 13.3185ZM33.281 24.3803C33.281 23.6814 33.8457 23.1167 34.5428 23.1167H38.3576C39.0565 23.1167 39.6212 23.6814 39.6212 24.3785V47.7381C39.6212 48.4352 39.0547 48.9999 38.3576 48.9999H34.5428C34.2081 48.9999 33.8872 48.8669 33.6506 48.6303C33.4139 48.3937 33.281 48.0727 33.281 47.7381V24.3785V24.3803ZM50.6352 29.7972C50.6606 29.7464 50.6726 29.69 50.67 29.6332C50.6675 29.5765 50.6505 29.5214 50.6206 29.4731C50.5907 29.4248 50.549 29.385 50.4994 29.3573C50.4498 29.3297 50.394 29.3152 50.3372 29.3153H42.7959C42.6301 29.3153 42.4658 29.2826 42.3126 29.219C42.1594 29.1555 42.0202 29.0624 41.903 28.945C41.7858 28.8277 41.6929 28.6884 41.6296 28.5351C41.5663 28.3818 41.5339 28.2175 41.5341 28.0516V24.3803C41.5341 23.6832 42.0988 23.1185 42.7959 23.1185H60.1887C60.7295 23.1185 61.4542 23.5581 61.1966 24.0327L51.1465 42.8344L51.1447 42.8381C51.1182 42.8889 51.1053 42.9457 51.107 43.0029C51.1088 43.0602 51.1252 43.1161 51.1548 43.1651C51.1843 43.2142 51.2259 43.2549 51.2757 43.2833C51.3255 43.3117 51.3817 43.3269 51.439 43.3273H60.6265C61.3236 43.3273 61.8882 43.8939 61.8882 44.591V47.7362C61.8882 48.4352 61.3236 48.9999 60.6265 48.9999H42.1779C41.5709 48.9999 41.4495 48.117 41.7217 47.5725L50.6352 29.7972Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_17688_5710">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000976562)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17688_5710)"><path fill="#fff" d="M21.647 34.031c.05.107.203.103.245-.007l3.916-10.208a1.26 1.26 0 0 1 1.171-.81l3.652-.02a1.262 1.262 0 0 1 1.191 1.7l-8.99 23.835c-.319.795-1.19.368-1.437-.227l-4.712-11.358a.667.667 0 0 0-1.205-.024L9.57 48.73a.134.134 0 0 1-.198.048.13.13 0 0 1-.047-.06L.085 24.691a1.262 1.262 0 0 1 1.177-1.716h3.967c.523 0 .994.324 1.177.811l3.914 10.236c.043.11.2.116.247.01l4.933-10.74a.668.668 0 0 1 1.214 0zM66.59 13.32c-.03-.144-.337-.144-.368 0-.228 1.118-.705 2.804-1.6 3.7s-2.583 1.372-3.701 1.6c-.144.032-.144.339 0 .368 1.118.23 2.805.707 3.7 1.6 1.17 1.172 1.573 2.77 1.711 3.73.011.061.202.07.213.01.21-1.03.688-2.781 1.647-3.738.895-.895 2.582-1.372 3.7-1.602.144-.029.144-.336 0-.367-1.118-.229-2.805-.705-3.7-1.6-.896-.896-1.372-2.583-1.602-3.701M33.28 24.38c0-.699.565-1.263 1.262-1.263h3.815a1.26 1.26 0 0 1 1.263 1.261v23.36c0 .697-.566 1.262-1.263 1.262h-3.815a1.26 1.26 0 0 1-1.262-1.262v-23.36zm17.354 5.417a.333.333 0 0 0-.298-.482h-7.541a1.26 1.26 0 0 1-1.262-1.263V24.38c0-.697.565-1.261 1.262-1.261h17.393c.54 0 1.265.44 1.008.914l-10.05 18.801-.002.004a.335.335 0 0 0 .294.49h9.188c.697 0 1.261.566 1.261 1.263v3.145c0 .7-.564 1.264-1.261 1.264h-18.45c-.606 0-.727-.883-.455-1.428z"/></g><defs><clipPath id="clip0_17688_5710"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/wiz-light.svg b/web/packages/design/src/ResourceIcon/assets/wiz-light.svg
index f00b2042c39e3..14d4044cdd09c 100644
--- a/web/packages/design/src/ResourceIcon/assets/wiz-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/wiz-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_17688_10900)">
-<path d="M21.6472 34.0313C21.6969 34.138 21.8495 34.1343 21.8918 34.024L25.8078 23.8156C25.8989 23.5785 26.0595 23.3743 26.2685 23.2299C26.4776 23.0855 26.7254 23.0076 26.9794 23.0063L30.6305 22.9861C30.8346 22.9847 31.036 23.0329 31.2175 23.1265C31.3989 23.2201 31.5549 23.3562 31.6721 23.5234C31.7893 23.6905 31.8642 23.8836 31.8904 24.086C31.9166 24.2884 31.8932 24.4942 31.8224 24.6857L22.8319 48.5205C22.5135 49.3165 21.642 48.8888 21.3952 48.2936L16.6828 36.9356C16.6308 36.8208 16.5473 36.7231 16.442 36.6538C16.3367 36.5844 16.214 36.5463 16.088 36.5438C15.9619 36.5413 15.8378 36.5745 15.7299 36.6396C15.6219 36.7048 15.5346 36.7991 15.4781 36.9117L9.5701 48.7295C9.55843 48.7526 9.54034 48.7718 9.51801 48.7848C9.49568 48.7979 9.47005 48.8042 9.44421 48.803C9.41837 48.8019 9.39342 48.7933 9.37236 48.7783C9.35129 48.7633 9.33501 48.7425 9.32546 48.7184L0.0846285 24.6912C0.0108516 24.5 -0.0152614 24.2938 0.00854665 24.0902C0.0323547 23.8867 0.105367 23.6921 0.221274 23.5231C0.33718 23.3541 0.492493 23.2159 0.673787 23.1204C0.855081 23.025 1.0569 22.9751 1.26181 22.9751H5.22926C5.75163 22.9751 6.2225 23.2988 6.40643 23.7862L10.3205 34.0221C10.3629 34.1325 10.5192 34.138 10.567 34.0313L15.5001 23.2933C15.5534 23.177 15.6389 23.0786 15.7465 23.0095C15.8541 22.9405 15.9793 22.9037 16.1071 22.9037C16.235 22.9037 16.3601 22.9405 16.4677 23.0095C16.5753 23.0786 16.6608 23.177 16.7141 23.2933L21.6472 34.0313ZM66.5896 13.3185C66.5602 13.1751 66.253 13.1751 66.2217 13.3185C65.9936 14.4369 65.5173 16.1235 64.6215 17.0193C63.7257 17.915 62.0391 18.3914 60.9207 18.6195C60.7773 18.6508 60.7773 18.958 60.9207 18.9874C62.0391 19.2173 63.7257 19.6937 64.6215 20.5876C65.7913 21.7593 66.1941 23.3576 66.3321 24.3178C66.3431 24.3785 66.5344 24.3877 66.5454 24.327C66.7551 23.2969 67.2334 21.5459 68.1917 20.5894C69.0874 19.6937 70.7741 19.2173 71.8924 18.9874C72.0359 18.958 72.0359 18.6508 71.8924 18.6195C70.7741 18.3914 69.0874 17.915 68.1917 17.0193C67.2959 16.1235 66.8195 14.4369 66.5896 13.3185ZM33.281 24.3803C33.281 23.6814 33.8457 23.1167 34.5428 23.1167H38.3576C39.0565 23.1167 39.6212 23.6814 39.6212 24.3785V47.7381C39.6212 48.4352 39.0547 48.9999 38.3576 48.9999H34.5428C34.2081 48.9999 33.8872 48.8669 33.6506 48.6303C33.4139 48.3937 33.281 48.0727 33.281 47.7381V24.3785V24.3803ZM50.6352 29.7972C50.6606 29.7464 50.6726 29.69 50.67 29.6332C50.6675 29.5765 50.6505 29.5214 50.6206 29.4731C50.5907 29.4248 50.549 29.385 50.4994 29.3573C50.4498 29.3297 50.394 29.3152 50.3372 29.3153H42.7959C42.6301 29.3153 42.4658 29.2826 42.3126 29.219C42.1594 29.1555 42.0202 29.0624 41.903 28.945C41.7858 28.8277 41.6929 28.6884 41.6296 28.5351C41.5663 28.3818 41.5339 28.2175 41.5341 28.0516V24.3803C41.5341 23.6832 42.0988 23.1185 42.7959 23.1185H60.1887C60.7295 23.1185 61.4542 23.5581 61.1966 24.0327L51.1465 42.8344L51.1447 42.8381C51.1182 42.8889 51.1053 42.9457 51.107 43.0029C51.1088 43.0602 51.1252 43.1161 51.1548 43.1651C51.1843 43.2142 51.2259 43.2549 51.2757 43.2833C51.3255 43.3117 51.3817 43.3269 51.439 43.3273H60.6265C61.3236 43.3273 61.8882 43.8939 61.8882 44.591V47.7362C61.8882 48.4352 61.3236 48.9999 60.6265 48.9999H42.1779C41.5709 48.9999 41.4495 48.117 41.7217 47.5725L50.6352 29.7972Z" fill="#0254EC"/>
-</g>
-<defs>
-<clipPath id="clip0_17688_10900">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000976562)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_17688_10900)"><path fill="#0254ec" d="M21.647 34.031c.05.107.203.103.245-.007l3.916-10.208a1.26 1.26 0 0 1 1.171-.81l3.652-.02a1.262 1.262 0 0 1 1.191 1.7l-8.99 23.835c-.319.795-1.19.368-1.437-.227l-4.712-11.358a.667.667 0 0 0-1.205-.024L9.57 48.73a.134.134 0 0 1-.198.048.13.13 0 0 1-.047-.06L.085 24.691a1.262 1.262 0 0 1 1.177-1.716h3.967c.523 0 .994.324 1.177.811l3.914 10.236c.043.11.2.116.247.01l4.933-10.74a.668.668 0 0 1 1.214 0zM66.59 13.32c-.03-.144-.337-.144-.368 0-.228 1.118-.705 2.804-1.6 3.7s-2.583 1.372-3.701 1.6c-.144.032-.144.339 0 .368 1.118.23 2.805.707 3.7 1.6 1.17 1.172 1.573 2.77 1.711 3.73.011.061.202.07.213.01.21-1.03.688-2.781 1.647-3.738.895-.895 2.582-1.372 3.7-1.602.144-.029.144-.336 0-.367-1.118-.229-2.805-.705-3.7-1.6-.896-.896-1.372-2.583-1.602-3.701M33.28 24.38c0-.699.565-1.263 1.262-1.263h3.815a1.26 1.26 0 0 1 1.263 1.261v23.36c0 .697-.566 1.262-1.263 1.262h-3.815a1.26 1.26 0 0 1-1.262-1.262v-23.36zm17.354 5.417a.333.333 0 0 0-.298-.482h-7.541a1.26 1.26 0 0 1-1.262-1.263V24.38c0-.697.565-1.261 1.262-1.261h17.393c.54 0 1.265.44 1.008.914l-10.05 18.801-.002.004a.335.335 0 0 0 .294.49h9.188c.697 0 1.261.566 1.261 1.263v3.145c0 .7-.564 1.264-1.261 1.264h-18.45c-.606 0-.727-.883-.455-1.428z"/></g><defs><clipPath id="clip0_17688_10900"><path fill="#fff" d="M0 .001h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/workshop-dark.svg b/web/packages/design/src/ResourceIcon/assets/workshop-dark.svg
index 304623874c471..50abd10f7aeaa 100644
--- a/web/packages/design/src/ResourceIcon/assets/workshop-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/workshop-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16976_12183)">
-<path d="M0.63655 11.0088C0.236691 11.0088 -0.0679696 11.3769 0.0145409 11.7704L4.22258 31.9347C4.28605 32.2267 4.54626 32.4425 4.84457 32.4425H14.0477C14.4666 32.4425 14.6951 32.9376 14.4158 33.2549L11.547 36.5045C11.4137 36.6505 11.3629 36.8536 11.401 37.0504L16.1929 60.8197C16.2501 61.118 16.5103 61.3275 16.8149 61.3275H30.9687C31.2606 61.3275 31.5208 61.1244 31.5907 60.8324C34.5801 48.2464 36.7571 37.9453 38.4898 28.2345H38.8706C40.6732 38.7577 43.0723 49.3571 45.7698 60.8324C45.8396 61.118 46.0935 61.3275 46.3918 61.3275H61.4848C61.7895 61.3275 62.0497 61.1117 62.1068 60.8197L71.9891 11.7641C72.0652 11.3706 71.7669 11.0024 71.3671 11.0024H59.6188C58.4193 11.0024 57.372 11.8466 57.1308 13.0271C54.7634 24.4834 52.8276 35.3748 51.6026 45.3141C49.9842 34.0419 46.9249 22.8395 44.329 12.1259C44.1703 11.4658 43.5801 11.0024 42.9009 11.0024H34.4658C33.7867 11.0024 33.1964 11.4658 33.0314 12.1259C30.0928 24.0581 27.4651 35.2605 25.9863 45.3141L20.585 15.2993L20.1281 13.0398C19.8869 11.8529 18.846 11.0024 17.64 11.0024H0.649237L0.63655 11.0088Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16976_12183">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16976_12183)"><path fill="#fff" d="M.637 11.009c-.4 0-.705.368-.622.761l4.208 20.165a.644.644 0 0 0 .622.508h9.203a.49.49 0 0 1 .368.812l-2.869 3.25a.63.63 0 0 0-.146.545l4.792 23.77a.63.63 0 0 0 .622.508h14.154a.64.64 0 0 0 .622-.496c2.99-12.586 5.166-22.887 6.899-32.597h.38c1.803 10.523 4.202 21.122 6.9 32.597.07.286.323.495.622.495h15.093a.63.63 0 0 0 .622-.507l9.882-49.056a.638.638 0 0 0-.622-.762H59.62a2.54 2.54 0 0 0-2.488 2.025c-2.368 11.456-4.303 22.348-5.528 32.287-1.619-11.272-4.678-22.474-7.274-33.188a1.47 1.47 0 0 0-1.428-1.124h-8.435c-.68 0-1.27.464-1.435 1.124-2.938 11.932-5.566 23.135-7.045 33.188L20.585 15.3l-.457-2.26a2.54 2.54 0 0 0-2.488-2.037H.65z"/></g><defs><clipPath id="clip0_16976_12183"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/workshop-light.svg b/web/packages/design/src/ResourceIcon/assets/workshop-light.svg
index 7fe0d0a18d371..0c8d94efc0dc0 100644
--- a/web/packages/design/src/ResourceIcon/assets/workshop-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/workshop-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16976_12182)">
-<path d="M0.63655 11.0088C0.236691 11.0088 -0.0679696 11.3769 0.0145409 11.7704L4.22258 31.9347C4.28605 32.2267 4.54626 32.4425 4.84457 32.4425H14.0477C14.4666 32.4425 14.6951 32.9376 14.4158 33.2549L11.547 36.5045C11.4137 36.6505 11.3629 36.8536 11.401 37.0504L16.1929 60.8197C16.2501 61.118 16.5103 61.3275 16.8149 61.3275H30.9687C31.2606 61.3275 31.5208 61.1244 31.5907 60.8324C34.5801 48.2464 36.7571 37.9453 38.4898 28.2345H38.8706C40.6732 38.7577 43.0723 49.3571 45.7698 60.8324C45.8396 61.118 46.0935 61.3275 46.3918 61.3275H61.4848C61.7895 61.3275 62.0497 61.1117 62.1068 60.8197L71.9891 11.7641C72.0652 11.3706 71.7669 11.0024 71.3671 11.0024H59.6188C58.4193 11.0024 57.372 11.8466 57.1308 13.0271C54.7634 24.4834 52.8276 35.3748 51.6026 45.3141C49.9842 34.0419 46.9249 22.8395 44.329 12.1259C44.1703 11.4658 43.5801 11.0024 42.9009 11.0024H34.4658C33.7867 11.0024 33.1964 11.4658 33.0314 12.1259C30.0928 24.0581 27.4651 35.2605 25.9863 45.3141L20.585 15.2993L20.1281 13.0398C19.8869 11.8529 18.846 11.0024 17.64 11.0024H0.649237L0.63655 11.0088Z" fill="#0156D7"/>
-</g>
-<defs>
-<clipPath id="clip0_16976_12182">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16976_12182)"><path fill="#0156d7" d="M.637 11.009c-.4 0-.705.368-.622.761l4.208 20.165a.644.644 0 0 0 .622.508h9.203a.49.49 0 0 1 .368.812l-2.869 3.25a.63.63 0 0 0-.146.545l4.792 23.77a.63.63 0 0 0 .622.508h14.154a.64.64 0 0 0 .622-.496c2.99-12.586 5.166-22.887 6.899-32.597h.38c1.803 10.523 4.202 21.122 6.9 32.597.07.286.323.495.622.495h15.093a.63.63 0 0 0 .622-.507l9.882-49.056a.638.638 0 0 0-.622-.762H59.62a2.54 2.54 0 0 0-2.488 2.025c-2.368 11.456-4.303 22.348-5.528 32.287-1.619-11.272-4.678-22.474-7.274-33.188a1.47 1.47 0 0 0-1.428-1.124h-8.435c-.68 0-1.27.464-1.435 1.124-2.938 11.932-5.566 23.135-7.045 33.188L20.585 15.3l-.457-2.26a2.54 2.54 0 0 0-2.488-2.037H.65z"/></g><defs><clipPath id="clip0_16976_12182"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/youtube.svg b/web/packages/design/src/ResourceIcon/assets/youtube.svg
index 56548d6eca051..9d61c239dc48f 100644
--- a/web/packages/design/src/ResourceIcon/assets/youtube.svg
+++ b/web/packages/design/src/ResourceIcon/assets/youtube.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16976_12172)">
-<path d="M70.4955 18.6732C69.6658 15.5734 67.2296 13.1374 64.1299 12.3077C58.5173 10.8022 36.0008 10.8022 36.0008 10.8022C36.0008 10.8022 13.4847 10.8022 7.87188 12.3077C4.77214 13.1374 2.33617 15.5734 1.50641 18.6732C0.000977013 24.2859 0.000976562 36.0034 0.000976562 36.0034C0.000976562 36.0034 0.000977013 47.721 1.50641 53.3338C2.33617 56.4335 4.77214 58.8694 7.87188 59.6991C13.4847 61.2046 36.0008 61.2046 36.0008 61.2046C36.0008 61.2046 58.5173 61.2046 64.1299 59.6991C67.2296 58.8694 69.6658 56.4335 70.4955 53.3338C72.001 47.721 72.001 36.0034 72.001 36.0034C72.001 36.0034 71.9949 24.2859 70.4955 18.6732Z" fill="#FF0000"/>
-<path d="M28.7949 46.8031L47.5002 36.0044L28.7949 25.2056V46.8031Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16976_12172">
-<rect width="72" height="72" fill="white" transform="translate(0.000976562 0.00244141)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16976_12172)"><path fill="red" d="M70.496 18.673a9.02 9.02 0 0 0-6.366-6.365C58.517 10.802 36 10.802 36 10.802s-22.515 0-28.128 1.506a9.02 9.02 0 0 0-6.366 6.365C.001 24.286.001 36.003.001 36.003s0 11.718 1.505 17.33A9.02 9.02 0 0 0 7.872 59.7C13.485 61.205 36 61.205 36 61.205s22.516 0 28.129-1.506a9.02 9.02 0 0 0 6.366-6.365C72 47.72 72 36.004 72 36.004s-.006-11.718-1.505-17.33"/><path fill="#fff" d="M28.795 46.803 47.5 36.004 28.795 25.206z"/></g><defs><clipPath id="clip0_16976_12172"><path fill="#fff" d="M.001.002h72v72h-72z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/zapier.svg b/web/packages/design/src/ResourceIcon/assets/zapier.svg
index 6bac88f6043f4..ffa8ccb962647 100644
--- a/web/packages/design/src/ResourceIcon/assets/zapier.svg
+++ b/web/packages/design/src/ResourceIcon/assets/zapier.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_15941_7403)">
-<path d="M45.0015 36.0175C45.0018 38.6132 44.5331 41.1876 43.6181 43.6168C41.1881 44.5318 38.613 45.0008 36.0164 45.0013H35.9847C33.3882 45.0017 30.813 44.533 28.383 43.6179C27.4666 41.1883 26.9971 38.613 26.9973 36.0163V35.9824C26.9973 33.3071 27.4883 30.745 28.3774 28.3808C30.8077 27.4644 33.3839 26.9957 35.9813 26.9974H36.0107C38.6872 26.9974 41.2482 27.4883 43.6124 28.3808C44.5284 30.8105 44.9972 33.3858 44.9959 35.9824V36.0163H44.9993L45.0015 36.0175ZM71.5012 29.9995H50.4879L65.3451 15.1414C63.0088 11.8604 60.1406 8.99292 56.8589 6.65752L41.9993 21.5156V0.501604C40.0235 0.169245 38.0234 0.00163031 36.0198 0.000488281H35.9813C33.9429 0.000488281 31.9463 0.174691 30.0007 0.501604V21.5156L15.1378 6.65639C13.5009 7.82137 11.9647 9.1215 10.5451 10.5431L10.5383 10.5499C9.11877 11.9705 7.8198 13.5067 6.65487 15.1425L21.5178 29.9995H0.499976C0.499976 29.9995 0 33.9474 0 35.988V36.0129C0 38.0536 0.173067 40.0535 0.501116 42.0003H21.5189L6.65373 56.8562C8.99174 60.1368 11.8602 63.0048 15.1412 65.3423L30.0018 50.4853V71.5005C31.9452 71.8263 33.9384 71.9982 35.9746 72.0005H36.0254C38.0267 71.9986 40.0245 71.8314 41.9982 71.5005V50.4853L56.86 65.3457C58.497 64.1797 60.0343 62.8796 61.4561 61.459H61.4594C62.8783 60.0369 64.1769 58.4996 65.3417 56.863L50.4845 42.0014H71.5023C71.8281 40.0558 72 38.0626 72 36.0265V35.9745C72 33.9723 71.8326 31.9757 71.5023 30.0018L71.5012 29.9995Z" fill="#FF4A00"/>
-</g>
-<defs>
-<clipPath id="clip0_15941_7403">
-<rect width="72" height="72" fill="white" transform="translate(0 0.000488281)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_15941_7403)"><path fill="#ff4a00" d="M45.002 36.018c0 2.595-.469 5.17-1.384 7.599A21.6 21.6 0 0 1 36.016 45h-.031a21.6 21.6 0 0 1-7.602-1.383 21.5 21.5 0 0 1-1.386-7.602v-.034c0-2.675.491-5.237 1.38-7.601a21.5 21.5 0 0 1 7.604-1.384h.03c2.676 0 5.237.491 7.601 1.384a21.5 21.5 0 0 1 1.384 7.601v.034h.003zM71.502 30H50.487l14.858-14.86a36.2 36.2 0 0 0-8.486-8.483l-14.86 14.858V.502A36 36 0 0 0 36.02 0h-.038a36 36 0 0 0-5.98.502v21.014L15.138 6.656a36 36 0 0 0-4.593 3.887l-.007.007a36 36 0 0 0-3.883 4.592L21.518 30H.5S0 33.947 0 35.988v.025c0 2.04.173 4.04.501 5.987H21.52L6.654 56.856a36.3 36.3 0 0 0 8.487 8.486l14.86-14.857v21.016c1.944.325 3.937.497 5.974.5h.05c2.002-.002 4-.17 5.973-.5V50.485l14.862 14.86a36.3 36.3 0 0 0 4.596-3.886h.003a36.4 36.4 0 0 0 3.883-4.596L50.484 42.001h21.018c.326-1.945.498-3.938.498-5.974v-.053a36 36 0 0 0-.498-5.972z"/></g><defs><clipPath id="clip0_15941_7403"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/zendesk-dark.svg b/web/packages/design/src/ResourceIcon/assets/zendesk-dark.svg
index f0f7b59bc1076..99473f1ce9fe5 100644
--- a/web/packages/design/src/ResourceIcon/assets/zendesk-dark.svg
+++ b/web/packages/design/src/ResourceIcon/assets/zendesk-dark.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4409)">
-<path d="M33.1927 22.5321V62.8257H0L33.1927 22.5321ZM33.1927 8C33.1927 17.2477 25.7615 24.6789 16.5138 24.6789C7.26606 24.6789 0 17.2477 0 8H33.1927ZM38.6422 62.83C38.6422 53.5823 46.0734 46.15 55.3211 46.15C64.5688 46.15 72 53.5823 72 62.83H38.6422ZM38.6422 48.2936V8H72L38.6422 48.2936Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4409">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4409)"><path fill="#fff" d="M33.193 22.532v40.294H0zm0-14.532a16.633 16.633 0 0 1-16.68 16.679C7.267 24.679 0 17.248 0 8zm5.45 54.83c0-9.248 7.43-16.68 16.678-16.68A16.634 16.634 0 0 1 72 62.83zm0-14.536V8H72z"/></g><defs><clipPath id="clip0_8803_4409"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/zendesk-light.svg b/web/packages/design/src/ResourceIcon/assets/zendesk-light.svg
index 5356d41abf30d..9d8097ca00ba3 100644
--- a/web/packages/design/src/ResourceIcon/assets/zendesk-light.svg
+++ b/web/packages/design/src/ResourceIcon/assets/zendesk-light.svg
@@ -1,10 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_8803_4410)">
-<path d="M33.1927 22.5321V62.8257H0L33.1927 22.5321ZM33.1927 8C33.1927 17.2477 25.7615 24.6789 16.5138 24.6789C7.26606 24.6789 0 17.2477 0 8H33.1927ZM38.6422 62.83C38.6422 53.5823 46.0734 46.15 55.3211 46.15C64.5688 46.15 72 53.5823 72 62.83H38.6422ZM38.6422 48.2936V8H72L38.6422 48.2936Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_8803_4410">
-<rect width="72" height="72" fill="white"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_8803_4410)"><path fill="#000" d="M33.193 22.532v40.294H0zm0-14.532a16.633 16.633 0 0 1-16.68 16.679C7.267 24.679 0 17.248 0 8zm5.45 54.83c0-9.248 7.43-16.68 16.678-16.68A16.634 16.634 0 0 1 72 62.83zm0-14.536V8H72z"/></g><defs><clipPath id="clip0_8803_4410"><path fill="#fff" d="M0 0h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/zoom.svg b/web/packages/design/src/ResourceIcon/assets/zoom.svg
index 9b5ee937caca1..2914f33848a0c 100644
--- a/web/packages/design/src/ResourceIcon/assets/zoom.svg
+++ b/web/packages/design/src/ResourceIcon/assets/zoom.svg
@@ -1,3 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M15.1014 43.9375H2.29073C1.44391 43.9375 0.640535 43.4928 0.249699 42.7336C-0.195417 41.8658 -0.0325695 40.8246 0.651387 40.1412L9.56459 31.2364H3.18096C1.4222 31.2364 0 29.8156 0 28.0584H11.801C12.6478 28.0584 13.4512 28.5031 13.842 29.2624C14.2872 30.1301 14.1243 31.1713 13.4404 31.8547L4.52716 40.7595H11.9204C13.6792 40.7595 15.1014 42.1804 15.1014 43.9375ZM65.8014 27.8198C63.9668 27.8198 62.3162 28.6116 61.1871 29.8806C60.0475 28.6116 58.3971 27.8198 56.5733 27.8198C53.1642 27.8198 50.3851 30.7266 50.3851 34.1215V43.9375C52.1438 43.9375 53.5659 42.5166 53.5659 40.7595V34.089C53.5659 32.4512 54.8362 31.0629 56.4646 30.9978C58.1801 30.9327 59.6022 32.3102 59.6022 34.0131V40.7595C59.6022 42.5166 61.0244 43.9375 62.7831 43.9375V34.089C62.7831 32.4512 64.0535 31.0629 65.6816 30.9978C67.3971 30.9327 68.8195 32.3102 68.8195 34.0131V40.7595C68.8195 42.5166 70.2418 43.9375 72 43.9375V34.1215C71.9892 30.7266 69.2101 27.8198 65.8014 27.8198ZM31.1473 35.9979C31.1473 40.5101 27.4778 44.1761 22.9615 44.1761C18.4452 44.1761 14.7757 40.5101 14.7757 35.9979C14.7757 31.4859 18.4561 27.8198 22.9615 27.8198C27.467 27.8198 31.1473 31.4859 31.1473 35.9979ZM27.9663 35.9979C27.9663 33.243 25.7191 30.9978 22.9615 30.9978C20.204 30.9978 17.9566 33.243 17.9566 35.9979C17.9566 38.753 20.204 40.9981 22.9615 40.9981C25.7191 40.9981 27.9663 38.753 27.9663 35.9979ZM48.7891 35.9979C48.7891 40.5101 45.1198 44.1761 40.6035 44.1761C36.0869 44.1761 32.4175 40.5101 32.4175 35.9979C32.4175 31.4859 36.0981 27.8198 40.6035 27.8198C45.1086 27.8198 48.7891 31.4859 48.7891 35.9979ZM45.6082 35.9979C45.6082 33.243 43.361 30.9978 40.6035 30.9978C37.8459 30.9978 35.5985 33.243 35.5985 35.9979C35.5985 38.753 37.8459 40.9981 40.6035 40.9981C43.361 40.9981 45.6082 38.753 45.6082 35.9979Z" fill="#0B5CFF"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><path fill="#0b5cff" d="M15.101 43.938H2.291c-.847 0-1.65-.445-2.041-1.204a2.22 2.22 0 0 1 .4-2.594l8.914-8.905H3.18A3.177 3.177 0 0 1 0 28.058h11.801c.847 0 1.65.445 2.041 1.204a2.22 2.22 0 0 1-.402 2.593L4.527 40.76h7.393a3.177 3.177 0 0 1 3.181 3.178m50.7-16.118a6.16 6.16 0 0 0-4.614 2.06 6.2 6.2 0 0 0-4.614-2.06c-3.409 0-6.188 2.907-6.188 6.301v9.816c1.759 0 3.18-1.42 3.18-3.177v-6.671c0-1.638 1.271-3.026 2.9-3.091a3.024 3.024 0 0 1 3.137 3.015v6.747a3.177 3.177 0 0 0 3.181 3.178v-9.849c0-1.638 1.27-3.026 2.899-3.091a3.024 3.024 0 0 1 3.138 3.015v6.747A3.177 3.177 0 0 0 72 43.938V34.12c-.01-3.394-2.79-6.301-6.199-6.301m-34.654 8.178c0 4.512-3.67 8.178-8.185 8.178-4.517 0-8.186-3.666-8.186-8.178s3.68-8.178 8.186-8.178c4.505 0 8.185 3.666 8.185 8.178m-3.18 0c0-2.755-2.248-5-5.005-5a5.01 5.01 0 0 0-5.005 5c0 2.755 2.247 5 5.005 5a5.01 5.01 0 0 0 5.004-5m20.822 0c0 4.512-3.67 8.178-8.186 8.178s-8.186-3.666-8.186-8.178 3.681-8.178 8.186-8.178c4.506 0 8.186 3.666 8.186 8.178m-3.18 0c0-2.755-2.248-5-5.006-5a5.01 5.01 0 0 0-5.004 5c0 2.755 2.247 5 5.005 5a5.01 5.01 0 0 0 5.004-5"/></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/assets/zoominfo.svg b/web/packages/design/src/ResourceIcon/assets/zoominfo.svg
index 8a02f20285c31..57aca398b55ac 100644
--- a/web/packages/design/src/ResourceIcon/assets/zoominfo.svg
+++ b/web/packages/design/src/ResourceIcon/assets/zoominfo.svg
@@ -1,11 +1 @@
-<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_16966_11914)">
-<path d="M0 9.00195C0 4.03139 4.02943 0.00195312 9 0.00195312H63C67.9706 0.00195312 72 4.03139 72 9.00195V63.002C72 67.9725 67.9706 72.002 63 72.002H9C4.02943 72.002 0 67.9725 0 63.002V9.00195Z" fill="#FF1B15"/>
-<path d="M49.5011 18.0015H53.3677C53.7184 18.0015 54.0011 18.2844 54.0011 18.6351V28.6066C54.0011 28.9574 53.7296 29.2402 53.3791 29.2516H50.1345C49.7838 29.2516 49.5011 28.9688 49.5011 28.618V25.7007L24.4873 49.5016H30.8676C31.2183 49.5016 31.501 49.7844 31.501 50.1352V53.3681C31.501 53.7188 31.2183 54.0016 30.8676 54.0016H18.6344C18.2837 54.0016 18.001 53.7188 18.001 53.3681V49.5016L46.3546 22.5016H43.3845C43.0338 22.5016 42.7511 22.2186 42.7511 21.868V18.6464C42.7511 18.2957 43.0338 18.0128 43.3845 18.0128L49.5011 18.0015ZM27.001 22.5016L37.6177 22.4902C37.9683 22.4902 38.2511 22.2074 38.2511 21.8566V18.6351C38.2511 18.2844 37.9683 18.0015 37.629 18.0015H18.657C18.3063 18.0015 18.0236 18.2844 18.0236 18.6351V28.618C18.0236 28.9688 18.3063 29.2516 18.657 29.2516H21.879C22.2295 29.2516 22.501 28.9688 22.501 28.618V22.5016H27.001ZM49.5011 49.5016H36.6344C36.2838 49.5016 36.001 49.7844 36.001 50.1352V53.3681C36.001 53.7188 36.2838 54.0016 36.6344 54.0016H53.3677C53.7184 54.0016 54.0011 53.7188 54.0011 53.3681V43.3324C54.0011 42.9816 53.7184 42.6988 53.3677 42.6988H50.1345C49.7838 42.6988 49.5011 42.9816 49.5011 43.3324V49.5016Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_16966_11914">
-<rect width="72" height="72" fill="white" transform="translate(0 0.00195312)"/>
-</clipPath>
-</defs>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="none" viewBox="0 0 72 72"><g clip-path="url(#clip0_16966_11914)"><path fill="#ff1b15" d="M0 9.002a9 9 0 0 1 9-9h54a9 9 0 0 1 9 9v54a9 9 0 0 1-9 9H9a9 9 0 0 1-9-9z"/><path fill="#fff" d="M49.501 18.002h3.867c.35 0 .633.282.633.633v9.972a.64.64 0 0 1-.622.645h-3.244a.63.63 0 0 1-.634-.634v-2.917L24.487 49.5h6.38c.351 0 .634.283.634.634v3.233c0 .35-.283.634-.633.634H18.634a.63.63 0 0 1-.633-.634v-3.866l28.354-27h-2.97a.633.633 0 0 1-.634-.634v-3.222c0-.35.283-.633.634-.633zm-22.5 4.5 10.617-.012c.35 0 .633-.283.633-.633v-3.222a.63.63 0 0 0-.622-.634H18.657a.63.63 0 0 0-.633.634v9.983c0 .35.282.634.633.634h3.222c.35 0 .622-.283.622-.634v-6.116zm22.5 27H36.634a.63.63 0 0 0-.633.633v3.233c0 .35.283.634.633.634h16.734c.35 0 .633-.283.633-.634V43.332a.63.63 0 0 0-.633-.633h-3.233a.63.63 0 0 0-.634.633z"/></g><defs><clipPath id="clip0_16966_11914"><path fill="#fff" d="M0 .002h72v72H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/web/packages/design/src/ResourceIcon/icons.ts b/web/packages/design/src/ResourceIcon/icons.ts
index 0a0fe6c3f8042..dc306409e16bb 100644
--- a/web/packages/design/src/ResourceIcon/icons.ts
+++ b/web/packages/design/src/ResourceIcon/icons.ts
@@ -16,584 +16,323 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import activemq from './assets/activemq.svg';
-import adobe from './assets/adobe.svg';
-import adobecreativecloudDark from './assets/adobecreativecloud-dark.svg';
-import adobecreativecloudLight from './assets/adobecreativecloud-light.svg';
-import adobemarketo from './assets/adobemarketo.svg';
-import airbase from './assets/airbase.svg';
-import airtable from './assets/airtable.svg';
-import algoliaDark from './assets/algolia-dark.svg';
-import algoliaLight from './assets/algolia-light.svg';
-import altisalesDark from './assets/altisales-dark.svg';
-import altisalesLight from './assets/altisales-light.svg';
-import ansibleDark from './assets/ansible-dark.svg';
-import ansibleLight from './assets/ansible-light.svg';
-import anthem from './assets/anthem.svg';
-import apolloIoDark from './assets/apollo.io-dark.svg';
-import apolloIoLight from './assets/apollo.io-light.svg';
-import appleDark from './assets/apple-dark.svg';
-import appleLight from './assets/apple-light.svg';
-import application from './assets/application.svg';
-import argocd from './assets/argocd.svg';
-import asana from './assets/asana.svg';
-import assembleDark from './assets/assemble-dark.svg';
-import assembleLight from './assets/assemble-light.svg';
-import atlassian from './assets/atlassian.svg';
-import atlassianbitbucket from './assets/atlassianbitbucket.svg';
-import atlassianjiraservicemanagement from './assets/atlassianjiraservicemanagement.svg';
-import atlassianstatuspage from './assets/atlassianstatuspage.svg';
-import auth0Dark from './assets/auth0-dark.svg';
-import auth0Light from './assets/auth0-light.svg';
-import avalara from './assets/avalara.svg';
-import awsAccount from './assets/aws-account.svg';
-import awsDark from './assets/aws-dark.svg';
-import awsLight from './assets/aws-light.svg';
-import azure from './assets/azure.svg';
-import bill from './assets/bill.svg';
-import bonusly from './assets/bonusly.svg';
-import box from './assets/box.svg';
-import browserstack from './assets/browserstack.svg';
-import calendly from './assets/calendly.svg';
-import calm from './assets/calm.svg';
-import captivateiqDark from './assets/captivateiq-dark.svg';
-import captivateiqLight from './assets/captivateiq-light.svg';
-import careermindsDark from './assets/careerminds-dark.svg';
-import careermindsLight from './assets/careerminds-light.svg';
-import cartaDark from './assets/carta-dark.svg';
-import cartaLight from './assets/carta-light.svg';
-import checkly from './assets/checkly.svg';
-import checkr from './assets/checkr.svg';
-import ciliumDark from './assets/cilium-dark.svg';
-import ciliumLight from './assets/cilium-light.svg';
-import circleciDark from './assets/circleci-dark.svg';
-import circleciLight from './assets/circleci-light.svg';
-import clari from './assets/clari.svg';
-import clearbit from './assets/clearbit.svg';
-import clearfeed from './assets/clearfeed.svg';
-import clickhouseDark from './assets/clickhouse-dark.svg';
-import clickhouseLight from './assets/clickhouse-light.svg';
-import cloudflare from './assets/cloudflare.svg';
-import cloudzero from './assets/cloudzero.svg';
-import cockroachDark from './assets/cockroach-dark.svg';
-import cockroachLight from './assets/cockroach-light.svg';
-import coefficientDark from './assets/coefficient-dark.svg';
-import coefficientLight from './assets/coefficient-light.svg';
-import conveyor from './assets/conveyor.svg';
-import cronitor from './assets/cronitor.svg';
-import cultureampDark from './assets/cultureamp-dark.svg';
-import cultureampLight from './assets/cultureamp-light.svg';
-import database from './assets/database.svg';
-import datadogDark from './assets/datadog-dark.svg';
-import datadogLight from './assets/datadog-light.svg';
-import dealhub from './assets/dealhub.svg';
-import deelDark from './assets/deel-dark.svg';
-import deelLight from './assets/deel-light.svg';
-import desktop from './assets/desktop.svg';
-import digicertDark from './assets/digicert-dark.svg';
-import digicertLight from './assets/digicert-light.svg';
-import digitalocean from './assets/digitalocean.svg';
-import discord from './assets/discord.svg';
-import dmarcian from './assets/dmarcian.svg';
-import dockerDark from './assets/docker-dark.svg';
-import dockerLight from './assets/docker-light.svg';
-import docusignDark from './assets/docusign-dark.svg';
-import docusignLight from './assets/docusign-light.svg';
-import donut from './assets/donut.svg';
-import drataDark from './assets/drata-dark.svg';
-import drataLight from './assets/drata-light.svg';
-import driftDark from './assets/drift-dark.svg';
-import driftLight from './assets/drift-light.svg';
-import dropbox from './assets/dropbox.svg';
-import duoDark from './assets/duo-dark.svg';
-import duoLight from './assets/duo-light.svg';
-import dynamo from './assets/dynamo.svg';
-import ec2 from './assets/ec2.svg';
-import eks from './assets/eks.svg';
-import elastic from './assets/elastic.svg';
-import emailDark from './assets/email-dark.svg';
-import emailLight from './assets/email-light.svg';
-import entraid from './assets/entra-id.svg';
-import eventbrite from './assets/eventbrite.svg';
-import excalidraw from './assets/excalidraw.svg';
-import figma from './assets/figma.svg';
-import fontawesome from './assets/fontawesome.svg';
-import foqal from './assets/foqal.svg';
-import fossa from './assets/fossa.svg';
-import frameIoDark from './assets/frame.io-dark.svg';
-import frameIoLight from './assets/frame.io-light.svg';
-import g2 from './assets/g2.svg';
-import gable from './assets/gable.svg';
-import gemDark from './assets/gem-dark.svg';
-import gemLight from './assets/gem-light.svg';
-import gitDark from './assets/git-dark.svg';
-import gitLight from './assets/git-light.svg';
-import githubDark from './assets/github-dark.svg';
-import githubLight from './assets/github-light.svg';
-import gitlab from './assets/gitlab.svg';
-import gmail from './assets/gmail.svg';
-import go1Dark from './assets/go1-dark.svg';
-import go1Light from './assets/go1-light.svg';
-import goldcast from './assets/goldcast.svg';
-import google from './assets/google.svg';
-import googleanalytics from './assets/googleanalytics.svg';
-import googlecalendar from './assets/googlecalendar.svg';
-import googlecloud from './assets/googlecloudprovider.svg';
-import googledrive from './assets/googledrive.svg';
-import googletag from './assets/googletagmanager.svg';
-import googlevoice from './assets/googlevoice.svg';
-import grafana from './assets/grafana.svg';
-import grammarly from './assets/grammarly.svg';
-import grubhub from './assets/grubhub.svg';
-import guidelineDark from './assets/guideline-dark.svg';
-import guidelineLight from './assets/guideline-light.svg';
-import hackeroneDark from './assets/hackerone-dark.svg';
-import hackeroneLight from './assets/hackerone-light.svg';
-import headliner from './assets/headliner.svg';
-import hootsuite from './assets/hootsuite.svg';
-import ibmDark from './assets/ibm-dark.svg';
-import ibmLight from './assets/ibm-light.svg';
-import inkeep from './assets/inkeep.svg';
-import instruqtDark from './assets/instruqt-dark.svg';
-import instruqtLight from './assets/instruqt-light.svg';
-import intellimize from './assets/intellimize.svg';
-import ipstack from './assets/ipstack.svg';
-import jamf from './assets/jamf.svg';
-import jenkins from './assets/jenkins.svg';
-import jetbrains from './assets/jetbrains.svg';
-import jira from './assets/jira.svg';
-import kaiserDark from './assets/kaiser-dark.svg';
-import kaiserLight from './assets/kaiser-light.svg';
-import kisiDark from './assets/kisi-dark.svg';
-import kisiLight from './assets/kisi-light.svg';
-import kollide from './assets/kollide.svg';
-import kube from './assets/kube.svg';
-import kubeserver from './assets/kubeserver.svg';
-import laptop from './assets/laptop.svg';
-import leadiq from './assets/leadiq.svg';
-import leandata from './assets/leandata.svg';
-import lever from './assets/lever.svg';
-import linkedinDark from './assets/linkedin-dark.svg';
-import linkedinLight from './assets/linkedin-light.svg';
-import linuxDark from './assets/linux-dark.svg';
-import linuxLight from './assets/linux-light.svg';
-import loom from './assets/loom.svg';
-import lucidCoDark from './assets/lucid.co-dark.svg';
-import lucidCoLight from './assets/lucid.co-light.svg';
-import lushaDark from './assets/lusha-dark.svg';
-import lushaLight from './assets/lusha-light.svg';
-import mailgun from './assets/mailgun.svg';
-import mariadbDark from './assets/mariadb-dark.svg';
-import mariadbLight from './assets/mariadb-light.svg';
-import mattermostDark from './assets/mattermost-dark.svg';
-import mattermostLight from './assets/mattermost-light.svg';
-import maxioDark from './assets/maxio-dark.svg';
-import maxioLight from './assets/maxio-light.svg';
-import metabase from './assets/metabase.svg';
-import microsoft from './assets/microsoft.svg';
-import microsoftexcel from './assets/microsoftexcel.svg';
-import microsoftonedrive from './assets/microsoftonedrive.svg';
-import microsoftonenote from './assets/microsoftonenote.svg';
-import microsoftoutlook from './assets/microsoftoutlook.svg';
-import microsoftpowerpoint from './assets/microsoftpowerpoint.svg';
-import microsoftteams from './assets/microsoftteams.svg';
-import microsoftword from './assets/microsoftword.svg';
-import mongoDark from './assets/mongo-dark.svg';
-import mongoLight from './assets/mongo-light.svg';
-import mysqlLargeDark from './assets/mysql-large-dark.svg';
-import mysqlLargeLight from './assets/mysql-large-light.svg';
-import mysqlSmallDark from './assets/mysql-small-dark.svg';
-import mysqlSmallLight from './assets/mysql-small-light.svg';
-import namecheap from './assets/namecheap.svg';
-import navanDark from './assets/navan-dark.svg';
-import navanLight from './assets/navan-light.svg';
-import neverbounceDark from './assets/neverbounce-dark.svg';
-import neverbounceLight from './assets/neverbounce-light.svg';
-import notion from './assets/notion.svg';
-import oasisopen from './assets/oasisopen.svg';
-import oktaAlt from './assets/okta-alt.svg';
-import oktaDark from './assets/okta-dark.svg';
-import oktaLight from './assets/okta-light.svg';
-import onehundredonedomain from './assets/onehundredonedomain.svg';
-import oneloginDark from './assets/onelogin-dark.svg';
-import oneloginLight from './assets/onelogin-light.svg';
-import onepasswordDark from './assets/onepassword-dark.svg';
-import onepasswordLight from './assets/onepassword-light.svg';
-import opencomp from './assets/opencomp.svg';
-import openid from './assets/openid.svg';
-import opsgenie from './assets/opsgenie.svg';
-import orbitLove from './assets/orbit.love.svg';
-import orcasecurityDark from './assets/orcasecurity-dark.svg';
-import orcasecurityLight from './assets/orcasecurity-light.svg';
-import outreachIo from './assets/outreach.io.svg';
-import pagerduty from './assets/pagerduty.svg';
-import pantherDark from './assets/panther-dark.svg';
-import pantherLight from './assets/panther-light.svg';
-import parallels from './assets/parallels.svg';
-import pingdom from './assets/pingdom.svg';
-import podigee from './assets/podigee.svg';
-import polleverywhere from './assets/polleverywhere.svg';
-import portswigger from './assets/portswigger.svg';
-import postgres from './assets/postgres.svg';
-import posthogDark from './assets/posthog-dark.svg';
-import posthogLight from './assets/posthog-light.svg';
-import productboard from './assets/productboard.svg';
-import prometheus from './assets/prometheus.svg';
-import qualified from './assets/qualified.svg';
-import quickbooks from './assets/quickbooks.svg';
-import rabbitmq from './assets/rabbitmq.svg';
-import rds from './assets/rds.svg';
-import redhat from './assets/redhat.svg';
-import redshift from './assets/redshift.svg';
-import ringlead from './assets/ringlead.svg';
-import ripplingDark from './assets/rippling-dark.svg';
-import ripplingLight from './assets/rippling-light.svg';
-import salesforce from './assets/salesforce.svg';
-import sanity from './assets/sanity.svg';
-import scimDark from './assets/scim-dark.svg';
-import scimLight from './assets/scim-light.svg';
-import securecodewarriorDark from './assets/securecodewarrior-dark.svg';
-import securecodewarriorLight from './assets/securecodewarrior-light.svg';
-import semrush from './assets/semrush.svg';
-import sendgrid from './assets/sendgrid.svg';
-import sentryDark from './assets/sentry-dark.svg';
-import sentryLight from './assets/sentry-light.svg';
-import sequoiaDark from './assets/sequoia-dark.svg';
-import sequoiaLight from './assets/sequoia-light.svg';
-import server from './assets/server.svg';
-import servicenow from './assets/servicenow.svg';
-import shopify from './assets/shopify.svg';
-import sixsenseDark from './assets/sixsense-dark.svg';
-import sixsenseLight from './assets/sixsense-light.svg';
-import skype from './assets/skype.svg';
-import slab from './assets/slab.svg';
-import slack from './assets/slack.svg';
-import snowflake from './assets/snowflake.svg';
-import spaceliftDark from './assets/spacelift-dark.svg';
-import spaceliftLight from './assets/spacelift-light.svg';
-import sparrow from './assets/sparrow.svg';
-import stripeDark from './assets/stripe-dark.svg';
-import stripeLight from './assets/stripe-light.svg';
-import tableau from './assets/tableau.svg';
-import terraform from './assets/terraform.svg';
-import torqDark from './assets/torq-dark.svg';
-import torqLight from './assets/torq-light.svg';
-import troopsAiDark from './assets/troops.ai-dark.svg';
-import troopsAiLight from './assets/troops.ai-light.svg';
-import twilio from './assets/twilio.svg';
-import twitterDark from './assets/twitter-dark.svg';
-import twitterLight from './assets/twitter-light.svg';
-import userorbitDark from './assets/userorbit-dark.svg';
-import userorbitLight from './assets/userorbit-light.svg';
-import validity from './assets/validity.svg';
-import valimail from './assets/valimail.svg';
-import varicentDark from './assets/varicent-dark.svg';
-import varicentLight from './assets/varicent-light.svg';
-import vendr from './assets/vendr.svg';
-import vercelDark from './assets/vercel-dark.svg';
-import vercelLight from './assets/vercel-light.svg';
-import weavegitops from './assets/weavegitops.svg';
-import windowsDark from './assets/windows-dark.svg';
-import windowsLight from './assets/windows-light.svg';
-import wizDark from './assets/wiz-dark.svg';
-import wizLight from './assets/wiz-light.svg';
-import workshopDark from './assets/workshop-dark.svg';
-import workshopLight from './assets/workshop-light.svg';
-import youtube from './assets/youtube.svg';
-import zapier from './assets/zapier.svg';
-import zendeskDark from './assets/zendesk-dark.svg';
-import zendeskLight from './assets/zendesk-light.svg';
-import zoom from './assets/zoom.svg';
-import zoominfo from './assets/zoominfo.svg';
-
-export {
-  activemq,
-  adobecreativecloudDark,
-  adobecreativecloudLight,
-  adobemarketo,
-  adobe,
-  airbase,
-  airtable,
-  algoliaDark,
-  algoliaLight,
-  altisalesDark,
-  altisalesLight,
-  ansibleDark,
-  ansibleLight,
-  anthem,
-  apolloIoDark,
-  apolloIoLight,
-  appleDark,
-  appleLight,
-  application,
-  argocd,
-  asana,
-  assembleDark,
-  assembleLight,
-  atlassianbitbucket,
-  atlassianjiraservicemanagement,
-  atlassianstatuspage,
-  atlassian,
-  auth0Dark,
-  auth0Light,
-  avalara,
-  awsDark,
-  awsLight,
-  awsAccount,
-  azure,
-  bill,
-  bonusly,
-  box,
-  browserstack,
-  calendly,
-  calm,
-  captivateiqDark,
-  captivateiqLight,
-  careermindsDark,
-  careermindsLight,
-  cartaDark,
-  cartaLight,
-  checkly,
-  checkr,
-  circleciDark,
-  circleciLight,
-  clari,
-  clearbit,
-  clearfeed,
-  clickhouseDark,
-  clickhouseLight,
-  cloudflare,
-  cloudzero,
-  cockroachDark,
-  cockroachLight,
-  coefficientDark,
-  coefficientLight,
-  conveyor,
-  cronitor,
-  cultureampDark,
-  cultureampLight,
-  database,
-  datadogDark,
-  datadogLight,
-  dealhub,
-  deelDark,
-  deelLight,
-  desktop,
-  digicertDark,
-  digicertLight,
-  digitalocean,
-  discord,
-  dmarcian,
-  dockerDark,
-  dockerLight,
-  docusignDark,
-  docusignLight,
-  donut,
-  drataDark,
-  drataLight,
-  driftDark,
-  driftLight,
-  dropbox,
-  duoDark,
-  duoLight,
-  dynamo,
-  ec2,
-  eks,
-  elastic,
-  emailDark,
-  emailLight,
-  entraid,
-  eventbrite,
-  excalidraw,
-  figma,
-  fontawesome,
-  foqal,
-  fossa,
-  frameIoDark,
-  frameIoLight,
-  g2,
-  gable,
-  gemDark,
-  gemLight,
-  gitDark,
-  gitLight,
-  githubDark,
-  githubLight,
-  gitlab,
-  gmail,
-  go1Dark,
-  go1Light,
-  goldcast,
-  google,
-  googleanalytics,
-  googlecalendar,
-  googlecloud,
-  googledrive,
-  googletag,
-  googlevoice,
-  grafana,
-  grammarly,
-  grubhub,
-  guidelineDark,
-  guidelineLight,
-  hackeroneDark,
-  hackeroneLight,
-  headliner,
-  hootsuite,
-  ciliumDark,
-  ciliumLight,
-  ibmDark,
-  ibmLight,
-  inkeep,
-  instruqtDark,
-  instruqtLight,
-  intellimize,
-  ipstack,
-  jamf,
-  jenkins,
-  jetbrains,
-  jira,
-  kaiserDark,
-  kaiserLight,
-  kisiDark,
-  kisiLight,
-  kollide,
-  kube,
-  kubeserver,
-  laptop,
-  leadiq,
-  leandata,
-  lever,
-  linkedinDark,
-  linkedinLight,
-  linuxDark,
-  linuxLight,
-  loom,
-  lucidCoDark,
-  lucidCoLight,
-  lushaDark,
-  lushaLight,
-  mailgun,
-  mariadbDark,
-  mariadbLight,
-  mattermostDark,
-  mattermostLight,
-  maxioDark,
-  maxioLight,
-  metabase,
-  microsoft,
-  microsoftexcel,
-  microsoftonedrive,
-  microsoftonenote,
-  microsoftoutlook,
-  microsoftpowerpoint,
-  microsoftteams,
-  microsoftword,
-  mongoDark,
-  mongoLight,
-  mysqlLargeDark,
-  mysqlLargeLight,
-  mysqlSmallDark,
-  mysqlSmallLight,
-  namecheap,
-  navanDark,
-  navanLight,
-  neverbounceDark,
-  neverbounceLight,
-  notion,
-  oasisopen,
-  oktaDark,
-  oktaLight,
-  oktaAlt,
-  onehundredonedomain,
-  oneloginDark,
-  oneloginLight,
-  onepasswordDark,
-  onepasswordLight,
-  opencomp,
-  openid,
-  opsgenie,
-  orbitLove,
-  orcasecurityDark,
-  orcasecurityLight,
-  outreachIo,
-  pagerduty,
-  pantherDark,
-  pantherLight,
-  parallels,
-  pingdom,
-  podigee,
-  polleverywhere,
-  portswigger,
-  postgres,
-  posthogDark,
-  posthogLight,
-  productboard,
-  prometheus,
-  qualified,
-  quickbooks,
-  rabbitmq,
-  rds,
-  redhat,
-  redshift,
-  ringlead,
-  ripplingDark,
-  ripplingLight,
-  salesforce,
-  sanity,
-  scimDark,
-  scimLight,
-  securecodewarriorDark,
-  securecodewarriorLight,
-  semrush,
-  sendgrid,
-  sentryDark,
-  sentryLight,
-  sequoiaDark,
-  sequoiaLight,
-  server,
-  servicenow,
-  shopify,
-  sixsenseDark,
-  sixsenseLight,
-  skype,
-  slab,
-  slack,
-  snowflake,
-  spaceliftDark,
-  spaceliftLight,
-  sparrow,
-  stripeDark,
-  stripeLight,
-  tableau,
-  terraform,
-  torqDark,
-  torqLight,
-  troopsAiDark,
-  troopsAiLight,
-  twilio,
-  twitterDark,
-  twitterLight,
-  userorbitDark,
-  userorbitLight,
-  validity,
-  valimail,
-  varicentDark,
-  varicentLight,
-  vendr,
-  vercelDark,
-  vercelLight,
-  weavegitops,
-  windowsDark,
-  windowsLight,
-  wizDark,
-  wizLight,
-  workshopDark,
-  workshopLight,
-  youtube,
-  zapier,
-  zendeskDark,
-  zendeskLight,
-  zoom,
-  zoominfo,
-};
+// TODO(ravicious): Pass a function to assetsInlineLimit so that we don't have to remember about
+// adding the ?no-inline suffix.
+// https://vite.dev/config/build-options.html#build-assetsinlinelimit
+export { default as activemq } from './assets/activemq.svg?no-inline';
+export { default as adobe } from './assets/adobe.svg?no-inline';
+export { default as adobecreativecloudDark } from './assets/adobecreativecloud-dark.svg?no-inline';
+export { default as adobecreativecloudLight } from './assets/adobecreativecloud-light.svg?no-inline';
+export { default as adobemarketo } from './assets/adobemarketo.svg?no-inline';
+export { default as airbase } from './assets/airbase.svg?no-inline';
+export { default as airtable } from './assets/airtable.svg?no-inline';
+export { default as algoliaDark } from './assets/algolia-dark.svg?no-inline';
+export { default as algoliaLight } from './assets/algolia-light.svg?no-inline';
+export { default as altisalesDark } from './assets/altisales-dark.svg?no-inline';
+export { default as altisalesLight } from './assets/altisales-light.svg?no-inline';
+export { default as ansibleDark } from './assets/ansible-dark.svg?no-inline';
+export { default as ansibleLight } from './assets/ansible-light.svg?no-inline';
+export { default as anthem } from './assets/anthem.svg?no-inline';
+export { default as apolloIoDark } from './assets/apollo.io-dark.svg?no-inline';
+export { default as apolloIoLight } from './assets/apollo.io-light.svg?no-inline';
+export { default as appleDark } from './assets/apple-dark.svg?no-inline';
+export { default as appleLight } from './assets/apple-light.svg?no-inline';
+export { default as application } from './assets/application.svg?no-inline';
+export { default as argocd } from './assets/argocd.svg?no-inline';
+export { default as asana } from './assets/asana.svg?no-inline';
+export { default as assembleDark } from './assets/assemble-dark.svg?no-inline';
+export { default as assembleLight } from './assets/assemble-light.svg?no-inline';
+export { default as atlassian } from './assets/atlassian.svg?no-inline';
+export { default as atlassianbitbucket } from './assets/atlassianbitbucket.svg?no-inline';
+export { default as atlassianjiraservicemanagement } from './assets/atlassianjiraservicemanagement.svg?no-inline';
+export { default as atlassianstatuspage } from './assets/atlassianstatuspage.svg?no-inline';
+export { default as auth0Dark } from './assets/auth0-dark.svg?no-inline';
+export { default as auth0Light } from './assets/auth0-light.svg?no-inline';
+export { default as avalara } from './assets/avalara.svg?no-inline';
+export { default as awsAccount } from './assets/aws-account.svg?no-inline';
+export { default as awsDark } from './assets/aws-dark.svg?no-inline';
+export { default as awsLight } from './assets/aws-light.svg?no-inline';
+export { default as awsaurora } from './assets/awsaurora.svg?no-inline';
+export { default as awscommandlineinterface } from './assets/awscommandlineinterface.svg?no-inline';
+export { default as awsdynamodb } from './assets/awsdynamodb.svg?no-inline';
+export { default as awsec2 } from './assets/awsec2.svg?no-inline';
+export { default as awselasticache } from './assets/awselasticache.svg?no-inline';
+export { default as awselasticblockstore } from './assets/awselasticblockstore.svg?no-inline';
+export { default as awselasticcontainerservice } from './assets/awselasticcontainerservice.svg?no-inline';
+export { default as awselasticsearchservice } from './assets/awselasticsearchservice.svg?no-inline';
+export { default as awsfargate } from './assets/awsfargate.svg?no-inline';
+export { default as awsiamidentitycenter } from './assets/awsiamidentitycenter.svg?no-inline';
+export { default as awsidentityandaccessmanagementiam } from './assets/awsidentityandaccessmanagementiam.svg?no-inline';
+export { default as awskeyspaces } from './assets/awskeyspaces.svg?no-inline';
+export { default as awsmanagementconsole } from './assets/awsmanagementconsole.svg?no-inline';
+export { default as awsmemorydb } from './assets/awsmemorydb.svg?no-inline';
+export { default as awsrds } from './assets/awsrds.svg?no-inline';
+export { default as awsredshift } from './assets/awsredshift.svg?no-inline';
+export { default as awsredshift2 } from './assets/awsredshift2.svg?no-inline';
+export { default as awssimplestorageservices3 } from './assets/awssimplestorageservices3.svg?no-inline';
+export { default as awssinglesignon } from './assets/awssinglesignon.svg?no-inline';
+export { default as azure } from './assets/azure.svg?no-inline';
+export { default as bill } from './assets/bill.svg?no-inline';
+export { default as bonusly } from './assets/bonusly.svg?no-inline';
+export { default as box } from './assets/box.svg?no-inline';
+export { default as browserstack } from './assets/browserstack.svg?no-inline';
+export { default as calendly } from './assets/calendly.svg?no-inline';
+export { default as calm } from './assets/calm.svg?no-inline';
+export { default as captivateiqDark } from './assets/captivateiq-dark.svg?no-inline';
+export { default as captivateiqLight } from './assets/captivateiq-light.svg?no-inline';
+export { default as careermindsDark } from './assets/careerminds-dark.svg?no-inline';
+export { default as careermindsLight } from './assets/careerminds-light.svg?no-inline';
+export { default as cartaDark } from './assets/carta-dark.svg?no-inline';
+export { default as cartaLight } from './assets/carta-light.svg?no-inline';
+export { default as checkly } from './assets/checkly.svg?no-inline';
+export { default as checkr } from './assets/checkr.svg?no-inline';
+export { default as ciliumDark } from './assets/cilium-dark.svg?no-inline';
+export { default as ciliumLight } from './assets/cilium-light.svg?no-inline';
+export { default as circleciDark } from './assets/circleci-dark.svg?no-inline';
+export { default as circleciLight } from './assets/circleci-light.svg?no-inline';
+export { default as clari } from './assets/clari.svg?no-inline';
+export { default as clearbit } from './assets/clearbit.svg?no-inline';
+export { default as clearfeed } from './assets/clearfeed.svg?no-inline';
+export { default as clickhouseDark } from './assets/clickhouse-dark.svg?no-inline';
+export { default as clickhouseLight } from './assets/clickhouse-light.svg?no-inline';
+export { default as cloudflare } from './assets/cloudflare.svg?no-inline';
+export { default as cloudzero } from './assets/cloudzero.svg?no-inline';
+export { default as cockroachDark } from './assets/cockroach-dark.svg?no-inline';
+export { default as cockroachLight } from './assets/cockroach-light.svg?no-inline';
+export { default as coefficientDark } from './assets/coefficient-dark.svg?no-inline';
+export { default as coefficientLight } from './assets/coefficient-light.svg?no-inline';
+export { default as conveyor } from './assets/conveyor.svg?no-inline';
+export { default as cronitor } from './assets/cronitor.svg?no-inline';
+export { default as cultureampDark } from './assets/cultureamp-dark.svg?no-inline';
+export { default as cultureampLight } from './assets/cultureamp-light.svg?no-inline';
+export { default as database } from './assets/database.svg?no-inline';
+export { default as datadogDark } from './assets/datadog-dark.svg?no-inline';
+export { default as datadogLight } from './assets/datadog-light.svg?no-inline';
+export { default as dealhub } from './assets/dealhub.svg?no-inline';
+export { default as deelDark } from './assets/deel-dark.svg?no-inline';
+export { default as deelLight } from './assets/deel-light.svg?no-inline';
+export { default as desktop } from './assets/desktop.svg?no-inline';
+export { default as digicertDark } from './assets/digicert-dark.svg?no-inline';
+export { default as digicertLight } from './assets/digicert-light.svg?no-inline';
+export { default as digitalocean } from './assets/digitalocean.svg?no-inline';
+export { default as discord } from './assets/discord.svg?no-inline';
+export { default as dmarcian } from './assets/dmarcian.svg?no-inline';
+export { default as dockerDark } from './assets/docker-dark.svg?no-inline';
+export { default as dockerLight } from './assets/docker-light.svg?no-inline';
+export { default as docusignDark } from './assets/docusign-dark.svg?no-inline';
+export { default as docusignLight } from './assets/docusign-light.svg?no-inline';
+export { default as donut } from './assets/donut.svg?no-inline';
+export { default as drataDark } from './assets/drata-dark.svg?no-inline';
+export { default as drataLight } from './assets/drata-light.svg?no-inline';
+export { default as driftDark } from './assets/drift-dark.svg?no-inline';
+export { default as driftLight } from './assets/drift-light.svg?no-inline';
+export { default as dropbox } from './assets/dropbox.svg?no-inline';
+export { default as duoDark } from './assets/duo-dark.svg?no-inline';
+export { default as duoLight } from './assets/duo-light.svg?no-inline';
+export { default as dynamo } from './assets/dynamo.svg?no-inline';
+export { default as ec2 } from './assets/ec2.svg?no-inline';
+export { default as eks } from './assets/eks.svg?no-inline';
+export { default as elastic } from './assets/elastic.svg?no-inline';
+export { default as emailDark } from './assets/email-dark.svg?no-inline';
+export { default as emailLight } from './assets/email-light.svg?no-inline';
+export { default as entraid } from './assets/entra-id.svg?no-inline';
+export { default as eventbrite } from './assets/eventbrite.svg?no-inline';
+export { default as excalidraw } from './assets/excalidraw.svg?no-inline';
+export { default as figma } from './assets/figma.svg?no-inline';
+export { default as fontawesome } from './assets/fontawesome.svg?no-inline';
+export { default as foqal } from './assets/foqal.svg?no-inline';
+export { default as fossa } from './assets/fossa.svg?no-inline';
+export { default as frameIoDark } from './assets/frame.io-dark.svg?no-inline';
+export { default as frameIoLight } from './assets/frame.io-light.svg?no-inline';
+export { default as g2 } from './assets/g2.svg?no-inline';
+export { default as gable } from './assets/gable.svg?no-inline';
+export { default as gemDark } from './assets/gem-dark.svg?no-inline';
+export { default as gemLight } from './assets/gem-light.svg?no-inline';
+export { default as gitDark } from './assets/git-dark.svg?no-inline';
+export { default as gitLight } from './assets/git-light.svg?no-inline';
+export { default as githubDark } from './assets/github-dark.svg?no-inline';
+export { default as githubLight } from './assets/github-light.svg?no-inline';
+export { default as gitlab } from './assets/gitlab.svg?no-inline';
+export { default as gmail } from './assets/gmail.svg?no-inline';
+export { default as go1Dark } from './assets/go1-dark.svg?no-inline';
+export { default as go1Light } from './assets/go1-light.svg?no-inline';
+export { default as goldcast } from './assets/goldcast.svg?no-inline';
+export { default as google } from './assets/google.svg?no-inline';
+export { default as googleanalytics } from './assets/googleanalytics.svg?no-inline';
+export { default as googlecalendar } from './assets/googlecalendar.svg?no-inline';
+export { default as googlecloud } from './assets/googlecloudprovider.svg?no-inline';
+export { default as googledrive } from './assets/googledrive.svg?no-inline';
+export { default as googletag } from './assets/googletagmanager.svg?no-inline';
+export { default as googlevoice } from './assets/googlevoice.svg?no-inline';
+export { default as grafana } from './assets/grafana.svg?no-inline';
+export { default as grammarly } from './assets/grammarly.svg?no-inline';
+export { default as grubhub } from './assets/grubhub.svg?no-inline';
+export { default as guidelineDark } from './assets/guideline-dark.svg?no-inline';
+export { default as guidelineLight } from './assets/guideline-light.svg?no-inline';
+export { default as hackeroneDark } from './assets/hackerone-dark.svg?no-inline';
+export { default as hackeroneLight } from './assets/hackerone-light.svg?no-inline';
+export { default as headliner } from './assets/headliner.svg?no-inline';
+export { default as hootsuite } from './assets/hootsuite.svg?no-inline';
+export { default as ibmDark } from './assets/ibm-dark.svg?no-inline';
+export { default as ibmLight } from './assets/ibm-light.svg?no-inline';
+export { default as inkeep } from './assets/inkeep.svg?no-inline';
+export { default as instruqtDark } from './assets/instruqt-dark.svg?no-inline';
+export { default as instruqtLight } from './assets/instruqt-light.svg?no-inline';
+export { default as intellimize } from './assets/intellimize.svg?no-inline';
+export { default as intune } from './assets/intune.svg?no-inline';
+export { default as ipstack } from './assets/ipstack.svg?no-inline';
+export { default as jamf } from './assets/jamf.svg?no-inline';
+export { default as jenkins } from './assets/jenkins.svg?no-inline';
+export { default as jetbrains } from './assets/jetbrains.svg?no-inline';
+export { default as jira } from './assets/jira.svg?no-inline';
+export { default as kaiserDark } from './assets/kaiser-dark.svg?no-inline';
+export { default as kaiserLight } from './assets/kaiser-light.svg?no-inline';
+export { default as kisiDark } from './assets/kisi-dark.svg?no-inline';
+export { default as kisiLight } from './assets/kisi-light.svg?no-inline';
+export { default as kollide } from './assets/kollide.svg?no-inline';
+export { default as kube } from './assets/kube.svg?no-inline';
+export { default as kubeserver } from './assets/kubeserver.svg?no-inline';
+export { default as laptop } from './assets/laptop.svg?no-inline';
+export { default as leadiq } from './assets/leadiq.svg?no-inline';
+export { default as leandata } from './assets/leandata.svg?no-inline';
+export { default as lever } from './assets/lever.svg?no-inline';
+export { default as linkedinDark } from './assets/linkedin-dark.svg?no-inline';
+export { default as linkedinLight } from './assets/linkedin-light.svg?no-inline';
+export { default as linuxDark } from './assets/linux-dark.svg?no-inline';
+export { default as linuxLight } from './assets/linux-light.svg?no-inline';
+export { default as loom } from './assets/loom.svg?no-inline';
+export { default as lucidCoDark } from './assets/lucid.co-dark.svg?no-inline';
+export { default as lucidCoLight } from './assets/lucid.co-light.svg?no-inline';
+export { default as lushaDark } from './assets/lusha-dark.svg?no-inline';
+export { default as lushaLight } from './assets/lusha-light.svg?no-inline';
+export { default as mailgun } from './assets/mailgun.svg?no-inline';
+export { default as mariadbDark } from './assets/mariadb-dark.svg?no-inline';
+export { default as mariadbLight } from './assets/mariadb-light.svg?no-inline';
+export { default as mattermostDark } from './assets/mattermost-dark.svg?no-inline';
+export { default as mattermostLight } from './assets/mattermost-light.svg?no-inline';
+export { default as maxioDark } from './assets/maxio-dark.svg?no-inline';
+export { default as maxioLight } from './assets/maxio-light.svg?no-inline';
+export { default as mcpDark } from './assets/mcp-dark.svg?no-inline';
+export { default as mcpLight } from './assets/mcp-light.svg?no-inline';
+export { default as mcpCursorDark } from './assets/mcpcursor-dark.svg?no-inline';
+export { default as mcpCursorLight } from './assets/mcpcursor-dark.svg?no-inline';
+export { default as mcpVscode } from './assets/mcpvscode.svg?no-inline';
+export { default as mcpVscodeInsiders } from './assets/mcpvscodeinsiders.svg?no-inline';
+export { default as metabase } from './assets/metabase.svg?no-inline';
+export { default as microsoft } from './assets/microsoft.svg?no-inline';
+export { default as microsoftexcel } from './assets/microsoftexcel.svg?no-inline';
+export { default as microsoftonedrive } from './assets/microsoftonedrive.svg?no-inline';
+export { default as microsoftonenote } from './assets/microsoftonenote.svg?no-inline';
+export { default as microsoftoutlook } from './assets/microsoftoutlook.svg?no-inline';
+export { default as microsoftpowerpoint } from './assets/microsoftpowerpoint.svg?no-inline';
+export { default as microsoftteams } from './assets/microsoftteams.svg?no-inline';
+export { default as microsoftword } from './assets/microsoftword.svg?no-inline';
+export { default as mongoDark } from './assets/mongo-dark.svg?no-inline';
+export { default as mongoLight } from './assets/mongo-light.svg?no-inline';
+export { default as mysqlLargeDark } from './assets/mysql-large-dark.svg?no-inline';
+export { default as mysqlLargeLight } from './assets/mysql-large-light.svg?no-inline';
+export { default as mysqlSmallDark } from './assets/mysql-small-dark.svg?no-inline';
+export { default as mysqlSmallLight } from './assets/mysql-small-light.svg?no-inline';
+export { default as namecheap } from './assets/namecheap.svg?no-inline';
+export { default as navanDark } from './assets/navan-dark.svg?no-inline';
+export { default as navanLight } from './assets/navan-light.svg?no-inline';
+export { default as neverbounceDark } from './assets/neverbounce-dark.svg?no-inline';
+export { default as neverbounceLight } from './assets/neverbounce-light.svg?no-inline';
+export { default as notion } from './assets/notion.svg?no-inline';
+export { default as oasisopen } from './assets/oasisopen.svg?no-inline';
+export { default as oktaAlt } from './assets/okta-alt.svg?no-inline';
+export { default as oktaDark } from './assets/okta-dark.svg?no-inline';
+export { default as oktaLight } from './assets/okta-light.svg?no-inline';
+export { default as onehundredonedomain } from './assets/onehundredonedomain.svg?no-inline';
+export { default as oneloginDark } from './assets/onelogin-dark.svg?no-inline';
+export { default as oneloginLight } from './assets/onelogin-light.svg?no-inline';
+export { default as onepasswordDark } from './assets/onepassword-dark.svg?no-inline';
+export { default as onepasswordLight } from './assets/onepassword-light.svg?no-inline';
+export { default as opencomp } from './assets/opencomp.svg?no-inline';
+export { default as openid } from './assets/openid.svg?no-inline';
+export { default as opsgenie } from './assets/opsgenie.svg?no-inline';
+export { default as oracle } from './assets/oracle.svg?no-inline';
+export { default as orbitLove } from './assets/orbit.love.svg?no-inline';
+export { default as orcasecurityDark } from './assets/orcasecurity-dark.svg?no-inline';
+export { default as orcasecurityLight } from './assets/orcasecurity-light.svg?no-inline';
+export { default as outreachIo } from './assets/outreach.io.svg?no-inline';
+export { default as pagerduty } from './assets/pagerduty.svg?no-inline';
+export { default as pantherDark } from './assets/panther-dark.svg?no-inline';
+export { default as pantherLight } from './assets/panther-light.svg?no-inline';
+export { default as parallels } from './assets/parallels.svg?no-inline';
+export { default as pingdom } from './assets/pingdom.svg?no-inline';
+export { default as podigee } from './assets/podigee.svg?no-inline';
+export { default as polleverywhere } from './assets/polleverywhere.svg?no-inline';
+export { default as portswigger } from './assets/portswigger.svg?no-inline';
+export { default as postgres } from './assets/postgres.svg?no-inline';
+export { default as posthogDark } from './assets/posthog-dark.svg?no-inline';
+export { default as posthogLight } from './assets/posthog-light.svg?no-inline';
+export { default as productboard } from './assets/productboard.svg?no-inline';
+export { default as prometheus } from './assets/prometheus.svg?no-inline';
+export { default as qualified } from './assets/qualified.svg?no-inline';
+export { default as quickbooks } from './assets/quickbooks.svg?no-inline';
+export { default as rabbitmq } from './assets/rabbitmq.svg?no-inline';
+export { default as rds } from './assets/rds.svg?no-inline';
+export { default as redhat } from './assets/redhat.svg?no-inline';
+export { default as redshift } from './assets/redshift.svg?no-inline';
+export { default as ringlead } from './assets/ringlead.svg?no-inline';
+export { default as ripplingDark } from './assets/rippling-dark.svg?no-inline';
+export { default as ripplingLight } from './assets/rippling-light.svg?no-inline';
+export { default as salesforce } from './assets/salesforce.svg?no-inline';
+export { default as sanity } from './assets/sanity.svg?no-inline';
+export { default as scimDark } from './assets/scim-dark.svg?no-inline';
+export { default as scimLight } from './assets/scim-light.svg?no-inline';
+export { default as securecodewarriorDark } from './assets/securecodewarrior-dark.svg?no-inline';
+export { default as securecodewarriorLight } from './assets/securecodewarrior-light.svg?no-inline';
+export { default as semrush } from './assets/semrush.svg?no-inline';
+export { default as sendgrid } from './assets/sendgrid.svg?no-inline';
+export { default as sentryDark } from './assets/sentry-dark.svg?no-inline';
+export { default as sentryLight } from './assets/sentry-light.svg?no-inline';
+export { default as sequoiaDark } from './assets/sequoia-dark.svg?no-inline';
+export { default as sequoiaLight } from './assets/sequoia-light.svg?no-inline';
+export { default as server } from './assets/server.svg?no-inline';
+export { default as servicenow } from './assets/servicenow.svg?no-inline';
+export { default as shopify } from './assets/shopify.svg?no-inline';
+export { default as sixsenseDark } from './assets/sixsense-dark.svg?no-inline';
+export { default as sixsenseLight } from './assets/sixsense-light.svg?no-inline';
+export { default as skype } from './assets/skype.svg?no-inline';
+export { default as slab } from './assets/slab.svg?no-inline';
+export { default as slack } from './assets/slack.svg?no-inline';
+export { default as snowflake } from './assets/snowflake.svg?no-inline';
+export { default as spaceliftDark } from './assets/spacelift-dark.svg?no-inline';
+export { default as spaceliftLight } from './assets/spacelift-light.svg?no-inline';
+export { default as sparrow } from './assets/sparrow.svg?no-inline';
+export { default as strapi } from './assets/strapi.svg?no-inline';
+export { default as stripeDark } from './assets/stripe-dark.svg?no-inline';
+export { default as stripeLight } from './assets/stripe-light.svg?no-inline';
+export { default as tableau } from './assets/tableau.svg?no-inline';
+export { default as terraform } from './assets/terraform.svg?no-inline';
+export { default as torqDark } from './assets/torq-dark.svg?no-inline';
+export { default as torqLight } from './assets/torq-light.svg?no-inline';
+export { default as troopsAiDark } from './assets/troops.ai-dark.svg?no-inline';
+export { default as troopsAiLight } from './assets/troops.ai-light.svg?no-inline';
+export { default as twilio } from './assets/twilio.svg?no-inline';
+export { default as twitterDark } from './assets/twitter-dark.svg?no-inline';
+export { default as twitterLight } from './assets/twitter-light.svg?no-inline';
+export { default as userorbitDark } from './assets/userorbit-dark.svg?no-inline';
+export { default as userorbitLight } from './assets/userorbit-light.svg?no-inline';
+export { default as validity } from './assets/validity.svg?no-inline';
+export { default as valimail } from './assets/valimail.svg?no-inline';
+export { default as varicentDark } from './assets/varicent-dark.svg?no-inline';
+export { default as varicentLight } from './assets/varicent-light.svg?no-inline';
+export { default as vendr } from './assets/vendr.svg?no-inline';
+export { default as vercelDark } from './assets/vercel-dark.svg?no-inline';
+export { default as vercelLight } from './assets/vercel-light.svg?no-inline';
+export { default as weavegitops } from './assets/weavegitops.svg?no-inline';
+export { default as windowsDark } from './assets/windows-dark.svg?no-inline';
+export { default as windowsLight } from './assets/windows-light.svg?no-inline';
+export { default as wizDark } from './assets/wiz-dark.svg?no-inline';
+export { default as wizLight } from './assets/wiz-light.svg?no-inline';
+export { default as workshopDark } from './assets/workshop-dark.svg?no-inline';
+export { default as workshopLight } from './assets/workshop-light.svg?no-inline';
+export { default as youtube } from './assets/youtube.svg?no-inline';
+export { default as zapier } from './assets/zapier.svg?no-inline';
+export { default as zendeskDark } from './assets/zendesk-dark.svg?no-inline';
+export { default as zendeskLight } from './assets/zendesk-light.svg?no-inline';
+export { default as zoom } from './assets/zoom.svg?no-inline';
+export { default as zoominfo } from './assets/zoominfo.svg?no-inline';
diff --git a/web/packages/design/src/ResourceIcon/index.tsx b/web/packages/design/src/ResourceIcon/index.tsx
index c6c082c8694ed..501bd83e7204b 100644
--- a/web/packages/design/src/ResourceIcon/index.tsx
+++ b/web/packages/design/src/ResourceIcon/index.tsx
@@ -17,9 +17,10 @@
  */
 
 import { ComponentProps } from 'react';
-import { useTheme } from 'styled-components';
+import styled, { useTheme } from 'styled-components';
 
-import { Image } from 'design';
+import { Flex, Image } from 'design';
+import { IconProps } from 'design/Icon/Icon';
 
 import {
   iconNames,
@@ -33,6 +34,11 @@ interface ResourceIconProps extends ComponentProps<typeof Image> {
    * available names.
    */
   name: ResourceIconName;
+
+  /**
+   * Use a standard size. Otherwise, use `width` and `height` props.
+   */
+  size?: IconProps['size'];
 }
 
 /**
@@ -45,7 +51,59 @@ export const ResourceIcon = ({ name, ...props }: ResourceIconProps) => {
   if (!icon) {
     return null;
   }
+  if (props.size) {
+    const width = sizetoInnerPx(props.size);
+    const height = sizetoInnerPx(props.size);
+    return (
+      <Container $size={props.size}>
+        <Image
+          src={icon}
+          data-testid={`res-icon-${name}`}
+          {...props}
+          width={width}
+          height={height}
+        />
+      </Container>
+    );
+  }
+
   return <Image src={icon} data-testid={`res-icon-${name}`} {...props} />;
 };
 
+const Container = styled(Flex)<{ $size: IconProps['size'] }>`
+  width: ${props => sizetoOuterPx(props.$size)};
+  height: ${props => sizetoOuterPx(props.$size)};
+  align-items: center;
+  justify-content: center;
+`;
+
+/**
+ * Convert a standard size to a pixel width/height. This is different to the
+ * conversion done for Icons as they include in-asset padding.
+ *
+ * @param size the standard size to convert.
+ * @returns the pixel size
+ */
+function sizetoInnerPx(size: IconProps['size']) {
+  if (typeof size === 'number') {
+    return `${Math.floor(size * 0.8)}}px`;
+  }
+  if (size === 'small') return '14px';
+  if (size === 'medium') return '16px';
+  if (size === 'large') return '20px';
+  if (size === 'extra-large') return '24px';
+  return '24px';
+}
+
+function sizetoOuterPx(size: IconProps['size']) {
+  if (typeof size === 'number') {
+    return `${size}px`;
+  }
+  if (size === 'small') return '16px';
+  if (size === 'medium') return '20px';
+  if (size === 'large') return '24px';
+  if (size === 'extra-large') return '32px';
+  return '32px';
+}
+
 export { type ResourceIconName, resourceIconSpecs, iconNames };
diff --git a/web/packages/design/src/ResourceIcon/resourceIconSpecs.ts b/web/packages/design/src/ResourceIcon/resourceIconSpecs.ts
index 1669117c1339e..c6cecb785f306 100644
--- a/web/packages/design/src/ResourceIcon/resourceIconSpecs.ts
+++ b/web/packages/design/src/ResourceIcon/resourceIconSpecs.ts
@@ -61,6 +61,27 @@ export const resourceIconSpecs = {
   avalara: forAllThemes(i.avalara),
   aws: { dark: i.awsDark, light: i.awsLight },
   awsaccount: forAllThemes(i.awsAccount),
+  awsaurora: forAllThemes(i.awsaurora),
+  awscommandlineinterface: forAllThemes(i.awscommandlineinterface),
+  awsdynamodb: forAllThemes(i.awsdynamodb),
+  awsec2: forAllThemes(i.awsec2),
+  awselasticache: forAllThemes(i.awselasticache),
+  awselasticblockstore: forAllThemes(i.awselasticblockstore),
+  awselasticcontainerservice: forAllThemes(i.awselasticcontainerservice),
+  awselasticsearchservice: forAllThemes(i.awselasticsearchservice),
+  awsfargate: forAllThemes(i.awsfargate),
+  awsiamidentitycenter: forAllThemes(i.awsiamidentitycenter),
+  awsidentityandaccessmanagementiam: forAllThemes(
+    i.awsidentityandaccessmanagementiam
+  ),
+  awskeyspaces: forAllThemes(i.awskeyspaces),
+  awsmanagementconsole: forAllThemes(i.awsmanagementconsole),
+  awsmemorydb: forAllThemes(i.awsmemorydb),
+  awsrds: forAllThemes(i.awsrds),
+  awsredshift2: forAllThemes(i.awsredshift2),
+  awsredshift: forAllThemes(i.awsredshift),
+  awssimplestorageservices3: forAllThemes(i.awssimplestorageservices3),
+  awssinglesignon: forAllThemes(i.awssinglesignon),
   azure: forAllThemes(i.azure),
 
   bill: forAllThemes(i.bill),
@@ -150,6 +171,7 @@ export const resourceIconSpecs = {
   inkeep: forAllThemes(i.inkeep),
   instruqt: { dark: i.instruqtDark, light: i.instruqtLight },
   intellimize: forAllThemes(i.intellimize),
+  intune: forAllThemes(i.intune),
   ipstack: forAllThemes(i.ipstack),
 
   jamf: forAllThemes(i.jamf),
@@ -177,6 +199,10 @@ export const resourceIconSpecs = {
   mariadb: { dark: i.mariadbDark, light: i.mariadbLight },
   mattermost: { dark: i.mattermostDark, light: i.mattermostLight },
   maxio: { dark: i.maxioDark, light: i.maxioLight },
+  mcp: { dark: i.mcpDark, light: i.mcpLight },
+  mcpCursor: { dark: i.mcpCursorDark, light: i.mcpCursorLight },
+  mcpVscode: forAllThemes(i.mcpVscode),
+  mcpVscodeInsiders: forAllThemes(i.mcpVscodeInsiders),
   metabase: forAllThemes(i.metabase),
   microsoft: forAllThemes(i.microsoft),
   microsoftexcel: forAllThemes(i.microsoftexcel),
@@ -205,6 +231,7 @@ export const resourceIconSpecs = {
   openid: forAllThemes(i.openid),
   opsgenie: forAllThemes(i.opsgenie),
   'orbit.love': forAllThemes(i.orbitLove),
+  oracle: forAllThemes(i.oracle),
   orcasecurity: { dark: i.orcasecurityDark, light: i.orcasecurityLight },
   'outreach.io': forAllThemes(i.outreachIo),
 
@@ -252,6 +279,7 @@ export const resourceIconSpecs = {
   snowflake: forAllThemes(i.snowflake),
   spacelift: { dark: i.spaceliftDark, light: i.spaceliftLight },
   sparrow: forAllThemes(i.sparrow),
+  strapi: forAllThemes(i.strapi),
   stripe: { dark: i.stripeDark, light: i.stripeLight },
 
   tableau: forAllThemes(i.tableau),
diff --git a/web/packages/design/src/SlideTabs/SlideTabs.story.tsx b/web/packages/design/src/SlideTabs/SlideTabs.story.tsx
index 02096f99c7ec3..7305491199230 100644
--- a/web/packages/design/src/SlideTabs/SlideTabs.story.tsx
+++ b/web/packages/design/src/SlideTabs/SlideTabs.story.tsx
@@ -246,3 +246,45 @@ export const DisabledTab = () => {
     />
   );
 };
+
+export const NeutralTabs = () => {
+  const [activeIndex, setActiveIndex] = useState(0);
+  return (
+    <SlideTabs
+      tabs={threeSimpleTabs}
+      onChange={setActiveIndex}
+      activeIndex={activeIndex}
+      intent="neutral"
+    />
+  );
+};
+
+export const NeutralTabsDisabled = () => {
+  const [activeIndex, setActiveIndex] = useState(1);
+  return (
+    <SlideTabs
+      tabs={threeSimpleTabs}
+      onChange={setActiveIndex}
+      activeIndex={activeIndex}
+      intent="neutral"
+      disabled={true}
+    />
+  );
+};
+
+export const NeutralWithDisabledTab = () => {
+  const [activeIndex, setActiveIndex] = useState(0);
+  const tabs = [
+    { key: 'aws', title: 'aws' },
+    { key: 'automatically', title: 'automatically', disabled: true },
+    { key: 'manually', title: 'manually' },
+  ];
+  return (
+    <SlideTabs
+      tabs={tabs}
+      activeIndex={activeIndex}
+      onChange={setActiveIndex}
+      intent="neutral"
+    />
+  );
+};
diff --git a/web/packages/design/src/SlideTabs/SlideTabs.tsx b/web/packages/design/src/SlideTabs/SlideTabs.tsx
index 9eacda82c4cc6..854998484330a 100644
--- a/web/packages/design/src/SlideTabs/SlideTabs.tsx
+++ b/web/packages/design/src/SlideTabs/SlideTabs.tsx
@@ -35,6 +35,7 @@ export function SlideTabs({
   disabled = false,
   fitContent = false,
   hideStatusIconOnActiveTab,
+  intent = 'primary',
 }: SlideTabsProps) {
   const theme = useTheme();
   const activeTab = useRef<HTMLButtonElement>(null);
@@ -118,6 +119,7 @@ export function SlideTabs({
                 disabled={resolvedDisabled}
                 aria-selected={selected}
                 size={size}
+                intent={intent}
                 aria-label={ariaLabel}
               >
                 {/* We need a separate tab content component, since the status
@@ -152,7 +154,7 @@ export function SlideTabs({
           activeIndex={activeIndex}
           size={size}
         >
-          <TabSliderInner appearance={appearance} />
+          <TabSliderInner appearance={appearance} intent={intent} />
         </TabSlider>
       </TabList>
     </Wrapper>
@@ -160,6 +162,11 @@ export function SlideTabs({
 }
 
 export type SlideTabsProps = {
+  /**
+   * Specifies the selected tab button purpose class
+   * and affects its color palette.
+   */
+  intent?: Intent;
   /**
    * The style to render the selector in.
    */
@@ -216,7 +223,7 @@ export type SlideTabsProps = {
  */
 export type TabSpec = string | FullTabSpec;
 
-type FullTabSpec = TabContentSpec & {
+export type FullTabSpec = TabContentSpec & {
   /** Iteration key for the tab. */
   key: React.Key;
   /**
@@ -311,9 +318,12 @@ function StatusIconOrSpinner({
   );
 }
 
-const TabSliderInner = styled.div<{ appearance: Appearance }>`
+const TabSliderInner = styled.div<{ appearance: Appearance; intent: Intent }>`
   height: 100%;
-  background-color: ${({ theme }) => theme.colors.brand};
+  background-color: ${p =>
+    p.intent === 'primary'
+      ? p.theme.colors.brand
+      : p.theme.colors.interactive.tonal.neutral[2]};
   border-radius: ${props => (props.appearance === 'square' ? '8px' : '60px')};
 `;
 
@@ -420,6 +430,7 @@ const TabButton = styled.button<{
   disabled?: boolean;
   selected?: boolean;
   size: Size;
+  intent: Intent;
 }>`
   /* Reset the button styles. */
   font-family: inherit;
@@ -444,7 +455,7 @@ const TabButton = styled.button<{
    */
   ${buttonMargin}
   color: ${props =>
-    props.selected
+    props.selected && props.intent === 'primary'
       ? props.theme.colors.text.primaryInverse
       : props.theme.colors.text.main};
 
@@ -453,6 +464,7 @@ const TabButton = styled.button<{
 
 type Appearance = 'square' | 'round';
 type Size = 'large' | 'medium' | 'small';
+type Intent = 'primary' | 'neutral';
 
 const TabSlider = styled.div<{
   itemCount: number;
diff --git a/web/packages/design/src/StatusIcon/StatusIcon.story.tsx b/web/packages/design/src/StatusIcon/StatusIcon.story.tsx
index 5c9897c6d3896..c42ce7515378b 100644
--- a/web/packages/design/src/StatusIcon/StatusIcon.story.tsx
+++ b/web/packages/design/src/StatusIcon/StatusIcon.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { StoryObj } from '@storybook/react';
+import { StoryObj } from '@storybook/react-vite';
 
 import Flex from 'design/Flex';
 
diff --git a/web/packages/design/src/StepSlider/StepSlider.tsx b/web/packages/design/src/StepSlider/StepSlider.tsx
index 5dfcdb823750b..f9c406d9602c2 100644
--- a/web/packages/design/src/StepSlider/StepSlider.tsx
+++ b/web/packages/design/src/StepSlider/StepSlider.tsx
@@ -61,6 +61,7 @@ export function StepSlider<Flows>(props: Props<Flows>) {
     defaultStepIndex = 0,
     tDuration = 500,
     wrapping = false,
+    className,
     // extraProps are the props required by our step components defined in our flows.
     ...extraProps
   } = props;
@@ -274,7 +275,7 @@ export function StepSlider<Flows>(props: Props<Flows>) {
   const transitionRef = keyToNodeRef.current.get(key);
 
   return (
-    <Box ref={rootRef} style={rootStyle}>
+    <Box ref={rootRef} style={rootStyle} className={className}>
       {preMount && <HiddenBox>{$preContent}</HiddenBox>}
       <Wrap className={animationDirectionPrefix} tDuration={tDuration}>
         <TransitionGroup component={null}>
@@ -420,6 +421,8 @@ type Props<Flows> =
          * one and backwards from the first one to the last one.
          */
         wrapping?: boolean;
+        /** Allows styling of the container element. */
+        className?: string;
       } & ExtraProps // Extra props that are passed to each step component. Each step of each flow needs to accept the same set of extra props.
     : any;
 
diff --git a/web/packages/design/src/Tabs/Tabs.story.tsx b/web/packages/design/src/Tabs/Tabs.story.tsx
new file mode 100644
index 0000000000000..7f7fddd5c4649
--- /dev/null
+++ b/web/packages/design/src/Tabs/Tabs.story.tsx
@@ -0,0 +1,91 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta } from '@storybook/react-vite';
+import { useState } from 'react';
+
+import { TabBorder, TabContainer, TabsContainer } from './Tabs';
+import { useSlidingBottomBorderTabs } from './useSlidingBottomBorderTabs';
+
+type StoryProps = {
+  withBottomBorder: boolean;
+};
+
+const meta: Meta<StoryProps> = {
+  title: 'Design/Tabs',
+  component: Controls,
+  argTypes: {
+    withBottomBorder: {
+      control: { type: 'boolean' },
+    },
+  },
+  // default
+  args: {
+    withBottomBorder: false,
+  },
+};
+export default meta;
+
+enum Tab {
+  Example1,
+  Example2,
+  Example3,
+}
+
+export function Controls(props: StoryProps) {
+  const [activeTab, setActiveTab] = useState(Tab.Example1);
+
+  const { borderRef, parentRef } = useSlidingBottomBorderTabs({ activeTab });
+
+  return (
+    <>
+      <TabsContainer
+        ref={parentRef}
+        mb={3}
+        withBottomBorder={props.withBottomBorder}
+      >
+        <TabContainer
+          data-tab-id={Tab.Example1}
+          selected={activeTab === Tab.Example1}
+          onClick={() => setActiveTab(Tab.Example1)}
+        >
+          Example Tab 1
+        </TabContainer>
+        <TabContainer
+          data-tab-id={Tab.Example2}
+          selected={activeTab === Tab.Example2}
+          onClick={() => setActiveTab(Tab.Example2)}
+        >
+          Example Tab 2
+        </TabContainer>
+        <TabContainer
+          data-tab-id={Tab.Example3}
+          selected={activeTab === Tab.Example3}
+          onClick={() => setActiveTab(Tab.Example3)}
+        >
+          Example Tab 3
+        </TabContainer>
+        <TabBorder ref={borderRef} />
+      </TabsContainer>
+
+      {activeTab === Tab.Example1 && <div>Example 1 content</div>}
+      {activeTab === Tab.Example2 && <div>Example 2 content</div>}
+      {activeTab === Tab.Example3 && <div>Example 3 content</div>}
+    </>
+  );
+}
diff --git a/web/packages/design/src/Tabs/Tabs.ts b/web/packages/design/src/Tabs/Tabs.ts
index cf2c1719a52f0..df6bf6e4fd465 100644
--- a/web/packages/design/src/Tabs/Tabs.ts
+++ b/web/packages/design/src/Tabs/Tabs.ts
@@ -19,16 +19,29 @@
 import { NavLink } from 'react-router-dom';
 import styled from 'styled-components';
 
-export const TabsContainer = styled.div`
+import { space, SpaceProps } from 'design/system';
+
+interface TabsContainerProps extends SpaceProps {
+  /**
+   * It's an underlying background border bottom that
+   * renders underneath the currently active tab border
+   * bottom.
+   */
+  withBottomBorder?: boolean;
+}
+
+export const TabsContainer = styled.div<TabsContainerProps>`
   position: relative;
   display: flex;
   gap: ${p => p.theme.space[5]}px;
   align-items: center;
-  padding: 0 ${p => p.theme.space[5]}px;
-  border-bottom: 1px solid ${p => p.theme.colors.spotBackground[0]};
+  border-bottom: ${p =>
+    p.withBottomBorder ? `1px solid ${p.theme.colors.spotBackground[0]}` : 0};
+
+  ${space}
 `;
 
-export const TabContainer = styled(NavLink)<{ selected?: boolean }>`
+export const TabContainer = styled.div<{ selected?: boolean }>`
   padding: ${p => p.theme.space[1] + p.theme.space[2]}px
     ${p => p.theme.space[2]}px;
   position: relative;
@@ -48,6 +61,10 @@ export const TabContainer = styled(NavLink)<{ selected?: boolean }>`
   }
 `;
 
+export const TabContainerNavLink = styled(TabContainer).attrs({
+  as: NavLink,
+})``;
+
 export const TabBorder = styled.div`
   position: absolute;
   bottom: -1px;
diff --git a/web/packages/design/src/Tabs/index.ts b/web/packages/design/src/Tabs/index.ts
new file mode 100644
index 0000000000000..f0e5eea5c454a
--- /dev/null
+++ b/web/packages/design/src/Tabs/index.ts
@@ -0,0 +1,20 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { useSlidingBottomBorderTabs } from './useSlidingBottomBorderTabs';
+export * from './Tabs';
diff --git a/web/packages/design/src/Tabs/useSlidingBottomBorderTabs.ts b/web/packages/design/src/Tabs/useSlidingBottomBorderTabs.ts
new file mode 100644
index 0000000000000..93d90787501ba
--- /dev/null
+++ b/web/packages/design/src/Tabs/useSlidingBottomBorderTabs.ts
@@ -0,0 +1,57 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useLayoutEffect, useRef } from 'react';
+
+/**
+ * On selecting a new tab, produces a bottom border sliding animation
+ * from the current tab to the newly selected tab.
+ *
+ * Requires that each TabContainer defines a prop called "data-tab-id".
+ *
+ * TODO: mimics the implementation of tabs in
+ * e/web/teleport/src/AccessMonitoring/AccessMonitoring.tsx.
+ * Consider updating useSlidingBottomBorderTabs to be plain css.
+ */
+export function useSlidingBottomBorderTabs<T>({ activeTab }: { activeTab: T }) {
+  const borderRef = useRef<HTMLDivElement>(null);
+  const parentRef = useRef<HTMLDivElement>(null);
+
+  useLayoutEffect(() => {
+    if (!parentRef.current || !borderRef.current) {
+      return;
+    }
+
+    const activeElement = parentRef.current.querySelector(
+      `[data-tab-id="${activeTab}"]`
+    );
+
+    if (activeElement) {
+      const parentBounds = parentRef.current.getBoundingClientRect();
+      const activeBounds = activeElement.getBoundingClientRect();
+
+      const left = activeBounds.left - parentBounds.left;
+      const width = activeBounds.width;
+
+      borderRef.current.style.left = `${left}px`;
+      borderRef.current.style.width = `${width}px`;
+    }
+  }, [activeTab]);
+
+  return { borderRef, parentRef };
+}
diff --git a/web/packages/design/src/Text/Text.tsx b/web/packages/design/src/Text/Text.tsx
index 3282635e4a08e..285a37475ca05 100644
--- a/web/packages/design/src/Text/Text.tsx
+++ b/web/packages/design/src/Text/Text.tsx
@@ -18,7 +18,11 @@
 
 import { Property } from 'csstype';
 import styled from 'styled-components';
-import { ResponsiveValue } from 'styled-system';
+import {
+  fontFamily,
+  ResponsiveValue,
+  type FontFamilyProps,
+} from 'styled-system';
 
 import {
   color,
@@ -47,7 +51,8 @@ export type TextProps<E extends React.ElementType = 'div'> =
     SpaceProps &
     ColorProps &
     TextAlignProps &
-    FontWeightProps;
+    FontWeightProps &
+    FontFamilyProps;
 
 const Text = styled.div.withConfig({
   shouldForwardProp: shouldForwardTypographyProp,
@@ -61,6 +66,7 @@ const Text = styled.div.withConfig({
   ${color}
   ${textAlign}
   ${fontWeight}
+  ${fontFamily}
 `;
 
 Text.displayName = 'Text';
diff --git a/web/packages/design/src/TextArea/TextArea.tsx b/web/packages/design/src/TextArea/TextArea.tsx
index 26f3642338329..87cdab175f2d6 100644
--- a/web/packages/design/src/TextArea/TextArea.tsx
+++ b/web/packages/design/src/TextArea/TextArea.tsx
@@ -38,10 +38,7 @@ import { Theme } from 'design/theme/themes/types';
 export type TextAreaSize = 'large' | 'medium' | 'small';
 
 export interface TextAreaProps
-  extends ColorProps,
-    SpaceProps,
-    WidthProps,
-    HeightProps {
+  extends ColorProps, SpaceProps, WidthProps, HeightProps {
   size?: TextAreaSize;
   hasError?: boolean;
   resizable?: boolean;
@@ -133,6 +130,15 @@ const StyledTextArea = styled.textarea<StyledTextAreaProps>`
 
   &:read-only {
     cursor: not-allowed;
+
+    &:hover {
+      border: 1px solid
+        ${props => props.theme.colors.interactive.tonal.neutral[2]};
+    }
+
+    &:focus-visible {
+      border-color: ${props => props.theme.colors.interactive.tonal.neutral[2]};
+    }
   }
 
   &:disabled {
diff --git a/web/packages/design/src/Toggle/Toggle.story.tsx b/web/packages/design/src/Toggle/Toggle.story.tsx
index 40b7a388a475e..624e862e8cb73 100644
--- a/web/packages/design/src/Toggle/Toggle.story.tsx
+++ b/web/packages/design/src/Toggle/Toggle.story.tsx
@@ -18,7 +18,7 @@
 
 import { useState } from 'react';
 
-import Flex from '../Flex';
+import Flex, { Stack } from '../Flex';
 import Text from '../Text';
 import { Toggle } from './Toggle';
 
@@ -28,10 +28,10 @@ export default {
 
 export const Default = () => {
   return (
-    <Flex flexDirection="column" gap={4}>
+    <Stack gap={4} bg="levels.surface" p={3}>
       <ToggleRow initialToggled={false} />
       <ToggleRow initialToggled={true} />
-    </Flex>
+    </Stack>
   );
 };
 
diff --git a/web/packages/design/src/Toggle/Toggle.tsx b/web/packages/design/src/Toggle/Toggle.tsx
index 3a8b5c445777b..948856003a38a 100644
--- a/web/packages/design/src/Toggle/Toggle.tsx
+++ b/web/packages/design/src/Toggle/Toggle.tsx
@@ -26,6 +26,7 @@ export function Toggle({
   disabled,
   className,
   size = 'small',
+  ref,
 }: {
   isToggled: boolean;
   onToggle: () => void;
@@ -33,9 +34,10 @@ export function Toggle({
   disabled?: boolean;
   className?: string;
   size?: 'small' | 'large';
+  ref?: React.ForwardedRef<HTMLLabelElement>;
 }) {
   return (
-    <StyledWrapper disabled={disabled} className={className}>
+    <StyledWrapper disabled={disabled} className={className} ref={ref}>
       <StyledInput
         checked={isToggled}
         onChange={onToggle}
@@ -162,4 +164,8 @@ const StyledInput = styled.input.attrs({ type: 'checkbox' })<SizeProps>`
   &:disabled:checked + ${StyledSlider} {
     background: ${props => props.theme.colors.interactive.tonal.success[2]};
   }
+
+  &:focus-visible + ${StyledSlider} {
+    outline: 1px solid ${props => props.theme.colors.interactive.solid.primary.default};
+    outline-offset: 1px;
 `;
diff --git a/web/packages/design/src/Tooltip/HoverTooltip.tsx b/web/packages/design/src/Tooltip/HoverTooltip.tsx
index 8745d2611a4c9..88bd1c700531c 100644
--- a/web/packages/design/src/Tooltip/HoverTooltip.tsx
+++ b/web/packages/design/src/Tooltip/HoverTooltip.tsx
@@ -77,6 +77,11 @@ type HoverTooltipProps = {
    * Don't transition the tooltip in/out on mount/unmount.
    */
   disableTransitions?: boolean;
+  /**
+   * Optional HTMLElement to render the portal into.
+   * Defaults to `document.body`.
+   */
+  portalRoot?: HTMLElement;
 };
 
 export const HoverTooltip = ({
@@ -90,6 +95,7 @@ export const HoverTooltip = ({
   delay = 0,
   disableFlip = false,
   disableTransitions = false,
+  portalRoot,
 }: PropsWithChildren<HoverTooltipProps>) => {
   const theme = useTheme();
   const [open, setOpen] = useState(false);
@@ -176,8 +182,9 @@ export const HoverTooltip = ({
     >
       {children}
       {isMounted && (
-        <FloatingPortal>
+        <FloatingPortal root={portalRoot}>
           <StyledTooltip
+            data-testid="tooltip"
             ref={refs.setFloating}
             style={{
               position: strategy,
diff --git a/web/packages/teleport/src/components/formatters.ts b/web/packages/design/src/formatters.ts
similarity index 90%
rename from web/packages/teleport/src/components/formatters.ts
rename to web/packages/design/src/formatters.ts
index d67db8fdb4e61..e4de2b6f5ae94 100644
--- a/web/packages/teleport/src/components/formatters.ts
+++ b/web/packages/design/src/formatters.ts
@@ -16,8 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Label } from 'teleport/types';
-
-export function makeLabelTag(label: Label) {
+export function makeLabelTag(label: { name: string; value: string }): string {
   return `${label.name}: ${label.value}`;
 }
diff --git a/web/packages/design/src/index.ts b/web/packages/design/src/index.ts
index 099050aa9e5bc..7573ee5353aff 100644
--- a/web/packages/design/src/index.ts
+++ b/web/packages/design/src/index.ts
@@ -28,6 +28,7 @@ import {
 } from './Button';
 import ButtonIcon from './ButtonIcon';
 import ButtonLink from './ButtonLink';
+import { ButtonSelect } from './ButtonSelect';
 import { ButtonWithMenu } from './ButtonWithMenu';
 import Card from './Card';
 import CardSuccess, { CardSuccessLogin } from './CardSuccess';
@@ -74,6 +75,7 @@ export {
   ButtonLink,
   ButtonPrimary,
   ButtonSecondary,
+  ButtonSelect,
   ButtonText,
   ButtonWarning,
   ButtonWithMenu,
diff --git a/web/packages/design/src/labels.story.jsx b/web/packages/design/src/labels.story.jsx
index 1ebbb65189dee..fd0dcaa5ff813 100644
--- a/web/packages/design/src/labels.story.jsx
+++ b/web/packages/design/src/labels.story.jsx
@@ -17,7 +17,9 @@
  */
 
 import Flex from './Flex';
+import { CircleCheck, Cross, Plus } from './Icon';
 import Label from './Label';
+import { LabelButtonWithIcon } from './Label/LabelButtonWithIcon';
 import LabelState from './LabelState';
 
 export default {
@@ -31,55 +33,133 @@ export const Labels = () => (
       bg="levels.surface"
       justifyContent="center"
       alignItems="center"
+      gap={4}
     >
-      <Label mr={4} kind="primary">
+      <Label kind="primary">primary</Label>
+      <Label kind="secondary">secondary</Label>
+      <Label kind="warning">warning</Label>
+      <Label kind="danger">danger</Label>
+      <Label kind="success">success</Label>
+    </Flex>
+    <Flex
+      height="100px"
+      bg="levels.surface"
+      justifyContent="center"
+      alignItems="center"
+      gap={4}
+    >
+      <Label kind="primary" css={{ visibility: 'hidden' }}>
         Primary
       </Label>
-      <Label mr={4} kind="secondary">
-        Secondary
-      </Label>
-      <Label mr={4} kind="warning">
-        Warning
+      <Label kind="outline-primary">outline-primary</Label>
+      <Label kind="outline-secondary">outline-secondary</Label>
+      <Label kind="outline-warning">outline-warning</Label>
+      <Label kind="outline-danger">outline-danger</Label>
+      <Label kind="success" css={{ visibility: 'hidden' }}>
+        Success
       </Label>
-      <Label kind="danger">Danger</Label>
     </Flex>
     <Flex
       height="100px"
       bg="levels.surface"
       justifyContent="center"
       alignItems="center"
+      gap={4}
     >
-      <LabelState mr="4" kind="success">
-        Success
-      </LabelState>
-      <LabelState mr="4" kind="secondary">
-        Secondary
-      </LabelState>
-      <LabelState mr="4" kind="warning">
-        Warning
-      </LabelState>
-      <LabelState mr="4" kind="danger">
-        Danger
-      </LabelState>
+      <LabelState kind="success">Success</LabelState>
+      <LabelState kind="secondary">Secondary</LabelState>
+      <LabelState kind="warning">Warning</LabelState>
+      <LabelState kind="danger">Danger</LabelState>
     </Flex>
     <Flex
       height="100px"
       bg="levels.surface"
       justifyContent="center"
       alignItems="center"
+      gap={4}
     >
-      <LabelState shadow mr="4" kind="success">
+      <LabelState shadow kind="success">
         Success
       </LabelState>
-      <LabelState shadow mr="4" kind="secondary">
+      <LabelState shadow kind="secondary">
         Secondary
       </LabelState>
-      <LabelState shadow mr="4" kind="warning">
+      <LabelState shadow kind="warning">
         Warning
       </LabelState>
-      <LabelState shadow mr="4" kind="danger">
+      <LabelState shadow kind="danger">
         Danger
       </LabelState>
     </Flex>
+
+    <Flex
+      pb={4}
+      bg="levels.surface"
+      justifyContent="center"
+      alignItems="center"
+      gap={4}
+      flexWrap={'wrap'}
+    >
+      <LabelButtonWithIcon
+        kind="outline-primary"
+        IconLeft={Plus}
+        withHoverState
+      >
+        LabelButtonWithIcon: outline-primary
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon
+        kind="outline-secondary"
+        IconRight={Cross}
+        withHoverState
+      >
+        LabelButtonWithIcon: outline-secondary
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon
+        kind="outline-warning"
+        IconRight={Cross}
+        withHoverState
+      >
+        LabelButtonWithIcon: outline-warning
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon
+        kind="outline-danger"
+        IconRight={Cross}
+        withHoverState
+      >
+        LabelButtonWithIcon: outline-danger
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon
+        kind="outline-success"
+        IconLeft={CircleCheck}
+        withHoverState
+      >
+        LabelButtonWithIcon: outline-success
+      </LabelButtonWithIcon>
+    </Flex>
+
+    <Flex
+      pb={4}
+      bg="levels.surface"
+      justifyContent="center"
+      alignItems="center"
+      gap={4}
+      flexWrap={'wrap'}
+    >
+      <LabelButtonWithIcon kind="primary" IconLeft={Plus} withHoverState>
+        LabelButtonWithIcon: primary
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon kind="secondary" IconRight={Cross} withHoverState>
+        LabelButtonWithIcon: secondary
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon kind="warning" IconRight={Cross} withHoverState>
+        LabelButtonWithIcon: warning
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon kind="danger" IconRight={Cross} withHoverState>
+        LabelButtonWithIcon: danger
+      </LabelButtonWithIcon>
+      <LabelButtonWithIcon kind="success" IconLeft={CircleCheck} withHoverState>
+        LabelButtonWithIcon: success
+      </LabelButtonWithIcon>
+    </Flex>
   </>
 );
diff --git a/web/packages/design/src/system/index.ts b/web/packages/design/src/system/index.ts
index 17a1a6c0d70ea..94a7f702ae1c0 100644
--- a/web/packages/design/src/system/index.ts
+++ b/web/packages/design/src/system/index.ts
@@ -20,6 +20,7 @@ import { Property } from 'csstype';
 import {
   alignItems,
   alignSelf,
+  background,
   border,
   borderColor,
   borderRadius,
@@ -49,6 +50,7 @@ import {
   width,
   type AlignItemsProps,
   type AlignSelfProps,
+  type BackgroundProps,
   type BorderColorProps,
   type BorderProps,
   type BorderRadiusProps,
@@ -128,6 +130,8 @@ export {
   type AlignItemsProps,
   alignSelf,
   type AlignSelfProps,
+  background,
+  type BackgroundProps,
   border,
   type BorderProps,
   borderColor,
diff --git a/web/packages/design/src/theme/palette.story.jsx b/web/packages/design/src/theme/palette.story.jsx
index e0f022fa46f5c..22a466c7e49e7 100644
--- a/web/packages/design/src/theme/palette.story.jsx
+++ b/web/packages/design/src/theme/palette.story.jsx
@@ -16,8 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*eslint import/namespace: ['error', { allowComputed: true }]*/
-
 import { Box, Flex } from '..';
 import * as colors from './palette';
 import { getContrastText } from './themes/sharedStyles';
diff --git a/web/packages/design/src/theme/themes/bblpTheme.ts b/web/packages/design/src/theme/themes/bblpTheme.ts
index 4ffba3f24dca9..00555e0706126 100644
--- a/web/packages/design/src/theme/themes/bblpTheme.ts
+++ b/web/packages/design/src/theme/themes/bblpTheme.ts
@@ -491,6 +491,56 @@ const colors: ThemeColors = {
     caribbean: dataVisualisationColors.tertiary.caribbean,
   },
 
+  sessionRecording: {
+    resource: '#66C5FF',
+    user: '#C5B6FF',
+    player: {
+      progressBar: {
+        background: 'rgba(255, 255, 255, 0.2)',
+        seeking: 'rgba(255, 255, 255, 0.17)',
+        progress: '#FFA028',
+      },
+    },
+  },
+
+  sessionRecordingTimeline: {
+    background: levels.sunken,
+    headerBackground: 'rgba(0, 0, 0, 0.13)',
+    frameBorder: 'rgba(255, 255, 255, 0.2)',
+    progressLine: '#E53E3E',
+    border: {
+      default: '#474747',
+      hover: '#757575',
+    },
+    cursor: 'rgba(255, 255, 255, 0.4)',
+    events: {
+      inactivity: {
+        background: 'rgba(159,133,255, 0.25)',
+        text: 'rgba(255, 255, 255, 0.6)',
+      },
+      resize: {
+        semiBackground: 'rgba(0, 0, 0, 0.8)',
+        background: '#26323c',
+        border: '#86c4ed',
+        text: '#86c4ed',
+      },
+      join: {
+        background: '#009EFF',
+        text: 'rgba(0, 0, 0, 0.87)',
+      },
+      default: {
+        background: 'rgba(255, 255, 255, 0.54)',
+        text: '',
+      },
+    },
+    timeMarks: {
+      primary: '#E2E8F0',
+      secondary: '#A0AEC0',
+      absolute: '#E2E8F0',
+      text: '#A0AEC0',
+    },
+  },
+
   link: '#66ABFF',
 
   highlightedNavigationItem: 'rgba(255, 255, 255, 0.3)',
diff --git a/web/packages/design/src/theme/themes/darkTheme.ts b/web/packages/design/src/theme/themes/darkTheme.ts
index d4158282b3d5f..fe3bd8438435f 100644
--- a/web/packages/design/src/theme/themes/darkTheme.ts
+++ b/web/packages/design/src/theme/themes/darkTheme.ts
@@ -499,6 +499,56 @@ const colors: ThemeColors = {
     caribbean: dataVisualisationColors.tertiary.caribbean,
   },
 
+  sessionRecording: {
+    resource: '#66C5FF',
+    user: '#C5B6FF',
+    player: {
+      progressBar: {
+        background: 'rgba(255, 255, 255, 0.2)',
+        seeking: 'rgba(255, 255, 255, 0.17)',
+        progress: '#9F85FF',
+      },
+    },
+  },
+
+  sessionRecordingTimeline: {
+    background: '#1f2549',
+    headerBackground: 'rgba(0, 0, 0, 0.13)',
+    frameBorder: 'rgba(255, 255, 255, 0.2)',
+    progressLine: '#E53E3E',
+    border: {
+      default: '#4c516e',
+      hover: '#5f659e',
+    },
+    cursor: 'rgba(255, 255, 255, 0.4)',
+    events: {
+      inactivity: {
+        background: 'rgba(159,133,255, 0.25)',
+        text: 'rgba(255, 255, 255, 0.6)',
+      },
+      resize: {
+        semiBackground: 'rgba(0, 0, 0, 0.8)',
+        background: '#26323c',
+        border: '#86c4ed',
+        text: '#86c4ed',
+      },
+      join: {
+        background: '#009EFF',
+        text: 'rgba(0, 0, 0, 0.87)',
+      },
+      default: {
+        background: 'rgba(255, 255, 255, 0.54)',
+        text: '',
+      },
+    },
+    timeMarks: {
+      primary: '#718096',
+      secondary: '#4A5568',
+      absolute: '#E2E8F0',
+      text: '#A0AEC0',
+    },
+  },
+
   link: '#009EFF',
 
   highlightedNavigationItem: 'rgba(255, 255, 255, 0.3)',
diff --git a/web/packages/design/src/theme/themes/lightTheme.ts b/web/packages/design/src/theme/themes/lightTheme.ts
index 7febc92c22395..e9c6d77c9cbbf 100644
--- a/web/packages/design/src/theme/themes/lightTheme.ts
+++ b/web/packages/design/src/theme/themes/lightTheme.ts
@@ -494,6 +494,56 @@ const colors: ThemeColors = {
     caribbean: dataVisualisationColors.primary.caribbean,
   },
 
+  sessionRecording: {
+    resource: '#004570',
+    user: '#311C79',
+    player: {
+      progressBar: {
+        background: 'rgba(0, 0, 0, 0.1)',
+        seeking: 'rgba(0, 0, 0, 0.15)',
+        progress: '#9F85FF',
+      },
+    },
+  },
+
+  sessionRecordingTimeline: {
+    background: levels.deep,
+    headerBackground: 'rgba(0, 0, 0, 0.05)',
+    frameBorder: 'rgba(0, 0, 0, 0.2)',
+    progressLine: '#E53E3E',
+    border: {
+      default: '#9a9dab',
+      hover: '#5f659e',
+    },
+    cursor: 'rgba(0, 0, 0, 0.4)',
+    events: {
+      inactivity: {
+        background: 'rgba(81,47,201, 0.25)',
+        text: 'rgba(0, 0, 0, 0.6)',
+      },
+      resize: {
+        semiBackground: 'rgba(0, 0, 0, 0.8)',
+        border: '#26323c',
+        background: '#86c4ed',
+        text: '#26323c',
+      },
+      join: {
+        background: '#0073BA',
+        text: 'rgba(255, 255, 255, 0.8)',
+      },
+      default: {
+        background: 'rgba(0, 0, 0, 0.54)',
+        text: '#000',
+      },
+    },
+    timeMarks: {
+      primary: 'rgba(0,0,0,0.54)',
+      secondary: 'rgba(0,0,0,0.36)',
+      absolute: 'rgba(0,0,0,0.87)',
+      text: 'rgba(0,0,0,0.87)',
+    },
+  },
+
   link: '#0073BA',
 
   highlightedNavigationItem: blue[200],
diff --git a/web/packages/design/src/theme/themes/types.ts b/web/packages/design/src/theme/themes/types.ts
index 622f2fc268ca5..df4e2868a705e 100644
--- a/web/packages/design/src/theme/themes/types.ts
+++ b/web/packages/design/src/theme/themes/types.ts
@@ -222,6 +222,56 @@ export type ThemeColors = {
     caribbean: string;
   };
 
+  sessionRecording: {
+    resource: string;
+    user: string;
+    player: {
+      progressBar: {
+        background: string;
+        seeking: string;
+        progress: string;
+      };
+    };
+  };
+
+  sessionRecordingTimeline: {
+    background: string;
+    headerBackground: string;
+    frameBorder: string;
+    progressLine: string;
+    cursor: string;
+    border: {
+      default: string;
+      hover: string;
+    };
+    events: {
+      inactivity: {
+        background: string;
+        text: string;
+      };
+      resize: {
+        semiBackground: string;
+        background: string;
+        border: string;
+        text: string;
+      };
+      join: {
+        background: string;
+        text: string;
+      };
+      default: {
+        background: string;
+        text: string;
+      };
+    };
+    timeMarks: {
+      primary: string;
+      secondary: string;
+      absolute: string;
+      text: string;
+    };
+  };
+
   link: string;
 
   highlightedNavigationItem: string;
diff --git a/web/packages/design/src/theme/typography.ts b/web/packages/design/src/theme/typography.ts
index adb0452a2ac87..6f5d4641b1379 100644
--- a/web/packages/design/src/theme/typography.ts
+++ b/web/packages/design/src/theme/typography.ts
@@ -25,7 +25,7 @@ const bold = 600;
 
 export const fontSizes = [10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 34];
 
-export const fontWeights = { light, regular, bold };
+export const fontWeights = { light, regular, medium, bold };
 
 const typography = {
   body1: {
diff --git a/web/packages/design/src/utils/testing.tsx b/web/packages/design/src/utils/testing.tsx
index b68eecff79cfe..c32df1a50936d 100644
--- a/web/packages/design/src/utils/testing.tsx
+++ b/web/packages/design/src/utils/testing.tsx
@@ -28,7 +28,7 @@ import {
   within,
 } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
-import { ReactNode } from 'react';
+import { PropsWithChildren, ReactNode } from 'react';
 import { MemoryRouter as Router } from 'react-router-dom';
 
 import { darkTheme } from 'design/theme';
@@ -38,6 +38,7 @@ import '@testing-library/jest-dom';
 import 'jest-styled-components';
 
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { HttpResponse, JsonBodyType } from 'msw';
 
 export const testQueryClient = new QueryClient({
   defaultOptions: {
@@ -47,7 +48,7 @@ export const testQueryClient = new QueryClient({
   },
 });
 
-function Providers({ children }: { children: ReactNode }) {
+export function Providers({ children }: { children: ReactNode }) {
   return (
     <QueryClientProvider client={testQueryClient}>
       <ConfiguredThemeProvider theme={darkTheme}>
@@ -79,10 +80,58 @@ screen.debug = () => {
 };
 
 type RenderOptions = {
-  wrapper?: React.FC;
+  wrapper?: React.FC<PropsWithChildren>;
   container?: HTMLElement;
 };
 
+/**
+ * createDeferredResponse is a utility function to create a deferred response
+ * handler for testing purposes.
+ *
+ * This is useful when you want to assert that a loading state is shown,
+ * and then the loaded data is displayed after resolving the promise,
+ * instead of using a timeout or a fixed delay in the response handler.
+ *
+ * Example usage:
+ *
+ * ```ts
+ * const deferred = createDeferredResponse({
+ *   events: MOCK_EVENTS,
+ *   startKey: '',
+ * });
+ *
+ * server.use(http.get(listRecordingsUrl, deferred.handler));
+ *
+ * setupTest();
+ *
+ * await waitFor(() => {
+ *   expect(screen.getByTestId('indicator')).toBeInTheDocument();
+ * });
+ *
+ * deferred.resolve();
+ *
+ * await waitFor(() => {
+ *   expect(screen.queryByTestId('indicator')).not.toBeInTheDocument();
+ * });
+ * ```
+ */
+export function createDeferredResponse<T extends JsonBodyType>(data: T) {
+  let resolve: () => void;
+
+  const promise = new Promise<void>(r => {
+    resolve = r;
+  });
+
+  return {
+    handler: async () => {
+      await promise;
+
+      return HttpResponse.json(data);
+    },
+    resolve: () => resolve(),
+  };
+}
+
 export {
   act,
   screen,
diff --git a/web/packages/shared/README.md b/web/packages/shared/README.md
index 00b962fd11d42..53e54f0909136 100644
--- a/web/packages/shared/README.md
+++ b/web/packages/shared/README.md
@@ -15,7 +15,6 @@ Add `@gravitational/shared` to your package.json file.
 ### WASM
 
 This package includes a WASM module built from a Rust codebase located in `packages/shared/libs/ironrdp`.
-It is built with the help of [wasm-pack](https://github.com/rustwasm/wasm-pack).
 
 Running `pnpm build-wasm` builds the WASM binary as well as the appropriate Javascript/Typescript
 bindings and types in `web/packages/shared/libs/ironrdp/pkg`.
\ No newline at end of file
diff --git a/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/LongTerm.tsx b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/LongTerm.tsx
new file mode 100644
index 0000000000000..a29fd5e5750f4
--- /dev/null
+++ b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/LongTerm.tsx
@@ -0,0 +1,253 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { Alert } from 'design/Alert';
+import {
+  PendingListItem,
+  RequestCheckoutProps,
+} from 'shared/components/AccessRequests/NewRequest';
+import {
+  AccessRequest,
+  LongTermResourceGrouping,
+  RequestKind,
+} from 'shared/services/accessRequests';
+
+// UNSUPPORTED_KINDS is a list of resource_ids that are not supported
+// for long-term requests.
+export const UNSUPPORTED_KINDS = ['namespace', 'windows_desktop'];
+
+// LongTermGroupingErrors displays any errors related to long-term
+// resource grouping, such as uncovered or incompatible resources.
+export const LongTermGroupingErrors = <
+  T extends PendingListItem = PendingListItem,
+>({
+  grouping,
+  toggleResources,
+  pendingAccessRequests,
+}: {
+  grouping: LongTermResourceGrouping;
+  toggleResources?: RequestCheckoutProps<T>['toggleResources'];
+  pendingAccessRequests: T[];
+}) => {
+  if (
+    !grouping?.accessListToResources?.[grouping?.recommendedAccessList]?.length
+  ) {
+    return (
+      <Alert
+        kind="danger"
+        details={
+          grouping.validationMessage ||
+          'No resources are available for permanent access'
+        }
+        wrapContents
+      >
+        Permanent access unavailable
+      </Alert>
+    );
+  }
+
+  return (
+    <>
+      <LongTermUnavailableError
+        grouping={grouping}
+        pendingAccessRequests={pendingAccessRequests}
+        toggleResources={toggleResources}
+      />
+      <GroupingResourcesError
+        grouping={grouping}
+        pendingAccessRequests={pendingAccessRequests}
+        toggleResources={toggleResources}
+      />
+    </>
+  );
+};
+
+const LongTermUnavailableError = <T extends PendingListItem = PendingListItem>({
+  grouping,
+  pendingAccessRequests,
+  toggleResources,
+}: {
+  grouping: LongTermResourceGrouping;
+  pendingAccessRequests: T[];
+  toggleResources?: RequestCheckoutProps<T>['toggleResources'];
+}) => {
+  const uncoveredResources = findUncoveredLongTermResources(
+    grouping,
+    pendingAccessRequests
+  );
+  if (!uncoveredResources.length) {
+    return null;
+  }
+
+  const plural = uncoveredResources.length > 1;
+  const message = `${joinResourceNames(uncoveredResources)} ${plural ? 'are' : 'is'} not available for permanent access. Remove ${plural ? 'them' : 'it'} or switch to a temporary request.`;
+
+  return (
+    <Alert
+      kind="danger"
+      primaryAction={{
+        content: `Remove incompatible ${plural ? 'resources' : 'resource'}`,
+        onClick: () =>
+          toggleResources(
+            uncoveredResources.map(i => ({
+              resourceName: i.name,
+              resourceId: i.id,
+              kind: i.kind,
+            }))
+          ),
+      }}
+      details={message}
+      wrapContents
+    >
+      Permanent access is not available for{' '}
+      {plural ? 'some selected resources' : 'a selected resource'}
+    </Alert>
+  );
+};
+
+const GroupingResourcesError = <T extends PendingListItem = PendingListItem>({
+  grouping,
+  pendingAccessRequests,
+  toggleResources,
+}: {
+  grouping: LongTermResourceGrouping;
+  pendingAccessRequests: T[];
+  toggleResources?: RequestCheckoutProps<T>['toggleResources'];
+}) => {
+  const incompatibleResources = findIncompatibleLongTermResources(
+    grouping,
+    pendingAccessRequests
+  );
+  if (!incompatibleResources.length) {
+    return null;
+  }
+
+  const plural = incompatibleResources.length > 1;
+  const message = `Remove ${joinResourceNames(incompatibleResources)} and request ${plural ? 'them' : 'it'} separately, or switch to a temporary request.`;
+
+  return (
+    <Alert
+      kind="warning"
+      primaryAction={{
+        content: `Remove incompatible ${plural ? 'resources' : 'resource'}`,
+        onClick: () =>
+          toggleResources(
+            incompatibleResources.map(i => ({
+              resourceName: i.name,
+              resourceId: i.id,
+              kind: i.kind,
+            }))
+          ),
+      }}
+      details={message}
+      wrapContents
+    >
+      {plural ? 'Resources' : 'Resource'} cannot be grouped for permanent access
+    </Alert>
+  );
+};
+
+// joinResourceNames takes a list of resources and returns a
+// human-readable string of their names, formatted
+// as a list with commas and "and" for the last item.
+const joinResourceNames = <T extends PendingListItem = PendingListItem>(
+  resources: T[]
+) =>
+  new Intl.ListFormat('en', { style: 'long', type: 'conjunction' }).format(
+    resources.map(r => (r.kind === 'namespace' ? r.subResourceName : r.name))
+  );
+
+// findIncompatibleLongTermResources iterates through the
+// pendingRequests and returns a list of resources
+// that are incompatible with the optimal grouping.
+const findIncompatibleLongTermResources = <
+  T extends PendingListItem = PendingListItem,
+>(
+  grouping: LongTermResourceGrouping,
+  pendingRequests: T[]
+) => {
+  const optimalGrouping =
+    grouping.accessListToResources?.[grouping.recommendedAccessList] || [];
+  if (!optimalGrouping.length) {
+    return [];
+  }
+
+  // Don't include uncovered resources, so we avoid duplicate errors
+  const uncoveredResources = findUncoveredLongTermResources(
+    grouping,
+    pendingRequests
+  );
+
+  return pendingRequests.filter(
+    item =>
+      !uncoveredResources.some(i => item.id === i.id) &&
+      !optimalGrouping.some(i => item.id === i.name)
+  );
+};
+
+// findUncoveredLongTermResources iterates through the
+// pendingAccessRequests and returns a list of resources
+// that are not covered by any grouping.
+const findUncoveredLongTermResources = <
+  T extends PendingListItem = PendingListItem,
+>(
+  grouping: LongTermResourceGrouping,
+  pendingRequests: T[]
+) => {
+  const groupings = Object.values(grouping.accessListToResources || {}).flat();
+
+  return pendingRequests.filter(
+    item =>
+      UNSUPPORTED_KINDS.includes(item.kind) ||
+      !groupings.some(i => i.name === item.id)
+  );
+};
+
+// shouldShowLongTermGroupingErrors checks if the current dryRunResponse is
+// up-to-date with the current pendingAccessRequests and requestKind,
+// intended for use before rendering any LongTermGrouping errors.
+export const shouldShowLongTermGroupingErrors = <
+  T extends PendingListItem = PendingListItem,
+>({
+  requestKind,
+  pendingAccessRequests,
+  dryRunResponse,
+}: {
+  requestKind: RequestKind;
+  pendingAccessRequests: T[];
+  dryRunResponse: AccessRequest;
+}) => {
+  if (
+    requestKind !== RequestKind.LongTerm ||
+    !dryRunResponse?.longTermResourceGrouping ||
+    dryRunResponse.requestKind !== requestKind
+  ) {
+    return false;
+  }
+  // If any unsupported kinds are present, show errors immediately
+  if (pendingAccessRequests.some(r => UNSUPPORTED_KINDS.includes(r.kind))) {
+    return true;
+  }
+
+  const responseResourceKeys = new Set(
+    dryRunResponse.resources.map(res => `${res.id.kind}:${res.id.name}`)
+  );
+  return pendingAccessRequests.every(r => {
+    const key = `${r.kind}:${r.id}`;
+    return responseResourceKeys.has(key);
+  });
+};
diff --git a/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.story.tsx b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.story.tsx
index a7161baaadaed..dbe771618d4a0 100644
--- a/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.story.tsx
+++ b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.story.tsx
@@ -20,11 +20,14 @@ import { useState } from 'react';
 import { Link, MemoryRouter } from 'react-router-dom';
 
 import { Box, ButtonPrimary, ButtonText } from 'design';
+import { UNSUPPORTED_KINDS } from 'shared/components/AccessRequests/NewRequest/RequestCheckout/LongTerm';
 import { Option } from 'shared/components/Select';
+import { AccessRequest, RequestKind } from 'shared/services/accessRequests';
 
 import { dryRunResponse } from '../../fixtures';
 import { useSpecifiableFields } from '../useSpecifiableFields';
 import {
+  PendingListItem,
   RequestCheckoutWithSlider,
   RequestCheckoutWithSliderProps,
 } from './RequestCheckout';
@@ -127,6 +130,143 @@ export const LoadedResourceRequest = () => {
   );
 };
 
+export const LoadedLongTermRequest = () => {
+  const dryRunResponseWithLongTerm = {
+    ...dryRunResponse,
+    requestKind: RequestKind.LongTerm,
+    longTermResourceGrouping: {
+      accessListToResources: {
+        'some-list-uuid': baseProps.pendingAccessRequests
+          .filter(r => !UNSUPPORTED_KINDS.includes(r.kind))
+          .map(r => ({
+            kind: r.kind,
+            name: r.id,
+            clusterName: 'cluster-name',
+          })),
+      },
+      canProceed: true,
+      recommendedAccessList: 'some-list-uuid',
+      validationMessage: '',
+    },
+  } satisfies AccessRequest;
+
+  return (
+    <MemoryRouter>
+      <RequestCheckoutWithSlider
+        {...baseProps}
+        isResourceRequest={true}
+        pendingAccessRequests={baseProps.pendingAccessRequests.filter(
+          r => r.kind !== 'windows_desktop'
+        )}
+        fetchResourceRequestRolesAttempt={{ status: 'success' }}
+        requestKind={RequestKind.LongTerm}
+        dryRunResponse={dryRunResponseWithLongTerm}
+      />
+    </MemoryRouter>
+  );
+};
+
+export const LoadedLongTermRequestWithGroupingErrors = () => {
+  const dryRunResponseWithLongTermGroupingErrors = {
+    ...dryRunResponse,
+    requestKind: RequestKind.LongTerm,
+    longTermResourceGrouping: {
+      accessListToResources: {
+        'some-list-uuid': baseProps.pendingAccessRequests
+          .slice(0, 3)
+          .map(r => ({
+            kind: r.kind,
+            name: r.id,
+            clusterName: 'cluster-name',
+          })),
+        'another-list-uuid': baseProps.pendingAccessRequests
+          .slice(3)
+          .map(r => ({
+            kind: r.kind,
+            name: r.id,
+            clusterName: 'cluster-name',
+          })),
+      },
+      canProceed: false,
+      recommendedAccessList: 'some-list-uuid',
+      validationMessage:
+        'Selected resources cannot be grouped for long-term access',
+    },
+  } satisfies AccessRequest;
+
+  return (
+    <MemoryRouter>
+      <RequestCheckoutWithSlider
+        {...baseProps}
+        isResourceRequest={true}
+        fetchResourceRequestRolesAttempt={{ status: 'success' }}
+        requestKind={RequestKind.LongTerm}
+        dryRunResponse={dryRunResponseWithLongTermGroupingErrors}
+      />
+    </MemoryRouter>
+  );
+};
+
+export const LoadedLongTermRequestWithUnsupportedResources = () => {
+  const unsupportedResources = [
+    {
+      kind: 'windows_desktop',
+      name: 'desktop-name',
+      id: 'desktop-id',
+    },
+    {
+      kind: 'namespace',
+      name: 'kube-name',
+      id: 'kube-id',
+      subResourceName: 'kube-namespace-name',
+    },
+  ] satisfies PendingListItem[];
+
+  const dryRunResponseWithLongTermAndUnsupportedResources = {
+    ...dryRunResponse,
+    requestKind: RequestKind.LongTerm,
+    resources: [
+      ...baseProps.pendingAccessRequests.map(r => ({
+        id: { ...r, clusterName: 'cluster-name' },
+      })),
+      ...unsupportedResources.map(r => ({
+        id: { ...r, clusterName: 'cluster-name' },
+      })),
+    ],
+    longTermResourceGrouping: {
+      accessListToResources: {
+        'list-uuid': baseProps.pendingAccessRequests
+          .filter(r => !UNSUPPORTED_KINDS.includes(r.kind))
+          .map(r => ({
+            kind: r.kind,
+            name: r.id,
+            clusterName: 'cluster-name',
+          })),
+      },
+      canProceed: false,
+      recommendedAccessList: 'list-uuid',
+      validationMessage:
+        'Long-term access is not available for some selected resources',
+    },
+  } satisfies AccessRequest;
+
+  return (
+    <MemoryRouter>
+      <RequestCheckoutWithSlider
+        {...baseProps}
+        isResourceRequest={true}
+        pendingAccessRequests={[
+          ...baseProps.pendingAccessRequests,
+          ...unsupportedResources,
+        ]}
+        fetchResourceRequestRolesAttempt={{ status: 'success' }}
+        requestKind={RequestKind.LongTerm}
+        dryRunResponse={dryRunResponseWithLongTermAndUnsupportedResources}
+      />
+    </MemoryRouter>
+  );
+};
+
 export const ProcessingResourceRequest = () => (
   <MemoryRouter>
     <RequestCheckoutWithSlider
@@ -213,42 +353,43 @@ const baseProps: RequestCheckoutWithSliderProps = {
     {
       kind: 'app',
       name: 'app-name',
-      id: 'app-name',
+      id: 'app-id',
     },
     {
       kind: 'db',
-      name: 'app-name',
-      id: 'app-name',
+      name: 'db-name',
+      id: 'db-id',
     },
     {
       kind: 'kube_cluster',
       name: 'kube-name',
-      id: 'app-name',
+      id: 'kube-id',
     },
     {
       kind: 'user_group',
       name: 'user-group-name',
-      id: 'app-name',
+      id: 'user-group-id',
     },
     {
       kind: 'windows_desktop',
       name: 'desktop-name',
-      id: 'app-name',
+      id: 'desktop-id',
     },
     {
       kind: 'saml_idp_service_provider',
       name: 'app-saml',
-      id: 'app-name',
+      id: 'saml-id',
     },
     {
       kind: 'aws_ic_account_assignment',
       name: 'account1',
-      id: 'admin-on-account1',
+      id: 'aws-id',
     },
   ],
   clearAttempt: () => null,
   onClose: () => null,
   toggleResource: () => null,
+  toggleResources: () => null,
   reset: () => null,
   transitionState: 'entered',
   numRequestedResources: 4,
@@ -264,5 +405,7 @@ const baseProps: RequestCheckoutWithSliderProps = {
   pendingRequestTtlOptions: [],
   dryRunResponse,
   startTime: null,
+  requestKind: RequestKind.ShortTerm,
+  setRequestKind: () => null,
   onStartTimeChange: () => null,
 };
diff --git a/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.tsx b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.tsx
index 4433f674e77e1..79820ea5ecfd3 100644
--- a/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.tsx
+++ b/web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.tsx
@@ -19,12 +19,13 @@
 import React, {
   forwardRef,
   useEffect,
+  useMemo,
   useRef,
   useState,
   type JSX,
 } from 'react';
 import type { TransitionStatus } from 'react-transition-group';
-import styled from 'styled-components';
+import styled, { useTheme } from 'styled-components';
 
 import {
   Alert,
@@ -33,6 +34,7 @@ import {
   ButtonIcon,
   ButtonPrimary,
   ButtonSecondary,
+  ButtonSelect,
   Link as ExternalLink,
   Flex,
   H2,
@@ -47,6 +49,11 @@ import { Danger } from 'design/Alert';
 import Table, { Cell } from 'design/DataTable';
 import { ArrowBack, ChevronDown, ChevronRight, Warning } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
+import {
+  LongTermGroupingErrors,
+  shouldShowLongTermGroupingErrors,
+  UNSUPPORTED_KINDS,
+} from 'shared/components/AccessRequests/NewRequest/RequestCheckout/LongTerm';
 import { RequestableResourceKind } from 'shared/components/AccessRequests/NewRequest/resource';
 import { FieldCheckbox } from 'shared/components/FieldCheckbox';
 import { Option } from 'shared/components/Select';
@@ -54,7 +61,7 @@ import { TextSelectCopyMulti } from 'shared/components/TextSelectCopy';
 import Validation, { useRule, Validator } from 'shared/components/Validation';
 import { Attempt } from 'shared/hooks/useAttemptNext';
 import { mergeRefs } from 'shared/libs/mergeRefs';
-import type { AccessRequest } from 'shared/services/accessRequests';
+import { AccessRequest, RequestKind } from 'shared/services/accessRequests';
 import { pluralize } from 'shared/utils/text';
 
 import { AccessDurationRequest } from '../../AccessDuration';
@@ -142,6 +149,7 @@ export const RequestCheckoutWithSlider = forwardRef<
 
 export function RequestCheckout<T extends PendingListItem>({
   toggleResource,
+  toggleResources,
   onClose,
   reset,
   appsGrantedByUserGroup = [],
@@ -175,8 +183,15 @@ export function RequestCheckout<T extends PendingListItem>({
   onStartTimeChange,
   fetchKubeNamespaces,
   updateNamespacesForKubeCluster,
+  requestKind = RequestKind.ShortTerm,
+  setRequestKind,
 }: RequestCheckoutProps<T>) {
+  const theme = useTheme();
   const [reason, setReason] = useState('');
+  // TODO(kiosion): Remove once Teleterm's RequestCheckout supports LongTerm requests.
+  const supportsLongTerm =
+    setRequestKind !== undefined && toggleResources !== undefined;
+  const isLongTerm = requestKind === RequestKind.LongTerm;
 
   function updateReason(reason: string) {
     setReason(reason);
@@ -193,6 +208,7 @@ export function RequestCheckout<T extends PendingListItem>({
       maxDuration: maxDuration ? new Date(maxDuration.value) : null,
       requestTTL: pendingRequestTtl ? new Date(pendingRequestTtl.value) : null,
       start: startTime,
+      requestKind,
     });
   }
 
@@ -206,18 +222,63 @@ export function RequestCheckout<T extends PendingListItem>({
     isResourceRequest &&
     selectedResourceRequestRoles.length < 1;
 
-  const submitBtnDisabled =
-    pendingAccessRequests.length === 0 ||
-    createAttempt.status === 'processing' ||
-    isInvalidRoleSelection ||
-    (fetchResourceRequestRolesAttempt.status === 'failed' &&
-      hasUnsupporteKubeResourceKinds) ||
-    fetchResourceRequestRolesAttempt.status === 'processing';
+  const submitBtnDisabled = useMemo(() => {
+    if (
+      pendingAccessRequests.length === 0 ||
+      createAttempt.status === 'processing' ||
+      isInvalidRoleSelection
+    ) {
+      return true;
+    }
+    if (
+      fetchResourceRequestRolesAttempt.status === 'failed' &&
+      hasUnsupporteKubeResourceKinds
+    ) {
+      return true;
+    }
+    if (fetchResourceRequestRolesAttempt.status === 'processing') {
+      return true;
+    }
+    if (isLongTerm) {
+      return !dryRunResponse?.longTermResourceGrouping?.canProceed;
+    }
+    return false;
+  }, [
+    createAttempt,
+    fetchResourceRequestRolesAttempt,
+    hasUnsupporteKubeResourceKinds,
+    isInvalidRoleSelection,
+    isLongTerm,
+    dryRunResponse?.longTermResourceGrouping,
+    pendingAccessRequests,
+  ]);
 
   const cancelBtnDisabled =
     createAttempt.status === 'processing' ||
     fetchResourceRequestRolesAttempt.status === 'processing';
 
+  const [longTermDisabled, longTermDisabledReason] = useMemo(() => {
+    // If long-term is already enabled, don't block toggling it off
+    if (isLongTerm || dryRunResponse?.longTermResourceGrouping?.canProceed) {
+      return [false, undefined];
+    }
+    if (!isResourceRequest) {
+      return [
+        true,
+        'Permanent access is only supported for resource-based requests.',
+      ];
+    }
+    // If canProceed is false on initial dryRun, show validation msg and disable until req is re-run.
+    if (dryRunResponse?.longTermResourceGrouping?.canProceed === false) {
+      return [
+        true,
+        'Permanent access is unavailable. ' +
+          dryRunResponse.longTermResourceGrouping.validationMessage || '',
+      ];
+    }
+    return [false, undefined];
+  }, [isResourceRequest, isLongTerm, dryRunResponse?.longTermResourceGrouping]);
+
   const numPendingAccessRequests = pendingAccessRequests.filter(
     item => !isKubeClusterWithNamespaces(item, pendingAccessRequests)
   ).length;
@@ -244,8 +305,22 @@ export function RequestCheckout<T extends PendingListItem>({
 
   function customRow(item: T) {
     if (item.kind === 'kube_cluster') {
+      const unsupported =
+        requestKind === RequestKind.LongTerm &&
+        !!isKubeClusterWithNamespaces(item, pendingAccessRequests);
+
       return (
-        <td colSpan={showClusterNameColumn ? 4 : 3}>
+        <td
+          colSpan={showClusterNameColumn ? 4 : 3}
+          style={
+            unsupported
+              ? {
+                  background: theme.colors.interactive.tonal.danger[0],
+                  borderTopColor: theme.colors.interactive.tonal.danger[2],
+                }
+              : {}
+          }
+        >
           <Flex>
             <Flex flexWrap="wrap">
               <Flex
@@ -279,6 +354,44 @@ export function RequestCheckout<T extends PendingListItem>({
     }
   }
 
+  const getStyle = useMemo(
+    () => (item: T) => {
+      if (
+        !shouldShowLongTermGroupingErrors({
+          requestKind,
+          pendingAccessRequests,
+          dryRunResponse,
+        })
+      ) {
+        return;
+      }
+
+      const isInAnyGrouping = Object.values(
+        dryRunResponse.longTermResourceGrouping.accessListToResources
+      ).some(g => g.some(i => i.name === item.id));
+      const grouping =
+        dryRunResponse.longTermResourceGrouping.accessListToResources?.[
+          dryRunResponse.longTermResourceGrouping.recommendedAccessList
+        ] || [];
+
+      const isInOptimalGrouping = grouping.some(i => i.name === item.id);
+
+      if (!isInAnyGrouping || UNSUPPORTED_KINDS.includes(item.kind)) {
+        return {
+          background: theme.colors.interactive.tonal.danger[0],
+          borderTopColor: theme.colors.interactive.tonal.danger[2],
+        };
+      }
+      if (!isInOptimalGrouping) {
+        return {
+          background: theme.colors.interactive.tonal.alert[0],
+          borderTopColor: theme.colors.interactive.tonal.alert[2],
+        };
+      }
+    },
+    [requestKind, pendingAccessRequests, dryRunResponse, theme]
+  );
+
   return (
     <Validation>
       {({ validator }) => (
@@ -286,10 +399,9 @@ export function RequestCheckout<T extends PendingListItem>({
           {!isRequestKubeResourceError &&
             createAttempt.status !== 'failed' &&
             fetchResourceRequestRolesAttempt.status === 'failed' && (
-              <Alert
-                kind="danger"
-                children={fetchResourceRequestRolesAttempt.statusText}
-              />
+              <Alert kind="danger">
+                {fetchResourceRequestRolesAttempt.statusText}
+              </Alert>
             )}
           {hasUnsupporteKubeResourceKinds && (
             <Alert kind="danger">
@@ -335,13 +447,20 @@ export function RequestCheckout<T extends PendingListItem>({
               </Box>
             </Alert>
           )}
-          {fetchStatus === 'loading' && (
-            <Box mt={5} textAlign="center">
-              <Indicator />
+          {fetchStatus === 'loading' ? (
+            <Box
+              textAlign="center"
+              // roughly align with the 'normal' height of the side-panel
+              // and prevent jitter from Indicator sub-pixel rendering
+              css={`
+                min-height: 30vh;
+                display: grid;
+                place-items: center;
+              `}
+            >
+              <Indicator delay="none" />
             </Box>
-          )}
-
-          {fetchStatus === 'loaded' && (
+          ) : (
             <div>
               {createAttempt.status === 'success' ? (
                 <>
@@ -363,7 +482,18 @@ export function RequestCheckout<T extends PendingListItem>({
                 <>
                   {Header?.() || DefaultHeader()}
                   {createAttempt.status === 'failed' && (
-                    <Alert kind="danger" children={createAttempt.statusText} />
+                    <Alert kind="danger">{createAttempt.statusText}</Alert>
+                  )}
+                  {shouldShowLongTermGroupingErrors({
+                    requestKind,
+                    dryRunResponse,
+                    pendingAccessRequests,
+                  }) && (
+                    <LongTermGroupingErrors
+                      grouping={dryRunResponse?.longTermResourceGrouping}
+                      toggleResources={toggleResources}
+                      pendingAccessRequests={pendingAccessRequests}
+                    />
                   )}
                   <StyledTable
                     data={pendingAccessRequests.filter(
@@ -371,6 +501,7 @@ export function RequestCheckout<T extends PendingListItem>({
                     )}
                     row={{
                       customRow,
+                      getStyle,
                     }}
                     columns={[
                       {
@@ -417,7 +548,36 @@ export function RequestCheckout<T extends PendingListItem>({
                     appsGrantedByUserGroup.length > 0 && (
                       <AppsGrantedAccess apps={appsGrantedByUserGroup} />
                     )}
-                  {isResourceRequest && (
+                  {supportsLongTerm && (
+                    <>
+                      <Flex flexDirection="column" gap={2} mt={4}>
+                        <Text bold>Request Type</Text>
+                        <ButtonSelect
+                          options={[
+                            {
+                              value: RequestKind.ShortTerm,
+                              label: 'Temporary',
+                            },
+                            {
+                              value: RequestKind.LongTerm,
+                              label: 'Permanent',
+                              disabled: longTermDisabled,
+                              tooltip: longTermDisabledReason,
+                            },
+                          ]}
+                          activeValue={
+                            isLongTerm
+                              ? RequestKind.LongTerm
+                              : RequestKind.ShortTerm
+                          }
+                          onChange={setRequestKind}
+                          fullWidth
+                        />
+                      </Flex>
+                      <Divider />
+                    </>
+                  )}
+                  {!isLongTerm && isResourceRequest && (
                     <ResourceRequestRoles
                       roles={resourceRequestRoles}
                       selectedRoles={selectedResourceRequestRoles}
@@ -425,17 +585,21 @@ export function RequestCheckout<T extends PendingListItem>({
                       fetchAttempt={fetchResourceRequestRolesAttempt}
                     />
                   )}
-                  <Box mt={6} mb={1}>
-                    <SelectReviewers
-                      reviewers={
-                        dryRunResponse?.reviewers.map(r => r.name) ?? []
-                      }
-                      selectedReviewers={selectedReviewers}
-                      setSelectedReviewers={setSelectedReviewers}
-                    />
-                  </Box>
-                  <Flex mt={6} flexDirection="column" gap={1}>
-                    {dryRunResponse && (
+                  {/* Selecting reviewers not available for long-term requests */}
+                  {!isLongTerm && (
+                    <Box my={4}>
+                      <SelectReviewers
+                        reviewers={
+                          dryRunResponse?.reviewers.map(r => r.name) ?? []
+                        }
+                        selectedReviewers={selectedReviewers}
+                        setSelectedReviewers={setSelectedReviewers}
+                      />
+                    </Box>
+                  )}
+                  <Flex flexDirection="column" gap={1}>
+                    {/* Start time / max duration are only valid for non-Long-Term requests */}
+                    {!isLongTerm && dryRunResponse && (
                       <Box mb={1}>
                         <AssumeStartTime
                           start={startTime}
@@ -454,8 +618,9 @@ export function RequestCheckout<T extends PendingListItem>({
                       updateReason={updateReason}
                       requireReason={requireReason}
                       reasonPrompts={reasonPrompts}
+                      numPendingAccessRequests={numPendingAccessRequests}
                     />
-                    {dryRunResponse && maxDuration && (
+                    {!isLongTerm && dryRunResponse && maxDuration && (
                       <AdditionalOptions
                         selectedMaxDurationTimestamp={maxDuration.value}
                         setPendingRequestTtl={setPendingRequestTtl}
@@ -509,6 +674,15 @@ export function RequestCheckout<T extends PendingListItem>({
   );
 }
 
+const Divider = styled.div`
+  width: 100%;
+  height: 1px;
+  pointer-events: none;
+  background-color: ${props => props.theme.colors.spotBackground[1]};
+  margin-top: ${props => props.theme.space[4]}px;
+  margin-bottom: ${props => props.theme.space[4]}px;
+`;
+
 function AppsGrantedAccess({ apps }: { apps: string[] }) {
   const [expanded, setExpanded] = useState(true);
   const ArrowIcon = expanded ? ChevronDown : ChevronRight;
@@ -582,13 +756,14 @@ function ResourceRequestRoles({
     }
     setSelectedRoles(selectedRoles.filter(role => role !== roleName));
   }
+
   // only show the role selector if there is more than one role that can be selected
   if (roles.length < 2) {
     return;
   }
 
   return (
-    <Box mt={7} width="100%">
+    <Box width="100%">
       <Box style={{ cursor: 'pointer' }}>
         <Flex
           justifyContent="space-between"
@@ -694,11 +869,13 @@ const RoleRowContainer = styled.div<{ checked?: boolean }>`
 
   // TODO(bl-nero): That's the third place where we're copying these
   // definitions. We need to make them reusable.
+
   &:hover {
     background-color: ${props => props.theme.colors.levels.surface};
 
     // We use a pseudo element for the shadow with position: absolute in order to prevent
     // the shadow from increasing the size of the layout and causing scrollbar flicker.
+
     &:after {
       box-shadow: ${props => props.theme.boxShadow[3]};
       content: '';
@@ -732,23 +909,26 @@ function TextBox({
   updateReason,
   requireReason,
   reasonPrompts,
+  numPendingAccessRequests,
 }: {
   reason: string;
   updateReason(reason: string): void;
   requireReason: boolean;
-  reasonPrompts?: string[];
+  reasonPrompts: string[];
+  numPendingAccessRequests: number;
 }) {
   const { valid, message } = useRule(requireText(reason, requireReason));
   const hasError = !valid;
   const labelText = hasError ? message : 'Request Reason';
 
   const placeholderText =
-    reasonPrompts?.filter(s => s.length > 0).join('\n') ||
-    'Describe your request...';
+    reasonPrompts && reasonPrompts.length && numPendingAccessRequests > 0
+      ? reasonPrompts.filter(s => s.length > 0).join('\n')
+      : 'Describe your request...';
 
   return (
     <LabelInput hasError={hasError}>
-      {labelText}
+      <Text mb={1}>{labelText}</Text>
       <Box
         as="textarea"
         height="80px"
@@ -764,6 +944,7 @@ function TextBox({
         css={`
           outline: none;
           background: transparent;
+          font-size: ${props => props.theme.fontSizes[2]}px;
 
           &::placeholder {
             color: ${({ theme }) => theme.colors.text.muted};
@@ -921,6 +1102,14 @@ export type RequestCheckoutProps<T extends PendingListItem = PendingListItem> =
   {
     onClose(): void;
     toggleResource: (resource: T) => void;
+    toggleResources?: (
+      resources: {
+        kind: T['kind'];
+        resourceId: T['id'];
+        resourceName: T['name'];
+      }[],
+      action?: 'add' | 'remove'
+    ) => void;
     appsGrantedByUserGroup?: string[];
     userGroupFetchAttempt?: Attempt;
     reset: () => void;
@@ -950,6 +1139,8 @@ export type RequestCheckoutProps<T extends PendingListItem = PendingListItem> =
     dryRunResponse: AccessRequest;
     Header?: () => JSX.Element;
     startTime: Date;
+    requestKind?: RequestKind;
+    setRequestKind?: React.Dispatch<React.SetStateAction<RequestKind>>;
     onStartTimeChange(t?: Date): void;
     fetchKubeNamespaces(search: string, kubeCluster: T): Promise<string[]>;
     updateNamespacesForKubeCluster(
diff --git a/web/packages/shared/components/AccessRequests/NewRequest/resource.ts b/web/packages/shared/components/AccessRequests/NewRequest/resource.ts
index ca5a031f5db89..3f3fadf64ec6a 100644
--- a/web/packages/shared/components/AccessRequests/NewRequest/resource.ts
+++ b/web/packages/shared/components/AccessRequests/NewRequest/resource.ts
@@ -16,7 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourceIdKind } from 'teleport/services/agents';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { KubeResourceKind } from 'teleport/services/kube';
 
 /** Available request kinds for resource-based and role-based access requests. */
diff --git a/web/packages/shared/components/AccessRequests/NewRequest/useSpecifiableFields.ts b/web/packages/shared/components/AccessRequests/NewRequest/useSpecifiableFields.ts
index 05fc0c0be86ea..6f5617695e784 100644
--- a/web/packages/shared/components/AccessRequests/NewRequest/useSpecifiableFields.ts
+++ b/web/packages/shared/components/AccessRequests/NewRequest/useSpecifiableFields.ts
@@ -23,7 +23,7 @@ import {
   ReviewerOption,
 } from 'shared/components/AccessRequests/NewRequest';
 import { Option } from 'shared/components/Select';
-import { AccessRequest } from 'shared/services/accessRequests';
+import { AccessRequest, RequestKind } from 'shared/services/accessRequests';
 
 import {
   getDurationOptionIndexClosestToOneWeek,
@@ -87,6 +87,10 @@ export function useSpecifiableFields() {
    */
   let maxDurationOptions: Option<number>[] = [];
 
+  const [requestKind, setRequestKind] = useState<RequestKind>(
+    RequestKind.ShortTerm
+  );
+
   if (dryRunResponse) {
     pendingRequestTtlOptions = getPendingRequestDurationOptions(
       dryRunResponse.created,
@@ -106,6 +110,7 @@ export function useSpecifiableFields() {
     setStartTime(null);
     setMaxDuration(null);
     setPendingRequestTtl(null);
+    setRequestKind(RequestKind.ShortTerm);
   }
 
   function preselectPendingRequestTtlOption(
@@ -198,6 +203,8 @@ export function useSpecifiableFields() {
     pendingRequestTtlOptions,
     dryRunResponse,
     startTime,
+    requestKind,
+    setRequestKind,
     onStartTimeChange,
     onDryRunChange,
     reset,
diff --git a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestReview/RequestReview.tsx b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestReview/RequestReview.tsx
index 1c89ab35669ae..e03f57f5f809d 100644
--- a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestReview/RequestReview.tsx
+++ b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestReview/RequestReview.tsx
@@ -29,7 +29,11 @@ import { Option } from 'shared/components/Select';
 import Validation, { Validator } from 'shared/components/Validation';
 import { requiredField } from 'shared/components/Validation/rules';
 import { Attempt } from 'shared/hooks/useAsync';
-import { AccessRequest, RequestState } from 'shared/services/accessRequests';
+import {
+  AccessRequest,
+  RequestKind,
+  RequestState,
+} from 'shared/services/accessRequests';
 
 import { AccessDurationReview } from '../../../AccessDuration';
 import { AssumeStartTime } from '../../../AssumeStartTime/AssumeStartTime';
@@ -298,9 +302,13 @@ function makeReviewStateOptions(
     );
   }
 
-  return [
+  const opts: ReviewStateOption[] = [
     { value: 'DENIED', label: <>Reject request</> },
-    {
+  ];
+
+  // Don't allow approving short-term access for long-term requests.
+  if (request.requestKind !== RequestKind.LongTerm) {
+    opts.push({
       value: 'APPROVED',
       label: (
         <>
@@ -308,16 +316,19 @@ function makeReviewStateOptions(
           {shortTermDuration ? ` (${shortTermDuration})` : ''}
         </>
       ),
-    },
-    {
-      value: 'PROMOTED',
-      disabled:
-        fetchSuggestedAccessListsAttempt.status === 'error' ||
-        (fetchSuggestedAccessListsAttempt.status === 'success' &&
-          fetchSuggestedAccessListsAttempt.data.length === 0),
-      label: <>{promotedContent}</>,
-    },
-  ];
+    });
+  }
+
+  opts.push({
+    value: 'PROMOTED',
+    disabled:
+      fetchSuggestedAccessListsAttempt.status === 'error' ||
+      (fetchSuggestedAccessListsAttempt.status === 'success' &&
+        fetchSuggestedAccessListsAttempt.data.length === 0),
+    label: <>{promotedContent}</>,
+  });
+
+  return opts;
 }
 
 const TextMutedNoEllipsis = styled.div`
diff --git a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestView.tsx b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestView.tsx
index 84223961cc951..e0a4cf35dc569 100644
--- a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestView.tsx
+++ b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/RequestView.tsx
@@ -42,12 +42,14 @@ import {
 import { LabelKind } from 'design/LabelState/LabelState';
 import { TeleportGearIcon } from 'design/SVGIcon';
 import { HoverTooltip } from 'design/Tooltip';
+import ResourcesRequested from 'shared/components/AccessRequests/ReviewRequests/RequestView/ResourcesRequested';
 import { Attempt, hasFinished } from 'shared/hooks/useAsync';
 import {
   AccessRequest,
   AccessRequestReview,
   AccessRequestReviewer,
   canAssumeNow,
+  RequestKind,
   RequestState,
   Resource,
 } from 'shared/services/accessRequests';
@@ -224,20 +226,38 @@ export function RequestView({
                     >
                       {request.user}
                     </Text>
-                    <Text
-                      mr={2}
-                      typography="body3"
-                      style={{
-                        flexShrink: 0,
-                        whiteSpace: 'nowrap',
-                      }}
-                    >
-                      is requesting roles:
-                    </Text>
-                    <RolesRequested roles={request.roles} />
-                    <Text typography="body3">
-                      for {requestedAccessTime}, starting {startingTime}
-                    </Text>
+                    {request.requestKind === RequestKind.LongTerm ? (
+                      <>
+                        <Text
+                          mr={2}
+                          typography="body3"
+                          style={{
+                            flexShrink: 0,
+                            whiteSpace: 'nowrap',
+                          }}
+                        >
+                          is requesting permanent access to resources:
+                        </Text>
+                        <ResourcesRequested resources={request.resources} />
+                      </>
+                    ) : (
+                      <>
+                        <Text
+                          mr={2}
+                          typography="body3"
+                          style={{
+                            flexShrink: 0,
+                            whiteSpace: 'nowrap',
+                          }}
+                        >
+                          is requesting roles:
+                        </Text>
+                        <RolesRequested roles={request.roles} />
+                        <Text typography="body3">
+                          for {requestedAccessTime}, starting {startingTime}
+                        </Text>
+                      </>
+                    )}
                   </Flex>
                 </H3>
               </Flex>
@@ -420,7 +440,7 @@ export function Timestamp({
           )
         ) : (
           <span>
-            {verb} this request to long-term access with access list{' '}
+            {verb} this request to permanent access with access list{' '}
             <b>{promotedAccessListTitle}</b> {createdDuration}
           </span>
         )}
diff --git a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/ResourcesRequested.tsx b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/ResourcesRequested.tsx
new file mode 100644
index 0000000000000..442d500d53f56
--- /dev/null
+++ b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/ResourcesRequested.tsx
@@ -0,0 +1,35 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Box, Label } from 'design';
+import { formattedName } from 'shared/components/AccessRequests/ReviewRequests';
+import type { Resource } from 'shared/services/accessRequests';
+
+export default function ResourcesRequested({
+  resources,
+}: {
+  resources: Resource[];
+}) {
+  const $resources = resources.map(resource => (
+    <Label mr={1} key={resource.id.name} kind="secondary">
+      {resource.details.friendlyName || formattedName(resource)}
+    </Label>
+  ));
+
+  return <Box>{$resources}</Box>;
+}
diff --git a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/types.ts b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/types.ts
index 2fc16e1b307c8..f7a08e2ef2c02 100644
--- a/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/types.ts
+++ b/web/packages/shared/components/AccessRequests/ReviewRequests/RequestView/types.ts
@@ -18,6 +18,7 @@
 
 import { RequestState } from 'shared/services/accessRequests';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { AllUserTraits } from 'teleport/services/user';
 
 export type RequestFlags = {
diff --git a/web/packages/shared/components/AccessRequests/Shared/types.ts b/web/packages/shared/components/AccessRequests/Shared/types.ts
index 260d4a7849f95..8cb05c47cb101 100644
--- a/web/packages/shared/components/AccessRequests/Shared/types.ts
+++ b/web/packages/shared/components/AccessRequests/Shared/types.ts
@@ -16,7 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Option } from 'shared/components/Select';
+import type { Option } from 'shared/components/Select';
+import type { RequestKind } from 'shared/services/accessRequests';
 
 export type TimeOption = Option<Date>;
 
@@ -27,4 +28,5 @@ export type CreateRequest = {
   maxDuration?: Date;
   requestTTL?: Date;
   dryRun?: boolean;
+  requestKind?: RequestKind;
 };
diff --git a/web/packages/shared/components/AdvancedSearchToggle/AdvancedSearchToggle.tsx b/web/packages/shared/components/AdvancedSearchToggle/AdvancedSearchToggle.tsx
index 70a2ff22a6899..f20d09ab9d8f9 100644
--- a/web/packages/shared/components/AdvancedSearchToggle/AdvancedSearchToggle.tsx
+++ b/web/packages/shared/components/AdvancedSearchToggle/AdvancedSearchToggle.tsx
@@ -38,8 +38,11 @@ export function AdvancedSearchToggle(props: {
       px={props.px}
       className={props.className}
     >
-      <Toggle isToggled={props.isToggled} onToggle={props.onToggle} />
-      <Text typography="body3">Advanced</Text>
+      <Toggle isToggled={props.isToggled} onToggle={props.onToggle}>
+        <Text typography="body3" ml={2}>
+          Advanced
+        </Text>
+      </Toggle>
       <IconTooltip trigger="click">
         <PredicateDocumentation />
       </IconTooltip>
diff --git a/web/packages/shared/components/AnimatedTerminal/content.ts b/web/packages/shared/components/AnimatedTerminal/content.ts
index e766ecc9e8d61..cf3cdd4ee43b7 100644
--- a/web/packages/shared/components/AnimatedTerminal/content.ts
+++ b/web/packages/shared/components/AnimatedTerminal/content.ts
@@ -63,7 +63,6 @@ export async function* createTerminalContent(
     yield buffer;
   }
 
-  // eslint-disable-next-line no-constant-condition
   while (true) {
     if (lineIndex < lines.length) {
       if (!lines[lineIndex].isCommand) {
diff --git a/web/packages/shared/components/AwsLaunchButton/AwsLaunchButton.tsx b/web/packages/shared/components/AwsLaunchButton/AwsLaunchButton.tsx
index b9ba9def28ab8..a3126cd46721d 100644
--- a/web/packages/shared/components/AwsLaunchButton/AwsLaunchButton.tsx
+++ b/web/packages/shared/components/AwsLaunchButton/AwsLaunchButton.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import React from 'react';
+import React, { ComponentPropsWithRef } from 'react';
 import styled from 'styled-components';
 
 import { Box, ButtonBorder, Flex, Text } from 'design';
@@ -193,7 +193,7 @@ type Props = {
   awsRoles: AwsRole[];
   getLaunchUrl(arn: string): string;
   onLaunchUrl?(arn: string): void;
-  width?: string;
+  width?: ComponentPropsWithRef<typeof ButtonBorder>['width'];
   isAwsIdentityCenterApp?: boolean;
 };
 
diff --git a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.story.tsx b/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.story.tsx
deleted file mode 100644
index b9d0a8fff56fc..0000000000000
--- a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.story.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useState } from 'react';
-
-import Flex from 'design/Flex';
-
-import { ButtonTextWithAddIcon } from './ButtonTextWithAddIcon';
-
-export default {
-  title: 'Shared',
-};
-
-export const Button = () => {
-  const [label, setLabel] = useState('Add Item (click me)');
-  return (
-    <Flex gap={2} width="300px" flexWrap={'wrap'}>
-      <div>
-        <ButtonTextWithAddIcon label={'Add Item'} onClick={() => null} />
-      </div>
-      <div>
-        <ButtonTextWithAddIcon
-          label={label}
-          onClick={() => setLabel('Add More Item (click me)')}
-        />
-      </div>
-      <div>
-        <ButtonTextWithAddIcon
-          label={'Add Item Disabled'}
-          onClick={() => null}
-          disabled={true}
-        />
-      </div>
-      <div>
-        <ButtonTextWithAddIcon
-          label={'Add Item with Medium Icon Size'}
-          onClick={() => null}
-          iconSize={'medium'}
-        />
-      </div>
-    </Flex>
-  );
-};
-
-Button.storyName = 'ButtonTextWithAddIcon';
diff --git a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.test.tsx b/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.test.tsx
deleted file mode 100644
index 60bdede4a7f0a..0000000000000
--- a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.test.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { fireEvent, render, screen } from 'design/utils/testing';
-
-import { ButtonTextWithAddIcon } from './ButtonTextWithAddIcon';
-
-test('buttonTextWithAddIcon', () => {
-  const onClick = jest.fn();
-  const label = 'Add Item';
-
-  const { rerender } = render(
-    <ButtonTextWithAddIcon label={label} onClick={() => onClick('click')} />
-  );
-
-  expect(screen.getByText('Add Item')).toBeInTheDocument();
-  fireEvent.click(screen.getByText('Add Item'));
-
-  expect(onClick).toHaveBeenCalledWith('click');
-
-  rerender(
-    <ButtonTextWithAddIcon
-      label={label}
-      onClick={() => onClick('click')}
-      disabled={true}
-    />
-  );
-  expect(screen.getByText('Add Item')).toBeDisabled();
-});
diff --git a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.tsx b/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.tsx
deleted file mode 100644
index 13adb4bee6115..0000000000000
--- a/web/packages/shared/components/ButtonTextWithAddIcon/ButtonTextWithAddIcon.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { ButtonText } from 'design';
-import { Add as AddIcon } from 'design/Icon';
-import type { IconSize } from 'design/Icon/Icon';
-
-export const ButtonTextWithAddIcon = ({
-  label,
-  onClick,
-  disabled,
-  iconSize = 12,
-}: {
-  label: string;
-  onClick: () => void;
-  disabled?: boolean;
-  iconSize?: IconSize;
-}) => {
-  return (
-    <ButtonText onClick={onClick} disabled={disabled} compact pr={2}>
-      <AddIcon
-        className="icon-add"
-        size={iconSize}
-        css={`
-          margin-right: 3px;
-        `}
-      />
-      {label}
-    </ButtonText>
-  );
-};
diff --git a/web/packages/shared/components/ButtonTextWithAddIcon/index.ts b/web/packages/shared/components/ButtonTextWithAddIcon/index.ts
index 9493670ce549b..ac9743d2a6a30 100644
--- a/web/packages/shared/components/ButtonTextWithAddIcon/index.ts
+++ b/web/packages/shared/components/ButtonTextWithAddIcon/index.ts
@@ -16,4 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-export { ButtonTextWithAddIcon } from './ButtonTextWithAddIcon';
+/**
+ * @deprecated Use `ButtonWithAddIcon` instead.
+ *
+ * TODO (bernardjkim): Remove once components in e repo have been updated.
+ */
+export { ButtonWithAddIcon as ButtonTextWithAddIcon } from '../ButtonWithAddIcon';
diff --git a/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.story.tsx b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.story.tsx
new file mode 100644
index 0000000000000..3827c96207afb
--- /dev/null
+++ b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.story.tsx
@@ -0,0 +1,82 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import { ButtonBorder, ButtonPrimary, ButtonSecondary } from 'design/Button';
+import Flex from 'design/Flex';
+
+import { ButtonWithAddIcon } from './ButtonWithAddIcon';
+
+export default {
+  title: 'Shared/ButtonWithAddIcon',
+};
+
+export const Button = () => {
+  const [label, setLabel] = useState('Add Item (click me)');
+  return (
+    <Flex gap={2} width="300px" flexWrap={'wrap'}>
+      <div>
+        <ButtonWithAddIcon label={'Add Item'} onClick={() => null} />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          label={label}
+          onClick={() => setLabel('Add More Item (click me)')}
+        />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          label={'Add Item Disabled'}
+          onClick={() => null}
+          disabled={true}
+        />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          label={'Add Item with Medium Icon Size'}
+          onClick={() => null}
+          iconSize={'medium'}
+        />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          Button={ButtonPrimary}
+          label={'Add Item'}
+          onClick={() => null}
+        />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          Button={ButtonSecondary}
+          label={'Add Item'}
+          onClick={() => null}
+        />
+      </div>
+      <div>
+        <ButtonWithAddIcon
+          Button={ButtonBorder}
+          label={'Add Item'}
+          onClick={() => null}
+        />
+      </div>
+    </Flex>
+  );
+};
+
+Button.storyName = 'ButtonWithAddIcon';
diff --git a/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.test.tsx b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.test.tsx
new file mode 100644
index 0000000000000..9f87f95951ac7
--- /dev/null
+++ b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.test.tsx
@@ -0,0 +1,44 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { fireEvent, render, screen } from 'design/utils/testing';
+
+import { ButtonWithAddIcon } from './ButtonWithAddIcon';
+
+test('buttonWithAddIcon', () => {
+  const onClick = jest.fn();
+  const label = 'Add Item';
+
+  const { rerender } = render(
+    <ButtonWithAddIcon label={label} onClick={() => onClick('click')} />
+  );
+
+  expect(screen.getByText('Add Item')).toBeInTheDocument();
+  fireEvent.click(screen.getByText('Add Item'));
+
+  expect(onClick).toHaveBeenCalledWith('click');
+
+  rerender(
+    <ButtonWithAddIcon
+      label={label}
+      onClick={() => onClick('click')}
+      disabled={true}
+    />
+  );
+  expect(screen.getByText('Add Item')).toBeDisabled();
+});
diff --git a/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.tsx b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.tsx
new file mode 100644
index 0000000000000..59681a53e1696
--- /dev/null
+++ b/web/packages/shared/components/ButtonWithAddIcon/ButtonWithAddIcon.tsx
@@ -0,0 +1,48 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ButtonText } from 'design';
+import { ButtonProps } from 'design/Button';
+import { Add as AddIcon } from 'design/Icon';
+import type { IconSize } from 'design/Icon/Icon';
+
+export const ButtonWithAddIcon = ({
+  Button = ButtonText,
+  label,
+  iconSize = 12,
+  compact = true,
+  pr = 2,
+  ...props
+}: ButtonProps<'button'> & {
+  Button?: React.ComponentType<ButtonProps<'button'>>;
+  label: string;
+  iconSize?: IconSize;
+}) => {
+  return (
+    <Button {...props} compact={compact} pr={pr}>
+      <AddIcon
+        className="icon-add"
+        size={iconSize}
+        css={`
+          margin-right: 3px;
+        `}
+      />
+      {label}
+    </Button>
+  );
+};
diff --git a/web/packages/shared/components/ButtonWithAddIcon/index.ts b/web/packages/shared/components/ButtonWithAddIcon/index.ts
new file mode 100644
index 0000000000000..0c87b5c7bf405
--- /dev/null
+++ b/web/packages/shared/components/ButtonWithAddIcon/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { ButtonWithAddIcon } from './ButtonWithAddIcon';
diff --git a/web/packages/shared/components/CanvasRenderer.tsx b/web/packages/shared/components/CanvasRenderer.tsx
index 1d9170ecfe50e..9d51a4d2b450e 100644
--- a/web/packages/shared/components/CanvasRenderer.tsx
+++ b/web/packages/shared/components/CanvasRenderer.tsx
@@ -99,7 +99,11 @@ export const CanvasRenderer = forwardRef<
   }, []);
 
   useEffect(() => {
-    if (!onResize) {
+    if (
+      !onResize ||
+      // Only send resize events when the canvas is visible (i.e. the connection is active).
+      props.hidden
+    ) {
       return;
     }
 
@@ -118,7 +122,7 @@ export const CanvasRenderer = forwardRef<
       debouncedOnResize.cancel();
       observer.disconnect();
     };
-  }, [onResize]);
+  }, [onResize, props.hidden]);
 
   // Wheel events must be registered on a ref because React's onWheel
   // uses a passive listener, so handlers are not able to call of e.preventDefault() on it.
diff --git a/web/packages/shared/components/Controls/MultiselectMenu.story.tsx b/web/packages/shared/components/Controls/MultiselectMenu.story.tsx
index 606feaa8f5c28..bca6a8e355a20 100644
--- a/web/packages/shared/components/Controls/MultiselectMenu.story.tsx
+++ b/web/packages/shared/components/Controls/MultiselectMenu.story.tsx
@@ -16,10 +16,10 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { action } from '@storybook/addon-actions';
-import { useArgs } from '@storybook/preview-api';
-import type { Meta, StoryFn, StoryObj } from '@storybook/react';
+import type { Meta, StoryFn, StoryObj } from '@storybook/react-vite';
 import type { ReactNode } from 'react';
+import { action } from 'storybook/actions';
+import { useArgs } from 'storybook/preview-api';
 
 import { Flex } from 'design';
 
@@ -59,6 +59,10 @@ export default {
       description: 'Buffer selections until "Apply" is clicked',
       table: { defaultValue: { summary: 'false' } },
     },
+    disabled: {
+      control: { type: 'boolean' },
+      table: { defaultValue: { summary: 'false' } },
+    },
     showIndicator: {
       control: { type: 'boolean' },
       description: 'Show indicator when there are selected options',
@@ -106,10 +110,11 @@ export default {
     showIndicator: true,
     showSelectControls: true,
     onChange: action('onChange'),
+    disabled: false,
   },
   render: (args => {
     const [{ selected }, updateArgs] =
-      useArgs<Meta<typeof MultiselectMenu<OptionValue>>['args']>();
+      useArgs<Meta<typeof MultiselectMenu<typeof options>>['args']>();
     const onChange = (value: OptionValue[]) => {
       updateArgs({ selected: value });
       args.onChange?.(value);
@@ -119,10 +124,10 @@ export default {
         <MultiselectMenu {...args} selected={selected} onChange={onChange} />
       </Flex>
     );
-  }) satisfies StoryFn<typeof MultiselectMenu<OptionValue>>,
-} satisfies Meta<typeof MultiselectMenu<OptionValue>>;
+  }) satisfies StoryFn<typeof MultiselectMenu<typeof options>>,
+} satisfies Meta<typeof MultiselectMenu<typeof options>>;
 
-type Story = StoryObj<typeof MultiselectMenu<OptionValue>>;
+type Story = StoryObj<typeof MultiselectMenu<typeof options>>;
 
 const Default: Story = { args: { options } };
 
@@ -142,4 +147,11 @@ const WithDisabledOption: Story = {
   },
 };
 
-export { Default, WithCustomLabels, WithDisabledOption };
+const WithDisabledMenu: Story = {
+  args: {
+    options,
+    disabled: true,
+  },
+};
+
+export { Default, WithCustomLabels, WithDisabledOption, WithDisabledMenu };
diff --git a/web/packages/shared/components/Controls/MultiselectMenu.tsx b/web/packages/shared/components/Controls/MultiselectMenu.tsx
index abf5042c193b4..2f516ddfaeafe 100644
--- a/web/packages/shared/components/Controls/MultiselectMenu.tsx
+++ b/web/packages/shared/components/Controls/MultiselectMenu.tsx
@@ -31,23 +31,38 @@ import { CheckboxInput } from 'design/Checkbox';
 import { ChevronDown } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
 
-type MultiselectMenuProps<T> = {
-  options: {
-    value: T;
-    label: string | ReactNode;
-    disabled?: boolean;
-    disabledTooltip?: string;
-  }[];
-  selected: T[];
-  onChange: (selected: T[]) => void;
+type Option<T> = {
+  value: T;
+  label: string | ReactNode;
+  disabled?: boolean;
+  disabledTooltip?: string;
+};
+
+type MultiselectMenuProps<T extends readonly Option<any>[]> = {
+  options: T;
+  selected: Extract<T[number], Option<any>>['value'][];
+  onChange: (selected: Extract<T[number], Option<any>>['value'][]) => void;
   label: string | ReactNode;
   tooltip: string;
+  /**
+   * If true, renders inner control buttons (eg: apply, cancel),
+   * and changes made to dropdown don't take affect until user
+   * explicitly clicks on these inner control buttons.
+   *
+   * If false, no inner control buttons are rendered and changes
+   * take affect immediately.
+   */
   buffered?: boolean;
   showIndicator?: boolean;
   showSelectControls?: boolean;
+  /**
+   * If true, disables the button that
+   * opens the dropdown menu.
+   */
+  disabled?: boolean;
 };
 
-export const MultiselectMenu = <T extends string>({
+export const MultiselectMenu = <T extends readonly Option<any>[]>({
   onChange,
   options,
   selected,
@@ -56,9 +71,12 @@ export const MultiselectMenu = <T extends string>({
   buffered = false,
   showIndicator = true,
   showSelectControls = true,
+  disabled = false,
 }: MultiselectMenuProps<T>) => {
+  type Value = Extract<T[number], Option<any>>['value'];
+
   // we have a separate state in the filter so we can select a few different things and then click "apply"
-  const [intSelected, setIntSelected] = useState<T[]>([]);
+  const [intSelected, setIntSelected] = useState<Value[]>([]);
   const [anchorEl, setAnchorEl] = useState<HTMLElement>(null);
   const handleOpen = (
     event: React.MouseEvent<HTMLButtonElement, MouseEvent>
@@ -77,7 +95,7 @@ export const MultiselectMenu = <T extends string>({
     handleClose();
   };
 
-  const handleSelect = (value: T) => {
+  const handleSelect = (value: Value) => {
     let newSelected = (buffered ? intSelected : selected).slice();
 
     if (newSelected.includes(value)) {
@@ -112,9 +130,14 @@ export const MultiselectMenu = <T extends string>({
           onClick={handleOpen}
           aria-haspopup="true"
           aria-expanded={!!anchorEl}
+          disabled={disabled}
         >
           {label} {selected?.length > 0 ? `(${selected?.length})` : ''}
-          <ChevronDown ml={2} size="small" color="text.slightlyMuted" />
+          <ChevronDown
+            ml={2}
+            size="small"
+            color={disabled ? 'text.disabled' : 'text.slightlyMuted'}
+          />
           {selected?.length > 0 && showIndicator && <FiltersExistIndicator />}
         </ButtonSecondary>
       </HoverTooltip>
@@ -231,7 +254,7 @@ const MultiselectMenuOptionsContainer = styled(Flex)<{
   z-index: 1;
 `;
 
-const FiltersExistIndicator = styled.div`
+export const FiltersExistIndicator = styled.div`
   position: absolute;
   top: -4px;
   right: -4px;
diff --git a/web/packages/shared/components/Controls/SortMenu.story.tsx b/web/packages/shared/components/Controls/SortMenu.story.tsx
index d5a77fc795972..879ebfd0fc51d 100644
--- a/web/packages/shared/components/Controls/SortMenu.story.tsx
+++ b/web/packages/shared/components/Controls/SortMenu.story.tsx
@@ -16,9 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { action } from '@storybook/addon-actions';
-import { useArgs } from '@storybook/preview-api';
-import type { Meta, StoryFn, StoryObj } from '@storybook/react';
+import type { Meta, StoryFn, StoryObj } from '@storybook/react-vite';
+import { action } from 'storybook/actions';
+import { useArgs } from 'storybook/preview-api';
 
 import { Flex } from 'design';
 
@@ -81,16 +81,16 @@ export default {
     })),
     onChange: action('onChange'),
   },
-  render: (args => {
-    const [{ current }, updateArgs] =
-      useArgs<Meta<typeof SortMenu<any>>['args']>();
-    const onChange = (value: typeof current) => {
+  render: (({ fields, current, onChange }) => {
+    const [, updateArgs] =
+      useArgs<NonNullable<Meta<typeof SortMenu<any>>['args']>>();
+    const handleChange: typeof onChange = value => {
       updateArgs({ current: value });
-      args.onChange?.(value);
+      onChange?.(value);
     };
     return (
       <Flex alignItems="center" minHeight="100px">
-        <SortMenu current={current} fields={args.fields} onChange={onChange} />
+        <SortMenu current={current} fields={fields} onChange={handleChange} />
       </Flex>
     );
   }) satisfies StoryFn<typeof SortMenu>,
diff --git a/web/packages/shared/components/Controls/SortMenu.tsx b/web/packages/shared/components/Controls/SortMenu.tsx
index d0f8fa4f55f5b..9d9d98aad8ba0 100644
--- a/web/packages/shared/components/Controls/SortMenu.tsx
+++ b/web/packages/shared/components/Controls/SortMenu.tsx
@@ -22,11 +22,16 @@ import { ButtonBorder, Flex, Menu, MenuItem } from 'design';
 import { ArrowDown, ArrowUp } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
 
-type SortMenuSort<T extends object> = {
+export type SortMenuSort<T extends object> = {
   fieldName: Exclude<keyof T, symbol | number>;
   dir: 'ASC' | 'DESC';
 };
 
+// TODO(nicholasmarais1158): Remove this component once fully migrated to
+// SortMenuV2
+/**
+ * @deprecated Use `SortMenu` from ./SortMenuV2.tsx instead
+ */
 export const SortMenu = <T extends object>({
   current,
   fields,
@@ -36,7 +41,7 @@ export const SortMenu = <T extends object>({
   fields: { value: SortMenuSort<T>['fieldName']; label: string }[];
   onChange: (value: SortMenuSort<T>) => void;
 }) => {
-  const [anchorEl, setAnchorEl] = useState<HTMLElement>(null);
+  const [anchorEl, setAnchorEl] = useState<HTMLElement | null>(null);
 
   const handleOpen = (event: React.MouseEvent<HTMLButtonElement, MouseEvent>) =>
     setAnchorEl(event.currentTarget);
@@ -100,6 +105,7 @@ export const SortMenu = <T extends object>({
               dir: current.dir === 'ASC' ? 'DESC' : 'ASC',
             })
           }
+          aria-label="Sort direction"
           textTransform="none"
           css={`
             border-top-left-radius: 0;
diff --git a/web/packages/shared/components/Controls/SortMenuV2.story.tsx b/web/packages/shared/components/Controls/SortMenuV2.story.tsx
new file mode 100644
index 0000000000000..721f78397bc5f
--- /dev/null
+++ b/web/packages/shared/components/Controls/SortMenuV2.story.tsx
@@ -0,0 +1,89 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryFn, StoryObj } from '@storybook/react-vite';
+import { action } from 'storybook/internal/actions';
+import { useArgs } from 'storybook/internal/preview-api';
+
+import Flex from 'design/Flex/Flex';
+
+import { SortMenu, SortOrder } from './SortMenuV2';
+
+export default {
+  title: 'Shared/Controls/SortMenuV2',
+  component: SortMenu,
+  argTypes: {},
+  args: {
+    items: [
+      {
+        key: 'name',
+        label: 'Name',
+        ascendingLabel: 'Name, A - Z',
+        descendingLabel: 'Name, Z - A',
+        ascendingOptionLabel: 'Alphabetical, A - Z',
+        descendingOptionLabel: 'Alphabetical, Z - A',
+      },
+      {
+        key: 'created',
+        label: 'Created',
+        ascendingLabel: 'Oldest',
+        descendingLabel: 'Newest',
+        ascendingOptionLabel: 'Oldest',
+        descendingOptionLabel: 'Newest',
+        defaultOrder: 'DESC',
+      },
+      {
+        key: 'status',
+        label: 'Status',
+        ascendingOptionLabel: 'Alphabetical, A - Z',
+        descendingOptionLabel: 'Alphabetical, Z - A',
+      },
+      {
+        key: 'relevance',
+        label: 'Relevance',
+        disableSort: true,
+        defaultOrder: 'DESC',
+      },
+    ],
+    selectedKey: 'name',
+    selectedOrder: 'ASC',
+    onChange: action('onChange'),
+  },
+  render: (args => {
+    const [, updateArgs] =
+      useArgs<NonNullable<Meta<typeof SortMenu>['args']>>();
+    const onChange = (key: string, order: SortOrder) => {
+      updateArgs({ selectedKey: key, selectedOrder: order });
+      args.onChange?.(key, order);
+    };
+    return (
+      <Flex flexDirection="column" alignItems="flex-end" minWidth="100%">
+        <SortMenu
+          items={args.items}
+          selectedKey={args.selectedKey}
+          selectedOrder={args.selectedOrder}
+          onChange={onChange}
+        />
+      </Flex>
+    );
+  }) satisfies StoryFn<typeof SortMenu>,
+} satisfies Meta<typeof SortMenu>;
+
+const Default: StoryObj<typeof SortMenu> = { args: {} };
+
+export { Default as SortMenuV2 };
diff --git a/web/packages/shared/components/Controls/SortMenuV2.test.tsx b/web/packages/shared/components/Controls/SortMenuV2.test.tsx
new file mode 100644
index 0000000000000..03a3bbb9179c9
--- /dev/null
+++ b/web/packages/shared/components/Controls/SortMenuV2.test.tsx
@@ -0,0 +1,262 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { UserEvent } from '@testing-library/user-event';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import { render, screen, userEvent, within } from 'design/utils/testing';
+
+import { SortMenu } from './SortMenuV2';
+
+describe('SortMenu', () => {
+  it('shows the selected item in the button', async () => {
+    renderComponent();
+    expect(screen.getByText('Name')).toBeInTheDocument();
+  });
+
+  describe('shows the selected item sort-specific in the button', () => {
+    it('ascending', async () => {
+      renderComponent({
+        props: {
+          items: [
+            {
+              key: 'test',
+              label: 'Test',
+              ascendingLabel: 'Test ASC',
+            },
+          ],
+          selectedKey: 'test',
+          selectedOrder: 'ASC',
+        },
+      });
+      expect(screen.getByText('Test ASC')).toBeInTheDocument();
+    });
+
+    it('descending', async () => {
+      renderComponent({
+        props: {
+          items: [
+            {
+              key: 'test',
+              label: 'Test',
+              descendingLabel: 'Test DESC',
+            },
+          ],
+          selectedKey: 'test',
+          selectedOrder: 'DESC',
+        },
+      });
+      expect(screen.getByText('Test DESC')).toBeInTheDocument();
+    });
+  });
+
+  it('shows the selected order in the button', async () => {
+    renderComponent();
+    expect(screen.getByTestId('sort-asc-icon')).toBeInTheDocument();
+  });
+
+  it('shows the options menu', async () => {
+    const { user } = renderComponent();
+    await openMenu(user);
+    expect(screen.getByRole('menu')).toBeInTheDocument();
+  });
+
+  it('shows the options menu items', async () => {
+    const { user } = renderComponent();
+    await openMenu(user);
+    const menu = screen.getByRole('menu');
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Name' })
+    ).toBeInTheDocument();
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Created' })
+    ).toBeInTheDocument();
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Relevance' })
+    ).toBeInTheDocument();
+  });
+
+  it('shows the options menu order options', async () => {
+    const { user } = renderComponent();
+    await openMenu(user);
+    const menu = screen.getByRole('menu');
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Ascending' })
+    ).toBeInTheDocument();
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Descending' })
+    ).toBeInTheDocument();
+  });
+
+  it('shows the options menu order options with custom labels', async () => {
+    const { user } = renderComponent({
+      props: {
+        items: [
+          {
+            key: 'test',
+            label: 'Test',
+            ascendingOptionLabel: 'Test ASC',
+            descendingOptionLabel: 'Test DESC',
+          },
+        ],
+        selectedKey: 'test',
+        selectedOrder: 'DESC',
+      },
+    });
+    await openMenu(user, 'Test');
+    const menu = screen.getByRole('menu');
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Test ASC' })
+    ).toBeInTheDocument();
+    expect(
+      within(menu).getByRole('menuitem', { name: 'Test DESC' })
+    ).toBeInTheDocument();
+  });
+
+  it('shows disabled options menu order options', async () => {
+    const { user, onChange } = renderComponent({
+      props: {
+        items: [
+          {
+            key: 'test',
+            label: 'Test',
+            disableSort: true,
+          },
+        ],
+        selectedKey: 'test',
+        selectedOrder: 'DESC',
+      },
+    });
+    await openMenu(user, 'Test');
+    const menu = screen.getByRole('menu');
+    const asc = within(menu).getByRole('menuitem', { name: 'Ascending' });
+    const desc = within(menu).getByRole('menuitem', { name: 'Descending' });
+    expect(asc).toBeInTheDocument();
+    expect(desc).toBeInTheDocument();
+    await user.click(asc);
+    await user.click(desc);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it('allows an item to be selected', async () => {
+    const { user, onChange } = renderComponent();
+    await openMenu(user);
+    const menu = screen.getByRole('menu');
+    const name = within(menu).getByRole('menuitem', { name: 'Created' });
+    expect(name).toBeInTheDocument();
+    await user.click(name);
+    expect(onChange).toHaveBeenCalledTimes(1);
+    expect(onChange).toHaveBeenLastCalledWith('created', 'ASC');
+  });
+
+  it('allows an order to be selected', async () => {
+    const { user, onChange } = renderComponent();
+    await openMenu(user);
+    const menu = screen.getByRole('menu');
+    const name = within(menu).getByRole('menuitem', { name: 'Descending' });
+    expect(name).toBeInTheDocument();
+    await user.click(name);
+    expect(onChange).toHaveBeenCalledTimes(1);
+    expect(onChange).toHaveBeenLastCalledWith('name', 'DESC');
+  });
+
+  it('applies a default sort order when an item is selected', async () => {
+    const { user, onChange } = renderComponent({
+      props: {
+        items: [
+          {
+            key: 'test-1',
+            label: 'Test 1',
+          },
+          {
+            key: 'test-2',
+            label: 'Test 2',
+            defaultOrder: 'DESC',
+          },
+        ],
+        selectedKey: 'test-1',
+        selectedOrder: 'ASC',
+      },
+    });
+    await openMenu(user, 'Test 1');
+    const menu = screen.getByRole('menu');
+    const name = within(menu).getByRole('menuitem', { name: 'Test 2' });
+    expect(name).toBeInTheDocument();
+    await user.click(name);
+    expect(onChange).toHaveBeenCalledTimes(1);
+    expect(onChange).toHaveBeenLastCalledWith('test-2', 'DESC');
+  });
+});
+
+async function openMenu(user: UserEvent, label = 'Name') {
+  await user.click(screen.getByText(label));
+}
+
+const renderComponent = (options?: {
+  props: Partial<ComponentProps<typeof SortMenu>>;
+}) => {
+  const { props } = options ?? {};
+  const {
+    items = [
+      {
+        key: 'name',
+        label: 'Name',
+      },
+      {
+        key: 'created',
+        label: 'Created',
+      },
+      {
+        key: 'relevance',
+        label: 'Relevance',
+      },
+    ],
+    onChange = jest.fn(),
+    selectedKey = 'name',
+    selectedOrder = 'ASC',
+  } = props ?? {};
+
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <SortMenu
+        items={items}
+        onChange={onChange}
+        selectedKey={selectedKey}
+        selectedOrder={selectedOrder}
+      />,
+      {
+        wrapper: makeWrapper(),
+      }
+    ),
+    onChange,
+    user,
+  };
+};
+
+function makeWrapper() {
+  return (props: PropsWithChildren) => {
+    return (
+      <ConfiguredThemeProvider theme={darkTheme}>
+        {props.children}
+      </ConfiguredThemeProvider>
+    );
+  };
+}
diff --git a/web/packages/shared/components/Controls/SortMenuV2.tsx b/web/packages/shared/components/Controls/SortMenuV2.tsx
new file mode 100644
index 0000000000000..1d15ec700523a
--- /dev/null
+++ b/web/packages/shared/components/Controls/SortMenuV2.tsx
@@ -0,0 +1,212 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import styled, { useTheme } from 'styled-components';
+
+import { ButtonBorder } from 'design/Button/Button';
+import { CheckThick } from 'design/Icon/Icons/CheckThick';
+import { ChevronDown } from 'design/Icon/Icons/ChevronDown';
+import { SortAscending } from 'design/Icon/Icons/SortAscending';
+import { SortDescending } from 'design/Icon/Icons/SortDescending';
+import Menu from 'design/Menu/Menu';
+import MenuItem from 'design/Menu/MenuItem';
+import Text from 'design/Text/Text';
+
+export type SortOrder = 'ASC' | 'DESC';
+
+export type SortItem = {
+  /** A unique key for the item */
+  key: string;
+  /** The label that appears for the item in the options menu, as well as the sort button when selected */
+  label: string;
+  /** An optional override for the label used in the sort button when this item is selected and the selected order is ascending  */
+  ascendingLabel?: string;
+  /** An optional override for the label used in the sort button when this item is selected and the selected order is descending  */
+  descendingLabel?: string;
+  /** An optional label for the ascending label used in the options menu */
+  ascendingOptionLabel?: string;
+  /** An optional label for the descending label used in the options menu */
+  descendingOptionLabel?: string;
+  /** An optional default sort order used when the item is initially selected */
+  defaultOrder?: SortOrder;
+  /** Disable the sort options when this item is selected. The default sort order is still honored when the item is selected. */
+  disableSort?: boolean;
+};
+
+export function SortMenu(props: {
+  /** Items for the "sort by" section of the options menu */
+  items: SortItem[];
+  /** The key of the currently selected item. */
+  selectedKey: string;
+  /** The order currently selected. */
+  selectedOrder: SortOrder;
+  /** Function to use as a callback when the sort item or order changes */
+  onChange: (key: string, order: SortOrder) => void;
+}) {
+  const { items, selectedKey, selectedOrder, onChange } = props;
+
+  const [anchorEl, setAnchorEl] = useState<HTMLElement | null>(null);
+
+  const theme = useTheme();
+
+  const {
+    key,
+    label = key ?? 'No label',
+    ascendingLabel,
+    descendingLabel,
+    ascendingOptionLabel = 'Ascending',
+    descendingOptionLabel = 'Descending',
+    disableSort = false,
+  } = items.find(f => f.key === selectedKey) ?? {};
+
+  const handleOpen = (event: React.MouseEvent<HTMLButtonElement, MouseEvent>) =>
+    setAnchorEl(event.currentTarget);
+
+  const handleClose = () => setAnchorEl(null);
+
+  const handleItemSelected = (key: string) => {
+    handleClose();
+    onChange(
+      key,
+      items.find(f => f.key === key)?.defaultOrder ?? selectedOrder ?? 'ASC'
+    );
+  };
+
+  const handleOrderSelected = (order: 'ASC' | 'DESC') => {
+    if (disableSort) {
+      return;
+    }
+
+    handleClose();
+    onChange(selectedKey, order);
+  };
+
+  return (
+    <>
+      <StyledButtonBorder
+        textTransform="none"
+        size="small"
+        px={2}
+        onClick={handleOpen}
+        aria-label="Sort by"
+        aria-haspopup="true"
+        aria-expanded={!!anchorEl}
+      >
+        {selectedOrder === 'ASC' ? (
+          <SortDescending
+            size={'small'}
+            color={theme.colors.text.muted}
+            data-testid="sort-asc-icon"
+          />
+        ) : (
+          <SortAscending
+            size={'small'}
+            color={theme.colors.text.muted}
+            data-testid="sort-desc-icon"
+          />
+        )}
+
+        {selectedOrder === 'ASC'
+          ? (ascendingLabel ?? label)
+          : (descendingLabel ?? label)}
+
+        <ChevronDown size={'small'} />
+      </StyledButtonBorder>
+      <Menu
+        anchorEl={anchorEl}
+        open={Boolean(anchorEl)}
+        onClose={handleClose}
+        transformOrigin={{
+          vertical: 'top',
+          horizontal: 'right',
+        }}
+        anchorOrigin={{
+          vertical: 'bottom',
+          horizontal: 'right',
+        }}
+        popoverCss={() => `margin-top: ${theme.space[5]}px; margin-left: 0;`}
+        menuListCss={() => `padding-bottom: 8px;`}
+      >
+        <MenuTitle>Sort by</MenuTitle>
+        {items.map(({ key, label: optionLabel }) => (
+          <StyledMenuItem key={key} onClick={() => handleItemSelected(key)}>
+            <Tick
+              size={'small'}
+              checked={selectedKey == key}
+              color={theme.colors.text.muted}
+            />
+            {optionLabel}
+          </StyledMenuItem>
+        ))}
+        <MenuTitle>Order</MenuTitle>
+        <StyledMenuItem
+          onClick={() => handleOrderSelected('ASC')}
+          disabled={disableSort}
+        >
+          <Tick
+            size={'small'}
+            checked={selectedOrder == 'ASC'}
+            color={theme.colors.text.muted}
+          />
+          <SortDescending size={'small'} color={theme.colors.text.muted} />
+          {ascendingOptionLabel}
+        </StyledMenuItem>
+        <StyledMenuItem
+          onClick={() => handleOrderSelected('DESC')}
+          disabled={disableSort}
+        >
+          <Tick
+            size={'small'}
+            checked={selectedOrder == 'DESC'}
+            color={theme.colors.text.muted}
+          />
+          <SortAscending size={'small'} color={theme.colors.text.muted} />
+          {descendingOptionLabel}
+        </StyledMenuItem>
+      </Menu>
+    </>
+  );
+}
+
+const StyledButtonBorder = styled(ButtonBorder)`
+  border-color: ${props => props.theme.colors.interactive.tonal.neutral[2]};
+  gap: ${({ theme }) => theme.space[2]}px;
+`;
+
+const Tick = styled(CheckThick)<{ checked: boolean }>`
+  opacity: ${({ checked }) => (checked ? 1 : 0)};
+`;
+
+const MenuTitle = styled(Text)`
+  height: ${({ theme }) => theme.space[4]}px;
+  padding: 0 ${({ theme }) => theme.space[3]}px;
+  padding-top: ${({ theme }) => theme.space[2]}px;
+  font-size: ${({ theme }) => theme.fontSizes[1]}px;
+  font-weight: ${({ theme }) => theme.fontWeights.bold};
+  color: ${({ theme }) => theme.colors.text.muted};
+`;
+
+const StyledMenuItem = styled(MenuItem)`
+  min-height: 0;
+  gap: ${({ theme }) => theme.space[2]}px;
+  font-size: ${({ theme }) => theme.fontSizes[2]}px;
+  height: ${({ theme }) => theme.space[5]}px;
+  padding-left: ${({ theme }) => theme.space[3]}px;
+  padding-right: ${({ theme }) => theme.space[4]}px;
+`;
diff --git a/web/packages/shared/components/Controls/ViewModeSwitch.story.tsx b/web/packages/shared/components/Controls/ViewModeSwitch.story.tsx
index 063ef84325419..bdd3cd124e5e1 100644
--- a/web/packages/shared/components/Controls/ViewModeSwitch.story.tsx
+++ b/web/packages/shared/components/Controls/ViewModeSwitch.story.tsx
@@ -16,9 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { action } from '@storybook/addon-actions';
-import { useArgs } from '@storybook/preview-api';
-import type { Meta, StoryFn, StoryObj } from '@storybook/react';
+import type { Meta, StoryFn, StoryObj } from '@storybook/react-vite';
+import { action } from 'storybook/actions';
+import { useArgs } from 'storybook/preview-api';
 
 import { Flex } from 'design';
 import { ViewMode } from 'gen-proto-ts/teleport/userpreferences/v1/unified_resource_preferences_pb';
diff --git a/web/packages/shared/components/Controls/ViewModeSwitch.tsx b/web/packages/shared/components/Controls/ViewModeSwitch.tsx
index 6c7907508e4b6..ed100e6f7a521 100644
--- a/web/packages/shared/components/Controls/ViewModeSwitch.tsx
+++ b/web/packages/shared/components/Controls/ViewModeSwitch.tsx
@@ -63,7 +63,7 @@ export const ViewModeSwitch = ({
   );
 };
 
-const ViewModeSwitchContainer = styled.div`
+export const ViewModeSwitchContainer = styled.div`
   height: 22px;
   border: ${p => p.theme.borders[1]} ${p => p.theme.colors.spotBackground[2]};
   border-radius: ${p => p.theme.radii[2]}px;
@@ -79,7 +79,10 @@ const ViewModeSwitchContainer = styled.div`
   }
 `;
 
-const ViewModeSwitchButton = styled.button<{ first?: boolean; last?: boolean }>`
+export const ViewModeSwitchButton = styled.button<{
+  first?: boolean;
+  last?: boolean;
+}>`
   height: 100%;
   width: 100%;
   overflow: hidden;
diff --git a/web/packages/shared/components/CopyButton/CopyButton.story.tsx b/web/packages/shared/components/CopyButton/CopyButton.story.tsx
new file mode 100644
index 0000000000000..ee16e318351dc
--- /dev/null
+++ b/web/packages/shared/components/CopyButton/CopyButton.story.tsx
@@ -0,0 +1,35 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import Input from 'design/Input';
+
+import { CopyButton as CopyButtonComponent } from './CopyButton';
+
+export default {
+  title: 'Shared',
+  component: CopyButtonComponent,
+};
+
+export const CopyButton = () => (
+  <div>
+    <CopyButtonComponent value="Surprise!" />
+    Paste here to test: <Input />
+  </div>
+);
+
+CopyButton.storyName = 'CopyButton';
diff --git a/web/packages/shared/components/UnifiedResources/shared/CopyButton.test.tsx b/web/packages/shared/components/CopyButton/CopyButton.test.tsx
similarity index 97%
rename from web/packages/shared/components/UnifiedResources/shared/CopyButton.test.tsx
rename to web/packages/shared/components/CopyButton/CopyButton.test.tsx
index f02789bf9cb38..b4c307ec05aeb 100644
--- a/web/packages/shared/components/UnifiedResources/shared/CopyButton.test.tsx
+++ b/web/packages/shared/components/CopyButton/CopyButton.test.tsx
@@ -34,7 +34,7 @@ describe('CopyButton', () => {
 
     render(
       <div onClick={parentClick}>
-        <CopyButton name="copy data" />
+        <CopyButton value="copy data" />
       </div>
     );
 
diff --git a/web/packages/shared/components/UnifiedResources/shared/CopyButton.tsx b/web/packages/shared/components/CopyButton/CopyButton.tsx
similarity index 92%
rename from web/packages/shared/components/UnifiedResources/shared/CopyButton.tsx
rename to web/packages/shared/components/CopyButton/CopyButton.tsx
index d84e42e73aa5d..4855034e8416f 100644
--- a/web/packages/shared/components/UnifiedResources/shared/CopyButton.tsx
+++ b/web/packages/shared/components/CopyButton/CopyButton.tsx
@@ -24,12 +24,15 @@ import { Check, Copy } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
 import { copyToClipboard } from 'design/utils/copyToClipboard';
 
+/**
+ * Renders a button that copies the provided value to clipboard when clicked.
+ */
 export function CopyButton({
-  name,
+  value,
   mr,
   ml,
 }: {
-  name: string;
+  value: string;
   mr?: number;
   ml?: number;
 }) {
@@ -48,10 +51,11 @@ export function CopyButton({
 
   const handleCopy: MouseEventHandler<unknown> = e => {
     e.stopPropagation(); // Prevent parent onClick callbacks from stealing the click
+    e.preventDefault(); // Also prevent clicking links
 
     clearCurrentTimeout();
     setCopiedText(copySuccess);
-    copyToClipboard(name);
+    copyToClipboard(value);
     // Change to default text after 1 second
     timeout.current = setTimeout(() => {
       setCopiedText(copyDefault);
diff --git a/web/packages/shared/components/DemoTerminal/DemoTerminal.story.tsx b/web/packages/shared/components/DemoTerminal/DemoTerminal.story.tsx
index e2f07bf9f4296..0dc4fc0a65360 100644
--- a/web/packages/shared/components/DemoTerminal/DemoTerminal.story.tsx
+++ b/web/packages/shared/components/DemoTerminal/DemoTerminal.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-vite';
 
 import { DemoTerminal as Component } from './DemoTerminal';
 
diff --git a/web/packages/shared/components/DesktopSession/ActionMenu.tsx b/web/packages/shared/components/DesktopSession/ActionMenu.tsx
index 9e8e1a7ae469d..0f4596095f0d8 100644
--- a/web/packages/shared/components/DesktopSession/ActionMenu.tsx
+++ b/web/packages/shared/components/DesktopSession/ActionMenu.tsx
@@ -16,7 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Flex } from 'design';
 import * as Icons from 'design/Icon';
 import { MenuIcon, MenuItem, MenuItemIcon } from 'shared/components/MenuAction';
 
@@ -25,32 +24,30 @@ export default function ActionMenu(props: Props) {
     props;
 
   return (
-    <Flex alignItems="center">
-      <MenuIcon
-        buttonIconProps={{
-          ml: 4,
-          size: 0,
-          color: 'text.slightlyMuted',
-          style: { fontSize: '20px' },
-        }}
-        menuProps={menuProps}
-      >
-        {showShareDirectory && (
-          <MenuItem onClick={onShareDirectory}>
-            <MenuItemIcon as={Icons.FolderPlus} mr="2" />
-            Share Directory
-          </MenuItem>
-        )}
-        <MenuItem onClick={onCtrlAltDel}>
-          <MenuItemIcon as={Icons.Keyboard} mr="2" />
-          Send Ctrl+Alt+Del
+    <MenuIcon
+      buttonIconProps={{
+        size: 0,
+        color: 'text.slightlyMuted',
+        style: { fontSize: '20px' },
+        title: 'More actions',
+      }}
+      menuProps={menuProps}
+    >
+      {showShareDirectory && (
+        <MenuItem onClick={onShareDirectory}>
+          <MenuItemIcon as={Icons.FolderPlus} mr="2" />
+          Share Directory
         </MenuItem>
-        <MenuItem onClick={onDisconnect}>
-          <MenuItemIcon as={Icons.PowerSwitch} mr="2" />
-          Disconnect
-        </MenuItem>
-      </MenuIcon>
-    </Flex>
+      )}
+      <MenuItem onClick={onCtrlAltDel}>
+        <MenuItemIcon as={Icons.Keyboard} mr="2" />
+        Send Ctrl+Alt+Del
+      </MenuItem>
+      <MenuItem onClick={onDisconnect}>
+        <MenuItemIcon as={Icons.PowerSwitch} mr="2" />
+        Disconnect
+      </MenuItem>
+    </MenuIcon>
   );
 }
 
diff --git a/web/packages/shared/components/DesktopSession/AlertDropdown.tsx b/web/packages/shared/components/DesktopSession/AlertDropdown.tsx
index 4664ab92d4141..4c12896dd08d1 100644
--- a/web/packages/shared/components/DesktopSession/AlertDropdown.tsx
+++ b/web/packages/shared/components/DesktopSession/AlertDropdown.tsx
@@ -22,9 +22,9 @@ import styled, { useTheme } from 'styled-components';
 import { Button, ButtonIcon, Card, Flex, H3 } from 'design';
 import { Cross, Warning } from 'design/Icon';
 import {
-  Notification,
-  type NotificationItem,
-} from 'shared/components/Notification';
+  ToastNotification,
+  type ToastNotificationItem,
+} from 'shared/components/ToastNotification';
 import { useClickOutside } from 'shared/hooks/useClickOutside';
 
 export function AlertDropdown({ alerts, onRemoveAlert }: Props) {
@@ -126,7 +126,7 @@ const StyledCard = styled(Card)`
   background-color: ${({ theme }) => theme.colors.levels.elevated};
 `;
 
-const StyledNotification = styled(Notification)`
+const StyledNotification = styled(ToastNotification)`
   background: ${({ theme }) => theme.colors.spotBackground[0]};
   ${({ theme }) =>
     theme.type === 'light' && `border: 1px solid ${theme.colors.text.muted};`}
@@ -139,6 +139,6 @@ const StyledOverflow = styled(Flex)`
 `;
 
 type Props = {
-  alerts: NotificationItem[];
+  alerts: ToastNotificationItem[];
   onRemoveAlert: (id: string) => void;
 };
diff --git a/web/packages/shared/components/DesktopSession/DesktopSession.story.tsx b/web/packages/shared/components/DesktopSession/DesktopSession.story.tsx
index 356ea21a2dd12..3899dd0bea568 100644
--- a/web/packages/shared/components/DesktopSession/DesktopSession.story.tsx
+++ b/web/packages/shared/components/DesktopSession/DesktopSession.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import DialogConfirmation from 'design/DialogConfirmation';
 import {
@@ -26,8 +26,8 @@ import {
 } from 'shared/hooks/useAsync';
 import {
   BitmapFrame,
-  BrowserFileSystem,
   ClientScreenSpec,
+  selectDirectoryInBrowser,
   TdpClient,
   TdpClientEvent,
 } from 'shared/libs/tdp';
@@ -55,7 +55,7 @@ const meta: Meta = {
 export default meta;
 
 const fakeClient = () => {
-  const client = new TdpClient(() => null, new BrowserFileSystem());
+  const client = new TdpClient(() => null, selectDirectoryInBrowser);
   // Don't try to connect to a websocket.
   client.connect = async options => {
     emitFrame(client, options.screenSpec);
@@ -71,6 +71,7 @@ const props: DesktopSessionProps = {
   client: fakeClient(),
   username: 'user',
   desktop: 'windows-11',
+  browserSupportsSharing: true,
   hasAnotherSession: () => Promise.resolve(false),
 };
 
diff --git a/web/packages/shared/components/DesktopSession/DesktopSession.test.tsx b/web/packages/shared/components/DesktopSession/DesktopSession.test.tsx
index cf079f8c4fbd3..4b1f07603a59d 100644
--- a/web/packages/shared/components/DesktopSession/DesktopSession.test.tsx
+++ b/web/packages/shared/components/DesktopSession/DesktopSession.test.tsx
@@ -19,11 +19,16 @@
 import { EventEmitter } from 'events';
 
 import { screen } from '@testing-library/react';
+import { act } from 'react';
 
 import { render } from 'design/utils/testing';
 import { makeSuccessAttempt } from 'shared/hooks/useAsync';
-import { BrowserFileSystem, TdpClient } from 'shared/libs/tdp';
-import { wait } from 'shared/utils/wait';
+import {
+  MessageType,
+  selectDirectoryInBrowser,
+  SharedDirectoryAccess,
+  TdpClient,
+} from 'shared/libs/tdp';
 
 import { DesktopSession } from './DesktopSession';
 
@@ -36,6 +41,19 @@ import { TdpTransport } from 'shared/libs/tdp/client';
 // Disable WASM in tests.
 jest.mock('shared/libs/ironrdp/pkg/ironrdp');
 
+// Matches codec.decodePngFrame.
+function encodePngFrame(): ArrayBuffer {
+  const buffer = new ArrayBuffer(21);
+  const view = new DataView(buffer);
+  view.setUint8(0, MessageType.PNG_FRAME);
+  view.setUint32(1, 0);
+  view.setUint32(5, 0);
+  view.setUint32(9, 0);
+  view.setUint32(13, 0);
+  view.setUint32(17, 0);
+  return buffer;
+}
+
 const hasNoOtherSession = jest.fn().mockResolvedValue(false);
 const aclAttempt = makeSuccessAttempt({
   clipboardSharingEnabled: true,
@@ -46,9 +64,9 @@ const getMockTransport = () => {
   return {
     emitTransportError: () =>
       emitter.emit('error', new Error('Could not send bytes')),
+    emitPngFrameMessage: () => emitter.emit('message', encodePngFrame()),
     getTransport: async (abortSignal: AbortSignal): Promise<TdpTransport> => {
-      abortSignal.onabort = async () => {
-        await wait(50);
+      abortSignal.onabort = () => {
         emitter.emit('complete');
       };
       return {
@@ -70,11 +88,26 @@ const getMockTransport = () => {
   };
 };
 
+let originalQuery: typeof navigator.permissions.query;
+
+beforeEach(() => {
+  originalQuery = navigator.permissions.query;
+
+  navigator.permissions.query = jest.fn().mockResolvedValue({
+    state: 'granted',
+    onchange: null,
+  });
+});
+
+afterEach(() => {
+  navigator.permissions.query = originalQuery;
+});
+
 test('reconnect button reinitializes the connection', async () => {
   const transport = getMockTransport();
   const tpdClient = new TdpClient(
     transport.getTransport,
-    new BrowserFileSystem()
+    selectDirectoryInBrowser
   );
   jest.spyOn(tpdClient, 'connect');
   jest.spyOn(tpdClient, 'shutdown');
@@ -85,6 +118,7 @@ test('reconnect button reinitializes the connection', async () => {
       desktop="win-lab"
       aclAttempt={aclAttempt}
       hasAnotherSession={hasNoOtherSession}
+      browserSupportsSharing
     />
   );
 
@@ -114,3 +148,100 @@ test('reconnect button reinitializes the connection', async () => {
   // Called 2 times: the first one during reconnecting, the second one after unmounting.
   expect(tpdClient.shutdown).toHaveBeenCalledTimes(2);
 });
+
+test('ensure sharing remains enabled if the initial desktop connection attempt fails', async () => {
+  const transport = getMockTransport();
+  const tpdClient = new TdpClient(
+    transport.getTransport,
+    selectDirectoryInBrowser
+  );
+  render(
+    <DesktopSession
+      client={tpdClient}
+      username="admin"
+      desktop="win-lab"
+      aclAttempt={aclAttempt}
+      hasAnotherSession={hasNoOtherSession}
+      browserSupportsSharing
+    />
+  );
+
+  // The session is initializing.
+  expect(await screen.findByTestId('indicator')).toBeInTheDocument();
+
+  // An error occurred, the connection has been closed.
+  transport.emitTransportError();
+
+  expect(
+    await screen.findByText('The desktop session is offline.')
+  ).toBeInTheDocument();
+  const reconnect = await screen.findByRole('button', { name: 'Reconnect' });
+
+  await userEvent.click(reconnect);
+  // This time the connection succeeded.
+  await act(() => transport.emitPngFrameMessage());
+
+  expect(await screen.findByTitle('More actions')).toBeVisible();
+  await userEvent.click(screen.getByTitle('More actions'));
+  expect(await screen.findByText('Share Directory')).toBeVisible();
+});
+
+test('re-sharing directory is possible after a reconnect', async () => {
+  const transport = getMockTransport();
+  const mockFsSpy = jest.fn(async () => mockDirectoryAccess());
+  const tpdClient = new TdpClient(transport.getTransport, mockFsSpy);
+  render(
+    <DesktopSession
+      client={tpdClient}
+      username="admin"
+      desktop="win-lab"
+      aclAttempt={aclAttempt}
+      hasAnotherSession={hasNoOtherSession}
+      browserSupportsSharing
+    />
+  );
+
+  // The session is initializing.
+  expect(await screen.findByTestId('indicator')).toBeInTheDocument();
+
+  // Successfully initialize the connection.
+  await act(() => transport.emitPngFrameMessage());
+
+  // Share a directory.
+  await testSharingDirectory();
+
+  // An error occurred, the connection has been closed.
+  transport.emitTransportError();
+  expect(
+    await screen.findByText('The desktop session is offline.')
+  ).toBeInTheDocument();
+
+  // Reconnect.
+  const reconnect = await screen.findByRole('button', { name: 'Reconnect' });
+  await userEvent.click(reconnect);
+  await act(() => transport.emitPngFrameMessage());
+
+  // Share the directory again.
+  await testSharingDirectory();
+  expect(mockFsSpy).toHaveBeenCalledTimes(2);
+});
+
+async function testSharingDirectory() {
+  expect(await screen.findByTitle('More actions')).toBeVisible();
+  await userEvent.click(screen.getByTitle('More actions'));
+  await userEvent.click(await screen.findByText('Share Directory'));
+  expect(await screen.findByTitle('Alerts')).toHaveTextContent('0');
+}
+
+function mockDirectoryAccess(): SharedDirectoryAccess {
+  return {
+    getDirectoryName: () => '',
+    create: () => undefined,
+    read: () => undefined,
+    stat: () => undefined,
+    delete: () => undefined,
+    readDir: () => undefined,
+    truncate: () => undefined,
+    write: () => undefined,
+  };
+}
diff --git a/web/packages/shared/components/DesktopSession/DesktopSession.tsx b/web/packages/shared/components/DesktopSession/DesktopSession.tsx
index 0481cb7cc1797..903061b7151e3 100644
--- a/web/packages/shared/components/DesktopSession/DesktopSession.tsx
+++ b/web/packages/shared/components/DesktopSession/DesktopSession.tsx
@@ -49,12 +49,10 @@ import {
 } from 'shared/libs/tdp';
 import { TdpError } from 'shared/libs/tdp/client';
 
-import { KeyboardHandler } from './KeyboardHandler';
+import { InputHandler } from './InputHandler';
 import TopBar from './TopBar';
 import useDesktopSession, {
   clipboardSharingMessage,
-  defaultClipboardSharingState,
-  defaultDirectorySharingState,
   directorySharingPossible,
   isSharingClipboard,
   isSharingDirectory,
@@ -70,6 +68,8 @@ export interface DesktopSessionProps {
     clipboardSharingEnabled: boolean;
     directorySharingEnabled: boolean;
   }>;
+  /** Determines if the browser client support directory and clipboard sharing. */
+  browserSupportsSharing: boolean;
   /**
    * Injects a custom component that overrides other connection states.
    * Useful for per-session MFA, which differs between Web UI and Connect.
@@ -92,26 +92,26 @@ export function DesktopSession({
   hasAnotherSession,
   customConnectionState,
   keyboardLayout = 0,
+  browserSupportsSharing,
 }: DesktopSessionProps) {
   const {
     directorySharingState,
-    setDirectorySharingState,
     onClipboardData,
     sendLocalClipboardToRemote,
     clipboardSharingState,
-    setClipboardSharingState,
+    clearSharing,
     onShareDirectory,
     alerts,
     onRemoveAlert,
     addAlert,
-  } = useDesktopSession(client, aclAttempt);
+  } = useDesktopSession(client, aclAttempt, browserSupportsSharing);
 
   const [tdpConnectionStatus, setTdpConnectionStatus] =
     useState<TdpConnectionStatus>({ status: '' });
 
-  const keyboardHandler = useRef(new KeyboardHandler());
+  const inputHandler = useRef(new InputHandler());
   useEffect(() => {
-    return () => keyboardHandler.current.dispose();
+    return () => inputHandler.current.dispose();
   }, []);
 
   const [
@@ -143,20 +143,20 @@ export function DesktopSession({
 
   useListener(client.onClipboardData, onClipboardData);
 
-  const handleFatalError = useCallback(
-    (error: Error) => {
-      setDirectorySharingState(defaultDirectorySharingState);
-      setClipboardSharingState(defaultClipboardSharingState);
+  const handleConnectionClose = useCallback(
+    (error?: Error) => {
+      clearSharing();
       setTdpConnectionStatus({
         status: 'disconnected',
         fromTdpError: error instanceof TdpError,
-        message: error.message,
+        message: error?.message || '',
       });
       initialTdpConnectionSucceeded.current = false;
     },
-    [setClipboardSharingState, setDirectorySharingState]
+    [clearSharing]
   );
-  useListener(client.onError, handleFatalError);
+  useListener(client.onError, handleConnectionClose);
+  useListener(client.onTransportClose, handleConnectionClose);
 
   const addWarning = useCallback(
     (warning: string) => {
@@ -183,19 +183,6 @@ export function DesktopSession({
     )
   );
 
-  useListener(
-    client.onTransportClose,
-    useCallback(
-      error => {
-        setTdpConnectionStatus({
-          status: 'disconnected',
-          message: error?.message,
-        });
-        initialTdpConnectionSucceeded.current = false;
-      },
-      [setTdpConnectionStatus]
-    )
-  );
   useListener(
     client.onTransportOpen,
     useCallback(() => {
@@ -256,7 +243,7 @@ export function DesktopSession({
   }, [client, shouldConnect, keyboardLayout]);
 
   function handleKeyDown(e: React.KeyboardEvent) {
-    keyboardHandler.current.handleKeyboardEvent({
+    inputHandler.current.handleInputEvent({
       cli: client,
       e: e.nativeEvent,
       state: ButtonState.DOWN,
@@ -275,7 +262,7 @@ export function DesktopSession({
   }
 
   function handleKeyUp(e: React.KeyboardEvent) {
-    keyboardHandler.current.handleKeyboardEvent({
+    inputHandler.current.handleInputEvent({
       cli: client,
       e: e.nativeEvent,
       state: ButtonState.UP,
@@ -283,7 +270,7 @@ export function DesktopSession({
   }
 
   function handleBlur() {
-    keyboardHandler.current.onFocusOut();
+    inputHandler.current.onFocusOut();
   }
 
   function handleMouseMove(e: React.MouseEvent) {
@@ -294,9 +281,11 @@ export function DesktopSession({
   }
 
   function handleMouseDown(e: React.MouseEvent) {
-    if (e.button === 0 || e.button === 1 || e.button === 2) {
-      client.sendMouseButton(e.button, ButtonState.DOWN);
-    }
+    inputHandler.current.handleInputEvent({
+      cli: client,
+      e: e.nativeEvent,
+      state: ButtonState.DOWN,
+    });
 
     // Opportunistically sync local clipboard to remote while
     // transient user activation is in effect.
@@ -305,13 +294,17 @@ export function DesktopSession({
   }
 
   function handleMouseUp(e: React.MouseEvent) {
-    if (e.button === 0 || e.button === 1 || e.button === 2) {
-      client.sendMouseButton(e.button, ButtonState.UP);
-    }
+    inputHandler.current.handleInputEvent({
+      cli: client,
+      e: e.nativeEvent,
+      state: ButtonState.UP,
+    });
   }
 
   function handleMouseWheel(e: WheelEvent) {
     e.preventDefault();
+    // Check modifier states are correct to avoid unintentional zooming whilst scrolling.
+    inputHandler.current.synchronizeModifierState(client, e);
     // We only support pixel scroll events, not line or page events.
     // https://developer.mozilla.org/en-US/docs/Web/API/WheelEvent/deltaMode
     if (e.deltaMode === WheelEvent.DOM_DELTA_PIXEL) {
@@ -362,14 +355,6 @@ export function DesktopSession({
       <TopBar
         isConnected={screenState.state === 'canvas-visible'}
         onDisconnect={() => {
-          setClipboardSharingState(prevState => ({
-            ...prevState,
-            isSharing: false,
-          }));
-          setDirectorySharingState(prevState => ({
-            ...prevState,
-            isSharing: false,
-          }));
           client.shutdown();
         }}
         userHost={`${username} on ${desktop}`}
diff --git a/web/packages/shared/components/DesktopSession/InputHandler.test.ts b/web/packages/shared/components/DesktopSession/InputHandler.test.ts
new file mode 100644
index 0000000000000..7d5526f96a905
--- /dev/null
+++ b/web/packages/shared/components/DesktopSession/InputHandler.test.ts
@@ -0,0 +1,328 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  ButtonState,
+  selectDirectoryInBrowser,
+  TdpClient,
+} from 'shared/libs/tdp';
+
+import { InputHandler } from './InputHandler';
+
+// Mock the TdpClient class
+jest.mock('shared/libs/tdp', () => {
+  const originalModule = jest.requireActual('shared/libs/tdp');
+  return {
+    ...originalModule,
+    TdpClient: jest.fn().mockImplementation(() => {
+      return {
+        sendKeyboardInput: jest.fn(),
+        sendMouseButton: jest.fn(),
+        sendSyncKeys: jest.fn(),
+      };
+    }),
+  };
+});
+
+describe('InputHandler', () => {
+  let inputHandler: InputHandler;
+  let mockTdpClient: jest.Mocked<TdpClient>;
+
+  beforeEach(() => {
+    inputHandler = new InputHandler();
+    mockTdpClient = new TdpClient(
+      () => null,
+      selectDirectoryInBrowser
+    ) as jest.Mocked<TdpClient>;
+  });
+
+  afterEach(() => {
+    inputHandler.dispose();
+  });
+
+  describe('synchronizeModifierState', () => {
+    it('sends modifier sync when local and remote states differ', () => {
+      // Create event with Shift pressed but don't track it in remote state first
+      const event = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: true,
+      });
+
+      const params = {
+        e: event,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      };
+
+      inputHandler.handleInputEvent(params);
+
+      // Should send Shift DOWN to sync states since remote state defaults to UP
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'ShiftLeft',
+        ButtonState.DOWN
+      );
+    });
+
+    it('does not send sync when states are already synchronized', () => {
+      // First, set Shift as DOWN in remote state
+      const shiftDownEvent = new KeyboardEvent('keydown', {
+        code: 'ShiftLeft',
+      });
+      inputHandler.handleInputEvent({
+        e: shiftDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      mockTdpClient.sendKeyboardInput.mockClear();
+
+      // Now press a key with Shift
+      const event = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: true,
+      });
+
+      inputHandler.handleInputEvent({
+        e: event,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Should not send any Shift synchronization events
+      const shiftCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(
+        call => call[0].includes('Shift')
+      );
+      expect(shiftCalls).toHaveLength(0);
+    });
+
+    it('synchronizes multiple modifier states correctly', () => {
+      // Set Alt as DOWN in remote state (to test it gets synced to UP)
+      const altDownEvent = new KeyboardEvent('keydown', { code: 'AltLeft' });
+      inputHandler.handleInputEvent({
+        e: altDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Press event with multiple modifiers active but not previously tracked
+      const event = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: true,
+        ctrlKey: true,
+        altKey: false,
+        metaKey: false,
+      });
+
+      inputHandler.handleInputEvent({
+        e: event,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Should sync Shift and Control to DOWN, and Alt to UP
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'ShiftLeft',
+        ButtonState.DOWN
+      );
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'ControlLeft',
+        ButtonState.DOWN
+      );
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'AltLeft',
+        ButtonState.UP
+      );
+    });
+
+    it('handles modifier key release correctly', () => {
+      // First press Shift
+      const shiftDownEvent = new KeyboardEvent('keydown', {
+        code: 'ShiftLeft',
+      });
+      inputHandler.handleInputEvent({
+        e: shiftDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Then release Shift
+      const shiftUpEvent = new KeyboardEvent('keyup', { code: 'ShiftLeft' });
+      inputHandler.handleInputEvent({
+        e: shiftUpEvent,
+        state: ButtonState.UP,
+        cli: mockTdpClient,
+      });
+
+      mockTdpClient.sendKeyboardInput.mockClear();
+
+      // Now press a key without Shift
+      const normalKeyEvent = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: false,
+      });
+
+      inputHandler.handleInputEvent({
+        e: normalKeyEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Should not send additional Shift events since it's already UP
+      const shiftCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(
+        call => call[0].includes('Shift')
+      );
+      expect(shiftCalls).toHaveLength(0);
+    });
+
+    it('Control and Alt are not synchronized when AltGr pressed', () => {
+      // First, set Control and Alt to DOWN to mimick the what happens when a
+      // user presses AltGraph in a browser.
+      const ctrlDownEvent = new KeyboardEvent('keydown', {
+        code: 'ControlLeft',
+      });
+      inputHandler.handleInputEvent({
+        e: ctrlDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      const altDownEvent = new KeyboardEvent('keydown', { code: 'AltRight' });
+      inputHandler.handleInputEvent({
+        e: altDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Clear these events so they're not counted below
+      mockTdpClient.sendKeyboardInput.mockClear();
+
+      const altGrEvent = new KeyboardEvent('keydown', {
+        code: 'KeyQ',
+        ctrlKey: false,
+        altKey: false,
+      });
+
+      // There isn't a key code for AltGraph, so instead mock the
+      // getModifierState to return true for AltGraph
+      Object.defineProperty(altGrEvent, 'getModifierState', {
+        value: (key: string) => key === 'AltGraph',
+      });
+
+      inputHandler.handleInputEvent({
+        e: altGrEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Check that synchronizeModifierState doesn't try to set the remote state
+      // (down) to that of the local state (up)
+      const controlCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(
+        call => call[0].includes('Control')
+      );
+      const altCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(call =>
+        call[0].includes('Alt')
+      );
+
+      expect(controlCalls).toHaveLength(0);
+      expect(altCalls).toHaveLength(0);
+    });
+
+    it('Shift and Meta are still synchronized when AltGr is active', () => {
+      const shiftDownEvent = new KeyboardEvent('keydown', {
+        code: 'ShiftLeft',
+      });
+      inputHandler.handleInputEvent({
+        e: shiftDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      const metaDownEvent = new KeyboardEvent('keydown', { code: 'MetaLeft' });
+      inputHandler.handleInputEvent({
+        e: metaDownEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      mockTdpClient.sendKeyboardInput.mockClear();
+
+      // Press AltGr key with Shift and Meta released
+      const altGrEvent = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: false,
+        ctrlKey: false,
+        altKey: false,
+        metaKey: false,
+      });
+
+      Object.defineProperty(altGrEvent, 'getModifierState', {
+        value: (key: string) => key === 'AltGraph',
+      });
+
+      inputHandler.handleInputEvent({
+        e: altGrEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Shift & Meta should still be synchronized to UP even with AltGr active
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'ShiftLeft',
+        ButtonState.UP
+      );
+      expect(mockTdpClient.sendKeyboardInput).toHaveBeenCalledWith(
+        'MetaLeft',
+        ButtonState.UP
+      );
+    });
+
+    it('handles AltGr + Shift combination correctly', () => {
+      const altGrShiftEvent = new KeyboardEvent('keydown', {
+        code: 'KeyA',
+        shiftKey: true,
+        ctrlKey: false,
+        altKey: false,
+      });
+
+      Object.defineProperty(altGrShiftEvent, 'getModifierState', {
+        value: (key: string) => key === 'AltGraph' || key === 'Shift',
+      });
+
+      inputHandler.handleInputEvent({
+        e: altGrShiftEvent,
+        state: ButtonState.DOWN,
+        cli: mockTdpClient,
+      });
+
+      // Shift should be synchronized, but not Control/Alt
+      const shiftCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(
+        call => call[0].includes('Shift')
+      );
+      const controlCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(
+        call => call[0].includes('Control')
+      );
+      const altCalls = mockTdpClient.sendKeyboardInput.mock.calls.filter(call =>
+        call[0].includes('Alt')
+      );
+
+      expect(shiftCalls.length).toBeGreaterThan(0);
+      expect(controlCalls).toHaveLength(0);
+      expect(altCalls).toHaveLength(0);
+    });
+  });
+});
diff --git a/web/packages/shared/components/DesktopSession/InputHandler.tsx b/web/packages/shared/components/DesktopSession/InputHandler.tsx
new file mode 100644
index 0000000000000..8d0ccc9aa6a1a
--- /dev/null
+++ b/web/packages/shared/components/DesktopSession/InputHandler.tsx
@@ -0,0 +1,244 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { getPlatform, Platform } from 'design/platform';
+import { ButtonState, MouseButton, SyncKeys, TdpClient } from 'shared/libs/tdp';
+
+import { Withholder } from './Withholder';
+
+/**
+ * Handles mouse and keyboard events.
+ */
+export class InputHandler {
+  private withholder: Withholder = new Withholder();
+  /**
+   * Tracks whether the next keydown or keyup event should sync the
+   * local toggle key state to the remote machine.
+   *
+   * Set to true:
+   * - On component initialization, so keys are synced before the first keydown/keyup event.
+   * - On focusout, so keys are synced when the user returns to the window.
+   */
+  private syncBeforeNextKey: boolean = true;
+  private static isMac: boolean = getPlatform() === Platform.macOS;
+
+  /**
+   * Keep track of the remote state of modifier keys.
+   * This is used to mitigate stuck key issues when local
+   * and remote modifier states are out of sync.
+   */
+  private remoteModifierState = new Map<string, ButtonState>([
+    ['Shift', ButtonState.UP],
+    ['Control', ButtonState.UP],
+    ['Alt', ButtonState.UP],
+    ['Meta', ButtonState.UP],
+  ]);
+
+  constructor() {
+    // Bind finishHandlingInputEvent to this instance so it can be passed
+    // as a callback to the Withholder.
+    this.finishHandlingInputEvent = this.finishHandlingInputEvent.bind(this);
+  }
+
+  /**
+   * Primary method for handling input events.
+   */
+  public handleInputEvent(params: InputEventParams) {
+    const { e, cli, state } = params;
+    if (e instanceof KeyboardEvent) {
+      // Only prevent default for KeyboardEvents.
+      // If preventDefault is done on MouseEvents,
+      // it breaks focus and keys won't be registered.
+      e.preventDefault();
+      this.handleSyncBeforeNextKey(cli, e);
+      this.updateModifierState(e.code, state);
+    }
+    this.withholder.handleInputEvent(params, this.finishHandlingInputEvent);
+  }
+
+  private handleSyncBeforeNextKey(
+    cli: TdpClient,
+    e: KeyboardEvent | MouseEvent
+  ) {
+    if (this.syncBeforeNextKey === true) {
+      cli.sendSyncKeys(this.getSyncKeys(e));
+      this.syncBeforeNextKey = false;
+    }
+  }
+
+  private getSyncKeys = (e: KeyboardEvent | MouseEvent): SyncKeys => {
+    return {
+      scrollLockState: this.getModifierState(e, 'ScrollLock'),
+      numLockState: this.getModifierState(e, 'NumLock'),
+      capsLockState: this.getModifierState(e, 'CapsLock'),
+      kanaLockState: ButtonState.UP, // KanaLock is not supported, see https://www.w3.org/TR/uievents-key/#keys-modifier
+    };
+  };
+
+  /**
+   * Returns the ButtonState corresponding to the given `keyArg`.
+   *
+   * @param e The `KeyboardEvent`
+   * @param keyArg The key to check the state of. Valid values can be found [here](https://www.w3.org/TR/uievents-key/#keys-modifier)
+   */
+  private getModifierState = (
+    e: KeyboardEvent | MouseEvent,
+    keyArg: string
+  ): ButtonState => {
+    return e.getModifierState(keyArg) ? ButtonState.DOWN : ButtonState.UP;
+  };
+
+  /**
+   * Called to finish handling a keyboard event.
+   *
+   * For normal keys, this is called immediately.
+   * For withheld or delayed keys, this is called as the callback when
+   * another key is pressed or released (withheld) or after a delay (delayed).
+   */
+  private finishHandlingInputEvent(params: InputEventParams): void {
+    const { cli, e, state } = params;
+
+    // Synchronize local and remote modifier state before sending the input event.
+    this.synchronizeModifierState(cli, e);
+
+    // If this is a mouse event no special handling is needed.
+    if (e instanceof MouseEvent) {
+      cli.sendMouseButton(e.button as MouseButton, state);
+      return;
+    }
+
+    // Special handling for CapsLock on Mac.
+    if (e.code === 'CapsLock' && InputHandler.isMac) {
+      // On Mac, every UP or DOWN given to us by the browser corresponds
+      // to a DOWN + UP on the remote machine for CapsLock.
+      cli.sendKeyboardInput('CapsLock', ButtonState.DOWN);
+      cli.sendKeyboardInput('CapsLock', ButtonState.UP);
+    } else {
+      // Otherwise, just pass the event through normally to the server.
+      cli.sendKeyboardInput(e.code, state);
+    }
+  }
+
+  /**
+   * Updates the locally tracked remote modifier state.
+   *
+   * @param keyCode The key code of the key.
+   * @param state The state of the key.
+   */
+  private updateModifierState(keyCode: string, state: ButtonState) {
+    switch (keyCode) {
+      case 'ShiftLeft':
+      case 'ShiftRight':
+        this.remoteModifierState.set('Shift', state);
+        break;
+      case 'ControlLeft':
+      case 'ControlRight':
+        this.remoteModifierState.set('Control', state);
+        break;
+      case 'AltLeft':
+      case 'AltRight':
+        this.remoteModifierState.set('Alt', state);
+        break;
+      case 'MetaLeft':
+      case 'MetaRight':
+        this.remoteModifierState.set('Meta', state);
+        break;
+    }
+  }
+
+  /**
+   * Checks if the given key is a modifier key.
+   *
+   * @param key The key to check.
+   * @returns True if the key is a modifier key, false otherwise.
+   */
+  private isModifierKey(key: string): boolean {
+    return ['Shift', 'Control', 'Alt', 'Meta'].some(modifier =>
+      key.startsWith(modifier)
+    );
+  }
+
+  /**
+   * Synchronizes the local modifier state with the remote machine.
+   * This is called when key or mouse click/scroll events occur to ensure
+   * that the remote machine has the correct state of modifier keys.
+   * If not, it sends the current state.
+   *
+   * @param cli The TdpClient instance used to send the state.
+   * @param e The KeyboardEvent or MouseEvent that triggered the synchronization.
+   */
+  public synchronizeModifierState(
+    cli: TdpClient,
+    e: KeyboardEvent | MouseEvent
+  ) {
+    // Don't process modifier keys themselves
+    if (e instanceof KeyboardEvent && this.isModifierKey(e.code)) {
+      return;
+    }
+
+    // Check if AltGraph is being pressed
+    const isAltGraphActive = e.getModifierState('AltGraph');
+
+    this.remoteModifierState.forEach((state, modifier) => {
+      // When AltGr is pressed, browsers synthesize ControlLeft+AltRight, but
+      // getModifierState('Control') and getModifierState('Alt') return false
+      // because the physical keys aren't pressed. Skip sync to avoid sending
+      // incorrect UP events while AltGr is active.
+      if (isAltGraphActive && (modifier === 'Control' || modifier === 'Alt')) {
+        return;
+      }
+
+      const localState = e.getModifierState(modifier)
+        ? ButtonState.DOWN
+        : ButtonState.UP;
+
+      if (localState !== state) {
+        // If the local state is different from the remote state, send the updates.
+        cli.sendKeyboardInput(modifier + 'Left', localState);
+        cli.sendKeyboardInput(modifier + 'Right', localState);
+
+        // Update the remote state to match the local state.
+        this.remoteModifierState.set(modifier, localState);
+      }
+    });
+  }
+
+  /**
+   * Must be called when the element associated with the InputHandler loses focus.
+   */
+  public onFocusOut() {
+    // Sync toggle keys when we come back into focus.
+    this.syncBeforeNextKey = true;
+    // Cancel any withheld keys.
+    this.withholder.cancel();
+  }
+
+  /**
+   * Should be called when the element associated with the InputHandler goes away.
+   */
+  public dispose() {
+    // Make sure we cancel any withheld keys, particularly we want to cancel the timeouts.
+    this.withholder.cancel();
+  }
+}
+
+export type InputEventParams = {
+  cli: TdpClient;
+  e: KeyboardEvent | MouseEvent;
+  state: ButtonState;
+};
diff --git a/web/packages/shared/components/DesktopSession/KeyboardHandler.tsx b/web/packages/shared/components/DesktopSession/KeyboardHandler.tsx
deleted file mode 100644
index c2f275a42fd04..0000000000000
--- a/web/packages/shared/components/DesktopSession/KeyboardHandler.tsx
+++ /dev/null
@@ -1,133 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { getPlatform, Platform } from 'design/platform';
-import { ButtonState, SyncKeys, TdpClient } from 'shared/libs/tdp';
-
-import { Withholder } from './Withholder';
-
-/**
- * Handles keyboard events.
- */
-export class KeyboardHandler {
-  private withholder: Withholder = new Withholder();
-  /**
-   * Tracks whether the next keydown or keyup event should sync the
-   * local toggle key state to the remote machine.
-   *
-   * Set to true:
-   * - On component initialization, so keys are synced before the first keydown/keyup event.
-   * - On focusout, so keys are synced when the user returns to the window.
-   */
-  private syncBeforeNextKey: boolean = true;
-  private static isMac: boolean = getPlatform() === Platform.macOS;
-
-  constructor() {
-    // Bind finishHandlingKeyboardEvent to this instance so it can be passed
-    // as a callback to the Withholder.
-    this.finishHandlingKeyboardEvent =
-      this.finishHandlingKeyboardEvent.bind(this);
-  }
-
-  /**
-   * Primary method for handling keyboard events.
-   */
-  public handleKeyboardEvent(params: KeyboardEventParams) {
-    const { e, cli } = params;
-    e.preventDefault();
-    this.handleSyncBeforeNextKey(cli, e);
-    this.withholder.handleKeyboardEvent(
-      params,
-      this.finishHandlingKeyboardEvent
-    );
-  }
-
-  private handleSyncBeforeNextKey(cli: TdpClient, e: KeyboardEvent) {
-    if (this.syncBeforeNextKey === true) {
-      cli.sendSyncKeys(this.getSyncKeys(e));
-      this.syncBeforeNextKey = false;
-    }
-  }
-
-  private getSyncKeys = (e: KeyboardEvent): SyncKeys => {
-    return {
-      scrollLockState: this.getModifierState(e, 'ScrollLock'),
-      numLockState: this.getModifierState(e, 'NumLock'),
-      capsLockState: this.getModifierState(e, 'CapsLock'),
-      kanaLockState: ButtonState.UP, // KanaLock is not supported, see https://www.w3.org/TR/uievents-key/#keys-modifier
-    };
-  };
-
-  /**
-   * Returns the ButtonState corresponding to the given `keyArg`.
-   *
-   * @param e The `KeyboardEvent`
-   * @param keyArg The key to check the state of. Valid values can be found [here](https://www.w3.org/TR/uievents-key/#keys-modifier)
-   */
-  private getModifierState = (
-    e: KeyboardEvent,
-    keyArg: string
-  ): ButtonState => {
-    return e.getModifierState(keyArg) ? ButtonState.DOWN : ButtonState.UP;
-  };
-
-  /**
-   * Called to finish handling a keyboard event.
-   *
-   * For normal keys, this is called immediately.
-   * For withheld or delayed keys, this is called as the callback when
-   * another key is pressed or released (withheld) or after a delay (delayed).
-   */
-  private finishHandlingKeyboardEvent(params: KeyboardEventParams): void {
-    const { cli, e, state } = params;
-    // Special handling for CapsLock on Mac.
-    if (e.code === 'CapsLock' && KeyboardHandler.isMac) {
-      // On Mac, every UP or DOWN given to us by the browser corresponds
-      // to a DOWN + UP on the remote machine for CapsLock.
-      cli.sendKeyboardInput('CapsLock', ButtonState.DOWN);
-      cli.sendKeyboardInput('CapsLock', ButtonState.UP);
-    } else {
-      // Otherwise, just pass the event through normally to the server.
-      cli.sendKeyboardInput(e.code, state);
-    }
-  }
-
-  /**
-   * Must be called when the element associated with the KeyboardHandler loses focus.
-   */
-  public onFocusOut() {
-    // Sync toggle keys when we come back into focus.
-    this.syncBeforeNextKey = true;
-    // Cancel any withheld keys.
-    this.withholder.cancel();
-  }
-
-  /**
-   * Should be called when the element associated with the KeyboardHandler goes away.
-   */
-  public dispose() {
-    // Make sure we cancel any withheld keys, particularly we want to cancel the timeouts.
-    this.withholder.cancel();
-  }
-}
-
-export type KeyboardEventParams = {
-  cli: TdpClient;
-  e: KeyboardEvent;
-  state: ButtonState;
-};
diff --git a/web/packages/shared/components/DesktopSession/TopBar.tsx b/web/packages/shared/components/DesktopSession/TopBar.tsx
index b40d841f8091a..aa67f6b9248c8 100644
--- a/web/packages/shared/components/DesktopSession/TopBar.tsx
+++ b/web/packages/shared/components/DesktopSession/TopBar.tsx
@@ -22,7 +22,7 @@ import { Flex, Text, TopNav } from 'design';
 import { Clipboard, FolderShared } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
 import { LatencyDiagnostic } from 'shared/components/LatencyDiagnostic';
-import type { NotificationItem } from 'shared/components/Notification';
+import type { ToastNotificationItem } from 'shared/components/ToastNotification';
 
 import ActionMenu from './ActionMenu';
 import { AlertDropdown } from './AlertDropdown';
@@ -54,35 +54,28 @@ export default function TopBar(props: Props) {
     <TopNav
       height="40px"
       bg="levels.deep"
-      style={{
-        justifyContent: 'space-between',
-      }}
+      justifyContent="space-between"
+      gap={3}
+      px={3}
     >
-      <Text px={3} style={{ color: theme.colors.text.slightlyMuted }}>
-        {userHost}
-      </Text>
+      <Text style={{ color: theme.colors.text.slightlyMuted }}>{userHost}</Text>
 
       {isConnected && (
-        <Flex px={3}>
-          <Flex alignItems="center" gap={3}>
-            {latency && <LatencyDiagnostic latency={latency} />}
-            <HoverTooltip
-              tipContent={directorySharingToolTip(
-                canShareDirectory,
-                isSharingDirectory
-              )}
-              placement="bottom"
-            >
-              <FolderShared style={primaryOnTrue(isSharingDirectory)} />
-            </HoverTooltip>
-            <HoverTooltip
-              tipContent={clipboardSharingMessage}
-              placement="bottom"
-            >
-              <Clipboard style={primaryOnTrue(isSharingClipboard)} />
-            </HoverTooltip>
-            <AlertDropdown alerts={alerts} onRemoveAlert={onRemoveAlert} />
-          </Flex>
+        <Flex gap={3} alignItems="center">
+          {latency && <LatencyDiagnostic latency={latency} />}
+          <HoverTooltip
+            tipContent={directorySharingToolTip(
+              canShareDirectory,
+              isSharingDirectory
+            )}
+            placement="bottom"
+          >
+            <FolderShared style={primaryOnTrue(isSharingDirectory)} />
+          </HoverTooltip>
+          <HoverTooltip tipContent={clipboardSharingMessage} placement="bottom">
+            <Clipboard style={primaryOnTrue(isSharingClipboard)} />
+          </HoverTooltip>
+          <AlertDropdown alerts={alerts} onRemoveAlert={onRemoveAlert} />
           <ActionMenu
             onDisconnect={onDisconnect}
             showShareDirectory={canShareDirectory && !isSharingDirectory}
@@ -117,7 +110,7 @@ type Props = {
   onDisconnect: VoidFunction;
   onShareDirectory: VoidFunction;
   onCtrlAltDel: VoidFunction;
-  alerts: NotificationItem[];
+  alerts: ToastNotificationItem[];
   isConnected: boolean;
   onRemoveAlert(id: string): void;
   latency: {
diff --git a/web/packages/shared/components/DesktopSession/Withholder.test.ts b/web/packages/shared/components/DesktopSession/Withholder.test.ts
index 43ee1267cf4f3..c0178ca5046f6 100644
--- a/web/packages/shared/components/DesktopSession/Withholder.test.ts
+++ b/web/packages/shared/components/DesktopSession/Withholder.test.ts
@@ -16,7 +16,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { BrowserFileSystem, ButtonState, TdpClient } from 'shared/libs/tdp';
+import {
+  ButtonState,
+  selectDirectoryInBrowser,
+  TdpClient,
+} from 'shared/libs/tdp';
 
 import { Withholder } from './Withholder';
 
@@ -53,9 +57,9 @@ describe('withholder', () => {
     const params = {
       e: { key: 'Enter' } as KeyboardEvent as KeyboardEvent,
       state: ButtonState.DOWN,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
-    withholder.handleKeyboardEvent(params, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(params, mockHandleKeyboardEvent);
     expect(mockHandleKeyboardEvent).toHaveBeenCalledWith(params);
   });
 
@@ -63,27 +67,27 @@ describe('withholder', () => {
     const metaDown = {
       e: { key: 'Meta' } as KeyboardEvent,
       state: ButtonState.DOWN,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
 
     const metaUp = {
       e: { key: 'Meta' } as KeyboardEvent,
       state: ButtonState.UP,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
 
     const enterDown = {
       e: { key: 'Enter' } as KeyboardEvent as KeyboardEvent,
       state: ButtonState.DOWN,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
 
-    withholder.handleKeyboardEvent(metaDown, mockHandleKeyboardEvent);
-    withholder.handleKeyboardEvent(metaUp, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(metaDown, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(metaUp, mockHandleKeyboardEvent);
 
     expect(mockHandleKeyboardEvent).not.toHaveBeenCalled();
 
-    withholder.handleKeyboardEvent(enterDown, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(enterDown, mockHandleKeyboardEvent);
 
     expect(mockHandleKeyboardEvent).toHaveBeenCalledTimes(3);
     expect(mockHandleKeyboardEvent).toHaveBeenNthCalledWith(1, metaDown);
@@ -95,16 +99,16 @@ describe('withholder', () => {
     const metaParams = {
       e: { key: 'Meta' } as KeyboardEvent,
       state: ButtonState.UP,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
     const altParams = {
       e: { key: 'Alt' } as KeyboardEvent,
       state: ButtonState.UP,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
 
-    withholder.handleKeyboardEvent(metaParams, mockHandleKeyboardEvent);
-    withholder.handleKeyboardEvent(altParams, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(metaParams, mockHandleKeyboardEvent);
+    withholder.handleInputEvent(altParams, mockHandleKeyboardEvent);
 
     expect(mockHandleKeyboardEvent).not.toHaveBeenCalled();
 
@@ -119,15 +123,34 @@ describe('withholder', () => {
     const metaParams = {
       e: { key: 'Meta' } as KeyboardEvent,
       state: ButtonState.UP,
-      cli: new TdpClient(() => null, new BrowserFileSystem()),
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
     };
-    withholder.handleKeyboardEvent(metaParams, mockHandleKeyboardEvent);
-    expect((withholder as any).withheldKeys).toHaveLength(1);
+    withholder.handleInputEvent(metaParams, mockHandleKeyboardEvent);
+    expect((withholder as any).withheldInputs).toHaveLength(1);
 
     withholder.cancel();
     jest.advanceTimersByTime(10);
 
     expect(mockHandleKeyboardEvent).not.toHaveBeenCalled();
-    expect((withholder as any).withheldKeys).toHaveLength(0);
+    expect((withholder as any).withheldInputs).toHaveLength(0);
+  });
+
+  it('flushes keys on mouse event', () => {
+    const metaParams = {
+      e: { key: 'Meta' } as KeyboardEvent,
+      state: ButtonState.DOWN,
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
+    };
+    withholder.handleInputEvent(metaParams, mockHandleKeyboardEvent);
+
+    const mouseEvent = {
+      e: { button: 0 } as MouseEvent,
+      state: ButtonState.DOWN,
+      cli: new TdpClient(() => null, selectDirectoryInBrowser),
+    };
+    withholder.handleInputEvent(mouseEvent, mockHandleKeyboardEvent);
+
+    expect(mockHandleKeyboardEvent).toHaveBeenCalledWith(metaParams);
+    expect(mockHandleKeyboardEvent).toHaveBeenCalledWith(mouseEvent);
   });
 });
diff --git a/web/packages/shared/components/DesktopSession/Withholder.tsx b/web/packages/shared/components/DesktopSession/Withholder.tsx
index 271864e638c2d..bd8cab880943b 100644
--- a/web/packages/shared/components/DesktopSession/Withholder.tsx
+++ b/web/packages/shared/components/DesktopSession/Withholder.tsx
@@ -18,7 +18,7 @@
 
 import { ButtonState } from 'shared/libs/tdp';
 
-import { KeyboardEventParams } from './KeyboardHandler';
+import { InputEventParams } from './InputHandler';
 
 /**
  * The Withholder class manages keyboard events, particularly for alt/cmd keys. It delays handling these keys to determine the user's intent:
@@ -39,25 +39,26 @@ export class Withholder {
    */
   private keysToWithhold: string[] = ['Meta', 'Alt'];
   /**
-   * The internal array of keystrokes that are currently
+   * The internal array of inputs that are currently
    * being withheld.
    */
-  private withheldKeys: Array<WithheldKeyboardEventHandler> = [];
+  private withheldInputs: WithheldInputEventHandler[] = [];
 
   /**
-   * All keyboard events should be handled via this function.
+   * All input events should be handled via this function.
    */
-  public handleKeyboardEvent(
-    params: KeyboardEventParams,
-    handleKeyboardEvent: (params: KeyboardEventParams) => void
+  public handleInputEvent(
+    params: InputEventParams,
+    handleInputEvent: (params: InputEventParams) => void
   ) {
-    const key = params.e.key;
-
-    // If this is not a key we withhold, immediately flush any withheld keys
+    // If this is not a key we withhold or a mouse event, immediately flush any withheld keys
     // and handle this key.
-    if (!this.keysToWithhold.includes(key)) {
+    if (
+      params.e instanceof MouseEvent ||
+      !this.keysToWithhold.includes(params.e.key)
+    ) {
       this.flush();
-      handleKeyboardEvent(params);
+      handleInputEvent(params);
       return;
     }
 
@@ -84,32 +85,32 @@ export class Withholder {
       }, UP_DELAY_MS);
     }
 
-    this.withheldKeys.push({
+    this.withheldInputs.push({
       params,
-      handler: handleKeyboardEvent,
+      handler: handleInputEvent,
       timeout,
     });
   }
 
   // Cancel all withheld keys.
   public cancel() {
-    this.withheldKeys.forEach(w => clearTimeout(w.timeout));
-    this.withheldKeys = [];
+    this.withheldInputs.forEach(w => clearTimeout(w.timeout));
+    this.withheldInputs = [];
   }
 
   // Flush all withheld keys.
   private flush() {
-    this.withheldKeys.forEach(w => {
+    this.withheldInputs.forEach(w => {
       clearTimeout(w.timeout);
       w.handler(w.params);
     });
-    this.withheldKeys = [];
+    this.withheldInputs = [];
   }
 }
 
-type WithheldKeyboardEventHandler = {
-  handler: (params: KeyboardEventParams) => void;
-  params: KeyboardEventParams;
+type WithheldInputEventHandler = {
+  handler: (params: InputEventParams) => void;
+  params: InputEventParams;
   timeout?: NodeJS.Timeout;
 };
 
diff --git a/web/packages/shared/components/DesktopSession/useDesktopSession.tsx b/web/packages/shared/components/DesktopSession/useDesktopSession.tsx
index e68041a114a2e..e9c98f05a01c4 100644
--- a/web/packages/shared/components/DesktopSession/useDesktopSession.tsx
+++ b/web/packages/shared/components/DesktopSession/useDesktopSession.tsx
@@ -25,9 +25,10 @@ import {
   useState,
 } from 'react';
 
-import type { NotificationItem } from 'shared/components/Notification';
+import type { ToastNotificationItem } from 'shared/components/ToastNotification';
 import { Attempt } from 'shared/hooks/useAsync';
 import { ClipboardData, TdpClient } from 'shared/libs/tdp';
+import { isAbortError } from 'shared/utils/error';
 
 declare global {
   interface Window {
@@ -40,15 +41,34 @@ export default function useDesktopSession(
   aclAttempt: Attempt<{
     clipboardSharingEnabled: boolean;
     directorySharingEnabled: boolean;
-  }>
+  }>,
+  browserSupportsSharing: boolean
 ) {
   const encoder = useRef(new TextEncoder());
   const latestClipboardDigest = useRef('');
-  const [directorySharingState, setDirectorySharingState] =
-    useState<DirectorySharingState>(defaultDirectorySharingState);
-
-  const [clipboardSharingState, setClipboardSharingState] =
-    useState<ClipboardSharingState>(defaultClipboardSharingState);
+  const [directorySharingState, setDirectorySharingState] = useState<{
+    directorySelected: boolean;
+  }>({ directorySelected: false });
+
+  const [clipboardSharingState, setClipboardSharingState] = useState<{
+    readState?: PermissionState;
+    writeState?: PermissionState;
+  }>({});
+
+  const clipboardSharing: ClipboardSharingState = {
+    ...clipboardSharingState,
+    browserSupported: browserSupportsSharing,
+    allowedByAcl:
+      aclAttempt.status === 'success' &&
+      aclAttempt.data.clipboardSharingEnabled,
+  };
+  const directorySharing: DirectorySharingState = {
+    ...directorySharingState,
+    browserSupported: browserSupportsSharing,
+    allowedByAcl:
+      aclAttempt.status === 'success' &&
+      aclAttempt.data.directorySharingEnabled,
+  };
 
   useEffect(() => {
     const clearReadListenerPromise = initClipboardPermissionTracking(
@@ -68,26 +88,11 @@ export default function useDesktopSession(
     };
   }, []);
 
-  //TODO(gzdunek): This is workaround for synchronizing *sharingState with aclAttempt.
-  //Refactor clipboard and directory sharing so that we won't need allowedByAcl fields in state.
-  useEffect(() => {
-    if (aclAttempt.status === 'success') {
-      setClipboardSharingState(prevState => ({
-        ...prevState,
-        allowedByAcl: aclAttempt.data.clipboardSharingEnabled,
-      }));
-      setDirectorySharingState(prevState => ({
-        ...prevState,
-        allowedByAcl: aclAttempt.data.directorySharingEnabled,
-      }));
-    }
-  }, [aclAttempt]);
-
-  const [alerts, setAlerts] = useState<NotificationItem[]>([]);
+  const [alerts, setAlerts] = useState<ToastNotificationItem[]>([]);
   const onRemoveAlert = (id: string) => {
     setAlerts(prevState => prevState.filter(alert => alert.id !== id));
   };
-  const addAlert = useCallback((alert: Omit<NotificationItem, 'id'>) => {
+  const addAlert = useCallback((alert: Omit<ToastNotificationItem, 'id'>) => {
     setAlerts(prevState => [
       ...prevState,
       { ...alert, id: crypto.randomUUID() },
@@ -95,7 +100,7 @@ export default function useDesktopSession(
   }, []);
 
   async function sendLocalClipboardToRemote() {
-    if (!(await sysClipboardGuard(clipboardSharingState, 'read'))) {
+    if (!(await sysClipboardGuard(clipboardSharing, 'read'))) {
       return;
     }
     const text = await navigator.clipboard.readText();
@@ -111,7 +116,7 @@ export default function useDesktopSession(
   async function onClipboardData(clipboardData: ClipboardData) {
     if (
       clipboardData.data &&
-      (await sysClipboardGuard(clipboardSharingState, 'write'))
+      (await sysClipboardGuard(clipboardSharing, 'write'))
     ) {
       await navigator.clipboard.writeText(clipboardData.data);
       latestClipboardDigest.current = await sha256Digest(
@@ -124,15 +129,16 @@ export default function useDesktopSession(
   const onShareDirectory = async () => {
     try {
       await tdpClient.shareDirectory();
-      setDirectorySharingState(prevState => ({
-        ...prevState,
+      setDirectorySharingState({
         directorySelected: true,
-      }));
+      });
     } catch (e) {
-      setDirectorySharingState(prevState => ({
-        ...prevState,
+      if (isAbortError(e)) {
+        return;
+      }
+      setDirectorySharingState({
         directorySelected: false,
-      }));
+      });
       addAlert({
         severity: 'warn',
         content: {
@@ -143,11 +149,17 @@ export default function useDesktopSession(
     }
   };
 
+  /** Clears sharing state. */
+  const clearSharing = useCallback(() => {
+    setDirectorySharingState({
+      directorySelected: false,
+    });
+  }, []);
+
   return {
-    clipboardSharingState,
-    setClipboardSharingState,
-    directorySharingState,
-    setDirectorySharingState,
+    clipboardSharingState: clipboardSharing,
+    directorySharingState: directorySharing,
+    clearSharing,
     onShareDirectory,
     alerts,
     onRemoveAlert,
@@ -311,15 +323,6 @@ export function isSharingDirectory(
   );
 }
 
-export const defaultDirectorySharingState: DirectorySharingState = {
-  browserSupported: navigator.userAgent.includes('Chrome'),
-  directorySelected: false,
-};
-
-export const defaultClipboardSharingState: ClipboardSharingState = {
-  browserSupported: navigator.userAgent.includes('Chrome'),
-};
-
 /**
  * To be called before any system clipboard read/write operation.
  */
diff --git a/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.test.tsx b/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.test.tsx
new file mode 100644
index 0000000000000..516572b987da0
--- /dev/null
+++ b/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.test.tsx
@@ -0,0 +1,198 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useSuspenseQuery } from '@tanstack/react-query';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+import type { FallbackProps } from 'react-error-boundary';
+
+import {
+  createDeferredResponse,
+  render,
+  screen,
+  testQueryClient,
+} from 'design/utils/testing';
+
+import { ErrorSuspenseWrapper } from './ErrorSuspenseWrapper';
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+afterEach(() => {
+  server.resetHandlers();
+  testQueryClient.clear();
+});
+afterAll(() => server.close());
+
+function TestErrorComponent({ error, resetErrorBoundary }: FallbackProps) {
+  return (
+    <div>
+      <div role="alert">Error: {error.message}</div>
+      <button onClick={resetErrorBoundary}>Reset</button>
+    </div>
+  );
+}
+
+function TestLoadingComponent() {
+  return <div>Loading...</div>;
+}
+
+interface TestChildComponentProps {
+  shouldError?: boolean;
+}
+
+function TestChildComponent({ shouldError = false }: TestChildComponentProps) {
+  const { data } = useSuspenseQuery({
+    queryKey: ['test'],
+    queryFn: async () => {
+      const response = await fetch('/api/test');
+
+      if (!response.ok) {
+        throw new Error('Failed to fetch');
+      }
+
+      return response.json();
+    },
+    retry: false,
+  });
+
+  if (shouldError) {
+    throw new Error('Component error');
+  }
+
+  return <div>Data: {data?.message}</div>;
+}
+
+test('renders loading component during suspense', async () => {
+  const deferred = createDeferredResponse({ message: 'Success' });
+
+  server.use(http.get('/api/test', deferred.handler));
+
+  render(
+    <ErrorSuspenseWrapper
+      errorComponent={TestErrorComponent}
+      loadingComponent={TestLoadingComponent}
+    >
+      <TestChildComponent />
+    </ErrorSuspenseWrapper>
+  );
+
+  expect(screen.getByText('Loading...')).toBeInTheDocument();
+
+  deferred.resolve();
+
+  expect(await screen.findByText('Data: Success')).toBeInTheDocument();
+});
+
+test('renders children when loaded successfully', async () => {
+  server.use(
+    http.get('/api/test', () => HttpResponse.json({ message: 'Success' }))
+  );
+
+  render(
+    <ErrorSuspenseWrapper
+      errorComponent={TestErrorComponent}
+      loadingComponent={TestLoadingComponent}
+    >
+      <TestChildComponent />
+    </ErrorSuspenseWrapper>
+  );
+
+  expect(await screen.findByText('Data: Success')).toBeInTheDocument();
+
+  expect(screen.queryByText('Loading...')).not.toBeInTheDocument();
+  expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+});
+
+test('renders error component when query fails', async () => {
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+
+  server.use(http.get('/api/test', () => HttpResponse.error()));
+
+  render(
+    <ErrorSuspenseWrapper
+      errorComponent={TestErrorComponent}
+      loadingComponent={TestLoadingComponent}
+    >
+      <TestChildComponent />
+    </ErrorSuspenseWrapper>
+  );
+
+  expect(await screen.findByRole('alert')).toHaveTextContent(
+    'Error: Failed to fetch'
+  );
+
+  expect(screen.queryByText('Loading...')).not.toBeInTheDocument();
+});
+
+test('renders error component when child throws', async () => {
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+
+  server.use(
+    http.get('/api/test', () => HttpResponse.json({ message: 'Success' }))
+  );
+
+  render(
+    <ErrorSuspenseWrapper
+      errorComponent={TestErrorComponent}
+      loadingComponent={TestLoadingComponent}
+    >
+      <TestChildComponent shouldError={true} />
+    </ErrorSuspenseWrapper>
+  );
+
+  expect(await screen.findByRole('alert')).toHaveTextContent(
+    'Error: Component error'
+  );
+});
+
+test('resets error boundary and refetches query on reset', async () => {
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+
+  server.use(http.get('/api/test', () => HttpResponse.error()));
+
+  render(
+    <ErrorSuspenseWrapper
+      errorComponent={TestErrorComponent}
+      loadingComponent={TestLoadingComponent}
+    >
+      <TestChildComponent />
+    </ErrorSuspenseWrapper>
+  );
+
+  expect(await screen.findByRole('alert')).toHaveTextContent(
+    'Error: Failed to fetch'
+  );
+
+  const deferred = createDeferredResponse({ message: 'Success after retry' });
+
+  server.use(http.get('/api/test', deferred.handler));
+
+  await userEvent.click(screen.getByText('Reset'));
+
+  expect(await screen.findByText('Loading...')).toBeInTheDocument();
+
+  deferred.resolve();
+
+  expect(
+    await screen.findByText('Data: Success after retry')
+  ).toBeInTheDocument();
+
+  expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+});
diff --git a/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.tsx b/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.tsx
new file mode 100644
index 0000000000000..3ce1a364fb26d
--- /dev/null
+++ b/web/packages/shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper.tsx
@@ -0,0 +1,73 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryErrorResetBoundary } from '@tanstack/react-query';
+import { Suspense, type ComponentType, type PropsWithChildren } from 'react';
+import { ErrorBoundary, type FallbackProps } from 'react-error-boundary';
+
+interface ErrorSuspenseWrapperProps {
+  errorComponent: ComponentType<FallbackProps>;
+  loadingComponent: ComponentType;
+}
+
+/**
+ * ErrorSuspenseWrapper is a component that wraps its children in a
+ * react-error-boundary ErrorBoundary, a react-query QueryErrorResetBoundary and
+ * a Suspense component.
+ *
+ * It provides an easy way to add a retry mechanism for queries that fail.
+ *
+ * Example usage:
+ *
+ * ```tsx
+ * <ErrorSuspenseWrapper
+ *  errorComponent={MyErrorComponent}
+ *  loadingComponent={MyLoadingComponent}
+ * >
+ *  <MyComponent />
+ * </ErrorSuspenseWrapper>
+ * ```
+ *
+ * ```tsx
+ * import type { FallbackProps } from 'react-error-boundary';
+ *
+ * function MyErrorComponent({ error, resetErrorBoundary }: FallbackProps) {
+ *   return (
+ *     <div>
+ *       <div role="alert">Error: {error.message}</div>
+ *       <button onClick={resetErrorBoundary}>Retry</button>
+ *     </div>
+ *   );
+ * }
+ * ```
+ */
+export function ErrorSuspenseWrapper(
+  props: PropsWithChildren<ErrorSuspenseWrapperProps>
+) {
+  return (
+    <QueryErrorResetBoundary>
+      {({ reset }) => (
+        <ErrorBoundary FallbackComponent={props.errorComponent} onReset={reset}>
+          <Suspense fallback={<props.loadingComponent />}>
+            {props.children}
+          </Suspense>
+        </ErrorBoundary>
+      )}
+    </QueryErrorResetBoundary>
+  );
+}
diff --git a/web/packages/shared/components/FieldCheckbox/FieldCheckbox.story.tsx b/web/packages/shared/components/FieldCheckbox/FieldCheckbox.story.tsx
index 3c940aeb61a0c..0d095d80cdb29 100644
--- a/web/packages/shared/components/FieldCheckbox/FieldCheckbox.story.tsx
+++ b/web/packages/shared/components/FieldCheckbox/FieldCheckbox.story.tsx
@@ -16,49 +16,77 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
+
 import Box from 'design/Box';
 
-import { FieldCheckbox } from '.';
+import { FieldCheckbox as Component } from '.';
+
+type StoryProps = {
+  readOnly?: boolean;
+  disabled?: boolean;
+};
 
-export default {
+const meta: Meta<StoryProps> = {
   title: 'Shared',
+  component: FieldCheckbox,
+  args: {
+    readOnly: false,
+    disabled: false,
+  },
 };
+export default meta;
 
-export const FieldCheckboxStory = () => (
-  <Box width={600}>
-    <FieldCheckbox label="Unchecked checkbox" defaultChecked={false} />
-    <FieldCheckbox label="Checked checkbox" defaultChecked={true} />
-    <FieldCheckbox label="Disabled checkbox" disabled />
-    <FieldCheckbox size="small" label="Small checkbox" defaultChecked={true} />
-    <FieldCheckbox
-      label="Checkbox with helper text"
-      helperText="I'm a helpful helper text"
-      defaultChecked={true}
-    />
-    <FieldCheckbox
-      size="small"
-      label="Small checkbox with helper text"
-      helperText="Another helpful helper text"
-    />
-    <FieldCheckbox
-      disabled
-      label="Disabled checkbox with helper text"
-      helperText="There's nothing you can do here"
-      defaultChecked={true}
-    />
-    <FieldCheckbox
-      label="To check, or not to check: that is the question:
+export function FieldCheckbox(props: StoryProps) {
+  return (
+    <Box width={600}>
+      <Component
+        label="Unchecked checkbox"
+        defaultChecked={false}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        label="Checked checkbox"
+        defaultChecked={true}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        size="small"
+        label="Small checkbox"
+        defaultChecked={true}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        label="Checkbox with helper text"
+        helperText="I'm a helpful helper text"
+        defaultChecked={true}
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        size="small"
+        label="Small checkbox with helper text"
+        helperText="Another helpful helper text"
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+      <Component
+        label="To check, or not to check: that is the question:
       Whether 'tis nobler in the mind to suffer
       The slings and arrows of outrageous fortune,
       Or to take arms against a sea of troubles,
       And by opposing end them?"
-      helperText="To uncheck: to sleep;
+        helperText="To uncheck: to sleep;
       No more; and by a sleep to say we end
       The heart-ache and the thousand natural shocks
       That flesh is heir to, 'tis a consummation
       Devoutly to be wish'd."
-    />
-  </Box>
-);
-
-FieldCheckboxStory.storyName = 'FieldCheckbox';
+        disabled={props.disabled}
+        readOnly={props.readOnly}
+      />
+    </Box>
+  );
+}
diff --git a/web/packages/shared/components/FieldCheckbox/FieldCheckbox.tsx b/web/packages/shared/components/FieldCheckbox/FieldCheckbox.tsx
index 69b7e45ed0ea0..15c59828d3a50 100644
--- a/web/packages/shared/components/FieldCheckbox/FieldCheckbox.tsx
+++ b/web/packages/shared/components/FieldCheckbox/FieldCheckbox.tsx
@@ -32,7 +32,15 @@ interface FieldCheckboxProps extends SpaceProps {
   helperText?: React.ReactNode;
   checked?: boolean;
   defaultChecked?: boolean;
+  /**
+   * Disables and mutes all values.
+   */
   disabled?: boolean;
+  /**
+   * Disables checkbox but does not mute values
+   * to remain readable.
+   */
+  readOnly?: boolean;
   size?: CheckboxSize;
   onChange?: (e: React.ChangeEvent<HTMLInputElement>) => void;
 }
@@ -47,6 +55,7 @@ export const FieldCheckbox = forwardRef<HTMLInputElement, FieldCheckboxProps>(
       checked,
       defaultChecked,
       disabled,
+      readOnly,
       size,
       onChange,
       ...styles
@@ -59,7 +68,7 @@ export const FieldCheckbox = forwardRef<HTMLInputElement, FieldCheckboxProps>(
     const helperTypography = size === 'small' ? 'body3' : 'body2';
     return (
       <Box mb={3} lineHeight={0} {...styles}>
-        <StyledLabel disabled={disabled}>
+        <StyledLabel disabled={disabled} readOnly={readOnly}>
           <Flex flexDirection="row" gap={2}>
             {/* Nudge the small-size checkbox to better align with the
                 label. */}
@@ -72,6 +81,7 @@ export const FieldCheckbox = forwardRef<HTMLInputElement, FieldCheckboxProps>(
                 disabled={disabled}
                 name={name}
                 onChange={onChange}
+                readOnly={readOnly}
               />
             </Box>
             <Box>
@@ -89,7 +99,10 @@ export const FieldCheckbox = forwardRef<HTMLInputElement, FieldCheckboxProps>(
   }
 );
 
-const StyledLabel = styled(LabelInput)<{ disabled?: boolean }>`
+const StyledLabel = styled(LabelInput)<{
+  disabled?: boolean;
+  readOnly?: boolean;
+}>`
   // Typically, a short label in a wide container means a lot of whitespace that
   // acts as a click target for a checkbox. To avoid this, we use inline-flex to
   // wrap the label around its content.
@@ -98,5 +111,6 @@ const StyledLabel = styled(LabelInput)<{ disabled?: boolean }>`
   gap: ${props => props.theme.space[2]}px;
   margin-bottom: 0;
   line-height: 0;
-  cursor: ${props => (props.disabled ? 'not-allowed' : 'pointer')};
+  cursor: ${props =>
+    props.disabled || props.readOnly ? 'not-allowed' : 'pointer'};
 `;
diff --git a/web/packages/shared/components/FieldInput/FieldInput.story.tsx b/web/packages/shared/components/FieldInput/FieldInput.story.tsx
index 767e6eca66f76..bc9d3b0bad420 100644
--- a/web/packages/shared/components/FieldInput/FieldInput.story.tsx
+++ b/web/packages/shared/components/FieldInput/FieldInput.story.tsx
@@ -16,69 +16,97 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
+
 import { ButtonPrimary, Text } from 'design';
 import { EmailSolid } from 'design/Icon';
 
 import Validation from '../../components/Validation';
 import { requiredEmailLike, requiredField } from '../Validation/rules';
-import FieldInput from './FieldInput';
+import FieldInputComponent from './FieldInput';
 
-export default {
-  title: 'Shared',
+type StoryProps = {
+  readOnly?: boolean;
+  disabled?: boolean;
 };
 
-export const Fields = () => (
-  <Validation>
-    {({ validator }) => (
-      <>
-        <FieldInput
-          label="Label"
-          helperText="Optional helper text"
-          name="optional name"
-          onChange={() => {}}
-          value={'value'}
-          icon={EmailSolid}
-          size="large"
-          rule={requiredEmailLike}
-        />
-        <FieldInput
-          label="Label with placeholder"
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-        />
-        <FieldInput
-          label="Label with tooltip"
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-          toolTipContent={<Text>Hello world</Text>}
-        />
-        <FieldInput
-          label="Label with helper text and tooltip"
-          helperText="Helper text"
-          toolTipContent={<Text>Hello world</Text>}
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-        />
-        <FieldInput placeholder="without label" onChange={() => {}} />
-        <FieldInput
-          label="Required"
-          rule={requiredField('So required. Much mandatory.')}
-          required
-          onChange={() => {}}
-          value=""
-        />
-        <ButtonPrimary onClick={() => validator.validate()}>
-          Validate
-        </ButtonPrimary>
-      </>
-    )}
-  </Validation>
-);
+const meta: Meta<StoryProps> = {
+  title: 'Shared',
+  component: FieldInput,
+  args: {
+    readOnly: false,
+    disabled: false,
+  },
+};
+export default meta;
 
-Fields.storyName = 'FieldInput';
+export function FieldInput(props: StoryProps) {
+  return (
+    <Validation>
+      {({ validator }) => (
+        <>
+          <FieldInputComponent
+            label="Label"
+            helperText="Optional bottom helper text"
+            name="optional name"
+            onChange={() => {}}
+            value={'value'}
+            icon={EmailSolid}
+            size="large"
+            rule={requiredEmailLike}
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <FieldInputComponent
+            label="Label with placeholder"
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <FieldInputComponent
+            label="Label with tooltip"
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            toolTipContent={<Text>Hello world</Text>}
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <FieldInputComponent
+            label="Label with helper text and tooltip"
+            helperText="Bottom helper text"
+            toolTipContent={<Text>Hello world</Text>}
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <FieldInputComponent
+            placeholder="without label"
+            onChange={() => {}}
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <FieldInputComponent
+            label="Required"
+            rule={requiredField('So required. Much mandatory.')}
+            required
+            onChange={() => {}}
+            value=""
+            disabled={props.disabled}
+            readonly={props.readOnly}
+          />
+          <ButtonPrimary onClick={() => validator.validate()}>
+            Validate
+          </ButtonPrimary>
+        </>
+      )}
+    </Validation>
+  );
+}
diff --git a/web/packages/shared/components/FieldMultiInput/FieldMultiInput.story.tsx b/web/packages/shared/components/FieldMultiInput/FieldMultiInput.story.tsx
index 93fa3357b4c8c..d5a766ff067a8 100644
--- a/web/packages/shared/components/FieldMultiInput/FieldMultiInput.story.tsx
+++ b/web/packages/shared/components/FieldMultiInput/FieldMultiInput.story.tsx
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import Box from 'design/Box';
@@ -23,20 +24,31 @@ import { Button } from 'design/Button';
 import Validation from 'shared/components/Validation';
 
 import { arrayOf, requiredField } from '../Validation/rules';
-import { FieldMultiInput } from './FieldMultiInput';
+import { FieldMultiInput as Component } from './FieldMultiInput';
 
-export default {
+type StoryProps = {
+  readOnly?: boolean;
+  disabled?: boolean;
+};
+
+const meta: Meta<StoryProps> = {
   title: 'Shared',
+  component: FieldMultiInput,
+  args: {
+    readOnly: false,
+    disabled: false,
+  },
 };
+export default meta;
 
-export function Story() {
+export function FieldMultiInput(props: StoryProps) {
   const [items, setItems] = useState([]);
   return (
     <Box width="500px">
       <Validation>
         {({ validator }) => (
           <>
-            <FieldMultiInput
+            <Component
               label="Some items"
               value={items}
               onChange={setItems}
@@ -44,6 +56,8 @@ export function Story() {
               required
               tooltipContent="I'm a sticky tooltip."
               tooltipSticky
+              disabled={props.disabled}
+              readOnly={props.readOnly}
             />
             <Button mt={3} onClick={() => validator.validate()}>
               Validate
@@ -54,4 +68,3 @@ export function Story() {
     </Box>
   );
 }
-Story.storyName = 'FieldMultiInput';
diff --git a/web/packages/shared/components/FieldMultiInput/FieldMultiInput.tsx b/web/packages/shared/components/FieldMultiInput/FieldMultiInput.tsx
index e07f1b3963206..efce63da75ee1 100644
--- a/web/packages/shared/components/FieldMultiInput/FieldMultiInput.tsx
+++ b/web/packages/shared/components/FieldMultiInput/FieldMultiInput.tsx
@@ -48,7 +48,15 @@ type StringListValidationResult = ValidationResult & {
 export type FieldMultiInputProps = {
   label?: string;
   value: string[];
+  /**
+   * Disables and mutes all controls and values.
+   */
   disabled?: boolean;
+  /**
+   * Disables inputs and hides controls
+   * but does not mute values.
+   */
+  readOnly?: boolean;
   /** Adds a required field indicator to the label. */
   required?: boolean;
   tooltipContent?: ReactNode;
@@ -69,6 +77,7 @@ export function FieldMultiInput({
   label,
   value,
   disabled,
+  readOnly,
   required,
   tooltipContent,
   tooltipSticky,
@@ -164,28 +173,35 @@ export function FieldMultiInput({
                   }
                   onKeyDown={e => handleKeyDown(i, e)}
                   mb={0}
+                  readonly={readOnly}
+                  disabled={disabled}
                 />
               </Box>
-              <ButtonIcon
-                size="0"
-                title="Remove Item"
-                onClick={() => removeItem(i)}
-                disabled={disabled}
-              >
-                <Icon.Cross size="small" color={theme.colors.text.muted} />
-              </ButtonIcon>
+              {!readOnly && (
+                <ButtonIcon
+                  size="0"
+                  title="Remove Item"
+                  onClick={() => removeItem(i)}
+                  disabled={disabled}
+                >
+                  <Icon.Cross size="small" color={theme.colors.text.muted} />
+                </ButtonIcon>
+              )}
             </Flex>
           );
         })}
-        <ButtonSecondary
-          alignSelf="start"
-          size="small"
-          inputAlignment
-          onClick={() => insertItem(value.length)}
-        >
-          <Icon.Plus size="small" mr={2} />
-          Add More
-        </ButtonSecondary>
+        {!readOnly && (
+          <ButtonSecondary
+            alignSelf="start"
+            size="small"
+            $inputAlignment
+            onClick={() => insertItem(value.length)}
+            disabled={disabled}
+          >
+            <Icon.Plus size="small" mr={2} />
+            Add More
+          </ButtonSecondary>
+        )}
       </Fieldset>
     </Box>
   );
diff --git a/web/packages/shared/components/FieldSelect/FieldSelect.story.tsx b/web/packages/shared/components/FieldSelect/FieldSelect.story.tsx
index 4e500d3ec5ef0..7eee8a3b58872 100644
--- a/web/packages/shared/components/FieldSelect/FieldSelect.story.tsx
+++ b/web/packages/shared/components/FieldSelect/FieldSelect.story.tsx
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import { Flex } from 'design';
@@ -24,16 +25,30 @@ import Validation from 'shared/components/Validation';
 import { wait } from 'shared/utils/wait';
 
 import { requiredField } from '../Validation/rules';
-import { FieldSelect, FieldSelectAsync } from './FieldSelect';
+import {
+  FieldSelectAsync as FieldSelectAsyncComp,
+  FieldSelect as FieldSelectComp,
+} from './FieldSelect';
 import {
   FieldSelectCreatable,
   FieldSelectCreatableAsync,
 } from './FieldSelectCreatable';
 
-export default {
-  title: 'Shared/FieldSelect',
+type StoryProps = {
+  readOnly?: boolean;
+  isDisabled?: boolean;
 };
 
+const meta: Meta<StoryProps> = {
+  title: 'Shared',
+  component: FieldSelect,
+  args: {
+    readOnly: false,
+    isDisabled: false,
+  },
+};
+export default meta;
+
 function noPenguinsAllowed(opt: Option) {
   return () =>
     opt.value !== 'linux'
@@ -48,9 +63,12 @@ function noPenguinsAllowedInArray(opt: Option[]) {
       : { valid: false, message: 'No penguins allowed' };
 }
 
-export function Default() {
+export function FieldSelect(props: StoryProps) {
   const [selectedOption, setSelectedOption] = useState<Option>(OPTIONS[0]);
-  const [selectedOptions, setSelectedOptions] = useState<readonly Option[]>([]);
+  const [selectedOptions, setSelectedOptions] = useState<readonly Option[]>([
+    OPTIONS[0],
+    OPTIONS[1],
+  ]);
   return (
     <Validation>
       {({ validator }) => {
@@ -60,29 +78,35 @@ export function Default() {
         }
         return (
           <Flex flexDirection="column">
-            <FieldSelect
+            <FieldSelectComp
               label="FieldSelect with search"
               onChange={option => setSelectedOption(option)}
               value={selectedOption}
               isSearchable
               options={OPTIONS}
               helperText="And a helper text"
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelect
+            <FieldSelectComp
               label="FieldSelect with validation rule"
               onChange={option => setSelectedOption(option)}
               rule={noPenguinsAllowed}
               value={selectedOption}
               options={OPTIONS}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelect
+            <FieldSelectComp
               label="FieldSelect, multi-select"
               isMulti
               options={OPTIONS}
               value={selectedOptions}
               onChange={setSelectedOptions}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelect
+            <FieldSelectComp
               label="FieldSelect, multi-select, required, with tooltip"
               isMulti
               options={OPTIONS}
@@ -91,8 +115,10 @@ export function Default() {
               rule={requiredField('Field is required')}
               required
               toolTipContent="I'm a tooltip."
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelectAsync
+            <FieldSelectAsyncComp
               label="FieldSelectAsync with search"
               onChange={option => setSelectedOption(option)}
               value={selectedOption}
@@ -102,8 +128,10 @@ export function Default() {
                 return OPTIONS.filter(o => o.label.includes(input));
               }}
               noOptionsMessage={() => 'No options'}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelectAsync
+            <FieldSelectAsyncComp
               label="FieldSelectAsync with search and validation rule"
               onChange={option => setSelectedOption(option)}
               rule={noPenguinsAllowed}
@@ -114,8 +142,10 @@ export function Default() {
                 return OPTIONS.filter(o => o.label.includes(input));
               }}
               noOptionsMessage={() => 'No options'}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelectAsync
+            <FieldSelectAsyncComp
               label="FieldSelectAsync with error"
               onChange={undefined}
               value={undefined}
@@ -125,8 +155,10 @@ export function Default() {
                 throw new Error('Network error');
               }}
               noOptionsMessage={() => 'No options'}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
-            <FieldSelectAsync
+            <FieldSelectAsyncComp
               label="Empty FieldSelectAsync"
               onChange={undefined}
               value={undefined}
@@ -136,6 +168,8 @@ export function Default() {
                 return [];
               }}
               noOptionsMessage={() => 'No options'}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
             <FieldSelectCreatable
               label="FieldSelectCreatable, multi-select"
@@ -144,6 +178,8 @@ export function Default() {
               value={selectedOptions}
               isSearchable
               options={OPTIONS}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
             <FieldSelectCreatable
               label="FieldSelectCreatable, multi-select, with validation rule"
@@ -153,6 +189,8 @@ export function Default() {
               value={selectedOptions}
               isSearchable
               options={OPTIONS}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
             <FieldSelectCreatableAsync
               label="FieldSelectCreatableAsync, multi-select"
@@ -166,6 +204,8 @@ export function Default() {
                 return OPTIONS.filter(o => o.label.includes(input));
               }}
               noOptionsMessage={() => 'No options'}
+              isDisabled={props.isDisabled}
+              readOnly={props.readOnly}
             />
           </Flex>
         );
@@ -174,8 +214,6 @@ export function Default() {
   );
 }
 
-Default.storyName = 'FieldSelect';
-
 const OPTIONS = [
   { value: 'mac', label: 'Mac' },
   {
@@ -183,4 +221,5 @@ const OPTIONS = [
     label: 'Windows',
   },
   { value: 'linux', label: 'Linux' },
+  { value: 'mobile', label: 'Mobile' },
 ];
diff --git a/web/packages/shared/components/FieldSelect/FieldSelectCreatable.story.tsx b/web/packages/shared/components/FieldSelect/FieldSelectCreatable.story.tsx
deleted file mode 100644
index 4c5cf6d320f00..0000000000000
--- a/web/packages/shared/components/FieldSelect/FieldSelectCreatable.story.tsx
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useState } from 'react';
-
-import { Flex } from 'design';
-import { Option } from 'shared/components/Select';
-import Validation from 'shared/components/Validation';
-import { wait } from 'shared/utils/wait';
-
-import {
-  FieldSelectCreatable,
-  FieldSelectCreatableAsync,
-} from './FieldSelectCreatable';
-
-export default {
-  title: 'Shared/FieldSelectCreatable',
-};
-
-export function Default() {
-  const [selectedOptions, setSelectedOption] = useState<Option[]>([OPTIONS[0]]);
-  return (
-    <Validation>
-      {() => (
-        <Flex flexDirection="column">
-          <FieldSelectCreatable
-            inputId="test1"
-            label="FieldSelectCreatable multi"
-            onChange={option => setSelectedOption(option as Option[])}
-            value={selectedOptions}
-            isSearchable
-            options={OPTIONS}
-            isMulti
-          />
-          <FieldSelectCreatableAsync
-            inputId="test2"
-            label="FieldSelectCreatableAsync multi"
-            onChange={option => setSelectedOption(option as Option[])}
-            value={selectedOptions}
-            isSearchable
-            isMulti
-            loadOptions={async input => {
-              await wait(400);
-              return OPTIONS.filter(o => o.label.toLowerCase().includes(input));
-            }}
-            defaultOptions={true}
-            noOptionsMessage={() => 'No options'}
-          />
-          <FieldSelectCreatableAsync
-            inputId="test3"
-            label="FieldSelectCreatableAsync with error"
-            onChange={undefined}
-            value={undefined}
-            isSearchable
-            isMulti
-            defaultOptions={true}
-            loadOptions={async () => {
-              await wait(400);
-              return Promise.reject<Option[]>('Network error');
-            }}
-            noOptionsMessage={() => 'No options'}
-          />
-        </Flex>
-      )}
-    </Validation>
-  );
-}
-
-Default.storyName = 'FieldSelectCreatable';
-
-const OPTIONS = [
-  { value: 'mac', label: 'Mac' },
-  {
-    value: 'windows',
-    label: 'Windows',
-  },
-  { value: 'linux', label: 'Linux' },
-];
diff --git a/web/packages/shared/components/FieldSelect/FieldSelectCreatable.tsx b/web/packages/shared/components/FieldSelect/FieldSelectCreatable.tsx
index f2ce3c4aeeb7f..8b2acf7944889 100644
--- a/web/packages/shared/components/FieldSelect/FieldSelectCreatable.tsx
+++ b/web/packages/shared/components/FieldSelect/FieldSelectCreatable.tsx
@@ -58,11 +58,12 @@ export function FieldSelectCreatable<
     Group,
     typeof props
   >(props, {});
-  const { formatCreateLabel, ...styles } = others;
+  const { formatCreateLabel, filterOption, ...styles } = others;
   return (
     <FieldSelectWrapper {...wrapper} {...styles}>
       <SelectCreatable<Opt, IsMulti, Group>
         {...base}
+        filterOption={filterOption}
         formatCreateLabel={formatCreateLabel}
       />
     </FieldSelectWrapper>
diff --git a/web/packages/shared/components/FieldSelect/shared.tsx b/web/packages/shared/components/FieldSelect/shared.tsx
index e6a11254647e8..35849dda1829c 100644
--- a/web/packages/shared/components/FieldSelect/shared.tsx
+++ b/web/packages/shared/components/FieldSelect/shared.tsx
@@ -192,6 +192,7 @@ export function splitSelectProps<
     inputValue,
     isClearable,
     isDisabled,
+    readOnly,
     isMulti,
     isSearchable,
     label,
@@ -237,6 +238,7 @@ export function splitSelectProps<
       inputValue,
       isClearable,
       isDisabled,
+      readOnly,
       isMulti,
       isSearchable,
       maxMenuHeight,
@@ -285,6 +287,7 @@ type KeysRemovedFromOthers =
   | 'inputValue'
   | 'isClearable'
   | 'isDisabled'
+  | 'readOnly'
   | 'isMulti'
   | 'isSearchable'
   | 'label'
diff --git a/web/packages/shared/components/FieldTextArea/FieldTextArea.story.tsx b/web/packages/shared/components/FieldTextArea/FieldTextArea.story.tsx
index dab7db2123f33..292c74cf32cb2 100644
--- a/web/packages/shared/components/FieldTextArea/FieldTextArea.story.tsx
+++ b/web/packages/shared/components/FieldTextArea/FieldTextArea.story.tsx
@@ -16,66 +16,96 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
+
 import { ButtonPrimary, Text } from 'design';
 
 import Validation from '../../components/Validation';
 import { requiredField } from '../Validation/rules';
-import { FieldTextArea } from './FieldTextArea';
+import { FieldTextArea as Component } from './FieldTextArea';
+
+type StoryProps = {
+  readonly?: boolean;
+  disabled?: boolean;
+};
 
-export default {
-  title: 'Shared/FieldTextArea',
+const meta: Meta<StoryProps> = {
+  title: 'Shared',
+  component: FieldTextArea,
+  args: {
+    readonly: false,
+    disabled: false,
+  },
 };
+export default meta;
 
-export const Fields = () => (
-  <Validation>
-    {({ validator }) => (
-      <>
-        <FieldTextArea
-          label="Label"
-          helperText="Optional helper text"
-          name="optional name"
-          onChange={() => {}}
-          value={'value'}
-          size="large"
-        />
-        <FieldTextArea
-          label="Label with placeholder"
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-          rule={requiredField('So required. Much mandatory.')}
-          required
-        />
-        <FieldTextArea
-          label="Label with tooltip"
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-          tooltipContent={<Text>Hello world</Text>}
-        />
-        <FieldTextArea
-          label="Label with helper text and tooltip"
-          helperText="Helper text"
-          tooltipContent={<Text>Hello world</Text>}
-          name="optional name"
-          onChange={() => {}}
-          placeholder="placeholder"
-          value={''}
-        />
-        <FieldTextArea placeholder="without label" onChange={() => {}} />
-        <FieldTextArea
-          label="Required"
-          required
-          rule={requiredField('So required. Much mandatory.')}
-          onChange={() => {}}
-          value=""
-        />
-        <ButtonPrimary onClick={() => validator.validate()}>
-          Validate
-        </ButtonPrimary>
-      </>
-    )}
-  </Validation>
-);
+export function FieldTextArea(props: StoryProps) {
+  return (
+    <Validation>
+      {({ validator }) => (
+        <>
+          <Component
+            label="Label"
+            helperText="Optional helper text"
+            name="optional name"
+            onChange={() => {}}
+            value={'some value lorem ipsum dolores'}
+            size="large"
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <Component
+            label="Label with placeholder"
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            rule={requiredField('So required. Much mandatory.')}
+            required
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <Component
+            label="Label with tooltip"
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            tooltipContent={<Text>Hello world</Text>}
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <Component
+            label="Label with helper text and tooltip"
+            helperText="Helper text"
+            tooltipContent={<Text>Hello world</Text>}
+            name="optional name"
+            onChange={() => {}}
+            placeholder="placeholder"
+            value={''}
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <Component
+            placeholder="without label"
+            onChange={() => {}}
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <Component
+            label="Required"
+            required
+            rule={requiredField('So required. Much mandatory.')}
+            onChange={() => {}}
+            value=""
+            disabled={props.disabled}
+            readonly={props.readonly}
+          />
+          <ButtonPrimary onClick={() => validator.validate()}>
+            Validate
+          </ButtonPrimary>
+        </>
+      )}
+    </Validation>
+  );
+}
diff --git a/web/packages/shared/components/Markdown/Markdown.test.tsx b/web/packages/shared/components/Markdown/Markdown.test.tsx
new file mode 100644
index 0000000000000..2f248a286e514
--- /dev/null
+++ b/web/packages/shared/components/Markdown/Markdown.test.tsx
@@ -0,0 +1,623 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { screen } from '@testing-library/react';
+
+import { render } from 'design/utils/testing';
+
+import { Markdown, MarkdownOptions } from './Markdown';
+
+function renderMarkdown(text: string, opts: MarkdownOptions = {}) {
+  return render(<Markdown text={text} {...opts} />);
+}
+
+describe('Markdown', () => {
+  describe('inline formatting', () => {
+    it('renders bold text', () => {
+      renderMarkdown(`This is **bold** text`);
+
+      expect(screen.getByText('bold')).toBeInTheDocument();
+      expect(screen.getByText('bold').tagName).toBe('STRONG');
+    });
+
+    it('renders inline code', () => {
+      renderMarkdown(`This is \`code\` text`);
+
+      expect(screen.getByText('code')).toBeInTheDocument();
+      expect(screen.getByText('code').tagName).toBe('CODE');
+    });
+
+    it('renders links', () => {
+      renderMarkdown(`This is [a link](https://example.com) text`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByRole('link', { name: 'a link' });
+
+      expect(link).toBeInTheDocument();
+      expect(link).toHaveAttribute('href', 'https://example.com');
+    });
+
+    it('does not render links unless explicitly enabled', () => {
+      renderMarkdown(`This is [a link](https://example.com) text
+- a [link inside a list item](https://example.com)
+
+This is **a [link inside bold text](https://example.com)**,
+\`a [link inside inline code](https://example.com)\`,
+
+        `);
+
+      expect(screen.queryByRole('link')).not.toBeInTheDocument();
+      expect(
+        screen.getByText('This is [a link](https://example.com) text')
+      ).toBeInTheDocument();
+    });
+
+    it('renders multiple inline elements', () => {
+      renderMarkdown(
+        `**bold** and \`code\` and [link](https://example.com) together`,
+        { enableLinks: true }
+      );
+
+      expect(screen.getByText('bold')).toBeInTheDocument();
+      expect(screen.getByText('code')).toBeInTheDocument();
+      expect(screen.getByRole('link', { name: 'link' })).toBeInTheDocument();
+    });
+
+    it('handles nested markers correctly', () => {
+      renderMarkdown(`**bold \`code\` text**`);
+
+      const strong = screen.getByText((content, element) => {
+        return (
+          element.tagName === 'STRONG' &&
+          element.textContent === 'bold code text'
+        );
+      });
+
+      expect(strong).toBeInTheDocument();
+
+      const code = screen.getByText('code');
+
+      expect(code).toBeInTheDocument();
+
+      expect(code.tagName).toBe('CODE');
+    });
+
+    it('handles links with special characters in URL', () => {
+      renderMarkdown(`[link](https://example.com/path?query=1&foo=bar#hash)`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByRole('link', { name: 'link' });
+
+      expect(link).toHaveAttribute(
+        'href',
+        'https://example.com/path?query=1&foo=bar#hash'
+      );
+    });
+
+    it('renders links with correct formatting in text', () => {
+      renderMarkdown(`[**bold** link](https://example.com)`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByRole('link', { name: 'bold link' });
+
+      expect(link).toBeInTheDocument();
+      expect(link).toHaveAttribute('href', 'https://example.com');
+      expect(link.innerHTML).toContain('<strong>bold</strong> link');
+    });
+
+    it('renders links with code block in text', () => {
+      renderMarkdown(
+        '[`teleport-kube-agent`](https://goteleport.com/docs/reference/helm-reference/teleport-kube-agent/)',
+        { enableLinks: true }
+      );
+
+      const link = screen.getByRole('link', { name: 'teleport-kube-agent' });
+
+      expect(link).toBeInTheDocument();
+      expect(link).toHaveAttribute(
+        'href',
+        'https://goteleport.com/docs/reference/helm-reference/teleport-kube-agent/'
+      );
+      expect(link.tagName).toBe('A');
+      expect(link.innerHTML).toContain('<code>teleport-kube-agent</code>');
+    });
+  });
+
+  describe('headers', () => {
+    it('renders h1', () => {
+      renderMarkdown(`# Header 1`);
+
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: 'Header 1',
+        })
+      ).toBeInTheDocument();
+    });
+
+    it('renders h2 through h6', () => {
+      const text = `## Header 2
+### Header 3
+#### Header 4
+##### Header 5
+###### Header 6`;
+
+      renderMarkdown(text);
+
+      expect(
+        screen.getByRole('heading', {
+          level: 2,
+          name: 'Header 2',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 3,
+          name: 'Header 3',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 4,
+          name: 'Header 4',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 5,
+          name: 'Header 5',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 6,
+          name: 'Header 6',
+        })
+      ).toBeInTheDocument();
+    });
+
+    it('trims header content', () => {
+      renderMarkdown(`#   Spaced Header`);
+
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: 'Spaced Header',
+        })
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('lists', () => {
+    it('renders unordered list', () => {
+      const text = `- Item 1
+- Item 2
+- Item 3`;
+
+      renderMarkdown(text);
+
+      expect(screen.getByRole('list')).toBeInTheDocument();
+
+      const items = screen.getAllByRole('listitem');
+
+      expect(items).toHaveLength(3);
+
+      expect(items[0]).toHaveTextContent('Item 1');
+      expect(items[1]).toHaveTextContent('Item 2');
+      expect(items[2]).toHaveTextContent('Item 3');
+    });
+
+    it('renders list with inline formatting', () => {
+      const text = `- **Bold** item
+- Item with \`code\`
+- Item with [link](https://example.com)`;
+
+      renderMarkdown(text, { enableLinks: true });
+
+      expect(screen.getByText('Bold')).toBeInTheDocument();
+      expect(screen.getByText('Bold').tagName).toBe('STRONG');
+      expect(screen.getByText('code')).toBeInTheDocument();
+      expect(screen.getByText('code').tagName).toBe('CODE');
+      expect(screen.getByRole('link', { name: 'link' })).toBeInTheDocument();
+      expect(screen.getByRole('link', { name: 'link' })).toHaveAttribute(
+        'href',
+        'https://example.com'
+      );
+    });
+
+    it('stops list when non-list line encountered', () => {
+      const text = `- Item 1
+- Item 2
+Regular paragraph`;
+
+      renderMarkdown(text);
+
+      const items = screen.getAllByRole('listitem');
+
+      expect(items).toHaveLength(2);
+
+      expect(screen.getByText('Regular paragraph')).toBeInTheDocument();
+    });
+  });
+
+  describe('paragraphs', () => {
+    it('renders single line paragraph', () => {
+      renderMarkdown(`This is a paragraph`);
+
+      expect(screen.getByText('This is a paragraph')).toBeInTheDocument();
+    });
+
+    it('joins multiple lines into single paragraph', () => {
+      const text = `This is line one
+This is line two
+This is line three`;
+
+      renderMarkdown(text);
+
+      expect(
+        screen.getByText('This is line one This is line two This is line three')
+      ).toBeInTheDocument();
+    });
+
+    it('separates paragraphs by empty lines', () => {
+      const text = `First paragraph
+
+Second paragraph`;
+
+      renderMarkdown(text);
+
+      expect(screen.getByText('First paragraph')).toBeInTheDocument();
+      expect(screen.getByText('Second paragraph')).toBeInTheDocument();
+    });
+
+    it('renders paragraph with inline formatting', () => {
+      renderMarkdown(
+        `Paragraph with **bold** and \`code\` and [link](https://example.com)`,
+        { enableLinks: true }
+      );
+
+      expect(screen.getByText('bold')).toBeInTheDocument();
+      expect(screen.getByText('bold').tagName).toBe('STRONG');
+      expect(screen.getByText('code')).toBeInTheDocument();
+      expect(screen.getByText('code').tagName).toBe('CODE');
+      expect(screen.getByRole('link', { name: 'link' })).toBeInTheDocument();
+    });
+  });
+
+  describe('mixed content', () => {
+    it('renders complete document', () => {
+      const text = `# Main Title
+
+This is a paragraph with **bold** text and [a link](https://example.com).
+
+## Subsection
+
+Here is a list:
+- First item
+- Second item with \`code\`
+- Third item with [link](https://example.com)
+
+Another paragraph after the list.`;
+
+      renderMarkdown(text, { enableLinks: true });
+
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: 'Main Title',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 2,
+          name: 'Subsection',
+        })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText('This is a paragraph with', { exact: false })
+      ).toBeInTheDocument();
+      expect(screen.getByText('Here is a list:')).toBeInTheDocument();
+      expect(
+        screen.getByText('Another paragraph after the list.')
+      ).toBeInTheDocument();
+      expect(screen.getAllByRole('listitem')).toHaveLength(3);
+      expect(screen.getByText('bold')).toBeInTheDocument();
+      expect(screen.getByText('code')).toBeInTheDocument();
+      expect(screen.getAllByRole('link')).toHaveLength(2);
+    });
+
+    it('handles paragraph ending at header', () => {
+      const text = `This is a paragraph
+that continues
+# New Header`;
+
+      renderMarkdown(text);
+
+      expect(
+        screen.getByText('This is a paragraph that continues')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: 'New Header',
+        })
+      ).toBeInTheDocument();
+    });
+
+    it('handles paragraph ending at list', () => {
+      const text = `This is a paragraph
+that continues
+- List item`;
+
+      renderMarkdown(text);
+
+      expect(
+        screen.getByText('This is a paragraph that continues')
+      ).toBeInTheDocument();
+      expect(screen.getByRole('listitem')).toHaveTextContent('List item');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('handles empty string', () => {
+      renderMarkdown(``);
+
+      expect(screen.queryByRole('heading')).not.toBeInTheDocument();
+      expect(screen.queryByRole('list')).not.toBeInTheDocument();
+      expect(screen.queryByRole('listitem')).not.toBeInTheDocument();
+      expect(screen.queryByRole('link')).not.toBeInTheDocument();
+      expect(screen.queryByText(/.+/)).not.toBeInTheDocument();
+    });
+
+    it('handles only whitespace', () => {
+      renderMarkdown(`\n\n\n`);
+
+      expect(screen.queryByRole('heading')).not.toBeInTheDocument();
+      expect(screen.queryByRole('list')).not.toBeInTheDocument();
+      expect(screen.queryByRole('listitem')).not.toBeInTheDocument();
+      expect(screen.queryByRole('link')).not.toBeInTheDocument();
+    });
+
+    it('handles multiple consecutive empty lines', () => {
+      const text = `Paragraph 1
+
+
+Paragraph 2`;
+
+      renderMarkdown(text);
+
+      expect(screen.getByText('Paragraph 1')).toBeInTheDocument();
+      expect(screen.getByText('Paragraph 2')).toBeInTheDocument();
+    });
+
+    it('ignores list items without space after dash', () => {
+      const text = `-No space
+- With space`;
+
+      renderMarkdown(text);
+
+      const items = screen.getAllByRole('listitem');
+      expect(items).toHaveLength(1);
+      expect(items[0]).toHaveTextContent('With space');
+    });
+
+    it('handles unclosed inline markers', () => {
+      renderMarkdown(`**unclosed bold`);
+
+      expect(screen.queryByText('bold')).not.toBeInTheDocument();
+      expect(screen.getByText('**unclosed bold')).toBeInTheDocument();
+    });
+
+    it('handles unclosed links', () => {
+      renderMarkdown(`[unclosed link`, { enableLinks: true });
+
+      expect(screen.queryByRole('link')).not.toBeInTheDocument();
+      expect(screen.getByText('[unclosed link')).toBeInTheDocument();
+    });
+
+    it('handles links without URL', () => {
+      renderMarkdown(`[link text]()`, { enableLinks: true });
+
+      const link = screen.getByText('link text');
+
+      expect(link).not.toHaveAttribute('href');
+    });
+
+    it('handles empty link text', () => {
+      renderMarkdown(`[](https://example.com)`, { enableLinks: true });
+
+      const link = screen.getByRole('link', { name: '' });
+
+      expect(link).toBeInTheDocument();
+      expect(link).toHaveAttribute('href', 'https://example.com');
+    });
+  });
+
+  describe('memoization', () => {
+    it('returns same result for same input', () => {
+      const text = '# Header\n\nParagraph with [link](https://example.com)';
+
+      const { rerender } = renderMarkdown(text, { enableLinks: true });
+
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: 'Header',
+        })
+      ).toBeInTheDocument();
+      expect(screen.getByRole('link', { name: 'link' })).toBeInTheDocument();
+
+      const heading = screen.getByRole('heading', { level: 1 });
+      const link = screen.getByRole('link');
+
+      rerender(<Markdown text={text} enableLinks />);
+
+      expect(screen.getByRole('heading', { level: 1 })).toBe(heading);
+      expect(screen.getByRole('link')).toBe(link);
+    });
+
+    it('updates when text changes', () => {
+      const { rerender } = renderMarkdown(`Original`);
+
+      expect(screen.getByText('Original')).toBeInTheDocument();
+
+      rerender(<Markdown text="Updated" />);
+
+      expect(screen.queryByText('Original')).not.toBeInTheDocument();
+      expect(screen.getByText('Updated')).toBeInTheDocument();
+    });
+  });
+
+  describe('script injection prevention', () => {
+    it('does not execute inline scripts', () => {
+      renderMarkdown(`<script>alert('xss')</script>`);
+
+      expect(
+        screen.getByText("<script>alert('xss')</script>")
+      ).toBeInTheDocument();
+    });
+
+    it('does not execute scripts in markdown elements', () => {
+      renderMarkdown(`# Header <script>alert('xss')</script>`);
+
+      expect(
+        screen.getByRole('heading', {
+          level: 1,
+          name: "Header <script>alert('xss')</script>",
+        })
+      ).toBeInTheDocument();
+    });
+
+    it('does not execute javascript: URLs in links', () => {
+      renderMarkdown(`[Click me](javascript:alert('xss'))`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByText('Click me');
+
+      expect(link).not.toHaveAttribute('href', "javascript:alert('xss')");
+    });
+
+    it('renders script tags as plain text in paragraphs', () => {
+      renderMarkdown(`This is <script>alert('xss')</script> dangerous`);
+
+      expect(
+        screen.getByText("This is <script>alert('xss')</script> dangerous")
+      ).toBeInTheDocument();
+    });
+
+    it('renders script tags as plain text in lists', () => {
+      renderMarkdown(`- Item with <script>alert('xss')</script>`);
+
+      const listItem = screen.getByRole('listitem');
+      expect(listItem).toHaveTextContent(
+        "Item with <script>alert('xss')</script>"
+      );
+    });
+
+    it('does not render HTML tags', () => {
+      renderMarkdown(`<div onclick="alert('xss')">Click me</div>`);
+
+      expect(
+        screen.getByText('<div onclick="alert(\'xss\')">Click me</div>')
+      ).toBeInTheDocument();
+      expect(screen.queryByText('Click me')).not.toBeInTheDocument();
+    });
+
+    it('escapes HTML in bold text', () => {
+      renderMarkdown(`**<script>alert('xss')</script>**`);
+
+      const strong = screen.getByText("<script>alert('xss')</script>");
+      expect(strong.tagName).toBe('STRONG');
+      expect(strong.innerHTML).not.toContain('<script>');
+    });
+
+    it('escapes HTML in code blocks', () => {
+      renderMarkdown('`<script>alert("xss")</script>`');
+
+      const code = screen.getByText('<script>alert("xss")</script>');
+      expect(code.tagName).toBe('CODE');
+      expect(code.innerHTML).not.toContain('<script>');
+    });
+
+    it('does not execute scripts in link text', () => {
+      renderMarkdown(`[<script>alert('xss')</script>](https://example.com)`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByRole('link', {
+        name: "<script>alert('xss')</script>",
+      });
+      expect(link).toHaveAttribute('href', 'https://example.com');
+    });
+
+    it('handles data: URLs safely', () => {
+      renderMarkdown(
+        `[Click me](data:text/html,<script>alert('xss')</script>)`,
+        { enableLinks: true }
+      );
+
+      const link = screen.getByText('Click me');
+      expect(link).not.toHaveAttribute('href');
+    });
+
+    it('handles vbscript: URLs safely', () => {
+      renderMarkdown(`[Click me](vbscript:msgbox("xss"))`, {
+        enableLinks: true,
+      });
+
+      const link = screen.getByText('Click me');
+
+      expect(link).not.toHaveAttribute('href');
+    });
+
+    it('does not interpret HTML entities', () => {
+      renderMarkdown(`&lt;script&gt;alert('xss')&lt;/script&gt;`);
+
+      expect(
+        screen.getByText("&lt;script&gt;alert('xss')&lt;/script&gt;")
+      ).toBeInTheDocument();
+    });
+
+    it('handles mixed content with potential XSS', () => {
+      const text = `# Title <script>alert('xss')</script>
+
+This is **bold <script>alert('xss')</script>** text.
+
+- List with <script>alert('xss')</script>
+- [Link](javascript:alert('xss'))
+
+\`code <script>alert('xss')</script>\``;
+
+      renderMarkdown(text, { enableLinks: true });
+
+      expect(screen.getByRole('heading', { level: 1 })).toHaveTextContent(
+        "Title <script>alert('xss')</script>"
+      );
+      expect(
+        screen.getByText("bold <script>alert('xss')</script>")
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText("code <script>alert('xss')</script>")
+      ).toBeInTheDocument();
+    });
+  });
+});
diff --git a/web/packages/shared/components/Markdown/Markdown.tsx b/web/packages/shared/components/Markdown/Markdown.tsx
new file mode 100644
index 0000000000000..6af431f3c0959
--- /dev/null
+++ b/web/packages/shared/components/Markdown/Markdown.tsx
@@ -0,0 +1,262 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { createElement, useMemo, type ReactNode } from 'react';
+import styled from 'styled-components';
+
+export interface MarkdownOptions {
+  /**
+   * `true` if links should be rendered. Defaults to `false` to protect from
+   * rendering untrusted content posing as Teleport-approved link.
+   */
+  enableLinks?: boolean;
+}
+
+interface MarkdownParser {
+  condition?: (opts: MarkdownOptions) => boolean;
+  pattern: RegExp;
+  render: (
+    activeParsers: MarkdownParser[],
+    content: string,
+    key: string,
+    url?: string
+  ) => React.ReactNode;
+}
+
+interface EarliestMatch {
+  match: RegExpExecArray;
+  parser: MarkdownParser;
+}
+
+const StyledLink = styled.a`
+  font-style: unset;
+  color: ${p => p.theme.colors.buttons.link.default};
+  background: none;
+  text-decoration: underline;
+  text-transform: none;
+`;
+
+const parsers: MarkdownParser[] = [
+  {
+    pattern: /\*\*(?<content>[^*]+?)\*\*/,
+    render: (activeParsers, content, key) => (
+      <strong key={key}>{parseLine(activeParsers, content)}</strong>
+    ),
+  },
+  {
+    pattern: /`(?<content>[^`]+)`/,
+    render: (activeParsers, content, key) => <code key={key}>{content}</code>,
+  },
+  {
+    condition: (opts: MarkdownOptions) => !!opts.enableLinks,
+    pattern: /\[(?<content>[^\]]*)](?:\((?<url>https?:\/\/[^)]+|[^:)]+)\))?/,
+    render: (activeParsers, content, key, url) => (
+      <StyledLink key={key} href={url}>
+        {parseLine(activeParsers, content)}
+      </StyledLink>
+    ),
+  },
+];
+
+function parseLine(activeParsers: MarkdownParser[], line: string): ReactNode[] {
+  const items: ReactNode[] = [];
+
+  let remaining = line;
+
+  let key = 0;
+
+  while (remaining.length > 0) {
+    let earliestMatch: EarliestMatch | null = null;
+
+    for (const parser of activeParsers) {
+      if (parser.pattern.test(remaining)) {
+        const match = parser.pattern.exec(remaining);
+
+        if (
+          match &&
+          (!earliestMatch || match.index < earliestMatch.match.index)
+        ) {
+          earliestMatch = { match, parser };
+        }
+      }
+    }
+
+    if (!earliestMatch) {
+      items.push(remaining);
+
+      break;
+    }
+
+    const { match, parser } = earliestMatch;
+
+    if (match.index > 0) {
+      items.push(remaining.substring(0, match.index));
+    }
+
+    key += 1;
+
+    items.push(
+      parser.render(
+        activeParsers,
+        match.groups!.content,
+        `inline-${key}`,
+        match.groups?.url
+      )
+    );
+
+    remaining = remaining.substring(match.index + match[0].length);
+  }
+
+  return items;
+}
+
+const headerRegex = /^(?<hashes>#{1,6})\s*(?<content>.*)$/;
+
+const MAX_ITERATIONS = 10000;
+
+/**
+ * Turns a Markdown string into a list of React nodes. CAUTION: this function
+ * may handle untrusted user input, so think twice before extending it! If you
+ * extend it with something that may possibly cause a security issue if
+ * rendered, make sure to only enable it if a certain option is turned on and
+ * default to disabling it.
+ */
+function processMarkdown(text: string, options: MarkdownOptions): ReactNode[] {
+  if (!text) {
+    return [];
+  }
+
+  const activeParsers = parsers.filter(p => {
+    if (!p.condition) return true;
+    return p.condition(options);
+  });
+
+  const lines = text.split('\n');
+
+  const items: ReactNode[] = [];
+
+  let iterations = 0;
+  let i = 0;
+
+  while (i < lines.length) {
+    if (++iterations > MAX_ITERATIONS) {
+      // eslint-disable-next-line no-console
+      console.error(
+        `processMarkdown: Exceeded max iterations (${MAX_ITERATIONS})`
+      );
+      return items;
+    }
+
+    const line = lines[i].trim();
+
+    if (line.trim() === '') {
+      i += 1;
+
+      continue;
+    }
+
+    if (headerRegex.test(line)) {
+      const headerMatch = headerRegex.exec(line);
+
+      if (headerMatch) {
+        const [, hashes, content] = headerMatch;
+        const level = hashes.length;
+
+        items.push(createElement(`h${level}`, { key: i }, content.trim()));
+
+        i += 1;
+
+        continue;
+      }
+    }
+
+    if (line.trimStart().startsWith('- ')) {
+      const listItems: ReactNode[] = [];
+      const startI = i;
+
+      while (i < lines.length && lines[i].trimStart().startsWith('- ')) {
+        const firstDashIndex = lines[i].indexOf('- ');
+
+        listItems.push(
+          <li key={i}>
+            {parseLine(
+              activeParsers,
+              lines[i].substring(firstDashIndex + 2).trim()
+            )}
+          </li>
+        );
+
+        i += 1;
+
+        if (i - startI > MAX_ITERATIONS) {
+          break;
+        }
+      }
+
+      items.push(<ul key={i}>{listItems}</ul>);
+
+      continue;
+    }
+
+    const paragraphLines: string[] = [];
+    const startI = i;
+
+    while (i < lines.length && lines[i].trim() !== '') {
+      const currentLine = lines[i];
+
+      if (
+        headerRegex.test(currentLine) ||
+        currentLine.trim().startsWith('- ')
+      ) {
+        break;
+      }
+
+      paragraphLines.push(currentLine.trim());
+      i += 1;
+
+      if (i - startI > MAX_ITERATIONS) {
+        break;
+      }
+    }
+
+    if (paragraphLines.length > 0) {
+      items.push(
+        <p key={`p-${i}`}>
+          {parseLine(activeParsers, paragraphLines.join(' '))}
+        </p>
+      );
+    }
+
+    if (i === startI) {
+      i += 1;
+    }
+  }
+
+  return items;
+}
+
+export interface MarkdownProps extends MarkdownOptions {
+  text: string;
+}
+
+export function Markdown({ text, ...options }: MarkdownProps) {
+  return useMemo(
+    () => processMarkdown(text, options),
+    [text, ...Object.values(options)]
+  );
+}
diff --git a/web/packages/shared/components/MenuLogin/MenuLogin.tsx b/web/packages/shared/components/MenuLogin/MenuLogin.tsx
index 05f95961da07c..878e944827776 100644
--- a/web/packages/shared/components/MenuLogin/MenuLogin.tsx
+++ b/web/packages/shared/components/MenuLogin/MenuLogin.tsx
@@ -18,6 +18,7 @@
 
 import React, {
   ChangeEvent,
+  ComponentPropsWithoutRef,
   useImperativeHandle,
   useRef,
   useState,
@@ -48,6 +49,7 @@ export const MenuLogin = React.forwardRef<MenuLoginHandle, MenuLoginProps>(
       inputType = MenuInputType.INPUT,
       required = true,
       width,
+      buttonWidth,
       style,
     } = props;
     const [filter, setFilter] = useState('');
@@ -127,7 +129,7 @@ export const MenuLogin = React.forwardRef<MenuLoginHandle, MenuLoginProps>(
     return (
       <React.Fragment>
         <ButtonComponent
-          width={alignButtonWidthToMenu ? width : null}
+          width={alignButtonWidthToMenu ? width : buttonWidth}
           textTransform={props.textTransform}
           size="small"
           setRef={anchorRef}
@@ -180,7 +182,7 @@ const LoginItemList = ({
   onKeyPress: (e: React.KeyboardEvent<HTMLInputElement>) => void;
   onChange: (e: React.ChangeEvent<HTMLInputElement>) => void;
   placeholder: string;
-  width?: string;
+  width?: ComponentPropsWithoutRef<typeof Flex>['minWidth'];
   inputType?: MenuInputType;
 }) => {
   const content = getLoginItemListContent(items, getLoginItemsAttempt, onClick);
diff --git a/web/packages/shared/components/MenuLogin/types.ts b/web/packages/shared/components/MenuLogin/types.ts
index f4689f6baddae..bd348b5a16293 100644
--- a/web/packages/shared/components/MenuLogin/types.ts
+++ b/web/packages/shared/components/MenuLogin/types.ts
@@ -18,6 +18,7 @@
 
 import { ComponentPropsWithRef, ComponentType, CSSProperties } from 'react';
 
+import { Flex } from 'design';
 import { ButtonBorder } from 'design/Button';
 
 export type LoginItem = {
@@ -54,7 +55,15 @@ export type MenuLoginProps = {
   textTransform?: string;
   placeholder?: string;
   required?: boolean;
-  width?: string;
+  /**
+   * Width of the displayed menu. If alignButtonWidthToMenu is true, then this is also the width of
+   * the button.
+   */
+  width?: ComponentPropsWithRef<typeof Flex>['width'];
+  /**
+   * Width of just the button. Ignored if alignButtonWidthToMenu is true.
+   */
+  buttonWidth?: ComponentPropsWithRef<typeof ButtonBorder>['width'];
   ButtonComponent?: ComponentType<ComponentPropsWithRef<typeof ButtonBorder>>;
   buttonText?: string;
   style?: CSSProperties;
diff --git a/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.story.tsx b/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.story.tsx
index 25dd8e0ea08ae..248901a4645f3 100644
--- a/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.story.tsx
+++ b/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.story.tsx
@@ -18,7 +18,7 @@
 
 import styled from 'styled-components';
 
-import { Flex, H3, MenuItem } from 'design';
+import { Box, Flex, H3, MenuItem, Stack, Text } from 'design';
 import { MenuInputType } from 'shared/components/MenuLogin';
 
 import { MenuLoginWithActionMenu as MenuLoginWithActionMenuComponent } from './MenuLoginWithActionMenu';
@@ -29,77 +29,117 @@ export default {
 
 export const MenuLoginWithActionMenu = () => {
   return (
-    <Flex
-      inline
-      p={4}
-      gap="128px"
-      justifyContent="flex-start"
-      bg="levels.surface"
-    >
-      <Example>
-        <H3>No logins</H3>
-        <MenuLoginWithActionMenuComponent
-          getLoginItems={() => []}
-          onSelect={() => null}
-          buttonText="Connect"
-          size="small"
-        >
-          {menuItems}
-        </MenuLoginWithActionMenuComponent>
-      </Example>
-      <Example>
-        <H3>Processing state</H3>
-        <MenuLoginWithActionMenuComponent
-          getLoginItems={() => new Promise(() => {})}
-          onSelect={() => null}
-          buttonText="Connect"
-          size="small"
-        >
-          {menuItems}
-        </MenuLoginWithActionMenuComponent>
-      </Example>
-      <Example>
-        <H3>With logins</H3>
-        <MenuLoginWithActionMenuComponent
-          size="small"
-          buttonText="Connect"
-          getLoginItems={() => urlItems}
-          onSelect={() => null}
-          placeholder="Select item to log in..."
-          inputType={MenuInputType.NONE}
-        >
-          {menuItems}
-        </MenuLoginWithActionMenuComponent>
-      </Example>
-      <Example>
-        <H3>With logins and search input</H3>
-        <MenuLoginWithActionMenuComponent
-          buttonText="Connect"
-          size="small"
-          getLoginItems={() => loginItems}
-          onSelect={() => null}
-          placeholder="search login"
-        >
-          {menuItems}
-        </MenuLoginWithActionMenuComponent>
-      </Example>
-      <Example>
-        <H3>Large button with custom width</H3>
-        <MenuLoginWithActionMenuComponent
-          size="large"
-          width="150px"
-          buttonText="Connect"
-          getLoginItems={() => urlItems}
-          onSelect={() => null}
-          placeholder="Select item to log in..."
-        >
-          {menuItems}
-        </MenuLoginWithActionMenuComponent>
-      </Example>
-    </Flex>
+    <Stack gap={4}>
+      <Flex
+        inline
+        p={4}
+        gap="128px"
+        justifyContent="flex-start"
+        bg="levels.surface"
+      >
+        <Example>
+          <H3>No logins</H3>
+          <MenuLoginWithActionMenuComponent
+            getLoginItems={() => []}
+            onSelect={() => null}
+            buttonText="Connect"
+            size="small"
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+        <Example>
+          <H3>Processing state</H3>
+          <MenuLoginWithActionMenuComponent
+            getLoginItems={() => new Promise(() => {})}
+            onSelect={() => null}
+            buttonText="Connect"
+            size="small"
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+        <Example>
+          <H3>With logins</H3>
+          <MenuLoginWithActionMenuComponent
+            size="small"
+            buttonText="Connect"
+            getLoginItems={() => urlItems}
+            onSelect={() => null}
+            placeholder="Select item to log in..."
+            inputType={MenuInputType.NONE}
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+        <Example>
+          <H3>With logins and search input</H3>
+          <MenuLoginWithActionMenuComponent
+            buttonText="Connect"
+            size="small"
+            getLoginItems={() => loginItems}
+            onSelect={() => null}
+            placeholder="search login"
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+        <Example>
+          <H3>Large button with custom width</H3>
+          <MenuLoginWithActionMenuComponent
+            size="large"
+            menuWidth="150px"
+            buttonText="Connect"
+            getLoginItems={() => urlItems}
+            onSelect={() => null}
+            placeholder="Select item to log in..."
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+      </Flex>
+
+      <Stack p={4} gap={3} bg="levels.surface">
+        <Example>
+          <Box>
+            <H3>width=&#123;{constantWidth}&#125;</H3>
+            <Text>Affects total component width</Text>
+          </Box>
+          <MenuLoginWithActionMenuComponent
+            width={constantWidth}
+            buttonText="Connect"
+            size="small"
+            getLoginItems={() => loginItems}
+            onSelect={() => null}
+            placeholder="search login"
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+
+        <Example>
+          <Box>
+            <H3>menuWidth=&#123;{constantWidth}&#125;</H3>
+            <Text>Affects button and menu width</Text>
+          </Box>
+          <MenuLoginWithActionMenuComponent
+            menuWidth={constantWidth}
+            buttonText="Connect"
+            size="small"
+            getLoginItems={() => loginItems}
+            onSelect={() => null}
+            placeholder="search login"
+          >
+            {menuItems}
+          </MenuLoginWithActionMenuComponent>
+        </Example>
+      </Stack>
+    </Stack>
   );
 };
 
+const constantWidth = 250;
+
 const Example = styled(Flex).attrs({
   gap: 2,
   flexDirection: 'column',
diff --git a/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.tsx b/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.tsx
index 7c29494ce00d1..24a8ae80f2a08 100644
--- a/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.tsx
+++ b/web/packages/shared/components/MenuLoginWithActionMenu/MenuLoginWithActionMenu.tsx
@@ -16,7 +16,12 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { ReactElement, useRef, useState } from 'react';
+import {
+  ComponentPropsWithoutRef,
+  ReactElement,
+  useRef,
+  useState,
+} from 'react';
 
 import { ButtonBorder, Flex, Menu, MenuItem } from 'design';
 import { ButtonSize } from 'design/Button';
@@ -48,13 +53,14 @@ export const MenuLoginWithActionMenu = ({
   onSelect,
   getLoginItems,
   children,
+  menuWidth,
   width,
   size = 'medium',
   placeholder,
   inputType,
 }: {
   /** Button text for main menu button. */
-  buttonText: string;
+  buttonText?: string;
   /**
    * Handles select or click in main menu items.
    * If isExternalUrl item returned by getLoginItems is true, a button with <a> tag is rendered
@@ -67,7 +73,14 @@ export const MenuLoginWithActionMenu = ({
   getLoginItems: () => LoginItem[] | Promise<LoginItem[]>;
   /** Action menu items. */
   children: MenuItemComponent | MenuItemComponent[];
-  width?: string;
+  /**
+   * Width of just the MenuLogin part of the component. Ignored if width is set.
+   */
+  menuWidth?: ComponentPropsWithoutRef<typeof MenuLogin>['width'];
+  /**
+   * Width of the whole component (button of MenuLogin + ButtonBorder of action menu). menuWidth is ignored if width is set.
+   */
+  width?: ComponentPropsWithoutRef<typeof Flex>['width'];
   size?: ButtonSize;
   /** Text for action menu search box or static label.  */
   placeholder?: string;
@@ -77,9 +90,9 @@ export const MenuLoginWithActionMenu = ({
   const moreButtonRef = useRef<HTMLButtonElement>(null);
   const [isOpen, setIsOpen] = useState(false);
   return (
-    <Flex>
+    <Flex width={width}>
       <MenuLogin
-        width={width}
+        width={width ? '100%' : menuWidth}
         inputType={inputType}
         onSelect={onSelect}
         textTransform="none"
diff --git a/web/packages/shared/components/Notification/Notification.story.tsx b/web/packages/shared/components/Notification/Notification.story.tsx
deleted file mode 100644
index 9f30ae5af81a4..0000000000000
--- a/web/packages/shared/components/Notification/Notification.story.tsx
+++ /dev/null
@@ -1,341 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useState } from 'react';
-
-import Flex from 'design/Flex';
-import { Bots } from 'design/Icon';
-
-import { Notification } from './Notification';
-
-export default {
-  title: 'Shared/Notification',
-};
-
-export const Notifications = () => {
-  return (
-    <div
-      css={`
-        display: grid;
-        grid-gap: ${props => props.theme.space[8]}px;
-        grid-template-columns: auto auto auto;
-      `}
-    >
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              title: 'Info with title and description',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'warn',
-            content: {
-              title: 'Warning with title and description',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'error',
-            content: {
-              title: 'Error with title and description',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'neutral',
-            content: {
-              title: 'Neutral with title and description',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'neutral',
-            content: {
-              title: 'Custom icon with title and description',
-              description: loremIpsum,
-              icon: Bots,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              title: 'Info with title and description',
-              subtitle: 'And some subtitle, too',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'warn',
-            content: {
-              title: 'Warning with title and description',
-              subtitle: 'And some subtitle, too',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'error',
-            content: {
-              title: 'Error with title and description',
-              subtitle: 'And some subtitle, too',
-              description: loremIpsum,
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: 'Multiline info without title. ' + loremIpsum,
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'warn',
-            content: 'Multiline warning without title. ' + loremIpsum,
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'error',
-            content: 'Multiline error without title. ' + loremIpsum,
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: 'Info without title',
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              title: 'Info with link',
-              description: loremIpsum,
-              action: {
-                href: 'https://goteleport.com',
-                content: 'Learn More',
-              },
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              title: 'Info with list',
-              list: [loremIpsum, loremIpsum],
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content:
-              'Long continuous strings. /Users/test/Library/ApplicationSupport/foobarbazio/barbazfoobarioloremoipsumoconfigurationobaziofoobazi/baz/lorem/ipsum/Electron/configuration.json',
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              title:
-                'A very long title with a very long address that spans multiple lines tcp-postgres.foo.bar.baz.cloud.gravitational.io and some more text on another line',
-              description:
-                'Long continuous strings. /Users/test/Library/ApplicationSupport/foobarbazio/barbazfoobarioloremoipsumoconfigurationobaziofoobazi/baz/lorem/ipsum/Electron/configuration.json',
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              description: 'Info with description, without a title',
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-      <Flex flexDirection="column" gap={4}>
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content: {
-              list: ['Info with a list', 'But no title'],
-            },
-          }}
-          onRemove={() => {}}
-          isAutoRemovable={false}
-        />
-      </Flex>
-    </div>
-  );
-};
-
-export const AutoRemovable = () => {
-  const [showInfo, setShowInfo] = useState(true);
-  const [showWarning, setShowWarning] = useState(true);
-  const [showError, setShowError] = useState(true);
-
-  return (
-    <Flex flexDirection="column" gap={4}>
-      {showInfo ? (
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'info',
-            content:
-              "This will be automatically removed after 5 seconds. Click to expand it. Mouseover it to restart the timer. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
-          }}
-          onRemove={() => setShowInfo(false)}
-          isAutoRemovable={true}
-        />
-      ) : (
-        <div>Info notification has been removed</div>
-      )}
-      {showWarning ? (
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'warn',
-            content:
-              "This will be automatically removed after 5 seconds. Click to expand it. Mouseover it to restart the timer. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
-          }}
-          onRemove={() => setShowWarning(false)}
-          isAutoRemovable={true}
-        />
-      ) : (
-        <div>Warning notification has been removed</div>
-      )}
-      {showError ? (
-        <Notification
-          item={{
-            id: crypto.randomUUID(),
-            severity: 'error',
-            content:
-              "This can only be removed by clicking on the X. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
-          }}
-          onRemove={() => setShowError(false)}
-          isAutoRemovable={false}
-        />
-      ) : (
-        <div>Error notification has been removed</div>
-      )}
-    </Flex>
-  );
-};
-
-const loremIpsum =
-  'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut non ipsum dignissim, dignissim est vitae, facilisis nunc.';
diff --git a/web/packages/shared/components/Notification/Notification.test.tsx b/web/packages/shared/components/Notification/Notification.test.tsx
deleted file mode 100644
index 62d0eb9a8af2f..0000000000000
--- a/web/packages/shared/components/Notification/Notification.test.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { fireEvent, screen } from '@testing-library/react';
-
-import { render } from 'design/utils/testing';
-
-import { Notification } from './Notification';
-
-test('click on action button does not expand or collapse notification', async () => {
-  const description = 'An error happened';
-
-  render(
-    <Notification
-      item={{
-        id: '865801ca',
-        severity: 'error',
-        content: {
-          title: 'Warning',
-          description,
-          action: { content: 'Retry' },
-        },
-      }}
-      onRemove={() => {}}
-    />
-  );
-
-  fireEvent.click(screen.getByText('Retry'));
-
-  // Check if the text still has the initial, "collapsed" style (look at shortTextCss).
-  expect(screen.getByText(description)).toHaveStyleRule(
-    '-webkit-line-clamp',
-    '3'
-  );
-});
diff --git a/web/packages/shared/components/Notification/Notification.tsx b/web/packages/shared/components/Notification/Notification.tsx
deleted file mode 100644
index 92537d38273c2..0000000000000
--- a/web/packages/shared/components/Notification/Notification.tsx
+++ /dev/null
@@ -1,322 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import React, { useEffect, useRef, useState } from 'react';
-import styled, { useTheme } from 'styled-components';
-
-import { Box, ButtonIcon, Flex, Text } from 'design';
-import { ActionButton } from 'design/Alert';
-import { BoxProps } from 'design/Box';
-import { Cross } from 'design/Icon';
-import * as Icon from 'design/Icon';
-import { IconProps } from 'design/Icon/Icon';
-import { borderColor } from 'design/system';
-import { Theme } from 'design/theme/themes/types';
-
-import type {
-  NotificationItem,
-  NotificationItemContent,
-  NotificationItemObjectContent,
-  NotificationSeverity,
-} from './types';
-
-interface NotificationProps extends BoxProps {
-  item: NotificationItem;
-
-  onRemove(): void;
-
-  /**
-   * If defined, determines whether the notification is auto-dismissed after 5
-   * seconds. If undefined, the decision is based on the notification severity:
-   * only 'success', 'info', and 'neutral' notifications are removable by
-   * default.
-   *
-   * @deprecated: Define isAutoRemovable on item.content instead.
-   */
-  isAutoRemovable?: boolean;
-}
-
-const autoRemoveDurationMs = 5_000; // 5s
-
-export function Notification(props: NotificationProps) {
-  const {
-    item,
-    onRemove,
-    // TODO(ravicious): Remove isAutoRemovable in favor of item.content.isAutoRemovable.
-    isAutoRemovable: isAutoRemovableProp,
-    ...styleProps
-  } = props;
-  const content = toObjectContent(item.content);
-  const [isHovered, setIsHovered] = useState(false);
-  const [isExpanded, setIsExpanded] = useState(false);
-  const timeoutHandler = useRef<number>(undefined);
-  const theme = useTheme();
-
-  const isAutoRemovable =
-    getContentIsAutoRemovable(item.content) ??
-    isAutoRemovableProp ??
-    ['success', 'info', 'neutral'].includes(item.severity);
-  useEffect(() => {
-    if (!isHovered && isAutoRemovable) {
-      timeoutHandler.current = setTimeout(
-        onRemove,
-        autoRemoveDurationMs
-      ) as unknown as number;
-    }
-
-    return () => {
-      if (timeoutHandler.current) {
-        clearTimeout(timeoutHandler.current);
-      }
-    };
-  }, [isHovered, isAutoRemovable]);
-
-  function toggleIsExpanded() {
-    setIsExpanded(wasExpanded => !wasExpanded);
-  }
-
-  const { borderColor, iconColor } = notificationColors(theme, item.severity);
-
-  return (
-    <Container
-      py={3}
-      // We use a custom value to offset the default padding by the width of the
-      // left border.
-      pl="12px"
-      pr={3}
-      borderColor={borderColor}
-      onMouseOver={() => {
-        if (isHovered === false) {
-          setIsHovered(true);
-        }
-      }}
-      onMouseLeave={() => {
-        if (isHovered === true) {
-          setIsHovered(false);
-        }
-      }}
-      onClick={toggleIsExpanded}
-      {...styleProps}
-    >
-      <Flex gap={2} flexDirection="column">
-        <Flex flexDirection="row" gap={2}>
-          <NotificationIcon
-            severity={item.severity}
-            size="medium"
-            color={iconColor}
-            customIcon={content.icon}
-          />
-          {/* Right margin leaves room for the close button. Note that we
-              wouldn't have to do it if the close button was in layout, but we
-              would have to nudge it a bit to top-right anyway, and it would
-              then occupy too much vertical space where it used to be, causing
-              other problems. */}
-          <Box flex="1" mr={4}>
-            <Text typography="h3">{content.title}</Text>
-            <Text typography="body3">{content.subtitle}</Text>
-          </Box>
-        </Flex>
-        <NotificationBody content={content} isExpanded={isExpanded} />
-      </Flex>
-      <CloseIcon
-        style={{
-          visibility: isHovered ? 'visible' : 'hidden',
-        }}
-        title="Close Notification"
-        onClick={e => {
-          e.stopPropagation();
-          onRemove();
-        }}
-      >
-        <Cross size="small" />
-      </CloseIcon>
-    </Container>
-  );
-}
-
-const NotificationIcon = ({
-  severity,
-  customIcon: CustomIcon,
-  ...otherProps
-}: {
-  severity: NotificationSeverity;
-  customIcon: React.ComponentType<IconProps>;
-} & IconProps) => {
-  const commonProps = { role: 'graphics-symbol', ...otherProps };
-  if (CustomIcon) {
-    return <CustomIcon {...commonProps} />;
-  }
-  switch (severity) {
-    case 'success':
-      return <Icon.Checks aria-label="Success" {...commonProps} />;
-    case 'error':
-      return <Icon.WarningCircle aria-label="Danger" {...commonProps} />;
-    case 'info':
-      return <Icon.Info aria-label="Info" {...commonProps} />;
-    case 'warn':
-      return <Icon.Warning aria-label="Warning" {...commonProps} />;
-    case 'neutral':
-      return <Icon.Notification aria-label="Note" {...commonProps} />;
-    default:
-      severity satisfies never;
-  }
-};
-
-const toObjectContent = (
-  content: NotificationItemContent
-): NotificationItemObjectContent =>
-  typeof content === 'string' ? { title: content } : content;
-
-const getContentIsAutoRemovable = (
-  content: NotificationItemContent
-): boolean | undefined =>
-  typeof content === 'string' ? undefined : content.isAutoRemovable;
-
-const notificationColors = (theme: Theme, severity: NotificationSeverity) => {
-  switch (severity) {
-    case 'neutral':
-      return {
-        borderColor: theme.colors.interactive.tonal.neutral[2],
-        iconColor: theme.colors.text.main,
-      };
-    case 'error':
-      return {
-        borderColor: theme.colors.interactive.solid.danger.default,
-        iconColor: theme.colors.interactive.solid.danger.default,
-      };
-    case 'warn':
-      return {
-        borderColor: theme.colors.interactive.solid.alert.default,
-        iconColor: theme.colors.interactive.solid.alert.default,
-      };
-    case 'info':
-      return {
-        borderColor: theme.colors.interactive.solid.accent.default,
-        iconColor: theme.colors.interactive.solid.accent.default,
-      };
-    case 'success':
-      return {
-        borderColor: theme.colors.interactive.solid.success.default,
-        iconColor: theme.colors.interactive.solid.success.default,
-      };
-    default:
-      severity satisfies never;
-  }
-};
-
-const CloseIcon = styled(ButtonIcon)`
-  /* Place the close button so that its hover state circle "overflows" the layout
-   * padding a bit, placing the close icon itself in alignment with the padding. */
-  position: absolute;
-  top: ${props => props.theme.space[2]}px;
-  right: ${props => props.theme.space[2]}px;
-`;
-
-const NotificationBody = ({
-  content,
-  isExpanded,
-}: {
-  content: NotificationItemObjectContent;
-  isExpanded: boolean;
-}) => {
-  const longerTextCss = isExpanded ? textCss : shortTextCss;
-  const hasListOrDescription = !!content.list || !!content.description;
-
-  const { action } = content;
-
-  return (
-    <>
-      {/* Note: an empty <Text/> element would still generate a flex gap, so we
-          only render it if necessary. */}
-      {hasListOrDescription && (
-        <Text typography="body2" color="text.slightlyMuted" css={longerTextCss}>
-          {content.list && <List items={content.list} />}
-          {content.description}
-        </Text>
-      )}
-      {action && (
-        <Box alignSelf="flex-start">
-          <ActionButton
-            intent="neutral"
-            action={{
-              href: action.href,
-              content: action.content,
-              onClick: event => {
-                // Prevents toggling the isExpanded flag.
-                event.stopPropagation();
-                action.onClick?.(event);
-              },
-            }}
-          />
-        </Box>
-      )}
-    </>
-  );
-};
-
-function List(props: { items: string[] }) {
-  return (
-    <ul
-      // Ideally we'd align the bullet point to the left without using list-style-position: inside
-      // (because it looks bad when the list item spans multiple lines).
-      //
-      // However, it seems impossible to use padding-inline-start for that because the result looks
-      // different on Retina vs non-Retina screens, the bullet point looks cut off on the latter if
-      // padding-inline-start is set to 1em. So instead we just set it to 2em.
-      css={`
-        margin: 0;
-        padding-inline-start: 2em;
-      `}
-    >
-      {props.items.map((item, index) => (
-        <li key={index}>{item}</li>
-      ))}
-    </ul>
-  );
-}
-
-const textCss = `
-  overflow-wrap: anywhere;
-  white-space: pre-line;
-`;
-
-const shortTextCss = `
-  ${textCss};
-  display: -webkit-box;
-  -webkit-box-orient: vertical;
-  -webkit-line-clamp: 3;
-`;
-
-const Container = styled(Box)`
-  /* Positioning anchor for the close button. */
-  position: relative;
-  background: ${props => props.theme.colors.levels.elevated};
-  border-left: ${props => props.theme.borders[3]};
-  width: 320px;
-  box-shadow:
-    0px 3px 5px -1px rgba(0, 0, 0, 0.2),
-    0px 6px 10px 0px rgba(0, 0, 0, 0.14),
-    0px 1px 18px 0px rgba(0, 0, 0, 0.12);
-  color: ${props => props.theme.colors.text.main};
-  border-radius: ${props => props.theme.radii[3]}px;
-  cursor: pointer;
-  // Break up long addresses.
-  word-break: break-word;
-
-  ${borderColor}
-`;
diff --git a/web/packages/shared/components/Notification/index.ts b/web/packages/shared/components/Notification/index.ts
deleted file mode 100644
index 76c44aa5b05fc..0000000000000
--- a/web/packages/shared/components/Notification/index.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-export { Notification } from './Notification';
-export type {
-  NotificationItem,
-  NotificationItemContent,
-  NotificationSeverity,
-} from './types';
diff --git a/web/packages/shared/components/Notification/types.ts b/web/packages/shared/components/Notification/types.ts
deleted file mode 100644
index ced2272193ebd..0000000000000
--- a/web/packages/shared/components/Notification/types.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import React from 'react';
-
-import { Action } from 'design/Alert';
-import { IconProps } from 'design/Icon/Icon';
-
-export type NotificationSeverity =
-  | 'info'
-  | 'warn'
-  | 'error'
-  | 'success'
-  | 'neutral';
-
-export interface NotificationItem {
-  content: NotificationItemContent;
-  severity: NotificationSeverity;
-  id: string;
-}
-
-export type NotificationItemContent = string | NotificationItemObjectContent;
-
-export type NotificationItemObjectContent = {
-  title?: string;
-  subtitle?: string;
-  list?: string[];
-  description?: string;
-  icon?: React.ComponentType<IconProps>;
-  action?: Action;
-  /**
-   * If defined, isAutoRemovable circumvents the auto-removing logic in the Notification component,
-   * which automatically removes 'success', 'info', and 'neutral' notifications.
-   */
-  isAutoRemovable?: boolean;
-};
diff --git a/web/packages/shared/components/ScheduleEditor/ScheduleEditor.story.tsx b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.story.tsx
new file mode 100644
index 0000000000000..20b0de77f6595
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.story.tsx
@@ -0,0 +1,45 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import { ButtonPrimary } from 'design/Button';
+import Validation from 'shared/components/Validation';
+
+import { ScheduleEditor } from './ScheduleEditor';
+import { newSchedule, Schedule } from './types';
+
+export default {
+  title: 'Teleport/ScheduleEditor',
+};
+
+export const ScheduleEditorBasic = () => {
+  const [schedule, setSchedule] = useState<Schedule>(newSchedule());
+  return (
+    <Validation>
+      {({ validator }) => (
+        <>
+          <ScheduleEditor schedule={schedule} setSchedule={setSchedule} />
+          <ButtonPrimary onClick={() => validator.validate()}>
+            Validate
+          </ButtonPrimary>
+        </>
+      )}
+    </Validation>
+  );
+};
diff --git a/web/packages/shared/components/ScheduleEditor/ScheduleEditor.test.tsx b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.test.tsx
new file mode 100644
index 0000000000000..ff70a2efff996
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.test.tsx
@@ -0,0 +1,85 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, userEvent } from 'design/utils/testing';
+import Validation from 'shared/components/Validation';
+
+import { ScheduleEditor } from './ScheduleEditor';
+import { newSchedule } from './types';
+
+test('Toggle Monday', async () => {
+  const schedule = newSchedule();
+  const setSchedule = jest.fn();
+
+  render(
+    <Validation>
+      <ScheduleEditor schedule={schedule} setSchedule={setSchedule} />
+    </Validation>
+  );
+
+  const user = userEvent.setup();
+  const mondayButton = screen.getByRole('button', { name: /M/i });
+  await user.click(mondayButton);
+
+  expect(setSchedule).toHaveBeenCalledWith({
+    ...schedule,
+    shifts: {
+      ...schedule.shifts,
+      Monday: {
+        startTime: { label: '12:00AM', value: '00:00' },
+        endTime: { label: '12:00AM', value: '00:00' },
+      },
+    },
+  });
+});
+
+test('Set custom Monday start time', async () => {
+  const schedule = newSchedule();
+  const setSchedule = jest.fn();
+
+  schedule.shifts.Monday = {
+    startTime: { label: '12:00AM', value: '00:00' },
+    endTime: { label: '12:00AM', value: '00:00' },
+  };
+
+  render(
+    <Validation>
+      <ScheduleEditor schedule={schedule} setSchedule={setSchedule} />
+    </Validation>
+  );
+
+  const user = userEvent.setup();
+  expect(screen.getAllByText('12:00AM')).toHaveLength(2);
+
+  const startSelector = screen.getAllByRole('combobox')[1];
+  await user.click(startSelector);
+  await user.type(startSelector, '9:10AM');
+  const startOption = await screen.findByText('Create "9:10AM"');
+  await user.click(startOption);
+
+  expect(setSchedule).toHaveBeenCalledWith({
+    ...schedule,
+    shifts: {
+      ...schedule.shifts,
+      Monday: {
+        startTime: { label: '9:10AM', value: '09:10' },
+        endTime: { label: '12:00AM', value: '00:00' },
+      },
+    },
+  });
+});
diff --git a/web/packages/shared/components/ScheduleEditor/ScheduleEditor.tsx b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.tsx
new file mode 100644
index 0000000000000..4f539f99910ab
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/ScheduleEditor.tsx
@@ -0,0 +1,221 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { StylesConfig } from 'react-select';
+import styled from 'styled-components';
+
+import { Box, ButtonPrimary, Flex, Text } from 'design';
+import { LabelContent } from 'design/LabelInput/LabelInput';
+import Select, { Option, SelectCreatable } from 'shared/components/Select';
+import { useRule } from 'shared/components/Validation';
+
+import {
+  timeOptions,
+  timeOptionsAll,
+  timezoneOptions,
+  weekdayOptions,
+} from './const';
+import { validSchedule, validShift } from './rules';
+import { newShift, Schedule, Shift, Weekday } from './types';
+
+export const ScheduleEditor = ({
+  schedule,
+  setSchedule,
+}: {
+  schedule: Schedule;
+  setSchedule: (option: Schedule) => void;
+}) => {
+  const { valid, message } = useRule(validSchedule(schedule));
+
+  const setTimezone = (option: Option) => {
+    setSchedule({ ...schedule, timezone: option });
+  };
+
+  const toggleWeekday = (weekday: Weekday) => {
+    setSchedule({
+      ...schedule,
+      shifts: {
+        ...schedule.shifts,
+        [weekday]: schedule.shifts[weekday] ? null : newShift(),
+      },
+    });
+  };
+
+  const setShift = (weekday: string, shift: Shift) => {
+    setSchedule({
+      ...schedule,
+      shifts: {
+        ...schedule.shifts,
+        [weekday]: shift,
+      },
+    });
+  };
+
+  return (
+    <Flex flexDirection="column" width="330px" gap={3}>
+      <Box>
+        <LabelContent>Time Zone</LabelContent>
+        <Select
+          value={schedule.timezone}
+          onChange={setTimezone}
+          options={timezoneOptions}
+        />
+      </Box>
+      <Flex gap={2}>
+        {weekdayOptions.map(weekday => (
+          <ButtonPrimary
+            key={weekday.value}
+            size="large"
+            width={40}
+            $inputAlignment={true}
+            intent={schedule.shifts[weekday.value] ? 'primary' : 'neutral'}
+            onClick={() => toggleWeekday(weekday.value)}
+          >
+            {weekday.label}
+          </ButtonPrimary>
+        ))}
+      </Flex>
+      <Box>
+        <WeekdayScheduleTable>
+          <tbody>
+            {weekdayOptions
+              .filter(weekday => !!schedule.shifts[weekday.value])
+              .map(weekday => (
+                <tr key={weekday.value}>
+                  <td>
+                    <Text>{weekday.value}</Text>
+                  </td>
+                  <td colSpan={3}>
+                    <ShiftSelect
+                      shift={schedule.shifts[weekday.value]}
+                      setShift={shift => setShift(weekday.value, shift)}
+                    />
+                  </td>
+                </tr>
+              ))}
+          </tbody>
+        </WeekdayScheduleTable>
+        {!valid && (
+          <Flex>
+            <Text color="interactive.solid.danger.default">{message}</Text>
+          </Flex>
+        )}
+      </Box>
+    </Flex>
+  );
+};
+
+const ShiftSelect = ({
+  shift,
+  setShift,
+}: {
+  shift: Shift;
+  setShift: (option: Shift) => void;
+}) => {
+  const { valid } = useRule(validShift(shift));
+
+  return (
+    <StyledFlex gap={3} hasError={!valid}>
+      <Box flex="1" textAlign="center">
+        <SelectCreatable
+          value={shift.startTime}
+          onChange={time => {
+            const result = timeOptionsAll.find(
+              validTime => time.label.toUpperCase() === validTime.label
+            );
+            if (!result) return;
+            setShift({ ...shift, startTime: result });
+          }}
+          options={timeOptions}
+          components={{ DropdownIndicator: () => null }}
+          stylesConfig={selectCreatableStyles}
+        />
+      </Box>
+      <Text color="text.muted">to</Text>
+      <Box flex="1" textAlign="center">
+        <SelectCreatable
+          value={shift.endTime}
+          onChange={time => {
+            const result = timeOptionsAll.find(
+              validTime => time.label.toUpperCase() === validTime.label
+            );
+            if (!result) return;
+            setShift({ ...shift, endTime: result });
+          }}
+          options={timeOptions}
+          components={{ DropdownIndicator: () => null }}
+          stylesConfig={selectCreatableStyles}
+        />
+      </Box>
+    </StyledFlex>
+  );
+};
+
+const WeekdayScheduleTable = styled.table`
+  width: 100%;
+  border-collapse: collapse;
+  /*
+   * Using fixed layout seems to be the only way to prevent the internal input
+   * padding from somehow influencing the column width. As the padding is
+   * variable (and reflects the error state), we'd rather avoid column width
+   * changes while editing.
+   */
+  table-layout: fixed;
+
+  & td {
+    padding: 0;
+    padding-bottom: ${props => props.theme.space[2]}px;
+  }
+`;
+
+const StyledFlex = styled(Flex)<{
+  hasError?: boolean;
+}>`
+  align-items: center;
+  text-align: center;
+
+  border: 1px solid;
+  border-radius: 4px;
+  border-color: ${({ hasError, theme }) =>
+    hasError
+      ? theme.colors.interactive.solid.danger.default
+      : theme.colors.interactive.tonal.neutral[2]};
+  &:hover,
+  &:focus-within {
+    border-color: ${({ hasError, theme }) =>
+      hasError
+        ? theme.colors.interactive.solid.danger.default
+        : theme.colors.interactive.solid.primary.default};
+  }
+`;
+
+const selectCreatableStyles: StylesConfig = {
+  control: base => ({
+    ...base,
+    border: 'none !important',
+  }),
+  valueContainer: base => ({
+    ...base,
+    justifyContent: 'center',
+    padding: '0px !important',
+  }),
+  input: base => ({
+    ...base,
+    overflow: 'hidden',
+  }),
+};
diff --git a/web/packages/shared/components/ScheduleEditor/const.ts b/web/packages/shared/components/ScheduleEditor/const.ts
new file mode 100644
index 0000000000000..f44b98aa28b4c
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/const.ts
@@ -0,0 +1,98 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Option } from 'shared/components/Select';
+
+import { WeekdayOption } from './types';
+
+const allTimezones = ['UTC', ...Intl.supportedValuesOf('timeZone')];
+
+/**
+ * timezoneOptions lists the available timezone options.
+ */
+export const timezoneOptions: Option[] = allTimezones.map(timeZone => {
+  const formatter = new Intl.DateTimeFormat('en-US', {
+    timeZone,
+    timeZoneName: 'short',
+  });
+
+  const abbreviation =
+    formatter
+      .formatToParts(new Date())
+      .find(part => part.type === 'timeZoneName')?.value || '';
+
+  return {
+    value: timeZone,
+    label: `${timeZone} - ${abbreviation}`,
+  };
+});
+
+/**
+ * weekdayOptions lists the available weekday options.
+ */
+export const weekdayOptions: WeekdayOption[] = [
+  { value: 'Sunday', label: 'S' },
+  { value: 'Monday', label: 'M' },
+  { value: 'Tuesday', label: 'T' },
+  { value: 'Wednesday', label: 'W' },
+  { value: 'Thursday', label: 'T' },
+  { value: 'Friday', label: 'F' },
+  { value: 'Saturday', label: 'S' },
+];
+
+/**
+ * timeOptionsAll lists the available time options per minute.
+ * The value is 24 hour formatted, while the label is 12 hour formatted.
+ */
+export const timeOptionsAll: Option[] = Array.from(
+  { length: 1440 },
+  (_, index) => {
+    const hours = Math.floor(index / 60);
+    const minutes = index % 60;
+
+    const date = new Date();
+    date.setHours(hours, minutes, 0, 0);
+
+    const parts = new Intl.DateTimeFormat('en-US', {
+      hour: 'numeric',
+      minute: '2-digit',
+      hour12: true,
+    }).formatToParts(date);
+
+    const label =
+      parts.find(p => p.type === 'hour')?.value +
+      ':' +
+      parts.find(p => p.type === 'minute')?.value +
+      parts.find(p => p.type === 'dayPeriod')?.value;
+
+    const value = `${hours.toString().padStart(2, '0')}:${minutes
+      .toString()
+      .padStart(2, '0')}`;
+
+    return { value, label };
+  }
+);
+
+/**
+ * timeOptions lists the available time options with 30-minute intervals.
+ * The value is 24 hour formatted, while the label is 12 hour formatted.
+ */
+export const timeOptions: Option[] = timeOptionsAll.filter(option => {
+  const minutes = option.value.split(':')[1];
+  return minutes === '00' || minutes === '30';
+});
diff --git a/web/packages/shared/components/ScheduleEditor/index.ts b/web/packages/shared/components/ScheduleEditor/index.ts
new file mode 100644
index 0000000000000..34e8925001440
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/index.ts
@@ -0,0 +1,21 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { ScheduleEditor } from './ScheduleEditor';
+export * from './types';
+export * from './const';
diff --git a/web/packages/shared/components/ScheduleEditor/rules.test.ts b/web/packages/shared/components/ScheduleEditor/rules.test.ts
new file mode 100644
index 0000000000000..05248cc4706c6
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/rules.test.ts
@@ -0,0 +1,116 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { timezoneOptions, weekdayOptions } from './const';
+import { validSchedule, validShift } from './rules';
+import { Schedule, Shift, Weekday } from './types';
+
+describe('validShift', () => {
+  const testCases: {
+    name: string;
+    shift: Shift;
+    valid: boolean;
+    message?: string;
+  }[] = [
+    {
+      name: 'valid shift',
+      shift: {
+        startTime: { value: '00:00', label: '12:00AM' },
+        endTime: { value: '23:59', label: '11:59PM' },
+      },
+      valid: true,
+    },
+    {
+      name: 'invalid time value',
+      shift: {
+        startTime: { value: '00:00', label: '12:00AM' },
+        endTime: { value: '24:00', label: '12:00PM' },
+      },
+      valid: false,
+      message: 'invalid time',
+    },
+    {
+      name: 'same start and end time',
+      shift: {
+        startTime: { value: '00:00', label: '12:00AM' },
+        endTime: { value: '00:00', label: '12:00AM' },
+      },
+      valid: false,
+      message: 'start time must be before end time',
+    },
+  ];
+  test.each(testCases)('$name', tc => {
+    const result = validShift(tc.shift)();
+    expect(result.valid).toEqual(tc.valid);
+    expect(result.message).toEqual(tc.message);
+  });
+});
+
+describe('validSchedule', () => {
+  const testCases: {
+    name: string;
+    schedule: Schedule;
+    valid: boolean;
+    message?: string;
+  }[] = [
+    {
+      name: 'valid schedule',
+      schedule: {
+        name: 'test',
+        timezone: timezoneOptions[0],
+        shifts: {
+          ...newShifts(),
+          Monday: {
+            startTime: { value: '00:00', label: '12:00AM' },
+            endTime: { value: '23:59', label: '11:59PM' },
+          },
+          Tuesday: {
+            startTime: { value: '00:00', label: '12:00AM' },
+            endTime: { value: '23:59', label: '11:59PM' },
+          },
+        },
+      },
+      valid: true,
+    },
+    {
+      name: 'missing shifts',
+      schedule: {
+        name: 'test',
+        timezone: timezoneOptions[0],
+        shifts: newShifts(),
+      },
+      valid: false,
+      message: 'At least one shift is required.',
+    },
+  ];
+  test.each(testCases)('$name', tc => {
+    const result = validSchedule(tc.schedule)();
+    expect(result.valid).toEqual(tc.valid);
+    expect(result.message).toEqual(tc.message);
+  });
+});
+
+function newShifts(): Record<Weekday, Shift | null> {
+  return weekdayOptions.reduce(
+    (shifts, weekday) => {
+      shifts[weekday.value] = null;
+      return shifts;
+    },
+    {} as Record<Weekday, Shift | null>
+  );
+}
diff --git a/web/packages/shared/components/ScheduleEditor/rules.ts b/web/packages/shared/components/ScheduleEditor/rules.ts
new file mode 100644
index 0000000000000..99d004b2421ae
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/rules.ts
@@ -0,0 +1,91 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Rule } from 'shared/components/Validation/rules';
+
+import { timeOptionsAll } from './const';
+import { Schedule, Shift } from './types';
+
+/**
+ * validSchedule validates a schedule.
+ * A schedule is expected to contain at least one shift, and all shifts
+ * must be valid.
+ *
+ * @param schedule - The target schedule to validate.
+ * @returns a validator function that ensure the schedule is valid.
+ */
+export const validSchedule: Rule<Schedule> = (schedule: Schedule) => () => {
+  const enabledShifts = Object.values(schedule.shifts).filter(shift => !!shift);
+
+  if (enabledShifts.length === 0) {
+    return {
+      valid: false,
+      message: `At least one shift is required.`,
+    };
+  }
+
+  for (const shift of enabledShifts) {
+    const error = validateShift(shift);
+    if (error) {
+      return {
+        valid: false,
+        message: `Shift must be between 12:00AM and 11:59PM.`,
+      };
+    }
+  }
+
+  return {
+    valid: true,
+  };
+};
+
+/**
+ * validShift validates a shift.
+ * A shift is expected to be between 00:00 and 23:59.
+ *
+ * @param shift - The target shift to validate.
+ * @returns a validator function that ensure the shift is valid.
+ */
+export const validShift: Rule<Shift> = (shift: Shift) => () => {
+  const error = validateShift(shift);
+  return {
+    valid: !error,
+    message: error,
+  };
+};
+
+const validateShift = (shift: Shift) => {
+  const start = shift.startTime?.value;
+  const end = shift.endTime?.value;
+
+  if (!start || !end) {
+    return 'start and end interval required';
+  }
+
+  const startIndex = timeOptionsAll.findIndex(t => t.value === start);
+  const endIndex = timeOptionsAll.findIndex(t => t.value === end);
+
+  if (startIndex === -1 || endIndex === -1) {
+    return 'invalid time';
+  }
+
+  if (startIndex >= endIndex) {
+    return 'start time must be before end time';
+  }
+  return undefined;
+};
diff --git a/web/packages/shared/components/ScheduleEditor/types.ts b/web/packages/shared/components/ScheduleEditor/types.ts
new file mode 100644
index 0000000000000..3e826f62bdcc7
--- /dev/null
+++ b/web/packages/shared/components/ScheduleEditor/types.ts
@@ -0,0 +1,60 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Option } from 'shared/components/Select';
+
+import { timeOptions, timezoneOptions, weekdayOptions } from './const';
+
+export type Schedule = {
+  name: string;
+  timezone: Option;
+  shifts: Record<Weekday, Shift | null>;
+};
+
+export const newSchedule = (): Schedule => ({
+  name: 'default',
+  timezone: timezoneOptions[0],
+  shifts: weekdayOptions.reduce(
+    (shifts, weekday) => {
+      shifts[weekday.value] = null;
+      return shifts;
+    },
+    {} as Record<Weekday, Shift | null>
+  ),
+});
+
+export type Shift = {
+  startTime: Option;
+  endTime: Option;
+};
+
+export const newShift = (): Shift => ({
+  startTime: timeOptions[0],
+  endTime: timeOptions[0],
+});
+
+export type Weekday =
+  | 'Sunday'
+  | 'Monday'
+  | 'Tuesday'
+  | 'Wednesday'
+  | 'Thursday'
+  | 'Friday'
+  | 'Saturday';
+
+export type WeekdayOption = Option<Weekday>;
diff --git a/web/packages/shared/components/Search/SearchPanel.test.tsx b/web/packages/shared/components/Search/SearchPanel.test.tsx
new file mode 100644
index 0000000000000..40e9e11e3e936
--- /dev/null
+++ b/web/packages/shared/components/Search/SearchPanel.test.tsx
@@ -0,0 +1,105 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import { Providers, render, screen, userEvent } from 'design/utils/testing';
+
+import { SearchPanel } from './SearchPanel';
+
+describe('SearchPanel', () => {
+  test('renders', async () => {
+    renderComponent({
+      filter: {
+        search: '',
+      },
+      updateSearch: jest.fn(),
+      updateQuery: jest.fn(),
+      disableSearch: false,
+    });
+
+    expect(screen.getByPlaceholderText('Search...')).toBeInTheDocument();
+  });
+
+  test('submits a search', async () => {
+    const updateSearch = jest.fn();
+    const updateQuery = jest.fn();
+
+    const { user } = renderComponent({
+      filter: {
+        search: '',
+      },
+      updateSearch,
+      updateQuery,
+      hideAdvancedSearch: true,
+      disableSearch: false,
+    });
+
+    const input = screen.getByPlaceholderText('Search...');
+    await user.click(input);
+    await user.paste('Lorem ipsum delor sit amet.');
+    await user.type(input, '{enter}');
+
+    expect(updateSearch).toHaveBeenCalledTimes(1);
+    expect(updateSearch).toHaveBeenLastCalledWith(
+      'Lorem ipsum delor sit amet.'
+    );
+    expect(updateQuery).not.toHaveBeenCalled();
+  });
+
+  test('submits a query (advanced)', async () => {
+    const updateSearch = jest.fn();
+    const updateQuery = jest.fn();
+
+    const { user } = renderComponent({
+      filter: {
+        query: '',
+      },
+      updateSearch,
+      updateQuery,
+      hideAdvancedSearch: false,
+      disableSearch: false,
+    });
+
+    // Toggle advanced mode on
+    await userEvent.click(screen.getByLabelText('Advanced'));
+
+    const input = screen.getByPlaceholderText('Search...');
+    await user.click(input);
+    await user.paste('Lorem ipsum delor sit amet.');
+    await user.type(input, '{enter}');
+
+    expect(updateQuery).toHaveBeenCalledTimes(1);
+    expect(updateQuery).toHaveBeenLastCalledWith('Lorem ipsum delor sit amet.');
+    expect(updateSearch).not.toHaveBeenCalled();
+  });
+});
+
+function renderComponent(props: ComponentProps<typeof SearchPanel>) {
+  const user = userEvent.setup();
+  return {
+    ...render(<SearchPanel {...props} />, { wrapper: makeWrapper() }),
+    user,
+  };
+}
+
+function makeWrapper() {
+  return (props: PropsWithChildren) => {
+    return <Providers>{props.children}</Providers>;
+  };
+}
diff --git a/web/packages/shared/components/Search/SearchPanel.tsx b/web/packages/shared/components/Search/SearchPanel.tsx
index 5da5ad957c137..c69930a20f120 100644
--- a/web/packages/shared/components/Search/SearchPanel.tsx
+++ b/web/packages/shared/components/Search/SearchPanel.tsx
@@ -22,8 +22,10 @@ import styled from 'styled-components';
 import { Flex } from 'design';
 import InputSearch from 'design/DataTable/InputSearch';
 import { PageIndicatorText } from 'design/DataTable/Pager/PageIndicatorText';
+import { FlexProps } from 'design/Flex/Flex';
 import { AdvancedSearchToggle } from 'shared/components/AdvancedSearchToggle';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourceFilter } from 'teleport/services/agents';
 
 export function SearchPanel({
@@ -34,14 +36,16 @@ export function SearchPanel({
   disableSearch,
   hideAdvancedSearch,
   extraChildren,
+  mb = 3,
 }: {
-  updateQuery(s: string): void;
-  updateSearch(s: string): void;
+  updateQuery?: (s: string) => void;
+  updateSearch: (s: string) => void;
   pageIndicators?: { from: number; to: number; total: number };
   filter: ResourceFilter;
-  disableSearch: boolean;
+  disableSearch?: boolean;
   hideAdvancedSearch?: boolean;
   extraChildren?: JSX.Element;
+  mb?: FlexProps['mb'];
 }) {
   const [query, setQuery] = useState(filter.search || filter.query || '');
   const [isAdvancedSearch, setIsAdvancedSearch] = useState(!!filter.query);
@@ -59,11 +63,11 @@ export function SearchPanel({
     setQuery(newQuery);
 
     if (isAdvancedSearch) {
-      updateQuery(newQuery);
+      updateQuery?.(newQuery);
       return;
     }
 
-    updateSearch(newQuery);
+    updateSearch?.(newQuery);
   }
 
   return (
@@ -71,7 +75,7 @@ export function SearchPanel({
       justifyContent="space-between"
       alignItems="center"
       width="100%"
-      mb={3}
+      mb={mb}
     >
       <Flex style={{ width: '100%' }} alignItems="center">
         <StyledFlex
diff --git a/web/packages/shared/components/Select/Select.story.tsx b/web/packages/shared/components/Select/Select.story.tsx
index 872cf36df6d64..f61fe9291d05e 100644
--- a/web/packages/shared/components/Select/Select.story.tsx
+++ b/web/packages/shared/components/Select/Select.story.tsx
@@ -16,15 +16,31 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import { Box, Flex, H3, H4 } from 'design';
 
 import Select, { Option } from '../Select';
 
-export default {
+type StoryProps = {
+  readOnly?: boolean;
+  isDisabled?: boolean;
+};
+
+const meta: Meta<StoryProps> = {
   title: 'Shared/Select',
+  component: Controls,
+  argTypes: {
+    readOnly: {
+      control: { type: 'boolean' },
+    },
+    isDisabled: {
+      control: { type: 'boolean' },
+    },
+  },
 };
+export default meta;
 
 const options: Option[] = [
   { value: 'access-role', label: 'access' },
@@ -32,7 +48,7 @@ const options: Option[] = [
   { value: 'auditor-role', label: 'auditor' },
 ];
 
-export function Selects() {
+export function Controls(props: StoryProps) {
   const [selectedMulti, setSelectedMulti] = useState<readonly Option[]>(
     options.slice(0, 2)
   );
@@ -49,6 +65,8 @@ export function Selects() {
             options={options}
             placeholder="Click to select a role"
             isMulti={true}
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
         <Box>
@@ -60,6 +78,8 @@ export function Selects() {
             placeholder="Click to select a role"
             isMulti={true}
             isClearable
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
         <Box>
@@ -69,17 +89,8 @@ export function Selects() {
             options={options}
             placeholder="Click to select a role"
             isMulti={true}
-          />
-        </Box>
-        <Box>
-          <H3>Multi, disabled</H3>
-          <Select
-            value={selectedMulti}
-            onChange={options => setSelectedMulti(options)}
-            options={options}
-            placeholder="Click to select a role"
-            isMulti={true}
-            isDisabled={true}
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
         <Box>
@@ -89,28 +100,17 @@ export function Selects() {
             onChange={option => setSelectedSingle(option)}
             options={options}
             placeholder="Click to select a role"
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
         <Box>
           <H3>Single, empty</H3>
-          <Select options={options} placeholder="Click to select a role" />
-        </Box>
-        <Box>
-          <H3>Single, disabled</H3>
-          <Select
-            isDisabled={true}
-            value={selectedSingle}
-            onChange={option => setSelectedSingle(option)}
-            options={options}
-            placeholder="Click to select a role"
-          />
-        </Box>
-        <Box>
-          <H3>Single, disabled, empty</H3>
           <Select
-            isDisabled={true}
             options={options}
             placeholder="Click to select a role"
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
         <Box>
@@ -121,6 +121,8 @@ export function Selects() {
             options={options}
             placeholder="Click to select a role"
             hasError
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Box>
       </Flex>
@@ -137,6 +139,8 @@ export function Selects() {
             onChange={option => setSelectedSingle(option)}
             options={options}
             placeholder="Click to select a role"
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
           <Select
             size="large"
@@ -146,6 +150,8 @@ export function Selects() {
             placeholder="Click to select a role"
             isMulti={true}
             isClearable={true}
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Flex>
         <Flex flex="1" flexDirection="column" gap={3} mt={3}>
@@ -156,6 +162,8 @@ export function Selects() {
             onChange={option => setSelectedSingle(option)}
             options={options}
             placeholder="Click to select a role"
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
           <Select
             size="medium"
@@ -165,6 +173,8 @@ export function Selects() {
             placeholder="Click to select a role"
             isMulti={true}
             isClearable={true}
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Flex>
         <Flex flex="1" flexDirection="column" gap={3} mt={3}>
@@ -175,6 +185,8 @@ export function Selects() {
             onChange={option => setSelectedSingle(option)}
             options={options}
             placeholder="Click to select a role"
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
           <Select
             size="small"
@@ -184,6 +196,8 @@ export function Selects() {
             placeholder="Click to select a role"
             isMulti={true}
             isClearable={true}
+            isDisabled={props.isDisabled}
+            readOnly={props.readOnly}
           />
         </Flex>
       </Flex>
diff --git a/web/packages/shared/components/Select/Select.tsx b/web/packages/shared/components/Select/Select.tsx
index ea4566a1501b6..dcb6d5a595320 100644
--- a/web/packages/shared/components/Select/Select.tsx
+++ b/web/packages/shared/components/Select/Select.tsx
@@ -22,6 +22,7 @@ import ReactSelect, {
   DropdownIndicatorProps,
   GroupBase,
   MultiValueRemoveProps,
+  Props as ReactSelectProps,
 } from 'react-select';
 import ReactSelectAsync from 'react-select/async';
 import ReactSelectCreatableAsync from 'react-select/async-creatable';
@@ -54,22 +55,31 @@ export default function Select<
     closeMenuOnSelect = true,
     components,
     customProps,
+    readOnly,
     ...restOfProps
   } = props;
   return (
-    <StyledSelect selectSize={size} hasError={hasError} elevated={elevated}>
+    <StyledSelect
+      selectSize={size}
+      hasError={hasError}
+      elevated={elevated}
+      readOnly={readOnly}
+    >
       <ReactSelect<Opt, IsMulti, Group>
-        components={{ ...defaultComponents, ...components }}
+        components={{
+          ...defaultComponents,
+          ...components,
+          ...readOnlyComponents(readOnly),
+        }}
         menuPlacement="auto"
         className="react-select-container"
         classNamePrefix="react-select"
-        isClearable={false}
-        isSearchable={true}
         closeMenuOnSelect={closeMenuOnSelect}
         placeholder="Select..."
         styles={stylesConfig}
         customProps={{ size, ...customProps }}
         {...restOfProps}
+        {...readOnlyAttributes(readOnly)}
       />
     </StyledSelect>
   );
@@ -85,12 +95,17 @@ export function SelectAsync<
     hasError = false,
     components,
     customProps,
+    readOnly,
     ...restOfProps
   } = props;
   return (
-    <StyledSelect selectSize={size} hasError={hasError}>
+    <StyledSelect selectSize={size} hasError={hasError} readOnly={readOnly}>
       <ReactSelectAsync<Opt, IsMulti, Group>
-        components={{ ...defaultComponents, ...components }}
+        components={{
+          ...defaultComponents,
+          ...components,
+          ...readOnlyComponents(readOnly),
+        }}
         className="react-select-container"
         classNamePrefix="react-select"
         isClearable={false}
@@ -101,6 +116,7 @@ export function SelectAsync<
         placeholder="Select..."
         customProps={{ size, ...customProps }}
         {...restOfProps}
+        {...readOnlyAttributes(readOnly)}
       />
     </StyledSelect>
   );
@@ -117,17 +133,23 @@ export function SelectCreatable<
     stylesConfig,
     components,
     customProps,
+    readOnly,
     ...restOfProps
   } = props;
   return (
-    <StyledSelect selectSize={size} hasError={hasError}>
+    <StyledSelect selectSize={size} hasError={hasError} readOnly={readOnly}>
       <CreatableSelect<Opt, IsMulti, Group>
-        components={{ ...defaultComponents, ...components }}
+        components={{
+          ...defaultComponents,
+          ...components,
+          ...readOnlyComponents(readOnly),
+        }}
         className="react-select-container"
         classNamePrefix="react-select"
         styles={stylesConfig}
         customProps={{ size, ...customProps }}
         {...restOfProps}
+        {...readOnlyAttributes(readOnly)}
       />
     </StyledSelect>
   );
@@ -144,12 +166,17 @@ export function SelectCreatableAsync<
     stylesConfig,
     components,
     customProps,
+    readOnly,
     ...restOfProps
   } = props;
   return (
-    <StyledSelect selectSize={size} hasError={hasError}>
+    <StyledSelect selectSize={size} hasError={hasError} readOnly={readOnly}>
       <ReactSelectCreatableAsync<Opt, IsMulti, Group>
-        components={{ ...defaultComponents, ...components }}
+        components={{
+          ...defaultComponents,
+          ...components,
+          ...readOnlyComponents(readOnly),
+        }}
         className="react-select-container"
         classNamePrefix="react-select"
         styles={stylesConfig}
@@ -160,6 +187,7 @@ export function SelectCreatableAsync<
         defaultMenuIsOpen={false}
         customProps={{ size, ...customProps }}
         {...restOfProps}
+        {...readOnlyAttributes(readOnly)}
       />
     </StyledSelect>
   );
@@ -238,6 +266,43 @@ function error({ hasError, theme }: { hasError?: boolean; theme: Theme }) {
   };
 }
 
+function readOnlyComponents(readOnly: boolean) {
+  if (!readOnly) {
+    return {};
+  }
+  return {
+    // removes dropdown icon
+    DropdownIndicator: () => null,
+    // removes the x button on multi values
+    MultiValueRemove: () => null,
+  };
+}
+
+function readOnlyAttributes(
+  readOnly: boolean
+): Pick<
+  ReactSelectProps,
+  | 'isSearchable'
+  | 'isClearable'
+  | 'openMenuOnClick'
+  | 'openMenuOnFocus'
+  | 'menuIsOpen'
+> {
+  if (!readOnly) {
+    return {};
+  }
+  return {
+    // prevents typing and cursor blink
+    isSearchable: false,
+    // removes the x button on control
+    isClearable: false,
+    // the rest prevents menu from opening in any way
+    openMenuOnClick: false,
+    openMenuOnFocus: false,
+    menuIsOpen: false,
+  };
+}
+
 /**
  * Don't use directly. If you need to apply a custom style to a dropdown, just
  * apply it to a regular Select component.
@@ -247,6 +312,7 @@ const StyledSelect = styled.div<{
   hasError?: boolean;
   elevated?: boolean;
   isDisabled?: boolean;
+  readOnly?: boolean;
 }>`
   .react-select-container {
     box-sizing: border-box;
@@ -282,14 +348,20 @@ const StyledSelect = styled.div<{
           : props.theme.colors.text.slightlyMuted};
     }
     &:hover {
-      border: 1px solid ${props => props.theme.colors.text.muted};
-      cursor: pointer;
+      border: 1px solid
+        ${props =>
+          props.readOnly
+            ? props.theme.colors.interactive.tonal.neutral[2]
+            : props.theme.colors.text.muted};
+      cursor: ${p => (p.isDisabled || p.readOnly ? 'not-allowed' : 'pointer')};
     }
   }
 
   .react-select__control--is-focused {
     border-color: ${props =>
-      props.theme.colors.interactive.solid.primary.default};
+      props.readOnly
+        ? props.theme.colors.interactive.tonal.neutral[2]
+        : props.theme.colors.interactive.solid.primary.default};
     cursor: pointer;
 
     .react-select__dropdown-indicator {
@@ -298,7 +370,9 @@ const StyledSelect = styled.div<{
 
     &:hover {
       border-color: ${props =>
-        props.theme.colors.interactive.solid.primary.default};
+        props.readOnly
+          ? props.theme.colors.interactive.tonal.neutral[2]
+          : props.theme.colors.interactive.solid.primary.default};
     }
   }
 
@@ -319,6 +393,9 @@ const StyledSelect = styled.div<{
       props.theme.colors.interactive.tonal.neutral[0]};
     border-radius: 1000px;
     padding: 0 0 0 12px;
+    // this is required and adds the padding that is lost
+    // when readOnly removes the remove button
+    ${props => (props.readOnly ? 'padding-right: 12px;' : ``)}
     overflow: hidden;
 
     /* 
diff --git a/web/packages/shared/components/Select/SelectCreatable.story.tsx b/web/packages/shared/components/Select/SelectCreatable.story.tsx
index ca7ca1d158af9..353342fe71c8d 100644
--- a/web/packages/shared/components/Select/SelectCreatable.story.tsx
+++ b/web/packages/shared/components/Select/SelectCreatable.story.tsx
@@ -16,17 +16,33 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import { Box, Flex } from 'design';
 
 import { Option, SelectCreatable } from '../Select';
 
-export default {
+type StoryProps = {
+  readOnly?: boolean;
+  isDisabled?: boolean;
+};
+
+const meta: Meta<StoryProps> = {
   title: 'Shared/SelectCreatable',
+  component: Controls,
+  argTypes: {
+    readOnly: {
+      control: { type: 'boolean' },
+    },
+    isDisabled: {
+      control: { type: 'boolean' },
+    },
+  },
 };
+export default meta;
 
-export const Selects = () => {
+export function Controls(props: StoryProps) {
   const [input, setInput] = useState('');
   const [inputMulti, setInputMulti] = useState('');
   const [selected, setSelected] = useState<Option>();
@@ -49,6 +65,8 @@ export const Selects = () => {
           value={selectedMulti}
           onInputChange={v => setInputMulti(v)}
           onChange={v => setSelectedMulti(v)}
+          isDisabled={props.isDisabled}
+          readOnly={props.readOnly}
         />
         Note: accept new candidate with Enter or mouse click
       </Box>
@@ -60,8 +78,10 @@ export const Selects = () => {
           value={selected}
           onInputChange={v => setInput(v)}
           onChange={v => setSelected(v)}
+          isDisabled={props.isDisabled}
+          readOnly={props.readOnly}
         />
       </Box>
     </Flex>
   );
-};
+}
diff --git a/web/packages/shared/components/Select/types.ts b/web/packages/shared/components/Select/types.ts
index 094bf9bc96852..9b80278a327d3 100644
--- a/web/packages/shared/components/Select/types.ts
+++ b/web/packages/shared/components/Select/types.ts
@@ -48,6 +48,11 @@ export type CommonProps<Opt, IsMulti extends boolean> = {
   // having this more strict (depending on `IsMulti`) helps us to pass the
   // correct type to the validation rules in `FieldSelect`.
   value?: OnChangeValue<Opt, IsMulti>;
+  /**
+   * Disables inputs and hides controls
+   * but does not mute values.
+   */
+  readOnly?: boolean;
 };
 
 export type Props<
diff --git a/web/packages/shared/components/SlidingSidePanel/InfoGuide/InfoGuideContext.tsx b/web/packages/shared/components/SlidingSidePanel/InfoGuide/InfoGuideContext.tsx
index bf7cb5f3b5274..8aed768c37e58 100644
--- a/web/packages/shared/components/SlidingSidePanel/InfoGuide/InfoGuideContext.tsx
+++ b/web/packages/shared/components/SlidingSidePanel/InfoGuide/InfoGuideContext.tsx
@@ -18,9 +18,11 @@
 
 import {
   createContext,
+  FC,
   PropsWithChildren,
   useContext,
   useEffect,
+  useMemo,
   useState,
   type JSX,
 } from 'react';
@@ -80,20 +82,23 @@ export type InfoGuideConfig = {
 
 const InfoGuidePanelContext = createContext<InfoGuidePanelContextState>(null);
 
-export const InfoGuidePanelProvider: React.FC<
+export const InfoGuidePanelProvider: FC<
   PropsWithChildren<{ defaultPanelWidth?: number }>
 > = ({ children, defaultPanelWidth = generalInfoPanelWidth }) => {
   const [infoGuideConfig, setInfoGuideConfig] =
     useState<InfoGuideConfig | null>(null);
 
+  const providerValue = useMemo(
+    () => ({
+      infoGuideConfig,
+      setInfoGuideConfig,
+      panelWidth: infoGuideConfig?.panelWidth || defaultPanelWidth,
+    }),
+    [defaultPanelWidth, infoGuideConfig]
+  );
+
   return (
-    <InfoGuidePanelContext.Provider
-      value={{
-        infoGuideConfig,
-        setInfoGuideConfig,
-        panelWidth: infoGuideConfig?.panelWidth || defaultPanelWidth,
-      }}
-    >
+    <InfoGuidePanelContext.Provider value={providerValue}>
       {children}
     </InfoGuidePanelContext.Provider>
   );
diff --git a/web/packages/shared/components/SlidingSidePanel/SlidingSidePanel.story.tsx b/web/packages/shared/components/SlidingSidePanel/SlidingSidePanel.story.tsx
index 67f701730c783..bddf1cf7831f9 100644
--- a/web/packages/shared/components/SlidingSidePanel/SlidingSidePanel.story.tsx
+++ b/web/packages/shared/components/SlidingSidePanel/SlidingSidePanel.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import { Box, ButtonPrimary } from 'design';
diff --git a/web/packages/shared/components/TextEditor/TextEditor.jsx b/web/packages/shared/components/TextEditor/TextEditor.jsx
index 82411e5cc8880..7fc01339fcece 100644
--- a/web/packages/shared/components/TextEditor/TextEditor.jsx
+++ b/web/packages/shared/components/TextEditor/TextEditor.jsx
@@ -22,6 +22,7 @@ import styled from 'styled-components';
 
 import 'ace-builds/src-noconflict/mode-json';
 import 'ace-builds/src-noconflict/mode-yaml';
+import 'ace-builds/src-noconflict/mode-terraform.js';
 import 'ace-builds/src-noconflict/ext-searchbox';
 
 import { ButtonSecondary } from 'design/Button';
@@ -59,6 +60,16 @@ class TextEditor extends Component {
       this.editor.setReadOnly(this.props.readOnly);
     }
 
+    // If the data changes, reset the value in each session so changes are
+    // rendered.
+    // Only update the content if the editor is read-only to prevent
+    // interrupting the editing experience.
+    if (this.props.readOnly && prevProps.data !== this.props.data) {
+      this.props.data.forEach((doc, i) => {
+        this.sessions[i].setValue(doc.content);
+      });
+    }
+
     this.editor.resize();
   }
 
@@ -118,6 +129,16 @@ class TextEditor extends Component {
     this.session = null;
   }
 
+  handleCopy() {
+    copyToClipboard(this.editor.session.getValue());
+    this.props.onCopy?.();
+  }
+
+  handleDownload() {
+    downloadObject(this.props.downloadFileName, this.editor.session.getValue());
+    this.props.onDownload?.();
+  }
+
   render() {
     const { bg = 'levels.sunken' } = this.props;
     const hasButton = this.props.copyButton || this.props.downloadButton;
@@ -130,7 +151,7 @@ class TextEditor extends Component {
             {this.props.copyButton && (
               <EditorButton
                 title="Copy to clipboard"
-                onClick={() => copyToClipboard(this.editor.session.getValue())}
+                onClick={() => this.handleCopy()}
               >
                 <Copy size="medium" />
               </EditorButton>
@@ -138,12 +159,7 @@ class TextEditor extends Component {
             {this.props.downloadButton && (
               <EditorButton
                 title="Download"
-                onClick={() =>
-                  downloadObject(
-                    this.props.downloadFileName,
-                    this.editor.session.getValue()
-                  )
-                }
+                onClick={() => this.handleDownload()}
               >
                 <Download size="medium" />
               </EditorButton>
@@ -160,6 +176,16 @@ function getMode(docType) {
     return 'ace/mode/json';
   }
 
+  if (docType === 'terraform') {
+    return 'ace/mode/terraform';
+  }
+
+  if (docType === 'yaml') {
+    return 'ace/mode/yaml';
+  }
+
+  // Makes more sense to default to `ace/mode/text`, but there are existing uses
+  // that don't provide a type.
   return 'ace/mode/yaml';
 }
 
diff --git a/web/packages/shared/components/TextEditor/TextEditor.mock.tsx b/web/packages/shared/components/TextEditor/TextEditor.mock.tsx
new file mode 100644
index 0000000000000..61edbbaa62ecc
--- /dev/null
+++ b/web/packages/shared/components/TextEditor/TextEditor.mock.tsx
@@ -0,0 +1,42 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+jest.mock('./TextEditor', () => {
+  return {
+    __esModule: true,
+    default: MockTextEditor,
+  };
+});
+
+/**
+ * How to use this?
+ *
+ * Import "shared/components/TextEditor/TextEditor.mock" in your test file and
+ * the mock will be setup for you. It can be used to test the content only, no
+ * other features are available in the mock.
+ */
+
+function MockTextEditor(props: { data?: [{ content: string }] }) {
+  return (
+    <div data-testid="mock-text-editor">
+      {props.data?.map(d => (
+        <div key={d.content}>{d.content}</div>
+      ))}
+    </div>
+  );
+}
diff --git a/web/packages/shared/components/TextSelectCopy/TextSelectCopy.story.tsx b/web/packages/shared/components/TextSelectCopy/TextSelectCopy.story.tsx
index 5b38b6379f042..9959135cfc3b2 100644
--- a/web/packages/shared/components/TextSelectCopy/TextSelectCopy.story.tsx
+++ b/web/packages/shared/components/TextSelectCopy/TextSelectCopy.story.tsx
@@ -29,3 +29,9 @@ export const BashCommand = () => {
 export const NonBash = () => {
   return <Component text="some text to be copied" bash={false} />;
 };
+
+export const Obfuscated = () => {
+  return (
+    <Component text="Super-secret-donot-tell-anyone" bash={false} obfuscate />
+  );
+};
diff --git a/web/packages/shared/components/TextSelectCopy/TextSelectCopy.tsx b/web/packages/shared/components/TextSelectCopy/TextSelectCopy.tsx
index 74d23a2500cba..c0d3129fc1132 100644
--- a/web/packages/shared/components/TextSelectCopy/TextSelectCopy.tsx
+++ b/web/packages/shared/components/TextSelectCopy/TextSelectCopy.tsx
@@ -30,12 +30,17 @@ export function TextSelectCopy({
   allowMultiline,
   onCopy,
   bash = true,
+  obfuscate = false,
   ...styles
 }: Props) {
   const font = fontFamily || useTheme().fonts.mono;
   const ref = useRef(undefined);
   const abortControllerRef = useRef<AbortController>(undefined);
   const [copyCmd, setCopyCmd] = useState(() => 'Copy');
+  const [isObfuscated, setIsObfuscated] = useState(false);
+
+  const displayText =
+    obfuscate && !bash && !isObfuscated ? obfuscateText(text) : text;
 
   function onCopyClick() {
     abortControllerRef.current?.abort();
@@ -84,20 +89,36 @@ export function TextSelectCopy({
     >
       <Flex mr="2" style={boxStyles}>
         {bash && <Box mr="1" style={{ userSelect: 'none' }}>{`$`}</Box>}
-        <div ref={ref}>{text}</div>
+        <div ref={ref}>{displayText}</div>
+      </Flex>
+      <Flex gap={2} alignItems="center">
+        {obfuscate && (
+          <ButtonPrimary
+            onClick={() => setIsObfuscated(!isObfuscated)}
+            style={{
+              maxWidth: '48px',
+              width: '100%',
+              padding: '4px 8px',
+              minHeight: '10px',
+              fontSize: '10px',
+            }}
+          >
+            {isObfuscated ? 'Hide' : 'Show'}
+          </ButtonPrimary>
+        )}
+        <ButtonPrimary
+          onClick={onCopyClick}
+          style={{
+            maxWidth: '48px',
+            width: '100%',
+            padding: '4px 8px',
+            minHeight: '10px',
+            fontSize: '10px',
+          }}
+        >
+          {copyCmd}
+        </ButtonPrimary>
       </Flex>
-      <ButtonPrimary
-        onClick={onCopyClick}
-        style={{
-          maxWidth: '48px',
-          width: '100%',
-          padding: '4px 8px',
-          minHeight: '10px',
-          fontSize: '10px',
-        }}
-      >
-        {copyCmd}
-      </ButtonPrimary>
     </Flex>
   );
 }
@@ -109,4 +130,16 @@ type Props = {
   allowMultiline?: boolean;
   // handles styles
   [key: string]: any;
-};
+  // only one of `bash`/`obfuscate` should be set at a time
+} & (
+  | {
+      bash: false;
+      obfuscate?: true;
+    }
+  | {
+      bash?: true;
+      obfuscate?: false;
+    }
+);
+
+const obfuscateText = (value: string): string => '•'.repeat(value.length);
diff --git a/web/packages/shared/components/ToastNotification/ToastNotification.story.tsx b/web/packages/shared/components/ToastNotification/ToastNotification.story.tsx
new file mode 100644
index 0000000000000..cfa8db702b361
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/ToastNotification.story.tsx
@@ -0,0 +1,341 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import Flex from 'design/Flex';
+import { Bots } from 'design/Icon';
+
+import { ToastNotification } from './ToastNotification';
+
+export default {
+  title: 'Shared/ToastNotification',
+};
+
+export const Toasts = () => {
+  return (
+    <div
+      css={`
+        display: grid;
+        grid-gap: ${props => props.theme.space[8]}px;
+        grid-template-columns: auto auto auto;
+      `}
+    >
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              title: 'Info with title and description',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'warn',
+            content: {
+              title: 'Warning with title and description',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'error',
+            content: {
+              title: 'Error with title and description',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'neutral',
+            content: {
+              title: 'Neutral with title and description',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'neutral',
+            content: {
+              title: 'Custom icon with title and description',
+              description: loremIpsum,
+              icon: Bots,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              title: 'Info with title and description',
+              subtitle: 'And some subtitle, too',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'warn',
+            content: {
+              title: 'Warning with title and description',
+              subtitle: 'And some subtitle, too',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'error',
+            content: {
+              title: 'Error with title and description',
+              subtitle: 'And some subtitle, too',
+              description: loremIpsum,
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: 'Multiline info without title. ' + loremIpsum,
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'warn',
+            content: 'Multiline warning without title. ' + loremIpsum,
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'error',
+            content: 'Multiline error without title. ' + loremIpsum,
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: 'Info without title',
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              title: 'Info with link',
+              description: loremIpsum,
+              action: {
+                href: 'https://goteleport.com',
+                content: 'Learn More',
+              },
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              title: 'Info with list',
+              list: [loremIpsum, loremIpsum],
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content:
+              'Long continuous strings. /Users/test/Library/ApplicationSupport/foobarbazio/barbazfoobarioloremoipsumoconfigurationobaziofoobazi/baz/lorem/ipsum/Electron/configuration.json',
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              title:
+                'A very long title with a very long address that spans multiple lines tcp-postgres.foo.bar.baz.cloud.gravitational.io and some more text on another line',
+              description:
+                'Long continuous strings. /Users/test/Library/ApplicationSupport/foobarbazio/barbazfoobarioloremoipsumoconfigurationobaziofoobazi/baz/lorem/ipsum/Electron/configuration.json',
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              description: 'Info with description, without a title',
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+      <Flex flexDirection="column" gap={4}>
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content: {
+              list: ['Info with a list', 'But no title'],
+            },
+          }}
+          onRemove={() => {}}
+          isAutoRemovable={false}
+        />
+      </Flex>
+    </div>
+  );
+};
+
+export const AutoRemovable = () => {
+  const [showInfo, setShowInfo] = useState(true);
+  const [showWarning, setShowWarning] = useState(true);
+  const [showError, setShowError] = useState(true);
+
+  return (
+    <Flex flexDirection="column" gap={4}>
+      {showInfo ? (
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'info',
+            content:
+              "This will be automatically removed after 5 seconds. Click to expand it. Mouseover it to restart the timer. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
+          }}
+          onRemove={() => setShowInfo(false)}
+          isAutoRemovable={true}
+        />
+      ) : (
+        <div>Info notification has been removed</div>
+      )}
+      {showWarning ? (
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'warn',
+            content:
+              "This will be automatically removed after 5 seconds. Click to expand it. Mouseover it to restart the timer. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
+          }}
+          onRemove={() => setShowWarning(false)}
+          isAutoRemovable={true}
+        />
+      ) : (
+        <div>Warning notification has been removed</div>
+      )}
+      {showError ? (
+        <ToastNotification
+          item={{
+            id: crypto.randomUUID(),
+            severity: 'error',
+            content:
+              "This can only be removed by clicking on the X. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.",
+          }}
+          onRemove={() => setShowError(false)}
+          isAutoRemovable={false}
+        />
+      ) : (
+        <div>Error notification has been removed</div>
+      )}
+    </Flex>
+  );
+};
+
+const loremIpsum =
+  'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut non ipsum dignissim, dignissim est vitae, facilisis nunc.';
diff --git a/web/packages/shared/components/ToastNotification/ToastNotification.test.tsx b/web/packages/shared/components/ToastNotification/ToastNotification.test.tsx
new file mode 100644
index 0000000000000..3ca631502a78b
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/ToastNotification.test.tsx
@@ -0,0 +1,50 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { fireEvent, screen } from '@testing-library/react';
+
+import { render } from 'design/utils/testing';
+
+import { ToastNotification } from './ToastNotification';
+
+test('click on action button does not expand or collapse notification', async () => {
+  const description = 'An error happened';
+
+  render(
+    <ToastNotification
+      item={{
+        id: '865801ca',
+        severity: 'error',
+        content: {
+          title: 'Warning',
+          description,
+          action: { content: 'Retry' },
+        },
+      }}
+      onRemove={() => {}}
+    />
+  );
+
+  fireEvent.click(screen.getByText('Retry'));
+
+  // Check if the text still has the initial, "collapsed" style (look at shortTextCss).
+  expect(screen.getByText(description)).toHaveStyleRule(
+    '-webkit-line-clamp',
+    '3'
+  );
+});
diff --git a/web/packages/shared/components/ToastNotification/ToastNotification.tsx b/web/packages/shared/components/ToastNotification/ToastNotification.tsx
new file mode 100644
index 0000000000000..5bbcfb1e24532
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/ToastNotification.tsx
@@ -0,0 +1,327 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React, { useEffect, useRef, useState } from 'react';
+import styled, { useTheme } from 'styled-components';
+
+import { Box, ButtonIcon, Flex, Text } from 'design';
+import { ActionButton } from 'design/Alert';
+import { BoxProps } from 'design/Box';
+import { Cross } from 'design/Icon';
+import * as Icon from 'design/Icon';
+import { IconProps } from 'design/Icon/Icon';
+import { borderColor } from 'design/system';
+import { Theme } from 'design/theme/themes/types';
+
+import type {
+  ToastNotificationItem,
+  ToastNotificationItemContent,
+  ToastNotificationItemObjectContent,
+  ToastNotificationSeverity,
+} from './types';
+
+interface ToastNotificationProps extends BoxProps {
+  item: ToastNotificationItem;
+
+  onRemove(): void;
+
+  /**
+   * If defined, determines whether the notification is auto-dismissed after 5
+   * seconds. If undefined, the decision is based on the notification severity:
+   * only 'success', 'info', and 'neutral' notifications are removable by
+   * default.
+   *
+   * @deprecated: Define isAutoRemovable on item.content instead.
+   */
+  isAutoRemovable?: boolean;
+}
+
+export const autoRemoveDurationMs = 5_000; // 5s
+
+export function ToastNotification(props: ToastNotificationProps) {
+  const {
+    item,
+    onRemove,
+    // TODO(ravicious): Remove isAutoRemovable in favor of item.content.isAutoRemovable.
+    isAutoRemovable: isAutoRemovableProp,
+    ...styleProps
+  } = props;
+  const content = toObjectContent(item.content);
+  const [isHovered, setIsHovered] = useState(false);
+  const [isExpanded, setIsExpanded] = useState(false);
+  const timeoutHandler = useRef<number>(undefined);
+  const theme = useTheme();
+
+  const isAutoRemovable =
+    getContentIsAutoRemovable(item.content) ??
+    isAutoRemovableProp ??
+    ['success', 'info', 'neutral'].includes(item.severity);
+  useEffect(() => {
+    if (!isHovered && isAutoRemovable) {
+      timeoutHandler.current = setTimeout(
+        onRemove,
+        autoRemoveDurationMs
+      ) as unknown as number;
+    }
+
+    return () => {
+      if (timeoutHandler.current) {
+        clearTimeout(timeoutHandler.current);
+      }
+    };
+  }, [isHovered, isAutoRemovable]);
+
+  function toggleIsExpanded() {
+    setIsExpanded(wasExpanded => !wasExpanded);
+  }
+
+  const { borderColor, iconColor } = notificationColors(theme, item.severity);
+
+  return (
+    <Container
+      data-testid={`toast-note-${item.id}`}
+      py={3}
+      // We use a custom value to offset the default padding by the width of the
+      // left border.
+      pl="12px"
+      pr={3}
+      borderColor={borderColor}
+      onMouseOver={() => {
+        if (isHovered === false) {
+          setIsHovered(true);
+        }
+      }}
+      onMouseLeave={() => {
+        if (isHovered === true) {
+          setIsHovered(false);
+        }
+      }}
+      onClick={toggleIsExpanded}
+      {...styleProps}
+    >
+      <Flex gap={2} flexDirection="column">
+        <Flex flexDirection="row" gap={2}>
+          <NotificationIcon
+            severity={item.severity}
+            size="medium"
+            color={iconColor}
+            customIcon={content.icon}
+          />
+          {/* Right margin leaves room for the close button. Note that we
+              wouldn't have to do it if the close button was in layout, but we
+              would have to nudge it a bit to top-right anyway, and it would
+              then occupy too much vertical space where it used to be, causing
+              other problems. */}
+          <Box flex="1" mr={4}>
+            <Text typography="h3">{content.title}</Text>
+            <Text typography="body3">{content.subtitle}</Text>
+          </Box>
+        </Flex>
+        <NotificationBody content={content} isExpanded={isExpanded} />
+      </Flex>
+      <CloseIcon
+        style={{
+          visibility: isHovered ? 'visible' : 'hidden',
+        }}
+        title="Close Notification"
+        onClick={e => {
+          e.stopPropagation();
+          onRemove();
+        }}
+      >
+        <Cross size="small" />
+      </CloseIcon>
+    </Container>
+  );
+}
+
+const NotificationIcon = ({
+  severity,
+  customIcon: CustomIcon,
+  ...otherProps
+}: {
+  severity: ToastNotificationSeverity;
+  customIcon: React.ComponentType<IconProps>;
+} & IconProps) => {
+  const commonProps = { role: 'graphics-symbol', ...otherProps };
+  if (CustomIcon) {
+    return <CustomIcon {...commonProps} />;
+  }
+  switch (severity) {
+    case 'success':
+      return <Icon.Checks aria-label="Success" {...commonProps} />;
+    case 'error':
+      return <Icon.WarningCircle aria-label="Danger" {...commonProps} />;
+    case 'info':
+      return <Icon.Info aria-label="Info" {...commonProps} />;
+    case 'warn':
+      return <Icon.Warning aria-label="Warning" {...commonProps} />;
+    case 'neutral':
+      return <Icon.Notification aria-label="Note" {...commonProps} />;
+    default:
+      severity satisfies never;
+  }
+};
+
+const toObjectContent = (
+  content: ToastNotificationItemContent
+): ToastNotificationItemObjectContent =>
+  typeof content === 'string' ? { title: content } : content;
+
+const getContentIsAutoRemovable = (
+  content: ToastNotificationItemContent
+): boolean | undefined =>
+  typeof content === 'string' ? undefined : content.isAutoRemovable;
+
+const notificationColors = (
+  theme: Theme,
+  severity: ToastNotificationSeverity
+) => {
+  switch (severity) {
+    case 'neutral':
+      return {
+        borderColor: theme.colors.interactive.tonal.neutral[2],
+        iconColor: theme.colors.text.main,
+      };
+    case 'error':
+      return {
+        borderColor: theme.colors.interactive.solid.danger.default,
+        iconColor: theme.colors.interactive.solid.danger.default,
+      };
+    case 'warn':
+      return {
+        borderColor: theme.colors.interactive.solid.alert.default,
+        iconColor: theme.colors.interactive.solid.alert.default,
+      };
+    case 'info':
+      return {
+        borderColor: theme.colors.interactive.solid.accent.default,
+        iconColor: theme.colors.interactive.solid.accent.default,
+      };
+    case 'success':
+      return {
+        borderColor: theme.colors.interactive.solid.success.default,
+        iconColor: theme.colors.interactive.solid.success.default,
+      };
+    default:
+      severity satisfies never;
+  }
+};
+
+const CloseIcon = styled(ButtonIcon)`
+  /* Place the close button so that its hover state circle "overflows" the layout
+   * padding a bit, placing the close icon itself in alignment with the padding. */
+  position: absolute;
+  top: ${props => props.theme.space[2]}px;
+  right: ${props => props.theme.space[2]}px;
+`;
+
+const NotificationBody = ({
+  content,
+  isExpanded,
+}: {
+  content: ToastNotificationItemObjectContent;
+  isExpanded: boolean;
+}) => {
+  const longerTextCss = isExpanded ? textCss : shortTextCss;
+  const hasListOrDescription = !!content.list || !!content.description;
+
+  const { action } = content;
+
+  return (
+    <>
+      {/* Note: an empty <Text/> element would still generate a flex gap, so we
+          only render it if necessary. */}
+      {hasListOrDescription && (
+        <Text typography="body2" color="text.slightlyMuted" css={longerTextCss}>
+          {content.list && <List items={content.list} />}
+          {content.description}
+        </Text>
+      )}
+      {action && (
+        <Box alignSelf="flex-start">
+          <ActionButton
+            intent="neutral"
+            action={{
+              linkTo: action.linkTo,
+              href: action.href,
+              content: action.content,
+              onClick: event => {
+                // Prevents toggling the isExpanded flag.
+                event.stopPropagation();
+                action.onClick?.(event);
+              },
+            }}
+          />
+        </Box>
+      )}
+    </>
+  );
+};
+
+function List(props: { items: string[] }) {
+  return (
+    <ul
+      // Ideally we'd align the bullet point to the left without using list-style-position: inside
+      // (because it looks bad when the list item spans multiple lines).
+      //
+      // However, it seems impossible to use padding-inline-start for that because the result looks
+      // different on Retina vs non-Retina screens, the bullet point looks cut off on the latter if
+      // padding-inline-start is set to 1em. So instead we just set it to 2em.
+      css={`
+        margin: 0;
+        padding-inline-start: 2em;
+      `}
+    >
+      {props.items.map((item, index) => (
+        <li key={index}>{item}</li>
+      ))}
+    </ul>
+  );
+}
+
+const textCss = `
+  overflow-wrap: anywhere;
+  white-space: pre-line;
+`;
+
+const shortTextCss = `
+  ${textCss};
+  display: -webkit-box;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 3;
+`;
+
+const Container = styled(Box)`
+  /* Positioning anchor for the close button. */
+  position: relative;
+  background: ${props => props.theme.colors.levels.elevated};
+  border-left: ${props => props.theme.borders[3]};
+  width: 320px;
+  box-shadow:
+    0px 3px 5px -1px rgba(0, 0, 0, 0.2),
+    0px 6px 10px 0px rgba(0, 0, 0, 0.14),
+    0px 1px 18px 0px rgba(0, 0, 0, 0.12);
+  color: ${props => props.theme.colors.text.main};
+  border-radius: ${props => props.theme.radii[3]}px;
+  cursor: pointer;
+  // Break up long addresses.
+  word-break: break-word;
+
+  ${borderColor}
+`;
diff --git a/web/packages/shared/components/ToastNotification/ToastNotificationContext.tsx b/web/packages/shared/components/ToastNotification/ToastNotificationContext.tsx
new file mode 100644
index 0000000000000..4f1d0da38187f
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/ToastNotificationContext.tsx
@@ -0,0 +1,101 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  createContext,
+  FC,
+  PropsWithChildren,
+  useCallback,
+  useContext,
+  useState,
+} from 'react';
+
+import {
+  ToastNotificationItem,
+  ToastNotificationItemContent,
+  ToastNotificationSeverity,
+} from './types';
+
+export type NotificationEntry = {
+  severity: ToastNotificationSeverity;
+  content: ToastNotificationItemContent;
+};
+
+type ToastNotificationContextState = {
+  notifications: ToastNotificationItem[];
+  /**
+   * remove a notification matching id.
+   */
+  remove(id: string): void;
+  /**
+   * adds new notification to the beginning of
+   * an existing list of notifications.
+   */
+  add(entry: NotificationEntry): void;
+};
+
+const ToastNotificationContext =
+  createContext<ToastNotificationContextState>(null);
+
+/**
+ * Provider for adding, removing, and listing toast notifications.
+ */
+export const ToastNotificationProvider: FC<PropsWithChildren> = ({
+  children,
+}) => {
+  const [notifications, setNotifications] = useState<ToastNotificationItem[]>(
+    []
+  );
+
+  const remove = useCallback((id: string) => {
+    setNotifications(n => n.filter(item => item.id !== id));
+  }, []);
+
+  const add = useCallback((entry: NotificationEntry) => {
+    setNotifications(n => [
+      {
+        id: crypto.randomUUID(),
+        content: entry.content,
+        severity: entry.severity,
+      },
+      ...n,
+    ]);
+  }, []);
+
+  return (
+    <ToastNotificationContext.Provider value={{ notifications, add, remove }}>
+      {children}
+    </ToastNotificationContext.Provider>
+  );
+};
+
+/**
+ * useToastNotifications allows you to add to or remove from a
+ * list of notifications from ToastNotificationContext.
+ */
+export function useToastNotifications() {
+  const context = useContext(ToastNotificationContext);
+
+  if (!context) {
+    throw new Error(
+      'useToastNotifications must be used within a ToastNotificationProvider'
+    );
+  }
+
+  return context;
+}
diff --git a/web/packages/shared/components/ToastNotification/ToastNotifications.tsx b/web/packages/shared/components/ToastNotification/ToastNotifications.tsx
new file mode 100644
index 0000000000000..3be8aa3937e88
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/ToastNotifications.tsx
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import { ToastNotification } from './ToastNotification';
+import { useToastNotifications } from './ToastNotificationContext';
+
+/**
+ * Renders a list of notification toasts in the top right corner of the screen.
+ * Toasts are sticky when scrolling is enabled on the screen.
+ *
+ * Info like notifications (success, info, neutral) are automatically removed
+ * from the notification list after a set time.
+ *
+ * Requires ToastNotificationProvider.
+ */
+export const ToastNotifications = () => {
+  const { remove: removeNotification, notifications } = useToastNotifications();
+
+  return (
+    <TopRightStickyContainer>
+      <TopRightFlexedContainer>
+        {notifications.map(item => (
+          <ToastNotification
+            key={item.id}
+            item={item}
+            onRemove={() => removeNotification(item.id)}
+          />
+        ))}
+      </TopRightFlexedContainer>
+    </TopRightStickyContainer>
+  );
+};
+
+const TopRightStickyContainer = styled.div`
+  position: sticky;
+  top: 0;
+  right: 0;
+  z-index: 1;
+`;
+
+const TopRightFlexedContainer = styled.div`
+  position: absolute;
+  top: ${p => p.theme.space[2]}px;
+  right: ${p => p.theme.space[5]}px;
+  display: flex;
+  flex-direction: column;
+  gap: ${p => p.theme.space[3]}px;
+`;
diff --git a/web/packages/shared/components/ToastNotification/index.ts b/web/packages/shared/components/ToastNotification/index.ts
new file mode 100644
index 0000000000000..cbe229d918eab
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/index.ts
@@ -0,0 +1,26 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './ToastNotification';
+export * from './ToastNotifications';
+export * from './ToastNotificationContext';
+export type {
+  ToastNotificationItem,
+  ToastNotificationItemContent,
+  ToastNotificationSeverity,
+} from './types';
diff --git a/web/packages/shared/components/ToastNotification/types.ts b/web/packages/shared/components/ToastNotification/types.ts
new file mode 100644
index 0000000000000..d3ca9e6fa0aec
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/types.ts
@@ -0,0 +1,53 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+
+import { Action } from 'design/Alert';
+import { IconProps } from 'design/Icon/Icon';
+
+export type ToastNotificationSeverity =
+  | 'info'
+  | 'warn'
+  | 'error'
+  | 'success'
+  | 'neutral';
+
+export interface ToastNotificationItem {
+  content: ToastNotificationItemContent;
+  severity: ToastNotificationSeverity;
+  id: string;
+}
+
+export type ToastNotificationItemContent =
+  | string
+  | ToastNotificationItemObjectContent;
+
+export type ToastNotificationItemObjectContent = {
+  title?: string;
+  subtitle?: string;
+  list?: string[];
+  description?: string;
+  icon?: React.ComponentType<IconProps>;
+  action?: Action;
+  /**
+   * If defined, isAutoRemovable circumvents the auto-removing logic in the Notification component,
+   * which automatically removes 'success', 'info', and 'neutral' notifications.
+   */
+  isAutoRemovable?: boolean;
+};
diff --git a/web/packages/shared/components/ToastNotification/useToastNotification.test.tsx b/web/packages/shared/components/ToastNotification/useToastNotification.test.tsx
new file mode 100644
index 0000000000000..89add524581be
--- /dev/null
+++ b/web/packages/shared/components/ToastNotification/useToastNotification.test.tsx
@@ -0,0 +1,111 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook, waitFor } from '@testing-library/react';
+
+import { ShieldCheck } from 'design/Icon';
+
+import {
+  ToastNotificationProvider,
+  useToastNotifications,
+} from './ToastNotificationContext';
+import { ToastNotificationItemObjectContent } from './types';
+
+const wrapper = ({ children }) => (
+  <ToastNotificationProvider>{children}</ToastNotificationProvider>
+);
+
+describe('useToastNotifications', () => {
+  test('add notification', async () => {
+    const { result } = renderHook(() => useToastNotifications(), {
+      wrapper,
+    });
+
+    expect(result.current.notifications).toHaveLength(0);
+
+    // addNotification with content type "string"
+    await act(async () => {
+      result.current.add({
+        severity: 'error',
+        content: 'first note',
+      });
+    });
+
+    await waitFor(() => {
+      expect(result.current.notifications).toHaveLength(1);
+    });
+
+    expect(result.current.notifications[0].content).toEqual('first note');
+    expect(result.current.notifications[0].severity).toEqual('error');
+    expect(result.current.notifications[0].id).toBeTruthy();
+
+    // addNotification with content type "Object"
+    await act(async () => {
+      result.current.add({
+        severity: 'info',
+        content: {
+          title: 'second note',
+          description: 'some description',
+          icon: ShieldCheck,
+        },
+      });
+    });
+
+    await waitFor(() => {
+      expect(result.current.notifications).toHaveLength(2);
+    });
+
+    expect(result.current.notifications[0].id).toBeTruthy();
+    expect(result.current.notifications[0].severity).toEqual('info');
+
+    const item = result.current.notifications[0]
+      .content as ToastNotificationItemObjectContent;
+    expect(item.title).toEqual('second note');
+    expect(item.description).toEqual('some description');
+    expect(item.icon).toEqual(ShieldCheck);
+
+    // New notes get added to the beginning of list.
+    // Oldest notes are at the end of list.
+    expect(result.current.notifications[1].content).toEqual('first note');
+  });
+
+  test('remove notification', async () => {
+    const { result } = renderHook(() => useToastNotifications(), {
+      wrapper,
+    });
+
+    await act(async () => {
+      result.current.add({
+        severity: 'error',
+        content: 'error content',
+      });
+    });
+
+    await waitFor(() => {
+      expect(result.current.notifications).toHaveLength(1);
+    });
+
+    await act(async () => {
+      result.current.remove(result.current.notifications[0].id);
+    });
+
+    await waitFor(() => {
+      expect(result.current.notifications).toHaveLength(0);
+    });
+  });
+});
diff --git a/web/packages/shared/components/TraitsEditor/TraitsEditor.story.tsx b/web/packages/shared/components/TraitsEditor/TraitsEditor.story.tsx
index 27b12d6001e1b..e245aff781ef6 100644
--- a/web/packages/shared/components/TraitsEditor/TraitsEditor.story.tsx
+++ b/web/packages/shared/components/TraitsEditor/TraitsEditor.story.tsx
@@ -26,13 +26,8 @@ export default {
   title: 'Shared/TraitsEditor',
 };
 
-export const TraitsEditorWithoutToolTip = () => {
-  const [traits, setTraits] = useState<TraitsOption[]>([
-    {
-      traitKey: { label: 'logins', value: 'logins' },
-      traitValues: [{ label: 'root', value: 'root' }],
-    },
-  ]);
+export const TraitsEditorBasic = () => {
+  const [traits, setTraits] = useState<TraitsOption[]>(mockConfiguredTraits);
 
   return (
     <Validation>
@@ -76,3 +71,26 @@ export const TraitsEditorWithToolTip = () => {
     </Validation>
   );
 };
+
+export const TraitsEditorWithCustomLabels = () => {
+  const [traits, setTraits] = useState<TraitsOption[]>(mockConfiguredTraits);
+
+  return (
+    <Validation>
+      <TraitsEditor
+        isLoading={false}
+        configuredTraits={traits}
+        setConfiguredTraits={setTraits}
+        addActionLabel="Custom Action"
+        addActionSubsequentLabel="Custom Subsequent Action"
+      />
+    </Validation>
+  );
+};
+
+const mockConfiguredTraits = [
+  {
+    traitKey: { label: 'logins', value: 'logins' },
+    traitValues: [{ label: 'root', value: 'root' }],
+  },
+];
diff --git a/web/packages/shared/components/TraitsEditor/TraitsEditor.test.tsx b/web/packages/shared/components/TraitsEditor/TraitsEditor.test.tsx
index caa2ee1c3ca21..da23c1ad0dd85 100644
--- a/web/packages/shared/components/TraitsEditor/TraitsEditor.test.tsx
+++ b/web/packages/shared/components/TraitsEditor/TraitsEditor.test.tsx
@@ -19,6 +19,7 @@
 import { fireEvent, render, screen } from 'design/utils/testing';
 import Validation from 'shared/components/Validation';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { AllUserTraits } from 'teleport/services/user';
 
 import {
@@ -48,7 +49,7 @@ test('Available traits are rendered', async () => {
 
   expect(screen.getByText('User Traits')).toBeInTheDocument();
   expect(screen.getAllByTestId('trait-key')).toHaveLength(3);
-  expect(screen.getAllByTestId('trait-value')).toHaveLength(3);
+  expect(screen.getAllByTestId('trait-values')).toHaveLength(3);
 });
 
 test('Add and remove Trait', async () => {
@@ -66,7 +67,7 @@ test('Add and remove Trait', async () => {
   );
   expect(screen.queryAllByTestId('trait-key')).toHaveLength(0);
 
-  const addButtonEl = screen.getByRole('button', { name: /Add user trait/i });
+  const addButtonEl = screen.getByRole('button', { name: /Add a user trait/i });
   expect(addButtonEl).toBeInTheDocument();
   fireEvent.click(addButtonEl);
 
diff --git a/web/packages/shared/components/TraitsEditor/TraitsEditor.tsx b/web/packages/shared/components/TraitsEditor/TraitsEditor.tsx
index 1bbd53caf06d1..d50369428e717 100644
--- a/web/packages/shared/components/TraitsEditor/TraitsEditor.tsx
+++ b/web/packages/shared/components/TraitsEditor/TraitsEditor.tsx
@@ -17,21 +17,27 @@
  */
 
 import { Dispatch, SetStateAction } from 'react';
+import styled from 'styled-components';
 
-import { Box, ButtonBorder, ButtonIcon, Flex, Text } from 'design';
-import { Add, Trash } from 'design/Icon';
-import { IconTooltip } from 'design/Tooltip';
+import { ButtonIcon, ButtonSecondary, Flex } from 'design';
+import { buttonSizes } from 'design/ButtonIcon';
+import { Cross } from 'design/Icon';
+import { inputGeometry } from 'design/Input/Input';
+import { LabelContent } from 'design/LabelInput/LabelInput';
 import { FieldSelectCreatable } from 'shared/components/FieldSelect';
 import { Option } from 'shared/components/Select';
 import { requiredAll, requiredField } from 'shared/components/Validation/rules';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { AllUserTraits } from 'teleport/services/user';
 
+import { ButtonWithAddIcon } from '../ButtonWithAddIcon';
+
 /**
  * traitsPreset is a list of system defined traits in Teleport.
  * The list is used to populate traits key option.
  */
-const traitsPreset = [
+export const traitsPreset = [
   'aws_role_arns',
   'azure_identities',
   'db_names',
@@ -45,7 +51,27 @@ const traitsPreset = [
   'logins',
   'windows_logins',
   'github_orgs',
-];
+  'mcp_tools',
+  'default_relay_addr',
+] as const;
+
+export const traitDescriptions = {
+  aws_role_arns: 'List of allowed AWS role ARNS',
+  azure_identities: 'List of Azure identities',
+  db_names: 'List of allowed database names',
+  db_roles: 'List of allowed database roles',
+  db_users: 'List of allowed database users',
+  gcp_service_accounts: 'List of GCP service accounts',
+  kubernetes_groups: 'List of allowed Kubernetes groups',
+  kubernetes_users: 'List of allowed Kubernetes users',
+  logins: 'List of allowed logins',
+  windows_logins: 'List of allowed Windows logins',
+  host_user_gid: 'The group ID to use for auto-host-users',
+  host_user_uid: 'The user ID to use for auto-host-users',
+  github_orgs: 'List of allowed GitHub organizations for git command proxy',
+  mcp_tools: 'List of allowed MCP tools',
+  default_relay_addr: 'The relay address that clients should use by default',
+} as const satisfies { [key in (typeof traitsPreset)[number]]: string };
 
 /**
  * TraitsEditor supports add, edit or remove traits functionality.
@@ -61,6 +87,9 @@ export function TraitsEditor({
   setConfiguredTraits,
   tooltipContent,
   label = 'User Traits',
+  addActionLabel = 'Add a user trait',
+  addActionSubsequentLabel = 'Add another user trait',
+  autoFocus = true,
 }: TraitEditorProps) {
   function handleInputChange(i: InputOption | InputOptionArray) {
     const newTraits = [...configuredTraits];
@@ -103,32 +132,53 @@ export function TraitsEditor({
   }
 
   const addLabelText =
-    configuredTraits.length > 0 ? 'Add another user trait' : 'Add user trait';
+    configuredTraits.length > 0 ? addActionSubsequentLabel : addActionLabel;
 
   return (
-    <Box>
-      <Flex gap={2} alignItems="center" mb={2}>
-        <Text typography="body3">{label}</Text>
-        {tooltipContent && <IconTooltip>{tooltipContent}</IconTooltip>}
-      </Flex>
-      <Box>
-        {configuredTraits.map(({ traitKey, traitValues }, index) => {
-          return (
-            <Box mb={-1} key={index}>
-              <Flex alignItems="start">
-                <Box width="290px" minWidth="200px" mr={1}>
+    <Fieldset>
+      {label && (
+        <Legend>
+          <LabelContent tooltipContent={tooltipContent}>{label}</LabelContent>
+        </Legend>
+      )}
+      <LabelTable>
+        <colgroup>
+          {/* Column elements (for styling purposes, see LabelTable styles) */}
+          <col />
+          <col />
+          <col />
+        </colgroup>
+        {configuredTraits.length > 0 && (
+          <thead>
+            <tr>
+              <th scope="col">
+                <LabelContent required>Key</LabelContent>
+              </th>
+              <th scope="col">
+                <LabelContent required>Value</LabelContent>
+              </th>
+            </tr>
+          </thead>
+        )}
+        <tbody>
+          {configuredTraits.map(({ traitKey, traitValues }, index) => {
+            return (
+              <tr key={index}>
+                <td>
                   <FieldSelectCreatable
+                    size={inputSize}
+                    mb={0}
                     stylesConfig={customStyles}
                     data-testid="trait-key"
+                    ariaLabel="trait-key"
                     options={traitsPreset.map(r => ({
                       value: r,
                       label: r,
                     }))}
                     placeholder="Type a trait name and press enter"
-                    autoFocus
+                    autoFocus={autoFocus}
                     isSearchable
                     value={traitKey}
-                    label="Key"
                     rule={requiredAll(
                       requiredField('Trait key is required'),
                       requireNoDuplicateTraits(configuredTraits)
@@ -143,14 +193,15 @@ export function TraitsEditor({
                     createOptionPosition="last"
                     isDisabled={isLoading}
                   />
-                </Box>
-                <Box width="400px" minWidth="200px" ml={3}>
+                </td>
+                <td>
                   <FieldSelectCreatable
+                    size={inputSize}
+                    mb={0}
                     stylesConfig={customStyles}
-                    data-testid="trait-value"
+                    data-testid="trait-values"
                     ariaLabel="trait-values"
                     placeholder="Type a trait value and press enter"
-                    label="Values"
                     isMulti
                     isSearchable
                     isClearable={false}
@@ -168,54 +219,45 @@ export function TraitsEditor({
                     }
                     isDisabled={isLoading}
                   />
-                </Box>
-                <ButtonIcon
-                  ml={1}
-                  size={1}
-                  mt={4}
-                  title="Remove Trait"
-                  aria-label="Remove Trait"
-                  onClick={() => removeTraitPair(index)}
-                  css={`
-                    &:disabled {
-                      opacity: 0.65;
-                      pointer-events: none;
-                    }
-                  `}
-                  disabled={isLoading}
-                >
-                  <Trash size="medium" />
-                </ButtonIcon>
-              </Flex>
-            </Box>
-          );
-        })}
-      </Box>
-      <Box mt={1}>
-        <ButtonBorder
-          onClick={addNewTraitPair}
-          css={`
-            padding-left: 12px;
-            &:disabled {
-              .icon-add {
-                opacity: 0.35;
-              }
-              pointer-events: none;
-            }
-          `}
-          disabled={isLoading}
-        >
-          <Add
-            className="icon-add"
-            size={12}
-            css={`
-              margin-right: 3px;
-            `}
-          />
-          {addLabelText}
-        </ButtonBorder>
-      </Box>
-    </Box>
+                </td>
+                <td>
+                  <Flex
+                    alignItems="center"
+                    height={inputGeometry[inputSize].height}
+                  >
+                    <ButtonIcon
+                      size={buttonIconSize}
+                      title="Remove Trait"
+                      aria-label="Remove Trait"
+                      onClick={() => removeTraitPair(index)}
+                      css={`
+                        &:disabled {
+                          opacity: 0.65;
+                          pointer-events: none;
+                        }
+                      `}
+                      disabled={isLoading}
+                    >
+                      <Cross color="text.muted" size="small" />
+                    </ButtonIcon>
+                  </Flex>
+                </td>
+              </tr>
+            );
+          })}
+        </tbody>
+      </LabelTable>
+      <ButtonWithAddIcon
+        Button={ButtonSecondary}
+        label={addLabelText}
+        onClick={addNewTraitPair}
+        disabled={isLoading}
+        size="small"
+        pr={3}
+        compact={false}
+        $inputAlignment
+      />
+    </Fieldset>
   );
 }
 
@@ -264,6 +306,9 @@ export type TraitEditorProps = {
   isLoading: boolean;
   tooltipContent?: React.ReactNode;
   label?: string;
+  addActionLabel?: string;
+  addActionSubsequentLabel?: string;
+  autoFocus?: boolean;
 };
 
 export function traitsToTraitsOption(allTraits: AllUserTraits): TraitsOption[] {
@@ -296,3 +341,55 @@ const customStyles = {
     textOverflow: 'ellipsis',
   }),
 };
+
+const inputSize = 'medium';
+const buttonIconSize = 0;
+
+const Legend = styled.legend`
+  margin: 0 0 ${props => props.theme.space[1]}px 0;
+  padding: 0;
+  ${props => props.theme.typography.body3}
+`;
+
+const Fieldset = styled.fieldset`
+  border: none;
+  margin: 0;
+  padding: 0;
+`;
+
+const LabelTable = styled.table`
+  width: 100%;
+  border-collapse: collapse;
+  /*
+   * Using fixed layout seems to be the only way to prevent the internal input
+   * padding from somehow influencing the column width. As the padding is
+   * variable (and reflects the error state), we'd rather avoid column width
+   * changes while editing.
+   */
+  table-layout: fixed;
+
+  & th {
+    padding: 0 0 ${props => props.theme.space[1]}px 0;
+  }
+
+  col:nth-child(3) {
+    /*
+     * The fixed layout is good for stability, but it forces us to explicitly
+     * define the width of the delete button column. Set it to the width of an
+     * icon button.
+     */
+    width: ${buttonSizes[buttonIconSize].width};
+  }
+
+  & td {
+    padding: 0;
+    /* Keep the inputs top-aligned to support error messages */
+    vertical-align: top;
+    padding-bottom: ${props => props.theme.space[2]}px;
+
+    &:nth-child(1),
+    &:nth-child(2) {
+      padding-right: ${props => props.theme.space[2]}px;
+    }
+  }
+`;
diff --git a/web/packages/shared/components/UnifiedResources/CardsView/CardsView.tsx b/web/packages/shared/components/UnifiedResources/CardsView/CardsView.tsx
index 7cb431d0fcb7f..18049dab51f65 100644
--- a/web/packages/shared/components/UnifiedResources/CardsView/CardsView.tsx
+++ b/web/packages/shared/components/UnifiedResources/CardsView/CardsView.tsx
@@ -35,6 +35,8 @@ export function CardsView({
   onPinResource,
   isProcessing,
   pinningSupport,
+  visibleInputFields,
+  resourceLabelConfig,
 }: ResourceViewProps) {
   return (
     <CardsContainer className="CardsContainer" gap={2}>
@@ -51,6 +53,8 @@ export function CardsView({
             pinResource={() => onPinResource(key)}
             onShowStatusInfo={onShowStatusInfo}
             showingStatusInfo={showingStatusInfo}
+            visibleInputFields={visibleInputFields}
+            resourceLabelConfig={resourceLabelConfig}
           />
         )
       )}
diff --git a/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.story.tsx b/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.story.tsx
index 25e2ea7dccda1..557dc4a87677b 100644
--- a/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.story.tsx
+++ b/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.story.tsx
@@ -16,20 +16,30 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { MemoryRouter } from 'react-router';
 import styled from 'styled-components';
 
 import { ButtonBorder } from 'design';
+import { Plus } from 'design/Icon';
+import { LabelKind } from 'design/Label';
 import { gap, GapProps } from 'design/system';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { apps } from 'teleport/Apps/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { databases } from 'teleport/Databases/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { desktops } from 'teleport/Desktops/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { kubes } from 'teleport/Kubes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { nodes } from 'teleport/Nodes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { SamlAppActionProvider } from 'teleport/SamlApplications/useSamlAppActions';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import makeApp from 'teleport/services/apps/makeApps';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourceActionButton } from 'teleport/UnifiedResources/ResourceActionButton';
 
 import {
@@ -79,10 +89,43 @@ const additionalResources = [
   }),
 ];
 
-const meta: Meta<typeof ResourceCard> = {
-  component: ResourceCard,
+type StoryProps = {
+  withCheckbox: boolean;
+  withPin: boolean;
+  withLabelIcon: boolean;
+  labelIconPlacement: 'left' | 'right';
+  labelKind: LabelKind;
+};
+
+const meta: Meta<StoryProps> = {
   title: 'Shared/UnifiedResources/Items',
+  argTypes: {
+    withCheckbox: {
+      control: { type: 'boolean' },
+    },
+    withPin: {
+      control: { type: 'boolean' },
+    },
+    withLabelIcon: {
+      control: { type: 'boolean' },
+    },
+    labelIconPlacement: {
+      control: { type: 'select' },
+      options: ['left', 'right'],
+    },
+    labelKind: {
+      control: { type: 'select' },
+      options: ['secondary', 'outline-primary', 'outline-warning', ''],
+    },
+  },
+  // default
+  args: {
+    withCheckbox: true,
+    withPin: true,
+    withLabelIcon: false,
+  },
 };
+export default meta;
 
 const Grid = styled.div<GapProps>`
   display: grid;
@@ -90,58 +133,71 @@ const Grid = styled.div<GapProps>`
   ${gap}
 `;
 
-export default meta;
-type Story = StoryObj<typeof ResourceCard>;
-
 const ActionButton = <ButtonBorder size="small">Action</ButtonBorder>;
 
-export const Cards: Story = {
-  render() {
-    return (
-      <MemoryRouter>
-        <SamlAppActionProvider>
-          <Grid gap={2}>
-            {[
-              ...apps.map(resource =>
-                makeUnifiedResourceViewItemApp(resource, {
-                  ActionButton: <ResourceActionButton resource={resource} />,
-                })
-              ),
-              ...databases.map(resource =>
-                makeUnifiedResourceViewItemDatabase(resource, {
-                  ActionButton,
-                })
-              ),
-              ...kubes.map(resource =>
-                makeUnifiedResourceViewItemKube(resource, { ActionButton })
-              ),
-              ...nodes.map(resource =>
-                makeUnifiedResourceViewItemNode(resource, {
-                  ActionButton,
-                })
-              ),
-              ...additionalResources.map(resource =>
-                makeUnifiedResourceViewItemApp(resource, { ActionButton })
-              ),
-              ...desktops.map(resource =>
-                makeUnifiedResourceViewItemDesktop(resource, { ActionButton })
-              ),
-            ].map((res, i) => (
-              <ResourceCard
-                key={i}
-                pinned={false}
-                pinResource={() => {}}
-                selectResource={() => {}}
-                selected={false}
-                pinningSupport={PinningSupport.Supported}
-                onShowStatusInfo={() => null}
-                showingStatusInfo={false}
-                viewItem={res}
-              />
-            ))}
-          </Grid>
-        </SamlAppActionProvider>
-      </MemoryRouter>
-    );
-  },
-};
+export function Cards(props: StoryProps) {
+  return (
+    <MemoryRouter>
+      <SamlAppActionProvider>
+        <Grid gap={2}>
+          {[
+            ...apps.map(resource =>
+              makeUnifiedResourceViewItemApp(resource, {
+                ActionButton: <ResourceActionButton resource={resource} />,
+              })
+            ),
+            ...databases.map(resource =>
+              makeUnifiedResourceViewItemDatabase(resource, {
+                ActionButton,
+              })
+            ),
+            ...kubes.map(resource =>
+              makeUnifiedResourceViewItemKube(resource, { ActionButton })
+            ),
+            ...nodes.map(resource =>
+              makeUnifiedResourceViewItemNode(resource, {
+                ActionButton,
+              })
+            ),
+            ...additionalResources.map(resource =>
+              makeUnifiedResourceViewItemApp(resource, { ActionButton })
+            ),
+            ...desktops.map(resource =>
+              makeUnifiedResourceViewItemDesktop(resource, { ActionButton })
+            ),
+          ].map((res, i) => (
+            <ResourceCard
+              key={i}
+              pinned={false}
+              pinResource={() => {}}
+              selectResource={() => {}}
+              selected={false}
+              pinningSupport={PinningSupport.Supported}
+              onShowStatusInfo={() => null}
+              showingStatusInfo={false}
+              viewItem={res}
+              visibleInputFields={{
+                checkbox: props.withCheckbox,
+                pin: props.withPin,
+              }}
+              {...((props.withLabelIcon || props.labelKind) && {
+                resourceLabelConfig: {
+                  IconLeft:
+                    props.labelIconPlacement === 'left' && props.withLabelIcon
+                      ? Plus
+                      : undefined,
+                  IconRight:
+                    props.labelIconPlacement === 'right' && props.withLabelIcon
+                      ? Plus
+                      : undefined,
+                  kind: props.labelKind,
+                  withHoverState: props.withLabelIcon,
+                },
+              })}
+            />
+          ))}
+        </Grid>
+      </SamlAppActionProvider>
+    </MemoryRouter>
+  );
+}
diff --git a/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.tsx b/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.tsx
index c3f9262efe01d..2f017816c6203 100644
--- a/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.tsx
+++ b/web/packages/shared/components/UnifiedResources/CardsView/ResourceCard.tsx
@@ -19,14 +19,14 @@
 import { useEffect, useLayoutEffect, useRef, useState } from 'react';
 import styled, { css } from 'styled-components';
 
-import { Box, ButtonLink, Flex, Label, Text } from 'design';
+import { Box, ButtonLink, Flex, Text } from 'design';
 import { CheckboxInput } from 'design/Checkbox';
+import { makeLabelTag } from 'design/formatters';
+import { LabelButtonWithIcon } from 'design/Label/LabelButtonWithIcon';
 import { ResourceIcon } from 'design/ResourceIcon';
 import { HoverTooltip } from 'design/Tooltip';
 
-import { makeLabelTag } from 'teleport/components/formatters';
-
-import { CopyButton } from '../shared/CopyButton';
+import { CopyButton } from '../../CopyButton/CopyButton';
 import {
   BackgroundColorProps,
   getBackgroundColor,
@@ -35,7 +35,7 @@ import {
 import { PinButton } from '../shared/PinButton';
 import { ResourceActionButtonWrapper } from '../shared/ResourceActionButton';
 import { SingleLineBox } from '../shared/SingleLineBox';
-import { isUnhealthy } from '../shared/StatusInfo';
+import { shouldWarnResourceStatus } from '../shared/StatusInfo';
 import { ResourceItemProps } from '../types';
 import { WarningRightEdgeBadgeSvg } from './WarningRightEdgeBadgeSvg';
 
@@ -65,6 +65,8 @@ export function ResourceCard({
   onShowStatusInfo,
   showingStatusInfo,
   viewItem,
+  visibleInputFields = { pin: true, checkbox: true },
+  resourceLabelConfig,
 }: Omit<ResourceItemProps, 'expandAllLabels'>) {
   const {
     name,
@@ -168,7 +170,7 @@ export function ResourceCard({
     }
   };
 
-  const hasUnhealthyStatus = isUnhealthy(status);
+  const shouldDisplayStatusWarning = shouldWarnResourceStatus(status);
 
   return (
     <CardContainer
@@ -178,47 +180,51 @@ export function ResourceCard({
     >
       <CardOuterContainer
         showAllLabels={showAllLabels}
-        hasUnhealthyStatus={hasUnhealthyStatus}
+        shouldDisplayWarning={shouldDisplayStatusWarning}
       >
         <CardInnerContainer
           ref={innerContainer}
           p={3}
           // we set padding left a bit larger so we can have space to absolutely
           // position the pin/checkbox buttons
-          pl={6}
+          pl={visibleInputFields.pin || visibleInputFields.checkbox ? 6 : 2}
           alignItems="start"
           onMouseLeave={onMouseLeave}
           pinned={pinned}
           requiresRequest={requiresRequest}
           selected={selected}
           showingStatusInfo={showingStatusInfo}
-          hasUnhealthyStatus={hasUnhealthyStatus}
+          shouldDisplayWarning={shouldDisplayStatusWarning}
           // we set extra padding to push contents to the right to make
           // space for the WarningRightEdgeBadgeIcon.
-          {...(hasUnhealthyStatus && !showAllLabels && { pr: '35px' })}
-          {...(hasUnhealthyStatus && showAllLabels && { pr: '7px' })}
+          {...(shouldDisplayStatusWarning && !showAllLabels && { pr: '35px' })}
+          {...(shouldDisplayStatusWarning && showAllLabels && { pr: '7px' })}
         >
-          <CheckboxInput
-            checked={selected}
-            onChange={selectResource}
-            style={{ position: 'absolute', top: '16px', left: '16px' }}
-          />
-          <Box
-            css={`
-              position: absolute;
-              // we position far from the top so the layout of the pin doesn't change if we expand the card
-              top: ${props => props.theme.space[9]}px;
-              transition: none;
-              left: 16px;
-            `}
-          >
-            <PinButton
-              setPinned={pinResource}
-              pinned={pinned}
-              pinningSupport={pinningSupport}
-              hovered={hovered}
+          {visibleInputFields.checkbox && (
+            <CheckboxInput
+              checked={selected}
+              onChange={selectResource}
+              style={{ position: 'absolute', top: '16px', left: '16px' }}
             />
-          </Box>
+          )}
+          {visibleInputFields.pin && (
+            <Box
+              css={`
+                position: absolute;
+                // we position far from the top so the layout of the pin doesn't change if we expand the card
+                top: ${props => props.theme.space[9]}px;
+                transition: none;
+                left: 16px;
+              `}
+            >
+              <PinButton
+                setPinned={pinResource}
+                pinned={pinned}
+                pinningSupport={pinningSupport}
+                hovered={hovered}
+              />
+            </Box>
+          )}
           <ResourceIcon
             name={primaryIconName}
             width="45px"
@@ -230,13 +236,13 @@ export function ResourceCard({
           />
           {/* MinWidth is important to prevent descriptions from overflowing. */}
           <Flex flexDirection="column" flex="1" minWidth="0" ml={3} gap={1}>
-            <Flex flexDirection="row" alignItems="center">
+            <Flex flexDirection="row" alignItems="center" gap={1}>
               <SingleLineBox flex="1">
                 <HoverTooltip tipContent={name} showOnlyOnOverflow>
                   <Text typography="body1">{name}</Text>
                 </HoverTooltip>
               </SingleLineBox>
-              {hovered && <CopyButton name={name} mr={2} />}
+              {hovered && <CopyButton value={name} />}
               <ResourceActionButtonWrapper requiresRequest={requiresRequest}>
                 {ActionButton}
               </ResourceActionButtonWrapper>
@@ -263,7 +269,7 @@ export function ResourceCard({
             <LabelsContainer showAll={showAllLabels}>
               <LabelsInnerContainer
                 ref={labelsInnerContainer}
-                hasUnhealthyStatus={hasUnhealthyStatus}
+                hasUnhealthyStatus={shouldDisplayStatusWarning}
               >
                 <MoreLabelsButton
                   style={{
@@ -283,8 +289,10 @@ export function ResourceCard({
                       key={i}
                       title={labelText}
                       onClick={() => onLabelClick?.(label)}
+                      withHoverState={!!onLabelClick}
                       kind="secondary"
                       data-is-label=""
+                      {...resourceLabelConfig}
                     >
                       {labelText}
                     </StyledLabel>
@@ -293,7 +301,7 @@ export function ResourceCard({
               </LabelsInnerContainer>
             </LabelsContainer>
           </Flex>
-          {hasUnhealthyStatus && !showAllLabels && (
+          {shouldDisplayStatusWarning && !showAllLabels && (
             <HoverTooltip tipContent={'Show Connection Issue'} placement="left">
               <WarningRightEdgeBadgeIcon onClick={onShowStatusInfo} />
             </HoverTooltip>
@@ -303,7 +311,9 @@ export function ResourceCard({
       {/* This is to let the WarningRightEdgeBadgeIcon stay in place while the
         InnerContainer pops out and expands vertically from rendering all
         labels. */}
-      {hasUnhealthyStatus && showAllLabels && <WarningRightEdgeBadgeIcon />}
+      {shouldDisplayStatusWarning && showAllLabels && (
+        <WarningRightEdgeBadgeIcon />
+      )}
     </CardContainer>
   );
 }
@@ -364,7 +374,7 @@ const CardContainer = styled(Box)<{
 
 const CardOuterContainer = styled(Box)<{
   showAllLabels?: boolean;
-  hasUnhealthyStatus: boolean;
+  shouldDisplayWarning: boolean;
 }>`
   border-radius: ${props => props.theme.radii[3]}px;
 
@@ -374,7 +384,7 @@ const CardOuterContainer = styled(Box)<{
       position: absolute;
       left: 0;
       // The padding is required to show the WarningRightEdgeBadgeIcon
-      right: ${props.hasUnhealthyStatus ? '28px' : 0};
+      right: ${props.shouldDisplayWarning ? '28px' : 0};
       z-index: 1;
     `}
   transition: all 150ms;
@@ -415,7 +425,7 @@ const CardInnerContainer = styled(Flex)<BackgroundColorProps>`
   background-color: ${props => getBackgroundColor(props)};
 
   ${p =>
-    p.hasUnhealthyStatus &&
+    p.shouldDisplayWarning &&
     css`
       border: 2px solid ${p.theme.colors.interactive.solid.alert.default};
       background-color: ${getStatusBackgroundColor({
@@ -437,7 +447,7 @@ const CardInnerContainer = styled(Flex)<BackgroundColorProps>`
     border: ${props => props.theme.borders[2]} rgba(0, 0, 0, 0);
 
     ${p =>
-      p.hasUnhealthyStatus &&
+      p.shouldDisplayWarning &&
       css`
         border-color: ${p.theme.colors.interactive.solid.alert.hover};
         background-color: ${getStatusBackgroundColor({
@@ -460,7 +470,7 @@ const LabelsContainer = styled(Box)<{ showAll?: boolean }>`
   overflow: hidden;
 `;
 
-const StyledLabel = styled(Label)`
+const StyledLabel = styled(LabelButtonWithIcon)`
   height: ${labelHeight}px;
   margin: 1px 0;
   overflow: hidden;
diff --git a/web/packages/shared/components/UnifiedResources/FilterPanel.tsx b/web/packages/shared/components/UnifiedResources/FilterPanel.tsx
index 32784ae606ad8..4f949051352d7 100644
--- a/web/packages/shared/components/UnifiedResources/FilterPanel.tsx
+++ b/web/packages/shared/components/UnifiedResources/FilterPanel.tsx
@@ -27,31 +27,47 @@ import Menu from 'design/Menu';
 import { HoverTooltip } from 'design/Tooltip';
 import { ViewMode } from 'gen-proto-ts/teleport/userpreferences/v1/unified_resource_preferences_pb';
 import { MultiselectMenu } from 'shared/components/Controls/MultiselectMenu';
-import { SortMenu } from 'shared/components/Controls/SortMenu';
+import { SortItem, SortMenu } from 'shared/components/Controls/SortMenuV2';
 import { ViewModeSwitch } from 'shared/components/Controls/ViewModeSwitch';
 
 import {
   IncludedResourceMode,
-  SharedUnifiedResource,
+  ResourceHealthStatus,
   UnifiedResourcesQueryParams,
+  VisibleFilterPanelFields,
 } from './types';
-import { FilterKind, ResourceAvailabilityFilter } from './UnifiedResources';
-
-const kindToLabel: Record<SharedUnifiedResource['resource']['kind'], string> = {
-  app: 'Application',
-  db: 'Database',
-  windows_desktop: 'Desktop',
-  kube_cluster: 'Kubernetes',
-  node: 'Server',
-  user_group: 'User group',
-  git_server: 'Git Server',
-};
+import {
+  FilterKind,
+  getFilterKindName,
+  ResourceAvailabilityFilter,
+} from './UnifiedResources';
 
-const sortFieldOptions = [
-  { label: 'Name', value: 'name' },
-  { label: 'Type', value: 'kind' },
+const sortFieldOptions: SortItem[] = [
+  {
+    label: 'Name',
+    key: 'name',
+    ascendingLabel: 'Name, A - Z',
+    descendingLabel: 'Name, Z - A',
+    ascendingOptionLabel: 'Alphabetical, A - Z',
+    descendingOptionLabel: 'Alphabetical, Z - A',
+  },
+  {
+    label: 'Type',
+    key: 'kind',
+    ascendingLabel: 'Type, A - Z',
+    descendingLabel: 'Type, Z - A',
+    ascendingOptionLabel: 'Alphabetical, A - Z',
+    descendingOptionLabel: 'Alphabetical, Z - A',
+  },
 ];
 
+const resourceStatusOptions: { label: string; value: ResourceHealthStatus }[] =
+  [
+    { label: 'Healthy', value: 'healthy' },
+    { label: 'Unhealthy', value: 'unhealthy' },
+    { label: 'Unknown', value: 'unknown' },
+  ];
+
 interface FilterPanelProps {
   availableKinds: FilterKind[];
   params: UnifiedResourcesQueryParams;
@@ -72,6 +88,11 @@ interface FilterPanelProps {
   availabilityFilter?: ResourceAvailabilityFilter;
   changeAvailableResourceMode(mode: IncludedResourceMode): void;
   onRefresh(): void;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   */
+  visibleFilterPanelFields?: VisibleFilterPanelFields;
 }
 
 export function FilterPanel({
@@ -90,14 +111,25 @@ export function FilterPanel({
   changeAvailableResourceMode,
   ClusterDropdown = null,
   onRefresh,
+  visibleFilterPanelFields = {
+    checkbox: true,
+    clusterOpts: true,
+    healthStatusOpts: true,
+    resourceTypeOpts: true,
+    resourceAvailabilityOpts: true,
+  },
 }: FilterPanelProps) {
-  const { sort, kinds } = params;
+  const { sort, kinds, statuses } = params;
 
   const activeSortFieldOption = sortFieldOptions.find(
-    opt => opt.value === sort.fieldName
+    opt => opt.key === sort.fieldName
   );
 
   const onKindsChanged = (newKinds: string[]) => {
+    if (!resourceStatusFilterSupported(newKinds)) {
+      setParams({ ...params, statuses: null, kinds: newKinds });
+      return;
+    }
     setParams({ ...params, kinds: newKinds });
   };
 
@@ -109,6 +141,12 @@ export function FilterPanel({
     setParams({ ...params, sort: oppositeSort(sort) });
   };
 
+  const onHealthStatusChange = (newStatuses: ResourceHealthStatus[]) => {
+    setParams({ ...params, statuses: newStatuses });
+  };
+
+  const isResourceStatusFilterSupported = resourceStatusFilterSupported(kinds);
+
   return (
     // minHeight is set to 32px so there isn't layout shift when a bulk action button shows up
     <Flex
@@ -118,34 +156,62 @@ export function FilterPanel({
       alignItems="center"
     >
       <Flex gap={2}>
-        <HoverTooltip tipContent={selected ? 'Deselect all' : 'Select all'}>
-          <CheckboxInput
-            css={`
-              // add extra margin so it aligns with the checkboxes of the resources
-              margin-left: 19px;
-            `}
-            checked={selected}
-            onChange={selectVisible}
-            data-testid="select_all"
-          />
-        </HoverTooltip>
-        <MultiselectMenu
-          options={availableKinds.map(({ kind, disabled }) => ({
-            value: kind,
-            label: kindToLabel[kind],
-            disabled: disabled,
-          }))}
-          selected={kinds || []}
-          onChange={onKindsChanged}
-          label="Types"
-          tooltip="Filter by resource type"
-          buffered
-        />
-        {ClusterDropdown}
-        {availabilityFilter && (
-          <IncludedResourcesSelector
-            availabilityFilter={availabilityFilter}
-            onChange={changeAvailableResourceMode}
+        {visibleFilterPanelFields.checkbox && (
+          <HoverTooltip tipContent={selected ? 'Deselect all' : 'Select all'}>
+            <CheckboxInput
+              css={`
+                // add extra margin so it aligns with the checkboxes of the resources
+                margin-left: 19px;
+              `}
+              checked={selected}
+              onChange={selectVisible}
+              data-testid="select_all"
+            />
+          </HoverTooltip>
+        )}
+        {visibleFilterPanelFields.resourceTypeOpts &&
+          availableKinds.length > 0 && (
+            <MultiselectMenu
+              options={availableKinds
+                .toSorted((a, b) =>
+                  getFilterKindName(a.kind).localeCompare(
+                    getFilterKindName(b.kind)
+                  )
+                )
+                .map(({ kind, disabled }) => ({
+                  value: kind as string,
+                  label: getFilterKindName(kind),
+                  disabled,
+                }))}
+              selected={kinds || []}
+              onChange={onKindsChanged}
+              label="Types"
+              tooltip="Filter by resource type"
+              buffered
+            />
+          )}
+        {visibleFilterPanelFields.clusterOpts && ClusterDropdown}
+        {visibleFilterPanelFields.resourceAvailabilityOpts &&
+          availabilityFilter && (
+            <IncludedResourcesSelector
+              availabilityFilter={availabilityFilter}
+              onChange={changeAvailableResourceMode}
+            />
+          )}
+        {visibleFilterPanelFields.healthStatusOpts && (
+          <MultiselectMenu
+            options={resourceStatusOptions.map(({ label, value }) => ({
+              value,
+              label,
+            }))}
+            selected={statuses || []}
+            onChange={onHealthStatusChange}
+            label="Health Status"
+            tooltip={
+              'Health status filter is only available for database and Kubernetes resources. Support for more resource types will be added in the future.'
+            }
+            disabled={!isResourceStatusFilterSupported}
+            buffered
           />
         )}
       </Flex>
@@ -196,17 +262,20 @@ export function FilterPanel({
           </>
         )}
         <SortMenu
-          current={{
-            fieldName: activeSortFieldOption.value,
-            dir: sort.dir,
-          }}
-          fields={sortFieldOptions}
-          onChange={newSort => {
-            if (newSort.dir !== sort.dir) {
+          selectedKey={activeSortFieldOption?.key ?? sortFieldOptions[0].key}
+          selectedOrder={sort?.dir ?? 'ASC'}
+          items={sortFieldOptions.filter(opt => {
+            if (opt.key === 'kind' && availableKinds.length === 0) {
+              return false;
+            }
+            return true;
+          })}
+          onChange={(key, order) => {
+            if (order !== sort?.dir) {
               onSortOrderButtonClicked();
             }
-            if (newSort.fieldName !== activeSortFieldOption.value) {
-              onSortFieldChange(newSort.fieldName);
+            if (key !== activeSortFieldOption?.key) {
+              onSortFieldChange(key);
             }
           }}
         />
@@ -291,16 +360,15 @@ const IncludedResourcesSelector = ({
         onClose={handleClose}
       >
         <AccessRequestsToggleItem>
-          <Text mr={2} mb={1}>
-            Show requestable resources
-          </Text>
           <Toggle
             isToggled={
               availabilityFilter.mode === 'requestable' ||
               availabilityFilter.mode === 'all'
             }
             onToggle={handleToggle}
-          />
+          >
+            <Text ml={2}>Show requestable resources</Text>
+          </Toggle>
         </AccessRequestsToggleItem>
       </Menu>
     </Flex>
@@ -332,3 +400,12 @@ const AccessRequestsToggleItem = styled.div`
   text-decoration: none;
   white-space: nowrap;
 `;
+
+function resourceStatusFilterSupported(kinds: string[]) {
+  return (
+    !kinds ||
+    kinds.length === 0 ||
+    kinds.includes('db') ||
+    kinds.includes('kube_cluster')
+  );
+}
diff --git a/web/packages/shared/components/UnifiedResources/ListView/ListView.tsx b/web/packages/shared/components/UnifiedResources/ListView/ListView.tsx
index 72f69079ef97d..070fbd6a1d407 100644
--- a/web/packages/shared/components/UnifiedResources/ListView/ListView.tsx
+++ b/web/packages/shared/components/UnifiedResources/ListView/ListView.tsx
@@ -34,6 +34,8 @@ export function ListView({
   pinningSupport,
   isProcessing,
   expandAllLabels,
+  visibleInputFields,
+  resourceLabelConfig,
 }: ResourceViewProps) {
   return (
     <Flex className="ListContainer">
@@ -51,6 +53,8 @@ export function ListView({
             expandAllLabels={expandAllLabels}
             onShowStatusInfo={onShowStatusInfo}
             showingStatusInfo={showingStatusInfo}
+            visibleInputFields={visibleInputFields}
+            resourceLabelConfig={resourceLabelConfig}
           />
         )
       )}
diff --git a/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.story.tsx b/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.story.tsx
index b672fc0b00983..68a4047323227 100644
--- a/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.story.tsx
+++ b/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.story.tsx
@@ -16,15 +16,23 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { ButtonBorder, Flex } from 'design';
+import { Plus } from 'design/Icon';
+import { LabelKind } from 'design/Label';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { apps } from 'teleport/Apps/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { databases } from 'teleport/Databases/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { desktops } from 'teleport/Desktops/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { kubes } from 'teleport/Kubes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { nodes } from 'teleport/Nodes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import makeApp from 'teleport/services/apps/makeApps';
 
 import {
@@ -74,56 +82,102 @@ const additionalResources = [
   }),
 ];
 
-const meta: Meta<typeof ResourceListItem> = {
-  component: ResourceListItem,
-  title: 'Shared/UnifiedResources/Items',
+type StoryProps = {
+  withCheckbox: boolean;
+  withPin: boolean;
+  withLabelIcon: boolean;
+  labelIconPlacement: 'left' | 'right';
+  labelKind: LabelKind;
 };
 
+const meta: Meta<StoryProps> = {
+  title: 'Shared/UnifiedResources/Items',
+  argTypes: {
+    withCheckbox: {
+      control: { type: 'boolean' },
+    },
+    withPin: {
+      control: { type: 'boolean' },
+    },
+    withLabelIcon: {
+      control: { type: 'boolean' },
+    },
+    labelIconPlacement: {
+      control: { type: 'select' },
+      options: ['left', 'right'],
+    },
+    labelKind: {
+      control: { type: 'select' },
+      options: ['secondary', 'outline-primary', 'outline-warning', ''],
+    },
+  },
+  // default
+  args: {
+    withCheckbox: true,
+    withPin: true,
+    withLabelIcon: false,
+  },
+};
 export default meta;
-type Story = StoryObj<typeof ResourceListItem>;
 
 const ActionButton = <ButtonBorder size="small">Action</ButtonBorder>;
 
-export const ListItems: Story = {
-  render() {
-    return (
-      <Flex flexDirection="column">
-        {[
-          ...apps.map(resource =>
-            makeUnifiedResourceViewItemApp(resource, { ActionButton })
-          ),
-          ...databases.map(resource =>
-            makeUnifiedResourceViewItemDatabase(resource, {
-              ActionButton,
-            })
-          ),
-          ...kubes.map(resource =>
-            makeUnifiedResourceViewItemKube(resource, { ActionButton })
-          ),
-          ...nodes.map(resource =>
-            makeUnifiedResourceViewItemNode(resource, { ActionButton })
-          ),
-          ...additionalResources.map(resource =>
-            makeUnifiedResourceViewItemApp(resource, { ActionButton })
-          ),
-          ...desktops.map(resource =>
-            makeUnifiedResourceViewItemDesktop(resource, { ActionButton })
-          ),
-        ].map((res, i) => (
-          <ResourceListItem
-            key={i}
-            pinned={false}
-            pinResource={() => {}}
-            selectResource={() => {}}
-            selected={false}
-            pinningSupport={PinningSupport.Supported}
-            expandAllLabels={false}
-            onShowStatusInfo={() => null}
-            showingStatusInfo={false}
-            viewItem={res}
-          />
-        ))}
-      </Flex>
-    );
-  },
-};
+export function ListItems(props: StoryProps) {
+  return (
+    <Flex flexDirection="column">
+      {[
+        ...apps.map(resource =>
+          makeUnifiedResourceViewItemApp(resource, { ActionButton })
+        ),
+        ...databases.map(resource =>
+          makeUnifiedResourceViewItemDatabase(resource, {
+            ActionButton,
+          })
+        ),
+        ...kubes.map(resource =>
+          makeUnifiedResourceViewItemKube(resource, { ActionButton })
+        ),
+        ...nodes.map(resource =>
+          makeUnifiedResourceViewItemNode(resource, { ActionButton })
+        ),
+        ...additionalResources.map(resource =>
+          makeUnifiedResourceViewItemApp(resource, { ActionButton })
+        ),
+        ...desktops.map(resource =>
+          makeUnifiedResourceViewItemDesktop(resource, { ActionButton })
+        ),
+      ].map((res, i) => (
+        <ResourceListItem
+          key={i}
+          pinned={false}
+          pinResource={() => {}}
+          selectResource={() => {}}
+          selected={false}
+          pinningSupport={PinningSupport.Supported}
+          expandAllLabels={false}
+          onShowStatusInfo={() => null}
+          showingStatusInfo={false}
+          viewItem={res}
+          visibleInputFields={{
+            checkbox: props.withCheckbox,
+            pin: props.withPin,
+          }}
+          {...((props.withLabelIcon || props.labelKind) && {
+            resourceLabelConfig: {
+              IconLeft:
+                props.labelIconPlacement === 'left' && props.withLabelIcon
+                  ? Plus
+                  : undefined,
+              IconRight:
+                props.labelIconPlacement === 'right' && props.withLabelIcon
+                  ? Plus
+                  : undefined,
+              kind: props.labelKind,
+              withHoverState: props.withLabelIcon,
+            },
+          })}
+        />
+      ))}
+    </Flex>
+  );
+}
diff --git a/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.tsx b/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.tsx
index 4395de8c8cf03..87a8b2e0db898 100644
--- a/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.tsx
+++ b/web/packages/shared/components/UnifiedResources/ListView/ResourceListItem.tsx
@@ -19,15 +19,15 @@
 import { useEffect, useState } from 'react';
 import styled, { css } from 'styled-components';
 
-import { Box, ButtonIcon, Flex, Label, Text } from 'design';
+import { Box, ButtonIcon, Flex, Text } from 'design';
 import { CheckboxInput } from 'design/Checkbox';
+import { makeLabelTag } from 'design/formatters';
 import { Tags, Warning } from 'design/Icon';
+import { LabelButtonWithIcon } from 'design/Label/LabelButtonWithIcon';
 import { ResourceIcon } from 'design/ResourceIcon';
 import { HoverTooltip } from 'design/Tooltip';
 
-import { makeLabelTag } from 'teleport/components/formatters';
-
-import { CopyButton } from '../shared/CopyButton';
+import { CopyButton } from '../../CopyButton/CopyButton';
 import {
   BackgroundColorProps,
   getBackgroundColor,
@@ -35,7 +35,7 @@ import {
 } from '../shared/getBackgroundColor';
 import { PinButton } from '../shared/PinButton';
 import { ResourceActionButtonWrapper } from '../shared/ResourceActionButton';
-import { isUnhealthy } from '../shared/StatusInfo';
+import { shouldWarnResourceStatus } from '../shared/StatusInfo';
 import { ResourceItemProps } from '../types';
 
 export function ResourceListItem({
@@ -49,6 +49,8 @@ export function ResourceListItem({
   onShowStatusInfo,
   showingStatusInfo,
   viewItem,
+  visibleInputFields = { pin: true, checkbox: true },
+  resourceLabelConfig,
 }: ResourceItemProps) {
   const {
     name,
@@ -71,7 +73,7 @@ export function ResourceListItem({
   }, [expandAllLabels]);
 
   const showLabelsButton = labels.length > 0 && (hovered || showLabels);
-  const hasUnhealthyStatus = isUnhealthy(status);
+  const shouldDisplayStatusWarning = shouldWarnResourceStatus(status);
 
   // Determines which column the resource type text should end at.
   // We do this because if there is no address, or the labels button
@@ -91,7 +93,7 @@ export function ResourceListItem({
     <RowContainer
       onMouseEnter={() => setHovered(true)}
       onMouseLeave={() => setHovered(false)}
-      hasUnhealthyStatus={hasUnhealthyStatus}
+      shouldDisplayWarning={shouldDisplayStatusWarning}
       showingStatusInfo={showingStatusInfo}
     >
       <RowInnerContainer
@@ -99,30 +101,42 @@ export function ResourceListItem({
         alignItems="start"
         pinned={pinned}
         selected={selected}
-        hasUnhealthyStatus={hasUnhealthyStatus}
+        shouldDisplayWarning={shouldDisplayStatusWarning}
         showingStatusInfo={showingStatusInfo}
+        hideCheckbox={!visibleInputFields.checkbox}
+        hidePin={!visibleInputFields.pin}
       >
         {/* checkbox */}
-        <HoverTooltip
-          css={`
-            grid-area: checkbox;
-          `}
-          tipContent={selected ? 'Deselect' : 'Select'}
-        >
-          <CheckboxInput checked={selected} onChange={selectResource} />
-        </HoverTooltip>
+        {visibleInputFields.checkbox && (
+          <HoverTooltip
+            css={`
+              grid-area: checkbox;
+            `}
+            tipContent={selected ? 'Deselect' : 'Select'}
+          >
+            <CheckboxInput
+              checked={selected}
+              onChange={selectResource}
+              css={`
+                grid-area: checkbox;
+              `}
+            />
+          </HoverTooltip>
+        )}
 
         {/* pin button */}
-        <PinButton
-          setPinned={pinResource}
-          pinned={pinned}
-          pinningSupport={pinningSupport}
-          hovered={hovered}
-          css={`
-            grid-area: pin;
-            place-self: center center;
-          `}
-        />
+        {visibleInputFields.pin && (
+          <PinButton
+            setPinned={pinResource}
+            pinned={pinned}
+            pinningSupport={pinningSupport}
+            hovered={hovered}
+            css={`
+              grid-area: pin;
+              place-self: center center;
+            `}
+          />
+        )}
 
         {/* icon */}
         <ResourceIcon
@@ -163,7 +177,7 @@ export function ResourceListItem({
               align-self: start;
             `}
           >
-            {hovered && <CopyButton name={name} ml={1} />}
+            {hovered && <CopyButton value={name} ml={1} />}
           </Box>
         </Flex>
 
@@ -235,7 +249,7 @@ export function ResourceListItem({
         )}
 
         {/* warning icon if status is unhealthy */}
-        {hasUnhealthyStatus && (
+        {shouldDisplayStatusWarning && (
           <HoverTooltip
             tipContent={'Show Connection Issue'}
             css={`
@@ -271,12 +285,12 @@ export function ResourceListItem({
           >
             {labels.map((label, i) => {
               const labelText = makeLabelTag(label);
-              // We can use the index i as the key since it will always be unique to this label.
               return (
-                <Label
+                <LabelButtonWithIcon
                   key={i}
                   title={labelText}
                   onClick={() => onLabelClick?.(label)}
+                  withHoverState={!!onLabelClick}
                   kind="secondary"
                   mr={2}
                   css={`
@@ -288,9 +302,10 @@ export function ResourceListItem({
                     text-overflow: ellipsis;
                     white-space: nowrap;
                   `}
+                  {...resourceLabelConfig}
                 >
                   {labelText}
-                </Label>
+                </LabelButtonWithIcon>
               );
             })}
           </Box>
@@ -305,14 +320,14 @@ const ResTypeIconBox = styled(Box)`
 `;
 
 const RowContainer = styled(Box)<{
-  hasUnhealthyStatus: boolean;
+  shouldDisplayWarning: boolean;
   showingStatusInfo: boolean;
 }>`
   transition: all 150ms;
   position: relative;
 
   ${p =>
-    p.hasUnhealthyStatus &&
+    p.shouldDisplayWarning &&
     css`
       background-color: ${getStatusBackgroundColor({
         showingStatusInfo: p.showingStatusInfo,
@@ -326,7 +341,7 @@ const RowContainer = styled(Box)<{
     background-color: ${props => props.theme.colors.levels.surface};
 
     ${p =>
-      p.hasUnhealthyStatus &&
+      p.shouldDisplayWarning &&
       css`
         background-color: ${getStatusBackgroundColor({
           showingStatusInfo: p.showingStatusInfo,
@@ -353,12 +368,8 @@ const RowContainer = styled(Box)<{
 
 const RowInnerContainer = styled(Flex)<BackgroundColorProps>`
   display: grid;
-  grid-template-columns: 22px 24px 36px 2fr 1fr 1fr 32px min-content;
   column-gap: ${props => props.theme.space[3]}px;
   grid-template-rows: 56px min-content;
-  grid-template-areas:
-    'checkbox pin icon name type address labels-btn warning-icon button'
-    '. . labels labels labels labels labels labels labels';
   align-items: center;
   height: 100%;
   min-width: 100%;
@@ -374,6 +385,33 @@ const RowInnerContainer = styled(Flex)<BackgroundColorProps>`
     // Make the border invisible instead of removing it, this is to prevent things from shifting due to the size change.
     border-bottom: ${props => props.theme.borders[2]} rgba(0, 0, 0, 0);
   }
+
+  grid-template-columns: 22px 24px 36px 2fr 1fr 1fr 32px min-content;
+  grid-template-areas:
+    'checkbox pin icon name type address labels-btn warning-icon button'
+    '. . labels labels labels labels labels labels labels';
+
+  ${p =>
+    p.hideCheckbox &&
+    `grid-template-columns: 24px 36px 2fr 1fr 1fr 32px min-content;
+    grid-template-areas:
+    'pin icon name type address labels-btn warning-icon button'
+    '. labels labels labels labels labels labels labels';`}
+
+  ${p =>
+    p.hidePin &&
+    `grid-template-columns: 22px 36px 2fr 1fr 1fr 32px min-content;
+    grid-template-areas:
+    'checkbox icon name type address labels-btn warning-icon button'
+    '. labels labels labels labels labels labels labels';`}
+
+  ${p =>
+    p.hideCheckbox &&
+    p.hidePin &&
+    `grid-template-columns: 36px 2fr 1fr 1fr 32px min-content;
+    grid-template-areas:
+    'icon name type address labels-btn warning-icon button'
+    'labels labels labels labels labels labels labels';`}
 `;
 
 const Name = styled(Text)`
diff --git a/web/packages/shared/components/UnifiedResources/UnifiedResources.story.tsx b/web/packages/shared/components/UnifiedResources/UnifiedResources.story.tsx
index 9df012fa27a9a..0c945df54aba0 100644
--- a/web/packages/shared/components/UnifiedResources/UnifiedResources.story.tsx
+++ b/web/packages/shared/components/UnifiedResources/UnifiedResources.story.tsx
@@ -28,13 +28,21 @@ import {
 } from 'gen-proto-ts/teleport/userpreferences/v1/unified_resource_preferences_pb';
 import { makeErrorAttempt, makeProcessingAttempt } from 'shared/hooks/useAsync';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { apps, moreApps } from 'teleport/Apps/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { UrlResourcesParams } from 'teleport/config';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { databases, moreDatabases } from 'teleport/Databases/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { desktops, moreDesktops } from 'teleport/Desktops/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { gitServers } from 'teleport/GitServers/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { kubes, moreKubes } from 'teleport/Kubes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { moreNodes, nodes } from 'teleport/Nodes/fixtures';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourcesResponse } from 'teleport/services/agents';
 
 import { InfoGuidePanelProvider } from '../SlidingSidePanel/InfoGuide';
@@ -130,6 +138,10 @@ const story = ({
               kind: 'windows_desktop',
               disabled: false,
             },
+            {
+              kind: 'mcp',
+              disabled: false,
+            },
           ]}
           onShowStatusInfo={() => null}
           params={mergedParams}
diff --git a/web/packages/shared/components/UnifiedResources/UnifiedResources.tsx b/web/packages/shared/components/UnifiedResources/UnifiedResources.tsx
index 93a554ace9a9c..65651140fe279 100644
--- a/web/packages/shared/components/UnifiedResources/UnifiedResources.tsx
+++ b/web/packages/shared/components/UnifiedResources/UnifiedResources.tsx
@@ -56,6 +56,7 @@ import {
 } from 'shared/hooks/useInfiniteScroll';
 import { makeAdvancedSearchQueryForLabel } from 'shared/utils/advancedSearchLabelQuery';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourcesResponse } from 'teleport/services/agents';
 
 import { useInfoGuide } from '../SlidingSidePanel/InfoGuide';
@@ -68,10 +69,13 @@ import { mapResourceToViewItem } from './shared/viewItemsFactory';
 import {
   IncludedResourceMode,
   PinningSupport,
+  ResourceLabelConfig,
   SharedUnifiedResource,
   UnifiedResourceDefinition,
   UnifiedResourcesPinning,
   UnifiedResourcesQueryParams,
+  VisibleFilterPanelFields,
+  VisibleResourceItemFields,
 } from './types';
 
 // get 48 resources to start
@@ -118,16 +122,50 @@ export type BulkAction = {
   action: (selectedResources: SelectedResource[]) => void;
 };
 
+export type ResourceLabel = {
+  name: string;
+  value: string;
+};
+
 export type SelectedResource = {
   unifiedResourceId: string;
   resource: SharedUnifiedResource['resource'];
 };
 
+/*
+ * ResourceFilterKind are resource kinds that can be used for filtering through
+ * ListUnifiedResources API.
+ *
+ * 'mcp' can be used to filter MCP servers by the backend, even though they are
+ * internally just app resources atm.
+ */
+export type ResourceFilterKind =
+  | SharedUnifiedResource['resource']['kind']
+  | 'mcp';
+
 export type FilterKind = {
-  kind: SharedUnifiedResource['resource']['kind'];
+  kind: ResourceFilterKind;
   disabled: boolean;
 };
 
+const filterKindNameMap: Record<ResourceFilterKind, string> = {
+  app: 'Applications',
+  db: 'Databases',
+  windows_desktop: 'Desktops',
+  kube_cluster: 'Kubernetes Clusters',
+  node: 'SSH Resources',
+  user_group: 'User Groups',
+  git_server: 'Git Servers',
+  mcp: 'MCP Servers',
+};
+
+/*
+ * getFilterKindName returns the human-readable name of the filter kind.
+ */
+export function getFilterKindName(kind: ResourceFilterKind): string {
+  return filterKindNameMap[kind] ?? kind;
+}
+
 export type ResourceAvailabilityFilter =
   | {
       canRequestAll: true;
@@ -150,6 +188,11 @@ export interface UnifiedResourcesProps {
    * Rendered only when the resource list is empty and there's no search query.
    * */
   NoResources: React.ReactElement;
+  /**
+   * If true, it will render the "NoResources" component
+   * regardless of internal "no result" checks.
+   */
+  forceNoResources?: boolean;
   /**
    * If pinning is supported, the functions to get and update pinned resources
    * can be passed here.
@@ -182,6 +225,39 @@ export interface UnifiedResourcesProps {
    * with selected resources status info.
    */
   onShowStatusInfo(resource: UnifiedResourceDefinition): void;
+
+  /**
+   * resourceLabelConfig provides a way to custom handle resource labels.
+   *
+   * Look up the type to see the default behaviors if fields are not
+   * provided.
+   */
+  resourceLabelConfig?: ResourceLabelConfig;
+  /**
+   * onLabelClick is a custom label click handler.
+   *
+   * Default behavior is to append clicked label to
+   * the query string (aka predicate expression).
+   */
+  onLabelClick?(label: ResourceLabel): void;
+  /**
+   *  className support so that UnifiedResources works with the css prop.
+   */
+  className?: string;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   *
+   * Applies to FilterPanel component.
+   */
+  visibleFilterPanelFields?: VisibleFilterPanelFields;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   *
+   * Applies to row item elements (CardView or ListView).
+   */
+  visibleResourceItemFields?: VisibleResourceItemFields;
 }
 
 export function UnifiedResources(props: UnifiedResourcesProps) {
@@ -200,6 +276,12 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
     ClusterDropdown,
     bulkActions = [],
     onShowStatusInfo,
+    visibleFilterPanelFields,
+    visibleResourceItemFields,
+    onLabelClick,
+    resourceLabelConfig,
+    className,
+    forceNoResources,
   } = props;
 
   const containerRef = useRef<HTMLDivElement>(null);
@@ -442,17 +524,34 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
       ? CardsView
       : ListView;
 
+  let footerElement: JSX.Element;
+  if (forceNoResources) {
+    footerElement = props.NoResources;
+  } else if (noResults) {
+    if (isSearchEmpty && !params.pinnedOnly) {
+      footerElement = props.NoResources;
+    }
+    if (params.pinnedOnly && isSearchEmpty) {
+      footerElement = <NoPinned />;
+    }
+    if (!isSearchEmpty) {
+      footerElement = (
+        <NoResults
+          isPinnedTab={params.pinnedOnly}
+          query={params?.query || params?.search}
+        />
+      );
+    }
+  }
+
+  if (resourcesFetchAttempt.status === 'failed' && resources.length > 0) {
+    footerElement = (
+      <ButtonSecondary onClick={onRetryClicked}>Load more</ButtonSecondary>
+    );
+  }
+
   return (
-    <div
-      className="ContainerContext"
-      css={`
-        width: 100%;
-        max-width: 1800px;
-        margin: 0 auto;
-        min-width: 450px;
-      `}
-      ref={containerRef}
-    >
+    <Container className={`ContainerContext ${className}`} ref={containerRef}>
       <ErrorsContainer>
         {resourcesFetchAttempt.status === 'failed' && (
           <Danger
@@ -502,6 +601,7 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
 
       {props.Header}
       <FilterPanel
+        visibleFilterPanelFields={visibleFilterPanelFields}
         availabilityFilter={availabilityFilter}
         changeAvailableResourceMode={changeAvailableResourceMode}
         params={params}
@@ -575,12 +675,15 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
         </Flex>
       )}
       <ViewComponent
-        onLabelClick={label =>
-          setParams({
-            ...params,
-            search: '',
-            query: makeAdvancedSearchQueryForLabel(label, params),
-          })
+        onLabelClick={
+          onLabelClick
+            ? onLabelClick
+            : label =>
+                setParams({
+                  ...params,
+                  search: '',
+                  query: makeAdvancedSearchQueryForLabel(label, params),
+                })
         }
         pinnedResources={pinnedResources}
         selectedResources={selectedResources}
@@ -617,6 +720,7 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
                       availabilityFilter?.mode === 'requestable',
                   },
                 }),
+                resourceLabelConfig,
                 key: generateUnifiedResourceKey(resource),
                 onShowStatusInfo: () => onShowStatusInfo(resource),
                 showingStatusInfo:
@@ -626,22 +730,11 @@ export function UnifiedResources(props: UnifiedResourcesProps) {
             : []
         }
         expandAllLabels={expandAllLabels}
+        visibleInputFields={visibleResourceItemFields}
       />
       <div ref={setTrigger} />
-      <ListFooter>
-        {resourcesFetchAttempt.status === 'failed' && resources.length > 0 && (
-          <ButtonSecondary onClick={onRetryClicked}>Load more</ButtonSecondary>
-        )}
-        {noResults && isSearchEmpty && !params.pinnedOnly && props.NoResources}
-        {noResults && params.pinnedOnly && isSearchEmpty && <NoPinned />}
-        {noResults && !isSearchEmpty && (
-          <NoResults
-            isPinnedTab={params.pinnedOnly}
-            query={params?.query || params?.search}
-          />
-        )}
-      </ListFooter>
-    </div>
+      <ListFooter>{footerElement}</ListFooter>
+    </Container>
   );
 }
 
@@ -686,12 +779,16 @@ function getResourcePinningSupport(
   return PinningSupport.Supported;
 }
 
-function generateUnifiedResourceKey(
+// TODO (avatus): send and use the generated key from the server so we don't have to keep this in sync.
+export function generateUnifiedResourceKey(
   resource: SharedUnifiedResource['resource']
 ): string {
   if (resource.kind === 'node' || resource.kind == 'git_server') {
     return `${resource.hostname}/${resource.id}/${resource.kind}`.toLowerCase();
   }
+  if (resource.kind === 'app' && resource.friendlyName !== '') {
+    return `${resource.friendlyName}/${resource.name}/${resource.kind}`.toLowerCase();
+  }
   return `${resource.name}/${resource.kind}`.toLowerCase();
 }
 
@@ -806,3 +903,10 @@ export function getResourceAvailabilityFilter(
       availableResourceMode satisfies never;
   }
 }
+
+const Container = styled.div`
+  width: 100%;
+  max-width: 1800px;
+  margin: 0 auto;
+  min-width: 450px;
+`;
diff --git a/web/packages/shared/components/UnifiedResources/shared/StatusInfo.story.tsx b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.story.tsx
index e3759cccdf1a0..fcbc64f17c943 100644
--- a/web/packages/shared/components/UnifiedResources/shared/StatusInfo.story.tsx
+++ b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { SlidingSidePanel } from 'shared/components/SlidingSidePanel';
 import { InfoGuideContainer } from 'shared/components/SlidingSidePanel/InfoGuide';
@@ -25,7 +25,7 @@ import { Attempt } from 'shared/hooks/useAttemptNext';
 
 import {
   DatabaseServer,
-  ResourceStatus,
+  KubeServer,
   SharedResourceServer,
   UnifiedResourceDefinition,
 } from '../types';
@@ -36,14 +36,13 @@ import {
 
 type StoryProps = {
   attemptState: 'success' | 'processing' | 'failed' | '';
-  resourceKind: 'db';
-  healthStatus: ResourceStatus | 'empty';
+  resourceKind: 'db' | 'kube_cluster';
+  healthStatus: 'unhealthy' | 'unknown' | 'mixed';
   serverLength: 'few' | 'none' | 'many' | 'single';
 };
 
 const meta: Meta<StoryProps> = {
   title: 'Shared/UnifiedResources/UnhealthyStatusInfo',
-  component: UnhealthyStatusInfo,
   argTypes: {
     attemptState: {
       control: { type: 'select' },
@@ -51,11 +50,12 @@ const meta: Meta<StoryProps> = {
     },
     resourceKind: {
       control: { type: 'select' },
-      options: ['db'],
+      options: ['db', 'kube_cluster'],
     },
     healthStatus: {
       control: { type: 'select' },
-      options: ['unhealthy', 'unknown', 'empty'],
+      description: 'Specifies the health status of the servers listed',
+      options: ['unhealthy', 'mixed', 'unknown'],
     },
     serverLength: {
       control: { type: 'select' },
@@ -80,27 +80,57 @@ export function UnhealthyStatusInfo(props: StoryProps) {
 
   let resource: UnifiedResourceDefinition;
   let servers: SharedResourceServer[] = [];
-  if (props.resourceKind === 'db') {
-    resource = {
-      kind: 'db',
-      type: 'postgres',
-      description: 'some database description',
-      name: 'testing-database-resource-long-title-name',
-      protocol: 'postgres',
-      labels: [],
-      targetHealth: {
-        status: props.healthStatus === 'empty' ? '' : props.healthStatus,
-      },
-    };
-    if (props.serverLength === 'many') {
-      servers = manyDbServers;
-    }
-    if (props.serverLength === 'few') {
-      servers = fewDbServers;
-    }
-    if (props.serverLength === 'single') {
-      servers = [fewDbServers[0]];
-    }
+
+  switch (props.resourceKind) {
+    case 'db':
+      resource = {
+        kind: 'db',
+        type: 'postgres',
+        description: 'some database description',
+        name: 'testing-database-resource-long-title-name',
+        protocol: 'postgres',
+        labels: [],
+        targetHealth: {
+          status: 'unhealthy',
+        },
+      };
+
+      if (props.healthStatus === 'unhealthy') {
+        servers = getDbServers(props, unhealthyDbServers);
+      }
+      if (props.healthStatus === 'unknown') {
+        servers = getDbServers(props, unknownDbServers);
+      }
+      if (props.healthStatus === 'mixed') {
+        servers = getDbServers(props, [
+          ...unknownDbServers,
+          ...unhealthyDbServers,
+        ]);
+      }
+      break;
+    case 'kube_cluster':
+      resource = {
+        kind: 'kube_cluster',
+        name: 'testing-kube-resource-long-title-name',
+        labels: [],
+        targetHealth: {
+          status: 'unhealthy',
+        },
+      };
+
+      if (props.healthStatus === 'unhealthy') {
+        servers = getKubeServers(props, unhealthyKubeServers);
+      }
+      if (props.healthStatus === 'unknown') {
+        servers = getKubeServers(props, unknownKubeServers);
+      }
+      if (props.healthStatus === 'mixed') {
+        servers = getKubeServers(props, [
+          ...unknownKubeServers,
+          ...unhealthyKubeServers,
+        ]);
+      }
+      break;
   }
 
   return (
@@ -132,33 +162,120 @@ const loremTxt =
   quas reiciendis fugiat molestias delectus perspiciatis vero \
   similique minima mollitia accusantium eligendi impedit.';
 
-const fewDbServers: DatabaseServer[] = [
+const unhealthyDbServers: DatabaseServer[] = [
   {
     kind: 'db_server',
     hostId: 'host-id-1',
     hostname: 'hostname-1',
-    targetHealth: { status: 'unhealthy', error: 'error reason 1' },
+    targetHealth: {
+      status: 'unhealthy',
+      error: 'unhealthy error reason 1',
+      message: 'some unhealthy message 1',
+    },
+  },
+  {
+    kind: 'db_server',
+    hostId:
+      'host-id-long-george-washington-cherry-blossom-apple-banana-orange-chocolate-meow',
+    hostname:
+      'hostname-long-really-long-like-really-long-longer-pumpkin-pie-halloween',
+    targetHealth: { status: 'unhealthy', error: loremTxt },
+  },
+];
+
+const unknownDbServers: DatabaseServer[] = [
+  {
+    kind: 'db_server',
+    hostId: 'host-id-1',
+    hostname: 'hostname-1',
+    targetHealth: {
+      status: 'unknown',
+      error: 'unknown error reason 1',
+      message: 'some unknown message 1',
+    },
   },
   {
     kind: 'db_server',
     hostId: 'host-id-2',
     hostname: 'hostname-2',
-    targetHealth: { status: 'unhealthy', error: 'error reason 2' },
+    targetHealth: {
+      status: 'unknown',
+      error: 'unknown error reason 2',
+      message: 'some unknown message 2',
+    },
+  },
+];
+
+function getDbServers(
+  props: Pick<StoryProps, 'serverLength'>,
+  servers: DatabaseServer[]
+) {
+  if (props.serverLength === 'many') {
+    return [...servers, ...servers, ...servers, ...servers];
+  }
+  if (props.serverLength === 'few') {
+    return servers;
+  }
+  if (props.serverLength === 'single') {
+    return [servers[0]];
+  }
+}
+
+const unhealthyKubeServers: KubeServer[] = [
+  {
+    kind: 'kube_server',
+    hostId: 'host-id-1',
+    hostname: 'hostname-1',
+    targetHealth: {
+      status: 'unhealthy',
+      error: 'unhealthy error reason 1',
+      message: 'some unhealthy message 1',
+    },
   },
   {
-    kind: 'db_server',
+    kind: 'kube_server',
     hostId:
-      'host-id-long-george-washington-cherry-blossom-apple-banana-orange-chocolate-meow',
+      'host-id-long-abraham-lincoln-sunflower-meadow-grape-strawberry-mango-vanilla-woof',
     hostname:
-      'hostname-long-really-long-like-really-long-longer-pumpkin-pie-halloween',
-    targetHealth: { status: 'unknown', error: loremTxt },
+      'hostname-long-super-long-extremely-long-longest-blueberry-cake-thanksgiving',
+    targetHealth: { status: 'unhealthy', error: loremTxt },
   },
 ];
 
-const manyDbServers: DatabaseServer[] = [
-  ...fewDbServers,
-  ...fewDbServers,
-  ...fewDbServers,
-  ...fewDbServers,
-  ...fewDbServers,
+const unknownKubeServers: KubeServer[] = [
+  {
+    kind: 'kube_server',
+    hostId: 'host-id-1',
+    hostname: 'hostname-1',
+    targetHealth: {
+      status: 'unknown',
+      error: 'unknown error reason 1',
+      message: 'some unknown message 1',
+    },
+  },
+  {
+    kind: 'kube_server',
+    hostId: 'host-id-2',
+    hostname: 'hostname-2',
+    targetHealth: {
+      status: 'unknown',
+      error: 'unknown error reason 2',
+      message: 'some unknown message 2',
+    },
+  },
 ];
+
+function getKubeServers(
+  props: Pick<StoryProps, 'serverLength'>,
+  servers: KubeServer[]
+) {
+  if (props.serverLength === 'many') {
+    return [...servers, ...servers, ...servers, ...servers];
+  }
+  if (props.serverLength === 'few') {
+    return servers;
+  }
+  if (props.serverLength === 'single') {
+    return [servers[0]];
+  }
+}
diff --git a/web/packages/shared/components/UnifiedResources/shared/StatusInfo.test.ts b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.test.ts
new file mode 100644
index 0000000000000..098ca0a48ae2b
--- /dev/null
+++ b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.test.ts
@@ -0,0 +1,58 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ResourceHealthStatus } from '../types';
+import { shouldWarnResourceStatus } from './StatusInfo';
+
+describe('shouldWarnResourceStatus', () => {
+  const testCases: {
+    name: string;
+    status: ResourceHealthStatus;
+    shouldWarn: boolean;
+  }[] = [
+    {
+      name: 'undefined/empty',
+      status: undefined,
+      shouldWarn: false,
+    },
+    {
+      name: 'healthy status',
+      status: 'healthy',
+      shouldWarn: false,
+    },
+    {
+      name: 'unknown status',
+      status: 'unknown',
+      shouldWarn: false,
+    },
+    {
+      name: 'unhealthy status',
+      status: 'unhealthy',
+      shouldWarn: true,
+    },
+    {
+      name: 'mixed',
+      status: 'mixed',
+      shouldWarn: true,
+    },
+  ];
+
+  test.each(testCases)('$name', ({ status, shouldWarn }) => {
+    expect(shouldWarnResourceStatus(status)).toEqual(shouldWarn);
+  });
+});
diff --git a/web/packages/shared/components/UnifiedResources/shared/StatusInfo.tsx b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.tsx
index b87284b3692dd..6ce64e0ec53fe 100644
--- a/web/packages/shared/components/UnifiedResources/shared/StatusInfo.tsx
+++ b/web/packages/shared/components/UnifiedResources/shared/StatusInfo.tsx
@@ -19,7 +19,7 @@
 import { type JSX } from 'react';
 import styled, { css } from 'styled-components';
 
-import { Box, ButtonBorder, Indicator, Mark, Text } from 'design';
+import { Box, ButtonBorder, Indicator, Text } from 'design';
 import { Alert } from 'design/Alert';
 import Flex from 'design/Flex';
 import {
@@ -40,7 +40,7 @@ import { Attempt } from 'shared/hooks/useAttemptNext';
 import { pluralize } from 'shared/utils/text';
 
 import {
-  ResourceStatus,
+  ResourceHealthStatus,
   SharedResourceServer,
   UnifiedResourceDefinition,
 } from '../types';
@@ -66,7 +66,7 @@ export function UnhealthyStatusInfo({
     fetch({ force: true });
   }
 
-  const unhealthyOrUnknownServers = servers.filter(
+  const unhealthyOrUnknownServers = servers?.filter(
     s => s.targetHealth?.status !== 'healthy'
   );
 
@@ -74,12 +74,14 @@ export function UnhealthyStatusInfo({
     <>
       <Box>
         <ConnectionHeader resource={resource} />
-        <InfoParagraph>
-          <StatusDescription
-            resource={resource}
-            numUnhealthyServers={unhealthyOrUnknownServers.length}
-          />
-        </InfoParagraph>
+        {unhealthyOrUnknownServers.length > 0 && (
+          <InfoParagraph>
+            <StatusDescription
+              fetchedServers={unhealthyOrUnknownServers}
+              resource={resource}
+            />
+          </InfoParagraph>
+        )}
         <InfoParagraph mb={4}>
           <ButtonBorder
             as="a"
@@ -108,7 +110,9 @@ export function UnhealthyStatusInfo({
         )}
         <InfoParagraph>
           {attempt.status === 'success' && !servers?.length && (
-            <Text bold>No Results</Text>
+            // Refresh might be required if all health checks passed
+            // while unified resources page has been stale.
+            <Text bold>No Results. Try refreshing the page.</Text>
           )}
           {attempt.status === 'success' && servers?.length > 0 && (
             <Box
@@ -165,6 +169,15 @@ export function StatusInfoHeader({
         </Box>
       </Flex>
     );
+  } else if (resource.kind === 'kube_cluster') {
+    return (
+      <Flex gap={3}>
+        <ResourceIcon name={'kube'} width="45px" height="45px" />
+        <Box>
+          <H2>{resource.name}</H2>
+        </Box>
+      </Flex>
+    );
   }
 }
 
@@ -180,56 +193,79 @@ function ConnectionHeader({
         <H3>DB Connection Issue</H3>
       </Flex>
     );
+  } else if (resource.kind === 'kube_cluster') {
+    return (
+      <Flex gap={2} my={3}>
+        <WarningIcon size={16} />
+        <H3>Kubernetes Cluster Issue</H3>
+      </Flex>
+    );
   }
 }
 
 function StatusDescription({
+  fetchedServers,
   resource,
-  numUnhealthyServers,
 }: {
+  fetchedServers: SharedResourceServer[];
   resource: UnifiedResourceDefinition;
-  numUnhealthyServers: number;
 }) {
   if (resource.kind === 'db') {
-    const health = resource.targetHealth;
-    const startingWord = numUnhealthyServers > 1 ? 'Some' : 'A';
-    const servicedWord = numUnhealthyServers
-      ? pluralize(numUnhealthyServers, 'service')
-      : 'service';
-    switch (health.status) {
-      case 'unhealthy':
-        return (
-          <>
-            {startingWord} Teleport database {servicedWord} proxying access to
-            this database cannot reach the database endpoint.
-          </>
-        );
-      case 'unknown':
-        return (
-          <>
-            {startingWord} Teleport database {servicedWord} proxying access to
-            this database {numUnhealthyServers > 1 ? 'are' : 'is'} not running
-            network health checks for the database endpoint. User connections
-            will not be routed through affected Teleport database services as
-            long as other database services report a healthy connection to the
-            database.
-          </>
-        );
-      default: // empty
-        return (
-          <>
-            {startingWord} Teleport database {servicedWord} proxying access to
-            this database requires upgrading to Teleport version{' '}
-            <Mark>18.0.0</Mark> to run network health checks.
-          </>
-        );
+    const unhealthyServers = fetchedServers.filter(
+      s => s.targetHealth?.status === 'unhealthy'
+    ).length;
+    const unknownHealthServers = fetchedServers.filter(
+      s => s.targetHealth?.status === 'unknown'
+    ).length;
+
+    if (unhealthyServers && unknownHealthServers) {
+      return (
+        <StyledUl>
+          <li>{unhealthyStatus(unhealthyServers)}</li>
+          <li>{unknownStatus(unknownHealthServers)}</li>
+        </StyledUl>
+      );
     }
+
+    if (unhealthyServers) {
+      return <>{unhealthyStatus(unhealthyServers)}</>;
+    }
+
+    return <>{unknownStatus(unknownHealthServers)}</>;
   }
 }
 
+function unhealthyStatus(numServers: number) {
+  const startingWord = numServers > 1 ? 'Some' : 'A';
+  const serviceWord = numServers ? pluralize(numServers, 'service') : 'service';
+  return (
+    <>
+      {startingWord} Teleport database {serviceWord} proxying access to this
+      database cannot reach the database endpoint.
+    </>
+  );
+}
+
+function unknownStatus(numServers: number) {
+  const startingWord = numServers > 1 ? 'Some' : 'A';
+  const serviceWord = numServers ? pluralize(numServers, 'service') : 'service';
+  return (
+    <>
+      {startingWord} Teleport database {serviceWord} proxying access to this
+      database {numServers > 1 ? 'are' : 'is'} not running network health checks
+      for the database endpoint. User connections will not be routed through
+      affected Teleport database services as long as other database services
+      report a healthy connection to the database.
+    </>
+  );
+}
+
 function getTroubleShootingLink(resource: UnifiedResourceDefinition) {
-  if (resource.kind == 'db') {
-    return 'https://goteleport.com/docs/enroll-resources/database-access/getting-started/#troubleshooting';
+  switch (resource.kind) {
+    case 'db':
+      return 'https://goteleport.com/docs/enroll-resources/database-access/troubleshooting';
+    case 'kube_cluster':
+      return 'https://goteleport.com/docs/enroll-resources/kubernetes-access/troubleshooting';
   }
 }
 
@@ -237,6 +273,8 @@ function getAffectedResourceKind(resource: UnifiedResourceDefinition) {
   switch (resource.kind) {
     case 'db':
       return 'database services';
+    case 'kube_cluster':
+      return 'kubernetes clusters';
   }
 }
 
@@ -264,9 +302,18 @@ function UnhealthyServerList({ servers }: { servers: SharedResourceServer[] }) {
       <Text>
         <InfoField>UUID:</InfoField> {server.hostId}
       </Text>
+      <Text>
+        <InfoField>Status:</InfoField>{' '}
+        {server.targetHealth?.status || 'unknown'}
+      </Text>
+      {server.targetHealth?.message && (
+        <Text>
+          <InfoField>Message:</InfoField> {server.targetHealth.message}
+        </Text>
+      )}
       {server.targetHealth?.error && (
         <Text>
-          <InfoField>Reason:</InfoField> {server.targetHealth.error}
+          <InfoField>Error:</InfoField> {server.targetHealth.error}
         </Text>
       )}
     </Flex>
@@ -305,7 +352,7 @@ export function openStatusInfoPanel({
   guide: JSX.Element;
   isEnterprise?: boolean;
 }) {
-  if (resource.kind === 'db') {
+  if (resource.kind === 'db' || resource.kind === 'kube_cluster') {
     setInfoGuideConfig({
       guide,
       id: getResourceId(resource),
@@ -316,6 +363,18 @@ export function openStatusInfoPanel({
   }
 }
 
-export function isUnhealthy(status: ResourceStatus): boolean {
-  return status && status === 'unhealthy';
+/**
+ * Returns true if any status is unhealthy or if there are a mix of different
+ * health statuses.
+ */
+export function shouldWarnResourceStatus(
+  status: ResourceHealthStatus
+): boolean {
+  return status === 'mixed' || status === 'unhealthy';
 }
+
+export const StyledUl = styled.ul`
+  margin: 0;
+  padding-left: ${p => p.theme.space[4]}px;
+  padding-bottom: ${p => p.theme.space[1]}px;
+`;
diff --git a/web/packages/shared/components/UnifiedResources/shared/getBackgroundColor.ts b/web/packages/shared/components/UnifiedResources/shared/getBackgroundColor.ts
index e801ae6b0dcad..9d71bc08874da 100644
--- a/web/packages/shared/components/UnifiedResources/shared/getBackgroundColor.ts
+++ b/web/packages/shared/components/UnifiedResources/shared/getBackgroundColor.ts
@@ -23,12 +23,14 @@ export interface BackgroundColorProps {
   selected?: boolean;
   pinned?: boolean;
   theme: Theme;
-  hasUnhealthyStatus: boolean;
+  shouldDisplayWarning: boolean;
   showingStatusInfo: boolean;
+  hidePin?: boolean;
+  hideCheckbox?: boolean;
 }
 
 export const getBackgroundColor = (props: BackgroundColorProps) => {
-  if (props.hasUnhealthyStatus) {
+  if (props.shouldDisplayWarning) {
     return 'transparent';
   }
   if (props.selected) {
diff --git a/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.test.ts b/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.test.ts
index 8af64c7237581..0fd5b2aa528d2 100644
--- a/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.test.ts
+++ b/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.test.ts
@@ -16,7 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { App } from 'teleport/services/apps';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import makeApp from 'teleport/services/apps/makeApps';
 
 import { guessAppIcon } from './guessAppIcon';
diff --git a/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.ts b/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.ts
index cfe8ba95f4d96..000b06b3d3f7c 100644
--- a/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.ts
+++ b/web/packages/shared/components/UnifiedResources/shared/guessAppIcon.ts
@@ -21,8 +21,7 @@ import {
   ResourceIconName,
   resourceIconSpecs,
 } from 'design/ResourceIcon';
-
-import { AppSubKind } from 'teleport/services/apps';
+import { AppSubKind } from 'shared/services';
 
 import { UnifiedResourceApp } from '../types';
 
@@ -41,7 +40,7 @@ export function guessAppIcon(resource: UnifiedResourceApp): ResourceIconName {
   }
 
   if (awsConsole) {
-    return 'aws';
+    return 'awsidentityandaccessmanagementiam';
   }
   if (subKind === AppSubKind.AwsIcAccount) {
     return 'awsaccount';
diff --git a/web/packages/shared/components/UnifiedResources/shared/predicateExpression.test.ts b/web/packages/shared/components/UnifiedResources/shared/predicateExpression.test.ts
new file mode 100644
index 0000000000000..02f64853b7079
--- /dev/null
+++ b/web/packages/shared/components/UnifiedResources/shared/predicateExpression.test.ts
@@ -0,0 +1,85 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ResourceHealthStatus } from '../types';
+import { buildPredicateExpression } from './predicateExpression';
+
+type ResourceStatus = ResourceHealthStatus | '';
+
+describe('getPredicateExpression', () => {
+  const testCases: {
+    name: string;
+    requestedStatuses?: ResourceStatus[];
+    requestedQuery?: string;
+    expected: string | undefined;
+  }[] = [
+    {
+      name: 'undefined fields',
+      requestedStatuses: undefined,
+      requestedQuery: undefined,
+      expected: '',
+    },
+    {
+      name: 'empty status array',
+      requestedStatuses: [],
+      expected: '',
+    },
+    {
+      name: 'empty value in status array are ignored',
+      requestedStatuses: ['', ''],
+      expected: '',
+    },
+    {
+      name: 'with only status',
+      requestedStatuses: ['healthy'],
+      expected: 'health.status == "healthy"',
+    },
+    {
+      name: 'with multiple statuses',
+      requestedStatuses: ['healthy', '', 'unhealthy'],
+      expected: 'health.status == "healthy" || health.status == "unhealthy"',
+    },
+    {
+      name: 'with only query',
+      requestedQuery: 'name == "mysql"',
+      expected: 'name == "mysql"',
+    },
+    {
+      name: 'with status and query',
+      requestedStatuses: ['healthy'],
+      requestedQuery: 'name == "mysql"',
+      expected: '(name == "mysql") && (health.status == "healthy")',
+    },
+    {
+      name: 'with multi status and query',
+      requestedStatuses: ['healthy', '', 'unhealthy'],
+      requestedQuery: 'name == "mysql" || name == "postgres"',
+      expected:
+        '(name == "mysql" || name == "postgres") && (health.status == "healthy" || health.status == "unhealthy")',
+    },
+  ];
+
+  test.each(testCases)(
+    '$name',
+    ({ requestedStatuses, requestedQuery, expected }) => {
+      expect(
+        buildPredicateExpression(requestedStatuses, requestedQuery)
+      ).toEqual(expected);
+    }
+  );
+});
diff --git a/web/packages/shared/components/UnifiedResources/shared/predicateExpression.ts b/web/packages/shared/components/UnifiedResources/shared/predicateExpression.ts
new file mode 100644
index 0000000000000..227488a8ab4b8
--- /dev/null
+++ b/web/packages/shared/components/UnifiedResources/shared/predicateExpression.ts
@@ -0,0 +1,33 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export function buildPredicateExpression(
+  requestedStatuses: string[] = [],
+  requestedPredicateExpression = ''
+): string {
+  // deduplicate statuses
+  const statusPredicate = [...new Set(requestedStatuses)]
+    // ignore empty
+    .filter(Boolean)
+    .map(status => `health.status == "${status}"`)
+    .join(' || ');
+  if (requestedPredicateExpression && statusPredicate) {
+    return `(${requestedPredicateExpression}) && (${statusPredicate})`;
+  }
+  return requestedPredicateExpression || statusPredicate;
+}
diff --git a/web/packages/shared/components/UnifiedResources/shared/viewItemsFactory.ts b/web/packages/shared/components/UnifiedResources/shared/viewItemsFactory.ts
index 831f3adffdb52..32f110a8d8cd3 100644
--- a/web/packages/shared/components/UnifiedResources/shared/viewItemsFactory.ts
+++ b/web/packages/shared/components/UnifiedResources/shared/viewItemsFactory.ts
@@ -22,10 +22,11 @@ import {
   Desktop as DesktopIcon,
   GitHub as GitHubIcon,
   Kubernetes as KubernetesIcon,
+  ModelContextProtocol as MCPIcon,
   Server as ServerIcon,
 } from 'design/Icon';
 import { ResourceIconName } from 'design/ResourceIcon';
-import { NodeSubKind } from 'shared/services';
+import { AppSubKind, NodeSubKind } from 'shared/services';
 import { DbProtocol } from 'shared/services/databases';
 
 import {
@@ -107,6 +108,7 @@ export function makeUnifiedResourceViewItemKube(
       resourceType: 'Kubernetes',
     },
     requiresRequest: resource.requiresRequest,
+    status: resource.targetHealth?.status,
   };
 }
 
@@ -114,6 +116,24 @@ export function makeUnifiedResourceViewItemApp(
   resource: UnifiedResourceApp,
   ui: UnifiedResourceUi
 ): UnifiedResourceViewItem {
+  if (resource.subKind === AppSubKind.MCP) {
+    // TODO(greedy52) add address for non-stdio based MCP servers.
+    return {
+      name: resource.friendlyName || resource.name,
+      SecondaryIcon: MCPIcon,
+      primaryIconName: guessAppIcon(resource),
+      ActionButton: ui.ActionButton,
+      labels: resource.labels,
+      cardViewProps: {
+        primaryDesc: resource.description || 'MCP server',
+      },
+      listViewProps: {
+        resourceType: 'MCP Server',
+        description: resource.description || 'MCP server',
+      },
+      requiresRequest: resource.requiresRequest,
+    };
+  }
   return {
     name: resource.friendlyName || resource.name,
     SecondaryIcon: ApplicationIcon,
diff --git a/web/packages/shared/components/UnifiedResources/types.test.ts b/web/packages/shared/components/UnifiedResources/types.test.ts
new file mode 100644
index 0000000000000..42f65e3e01c84
--- /dev/null
+++ b/web/packages/shared/components/UnifiedResources/types.test.ts
@@ -0,0 +1,170 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  isResourceHealthStatus,
+  ResourceHealthStatus,
+  UnifiedResourceApp,
+  UnifiedResourceDatabase,
+  UnifiedResourceDesktop,
+  UnifiedResourceGitServer,
+  UnifiedResourceKube,
+  UnifiedResourceNode,
+  UnifiedResourceUserGroup,
+} from './types';
+import { generateUnifiedResourceKey } from './UnifiedResources';
+
+test('isResourceStatus', () => {
+  const validStatuses: ResourceHealthStatus[] = [
+    'healthy',
+    'unhealthy',
+    'unknown',
+    'mixed',
+  ];
+  const statuses = [
+    'healthy',
+    'random',
+    'unhealthy',
+    'llama',
+    'unknown',
+    '',
+    'mixed',
+  ];
+
+  expect(statuses.filter(isResourceHealthStatus)).toEqual(validStatuses);
+});
+
+describe('generateUnifiedResourceKey', () => {
+  test('generates key for node resource using hostname/id/kind format', () => {
+    const nodeResource: UnifiedResourceNode = {
+      kind: 'node',
+      hostname: 'MyServer',
+      id: 'abc-123',
+      addr: '127.0.0.1',
+      tunnel: false,
+      subKind: 'teleport',
+      labels: [],
+    };
+
+    expect(generateUnifiedResourceKey(nodeResource)).toBe(
+      'myserver/abc-123/node'
+    );
+  });
+
+  test('generates key for git_server resource using hostname/id/kind format', () => {
+    const gitServerResource: UnifiedResourceGitServer = {
+      kind: 'git_server',
+      hostname: 'GitServer',
+      id: 'git-456',
+      labels: [],
+      subKind: 'github',
+      github: {
+        organization: 'my-org',
+        integration: 'my-integration',
+      },
+    };
+
+    expect(generateUnifiedResourceKey(gitServerResource)).toBe(
+      'gitserver/git-456/git_server'
+    );
+  });
+
+  test('generates key for app resource with friendlyName using friendlyName/name/kind format', () => {
+    const appResource: UnifiedResourceApp = {
+      kind: 'app',
+      id: 'app-123',
+      name: 'my-app',
+      friendlyName: 'MyFriendlyApp',
+      description: 'Test app',
+      labels: [],
+      awsConsole: false,
+      samlApp: false,
+    };
+
+    expect(generateUnifiedResourceKey(appResource)).toBe(
+      'myfriendlyapp/my-app/app'
+    );
+  });
+
+  test('generates key for app resource without friendlyName using name/kind format', () => {
+    const appResource: UnifiedResourceApp = {
+      kind: 'app',
+      id: 'app-124',
+      name: 'my-app',
+      friendlyName: '',
+      description: 'Test app',
+      labels: [],
+      awsConsole: false,
+      samlApp: false,
+    };
+
+    expect(generateUnifiedResourceKey(appResource)).toBe('my-app/app');
+  });
+
+  test('generates key for database resource using name/kind format', () => {
+    const dbResource: UnifiedResourceDatabase = {
+      kind: 'db',
+      name: 'MyDatabase',
+      description: 'Test database',
+      type: 'postgres',
+      protocol: 'postgres',
+      labels: [],
+    };
+
+    expect(generateUnifiedResourceKey(dbResource)).toBe('mydatabase/db');
+  });
+
+  test('generates key for kube_cluster resource using name/kind format', () => {
+    const kubeResource: UnifiedResourceKube = {
+      kind: 'kube_cluster',
+      name: 'MyKubeCluster',
+      labels: [],
+    };
+
+    expect(generateUnifiedResourceKey(kubeResource)).toBe(
+      'mykubecluster/kube_cluster'
+    );
+  });
+
+  test('generates key for windows_desktop resource using name/kind format', () => {
+    const desktopResource: UnifiedResourceDesktop = {
+      kind: 'windows_desktop',
+      name: 'MyDesktop',
+      os: 'windows',
+      addr: '127.0.0.1',
+      labels: [],
+    };
+
+    expect(generateUnifiedResourceKey(desktopResource)).toBe(
+      'mydesktop/windows_desktop'
+    );
+  });
+
+  test('generates key for user_group resource using name/kind format', () => {
+    const userGroupResource: UnifiedResourceUserGroup = {
+      kind: 'user_group',
+      name: 'MyUserGroup',
+      description: 'Test group',
+      labels: [],
+    };
+
+    expect(generateUnifiedResourceKey(userGroupResource)).toBe(
+      'myusergroup/user_group'
+    );
+  });
+});
diff --git a/web/packages/shared/components/UnifiedResources/types.ts b/web/packages/shared/components/UnifiedResources/types.ts
index 428baafb193a9..aab6eb1a843c6 100644
--- a/web/packages/shared/components/UnifiedResources/types.ts
+++ b/web/packages/shared/components/UnifiedResources/types.ts
@@ -16,24 +16,62 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import React from 'react';
+import React, { ComponentProps } from 'react';
 
 import { Icon } from 'design/Icon';
+import { LabelButtonWithIcon } from 'design/Label/LabelButtonWithIcon';
 import { ResourceIconName } from 'design/ResourceIcon';
-import { NodeSubKind } from 'shared/services';
+import { TargetHealth } from 'gen-proto-ts/teleport/lib/teleterm/v1/target_health_pb';
+import { AppSubKind, NodeSubKind } from 'shared/services';
 import { DbProtocol } from 'shared/services/databases';
+import type { ComponentFeatureID } from 'shared/utils/componentFeatures';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourceLabel } from 'teleport/services/agents';
-import { AppSubKind, PermissionSet } from 'teleport/services/apps';
+// eslint-disable-next-line no-restricted-imports -- FIXME
+import { AppMCP, PermissionSet } from 'teleport/services/apps';
 
-/**
- * status == '' is a result of an older agent that does not
- * support the health check feature.
- */
-export type ResourceStatus = 'healthy' | 'unhealthy' | 'unknown' | '';
+import { SortOrder } from '../Controls/SortMenuV2';
+
+// "mixed" indicates the resource has a mix of health
+// statuses. This can happen when multiple agents proxy the same resource.
+export type ResourceHealthStatus =
+  | 'healthy'
+  | 'unhealthy'
+  | 'unknown'
+  | 'mixed';
+
+const resourceHealthStatuses = new Set<ResourceHealthStatus>([
+  'healthy',
+  'unhealthy',
+  'unknown',
+  'mixed',
+]);
+
+export function isResourceHealthStatus(
+  status: unknown
+): status is ResourceHealthStatus {
+  return (
+    typeof status === 'string' &&
+    resourceHealthStatuses.has(status as ResourceHealthStatus)
+  );
+}
+
+export function makeTargetHealth(
+  t: TargetHealth | undefined
+): ResourceTargetHealth | undefined {
+  if (!t) return undefined;
+  return {
+    status: t.status as ResourceHealthStatus,
+    error: t.error,
+    message: t.message,
+  };
+}
 
 export type ResourceTargetHealth = {
-  status: ResourceStatus;
+  status: ResourceHealthStatus;
+  // additional information meant for user.
+  message?: string;
   error?: string;
 };
 
@@ -50,6 +88,8 @@ export type UnifiedResourceApp = {
   requiresRequest?: boolean;
   subKind?: AppSubKind;
   permissionSets?: PermissionSet[];
+  mcp?: AppMCP;
+  supportedFeatureIds?: ComponentFeatureID[];
 };
 
 export interface UnifiedResourceDatabase {
@@ -79,6 +119,7 @@ export interface UnifiedResourceKube {
   name: string;
   labels: ResourceLabel[];
   requiresRequest?: boolean;
+  targetHealth?: ResourceTargetHealth;
 }
 
 export type UnifiedResourceDesktop = {
@@ -137,9 +178,10 @@ export type UnifiedResourcesQueryParams = {
   search?: string;
   sort?: {
     fieldName: string;
-    dir: 'ASC' | 'DESC';
+    dir: SortOrder;
   };
   pinnedOnly?: boolean;
+  statuses?: ResourceHealthStatus[];
   // TODO(bl-nero): Remove this once filters are expressed as advanced search.
   kinds?: string[];
   includedResourceMode?: IncludedResourceMode;
@@ -156,9 +198,22 @@ export interface UnifiedResourceViewItem {
   cardViewProps: CardViewSpecificProps;
   listViewProps: ListViewSpecificProps;
   requiresRequest?: boolean;
-  status?: ResourceStatus;
+  status?: ResourceHealthStatus;
 }
 
+export type VisibleFilterPanelFields = {
+  checkbox: boolean;
+  clusterOpts: boolean;
+  healthStatusOpts: boolean;
+  resourceTypeOpts: boolean;
+  resourceAvailabilityOpts: boolean;
+};
+
+export type VisibleResourceItemFields = {
+  checkbox: boolean;
+  pin: boolean;
+};
+
 export enum PinningSupport {
   Supported = 'Supported',
   /**
@@ -178,6 +233,17 @@ export type IncludedResourceMode =
   | 'requestable'
   | 'accessible';
 
+/**
+ * If this field is not provided, the default config will be:
+ * - No icon, just text label
+ * - Label kind is "secondary"
+ * - No hover states
+ */
+export type ResourceLabelConfig = Omit<
+  ComponentProps<typeof LabelButtonWithIcon>,
+  'children'
+>;
+
 export type ResourceItemProps = {
   onLabelClick?: (label: ResourceLabel) => void;
   pinResource: () => void;
@@ -193,6 +259,18 @@ export type ResourceItemProps = {
    * Used as a flag to render different styling.
    */
   showingStatusInfo: boolean;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   */
+  visibleInputFields?: VisibleResourceItemFields;
+  /**
+   * resourceLabelConfig provides a way to custom handle resource labels.
+   *
+   * Look up the type to see the default behaviors if fields are not
+   * provided.
+   */
+  resourceLabelConfig?: ResourceLabelConfig;
 };
 
 // Props that are needed for the Card view.
@@ -236,6 +314,18 @@ export type ResourceViewProps = {
     showingStatusInfo: boolean;
   }[];
   expandAllLabels: boolean;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   */
+  visibleInputFields?: VisibleResourceItemFields;
+  /**
+   * resourceLabelConfig provides a way to custom handle resource labels.
+   *
+   * Look up the type to see the default behaviors if fields are not
+   * provided.
+   */
+  resourceLabelConfig?: ResourceLabelConfig;
 };
 
 /**
@@ -250,4 +340,16 @@ export type DatabaseServer = {
   targetHealth?: ResourceTargetHealth;
 };
 
-export type SharedResourceServer = DatabaseServer;
+/**
+ * KubeServer (kube_server) describes a Kube heartbeat signal
+ * reported from an agent (kubernetes_service) that is proxying
+ * the Kubernetes cluster.
+ */
+export type KubeServer = {
+  kind: 'kube_server';
+  hostname: string;
+  hostId: string;
+  targetHealth?: ResourceTargetHealth;
+};
+
+export type SharedResourceServer = DatabaseServer | KubeServer;
diff --git a/web/packages/shared/components/Validation/rules.test.ts b/web/packages/shared/components/Validation/rules.test.ts
index 827264949d559..40ffa0b628637 100644
--- a/web/packages/shared/components/Validation/rules.test.ts
+++ b/web/packages/shared/components/Validation/rules.test.ts
@@ -22,6 +22,7 @@ import {
   requiredEmailLike,
   requiredField,
   requiredIamRoleName,
+  requiredMaxLength,
   requiredPassword,
   requiredPort,
   requiredRoleArn,
@@ -156,6 +157,25 @@ describe('requiredPort', () => {
   });
 });
 
+describe('requiredMaxLength', () => {
+  const errMsg = 'message goes here';
+  const validator = requiredMaxLength(errMsg, 10);
+  test.each`
+    value                         | expected
+    ${'Lorem ipsum'}              | ${{ valid: false, message: errMsg }}
+    ${'Lorem ipsu'}               | ${{ valid: true }}
+    ${'   Lorem ipsu   '}         | ${{ valid: true }}
+    ${''}                         | ${{ valid: true }}
+    ${Array.from({ length: 11 })} | ${{ valid: false, message: errMsg }}
+    ${Array.from({ length: 10 })} | ${{ valid: true }}
+    ${[]}                         | ${{ valid: true }}
+    ${1}                          | ${{ valid: false, message: 'value must be a string or an array' }}
+    ${true}                       | ${{ valid: false, message: 'value must be a string or an array' }}
+  `('value: $value', ({ value, expected }) => {
+    expect(validator(value)()).toEqual(expected);
+  });
+});
+
 test('runRules', () => {
   expect(
     runRules(
diff --git a/web/packages/shared/components/Validation/rules.ts b/web/packages/shared/components/Validation/rules.ts
index cb6425369cd60..d6fa0404ca3d0 100644
--- a/web/packages/shared/components/Validation/rules.ts
+++ b/web/packages/shared/components/Validation/rules.ts
@@ -16,14 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/**
- * ROLE_ARN_REGEX uses the same regex matcher used in the backend:
- * https://github.com/gravitational/teleport/blob/2cba82cb332e769ebc8a658d32ff24ddda79daff/api/utils/aws/identifiers.go#L43
- *
- * The regex checks for alphanumerics and select few characters.
- */
-const IAM_ROLE_NAME_REGEX = /^[\w+=,.@-]+$/;
-
 /**
  * The result of validating a field.
  */
@@ -107,28 +99,62 @@ const requiredConfirmedPassword =
     };
   };
 
-const isIamRoleNameValid = roleName => {
-  return (
-    roleName && roleName.length <= 64 && roleName.match(IAM_ROLE_NAME_REGEX)
-  );
+/**
+ * DNS1035_LABEL_REGEX uses the same regex matcher as documented here:
+ * https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#rfc-1035-label-names
+ *
+ * This matches how the backend validates integration names to satisfy a lowercase valid DNS subdomain.
+ */
+const DNS1035_LABEL_REGEX = /^[a-z]([-a-z0-9]*[a-z0-9])?$/;
+const DNS1035_LABEL_MAX_LENGTH = 63;
+/**
+ * @param name validIntegrationName verifies if the given value is a
+ * valid Integration name.
+ */
+const validIntegrationName = (name: string): ValidationResult => {
+  if (name.length > DNS1035_LABEL_MAX_LENGTH) {
+    return {
+      valid: false,
+      message: 'Name should be <= ' + DNS1035_LABEL_MAX_LENGTH + ' characters',
+    };
+  }
+
+  if (!name.match(DNS1035_LABEL_REGEX)) {
+    return {
+      valid: false,
+      message: 'Name must be a lower case valid DNS subdomain',
+    };
+  }
+
+  return {
+    valid: true,
+  };
 };
 
+/**
+ * IAM_ROLE_NAME_REGEX uses the same regex matcher used in the backend:
+ * https://github.com/gravitational/teleport/blob/8d946146999260578f1a1b250aa87a6008343bab/api/utils/aws/identifiers.go#L178
+ *
+ * The regex checks for alphanumerics and select few characters.
+ */
+const IAM_ROLE_NAME_REGEX = /^[\w+=,.@-]+$/;
+const IAM_ROLE_NAME_MAX_LENGTH = 64;
 /**
  * @param name validAwsIAMRoleName verifies if the given value is a
  * valid AWS IAM role name.
  */
 const validAwsIAMRoleName = (name: string): ValidationResult => {
-  if (name.length > 64) {
+  if (name.length > IAM_ROLE_NAME_MAX_LENGTH) {
     return {
       valid: false,
-      message: 'name should be <= 64 characters',
+      message: 'Name should be <= ' + IAM_ROLE_NAME_MAX_LENGTH + ' characters',
     };
   }
 
-  if (!isIamRoleNameValid(name)) {
+  if (!name.match(IAM_ROLE_NAME_REGEX)) {
     return {
       valid: false,
-      message: 'name can only contain characters @ = , . + - and alphanumerics',
+      message: 'Name can only contain characters @ = , . + - and alphanumerics',
     };
   }
 
@@ -137,9 +163,64 @@ const validAwsIAMRoleName = (name: string): ValidationResult => {
   };
 };
 
+/**
+ * ROLES_ANYWHERE_NAME_REGEX uses the same regex matcher used in the backend:
+ * https://github.com/gravitational/teleport/blob/8d946146999260578f1a1b250aa87a6008343bab/api/utils/aws/identifiers.go#L213
+ */
+const ROLES_ANYWHERE_NAME_REGEX = /^[ a-zA-Z0-9-_]{1,255}$/;
+const ROLES_ANYWHERE_NAME_MAX_LENGTH = 255;
+/**
+ * @param name validAwsRaResourceName verifies if the given value is a
+ * valid AWS Roles Anywhere resource name.
+ */
+const validAwsRaResourceName = (name: string): ValidationResult => {
+  if (name.length > ROLES_ANYWHERE_NAME_MAX_LENGTH) {
+    return {
+      valid: false,
+      message:
+        'Name should be <= ' + ROLES_ANYWHERE_NAME_MAX_LENGTH + ' characters',
+    };
+  }
+
+  // Since [space] is allowed in regex matcher, we don't want leading/trailing whitespaces.
+  if (name !== name.trim()) {
+    return {
+      valid: false,
+      message: 'Name contains leading/trailing whitespace characters',
+    };
+  }
+
+  if (!name.match(ROLES_ANYWHERE_NAME_REGEX)) {
+    return {
+      valid: false,
+      message: 'Name can only contain characters [space] - _ and alphanumerics',
+    };
+  }
+  return {
+    valid: true,
+  };
+};
+
+/**
+ * requiredIntegrationName is a required field and checks for a
+ * value which should also be a valid Integration name.
+ * @param name is an integration name.
+ * @returns ValidationResult
+ */
+const requiredIntegrationName: Rule = name => (): ValidationResult => {
+  if (!name) {
+    return {
+      valid: false,
+      message: 'Integration name is required',
+    };
+  }
+
+  return validIntegrationName(name);
+};
+
 /**
  * requiredIamRoleName is a required field and checks for a
- * value which should also be a valid AWS IAM role name.
+ * value which should also be a valid AWS IAM Role name.
  * @param name is a role name.
  * @returns ValidationResult
  */
@@ -147,13 +228,47 @@ const requiredIamRoleName: Rule = name => (): ValidationResult => {
   if (!name) {
     return {
       valid: false,
-      message: 'IAM role name required',
+      message: 'IAM Role name is required',
     };
   }
 
   return validAwsIAMRoleName(name);
 };
 
+/**
+ * requiredIamTrustAnchorName is a required field and checks for a
+ * value which should also be a valid AWS IAM Roles Anywhere Trust Anchor name.
+ * @param name is a trust anchor name.
+ * @returns ValidationResult
+ */
+const requiredIamTrustAnchorName: Rule = name => (): ValidationResult => {
+  if (!name) {
+    return {
+      valid: false,
+      message: 'IAM Trust Anchor name is required',
+    };
+  }
+
+  return validAwsRaResourceName(name);
+};
+
+/**
+ * requiredIamProfileName is a required field and checks for a
+ * value which should also be a valid AWS IAM Roles Anywhere Profile name.
+ * @param name is a profile name.
+ * @returns ValidationResult
+ */
+const requiredIamProfileName: Rule = name => (): ValidationResult => {
+  if (!name) {
+    return {
+      valid: false,
+      message: 'IAM Profile name is required',
+    };
+  }
+
+  return validAwsRaResourceName(name);
+};
+
 /**
  * ROLE_ARN_REGEX_STR checks provided arn (amazon resource names) is
  * somewhat in the format as documented here:
@@ -188,6 +303,14 @@ const requiredRoleArn: Rule = roleArn => () => {
   };
 };
 
+const isIamRoleNameValid = (roleName: string) => {
+  return (
+    roleName &&
+    roleName.length <= IAM_ROLE_NAME_MAX_LENGTH &&
+    roleName.match(IAM_ROLE_NAME_REGEX)
+  );
+};
+
 export interface EmailValidationResult extends ValidationResult {
   kind?: 'empty' | 'invalid';
 }
@@ -260,6 +383,39 @@ const requiredPort: Rule = port => () => {
   };
 };
 
+/**
+ * requiredMaxLength checks for strings or arrays over a given length.
+ *
+ * @param message The custom error message to display to users.
+ * @param maxLength The maximum length to allow.
+ * @param value The value input.
+ */
+const requiredMaxLength =
+  <T = string>(
+    message: string,
+    maxLength: number
+  ): Rule<T | T[] | readonly T[]> =>
+  value =>
+  () => {
+    if (typeof value === 'string') {
+      const valid = value.trim().length <= maxLength;
+      return {
+        valid,
+        message: valid ? undefined : message,
+      };
+    }
+
+    if (Array.isArray(value)) {
+      const valid = value.length <= maxLength;
+      return {
+        valid,
+        message: valid ? undefined : message,
+      };
+    }
+
+    return { valid: false, message: 'value must be a string or an array' };
+  };
+
 /**
  * A rule function that combines multiple inner rule functions. All rules must
  * return `valid`, otherwise it returns a comma separated string containing all
@@ -368,8 +524,12 @@ export {
   requiredConfirmedPassword,
   requiredField,
   requiredRoleArn,
+  requiredIntegrationName,
   requiredIamRoleName,
+  requiredIamTrustAnchorName,
+  requiredIamProfileName,
   requiredEmailLike,
+  requiredMaxLength,
   requiredAll,
   requiredMatchingRoleNameAndRoleArn,
   validAwsIAMRoleName,
diff --git a/web/packages/shared/hooks/useInfiniteScroll/testUtils.ts b/web/packages/shared/hooks/useInfiniteScroll/testUtils.ts
index 56abefaace101..b09ce28959ddc 100644
--- a/web/packages/shared/hooks/useInfiniteScroll/testUtils.ts
+++ b/web/packages/shared/hooks/useInfiniteScroll/testUtils.ts
@@ -18,6 +18,7 @@
 
 import 'whatwg-fetch';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { Node } from 'teleport/services/nodes';
 
 /**
diff --git a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.test.ts b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.test.ts
index 92dbca79b95f0..c80f38db40339 100644
--- a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.test.ts
+++ b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.test.ts
@@ -18,7 +18,9 @@
 
 import { act, renderHook } from '@testing-library/react';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ApiError } from 'teleport/services/api/parseError';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { Node } from 'teleport/services/nodes';
 
 import { newFetchFunc, resourceClusterIds, resourceNames } from './testUtils';
diff --git a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
index be15d3a2a3077..89424c68e19ab 100644
--- a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
+++ b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
@@ -27,7 +27,9 @@ import {
 import { Attempt } from 'shared/hooks/useAttemptNext';
 import { isAbortError } from 'shared/utils/abortError';
 
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ResourcesResponse } from 'teleport/services/agents';
+// eslint-disable-next-line no-restricted-imports -- FIXME
 import { ApiError } from 'teleport/services/api/parseError';
 
 /**
@@ -205,7 +207,7 @@ export type KeyBasedPaginationOptions<T> = {
   dataKey?: string;
 };
 
-type KeyBasedPagination<T> = {
+export type KeyBasedPagination<T> = {
   /**
    * Attempts to fetch a new batch of data, unless one is already being fetched,
    * or the previous fetch resulted with an error. It is intended to be called
@@ -227,6 +229,10 @@ type KeyBasedPagination<T> = {
   clear(): void;
   attempt: Attempt;
   resources: T[];
+  /**
+   * True if there is no next page.
+   * Means all pages were fetched.
+   */
   finished: boolean;
   /**
    * Used in conjunction with create/delete/update operations
diff --git a/web/packages/shared/hooks/useRefAutoFocus/useRefAutoFocus.ts b/web/packages/shared/hooks/useRefAutoFocus/useRefAutoFocus.ts
index 7b97905749a3e..c0747a95b9bca 100644
--- a/web/packages/shared/hooks/useRefAutoFocus/useRefAutoFocus.ts
+++ b/web/packages/shared/hooks/useRefAutoFocus/useRefAutoFocus.ts
@@ -24,6 +24,10 @@ import { DependencyList, MutableRefObject, useEffect, useRef } from 'react';
  */
 export function useRefAutoFocus<T extends { focus(): void }>(options: {
   shouldFocus: boolean;
+  /**
+   * @deprecated Include items from refocusDeps into the calculation of shouldFocus instead.
+   * The list of useEffect deps should be statically known.
+   */
   refocusDeps?: DependencyList;
 }): MutableRefObject<T> {
   const ref = useRef<T>(undefined);
diff --git a/web/packages/shared/libs/ironrdp/src/lib.rs b/web/packages/shared/libs/ironrdp/src/lib.rs
index 13f7665cdd45a..f1f5af32da93a 100644
--- a/web/packages/shared/libs/ironrdp/src/lib.rs
+++ b/web/packages/shared/libs/ironrdp/src/lib.rs
@@ -24,6 +24,7 @@ use ironrdp_graphics::image_processing::PixelFormat;
 use ironrdp_pdu::fast_path::UpdateCode::{Bitmap, SurfaceCommands};
 use ironrdp_pdu::fast_path::{FastPathHeader, FastPathUpdatePdu};
 use ironrdp_pdu::geometry::{InclusiveRectangle, Rectangle};
+use ironrdp_pdu::rdp::client_info;
 use ironrdp_session::fast_path::UpdateKind;
 use ironrdp_session::image::DecodedImage;
 use ironrdp_session::ActiveStageOutput;
@@ -269,10 +270,12 @@ impl FastPathProcessor {
                 self.remote_fx_check_required = false;
                 Ok(())
             }
-            Bitmap => Err(JsValue::from_str(concat!(
-                "Teleport requires the RemoteFX codec for Windows desktop sessions, ",
-                "but it is not currently enabled. For detailed instructions, see:\n",
-                "https://goteleport.com/docs/enroll-resources/desktop-access/active-directory/#enable-remotefx"
+            Bitmap => Err(JsValue::from(format!(
+                "Teleport requires the RemoteFX codec for Windows desktop sessions, \
+                but the Windows host sent a bitmap update with {} compression instead.\n\
+                For detailed instructions, see:\n\
+                https://goteleport.com/docs/enroll-resources/desktop-access/active-directory/#enable-remotefx",
+                compression_type(&update_pdu.compression_type)
             ))),
             _ => Ok(()),
         }
@@ -385,3 +388,13 @@ fn extract_whole_rows(
 
     (wider_region, dst)
 }
+
+fn compression_type(ct: &Option<client_info::CompressionType>) -> &'static str {
+    match ct {
+        None => "unknown",
+        Some(client_info::CompressionType::K8) => "RDP 4.0",
+        Some(client_info::CompressionType::K64) => "RDP 5.0",
+        Some(client_info::CompressionType::Rdp6) => "RDP 6.0",
+        Some(client_info::CompressionType::Rdp61) => "RDP 6.1",
+    }
+}
diff --git a/web/packages/shared/libs/tdp/client.ts b/web/packages/shared/libs/tdp/client.ts
index a7435ef93db30..d6fc1e497eebc 100644
--- a/web/packages/shared/libs/tdp/client.ts
+++ b/web/packages/shared/libs/tdp/client.ts
@@ -138,12 +138,13 @@ export class TdpClient extends EventEmitter<EventMap> {
   protected transport: TdpTransport | undefined;
   private transportAbortController: AbortController | undefined;
   private fastPathProcessor: FastPathProcessor | undefined;
+  private sharedDirectory: SharedDirectoryAccess | undefined;
 
   private logger = Logger.create('TDPClient');
 
   constructor(
     private getTransport: (signal: AbortSignal) => Promise<TdpTransport>,
-    private sharedDirectoryAccess: SharedDirectoryAccess
+    private selectSharedDirectory: () => Promise<SharedDirectoryAccess>
   ) {
     super();
     this.codec = new Codec();
@@ -186,8 +187,23 @@ export class TdpClient extends EventEmitter<EventMap> {
       this.sendClientScreenSpec(options.screenSpec);
     }
 
-    if (options.keyboardLayout !== undefined) {
+    // 0 represents the default keyboard layout from the point of view of the
+    // remote desktop, so there is no need to send this message. Additionally,
+    // for clients (Connect) that don't support specifying a keyboard layout
+    // and WDS versions that don't support this feature (v17 and earlier), this
+    // avoids the connection crashing.
+    if (options.keyboardLayout !== undefined && options.keyboardLayout !== 0) {
       this.sendClientKeyboardLayout(options.keyboardLayout);
+    } else {
+      // The proxy expects two messasges (client screen spec and keyboard layout)
+      // before it will initialise the connection to WDS. If no keyboard layout
+      // is sent, the proxy will hang waiting for a second message that won't
+      // arrive. To get around this we send another client screen spec.
+      // TODO (danielashare): Remove this once proxy doesn't block on
+      // keyboardLayout.
+      if (options.screenSpec) {
+        this.sendClientScreenSpec(options.screenSpec);
+      }
     }
 
     let processingError: Error | undefined;
@@ -231,6 +247,7 @@ export class TdpClient extends EventEmitter<EventMap> {
 
     this.logger.info('Transport is closed');
 
+    this.sharedDirectory = undefined;
     this.transport = undefined;
   }
 
@@ -342,7 +359,7 @@ export class TdpClient extends EventEmitter<EventMap> {
         this.handleRdpConnectionActivated(buffer);
         break;
       case MessageType.RDP_FASTPATH_PDU:
-        this.handleRdpFastPathPDU(buffer);
+        this.handleRdpFastPathPdu(buffer);
         break;
       case MessageType.CLIENT_SCREEN_SPEC:
         this.handleClientScreenSpec(buffer);
@@ -484,8 +501,8 @@ export class TdpClient extends EventEmitter<EventMap> {
     this.emit(TdpClientEvent.TDP_CLIENT_SCREEN_SPEC, spec);
   }
 
-  handleRdpFastPathPDU(buffer: ArrayBufferLike) {
-    let rdpFastPathPDU = this.codec.decodeRdpFastPathPDU(buffer);
+  handleRdpFastPathPdu(buffer: ArrayBufferLike) {
+    let rdpFastPathPdu = this.codec.decodeRdpFastPathPdu(buffer);
 
     // This should never happen but let's catch it with an error in case it does.
     if (!this.fastPathProcessor) {
@@ -493,13 +510,13 @@ export class TdpClient extends EventEmitter<EventMap> {
     }
 
     this.fastPathProcessor.process(
-      rdpFastPathPDU,
+      rdpFastPathPdu,
       this,
       (bmpFrame: BitmapFrame) => {
         this.emit(TdpClientEvent.TDP_BMP_FRAME, bmpFrame);
       },
       (responseFrame: ArrayBuffer) => {
-        this.sendRdpResponsePDU(responseFrame);
+        this.sendRdpResponsePdu(responseFrame);
       },
       (data: ImageData | boolean, hotspot_x?: number, hotspot_y?: number) => {
         this.emit(TdpClientEvent.POINTER, { data, hotspot_x, hotspot_y });
@@ -525,28 +542,32 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   handleSharedDirectoryAcknowledge(buffer: ArrayBufferLike) {
     const ack = this.codec.decodeSharedDirectoryAcknowledge(buffer);
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
+
     if (ack.errCode !== SharedDirectoryErrCode.Nil) {
       // A failure in the acknowledge message means the directory
       // share operation failed (likely due to server side configuration).
       // Since this is not a fatal error, we emit a warning but otherwise
       // keep the sesion alive.
       this.handleWarning(
-        `Failed to share directory '${this.sharedDirectoryAccess.getDirectoryName()}', drive redirection may be disabled on the RDP server.`,
+        `Failed to share directory '${sharedDirectory.getDirectoryName()}', drive redirection may be disabled on the RDP server.`,
         TdpClientEvent.TDP_WARNING
       );
       return;
     }
 
     this.logger.info(
-      `Started sharing directory: ${this.sharedDirectoryAccess.getDirectoryName()}`
+      `Started sharing directory: ${sharedDirectory.getDirectoryName()}`
     );
   }
 
   async handleSharedDirectoryInfoRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryInfoRequest(buffer);
     const path = req.path;
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
+
     try {
-      const info = await this.sharedDirectoryAccess.stat(path);
+      const info = await sharedDirectory.stat(path);
       this.sendSharedDirectoryInfoResponse({
         completionId: req.completionId,
         errCode: SharedDirectoryErrCode.Nil,
@@ -573,10 +594,11 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   async handleSharedDirectoryCreateRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryCreateRequest(buffer);
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
 
     try {
-      await this.sharedDirectoryAccess.create(req.path, req.fileType);
-      const info = await this.sharedDirectoryAccess.stat(req.path);
+      await sharedDirectory.create(req.path, req.fileType);
+      const info = await sharedDirectory.stat(req.path);
       this.sendSharedDirectoryCreateResponse({
         completionId: req.completionId,
         errCode: SharedDirectoryErrCode.Nil,
@@ -600,9 +622,10 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   async handleSharedDirectoryDeleteRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryDeleteRequest(buffer);
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
 
     try {
-      await this.sharedDirectoryAccess.delete(req.path);
+      await sharedDirectory.delete(req.path);
       this.sendSharedDirectoryDeleteResponse({
         completionId: req.completionId,
         errCode: SharedDirectoryErrCode.Nil,
@@ -618,7 +641,9 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   async handleSharedDirectoryReadRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryReadRequest(buffer);
-    const readData = await this.sharedDirectoryAccess.read(
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
+
+    const readData = await sharedDirectory.read(
       req.path,
       req.offset,
       req.length
@@ -633,7 +658,9 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   async handleSharedDirectoryWriteRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryWriteRequest(buffer);
-    const bytesWritten = await this.sharedDirectoryAccess.write(
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
+
+    const bytesWritten = await sharedDirectory.write(
       req.path,
       req.offset,
       req.writeData
@@ -663,10 +690,10 @@ export class TdpClient extends EventEmitter<EventMap> {
   async handleSharedDirectoryListRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryListRequest(buffer);
     const path = req.path;
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
 
-    const infoList: FileOrDirInfo[] =
-      await this.sharedDirectoryAccess.readDir(path);
-    const fsoList: FileSystemObject[] = infoList.map(info => this.toFso(info));
+    const infoList = await sharedDirectory.readDir(path);
+    const fsoList = infoList.map(info => this.toFso(info));
 
     this.sendSharedDirectoryListResponse({
       completionId: req.completionId,
@@ -677,7 +704,9 @@ export class TdpClient extends EventEmitter<EventMap> {
 
   async handleSharedDirectoryTruncateRequest(buffer: ArrayBufferLike) {
     const req = this.codec.decodeSharedDirectoryTruncateRequest(buffer);
-    await this.sharedDirectoryAccess.truncate(req.path, req.endOfFile);
+    const sharedDirectory = this.getSharedDirectoryOrThrow();
+
+    await sharedDirectory.truncate(req.path, req.endOfFile);
     this.sendSharedDirectoryTruncateResponse({
       completionId: req.completionId,
       errCode: SharedDirectoryErrCode.Nil,
@@ -766,12 +795,15 @@ export class TdpClient extends EventEmitter<EventMap> {
   }
 
   async shareDirectory() {
-    await this.sharedDirectoryAccess.selectDirectory();
+    if (this.sharedDirectory) {
+      throw new Error('Only one shared directory is allowed at a time.');
+    }
+    this.sharedDirectory = await this.selectSharedDirectory();
     this.sendSharedDirectoryAnnounce();
   }
 
   sendSharedDirectoryAnnounce() {
-    const name = this.sharedDirectoryAccess.getDirectoryName();
+    const name = this.sharedDirectory.getDirectoryName();
     this.send(
       this.codec.encodeSharedDirectoryAnnounce({
         discard: 0, // This is always the first request.
@@ -821,8 +853,8 @@ export class TdpClient extends EventEmitter<EventMap> {
     this.sendClientScreenSpec(spec);
   };
 
-  sendRdpResponsePDU(responseFrame: ArrayBufferLike) {
-    this.send(this.codec.encodeRdpResponsePDU(responseFrame));
+  sendRdpResponsePdu(responseFrame: ArrayBufferLike) {
+    this.send(this.codec.encodeRdpResponsePdu(responseFrame));
   }
 
   // Emits a warning event, but keeps the socket open.
@@ -839,6 +871,13 @@ export class TdpClient extends EventEmitter<EventMap> {
     this.emit(TdpClientEvent.TDP_INFO, info);
   }
 
+  private getSharedDirectoryOrThrow() {
+    if (!this.sharedDirectory) {
+      throw new Error('No shared directory has been initialized.');
+    }
+    return this.sharedDirectory;
+  }
+
   // It's safe to call this multiple times, calls subsequent to the first call
   // will simply do nothing.
   shutdown() {
diff --git a/web/packages/shared/libs/tdp/codec.ts b/web/packages/shared/libs/tdp/codec.ts
index 7c38e12541e5d..75eb8061e8b4f 100644
--- a/web/packages/shared/libs/tdp/codec.ts
+++ b/web/packages/shared/libs/tdp/codec.ts
@@ -745,7 +745,7 @@ export default class Codec {
   }
 
   // | message type (30) | data_length uint32 | data []byte |
-  encodeRdpResponsePDU(responseFrame: ArrayBufferLike): Message {
+  encodeRdpResponsePdu(responseFrame: ArrayBufferLike): Message {
     const bufLen = BYTE_LEN + UINT_32_LEN + responseFrame.byteLength;
     const buffer = new ArrayBuffer(bufLen);
     const view = new DataView(buffer);
@@ -894,7 +894,7 @@ export default class Codec {
   }
 
   // | message type (29) | data_length uint32 | data []byte |
-  decodeRdpFastPathPDU(buffer: ArrayBufferLike): RdpFastPathPdu {
+  decodeRdpFastPathPdu(buffer: ArrayBufferLike): RdpFastPathPdu {
     const dv = new DataView(buffer);
     let offset = 0;
     offset += BYTE_LEN; // eat message type
diff --git a/web/packages/shared/libs/tdp/sharedDirectoryAccess.ts b/web/packages/shared/libs/tdp/sharedDirectoryAccess.ts
index 7cd8862448f3d..62be4f29a4549 100644
--- a/web/packages/shared/libs/tdp/sharedDirectoryAccess.ts
+++ b/web/packages/shared/libs/tdp/sharedDirectoryAccess.ts
@@ -19,8 +19,6 @@
 import { FileType } from './codec';
 
 export interface SharedDirectoryAccess {
-  /** Prompts the user to select a directory to share. */
-  selectDirectory(): Promise<void>;
   /** Returns the name of the currently shared directory. */
   getDirectoryName(): string;
   /** Retrieves metadata about a file or directory at the given path. */
@@ -39,59 +37,46 @@ export interface SharedDirectoryAccess {
   delete(path: string): Promise<void>;
 }
 
+/**
+ * Opens a directory picker and returns an interface for interacting with the selected directory.
+ */
+export async function selectDirectoryInBrowser(): Promise<BrowserFileSystem> {
+  if (typeof window.showDirectoryPicker !== 'function') {
+    // This is a gross error message, but should be infrequent enough that its worth just telling
+    // the user the likely problem, while also displaying the error message just in case that's not it.
+    // In a perfect world, we could check for which error message this is and display
+    // context appropriate directions.
+    throw new Error(
+      'Your user role supports directory sharing over desktop access, \
+however this feature is only available by default on some Chromium \
+based browsers like Google Chrome or Microsoft Edge. Brave users can \
+use the feature by navigating to brave://flags/#file-system-access-api \
+and selecting "Enable". If you\'re not already, please switch to a supported browser.'
+    );
+  }
+
+  const sharedDirectory = await window.showDirectoryPicker();
+  return new BrowserFileSystem(sharedDirectory);
+}
+
 /**
  * Enables directory sharing using FileSystem API.
  * Most of the methods can potentially throw errors and so should be wrapped in try/catch blocks.
  * Should be kept in sync with lib/teleterm/services/desktop/directorysharing.go
  * where file system events are handled for Connect.
  */
-export class BrowserFileSystem implements SharedDirectoryAccess {
-  private dir: FileSystemDirectoryHandle | undefined;
+class BrowserFileSystem implements SharedDirectoryAccess {
+  constructor(private dir: FileSystemDirectoryHandle) {}
 
-  /**
-   * Opens a directory.
-   * @throws Will throw an error if a directory is already being shared.
-   */
-  async selectDirectory() {
-    if (typeof window.showDirectoryPicker !== 'function') {
-      // This is a gross error message, but should be infrequent enough that its worth just telling
-      // the user the likely problem, while also displaying the error message just in case that's not it.
-      // In a perfect world, we could check for which error message this is and display
-      // context appropriate directions.
-      throw new Error(
-        'Your user role supports directory sharing over desktop access, \
-  however this feature is only available by default on some Chromium \
-  based browsers like Google Chrome or Microsoft Edge. Brave users can \
-  use the feature by navigating to brave://flags/#file-system-access-api \
-  and selecting "Enable". If you\'re not already, please switch to a supported browser.'
-      );
-    }
-
-    const sharedDirectory = await window.showDirectoryPicker();
-    if (this.dir) {
-      throw new Error(
-        'SharedDirectoryManager currently only supports sharing a single directory'
-      );
-    }
-    this.dir = sharedDirectory;
-  }
-
-  /**
-   * @throws Will throw an error if a directory has not already been initialized.
-   */
   getDirectoryName(): string {
-    this.checkReady();
     return this.dir.name;
   }
 
   /**
    * Gets the information for the file or directory at path where path is the relative path from the root directory.
-   * @throws Will throw an error if a directory has not already been initialized.
-   * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
+   * @throws {PathDoesNotExistError} if the path isn't a valid path in the shared directory
    */
   async stat(path: string): Promise<FileOrDirInfo> {
-    this.checkReady();
-
     const fileOrDir = await this.walkPath(path);
 
     let isEmpty = true;
@@ -129,12 +114,9 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
   /**
    * Gets the FileOrDirInfo for all the children of the directory at path.
-   * @throws Will throw an error if a directory has not already been initialized.
-   * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
+   * @throws {PathDoesNotExistError} if the path isn't a valid path in the shared directory
    */
   async readDir(path: string): Promise<FileOrDirInfo[]> {
-    this.checkReady();
-
     // Get the directory whose contents we want to list.
     const dir = await this.walkPath(path);
     if (dir.kind !== 'directory') {
@@ -158,15 +140,13 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
   /**
    * Reads length bytes starting at offset from a file at path.
-   * @throws Will throw an error if a directory has not already been initialized.
-   * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
+   * @throws {PathDoesNotExistError} if the path isn't a valid path in the shared directory
    */
   async read(
     path: string,
     offset: bigint,
     length: number
   ): Promise<Uint8Array> {
-    this.checkReady();
     const fileHandle = await this.getFileHandle(path);
     const file = await fileHandle.getFile();
     return new Uint8Array(
@@ -176,12 +156,9 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
   /**
    * Writes the bytes in writeData to the file at path starting at offset.
-   * @throws Will throw an error if a directory has not already been initialized.
    * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
    */
   async write(path: string, offset: bigint, data: Uint8Array): Promise<number> {
-    this.checkReady();
-
     const fileHandle = await this.getFileHandle(path);
     const file = await fileHandle.createWritable({ keepExistingData: true });
     await file.write({ type: 'write', position: Number(offset), data });
@@ -192,11 +169,9 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
   /**
    * Truncates the file at path to size bytes.
-   * @throws Will throw an error if a directory has not already been initialized.
-   * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
+   * @throws {PathDoesNotExistError} if the path isn't a valid path in the shared directory
    */
   async truncate(path: string, size: number): Promise<void> {
-    this.checkReady();
     const fileHandle = await this.getFileHandle(path);
     const file = await fileHandle.createWritable({ keepExistingData: true });
     await file.truncate(size);
@@ -238,8 +213,8 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
   /**
    * Returns the FileSystemFileHandle for the file at path.
-   * @throws {PathDoesNotExistError} if the pathstr isn't a valid path in the shared directory
-   * @throws {Error} if the pathstr points to a directory
+   * @throws {PathDoesNotExistError} if the path isn't a valid path in the shared directory
+   * @throws {Error} if the path points to a directory
    */
   private async getFileHandle(pathstr: string): Promise<FileSystemFileHandle> {
     const fileHandle = await this.walkPath(pathstr);
@@ -310,17 +285,6 @@ export class BrowserFileSystem implements SharedDirectoryAccess {
 
     return walkIt(this.dir, path);
   }
-
-  /**
-   * @throws Will throw an error if a directory has not already been initialized.
-   */
-  private checkReady() {
-    if (!this.dir) {
-      throw new Error(
-        'attempted to use a shared directory before one was initialized'
-      );
-    }
-  }
 }
 
 export class PathDoesNotExistError extends Error {
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index f1c1090de2afc..eb5082a1da4ff 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,13 +10,17 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && RUST_MIN_STACK=16777216 wasm-pack build ./libs/ironrdp --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && make -C ../../../ build-ironrdp-wasm"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",
     "@xterm/addon-search": "^0.15.0",
     "ace-builds": "1.41.0",
     "events": "3.3.0",
-    "highlight-words-core": "^1.2.3"
+    "highlight-words-core": "^1.2.3",
+    "semver": "^7.7.2"
+  },
+  "devDependencies": {
+    "@types/semver": "^7.7.0"
   }
 }
diff --git a/web/packages/shared/services/accessRequests/accessRequests.ts b/web/packages/shared/services/accessRequests/accessRequests.ts
index 974a2a46cf9af..abe72c9d127c9 100644
--- a/web/packages/shared/services/accessRequests/accessRequests.ts
+++ b/web/packages/shared/services/accessRequests/accessRequests.ts
@@ -27,6 +27,39 @@ export type RequestState =
   | 'PROMOTED'
   | '';
 
+export enum RequestKind {
+  Undefined = 0,
+  ShortTerm = 1,
+  LongTerm = 2,
+}
+
+/**
+ * LongTermResourceGrouping contains information about how resources can be grouped
+ * for long-term Access Requests.
+ */
+export interface LongTermResourceGrouping {
+  /**
+   * canProceed represents the validity of the long-term request. If all requested
+   * resources cannot be grouped together, this will be false.
+   */
+  canProceed: boolean;
+  /**
+   * validationMessage is a user-friendly message explaining any grouping error if `canProceed` is false
+   */
+  validationMessage?: string;
+  /**
+   * recommendedAccessList is the name of the Access List that would provide
+   * access to the most resources. If multiple Access Lists provide the same
+   * number of resources, the first one found will be used.
+   */
+  recommendedAccessList?: string;
+  /**
+   * accessListToResources maps applicable Access List names to the resources they can grant,
+   * including the optimal grouping.
+   */
+  accessListToResources: { [key: string]: ResourceId[] };
+}
+
 export interface AccessRequest {
   id: string;
   state: RequestState;
@@ -53,6 +86,8 @@ export interface AccessRequest {
   assumeStartTimeDuration?: string;
   reasonMode: string;
   reasonPrompts: string[];
+  requestKind?: RequestKind;
+  longTermResourceGrouping?: LongTermResourceGrouping;
 }
 
 export interface AccessRequestReview {
diff --git a/web/packages/shared/services/accessRequests/makeAccessRequest.ts b/web/packages/shared/services/accessRequests/makeAccessRequest.ts
index a29fe0753c42b..e7716259c46b5 100644
--- a/web/packages/shared/services/accessRequests/makeAccessRequest.ts
+++ b/web/packages/shared/services/accessRequests/makeAccessRequest.ts
@@ -22,6 +22,7 @@ import {
   AccessRequest,
   AccessRequestReview,
   AccessRequestReviewer,
+  RequestKind,
 } from './accessRequests';
 
 // TODO(gzdunek): This function should live in the Web UI.
@@ -72,9 +73,22 @@ export function makeAccessRequest(json?): AccessRequest {
     assumeStartTimeDuration: getAssumeStartDurationText(json.assumeStartTime),
     reasonMode: json.reasonMode || 'optional',
     reasonPrompts: json.reasonPrompts || [],
+    requestKind: getRequestKind(json.requestKind),
+    longTermResourceGrouping: json.longTermResourceGrouping,
   };
 }
 
+function getRequestKind(jsonKind: unknown): RequestKind {
+  if (typeof jsonKind !== 'number') {
+    return RequestKind.Undefined;
+  }
+  return jsonKind === RequestKind.LongTerm
+    ? RequestKind.LongTerm
+    : jsonKind === RequestKind.ShortTerm
+      ? RequestKind.ShortTerm
+      : RequestKind.Undefined;
+}
+
 function makeReviews(jsonReviews): AccessRequestReview[] {
   jsonReviews = jsonReviews || [];
 
diff --git a/web/packages/shared/services/apps.test.ts b/web/packages/shared/services/apps.test.ts
new file mode 100644
index 0000000000000..cfd65e101a704
--- /dev/null
+++ b/web/packages/shared/services/apps.test.ts
@@ -0,0 +1,50 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { getAppProtocol, getAppUriScheme } from './apps';
+import type { AppProtocol } from './types';
+
+describe('getAppProtocol', () => {
+  test.each<[string, AppProtocol]>([
+    // TCP
+    ['tcp://localhost:8080', 'TCP'],
+
+    // MCP
+    ['mcp+stdio://', 'MCP'],
+    ['mcp+http://example.com/mcp', 'MCP'],
+    ['mcp+sse+https://example.com/sse', 'MCP'],
+
+    // HTTP (fallback/default)
+    ['http://localhost:8080', 'HTTP'],
+    ['https://localhost:8080', 'HTTP'],
+    ['cloud://AWS', 'HTTP'],
+  ])('%s is %s', (uri, expected) => {
+    expect(getAppProtocol(uri)).toBe(expected);
+  });
+});
+
+describe('getAppUriScheme', () => {
+  test.each<[string, string]>([
+    ['tcp://localhost:8080', 'tcp'],
+    ['https://localhost:8080', 'https'],
+    ['mcp+http://example.com/mcp', 'mcp+http'],
+    ['', ''],
+  ])('scheme from %s is %s', (uri, expected) => {
+    expect(getAppUriScheme(uri)).toBe(expected);
+  });
+});
diff --git a/web/packages/shared/services/apps.ts b/web/packages/shared/services/apps.ts
index 75b4cdd465f3c..3c5570b3719be 100644
--- a/web/packages/shared/services/apps.ts
+++ b/web/packages/shared/services/apps.ts
@@ -15,6 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
+import { AppProtocol } from 'shared/services/types';
 
 export type AwsRole = {
   name: string;
@@ -22,3 +23,25 @@ export type AwsRole = {
   display: string;
   accountId: string;
 };
+
+/**
+ * getAppProtocol returns the protocol of the application. Equivalent to
+ * types.Application.GetProtocol.
+ */
+export function getAppProtocol(appURI: string): AppProtocol {
+  if (appURI.startsWith('tcp://')) {
+    return 'TCP';
+  }
+  if (appURI.startsWith('mcp+')) {
+    return 'MCP';
+  }
+  return 'HTTP';
+}
+
+/**
+ * getAppUriScheme extracts the scheme from the app URI.
+ */
+export function getAppUriScheme(appURI: string): string {
+  const sepIdx = appURI.indexOf('://');
+  return sepIdx > 0 ? appURI.slice(0, sepIdx) : '';
+}
diff --git a/web/packages/shared/services/databases/databases.ts b/web/packages/shared/services/databases/databases.ts
index 02147ddd3eed3..6c680d62e97bf 100644
--- a/web/packages/shared/services/databases/databases.ts
+++ b/web/packages/shared/services/databases/databases.ts
@@ -25,6 +25,7 @@ export type DbType =
   | 'gcp'
   | 'azure'
   | 'elasticache'
+  | 'elasticache-serverless'
   | 'memorydb'
   | 'keyspace'
   | 'cassandra'
@@ -100,6 +101,9 @@ export const formatDatabaseInfo = (type: DbType, protocol: DbProtocol) => {
     case 'elasticache':
       output.title = 'Amazon ElastiCache';
       return output;
+    case 'elasticache-serverless':
+      output.title = 'Amazon ElastiCache Serverless';
+      return output;
     case 'memorydb':
       output.title = 'Amazon MemoryDB';
       return output;
@@ -131,3 +135,32 @@ export const formatDatabaseInfo = (type: DbType, protocol: DbProtocol) => {
 };
 
 export type DatabaseInfo = ReturnType<typeof formatDatabaseInfo>;
+
+export type DbNameRequirement = 'unsupported' | 'optional' | 'required';
+
+const dbNameRequirementsByProtocol: Record<DbProtocol, DbNameRequirement> = {
+  mongodb: 'required',
+  oracle: 'required',
+  postgres: 'required',
+  spanner: 'required',
+  sqlserver: 'required',
+
+  cassandra: 'unsupported',
+  clickhouse: 'unsupported',
+  'clickhouse-http': 'unsupported',
+  dynamodb: 'unsupported',
+  elasticsearch: 'unsupported',
+  opensearch: 'unsupported',
+  redis: 'unsupported',
+
+  cockroachdb: 'optional',
+  mysql: 'optional',
+  snowflake: 'optional',
+};
+
+export const getDbNameRequirement = (
+  protocol: DbProtocol
+): DbNameRequirement => {
+  // default to 'optional'
+  return dbNameRequirementsByProtocol[protocol] ?? 'optional';
+};
diff --git a/web/packages/shared/services/mcp/client.test.ts b/web/packages/shared/services/mcp/client.test.ts
new file mode 100644
index 0000000000000..37acf47acd830
--- /dev/null
+++ b/web/packages/shared/services/mcp/client.test.ts
@@ -0,0 +1,55 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  generateClaudeDesktopConfigForApp,
+  generateInstallLinksForApp,
+} from 'shared/services/mcp/client';
+
+describe('generateClaudeDesktopConfigForApp', () => {
+  it('generates the correct config JSON', () => {
+    const outputJSON = generateClaudeDesktopConfigForApp('demo-test');
+
+    expect(outputJSON).toBe(`{
+  "mcpServers": {
+    "teleport-mcp-demo-test": {
+      "command": "tsh",
+      "args": [
+        "mcp",
+        "connect",
+        "demo-test"
+      ]
+    }
+  }
+}`);
+  });
+});
+
+describe('generateInstallLinksForApp', () => {
+  it('generates the correct links', () => {
+    const links = generateInstallLinksForApp('demo-test');
+    expect(links).toEqual({
+      cursor:
+        'cursor://anysphere.cursor-deeplink/mcp/install?name=teleport-mcp-demo-test&config=eyJjb21tYW5kIjoidHNoIiwiYXJncyI6WyJtY3AiLCJjb25uZWN0IiwiZGVtby10ZXN0Il19',
+      vscode:
+        'vscode:mcp/install?%7B%22name%22%3A%22teleport-mcp-demo-test%22%2C%22command%22%3A%22tsh%22%2C%22args%22%3A%5B%22mcp%22%2C%22connect%22%2C%22demo-test%22%5D%7D',
+      vscodeInsiders:
+        'vscode-insiders:mcp/install?%7B%22name%22%3A%22teleport-mcp-demo-test%22%2C%22command%22%3A%22tsh%22%2C%22args%22%3A%5B%22mcp%22%2C%22connect%22%2C%22demo-test%22%5D%7D',
+    });
+  });
+});
diff --git a/web/packages/shared/services/mcp/client.ts b/web/packages/shared/services/mcp/client.ts
new file mode 100644
index 0000000000000..5023040353202
--- /dev/null
+++ b/web/packages/shared/services/mcp/client.ts
@@ -0,0 +1,83 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export type MCPServerConfig = {
+  command: string;
+  args: string[];
+};
+
+function mcpServerNameForApp(appName: string): string {
+  return `teleport-mcp-${appName}`;
+}
+
+function mcpServerConfigForApp(appName: string): MCPServerConfig {
+  return {
+    // TODO(greedy52) we might need different command path and TELEPORT_HOME
+    // env var for Teleport Connect.
+    command: 'tsh',
+    args: ['mcp', 'connect', appName],
+  };
+}
+
+/**
+ * generateClaudeDesktopConfigForApp generates a prettified JSON config with
+ * details to launch the MCP server app with tsh in Claude Desktop format.
+ */
+export function generateClaudeDesktopConfigForApp(appName: string): string {
+  const claudeConfig = {
+    mcpServers: {
+      [mcpServerNameForApp(appName)]: mcpServerConfigForApp(appName),
+    },
+  };
+  return JSON.stringify(claudeConfig, null, 2);
+}
+
+export type InstallLinks = {
+  cursor: string;
+  vscode: string;
+  vscodeInsiders: string;
+};
+
+/**
+ * generateInstallLinksForApp generates links that can be used to install the MCP
+ * server app (that runs via tsh) for various MCP clients like cursor.
+ */
+export function generateInstallLinksForApp(appName: string): InstallLinks {
+  const name = mcpServerNameForApp(appName);
+  const config = mcpServerConfigForApp(appName);
+
+  // Cursor Deeplink
+  // https://docs.cursor.com/tools/developers
+  const cursorLink = new URL('cursor://anysphere.cursor-deeplink/mcp/install');
+  cursorLink.searchParams.set('name', name);
+  cursorLink.searchParams.set('config', btoa(JSON.stringify(config)));
+
+  // VSCode
+  // https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_url-handler
+  const vscodeEncodedConfig = encodeURIComponent(
+    JSON.stringify({
+      name,
+      ...config,
+    })
+  );
+  return {
+    cursor: cursorLink.toString(),
+    vscode: `vscode:mcp/install?${vscodeEncodedConfig}`,
+    vscodeInsiders: `vscode-insiders:mcp/install?${vscodeEncodedConfig}`,
+  };
+}
diff --git a/web/packages/shared/services/mcp/index.ts b/web/packages/shared/services/mcp/index.ts
new file mode 100644
index 0000000000000..750222783cd30
--- /dev/null
+++ b/web/packages/shared/services/mcp/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './client';
diff --git a/web/packages/shared/services/types.ts b/web/packages/shared/services/types.ts
index a9989ffa30dd2..7879c56789902 100644
--- a/web/packages/shared/services/types.ts
+++ b/web/packages/shared/services/types.ts
@@ -56,3 +56,14 @@ export type AuthProvider = {
 
 /** Values are taken from https://github.com/gravitational/teleport/blob/0460786b4c3afced1350dd9362ce761806e1c99d/api/types/constants.go#L140-L154 */
 export type NodeSubKind = 'teleport' | 'openssh' | 'openssh-ec2-ice';
+
+/** AppSubKind defines names of SubKind for App resource. */
+export enum AppSubKind {
+  AwsIcAccount = 'aws_ic_account',
+  MCP = 'mcp',
+}
+
+/**
+ * AppProtocol defines the protocol of an App resource.
+ */
+export type AppProtocol = 'TCP' | 'HTTP' | 'MCP';
diff --git a/web/packages/shared/utils/componentFeatures.ts b/web/packages/shared/utils/componentFeatures.ts
new file mode 100644
index 0000000000000..80bdca62b3fe6
--- /dev/null
+++ b/web/packages/shared/utils/componentFeatures.ts
@@ -0,0 +1,33 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * ComponentFeatureID is an identifier for a specific feature supported
+ * by a Teleport component.
+ */
+export enum ComponentFeatureID {
+  /**
+   * Unspecified is the unspecified feature ID.
+   */
+  Unspecified = 0,
+  /**
+   * ResourceConstraintsV1 indicates support for Resource Constraints in
+   * Access Requests, identity certificates, and AWS Console App resources.
+   */
+  ResourceConstraintsV1 = 1,
+}
diff --git a/web/packages/shared/utils/error.ts b/web/packages/shared/utils/error.ts
index c006cbab0bad5..fa28612a64993 100644
--- a/web/packages/shared/utils/error.ts
+++ b/web/packages/shared/utils/error.ts
@@ -69,6 +69,17 @@ export function isAbortError(err: any): boolean {
     return true;
   }
 
-  // handles Connect abort error (specifically gRPC cancel error), see TshdRpcError
+  // handles error that went through Electron IPC (it contains only a message)
+  if (getErrorMessage(err).includes('AbortError:')) {
+    return true;
+  }
+
+  // handles gRPC cancel error (see TshdRpcError)
   return err?.code === 'CANCELLED';
 }
+
+export class AbortError extends DOMException {
+  constructor(message = 'The operation was aborted.') {
+    super(message, 'AbortError');
+  }
+}
diff --git a/web/packages/shared/utils/highbar.test.ts b/web/packages/shared/utils/highbar.test.ts
index b65e6804364d9..c0abc95529c9d 100644
--- a/web/packages/shared/utils/highbar.test.ts
+++ b/web/packages/shared/utils/highbar.test.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { arrayObjectIsEqual, equalsDeep, mergeDeep } from './highbar';
+import { arrayObjectIsEqual, equalsDeep, mergeDeep, runOnce } from './highbar';
 
 describe('mergeDeep can merge two', () => {
   it('objects together', () => {
@@ -368,3 +368,29 @@ describe('equalsDeep', () => {
     ).toBe(false);
   });
 });
+
+test('runOnce only runs once and preserves "this"', () => {
+  class Class {
+    private value: symbol;
+
+    update = runOnce(function (this: Class) {
+      const value = Symbol();
+      // Store the value to make sure 'this' is passed correctly through runOnce,
+      // even when used in that complex way.
+      this.value = value;
+      return value;
+    });
+  }
+
+  const c = new Class();
+
+  // First call updates the value (and doesn't throw because of 'this' being undefined).
+  let firstReturnValue: symbol;
+  expect(() => {
+    firstReturnValue = c.update();
+  }).not.toThrow();
+
+  // Subsequent calls return the same value.
+  const secondReturnValue = c.update();
+  expect(secondReturnValue).toBe(firstReturnValue);
+});
diff --git a/web/packages/shared/utils/highbar.ts b/web/packages/shared/utils/highbar.ts
index f4f4adb867f37..3c483cf1b6a02 100644
--- a/web/packages/shared/utils/highbar.ts
+++ b/web/packages/shared/utils/highbar.ts
@@ -133,22 +133,18 @@ export function isObject(checkVal: unknown): checkVal is object {
   return checkVal != null && (type == 'object' || type == 'function');
 }
 
-/**
- * Lodash <https://lodash.com/>
- * Copyright JS Foundation and other contributors <https://js.foundation/>
- * Released under MIT license <https://lodash.com/license>
- * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
- * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
- */
-export function runOnce<T extends (...args) => any>(func: T) {
-  let n = 2;
-  let result;
-  return function () {
-    if (--n > 0) {
-      // This implementation does not pass strictBindCallApply check.
-      result = func.apply(this, arguments as any);
-    }
-    if (n <= 1) {
+/** Runs the provided function only once. */
+export function runOnce<T extends (...args: any[]) => any>(func: T) {
+  let hasRun = false;
+  let result: ReturnType<T>;
+
+  // 'this' is a special TS parameter that is erased during compilation
+  // https://www.typescriptlang.org/docs/handbook/2/classes.html#this-parameters
+  return function (this: unknown, ...args: Parameters<T>) {
+    if (!hasRun) {
+      hasRun = true;
+      result = func.apply(this, args);
+      // Remove the reference, so it can be garbage-collected.
       func = undefined;
     }
     return result;
@@ -305,7 +301,7 @@ export function debounce<T extends (...args: any) => any>(
     return timerId === undefined ? result : trailingEdge(Date.now());
   }
 
-  function debounced() {
+  function debounced(this: unknown) {
     var time = Date.now(),
       isInvoking = shouldInvoke(time);
 
@@ -333,167 +329,3 @@ export function debounce<T extends (...args: any) => any>(
   debounced.flush = flush;
   return debounced;
 }
-
-interface MapCacheType {
-  delete(key: any): boolean;
-  get(key: any): any;
-  has(key: any): boolean;
-  set(key: any, value: any): this;
-  clear?: (() => void) | undefined;
-}
-
-type MemoizedFunction = {
-  cache: MapCacheType;
-};
-
-/**
- * Lodash <https://lodash.com/>
- * Copyright JS Foundation and other contributors <https://js.foundation/>
- * Released under MIT license <https://lodash.com/license>
- * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
- * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
- */
-export function memoize<T extends (...args: any) => any>(
-  func: T
-): T & MemoizedFunction {
-  const memoized = function () {
-    const args = arguments;
-    const key = args[0];
-    const cache = memoized.cache;
-
-    if (cache.has(key)) {
-      return cache.get(key);
-    }
-    // `as any` because the implementation does not pass strictBindCallApply check.
-    const result = func.apply(this, args as any);
-    memoized.cache = cache.set(key, result) || cache;
-    return result;
-  };
-  memoized.cache = new (memoize.Cache || MapCache)();
-  /* eslint-disable @typescript-eslint/ban-ts-comment*/
-  // @ts-ignore
-  return memoized;
-}
-
-// Expose `MapCache`.
-memoize.Cache = MapCache;
-
-function MapCache(entries?: any) {
-  let index = -1;
-  const length = entries == null ? 0 : entries.length;
-
-  this.clear();
-  while (++index < length) {
-    const entry = entries[index];
-    this.set(entry[0], entry[1]);
-  }
-}
-
-function mapCacheClear() {
-  this.size = 0;
-  this.__data__ = {
-    hash: new Hash(),
-    map: new Map(),
-    string: new Hash(),
-  };
-}
-
-function mapCacheDelete(key) {
-  var result = getMapData(this, key)['delete'](key);
-  this.size -= result ? 1 : 0;
-  return result;
-}
-
-function mapCacheGet(key) {
-  return getMapData(this, key).get(key);
-}
-
-function mapCacheHas(key) {
-  return getMapData(this, key).has(key);
-}
-
-function mapCacheSet(key, value) {
-  var data = getMapData(this, key),
-    size = data.size;
-
-  data.set(key, value);
-  this.size += data.size == size ? 0 : 1;
-  return this;
-}
-
-MapCache.prototype.clear = mapCacheClear;
-MapCache.prototype['delete'] = mapCacheDelete;
-MapCache.prototype.get = mapCacheGet;
-MapCache.prototype.has = mapCacheHas;
-MapCache.prototype.set = mapCacheSet;
-
-function Hash(entries?) {
-  var index = -1,
-    length = entries == null ? 0 : entries.length;
-
-  this.clear();
-  while (++index < length) {
-    var entry = entries[index];
-    this.set(entry[0], entry[1]);
-  }
-}
-
-const HASH_UNDEFINED = '__lodash_hash_undefined__';
-
-function hashClear() {
-  this.__data__ = Object.create ? Object.create(null) : {};
-  this.size = 0;
-}
-
-function hashDelete(key) {
-  var result = this.has(key) && delete this.__data__[key];
-  this.size -= result ? 1 : 0;
-  return result;
-}
-
-function hashGet(key) {
-  var data = this.__data__;
-  if (Object.create) {
-    var result = data[key];
-    return result === HASH_UNDEFINED ? undefined : result;
-  }
-  return Object.hasOwnProperty.call(data, key) ? data[key] : undefined;
-}
-
-function hashHas(key) {
-  var data = this.__data__;
-  return Object.create
-    ? data[key] !== undefined
-    : Object.hasOwnProperty.call(data, key);
-}
-
-function hashSet(key, value) {
-  var data = this.__data__;
-  this.size += this.has(key) ? 0 : 1;
-  data[key] = Object.create && value === undefined ? HASH_UNDEFINED : value;
-  return this;
-}
-
-// Add methods to `Hash`.
-Hash.prototype.clear = hashClear;
-Hash.prototype['delete'] = hashDelete;
-Hash.prototype.get = hashGet;
-Hash.prototype.has = hashHas;
-Hash.prototype.set = hashSet;
-
-function getMapData(map, key) {
-  var data = map.__data__;
-  return isKeyable(key)
-    ? data[typeof key == 'string' ? 'string' : 'hash']
-    : data.map;
-}
-
-function isKeyable(value) {
-  var type = typeof value;
-  return type == 'string' ||
-    type == 'number' ||
-    type == 'symbol' ||
-    type == 'boolean'
-    ? value !== '__proto__'
-    : value === null;
-}
diff --git a/web/packages/shared/utils/saveOnDisk.test.ts b/web/packages/shared/utils/saveOnDisk.test.ts
index 92d4e9d84ce82..947cf87bfc9bd 100644
--- a/web/packages/shared/utils/saveOnDisk.test.ts
+++ b/web/packages/shared/utils/saveOnDisk.test.ts
@@ -27,7 +27,6 @@ test('saveOnDisk', async () => {
   jest.spyOn(document.body, 'appendChild').mockImplementation();
   jest.spyOn(document.body, 'removeChild').mockImplementation();
   const blob = jest.spyOn(global, 'Blob').mockImplementation();
-  // eslint-disable-next-line jest/prefer-spy-on
   window.URL.createObjectURL = jest.fn();
 
   saveOnDisk('testcontent', 'testfile.txt', 'plain/text');
diff --git a/web/packages/shared/utils/semVer.test.ts b/web/packages/shared/utils/semVer.test.ts
deleted file mode 100644
index e215d41a9115f..0000000000000
--- a/web/packages/shared/utils/semVer.test.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { compareSemVers } from './semVer';
-
-test('compareSemVers', () => {
-  expect(['3.0.0', '1.0.0', '2.0.0'].sort(compareSemVers)).toEqual([
-    '1.0.0',
-    '2.0.0',
-    '3.0.0',
-  ]);
-
-  expect(['3.1.0', '3.2.0', '3.1.1'].sort(compareSemVers)).toEqual([
-    '3.1.0',
-    '3.1.1',
-    '3.2.0',
-  ]);
-
-  expect(['10.0.1', '10.0.2', '2.0.0'].sort(compareSemVers)).toEqual([
-    '2.0.0',
-    '10.0.1',
-    '10.0.2',
-  ]);
-
-  expect(['10.1.0', '11.1.0', '5.10.10'].sort(compareSemVers)).toEqual([
-    '5.10.10',
-    '10.1.0',
-    '11.1.0',
-  ]);
-
-  expect(compareSemVers('1.0.0', '1.0.0')).toBe(0);
-});
diff --git a/web/packages/shared/utils/semVer.ts b/web/packages/shared/utils/semVer.ts
index bee92a73d7feb..1c4d94eb83f4f 100644
--- a/web/packages/shared/utils/semVer.ts
+++ b/web/packages/shared/utils/semVer.ts
@@ -16,31 +16,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-export const compareSemVers = (a: string, b: string): -1 | 1 | 0 => {
-  const splitA = a.split('.');
-  const splitB = b.split('.');
+import compare from 'semver/functions/compare';
+import major from 'semver/functions/major';
+import parse from 'semver/functions/parse';
 
-  if (splitA.length < 3 || splitB.length < 3) {
-    return -1;
-  }
+// Re-export specific functions from `semver/functions/*` to avoid bundling
+// the full semver package.
 
-  const majorA = parseInt(splitA[0]);
-  const majorB = parseInt(splitB[0]);
-  if (majorA !== majorB) {
-    return majorA > majorB ? 1 : -1;
-  }
-
-  const minorA = parseInt(splitA[1]);
-  const minorB = parseInt(splitB[1]);
-  if (minorA !== minorB) {
-    return minorA > minorB ? 1 : -1;
-  }
-
-  const patchA = parseInt(splitA[2].split('-')[0]);
-  const patchB = parseInt(splitB[2].split('-')[0]);
-  if (patchA !== patchB) {
-    return patchA > patchB ? 1 : -1;
-  }
-
-  return 0;
+export {
+  compare,
+  /** @deprecated Import `compare` from `shared/utils/semver`. */
+  compare as compareSemVers,
+  major,
+  parse,
 };
diff --git a/web/packages/teleport/README.md b/web/packages/teleport/README.md
index ccf9b31b3ee60..415d67b138486 100644
--- a/web/packages/teleport/README.md
+++ b/web/packages/teleport/README.md
@@ -5,11 +5,3 @@ This package contains the source code of Teleport Web UI.
 ## Development
 
 Follow the instructions from `web/README.md`.
-
-#### wasm-pack
-
-The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required to build the WebAssembly module.
-
-When calling `wasm-pack`, we set the environment variable `RUST_MIN_STACK=16777216`. This is necessary to avoid a `SIGSEGV` error when building the module on some systems.
-
-`16777216` was chosen based on [the suggestion in the rust compiler error message](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_driver_impl/src/signal_handler.rs#L104-L106) to double the [`DEFAULT_STACK_SIZE`](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_interface/src/util.rs#L52) value.
diff --git a/web/packages/teleport/index.html b/web/packages/teleport/index.html
index 34d6ce56782c2..917ff53c548cb 100644
--- a/web/packages/teleport/index.html
+++ b/web/packages/teleport/index.html
@@ -10,8 +10,15 @@
     <meta name="robots" content="noindex" />
     <link
       href="/app/favicon-light.png"
-      rel="icon" 
-      type="image/png" 
+      rel="icon"
+      type="image/png"
+      media="(prefers-color-scheme: light)"
+    />
+    <link
+      href="/app/favicon-dark.png"
+      rel="icon"
+      type="image/png"
+      media="(prefers-color-scheme: dark)"
     />
     <title></title>
   </head>
diff --git a/web/packages/teleport/package.json b/web/packages/teleport/package.json
index cdca122512f71..fa61c11c8b6ee 100644
--- a/web/packages/teleport/package.json
+++ b/web/packages/teleport/package.json
@@ -6,7 +6,10 @@
   "scripts": {
     "start": "pnpm build-wasm && vite",
     "build": "pnpm build-wasm && vite build",
-    "build-wasm": "pnpm --filter=@gravitational/shared build-wasm"
+    "build-wasm": "pnpm --filter=@gravitational/shared build-wasm",
+    "event-reference": "pnpm event-reference:build && pnpm event-reference:gen",
+    "event-reference:build": "vite --config ../build/vite/gen-event-reference-config.mts build",
+    "event-reference:gen": "node ./src/services/audit/gen-event-reference/dist/gen-event-reference.js ../../../docs/pages/reference/audit-events.mdx"
   },
   "author": "Gravitational, Inc.",
   "license": "Apache-2.0",
@@ -39,15 +42,13 @@
     "@xterm/addon-webgl": "^0.18.0",
     "@xterm/xterm": "^5.5.0",
     "create-react-class": "^15.6.3",
-    "events": "3.3.0",
-    "react-markdown": "^10.1.0"
+    "events": "3.3.0"
   },
   "devDependencies": {
     "@gravitational/build": "workspace:*",
     "@gravitational/teleport": "workspace:*",
     "babel-plugin-transform-import-meta": "2.2.1",
     "babel-plugin-transform-vite-meta-env": "^1.0.3",
-    "jest-canvas-mock": "^2.5.2",
     "jest-websocket-mock": "^2.5.0"
   }
 }
diff --git a/web/packages/teleport/src/Account/Account.story.tsx b/web/packages/teleport/src/Account/Account.story.tsx
index 4d364bc2d31f3..8f49d8447315c 100644
--- a/web/packages/teleport/src/Account/Account.story.tsx
+++ b/web/packages/teleport/src/Account/Account.story.tsx
@@ -19,7 +19,9 @@
 import { useEffect } from 'react';
 
 import cfg from 'teleport/config';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
 import { PasswordState } from 'teleport/services/user';
+import { UserContextProvider } from 'teleport/User';
 
 import { Account, AccountProps } from './Account';
 
@@ -36,7 +38,13 @@ export default {
           cfg.auth.second_factor = defaultSecondFactor;
         };
       }, []);
-      return <Story />;
+      return (
+        <TeleportProviderBasic initialEntries={['/web/account']}>
+          <UserContextProvider>
+            <Story />
+          </UserContextProvider>
+        </TeleportProviderBasic>
+      );
     },
   ],
 };
diff --git a/web/packages/teleport/src/Account/Account.tsx b/web/packages/teleport/src/Account/Account.tsx
index e07e5b6c3e87f..ba6cadb395da1 100644
--- a/web/packages/teleport/src/Account/Account.tsx
+++ b/web/packages/teleport/src/Account/Account.tsx
@@ -23,7 +23,7 @@ import styled from 'styled-components';
 import { Flex } from 'design';
 import { Danger } from 'design/Alert';
 import { ArrowBack } from 'design/Icon';
-import { NotificationSeverity } from 'shared/components/Notification';
+import { NotificationEntry } from 'shared/components/ToastNotification';
 import { useStore } from 'shared/libs/stores';
 
 import {
@@ -39,10 +39,6 @@ import useTeleport from 'teleport/useTeleport';
 import useManageDevices, {
   State as ManageDevicesState,
 } from './ManageDevices/useManageDevices';
-import {
-  NotificationOutlet,
-  NotificationProvider,
-} from './NotificationContext';
 import { Preferences } from './Preferences';
 import { SecuritySettings } from './SecuritySettings';
 import { SideNav } from './SideNav';
@@ -50,7 +46,7 @@ import { SideNav } from './SideNav';
 export interface EnterpriseComponentProps {
   // TODO(bl-nero): Consider moving the notifications to its own store and
   // unifying them between this screen and the unified resources screen.
-  addNotification: (severity: NotificationSeverity, content: string) => void;
+  addNotification: (entry: NotificationEntry) => void;
 }
 
 export interface AccountPageProps {
@@ -127,85 +123,75 @@ export function Account({
   }, []);
 
   return (
-    <NotificationProvider>
-      <Relative>
-        <FeatureBox margin="auto">
-          <FeatureHeader>
-            <ArrowBack
-              mr={2}
-              size="large"
-              color="text.main"
-              onClick={history.goBack}
-              style={{ cursor: 'pointer' }}
+    <Relative>
+      <FeatureBox margin="auto">
+        <FeatureHeader>
+          <ArrowBack
+            mr={2}
+            size="large"
+            color="text.main"
+            onClick={history.goBack}
+            style={{ cursor: 'pointer' }}
+          />
+          <FeatureHeaderTitle>Account Settings</FeatureHeaderTitle>
+        </FeatureHeader>
+        {!!errorMessage && (
+          <Danger dismissible onDismiss={() => setErrorMessage(null)}>
+            {errorMessage}
+          </Danger>
+        )}
+        <Flex flexDirection="row" gap={4} maxWidth={'1440px'} margin={'0 auto'}>
+          <Flex flexDirection="column" gap={1} width="16rem">
+            <SideNav
+              recoveryEnabled={EnterpriseComponent !== undefined}
+              trustedDevicesEnabled={TrustedDeviceListComponent !== undefined}
             />
-            <FeatureHeaderTitle>Account Settings</FeatureHeaderTitle>
-          </FeatureHeader>
-          {!!errorMessage && (
-            <Danger dismissible onDismiss={() => setErrorMessage(null)}>
-              {errorMessage}
-            </Danger>
-          )}
-          <Flex
-            flexDirection="row"
-            gap={4}
-            maxWidth={'1440px'}
-            margin={'0 auto'}
-          >
-            <Flex flexDirection="column" gap={1} width="16rem">
-              <SideNav
-                recoveryEnabled={EnterpriseComponent !== undefined}
-                trustedDevicesEnabled={TrustedDeviceListComponent !== undefined}
+          </Flex>
+          <Flex flexDirection="column" gap={4}>
+            <Switch>
+              <Route
+                exact
+                path={cfg.routes.account}
+                component={() => <Redirect to={cfg.routes.accountSecurity} />}
+              />
+              <Route
+                path={cfg.routes.accountSecurity}
+                component={() => (
+                  <SecuritySettings
+                    isSso={isSso}
+                    canAddPasskeys={canAddPasskeys}
+                    canAddMfa={canAddMfa}
+                    passwordState={passwordState}
+                    devices={devices}
+                    onAddDevice={onAddDevice}
+                    onRemoveDevice={onRemoveDevice}
+                    onDeviceAdded={onDeviceAdded}
+                    onDeviceRemoved={onDeviceRemoved}
+                    deviceToRemove={deviceToRemove}
+                    fetchDevicesAttempt={fetchDevicesAttempt}
+                    addDeviceWizardVisible={addDeviceWizardVisible}
+                    hideRemoveDevice={hideRemoveDevice}
+                    closeAddDeviceWizard={closeAddDeviceWizard}
+                    mfaDisabled={mfaDisabled}
+                    createRestrictedTokenAttempt={createRestrictedTokenAttempt}
+                    newDeviceUsage={newDeviceUsage}
+                    enterpriseComponent={EnterpriseComponent}
+                    userTrustedDevicesComponent={TrustedDeviceListComponent}
+                    onPasswordChange={onPasswordChangeCb}
+                  />
+                )}
+              />
+              <Route
+                path={cfg.routes.accountPreferences}
+                component={() => (
+                  <Preferences setErrorMessage={stableSetErrorMessage} />
+                )}
               />
-            </Flex>
-            <Flex flexDirection="column" gap={4}>
-              <Switch>
-                <Route
-                  exact
-                  path={cfg.routes.account}
-                  component={() => <Redirect to={cfg.routes.accountSecurity} />}
-                />
-                <Route
-                  path={cfg.routes.accountSecurity}
-                  component={() => (
-                    <SecuritySettings
-                      isSso={isSso}
-                      canAddPasskeys={canAddPasskeys}
-                      canAddMfa={canAddMfa}
-                      passwordState={passwordState}
-                      devices={devices}
-                      onAddDevice={onAddDevice}
-                      onRemoveDevice={onRemoveDevice}
-                      onDeviceAdded={onDeviceAdded}
-                      onDeviceRemoved={onDeviceRemoved}
-                      deviceToRemove={deviceToRemove}
-                      fetchDevicesAttempt={fetchDevicesAttempt}
-                      addDeviceWizardVisible={addDeviceWizardVisible}
-                      hideRemoveDevice={hideRemoveDevice}
-                      closeAddDeviceWizard={closeAddDeviceWizard}
-                      mfaDisabled={mfaDisabled}
-                      createRestrictedTokenAttempt={
-                        createRestrictedTokenAttempt
-                      }
-                      newDeviceUsage={newDeviceUsage}
-                      enterpriseComponent={EnterpriseComponent}
-                      userTrustedDevicesComponent={TrustedDeviceListComponent}
-                      onPasswordChange={onPasswordChangeCb}
-                    />
-                  )}
-                />
-                <Route
-                  path={cfg.routes.accountPreferences}
-                  component={() => (
-                    <Preferences setErrorMessage={stableSetErrorMessage} />
-                  )}
-                />
-              </Switch>
-            </Flex>
+            </Switch>
           </Flex>
-          <NotificationOutlet />
-        </FeatureBox>
-      </Relative>
-    </NotificationProvider>
+        </Flex>
+      </FeatureBox>
+    </Relative>
   );
 }
 
diff --git a/web/packages/teleport/src/Account/NotificationContext.tsx b/web/packages/teleport/src/Account/NotificationContext.tsx
deleted file mode 100644
index e70867f40ab86..0000000000000
--- a/web/packages/teleport/src/Account/NotificationContext.tsx
+++ /dev/null
@@ -1,131 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { createContext, useCallback, useContext, useState } from 'react';
-import styled from 'styled-components';
-
-import {
-  Notification,
-  NotificationItem,
-  NotificationItemContent,
-  NotificationSeverity,
-} from 'shared/components/Notification';
-
-interface NotificationContextType {
-  addNotification: (
-    severity: NotificationSeverity,
-    content: NotificationItemContent
-  ) => void;
-}
-
-// A context to be used by components that only need to add notifications and should
-// not re-render when notification state changes.
-const AddNotificationContext = createContext<
-  NotificationContextType | undefined
->(undefined);
-
-// Internal context for rendering notification component.
-interface NotificationContext extends NotificationContextType {
-  removeNotification: (id: string) => void;
-  notifications: NotificationItem[];
-}
-const NotificationContext = createContext<NotificationContext | undefined>(
-  undefined
-);
-
-export const useNotification = () => {
-  const context = useContext(AddNotificationContext);
-  if (!context) {
-    throw new Error(
-      'useNotification must be used within a NotificationProvider'
-    );
-  }
-  return context;
-};
-
-interface NotificationProviderProps {
-  children: React.ReactNode;
-}
-
-export const NotificationProvider = ({
-  children,
-}: NotificationProviderProps) => {
-  const [notifications, setNotifications] = useState<NotificationItem[]>([]);
-
-  const addNotification = useCallback(
-    (severity: NotificationSeverity, content: NotificationItemContent) => {
-      setNotifications(n => [
-        ...n,
-        {
-          id: crypto.randomUUID(),
-          severity,
-          content,
-        },
-      ]);
-    },
-    []
-  );
-
-  const removeNotification = useCallback((id: string) => {
-    setNotifications(n => n.filter(item => item.id !== id));
-  }, []);
-
-  return (
-    <NotificationContext.Provider
-      value={{ notifications, removeNotification, addNotification }}
-    >
-      <AddNotificationContext.Provider value={{ addNotification }}>
-        {children}
-      </AddNotificationContext.Provider>
-    </NotificationContext.Provider>
-  );
-};
-
-export const NotificationOutlet = () => {
-  const context = useContext(NotificationContext);
-  if (!context) {
-    throw new Error(
-      'NotificationOutlet must be used within a NotificationProvider'
-    );
-  }
-  const { notifications, removeNotification } = context;
-
-  if (!notifications.length) {
-    return null;
-  }
-
-  return (
-    <NotificationContainer>
-      {notifications.map(item => (
-        <Notification
-          mb={3}
-          key={item.id}
-          item={item}
-          onRemove={() => removeNotification(item.id)}
-        />
-      ))}
-    </NotificationContainer>
-  );
-};
-
-const NotificationContainer = styled.div`
-  position: absolute;
-  top: ${props => props.theme.space[2]}px;
-  right: ${props => props.theme.space[5]}px;
-  z-index: 1000;
-`;
diff --git a/web/packages/teleport/src/Account/Preferences.test.tsx b/web/packages/teleport/src/Account/Preferences.test.tsx
index e584edf392528..b5bfbf181409a 100644
--- a/web/packages/teleport/src/Account/Preferences.test.tsx
+++ b/web/packages/teleport/src/Account/Preferences.test.tsx
@@ -20,6 +20,10 @@ import * as styledComponents from 'styled-components';
 import { lightTheme } from 'design/theme';
 import { fireEvent, render, screen, waitFor } from 'design/utils/testing';
 import { Theme } from 'gen-proto-ts/teleport/userpreferences/v1/theme_pb';
+import {
+  ToastNotificationProvider,
+  useToastNotifications,
+} from 'shared/components/ToastNotification';
 
 import { createTeleportContext } from 'teleport/mocks/contexts';
 import TeleportContext from 'teleport/teleportContext';
@@ -27,23 +31,27 @@ import { makeTestUserContext } from 'teleport/User/testHelpers/makeTestUserConte
 import { mockUserContextProviderWith } from 'teleport/User/testHelpers/mockUserContextWith';
 
 import { ContextProvider } from '..';
-import { NotificationProvider, useNotification } from './NotificationContext';
 import { Preferences } from './Preferences';
 
-jest.mock('./NotificationContext', () => {
-  const originalContext = jest.requireActual('./NotificationContext');
-  return {
-    ...originalContext,
-    useNotification: jest.fn(),
-  };
-});
+jest.mock(
+  '../../../shared/components/ToastNotification/ToastNotificationContext',
+  () => {
+    const originalContext = jest.requireActual(
+      '../../../shared/components/ToastNotification/ToastNotificationContext'
+    );
+    return {
+      ...originalContext,
+      useToastNotifications: jest.fn(),
+    };
+  }
+);
 
 function renderComponent(ctx: TeleportContext, setErrorMessageFn = jest.fn()) {
   render(
     <ContextProvider ctx={ctx}>
-      <NotificationProvider>
+      <ToastNotificationProvider>
         <Preferences setErrorMessage={setErrorMessageFn} />
-      </NotificationProvider>
+      </ToastNotificationProvider>
     </ContextProvider>
   );
 }
@@ -60,8 +68,8 @@ describe('Account/Preferences', () => {
         return { success: true };
       });
 
-    (useNotification as jest.Mock).mockReturnValue({
-      addNotification: jest.fn(),
+    (useToastNotifications as jest.Mock).mockReturnValue({
+      add: jest.fn(),
     });
 
     mockUserContextProviderWith(userContext);
@@ -108,8 +116,8 @@ describe('Account/Preferences', () => {
     mockUserContextProviderWith(userContext);
 
     const addNotification = jest.fn();
-    (useNotification as jest.Mock).mockReturnValue({
-      addNotification,
+    (useToastNotifications as jest.Mock).mockReturnValue({
+      add: addNotification,
     });
 
     renderComponent(createTeleportContext());
@@ -132,9 +140,11 @@ describe('Account/Preferences', () => {
       );
     });
 
-    expect(addNotification).toHaveBeenCalledWith('success', {
-      title: 'Change saved',
-      isAutoRemovable: true,
+    expect(addNotification).toHaveBeenCalledWith({
+      severity: 'success',
+      content: {
+        title: 'Change saved',
+      },
     });
   });
 
diff --git a/web/packages/teleport/src/Account/Preferences.tsx b/web/packages/teleport/src/Account/Preferences.tsx
index 9e16a754fad01..a554ba02e5b83 100644
--- a/web/packages/teleport/src/Account/Preferences.tsx
+++ b/web/packages/teleport/src/Account/Preferences.tsx
@@ -27,12 +27,12 @@ import * as Icon from 'design/Icon';
 import { SingleRowBox } from 'design/MultiRowBox';
 import { Theme } from 'gen-proto-ts/teleport/userpreferences/v1/theme_pb';
 import Select from 'shared/components/Select';
+import { useToastNotifications } from 'shared/components/ToastNotification';
 import { useAsync } from 'shared/hooks/useAsync';
 
 import { useUser } from 'teleport/User/UserContext';
 
 import { Header } from './Header';
-import { useNotification } from './NotificationContext';
 import DarkThemeIcon from './ThemeImages/dark_theme.svg';
 import LightThemeIcon from './ThemeImages/light_theme.svg';
 import SystemThemeIcon from './ThemeImages/system_theme.svg';
@@ -221,7 +221,7 @@ export interface PreferencesProps {
 export function Preferences({ setErrorMessage }: PreferencesProps) {
   const { preferences, updatePreferences } = useUser();
   const theme = useTheme();
-  const { addNotification } = useNotification();
+  const toastNotification = useToastNotifications();
 
   const layout = preferences.keyboardLayout;
   const layoutValue =
@@ -333,9 +333,11 @@ export function Preferences({ setErrorMessage }: PreferencesProps) {
                     runUpdatePreference({
                       keyboardLayout: selected.value,
                     });
-                    addNotification('success', {
-                      title: 'Change saved',
-                      isAutoRemovable: true,
+                    toastNotification.add({
+                      severity: 'success',
+                      content: {
+                        title: 'Change saved',
+                      },
                     });
                   }}
                   isDisabled={updatePreferenceAttempt.status === 'processing'}
diff --git a/web/packages/teleport/src/Account/SecuritySettings.test.tsx b/web/packages/teleport/src/Account/SecuritySettings.test.tsx
index b1b4d38cdd8e2..a7cc49cff4008 100644
--- a/web/packages/teleport/src/Account/SecuritySettings.test.tsx
+++ b/web/packages/teleport/src/Account/SecuritySettings.test.tsx
@@ -20,6 +20,7 @@ import { within } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 
 import { render, screen, waitFor } from 'design/utils/testing';
+import { ToastNotificationProvider } from 'shared/components/ToastNotification';
 import { useStore } from 'shared/libs/stores';
 
 import { ContextProvider } from 'teleport';
@@ -32,7 +33,6 @@ import { PasswordState } from 'teleport/services/user';
 import TeleportContext from 'teleport/teleportContext';
 
 import useManageDevices from './ManageDevices/useManageDevices';
-import { NotificationProvider } from './NotificationContext';
 
 const defaultAuthType = cfg.auth.second_factor;
 const defaultPasswordless = cfg.auth.allowPasswordless;
@@ -56,7 +56,7 @@ function SecuritySettingsWrapper({ ctx }: { ctx: TeleportContext }) {
   }
 
   return (
-    <NotificationProvider>
+    <ToastNotificationProvider>
       <SecuritySettings
         isSso={isSso}
         canAddPasskeys={canAddPasskeys}
@@ -65,7 +65,7 @@ function SecuritySettingsWrapper({ ctx }: { ctx: TeleportContext }) {
         {...manageDevicesState}
         onPasswordChange={onPasswordChange}
       />
-    </NotificationProvider>
+    </ToastNotificationProvider>
   );
 }
 
diff --git a/web/packages/teleport/src/Account/SecuritySettings.tsx b/web/packages/teleport/src/Account/SecuritySettings.tsx
index b3453547dcb8e..3183b65362c19 100644
--- a/web/packages/teleport/src/Account/SecuritySettings.tsx
+++ b/web/packages/teleport/src/Account/SecuritySettings.tsx
@@ -20,6 +20,7 @@ import styled, { useTheme } from 'styled-components';
 
 import { Box, Flex, H2, Indicator, Subtitle2 } from 'design';
 import * as Icon from 'design/Icon';
+import { useToastNotifications } from 'shared/components/ToastNotification';
 import { Attempt } from 'shared/hooks/useAttemptNext';
 import { useStore } from 'shared/libs/stores';
 
@@ -34,7 +35,6 @@ import {
   AddAuthDeviceWizard,
   DeleteAuthDeviceWizard,
 } from './ManageDevices/wizards';
-import { useNotification } from './NotificationContext';
 import { PasswordBox } from './PasswordBox';
 import { Headings } from './SideNav';
 import { StatePill } from './StatePill';
@@ -81,7 +81,7 @@ export function SecuritySettings({
   passwordState,
   onPasswordChange: onPasswordChangeCb,
 }: SecuritySettingsProps) {
-  const { addNotification } = useNotification();
+  const toastNotification = useToastNotifications();
 
   const passkeys = devices.filter(d => d.usage === 'passwordless');
   const mfaDevices = devices.filter(d => d.usage === 'mfa');
@@ -99,14 +99,19 @@ export function SecuritySettings({
   if (prevFetchStatus !== fetchDevicesAttempt.status) {
     setPrevFetchStatus(fetchDevicesAttempt.status);
     if (fetchDevicesAttempt.status === 'failed') {
-      addNotification('error', fetchDevicesAttempt.statusText);
+      toastNotification.add({
+        severity: 'error',
+        content: fetchDevicesAttempt.statusText,
+      });
     }
   }
 
   function onPasswordChange() {
-    addNotification('info', {
-      title: 'Your password has been changed.',
-      isAutoRemovable: true,
+    toastNotification.add({
+      severity: 'info',
+      content: {
+        title: 'Your password has been changed.',
+      },
     });
     onPasswordChangeCb();
   }
@@ -116,7 +121,7 @@ export function SecuritySettings({
       newDeviceUsage === 'passwordless'
         ? 'Passkey successfully saved.'
         : 'MFA method successfully saved.';
-    addNotification('info', { title: message, isAutoRemovable: true });
+    toastNotification.add({ severity: 'info', content: { title: message } });
     onDeviceAdded();
   }
 
@@ -125,7 +130,10 @@ export function SecuritySettings({
       deviceToRemove.usage === 'passwordless'
         ? 'Passkey successfully deleted.'
         : 'MFA method successfully deleted.';
-    addNotification('info', { title: message, isAutoRemovable: true });
+    toastNotification.add({
+      severity: 'info',
+      content: { title: message },
+    });
     onDeviceRemoved();
   }
   return (
@@ -196,7 +204,7 @@ export function SecuritySettings({
       </Box>
       {EnterpriseComponent && (
         <div id="recovery-code">
-          <EnterpriseComponent addNotification={addNotification} />
+          <EnterpriseComponent addNotification={toastNotification.add} />
         </div>
       )}
       {TrustedDeviceListComponent && (
diff --git a/web/packages/teleport/src/Apps/MCPAppConnectDialog.story.tsx b/web/packages/teleport/src/Apps/MCPAppConnectDialog.story.tsx
new file mode 100644
index 0000000000000..a4ced15dc303c
--- /dev/null
+++ b/web/packages/teleport/src/Apps/MCPAppConnectDialog.story.tsx
@@ -0,0 +1,39 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MemoryRouter } from 'react-router';
+
+import { ContextProvider } from 'teleport';
+import { mcpApp } from 'teleport/Apps/fixtures';
+import { MCPAppConnectDialog as Component } from 'teleport/Apps/MCPAppConnectDialog';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+
+export default {
+  title: 'Teleport/Apps/MCPAppConnectDialog',
+};
+
+export function MCPAppConnectDialog() {
+  const ctx = createTeleportContext();
+  return (
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <Component app={mcpApp} onClose={() => {}} />
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
diff --git a/web/packages/teleport/src/Apps/MCPAppConnectDialog.tsx b/web/packages/teleport/src/Apps/MCPAppConnectDialog.tsx
new file mode 100644
index 0000000000000..11bfd30c3b1a6
--- /dev/null
+++ b/web/packages/teleport/src/Apps/MCPAppConnectDialog.tsx
@@ -0,0 +1,141 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  Box,
+  ButtonSecondary,
+  Flex,
+  Link,
+  ResourceIcon,
+  Stack,
+  Text,
+} from 'design';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from 'design/Dialog';
+import {
+  TextSelectCopy,
+  TextSelectCopyMulti,
+} from 'shared/components/TextSelectCopy';
+import {
+  generateClaudeDesktopConfigForApp,
+  generateInstallLinksForApp,
+} from 'shared/services/mcp';
+
+import { generateTshLoginCommand } from 'teleport/lib/util';
+import { App } from 'teleport/services/apps';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+import useTeleport from 'teleport/useTeleport';
+
+/**
+ * MCPAppConnectDialog shows tsh instructions for connecting to an MCP app.
+ */
+export function MCPAppConnectDialog(props: { app: App; onClose: () => void }) {
+  const { app, onClose } = props;
+  const ctx = useTeleport();
+  const { clusterId } = useStickyClusterId();
+  const { username, authType } = ctx.storeUser.state;
+  const accessRequestId = ctx.storeUser.getAccessRequestId();
+  const claudeConfig = generateClaudeDesktopConfigForApp(app.name);
+  const links = generateInstallLinksForApp(app.name);
+
+  return (
+    <Dialog
+      dialogCss={() => ({
+        maxWidth: '600px',
+        width: '100%',
+      })}
+      disableEscapeKeyDown={false}
+      onClose={onClose}
+      open={true}
+    >
+      <DialogHeader mb={4}>
+        <DialogTitle>Connect to: {app.name}</DialogTitle>
+      </DialogHeader>
+
+      <DialogContent>
+        <Stack gap={4}>
+          <Stack fullWidth gap={2}>
+            <Text>
+              <Text bold as="span">
+                Step 1
+              </Text>
+              {' - Log in to Teleport'}
+            </Text>
+            <TextSelectCopy
+              text={generateTshLoginCommand({
+                authType,
+                username,
+                clusterId,
+                accessRequestId,
+              })}
+            />
+          </Stack>
+
+          <Stack fullWidth gap={2}>
+            <Text>
+              <Text bold as="span">
+                Step 2
+              </Text>
+              {' - Configure your MCP client'}
+            </Text>
+            <Flex alignItems="center" justifyContent="left" columnGap={2}>
+              <Link href={links.cursor} target="_blank">
+                <ResourceIcon name="mcpCursor" height="32px" />
+              </Link>
+              <Link href={links.vscode} target="_blank">
+                <ResourceIcon name="mcpVscode" height="25px" />
+              </Link>
+              <Link href={links.vscodeInsiders} target="_blank">
+                <ResourceIcon name="mcpVscodeInsiders" height="25px" />
+              </Link>
+            </Flex>
+            <Box>
+              Here is a sample Claude Desktop config to connect to this MCP
+              server:
+            </Box>
+            <TextSelectCopyMulti
+              bash={false}
+              lines={[
+                {
+                  text: claudeConfig,
+                },
+              ]}
+            />
+            <Box>
+              Alternatively, run the following to generate the config from the
+              command line.
+            </Box>
+            <TextSelectCopy text={`tsh mcp config ${app.name}`} />
+            <Box>
+              Note: You might need to restart your MCP client to load the
+              updated configuration.
+            </Box>
+          </Stack>
+        </Stack>
+      </DialogContent>
+
+      <DialogFooter>
+        <ButtonSecondary onClick={props.onClose}>Close</ButtonSecondary>
+      </DialogFooter>
+    </Dialog>
+  );
+}
diff --git a/web/packages/teleport/src/Apps/TcpAppConnectDialog.story.tsx b/web/packages/teleport/src/Apps/TcpAppConnectDialog.story.tsx
index 685ce1004e9df..755e3ae14d5f9 100644
--- a/web/packages/teleport/src/Apps/TcpAppConnectDialog.story.tsx
+++ b/web/packages/teleport/src/Apps/TcpAppConnectDialog.story.tsx
@@ -15,7 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { MemoryRouter } from 'react-router';
 
 import {
diff --git a/web/packages/teleport/src/Apps/fixtures/index.ts b/web/packages/teleport/src/Apps/fixtures/index.ts
index 1bf4709101c24..c4f3ee27ec89e 100644
--- a/web/packages/teleport/src/Apps/fixtures/index.ts
+++ b/web/packages/teleport/src/Apps/fixtures/index.ts
@@ -94,6 +94,24 @@ export const tcpApp = makeApp({
   clusterId: 'one',
 });
 
+export const mcpApp = makeApp({
+  name: 'mcp-everything',
+  subKind: 'mcp',
+  description: 'Some MCP server',
+  uri: 'mcp+stdio://',
+  publicAddr: 'mcp-everything.teleport.example.com',
+  fqdn: 'mcp-everything.teleport.example.com',
+  labels: [
+    { name: 'env', value: 'dev' },
+    { name: 'cluster', value: 'one' },
+  ],
+  mcp: {
+    command: 'npx',
+    args: ['-y', '@modelcontextprotocol/server-everything'],
+    runAsHostUser: 'hostuser',
+  },
+});
+
 export const apps = [
   {
     name: 'Jenkins',
@@ -259,7 +277,7 @@ export const apps = [
     fqdn: 'https://console.aws.amazon.com',
   },
 ].map(makeApp);
-apps.push(awsConsoleApp, awsIamIcAccountApp, tcpApp);
+apps.push(awsConsoleApp, awsIamIcAccountApp, tcpApp, mcpApp);
 
 export const gcpCloudApp = makeApp({
   name: 'cloud-app',
diff --git a/web/packages/teleport/src/Audit/EventList/EventTypeCell.tsx b/web/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
index 601c1d4e29a91..849a5da541e60 100644
--- a/web/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
+++ b/web/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
@@ -314,6 +314,33 @@ const EventIconMap: Record<EventCode, any> = {
   [eventCodes.AUTOUPDATE_AGENT_ROLLOUT_TRIGGER]: Icons.RocketLaunch,
   [eventCodes.AUTOUPDATE_AGENT_ROLLOUT_FORCE_DONE]: Icons.Checks,
   [eventCodes.AUTOUPDATE_AGENT_ROLLOUT_ROLLBACK]: Icons.Restore,
+  [eventCodes.MCP_SESSION_START]: Icons.ModelContextProtocol,
+  [eventCodes.MCP_SESSION_END]: Icons.ModelContextProtocol,
+  [eventCodes.MCP_SESSION_END_FAILURE]: Icons.Warning,
+  [eventCodes.MCP_SESSION_REQUEST]: Icons.ModelContextProtocol,
+  [eventCodes.MCP_SESSION_REQUEST_FAILURE]: Icons.Warning,
+  [eventCodes.MCP_SESSION_NOTIFICATION]: Icons.ModelContextProtocol,
+  [eventCodes.MCP_SESSION_NOTIFICATION_FAILURE]: Icons.Warning,
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM]: Icons.ModelContextProtocol,
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM_FAILURE]: Icons.Warning,
+  [eventCodes.MCP_SESSION_INVALID_HTTP_REQUEST]: Icons.Warning,
+  [eventCodes.BOUND_KEYPAIR_RECOVERY]: Icons.Info,
+  [eventCodes.BOUND_KEYPAIR_ROTATION]: Icons.Info,
+  [eventCodes.BOUND_KEYPAIR_JOIN_STATE_VERIFICATION_FAILED]: Icons.Warning,
+  [eventCodes.SCIM_RESOURCE_CREATE]: Icons.Info,
+  [eventCodes.SCIM_RESOURCE_CREATE_FAILURE]: Icons.Warning,
+  [eventCodes.SCIM_RESOURCE_UPDATE]: Icons.Info,
+  [eventCodes.SCIM_RESOURCE_UPDATE_FAILURE]: Icons.Warning,
+  [eventCodes.SCIM_RESOURCE_DELETE]: Icons.Info,
+  [eventCodes.SCIM_RESOURCE_DELETE_FAILURE]: Icons.Warning,
+  [eventCodes.SCIM_RESOURCE_GET]: Icons.Info,
+  [eventCodes.SCIM_RESOURCE_GET_FAILURE]: Icons.Warning,
+  [eventCodes.SCIM_RESOURCE_LIST]: Icons.Info,
+  [eventCodes.SCIM_RESOURCE_LIST_FAILURE]: Icons.Warning,
+  [eventCodes.CLIENT_IP_RESTRICTIONS_UPDATE]: Icons.Info,
+  [eventCodes.VNET_CONFIG_CREATE]: Icons.Info,
+  [eventCodes.VNET_CONFIG_UPDATE]: Icons.Info,
+  [eventCodes.VNET_CONFIG_DELETE]: Icons.Info,
 };
 
 export default function renderTypeCell(event: Event) {
diff --git a/web/packages/teleport/src/Audit/EventList/ViewInPolicyButton.tsx b/web/packages/teleport/src/Audit/EventList/ViewInPolicyButton.tsx
index 7849b17a91783..3debb28ba8896 100644
--- a/web/packages/teleport/src/Audit/EventList/ViewInPolicyButton.tsx
+++ b/web/packages/teleport/src/Audit/EventList/ViewInPolicyButton.tsx
@@ -41,7 +41,7 @@ function getUrlForEvent<C extends EventCode>(event: RawEvents[C]) {
 
   // eslint-disable-next-line no-console
   console.warn(
-    'Unsupported event code for "View in Policy" button',
+    'Unsupported event code for "View in Identity Security" button',
     event.code
   );
 }
@@ -65,7 +65,7 @@ export function ViewInPolicyButton({ event }: { event: Event }) {
       size="small"
       style={{ whiteSpace: 'nowrap' }}
     >
-      View in Policy
+      View in Identity Security
     </ButtonBorder>
   );
 }
diff --git a/web/packages/teleport/src/Audit/fixtures/index.ts b/web/packages/teleport/src/Audit/fixtures/index.ts
index 57ce19fba3e44..fdccb555b4859 100644
--- a/web/packages/teleport/src/Audit/fixtures/index.ts
+++ b/web/packages/teleport/src/Audit/fixtures/index.ts
@@ -1901,6 +1901,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP02I',
     desktop_addr: '100.104.52.89:3389',
+    desktop_name: 'desktop-name',
     ei: 0,
     event: 'desktop.clipboard.send',
     sid: 'b7f734d8-bdc2-4996-8959-0b42a11708e7',
@@ -1913,6 +1914,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP03I',
     desktop_addr: '100.104.52.89:3389',
+    desktop_name: 'desktop-name',
     ei: 0,
     event: 'desktop.clipboard.receive',
     sid: 'b7f734d8-bdc2-4996-8959-0b42a11708e7',
@@ -1926,6 +1928,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP04I',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 3317,
@@ -1942,6 +1945,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP04W',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 3317,
@@ -1958,6 +1962,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP05I',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 9766,
@@ -1977,6 +1982,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP05W',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 9766,
@@ -1996,6 +2002,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP06I',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 7428,
@@ -2015,6 +2022,7 @@ export const events = [
     cluster_name: 'im-a-cluster-name',
     code: 'TDP06W',
     desktop_addr: 'ec2-54-162-177-255.compute-1.amazonaws.com:3389',
+    desktop_name: 'desktop-name',
     directory_id: 2,
     directory_name: 'windows-server-2012-shared',
     ei: 7428,
@@ -4032,6 +4040,355 @@ export const events = [
     groups: ['prod'],
     success: true,
   },
+  {
+    code: 'TMCP001I',
+    ei: 0,
+    event: 'mcp.session.start',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.111Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+  },
+  {
+    code: 'TMCP003I',
+    ei: 0,
+    event: 'mcp.session.request',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+    message: {
+      id: 0,
+      method: 'initialize',
+      params: {
+        clientInfo: {
+          name: 'claude-ai',
+          version: '0.1.0',
+        },
+        protocolVersion: '2024-11-05',
+      },
+      jsonrpc: '2.0',
+    },
+  },
+  {
+    code: 'TMCP004I',
+    ei: 0,
+    event: 'mcp.session.notification',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.333Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+    message: {
+      method: 'notifications/initialized',
+      jsonrpc: '2.0',
+    },
+  },
+  {
+    code: 'TMCP004E',
+    ei: 0,
+    event: 'mcp.session.notification',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.333Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: false,
+    message: {
+      method: 'notifications/initialized',
+      jsonrpc: '2.0',
+    },
+    error: 'HTTP 401 Unauthorized',
+  },
+  {
+    code: 'TMCP003I',
+    ei: 0,
+    event: 'mcp.session.request',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.444Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+    message: {
+      id: 2,
+      method: 'tools/call',
+      params: {
+        name: 'get_weather',
+        arguments: {
+          location: 'New York',
+        },
+      },
+      jsonrpc: '2.0',
+    },
+  },
+  {
+    code: 'TMCP003E',
+    ei: 0,
+    event: 'mcp.session.request',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T11:11:11.555Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: false,
+    error: 'access denied',
+    message: {
+      id: 2,
+      method: 'tools/call',
+      params: {
+        name: 'write_file',
+        arguments: {
+          path: '/etc/passwd',
+        },
+      },
+      jsonrpc: '2.0',
+    },
+  },
+  {
+    code: 'TMCP002I',
+    ei: 0,
+    event: 'mcp.session.end',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T12:22:22.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+  },
+  {
+    code: 'TMCP002E',
+    ei: 0,
+    event: 'mcp.session.end',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T12:22:22.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+    error: 'HTTP 405 Method Not Allowed',
+  },
+  {
+    code: 'TMCP005I',
+    ei: 0,
+    event: 'mcp.session.listen_sse_stream',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T12:22:22.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: true,
+  },
+  {
+    code: 'TMCP005E',
+    ei: 0,
+    event: 'mcp.session.listen_sse_stream',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T12:22:22.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    success: false,
+    error: 'HTTP 405 Method Not Allowed',
+  },
+  {
+    code: 'TMCP006E',
+    ei: 0,
+    event: 'mcp.session.invalid_http_request',
+    namespace: 'default',
+    server_id: 'a0518380-0d53-4188-ac8b-8ddd8103e45b',
+    sid: '6593cf87-9839-4f18-abf8-c54873aaeb4e',
+    time: '2025-05-23T12:22:22.222Z',
+    uid: '80400ed9-644e-4a6e-ab99-b264b34d0f55',
+    user: 'ai-user',
+    app_name: 'mcp-everything',
+    method: 'OPTIONS',
+    path: '/',
+  },
+  {
+    ei: 163,
+    time: '2023-05-08T19:21:36.144Z',
+    cluster: 'dev',
+    code: 'TSCIM005I',
+    event: 'scim.list',
+    success: true,
+    integration: 'okta',
+    resource_type: 'user',
+    teleport_id: 'root@localhost',
+    external_id: 'external-id-0987654321',
+    display: 'local admin',
+  },
+  {
+    ei: 163,
+    time: '2023-05-08T19:21:36.144Z',
+    cluster: 'dev',
+    code: 'TSCIM001I',
+    event: 'scim.create',
+    success: true,
+    request: {
+      id: 'ff5cea87-db00-4fa8-a30f-99f220f61075',
+      source_address: '127.0.0.1',
+      user_agent: 'carrier pigeon',
+      method: 'PUT',
+      path: '/scim/v2/Users',
+      body: {
+        active: true,
+        id: 'external-id-0987654321',
+        nickName: 'bofh',
+        schemas: ['urn:ietf:params:scim:schemas:core:2.0:User'],
+        userName: 'root@localhost',
+      },
+    },
+    integration: 'okta',
+    resource_type: 'user',
+    external_id: 'external-id-0987654321',
+    teleport_id: 'root@localhost',
+  },
+  {
+    time: '2023-05-08T19:21:36.144Z',
+    cluster: 'dev',
+    code: 'TSCIM001E',
+    event: 'scim.create',
+    success: false,
+    error: 'Too many candidates',
+    integration: 'okta',
+    resource_type: 'group',
+    teleport_id: 'access-list-guid',
+    external_id: '0987654321',
+    display: 'Some group',
+  },
+  {
+    time: '2023-05-08T19:21:36.144Z',
+    cluster: 'dev',
+    code: 'TSCIM002I',
+    event: 'scim.update',
+    success: true,
+    integration: 'okta',
+    resource_type: 'user',
+    teleport_id: 'test@example.com',
+    external_id: 'externa-id-00123456789',
+    display: 'test@example.com',
+  },
+  {
+    time: '2023-05-08T19:21:37.000Z',
+    cluster: 'dev',
+    code: 'TSCIM002E',
+    event: 'scim.update',
+    resource_type: 'user',
+    success: false,
+    error: 'no such user',
+    integration: 'okta',
+    teleport_id: 'test@example.com',
+    external_id: 'external-id-000123456789',
+    display: 'test@example.com',
+  },
+  {
+    time: '2023-05-08T19:21:36.144Z',
+    cluster: 'dev',
+    code: 'TSCIM003I',
+    event: 'scim.delete',
+    success: true,
+    integration: 'okta',
+    resource_type: 'user',
+    teleport_id: 'test@example.com',
+    external_id: 'external-id-00123456789',
+    display: 'test@example.com',
+  },
+  {
+    time: '2023-05-08T19:21:37.000Z',
+    cluster: 'dev',
+    code: 'TSCIM003E',
+    event: 'scim.delete',
+    resource_type: 'group',
+    success: false,
+    error: 'no such group',
+    integration: 'okta',
+    teleport_id: 'access-list-guid',
+    external_id: 'external-id-00123456789',
+    display: 'some group',
+  },
+  {
+    client_ip_restrictions: ['3.0.0.0/8'],
+    cluster_name: 'localhost',
+    code: 'CIR001I',
+    ei: 0,
+    event: 'cir.update',
+    expires: '0001-01-01T00:00:00Z',
+    name: 'client_ip_restriction',
+    success: true,
+    time: '2025-10-21T20:45:14.775Z',
+    updated_by: 'admin',
+    user: 'admin',
+    user_cluster_name: 'localhost',
+    user_kind: 1,
+    user_roles: ['editor'],
+  },
+  {
+    'addr.remote': '127.0.0.1:62460',
+    cluster_name: 'teleport.dev',
+    code: 'TVNET001I',
+    ei: 0,
+    event: 'vnet.config.create',
+    success: true,
+    time: '2025-03-04T15:49:21.869Z',
+    uid: 'e1973df2-4bee-4a67-9925-575c1d38cc80',
+    user: '08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev',
+    user_cluster_name: 'teleport.dev',
+    user_kind: 3,
+    user_roles: ['Admin'],
+  },
+  {
+    'addr.remote': '127.0.0.1:62460',
+    cluster_name: 'teleport.dev',
+    code: 'TVNET002I',
+    ei: 0,
+    event: 'vnet.config.update',
+    success: true,
+    time: '2025-03-04T15:49:21.869Z',
+    uid: 'e1973df2-4bee-4a67-9925-575c1d38cc80',
+    user: '08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev',
+    user_cluster_name: 'teleport.dev',
+    user_kind: 3,
+    user_roles: ['Admin'],
+  },
+  {
+    'addr.remote': '127.0.0.1:62460',
+    cluster_name: 'teleport.dev',
+    code: 'TVNET003I',
+    ei: 0,
+    event: 'vnet.config.delete',
+    success: true,
+    time: '2025-03-04T15:49:21.869Z',
+    uid: 'e1973df2-4bee-4a67-9925-575c1d38cc80',
+    user: '08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev',
+    user_cluster_name: 'teleport.dev',
+    user_kind: 3,
+    user_roles: ['Admin'],
+  },
 ].map(makeEvent);
 
 // Do not add new events to this array, add it to `events` list.
diff --git a/web/packages/teleport/src/AuthConnectors/AuthConnectorEditor/AuthConnectorEditorContent.tsx b/web/packages/teleport/src/AuthConnectors/AuthConnectorEditor/AuthConnectorEditorContent.tsx
index b2af6ef012b95..19115e6ce71b1 100644
--- a/web/packages/teleport/src/AuthConnectors/AuthConnectorEditor/AuthConnectorEditorContent.tsx
+++ b/web/packages/teleport/src/AuthConnectors/AuthConnectorEditor/AuthConnectorEditorContent.tsx
@@ -88,15 +88,13 @@ export function AuthConnectorEditorContent({
             {saveAttempt.status === 'error' && (
               <Alert width="100%">{saveAttempt.statusText}</Alert>
             )}
-            <Flex height="600px" width="100%">
-              {content && (
-                <TextEditor
-                  bg="levels.deep"
-                  readOnly={false}
-                  data={[{ content, type: 'yaml' }]}
-                  onChange={setContent}
-                />
-              )}
+            <Flex height="100%" width="100%">
+              <TextEditor
+                bg="levels.deep"
+                readOnly={false}
+                data={[{ content, type: 'yaml' }]}
+                onChange={setContent}
+              />
             </Flex>
             <Box mt={3}>
               <ButtonPrimary disabled={isSaveDisabled} onClick={onSave} mr="3">
diff --git a/web/packages/teleport/src/BotInstances/BotInstances.story.tsx b/web/packages/teleport/src/BotInstances/BotInstances.story.tsx
new file mode 100644
index 0000000000000..0d0afec88d159
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/BotInstances.story.tsx
@@ -0,0 +1,217 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryHistory } from 'history';
+import { MemoryRouter, Router } from 'react-router';
+
+import Box from 'design/Box/Box';
+
+import { Route } from 'teleport/components/Router';
+import cfg from 'teleport/config';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  getBotInstanceError,
+  getBotInstanceMetricsSuccess,
+  getBotInstanceSuccess,
+  listBotInstancesError,
+  listBotInstancesForever,
+  listBotInstancesSuccess,
+} from 'teleport/test/helpers/botInstances';
+
+import { BotInstances } from './BotInstances';
+
+const meta = {
+  title: 'Teleport/BotInstances',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+const listBotInstances = {
+  bot_instances: [
+    {
+      bot_name: 'ansible-worker',
+      instance_id: crypto.randomUUID(),
+      active_at_latest: '2025-07-22T10:54:00Z',
+      host_name_latest: 'my-svc.my-namespace.svc.cluster-domain.example',
+      join_method_latest: 'github',
+      os_latest: 'linux',
+      version_latest: '4.4.0',
+    },
+    {
+      bot_name: 'ansible-worker',
+      instance_id: crypto.randomUUID(),
+      active_at_latest: '2025-07-22T10:54:00Z',
+      host_name_latest: 'win-123a',
+      join_method_latest: 'tpm',
+      os_latest: 'windows',
+      version_latest: '4.3.18+ab12hd',
+    },
+    {
+      bot_name: 'ansible-worker',
+      instance_id: crypto.randomUUID(),
+      active_at_latest: '2025-07-22T10:54:00Z',
+      host_name_latest: 'mac-007',
+      join_method_latest: 'kubernetes',
+      os_latest: 'darwin',
+      version_latest: '3.9.99',
+    },
+    {
+      bot_name: 'ansible-worker',
+      instance_id: crypto.randomUUID(),
+      active_at_latest: '2025-07-22T10:54:00Z',
+      host_name_latest: 'aws:g49dh27dhjm3',
+      join_method_latest: 'ec2',
+      os_latest: 'linux',
+      version_latest: '1.3.2',
+    },
+    {
+      bot_name: 'ansible-worker',
+      instance_id: crypto.randomUUID(),
+    },
+  ],
+  next_page_token: '',
+};
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        listBotInstancesSuccess(listBotInstances, 'v1'),
+        listBotInstancesSuccess(listBotInstances, 'v2'),
+        getBotInstanceSuccess(),
+        getBotInstanceMetricsSuccess(),
+      ],
+    },
+  },
+};
+
+export const ErrorLoadingList: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        listBotInstancesError(500, 'something went wrong'),
+        getBotInstanceMetricsSuccess(),
+      ],
+    },
+  },
+};
+
+export const StillLoadingList: Story = {
+  parameters: {
+    msw: {
+      handlers: [listBotInstancesForever(), getBotInstanceMetricsSuccess()],
+    },
+  },
+};
+
+export const NoListPermission: Story = {
+  args: {
+    hasBotInstanceListPermission: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listBotInstancesError(
+          500,
+          'this call should never be made without permissions'
+        ),
+        getBotInstanceMetricsSuccess(),
+      ],
+    },
+  },
+};
+
+export const NoReadPermission: Story = {
+  args: {
+    hasBotInstanceReadPermission: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listBotInstancesSuccess(listBotInstances, 'v1'),
+        listBotInstancesSuccess(listBotInstances, 'v2'),
+        getBotInstanceError(
+          500,
+          'this call should never be made without permissions'
+        ),
+        getBotInstanceMetricsSuccess(),
+      ],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(props?: {
+  hasBotInstanceListPermission?: boolean;
+  hasBotInstanceReadPermission?: boolean;
+}) {
+  const {
+    hasBotInstanceListPermission = true,
+    hasBotInstanceReadPermission = true,
+  } = props ?? {};
+
+  const history = createMemoryHistory({
+    initialEntries: ['/web/bots/instances'],
+  });
+
+  const customAcl = makeAcl({
+    botInstances: {
+      ...defaultAccess,
+      read: hasBotInstanceReadPermission,
+      list: hasBotInstanceListPermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <Router history={history}>
+            <Route path={cfg.routes.botInstances}>
+              <Box height={820}>
+                <BotInstances />
+              </Box>
+            </Route>
+          </Router>
+        </TeleportProviderBasic>
+      </MemoryRouter>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/BotInstances.test.tsx b/web/packages/teleport/src/BotInstances/BotInstances.test.tsx
index c1aa62ed625c6..80e4f1c906d1d 100644
--- a/web/packages/teleport/src/BotInstances/BotInstances.test.tsx
+++ b/web/packages/teleport/src/BotInstances/BotInstances.test.tsx
@@ -17,29 +17,38 @@
  */
 
 import { QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryHistory } from 'history';
 import { setupServer } from 'msw/node';
 import { PropsWithChildren } from 'react';
-import { MemoryRouter } from 'react-router';
+import { MemoryRouter, Route, Router } from 'react-router';
 
 import { darkTheme } from 'design/theme';
 import { ConfiguredThemeProvider } from 'design/ThemeProvider';
 import {
-  fireEvent,
   render,
   screen,
   testQueryClient,
   userEvent,
   waitFor,
   waitForElementToBeRemoved,
+  within,
 } from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
 
+import cfg from 'teleport/config';
+import { createTeleportContext } from 'teleport/mocks/contexts';
 import { listBotInstances } from 'teleport/services/bot/bot';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
 import {
+  getBotInstanceMetricsSuccess,
+  getBotInstanceSuccess,
   listBotInstancesError,
   listBotInstancesSuccess,
 } from 'teleport/test/helpers/botInstances';
 
+import 'shared/components/TextEditor/TextEditor.mock';
+
+import { ContextProvider } from '..';
 import { BotInstances } from './BotInstances';
 
 jest.mock('teleport/services/bot/bot', () => {
@@ -48,15 +57,19 @@ jest.mock('teleport/services/bot/bot', () => {
     listBotInstances: jest.fn((...all) => {
       return actual.listBotInstances(...all);
     }),
+    getBotInstance: jest.fn((...all) => {
+      return actual.getBotInstance(...all);
+    }),
+    getBotInstanceMetrics: jest.fn((...all) => {
+      return actual.getBotInstanceMetrics(...all);
+    }),
   };
 });
 
 const server = setupServer();
 
-beforeEach(() => {
+beforeAll(() => {
   server.listen();
-
-  jest.useFakeTimers().setSystemTime(new Date('2025-05-19T08:00:00Z'));
 });
 
 afterEach(async () => {
@@ -72,17 +85,21 @@ afterAll(() => server.close());
 describe('BotInstances', () => {
   it('Shows an empty state', async () => {
     server.use(
-      listBotInstancesSuccess({
-        bot_instances: [],
-        next_page_token: '',
-      })
+      listBotInstancesSuccess(
+        {
+          bot_instances: [],
+          next_page_token: '',
+        },
+        'v1'
+      )
     );
+    server.use(getBotInstanceMetricsSuccess());
 
-    render(<BotInstances />, { wrapper: Wrapper });
+    renderComponent();
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    expect(screen.getByText('No active instances found')).toBeInTheDocument();
+    expect(screen.getByText('No active instances')).toBeInTheDocument();
     expect(
       screen.getByText(
         'Bot instances are ephemeral, and disappear once all issued credentials have expired.'
@@ -91,51 +108,163 @@ describe('BotInstances', () => {
   });
 
   it('Shows an error state', async () => {
-    server.use(listBotInstancesError(500));
+    server.use(listBotInstancesError(500, 'something went wrong'));
+    server.use(getBotInstanceMetricsSuccess());
+
+    renderComponent();
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
 
-    render(<BotInstances />, { wrapper: Wrapper });
+  it('Shows an unsupported sort error state', async () => {
+    const testErrorMessage =
+      'unsupported sort, only bot_name:asc is supported, but got "blah" (desc = true)';
+    server.use(listBotInstancesError(400, testErrorMessage));
+    server.use(getBotInstanceMetricsSuccess());
+
+    const { user } = renderComponent();
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
+    expect(screen.getByText(testErrorMessage)).toBeInTheDocument();
+
+    server.use(
+      listBotInstancesSuccess(
+        {
+          bot_instances: [],
+          next_page_token: '',
+        },
+        'v1'
+      )
+    );
+
+    const resetButton = screen.getByRole('button', { name: 'Reset sort' });
+    await user.click(resetButton);
+
+    expect(screen.queryByText(testErrorMessage)).not.toBeInTheDocument();
+  });
+
+  it('Shows an unauthorised error state', async () => {
+    renderComponent({
+      customAcl: makeAcl({
+        botInstances: {
+          ...defaultAccess,
+          list: false,
+        },
+      }),
+    });
+
     expect(
-      screen.getByText('Error: 500', { exact: false })
+      screen.getByText(
+        'You do not have permission to access Bot instances. Missing role permissions:',
+        { exact: false }
+      )
     ).toBeInTheDocument();
+
+    expect(screen.getByText('bot_instance.list')).toBeInTheDocument();
   });
 
   it('Shows a list', async () => {
+    jest.useFakeTimers().setSystemTime(new Date('2025-05-19T08:00:00Z'));
+
     server.use(
-      listBotInstancesSuccess({
-        bot_instances: [
-          {
-            bot_name: 'test-bot-1',
-            instance_id: '5e885c66-1af3-4a36-987d-a604d8ee49d2',
-            active_at_latest: '2025-05-19T07:32:00Z',
-            host_name_latest: 'test-hostname',
-            join_method_latest: 'test-join-method',
-            version_latest: '1.0.0-dev-a12b3c',
-          },
-          {
-            bot_name: 'test-bot-2',
-            instance_id: '3c3aae3e-de25-4824-a8e9-5a531862f19a',
-          },
-        ],
-        next_page_token: '',
-      })
+      listBotInstancesSuccess(
+        {
+          bot_instances: [
+            {
+              bot_name: 'test-bot-1',
+              instance_id: '5e885c66-1af3-4a36-987d-a604d8ee49d2',
+              active_at_latest: '2025-05-19T07:32:00Z',
+              host_name_latest: 'test-hostname',
+              join_method_latest: 'github',
+              version_latest: '1.0.0-dev-a12b3c',
+            },
+            {
+              bot_name: 'test-bot-2',
+              instance_id: '3c3aae3e-de25-4824-a8e9-5a531862f19a',
+            },
+          ],
+          next_page_token: '',
+        },
+        'v1'
+      )
     );
+    server.use(getBotInstanceMetricsSuccess());
 
-    render(<BotInstances />, { wrapper: Wrapper });
+    renderComponent();
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    expect(screen.getByText('test-bot-1')).toBeInTheDocument();
-    expect(screen.getByText('5e885c6')).toBeInTheDocument();
+    expect(screen.getByText('test-bot-1/5e885c6')).toBeInTheDocument();
     expect(screen.getByText('28 minutes ago')).toBeInTheDocument();
     expect(screen.getByText('test-hostname')).toBeInTheDocument();
-    expect(screen.getByText('test-join-method')).toBeInTheDocument();
+    expect(screen.getByTestId('res-icon-github')).toBeInTheDocument();
     expect(screen.getByText('v1.0.0-dev-a12b3c')).toBeInTheDocument();
   });
 
+  it('Selects an item', async () => {
+    server.use(
+      listBotInstancesSuccess(
+        {
+          bot_instances: [
+            {
+              bot_name: 'test-bot-1',
+              instance_id: '5e885c66-1af3-4a36-987d-a604d8ee49d2',
+              active_at_latest: '2025-05-19T07:32:00Z',
+              host_name_latest: 'test-hostname',
+              join_method_latest: 'github',
+              version_latest: '1.0.0-dev-a12b3c',
+            },
+            {
+              bot_name: 'test-bot-2',
+              instance_id: '3c3aae3e-de25-4824-a8e9-5a531862f19a',
+            },
+          ],
+          next_page_token: '',
+        },
+        'v1'
+      )
+    );
+    server.use(getBotInstanceMetricsSuccess());
+
+    server.use(getBotInstanceSuccess());
+
+    const { user } = renderComponent();
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(
+      screen.queryByRole('heading', {
+        name: 'test-bot-2/3c3aae3e-de25-4824-a8e9-5a531862f19a',
+      })
+    ).not.toBeInTheDocument();
+
+    const item = screen.getByRole('listitem', {
+      name: 'test-bot-2/3c3aae3e-de25-4824-a8e9-5a531862f19a',
+    });
+    await user.click(item);
+
+    expect(
+      screen.getByRole('heading', {
+        name: 'test-bot-2/3c3aae3e-de25-4824-a8e9-5a531862f19a',
+      })
+    ).toBeInTheDocument();
+
+    const summarySection = screen
+      .getByRole('heading', {
+        name: 'Summary',
+      })
+      .closest('section');
+    expect(
+      within(summarySection!).getByText('test-bot-name')
+    ).toBeInTheDocument();
+  });
+
   it('Allows paging', async () => {
+    server.use(getBotInstanceMetricsSuccess());
+
     jest.mocked(listBotInstances).mockImplementation(
       ({ pageToken }) =>
         new Promise(resolve => {
@@ -143,7 +272,7 @@ describe('BotInstances', () => {
             bot_instances: [
               {
                 bot_name: `test-bot`,
-                instance_id: `00000000-0000-4000-0000-000000000000`,
+                instance_id: crypto.randomUUID(),
                 active_at_latest: `2025-05-19T07:32:00Z`,
                 host_name_latest: 'test-hostname',
                 join_method_latest: 'test-join-method',
@@ -157,55 +286,141 @@ describe('BotInstances', () => {
 
     expect(listBotInstances).toHaveBeenCalledTimes(0);
 
-    render(<BotInstances />, { wrapper: Wrapper });
+    const { user } = renderComponent();
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    const [nextButton] = screen.getAllByTitle('Next page');
+    const moreAction = screen.getByRole('button', { name: 'Load More' });
 
     expect(listBotInstances).toHaveBeenCalledTimes(1);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '',
-      searchTerm: '',
-    });
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
 
-    await waitFor(() => expect(nextButton).toBeEnabled());
-    fireEvent.click(nextButton);
+    await waitFor(() => expect(moreAction).toBeEnabled());
+    await user.click(moreAction);
 
     expect(listBotInstances).toHaveBeenCalledTimes(2);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '.next',
-      searchTerm: '',
-    });
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '.next',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
 
-    await waitFor(() => expect(nextButton).toBeEnabled());
-    fireEvent.click(nextButton);
+    await waitFor(() => expect(moreAction).toBeEnabled());
+    await user.click(moreAction);
 
     expect(listBotInstances).toHaveBeenCalledTimes(3);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '.next.next',
-      searchTerm: '',
-    });
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '.next.next',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+  });
+
+  it('Allows filtering (search)', async () => {
+    server.use(getBotInstanceMetricsSuccess());
+
+    jest.mocked(listBotInstances).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            bot_instances: [
+              {
+                bot_name: `test-bot`,
+                instance_id: crypto.randomUUID(),
+                active_at_latest: `2025-05-19T07:32:00Z`,
+                host_name_latest: 'test-hostname',
+                join_method_latest: 'test-join-method',
+                version_latest: `1.0.0-dev-a12b3c`,
+              },
+            ],
+            next_page_token: pageToken + '.next',
+          });
+        })
+    );
 
-    const [prevButton] = screen.getAllByTitle('Previous page');
+    expect(listBotInstances).toHaveBeenCalledTimes(0);
+    const { user, history } = renderComponent();
+    jest.spyOn(history, 'push');
 
-    await waitFor(() => expect(prevButton).toBeEnabled());
-    fireEvent.click(prevButton);
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    // This page's data will have been cached
-    expect(listBotInstances).toHaveBeenCalledTimes(3);
+    expect(listBotInstances).toHaveBeenCalledTimes(1);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
 
-    await waitFor(() => expect(prevButton).toBeEnabled());
-    fireEvent.click(prevButton);
+    const moreAction = screen.getByRole('button', { name: 'Load More' });
+    await waitFor(() => expect(moreAction).toBeEnabled());
+    await user.click(moreAction);
 
-    // This page's data will have been cached
+    expect(listBotInstances).toHaveBeenCalledTimes(2);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '.next',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+
+    const search = screen.getByPlaceholderText('Search...');
+    await userEvent.type(search, 'test-search-term');
+    await userEvent.type(search, '{enter}');
+
+    expect(history.push).toHaveBeenLastCalledWith({
+      pathname: '/web/bots/instances',
+      search: 'query=test-search-term',
+    });
     expect(listBotInstances).toHaveBeenCalledTimes(3);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '', // Should reset to the first page
+        searchTerm: 'test-search-term',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
   });
 
-  it('Allows filtering (search)', async () => {
+  it('Allows filtering (query)', async () => {
+    server.use(getBotInstanceMetricsSuccess());
+
     jest.mocked(listBotInstances).mockImplementation(
       ({ pageToken }) =>
         new Promise(resolve => {
@@ -213,7 +428,7 @@ describe('BotInstances', () => {
             bot_instances: [
               {
                 bot_name: `test-bot`,
-                instance_id: `00000000-0000-4000-0000-000000000000`,
+                instance_id: crypto.randomUUID(),
                 active_at_latest: `2025-05-19T07:32:00Z`,
                 host_name_latest: 'test-hostname',
                 join_method_latest: 'test-join-method',
@@ -226,55 +441,249 @@ describe('BotInstances', () => {
     );
 
     expect(listBotInstances).toHaveBeenCalledTimes(0);
-
-    render(<BotInstances />, { wrapper: Wrapper });
+    const { user, history } = renderComponent();
+    jest.spyOn(history, 'push');
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
     expect(listBotInstances).toHaveBeenCalledTimes(1);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '',
-      searchTerm: '',
-    });
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
 
-    const [nextButton] = screen.getAllByTitle('Next page');
-    await waitFor(() => expect(nextButton).toBeEnabled());
-    fireEvent.click(nextButton);
+    const moreAction = screen.getByRole('button', { name: 'Load More' });
+    await waitFor(() => expect(moreAction).toBeEnabled());
+    await user.click(moreAction);
 
     expect(listBotInstances).toHaveBeenCalledTimes(2);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '.next',
-      searchTerm: '',
-    });
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '.next',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
 
-    jest.useRealTimers(); // Required as userEvent.type() uses setTimeout internally
+    const advancedToggle = screen.getByLabelText('Advanced');
+    expect(advancedToggle).not.toBeChecked();
+    await userEvent.click(advancedToggle);
+    expect(advancedToggle).toBeChecked();
 
     const search = screen.getByPlaceholderText('Search...');
-    await waitFor(() => expect(search).toBeEnabled());
-    await userEvent.type(search, 'test-search-term');
+    await userEvent.type(search, 'test-query');
     await userEvent.type(search, '{enter}');
 
+    expect(history.push).toHaveBeenLastCalledWith({
+      pathname: '/web/bots/instances',
+      search: 'query=test-query&is_advanced=1',
+    });
     expect(listBotInstances).toHaveBeenCalledTimes(3);
-    expect(listBotInstances).toHaveBeenLastCalledWith({
-      pageSize: 20,
-      pageToken: '', // Search should reset to the first page
-      searchTerm: 'test-search-term',
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '', // Should reset to the first page
+        searchTerm: undefined,
+        query: 'test-query',
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+  });
+
+  it('Allows a filter to be applied from the dashboard', async () => {
+    server.use(getBotInstanceMetricsSuccess());
+
+    jest.mocked(listBotInstances).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            bot_instances: [],
+            next_page_token: pageToken + '.next',
+          });
+        })
+    );
+
+    const { user, history } = renderComponent();
+    jest.spyOn(history, 'push');
+
+    await waitForElementToBeRemoved(() =>
+      screen.queryByTestId('loading-dashboard')
+    );
+
+    expect(listBotInstances).toHaveBeenCalledTimes(1);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+
+    const item = screen.getByLabelText('Up to date');
+    await user.click(item);
+
+    expect(history.push).toHaveBeenLastCalledWith({
+      pathname: '/web/bots/instances',
+      search: 'query=up+to+date+filter+goes+here&is_advanced=1',
     });
+    expect(listBotInstances).toHaveBeenCalledTimes(2);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '', // Should reset to the first page
+        searchTerm: undefined,
+        query: 'up to date filter goes here',
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+  });
+
+  it('Allows sorting', async () => {
+    server.use(getBotInstanceMetricsSuccess());
+
+    jest.mocked(listBotInstances).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            bot_instances: [
+              {
+                bot_name: `test-bot`,
+                instance_id: `00000000-0000-4000-0000-000000000000`,
+                active_at_latest: `2025-05-19T07:32:00Z`,
+                host_name_latest: 'test-hostname',
+                join_method_latest: 'test-join-method',
+                version_latest: `1.0.0-dev-a12b3c`,
+              },
+            ],
+            next_page_token: pageToken + '.next',
+          });
+        })
+    );
+
+    expect(listBotInstances).toHaveBeenCalledTimes(0);
+
+    const { user } = renderComponent();
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(listBotInstances).toHaveBeenCalledTimes(1);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'DESC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+
+    const sortFieldAction = screen.getByRole('button', { name: 'Sort by' });
+    await user.click(sortFieldAction);
+
+    const ascendingAction = screen.getByRole('menuitem', { name: 'Oldest' });
+    await user.click(ascendingAction);
+
+    expect(listBotInstances).toHaveBeenCalledTimes(2);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'ASC',
+        sortField: 'active_at_latest',
+      },
+      expect.anything()
+    );
+
+    await user.click(sortFieldAction);
+    const option = screen.getByRole('menuitem', { name: 'Bot name' });
+    await user.click(option);
+
+    expect(listBotInstances).toHaveBeenCalledTimes(3);
+    expect(listBotInstances).toHaveBeenLastCalledWith(
+      {
+        pageSize: 32,
+        pageToken: '',
+        searchTerm: '',
+        query: undefined,
+        sortDir: 'ASC',
+        sortField: 'bot_name',
+      },
+      expect.anything()
+    );
   });
 });
 
-function Wrapper({ children }: PropsWithChildren) {
-  return (
-    <MemoryRouter>
-      <QueryClientProvider client={testQueryClient}>
-        <ConfiguredThemeProvider theme={darkTheme}>
-          <InfoGuidePanelProvider data-testid="blah">
-            {children}
-          </InfoGuidePanelProvider>
-        </ConfiguredThemeProvider>
-      </QueryClientProvider>
-    </MemoryRouter>
-  );
+function renderComponent(options?: { customAcl?: ReturnType<typeof makeAcl> }) {
+  const {
+    customAcl = makeAcl({
+      botInstances: {
+        ...defaultAccess,
+        read: true,
+        list: true,
+      },
+    }),
+  } = options ?? {};
+
+  const user = userEvent.setup();
+  const history = createMemoryHistory({
+    initialEntries: ['/web/bots/instances'],
+  });
+  return {
+    ...render(<BotInstances />, {
+      wrapper: makeWrapper({ customAcl, history }),
+    }),
+    user,
+    history,
+  };
+}
+
+function makeWrapper(options: {
+  customAcl: ReturnType<typeof makeAcl>;
+  history: ReturnType<typeof createMemoryHistory>;
+}) {
+  const { customAcl, history } = options ?? {};
+
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <MemoryRouter>
+        <QueryClientProvider client={testQueryClient}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <InfoGuidePanelProvider data-testid="blah">
+              <ContextProvider ctx={ctx}>
+                <Router history={history}>
+                  <Route path={cfg.routes.botInstances}>{children}</Route>
+                </Router>
+              </ContextProvider>
+            </InfoGuidePanelProvider>
+          </ConfiguredThemeProvider>
+        </QueryClientProvider>
+      </MemoryRouter>
+    );
+  };
 }
diff --git a/web/packages/teleport/src/BotInstances/BotInstances.tsx b/web/packages/teleport/src/BotInstances/BotInstances.tsx
index 1d5b25a6df94e..3cd7eb405888f 100644
--- a/web/packages/teleport/src/BotInstances/BotInstances.tsx
+++ b/web/packages/teleport/src/BotInstances/BotInstances.tsx
@@ -16,173 +16,267 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { keepPreviousData, useQuery } from '@tanstack/react-query';
-import { useCallback } from 'react';
+import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query';
+import { useCallback, useMemo, useRef } from 'react';
 import { useHistory, useLocation } from 'react-router';
+import styled, { css } from 'styled-components';
 
 import { Alert } from 'design/Alert/Alert';
-import Box from 'design/Box/Box';
-import { Indicator } from 'design/Indicator/Indicator';
-import { Mark } from 'design/Mark/Mark';
-import {
-  InfoExternalTextLink,
-  InfoGuideButton,
-  InfoParagraph,
-  ReferenceLinks,
-} from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
+import { CardTile } from 'design/CardTile/CardTile';
+import Flex from 'design/Flex/Flex';
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+import { SearchPanel } from 'shared/components/Search';
+import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
 
+import { EmptyState } from 'teleport/Bots/List/EmptyState/EmptyState';
 import {
   FeatureBox,
   FeatureHeader,
   FeatureHeaderTitle,
 } from 'teleport/components/Layout/Layout';
-import cfg from 'teleport/config';
 import { listBotInstances } from 'teleport/services/bot/bot';
 import { BotInstanceSummary } from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
 
-import { BotInstancesList } from './List/BotInstancesList';
+import { BotInstancesDashboard } from './Dashboard/BotInstanceDashboard';
+import { BotInstanceDetails } from './Details/BotInstanceDetails';
+import { InfoGuide } from './InfoGuide';
+import {
+  BotInstancesList,
+  BotInstancesListControls,
+} from './List/BotInstancesList';
 
 export function BotInstances() {
   const history = useHistory();
-  const location = useLocation();
+  const location = useLocation<{ prevPageTokens?: readonly string[] }>();
   const queryParams = new URLSearchParams(location.search);
-  const pageToken = queryParams.get('page') ?? '';
-  const searchTerm = queryParams.get('search') ?? '';
-
-  const { isPending, isFetching, isSuccess, isError, error, data } = useQuery({
-    queryKey: ['bot_instances', 'list', searchTerm, pageToken],
-    queryFn: () =>
-      listBotInstances({
-        pageSize: 20,
-        pageToken,
-        searchTerm,
-      }),
+  const query = queryParams.get('query') ?? '';
+  const isAdvancedQuery = queryParams.get('is_advanced') ?? '';
+  const sortField = queryParams.get('sort_field') || 'active_at_latest';
+  const sortDir = queryParams.get('sort_dir') || 'DESC';
+  const selectedItemId = queryParams.get('selected');
+  const activeTab = queryParams.get('tab');
+
+  const listRef = useRef<BotInstancesListControls | null>(null);
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasListPermission = flags.listBotInstances;
+
+  const {
+    isSuccess,
+    data,
+    isLoading,
+    isFetchingNextPage,
+    error,
+    hasNextPage,
+    fetchNextPage,
+  } = useInfiniteQuery({
+    enabled: hasListPermission,
+    queryKey: [
+      'bot_instances',
+      'list',
+      sortField,
+      sortDir,
+      query,
+      isAdvancedQuery,
+    ],
+    queryFn: ({ pageParam, signal }) =>
+      listBotInstances(
+        {
+          pageSize: 32,
+          pageToken: pageParam,
+          sortField,
+          sortDir,
+          searchTerm: isAdvancedQuery ? undefined : query,
+          query: isAdvancedQuery ? query : undefined,
+        },
+        signal
+      ),
+    initialPageParam: '',
+    getNextPageParam: data => data?.next_page_token,
     placeholderData: keepPreviousData,
     staleTime: 30_000, // Cached pages are valid for 30 seconds
   });
 
-  const hasNextPage = !!data?.next_page_token;
-  const hasPrevPage = !!pageToken;
-
-  const handleFetchNext = useCallback(() => {
-    const search = new URLSearchParams(location.search);
-    search.set('page', data?.next_page_token ?? '');
-
-    history.push({
-      pathname: `${location.pathname}`,
-      search: search.toString(),
-    });
-  }, [data?.next_page_token, history, location.pathname, location.search]);
-
-  const handleFetchPrev = useCallback(() => {
-    history.goBack();
-  }, [history]);
-
-  const handleSearchChange = useCallback((term: string) => {
-    const search = new URLSearchParams(location.search);
-    search.set('search', term);
-    search.set('page', '');
-
-    history.push({
-      pathname: `${location.pathname}`,
-      search: search.toString(),
-    });
-  }, []);
-
-  const onItemSelected = useCallback(
-    (item: BotInstanceSummary) => {
-      history.push(
-        cfg.getBotInstanceDetailsRoute({
-          botName: item.bot_name,
-          instanceId: item.instance_id,
-        })
-      );
+  const handleQueryChange = useCallback(
+    (query: string, isAdvanced: boolean) => {
+      const search = new URLSearchParams(location.search);
+      if (query) {
+        search.set('query', query);
+      } else {
+        search.delete('query');
+      }
+      if (isAdvanced) {
+        search.set('is_advanced', '1');
+      } else {
+        search.delete('is_advanced');
+      }
+
+      history.push({
+        pathname: `${location.pathname}`,
+        search: search.toString(),
+      });
+
+      listRef.current?.scrollToTop();
+    },
+    [history, location.pathname, location.search]
+  );
+
+  const handleSortChanged = useCallback(
+    (sortField: string, sortDir: SortOrder) => {
+      const search = new URLSearchParams(location.search);
+      search.set('sort_field', sortField);
+      search.set('sort_dir', sortDir);
+
+      history.replace({
+        pathname: location.pathname,
+        search: search.toString(),
+      });
+
+      listRef.current?.scrollToTop();
+    },
+    [history, location.pathname, location.search]
+  );
+
+  const handleItemSelected = useCallback(
+    (item: BotInstanceSummary | null) => {
+      const search = new URLSearchParams(location.search);
+      if (item) {
+        search.set('selected', `${item.bot_name}/${item.instance_id}`);
+      } else {
+        search.delete('selected');
+        search.delete('tab');
+      }
+
+      history.push({
+        pathname: location.pathname,
+        search: search.toString(),
+      });
     },
-    [history]
+    [history, location.pathname, location.search]
   );
 
+  const handleDetailsTabSelected = useCallback(
+    (tab: string) => {
+      const search = new URLSearchParams(location.search);
+
+      search.set('tab', tab);
+
+      history.push({
+        pathname: location.pathname,
+        search: search.toString(),
+      });
+    },
+    [history, location.pathname, location.search]
+  );
+
+  const [selectedBotName, selectedInstanceId] =
+    selectedItemId?.split('/') ?? [];
+
+  const flatData = useMemo(
+    () => (isSuccess ? data.pages.flatMap(page => page.bot_instances) : null),
+    [data?.pages, isSuccess]
+  );
+
+  const handleFilterSelected = useCallback(
+    (filter: string) => {
+      handleQueryChange(filter, true);
+    },
+    [handleQueryChange]
+  );
+
+  if (!hasListPermission) {
+    return (
+      <FeatureBox>
+        <Alert kind="info" mt={4}>
+          You do not have permission to access Bot instances. Missing role
+          permissions: <code>bot_instance.list</code>
+        </Alert>
+        <EmptyState />
+      </FeatureBox>
+    );
+  }
+
   return (
-    <FeatureBox>
-      <FeatureHeader justifyContent="space-between">
-        <FeatureHeaderTitle>Bot instances</FeatureHeaderTitle>
+    <FeatureBox hideBottomSpacing>
+      <FeatureHeader justifyContent="space-between" mb={0}>
+        <FeatureHeaderTitle>Bot Instances</FeatureHeaderTitle>
         <InfoGuideButton config={{ guide: <InfoGuide /> }} />
       </FeatureHeader>
 
-      {isPending ? (
-        <Box data-testid="loading" textAlign="center" m={10}>
-          <Indicator />
-        </Box>
-      ) : undefined}
-
-      {isError ? (
-        <Alert kind="danger">{`Error: ${error.message}`}</Alert>
-      ) : undefined}
-
-      {isSuccess ? (
-        <BotInstancesList
-          data={data.bot_instances}
-          fetchStatus={isFetching ? 'loading' : ''}
-          onFetchNext={hasNextPage ? handleFetchNext : undefined}
-          onFetchPrev={hasPrevPage ? handleFetchPrev : undefined}
-          onSearchChange={handleSearchChange}
-          searchTerm={searchTerm}
-          onItemSelected={onItemSelected}
+      <Container>
+        <SearchPanel
+          filter={{
+            query: isAdvancedQuery ? query : undefined,
+            search: isAdvancedQuery ? undefined : query,
+          }}
+          updateSearch={query => handleQueryChange(query, false)}
+          updateQuery={query => handleQueryChange(query, true)}
+          mb={2}
         />
-      ) : undefined}
+        <ContentContainer>
+          <ListAndDetailsContainer $listOnlyMode={!selectedItemId}>
+            <BotInstancesList
+              ref={listRef}
+              data={flatData}
+              isLoading={isLoading}
+              isFetchingNextPage={isFetchingNextPage}
+              error={error}
+              hasNextPage={hasNextPage}
+              sortField={sortField}
+              sortDir={sortDir === 'DESC' ? 'DESC' : 'ASC'}
+              onSortChanged={handleSortChanged}
+              onLoadNextPage={fetchNextPage}
+              selectedItem={selectedItemId}
+              onItemSelected={handleItemSelected}
+              isFiltering={!!query}
+            />
+            {selectedItemId ? (
+              <BotInstanceDetails
+                key={selectedItemId}
+                botName={selectedBotName}
+                instanceId={selectedInstanceId}
+                onClose={() => handleItemSelected(null)}
+                activeTab={activeTab}
+                onTabSelected={tab => handleDetailsTabSelected(tab)}
+              />
+            ) : undefined}
+          </ListAndDetailsContainer>
+          {!selectedItemId ? (
+            <BotInstancesDashboard onFilterSelected={handleFilterSelected} />
+          ) : undefined}
+        </ContentContainer>
+      </Container>
     </FeatureBox>
   );
 }
 
-const InfoGuide = () => (
-  <Box>
-    <InfoParagraph>
-      A{' '}
-      <InfoExternalTextLink
-        target="_blank"
-        href={InfoGuideReferenceLinks.BotInstances.href}
-      >
-        Bot Instance
-      </InfoExternalTextLink>{' '}
-      identifies a single lineage of{' '}
-      <InfoExternalTextLink
-        target="_blank"
-        href={InfoGuideReferenceLinks.Bots.href}
-      >
-        bot
-      </InfoExternalTextLink>{' '}
-      identities, even through certificate renewals and rejoins. When the{' '}
-      <Mark>tbot</Mark> client first authenticates to a cluster, a Bot Instance
-      is generated and its UUID is embedded in the returned client identity.
-    </InfoParagraph>
-    <InfoParagraph>
-      Bot Instances track a variety of information about <Mark>tbot</Mark>{' '}
-      instances, including regular heartbeats which include basic information
-      about the <Mark>tbot</Mark> host, like its architecture and OS version.
-    </InfoParagraph>
-    <InfoParagraph>
-      {' '}
-      Bot Instances have a relatively short lifespan and are set to expire after
-      the most recent identity issued for that instance will expire. If the{' '}
-      <Mark>tbot</Mark> client associated with a particular Bot Instance renews
-      or rejoins, the expiration of the bot instance is reset. This is designed
-      to allow users to list Bot Instances for an accurate view of the number of
-      active <Mark>tbot</Mark> clients interacting with their Teleport cluster.
-    </InfoParagraph>
-    <ReferenceLinks links={Object.values(InfoGuideReferenceLinks)} />
-  </Box>
-);
-
-const InfoGuideReferenceLinks = {
-  BotInstances: {
-    title: 'What are Bot instances',
-    href: 'https://goteleport.com/docs/enroll-resources/machine-id/introduction/#bot-instances',
-  },
-  Bots: {
-    title: 'What are Bots',
-    href: 'https://goteleport.com/docs/enroll-resources/machine-id/introduction/#bots',
-  },
-  Tctl: {
-    title: 'Use tctl to manage bot instances',
-    href: 'https://goteleport.com/docs/reference/cli/tctl/#tctl-bots-instances-add',
-  },
-};
+const Container = styled(Flex)`
+  flex-direction: column;
+  flex: 1;
+  overflow: auto;
+  padding-bottom: ${props => props.theme.space[3]}px;
+`;
+
+const ContentContainer = styled(Flex)`
+  flex: 1;
+  overflow: auto;
+  gap: ${props => props.theme.space[2]}px;
+`;
+
+const ListAndDetailsContainer = styled(CardTile)<{ $listOnlyMode: boolean }>`
+  flex-direction: row;
+  overflow: auto;
+  padding: 0;
+  gap: 0;
+  margin: ${props => props.theme.space[1]}px;
+
+  ${p =>
+    p.$listOnlyMode
+      ? css`
+          min-width: 300px;
+          max-width: 400px;
+        `
+      : ''}
+`;
diff --git a/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.story.tsx b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.story.tsx
new file mode 100644
index 0000000000000..fa327d5028d7e
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.story.tsx
@@ -0,0 +1,118 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import {
+  getBotInstanceMetricsError,
+  getBotInstanceMetricsForever,
+  getBotInstanceMetricsSuccess,
+} from 'teleport/test/helpers/botInstances';
+
+import { BotInstancesDashboard } from './BotInstanceDashboard';
+
+const meta = {
+  title: 'Teleport/BotInstances/Dashboard',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceMetricsSuccess()],
+    },
+  },
+};
+
+export const NoData: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotInstanceMetricsSuccess({
+          upgrade_statuses: null,
+          refresh_after_seconds: 60_000,
+        }),
+      ],
+    },
+  },
+};
+
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceMetricsForever()],
+    },
+  },
+};
+
+export const Error: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceMetricsError(500, 'something went wrong')],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper() {
+  const ctx = createTeleportContext();
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <BotInstancesDashboard onFilterSelected={() => {}} />
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.test.tsx b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.test.tsx
new file mode 100644
index 0000000000000..12348d43f05b3
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.test.tsx
@@ -0,0 +1,264 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import { darkTheme } from 'design/theme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitForElementToBeRemoved,
+  within,
+} from 'design/utils/testing';
+
+import {
+  getBotInstanceMetricsError,
+  getBotInstanceMetricsSuccess,
+} from 'teleport/test/helpers/botInstances';
+
+import { BotInstancesDashboard } from './BotInstanceDashboard';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('BotInstanceDashboard', () => {
+  it('renders', async () => {
+    withSuccessResponse();
+
+    renderComponent();
+
+    await waitForLoading();
+
+    expect(screen.getByText('Insights')).toBeInTheDocument();
+    expect(screen.getByText('Version Compatibility')).toBeInTheDocument();
+
+    const upToDate = screen.getByLabelText('Up to date');
+    expect(within(upToDate).getByText('100 (57%)')).toBeInTheDocument();
+
+    const patch = screen.getByLabelText('Patch available');
+    expect(within(patch).getByText('50 (29%)')).toBeInTheDocument();
+
+    const upgrade = screen.getByLabelText('Upgrade required');
+    expect(within(upgrade).getByText('25 (14%)')).toBeInTheDocument();
+
+    const unsupported = screen.getByLabelText('Unsupported');
+    expect(within(unsupported).getByText('0 (0%)')).toBeInTheDocument();
+
+    expect(
+      screen.getByText('Select a category above to filter bot instances.')
+    ).toBeInTheDocument();
+  });
+
+  it('shows no data message', async () => {
+    withSuccessResponse({
+      upgrade_statuses: null,
+      refresh_after_seconds: 60_000,
+    });
+
+    renderComponent();
+
+    await waitForLoading();
+
+    expect(screen.getByText('No data available')).toBeInTheDocument();
+    expect(
+      screen.queryByText('Select a status above to view instances.')
+    ).not.toBeInTheDocument();
+  });
+
+  it('shows an error', async () => {
+    withErrorResponse(500, 'something went wrong');
+
+    renderComponent();
+
+    await waitForLoading();
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+    expect(
+      screen.queryByText('Select a status above to view instances.')
+    ).not.toBeInTheDocument();
+  });
+
+  it('items are selectable', async () => {
+    const onFilterSelected = jest.fn();
+
+    withSuccessResponse();
+
+    const { user } = renderComponent({ props: { onFilterSelected } });
+
+    await waitForLoading();
+
+    {
+      const item = screen.getByLabelText('Up to date');
+      await user.click(item);
+      expect(onFilterSelected).toHaveBeenCalledTimes(1);
+      expect(onFilterSelected).toHaveBeenLastCalledWith(
+        'mock up-to-date filter'
+      );
+    }
+
+    {
+      const item = screen.getByLabelText('Patch available');
+      await user.click(item);
+      expect(onFilterSelected).toHaveBeenCalledTimes(2);
+      expect(onFilterSelected).toHaveBeenLastCalledWith('mock patch filter');
+    }
+
+    {
+      const item = screen.getByLabelText('Upgrade required');
+      await user.click(item);
+      expect(onFilterSelected).toHaveBeenCalledTimes(3);
+      expect(onFilterSelected).toHaveBeenLastCalledWith('mock upgrade filter');
+    }
+
+    {
+      const item = screen.getByLabelText('Unsupported');
+      await user.click(item);
+      expect(onFilterSelected).toHaveBeenCalledTimes(4);
+      expect(onFilterSelected).toHaveBeenLastCalledWith(
+        'mock unsupported filter'
+      );
+    }
+  });
+
+  it('refreshes', async () => {
+    const onFilterSelected = jest.fn();
+
+    withSuccessResponse();
+
+    const { user } = renderComponent({ props: { onFilterSelected } });
+
+    await waitForLoading();
+
+    {
+      const upToDate = screen.getByLabelText('Up to date');
+      expect(within(upToDate).getByText('100 (57%)')).toBeInTheDocument();
+    }
+
+    withSuccessResponse({
+      upgrade_statuses: {
+        up_to_date: {
+          count: 99,
+        },
+        patch_available: {
+          count: 0,
+        },
+        requires_upgrade: {
+          count: 0,
+        },
+        unsupported: {
+          count: 0,
+        },
+        updated_at: '1970-01-01T00:00:00Z',
+      },
+      refresh_after_seconds: 60_000,
+    });
+
+    const refreshButton = screen.getByLabelText('refresh');
+    await user.click(refreshButton);
+
+    {
+      const upToDate = screen.getByLabelText('Up to date');
+      expect(within(upToDate).getByText('99 (100%)')).toBeInTheDocument();
+    }
+  });
+});
+
+function renderComponent(options?: {
+  props?: ComponentProps<typeof BotInstancesDashboard>;
+}) {
+  const { props } = options ?? {};
+  const { onFilterSelected = jest.fn() } = props ?? {};
+
+  const user = userEvent.setup();
+
+  return {
+    ...render(<BotInstancesDashboard onFilterSelected={onFilterSelected} />, {
+      wrapper: makeWrapper(),
+    }),
+    user,
+    history,
+  };
+}
+
+function makeWrapper() {
+  return ({ children }: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ConfiguredThemeProvider theme={darkTheme}>
+          {children}
+        </ConfiguredThemeProvider>
+      </QueryClientProvider>
+    );
+  };
+}
+
+async function waitForLoading() {
+  await waitForElementToBeRemoved(() =>
+    screen.queryByTestId('loading-dashboard')
+  );
+}
+
+function withSuccessResponse(
+  mock: Parameters<typeof getBotInstanceMetricsSuccess>[0] = {
+    upgrade_statuses: {
+      up_to_date: {
+        count: 100,
+        filter: 'mock up-to-date filter',
+      },
+      patch_available: {
+        count: 50,
+        filter: 'mock patch filter',
+      },
+      requires_upgrade: {
+        count: 25,
+        filter: 'mock upgrade filter',
+      },
+      unsupported: {
+        count: 0,
+        filter: 'mock unsupported filter',
+      },
+      updated_at: new Date().toISOString(),
+    },
+    refresh_after_seconds: 60_000,
+  }
+) {
+  server.use(getBotInstanceMetricsSuccess(mock));
+}
+
+function withErrorResponse(
+  ...params: Parameters<typeof getBotInstanceMetricsError>
+) {
+  server.use(getBotInstanceMetricsError(...params));
+}
diff --git a/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.tsx b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.tsx
new file mode 100644
index 0000000000000..c6148dfd1bd11
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Dashboard/BotInstanceDashboard.tsx
@@ -0,0 +1,380 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { format, formatDistanceToNowStrict, parseISO } from 'date-fns';
+import { useEffect, useState } from 'react';
+import styled, { useTheme } from 'styled-components';
+
+import { Alert } from 'design/Alert/Alert';
+import Box from 'design/Box/Box';
+import ButtonIcon from 'design/ButtonIcon/ButtonIcon';
+import { CardTile } from 'design/CardTile/CardTile';
+import Flex from 'design/Flex';
+import { Refresh } from 'design/Icon';
+import { Indicator } from 'design/Indicator/Indicator';
+import Text, { H2, H3 } from 'design/Text';
+import { IconTooltip } from 'design/Tooltip';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+
+import { getBotInstanceMetrics } from 'teleport/services/bot/bot';
+import { GetBotInstanceMetricsResponse } from 'teleport/services/bot/types';
+
+export function BotInstancesDashboard(props: {
+  /**
+   * Callback used when a dashbaord item is selected (e.g. "unsupported"
+   * instance versions). The given filter is used as an advanced query (in the
+   * Teleport predicate language) to filter the items in the instances list.
+   *
+   * @param filter query (verbatum) used to filter the bot instance list.
+   */
+  onFilterSelected: (filter: string) => void;
+}) {
+  const { onFilterSelected } = props;
+
+  const { data, error, isLoading, isPending, refetch } = useQuery({
+    queryKey: ['bot_instance', 'metrics'],
+    queryFn: ({ signal }) => getBotInstanceMetrics(null, signal),
+    // The metrics endpoint (used by this query) returns a
+    // `refresh_after_seconds` value to indicate how frequently the client
+    // should poll for updated metrics, which may take jitter into account. This
+    // allows the polling rate to most closely match the backend data refresh,
+    // and allows the rate to be controlled server-side.
+    //
+    // The `refetchInterval` is set to this value from the lasty successful
+    // response, otherwise 1 min as a fallback.
+    refetchInterval: ({ state }) =>
+      (state.data?.refresh_after_seconds ?? 60) * 1_000,
+  });
+
+  // Used to keep "Last updated x minutes ago" label current
+  useTick(30_000);
+
+  return (
+    <Container>
+      <TitleContainer>
+        <H2>Insights</H2>
+        <HoverTooltip placement="top" tipContent={'Refresh metrics'}>
+          <ButtonIcon
+            onClick={() => refetch()}
+            aria-label="refresh"
+            disabled={isLoading}
+          >
+            <Refresh size="medium" />
+          </ButtonIcon>
+        </HoverTooltip>
+      </TitleContainer>
+      <Divider />
+
+      {error ? (
+        <Alert kind="danger" m={3}>
+          {error.message}
+        </Alert>
+      ) : undefined}
+
+      {isLoading ? (
+        <Box data-testid="loading-dashboard" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      ) : undefined}
+
+      {isPending ? undefined : (
+        <>
+          <InnerContainer>
+            <UpgradeStatusChart
+              data={data?.upgrade_statuses}
+              onFilterSelected={onFilterSelected}
+            />
+          </InnerContainer>
+
+          {data?.upgrade_statuses ? (
+            <Alert kind="info" ml={5} mr={5} mt={3}>
+              Select a category above to filter bot instances.
+            </Alert>
+          ) : undefined}
+        </>
+      )}
+    </Container>
+  );
+}
+
+const Container = styled(CardTile)`
+  flex-direction: column;
+  flex-basis: 100%;
+  margin: ${props => props.theme.space[1]}px;
+  padding: 0;
+  gap: 0;
+`;
+
+const TitleContainer = styled(Flex)`
+  align-items: center;
+  justify-content: space-between;
+  min-height: ${p => p.theme.space[8]}px;
+  padding-left: ${p => p.theme.space[3]}px;
+  padding-right: ${p => p.theme.space[3]}px;
+  gap: ${p => p.theme.space[2]}px;
+`;
+
+const Divider = styled.div`
+  height: 1px;
+  flex-shrink: 0;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+`;
+
+const InnerContainer = styled(Flex)`
+  overflow: auto;
+  flex-direction: column;
+  padding: ${p => p.theme.space[3]}px;
+`;
+
+function UpgradeStatusChart(props: {
+  data: GetBotInstanceMetricsResponse['upgrade_statuses'];
+  onFilterSelected: (status: string) => void;
+}) {
+  const { data, onFilterSelected } = props;
+
+  const theme = useTheme();
+
+  const max = Math.max(
+    1, // Never zero
+    data?.up_to_date?.count ?? 0,
+    data?.patch_available?.count ?? 0,
+    data?.requires_upgrade?.count ?? 0,
+    data?.unsupported?.count ?? 0
+  );
+
+  const total = Math.max(
+    1, // Never zero
+    (data?.up_to_date?.count ?? 0) +
+      (data?.patch_available?.count ?? 0) +
+      (data?.requires_upgrade?.count ?? 0) +
+      (data?.unsupported?.count ?? 0)
+  );
+
+  const series = data
+    ? [
+        {
+          name: 'Up to date',
+          percent: (data.up_to_date?.count ?? 0) / max,
+          count: data.up_to_date?.count ?? 0,
+          label: `${data.up_to_date?.count ?? 0}\xa0(${formatPercent((data.up_to_date?.count ?? 0) / total)})`,
+          color: theme.colors.interactive.solid.success.default,
+          onClick: () =>
+            data.up_to_date?.filter
+              ? onFilterSelected(data.up_to_date?.filter)
+              : undefined,
+          tooltip:
+            'Up-to-date instances are running the same version as the Teleport cluster.',
+        },
+        {
+          name: 'Patch available',
+          percent: (data.patch_available?.count ?? 0) / max,
+          count: data.patch_available?.count ?? 0,
+          label: `${data.patch_available?.count ?? 0}\xa0(${formatPercent((data.patch_available?.count ?? 0) / total)})`,
+          color: theme.colors.interactive.solid.accent.default,
+          onClick: () =>
+            data.patch_available?.filter
+              ? onFilterSelected(data.patch_available?.filter)
+              : undefined,
+          tooltip:
+            'Instances with a patch available are running the same major version as the Teleport cluster.',
+        },
+        {
+          name: 'Upgrade required',
+          percent: (data.requires_upgrade?.count ?? 0) / max,
+          count: data.requires_upgrade?.count ?? 0,
+          label: `${data.requires_upgrade?.count ?? 0}\xa0(${formatPercent((data.requires_upgrade?.count ?? 0) / total)})`,
+          color: theme.colors.interactive.solid.alert.default,
+          onClick: () =>
+            data.requires_upgrade?.filter
+              ? onFilterSelected(data.requires_upgrade?.filter)
+              : undefined,
+          tooltip:
+            'Instances requiring an upgrade are running the one major version behind the Teleport cluster.',
+        },
+        {
+          name: 'Unsupported',
+          percent: (data.unsupported?.count ?? 0) / max,
+          count: data.unsupported?.count ?? 0,
+          label: `${data.unsupported?.count ?? 0}\xa0(${formatPercent((data.unsupported?.count ?? 0) / total)})`,
+          color: theme.colors.interactive.solid.danger.default,
+          onClick: () =>
+            data.unsupported?.filter
+              ? onFilterSelected(data.unsupported?.filter)
+              : undefined,
+          tooltip:
+            'Unsupported instances are running two or more major versions behind the Teleport cluster, or are running a newer version.',
+        },
+      ]
+    : null;
+
+  return (
+    <UpgradeStatusContainer>
+      <Flex alignItems={'center'} justifyContent={'space-between'}>
+        <H3>Version Compatibility</H3>
+        {data?.updated_at ? (
+          <HoverTooltip
+            placement="top"
+            tipContent={format(parseISO(data.updated_at), 'PP, p z')}
+          >
+            <ChartUpdatedAtText>
+              Last updated{' '}
+              {formatDistanceToNowStrict(parseISO(data.updated_at))} ago
+            </ChartUpdatedAtText>
+          </HoverTooltip>
+        ) : undefined}
+      </Flex>
+      <BarsContainer>
+        {series ? (
+          series.map(s => (
+            <SeriesContainer
+              key={s.name}
+              onClick={s.onClick}
+              onKeyUp={event => {
+                if (event.key === 'Enter') {
+                  s.onClick();
+                }
+              }}
+              role="button"
+              tabIndex={0}
+              aria-label={`${s.name}`}
+            >
+              <ChartLabelContainer>
+                <ChartLabelText>{s.name}</ChartLabelText>
+                <IconTooltip kind="info" position="top">
+                  {s.tooltip}
+                </IconTooltip>
+              </ChartLabelContainer>
+              <Bar percent={s.percent} label={s.label} color={s.color} />
+            </SeriesContainer>
+          ))
+        ) : (
+          <ChartNoDataContainer>No data available</ChartNoDataContainer>
+        )}
+      </BarsContainer>
+    </UpgradeStatusContainer>
+  );
+}
+
+const UpgradeStatusContainer = styled(Flex)`
+  flex-direction: column;
+  padding: ${({ theme }) => theme.space[3]}px;
+  border-radius: ${({ theme }) => theme.space[2]}px;
+  gap: ${({ theme }) => theme.space[3]}px;
+  border: 1px solid ${p => p.theme.colors.interactive.tonal.neutral[0]};
+`;
+
+const BarsContainer = styled(Flex)`
+  flex-direction: column;
+`;
+
+const SeriesContainer = styled.div`
+  padding: ${({ theme }) => theme.space[2]}px ${({ theme }) => theme.space[3]}px;
+  border-radius: ${({ theme }) => theme.space[2]}px;
+
+  cursor: pointer;
+
+  &:hover {
+    background-color: ${({ theme }) => theme.colors.levels.sunken};
+  }
+  &:focus,
+  &:active {
+    outline: none;
+
+    background-color: ${({ theme }) => theme.colors.levels.deep};
+  }
+
+  transition: background-color 200ms linear;
+`;
+
+const ChartLabelContainer = styled(Flex)`
+  align-items: center;
+  gap: ${({ theme }) => theme.space[2]}px;
+`;
+
+const ChartLabelText = styled(Text)`
+  white-space: nowrap;
+  font-size: ${({ theme }) => theme.fontSizes[1]}px;
+`;
+
+const ChartNoDataContainer = styled(Flex)`
+  align-items: center;
+  justify-content: center;
+  padding: ${({ theme }) => theme.space[4]}px;
+  color: ${({ theme }) => theme.colors.text.muted};
+`;
+
+const ChartUpdatedAtText = styled(Text)`
+  font-size: ${({ theme }) => theme.fontSizes[1]}px;
+  font-weight: ${({ theme }) => theme.fontWeights.medium};
+  text-align: right;
+`;
+
+function Bar(props: { percent: number; label: string; color: string }) {
+  const { percent, label, color } = props;
+
+  return (
+    <BarContainer>
+      <BarAmount $percent={percent} $color={color} />
+      <BarLabel $percent={percent}>{label}</BarLabel>
+    </BarContainer>
+  );
+}
+
+const BarContainer = styled(Flex)`
+  align-items: center;
+  gap: ${({ theme }) => theme.space[2]}px;
+`;
+
+const BarAmount = styled.div<{ $percent: number; $color: string }>`
+  flex-grow: ${({ $percent }) => $percent};
+  background-color: ${({ $color }) => $color};
+  height: ${({ theme }) => theme.space[3]}px;
+  border-radius: ${({ theme }) => theme.space[1]}px;
+  min-width: ${({ theme }) => theme.space[1]}px;
+
+  transition: flex-grow 1000ms ease-in-out;
+`;
+
+const BarLabel = styled.div<{ $percent: number }>`
+  flex-grow: ${({ $percent }) => 1 - $percent};
+
+  transition: flex-grow 1000ms ease-in-out;
+`;
+
+function formatPercent(percent: number) {
+  return `${(percent * 100).toFixed(0)}%`;
+}
+
+/**
+ * A hook which ticks at the given interval and will cause a re-render of
+ * components which use it. Useful for updating messaging such as "updated 10
+ * seconds ago".
+ * @param interval how often to tick (in milliseconds)
+ * @returns A date instance representing the last tick
+ */
+function useTick(interval: number) {
+  const [tick, setTick] = useState(new Date());
+
+  useEffect(() => {
+    const id = setInterval(() => setTick(new Date()), interval);
+    return () => clearInterval(id);
+  });
+
+  return tick;
+}
diff --git a/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.story.tsx b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.story.tsx
new file mode 100644
index 0000000000000..6b2a7224192fd
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.story.tsx
@@ -0,0 +1,143 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { useState } from 'react';
+
+import { CardTile } from 'design/CardTile';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  getBotInstanceError,
+  getBotInstanceForever,
+  getBotInstanceSuccess,
+  mockGetBotInstanceResponse,
+} from 'teleport/test/helpers/botInstances';
+
+import { BotInstanceDetails } from './BotInstanceDetails';
+
+const meta = {
+  title: 'Teleport/BotInstances/Details',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceSuccess()],
+    },
+  },
+};
+
+export const ZeroServices: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotInstanceSuccess({
+          ...mockGetBotInstanceResponse,
+          bot_instance: {
+            ...mockGetBotInstanceResponse.bot_instance,
+            status: {
+              ...mockGetBotInstanceResponse.bot_instance.status,
+              service_health: [],
+            },
+          },
+        }),
+      ],
+    },
+  },
+};
+
+export const ErrorLoadingList: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceError(500, 'something went wrong')],
+    },
+  },
+};
+
+export const StillLoadingList: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceForever()],
+    },
+  },
+};
+
+export const NoReadPermission: Story = {
+  args: {
+    hasBotInstanceReadPermission: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [getBotInstanceError(500, 'this call should never be made')],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(props?: { hasBotInstanceReadPermission?: boolean }) {
+  const { hasBotInstanceReadPermission = true } = props ?? {};
+
+  const [activeTab, setActiveTab] = useState('info');
+
+  const customAcl = makeAcl({
+    botInstances: {
+      ...defaultAccess,
+      read: hasBotInstanceReadPermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <CardTile height={600} overflow={'auto'} p={0}>
+          <BotInstanceDetails
+            botName="ansible-worker"
+            instanceId="a55259e8-9b17-466f-9d37-ab390ca4024e"
+            onClose={() => {}}
+            activeTab={activeTab}
+            onTabSelected={tab => setActiveTab(tab)}
+          />
+        </CardTile>
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.test.tsx b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.test.tsx
index b347c96b79daa..efe8f93f14dfe 100644
--- a/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.test.tsx
+++ b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.test.tsx
@@ -18,20 +18,24 @@
 
 import { QueryClientProvider } from '@tanstack/react-query';
 import { setupServer } from 'msw/node';
-import { PropsWithChildren } from 'react';
-import { MemoryRouter, useHistory } from 'react-router';
+import { ComponentProps, PropsWithChildren } from 'react';
 
 import darkTheme from 'design/theme/themes/darkTheme';
 import { ConfiguredThemeProvider } from 'design/ThemeProvider';
-import { copyToClipboard } from 'design/utils/copyToClipboard';
 import {
-  fireEvent,
   render,
   screen,
   testQueryClient,
+  userEvent,
   waitForElementToBeRemoved,
+  within,
 } from 'design/utils/testing';
 
+import 'shared/components/TextEditor/TextEditor.mock';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
 import {
   getBotInstanceError,
   getBotInstanceSuccess,
@@ -39,35 +43,9 @@ import {
 
 import { BotInstanceDetails } from './BotInstanceDetails';
 
-jest.mock('react-router', () => {
-  const actual = jest.requireActual('react-router');
-  return {
-    ...actual,
-    useHistory: jest.fn(),
-    useParams: jest.fn(() => ({
-      botName: 'test-bot-name',
-      instanceId: '4fa10e68-f2e0-4cf9-ad5b-1458febcd827',
-    })),
-  };
-});
-
-jest.mock('shared/components/TextEditor/TextEditor', () => {
-  return {
-    __esModule: true,
-    default: MockTextEditor,
-  };
-});
-
-jest.mock('design/utils/copyToClipboard', () => {
-  return {
-    __esModule: true,
-    copyToClipboard: jest.fn(),
-  };
-});
-
 const server = setupServer();
 
-beforeEach(() => {
+beforeAll(() => {
   server.listen();
 });
 
@@ -80,94 +58,78 @@ afterEach(async () => {
 
 afterAll(() => server.close());
 
-const withSuccessResponse = () => {
-  server.use(
-    getBotInstanceSuccess({
-      bot_instance: {
-        spec: {
-          instance_id: '4fa10e68-f2e0-4cf9-ad5b-1458febcd827',
-        },
-      },
-      yaml: 'kind: bot_instance\nversion: v1\n',
-    })
-  );
-};
-
-const withErrorResponse = () => {
-  server.use(getBotInstanceError(500));
-};
-
 describe('BotIntanceDetails', () => {
-  it('Allows back navigation', async () => {
-    const goBack = jest.fn();
-    jest.mocked(useHistory).mockImplementation(
-      () =>
-        ({
-          goBack,
-        }) as unknown as ReturnType<typeof useHistory>
-    );
-
+  it('Allows close action', async () => {
+    const onClose = jest.fn();
     withSuccessResponse();
 
-    render(<BotInstanceDetails />, { wrapper: Wrapper });
+    const { user } = renderComponent({ props: { onClose } });
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    const backButton = screen.getByLabelText('back');
-    fireEvent.click(backButton);
+    const closeButton = screen.getByLabelText('close');
+    await user.click(closeButton);
 
-    expect(goBack).toHaveBeenCalledTimes(1);
+    expect(onClose).toHaveBeenCalledTimes(1);
   });
 
-  it('Shows the short instance id', async () => {
+  it('Allows switching tab', async () => {
+    const onTabSelected = jest.fn();
+
     withSuccessResponse();
 
-    render(<BotInstanceDetails />, { wrapper: Wrapper });
+    const { user } = renderComponent({ props: { onTabSelected } });
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    expect(screen.getByText('4fa10e6')).toBeInTheDocument();
+    const overviewTab = screen.getByRole('tab', { name: 'Overview' });
+    await user.click(overviewTab);
+    expect(onTabSelected).toHaveBeenCalledTimes(1);
+    expect(onTabSelected).toHaveBeenLastCalledWith('info');
+
+    const servicesTab = screen.getByRole('tab', { name: 'Services' });
+    await user.click(servicesTab);
+    expect(onTabSelected).toHaveBeenCalledTimes(2);
+    expect(onTabSelected).toHaveBeenLastCalledWith('health');
+
+    const yamlTab = screen.getByRole('tab', { name: 'YAML' });
+    await user.click(yamlTab);
+    expect(onTabSelected).toHaveBeenCalledTimes(3);
+    expect(onTabSelected).toHaveBeenLastCalledWith('yaml');
   });
 
-  it('Allows the full instance id to be copied', async () => {
+  it('Shows instance info', async () => {
     withSuccessResponse();
 
-    render(<BotInstanceDetails />, { wrapper: Wrapper });
+    renderComponent({ props: { activeTab: 'info' } });
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    const copyButton = screen.getByLabelText('copy');
-    fireEvent.click(copyButton);
-
-    expect(copyToClipboard).toHaveBeenCalledTimes(1);
-    expect(copyToClipboard).toHaveBeenLastCalledWith(
-      '4fa10e68-f2e0-4cf9-ad5b-1458febcd827'
-    );
+    const summarySection = screen
+      .getByRole('heading', {
+        name: 'Summary',
+      })
+      .closest('section');
+    expect(
+      within(summarySection!).getByText('test-bot-name')
+    ).toBeInTheDocument();
   });
 
-  it('Shows a docs link', async () => {
-    const onClick = jest.fn(e => {
-      e.preventDefault();
-    });
-
+  it('Shows instance services', async () => {
     withSuccessResponse();
 
-    render(<BotInstanceDetails onDocsLinkClickedForTesting={onClick} />, {
-      wrapper: Wrapper,
-    });
+    renderComponent({ props: { activeTab: 'health' } });
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
-    const docsButton = screen.getByText('View Documentation');
-    fireEvent.click(docsButton);
-
-    expect(onClick).toHaveBeenCalledTimes(1);
+    const item = screen.getByTestId('application-tunnel-1');
+    expect(within(item!).getByText('application-tunnel-1')).toBeInTheDocument();
   });
 
   it('Shows full yaml', async () => {
     withSuccessResponse();
 
-    render(<BotInstanceDetails />, { wrapper: Wrapper });
+    renderComponent({ props: { activeTab: 'yaml' } });
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
@@ -179,32 +141,92 @@ describe('BotIntanceDetails', () => {
   it('Shows an error', async () => {
     withErrorResponse();
 
-    render(<BotInstanceDetails />, { wrapper: Wrapper });
+    renderComponent();
 
     await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
 
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
+
+  it('Shows a permisison warning', async () => {
+    withErrorResponse();
+
+    renderComponent({
+      hasBotInstanceReadPermission: false,
+    });
+
     expect(
-      screen.getByText('Error: 500', { exact: false })
+      screen.getByText('You do not have permission to read Bot instances', {
+        exact: false,
+      })
     ).toBeInTheDocument();
+
+    expect(screen.getByText('bot_instance.read')).toBeInTheDocument();
   });
 });
 
-function Wrapper(props: PropsWithChildren) {
-  return (
-    <MemoryRouter>
+const renderComponent = (options?: {
+  props?: Partial<ComponentProps<typeof BotInstanceDetails>>;
+  hasBotInstanceReadPermission?: boolean;
+}) => {
+  const { props, ...rest } = options ?? {};
+  const {
+    botName = 'test-bot-name',
+    instanceId = '4fa10e68-f2e0-4cf9-ad5b-1458febcd827',
+    onClose = jest.fn(),
+    activeTab = 'info',
+    onTabSelected = jest.fn(),
+  } = props ?? {};
+
+  const user = userEvent.setup();
+
+  return {
+    ...render(
+      <BotInstanceDetails
+        botName={botName}
+        instanceId={instanceId}
+        onClose={onClose}
+        activeTab={activeTab}
+        onTabSelected={onTabSelected}
+      />,
+      {
+        wrapper: makeWrapper(rest),
+      }
+    ),
+    user,
+  };
+};
+
+function makeWrapper(options?: { hasBotInstanceReadPermission?: boolean }) {
+  const { hasBotInstanceReadPermission = true } = options ?? {};
+
+  const customAcl = makeAcl({
+    botInstances: {
+      ...defaultAccess,
+      read: hasBotInstanceReadPermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+  return (props: PropsWithChildren) => {
+    return (
       <QueryClientProvider client={testQueryClient}>
-        <ConfiguredThemeProvider theme={darkTheme}>
-          {props.children}
-        </ConfiguredThemeProvider>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            {props.children}
+          </ConfiguredThemeProvider>
+        </TeleportProviderBasic>
       </QueryClientProvider>
-    </MemoryRouter>
-  );
+    );
+  };
 }
 
-function MockTextEditor(props: { data?: [{ content: string }] }) {
-  return (
-    <div data-testid="mock-text-editor">
-      {props.data?.map(d => <div key={d.content}>{d.content}</div>)}
-    </div>
-  );
-}
+const withSuccessResponse = () => {
+  server.use(getBotInstanceSuccess());
+};
+
+const withErrorResponse = () => {
+  server.use(getBotInstanceError(500, 'something went wrong'));
+};
diff --git a/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.tsx b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.tsx
index 717857865009c..83bf5689f16ec 100644
--- a/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.tsx
+++ b/web/packages/teleport/src/BotInstances/Details/BotInstanceDetails.tsx
@@ -16,131 +16,212 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { MouseEventHandler, useCallback } from 'react';
-import { useHistory, useParams } from 'react-router';
 import styled from 'styled-components';
 
 import { Alert } from 'design/Alert/Alert';
 import Box from 'design/Box/Box';
-import { ButtonBorder } from 'design/Button/Button';
 import ButtonIcon from 'design/ButtonIcon/ButtonIcon';
 import Flex from 'design/Flex/Flex';
-import { ArrowLeft } from 'design/Icon/Icons/ArrowLeft';
+import { Cross } from 'design/Icon/Icons/Cross';
 import { Indicator } from 'design/Indicator/Indicator';
-import Text from 'design/Text';
+import { TabBorder, TabContainer, TabsContainer } from 'design/Tabs/Tabs';
+import { useSlidingBottomBorderTabs } from 'design/Tabs/useSlidingBottomBorderTabs';
+import Text from 'design/Text/Text';
 import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
 import TextEditor from 'shared/components/TextEditor/TextEditor';
-import { CopyButton } from 'shared/components/UnifiedResources/shared/CopyButton';
 
-import {
-  FeatureBox,
-  FeatureHeader,
-  FeatureHeaderTitle,
-} from 'teleport/components/Layout/Layout';
+import useTeleport from 'teleport/useTeleport';
 
 import { useGetBotInstance } from '../hooks';
-
-const docsUrl =
-  'https://goteleport.com/docs/enroll-resources/machine-id/introduction/#bot-instances';
+import { HealthTab } from './HealthTab';
+import { InfoTab } from './InfoTab';
 
 export function BotInstanceDetails(props: {
-  onDocsLinkClickedForTesting?: MouseEventHandler<HTMLAnchorElement>;
+  botName: string;
+  instanceId: string;
+  onClose: () => void;
+  activeTab?: string | null;
+  onTabSelected: (tab: string) => void;
 }) {
-  const history = useHistory();
-  const params = useParams<{
-    botName: string;
-    instanceId: string;
-  }>();
+  const { botName, instanceId, onClose, activeTab, onTabSelected } = props;
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasReadPermission = flags.readBotInstances;
 
   const { data, error, isSuccess, isError, isLoading } = useGetBotInstance(
-    params,
     {
+      botName,
+      instanceId,
+    },
+    {
+      enabled: hasReadPermission,
       staleTime: 30_000, // Keep data in the cache for 30 seconds
     }
   );
 
-  const handleBackPress = useCallback(() => {
-    history.goBack();
-  }, [history]);
+  const tab = tabs.find(t => t.id === activeTab)?.id ?? 'info';
 
   return (
-    <FeatureBox>
-      <FeatureHeader justifyContent="space-between" gap={2}>
-        <Flex gap={2}>
-          <HoverTooltip placement="bottom" tipContent={'Go back'}>
-            <ButtonIcon onClick={handleBackPress} aria-label="back">
-              <ArrowLeft size="medium" />
-            </ButtonIcon>
-          </HoverTooltip>
-          <FeatureHeaderTitle>Bot instance</FeatureHeaderTitle>
-          {isSuccess && data.bot_instance?.spec?.instance_id ? (
-            <InstanceId>
-              <Flex inline alignItems={'center'} gap={1} mr={0}>
-                <MonoText>
-                  {data.bot_instance.spec.instance_id.substring(0, 7)}
-                </MonoText>
-                <CopyButton name={data.bot_instance.spec.instance_id} />
-              </Flex>
-            </InstanceId>
-          ) : undefined}
-        </Flex>
-
-        <ButtonBorder
-          size="medium"
-          as="a"
-          href={docsUrl}
-          target="_blank"
-          rel="noreferrer"
-          onClick={props.onDocsLinkClickedForTesting}
-        >
-          View Documentation
-        </ButtonBorder>
-      </FeatureHeader>
-
-      {isLoading ? (
-        <Box data-testid="loading" textAlign="center" m={10}>
-          <Indicator />
-        </Box>
-      ) : undefined}
-
-      {isError ? (
-        <Alert kind="danger">{`Error: ${error.message}`}</Alert>
-      ) : undefined}
-
-      {isSuccess && data.yaml ? (
-        <YamlContaner>
-          <TextEditor
-            bg="levels.elevated"
-            data={[
-              {
-                content: data.yaml,
-                type: 'yaml',
-              },
-            ]}
-            readOnly={true}
-          />
-        </YamlContaner>
-      ) : undefined}
-    </FeatureBox>
+    <Container>
+      <TitleContainer>
+        <TitleText>
+          {botName}/{instanceId}
+        </TitleText>
+        <HoverTooltip placement="top" tipContent={'Close'}>
+          <ButtonIcon onClick={() => onClose()} aria-label="close">
+            <Cross size="medium" />
+          </ButtonIcon>
+        </HoverTooltip>
+      </TitleContainer>
+      <Divider />
+      <ContentContainer>
+        {isLoading ? (
+          <Box data-testid="loading" textAlign="center" m={10}>
+            <Indicator />
+          </Box>
+        ) : undefined}
+
+        {isError ? (
+          <Alert m={3} kind="danger">
+            {error.message}
+          </Alert>
+        ) : undefined}
+
+        {!hasReadPermission ? (
+          <Alert kind="info" m={3}>
+            You do not have permission to read Bot instances. Missing role
+            permissions: <code>bot_instance.read</code>
+          </Alert>
+        ) : undefined}
+
+        {isSuccess ? (
+          <>
+            <Tabs activeTab={tab} onTabSelected={onTabSelected} />
+
+            {tab === 'info' ? (
+              <TabContentContainer>
+                <InfoTab
+                  data={data}
+                  onGoToServicesClick={() => onTabSelected('health')}
+                />
+              </TabContentContainer>
+            ) : undefined}
+
+            {tab === 'health' ? <HealthTab data={data} /> : undefined}
+
+            {tab === 'yaml' ? (
+              <TextEditor
+                bg="levels.sunken"
+                data={[
+                  {
+                    content: data.yaml,
+                    type: 'yaml',
+                  },
+                ]}
+                readOnly={true}
+              />
+            ) : undefined}
+          </>
+        ) : undefined}
+      </ContentContainer>
+    </Container>
   );
 }
 
-const MonoText = styled(Text)`
-  font-family: ${({ theme }) => theme.fonts.mono};
+const Container = styled.section`
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  border-left-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+  border-left-width: 1px;
+  border-left-style: solid;
+  overflow: hidden;
+  min-width: 300px;
 `;
 
-const InstanceId = styled.div`
-  display: flex;
+const TitleContainer = styled(Flex)`
   align-items: center;
-  padding-left: 8px;
-  padding-right: 6px;
-  height: 32px;
-  border-radius: 16px;
-  background-color: ${({ theme }) => theme.colors.interactive.tonal.neutral[0]};
+  justify-content: space-between;
+  min-height: ${p => p.theme.space[8]}px;
+  padding-left: ${p => p.theme.space[3]}px;
+  padding-right: ${p => p.theme.space[3]}px;
+  gap: ${p => p.theme.space[2]}px;
+  overflow: hidden;
 `;
 
-const YamlContaner = styled(Flex)`
+export const TitleText = styled(Text).attrs({
+  as: 'h2',
+  typography: 'h2',
+})`
   flex: 1;
-  border-radius: 8px;
-  background-color: ${({ theme }) => theme.colors.levels.elevated};
+  white-space: nowrap;
+`;
+
+const Divider = styled.div`
+  height: 1px;
+  flex-shrink: 0;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+`;
+
+const ContentContainer = styled.div`
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  min-height: 0;
+`;
+
+const TabContentContainer = styled(Flex)`
+  overflow: auto;
+  flex: 1;
+  background-color: ${({ theme }) => theme.colors.levels.surface};
+`;
+
+const tabs = [
+  {
+    id: 'info',
+    label: 'Overview',
+  },
+  {
+    id: 'health',
+    label: 'Services',
+  },
+  { id: 'yaml', label: 'YAML' },
+] as const;
+
+type TabId = (typeof tabs)[number]['id'];
+
+function Tabs(props: {
+  activeTab: TabId;
+  onTabSelected: (tab: TabId) => void;
+}) {
+  const { activeTab, onTabSelected } = props;
+  const { borderRef, parentRef } = useSlidingBottomBorderTabs({ activeTab });
+
+  return (
+    <StyledTabsContainer ref={parentRef} withBottomBorder role="tablist">
+      {tabs.map(t => (
+        <StyledTabContainer
+          key={t.id}
+          data-tab-id={t.id}
+          selected={activeTab === t.id}
+          onClick={() => onTabSelected(t.id)}
+          role="tab"
+        >
+          {t.label}
+        </StyledTabContainer>
+      ))}
+      <TabBorder ref={borderRef} />
+    </StyledTabsContainer>
+  );
+}
+
+const StyledTabsContainer = styled(TabsContainer)`
+  gap: 0;
+`;
+
+const StyledTabContainer = styled(TabContainer)`
+  padding: ${p => p.theme.space[2]}px ${p => p.theme.space[3]}px;
+  font-weight: ${p => p.theme.fontWeights.medium};
+  font-size: ${p => p.theme.fontSizes[2]}px;
 `;
diff --git a/web/packages/teleport/src/BotInstances/Details/HealthTab.test.tsx b/web/packages/teleport/src/BotInstances/Details/HealthTab.test.tsx
new file mode 100644
index 0000000000000..a3f804c062659
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Details/HealthTab.test.tsx
@@ -0,0 +1,126 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import userEvent from '@testing-library/user-event';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import { render, screen, within } from 'design/utils/testing';
+
+import { mockGetBotInstanceResponse } from 'teleport/test/helpers/botInstances';
+
+import { HealthTab } from './HealthTab';
+
+beforeAll(() => {
+  jest.useFakeTimers({
+    now: new Date('2025-10-10T11:00:00Z'),
+  });
+});
+
+afterAll(() => {
+  jest.useRealTimers();
+});
+
+describe('HealthTab', () => {
+  // eslint-disable-next-line jest/expect-expect
+  it('renders', async () => {
+    renderComponent();
+
+    expectItem({
+      name: 'application-tunnel-1',
+      type: 'application-tunnel',
+      updatedAt: 'Reported 15 minutes ago',
+      status: 'Healthy',
+    });
+
+    expectItem({
+      name: 'db-eu-lon-1',
+      type: 'database-tunnel',
+      updatedAt: 'Reported 14 minutes ago',
+      status: 'Unhealthy',
+      reason: 'permission denied',
+    });
+
+    expectItem({
+      name: 'workload-identity-aws-roles-anywhere-1',
+      type: 'workload-identity-aws-roles-anywhere',
+      updatedAt: 'Reported 13 minutes ago',
+      status: 'Initializing',
+    });
+
+    expectItem({
+      name: 'application-tunnel-2',
+      type: 'application-tunnel',
+      updatedAt: 'Reported 12 minutes ago',
+      status: 'Unknown',
+    });
+  });
+
+  it('show an empty state', async () => {
+    renderComponent({
+      data: {
+        bot_instance: {
+          status: {
+            service_health: [],
+          },
+        },
+      },
+    });
+
+    expect(screen.getByText('No reported services')).toBeInTheDocument();
+  });
+});
+
+function expectItem(match: {
+  name: string;
+  type: string;
+  updatedAt: string;
+  status: string;
+  reason?: string;
+}) {
+  const item = screen.getByTestId(match.name);
+  expect(within(item).getByText(match.name)).toBeInTheDocument();
+  expect(within(item).getByText(`Type: ${match.type}`)).toBeInTheDocument();
+  expect(within(item).getByText(match.updatedAt)).toBeInTheDocument();
+  expect(within(item).getByText(match.status)).toBeInTheDocument();
+  if (match.reason) {
+    expect(
+      within(item).getByText(match.reason, { exact: false })
+    ).toBeInTheDocument();
+  }
+}
+
+function renderComponent(props?: Partial<ComponentProps<typeof HealthTab>>) {
+  const { data = mockGetBotInstanceResponse } = props ?? {};
+  const user = userEvent.setup();
+
+  return {
+    ...render(<HealthTab data={data} />, { wrapper: makeWrapper() }),
+    user,
+    history,
+  };
+}
+
+function makeWrapper() {
+  return (props: PropsWithChildren) => (
+    <ConfiguredThemeProvider theme={darkTheme}>
+      {props.children}
+    </ConfiguredThemeProvider>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/Details/HealthTab.tsx b/web/packages/teleport/src/BotInstances/Details/HealthTab.tsx
new file mode 100644
index 0000000000000..63e1d1e6d64e8
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Details/HealthTab.tsx
@@ -0,0 +1,215 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import format from 'date-fns/format';
+import formatDistanceToNowStrict from 'date-fns/formatDistanceToNowStrict';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import { SecondaryOutlined } from 'design/Label/Label';
+import Text from 'design/Text';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+
+import {
+  BotInstanceServiceHealthStatus,
+  GetBotInstanceResponse,
+} from 'teleport/services/bot/types';
+
+export function HealthTab(props: { data: GetBotInstanceResponse }) {
+  const { data } = props;
+  const { bot_instance } = data ?? {};
+  const { status } = bot_instance ?? {};
+  const { service_health } = status ?? {};
+
+  return (
+    <Container>
+      {service_health?.length ? (
+        service_health
+          ?.toSorted((a, b) =>
+            (a.service?.name ?? '').localeCompare(b.service?.name ?? '')
+          )
+          .map(h =>
+            h.service?.name ? (
+              <ItemContainer key={h.service.name} data-testid={h.service.name}>
+                <Flex
+                  gap={3}
+                  alignItems={'flex-start'}
+                  justifyContent={'space-between'}
+                >
+                  <Flex flexDirection={'column'} overflow={'hidden'}>
+                    <TitleText>{h.service.name}</TitleText>
+                    {h.service.type ? (
+                      <Text typography="body3">Type: {h.service.type}</Text>
+                    ) : undefined}
+                  </Flex>
+
+                  <Flex
+                    flexDirection={'column'}
+                    alignItems={'flex-end'}
+                    gap={1}
+                  >
+                    {h.updated_at?.seconds ? (
+                      <HoverTooltip
+                        placement="top"
+                        tipContent={format(
+                          new Date(h.updated_at.seconds * 1000),
+                          'PP, p z'
+                        )}
+                      >
+                        <TimeText>{`Reported ${formatDistanceToNowStrict(new Date(h.updated_at.seconds * 1000))} ago`}</TimeText>
+                      </HoverTooltip>
+                    ) : undefined}
+                    <SecondaryOutlined>
+                      <Flex
+                        alignItems={'center'}
+                        gap={2}
+                        padding={1}
+                        paddingLeft={2}
+                        paddingRight={0}
+                      >
+                        <Text typography="body3">
+                          {makeHealthLabel(h.status)}
+                        </Text>
+                        <HealthStatusDot $status={h.status} />
+                      </Flex>
+                    </SecondaryOutlined>
+                  </Flex>
+                </Flex>
+
+                {h.reason ? (
+                  <ReasonContainer $status={h.status}>
+                    <ReasonInnerContainer>
+                      <ReasonText>{h.reason}</ReasonText>
+                    </ReasonInnerContainer>
+                  </ReasonContainer>
+                ) : undefined}
+              </ItemContainer>
+            ) : undefined
+          )
+      ) : (
+        <EmptyText>No reported services</EmptyText>
+      )}
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  flex-direction: column;
+  flex: 1;
+  min-width: 0;
+  padding: ${({ theme }) => theme.space[3]}px;
+  gap: ${({ theme }) => theme.space[3]}px;
+  overflow: auto;
+`;
+
+const ItemContainer = styled(Flex)`
+  flex-direction: column;
+  border: 1px solid ${p => p.theme.colors.interactive.tonal.neutral[0]};
+  border-radius: ${({ theme }) => theme.space[1]}px;
+  padding: ${({ theme }) => theme.space[3]}px;
+  gap: ${({ theme }) => theme.space[3]}px;
+`;
+
+export const HealthStatusDot = styled.div<{
+  $status: BotInstanceServiceHealthStatus | undefined;
+}>`
+  width: ${({ theme }) => theme.space[3] - theme.space[1]}px;
+  height: ${({ theme }) => theme.space[3] - theme.space[1]}px;
+  border-radius: 999px;
+  background-color: ${({ theme, $status }) =>
+    $status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+      ? theme.colors.interactive.solid.success.default
+      : $status ===
+          BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+        ? theme.colors.interactive.solid.danger.default
+        : $status ===
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+          ? theme.colors.interactive.tonal.neutral[1]
+          : theme.colors.interactive.solid.alert.default};
+`;
+
+const ReasonContainer = styled.div<{
+  $status: BotInstanceServiceHealthStatus | undefined;
+}>`
+  background-color: ${p => p.theme.colors.levels.sunken};
+  border-width: 0;
+  border-left-width: ${({ theme }) => theme.space[1]}px;
+  border-style: solid;
+  border-color: ${({ theme, $status }) =>
+    $status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+      ? theme.colors.interactive.solid.success.default
+      : $status ===
+          BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+        ? theme.colors.interactive.solid.danger.default
+        : $status ===
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+          ? theme.colors.interactive.tonal.neutral[1]
+          : theme.colors.interactive.solid.alert.default};
+  padding: 0 ${({ theme }) => theme.space[2]}px;
+  overflow: auto;
+`;
+
+const ReasonInnerContainer = styled.div`
+  width: max-content;
+`;
+
+const ReasonText = styled.code`
+  font-size: ${({ theme }) => theme.fontSizes[1]}px;
+  white-space: pre-wrap;
+  tab-size: ${({ theme }) => theme.space[3]}px;
+`;
+
+const TitleText = styled(Text).attrs({
+  typography: 'body2',
+})`
+  white-space: nowrap;
+  font-weight: ${({ theme }) => theme.fontWeights.medium};
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
+
+const TimeText = styled(Text).attrs({
+  typography: 'body4',
+})`
+  white-space: nowrap;
+`;
+
+function makeHealthLabel(status: BotInstanceServiceHealthStatus | undefined) {
+  if (
+    status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+  ) {
+    return 'Initializing';
+  }
+  if (
+    status === BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+  ) {
+    return 'Healthy';
+  }
+  if (
+    status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+  ) {
+    return 'Unhealthy';
+  }
+  return 'Unknown';
+}
diff --git a/web/packages/teleport/src/BotInstances/Details/InfoTab.test.tsx b/web/packages/teleport/src/BotInstances/Details/InfoTab.test.tsx
new file mode 100644
index 0000000000000..56437fc718508
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Details/InfoTab.test.tsx
@@ -0,0 +1,185 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// Required to allow using `.closest()` to find sections
+/* eslint-disable testing-library/no-node-access */
+
+import userEvent from '@testing-library/user-event';
+import { createMemoryHistory } from 'history';
+import { ComponentProps, PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import { darkTheme } from 'design/theme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import { render, screen, within } from 'design/utils/testing';
+
+import cfg from 'teleport/config';
+import { mockGetBotInstanceResponse } from 'teleport/test/helpers/botInstances';
+
+import { InfoTab } from './InfoTab';
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('InfoTab', () => {
+  it('renders summary section', async () => {
+    renderComponent();
+
+    const section = screen
+      .getByRole('heading', { name: 'Summary' })
+      .closest('section');
+    expect(section).toBeInTheDocument();
+
+    expectFieldAndValue('Bot name', 'test-bot-name', section);
+    expectFieldAndValue('Up time', '12h 1m', section);
+    expectFieldAndValue('Kind', 'tctl', section);
+    expectFieldAndValue('Version', 'v18.4.0', section);
+    expectFieldAndValue('OS', 'linux', section);
+    expectFieldAndValue('Hostname', 'test-hostname', section);
+  });
+
+  it('renders health section', async () => {
+    renderComponent();
+
+    const section = screen
+      .getByRole('heading', { name: 'Health Status' })
+      .closest('section');
+
+    expect(
+      within(section!).getByText(
+        (_, element) => element?.textContent === '1 of 4 services are healthy'
+      )
+    ).toBeInTheDocument();
+
+    expect(
+      within(section!).getByText('application-tunnel-1', {})
+    ).toBeInTheDocument();
+    expect(within(section!).getByText('db-eu-lon-1', {})).toBeInTheDocument();
+    expect(
+      within(section!).getByText('workload-identity-aws-roles-anywhere-1', {})
+    ).toBeInTheDocument();
+    expect(
+      within(section!).getByText('application-tunnel-2', {})
+    ).toBeInTheDocument();
+  });
+
+  it('renders join token section', async () => {
+    renderComponent();
+
+    const section = screen
+      .getByRole('heading', { name: 'Join Token' })
+      .closest('section');
+    expect(section).toBeInTheDocument();
+
+    expectFieldAndValue('Name', 'test-token-name', section);
+    expectFieldAndValue('Method', 'github', section);
+    expectFieldAndValue('Repository', 'gravitational/teleport', section);
+    expectFieldAndValue('Subject', 'test-github-sub', section);
+  });
+
+  it('navigate on bot name link click', async () => {
+    const { history, user } = renderComponent();
+    const pushMock = jest.spyOn(history, 'push');
+
+    const section = screen
+      .getByRole('heading', { name: 'Summary' })
+      .closest('section');
+    expect(section).toBeInTheDocument();
+
+    const link = within(section!).getByText('test-bot-name');
+    await user.click(link);
+
+    expect(pushMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).toHaveBeenLastCalledWith('/web/bot/test-bot-name');
+  });
+
+  it('navigate on join token name link click', async () => {
+    const { history, user } = renderComponent();
+    const pushMock = jest.spyOn(history, 'push');
+
+    const section = screen
+      .getByRole('heading', { name: 'Join Token' })
+      .closest('section');
+    expect(section).toBeInTheDocument();
+
+    const link = within(section!).getByText('test-token-name');
+    await user.click(link);
+
+    expect(pushMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).toHaveBeenLastCalledWith('/web/tokens');
+  });
+
+  it('callback on "view services" click', async () => {
+    const callback = jest.fn();
+    const { user } = renderComponent({ onGoToServicesClick: callback });
+
+    const section = screen
+      .getByRole('heading', { name: 'Health Status' })
+      .closest('section');
+
+    const button = within(section!).getByText('View Services');
+    await user.click(button);
+
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+});
+
+function expectFieldAndValue(
+  field: string,
+  value: string,
+  container?: HTMLElement | null
+) {
+  if (container) {
+    expect(within(container).getByText(field)).toBeInTheDocument();
+    expect(within(container).getByText(value)).toBeInTheDocument();
+  } else {
+    expect(screen.getByText(field)).toBeInTheDocument();
+    expect(screen.getByText(value)).toBeInTheDocument();
+  }
+}
+
+function renderComponent(props?: Partial<ComponentProps<typeof InfoTab>>) {
+  const { data = mockGetBotInstanceResponse, onGoToServicesClick = jest.fn() } =
+    props ?? {};
+  const user = userEvent.setup();
+
+  const history = createMemoryHistory({
+    initialEntries: [cfg.getBotInstancesRoute()],
+  });
+
+  return {
+    ...render(
+      <InfoTab data={data} onGoToServicesClick={onGoToServicesClick} />,
+      { wrapper: makeWrapper({ history }) }
+    ),
+    user,
+    history,
+  };
+}
+
+function makeWrapper(options: {
+  history: ReturnType<typeof createMemoryHistory>;
+}) {
+  return (props: PropsWithChildren) => (
+    <ConfiguredThemeProvider theme={darkTheme}>
+      {/* A Router with history is required to render <Link/> */}
+      <Router history={options.history}>{props.children}</Router>
+    </ConfiguredThemeProvider>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/Details/InfoTab.tsx b/web/packages/teleport/src/BotInstances/Details/InfoTab.tsx
new file mode 100644
index 0000000000000..393bab7e678ae
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/Details/InfoTab.tsx
@@ -0,0 +1,401 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import { Link } from 'react-router-dom';
+import styled from 'styled-components';
+
+import Box from 'design/Box/Box';
+import Flex from 'design/Flex/Flex';
+import { SecondaryOutlined } from 'design/Label/Label';
+import Text from 'design/Text';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+import { IconTooltip } from 'design/Tooltip/IconTooltip';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
+
+import { Panel } from 'teleport/Bots/Details/Panel';
+import { formatDuration } from 'teleport/Bots/formatDuration';
+import cfg from 'teleport/config';
+import {
+  BotInstanceKind,
+  BotInstanceServiceHealthStatus,
+  GetBotInstanceResponse,
+  GetBotInstanceResponseJoinAttrs,
+} from 'teleport/services/bot/types';
+
+import { HealthStatusDot } from './HealthTab';
+
+export function InfoTab(props: {
+  data: GetBotInstanceResponse;
+  onGoToServicesClick: () => void;
+}) {
+  const {
+    data: { bot_instance },
+    onGoToServicesClick,
+  } = props;
+
+  const { spec, status } = bot_instance ?? {};
+  const { bot_name } = spec ?? {};
+  const { latest_heartbeats, latest_authentications, service_health } =
+    status ?? {};
+  const latestHeartbeat = latest_heartbeats?.at(-1);
+  const { kind, uptime, version, os, hostname } = latestHeartbeat ?? {};
+  const latestAuthentication = latest_authentications?.at(-1);
+  const { join_attrs } = latestAuthentication ?? {};
+  const { meta } = join_attrs ?? {};
+  const { join_method, join_token_name } = meta ?? {};
+
+  const joinExtras = makeJoinExtras(join_attrs);
+
+  const { kindLabel, kindTooltip } = makeKindInfo(kind) ?? {};
+
+  const healthyCount =
+    service_health?.filter(
+      h =>
+        h.status ===
+        BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+    ).length ?? 0;
+  const totalCount = service_health?.length ?? 0;
+
+  return (
+    <Container>
+      <Panel title="Summary" isSubPanel>
+        <PanelContentContainer>
+          <Grid>
+            <GridLabel>Bot name</GridLabel>
+            {bot_name ? (
+              <Flex inline alignItems={'center'} gap={1} overflow={'hidden'}>
+                <GridValue>
+                  <StyledLink to={cfg.getBotDetailsRoute(bot_name)}>
+                    {bot_name}
+                  </StyledLink>
+                </GridValue>
+                <CopyButton value={bot_name} />
+              </Flex>
+            ) : (
+              '-'
+            )}
+            <GridLabel>Up time</GridLabel>
+            {uptime?.seconds
+              ? formatDuration(
+                  { seconds: uptime.seconds },
+                  {
+                    separator: ' ',
+                  }
+                )
+              : '-'}
+            <GridLabel>Kind</GridLabel>
+            {kindLabel ? (
+              <Flex inline alignItems={'center'} gap={1} overflow={'hidden'}>
+                <GridValue>{kindLabel}</GridValue>
+                <IconTooltip kind="info" position="top">
+                  {kindTooltip}
+                </IconTooltip>
+              </Flex>
+            ) : (
+              '-'
+            )}
+            <GridLabel>Version</GridLabel>
+            <GridValue>{version ? `v${version}` : '-'}</GridValue>
+            <GridLabel>OS</GridLabel>
+            <GridValue>{os || '-'}</GridValue>
+            <GridLabel>Hostname</GridLabel>
+            <GridValue>{hostname || '-'}</GridValue>
+          </Grid>
+        </PanelContentContainer>
+      </Panel>
+
+      <PaddedDivider />
+
+      <Panel
+        title="Health Status"
+        isSubPanel
+        action={{
+          label: 'View Services',
+          onClick: onGoToServicesClick,
+        }}
+      >
+        <PanelContentContainer gap={3}>
+          <div>
+            <AccentCountText as={'span'}>{healthyCount}</AccentCountText> of{' '}
+            {totalCount} services are healthy
+          </div>
+
+          <HealthLabelsContainer>
+            {service_health
+              ?.toSorted((a, b) =>
+                (a.service?.name ?? '').localeCompare(b.service?.name ?? '')
+              )
+              .map(h =>
+                h.service?.name ? (
+                  <HoverTooltip
+                    key={h.service.name}
+                    placement="top"
+                    tipContent={makeHealthTooltip(h.status)}
+                  >
+                    <SecondaryOutlined>
+                      <Flex
+                        alignItems={'center'}
+                        gap={2}
+                        padding={1}
+                        paddingLeft={0}
+                        paddingRight={2}
+                      >
+                        <HealthStatusDot $status={h.status} />
+                        <HealthLabelText>{h.service.name}</HealthLabelText>
+                      </Flex>
+                    </SecondaryOutlined>
+                  </HoverTooltip>
+                ) : undefined
+              )}
+          </HealthLabelsContainer>
+        </PanelContentContainer>
+      </Panel>
+
+      <PaddedDivider />
+
+      <Panel title="Join Token" isSubPanel>
+        <PanelContentContainer>
+          <Grid>
+            <GridLabel>Name</GridLabel>
+            {join_token_name ? (
+              <Flex inline alignItems={'center'} gap={1} overflow={'hidden'}>
+                <GridValue>
+                  <StyledLink to={cfg.getJoinTokensRoute()}>
+                    {join_token_name}
+                  </StyledLink>
+                </GridValue>
+                <CopyButton value={join_token_name} />
+              </Flex>
+            ) : (
+              '-'
+            )}
+            <GridLabel>Method</GridLabel>
+            <GridValue>{join_method || '-'}</GridValue>
+
+            {joinExtras
+              ? joinExtras.map(([label, value]) => (
+                  <React.Fragment key={label}>
+                    <GridLabel>{label}</GridLabel>
+                    <GridValue>{value || '-'}</GridValue>
+                  </React.Fragment>
+                ))
+              : undefined}
+          </Grid>
+        </PanelContentContainer>
+      </Panel>
+    </Container>
+  );
+}
+
+const Container = styled.div`
+  flex: 1;
+  min-width: 0;
+`;
+
+const PanelContentContainer = styled(Flex)`
+  flex-direction: column;
+  padding: ${props => props.theme.space[3]}px;
+  padding-top: 0;
+  overflow: hidden;
+`;
+
+const Grid = styled(Box)`
+  align-self: flex-start;
+  display: grid;
+  grid-template-columns: repeat(2, auto);
+  gap: ${({ theme }) => theme.space[2]}px;
+  overflow: hidden;
+`;
+
+const GridLabel = styled(Text)`
+  color: ${({ theme }) => theme.colors.text.muted};
+  font-weight: ${({ theme }) => theme.fontWeights.regular};
+  padding-right: ${({ theme }) => theme.space[2]}px;
+`;
+
+const GridValue = styled(Text)`
+  white-space: nowrap;
+`;
+
+const PaddedDivider = styled.div`
+  height: 1px;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+  flex-shrink: 0;
+  margin-left: ${props => props.theme.space[3]}px;
+  margin-right: ${props => props.theme.space[3]}px;
+`;
+
+const HealthLabelsContainer = styled(Flex)`
+  flex-wrap: wrap;
+  overflow: hidden;
+  gap: ${props => props.theme.space[1]}px;
+`;
+
+const HealthLabelText = styled(Text).attrs({
+  typography: 'body3',
+})`
+  white-space: nowrap;
+`;
+
+const AccentCountText = styled(Text)`
+  font-size: ${({ theme }) => theme.fontSizes[8]}px;
+  font-weight: ${({ theme }) => theme.fontWeights.light}px;
+`;
+
+const StyledLink = styled(Link)`
+  color: ${({ theme }) => theme.colors.interactive.solid.accent.default};
+  background: none;
+  text-decoration: underline;
+  text-transform: none;
+
+  &:hover {
+    color: ${({ theme }) => theme.colors.interactive.solid.accent.hover};
+  }
+
+  &:active {
+    color: ${({ theme }) => theme.colors.interactive.solid.accent.active};
+  }
+`;
+
+function makeKindInfo(kind: BotInstanceKind | undefined) {
+  if (kind === BotInstanceKind.BOT_KIND_TBOT) {
+    return {
+      kindLabel: 'tbot',
+      kindTooltip: 'This instance is running using the tbot CLI.',
+    };
+  }
+  if (kind === BotInstanceKind.BOT_KIND_TERRAFORM_PROVIDER) {
+    return {
+      kindLabel: 'Terraform',
+      kindTooltip:
+        'This instance is running using the Teleport Terraform Provider.',
+    };
+  }
+  if (kind === BotInstanceKind.BOT_KIND_KUBERNETES_OPERATOR) {
+    return {
+      kindLabel: 'Kubernetes',
+      kindTooltip:
+        'This instance is running using the Teleport Kubernetes Operator.',
+    };
+  }
+  if (kind === BotInstanceKind.BOT_KIND_TCTL) {
+    return {
+      kindLabel: 'tctl',
+      kindTooltip: 'This instance is running inside tctl.',
+    };
+  }
+
+  return undefined;
+}
+
+function makeHealthTooltip(status: BotInstanceServiceHealthStatus | undefined) {
+  if (
+    status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+  ) {
+    return 'Status: Initializing';
+  }
+  if (
+    status === BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+  ) {
+    return 'Status: Healthy';
+  }
+  if (
+    status ===
+    BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+  ) {
+    return 'Status: Unhealthy';
+  }
+  return 'Status: Unspecified';
+}
+
+function makeJoinExtras(
+  joinAttrs?: GetBotInstanceResponseJoinAttrs | null
+): [string, string | undefined][] {
+  if (joinAttrs?.azure) {
+    return [
+      ['Resource group', joinAttrs.azure.resource_group],
+      ['Subscription', joinAttrs.azure.subscription],
+    ];
+  }
+  if (joinAttrs?.azure_devops) {
+    return [
+      ['Repository ID', joinAttrs.azure_devops.pipeline?.repository_id],
+      ['Subject', joinAttrs.azure_devops.pipeline?.sub],
+    ];
+  }
+  if (joinAttrs?.bitbucket) {
+    return [
+      ['Repository UUID', joinAttrs.bitbucket.repository_uuid],
+      ['Subject', joinAttrs.bitbucket.sub],
+    ];
+  }
+  if (joinAttrs?.circleci) {
+    return [
+      ['Project ID', joinAttrs.circleci.project_id],
+      ['Subject', joinAttrs.circleci.sub],
+    ];
+  }
+  if (joinAttrs?.gcp) {
+    return [['Service account', joinAttrs.gcp.service_account]];
+  }
+  if (joinAttrs?.github) {
+    return [
+      ['Repository', joinAttrs.github.repository],
+      ['Subject', joinAttrs.github.sub],
+    ];
+  }
+  if (joinAttrs?.gitlab) {
+    return [
+      ['Project path', joinAttrs.gitlab.project_path],
+      ['Subject', joinAttrs.gitlab.sub],
+    ];
+  }
+  if (joinAttrs?.iam) {
+    return [
+      ['Account', joinAttrs.iam.account],
+      ['ARN', joinAttrs.iam.arn],
+    ];
+  }
+  if (joinAttrs?.kubernetes) {
+    return [['Subject', joinAttrs.kubernetes.subject]];
+  }
+  if (joinAttrs?.oracle) {
+    return [
+      ['Tenancy ID', joinAttrs.oracle.tenancy_id],
+      ['Compartment ID', joinAttrs.oracle.compartment_id],
+    ];
+  }
+  if (joinAttrs?.spacelift) {
+    return [
+      ['Space ID', joinAttrs.spacelift.space_id],
+      ['Subject', joinAttrs.spacelift.sub],
+    ];
+  }
+  if (joinAttrs?.terraform_cloud) {
+    return [
+      ['Workspace', joinAttrs.terraform_cloud.full_workspace],
+      ['Subject', joinAttrs.terraform_cloud.sub],
+    ];
+  }
+  if (joinAttrs?.tpm) {
+    return [['Public key', joinAttrs.tpm.ek_pub_hash]];
+  }
+  return [];
+}
diff --git a/web/packages/teleport/src/BotInstances/InfoGuide.tsx b/web/packages/teleport/src/BotInstances/InfoGuide.tsx
new file mode 100644
index 0000000000000..7df54624989e2
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/InfoGuide.tsx
@@ -0,0 +1,82 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import Box from 'design/Box/Box';
+import { Mark } from 'design/Mark/Mark';
+import {
+  InfoExternalTextLink,
+  InfoParagraph,
+  ReferenceLinks,
+} from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
+
+export function InfoGuide() {
+  return (
+    <Box>
+      <InfoParagraph>
+        A{' '}
+        <InfoExternalTextLink
+          target="_blank"
+          href={InfoGuideReferenceLinks.BotInstances.href}
+        >
+          Bot Instance
+        </InfoExternalTextLink>{' '}
+        identifies a single lineage of{' '}
+        <InfoExternalTextLink
+          target="_blank"
+          href={InfoGuideReferenceLinks.Bots.href}
+        >
+          bot
+        </InfoExternalTextLink>{' '}
+        identities, even through certificate renewals and rejoins. When the{' '}
+        <Mark>tbot</Mark> client first authenticates to a cluster, a Bot
+        Instance is generated and its UUID is embedded in the returned client
+        identity.
+      </InfoParagraph>
+      <InfoParagraph>
+        Bot Instances track a variety of information about <Mark>tbot</Mark>{' '}
+        instances, including regular heartbeats which include basic information
+        about the <Mark>tbot</Mark> host, like its architecture and OS version.
+      </InfoParagraph>
+      <InfoParagraph>
+        Bot Instances have a relatively short lifespan and are set to expire
+        after the most recent identity issued for that instance expires. If the{' '}
+        <Mark>tbot</Mark> client associated with a particular Bot Instance
+        renews or rejoins, the expiration of the bot instance is reset. This is
+        designed to allow users to list Bot Instances for an accurate view of
+        the number of active <Mark>tbot</Mark> clients interacting with their
+        Teleport cluster.
+      </InfoParagraph>
+      <ReferenceLinks links={Object.values(InfoGuideReferenceLinks)} />
+    </Box>
+  );
+}
+
+const InfoGuideReferenceLinks = {
+  BotInstances: {
+    title: 'What are Bot instances',
+    href: 'https://goteleport.com/docs/enroll-resources/machine-id/introduction/#bot-instances',
+  },
+  Bots: {
+    title: 'What are Bots',
+    href: 'https://goteleport.com/docs/enroll-resources/machine-id/introduction/#bots',
+  },
+  Tctl: {
+    title: 'Use tctl to manage bot instances',
+    href: 'https://goteleport.com/docs/reference/cli/tctl/#tctl-bots-instances-add',
+  },
+};
diff --git a/web/packages/teleport/src/BotInstances/List/BotInstancesList.story.tsx b/web/packages/teleport/src/BotInstances/List/BotInstancesList.story.tsx
new file mode 100644
index 0000000000000..11be782f0371e
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/List/BotInstancesList.story.tsx
@@ -0,0 +1,200 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient } from '@tanstack/react-query';
+import { ComponentProps, useRef, useState } from 'react';
+
+import { CardTile } from 'design/CardTile/CardTile';
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { BotInstanceSummary } from 'teleport/services/bot/types';
+
+import { BotInstancesList, BotInstancesListControls } from './BotInstancesList';
+
+const meta = {
+  title: 'Teleport/BotInstances/List',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {};
+
+export const Empty: Story = {
+  args: {
+    data: [],
+  },
+};
+
+export const EmptyWithFilter: Story = {
+  args: {
+    data: [],
+    isFiltering: true,
+  },
+};
+
+export const ErrorLoadingList: Story = {
+  args: {
+    error: new Error('something went wrong'),
+  },
+};
+
+export const NoMoreToLoad: Story = {
+  args: {
+    hasNextPage: false,
+  },
+};
+
+export const LoadingMore: Story = {
+  args: {
+    isFetchingNextPage: true,
+  },
+};
+
+export const UnsupportedSort: Story = {
+  args: {
+    error: new Error('unsupported sort: something went wrong'),
+  },
+};
+
+export const StillLoadingList: Story = {
+  args: {
+    isLoading: true,
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(
+  props?: Partial<
+    Pick<
+      ComponentProps<typeof BotInstancesList>,
+      | 'error'
+      | 'isLoading'
+      | 'hasNextPage'
+      | 'isFetchingNextPage'
+      | 'data'
+      | 'isFiltering'
+    >
+  >
+) {
+  const {
+    data = [
+      {
+        bot_name: 'ansible-worker',
+        instance_id: `966c0850-9bb5-4ed7-af2d-4b1f202a936a`,
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'my-svc.my-namespace.svc.cluster-domain.example',
+        join_method_latest: 'github',
+        os_latest: 'linux',
+        version_latest: '2.4.0',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: 'ac7135ce-fde6-4a91-bd77-ba7419e1c175',
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'win-123a',
+        join_method_latest: 'tpm',
+        os_latest: 'windows',
+        version_latest: '4.3.18+ab12hd',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: '5283f4a9-c49b-4876-be48-b5f83000e612',
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'mac-007',
+        join_method_latest: 'kubernetes',
+        os_latest: 'darwin',
+        version_latest: '3.9.99',
+      },
+    ],
+    error = null,
+    hasNextPage = true,
+    isFetchingNextPage = false,
+    isLoading = false,
+    isFiltering = false,
+  } = props ?? {};
+
+  const [allData, setAllData] = useState(data);
+  const [selected, setSelected] = useState<string | null>(null);
+  const [sortField, setSortField] = useState<string>('active_at_latest');
+  const [sortDir, setSortDir] = useState<SortOrder>('ASC');
+
+  const listRef = useRef<BotInstancesListControls | null>(null);
+
+  const ctx = createTeleportContext();
+
+  return (
+    <TeleportProviderBasic teleportCtx={ctx}>
+      <CardTile
+        height={600}
+        width={400}
+        overflow={'auto'}
+        p={0}
+        flexDirection={'row'}
+      >
+        <BotInstancesList
+          ref={listRef}
+          data={allData}
+          isLoading={isLoading}
+          isFetchingNextPage={isFetchingNextPage}
+          error={error}
+          hasNextPage={hasNextPage}
+          sortField={sortField}
+          sortDir={sortDir}
+          selectedItem={selected}
+          onSortChanged={(sortField: string, sortDir: 'ASC' | 'DESC') => {
+            setSortField(sortField);
+            setSortDir(sortDir);
+            listRef.current?.scrollToTop();
+          }}
+          onLoadNextPage={() =>
+            setAllData(existing => {
+              const newData = (data ?? []).map(i => {
+                return {
+                  ...i,
+                  instance_id: crypto.randomUUID(),
+                };
+              });
+              return [...(existing ?? []), ...newData];
+            })
+          }
+          onItemSelected={function (item: BotInstanceSummary | null): void {
+            setSelected(item ? `${item.bot_name}/${item.instance_id}` : null);
+          }}
+          isFiltering={isFiltering}
+        />
+      </CardTile>
+    </TeleportProviderBasic>
+  );
+}
diff --git a/web/packages/teleport/src/BotInstances/List/BotInstancesList.test.tsx b/web/packages/teleport/src/BotInstances/List/BotInstancesList.test.tsx
new file mode 100644
index 0000000000000..3fc8c25006b0e
--- /dev/null
+++ b/web/packages/teleport/src/BotInstances/List/BotInstancesList.test.tsx
@@ -0,0 +1,347 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+} from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+
+import { BotInstancesList } from './BotInstancesList';
+
+jest.mock('design/utils/copyToClipboard', () => {
+  return {
+    __esModule: true,
+    copyToClipboard: jest.fn(),
+  };
+});
+
+afterEach(async () => {
+  jest.clearAllMocks();
+});
+
+describe('BotIntancesList', () => {
+  it('renders items', async () => {
+    renderComponent();
+
+    expect(screen.getByText('ansible-worker/966c085')).toBeInTheDocument();
+    expect(screen.getByText('ansible-worker/ac7135c')).toBeInTheDocument();
+    expect(screen.getByText('ansible-worker/5283f4a')).toBeInTheDocument();
+  });
+
+  it('select an item', async () => {
+    const onItemSelected = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        onItemSelected,
+      },
+    });
+
+    const item2 = screen.getByRole('listitem', {
+      name: 'ansible-worker/ac7135ce-fde6-4a91-bd77-ba7419e1c175',
+    });
+    await user.click(item2);
+
+    expect(onItemSelected).toHaveBeenCalledTimes(1);
+    expect(onItemSelected).toHaveBeenLastCalledWith({
+      active_at_latest: '2025-07-22T10:54:00Z',
+      bot_name: 'ansible-worker',
+      host_name_latest: 'win-123a',
+      instance_id: 'ac7135ce-fde6-4a91-bd77-ba7419e1c175',
+      join_method_latest: 'tpm',
+      os_latest: 'windows',
+      version_latest: '4.3.18+ab12hd',
+    });
+  });
+
+  it('Shows a loading state', async () => {
+    renderComponent({
+      props: {
+        isLoading: true,
+      },
+    });
+
+    expect(screen.getByTestId('loading')).toBeInTheDocument();
+  });
+
+  it('Shows an empty state', async () => {
+    renderComponent({
+      props: {
+        data: [],
+      },
+    });
+
+    expect(screen.getByText('No active instances')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Bot instances are ephemeral, and disappear once all issued credentials have expired.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('Shows an error', async () => {
+    renderComponent({
+      props: {
+        error: new Error('something went wrong'),
+      },
+    });
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
+
+  it('Allows fetch more action', async () => {
+    const onLoadNextPage = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        hasNextPage: true,
+        onLoadNextPage,
+      },
+    });
+
+    const action = screen.getByText('Load More');
+    await user.click(action);
+
+    expect(onLoadNextPage).toHaveBeenCalledTimes(1);
+  });
+
+  it('Prevents next page action when no page', async () => {
+    const onLoadNextPage = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        hasNextPage: false,
+        onLoadNextPage,
+      },
+    });
+
+    const action = screen.getByText('Load More');
+    await user.click(action);
+
+    expect(action).toBeDisabled();
+    expect(onLoadNextPage).not.toHaveBeenCalled();
+  });
+
+  it('Prevents next page action when loading next page', async () => {
+    const onLoadNextPage = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        hasNextPage: true,
+        isFetchingNextPage: true,
+        onLoadNextPage,
+      },
+    });
+
+    const action = screen.getByText('Load More');
+    await user.click(action);
+
+    expect(action).toBeDisabled();
+    expect(onLoadNextPage).not.toHaveBeenCalled();
+  });
+
+  it('Allows sort change', async () => {
+    const onSortChanged = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        onSortChanged,
+        sortField: 'active_at_latest',
+        sortDir: 'DESC',
+      },
+    });
+
+    const fieldAction = screen.getByRole('button', { name: 'Sort by' });
+    await user.click(fieldAction);
+
+    expect(
+      screen.getByRole('menuitem', { name: 'Bot name' })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('menuitem', { name: 'Activity' })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('menuitem', { name: 'Hostname' })
+    ).toBeInTheDocument();
+    const versionOption = screen.getByRole('menuitem', { name: 'Version' });
+    await user.click(versionOption);
+
+    expect(onSortChanged).toHaveBeenLastCalledWith('version_latest', 'ASC');
+
+    await user.click(fieldAction);
+    const oldestAction = screen.getByRole('menuitem', {
+      name: 'Oldest',
+    });
+    await user.click(oldestAction);
+
+    // The component under test does not keep sort state so the sort field will
+    // be 'active_at_latest' on the next change.
+    expect(onSortChanged).toHaveBeenLastCalledWith('active_at_latest', 'ASC');
+  });
+
+  it('Shows an unsupported sort error', async () => {
+    const onSortChanged = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        onSortChanged,
+        sortField: 'active_at_latest',
+        sortDir: 'DESC',
+        error: new Error('unsupported sort: foo'),
+      },
+    });
+
+    expect(screen.getByText('unsupported sort: foo')).toBeInTheDocument();
+
+    const resetAction = screen.getByRole('button', { name: 'Reset sort' });
+    await user.click(resetAction);
+
+    expect(onSortChanged).toHaveBeenLastCalledWith('bot_name', 'ASC');
+  });
+
+  describe('When filtering', () => {
+    it('Shows an alterate title', async () => {
+      renderComponent({
+        props: {
+          isFiltering: true,
+        },
+      });
+
+      expect(
+        screen.getByRole('heading', { name: 'Filtered Instances' })
+      ).toBeInTheDocument();
+    });
+
+    it('Shows an empty state', async () => {
+      renderComponent({
+        props: {
+          data: [],
+          isFiltering: true,
+        },
+      });
+
+      expect(
+        screen.getByText('No instances matching filter')
+      ).toBeInTheDocument();
+      expect(
+        screen.queryByText(
+          'Bot instances are ephemeral, and disappear once all issued credentials have expired.'
+        )
+      ).not.toBeInTheDocument();
+    });
+  });
+});
+
+const renderComponent = (options?: {
+  props: Partial<ComponentProps<typeof BotInstancesList>>;
+}) => {
+  const { props } = options ?? {};
+  const {
+    data = mockData,
+    isLoading = false,
+    isFetchingNextPage = false,
+    error = null,
+    hasNextPage = true,
+    sortField = 'bot_name',
+    sortDir = 'ASC',
+    selectedItem = null,
+    onSortChanged = jest.fn(),
+    onLoadNextPage = jest.fn(),
+    onItemSelected = jest.fn(),
+    isFiltering = false,
+  } = props ?? {};
+
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <BotInstancesList
+        data={data}
+        isLoading={isLoading}
+        isFetchingNextPage={isFetchingNextPage}
+        error={error}
+        hasNextPage={hasNextPage}
+        sortField={sortField}
+        sortDir={sortDir}
+        selectedItem={selectedItem}
+        onSortChanged={onSortChanged}
+        onLoadNextPage={onLoadNextPage}
+        onItemSelected={onItemSelected}
+        isFiltering={isFiltering}
+      />,
+      {
+        wrapper: makeWrapper(),
+      }
+    ),
+    user,
+  };
+};
+
+function makeWrapper() {
+  const ctx = createTeleportContext();
+  return (props: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            {props.children}
+          </ConfiguredThemeProvider>
+        </TeleportProviderBasic>
+      </QueryClientProvider>
+    );
+  };
+}
+
+const mockData = [
+  {
+    bot_name: 'ansible-worker',
+    instance_id: `966c0850-9bb5-4ed7-af2d-4b1f202a936a`,
+    active_at_latest: '2025-07-22T10:54:00Z',
+    host_name_latest: 'my-svc.my-namespace.svc.cluster-domain.example',
+    join_method_latest: 'github',
+    os_latest: 'linux',
+    version_latest: '2.4.0',
+  },
+  {
+    bot_name: 'ansible-worker',
+    instance_id: 'ac7135ce-fde6-4a91-bd77-ba7419e1c175',
+    active_at_latest: '2025-07-22T10:54:00Z',
+    host_name_latest: 'win-123a',
+    join_method_latest: 'tpm',
+    os_latest: 'windows',
+    version_latest: '4.3.18+ab12hd',
+  },
+  {
+    bot_name: 'ansible-worker',
+    instance_id: '5283f4a9-c49b-4876-be48-b5f83000e612',
+    active_at_latest: '2025-07-22T10:54:00Z',
+    host_name_latest: 'mac-007',
+    join_method_latest: 'kubernetes',
+    os_latest: 'darwin',
+    version_latest: '3.9.99',
+  },
+];
diff --git a/web/packages/teleport/src/BotInstances/List/BotInstancesList.tsx b/web/packages/teleport/src/BotInstances/List/BotInstancesList.tsx
index 026fbf76ad19b..e00471eecd9f4 100644
--- a/web/packages/teleport/src/BotInstances/List/BotInstancesList.tsx
+++ b/web/packages/teleport/src/BotInstances/List/BotInstancesList.tsx
@@ -16,148 +16,263 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import format from 'date-fns/format';
-import formatDistanceToNowStrict from 'date-fns/formatDistanceToNowStrict';
-import parseISO from 'date-fns/parseISO';
-import { useMemo } from 'react';
+import React, { forwardRef, useImperativeHandle } from 'react';
 import styled from 'styled-components';
 
-import { Info } from 'design/Alert/Alert';
-import { Cell, LabelCell } from 'design/DataTable/Cells';
-import Table from 'design/DataTable/Table';
-import { FetchingConfig } from 'design/DataTable/types';
-import Flex from 'design/Flex';
+import { Alert, Info } from 'design/Alert/Alert';
+import Box from 'design/Box/Box';
+import { ButtonSecondary } from 'design/Button/Button';
+import Flex from 'design/Flex/Flex';
+import { Indicator } from 'design/Indicator/Indicator';
 import Text from 'design/Text';
-import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
-import { SearchPanel } from 'shared/components/Search';
-import { CopyButton } from 'shared/components/UnifiedResources/shared/CopyButton';
+import {
+  SortItem,
+  SortMenu,
+  SortOrder,
+} from 'shared/components/Controls/SortMenuV2';
 
+import { Instance } from 'teleport/Bots/Details/Instance';
 import { BotInstanceSummary } from 'teleport/services/bot/types';
 
-const MonoText = styled(Text)`
-  font-family: ${({ theme }) => theme.fonts.mono};
-`;
+export const BotInstancesList = forwardRef(InternalBotInstancesList);
 
-export function BotInstancesList({
-  data,
-  fetchStatus,
-  onFetchNext,
-  onFetchPrev,
-  searchTerm,
-  onSearchChange,
-  onItemSelected,
-}: {
-  data: BotInstanceSummary[];
-  searchTerm: string;
-  onSearchChange: (term: string) => void;
-  onItemSelected: (item: BotInstanceSummary) => void;
-} & Omit<FetchingConfig, 'onFetchMore'>) {
-  const tableData = data.map(x => ({
-    ...x,
-    hostnameDisplay: x.host_name_latest ?? '-',
-    instanceIdDisplay: x.instance_id.substring(0, 7),
-    versionDisplay: x.version_latest ? `v${x.version_latest}` : '-',
-    activeAtDisplay: x.active_at_latest
-      ? `${formatDistanceToNowStrict(parseISO(x.active_at_latest))} ago`
-      : '-',
-    activeAtLocal: x.active_at_latest
-      ? format(parseISO(x.active_at_latest), 'PP, p z')
-      : '-',
-  }));
-
-  const rowConfig = useMemo(
-    () => ({
-      onClick: onItemSelected,
-      getStyle: () => ({ cursor: 'pointer' }),
-    }),
-    [onItemSelected]
-  );
+export type BotInstancesListControls = {
+  scrollToTop: () => void;
+};
+
+function InternalBotInstancesList(
+  props: {
+    data: BotInstanceSummary[] | null | undefined;
+    isLoading: boolean;
+    isFetchingNextPage: boolean;
+    error: Error | null | undefined;
+    hasNextPage: boolean;
+    sortField: string;
+    sortDir: SortOrder;
+    selectedItem: string | null;
+    onSortChanged: (sortField: string, sortDir: SortOrder) => void;
+    onLoadNextPage: () => void;
+    onItemSelected: (item: BotInstanceSummary) => void;
+    isFiltering: boolean;
+  },
+  ref: React.RefObject<BotInstancesListControls | null>
+) {
+  const {
+    data,
+    isLoading,
+    isFetchingNextPage,
+    error,
+    hasNextPage,
+    sortField,
+    sortDir,
+    selectedItem,
+    onSortChanged,
+    onLoadNextPage,
+    onItemSelected,
+    isFiltering,
+  } = props;
+
+  const contentRef = React.useRef<HTMLDivElement>(null);
+  useImperativeHandle(ref, () => {
+    return {
+      scrollToTop() {
+        contentRef.current?.scrollTo({ top: 0, behavior: 'instant' });
+      },
+    };
+  }, [contentRef]);
+
+  const hasError = !!error;
+  const hasData = !hasError && !isLoading;
+  const hasUnsupportedSortError = isUnsupportedSortError(error);
+
+  const makeOnSelectedCallback = (instance: BotInstanceSummary) => () => {
+    onItemSelected(instance);
+  };
 
   return (
-    <Table<(typeof tableData)[number]>
-      data={tableData}
-      fetching={{
-        fetchStatus,
-        onFetchNext,
-        onFetchPrev,
-        disableLoadingIndicator: true,
-      }}
-      serversideProps={{
-        sort: undefined,
-        setSort: () => undefined,
-        serversideSearchPanel: (
-          <SearchPanel
-            updateSearch={onSearchChange}
-            updateQuery={null}
-            hideAdvancedSearch={true}
-            filter={{ search: searchTerm }}
-            disableSearch={fetchStatus !== ''}
-          />
-        ),
-      }}
-      row={rowConfig}
-      columns={[
-        {
-          key: 'bot_name',
-          headerText: 'Bot',
-          isSortable: false,
-        },
-        {
-          key: 'instanceIdDisplay',
-          headerText: 'ID',
-          isSortable: false,
-          render: ({ instance_id, instanceIdDisplay }) => (
-            <Cell>
-              <Flex inline alignItems={'center'} gap={1} mr={0}>
-                <MonoText>{instanceIdDisplay}</MonoText>
-                <CopyButton name={instance_id} />
-              </Flex>
-            </Cell>
-          ),
-        },
-        {
-          key: 'join_method_latest',
-          headerText: 'Method',
-          isSortable: false,
-          render: ({ join_method_latest }) =>
-            join_method_latest ? (
-              <LabelCell data={[join_method_latest]} />
-            ) : (
-              <Cell>{'-'}</Cell>
-            ),
-        },
-        {
-          key: 'hostnameDisplay',
-          headerText: 'Hostname',
-          isSortable: false,
-        },
-        {
-          key: 'versionDisplay',
-          headerText: 'Version (tbot)',
-          isSortable: false,
-        },
-        {
-          key: 'activeAtDisplay',
-          headerText: 'Last heartbeat',
-          isSortable: false,
-          render: ({ activeAtDisplay, activeAtLocal }) => (
-            <Cell>
-              <Flex>
-                <HoverTooltip tipContent={activeAtLocal}>
-                  {activeAtDisplay}
-                </HoverTooltip>
-              </Flex>
-            </Cell>
-          ),
-        },
-      ]}
-      emptyText="No active instances found"
-      emptyButton={
-        <Info alignItems="flex-start" mt={5}>
-          Bot instances are ephemeral, and disappear once all issued credentials
-          have expired.
-        </Info>
-      }
-    />
+    <Container>
+      <TitleContainer>
+        <TitleText>
+          {isFiltering ? 'Filtered Instances' : 'Active Instances'}
+        </TitleText>
+        <SortMenu
+          selectedKey={sortField}
+          selectedOrder={sortDir}
+          items={sortItems}
+          onChange={(field, order) => {
+            onSortChanged(field, order);
+          }}
+        />
+      </TitleContainer>
+
+      <Divider />
+
+      {isLoading ? (
+        <Box data-testid="loading" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      ) : undefined}
+
+      {hasError && hasUnsupportedSortError ? (
+        <Alert
+          m={3}
+          kind="warning"
+          primaryAction={{
+            content: 'Reset sort',
+            onClick: () => {
+              onSortChanged('bot_name', 'ASC');
+            },
+          }}
+        >
+          {error.message}
+        </Alert>
+      ) : undefined}
+
+      {hasError && !hasUnsupportedSortError ? (
+        <Alert m={3} kind="danger" details={error.message}>
+          Failed to fetch instances
+        </Alert>
+      ) : undefined}
+
+      {hasData ? (
+        <>
+          {data && data.length > 0 ? (
+            <ContentContainer ref={contentRef} data-scrollbar="default">
+              {data.map((instance, i) => (
+                <React.Fragment key={`${instance.instance_id}`}>
+                  {i === 0 ? undefined : <Divider />}
+                  <Instance
+                    isSelectable
+                    onSelected={makeOnSelectedCallback(instance)}
+                    isSelected={
+                      `${instance.bot_name}/${instance.instance_id}` ==
+                      selectedItem
+                    }
+                    data={{
+                      id: instance.instance_id,
+                      botName: instance.bot_name,
+                      version: instance.version_latest,
+                      hostname: instance.host_name_latest,
+                      activeAt: instance.active_at_latest,
+                      method: instance.join_method_latest,
+                      os: instance.os_latest,
+                    }}
+                  />
+                </React.Fragment>
+              ))}
+
+              <Divider />
+
+              <LoadMoreContainer>
+                <ButtonSecondary
+                  onClick={() => onLoadNextPage()}
+                  disabled={!hasNextPage || isFetchingNextPage}
+                >
+                  Load More
+                </ButtonSecondary>
+              </LoadMoreContainer>
+            </ContentContainer>
+          ) : (
+            <Box p={3}>
+              <EmptyText>
+                {isFiltering
+                  ? 'No instances matching filter'
+                  : 'No active instances'}
+              </EmptyText>
+              {!isFiltering ? (
+                <Info mt={3}>
+                  Bot instances are ephemeral, and disappear once all issued
+                  credentials have expired.
+                </Info>
+              ) : undefined}
+            </Box>
+          )}
+        </>
+      ) : undefined}
+    </Container>
   );
 }
+
+const Container = styled.section`
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  min-width: 300px;
+  max-width: 400px;
+`;
+
+const TitleContainer = styled(Flex)`
+  align-items: center;
+  justify-content: space-between;
+  gap: ${p => p.theme.space[2]}px;
+  padding-left: ${p => p.theme.space[3]}px;
+  padding-right: ${p => p.theme.space[3]}px;
+  min-height: ${p => p.theme.space[8]}px;
+`;
+
+export const TitleText = styled(Text).attrs({
+  as: 'h2',
+  typography: 'h2',
+})``;
+
+const ContentContainer = styled.div`
+  overflow: auto;
+`;
+
+const LoadMoreContainer = styled(Flex)`
+  justify-content: center;
+  padding: ${props => props.theme.space[3]}px;
+`;
+
+const Divider = styled.div`
+  height: 1px;
+  flex-shrink: 0;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
+
+const isUnsupportedSortError = (error: Error | null | undefined) => {
+  return !!error && error.message.includes('unsupported sort');
+};
+
+const sortItems: SortItem[] = [
+  {
+    key: 'bot_name',
+    label: 'Bot name',
+    ascendingLabel: 'Bot name, A - Z',
+    descendingLabel: 'Bot name, Z - A',
+    ascendingOptionLabel: 'Alphabetical, A - Z',
+    descendingOptionLabel: 'Alphabetical, Z - A',
+    defaultOrder: 'ASC',
+  },
+  {
+    key: 'active_at_latest',
+    label: 'Activity',
+    ascendingLabel: 'Oldest',
+    descendingLabel: 'Latest',
+    ascendingOptionLabel: 'Oldest',
+    descendingOptionLabel: 'Latest',
+    defaultOrder: 'DESC',
+  },
+  {
+    key: 'version_latest',
+    label: 'Version',
+    ascendingLabel: 'Oldest version',
+    descendingLabel: 'Newest version',
+    ascendingOptionLabel: 'Oldest',
+    descendingOptionLabel: 'Newest',
+    defaultOrder: 'ASC',
+  },
+  {
+    key: 'host_name_latest',
+    label: 'Hostname',
+    ascendingLabel: 'Hostname, A - Z',
+    descendingLabel: 'Hostname, Z - A',
+    ascendingOptionLabel: 'Alphabetical, A - Z',
+    descendingOptionLabel: 'Alphabetical, Z - A',
+    defaultOrder: 'ASC',
+  },
+];
diff --git a/web/packages/teleport/src/Bots/Add/AddBots.tsx b/web/packages/teleport/src/Bots/Add/AddBots.tsx
index 5b6ffa3412a38..0f35ac1289277 100644
--- a/web/packages/teleport/src/Bots/Add/AddBots.tsx
+++ b/web/packages/teleport/src/Bots/Add/AddBots.tsx
@@ -17,22 +17,29 @@
  */
 
 import { FeatureBox } from 'teleport/components/Layout';
-import { Route, Switch } from 'teleport/components/Router';
+import { Redirect, Route, Switch } from 'teleport/components/Router';
 import cfg from 'teleport/config';
 
 import { BotFlowType } from '../types';
-import { AddBotsPicker } from './AddBotsPicker';
-import GitHubActionsFlow from './GitHubActions';
+import { GitHubActionsK8s } from './GitHubActionsK8s/GitHubActionsK8s';
+import GitHubActionsSshFlow from './GitHubActionsSsh';
 
 export function AddBots() {
   return (
     <FeatureBox>
       <Switch>
         <Route
-          path={cfg.getBotsNewRoute(BotFlowType.GitHubActions)}
-          component={GitHubActionsFlow}
+          path={cfg.getBotsNewRoute(BotFlowType.GitHubActionsSsh)}
+          component={GitHubActionsSshFlow}
+        />
+        <Route
+          path={cfg.getBotsNewRoute(BotFlowType.GitHubActionsK8s)}
+          component={GitHubActionsK8s}
+        />
+        <Redirect
+          path={cfg.getBotsNewRoute()}
+          to={`${cfg.getIntegrationEnrollRoute()}?tags=bot`}
         />
-        <Route path={cfg.getBotsNewRoute()} component={AddBotsPicker} />
       </Switch>
     </FeatureBox>
   );
diff --git a/web/packages/teleport/src/Bots/Add/AddBotsPicker.tsx b/web/packages/teleport/src/Bots/Add/AddBotsPicker.tsx
index 977417bc1695e..de8a1964bbc91 100644
--- a/web/packages/teleport/src/Bots/Add/AddBotsPicker.tsx
+++ b/web/packages/teleport/src/Bots/Add/AddBotsPicker.tsx
@@ -16,12 +16,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import type { JSX } from 'react';
-import { Link } from 'react-router-dom';
+import { ReactNode } from 'react';
 import styled from 'styled-components';
 
-import { Box, Link as ExternalLink, Flex, ResourceIcon, Text } from 'design';
-import { Server } from 'design/Icon';
+import { Box, Flex, Text } from 'design';
+import { ResourceIconName } from 'design/ResourceIcon';
 import { P } from 'design/Text/Text';
 import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide';
 
@@ -29,6 +28,7 @@ import { FeatureHeader, FeatureHeaderTitle } from 'teleport/components/Layout';
 import { ToolTipNoPermBadge } from 'teleport/components/ToolTipNoPermBadge';
 import cfg from 'teleport/config';
 import { IntegrationTile } from 'teleport/Integrations';
+import { IntegrationTag, Tile } from 'teleport/Integrations/Enroll/Shared';
 import {
   IntegrationEnrollEvent,
   IntegrationEnrollKind,
@@ -39,101 +39,170 @@ import useTeleport from 'teleport/useTeleport';
 import { InfoGuide } from '../InfoGuide';
 import { BotFlowType } from '../types';
 
-type BotIntegration = {
+export type BotIntegration = {
   title: string;
+  description: string;
   link: string;
-  icon: JSX.Element;
+  icon: ResourceIconName;
   guided: boolean;
+  type: 'bot';
   kind: IntegrationEnrollKind;
+  tags: IntegrationTag[];
 };
 
-const StyledResourceIcon = styled(ResourceIcon)`
-  margin: 0 auto;
-  height: 100%;
-  min-width: 0;
-  max-width: 80px;
-`;
-
-const integrations: BotIntegration[] = [
+export const integrations: BotIntegration[] = [
   {
     title: 'GitHub Actions + SSH',
-    link: cfg.getBotsNewRoute(BotFlowType.GitHubActions),
-    icon: <StyledResourceIcon name="github" />,
+    description:
+      'Use Machine & Workload Identity to grant GitHub Actions CI/CD access to Teleport resources.',
+    link: cfg.getBotsNewRoute(BotFlowType.GitHubActionsSsh),
+    icon: 'github',
     kind: IntegrationEnrollKind.MachineIDGitHubActions,
+    type: 'bot',
     guided: true,
+    tags: ['bot', 'cicd'],
+  },
+  // Hiding the new guide for now.
+  // {
+  //   title: 'GitHub Actions + Kubernetes',
+  //   description: 'Use Machine & Workload Identity to grant GitHub Actions CI/CD access to Teleport resources.',
+  //   link: cfg.getBotsNewRoute(BotFlowType.GitHubActionsK8s),
+  //   icon: 'github',
+  //   kind: IntegrationEnrollKind.MachineIDGitHubActionsK8s,
+  //   type: 'bot',
+  //   guided: true,
+  //   tags: ['bot', 'cicd'],
+  // },
+  {
+    title: 'GitHub Actions + Kubernetes',
+    description:
+      'Use Machine & Workload Identity to grant GitHub Actions CI/CD access to Teleport resources.',
+    link: cfg.getBotsNewRoute(BotFlowType.GitHubActionsK8s),
+    icon: 'github',
+    kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+    type: 'bot',
+    guided: true,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'CircleCI',
+    description: 'Use Machine ID to power CircleCI CI/CD workflows.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/circleci/',
-    icon: <StyledResourceIcon name="circleci" />,
+    icon: 'circleci',
     kind: IntegrationEnrollKind.MachineIDCircleCI,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'GitLab CI/CD',
+    description: 'Use Machine ID to power GitLab CI/CD workflows.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/gitlab/',
-    icon: <StyledResourceIcon name="gitlab" />,
+    icon: 'gitlab',
     kind: IntegrationEnrollKind.MachineIDGitLab,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'Jenkins',
+    description:
+      'Use Machine ID to eliminate long-lived credentials in Jenkins.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/jenkins/',
-    icon: <StyledResourceIcon name="jenkins" />,
+    icon: 'jenkins',
     kind: IntegrationEnrollKind.MachineIDJenkins,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'Ansible',
+    description:
+      'Use Machine ID to eliminate long-lived credentials from auth with Linux hosts.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/access-guides/ansible/',
-    icon: <StyledResourceIcon name="ansible" />,
+    icon: 'ansible',
     kind: IntegrationEnrollKind.MachineIDAnsible,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'Spacelift',
+    description:
+      'Use Machine ID to authenticate workloads running in Spacelift with Teleport.',
     link: 'https://goteleport.com/docs/admin-guides/infrastructure-as-code/terraform-provider/spacelift/',
-    icon: <StyledResourceIcon name="spacelift" />,
+    icon: 'spacelift',
     kind: IntegrationEnrollKind.MachineIDSpacelift,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'AWS',
+    description: 'Connect EC2 instances and RDS databases seamlessly.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/aws/',
-    icon: <StyledResourceIcon name="aws" />,
+    icon: 'aws',
     kind: IntegrationEnrollKind.MachineIDAWS,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'resourceaccess'],
   },
   {
-    title: 'GCP',
+    title: 'Google Cloud',
+    description: 'Connect GCE instances and CloudSQL databases seamlessly.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/gcp/',
-    icon: <StyledResourceIcon name="googlecloud" />,
+    icon: 'googlecloud',
     kind: IntegrationEnrollKind.MachineIDGCP,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'resourceaccess'],
   },
   {
     title: 'Azure',
+    description:
+      'Use Machine ID to eliminate long-lived credentials on Azure VMs.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/azure/',
-    icon: <StyledResourceIcon name="azure" />,
+    icon: 'azure',
     kind: IntegrationEnrollKind.MachineIDAzure,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'resourceaccess'],
   },
   {
     title: 'Kubernetes',
+    description:
+      'Use Machine ID to eliminate long-lived credentials for Kubernetes workloads.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/deployment/kubernetes/',
-    icon: <StyledResourceIcon name="kube" />,
+    icon: 'kube',
     kind: IntegrationEnrollKind.MachineIDKubernetes,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'resourceaccess'],
+  },
+  {
+    title: 'Argo CD',
+    description:
+      'Use Machine ID to enable Argo CD to connect to external Kubernetes clusters.',
+    link: 'https://goteleport.com/docs/machine-workload-identity/machine-id/access-guides/argocd/',
+    icon: 'argocd',
+    kind: IntegrationEnrollKind.MachineIDArgoCD,
+    type: 'bot',
+    guided: false,
+    tags: ['bot', 'cicd'],
   },
   {
     title: 'Generic',
+    description: 'Use Machine ID to Integrate generic server with Teleport.',
     link: 'https://goteleport.com/docs/enroll-resources/machine-id/getting-started/',
-    icon: <Server size={80} />,
+    icon: 'server',
     kind: IntegrationEnrollKind.MachineID,
+    type: 'bot',
     guided: false,
+    tags: ['bot', 'resourceaccess'],
   },
 ];
 
+// TODO(alexhemard): delete in a follow up PR
 export function AddBotsPicker() {
   const ctx = useTeleport();
   return (
@@ -159,41 +228,63 @@ export function BotTiles({
   hasCreateBotPermission: boolean;
 }) {
   return (
-    <Flex gap={3} flexWrap="wrap">
+    <div
+      css={`
+        display: grid;
+        grid-template-columns: repeat(auto-fill, minmax(400px, 1fr));
+        gap: 16px;
+      `}
+    >
       {integrations.map(i => (
         <Box key={i.title}>
-          {i.guided ? (
-            <GuidedTile
-              integration={i}
-              hasCreateBotPermission={hasCreateBotPermission}
-            />
-          ) : (
-            <ExternalLinkTile integration={i} />
-          )}
+          <BotTile
+            integration={i}
+            hasCreateBotPermission={hasCreateBotPermission}
+          />
         </Box>
       ))}
-    </Flex>
+    </div>
   );
 }
 
+export function BotTile({
+  integration,
+  hasCreateBotPermission,
+}: {
+  integration: BotIntegration;
+  hasCreateBotPermission: boolean;
+}) {
+  if (integration.guided) {
+    return (
+      <GuidedTile
+        integration={integration}
+        hasCreateBotPermission={hasCreateBotPermission}
+      />
+    );
+  }
+  return <ExternalLinkTile integration={integration} />;
+}
+
 function ExternalLinkTile({ integration }: { integration: BotIntegration }) {
+  const onBotClick = () => {
+    userEventService.captureIntegrationEnrollEvent({
+      event: IntegrationEnrollEvent.Started,
+      eventData: {
+        id: crypto.randomUUID(),
+        kind: integration.kind,
+      },
+    });
+  };
+
   return (
-    <IntegrationTile
-      as={ExternalLink}
-      href={integration.link}
-      target="_blank"
-      onClick={() => {
-        userEventService.captureIntegrationEnrollEvent({
-          event: IntegrationEnrollEvent.Started,
-          eventData: {
-            id: crypto.randomUUID(),
-            kind: integration.kind,
-          },
-        });
-      }}
-    >
-      <TileContent icon={integration.icon} title={integration.title} />
-    </IntegrationTile>
+    <Tile
+      title={`Machine ID: ${integration.title}`}
+      description={integration.description}
+      tags={integration.tags}
+      link={{ external: true, url: integration.link, onClick: onBotClick }}
+      icon={integration.icon}
+      hasAccess={true}
+    />
   );
 }
 
@@ -204,38 +295,38 @@ function GuidedTile({
   integration: BotIntegration;
   hasCreateBotPermission: boolean;
 }) {
+  const onBotClick = () => {
+    if (!hasCreateBotPermission) {
+      return;
+    }
+    userEventService.captureIntegrationEnrollEvent({
+      event: IntegrationEnrollEvent.Started,
+      eventData: {
+        id: crypto.randomUUID(),
+        kind: integration.kind,
+      },
+    });
+  };
+
+  const Badge = hasCreateBotPermission ? undefined : (
+    <ToolTipNoPermBadge>
+      <div>
+        You don’t have sufficient permissions to create bots. Reach out to your
+        Teleport administrator to request additional permissions.
+      </div>
+    </ToolTipNoPermBadge>
+  );
+
   return (
-    <IntegrationTile
-      as={Link}
-      to={{
-        pathname: hasCreateBotPermission ? integration.link : null,
-        state: { previousPathname: location.pathname },
-      }}
-      onClick={() => {
-        if (!hasCreateBotPermission) {
-          return;
-        }
-        userEventService.captureIntegrationEnrollEvent({
-          event: IntegrationEnrollEvent.Started,
-          eventData: {
-            id: crypto.randomUUID(),
-            kind: integration.kind,
-          },
-        });
-      }}
-    >
-      {hasCreateBotPermission ? (
-        <BadgeGuided>Guided</BadgeGuided>
-      ) : (
-        <ToolTipNoPermBadge>
-          <div>
-            You don’t have sufficient permissions to create bots. Reach out to
-            your Teleport administrator to request additional permissions.
-          </div>
-        </ToolTipNoPermBadge>
-      )}
-      <TileContent icon={integration.icon} title={integration.title} />
-    </IntegrationTile>
+    <Tile
+      title={`Machine ID: ${integration.title}`}
+      description={integration.description}
+      tags={integration.tags}
+      hasAccess={hasCreateBotPermission}
+      icon={integration.icon}
+      link={{ url: integration.link, onClick: onBotClick }}
+      Badge={Badge}
+    />
   );
 }
 
@@ -244,7 +335,7 @@ export function DisplayTile({
   title,
 }: {
   title: string;
-  icon: JSX.Element;
+  icon: ReactNode;
 }) {
   return (
     <HoverIntegrationTile>
@@ -262,18 +353,6 @@ function TileContent({ icon, title }) {
   );
 }
 
-const BadgeGuided = styled.div`
-  position: absolute;
-  background: ${props => props.theme.colors.brand};
-  color: ${props => props.theme.colors.text.primaryInverse};
-  padding: 0px 6px;
-  border-top-right-radius: 8px;
-  border-bottom-left-radius: 8px;
-  top: 0px;
-  right: 0px;
-  font-size: 10px;
-`;
-
 const HoverIntegrationTile = styled(IntegrationTile)`
   background: none;
   transition: all 0.1s ease-in;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.story.tsx
deleted file mode 100644
index c89c75b4b7d44..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.story.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { MemoryRouter } from 'react-router';
-
-import { ContextProvider } from 'teleport';
-import { createTeleportContext } from 'teleport/mocks/contexts';
-
-import { FlowStepProps } from '../Shared/GuidedFlow';
-import { ConnectGitHub } from './ConnectGitHub';
-import { Finish } from './Finish';
-import { GitHubFlowProvider } from './useGitHubFlow';
-
-const Provider = ({ children }) => {
-  const ctx = createTeleportContext();
-
-  return (
-    <MemoryRouter>
-      <ContextProvider ctx={ctx}>
-        <GitHubFlowProvider>{children}</GitHubFlowProvider>
-      </ContextProvider>
-    </MemoryRouter>
-  );
-};
-
-export default {
-  title: 'Teleport/Bots/Add/GitHubActions',
-};
-
-export const RepoRules = () => (
-  <Provider>
-    <ConnectGitHub {...props} />
-  </Provider>
-);
-
-export const Finished = () => (
-  <Provider>
-    <Finish />
-  </Provider>
-);
-
-const props: FlowStepProps = {
-  nextStep: () => {},
-  prevStep: () => {},
-};
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.test.tsx
deleted file mode 100644
index 408ede652f09e..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.test.tsx
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { MemoryRouter } from 'react-router';
-
-import { render, screen } from 'design/utils/testing';
-
-import { ContextProvider } from 'teleport';
-import { allAccessAcl } from 'teleport/mocks/contexts';
-import TeleportContext from 'teleport/teleportContext';
-
-import { ConnectGitHub } from './ConnectGitHub';
-import { GitHubFlowProvider } from './useGitHubFlow';
-
-describe('connectGitHub Component', () => {
-  function setup() {
-    const ctx = new TeleportContext();
-
-    ctx.storeUser.setState({
-      username: 'joe@example.com',
-      acl: allAccessAcl,
-    });
-
-    render(
-      <MemoryRouter>
-        <ContextProvider ctx={ctx}>
-          <GitHubFlowProvider>
-            <ConnectGitHub />
-          </GitHubFlowProvider>
-        </ContextProvider>
-      </MemoryRouter>
-    );
-  }
-
-  // Test for default rendering
-  it('renders basic elements', () => {
-    setup();
-    expect(
-      screen.getByText('Step 2: Input Your GitHub Account Info')
-    ).toBeInTheDocument();
-    expect(screen.getByText('Next')).toBeInTheDocument();
-    expect(screen.getByText('Back')).toBeInTheDocument();
-
-    // rule form
-    expect(screen.getByText('GitHub Repository Access:')).toBeInTheDocument();
-    expect(
-      screen.getByPlaceholderText('https://github.com/gravitational/teleport')
-    ).toBeInTheDocument();
-    expect(screen.getByText('Git Ref')).toBeInTheDocument();
-    expect(screen.getByPlaceholderText('main')).toBeInTheDocument();
-    expect(screen.getByText('Ref Type')).toBeInTheDocument();
-    expect(
-      screen.getByText('Name of the GitHub Actions Workflow')
-    ).toBeInTheDocument();
-    expect(screen.getByPlaceholderText('cd')).toBeInTheDocument();
-    expect(screen.getByText('Environment')).toBeInTheDocument();
-    expect(screen.getByPlaceholderText('development')).toBeInTheDocument();
-    expect(screen.getByText('Restrict to a GitHub User')).toBeInTheDocument();
-    expect(screen.getByPlaceholderText('octocat')).toBeInTheDocument();
-  });
-});
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.tsx
deleted file mode 100644
index 3f7dfee985e4b..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConnectGitHub.tsx
+++ /dev/null
@@ -1,361 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useState, type JSX } from 'react';
-import styled from 'styled-components';
-
-import { H2, Text } from 'design';
-import { Alert } from 'design/Alert';
-import Box from 'design/Box';
-import { ButtonSecondary } from 'design/Button';
-import ButtonIcon from 'design/ButtonIcon';
-import Card from 'design/Card';
-import Flex from 'design/Flex';
-import * as Icons from 'design/Icon';
-import Input from 'design/Input';
-import Link from 'design/Link';
-import FieldInput from 'shared/components/FieldInput';
-import Select from 'shared/components/Select';
-import Validation, { Validator } from 'shared/components/Validation';
-
-import cfg from 'teleport/config';
-
-import { FlowButtons } from '../Shared/FlowButtons';
-import { FlowStepProps } from '../Shared/GuidedFlow';
-import {
-  GITHUB_HOST,
-  parseRepoAddress,
-  RefTypeOption,
-  Rule,
-  useGitHubFlow,
-} from './useGitHubFlow';
-
-const refTypeOptions: RefTypeOption[] = [
-  {
-    label: 'any',
-    value: '',
-  },
-  {
-    label: 'Branch',
-    value: 'branch',
-  },
-  {
-    label: 'Tag',
-    value: 'tag',
-  },
-];
-
-export function ConnectGitHub({ nextStep, prevStep }: FlowStepProps) {
-  const {
-    repoRules,
-    setRepoRules,
-    addEmptyRepoRule,
-    createBot,
-    attempt,
-    resetAttempt,
-  } = useGitHubFlow();
-  const isLoading = attempt.status === 'processing';
-
-  const [hostError, setHostError] = useState<JSX.Element | null>(null);
-
-  function handleNext(validator: Validator) {
-    // clear errors
-    setHostError(null);
-
-    if (!validator.validate()) {
-      return;
-    }
-
-    const hosts = new Set<string>();
-    repoRules.forEach(rule => {
-      try {
-        const { host } = parseRepoAddress(rule.repoAddress);
-        hosts.add(host);
-      } catch (err) {
-        setHostError(InvalidHostError({ rule: rule.repoAddress, error: err }));
-      }
-    });
-
-    // ensure all repositories have the same host
-    if (hosts.size > 1) {
-      setHostError(MultipleHostsError);
-      return;
-    }
-
-    const isGitHubEnterpriseHost = [...hosts][0] !== GITHUB_HOST;
-    // ensure only enterprise users can use GitHub Enterprise Server Host
-    if (isGitHubEnterpriseHost && !cfg.isEnterprise) {
-      setHostError(EnterpriseHostError);
-      return;
-    }
-
-    createBot().then(success => {
-      if (success) {
-        nextStep();
-      }
-    });
-  }
-
-  function handleChange(
-    index: number,
-    field: keyof Rule,
-    value: Rule[typeof field]
-  ) {
-    const newRules = [...repoRules];
-    newRules[index] = { ...newRules[index], [field]: value };
-    setRepoRules(newRules);
-  }
-
-  return (
-    <Box>
-      <Validation>
-        {({ validator }) => (
-          <Box mt="3">
-            <H2 mb="3">Step 2: Input Your GitHub Account Info</H2>
-            <Text mb="3">
-              These fields will be combined with your bot's permissions to
-              create a join token and generate a sample GitHub Actions file.
-            </Text>
-
-            {repoRules.map((rule, i) => (
-              <Card p="4" maxWidth="540px" key={i} mb="4">
-                <Box>
-                  <Flex alignItems="center" justifyContent="space-between">
-                    <Text bold>GitHub Repository Access:</Text>
-                    {i > 0 && (
-                      <ButtonIcon
-                        size={1}
-                        title="Remove Rule"
-                        onClick={() =>
-                          setRepoRules(
-                            repoRules.filter((r, index) => index !== i)
-                          )
-                        }
-                      >
-                        <Icons.Trash size="medium" />
-                      </ButtonIcon>
-                    )}
-                  </Flex>
-                  <FormItem>
-                    <Text mt="3">Full URL to Your Repository*</Text>
-                    <FieldInput
-                      disabled={isLoading}
-                      rule={requireValidRepository}
-                      label=" "
-                      placeholder="https://github.com/gravitational/teleport"
-                      value={repoRules[i].repoAddress}
-                      onChange={e =>
-                        handleChange(i, 'repoAddress', e.target.value)
-                      }
-                    />
-                  </FormItem>
-
-                  <FormItem>
-                    <Flex>
-                      <Box width="100%">
-                        <Text>
-                          Git Ref <OptionalFieldText />
-                        </Text>
-                        <Input
-                          disabled={isLoading}
-                          placeholder="main"
-                          style={{ borderRadius: '4px 0 0 4px' }}
-                          value={repoRules[i].ref}
-                          onChange={e => handleChange(i, 'ref', e.target.value)}
-                        />
-                      </Box>
-                      <Box minWidth="160px">
-                        <Text ml="1">Ref Type</Text>
-                        <RefTypeSelect
-                          isDisabled={isLoading}
-                          isMulti={false}
-                          value={repoRules[i].refType}
-                          onChange={o => handleChange(i, 'refType', o)}
-                          options={refTypeOptions}
-                          menuPlacement="auto"
-                        />
-                      </Box>
-                    </Flex>
-                  </FormItem>
-
-                  <FormItem>
-                    <Text>
-                      Name of the GitHub Actions Workflow
-                      <OptionalFieldText />
-                    </Text>
-                    <FieldInput
-                      disabled={isLoading}
-                      placeholder="cd"
-                      value={repoRules[i].workflowName}
-                      onChange={e =>
-                        handleChange(i, 'workflowName', e.target.value)
-                      }
-                    />
-                  </FormItem>
-
-                  <FormItem>
-                    <Text>
-                      Environment <OptionalFieldText />
-                    </Text>
-                    <Input
-                      disabled={isLoading}
-                      placeholder="development"
-                      value={repoRules[i].environment}
-                      onChange={e =>
-                        handleChange(i, 'environment', e.target.value)
-                      }
-                    />
-                  </FormItem>
-
-                  <Box>
-                    <Text>
-                      Restrict to a GitHub User
-                      <OptionalFieldText />{' '}
-                    </Text>
-                    <Input
-                      disabled={isLoading}
-                      placeholder="octocat"
-                      value={repoRules[i].actor}
-                      onChange={e => handleChange(i, 'actor', e.target.value)}
-                    />
-                    <Text
-                      fontWeight="lighter"
-                      fontSize="1"
-                      style={{ fontStyle: 'italic' }}
-                    >
-                      If left blank, any GitHub user can trigger the workflow
-                    </Text>
-                  </Box>
-                </Box>
-              </Card>
-            ))}
-            <Box mb="4">
-              {attempt.status === 'failed' && (
-                <Alert kind="danger">{attempt.statusText}</Alert>
-              )}
-              {hostError && <Alert kind="danger">{hostError}</Alert>}
-              <ButtonSecondary disabled={isLoading} onClick={addEmptyRepoRule}>
-                + Add Another Set of Repository Rules
-              </ButtonSecondary>
-            </Box>
-            <FlowButtons
-              backButton={{
-                disabled: isLoading,
-                hidden: false,
-              }}
-              nextButton={{
-                disabled: isLoading,
-              }}
-              nextStep={() => handleNext(validator)}
-              prevStep={() => {
-                resetAttempt();
-                prevStep();
-              }}
-            />
-          </Box>
-        )}
-      </Validation>
-    </Box>
-  );
-}
-
-const RefTypeSelect = styled(Select<RefTypeOption>)`
-  .react-select__control {
-    border-radius: 0 4px 4px 0;
-    border-left-color: transparent;
-  }
-
-  .react-select__control--is-focused {
-    border-left-color: ${props =>
-      props.theme.colors.interactive.solid.primary.default};
-  }
-`;
-
-const FormItem = styled(Box)`
-  margin-bottom: ${props => props.theme.space[4]}px;
-  max-width: 500px;
-`;
-const OptionalFieldText = () => (
-  <Text
-    style={{ display: 'inline', lineHeight: '12px' }}
-    fontWeight="lighter"
-    fontSize="1"
-  >
-    {' '}
-    (optional)
-  </Text>
-);
-
-const requireValidRepository = value => () => {
-  if (!value) {
-    return { valid: false, message: 'Repository is required' };
-  }
-  let repoAddr = value.trim();
-  if (!repoAddr) {
-    return { valid: false, message: 'Repository is required' };
-  }
-
-  // add protocol if user omited it
-  if (!repoAddr.startsWith('http://') && !repoAddr.startsWith('https://')) {
-    repoAddr = `https://${repoAddr}`;
-  }
-
-  try {
-    const { owner, repository } = parseRepoAddress(repoAddr);
-    if (owner.trim() === '' || repository.trim() == '') {
-      return {
-        valid: false,
-        message:
-          'URL expected to be in the format https://<host>/<owner>/<repository>',
-      };
-    }
-
-    return { valid: true };
-  } catch (e) {
-    return { valid: false, message: e?.message };
-  }
-};
-
-const MultipleHostsError = () => {
-  return (
-    <Text>
-      All repositories must be in the same host. Please create different bots
-      for each host.
-    </Text>
-  );
-};
-
-const EnterpriseHostError = () => {
-  return (
-    <Box>
-      GitHub Enterprise Server Host require Teleport Enterprise.Please use a
-      repository hosted at github.com or{' '}
-      <Link target="_blank" href="https://goteleport.com/signup/enterprise/">
-        contact us
-      </Link>
-      .
-    </Box>
-  );
-};
-const InvalidHostError = ({ rule, error }: { rule: string; error: string }) => {
-  return (
-    <Box>
-      Invalid address {rule}: {error}
-    </Box>
-  );
-};
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/Finish.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/Finish.tsx
deleted file mode 100644
index 5ec2c6d0c07a9..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/Finish.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { Link } from 'react-router-dom';
-
-import { ButtonPrimary, ButtonSecondary } from 'design/Button';
-import Flex from 'design/Flex';
-import Image from 'design/Image';
-import Text, { H2 } from 'design/Text';
-
-import cfg from 'teleport/config';
-import celebratePamPng from 'teleport/Discover/Shared/Finished/celebrate-pam.png';
-
-import { useGitHubFlow } from './useGitHubFlow';
-
-export function Finish() {
-  const { createBotRequest } = useGitHubFlow();
-
-  return (
-    <Flex
-      width="600px"
-      flexDirection="column"
-      alignItems="center"
-      mt={5}
-      css={`
-        margin-right: auto;
-        margin-left: auto;
-        text-align: center;
-      `}
-    >
-      <Image width="120px" height="120px" src={celebratePamPng} />
-      <H2 mt={3} mb={2}>
-        Your Bot is Added to Teleport
-      </H2>
-      <Text mb={3}>
-        Bot {createBotRequest.botName} has been successfully added to this
-        Teleport Cluster. You can see {createBotRequest.botName} in the Bots
-        page and you can always find the sample GitHub Actions workflow again
-        from the bot's options.
-      </Text>
-      <Flex gap="4">
-        <ButtonPrimary as={Link} to={cfg.getBotsRoute()} size="large">
-          View Bots
-        </ButtonPrimary>
-        <ButtonSecondary as={Link} to={cfg.getBotsNewRoute()} size="large">
-          Add Another Bot
-        </ButtonSecondary>
-      </Flex>
-    </Flex>
-  );
-}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.test.tsx
deleted file mode 100644
index d838940fccd4c..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.test.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { MemoryRouter } from 'react-router';
-
-import { render, screen, userEvent } from 'design/utils/testing';
-
-import { ContextProvider } from 'teleport';
-import { allAccessAcl, noAccess } from 'teleport/mocks/contexts';
-import * as botService from 'teleport/services/bot/bot';
-import TeleportContext from 'teleport/teleportContext';
-
-import { GitHubActions } from './GitHubActions';
-import { GitHubFlowProvider } from './useGitHubFlow';
-
-const tokenName = 'generated-test-token';
-const authVersion = 'v15.0.0';
-
-describe('gitHub component', () => {
-  afterEach(() => {
-    jest.clearAllMocks();
-  });
-
-  type SetupProps = {
-    hasAccess?: boolean;
-  };
-
-  const setup = ({ hasAccess = true }: SetupProps) => {
-    const ctx = new TeleportContext();
-    ctx.storeUser.setState({
-      username: 'joe@example.com',
-      acl: hasAccess ? allAccessAcl : { ...allAccessAcl, bots: noAccess },
-      cluster: {
-        authVersion: authVersion,
-        clusterId: 'cluster-id',
-        connectedText: 'connected-text',
-        lastConnected: new Date('2023-01-01'),
-        proxyVersion: 'v15.0.0',
-        publicURL: 'publicurl',
-        status: 'ok',
-        url: 'url',
-      },
-    });
-
-    jest.spyOn(ctx.resourceService, 'createRole').mockResolvedValue({
-      id: 'role-id',
-      kind: 'role',
-      name: 'role-name',
-      content: '',
-    });
-    jest.spyOn(ctx.joinTokenService, 'fetchJoinToken').mockResolvedValue({
-      id: tokenName,
-      expiry: new Date('2020-01-01'),
-      safeName: '',
-      isStatic: false,
-      method: 'kubernetes',
-      roles: [],
-      content: '',
-    });
-    jest.spyOn(botService, 'createBot').mockResolvedValue();
-    jest.spyOn(botService, 'createBotToken').mockResolvedValue({
-      integrationName: 'test-integration',
-      joinMethod: 'github',
-      webFlowLabel: 'github-actions-ssh',
-    });
-    jest.spyOn(botService, 'getBot').mockResolvedValue(null);
-
-    render(
-      <MemoryRouter>
-        <ContextProvider ctx={ctx}>
-          <GitHubFlowProvider>
-            <GitHubActions />
-          </GitHubFlowProvider>
-        </ContextProvider>
-      </MemoryRouter>
-    );
-  };
-
-  it('renders initial state with warning if user has no access', () => {
-    setup({ hasAccess: false });
-    expect(screen.getByText(/Insufficient permissions/)).toBeInTheDocument();
-    expect(screen.getByTestId('button-next')).toBeDisabled();
-    expect(screen.getByTestId('button-back-first-step')).toBeEnabled();
-  });
-
-  it('renders initial state with no warnings if user the necessary access', () => {
-    setup({});
-    expect(
-      screen.queryByText(/Insufficient permissions/)
-    ).not.toBeInTheDocument();
-    expect(screen.getByTestId('button-next')).toBeEnabled();
-  });
-
-  it('allows the user to go through the whole flow', async () => {
-    setup({});
-    expect(
-      screen.getByText(/Step 1: Scope the Permissions for Your Bot/)
-    ).toBeInTheDocument();
-    // fill up the forms and go through the flow
-    // step 1: Configure Bot Access
-    const botNameInput = screen.getByPlaceholderText('github-actions-cd');
-    await userEvent.type(botNameInput, 'bot-name');
-    const sshUserInput = screen.getByPlaceholderText('ubuntu');
-    await userEvent.type(sshUserInput, 'ssh-user');
-    await userEvent.click(screen.getByTestId('button-next'));
-    // step 2: Connect GitHub
-    expect(
-      screen.getByText(/Step 2: Input Your GitHub Account Info/)
-    ).toBeInTheDocument();
-    const repositoryInput = screen.getByPlaceholderText(
-      'https://github.com/gravitational/teleport'
-    );
-    await userEvent.type(repositoryInput, 'https://github.com/owner/repo');
-    await userEvent.click(screen.getByTestId('button-next'));
-    // step 3: Add Bot to GitHub
-    expect(
-      screen.getByText(/Step 3: Connect Your Bot in a GitHub Actions Workflow/)
-    ).toBeInTheDocument();
-    await userEvent.click(screen.getByTestId('button-next'));
-    // Finish screen
-    expect(
-      screen.getByText(/Your Bot is Added to Teleport/)
-    ).toBeInTheDocument();
-    expect(screen.getByText(/View Bots/)).toBeInTheDocument();
-    expect(screen.getByText(/Add Another Bot/)).toBeInTheDocument();
-  });
-});
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.tsx
deleted file mode 100644
index 4332e2f466c6c..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/GitHubActions.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-import { ResourceIcon } from 'design/ResourceIcon';
-
-import { GuidedFlow, View } from '../Shared/GuidedFlow';
-import { AddBotToWorkflow } from './AddBotToWorkflow';
-import { ConfigureBot } from './ConfigureBot';
-import { ConnectGitHub } from './ConnectGitHub';
-import { Finish } from './Finish';
-import { GitHubFlowProvider } from './useGitHubFlow';
-
-const views: View[] = [
-  {
-    name: 'Configure Bot Access',
-    component: ConfigureBot,
-  },
-  {
-    name: 'Connect GitHub',
-    component: ConnectGitHub,
-  },
-  {
-    name: 'Add Bot to GitHub',
-    component: AddBotToWorkflow,
-  },
-  {
-    name: 'Finish',
-    component: Finish,
-  },
-];
-
-export function GitHubActions() {
-  return (
-    <GitHubFlowProvider>
-      <GuidedFlow
-        title="GitHub Actions and Machine ID Integration"
-        icon={<ResourceIcon name="github" width="20px" />}
-        views={views}
-        name="GitHub Actions"
-      />
-    </GitHubFlowProvider>
-  );
-}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/index.ts b/web/packages/teleport/src/Bots/Add/GitHubActions/index.ts
deleted file mode 100644
index af98f36257a65..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-export { GitHubActions as default } from './GitHubActions';
-export { ConnectGitHub as ConfigureBot } from './ConnectGitHub';
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.test.tsx
deleted file mode 100644
index 63857989635b2..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.test.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 20024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { parseRepoAddress } from './useGitHubFlow';
-
-describe('parseRepoAddress with valid inputs', () => {
-  const testCases = [
-    {
-      url: 'https://github.com/gravitational/teleport',
-      expected: {
-        host: 'github.com',
-        owner: 'gravitational',
-        repository: 'teleport',
-      },
-    },
-    {
-      url: 'github.com/gravitational/teleport',
-      expected: {
-        host: 'github.com',
-        owner: 'gravitational',
-        repository: 'teleport',
-      },
-    },
-    {
-      url: 'https://www.example.com/company/project',
-      expected: {
-        host: 'www.example.com',
-        owner: 'company',
-        repository: 'project',
-      },
-    },
-    {
-      url: 'www.example.com/company/project',
-      expected: {
-        host: 'www.example.com',
-        owner: 'company',
-        repository: 'project',
-      },
-    },
-  ];
-  test.each(testCases)(
-    'should return repo="$expected" for url=$url',
-    ({ url, expected }) => {
-      const result = parseRepoAddress(url);
-      expect(result).toEqual(expected);
-    }
-  );
-});
-
-describe('parseRepoAddress throws with invalid inputs', () => {
-  const testCases = [
-    {
-      url: 'https://github.com',
-      expectedErr:
-        'URL expected to be in the format https://<host>/<owner>/<repository>',
-    },
-    {
-      url: 'https://github.com/owner',
-      expectedErr:
-        'URL expected to be in the format https://<host>/<owner>/<repository>',
-    },
-    {
-      url: 'invalid URL',
-      expectedErr: 'Must be a valid URL',
-    },
-  ];
-  test.each(testCases)(
-    'should throw with message="$expectedErr" for url=$url',
-    ({ url, expectedErr }) => {
-      expect(() => parseRepoAddress(url)).toThrow(expectedErr);
-    }
-  );
-});
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.tsx b/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.tsx
deleted file mode 100644
index 0284aa9ffff05..0000000000000
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/useGitHubFlow.tsx
+++ /dev/null
@@ -1,252 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import React, { useContext, useState } from 'react';
-
-import { Option } from 'shared/components/Select';
-import useAttempt, { Attempt } from 'shared/hooks/useAttemptNext';
-
-import { ResourceLabel } from 'teleport/services/agents';
-import {
-  createBotToken,
-  GITHUB_ACTIONS_LABEL_KEY,
-  createBot as serviceCreateBot,
-} from 'teleport/services/bot';
-import {
-  BotUiFlow,
-  CreateBotRequest,
-  GitHubRepoRule,
-  RefType,
-} from 'teleport/services/bot/types';
-import useTeleport from 'teleport/useTeleport';
-
-export const GITHUB_HOST = 'github.com';
-const GITHUB_ACTIONS_LABEL_VAL = BotUiFlow.GitHubActionsSsh;
-
-type GitHubFlowContext = {
-  attempt: Attempt;
-  createBotRequest: CreateBotRequest;
-  setCreateBotRequest: React.Dispatch<React.SetStateAction<CreateBotRequest>>;
-  repoRules: Rule[];
-  setRepoRules: React.Dispatch<React.SetStateAction<Rule[]>>;
-  addEmptyRepoRule: () => void;
-  tokenName: string;
-  createBot: () => Promise<boolean>;
-  resetAttempt: () => void;
-};
-
-const gitHubFlowContext = React.createContext<GitHubFlowContext>(null);
-
-export const initialBotState = {
-  labels: [{ name: '*', value: '*' }],
-  login: '',
-  botName: '',
-  roles: [],
-};
-
-export function GitHubFlowProvider({
-  children,
-  bot = initialBotState,
-}: React.PropsWithChildren<{ bot?: CreateBotRequest }>) {
-  const { resourceService } = useTeleport();
-  const { attempt, run, setAttempt } = useAttempt();
-  const [createBotRequest, setCreateBotRequest] =
-    useState<CreateBotRequest>(bot);
-  const [repoRules, setRepoRules] = useState<Rule[]>([defaultRule]);
-  const [tokenName, setTokenName] = useState('');
-
-  function addEmptyRepoRule() {
-    setRepoRules([...repoRules, defaultRule]);
-  }
-
-  function resetAttempt() {
-    if (attempt.status !== 'processing') {
-      setAttempt({ status: '' });
-    }
-  }
-
-  function createBot(): Promise<boolean> {
-    return run(() =>
-      resourceService
-        .createRole(
-          getRoleYaml(
-            createBotRequest.botName,
-            createBotRequest.labels,
-            createBotRequest.login
-          )
-        )
-        .then(() => {
-          let repoHost = '';
-          // Check if user sent a GitHub Enterprise host address.
-          // We can just check the first rule, as the UI will not allow
-          // using different hosts on multiple rules.
-          if (repoRules.length > 0) {
-            const { host } = parseRepoAddress(repoRules[0].repoAddress);
-            // the enterprise server host should be omited if using github.com
-            if (host !== GITHUB_HOST) {
-              repoHost = host;
-            }
-          }
-
-          return createBotToken({
-            integrationName: createBotRequest.botName,
-            joinMethod: 'github',
-            webFlowLabel: GITHUB_ACTIONS_LABEL_VAL,
-            gitHub: {
-              enterpriseServerHost: repoHost,
-              allow: repoRules.map((r): GitHubRepoRule => {
-                const { owner, repository } = parseRepoAddress(r.repoAddress);
-                return {
-                  repository: `${owner}/${repository}`,
-                  repositoryOwner: owner,
-                  actor: r.actor,
-                  environment: r.environment,
-                  ref: r.ref,
-                  refType: r.refType.value || null,
-                  workflow: r.workflowName,
-                };
-              }),
-            },
-          }).then(token => {
-            setTokenName(token.id);
-            return serviceCreateBot({
-              ...createBotRequest,
-              roles: [createBotRequest.botName],
-            });
-          });
-        })
-    );
-  }
-
-  const value: GitHubFlowContext = {
-    attempt,
-    createBotRequest,
-    setCreateBotRequest,
-    repoRules,
-    setRepoRules,
-    addEmptyRepoRule,
-    tokenName,
-    createBot,
-    resetAttempt,
-  };
-
-  return (
-    <gitHubFlowContext.Provider value={value}>
-      {children}
-    </gitHubFlowContext.Provider>
-  );
-}
-
-export function useGitHubFlow(): GitHubFlowContext {
-  return useContext(gitHubFlowContext);
-}
-
-export type RefTypeOption = Option<RefType | ''>;
-
-export type Rule = {
-  workflowName: string;
-  environment: string;
-  ref: string;
-  refType: RefTypeOption;
-  repoAddress: string;
-  actor: string;
-};
-
-export const defaultRule: Rule = {
-  workflowName: '',
-  environment: '',
-  ref: '',
-  refType: { label: 'any', value: '' },
-  repoAddress: '',
-  actor: '',
-};
-
-/**
- * Parses the GitHub repository URL and returns the repository name and
- * its owner's name. Throws errors if parsing the URL fails or
- * the URL doesn't contains the expected format.
- * @param repoAddr repository address (with or without protocl)
- * @returns owner and repository name
- */
-export function parseRepoAddress(repoAddr: string): {
-  host: string;
-  owner: string;
-  repository: string;
-} {
-  // add protocol if it is missing
-  if (!repoAddr.startsWith('http://') && !repoAddr.startsWith('https://')) {
-    repoAddr = `https://${repoAddr}`;
-  }
-
-  let url;
-  try {
-    url = new URL(repoAddr);
-  } catch {
-    throw new Error('Must be a valid URL');
-  }
-
-  const paths = url.pathname.split('/');
-  // expected length is 3, since pathname starts with a /, so paths[0] should be empty
-  if (paths.length < 3) {
-    throw new Error(
-      'URL expected to be in the format https://<host>/<owner>/<repository>'
-    );
-  }
-
-  const owner = paths[1];
-  const repository = paths[2];
-  if (owner.trim() === '' || repository.trim() == '') {
-    throw new Error(
-      'URL expected to be in the format https://<host>/<owner>/<repository>'
-    );
-  }
-
-  return {
-    host: url.host,
-    owner,
-    repository,
-  };
-}
-
-function getRoleYaml(
-  botName: string,
-  labels: ResourceLabel[],
-  login: string
-): string {
-  const nodeLabels = labels
-    .map(label => `'${label.name}': '${label.value}'`)
-    .join('\n      ');
-
-  return `kind: role
-metadata:
-  name: ${botName}
-  labels:
-    ${GITHUB_ACTIONS_LABEL_KEY}: ${GITHUB_ACTIONS_LABEL_VAL}
-spec:
-  allow:
-    # List of allowed SSH logins
-    logins: [${login}]
-
-    # List of node labels that users can SSH into
-    node_labels:
-      ${nodeLabels}
-    options:
-      max_session_ttl: 8h0m0s
-version: v7
-  `;
-}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/CodePanel.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/CodePanel.tsx
new file mode 100644
index 0000000000000..8eb030f59b4e1
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/CodePanel.tsx
@@ -0,0 +1,93 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import { Tabs } from 'shared/components/Editor/Tabs';
+import TextEditor from 'shared/components/TextEditor/TextEditor';
+
+import {
+  IntegrationEnrollCodeType,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+
+import { useTracking } from '../Shared/useTracking';
+import { useGitHubK8sFlow } from './useGitHubK8sFlow';
+
+export function CodePanel(props: { trackingStep: IntegrationEnrollStep }) {
+  const { trackingStep } = props;
+  const [activeCodeTab, setActiveCodeTab] = useState(0);
+
+  const { template } = useGitHubK8sFlow();
+
+  const tracking = useTracking();
+
+  return (
+    <>
+      <Tabs
+        items={files}
+        activeIndex={activeCodeTab}
+        onSelect={setActiveCodeTab}
+      />
+      <TextEditor
+        bg="levels.deep"
+        data={[
+          {
+            content: makeTerraformContent(template),
+            type: 'terraform',
+          },
+          {
+            content: template.ghaWorkflow || '# Loading template...',
+            type: 'yaml',
+          },
+        ]}
+        activeIndex={activeCodeTab}
+        readOnly={true}
+        copyButton={true}
+        downloadButton={true}
+        downloadFileName={files[activeCodeTab]}
+        onCopy={() => {
+          tracking.codeCopy(trackingStep, trackingTypes[activeCodeTab]);
+        }}
+        onDownload={() => {
+          tracking.codeCopy(trackingStep, trackingTypes[activeCodeTab]);
+        }}
+      />
+    </>
+  );
+}
+
+const files = ['main.tf', 'gha-workflow.yaml'];
+const trackingTypes = [
+  IntegrationEnrollCodeType.Terraform,
+  IntegrationEnrollCodeType.GitHubActionsYAML,
+];
+
+function makeTerraformContent(
+  template: ReturnType<typeof useGitHubK8sFlow>['template']
+) {
+  if (template.terraform.error) {
+    return `# Failed to fetch template\n# ${template.terraform.error.message}`;
+  }
+
+  if (template.terraform.data) {
+    return template.terraform.data;
+  }
+
+  return '# Loading template...';
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.story.tsx
new file mode 100644
index 0000000000000..b3cb2866ca7ea
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.story.tsx
@@ -0,0 +1,116 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import {
+  genWizardCiCdError,
+  genWizardCiCdForever,
+  genWizardCiCdSuccess,
+} from 'teleport/test/helpers/bots';
+import { fetchUnifiedResourcesSuccess } from 'teleport/test/helpers/resources';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { TrackingProvider } from '../Shared/useTracking';
+import { ConfigureAccess } from './ConfigureAccess';
+import { GitHubK8sFlowProvider } from './useGitHubK8sFlow';
+
+const meta = {
+  title: 'Teleport/Bots/Add/GitHubActions+K8s/ConfigureAccess',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        genWizardCiCdSuccess(),
+        fetchUnifiedResourcesSuccess(),
+        userEventCaptureSuccess(),
+      ],
+    },
+  },
+};
+
+export const TemplateFetchFailed: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        genWizardCiCdError(500, 'something went wrong'),
+        fetchUnifiedResourcesSuccess(),
+        userEventCaptureSuccess(),
+      ],
+    },
+  },
+};
+
+export const TemplateFetching: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        genWizardCiCdForever(),
+        fetchUnifiedResourcesSuccess(),
+        userEventCaptureSuccess(),
+      ],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper() {
+  const ctx = createTeleportContext();
+  return (
+    <QueryClientProvider client={queryClient}>
+      <ContextProvider ctx={ctx}>
+        <TrackingProvider>
+          <GitHubK8sFlowProvider>
+            <Container>
+              <ConfigureAccess />
+            </Container>
+          </GitHubK8sFlowProvider>
+        </TrackingProvider>
+      </ContextProvider>
+    </QueryClientProvider>
+  );
+}
+
+const Container = styled(Flex)`
+  height: 820px;
+  overflow: auto;
+`;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.test.tsx
new file mode 100644
index 0000000000000..6f11dc2ff45e7
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.test.tsx
@@ -0,0 +1,243 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import selectEvent from 'react-select-event';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  act,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  within,
+} from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { genWizardCiCdSuccess } from 'teleport/test/helpers/bots';
+import { fetchUnifiedResourcesSuccess } from 'teleport/test/helpers/resources';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { trackingTester } from '../Shared/trackingTester';
+import { TrackingProvider } from '../Shared/useTracking';
+import { ConfigureAccess } from './ConfigureAccess';
+import { GitHubK8sFlowProvider, useGitHubK8sFlow } from './useGitHubK8sFlow';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+
+  // Basic mock for all tests
+  server.use(genWizardCiCdSuccess());
+  server.use(fetchUnifiedResourcesSuccess());
+  server.use(userEventCaptureSuccess());
+
+  jest.useFakeTimers();
+});
+
+afterAll(() => {
+  server.close();
+
+  jest.useRealTimers();
+  jest.resetAllMocks();
+});
+
+describe('ConfigureAccess', () => {
+  test('renders', async () => {
+    renderComponent({
+      initialState: {
+        allowAnyBranch: false,
+        branch: 'main',
+        enterpriseJwks: '{"keys":[]}',
+        enterpriseSlug: 'octo-enterprise',
+        environment: 'production',
+        gitHubUrl: 'https://github.com/gravitational/teleport',
+        isBranchDisabled: false,
+        ref: 'main',
+        refType: 'branch',
+        workflow: 'my-workflow',
+        kubernetesGroups: ['viewers'],
+        kubernetesLabels: [{ name: '*', values: ['*'] }],
+        kubernetesUsers: ['user@example.com'],
+      },
+    });
+
+    expect(
+      screen.getByRole('heading', { name: 'Configure Access' })
+    ).toBeInTheDocument();
+
+    expect(screen.getByLabelText('Kubernetes Groups')).toBeInTheDocument();
+    expect(screen.getByLabelText('Labels')).toBeInTheDocument();
+    expect(screen.getByLabelText('Kubernetes Users')).toBeInTheDocument();
+  });
+
+  test('navigation', async () => {
+    const { onNextStep, onPrevStep, user } = renderComponent({
+      initialState: {
+        allowAnyBranch: false,
+        branch: 'main',
+        enterpriseJwks: '{"keys":[]}',
+        enterpriseSlug: 'octo-enterprise',
+        environment: 'production',
+        gitHubUrl: 'https://github.com/gravitational/teleport',
+        isBranchDisabled: false,
+        ref: 'main',
+        refType: 'branch',
+        workflow: 'my-workflow',
+        kubernetesGroups: [],
+        kubernetesLabels: [{ name: '*', values: ['*'] }],
+        kubernetesUsers: [],
+      },
+    });
+
+    await user.click(screen.getByRole('button', { name: 'Next' }));
+    expect(onNextStep).toHaveBeenCalledTimes(1);
+    expect(onPrevStep).toHaveBeenCalledTimes(0);
+
+    await user.click(screen.getByRole('button', { name: 'Back' }));
+    expect(onNextStep).toHaveBeenCalledTimes(1);
+    expect(onPrevStep).toHaveBeenCalledTimes(1);
+  });
+
+  test('input groups', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Kubernetes Groups');
+    await selectEvent.create(input, 'system:masters');
+    await user.type(input, 'viewers{enter}');
+
+    expect(screen.getByText('system:masters')).toBeInTheDocument();
+    expect(screen.getByText('viewers')).toBeInTheDocument();
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS'
+    );
+  });
+
+  test('input labels', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Labels');
+    await user.click(within(input).getByRole('button'));
+
+    const modal = screen.getByTestId('Modal');
+    const manualInput = within(modal).getByPlaceholderText('name: value');
+    await user.type(manualInput, 'foo: bar{enter}');
+    await user.click(within(modal).getByRole('button', { name: 'Done' }));
+
+    expect(modal).not.toBeInTheDocument();
+    expect(screen.getByText('foo: bar')).toBeInTheDocument();
+
+    // Skip start event
+    tracking.skip();
+    // Skip section event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS'
+    );
+  });
+
+  test('input users', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Kubernetes Users');
+    await selectEvent.create(input, 'user1@example.com');
+    await user.type(input, 'user2@example.com{enter}');
+
+    expect(screen.getByText('user1@example.com')).toBeInTheDocument();
+    expect(screen.getByText('user2@example.com')).toBeInTheDocument();
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS'
+    );
+  });
+});
+
+function renderComponent(opts?: {
+  initialState?: ReturnType<typeof useGitHubK8sFlow>['state'];
+  disableTracking?: boolean;
+}) {
+  const user = userEvent.setup({
+    advanceTimers: t => jest.advanceTimersByTime(t),
+  });
+  const onNextStep = jest.fn();
+  const onPrevStep = jest.fn();
+  return {
+    ...render(<ConfigureAccess nextStep={onNextStep} prevStep={onPrevStep} />, {
+      wrapper: makeWrapper(opts),
+    }),
+    user,
+    onNextStep,
+    onPrevStep,
+  };
+}
+
+function makeWrapper(opts?: {
+  initialState?: ReturnType<typeof useGitHubK8sFlow>['state'];
+  disableTracking?: boolean;
+}) {
+  const { initialState, disableTracking = false } = opts ?? {};
+  const ctx = createTeleportContext();
+
+  return ({ children }: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ContextProvider ctx={ctx}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <TrackingProvider disabled={disableTracking}>
+              <GitHubK8sFlowProvider intitialState={initialState}>
+                {children}
+              </GitHubK8sFlowProvider>
+            </TrackingProvider>
+          </ConfiguredThemeProvider>
+        </ContextProvider>
+      </QueryClientProvider>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.tsx
new file mode 100644
index 0000000000000..caa16802f7f5f
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConfigureAccess.tsx
@@ -0,0 +1,245 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import Box from 'design/Box/Box';
+import { ButtonPrimary, ButtonSecondary } from 'design/Button/Button';
+import Flex from 'design/Flex/Flex';
+import Link from 'design/Link/Link';
+import Text, { H2 } from 'design/Text';
+import { FieldSelectCreatable } from 'shared/components/FieldSelect/FieldSelectCreatable';
+import Validator, { Validation } from 'shared/components/Validation/Validation';
+
+import { SectionBox } from 'teleport/Roles/RoleEditor/StandardEditor/sections';
+import {
+  IntegrationEnrollField,
+  IntegrationEnrollSection,
+  IntegrationEnrollStatusCode,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { useTracking } from '../Shared/useTracking';
+import { CodePanel } from './CodePanel';
+import { KubernetesLabelsSelect } from './KubernetesLabelsSelect';
+import { useGitHubK8sFlow } from './useGitHubK8sFlow';
+
+export function ConfigureAccess(props: FlowStepProps) {
+  const { nextStep, prevStep } = props;
+
+  const { dispatch, state } = useGitHubK8sFlow();
+  const tracking = useTracking();
+
+  const handleNext = (validator: Validator) => {
+    if (!validator.validate()) {
+      tracking.error(
+        IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+        'validation error'
+      );
+      return;
+    }
+
+    tracking.step(
+      IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+      IntegrationEnrollStatusCode.Success
+    );
+
+    nextStep?.();
+  };
+
+  return (
+    <Container>
+      <FormContainer>
+        <Box>
+          <H2 mb={3} mt={3}>
+            Configure Access
+          </H2>
+
+          <Text mb={3}>
+            Fine tune the access your workflow needs to perform its steps.
+            Restrict which clusters can be accessed using labels and what level
+            of access using the other options.
+          </Text>
+        </Box>
+
+        <Validation>
+          {({ validator }) => (
+            <>
+              <div>
+                <KubernetesLabelsSelect
+                  mt={2}
+                  selected={state.kubernetesLabels}
+                  onChange={labels => {
+                    dispatch({
+                      type: 'kubernetes-labels-changed',
+                      value: labels,
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                      IntegrationEnrollField.MWIGHAK8SKubernetesLabels
+                    );
+                  }}
+                />
+                <Text mt={3} mb={3}>
+                  Your workflow will have access to Kubernetes clusters which
+                  satisfy the labels you specify. Visit the{' '}
+                  <Link
+                    target="_blank"
+                    href={K8S_RBAC_LINK}
+                    onClick={() => {
+                      tracking.link(
+                        IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                        K8S_RBAC_LINK
+                      );
+                    }}
+                  >
+                    Teleport Kubernetes Access Controls
+                  </Link>{' '}
+                  docs for information about using Kubernetes labels.
+                </Text>
+
+                <FieldSelectCreatable
+                  label="Kubernetes Groups"
+                  mt={2}
+                  placeholder="e.g. system:masters"
+                  isMulti
+                  value={state.kubernetesGroups.map(g => ({
+                    label: g,
+                    value: g,
+                  }))}
+                  onChange={e => {
+                    dispatch({
+                      type: 'kubernetes-groups-changed',
+                      value: e.map(g => g.value),
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                      IntegrationEnrollField.MWIGHAK8SKubernetesGroups
+                    );
+                  }}
+                  createOptionPosition="last"
+                />
+                <Text mb={3}>
+                  Add Kubernetes groups created using RoleBinding or
+                  ClusterRoleBinding resources. See the{' '}
+                  <Link
+                    target="_blank"
+                    href={K8S_RBAC_LINK}
+                    onClick={() => {
+                      tracking.link(
+                        IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                        K8S_RBAC_LINK
+                      );
+                    }}
+                  >
+                    Teleport Kubernetes Access Controls
+                  </Link>{' '}
+                  docs for information about mapping groups to roles.
+                </Text>
+              </div>
+
+              {/* TODO(nicholasmarais1158): Make SectionBox a component instead of reusing it from Roles */}
+              <SectionBox
+                titleSegments={['Advanced options']}
+                initiallyCollapsed={state.kubernetesUsers.length === 0}
+                validation={{
+                  valid: true,
+                }}
+                onExpand={() => {
+                  tracking.section(
+                    IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                    IntegrationEnrollSection.MWIGHAK8SKubernetesAdvancedOptions
+                  );
+                }}
+              >
+                <FieldSelectCreatable
+                  label="Kubernetes Users"
+                  mt={2}
+                  isMulti
+                  placeholder={'e.g. user@example.com'}
+                  value={state.kubernetesUsers.map(g => ({
+                    label: g,
+                    value: g,
+                  }))}
+                  onChange={e => {
+                    dispatch({
+                      type: 'kubernetes-users-changed',
+                      value: e.map(g => g.value),
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+                      IntegrationEnrollField.MWIGHAK8SKubernetesUsers
+                    );
+                  }}
+                  createOptionPosition="last"
+                />
+                <Text mb={3}>
+                  See the{' '}
+                  <Link
+                    target="_blank"
+                    href="https://goteleport.com/docs/enroll-resources/kubernetes-access/controls/"
+                  >
+                    Teleport Kubernetes Access Controls
+                  </Link>{' '}
+                  docs for more information about using users and service
+                  accounts.
+                </Text>
+              </SectionBox>
+
+              <Flex gap={2} pt={5}>
+                <ButtonPrimary onClick={() => handleNext(validator)}>
+                  Next
+                </ButtonPrimary>
+                <ButtonSecondary onClick={prevStep}>Back</ButtonSecondary>
+              </Flex>
+            </>
+          )}
+        </Validation>
+      </FormContainer>
+
+      <CodeContainer>
+        <CodePanel
+          trackingStep={IntegrationEnrollStep.MWIGHAK8SConfigureAccess}
+        />
+      </CodeContainer>
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  flex: 1;
+  overflow: auto;
+  gap: ${({ theme }) => theme.space[1]}px;
+`;
+
+const FormContainer = styled(Flex)`
+  flex: 4;
+  flex-direction: column;
+  overflow: auto;
+  padding-right: ${({ theme }) => theme.space[5]}px;
+`;
+
+const CodeContainer = styled(Flex)`
+  flex: 6;
+  flex-direction: column;
+  overflow: auto;
+`;
+
+const K8S_RBAC_LINK =
+  'https://goteleport.com/docs/enroll-resources/kubernetes-access/controls/';
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.story.tsx
new file mode 100644
index 0000000000000..ad1f828a17c40
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.story.tsx
@@ -0,0 +1,106 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import {
+  genWizardCiCdError,
+  genWizardCiCdForever,
+  genWizardCiCdSuccess,
+} from 'teleport/test/helpers/bots';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { TrackingProvider } from '../Shared/useTracking';
+import { ConnectGitHub } from './ConnectGitHub';
+import { GitHubK8sFlowProvider } from './useGitHubK8sFlow';
+
+const meta = {
+  title: 'Teleport/Bots/Add/GitHubActions+K8s/ConnectGitHub',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [genWizardCiCdSuccess(), userEventCaptureSuccess()],
+    },
+  },
+};
+
+export const TemplateFetchFailed: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        genWizardCiCdError(500, 'something went wrong'),
+        userEventCaptureSuccess(),
+      ],
+    },
+  },
+};
+
+export const TemplateFetching: Story = {
+  parameters: {
+    msw: {
+      handlers: [genWizardCiCdForever(), userEventCaptureSuccess()],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper() {
+  const ctx = createTeleportContext();
+  return (
+    <QueryClientProvider client={queryClient}>
+      <ContextProvider ctx={ctx}>
+        <TrackingProvider>
+          <GitHubK8sFlowProvider>
+            <Container>
+              <ConnectGitHub />
+            </Container>
+          </GitHubK8sFlowProvider>
+        </TrackingProvider>
+      </ContextProvider>
+    </QueryClientProvider>
+  );
+}
+
+const Container = styled(Flex)`
+  height: 820px;
+  overflow: auto;
+`;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.test.tsx
new file mode 100644
index 0000000000000..00778e8db8726
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.test.tsx
@@ -0,0 +1,399 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { ComponentProps, PropsWithChildren } from 'react';
+import selectEvent from 'react-select-event';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  act,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+} from 'design/utils/testing';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { genWizardCiCdSuccess } from 'teleport/test/helpers/bots';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { trackingTester } from '../Shared/trackingTester';
+import { TrackingProvider } from '../Shared/useTracking';
+import { ConnectGitHub } from './ConnectGitHub';
+import { GitHubK8sFlowProvider } from './useGitHubK8sFlow';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+
+  // Basic mock for all tests
+  server.use(genWizardCiCdSuccess());
+  server.use(userEventCaptureSuccess());
+
+  jest.useFakeTimers();
+});
+
+afterAll(() => {
+  server.close();
+
+  jest.useRealTimers();
+  jest.resetAllMocks();
+});
+
+describe('ConnectGitHub', () => {
+  test('renders', async () => {
+    renderComponent({
+      initialState: {
+        allowAnyBranch: false,
+        branch: 'main',
+        enterpriseJwks: '{"keys":[]}',
+        enterpriseSlug: 'octo-enterprise',
+        environment: 'production',
+        gitHubUrl: 'https://github.com/gravitational/teleport',
+        isBranchDisabled: false,
+        ref: 'main',
+        refType: 'branch',
+        workflow: 'my-workflow',
+        kubernetesGroups: [],
+        kubernetesLabels: [{ name: '*', values: ['*'] }],
+        kubernetesUsers: [],
+      },
+    });
+
+    expect(
+      screen.getByRole('heading', { name: 'Connect to GitHub' })
+    ).toBeInTheDocument();
+
+    expect(
+      screen.getByPlaceholderText('https://github.com/gravitational/teleport')
+    ).toHaveValue('https://github.com/gravitational/teleport');
+
+    expect(screen.getAllByPlaceholderText('refs/heads/main')[0]).toHaveValue(
+      'main'
+    );
+
+    expect(screen.getByPlaceholderText('my-workflow')).toHaveValue(
+      'my-workflow'
+    );
+
+    expect(screen.getByPlaceholderText('production')).toHaveValue('production');
+
+    expect(screen.getAllByPlaceholderText('refs/heads/main')[1]).toHaveValue(
+      'main'
+    );
+
+    expect(screen.getByPlaceholderText('octo-enterprise')).toHaveValue(
+      'octo-enterprise'
+    );
+
+    expect(screen.getByPlaceholderText('{"keys":[ --snip-- ]}')).toHaveValue(
+      '{"keys":[]}'
+    );
+  });
+
+  test('navigation', async () => {
+    const { onNextStep, onPrevStep, user } = renderComponent({
+      initialState: {
+        allowAnyBranch: false,
+        branch: 'main',
+        enterpriseJwks: '{"keys":[]}',
+        enterpriseSlug: 'octo-enterprise',
+        environment: 'production',
+        gitHubUrl: 'https://github.com/gravitational/teleport',
+        isBranchDisabled: false,
+        ref: 'main',
+        refType: 'branch',
+        workflow: 'my-workflow',
+        kubernetesGroups: [],
+        kubernetesLabels: [{ name: '*', values: ['*'] }],
+        kubernetesUsers: [],
+      },
+    });
+
+    await user.click(screen.getByRole('button', { name: 'Next' }));
+    expect(onNextStep).toHaveBeenCalledTimes(1);
+    expect(onPrevStep).toHaveBeenCalledTimes(0);
+
+    await user.click(screen.getByRole('button', { name: 'Back' }));
+    expect(onNextStep).toHaveBeenCalledTimes(1);
+    expect(onPrevStep).toHaveBeenCalledTimes(1);
+  });
+
+  test('input github url', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Repository URL');
+    await user.type(input, 'https://github.com/foo/bar');
+
+    expect(input).toHaveValue('https://github.com/foo/bar');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL'
+    );
+  });
+
+  test('input branch', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Branch');
+    await user.type(input, 'main');
+
+    expect(input).toHaveValue('main');
+    expect(screen.getByLabelText('Git Ref')).toHaveValue('main');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH'
+    );
+  });
+
+  test('toggle allow any branch', async () => {
+    const { user } = renderComponent({ disableTracking: true });
+
+    const input = screen.getByLabelText('Branch');
+    await user.type(input, 'main');
+
+    const check = screen.getByLabelText('Allow any branch');
+    await user.click(check);
+
+    expect(input).toHaveValue('');
+  });
+
+  test('input workflow', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Workflow');
+    await user.type(input, 'my-workflow');
+
+    expect(input).toHaveValue('my-workflow');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW'
+    );
+  });
+
+  test('input environment', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Environment');
+    await user.type(input, 'production');
+
+    expect(input).toHaveValue('production');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT'
+    );
+  });
+
+  test('input ref and type', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent();
+
+    const input = screen.getByLabelText('Git Ref');
+    await user.type(input, 'release-*');
+
+    expect(input).toHaveValue('release-*');
+    expect(screen.getByLabelText('Branch')).toHaveValue('release-*');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF'
+    );
+
+    const select = screen.getByLabelText('Ref Type');
+    await selectEvent.select(select, ['Tag']);
+
+    expect(input).toHaveValue('release-*');
+    expect(screen.getByLabelText('Branch')).toHaveValue('');
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF'
+    );
+  });
+
+  test('input slug disabled', async () => {
+    renderComponent();
+
+    const input = screen.getByLabelText('Enterprise slug');
+    expect(input).toBeDisabled();
+  });
+
+  test('input slug', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent({
+      isEnterprise: true,
+    });
+
+    const input = screen.getByLabelText('Enterprise slug');
+    await user.type(input, 'octo-enterprise');
+
+    expect(input).toHaveValue('octo-enterprise');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG'
+    );
+  });
+
+  test('input jwks disabled', async () => {
+    renderComponent();
+
+    const input = screen.getByLabelText('Enterprise JWKS');
+    expect(input).toBeDisabled();
+  });
+
+  test('input jwks', async () => {
+    const tracking = trackingTester();
+
+    const { user } = renderComponent({
+      isEnterprise: true,
+      initialState: {
+        gitHubUrl: 'example.com/owner/repo',
+        info: {
+          host: 'example.com',
+          owner: 'owner',
+          repository: 'repo',
+        },
+      },
+    });
+
+    const input = screen.getByLabelText('Enterprise JWKS');
+    await user.type(input, '{{"keys":[[]}'); // Note escaping of "{" and "["
+
+    expect(input).toHaveValue('{"keys":[]}');
+
+    // Skip start event
+    tracking.skip();
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS'
+    );
+  });
+});
+
+function renderComponent(opts?: {
+  initialState?: ComponentProps<typeof GitHubK8sFlowProvider>['intitialState'];
+  isEnterprise?: boolean;
+  disableTracking?: boolean;
+}) {
+  const user = userEvent.setup({
+    advanceTimers: t => jest.advanceTimersByTime(t),
+  });
+  const onNextStep = jest.fn();
+  const onPrevStep = jest.fn();
+  return {
+    ...render(<ConnectGitHub nextStep={onNextStep} prevStep={onPrevStep} />, {
+      wrapper: makeWrapper(opts),
+    }),
+    user,
+    onNextStep,
+    onPrevStep,
+  };
+}
+
+function makeWrapper(opts?: {
+  initialState?: ComponentProps<typeof GitHubK8sFlowProvider>['intitialState'];
+  isEnterprise?: boolean;
+  disableTracking?: boolean;
+}) {
+  const { initialState, isEnterprise = false, disableTracking } = opts ?? {};
+
+  cfg.isEnterprise = isEnterprise;
+  cfg.edition = isEnterprise ? 'ent' : 'oss';
+
+  const ctx = createTeleportContext();
+
+  return ({ children }: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ContextProvider ctx={ctx}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <TrackingProvider disabled={disableTracking}>
+              <GitHubK8sFlowProvider intitialState={initialState}>
+                {children}
+              </GitHubK8sFlowProvider>
+            </TrackingProvider>
+          </ConfiguredThemeProvider>
+        </ContextProvider>
+      </QueryClientProvider>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.tsx
new file mode 100644
index 0000000000000..7c73b6624c753
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/ConnectGitHub.tsx
@@ -0,0 +1,359 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import { Box, H2, Link, Text } from 'design';
+import { Info } from 'design/Alert/Alert';
+import { ButtonPrimary, ButtonSecondary } from 'design/Button/Button';
+import Flex from 'design/Flex/Flex';
+import { FieldCheckbox } from 'shared/components/FieldCheckbox/FieldCheckbox';
+import FieldInput from 'shared/components/FieldInput/FieldInput';
+import { FieldSelect } from 'shared/components/FieldSelect/FieldSelect';
+import Validation, { Validator } from 'shared/components/Validation';
+import { requiredField } from 'shared/components/Validation/rules';
+
+import cfg from 'teleport/config';
+import { SectionBox } from 'teleport/Roles/RoleEditor/StandardEditor/sections';
+import {
+  IntegrationEnrollField,
+  IntegrationEnrollSection,
+  IntegrationEnrollStatusCode,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+
+import {
+  GITHUB_HOST,
+  RefTypeOption,
+  refTypeOptions,
+  requireValidRepository,
+} from '../Shared/github';
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { useTracking } from '../Shared/useTracking';
+import { CodePanel } from './CodePanel';
+import { useGitHubK8sFlow } from './useGitHubK8sFlow';
+
+export function ConnectGitHub(props: FlowStepProps) {
+  const { nextStep, prevStep } = props;
+
+  const { dispatch, state } = useGitHubK8sFlow();
+
+  const tracking = useTracking();
+
+  const handleNext = (validator: Validator) => {
+    if (!validator.validate()) {
+      tracking.error(
+        IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+        'validation error'
+      );
+
+      return;
+    }
+
+    tracking.step(
+      IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+      IntegrationEnrollStatusCode.Success
+    );
+
+    nextStep?.();
+  };
+
+  const refTypeValue: RefTypeOption =
+    refTypeOptions.find(o => o.value === state.refType) ?? refTypeOptions[0];
+
+  const hasGHEHost = !!state.info?.host && state.info.host !== GITHUB_HOST;
+
+  return (
+    <Container>
+      <FormContainer>
+        <Box>
+          <H2 mb={3} mt={3}>
+            Connect to GitHub
+          </H2>
+
+          <Text mb={3}>
+            Provide details for the GitHub repository you would like to connect.
+          </Text>
+        </Box>
+
+        <Validation>
+          {({ validator }) => (
+            <div>
+              <FieldInput
+                rule={requireValidRepository}
+                label="Repository URL"
+                placeholder="https://github.com/gravitational/teleport"
+                value={state.gitHubUrl}
+                onChange={e => {
+                  dispatch({
+                    type: 'github-url-changed',
+                    value: e.target.value,
+                  });
+                  tracking.field(
+                    IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                    IntegrationEnrollField.MWIGHAK8SGitHubRepositoryURL,
+                    !e.target.value.length
+                  );
+                }}
+              />
+
+              <FieldInput
+                rule={
+                  state.isBranchDisabled || state.allowAnyBranch
+                    ? undefined
+                    : requiredField('A branch is required')
+                }
+                disabled={state.isBranchDisabled}
+                label="Branch"
+                placeholder="refs/heads/main"
+                value={state.branch}
+                onChange={e => {
+                  dispatch({
+                    type: 'branch-changed',
+                    value: e.target.value,
+                  });
+                  tracking.field(
+                    IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                    IntegrationEnrollField.MWIGHAK8SGitHubBranch,
+                    !e.target.value.length
+                  );
+                }}
+              />
+              <FieldCheckbox
+                label="Allow any branch"
+                checked={state.allowAnyBranch}
+                disabled={state.isBranchDisabled}
+                onChange={e =>
+                  dispatch({
+                    type: 'allow-any-branch-toggled',
+                    value: e.target.checked,
+                  })
+                }
+                size="small"
+              />
+              <Text mb={3}>
+                Specifying a branch is recommended to prevent workflows running
+                from any branch to access your Teleport resources.
+              </Text>
+
+              {/* TODO(nicholasmarais1158): Make SectionBox a component instead of reusing it from Roles */}
+              <SectionBox
+                titleSegments={['Advanced options']}
+                initiallyCollapsed={
+                  [
+                    'workflow',
+                    'environment',
+                    'enterpriseSlug',
+                    'enterpriseJwks',
+                  ].every(k => !state[k]) && state.refType === 'branch'
+                }
+                validation={{
+                  valid: true,
+                }}
+                onExpand={() => {
+                  tracking.section(
+                    IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                    IntegrationEnrollSection.MWIGHAK8SGitHubAdvancedOptions
+                  );
+                }}
+              >
+                <FieldInput
+                  label="Workflow"
+                  placeholder="my-workflow"
+                  value={state.workflow}
+                  onChange={e => {
+                    dispatch({
+                      type: 'workflow-changed',
+                      value: e.target.value,
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                      IntegrationEnrollField.MWIGHAK8SGitHubWorkflow,
+                      !e.target.value.length
+                    );
+                  }}
+                />
+
+                <FieldInput
+                  label="Environment"
+                  placeholder="production"
+                  value={state.environment}
+                  onChange={e => {
+                    dispatch({
+                      type: 'environment-changed',
+                      value: e.target.value,
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                      IntegrationEnrollField.MWIGHAK8SGitHubEnvironment,
+                      !e.target.value.length
+                    );
+                  }}
+                />
+
+                <Flex mb={3} gap={2}>
+                  <FieldInput
+                    flex={1}
+                    label={'Git Ref'}
+                    placeholder="refs/heads/main"
+                    value={state.ref}
+                    onChange={e => {
+                      dispatch({
+                        type: 'ref-changed',
+                        value: e.target.value,
+                      });
+                      tracking.field(
+                        IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                        IntegrationEnrollField.MWIGHAK8SGitHubRef,
+                        !e.target.value.length
+                      );
+                    }}
+                    borderTopRightRadius={0}
+                    borderBottomRightRadius={0}
+                  />
+                  <FieldSelect
+                    width={160}
+                    label="Ref Type"
+                    isMulti={false}
+                    value={refTypeValue}
+                    onChange={o => {
+                      dispatch({
+                        type: 'ref-type-changed',
+                        value: o?.value ?? '',
+                      });
+                      tracking.field(
+                        IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                        IntegrationEnrollField.MWIGHAK8SGitHubRef
+                      );
+                    }}
+                    options={refTypeOptions}
+                    menuPlacement="auto"
+                  />
+                </Flex>
+
+                {cfg.edition !== 'ent' ? (
+                  <Info
+                    mt={5}
+                    mb={3}
+                    alignItems="flex-start"
+                    details={
+                      <>
+                        GitHub Enterprise Server configuration requires Teleport
+                        Enterprise. Please use a repository hosted at github.com
+                        or{' '}
+                        <Link
+                          target="_blank"
+                          href="https://goteleport.com/signup/enterprise/"
+                        >
+                          contact us
+                        </Link>
+                        .
+                      </>
+                    }
+                  >
+                    GitHub Enterprise Server
+                  </Info>
+                ) : undefined}
+
+                <FieldInput
+                  label="Enterprise slug"
+                  disabled={cfg.edition !== 'ent' || hasGHEHost}
+                  placeholder="octo-enterprise"
+                  value={state.enterpriseSlug}
+                  onChange={e => {
+                    dispatch({
+                      type: 'slug-changed',
+                      value: e.target.value,
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                      IntegrationEnrollField.MWIGHAK8SGitHubEnterpriseSlug,
+                      !e.target.value.length
+                    );
+                  }}
+                  toolTipContent="Allows the slug of a GitHub Enterprise (GHE) organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the include_enterprise_slug option in GHE."
+                  helperText={
+                    hasGHEHost
+                      ? `Only available for repositories at ${GITHUB_HOST}.`
+                      : undefined
+                  }
+                />
+
+                <FieldInput
+                  label="Enterprise JWKS"
+                  disabled={cfg.edition !== 'ent' || !hasGHEHost}
+                  placeholder='{"keys":[ --snip-- ]}'
+                  value={state.enterpriseJwks}
+                  onChange={e => {
+                    dispatch({
+                      type: 'jwks-changed',
+                      value: e.target.value,
+                    });
+                    tracking.field(
+                      IntegrationEnrollStep.MWIGHAK8SConnectGitHub,
+                      IntegrationEnrollField.MWIGHAK8SGitHubEnterpriseStaticJWKS,
+                      !e.target.value.length
+                    );
+                  }}
+                  toolTipContent="When using GitHub Enterprise Server (GHES), allows the JSON Web Key Set (JWKS) used to verify the token issued by GitHub Actions to be overridden. This can be used in scenarios where the Teleport Auth Service is unable to reach a GHE server."
+                  helperText={
+                    hasGHEHost
+                      ? undefined
+                      : 'Used only with GitHub Enterprise Server (GHES).'
+                  }
+                />
+              </SectionBox>
+
+              <Flex gap={2} pt={5}>
+                <ButtonPrimary onClick={() => handleNext(validator)}>
+                  Next
+                </ButtonPrimary>
+                <ButtonSecondary onClick={prevStep}>Back</ButtonSecondary>
+              </Flex>
+            </div>
+          )}
+        </Validation>
+      </FormContainer>
+
+      <CodeContainer>
+        <CodePanel
+          trackingStep={IntegrationEnrollStep.MWIGHAK8SConnectGitHub}
+        />
+      </CodeContainer>
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  flex: 1;
+  overflow: auto;
+  gap: ${({ theme }) => theme.space[1]}px;
+`;
+
+const FormContainer = styled(Flex)`
+  flex: 4;
+  flex-direction: column;
+  overflow: auto;
+  padding-right: ${({ theme }) => theme.space[5]}px;
+`;
+
+const CodeContainer = styled(Flex)`
+  flex: 6;
+  flex-direction: column;
+  overflow: auto;
+`;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Finish.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Finish.tsx
new file mode 100644
index 0000000000000..d62f0016998f8
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Finish.tsx
@@ -0,0 +1,172 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import { useHistory } from 'react-router';
+import { styled } from 'styled-components';
+
+import Box from 'design/Box/Box';
+import {
+  ButtonPrimary,
+  ButtonSecondary,
+  ButtonWarning,
+} from 'design/Button/Button';
+import { Dialog } from 'design/Dialog/Dialog';
+import DialogContent from 'design/Dialog/DialogContent';
+import DialogHeader from 'design/Dialog/DialogHeader';
+import DialogTitle from 'design/Dialog/DialogTitle';
+import Flex from 'design/Flex/Flex';
+import Link from 'design/Link/Link';
+import { H2, P2 } from 'design/Text/Text';
+
+import cfg from 'teleport/config';
+import {
+  IntegrationEnrollStatusCode,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { useTracking } from '../Shared/useTracking';
+import { CodePanel } from './CodePanel';
+
+export function Finish(props: FlowStepProps) {
+  const { prevStep } = props;
+
+  const [showDoneCheck, setShowDoneCheck] = useState(false);
+
+  const history = useHistory();
+  const tracking = useTracking();
+
+  const handleDone = () => {
+    tracking.step(
+      IntegrationEnrollStep.MWIGHAK8SSetupWorkflow,
+      IntegrationEnrollStatusCode.Success
+    );
+
+    history.replace(cfg.getBotsRoute());
+  };
+
+  return (
+    <Container>
+      <Box flex={4}>
+        <H2 mb={3} mt={3}>
+          Setup Workflow
+        </H2>
+
+        <P2>
+          <strong>To complete the setup</strong>;
+        </P2>
+        <ul>
+          <li>Use the Infrastructure as Code templates to create resources</li>
+          <li>Copy the workflow template and add it to your repository</li>
+        </ul>
+
+        <P2>
+          See the{' '}
+          <Link
+            target="_blank"
+            href={IAC_LINK}
+            onClick={() => {
+              tracking.link(
+                IntegrationEnrollStep.MWIGHAK8SSetupWorkflow,
+                IAC_LINK
+              );
+            }}
+          >
+            Infrastructure as Code
+          </Link>{' '}
+          docs for information about setting up and using IaC with Teleport.
+        </P2>
+
+        <P2>
+          See the{' '}
+          <Link
+            target="_blank"
+            href={TBOT_GHA_LINK}
+            onClick={() => {
+              tracking.link(
+                IntegrationEnrollStep.MWIGHAK8SSetupWorkflow,
+                TBOT_GHA_LINK
+              );
+            }}
+          >
+            Deploying tbot on GitHub Actions
+          </Link>{' '}
+          docs for information about running tbot in a GitHub Actions workflow.
+        </P2>
+
+        <Flex gap={2} pt={5}>
+          <ButtonPrimary onClick={() => setShowDoneCheck(true)}>
+            Done
+          </ButtonPrimary>
+          <ButtonSecondary onClick={prevStep}>Back</ButtonSecondary>
+        </Flex>
+      </Box>
+
+      <CodeContainer>
+        <CodePanel
+          trackingStep={IntegrationEnrollStep.MWIGHAK8SSetupWorkflow}
+        />
+      </CodeContainer>
+
+      <Dialog open={showDoneCheck} onClose={() => setShowDoneCheck(false)}>
+        <DialogHeader mb={4}>
+          <DialogTitle>
+            Are you sure you would like to complete the guide?
+          </DialogTitle>
+        </DialogHeader>
+        <DialogContent mb={3} maxWidth={480}>
+          <P2>
+            Once the guide is completed, you will not longer have access to the
+            Infrastructure as Code and GitHub workflow templates.
+          </P2>
+        </DialogContent>
+        <Flex gap={3}>
+          <ButtonWarning block size="large" onClick={handleDone}>
+            Confirm
+          </ButtonWarning>
+          <ButtonSecondary
+            block
+            size="large"
+            autoFocus
+            onClick={() => setShowDoneCheck(false)}
+          >
+            Cancel
+          </ButtonSecondary>
+        </Flex>
+      </Dialog>
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  flex: 1;
+  overflow: auto;
+  gap: ${({ theme }) => theme.space[5]}px;
+`;
+
+const CodeContainer = styled(Flex)`
+  flex: 6;
+  flex-direction: column;
+  overflow: auto;
+`;
+
+const IAC_LINK =
+  'https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/';
+const TBOT_GHA_LINK =
+  'https://goteleport.com/docs/machine-workload-identity/deployment/github-actions/';
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.test.tsx
new file mode 100644
index 0000000000000..6f37c8117092c
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.test.tsx
@@ -0,0 +1,209 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryHistory } from 'history';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  act,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+} from 'design/utils/testing';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { BotFlowType } from 'teleport/Bots/types';
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { ContentMinWidth } from 'teleport/Main/Main';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { genWizardCiCdSuccess } from 'teleport/test/helpers/bots';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { trackingTester } from '../Shared/trackingTester';
+import { TrackingProvider } from '../Shared/useTracking';
+import { GitHubActionsK8sWithoutTracking } from './GitHubActionsK8s';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+
+  server.use(genWizardCiCdSuccess());
+  server.use(userEventCaptureSuccess());
+
+  jest.useFakeTimers();
+});
+
+afterAll(() => {
+  server.close();
+
+  jest.useRealTimers();
+  jest.resetAllMocks();
+});
+
+describe('GitHubActionsK8s', () => {
+  test('complete flow: minimal', async () => {
+    const tracking = trackingTester();
+
+    const { user, history, unmount } = renderComponent({
+      trackingEventId: 'test-tracking-event-id',
+    });
+    const replaceMock = jest.spyOn(history, 'replace');
+
+    tracking.assertStart('test-tracking-event-id');
+
+    expect(
+      screen.getByRole('heading', { name: 'GitHub Actions + Kubernetes' })
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Start' }));
+
+    tracking.assertStep(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME',
+      'INTEGRATION_ENROLL_STATUS_CODE_SUCCESS'
+    );
+
+    expect(
+      screen.getByRole('heading', { name: 'Connect to GitHub' })
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Next' }));
+
+    tracking.assertError(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'validation error'
+    );
+
+    expect(screen.getByText('Repository is required')).toBeInTheDocument();
+    expect(screen.getByText('A branch is required')).toBeInTheDocument();
+
+    await user.type(
+      screen.getByLabelText('Repository URL'),
+      'https://github.com/gravitational/teleport'
+    );
+
+    // Field tracking is debounced, so move time along to send the event
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL'
+    );
+
+    await user.type(screen.getByLabelText('Branch'), 'main');
+
+    await act(() => jest.advanceTimersByTimeAsync(1000));
+    tracking.assertField(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH'
+    );
+
+    await user.click(screen.getByRole('button', { name: 'Next' }));
+
+    tracking.assertStep(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+      'INTEGRATION_ENROLL_STATUS_CODE_SUCCESS'
+    );
+
+    expect(
+      screen.getByRole('heading', { name: 'Configure Access' })
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Next' }));
+
+    tracking.assertStep(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+      'INTEGRATION_ENROLL_STATUS_CODE_SUCCESS'
+    );
+
+    expect(
+      screen.getByRole('heading', { name: 'Setup Workflow' })
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Done' }));
+
+    await user.click(screen.getByRole('button', { name: 'Confirm' }));
+
+    tracking.assertStep(
+      'test-tracking-event-id',
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW',
+      'INTEGRATION_ENROLL_STATUS_CODE_SUCCESS'
+    );
+
+    expect(replaceMock).toHaveBeenLastCalledWith('/web/bots');
+
+    unmount();
+
+    tracking.assertComplete('test-tracking-event-id');
+  });
+});
+
+function renderComponent(opts?: { trackingEventId?: string }) {
+  const { trackingEventId } = opts ?? {};
+  const user = userEvent.setup({
+    advanceTimers: t => jest.advanceTimersByTime(t),
+  });
+  const history = createMemoryHistory({
+    initialEntries: [cfg.getBotsNewRoute(BotFlowType.GitHubActionsSsh)],
+  });
+  return {
+    ...render(<GitHubActionsK8sWithoutTracking />, {
+      wrapper: makeWrapper({ history, trackingEventId }),
+    }),
+    user,
+    history,
+  };
+}
+
+function makeWrapper(opts: {
+  history: ReturnType<typeof createMemoryHistory>;
+  trackingEventId?: string;
+}) {
+  const { history, trackingEventId } = opts;
+  const ctx = createTeleportContext();
+
+  return ({ children }: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ContextProvider ctx={ctx}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <InfoGuidePanelProvider>
+              <ContentMinWidth>
+                <TrackingProvider initialEventId={trackingEventId}>
+                  <Router history={history}>{children}</Router>
+                </TrackingProvider>
+              </ContentMinWidth>
+            </InfoGuidePanelProvider>
+          </ConfiguredThemeProvider>
+        </ContextProvider>
+      </QueryClientProvider>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.tsx
new file mode 100644
index 0000000000000..e699f2e0904c0
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/GitHubActionsK8s.tsx
@@ -0,0 +1,72 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ResourceIcon } from 'design/ResourceIcon';
+
+import { useNoMinWidth } from 'teleport/Main';
+
+import { GuidedFlow, View } from '../Shared/GuidedFlow';
+import { TrackingProvider } from '../Shared/useTracking';
+import { ConfigureAccess } from './ConfigureAccess';
+import { ConnectGitHub } from './ConnectGitHub';
+import { Finish } from './Finish';
+import { GitHubK8sFlowProvider } from './useGitHubK8sFlow';
+import { Welcome } from './Welcome';
+
+const views: View[] = [
+  {
+    name: 'Welcome',
+    component: Welcome,
+  },
+  {
+    name: 'Connect GitHub',
+    component: ConnectGitHub,
+  },
+  {
+    name: 'Configure Access',
+    component: ConfigureAccess,
+  },
+  {
+    name: 'Setup workflow',
+    component: Finish,
+  },
+];
+
+export function GitHubActionsK8s() {
+  useNoMinWidth();
+
+  return (
+    <TrackingProvider>
+      <GitHubActionsK8sWithoutTracking />
+    </TrackingProvider>
+  );
+}
+
+export function GitHubActionsK8sWithoutTracking() {
+  useNoMinWidth();
+
+  return (
+    <GitHubK8sFlowProvider>
+      <GuidedFlow
+        icon={<ResourceIcon name="github" width="20px" />}
+        views={views}
+        name="GitHub Actions + Kubernetes"
+      />
+    </GitHubK8sFlowProvider>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.story.tsx
new file mode 100644
index 0000000000000..c581b28dd50a1
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.story.tsx
@@ -0,0 +1,137 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { useState } from 'react';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import Validation, { Validator } from 'shared/components/Validation';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  fetchUnifiedResourcesError,
+  fetchUnifiedResourcesForever,
+  fetchUnifiedResourcesSuccess,
+} from 'teleport/test/helpers/resources';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { KubernetesLabel } from '../Shared/kubernetes';
+import { TrackingProvider } from '../Shared/useTracking';
+import { KubernetesLabelsSelect } from './KubernetesLabelsSelect';
+
+const meta = {
+  title: 'Teleport/Bots/Add/GitHubActions+K8s/KubernetesLabelsSelect',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [fetchUnifiedResourcesSuccess(), userEventCaptureSuccess()],
+    },
+  },
+};
+
+export const FetchResourcesError: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        fetchUnifiedResourcesError(500, 'something went wrong'),
+        userEventCaptureSuccess(),
+      ],
+    },
+  },
+};
+
+export const FetchResourcesForever: Story = {
+  parameters: {
+    msw: {
+      handlers: [fetchUnifiedResourcesForever(), userEventCaptureSuccess()],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper() {
+  const [labels, setLabels] = useState<KubernetesLabel[]>([
+    { name: '*', values: ['*'] },
+  ]);
+
+  const handleLabelsChanged = (
+    labels: KubernetesLabel[],
+    validator: Validator
+  ) => {
+    setLabels(labels);
+    validator.validate();
+  };
+
+  const customAcl = makeAcl({
+    kubeServers: {
+      ...defaultAccess,
+      read: true,
+      list: true,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <TrackingProvider>
+          <Validation>
+            {({ validator }) => (
+              <Container>
+                <KubernetesLabelsSelect
+                  selected={labels}
+                  onChange={labels => handleLabelsChanged(labels, validator)}
+                />
+              </Container>
+            )}
+          </Validation>
+        </TrackingProvider>
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
+
+const Container = styled(Flex)`
+  flex-direction: column;
+  gap: ${({ theme }) => theme.space[2]}px;
+`;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.test.tsx
new file mode 100644
index 0000000000000..a061777fae2a0
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.test.tsx
@@ -0,0 +1,434 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  within,
+} from 'design/utils/testing';
+import Validation from 'shared/components/Validation';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { ResourcesResponse, UnifiedResource } from 'teleport/services/agents';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { fetchUnifiedResourcesSuccess } from 'teleport/test/helpers/resources';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { trackingTester } from '../Shared/trackingTester';
+import { TrackingProvider } from '../Shared/useTracking';
+import { KubernetesLabelsSelect } from './KubernetesLabelsSelect';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+beforeEach(() => {
+  server.use(userEventCaptureSuccess());
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => {
+  server.close();
+
+  jest.resetAllMocks();
+});
+
+describe('KubernetesLabelsSelect', () => {
+  test('renders', async () => {
+    renderComponent({
+      props: {
+        selected: [
+          {
+            name: 'foo',
+            values: ['bar'],
+          },
+          {
+            name: 'env',
+            values: ['*'],
+          },
+        ],
+      },
+    });
+
+    expect(screen.getByText('foo: bar')).toBeInTheDocument();
+    expect(screen.getByText('env: *')).toBeInTheDocument();
+  });
+
+  test('empty state', async () => {
+    renderComponent();
+
+    expect(screen.getByText('No labels selected.')).toBeInTheDocument();
+  });
+
+  test('edit action', async () => {
+    const tracking = trackingTester();
+
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent();
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(
+      within(modal).getByText('Select one or more labels to configure access.')
+    ).toBeInTheDocument();
+
+    tracking.assertSection(
+      expect.any(String),
+      'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+      'INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER'
+    );
+  });
+
+  test('cluster list empty', async () => {
+    withListUnifiedResourcesSuccess({
+      response: {
+        agents: [],
+      },
+    });
+
+    const { user } = renderComponent();
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(within(modal).getByText('No clusters found')).toBeInTheDocument();
+  });
+
+  test('cluster list', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent();
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(
+      within(modal).getByText('kube-lon-dev-01.example.com')
+    ).toBeInTheDocument();
+    expect(
+      within(modal).getByText('kube-lon-prod-01.example.com')
+    ).toBeInTheDocument();
+    expect(
+      within(modal).getByText('kube-lon-staging-01.example.com')
+    ).toBeInTheDocument();
+    expect(
+      within(modal).getByText('kube-temp-01.example.com')
+    ).toBeInTheDocument();
+  });
+
+  test('zero selected labels', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent({
+      props: {
+        selected: [],
+      },
+    });
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(within(modal).getByText('Selected Labels (0)')).toBeInTheDocument();
+  });
+
+  test('selected labels', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent({
+      props: {
+        selected: [
+          {
+            name: 'test-1',
+            values: ['one', 'two', 'three'],
+          },
+          {
+            name: 'test-2',
+            values: ['*'],
+          },
+          {
+            name: 'test-*',
+            values: ['^(alpha|beta)$'],
+          },
+        ],
+      },
+    });
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (3)' })
+    ).toBeInTheDocument();
+  });
+
+  test('add label', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent();
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (0)' })
+    ).toBeInTheDocument();
+
+    const item = screen.getByTestId('cluster-item-kube-lon-dev-01.example.com');
+    const addLabel = within(item).getByTestId('label-action-env: dev-add');
+    await user.click(addLabel);
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (1)' })
+    ).toBeInTheDocument();
+
+    const selectedSection = within(modal)
+      .getByRole('heading', { name: 'Selected Labels (1)' })
+      .closest('div');
+    expect(within(selectedSection!).getByText('env: dev')).toBeInTheDocument();
+  });
+
+  test('remove label', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent({
+      props: {
+        selected: [
+          {
+            name: 'env',
+            values: ['dev'],
+          },
+        ],
+      },
+    });
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (1)' })
+    ).toBeInTheDocument();
+
+    const selectedSection = within(modal)
+      .getByRole('heading', { name: 'Selected Labels (1)' })
+      .closest('div');
+    const removeLabel = within(selectedSection!).getByTestId(
+      'label-action-env: dev-remove'
+    );
+    await user.click(removeLabel);
+
+    const item = screen.getByTestId('cluster-item-kube-lon-dev-01.example.com');
+    expect(
+      within(item).getByTestId('label-action-env: dev-add')
+    ).toBeInTheDocument();
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (0)' })
+    ).toBeInTheDocument();
+    expect(
+      within(selectedSection!).queryByText('env: dev')
+    ).not.toBeInTheDocument();
+  });
+
+  test('manual entry', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const { user } = renderComponent();
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    const selectedSection = within(modal)
+      .getByRole('heading', { name: 'Selected Labels (0)' })
+      .closest('div');
+
+    const input = within(selectedSection!).getByPlaceholderText('name: value');
+    await user.type(input, 'foo: bar{enter}');
+    await user.type(input, 'foo2:bar: baz{enter}'); // colon in name
+    await user.type(input, 'foo3: bar:baz{enter}'); // colon in value
+    await user.type(input, 'foo4: bar: baz{enter}'); // colon in value
+    await user.type(input, 'env: *{enter}');
+    // Extra square brackets are required to escape the initial pair
+    await user.type(input, 'region: ^eu-(west|east)-[[0-9]]+$');
+    await user.click(
+      within(selectedSection!).getByRole('button', { name: 'Add' })
+    );
+
+    expect(
+      within(modal).getByRole('heading', { name: 'Selected Labels (6)' })
+    ).toBeInTheDocument();
+
+    expect(
+      within(selectedSection!).getByTestId('label-action-foo: bar-remove')
+    ).toBeInTheDocument();
+  });
+
+  test('done', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const onChange = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        onChange,
+      },
+    });
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    const input = within(modal).getByPlaceholderText('name: value');
+    await user.type(input, 'foo: bar{enter}');
+
+    await user.click(within(modal).getByRole('button', { name: 'Done' }));
+
+    expect(modal).not.toBeInTheDocument();
+
+    expect(onChange).toHaveBeenCalledTimes(1);
+    expect(onChange).toHaveBeenLastCalledWith([
+      { name: 'foo', values: ['bar'] },
+    ]);
+  });
+
+  test('cancel', async () => {
+    withListUnifiedResourcesSuccess();
+
+    const onChange = jest.fn();
+
+    const { user } = renderComponent({
+      props: {
+        onChange,
+      },
+    });
+
+    const edit = screen.getByRole('button', { name: 'edit' });
+    await user.click(edit);
+
+    const modal = screen.getByTestId('Modal');
+
+    const input = within(modal).getByPlaceholderText('name: value');
+    await user.type(input, 'foo:bar{enter}');
+
+    await user.click(within(modal).getByRole('button', { name: 'Cancel' }));
+
+    expect(modal).not.toBeInTheDocument();
+
+    expect(onChange).toHaveBeenCalledTimes(0);
+  });
+});
+
+function renderComponent(opts?: {
+  props?: Partial<ComponentProps<typeof KubernetesLabelsSelect>>;
+  customAcl?: ReturnType<typeof makeAcl>;
+  disableTracking?: boolean;
+}) {
+  const { props, customAcl, disableTracking } = opts ?? {};
+  const { selected = [], onChange = () => {} } = props ?? {};
+
+  const user = userEvent.setup();
+
+  return {
+    ...render(
+      <KubernetesLabelsSelect selected={selected} onChange={onChange} />,
+      {
+        wrapper: makeWrapper({
+          customAcl,
+          disableTracking,
+        }),
+      }
+    ),
+    user,
+  };
+}
+
+function makeWrapper(opts?: {
+  customAcl?: ReturnType<typeof makeAcl>;
+  disableTracking?: boolean;
+}) {
+  const {
+    customAcl = makeAcl({
+      kubeServers: {
+        ...defaultAccess,
+        read: true,
+        list: true,
+      },
+    }),
+    disableTracking,
+  } = opts ?? {};
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return ({ children }: PropsWithChildren) => {
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ConfiguredThemeProvider theme={darkTheme}>
+          <ContextProvider ctx={ctx}>
+            <TrackingProvider disabled={disableTracking}>
+              <Validation>{children}</Validation>
+            </TrackingProvider>
+          </ContextProvider>
+        </ConfiguredThemeProvider>
+      </QueryClientProvider>
+    );
+  };
+}
+
+function withListUnifiedResourcesSuccess(opts?: {
+  response?: ResourcesResponse<UnifiedResource>;
+}) {
+  server.use(fetchUnifiedResourcesSuccess(opts));
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.tsx
new file mode 100644
index 0000000000000..c4e6863bd8795
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/KubernetesLabelsSelect.tsx
@@ -0,0 +1,584 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query';
+import { ReactNode, useEffect, useMemo, useState } from 'react';
+import styled from 'styled-components';
+
+import { Alert } from 'design/Alert/Alert';
+import Box, { BoxProps } from 'design/Box/Box';
+import { ButtonPrimary, ButtonSecondary } from 'design/Button/Button';
+import ButtonIcon from 'design/ButtonIcon/ButtonIcon';
+import { Dialog } from 'design/Dialog/Dialog';
+import DialogContent from 'design/Dialog/DialogContent';
+import DialogFooter from 'design/Dialog/DialogFooter';
+import DialogHeader from 'design/Dialog/DialogHeader';
+import DialogTitle from 'design/Dialog/DialogTitle';
+import Flex from 'design/Flex/Flex';
+import { CheckThick } from 'design/Icon/Icons/CheckThick';
+import { Cross } from 'design/Icon/Icons/Cross';
+import { Minus } from 'design/Icon/Icons/Minus';
+import { Pencil } from 'design/Icon/Icons/Pencil';
+import { Plus } from 'design/Icon/Icons/Plus';
+import { Indicator } from 'design/Indicator/Indicator';
+import { Primary, Secondary } from 'design/Label/Label';
+import { LabelContent, LabelInput } from 'design/LabelInput/LabelInput';
+import { ResourceIcon } from 'design/ResourceIcon';
+import Text, { H3 } from 'design/Text';
+import FieldInput, {
+  HelperTextLine,
+} from 'shared/components/FieldInput/FieldInput';
+import Validation, { useRule, Validator } from 'shared/components/Validation';
+import { Rule } from 'shared/components/Validation/rules';
+
+import cfg from 'teleport/config';
+import { ResourceLabel } from 'teleport/services/agents';
+import { Kube } from 'teleport/services/kube';
+import {
+  IntegrationEnrollSection,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+import useTeleport from 'teleport/useTeleport';
+
+import {
+  KubernetesLabel,
+  makeKubernetesAccessChecker,
+} from '../Shared/kubernetes';
+import { useTracking } from '../Shared/useTracking';
+
+export function KubernetesLabelsSelect(
+  props: {
+    selected: KubernetesLabel[];
+    onChange: (labels: KubernetesLabel[]) => void;
+  } & BoxProps
+) {
+  const [showPicker, setShowPicker] = useState(false);
+  const { selected, onChange, ...styles } = props;
+
+  const { valid, message } = useRule(() => {
+    if (selected.length === 0) {
+      return {
+        valid: false,
+        message:
+          'At least one label must be selected. Use wildcard *:* to match any label.',
+      };
+    }
+    return {
+      valid: true,
+    };
+  });
+
+  const handleChanged = (labels: KubernetesLabel[]) => {
+    setShowPicker(false);
+    onChange(labels);
+  };
+
+  const handleCancel = () => {
+    setShowPicker(false);
+  };
+
+  return (
+    <Box {...styles}>
+      <LabelInput mb={0} aria-label="Labels">
+        <LabelContent>Labels</LabelContent>
+
+        <LabelsContainer aria-describedby={'labels-select-helper-text'}>
+          {selected.map(l => (
+            <Label key={l.name} label={formatLabel(l)} style="secondary" />
+          ))}
+
+          {selected.length === 0 && <EmptyText>No labels selected.</EmptyText>}
+
+          <ButtonIcon
+            onClick={() => {
+              setShowPicker(true);
+            }}
+            aria-label="edit"
+          >
+            <Pencil size="medium" />
+          </ButtonIcon>
+        </LabelsContainer>
+      </LabelInput>
+
+      <HelperTextLine
+        hasError={!valid}
+        helperTextId={'labels-select-helper-text'}
+        errorMessage={message}
+      />
+
+      {showPicker && (
+        <Picker
+          selected={selected}
+          onChange={handleChanged}
+          onCancel={handleCancel}
+        />
+      )}
+    </Box>
+  );
+}
+
+const LabelsContainer = styled(Flex)`
+  flex-wrap: wrap;
+  overflow: hidden;
+  gap: ${props => props.theme.space[2]}px;
+  align-items: center;
+`;
+
+const LabelText = styled(Text).attrs({
+  typography: 'body2',
+})`
+  white-space: nowrap;
+`;
+
+function Picker(props: {
+  selected: KubernetesLabel[];
+  onChange: (labels: KubernetesLabel[]) => void;
+  onCancel: () => void;
+}) {
+  const { selected: initial, onChange, onCancel } = props;
+
+  const [selected, setSelected] = useState(initial);
+  const [manualInput, setManualInput] = useState('');
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasListPermission = flags.kubernetes;
+
+  const tracking = useTracking();
+
+  // This effect sends a tracking event when the component mounts
+  useEffect(() => {
+    tracking.section(
+      IntegrationEnrollStep.MWIGHAK8SConfigureAccess,
+      IntegrationEnrollSection.MWIGHAK8SKubernetesLabelPicker
+    );
+  }, [tracking]);
+
+  const {
+    data,
+    isLoading,
+    isFetchingNextPage,
+    error,
+    hasNextPage,
+    fetchNextPage,
+  } = useInfiniteQuery({
+    enabled: hasListPermission,
+    queryKey: ['list', 'unified_resources', cfg.proxyCluster, ['kube_cluster']],
+    queryFn: ({ pageParam, signal }) =>
+      ctx.resourceService.fetchUnifiedResources(
+        cfg.proxyCluster,
+        {
+          kinds: ['kube_cluster'],
+          startKey: pageParam,
+          limit: 20,
+        },
+        signal
+      ),
+    initialPageParam: '',
+    getNextPageParam: data => data?.startKey || undefined,
+    placeholderData: keepPreviousData,
+    staleTime: 30_000, // Cached pages are valid for 30 seconds
+  });
+
+  const handleAdd = (name: string, value: string) => {
+    setSelected(prev => {
+      const index = prev.findIndex(l => l.name === name);
+      if (index == -1) {
+        return [...prev, { name, values: [value] }];
+      }
+      return prev.map(l => {
+        if (l.name === name) {
+          const vs = new Set([...l.values, value]);
+          return {
+            ...l,
+            values: [...vs],
+          };
+        }
+        return l;
+      });
+    });
+  };
+
+  const handleManualAdd = (validator: Validator) => {
+    if (!validator.validate()) {
+      return;
+    }
+
+    const [n, ...rest] = manualInput.split(': ');
+    const name = n.trim();
+    const value = rest.join(': ').trim();
+    handleAdd(name, value);
+
+    validator.reset();
+    setManualInput('');
+  };
+
+  const handleRemove = (name: string, value?: string) => {
+    setSelected(prev => {
+      if (value === undefined) {
+        return prev.filter(l => l.name !== name);
+      }
+
+      return prev.flatMap(l => {
+        if (l.name === name) {
+          l.values = l.values.filter(v => v != value);
+
+          if (l.values.length < 1) {
+            return [];
+          }
+        }
+
+        return [l];
+      });
+    });
+  };
+
+  const accessChecker = useMemo(
+    () => makeKubernetesAccessChecker(selected),
+    [selected]
+  );
+
+  const kubeClusters = data?.pages.flatMap(p =>
+    p.agents.filter(a => a.kind === 'kube_cluster')
+  );
+
+  return (
+    <Dialog open onClose={onCancel}>
+      <DialogHeader>
+        <Box width={'100%'}>
+          <DialogTitle>Kubernetes Labels</DialogTitle>
+          <Text>Select one or more labels to configure access.</Text>
+
+          {!hasListPermission ? (
+            <Alert mt={3} mb={0} kind="info">
+              You do not have permission to view resources. Missing role
+              permissions: <code>kube_server.read</code>,{' '}
+              <code>kube_server.list</code>
+            </Alert>
+          ) : undefined}
+
+          {error ? (
+            <Alert mt={3} mb={0} kind="danger" details={error.message}>
+              Failed to fetch resources
+            </Alert>
+          ) : undefined}
+        </Box>
+      </DialogHeader>
+
+      <DialogContent
+        minWidth={600}
+        maxWidth={1024}
+        minHeight={360}
+        maxHeight={600}
+      >
+        <PickerContainer>
+          <ColumnContainer>
+            <ColumnHeading>Enrolled clusters</ColumnHeading>
+
+            {isLoading ? (
+              <Box data-testid="loading-resources" textAlign="center" m={10}>
+                <Indicator />
+              </Box>
+            ) : undefined}
+
+            {!isLoading && !kubeClusters?.length && (
+              <Box p={3}>
+                <EmptyText>No clusters found</EmptyText>
+              </Box>
+            )}
+
+            <Flex overflow={'auto'} flexDirection={'column'} flex={1}>
+              {kubeClusters?.map(item => (
+                <ClusterItem
+                  key={item.name}
+                  resource={item}
+                  selectedLabels={selected}
+                  addLabel={handleAdd}
+                  removeLabel={handleRemove}
+                  checkAccess={accessChecker.check}
+                />
+              ))}
+
+              {hasNextPage && (
+                <LoadMoreContainer>
+                  <ButtonSecondary
+                    onClick={() => fetchNextPage()}
+                    disabled={!hasNextPage || isFetchingNextPage}
+                  >
+                    Load More
+                  </ButtonSecondary>
+                </LoadMoreContainer>
+              )}
+            </Flex>
+          </ColumnContainer>
+          <ColumnContainer>
+            <ColumnHeading>Selected Labels ({selected.length})</ColumnHeading>
+
+            <Flex
+              overflow={'auto'}
+              flexDirection={'column'}
+              flex={1}
+              p={3}
+              gap={2}
+              alignItems={'flex-start'}
+            >
+              {selected.map(l => (
+                <Label
+                  key={l.name}
+                  label={formatLabel(l)}
+                  actionAriaLabel="remove"
+                  actionIcon={<Cross size="small" />}
+                  onAction={() => handleRemove(l.name)}
+                  style="secondary"
+                />
+              ))}
+            </Flex>
+            <Validation>
+              {({ validator }) => (
+                <form
+                  onSubmit={e => {
+                    e.preventDefault();
+                    handleManualAdd(validator);
+                  }}
+                >
+                  <div>
+                    <ManualInputContainer>
+                      <FieldInput
+                        flex={1}
+                        m={0}
+                        size="small"
+                        rule={requireValidManualLabel}
+                        label={'Add custom label'}
+                        placeholder="name: value"
+                        value={manualInput}
+                        onChange={e => setManualInput(e.target.value)}
+                        toolTipContent="e.g. env: prod, region: us-*, name: ^kube-(a|b).+$"
+                      />
+                      <ButtonSecondary type="submit">Add</ButtonSecondary>
+                    </ManualInputContainer>
+                  </div>
+                </form>
+              )}
+            </Validation>
+          </ColumnContainer>
+        </PickerContainer>
+      </DialogContent>
+
+      <DialogFooter>
+        <Flex gap={3}>
+          <ButtonPrimary onClick={() => onChange(selected)}>Done</ButtonPrimary>
+          <ButtonSecondary onClick={onCancel}>Cancel</ButtonSecondary>
+        </Flex>
+      </DialogFooter>
+    </Dialog>
+  );
+}
+
+const PickerContainer = styled(Flex)`
+  flex: 1;
+  overflow: auto;
+  gap: ${({ theme }) => theme.space[3]}px;
+`;
+
+const ColumnContainer = styled(Flex)`
+  flex: 1;
+  flex-direction: column;
+  overflow: auto;
+  background-color: ${({ theme }) => theme.colors.levels.elevated};
+  border-radius: ${({ theme }) => theme.radii[3]}px;
+`;
+
+const ColumnHeading = styled(H3)`
+  padding: ${({ theme }) => theme.space[2] + theme.space[1]}px ${({ theme }) => theme.space[3]}px;
+  border-bottom: 1px solid ${({ theme }) => theme.colors.interactive.tonal.neutral[0]}};
+`;
+
+const ManualInputContainer = styled(Flex)`
+  padding: ${({ theme }) => theme.space[3]}px;
+  gap: ${({ theme }) => theme.space[2]}px;
+  align-items: flex-end;
+  border-top: 1px solid ${({ theme }) => theme.colors.interactive.tonal.neutral[0]}};
+`;
+
+const LoadMoreContainer = styled(Flex)`
+  justify-content: center;
+  padding: ${props => props.theme.space[3]}px;
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
+
+function formatLabel(label: KubernetesLabel) {
+  return `${label.name}: ${label.values.join(' or ')}`;
+}
+
+const manualLabelRegex = /^ *[a-z0-9:*]+ *: .+$/;
+export const requireValidManualLabel: Rule = value => () => {
+  const match = manualLabelRegex.test(value);
+  return {
+    valid: match,
+    message: match ? undefined : 'Must be in the format "name: value"',
+  };
+};
+
+function ClusterItem(props: {
+  resource: Kube;
+  selectedLabels: KubernetesLabel[];
+  addLabel: (name: string, value: string) => void;
+  removeLabel: (name: string, value: string) => void;
+  checkAccess: (labels: ResourceLabel[]) => boolean;
+}) {
+  const { resource, selectedLabels, addLabel, removeLabel, checkAccess } =
+    props;
+
+  const hasAccess = checkAccess(resource.labels);
+
+  return (
+    <ClusterItemContainer data-testid={`cluster-item-${resource.name}`}>
+      <div style={{ position: 'relative' }}>
+        <ResourceIcon name="kube" size={40} />
+        {hasAccess && (
+          <AccessCheckBackground>
+            <CheckThick size={'small'} />
+          </AccessCheckBackground>
+        )}
+      </div>
+
+      <ClusterItemInnerContainer>
+        <ClusterItemNameContainer>
+          <ClusterItemNameText>{resource.name}</ClusterItemNameText>
+        </ClusterItemNameContainer>
+
+        <ClusterItemLabelsContainer>
+          {resource.labels.map(l => {
+            const isSelected = selectedLabels.reduce((acc, cur) => {
+              if (acc) {
+                return true;
+              }
+              return cur.name === l.name && cur.values.some(v => v === l.value);
+            }, false);
+            return (
+              <Label
+                key={l.name}
+                label={formatLabel({ name: l.name, values: [l.value] })}
+                style="secondary"
+                actionAriaLabel={isSelected ? 'remove' : 'add'}
+                actionIcon={
+                  isSelected ? (
+                    <Minus size={'small'} />
+                  ) : (
+                    <Plus size={'small'} />
+                  )
+                }
+                onAction={() =>
+                  isSelected
+                    ? removeLabel(l.name, l.value)
+                    : addLabel(l.name, l.value)
+                }
+              />
+            );
+          })}
+
+          {resource.labels.length === 0 && <EmptyText>No labels</EmptyText>}
+        </ClusterItemLabelsContainer>
+      </ClusterItemInnerContainer>
+    </ClusterItemContainer>
+  );
+}
+
+const ClusterItemContainer = styled(Flex)`
+  align-items: flex-start;
+  gap: ${({ theme }) => theme.space[2]}px;
+  padding: ${({ theme }) => theme.space[2]}px ${({ theme }) => theme.space[3]}px;
+  padding-left: ${({ theme }) => theme.space[2]}px;
+`;
+
+const ClusterItemInnerContainer = styled(Flex)`
+  flex-direction: column;
+`;
+
+const ClusterItemNameContainer = styled(Flex)`
+  align-items: center;
+  min-height: ${({ theme }) => theme.space[5]}px;
+`;
+
+const ClusterItemNameText = styled(Text).attrs({
+  typography: 'subtitle2',
+})`
+  white-space: nowrap;
+`;
+
+const ClusterItemLabelsContainer = styled(Flex)`
+  flex-wrap: wrap;
+  gap: ${({ theme }) => theme.space[2]}px;
+`;
+
+const AccessCheckBackground = styled.div`
+  position: absolute;
+  right: 0;
+  bottom: 0;
+  border-radius: 999px;
+  background-color: ${({ theme }) =>
+    theme.colors.interactive.solid.success.default};
+  line-height: 0;
+  color: white;
+  border: 2px solid white;
+`;
+
+function Label(props: {
+  label: string;
+  style?: 'primary' | 'secondary';
+  onAction?: () => void;
+  actionIcon?: ReactNode;
+  actionAriaLabel?: string;
+}) {
+  const {
+    label,
+    style = 'primary',
+    onAction,
+    actionIcon,
+    actionAriaLabel,
+  } = props;
+
+  const Component = style === 'primary' ? Primary : Secondary;
+
+  return (
+    <Component p={0}>
+      <Flex
+        alignItems={'center'}
+        gap={1}
+        padding={1}
+        paddingLeft={3}
+        paddingRight={onAction ? 1 : 3}
+      >
+        <LabelText>{label}</LabelText>
+        {onAction && (
+          <ButtonIcon
+            size={0}
+            onClick={onAction}
+            aria-label={actionAriaLabel}
+            data-testid={`label-action-${label}-${actionAriaLabel}`}
+          >
+            {actionIcon}
+          </ButtonIcon>
+        )}
+      </Flex>
+    </Component>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Welcome.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Welcome.tsx
new file mode 100644
index 0000000000000..800265402572b
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/Welcome.tsx
@@ -0,0 +1,113 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled, { useTheme } from 'styled-components';
+
+import Box from 'design/Box/Box';
+import { ButtonPrimary } from 'design/Button/Button';
+import Flex from 'design/Flex/Flex';
+import Image from 'design/Image/Image';
+import Link from 'design/Link/Link';
+import { H2, P2 } from 'design/Text/Text';
+import { Theme } from 'design/theme/themes/types';
+
+import {
+  IntegrationEnrollStatusCode,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent';
+
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { useTracking } from '../Shared/useTracking';
+import welcomeDark from './gha-k8s-welcome-dark.svg';
+import welcomeLight from './gha-k8s-welcome-light.svg';
+
+export function Welcome(props: FlowStepProps) {
+  const { nextStep } = props;
+
+  const theme = useTheme();
+  const tracking = useTracking();
+
+  const welcomeImage: ImageSpec = {
+    light: welcomeLight,
+    dark: welcomeDark,
+  };
+
+  const handleNext = () => {
+    tracking.step(
+      IntegrationEnrollStep.MWIGHAK8SWelcome,
+      IntegrationEnrollStatusCode.Success
+    );
+
+    nextStep?.();
+  };
+
+  return (
+    <Container>
+      <Box>
+        <H2 mb={3} mt={3}>
+          GitHub Actions + Kubernetes
+        </H2>
+
+        <P2>
+          Use <code>kubectl</code> and other tools from your GitHub Actions
+          workflows.
+        </P2>
+
+        <P2>You’ll need:</P2>
+        <ul>
+          <li>A GitHub repository</li>
+          <li>Access rules for your workflow</li>
+        </ul>
+
+        <P2>
+          See the{' '}
+          <Link
+            target="_blank"
+            href={IAC_LINK}
+            onClick={() => {
+              tracking.link(IntegrationEnrollStep.MWIGHAK8SWelcome, IAC_LINK);
+            }}
+          >
+            Infrastructure as Code
+          </Link>{' '}
+          docs for information about setting up and using IaC with Teleport.
+        </P2>
+
+        <Flex gap={2} pt={5}>
+          <ButtonPrimary onClick={handleNext}>Start</ButtonPrimary>
+        </Flex>
+      </Box>
+
+      <Image p={5} width={420} src={welcomeImage[theme.type]} />
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  align-items: flex-start;
+  flex: 1;
+  overflow: auto;
+  gap: ${({ theme }) => theme.space[1]}px;
+`;
+
+type ImageSpec = {
+  [K in Theme['type']]: string;
+};
+
+const IAC_LINK =
+  'https://goteleport.com/docs/zero-trust-access/infrastructure-as-code/';
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-dark.svg b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-dark.svg
new file mode 100644
index 0000000000000..eba17b1585bed
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-dark.svg
@@ -0,0 +1 @@
+<svg fill="none" height="498" viewBox="0 0 1051 498" width="1051" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" gradientUnits="userSpaceOnUse" x1="66" x2="229" y1="166" y2="166"><stop offset="0" stop-color="#e1e1e1"/><stop offset="1" stop-color="#737373"/></linearGradient><clipPath id="b"><path d="m0 0h1051v498h-1051z"/></clipPath><clipPath id="c"><path d="m903 100h110v110h-110z"/></clipPath><g clip-path="url(#b)"><path d="m175.124 322h-52.841c-.677 0-1.863.508-2.371 1.186l-24.7267 24.388c-.8468.338-1.1853 1.524-1.1853 2.371v73.503c0 5.589 4.742 10.331 10.839 10.331h70.624c5.928 0 10.67-4.742 10.67-10.331v-91.117c-.339-5.589-5.081-10.331-11.009-10.331z" fill="#fff"/><path clip-rule="evenodd" d="m127.422 378.281c0-7.058 5.867-12.8 13.078-12.8s13.079 5.742 13.079 12.8c0 7.057-5.867 12.799-13.079 12.799-7.211 0-13.078-5.742-13.078-12.799zm5.384 0c0 4.147 3.451 7.521 7.694 7.521s7.694-3.374 7.694-7.521c0-4.148-3.452-7.523-7.695-7.523-4.242 0-7.693 3.375-7.693 7.523z" fill="#512fc9" fill-rule="evenodd"/><path clip-rule="evenodd" d="m171.509 387.318-6.367-5.313.118-.721c.133-.975.177-1.993.177-2.998 0-1.248-.067-2.532-.295-3.718l6.367-5.306.141-.116c.169-.163.285-.376.328-.605.046-.231.015-.47-.082-.684-1.3-3.843-3.542-7.501-6.3-10.534-.39-.434-.941-.593-1.458-.372l-8.023 2.683-.666-.505c-1.826-1.331-3.83-2.411-5.955-3.21l-1.589-7.995-.046-.165c-.079-.227-.219-.425-.406-.578-.187-.154-.412-.254-.652-.289l-.003-.003c-4.158-.814-8.438-.814-12.596 0-.27.04-.52.161-.718.345-.197.185-.332.424-.386.688l-1.589 7.994-.721.282c-2.13.854-4.119 2.009-5.903 3.434l-8.02-2.686-.177-.055c-.234-.055-.48-.043-.708.033-.228.078-.428.216-.579.399-2.761 3.033-5 6.691-6.298 10.534-.111.242-.133.513-.062.769.071.257.23.483.451.636l6.366 5.308-.12.722c-.133.974-.174 1.997-.174 2.994-.017 1.246.081 2.49.294 3.719l-6.363 5.313-.141.113c-.171.166-.286.377-.33.608s-.015.47.082.684c1.298 3.846 3.536 7.499 6.298 10.526.392.438.944.596 1.461.377l8.02-2.688.585.462c1.843 1.362 3.877 2.46 6.039 3.256l1.589 8 .043.166c.08.223.221.424.408.578.187.153.413.251.653.289 2.079.371 4.157.59 6.301.59 2.141 0 4.219-.219 6.298-.59.269-.043.519-.164.717-.347.197-.186.332-.425.387-.686l1.592-8 .794-.314c2.1-.869 4.067-2.014 5.827-3.404l8.02 2.688.174.058c.466.123.938-.045 1.287-.435 2.763-3.027 5-6.68 6.297-10.526.113-.241.133-.515.064-.772-.072-.256-.231-.479-.451-.633zm-31.009 9.688c-10.572 0-19.141-8.384-19.141-18.725 0-10.34 8.563-18.726 19.14-18.727 10.574.001 19.143 8.387 19.143 18.727 0 10.341-8.57 18.725-19.142 18.725z" fill="#512fc9" fill-rule="evenodd"/><path d="m105.641 450.627 5.364-.864v5.58h6.444v4.464h-6.444v6.66c0 1.128.192 2.028.576 2.7.408.672 1.212 1.008 2.412 1.008.576 0 1.164-.048 1.764-.144.624-.12 1.188-.276 1.692-.468l.756 4.176c-.648.264-1.368.492-2.16.684s-1.764.288-2.916.288c-1.464 0-2.676-.192-3.636-.576-.96-.408-1.728-.96-2.304-1.656-.576-.72-.984-1.584-1.224-2.592-.216-1.008-.324-2.124-.324-3.348zm27.912 14.04c0-3.456-1.272-5.184-3.816-5.184-.552 0-1.104.072-1.656.216-.528.144-.96.324-1.296.54v9.756c.264.048.6.096 1.008.144.408.024.852.036 1.332.036 1.464 0 2.568-.504 3.312-1.512s1.116-2.34 1.116-3.996zm5.472.144c0 1.512-.228 2.88-.684 4.104-.432 1.224-1.068 2.268-1.908 3.132s-1.872 1.536-3.096 2.016c-1.224.456-2.616.684-4.176.684-.648 0-1.332-.036-2.052-.108-.696-.048-1.392-.12-2.088-.216-.672-.096-1.32-.204-1.944-.324-.624-.144-1.176-.288-1.656-.432v-26.46l5.364-.864v9.432c.6-.264 1.224-.468 1.872-.612s1.344-.216 2.088-.216c1.344 0 2.532.24 3.564.72 1.032.456 1.896 1.116 2.592 1.98s1.224 1.908 1.584 3.132c.36 1.2.54 2.544.54 4.032zm21.439-.036c0 1.488-.216 2.856-.648 4.104-.432 1.224-1.056 2.28-1.872 3.168-.816.864-1.8 1.536-2.952 2.016-1.128.48-2.4.72-3.816.72-1.392 0-2.664-.24-3.816-.72-1.128-.48-2.1-1.152-2.916-2.016-.816-.888-1.452-1.944-1.908-3.168-.456-1.248-.684-2.616-.684-4.104s.228-2.844.684-4.068c.48-1.224 1.128-2.268 1.944-3.132.84-.864 1.824-1.536 2.952-2.016 1.152-.48 2.4-.72 3.744-.72 1.368 0 2.616.24 3.744.72 1.152.48 2.136 1.152 2.952 2.016s1.452 1.908 1.908 3.132.684 2.58.684 4.068zm-5.472 0c0-1.656-.336-2.952-1.008-3.888-.648-.96-1.584-1.44-2.808-1.44s-2.172.48-2.844 1.44c-.672.936-1.008 2.232-1.008 3.888s.336 2.976 1.008 3.96c.672.96 1.62 1.44 2.844 1.44s2.16-.48 2.808-1.44c.672-.984 1.008-2.304 1.008-3.96zm9.051-14.148 5.364-.864v5.58h6.444v4.464h-6.444v6.66c0 1.128.192 2.028.576 2.7.408.672 1.212 1.008 2.412 1.008.576 0 1.164-.048 1.764-.144.624-.12 1.188-.276 1.692-.468l.756 4.176c-.648.264-1.368.492-2.16.684s-1.764.288-2.916.288c-1.464 0-2.676-.192-3.636-.576-.96-.408-1.728-.96-2.304-1.656-.576-.72-.984-1.584-1.224-2.592-.216-1.008-.324-2.124-.324-3.348z" fill="#fff"/><g clip-path="url(#c)"><path clip-rule="evenodd" d="m957.739 101.736h.111c1.146 0 2.74.134 4.278.896l36.331 17.391.056.031c2.355 1.255 4.385 3.371 5.245 6.138l.04.107 9.1 39.179.02.163c.32 2.713-.32 5.485-1.96 7.789l-.05.071-25.124 31.075c-1.858 2.491-4.791 3.942-7.975 3.652h-39.92l-.087-.005c-2.788-.163-5.487-1.45-7.402-3.364l-.111-.111-25.259-31.247-.052-.071c-.82-1.138-1.403-2.428-1.716-3.795-.312-1.367-.347-2.783-.102-4.164l.014-.071 8.94-39.229.003-.009c.319-1.394.952-2.696 1.851-3.807.899-1.11 2.041-2.001 3.338-2.602l36.552-17.616.295-.074c1.313-.329 2.702-.327 3.585-.327" fill="#fff" fill-rule="evenodd"/><g fill="#326de6"><path d="m957.734 162.3 3.213-1.548.833-3.45-2.261-2.857h-3.569l-2.261 2.857.832 3.45zm23.083-1.785c.239-2.499.12-4.997-.475-7.496-.576-2.476-1.541-4.846-2.857-7.021l-8.922 8.092c-.24.238-.357.475-.477.832-.238 1.071.356 2.142 1.427 2.38zm-16.657-12.017 9.756-6.903c-3.57-3.569-8.21-5.83-13.444-6.424l.713 12.018c0 .356.12.595.356.832.596.833 1.786.952 2.619.477zm-9.4-13.446-2.381.475c-4.163.952-7.972 3.094-11.065 6.068l9.877 7.02.209.074c.252.091.458.165.742.165 1.07 0 2.023-.833 2.023-1.904zm-8.092 18.799-8.804-7.853c-2.598 4.377-3.802 9.44-3.451 14.517l11.542-3.332c.475-.119.713-.238.952-.596.713-.832.596-2.024-.239-2.736zm.952 10.233-11.779 2.023c1.665 4.759 4.996 8.924 9.162 11.662l4.522-10.949c.237-.355.237-.832.118-1.19-.119-.95-1.069-1.546-2.023-1.546zm10.114 17.373c1.785 0 3.451-.239 5.117-.596.744-.202 1.499-.361 2.261-.475l-5.713-10.353c-.356-.357-.594-.595-.951-.832-.833-.477-1.785-.239-2.379.475l-5.83 10.59c2.379.714 4.996 1.191 7.495 1.191zm12.494-3.808c2.885-1.815 5.324-4.255 7.14-7.139.951-1.309 1.665-2.857 2.261-4.522l-11.9-2.023c-.356 0-.714.119-1.07.238-.834.358-1.31 1.31-1.072 2.262z"/><path clip-rule="evenodd" d="m997.119 122.677c1.784.952 3.211 2.499 3.811 4.403l9.04 38.908c.24 2.023-.24 4.045-1.43 5.712l-25.106 31.055c-1.307 1.785-3.33 2.737-5.472 2.498h-39.979c-2.024-.119-4.045-1.069-5.474-2.498l-25.106-31.056c-.591-.816-1.012-1.742-1.237-2.723-.225-.982-.249-1.998-.072-2.99l8.924-39.143c.216-.959.65-1.856 1.269-2.619.62-.764 1.407-1.374 2.301-1.784l36.291-17.49c.952-.238 2.023-.238 2.974-.238.952 0 2.023.119 2.975.596zm-2.025 41.646c0 .119.12.119.239.119 1.069.238 2.023 1.19 2.142 2.498-.184.484-.509.902-.934 1.199-.424.297-.929.459-1.447.466-.238 0-.357 0-.595-.118-.068-.069-.097-.098-.132-.11-.026-.009-.055-.009-.107-.009-.137 0-.237-.041-.317-.075-.05-.024-.103-.039-.158-.044-.351-.089-.64-.241-.959-.413-.111-.061-.227-.122-.349-.183-.238 0-.476-.118-.715-.237h-.119c-1.23-.483-2.505-.841-3.807-1.071h-.119c-.352-.01-.693.118-.952.356 0 0 0 .119-.119.119l-.952-.119c-2.142 6.784-6.782 12.494-12.849 16.182l.356.954s-.119 0-.119.117c-.238.358-.238.835-.119 1.192.475 1.189 1.07 2.379 1.904 3.45v.237c.238.238.357.357.476.595.356.358.595.714.833 1.191.119.119.237.238.237.356 0 0 .119 0 .119.119.238.596.238 1.191.119 1.786-.119.594-.596 1.069-1.069 1.308l-.211.073c-.252.092-.458.165-.743.165-.951 0-1.784-.596-2.261-1.429-.117 0-.117-.119-.117-.119-.05-.051-.091-.111-.12-.177-.028-.066-.069-.127-.119-.179-.238-.357-.357-.832-.476-1.309l-.237-.714v-.119c-.358-1.309-.952-2.499-1.548-3.688-.229-.337-.564-.589-.952-.715 0-.119 0-.119-.119-.119l-.475-.833c-.304.092-.615.189-.93.291-.926.293-1.902.603-2.879.78-2.14.596-4.282.833-6.424.833-3.57 0-7.02-.594-10.352-1.904l-.475.952c0 .061 0 .09-.016.104-.015.014-.045.015-.104.015-.388.126-.722.378-.951.715-.596 1.189-1.192 2.379-1.548 3.688l-.238.714c-.063.224-.142.442-.237.654-.096.212-.176.431-.238.655-.12.119-.239.239-.239.356-.119 0-.119.119-.119.119-.475.835-1.309 1.429-2.261 1.429-.237 0-.594-.119-.833-.238-1.069-.596-1.546-2.023-.952-3.213.12 0 .12-.118.12-.118.05-.052.09-.113.119-.179s.069-.126.119-.179c.156-.209.29-.417.411-.606.154-.241.287-.449.422-.584.238-.238.357-.357.475-.596v-.117c.715-1.071 1.428-2.261 1.905-3.451.119-.356.119-.833-.119-1.191 0 0-.119 0-.119-.119l.595-.832c-1.191-.596-2.143-1.308-3.214-2.141-4.64-3.57-7.972-8.448-9.756-13.922l-1.07.119s0-.119-.121-.119c-.258-.239-.6-.367-.951-.356h-.12c-1.426.236-2.617.594-3.926 1.069h-.119c-.237 0-.475.119-.714.238-.132.046-.282.107-.443.172-.28.123-.57.225-.866.305-.052-.005-.104-.013-.156-.023-.145-.027-.321-.061-.321.023 0 .06 0 .089-.013.104-.016.015-.046.015-.104.015-.239.119-.358.119-.596.119-1.069.12-2.14-.595-2.379-1.665-.059-.305-.057-.619.007-.924.064-.304.188-.592.366-.848.177-.255.404-.472.667-.638s.557-.277.864-.328c.119-.119.119-.119.238-.119.111-.001.22-.027.319-.075.059-.023.107-.044.156-.044.239 0 .477-.031.715-.06.237-.03.475-.059.714-.059.238-.119.476-.119.713-.119 1.368-.112 2.722-.351 4.046-.714.357-.238.713-.475.832-.832 0 0 .12 0 .12-.12l.951-.238c-1.069-6.782.477-13.683 4.165-19.513.061-.119.119-.209.179-.298.065-.095.125-.195.179-.298l-.691-.69c.054-.342-.163-.758-.382-.975-.95-.952-2.14-1.665-3.33-2.38l-.714-.356c-.449-.215-.886-.453-1.309-.715-.119 0-.356-.237-.356-.237s0-.119-.119-.119c-.952-.834-1.192-2.261-.477-3.332.358-.596.952-.833 1.665-.833.596 0 1.192.239 1.666.596l.12.118c.052.05.113.09.179.119.06.03.119.059.177.119.179.179.329.356.477.535s.298.357.477.534c.036.036.081.074.132.114.12.09.26.198.343.363.832.952 1.903 1.904 2.974 2.738.239.119.477.237.714.237.111-.002.22-.027.321-.075.049-.024.101-.039.155-.044h.12l.713.476c3.926-4.164 9.045-7.139 14.636-8.329l.611-.103c1.193-.201 2.315-.389 3.433-.492l.119-.951v-.239c.358-.238.477-.595.596-.951 0-1.429 0-2.737-.238-4.046v-.119c0-.239 0-.475-.119-.714-.119-.476-.239-.951-.239-1.428v-.596c0-.594.239-1.189.715-1.665.596-.595 1.308-.952 2.023-.833 1.19.119 2.142 1.309 2.023 2.5v.713c-.061.238-.09.477-.119.714-.029.236-.061.476-.119.715 0 .119-.031.236-.06.355-.034.117-.054.237-.06.358v.119c-.238 1.427-.238 2.736-.238 4.046.119.357.238.713.596.952v-.12l.119.952c5.592.596 11.066 2.736 15.467 6.188.477.476.983.951 1.488 1.427.506.475 1.012.953 1.487 1.428l.952-.596h.119c.119.121.357.121.477.121.238 0 .475-.119.713-.238 1.099-.743 2.099-1.623 2.975-2.619.037-.035.082-.072.134-.112.118-.09.26-.198.342-.363.237-.358.595-.714.952-1.071.118 0 .237-.119.356-.238l.119-.12c.477-.356 1.071-.595 1.665-.595.595 0 1.31.359 1.666.834.834 1.071.596 2.499-.474 3.33 0 .046.015.075.031.1.024.038.042.065-.031.139-.052.05-.112.09-.179.119-.066.029-.126.069-.178.119-.239.119-.446.238-.656.357-.208.12-.415.239-.654.358l-.713.356c-1.192.715-2.261 1.428-3.332 2.38-.239.239-.358.714-.358 1.07v.12l-.713.714c1.917 3 3.325 6.296 4.165 9.756.713 3.451.951 7.02.475 10.472l.953.238c.072.19.184.362.327.505.144.144.316.255.506.328 1.307.356 2.736.595 4.045.713h.119c.237.119.476.119.714.119.475 0 .952 0 1.427.119.238 0 .476 0 .476.12zm-62.088-23.299-.022-.023v.119c.01-.031.018-.063.023-.096" fill-rule="evenodd"/></g></g><path d="m615.161 106h-104.43c-2.204 0-3.731 1.525-3.731 3.729v14.92c0 2.204 1.527 3.729 3.731 3.729h104.43c2.204 0 3.729-1.525 3.729-3.729v-14.92c0-2.204-1.525-3.729-3.729-3.729zm-22.379 14.918c-2.204 0-3.729-1.525-3.729-3.729s1.525-3.729 3.729-3.729 3.731 1.525 3.731 3.729-1.527 3.729-3.731 3.729zm18.649 0h-7.459c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.729 3.73-3.729h7.459c2.204 0 3.73 1.525 3.73 3.729s-1.526 3.729-3.73 3.729z" fill="#fff"/><path d="m615.161 143.297h-104.43c-2.204 0-3.731 1.525-3.731 3.729v14.918c0 2.204 1.527 3.731 3.731 3.731h48.484v15.597c-3.39 1.186-5.594 3.729-6.611 6.781h-30.685c-2.203 0-3.73 1.525-3.73 3.729s1.527 3.73 3.73 3.73h30.685c1.356 4.408 5.595 7.459 10.342 7.459s8.984-3.051 10.34-7.459h30.686c2.204 0 3.73-1.526 3.73-3.73s-1.526-3.729-3.73-3.729h-30.686c-1.017-3.391-3.559-5.595-6.611-6.781v-15.597h48.486c2.204 0 3.729-1.527 3.729-3.731v-14.918c0-2.204-1.525-3.729-3.729-3.729zm-89.512 14.918c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731 3.729 1.527 3.729 3.731-1.525 3.729-3.729 3.729zm11.189 0c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731c2.203 0 3.729 1.527 3.729 3.731s-1.526 3.729-3.729 3.729zm11.188 0c-2.203 0-3.729-1.525-3.729-3.729s1.526-3.731 3.729-3.731c2.204 0 3.731 1.527 3.731 3.731s-1.527 3.729-3.731 3.729zm7.46-3.729c0-2.204 1.525-3.731 3.729-3.731s3.731 1.527 3.731 3.731-1.527 3.729-3.731 3.729-3.729-1.525-3.729-3.729zm37.296 3.729c-2.204 0-3.729-1.525-3.729-3.729s1.525-3.731 3.729-3.731 3.731 1.527 3.731 3.731-1.527 3.729-3.731 3.729zm18.649 0h-7.459c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731h7.459c2.204 0 3.73 1.527 3.73 3.731s-1.526 3.729-3.73 3.729z" fill="#fff"/><path d="m23.9999 3c-13.2577 0-23.9999 10.9892-23.9999 24.6047 0 10.8509 6.86683 20.1121 16.4532 23.3605 1.1558.2073 1.6318-.5528 1.6318-1.1749 0-.5529-.0681-2.5573-.0681-4.5616-6.6628 1.4514-8.09061-2.9719-8.09061-2.9719-1.01982-2.8336-2.6515-3.5248-2.6515-3.5248-2.17562-1.5206.13597-1.5205.13597-1.5205 2.44758.1382 3.73924 2.4882 3.73924 2.4882 2.1757 3.8012 5.6431 2.6953 7.0029 2.0733.2039-1.5896.8158-2.6955 1.4957-3.3175-5.3711-.5529-10.94604-2.6954-10.94604-12.095 0-2.7646.9518-4.9071 2.51554-6.635-.272-.622-1.1558-3.1101.204-6.5658 0 0 2.0396-.622 6.5948 2.5572 2.0397-.5529 3.8754-.8293 5.983-.8293s4.1473.2764 6.0509.8293c4.5552-3.1792 6.5948-2.5572 6.5948-2.5572 1.2918 3.4557.476 5.9438.204 6.5658 1.5638 1.7279 2.4477 3.8704 2.4477 6.635 0 9.3996-5.5071 11.473-10.9462 12.095.8839.7603 1.6318 2.2118 1.6318 4.5616v6.7732c0 .6221.4079 1.3822 1.6317 1.1749 9.5183-3.2484 16.3851-12.5096 16.3851-23.3605.068-13.6155-10.7421-24.6047-23.9998-24.6047z" fill="#fff"/><path d="m78.324 27.724h3.492v11.664c-.288.096-.708.204-1.26.324-.528.12-1.152.24-1.872.36-.696.12-1.464.216-2.304.288-.84.096-1.692.144-2.556.144-1.752 0-3.348-.288-4.788-.864s-2.676-1.416-3.708-2.52-1.836-2.46-2.412-4.068c-.552-1.608-.828-3.456-.828-5.544s.312-3.936.936-5.544c.648-1.632 1.512-3 2.592-4.104s2.34-1.944 3.78-2.52c1.464-.576 3.024-.864 4.68-.864 1.128 0 2.124.072 2.988.216.888.144 1.644.312 2.268.504s1.128.384 1.512.576c.408.192.684.336.828.432l-1.116 2.916c-.696-.456-1.62-.828-2.772-1.116-1.152-.312-2.328-.468-3.528-.468-1.272 0-2.436.228-3.492.684-1.032.456-1.92 1.116-2.664 1.98-.72.864-1.284 1.92-1.692 3.168-.408 1.224-.612 2.604-.612 4.14 0 1.488.168 2.844.504 4.068.36 1.224.888 2.28 1.584 3.168.72.864 1.596 1.536 2.628 2.016 1.056.48 2.292.72 3.708.72 1.008 0 1.86-.048 2.556-.144.72-.12 1.236-.228 1.548-.324zm11.6955 12.276h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm10.1855 3.384h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm26.868-6.228h3.492v24.948h-3.492v-11.52h-12.204v11.52h-3.492v-24.948h3.492v10.404h12.204zm23.979 24.408c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.72-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm42.275 2.916c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm17.546 9.684c-1.512 0-2.844-.24-3.996-.72-1.128-.48-2.088-1.152-2.88-2.016-.768-.864-1.344-1.884-1.728-3.06-.384-1.2-.576-2.52-.576-3.96s.204-2.76.612-3.96c.432-1.2 1.032-2.232 1.8-3.096.768-.888 1.704-1.572 2.808-2.052 1.128-.504 2.376-.756 3.744-.756.84 0 1.68.072 2.52.216s1.644.372 2.412.684l-.756 2.844c-.504-.24-1.092-.432-1.764-.576-.648-.144-1.344-.216-2.088-.216-1.872 0-3.312.588-4.32 1.764-.984 1.176-1.476 2.892-1.476 5.148 0 1.008.108 1.932.324 2.772.24.84.6 1.56 1.08 2.16.504.6 1.14 1.068 1.908 1.404.768.312 1.704.468 2.808.468.888 0 1.692-.084 2.412-.252s1.284-.348 1.692-.54l.468 2.808c-.192.12-.468.24-.828.36-.36.096-.768.18-1.224.252-.456.096-.948.168-1.476.216-.504.072-.996.108-1.476.108zm11.335-19.152h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm14.304 18.72h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm23.578 12.744c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm7.806-8.82c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm24.632 15.768c1.368 0 2.376-.18 3.024-.54.672-.36 1.008-.936 1.008-1.728 0-.816-.324-1.464-.972-1.944s-1.716-1.02-3.204-1.62c-.72-.288-1.416-.576-2.088-.864-.648-.312-1.212-.672-1.692-1.08s-.864-.9-1.152-1.476-.432-1.284-.432-2.124c0-1.656.612-2.964 1.836-3.924 1.224-.984 2.892-1.476 5.004-1.476.528 0 1.056.036 1.584.108.528.048 1.02.12 1.476.216.456.072.852.156 1.188.252.36.096.636.18.828.252l-.612 2.88c-.36-.192-.924-.384-1.692-.576-.768-.216-1.692-.324-2.772-.324-.936 0-1.752.192-2.448.576-.696.36-1.044.936-1.044 1.728 0 .408.072.768.216 1.08.168.312.408.6.72.864.336.24.744.468 1.224.684s1.056.444 1.728.684c.888.336 1.68.672 2.376 1.008.696.312 1.284.684 1.764 1.116.504.432.888.96 1.152 1.584.264.6.396 1.344.396 2.232 0 1.728-.648 3.036-1.944 3.924-1.272.888-3.096 1.332-5.472 1.332-1.656 0-2.952-.144-3.888-.432-.936-.264-1.572-.468-1.908-.612l.612-2.88c.384.144.996.36 1.836.648s1.956.432 3.348.432z" fill="#fff"/><path d="m886.776 226.052c-.744.816-1.584 1.728-2.52 2.736-.936.984-1.92 2.004-2.952 3.06-1.008 1.032-2.016 2.052-3.024 3.06s-1.956 1.944-2.844 2.808c1.032.72 2.124 1.608 3.276 2.664s2.28 2.184 3.384 3.384 2.136 2.424 3.096 3.672c.984 1.248 1.8 2.436 2.448 3.564h-4.104c-.72-1.128-1.548-2.256-2.484-3.384-.936-1.152-1.932-2.244-2.988-3.276-1.032-1.056-2.088-2.028-3.168-2.916-1.056-.888-2.088-1.644-3.096-2.268v11.844h-3.492v-24.948h3.492v11.016c.84-.792 1.764-1.68 2.772-2.664 1.008-1.008 2.004-2.016 2.988-3.024s1.908-1.968 2.772-2.88c.888-.936 1.632-1.752 2.232-2.448zm18.007 24.408c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.72-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm16.411-6.408c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm14.818-7.956c.288 0 .612.024.972.072.384.024.756.072 1.116.144.36.048.684.108.972.18.312.048.54.096.684.144l-.576 2.916c-.264-.096-.708-.204-1.332-.324-.6-.144-1.38-.216-2.34-.216-.624 0-1.248.072-1.872.216-.6.12-.996.204-1.188.252v15.732h-3.348v-17.928c.792-.288 1.776-.552 2.952-.792 1.176-.264 2.496-.396 3.96-.396zm6.578.936c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm19.232 8.856c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm11.034-7.56h7.1v2.808h-7.1v8.64c0 .936.08 1.716.22 2.34.14.6.36 1.08.65 1.44.29.336.65.576 1.08.72s.93.216 1.51.216c1.01 0 1.81-.108 2.41-.324.63-.24 1.06-.408 1.3-.504l.65 2.772c-.34.168-.93.372-1.77.612-.84.264-1.8.396-2.88.396-1.27 0-2.33-.156-3.17-.468-.81-.336-1.47-.828-1.98-1.476-.5-.648-.86-1.44-1.08-2.376-.19-.96-.28-2.064-.28-3.312v-16.704l3.34-.576zm9.56 9.396c0-1.656.24-3.096.72-4.32.48-1.248 1.12-2.28 1.91-3.096s1.71-1.428 2.74-1.836 2.09-.612 3.17-.612c2.52 0 4.45.792 5.79 2.376 1.35 1.56 2.02 3.948 2.02 7.164v.576c0 .216-.01.42-.04.612h-12.81c.14 1.944.7 3.42 1.69 4.428.98 1.008 2.52 1.512 4.61 1.512 1.17 0 2.16-.096 2.95-.288.81-.216 1.43-.42 1.83-.612l.47 2.808c-.41.216-1.13.444-2.16.684-1.01.24-2.16.36-3.45.36-1.64 0-3.05-.24-4.25-.72-1.18-.504-2.15-1.188-2.92-2.052s-1.34-1.884-1.73-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.86-1.836c.02-1.512-.36-2.748-1.16-3.708-.76-.984-1.83-1.476-3.2-1.476-.77 0-1.45.156-2.05.468-.58.288-1.07.672-1.48 1.152s-.73 1.032-.97 1.656c-.22.624-.36 1.26-.43 1.908zm12.26 8.748c1.37 0 2.37-.18 3.02-.54.67-.36 1.01-.936 1.01-1.728 0-.816-.32-1.464-.97-1.944s-1.72-1.02-3.21-1.62c-.72-.288-1.41-.576-2.08-.864-.65-.312-1.22-.672-1.7-1.08s-.86-.9-1.15-1.476-.43-1.284-.43-2.124c0-1.656.61-2.964 1.84-3.924 1.22-.984 2.89-1.476 5-1.476.53 0 1.06.036 1.58.108.53.048 1.02.12 1.48.216.46.072.85.156 1.19.252.36.096.63.18.83.252l-.62 2.88c-.36-.192-.92-.384-1.69-.576-.77-.216-1.69-.324-2.77-.324-.94 0-1.75.192-2.45.576-.69.36-1.04.936-1.04 1.728 0 .408.07.768.21 1.08.17.312.41.6.72.864.34.24.75.468 1.23.684s1.05.444 1.73.684c.88.336 1.68.672 2.37 1.008.7.312 1.29.684 1.77 1.116.5.432.88.96 1.15 1.584.26.6.39 1.344.39 2.232 0 1.728-.64 3.036-1.94 3.924-1.27.888-3.1 1.332-5.47 1.332-1.66 0-2.95-.144-3.89-.432-.94-.264-1.57-.468-1.91-.612l.61-2.88c.39.144 1 .36 1.84.648s1.96.432 3.35.432z" fill="#fff"/><path d="m506.108 251c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm16.707-15.948c3.504 0 6.192.672 8.064 2.016 1.896 1.32 2.844 3.3 2.844 5.94 0 1.44-.264 2.676-.792 3.708-.504 1.008-1.248 1.836-2.232 2.484-.96.624-2.136 1.08-3.528 1.368s-2.964.432-4.716.432h-2.772v9.252h-3.492v-24.588c.984-.24 2.076-.396 3.276-.468 1.224-.096 2.34-.144 3.348-.144zm.288 3.06c-1.488 0-2.628.036-3.42.108v9.792h2.628c1.2 0 2.28-.072 3.24-.216.96-.168 1.764-.432 2.412-.792.672-.384 1.188-.9 1.548-1.548s.54-1.476.54-2.484c0-.96-.192-1.752-.576-2.376-.36-.624-.864-1.116-1.512-1.476-.624-.384-1.356-.648-2.196-.792s-1.728-.216-2.664-.216zm14.594-2.808h3.492v24.948h-3.492zm23.832-.252c3.504 0 6.192.672 8.064 2.016 1.896 1.32 2.844 3.3 2.844 5.94 0 1.44-.264 2.676-.792 3.708-.504 1.008-1.248 1.836-2.232 2.484-.96.624-2.136 1.08-3.528 1.368s-2.964.432-4.716.432h-2.772v9.252h-3.492v-24.588c.984-.24 2.076-.396 3.276-.468 1.224-.096 2.34-.144 3.348-.144zm.288 3.06c-1.488 0-2.628.036-3.42.108v9.792h2.628c1.2 0 2.28-.072 3.24-.216.96-.168 1.764-.432 2.412-.792.672-.384 1.188-.9 1.548-1.548s.54-1.476.54-2.484c0-.96-.192-1.752-.576-2.376-.36-.624-.864-1.116-1.512-1.476-.624-.384-1.356-.648-2.196-.792s-1.728-.216-2.664-.216zm21.291 3.024c.288 0 .612.024.972.072.384.024.756.072 1.116.144.36.048.684.108.972.18.312.048.54.096.684.144l-.576 2.916c-.264-.096-.708-.204-1.332-.324-.6-.144-1.38-.216-2.34-.216-.624 0-1.248.072-1.872.216-.6.12-.996.204-1.188.252v15.732h-3.348v-17.928c.792-.288 1.776-.552 2.952-.792 1.176-.264 2.496-.396 3.96-.396zm23.102 9.756c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm18.405 9.36c-.264-.528-.588-1.116-.972-1.764s-.804-1.308-1.26-1.98c-.456-.696-.924-1.38-1.404-2.052s-.948-1.308-1.404-1.908c-.456.6-.924 1.248-1.404 1.944-.48.672-.948 1.356-1.404 2.052-.432.672-.84 1.332-1.224 1.98s-.708 1.224-.972 1.728h-3.456c.84-1.632 1.836-3.288 2.988-4.968 1.176-1.704 2.34-3.324 3.492-4.86l-6.192-8.892h3.78l4.464 6.552 4.5-6.552h3.564l-6.048 8.676c1.152 1.56 2.328 3.216 3.528 4.968 1.224 1.728 2.256 3.42 3.096 5.076zm4.599 3.492c.264.12.6.228 1.008.324.432.12.852.18 1.26.18 1.32 0 2.352-.3 3.096-.9.744-.576 1.416-1.524 2.016-2.844-1.512-2.88-2.928-5.928-4.248-9.144-1.296-3.24-2.376-6.516-3.24-9.828h3.6c.264 1.08.576 2.244.936 3.492.384 1.248.804 2.532 1.26 3.852s.948 2.64 1.476 3.96 1.08 2.592 1.656 3.816c.912-2.52 1.704-5.016 2.376-7.488s1.308-5.016 1.908-7.632h3.456c-.864 3.528-1.824 6.924-2.88 10.188-1.056 3.24-2.196 6.276-3.42 9.108-.48 1.08-.984 2.004-1.512 2.772-.504.792-1.068 1.44-1.692 1.944s-1.332.876-2.124 1.116c-.768.24-1.644.36-2.628.36-.264 0-.54-.024-.828-.072-.288-.024-.576-.072-.864-.144-.264-.048-.516-.108-.756-.18-.216-.072-.372-.132-.468-.18z" fill="#fff"/><path d="m166.773 267.704c.72.552 1.476 1.236 2.268 2.052.816.816 1.608 1.704 2.376 2.664.792.936 1.536 1.896 2.232 2.88.696.96 1.284 1.86 1.764 2.7h-3.924c-.504-.84-1.092-1.692-1.764-2.556-.648-.888-1.332-1.728-2.052-2.52-.72-.816-1.452-1.56-2.196-2.232s-1.452-1.236-2.124-1.692v9h-3.348v-27.36l3.348-.576v17.064l1.908-1.908c.696-.696 1.38-1.404 2.052-2.124s1.308-1.404 1.908-2.052c.6-.672 1.116-1.26 1.548-1.764h3.924c-.552.6-1.152 1.26-1.8 1.98s-1.32 1.452-2.016 2.196c-.696.72-1.404 1.452-2.124 2.196-.696.72-1.356 1.404-1.98 2.052zm26.549 9.756c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.719-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm16.412-6.408c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm16.041 11.592c-1.512 0-2.844-.24-3.996-.72-1.128-.48-2.088-1.152-2.88-2.016-.768-.864-1.344-1.884-1.728-3.06-.384-1.2-.576-2.52-.576-3.96s.204-2.76.612-3.96c.432-1.2 1.032-2.232 1.8-3.096.768-.888 1.704-1.572 2.808-2.052 1.128-.504 2.376-.756 3.744-.756.84 0 1.68.072 2.52.216s1.644.372 2.412.684l-.756 2.844c-.504-.24-1.092-.432-1.764-.576-.648-.144-1.344-.216-2.088-.216-1.872 0-3.312.588-4.32 1.764-.984 1.176-1.476 2.892-1.476 5.148 0 1.008.108 1.932.324 2.772.24.84.6 1.56 1.08 2.16.504.6 1.14 1.068 1.908 1.404.768.312 1.704.468 2.808.468.888 0 1.692-.084 2.412-.252s1.284-.348 1.692-.54l.468 2.808c-.192.12-.468.24-.828.36-.36.096-.768.18-1.224.252-.456.096-.948.168-1.476.216-.504.072-.996.108-1.476.108zm24.269-9.792c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm7.807-8.82c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm27.584-9.756c.84 0 1.56.06 2.16.18.6.096 1.032.192 1.296.288l-.468 2.88c-.264-.096-.624-.192-1.08-.288-.456-.12-1.008-.18-1.656-.18-1.56 0-2.652.432-3.276 1.296-.624.84-.936 1.98-.936 3.42v1.62h7.2v2.808h-7.2v15.912h-3.348v-20.412c0-2.4.588-4.248 1.764-5.544 1.176-1.32 3.024-1.98 5.544-1.98zm10.08 27.936h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm18.776 20.232c-.288.192-.852.444-1.692.756-.816.288-1.776.432-2.88.432-1.128 0-2.196-.18-3.204-.54-.984-.36-1.848-.912-2.592-1.656-.744-.768-1.332-1.716-1.764-2.844s-.648-2.472-.648-4.032c0-1.368.204-2.616.612-3.744.408-1.152.996-2.136 1.764-2.952.792-.84 1.752-1.488 2.88-1.944 1.128-.48 2.4-.72 3.816-.72 1.56 0 2.916.12 4.068.36 1.176.216 2.16.42 2.952.612v16.704c0 2.88-.744 4.968-2.232 6.264s-3.744 1.944-6.768 1.944c-1.176 0-2.292-.096-3.348-.288-1.032-.192-1.932-.42-2.7-.684l.612-2.916c.672.264 1.488.492 2.448.684.984.216 2.004.324 3.06.324 1.992 0 3.42-.396 4.284-1.188.888-.792 1.332-2.052 1.332-3.78zm-.036-13.896c-.336-.096-.792-.18-1.368-.252-.552-.096-1.308-.144-2.268-.144-1.8 0-3.192.588-4.176 1.764-.96 1.176-1.44 2.736-1.44 4.68 0 1.08.132 2.004.396 2.772.288.768.66 1.404 1.116 1.908.48.504 1.02.876 1.62 1.116.624.24 1.26.36 1.908.36.888 0 1.704-.12 2.448-.36.744-.264 1.332-.564 1.764-.9z" fill="#fff"/><path d="m548.825 473c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm24.244 8.712c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.503-18.18h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm10.957 18.72v-27.36l3.348-.576v9.576c.624-.24 1.284-.42 1.98-.54.72-.144 1.428-.216 2.124-.216 1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.024-1.116.072s-.756.108-1.116.18c-.336.048-.648.108-.936.18-.264.072-.456.132-.576.18v15.552z" fill="#fff"/><rect fill="url(#a)" height="56" rx="4" width="163" x="66" y="138"/><path d="m90.8434 170.416-13.76 5.792-1.248-3.872 10.048-3.904-10.048-3.904 1.248-3.872 13.76 5.792zm15.6026-3.168c.47-.512.95-1.045 1.44-1.6.512-.555 1.003-1.099 1.472-1.632.47-.555.907-1.077 1.312-1.568.427-.491.79-.917 1.088-1.28h5.664c-1.13 1.301-2.24 2.549-3.328 3.744-1.066 1.173-2.24 2.389-3.52 3.648.64.576 1.302 1.269 1.984 2.08.683.789 1.344 1.611 1.984 2.464s1.227 1.707 1.76 2.56c.534.853.982 1.632 1.344 2.336h-5.472c-.341-.555-.736-1.163-1.184-1.824-.426-.683-.885-1.355-1.376-2.016-.49-.683-1.013-1.333-1.568-1.952-.533-.619-1.066-1.141-1.6-1.568v7.36h-4.768v-24.064l4.768-.768zm27.467 10.176c-.811.235-1.856.448-3.136.64-1.28.213-2.624.32-4.032.32-1.429 0-2.624-.192-3.584-.576-.939-.384-1.685-.917-2.24-1.6-.555-.704-.949-1.536-1.184-2.496s-.352-2.016-.352-3.168v-9.376h4.768v8.8c0 1.536.203 2.645.608 3.328s1.163 1.024 2.272 1.024c.341 0 .704-.011 1.088-.032.384-.043.725-.085 1.024-.128v-12.992h4.768zm14.908-7.968c0-3.072-1.131-4.608-3.392-4.608-.491 0-.981.064-1.472.192-.469.128-.853.288-1.152.48v8.672c.235.043.533.085.896.128.363.021.757.032 1.184.032 1.301 0 2.283-.448 2.944-1.344s.992-2.08.992-3.552zm4.864.128c0 1.344-.203 2.56-.608 3.648-.384 1.088-.949 2.016-1.696 2.784s-1.664 1.365-2.752 1.792c-1.088.405-2.325.608-3.712.608-.576 0-1.184-.032-1.824-.096-.619-.043-1.237-.107-1.856-.192-.597-.085-1.173-.181-1.728-.288-.555-.128-1.045-.256-1.472-.384v-23.52l4.768-.768v8.384c.533-.235 1.088-.416 1.664-.544s1.195-.192 1.856-.192c1.195 0 2.251.213 3.168.64.917.405 1.685.992 2.304 1.76s1.088 1.696 1.408 2.784c.32 1.067.48 2.261.48 3.584zm2.512.128c0-1.493.224-2.795.672-3.904.47-1.131 1.078-2.069 1.824-2.816.747-.747 1.6-1.312 2.56-1.696.982-.384 1.984-.576 3.008-.576 2.39 0 4.278.736 5.664 2.208 1.387 1.451 2.08 3.595 2.08 6.432 0 .277-.01.587-.032.928-.021.32-.042.608-.064.864h-10.816c.107.981.566 1.76 1.376 2.336.811.576 1.899.864 3.264.864.875 0 1.728-.075 2.56-.224.854-.171 1.547-.373 2.08-.608l.64 3.872c-.256.128-.597.256-1.024.384-.426.128-.906.235-1.44.32-.512.107-1.066.192-1.664.256-.597.064-1.194.096-1.792.096-1.514 0-2.837-.224-3.968-.672-1.109-.448-2.037-1.056-2.784-1.824-.725-.789-1.269-1.717-1.632-2.784-.341-1.067-.512-2.219-.512-3.456zm11.2-1.824c-.021-.405-.096-.8-.224-1.184-.106-.384-.288-.725-.544-1.024-.234-.299-.544-.544-.928-.736-.362-.192-.821-.288-1.376-.288-.533 0-.992.096-1.376.288-.384.171-.704.405-.96.704s-.458.651-.608 1.056c-.128.384-.224.779-.288 1.184zm7.136 1.696c0-1.216.192-2.357.576-3.424.405-1.088.981-2.027 1.728-2.816.747-.811 1.653-1.451 2.72-1.92s2.283-.704 3.648-.704c.896 0 1.717.085 2.464.256.747.149 1.472.373 2.176.672l-.992 3.808c-.448-.171-.939-.32-1.472-.448s-1.131-.192-1.792-.192c-1.408 0-2.464.437-3.168 1.312-.683.875-1.024 2.027-1.024 3.456 0 1.515.32 2.688.96 3.52.661.832 1.803 1.248 3.424 1.248.576 0 1.195-.053 1.856-.16s1.269-.277 1.824-.512l.672 3.904c-.555.235-1.248.437-2.08.608s-1.749.256-2.752.256c-1.536 0-2.859-.224-3.968-.672-1.109-.469-2.027-1.099-2.752-1.888-.704-.789-1.227-1.717-1.568-2.784-.32-1.088-.48-2.261-.48-3.52zm16.288-12.608 4.768-.768v4.96h5.728v3.968h-5.728v5.92c0 1.003.171 1.803.512 2.4.363.597 1.077.896 2.144.896.512 0 1.035-.043 1.568-.128.555-.107 1.056-.245 1.504-.416l.672 3.712c-.576.235-1.216.437-1.92.608s-1.568.256-2.592.256c-1.301 0-2.379-.171-3.232-.512-.853-.363-1.536-.853-2.048-1.472-.512-.64-.875-1.408-1.088-2.304-.192-.896-.288-1.888-.288-2.976zm20.747 21.344c-1.387-.021-2.518-.171-3.392-.448-.854-.277-1.536-.661-2.048-1.152-.491-.512-.832-1.12-1.024-1.824-.171-.725-.256-1.536-.256-2.432v-18.528l4.768-.768v18.336c0 .427.032.811.096 1.152s.181.629.352.864c.192.235.458.427.8.576.341.149.8.245 1.376.288z" fill="#000"/><path d="m380 2v494" stroke="#b3b3b3" stroke-dasharray="20 20" stroke-linecap="round" stroke-width="4"/><path d="m750 2v494" stroke="#b3b3b3" stroke-dasharray="20 20" stroke-linecap="round" stroke-width="4"/><g fill="#fff"><path d="m637 165c-1.105 0-2 .895-2 2s.895 2 2 2v-2zm253.414 3.414c.781-.781.781-2.047 0-2.828l-12.728-12.728c-.781-.781-2.047-.781-2.828 0s-.781 2.047 0 2.828l11.314 11.314-11.314 11.314c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0zm-253.414-1.414v2h252v-2-2h-252z"/><path d="m242 165c-1.105 0-2 .895-2 2s.895 2 2 2v-2zm253.414 3.414c.781-.781.781-2.047 0-2.828l-12.728-12.728c-.781-.781-2.047-.781-2.828 0s-.781 2.047 0 2.828l11.314 11.314-11.314 11.314c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0zm-253.414-1.414v2h252v-2-2h-252z"/><path d="m501 403c1.105 0 2-.895 2-2s-.895-2-2-2v2zm-299.914-3.414c-.781.781-.781 2.047 0 2.828l12.728 12.728c.781.781 2.047.781 2.828 0s.781-2.047 0-2.828l-11.314-11.314 11.314-11.314c.781-.781.781-2.047 0-2.828s-2.047-.781-2.828 0zm299.914 1.414v-2h-298.5v2 2h298.5z"/><path d="m138 305c0 1.105.895 2 2 2s2-.895 2-2h-2zm3.414-96.914c-.781-.781-2.047-.781-2.828 0l-12.728 12.728c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0l11.314-11.314 11.314 11.314c.781.781 2.047.781 2.828 0s.781-2.047 0-2.828zm-1.414 96.914h2v-95.5h-2-2v95.5z"/><path d="m522.159 352.961h92.551c2.33 0 4.16-2.331 3.162-4.828l-10.82-24.136c-.333-1.331-1.664-1.997-2.663-1.997h-71.576c-.998 0-2.33.666-3.163 1.997l-10.652 24.136c-.999 2.497.831 4.828 3.161 4.828z"/><path d="m616.874 356.292h-96.544c-1.998 0-3.33 1.498-3.33 3.662v13.649c0 1.998 1.332 3.33 3.33 3.33h96.544c1.997 0 3.329-1.332 3.329-3.33v-13.649c0-2.164-1.332-3.662-3.329-3.662zm-20.641 13.982c-2.164 0-3.661-1.498-3.661-3.662 0-1.997 1.497-3.329 3.661-3.329 1.998 0 3.329 1.332 3.329 3.329 0 2.164-1.331 3.662-3.329 3.662zm16.979 0h-6.659c-2.164 0-3.662-1.498-3.662-3.662 0-1.997 1.498-3.329 3.662-3.329h6.659c2.164 0 3.662 1.332 3.662 3.329 0 2.164-1.498 3.662-3.662 3.662z"/><path d="m616.874 404.563h-96.544c-1.998 0-3.33 1.332-3.33 3.329v13.983c0 1.997 1.332 3.329 3.33 3.329h96.544c1.997 0 3.329-1.332 3.329-3.329v-13.983c0-1.997-1.332-3.329-3.329-3.329zm-20.641 13.65c-2.164 0-3.661-1.332-3.661-3.329 0-1.998 1.497-3.329 3.661-3.329 1.998 0 3.329 1.331 3.329 3.329 0 1.997-1.331 3.329-3.329 3.329zm16.979 0h-6.659c-2.164 0-3.662-1.332-3.662-3.329 0-1.998 1.498-3.329 3.662-3.329h6.659c2.164 0 3.662 1.331 3.662 3.329 0 1.997-1.498 3.329-3.662 3.329z"/><path d="m616.874 380.592h-96.544c-1.998 0-3.33 1.332-3.33 3.329v13.65c0 2.164 1.332 3.662 3.33 3.662h96.544c1.997 0 3.329-1.498 3.329-3.662v-13.65c0-1.997-1.332-3.329-3.329-3.329zm-82.562 13.65c-2.164 0-3.663-1.333-3.663-3.33 0-2.164 1.499-3.662 3.663-3.662 1.998 0 3.328 1.498 3.328 3.662 0 1.997-1.33 3.33-3.328 3.33zm10.32 0c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662 1.997 0 3.329 1.498 3.329 3.662 0 1.997-1.332 3.33-3.329 3.33zm10.32 0c-2.163 0-3.662-1.333-3.662-3.33 0-2.164 1.499-3.662 3.662-3.662 1.998 0 3.329 1.498 3.329 3.662 0 1.997-1.331 3.33-3.329 3.33zm10.32 0c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662 1.997 0 3.33 1.498 3.33 3.662 0 1.997-1.333 3.33-3.33 3.33zm30.961 0c-2.164 0-3.661-1.333-3.661-3.33 0-2.164 1.497-3.662 3.661-3.662 1.998 0 3.329 1.498 3.329 3.662 0 1.997-1.331 3.33-3.329 3.33zm16.979 0h-6.659c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662h6.659c2.164 0 3.662 1.498 3.662 3.662 0 1.997-1.498 3.33-3.662 3.33z"/><path clip-rule="evenodd" d="m475.142 26.5012c0-4.7417 3.867-8.5997 8.62-8.6 4.754.0003 8.621 3.8583 8.621 8.6s-3.867 8.5993-8.62 8.5993c-4.754 0-8.621-3.8575-8.621-8.5993zm3.549 0c0 2.7866 2.275 5.0534 5.072 5.0534 2.796 0 5.071-2.2668 5.071-5.0534 0-2.7869-2.275-5.054-5.072-5.054-2.796 0-5.071 2.2671-5.071 5.054z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m504.202 32.5735-4.197-3.5702.078-.4845c.088-.655.116-1.3385.116-2.0137 0-.8391-.044-1.7016-.194-2.4983l4.197-3.565.092-.0777c.112-.1097.188-.2531.217-.4068.03-.1553.01-.3157-.054-.4592-.857-2.5826-2.335-5.0403-4.153-7.0778-.257-.2919-.62-.3983-.961-.2497l-5.288 1.8027-.439-.3393c-1.204-.8946-2.524-1.6203-3.925-2.1572l-1.047-5.37116-.031-.11142c-.052-.15193-.144-.28531-.267-.38825-.123-.10302-.272-.17047-.43-.1941l-.002-.00173c-2.741-.54685-5.562-.54685-8.302 0-.178.02702-.343.10809-.474.23132-.13.12484-.219.28524-.255.46245l-1.047 5.37129-.475.189c-1.404.5739-2.715 1.3504-3.891 2.3074l-5.286-1.8044-.117-.0371c-.154-.0372-.316-.0288-.466.0219-.15.0524-.283.1452-.382.2683-1.82 2.0375-3.296 4.4952-4.151 7.0778-.073.1621-.088.3444-.041.5166s.152.3241.297.4271l4.196 3.5667-.078.4844c-.088.655-.115 1.3421-.115 2.0122-.012.8372.053 1.6728.193 2.4982l-4.194 3.5702-.093.0759c-.112.1113-.188.2532-.217.4084-.029.1554-.01.3158.054.4591.855 2.5844 2.331 5.0388 4.151 7.0728.258.2937.622.4.963.2532l5.286-1.8062.386.3107c1.215.9149 2.556 1.6525 3.98 2.1876l1.047 5.3746.029.1113c.053.1503.146.2854.269.3884.123.1029.272.1687.431.1941 1.37.2498 2.74.3966 4.152.3966s2.782-.1468 4.152-.3966c.177-.0288.342-.1097.472-.233.13-.125.219-.2852.256-.4608l1.049-5.3746.523-.211c1.384-.5841 2.681-1.3538 3.841-2.2873l5.286 1.8063.115.0388c.307.0827.618-.0304.848-.2921 1.821-2.034 3.296-4.4884 4.151-7.0727.074-.162.088-.346.042-.5183-.047-.1721-.152-.3223-.297-.4252zm-20.439 6.5088c-6.969 0-12.617-5.6328-12.617-12.5806 0-6.9475 5.644-12.5818 12.616-12.5823 6.969.0005 12.618 5.6348 12.618 12.5823 0 6.9478-5.649 12.5806-12.617 12.5806z" fill-rule="evenodd"/><path d="m562.601 11.3723h-6.06v28.723h6.06z"/><path d="m536.752 12.1384h-22.645v5.1434h8.016v22.8133h6.611v-22.8133h8.018z"/><path clip-rule="evenodd" d="m603.708 20.5042c.919.4777 1.717 1.1613 2.328 1.9969.652.8694 1.162 1.9344 1.534 3.1937.372 1.261.556 2.689.556 4.2893 0 1.4955-.21 2.8779-.635 4.1439-.387 1.1985-.989 2.3177-1.778 3.3001-.745.9182-1.679 1.6644-2.738 2.1859-1.1.5335-2.308.8035-3.529.7883-1.058 0-1.945-.1469-2.659-.4406-.712-.2903-1.372-.692-1.957-1.1899v7.6365h-6.061v-26.2113h3.753l.185.0084c.272.0135.533.0979.763.2414.264.1772.455.4439.539.7495l.448 1.4584.299-.3106c.306-.3021.628-.5824.963-.8423 1.446-1.117 3.227-1.7129 5.056-1.6878 1.059.0002 2.035.2296 2.933.6902zm-2.943 14.1521c.346-.4793.615-1.1039.813-1.8719.194-.7664.292-1.6998.292-2.8003 0-1.05-.079-1.9312-.235-2.6486-.155-.7157-.375-1.2946-.654-1.7369-.28-.4405-.618-.7562-1.008-.9503-.39-.1909-.826-.2871-1.311-.2871-.443 0-.843.0423-1.201.1266-.359.0811-.693.1993-.997.3546-.309.1552-.597.3511-.852.5841-.278.2548-.539.5266-.782.8152v8.4434l.198.2025c.365.368.804.6549 1.289.8424.534.1991 1.095.297 1.681.297.534.0051 1.061-.1047 1.544-.3257.47-.2178.877-.5672 1.223-1.045z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m550.312 22.29c-.821-.7916-1.801-1.4009-2.875-1.7858-1.183-.4204-2.429-.628-3.685-.6128-1.552 0-2.944.2617-4.176.7867-1.182.4911-2.254 1.2136-3.149 2.1285-.868.898-1.546 1.9615-1.993 3.1278-.467 1.2053-.702 2.4881-.695 3.7812 0 1.764.269 3.3118.813 4.642.54 1.3301 1.277 2.4442 2.21 3.3388.932.8963 2.02 1.5698 3.265 2.0256 1.244.4524 2.578.6803 3.997.6803.693 0 1.418-.049 2.181-.1435.762-.0962 1.524-.2684 2.288-.5199.764-.2482 1.507-.5925 2.23-1.0348.62-.3763 1.204-.8525 1.754-1.4229l.27-.2937-1.759-2.1303c-.25-.3461-.613-.5199-1.096-.5199-.365 0-.713.0844-1.044.2515-.335.1654-.7.3511-1.097.5553-.437.2212-.892.4068-1.36.5571-.508.1671-1.115.2498-1.818.2498-1.317 0-2.393-.3747-3.226-1.1225-.779-.6988-1.279-1.7961-1.502-3.2916l-.042-.3258h11.692c.275 0 .498-.0321.674-.0945.176-.0641.326-.1857.422-.346.117-.2059.191-.4356.215-.6718.039-.2819.059-.6448.059-1.0939 0-1.433-.226-2.716-.676-3.8469-.415-1.0787-1.054-2.056-1.877-2.868zm-10.452 5.4675c.209-1.2153.64-2.1471 1.291-2.7919.652-.6466 1.557-.969 2.718-.969.65 0 1.205.1097 1.662.3275.429.1958.806.4878 1.105.8525.282.3545.488.763.607 1.2001.123.4508.186.9149.184 1.3808z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m579.86 20.5042c1.075.3849 2.055.9925 2.876 1.7843.801.7815 1.427 1.7384 1.877 2.8695.447 1.1309.674 2.4139.674 3.8469 0 .4491-.017.812-.059 1.0939-.024.2362-.098.4659-.215.6718-.096.1603-.245.2819-.421.346-.216.0692-.444.1012-.674.0946h-11.694l.042.3257c.223 1.4956.724 2.5928 1.504 3.2916.833.7495 1.909 1.1209 3.227 1.1209.703 0 1.309-.0811 1.818-.2482.466-.1486.92-.3343 1.358-.5553.399-.206.764-.3917 1.096-.5554.331-.1688.681-.2516 1.044-.2516.485 0 .848.1722 1.097.5183l1.76 2.1303-.272.2937c-.52.5485-1.11 1.0263-1.752 1.4229-.724.4423-1.466.7884-2.228 1.0365-.745.2464-1.512.4186-2.289.5182-.764.0945-1.489.1435-2.18.1435-1.363.0101-2.716-.2212-3.998-.6803-1.22-.4389-2.334-1.1276-3.268-2.0256-.932-.8946-1.667-2.0053-2.21-3.3372-.54-1.3317-.812-2.8796-.812-4.6436 0-1.3318.233-2.5911.696-3.7812.448-1.1663 1.125-2.2298 1.993-3.1278.896-.9132 1.967-1.6373 3.148-2.1285 1.231-.525 2.623-.7884 4.174-.7884l.002.0018c1.255-.0153 2.504.1923 3.686.6127zm-6.286 4.4614c-.652.6465-1.083 1.5766-1.291 2.7919h7.567c0-.4744-.061-.9318-.184-1.3808-.125-.4473-.326-.849-.606-1.2001-.283-.3528-.649-.6364-1.107-.8542-.456-.2161-1.009-.3241-1.662-.3241-1.161 0-2.067.3224-2.717.9673z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m627.868 22.6346c-.931-.8981-2.04-1.5901-3.255-2.034-1.265-.4727-2.666-.709-4.203-.709-1.553 0-2.965.2363-4.236.709-1.225.4439-2.343 1.1377-3.286 2.034-.932.9046-1.66 2.0019-2.13 3.2139-.502 1.2593-.752 2.6772-.752 4.2504 0 1.585.25 3.0148.752 4.2892.502 1.2711 1.213 2.3513 2.13 3.2426.943.9032 2.061 1.602 3.286 2.051 1.272.481 2.683.7207 4.236.7207 1.537 0 2.939-.2397 4.203-.7207 1.216-.449 2.326-1.1478 3.255-2.051.906-.8913 1.61-1.9715 2.112-3.2426.504-1.2728.754-2.7042.754-4.2892 0-1.5732-.25-2.9911-.754-4.2504-.468-1.2086-1.188-2.3041-2.112-3.2139zm-4.38 11.9054c-.657.9656-1.686 1.45-3.078 1.45-1.435 0-2.486-.4827-3.15-1.45-.665-.9655-.996-2.4324-.996-4.4022 0-1.97.331-3.4368.996-4.394.666-.9588 1.715-1.4398 3.15-1.4398 1.392 0 2.421.4793 3.078 1.4398.659.9572.986 2.424.986 4.394 0 1.9698-.327 3.4367-.986 4.4022z" fill-rule="evenodd"/><path d="m660.819 35.4633c.111.0827.225.2126.343.3916l1.838 2.8206-.297.2094c-.722.4793-1.511.8457-2.342 1.0853-.98.287-1.988.4322-3.032.4322-.965 0-1.815-.1385-2.553-.4119-.696-.2515-1.331-.6499-1.857-1.1716-.51-.5198-.902-1.1444-1.143-1.8314-.271-.7715-.403-1.5833-.392-2.3986v-10.285h-1.722l-.152-.0083c-.242-.0254-.468-.125-.649-.2888-.221-.1974-.331-.4895-.331-.8743v-2.3193l3.225-.6145 1.195-4.8563.044-.147c.187-.5148.614-.7731 1.283-.7731h3.17v5.8136h4.928v4.0664h-4.928v9.8831l.007.1943c.027.3729.14.6903.336.9485.226.2988.556.4508.985.4508.329.0066.657-.0693.949-.2212.112-.0574.215-.108.314-.1535.107-.0474.225-.0693.342-.0676.157-.0068.311.0371.439.1266z"/><path d="m603.364 19.8139.002.0001.002-.0001z"/><path d="m639.997 23.0936c.615-.8895 1.377-1.666 2.254-2.3006.924-.6517 1.936-.9791 3.03-.9791.926 0 1.668.2178 2.23.6533l-.78 4.3753-.037.1502c-.043.1654-.141.3122-.277.4153-.156.1097-.365.1637-.625.1637-.223 0-.484-.0304-.783-.0878-.299-.0573-.677-.0861-1.135-.0861-1.59 0-2.842.8304-3.754 2.4931v12.2043h-6.061v-19.8964h3.595l.216.005c.181.0051.361.0287.537.071.184.0438.358.1248.509.2396.14.1147.248.2633.312.4322.081.2126.144.4305.186.6532l.333 1.8585z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-light.svg b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-light.svg
new file mode 100644
index 0000000000000..c4e1a9cb1e828
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/gha-k8s-welcome-light.svg
@@ -0,0 +1 @@
+<svg fill="none" height="478" viewBox="0 0 1051 478" width="1051" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" gradientUnits="userSpaceOnUse" x1="66" x2="229" y1="166" y2="166"><stop offset="0" stop-color="#737373"/><stop offset="1"/></linearGradient><clipPath id="b"><path d="m0 0h1051v478h-1051z"/></clipPath><clipPath id="c"><path d="m903 100h110v110h-110z"/></clipPath><g clip-path="url(#b)"><path d="m175.124 322h-52.841c-.677 0-1.863.508-2.371 1.186l-24.7267 24.388c-.8468.338-1.1853 1.524-1.1853 2.371v73.503c0 5.589 4.742 10.331 10.839 10.331h70.624c5.928 0 10.67-4.742 10.67-10.331v-91.117c-.339-5.589-5.081-10.331-11.009-10.331z" fill="#512fc9"/><path clip-rule="evenodd" d="m127.422 378.281c0-7.058 5.867-12.8 13.078-12.801 7.211.001 13.079 5.743 13.079 12.801 0 7.057-5.867 12.798-13.079 12.798-7.211 0-13.078-5.741-13.078-12.798zm5.384 0c0 4.147 3.451 7.521 7.694 7.521s7.694-3.374 7.694-7.521c0-4.148-3.452-7.523-7.695-7.523-4.242 0-7.693 3.375-7.693 7.523z" fill="#fff" fill-rule="evenodd"/><path clip-rule="evenodd" d="m171.509 387.318-6.367-5.314.118-.721c.133-.974.177-1.992.177-2.997 0-1.249-.067-2.532-.295-3.718l6.367-5.306.141-.116c.169-.163.285-.377.328-.605.046-.231.015-.47-.082-.684-1.3-3.844-3.542-7.502-6.3-10.534-.39-.435-.941-.593-1.458-.372l-8.023 2.683-.666-.505c-1.826-1.331-3.83-2.411-5.955-3.21l-1.589-7.995-.046-.166c-.079-.226-.219-.424-.406-.577-.187-.154-.412-.254-.652-.289l-.003-.003c-4.158-.814-8.438-.814-12.596 0-.27.04-.52.161-.718.344-.197.186-.332.425-.386.689l-1.589 7.994-.721.281c-2.13.855-4.119 2.01-5.903 3.435l-8.02-2.686-.177-.055c-.234-.055-.48-.043-.708.033-.228.077-.428.216-.579.399-2.761 3.032-5 6.69-6.298 10.534-.111.241-.133.513-.062.769s.23.482.451.636l6.366 5.308-.12.721c-.133.975-.174 1.998-.174 2.995-.017 1.246.081 2.49.294 3.718l-6.363 5.314-.141.113c-.171.166-.286.377-.33.608s-.015.47.082.684c1.298 3.846 3.536 7.499 6.298 10.526.392.438.944.596 1.461.377l8.02-2.688.585.462c1.843 1.362 3.877 2.46 6.039 3.256l1.589 8 .043.165c.08.224.221.425.408.579.187.153.413.251.653.288 2.079.372 4.157.591 6.301.591 2.141 0 4.219-.219 6.298-.591.269-.042.519-.163.717-.346.197-.186.332-.425.387-.686l1.592-8 .794-.314c2.1-.869 4.067-2.015 5.827-3.404l8.02 2.688.174.058c.466.123.938-.045 1.287-.435 2.763-3.027 5-6.68 6.297-10.526.113-.242.133-.515.064-.772-.072-.256-.231-.48-.451-.633zm-31.009 9.688c-10.572 0-19.141-8.384-19.141-18.725 0-10.34 8.563-18.726 19.14-18.727 10.574.001 19.143 8.387 19.143 18.727 0 10.341-8.57 18.725-19.142 18.725z" fill="#fff" fill-rule="evenodd"/><path d="m105.641 450.627 5.364-.864v5.58h6.444v4.464h-6.444v6.66c0 1.128.192 2.028.576 2.7.408.672 1.212 1.008 2.412 1.008.576 0 1.164-.048 1.764-.144.624-.12 1.188-.276 1.692-.468l.756 4.176c-.648.264-1.368.492-2.16.684s-1.764.288-2.916.288c-1.464 0-2.676-.192-3.636-.576-.96-.408-1.728-.96-2.304-1.656-.576-.72-.984-1.584-1.224-2.592-.216-1.008-.324-2.124-.324-3.348zm27.912 14.04c0-3.456-1.272-5.184-3.816-5.184-.552 0-1.104.072-1.656.216-.528.144-.96.324-1.296.54v9.756c.264.048.6.096 1.008.144.408.024.852.036 1.332.036 1.464 0 2.568-.504 3.312-1.512s1.116-2.34 1.116-3.996zm5.472.144c0 1.512-.228 2.88-.684 4.104-.432 1.224-1.068 2.268-1.908 3.132s-1.872 1.536-3.096 2.016c-1.224.456-2.616.684-4.176.684-.648 0-1.332-.036-2.052-.108-.696-.048-1.392-.12-2.088-.216-.672-.096-1.32-.204-1.944-.324-.624-.144-1.176-.288-1.656-.432v-26.46l5.364-.864v9.432c.6-.264 1.224-.468 1.872-.612s1.344-.216 2.088-.216c1.344 0 2.532.24 3.564.72 1.032.456 1.896 1.116 2.592 1.98s1.224 1.908 1.584 3.132c.36 1.2.54 2.544.54 4.032zm21.439-.036c0 1.488-.216 2.856-.648 4.104-.432 1.224-1.056 2.28-1.872 3.168-.816.864-1.8 1.536-2.952 2.016-1.128.48-2.4.72-3.816.72-1.392 0-2.664-.24-3.816-.72-1.128-.48-2.1-1.152-2.916-2.016-.816-.888-1.452-1.944-1.908-3.168-.456-1.248-.684-2.616-.684-4.104s.228-2.844.684-4.068c.48-1.224 1.128-2.268 1.944-3.132.84-.864 1.824-1.536 2.952-2.016 1.152-.48 2.4-.72 3.744-.72 1.368 0 2.616.24 3.744.72 1.152.48 2.136 1.152 2.952 2.016s1.452 1.908 1.908 3.132.684 2.58.684 4.068zm-5.472 0c0-1.656-.336-2.952-1.008-3.888-.648-.96-1.584-1.44-2.808-1.44s-2.172.48-2.844 1.44c-.672.936-1.008 2.232-1.008 3.888s.336 2.976 1.008 3.96c.672.96 1.62 1.44 2.844 1.44s2.16-.48 2.808-1.44c.672-.984 1.008-2.304 1.008-3.96zm9.051-14.148 5.364-.864v5.58h6.444v4.464h-6.444v6.66c0 1.128.192 2.028.576 2.7.408.672 1.212 1.008 2.412 1.008.576 0 1.164-.048 1.764-.144.624-.12 1.188-.276 1.692-.468l.756 4.176c-.648.264-1.368.492-2.16.684s-1.764.288-2.916.288c-1.464 0-2.676-.192-3.636-.576-.96-.408-1.728-.96-2.304-1.656-.576-.72-.984-1.584-1.224-2.592-.216-1.008-.324-2.124-.324-3.348z" fill="#512fc9"/><g clip-path="url(#c)"><path clip-rule="evenodd" d="m957.739 101.736h.111c1.146 0 2.74.134 4.278.896l36.331 17.391.056.031c2.355 1.255 4.385 3.371 5.245 6.138l.04.107 9.1 39.179.02.163c.32 2.713-.32 5.485-1.96 7.789l-.05.071-25.124 31.075c-1.858 2.491-4.791 3.942-7.975 3.652h-39.92l-.087-.005c-2.788-.163-5.487-1.45-7.402-3.364l-.111-.111-25.259-31.247-.052-.071c-.82-1.138-1.403-2.428-1.716-3.795-.312-1.367-.347-2.783-.102-4.164l.014-.071 8.94-39.229.003-.009c.319-1.394.952-2.696 1.851-3.807.899-1.11 2.041-2.001 3.338-2.602l36.552-17.616.295-.074c1.313-.329 2.702-.327 3.585-.327" fill="#fff" fill-rule="evenodd"/><g fill="#326de6"><path d="m957.734 162.3 3.213-1.548.833-3.45-2.261-2.857h-3.569l-2.261 2.857.832 3.45zm23.083-1.785c.239-2.499.12-4.997-.475-7.496-.576-2.476-1.541-4.846-2.857-7.021l-8.922 8.092c-.24.238-.357.475-.477.832-.238 1.071.356 2.142 1.427 2.38zm-16.657-12.017 9.756-6.903c-3.57-3.569-8.21-5.83-13.444-6.424l.713 12.018c0 .356.12.595.356.832.596.833 1.786.952 2.619.477zm-9.4-13.446-2.381.475c-4.163.952-7.972 3.094-11.065 6.068l9.877 7.02.209.074c.252.091.458.165.742.165 1.07 0 2.023-.833 2.023-1.904zm-8.092 18.799-8.804-7.853c-2.598 4.377-3.802 9.44-3.451 14.517l11.542-3.332c.475-.119.713-.238.952-.596.713-.832.596-2.024-.239-2.736zm.952 10.233-11.779 2.023c1.665 4.759 4.996 8.924 9.162 11.662l4.522-10.949c.237-.355.237-.832.118-1.19-.119-.95-1.069-1.546-2.023-1.546zm10.114 17.373c1.785 0 3.451-.239 5.117-.596.744-.202 1.499-.361 2.261-.475l-5.713-10.353c-.356-.357-.594-.595-.951-.832-.833-.477-1.785-.239-2.379.475l-5.83 10.59c2.379.714 4.996 1.191 7.495 1.191zm12.494-3.808c2.885-1.815 5.324-4.255 7.14-7.139.951-1.309 1.665-2.857 2.261-4.522l-11.9-2.023c-.356 0-.714.119-1.07.238-.834.358-1.31 1.31-1.072 2.262z"/><path clip-rule="evenodd" d="m997.119 122.677c1.784.952 3.211 2.499 3.811 4.403l9.04 38.908c.24 2.023-.24 4.045-1.43 5.712l-25.106 31.055c-1.307 1.785-3.33 2.737-5.472 2.498h-39.979c-2.024-.119-4.045-1.069-5.474-2.498l-25.106-31.056c-.591-.816-1.012-1.742-1.237-2.723-.225-.982-.249-1.998-.072-2.99l8.924-39.143c.216-.959.65-1.856 1.269-2.619.62-.764 1.407-1.374 2.301-1.784l36.291-17.49c.952-.238 2.023-.238 2.974-.238.952 0 2.023.119 2.975.596zm-2.025 41.646c0 .119.12.119.239.119 1.069.238 2.023 1.19 2.142 2.498-.184.484-.509.902-.934 1.199-.424.297-.929.459-1.447.466-.238 0-.357 0-.595-.118-.068-.069-.097-.098-.132-.11-.026-.009-.055-.009-.107-.009-.137 0-.237-.041-.317-.075-.05-.024-.103-.039-.158-.044-.351-.089-.64-.241-.959-.413-.111-.061-.227-.122-.349-.183-.238 0-.476-.118-.715-.237h-.119c-1.23-.483-2.505-.841-3.807-1.071h-.119c-.352-.01-.693.118-.952.356 0 0 0 .119-.119.119l-.952-.119c-2.142 6.784-6.782 12.494-12.849 16.182l.356.954s-.119 0-.119.117c-.238.358-.238.835-.119 1.192.475 1.189 1.07 2.379 1.904 3.45v.237c.238.238.357.357.476.595.356.358.595.714.833 1.191.119.119.237.238.237.356 0 0 .119 0 .119.119.238.596.238 1.191.119 1.786-.119.594-.596 1.069-1.069 1.308l-.211.073c-.252.092-.458.165-.743.165-.951 0-1.784-.596-2.261-1.429-.117 0-.117-.119-.117-.119-.05-.051-.091-.111-.12-.177-.028-.066-.069-.127-.119-.179-.238-.357-.357-.832-.476-1.309l-.237-.714v-.119c-.358-1.309-.952-2.499-1.548-3.688-.229-.337-.564-.589-.952-.715 0-.119 0-.119-.119-.119l-.475-.833c-.304.092-.615.189-.93.291-.926.293-1.902.603-2.879.78-2.14.596-4.282.833-6.424.833-3.57 0-7.02-.594-10.352-1.904l-.475.952c0 .061 0 .09-.016.104-.015.014-.045.015-.104.015-.388.126-.722.378-.951.715-.596 1.189-1.192 2.379-1.548 3.688l-.238.714c-.063.224-.142.442-.237.654-.096.212-.176.431-.238.655-.12.119-.239.239-.239.356-.119 0-.119.119-.119.119-.475.835-1.309 1.429-2.261 1.429-.237 0-.594-.119-.833-.238-1.069-.596-1.546-2.023-.952-3.213.12 0 .12-.118.12-.118.05-.052.09-.113.119-.179s.069-.126.119-.179c.156-.209.29-.417.411-.606.154-.241.287-.449.422-.584.238-.238.357-.357.475-.596v-.117c.715-1.071 1.428-2.261 1.905-3.451.119-.356.119-.833-.119-1.191 0 0-.119 0-.119-.119l.595-.832c-1.191-.596-2.143-1.308-3.214-2.141-4.64-3.57-7.972-8.448-9.756-13.922l-1.07.119s0-.119-.121-.119c-.258-.239-.6-.367-.951-.356h-.12c-1.426.236-2.617.594-3.926 1.069h-.119c-.237 0-.475.119-.714.238-.132.046-.282.107-.443.172-.28.123-.57.225-.866.305-.052-.005-.104-.013-.156-.023-.145-.027-.321-.061-.321.023 0 .06 0 .089-.013.104-.016.015-.046.015-.104.015-.239.119-.358.119-.596.119-1.069.12-2.14-.595-2.379-1.665-.059-.305-.057-.619.007-.924.064-.304.188-.592.366-.848.177-.255.404-.472.667-.638s.557-.277.864-.328c.119-.119.119-.119.238-.119.111-.001.22-.027.319-.075.059-.023.107-.044.156-.044.239 0 .477-.031.715-.06.237-.03.475-.059.714-.059.238-.119.476-.119.713-.119 1.368-.112 2.722-.351 4.046-.714.357-.238.713-.475.832-.832 0 0 .12 0 .12-.12l.951-.238c-1.069-6.782.477-13.683 4.165-19.513.061-.119.119-.209.179-.298.065-.095.125-.195.179-.298l-.691-.69c.054-.342-.163-.758-.382-.975-.95-.952-2.14-1.665-3.33-2.38l-.714-.356c-.449-.215-.886-.453-1.309-.715-.119 0-.356-.237-.356-.237s0-.119-.119-.119c-.952-.834-1.192-2.261-.477-3.332.358-.596.952-.833 1.665-.833.596 0 1.192.239 1.666.596l.12.118c.052.05.113.09.179.119.06.03.119.059.177.119.179.179.329.356.477.535s.298.357.477.534c.036.036.081.074.132.114.12.09.26.198.343.363.832.952 1.903 1.904 2.974 2.738.239.119.477.237.714.237.111-.002.22-.027.321-.075.049-.024.101-.039.155-.044h.12l.713.476c3.926-4.164 9.045-7.139 14.636-8.329l.611-.103c1.193-.201 2.315-.389 3.433-.492l.119-.951v-.239c.358-.238.477-.595.596-.951 0-1.429 0-2.737-.238-4.046v-.119c0-.239 0-.475-.119-.714-.119-.476-.239-.951-.239-1.428v-.596c0-.594.239-1.189.715-1.665.596-.595 1.308-.952 2.023-.833 1.19.119 2.142 1.309 2.023 2.5v.713c-.061.238-.09.477-.119.714-.029.236-.061.476-.119.715 0 .119-.031.236-.06.355-.034.117-.054.237-.06.358v.119c-.238 1.427-.238 2.736-.238 4.046.119.357.238.713.596.952v-.12l.119.952c5.592.596 11.066 2.736 15.467 6.188.477.476.983.951 1.488 1.427.506.475 1.012.953 1.487 1.428l.952-.596h.119c.119.121.357.121.477.121.238 0 .475-.119.713-.238 1.099-.743 2.099-1.623 2.975-2.619.037-.035.082-.072.134-.112.118-.09.26-.198.342-.363.237-.358.595-.714.952-1.071.118 0 .237-.119.356-.238l.119-.12c.477-.356 1.071-.595 1.665-.595.595 0 1.31.359 1.666.834.834 1.071.596 2.499-.474 3.33 0 .046.015.075.031.1.024.038.042.065-.031.139-.052.05-.112.09-.179.119-.066.029-.126.069-.178.119-.239.119-.446.238-.656.357-.208.12-.415.239-.654.358l-.713.356c-1.192.715-2.261 1.428-3.332 2.38-.239.239-.358.714-.358 1.07v.12l-.713.714c1.917 3 3.325 6.296 4.165 9.756.713 3.451.951 7.02.475 10.472l.953.238c.072.19.184.362.327.505.144.144.316.255.506.328 1.307.356 2.736.595 4.045.713h.119c.237.119.476.119.714.119.475 0 .952 0 1.427.119.238 0 .476 0 .476.12zm-62.088-23.299-.022-.023v.119c.01-.031.018-.063.023-.096" fill-rule="evenodd"/></g></g><path d="m615.161 106h-104.43c-2.204 0-3.731 1.525-3.731 3.729v14.92c0 2.204 1.527 3.729 3.731 3.729h104.43c2.204 0 3.729-1.525 3.729-3.729v-14.92c0-2.204-1.525-3.729-3.729-3.729zm-22.379 14.918c-2.204 0-3.729-1.525-3.729-3.729s1.525-3.729 3.729-3.729 3.731 1.525 3.731 3.729-1.527 3.729-3.731 3.729zm18.649 0h-7.459c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.729 3.73-3.729h7.459c2.204 0 3.73 1.525 3.73 3.729s-1.526 3.729-3.73 3.729z" fill="#512fc9"/><path d="m615.161 143.297h-104.43c-2.204 0-3.731 1.525-3.731 3.729v14.918c0 2.204 1.527 3.731 3.731 3.731h48.484v15.597c-3.39 1.186-5.594 3.729-6.611 6.781h-30.685c-2.203 0-3.73 1.525-3.73 3.729s1.527 3.73 3.73 3.73h30.685c1.356 4.408 5.595 7.459 10.342 7.459s8.984-3.051 10.34-7.459h30.686c2.204 0 3.73-1.526 3.73-3.73s-1.526-3.729-3.73-3.729h-30.686c-1.017-3.391-3.559-5.595-6.611-6.781v-15.597h48.486c2.204 0 3.729-1.527 3.729-3.731v-14.918c0-2.204-1.525-3.729-3.729-3.729zm-89.512 14.918c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731 3.729 1.527 3.729 3.731-1.525 3.729-3.729 3.729zm11.189 0c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731c2.203 0 3.729 1.527 3.729 3.731s-1.526 3.729-3.729 3.729zm11.188 0c-2.203 0-3.729-1.525-3.729-3.729s1.526-3.731 3.729-3.731c2.204 0 3.731 1.527 3.731 3.731s-1.527 3.729-3.731 3.729zm7.46-3.729c0-2.204 1.525-3.731 3.729-3.731s3.731 1.527 3.731 3.731-1.527 3.729-3.731 3.729-3.729-1.525-3.729-3.729zm37.296 3.729c-2.204 0-3.729-1.525-3.729-3.729s1.525-3.731 3.729-3.731 3.731 1.527 3.731 3.731-1.527 3.729-3.731 3.729zm18.649 0h-7.459c-2.204 0-3.73-1.525-3.73-3.729s1.526-3.731 3.73-3.731h7.459c2.204 0 3.73 1.527 3.73 3.731s-1.526 3.729-3.73 3.729z" fill="#512fc9"/><path d="m23.9999 3c-13.2577 0-23.9999 10.9892-23.9999 24.6047 0 10.8509 6.86683 20.1121 16.4532 23.3605 1.1558.2073 1.6318-.5528 1.6318-1.1749 0-.5529-.0681-2.5573-.0681-4.5616-6.6628 1.4514-8.09061-2.9718-8.09061-2.9718-1.01982-2.8337-2.6515-3.5249-2.6515-3.5249-2.17562-1.5206.13597-1.5205.13597-1.5205 2.44758.1382 3.73924 2.4882 3.73924 2.4882 2.1757 3.8012 5.6431 2.6953 7.0029 2.0733.2039-1.5896.8158-2.6955 1.4957-3.3175-5.3711-.5529-10.94604-2.6954-10.94604-12.095 0-2.7646.9518-4.9071 2.51554-6.635-.272-.622-1.1558-3.1101.204-6.5658 0 0 2.0396-.622 6.5948 2.5572 2.0397-.5529 3.8754-.8293 5.983-.8293s4.1473.2764 6.0509.8293c4.5552-3.1792 6.5948-2.5572 6.5948-2.5572 1.2918 3.4557.476 5.9438.204 6.5658 1.5638 1.7279 2.4477 3.8704 2.4477 6.635 0 9.3996-5.5071 11.473-10.9462 12.095.8839.7603 1.6318 2.2118 1.6318 4.5616v6.7732c0 .6221.4079 1.3822 1.6317 1.1749 9.5183-3.2484 16.3851-12.5096 16.3851-23.3605.068-13.6155-10.7421-24.6047-23.9998-24.6047z" fill="#24292f"/><path d="m78.324 27.724h3.492v11.664c-.288.096-.708.204-1.26.324-.528.12-1.152.24-1.872.36-.696.12-1.464.216-2.304.288-.84.096-1.692.144-2.556.144-1.752 0-3.348-.288-4.788-.864s-2.676-1.416-3.708-2.52-1.836-2.46-2.412-4.068c-.552-1.608-.828-3.456-.828-5.544s.312-3.936.936-5.544c.648-1.632 1.512-3 2.592-4.104s2.34-1.944 3.78-2.52c1.464-.576 3.024-.864 4.68-.864 1.128 0 2.124.072 2.988.216.888.144 1.644.312 2.268.504s1.128.384 1.512.576c.408.192.684.336.828.432l-1.116 2.916c-.696-.456-1.62-.828-2.772-1.116-1.152-.312-2.328-.468-3.528-.468-1.272 0-2.436.228-3.492.684-1.032.456-1.92 1.116-2.664 1.98-.72.864-1.284 1.92-1.692 3.168-.408 1.224-.612 2.604-.612 4.14 0 1.488.168 2.844.504 4.068.36 1.224.888 2.28 1.584 3.168.72.864 1.596 1.536 2.628 2.016 1.056.48 2.292.72 3.708.72 1.008 0 1.86-.048 2.556-.144.72-.12 1.236-.228 1.548-.324zm11.6955 12.276h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm10.1855 3.384h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm26.868-6.228h3.492v24.948h-3.492v-11.52h-12.204v11.52h-3.492v-24.948h3.492v10.404h12.204zm23.979 24.408c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.72-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm42.275 2.916c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm17.546 9.684c-1.512 0-2.844-.24-3.996-.72-1.128-.48-2.088-1.152-2.88-2.016-.768-.864-1.344-1.884-1.728-3.06-.384-1.2-.576-2.52-.576-3.96s.204-2.76.612-3.96c.432-1.2 1.032-2.232 1.8-3.096.768-.888 1.704-1.572 2.808-2.052 1.128-.504 2.376-.756 3.744-.756.84 0 1.68.072 2.52.216s1.644.372 2.412.684l-.756 2.844c-.504-.24-1.092-.432-1.764-.576-.648-.144-1.344-.216-2.088-.216-1.872 0-3.312.588-4.32 1.764-.984 1.176-1.476 2.892-1.476 5.148 0 1.008.108 1.932.324 2.772.24.84.6 1.56 1.08 2.16.504.6 1.14 1.068 1.908 1.404.768.312 1.704.468 2.808.468.888 0 1.692-.084 2.412-.252s1.284-.348 1.692-.54l.468 2.808c-.192.12-.468.24-.828.36-.36.096-.768.18-1.224.252-.456.096-.948.168-1.476.216-.504.072-.996.108-1.476.108zm11.335-19.152h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm14.304 18.72h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm23.578 12.744c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm7.806-8.82c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm24.632 15.768c1.368 0 2.376-.18 3.024-.54.672-.36 1.008-.936 1.008-1.728 0-.816-.324-1.464-.972-1.944s-1.716-1.02-3.204-1.62c-.72-.288-1.416-.576-2.088-.864-.648-.312-1.212-.672-1.692-1.08s-.864-.9-1.152-1.476-.432-1.284-.432-2.124c0-1.656.612-2.964 1.836-3.924 1.224-.984 2.892-1.476 5.004-1.476.528 0 1.056.036 1.584.108.528.048 1.02.12 1.476.216.456.072.852.156 1.188.252.36.096.636.18.828.252l-.612 2.88c-.36-.192-.924-.384-1.692-.576-.768-.216-1.692-.324-2.772-.324-.936 0-1.752.192-2.448.576-.696.36-1.044.936-1.044 1.728 0 .408.072.768.216 1.08.168.312.408.6.72.864.336.24.744.468 1.224.684s1.056.444 1.728.684c.888.336 1.68.672 2.376 1.008.696.312 1.284.684 1.764 1.116.504.432.888.96 1.152 1.584.264.6.396 1.344.396 2.232 0 1.728-.648 3.036-1.944 3.924-1.272.888-3.096 1.332-5.472 1.332-1.656 0-2.952-.144-3.888-.432-.936-.264-1.572-.468-1.908-.612l.612-2.88c.384.144.996.36 1.836.648s1.956.432 3.348.432z" fill="#000"/><path d="m886.776 226.052c-.744.816-1.584 1.728-2.52 2.736-.936.984-1.92 2.004-2.952 3.06-1.008 1.032-2.016 2.052-3.024 3.06s-1.956 1.944-2.844 2.808c1.032.72 2.124 1.608 3.276 2.664s2.28 2.184 3.384 3.384 2.136 2.424 3.096 3.672c.984 1.248 1.8 2.436 2.448 3.564h-4.104c-.72-1.128-1.548-2.256-2.484-3.384-.936-1.152-1.932-2.244-2.988-3.276-1.032-1.056-2.088-2.028-3.168-2.916-1.056-.888-2.088-1.644-3.096-2.268v11.844h-3.492v-24.948h3.492v11.016c.84-.792 1.764-1.68 2.772-2.664 1.008-1.008 2.004-2.016 2.988-3.024s1.908-1.968 2.772-2.88c.888-.936 1.632-1.752 2.232-2.448zm18.007 24.408c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.72-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm16.411-6.408c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm14.818-7.956c.288 0 .612.024.972.072.384.024.756.072 1.116.144.36.048.684.108.972.18.312.048.54.096.684.144l-.576 2.916c-.264-.096-.708-.204-1.332-.324-.6-.144-1.38-.216-2.34-.216-.624 0-1.248.072-1.872.216-.6.12-.996.204-1.188.252v15.732h-3.348v-17.928c.792-.288 1.776-.552 2.952-.792 1.176-.264 2.496-.396 3.96-.396zm6.578.936c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm19.232 8.856c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm11.034-7.56h7.1v2.808h-7.1v8.64c0 .936.08 1.716.22 2.34.14.6.36 1.08.65 1.44.29.336.65.576 1.08.72s.93.216 1.51.216c1.01 0 1.81-.108 2.41-.324.63-.24 1.06-.408 1.3-.504l.65 2.772c-.34.168-.93.372-1.77.612-.84.264-1.8.396-2.88.396-1.27 0-2.33-.156-3.17-.468-.81-.336-1.47-.828-1.98-1.476-.5-.648-.86-1.44-1.08-2.376-.19-.96-.28-2.064-.28-3.312v-16.704l3.34-.576zm9.56 9.396c0-1.656.24-3.096.72-4.32.48-1.248 1.12-2.28 1.91-3.096s1.71-1.428 2.74-1.836 2.09-.612 3.17-.612c2.52 0 4.45.792 5.79 2.376 1.35 1.56 2.02 3.948 2.02 7.164v.576c0 .216-.01.42-.04.612h-12.81c.14 1.944.7 3.42 1.69 4.428.98 1.008 2.52 1.512 4.61 1.512 1.17 0 2.16-.096 2.95-.288.81-.216 1.43-.42 1.83-.612l.47 2.808c-.41.216-1.13.444-2.16.684-1.01.24-2.16.36-3.45.36-1.64 0-3.05-.24-4.25-.72-1.18-.504-2.15-1.188-2.92-2.052s-1.34-1.884-1.73-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.86-1.836c.02-1.512-.36-2.748-1.16-3.708-.76-.984-1.83-1.476-3.2-1.476-.77 0-1.45.156-2.05.468-.58.288-1.07.672-1.48 1.152s-.73 1.032-.97 1.656c-.22.624-.36 1.26-.43 1.908zm12.26 8.748c1.37 0 2.37-.18 3.02-.54.67-.36 1.01-.936 1.01-1.728 0-.816-.32-1.464-.97-1.944s-1.72-1.02-3.21-1.62c-.72-.288-1.41-.576-2.08-.864-.65-.312-1.22-.672-1.7-1.08s-.86-.9-1.15-1.476-.43-1.284-.43-2.124c0-1.656.61-2.964 1.84-3.924 1.22-.984 2.89-1.476 5-1.476.53 0 1.06.036 1.58.108.53.048 1.02.12 1.48.216.46.072.85.156 1.19.252.36.096.63.18.83.252l-.62 2.88c-.36-.192-.92-.384-1.69-.576-.77-.216-1.69-.324-2.77-.324-.94 0-1.75.192-2.45.576-.69.36-1.04.936-1.04 1.728 0 .408.07.768.21 1.08.17.312.41.6.72.864.34.24.75.468 1.23.684s1.05.444 1.73.684c.88.336 1.68.672 2.37 1.008.7.312 1.29.684 1.77 1.116.5.432.88.96 1.15 1.584.26.6.39 1.344.39 2.232 0 1.728-.64 3.036-1.94 3.924-1.27.888-3.1 1.332-5.47 1.332-1.66 0-2.95-.144-3.89-.432-.94-.264-1.57-.468-1.91-.612l.61-2.88c.39.144 1 .36 1.84.648s1.96.432 3.35.432z" fill="#000"/><path d="m506.108 251c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm16.707-15.948c3.504 0 6.192.672 8.064 2.016 1.896 1.32 2.844 3.3 2.844 5.94 0 1.44-.264 2.676-.792 3.708-.504 1.008-1.248 1.836-2.232 2.484-.96.624-2.136 1.08-3.528 1.368s-2.964.432-4.716.432h-2.772v9.252h-3.492v-24.588c.984-.24 2.076-.396 3.276-.468 1.224-.096 2.34-.144 3.348-.144zm.288 3.06c-1.488 0-2.628.036-3.42.108v9.792h2.628c1.2 0 2.28-.072 3.24-.216.96-.168 1.764-.432 2.412-.792.672-.384 1.188-.9 1.548-1.548s.54-1.476.54-2.484c0-.96-.192-1.752-.576-2.376-.36-.624-.864-1.116-1.512-1.476-.624-.384-1.356-.648-2.196-.792s-1.728-.216-2.664-.216zm14.594-2.808h3.492v24.948h-3.492zm23.832-.252c3.504 0 6.192.672 8.064 2.016 1.896 1.32 2.844 3.3 2.844 5.94 0 1.44-.264 2.676-.792 3.708-.504 1.008-1.248 1.836-2.232 2.484-.96.624-2.136 1.08-3.528 1.368s-2.964.432-4.716.432h-2.772v9.252h-3.492v-24.588c.984-.24 2.076-.396 3.276-.468 1.224-.096 2.34-.144 3.348-.144zm.288 3.06c-1.488 0-2.628.036-3.42.108v9.792h2.628c1.2 0 2.28-.072 3.24-.216.96-.168 1.764-.432 2.412-.792.672-.384 1.188-.9 1.548-1.548s.54-1.476.54-2.484c0-.96-.192-1.752-.576-2.376-.36-.624-.864-1.116-1.512-1.476-.624-.384-1.356-.648-2.196-.792s-1.728-.216-2.664-.216zm21.291 3.024c.288 0 .612.024.972.072.384.024.756.072 1.116.144.36.048.684.108.972.18.312.048.54.096.684.144l-.576 2.916c-.264-.096-.708-.204-1.332-.324-.6-.144-1.38-.216-2.34-.216-.624 0-1.248.072-1.872.216-.6.12-.996.204-1.188.252v15.732h-3.348v-17.928c.792-.288 1.776-.552 2.952-.792 1.176-.264 2.496-.396 3.96-.396zm23.102 9.756c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm18.405 9.36c-.264-.528-.588-1.116-.972-1.764s-.804-1.308-1.26-1.98c-.456-.696-.924-1.38-1.404-2.052s-.948-1.308-1.404-1.908c-.456.6-.924 1.248-1.404 1.944-.48.672-.948 1.356-1.404 2.052-.432.672-.84 1.332-1.224 1.98s-.708 1.224-.972 1.728h-3.456c.84-1.632 1.836-3.288 2.988-4.968 1.176-1.704 2.34-3.324 3.492-4.86l-6.192-8.892h3.78l4.464 6.552 4.5-6.552h3.564l-6.048 8.676c1.152 1.56 2.328 3.216 3.528 4.968 1.224 1.728 2.256 3.42 3.096 5.076zm4.599 3.492c.264.12.6.228 1.008.324.432.12.852.18 1.26.18 1.32 0 2.352-.3 3.096-.9.744-.576 1.416-1.524 2.016-2.844-1.512-2.88-2.928-5.928-4.248-9.144-1.296-3.24-2.376-6.516-3.24-9.828h3.6c.264 1.08.576 2.244.936 3.492.384 1.248.804 2.532 1.26 3.852s.948 2.64 1.476 3.96 1.08 2.592 1.656 3.816c.912-2.52 1.704-5.016 2.376-7.488s1.308-5.016 1.908-7.632h3.456c-.864 3.528-1.824 6.924-2.88 10.188-1.056 3.24-2.196 6.276-3.42 9.108-.48 1.08-.984 2.004-1.512 2.772-.504.792-1.068 1.44-1.692 1.944s-1.332.876-2.124 1.116c-.768.24-1.644.36-2.628.36-.264 0-.54-.024-.828-.072-.288-.024-.576-.072-.864-.144-.264-.048-.516-.108-.756-.18-.216-.072-.372-.132-.468-.18z" fill="#000"/><path d="m166.773 267.704c.72.552 1.476 1.236 2.268 2.052.816.816 1.608 1.704 2.376 2.664.792.936 1.536 1.896 2.232 2.88.696.96 1.284 1.86 1.764 2.7h-3.924c-.504-.84-1.092-1.692-1.764-2.556-.648-.888-1.332-1.728-2.052-2.52-.72-.816-1.452-1.56-2.196-2.232s-1.452-1.236-2.124-1.692v9h-3.348v-27.36l3.348-.576v17.064l1.908-1.908c.696-.696 1.38-1.404 2.052-2.124s1.308-1.404 1.908-2.052c.6-.672 1.116-1.26 1.548-1.764h3.924c-.552.6-1.152 1.26-1.8 1.98s-1.32 1.452-2.016 2.196c-.696.72-1.404 1.452-2.124 2.196-.696.72-1.356 1.404-1.98 2.052zm26.549 9.756c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.719-17.352c.408-.264 1.02-.54 1.836-.828.84-.288 1.8-.432 2.88-.432 1.344 0 2.532.24 3.564.72 1.056.48 1.944 1.152 2.664 2.016s1.26 1.896 1.62 3.096c.384 1.2.576 2.52.576 3.96 0 1.512-.228 2.88-.684 4.104-.432 1.2-1.056 2.22-1.872 3.06s-1.8 1.488-2.952 1.944-2.448.684-3.888.684c-1.56 0-2.94-.108-4.14-.324s-2.184-.432-2.952-.648v-26.82l3.348-.576zm0 14.976c.336.096.804.192 1.404.288.624.072 1.392.108 2.304.108 1.8 0 3.24-.588 4.32-1.764 1.08-1.2 1.62-2.892 1.62-5.076 0-.96-.096-1.86-.288-2.7s-.504-1.56-.936-2.16c-.432-.624-.996-1.104-1.692-1.44-.672-.36-1.488-.54-2.448-.54-.912 0-1.752.156-2.52.468s-1.356.636-1.764.972zm16.412-6.408c0-1.656.24-3.096.72-4.32.48-1.248 1.116-2.28 1.908-3.096s1.704-1.428 2.736-1.836 2.088-.612 3.168-.612c2.52 0 4.452.792 5.796 2.376 1.344 1.56 2.016 3.948 2.016 7.164v.576c0 .216-.012.42-.036.612h-12.816c.144 1.944.708 3.42 1.692 4.428s2.52 1.512 4.608 1.512c1.176 0 2.16-.096 2.952-.288.816-.216 1.428-.42 1.836-.612l.468 2.808c-.408.216-1.128.444-2.16.684-1.008.24-2.16.36-3.456.36-1.632 0-3.048-.24-4.248-.72-1.176-.504-2.148-1.188-2.916-2.052s-1.344-1.884-1.728-3.06c-.36-1.2-.54-2.508-.54-3.924zm12.852-1.836c.024-1.512-.36-2.748-1.152-3.708-.768-.984-1.836-1.476-3.204-1.476-.768 0-1.452.156-2.052.468-.576.288-1.068.672-1.476 1.152s-.732 1.032-.972 1.656c-.216.624-.36 1.26-.432 1.908zm16.041 11.592c-1.512 0-2.844-.24-3.996-.72-1.128-.48-2.088-1.152-2.88-2.016-.768-.864-1.344-1.884-1.728-3.06-.384-1.2-.576-2.52-.576-3.96s.204-2.76.612-3.96c.432-1.2 1.032-2.232 1.8-3.096.768-.888 1.704-1.572 2.808-2.052 1.128-.504 2.376-.756 3.744-.756.84 0 1.68.072 2.52.216s1.644.372 2.412.684l-.756 2.844c-.504-.24-1.092-.432-1.764-.576-.648-.144-1.344-.216-2.088-.216-1.872 0-3.312.588-4.32 1.764-.984 1.176-1.476 2.892-1.476 5.148 0 1.008.108 1.932.324 2.772.24.84.6 1.56 1.08 2.16.504.6 1.14 1.068 1.908 1.404.768.312 1.704.468 2.808.468.888 0 1.692-.084 2.412-.252s1.284-.348 1.692-.54l.468 2.808c-.192.12-.468.24-.828.36-.36.096-.768.18-1.224.252-.456.096-.948.168-1.476.216-.504.072-.996.108-1.476.108zm24.269-9.792c0 1.488-.216 2.832-.648 4.032s-1.044 2.232-1.836 3.096c-.768.864-1.692 1.536-2.772 2.016-1.08.456-2.256.684-3.528.684s-2.448-.228-3.528-.684c-1.08-.48-2.016-1.152-2.808-2.016-.768-.864-1.368-1.896-1.8-3.096s-.648-2.544-.648-4.032c0-1.464.216-2.796.648-3.996.432-1.224 1.032-2.268 1.8-3.132.792-.864 1.728-1.524 2.808-1.98 1.08-.48 2.256-.72 3.528-.72s2.448.24 3.528.72c1.08.456 2.004 1.116 2.772 1.98.792.864 1.404 1.908 1.836 3.132.432 1.2.648 2.532.648 3.996zm-3.492 0c0-2.112-.48-3.78-1.44-5.004-.936-1.248-2.22-1.872-3.852-1.872s-2.928.624-3.888 1.872c-.936 1.224-1.404 2.892-1.404 5.004s.468 3.792 1.404 5.04c.96 1.224 2.256 1.836 3.888 1.836s2.916-.612 3.852-1.836c.96-1.248 1.44-2.928 1.44-5.04zm7.807-8.82c.768-.192 1.788-.396 3.06-.612s2.736-.324 4.392-.324c1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.012-1.116.036s-.756.06-1.116.108c-.336.024-.648.06-.936.108-.264.048-.456.084-.576.108v15.804h-3.348zm27.584-9.756c.84 0 1.56.06 2.16.18.6.096 1.032.192 1.296.288l-.468 2.88c-.264-.096-.624-.192-1.08-.288-.456-.12-1.008-.18-1.656-.18-1.56 0-2.652.432-3.276 1.296-.624.84-.936 1.98-.936 3.42v1.62h7.2v2.808h-7.2v15.912h-3.348v-20.412c0-2.4.588-4.248 1.764-5.544 1.176-1.32 3.024-1.98 5.544-1.98zm10.08 27.936h-3.348v-18.72h3.348zm-1.692-22.104c-.6 0-1.116-.192-1.548-.576-.408-.408-.612-.948-.612-1.62s.204-1.2.612-1.584c.432-.408.948-.612 1.548-.612s1.104.204 1.512.612c.432.384.648.912.648 1.584s-.216 1.212-.648 1.62c-.408.384-.912.576-1.512.576zm18.776 20.232c-.288.192-.852.444-1.692.756-.816.288-1.776.432-2.88.432-1.128 0-2.196-.18-3.204-.54-.984-.36-1.848-.912-2.592-1.656-.744-.768-1.332-1.716-1.764-2.844s-.648-2.472-.648-4.032c0-1.368.204-2.616.612-3.744.408-1.152.996-2.136 1.764-2.952.792-.84 1.752-1.488 2.88-1.944 1.128-.48 2.4-.72 3.816-.72 1.56 0 2.916.12 4.068.36 1.176.216 2.16.42 2.952.612v16.704c0 2.88-.744 4.968-2.232 6.264s-3.744 1.944-6.768 1.944c-1.176 0-2.292-.096-3.348-.288-1.032-.192-1.932-.42-2.7-.684l.612-2.916c.672.264 1.488.492 2.448.684.984.216 2.004.324 3.06.324 1.992 0 3.42-.396 4.284-1.188.888-.792 1.332-2.052 1.332-3.78zm-.036-13.896c-.336-.096-.792-.18-1.368-.252-.552-.096-1.308-.144-2.268-.144-1.8 0-3.192.588-4.176 1.764-.96 1.176-1.44 2.736-1.44 4.68 0 1.08.132 2.004.396 2.772.288.768.66 1.404 1.116 1.908.48.504 1.02.876 1.62 1.116.624.24 1.26.36 1.908.36.888 0 1.704-.12 2.448-.36.744-.264 1.332-.564 1.764-.9z" fill="#000"/><path d="m548.825 473c-.408-1.08-.792-2.136-1.152-3.168-.36-1.056-.732-2.124-1.116-3.204h-11.304l-2.268 6.372h-3.636c.96-2.64 1.86-5.076 2.7-7.308.84-2.256 1.656-4.392 2.448-6.408.816-2.016 1.62-3.936 2.412-5.76.792-1.848 1.62-3.672 2.484-5.472h3.204c.864 1.8 1.692 3.624 2.484 5.472.792 1.824 1.584 3.744 2.376 5.76.816 2.016 1.644 4.152 2.484 6.408.84 2.232 1.74 4.668 2.7 7.308zm-3.276-9.252c-.768-2.088-1.536-4.104-2.304-6.048-.744-1.968-1.524-3.852-2.34-5.652-.84 1.8-1.644 3.684-2.412 5.652-.744 1.944-1.488 3.96-2.232 6.048zm24.244 8.712c-.768.192-1.788.396-3.06.612-1.248.216-2.7.324-4.356.324-1.44 0-2.652-.204-3.636-.612-.984-.432-1.776-1.032-2.376-1.8s-1.032-1.668-1.296-2.7c-.264-1.056-.396-2.22-.396-3.492v-10.512h3.348v9.792c0 2.28.36 3.912 1.08 4.896s1.932 1.476 3.636 1.476c.36 0 .732-.012 1.116-.036s.744-.048 1.08-.072c.336-.048.636-.084.9-.108.288-.048.492-.096.612-.144v-15.804h3.348zm8.503-18.18h7.092v2.808h-7.092v8.64c0 .936.072 1.716.216 2.34.144.6.36 1.08.648 1.44.288.336.648.576 1.08.72s.936.216 1.512.216c1.008 0 1.812-.108 2.412-.324.624-.24 1.056-.408 1.296-.504l.648 2.772c-.336.168-.924.372-1.764.612-.84.264-1.8.396-2.88.396-1.272 0-2.328-.156-3.168-.468-.816-.336-1.476-.828-1.98-1.476s-.864-1.44-1.08-2.376c-.192-.96-.288-2.064-.288-3.312v-16.704l3.348-.576zm10.957 18.72v-27.36l3.348-.576v9.576c.624-.24 1.284-.42 1.98-.54.72-.144 1.428-.216 2.124-.216 1.488 0 2.724.216 3.708.648.984.408 1.764.996 2.34 1.764.6.744 1.02 1.644 1.26 2.7s.36 2.22.36 3.492v10.512h-3.348v-9.792c0-1.152-.084-2.136-.252-2.952-.144-.816-.396-1.476-.756-1.98s-.84-.864-1.44-1.08c-.6-.24-1.344-.36-2.232-.36-.36 0-.732.024-1.116.072s-.756.108-1.116.18c-.336.048-.648.108-.936.18-.264.072-.456.132-.576.18v15.552z" fill="#000"/><rect fill="url(#a)" height="56" rx="4" width="163" x="66" y="138"/><path d="m90.8434 170.416-13.76 5.792-1.248-3.872 10.048-3.904-10.048-3.904 1.248-3.872 13.76 5.792zm15.6026-3.168c.47-.512.95-1.045 1.44-1.6.512-.555 1.003-1.099 1.472-1.632.47-.555.907-1.077 1.312-1.568.427-.491.79-.917 1.088-1.28h5.664c-1.13 1.301-2.24 2.549-3.328 3.744-1.066 1.173-2.24 2.389-3.52 3.648.64.576 1.302 1.269 1.984 2.08.683.789 1.344 1.611 1.984 2.464s1.227 1.707 1.76 2.56c.534.853.982 1.632 1.344 2.336h-5.472c-.341-.555-.736-1.163-1.184-1.824-.426-.683-.885-1.355-1.376-2.016-.49-.683-1.013-1.333-1.568-1.952-.533-.619-1.066-1.141-1.6-1.568v7.36h-4.768v-24.064l4.768-.768zm27.467 10.176c-.811.235-1.856.448-3.136.64-1.28.213-2.624.32-4.032.32-1.429 0-2.624-.192-3.584-.576-.939-.384-1.685-.917-2.24-1.6-.555-.704-.949-1.536-1.184-2.496s-.352-2.016-.352-3.168v-9.376h4.768v8.8c0 1.536.203 2.645.608 3.328s1.163 1.024 2.272 1.024c.341 0 .704-.011 1.088-.032.384-.043.725-.085 1.024-.128v-12.992h4.768zm14.908-7.968c0-3.072-1.131-4.608-3.392-4.608-.491 0-.981.064-1.472.192-.469.128-.853.288-1.152.48v8.672c.235.043.533.085.896.128.363.021.757.032 1.184.032 1.301 0 2.283-.448 2.944-1.344s.992-2.08.992-3.552zm4.864.128c0 1.344-.203 2.56-.608 3.648-.384 1.088-.949 2.016-1.696 2.784s-1.664 1.365-2.752 1.792c-1.088.405-2.325.608-3.712.608-.576 0-1.184-.032-1.824-.096-.619-.043-1.237-.107-1.856-.192-.597-.085-1.173-.181-1.728-.288-.555-.128-1.045-.256-1.472-.384v-23.52l4.768-.768v8.384c.533-.235 1.088-.416 1.664-.544s1.195-.192 1.856-.192c1.195 0 2.251.213 3.168.64.917.405 1.685.992 2.304 1.76s1.088 1.696 1.408 2.784c.32 1.067.48 2.261.48 3.584zm2.512.128c0-1.493.224-2.795.672-3.904.47-1.131 1.078-2.069 1.824-2.816.747-.747 1.6-1.312 2.56-1.696.982-.384 1.984-.576 3.008-.576 2.39 0 4.278.736 5.664 2.208 1.387 1.451 2.08 3.595 2.08 6.432 0 .277-.01.587-.032.928-.021.32-.042.608-.064.864h-10.816c.107.981.566 1.76 1.376 2.336.811.576 1.899.864 3.264.864.875 0 1.728-.075 2.56-.224.854-.171 1.547-.373 2.08-.608l.64 3.872c-.256.128-.597.256-1.024.384-.426.128-.906.235-1.44.32-.512.107-1.066.192-1.664.256-.597.064-1.194.096-1.792.096-1.514 0-2.837-.224-3.968-.672-1.109-.448-2.037-1.056-2.784-1.824-.725-.789-1.269-1.717-1.632-2.784-.341-1.067-.512-2.219-.512-3.456zm11.2-1.824c-.021-.405-.096-.8-.224-1.184-.106-.384-.288-.725-.544-1.024-.234-.299-.544-.544-.928-.736-.362-.192-.821-.288-1.376-.288-.533 0-.992.096-1.376.288-.384.171-.704.405-.96.704s-.458.651-.608 1.056c-.128.384-.224.779-.288 1.184zm7.136 1.696c0-1.216.192-2.357.576-3.424.405-1.088.981-2.027 1.728-2.816.747-.811 1.653-1.451 2.72-1.92s2.283-.704 3.648-.704c.896 0 1.717.085 2.464.256.747.149 1.472.373 2.176.672l-.992 3.808c-.448-.171-.939-.32-1.472-.448s-1.131-.192-1.792-.192c-1.408 0-2.464.437-3.168 1.312-.683.875-1.024 2.027-1.024 3.456 0 1.515.32 2.688.96 3.52.661.832 1.803 1.248 3.424 1.248.576 0 1.195-.053 1.856-.16s1.269-.277 1.824-.512l.672 3.904c-.555.235-1.248.437-2.08.608s-1.749.256-2.752.256c-1.536 0-2.859-.224-3.968-.672-1.109-.469-2.027-1.099-2.752-1.888-.704-.789-1.227-1.717-1.568-2.784-.32-1.088-.48-2.261-.48-3.52zm16.288-12.608 4.768-.768v4.96h5.728v3.968h-5.728v5.92c0 1.003.171 1.803.512 2.4.363.597 1.077.896 2.144.896.512 0 1.035-.043 1.568-.128.555-.107 1.056-.245 1.504-.416l.672 3.712c-.576.235-1.216.437-1.92.608s-1.568.256-2.592.256c-1.301 0-2.379-.171-3.232-.512-.853-.363-1.536-.853-2.048-1.472-.512-.64-.875-1.408-1.088-2.304-.192-.896-.288-1.888-.288-2.976zm20.747 21.344c-1.387-.021-2.518-.171-3.392-.448-.854-.277-1.536-.661-2.048-1.152-.491-.512-.832-1.12-1.024-1.824-.171-.725-.256-1.536-.256-2.432v-18.528l4.768-.768v18.336c0 .427.032.811.096 1.152s.181.629.352.864c.192.235.458.427.8.576.341.149.8.245 1.376.288z" fill="#fff"/><path d="m380 2v494" stroke="#b3b3b3" stroke-dasharray="20 20" stroke-linecap="round" stroke-width="4"/><path d="m750 2v494" stroke="#b3b3b3" stroke-dasharray="20 20" stroke-linecap="round" stroke-width="4"/><path d="m637 165c-1.105 0-2 .895-2 2s.895 2 2 2v-2zm253.414 3.414c.781-.781.781-2.047 0-2.828l-12.728-12.728c-.781-.781-2.047-.781-2.828 0s-.781 2.047 0 2.828l11.314 11.314-11.314 11.314c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0zm-253.414-1.414v2h252v-2-2h-252z" fill="#000"/><path d="m242 165c-1.105 0-2 .895-2 2s.895 2 2 2v-2zm253.414 3.414c.781-.781.781-2.047 0-2.828l-12.728-12.728c-.781-.781-2.047-.781-2.828 0s-.781 2.047 0 2.828l11.314 11.314-11.314 11.314c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0zm-253.414-1.414v2h252v-2-2h-252z" fill="#000"/><path d="m501 403c1.105 0 2-.895 2-2s-.895-2-2-2v2zm-299.914-3.414c-.781.781-.781 2.047 0 2.828l12.728 12.728c.781.781 2.047.781 2.828 0s.781-2.047 0-2.828l-11.314-11.314 11.314-11.314c.781-.781.781-2.047 0-2.828s-2.047-.781-2.828 0zm299.914 1.414v-2h-298.5v2 2h298.5z" fill="#000"/><path d="m138 305c0 1.105.895 2 2 2s2-.895 2-2h-2zm3.414-96.914c-.781-.781-2.047-.781-2.828 0l-12.728 12.728c-.781.781-.781 2.047 0 2.828s2.047.781 2.828 0l11.314-11.314 11.314 11.314c.781.781 2.047.781 2.828 0s.781-2.047 0-2.828zm-1.414 96.914h2v-95.5h-2-2v95.5z" fill="#000"/><g fill="#512fc9"><path d="m522.159 352.961h92.551c2.33 0 4.16-2.331 3.162-4.828l-10.82-24.136c-.333-1.331-1.664-1.997-2.663-1.997h-71.576c-.998 0-2.33.666-3.163 1.997l-10.652 24.136c-.999 2.497.831 4.828 3.161 4.828z"/><path d="m616.874 356.292h-96.544c-1.998 0-3.33 1.498-3.33 3.662v13.649c0 1.998 1.332 3.33 3.33 3.33h96.544c1.997 0 3.329-1.332 3.329-3.33v-13.649c0-2.164-1.332-3.662-3.329-3.662zm-20.641 13.982c-2.164 0-3.661-1.498-3.661-3.662 0-1.997 1.497-3.329 3.661-3.329 1.998 0 3.329 1.332 3.329 3.329 0 2.164-1.331 3.662-3.329 3.662zm16.979 0h-6.659c-2.164 0-3.662-1.498-3.662-3.662 0-1.997 1.498-3.329 3.662-3.329h6.659c2.164 0 3.662 1.332 3.662 3.329 0 2.164-1.498 3.662-3.662 3.662z"/><path d="m616.874 404.563h-96.544c-1.998 0-3.33 1.332-3.33 3.329v13.983c0 1.997 1.332 3.329 3.33 3.329h96.544c1.997 0 3.329-1.332 3.329-3.329v-13.983c0-1.997-1.332-3.329-3.329-3.329zm-20.641 13.65c-2.164 0-3.661-1.332-3.661-3.329 0-1.998 1.497-3.329 3.661-3.329 1.998 0 3.329 1.331 3.329 3.329 0 1.997-1.331 3.329-3.329 3.329zm16.979 0h-6.659c-2.164 0-3.662-1.332-3.662-3.329 0-1.998 1.498-3.329 3.662-3.329h6.659c2.164 0 3.662 1.331 3.662 3.329 0 1.997-1.498 3.329-3.662 3.329z"/><path d="m616.874 380.592h-96.544c-1.998 0-3.33 1.332-3.33 3.329v13.65c0 2.164 1.332 3.662 3.33 3.662h96.544c1.997 0 3.329-1.498 3.329-3.662v-13.65c0-1.997-1.332-3.329-3.329-3.329zm-82.562 13.65c-2.164 0-3.663-1.333-3.663-3.33 0-2.164 1.499-3.662 3.663-3.662 1.998 0 3.328 1.498 3.328 3.662 0 1.997-1.33 3.33-3.328 3.33zm10.32 0c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662 1.997 0 3.329 1.498 3.329 3.662 0 1.997-1.332 3.33-3.329 3.33zm10.32 0c-2.163 0-3.662-1.333-3.662-3.33 0-2.164 1.499-3.662 3.662-3.662 1.998 0 3.329 1.498 3.329 3.662 0 1.997-1.331 3.33-3.329 3.33zm10.32 0c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662 1.997 0 3.33 1.498 3.33 3.662 0 1.997-1.333 3.33-3.33 3.33zm30.961 0c-2.164 0-3.661-1.333-3.661-3.33 0-2.164 1.497-3.662 3.661-3.662 1.998 0 3.329 1.498 3.329 3.662 0 1.997-1.331 3.33-3.329 3.33zm16.979 0h-6.659c-2.164 0-3.662-1.333-3.662-3.33 0-2.164 1.498-3.662 3.662-3.662h6.659c2.164 0 3.662 1.498 3.662 3.662 0 1.997-1.498 3.33-3.662 3.33z"/><path clip-rule="evenodd" d="m475.142 26.5012c0-4.7417 3.867-8.5997 8.62-8.6 4.754.0003 8.621 3.8583 8.621 8.6s-3.867 8.5993-8.62 8.5993c-4.754 0-8.621-3.8575-8.621-8.5993zm3.549 0c0 2.7866 2.275 5.0534 5.072 5.0534 2.796 0 5.071-2.2668 5.071-5.0534 0-2.7869-2.275-5.054-5.072-5.054-2.796 0-5.071 2.2671-5.071 5.054z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m504.202 32.5735-4.197-3.5702.078-.4845c.088-.655.116-1.3385.116-2.0137 0-.8391-.044-1.7016-.194-2.4983l4.197-3.565.092-.0777c.112-.1097.188-.2531.217-.4068.03-.1553.01-.3157-.054-.4592-.857-2.5826-2.335-5.0403-4.153-7.0778-.257-.2919-.62-.3983-.961-.2497l-5.288 1.8027-.439-.3393c-1.204-.8946-2.524-1.6203-3.925-2.1572l-1.047-5.37116-.031-.11142c-.052-.15193-.144-.28531-.267-.38825-.123-.10302-.272-.17047-.43-.1941l-.002-.00173c-2.741-.54685-5.562-.54685-8.302 0-.178.02702-.343.10809-.474.23132-.13.12484-.219.28524-.255.46245l-1.047 5.37129-.475.189c-1.404.5739-2.715 1.3504-3.891 2.3074l-5.286-1.8044-.117-.0371c-.154-.0372-.316-.0288-.466.0219-.15.0524-.283.1452-.382.2683-1.82 2.0375-3.296 4.4952-4.151 7.0778-.073.1621-.088.3444-.041.5166s.152.3241.297.4271l4.196 3.5667-.078.4844c-.088.655-.115 1.3421-.115 2.0122-.012.8372.053 1.6728.193 2.4982l-4.194 3.5702-.093.0759c-.112.1113-.188.2532-.217.4084-.029.1554-.01.3158.054.4591.855 2.5844 2.331 5.0388 4.151 7.0728.258.2937.622.4.963.2532l5.286-1.8062.386.3107c1.215.9149 2.556 1.6525 3.98 2.1876l1.047 5.3746.029.1113c.053.1503.146.2854.269.3884.123.1029.272.1687.431.1941 1.37.2498 2.74.3966 4.152.3966s2.782-.1468 4.152-.3966c.177-.0288.342-.1097.472-.233.13-.125.219-.2852.256-.4608l1.049-5.3746.523-.211c1.384-.5841 2.681-1.3538 3.841-2.2873l5.286 1.8063.115.0388c.307.0827.618-.0304.848-.2921 1.821-2.034 3.296-4.4884 4.151-7.0727.074-.162.088-.346.042-.5183-.047-.1721-.152-.3223-.297-.4252zm-20.439 6.5088c-6.969 0-12.617-5.6328-12.617-12.5806 0-6.9475 5.644-12.5818 12.616-12.5823 6.969.0005 12.618 5.6348 12.618 12.5823 0 6.9478-5.649 12.5806-12.617 12.5806z" fill-rule="evenodd"/><path d="m562.601 11.3723h-6.06v28.723h6.06z"/><path d="m536.752 12.1384h-22.645v5.1434h8.016v22.8133h6.611v-22.8133h8.018z"/><path clip-rule="evenodd" d="m603.708 20.5042c.919.4777 1.717 1.1613 2.328 1.9969.652.8694 1.162 1.9344 1.534 3.1937.372 1.2609.556 2.689.556 4.2893 0 1.4955-.21 2.8779-.635 4.1439-.387 1.1985-.989 2.3177-1.778 3.3001-.745.9182-1.679 1.6644-2.738 2.1859-1.1.5335-2.308.8035-3.529.7883-1.058 0-1.945-.1469-2.659-.4406-.712-.2903-1.372-.692-1.957-1.1899v7.6365h-6.061v-26.2113h3.753l.185.0084c.272.0135.533.0979.763.2414.264.1772.455.4439.539.7495l.448 1.4584.299-.3106c.306-.3021.628-.5824.963-.8423 1.446-1.117 3.227-1.7129 5.056-1.6878 1.059.0002 2.035.2296 2.933.6902zm-2.943 14.1521c.346-.4793.615-1.1039.813-1.8719.194-.7664.292-1.6998.292-2.8003 0-1.05-.079-1.9312-.235-2.6486-.155-.7157-.375-1.2946-.654-1.7369-.28-.4405-.618-.7562-1.008-.9503-.39-.1909-.826-.2871-1.311-.2871-.443 0-.843.0423-1.201.1266-.359.0811-.693.1993-.997.3546-.309.1552-.597.3511-.852.5841-.278.2548-.539.5266-.782.8152v8.4434l.198.2025c.365.368.804.6549 1.289.8424.534.1991 1.095.297 1.681.297.534.0051 1.061-.1047 1.544-.3257.47-.2178.877-.5672 1.223-1.045z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m550.312 22.29c-.821-.7916-1.801-1.4009-2.875-1.7858-1.183-.4204-2.429-.628-3.685-.6128-1.552 0-2.944.2617-4.176.7867-1.182.4911-2.254 1.2136-3.149 2.1285-.868.898-1.546 1.9615-1.993 3.1278-.467 1.2053-.702 2.4881-.695 3.7812 0 1.764.269 3.3118.813 4.642.54 1.3301 1.277 2.4442 2.21 3.3388.932.8963 2.02 1.5698 3.265 2.0256 1.244.4524 2.578.6803 3.997.6803.693 0 1.418-.049 2.181-.1435.762-.0962 1.524-.2684 2.288-.5199.764-.2482 1.507-.5925 2.23-1.0348.62-.3763 1.204-.8525 1.754-1.4229l.27-.2938-1.759-2.1302c-.25-.3461-.613-.5199-1.096-.5199-.365 0-.713.0844-1.044.2515-.335.1654-.7.3511-1.097.5553-.437.2212-.892.4068-1.36.5571-.508.1671-1.115.2498-1.818.2498-1.317 0-2.393-.3747-3.226-1.1225-.779-.6988-1.279-1.7961-1.502-3.2916l-.042-.3258h11.692c.275 0 .498-.0321.674-.0945.176-.0641.326-.1857.422-.346.117-.2059.191-.4356.215-.6718.039-.2819.059-.6448.059-1.0939 0-1.433-.226-2.716-.676-3.8469-.415-1.0787-1.054-2.056-1.877-2.868zm-10.452 5.4675c.209-1.2153.64-2.1471 1.291-2.7919.652-.6466 1.557-.969 2.718-.969.65 0 1.205.1097 1.662.3275.429.1958.806.4878 1.105.8525.282.3545.488.763.607 1.2001.123.4508.186.9149.184 1.3808z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m579.86 20.5042c1.075.3849 2.055.9925 2.876 1.7843.801.7815 1.427 1.7384 1.877 2.8695.447 1.1309.674 2.4139.674 3.8469 0 .4491-.017.812-.059 1.0939-.024.2362-.098.4659-.215.6718-.096.1603-.245.2819-.421.346-.216.0692-.444.1012-.674.0946h-11.694l.042.3257c.223 1.4956.724 2.5928 1.504 3.2916.833.7495 1.909 1.1209 3.227 1.1209.703 0 1.309-.0811 1.818-.2482.466-.1486.92-.3343 1.358-.5553.399-.206.764-.3917 1.096-.5554.331-.1688.681-.2516 1.044-.2516.485 0 .848.1722 1.097.5183l1.76 2.1303-.272.2937c-.52.5485-1.11 1.0263-1.752 1.4229-.724.4423-1.466.7884-2.228 1.0365-.745.2464-1.512.4186-2.289.5182-.764.0945-1.489.1435-2.18.1435-1.363.0101-2.716-.2212-3.998-.6803-1.22-.4389-2.334-1.1276-3.268-2.0256-.932-.8946-1.667-2.0053-2.21-3.3372-.54-1.3317-.812-2.8796-.812-4.6436 0-1.3318.233-2.5911.696-3.7812.448-1.1663 1.125-2.2298 1.993-3.1278.896-.9132 1.967-1.6373 3.148-2.1285 1.231-.525 2.623-.7884 4.174-.7884l.002.0018c1.255-.0153 2.504.1923 3.686.6127zm-6.286 4.4614c-.652.6465-1.083 1.5766-1.291 2.7919h7.567c0-.4744-.061-.9318-.184-1.3808-.125-.4473-.326-.849-.606-1.2001-.283-.3528-.649-.6364-1.107-.8542-.456-.2161-1.009-.3241-1.662-.3241-1.161 0-2.067.3224-2.717.9673z" fill-rule="evenodd"/><path clip-rule="evenodd" d="m627.868 22.6346c-.93-.8981-2.041-1.5901-3.255-2.034-1.265-.4727-2.666-.709-4.203-.709-1.553 0-2.965.2363-4.236.709-1.225.4439-2.343 1.1377-3.286 2.034-.932.9046-1.66 2.0019-2.13 3.2139-.502 1.2593-.752 2.6772-.752 4.2504 0 1.585.25 3.0148.752 4.2892.502 1.2711 1.213 2.3513 2.13 3.2426.943.9032 2.061 1.602 3.286 2.051 1.272.481 2.683.7207 4.236.7207 1.537 0 2.939-.2397 4.203-.7207 1.216-.449 2.326-1.1478 3.255-2.051.906-.8913 1.61-1.9715 2.112-3.2426.504-1.2728.754-2.7042.754-4.2892 0-1.5732-.25-2.9911-.754-4.2504-.468-1.2086-1.188-2.3041-2.112-3.2139zm-4.38 11.9054c-.657.9656-1.686 1.45-3.078 1.45-1.435 0-2.486-.4827-3.15-1.45-.665-.9655-.996-2.4324-.996-4.4022 0-1.97.331-3.4368.996-4.394.666-.9588 1.715-1.4398 3.15-1.4398 1.392 0 2.421.4793 3.078 1.4398.659.9572.986 2.424.986 4.394 0 1.9698-.327 3.4367-.986 4.4022z" fill-rule="evenodd"/><path d="m660.819 35.4633c.111.0827.225.2126.343.3916l1.838 2.8206-.297.2094c-.722.4793-1.511.8457-2.342 1.0853-.98.287-1.988.4322-3.032.4322-.965 0-1.815-.1385-2.553-.4119-.696-.2515-1.331-.6499-1.857-1.1716-.51-.5198-.902-1.1444-1.143-1.8314-.271-.7715-.403-1.5833-.392-2.3986v-10.285h-1.722l-.152-.0083c-.242-.0254-.468-.125-.649-.2888-.221-.1974-.331-.4895-.331-.8743v-2.3193l3.225-.6145 1.195-4.8563.044-.147c.187-.5148.614-.7731 1.283-.7731h3.17v5.8136h4.928v4.0664h-4.928v9.8831l.007.1943c.027.3729.14.6903.336.9485.226.2988.556.4508.985.4508.329.0066.657-.0693.949-.2212.112-.0574.215-.108.314-.1535.107-.0474.225-.0693.342-.0676.157-.0068.311.0371.439.1266z"/><path d="m603.364 19.8139.002.0001.002-.0001z"/><path d="m639.997 23.0936c.615-.8895 1.377-1.666 2.254-2.3006.924-.6517 1.936-.9791 3.03-.9791.926 0 1.668.2178 2.23.6533l-.78 4.3753-.037.1502c-.043.1654-.141.3122-.277.4153-.156.1097-.365.1637-.625.1637-.223 0-.484-.0304-.783-.0878-.299-.0573-.677-.0861-1.135-.0861-1.59 0-2.842.8304-3.754 2.4931v12.2043h-6.061v-19.8964h3.595l.216.005c.181.0051.361.0287.537.071.184.0438.358.1248.509.2396.14.1147.248.2633.312.4322.081.2126.144.4305.186.6532l.333 1.8585z"/></g></g></svg>
\ No newline at end of file
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/templates.ts b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/templates.ts
new file mode 100644
index 0000000000000..2afcec2401d11
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/templates.ts
@@ -0,0 +1,84 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export function makeGhaWorkflow(params: {
+  tokenName: string;
+  clusterPublicUrl: string;
+}) {
+  return GHA_WORKFLOW.replaceAll(
+    ':token_name',
+    JSON.stringify(params.tokenName)
+  ).replaceAll(':cluster_public_url', JSON.stringify(params.clusterPublicUrl));
+}
+
+export const GHA_WORKFLOW = `# This file contains a GitHub Actions workflow which enrolls with Teleport in
+# order to access a Kubernetes cluster using kubectl or other tools compatible
+# with kubeconfig, such as Helm.
+
+# Save this file to your GitHub repository in \`.github/workflows\`. You can edit
+# the events that trigger your workflow, such as when pushing to a named branch
+# or triggering it manually.
+
+# For more information about using GitHub Actions read the getting started
+# guide; https://docs.github.com/en/actions/get-started/quickstart
+
+on: workflow_dispatch
+
+env:
+  TELEPORT_PROXY_ADDR: :cluster_public_url
+  TELEPORT_JOIN_TOKEN_NAME: :token_name
+
+  # TODO: Provide the name of the Kubernetes cluster in Teleport
+  TELEPORT_K8S_CLUSTER_NAME: my-kubernetes-cluster
+
+jobs:
+  demo:
+    permissions:
+      # The "id-token: write" permission is required or \`tbot\` will not be able
+      # to authenticate with the cluster.
+      id-token: write
+      contents: read
+    name: Teleport Kubernetes Access
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Fetch Teleport binaries
+      uses: teleport-actions/setup@v1
+      with:
+        version: auto
+        proxy: \${{ env.TELEPORT_PROXY_ADDR }}
+
+    - name: Fetch credentials using Machine & Workload Identity
+      uses: teleport-actions/auth-k8s@v2
+      with:
+        proxy: \${{ env.TELEPORT_PROXY_ADDR }}
+        token: \${{ env.TELEPORT_JOIN_TOKEN_NAME }}
+        kubernetes-cluster: \${{ env.TELEPORT_K8S_CLUSTER_NAME }}
+        # Enable the submission of anonymous usage telemetry. This helps us
+        # shape the future development of \`tbot\`. You can disable this by
+        # omitting this.
+        anonymous-telemetry: 1
+
+    # Use kubectl or other compatible tools to interact with your Kubernetes
+    # cluster.
+    - name: List pods
+      run: kubectl version
+`;
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.test.tsx
new file mode 100644
index 0000000000000..3eb6c9fb91728
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.test.tsx
@@ -0,0 +1,496 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { act, renderHook } from '@testing-library/react';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import { waitFor } from 'storybook/internal/test';
+
+import { testQueryClient } from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { genWizardCiCdSuccess } from 'teleport/test/helpers/bots';
+import { userEventCaptureSuccess } from 'teleport/test/helpers/userEvents';
+
+import { TrackingProvider } from '../Shared/useTracking';
+import { GitHubK8sFlowProvider, useGitHubK8sFlow } from './useGitHubK8sFlow';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+beforeEach(() => {
+  server.use(userEventCaptureSuccess());
+
+  // The templates API call is debounced, so we'll need to time travel a little.
+  jest.useFakeTimers();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.useRealTimers();
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('useGitHubK8sFlow', () => {
+  test('initial', async () => {
+    withGenWizardCiCdSuccess({
+      response: {
+        terraform: 'mock terraform template',
+      },
+    });
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    await waitForAPI(result.current);
+
+    expect(result.current.state).toStrictEqual(withDefaultState({}));
+    expect(result.current.template.terraform.data).toBe(
+      'mock terraform template'
+    );
+
+    expect(result.current.template.ghaWorkflow).toContain(
+      'TELEPORT_PROXY_ADDR: "some-long-cluster-public-url-name.cloud.teleport.gravitational.io:1234"'
+    );
+  });
+
+  describe('github url', () => {
+    test.each`
+      name                | url
+      ${'with scheme'}    | ${'https://github.example.com/owner/repo'}
+      ${'without scheme'} | ${'github.example.com/owner/repo'}
+    `('$name', async ({ url }) => {
+      withGenWizardCiCdSuccess();
+
+      const { result } = renderHook(() => useGitHubK8sFlow(), {
+        wrapper: Wrapper,
+      });
+
+      act(() => {
+        result.current.dispatch({
+          type: 'github-url-changed',
+          value: url,
+        });
+      });
+
+      expect(result.current.state).toStrictEqual(
+        withDefaultState({
+          gitHubUrl: url,
+          info: {
+            host: 'github.example.com',
+            owner: 'owner',
+            repository: 'repo',
+          },
+        })
+      );
+
+      await waitForAPI(result.current);
+
+      expect(result.current.template.terraform.data).toContain(
+        '"enterprise_server_host":"github.example.com"'
+      );
+      expect(result.current.template.terraform.data).toContain(
+        '"repository":"repo"'
+      );
+      expect(result.current.template.terraform.data).toContain(
+        '"owner":"owner"'
+      );
+
+      expect(result.current.template.ghaWorkflow).toContain(
+        'TELEPORT_JOIN_TOKEN_NAME: "gha-owner-repo"'
+      );
+    });
+  });
+
+  test('branch', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'ref-changed',
+        value: 'release-*',
+      });
+
+      result.current.dispatch({
+        type: 'allow-any-branch-toggled',
+        value: true,
+      });
+
+      result.current.dispatch({
+        type: 'branch-changed',
+        value: 'release-*',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        branch: 'release-*',
+        ref: 'release-*',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"ref":"release-*"'
+    );
+    expect(result.current.template.terraform.data).toContain(
+      '"ref_type":"branch"'
+    );
+  });
+
+  test('allow any branch', async () => {
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'allow-any-branch-toggled',
+        value: true,
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        allowAnyBranch: true,
+      })
+    );
+  });
+
+  test('workflow', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'workflow-changed',
+        value: 'my-workflow',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        workflow: 'my-workflow',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"workflow":"my-workflow"'
+    );
+  });
+
+  test('environment', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'environment-changed',
+        value: 'production',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        environment: 'production',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"environment":"production"'
+    );
+  });
+
+  test('ref', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'ref-changed',
+        value: 'release-*',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        ref: 'release-*',
+        branch: 'release-*',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"ref":"release-*"'
+    );
+  });
+
+  test('ref type', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'ref-changed',
+        value: 'release-*',
+      });
+
+      result.current.dispatch({
+        type: 'ref-type-changed',
+        value: 'tag',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        refType: 'tag',
+        ref: 'release-*',
+        branch: '',
+        isBranchDisabled: true,
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"ref_type":"tag"'
+    );
+  });
+
+  test('slug', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'slug-changed',
+        value: 'octo-enterprise',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        enterpriseSlug: 'octo-enterprise',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"enterprise_slug":"octo-enterprise"'
+    );
+  });
+
+  test('jwks', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'jwks-changed',
+        value: '{"keys": []}',
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        enterpriseJwks: '{"keys": []}',
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"static_jwks":"{\\"keys\\": []}"'
+    );
+  });
+
+  test('kubernetes groups', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'kubernetes-groups-changed',
+        value: ['system:masters'],
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        kubernetesGroups: ['system:masters'],
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"groups":["system:masters"]'
+    );
+  });
+
+  test('kubernetes labels', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'kubernetes-labels-changed',
+        value: [{ name: 'foo', values: ['bar'] }],
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        kubernetesLabels: [
+          {
+            name: 'foo',
+            values: ['bar'],
+          },
+        ],
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"labels":{"foo":["bar"]}'
+    );
+  });
+
+  test('kubernetes users', async () => {
+    withGenWizardCiCdSuccess();
+
+    const { result } = renderHook(() => useGitHubK8sFlow(), {
+      wrapper: Wrapper,
+    });
+
+    act(() => {
+      result.current.dispatch({
+        type: 'kubernetes-users-changed',
+        value: ['user1@example.com'],
+      });
+    });
+
+    expect(result.current.state).toStrictEqual(
+      withDefaultState({
+        kubernetesUsers: ['user1@example.com'],
+      })
+    );
+
+    await waitForAPI(result.current);
+
+    expect(result.current.template.terraform.data).toContain(
+      '"users":["user1@example.com"]'
+    );
+  });
+});
+
+async function waitForAPI(context: ReturnType<typeof useGitHubK8sFlow>) {
+  await act(jest.advanceTimersToNextTimerAsync);
+  return waitFor(() => expect(context.template.terraform.loading).toBeFalsy());
+}
+
+function withDefaultState(
+  overrides: Partial<ReturnType<typeof useGitHubK8sFlow>['state']>
+) {
+  return {
+    allowAnyBranch: false,
+    branch: '',
+    enterpriseJwks: '',
+    enterpriseSlug: '',
+    environment: '',
+    gitHubUrl: '',
+    isBranchDisabled: false,
+    ref: '',
+    refType: 'branch',
+    workflow: '',
+    kubernetesGroups: [],
+    kubernetesLabels: [
+      {
+        name: '*',
+        values: ['*'],
+      },
+    ],
+    kubernetesUsers: [],
+    ...overrides,
+  };
+}
+
+function withGenWizardCiCdSuccess(
+  ...params: Parameters<typeof genWizardCiCdSuccess>
+) {
+  server.use(genWizardCiCdSuccess(...params));
+}
+
+function Wrapper(props: PropsWithChildren) {
+  const ctx = createTeleportContext();
+  return (
+    <QueryClientProvider client={testQueryClient}>
+      <ContextProvider ctx={ctx}>
+        <TrackingProvider>
+          <GitHubK8sFlowProvider>{props.children}</GitHubK8sFlowProvider>
+        </TrackingProvider>
+      </ContextProvider>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.tsx
new file mode 100644
index 0000000000000..efb17ee8e19f7
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsK8s/useGitHubK8sFlow.tsx
@@ -0,0 +1,350 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMutation } from '@tanstack/react-query';
+import React, {
+  PropsWithChildren,
+  useContext,
+  useEffect,
+  useReducer,
+} from 'react';
+import { useDebounceCallback } from 'usehooks-ts';
+
+import { generateGhaK8sTemplates } from 'teleport/services/bot/bot';
+import { RefType } from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
+
+import { GITHUB_HOST, parseRepoAddress } from '../Shared/github';
+import { KubernetesLabel } from '../Shared/kubernetes';
+import { useTracking } from '../Shared/useTracking';
+import { makeGhaWorkflow } from './templates';
+
+export function useGitHubK8sFlow() {
+  return useContext(context);
+}
+
+export function GitHubK8sFlowProvider(
+  props: PropsWithChildren & {
+    intitialState?: Partial<State>;
+  }
+) {
+  const { children, intitialState = {} } = props;
+
+  const [state, dispatch] = useReducer(reducer, {
+    ...defaultState,
+    ...intitialState,
+  });
+
+  const ctx = useTeleport();
+  const cluster = ctx.storeUser.state.cluster;
+
+  const tracking = useTracking();
+
+  // This effect sends a user event when the flow starts and ends
+  useEffect(() => {
+    tracking.start();
+    return () => {
+      tracking.complete();
+    };
+  }, [tracking]);
+
+  const { mutate, data, isPending, error } = useMutation({
+    mutationFn: (vars: Parameters<typeof generateGhaK8sTemplates>[0]) =>
+      generateGhaK8sTemplates(vars),
+    retry: 3,
+    scope: {
+      id: 'gha-k8s', // mutations in this scope are executed serially, in-order
+    },
+  });
+
+  // Hold the previous data value so we always have something to display after
+  // the initial fetch. When the mutation runs, data is set to null until the
+  // new data arrives.
+  const prevData = usePrevious(data);
+
+  const regenerateTemplates = useDebounceCallback(mutate, 1000);
+
+  // This effect triggers the code templates to be regenerated when state
+  // changes. It's debounced to reduce the number of api calls.
+  useEffect(() => {
+    const includeKubernetes =
+      state.kubernetesGroups.length > 0 ||
+      state.kubernetesLabels.length > 0 ||
+      state.kubernetesUsers.length > 0;
+
+    regenerateTemplates({
+      github: {
+        allow: [
+          {
+            environment: state.environment,
+            owner: state.info?.owner || 'gravitational',
+            ref: state.ref,
+            ref_type: state.refType,
+            repository: state.info?.repository || 'teleport',
+            workflow: state.workflow,
+            // actor: state.actor - we don't allow actor to be specified
+          },
+        ],
+        enterprise_server_host:
+          state.info?.host === GITHUB_HOST ? undefined : state.info?.host,
+        enterprise_slug: state.enterpriseSlug,
+        static_jwks: state.enterpriseJwks,
+      },
+      kubernetes: includeKubernetes
+        ? {
+            groups: state.kubernetesGroups,
+            labels: state.kubernetesLabels.reduce<Record<string, string[]>>(
+              (acc, cur) => {
+                const existing = acc[cur.name];
+                if (existing) {
+                  existing.push(...cur.values);
+                } else {
+                  acc[cur.name] = cur.values;
+                }
+                return acc;
+              },
+              {}
+            ),
+            users: state.kubernetesUsers,
+          }
+        : undefined,
+    });
+  }, [
+    regenerateTemplates,
+    state.enterpriseJwks,
+    state.enterpriseSlug,
+    state.environment,
+    state.info?.host,
+    state.info?.owner,
+    state.info?.repository,
+    state.kubernetesGroups,
+    state.kubernetesLabels,
+    state.kubernetesUsers,
+    state.ref,
+    state.refType,
+    state.workflow,
+  ]);
+
+  const value = {
+    state,
+    dispatch,
+    template: {
+      terraform: {
+        data: (data ?? prevData)?.terraform,
+        loading: isPending,
+        error,
+      },
+      ghaWorkflow: makeGhaWorkflow({
+        tokenName: `gha-${state.info?.owner ?? 'gravitational'}-${state.info?.repository ?? 'teleport'}`,
+        clusterPublicUrl: cluster.publicURL,
+      }),
+    },
+  };
+
+  return <context.Provider value={value}>{children}</context.Provider>;
+}
+
+function reducer(prev: State, action: Action): State {
+  switch (action.type) {
+    case 'github-url-changed':
+      let info: ReturnType<typeof parseRepoAddress> | undefined = undefined;
+      try {
+        info = parseRepoAddress(action.value);
+      } catch {
+        /* Best endeavours */
+      }
+
+      return {
+        ...prev,
+        gitHubUrl: action.value,
+        info,
+      };
+    case 'branch-changed':
+      return {
+        ...prev,
+        branch: action.value,
+        allowAnyBranch: false,
+        ref: action.value,
+        refType: 'branch',
+      };
+    case 'allow-any-branch-toggled':
+      return {
+        ...prev,
+        allowAnyBranch: action.value,
+        branch: '',
+        ref: '',
+      };
+    case 'ref-changed':
+      return {
+        ...prev,
+        ref: action.value,
+        // Keep ref in sync with branch while ref type is 'branch'
+        branch: prev.refType === 'branch' ? action.value : '',
+        isBranchDisabled: prev.refType !== 'branch',
+      };
+    case 'ref-type-changed':
+      return {
+        ...prev,
+        // Keep ref in sync with branch while ref type is 'branch'
+        branch: action.value === 'branch' ? prev.ref : '',
+        isBranchDisabled: action.value !== 'branch',
+        refType: action.value,
+      };
+    case 'workflow-changed':
+      return {
+        ...prev,
+        workflow: action.value,
+      };
+    case 'environment-changed':
+      return {
+        ...prev,
+        environment: action.value,
+      };
+    case 'slug-changed':
+      return {
+        ...prev,
+        enterpriseSlug: action.value,
+      };
+    case 'jwks-changed':
+      return {
+        ...prev,
+        enterpriseJwks: action.value,
+      };
+    case 'kubernetes-groups-changed':
+      return {
+        ...prev,
+        kubernetesGroups: action.value,
+      };
+    case 'kubernetes-labels-changed':
+      return {
+        ...prev,
+        kubernetesLabels: action.value,
+      };
+    case 'kubernetes-users-changed':
+      return {
+        ...prev,
+        kubernetesUsers: action.value,
+      };
+    default:
+      const exhaustiveCheck: never = action;
+      throw new Error(`Unhandled action type: ${exhaustiveCheck}`);
+  }
+}
+
+type Action =
+  | {
+      type:
+        | 'github-url-changed'
+        | 'branch-changed'
+        | 'ref-changed'
+        | 'workflow-changed'
+        | 'environment-changed'
+        | 'slug-changed'
+        | 'jwks-changed';
+      value: string;
+    }
+  | {
+      type: 'allow-any-branch-toggled';
+      value: boolean;
+    }
+  | {
+      type: 'ref-type-changed';
+      value: RefType | '';
+    }
+  | {
+      type: 'kubernetes-groups-changed' | 'kubernetes-users-changed';
+      value: string[];
+    }
+  | {
+      type: 'kubernetes-labels-changed';
+      value: KubernetesLabel[];
+    };
+
+type State = {
+  gitHubUrl: string;
+  info?: {
+    host?: string;
+    owner?: string;
+    repository?: string;
+  };
+  branch: string;
+  allowAnyBranch: boolean;
+  isBranchDisabled: boolean;
+  ref: string;
+  refType: RefType | '';
+  workflow: string;
+  environment: string;
+  enterpriseSlug: string;
+  enterpriseJwks: string;
+  kubernetesGroups: string[];
+  kubernetesLabels: KubernetesLabel[];
+  kubernetesUsers: string[];
+};
+
+const defaultState: State = {
+  gitHubUrl: '',
+  branch: '',
+  allowAnyBranch: false,
+  isBranchDisabled: false,
+  ref: '',
+  refType: 'branch',
+  workflow: '',
+  environment: '',
+  enterpriseSlug: '',
+  enterpriseJwks: '',
+  kubernetesGroups: [],
+  kubernetesLabels: [{ name: '*', values: ['*'] }],
+  kubernetesUsers: [],
+};
+
+type Context = {
+  state: State;
+  dispatch: React.ActionDispatch<[Action]>;
+  template: {
+    terraform: {
+      data?: string;
+      loading: boolean;
+      error: Error | null;
+    };
+    ghaWorkflow?: string;
+  };
+};
+const context = React.createContext<Context>({
+  dispatch: () => {
+    throw new Error('not implemented');
+  },
+  state: defaultState,
+  template: {
+    terraform: {
+      loading: false,
+      error: null,
+    },
+  },
+});
+
+function usePrevious<T>(value: T) {
+  const [current, setCurrent] = React.useState<T>(value);
+  const [previous, setPrevious] = React.useState<T | undefined>(undefined);
+
+  if (value !== current) {
+    setPrevious(current);
+    setCurrent(value);
+  }
+
+  return previous;
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.story.tsx
similarity index 88%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.story.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.story.tsx
index a66b7ed730628..2eeb4a459e2de 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.story.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.story.tsx
@@ -23,7 +23,7 @@ import { createTeleportContext } from 'teleport/mocks/contexts';
 
 import { FlowStepProps } from '../Shared/GuidedFlow';
 import { AddBotToWorkflow } from './AddBotToWorkflow';
-import { GitHubFlowProvider } from './useGitHubFlow';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
 
 const Provider = ({ children }) => {
   const ctx = createTeleportContext();
@@ -31,14 +31,14 @@ const Provider = ({ children }) => {
   return (
     <MemoryRouter>
       <ContextProvider ctx={ctx}>
-        <GitHubFlowProvider>{children}</GitHubFlowProvider>
+        <GitHubSshFlowProvider>{children}</GitHubSshFlowProvider>
       </ContextProvider>
     </MemoryRouter>
   );
 };
 
 export default {
-  title: 'Teleport/Bots/Add/GitHubActions',
+  title: 'Teleport/Bots/Add/GitHubActions+SSH',
 };
 
 export const AddBot = () => (
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.test.tsx
similarity index 92%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.test.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.test.tsx
index c70d2d49e5702..1b062869e6a58 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.test.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.test.tsx
@@ -25,7 +25,7 @@ import { allAccessAcl } from 'teleport/mocks/contexts';
 import TeleportContext from 'teleport/teleportContext';
 
 import { ConfigureBot } from './ConfigureBot';
-import { GitHubFlowProvider } from './useGitHubFlow';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
 
 describe('addBotToWorkflow Component', () => {
   const setup = () => {
@@ -38,9 +38,9 @@ describe('addBotToWorkflow Component', () => {
     render(
       <MemoryRouter>
         <ContextProvider ctx={ctx}>
-          <GitHubFlowProvider>
+          <GitHubSshFlowProvider>
             <ConfigureBot />
-          </GitHubFlowProvider>
+          </GitHubSshFlowProvider>
         </ContextProvider>
       </MemoryRouter>
     );
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.tsx
similarity index 96%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.tsx
index 66f67bb5206d8..9653380d16e21 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/AddBotToWorkflow.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/AddBotToWorkflow.tsx
@@ -25,10 +25,10 @@ import useTeleport from 'teleport/useTeleport';
 
 import { FlowButtons } from '../Shared/FlowButtons';
 import { FlowStepProps } from '../Shared/GuidedFlow';
-import { useGitHubFlow } from './useGitHubFlow';
+import { useGitHubSshFlow } from './useGitHubSshFlow';
 
 export function AddBotToWorkflow({ prevStep, nextStep }: FlowStepProps) {
-  const { tokenName, createBotRequest } = useGitHubFlow();
+  const { tokenName, createBotRequest } = useGitHubSshFlow();
   const ctx = useTeleport();
   const cluster = ctx.storeUser.state.cluster;
 
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.story.tsx
similarity index 90%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.story.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.story.tsx
index 1f03d6937d12d..53ff2b3940b6e 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.story.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.story.tsx
@@ -23,7 +23,7 @@ import { allAccessAcl, createTeleportContext } from 'teleport/mocks/contexts';
 
 import { FlowStepProps } from '../Shared/GuidedFlow';
 import { ConfigureBot } from './ConfigureBot';
-import { GitHubFlowProvider } from './useGitHubFlow';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
 
 const Provider = ({ children, access = allAccessAcl }) => {
   const ctx = createTeleportContext();
@@ -35,14 +35,14 @@ const Provider = ({ children, access = allAccessAcl }) => {
   return (
     <MemoryRouter>
       <ContextProvider ctx={ctx}>
-        <GitHubFlowProvider>{children}</GitHubFlowProvider>
+        <GitHubSshFlowProvider>{children}</GitHubSshFlowProvider>
       </ContextProvider>
     </MemoryRouter>
   );
 };
 
 export default {
-  title: 'Teleport/Bots/Add/GitHubActions/Permissions',
+  title: 'Teleport/Bots/Add/GitHubActions+SSH/Permissions',
 };
 
 export const Loaded = () => (
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.test.tsx
similarity index 96%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.test.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.test.tsx
index 1b5bfdbff512d..699355e70f98d 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.test.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.test.tsx
@@ -27,7 +27,7 @@ import { Access, Acl } from 'teleport/services/user';
 import TeleportContext from 'teleport/teleportContext';
 
 import { ConfigureBot } from './ConfigureBot';
-import { GitHubFlowProvider } from './useGitHubFlow';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
 
 type SetupProps = {
   access?: Acl;
@@ -51,9 +51,9 @@ describe('configureBot Component', () => {
     render(
       <MemoryRouter>
         <ContextProvider ctx={ctx}>
-          <GitHubFlowProvider>
+          <GitHubSshFlowProvider>
             <ConfigureBot />
-          </GitHubFlowProvider>
+          </GitHubSshFlowProvider>
         </ContextProvider>
       </MemoryRouter>
     );
@@ -113,6 +113,7 @@ describe('configureBot Component', () => {
       status: '',
       subKind: '',
       version: '',
+      max_session_ttl: { seconds: 43200 },
     });
 
     const botNameInput = screen.getByPlaceholderText('github-actions-cd');
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.tsx
similarity index 97%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.tsx
index 9467d68b2bf9c..5c9056c228af3 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/ConfigureBot.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConfigureBot.tsx
@@ -33,13 +33,13 @@ import useTeleport from 'teleport/useTeleport';
 
 import { FlowButtons } from '../Shared/FlowButtons';
 import { FlowStepProps } from '../Shared/GuidedFlow';
-import { useGitHubFlow } from './useGitHubFlow';
+import { useGitHubSshFlow } from './useGitHubSshFlow';
 
 export function ConfigureBot({ nextStep, prevStep }: FlowStepProps) {
   const [missingLabels, setMissingLabels] = useState(false);
   const [alreadyExistErr, setAlreadyExistErr] = useState(false);
 
-  const { createBotRequest, setCreateBotRequest } = useGitHubFlow();
+  const { createBotRequest, setCreateBotRequest } = useGitHubSshFlow();
   const { attempt, run } = useAttempt();
   const isLoading = attempt.status === 'processing';
 
@@ -64,9 +64,9 @@ export function ConfigureBot({ nextStep, prevStep }: FlowStepProps) {
 
     // check if a bot with that name already exist
     run(async () => {
-      const bot = await getBot(createBotRequest.botName);
+      const bot = await getBot({ botName: createBotRequest.botName });
       if (bot === null) {
-        nextStep();
+        nextStep?.();
         return;
       }
       setAlreadyExistErr(true);
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.story.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.story.tsx
new file mode 100644
index 0000000000000..4ad2db6b9de0a
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.story.tsx
@@ -0,0 +1,60 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MemoryRouter } from 'react-router';
+
+import { ContextProvider } from 'teleport';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { ConnectGitHub } from './ConnectGitHub';
+import { Finish } from './Finish';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
+
+const Provider = ({ children }) => {
+  const ctx = createTeleportContext();
+
+  return (
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <GitHubSshFlowProvider>{children}</GitHubSshFlowProvider>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+};
+
+export default {
+  title: 'Teleport/Bots/Add/GitHubActions+SSH',
+};
+
+export const RepoRules = () => (
+  <Provider>
+    <ConnectGitHub {...props} />
+  </Provider>
+);
+
+export const Finished = () => (
+  <Provider>
+    <Finish />
+  </Provider>
+);
+
+const props: FlowStepProps = {
+  nextStep: () => {},
+  prevStep: () => {},
+};
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.test.tsx
new file mode 100644
index 0000000000000..c61ff25453ab6
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.test.tsx
@@ -0,0 +1,76 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MemoryRouter } from 'react-router';
+
+import { render, screen } from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport';
+import { allAccessAcl } from 'teleport/mocks/contexts';
+import TeleportContext from 'teleport/teleportContext';
+
+import { ConnectGitHub } from './ConnectGitHub';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
+
+describe('connectGitHub Component', () => {
+  function setup() {
+    const ctx = new TeleportContext();
+
+    ctx.storeUser.setState({
+      username: 'joe@example.com',
+      acl: allAccessAcl,
+    });
+
+    render(
+      <MemoryRouter>
+        <ContextProvider ctx={ctx}>
+          <GitHubSshFlowProvider>
+            <ConnectGitHub />
+          </GitHubSshFlowProvider>
+        </ContextProvider>
+      </MemoryRouter>
+    );
+  }
+
+  // Test for default rendering
+  it('renders basic elements', () => {
+    setup();
+    expect(
+      screen.getByText('Step 2: Input Your GitHub Account Info')
+    ).toBeInTheDocument();
+    expect(screen.getByText('Next')).toBeInTheDocument();
+    expect(screen.getByText('Back')).toBeInTheDocument();
+
+    // rule form
+    expect(screen.getByText('GitHub Repository Access:')).toBeInTheDocument();
+    expect(
+      screen.getByPlaceholderText('https://github.com/gravitational/teleport')
+    ).toBeInTheDocument();
+    expect(screen.getByText('Git Ref')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('main')).toBeInTheDocument();
+    expect(screen.getByText('Ref Type')).toBeInTheDocument();
+    expect(
+      screen.getByText('Name of the GitHub Actions Workflow')
+    ).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('cd')).toBeInTheDocument();
+    expect(screen.getByText('Environment')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('development')).toBeInTheDocument();
+    expect(screen.getByText('Restrict to a GitHub User')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('octocat')).toBeInTheDocument();
+  });
+});
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.tsx
new file mode 100644
index 0000000000000..e666f6e7f2f09
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/ConnectGitHub.tsx
@@ -0,0 +1,317 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState, type JSX } from 'react';
+import styled from 'styled-components';
+
+import { H2, Text } from 'design';
+import { Alert } from 'design/Alert';
+import Box from 'design/Box';
+import { ButtonSecondary } from 'design/Button';
+import ButtonIcon from 'design/ButtonIcon';
+import Card from 'design/Card';
+import Flex from 'design/Flex';
+import * as Icons from 'design/Icon';
+import Input from 'design/Input';
+import Link from 'design/Link';
+import FieldInput from 'shared/components/FieldInput';
+import Select from 'shared/components/Select';
+import Validation, { Validator } from 'shared/components/Validation';
+
+import cfg from 'teleport/config';
+
+import { FlowButtons } from '../Shared/FlowButtons';
+import {
+  GITHUB_HOST,
+  parseRepoAddress,
+  RefTypeOption,
+  refTypeOptions,
+  requireValidRepository,
+} from '../Shared/github';
+import { FlowStepProps } from '../Shared/GuidedFlow';
+import { Rule, useGitHubSshFlow } from './useGitHubSshFlow';
+
+export function ConnectGitHub({ nextStep, prevStep }: FlowStepProps) {
+  const {
+    repoRules,
+    setRepoRules,
+    addEmptyRepoRule,
+    createBot,
+    attempt,
+    resetAttempt,
+  } = useGitHubSshFlow();
+  const isLoading = attempt.status === 'processing';
+
+  const [hostError, setHostError] = useState<JSX.Element | null>(null);
+
+  function handleNext(validator: Validator) {
+    // clear errors
+    setHostError(null);
+
+    if (!validator.validate()) {
+      return;
+    }
+
+    const hosts = new Set<string>();
+    repoRules.forEach(rule => {
+      try {
+        const { host } = parseRepoAddress(rule.repoAddress);
+        hosts.add(host);
+      } catch (err) {
+        setHostError(InvalidHostError({ rule: rule.repoAddress, error: err }));
+      }
+    });
+
+    // ensure all repositories have the same host
+    if (hosts.size > 1) {
+      setHostError(MultipleHostsError);
+      return;
+    }
+
+    const isGitHubEnterpriseHost = [...hosts][0] !== GITHUB_HOST;
+    // ensure only enterprise users can use GitHub Enterprise Server Host
+    if (isGitHubEnterpriseHost && !cfg.isEnterprise) {
+      setHostError(EnterpriseHostError);
+      return;
+    }
+
+    createBot().then(success => {
+      if (success) {
+        nextStep?.();
+      }
+    });
+  }
+
+  function handleChange(
+    index: number,
+    field: keyof Rule,
+    value: Rule[typeof field]
+  ) {
+    const newRules = [...repoRules];
+    newRules[index] = { ...newRules[index], [field]: value };
+    setRepoRules(newRules);
+  }
+
+  return (
+    <Box>
+      <Validation>
+        {({ validator }) => (
+          <Box mt="3">
+            <H2 mb="3">Step 2: Input Your GitHub Account Info</H2>
+            <Text mb="3">
+              These fields will be combined with your bot's permissions to
+              create a join token and generate a sample GitHub Actions file.
+            </Text>
+
+            {repoRules.map((rule, i) => (
+              <Card p="4" maxWidth="540px" key={i} mb="4">
+                <Box>
+                  <Flex alignItems="center" justifyContent="space-between">
+                    <Text bold>GitHub Repository Access:</Text>
+                    {i > 0 && (
+                      <ButtonIcon
+                        size={1}
+                        title="Remove Rule"
+                        onClick={() =>
+                          setRepoRules(
+                            repoRules.filter((r, index) => index !== i)
+                          )
+                        }
+                      >
+                        <Icons.Trash size="medium" />
+                      </ButtonIcon>
+                    )}
+                  </Flex>
+                  <FormItem>
+                    <Text mt="3">Full URL to Your Repository*</Text>
+                    <FieldInput
+                      disabled={isLoading}
+                      rule={requireValidRepository}
+                      label=" "
+                      placeholder="https://github.com/gravitational/teleport"
+                      value={repoRules[i].repoAddress}
+                      onChange={e =>
+                        handleChange(i, 'repoAddress', e.target.value)
+                      }
+                    />
+                  </FormItem>
+
+                  <FormItem>
+                    <Flex>
+                      <Box width="100%">
+                        <Text>
+                          Git Ref <OptionalFieldText />
+                        </Text>
+                        <Input
+                          disabled={isLoading}
+                          placeholder="main"
+                          style={{ borderRadius: '4px 0 0 4px' }}
+                          value={repoRules[i].ref}
+                          onChange={e => handleChange(i, 'ref', e.target.value)}
+                        />
+                      </Box>
+                      <Box minWidth="160px">
+                        <Text ml="1">Ref Type</Text>
+                        <RefTypeSelect
+                          isDisabled={isLoading}
+                          isMulti={false}
+                          value={repoRules[i].refType}
+                          onChange={o => o && handleChange(i, 'refType', o)}
+                          options={refTypeOptions}
+                          menuPlacement="auto"
+                        />
+                      </Box>
+                    </Flex>
+                  </FormItem>
+
+                  <FormItem>
+                    <Text>
+                      Name of the GitHub Actions Workflow
+                      <OptionalFieldText />
+                    </Text>
+                    <FieldInput
+                      disabled={isLoading}
+                      placeholder="cd"
+                      value={repoRules[i].workflowName}
+                      onChange={e =>
+                        handleChange(i, 'workflowName', e.target.value)
+                      }
+                    />
+                  </FormItem>
+
+                  <FormItem>
+                    <Text>
+                      Environment <OptionalFieldText />
+                    </Text>
+                    <Input
+                      disabled={isLoading}
+                      placeholder="development"
+                      value={repoRules[i].environment}
+                      onChange={e =>
+                        handleChange(i, 'environment', e.target.value)
+                      }
+                    />
+                  </FormItem>
+
+                  <Box>
+                    <Text>
+                      Restrict to a GitHub User
+                      <OptionalFieldText />{' '}
+                    </Text>
+                    <Input
+                      disabled={isLoading}
+                      placeholder="octocat"
+                      value={repoRules[i].actor}
+                      onChange={e => handleChange(i, 'actor', e.target.value)}
+                    />
+                    <Text
+                      fontWeight="lighter"
+                      fontSize="1"
+                      style={{ fontStyle: 'italic' }}
+                    >
+                      If left blank, any GitHub user can trigger the workflow
+                    </Text>
+                  </Box>
+                </Box>
+              </Card>
+            ))}
+            <Box mb="4">
+              {attempt.status === 'failed' && (
+                <Alert kind="danger">{attempt.statusText}</Alert>
+              )}
+              {hostError && <Alert kind="danger">{hostError}</Alert>}
+              <ButtonSecondary disabled={isLoading} onClick={addEmptyRepoRule}>
+                + Add Another Set of Repository Rules
+              </ButtonSecondary>
+            </Box>
+            <FlowButtons
+              backButton={{
+                disabled: isLoading,
+                hidden: false,
+              }}
+              nextButton={{
+                disabled: isLoading,
+              }}
+              nextStep={() => handleNext(validator)}
+              prevStep={() => {
+                resetAttempt();
+                prevStep?.();
+              }}
+            />
+          </Box>
+        )}
+      </Validation>
+    </Box>
+  );
+}
+
+const RefTypeSelect = styled(Select<RefTypeOption>)`
+  .react-select__control {
+    border-radius: 0 4px 4px 0;
+    border-left-color: transparent;
+  }
+
+  .react-select__control--is-focused {
+    border-left-color: ${props =>
+      props.theme.colors.interactive.solid.primary.default};
+  }
+`;
+
+const FormItem = styled(Box)`
+  margin-bottom: ${props => props.theme.space[4]}px;
+  max-width: 500px;
+`;
+const OptionalFieldText = () => (
+  <Text
+    style={{ display: 'inline', lineHeight: '12px' }}
+    fontWeight="lighter"
+    fontSize="1"
+  >
+    {' '}
+    (optional)
+  </Text>
+);
+
+const MultipleHostsError = () => {
+  return (
+    <Text>
+      All repositories must be in the same host. Please create different bots
+      for each host.
+    </Text>
+  );
+};
+
+const EnterpriseHostError = () => {
+  return (
+    <Box>
+      GitHub Enterprise Server Host require Teleport Enterprise.Please use a
+      repository hosted at github.com or{' '}
+      <Link target="_blank" href="https://goteleport.com/signup/enterprise/">
+        contact us
+      </Link>
+      .
+    </Box>
+  );
+};
+const InvalidHostError = ({ rule, error }: { rule: string; error: string }) => {
+  return (
+    <Box>
+      Invalid address {rule}: {error}
+    </Box>
+  );
+};
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActions/Finish.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.test.tsx
similarity index 91%
rename from web/packages/teleport/src/Bots/Add/GitHubActions/Finish.test.tsx
rename to web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.test.tsx
index 648b1c0c2937e..ef3eea9293ea9 100644
--- a/web/packages/teleport/src/Bots/Add/GitHubActions/Finish.test.tsx
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.test.tsx
@@ -25,7 +25,7 @@ import cfg from 'teleport/config';
 import TeleportContext from 'teleport/teleportContext';
 
 import { Finish } from './Finish';
-import { GitHubFlowProvider, initialBotState } from './useGitHubFlow';
+import { GitHubSshFlowProvider, initialBotState } from './useGitHubSshFlow';
 
 describe('finish Component', () => {
   const setup = ({ botName }) => {
@@ -33,9 +33,9 @@ describe('finish Component', () => {
     render(
       <MemoryRouter>
         <ContextProvider ctx={ctx}>
-          <GitHubFlowProvider bot={{ ...initialBotState, botName }}>
+          <GitHubSshFlowProvider bot={{ ...initialBotState, botName }}>
             <Finish />
-          </GitHubFlowProvider>
+          </GitHubSshFlowProvider>
         </ContextProvider>
       </MemoryRouter>
     );
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.tsx
new file mode 100644
index 0000000000000..d0eabf8cfc830
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/Finish.tsx
@@ -0,0 +1,66 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Link } from 'react-router-dom';
+
+import { ButtonPrimary, ButtonSecondary } from 'design/Button';
+import Flex from 'design/Flex';
+import Image from 'design/Image';
+import Text, { H2 } from 'design/Text';
+
+import cfg from 'teleport/config';
+import celebratePamPng from 'teleport/Discover/Shared/Finished/celebrate-pam.png';
+
+import { useGitHubSshFlow } from './useGitHubSshFlow';
+
+export function Finish() {
+  const { createBotRequest } = useGitHubSshFlow();
+
+  return (
+    <Flex
+      width="600px"
+      flexDirection="column"
+      alignItems="center"
+      mt={5}
+      css={`
+        margin-right: auto;
+        margin-left: auto;
+        text-align: center;
+      `}
+    >
+      <Image width="120px" height="120px" src={celebratePamPng} />
+      <H2 mt={3} mb={2}>
+        Your Bot is Added to Teleport
+      </H2>
+      <Text mb={3}>
+        Bot {createBotRequest.botName} has been successfully added to this
+        Teleport Cluster. You can see {createBotRequest.botName} in the Bots
+        page and you can always find the sample GitHub Actions workflow again
+        from the bot's options.
+      </Text>
+      <Flex gap="4">
+        <ButtonPrimary as={Link} to={cfg.getBotsRoute()} size="large">
+          View Bots
+        </ButtonPrimary>
+        <ButtonSecondary as={Link} to={cfg.getBotsNewRoute()} size="large">
+          Add Another Bot
+        </ButtonSecondary>
+      </Flex>
+    </Flex>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.test.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.test.tsx
new file mode 100644
index 0000000000000..a26cda5fb321e
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.test.tsx
@@ -0,0 +1,142 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MemoryRouter } from 'react-router';
+
+import { render, screen, userEvent } from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport';
+import { allAccessAcl, noAccess } from 'teleport/mocks/contexts';
+import * as botService from 'teleport/services/bot/bot';
+import TeleportContext from 'teleport/teleportContext';
+
+import { GitHubActionsSsh } from './GitHubActionsSsh';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
+
+const tokenName = 'generated-test-token';
+const authVersion = 'v15.0.0';
+
+describe('gitHub component', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  type SetupProps = {
+    hasAccess?: boolean;
+  };
+
+  const setup = ({ hasAccess = true }: SetupProps) => {
+    const ctx = new TeleportContext();
+    ctx.storeUser.setState({
+      username: 'joe@example.com',
+      acl: hasAccess ? allAccessAcl : { ...allAccessAcl, bots: noAccess },
+      cluster: {
+        authVersion: authVersion,
+        clusterId: 'cluster-id',
+        connectedText: 'connected-text',
+        lastConnected: new Date('2023-01-01'),
+        proxyVersion: 'v15.0.0',
+        publicURL: 'publicurl',
+        status: 'ok',
+        url: 'url',
+      },
+    });
+
+    jest.spyOn(ctx.resourceService, 'createRole').mockResolvedValue({
+      id: 'role-id',
+      kind: 'role',
+      name: 'role-name',
+      content: '',
+    });
+    jest.spyOn(ctx.joinTokenService, 'fetchJoinToken').mockResolvedValue({
+      id: tokenName,
+      expiry: new Date('2020-01-01'),
+      safeName: '',
+      isStatic: false,
+      method: 'kubernetes',
+      roles: [],
+      content: '',
+    });
+    jest.spyOn(botService, 'createBot').mockResolvedValue();
+    jest.spyOn(botService, 'createBotToken').mockResolvedValue({
+      integrationName: 'test-integration',
+      joinMethod: 'github',
+      webFlowLabel: 'github-actions-ssh',
+    });
+    jest.spyOn(botService, 'getBot').mockResolvedValue(null);
+
+    render(
+      <MemoryRouter>
+        <ContextProvider ctx={ctx}>
+          <GitHubSshFlowProvider>
+            <GitHubActionsSsh />
+          </GitHubSshFlowProvider>
+        </ContextProvider>
+      </MemoryRouter>
+    );
+  };
+
+  it('renders initial state with warning if user has no access', () => {
+    setup({ hasAccess: false });
+    expect(screen.getByText(/Insufficient permissions/)).toBeInTheDocument();
+    expect(screen.getByTestId('button-next')).toBeDisabled();
+    expect(screen.getByTestId('button-back-first-step')).toBeEnabled();
+  });
+
+  it('renders initial state with no warnings if user the necessary access', () => {
+    setup({});
+    expect(
+      screen.queryByText(/Insufficient permissions/)
+    ).not.toBeInTheDocument();
+    expect(screen.getByTestId('button-next')).toBeEnabled();
+  });
+
+  it('allows the user to go through the whole flow', async () => {
+    setup({});
+    expect(
+      screen.getByText(/Step 1: Scope the Permissions for Your Bot/)
+    ).toBeInTheDocument();
+    // fill up the forms and go through the flow
+    // step 1: Configure Bot Access
+    const botNameInput = screen.getByPlaceholderText('github-actions-cd');
+    await userEvent.type(botNameInput, 'bot-name');
+    const sshUserInput = screen.getByPlaceholderText('ubuntu');
+    await userEvent.type(sshUserInput, 'ssh-user');
+    await userEvent.click(screen.getByTestId('button-next'));
+    // step 2: Connect GitHub
+    expect(
+      screen.getByText(/Step 2: Input Your GitHub Account Info/)
+    ).toBeInTheDocument();
+    const repositoryInput = screen.getByPlaceholderText(
+      'https://github.com/gravitational/teleport'
+    );
+    await userEvent.type(repositoryInput, 'https://github.com/owner/repo');
+    await userEvent.click(screen.getByTestId('button-next'));
+    // step 3: Add Bot to GitHub
+    expect(
+      screen.getByText(/Step 3: Connect Your Bot in a GitHub Actions Workflow/)
+    ).toBeInTheDocument();
+    await userEvent.click(screen.getByTestId('button-next'));
+    // Finish screen
+    expect(
+      screen.getByText(/Your Bot is Added to Teleport/)
+    ).toBeInTheDocument();
+    expect(screen.getByText(/View Bots/)).toBeInTheDocument();
+    expect(screen.getByText(/Add Another Bot/)).toBeInTheDocument();
+  });
+});
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.tsx
new file mode 100644
index 0000000000000..9d8dd2fac3b77
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/GitHubActionsSsh.tsx
@@ -0,0 +1,57 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { ResourceIcon } from 'design/ResourceIcon';
+
+import { GuidedFlow, View } from '../Shared/GuidedFlow';
+import { AddBotToWorkflow } from './AddBotToWorkflow';
+import { ConfigureBot } from './ConfigureBot';
+import { ConnectGitHub } from './ConnectGitHub';
+import { Finish } from './Finish';
+import { GitHubSshFlowProvider } from './useGitHubSshFlow';
+
+const views: View[] = [
+  {
+    name: 'Configure Bot Access',
+    component: ConfigureBot,
+  },
+  {
+    name: 'Connect GitHub',
+    component: ConnectGitHub,
+  },
+  {
+    name: 'Add Bot to GitHub',
+    component: AddBotToWorkflow,
+  },
+  {
+    name: 'Finish',
+    component: Finish,
+  },
+];
+
+export function GitHubActionsSsh() {
+  return (
+    <GitHubSshFlowProvider>
+      <GuidedFlow
+        title="GitHub Actions and Machine ID Integration"
+        icon={<ResourceIcon name="github" width="20px" />}
+        views={views}
+        name="GitHub Actions + SSH"
+      />
+    </GitHubSshFlowProvider>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/index.ts b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/index.ts
new file mode 100644
index 0000000000000..248397a1cb82d
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/index.ts
@@ -0,0 +1,20 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { GitHubActionsSsh as default } from './GitHubActionsSsh';
+export { ConnectGitHub as ConfigureBot } from './ConnectGitHub';
diff --git a/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/useGitHubSshFlow.tsx b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/useGitHubSshFlow.tsx
new file mode 100644
index 0000000000000..801a57571f4ea
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/GitHubActionsSsh/useGitHubSshFlow.tsx
@@ -0,0 +1,246 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React, { useContext, useState } from 'react';
+
+import useAttempt, { Attempt } from 'shared/hooks/useAttemptNext';
+import { getErrorMessage } from 'shared/utils/error';
+
+import { ResourceLabel } from 'teleport/services/agents';
+import auth from 'teleport/services/auth';
+import {
+  createBotToken,
+  GITHUB_ACTIONS_LABEL_KEY,
+  createBot as serviceCreateBot,
+} from 'teleport/services/bot';
+import {
+  BotUiFlow,
+  CreateBotRequest,
+  GitHubRepoRule,
+} from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
+
+import { GITHUB_HOST, parseRepoAddress, RefTypeOption } from '../Shared/github';
+
+const GITHUB_ACTIONS_LABEL_VAL = BotUiFlow.GitHubActionsSsh;
+
+type GitHubFlowContext = {
+  attempt: Attempt;
+  createBotRequest: CreateBotRequest;
+  setCreateBotRequest: React.Dispatch<React.SetStateAction<CreateBotRequest>>;
+  repoRules: Rule[];
+  setRepoRules: React.Dispatch<React.SetStateAction<Rule[]>>;
+  addEmptyRepoRule: () => void;
+  tokenName: string;
+  createBot: () => Promise<boolean>;
+  resetAttempt: () => void;
+};
+
+const noop = () => {};
+const gitHubFlowContext = React.createContext<GitHubFlowContext>({
+  addEmptyRepoRule: noop,
+  attempt: {
+    status: '',
+    statusText: undefined,
+    statusCode: undefined,
+  },
+  createBotRequest: {
+    botName: '',
+    labels: [],
+    roles: [],
+    login: '',
+  },
+  setCreateBotRequest: noop,
+  repoRules: [],
+  setRepoRules: noop,
+  tokenName: '',
+  createBot: () => Promise.reject('noop'),
+  resetAttempt: noop,
+});
+
+export const initialBotState = {
+  labels: [{ name: '*', value: '*' }],
+  login: '',
+  botName: '',
+  roles: [],
+};
+
+export function GitHubSshFlowProvider({
+  children,
+  bot = initialBotState,
+}: React.PropsWithChildren<{ bot?: CreateBotRequest }>) {
+  const { resourceService } = useTeleport();
+  const { attempt, setAttempt } = useAttempt();
+  const [createBotRequest, setCreateBotRequest] =
+    useState<CreateBotRequest>(bot);
+  const [repoRules, setRepoRules] = useState<Rule[]>([defaultRule]);
+  const [tokenName, setTokenName] = useState('');
+
+  function addEmptyRepoRule() {
+    setRepoRules([...repoRules, defaultRule]);
+  }
+
+  function resetAttempt() {
+    if (attempt.status !== 'processing') {
+      setAttempt({ status: '' });
+    }
+  }
+
+  // setting attempt to "success" is skipped because
+  // it saves a re-render caused by it since
+  // after the fetch is successful, we render the
+  // finish step.
+  async function createBot(): Promise<boolean> {
+    setAttempt({ status: 'processing' });
+
+    try {
+      // Re-authn once, so we can re-use it for other actions
+      // that require re-authn.
+      const mfaResponse = await auth.getMfaChallengeResponseForAdminAction(
+        true /* allow re-use */
+      );
+
+      await resourceService.createRole(
+        getRoleYaml(
+          createBotRequest.botName,
+          createBotRequest.labels,
+          createBotRequest.login
+        ),
+        mfaResponse
+      );
+
+      let repoHost = '';
+      // Check if user sent a GitHub Enterprise host address.
+      // We can just check the first rule, as the UI will not allow
+      // using different hosts on multiple rules.
+      if (repoRules.length > 0) {
+        const { host } = parseRepoAddress(repoRules[0].repoAddress);
+        // the enterprise server host should be omited if using github.com
+        if (host !== GITHUB_HOST) {
+          repoHost = host;
+        }
+      }
+
+      const token = await createBotToken(
+        {
+          integrationName: createBotRequest.botName,
+          joinMethod: 'github',
+          webFlowLabel: GITHUB_ACTIONS_LABEL_VAL,
+          gitHub: {
+            enterpriseServerHost: repoHost,
+            allow: repoRules.map((r): GitHubRepoRule => {
+              const { owner, repository } = parseRepoAddress(r.repoAddress);
+              return {
+                repository: `${owner}/${repository}`,
+                repositoryOwner: owner,
+                actor: r.actor,
+                environment: r.environment,
+                ref: r.ref,
+                refType: r.refType.value || undefined,
+                workflow: r.workflowName,
+              };
+            }),
+          },
+        },
+        mfaResponse
+      );
+      setTokenName(token.id);
+
+      await serviceCreateBot(
+        {
+          ...createBotRequest,
+          roles: [createBotRequest.botName],
+        },
+        mfaResponse
+      );
+
+      return true; // successful
+    } catch (err) {
+      setAttempt({ status: 'failed', statusText: getErrorMessage(err) });
+      return false; // unsuccessful
+    }
+  }
+
+  const value: GitHubFlowContext = {
+    attempt,
+    createBotRequest,
+    setCreateBotRequest,
+    repoRules,
+    setRepoRules,
+    addEmptyRepoRule,
+    tokenName,
+    createBot,
+    resetAttempt,
+  };
+
+  return (
+    <gitHubFlowContext.Provider value={value}>
+      {children}
+    </gitHubFlowContext.Provider>
+  );
+}
+
+export function useGitHubSshFlow(): GitHubFlowContext {
+  return useContext(gitHubFlowContext);
+}
+
+export type Rule = {
+  workflowName: string;
+  environment: string;
+  ref: string;
+  refType: RefTypeOption;
+  repoAddress: string;
+  actor: string;
+};
+
+export const defaultRule: Rule = {
+  workflowName: '',
+  environment: '',
+  ref: '',
+  refType: { label: 'any', value: '' },
+  repoAddress: '',
+  actor: '',
+};
+
+function getRoleYaml(
+  botName: string,
+  labels: ResourceLabel[],
+  login: string
+): string {
+  const nodeLabels = labels
+    .map(label => `'${label.name}': '${label.value}'`)
+    .join('\n      ');
+
+  return `kind: role
+metadata:
+  name: ${botName}
+  labels:
+    ${GITHUB_ACTIONS_LABEL_KEY}: ${GITHUB_ACTIONS_LABEL_VAL}
+spec:
+  allow:
+    # List of allowed SSH logins
+    logins: [${login}]
+
+    # List of node labels that users can SSH into
+    node_labels:
+      ${nodeLabels}
+    options:
+      max_session_ttl: 8h0m0s
+version: v7
+  `;
+}
diff --git a/web/packages/teleport/src/Bots/Add/Shared/GuidedFlow.tsx b/web/packages/teleport/src/Bots/Add/Shared/GuidedFlow.tsx
index beef99bbc0e3c..633b0b269b1ee 100644
--- a/web/packages/teleport/src/Bots/Add/Shared/GuidedFlow.tsx
+++ b/web/packages/teleport/src/Bots/Add/Shared/GuidedFlow.tsx
@@ -35,7 +35,7 @@ export type View = {
 
 export type FlowProps = {
   name: string;
-  title: string;
+  title?: string;
   views: View[];
   icon: JSX.Element;
 };
@@ -65,7 +65,7 @@ export function GuidedFlow({ name, title, views, icon }: FlowProps) {
 
   return (
     <>
-      <Flex pt="3">
+      <Flex pt="3" pb="4">
         {icon}
         <Text bold ml="2" mr="4">
           {name}
@@ -75,9 +75,7 @@ export function GuidedFlow({ name, title, views, icon }: FlowProps) {
           views={views.map(v => ({ title: v.name }))}
         />
       </Flex>
-      <H1 mt="4" mb="3">
-        {title}
-      </H1>
+      {title && <H1 mb="3">{title}</H1>}
       <Component nextStep={handleNextStep} prevStep={handlePrevStep} />
     </>
   );
diff --git a/web/packages/teleport/src/Bots/Add/Shared/github.test.ts b/web/packages/teleport/src/Bots/Add/Shared/github.test.ts
new file mode 100644
index 0000000000000..7e0e4e6144eb6
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/github.test.ts
@@ -0,0 +1,90 @@
+/**
+ * Teleport
+ * Copyright (C) 20024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { parseRepoAddress } from './github';
+
+describe('parseRepoAddress', () => {
+  describe('parseRepoAddress with valid inputs', () => {
+    const testCases = [
+      {
+        url: 'https://github.com/gravitational/teleport',
+        expected: {
+          host: 'github.com',
+          owner: 'gravitational',
+          repository: 'teleport',
+        },
+      },
+      {
+        url: 'github.com/gravitational/teleport',
+        expected: {
+          host: 'github.com',
+          owner: 'gravitational',
+          repository: 'teleport',
+        },
+      },
+      {
+        url: 'https://www.example.com/company/project',
+        expected: {
+          host: 'www.example.com',
+          owner: 'company',
+          repository: 'project',
+        },
+      },
+      {
+        url: 'www.example.com/company/project',
+        expected: {
+          host: 'www.example.com',
+          owner: 'company',
+          repository: 'project',
+        },
+      },
+    ];
+    test.each(testCases)(
+      'should return repo="$expected" for url=$url',
+      ({ url, expected }) => {
+        const result = parseRepoAddress(url);
+        expect(result).toEqual(expected);
+      }
+    );
+  });
+
+  describe('parseRepoAddress throws with invalid inputs', () => {
+    const testCases = [
+      {
+        url: 'https://github.com',
+        expectedErr:
+          'URL expected to be in the format https://<host>/<owner>/<repository>',
+      },
+      {
+        url: 'https://github.com/owner',
+        expectedErr:
+          'URL expected to be in the format https://<host>/<owner>/<repository>',
+      },
+      {
+        url: 'invalid URL',
+        expectedErr: 'Must be a valid URL',
+      },
+    ];
+    test.each(testCases)(
+      'should throw with message="$expectedErr" for url=$url',
+      ({ url, expectedErr }) => {
+        expect(() => parseRepoAddress(url)).toThrow(expectedErr);
+      }
+    );
+  });
+});
diff --git a/web/packages/teleport/src/Bots/Add/Shared/github.ts b/web/packages/teleport/src/Bots/Add/Shared/github.ts
new file mode 100644
index 0000000000000..1912a19bd373b
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/github.ts
@@ -0,0 +1,118 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Option } from 'shared/components/Select';
+import { Rule } from 'shared/components/Validation/rules';
+
+import { RefType } from 'teleport/services/bot/types';
+
+export const GITHUB_HOST = 'github.com';
+
+export type RefTypeOption = Option<RefType | ''>;
+
+export const refTypeOptions: RefTypeOption[] = [
+  {
+    label: 'any',
+    value: '',
+  },
+  {
+    label: 'Branch',
+    value: 'branch',
+  },
+  {
+    label: 'Tag',
+    value: 'tag',
+  },
+];
+
+/**
+ * Parses the GitHub repository URL and returns the repository name and
+ * its owner's name. Throws errors if parsing the URL fails or
+ * the URL doesn't contains the expected format.
+ * @param repoAddr repository address (with or without protocl)
+ * @returns owner and repository name
+ */
+export function parseRepoAddress(repoAddr: string): {
+  host: string;
+  owner: string;
+  repository: string;
+} {
+  // add protocol if it is missing
+  if (!repoAddr.startsWith('http://') && !repoAddr.startsWith('https://')) {
+    repoAddr = `https://${repoAddr}`;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(repoAddr);
+  } catch (error) {
+    throw new Error('Must be a valid URL', { cause: error });
+  }
+
+  const paths = url.pathname.split('/');
+  // expected length is 3, since pathname starts with a /, so paths[0] should be empty
+  if (paths.length < 3) {
+    throw new Error(
+      'URL expected to be in the format https://<host>/<owner>/<repository>'
+    );
+  }
+
+  const owner = paths[1];
+  const repository = paths[2];
+  if (owner.trim() === '' || repository.trim() == '') {
+    throw new Error(
+      'URL expected to be in the format https://<host>/<owner>/<repository>'
+    );
+  }
+
+  return {
+    host: url.host,
+    owner,
+    repository,
+  };
+}
+
+export const requireValidRepository: Rule = value => () => {
+  if (!value) {
+    return { valid: false, message: 'Repository is required' };
+  }
+  let repoAddr = value.trim();
+  if (!repoAddr) {
+    return { valid: false, message: 'Repository is required' };
+  }
+
+  // add protocol if user omited it
+  if (!repoAddr.startsWith('http://') && !repoAddr.startsWith('https://')) {
+    repoAddr = `https://${repoAddr}`;
+  }
+
+  try {
+    const { owner, repository } = parseRepoAddress(repoAddr);
+    if (owner.trim() === '' || repository.trim() == '') {
+      return {
+        valid: false,
+        message:
+          'URL expected to be in the format https://<host>/<owner>/<repository>',
+      };
+    }
+
+    return { valid: true };
+  } catch (e) {
+    return { valid: false, message: e?.message };
+  }
+};
diff --git a/web/packages/teleport/src/Bots/Add/Shared/kubernetes.test.ts b/web/packages/teleport/src/Bots/Add/Shared/kubernetes.test.ts
new file mode 100644
index 0000000000000..0efb579dedf80
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/kubernetes.test.ts
@@ -0,0 +1,185 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { makeKubernetesAccessChecker } from './kubernetes';
+
+describe('prepareKubernetesAccessChecker', () => {
+  test('zero labels', async () => {
+    const checker = makeKubernetesAccessChecker([]);
+
+    expect(checker.check([])).toBeFalsy();
+    expect(checker.check([{ name: '*', value: '*' }])).toBeFalsy();
+  });
+
+  describe('literals', () => {
+    test('single', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['bar'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+    });
+
+    test('multiple', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['bar', 'baz'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'box' }])).toBeFalsy();
+    });
+  });
+
+  describe('wildcards', () => {
+    test('single', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['ba*'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'box' }])).toBeFalsy();
+    });
+
+    test('multiple', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['bar*', 'baz', 'b*x'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'box' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bot' }])).toBeFalsy();
+    });
+
+    test('special', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: '*',
+          values: ['*'],
+        },
+        {
+          name: 'never',
+          values: ['never'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'bar', value: 'baz' }])).toBeTruthy();
+    });
+  });
+
+  describe('regex', () => {
+    test('single', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['^ba(z|r)$'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'box' }])).toBeFalsy();
+    });
+    test('multiple', async () => {
+      const checker = makeKubernetesAccessChecker([
+        {
+          name: 'foo',
+          values: ['^ba(z|r)$', '^bo(x|y)$'],
+        },
+      ]);
+
+      expect(checker.check([])).toBeFalsy();
+      expect(checker.check([{ name: 'foo', value: 'baz' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bar' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'box' }])).toBeTruthy();
+      expect(checker.check([{ name: 'foo', value: 'bot' }])).toBeFalsy();
+    });
+  });
+
+  test('combination', async () => {
+    const checker = makeKubernetesAccessChecker([
+      {
+        name: 'region',
+        values: ['us-west-*'],
+      },
+      {
+        name: 'env',
+        values: ['^(dev|staging)-[0-9]+$'],
+      },
+      {
+        name: 'cloud',
+        values: ['aws', 'gcp'],
+      },
+    ]);
+
+    expect(checker.check([])).toBeFalsy();
+    expect(checker.check([{ name: 'region', value: 'us-west-1' }])).toBeFalsy();
+    expect(checker.check([{ name: 'env', value: 'dev-01' }])).toBeFalsy();
+    expect(checker.check([{ name: 'cloud', value: 'gcp' }])).toBeFalsy();
+    expect(
+      checker.check([
+        { name: 'region', value: 'us-west-1' },
+        { name: 'env', value: 'dev-01' },
+        { name: 'cloud', value: 'gcp' },
+      ])
+    ).toBeTruthy();
+    expect(
+      checker.check([
+        { name: 'region', value: 'eu-west-1' },
+        { name: 'env', value: 'dev-01' },
+        { name: 'cloud', value: 'gcp' },
+      ])
+    ).toBeFalsy();
+    expect(
+      checker.check([
+        { name: 'region', value: 'us-west-1' },
+        { name: 'env', value: 'staging-abc' },
+        { name: 'cloud', value: 'gcp' },
+      ])
+    ).toBeFalsy();
+    expect(
+      checker.check([
+        { name: 'region', value: 'us-west-1' },
+        { name: 'env', value: 'dev-01' },
+        { name: 'cloud', value: 'azure' },
+      ])
+    ).toBeFalsy();
+  });
+});
diff --git a/web/packages/teleport/src/Bots/Add/Shared/kubernetes.ts b/web/packages/teleport/src/Bots/Add/Shared/kubernetes.ts
new file mode 100644
index 0000000000000..d84e81e1c76df
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/kubernetes.ts
@@ -0,0 +1,104 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * `makeKubernetesAccessChecker` creates a checker from the provided labels. Regexes are
+ * compiled and reused for subsequent checks.
+ *
+ * Mimics the backend logic and should be kept in sync;
+ *  - lib/services/role.go:1204
+ *
+ * Label names are always treated as literals and must match fully.
+ *
+ * Label values can be literals, wildcards or regex;
+ * - literals - must match fully (e.g. "dev" matches "dev")
+ * - wildcards - can use * to match chunks of zero of more characters (e.g. "us-*-*" matches "us-west-1" and "us-east-2")
+ * - regex - regular expression match (e.g. "^(uat|prod)-[0-9]+$")
+ *
+ * A special combination of *: * (name: value) matches everything even empty target set.
+ */
+export function makeKubernetesAccessChecker(selected: KubernetesLabel[]) {
+  const items = selected.map(s => {
+    return {
+      name: s.name,
+      orMatches: s.values.map(v => {
+        let wildcard: RegExp | null = null;
+        let regex: RegExp | null = null;
+        if (v.includes('*')) {
+          try {
+            wildcard = new RegExp(`^${v.replaceAll('*', '.*')}$`);
+          } catch (e) {
+            if (!(e instanceof SyntaxError)) {
+              throw e;
+            }
+            // Ignore regex syntax errors
+          }
+        } else {
+          try {
+            regex = new RegExp(v);
+          } catch (e) {
+            if (!(e instanceof SyntaxError)) {
+              throw e;
+            }
+            // Ignore regex syntax errors
+          }
+        }
+        return {
+          literal: v,
+          wildcard,
+          regex,
+        };
+      }),
+    };
+  });
+  const hasFullWildcard = selected.some(
+    s => s.name === '*' && s.values.some(v => v === '*')
+  );
+  return {
+    check(labels: { name: string; value: string }[]) {
+      if (hasFullWildcard) {
+        return true;
+      }
+      return (
+        items.length > 0 &&
+        items.every(cs => {
+          const label = labels.find(l => l.name === cs.name);
+          return (
+            !!label &&
+            cs.orMatches.some(c => {
+              const match =
+                c.literal === label.value ||
+                c.wildcard?.test(label.value) ||
+                c.regex?.test(label.value);
+              return match;
+            })
+          );
+        })
+      );
+    },
+  };
+}
+
+export type KubernetesLabel = { name: string; values: string[] };
+
+export type KubernetesResourceRule = {
+  kind: string;
+  name: string;
+  namespace: string;
+  verbs: string[];
+};
diff --git a/web/packages/teleport/src/Bots/Add/Shared/trackingTester.ts b/web/packages/teleport/src/Bots/Add/Shared/trackingTester.ts
new file mode 100644
index 0000000000000..7026e76a9a6fd
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/trackingTester.ts
@@ -0,0 +1,119 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { userEventService } from 'teleport/services/userEvent';
+
+beforeAll(() => {
+  jest.spyOn(userEventService, 'captureIntegrationEnrollEvent');
+});
+
+afterEach(() => {
+  jest.mocked(userEventService.captureIntegrationEnrollEvent).mockClear();
+});
+
+export function trackingTester() {
+  let nextIndex = 0;
+
+  const assertTracking = (data: unknown) => {
+    const { calls } = jest.mocked(
+      userEventService.captureIntegrationEnrollEvent
+    ).mock;
+
+    const call = calls[nextIndex];
+    if (!call) {
+      throw new Error('expected a tracking call but received none');
+    }
+
+    expect(call[0]).toStrictEqual(data);
+
+    nextIndex += 1;
+  };
+
+  return {
+    skip: (count: number = 1) => {
+      nextIndex += count;
+    },
+    assertStart(eventId: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.start',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+        },
+      });
+    },
+    assertComplete(eventId: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.complete',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+        },
+      });
+    },
+    assertStep(eventId: string, step: string, status: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.step',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+          step,
+          status: {
+            code: status,
+          },
+        },
+      });
+    },
+    assertError(eventId: string, step: string, error: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.step',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+          step,
+          status: {
+            code: 'INTEGRATION_ENROLL_STATUS_CODE_ERROR',
+            error,
+          },
+        },
+      });
+    },
+    assertField(eventId: string, step: string, field: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.fieldComplete',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+          step,
+          field,
+        },
+      });
+    },
+    assertSection(eventId: string, step: string, section: string) {
+      assertTracking({
+        event: 'tp.ui.integrationEnroll.sectionOpen',
+        eventData: {
+          id: eventId,
+          kind: 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
+          step,
+          section,
+        },
+      });
+    },
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Add/Shared/useTracking.tsx b/web/packages/teleport/src/Bots/Add/Shared/useTracking.tsx
new file mode 100644
index 0000000000000..7033102535af4
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Add/Shared/useTracking.tsx
@@ -0,0 +1,212 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  createContext,
+  PropsWithChildren,
+  useContext,
+  useMemo,
+  useRef,
+} from 'react';
+
+import { debounce } from 'shared/utils/highbar';
+
+import {
+  IntegrationEnrollCodeType,
+  IntegrationEnrollEvent,
+  IntegrationEnrollEventData,
+  IntegrationEnrollField,
+  IntegrationEnrollKind,
+  IntegrationEnrollSection,
+  IntegrationEnrollStatusCode,
+  IntegrationEnrollStep,
+} from 'teleport/services/userEvent/types';
+import { userEventService } from 'teleport/services/userEvent/userEvent';
+
+export function useTracking() {
+  const ctx = useContext(context);
+  if (!ctx) {
+    throw new Error(
+      'Tracking not implemented, do you need to add a TrackingProvider?'
+    );
+  }
+  return ctx;
+}
+
+export function TrackingProvider(
+  props: { initialEventId?: string; disabled?: boolean } & PropsWithChildren
+) {
+  const { initialEventId = crypto.randomUUID(), disabled = false } = props;
+
+  // Changes to the eventId should not cause a re-render.
+  const eventId = useRef(initialEventId);
+
+  const debouncedField = useRef(
+    debounce(
+      (
+        eventId: string,
+        step: IntegrationEnrollStep,
+        field: IntegrationEnrollField
+      ) => {
+        return sendEvent(IntegrationEnrollEvent.FieldComplete, {
+          id: eventId,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          field,
+        });
+      },
+      1000
+    )
+  );
+
+  // Keep a stable value as this is likely to be used in effects
+  const value = useMemo(
+    () => ({
+      reset(newId?: string) {
+        eventId.current = newId || crypto.randomUUID();
+      },
+      start() {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.Started, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+        });
+      },
+      complete() {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.Complete, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+        });
+      },
+      step(
+        step: IntegrationEnrollStep,
+        status: Exclude<
+          IntegrationEnrollStatusCode,
+          IntegrationEnrollStatusCode.Error
+        >
+      ) {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.Step, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          status: {
+            code: status,
+          },
+        });
+      },
+      error(step: IntegrationEnrollStep, error: string) {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.Step, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          status: {
+            code: IntegrationEnrollStatusCode.Error,
+            error,
+          },
+        });
+      },
+      field(
+        step: IntegrationEnrollStep,
+        field: IntegrationEnrollField,
+        isEmpty?: boolean
+      ) {
+        if (disabled || isEmpty) return;
+        return debouncedField.current(eventId.current, step, field);
+      },
+      section(step: IntegrationEnrollStep, section: IntegrationEnrollSection) {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.SectionOpen, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          section,
+        });
+      },
+      link(step: IntegrationEnrollStep, link: string) {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.LinkClick, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          link,
+        });
+      },
+      codeCopy(
+        step: IntegrationEnrollStep,
+        codeType: IntegrationEnrollCodeType
+      ) {
+        if (disabled) return;
+        return sendEvent(IntegrationEnrollEvent.CodeCopy, {
+          id: eventId.current,
+          kind: IntegrationEnrollKind.MachineIDGitHubActionsKubernetes,
+          step,
+          codeType,
+        });
+      },
+    }),
+    [disabled]
+  );
+
+  return <context.Provider value={value}>{props.children}</context.Provider>;
+}
+
+function sendEvent(
+  event: IntegrationEnrollEvent,
+  eventData: IntegrationEnrollEventData
+) {
+  userEventService.captureIntegrationEnrollEvent({
+    event,
+    eventData,
+  });
+}
+
+type Context = {
+  start: () => void;
+  complete: () => void;
+  step: (
+    step: IntegrationEnrollStep,
+    statusCode: IntegrationEnrollStatusCode
+  ) => void;
+  error: (step: IntegrationEnrollStep, error: string) => void;
+  /**
+   * Track when a field's value changes. This call is debounced across all
+   * fields.
+   * @param step The step in the guide where the field appears
+   * @param field The field's identifier
+   * @param isEmpty If the field has no input
+   */
+  field: (
+    step: IntegrationEnrollStep,
+    field: IntegrationEnrollField,
+    isEmpty?: boolean
+  ) => void;
+  section: (
+    step: IntegrationEnrollStep,
+    section: IntegrationEnrollSection
+  ) => void;
+  link: (step: IntegrationEnrollStep, link: string) => void;
+  codeCopy: (
+    step: IntegrationEnrollStep,
+    codeType: IntegrationEnrollCodeType
+  ) => void;
+};
+
+const context = createContext<Context | null>(null);
diff --git a/web/packages/teleport/src/Bots/Delete/DeleteDialog.test.tsx b/web/packages/teleport/src/Bots/Delete/DeleteDialog.test.tsx
new file mode 100644
index 0000000000000..a280971870ff5
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Delete/DeleteDialog.test.tsx
@@ -0,0 +1,204 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+
+import {
+  Providers,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+} from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { deleteBotError, deleteBotSuccess } from 'teleport/test/helpers/bots';
+
+import { DeleteDialog } from './DeleteDialog';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('DeleteDialog', () => {
+  it('should render correctly', async () => {
+    renderComponent();
+    expect(screen.getByText('Delete test-bot-name?')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Alternatively, you can lock a bot to stop all of its activity immediately.'
+      )
+    ).toBeInTheDocument();
+    expect(screen.getByText('Delete Bot')).toBeEnabled();
+    expect(screen.getByText('Cancel')).toBeEnabled();
+    expect(screen.getByText('Lock Bot')).toBeEnabled();
+  });
+
+  it('should cancel', async () => {
+    const onCancel = jest.fn();
+    const { user } = renderComponent({
+      onCancel,
+    });
+    await user.click(screen.getByText('Cancel'));
+    expect(onCancel).toHaveBeenCalled();
+  });
+
+  it('should request lock', async () => {
+    const onLockRequest = jest.fn();
+    const { user } = renderComponent({
+      onLockRequest,
+    });
+    await user.click(screen.getByText('Lock Bot'));
+    expect(onLockRequest).toHaveBeenCalled();
+  });
+
+  it('should disable request lock', async () => {
+    const onLockRequest = jest.fn();
+    const { user } = renderComponent({
+      onLockRequest,
+      canLockBot: false,
+    });
+    await user.click(screen.getByText('Lock Bot'));
+    expect(onLockRequest).not.toHaveBeenCalled();
+    expect(screen.getByText('Lock Bot')).toBeDisabled();
+  });
+
+  it('should hide request lock', async () => {
+    renderComponent({
+      showLockAlternative: false,
+    });
+    expect(
+      screen.queryByText(
+        'Alternatively, you can lock a bot to stop all of its activity immediately.'
+      )
+    ).not.toBeInTheDocument();
+    expect(screen.queryByText('Lock Bot')).not.toBeInTheDocument();
+  });
+
+  it('should submit', async () => {
+    withDeleteBotSuccess();
+    const onComplete = jest.fn();
+    const { user } = renderComponent({
+      onComplete,
+    });
+    await user.click(screen.getByText('Delete Bot'));
+    await waitFor(
+      () => {
+        expect(onComplete).toHaveBeenCalled();
+      },
+      { timeout: 5000 }
+    );
+  });
+
+  it('should show submit error', async () => {
+    withDeleteBotError();
+    const onComplete = jest.fn();
+    const { user } = renderComponent({
+      onComplete,
+    });
+    await user.click(screen.getByText('Delete Bot'));
+    await waitFor(() => {
+      expect(screen.getByText('something went wrong')).toBeInTheDocument();
+    });
+    expect(onComplete).not.toHaveBeenCalled();
+  });
+});
+
+function renderComponent(options?: {
+  onCancel?: () => void;
+  onComplete?: () => void;
+  customAcl?: ReturnType<typeof makeAcl>;
+  showLockAlternative?: boolean;
+  canLockBot?: boolean;
+  onLockRequest?: () => void;
+}) {
+  const {
+    onCancel = jest.fn(),
+    onComplete = jest.fn(),
+    customAcl,
+    showLockAlternative = true,
+    canLockBot = true,
+    onLockRequest = jest.fn(),
+  } = options ?? {};
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <DeleteDialog
+        botName="test-bot-name"
+        onCancel={onCancel}
+        onComplete={onComplete}
+        showLockAlternative={showLockAlternative}
+        canLockBot={canLockBot}
+        onLockRequest={onLockRequest}
+      />,
+      { wrapper: makeWrapper({ customAcl }) }
+    ),
+    user,
+  };
+}
+
+function makeWrapper(params?: { customAcl?: ReturnType<typeof makeAcl> }) {
+  const {
+    customAcl = makeAcl({
+      bots: {
+        ...defaultAccess,
+        read: true,
+        edit: true,
+      },
+      roles: {
+        ...defaultAccess,
+        list: true,
+      },
+    }),
+  } = params ?? {};
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <Providers>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          {children}
+        </TeleportProviderBasic>
+      </Providers>
+    );
+  };
+}
+
+function withDeleteBotSuccess() {
+  server.use(deleteBotSuccess());
+}
+
+function withDeleteBotError() {
+  server.use(deleteBotError(500, 'something went wrong'));
+}
diff --git a/web/packages/teleport/src/Bots/Delete/DeleteDialog.tsx b/web/packages/teleport/src/Bots/Delete/DeleteDialog.tsx
new file mode 100644
index 0000000000000..309d9771e684e
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Delete/DeleteDialog.tsx
@@ -0,0 +1,137 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMutation } from '@tanstack/react-query';
+
+import { Alert } from 'design/Alert/Alert';
+import {
+  ButtonSecondary,
+  ButtonWarning,
+  ButtonWarningBorder,
+} from 'design/Button/Button';
+import { Dialog } from 'design/Dialog/Dialog';
+import DialogContent from 'design/Dialog/DialogContent';
+import DialogFooter from 'design/Dialog/DialogFooter';
+import DialogHeader from 'design/Dialog/DialogHeader';
+import DialogTitle from 'design/Dialog/DialogTitle';
+import Flex from 'design/Flex';
+import { P } from 'design/Text/Text';
+import { wait } from 'shared/utils/wait';
+
+import { deleteBot } from 'teleport/services/bot/bot';
+
+export function DeleteDialog(props: {
+  botName: string;
+  /**
+   * Called when the user cancels the delete operation.
+   */
+  onCancel: () => void;
+  /**
+   * Called when the user completes the delete operation.
+   */
+  onComplete: () => void;
+  showLockAlternative?: boolean;
+  /**
+   * Called when the user requests to lock the bot instead of deleting it.
+   */
+  onLockRequest?: () => void;
+  canLockBot?: boolean;
+}) {
+  const {
+    botName,
+    onCancel,
+    onComplete,
+    showLockAlternative = true,
+    onLockRequest,
+    canLockBot,
+  } = props;
+
+  const { mutateAsync, isPending, error } = useMutation({
+    async mutationFn(variables: Parameters<typeof deleteBot>[0]) {
+      const result = await deleteBot(variables);
+
+      // Adds a delay to allow the delete event to propagate to the backend
+      // cache before indicating that the operation is complete. In case a
+      // refresh is triggered immediately.
+      //
+      // TODO(nicholasmarais1158): Use Tanstack Query to fetch the bot list,
+      // then update the query's cache here to avoid needing this delay.
+      await wait(1000);
+
+      return result;
+    },
+  });
+
+  const handleDelete = async () => {
+    try {
+      await mutateAsync({ botName });
+    } catch {
+      // Swallow this error - it's handled as `error` above
+      return;
+    }
+    onComplete();
+  };
+
+  return (
+    <Dialog onClose={onCancel} open={true}>
+      <DialogHeader>
+        <DialogTitle>Delete {botName}?</DialogTitle>
+      </DialogHeader>
+      <DialogContent maxWidth={540}>
+        <div>
+          <P>
+            Deleting a bot is permanent and cannot be undone. Bot instances
+            remain active until their issued credentials expire.
+            {showLockAlternative
+              ? ''
+              : ' To terminate active instances immediately, lock the bot before deleting it.'}
+          </P>
+          {showLockAlternative ? (
+            <P>
+              Alternatively, you can lock a bot to stop all of its activity
+              immediately.
+            </P>
+          ) : undefined}
+        </div>
+        {error ? (
+          <Alert kind="danger" details={error.message} mt={3} mb={0}>
+            Failed to delete <code>{botName}</code>
+          </Alert>
+        ) : undefined}
+      </DialogContent>
+      <DialogFooter>
+        <Flex gap={3}>
+          <ButtonWarning disabled={isPending} onClick={handleDelete}>
+            Delete Bot
+          </ButtonWarning>
+          <ButtonSecondary disabled={isPending} onClick={onCancel} mr="auto">
+            Cancel
+          </ButtonSecondary>
+          {showLockAlternative ? (
+            <ButtonWarningBorder
+              disabled={!canLockBot || isPending}
+              onClick={onLockRequest}
+            >
+              Lock Bot
+            </ButtonWarningBorder>
+          ) : undefined}
+        </Flex>
+      </DialogFooter>
+    </Dialog>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/DeleteBot.test.tsx b/web/packages/teleport/src/Bots/DeleteBot.test.tsx
deleted file mode 100644
index be3fcaaffecb4..0000000000000
--- a/web/packages/teleport/src/Bots/DeleteBot.test.tsx
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { render, screen, userEvent } from 'design/utils/testing';
-
-import { DeleteBot } from 'teleport/Bots/DeleteBot';
-import { DeleteBotProps } from 'teleport/Bots/types';
-
-const makeProps = (): DeleteBotProps => ({
-  attempt: { status: '' },
-  name: 'bot-007',
-  onClose: () => {},
-  onDelete: () => {},
-});
-
-test('renders', async () => {
-  const props = makeProps();
-  render(<DeleteBot {...props} />);
-
-  expect(screen.getByText('Delete Bot?')).toBeInTheDocument();
-  expect(
-    screen.getByRole('button', { name: 'Yes, Delete Bot' })
-  ).toBeInTheDocument();
-  expect(screen.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
-
-  screen.getByText((content, node) => {
-    const hasText = node =>
-      node.textContent === 'Are you sure you want to delete Bot bot-007 ?';
-    const nodeHasText = hasText(node);
-    const childrenDontHaveText = Array.from(node.children).every(
-      child => !hasText(child)
-    );
-    return nodeHasText && childrenDontHaveText;
-  });
-});
-
-test('cancel calls onclose cb', async () => {
-  const props = makeProps();
-  const mockClose = jest.fn();
-  props.onClose = mockClose;
-  render(<DeleteBot {...props} />);
-
-  expect(mockClose).not.toHaveBeenCalled();
-  await userEvent.click(screen.queryByRole('button', { name: 'Cancel' }));
-  expect(mockClose).toHaveBeenCalled();
-});
-
-test('delete calls ondelete cb', async () => {
-  const props = makeProps();
-  const mockDelete = jest.fn();
-  props.onDelete = mockDelete;
-  render(<DeleteBot {...props} />);
-
-  expect(mockDelete).not.toHaveBeenCalled();
-  await userEvent.click(
-    screen.queryByRole('button', { name: 'Yes, Delete Bot' })
-  );
-  expect(mockDelete).toHaveBeenCalled();
-});
-
-test('disables buttons when processing', async () => {
-  const props = makeProps();
-  props.attempt = { status: 'processing' };
-  render(<DeleteBot {...props} />);
-
-  expect(
-    screen.queryByRole('button', { name: 'Yes, Delete Bot' })
-  ).toBeDisabled();
-  expect(screen.queryByRole('button', { name: 'Cancel' })).toBeDisabled();
-});
-
-test('displays error text', async () => {
-  const props = makeProps();
-  props.attempt = { status: 'failed', statusText: 'error deleting' };
-  render(<DeleteBot {...props} />);
-
-  expect(screen.getByText('error deleting')).toBeInTheDocument();
-});
diff --git a/web/packages/teleport/src/Bots/DeleteBot.tsx b/web/packages/teleport/src/Bots/DeleteBot.tsx
deleted file mode 100644
index 93b8dffa2fa0a..0000000000000
--- a/web/packages/teleport/src/Bots/DeleteBot.tsx
+++ /dev/null
@@ -1,67 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { Alert, ButtonSecondary, ButtonWarning, P1, Text } from 'design';
-import Dialog, {
-  DialogContent,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from 'design/DialogConfirmation';
-
-import { DeleteBotProps } from 'teleport/Bots/types';
-
-export function DeleteBot({
-  attempt,
-  onClose,
-  name,
-  onDelete,
-}: DeleteBotProps) {
-  return (
-    <Dialog disableEscapeKeyDown={false} onClose={onClose} open={true}>
-      <DialogHeader>
-        <DialogTitle>Delete Bot?</DialogTitle>
-      </DialogHeader>
-      <DialogContent width="450px">
-        {attempt.status === 'failed' && <Alert children={attempt.statusText} />}
-        <P1>
-          Are you sure you want to delete Bot{' '}
-          <Text as="span" bold color="text.main">
-            {name}
-          </Text>{' '}
-          ?
-        </P1>
-      </DialogContent>
-      <DialogFooter>
-        <ButtonWarning
-          mr="3"
-          disabled={attempt.status === 'processing'}
-          onClick={onDelete}
-        >
-          Yes, Delete Bot
-        </ButtonWarning>
-        <ButtonSecondary
-          disabled={attempt.status === 'processing'}
-          onClick={onClose}
-        >
-          Cancel
-        </ButtonSecondary>
-      </DialogFooter>
-    </Dialog>
-  );
-}
diff --git a/web/packages/teleport/src/Bots/Details/BotDetails.story.tsx b/web/packages/teleport/src/Bots/Details/BotDetails.story.tsx
new file mode 100644
index 0000000000000..0f40259ddc879
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/BotDetails.story.tsx
@@ -0,0 +1,643 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryHistory } from 'history';
+import { MemoryRouter, Route, Router } from 'react-router';
+import { action } from 'storybook/internal/actions';
+
+import Box from 'design/Box';
+
+import cfg from 'teleport/config';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { listBotInstancesSuccess } from 'teleport/test/helpers/botInstances';
+import {
+  deleteBotSuccess,
+  editBotSuccess,
+  getBotError,
+  getBotForever,
+  getBotSuccess,
+} from 'teleport/test/helpers/bots';
+import {
+  createLockSuccess,
+  listV2LocksError,
+  listV2LocksSuccess,
+  removeLockSuccess,
+} from 'teleport/test/helpers/locks';
+import { mfaAuthnChallengeSuccess } from 'teleport/test/helpers/mfa';
+import { successGetRoles } from 'teleport/test/helpers/roles';
+import {
+  listV2TokensError,
+  listV2TokensMfaError,
+  listV2TokensSuccess,
+} from 'teleport/test/helpers/tokens';
+
+import { BotDetails } from './BotDetails';
+import { listBotInstancesSuccessHandler } from './InstancesPanel.story';
+
+const meta = {
+  title: 'Teleport/Bots/Details',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+const successHandler = getBotSuccess({
+  name: 'ansible-worker',
+  roles: Array.from({ length: 8 }, (_, k) => k).map(
+    r => `testing-role-${r + 1}`
+  ),
+  traits: [
+    {
+      name: 'logins',
+      values: ['guest'],
+    },
+    {
+      name: 'db_names',
+      values: ['*'],
+    },
+    {
+      name: 'custom_idp',
+      values: Array.from({ length: 8 }, (_, k) => k).map(
+        r => `test-value-${r + 1}`
+      ),
+    },
+  ],
+  max_session_ttl: {
+    seconds: 43200,
+  },
+});
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: Array.from({ length: 10 }, (_, k) => k).map(r => ({
+            content: `role-${r}`,
+            id: `role-${r}`,
+            name: `role-${r}`,
+            kind: 'role',
+          })),
+        }),
+        listV2LocksSuccess(),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        removeLockSuccess(),
+        createLockSuccess(),
+        deleteBotSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithEmpty: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotSuccess({
+          name: 'ansible-worker',
+          roles: [],
+          traits: [],
+          max_session_ttl: {
+            seconds: 43200,
+          },
+        }),
+        listV2TokensSuccess({
+          tokens: [],
+        }),
+        mfaAuthnChallengeSuccess(),
+        listBotInstancesSuccess(
+          {
+            bot_instances: [],
+            next_page_token: '',
+          },
+          'v1'
+        ),
+        successGetRoles({
+          startKey: '',
+          items: Array.from({ length: 10 }, (_, k) => k).map(r => ({
+            content: `role-${r}`,
+            id: `role-${r}`,
+            name: `role-${r}`,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithTypical: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotSuccess({
+          name: 'ansible-worker',
+          roles: ['access'],
+          traits: [],
+          max_session_ttl: {
+            seconds: 43200,
+          },
+        }),
+        listV2TokensSuccess({
+          tokens: ['kubernetes'],
+        }),
+        mfaAuthnChallengeSuccess(),
+        listBotInstancesSuccess(
+          {
+            bot_instances: [
+              {
+                bot_name: 'bot-1',
+                instance_id: '6570dbf1-3530-4e13-a8c7-497bb9927994',
+                active_at_latest: new Date().toISOString(),
+                host_name_latest:
+                  'my-svc.my-namespace.svc.cluster-domain.example',
+                join_method_latest: 'kubernetes',
+                os_latest: 'linux',
+                version_latest: '18.1.0',
+              },
+            ],
+            next_page_token: '',
+          },
+          'v1'
+        ),
+        successGetRoles({
+          startKey: '',
+          items: Array.from({ length: 10 }, (_, k) => k).map(r => ({
+            content: `role-${r}`,
+            id: `role-${r}`,
+            name: `role-${r}`,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithLongValues: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotSuccess({
+          name: 'ansibleworkeransibleworkeransibleworkeransibleworkeransibleworkeransibleworker',
+          description:
+            'This is a bot. This is a bot. This is a bot. This is a bot. This is a bot.',
+          roles: [
+            'rolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerolerole',
+          ],
+          traits: [
+            {
+              name: 'traittraittraittraittraittraittraittraittraittraittraittraittraittraittrait',
+              values: ['value'],
+            },
+            {
+              name: 'name',
+              values: [
+                'valuevaluevaluevaluevaluevaluevaluevaluevaluevaluevaluevaluevaluevaluevaluevalue',
+              ],
+            },
+          ],
+          max_session_ttl: {
+            seconds: 43200,
+          },
+        }),
+        listV2TokensSuccess({
+          tokens: [
+            'tokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentokentoken',
+          ],
+        }),
+        mfaAuthnChallengeSuccess(),
+        listBotInstancesSuccess(
+          {
+            bot_instances: [
+              {
+                bot_name: '',
+                instance_id:
+                  '04241a2a66b904241a2a66b904241a2a66b904241a2a66b904241a2a66b9',
+                host_name_latest:
+                  'hotnamehotnamehotnamehotnamehotnamehotnamehotnamehotnamehotname',
+                active_at_latest: '2025-01-01T00:00:00Z',
+                join_method_latest: 'github',
+                os_latest: 'linux',
+                version_latest: '17.2.6-04241a2',
+              },
+            ],
+            next_page_token: '',
+          },
+          'v1'
+        ),
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithoutEditPermission: Story = {
+  args: {
+    hasBotsEdit: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithoutTokenListPermission: Story = {
+  args: {
+    hasTokensList: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithMFAPrompt: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensMfaError(),
+        mfaAuthnChallengeSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithTokensError: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensError(500, 'something went wrong'),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithTokensOutdatedProxy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensError(404, 'path not found', {
+          proxyVersion: {
+            major: 19,
+            minor: 0,
+            patch: 0,
+            preRelease: 'dev',
+            string: '18.0.0',
+          },
+        }),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithoutBotInstanceListPermission: Story = {
+  args: {
+    hasBotInstanceListPermission: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithLock: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: Array.from({ length: 10 }, (_, k) => k).map(r => ({
+            content: `role-${r}`,
+            id: `role-${r}`,
+            name: `role-${r}`,
+            kind: 'role',
+          })),
+        }),
+        listV2LocksSuccess({
+          locks: [
+            {
+              name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+              message: 'This is a test message',
+              expires: '2023-12-31T23:59:59Z',
+              targets: {
+                user: 'bot-ansible-worker',
+              },
+              createdAt: '2023-01-01T00:00:00Z',
+              createdBy: 'admin',
+            },
+          ],
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+        removeLockSuccess(),
+        createLockSuccess(),
+      ],
+    },
+  },
+};
+
+export const HappyWithLockError: Story = {
+  args: {
+    hasLocksMutatePermission: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        listV2TokensSuccess(),
+        listBotInstancesSuccessHandler,
+        successGetRoles({
+          startKey: '',
+          items: Array.from({ length: 10 }, (_, k) => k).map(r => ({
+            content: `role-${r}`,
+            id: `role-${r}`,
+            name: `role-${r}`,
+            kind: 'role',
+          })),
+        }),
+        listV2LocksError(500, 'error message goes here'),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+      ],
+    },
+  },
+};
+
+export const WithFetchPending: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotForever(), listV2LocksSuccess()],
+    },
+  },
+};
+
+export const WithFetchFailure: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        getBotError(500, 'error message goes here'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+export const WithBotNotFound: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotError(404, 'not found'), listV2LocksSuccess()],
+    },
+  },
+};
+
+export const WithNoBotReadPermission: Story = {
+  args: {
+    hasBotsRead: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        getBotError(500, 'you have permission, congrats 🎉'),
+        listV2LocksSuccess(),
+      ],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(props?: {
+  hasBotsRead?: boolean;
+  hasBotsEdit?: boolean;
+  hasBotsDelete?: boolean;
+  hasTokensList?: boolean;
+  hasBotInstanceListPermission?: boolean;
+  hasLocksListPermission?: boolean;
+  hasLocksMutatePermission?: boolean;
+  hasLocksDeletePermission?: boolean;
+}) {
+  const {
+    hasBotsRead = true,
+    hasBotsEdit = true,
+    hasBotsDelete = true,
+    hasTokensList = true,
+    hasBotInstanceListPermission = true,
+    hasLocksListPermission = true,
+    hasLocksMutatePermission = true,
+    hasLocksDeletePermission = true,
+  } = props ?? {};
+
+  const history = createMemoryHistory({
+    initialEntries: ['/web/bot/ansible-worker'],
+  });
+  history.push = action('history.push');
+
+  const customAcl = makeAcl({
+    bots: {
+      ...defaultAccess,
+      read: hasBotsRead,
+      edit: hasBotsEdit,
+      remove: hasBotsDelete,
+    },
+    roles: {
+      ...defaultAccess,
+      list: true,
+    },
+    tokens: {
+      ...defaultAccess,
+      list: hasTokensList,
+    },
+    botInstances: {
+      ...defaultAccess,
+      list: hasBotInstanceListPermission,
+    },
+    lock: {
+      ...defaultAccess,
+      list: hasLocksListPermission,
+      create: hasLocksMutatePermission,
+      edit: hasLocksMutatePermission,
+      remove: hasLocksDeletePermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <Router history={history}>
+            <Route path={cfg.routes.bot}>
+              <Box height={820} overflow={'auto'}>
+                <BotDetails />
+              </Box>
+            </Route>
+          </Router>
+        </TeleportProviderBasic>
+      </MemoryRouter>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Details/BotDetails.test.tsx b/web/packages/teleport/src/Bots/Details/BotDetails.test.tsx
new file mode 100644
index 0000000000000..31beed9f519bd
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/BotDetails.test.tsx
@@ -0,0 +1,946 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* eslint-disable testing-library/no-node-access */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { UserEvent } from '@testing-library/user-event';
+import { createMemoryHistory } from 'history';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import { MemoryRouter, Route, Router } from 'react-router';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+  waitForElementToBeRemoved,
+  within,
+} from 'design/utils/testing';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { EditBotRequest } from 'teleport/services/bot/types';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { listBotInstancesSuccess } from 'teleport/test/helpers/botInstances';
+import {
+  deleteBotSuccess,
+  EditBotApiVersion,
+  editBotSuccess,
+  getBotError,
+  getBotSuccess,
+} from 'teleport/test/helpers/bots';
+import {
+  createLockSuccess,
+  listV2LocksSuccess,
+  removeLockSuccess,
+} from 'teleport/test/helpers/locks';
+import { successGetRoles } from 'teleport/test/helpers/roles';
+import {
+  listV2TokensError,
+  listV2TokensMfaError,
+  listV2TokensSuccess,
+} from 'teleport/test/helpers/tokens';
+
+import { BotDetails } from './BotDetails';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('BotDetails', () => {
+  it('should show a page error state', async () => {
+    withFetchError();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
+
+  it('should show a not found error state', async () => {
+    withFetchError(404, 'not_found');
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    expect(
+      screen.getByText('Bot test-bot-name does not exist')
+    ).toBeInTheDocument();
+  });
+
+  it('should allow back navigation', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    const { user, history } = renderComponent();
+    jest.spyOn(history, 'goBack');
+    await waitForLoadingBot();
+
+    const backButton = screen.getByLabelText('back');
+    await user.click(backButton);
+
+    expect(history.goBack).toHaveBeenCalledTimes(1);
+  });
+
+  it('should show page title', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    const pageHeader = screen.getByTestId('page-header');
+    expect(pageHeader).toBeInTheDocument();
+
+    expect(within(pageHeader).getByText('test-bot-name')).toBeInTheDocument();
+  });
+
+  it('should show bot metadata', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Metadata' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(within(panel!).getByText('test-bot-name')).toBeInTheDocument();
+    expect(
+      within(panel!).getByText("This is the bot's description.")
+    ).toBeInTheDocument();
+    expect(within(panel!).getByText('12h')).toBeInTheDocument();
+  });
+
+  it('should show bot roles', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Roles' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(within(panel!).getByText('admin')).toBeInTheDocument();
+    expect(within(panel!).getByText('user')).toBeInTheDocument();
+  });
+
+  it('should show bot traits', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Traits' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(within(panel!).getByText('trait-1')).toBeInTheDocument();
+    expect(within(panel!).getByText('value-1')).toBeInTheDocument();
+    expect(within(panel!).getByText('value-2')).toBeInTheDocument();
+    expect(within(panel!).getByText('value-3')).toBeInTheDocument();
+  });
+
+  it('should show bot join tokens', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+    await waitForLoadingTokens();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Join Tokens' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(within(panel!).getByText('github')).toBeInTheDocument();
+    expect(within(panel!).getByText('iam')).toBeInTheDocument();
+    expect(within(panel!).getByText('oracle')).toBeInTheDocument();
+  });
+
+  it('should show bot join tokens outdated proxy warning', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensOutdatedProxy();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+    await waitForLoadingTokens();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Join Tokens' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(
+      within(panel!).getByText(
+        'We could not complete your request. Your proxy (v18.0.0) may be behind the minimum required version (v18.1.0) to support this request. Ensure all proxies are upgraded and try again.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('should show bot join tokens mfa message', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensMfaError();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+    await waitForLoadingTokens();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Join Tokens' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(
+      within(panel!).getByText(
+        'Multi-factor authentication is required to view join tokens'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('should allow an instance to be selected', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    const { user, history } = renderComponent();
+    jest.spyOn(history, 'push');
+    await waitForLoadingBot();
+    await waitForLoadingTokens();
+
+    const instanceSection = screen
+      .getByRole('heading', { name: 'Active Instances' })
+      .closest('section');
+
+    const firstItem = within(instanceSection!).getByText(
+      'c11250e0-00c2-4f52-bcdf-b367f80b9461'
+    );
+
+    await user.click(firstItem);
+
+    expect(history.push).toHaveBeenCalledTimes(1);
+    const search = new URLSearchParams(history.location.search);
+    expect(search.get('query')).toBe('spec.bot_name == "ansible-worker"');
+    expect(search.get('is_advanced')).toBe('1');
+    expect(search.get('sort_field')).toBe('active_at_latest');
+    expect(search.get('sort_dir')).toBe('DESC');
+    expect(search.get('selected')).toBe(
+      'ansible-worker/c11250e0-00c2-4f52-bcdf-b367f80b9461'
+    );
+  });
+
+  describe('should show bot join tokens empty message', () => {
+    it('when an empty list is returned', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess({ tokens: [] });
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      renderComponent();
+      await waitForLoadingBot();
+      await waitForLoadingTokens();
+
+      const panel = screen
+        .getByRole('heading', { name: 'Join Tokens' })
+        .closest('section');
+      expect(panel).toBeInTheDocument();
+
+      expect(within(panel!).getByText('No join tokens')).toBeInTheDocument();
+    });
+
+    it('when null is returned', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess({ tokens: null });
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      renderComponent();
+      await waitForLoadingBot();
+      await waitForLoadingTokens();
+
+      const panel = screen
+        .getByRole('heading', { name: 'Join Tokens' })
+        .closest('section');
+      expect(panel).toBeInTheDocument();
+
+      expect(within(panel!).getByText('No join tokens')).toBeInTheDocument();
+    });
+  });
+
+  it('should show bot instances', async () => {
+    withFetchSuccess();
+    withFetchJoinTokensSuccess();
+    withFetchInstancesSuccess();
+    withListLocksSuccess();
+    renderComponent();
+    await waitForLoadingBot();
+    await waitForLoadingInstances();
+
+    const panel = screen
+      .getByRole('heading', { name: 'Active Instances' })
+      .closest('section');
+    expect(panel).toBeInTheDocument();
+
+    expect(
+      within(panel!).getByText('c11250e0-00c2-4f52-bcdf-b367f80b9461')
+    ).toBeInTheDocument();
+  });
+
+  it('should show an unauthorised error state', async () => {
+    renderComponent({
+      customAcl: makeAcl({
+        bots: {
+          ...defaultAccess,
+          read: false,
+        },
+      }),
+    });
+    expect(
+      screen.getByText('You do not have permission to view this bot.', {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+  });
+
+  describe('Edit', () => {
+    it('should disable edit action if no edit permission', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      renderComponent({
+        customAcl: makeAcl({
+          bots: {
+            ...defaultAccess,
+            read: true,
+          },
+        }),
+      });
+      await waitForLoadingBot();
+
+      expect(screen.getByText('Edit Bot')).toBeDisabled();
+      expect(screen.getByText('Edit')).toBeDisabled();
+    });
+
+    it('should show edit form on edit action', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      const { user } = renderComponent();
+      await waitForLoadingBot();
+
+      withFetchRolesSuccess();
+      const editButton = screen.getByRole('button', { name: 'Edit Bot' });
+      await user.click(editButton);
+
+      expect(
+        screen.getByText('Bot name cannot be changed')
+      ).toBeInTheDocument();
+
+      const cancelButton = screen.getByRole('button', { name: 'Cancel' });
+      await user.click(cancelButton);
+
+      expect(
+        screen.queryByText('Bot name cannot be changed')
+      ).not.toBeInTheDocument();
+    });
+
+    it("should update the bot's details on edit success", async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      const { user } = renderComponent();
+      await waitForLoadingBot();
+
+      let configPanel = screen
+        .getByRole('heading', { name: 'Metadata' })
+        .closest('section');
+      expect(configPanel).toBeInTheDocument();
+      expect(within(configPanel!).getByText('12h')).toBeInTheDocument();
+
+      let rolesPanel = screen
+        .getByRole('heading', { name: 'Roles' })
+        .closest('section');
+      expect(rolesPanel).toBeInTheDocument();
+      expect(within(rolesPanel!).getByText('admin')).toBeInTheDocument();
+      expect(within(rolesPanel!).getByText('user')).toBeInTheDocument();
+
+      let traitsPanel = screen
+        .getByRole('heading', { name: 'Traits' })
+        .closest('section');
+      expect(traitsPanel).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('trait-1')).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('value-1')).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('value-2')).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('value-3')).toBeInTheDocument();
+
+      withFetchRolesSuccess();
+      const editButton = screen.getByRole('button', { name: 'Edit Bot' });
+      await user.click(editButton);
+
+      // Change something to enable the save button
+      await inputMaxSessionDuration(user, '12h 30m');
+
+      withSaveSuccess('v2', {
+        roles: ['role-1'],
+        traits: [
+          {
+            name: 'trait-2',
+            values: ['value-3'],
+          },
+        ],
+        max_session_ttl: '12h30m',
+      });
+      const saveButton = screen.getByRole('button', { name: 'Save' });
+      await user.click(saveButton);
+      await waitFor(() => {
+        expect(
+          screen.queryByRole('button', { name: 'Save' })
+        ).not.toBeInTheDocument();
+      });
+
+      configPanel = screen
+        .getByRole('heading', { name: 'Metadata' })
+        .closest('section');
+      expect(configPanel).toBeInTheDocument();
+      expect(within(configPanel!).getByText('12h 30m')).toBeInTheDocument();
+
+      rolesPanel = screen
+        .getByRole('heading', { name: 'Roles' })
+        .closest('section');
+      expect(rolesPanel).toBeInTheDocument();
+      expect(within(rolesPanel!).getByText('role-1')).toBeInTheDocument();
+
+      traitsPanel = screen
+        .getByRole('heading', { name: 'Traits' })
+        .closest('section');
+      expect(traitsPanel).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('trait-2')).toBeInTheDocument();
+      expect(within(traitsPanel!).getByText('value-3')).toBeInTheDocument();
+    });
+  });
+
+  describe('Locks', () => {
+    it('should show an overflow option to lock the bot', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess({
+        locks: [],
+      });
+      const { user } = renderComponent();
+      await waitForLoadingBot();
+
+      expect(screen.queryByText('Locked')).not.toBeInTheDocument();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const lockButton = screen.getByText('Lock Bot...');
+      expect(lockButton).toBeInTheDocument();
+      await user.click(lockButton!);
+
+      expect(screen.getByText('Lock bot-test-bot-name?')).toBeInTheDocument();
+
+      withLockSuccess();
+      const submitButton = screen.getByRole('button', { name: 'Create Lock' });
+      expect(submitButton).toBeEnabled();
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(screen.getByText('Locked')).toBeInTheDocument();
+      });
+    });
+
+    it('should show an overflow option to unlock the bot', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      const { user } = renderComponent();
+      await waitForLoadingBot();
+
+      expect(screen.getByText('Locked')).toBeInTheDocument();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const unlockButton = screen.getByText('Unlock Bot...');
+      expect(unlockButton).toBeInTheDocument();
+      await user.click(unlockButton!);
+
+      expect(screen.getByText('Unlock bot-test-bot-name?')).toBeInTheDocument();
+
+      withUnlockSuccess();
+      const submitButton = screen.getByRole('button', { name: 'Remove Lock' });
+      expect(submitButton).toBeEnabled();
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(screen.queryByText('Locked')).not.toBeInTheDocument();
+      });
+    });
+
+    it('should disable lock action if no permissions', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess({
+        locks: [],
+      });
+      const { user } = renderComponent({
+        customAcl: makeAcl({
+          bots: {
+            ...defaultAccess,
+            read: true,
+            edit: true,
+          },
+          lock: {
+            ...defaultAccess,
+            list: true,
+            remove: true,
+            create: false,
+          },
+        }),
+      });
+      await waitForLoadingBot();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const lockButton = screen.getByText('Lock Bot...');
+      expect(lockButton).toBeInTheDocument();
+      await user.click(lockButton!);
+
+      expect(
+        screen.queryByText('Lock bot-test-bot-name?')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should disable unlock action if no permissions', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      const { user } = renderComponent({
+        customAcl: makeAcl({
+          bots: {
+            ...defaultAccess,
+            read: true,
+            edit: true,
+          },
+          lock: {
+            ...defaultAccess,
+            list: true,
+            remove: false,
+            create: true,
+          },
+        }),
+      });
+      await waitForLoadingBot();
+
+      expect(screen.getByText('Locked')).toBeInTheDocument();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const unlockButton = screen.getByText('Unlock Bot...');
+      expect(unlockButton).toBeInTheDocument();
+      await user.click(unlockButton!);
+
+      expect(
+        screen.queryByText('Unlock bot-test-bot-name?')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Delete', () => {
+    it('should show an overflow option to delete the bot', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess({
+        locks: [],
+      });
+      withDeleteBotSuccess();
+      const { user, history } = renderComponent();
+      jest.spyOn(history, 'replace');
+      await waitForLoadingBot();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const deleteButton = screen.getByText('Delete Bot...');
+      expect(deleteButton).toBeInTheDocument();
+      await user.click(deleteButton!);
+
+      expect(screen.getByText('Delete test-bot-name?')).toBeInTheDocument();
+      expect(screen.getByText('Lock Bot')).toBeInTheDocument();
+
+      await user.click(screen.getByText('Delete Bot'));
+
+      // The operation is delayed to account for backend cache lag
+      await waitFor(
+        () => {
+          expect(
+            screen.queryByText('Delete test-bot-name?')
+          ).not.toBeInTheDocument();
+        },
+        { timeout: 5000 }
+      );
+
+      expect(history.replace).toHaveBeenCalledTimes(1);
+      expect(history.replace).toHaveBeenLastCalledWith('/web/bots');
+    });
+
+    it('should disable the delete action if no permissions', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      withDeleteBotSuccess();
+      const { user } = renderComponent({
+        customAcl: makeAcl({
+          bots: {
+            ...defaultAccess,
+            read: true,
+            edit: true,
+            remove: false,
+          },
+          lock: {
+            ...defaultAccess,
+            list: true,
+            remove: true,
+            create: true,
+            edit: true,
+          },
+        }),
+      });
+      await waitForLoadingBot();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const deleteButton = screen.getByText('Delete Bot...');
+      expect(deleteButton).toBeInTheDocument();
+      await user.click(deleteButton!);
+
+      expect(
+        screen.queryByText('Delete test-bot-name?')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not allow lock alternative if no permission', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess({
+        locks: [],
+      });
+      withDeleteBotSuccess();
+      const { user } = renderComponent({
+        customAcl: makeAcl({
+          bots: {
+            ...defaultAccess,
+            read: true,
+            edit: true,
+            remove: true,
+          },
+          lock: {
+            ...defaultAccess,
+            list: true,
+            remove: true,
+            create: false,
+            edit: false,
+          },
+        }),
+      });
+      await waitForLoadingBot();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const deleteButton = screen.getByText('Delete Bot...');
+      expect(deleteButton).toBeInTheDocument();
+      await user.click(deleteButton!);
+
+      expect(screen.getByText('Delete test-bot-name?')).toBeInTheDocument();
+
+      const lockButton = screen.getByText('Lock Bot');
+      expect(lockButton).toBeInTheDocument();
+      await user.click(lockButton!);
+
+      expect(
+        screen.queryByText('Lock bot-test-bot-name?')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not show lock alternative if already locked', async () => {
+      withFetchSuccess();
+      withFetchJoinTokensSuccess();
+      withFetchInstancesSuccess();
+      withListLocksSuccess();
+      withDeleteBotSuccess();
+      const { user } = renderComponent();
+      await waitForLoadingBot();
+
+      const overflowButton = screen.getByTestId('overflow-btn-open');
+      await user.click(overflowButton);
+
+      const deleteButton = screen.getByText('Delete Bot...');
+      expect(deleteButton).toBeInTheDocument();
+      await user.click(deleteButton!);
+
+      expect(screen.getByText('Delete test-bot-name?')).toBeInTheDocument();
+
+      expect(screen.queryByText('Lock Bot')).not.toBeInTheDocument();
+    });
+  });
+});
+
+async function inputMaxSessionDuration(user: UserEvent, duration: string) {
+  const ttlInput = screen.getByLabelText('Max session duration');
+  await user.type(ttlInput, duration);
+}
+
+const renderComponent = (options?: {
+  customAcl?: ReturnType<typeof makeAcl>;
+}) => {
+  const user = userEvent.setup();
+  const history = createMemoryHistory({
+    initialEntries: ['/web/bot/test-bot-name'],
+  });
+  return {
+    ...render(<BotDetails />, {
+      wrapper: makeWrapper({
+        customAcl: options?.customAcl,
+        history,
+      }),
+    }),
+    user,
+    history,
+  };
+};
+
+const waitForLoadingBot = async () => {
+  await waitForElementToBeRemoved(() => screen.queryByTestId('loading-bot'));
+};
+
+const waitForLoadingTokens = async () => {
+  await waitForElementToBeRemoved(() => screen.queryByTestId('loading-tokens'));
+};
+
+const waitForLoadingInstances = async () => {
+  await waitForElementToBeRemoved(() =>
+    screen.queryByTestId('loading-instances')
+  );
+};
+
+const withFetchError = (status = 500, message = 'something went wrong') => {
+  server.use(getBotError(status, message));
+};
+
+const withFetchSuccess = () => {
+  server.use(getBotSuccess());
+};
+
+const withFetchJoinTokensSuccess = (options?: {
+  hasNextPage?: boolean;
+  tokens?: string[] | null;
+}) => {
+  server.use(listV2TokensSuccess(options));
+};
+
+const withFetchJoinTokensMfaError = () => {
+  server.use(listV2TokensMfaError());
+};
+
+const withFetchJoinTokensOutdatedProxy = () => {
+  server.use(
+    listV2TokensError(404, 'path not found', {
+      proxyVersion: {
+        major: 19,
+        minor: 0,
+        patch: 0,
+        preRelease: 'dev',
+        string: '18.0.0',
+      },
+    })
+  );
+};
+
+function withFetchInstancesSuccess() {
+  server.use(
+    listBotInstancesSuccess(
+      {
+        bot_instances: [
+          {
+            bot_name: 'ansible-worker',
+            instance_id: 'c11250e0-00c2-4f52-bcdf-b367f80b9461',
+            active_at_latest: '2025-07-22T10:54:00Z',
+            host_name_latest: 'svr-lon-01-ab23cd',
+            join_method_latest: 'github',
+            os_latest: 'linux',
+            version_latest: '4.4.16',
+          },
+        ],
+        next_page_token: '',
+      },
+      'v1'
+    )
+  );
+}
+
+function withSaveSuccess(
+  version: EditBotApiVersion = 'v3',
+  overrides?: Partial<EditBotRequest>
+) {
+  server.use(editBotSuccess(version, overrides));
+}
+
+function withFetchRolesSuccess() {
+  server.use(
+    successGetRoles({
+      items: [],
+      startKey: '',
+    })
+  );
+}
+
+function withListLocksSuccess(
+  ...params: Parameters<typeof listV2LocksSuccess>
+) {
+  server.use(
+    listV2LocksSuccess({
+      locks: params[0]?.locks ?? [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'bot-test-bot-name',
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    })
+  );
+}
+
+function withUnlockSuccess() {
+  server.use(removeLockSuccess());
+}
+
+function withLockSuccess() {
+  server.use(createLockSuccess());
+}
+
+function withDeleteBotSuccess() {
+  server.use(deleteBotSuccess());
+}
+
+function makeWrapper(options: {
+  history: ReturnType<typeof createMemoryHistory>;
+  customAcl?: ReturnType<typeof makeAcl>;
+}) {
+  const {
+    history,
+    customAcl = makeAcl({
+      bots: {
+        ...defaultAccess,
+        read: true,
+        edit: true,
+        remove: true,
+      },
+      roles: {
+        ...defaultAccess,
+        list: true,
+      },
+      tokens: {
+        ...defaultAccess,
+        list: true,
+      },
+      botInstances: {
+        ...defaultAccess,
+        list: true,
+      },
+      lock: {
+        ...defaultAccess,
+        list: true,
+        remove: true,
+        create: true,
+        edit: true,
+      },
+    }),
+  } = options;
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <MemoryRouter>
+        <QueryClientProvider client={testQueryClient}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <ContextProvider ctx={ctx}>
+              <InfoGuidePanelProvider>
+                <Router history={history}>
+                  <Route path={cfg.routes.bot}>{children}</Route>
+                </Router>
+              </InfoGuidePanelProvider>
+            </ContextProvider>
+          </ConfiguredThemeProvider>
+        </QueryClientProvider>
+      </MemoryRouter>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Details/BotDetails.tsx b/web/packages/teleport/src/Bots/Details/BotDetails.tsx
new file mode 100644
index 0000000000000..8129fbff7c15e
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/BotDetails.tsx
@@ -0,0 +1,702 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import React, { useRef, useState } from 'react';
+import { useHistory, useLocation, useParams } from 'react-router';
+import styled, { useTheme } from 'styled-components';
+
+import { Alert } from 'design/Alert/Alert';
+import Box from 'design/Box/Box';
+import { Button, ButtonSecondary } from 'design/Button/Button';
+import ButtonIcon from 'design/ButtonIcon/ButtonIcon';
+import { CardTile } from 'design/CardTile/CardTile';
+import Flex, { Stack } from 'design/Flex/Flex';
+import { ArrowLeft } from 'design/Icon/Icons/ArrowLeft';
+import { FingerprintSimple } from 'design/Icon/Icons/FingerprintSimple';
+import { LockKey } from 'design/Icon/Icons/LockKey';
+import { MoreVert } from 'design/Icon/Icons/MoreVert';
+import { NewTab } from 'design/Icon/Icons/NewTab';
+import { Pencil } from 'design/Icon/Icons/Pencil';
+import { Question } from 'design/Icon/Icons/Question';
+import { Trash } from 'design/Icon/Icons/Trash';
+import { Unlock } from 'design/Icon/Icons/Unlock';
+import { Indicator } from 'design/Indicator/Indicator';
+import { SecondaryOutlined } from 'design/Label/Label';
+import Menu from 'design/Menu/Menu';
+import MenuItem from 'design/Menu/MenuItem';
+import Text from 'design/Text';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
+import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
+import { traitDescriptions } from 'shared/components/TraitsEditor/TraitsEditor';
+
+import {
+  FeatureBox,
+  FeatureHeader,
+  FeatureHeaderTitle,
+} from 'teleport/components/Layout/Layout';
+import cfg from 'teleport/config';
+import { ResourceLockDialog } from 'teleport/lib/locks/ResourceLockDialog';
+import { ResourceLockIndicator } from 'teleport/lib/locks/ResourceLockIndicator';
+import { ResourceUnlockDialog } from 'teleport/lib/locks/ResourceUnlockDialog';
+import { useResourceLock } from 'teleport/lib/locks/useResourceLock';
+import { isAdminActionRequiresMfaError } from 'teleport/services/api/api';
+import { BotInstanceSummary } from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
+
+import { DeleteDialog } from '../Delete/DeleteDialog';
+import { EditDialog } from '../Edit/EditDialog';
+import { formatDuration } from '../formatDuration';
+import { useGetBot, useListBotTokens } from '../hooks';
+import { InfoGuide } from '../InfoGuide';
+import { InstancesPanel } from './InstancesPanel';
+import { JoinMethodIcon } from './JoinMethodIcon';
+import { Panel } from './Panel';
+
+export function BotDetails() {
+  const ctx = useTeleport();
+  const history = useHistory();
+  const location = useLocation();
+  const params = useParams<{
+    botName: string;
+  }>();
+  const [isEditing, setEditing] = useState(false);
+  const [showLockConfirmation, setShowLockConfirmation] = useState(false);
+  const [showUnlockConfirmation, setShowUnlockConfirmation] = useState(false);
+  const [showDeleteConfirmation, setShowDeleteConfirmation] = useState(false);
+
+  const flags = ctx.getFeatureFlags();
+  const hasReadPermission = flags.readBots;
+  const hasEditPermission = flags.editBots;
+  const hasDeletePermission = flags.removeBots;
+
+  const { data, error, isSuccess, isError, isLoading } = useGetBot(params, {
+    enabled: hasReadPermission,
+    staleTime: 30_000, // Keep data in the cache for 30 seconds
+  });
+
+  const targetKind = 'user';
+  const targetName = `bot-${params.botName}`;
+
+  const {
+    isLocked,
+    error: lockError,
+    canLock,
+    canUnlock,
+  } = useResourceLock({
+    targetKind,
+    targetName,
+  });
+
+  const handleBackPress = () => {
+    // If location.key is unset, or 'default', this is the first history entry in-app in the session.
+    if (!location.key || location.key === 'default') {
+      history.push(cfg.getBotsRoute());
+    } else {
+      history.goBack();
+    }
+  };
+
+  const handleEdit = () => {
+    setEditing(true);
+  };
+
+  const handleEditSuccess = () => {
+    setEditing(false);
+  };
+
+  const handleViewAllTokensClicked = () => {
+    history.push(cfg.getJoinTokensRoute());
+  };
+
+  const handleLock = () => {
+    setShowLockConfirmation(true);
+  };
+
+  const handleUnlock = () => {
+    setShowUnlockConfirmation(true);
+  };
+
+  const handleDelete = () => {
+    setShowDeleteConfirmation(true);
+  };
+
+  const handleDeleteComplete = () => {
+    setShowDeleteConfirmation(false);
+    history.replace(cfg.getBotsRoute());
+  };
+
+  const handleInstanceSelected = (instance: BotInstanceSummary) => {
+    const path = cfg.getBotInstancesRoute({
+      selectedItemId: `${instance.bot_name}/${instance.instance_id}`,
+      isAdvancedQuery: true,
+      query: `spec.bot_name == "${instance.bot_name}"`,
+      sortField: 'active_at_latest',
+      sortDir: 'DESC',
+    });
+    history.push(path);
+  };
+
+  return (
+    <FeatureBox>
+      <FeatureHeader gap={2} data-testid="page-header">
+        <HoverTooltip placement="bottom" tipContent={'Go back'}>
+          <ButtonIcon onClick={handleBackPress} aria-label="back">
+            <ArrowLeft size="medium" />
+          </ButtonIcon>
+        </HoverTooltip>
+        <Flex flex={1} gap={2} justifyContent="space-between" overflow="hidden">
+          {isSuccess && data ? (
+            <>
+              <Flex gap={3}>
+                <FeatureHeaderTitle>
+                  <TitleText>{data.name}</TitleText>
+                </FeatureHeaderTitle>
+
+                {isLocked ? (
+                  <ResourceLockIndicator
+                    targetKind={targetKind}
+                    targetName={targetName}
+                  />
+                ) : undefined}
+              </Flex>
+
+              <Flex gap={2}>
+                <EditButton onClick={handleEdit} disabled={!hasEditPermission}>
+                  <Pencil size="medium" /> Edit Bot
+                </EditButton>
+
+                <OverflowMenu
+                  isLocked={isLocked}
+                  canLock={canLock}
+                  onLock={handleLock}
+                  canUnlock={canUnlock}
+                  onUnlock={handleUnlock}
+                  canDelete={hasDeletePermission}
+                  onDelete={handleDelete}
+                />
+              </Flex>
+            </>
+          ) : (
+            <FeatureHeaderTitle>Bot details</FeatureHeaderTitle>
+          )}
+        </Flex>
+        <InfoGuideButton config={{ guide: <InfoGuide /> }} />
+      </FeatureHeader>
+
+      {isLoading ? (
+        <Box data-testid="loading-bot" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      ) : undefined}
+
+      {isError ? (
+        <Alert kind="danger" details={error.message}>
+          Failed to fetch bot
+        </Alert>
+      ) : undefined}
+
+      {lockError ? (
+        <Alert kind="danger" details={lockError.message}>
+          Failed to get lock status
+        </Alert>
+      ) : undefined}
+
+      {isSuccess && data === null ? (
+        <Alert kind="warning">Bot {params.botName} does not exist</Alert>
+      ) : undefined}
+
+      {!hasReadPermission ? (
+        <Alert kind="info">
+          You do not have permission to view this bot. Missing role permissions:{' '}
+          <code>bots.read</code>
+        </Alert>
+      ) : undefined}
+
+      {hasReadPermission && isSuccess && data ? (
+        <Container>
+          <ColumnContainer>
+            <Panel
+              title="Bot Details"
+              action={{
+                label: 'Edit',
+                onClick: handleEdit,
+                iconLeft: <Pencil size={'medium'} />,
+                disabled: !hasEditPermission,
+              }}
+            />
+            <Divider />
+
+            <Panel title="Metadata" isSubPanel>
+              <PanelContentContainer>
+                <Grid>
+                  <GridLabel>Bot name</GridLabel>
+                  <Flex
+                    inline
+                    alignItems={'center'}
+                    gap={1}
+                    overflow={'hidden'}
+                  >
+                    <MonoText>{data.name}</MonoText>
+                    <CopyButton value={data.name} />
+                  </Flex>
+                  <GridLabel>Description</GridLabel>
+                  <span>{data.description || '-'}</span>
+                  <GridLabel>Max session duration</GridLabel>
+                  <span>
+                    {data.max_session_ttl
+                      ? formatDuration(data.max_session_ttl, {
+                          separator: ' ',
+                        })
+                      : '-'}
+                  </span>
+                </Grid>
+              </PanelContentContainer>
+            </Panel>
+
+            <PaddedDivider />
+
+            <Panel title="Roles" isSubPanel>
+              <PanelContentContainer>
+                {data.roles.length ? (
+                  <LabelsContainer>
+                    {data.roles.toSorted().map(r => (
+                      <SecondaryOutlined key={r}>
+                        <LabelText>{r}</LabelText>
+                      </SecondaryOutlined>
+                    ))}
+                  </LabelsContainer>
+                ) : (
+                  <EmptyText>No roles assigned</EmptyText>
+                )}
+              </PanelContentContainer>
+            </Panel>
+
+            <PaddedDivider />
+
+            <Panel title="Traits" isSubPanel>
+              <PanelContentContainer>
+                {data.traits.length ? (
+                  <Grid>
+                    {data.traits
+                      .toSorted((a, b) => a.name.localeCompare(b.name))
+                      .map(r => (
+                        <React.Fragment key={r.name}>
+                          <GridLabel>
+                            <Trait traitName={r.name} />
+                          </GridLabel>
+                          <LabelsContainer>
+                            {r.values.length > 0
+                              ? r.values.toSorted().map(v => (
+                                  <SecondaryOutlined key={v}>
+                                    <LabelText>{v}</LabelText>
+                                  </SecondaryOutlined>
+                                ))
+                              : 'no values'}
+                          </LabelsContainer>
+                        </React.Fragment>
+                      ))}
+                  </Grid>
+                ) : (
+                  <EmptyText>No traits set</EmptyText>
+                )}
+              </PanelContentContainer>
+            </Panel>
+
+            <Divider />
+
+            <JoinTokens
+              botName={data.name}
+              onViewAllClicked={handleViewAllTokensClicked}
+            />
+          </ColumnContainer>
+          <ColumnContainer maxWidth={400}>
+            <InstancesPanel
+              botName={params.botName}
+              onItemSelected={handleInstanceSelected}
+            />
+          </ColumnContainer>
+
+          {isEditing ? (
+            <EditDialog
+              botName={data.name}
+              onCancel={() => setEditing(false)}
+              onSuccess={handleEditSuccess}
+            />
+          ) : undefined}
+
+          {showLockConfirmation ? (
+            <ResourceLockDialog
+              onCancel={() => setShowLockConfirmation(false)}
+              onComplete={() => setShowLockConfirmation(false)}
+              targetKind={targetKind}
+              targetName={targetName}
+            />
+          ) : undefined}
+
+          {showUnlockConfirmation ? (
+            <ResourceUnlockDialog
+              onCancel={() => setShowUnlockConfirmation(false)}
+              onComplete={() => setShowUnlockConfirmation(false)}
+              targetKind={targetKind}
+              targetName={targetName}
+            />
+          ) : undefined}
+
+          {showDeleteConfirmation ? (
+            <DeleteDialog
+              onCancel={() => setShowDeleteConfirmation(false)}
+              onComplete={handleDeleteComplete}
+              canLockBot={canLock}
+              onLockRequest={() => {
+                setShowLockConfirmation(true);
+                setShowDeleteConfirmation(false);
+              }}
+              botName={params.botName}
+              showLockAlternative={!isLocked}
+            />
+          ) : undefined}
+        </Container>
+      ) : undefined}
+    </FeatureBox>
+  );
+}
+
+const Container = styled(Flex).attrs({ gap: 2 })`
+  flex: 1;
+  overflow: auto;
+`;
+
+const ColumnContainer = styled(CardTile)`
+  flex-direction: column;
+  overflow: auto;
+  padding: 0;
+  gap: 0;
+  margin: ${props => props.theme.space[1]}px;
+`;
+
+const PanelContentContainer = styled(Flex)`
+  flex-direction: column;
+  padding: ${props => props.theme.space[3]}px;
+  padding-top: 0;
+`;
+
+const LabelsContainer = styled(Flex)`
+  flex-wrap: wrap;
+  overflow: hidden;
+  gap: ${props => props.theme.space[1]}px;
+`;
+
+const Divider = styled.div`
+  height: 1px;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+  flex-shrink: 0;
+`;
+
+const PaddedDivider = styled(Divider)`
+  margin-left: ${props => props.theme.space[3]}px;
+  margin-right: ${props => props.theme.space[3]}px;
+`;
+
+const Grid = styled(Box)`
+  align-self: flex-start;
+  display: grid;
+  grid-template-columns: repeat(2, auto);
+  gap: ${({ theme }) => theme.space[2]}px;
+  overflow: hidden;
+`;
+
+const GridLabel = styled(Text)`
+  color: ${({ theme }) => theme.colors.text.muted};
+  font-weight: ${({ theme }) => theme.fontWeights.regular};
+  padding-right: ${({ theme }) => theme.space[2]}px;
+`;
+
+const MonoText = styled(Text)`
+  font-family: ${({ theme }) => theme.fonts.mono};
+`;
+
+const EditButton = styled(ButtonSecondary)`
+  gap: ${props => props.theme.space[2]}px;
+  white-space: nowrap;
+`;
+
+const TitleText = styled(Text)`
+  white-space: nowrap;
+`;
+
+const LabelText = styled(Text).attrs({
+  typography: 'body3',
+})`
+  white-space: nowrap;
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
+
+function Trait(props: { traitName: string }) {
+  const theme = useTheme();
+
+  const description = traitDescriptions[props.traitName];
+
+  return description ? (
+    <Flex gap={1}>
+      {props.traitName}
+      <HoverTooltip placement="top" tipContent={description}>
+        <Question
+          size={'small'}
+          color={theme.colors.interactive.tonal.neutral[3]}
+        />
+      </HoverTooltip>
+    </Flex>
+  ) : (
+    props.traitName
+  );
+}
+
+function JoinTokens(props: { botName: string; onViewAllClicked: () => void }) {
+  const { botName, onViewAllClicked } = props;
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasListPermission = flags.listTokens;
+
+  const [skipAuthnRetry, setSkipAuthnRetry] = useState(true);
+
+  const { data, error, isSuccess, isError, isLoading } = useListBotTokens(
+    { botName, skipAuthnRetry },
+    {
+      enabled: hasListPermission,
+      staleTime: 30_000, // Keep data in the cache for 30 seconds
+    }
+  );
+
+  const requiresMfa = isError && isAdminActionRequiresMfaError(error);
+
+  const handleVerifyClick = () => {
+    setSkipAuthnRetry(false);
+  };
+
+  return (
+    <Panel
+      title="Join Tokens"
+      isSubPanel
+      action={{
+        label: 'View All',
+        onClick: onViewAllClicked,
+        iconRight: <NewTab size={'medium'} />,
+        disabled: !hasListPermission,
+      }}
+    >
+      <PanelContentContainer>
+        {isLoading ? (
+          <Box data-testid="loading-tokens" textAlign="center" m={10}>
+            <Indicator />
+          </Box>
+        ) : undefined}
+
+        {!hasListPermission ? (
+          <Alert kind="info">
+            You do not have permission to view join tokens. Missing role
+            permissions: <code>tokens.list</code>
+          </Alert>
+        ) : undefined}
+
+        {requiresMfa ? (
+          <MfaContainer>
+            <MfaText fontWeight={'regular'}>
+              Multi-factor authentication is required to view join tokens
+            </MfaText>
+            <MfaVerifyButton onClick={handleVerifyClick}>
+              <FingerprintSimple size="medium" /> Authenticate
+            </MfaVerifyButton>
+          </MfaContainer>
+        ) : undefined}
+
+        {isError && !requiresMfa ? (
+          <Alert kind="danger" details={error.message}>
+            Failed to fetch join tokens
+          </Alert>
+        ) : undefined}
+
+        {isSuccess ? (
+          <>
+            {data.items?.length ? (
+              <LabelsContainer>
+                {data.items
+                  .toSorted((a, b) => a.safeName.localeCompare(b.safeName))
+                  .map(t => {
+                    return (
+                      <HoverTooltip
+                        key={t.id}
+                        placement="top"
+                        tipContent={t.method}
+                      >
+                        <SecondaryOutlined padding={0}>
+                          <Flex
+                            alignItems={'center'}
+                            gap={1}
+                            padding={1}
+                            paddingRight={2}
+                          >
+                            <JoinMethodIcon
+                              method={t.method}
+                              size={'large'}
+                              includeTooltip={false}
+                            />
+                            <LabelText>{t.safeName}</LabelText>
+                          </Flex>
+                        </SecondaryOutlined>
+                      </HoverTooltip>
+                    );
+                  })}
+              </LabelsContainer>
+            ) : (
+              <EmptyText>No join tokens</EmptyText>
+            )}
+          </>
+        ) : undefined}
+      </PanelContentContainer>
+    </Panel>
+  );
+}
+
+const MfaContainer = styled(Stack)`
+  align-items: center;
+  gap: ${props => props.theme.space[2]}px;
+  background-color: ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  padding: ${props => props.theme.space[4]}px;
+  border: ${props => props.theme.borders[1]}
+    ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  border-radius: ${props => props.theme.radii[2]}px;
+`;
+
+const MfaText = styled(Text)`
+  max-width: 216px;
+  text-align: center;
+`;
+
+const MfaVerifyButton = styled(ButtonSecondary)`
+  gap: ${props => props.theme.space[2]}px;
+`;
+
+function OverflowMenu(props: {
+  isLocked: boolean;
+  canLock: boolean;
+  onLock: () => void;
+  canUnlock: boolean;
+  onUnlock: () => void;
+  canDelete: boolean;
+  onDelete: () => void;
+}) {
+  const {
+    isLocked,
+    canLock,
+    onLock,
+    canUnlock,
+    onUnlock,
+    canDelete,
+    onDelete,
+  } = props;
+  const [isOpen, setIsOpen] = useState(false);
+  const anchorElRef = useRef<HTMLButtonElement>(null);
+
+  const handleLock = () => {
+    // Disabled attribute on MenuItem is for styling only, so check if the user can lock the bot
+    if (!canLock) return;
+    onLock();
+    setIsOpen(false);
+  };
+
+  const handleUnlock = () => {
+    // Disabled attribute on MenuItem is for styling only, so check if the user can unlock the bot
+    if (!canUnlock) return;
+    onUnlock();
+    setIsOpen(false);
+  };
+
+  const handleDelete = () => {
+    // Disabled attribute on MenuItem is for styling only, so check if the user can delete the bot
+    if (!canDelete) return;
+    onDelete();
+    setIsOpen(false);
+  };
+
+  return (
+    <div>
+      <FilledButtonIcon
+        setRef={anchorElRef}
+        intent="neutral"
+        onClick={() => {
+          setIsOpen(true);
+        }}
+        data-testid="overflow-btn-open"
+      >
+        <MoreVert size="medium" />
+      </FilledButtonIcon>
+
+      <Menu
+        anchorEl={anchorElRef.current}
+        open={isOpen}
+        onClose={() => setIsOpen(false)}
+        transformOrigin={{
+          vertical: 'top',
+          horizontal: 'right',
+        }}
+        anchorOrigin={{
+          vertical: 'bottom',
+          horizontal: 'right',
+        }}
+      >
+        {isLocked ? (
+          <MenuItem disabled={!canUnlock} onClick={handleUnlock}>
+            <Flex gap={2}>
+              <Unlock size="small" />
+              Unlock Bot...
+            </Flex>
+          </MenuItem>
+        ) : (
+          <MenuItem disabled={!canLock} onClick={handleLock}>
+            <Flex gap={2}>
+              <LockKey size="small" />
+              Lock Bot...
+            </Flex>
+          </MenuItem>
+        )}
+
+        <MenuItem disabled={!canDelete} onClick={handleDelete}>
+          <Flex gap={2}>
+            <StyledTrashIcon size="small" />
+            Delete Bot...
+          </Flex>
+        </MenuItem>
+      </Menu>
+    </div>
+  );
+}
+
+const StyledTrashIcon = styled(Trash)`
+  color: ${({ theme }) => theme.colors.interactive.solid.danger.default};
+`;
+
+const FilledButtonIcon = styled(Button)`
+  width: 32px;
+  height: 32px;
+  padding: 0;
+`;
diff --git a/web/packages/teleport/src/Bots/Details/Instance.story.tsx b/web/packages/teleport/src/Bots/Details/Instance.story.tsx
new file mode 100644
index 0000000000000..5b1d42e0b2489
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/Instance.story.tsx
@@ -0,0 +1,140 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+
+import { Instance } from './Instance';
+import { methods } from './JoinMethodIcon.story';
+
+const meta = {
+  title: 'Teleport/Bots/Details/Instance',
+  component: Wrapper,
+  argTypes: {
+    activeAt: {
+      control: {
+        type: 'date',
+      },
+    },
+    method: {
+      control: 'select',
+      options: methods,
+    },
+    version: {
+      control: 'select',
+      options: ['6.0.0', '5.0.0', '4.4.0', '4.3.999', '3.2.1', '2.0.1'],
+    },
+    os: {
+      control: 'select',
+      options: ['windows', 'linux', 'darwin', '--fallback--'].sort(),
+    },
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Item: Story = {
+  args: {
+    id: '686750f5-0f21-4a6f-b151-fa11a603701d',
+    botName: '',
+    activeAt: new Date('2025-07-18T14:54:32Z').getTime(),
+    hostname: 'my-svc.my-namespace.svc.cluster-domain.example',
+    method: 'kubernetes',
+    version: '4.4.0',
+    os: 'linux',
+    isSelectable: true,
+    isSelected: false,
+  },
+};
+
+export const ItemWithNoHeartbeatData: Story = {
+  args: {
+    id: '686750f5-0f21-4a6f-b151-fa11a603701d',
+  },
+};
+
+export const ItemWithLongValues: Story = {
+  args: {
+    id: 'fa11a603701dfa11a603701dfa11a603701dfa11a603701dfa11a603701dfa113701d',
+    activeAt: new Date('2025-07-18T14:54:32Z').getTime(),
+    hostname: 'hostnamehostnamehostnamehostnamehostnamehostnamehostnamehostnam',
+    method: 'kubernetes',
+    version: '4.4.0-fa11a60',
+    os: 'linux',
+  },
+};
+
+export const ItemWithLongValuesAndBotName: Story = {
+  args: {
+    id: 'fa11a603701dfa11a603701dfa11a603701dfa11a603701dfa11a603701dfa113701d',
+    botName: 'ansible-worker-ansible-worker-ansible-worker-ansible-worker',
+    activeAt: new Date('2025-07-18T14:54:32Z').getTime(),
+    hostname: 'hostnamehostnamehostnamehostnamehostnamehostnamehostnamehostnam',
+    method: 'kubernetes',
+    version: '4.4.0-fa11a60',
+    os: 'linux',
+  },
+};
+
+type Props = {
+  id: Parameters<typeof Instance>[0]['data']['id'];
+  botName?: Parameters<typeof Instance>[0]['data']['botName'];
+  version?: Parameters<typeof Instance>[0]['data']['version'];
+  hostname?: Parameters<typeof Instance>[0]['data']['hostname'];
+  activeAt?: number;
+  method?: Parameters<typeof Instance>[0]['data']['method'];
+  os?: Parameters<typeof Instance>[0]['data']['os'];
+  isSelectable?: Parameters<typeof Instance>[0]['isSelectable'];
+  isSelected?: Parameters<typeof Instance>[0]['isSelected'];
+};
+function Wrapper(props: Props) {
+  const { isSelectable, isSelected, activeAt, ...data } = props;
+  return (
+    <TeleportProviderBasic>
+      <Container>
+        <Container400>
+          <Instance
+            isSelectable={isSelectable}
+            isSelected={isSelected}
+            onSelected={undefined}
+            data={{
+              ...data,
+              activeAt: activeAt ? new Date(activeAt).toISOString() : undefined,
+            }}
+          />
+        </Container400>
+      </Container>
+    </TeleportProviderBasic>
+  );
+}
+
+const Container = styled(Flex)`
+  align-items: center;
+  justify-content: center;
+  padding: 32px;
+`;
+
+const Container400 = styled.div`
+  width: 400px;
+`;
diff --git a/web/packages/teleport/src/Bots/Details/Instance.tsx b/web/packages/teleport/src/Bots/Details/Instance.tsx
new file mode 100644
index 0000000000000..a37128c7e6172
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/Instance.tsx
@@ -0,0 +1,284 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import format from 'date-fns/format';
+import formatDistanceToNowStrict from 'date-fns/formatDistanceToNowStrict';
+import parseISO from 'date-fns/parseISO';
+import { ReactElement } from 'react';
+import styled, { css } from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+import { ArrowFatLinesUp } from 'design/Icon/Icons/ArrowFatLinesUp';
+import {
+  DangerOutlined,
+  SecondaryOutlined,
+  WarningOutlined,
+} from 'design/Label/Label';
+import { ResourceIcon } from 'design/ResourceIcon';
+import Text from 'design/Text/Text';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
+
+import { useClusterVersion } from '../../useClusterVersion';
+import { JoinMethodIcon } from './JoinMethodIcon';
+
+export function Instance(props: {
+  data: {
+    id: string;
+    botName?: string;
+    version?: string;
+    hostname?: string;
+    activeAt?: string;
+    method?: string;
+    os?: string;
+  };
+  isSelectable?: boolean;
+  isSelected?: boolean;
+  onSelected?: () => void;
+}) {
+  const {
+    data: { id, botName, version, hostname, activeAt, method, os },
+    isSelectable,
+    isSelected,
+    onSelected,
+  } = props;
+
+  const hasHeartbeatData = !!version || !!hostname || !!method || !!os;
+
+  return (
+    <Container
+      $isSelectable={!!isSelectable}
+      $isSelected={!!isSelected}
+      onClick={onSelected}
+      onKeyUp={
+        onSelected
+          ? event => {
+              if (event.key === 'Enter') {
+                onSelected();
+              }
+            }
+          : undefined
+      }
+      role="listitem"
+      tabIndex={0}
+      aria-label={`${botName}/${id}`}
+    >
+      <TopRow>
+        {botName ? (
+          <BotNameContainer alignItems={'center'} gap={1}>
+            <BotNameText>
+              {botName}/{shortenId(id)}
+            </BotNameText>
+            <CopyButton value={`${botName}/${id}`} />
+          </BotNameContainer>
+        ) : (
+          <IdText typography="body2">{id}</IdText>
+        )}
+        {activeAt ? (
+          <HoverTooltip
+            placement="top"
+            tipContent={format(parseISO(activeAt), 'PP, p z')}
+          >
+            <TimeText>{`${formatDistanceToNowStrict(parseISO(activeAt))} ago`}</TimeText>
+          </HoverTooltip>
+        ) : undefined}
+      </TopRow>
+      {hasHeartbeatData ? (
+        <BottomRow>
+          <Flex gap={2} flex={1} overflow={'hidden'} alignItems={'flex-end'}>
+            <Version version={version} />
+
+            {hostname ? (
+              <HoverTooltip
+                placement="top"
+                tipContent={`Hostname: ${hostname}`}
+              >
+                <SecondaryOutlined borderRadius={2}>
+                  <HostnameText>{hostname}</HostnameText>
+                </SecondaryOutlined>
+              </HoverTooltip>
+            ) : undefined}
+          </Flex>
+          <Flex gap={2}>
+            {method ? (
+              <JoinMethodIcon method={method} size={'large'} />
+            ) : undefined}
+
+            {os ? (
+              <HoverTooltip placement="top" tipContent={os}>
+                {os === 'darwin' ? (
+                  <ResourceIcon name={'apple'} size={'large'} />
+                ) : os === 'windows' ? (
+                  <ResourceIcon name={'windows'} size={'large'} />
+                ) : os === 'linux' ? (
+                  <ResourceIcon name={'linux'} size={'large'} />
+                ) : (
+                  <ResourceIcon name={'server'} size={'large'} />
+                )}
+              </HoverTooltip>
+            ) : undefined}
+          </Flex>
+        </BottomRow>
+      ) : (
+        <EmptyText>No heartbeat data</EmptyText>
+      )}
+    </Container>
+  );
+}
+
+const Container = styled(Flex)<{
+  $isSelectable: boolean;
+  $isSelected: boolean;
+}>`
+  flex-direction: column;
+  padding: ${props => props.theme.space[3]}px;
+  padding-top: ${p => p.theme.space[2]}px;
+  padding-bottom: ${p => p.theme.space[2]}px;
+  background-color: ${p => p.theme.colors.levels.surface};
+  gap: ${p => p.theme.space[1]}px;
+
+  ${p =>
+    p.$isSelected
+      ? css`
+          border-left: ${p.theme.space[1]}px solid
+            ${p.theme.colors.interactive.solid.primary.default};
+          padding-left: ${props => props.theme.space[3] - p.theme.space[1]}px;
+          background-color: ${p.theme.colors.levels.sunken};
+        `
+      : ''}
+
+  ${p =>
+    p.$isSelectable
+      ? css`
+          cursor: pointer;
+
+          &:hover {
+            background-color: ${p.theme.colors.levels.sunken};
+          }
+          &:active,
+          &:focus {
+            outline: none;
+            background-color: ${p.theme.colors.levels.deep};
+          }
+        `
+      : ''}
+
+  transition: background-color 200ms linear;
+`;
+
+const TopRow = styled(Flex)`
+  justify-content: space-between;
+  align-items: center;
+  overflow: hidden;
+  gap: ${p => p.theme.space[2]}px;
+`;
+
+const BottomRow = styled(Flex)`
+  justify-content: space-between;
+  align-items: flex-end;
+  gap: ${p => p.theme.space[2]}px;
+  overflow: hidden;
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
+
+const TimeText = styled(Text).attrs({
+  typography: 'body4',
+})`
+  white-space: nowrap;
+`;
+
+const IdText = styled(Text)`
+  flex: 1;
+  white-space: nowrap;
+`;
+
+const BotNameText = styled(Text)`
+  white-space: nowrap;
+`;
+
+const BotNameContainer = styled(Flex)`
+  flex: 1;
+  overflow: hidden;
+`;
+
+const HostnameText = styled(Text).attrs({
+  typography: 'body3',
+})`
+  white-space: nowrap;
+`;
+
+function Version(props: { version: string | undefined }) {
+  const { version } = props;
+  const { checkCompatibility } = useClusterVersion();
+  const versionCompatibility = checkCompatibility(version);
+
+  let Wrapper = SecondaryOutlined;
+  let icon: ReactElement | null = <ArrowFatLinesUp size={'small'} />;
+  let tooltip = 'Version is up to date';
+  if (versionCompatibility?.isCompatible) {
+    switch (versionCompatibility.reason) {
+      case 'match':
+        icon = null;
+        break;
+      case 'upgrade-minor':
+        tooltip = 'An upgrade is available';
+        break;
+      case 'upgrade-major':
+        Wrapper = WarningOutlined;
+        tooltip =
+          'Version is one major version behind. Consider upgrading soon.';
+        break;
+    }
+  } else {
+    switch (versionCompatibility?.reason) {
+      case 'too-old':
+        Wrapper = DangerOutlined;
+        tooltip =
+          'Version is two or more major versions behind, and is no longer compatible.';
+        break;
+      case 'too-new':
+        Wrapper = DangerOutlined;
+        tooltip = 'Version is ahead, and is not compatible.';
+        break;
+    }
+  }
+
+  return version ? (
+    <VersionContainer>
+      <HoverTooltip placement="top" tipContent={tooltip}>
+        <Wrapper borderRadius={2}>
+          <Flex gap={1}>
+            {icon}
+            <Text typography="body3">v{version}</Text>
+          </Flex>
+        </Wrapper>
+      </HoverTooltip>
+    </VersionContainer>
+  ) : undefined;
+}
+
+const VersionContainer = styled.div`
+  flex-shrink: 0;
+`;
+
+function shortenId(id: string) {
+  return id.substring(0, 7);
+}
diff --git a/web/packages/teleport/src/Bots/Details/InstancesPanel.story.tsx b/web/packages/teleport/src/Bots/Details/InstancesPanel.story.tsx
new file mode 100644
index 0000000000000..2df7a10403191
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/InstancesPanel.story.tsx
@@ -0,0 +1,181 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { action } from 'storybook/internal/actions';
+import styled from 'styled-components';
+
+import { CardTile } from 'design/CardTile/CardTile';
+import Flex from 'design/Flex/Flex';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  listBotInstancesError,
+  listBotInstancesForever,
+  listBotInstancesSuccess,
+} from 'teleport/test/helpers/botInstances';
+
+import { InstancesPanel } from './InstancesPanel';
+
+const meta = {
+  title: 'Teleport/Bots/Details/InstancesPanel',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+  excludeStories: ['listBotInstancesSuccessHandler'],
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const listBotInstancesSuccessHandler = listBotInstancesSuccess(
+  {
+    bot_instances: [
+      {
+        bot_name: 'ansible-worker',
+        instance_id: crypto.randomUUID(),
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'my-svc.my-namespace.svc.cluster-domain.example',
+        join_method_latest: 'github',
+        os_latest: 'linux',
+        version_latest: '4.4.0',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: crypto.randomUUID(),
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'win-123a',
+        join_method_latest: 'tpm',
+        os_latest: 'windows',
+        version_latest: '4.3.18+ab12hd',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: crypto.randomUUID(),
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'mac-007',
+        join_method_latest: 'kubernetes',
+        os_latest: 'darwin',
+        version_latest: '3.9.99',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: crypto.randomUUID(),
+        active_at_latest: '2025-07-22T10:54:00Z',
+        host_name_latest: 'aws:g49dh27dhjm3',
+        join_method_latest: 'ec2',
+        os_latest: 'linux',
+        version_latest: '1.3.2',
+      },
+      {
+        bot_name: 'ansible-worker',
+        instance_id: crypto.randomUUID(),
+      },
+    ],
+    next_page_token: '',
+  },
+  'v1'
+);
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [listBotInstancesSuccessHandler],
+    },
+  },
+};
+
+export const WithFetchPending: Story = {
+  parameters: {
+    msw: {
+      handlers: [listBotInstancesForever()],
+    },
+  },
+};
+
+export const WithFetchFailure: Story = {
+  parameters: {
+    msw: {
+      handlers: [listBotInstancesError(500, 'something went wrong')],
+    },
+  },
+};
+
+export const NoBotInstancesListPermission: Story = {
+  args: {
+    hasBotInstanceListPermission: false,
+  },
+};
+
+function Wrapper(props: { hasBotInstanceListPermission?: boolean }) {
+  const { hasBotInstanceListPermission = true } = props;
+
+  const customAcl = makeAcl({
+    botInstances: {
+      ...defaultAccess,
+      list: hasBotInstanceListPermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <Container>
+          <InnerContainer>
+            <InstancesPanel
+              botName="ansible-worker"
+              onItemSelected={action('onItemSelected')}
+            />
+          </InnerContainer>
+        </Container>
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
+
+const Container = styled(Flex)`
+  align-items: center;
+  justify-content: center;
+`;
+
+const InnerContainer = styled(CardTile)`
+  max-width: 400px;
+  height: 600px;
+  overflow: auto;
+  padding: 0;
+  gap: 0;
+  margin: ${props => props.theme.space[1]}px;
+`;
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
diff --git a/web/packages/teleport/src/Bots/Details/InstancesPanel.test.tsx b/web/packages/teleport/src/Bots/Details/InstancesPanel.test.tsx
new file mode 100644
index 0000000000000..0d19e6cfb998f
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/InstancesPanel.test.tsx
@@ -0,0 +1,155 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  render,
+  screen,
+  testQueryClient,
+  waitForElementToBeRemoved,
+} from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  listBotInstancesError,
+  listBotInstancesSuccess,
+} from 'teleport/test/helpers/botInstances';
+
+import { InstancesPanel } from './InstancesPanel';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('InstancesPanel', () => {
+  it('should show a fetch error state', async () => {
+    withFetchError();
+    render(<InstancesPanel botName="test-bot" onItemSelected={jest.fn()} />, {
+      wrapper: makeWrapper(),
+    });
+    await waitForLoading();
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
+
+  it('should show a no permissions state', async () => {
+    withFetchError();
+    render(<InstancesPanel botName="test-bot" onItemSelected={jest.fn()} />, {
+      wrapper: makeWrapper({
+        customAcl: makeAcl({
+          botInstances: {
+            ...defaultAccess,
+            list: false,
+          },
+        }),
+      }),
+    });
+
+    expect(
+      screen.getByText('You do not have permission to view bot instances.', {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+  });
+
+  it('renders instance items', async () => {
+    withFetchSuccess();
+
+    render(<InstancesPanel botName="test-bot" onItemSelected={jest.fn()} />, {
+      wrapper: makeWrapper(),
+    });
+    await waitForLoading();
+
+    expect(
+      screen.getByText('c11250e0-00c2-4f52-bcdf-b367f80b9461')
+    ).toBeInTheDocument();
+  });
+});
+
+const waitForLoading = async () => {
+  await waitForElementToBeRemoved(() =>
+    screen.queryByTestId('loading-instances')
+  );
+};
+
+function withFetchSuccess() {
+  server.use(
+    listBotInstancesSuccess(
+      {
+        bot_instances: [
+          {
+            bot_name: 'ansible-worker',
+            instance_id: 'c11250e0-00c2-4f52-bcdf-b367f80b9461',
+            active_at_latest: '2025-07-22T10:54:00Z',
+            host_name_latest: 'svr-lon-01-ab23cd',
+            join_method_latest: 'github',
+            os_latest: 'linux',
+            version_latest: '4.4.16',
+          },
+        ],
+        next_page_token: '',
+      },
+      'v1'
+    )
+  );
+}
+
+function withFetchError() {
+  server.use(listBotInstancesError(500, 'something went wrong'));
+}
+
+function makeWrapper(options?: { customAcl?: ReturnType<typeof makeAcl> }) {
+  const {
+    customAcl = makeAcl({
+      botInstances: {
+        ...defaultAccess,
+        list: true,
+      },
+    }),
+  } = options ?? {};
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ConfiguredThemeProvider theme={darkTheme}>
+          <ContextProvider ctx={ctx}>{children}</ContextProvider>
+        </ConfiguredThemeProvider>
+      </QueryClientProvider>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Details/InstancesPanel.tsx b/web/packages/teleport/src/Bots/Details/InstancesPanel.tsx
new file mode 100644
index 0000000000000..f5cec75d57742
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/InstancesPanel.tsx
@@ -0,0 +1,215 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query';
+import React, { useEffect, useState } from 'react';
+import styled from 'styled-components';
+
+import { Alert } from 'design/Alert/Alert';
+import Box from 'design/Box/Box';
+import { ButtonSecondary, ButtonText } from 'design/Button';
+import Flex from 'design/Flex/Flex';
+import { SortAscending, SortDescending } from 'design/Icon';
+import { Indicator } from 'design/Indicator/Indicator';
+import Text from 'design/Text';
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+
+import { listBotInstances } from 'teleport/services/bot/bot';
+import { BotInstanceSummary } from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
+
+import { Instance } from './Instance';
+import { PanelTitleText } from './Panel';
+
+export function InstancesPanel(props: {
+  botName: string;
+  onItemSelected: (instance: BotInstanceSummary) => void;
+}) {
+  const { botName, onItemSelected } = props;
+
+  const [sortField] = useState('active_at_latest');
+  const [sortDir, setSortDir] = useState<SortOrder>('DESC');
+
+  const contentRef = React.useRef<HTMLDivElement>(null);
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasListPermission = flags.listBotInstances;
+
+  const {
+    isSuccess,
+    data,
+    isLoading,
+    isFetchingNextPage,
+    isError,
+    error,
+    hasNextPage,
+    fetchNextPage,
+  } = useInfiniteQuery({
+    enabled: hasListPermission,
+    queryKey: ['bot_instances', 'list', sortField, sortDir, botName],
+    queryFn: ({ pageParam, signal }) =>
+      listBotInstances(
+        {
+          pageSize: 32,
+          pageToken: pageParam,
+          sortField,
+          sortDir,
+          botName,
+        },
+        signal
+      ),
+    initialPageParam: '',
+    getNextPageParam: data => data?.next_page_token,
+    placeholderData: keepPreviousData,
+    staleTime: 30_000, // Cached pages are valid for 30 seconds
+  });
+
+  const handleToggleSort = () => {
+    setSortDir(dir => (dir === 'DESC' ? 'ASC' : 'DESC'));
+  };
+
+  // Scrolls to the top when the selected sort changes
+  useEffect(() => {
+    contentRef.current?.scrollTo({ top: 0, behavior: 'instant' });
+  }, [sortField, sortDir]);
+
+  const makeOnSelectedCallback = (instance: BotInstanceSummary) => () => {
+    onItemSelected(instance);
+  };
+
+  return (
+    <Container>
+      <TitleContainer>
+        <PanelTitleText>Active Instances</PanelTitleText>
+        {isSuccess ? (
+          <ActionButton onClick={handleToggleSort}>
+            Recent
+            {sortDir === 'DESC' ? (
+              <SortDescending size={'medium'} />
+            ) : (
+              <SortAscending size={'medium'} />
+            )}
+          </ActionButton>
+        ) : undefined}
+      </TitleContainer>
+
+      <Divider />
+
+      {isLoading ? (
+        <Box data-testid="loading-instances" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      ) : undefined}
+
+      {!hasListPermission ? (
+        <Alert m={3} kind="info">
+          You do not have permission to view bot instances. Missing role
+          permissions: <code>botInstances.list</code>
+        </Alert>
+      ) : undefined}
+
+      {isError ? (
+        <Alert m={3} kind="danger" details={error.message}>
+          Failed to fetch instances
+        </Alert>
+      ) : undefined}
+
+      {isSuccess ? (
+        <>
+          {data.pages.length > 0 && data.pages[0].bot_instances.length > 0 ? (
+            <ContentContainer ref={contentRef}>
+              {data.pages.map((page, i) =>
+                page.bot_instances.map((instance, j) => (
+                  <React.Fragment key={`${instance.instance_id}`}>
+                    {i === 0 && j === 0 ? undefined : <Divider />}
+                    <Instance
+                      data={{
+                        id: instance.instance_id,
+                        version: instance.version_latest,
+                        hostname: instance.host_name_latest,
+                        activeAt: instance.active_at_latest,
+                        method: instance.join_method_latest,
+                        os: instance.os_latest,
+                      }}
+                      isSelectable
+                      onSelected={makeOnSelectedCallback(instance)}
+                    />
+                  </React.Fragment>
+                ))
+              )}
+
+              <Divider />
+
+              <LoadMoreContainer>
+                <ButtonSecondary
+                  onClick={() => fetchNextPage()}
+                  disabled={!hasNextPage || isFetchingNextPage}
+                >
+                  Load More
+                </ButtonSecondary>
+              </LoadMoreContainer>
+            </ContentContainer>
+          ) : (
+            <Box p={3}>
+              <EmptyText>No active instances</EmptyText>
+            </Box>
+          )}
+        </>
+      ) : undefined}
+    </Container>
+  );
+}
+
+const Container = styled.section`
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+`;
+
+const TitleContainer = styled(Flex)`
+  align-items: center;
+  justify-content: space-between;
+  padding: ${p => p.theme.space[3]}px;
+  gap: ${p => p.theme.space[2]}px;
+`;
+
+const ActionButton = styled(ButtonText)`
+  padding-left: ${p => p.theme.space[2]}px;
+  padding-right: ${p => p.theme.space[2]}px;
+  gap: ${p => p.theme.space[2]}px;
+`;
+
+const ContentContainer = styled.div`
+  overflow: auto;
+`;
+
+const LoadMoreContainer = styled(Flex)`
+  justify-content: center;
+  padding: ${props => props.theme.space[3]}px;
+`;
+
+const Divider = styled.div`
+  height: 1px;
+  flex-shrink: 0;
+  background-color: ${p => p.theme.colors.interactive.tonal.neutral[0]};
+`;
+
+const EmptyText = styled(Text)`
+  color: ${p => p.theme.colors.text.muted};
+`;
diff --git a/web/packages/teleport/src/Bots/Details/JoinMethodIcon.story.tsx b/web/packages/teleport/src/Bots/Details/JoinMethodIcon.story.tsx
new file mode 100644
index 0000000000000..fc13377b4a234
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/JoinMethodIcon.story.tsx
@@ -0,0 +1,111 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+import { IconProps } from 'design/Icon/Icon';
+
+import { JoinMethodIcon } from './JoinMethodIcon';
+
+const meta = {
+  title: 'Teleport/Bots/Details/JoinMethodIcon',
+  component: Wrapper,
+  excludeStories: ['methods'],
+  argTypes: {
+    size: {
+      control: 'select',
+      options: ['fill', 'small', 'medium', 'large', 'extra-large'],
+    },
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const AllMethods: Story = {
+  args: {
+    size: 'extra-large',
+  },
+};
+
+function Wrapper(props: { size: IconProps['size'] }) {
+  return (
+    <Container>
+      {methods.map(m => (
+        <Flex key={m} flexDirection={'column'} alignItems={'center'} gap={2}>
+          <IconContainer>
+            <JoinMethodIcon
+              method={m}
+              size={props.size}
+              color={hasIcon.includes(m) ? undefined : 'red'}
+            />
+          </IconContainer>
+          {m}
+        </Flex>
+      ))}
+    </Container>
+  );
+}
+
+const Container = styled(Flex)`
+  display: grid;
+  grid-template-columns: repeat(5, auto);
+  gap: ${props => props.theme.space[4]}px;
+  align-items: center;
+  justify-content: center;
+`;
+
+const IconContainer = styled(Flex)`
+  align-items: center;
+  justify-content: center;
+  border: 1px dashed ${p => p.theme.colors.text.main};
+`;
+
+export const methods = [
+  'token',
+  'ec2',
+  'iam',
+  'github',
+  'circleci',
+  'kubernetes',
+  'azure',
+  'gitlab',
+  'gcp',
+  'spacelift',
+  'tpm',
+  'terraform_cloud',
+  'bitbucket',
+  'oracle',
+  'azure_devops',
+  'bound_keypair',
+  '--fallback--',
+].sort();
+
+const hasIcon = [
+  'token',
+  'ec2',
+  'iam',
+  'github',
+  'kubernetes',
+  'tpm',
+  'bound_keypair',
+  '--fallback--',
+];
diff --git a/web/packages/teleport/src/Bots/Details/JoinMethodIcon.tsx b/web/packages/teleport/src/Bots/Details/JoinMethodIcon.tsx
new file mode 100644
index 0000000000000..75d14abc54926
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/JoinMethodIcon.tsx
@@ -0,0 +1,96 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { IconProps } from 'design/Icon/Icon';
+import { Key } from 'design/Icon/Icons/Key';
+import { Keypair } from 'design/Icon/Icons/Keypair';
+import { Memory } from 'design/Icon/Icons/Memory';
+import { ResourceIcon } from 'design/ResourceIcon';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+
+export function JoinMethodIcon(props: {
+  method: string | undefined | null;
+  size?: IconProps['size'];
+  color?: IconProps['color'];
+  includeTooltip?: boolean;
+}) {
+  const { method, size, color, includeTooltip = true } = props;
+  if (!method) return null;
+
+  const icon = renderLogo(method, size) ?? renderIcon(method, size, color);
+
+  return includeTooltip ? (
+    <HoverTooltip placement="top" tipContent={method}>
+      {icon}
+    </HoverTooltip>
+  ) : (
+    icon
+  );
+}
+
+const renderLogo = (method: string, size: IconProps['size']) => {
+  const name = (() => {
+    switch (method) {
+      case 'ec2':
+        return 'ec2';
+      case 'iam':
+        return 'awsaccount';
+      case 'github':
+        return 'github';
+      case 'circleci':
+        return 'circleci';
+      case 'kubernetes':
+        return 'kube';
+      case 'azure':
+        return 'azure';
+      case 'gitlab':
+        return 'gitlab';
+      case 'gcp':
+        return 'googlecloud';
+      case 'spacelift':
+        return 'spacelift';
+      case 'terraform_cloud':
+        return 'terraform';
+      case 'bitbucket':
+        return 'git';
+      case 'oracle':
+        return 'oracle';
+      case 'azure_devops':
+        return 'azure';
+    }
+  })();
+
+  return name ? <ResourceIcon name={name} size={size} /> : undefined;
+};
+
+const renderIcon = (
+  method: string,
+  size: IconProps['size'],
+  color: IconProps['color']
+) => {
+  switch (method) {
+    case 'token':
+      return <Key size={size} color={color} />;
+    case 'tpm':
+      return <Memory size={size} color={color} />;
+    case 'bound_keypair':
+      return <Keypair size={size} color={color} />;
+    default:
+      return <Key size={size} color={color} />;
+  }
+};
diff --git a/web/packages/teleport/src/Bots/Details/Panel.tsx b/web/packages/teleport/src/Bots/Details/Panel.tsx
new file mode 100644
index 0000000000000..9c0fab4c4703b
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Details/Panel.tsx
@@ -0,0 +1,82 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { PropsWithChildren, ReactNode } from 'react';
+import styled from 'styled-components';
+
+import { ButtonText } from 'design/Button/Button';
+import Flex from 'design/Flex/Flex';
+import Text from 'design/Text/Text';
+
+export function Panel(
+  props: PropsWithChildren & {
+    title: string;
+    isSubPanel?: boolean;
+    action?: {
+      label: string;
+      onClick: () => void;
+      iconLeft?: ReactNode;
+      iconRight?: ReactNode;
+      disabled?: boolean;
+    };
+    testId?: string;
+  }
+) {
+  const { title, isSubPanel = false, action, children, testId } = props;
+  return (
+    <section>
+      <Container data-testid={testId}>
+        <TitleContainer>
+          <PanelTitleText $isSubPanel={isSubPanel}>{title}</PanelTitleText>
+          {action ? (
+            <ActionButton onClick={action.onClick} disabled={action.disabled}>
+              {action.iconLeft}
+              {action.label}
+              {action.iconRight}
+            </ActionButton>
+          ) : undefined}
+        </TitleContainer>
+        {children}
+      </Container>
+    </section>
+  );
+}
+
+const Container = styled(Flex)`
+  flex-direction: column;
+`;
+
+const TitleContainer = styled(Flex)`
+  align-items: center;
+  justify-content: space-between;
+  padding: ${p => p.theme.space[3]}px;
+  gap: 8px;
+`;
+
+export const PanelTitleText = styled(Text).attrs<{ $isSubPanel?: boolean }>(
+  ({ $isSubPanel = false }) => ({
+    as: $isSubPanel ? 'h3' : 'h2',
+    typography: $isSubPanel ? 'h3' : 'h2',
+  })
+)``;
+
+const ActionButton = styled(ButtonText)`
+  padding-left: 8px;
+  padding-right: 8px;
+  gap: 8px;
+`;
diff --git a/web/packages/teleport/src/Bots/Edit/EditDialog.story.tsx b/web/packages/teleport/src/Bots/Edit/EditDialog.story.tsx
new file mode 100644
index 0000000000000..6b47ef2f154c7
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Edit/EditDialog.story.tsx
@@ -0,0 +1,269 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  editBotError,
+  editBotForever,
+  editBotSuccess,
+  getBotError,
+  getBotForever,
+  getBotSuccess,
+} from 'teleport/test/helpers/bots';
+import { successGetRoles } from 'teleport/test/helpers/roles';
+
+import { EditDialog } from './EditDialog';
+
+const meta = {
+  title: 'Teleport/Bots/Edit',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+const successHandler = getBotSuccess({
+  name: 'ansible-worker',
+  roles: ['terraform-provider'],
+  traits: [
+    {
+      name: 'logins',
+      values: ['guest'],
+    },
+    {
+      name: 'db_names',
+      values: ['*'],
+    },
+    {
+      name: 'custom_idp',
+      values: ['val-1', 'val-2', 'val-3'],
+    },
+  ],
+  max_session_ttl: {
+    seconds: 43200,
+  },
+});
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotSuccess('v1'),
+        editBotSuccess('v2'),
+        editBotSuccess('v3'),
+      ],
+    },
+  },
+};
+
+export const WithFetchPending: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotForever()],
+    },
+  },
+};
+
+export const WithFetchFailure: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotError(500, 'error message goes here')],
+    },
+  },
+};
+
+export const WithBotNotFound: Story = {
+  parameters: {
+    msw: {
+      handlers: [getBotError(404, 'not found')],
+    },
+  },
+};
+
+export const WithNoBotReadPermission: Story = {
+  args: {
+    hasBotsRead: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [getBotError(500, 'you have permission, congrats 🎉')],
+    },
+  },
+};
+
+export const WithNoBotEditPermission: Story = {
+  args: {
+    hasBotsEdit: false,
+  },
+  parameters: {
+    msw: {
+      handlers: [successHandler],
+    },
+  },
+};
+
+export const WithSubmitPending: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotForever(),
+      ],
+    },
+  },
+};
+
+export const WithSubmitFailure: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotError('v1', 500, 'something went wrong'),
+        editBotError('v2', 500, 'something went wrong'),
+        editBotError('v3', 500, 'something went wrong'),
+      ],
+    },
+  },
+};
+
+export const WithSubmitOutdatedProxy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        successHandler,
+        successGetRoles({
+          startKey: '',
+          items: ['access', 'editor', 'terraform-provider'].map(r => ({
+            content: r,
+            id: r,
+            name: r,
+            kind: 'role',
+          })),
+        }),
+        editBotError('v1', 404, 'path not found', {
+          proxyVersion: {
+            major: 19,
+            minor: 0,
+            patch: 0,
+            preRelease: 'dev',
+            string: '18.0.0',
+          },
+        }),
+        editBotError('v2', 404, 'path not found', {
+          proxyVersion: {
+            major: 19,
+            minor: 0,
+            patch: 0,
+            preRelease: 'dev',
+            string: '18.0.0',
+          },
+        }),
+        editBotError('v3', 404, 'path not found', {
+          proxyVersion: {
+            major: 19,
+            minor: 0,
+            patch: 0,
+            preRelease: 'dev',
+            string: '18.0.0',
+          },
+        }),
+      ],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(props?: { hasBotsRead?: boolean; hasBotsEdit?: boolean }) {
+  const { hasBotsRead = true, hasBotsEdit = true } = props ?? {};
+
+  const customAcl = makeAcl({
+    bots: {
+      ...defaultAccess,
+      read: hasBotsRead,
+      edit: hasBotsEdit,
+    },
+    roles: {
+      ...defaultAccess,
+      list: true,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <EditDialog
+            botName="ansible-worker"
+            onCancel={() => {}}
+            onSuccess={() => {}}
+          />
+        </TeleportProviderBasic>
+      </MemoryRouter>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/Bots/Edit/EditDialog.test.tsx b/web/packages/teleport/src/Bots/Edit/EditDialog.test.tsx
new file mode 100644
index 0000000000000..6523f1a550f87
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Edit/EditDialog.test.tsx
@@ -0,0 +1,483 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { UserEvent } from '@testing-library/user-event';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import selectEvent from 'react-select-event';
+
+import darkTheme from 'design/theme/themes/darkTheme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  act,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitForElementToBeRemoved,
+} from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { EditBotRequest, FlatBot } from 'teleport/services/bot/types';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  EditBotApiVersion,
+  editBotError,
+  editBotSuccess,
+  getBotError,
+  getBotSuccess,
+} from 'teleport/test/helpers/bots';
+import { successGetRoles } from 'teleport/test/helpers/roles';
+
+import { EditDialog } from './EditDialog';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('EditDialog', () => {
+  it('should show a fetch error state', async () => {
+    withFetchBotError();
+    withFetchRolesSuccess({ items: ['test-role'] });
+    renderComponent();
+    await waitForLoading();
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+  });
+
+  it('should show a read unauthorised error state', async () => {
+    withFetchBotError();
+    renderComponent({
+      customAcl: makeAcl({
+        bots: {
+          ...defaultAccess,
+          read: false,
+        },
+      }),
+    });
+
+    expect(
+      screen.getByText('You do not have permission to edit this bot.', {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+
+    const cancelButton = screen.getByRole('button', { name: 'Cancel' });
+    expect(cancelButton).toBeEnabled();
+
+    // For some reason, this test fails with "ForwardRef inside a test was not
+    // wrapped in act()" errors. Perhaps it's caused by the test finishing before
+    // the render has settled. The line below is a hack to get around this issue.
+    await act(() => new Promise(resolve => setTimeout(resolve, 0)));
+  });
+
+  it('should show an edit unauthorised error state', async () => {
+    withFetchBotSuccess();
+    renderComponent({
+      customAcl: makeAcl({
+        bots: {
+          ...defaultAccess,
+          read: true,
+          edit: false,
+        },
+      }),
+    });
+    await waitForLoading();
+
+    expect(
+      screen.getByText('You do not have permission to edit this bot.', {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+
+    const cancelButton = screen.getByRole('button', { name: 'Cancel' });
+    expect(cancelButton).toBeEnabled();
+  });
+
+  it('should allow roles to be edited', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess();
+    withFetchRolesSuccess({ items: ['test-role'] });
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    await inputRole('test-role');
+
+    withSaveSuccess('v1');
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(onSuccess).toHaveBeenCalledTimes(1);
+    expect(onSuccess).toHaveBeenLastCalledWith({
+      description: '',
+      kind: 'bot',
+      labels: new Map(),
+      max_session_ttl: {
+        seconds: 43200,
+      },
+      name: 'test-bot-name',
+      namespace: '',
+      revision: '',
+      roles: ['admin', 'user', 'test-role'],
+      status: 'active',
+      subKind: '',
+      traits: [
+        {
+          name: 'trait-1',
+          values: ['value-1', 'value-2', 'value-3'],
+        },
+      ],
+      type: null,
+      version: 'v1',
+    });
+  });
+
+  it('should allow traits to be edited', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess();
+    withFetchRolesSuccess();
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    const addTraitButton = screen.getByRole('button', {
+      name: 'Add another trait',
+    });
+    await user.click(addTraitButton);
+
+    await inputTrait(user, 'logins', ['test-value']);
+
+    withSaveSuccess('v2');
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(onSuccess).toHaveBeenCalledTimes(1);
+    expect(onSuccess).toHaveBeenLastCalledWith({
+      description: '',
+      kind: 'bot',
+      labels: new Map(),
+      max_session_ttl: {
+        seconds: 43200,
+      },
+      name: 'test-bot-name',
+      namespace: '',
+      revision: '',
+      roles: ['admin', 'user'],
+      status: 'active',
+      subKind: '',
+      traits: [
+        {
+          name: 'trait-1',
+          values: ['value-1', 'value-2', 'value-3'],
+        },
+        {
+          name: 'logins',
+          values: ['test-value'],
+        },
+      ],
+      type: null,
+      version: 'v1',
+    });
+  });
+
+  it('should allow max session ttl to be edited', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess();
+    withFetchRolesSuccess();
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    await inputMaxSessionDuration(user, ' 12h 30m ');
+
+    withSaveSuccess('v2');
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(onSuccess).toHaveBeenCalledTimes(1);
+    expect(onSuccess).toHaveBeenLastCalledWith({
+      description: '',
+      kind: 'bot',
+      labels: new Map(),
+      max_session_ttl: {
+        seconds: 43200 + 30 * 60,
+      },
+      name: 'test-bot-name',
+      namespace: '',
+      revision: '',
+      roles: ['admin', 'user'],
+      status: 'active',
+      subKind: '',
+      traits: [
+        {
+          name: 'trait-1',
+          values: ['value-1', 'value-2', 'value-3'],
+        },
+      ],
+      type: null,
+      version: 'v1',
+    });
+  });
+
+  it('should allow description to be edited', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess({
+      description: '',
+    });
+    withFetchRolesSuccess();
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    await inputDescription(user, 'Hello world!');
+
+    withSaveSuccess();
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(onSuccess).toHaveBeenCalledTimes(1);
+    expect(onSuccess).toHaveBeenLastCalledWith({
+      description: 'Hello world!',
+      kind: 'bot',
+      labels: new Map(),
+      max_session_ttl: {
+        seconds: 43200,
+      },
+      name: 'test-bot-name',
+      namespace: '',
+      revision: '',
+      roles: ['admin', 'user'],
+      status: 'active',
+      subKind: '',
+      traits: [
+        {
+          name: 'trait-1',
+          values: ['value-1', 'value-2', 'value-3'],
+        },
+      ],
+      type: null,
+      version: 'v1',
+    });
+  });
+
+  it('should show a save error state', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess();
+    withFetchRolesSuccess();
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    // Change something to enable the save button
+    await inputMaxSessionDuration(user, '12h 30m');
+
+    withSaveError('v2');
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(screen.getByText('something went wrong')).toBeInTheDocument();
+
+    expect(onSuccess).not.toHaveBeenCalled();
+  });
+
+  it('should show a version mismatch warning', async () => {
+    const onSuccess = jest.fn();
+
+    withFetchBotSuccess();
+    withFetchRolesSuccess({ items: ['test-role'] });
+    const { user } = renderComponent({ onSuccess });
+    await waitForLoading();
+
+    await inputRole('test-role');
+    await inputTrait(user, 'logins', ['test-value']);
+    await inputMaxSessionDuration(user, '12h 30m');
+    await inputDescription(user, 'hello');
+
+    withSaveVersionMismatch();
+    const saveButton = screen.getByRole('button', { name: 'Save' });
+    expect(saveButton).toBeEnabled();
+    await user.click(saveButton);
+
+    expect(onSuccess).not.toHaveBeenCalled();
+
+    expect(
+      screen.getByText(
+        'We could not complete your request. Your proxy (v18.0.0) may be behind the minimum required version (v18.1.0) to support this request. Ensure all proxies are upgraded and try again.'
+      )
+    ).toBeInTheDocument();
+  });
+});
+
+async function inputRole(role: string) {
+  await selectEvent.select(screen.getByLabelText('Roles'), [role]);
+}
+
+async function inputTrait(user: UserEvent, name: string, values: string[]) {
+  await selectEvent.select(screen.getAllByLabelText('trait-key').at(-1)!, [
+    name,
+  ]);
+
+  const traitValue = screen.getAllByLabelText('trait-values');
+
+  for (const value of values) {
+    const input = traitValue.at(-1);
+    await user.clear(input!);
+    await user.type(input!, value + '{enter}');
+  }
+}
+
+async function inputMaxSessionDuration(user: UserEvent, duration: string) {
+  const input = screen.getByLabelText('Max session duration');
+  await user.clear(input);
+  await user.click(input);
+  await user.paste(duration);
+}
+
+async function inputDescription(user: UserEvent, description: string) {
+  const input = screen.getByLabelText('Description');
+  await user.clear(input);
+  await user.click(input);
+  await user.paste(description);
+}
+
+function withFetchBotError(status = 500, message = 'something went wrong') {
+  server.use(getBotError(status, message));
+}
+
+function withSaveError(
+  version: EditBotApiVersion = 'v3',
+  status = 500,
+  message = 'something went wrong'
+) {
+  server.use(editBotError(version, status, message));
+}
+
+function withSaveVersionMismatch(version: EditBotApiVersion = 'v3') {
+  server.use(
+    editBotError(version, 404, 'path not found', {
+      proxyVersion: {
+        major: 19,
+        minor: 0,
+        patch: 0,
+        preRelease: 'dev',
+        string: '18.0.0',
+      },
+    })
+  );
+}
+
+function withFetchBotSuccess(...params: Parameters<typeof getBotSuccess>) {
+  server.use(getBotSuccess(...params));
+}
+
+function withSaveSuccess(
+  version: EditBotApiVersion = 'v3',
+  overrides?: Partial<EditBotRequest>
+) {
+  server.use(editBotSuccess(version, overrides));
+}
+
+function withFetchRolesSuccess(options?: { items: string[] }) {
+  const { items = [] } = options ?? {};
+  server.use(
+    successGetRoles({
+      items: items.map(r => ({
+        name: r,
+        id: r,
+        kind: 'role',
+        content: '',
+      })),
+      startKey: '',
+    })
+  );
+}
+
+function renderComponent(options?: {
+  onCancel?: () => void;
+  onSuccess?: (bot: FlatBot) => void;
+  customAcl?: ReturnType<typeof makeAcl>;
+}) {
+  const {
+    onCancel = jest.fn(),
+    onSuccess = jest.fn(),
+    customAcl,
+  } = options ?? {};
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <EditDialog
+        botName="test-bot-name"
+        onCancel={onCancel}
+        onSuccess={onSuccess}
+      />,
+      { wrapper: makeWrapper({ customAcl }) }
+    ),
+    user,
+  };
+}
+
+async function waitForLoading() {
+  return waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+}
+
+function makeWrapper(params?: { customAcl?: ReturnType<typeof makeAcl> }) {
+  const {
+    customAcl = makeAcl({
+      bots: {
+        ...defaultAccess,
+        read: true,
+        edit: true,
+      },
+      roles: {
+        ...defaultAccess,
+        list: true,
+      },
+    }),
+  } = params ?? {};
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <ConfiguredThemeProvider theme={darkTheme}>
+          <ContextProvider ctx={ctx}>{children}</ContextProvider>
+        </ConfiguredThemeProvider>
+      </QueryClientProvider>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/Bots/Edit/EditDialog.tsx b/web/packages/teleport/src/Bots/Edit/EditDialog.tsx
new file mode 100644
index 0000000000000..384306d3f19a2
--- /dev/null
+++ b/web/packages/teleport/src/Bots/Edit/EditDialog.tsx
@@ -0,0 +1,317 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { useState } from 'react';
+
+import {
+  Alert,
+  Box,
+  ButtonPrimary,
+  ButtonSecondary,
+  Flex,
+  Indicator,
+} from 'design';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from 'design/DialogConfirmation';
+import FieldInput from 'shared/components/FieldInput';
+import { FieldSelectAsync } from 'shared/components/FieldSelect';
+import { FieldTextArea } from 'shared/components/FieldTextArea/FieldTextArea';
+import { Option } from 'shared/components/Select';
+import {
+  TraitsEditor,
+  TraitsOption,
+} from 'shared/components/TraitsEditor/TraitsEditor';
+import Validation from 'shared/components/Validation';
+import {
+  requiredField,
+  requiredMaxLength,
+} from 'shared/components/Validation/rules';
+
+import { editBotMutationFunction, fetchRoles } from 'teleport/services/bot/bot';
+import { FlatBot } from 'teleport/services/bot/types';
+import useTeleport from 'teleport/useTeleport';
+
+import { formatDuration } from '../formatDuration';
+import { createGetBotQueryKey, useGetBot } from '../hooks';
+
+export function EditDialog(props: {
+  botName: string;
+  onCancel: () => void;
+  onSuccess: (bot: FlatBot) => void;
+}) {
+  const { botName, onCancel, onSuccess } = props;
+  const queryClient = useQueryClient();
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasReadPermission = flags.readBots;
+  const hasEditPermission = flags.editBots;
+
+  const [selectedRoles, setSelectedRoles] = useState<string[] | null>(null);
+  const [selectedTraits, setSelectedTraits] = useState<TraitsOption[] | null>(
+    null
+  );
+  const [selectedMaxSessionDuration, setSelectedMaxSessionDuration] = useState<
+    string | null
+  >(null);
+  const [selectedDescription, setSelectedDescription] = useState<string | null>(
+    null
+  );
+
+  const { isSuccess, data, error, isLoading } = useGetBot(
+    { botName },
+    {
+      enabled: hasReadPermission,
+      staleTime: 30_000, // Keep data in the cache for 30 seconds
+    }
+  );
+
+  const {
+    mutate,
+    error: saveError,
+    isPending: isSubmitting,
+  } = useMutation({
+    mutationFn: editBotMutationFunction,
+    onSuccess: newData => {
+      const key = createGetBotQueryKey({ botName: newData.name });
+      queryClient.setQueryData(key, newData);
+
+      setSelectedRoles(null);
+      setSelectedTraits(null);
+      setSelectedMaxSessionDuration(null);
+
+      onSuccess(newData);
+    },
+  });
+
+  const handleSubmit = () => {
+    const roles = selectedRoles ?? null;
+    const traits =
+      selectedTraits?.map(t => ({
+        name: t.traitKey.value,
+        values: t.traitValues.map(v => v.value),
+      })) ?? null;
+    const max_session_ttl =
+      selectedMaxSessionDuration?.trim().replaceAll(' ', '') ?? null;
+    const description = selectedDescription?.trim();
+
+    const req = {
+      roles,
+      traits,
+      max_session_ttl,
+      description,
+    };
+
+    mutate({ botName, req });
+  };
+
+  const isDirty =
+    selectedRoles !== null ||
+    selectedTraits !== null ||
+    selectedMaxSessionDuration !== null ||
+    selectedDescription !== null;
+
+  const missingPermissions = [
+    ...(hasReadPermission ? [] : ['bots.read']),
+    ...(hasEditPermission ? [] : ['bots.edit']),
+  ];
+
+  return (
+    <Dialog open onClose={onCancel}>
+      <DialogHeader>
+        <DialogTitle>Edit Bot</DialogTitle>
+      </DialogHeader>
+      <Validation>
+        {({ validator }) => (
+          <form
+            onSubmit={e => {
+              e.preventDefault();
+              if (
+                hasEditPermission &&
+                isDirty &&
+                !isSubmitting &&
+                validator.validate()
+              ) {
+                handleSubmit();
+              }
+            }}
+          >
+            <DialogContent maxWidth={680}>
+              {isLoading ? (
+                <Box data-testid="loading" textAlign="center" m={10}>
+                  <Indicator />
+                </Box>
+              ) : undefined}
+
+              {error ? (
+                <Alert kind="danger" details={error.message}>
+                  Failed to fetch bot
+                </Alert>
+              ) : undefined}
+
+              {isSuccess && data === null && (
+                <Alert kind="warning">Bot {botName} does not exist</Alert>
+              )}
+
+              {missingPermissions.length ? (
+                <Alert kind="info">
+                  You do not have permission to edit this bot. Missing role
+                  permissions: <code>{missingPermissions.join(', ')}</code>
+                </Alert>
+              ) : undefined}
+
+              <div
+                style={{
+                  visibility:
+                    hasReadPermission && isSuccess && data
+                      ? 'visible'
+                      : 'hidden',
+                }}
+              >
+                <Alert kind="info" width={'100%'}>
+                  Updates to a bot&apos;s identity take effect when tbot next
+                  renews its certificates. By default, this happens every 20
+                  minutes.
+                </Alert>
+
+                <FieldInput
+                  label="Name"
+                  placeholder="Name"
+                  value={data?.name ?? ''}
+                  readonly={true}
+                  helperText={'Bot name cannot be changed'}
+                />
+                <FieldTextArea
+                  label="Description"
+                  placeholder="Description"
+                  value={selectedDescription ?? data?.description ?? ''}
+                  onChange={e => setSelectedDescription(e.target.value)}
+                  rule={requiredMaxLength(
+                    'Description must be 200 characters or shorter.',
+                    200
+                  )}
+                  helperText={'200 characters maximum'}
+                />
+                <FieldSelectAsync
+                  menuPosition="fixed"
+                  label="Roles"
+                  rule={requiredField('At least one role is required')}
+                  placeholder="Click to select roles"
+                  isSearchable
+                  isMulti
+                  isClearable={false}
+                  value={(selectedRoles ?? data?.roles.toSorted() ?? []).map(
+                    r => ({
+                      value: r,
+                      label: r,
+                    })
+                  )}
+                  onChange={(values: Option[]) =>
+                    setSelectedRoles(values?.map(v => v.value) || [])
+                  }
+                  loadOptions={async input => {
+                    const flags = ctx.getFeatureFlags();
+                    const roles = await fetchRoles({ search: input, flags });
+                    return roles.items.map(r => ({
+                      value: r.name,
+                      label: r.name,
+                    }));
+                  }}
+                  noOptionsMessage={() => 'No roles found'}
+                  elevated={true}
+                />
+                <Box mb={3}>
+                  <TraitsEditor
+                    configuredTraits={
+                      selectedTraits ??
+                      data?.traits
+                        .toSorted((a, b) => a.name.localeCompare(b.name))
+                        .map(t => ({
+                          traitKey: {
+                            value: t.name,
+                            label: t.name,
+                          },
+                          traitValues: t.values.toSorted().map(v => ({
+                            value: v,
+                            label: v,
+                          })),
+                        })) ??
+                      []
+                    }
+                    setConfiguredTraits={setSelectedTraits}
+                    isLoading={false}
+                    label="Traits"
+                    addActionLabel="Add trait"
+                    addActionSubsequentLabel="Add another trait"
+                    autoFocus={false}
+                  />
+                </Box>
+                <FieldInput
+                  label="Max session duration"
+                  rule={requiredField('Max session duration is required')}
+                  value={
+                    selectedMaxSessionDuration ??
+                    formatDuration({
+                      seconds:
+                        data?.max_session_ttl?.seconds ??
+                        TWELVE_HOURS_IN_SECONDS,
+                    })
+                  }
+                  onChange={e => setSelectedMaxSessionDuration(e.target.value)}
+                  helperText={
+                    'A duration string such as 12h, 2h 45m, 43200s. Valid time units are h, m and s. Maximum is 24h'
+                  }
+                />
+              </div>
+
+              {saveError ? (
+                <Alert kind="danger" details={saveError.message}>
+                  Failed to save changes
+                </Alert>
+              ) : undefined}
+            </DialogContent>
+            <DialogFooter>
+              <Flex gap={3}>
+                <ButtonPrimary
+                  type="submit"
+                  disabled={
+                    isLoading || isSubmitting || !hasEditPermission || !isDirty
+                  }
+                >
+                  Save
+                </ButtonPrimary>
+                <ButtonSecondary
+                  disabled={isLoading || isSubmitting}
+                  onClick={onCancel}
+                >
+                  Cancel
+                </ButtonSecondary>
+              </Flex>
+            </DialogFooter>
+          </form>
+        )}
+      </Validation>
+    </Dialog>
+  );
+}
+
+const TWELVE_HOURS_IN_SECONDS = 43_200;
diff --git a/web/packages/teleport/src/Bots/EditBot.test.tsx b/web/packages/teleport/src/Bots/EditBot.test.tsx
deleted file mode 100644
index 4b350c1b5b2b8..0000000000000
--- a/web/packages/teleport/src/Bots/EditBot.test.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { waitFor } from '@testing-library/react';
-
-import { render, screen, userEvent } from 'design/utils/testing';
-
-import { EditBot } from 'teleport/Bots/EditBot';
-import { EditBotProps } from 'teleport/Bots/types';
-
-const makeProps = (overrides: Partial<EditBotProps> = {}): EditBotProps => ({
-  fetchRoles: jest.fn().mockResolvedValueOnce([]),
-  attempt: { status: '' },
-  name: 'bot-007',
-  onClose: () => {},
-  onEdit: () => {},
-  selectedRoles: [],
-  setSelectedRoles: () => {},
-  ...overrides,
-});
-
-test('renders', async () => {
-  const props = makeProps({ selectedRoles: ['foo-role'] });
-  render(<EditBot {...props} />);
-  await waitFor(() => expect(props.fetchRoles).toHaveBeenCalledTimes(1));
-
-  expect(screen.getByText('Edit Bot')).toBeInTheDocument();
-  expect(screen.getByRole('button', { name: 'Save' })).toBeInTheDocument();
-  expect(screen.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
-
-  expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('bot-007');
-  expect(screen.getByRole('textbox', { name: 'Name' })).toHaveAttribute(
-    'readonly'
-  );
-
-  expect(screen.getByRole('combobox', { name: 'Bot Roles' })).toBeEnabled();
-  expect(screen.getByText('foo-role')).toBeInTheDocument();
-});
-
-test('cancel calls onclose cb', async () => {
-  const mockClose = jest.fn();
-  const props = makeProps({ onClose: mockClose });
-  render(<EditBot {...props} />);
-
-  expect(mockClose).not.toHaveBeenCalled();
-  await userEvent.click(screen.queryByRole('button', { name: 'Cancel' }));
-  expect(mockClose).toHaveBeenCalled();
-});
-
-test('edit calls onedit cb', async () => {
-  const mockEdit = jest.fn();
-  const props = makeProps({ onEdit: mockEdit });
-  render(<EditBot {...props} />);
-
-  expect(mockEdit).not.toHaveBeenCalled();
-  await userEvent.click(screen.queryByRole('button', { name: 'Save' }));
-  expect(mockEdit).toHaveBeenCalled();
-});
-
-test('disables buttons when processing', async () => {
-  const props = makeProps({ attempt: { status: 'processing' } });
-  render(<EditBot {...props} />);
-  await waitFor(() => expect(props.fetchRoles).toHaveBeenCalledTimes(1));
-
-  expect(screen.queryByRole('button', { name: 'Save' })).toBeDisabled();
-  expect(screen.queryByRole('button', { name: 'Cancel' })).toBeDisabled();
-});
-
-test('displays error text', async () => {
-  const props = makeProps({
-    attempt: { status: 'failed', statusText: 'error editing' },
-  });
-  render(<EditBot {...props} />);
-  await waitFor(() => expect(props.fetchRoles).toHaveBeenCalledTimes(1));
-
-  expect(screen.getByText('error editing')).toBeInTheDocument();
-});
diff --git a/web/packages/teleport/src/Bots/EditBot.tsx b/web/packages/teleport/src/Bots/EditBot.tsx
deleted file mode 100644
index ccac6e58b102d..0000000000000
--- a/web/packages/teleport/src/Bots/EditBot.tsx
+++ /dev/null
@@ -1,105 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { Alert, ButtonSecondary, ButtonWarning } from 'design';
-import Dialog, {
-  DialogContent,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from 'design/DialogConfirmation';
-import FieldInput from 'shared/components/FieldInput';
-import { FieldSelectAsync } from 'shared/components/FieldSelect';
-import { Option } from 'shared/components/Select';
-import Validation from 'shared/components/Validation';
-import { requiredField } from 'shared/components/Validation/rules';
-
-import { EditBotProps } from 'teleport/Bots/types';
-
-export function EditBot({
-  fetchRoles,
-  attempt,
-  name,
-  onClose,
-  onEdit,
-  selectedRoles,
-  setSelectedRoles,
-}: EditBotProps) {
-  return (
-    <Dialog disableEscapeKeyDown={false} onClose={onClose} open={true}>
-      <DialogHeader>
-        <DialogTitle>Edit Bot</DialogTitle>
-      </DialogHeader>
-      <Validation>
-        <DialogContent width="450px">
-          {attempt.status === 'failed' && (
-            <Alert children={attempt.statusText} />
-          )}
-          <FieldInput
-            label="Name"
-            placeholder="Name"
-            autoFocus
-            value={name}
-            readonly={true}
-            onChange={() => {}}
-          />
-          <FieldSelectAsync
-            menuPosition="fixed"
-            label="Bot Roles"
-            rule={requiredField('At least one role is required')}
-            placeholder="Click to select roles"
-            isSearchable
-            isMulti
-            isClearable={false}
-            value={selectedRoles.map(r => ({
-              value: r,
-              label: r,
-            }))}
-            onChange={(values: Option[]) =>
-              setSelectedRoles(values?.map(v => v.value) || [])
-            }
-            loadOptions={async input => {
-              const roles = await fetchRoles(input);
-              return roles.map(r => ({
-                value: r,
-                label: r,
-              }));
-            }}
-            noOptionsMessage={() => 'No roles found'}
-            elevated={true}
-          />
-        </DialogContent>
-      </Validation>
-      <DialogFooter>
-        <ButtonWarning
-          mr="3"
-          disabled={attempt.status === 'processing'}
-          onClick={onEdit}
-        >
-          Save
-        </ButtonWarning>
-        <ButtonSecondary
-          disabled={attempt.status === 'processing'}
-          onClick={onClose}
-        >
-          Cancel
-        </ButtonSecondary>
-      </DialogFooter>
-    </Dialog>
-  );
-}
diff --git a/web/packages/teleport/src/Bots/List/ActionCell.tsx b/web/packages/teleport/src/Bots/List/ActionCell.tsx
index 7658d7bb0e641..5d9ec0a386dfc 100644
--- a/web/packages/teleport/src/Bots/List/ActionCell.tsx
+++ b/web/packages/teleport/src/Bots/List/ActionCell.tsx
@@ -40,7 +40,7 @@ export function BotOptionsCell({
           Delete...
         </MenuItem>
         {bot.type === BotUiFlow.GitHubActionsSsh && (
-          <MenuItem onClick={onClickView}>View...</MenuItem>
+          <MenuItem onClick={onClickView}>View GitHub example...</MenuItem>
         )}
       </MenuButton>
     </Cell>
diff --git a/web/packages/teleport/src/Bots/List/BotList.test.tsx b/web/packages/teleport/src/Bots/List/BotList.test.tsx
index 6001a2a4a0b97..4c1ea6028c440 100644
--- a/web/packages/teleport/src/Bots/List/BotList.test.tsx
+++ b/web/packages/teleport/src/Bots/List/BotList.test.tsx
@@ -24,77 +24,80 @@ import { BotListProps } from 'teleport/Bots/types';
 import { BotUiFlow } from 'teleport/services/bot/types';
 
 const makeProps = (): BotListProps => ({
-  attempt: { status: '' },
   bots: botsFixture,
   disabledEdit: false,
   disabledDelete: false,
   onClose: () => {},
   onDelete: () => {},
   onEdit: () => {},
-  fetchRoles: async () => [],
+  onSelect: () => {},
   selectedBot: null,
-  selectedRoles: [],
   setSelectedBot: () => {},
-  setSelectedRoles: () => {},
 });
 
-test('renders table with bots', () => {
-  const props = makeProps();
-  render(<BotList {...props} />);
+describe('BotList', () => {
+  test('renders table with bots', () => {
+    const props = makeProps();
+    render(<BotList {...props} />);
 
-  const rows = screen.getAllByRole('row');
-  expect(rows).toHaveLength(props.bots.length + 1);
+    const rows = screen.getAllByRole('row');
+    expect(rows).toHaveLength(props.bots.length + 1);
 
-  props.bots.forEach(row => {
-    expect(screen.getByText(row.name)).toBeInTheDocument();
-    row.roles.forEach(role => {
-      expect(screen.getByText(role)).toBeInTheDocument();
+    props.bots.forEach(row => {
+      expect(screen.getByText(row.name)).toBeInTheDocument();
+      row.roles.forEach(role => {
+        expect(screen.getByText(role)).toBeInTheDocument();
+      });
     });
   });
-});
 
-test('renders View options if type is github actions ssh', async () => {
-  const bot = {
-    namespace: '',
-    description: '',
-    labels: null,
-    revision: '',
-    traits: [],
-    status: '',
-    subKind: '',
-    version: '',
-    kind: 'kind',
-    name: 'github-actions-bot',
-    roles: [],
-    type: BotUiFlow.GitHubActionsSsh,
-  };
+  test('renders View options if type is github actions ssh', async () => {
+    const bot = {
+      namespace: '',
+      description: '',
+      labels: null,
+      revision: '',
+      traits: [],
+      status: '',
+      subKind: '',
+      version: '',
+      kind: 'kind',
+      name: 'github-actions-bot',
+      roles: [],
+      type: BotUiFlow.GitHubActionsSsh,
+      max_session_ttl: { seconds: 0 },
+    };
 
-  const props = makeProps();
-  props.bots = [bot];
-  render(<BotList {...props} />);
-  fireEvent.click(await screen.findByText('Options'));
-  expect(screen.getByText('View...')).toBeInTheDocument();
-});
+    const props = makeProps();
+    props.bots = [bot];
+    render(<BotList {...props} />);
+    fireEvent.click(await screen.findByText('Options'));
+    expect(screen.getByText('View GitHub example...')).toBeInTheDocument();
+  });
 
-test('doesnt renders View options if bot type is not github actions', async () => {
-  const bot = {
-    namespace: '',
-    description: '',
-    labels: null,
-    revision: '',
-    traits: [],
-    status: '',
-    subKind: '',
-    version: '',
-    kind: 'kind',
-    name: 'github-actions-bot',
-    roles: [],
-    type: null,
-  };
+  test('doesnt renders View options if bot type is not github actions', async () => {
+    const bot = {
+      namespace: '',
+      description: '',
+      labels: null,
+      revision: '',
+      traits: [],
+      status: '',
+      subKind: '',
+      version: '',
+      kind: 'kind',
+      name: 'github-actions-bot',
+      roles: [],
+      type: null,
+      max_session_ttl: { seconds: 0 },
+    };
 
-  const props = makeProps();
-  props.bots = [bot];
-  render(<BotList {...props} />);
-  fireEvent.click(await screen.findByText('Options'));
-  expect(screen.queryByText('View...')).not.toBeInTheDocument();
+    const props = makeProps();
+    props.bots = [bot];
+    render(<BotList {...props} />);
+    fireEvent.click(await screen.findByText('Options'));
+    expect(
+      screen.queryByText('View GitHub example...')
+    ).not.toBeInTheDocument();
+  });
 });
diff --git a/web/packages/teleport/src/Bots/List/BotList.tsx b/web/packages/teleport/src/Bots/List/BotList.tsx
index b3894d962ece0..f7d61ffb2f7ae 100644
--- a/web/packages/teleport/src/Bots/List/BotList.tsx
+++ b/web/packages/teleport/src/Bots/List/BotList.tsx
@@ -20,33 +20,30 @@ import { useState } from 'react';
 
 import Table, { LabelCell } from 'design/DataTable';
 
-import { DeleteBot } from 'teleport/Bots/DeleteBot';
-import { EditBot } from 'teleport/Bots/EditBot';
 import { BotOptionsCell } from 'teleport/Bots/List/ActionCell';
 import { BotListProps } from 'teleport/Bots/types';
 
+import { DeleteDialog } from '../Delete/DeleteDialog';
+import { EditDialog } from '../Edit/EditDialog';
 import { ViewBot } from '../ViewBot';
 
 enum Interaction {
-  VIEW,
+  GITHUB_EXAMPLE,
   EDIT,
   DELETE,
   NONE,
 }
 
 export function BotList({
-  attempt,
   bots,
   disabledEdit,
   disabledDelete,
-  fetchRoles,
   onClose,
   onDelete,
   onEdit,
+  onSelect,
   selectedBot,
   setSelectedBot,
-  selectedRoles,
-  setSelectedRoles,
 }: BotListProps) {
   const [interaction, setInteraction] = useState<Interaction>(Interaction.NONE);
 
@@ -75,18 +72,21 @@ export function BotList({
                 bot={bot}
                 onClickView={() => {
                   setSelectedBot(bot);
-                  setInteraction(Interaction.VIEW);
+                  setInteraction(Interaction.GITHUB_EXAMPLE);
                 }}
                 disabledEdit={disabledEdit}
                 disabledDelete={disabledDelete}
                 onClickEdit={() => {
-                  setSelectedBot(bot);
-                  setSelectedRoles(bot.roles);
-                  setInteraction(Interaction.EDIT);
+                  if (!disabledEdit) {
+                    setSelectedBot(bot);
+                    setInteraction(Interaction.EDIT);
+                  }
                 }}
                 onClickDelete={() => {
-                  setSelectedBot(bot);
-                  setInteraction(Interaction.DELETE);
+                  if (!disabledDelete) {
+                    setSelectedBot(bot);
+                    setInteraction(Interaction.DELETE);
+                  }
                 }}
               />
             ),
@@ -95,27 +95,27 @@ export function BotList({
         emptyText="No Bots Found"
         isSearchable
         pagination={{ pageSize: 20 }}
+        row={{
+          onClick: onSelect,
+          getStyle: () => ({ cursor: 'pointer' }),
+        }}
       />
       {selectedBot && interaction === Interaction.DELETE && (
-        <DeleteBot
-          attempt={attempt}
-          name={selectedBot.name}
-          onClose={onClose}
-          onDelete={onDelete}
+        <DeleteDialog
+          botName={selectedBot.name}
+          onCancel={onClose}
+          onComplete={onDelete}
+          showLockAlternative={false}
         />
       )}
       {selectedBot && interaction === Interaction.EDIT && (
-        <EditBot
-          fetchRoles={fetchRoles}
-          attempt={attempt}
-          name={selectedBot.name}
-          onClose={onClose}
-          onEdit={onEdit}
-          selectedRoles={selectedRoles}
-          setSelectedRoles={setSelectedRoles}
+        <EditDialog
+          botName={selectedBot.name}
+          onCancel={onClose}
+          onSuccess={onEdit}
         />
       )}
-      {selectedBot && interaction === Interaction.VIEW && (
+      {selectedBot && interaction === Interaction.GITHUB_EXAMPLE && (
         <ViewBot onClose={onClose} bot={selectedBot} />
       )}
     </>
diff --git a/web/packages/teleport/src/Bots/List/Bots.story.tsx b/web/packages/teleport/src/Bots/List/Bots.story.tsx
index bcca12a34e727..bed9c37780b2f 100644
--- a/web/packages/teleport/src/Bots/List/Bots.story.tsx
+++ b/web/packages/teleport/src/Bots/List/Bots.story.tsx
@@ -25,7 +25,7 @@ import { TeleportProviderBasic } from 'teleport/mocks/providers';
 import { EmptyState } from './EmptyState/EmptyState';
 
 export default {
-  title: 'Teleport/Bots',
+  title: 'Teleport/Bots/List',
 };
 
 export const Empty = () => {
@@ -41,18 +41,15 @@ export const Empty = () => {
 export const List = () => {
   return (
     <BotList
-      attempt={{ status: '' }}
       bots={botsFixture}
       disabledEdit={false}
       disabledDelete={false}
       onClose={() => {}}
       onDelete={() => {}}
       onEdit={() => {}}
-      fetchRoles={async () => []}
+      onSelect={() => {}}
       selectedBot={null}
-      selectedRoles={[]}
       setSelectedBot={() => {}}
-      setSelectedRoles={() => {}}
     />
   );
 };
diff --git a/web/packages/teleport/src/Bots/List/Bots.test.tsx b/web/packages/teleport/src/Bots/List/Bots.test.tsx
index 2170d55bed607..d33966c86975d 100644
--- a/web/packages/teleport/src/Bots/List/Bots.test.tsx
+++ b/web/packages/teleport/src/Bots/List/Bots.test.tsx
@@ -18,7 +18,13 @@
 
 import { MemoryRouter } from 'react-router';
 
-import { render, screen, userEvent, waitFor } from 'design/utils/testing';
+import {
+  render,
+  screen,
+  userEvent,
+  waitFor,
+  waitForElementToBeRemoved,
+} from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
 
 import { botsApiResponseFixture } from 'teleport/Bots/fixtures';
@@ -45,101 +51,80 @@ function renderWithContext(element, ctx?: TeleportContext) {
     </MemoryRouter>
   );
 }
-
-test('fetches bots on load', async () => {
-  jest.spyOn(api, 'get').mockResolvedValueOnce({ ...botsApiResponseFixture });
-  renderWithContext(<Bots />);
-
-  await waitFor(() => {
-    expect(
-      screen.getByText(botsApiResponseFixture.items[0].metadata.name)
-    ).toBeInTheDocument();
+describe('Bots', () => {
+  test('fetches bots on load', async () => {
+    jest.spyOn(api, 'get').mockResolvedValueOnce({ ...botsApiResponseFixture });
+    renderWithContext(<Bots />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(botsApiResponseFixture.items[0].metadata.name)
+      ).toBeInTheDocument();
+    });
+    expect(api.get).toHaveBeenCalledTimes(1);
   });
-  expect(api.get).toHaveBeenCalledTimes(1);
-});
-
-test('shows empty state when bots are empty', async () => {
-  jest.spyOn(api, 'get').mockResolvedValue({ items: [] });
-  renderWithContext(<Bots />);
-
-  await waitFor(() => {
-    expect(screen.getByTestId('bots-empty-state')).toBeInTheDocument();
-  });
-});
 
-test('shows missing permissions error if user lacks permissions to list', async () => {
-  jest.spyOn(api, 'get').mockResolvedValue({ items: [] });
-  const ctx = createTeleportContext();
-  ctx.storeUser.setState({ acl: { ...allAccessAcl, bots: noAccess } });
-  renderWithContext(<Bots />, ctx);
+  test('shows empty state when bots are empty', async () => {
+    jest.spyOn(api, 'get').mockResolvedValue({ items: [] });
+    renderWithContext(<Bots />);
 
-  await waitFor(() => {
-    expect(screen.getByTestId('bots-empty-state')).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId('bots-empty-state')).toBeInTheDocument();
+    });
   });
-  expect(
-    screen.getByText(/You do not have permission to access Bots/i)
-  ).toBeInTheDocument();
-});
 
-test('calls edit endpoint', async () => {
-  jest
-    .spyOn(api, 'get')
-    .mockResolvedValueOnce({ ...botsApiResponseFixture })
-    .mockResolvedValueOnce(['role-1', 'editor']);
-  jest.spyOn(api, 'put').mockResolvedValue({});
-  renderWithContext(<Bots />);
+  test('shows missing permissions error if user lacks permissions to list', async () => {
+    jest.spyOn(api, 'get').mockResolvedValue({ items: [] });
+    const ctx = createTeleportContext();
+    ctx.storeUser.setState({ acl: { ...allAccessAcl, bots: noAccess } });
+    renderWithContext(<Bots />, ctx);
 
-  await waitFor(() => {
+    await waitFor(() => {
+      expect(screen.getByTestId('bots-empty-state')).toBeInTheDocument();
+    });
     expect(
-      screen.getByText(botsApiResponseFixture.items[0].metadata.name)
+      screen.getByText(/You do not have permission to access Bots/i)
     ).toBeInTheDocument();
   });
 
-  const actionCells = screen.queryAllByRole('button', { name: 'Options' });
-  expect(actionCells).toHaveLength(botsApiResponseFixture.items.length);
-  await userEvent.click(actionCells[0]);
+  test('calls delete endpoint', async () => {
+    jest
+      .spyOn(api, 'get')
+      .mockResolvedValueOnce({ ...botsApiResponseFixture })
+      .mockResolvedValueOnce(['role-1', 'editor']);
+    jest.spyOn(api, 'deleteWithOptions').mockResolvedValue({});
+    renderWithContext(<Bots />);
 
-  expect(screen.getByText('Edit...')).toBeInTheDocument();
-  await userEvent.click(screen.getByText('Edit...'));
+    await waitFor(() => {
+      expect(
+        screen.getByText(botsApiResponseFixture.items[0].metadata.name)
+      ).toBeInTheDocument();
+    });
 
-  expect(screen.getByText('Edit Bot')).toBeInTheDocument();
-  await userEvent.click(screen.queryByRole('button', { name: 'Save' }));
+    const actionCells = screen.queryAllByRole('button', { name: 'Options' });
+    expect(actionCells).toHaveLength(botsApiResponseFixture.items.length);
+    await userEvent.click(actionCells[0]);
 
-  expect(screen.queryByText('Edit Bot')).not.toBeInTheDocument();
-  expect(api.put).toHaveBeenCalledWith(
-    `/v1/webapi/sites/localhost/machine-id/bot/${botsApiResponseFixture.items[0].metadata.name}`,
-    { roles: ['bot-bot-role'] }
-  );
-});
+    expect(screen.getByText('Delete...')).toBeInTheDocument();
+    await userEvent.click(screen.getByText('Delete...'));
 
-test('calls delete endpoint', async () => {
-  jest
-    .spyOn(api, 'get')
-    .mockResolvedValueOnce({ ...botsApiResponseFixture })
-    .mockResolvedValueOnce(['role-1', 'editor']);
-  jest.spyOn(api, 'delete').mockResolvedValue({});
-  renderWithContext(<Bots />);
-
-  await waitFor(() => {
     expect(
-      screen.getByText(botsApiResponseFixture.items[0].metadata.name)
+      screen.getByText(
+        `Delete ${botsApiResponseFixture.items[0].metadata.name}?`
+      )
     ).toBeInTheDocument();
+    await userEvent.click(screen.getByRole('button', { name: 'Delete Bot' }));
+
+    await waitForElementToBeRemoved(
+      () =>
+        screen.queryByText(
+          `Delete ${botsApiResponseFixture.items[0].metadata.name}?`
+        ),
+      { timeout: 5000 }
+    );
+    expect(api.deleteWithOptions).toHaveBeenCalledWith(
+      `/v1/webapi/sites/localhost/machine-id/bot/${botsApiResponseFixture.items[0].metadata.name}`,
+      { signal: undefined }
+    );
   });
-
-  const actionCells = screen.queryAllByRole('button', { name: 'Options' });
-  expect(actionCells).toHaveLength(botsApiResponseFixture.items.length);
-  await userEvent.click(actionCells[0]);
-
-  expect(screen.getByText('Delete...')).toBeInTheDocument();
-  await userEvent.click(screen.getByText('Delete...'));
-
-  expect(screen.getByText('Delete Bot?')).toBeInTheDocument();
-  await userEvent.click(
-    screen.queryByRole('button', { name: 'Yes, Delete Bot' })
-  );
-
-  expect(screen.queryByText('Delete Bot?')).not.toBeInTheDocument();
-  expect(api.delete).toHaveBeenCalledWith(
-    `/v1/webapi/sites/localhost/machine-id/bot/${botsApiResponseFixture.items[0].metadata.name}`
-  );
 });
diff --git a/web/packages/teleport/src/Bots/List/Bots.tsx b/web/packages/teleport/src/Bots/List/Bots.tsx
index 59321a61079a9..3abcf2828d22e 100644
--- a/web/packages/teleport/src/Bots/List/Bots.tsx
+++ b/web/packages/teleport/src/Bots/List/Bots.tsx
@@ -16,8 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { useEffect, useState } from 'react';
-import { Link } from 'react-router-dom';
+import { useCallback, useEffect, useState } from 'react';
+import { Link, useHistory } from 'react-router-dom';
 
 import { Alert, Box, Button, Indicator } from 'design';
 import { HoverTooltip } from 'design/Tooltip';
@@ -31,12 +31,7 @@ import {
   FeatureHeaderTitle,
 } from 'teleport/components/Layout';
 import cfg from 'teleport/config';
-import {
-  deleteBot,
-  editBot,
-  fetchBots,
-  fetchRoles,
-} from 'teleport/services/bot/bot';
+import { fetchBots } from 'teleport/services/bot/bot';
 import { FlatBot } from 'teleport/services/bot/types';
 import useTeleport from 'teleport/useTeleport';
 
@@ -45,14 +40,13 @@ import { EmptyState } from './EmptyState/EmptyState';
 
 export function Bots() {
   const ctx = useTeleport();
+  const history = useHistory();
   const flags = ctx.getFeatureFlags();
   const hasAddBotPermissions = flags.addBots;
   const canListBots = flags.listBots;
 
   const [bots, setBots] = useState<FlatBot[]>([]);
-  const [selectedBot, setSelectedBot] = useState<FlatBot>();
-  const [selectedRoles, setSelectedRoles] = useState<string[]>();
-  const { attempt: crudAttempt, run: crudRun } = useAttemptNext();
+  const [selectedBot, setSelectedBot] = useState<FlatBot | null>();
   const { attempt: fetchAttempt, run: fetchRun } = useAttemptNext(
     canListBots ? 'processing' : 'success'
   );
@@ -77,45 +71,37 @@ export function Bots() {
     };
   }, [ctx, fetchRun, canListBots]);
 
-  async function fetchRoleNames(search: string): Promise<string[]> {
-    const flags = ctx.getFeatureFlags();
-    const roles = await fetchRoles(search, flags);
-    return roles.items.map(r => r.name);
+  function onDelete() {
+    setBots(bots.filter(bot => bot.name !== selectedBot.name));
+    onClose();
   }
 
-  function onDelete() {
-    crudRun(() => deleteBot(flags, selectedBot.name)).then(() => {
-      setBots(bots.filter(bot => bot.name !== selectedBot.name));
-      onClose();
+  function onEdit(updated: FlatBot) {
+    const updatedList = bots.map((item: FlatBot): FlatBot => {
+      if (item.name !== selectedBot?.name) {
+        return item;
+      }
+      return {
+        ...item,
+        ...updated,
+      };
     });
-  }
 
-  function onEdit() {
-    crudRun(() =>
-      editBot(flags, selectedBot.name, { roles: selectedRoles }).then(
-        (updated: FlatBot) => {
-          const updatedList: FlatBot[] = bots.map((item: FlatBot): FlatBot => {
-            if (item.name !== selectedBot.name) {
-              return item;
-            }
-            return {
-              ...item,
-              ...updated,
-            };
-          });
-
-          setBots(updatedList);
-          onClose();
-        }
-      )
-    );
+    setBots(updatedList);
+    onClose();
   }
 
   function onClose() {
     setSelectedBot(null);
-    setSelectedRoles(null);
   }
 
+  const handleSelect = useCallback(
+    (item: FlatBot) => {
+      history.push(cfg.getBotDetailsRoute(item.name));
+    },
+    [history]
+  );
+
   if (fetchAttempt.status === 'processing') {
     return (
       <FeatureBox>
@@ -174,22 +160,19 @@ export function Bots() {
         </Box>
       </FeatureHeader>
       {fetchAttempt.status == 'failed' && (
-        <Alert kind="danger" children={fetchAttempt.statusText} />
+        <Alert kind="danger">{fetchAttempt.statusText}</Alert>
       )}
       {fetchAttempt.status == 'success' && (
         <BotList
-          attempt={crudAttempt}
           bots={bots}
           disabledEdit={!flags.roles || !flags.editBots}
           disabledDelete={!flags.removeBots}
-          fetchRoles={fetchRoleNames}
           onClose={onClose}
           onDelete={onDelete}
           onEdit={onEdit}
+          onSelect={handleSelect}
           selectedBot={selectedBot}
           setSelectedBot={setSelectedBot}
-          selectedRoles={selectedRoles}
-          setSelectedRoles={setSelectedRoles}
         />
       )}
     </FeatureBox>
diff --git a/web/packages/teleport/src/Bots/ViewBot.story.tsx b/web/packages/teleport/src/Bots/ViewBot.story.tsx
index 6a8926d85f73f..c0e0f312db924 100644
--- a/web/packages/teleport/src/Bots/ViewBot.story.tsx
+++ b/web/packages/teleport/src/Bots/ViewBot.story.tsx
@@ -24,10 +24,10 @@ import { ViewBotProps } from './types';
 import { ViewBot } from './ViewBot';
 
 export default {
-  title: 'Teleport/Bots/Add/ViewBot',
+  title: 'Teleport/Bots/Github Actions',
 };
 
-export const GitHubActionsSsh = () => {
+export const GithubActionsSsh = () => {
   const ctx = createTeleportContext();
 
   return (
@@ -43,7 +43,7 @@ const props: ViewBotProps = {
     type: BotUiFlow.GitHubActionsSsh,
     namespace: '',
     description: '',
-    labels: null,
+    labels: new Map(),
     revision: '',
     traits: [],
     status: '',
@@ -51,6 +51,7 @@ const props: ViewBotProps = {
     version: '',
     kind: '',
     roles: [],
+    max_session_ttl: { seconds: 0 },
   },
   onClose: () => {},
 };
diff --git a/web/packages/teleport/src/Bots/ViewBot.tsx b/web/packages/teleport/src/Bots/ViewBot.tsx
index 7112cfea80c3f..b7d24dac82d32 100644
--- a/web/packages/teleport/src/Bots/ViewBot.tsx
+++ b/web/packages/teleport/src/Bots/ViewBot.tsx
@@ -28,7 +28,7 @@ import TextEditor from 'shared/components/TextEditor';
 import { ViewBotProps } from 'teleport/Bots/types';
 import useTeleport from 'teleport/useTeleport';
 
-import { getWorkflowExampleYaml } from './Add/GitHubActions/AddBotToWorkflow';
+import { getWorkflowExampleYaml } from './Add/GitHubActionsSsh/AddBotToWorkflow';
 
 export function ViewBot({ bot, onClose }: ViewBotProps) {
   const ctx = useTeleport();
@@ -43,14 +43,13 @@ export function ViewBot({ bot, onClose }: ViewBotProps) {
   );
 
   return (
-    <Dialog disableEscapeKeyDown={false} onClose={onClose} open={true}>
+    <Dialog onClose={onClose} open={true}>
       <DialogHeader>
         <DialogTitle>{bot.name}</DialogTitle>
       </DialogHeader>
       <DialogContent width="640px">
         <Text mb="4">
           Below is an example GitHub Actions workflow to help you get started.
-          You can find this again from the bot’s options dropdown.
         </Text>
         <Flex height="500px" pt="3" pr="3" bg="levels.deep" borderRadius={3}>
           <TextEditor
diff --git a/web/packages/teleport/src/Bots/fixtures/index.ts b/web/packages/teleport/src/Bots/fixtures/index.ts
index a99def2731516..978e3365ec30f 100644
--- a/web/packages/teleport/src/Bots/fixtures/index.ts
+++ b/web/packages/teleport/src/Bots/fixtures/index.ts
@@ -16,18 +16,24 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { ApiBot, BotResponse, FlatBot } from 'teleport/services/bot/types';
+import {
+  ApiBot,
+  BotResponse,
+  BotUiFlow,
+  FlatBot,
+} from 'teleport/services/bot/types';
 
 // nonDisplayedFields are not leveraged in the UI, so we don't explicitly set them
 const nonDisplayedFields = {
   namespace: '',
   description: '',
-  labels: null,
+  labels: new Map(),
   revision: '',
   traits: [],
   status: '',
   subKind: '',
   version: '',
+  max_session_ttl: { seconds: 0 },
 };
 
 export const botsFixture: FlatBot[] = [
@@ -36,6 +42,7 @@ export const botsFixture: FlatBot[] = [
     kind: 'GitHub Actions',
     name: 'bot-github-actions',
     roles: ['bot-bot-role'],
+    type: BotUiFlow.GitHubActionsSsh,
   },
   {
     ...nonDisplayedFields,
@@ -71,7 +78,7 @@ const getEmptyApiBot = (
   kind: kind,
   metadata: {
     description: '',
-    labels: null,
+    labels: new Map(),
     name: name,
     namespace: '',
     revision: '',
@@ -79,6 +86,7 @@ const getEmptyApiBot = (
   spec: {
     roles: roles,
     traits: [],
+    max_session_ttl: { seconds: 0 },
   },
   status: '',
   subKind: '',
diff --git a/web/packages/teleport/src/Bots/formatDuration.test.ts b/web/packages/teleport/src/Bots/formatDuration.test.ts
new file mode 100644
index 0000000000000..35c3a6e6aa4e4
--- /dev/null
+++ b/web/packages/teleport/src/Bots/formatDuration.test.ts
@@ -0,0 +1,43 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { formatDuration } from './formatDuration';
+
+describe('formatDuration', () => {
+  it.each`
+    seconds  | expected
+    ${0}     | ${'0s'}
+    ${1}     | ${'1s'}
+    ${1.5}   | ${'1s'}
+    ${60}    | ${'1m'}
+    ${3600}  | ${'1h'}
+    ${86400} | ${'24h'}
+    ${12345} | ${'3h25m45s'}
+  `('formats $seconds seconds as $expected', ({ seconds, expected }) => {
+    expect(formatDuration({ seconds })).toBe(expected);
+  });
+
+  it.each`
+    seconds  | expected
+    ${0}     | ${'0s'}
+    ${1}     | ${'1s'}
+    ${12345} | ${'3h|25m|45s'}
+  `('formats $seconds seconds as $expected', ({ seconds, expected }) => {
+    expect(formatDuration({ seconds }, { separator: '|' })).toBe(expected);
+  });
+});
diff --git a/web/packages/teleport/src/Bots/formatDuration.ts b/web/packages/teleport/src/Bots/formatDuration.ts
new file mode 100644
index 0000000000000..e0f0d996bbe6f
--- /dev/null
+++ b/web/packages/teleport/src/Bots/formatDuration.ts
@@ -0,0 +1,62 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * `formatDuration` formats a given duration (in seconds) as a duration string
+ * supporting h, m and s units with an optional separator (e.g., "1h 2m 3s").
+ *
+ * @param duration object containting number of seconds to format
+ * @param options optional config to provide a separator
+ * @returns a duration string
+ */
+export function formatDuration(
+  duration:
+    | {
+        seconds: number;
+      }
+    | undefined
+    | null,
+  options?: {
+    separator?: string;
+  }
+): string {
+  const { seconds = 0 } = duration ?? {};
+  const { separator = '' } = options ?? {};
+
+  if (!seconds) return '0s';
+
+  return units
+    .reduce(
+      ({ remainder, fmt }, { unit, denominator }) => {
+        const value = Math.floor(remainder / denominator);
+        return {
+          remainder: remainder % denominator,
+          fmt: value > 0 ? [...fmt, `${value}${unit}`] : fmt,
+        };
+      },
+      { remainder: seconds, fmt: [] }
+    )
+    .fmt.join(separator);
+}
+
+// Order is important - largest denominators first
+const units = [
+  { unit: 'h', denominator: 3_600 },
+  { unit: 'm', denominator: 60 },
+  { unit: 's', denominator: 1 },
+];
diff --git a/web/packages/teleport/src/Bots/hooks.ts b/web/packages/teleport/src/Bots/hooks.ts
new file mode 100644
index 0000000000000..39b01c1449649
--- /dev/null
+++ b/web/packages/teleport/src/Bots/hooks.ts
@@ -0,0 +1,28 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { getBot, listBotTokens } from 'teleport/services/bot/bot';
+import { createQueryHook } from 'teleport/services/queryHelpers';
+
+export const { createQueryKey: createGetBotQueryKey, useQuery: useGetBot } =
+  createQueryHook(['bot', 'get'], getBot);
+
+export const {
+  createQueryKey: createListBotTokensQueryKey,
+  useQuery: useListBotTokens,
+} = createQueryHook(['bot', 'token', 'list'], listBotTokens);
diff --git a/web/packages/teleport/src/Bots/types.ts b/web/packages/teleport/src/Bots/types.ts
index ead0fac477cb4..f5043a667f0bd 100644
--- a/web/packages/teleport/src/Bots/types.ts
+++ b/web/packages/teleport/src/Bots/types.ts
@@ -31,18 +31,15 @@ export type BotOptionsCellProps = {
 };
 
 export type BotListProps = {
-  attempt: Attempt;
   bots: FlatBot[];
   disabledEdit: boolean;
   disabledDelete: boolean;
-  fetchRoles: (input: string) => Promise<string[]>;
   onClose: () => void;
   onDelete: () => void;
-  onEdit: () => void;
+  onEdit: (updatedBot: FlatBot) => void;
+  onSelect: (item: FlatBot) => void;
   selectedBot: FlatBot;
   setSelectedBot: Dispatch<SetStateAction<FlatBot>>;
-  selectedRoles: string[];
-  setSelectedRoles: Dispatch<SetStateAction<string[]>>;
 };
 
 export type DeleteBotProps = {
@@ -58,7 +55,8 @@ export type ViewBotProps = {
 };
 
 export enum BotFlowType {
-  GitHubActions = 'github-actions',
+  GitHubActionsSsh = 'github-actions-ssh',
+  GitHubActionsK8s = 'github-actions-k8s',
 }
 
 export type EditBotProps = {
diff --git a/web/packages/teleport/src/Clusters/ClusterList/ClusterList.tsx b/web/packages/teleport/src/Clusters/ClusterList/ClusterList.tsx
index 3d3dc11902121..0a98388aefcb1 100644
--- a/web/packages/teleport/src/Clusters/ClusterList/ClusterList.tsx
+++ b/web/packages/teleport/src/Clusters/ClusterList/ClusterList.tsx
@@ -24,7 +24,6 @@ import Table, { Cell } from 'design/DataTable';
 import { Primary, Secondary } from 'design/Label';
 import { MenuButton, MenuItem } from 'shared/components/MenuAction';
 
-import { DropdownDivider } from 'teleport/components/Dropdown';
 import cfg from 'teleport/config';
 import { Cluster } from 'teleport/services/clusters';
 
@@ -85,12 +84,6 @@ function renderActionCell({ clusterId }: Cluster, flags: MenuFlags) {
     );
   }
 
-  $items.push(<DropdownDivider key="divider" />);
-
-  $items.push(
-    renderMenuItem('Manage Cluster', cfg.getManageClusterRoute(clusterId))
-  );
-
   return (
     <Cell align="right">{$items && <MenuButton children={$items} />}</Cell>
   );
diff --git a/web/packages/teleport/src/Clusters/Clusters.tsx b/web/packages/teleport/src/Clusters/Clusters.tsx
index b21cf1676bbb1..136b6a6c74acd 100644
--- a/web/packages/teleport/src/Clusters/Clusters.tsx
+++ b/web/packages/teleport/src/Clusters/Clusters.tsx
@@ -33,7 +33,6 @@ import { useFeatures } from 'teleport/FeaturesContext';
 import useTeleport from 'teleport/useTeleport';
 
 import ClusterList from './ClusterList';
-import { ManageCluster } from './ManageCluster';
 import { buildACL } from './utils';
 
 export function Clusters() {
@@ -45,11 +44,6 @@ export function Clusters() {
         path={cfg.routes.clusters}
         component={ClusterListPage}
       />
-      <Route
-        key="cluster-management"
-        path={cfg.routes.manageCluster}
-        component={ManageCluster}
-      />
     </Switch>
   );
 }
diff --git a/web/packages/teleport/src/Console/DocumentDb/ConnectDialog.tsx b/web/packages/teleport/src/Console/DocumentDb/ConnectDialog.tsx
index a18a088980da9..c62e51de97aad 100644
--- a/web/packages/teleport/src/Console/DocumentDb/ConnectDialog.tsx
+++ b/web/packages/teleport/src/Console/DocumentDb/ConnectDialog.tsx
@@ -34,6 +34,7 @@ import { Option } from 'shared/components/Select';
 import Validation from 'shared/components/Validation';
 import { requiredField } from 'shared/components/Validation/rules';
 import { useAsync } from 'shared/hooks/useAsync';
+import { getDbNameRequirement } from 'shared/services/databases';
 
 import { useTeleport } from 'teleport';
 import { DbConnectData } from 'teleport/lib/term/tty';
@@ -121,34 +122,45 @@ function ConnectForm(props: {
     props.onConnect({
       serviceName: props.db.name,
       protocol: props.db.protocol,
-      dbName: selectedName.value,
+      dbName: selectedName?.value,
       dbUser: selectedUser.value,
       dbRoles: selectedRoles?.map(role => role.value),
     });
   };
 
+  const dbNameReq = getDbNameRequirement(props.db.protocol);
   return (
     <Validation>
       {({ validator }) => (
         <form>
           <DialogContent flex="0 0 auto">
+            {dbNameReq !== 'unsupported' && (
+              <ConnectionField
+                // if db name is optional, then RBAC is not enforcing a db name, so they can input whatever they want
+                allowCreatableSelect={
+                  dbNameHasWildcard || dbNameReq === 'optional'
+                }
+                label="Database name"
+                menuPosition="fixed"
+                onChange={option => setSelectedName(option as Option)}
+                value={selectedName}
+                options={dbNamesOpts}
+                creatableOptions={{
+                  formatCreateLabel: (userInput: string) =>
+                    `Use "${userInput}" database name`,
+                  toolTipContent:
+                    'You can type in the select box to use a custom database name instead of the available options.',
+                }}
+                isClearable={dbNameReq === 'optional'}
+                rule={
+                  dbNameReq === 'required'
+                    ? requiredField('Database name is required')
+                    : undefined
+                }
+              />
+            )}
             <ConnectionField
-              hasWildcard={dbNameHasWildcard}
-              label="Database name"
-              menuPosition="fixed"
-              onChange={option => setSelectedName(option as Option)}
-              value={selectedName}
-              options={dbNamesOpts}
-              creatableOptions={{
-                formatCreateLabel: userInput =>
-                  `Use "${userInput}" database name`,
-                toolTipContent:
-                  'You can type in the select box to use a custom database name instead of the available options.',
-              }}
-              rule={requiredField('Database name is required')}
-            />
-            <ConnectionField
-              hasWildcard={dbUserHasWildcard}
+              allowCreatableSelect={dbUserHasWildcard}
               label="Database user"
               menuPosition="fixed"
               onChange={option => setSelectedUser(option as Option)}
@@ -170,7 +182,7 @@ function ConnectForm(props: {
             />
             {(dbRolesOpts?.length > 0 || dbRoleHasWildcard) && (
               <ConnectionField
-                hasWildcard={dbRoleHasWildcard}
+                allowCreatableSelect={dbRoleHasWildcard}
                 label="Database roles"
                 menuPosition="fixed"
                 isMulti={true}
@@ -217,11 +229,11 @@ function ConnectForm(props: {
 }
 
 function ConnectionField({
-  hasWildcard,
+  allowCreatableSelect,
   creatableOptions = {},
   ...commonOptions
 }) {
-  return hasWildcard ? (
+  return allowCreatableSelect ? (
     <FieldSelectCreatable {...commonOptions} {...creatableOptions} />
   ) : (
     <FieldSelect {...commonOptions} />
diff --git a/web/packages/teleport/src/Console/DocumentDb/DocumentDb.story.tsx b/web/packages/teleport/src/Console/DocumentDb/DocumentDb.story.tsx
index 1ea314c93efc1..6c5829fad4faf 100644
--- a/web/packages/teleport/src/Console/DocumentDb/DocumentDb.story.tsx
+++ b/web/packages/teleport/src/Console/DocumentDb/DocumentDb.story.tsx
@@ -54,6 +54,79 @@ export const Connect = () => {
   return <DocumentDbWrapper ctx={ctx} consoleCtx={consoleCtx} doc={baseDoc} />;
 };
 
+export const ConnectWithEmptyDatabaseName = () => {
+  const { ctx, consoleCtx } = getContexts(
+    Promise.resolve({
+      agents: [
+        {
+          kind: 'db',
+          name: 'mydb',
+          description: '',
+          type: '',
+          protocol: 'mysql',
+          labels: [],
+          names: ['users', 'orders'],
+          users: ['alice', 'bob'],
+          roles: ['reader', 'all'],
+          hostname: '',
+          supportsInteractive: true,
+        },
+      ],
+    })
+  );
+
+  return <DocumentDbWrapper ctx={ctx} consoleCtx={consoleCtx} doc={baseDoc} />;
+};
+
+export const ConnectWithoutAllowedDatabaseNames = () => {
+  const { ctx, consoleCtx } = getContexts(
+    Promise.resolve({
+      agents: [
+        {
+          kind: 'db',
+          name: 'mydb',
+          description: '',
+          type: '',
+          protocol: 'mysql',
+          labels: [],
+          users: ['alice', 'bob'],
+          roles: ['reader', 'all'],
+          hostname: '',
+          supportsInteractive: true,
+        },
+      ],
+    })
+  );
+
+  return <DocumentDbWrapper ctx={ctx} consoleCtx={consoleCtx} doc={baseDoc} />;
+};
+
+export const ConnectWithDatabaseNamesUnsupported = () => {
+  const { ctx, consoleCtx } = getContexts(
+    Promise.resolve({
+      agents: [
+        {
+          kind: 'db',
+          name: 'mydb',
+          description: '',
+          type: '',
+          // as of writing, we don't even have a Cassandra web client, but we
+          // should test that protocols without database name support render
+          // without an input for database name.
+          protocol: 'cassandra',
+          labels: [],
+          users: ['alice', 'bob'],
+          roles: ['reader', 'all'],
+          hostname: '',
+          supportsInteractive: true,
+        },
+      ],
+    })
+  );
+
+  return <DocumentDbWrapper ctx={ctx} consoleCtx={consoleCtx} doc={baseDoc} />;
+};
+
 export const ConnectWithoutRoles = () => {
   const { ctx, consoleCtx } = getContexts(
     Promise.resolve({
diff --git a/web/packages/teleport/src/Databases/ConnectDialog/ConnectDialog.tsx b/web/packages/teleport/src/Databases/ConnectDialog/ConnectDialog.tsx
index 92edf926bff16..4369b42fdbea3 100644
--- a/web/packages/teleport/src/Databases/ConnectDialog/ConnectDialog.tsx
+++ b/web/packages/teleport/src/Databases/ConnectDialog/ConnectDialog.tsx
@@ -35,7 +35,8 @@ import { NewTab as NewTabIcon } from 'design/Icon';
 import { ResourceIcon } from 'design/ResourceIcon';
 import { TextSelectCopy } from 'shared/components/TextSelectCopy';
 import { getDatabaseIconName } from 'shared/components/UnifiedResources/shared/viewItemsFactory';
-import { DbProtocol } from 'shared/services/databases';
+import { DbProtocol, getDbNameRequirement } from 'shared/services/databases';
+import { assertUnreachable } from 'shared/utils/assertUnreachable';
 
 import cfg from 'teleport/config';
 import { generateTshLoginCommand, openNewTab } from 'teleport/lib/util';
@@ -56,32 +57,22 @@ export default function ConnectDialog({
     dbProtocol == 'dynamodb' || dbProtocol == 'clickhouse-http'
       ? 'proxy db --tunnel'
       : 'db connect';
-
   // Adjust `--db-name` flag based on db protocol, as it's required for
   // some, optional for some, and unsupported by some.
+  const dbNameReq = getDbNameRequirement(dbProtocol);
   let dbNameFlag: string;
-  switch (dbProtocol) {
-    case 'postgres':
-    case 'sqlserver':
-    case 'oracle':
-    case 'mongodb':
-    case 'spanner':
-      // Required
+  switch (dbNameReq) {
+    case 'required':
       dbNameFlag = ' --db-name=<name>';
       break;
-    case 'cassandra':
-    case 'clickhouse':
-    case 'clickhouse-http':
-    case 'dynamodb':
-    case 'opensearch':
-    case 'elasticsearch':
-    case 'redis':
-      // No flag
+    case 'unsupported':
       dbNameFlag = '';
       break;
-    default:
-      // Default to optional
+    case 'optional':
       dbNameFlag = ' [--db-name=<name>]';
+      break;
+    default:
+      assertUnreachable(dbNameReq);
   }
 
   const onConnect = () => {
diff --git a/web/packages/teleport/src/Databases/fixtures/index.ts b/web/packages/teleport/src/Databases/fixtures/index.ts
index b42c40377eee2..f75675e9d855d 100644
--- a/web/packages/teleport/src/Databases/fixtures/index.ts
+++ b/web/packages/teleport/src/Databases/fixtures/index.ts
@@ -118,6 +118,30 @@ export const databases: Database[] = [
     ],
     hostname: 'mysql-hostname',
   },
+  {
+    kind: 'db',
+    name: 'elasticache-redis',
+    description: 'ElastiCache Redis',
+    type: 'elasticache',
+    protocol: 'redis',
+    labels: [
+      { name: 'cluster', value: 'root' },
+      { name: 'env', value: 'aws' },
+    ],
+    hostname: 'redis-hostname',
+  },
+  {
+    kind: 'db',
+    name: 'elasticache-serverless-redis',
+    description: 'ElastiCache Serverless Redis',
+    type: 'elasticache-serverless',
+    protocol: 'redis',
+    labels: [
+      { name: 'cluster', value: 'root' },
+      { name: 'env', value: 'aws' },
+    ],
+    hostname: 'redis-hostname',
+  },
 ];
 
 export const moreDatabases: Database[] = [
diff --git a/web/packages/teleport/src/DesktopSession/DesktopSession.tsx b/web/packages/teleport/src/DesktopSession/DesktopSession.tsx
index e24008757e084..c7f997f27b0cb 100644
--- a/web/packages/teleport/src/DesktopSession/DesktopSession.tsx
+++ b/web/packages/teleport/src/DesktopSession/DesktopSession.tsx
@@ -24,7 +24,7 @@ import {
   DesktopSession as SharedDesktopSession,
 } from 'shared/components/DesktopSession';
 import { useAsync } from 'shared/hooks/useAsync';
-import { BrowserFileSystem, TdpClient } from 'shared/libs/tdp';
+import { selectDirectoryInBrowser, TdpClient } from 'shared/libs/tdp';
 
 import { useTeleport } from 'teleport';
 import AuthnDialog from 'teleport/components/AuthnDialog';
@@ -59,7 +59,7 @@ export function DesktopSession() {
             ),
             abortSignal
           ),
-        new BrowserFileSystem()
+        selectDirectoryInBrowser
       )
   );
   const mfa = useMfaEmitter(client, undefined, {
@@ -131,6 +131,7 @@ export function DesktopSession() {
         }
       }}
       aclAttempt={aclAttempt}
+      browserSupportsSharing={navigator.userAgent.includes('Chrome')}
       hasAnotherSession={hasAnotherSession}
       keyboardLayout={preferences.keyboardLayout}
     />
diff --git a/web/packages/teleport/src/DeviceTrust/EmptyList.tsx b/web/packages/teleport/src/DeviceTrust/EmptyList.tsx
index 95c6fb3fa323b..5c38a2d30865f 100644
--- a/web/packages/teleport/src/DeviceTrust/EmptyList.tsx
+++ b/web/packages/teleport/src/DeviceTrust/EmptyList.tsx
@@ -90,7 +90,7 @@ export const EmptyList = ({
       <Box mb={3}>
         <H1 mb={3}>What are Trusted Devices?</H1>
         <Text css={{ maxWidth }}>
-          Device trust reduces the attack surface by enforcing that only
+          Device Trust reduces the attack surface by enforcing that only
           trusted, registered devices can access your Teleport cluster.
         </Text>
       </Box>
@@ -116,14 +116,14 @@ export const EmptyList = ({
             isSliding={!!intervalId}
             onClick={() => handleOnClick(2)}
             title="Tie audit events to the user AND machine accessing the system."
-            description="Device trust maps the device identity to every audit log event, so you always know which device was used for each action."
+            description="Device Trust maps the device identity to every audit log event, so you always know which device was used for each action."
           />
           <DetailsTab
             active={currIndex === 3}
             isSliding={!!intervalId}
             onClick={() => handleOnClick(3)}
             title="Integrates with your MDM"
-            description="Auto-enroll and sync device registry from Jamf."
+            description="Auto-enroll and sync device registry from Jamf&nbsp;Pro or&nbsp;Microsoft&nbsp;Intune."
           />
         </Box>
         <Box>
@@ -146,21 +146,22 @@ export const EmptyList = ({
           )}
           {currIndex === 3 && (
             <FadedTable>
-              <Flex flexDirection="column" justifyContent="center">
-                <JamfCard margin="auto" mb={4}>
-                  <ResourceIcon height="20px" width="20px" name="jamf" />
-                  {/* purposefully "creating" the text ourselves to avoid having a light and dark logo just for text */}
-                  <Text
-                    css={`
-                      font-size: 28px;
-                      line-height: 30px;
-                    `}
-                    ml={3}
-                  >
-                    jamf
-                  </Text>
-                </JamfCard>
-                <Flex justifyContent="center" gap={4}>
+              <Flex
+                flexDirection="column"
+                justifyContent="center"
+                gap={iconGap}
+              >
+                <Flex gap={iconGap}>
+                  <MdmCard>
+                    <ResourceIcon height="20px" width="20px" name="jamf" />
+                    <MdmText>Jamf Pro</MdmText>
+                  </MdmCard>
+                  <MdmCard>
+                    <ResourceIcon height="20px" width="20px" name="intune" />
+                    <MdmText>Microsoft Intune</MdmText>
+                  </MdmCard>
+                </Flex>
+                <Flex justifyContent="center" gap={iconGap}>
                   <IconCard>
                     <Password />
                   </IconCard>
@@ -198,16 +199,17 @@ export const EmptyList = ({
           {isEnterprise ? (
             <>
               <ButtonPrimary
-                width="280px"
                 as={Link}
-                to={cfg.getIntegrationEnrollRoute('jamf')}
+                to={cfg.getIntegrationsEnrollRoute({ tags: ['devicetrust'] })}
+                width="280px"
                 size="large"
               >
-                Get Started with JAMF
+                Get Started with an MDM
               </ButtonPrimary>
+
               <ButtonSecondary
                 as="a"
-                href="https://goteleport.com/docs/admin-guides/access-controls/device-trust/jamf-integration/"
+                href="https://goteleport.com/docs/identity-governance/device-trust/"
                 target="_blank"
                 width="280px"
                 size="large"
@@ -230,48 +232,50 @@ export const EmptyList = ({
   );
 };
 
+const iconGap = 4;
+
 export const fakeItems: TrustedDevice[] = [
   {
     id: 'FWPGP915V',
     assetTag: 'FWPGP915V',
     osType: 'macOS',
     enrollStatus: 'enrolled',
-    owner: 'mykel',
+    owner: 'alice',
   },
   {
     id: 'M7XJR4GK8823',
     assetTag: 'M7XJR4GK8823',
     osType: 'Windows',
     enrollStatus: 'enrolled',
-    owner: 'lila',
+    owner: 'bob',
   },
   {
     id: 'L2FQZ9VH4466',
     assetTag: 'L2FQZ9VH4466',
     osType: 'Linux',
     enrollStatus: 'enrolled',
-    owner: 'bart',
+    owner: 'charlie',
   },
   {
     id: 'N8EYW1DP7732',
     assetTag: 'N8EYW1DP7732',
     osType: 'Linux',
     enrollStatus: 'not enrolled',
-    owner: 'rafao',
+    owner: '',
   },
   {
     id: 'K5BHP6CT5598',
     assetTag: 'K5BHP6CT5598',
     osType: 'Windows',
     enrollStatus: 'not enrolled',
-    owner: 'gzz',
+    owner: '',
   },
   {
     id: 'Y3RSL7FJ2104',
     assetTag: 'Y3RSL7FJ2104',
     osType: 'macOS',
     enrollStatus: 'enrolled',
-    owner: 'ryry',
+    owner: 'dan',
   },
 ];
 
@@ -292,7 +296,7 @@ const auditEvents = [
     code: 'TC000I',
     event: 'cert.create',
     identity: {
-      user: 'lisa',
+      user: 'charlie',
     },
     time: '2024-02-04T19:43:23.529Z',
   },
@@ -303,14 +307,14 @@ const auditEvents = [
     success: true,
     time: '2024-02-04T19:43:22.529Z',
     uid: 'fa279611-91d8-47b5-9fad-b8ea3e5286e0',
-    user: 'lisa',
+    user: 'charlie',
   },
   {
     cert_type: 'user',
     code: 'TC000I',
     event: 'cert.create',
     identity: {
-      user: 'isabelle',
+      user: 'dan',
     },
     time: '2024-02-04T19:43:21.529Z',
   },
@@ -319,7 +323,7 @@ const auditEvents = [
     code: 'T1016I',
     time: '2024-02-04T19:43:20.529Z',
     uid: '815bbcf4-fb05-4e08-917c-7259e9332d69',
-    user: 'isabelle',
+    user: 'dan',
   },
 ].map(makeEvent);
 
@@ -467,12 +471,17 @@ const PreviewBox = styled(Box)`
   border-radius: ${p => p.theme.radii[3]}px;
 `;
 
-const JamfCard = styled(Flex)`
-  justify-content: center;
-  align-items: center;
-  padding: ${p => p.theme.space[5]}px;
-  border-radius: ${p => p.theme.radii[3]}px;
-  background-color: ${p => p.theme.colors.levels.surface};
+const MdmCard = styled(Flex).attrs({
+  justifyContent: 'center',
+  alignItems: 'center',
+  p: 5,
+  borderRadius: 3,
+  backgroundColor: 'levels.surface',
+  gap: 3,
+})``;
+
+const MdmText = styled(Text).attrs({ fontSize: '28px' })`
+  line-height: 30px;
 `;
 
 const IconCard = styled(Flex)`
diff --git a/web/packages/teleport/src/DeviceTrust/types.test.ts b/web/packages/teleport/src/DeviceTrust/types.test.ts
new file mode 100644
index 0000000000000..029aed579f5fc
--- /dev/null
+++ b/web/packages/teleport/src/DeviceTrust/types.test.ts
@@ -0,0 +1,54 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { DeviceOrigin, deviceSource, DeviceSource } from './types';
+
+describe('deviceSource', () => {
+  const tests: Array<{
+    name: string;
+    source: DeviceSource | undefined;
+    want: string;
+  }> = [
+    {
+      name: 'default name for origin',
+      source: { origin: DeviceOrigin.Intune, name: 'intune' },
+      want: 'Intune',
+    },
+    {
+      name: 'custom name',
+      source: { origin: DeviceOrigin.Jamf, name: 'cool jamf' },
+      want: 'cool jamf',
+    },
+    {
+      name: 'no source',
+      source: undefined,
+      want: '',
+    },
+    {
+      name: 'unsupported origin',
+      source: { origin: 1337 as DeviceOrigin, name: 'even cooler jamf' },
+      // Show the name instead of something like "unknown" as name is required and likely more
+      // informative than displaying "unknown".
+      want: 'even cooler jamf',
+    },
+  ];
+
+  test.each(tests)('$name', ({ source, want }) => {
+    expect(deviceSource(source)).toEqual(want);
+  });
+});
diff --git a/web/packages/teleport/src/DeviceTrust/types.ts b/web/packages/teleport/src/DeviceTrust/types.ts
index 9e4dc3f93b18a..6ce9c50332dbb 100644
--- a/web/packages/teleport/src/DeviceTrust/types.ts
+++ b/web/packages/teleport/src/DeviceTrust/types.ts
@@ -25,6 +25,29 @@ export type TrustedDevice = {
   enrollStatus: 'enrolled' | 'not enrolled';
   owner: string;
   createTime?: Date;
+  /**
+   * source indicates how the device got into Teleport's inventory.
+   * Devices registered directly via Teleport through tctl have no assigned source.
+   */
+  source?: DeviceSource;
+};
+
+/**
+ * DeviceSource indicates how the device got into Teleport's inventory.
+ * Devices registered directly via Teleport through tctl have no assigned source.
+ */
+export type DeviceSource = {
+  /**
+   * name is an arbitrary name that can be set when using either the Jamf integration [1] or when
+   * registering devices through the Teleport API.
+   *
+   * When using the Jamf or Intune integrations with default settings, it's set to "jamf" and
+   * "intune" respectively.
+   *
+   * [1]: https://goteleport.com/docs/identity-governance/device-trust/jamf-integration/#optional-sync-multiple-sources
+   */
+  name: string;
+  origin: DeviceOrigin;
 };
 
 export type TrustedDeviceOSType = 'Windows' | 'Linux' | 'macOS';
@@ -41,3 +64,42 @@ export type DeviceListProps = {
   fetchStatus?: 'loading' | 'disabled' | '';
   fetchData?: () => void;
 };
+
+export enum DeviceOrigin {
+  Unspecified = 0,
+  /**
+   * Api is only ever set if a customer wrote a 3rd-party solution for syncing devices and uses
+   * Teleport's API directly. The customer would be steered into using this origin, as setting the
+   * origin and the name is required by the API (see e/lib/devicetrust/storage.ValidateDeviceForCreate).
+   */
+  Api,
+  Jamf,
+  Intune,
+}
+
+export function deviceSource(source: DeviceSource | undefined): string {
+  if (!source) {
+    return '';
+  }
+
+  // Display the name only if it's not equal to the default name used by the given origin.
+  if (source.name == originToDefaultName[source.origin]) {
+    return originToPrettyName[source.origin];
+  }
+
+  return source.name;
+}
+
+/**
+ * originToDefaultName maps an origin to the default name each MDM integration uses as its source
+ * name.
+ */
+const originToDefaultName: Partial<Record<DeviceOrigin, string>> = {
+  [DeviceOrigin.Jamf]: 'jamf',
+  [DeviceOrigin.Intune]: 'intune',
+};
+
+const originToPrettyName: Partial<Record<DeviceOrigin, string>> = {
+  [DeviceOrigin.Jamf]: 'Jamf',
+  [DeviceOrigin.Intune]: 'Intune',
+};
diff --git a/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.story.tsx b/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.story.tsx
index 440155f0bade8..2d37dbdde8a1a 100644
--- a/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.story.tsx
+++ b/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { DiscoverGuideId } from 'teleport/services/userPreferences/discoverPreference';
 
diff --git a/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.tsx b/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.tsx
index e9fedaadcecd0..787a03593c463 100644
--- a/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.tsx
+++ b/web/packages/teleport/src/Discover/Database/SetupAccess/AwsRdsAuthRequirements.tsx
@@ -121,7 +121,7 @@ export function AwsRdsAuthRequirements({
             documentation
           </Link>{' '}
           on how to enable IAM authentication on your{' '}
-          {wantAutoDiscover ? 'databses' : 'database'}.
+          {wantAutoDiscover ? 'databases' : 'database'}.
         </Box>
       )}
 
diff --git a/web/packages/teleport/src/Discover/Database/common.tsx b/web/packages/teleport/src/Discover/Database/common.tsx
index 3cc782febd17b..1d85980ae736a 100644
--- a/web/packages/teleport/src/Discover/Database/common.tsx
+++ b/web/packages/teleport/src/Discover/Database/common.tsx
@@ -17,6 +17,7 @@
  */
 
 import { Box, Mark, Label as Pill } from 'design';
+import { makeLabelTag } from 'design/formatters';
 import * as Icons from 'design/Icon';
 import { P } from 'design/Text/Text';
 
@@ -81,7 +82,7 @@ export const Labels = ({
           </P>
           <Box mb={3}>
             {dbLabels.map((label, index) => {
-              const labelText = `${label.name}: ${label.value}`;
+              const labelText = makeLabelTag(label);
               return (
                 <Pill
                   key={`${label.name}${label.value}${index}`}
diff --git a/web/packages/teleport/src/Discover/Discover.test.tsx b/web/packages/teleport/src/Discover/Discover.test.tsx
index a7113a1eafca9..7b4f5c9544400 100644
--- a/web/packages/teleport/src/Discover/Discover.test.tsx
+++ b/web/packages/teleport/src/Discover/Discover.test.tsx
@@ -152,7 +152,7 @@ describe('location state', () => {
     // we assert three databases for servers because the naming convention includes "server"
     expect(
       screen.queryAllByTestId(getGuideTileId({ kind: ResourceKind.Database }))
-    ).toHaveLength(4);
+    ).toHaveLength(5);
 
     expect(
       screen.queryByTestId(getGuideTileId({ kind: ResourceKind.Desktop }))
diff --git a/web/packages/teleport/src/Discover/Kubernetes/SelfHosted/HelmChart/HelmChart.story.tsx b/web/packages/teleport/src/Discover/Kubernetes/SelfHosted/HelmChart/HelmChart.story.tsx
index 326b762e7b424..c22531be3e7ff 100644
--- a/web/packages/teleport/src/Discover/Kubernetes/SelfHosted/HelmChart/HelmChart.story.tsx
+++ b/web/packages/teleport/src/Discover/Kubernetes/SelfHosted/HelmChart/HelmChart.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { StoryObj } from '@storybook/react';
+import { StoryObj } from '@storybook/react-vite';
 import { delay, http, HttpResponse } from 'msw';
 import { PropsWithChildren } from 'react';
 import { withoutQuery } from 'web/packages/build/storybook';
diff --git a/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx b/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx
index 2e27f87ca912d..f106af91e2f19 100644
--- a/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx
@@ -57,6 +57,7 @@ import {
   kindBasedList,
   l_DesktopAzure,
   l_Saml,
+  m_MCP,
   makeResourceSpec,
   NoAccessList,
 } from './testUtils';
@@ -154,6 +155,7 @@ describe('preferred resources', () => {
         l_Saml,
         l_DesktopAzure,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -176,6 +178,7 @@ describe('preferred resources', () => {
         l_Saml,
         l_DesktopAzure,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -198,6 +201,7 @@ describe('preferred resources', () => {
         k_Database,
         l_Saml,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -209,6 +213,7 @@ describe('preferred resources', () => {
         // preferred first
         c_ApplicationGcp,
         g_Application,
+        m_MCP,
         // alpha; guided before unguided
         a_DatabaseAws,
         d_Saml,
@@ -242,6 +247,7 @@ describe('preferred resources', () => {
         k_Database,
         l_Saml,
         l_DesktopAzure,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -297,6 +303,7 @@ describe('marketing params', () => {
         k_Database,
         l_Saml,
         l_DesktopAzure,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -327,6 +334,7 @@ describe('marketing params', () => {
         l_Saml,
         l_DesktopAzure,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -357,6 +365,7 @@ describe('marketing params', () => {
         l_Saml,
         l_DesktopAzure,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -387,6 +396,7 @@ describe('marketing params', () => {
         k_Database,
         l_Saml,
         e_KubernetesSelfHosted_unguided,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
@@ -406,6 +416,7 @@ describe('marketing params', () => {
         // preferred first
         c_ApplicationGcp,
         g_Application,
+        m_MCP,
         // alpha; guided before unguided
         a_DatabaseAws,
         d_Saml,
@@ -447,6 +458,7 @@ describe('marketing params', () => {
         k_Database,
         l_Saml,
         l_DesktopAzure,
+        m_MCP,
         // no access is last
         ...NoAccessList,
       ],
diff --git a/web/packages/teleport/src/Discover/SelectResource/Tile.tsx b/web/packages/teleport/src/Discover/SelectResource/Tile.tsx
index 15bcac0f4ce7a..7736feb179331 100644
--- a/web/packages/teleport/src/Discover/SelectResource/Tile.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/Tile.tsx
@@ -17,9 +17,10 @@
  */
 
 import { useState, type ComponentPropsWithoutRef } from 'react';
+import { Link as InternalLink } from 'react-router-dom';
 import styled from 'styled-components';
 
-import { Box, Flex, Link, Text } from 'design';
+import { Box, Link as ExternalLink, Flex, Text } from 'design';
 import { NewTab } from 'design/Icon';
 import { Theme } from 'design/theme';
 import { PinningSupport } from 'shared/components/UnifiedResources';
@@ -71,7 +72,9 @@ export function Tile({
     onSelectResource(resourceSpec);
   };
 
-  let resourceCardProps: ComponentPropsWithoutRef<'button' | typeof Link>;
+  let resourceCardProps: ComponentPropsWithoutRef<
+    'button' | typeof ExternalLink | typeof InternalLink
+  >;
 
   if (resourceSpec.kind === ResourceKind.Application && resourceSpec.isDialog) {
     resourceCardProps = {
@@ -81,12 +84,20 @@ export function Tile({
     };
   } else if (resourceSpec.unguidedLink) {
     resourceCardProps = {
-      as: Link,
+      as: ExternalLink,
       href: resourceSpec.hasAccess ? resourceSpec.unguidedLink : null,
       target: '_blank',
       style: { textDecoration: 'none' },
       role: 'link',
     };
+  } else if (resourceSpec.guidedLink) {
+    resourceCardProps = {
+      as: InternalLink,
+      to: {
+        pathname: resourceSpec.hasAccess ? resourceSpec.guidedLink : null,
+      },
+      style: { textDecoration: 'none' },
+    };
   } else {
     resourceCardProps = {
       onClick: () => resourceSpec.hasAccess && onSelectResource(resourceSpec),
diff --git a/web/packages/teleport/src/Discover/SelectResource/resources/databases.tsx b/web/packages/teleport/src/Discover/SelectResource/resources/databases.tsx
index 2a7e074615d37..544f4c86df30b 100644
--- a/web/packages/teleport/src/Discover/SelectResource/resources/databases.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/resources/databases.tsx
@@ -125,6 +125,22 @@ export const DATABASES_UNGUIDED: SelectResourceSpec[] = [
       'https://goteleport.com/docs/enroll-resources/database-access/enroll-aws-databases/redis-aws',
     event: DiscoverEventResource.DatabaseRedisElasticache,
   },
+  {
+    id: DiscoverGuideId.DatabaseAwsElastiCacheServerless,
+    dbMeta: { location: DatabaseLocation.Aws, engine: DatabaseEngine.Redis },
+    name: 'ElastiCache Serverless',
+    keywords: [
+      ...awsDatabaseKeywords,
+      'elasticache-serverless',
+      'valkey',
+      'redis',
+    ],
+    kind: ResourceKind.Database,
+    icon: 'aws',
+    unguidedLink:
+      'https://goteleport.com/docs/enroll-resources/database-access/enroll-aws-databases/elasticache-serverless',
+    event: DiscoverEventResource.DatabaseRedisElastiCacheServerless,
+  },
   {
     id: DiscoverGuideId.DatabaseAwsCassandraKeyspaces,
     dbMeta: {
diff --git a/web/packages/teleport/src/Discover/SelectResource/resources/keywords.ts b/web/packages/teleport/src/Discover/SelectResource/resources/keywords.ts
index 489ba11058154..ce17d5f798bfb 100644
--- a/web/packages/teleport/src/Discover/SelectResource/resources/keywords.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/resources/keywords.ts
@@ -20,6 +20,7 @@ export const baseServerKeywords = ['server', 'node', 'ssh'];
 export const awsKeywords = ['aws', 'amazon', 'amazon web services'];
 export const kubeKeywords = ['kubernetes', 'k8s', 'kubes', 'cluster'];
 export const selfHostedKeywords = ['self hosted', 'self-hosted'];
+export const mcpKeywords = ['mcp', 'model context protocol', 'mcp server'];
 
 export const baseDatabaseKeywords = ['db', 'database', 'databases'];
 export const awsDatabaseKeywords = [...baseDatabaseKeywords, ...awsKeywords];
diff --git a/web/packages/teleport/src/Discover/SelectResource/resources/resources.tsx b/web/packages/teleport/src/Discover/SelectResource/resources/resources.tsx
index 5f2e5c29cb3b5..579f109494b2b 100644
--- a/web/packages/teleport/src/Discover/SelectResource/resources/resources.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/resources/resources.tsx
@@ -19,6 +19,8 @@
 import { Platform } from 'design/platform';
 import { assertUnreachable } from 'shared/utils/assertUnreachable';
 
+import cfg from 'teleport/config';
+import { IntegrationKind } from 'teleport/services/integrations';
 import {
   DiscoverDiscoveryConfigMethod,
   DiscoverEventResource,
@@ -42,6 +44,7 @@ import {
   awsKeywords,
   baseServerKeywords,
   kubeKeywords,
+  mcpKeywords,
   selfHostedKeywords,
 } from './keywords';
 
@@ -68,7 +71,16 @@ export const SERVERS: SelectResourceSpec[] = [
     id: DiscoverGuideId.ServerLinuxRhelCentos,
     name: 'RHEL 8+/CentOS Stream 9+',
     kind: ResourceKind.Server,
-    keywords: [...baseServerKeywords, 'rhel', 'redhat', 'centos', 'linux'],
+    keywords: [
+      ...baseServerKeywords,
+      'rhel',
+      'redhat',
+      'centos',
+      'linux',
+      'rocky',
+      'alma',
+      'almalinux',
+    ],
     icon: 'linux',
     event: DiscoverEventResource.Server,
     platform: Platform.Linux,
@@ -149,13 +161,22 @@ export const APPLICATIONS: SelectResourceSpec[] = [
   },
   {
     id: DiscoverGuideId.ApplicationAwsCliConsole,
-    name: 'AWS CLI/Console Access',
+    name: 'AWS CLI/Console Access via AWS OIDC IdP',
     kind: ResourceKind.Application,
     keywords: [...awsKeywords, 'application', 'cli', 'console access'],
     icon: 'aws',
     event: DiscoverEventResource.ApplicationAwsConsole,
     appMeta: { awsConsole: true },
   },
+  {
+    id: DiscoverGuideId.ApplicationAwsRolesAnywhere,
+    name: 'AWS CLI/Console Access via AWS Roles Anywhere',
+    kind: ResourceKind.Application,
+    keywords: [...awsKeywords, 'application', 'cli', 'console access'],
+    icon: 'aws',
+    event: DiscoverEventResource.ApplicationAwsConsole,
+    guidedLink: cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa),
+  },
 ];
 
 export const WINDOWS_DESKTOPS: SelectResourceSpec[] = [
@@ -202,8 +223,42 @@ export const KUBERNETES: SelectResourceSpec[] = [
   },
 ];
 
+export const MCP_SERVERS: SelectResourceSpec[] = [
+  {
+    id: DiscoverGuideId.MCPServerStreamableHTTPTransport,
+    name: 'MCP Server with streamable-HTTP transport',
+    kind: ResourceKind.MCP,
+    keywords: [...mcpKeywords, 'streamable', 'http'],
+    icon: 'mcp',
+    event: DiscoverEventResource.MCPStreamableHTTP,
+    unguidedLink:
+      'https://goteleport.com/docs/enroll-resources/mcp-access/streamable-http/',
+  },
+  {
+    id: DiscoverGuideId.MCPServerStdioTransport,
+    name: 'MCP Server with stdio transport',
+    kind: ResourceKind.MCP,
+    keywords: [...mcpKeywords, 'stdio'],
+    icon: 'mcp',
+    event: DiscoverEventResource.MCPStdio,
+    unguidedLink:
+      'https://goteleport.com/docs/enroll-resources/mcp-access/stdio/',
+  },
+  {
+    id: DiscoverGuideId.MCPServerSSETransport,
+    name: 'MCP Server with the legacy SSE transport',
+    kind: ResourceKind.MCP,
+    keywords: [...mcpKeywords, 'sse'],
+    icon: 'mcp',
+    event: DiscoverEventResource.MCPSSE,
+    unguidedLink:
+      'https://goteleport.com/docs/enroll-resources/mcp-access/sse/',
+  },
+];
+
 export const BASE_RESOURCES: SelectResourceSpec[] = [
   ...APPLICATIONS,
+  ...MCP_SERVERS,
   ...KUBERNETES,
   ...WINDOWS_DESKTOPS,
   ...SERVERS,
@@ -277,12 +332,18 @@ export function getResourcePretitle(r: SelectResourceSpec) {
     case ResourceKind.ConnectMyComputer:
       return 'SSH';
     case ResourceKind.Application:
-      if (r.id === DiscoverGuideId.ApplicationAwsCliConsole) {
+      if (
+        r.id === DiscoverGuideId.ApplicationAwsCliConsole ||
+        r.id === DiscoverGuideId.ApplicationAwsRolesAnywhere
+      ) {
         return 'Amazon Web Services (AWS)';
       }
       if (r.id === DiscoverGuideId.ApplicationWebHttpProxy) {
         return 'HTTP Proxy';
       }
+      break;
+    case ResourceKind.MCP:
+      return 'Model Context Protocol';
   }
 
   return '';
diff --git a/web/packages/teleport/src/Discover/SelectResource/testUtils.ts b/web/packages/teleport/src/Discover/SelectResource/testUtils.ts
index 87241db882ea0..8a4b6c99c0267 100644
--- a/web/packages/teleport/src/Discover/SelectResource/testUtils.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/testUtils.ts
@@ -135,6 +135,11 @@ export const l_Saml = makeResourceSpec({
   name: 'lima',
   kind: ResourceKind.SamlApplication,
 });
+export const m_MCP = makeResourceSpec({
+  name: 'memory',
+  kind: ResourceKind.MCP,
+  unguidedLink: 'test.com',
+});
 
 export const kindBasedList: SelectResourceSpec[] = [
   c_ApplicationGcp,
@@ -156,4 +161,5 @@ export const kindBasedList: SelectResourceSpec[] = [
   h_Server,
   y_Saml_NoAccess,
   l_Saml,
+  m_MCP,
 ];
diff --git a/web/packages/teleport/src/Discover/SelectResource/types.ts b/web/packages/teleport/src/Discover/SelectResource/types.ts
index 697d6fb1d3acd..cd81629ddbf82 100644
--- a/web/packages/teleport/src/Discover/SelectResource/types.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/types.ts
@@ -97,6 +97,10 @@ export interface ResourceSpec {
    * this resource is not "guided" (has no UI interactive flow).
    */
   unguidedLink?: string;
+  /**
+   * guidedLink is an internal link to a guided flow outside of Discover flow.
+   */
+  guidedLink?: string;
   /**
    * isDialog indicates whether the flow for this resource is a popover dialog as opposed to a
    * Discover flow. This is the case for the 'Application' resource.
diff --git a/web/packages/teleport/src/Discover/SelectResource/utils/checkAccess.ts b/web/packages/teleport/src/Discover/SelectResource/utils/checkAccess.ts
index 01fadfed5ec48..16641b6cbf7a0 100644
--- a/web/packages/teleport/src/Discover/SelectResource/utils/checkAccess.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/utils/checkAccess.ts
@@ -44,6 +44,8 @@ function checkHasAccess(acl: Acl, resourceKind: ResourceKind) {
       // This is probably already true since without this permission the user wouldn't be able to
       // add any other resource, but let's just leave it for completeness sake.
       return acl.tokens.create;
+    case ResourceKind.MCP:
+      return acl.appServers.read && acl.appServers.list;
     default:
       return false;
   }
diff --git a/web/packages/teleport/src/Discover/SelectResource/utils/filters.test.ts b/web/packages/teleport/src/Discover/SelectResource/utils/filters.test.ts
index ccc0d53ffdf6c..007d10c6a74fe 100644
--- a/web/packages/teleport/src/Discover/SelectResource/utils/filters.test.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/utils/filters.test.ts
@@ -23,6 +23,7 @@ import {
   e_KubernetesSelfHosted_unguided,
   f_Server,
   l_DesktopAzure,
+  m_MCP,
   t_Application_NoAccess,
 } from '../testUtils';
 import { filterResources, Filters } from './filters';
@@ -34,6 +35,7 @@ const resources: SelectResourceSpec[] = [
   l_DesktopAzure,
   e_KubernetesSelfHosted_unguided,
   f_Server,
+  m_MCP,
 ];
 
 describe('filters by resource types', () => {
@@ -50,7 +52,7 @@ describe('filters by resource types', () => {
     {
       name: 'filter by application',
       filter: { resourceTypes: ['app'], hostingPlatforms: [] },
-      expected: [c_ApplicationGcp, t_Application_NoAccess],
+      expected: [c_ApplicationGcp, t_Application_NoAccess, m_MCP],
     },
     {
       name: 'filter by database',
@@ -75,7 +77,17 @@ describe('filters by resource types', () => {
     {
       name: 'filter by server and app',
       filter: { resourceTypes: ['app', 'server'], hostingPlatforms: [] },
-      expected: [c_ApplicationGcp, t_Application_NoAccess, f_Server],
+      expected: [c_ApplicationGcp, t_Application_NoAccess, f_Server, m_MCP],
+    },
+    {
+      name: 'filter by mcp',
+      filter: { resourceTypes: ['mcp'], hostingPlatforms: [] },
+      expected: [m_MCP],
+    },
+    {
+      name: 'filter by app and mcp',
+      filter: { resourceTypes: ['app', 'mcp'], hostingPlatforms: [] },
+      expected: [c_ApplicationGcp, t_Application_NoAccess, m_MCP],
     },
   ];
   test.each(testCases)('$name', tc => {
diff --git a/web/packages/teleport/src/Discover/SelectResource/utils/filters.ts b/web/packages/teleport/src/Discover/SelectResource/utils/filters.ts
index 6fd058a48fada..d7ed7e30854f1 100644
--- a/web/packages/teleport/src/Discover/SelectResource/utils/filters.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/utils/filters.ts
@@ -45,6 +45,7 @@ export const resourceTypeOptions = [
   { value: 'app', label: 'Applications' },
   { value: 'db', label: 'Database' },
   { value: 'desktops', label: 'Desktops' },
+  { value: 'mcp', label: 'MCP Servers' },
   { value: 'kube', label: 'Kubernetes' },
   { value: 'server', label: 'SSH' },
 ] as const satisfies { value: string; label: string }[];
@@ -90,7 +91,8 @@ export function filterResources(
       if (
         resourceTypes.includes('app') &&
         (r.kind === ResourceKind.Application ||
-          r.kind === ResourceKind.SamlApplication)
+          r.kind === ResourceKind.SamlApplication ||
+          r.kind === ResourceKind.MCP)
       ) {
         return true;
       }
@@ -116,6 +118,9 @@ export function filterResources(
       ) {
         return true;
       }
+      if (resourceTypes.includes('mcp') && r.kind === ResourceKind.MCP) {
+        return true;
+      }
     });
   }
 
diff --git a/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.test.tsx b/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.test.tsx
index 43c3943947f59..5be9e2bcd1e9b 100644
--- a/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.test.tsx
+++ b/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.test.tsx
@@ -102,7 +102,7 @@ describe('DiscoveryConfigSsm', () => {
     await completeForm();
     // add tags
 
-    fireEvent.click(screen.getByText(/add a tag/i));
+    fireEvent.click(screen.getByText(/add tag/i));
     const keyInput = screen.getByPlaceholderText('label key');
     const valInput = screen.getByPlaceholderText('label value');
 
diff --git a/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.tsx b/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.tsx
index f49b34461fd03..d48821fc22456 100644
--- a/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.tsx
+++ b/web/packages/teleport/src/Discover/Server/DiscoveryConfigSsm/DiscoveryConfigSsm.tsx
@@ -43,6 +43,7 @@ import { LabelsInput } from 'teleport/components/LabelsInput';
 import cfg from 'teleport/config';
 import { AwsRegionSelector } from 'teleport/Discover/Shared/AwsRegionSelector';
 import { useDiscover } from 'teleport/Discover/useDiscover';
+import auth from 'teleport/services/auth';
 import {
   createDiscoveryConfig,
   DISCOVERY_GROUP_CLOUD,
@@ -110,9 +111,7 @@ export function DiscoveryConfigSsm() {
   const { clusterId } = useStickyClusterId();
 
   const [selectedRegion, setSelectedRegion] = useState<Regions>();
-  const [ssmDocumentName, setSsmDocumentName] = useState(
-    'TeleportDiscoveryInstaller'
-  );
+  const [ssmDocumentName, setSsmDocumentName] = useState('AWS-RunShellScript');
   const [scriptUrl, setScriptUrl] = useState('');
   const joinTokenRef = useRef<JoinToken>(undefined);
   const [tags, setTags] = useState<AWSLabels>([]);
@@ -126,11 +125,19 @@ export function DiscoveryConfigSsm() {
         // This can happen if creating discovery config attempt failed
         // and the user retries.
         if (!joinTokenRef.current) {
-          joinTokenRef.current = await joinTokenService.fetchJoinTokenV2({
-            roles: ['Node'],
-            method: 'iam',
-            rules: [{ awsAccountId }],
-          });
+          const mfaResponse = await auth.getMfaChallengeResponseForAdminAction(
+            true /* allow re-use */
+          );
+
+          joinTokenRef.current = await joinTokenService.fetchJoinTokenV2(
+            {
+              roles: ['Node'],
+              method: 'iam',
+              rules: [{ awsAccountId }],
+            },
+            null /* abortSignal */,
+            mfaResponse
+          );
         }
 
         const config = await createDiscoveryConfig(clusterId, {
@@ -413,6 +420,7 @@ const inlinePolicyJson = `{
       {
           "Effect": "Allow",
           "Action": [
+              "account:ListRegions",
               "ec2:DescribeInstances",
               "ssm:DescribeInstanceInformation",
               "ssm:GetCommandInvocation",
diff --git a/web/packages/teleport/src/Discover/Server/DownloadScript/DownloadScript.story.tsx b/web/packages/teleport/src/Discover/Server/DownloadScript/DownloadScript.story.tsx
index a2e5a2f206115..252db45be3616 100644
--- a/web/packages/teleport/src/Discover/Server/DownloadScript/DownloadScript.story.tsx
+++ b/web/packages/teleport/src/Discover/Server/DownloadScript/DownloadScript.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { StoryObj } from '@storybook/react';
+import { StoryObj } from '@storybook/react-vite';
 import { delay, http, HttpResponse } from 'msw';
 import { PropsWithChildren } from 'react';
 import { withoutQuery } from 'web/packages/build/storybook';
diff --git a/web/packages/teleport/src/Discover/Shared/Aws/Labels.tsx b/web/packages/teleport/src/Discover/Shared/Aws/Labels.tsx
index 5dc06e2e834b2..004105c8a603b 100644
--- a/web/packages/teleport/src/Discover/Shared/Aws/Labels.tsx
+++ b/web/packages/teleport/src/Discover/Shared/Aws/Labels.tsx
@@ -17,12 +17,13 @@
  */
 
 import { Flex, Label as Pill } from 'design';
+import { makeLabelTag } from 'design/formatters';
 
 import { Label } from 'teleport/types';
 
 export const Labels = ({ labels }: { labels: Label[] }) => {
   const $labels = labels.map((label, index) => {
-    const labelText = `${label.name}: ${label.value}`;
+    const labelText = makeLabelTag(label);
 
     return (
       <Pill key={`${label.name}${label.value}${index}`} mr="1" kind="secondary">
diff --git a/web/packages/teleport/src/Discover/Shared/Finished/Finished.story.tsx b/web/packages/teleport/src/Discover/Shared/Finished/Finished.story.tsx
index 78e08aa30befb..2a01d5fe0063a 100644
--- a/web/packages/teleport/src/Discover/Shared/Finished/Finished.story.tsx
+++ b/web/packages/teleport/src/Discover/Shared/Finished/Finished.story.tsx
@@ -52,6 +52,18 @@ export const FinishedWithAutoEnroll = () => (
   />
 );
 
+export const FinishedWithMessageProps = () => (
+  <Component
+    {...props}
+    title="Resource Added Custom Message"
+    resourceText="Custom completion details"
+    primaryButtonText="Custom primary button"
+    primaryButtonAction={() => console.info('primary action')}
+    secondaryButtonText="Custom secondary button"
+    secondaryButtonAction={() => console.info('secondary action')}
+  />
+);
+
 const props: AgentStepProps = {
   agentMeta: { resourceName: 'some-resource-name', agentMatcherLabels: [] },
   updateAgentMeta: () => null,
diff --git a/web/packages/teleport/src/Discover/Shared/Finished/Finished.tsx b/web/packages/teleport/src/Discover/Shared/Finished/Finished.tsx
index 6dcb4d245b0dc..3d248edd80456 100644
--- a/web/packages/teleport/src/Discover/Shared/Finished/Finished.tsx
+++ b/web/packages/teleport/src/Discover/Shared/Finished/Finished.tsx
@@ -26,17 +26,31 @@ import history from 'teleport/services/history';
 import type { AgentStepProps } from '../../types';
 import celebratePamPng from './celebrate-pam.png';
 
-export function Finished(props: AgentStepProps) {
-  let title = 'Resource Successfully Added';
-  let resourceText =
-    'You can start accessing this resource right away or add another resource.';
+//  Message fields will optionally override defaults and agent-based logic
+type Message = {
+  title?: string;
+  resourceText?: string;
+  primaryButtonText?: string;
+  primaryButtonAction?: () => void;
+  secondaryButtonText?: string;
+  secondaryButtonAction?: () => void;
+};
 
-  if (props.agentMeta) {
-    if (props.agentMeta.autoDiscovery) {
+export function Finished({
+  agentMeta,
+  title = 'Resource Successfully Added',
+  resourceText = 'You can start accessing this resource right away or add another resource.',
+  primaryButtonText = 'Browse Existing Resources',
+  primaryButtonAction = () => history.push(cfg.routes.root, true),
+  secondaryButtonText = 'Add Another Resource',
+  secondaryButtonAction = () => history.reload(),
+}: AgentStepProps & Message) {
+  if (agentMeta) {
+    if (agentMeta.autoDiscovery) {
       title = 'Completed Setup';
       resourceText = 'You have completed setup for auto-enrolling.';
-    } else if (props.agentMeta.resourceName) {
-      resourceText = `Resource [${props.agentMeta.resourceName}] has been successfully added to
+    } else if (agentMeta.resourceName) {
+      resourceText = `Resource [${agentMeta.resourceName}] has been successfully added to
       this Teleport Cluster. ${resourceText}`;
     }
   }
@@ -52,17 +66,17 @@ export function Finished(props: AgentStepProps) {
         <ButtonPrimary
           width="270px"
           size="large"
-          onClick={() => history.push(cfg.routes.root, true)}
+          onClick={primaryButtonAction}
           mr={3}
         >
-          Browse Existing Resources
+          {primaryButtonText}
         </ButtonPrimary>
         <ButtonSecondary
           width="270px"
           size="large"
-          onClick={() => history.reload()}
+          onClick={secondaryButtonAction}
         >
-          Add Another Resource
+          {secondaryButtonText}
         </ButtonSecondary>
       </Flex>
     </Container>
diff --git a/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx b/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
index 058f5381badee..a413b5343fd92 100644
--- a/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
+++ b/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
@@ -21,7 +21,7 @@ import React from 'react';
 import { Box, ButtonIcon, Flex, Text } from 'design';
 import * as Icons from 'design/Icon';
 import { inputGeometry } from 'design/Input/Input';
-import { ButtonTextWithAddIcon } from 'shared/components/ButtonTextWithAddIcon';
+import { ButtonWithAddIcon } from 'shared/components/ButtonWithAddIcon';
 import FieldInput from 'shared/components/FieldInput';
 import { useValidation, Validator } from 'shared/components/Validation';
 import { requiredField } from 'shared/components/Validation/rules';
@@ -188,7 +188,7 @@ export function LabelsCreater({
           );
         })}
       </Box>
-      <ButtonTextWithAddIcon
+      <ButtonWithAddIcon
         label={labels.length === 0 ? 'Add a Label' : 'Add Another Label'}
         onClick={addLabel}
         disabled={disableBtns}
diff --git a/web/packages/teleport/src/Discover/Shared/ResourceKind.ts b/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
index be6d3ba2e93a0..4da5bf80e3698 100644
--- a/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
+++ b/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
@@ -29,6 +29,7 @@ export enum ResourceKind {
   SamlApplication,
   Discovery,
   ConnectMyComputer,
+  MCP,
 }
 
 export function resourceKindToJoinRole(kind: ResourceKind): JoinRole {
@@ -66,5 +67,7 @@ export function resourceKindToPreferredResource(kind: ResourceKind): Resource {
       return Resource.UNSPECIFIED;
     case ResourceKind.ConnectMyComputer:
       return Resource.SERVER_SSH;
+    case ResourceKind.MCP:
+      return Resource.WEB_APPLICATIONS;
   }
 }
diff --git a/web/packages/teleport/src/Discover/useDiscover.tsx b/web/packages/teleport/src/Discover/useDiscover.tsx
index 7fc9a6cff64e8..c24656a75058e 100644
--- a/web/packages/teleport/src/Discover/useDiscover.tsx
+++ b/web/packages/teleport/src/Discover/useDiscover.tsx
@@ -298,7 +298,7 @@ export function DiscoverProvider({
     // We still want to emit an event if user clicked on an
     // unguided link to gather data on which unguided resource
     // is most popular.
-    if (resource.unguidedLink || resource.isDialog) {
+    if (resource.unguidedLink || resource.guidedLink || resource.isDialog) {
       emitEvent(
         { stepStatus: DiscoverEventStatus.Success },
         {
diff --git a/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.test.tsx b/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.test.tsx
index d5b334860f31c..cefe2963c787a 100644
--- a/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.test.tsx
+++ b/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.test.tsx
@@ -23,20 +23,29 @@ import { render, screen } from 'design/utils/testing';
 
 import cfg from 'teleport/config';
 import { HeadlessRequest } from 'teleport/HeadlessRequest/HeadlessRequest';
+import { shouldShowMfaPrompt } from 'teleport/lib/useMfa';
 import auth from 'teleport/services/auth';
 
-test('ip address should be visible', async () => {
-  jest.spyOn(auth, 'headlessSsoGet').mockImplementation(
-    () =>
-      new Promise(resolve => {
-        resolve({ clientIpAddress: '1.2.3.4' });
-      })
-  );
+const mockGetChallengeResponse = jest.fn();
 
-  const headlessSSOPath = '/web/headless/2a8dcaae-1fa5-533b-aad8-f97420df44de';
-  const mockHistory = createMemoryHistory({
-    initialEntries: [headlessSSOPath],
-  });
+jest.mock('teleport/lib/useMfa', () => ({
+  useMfa: () => ({
+    getChallengeResponse: mockGetChallengeResponse,
+    attempt: { status: '' },
+  }),
+  shouldShowMfaPrompt: jest.fn(),
+}));
+
+function setup({ mfaPrompt = false, path = '/web/headless/123' } = {}) {
+  (shouldShowMfaPrompt as jest.Mock).mockReturnValue(mfaPrompt);
+
+  mockGetChallengeResponse.mockResolvedValue({ webauthn_response: {} });
+
+  jest
+    .spyOn(auth, 'headlessSsoGet')
+    .mockResolvedValue({ clientIpAddress: '1.2.3.4' });
+
+  const mockHistory = createMemoryHistory({ initialEntries: [path] });
 
   render(
     <Router history={mockHistory}>
@@ -45,8 +54,31 @@ test('ip address should be visible', async () => {
       </Route>
     </Router>
   );
+}
+
+describe('HeadlessRequest', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('shows the headless request approve/reject dialog', async () => {
+    setup({ mfaPrompt: false, path: '/web/headless/abc' });
 
-  await expect(
-    screen.findByText(/Someone has initiated a command from 1.2.3.4/i)
-  ).resolves.toBeInTheDocument();
+    await expect(
+      screen.findByText(/Someone has initiated a command from 1.2.3.4/i)
+    ).resolves.toBeInTheDocument();
+
+    expect(
+      await screen.findByRole('button', { name: /Approve/i })
+    ).toBeInTheDocument();
+    expect(
+      await screen.findByRole('button', { name: /Reject/i })
+    ).toBeInTheDocument();
+  });
+
+  test('shows MFA prompt after user approves the request', async () => {
+    setup({ mfaPrompt: true, path: '/web/headless/abc' });
+
+    expect(await screen.findAllByText(/Verify Your Identity/i)).toHaveLength(2);
+  });
 });
diff --git a/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.tsx b/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.tsx
index 9950cbac4c2ac..c732e6143819c 100644
--- a/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.tsx
+++ b/web/packages/teleport/src/HeadlessRequest/HeadlessRequest.tsx
@@ -22,10 +22,13 @@ import styled from 'styled-components';
 import { Box, Flex, rotate360 } from 'design';
 import { Spinner } from 'design/Icon';
 
+import AuthnDialog from 'teleport/components/AuthnDialog';
 import HeadlessRequestDialog from 'teleport/components/HeadlessRequestDialog/HeadlessRequestDialog';
 import { useParams } from 'teleport/components/Router';
 import { CardAccept, CardDenied } from 'teleport/HeadlessRequest/Cards';
+import { shouldShowMfaPrompt, useMfa } from 'teleport/lib/useMfa';
 import auth from 'teleport/services/auth';
+import { MfaChallengeScope } from 'teleport/services/auth/auth';
 
 export function HeadlessRequest() {
   const { requestId } = useParams<{ requestId: string }>();
@@ -37,6 +40,13 @@ export function HeadlessRequest() {
     publicKey: null as PublicKeyCredentialRequestOptions,
   });
 
+  const mfa = useMfa({
+    req: {
+      scope: MfaChallengeScope.HEADLESS_LOGIN,
+    },
+    isMfaRequired: true,
+  });
+
   useEffect(() => {
     const setIpAddress = (response: { clientIpAddress: string }) => {
       setState({
@@ -100,38 +110,47 @@ export function HeadlessRequest() {
   }
 
   return (
-    <HeadlessRequestDialog
-      ipAddress={state.ipAddress}
-      onAccept={() => {
-        setState({ ...state, status: 'in-progress' });
-
-        auth
-          .headlessSsoAccept(requestId)
-          .then(setSuccess)
-          .catch(e => {
-            setState({
-              ...state,
-              status: 'error',
-              errorText: e.toString(),
-            });
-          });
-      }}
-      onReject={() => {
-        setState({ ...state, status: 'in-progress' });
-
-        auth
-          .headlessSSOReject(requestId)
-          .then(setRejected)
-          .catch(e => {
-            setState({
-              ...state,
-              status: 'error',
-              errorText: e.toString(),
-            });
-          });
-      }}
-      errorText={state.errorText}
-    />
+    <>
+      {
+        /* Show only one dialog at a time because too many dialogs can be confusing */
+        shouldShowMfaPrompt(mfa) ? (
+          <AuthnDialog mfaState={mfa} />
+        ) : (
+          <HeadlessRequestDialog
+            ipAddress={state.ipAddress}
+            onAccept={() => {
+              setState({ ...state, status: 'in-progress' });
+
+              auth
+                .headlessSsoAccept(mfa, requestId)
+                .then(setSuccess)
+                .catch(e => {
+                  setState({
+                    ...state,
+                    status: 'error',
+                    errorText: e.toString(),
+                  });
+                });
+            }}
+            onReject={() => {
+              setState({ ...state, status: 'in-progress' });
+
+              auth
+                .headlessSSOReject(requestId)
+                .then(setRejected)
+                .catch(e => {
+                  setState({
+                    ...state,
+                    status: 'error',
+                    errorText: e.toString(),
+                  });
+                });
+            }}
+            errorText={state.errorText}
+          />
+        )
+      }
+    </>
   );
 }
 
diff --git a/web/packages/teleport/src/Integrations/DeleteAwsOidcIntegrationDialog.tsx b/web/packages/teleport/src/Integrations/DeleteAwsOidcIntegrationDialog.tsx
new file mode 100644
index 0000000000000..4fe37c8cefe8e
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/DeleteAwsOidcIntegrationDialog.tsx
@@ -0,0 +1,100 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Alert, ButtonSecondary, ButtonWarning, P1, Text } from 'design';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from 'design/DialogConfirmation';
+import useAttempt from 'shared/hooks/useAttemptNext';
+
+import { IntegrationAwsOidc } from 'teleport/services/integrations';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+
+import { type DeleteRequestOptions } from './Operations/IntegrationOperations';
+
+type Props = {
+  close(): void;
+  remove(opt?: DeleteRequestOptions): Promise<void>;
+  integration: IntegrationAwsOidc;
+};
+
+export function DeleteAwsOidcIntegrationDialog(props: Props) {
+  const { close, remove, integration } = props;
+  const { attempt, run } = useAttempt();
+  const isDisabled = attempt.status === 'processing';
+  const { clusterId } = useStickyClusterId();
+
+  // https://resource-explorer.console.aws.amazon.com
+  // /resource-explorer/home#/search?query=
+  // tag:teleport.dev/origin=integration_awsoidc+
+  // tag:teleport.dev/cluster={cluster_name}+
+  // tag:teleport.dev/integration={integration_name}
+  const awsResourceExplorerUrl =
+    `https://resource-explorer.console.aws.amazon.com` +
+    `/resource-explorer/home#/search?query=` +
+    `tag%3Ateleport.dev%2Forigin%3Dintegration_awsoidc+` +
+    `tag%3Ateleport.dev%2Fcluster%3D${clusterId}+` +
+    `tag%3Ateleport.dev%2Fintegration%3D${integration.name}`;
+  function onOk() {
+    run(() => remove({ deleteAssociatedResources: true }));
+  }
+
+  return (
+    <Dialog onClose={close} open={true}>
+      <DialogHeader>
+        <DialogTitle>Delete AWS OIDC Integration?</DialogTitle>
+      </DialogHeader>
+      <DialogContent width="600px">
+        {attempt.status === 'failed' && <Alert children={attempt.statusText} />}
+        <P1 mb={3}>
+          Are you sure you want to delete integration{' '}
+          <Text as="span" bold color="text.main">
+            {integration.name}
+          </Text>
+          ?
+        </P1>
+        <Alert
+          kind="warning"
+          primaryAction={{
+            content: 'AWS Resource Explorer',
+            href: awsResourceExplorerUrl,
+          }}
+        >
+          AWS resources created by this integration may require manual clean up.
+          Visit AWS Resource Explorer to see AWS resources tagged by this
+          integration.
+        </Alert>
+        <Alert kind="warning">
+          Teleport will also remove App servers and resources used for
+          auto-discovery that reference this integration.
+        </Alert>
+      </DialogContent>
+      <DialogFooter>
+        <ButtonWarning mr="3" disabled={isDisabled} onClick={onOk}>
+          Yes, Delete Integration
+        </ButtonWarning>
+        <ButtonSecondary disabled={isDisabled} onClick={close}>
+          Cancel
+        </ButtonSecondary>
+      </DialogFooter>
+    </Dialog>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.story.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.story.tsx
new file mode 100644
index 0000000000000..ad8fed3679e03
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.story.tsx
@@ -0,0 +1,519 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { MemoryRouter } from 'react-router';
+
+import { Info } from 'design/Alert';
+import { CollapsibleInfoSection as CollapsibleInfoSectionComponent } from 'design/CollapsibleInfoSection';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { Access } from 'teleport/Integrations/Enroll/AwsConsole/Access/Access';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { IntegrationKind } from 'teleport/services/integrations';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+
+export default {
+  title: 'Teleport/Integrations/Enroll/AwsConsole/ConfigureAccess',
+};
+
+const raName = 'test-ra';
+const ctx = createTeleportContext();
+
+const initialEntries = [
+  {
+    pathname: cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa, 'access'),
+    state: {
+      syncProfileArn: 'arn:aws:sync-profile',
+      syncRoleArn: 'arn:aws:sync-profile',
+      integrationName: raName,
+      trustAnchorArn:
+        'arn:aws:rolesanywhere:us-east-2:012345678901:trust-anchor/00000000-0000-0000-0000-000000000000',
+    },
+  },
+];
+
+export const NoProfiles = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter initialEntries={initialEntries}>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+NoProfiles.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json({
+          profiles: [],
+        });
+      }),
+    ],
+  },
+};
+
+export const WithProfiles = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter initialEntries={initialEntries}>
+        <CollapsibleInfoSectionComponent openLabel="Devs Instructions">
+          <Info
+            kind="info"
+            details="(Devs) Success is a redirect that is not yet implemented, that is not mocked here"
+          >
+            Case: Success
+          </Info>
+          <Info
+            kind="danger"
+            details="(Devs) Add a label with `baz` and submit to see filter error formatting"
+          >
+            Case: Test error
+          </Info>
+        </CollapsibleInfoSectionComponent>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+WithProfiles.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json({
+          profiles: [
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleA', 'RoleC'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/bar',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleB', 'RoleB'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/baz',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/qux',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              roles: ['RoleB', 'RoleB'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleA', 'RoleC'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/bar',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleB', 'RoleB'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/baz',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/qux',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              roles: ['RoleB', 'RoleB'],
+            },
+          ],
+        });
+      }),
+      http.put(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Filter baz invalid.' },
+          },
+          { status: 400 }
+        );
+      }),
+    ],
+  },
+};
+
+export const NotFoundEnroll = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter initialEntries={initialEntries}>
+        <CollapsibleInfoSectionComponent openLabel="Devs Instructions">
+          <Info
+            kind="info"
+            details="(Devs) During enrollment, a 404 can occur if the integration created on the previous page is not yet ready. Open the network tab, this component should be retrying /listprofiles every 2 seconds."
+          >
+            Enrolling: 404 Error
+          </Info>
+        </CollapsibleInfoSectionComponent>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+NotFoundEnroll.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Hidden 404 message' },
+          },
+          { status: 404 }
+        );
+      }),
+    ],
+  },
+};
+
+export const Edit = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter
+        initialEntries={[
+          {
+            pathname: cfg.getIntegrationEnrollRoute(
+              IntegrationKind.AwsRa,
+              'access'
+            ),
+            state: {
+              edit: true,
+              integrationName: raName,
+              trustAnchorArn:
+                'arn:aws:rolesanywhere:us-east-2:012345678901:trust-anchor/00000000-0000-0000-0000-000000000000',
+              syncProfileArn: 'arn:aws:sync-profile',
+              syncRoleArn: 'arn:aws:sync-profile',
+            },
+          },
+        ]}
+      >
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+Edit.parameters = {
+  msw: {
+    handlers: [
+      http.get(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json({
+          name: raName,
+          kind: IntegrationKind,
+          subKind: IntegrationKind.AwsRa,
+          awsra: {
+            trustAnchorArn: 'foo',
+            profileSyncConfig: {
+              profileNameFilters: ['test-*', 'dev-*', 'staging-*'],
+            },
+          },
+        });
+      }),
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json({
+          profiles: [
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleA', 'RoleC'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/bar',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleB', 'RoleB'],
+            },
+          ],
+        });
+      }),
+    ],
+  },
+};
+
+export const EditError = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter
+        initialEntries={[
+          {
+            pathname: cfg.getIntegrationEnrollRoute(
+              IntegrationKind.AwsRa,
+              'access'
+            ),
+            state: {
+              edit: true,
+              integrationName: raName,
+              trustAnchorArn:
+                'arn:aws:rolesanywhere:us-east-2:012345678901:trust-anchor/00000000-0000-0000-0000-000000000000',
+              syncProfileArn: 'arn:aws:sync-profile',
+              syncRoleArn: 'arn:aws:sync-profile',
+            },
+          },
+        ]}
+      >
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+EditError.parameters = {
+  msw: {
+    handlers: [
+      http.get(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Generic Bad Request' },
+          },
+          { status: 400 }
+        );
+      }),
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json({
+          profiles: [
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleA', 'RoleC'],
+            },
+            {
+              arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/bar',
+              enabled: true,
+              name: raName,
+              acceptRoleSessionName: false,
+              tags: {
+                'teleport.dev/cluster': 'foo',
+                'teleport.dev/integration': 'bar',
+                'teleport.dev/origin': 'baz',
+              },
+              roles: ['RoleB', 'RoleB'],
+            },
+          ],
+        });
+      }),
+      http.put(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Filter baz invalid.' },
+          },
+          { status: 400 }
+        );
+      }),
+    ],
+  },
+};
+
+export const NotFoundEdit = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter
+        initialEntries={[
+          {
+            pathname: cfg.getIntegrationEnrollRoute(
+              IntegrationKind.AwsRa,
+              'access'
+            ),
+            state: {
+              edit: true,
+              integrationName: raName,
+              trustAnchorArn:
+                'arn:aws:rolesanywhere:us-east-2:012345678901:trust-anchor/00000000-0000-0000-0000-000000000000',
+              syncProfileArn: 'arn:aws:sync-profile',
+              syncRoleArn: 'arn:aws:sync-profile',
+            },
+          },
+        ]}
+      >
+        <CollapsibleInfoSectionComponent openLabel="Devs Instructions">
+          <Info
+            kind="info"
+            details="(Devs) During editing, a 404 will not result in polling as the integration should already exist"
+          >
+            Editing: 404 Error
+          </Info>
+        </CollapsibleInfoSectionComponent>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+NotFoundEdit.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Hidden 404 message' },
+          },
+          { status: 404 }
+        );
+      }),
+    ],
+  },
+};
+
+export const BadRequest = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter initialEntries={initialEntries}>
+        <CollapsibleInfoSectionComponent openLabel="Devs Instructions">
+          <Info
+            kind="info"
+            details="(Devs) Non-404 errors should not refetch. Open the network tab, you should not see retries to /listprofiles"
+          >
+            Non-404 Error
+          </Info>
+        </CollapsibleInfoSectionComponent>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+BadRequest.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Generic Bad Request' },
+          },
+          { status: 400 }
+        );
+      }),
+    ],
+  },
+};
+
+export const WithoutAccess = () => {
+  const noCtx = createTeleportContext({
+    customAcl: makeAcl({
+      integrations: {
+        ...defaultAccess,
+      },
+    }),
+  });
+
+  return (
+    <ContextProvider ctx={noCtx}>
+      <InfoGuidePanelProvider>
+        <MemoryRouter initialEntries={initialEntries}>
+          <Access />
+        </MemoryRouter>
+      </InfoGuidePanelProvider>
+    </ContextProvider>
+  );
+};
+
+const missingState = [
+  {
+    pathname: cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa, 'access'),
+    state: {
+      integrationName: undefined,
+      trustAnchorArn: undefined,
+    },
+  },
+];
+
+export const MissingState = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter initialEntries={missingState}>
+        <Access />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+MissingState.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getAwsRolesAnywhereProfilesUrl(raName), () => {
+        return HttpResponse.json({
+          profiles: [],
+        });
+      }),
+    ],
+  },
+};
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.test.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.test.tsx
new file mode 100644
index 0000000000000..27ef66809b64c
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.test.tsx
@@ -0,0 +1,134 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { screen } from '@testing-library/react';
+import { MemoryRouter } from 'react-router';
+
+import { fireEvent, render, userEvent } from 'design/utils/testing';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { ContextProvider } from 'teleport/index';
+import { Access } from 'teleport/Integrations/Enroll/AwsConsole/Access/Access';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { integrationService } from 'teleport/services/integrations';
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+    },
+  },
+});
+
+const initialEntries = [
+  {
+    state: {
+      integrationName: 'test',
+      trustAnchorArn: 'trust-anchor-arn',
+      syncRoleArn: 'sync-role-arn',
+      syncProfileArn: 'sync-profile-arn',
+    },
+  },
+];
+
+jest.mock('react-router', () => ({
+  ...jest.requireActual('react-router'),
+  useHistory: () => ({
+    goBack: jest.fn(),
+    push: jest.fn(),
+  }),
+}));
+
+beforeEach(() => {
+  jest
+    .spyOn(integrationService, 'fetchIntegration')
+    .mockResolvedValue({} as any);
+  jest
+    .spyOn(integrationService, 'updateIntegration')
+    .mockResolvedValue({} as any);
+  jest.spyOn(integrationService, 'awsRolesAnywhereProfiles').mockResolvedValue({
+    profiles: [
+      {
+        arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+        enabled: true,
+        name: 'test',
+        acceptRoleSessionName: false,
+        tags: ['foo:bar', 'baz:qux', 'TagA:1'],
+        roles: ['RoleA', 'RoleC'],
+      },
+      {
+        arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/bar',
+        enabled: true,
+        name: 'test',
+        acceptRoleSessionName: false,
+        tags: ['foo2:bar2', 'baz2:qux2', 'TagA:2'],
+        roles: ['RoleB', 'RoleB'],
+      },
+    ],
+  } as any);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+test('flows through profiles configuration', async () => {
+  const user = userEvent.setup();
+
+  render(
+    <ContextProvider ctx={createTeleportContext()}>
+      <QueryClientProvider client={queryClient}>
+        <InfoGuidePanelProvider>
+          <MemoryRouter initialEntries={initialEntries}>
+            <Access />
+          </MemoryRouter>
+        </InfoGuidePanelProvider>
+      </QueryClientProvider>
+    </ContextProvider>
+  );
+
+  await screen.findByText('Import All');
+  expect(screen.getByText('Configure Access')).toBeInTheDocument();
+  expect(screen.getByRole('button', { name: 'Enable Sync' })).toBeEnabled();
+  expect(screen.queryByText('Filter by Profile Name')).not.toBeInTheDocument();
+  expect(screen.getByTestId('toggle')).toBeEnabled();
+  await user.click(screen.getByTestId('toggle'));
+  expect(screen.getByText('Filter by Profile Name')).toBeInTheDocument();
+
+  await user.type(screen.getByLabelText('Filter by Profile Name'), 'test-*');
+  fireEvent.keyDown(screen.getByLabelText('Filter by Profile Name'), {
+    key: 'Enter',
+  });
+  await user.click(screen.getByRole('button', { name: 'Enable Sync' }));
+
+  expect(integrationService.fetchIntegration).not.toHaveBeenCalled();
+  expect(integrationService.updateIntegration).toHaveBeenCalledTimes(1);
+  expect(integrationService.updateIntegration).toHaveBeenCalledWith('test', {
+    awsRa: {
+      trustAnchorARN: 'trust-anchor-arn',
+      profileSyncConfig: {
+        enabled: true,
+        filters: ['test-*'],
+        profileArn: 'sync-profile-arn',
+        roleArn: 'sync-role-arn',
+      },
+    },
+    kind: 'aws-ra',
+  });
+});
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.tsx
new file mode 100644
index 0000000000000..bec2359742f99
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Access.tsx
@@ -0,0 +1,347 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  keepPreviousData,
+  useMutation,
+  useQueries,
+} from '@tanstack/react-query';
+import { useEffect, useRef, useState } from 'react';
+import { useHistory, useLocation } from 'react-router';
+
+import { Box, CardTile, Indicator, ResourceIcon } from 'design';
+import * as Alerts from 'design/Alert';
+import { Alert } from 'design/Alert';
+import { ButtonBorder, ButtonPrimary, ButtonSecondary } from 'design/Button';
+import Flex from 'design/Flex';
+import * as Icons from 'design/Icon';
+import { H2, H3, P2 } from 'design/Text';
+import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { FeatureBox } from 'teleport/components/Layout';
+import cfg from 'teleport/config';
+import { Profiles } from 'teleport/Integrations/Enroll/AwsConsole/Access/Profiles';
+import {
+  makeProfilesFilterOption,
+  ProfilesFilterOption,
+} from 'teleport/Integrations/Enroll/AwsConsole/Access/ProfilesFilter';
+import { Guide } from 'teleport/Integrations/Enroll/AwsConsole/Guide';
+import { rolesAnywhereCreateProfile } from 'teleport/Integrations/Enroll/awsLinks';
+import { ApiError } from 'teleport/services/api/parseError';
+import {
+  IntegrationAwsRa,
+  IntegrationKind,
+  integrationService,
+} from 'teleport/services/integrations';
+import useTeleport from 'teleport/useTeleport';
+
+export function Access() {
+  const ctx = useTeleport();
+  const integrationsAccess = ctx.storeUser.getIntegrationsAccess();
+  const canEnroll = integrationsAccess.create;
+
+  const history = useHistory();
+  const location = useLocation<{
+    integrationName?: string;
+    trustAnchorArn?: string;
+    syncProfileArn?: string;
+    syncRoleArn?: string;
+    edit?: boolean;
+  }>();
+
+  const {
+    integrationName = '',
+    trustAnchorArn = '',
+    syncProfileArn = '',
+    syncRoleArn = '',
+    edit = false,
+  } = location.state;
+  const [syncAll, setSyncAll] = useState(!edit);
+  const [filters, setFilters] = useState<ProfilesFilterOption[]>([]);
+  // initialFilters is used in the edit flow to reset filters if import all is un-toggled
+  const [initialFilters, setInitialFilters] = useState<ProfilesFilterOption[]>(
+    []
+  );
+  // initialComplete & foundProfiles allows us to show a custom view for zero profiles,
+  // vs. showing the table view when the user has filtered down to zero
+  const initialComplete = useRef(false);
+  const [foundProfiles, setFoundProfiles] = useState(false);
+
+  const [intervalMs, setIntervalMs] = useState<number | false>(
+    edit ? false : 2000
+  );
+  const results = useQueries({
+    queries: [
+      // The integration endpoint is used for editing an existing subscription. It is only enabled if editing and here
+      // is no refetch logic, the response is used to set existing filters if they exist on the integration.
+      {
+        queryKey: ['integration'],
+        enabled: edit,
+        gcTime: 0,
+        placeholderData: keepPreviousData,
+        refetchInterval: false,
+        queryFn: () =>
+          integrationService
+            .fetchIntegration<IntegrationAwsRa>(integrationName)
+            .then(data => {
+              setFilters(
+                makeProfilesFilterOption(data.spec.profileSyncConfig.filters)
+              );
+              setInitialFilters(
+                makeProfilesFilterOption(data.spec.profileSyncConfig.filters)
+              );
+              return data;
+            }),
+      },
+      // The profiles endpoint is called immediately after creation. Because the integration may not yet be ready, we
+      // add refetchInterval which is set via intervalMs when we receive a 404 response. If a success or non-404
+      // response is received, retries will end.
+      {
+        queryKey: ['profiles', filters],
+        gcTime: 0,
+        placeholderData: keepPreviousData,
+        refetchInterval: intervalMs,
+        queryFn: () =>
+          integrationService
+            .awsRolesAnywhereProfiles({
+              integrationName: integrationName,
+              filters,
+            })
+            .then(data => {
+              setIntervalMs(false);
+              if (!initialComplete.current) {
+                setFoundProfiles(data.profiles && data?.profiles.length > 0);
+                initialComplete.current = true;
+              }
+
+              return data;
+            }),
+      },
+    ],
+  });
+
+  const [integrationResp, profilesResp] = results;
+  const { status: editStatus, error: editError } = integrationResp;
+  const { status, error, data, isFetching, refetch, isRefetching } =
+    profilesResp;
+
+  // Set retry logic for profiles not found errors
+  const isNotFoundErr =
+    error instanceof ApiError && error.response.status === 404;
+  if (error && !isNotFoundErr && intervalMs != false) {
+    // if the error returned is not a 404, stop the retry
+    setIntervalMs(false);
+  }
+
+  const update = useMutation({
+    mutationFn: () =>
+      integrationService
+        .updateIntegration(integrationName, {
+          kind: IntegrationKind.AwsRa,
+          awsRa: {
+            trustAnchorARN: trustAnchorArn,
+            profileSyncConfig: {
+              enabled: true, // must be true for enable step; otherwise profiles won't sync
+              profileArn: syncProfileArn,
+              roleArn: syncRoleArn,
+              filters: filters.length > 0 ? filters.map(f => f.value) : ['*'],
+            },
+          },
+        })
+        .then(data => data),
+    onSuccess: () => {
+      history.push(
+        cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa, 'next'),
+        { integrationName: integrationName }
+      );
+    },
+    onError: (e: ApiError) => {
+      // Set validity on invalid filter based on API error
+      const messages = e.messages.join(' ');
+      const next = filters.map(f => {
+        if (e.message.includes(f.value) || messages.includes(f.value)) {
+          return {
+            ...f,
+            invalid: true,
+          };
+        } else {
+          return f;
+        }
+      });
+
+      setFilters(next);
+    },
+  });
+
+  useEffect(() => {
+    // clear filters on syncAll
+    if (syncAll) {
+      setFilters([]);
+    }
+
+    // if editing, when clearing sync all reset to the initial filters
+    if (!syncAll && edit) {
+      setFilters(initialFilters);
+    }
+  }, [syncAll]);
+
+  if (!canEnroll) {
+    return (
+      <FeatureBox>
+        <Alert
+          kind="info"
+          mt={4}
+          secondaryAction={{
+            content: 'Back',
+            onClick: history.goBack,
+          }}
+        >
+          You do not have permission to enroll integrations. Missing role
+          permissions: <code>integrations.create</code>
+        </Alert>
+      </FeatureBox>
+    );
+  }
+
+  if (
+    integrationName === '' ||
+    trustAnchorArn === '' ||
+    syncProfileArn === '' ||
+    syncRoleArn === ''
+  ) {
+    return (
+      <FeatureBox>
+        <Alert
+          kind="info"
+          mt={4}
+          secondaryAction={{
+            content: 'Back',
+            onClick: history.goBack,
+          }}
+        >
+          Missing form data, please try again.
+        </Alert>
+      </FeatureBox>
+    );
+  }
+
+  if (editStatus === 'error' && editError) {
+    return (
+      <Alerts.Danger
+        details={editError.message}
+        secondaryAction={{
+          content: 'Back',
+          onClick: history.goBack,
+        }}
+      >
+        Unable to edit integration: {editError.name}
+      </Alerts.Danger>
+    );
+  }
+
+  return (
+    <>
+      <Flex mt={3} justifyContent="space-between" alignItems="center">
+        <H2>Configure Access</H2>
+        <InfoGuideButton
+          config={{
+            guide: <Guide />,
+          }}
+        />
+      </Flex>
+      <Box>
+        <P2 mb={3}>
+          Import and synchronize AWS IAM Roles Anywhere Profiles into Teleport.
+          Imported Profiles will be available as Resources with each Role
+          available as an account.
+        </P2>
+      </Box>
+      {!edit && status !== 'success' && intervalMs && (
+        <Alerts.Info details="It may take a moment for your integration to be ready before configuring access. This page will reload when ready.">
+          We&#39;re creating your integration
+        </Alerts.Info>
+      )}
+      {status === 'error' && !isNotFoundErr && (
+        <Alerts.Danger details={error.message}>
+          Error: {error.name}
+        </Alerts.Danger>
+      )}
+      {/* only show the indicator for the first fetch */}
+      {status === 'pending' && !initialComplete && (
+        <Box data-testid="loading" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      )}
+      {status === 'success' && !foundProfiles && <ProfilesEmptyState />}
+      {foundProfiles && (
+        <Profiles
+          data={data?.profiles}
+          fetchStatus={isFetching || isRefetching ? 'loading' : ''}
+          filters={filters}
+          setFilters={setFilters}
+          refetch={refetch}
+          syncAll={syncAll}
+          setSyncAll={setSyncAll}
+          isRefetching={isRefetching}
+        />
+      )}
+      {update.error && (
+        <Alerts.Danger details={update.error?.message} mt={2}>
+          Error: {update.error.name}
+        </Alerts.Danger>
+      )}
+      <Flex gap={3} mt={3}>
+        <ButtonPrimary
+          width="200px"
+          onClick={() => update.mutate()}
+          disabled={status !== 'success'}
+        >
+          {edit ? 'Update Sync' : 'Enable Sync'}
+        </ButtonPrimary>
+        {edit && (
+          <ButtonSecondary onClick={history.goBack} width="100px">
+            Cancel
+          </ButtonSecondary>
+        )}
+      </Flex>
+    </>
+  );
+}
+
+function ProfilesEmptyState() {
+  return (
+    <CardTile alignItems="center" gap={4}>
+      <ResourceIcon name="awsidentityandaccessmanagementiam" width="164px" />
+      <Flex flexDirection="column" alignItems="center">
+        <H3 mb={1}>No AWS IAM Roles Anywhere Profiles Found</H3>
+      </Flex>
+      <Flex gap={3}>
+        <ButtonPrimary
+          gap={2}
+          as="a"
+          target="blank"
+          href={rolesAnywhereCreateProfile}
+        >
+          Create AWS Profiles
+          <Icons.NewTab size="small" />
+        </ButtonPrimary>
+        <ButtonBorder intent="primary">Refresh AWS Profiles</ButtonBorder>
+      </Flex>
+    </CardTile>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Profiles.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Profiles.tsx
new file mode 100644
index 0000000000000..6f9b8e2052e42
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/Profiles.tsx
@@ -0,0 +1,115 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Dispatch, SetStateAction } from 'react';
+
+import { ButtonPrimary } from 'design/Button';
+import { CardTile } from 'design/CardTile';
+import { FetchingConfig } from 'design/DataTable/types';
+import Flex from 'design/Flex';
+import * as Icons from 'design/Icon';
+import { H3, P1, P2 } from 'design/Text';
+import { Toggle } from 'design/Toggle';
+import Validation from 'shared/components/Validation';
+
+import { rolesAnywhereCreateProfile } from 'teleport/Integrations/Enroll/awsLinks';
+import { RolesAnywhereProfile } from 'teleport/services/integrations';
+
+import { ProfilesFilter, ProfilesFilterOption } from './ProfilesFilter';
+import { ProfilesTable } from './ProfilesTable';
+
+export function Profiles({
+  data,
+  fetchStatus,
+  filters,
+  setFilters,
+  onFetchNext,
+  onFetchPrev,
+  refetch,
+  syncAll,
+  setSyncAll,
+  isRefetching,
+}: {
+  data: RolesAnywhereProfile[];
+  filters: ProfilesFilterOption[];
+  setFilters: Dispatch<SetStateAction<ProfilesFilterOption[]>>;
+  refetch: () => void;
+  syncAll: boolean;
+  setSyncAll: Dispatch<SetStateAction<boolean>>;
+  isRefetching: boolean;
+} & Omit<FetchingConfig, 'onFetchMore'>) {
+  return (
+    <Validation>
+      <CardTile backgroundColor="levels.elevated">
+        <Flex justifyContent="space-between">
+          <Flex flexDirection="column">
+            <H3>Sync IAM Profiles with Teleport as Resources</H3>
+            <P2>
+              You will be able to see the imported profiles on the Resources
+              Page
+            </P2>
+          </Flex>
+          <Flex alignItems="center" gap={3}>
+            <ButtonPrimary
+              disabled={isRefetching}
+              gap={2}
+              fill="minimal"
+              intent="neutral"
+              size="small"
+              onClick={refetch}
+              minWidth="100px"
+            >
+              <Icons.Refresh size="small" />
+              {isRefetching ? 'Refreshing' : 'Refresh'}
+            </ButtonPrimary>
+            <ButtonPrimary
+              gap={2}
+              intent="neutral"
+              size="small"
+              as="a"
+              target="blank"
+              href={rolesAnywhereCreateProfile}
+            >
+              Create AWS Profiles
+              <Icons.NewTab size="small" />
+            </ButtonPrimary>
+            <Flex gap={1}>
+              <Toggle
+                isToggled={syncAll}
+                onToggle={() => {
+                  setSyncAll(!syncAll);
+                }}
+                size="large"
+              />
+              <P1>Import All</P1>
+            </Flex>
+          </Flex>
+        </Flex>
+        {!syncAll && (
+          <ProfilesFilter filters={filters} setFilters={setFilters} />
+        )}
+        <ProfilesTable
+          data={data}
+          fetchStatus={fetchStatus}
+          onFetchNext={onFetchNext}
+          onFetchPrev={onFetchPrev}
+        />
+      </CardTile>
+    </Validation>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesFilter.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesFilter.tsx
new file mode 100644
index 0000000000000..a7979db8cabf8
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesFilter.tsx
@@ -0,0 +1,116 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Dispatch, SetStateAction } from 'react';
+import { components } from 'react-select';
+import { useTheme } from 'styled-components';
+
+import Box from 'design/Box';
+import Flex from 'design/Flex';
+import { P1 } from 'design/Text';
+import { Theme } from 'design/theme/themes/types';
+import { FieldSelectCreatable } from 'shared/components/FieldSelect';
+import { CustomSelectComponentProps, Option } from 'shared/components/Select';
+
+export type ProfilesFilterOption = Option & { invalid: boolean };
+
+export function ProfilesFilter({
+  filters,
+  setFilters,
+}: {
+  filters: ProfilesFilterOption[];
+  setFilters: Dispatch<SetStateAction<ProfilesFilterOption[]>>;
+}) {
+  const theme = useTheme();
+
+  return (
+    <Flex alignItems="center" gap={2}>
+      <Box width="540px">
+        <FieldSelectCreatable
+          ariaLabel={`input-profiles`}
+          autoFocus={true}
+          placeholder="* – Type a filter to restrict matches"
+          isMulti
+          isClearable
+          isSearchable
+          options={filters}
+          onChange={(o: ProfilesFilterOption[]) => setFilters(o)}
+          value={filters || []}
+          noOptionsMessage={() => null}
+          label="Filter by Profile Name"
+          helperText="Regex and glob supported. Defaults to all(*) if no filters are defined"
+          formatCreateLabel={userInput => `Apply filter: ${userInput}`}
+          stylesConfig={filterCreateCss(theme)}
+          components={{
+            MultiValueContainer,
+            Menu: () => null,
+            DropdownIndicator: () => null,
+          }}
+          customProps={{
+            lastFilter:
+              filters?.length > 1 ? filters[filters.length - 1].value : '',
+          }}
+        />
+      </Box>
+    </Flex>
+  );
+}
+
+const filterCreateCss = (theme: Theme) => ({
+  multiValue: (base, state) => {
+    const errorState = state.data.invalid
+      ? { border: `1px solid ${theme.colors.interactive.solid.danger.default}` }
+      : undefined;
+
+    return {
+      ...base,
+      ...errorState,
+    };
+  },
+});
+
+const MultiValueContainer = (
+  props: CustomSelectComponentProps<{ lastFilter: string }, Option>
+) => {
+  const lastFilter = props.selectProps.customProps.lastFilter;
+  const currFilter = props.data.value;
+
+  const isLastFilter = lastFilter === currFilter;
+  return (
+    <>
+      <components.MultiValueContainer {...props} />
+      {lastFilter && !isLastFilter && <P1 fontSize={0}>OR</P1>}
+    </>
+  );
+};
+
+export function makeProfilesFilterOption(
+  filters: string[]
+): ProfilesFilterOption[] {
+  if (!filters || filters?.length === 0) {
+    return [];
+  }
+
+  return filters.map(f => {
+    return {
+      value: f,
+      label: f,
+      invalid: false,
+    };
+  });
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesTable.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesTable.tsx
new file mode 100644
index 0000000000000..18c1cb6ba96f2
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Access/ProfilesTable.tsx
@@ -0,0 +1,165 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import Table, { Cell, LabelCell } from 'design/DataTable';
+import { ClientSidePager } from 'design/DataTable/Pager';
+import { StyledTable } from 'design/DataTable/StyledTable';
+import { FetchingConfig, PagedTableProps } from 'design/DataTable/types';
+import Flex from 'design/Flex';
+import * as Icons from 'design/Icon';
+import { Check } from 'design/Icon';
+import { P2 } from 'design/Text';
+
+import { RolesAnywhereProfile } from 'teleport/services/integrations';
+
+export function ProfilesTable({
+  data,
+  fetchStatus,
+  onFetchNext,
+  onFetchPrev,
+}: {
+  data: RolesAnywhereProfile[];
+} & Omit<FetchingConfig, 'onFetchMore'>) {
+  return (
+    <Table
+      data={data}
+      columns={[
+        {
+          altKey: 'selected',
+          headerText: '',
+          render: row =>
+            data?.includes(row) ? (
+              <Cell width="50px">
+                <Check size="small" color="success.main" />
+              </Cell>
+            ) : (
+              <Cell width="50px" />
+            ),
+        },
+        {
+          key: 'name',
+          headerText: 'Profile Name',
+        },
+        {
+          key: 'tags',
+          headerText: 'Tags',
+          render: row => <LabelCell data={row.tags} />,
+        },
+        {
+          key: 'roles',
+          headerText: 'IAM Roles',
+          render: row => <Cell>{row?.roles?.join(', ')}</Cell>,
+        },
+      ]}
+      emptyText={fetchStatus === 'loading' ? 'Refreshing' : 'No Profiles Found'}
+      pagination={{ pageSize: 20, CustomTable }}
+      fetching={{
+        fetchStatus,
+        onFetchNext,
+        onFetchPrev,
+        disableLoadingIndicator: true,
+      }}
+    />
+  );
+}
+
+function CustomTable<T>({
+  nextPage,
+  prevPage,
+  data,
+  pagination,
+  renderHeaders,
+  renderBody,
+}: PagedTableProps<T>) {
+  const { paginatedData, currentPage } = pagination;
+
+  return (
+    <>
+      <TableWrapper>
+        <CustomerStyledTable>
+          {renderHeaders()}
+          {renderBody(paginatedData[currentPage])}
+        </CustomerStyledTable>
+      </TableWrapper>
+      <Flex justifyContent="space-between" alignItems="center">
+        <Flex gap={1}>
+          <Icons.Info color="text.muted" />
+          <P2 color="text.muted">
+            New and matching AWS Roles Anywhere Profiles created in the AWS
+            Console will be automatically synced with Teleport.
+          </P2>
+        </Flex>
+        <Flex>
+          <ClientSidePager
+            nextPage={nextPage}
+            prevPage={prevPage}
+            data={data}
+            {...pagination}
+          />
+        </Flex>
+      </Flex>
+    </>
+  );
+}
+
+const TableWrapper = styled.div(
+  props => `
+      border-bottom: 1px solid ${props.theme.colors.interactive.tonal.neutral[0]};
+      overflow-y: auto;
+      max-height: 330px;
+`
+);
+
+const CustomerStyledTable = styled(StyledTable)(
+  props => `
+
+   background-color: inherit;
+   border-collapse: separate;
+
+  tbody > tr > td, thead > tr > th {
+    font-size: ${props.theme.fontSizes[2]}px;
+    font-weight: 300;
+  }
+
+  thead > tr > th {
+    font-weight: bold;
+    border-bottom: 1px solid ${props.theme.colors.interactive.tonal.neutral[0]};
+    text-transform: none;
+    padding: ${props.theme.space[2]}px 0;
+    top: 0;
+    position: sticky;
+    z-index: 1;
+    background-color: ${props.theme.colors.levels.elevated};
+    opacity: 1;
+  }
+
+  tbody > tr > td {
+    padding: ${props.theme.space[3]}px 0;
+  }
+
+  tbody > tr {
+    background-color: ${props.theme.colors.levels.surface};
+    border: none;
+    
+    transition: all 150ms;
+    position: relative;
+  }
+`
+);
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/AwsRolesAnywhereSetup.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/AwsRolesAnywhereSetup.tsx
new file mode 100644
index 0000000000000..5c534f9394853
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/AwsRolesAnywhereSetup.tsx
@@ -0,0 +1,159 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { useMemo } from 'react';
+import { useHistory } from 'react-router';
+
+import { Alert, Box, Flex } from 'design';
+
+import { EmptyState } from 'teleport/Bots/List/EmptyState/EmptyState';
+import { FeatureBox } from 'teleport/components/Layout';
+import { Route, Switch, useParams } from 'teleport/components/Router';
+import { addIndexToViews } from 'teleport/components/Wizard/flow';
+import { Navigation } from 'teleport/components/Wizard/Navigation';
+import cfg from 'teleport/config';
+import { Finished } from 'teleport/Discover/Shared';
+import { IntegrationIcon } from 'teleport/Integrations/Enroll';
+import { Access } from 'teleport/Integrations/Enroll/AwsConsole/Access/Access';
+import { IamIntegration } from 'teleport/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration';
+import { IntegrationKind } from 'teleport/services/integrations';
+import useTeleport from 'teleport/useTeleport';
+
+export const AwsRolesAnywhereSetup = () => {
+  const { subPage } = useParams<{ subPage?: string }>();
+  const ctx = useTeleport();
+  const history = useHistory();
+  const integrationsAccess = ctx.storeUser.getIntegrationsAccess();
+  const canEnroll = integrationsAccess.create;
+
+  const navigationViews = useMemo(
+    () =>
+      addIndexToViews(
+        Object.values(integrationLevels).map(l => ({
+          title: l.shortName,
+          component: null,
+        }))
+      ),
+    []
+  );
+
+  if (!canEnroll) {
+    return (
+      <FeatureBox>
+        <Alert kind="info" mt={4}>
+          You do not have permission to enroll integrations. Missing role
+          permissions: <code>integrations.create</code>
+        </Alert>
+        <EmptyState />
+      </FeatureBox>
+    );
+  }
+
+  return (
+    <>
+      <Box my={4}>
+        <Navigation
+          currentStep={(integrationLevels[subPage]?.level ?? 0) - 1}
+          views={navigationViews}
+          startWithIcon={{
+            title: 'AWS CLI/Console Access',
+            component: <IntegrationIcon size={16} name="aws" />,
+          }}
+        />
+      </Box>
+      <Flex flexDirection="column">
+        <Switch>
+          <Route
+            exact
+            key={IntegrationLevel.Access}
+            path={cfg.getIntegrationEnrollRoute(
+              IntegrationKind.AwsRa,
+              IntegrationLevel.Access
+            )}
+            component={Access}
+          />
+          <Route
+            exact
+            key={IntegrationLevel.Next}
+            path={cfg.getIntegrationEnrollRoute(
+              IntegrationKind.AwsRa,
+              IntegrationLevel.Next
+            )}
+            component={(props: {
+              location: { state: { integrationName: string } };
+            }) => {
+              return (
+                <Finished
+                  title="AWS IAM Roles Anywhere Profiles Successfully Imported"
+                  resourceText="AWS IAM Roles Anywhere Profiles will be imported soon and available in the Resources page."
+                  primaryButtonText="Go To Resources"
+                  primaryButtonAction={() =>
+                    history.push(
+                      `${cfg.getUnifiedResourcesRoute(cfg.proxyCluster)}?kinds=app&query=search("arn:aws:rolesanywhere")`,
+                      { kind: 'app' }
+                    )
+                  }
+                  secondaryButtonText="View Integration"
+                  secondaryButtonAction={() =>
+                    history.push(
+                      cfg.getIntegrationStatusRoute(
+                        IntegrationKind.AwsRa,
+                        props.location.state.integrationName
+                      )
+                    )
+                  }
+                />
+              );
+            }}
+          />
+          <Route>
+            <IamIntegration />
+          </Route>
+        </Switch>
+      </Flex>
+    </>
+  );
+};
+
+enum IntegrationLevel {
+  Integration = 'integration',
+  Access = 'access',
+  Next = 'next',
+}
+
+export const integrationLevels = {
+  [IntegrationLevel.Integration]: {
+    level: 1,
+    name: 'Create IAM Roles Anywhere Integration',
+    shortName: 'Create IAM Roles Anywhere Integration',
+    completeCopy: {},
+    bullets: [],
+  },
+  [IntegrationLevel.Access]: {
+    level: 2,
+    name: 'Configure Access',
+    shortName: 'Configure Access',
+    completeCopy: {},
+    bullets: [],
+  },
+  [IntegrationLevel.Next]: {
+    level: 3,
+    name: 'Next Steps',
+    shortName: 'Next Steps',
+    bullets: [],
+  },
+} as const;
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Guide.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Guide.tsx
new file mode 100644
index 0000000000000..cd689d18d2f53
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/Guide.tsx
@@ -0,0 +1,75 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { Box } from 'design';
+import {
+  InfoExternalTextLink,
+  InfoParagraph,
+  InfoTitle,
+  ReferenceLinks,
+} from 'shared/components/SlidingSidePanel/InfoGuide';
+
+const GuideReferenceLinks = {
+  AwsRolesAnywhere: {
+    title: 'AWS Roles Anywhere',
+    href: 'https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html',
+  },
+  TeleportSetUp: {
+    title: 'Teleport AWS Console and CLI access: Set up access',
+    href: 'https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/aws-console-roles-anywhere/#step-34-set-up-access',
+  },
+};
+
+export const Guide = () => (
+  <Box>
+    <InfoTitle>How to Access Profiles as Resources</InfoTitle>
+    <InfoParagraph>
+      Teleport will periodically sync Roles Anywhere Profiles as AWS Access
+      applications. You can create Roles which allow access to multiple Profiles
+      and IAM Roles, and use them to grant AWS access to Teleport users.
+    </InfoParagraph>
+    <InfoParagraph>
+      Refer to the{' '}
+      <InfoExternalTextLink
+        target="_blank"
+        href={GuideReferenceLinks.TeleportSetUp.href}
+      >
+        AWS Console and CLI access documentation
+      </InfoExternalTextLink>{' '}
+      to configure access to Roles Anywhere profiles.
+    </InfoParagraph>
+    <ReferenceLinks links={Object.values(GuideReferenceLinks)} />
+  </Box>
+);
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.story.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.story.tsx
new file mode 100644
index 0000000000000..d936b70c8fc5e
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.story.tsx
@@ -0,0 +1,148 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { MemoryRouter } from 'react-router';
+
+import { Info } from 'design/Alert';
+import { CollapsibleInfoSection as CollapsibleInfoSectionComponent } from 'design/CollapsibleInfoSection';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { IamIntegration } from 'teleport/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+
+export default {
+  title: 'Teleport/Integrations/Enroll/AwsConsole/IamIntegration',
+};
+
+const ctx = createTeleportContext();
+
+export const Loaded = () => (
+  <ContextProvider ctx={ctx}>
+    <InfoGuidePanelProvider>
+      <MemoryRouter>
+        <CollapsibleInfoSectionComponent openLabel="Devs Instructions">
+          <Info
+            kind="success"
+            details="(Devs) step 1: use test as the integration name"
+          >
+            Case: Profiles
+          </Info>
+          <Info
+            kind="warning"
+            details="(Devs) step 1: use zero as the integration name"
+          >
+            Case: No Profiles
+          </Info>
+          <Info
+            kind="danger"
+            details="(Devs) step 1: use error as the integration name"
+          >
+            Case: Test error
+          </Info>
+          <Info
+            kind="info"
+            details={`(Devs) use any valid CloudShell output and click submit to see a success message, for instance:
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/bar
+arn:aws:iam::123456789012:role/baz`}
+          >
+            Step 3
+          </Info>
+        </CollapsibleInfoSectionComponent>
+        <IamIntegration />
+      </MemoryRouter>
+    </InfoGuidePanelProvider>
+  </ContextProvider>
+);
+Loaded.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.getValidateAWSRolesAnywhereIntegrationUrl('test'), () => {
+        return HttpResponse.json({});
+      }),
+      http.post(cfg.getValidateAWSRolesAnywhereIntegrationUrl('zero'), () => {
+        return HttpResponse.json({});
+      }),
+      http.post(cfg.getValidateAWSRolesAnywhereIntegrationUrl('error'), () => {
+        return HttpResponse.json({});
+      }),
+      http.post(
+        cfg.getValidateAWSRolesAnywhereIntegrationUrl('duplicate'),
+        () => {
+          return HttpResponse.json(
+            {
+              message: 'Integration name already exists',
+            },
+            { status: 400 }
+          );
+        }
+      ),
+      http.post(cfg.getAwsRolesAnywherePingUrl('test'), () => {
+        return HttpResponse.json({
+          profileCount: 3,
+          accountID: 'fc2ef183-2ac0-4836-9d7d-ff873c99e733',
+          arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+          userId: 'edd13a04-9956-4ef2-9ef5-7b0169e1cd5b',
+        });
+      }),
+      http.post(cfg.getAwsRolesAnywherePingUrl('zero'), () => {
+        return HttpResponse.json({
+          profileCount: 0,
+          accountID: 'fc2ef183-2ac0-4836-9d7d-ff873c99e733',
+          arn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+          userId: 'edd13a04-9956-4ef2-9ef5-7b0169e1cd5b',
+        });
+      }),
+      http.post(cfg.getAwsRolesAnywherePingUrl('error'), () => {
+        return HttpResponse.json(
+          {
+            message: 'some error message',
+          },
+          { status: 500 }
+        );
+      }),
+      http.post(cfg.getIntegrationsUrl(), () => {
+        return HttpResponse.json({ status: 200 });
+      }),
+    ],
+  },
+};
+
+export const WithoutAccess = () => {
+  const noCtx = createTeleportContext({
+    customAcl: makeAcl({
+      integrations: {
+        ...defaultAccess,
+      },
+    }),
+  });
+
+  return (
+    <ContextProvider ctx={noCtx}>
+      <InfoGuidePanelProvider>
+        <MemoryRouter>
+          <IamIntegration />
+        </MemoryRouter>
+      </InfoGuidePanelProvider>
+    </ContextProvider>
+  );
+};
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.test.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.test.tsx
new file mode 100644
index 0000000000000..96fe3285ba165
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.test.tsx
@@ -0,0 +1,280 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { screen } from '@testing-library/react';
+
+import { fireEvent, render, waitFor } from 'design/utils/testing';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { ContextProvider } from 'teleport/index';
+import {
+  IamIntegration,
+  parseOutput,
+} from 'teleport/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { integrationService } from 'teleport/services/integrations';
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+    },
+  },
+});
+
+jest.mock('react-router', () => ({
+  ...jest.requireActual('react-router'),
+  useHistory: () => ({
+    goBack: jest.fn(),
+    push: jest.fn(),
+  }),
+}));
+
+beforeEach(() => {
+  jest
+    .spyOn(integrationService, 'createIntegration')
+    .mockResolvedValue({} as any);
+  jest
+    .spyOn(integrationService, 'validateAWSRolesAnywhereIntegration')
+    .mockResolvedValue({} as any);
+  jest
+    .spyOn(integrationService, 'awsRolesAnywherePing')
+    .mockResolvedValue({} as any);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+test('flows through roles anywhere IAM setup', async () => {
+  render(
+    <ContextProvider ctx={createTeleportContext()}>
+      <InfoGuidePanelProvider>
+        <QueryClientProvider client={queryClient}>
+          <IamIntegration />
+        </QueryClientProvider>
+      </InfoGuidePanelProvider>
+    </ContextProvider>
+  );
+
+  expect(
+    screen.getByText('Step 1: Name your Teleport Integration')
+  ).toBeInTheDocument();
+  expect(
+    screen.queryByText('Step 2: Create Roles Anywhere Trust Anchor')
+  ).not.toBeInTheDocument();
+  expect(
+    screen.getByRole('button', { name: 'Next: Configure Access' })
+  ).toBeDisabled();
+
+  fireEvent.click(screen.getByRole('button', { name: 'Generate Command' }));
+  expect(screen.getByText('Integration name is required')).toBeInTheDocument();
+
+  fireEvent.change(screen.getByLabelText('Integration Name'), {
+    target: { value: 'invalid(((***' },
+  });
+
+  fireEvent.click(
+    screen.getByRole('button', {
+      name: 'Optionally edit resource names that will be created in AWS',
+    })
+  );
+  expect(
+    screen.getByText('Edit resource names that will be created in AWS')
+  ).toBeInTheDocument();
+  expect(
+    screen.getByText('IAM Roles Anywhere Trust Anchor Name')
+  ).toBeInTheDocument();
+  fireEvent.change(
+    screen.getByLabelText('IAM Roles Anywhere Trust Anchor Name'),
+    {
+      target: { value: 'invalid(((***' },
+    }
+  );
+  fireEvent.change(
+    screen.getByLabelText('IAM Role Name (used for profile synchronization)'),
+    {
+      target: { value: 'invalid(((***' },
+    }
+  );
+  fireEvent.change(
+    screen.getByLabelText(
+      'IAM Roles Anywhere Profile Name (used for profile synchronization)'
+    ),
+    {
+      target: { value: 'invalid(((***' },
+    }
+  );
+  fireEvent.click(screen.getByRole('button', { name: 'Generate Command' }));
+  expect(
+    screen.getByText('Name must be a lower case valid DNS subdomain')
+  ).toBeInTheDocument();
+  expect(screen.getAllByText(/Name can only contain characters/i)).toHaveLength(
+    3
+  );
+
+  fireEvent.change(screen.getByLabelText('Integration Name'), {
+    target: { value: 'some-integration-name' },
+  });
+  fireEvent.change(
+    screen.getByLabelText('IAM Roles Anywhere Trust Anchor Name'),
+    {
+      target: { value: 'teleport-aws-roles-anywhere-trust-anchor' },
+    }
+  );
+  fireEvent.change(
+    screen.getByLabelText('IAM Role Name (used for profile synchronization)'),
+    {
+      target: { value: 'teleport-aws-roles-anywhere-role' },
+    }
+  );
+  fireEvent.change(
+    screen.getByLabelText(
+      'IAM Roles Anywhere Profile Name (used for profile synchronization)'
+    ),
+    {
+      target: { value: 'teleport-aws-roles-anywhere-profile' },
+    }
+  );
+  fireEvent.click(screen.getByRole('button', { name: 'Generate Command' }));
+
+  await waitFor(() =>
+    screen.findByText('Step 2: Create Roles Anywhere Trust Anchor')
+  );
+  expect(
+    screen.getByText('Step 3: Create and Sync the Integration Profile and Role')
+  ).toBeInTheDocument();
+  expect(
+    screen.getByRole('button', { name: 'Test Configuration' })
+  ).toBeDisabled();
+  expect(
+    screen.getByRole('button', { name: 'Next: Configure Access' })
+  ).toBeDisabled();
+
+  fireEvent.change(
+    screen.getByLabelText('Trust Anchor, Profile and Role ARNs'),
+    {
+      target: {
+        value:
+          'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo\n' +
+          'arn:aws:rolesanywhere:eu-west-2:123456789012:profile/bar\n' +
+          'arn:aws:iam::123456789012:role/baz',
+      },
+    }
+  );
+
+  expect(
+    screen.getByRole('button', { name: 'Test Configuration' })
+  ).toBeEnabled();
+  fireEvent.click(screen.getByRole('button', { name: 'Test Configuration' }));
+  await waitFor(() =>
+    expect(integrationService.awsRolesAnywherePing).toHaveBeenCalledTimes(1)
+  );
+  expect(integrationService.awsRolesAnywherePing).toHaveBeenCalledWith({
+    integrationName: 'some-integration-name',
+    syncProfileArn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:profile/bar',
+    syncRoleArn: 'arn:aws:iam::123456789012:role/baz',
+    trustAnchorArn:
+      'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+  });
+
+  expect(
+    screen.getByRole('button', { name: 'Next: Configure Access' })
+  ).toBeEnabled();
+  fireEvent.click(
+    screen.getByRole('button', { name: 'Next: Configure Access' })
+  );
+  await waitFor(() =>
+    expect(integrationService.createIntegration).toHaveBeenCalledTimes(1)
+  );
+  expect(integrationService.createIntegration).toHaveBeenCalledWith({
+    name: 'some-integration-name',
+    subKind: 'aws-ra',
+    kind: 'aws-ra',
+    awsRa: {
+      trustAnchorARN:
+        'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+      profileSyncConfig: {
+        enabled: false,
+        profileArn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:profile/bar',
+        filters: [],
+        roleArn: 'arn:aws:iam::123456789012:role/baz',
+      },
+    },
+  });
+});
+
+describe('parseOutput', () => {
+  const excess = `
+  4. Create a Roles Anywhere Profile in AWS IAM for your Teleport cluster.
+CreateRolesAnywhereProfileProvider: {
+    "Name": "RAProfileFromCLI",
+    "RoleArns": [
+        "arn:aws:iam::123456789012:role/ra-role"
+    ],
+
+Copy and paste the following values to Teleport UI
+
+=================================================
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/ra-role
+=================================================
+
+2025-05-15T16:30:21.683+01:00 INFO  Success! operation:awsra-trust-anchor provisioning/operations.go:190
+`;
+  const topExcess = `
+
+=================================================
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/ra-role
+`;
+  const bottomExcess = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/ra-role
+=================================================
+`;
+  const perfect = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/ra-role
+`;
+  const empty = '';
+
+  const valid = {
+    trustAnchorArn:
+      'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000',
+    syncProfileArn:
+      'arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000',
+    syncRoleArn: 'arn:aws:iam::123456789012:role/ra-role',
+  };
+
+  test.each`
+    name                          | input           | expected
+    ${'valid excess copy'}        | ${excess}       | ${valid}
+    ${'valid excess top copy'}    | ${topExcess}    | ${valid}
+    ${'valid excess bottom copy'} | ${bottomExcess} | ${valid}
+    ${'valid perfect copy'}       | ${perfect}      | ${valid}
+    ${'invalid empty'}            | ${empty}        | ${undefined}
+  `(`parseOutput $name`, ({ input, expected }) => {
+    const values = parseOutput(input);
+    expect(values).toEqual(expected);
+  });
+});
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.tsx
new file mode 100644
index 0000000000000..d5faa1f8e41ce
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/IamIntegration/IamIntegration.tsx
@@ -0,0 +1,532 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMutation } from '@tanstack/react-query';
+import { ChangeEvent, ReactNode, useMemo, useState } from 'react';
+import { useHistory } from 'react-router';
+
+import {
+  Alert,
+  Box,
+  ButtonPrimary,
+  ButtonSecondary,
+  CardTile,
+  Flex,
+  H2,
+  H3,
+  Link,
+  Subtitle2,
+} from 'design';
+import * as Alerts from 'design/Alert';
+import { Danger } from 'design/Alert';
+import { CollapsibleInfoSection } from 'design/CollapsibleInfoSection';
+import { Info, NewTab } from 'design/Icon';
+import { IconTooltip } from 'design/Tooltip';
+import FieldInput from 'shared/components/FieldInput';
+import { FieldTextArea } from 'shared/components/FieldTextArea';
+import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide';
+import { TextSelectCopyMulti } from 'shared/components/TextSelectCopy';
+import Validation, { Validator } from 'shared/components/Validation';
+import {
+  requiredIamProfileName,
+  requiredIamRoleName,
+  requiredIamTrustAnchorName,
+  requiredIntegrationName,
+} from 'shared/components/Validation/rules';
+
+import { FeatureBox } from 'teleport/components/Layout';
+import cfg from 'teleport/config';
+import { Guide } from 'teleport/Integrations/Enroll/AwsConsole/Guide';
+import { validTrustAnchorInput } from 'teleport/Integrations/Enroll/AwsConsole/rules';
+import {
+  cloudShell,
+  rolesAnywhere,
+} from 'teleport/Integrations/Enroll/awsLinks';
+import {
+  AwsRolesAnywherePingResponse,
+  IntegrationKind,
+  integrationService,
+} from 'teleport/services/integrations';
+import useTeleport from 'teleport/useTeleport';
+
+enum Phase {
+  One, // enable step one
+  Two, // enable step two & three
+  Three, // step three is verified, enable proceed button
+}
+
+export function IamIntegration() {
+  const ctx = useTeleport();
+  const integrationsAccess = ctx.storeUser.getIntegrationsAccess();
+  const canEnroll = integrationsAccess.create;
+
+  const history = useHistory();
+  const [phase, setPhase] = useState(Phase.One);
+  const [alert, setAlert] = useState<ReactNode>();
+  const [scriptUrl, setScriptUrl] = useState<string>();
+  const [sync, setSync] = useState<string>();
+  const [output, setOutput] = useState<{
+    trustAnchorArn: string;
+    syncRoleArn: string;
+    syncProfileArn: string;
+  }>();
+
+  const [formState, setFormState] = useState({
+    // integrationName: the name of the AWS IAM Roles Anywhere Integration
+    // required by user, no default
+    integrationName: '',
+    // trustAnchor: the name of the Trust Anchor to be created
+    trustAnchorName: 'teleport-aws-roles-anywhere-trust-anchor',
+    // syncRole: the name of the IAM Role to be created
+    syncProfileName: 'teleport-aws-roles-anywhere-profile',
+    // syncProfile: the name of the IAM Roles Anywhere Profile to be created
+    syncRoleName: 'teleport-aws-roles-anywhere-role',
+  });
+
+  const create = useMutation({
+    mutationFn: () =>
+      integrationService
+        .createIntegration({
+          name: formState.integrationName,
+          kind: IntegrationKind.AwsRa,
+          subKind: IntegrationKind.AwsRa,
+          awsRa: {
+            trustAnchorARN: output.trustAnchorArn,
+            profileSyncConfig: {
+              enabled: false, // must be false for creation; otherwise profiles will sync before configuration on the next page
+              profileArn: output.syncProfileArn,
+              roleArn: output.syncRoleArn,
+              filters: [], // will be added in configuration step
+            },
+          },
+        })
+        .then(data => data),
+    onSuccess: () => {
+      history.push(
+        cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa, 'access'),
+        {
+          integrationName: formState.integrationName,
+          trustAnchorArn: output.trustAnchorArn,
+          syncProfileArn: output.syncProfileArn,
+          syncRoleArn: output.syncRoleArn,
+        }
+      );
+    },
+  });
+
+  const validateName = useMutation({
+    mutationFn: () =>
+      integrationService
+        .validateAWSRolesAnywhereIntegration(formState.integrationName)
+        .then(data => data),
+    onSuccess: () => {
+      setScriptUrl(
+        cfg.getAwsRolesAnywhereGenerateUrl(
+          formState.integrationName,
+          formState.trustAnchorName,
+          formState.syncRoleName,
+          formState.syncProfileName
+        )
+      );
+      setPhase(Phase.Two);
+    },
+  });
+
+  function generateCommand(validator: Validator) {
+    if (!validator.validate()) {
+      return;
+    }
+    validateName.mutate();
+  }
+
+  const manageAction = {
+    content: (
+      <>
+        Manage AWS Roles Anywhere Profiles{' '}
+        <NewTab size={18} ml={2} style={{ lineHeight: '22px' }} />
+      </>
+    ),
+    href: rolesAnywhere,
+  };
+
+  const testCfg = useMutation({
+    mutationFn: () => {
+      const inputs = parseOutput(sync);
+      // set output for final redirect
+      setOutput({
+        trustAnchorArn: inputs.trustAnchorArn,
+        syncProfileArn: inputs.syncProfileArn,
+        syncRoleArn: inputs.syncRoleArn,
+      });
+      return integrationService.awsRolesAnywherePing({
+        integrationName: formState.integrationName,
+        trustAnchorArn: inputs.trustAnchorArn,
+        syncRoleArn: inputs.syncRoleArn,
+        syncProfileArn: inputs.syncProfileArn,
+      });
+    },
+    onError: error => {
+      setAlert(
+        <Alert kind="danger" details={error.message}>
+          Error: {error.name}
+        </Alert>
+      );
+    },
+    onSuccess: (response: AwsRolesAnywherePingResponse) => {
+      if (response.profileCount > 0) {
+        setAlert(
+          <Alert kind="success" secondaryAction={manageAction}>
+            Success! AWS IAM Roles Anywhere Profiles found
+          </Alert>
+        );
+      } else {
+        setAlert(
+          <Alert
+            kind="warning"
+            secondaryAction={manageAction}
+            details={
+              'Create your first Profile to start accessing AWS from Teleport.'
+            }
+          >
+            Teleport didn&#39;t find any Profiles
+          </Alert>
+        );
+      }
+
+      setPhase(Phase.Three);
+    },
+  });
+
+  const validInput = useMemo(() => {
+    return validTrustAnchorInput(sync)().valid;
+  }, [sync]);
+
+  if (!canEnroll) {
+    return (
+      <FeatureBox>
+        <Alert kind="info" mt={4}>
+          You do not have permission to enroll integrations. Missing role
+          permissions: <code>integrations.create</code>
+        </Alert>
+      </FeatureBox>
+    );
+  }
+
+  return (
+    <>
+      <Flex mt={3} justifyContent="space-between" alignItems="center">
+        <H2>AWS CLI / Console Access</H2>
+        <InfoGuideButton
+          config={{
+            guide: <Guide />,
+          }}
+        />
+      </Flex>
+      <Box>
+        Compatible with any CLI and AWS SDK-based tooling (such as Terraform and
+        AWS CLI). Teleport uses <strong>AWS IAM Roles Anywhere</strong> to
+        manage access and allows you to configure the right permissions for your
+        users.
+        <br />
+        Follow the below steps to create a Roles Anywhere Trust Anchor and
+        configure the required IAM Roles for synchronizing Profiles as Teleport
+        resources.
+      </Box>
+      <Alert
+        kind="neutral"
+        icon={Info}
+        mt={5}
+        secondaryAction={manageAction}
+        details={
+          'Create AWS Profiles and assign Roles to them in your AWS account. Teleport will allow you to import these Profiles as Resources.'
+        }
+      >
+        Prerequisites
+      </Alert>
+      <Validation>
+        {({ validator }) => (
+          <Flex flexDirection="column" gap={3}>
+            <CardTile>
+              <Flex flexDirection="column">
+                <H2>Step 1: Name your Teleport Integration</H2>
+                <Subtitle2>Give this integration a name.</Subtitle2>
+              </Flex>
+              <Flex flexDirection="column" gap={1} maxWidth={500}>
+                <FieldInput
+                  label="Integration Name"
+                  placeholder="teleport-aws-prod"
+                  rule={requiredIntegrationName}
+                  value={formState.integrationName}
+                  onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                    return setFormState(prev => ({
+                      ...prev,
+                      integrationName: e.target.value.trim(),
+                    }));
+                  }}
+                />
+              </Flex>
+              <CollapsibleInfoSection
+                openLabel="Optionally edit resource names that will be created in AWS"
+                closeLabel="Edit resource names that will be created in AWS"
+              >
+                <Flex flexDirection="column" gap={1} maxWidth={500}>
+                  <FieldInput
+                    label="IAM Roles Anywhere Trust Anchor Name"
+                    placeholder=""
+                    rule={requiredIamTrustAnchorName}
+                    value={formState.trustAnchorName}
+                    onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                      return setFormState(prev => ({
+                        ...prev,
+                        trustAnchorName: e.target.value,
+                      }));
+                    }}
+                  />
+                  <FieldInput
+                    label="IAM Role Name (used for profile synchronization)"
+                    placeholder=""
+                    rule={requiredIamRoleName}
+                    value={formState.syncRoleName}
+                    onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                      return setFormState(prev => ({
+                        ...prev,
+                        syncRoleName: e.target.value.trim(),
+                      }));
+                    }}
+                  />
+                  <FieldInput
+                    label="IAM Roles Anywhere Profile Name (used for profile synchronization)"
+                    placeholder=""
+                    rule={requiredIamProfileName}
+                    value={formState.syncProfileName}
+                    onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                      return setFormState(prev => ({
+                        ...prev,
+                        syncProfileName: e.target.value,
+                      }));
+                    }}
+                  />
+                </Flex>
+              </CollapsibleInfoSection>
+              {validateName.status === 'error' && validateName.error && (
+                <Danger details={validateName.error.message}>
+                  Error: {validateName.error.name}
+                </Danger>
+              )}
+              {phase === Phase.One ? (
+                <ButtonPrimary
+                  disabled={
+                    create.status == 'pending' ||
+                    validateName.status == 'pending' ||
+                    testCfg.status == 'pending'
+                  }
+                  width="200px"
+                  onClick={() => generateCommand(validator)}
+                >
+                  Generate Command
+                </ButtonPrimary>
+              ) : (
+                <ButtonSecondary
+                  disabled={
+                    create.status == 'pending' ||
+                    validateName.status == 'pending' ||
+                    testCfg.status == 'pending'
+                  }
+                  width="200px"
+                  onClick={() => generateCommand(validator)}
+                >
+                  Generate Command
+                </ButtonSecondary>
+              )}
+            </CardTile>
+            {phase !== Phase.One && (
+              <>
+                <CardTile>
+                  <Flex flexDirection="column">
+                    <Flex gap={1} alignItems="center">
+                      <H2>Step 2: Create Roles Anywhere Trust Anchor</H2>
+                      <IconTooltip sticky={true} maxWidth={800}>
+                        <H3 mb={2}>
+                          Running the command in AWS CloudShell does the
+                          following:
+                        </H3>
+                        <ol>
+                          <li>
+                            Configures a new IAM Roles Anywhere which trusts
+                            your Teleport Cluster.
+                          </li>
+                          <li>Configures an IAM Role named {`<xyz>`} that:</li>
+                          <ul>
+                            <li>
+                              Can be used by the AWS IAM Roles Anywhere Trust
+                              Anchor created above
+                            </li>
+                            <li>Allows the usage of the following APIs:</li>
+                            <ul>
+                              <li>rolesanywhere:ListProfiles</li>
+                              <li>rolesanywhere:ListTagsForResource</li>
+                              <li>rolesanywhere:ImportCrl</li>
+                              <li>iam:GetRole</li>
+                            </ul>
+                          </ul>
+                          <li>
+                            Creates a new IAM Roles Anywhere Profile which can
+                            use the Role above
+                          </li>
+                        </ol>
+                      </IconTooltip>
+                    </Flex>
+                    <Subtitle2>
+                      Open{' '}
+                      <Link href={cloudShell} target="_blank">
+                        AWS CloudShell
+                      </Link>{' '}
+                      and copy and paste the command below. Upon executing in
+                      the AWS Shell the command will download and execute
+                      Teleport binary that configures Teleport as a IAM Roles
+                      Anywhere trusted entity. After running the script, copy
+                      the output and paste it in the field below.
+                    </Subtitle2>
+                  </Flex>
+                  <Box mb={2} mt={3}>
+                    <TextSelectCopyMulti
+                      lines={[
+                        {
+                          text: `bash -c "$(curl '${scriptUrl}')"`,
+                        },
+                      ]}
+                    />
+                  </Box>
+                </CardTile>
+                <CardTile>
+                  <Flex flexDirection="column">
+                    <H2>
+                      Step 3: Create and Sync the Integration Profile and Role
+                    </H2>
+                    <Subtitle2>
+                      Once the script above completes, copy and paste its output
+                      below.
+                    </Subtitle2>
+                    <Subtitle2>
+                      You can run the script again if you’ve already closed the
+                      window.
+                    </Subtitle2>
+                  </Flex>
+                  <FieldTextArea
+                    width="750px"
+                    value={sync}
+                    onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                      setSync(e.target.value);
+                    }}
+                    label="Trust Anchor, Profile and Role ARNs"
+                    placeholder={`:trust-anchor/\n:profile/\n:role/\n`}
+                    rule={validTrustAnchorInput}
+                  />
+                  {phase === Phase.Two ? (
+                    <ButtonPrimary
+                      width="200px"
+                      onClick={() => testCfg.mutate()}
+                      disabled={
+                        !sync ||
+                        !validInput ||
+                        create.status == 'pending' ||
+                        validateName.status == 'pending' ||
+                        testCfg.status == 'pending'
+                      }
+                    >
+                      Test Configuration
+                    </ButtonPrimary>
+                  ) : (
+                    <ButtonSecondary
+                      width="200px"
+                      onClick={() => testCfg.mutate()}
+                      disabled={
+                        !sync ||
+                        !validInput ||
+                        create.status == 'pending' ||
+                        validateName.status == 'pending' ||
+                        testCfg.status == 'pending'
+                      }
+                    >
+                      Test Configuration
+                    </ButtonSecondary>
+                  )}
+                  {alert && alert}
+                </CardTile>
+              </>
+            )}
+            {create.error && (
+              <Alerts.Danger details={create.error?.message}>
+                Error: {create.error.name}
+              </Alerts.Danger>
+            )}
+            <Flex gap={3}>
+              <ButtonPrimary
+                width="200px"
+                onClick={() => create.mutate()}
+                disabled={
+                  phase !== Phase.Three ||
+                  create.status == 'pending' ||
+                  validateName.status == 'pending' ||
+                  testCfg.status == 'pending'
+                }
+              >
+                Next: Configure Access
+              </ButtonPrimary>
+              <ButtonSecondary onClick={history.goBack} width="100px">
+                Back
+              </ButtonSecondary>
+            </Flex>
+          </Flex>
+        )}
+      </Validation>
+    </>
+  );
+}
+
+// The backend will use AWS validation to ensure the params are valid, we just want to get close at this point
+// Will remove dividing line if present, then ensures there are three inputs each starting with `arn:aws:`
+export function parseOutput(value: string): {
+  trustAnchorArn: string;
+  syncProfileArn: string;
+  syncRoleArn: string;
+} {
+  if (!value) {
+    return;
+  }
+
+  const lines = value.split('\n');
+  const trustAnchor = lines
+    .find(l => l.includes(':trust-anchor/'))
+    .replace(/"/g, '')
+    .trim();
+  const profile = lines
+    .find(l => l.includes(':profile/'))
+    .replace(/"/g, '')
+    .trim();
+  const role = lines
+    .find(l => l.includes(':role/'))
+    .replace(/"/g, '')
+    .trim();
+
+  return {
+    trustAnchorArn: trustAnchor,
+    syncProfileArn: profile,
+    syncRoleArn: role,
+  };
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/index.ts b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/index.ts
new file mode 100644
index 0000000000000..e9d0c87e34880
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { IamIntegration } from './IamIntegration/IamIntegration';
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.test.ts b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.test.ts
new file mode 100644
index 0000000000000..7ca91f3bde759
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.test.ts
@@ -0,0 +1,98 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { validTrustAnchorInput } from 'teleport/Integrations/Enroll/AwsConsole/rules';
+
+const excess = `
+  4. Create a Roles Anywhere Profile in AWS IAM for your Teleport cluster.
+CreateRolesAnywhereProfileProvider: {
+    "Name": "MarcoRAProfileFromCLI",
+    "RoleArns": [
+        "arn:aws:iam::123456789012:role/MarcoRARoleFromCLI"
+    ],
+
+Copy and paste the following values to Teleport UI
+
+=================================================
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+=================================================
+
+2025-05-15T16:30:21.683+01:00 INFO  Success! operation:awsra-trust-anchor provisioning/operations.go:190
+`;
+const topExcess = `
+
+=================================================
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+`;
+const bottomExcess = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+=================================================
+`;
+const perfect = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+`;
+const missingArn = `
+:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+`;
+const missingTrust = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:nottheanchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+`;
+const missingProfile = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:nottheprofile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:role/MarcoRARoleFromCLI
+`;
+const missingRole = `
+arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000
+arn:aws:rolesanywhere:eu-west-2:123456789012:profile/00000000-0000-0000-0000-000000000000
+arn:aws:iam::123456789012:nottherole/MarcoRARoleFromCLI
+`;
+const missingAll = `
+foo
+bar
+baz
+`;
+
+test.each`
+  name                          | input             | valid    | message
+  ${'valid excess copy'}        | ${excess}         | ${true}  | ${undefined}
+  ${'valid excess top copy'}    | ${topExcess}      | ${true}  | ${undefined}
+  ${'valid excess bottom copy'} | ${bottomExcess}   | ${true}  | ${undefined}
+  ${'valid perfect copy'}       | ${perfect}        | ${true}  | ${undefined}
+  ${'invalid missing arn'}      | ${missingArn}     | ${false} | ${'Each line should start with arn:aws:, please double check the output'}
+  ${'invalid missing trust'}    | ${missingTrust}   | ${false} | ${'Output is missing trust anchor, please double check the output'}
+  ${'invalid missing profile'}  | ${missingProfile} | ${false} | ${'Output is missing profile, please double check the output'}
+  ${'invalid missing role'}     | ${missingRole}    | ${false} | ${'Output is missing role, please double check the output'}
+  ${'invalid missingAll'}       | ${missingAll}     | ${false} | ${'Each line should start with arn:aws:, please double check the output'}
+`(`parseOutput $name`, ({ input, valid, message }) => {
+  const validationResult = validTrustAnchorInput(input)();
+  expect(validationResult.valid).toBe(valid);
+  expect(validationResult.message).toBe(message);
+});
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.ts b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.ts
new file mode 100644
index 0000000000000..b59f8f136d0ab
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsConsole/rules.ts
@@ -0,0 +1,75 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ValidationResult } from 'shared/components/Validation/rules';
+
+/**
+ * Returns the validity of the trust anchor input including trust anchor, profile and role arns
+ *
+ * @remarks
+ * Loosely checks the inputs for validity; the API will do further validations using the aws package.
+ * Will return invalid if there are not three lines that begin with arn or if one of the following is missing: trust anchor, profile, role.
+ *
+ * @param value - The target to validate
+ * @returns () => {valid: boolean, message: string}
+ *
+ */
+export const validTrustAnchorInput =
+  (value: string) => (): ValidationResult => {
+    if (!value) {
+      return {
+        valid: true,
+      };
+    }
+
+    let lines = value.split('\n');
+    const startsWithArn = lines.filter(l => l.startsWith('arn:aws:'));
+    if (startsWithArn.length < 3) {
+      return {
+        valid: false,
+        message:
+          'Each line should start with arn:aws:, please double check the output',
+      };
+    }
+
+    const trustAnchor = lines.find(l => l.includes(':trust-anchor/'));
+    if (!trustAnchor) {
+      return {
+        valid: false,
+        message:
+          'Output is missing trust anchor, please double check the output',
+      };
+    }
+
+    const profile = lines.find(l => l.includes(':profile/'));
+    if (!profile) {
+      return {
+        valid: false,
+        message: 'Output is missing profile, please double check the output',
+      };
+    }
+    const role = lines.find(l => l.includes(':role/'));
+    if (!role) {
+      return {
+        valid: false,
+        message: 'Output is missing role, please double check the output',
+      };
+    }
+
+    return { valid: true };
+  };
diff --git a/web/packages/teleport/src/Integrations/Enroll/AwsOidc/AwsOidc.tsx b/web/packages/teleport/src/Integrations/Enroll/AwsOidc/AwsOidc.tsx
index a64dd2aac60e2..72d1ea36ed2f6 100644
--- a/web/packages/teleport/src/Integrations/Enroll/AwsOidc/AwsOidc.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/AwsOidc/AwsOidc.tsx
@@ -23,7 +23,10 @@ import { Box, ButtonPrimary, ButtonSecondary, Flex, Link, Text } from 'design';
 import * as Icons from 'design/Icon';
 import FieldInput from 'shared/components/FieldInput';
 import Validation from 'shared/components/Validation';
-import { requiredIamRoleName } from 'shared/components/Validation/rules';
+import {
+  requiredIamRoleName,
+  requiredIntegrationName,
+} from 'shared/components/Validation/rules';
 
 import { TextSelectCopyMulti } from 'teleport/components/TextSelectCopy';
 import cfg from 'teleport/config';
@@ -112,13 +115,14 @@ export function AwsOidc() {
               <Box width="600px">
                 <FieldInput
                   autoFocus={true}
+                  rule={requiredIntegrationName}
                   value={integrationConfig.name}
                   label="Give this AWS integration a name"
                   placeholder="Integration Name"
                   onChange={e =>
                     setIntegrationConfig({
                       ...integrationConfig,
-                      name: e.target.value,
+                      name: e.target.value.trim(),
                     })
                   }
                   disabled={!!scriptUrl}
@@ -131,7 +135,7 @@ export function AwsOidc() {
                   onChange={e =>
                     setIntegrationConfig({
                       ...integrationConfig,
-                      roleName: e.target.value,
+                      roleName: e.target.value.trim(),
                     })
                   }
                   disabled={!!scriptUrl}
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.story.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.story.tsx
index 04e71533b41dc..805c577908658 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.story.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.story.tsx
@@ -18,8 +18,11 @@
 
 import { MemoryRouter } from 'react-router';
 
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
 import { ContextProvider } from 'teleport';
 import cfg from 'teleport/config';
+import { ContentMinWidth } from 'teleport/Main/Main';
 import { createTeleportContext } from 'teleport/mocks/contexts';
 
 import { IntegrationEnroll } from './IntegrationEnroll';
@@ -33,9 +36,13 @@ export const Picker = () => {
 
   return (
     <MemoryRouter initialEntries={[cfg.routes.integrationEnroll]}>
-      <ContextProvider ctx={ctx}>
-        <IntegrationEnroll />
-      </ContextProvider>
+      <InfoGuidePanelProvider>
+        <ContentMinWidth>
+          <ContextProvider ctx={ctx}>
+            <IntegrationEnroll />
+          </ContextProvider>
+        </ContentMinWidth>
+      </InfoGuidePanelProvider>
     </MemoryRouter>
   );
 };
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.tsx
index 682d7d1cd1809..bdc9f2a760137 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationEnroll.tsx
@@ -16,20 +16,27 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Flex } from 'design';
-
 import {
-  FeatureBox,
-  FeatureHeader,
-  FeatureHeaderTitle,
-} from 'teleport/components/Layout';
+  BotIntegration,
+  integrations as botIntegrations,
+  BotTile,
+} from 'teleport/Bots/Add/AddBotsPicker';
+import { FeatureBox } from 'teleport/components/Layout';
 import { Route, Switch } from 'teleport/components/Router';
 import cfg from 'teleport/config';
+import { useNoMinWidth } from 'teleport/Main';
+import useTeleport from 'teleport/useTeleport';
 
-import { NoCodeIntegrationDescription } from './common';
 import { getRoutesToEnrollIntegrations } from './IntegrationRoute';
-import { IntegrationTiles } from './IntegrationTiles/IntegrationTiles';
-import { MachineIDIntegrationSection } from './MachineIDIntegrationSection';
+import {
+  installableIntegrations,
+  IntegrationTileSpec,
+} from './IntegrationTiles/integrations';
+import {
+  displayName,
+  IntegrationTileWithSpec,
+  IntegrationPicker as SharedIntegrationPicker,
+} from './Shared';
 
 export function IntegrationEnroll() {
   return (
@@ -45,23 +52,67 @@ export function IntegrationEnroll() {
   );
 }
 
+type Integration = IntegrationTileSpec | BotIntegration;
+
+const isGuided = (i: Integration) => {
+  if ('guided' in i) {
+    return i.guided;
+    // non-Bot Integrations are guided
+  } else {
+    return true;
+  }
+};
+
+const sortByName = (a: Integration, b: Integration) => {
+  return displayName(a).localeCompare(displayName(b));
+};
+
+const initialSort = (a: Integration, b: Integration) => {
+  return (
+    (isGuided(b) ? (isGuided(a) ? 0 : 1) : isGuided(a) ? -1 : 0) ||
+    sortByName(a, b)
+  );
+};
+
 export function IntegrationPicker() {
+  const ctx = useTeleport();
+  const hasCreateBotPermission = ctx.getFeatureFlags().addBots;
+  const hasIntegrationAccess = ctx.storeUser.getIntegrationsAccess().create;
+  const hasExternalAuditStorage =
+    ctx.storeUser.getExternalAuditStorageAccess().create;
+
+  const integrations = [...installableIntegrations(), ...botIntegrations];
+  useNoMinWidth();
+
+  const renderIntegration = (i: Integration) => {
+    if (i.type === 'integration') {
+      return (
+        <IntegrationTileWithSpec
+          key={i.kind}
+          spec={i}
+          hasIntegrationAccess={hasIntegrationAccess}
+          hasExternalAuditStorage={hasExternalAuditStorage}
+        />
+      );
+    }
+
+    if (i.type === 'bot') {
+      return (
+        <BotTile
+          key={i.kind}
+          integration={i}
+          hasCreateBotPermission={hasCreateBotPermission}
+        />
+      );
+    }
+  };
+
   return (
-    <>
-      <FeatureHeader>
-        <FeatureHeaderTitle>Select Integration Type</FeatureHeaderTitle>
-      </FeatureHeader>
-      <Flex flexDirection="column" gap={4}>
-        <Flex flexDirection="column">
-          <NoCodeIntegrationDescription />
-          <Flex mb={2} gap={3} flexWrap="wrap">
-            <IntegrationTiles />
-          </Flex>
-        </Flex>
-        <Flex flexDirection="column">
-          <MachineIDIntegrationSection />
-        </Flex>
-      </Flex>
-    </>
+    <SharedIntegrationPicker
+      integrations={integrations}
+      renderIntegration={renderIntegration}
+      initialSort={initialSort}
+      canCreate={true}
+    />
   );
 }
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationRoute.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationRoute.tsx
index 7193424a150de..2d097eb4b53ad 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationRoute.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationRoute.tsx
@@ -18,12 +18,18 @@
 
 import { Route } from 'teleport/components/Router';
 import cfg from 'teleport/config';
+import { AwsRolesAnywhereSetup } from 'teleport/Integrations/Enroll/AwsConsole/AwsRolesAnywhereSetup';
 import { IntegrationKind } from 'teleport/services/integrations';
 
 import { AwsOidc } from './AwsOidc';
 
 export function getRoutesToEnrollIntegrations() {
   return [
+    <Route
+      key={IntegrationKind.AwsRa}
+      path={cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa)}
+      component={AwsRolesAnywhereSetup}
+    />,
     <Route
       key={IntegrationKind.AwsOidc}
       exact
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.test.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.test.tsx
index 22f9fe0197674..02fc894275172 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.test.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.test.tsx
@@ -33,8 +33,14 @@ test('render', async () => {
 
   expect(screen.getByText(/AWS OIDC Identity Provider/i)).toBeInTheDocument();
   expect(screen.queryByText(/no permission/i)).not.toBeInTheDocument();
-  expect(screen.getAllByTestId('res-icon-aws')).toHaveLength(2);
-  expect(screen.getAllByRole('link')).toHaveLength(2);
+  expect(screen.getAllByTestId('res-icon-aws')).toHaveLength(1);
+  expect(
+    screen.getAllByTestId('res-icon-awsidentityandaccessmanagementiam')
+  ).toHaveLength(1);
+  expect(
+    screen.getAllByTestId('res-icon-awssimplestorageservices3')
+  ).toHaveLength(1);
+  expect(screen.getAllByRole('link')).toHaveLength(3);
 
   const tile = screen.getByTestId('tile-aws-oidc');
   expect(tile).toBeEnabled();
@@ -65,7 +71,7 @@ test('render disabled', async () => {
   expect(tile).toHaveAttribute('disabled');
 
   // Disabled states have badges on them. Test it renders on hover.
-  const badge = screen.getByText(/lacking permission/i);
+  const badge = tile.querySelector('[data-testid="tooltip"]');
   await userEvent.hover(badge);
   expect(
     screen.getByText(/request additional permissions/i)
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.tsx
index 1c121286faf16..e552b86e7cc29 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/IntegrationTiles.tsx
@@ -31,6 +31,7 @@ import { IntegrationKind } from 'teleport/services/integrations';
 import { IntegrationIcon, IntegrationTile } from '../common';
 import { installableIntegrations, IntegrationTileSpec } from './integrations';
 
+// TODO(alexhemard): delete in a follow up PR
 export function IntegrationTiles({
   hasIntegrationAccess = true,
   hasExternalAuditStorage = true,
@@ -72,7 +73,7 @@ export function IntegrationTileWithSpec({
         data-testid="tile-external-audit-storage"
       >
         <Flex flexBasis={100}>
-          <IntegrationIcon name={spec.icon} size={80} />
+          <IntegrationIcon name={spec.icon} />
         </Flex>
         <Flex>
           <Text>{spec.name}</Text>
@@ -95,7 +96,7 @@ export function IntegrationTileWithSpec({
   );
 }
 
-function renderExternalAuditStorageBadge(
+export function renderExternalAuditStorageBadge(
   hasExternalAuditStorageAccess: boolean,
   isEnterprise: boolean
 ) {
@@ -106,15 +107,15 @@ function renderExternalAuditStorageBadge(
       </ToolTipNoPermBadge>
     );
 
-  return (
+  return !hasExternalAuditStorageAccess ? (
     <GenericNoPermBadge
       noAccess={!hasExternalAuditStorageAccess}
       kind="External Audit Storage"
     />
-  );
+  ) : undefined;
 }
 
-function GenericNoPermBadge({
+export function GenericNoPermBadge({
   noAccess,
   kind = 'integration',
 }: {
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/integrations.ts b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/integrations.ts
index e035bd8942600..bff2afc185259 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/integrations.ts
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles/integrations.ts
@@ -19,6 +19,7 @@
 import { ResourceIconName } from 'design/ResourceIcon';
 
 import cfg from 'teleport/config';
+import { type IntegrationTag } from 'teleport/Integrations/Enroll/Shared';
 import { IntegrationKind } from 'teleport/services/integrations';
 
 export type IntegrationTileSpec = {
@@ -32,6 +33,8 @@ export type IntegrationTileSpec = {
   kind: IntegrationKind;
   icon: ResourceIconName;
   name: string;
+  description: string;
+  tags: IntegrationTag[];
 };
 
 // Add new integrations here sorted by 'name' field.
@@ -39,14 +42,29 @@ const integrations: IntegrationTileSpec[] = [
   {
     type: 'integration',
     kind: IntegrationKind.ExternalAuditStorage,
-    icon: 'aws',
+    description:
+      'Store audit events and session recordings on AWS infrastructure.',
+    icon: 'awssimplestorageservices3',
     name: 'AWS External Audit Storage',
+    tags: ['resourceaccess'],
   },
   {
     type: 'integration',
     kind: IntegrationKind.AwsOidc,
     icon: 'aws',
     name: 'AWS OIDC Identity Provider',
+    description:
+      'Set up Teleport as AWS OIDC IdP to support AWS resource enrollment.',
+    tags: ['idp'],
+  },
+  {
+    type: 'integration',
+    kind: IntegrationKind.AwsRa,
+    description:
+      'Use AWS Roles Anywhere to provide AWS Console and CLI access.',
+    icon: 'awsidentityandaccessmanagementiam',
+    name: 'AWS IAM Roles Anywhere',
+    tags: ['resourceaccess'],
   },
 ];
 
diff --git a/web/packages/teleport/src/Integrations/Enroll/MachineIDIntegrationSection.tsx b/web/packages/teleport/src/Integrations/Enroll/MachineIDIntegrationSection.tsx
index cf2d26a42b56d..b52162203df08 100644
--- a/web/packages/teleport/src/Integrations/Enroll/MachineIDIntegrationSection.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/MachineIDIntegrationSection.tsx
@@ -22,6 +22,7 @@ import { P } from 'design/Text/Text';
 import { BotTiles } from 'teleport/Bots/Add/AddBotsPicker';
 import useTeleport from 'teleport/useTeleport';
 
+// TODO(alexhemard): delete in a follow up PR
 export const MachineIDIntegrationSection = () => {
   const ctx = useTeleport();
   return (
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/FilterPanel.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/FilterPanel.tsx
new file mode 100644
index 0000000000000..e4030d44a2c7c
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/FilterPanel.tsx
@@ -0,0 +1,117 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { type Dispatch, type SetStateAction } from 'react';
+
+import { Box, Flex } from 'design';
+import InputSearch from 'design/DataTable/InputSearch';
+import { MultiselectMenu } from 'shared/components/Controls/MultiselectMenu';
+import {
+  SortItem,
+  SortMenu,
+  SortOrder,
+} from 'shared/components/Controls/SortMenuV2';
+
+import {
+  integrationTagOptions,
+  isIntegrationTag,
+  type IntegrationTag,
+} from './common';
+import { IntegrationPickerFilterKey, IntegrationPickerState } from './state';
+
+export function FilterPanel({
+  state,
+  setState,
+  tagOptions = integrationTagOptions,
+}: {
+  state: IntegrationPickerState;
+  setState: Dispatch<SetStateAction<IntegrationPickerState>>;
+  tagOptions: { value: string; label: string }[];
+}) {
+  const sortFieldOptions: SortItem[] = [
+    {
+      label: 'Name',
+      key: 'name',
+      ascendingLabel: 'Name, A - Z',
+      descendingLabel: 'Name, Z - A',
+      ascendingOptionLabel: 'Alphabetical, A - Z',
+      descendingOptionLabel: 'Alphabetical, Z - A',
+    },
+  ];
+
+  const handleSortChange = (key: string, order: SortOrder) => {
+    setState(prev => ({
+      ...prev,
+      sortKey: key,
+      sortDirection: order,
+    }));
+  };
+
+  const handleFilterChange = (
+    key: IntegrationPickerFilterKey,
+    value: IntegrationTag[]
+  ) => {
+    setState(prev => ({
+      ...prev,
+      filters: {
+        ...prev.filters,
+        [key]: value,
+      },
+    }));
+  };
+
+  function handleSearchChange(search: string) {
+    setState(prev => ({
+      ...prev,
+      search: search,
+    }));
+  }
+
+  return (
+    <>
+      <Box maxWidth="600px" width="100%">
+        <InputSearch
+          searchValue={state.search}
+          setSearchValue={handleSearchChange}
+          placeholder="Search for integrations..."
+        />
+      </Box>
+      <Flex justifyContent="space-between">
+        <Flex justifyContent="flex-start">
+          <MultiselectMenu
+            options={tagOptions}
+            onChange={tags =>
+              handleFilterChange('tags', tags.filter(isIntegrationTag))
+            }
+            selected={state.filters.tags}
+            label="Integration Type"
+            tooltip="Filter by integration type"
+          />
+        </Flex>
+        <Flex justifyContent="flex-end">
+          <SortMenu
+            selectedKey={state.sortKey || 'name'}
+            selectedOrder={state.sortDirection}
+            items={sortFieldOptions}
+            onChange={handleSortChange}
+          />
+        </Flex>
+      </Flex>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.test.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.test.tsx
new file mode 100644
index 0000000000000..cd587274ac774
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.test.tsx
@@ -0,0 +1,270 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { createMemoryHistory } from 'history';
+import type { PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import { Providers, render, screen } from 'design/utils/testing';
+
+import { type BaseIntegration } from './common';
+import { IntegrationPicker } from './IntegrationPicker';
+
+type TestIntegration = BaseIntegration & {
+  type: string;
+};
+
+const mockIntegrations: TestIntegration[] = [
+  {
+    name: 'AWS OIDC',
+    type: 'aws-oidc',
+    tags: ['idp'],
+  },
+  {
+    name: 'Google Cloud Platform',
+    type: 'gcp',
+    tags: ['resourceaccess'],
+  },
+  {
+    title: 'Jenkins',
+    type: 'jenkins',
+    tags: ['cicd'],
+  },
+];
+
+const defaultProps = {
+  integrations: mockIntegrations,
+  renderIntegration: (i: TestIntegration) => (
+    <div key={i.type} data-testid={`integration-${i.type}`}>
+      {i.title || i.name}
+    </div>
+  ),
+  canCreate: true,
+  initialSort: (a: TestIntegration, b: TestIntegration) => {
+    const aName = a.title || a.name;
+    const bName = b.title || b.name;
+    return aName.localeCompare(bName);
+  },
+};
+
+function makeWrapper(route: string = '/') {
+  const history = createMemoryHistory({
+    initialEntries: [route],
+  });
+
+  return function wrapper({ children }: PropsWithChildren) {
+    return (
+      <Providers>
+        <Router history={history}>{children}</Router>
+      </Providers>
+    );
+  };
+}
+
+describe('IntegrationPicker', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('filtering', () => {
+    test('filters integrations by search term', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?search=aws'),
+      });
+
+      expect(screen.getByTestId('integration-aws-oidc')).toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-jenkins')
+      ).not.toBeInTheDocument();
+    });
+
+    test('filters integrations by search term matches tags', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?search=cicd'),
+      });
+
+      expect(screen.getByTestId('integration-jenkins')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-aws-oidc')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+    });
+
+    test('filters integrations by multiple search terms', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?search=aws%20oidc'),
+      });
+
+      expect(screen.getByTestId('integration-aws-oidc')).toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-jenkins')
+      ).not.toBeInTheDocument();
+    });
+
+    test('filters integrations by tags', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?tags=cicd'),
+      });
+
+      expect(screen.getByTestId('integration-jenkins')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-aws-oidc')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+    });
+
+    test('filters integrations by multiple tags', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?tags=idp&tags=cicd'),
+      });
+
+      expect(screen.getByTestId('integration-aws-oidc')).toBeInTheDocument();
+      expect(screen.getByTestId('integration-jenkins')).toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+    });
+
+    test('combines search and tag filters', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?search=jEnKiNs&tags=cicd'),
+      });
+
+      expect(screen.getByTestId('integration-jenkins')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-aws-oidc')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+    });
+
+    test('shows no results when nothing matches', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?search=netbsd'),
+      });
+
+      expect(screen.getByText('No results found')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-aws-oidc')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('integration-gcp')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-jenkins')
+      ).not.toBeInTheDocument();
+    });
+
+    test('shows all integrations when no filters applied', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper(),
+      });
+
+      expect(screen.getByTestId('integration-aws-oidc')).toBeInTheDocument();
+      expect(screen.getByTestId('integration-gcp')).toBeInTheDocument();
+      expect(screen.getByTestId('integration-jenkins')).toBeInTheDocument();
+    });
+  });
+
+  describe('sorting', () => {
+    test('sorts by name in ascending order', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?sort=name&direction=ASC'),
+      });
+
+      const integrations = screen.getAllByTestId(/integration-/);
+      expect(integrations[0]).toHaveTextContent('AWS OIDC');
+      expect(integrations[1]).toHaveTextContent('Google Cloud Platform');
+      expect(integrations[2]).toHaveTextContent('Jenkins');
+    });
+
+    test('sorts by name in descending order', () => {
+      render(<IntegrationPicker {...defaultProps} />, {
+        wrapper: makeWrapper('/?sort=name&direction=DESC'),
+      });
+
+      const integrations = screen.getAllByTestId(/integration-/);
+      expect(integrations[0]).toHaveTextContent('Jenkins');
+      expect(integrations[1]).toHaveTextContent('Google Cloud Platform');
+      expect(integrations[2]).toHaveTextContent('AWS OIDC');
+    });
+
+    test('uses initial sort when no sort specified', () => {
+      const jenkinsSort = jest.fn((a: TestIntegration, b: TestIntegration) => {
+        return a.title === 'Jenkins' ? -1 : b.title === 'Jenkins' ? 1 : 0;
+      });
+      render(
+        <IntegrationPicker {...defaultProps} initialSort={jenkinsSort} />,
+        {
+          wrapper: makeWrapper(),
+        }
+      );
+
+      expect(jenkinsSort).toHaveBeenCalled();
+      const integrations = screen.getAllByTestId(/integration-/);
+      expect(integrations[0]).toHaveTextContent('Jenkins');
+    });
+  });
+
+  describe('loading and error states', () => {
+    test('shows loading indicator when isLoading is true', async () => {
+      render(<IntegrationPicker {...defaultProps} isLoading={true} />, {
+        wrapper: makeWrapper(),
+      });
+
+      expect(await screen.findByTestId('indicator')).toBeInTheDocument();
+      expect(
+        screen.queryByTestId('integration-aws-oidc')
+      ).not.toBeInTheDocument();
+    });
+
+    test('shows error message when ErrorMessage is provided', () => {
+      const ErrorMessage = <div>Something went wrong</div>;
+      render(
+        <IntegrationPicker {...defaultProps} ErrorMessage={ErrorMessage} />,
+        {
+          wrapper: makeWrapper(),
+        }
+      );
+
+      expect(screen.getByText('Something went wrong')).toBeInTheDocument();
+      expect(screen.queryByTestId('integration-1')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('permission notification', () => {
+    test('shows permission notification when canCreate is false', () => {
+      render(<IntegrationPicker {...defaultProps} canCreate={false} />, {
+        wrapper: makeWrapper(),
+      });
+
+      expect(
+        screen.getByText(/You do not have permission to create Integrations/)
+      ).toBeInTheDocument();
+      expect(screen.getByText('plugin.create')).toBeInTheDocument();
+      expect(screen.getByText('integration.create')).toBeInTheDocument();
+    });
+
+    test('does not show permission alert when canCreate is true', () => {
+      render(<IntegrationPicker {...defaultProps} canCreate={true} />, {
+        wrapper: makeWrapper(),
+      });
+
+      expect(
+        screen.queryByText(/You do not have permission to create Integrations/)
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.tsx
new file mode 100644
index 0000000000000..9106c40605e40
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/IntegrationPicker.tsx
@@ -0,0 +1,164 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ReactNode, useMemo } from 'react';
+import styled from 'styled-components';
+
+import { Alert, Box, Flex, Indicator } from 'design';
+import * as Icons from 'design/Icon';
+
+import { FeatureHeader, FeatureHeaderTitle } from 'teleport/components/Layout';
+import { TextIcon } from 'teleport/Discover/Shared';
+
+import { integrationTagOptions, type BaseIntegration } from './common';
+import { FilterPanel } from './FilterPanel';
+import { filterIntegrations } from './filters';
+import { useIntegrationPickerState } from './state';
+
+function titleOrName<T extends BaseIntegration>(i: T) {
+  if ('title' in i) {
+    return i.title;
+  } else if ('name' in i) {
+    return i.name;
+  }
+}
+
+export function displayName<T extends BaseIntegration>(i: T) {
+  const name = titleOrName(i);
+  if ('type' in i && i.type === 'bot') {
+    return `Machine ID: ${name}`;
+  }
+  return name;
+}
+
+export function sortByDisplayName<T extends BaseIntegration>(a: T, b: T) {
+  return displayName(a).localeCompare(displayName(b));
+}
+
+export interface IntegrationPickerProps<T extends BaseIntegration> {
+  integrations: T[];
+  renderIntegration: (integration: T) => ReactNode;
+  initialSort?: (a: T, b: T) => number;
+  isLoading?: boolean;
+  canCreate?: boolean;
+  ErrorMessage?: ReactNode;
+}
+
+export function IntegrationPicker<T extends BaseIntegration>({
+  integrations,
+  renderIntegration,
+  initialSort = sortByDisplayName,
+  isLoading,
+  canCreate,
+  ErrorMessage,
+}: IntegrationPickerProps<T>) {
+  const [state, setState] = useIntegrationPickerState();
+
+  const activeTagOptions = integrationTagOptions.filter(tagOption =>
+    integrations.some(integration => integration.tags.includes(tagOption.value))
+  );
+
+  const sortedIntegrations = useMemo(() => {
+    const sorted = integrations.toSorted((a, b) => {
+      switch (state.sortKey) {
+        case 'name':
+          return sortByDisplayName(a, b);
+        default:
+          return initialSort(a, b);
+      }
+    });
+
+    if (state.sortDirection === 'DESC') {
+      sorted.reverse();
+    }
+
+    return sorted;
+  }, [integrations, state.sortDirection, state.sortKey]);
+
+  const filteredIntegrations = useMemo(
+    () =>
+      filterIntegrations(sortedIntegrations, state.filters.tags, state.search),
+    [sortedIntegrations, state.filters.tags, state.search]
+  );
+
+  const renderPermissionsNotice = () => {
+    if (!canCreate) {
+      return (
+        <Alert kind="info" mt={4}>
+          <Flex gap={2}>
+            You do not have permission to create Integrations. You must have at
+            least one of these role permissions: <code>plugin.create</code>{' '}
+            <code>integration.create</code>
+          </Flex>
+        </Alert>
+      );
+    }
+  };
+
+  const renderIntegrations = () => {
+    if (isLoading) {
+      return (
+        <Box textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      );
+    } else {
+      return (
+        <>
+          <FilterPanel
+            state={state}
+            setState={setState}
+            tagOptions={activeTagOptions}
+          />
+          {!filteredIntegrations.length && (
+            <TextIcon>
+              <Icons.Magnifier size="small" /> No results found
+            </TextIcon>
+          )}
+          <Container role="grid">
+            {filteredIntegrations.map(i => {
+              return renderIntegration(i);
+            })}
+          </Container>
+        </>
+      );
+    }
+  };
+
+  return (
+    <>
+      <Box>
+        <FeatureHeader mb={0}>
+          <FeatureHeaderTitle>Enroll a New Integration</FeatureHeaderTitle>
+        </FeatureHeader>
+      </Box>
+      {renderPermissionsNotice()}
+
+      <Flex flexDirection="column" gap={3}>
+        {ErrorMessage ? ErrorMessage : renderIntegrations()}
+      </Flex>
+    </>
+  );
+}
+
+const Container = styled.div`
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(400px, 1fr));
+  gap: ${props => props.theme.space[3]}px;
+  margin-bottom: ${props => props.theme.space[4]}px;
+`;
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/Tile.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/Tile.tsx
new file mode 100644
index 0000000000000..102b5f02c2a10
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/Tile.tsx
@@ -0,0 +1,296 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ReactNode } from 'react';
+import { Link as InternalLink } from 'react-router-dom';
+import styled from 'styled-components';
+
+import { Link as ExternalLink, Flex, Label, Text } from 'design';
+import * as Icon from 'design/Icon';
+import { ResourceIconName } from 'design/ResourceIcon/resourceIconSpecs';
+
+import cfg from 'teleport/config';
+import { IntegrationKind } from 'teleport/services/integrations';
+
+import { IntegrationIcon } from '../common';
+import { type IntegrationTileSpec } from '../IntegrationTiles/integrations';
+import {
+  GenericNoPermBadge,
+  renderExternalAuditStorageBadge,
+} from '../IntegrationTiles/IntegrationTiles';
+import { integrationTagOptions, type IntegrationTag } from './common';
+
+type IntegrationLink = {
+  url: string | undefined;
+  external?: boolean;
+  onClick?: () => void;
+};
+
+export function IntegrationTileWithSpec({
+  spec,
+  hasIntegrationAccess = true,
+  hasExternalAuditStorage = true,
+}: {
+  spec: IntegrationTileSpec;
+  hasIntegrationAccess?: boolean;
+  hasExternalAuditStorage?: boolean;
+}) {
+  const link = hasExternalAuditStorage
+    ? { external: false, url: cfg.getIntegrationEnrollRoute(spec.kind) }
+    : null;
+
+  let Badge = undefined;
+  let hasAccess = hasIntegrationAccess;
+
+  if (spec.kind === IntegrationKind.ExternalAuditStorage) {
+    const externalAuditStorageEnabled =
+      cfg.entitlements.ExternalAuditStorage.enabled;
+
+    hasAccess &&= hasExternalAuditStorage && externalAuditStorageEnabled;
+
+    Badge = renderExternalAuditStorageBadge(
+      hasExternalAuditStorage,
+      externalAuditStorageEnabled
+    );
+  }
+
+  if (!hasAccess) {
+    Badge ||= <GenericNoPermBadge noAccess={!hasAccess} />;
+  }
+
+  const dataTestID = `tile-${spec.kind}`;
+
+  return (
+    <Tile
+      title={spec.name}
+      hasAccess={hasAccess}
+      link={link}
+      tags={spec.tags}
+      icon={spec.icon}
+      description={spec.description}
+      Badge={Badge}
+      data-testid={dataTestID}
+    />
+  );
+}
+
+export function Tile({
+  title,
+  description,
+  hasAccess,
+  icon,
+  link,
+  tags = [],
+  enrolled = false,
+  Badge,
+  'data-testid': dataTestID,
+}: {
+  title: string;
+  description?: ReactNode;
+  hasAccess: boolean;
+  enrolled?: boolean;
+  icon: ResourceIconName;
+  link?: IntegrationLink;
+  tags?: IntegrationTag[];
+  Badge?: ReactNode;
+  'data-testid'?: string;
+}) {
+  const nameForTag = (tag: IntegrationTag) => {
+    const option = integrationTagOptions.find(option => option.value === tag);
+    return option ? option.label : null;
+  };
+
+  let tileProps = {};
+  if (hasAccess && link?.url) {
+    if (link.external) {
+      tileProps = {
+        as: ExternalLink,
+        href: link.url,
+        target: '_blank',
+        onClick: link.onClick,
+        style: { textDecoration: 'none' },
+        role: 'link',
+      };
+    } else {
+      tileProps = {
+        as: InternalLink,
+        to: link.url,
+      };
+    }
+  }
+
+  if (dataTestID) {
+    tileProps['data-testid'] = dataTestID;
+  }
+
+  return (
+    <IntegrationCard
+      tabIndex={0}
+      title={title}
+      data-testid={dataTestID}
+      disabled={!hasAccess}
+      $enrolled={enrolled}
+      {...tileProps}
+    >
+      {Badge ||
+        (link && !link.external ? (
+          <BadgeGuided>Guided</BadgeGuided>
+        ) : (
+          <BadgeSelfHosted>
+            Self-Hosted
+            <StyledNewTab size={14} color="text.slightlyMuted" />
+          </BadgeSelfHosted>
+        ))}
+      <Flex flexDirection="row" width={'100%'}>
+        <Flex alignItems="flex-start" ml={3} mr={2} mt={3} gap={3}>
+          <Flex width={72}>
+            <IntegrationIcon name={icon} size={72} />
+          </Flex>
+          <Flex flexDirection="column" gap={1} minWidth={0}>
+            <StyledText>{title}</StyledText>
+            {description && (
+              <Text typography="body2" color="text.slightlyMuted" fontSize={12}>
+                {description}
+              </Text>
+            )}
+            <Flex gap={1} flexWrap="wrap">
+              {tags.map(tag => {
+                return (
+                  <StyledLabel
+                    key={tag}
+                    title={nameForTag(tag)}
+                    kind="secondary"
+                    data-is-label=""
+                  >
+                    {nameForTag(tag)}
+                  </StyledLabel>
+                );
+              })}
+            </Flex>
+          </Flex>
+        </Flex>
+      </Flex>
+      {enrolled && (
+        <StyledIconCheck
+          data-testid="integration-checkmark"
+          color="success.main"
+          size="large"
+        />
+      )}
+    </IntegrationCard>
+  );
+}
+
+const StyledText = styled(Text)`
+  white-space: nowrap;
+  font-size: 16px;
+  font-weight: 500;
+`;
+
+const StyledLabel = styled(Label)`
+  height: 20px;
+  margin: 1px 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  cursor: pointer;
+  line-height: 18px;
+`;
+
+const IntegrationCard = styled.div<{ disabled?: boolean; $enrolled?: boolean }>`
+  align-items: flex-start;
+  display: inline-flex;
+  margin: 0;
+  appearance: auto;
+  text-align: left;
+  position: relative;
+  text-decoration: none;
+
+  height: 132px;
+  width: 100%;
+  border-radius: ${props => props.theme.radii[3]}px;
+  box-shadow: inset 0 0 0 2px
+    ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  background-color: transparent;
+  transition: background-color 0.3s ease;
+
+  color: ${props => props.theme.colors.text.main};
+  line-height: inherit;
+  font-size: inherit;
+  font-family: inherit;
+
+  cursor: ${({ disabled, $enrolled }) =>
+    disabled || $enrolled ? 'not-allowed' : 'pointer'};
+
+  opacity: ${props => (props.disabled ? '0.45' : '1')};
+
+  &:hover {
+    background-color: ${props =>
+      props.disabled || props.$enrolled
+        ? 'transparent'
+        : props.theme.colors.interactive.tonal.neutral[0]};
+    box-shadow: inset 0 0 0 2px
+      ${props =>
+        props.disabled || props.$enrolled
+          ? props.theme.colors.interactive.tonal.neutral[0]
+          : 'transparent'};
+  }
+
+  &:focus-visible {
+    outline: none;
+    box-shadow: 0 0 0 3px ${props => props.theme.colors.brand};
+  }
+`;
+
+const BadgeSelfHosted = styled.div`
+  position: absolute;
+  background-color: ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  color: ${props => props.theme.colors.text.slightlyMuted};
+  padding: 2px 24px 2px 8px;
+  border-top-right-radius: ${({ theme }) => theme.space[2]}px;
+  border-bottom-left-radius: ${({ theme }) => theme.space[2]}px;
+  top: 0px;
+  right: 0px;
+  font-size: 10px;
+  line-height: 20px;
+`;
+
+const BadgeGuided = styled.div`
+  position: absolute;
+  background: ${props => props.theme.colors.brand};
+  color: ${props => props.theme.colors.text.primaryInverse};
+  padding: 2px 8px;
+  border-top-right-radius: 8px;
+  border-bottom-left-radius: 8px;
+  top: 0px;
+  right: 0px;
+  font-size: 10px;
+  line-height: 18px;
+`;
+
+const StyledIconCheck = styled(Icon.Check)`
+  position: absolute;
+  bottom: ${({ theme }) => theme.space[2]}px;
+  right: ${({ theme }) => theme.space[2]}px;
+`;
+
+const StyledNewTab = styled(Icon.NewTab)`
+  position: absolute;
+  top: ${({ theme }) => theme.space[1]}px;
+  right: ${({ theme }) => theme.space[2]}px;
+`;
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/common.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/common.tsx
new file mode 100644
index 0000000000000..c008cefa84dd7
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/common.tsx
@@ -0,0 +1,50 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export type BaseIntegration = (
+  | { name: string; title?: never } // Plugin, IntegrationTileSpec
+  | { title: string; name?: never } // BotIntegration uses title
+) & {
+  tags: IntegrationTag[];
+  description?: string;
+};
+
+export const integrationTagOptions = [
+  { value: 'bot', label: 'Bot' },
+  { value: 'cicd', label: 'CI/CD' },
+  { value: 'devicetrust', label: 'Device Trust' },
+  { value: 'idp', label: 'IdP' },
+  { value: 'notifications', label: 'Notifications' },
+  { value: 'resourceaccess', label: 'Resource Access' },
+  { value: 'scim', label: 'SCIM' },
+] as const satisfies { value: string; label: string }[];
+
+/**
+ * Type representing tags used for categorizing and filtering integrations
+ */
+export type IntegrationTag = Extract<
+  (typeof integrationTagOptions)[number],
+  { value: string }
+>['value'];
+
+export function isIntegrationTag(tag: unknown): tag is IntegrationTag {
+  return (
+    typeof tag === 'string' &&
+    integrationTagOptions.some(option => option.value === tag)
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/filters.ts b/web/packages/teleport/src/Integrations/Enroll/Shared/filters.ts
new file mode 100644
index 0000000000000..607db69dd0c04
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/filters.ts
@@ -0,0 +1,56 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  displayName,
+  type BaseIntegration,
+  type IntegrationTag,
+} from 'teleport/Integrations/Enroll/Shared';
+
+export function filterIntegrations<T extends BaseIntegration>(
+  integrations: T[],
+  tags: IntegrationTag[],
+  search: string
+): T[] {
+  if (!integrations.length && !tags && search === '') {
+    return integrations;
+  }
+
+  const searches = search.split(' ').map(s => s.toLowerCase());
+
+  const found = integrations.filter(i =>
+    searches.every(
+      s =>
+        displayName<T>(i).toLowerCase().includes(s) ||
+        i.tags.some(tag => tag.includes(s)) ||
+        i.description?.toLowerCase().includes(s)
+    )
+  );
+
+  let filtered = [...found];
+
+  if (tags.length) {
+    filtered = filtered.filter(i => {
+      if ('tags' in i) {
+        return tags.some(tag => i.tags.includes(tag));
+      }
+    });
+  }
+
+  return filtered;
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/index.ts b/web/packages/teleport/src/Integrations/Enroll/Shared/index.ts
new file mode 100644
index 0000000000000..d7af64b1a5f8c
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/index.ts
@@ -0,0 +1,26 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { IntegrationPicker, displayName } from './IntegrationPicker';
+export {
+  type IntegrationTag,
+  type BaseIntegration,
+  isIntegrationTag,
+  integrationTagOptions,
+} from './common';
+export { Tile, IntegrationTileWithSpec } from './Tile';
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/state.test.tsx b/web/packages/teleport/src/Integrations/Enroll/Shared/state.test.tsx
new file mode 100644
index 0000000000000..56803a797f394
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/state.test.tsx
@@ -0,0 +1,385 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook } from '@testing-library/react';
+import { createMemoryHistory } from 'history';
+import type { PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import {
+  searchParamsToState,
+  stateToSearchParams,
+  useIntegrationPickerState,
+  type IntegrationPickerState,
+} from './state';
+
+describe('searchParamsToState', () => {
+  it('returns default state when no params provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(params);
+
+    expect(state).toEqual({
+      filters: {
+        tags: [],
+      },
+      search: '',
+      sortKey: undefined,
+      sortDirection: 'ASC',
+    });
+  });
+
+  it('parses filters correctly', () => {
+    const params = new URLSearchParams();
+
+    params.append('tags', 'bot');
+    params.append('tags', 'cicd');
+
+    const state = searchParamsToState(params);
+
+    expect(state.filters).toEqual({
+      tags: ['bot', 'cicd'],
+    });
+  });
+
+  it('filters out invalid integration tags', () => {
+    const params = new URLSearchParams();
+
+    params.append('tags', 'bot');
+    params.append('tags', 'invalid-type');
+    params.append('tags', 'cicd');
+
+    const state = searchParamsToState(params);
+
+    expect(state.filters.tags).toEqual(['bot', 'cicd']);
+  });
+
+  it('parses sort parameters correctly', () => {
+    const params = new URLSearchParams('?sort=name&direction=ASC');
+    const state = searchParamsToState(params);
+
+    expect(state.sortKey).toBe('name');
+    expect(state.sortDirection).toBe('ASC');
+  });
+
+  it('ignores invalid sort key', () => {
+    const params = new URLSearchParams('?sort=invalid');
+    const state = searchParamsToState(params);
+
+    expect(state.sortKey).toBe(undefined);
+  });
+
+  it('ignores invalid sort direction', () => {
+    const params = new URLSearchParams('?direction=INVALID');
+    const state = searchParamsToState(params);
+
+    expect(state.sortDirection).toBe('ASC');
+  });
+
+  it('parses search parameter correctly', () => {
+    const params = new URLSearchParams('?search=test%20query');
+    const state = searchParamsToState(params);
+
+    expect(state.search).toBe('test query');
+  });
+
+  it('defaults search to empty string when not provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(params);
+
+    expect(state.search).toBe('');
+  });
+
+  it('handles empty search parameter', () => {
+    const params = new URLSearchParams('?search=');
+    const state = searchParamsToState(params);
+
+    expect(state.search).toBe('');
+  });
+});
+
+describe('stateToSearchParams', () => {
+  it('returns empty params for default state', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: [],
+      },
+      search: '',
+      sortKey: undefined,
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+
+    expect(params).toBe('');
+  });
+
+  it('includes all filters', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: ['bot', 'cicd'],
+      },
+      search: '',
+      sortKey: 'name',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.getAll('tags')).toEqual(['bot', 'cicd']);
+  });
+
+  it('combines all parameters correctly', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: ['bot'],
+      },
+      search: '',
+      sortKey: 'name',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.getAll('tags')).toEqual(['bot']);
+    expect(urlParams.get('sort')).toBe('name');
+    expect(urlParams.get('direction')).toBe('ASC');
+  });
+
+  it('includes search when not empty', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: [],
+      },
+      search: 'test query',
+      sortKey: 'name',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('search')).toBe('test query');
+  });
+
+  it('omits search when empty', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: [],
+      },
+      search: '',
+      sortKey: 'name',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.has('search')).toBe(false);
+  });
+
+  it('includes search with other parameters', () => {
+    const state: IntegrationPickerState = {
+      filters: {
+        tags: ['bot'],
+      },
+      search: 'google cloud',
+      sortKey: 'name',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('search')).toBe('google cloud');
+    expect(urlParams.getAll('tags')).toEqual(['bot']);
+    expect(urlParams.get('sort')).toBe('name');
+    expect(urlParams.get('direction')).toBe('ASC');
+  });
+});
+
+describe('useIntegrationPickerState', () => {
+  it('initializes state from URL search params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/integrations/new?search=cool'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [state] = result.current;
+
+    expect(state.search).toBe('cool');
+  });
+
+  it('updates URL when state changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        sortKey: 'name',
+        sortDirection: 'DESC',
+      }));
+    });
+
+    expect(history.location.search).toContain('direction=DESC');
+    expect(history.location.search).toContain('sort=name');
+  });
+
+  it('responds to browser navigation', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    act(() => {
+      history.push('?sort=name&direction=DESC');
+    });
+
+    const [state] = result.current;
+
+    expect(state.sortKey).toBe('name');
+    expect(state.sortDirection).toBe('DESC');
+  });
+
+  it('prevents unnecessary state updates', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [initialState, setState] = result.current;
+
+    act(() => {
+      setState(initialState);
+    });
+
+    const [newState] = result.current;
+
+    expect(newState).toBe(initialState);
+  });
+
+  it('handles functional updates', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        filters: {
+          ...prev.filters,
+          tags: ['cicd'],
+        },
+      }));
+    });
+
+    const [state] = result.current;
+
+    expect(state.filters.tags.length).toBe(1);
+  });
+
+  it('does not update URL for default empty search params', () => {
+    const history = createMemoryHistory();
+    const replaceSpy = jest.spyOn(history, 'replace');
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    renderHook(() => useIntegrationPickerState(), { wrapper });
+
+    expect(replaceSpy).not.toHaveBeenCalled();
+  });
+
+  it('handles search parameter in URL params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/integrations/new?search=test%20query'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [state] = result.current;
+
+    expect(state.search).toBe('test query');
+  });
+
+  it('updates URL when search changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useIntegrationPickerState(), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        search: 'new search term',
+      }));
+    });
+
+    expect(history.location.search).toContain('search=new+search+term');
+  });
+});
diff --git a/web/packages/teleport/src/Integrations/Enroll/Shared/state.ts b/web/packages/teleport/src/Integrations/Enroll/Shared/state.ts
new file mode 100644
index 0000000000000..e90a6dc3d2a26
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/Shared/state.ts
@@ -0,0 +1,146 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useEffect,
+  useRef,
+  useState,
+  type Dispatch,
+  type SetStateAction,
+} from 'react';
+import { useHistory } from 'react-router';
+
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+
+import { isIntegrationTag, type IntegrationTag } from './common';
+
+export interface IntegrationPickerFilters {
+  tags: IntegrationTag[];
+}
+
+export interface IntegrationPickerState {
+  filters: IntegrationPickerFilters;
+  search: string;
+  sortKey: string | undefined;
+  sortDirection: SortOrder;
+}
+
+export type IntegrationPickerFilterKey = keyof IntegrationPickerFilters;
+
+export function searchParamsToState(params: URLSearchParams) {
+  const state: IntegrationPickerState = {
+    filters: {
+      tags: [],
+    },
+    search: '',
+    sortKey: undefined,
+    sortDirection: 'ASC',
+  };
+
+  const sortKey = params.get('sort');
+  if (sortKey && ['name'].includes(sortKey)) {
+    state.sortKey = sortKey;
+  }
+
+  const direction = params.get('direction');
+  if (direction === 'ASC' || direction === 'DESC') {
+    state.sortDirection = direction;
+  }
+
+  const tags = params.getAll('tags');
+  if (tags.length > 0) {
+    state.filters.tags = tags.filter(isIntegrationTag);
+  }
+
+  const search = params.get('search');
+  if (search) {
+    state.search = search;
+  }
+
+  return state;
+}
+
+export function stateToSearchParams(state: IntegrationPickerState) {
+  const urlParams = new URLSearchParams();
+
+  if (state.filters.tags.length > 0) {
+    for (const tags of state.filters.tags) {
+      urlParams.append('tags', tags);
+    }
+  }
+
+  if (state.search) {
+    urlParams.set('search', state.search);
+  }
+
+  if (state.sortKey !== undefined) {
+    urlParams.set('direction', state.sortDirection);
+    urlParams.set('sort', state.sortKey);
+  }
+
+  return urlParams.toString();
+}
+
+// useIntegrationPickerState is a custom hook that manages the state of the the Integration Picker,
+// syncing it with the URL search parameters.
+// It allows for state updates and ensures that the URL reflects the current state.
+// It also listens for changes in the URL to update the state accordingly.
+// Repurposed from SessionRecordings/list/state.ts
+export function useIntegrationPickerState(): [
+  IntegrationPickerState,
+  Dispatch<SetStateAction<IntegrationPickerState>>,
+] {
+  const history = useHistory();
+
+  const [state, setState] = useState<IntegrationPickerState>(() =>
+    searchParamsToState(new URLSearchParams(history.location.search))
+  );
+
+  const currentSearch = useRef<string>(history.location.search);
+
+  useEffect(() => {
+    const params = stateToSearchParams(state);
+
+    currentSearch.current = `?${params.toString()}`;
+
+    if (
+      history.location.search.length === 0 &&
+      currentSearch.current.length === 1 // empty, i.e. just '?'
+    ) {
+      // the current search is empty, and the state is also empty,
+      // so we don't need to update the URL
+      return;
+    }
+
+    if (history.location.search !== currentSearch.current) {
+      history.replace({ search: currentSearch.current });
+    }
+  }, [history, state]);
+
+  useEffect(() => {
+    return history.listen(next => {
+      if (next.search !== currentSearch.current) {
+        setState(searchParamsToState(new URLSearchParams(next.search)));
+
+        currentSearch.current = next.search;
+      }
+    });
+  }, [history]);
+
+  return [state, setState];
+}
diff --git a/web/packages/teleport/src/Integrations/Enroll/awsLinks.ts b/web/packages/teleport/src/Integrations/Enroll/awsLinks.ts
new file mode 100644
index 0000000000000..4d13d081b7703
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/Enroll/awsLinks.ts
@@ -0,0 +1,23 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export const cloudShell = 'https://console.aws.amazon.com/cloudshell/home';
+export const rolesAnywhere =
+  'https://console.aws.amazon.com/rolesanywhere/home';
+export const rolesAnywhereCreateProfile =
+  'https://console.aws.amazon.com/rolesanywhere/home/profiles/create';
diff --git a/web/packages/teleport/src/Integrations/Enroll/common.tsx b/web/packages/teleport/src/Integrations/Enroll/common.tsx
index b8a3d6be5f7bd..fe20768de8659 100644
--- a/web/packages/teleport/src/Integrations/Enroll/common.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/common.tsx
@@ -18,8 +18,7 @@
 
 import styled from 'styled-components';
 
-import { Box, Flex, H2, ResourceIcon } from 'design';
-import { P } from 'design/Text/Text';
+import { Box, Flex, H2, ResourceIcon, Text } from 'design';
 
 export const IntegrationTile = styled(Flex)<{
   disabled?: boolean;
@@ -36,7 +35,7 @@ export const IntegrationTile = styled(Flex)<{
   gap: ${({ theme }) => theme.space[3]}px;
   height: 170px;
   width: 170px;
-  background-color: ${({ theme }) => theme.colors.buttons.secondary.default};
+  background-color: ${({ theme }) => theme.colors.levels.sunken};
   text-align: center;
   cursor: ${({ disabled, $exists }) =>
     disabled || $exists ? 'not-allowed' : 'pointer'};
@@ -51,7 +50,7 @@ export const IntegrationTile = styled(Flex)<{
     opacity: ${props.disabled ? '0.45' : '1'};
     &:hover,
     &:focus-visible {
-      background-color: ${props.theme.colors.buttons.secondary.hover};
+      background-color: ${props.theme.colors.levels.surface};
     }
     `;
   }};
@@ -60,10 +59,10 @@ export const IntegrationTile = styled(Flex)<{
 export const NoCodeIntegrationDescription = () => (
   <Box mb={3}>
     <H2 mb={1}>No-Code Integrations</H2>
-    <P>
+    <Text>
       Set up Teleport to post notifications to messaging apps, discover and
       import resources from cloud providers and other services.
-    </P>
+    </Text>
   </Box>
 );
 
@@ -71,10 +70,11 @@ export const NoCodeIntegrationDescription = () => (
  * IntegrationIcon wraps ResourceIcon with css required for integration
  * and plugin tiles.
  */
-export const IntegrationIcon = styled(ResourceIcon)<{ size?: number }>`
-  display: inline-block;
+export const IntegrationIcon = styled(ResourceIcon).withConfig({
+  shouldForwardProp: prop => prop !== 'size',
+})<{ size?: number }>`
   margin: 0 auto;
   height: 100%;
-  min-width: 0;
-  ${({ size }) => size && `max-width: ${size}px;`}
+  min-width: ${props => (props.size ? `${props.size}px` : 0)};
+  max-width: ${props => props.size || 72}px;
 `;
diff --git a/web/packages/teleport/src/Integrations/IntegrationList.tsx b/web/packages/teleport/src/Integrations/IntegrationList.tsx
index 4fca4f30e0b7a..7aaf3dccd1b2e 100644
--- a/web/packages/teleport/src/Integrations/IntegrationList.tsx
+++ b/web/packages/teleport/src/Integrations/IntegrationList.tsx
@@ -60,16 +60,19 @@ export type IntegrationLike =
   | Plugin
   | ExternalAuditStorageIntegration;
 
+// statusKinds are the integration types with status pages; we enable clicking on the row directly to route to the view
+const statusKinds = ['okta', IntegrationKind.AwsOidc, IntegrationKind.AwsRa];
+
 export function IntegrationList(props: Props) {
   const history = useHistory();
 
   function handleRowClick(row: IntegrationLike) {
-    if (row.kind !== 'okta' && row.kind !== IntegrationKind.AwsOidc) return;
+    if (!statusKinds.includes(row.kind)) return;
     history.push(cfg.getIntegrationStatusRoute(row.kind, row.name));
   }
 
   function getRowStyle(row: IntegrationLike): React.CSSProperties {
-    if (row.kind !== 'okta' && row.kind !== IntegrationKind.AwsOidc) return;
+    if (!statusKinds.includes(row.kind)) return;
     return { cursor: 'pointer' };
   }
 
@@ -118,8 +121,12 @@ export function IntegrationList(props: Props) {
         {
           altKey: 'options-btn',
           render: item => {
-            if (item.kind === IntegrationKind.AwsOidc) {
-              // do not show any action menu for aws oidc; settings are available on the dashboard
+            if (
+              item.kind === IntegrationKind.AwsOidc ||
+              item.kind === IntegrationKind.AwsRa
+            ) {
+              // do not show any action menu for aws oidc or roles anywhere;
+              // settings are available on the dashboard
               return;
             }
 
@@ -351,6 +358,17 @@ const IconCell = ({ item }: { item: IntegrationLike }) => {
         formattedText = 'AWS IAM Identity Center';
         icon = <IconContainer name="aws" />;
         break;
+      case 'scim':
+        formattedText = 'SCIM';
+        icon = <IconContainer name="scim" />;
+        break;
+      case 'intune':
+        formattedText = 'Microsoft Intune';
+        icon = <IconContainer name="intune" />;
+        break;
+      default:
+        // TODO(ravicious): Remove openai exemption from here once a branch is added for it.
+        item.kind satisfies never | 'openai';
     }
   } else {
     // Default is integration.
@@ -360,6 +378,10 @@ const IconCell = ({ item }: { item: IntegrationLike }) => {
         formattedText = item.name;
         icon = <IconContainer name="aws" />;
         break;
+      case IntegrationKind.AwsRa:
+        formattedText = item.name;
+        icon = <IconContainer name="awsidentityandaccessmanagementiam" />;
+        break;
       case IntegrationKind.AzureOidc:
         formattedText = 'Azure OIDC';
         icon = <IconContainer name="azure" />;
diff --git a/web/packages/teleport/src/Integrations/IntegrationStatus.tsx b/web/packages/teleport/src/Integrations/IntegrationStatus.tsx
index 6119793a0d1a6..b73e50f8c0a4a 100644
--- a/web/packages/teleport/src/Integrations/IntegrationStatus.tsx
+++ b/web/packages/teleport/src/Integrations/IntegrationStatus.tsx
@@ -19,6 +19,7 @@
 import { useParams } from 'react-router';
 
 import { AwsOidcRoutes } from 'teleport/Integrations/status/AwsOidc/AwsOidcRoutes';
+import { AwsRaRoutes } from 'teleport/Integrations/status/AwsRa/AwsRaRoutes';
 import { IntegrationKind, PluginKind } from 'teleport/services/integrations';
 
 export function IntegrationStatus() {
@@ -26,9 +27,13 @@ export function IntegrationStatus() {
     type: PluginKind | IntegrationKind;
   }>();
 
-  if (integrationType === 'aws-oidc') {
+  if (integrationType === IntegrationKind.AwsOidc) {
     return <AwsOidcRoutes />;
   }
 
+  if (integrationType === IntegrationKind.AwsRa) {
+    return <AwsRaRoutes />;
+  }
+
   return <>Status for integration type {integrationType} is not supported</>;
 }
diff --git a/web/packages/teleport/src/Integrations/Integrations.story.tsx b/web/packages/teleport/src/Integrations/Integrations.story.tsx
index 32cd1fa5fcb88..7c0adcbc64191 100644
--- a/web/packages/teleport/src/Integrations/Integrations.story.tsx
+++ b/web/packages/teleport/src/Integrations/Integrations.story.tsx
@@ -23,6 +23,7 @@ import {
   IntegrationStatusCode,
 } from 'teleport/services/integrations';
 
+import { DeleteAwsOidcIntegrationDialog } from './DeleteAwsOidcIntegrationDialog';
 import { EditAwsOidcIntegrationDialog } from './EditAwsOidcIntegrationDialog';
 import { integrations, plugins } from './fixtures';
 import { IntegrationList } from './IntegrationList';
@@ -50,6 +51,26 @@ export function DeleteDialog() {
   );
 }
 
+export function DeleteAwsOidcDialog() {
+  return (
+    <MemoryRouter>
+      <DeleteAwsOidcIntegrationDialog
+        close={() => null}
+        remove={() => null}
+        integration={{
+          resourceType: 'integration',
+          kind: IntegrationKind.AwsOidc,
+          name: 'some-integration-name',
+          spec: {
+            roleArn: 'arn:aws:iam::123456789012:role/johndoe',
+          },
+          statusCode: IntegrationStatusCode.Running,
+        }}
+      />
+    </MemoryRouter>
+  );
+}
+
 export function EditDialogWithoutS3() {
   return (
     <EditAwsOidcIntegrationDialog
diff --git a/web/packages/teleport/src/Integrations/Operations/IntegrationOperations.tsx b/web/packages/teleport/src/Integrations/Operations/IntegrationOperations.tsx
index dbfa876c0cfc9..57de42233f653 100644
--- a/web/packages/teleport/src/Integrations/Operations/IntegrationOperations.tsx
+++ b/web/packages/teleport/src/Integrations/Operations/IntegrationOperations.tsx
@@ -18,6 +18,7 @@
 
 import { Integration, IntegrationKind } from 'teleport/services/integrations';
 
+import { DeleteAwsOidcIntegrationDialog } from '../DeleteAwsOidcIntegrationDialog';
 import { EditAwsOidcIntegrationDialog } from '../EditAwsOidcIntegrationDialog';
 import { DeleteIntegrationDialog } from '../RemoveIntegrationDialog';
 import {
@@ -44,6 +45,16 @@ export function IntegrationOperations({
   edit,
   remove,
 }: Props<EditableIntegrationFields>) {
+  if (operation === 'delete' && integration.kind === IntegrationKind.AwsOidc) {
+    return (
+      <DeleteAwsOidcIntegrationDialog
+        integration={integration}
+        close={close}
+        remove={remove}
+      />
+    );
+  }
+
   if (operation === 'delete') {
     return (
       <DeleteIntegrationDialog
diff --git a/web/packages/teleport/src/Integrations/Operations/useIntegrationOperation.ts b/web/packages/teleport/src/Integrations/Operations/useIntegrationOperation.ts
index 70a8f55ddc7fd..a570eef3f8b7e 100644
--- a/web/packages/teleport/src/Integrations/Operations/useIntegrationOperation.ts
+++ b/web/packages/teleport/src/Integrations/Operations/useIntegrationOperation.ts
@@ -20,13 +20,14 @@ import { useState } from 'react';
 
 import {
   IntegrationAwsOidc,
+  IntegrationAwsRa,
   IntegrationKind,
   integrationService,
   type Integration,
 } from 'teleport/services/integrations';
 import useStickyClusterId from 'teleport/useStickyClusterId';
 
-import { DeleteRequestOptions } from './IntegrationOperations';
+import { type DeleteRequestOptions } from './IntegrationOperations';
 
 export function useIntegrationOperation() {
   const { clusterId } = useStickyClusterId();
@@ -105,4 +106,4 @@ export type Operation = {
   item?: Integration;
 };
 
-export type EditableIntegration = IntegrationAwsOidc;
+export type EditableIntegration = IntegrationAwsOidc | IntegrationAwsRa;
diff --git a/web/packages/teleport/src/Integrations/fixtures.ts b/web/packages/teleport/src/Integrations/fixtures.ts
index 5018af93bc351..a195f219cf128 100644
--- a/web/packages/teleport/src/Integrations/fixtures.ts
+++ b/web/packages/teleport/src/Integrations/fixtures.ts
@@ -97,6 +97,14 @@ export const plugins: Plugin[] = [
     statusCode: IntegrationStatusCode.Running,
     spec: {},
   },
+  {
+    resourceType: 'plugin',
+    name: 'intune',
+    details: '',
+    kind: 'intune',
+    statusCode: IntegrationStatusCode.Running,
+    spec: {},
+  },
   {
     resourceType: 'plugin',
     name: 'servicenow',
@@ -193,6 +201,23 @@ export const integrations: Integration[] = [
     details: 'some-detail',
     spec: { organization: 'lsdf' },
   },
+  {
+    resourceType: 'integration',
+    name: 'roles-anywhere',
+    kind: IntegrationKind.AwsRa,
+    statusCode: IntegrationStatusCode.Running,
+    details: 'some-detail',
+    spec: {
+      trustAnchorARN:
+        'arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/foo',
+      profileSyncConfig: {
+        enabled: true,
+        profileArn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:profile/bar',
+        roleArn: 'arn:aws:rolesanywhere:eu-west-2:123456789012:role/baz',
+        filters: ['test-*', 'dev-*'],
+      },
+    },
+  },
 ];
 
 export const externalAuditStorage: ExternalAuditStorage = {
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.story.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.story.tsx
index 06c54e9c99a3a..de726e5542423 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.story.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.story.tsx
@@ -16,6 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { http, HttpResponse } from 'msw';
+
 import {
   makeErrorAttempt,
   makeProcessingAttempt,
@@ -31,6 +33,18 @@ import { makeAwsOidcStatusContextState } from './testHelpers/makeAwsOidcStatusCo
 
 export default {
   title: 'Teleport/Integrations/AwsOidc',
+  parameters: {
+    msw: {
+      handlers: [
+        http.get(cfg.getIntegrationsUrl(), () => {
+          return HttpResponse.json({
+            items: [],
+            nextKey: '',
+          });
+        }),
+      ],
+    },
+  },
 };
 
 const setup = {
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.test.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.test.tsx
index 91b54d4801e65..378d9bb7e3d49 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.test.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.test.tsx
@@ -23,71 +23,84 @@ import { render, screen } from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
 import { makeSuccessAttempt } from 'shared/hooks/useAsync';
 
+import { ContextProvider } from 'teleport/index';
 import { AwsOidcDashboard } from 'teleport/Integrations/status/AwsOidc/AwsOidcDashboard';
 import { MockAwsOidcStatusProvider } from 'teleport/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider';
+import { createTeleportContext } from 'teleport/mocks/contexts';
 import {
   IntegrationAwsOidc,
   IntegrationKind,
+  integrationService,
   IntegrationWithSummary,
 } from 'teleport/services/integrations';
 
-test('renders header and stats cards', () => {
+jest.spyOn(integrationService, 'fetchIntegrations').mockResolvedValue({
+  items: [],
+  nextKey: '',
+});
+
+test('renders header and stats cards', async () => {
   render(
-    <MockAwsOidcStatusProvider
-      value={{
-        integrationAttempt: makeSuccessAttempt<IntegrationAwsOidc>({
-          resourceType: 'integration',
-          name: 'integration-one',
-          kind: IntegrationKind.AwsOidc,
-          spec: {
-            roleArn: 'arn:aws:iam::111456789011:role/bar',
-          },
-          statusCode: 1,
-        }),
-        statsAttempt: makeSuccessAttempt<IntegrationWithSummary>({
-          name: 'integration-one',
-          subKind: IntegrationKind.AwsOidc,
-          awsoidc: {
-            roleArn: 'arn:aws:iam::111456789011:role/bar',
-          },
-          unresolvedUserTasks: 1,
-          awsec2: {
-            rulesCount: 24,
-            resourcesFound: 12,
-            resourcesEnrollmentFailed: 3,
-            resourcesEnrollmentSuccess: 9,
-            discoverLastSync: new Date().getTime(),
-            ecsDatabaseServiceCount: 0, // irrelevant
-            unresolvedUserTasks: 0,
-          },
-          awsrds: {
-            rulesCount: 14,
-            resourcesFound: 5,
-            resourcesEnrollmentFailed: 5,
-            resourcesEnrollmentSuccess: 0,
-            discoverLastSync: addHours(new Date().getTime(), -4).getTime(),
-            ecsDatabaseServiceCount: 8, // relevant
-            unresolvedUserTasks: 0,
-          },
-          awseks: {
-            rulesCount: 33,
-            resourcesFound: 3,
-            resourcesEnrollmentFailed: 0,
-            resourcesEnrollmentSuccess: 3,
-            discoverLastSync: addHours(new Date().getTime(), -48).getTime(),
-            ecsDatabaseServiceCount: 0, // irrelevant
-            unresolvedUserTasks: 0,
-          },
-        }),
-      }}
-      path=""
-    >
-      <InfoGuidePanelProvider>
-        <AwsOidcDashboard />
-      </InfoGuidePanelProvider>
-    </MockAwsOidcStatusProvider>
+    <ContextProvider ctx={createTeleportContext()}>
+      <MockAwsOidcStatusProvider
+        value={{
+          integrationAttempt: makeSuccessAttempt<IntegrationAwsOidc>({
+            resourceType: 'integration',
+            name: 'integration-one',
+            kind: IntegrationKind.AwsOidc,
+            spec: {
+              roleArn: 'arn:aws:iam::111456789011:role/bar',
+            },
+            statusCode: 1,
+          }),
+          statsAttempt: makeSuccessAttempt<IntegrationWithSummary>({
+            name: 'integration-one',
+            subKind: IntegrationKind.AwsOidc,
+            awsra: undefined,
+            rolesAnywhereProfileSync: undefined,
+            awsoidc: {
+              roleArn: 'arn:aws:iam::111456789011:role/bar',
+            },
+            unresolvedUserTasks: 1,
+            awsec2: {
+              rulesCount: 24,
+              resourcesFound: 12,
+              resourcesEnrollmentFailed: 3,
+              resourcesEnrollmentSuccess: 9,
+              discoverLastSync: new Date().getTime(),
+              ecsDatabaseServiceCount: 0, // irrelevant
+              unresolvedUserTasks: 0,
+            },
+            awsrds: {
+              rulesCount: 14,
+              resourcesFound: 5,
+              resourcesEnrollmentFailed: 5,
+              resourcesEnrollmentSuccess: 0,
+              discoverLastSync: addHours(new Date().getTime(), -4).getTime(),
+              ecsDatabaseServiceCount: 8, // relevant
+              unresolvedUserTasks: 0,
+            },
+            awseks: {
+              rulesCount: 33,
+              resourcesFound: 3,
+              resourcesEnrollmentFailed: 0,
+              resourcesEnrollmentSuccess: 3,
+              discoverLastSync: addHours(new Date().getTime(), -48).getTime(),
+              ecsDatabaseServiceCount: 0, // irrelevant
+              unresolvedUserTasks: 0,
+            },
+          }),
+        }}
+        path=""
+      >
+        <InfoGuidePanelProvider>
+          <AwsOidcDashboard />
+        </InfoGuidePanelProvider>
+      </MockAwsOidcStatusProvider>
+    </ContextProvider>
   );
 
+  await screen.findByText('Running');
   const breadcrumbs = screen.getByTestId('aws-oidc-header');
   expect(within(breadcrumbs).getByText('integration-one')).toBeInTheDocument();
 
@@ -161,35 +174,39 @@ test('renders enroll cards', () => {
   };
 
   render(
-    <MockAwsOidcStatusProvider
-      value={{
-        integrationAttempt: makeSuccessAttempt({
-          resourceType: 'integration',
-          name: 'integration-one',
-          kind: IntegrationKind.AwsOidc,
-          spec: {
-            roleArn: 'arn:aws:iam::111456789011:role/bar',
-          },
-          statusCode: 1,
-        }),
-        statsAttempt: makeSuccessAttempt({
-          name: 'integration-one',
-          subKind: IntegrationKind.AwsOidc,
-          unresolvedUserTasks: 0,
-          awsoidc: {
-            roleArn: 'arn:aws:iam::111456789011:role/bar',
-          },
-          awsec2: zeroCount,
-          awsrds: zeroCount,
-          awseks: zeroCount,
-        }),
-      }}
-      path=""
-    >
-      <InfoGuidePanelProvider>
-        <AwsOidcDashboard />
-      </InfoGuidePanelProvider>
-    </MockAwsOidcStatusProvider>
+    <ContextProvider ctx={createTeleportContext()}>
+      <MockAwsOidcStatusProvider
+        value={{
+          integrationAttempt: makeSuccessAttempt({
+            resourceType: 'integration',
+            name: 'integration-one',
+            kind: IntegrationKind.AwsOidc,
+            spec: {
+              roleArn: 'arn:aws:iam::111456789011:role/bar',
+            },
+            statusCode: 1,
+          }),
+          statsAttempt: makeSuccessAttempt({
+            name: 'integration-one',
+            subKind: IntegrationKind.AwsOidc,
+            unresolvedUserTasks: 0,
+            awsra: undefined,
+            rolesAnywhereProfileSync: undefined,
+            awsoidc: {
+              roleArn: 'arn:aws:iam::111456789011:role/bar',
+            },
+            awsec2: zeroCount,
+            awsrds: zeroCount,
+            awseks: zeroCount,
+          }),
+        }}
+        path=""
+      >
+        <InfoGuidePanelProvider>
+          <AwsOidcDashboard />
+        </InfoGuidePanelProvider>
+      </MockAwsOidcStatusProvider>
+    </ContextProvider>
   );
 
   expect(
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.tsx
index de226cb407469..51397926cc25f 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcDashboard.tsx
@@ -16,6 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { useQuery } from '@tanstack/react-query';
+import { useState } from 'react';
+
 import { Box, Flex, Indicator } from 'design';
 import { Danger } from 'design/Alert';
 
@@ -25,14 +28,41 @@ import { AwsOidcTitle } from 'teleport/Integrations/status/AwsOidc/AwsOidcTitle'
 import {
   AwsResource,
   StatCard,
-} from 'teleport/Integrations/status/AwsOidc/StatCard';
+} from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { TaskAlert } from 'teleport/Integrations/status/AwsOidc/Tasks/TaskAlert';
 import { useAwsOidcStatus } from 'teleport/Integrations/status/AwsOidc/useAwsOidcStatus';
+import {
+  IntegrationKind,
+  integrationService,
+} from 'teleport/services/integrations';
+import useTeleport from 'teleport/useTeleport';
+
+import { ConsoleCardEnroll } from './Cards/ConsoleCard';
 
 export function AwsOidcDashboard() {
+  const ctx = useTeleport();
+  const integrationsAccess = ctx.storeUser.getIntegrationsAccess();
+  const canList = integrationsAccess.list;
   const { statsAttempt, integrationAttempt } = useAwsOidcStatus();
+  const [enrolledCli, setEnrolledCli] = useState(false);
+
+  // Get the list of integrations and see if roles anywhere as been enrolled.
+  // If not, show an enrollment card below. If yes, or in the case of an error: show nothing
+  const { status: listStatus } = useQuery({
+    enabled: canList,
+    queryKey: ['integrations'],
+    gcTime: 0,
+    queryFn: () =>
+      integrationService.fetchIntegrations().then(data => {
+        if (data.items.some(i => i.kind === IntegrationKind.AwsRa)) {
+          setEnrolledCli(true);
+        }
+        return data;
+      }),
+  });
 
   if (
+    listStatus === 'pending' ||
     statsAttempt.status === 'processing' ||
     integrationAttempt.status === 'processing'
   ) {
@@ -73,23 +103,25 @@ export function AwsOidcDashboard() {
         <Flex gap={3}>
           <StatCard
             name={integration.name}
-            item="instances"
             resource={AwsResource.ec2}
             summary={awsec2}
           />
           <StatCard
             name={integration.name}
-            item="databases"
             resource={AwsResource.rds}
             summary={awsrds}
           />
           <StatCard
             name={integration.name}
-            item="clusters"
             resource={AwsResource.eks}
             summary={awseks}
           />
         </Flex>
+        {listStatus === 'success' && !enrolledCli && (
+          <Flex>
+            <ConsoleCardEnroll />
+          </Flex>
+        )}
       </FeatureBox>
     </>
   );
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcHeader.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcHeader.tsx
index 2c8aae5ecdb0c..06ec6c8494b25 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcHeader.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcHeader.tsx
@@ -23,7 +23,7 @@ import { Plugs } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
 
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { Integration } from 'teleport/services/integrations';
 
 export function AwsOidcHeader({
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.test.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.test.tsx
index cdccaf21b82ce..71f5bf1ad8ad8 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.test.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.test.tsx
@@ -22,7 +22,7 @@ import { render, screen } from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
 
 import { AwsOidcTitle } from 'teleport/Integrations/status/AwsOidc/AwsOidcTitle';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import {
   IntegrationAwsOidc,
   IntegrationKind,
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.tsx
index d0ff2a65e40a6..1259d610134a4 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/AwsOidcTitle.tsx
@@ -33,9 +33,11 @@ import {
   IntegrationOperations,
   useIntegrationOperation,
 } from 'teleport/Integrations/Operations';
+import { type DeleteRequestOptions } from 'teleport/Integrations/Operations/IntegrationOperations';
 import type { EditableIntegrationFields } from 'teleport/Integrations/Operations/useIntegrationOperation';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { IntegrationAwsOidc } from 'teleport/services/integrations';
+import { splitAwsIamArn } from 'teleport/services/integrations/aws';
 
 import { DashboardGuide, Ec2Guide, EksGuide, RdsGuide } from './guides';
 
@@ -54,8 +56,8 @@ export function AwsOidcTitle({
   const { status, labelKind } = getStatusAndLabel(integration);
   const content = getContent(integration, resource, tasks);
 
-  async function removeIntegration() {
-    await integrationOps.remove();
+  async function removeIntegration(opt: DeleteRequestOptions) {
+    await integrationOps.remove(opt);
     integrationOps.clear();
     history.push(cfg.routes.integrations);
   }
@@ -65,6 +67,10 @@ export function AwsOidcTitle({
     integrationOps.clear();
   }
 
+  const { arnResourceName: roleArnResourceName } = splitAwsIamArn(
+    integration.spec?.roleArn
+  );
+
   return (
     <Flex mt={3} justifyContent="space-between" alignItems="center">
       <Flex alignItems="center" data-testid="aws-oidc-title">
@@ -82,21 +88,23 @@ export function AwsOidcTitle({
               {status}
             </Label>
           </Flex>
-          <Flex gap={1}>
-            Role ARN:{' '}
-            <Link
-              target="_blank"
-              href={`https://console.aws.amazon.com/iamv2/home#/roles/details/${integration.name}`}
-            >
-              <Text
-                style={{
-                  fontFamily: theme.fonts.mono,
-                }}
+          {integration.spec && (
+            <Flex gap={1}>
+              Role ARN:{' '}
+              <Link
+                target="_blank"
+                href={`https://console.aws.amazon.com/iamv2/home#/roles/details/${roleArnResourceName}`}
               >
-                {integration.spec?.roleArn}
-              </Text>
-            </Link>
-          </Flex>
+                <Text
+                  style={{
+                    fontFamily: theme.fonts.mono,
+                  }}
+                >
+                  {integration.spec.roleArn}
+                </Text>
+              </Link>
+            </Flex>
+          )}
         </Flex>
       </Flex>
       <Flex gap={1} alignItems="center">
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/Cards.story.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/Cards.story.tsx
new file mode 100644
index 0000000000000..35b595fbfb2ef
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/Cards.story.tsx
@@ -0,0 +1,132 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MemoryRouter } from 'react-router';
+
+import { Box, H3 } from 'design';
+
+import {
+  ConsoleCardEnroll,
+  ConsoleCardEnrolled,
+} from 'teleport/Integrations/status/AwsOidc/Cards/ConsoleCard';
+import {
+  AwsResource,
+  StatCard,
+} from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
+import { RolesAnywhereProfileSync } from 'teleport/services/integrations';
+
+export default {
+  title: 'Teleport/Integrations/Cards',
+};
+
+export function StatCards() {
+  const baseSummary = {
+    discoverLastSync: 9,
+    ecsDatabaseServiceCount: 0,
+    resourcesEnrollmentFailed: 7,
+    resourcesEnrollmentSuccess: 8,
+    resourcesFound: 6,
+    rulesCount: 5,
+    unresolvedUserTasks: 10,
+  };
+
+  const cases = [
+    {
+      name: 'Enrolled EC2',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.ec2,
+        summary: baseSummary,
+      },
+    },
+    {
+      name: 'Un-enrolled EC2',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.ec2,
+      },
+    },
+    {
+      name: 'Enrolled EKS',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.eks,
+        summary: baseSummary,
+      },
+    },
+    {
+      name: 'Un-enrolled EKS',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.eks,
+      },
+    },
+    {
+      name: 'Enrolled RDS',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.rds,
+        summary: {
+          ...baseSummary,
+          ecsDatabaseServiceCount: 22,
+        },
+      },
+    },
+    {
+      name: 'Un-enrolled RDS',
+      props: {
+        name: 'some-name',
+        resource: AwsResource.rds,
+      },
+    },
+  ];
+  return (
+    <MemoryRouter>
+      {cases.map(c => (
+        <Box key={c.name} mb={2}>
+          <H3>{c.name}</H3>
+          <StatCard key={c.name} {...c.props} />
+        </Box>
+      ))}
+    </MemoryRouter>
+  );
+}
+
+export function ConsoleCards() {
+  const stats: RolesAnywhereProfileSync = {
+    syncedProfiles: 13,
+    syncEndTime: new Date().getTime(),
+    enabled: false,
+    status: '',
+    errorMessage: '',
+    syncStartTime: new Date().getTime(),
+  };
+
+  return (
+    <MemoryRouter>
+      <Box mb={2}>
+        <H3>Un-enrolled CLI</H3>
+        <ConsoleCardEnroll />
+      </Box>
+      <Box mb={2}>
+        <H3>Enrolled CLI</H3>
+        <ConsoleCardEnrolled stats={stats} />
+      </Box>
+    </MemoryRouter>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/ConsoleCard.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/ConsoleCard.tsx
new file mode 100644
index 0000000000000..8b90a09755373
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/ConsoleCard.tsx
@@ -0,0 +1,133 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import { Link as InternalLink } from 'react-router-dom';
+import styled, { useTheme } from 'styled-components';
+
+import { P3, SyncStamp, Text } from 'design';
+import Box from 'design/Box';
+import { CardTile } from 'design/CardTile';
+import Flex from 'design/Flex';
+import * as Icons from 'design/Icon';
+import { H2, H3, P2 } from 'design/Text';
+
+import cfg from 'teleport/config';
+import {
+  IntegrationKind,
+  RolesAnywhereProfileSync,
+} from 'teleport/services/integrations';
+
+export function ConsoleCardEnrolled({
+  stats,
+}: {
+  stats: RolesAnywhereProfileSync;
+}) {
+  const theme = useTheme();
+  const { syncedProfiles, syncEndTime } = stats;
+  const updated = syncEndTime ? new Date(syncEndTime) : undefined;
+
+  return (
+    <CardTile width="100%" data-testid={`console-enrolled`}>
+      <Flex flexDirection="column" justifyContent="space-between" height="100%">
+        <Box>
+          <Flex alignItems="center" justifyContent="space-between">
+            <H2>AWS Console and CLI Access</H2>
+            <Chip
+              backgroundColor="interactive.tonal.success.0"
+              pr={3}
+              pl={2}
+              py={1}
+            >
+              <Icons.CircleCheck
+                size="small"
+                color="interactive.solid.success.default"
+              />
+              <Text
+                color="interactive.solid.success.default"
+                typography="body3"
+              >
+                Enabled
+              </Text>
+            </Chip>
+          </Flex>
+          <P2 mb={2} color="text.slightlyMuted">
+            Sync AWS IAM Roles Anywhere Profiles with Teleport
+          </P2>
+        </Box>
+        <Flex gap={3} my={3}>
+          <Box>
+            <Text fontWeight="500" fontSize={9} mb={2} css={{ lineHeight: 1 }}>
+              {syncedProfiles || 0}
+            </Text>
+            <H3>Profiles</H3>
+            {syncedProfiles > 0 ? (
+              <P3 color="text.muted" mb={1}>
+                {' '}
+                AWS Roles Anywhere Profiles are available on the{' '}
+                <InternalLink
+                  to={cfg.getUnifiedResourcesRoute(cfg.proxyCluster)}
+                  style={{ color: theme.colors.text.muted }}
+                >
+                  Resources Page.
+                </InternalLink>
+              </P3>
+            ) : (
+              <P3 color="text.muted" mb={1}>
+                Edit the integration to sync profiles.
+              </P3>
+            )}
+          </Box>
+        </Flex>
+        <SyncStamp date={updated} />
+      </Flex>
+    </CardTile>
+  );
+}
+
+export function ConsoleCardEnroll() {
+  return (
+    <CardTile
+      width="100%"
+      data-testid={`console-enroll`}
+      as={InternalLink}
+      to={cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa)}
+    >
+      <Flex flexDirection="column" justifyContent="space-between" height="100%">
+        <Box>
+          <Flex alignItems="center">
+            <H2>AWS Console and CLI Access</H2>
+          </Flex>
+          <P2 mb={2} color="text.slightlyMuted">
+            Configure access to your AWS account.
+          </P2>
+        </Box>
+        <Flex alignItems="center" gap={2}>
+          <H3>Enable Access</H3>
+          <Icons.ArrowForward />
+        </Flex>
+      </Flex>
+    </CardTile>
+  );
+}
+
+const Chip = styled(Flex).attrs({
+  flexDirection: 'row',
+  alignItems: 'center',
+  gap: 1,
+})`
+  border-radius: 999px;
+`;
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/StatCard.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/StatCard.tsx
similarity index 75%
rename from web/packages/teleport/src/Integrations/status/AwsOidc/StatCard.tsx
rename to web/packages/teleport/src/Integrations/status/AwsOidc/Cards/StatCard.tsx
index 603e3adeb2db8..c77d2e55705b8 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/StatCard.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Cards/StatCard.tsx
@@ -15,16 +15,14 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-
 import { Link as InternalLink } from 'react-router-dom';
 
-import { CardTile, Flex, H2, P2, Text } from 'design';
+import { Box, CardTile, Flex, H2, H3, P2, Text } from 'design';
 import * as Icons from 'design/Icon';
 import { ResourceIcon } from 'design/ResourceIcon';
 import { SyncStamp } from 'design/SyncStamp/SyncStamp';
 
 import cfg from 'teleport/config';
-import { EnrollCard } from 'teleport/Integrations/status/AwsOidc/EnrollCard';
 import {
   IntegrationKind,
   ResourceTypeSummary,
@@ -38,14 +36,17 @@ export enum AwsResource {
 
 type Item = 'clusters' | 'databases' | 'instances';
 
-type StatCardProps = {
+export function StatCard({
+  name,
+  resource,
+  summary,
+}: {
   name: string;
-  item: Item;
   resource: AwsResource;
   summary?: ResourceTypeSummary;
-};
+}) {
+  const item = getItem(resource);
 
-export function StatCard({ name, item, resource, summary }: StatCardProps) {
   const updated = summary?.discoverLastSync
     ? new Date(summary?.discoverLastSync)
     : undefined;
@@ -110,6 +111,42 @@ export function StatCard({ name, item, resource, summary }: StatCardProps) {
   );
 }
 
+function EnrollCard({
+  resource,
+  item,
+}: {
+  resource: AwsResource;
+  item: string;
+}) {
+  return (
+    <CardTile
+      width="33%"
+      data-testid={`${resource}-enroll`}
+      as={InternalLink}
+      to={{
+        pathname: cfg.routes.discover,
+        state: { searchKeywords: resource },
+      }}
+    >
+      <Flex flexDirection="column" justifyContent="space-between" height="100%">
+        <Box>
+          <Flex alignItems="center">
+            <ResourceIcon name={resource} mr={2} width="32px" height="32px" />
+            <H2>{resource.toUpperCase()}</H2>
+          </Flex>
+          <P2 mb={2}>
+            Discover and enroll {resource.toUpperCase()} {item}
+          </P2>
+        </Box>
+        <Flex alignItems="center" gap={2}>
+          <H3>Enroll {resource.toUpperCase()}</H3>
+          <Icons.ArrowForward />
+        </Flex>
+      </Flex>
+    </CardTile>
+  );
+}
+
 function getResourceTerm(resource: AwsResource): string {
   switch (resource) {
     case AwsResource.rds:
@@ -133,3 +170,15 @@ function foundResource(resource: ResourceTypeSummary): boolean {
 
   return resource.rulesCount != 0 || resource.resourcesFound != 0;
 }
+
+function getItem(resource: AwsResource): Item {
+  switch (resource) {
+    case AwsResource.eks:
+      return 'clusters';
+    case AwsResource.rds:
+      return 'databases';
+    case AwsResource.ec2:
+    default:
+      return 'instances';
+  }
+}
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Agents.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Agents.tsx
index 3575ac19d1287..283011bfebcf7 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Agents.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Agents.tsx
@@ -26,7 +26,7 @@ import Table, { LabelCell } from 'design/DataTable';
 import { useAsync } from 'shared/hooks/useAsync';
 
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import {
   AWSOIDCDeployedDatabaseService,
   IntegrationKind,
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.story.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.story.tsx
index 92c38f30c8f90..7976efbc27ee5 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.story.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.story.tsx
@@ -35,8 +35,8 @@
 import { http, HttpResponse } from 'msw';
 
 import cfg from 'teleport/config';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { Details } from 'teleport/Integrations/status/AwsOidc/Details/Details';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
 import { MockAwsOidcStatusProvider } from 'teleport/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider';
 import { IntegrationKind } from 'teleport/services/integrations';
 
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.tsx
index a54fbb9aec7f6..328256f33e314 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Details.tsx
@@ -23,9 +23,9 @@ import { Danger } from 'design/Alert';
 import { FeatureBox } from 'teleport/components/Layout';
 import { AwsOidcHeader } from 'teleport/Integrations/status/AwsOidc/AwsOidcHeader';
 import { AwsOidcTitle } from 'teleport/Integrations/status/AwsOidc/AwsOidcTitle';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { Rds } from 'teleport/Integrations/status/AwsOidc/Details/Rds';
 import { Rules } from 'teleport/Integrations/status/AwsOidc/Details/Rules';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
 import { TaskAlert } from 'teleport/Integrations/status/AwsOidc/Tasks/TaskAlert';
 import { useAwsOidcStatus } from 'teleport/Integrations/status/AwsOidc/useAwsOidcStatus';
 import { IntegrationKind } from 'teleport/services/integrations';
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rds.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rds.tsx
index e108755cef024..bd4a1a4fcae68 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rds.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rds.tsx
@@ -16,15 +16,19 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { useEffect, useRef } from 'react';
 import { useLocation, useParams } from 'react-router';
 
-import { TabBorder, TabContainer, TabsContainer } from 'design/Tabs/Tabs';
+import {
+  TabBorder,
+  TabContainerNavLink,
+  TabsContainer,
+  useSlidingBottomBorderTabs,
+} from 'design/Tabs';
 
 import cfg from 'teleport/config';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { Agents } from 'teleport/Integrations/status/AwsOidc/Details/Agents';
 import { Rules } from 'teleport/Integrations/status/AwsOidc/Details/Rules';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
 import { IntegrationKind } from 'teleport/services/integrations';
 
 export enum RdsTab {
@@ -43,38 +47,14 @@ export function Rds() {
   const searchParams = new URLSearchParams(search);
   const tab = (searchParams.get('tab') as RdsTab) || RdsTab.Rules;
 
-  const borderRef = useRef<HTMLDivElement>(null);
-  const parentRef = useRef<HTMLDivElement>(null);
-
-  // todo (michellescripts) the following implementation mimics the implementation of tabs in
-  //  e/web/teleport/src/AccessMonitoring/AccessMonitoring.tsx which is refactored/moved into a shared
-  //  design component, web/packages/design/src/Tabs/Tabs.ts. When refactoring AccessMonitoring to use the shared
-  //  component, consider updating both instances logic to be plain css
-  useEffect(() => {
-    if (!parentRef.current || !borderRef.current) {
-      return;
-    }
-
-    const activeElement = parentRef.current.querySelector(
-      `[data-tab-id="${tab}"]`
-    );
-
-    if (activeElement) {
-      const parentBounds = parentRef.current.getBoundingClientRect();
-      const activeBounds = activeElement.getBoundingClientRect();
-
-      const left = activeBounds.left - parentBounds.left;
-      const width = activeBounds.width;
-
-      borderRef.current.style.left = `${left}px`;
-      borderRef.current.style.width = `${width}px`;
-    }
-  }, [tab]);
+  const { borderRef, parentRef } = useSlidingBottomBorderTabs({
+    activeTab: tab,
+  });
 
   return (
     <>
-      <TabsContainer ref={parentRef}>
-        <TabContainer
+      <TabsContainer ref={parentRef} withBottomBorder px={5}>
+        <TabContainerNavLink
           data-tab-id={RdsTab.Rules}
           selected={tab === RdsTab.Rules}
           to={`${cfg.getIntegrationStatusResourcesRoute(
@@ -84,8 +64,8 @@ export function Rds() {
           )}?tab=${RdsTab.Rules}`}
         >
           Enrollment Rules
-        </TabContainer>
-        <TabContainer
+        </TabContainerNavLink>
+        <TabContainerNavLink
           data-tab-id={RdsTab.Agents}
           selected={tab === RdsTab.Agents}
           to={`${cfg.getIntegrationStatusResourcesRoute(
@@ -95,7 +75,7 @@ export function Rds() {
           )}?tab=${RdsTab.Agents}`}
         >
           Agents
-        </TabContainer>
+        </TabContainerNavLink>
         <TabBorder ref={borderRef} />
       </TabsContainer>
       {tab === RdsTab.Rules && <Rules />}
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rules.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rules.tsx
index f8e261a9d6272..ee2f0d08b6695 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rules.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Details/Rules.tsx
@@ -25,7 +25,7 @@ import Table, { LabelCell } from 'design/DataTable';
 
 import { useServerSidePagination } from 'teleport/components/hooks';
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import {
   IntegrationDiscoveryRule,
   IntegrationKind,
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/EnrollCard.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/EnrollCard.tsx
deleted file mode 100644
index 603c1a01797b6..0000000000000
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/EnrollCard.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2025 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { Link as InternalLink } from 'react-router-dom';
-
-import { Box, CardTile, Flex, H2, H3, P2, ResourceIcon } from 'design';
-import * as Icons from 'design/Icon';
-
-import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
-
-export function EnrollCard({
-  resource,
-  item,
-}: {
-  resource: AwsResource;
-  item: string;
-}) {
-  return (
-    <CardTile
-      width="33%"
-      data-testid={`${resource}-enroll`}
-      as={InternalLink}
-      to={{
-        pathname: cfg.routes.discover,
-        state: { searchKeywords: resource },
-      }}
-    >
-      <Flex flexDirection="column" justifyContent="space-between" height="100%">
-        <Box>
-          <Flex alignItems="center">
-            <ResourceIcon name={resource} mr={2} width="32px" height="32px" />
-            <H2>{resource.toUpperCase()}</H2>
-          </Flex>
-          <P2 mb={2}>
-            Discover and enroll {resource.toUpperCase()} {item}
-          </P2>
-        </Box>
-        <Flex alignItems="center" gap={2}>
-          <H3>Enroll {resource.toUpperCase()}</H3>
-          <Icons.ArrowForward />
-        </Flex>
-      </Flex>
-    </CardTile>
-  );
-}
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.test.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.test.tsx
index 699707fd0ce39..04c9786298c67 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.test.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.test.tsx
@@ -36,7 +36,7 @@ test('renders ec2 impacts', async () => {
     issueType: 'ec2-ssm-invocation-failure',
     title: 'ec2 ssm invocation failure',
     description:
-      'Teleport failed to access the SSM Agent to auto enroll the instance.\nSome instances failed to communicate with the AWS Systems Manager service to execute the install script.\n\nUsually this happens when:\n\n**Missing policies**\n\nThe IAM Role used by the integration might be missing some required permissions.\nEnsure the following actions are allowed in the IAM Role used by the integration:\n- `ec2:DescribeInstances`\n- `ssm:DescribeInstanceInformation`\n- `ssm:GetCommandInvocation`\n- `ssm:ListCommandInvocations`\n- `ssm:SendCommand`\n\n**SSM Document is invalid**\n\nTeleport uses an SSM Document to run an installation script.\nIf the document is changed or removed, it might no longer work.',
+      'Teleport failed to access the SSM Agent to auto enroll the instance.\nSome instances failed to communicate with the AWS Systems Manager service to execute the install script.\n\nUsually this happens when:\n\n**Missing policies**\n\nThe IAM Role used by the integration might be missing some required permissions.\nEnsure the following actions are allowed in the IAM Role used by the integration:\n- `account:ListRegions`\n- `ec2:DescribeInstances`\n- `ssm:DescribeInstanceInformation`\n- `ssm:GetCommandInvocation`\n- `ssm:ListCommandInvocations`\n- `ssm:SendCommand`\n\n**SSM Document is invalid**\n\nTeleport uses an SSM Document to run an installation script.\nIf the document is changed or removed, it might no longer work.',
     discoverEks: undefined,
     discoverRds: undefined,
     discoverEc2: {
@@ -189,6 +189,11 @@ test('renders rds impacts', async () => {
     header: ['Name'],
     rows: [['i-016e32a5882f5ee81'], ['i-065818031835365cc']],
   });
+  const link = screen.getByRole('link', { name: 'IAM authentication' });
+  expect(link).toHaveAttribute(
+    'href',
+    'https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html'
+  );
   jest.resetAllMocks();
 });
 
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.tsx
index 49648dcc59053..07bd9c1f467c3 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Task.tsx
@@ -17,8 +17,7 @@
  */
 
 import { PropsWithChildren, useEffect } from 'react';
-import ReactMarkdown from 'react-markdown';
-import styled, { useTheme } from 'styled-components';
+import styled from 'styled-components';
 
 import {
   Alert,
@@ -27,12 +26,14 @@ import {
   Link as ExternalLink,
   Flex,
   H2,
+  Indicator,
 } from 'design';
 import { Danger } from 'design/Alert';
 import Table, { Cell } from 'design/DataTable';
 import { TableColumn } from 'design/DataTable/types';
 import * as Icons from 'design/Icon';
 import { H3, P2, P3, Subtitle2 } from 'design/Text';
+import { Markdown } from 'shared/components/Markdown/Markdown';
 import { Attempt, useAsync } from 'shared/hooks/useAsync';
 import useAttempt from 'shared/hooks/useAttemptNext';
 import { getErrMessage } from 'shared/utils/errorType';
@@ -50,7 +51,7 @@ import {
   UserTaskDetail,
 } from 'teleport/services/integrations';
 
-import { AwsResource } from '../StatCard';
+import { AwsResource } from '../Cards/StatCard';
 import { SidePanel } from './SidePanel';
 
 export function Task({
@@ -60,7 +61,6 @@ export function Task({
   name: string;
   close: (resolved: boolean) => void;
 }) {
-  const theme = useTheme();
   const { attempt, setAttempt } = useAttempt('');
 
   const [taskAttempt, fetchTask] = useAsync(() =>
@@ -79,6 +79,14 @@ export function Task({
     );
   }
 
+  if (taskAttempt.status === 'processing') {
+    return (
+      <SidePanel onClose={() => close(false)}>
+        <Indicator />
+      </SidePanel>
+    );
+  }
+
   if (!taskAttempt.data) {
     return null;
   }
@@ -163,26 +171,7 @@ export function Task({
       <H3 my={2} style={{ overflow: 'unset' }}>
         Details
       </H3>
-      <ReactMarkdown
-        components={{
-          a(props) {
-            return (
-              <a
-                style={{
-                  fontStyle: 'unset',
-                  color: theme.colors.buttons.link.default,
-                  background: 'none',
-                  textDecoration: 'underline',
-                  textTransform: 'none',
-                }}
-                {...props}
-              />
-            );
-          },
-        }}
-      >
-        {taskAttempt.data.description}
-      </ReactMarkdown>
+      <Markdown text={taskAttempt.data.description} enableLinks />
       <H3 my={2} style={{ overflow: 'unset' }}>
         Impacted instances ({Object.keys(impacts).length})
       </H3>
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/TaskAlert.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/TaskAlert.tsx
index ad4938bae021f..8900356575a6b 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/TaskAlert.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/TaskAlert.tsx
@@ -21,7 +21,7 @@ import { Alert } from 'design';
 import { ArrowForward, BellRinging } from 'design/Icon';
 
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { IntegrationKind } from 'teleport/services/integrations';
 
 export function TaskAlert({
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.story.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.story.tsx
index a9e4c9c2fe316..824958775afa4 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.story.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.story.tsx
@@ -74,9 +74,35 @@ TaskView.parameters = {
                 name: 'rds-detail',
                 taskType: 'discover-rds',
                 state: TaskState.Open,
-                issueType: 'rds-generic',
+                issueType: 'rds-auth-disabled',
                 integration: integrationName,
                 lastStateChange: '2022-02-12T20:32:19.482607921Z',
+                // lib/usertasks/descriptions/rds-iam-auth-disabled.md
+                description: `
+                # IAM Auth disabled
+The Teleport Database Service uses [IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html) to communicate with RDS.
+
+The following RDS databases do not have IAM authentication enabled.
+
+You can enable by modifying the IAM DB Authentication property of the database.
+                `,
+                title: 'rds-auth-disabled',
+                discoverRds: {
+                  databases: {
+                    'i-01568fcc52b7071cd': {
+                      name: 'i-01568fcc52b7071cd',
+                      is_cluster: true,
+                      engine: 'aurora',
+                      discovery_config: 'ee2f2480-09d3-4409-80f5-183549706446',
+                      discovery_group: 'cloud-discovery-group',
+                      sync_time: {
+                        seconds: -62135596800,
+                      },
+                      resourceUrl:
+                        'https://console.aws.amazon.com/ec2/home?region=us-east-2#InstanceDetails:instanceId=i-01568fcc52b7071cd',
+                    },
+                  },
+                },
               },
               {
                 name: 'ec2-detail',
@@ -85,29 +111,100 @@ TaskView.parameters = {
                 issueType: 'ec2-ssm-invocation-failure',
                 integration: integrationName,
                 lastStateChange: '2025-02-11T20:32:19.482607921Z',
-              },
-              {
-                name: 'ec2-detail',
-                taskType: 'discover-ec2',
-                state: TaskState.Open,
-                issueType: 'ec2-ssm-agent-not-registered',
-                integration: integrationName,
-                lastStateChange: '2025-02-11T20:32:13.61608091Z',
+                title: 'ec2-detail',
+                // lib/usertasks/descriptions/ec2-ssm-invocation-failure.md
+                description: `
+                # SSM Invocation failed
+Teleport failed to access the SSM Agent to auto enroll the instance.
+Some instances failed to communicate with the AWS Systems Manager service to execute the install script.
+
+Usually this happens when:
+
+**Missing policies**
+
+The IAM Role used by the integration might be missing some required permissions.
+Ensure the following actions are allowed in the IAM Role used by the integration:
+- \`account:ListRegions\`
+- \`ec2:DescribeInstances\`
+- \`ssm:DescribeInstanceInformation\`
+- \`ssm:GetCommandInvocation\`
+- \`ssm:ListCommandInvocations\`
+- \`ssm:SendCommand\`
+
+**SSM Document is invalid**
+
+Teleport uses an SSM Document to run an installation script.
+If the document is changed or removed, it might no longer work.
+`,
+                discoverEc2: {
+                  instances: {
+                    'i-01568fcc52b7071cd': {
+                      instance_id: 'i-01568fcc52b7071cd',
+                      discovery_config: 'ee2f2480-09d3-4409-80f5-183549706446',
+                      discovery_group: 'cloud-discovery-group',
+                      sync_time: {
+                        seconds: -62135596800,
+                      },
+                      resourceUrl:
+                        'https://console.aws.amazon.com/ec2/home?region=us-east-2#InstanceDetails:instanceId=i-01568fcc52b7071cd',
+                    },
+                    'i-019e54b3f58bfa9fd': {
+                      instance_id: 'i-019e54b3f58bfa9fd',
+                      name: 'travis-test-tcp4',
+                      discovery_config: 'ee2f2480-09d3-4409-80f5-183549706446',
+                      discovery_group: 'cloud-discovery-group',
+                      sync_time: {
+                        seconds: -62135596800,
+                      },
+                      resourceUrl:
+                        'https://console.aws.amazon.com/ec2/home?region=us-east-2#InstanceDetails:instanceId=i-019e54b3f58bfa9fd',
+                    },
+                  },
+                },
               },
               {
                 name: 'no match',
                 state: TaskState.Open,
                 issueType: 'side panel error',
                 integration: integrationName,
+                title: 'no match',
                 lastStateChange: '0',
+                instances: [],
               },
               {
                 name: 'eks-detail',
                 taskType: 'discover-eks',
                 state: TaskState.Open,
-                issueType: 'eks-failure',
+                issueType: 'eks-agent-not-connecting',
                 integration: integrationName,
                 lastStateChange: '2025-02-11T20:32:13.61608091Z',
+                title: 'eks-agent-not-connecting',
+                // lib/usertasks/descriptions/eks-agent-not-connecting.md
+                description: `
+                # Teleport Agent not connecting
+The process of automatically enrolling EKS Clusters into Teleport, starts by installing the [\`teleport-kube-agent\`](https://goteleport.com/docs/reference/helm-reference/teleport-kube-agent/) to the cluster.
+
+If the installation is successful, the EKS Cluster will appear in your Resources list.
+
+However, the following EKS Clusters did not automatically enrolled.
+This usually happens when the installation is taking too long or there was an error preventing the HELM chart installation.
+
+Open the Teleport Agent to get more information.
+`,
+                discoverEks: {
+                  clusters: {
+                    'i-01568fcc52b7071cd': {
+                      name: 'i-01568fcc52b7071cd',
+                      discovery_config: 'ee2f2480-09d3-4409-80f5-183549706446',
+                      discovery_group: 'cloud-discovery-group',
+                      sync_time: {
+                        seconds: -62135596800,
+                      },
+                      resourceUrl:
+                        'https://console.aws.amazon.com/ec2/home?region=us-east-2#InstanceDetails:instanceId=i-01568fcc52b7071cd',
+                    },
+                  },
+                },
               },
             ],
             nextKey: '1',
@@ -136,7 +233,7 @@ const ec2Detail = {
   issueType: 'ec2-ssm-invocation-failure',
   title: 'EC2 failure',
   description:
-    'Teleport failed to access the SSM Agent to auto enroll the instance.\nSome instances failed to communicate with the AWS Systems Manager service to execute the install script.\n\nUsually this happens when:\n\n**Missing policies**\n\nThe IAM Role used by the integration might be missing some required permissions.\nEnsure the following actions are allowed in the IAM Role used by the integration:\n- `ec2:DescribeInstances`\n- `ssm:DescribeInstanceInformation`\n- `ssm:GetCommandInvocation`\n- `ssm:ListCommandInvocations`\n- `ssm:SendCommand`\n\n**SSM Document is invalid**\n\nTeleport uses an SSM Document to run an installation script.\nIf the document is changed or removed, it might no longer work.',
+    'Teleport failed to access the SSM Agent to auto enroll the instance.\nSome instances failed to communicate with the AWS Systems Manager service to execute the install script.\n\nUsually this happens when:\n\n**Missing policies**\n\nThe IAM Role used by the integration might be missing some required permissions.\nEnsure the following actions are allowed in the IAM Role used by the integration:\n- `account:ListRegions`\n- `ec2:DescribeInstances`\n- `ssm:DescribeInstanceInformation`\n- `ssm:GetCommandInvocation`\n- `ssm:ListCommandInvocations`\n- `ssm:SendCommand`\n\n**SSM Document is invalid**\n\nTeleport uses an SSM Document to run an installation script.\nIf the document is changed or removed, it might no longer work.',
   discoverEc2: {
     region: 'us-east-2',
     instances: {
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.tsx
index e40df4f15d7b9..2add842f17963 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/Tasks/Tasks.tsx
@@ -16,14 +16,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { useEffect, useState } from 'react';
-import { useHistory } from 'react-router';
+import { useEffect, useMemo, useState } from 'react';
+import { useHistory, useLocation } from 'react-router';
 import styled, { useTheme } from 'styled-components';
 
 import { Flex, Indicator } from 'design';
 import { Danger } from 'design/Alert';
 import Table, { Cell } from 'design/DataTable';
-import { Notification, NotificationItem } from 'shared/components/Notification';
+import {
+  ToastNotification,
+  ToastNotificationItem,
+} from 'shared/components/ToastNotification';
 
 import { useServerSidePagination } from 'teleport/components/hooks';
 import { FeatureBox } from 'teleport/components/Layout';
@@ -38,8 +41,9 @@ import { integrationService, UserTask } from 'teleport/services/integrations';
 export function Tasks() {
   const theme = useTheme();
   const history = useHistory();
-  const searchParams = new URLSearchParams(history.location.search);
-  const [notification, setNotification] = useState<NotificationItem>();
+  const { search } = useLocation();
+  const searchParams = useMemo(() => new URLSearchParams(search), [search]);
+  const [notification, setNotification] = useState<ToastNotificationItem>();
 
   const { integrationAttempt } = useAwsOidcStatus();
   const { data: integration } = integrationAttempt;
@@ -180,7 +184,7 @@ export function Tasks() {
           />
           {notification && (
             <NotificationContainer>
-              <Notification
+              <ToastNotification
                 key={notification.id}
                 item={notification}
                 onRemove={() => setNotification(undefined)}
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/helpers.ts b/web/packages/teleport/src/Integrations/status/AwsOidc/helpers.ts
index 6ea5ec62a159c..45f9f7ca38d9b 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/helpers.ts
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/helpers.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 
 export function getResourceType(type: string): AwsResource {
   switch (type) {
diff --git a/web/packages/teleport/src/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider.tsx b/web/packages/teleport/src/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider.tsx
index 6cc3d0129a8ca..a34d15dfac87a 100644
--- a/web/packages/teleport/src/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider.tsx
+++ b/web/packages/teleport/src/Integrations/status/AwsOidc/testHelpers/mockAwsOidcStatusProvider.tsx
@@ -28,19 +28,24 @@ import {
   AwsOidcStatusContextState,
 } from 'teleport/Integrations/status/AwsOidc/useAwsOidcStatus';
 import { createTeleportContext } from 'teleport/mocks/contexts';
+import { Acl } from 'teleport/services/user';
 
 export const MockAwsOidcStatusProvider = ({
   children,
   value,
   initialEntries,
   path,
+  customAcl,
 }: {
   children?: React.ReactNode;
   value: AwsOidcStatusContextState;
   path: string;
   initialEntries?: string[];
+  customAcl?: Acl;
 }) => {
-  const ctx = createTeleportContext();
+  const ctx = customAcl
+    ? createTeleportContext({ customAcl })
+    : createTeleportContext();
 
   return (
     <MemoryRouter initialEntries={initialEntries}>
diff --git a/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.story.tsx b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.story.tsx
new file mode 100644
index 0000000000000..e832746339d82
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.story.tsx
@@ -0,0 +1,202 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { MemoryRouter } from 'react-router';
+import { Route } from 'react-router-dom';
+
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { AwsRaDashboard } from 'teleport/Integrations/status/AwsRa/AwsRaDashboard';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { IntegrationKind } from 'teleport/services/integrations';
+
+export default {
+  title: 'Teleport/Integrations/AwsRa',
+  parameters: {
+    msw: {
+      handlers: [
+        http.get(cfg.getIntegrationsUrl(), () => {
+          return HttpResponse.json({
+            items: [],
+            nextKey: '',
+          });
+        }),
+      ],
+    },
+  },
+};
+
+const raName = 'ra-int';
+const trustAnchorArn =
+  'arn:aws:rolesanywhere:us-east-2:111:trust-anchor/1420223b-23d8-49f3-bca5-6521042ac283';
+const ctx = createTeleportContext();
+const initialEntries = [
+  cfg.getIntegrationStatusRoute(IntegrationKind.AwsRa, raName),
+];
+const path = cfg.routes.integrationStatus;
+
+export function Dashboard() {
+  return (
+    <ContextProvider ctx={ctx}>
+      <MemoryRouter initialEntries={initialEntries}>
+        <InfoGuidePanelProvider>
+          <Route path={path}>
+            <AwsRaDashboard />
+          </Route>
+        </InfoGuidePanelProvider>
+      </MemoryRouter>
+    </ContextProvider>
+  );
+}
+Dashboard.parameters = {
+  msw: {
+    handlers: [
+      http.get(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json({
+          name: raName,
+          subKind: 'aws-ra',
+          awsra: {
+            trustAnchorARN: trustAnchorArn,
+            profileSyncConfig: {
+              enabled: true,
+              profileArn:
+                'arn:aws:rolesanywhere:us-east-2:111:profile/31a77874-9f41-4c10-aeae-2aa1140e8ca5',
+              roleArn: 'arn:aws:iam::111:role/ra-int',
+              filters: ['*'],
+            },
+          },
+        });
+      }),
+      http.get(cfg.getIntegrationStatsUrl(raName), () => {
+        return HttpResponse.json({
+          name: raName,
+          subKind: 'aws-ra',
+          awsra: {
+            trustAnchorARN: trustAnchorArn,
+            profileSyncConfig: {
+              enabled: true,
+              profileArn:
+                'arn:aws:rolesanywhere:us-east-2:111:profile/31a77874-9f41-4c10-aeae-2aa1140e8ca5',
+              roleArn: 'arn:aws:iam::111:role/ra-int',
+              filters: ['*'],
+            },
+          },
+          unresolvedUserTasks: 0,
+          awsec2: {},
+          awsrds: {},
+          awseks: {},
+          rolesAnywhereProfileSync: {
+            enabled: true,
+            status: 'SUCCESS',
+            syncedProfiles: 3,
+            syncStartTime: '2025-08-25T17:57:29.5993537Z',
+            syncEndTime: '2025-08-25T17:57:30.538177396Z',
+          },
+        });
+      }),
+    ],
+  },
+};
+
+export function Failed() {
+  return (
+    <ContextProvider ctx={ctx}>
+      <MemoryRouter initialEntries={initialEntries}>
+        <InfoGuidePanelProvider>
+          <Route path={path}>
+            <AwsRaDashboard />
+          </Route>
+        </InfoGuidePanelProvider>
+      </MemoryRouter>
+    </ContextProvider>
+  );
+}
+Failed.parameters = {
+  msw: {
+    handlers: [
+      http.get(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Generic Bad Request' },
+          },
+          { status: 400 }
+        );
+      }),
+      http.get(cfg.getIntegrationStatsUrl(raName), () => {
+        return HttpResponse.json(
+          {
+            error: { message: 'Generic Bad Request' },
+          },
+          { status: 400 }
+        );
+      }),
+    ],
+  },
+};
+
+export function NoData() {
+  return (
+    <ContextProvider ctx={ctx}>
+      <MemoryRouter initialEntries={initialEntries}>
+        <InfoGuidePanelProvider>
+          <Route path={path}>
+            <AwsRaDashboard />
+          </Route>
+        </InfoGuidePanelProvider>
+      </MemoryRouter>
+    </ContextProvider>
+  );
+}
+NoData.parameters = {
+  msw: {
+    handlers: [
+      http.get(cfg.getIntegrationsUrl(raName), () => {
+        return HttpResponse.json({
+          name: raName,
+          subKind: 'aws-ra',
+          awsra: {
+            trustAnchorARN: trustAnchorArn,
+            profileSyncConfig: {
+              enabled: true,
+              profileArn:
+                'arn:aws:rolesanywhere:us-east-2:111:profile/31a77874-9f41-4c10-aeae-2aa1140e8ca5',
+              roleArn: 'arn:aws:iam::111:role/ra-int',
+              filters: ['*'],
+            },
+          },
+        });
+      }),
+      http.get(cfg.getIntegrationStatsUrl(raName), () => {
+        return HttpResponse.json({
+          name: raName,
+          subKind: IntegrationKind.AwsRa,
+          unresolvedUserTasks: 0,
+          awsra: {},
+          awsoidc: {},
+          awsec2: {},
+          awsrds: {},
+          awseks: {},
+          rolesAnywhereProfileSync: {},
+        });
+      }),
+    ],
+  },
+};
diff --git a/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.tsx b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.tsx
new file mode 100644
index 0000000000000..9d7e1d6d937d8
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaDashboard.tsx
@@ -0,0 +1,217 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useQueries } from '@tanstack/react-query';
+import { useHistory, useParams } from 'react-router';
+import { Link as InternalLink } from 'react-router-dom';
+import { useTheme } from 'styled-components';
+
+import { ButtonIcon, Flex, Label, Link, MenuItem, Text } from 'design';
+import * as Alerts from 'design/Alert';
+import * as Icons from 'design/Icon';
+import { ArrowLeft } from 'design/Icon';
+import { ShimmerBox } from 'design/ShimmerBox';
+import { HoverTooltip } from 'design/Tooltip';
+import { MenuButton } from 'shared/components/MenuAction';
+import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { FeatureBox } from 'teleport/components/Layout';
+import cfg from 'teleport/config';
+import { Guide } from 'teleport/Integrations/Enroll/AwsConsole/Guide';
+import { getStatusAndLabel } from 'teleport/Integrations/helpers';
+import {
+  IntegrationOperations,
+  useIntegrationOperation,
+} from 'teleport/Integrations/Operations';
+import type { EditableIntegrationFields } from 'teleport/Integrations/Operations/useIntegrationOperation';
+import { AwsOidcHeader } from 'teleport/Integrations/status/AwsOidc/AwsOidcHeader';
+import { ConsoleCardEnrolled } from 'teleport/Integrations/status/AwsOidc/Cards/ConsoleCard';
+import {
+  IntegrationAwsRa,
+  IntegrationKind,
+  integrationService,
+} from 'teleport/services/integrations';
+
+export function AwsRaDashboard() {
+  const { name } = useParams<{
+    type: IntegrationKind;
+    name: string;
+  }>();
+
+  const results = useQueries({
+    queries: [
+      {
+        queryKey: ['integration'],
+        gcTime: 0, // this prevents other pages from seeing cached data
+        queryFn: () =>
+          integrationService
+            .fetchIntegration<IntegrationAwsRa>(name)
+            .then(data => data),
+      },
+      {
+        queryKey: ['stats'],
+        gcTime: 0, // this prevents other pages from seeing cached data
+        queryFn: () =>
+          integrationService
+            .fetchIntegrationStats(name)
+            .then(data => data.rolesAnywhereProfileSync),
+      },
+    ],
+  });
+
+  const [integrationResp, statsResp] = results;
+  if (results.some(r => r.status === 'error')) {
+    return (
+      <Alerts.Danger
+        details={integrationResp?.error?.message || statsResp?.error?.message}
+      >
+        Error: {integrationResp?.error?.name || statsResp?.error?.name}
+      </Alerts.Danger>
+    );
+  }
+
+  if (results.some(r => r.status === 'pending')) {
+    return <ShimmerBox height="24px" width="100%" />;
+  }
+
+  const integration = integrationResp.data;
+  const stats = statsResp.data;
+
+  if (!integration || !stats) {
+    return (
+      <Alerts.Danger>
+        There was an error loading this integration.
+      </Alerts.Danger>
+    );
+  }
+
+  return (
+    <>
+      <AwsOidcHeader integration={integration} />
+      <FeatureBox maxWidth={1440} margin="auto" gap={3}>
+        <AwsRaTitle integration={integration} />
+        <Flex>
+          {integration && stats && <ConsoleCardEnrolled stats={stats} />}
+        </Flex>
+      </FeatureBox>
+    </>
+  );
+}
+
+function AwsRaTitle({ integration }: { integration: IntegrationAwsRa }) {
+  const theme = useTheme();
+  const history = useHistory();
+  const integrationOps = useIntegrationOperation();
+  const { status, labelKind } = getStatusAndLabel(integration);
+
+  const anchorIdReg = new RegExp('[^\\/]+$');
+  const trustAnchorId = integration?.spec?.trustAnchorARN?.match(anchorIdReg);
+
+  async function removeIntegration() {
+    await integrationOps.remove();
+    integrationOps.clear();
+    history.push(cfg.routes.integrations);
+  }
+
+  async function editIntegration(req: EditableIntegrationFields) {
+    await integrationOps.edit(req);
+    integrationOps.clear();
+  }
+
+  return (
+    <Flex mt={3} justifyContent="space-between" alignItems="center" mb={4}>
+      <Flex alignItems="center" data-testid="aws-oidc-title">
+        <HoverTooltip placement="bottom" tipContent="Back to integrations">
+          <ButtonIcon
+            as={InternalLink}
+            to={cfg.routes.integrations}
+            aria-label="back"
+          >
+            <ArrowLeft size="medium" />
+          </ButtonIcon>
+        </HoverTooltip>
+        <Flex flexDirection="column" ml={1}>
+          <Flex alignItems="center" gap={2}>
+            <Text bold fontSize={6}>
+              {integration.name}
+            </Text>
+            <Label kind={labelKind} aria-label="status" px={3}>
+              {status}
+            </Label>
+          </Flex>
+          <Flex gap={1}>
+            Trust Anchor ARN:{' '}
+            {trustAnchorId && trustAnchorId.length === 1 ? (
+              <Link
+                target="_blank"
+                href={`https://console.aws.amazon.com/rolesanywhere/home/trust-anchors/${trustAnchorId[0]}`}
+              >
+                <Text
+                  style={{
+                    fontFamily: theme.fonts.mono,
+                  }}
+                >
+                  {integration.spec?.trustAnchorARN}
+                </Text>
+              </Link>
+            ) : (
+              <Text
+                style={{
+                  fontFamily: theme.fonts.mono,
+                }}
+              >
+                {integration.spec?.trustAnchorARN}
+              </Text>
+            )}
+          </Flex>
+        </Flex>
+      </Flex>
+      <Flex gap={1} alignItems="center">
+        <MenuButton icon={<Icons.Cog size="small" />}>
+          <MenuItem
+            onClick={() =>
+              history.push(
+                cfg.getIntegrationEnrollRoute(IntegrationKind.AwsRa, 'access'),
+                {
+                  integrationName: integration.name,
+                  trustAnchorArn: integration.spec.trustAnchorARN,
+                  syncProfileArn: integration.spec.profileSyncConfig.profileArn,
+                  syncRoleArn: integration.spec.profileSyncConfig.roleArn,
+                  edit: true,
+                }
+              )
+            }
+          >
+            Edit…
+          </MenuItem>
+          <MenuItem onClick={() => integrationOps.onRemove(integration)}>
+            Delete…
+          </MenuItem>
+        </MenuButton>
+        <InfoGuideButton config={{ guide: <Guide /> }} />
+      </Flex>
+      <IntegrationOperations
+        operation={integrationOps.type}
+        integration={integrationOps.item}
+        close={integrationOps.clear}
+        edit={editIntegration}
+        remove={removeIntegration}
+      />
+    </Flex>
+  );
+}
diff --git a/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaRoutes.tsx b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaRoutes.tsx
new file mode 100644
index 0000000000000..11aef6c2bfab3
--- /dev/null
+++ b/web/packages/teleport/src/Integrations/status/AwsRa/AwsRaRoutes.tsx
@@ -0,0 +1,34 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Route, Switch } from 'teleport/components/Router';
+import cfg from 'teleport/config';
+import { AwsRaDashboard } from 'teleport/Integrations/status/AwsRa/AwsRaDashboard';
+
+export function AwsRaRoutes() {
+  return (
+    <Switch>
+      <Route
+        key="aws-ra-dashboard"
+        exact
+        path={cfg.routes.integrationStatus}
+        component={AwsRaDashboard}
+      />
+    </Switch>
+  );
+}
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.test.tsx b/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.test.tsx
index b9c9e817a35a3..6c7fa8c69c138 100644
--- a/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.test.tsx
+++ b/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.test.tsx
@@ -18,44 +18,40 @@
 
 import userEvent from '@testing-library/user-event';
 import { PropsWithChildren } from 'react';
+import selectEvent from 'react-select-event';
 
-import { fireEvent, render, screen, within } from 'design/utils/testing';
+import { render, screen, within } from 'design/utils/testing';
 import Validation, { useValidation } from 'shared/components/Validation';
 
+import cfg from 'teleport/config';
 import { ThemeProvider } from 'teleport/ThemeProvider';
 
 import { JoinTokenGithubForm } from './JoinTokenGithubForm';
-import { NewJoinTokenState } from './UpsertJoinTokenDialog';
+import {
+  NewJoinTokenGithubStateRule,
+  NewJoinTokenState,
+} from './UpsertJoinTokenDialog';
 
 const populateRuleFieldTest =
   (
-    field: keyof NewJoinTokenState['github']['rules'][number],
+    field: keyof NewJoinTokenGithubStateRule,
     placeholer: string,
     value: string
   ) =>
   async () => {
-    const state = baseState();
-    const onUpdate = jest.fn();
+    const { user, onUpdate } = renderComponent();
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={onUpdate}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const input = screen.getByPlaceholderText(placeholer);
+    expect(input).toBeEnabled();
 
-    fireEvent.change(screen.getByPlaceholderText(placeholer), {
-      target: { value },
-    });
+    await user.click(input);
+    await user.paste(value);
 
     expect(onUpdate).toHaveBeenCalledTimes(1);
     expect(onUpdate).toHaveBeenLastCalledWith(
       baseState({
         rules: [
           {
-            ...state.github.rules[0],
             [field]: value,
           },
         ],
@@ -68,27 +64,28 @@ const populateFieldTest =
     field,
     placeholer,
     value,
+    needsEnt,
   }: {
-    field: keyof NewJoinTokenState['github'];
+    field: keyof NonNullable<NewJoinTokenState['github']>;
     placeholer: string;
     value: string;
+    needsEnt?: boolean;
   }) =>
   async () => {
-    const state = baseState();
-    const onUpdate = jest.fn();
+    if (needsEnt) {
+      cfg.init({
+        edition: 'ent',
+        isEnterprise: true,
+      });
+    }
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={onUpdate}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const { user, onUpdate } = renderComponent();
 
-    fireEvent.change(screen.getByPlaceholderText(placeholer), {
-      target: { value },
-    });
+    const input = screen.getByPlaceholderText(placeholer);
+    expect(input).toBeEnabled();
+
+    await user.click(input);
+    await user.paste(value);
 
     expect(onUpdate).toHaveBeenCalledTimes(1);
     expect(onUpdate).toHaveBeenLastCalledWith(
@@ -100,46 +97,22 @@ const populateFieldTest =
 
 describe('GithubJoinTokenForm', () => {
   it('a rule can be added', async () => {
-    const state = baseState();
-    const onUpdate = jest.fn();
-
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={onUpdate}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const { user, onUpdate } = renderComponent();
 
-    await userEvent.click(
+    await user.click(
       screen.getByRole('button', { name: /Add another GitHub rule/i })
     );
 
     expect(onUpdate).toHaveBeenCalledTimes(1);
     expect(onUpdate).toHaveBeenLastCalledWith(
       baseState({
-        rules: [
-          ...state.github.rules,
-          {
-            ref_type: 'any',
-          },
-        ],
+        rules: [{}, {}],
       })
     );
   });
 
   it('delete button is hidden when only one rule exists', async () => {
-    const state = baseState();
-
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={jest.fn()}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    renderComponent();
 
     expect(screen.queryByTestId('delete_rule')).not.toBeInTheDocument();
   });
@@ -149,14 +122,7 @@ describe('GithubJoinTokenForm', () => {
       rules: [{}, {}],
     });
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={jest.fn()}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    renderComponent({ state });
 
     expect(screen.queryAllByTestId('delete_rule').length).toBe(2);
   });
@@ -165,26 +131,18 @@ describe('GithubJoinTokenForm', () => {
     const state = baseState({
       rules: [{}, {}],
     });
-    const onUpdate = jest.fn();
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={onUpdate}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const { user, onUpdate } = renderComponent({ state });
 
     const rule0 = screen.getByTestId('rule_0');
     const deleteButton0 = within(rule0).getByTestId('delete_rule');
 
-    await userEvent.click(deleteButton0);
+    await user.click(deleteButton0);
 
     expect(onUpdate).toHaveBeenCalledTimes(1);
     expect(onUpdate).toHaveBeenLastCalledWith(
       baseState({
-        rules: [state.github.rules[0]],
+        rules: state.github?.rules ? [state.github.rules[0]] : [],
       })
     );
   });
@@ -200,18 +158,9 @@ describe('GithubJoinTokenForm', () => {
   );
 
   it('repository field shows a validation message', async () => {
-    const state = baseState();
+    const { user } = renderComponent();
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={jest.fn()}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
-
-    await userEvent.click(screen.getByTestId('submit'));
+    await user.click(screen.getByTestId('submit'));
 
     expect(
       screen.getByText('Either repository name or owner is required')
@@ -225,18 +174,9 @@ describe('GithubJoinTokenForm', () => {
   );
 
   it('repository owner field shows a validation message', async () => {
-    const state = baseState();
-
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={jest.fn()}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const { user } = renderComponent();
 
-    await userEvent.click(screen.getByTestId('submit'));
+    await user.click(screen.getByTestId('submit'));
 
     expect(
       screen.getByText('Either repository owner or name is required')
@@ -258,61 +198,53 @@ describe('GithubJoinTokenForm', () => {
   // eslint-disable-next-line jest/expect-expect
   it(
     'ref field can be populated',
-    populateRuleFieldTest('ref', 'ref/heads/main', 'ref/heads/main')
+    populateRuleFieldTest('ref', 'refs/heads/main', 'refs/heads/main')
   );
 
-  it('ref type is disabled when ref is not populated', async () => {
-    const state = baseState();
-
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={jest.fn()}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
-
-    expect(screen.getByLabelText('Ref type')).toBeDisabled();
-  });
-
   it('ref type can be selected', async () => {
     const state = baseState({
       rules: [
         {
-          ref: 'ref/heads/main',
-          ref_type: 'any',
+          ref: 'refs/heads/main',
+          ref_type: undefined,
         },
       ],
     });
-    const onUpdate = jest.fn();
 
-    render(
-      <JoinTokenGithubForm
-        tokenState={state}
-        onUpdateState={onUpdate}
-        readonly={false}
-      />,
-      { wrapper: Wrapper }
-    );
+    const { onUpdate } = renderComponent({ state });
 
     const selectElement = screen.getByLabelText('Ref type');
     expect(selectElement).toBeEnabled();
 
-    // Seems to be the only way to interact with react-select component
-    fireEvent.keyDown(selectElement, { key: 'ArrowDown' });
-    const existingItem = await screen.findByText('Branch');
-    fireEvent.click(existingItem);
+    await selectEvent.select(selectElement, ['Branch']);
 
     expect(onUpdate).toHaveBeenCalledTimes(1);
     expect(onUpdate).toHaveBeenLastCalledWith(
       baseState({
-        rules: [
-          {
-            ...state.github.rules[0],
-            ref_type: 'branch',
-          },
-        ],
+        rules: state.github?.rules
+          ? [
+              {
+                ...state.github.rules[0],
+                ref_type: 'branch',
+              },
+            ]
+          : [],
+      })
+    );
+
+    await selectEvent.select(selectElement, ['Any']);
+
+    expect(onUpdate).toHaveBeenCalledTimes(2);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: state.github?.rules
+          ? [
+              {
+                ...state.github.rules[0],
+                ref_type: undefined,
+              },
+            ]
+          : [],
       })
     );
   });
@@ -324,6 +256,7 @@ describe('GithubJoinTokenForm', () => {
       field: 'server_host',
       placeholer: 'github.example.com',
       value: 'github.example.com',
+      needsEnt: true,
     })
   );
 
@@ -334,6 +267,7 @@ describe('GithubJoinTokenForm', () => {
       field: 'enterprise_slug',
       placeholer: 'octo-enterprise',
       value: 'octo-enterprise',
+      needsEnt: true,
     })
   );
 
@@ -344,10 +278,29 @@ describe('GithubJoinTokenForm', () => {
       field: 'static_jwks',
       placeholer: '{"keys":[--snip--]}',
       value: '{"keys":[]}',
+      needsEnt: true,
     })
   );
 });
 
+function renderComponent(options?: { state?: NewJoinTokenState }) {
+  const { state = baseState() } = options ?? {};
+  const onUpdate = jest.fn();
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <JoinTokenGithubForm
+        tokenState={state}
+        onUpdateState={onUpdate}
+        readonly={false}
+      />,
+      { wrapper: Wrapper }
+    ),
+    onUpdate,
+    user,
+  };
+}
+
 const Wrapper = ({ children }: PropsWithChildren) => {
   return (
     <ThemeProvider>
@@ -360,7 +313,6 @@ const Wrapper = ({ children }: PropsWithChildren) => {
 
 const SubmitWrapper = ({ children }: PropsWithChildren) => {
   const validation = useValidation();
-
   return (
     <>
       {children}
@@ -378,13 +330,6 @@ const baseState = (
   bot_name: 'test-bot-name',
   github: {
     ...github,
-    rules: github.rules ?? [
-      {
-        ref_type: 'any',
-      },
-    ],
+    rules: github.rules ?? [{}],
   },
-  iam: [],
-  gcp: [],
-  oracle: [],
 });
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.tsx b/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.tsx
index 8ae281c6f4c33..cd057724ec6d9 100644
--- a/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.tsx
+++ b/web/packages/teleport/src/JoinTokens/JoinTokenGithubForm.tsx
@@ -28,7 +28,7 @@ import { Trash } from 'design/Icon/Icons/Trash';
 import Link from 'design/Link/Link';
 import Text from 'design/Text/Text';
 import FieldInput from 'shared/components/FieldInput/FieldInput';
-import FieldSelect from 'shared/components/FieldSelect';
+import { FieldSelect } from 'shared/components/FieldSelect';
 import { requiredField } from 'shared/components/Validation/rules';
 
 import cfg from 'teleport/config';
@@ -46,10 +46,10 @@ export const JoinTokenGithubForm = ({
   readonly: boolean;
 }) => {
   const { github } = tokenState;
-  const { rules } = github;
+  const { rules } = github ?? {};
 
   function removeRule(index: number) {
-    const newRules = rules.filter((_, i) => index !== i);
+    const newRules = rules?.filter((_, i) => index !== i);
     const newState = {
       ...tokenState,
       github: {
@@ -65,12 +65,7 @@ export const JoinTokenGithubForm = ({
       ...tokenState,
       github: {
         ...tokenState.github,
-        rules: [
-          ...rules,
-          {
-            ref_type: 'any' as const,
-          },
-        ],
+        rules: [...(rules ?? []), {}],
       },
     };
     onUpdateState(newState);
@@ -81,7 +76,7 @@ export const JoinTokenGithubForm = ({
       ...tokenState,
       github: {
         ...tokenState.github,
-        rules: rules.map((rule, i) => {
+        rules: rules?.map((rule, i) => {
           if (i === index) {
             return { ...rule, [fieldName]: opts };
           }
@@ -94,7 +89,7 @@ export const JoinTokenGithubForm = ({
 
   return (
     <>
-      {rules.map((rule, index) => (
+      {rules?.map((rule, index) => (
         <RuleBox
           data-testid={`rule_${index}`}
           key={index} // order doesn't change without updating the referrenced array
@@ -118,7 +113,7 @@ export const JoinTokenGithubForm = ({
             label="Repository"
             placeholder="gravitational/teleport"
             toolTipContent="Fully qualified name of a GitHub repository (i.e. including the owner)"
-            value={rule.repository}
+            value={rule.repository ?? ''}
             onChange={e => updateRuleField(index, 'repository', e.target.value)}
             rule={
               rule.repository_owner
@@ -132,7 +127,7 @@ export const JoinTokenGithubForm = ({
             label="Repository owner"
             placeholder="gravitational"
             toolTipContent="Name of an organization or user that a repository belongs to"
-            value={rule.repository_owner}
+            value={rule.repository_owner ?? ''}
             onChange={e =>
               updateRuleField(index, 'repository_owner', e.target.value)
             }
@@ -147,7 +142,7 @@ export const JoinTokenGithubForm = ({
           <FieldInput
             label="Workflow name"
             placeholder="my-workflow"
-            value={rule.workflow}
+            value={rule.workflow ?? ''}
             onChange={e => updateRuleField(index, 'workflow', e.target.value)}
             readonly={readonly}
           />
@@ -155,7 +150,7 @@ export const JoinTokenGithubForm = ({
           <FieldInput
             label="Environment"
             placeholder="production"
-            value={rule.environment}
+            value={rule.environment ?? ''}
             onChange={e =>
               updateRuleField(index, 'environment', e.target.value)
             }
@@ -166,8 +161,8 @@ export const JoinTokenGithubForm = ({
             <FieldInput
               flex={2}
               label="Git ref"
-              placeholder="ref/heads/main"
-              value={rule.ref}
+              placeholder="refs/heads/main"
+              value={rule.ref ?? ''}
               onChange={e => updateRuleField(index, 'ref', e.target.value)}
               readonly={readonly}
             />
@@ -176,9 +171,18 @@ export const JoinTokenGithubForm = ({
               flex={1}
               label="Ref type"
               options={refTypeOptions}
-              value={refTypeOptions.find(o => o.value === rule.ref_type)}
-              onChange={opts => updateRuleField(index, 'ref_type', opts.value)}
-              isDisabled={!rule.ref || readonly}
+              value={
+                refTypeOptions.find(o => o.value === rule.ref_type) ??
+                refTypeOptions[0]
+              }
+              onChange={opts =>
+                updateRuleField(
+                  index,
+                  'ref_type',
+                  opts?.value === 'any' ? undefined : opts?.value
+                )
+              }
+              isDisabled={readonly}
               data-testid="ref-type-select"
             />
           </Flex>
@@ -190,14 +194,14 @@ export const JoinTokenGithubForm = ({
         Add another GitHub rule
       </ButtonText>
 
-      {/* TODO(nickmarais): Make SectionBox a component instead of reusing it from Roles */}
+      {/* TODO(nicholasmarais1158): Make SectionBox a component instead of reusing it from Roles */}
       <SectionBox
         titleSegments={['GitHub Enterprise Server']}
         initiallyCollapsed={[
           'server_host',
           'enterprise_slug',
           'static_jwks',
-        ].every(k => !github[k])}
+        ].every(k => !github?.[k])}
         validation={{
           valid: true,
         }}
@@ -223,7 +227,7 @@ export const JoinTokenGithubForm = ({
         <FieldInput
           label="Server host"
           placeholder="github.example.com"
-          value={github.server_host}
+          value={github?.server_host ?? ''}
           onChange={e =>
             onUpdateState({
               ...tokenState,
@@ -239,7 +243,7 @@ export const JoinTokenGithubForm = ({
         <FieldInput
           label="Slug"
           placeholder="octo-enterprise"
-          value={github.enterprise_slug}
+          value={github?.enterprise_slug ?? ''}
           onChange={e =>
             onUpdateState({
               ...tokenState,
@@ -256,7 +260,7 @@ export const JoinTokenGithubForm = ({
           label="Static JWKS"
           placeholder='{"keys":[--snip--]}'
           toolTipContent="JSON Web Key Set used to verify the token issued by GitHub Actions"
-          value={github.static_jwks}
+          value={github?.static_jwks ?? ''}
           onChange={e =>
             onUpdateState({
               ...tokenState,
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.test.tsx b/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.test.tsx
new file mode 100644
index 0000000000000..0b0add304cb46
--- /dev/null
+++ b/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.test.tsx
@@ -0,0 +1,305 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import userEvent from '@testing-library/user-event';
+import { PropsWithChildren } from 'react';
+import selectEvent from 'react-select-event';
+
+import { render, screen, within } from 'design/utils/testing';
+import Validation, { useValidation } from 'shared/components/Validation';
+
+import { ThemeProvider } from 'teleport/ThemeProvider';
+
+import { JoinTokenGitlabForm } from './JoinTokenGitlabForm';
+import {
+  NewJoinTokenGitlabStateRule,
+  NewJoinTokenState,
+} from './UpsertJoinTokenDialog';
+
+const populateRuleFieldTest =
+  (
+    field: keyof NewJoinTokenGitlabStateRule,
+    placeholer: string,
+    value: string
+  ) =>
+  async () => {
+    const { user, onUpdate } = renderComponent();
+
+    const input = screen.getByPlaceholderText(placeholer);
+    expect(input).toBeEnabled();
+
+    await user.click(input);
+    await user.paste(value);
+
+    expect(onUpdate).toHaveBeenCalledTimes(1);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: [
+          {
+            [field]: value,
+          },
+        ],
+      })
+    );
+  };
+
+const populateFieldTest =
+  ({
+    field,
+    placeholer,
+    value,
+  }: {
+    field: keyof NonNullable<NewJoinTokenState['gitlab']>;
+    placeholer: string;
+    value: string;
+  }) =>
+  async () => {
+    const { user, onUpdate } = renderComponent();
+
+    const input = screen.getByPlaceholderText(placeholer);
+    expect(input).toBeEnabled();
+
+    await user.click(input);
+    await user.paste(value);
+
+    expect(onUpdate).toHaveBeenCalledTimes(1);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        [field]: value,
+      })
+    );
+  };
+
+describe('GitlabJoinTokenForm', () => {
+  it('a rule can be added', async () => {
+    const { user, onUpdate } = renderComponent();
+
+    await user.click(
+      screen.getByRole('button', { name: /Add another GitLab rule/i })
+    );
+
+    expect(onUpdate).toHaveBeenCalledTimes(1);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: [{}, {}],
+      })
+    );
+  });
+
+  it('delete button is hidden when only one rule exists', async () => {
+    renderComponent();
+
+    expect(screen.queryByTestId('delete_rule')).not.toBeInTheDocument();
+  });
+
+  it('delete button is visible when more than one rule exists', async () => {
+    const state = baseState({
+      rules: [{}, {}],
+    });
+
+    renderComponent({ state });
+
+    expect(screen.queryAllByTestId('delete_rule').length).toBe(2);
+  });
+
+  it('a rule can be deleted', async () => {
+    const state = baseState({
+      rules: [{}, {}],
+    });
+
+    const { user, onUpdate } = renderComponent({ state });
+
+    const rule0 = screen.getByTestId('rule_0');
+    const deleteButton0 = within(rule0).getByTestId('delete_rule');
+
+    await user.click(deleteButton0);
+
+    expect(onUpdate).toHaveBeenCalledTimes(1);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: state.gitlab?.rules ? [state.gitlab.rules[0]] : [],
+      })
+    );
+  });
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'project path field can be populated',
+    populateRuleFieldTest(
+      'project_path',
+      'my-user/my-project',
+      'gravitational/teleport'
+    )
+  );
+
+  it('project path field shows a validation message', async () => {
+    const { user } = renderComponent();
+
+    await user.click(screen.getByTestId('submit'));
+
+    expect(
+      screen.getByText('Either project path or namespace path is required')
+    ).toBeInTheDocument();
+  });
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'namespace path field can be populated',
+    populateRuleFieldTest('namespace_path', 'my-user', 'gravitational')
+  );
+
+  it('namespace path field shows a validation message', async () => {
+    const { user } = renderComponent();
+
+    await user.click(screen.getByTestId('submit'));
+
+    expect(
+      screen.getByText('Either namespace path or project path is required')
+    ).toBeInTheDocument();
+  });
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'environment field can be populated',
+    populateRuleFieldTest('environment', 'production', 'production')
+  );
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'ref field can be populated',
+    populateRuleFieldTest('ref', 'main', 'release-*')
+  );
+
+  it('ref type can be selected', async () => {
+    const state = baseState({
+      rules: [
+        {
+          ref: 'main',
+        },
+      ],
+    });
+
+    const { onUpdate } = renderComponent({ state });
+
+    const selectElement = screen.getByLabelText('Ref type');
+    expect(selectElement).toBeEnabled();
+
+    await selectEvent.select(selectElement, ['Branch']);
+
+    expect(onUpdate).toHaveBeenCalledTimes(1);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: state.gitlab?.rules
+          ? [
+              {
+                ...state.gitlab.rules[0],
+                ref_type: 'branch',
+              },
+            ]
+          : [],
+      })
+    );
+
+    await selectEvent.select(selectElement, ['Any']);
+
+    expect(onUpdate).toHaveBeenCalledTimes(2);
+    expect(onUpdate).toHaveBeenLastCalledWith(
+      baseState({
+        rules: state.gitlab?.rules
+          ? [
+              {
+                ...state.gitlab.rules[0],
+                ref_type: undefined,
+              },
+            ]
+          : [],
+      })
+    );
+  });
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'domain field can be populated',
+    populateFieldTest({
+      field: 'domain',
+      placeholer: 'gitlab.example.com',
+      value: 'gitlab.example.com',
+    })
+  );
+
+  // eslint-disable-next-line jest/expect-expect
+  it(
+    'jwks field can be populated',
+    populateFieldTest({
+      field: 'static_jwks',
+      placeholer: '{"keys":[--snip--]}',
+      value: '{"keys":[]}',
+    })
+  );
+});
+
+function renderComponent(options?: { state?: NewJoinTokenState }) {
+  const { state = baseState() } = options ?? {};
+  const onUpdate = jest.fn();
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <JoinTokenGitlabForm
+        tokenState={state}
+        onUpdateState={onUpdate}
+        readonly={false}
+      />,
+      { wrapper: Wrapper }
+    ),
+    onUpdate,
+    user,
+  };
+}
+
+const Wrapper = ({ children }: PropsWithChildren) => {
+  return (
+    <ThemeProvider>
+      <Validation>
+        <SubmitWrapper>{children}</SubmitWrapper>
+      </Validation>
+    </ThemeProvider>
+  );
+};
+
+const SubmitWrapper = ({ children }: PropsWithChildren) => {
+  const validation = useValidation();
+  return (
+    <>
+      {children}
+      <button data-testid="submit" onClick={() => validation.validate()} />
+    </>
+  );
+};
+
+const baseState = (
+  gitlab: Partial<NewJoinTokenState['gitlab']> = {}
+): NewJoinTokenState => ({
+  name: 'test-name',
+  method: { label: 'gitlab', value: 'gitlab' },
+  roles: [{ label: 'Bot', value: 'Bot' }],
+  bot_name: 'test-bot-name',
+  gitlab: {
+    ...gitlab,
+    rules: gitlab.rules ?? [{}],
+  },
+});
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.tsx b/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.tsx
new file mode 100644
index 0000000000000..67af75b2bab76
--- /dev/null
+++ b/web/packages/teleport/src/JoinTokens/JoinTokenGitlabForm.tsx
@@ -0,0 +1,248 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import Box from 'design/Box/Box';
+import { ButtonText } from 'design/Button/Button';
+import ButtonIcon from 'design/ButtonIcon/ButtonIcon';
+import Flex from 'design/Flex/Flex';
+import { Plus } from 'design/Icon/Icons/Plus';
+import { Trash } from 'design/Icon/Icons/Trash';
+import Text from 'design/Text';
+import FieldInput from 'shared/components/FieldInput/FieldInput';
+import { FieldSelect } from 'shared/components/FieldSelect/FieldSelect';
+import { requiredField } from 'shared/components/Validation/rules';
+
+import { SectionBox } from 'teleport/Roles/RoleEditor/StandardEditor/sections';
+
+import { NewJoinTokenState } from './UpsertJoinTokenDialog';
+
+export function JoinTokenGitlabForm(props: {
+  tokenState: NewJoinTokenState;
+  onUpdateState: (newToken: NewJoinTokenState) => void;
+  readonly: boolean;
+}) {
+  const { tokenState, onUpdateState, readonly } = props;
+  const { gitlab } = tokenState;
+  const { domain, static_jwks, rules } = gitlab ?? {};
+
+  function removeRule(index: number) {
+    const newRules = rules?.filter((_, i) => index !== i);
+    const newState = {
+      ...tokenState,
+      gitlab: {
+        ...tokenState.gitlab,
+        rules: newRules,
+      },
+    };
+    onUpdateState(newState);
+  }
+
+  function addNewRule() {
+    const newState = {
+      ...tokenState,
+      gitlab: {
+        ...tokenState.gitlab,
+        rules: [...(rules ?? []), {}],
+      },
+    };
+    onUpdateState(newState);
+  }
+
+  function updateRuleField(index: number, fieldName: string, opts: unknown) {
+    const newState = {
+      ...tokenState,
+      gitlab: {
+        ...tokenState.gitlab,
+        rules: rules?.map((rule, i) => {
+          if (i === index) {
+            return { ...rule, [fieldName]: opts };
+          }
+          return rule;
+        }),
+      },
+    };
+    onUpdateState(newState);
+  }
+
+  return (
+    <>
+      {rules?.map((rule, index) => (
+        <RuleBox
+          data-testid={`rule_${index}`}
+          key={index} // order doesn't change without updating the referrenced array
+        >
+          <Flex alignItems="center" justifyContent="space-between">
+            <Text fontWeight={700} mb={2}>
+              GitLab Rule
+            </Text>
+
+            {rules.length > 1 && ( // at least one rule is required, so lets not allow the user to remove it
+              <ButtonIcon
+                data-testid="delete_rule"
+                onClick={() => removeRule(index)}
+              >
+                <Trash size={16} color="text.muted" />
+              </ButtonIcon>
+            )}
+          </Flex>
+
+          <FieldInput
+            label="Project path"
+            placeholder="my-user/my-project"
+            value={rule.project_path ?? ''}
+            onChange={e =>
+              updateRuleField(index, 'project_path', e.target.value)
+            }
+            rule={
+              rule.namespace_path
+                ? undefined
+                : requiredField(
+                    'Either project path or namespace path is required'
+                  )
+            }
+            readonly={readonly}
+          />
+
+          <FieldInput
+            label="Namespace path"
+            placeholder="my-user"
+            value={rule.namespace_path ?? ''}
+            onChange={e =>
+              updateRuleField(index, 'namespace_path', e.target.value)
+            }
+            rule={
+              rule.project_path
+                ? undefined
+                : requiredField(
+                    'Either namespace path or project path is required'
+                  )
+            }
+            readonly={readonly}
+          />
+
+          <FieldInput
+            label="Environment"
+            placeholder="production"
+            value={rule.environment ?? ''}
+            onChange={e =>
+              updateRuleField(index, 'environment', e.target.value)
+            }
+            readonly={readonly}
+          />
+
+          <Flex fullWidth gap={2}>
+            <FieldInput
+              flex={2}
+              label="Git ref"
+              placeholder="main"
+              value={rule.ref ?? ''}
+              onChange={e => updateRuleField(index, 'ref', e.target.value)}
+              readonly={readonly}
+            />
+
+            <FieldSelect
+              flex={1}
+              label="Ref type"
+              options={refTypeOptions}
+              value={
+                refTypeOptions.find(o => o.value === rule.ref_type) ??
+                refTypeOptions[0]
+              }
+              onChange={opts =>
+                updateRuleField(
+                  index,
+                  'ref_type',
+                  opts?.value === 'any' ? undefined : opts?.value
+                )
+              }
+              isDisabled={readonly}
+              data-testid="ref-type-select"
+            />
+          </Flex>
+        </RuleBox>
+      ))}
+
+      <ButtonText onClick={addNewRule} compact mb={4}>
+        <Plus size={16} mr={2} />
+        Add another GitLab rule
+      </ButtonText>
+
+      {/* TODO(nicholasmarais1158): Make SectionBox a component instead of reusing it from Roles */}
+      <SectionBox
+        titleSegments={['Advanced Configuration']}
+        initiallyCollapsed={['domain', 'static_jwks'].every(k => !gitlab?.[k])}
+        validation={{
+          valid: true,
+        }}
+      >
+        <FieldInput
+          label="Domain"
+          placeholder="gitlab.example.com"
+          toolTipContent="If you are using GitLab's cloud hosted offering, leave this field empty"
+          value={domain ?? ''}
+          onChange={e =>
+            onUpdateState({
+              ...tokenState,
+              gitlab: {
+                ...tokenState.gitlab,
+                domain: e.target.value,
+              },
+            })
+          }
+          readonly={readonly}
+        />
+
+        <FieldInput
+          label="Static JWKS"
+          placeholder='{"keys":[--snip--]}'
+          toolTipContent="JSON Web Key Set used to verify the token issued by GitLab"
+          value={static_jwks ?? ''}
+          onChange={e =>
+            onUpdateState({
+              ...tokenState,
+              gitlab: {
+                ...tokenState.gitlab,
+                static_jwks: e.target.value,
+              },
+            })
+          }
+          readonly={readonly}
+        />
+      </SectionBox>
+    </>
+  );
+}
+
+const refTypeOptions = [
+  { value: 'any' as const, label: 'Any' },
+  { value: 'branch' as const, label: 'Branch' },
+  { value: 'tag' as const, label: 'Tag' },
+];
+
+const RuleBox = styled(Box)`
+  border-color: ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  border-width: 2px;
+  border-style: solid;
+  border-radius: ${props => props.theme.radii[2]}px;
+
+  margin-bottom: ${props => props.theme.space[3]}px;
+
+  padding: ${props => props.theme.space[3]}px;
+`;
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokens.story.tsx b/web/packages/teleport/src/JoinTokens/JoinTokens.story.tsx
index 55ef629649987..bc2fe01ebaaec 100644
--- a/web/packages/teleport/src/JoinTokens/JoinTokens.story.tsx
+++ b/web/packages/teleport/src/JoinTokens/JoinTokens.story.tsx
@@ -37,7 +37,7 @@ export const Loaded = () => (
 Loaded.parameters = {
   msw: {
     handlers: [
-      http.get(cfg.api.joinTokensPath, () => {
+      http.get(cfg.api.joinToken.list, () => {
         return HttpResponse.json({ items: tokens });
       }),
       http.put(cfg.api.joinTokenYamlPath, () => {
diff --git a/web/packages/teleport/src/JoinTokens/JoinTokens.tsx b/web/packages/teleport/src/JoinTokens/JoinTokens.tsx
index 94ece31cd1831..fe6d0e0c32eaf 100644
--- a/web/packages/teleport/src/JoinTokens/JoinTokens.tsx
+++ b/web/packages/teleport/src/JoinTokens/JoinTokens.tsx
@@ -18,7 +18,7 @@
 
 import { addHours, isAfter } from 'date-fns';
 import { useEffect, useState } from 'react';
-import styled from 'styled-components';
+import styled, { useTheme } from 'styled-components';
 
 import {
   Alert,
@@ -43,6 +43,7 @@ import Dialog, {
 } from 'design/Dialog';
 import { Warning } from 'design/Icon';
 import { HoverTooltip } from 'design/Tooltip';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
 import { MenuButton } from 'shared/components/MenuAction';
 import {
   InfoExternalTextLink,
@@ -50,7 +51,6 @@ import {
   InfoParagraph,
   ReferenceLinks,
 } from 'shared/components/SlidingSidePanel/InfoGuide';
-import { CopyButton } from 'shared/components/UnifiedResources/shared/CopyButton';
 import { Attempt, useAsync } from 'shared/hooks/useAsync';
 
 import { useTeleport } from 'teleport';
@@ -77,6 +77,8 @@ function makeTokenResource(token: JoinToken): Resource<KindJoinToken> {
 
 export const JoinTokens = () => {
   const ctx = useTeleport();
+  const theme = useTheme();
+
   const [creatingToken, setCreatingToken] = useState(false);
   const [editingToken, setEditingToken] = useState<JoinToken | null>(null);
   const [tokenToDelete, setTokenToDelete] = useState<JoinToken | null>(null);
@@ -88,8 +90,19 @@ export const JoinTokens = () => {
     { join_token: '' } // we are only editing for now, so template can be empty
   );
 
+  function getRowStyle(row: JoinToken): React.CSSProperties {
+    if (row.isCloudSystem) {
+      return {
+        background: theme.colors.interactive.tonal.neutral[0],
+        color: theme.colors.text.muted,
+      };
+    }
+  }
+
   function updateTokenList(token: JoinToken): JoinToken[] {
-    let items = [...joinTokensAttempt.data.items];
+    let items = joinTokensAttempt.data?.items
+      ? [...joinTokensAttempt.data.items]
+      : [];
     if (creatingToken) {
       items.push(token);
     } else {
@@ -124,7 +137,7 @@ export const JoinTokens = () => {
         status: 'success',
         statusText: '',
         data: {
-          items: joinTokensAttempt.data.items.filter(t => t.id !== token),
+          items: joinTokensAttempt.data?.items.filter(t => t.id !== token),
         },
       });
       setTokenToDelete(null);
@@ -174,9 +187,12 @@ export const JoinTokens = () => {
             <Alert kind="danger">{joinTokensAttempt.statusText}</Alert>
           )}
           {joinTokensAttempt.status === 'success' && (
-            <Table
+            <JoinTokenTable
               isSearchable
               data={joinTokensAttempt.data.items}
+              row={{
+                getStyle: getRowStyle,
+              }}
               columns={[
                 {
                   key: 'id',
@@ -235,7 +251,8 @@ export const JoinTokens = () => {
                           token.method === 'iam' ||
                           token.method === 'gcp' ||
                           token.method === 'token' ||
-                          (token.method === 'github' && token.github)
+                          (token.method === 'github' && token.github) ||
+                          (token.method === 'gitlab' && token.gitlab)
                         ) {
                           setEditingToken(token);
                           return;
@@ -285,7 +302,7 @@ export const JoinTokens = () => {
             setDeleteTokenAttempt({
               status: 'success',
               statusText: '',
-              data: null,
+              data: undefined,
             });
             setTokenToDelete(null);
           }}
@@ -310,6 +327,15 @@ export const JoinTokens = () => {
   );
 };
 
+// This is necessary because the Table component styles
+// hard-code the text color for the <td> element, preventing
+// our row style from being applied.
+const JoinTokenTable = styled(Table)`
+  & > tbody > tr > td {
+    color: inherit;
+  }
+` as typeof Table;
+
 export function searchMatcher(
   targetValue: any,
   searchValue: string,
@@ -358,7 +384,7 @@ const NameCell = ({ token }: { token: JoinToken }) => {
             visibility: ${hovered ? 'visible' : 'hidden'};
           `}
         >
-          <CopyButton name={id} />
+          <CopyButton value={id} />
         </Box>
       </Flex>
     </Cell>
@@ -370,7 +396,7 @@ const StyledLabel = styled(Label)`
   margin: 1px 0;
   margin-right: ${props => props.theme.space[2]}px;
   background-color: ${props => props.theme.colors.interactive.tonal.neutral[0]};
-  color: ${props => props.theme.colors.text.main};
+  color: inherit;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -434,7 +460,7 @@ const ActionCell = ({
   onDelete(): void;
   token: JoinToken;
 }) => {
-  const buttonProps = { width: '100px' };
+  const buttonProps = { width: '100px', disabled: false };
   if (token.isStatic) {
     return (
       <Cell align="right">
@@ -447,12 +473,29 @@ const ActionCell = ({
       </Cell>
     );
   }
+  if (token.isCloudSystem) {
+    buttonProps.disabled = true;
+  }
+
+  const Button = (
+    <MenuButton buttonProps={buttonProps}>
+      <MenuItem onClick={onEdit}>View/Edit...</MenuItem>
+      <MenuItem onClick={onDelete}>Delete...</MenuItem>
+    </MenuButton>
+  );
+
   return (
     <Cell align="right">
-      <MenuButton buttonProps={buttonProps}>
-        <MenuItem onClick={onEdit}>View/Edit...</MenuItem>
-        <MenuItem onClick={onDelete}>Delete...</MenuItem>
-      </MenuButton>
+      {token.isCloudSystem ? (
+        <HoverTooltip
+          placement="top-end"
+          tipContent="This token is managed by Teleport Cloud."
+        >
+          {Button}
+        </HoverTooltip>
+      ) : (
+        <>{Button}</>
+      )}
     </Cell>
   );
 };
diff --git a/web/packages/teleport/src/JoinTokens/UpsertJoinTokenDialog.tsx b/web/packages/teleport/src/JoinTokens/UpsertJoinTokenDialog.tsx
index 62ccf938d46cc..3efb1c45e2b26 100644
--- a/web/packages/teleport/src/JoinTokens/UpsertJoinTokenDialog.tsx
+++ b/web/packages/teleport/src/JoinTokens/UpsertJoinTokenDialog.tsx
@@ -53,6 +53,7 @@ import 'teleport/services/resources';
 import { Info } from 'design/Alert/Alert';
 import { collectKeys } from 'shared/utils/collectKeys';
 
+import auth from 'teleport/services/auth';
 import { YamlSupportedResourceKind } from 'teleport/services/yaml/types';
 
 import {
@@ -61,6 +62,7 @@ import {
   JoinTokenOracleForm,
 } from './JoinTokenForms';
 import { JoinTokenGithubForm } from './JoinTokenGithubForm';
+import { JoinTokenGitlabForm } from './JoinTokenGitlabForm';
 
 const maxWidth = '550px';
 
@@ -79,10 +81,13 @@ const availableJoinMethods: OptionJoinMethod[] = [
   'gcp',
   'oracle',
   'github',
-].map(method => ({
-  value: method as JoinMethod,
-  label: method as JoinMethod,
-}));
+  'gitlab',
+]
+  .sort()
+  .map(method => ({
+    value: method as JoinMethod,
+    label: method as JoinMethod,
+  }));
 
 export type AllowOption = Option<string, string>;
 type OptionJoinMethod = Option<JoinMethod, JoinMethod>;
@@ -99,17 +104,33 @@ type NewJoinTokenOracleState = {
 };
 
 type NewJoinTokenGithubState = {
-  server_host?: string;
-  static_jwks?: string | undefined;
-  enterprise_slug?: string | undefined;
-  rules: {
-    repository?: string;
-    repository_owner?: string | undefined;
-    workflow?: string | undefined;
-    environment?: string | undefined;
-    ref?: string;
-    ref_type?: 'any' | 'branch' | 'tag';
-  }[];
+  server_host?: string | null;
+  static_jwks?: string | null;
+  enterprise_slug?: string | null;
+  rules?: NewJoinTokenGithubStateRule[] | null;
+};
+
+export type NewJoinTokenGithubStateRule = {
+  repository?: string | null;
+  repository_owner?: string | null;
+  workflow?: string | null;
+  environment?: string | null;
+  ref?: string | null;
+  ref_type?: 'branch' | 'tag' | null;
+};
+
+type NewJoinTokenGitlabState = {
+  domain?: string | null;
+  static_jwks?: string | null;
+  rules?: NewJoinTokenGitlabStateRule[] | null;
+};
+
+export type NewJoinTokenGitlabStateRule = {
+  project_path?: string | null;
+  namespace_path?: string | null;
+  environment?: string | null;
+  ref?: string | null;
+  ref_type?: 'branch' | 'tag' | null;
 };
 
 export type NewJoinTokenState = {
@@ -118,10 +139,11 @@ export type NewJoinTokenState = {
   bot_name?: string;
   method: OptionJoinMethod;
   roles: OptionJoinRole[];
-  iam: AWSRules[];
-  gcp: NewJoinTokenGCPState[];
-  oracle: NewJoinTokenOracleState[];
-  github: NewJoinTokenGithubState;
+  iam?: AWSRules[];
+  gcp?: NewJoinTokenGCPState[];
+  oracle?: NewJoinTokenOracleState[];
+  github?: NewJoinTokenGithubState;
+  gitlab?: NewJoinTokenGitlabState;
 };
 
 export const defaultNewTokenState: NewJoinTokenState = {
@@ -133,11 +155,10 @@ export const defaultNewTokenState: NewJoinTokenState = {
   gcp: [{ project_ids: [], service_accounts: [], locations: [] }],
   oracle: [{ tenancy: '', parent_compartments: [], regions: [] }],
   github: {
-    rules: [
-      {
-        ref_type: 'any',
-      },
-    ],
+    rules: [{}],
+  },
+  gitlab: {
+    rules: [{}],
   },
 };
 
@@ -169,27 +190,40 @@ function makeDefaultEditState(token: JoinToken): NewJoinTokenState {
           server_host: token.github.enterprise_server_host,
           enterprise_slug: token.github.enterprise_slug,
           static_jwks: token.github.static_jwks,
-          rules: token.github.allow.map(r => ({
+          rules: token.github.allow?.map(r => ({
             repository: r.repository,
             actor: r.actor,
             environment: r.environment,
             ref: r.ref,
-            ref_type: parseGithubRefType(r.ref_type),
+            ref_type: parseRefType(r.ref_type),
             repository_owner: r.repository_owner,
             workflow: r.workflow,
           })),
         }
       : undefined,
+    gitlab: token.gitlab
+      ? {
+          domain: token.gitlab?.domain,
+          static_jwks: token.gitlab.static_jwks,
+          rules: token.gitlab.allow?.map(r => ({
+            project_path: r.project_path,
+            namespace_path: r.namespace_path,
+            environment: r.environment,
+            ref: r.ref,
+            ref_type: parseRefType(r.ref_type),
+          })),
+        }
+      : undefined,
   };
 }
 
-function parseGithubRefType(refType: string) {
+function parseRefType(refType: string | null | undefined) {
   if (refType == 'branch') {
     return 'branch';
   } else if (refType == 'tag') {
     return 'tag';
   } else {
-    return 'any';
+    return undefined;
   }
 }
 
@@ -201,7 +235,7 @@ export const UpsertJoinTokenDialog = ({
 }: {
   onClose(): void;
   updateTokenList: (token: JoinToken) => void;
-  editToken?: JoinToken;
+  editToken: JoinToken | null;
   editTokenWithYAML: (tokenId: string) => void;
 }) => {
   const ctx = useTeleport();
@@ -211,9 +245,15 @@ export const UpsertJoinTokenDialog = ({
 
   const [createTokenAttempt, runCreateTokenAttempt] = useAsync(
     async (req: CreateJoinTokenRequest, isEdit: boolean) => {
+      // The edit and create endpoint each call other endpoints
+      // that require re-authenticating. Providing a reusable mfaResponse
+      // is required for multple internal validations to succeed.
+      const mfaResponse = await auth.getMfaChallengeResponseForAdminAction(
+        true /* allow re-use */
+      );
       const token = isEdit
-        ? await ctx.joinTokenService.editJoinToken(req)
-        : await ctx.joinTokenService.createJoinToken(req);
+        ? await ctx.joinTokenService.editJoinToken(req, mfaResponse)
+        : await ctx.joinTokenService.createJoinToken(req, mfaResponse);
       updateTokenList(token);
       onClose();
     }
@@ -269,6 +309,11 @@ export const UpsertJoinTokenDialog = ({
           data.object.spec.github,
           data.object.spec.join_method
         );
+      case 'gitlab':
+        return !checkYamlData(
+          data.object.spec.gitlab,
+          data.object.spec.join_method
+        );
     }
 
     return false;
@@ -300,51 +345,69 @@ export const UpsertJoinTokenDialog = ({
 
     if (newTokenState.method.value === 'gcp') {
       const gcp = {
-        allow: newTokenState.gcp.map(rule => ({
-          project_ids: rule.project_ids?.map(id => id.value),
-          locations: rule.locations?.map(loc => loc.value),
-          service_accounts: rule.service_accounts?.map(
-            account => account.value
-          ),
-        })),
+        allow:
+          newTokenState.gcp?.map(rule => ({
+            project_ids: rule.project_ids?.map(id => id.value),
+            locations: rule.locations?.map(loc => loc.value),
+            service_accounts: rule.service_accounts?.map(
+              account => account.value
+            ),
+          })) ?? [],
       };
       request.gcp = gcp;
     }
 
     if (newTokenState.method.value === 'oracle') {
       const oracle = {
-        allow: newTokenState.oracle.map(rule => ({
-          tenancy: rule.tenancy,
-          parent_compartments: rule.parent_compartments?.map(
-            compartment => compartment.value
-          ),
-          regions: rule.regions?.map(region => region.value),
-        })),
+        allow:
+          newTokenState.oracle?.map(rule => ({
+            tenancy: rule.tenancy,
+            parent_compartments: rule.parent_compartments?.map(
+              compartment => compartment.value
+            ),
+            regions: rule.regions?.map(region => region.value),
+          })) ?? [],
       };
       request.oracle = oracle;
     }
 
     if (newTokenState.method.value === 'github') {
       const github: (typeof request)['github'] = {
-        allow: newTokenState.github.rules.map(rule => ({
+        allow: newTokenState.github?.rules?.map(rule => ({
           environment: rule.environment,
           ref: rule.ref,
-          ref_type: rule.ref ? rule.ref_type : undefined,
+          ref_type: rule.ref_type,
           repository: rule.repository,
           repository_owner: rule.repository_owner,
           workflow: rule.workflow,
 
-          actor: null, // Unsupported field
-          sub: null, // Unsupported field
+          actor: undefined, // Unsupported field
+          sub: undefined, // Unsupported field
         })),
-        enterprise_server_host: newTokenState.github.server_host,
-        enterprise_slug: newTokenState.github.enterprise_slug,
-        static_jwks: newTokenState.github.static_jwks,
+        enterprise_server_host: newTokenState.github?.server_host,
+        enterprise_slug: newTokenState.github?.enterprise_slug,
+        static_jwks: newTokenState.github?.static_jwks,
       };
 
       request.github = github;
     }
 
+    if (newTokenState.method.value === 'gitlab') {
+      const gitlab: (typeof request)['gitlab'] = {
+        allow: newTokenState.gitlab?.rules?.map(rule => ({
+          project_path: rule.project_path,
+          namespace_path: rule.namespace_path,
+          environment: rule.environment,
+          ref: rule.ref,
+          ref_type: rule.ref_type,
+        })),
+        domain: newTokenState.gitlab?.domain,
+        static_jwks: newTokenState.gitlab?.static_jwks,
+      };
+
+      request.gitlab = gitlab;
+    }
+
     runCreateTokenAttempt(request, !!editToken);
   }
 
@@ -423,7 +486,7 @@ export const UpsertJoinTokenDialog = ({
               )}
             </Flex>
 
-            {hasUnsupportedFields ? (
+            {hasUnsupportedFields && editToken ? (
               <Info alignItems="flex-start">
                 <Text>
                   This token has configuration that is not visible. To edit this
@@ -527,6 +590,13 @@ export const UpsertJoinTokenDialog = ({
                       readonly={hasUnsupportedFields}
                     />
                   )}
+                  {newTokenState.method.value === 'gitlab' && (
+                    <JoinTokenGitlabForm
+                      tokenState={newTokenState}
+                      onUpdateState={setNewTokenState}
+                      readonly={hasUnsupportedFields}
+                    />
+                  )}
                   <Flex
                     mt={4}
                     py={4}
@@ -583,6 +653,7 @@ const checkYAMLData = (
       allow: unknown;
       gcp: unknown;
       github: unknown;
+      gitlab: unknown;
     };
   };
 } => {
@@ -658,4 +729,13 @@ const supportedFieldsMap: Partial<Record<JoinMethod, Set<string>>> = {
     '.allow.ref',
     '.allow.ref_type',
   ]),
+  gitlab: new Set([
+    '.domain',
+    '.static_jwks',
+    '.allow.project_path',
+    '.allow.namespace_path',
+    '.allow.environment',
+    '.allow.ref',
+    '.allow.ref_type',
+  ]),
 };
diff --git a/web/packages/teleport/src/Kubes/fixtures/index.ts b/web/packages/teleport/src/Kubes/fixtures/index.ts
index f9845aeb34b77..f0f411320dea2 100644
--- a/web/packages/teleport/src/Kubes/fixtures/index.ts
+++ b/web/packages/teleport/src/Kubes/fixtures/index.ts
@@ -26,11 +26,13 @@ export const kubes: Kube[] = [
       { name: 'kernel', value: '4.15.0-51-generic' },
       { name: 'env', value: 'prod' },
     ],
+    targetHealth: { status: 'healthy' },
   },
   {
     kind: 'kube_cluster',
     name: 'tele.logicoma.dev-staging',
     labels: [{ name: 'env', value: 'staging' }],
+    targetHealth: { status: 'healthy' },
   },
   {
     kind: 'kube_cluster',
@@ -39,6 +41,13 @@ export const kubes: Kube[] = [
       { name: 'cluster-name', value: 'some-cluster-name' },
       { name: 'env', value: 'idk' },
     ],
+    targetHealth: { status: 'unknown' },
+  },
+  {
+    kind: 'kube_cluster',
+    name: 'unhealthy-kube-cluster',
+    labels: [{ name: 'env', value: 'sunflower' }],
+    targetHealth: { status: 'unhealthy' },
   },
 ];
 
diff --git a/web/packages/teleport/src/LocksV2/Locks/Locks.test.tsx b/web/packages/teleport/src/LocksV2/Locks/Locks.test.tsx
index ea2fd3ec0770c..f47ed785ed3a1 100644
--- a/web/packages/teleport/src/LocksV2/Locks/Locks.test.tsx
+++ b/web/packages/teleport/src/LocksV2/Locks/Locks.test.tsx
@@ -31,26 +31,28 @@ test('lock search', async () => {
   const ctx = createTeleportContext();
 
   jest.spyOn(lockService, 'fetchLocks').mockResolvedValue(
-    makeLocks([
-      {
-        name: 'lock-name-1',
-        targets: {
-          user: 'lock-user',
+    makeLocks({
+      items: [
+        {
+          name: 'lock-name-1',
+          targets: {
+            user: 'lock-user',
+          },
         },
-      },
-      {
-        name: 'lock-name-2',
-        targets: {
-          role: 'lock-role-1',
+        {
+          name: 'lock-name-2',
+          targets: {
+            role: 'lock-role-1',
+          },
         },
-      },
-      {
-        name: 'lock-name-3',
-        targets: {
-          role: 'lock-role-2',
+        {
+          name: 'lock-name-3',
+          targets: {
+            role: 'lock-role-2',
+          },
         },
-      },
-    ])
+      ],
+    })
   );
 
   render(
diff --git a/web/packages/teleport/src/LocksV2/NewLock/LockCheckout/LockCheckout.tsx b/web/packages/teleport/src/LocksV2/NewLock/LockCheckout/LockCheckout.tsx
index a9e23d51fe86a..709e6c91ff337 100644
--- a/web/packages/teleport/src/LocksV2/NewLock/LockCheckout/LockCheckout.tsx
+++ b/web/packages/teleport/src/LocksV2/NewLock/LockCheckout/LockCheckout.tsx
@@ -42,6 +42,7 @@ import { pluralize } from 'shared/utils/text';
 import shieldCheck from 'teleport/assets/shield-check.png';
 import cfg from 'teleport/config';
 import { TrashButton } from 'teleport/LocksV2/common';
+import { zIndexMap } from 'teleport/Navigation/zIndexMap';
 import { lockService } from 'teleport/services/locks';
 
 import {
@@ -200,6 +201,7 @@ export const LockCheckout = forwardRef<HTMLDivElement, Props>(
           top: 0;
           left: 0;
           overflow: hidden;
+          z-index: ${zIndexMap.checkoutSidePanel};
         `}
       >
         <Dimmer className={transitionState} />
diff --git a/web/packages/teleport/src/Login/Login.test.tsx b/web/packages/teleport/src/Login/Login.test.tsx
index d9e63fbef0268..d65d3753fb308 100644
--- a/web/packages/teleport/src/Login/Login.test.tsx
+++ b/web/packages/teleport/src/Login/Login.test.tsx
@@ -102,7 +102,7 @@ test('login with SSO', () => {
       displayName: 'With GitHub',
       type: 'github',
       name: 'github',
-      url: '/github/login/web?redirect_url=:redirect?connector_id=:providerName',
+      url: '/github/login/web?connector_id=:providerName&redirect_url=:redirect?',
     },
   ]);
 
@@ -111,7 +111,7 @@ test('login with SSO', () => {
   // test login pathways
   fireEvent.click(screen.getByText('With GitHub'));
   expect(history.push).toHaveBeenCalledWith(
-    'http://localhost/github/login/web?redirect_url=http:%2F%2Flocalhost%2Fwebconnector_id=github',
+    'http://localhost/github/login/web?connector_id=github&redirect_url=http%3A%2F%2Flocalhost%2Fweb',
     true
   );
 });
diff --git a/web/packages/teleport/src/Login/useLogin.ts b/web/packages/teleport/src/Login/useLogin.ts
index f5c616c072d1a..1b0015a85c7ae 100644
--- a/web/packages/teleport/src/Login/useLogin.ts
+++ b/web/packages/teleport/src/Login/useLogin.ts
@@ -117,11 +117,16 @@ export default function useLogin() {
       });
   }
 
-  function onLoginWithSso(provider: AuthProvider) {
+  function onLoginWithSso(provider: AuthProvider, loginHint?: string) {
     attemptActions.start();
     storageService.clearLoginTime();
     const appStartRoute = getEntryRoute();
-    const ssoUri = cfg.getSsoUrl(provider.url, provider.name, appStartRoute);
+    const ssoUri = cfg.getSsoUrl(
+      provider.url,
+      provider.name,
+      appStartRoute,
+      loginHint
+    );
     history.push(ssoUri, true);
   }
 
diff --git a/web/packages/teleport/src/Main/Main.test.tsx b/web/packages/teleport/src/Main/Main.test.tsx
index fb1c3ddb72a00..35a6a4aae8069 100644
--- a/web/packages/teleport/src/Main/Main.test.tsx
+++ b/web/packages/teleport/src/Main/Main.test.tsx
@@ -18,9 +18,15 @@
 
 import { MemoryRouter } from 'react-router';
 
+import { ButtonPrimary } from 'design/Button';
 import { ListThin } from 'design/Icon';
-import { fireEvent, render, screen } from 'design/utils/testing';
+import { act, fireEvent, render, screen } from 'design/utils/testing';
 import { InfoGuideButton } from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
+import {
+  autoRemoveDurationMs,
+  ToastNotificationProvider,
+  useToastNotifications,
+} from 'shared/components/ToastNotification';
 
 import { Context, ContextProvider } from 'teleport';
 import { apps } from 'teleport/Apps/fixtures';
@@ -74,29 +80,36 @@ test('renders', () => {
     <MemoryRouter>
       <LayoutContextProvider>
         <ContextProvider ctx={ctx}>
-          <Main {...props} />
+          <ToastNotificationProvider>
+            <Main {...props} />
+          </ToastNotificationProvider>
         </ContextProvider>
       </LayoutContextProvider>
     </MemoryRouter>
   );
 
   expect(screen.getByTestId('teleport-logo')).toBeInTheDocument();
+  expect(screen.queryAllByTestId(/toast-note/i)).toHaveLength(0);
 });
 
 test('toggle rendering of info guide panel', async () => {
   mockUserContextProviderWith(makeTestUserContext());
   const ctx = createTeleportContext();
 
+  const testFeature = new FeatureTest();
+
   const props: MainProps = {
-    features: [...getOSSFeatures(), new FeatureTestInfoGuide()],
+    features: [...getOSSFeatures(), testFeature],
   };
 
   render(
     <MemoryRouter>
       <ContextProvider ctx={ctx}>
-        <LayoutContextProvider>
-          <Main {...props} />
-        </LayoutContextProvider>
+        <ToastNotificationProvider>
+          <LayoutContextProvider>
+            <Main {...props} />
+          </LayoutContextProvider>
+        </ToastNotificationProvider>
       </ContextProvider>
     </MemoryRouter>
   );
@@ -108,7 +121,7 @@ test('toggle rendering of info guide panel', async () => {
 
   // render the component that has the guide info button
   fireEvent.click(screen.queryAllByText('Zero Trust Access')[0]);
-  fireEvent.click(screen.getByText(/test info guide/i));
+  fireEvent.click(screen.getByTestId(testFeature.route.path));
   expect(screen.getByText(/info guide title/i)).toBeInTheDocument();
 
   // test opening of panel
@@ -120,53 +133,70 @@ test('toggle rendering of info guide panel', async () => {
   expect(screen.queryByText(/i am the guide/i)).not.toBeInTheDocument();
 });
 
-test('displays invite collaborators feedback if present', () => {
+test('notification render and auto dismissal', async () => {
+  jest.useFakeTimers();
   mockUserContextProviderWith(makeTestUserContext());
-  const ctx = setupContext();
+  const ctx = createTeleportContext();
+
+  const testFeature = new FeatureTest();
 
   const props: MainProps = {
-    features: getOSSFeatures(),
-    inviteCollaboratorsFeedback: <div>Passed Component!</div>,
+    features: [...getOSSFeatures(), testFeature],
   };
 
   render(
     <MemoryRouter>
-      <LayoutContextProvider>
-        <ContextProvider ctx={ctx}>
-          <Main {...props} />
-        </ContextProvider>
-      </LayoutContextProvider>
+      <ContextProvider ctx={ctx}>
+        <ToastNotificationProvider>
+          <LayoutContextProvider>
+            <Main {...props} />
+          </LayoutContextProvider>
+        </ToastNotificationProvider>
+      </ContextProvider>
     </MemoryRouter>
   );
 
-  expect(screen.getByText('Passed Component!')).toBeInTheDocument();
-});
+  expect(screen.getByTestId('teleport-logo')).toBeInTheDocument();
 
-test('renders without invite collaborators feedback enabled', () => {
-  mockUserContextProviderWith(makeTestUserContext());
-  const ctx = setupContext();
+  // render the component that has the add note button
+  fireEvent.click(screen.queryAllByText('Zero Trust Access')[0]);
+  fireEvent.click(screen.getByTestId(testFeature.route.path));
 
-  const props: MainProps = {
-    features: getOSSFeatures(),
-  };
-  expect(props.inviteCollaboratorsFeedback).toBeUndefined();
+  expect(screen.queryAllByText(/some note/i)).toHaveLength(0);
 
-  render(
-    <MemoryRouter>
-      <LayoutContextProvider>
-        <ContextProvider ctx={ctx}>
-          <Main {...props} />
-        </ContextProvider>
-      </LayoutContextProvider>
-    </MemoryRouter>
-  );
+  fireEvent.click(screen.getByText(/add notification/i));
+  fireEvent.click(screen.getByText(/add notification/i));
 
-  expect(screen.getByTestId('teleport-logo')).toBeInTheDocument();
+  expect(screen.getByText(/some note 1/i)).toBeInTheDocument();
+  expect(screen.getByText(/some note 2/i)).toBeInTheDocument();
+  expect(screen.queryAllByTestId(/toast-note/i)).toHaveLength(2);
+
+  // wait for notes to auto disappear
+  act(() => jest.advanceTimersByTime(autoRemoveDurationMs + 3_000));
+
+  expect(screen.queryByText(/some note 1/i)).not.toBeInTheDocument();
+  expect(screen.queryByText(/some note 2/i)).not.toBeInTheDocument();
+  expect(screen.queryAllByTestId(/toast-note/i)).toHaveLength(0);
+
+  jest.useRealTimers();
 });
 
-const TestInfoGuide = () => {
+let note = 1;
+const TestComponent = () => {
+  const toastNotification = useToastNotifications();
   return (
     <div>
+      <ButtonPrimary
+        onClick={() => {
+          toastNotification.add({
+            severity: 'success',
+            content: `some note ${note}`,
+          });
+          note += 1;
+        }}
+      >
+        add notification
+      </ButtonPrimary>
       <InfoGuideButton config={{ guide: <div>I am the guide</div> }}>
         Info Guide Title
       </InfoGuideButton>
@@ -174,22 +204,22 @@ const TestInfoGuide = () => {
   );
 };
 
-class FeatureTestInfoGuide implements TeleportFeature {
+class FeatureTest implements TeleportFeature {
   category = NavigationCategory.Audit;
 
   route = {
-    title: 'Test Info Guide',
-    path: '/web/testinfoguide',
-    component: TestInfoGuide,
+    title: 'Testing Route Title',
+    path: '/web/testing',
+    component: TestComponent,
   };
 
   navigationItem = {
-    title: 'Test Info Guide' as any,
+    title: 'Testing Navigation Title' as any,
     icon: ListThin,
     getLink() {
-      return '/web/testinfoguide';
+      return '/web/testing';
     },
-    searchableTags: ['test info guide'],
+    searchableTags: ['test testing'],
   };
 
   hasAccess() {
diff --git a/web/packages/teleport/src/Main/Main.tsx b/web/packages/teleport/src/Main/Main.tsx
index e603c59469785..4e525f9905369 100644
--- a/web/packages/teleport/src/Main/Main.tsx
+++ b/web/packages/teleport/src/Main/Main.tsx
@@ -36,6 +36,7 @@ import {
   useInfoGuide,
 } from 'shared/components/SlidingSidePanel/InfoGuide';
 import { marginTransitionCss } from 'shared/components/SlidingSidePanel/InfoGuide/const';
+import { ToastNotifications } from 'shared/components/ToastNotification';
 import useAttempt from 'shared/hooks/useAttemptNext';
 
 import { BannerList } from 'teleport/components/BannerList';
@@ -67,7 +68,6 @@ export interface MainProps {
   features: TeleportFeature[];
   billingBanners?: ReactNode[];
   CustomLogo?: () => React.ReactElement;
-  inviteCollaboratorsFeedback?: ReactNode;
 }
 
 export function Main(props: MainProps) {
@@ -198,6 +198,7 @@ export function Main(props: MainProps) {
                   billingBanners={featureFlags.billing && props.billingBanners}
                   onBannerDismiss={dismissAlert}
                 />
+                <ToastNotifications />
                 <Suspense fallback={null}>
                   <FeatureRoutes lockedFeatures={ctx.lockedFeatures} />
                 </Suspense>
@@ -209,7 +210,6 @@ export function Main(props: MainProps) {
       {displayOnboardDiscover && (
         <OnboardDiscover onClose={handleOnClose} onOnboard={handleOnboard} />
       )}
-      {props.inviteCollaboratorsFeedback}
     </FeaturesContextProvider>
   );
 }
diff --git a/web/packages/teleport/src/Main/OnboardDiscover/OnboardDiscover.tsx b/web/packages/teleport/src/Main/OnboardDiscover/OnboardDiscover.tsx
index 0e7d9e2d0046d..bc1ce2abf394d 100644
--- a/web/packages/teleport/src/Main/OnboardDiscover/OnboardDiscover.tsx
+++ b/web/packages/teleport/src/Main/OnboardDiscover/OnboardDiscover.tsx
@@ -26,7 +26,7 @@ import Dialog, {
 import { userEventService } from 'teleport/services/userEvent';
 import { CaptureEvent } from 'teleport/services/userEvent/types';
 
-import resourcesPng from './resources.png';
+import resourcesSvg from './resources.svg';
 
 export function OnboardDiscover({
   onClose,
@@ -61,7 +61,7 @@ export function OnboardDiscover({
       open={true}
     >
       <DialogHeader mx="auto">
-        <Image src={resourcesPng} width="350px" height="218.97px" />
+        <Image src={resourcesSvg} width="350px" height="220px" />
       </DialogHeader>
       <DialogContent textAlign="center">
         <H2>Start by adding your first resource</H2>
diff --git a/web/packages/teleport/src/Main/OnboardDiscover/resources.png b/web/packages/teleport/src/Main/OnboardDiscover/resources.png
deleted file mode 100644
index ea0537301167e..0000000000000
Binary files a/web/packages/teleport/src/Main/OnboardDiscover/resources.png and /dev/null differ
diff --git a/web/packages/teleport/src/Main/OnboardDiscover/resources.svg b/web/packages/teleport/src/Main/OnboardDiscover/resources.svg
new file mode 100644
index 0000000000000..4a7fc439a4401
--- /dev/null
+++ b/web/packages/teleport/src/Main/OnboardDiscover/resources.svg
@@ -0,0 +1 @@
+<svg fill="none" height="1000" viewBox="0 0 1600 1000" width="1600" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><filter id="a" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1493" x="1021.52" y="411.475"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="b" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1493" width="17.1494" x="597.796" y="357.803"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="c" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1493" width="17.1493" x="1172.33" y="439.985"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="d" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1493" x="1159.04" y="650.67"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="e" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1494" x="881.677" y="276.074"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="f" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1494" x="1120.11" y="550.641"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="g" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1493" width="17.1494" x="878.982" y="670.025"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="h" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1494" x="755.791" y="782.878"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="i" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1493" x="495.089" y="577.008"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="j" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.1494" width="17.1494" x="384.051" y="789.243"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="2.46893"/><feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.65 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="k" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="338.911" width="254.093" x="393.552" y="643.507"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="10.92"/><feColorMatrix type="matrix" values="0 0 0 0 0.172549 0 0 0 0 0.317647 0 0 0 0 0.360784 0 0 0 0.35 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="l" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="261.102" width="318.071" x="1150.17" y="473.925"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="10.2687"/><feColorMatrix type="matrix" values="0 0 0 0 0.164706 0 0 0 0 0.227451 0 0 0 0 0.227451 0 0 0 0.3 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="m" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="43.6829" width="46.0241" x="1391.21" y="690.689"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="10.2687"/><feColorMatrix type="matrix" values="0 0 0 0 0.164706 0 0 0 0 0.227451 0 0 0 0 0.227451 0 0 0 0.3 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="n" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="277.258" width="242.675" x="165.613" y="345.62"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="5.92754"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.15 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><filter id="o" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="266.061" width="231.942" x="710.417" y="22.8933"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" result="hardAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset/><feGaussianBlur stdDeviation="5.56267"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.15 0"/><feBlend in2="BackgroundImageFix" mode="normal" result="effect1_dropShadow_1_2974"/><feBlend in="SourceGraphic" in2="effect1_dropShadow_1_2974" mode="normal" result="shape"/></filter><linearGradient id="p"><stop offset=".447317" stop-color="#39808f" stop-opacity="0"/><stop offset=".781312" stop-color="#39808f" stop-opacity=".1"/><stop offset=".915951" stop-color="#39808f" stop-opacity=".428236"/><stop offset="1" stop-color="#39808f" stop-opacity=".6"/></linearGradient><linearGradient id="q" gradientUnits="userSpaceOnUse" x1="161.725" x2="615.206" xlink:href="#p" y1="854.696" y2="837.783"/><linearGradient id="r"><stop offset=".123838" stop-color="#fff" stop-opacity="0"/><stop offset=".772962" stop-color="#fff" stop-opacity=".05"/><stop offset=".851421" stop-color="#fff" stop-opacity=".257542"/><stop offset=".952177" stop-color="#fff" stop-opacity=".503507"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="s" gradientUnits="userSpaceOnUse" x1="754.224" x2="401.878" xlink:href="#r" y1="835.386" y2="845.678"/><linearGradient id="t" gradientUnits="userSpaceOnUse" x1="415.64" x2="626.05" xlink:href="#p" y1="725.974" y2="725.974"/><linearGradient id="u" gradientUnits="userSpaceOnUse" x1="867.899" x2="365.72" xlink:href="#r" y1="791.777" y2="696.612"/><linearGradient id="v" gradientUnits="userSpaceOnUse" x1="777.08" x2="298.543" xlink:href="#r" y1="828.782" y2="851.24"/><linearGradient id="w"><stop offset="0" stop-color="#4c7f8d" stop-opacity="0"/><stop offset=".407209" stop-color="#4c7f8d" stop-opacity="0"/><stop offset=".498533" stop-color="#4c7f8d" stop-opacity=".112406"/><stop offset=".701603" stop-color="#4c7f8d" stop-opacity=".324114"/><stop offset=".875881" stop-color="#4c7f8d" stop-opacity=".45372"/><stop offset="1" stop-color="#4c7f8d" stop-opacity=".5"/></linearGradient><linearGradient id="x" gradientUnits="userSpaceOnUse" x1="1211.92" x2="1255.99" xlink:href="#w" y1="518.61" y2="518.61"/><linearGradient id="y" gradientUnits="userSpaceOnUse" x1="1247.43" x2="1249.4" xlink:href="#w" y1="516.532" y2="516.532"/><linearGradient id="z" gradientUnits="userSpaceOnUse" x1="1261.53" x2="1447.71" xlink:href="#w" y1="604.149" y2="604.149"/><linearGradient id="A" gradientUnits="userSpaceOnUse" x1="1187.12" x2="1201.92" xlink:href="#w" y1="540.465" y2="540.465"/><linearGradient id="B" gradientUnits="userSpaceOnUse" x1="1114.58" x2="1468.16" xlink:href="#w" y1="432.423" y2="762.026"/><linearGradient id="C" gradientUnits="userSpaceOnUse" x1="1241.72" x2="1471.03" y1="669.229" y2="612.201"><stop offset=".257523" stop-color="#fff" stop-opacity="0"/><stop offset=".673025" stop-color="#fff" stop-opacity=".1"/><stop offset=".766936" stop-color="#fff" stop-opacity=".257491"/><stop offset=".925007" stop-color="#fff" stop-opacity=".503526"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="D"><stop offset="0" stop-color="#587e8d" stop-opacity="0"/><stop offset=".403882" stop-color="#587e8d" stop-opacity="0"/><stop offset=".495718" stop-color="#587e8d" stop-opacity=".112406"/><stop offset=".699928" stop-color="#587e8d" stop-opacity=".324114"/><stop offset=".875184" stop-color="#587e8d" stop-opacity=".45372"/><stop offset="1" stop-color="#587e8d" stop-opacity=".5"/></linearGradient><linearGradient id="E" gradientUnits="userSpaceOnUse" x1="151.605" x2="426.646" xlink:href="#D" y1="602.671" y2="442.475"/><linearGradient id="F"><stop offset="0" stop-color="#587e8d" stop-opacity=".6"/><stop offset=".110748" stop-color="#587e8d" stop-opacity=".553706"/><stop offset=".266246" stop-color="#587e8d" stop-opacity=".424065"/><stop offset=".447337" stop-color="#587e8d" stop-opacity=".212427"/><stop offset=".596118" stop-color="#587e8d" stop-opacity="0"/><stop offset="1" stop-color="#587e8d" stop-opacity="0"/></linearGradient><linearGradient id="G" gradientUnits="userSpaceOnUse" x1="400.375" x2="174.655" xlink:href="#F" y1="547.291" y2="574.472"/><linearGradient id="H" gradientUnits="userSpaceOnUse" x1="397.564" x2="171.94" xlink:href="#F" y1="523.952" y2="551.105"/><linearGradient id="I" gradientUnits="userSpaceOnUse" x1="-.000026" x2="426.646" xlink:href="#D" y1="568.348" y2="408.151"/><linearGradient id="J" gradientUnits="userSpaceOnUse" x1="-.000045" x2=".999956" xlink:href="#F" y1="512.968" y2="540.149"/><linearGradient id="K" gradientUnits="userSpaceOnUse" x1="397.564" x2="171.941" xlink:href="#F" y1="489.629" y2="516.785"/><linearGradient id="L" gradientUnits="userSpaceOnUse" x1="151.605" x2="426.646" xlink:href="#D" y1="534.024" y2="373.828"/><linearGradient id="M" gradientUnits="userSpaceOnUse" x1="-.000044" x2="174.655" xlink:href="#F" y1="478.644" y2="505.825"/><linearGradient id="N" gradientUnits="userSpaceOnUse" x1="397.564" x2="171.941" xlink:href="#F" y1="455.305" y2="482.461"/><linearGradient id="O" gradientUnits="userSpaceOnUse" x1="-.000026" x2="426.646" xlink:href="#D" y1="499.701" y2="339.504"/><linearGradient id="P" gradientUnits="userSpaceOnUse" x1="400.375" x2="174.655" xlink:href="#F" y1="444.321" y2="471.502"/><linearGradient id="Q" gradientUnits="userSpaceOnUse" x1="397.564" x2="171.941" xlink:href="#F" y1="420.982" y2="448.138"/><linearGradient id="R" gradientUnits="userSpaceOnUse" x1="1406.69" x2="1248.19" y1="140.421" y2="225.59"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset=".5247" stop-color="#fff" stop-opacity="0"/><stop offset=".753747" stop-color="#fff" stop-opacity=".104077"/><stop offset="1" stop-color="#fff" stop-opacity=".2"/></linearGradient><linearGradient id="S"><stop offset=".397466" stop-color="#fff" stop-opacity="0"/><stop offset=".763613" stop-color="#fff" stop-opacity=".05"/><stop offset=".845303" stop-color="#fff" stop-opacity=".257542"/><stop offset=".950208" stop-color="#fff" stop-opacity=".503507"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="T" gradientUnits="userSpaceOnUse" x1="1230.06" x2="1192.92" xlink:href="#S" y1="225.354" y2="227.392"/><linearGradient id="U" gradientUnits="userSpaceOnUse" x1="1393.72" x2="1349.19" xlink:href="#S" y1="325.231" y2="313.735"/><linearGradient id="V" gradientUnits="userSpaceOnUse" x1="1052.13" x2="1369.97" y1="-11.0785" y2="410.889"><stop offset=".251467" stop-color="#39808f" stop-opacity="0"/><stop offset=".751199" stop-color="#39808f" stop-opacity=".04"/><stop offset=".91359" stop-color="#39808f" stop-opacity=".428214"/><stop offset="1" stop-color="#39808f" stop-opacity=".6"/></linearGradient><linearGradient id="W"><stop offset=".514484" stop-color="#fff" stop-opacity="0"/><stop offset=".822641" stop-color="#fff" stop-opacity=".1"/><stop offset=".87358" stop-color="#fff" stop-opacity=".257491"/><stop offset=".959322" stop-color="#fff" stop-opacity=".503526"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="X" gradientUnits="userSpaceOnUse" x1="1453.32" x2="1332.05" xlink:href="#W" y1="225.6" y2="385.55"/><linearGradient id="Y" gradientUnits="userSpaceOnUse" x1="1340.42" x2="1219.27" xlink:href="#W" y1="140.124" y2="300.398"/><linearGradient id="Z" gradientUnits="userSpaceOnUse" x1="1387.16" x2="1266.02" xlink:href="#W" y1="175.454" y2="335.746"/><linearGradient id="aa" gradientUnits="userSpaceOnUse" x1="775.528" x2="807.955" xlink:href="#D" y1="118.345" y2="162.745"/><linearGradient id="ab"><stop offset=".573475" stop-color="#fff" stop-opacity="0"/><stop offset=".785053" stop-color="#fff" stop-opacity=".3"/><stop offset=".865893" stop-color="#fff" stop-opacity=".418067"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><linearGradient id="ac" gradientUnits="userSpaceOnUse" x1="817.492" x2="819.676" xlink:href="#ab" y1="128.034" y2="143.323"/><linearGradient id="ad" gradientUnits="userSpaceOnUse" x1="942.293" x2="697.425" xlink:href="#F" y1="236.918" y2="221.642"/><linearGradient id="ae" gradientUnits="userSpaceOnUse" x1="937.729" x2="741.913" xlink:href="#ab" y1="245.271" y2="204.807"/><linearGradient id="af" gradientUnits="userSpaceOnUse" x1="775.528" x2="807.955" xlink:href="#D" y1="70.1489" y2="114.549"/><linearGradient id="ag" gradientUnits="userSpaceOnUse" x1="817.492" x2="819.676" xlink:href="#ab" y1="79.8381" y2="95.127"/><linearGradient id="ah" gradientUnits="userSpaceOnUse" x1="942.293" x2="697.425" xlink:href="#F" y1="188.722" y2="173.445"/><linearGradient id="ai" gradientUnits="userSpaceOnUse" x1="937.729" x2="741.913" xlink:href="#ab" y1="197.075" y2="156.611"/><linearGradient id="aj" gradientUnits="userSpaceOnUse" x1="775.528" x2="807.955" xlink:href="#D" y1="21.9526" y2="66.3528"/><linearGradient id="ak" gradientUnits="userSpaceOnUse" x1="817.492" x2="819.676" xlink:href="#ab" y1="31.6418" y2="46.9306"/><linearGradient id="al" gradientUnits="userSpaceOnUse" x1="942.293" x2="697.425" xlink:href="#F" y1="140.525" y2="125.249"/><linearGradient id="am" gradientUnits="userSpaceOnUse" x1="937.729" x2="741.913" xlink:href="#ab" y1="148.878" y2="108.414"/><linearGradient id="an" gradientUnits="userSpaceOnUse" x1="889.092" x2="775.304" xlink:href="#ab" y1="112.093" y2="80.885"/><linearGradient id="ao" gradientUnits="userSpaceOnUse" x1="530.96" x2="963.546" y1="284.494" y2="650.151"><stop offset=".39362" stop-color="#058190" stop-opacity="0"/><stop offset=".614028" stop-color="#058190" stop-opacity=".04"/><stop offset=".743804" stop-color="#058190" stop-opacity=".230122"/><stop offset=".879213" stop-color="#058190" stop-opacity=".4"/></linearGradient><linearGradient id="ap" gradientUnits="userSpaceOnUse" x1="1211.23" x2="485.938" y1="740.121" y2="315.483"><stop offset=".474306" stop-color="#fff" stop-opacity="0"/><stop offset=".765565" stop-color="#fff" stop-opacity=".1"/><stop offset=".832897" stop-color="#fff" stop-opacity=".257491"/><stop offset=".946232" stop-color="#fff" stop-opacity=".503526"/><stop offset="1" stop-color="#fff" stop-opacity=".6"/></linearGradient><radialGradient id="aq" cx="754.379" cy="-31.4225" gradientUnits="userSpaceOnUse" r="574.274"><stop offset=".106928" stop-color="#fff" stop-opacity="0"/><stop offset=".664507" stop-color="#8300ff" stop-opacity=".1"/><stop offset=".707959" stop-color="#8300ff" stop-opacity=".15743"/><stop offset=".906105" stop-color="#8300ff" stop-opacity=".403594"/><stop offset="1" stop-color="#8300ff" stop-opacity=".5"/></radialGradient><path d="m1333.12 581.685c2.66 1.534 2.67 4.014.05 5.541-2.65 1.535-6.93 1.535-9.58 0-2.65-1.527-2.66-4.007-.02-5.541 2.62-1.527 6.91-1.527 9.55 0zm-8.2 4.764c1.91 1.1 5.01 1.1 6.9 0s1.87-2.887-.04-3.986c-1.9-1.1-4.97-1.1-6.87 0-1.89 1.099-1.89 2.886.01 3.986z" fill="#587e8c"/><g filter="url(#a)"><path d="m1030.09 423.687c2.01 0 3.64-1.628 3.64-3.637 0-2.008-1.63-3.637-3.64-3.637s-3.64 1.629-3.64 3.637c0 2.009 1.63 3.637 3.64 3.637z" fill="#6e17ff"/></g><g filter="url(#b)"><path d="m606.371 370.014c2.009 0 3.637-1.628 3.637-3.636 0-2.009-1.628-3.637-3.637-3.637-2.008 0-3.637 1.628-3.637 3.637 0 2.008 1.629 3.636 3.637 3.636z" fill="#6e17ff"/></g><g filter="url(#c)"><path d="m1180.91 452.196c2 0 3.63-1.628 3.63-3.636 0-2.009-1.63-3.637-3.63-3.637-2.01 0-3.64 1.628-3.64 3.637 0 2.008 1.63 3.636 3.64 3.636z" fill="#6e17ff"/></g><g filter="url(#d)"><path d="m1167.62 662.882c2.01 0 3.64-1.629 3.64-3.637 0-2.009-1.63-3.637-3.64-3.637s-3.64 1.628-3.64 3.637c0 2.008 1.63 3.637 3.64 3.637z" fill="#6e17ff"/></g><g filter="url(#e)"><path d="m890.251 288.285c2.009 0 3.637-1.628 3.637-3.636 0-2.009-1.628-3.637-3.637-3.637-2.008 0-3.636 1.628-3.636 3.637 0 2.008 1.628 3.636 3.636 3.636z" fill="#6e17ff"/></g><g filter="url(#f)"><path d="m1128.69 562.853c2.01 0 3.63-1.628 3.63-3.637s-1.62-3.637-3.63-3.637-3.64 1.628-3.64 3.637 1.63 3.637 3.64 3.637z" fill="#6e17ff"/></g><g filter="url(#g)"><path d="m887.556 682.237c2.009 0 3.637-1.629 3.637-3.637 0-2.009-1.628-3.637-3.637-3.637-2.008 0-3.637 1.628-3.637 3.637 0 2.008 1.629 3.637 3.637 3.637z" fill="#6e17ff"/></g><g filter="url(#h)"><path d="m764.365 795.089c2.009 0 3.637-1.628 3.637-3.637 0-2.008-1.628-3.636-3.637-3.636-2.008 0-3.637 1.628-3.637 3.636 0 2.009 1.629 3.637 3.637 3.637z" fill="#6e17ff"/></g><g filter="url(#i)"><path d="m503.664 589.219c2.008 0 3.636-1.628 3.636-3.636 0-2.009-1.628-3.637-3.636-3.637-2.009 0-3.637 1.628-3.637 3.637 0 2.008 1.628 3.636 3.637 3.636z" fill="#6e17ff"/></g><g filter="url(#j)"><path d="m392.626 801.455c2.008 0 3.637-1.629 3.637-3.637 0-2.009-1.629-3.637-3.637-3.637-2.009 0-3.637 1.628-3.637 3.637 0 2.008 1.628 3.637 3.637 3.637z" fill="#6e17ff"/></g><path d="m912.441 488.04 383.489-221.407" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m916.702 518.526 45.95-26.642 28.431 16.415 71.077-41.036" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1230.37 550.699-38.31 19.369-39.85-23.567-59.76 35.07-29.89-17.256-129.154 74.769-83.47-48.773" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1289.27 640.471-77.27 44.62-149.85-86.516-139.048 80.768-100.482-58.843" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m913.319 563.907 34.144 19.48 84.407-48.719" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1331.82 659.245 28.43 16.414-85.29 49.245" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1033.73 450.843 259.58-149.867" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m821.993 236.391-47.037 27.157 28.431 16.41-155.351 89.696 98.496 49.833" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m877.38 249.497 37.545 21.677-140.793 81.281" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m899.959 430.625 77.58-45.828-29.103-16.026 29.103-17.232" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m872.979 509.732-265.733 153.421 35.542 19.904-70.29 40.591" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m618.844 843.464 73.682-42.721 28.431 16.415 71.079-41.036" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m392.992 503.359 77.58-45.829-29.103-16.026 29.103-17.231" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m732.162 214.565-33.718-19.467-27.689 16.279" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m953.463 249.287-38.948-22.961" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1161.67 459.054 57.18-32.646-71.4-41.221" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1076.37 541.124 70.38-41.437" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m770.739 643.717 49.75 28.724-28.435 16.412 42.659 24.63" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m356.637 562.224 45.865 26.481-26.215 15.131c16.117 9.279 32.233 18.558 48.35 27.837l120.412-69.52 70.241 40.901c7.092-4.094 14.183-8.189 21.274-12.283" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m591.166 324.632 28.431 17.207-28.431 16.414 56.87 32.829" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m377.564 788.873 28.431 17.207-28.431 16.414 80.101 46.239" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m700.396 860.216 28.431 17.207-28.431 16.415 56.87 32.829" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1021.77 367.957 70.39-41.437" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m1287.61 442.19 70.39-41.437" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m944.111 718.534 70.389-41.437" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m693.807 683.061c17.004 9.817 34.007 19.634 51.011 29.452-17.004 9.817-34.007 19.634-51.011 29.451" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m284.788 589.677 80.193 46.3-50.994 29.452 25.492 14.733" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m515.32 491.657-76.559 44.143" stroke="#cdd8dd" stroke-linejoin="round" stroke-width="1.55"/><path d="m844.147 713.184c2.657 1.534 2.671 4.014.043 5.541-2.64 1.534-6.921 1.534-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.528 6.91-1.528 9.555 0zm-8.198 4.764c1.905 1.099 5.002 1.099 6.894 0 1.893-1.1 1.871-2.887-.034-3.987s-4.977-1.1-6.87 0-1.895 2.887.01 3.987z" fill="#cdd8dd"/><path d="m1039.76 528.917c2.65 1.534 2.67 4.014.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.64-1.528-2.66-4.008-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.9 1.1 5 1.1 6.89 0 1.9-1.1 1.87-2.886-.03-3.986-1.91-1.1-4.98-1.1-6.87 0s-1.9 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1161.98 458.345c2.66 1.534 2.67 4.014.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.64-1.528-2.66-4.008-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.91 1.1 5 1.1 6.89 0 1.9-1.1 1.88-2.886-.03-3.986-1.9-1.1-4.98-1.1-6.87 0s-1.89 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1154.66 494.413c2.65 1.535 2.67 4.015.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.9 1.1 5 1.1 6.89 0s1.87-2.886-.03-3.986c-1.91-1.1-4.98-1.1-6.87 0-1.9 1.1-1.9 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1077.58 540.801c2.66 1.535 2.67 4.015.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.64-1.527-2.66-4.007-.02-5.541 2.63-1.528 6.91-1.528 9.56-.001zm-8.2 4.764c1.91 1.1 5 1.1 6.89 0 1.9-1.099 1.88-2.886-.03-3.986s-4.98-1.1-6.87 0-1.89 2.887.01 3.986z" fill="#cdd8dd"/><path d="m1069.56 461.563c2.65 1.534 2.67 4.014.04 5.541-2.64 1.534-6.92 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.541 2.63-1.528 6.91-1.528 9.56 0zm-8.2 4.764c1.9 1.099 5 1.099 6.89 0 1.89-1.1 1.87-2.887-.03-3.987-1.91-1.1-4.98-1.1-6.87 0s-1.9 2.887.01 3.987z" fill="#cdd8dd"/><path d="m1033.97 449.705c2.65 1.534 2.67 4.014.04 5.541-2.64 1.535-6.92 1.535-9.58.001-2.65-1.528-2.66-4.008-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.9 1.1 5 1.1 6.89 0s1.87-2.887-.03-3.986c-1.91-1.1-4.98-1.1-6.87 0-1.9 1.1-1.9 2.886.01 3.986z" fill="#cdd8dd"/><path d="m985.506 346.071c2.657 1.534 2.671 4.014.043 5.541-2.64 1.535-6.921 1.535-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.527 6.91-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.002 1.1 6.894 0 1.893-1.1 1.871-2.887-.034-3.987-1.905-1.099-4.977-1.099-6.87 0-1.893 1.1-1.895 2.887.01 3.987z" fill="#cdd8dd"/><path d="m963.025 248.942c2.657 1.534 2.671 4.014.043 5.541-2.64 1.534-6.922 1.534-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.528 6.909-1.528 9.555 0zm-8.198 4.764c1.905 1.099 5.001 1.099 6.894 0 1.893-1.1 1.871-2.887-.035-3.987-1.905-1.1-4.977-1.1-6.869 0-1.893 1.1-1.895 2.887.01 3.987z" fill="#cdd8dd"/><path d="m671.389 211.298c2.658 1.535 2.672 4.015.044 5.542-2.64 1.534-6.922 1.534-9.579 0-2.646-1.527-2.66-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.554 0zm-8.197 4.764c1.905 1.1 5.001 1.1 6.894 0 1.892-1.1 1.87-2.886-.035-3.986s-4.977-1.1-6.87 0c-1.892 1.1-1.894 2.886.011 3.986z" fill="#cdd8dd"/><path d="m591.684 319.532c2.658 1.535 2.672 4.015.044 5.542-2.64 1.534-6.922 1.534-9.579 0-2.646-1.527-2.659-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.554 0zm-8.197 4.764c1.905 1.1 5.001 1.1 6.894 0s1.87-2.886-.035-3.986-4.977-1.1-6.869 0c-1.893 1.1-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m378.083 783.773c2.657 1.535 2.671 4.015.043 5.542-2.64 1.534-6.922 1.534-9.579 0-2.646-1.527-2.659-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.001 1.1 6.894 0s1.87-2.886-.035-3.986-4.977-1.1-6.869 0c-1.893 1.1-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m348.266 679.303c2.657 1.535 2.671 4.015.043 5.542-2.64 1.534-6.922 1.534-9.579 0-2.646-1.527-2.659-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.001 1.1 6.894 0s1.87-2.886-.035-3.986-4.977-1.1-6.869 0c-1.893 1.1-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m700.914 855.117c2.658 1.534 2.672 4.014.044 5.541-2.64 1.535-6.922 1.535-9.579 0-2.646-1.527-2.66-4.007-.019-5.541 2.628-1.527 6.909-1.527 9.554 0zm-8.197 4.764c1.905 1.1 5.001 1.1 6.894 0 1.892-1.1 1.87-2.887-.035-3.987-1.905-1.099-4.977-1.099-6.87 0-1.892 1.1-1.894 2.887.011 3.987z" fill="#cdd8dd"/><path d="m766.555 925.555c2.657 1.534 2.671 4.014.043 5.541-2.64 1.535-6.922 1.535-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.527 6.91-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.001 1.1 6.894 0s1.871-2.887-.034-3.986c-1.905-1.1-4.977-1.1-6.87 0-1.893 1.099-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1100.06 321.247c2.66 1.534 2.67 4.014.05 5.541-2.64 1.534-6.93 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.541 2.63-1.528 6.91-1.528 9.55 0zm-8.2 4.763c1.91 1.1 5.01 1.1 6.9 0 1.89-1.099 1.87-2.886-.04-3.986-1.9-1.1-4.97-1.1-6.87 0-1.89 1.1-1.89 2.887.01 3.986z" fill="#cdd8dd"/><path d="m1022.98 367.635c2.66 1.534 2.68 4.014.05 5.541-2.64 1.534-6.92 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.541 2.63-1.528 6.91-1.528 9.55 0zm-8.19 4.764c1.9 1.099 5 1.099 6.89-.001 1.89-1.099 1.87-2.886-.03-3.986-1.91-1.1-4.98-1.1-6.87 0-1.9 1.1-1.9 2.887.01 3.987z" fill="#cdd8dd"/><path d="m1365.9 395.479c2.66 1.534 2.67 4.015.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.64-1.527-2.66-4.007-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.91 1.1 5 1.1 6.89 0 1.9-1.1 1.88-2.886-.03-3.986-1.9-1.1-4.98-1.1-6.87 0s-1.89 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1288.82 441.867c2.66 1.535 2.67 4.015.05 5.542-2.65 1.534-6.93 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.542 2.62-1.527 6.91-1.527 9.55 0zm-8.2 4.764c1.91 1.1 5.01 1.1 6.9 0s1.87-2.886-.04-3.986c-1.9-1.1-4.97-1.1-6.87 0-1.89 1.1-1.89 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1022.4 671.823c2.66 1.535 2.67 4.015.04 5.542-2.64 1.534-6.92 1.534-9.58 0-2.64-1.527-2.66-4.007-.02-5.542 2.63-1.527 6.91-1.527 9.56 0zm-8.2 4.764c1.91 1.1 5 1.1 6.89 0 1.9-1.1 1.88-2.886-.03-3.986-1.9-1.1-4.98-1.1-6.87 0s-1.89 2.886.01 3.986z" fill="#cdd8dd"/><path d="m1275.73 724.059c2.65 1.534 2.67 4.014.04 5.541-2.64 1.534-6.92 1.534-9.58 0-2.65-1.527-2.66-4.007-.02-5.541 2.63-1.528 6.91-1.528 9.56 0zm-8.2 4.763c1.9 1.1 5 1.1 6.89 0 1.89-1.099 1.87-2.886-.03-3.986-1.91-1.1-4.98-1.1-6.87 0s-1.9 2.887.01 3.986z" fill="#cdd8dd"/><path d="m945.322 718.211c2.657 1.535 2.671 4.015.043 5.542-2.64 1.534-6.922 1.534-9.579 0-2.645-1.527-2.659-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.001 1.1 6.894 0s1.87-2.886-.035-3.986-4.977-1.1-6.869 0c-1.893 1.1-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m800.584 770.727c2.658 1.535 2.672 4.015.044 5.542-2.641 1.534-6.922 1.534-9.579 0-2.646-1.527-2.66-4.007-.019-5.542 2.628-1.527 6.909-1.527 9.554 0zm-8.197 4.764c1.905 1.1 5.001 1.1 6.894 0 1.892-1.1 1.87-2.886-.035-3.986s-4.977-1.1-6.87 0c-1.892 1.1-1.894 2.887.011 3.986z" fill="#cdd8dd"/><path d="m694.675 677.961c2.657 1.534 2.671 4.014.043 5.541-2.64 1.534-6.922 1.534-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.528 6.909-1.528 9.555 0zm-8.198 4.764c1.905 1.099 5.001 1.099 6.894-.001 1.893-1.099 1.871-2.886-.034-3.986-1.906-1.1-4.978-1.1-6.87 0-1.893 1.1-1.895 2.887.01 3.987z" fill="#cdd8dd"/><path d="m694.675 741.515c2.657 1.534 2.671 4.014.043 5.541-2.64 1.534-6.922 1.535-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.527 6.909-1.528 9.555 0zm-8.198 4.764c1.905 1.099 5.001 1.1 6.894 0s1.871-2.887-.034-3.987c-1.906-1.1-4.978-1.099-6.87 0-1.893 1.1-1.895 2.887.01 3.987z" fill="#cdd8dd"/><path d="m523.359 486.047c2.657 1.534 2.671 4.014.043 5.542-2.64 1.534-6.921 1.534-9.579 0-2.645-1.528-2.659-4.008-.019-5.542 2.628-1.527 6.91-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.002 1.1 6.894 0 1.893-1.1 1.871-2.886-.034-3.986s-4.977-1.1-6.87 0-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m478.99 419.122c2.657 1.534 2.671 4.014.043 5.542-2.64 1.534-6.921 1.534-9.579 0-2.645-1.528-2.659-4.008-.019-5.542 2.628-1.527 6.91-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.002 1.1 6.894 0 1.893-1.1 1.871-2.886-.034-3.986s-4.977-1.1-6.87 0-1.895 2.886.01 3.986z" fill="#cdd8dd"/><path d="m438.888 535.338c2.657 1.534 2.671 4.014.043 5.541-2.64 1.535-6.922 1.535-9.579 0-2.645-1.527-2.659-4.007-.019-5.541 2.628-1.527 6.909-1.527 9.555 0zm-8.198 4.764c1.905 1.1 5.001 1.1 6.894 0s1.87-2.887-.035-3.987c-1.905-1.099-4.977-1.099-6.869.001-1.893 1.099-1.895 2.886.01 3.986z" fill="#cdd8dd"/><g filter="url(#k)" opacity=".8"><path d="m625.804 726.241-.491 173.467c0 .355-.232.696-.668.956l-102.31 59.525c-.9.519-2.374.519-3.274 0l-102.964-59.525c-.478-.26-.696-.601-.696-.956l.477-172.675c-.709-.519-.641-1.284.192-1.762l102.296-59.525c.9-.532 2.373-.532 3.287 0l102.978 59.525c.9.519.9 1.38 0 1.899l-102.296 59.538c-.409.246-.955.369-1.5.369.709.082 1.459-.054 2.005-.369l102.282-59.525c.464-.259.682-.601.682-.942z" fill="#fff"/></g><path d="m626.045 725.983-.483 173.66c0 .344-.234.689-.675.951l-102.545 59.591c-.909.524-2.384.524-3.294 0l-103.206-59.591c-.469-.262-.689-.607-.689-.951l.482-173.674c0 .345.234.689.689.965l103.22 59.591c.91.524 2.385.524 3.295 0l102.53-59.591c.455-.262.676-.606.676-.951z" fill="#ccd7dc"/><path d="m626.046 725.975-.482 173.66c0 .345-.235.689-.676.951l-102.544 59.591c-.91.524-2.385.524-3.295 0l-103.206-59.591c-.469-.262-.689-.606-.689-.951l.482-173.674c0 .345.235.69.689.965l103.22 59.592c.91.523 2.385.523 3.295 0l102.531-59.592c.454-.262.675-.606.675-.951z" fill="url(#q)" opacity=".65"/><path d="m422.789 895.163 87.189 52.299.427-154.789-87.616-52.547z" fill="#5e2ad7"/><path d="m625.364 725.021c.91.525.915 1.383.011 1.908l-102.54 59.59c-.904.525-2.385.525-3.295 0l-103.21-59.589c-.921-.531-.916-1.383-.011-1.909l102.539-59.589c.905-.525 2.375-.532 3.296 0z" fill="#eff1f3"/><path d="m422.789 895.163 87.189 52.299.427-154.789-87.616-52.547z" fill="url(#s)" opacity=".5"/><path d="m615.082 767.916c1.22-.704 2.205-.133 2.209 1.268.004 1.402-.975 3.107-2.195 3.811l-74.746 43.155c-1.22.704-2.213.138-2.217-1.264-.004-1.401.983-3.11 2.202-3.815z" fill="#fff"/><path d="m615.082 784.405c1.22-.704 2.205-.133 2.209 1.268.004 1.402-.975 3.106-2.195 3.811l-74.746 43.154c-1.22.705-2.213.139-2.217-1.263s.983-3.111 2.202-3.815z" fill="#fff"/><path d="m615.084 800.894c1.22-.704 2.205-.134 2.209 1.268.004 1.401-.975 3.106-2.194 3.81l-74.747 43.155c-1.22.704-2.213.138-2.217-1.263-.004-1.402.983-3.111 2.203-3.815z" fill="#fff"/><path d="m615.082 817.383c1.22-.705 2.205-.134 2.209 1.268.004 1.401-.975 3.106-2.195 3.81l-74.746 43.155c-1.22.704-2.213.138-2.217-1.263-.004-1.402.983-3.111 2.202-3.816z" fill="#fff"/><path d="m615.082 833.871c1.22-.704 2.205-.133 2.209 1.268.004 1.402-.975 3.107-2.195 3.811l-74.746 43.155c-1.22.704-2.213.138-2.217-1.264-.004-1.401.983-3.111 2.202-3.815z" fill="#fff"/><path d="m615.084 850.36c1.22-.704 2.205-.134 2.209 1.268s-.975 3.106-2.194 3.81l-74.747 43.155c-1.22.705-2.213.138-2.217-1.263-.004-1.402.983-3.111 2.203-3.815z" fill="#fff"/><path d="m615.084 866.849c1.22-.705 2.205-.134 2.209 1.268.004 1.401-.975 3.106-2.194 3.81l-74.747 43.155c-1.22.704-2.213.138-2.217-1.263-.004-1.402.983-3.111 2.203-3.816z" fill="#fff"/><path d="m595.76 726.782-8.285 4.811-66.98-38.666c-.661-.386-1.737-.386-2.398 0l-66.484 38.639-8.284-4.784c-.662-.385-.662-1.02 0-1.392l74.768-43.449c.661-.386 1.737-.4 2.398 0l75.265 43.449c.661.372.661 1.007 0 1.392z" fill="#587e8c"/><path d="m587.475 731.593-66.483 38.639c-.662.386-1.737.386-2.399 0l-66.98-38.666 66.484-38.639c.661-.386 1.737-.386 2.398 0z" fill="#ccd7dc"/><path d="m455.629 775.972c.934.539 1.689 1.847 1.686 2.92-.003 1.072-.763 1.506-1.697.967l-19.775-11.418c-.934-.539-1.689-1.847-1.686-2.92.003-1.072.763-1.506 1.697-.967z" fill="#fff"/><path d="m455.629 784.978c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-19.775-11.417c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m455.629 804.173c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-19.775-11.417c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m484.385 793.506c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.934-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff"/><path d="m458.812 796.031c.934.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m474.805 826.722c.933.539 1.689 1.847 1.686 2.926-.003 1.072-.764 1.506-1.697.967l-13.072-7.547c-.934-.539-1.689-1.848-1.686-2.921.003-1.078.763-1.511 1.697-.972z" fill="#fff" opacity=".8"/><path d="m474.81 796.232c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.934-.539-1.689-1.847-1.686-2.92.003-1.078.763-1.512 1.697-.973z" fill="#fff"/><path d="m478.856 808.187c.934.538 1.689 1.847 1.686 2.925-.003 1.073-.763 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.004-1.078.764-1.511 1.697-.973z" fill="#fff" opacity=".8"/><path d="m476.158 816.251c.933.538 1.688 1.847 1.685 2.926-.003 1.072-.763 1.505-1.696.967l-13.072-7.548c-.934-.538-1.689-1.847-1.686-2.92.003-1.078.763-1.511 1.697-.973z" fill="#fff"/><path d="m464.747 781.609c.934.539 1.689 1.848 1.686 2.92s-.763 1.506-1.697.967l-2.552-1.474c-.933-.539-1.689-1.847-1.686-2.92.003-1.072.764-1.506 1.697-.967z" fill="#fff" opacity=".8"/><path d="m487.353 804.353c.933.539 1.688 1.848 1.685 2.92-.003 1.073-.763 1.506-1.696.967l-2.553-1.473c-.933-.539-1.689-1.848-1.686-2.92.003-1.073.764-1.506 1.697-.967z" fill="#fff"/><path d="m488.119 814.163c.934.538 1.689 1.847 1.686 2.92-.003 1.072-.764 1.505-1.697.967l-2.552-1.474c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m486.794 822.642c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.473c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m438.338 804.353c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.473c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m446.51 809.408c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.473c-.934-.539-1.689-1.848-1.686-2.92.003-1.073.763-1.506 1.697-.967z" fill="#fff"/><path d="m454.936 814.824c.933.539 1.689 1.848 1.686 2.92-.003 1.073-.764 1.506-1.697.967l-2.553-1.473c-.933-.539-1.689-1.848-1.686-2.92.003-1.073.764-1.506 1.697-.967z" fill="#fff"/><path d="m438.338 784.134c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.474c-.934-.538-1.689-1.847-1.686-2.92.003-1.072.763-1.506 1.697-.967z" fill="#fff"/><path d="m455.071 824.07c.933.538 1.689 1.847 1.686 2.92-.003 1.072-.764 1.505-1.697.967l-19.776-11.418c-.933-.539-1.689-1.847-1.685-2.92.003-1.072.763-1.506 1.696-.967z" fill="#fff" opacity=".8"/><path d="m455.071 833.076c.933.539 1.689 1.848 1.686 2.92-.003 1.073-.764 1.506-1.697.967l-19.776-11.417c-.933-.539-1.689-1.848-1.685-2.92.003-1.073.763-1.506 1.696-.967z" fill="#fff" opacity=".8"/><path d="m455.071 852.271c.933.539 1.689 1.847 1.686 2.92-.003 1.072-.764 1.506-1.697.967l-19.776-11.418c-.933-.538-1.689-1.847-1.685-2.92.003-1.072.763-1.506 1.696-.967z" fill="#fff" opacity=".8"/><path d="m483.827 841.604c.933.539 1.688 1.848 1.685 2.926-.003 1.072-.763 1.506-1.696.967l-13.072-7.547c-.934-.539-1.689-1.848-1.686-2.92.003-1.079.763-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m458.254 844.129c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.934-.539-1.689-1.848-1.686-2.92.003-1.079.763-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m474.246 874.819c.934.539 1.689 1.848 1.686 2.926-.003 1.073-.763 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m474.251 844.33c.934.539 1.689 1.848 1.686 2.926-.003 1.072-.763 1.506-1.697.967l-13.072-7.547c-.933-.539-1.688-1.848-1.685-2.92.003-1.079.763-1.512 1.696-.973z" fill="#fff"/><path d="m467.93 884.088c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m478.298 856.284c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m475.599 864.348c.933.539 1.689 1.848 1.686 2.926-.003 1.073-.764 1.506-1.697.967l-13.072-7.547c-.933-.539-1.689-1.847-1.686-2.92.003-1.078.764-1.512 1.697-.973z" fill="#fff" opacity=".8"/><path d="m464.189 829.707c.933.539 1.689 1.847 1.686 2.92-.003 1.072-.764 1.506-1.697.967l-2.552-1.474c-.934-.539-1.689-1.847-1.686-2.92.003-1.072.763-1.506 1.697-.967z" fill="#fff" opacity=".8"/><path d="m486.794 852.451c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.474c-.934-.539-1.689-1.847-1.686-2.92.003-1.072.763-1.506 1.697-.967z" fill="#fff" opacity=".8"/><path d="m487.561 862.26c.933.539 1.689 1.848 1.686 2.92-.003 1.073-.764 1.506-1.697.967l-2.553-1.473c-.933-.539-1.689-1.848-1.686-2.92.003-1.073.764-1.506 1.697-.967z" fill="#fff" opacity=".8"/><path d="m437.78 852.451c.933.539 1.689 1.848 1.686 2.92-.003 1.073-.764 1.506-1.697.967l-2.553-1.474c-.933-.539-1.689-1.847-1.686-2.92.003-1.072.764-1.506 1.697-.967z" fill="#fff"/><path d="m445.952 857.506c.933.539 1.689 1.848 1.686 2.92-.003 1.073-.764 1.506-1.697.967l-2.553-1.474c-.933-.538-1.689-1.847-1.686-2.92.003-1.072.764-1.505 1.697-.967z" fill="#fff" opacity=".8"/><path d="m454.377 862.922c.934.539 1.689 1.848 1.686 2.92-.003 1.073-.763 1.506-1.697.967l-2.552-1.474c-.933-.538-1.689-1.847-1.686-2.92.003-1.072.764-1.505 1.697-.967z" fill="#fff" opacity=".8"/><path d="m437.78 832.232c.933.539 1.689 1.847 1.686 2.92-.003 1.072-.764 1.506-1.697.967l-2.553-1.474c-.933-.539-1.689-1.847-1.686-2.92.003-1.072.764-1.506 1.697-.967z" fill="#fff" opacity=".8"/><path d="m427.75 743.944c-.01 1.163-.414 1.99-1.078 2.375l-1.355.789c.663-.385 1.067-1.212 1.077-2.376 0-2.337-1.645-5.193-3.683-6.366-1.02-.596-1.953-.644-2.626-.26l1.356-.788c.673-.385 1.596-.337 2.625.26 2.039 1.173 3.684 4.029 3.684 6.366z" fill="#587e8c"/><path d="m422.712 738.366c2.039 1.176 3.685 4.028 3.678 6.37s-1.664 3.287-3.702 2.11-3.685-4.028-3.678-6.371c.007-2.342 1.664-3.286 3.702-2.109z" fill="#fff"/><path d="m427.469 895.366c-.009 1.164-.413 1.991-1.077 2.376l-1.356.788c.664-.385 1.068-1.212 1.077-2.375 0-2.337-1.644-5.193-3.683-6.366-1.019-.596-1.952-.645-2.625-.26l1.356-.788c.673-.385 1.596-.337 2.625.259 2.039 1.173 3.683 4.03 3.683 6.366z" fill="#587e8c"/><path d="m422.432 889.788c2.038 1.177 3.684 4.028 3.678 6.371-.007 2.342-1.664 3.286-3.702 2.109-2.039-1.176-3.685-4.028-3.678-6.37.006-2.342 1.663-3.287 3.702-2.11z" fill="#fff"/><path d="m512.276 794.256c-.01 1.164-.414 1.991-1.077 2.376l-1.356.788c.663-.385 1.067-1.212 1.077-2.375 0-2.337-1.645-5.193-3.683-6.366-1.02-.597-1.953-.645-2.626-.26l1.356-.789c.673-.384 1.597-.336 2.626.26 2.038 1.173 3.683 4.029 3.683 6.366z" fill="#587e8c"/><path d="m507.238 788.678c2.039 1.177 3.685 4.028 3.678 6.371-.006 2.342-1.663 3.286-3.702 2.109-2.038-1.177-3.684-4.028-3.678-6.37.007-2.343 1.664-3.287 3.702-2.11z" fill="#fff"/><path d="m512.276 945.471c-.01 1.164-.414 1.991-1.077 2.375l-1.356.789c.663-.385 1.067-1.212 1.077-2.375 0-2.337-1.645-5.193-3.683-6.366-1.02-.597-1.953-.645-2.626-.26l1.356-.789c.673-.384 1.597-.336 2.626.26 2.038 1.173 3.683 4.029 3.683 6.366z" fill="#587e8c"/><path d="m507.238 939.893c2.039 1.177 3.685 4.028 3.678 6.371-.006 2.342-1.663 3.286-3.702 2.109-2.038-1.177-3.684-4.028-3.678-6.37.007-2.343 1.664-3.287 3.702-2.11z" fill="#fff"/><path d="m625.364 725.021c.91.525.915 1.383.011 1.908l-102.54 59.59c-.904.525-2.385.525-3.295 0l-103.21-59.589c-.921-.531-.916-1.383-.011-1.909l102.539-59.589c.905-.525 2.375-.532 3.296 0z" fill="url(#t)" opacity=".8"/><path d="m625.112 725.008c.91.525.915 1.383.011 1.909l-102.54 59.589c-.904.525-2.385.526-3.295 0l-103.211-59.589c-.92-.531-.915-1.383-.01-1.908l102.539-59.59c.904-.525 2.375-.531 3.296 0z" fill="url(#u)"/><path d="m626.291 725.975-.482 173.66c0 .345-.235.689-.676.951l-102.544 59.591c-.91.524-2.385.524-3.295 0l-103.206-59.591c-.469-.262-.689-.606-.689-.951l.482-173.674c0 .345.235.69.689.965l103.22 59.592c.91.523 2.385.523 3.295 0l102.531-59.592c.454-.262.675-.606.675-.951z" fill="url(#v)"/><g opacity=".6"><g fill="#fff" filter="url(#l)" opacity=".8"><path d="m1249.4 515.957-.21.205c-.59.288-1.19.617-1.76.945z"/><path d="m1447.62 679.147c-1.11-16.348-13.12-36.392-28.03-45.408-.12-2.095-1.52-20.188-15.14-38.323-6.47-8.626-13.1-13.822-18.46-16.902-5.91-3.409-10.27-4.293-11.13-4.457-9.24-30.046-30.46-58.223-53.64-71.613-1.09-.637-2.2-1.233-3.31-1.808-14.75-7.557-28.3-8.03-38.32-2.218l-18.06 10.495c-1.93.534-3.77 1.273-5.54 2.218-5.59-3.163-12.92-5.956-19.96-4.313-1.71.411-3.21 1.006-4.54 1.787l-19.57 11.377h-.02c-.15.021-.29.042-.44.083-3.75.883-6.57 2.813-8.66 5.216-.21.226-.39.452-.58.698-.26.329-.53.658-.76 1.007-1.02 1.458-1.83 3.019-2.44 4.58l-11.89 7.023c-1.89-.369-3.68-.411-5.32-.164h-.02c-3.16.452-5.79 1.992-7.74 4.498 0 0 0 .02-.03.02-.24.349-.49.698-.73 1.109-1.32 2.116-2.18 4.806-2.47 7.989-1.31 14.335 9.37 34.647 23.45 43.129 66.85 38.589 133.72 77.179 200.57 115.789 6.43 3.491 12.24 4.272 16.9 2.875l4.95-2.608 22.74-11.953c5.65-3.286 8.85-10.474 8.19-20.126zm-198.43-162.985c-.59.288-1.19.617-1.76.945l1.97-1.15z"/><path d="m1249.4 515.957-.21.205c-.59.288-1.19.617-1.76.945z"/></g><g filter="url(#m)" opacity=".8"><path d="m1416.69 711.226c-1.45 1.191-3.1 2.074-4.95 2.608z" fill="#fff"/></g></g><path d="m1249.4 515.957-1.97 1.15c.57-.328 1.17-.657 1.76-.945-3.72 3.738-6.65 8.667-8.6 14.726-.89-.781-4.25-3.676-8.86-6.346-5.5-3.184-12.79-6.018-19.81-4.56l19.57-11.377c1.33-.781 2.83-1.376 4.54-1.787 7.04-1.643 14.37 1.15 19.96 4.313-2.4 1.253-4.6 2.875-6.59 4.826z" fill="#c8d6dc"/><path d="m1249.4 515.957c-.06.062-.15.144-.21.205-.59.288-1.19.617-1.76.945z" fill="#c8d6dc"/><path d="m1439.43 699.273-27.69 14.561c3.7-3.676 12.05-10.922 11.32-21.441-1.13-16.347-13.12-36.412-28.03-45.408-.13-2.095-1.52-20.188-15.14-38.343-6.47-8.626-13.1-13.801-18.46-16.882-5.9-3.409-10.27-4.292-11.15-4.456-9.22-30.046-30.44-58.244-53.63-71.614-1.09-.637-2.19-1.253-3.3-1.807-11.77-6.018-22.76-7.558-31.82-4.97l18.06-10.495c10.02-5.812 23.57-5.339 38.32 2.218 1.11.575 2.22 1.171 3.31 1.808 23.18 13.39 44.4 41.567 53.64 71.613.86.165 5.22 1.048 11.13 4.457 5.36 3.08 11.99 8.276 18.46 16.902 13.62 18.134 15.02 36.228 15.14 38.323 14.91 9.016 26.92 29.06 28.03 45.408.66 9.652-2.54 16.84-8.19 20.126z" fill="#c8d6dc"/><path d="m1249.4 515.957c-.06.062-.15.144-.21.205-.59.288-1.19.617-1.76.945z" fill="#c8d6dc"/><path d="m1199.01 531.566-11.89 7.022 14.8 10.775z" fill="#c8d6dc"/><g opacity=".8"><path d="m1249.4 515.957-1.97 1.15c.57-.328 1.17-.657 1.76-.945-3.72 3.738-6.65 8.667-8.6 14.726-.89-.781-4.25-3.676-8.86-6.346-5.5-3.184-12.79-6.018-19.81-4.56l19.57-11.377c1.33-.781 2.83-1.376 4.54-1.787 7.04-1.643 14.37 1.15 19.96 4.313-2.4 1.253-4.6 2.875-6.59 4.826z" fill="url(#x)"/><path d="m1249.4 515.957c-.06.062-.15.144-.21.205-.59.288-1.19.617-1.76.945z" fill="url(#y)"/><path d="m1439.43 699.273-27.69 14.561c.01-.098.01-.196.01-.295 1.19-5.77 2.02-12.97 1.44-21.175-1.55-22.307-12.46-38.213-18.16-45.379-.13-2.095-1.52-20.188-15.14-38.343-6.47-8.626-13.1-13.801-18.46-16.882-5.9-3.409-10.27-4.292-11.15-4.456-9.22-30.046-30.44-58.244-53.63-71.614-1.09-.637-2.19-1.253-3.3-1.807-11.77-6.018-22.76-7.558-31.82-4.97l18.06-10.495c10.02-5.812 23.57-5.339 38.32 2.218 1.11.575 2.22 1.171 3.31 1.808 23.18 13.39 44.4 41.567 53.64 71.613.86.165 5.22 1.048 11.13 4.457 5.36 3.08 11.99 8.276 18.46 16.902 13.62 18.134 15.02 36.228 15.14 38.323 14.91 9.016 26.92 29.06 28.03 45.408.66 9.652-2.54 16.84-8.19 20.126z" fill="url(#z)"/><path d="m1249.4 515.957c-.06.062-.15.144-.21.205-.59.288-1.19.617-1.76.945z" fill="url(#y)"/><path d="m1199.01 531.566-11.89 7.022 14.8 10.775z" fill="url(#A)"/></g><path d="m1411.74 713.834c-4.66 1.397-10.47.616-16.9-2.875-66.85-38.61-133.72-77.2-200.57-115.789-14.08-8.482-24.76-28.794-23.45-43.129.29-3.183 1.15-5.874 2.47-7.989.24-.411.49-.76.73-1.109.03 0 .03-.02.03-.02 1.95-2.506 4.58-4.046 7.74-4.498h.02c3.76-.575 8.21.411 12.94 3.142.61.37 1.23.739 1.85 1.15.06-1.355.53-9.488 4.86-15.731.23-.35.5-.678.76-1.007.19-.246.37-.472.58-.698 2.09-2.403 4.91-4.333 8.66-5.216.15-.041.29-.062.44-.083h.02c7.02-1.458 14.31 1.376 19.81 4.56 4.61 2.67 7.97 5.565 8.86 6.346 1.95-6.059 4.88-10.988 8.6-14.726.06-.061.15-.143.21-.205 1.99-1.951 4.19-3.573 6.59-4.826 1.77-.945 3.61-1.684 5.54-2.218 9.06-2.588 20.05-1.048 31.82 4.97 1.11.554 2.21 1.17 3.3 1.807 23.19 13.37 44.41 41.568 53.63 71.614.88.164 5.25 1.047 11.15 4.456 5.36 3.081 11.99 8.256 18.46 16.882 13.62 18.155 15.01 36.248 15.14 38.343 14.91 8.996 26.9 29.061 28.03 45.408.78 11.316-3.76 19.223-11.32 21.441z" fill="#fff"/><path d="m1336.5 628.802c3.11 1.794 5.61 3.949 6.15 5.013 1.1 2.254-.34 12.433-5.82 14.548-.3.126-.6.09-.84-.049-.42-.244-.66-.806-.42-1.351 1.25-2.814 4.02-9.158 2.73-11.803-.58-1.197-2.37-2.509-4.47-3.721-2.59-1.491-5.63-2.834-7.46-3.631-.06-.029-.13-.06-.18-.094-.83-.478-.91-1.433-.06-1.646 3.02-.698 7.04.81 10.37 2.734z" fill="#5e2ad7"/><path d="m1337.78 608.08c.96 2.005 1.42 3.953 1.42 5.805-.01 1.533-.29 2.761-.82 3.669-.56.893-1.31 1.528-2.27 1.82-.96.34-2.12.314-3.45.006-1.39-.29-2.85-.893-4.44-1.807-1.61-.93-3.22-2.069-4.76-3.39-1.55-1.327-2.76-2.489-3.56-3.48-.5-.609-.84-1.169-.96-1.558-.12-.393-.18-.777-.18-1.095l.01-1.819c0-.751.25-.957.71-.692.18.104.37.247.55.414.2.193.48.496.78.818 1.06 1.137 2.19 2.223 3.4 3.21 1.25 1.008 2.46 1.848 3.69 2.562 1.95 1.124 3.48 1.606 4.54 1.434 1.04-.18 1.61-.985 1.62-2.452 0-.99-.29-1.988-.84-2.98-.56-1.007-1.61-2.206-3.12-3.656l-4.5-4.21c-2.25-2.113-3.92-4.297-4.93-6.479-1.03-2.157-1.55-4.218-1.55-6.068.01-1.485.29-2.649.85-3.462.56-.827 1.31-1.384 2.24-1.63.94-.292 2-.272 3.23.01 1.24.282 2.55.861 3.91 1.647.68.393 1.38.834 2.08 1.347.71.504 1.36 1.025 2 1.539.62.535 1.22 1.071 1.77 1.599.56.529.99 1.001 1.29 1.383.45.546.75 1.009.93 1.434.2.399.28.829.28 1.339l-.01 1.66c0 .751-.24 1.014-.71.742-.25-.145-.65-.522-1.18-1.114-1.76-1.945-3.74-3.553-5.94-4.82-1.76-1.019-3.17-1.509-4.13-1.377-.96.117-1.46.866-1.47 2.318 0 1.007.32 2.037.93 3.075.62 1.031 1.76 2.36 3.41 3.922l4.4 4.153c2.22 2.098 3.83 4.16 4.78 6.183z" fill="#5e2ad7"/><path d="m1315.86 577.836c.5.289.77.736.77 1.343 0 .175-.03.334-.05.526-.03.207-.1.454-.23.765l-7.55 23.219c-.18.596-.41.932-.64 1.02-.25.063-.66-.027-1.19-.332l-2.66-1.539c-.59-.338-1-.689-1.24-1.065-.25-.4-.47-.991-.59-1.766l-4.74-25.758-4.83 20.185c-.16.63-.35.982-.59 1.099-.25.097-.69-.048-1.25-.369l-2.67-1.539c-.55-.321-.93-.65-1.16-1.027-.25-.367-.47-.991-.65-1.765l-7.21-31.741c-.18-.823-.28-1.343-.28-1.582 0-.574.25-.749.75-.46l3.03 1.748c.6.345 1 .689 1.22 1.056.24.36.43.967.61 1.741l5.14 26.582 4.9-20.783c.16-.613.35-.965.59-1.052.25-.064.68.042 1.25.371l2.47 1.428c.6.345 1 .688 1.24 1.064.25.367.47.991.59 1.733l4.82 26.684 5.43-20.766c.2-.588.41-.932.63-1.027.25-.064.66.027 1.21.347z" fill="#5e2ad7"/><path d="m1276.46 580.622c.25.926.55 1.964 1 3.148.15.375.2.694.2.934 0 .366-.18.614-.59.732l-1.96.369c-.28.048-.56-.001-.81-.145-.3-.177-.6-.528-.92-1.032-.43-.792-.81-1.567-1.11-2.317-.31-.783-.62-1.639-.95-2.662-2.43 1.894-5.48 1.764-9.13-.345-2.61-1.507-4.68-3.547-6.19-6.13-1.52-2.605-2.29-5.321-2.28-8.178 0-3.033.94-4.937 2.84-5.697 1.91-.753 4.41-.236 7.6 1.608 1.06.61 2.14 1.332 3.3 2.173 1.13.832 2.31 1.803 3.55 2.834l.01-2.586c0-2.713-.49-4.885-1.45-6.54-.98-1.686-2.66-3.182-5.04-4.553-1.08-.625-2.2-1.133-3.34-1.47-1.16-.346-2.27-.589-3.35-.72-.5-.05-.88-.122-1.09-.164-.22-.064-.37-.104-.5-.177-.43-.248-.65-.742-.65-1.493l.01-1.739c0-.575.07-.95.22-1.118s.43-.246.87-.253c1.08-.012 2.39.199 3.9.658 1.53.419 3.14 1.126 4.84 2.104 3.69 2.133 6.39 4.663 8.12 7.58 1.7 2.902 2.55 6.32 2.54 10.246l-.03 11.54c.06 1.35.18 2.49.39 3.393zm-5.4-9.176.01-1.5c-.91-.762-1.86-1.539-2.86-2.259-.99-.714-1.95-1.33-2.91-1.884-2.08-1.202-3.6-1.615-4.63-1.249-1.01.387-1.52 1.438-1.52 3.227-.01 1.675.37 3.137 1.13 4.424.75 1.327 1.83 2.383 3.26 3.209 1.01.586 2.07.987 3.19 1.205 1.12.213 2.1-.002 2.96-.581.48-.389.86-.924 1.04-1.681.2-.735.33-1.698.33-2.911z" fill="#5e2ad7"/><path d="m1250.62 581.346c.2.116.43.318.67.619 13.12 16.349 29.31 31.007 46.08 40.686 11.3 6.528 23.74 11.008 35.19 12.054.28.015.55.107.8.252 1.3.75 2.09 2.926.68 3.303-10.22 2.78-25.04-1.187-37.78-8.541-17.86-10.313-33.93-27.181-46.03-46.799-.76-1.222-.37-2.015.39-1.574z" fill="#5e2ad7"/><path d="m1411.74 713.834c-4.66 1.397-10.47.616-16.9-2.875-66.85-38.61-133.72-77.2-200.57-115.789-14.08-8.482-24.76-28.794-23.45-43.129.29-3.183 1.15-5.874 2.47-7.989.24-.411.49-.76.73-1.109.03 0 .03-.02.03-.02 1.95-2.506 4.58-4.046 7.74-4.498h.02c3.76-.575 8.21.411 12.94 3.142.61.37 1.23.739 1.85 1.15.06-1.355.53-9.488 4.86-15.731.23-.35.5-.678.76-1.007.19-.246.37-.472.58-.698 2.09-2.403 4.91-4.333 8.66-5.216.15-.041.29-.062.44-.083h.02c7.02-1.458 14.31 1.376 19.81 4.56 4.61 2.67 7.97 5.565 8.86 6.346 1.95-6.059 4.88-10.988 8.6-14.726.06-.061.15-.143.21-.205 1.99-1.951 4.19-3.573 6.59-4.826 1.77-.945 3.61-1.684 5.54-2.218 9.06-2.588 20.05-1.048 31.82 4.97 1.11.554 2.21 1.17 3.3 1.807 23.19 13.37 44.41 41.568 53.63 71.614.88.164 5.25 1.047 11.15 4.456 5.36 3.081 11.99 8.256 18.46 16.882 13.62 18.155 15.01 36.248 15.14 38.343 14.91 8.996 26.9 29.061 28.03 45.408.78 11.316-3.76 19.223-11.32 21.441z" fill="url(#B)" opacity=".8"/><path d="m1372.64 588.914-.18 63.797c0 .473.34 1.047.74 1.282l43.57 25.154c.41.235.74.05.75-.424l.18-63.796z" fill="#5e2ad7"/><path d="m1417.52 678.72c0 .24-.08.401-.22.481l5.05-2.938c.14-.08.22-.24.22-.48l.18-63.795-45.06-26.005-5.05 2.926 45.06 26.017z" fill="#4925c7"/><path d="m1372.64 588.868 45.05 26.016.01-3.738c0-.468-.33-1.04-.73-1.28l-43.58-25.159c-.11-.069-.23-.103-.33-.103-.06 0-.11.012-.16.034-.16.069-.25.24-.25.492z" fill="#4c7f8d"/><path d="m1372.95 584.616c.03 0 .07-.012.11-.012.1 0 .22.034.33.103l43.58 25.159c.4.24.73.812.73 1.28l-.01 3.738 5.05-2.938.01-3.737c0-.469-.33-1.041-.74-1.281l-43.56-25.147c-.21-.126-.4-.138-.54-.057z" fill="#3c707c"/><path d="m1378.27 588.844c-.56-.326-1.03-.066-1.03.589-.01.654.46 1.452 1.02 1.778.57.329 1.03.065 1.04-.589 0-.654-.46-1.45-1.03-1.778z" fill="#fff"/><path d="m1375.38 587.154c-.57-.326-1.03-.065-1.04.589 0 .654.47 1.453 1.03 1.779.57.328 1.03.065 1.03-.59.01-.654-.45-1.45-1.02-1.778z" fill="#fff"/><g fill="#fff" opacity=".6"><path d="m1377.12 598.382c-.41-.24-.75-.048-.75.422 0 .478.33 1.057.75 1.297l27.42 15.831c.41.236.74.044.74-.434.01-.47-.33-1.05-.74-1.285z"/><path d="m1377.12 611.985c-.41-.236-.75-.044-.75.426 0 .478.33 1.057.74 1.293l23.28 13.441c.41.236.75.044.75-.434 0-.469-.33-1.049-.74-1.285z"/><path d="m1377.12 618.82c-.41-.236-.75-.044-.75.426 0 .478.33 1.057.74 1.293l23.28 13.442c.41.236.75.044.75-.434 0-.47-.33-1.05-.74-1.285z"/><path d="m1394.77 614.986c-.42-.24-.76-.04-.76.43 0 .469.34 1.049.75 1.289l14.02 8.094c.41.236.75.044.75-.425 0-.47-.33-1.058-.74-1.294z"/><path d="m1377.12 604.907c-.41-.24-.75-.039-.75.43 0 .47.33 1.049.75 1.29l14.02 8.094c.41.236.74.044.75-.426 0-.469-.34-1.057-.75-1.293z"/></g><path d="m1372.46 652.71c0 .469.34 1.041.74 1.281l43.58 25.158c.2.115.39.126.52.046l5.06-2.937c.13-.08.21-.241.21-.481l.19-63.794-.04-.023.02-.012.02-3.737c0-.469-.34-1.041-.75-1.281l-43.56-25.147c-.21-.126-.4-.137-.54-.057l-4.96 2.892c.04 0 .07-.012.12-.012-.06 0-.12.012-.16.034-.16.069-.26.24-.26.492l-.01 3.738.04.011-.04.023 45.06 26.016-45.06-26.005z" fill="url(#C)"/><g filter="url(#n)"><path d="m396.393 524.022-.08 23.624c0 .644-.423 1.288-1.265 1.777l-104.749 60.796c-.921.533-2.162.777-3.375.729l.013-23.746c1.236.06 2.505-.18 3.442-.725l104.749-60.8c.265-.153.486-.319.668-.501.075-.071.138-.142.198-.217.146-.186.253-.379.32-.577.012-.04.028-.079.036-.119 0-.007.004-.015.004-.023 0-.004 0-.008.004-.012.004-.012.008-.024.008-.036.003-.015.003-.031.007-.051.012-.04.016-.079.02-.119z" fill="#cdd8dd"/><path d="m396.393 523.9v.118.004c-.012.119-.035.241-.079.36.051-.158.079-.32.079-.482z" fill="#cdd8dd"/><path d="m396.393 523.9v.118.004c-.004.04-.008.079-.02.119-.004.02-.004.036-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .008-.004.016-.004.023-.008.04-.024.079-.036.119-.067.198-.174.391-.32.577-.06.075-.123.146-.198.217-.182.182-.403.348-.668.501l-104.749 60.8c-.937.545-2.206.785-3.442.725-1-.044-1.976-.289-2.735-.728l-105.37-60.913c-.056-.032-.107-.064-.154-.095-.079-.052-.154-.103-.225-.155-.04-.031-.079-.059-.115-.091-.063-.051-.126-.106-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.126-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.245-.079-.368v-.118c0 .005.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.495 1.28 1.147 1.279 1.803z" fill="#fff"/><path d="m396.393 523.9v.118.004c-.004.04-.008.079-.02.119-.004.02-.004.036-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .008-.004.016-.004.023-.008.04-.024.079-.036.119-.067.198-.174.391-.32.577-.06.075-.123.146-.198.217-.182.182-.403.348-.668.501l-104.749 60.8c-.937.545-2.206.785-3.442.725-1-.044-1.976-.289-2.735-.728l-105.37-60.913c-.056-.032-.107-.064-.154-.095-.079-.052-.154-.103-.225-.155-.04-.031-.079-.059-.115-.091-.063-.051-.126-.106-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.126-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.245-.079-.368v-.118c0 .005.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.495 1.28 1.147 1.279 1.803z" fill="url(#E)"/><path d="m286.937 587.202-.013 23.746c-1.02-.036-2.023-.286-2.802-.733l-105.37-60.909c-.858-.494-1.288-1.15-1.284-1.802l.08-23.62c.012.123.036.245.079.368.016.039.028.079.048.118.023.068.055.131.094.194.052.091.115.182.186.273.059.075.126.146.197.217l.004.004c.056.056.115.111.182.162.036.032.075.06.115.091.071.052.146.103.225.155.047.031.098.063.154.095l105.37 60.913c.759.439 1.735.684 2.735.728z" fill="#cdd8dd"/><g opacity=".9"><path d="m396.433 524.092-.079 23.623c0 .644-.423 1.288-1.265 1.778l-104.747 60.793c-.921.534-2.162.779-3.375.731-1.02-.035-2.023-.288-2.802-.735l-105.372-60.907c-.857-.494-1.288-1.15-1.284-1.802l.079-23.62c.012.123.035.245.079.368.016.039.028.079.047.118.024.068.056.131.095.194.052.091.115.182.186.273.059.075.126.146.198.217l.003.004c.056.055.115.111.182.162.036.032.075.059.115.091.071.051.146.103.225.154.047.032.099.063.154.095l105.372 60.911c.759.439 1.735.688 2.735.731 1.237.06 2.505-.181 3.442-.727l104.747-60.797c.265-.154.486-.32.668-.501.075-.072.138-.143.198-.218.146-.185.253-.379.32-.577.012-.039.024-.079.035-.118 0-.008.004-.02.004-.028 0 0 .004-.004.004-.008.004-.012.008-.024.008-.035.004-.016.008-.032.008-.052.012-.039.016-.079.02-.118z" fill="url(#G)"/><path d="m396.433 523.969v.123c-.004.039-.008.079-.02.118.012-.079.02-.162.02-.241z" fill="url(#H)"/></g><g fill="#fff" opacity=".6"><path d="m200.836 544.146c.343.198.622.682.621 1.073l-.036 12.875c-.002.391-.283.552-.626.353-.343-.198-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m205.146 546.575c.343.199.622.682.621 1.073l-.037 12.876c-.001.391-.282.551-.625.353s-.622-.682-.621-1.073l.036-12.875c.002-.391.282-.552.626-.354z"/><path d="m209.455 549.071c.343.199.623.682.621 1.073l-.036 12.875c-.001.392-.282.552-.625.354s-.623-.682-.621-1.073l.036-12.875c.001-.392.282-.552.625-.354z"/><path d="m213.765 551.57c.343.198.622.682.621 1.073l-.036 12.875c-.002.391-.283.552-.626.353-.343-.198-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m218.075 554.055c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354s-.622-.682-.621-1.073l.036-12.876c.002-.391.282-.551.626-.353z"/><path d="m226.694 559.026c.343.198.622.681.621 1.073l-.036 12.875c-.002.391-.282.551-.626.353-.343-.198-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m231.004 561.511c.343.198.622.682.621 1.073l-.037 12.875c-.001.391-.282.552-.625.353-.343-.198-.622-.681-.621-1.072l.036-12.876c.002-.391.282-.551.626-.353z"/><path d="m235.313 563.995c.343.198.623.681.621 1.073l-.036 12.875c-.001.391-.282.551-.625.353s-.623-.681-.621-1.073l.036-12.875c.001-.391.282-.551.625-.353z"/><path d="m239.623 566.511c.343.198.622.682.621 1.073l-.036 12.875c-.002.392-.282.552-.626.354-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m243.933 569.006c.343.198.622.682.621 1.073l-.037 12.875c-.001.391-.282.552-.625.353-.343-.198-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m262.888 580.032c.343.198.623.681.621 1.073l-.036 12.875c-.001.391-.282.551-.625.353s-.623-.681-.621-1.073l.036-12.875c.001-.391.282-.551.625-.353z"/><path d="m267.198 582.526c.343.199.622.682.621 1.073l-.036 12.876c-.001.391-.282.551-.626.353-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/></g><path d="m187.725 539.104c1.844 1.065 3.335 3.648 3.329 5.767-.006 2.122-1.507 2.975-3.351 1.91s-3.336-3.645-3.33-5.767c.007-2.119 1.508-2.975 3.352-1.91z" fill="#fff"/><path d="m396.393 489.699-.08 23.623c0 .644-.423 1.288-1.265 1.778l-104.749 60.795c-.921.533-2.162.778-3.375.73l.013-23.746c1.236.06 2.505-.181 3.442-.725l104.749-60.8c.265-.154.486-.32.668-.501.075-.072.138-.143.198-.218.146-.185.253-.379.32-.576.012-.04.028-.079.036-.119 0-.008.004-.016.004-.024 0-.004 0-.008.004-.012.004-.011.008-.023.008-.035.003-.016.003-.032.007-.051.012-.04.016-.079.02-.119z" fill="#cdd8dd"/><path d="m396.393 489.577v.118.004c-.012.119-.035.241-.079.36.051-.158.079-.32.079-.482z" fill="#cdd8dd"/><path d="m396.393 489.577v.118.004c-.004.04-.008.079-.02.119-.004.019-.004.035-.007.051-.004.012-.008.024-.008.035-.004.004-.004.008-.004.012 0 .008-.004.016-.004.024-.008.04-.024.079-.036.119-.067.197-.174.391-.32.576-.06.075-.123.146-.198.218-.182.181-.403.347-.668.501l-104.749 60.8c-.937.544-2.206.785-3.442.725-1-.044-1.976-.29-2.735-.729l-105.37-60.913c-.056-.031-.107-.063-.154-.095-.079-.051-.154-.103-.225-.154-.04-.032-.079-.059-.115-.091-.063-.051-.126-.107-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.127-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.246-.079-.368v-.119c0 .006.002.012.002.018-.006-.655.409-1.308 1.26-1.803l104.753-60.796c1.696-.987 4.474-.985 6.18.004l105.371 60.909c.857.494 1.28 1.147 1.279 1.803z" fill="#fff"/><path d="m396.393 489.577v.118.004c-.004.04-.008.079-.02.119-.004.019-.004.035-.007.051-.004.012-.008.024-.008.035-.004.004-.004.008-.004.012 0 .008-.004.016-.004.024-.008.04-.024.079-.036.119-.067.197-.174.391-.32.576-.06.075-.123.146-.198.218-.182.181-.403.347-.668.501l-104.749 60.8c-.937.544-2.206.785-3.442.725-1-.044-1.976-.29-2.735-.729l-105.37-60.913c-.056-.031-.107-.063-.154-.095-.079-.051-.154-.103-.225-.154-.04-.032-.079-.059-.115-.091-.063-.051-.126-.107-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.127-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.246-.079-.368v-.119c0 .006.002.012.002.018-.006-.655.409-1.308 1.26-1.803l104.753-60.796c1.696-.987 4.474-.985 6.18.004l105.371 60.909c.857.494 1.28 1.147 1.279 1.803z" fill="url(#I)"/><path d="m286.937 552.879-.013 23.746c-1.02-.037-2.023-.286-2.802-.733l-105.37-60.909c-.858-.495-1.288-1.151-1.284-1.803l.08-23.619c.012.122.036.245.079.367.016.04.028.08.048.119.023.067.055.131.094.194.052.091.115.182.186.273.059.075.126.146.197.217l.004.004c.056.055.115.111.182.162.036.032.075.059.115.091.071.051.146.103.225.154.047.032.098.064.154.095l105.37 60.913c.759.439 1.735.685 2.735.729z" fill="#cdd8dd"/><g opacity=".9"><path d="m396.433 489.768-.079 23.624c0 .644-.423 1.288-1.265 1.778l-104.747 60.793c-.921.533-2.162.778-3.375.731-1.02-.036-2.023-.289-2.802-.735l-105.372-60.908c-.857-.494-1.288-1.15-1.284-1.802l.079-23.619c.012.122.035.245.079.367.016.04.028.08.047.119.024.067.056.13.095.194.052.091.115.181.186.272.059.075.126.147.198.218l.003.004c.056.055.115.11.182.162.036.031.075.059.115.091.071.051.146.102.225.154.047.031.099.063.154.095l105.372 60.911c.759.439 1.735.688 2.735.731 1.237.059 2.505-.182 3.442-.727l104.747-60.797c.265-.154.486-.32.668-.502.075-.071.138-.142.198-.217.146-.186.253-.38.32-.577.012-.04.024-.079.035-.119 0-.008.004-.019.004-.027 0 0 .004-.004.004-.008.004-.012.008-.024.008-.036.004-.016.008-.031.008-.051.012-.04.016-.079.02-.119z" fill="url(#J)"/><path d="m396.433 489.646v.122c-.004.04-.008.079-.02.119.012-.079.02-.162.02-.241z" fill="url(#K)"/></g><g fill="#fff" opacity=".6"><path d="m200.836 509.822c.343.199.622.682.621 1.073l-.036 12.876c-.002.391-.283.551-.626.353s-.622-.682-.621-1.073l.037-12.875c.001-.391.282-.552.625-.354z"/><path d="m205.146 512.252c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354-.343-.199-.622-.682-.621-1.073l.036-12.875c.002-.392.282-.552.626-.354z"/><path d="m209.455 514.748c.343.198.623.682.621 1.073l-.036 12.875c-.001.391-.282.552-.625.353-.343-.198-.623-.681-.621-1.073l.036-12.875c.001-.391.282-.551.625-.353z"/><path d="m213.765 517.247c.343.198.622.681.621 1.073l-.036 12.875c-.002.391-.283.551-.626.353s-.622-.682-.621-1.073l.037-12.875c.001-.391.282-.552.625-.353z"/><path d="m218.075 519.732c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m226.694 524.702c.343.198.622.682.621 1.073l-.036 12.875c-.002.392-.282.552-.626.354-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m231.004 527.188c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m235.313 529.671c.343.198.623.682.621 1.073l-.036 12.875c-.001.392-.282.552-.625.354s-.623-.682-.621-1.073l.036-12.875c.001-.392.282-.552.625-.354z"/><path d="m239.623 532.188c.343.198.622.682.621 1.073l-.036 12.875c-.002.391-.282.551-.626.353-.343-.198-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m243.933 534.683c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.552.626-.353z"/><path d="m262.888 545.708c.343.198.623.682.621 1.073l-.036 12.875c-.001.392-.282.552-.625.354s-.623-.682-.621-1.073l.036-12.875c.001-.392.282-.552.625-.354z"/><path d="m267.198 548.203c.343.198.622.682.621 1.073l-.036 12.875c-.001.392-.282.552-.626.354-.343-.199-.622-.682-.621-1.073l.037-12.876c.001-.391.282-.551.625-.353z"/></g><path d="m187.725 504.781c1.844 1.064 3.335 3.647 3.329 5.767-.006 2.122-1.507 2.974-3.351 1.91-1.844-1.065-3.336-3.645-3.33-5.768.007-2.119 1.508-2.974 3.352-1.909z" fill="#fff"/><path d="m396.393 455.376-.08 23.623c0 .644-.423 1.288-1.265 1.777l-104.749 60.796c-.921.533-2.162.777-3.375.729l.013-23.746c1.236.06 2.505-.18 3.442-.725l104.749-60.799c.265-.154.486-.32.668-.502.075-.071.138-.142.198-.217.146-.186.253-.379.32-.577.012-.039.028-.079.036-.118 0-.008.004-.016.004-.024 0-.004 0-.008.004-.012.004-.012.008-.024.008-.035.003-.016.003-.032.007-.052.012-.039.016-.079.02-.118z" fill="#cdd8dd"/><path d="m396.393 455.253v.119.004c-.012.118-.035.241-.079.359.051-.158.079-.32.079-.482z" fill="#cdd8dd"/><path d="m396.393 455.253v.119.004c-.004.039-.008.079-.02.118-.004.02-.004.036-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .008-.004.016-.004.024-.008.039-.024.079-.036.118-.067.198-.174.391-.32.577-.06.075-.123.146-.198.217-.182.182-.403.348-.668.502l-104.749 60.799c-.937.545-2.206.785-3.442.725-1-.044-1.976-.289-2.735-.728l-105.37-60.913c-.056-.032-.107-.064-.154-.095-.079-.052-.154-.103-.225-.154-.04-.032-.079-.06-.115-.091-.063-.052-.126-.107-.182-.162l-.004-.004c-.071-.072-.138-.143-.197-.218-.071-.091-.134-.182-.186-.273-.035-.063-.067-.126-.094-.193-.02-.04-.032-.079-.048-.119-.043-.122-.067-.245-.079-.367v-.119c0 .006.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.495 1.28 1.147 1.279 1.803z" fill="#fff"/><path d="m396.393 455.253v.119.004c-.004.039-.008.079-.02.118-.004.02-.004.036-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .008-.004.016-.004.024-.008.039-.024.079-.036.118-.067.198-.174.391-.32.577-.06.075-.123.146-.198.217-.182.182-.403.348-.668.502l-104.749 60.799c-.937.545-2.206.785-3.442.725-1-.044-1.976-.289-2.735-.728l-105.37-60.913c-.056-.032-.107-.064-.154-.095-.079-.052-.154-.103-.225-.154-.04-.032-.079-.06-.115-.091-.063-.052-.126-.107-.182-.162l-.004-.004c-.071-.072-.138-.143-.197-.218-.071-.091-.134-.182-.186-.273-.035-.063-.067-.126-.094-.193-.02-.04-.032-.079-.048-.119-.043-.122-.067-.245-.079-.367v-.119c0 .006.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.495 1.28 1.147 1.279 1.803z" fill="url(#L)"/><path d="m286.937 518.555-.013 23.746c-1.02-.036-2.023-.285-2.802-.732l-105.37-60.91c-.858-.494-1.288-1.15-1.284-1.802l.08-23.619c.012.122.036.245.079.367.016.04.028.079.048.119.023.067.055.13.094.193.052.091.115.182.186.273.059.075.126.146.197.218l.004.004c.056.055.115.11.182.162.036.031.075.059.115.091.071.051.146.102.225.154.047.031.098.063.154.095l105.37 60.913c.759.439 1.735.684 2.735.728z" fill="#cdd8dd"/><g opacity=".9"><path d="m396.433 455.445-.079 23.623c0 .644-.423 1.288-1.265 1.778l-104.747 60.793c-.921.534-2.162.779-3.375.731-1.02-.035-2.023-.288-2.802-.735l-105.372-60.907c-.857-.494-1.288-1.15-1.284-1.802l.079-23.619c.012.122.035.245.079.367.016.04.028.079.047.119.024.067.056.13.095.193.052.091.115.182.186.273.059.075.126.146.198.217l.003.004c.056.056.115.111.182.162.036.032.075.06.115.091.071.051.146.103.225.154.047.032.099.063.154.095l105.372 60.912c.759.438 1.735.687 2.735.731 1.237.059 2.505-.182 3.442-.727l104.747-60.797c.265-.154.486-.32.668-.502.075-.071.138-.143.198-.218.146-.185.253-.379.32-.577.012-.039.024-.079.035-.118 0-.008.004-.02.004-.028 0 0 .004-.004.004-.008.004-.012.008-.023.008-.035.004-.016.008-.032.008-.052.012-.039.016-.079.02-.118z" fill="url(#M)"/><path d="m396.433 455.322v.123c-.004.039-.008.079-.02.118.012-.079.02-.162.02-.241z" fill="url(#N)"/></g><g fill="#fff" opacity=".8"><path d="m200.836 475.499c.343.198.622.682.621 1.073l-.036 12.875c-.002.392-.283.552-.626.354s-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m205.146 477.929c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m209.455 480.425c.343.198.623.681.621 1.073l-.036 12.875c-.001.391-.282.551-.625.353s-.623-.682-.621-1.073l.036-12.875c.001-.391.282-.552.625-.353z"/><path d="m213.765 482.923c.343.198.622.682.621 1.073l-.036 12.875c-.002.392-.283.552-.626.354-.343-.199-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m218.075 485.408c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354s-.622-.682-.621-1.073l.036-12.875c.002-.392.282-.552.626-.354z"/><path d="m231.004 492.864c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354s-.622-.682-.621-1.073l.036-12.875c.002-.392.282-.552.626-.354z"/><path d="m235.313 495.348c.343.198.623.682.621 1.073l-.036 12.875c-.001.391-.282.552-.625.353-.343-.198-.623-.681-.621-1.073l.036-12.875c.001-.391.282-.551.625-.353z"/><path d="m239.623 497.864c.343.199.622.682.621 1.073l-.036 12.876c-.002.391-.282.551-.626.353-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.391.282-.552.625-.354z"/><path d="m243.933 500.359c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354s-.622-.682-.621-1.073l.036-12.875c.002-.392.282-.552.626-.354z"/><path d="m267.198 513.88c.343.198.622.681.621 1.073l-.036 12.875c-.001.391-.282.551-.626.353-.343-.198-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/></g><path d="m187.725 470.457c1.844 1.065 3.335 3.648 3.329 5.767-.006 2.123-1.507 2.975-3.351 1.91s-3.336-3.645-3.33-5.767c.007-2.119 1.508-2.975 3.352-1.91z" fill="#fff"/><path d="m396.393 421.052-.08 23.623c0 .644-.423 1.288-1.265 1.778l-104.749 60.796c-.921.533-2.162.777-3.375.729l.013-23.746c1.236.06 2.505-.18 3.442-.725l104.749-60.8c.265-.154.486-.32.668-.501.075-.071.138-.142.198-.217.146-.186.253-.38.32-.577.012-.04.028-.079.036-.119 0-.008.004-.016.004-.023 0-.004 0-.008.004-.012.004-.012.008-.024.008-.036.003-.016.003-.032.007-.051.012-.04.016-.079.02-.119z" fill="#cdd8dd"/><path d="m396.393 420.93v.118.004c-.012.119-.035.241-.079.36.051-.158.079-.32.079-.482z" fill="#cdd8dd"/><path d="m396.393 420.93v.118.004c-.004.04-.008.079-.02.119-.004.019-.004.035-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .007-.004.015-.004.023-.008.04-.024.079-.036.119-.067.197-.174.391-.32.577-.06.075-.123.146-.198.217-.182.181-.403.347-.668.501l-104.749 60.8c-.937.545-2.206.785-3.442.725-1-.044-1.976-.29-2.735-.729l-105.37-60.913c-.056-.031-.107-.063-.154-.095-.079-.051-.154-.102-.225-.154-.04-.031-.079-.059-.115-.091-.063-.051-.126-.107-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.127-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.245-.079-.368v-.118c0 .005.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.494 1.28 1.147 1.279 1.803z" fill="#fff"/><path d="m396.393 420.93v.118.004c-.004.04-.008.079-.02.119-.004.019-.004.035-.007.051-.004.012-.008.024-.008.036-.004.004-.004.008-.004.012 0 .007-.004.015-.004.023-.008.04-.024.079-.036.119-.067.197-.174.391-.32.577-.06.075-.123.146-.198.217-.182.181-.403.347-.668.501l-104.749 60.8c-.937.545-2.206.785-3.442.725-1-.044-1.976-.29-2.735-.729l-105.37-60.913c-.056-.031-.107-.063-.154-.095-.079-.051-.154-.102-.225-.154-.04-.031-.079-.059-.115-.091-.063-.051-.126-.107-.182-.162l-.004-.004c-.071-.071-.138-.142-.197-.217-.071-.091-.134-.182-.186-.273-.035-.063-.067-.127-.094-.194-.02-.039-.032-.079-.048-.118-.043-.123-.067-.245-.079-.368v-.118c0 .005.002.011.002.017-.006-.654.409-1.308 1.26-1.803l104.753-60.795c1.696-.987 4.474-.986 6.18.003l105.371 60.909c.857.494 1.28 1.147 1.279 1.803z" fill="url(#O)"/><path d="m286.937 484.232-.013 23.746c-1.02-.036-2.023-.286-2.802-.733l-105.37-60.909c-.858-.494-1.288-1.151-1.284-1.803l.08-23.619c.012.123.036.245.079.368.016.039.028.079.048.118.023.067.055.131.094.194.052.091.115.182.186.273.059.075.126.146.197.217l.004.004c.056.055.115.111.182.162.036.032.075.06.115.091.071.052.146.103.225.154.047.032.098.064.154.095l105.37 60.913c.759.439 1.735.685 2.735.729z" fill="#cdd8dd"/><g opacity=".9"><path d="m396.433 421.121-.079 23.624c0 .644-.423 1.288-1.265 1.778l-104.747 60.793c-.921.533-2.162.778-3.375.731-1.02-.036-2.023-.289-2.802-.735l-105.372-60.908c-.857-.494-1.288-1.15-1.284-1.802l.079-23.619c.012.123.035.245.079.368.016.039.028.079.047.118.024.067.056.131.095.194.052.091.115.182.186.273.059.075.126.146.198.217l.003.004c.056.055.115.11.182.162.036.031.075.059.115.091.071.051.146.102.225.154.047.031.099.063.154.095l105.372 60.911c.759.439 1.735.688 2.735.731 1.237.059 2.505-.182 3.442-.727l104.747-60.797c.265-.154.486-.32.668-.502.075-.071.138-.142.198-.217.146-.186.253-.379.32-.577.012-.039.024-.079.035-.118 0-.008.004-.02.004-.028 0 0 .004-.004.004-.008.004-.012.008-.024.008-.036.004-.015.008-.031.008-.051.012-.039.016-.079.02-.119z" fill="url(#P)"/><path d="m396.433 420.999v.122c-.004.04-.008.08-.02.119.012-.079.02-.162.02-.241z" fill="url(#Q)"/></g><g fill="#651fff"><path d="m200.836 441.176c.343.198.622.681.621 1.073l-.036 12.875c-.002.391-.283.551-.626.353s-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m205.146 443.605c.343.198.622.682.621 1.073l-.037 12.875c-.001.392-.282.552-.625.354s-.622-.682-.621-1.073l.036-12.875c.002-.392.282-.552.626-.354z"/><path d="m213.765 448.6c.343.198.622.681.621 1.073l-.036 12.875c-.002.391-.283.551-.626.353s-.622-.681-.621-1.073l.037-12.875c.001-.391.282-.551.625-.353z"/><path d="m226.694 456.056c.343.198.622.681.621 1.073l-.036 12.875c-.002.391-.282.551-.626.353-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.391.282-.552.625-.353z"/><path d="m231.004 458.541c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m239.623 463.541c.343.198.622.682.621 1.073l-.036 12.875c-.002.392-.282.552-.626.354-.343-.199-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m243.933 466.036c.343.198.622.681.621 1.073l-.037 12.875c-.001.391-.282.551-.625.353s-.622-.681-.621-1.073l.036-12.875c.002-.391.282-.551.626-.353z"/><path d="m262.888 477.062c.343.198.623.681.621 1.073l-.036 12.875c-.001.391-.282.551-.625.353s-.623-.682-.621-1.073l.036-12.875c.001-.391.282-.552.625-.353z"/><path d="m267.198 479.556c.343.198.622.682.621 1.073l-.036 12.875c-.001.392-.282.552-.626.354-.343-.198-.622-.682-.621-1.073l.037-12.875c.001-.392.282-.552.625-.354z"/><path d="m187.725 436.134c1.844 1.065 3.335 3.648 3.329 5.767-.006 2.122-1.507 2.975-3.351 1.91s-3.336-3.645-3.33-5.767c.007-2.12 1.508-2.975 3.352-1.91z"/></g></g><path d="m1382.94 318.899-.02 8.435c0 .599-.4 1.198-1.19 1.656l-115.39 67.06c-1.59.928-4.19.928-5.78 0l-174.55-100.777c-.8-.459-1.2-1.058-1.21-1.645v-.035l.04-8.436c0 .6.41 1.21 1.2 1.669l174.55 100.777c1.6.916 4.18.916 5.77 0l115.39-67.06c.79-.446 1.18-1.045 1.19-1.644z" fill="#ccd7dc"/><path d="m1382.94 318.899-.02 8.435c0 .599-.4 1.198-1.19 1.656l-115.39 67.06c-1.59.928-4.19.928-5.78 0l-174.55-100.777c-.8-.459-1.2-1.058-1.21-1.645v-.035l.04-8.436c0 .6.41 1.21 1.2 1.669l174.55 100.777c1.6.916 4.18.916 5.77 0l115.39-67.06c.79-.446 1.18-1.045 1.19-1.644z" fill="#ccd7dc"/><path d="m1381.74 317.197c1.6.922 1.6 2.421.02 3.343l-115.4 67.062c-1.59.922-4.17.922-5.77 0l-174.56-100.779c-1.59-.922-1.6-2.421-.01-3.343l115.39-67.062c1.59-.922 4.18-.922 5.77 0z" fill="#f4f5f6"/><path d="m1390.46 178.123-.37 133.473c-.02.904-.33 1.55-.85 1.856l-5.87 3.407c.37-.341.6-.905.6-1.668l.37-133.461c0-1.845-1.29-4.077-2.89-4.994l-174.54-100.7767c-.81-.4699-1.54-.5169-2.07-.1998l6.43-3.7359c.48-.141 1.09-.047 1.75.329l174.55 100.7774c1.6.928 2.89 3.16 2.89 4.993z" fill="#587e8c"/><path d="m1390.46 178.123-.37 133.473c-.02.904-.33 1.55-.85 1.856l-5.87 3.407c.37-.341.6-.905.6-1.668l.37-133.461c0-1.845-1.29-4.077-2.89-4.994l-174.54-100.7767c-.81-.4699-1.54-.5169-2.07-.1998l6.43-3.7359c.48-.141 1.09-.047 1.75.329l174.55 100.7774c1.6.928 2.89 3.16 2.89 4.993z" fill="#ccd7dc"/><path d="m1381.46 176.733c1.6.923 2.89 3.154 2.89 4.99l-.38 133.467c-.01 1.836-1.31 2.578-2.91 1.656l-174.55-100.779c-1.6-.922-2.89-3.163-2.89-4.999l.38-133.4667c.01-1.8359 1.31-2.5692 2.91-1.6468z" fill="#e3e7e9"/><path d="m1373.51 178.237c1.47.852 2.67 2.913 2.66 4.608l-.35 123.263c0 1.696-1.21 2.381-2.68 1.529l-161.21-93.074c-1.48-.852-2.67-2.921-2.67-4.616l.35-123.2631c.01-1.6955 1.21-2.3727 2.69-1.5208z" fill="#fff"/><path d="m1238.68 137.045c34.17 19.819 68.34 39.638 102.51 59.458l-.2 72.076c0 1.045-.74 1.468-1.65.94l-99.23-57.285c-.92-.529-1.64-1.798-1.64-2.843" fill="#000"/><path d="m1341.2 192.708-.01 3.771v.024c-34.17-19.82-68.34-39.639-102.51-59.458l.01-3.783v-.012c.12-.858.81-1.152 1.64-.682l99.24 57.297c.91.529 1.65 1.798 1.63 2.843z" fill="#e3e7e9"/><path d="m1221.66 99.8139c.27.1603.5.5491.5.8681l-.02 6.326c0 .319-.23.448-.5.287l-5.51-3.178c-.28-.161-.5-.549-.5-.868l.02-6.3264c0-.3189.22-.4476.5-.2874z" fill="#587e8c" opacity=".8"/><path d="m1232.48 106.493c.28.16.5.549.5.868l-.02 6.326c0 .319-.22.448-.5.287l-5.51-3.178c-.28-.161-.5-.549-.5-.868l.02-6.326c0-.319.23-.448.5-.288z" fill="#587e8c" opacity=".8"/><path d="m1365.77 288.041c.28.16.51.548.5.867l-.01 6.327c0 .319-.23.447-.51.287l-5.5-3.179c-.28-.16-.51-.548-.5-.867l.01-6.327c0-.319.23-.447.51-.287z" fill="#587e8c" opacity=".8"/><path d="m1221.66 111.458c.27.16.5.548.5.867l-.02 6.327c0 .319-.23.447-.5.287l-5.51-3.179c-.28-.16-.5-.548-.5-.867l.02-6.327c0-.319.22-.447.5-.287z" fill="#587e8c" opacity=".8"/><path d="m1221.66 122.256c.27.16.5.548.5.867l-.02 6.327c0 .319-.23.447-.5.287l-5.51-3.179c-.28-.16-.5-.548-.5-.867l.02-6.327c0-.319.22-.447.5-.287z" fill="#587e8c" opacity=".8"/><path d="m1241.17 134.498c.66.381 1.19 1.301 1.18 2.05 0 .759-.53 1.063-1.19.682-.65-.377-1.19-1.296-1.18-2.054 0-.75.53-1.055 1.19-.678z" fill="#fff"/><path d="m1244.36 136.551c.66.381 1.19 1.301 1.19 2.051 0 .758-.54 1.062-1.2.681-.65-.376-1.18-1.296-1.18-2.054 0-.75.54-1.055 1.19-.678z" fill="#fff"/><path d="m1247.86 138.604c.66.381 1.19 1.301 1.19 2.051 0 .758-.54 1.063-1.2.681-.65-.376-1.18-1.296-1.18-2.054 0-.75.54-1.055 1.19-.678z" fill="#fff"/><path d="m1283.21 177.588c0 .223-.12.329-.3.282-.02-.012-.05-.024-.08-.047l-39.27-22.663c-.22-.129-.4-.434-.4-.681 0-.211.13-.305.31-.258l.09.047 39.27 22.662c.01 0 .01.012.02.012.2.129.36.423.36.646z" fill="#00bfa5"/><path d="m1300.94 182.814c.21.126.39.424.38.665 0 .25-.17.357-.39.232l-57.37-33.126c-.22-.125-.39-.432-.39-.682 0-.241.17-.34.39-.214z" fill="#00bfa5"/><path d="m1295.64 189.571c0 .212-.12.318-.3.271-.02-.012-.05-.036-.08-.047l-51.7-29.841c-.22-.129-.4-.435-.4-.682 0-.211.13-.305.31-.258l51.79 29.888s.01 0 .01.011c.21.13.37.412.37.658z" fill="#00bfa5"/><path d="m1295.64 198.907c0 .212-.12.317-.3.271-.02-.012-.05-.036-.08-.048l-51.7-29.84c-.22-.129-.4-.435-.4-.682 0-.211.13-.305.31-.258l51.79 29.888s.01 0 .01.011c.21.13.37.412.37.658z" fill="#00bfa5"/><path d="m1256.55 171.761c0 .211-.13.317-.31.27-.02-.012-.05-.035-.08-.047l-12.6-7.272c-.22-.129-.4-.435-.4-.682 0-.211.13-.305.31-.258l12.69 7.319s.01 0 .01.012c.21.129.38.411.38.658z" fill="#00bfa5"/><path d="m1271.52 180.659c0 .211-.13.317-.3.27-.03-.012-.05-.035-.09-.047l-12.59-7.272c-.22-.13-.4-.435-.4-.682 0-.211.13-.305.31-.258l12.68 7.319s.02 0 .02.012c.21.129.37.411.37.658z" fill="#00bfa5"/><path d="m1256.55 181.327c0 .211-.13.317-.31.27-.02-.012-.05-.035-.08-.047l-12.6-7.272c-.22-.13-.4-.435-.4-.682 0-.211.13-.305.31-.258l12.69 7.319s.01 0 .01.012c.21.129.38.411.38.658z" fill="#00bfa5"/><path d="m1265.83 186.904c0 .188-.1.294-.24.282l-6.29-3.63c-.22-.129-.4-.435-.4-.681 0-.188.11-.282.26-.27l6.29 3.63s.01 0 .01.012c.21.129.37.411.37.657z" fill="#00bfa5"/><path d="m1274.5 192.248c0 .188-.11.294-.25.282l-6.28-3.63c-.23-.13-.4-.435-.4-.682 0-.188.1-.282.26-.27l6.28 3.63s.01 0 .01.012c.21.129.38.411.38.658z" fill="#00bfa5"/><path d="m1299.41 187.191c0 .211-.13.317-.31.27-.02-.012-.04-.035-.08-.047l-12.59-7.272c-.23-.13-.4-.435-.4-.682 0-.211.13-.305.3-.258l12.69 7.319s.01 0 .01.012c.21.129.38.411.38.658z" fill="#00bfa5"/><path d="m1238.68 137.045c34.17 19.819 68.34 39.638 102.51 59.458l-.2 72.076c0 1.045-.74 1.468-1.65.94l-99.23-57.285c-.92-.529-1.64-1.798-1.64-2.843" fill="url(#R)"/><path d="m1232.96 327.456c.8.467.81 1.227.01 1.693l-25.43 14.773c-.8.467-2.11.467-2.92 0l-45.99-26.556c-.82-.471-.82-1.226-.01-1.692l25.42-14.774c.8-.466 2.1-.471 2.92 0z" fill="#607d8b"/><path d="m1195.83 236.213c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.34-3.69c.39-.223 1-.217 1.38.006z" fill="#ccd7dc"/><path d="m1206.66 242.911c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z" fill="#ccd7dc"/><path d="m1217.78 249.609c.39.222.4.575.02.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.222 1-.216 1.38.007z" fill="#ccd7dc"/><path d="m1229.02 256.306c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z" fill="#ccd7dc"/><path d="m1240.44 263.004c.38.223.39.576.01.798l-6.35 3.691c-.38.222-1 .222-1.39-.001l-6.39-3.689c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.37.006z" fill="#ccd7dc"/><path d="m1252.2 269.701c.39.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.38 0l-6.4-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.38.006z" fill="#ccd7dc"/><path d="m1264.18 276.399c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.38-.223.99-.217 1.38.006z" fill="#ccd7dc"/><path d="m1275.76 283.097c.38.223.4.575.01.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.222.99-.216 1.38.007z" fill="#ccd7dc"/><path d="m1287.38 289.794c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z" fill="#ccd7dc"/><path d="m1298.74 296.492c.39.223.4.576.02.799l-6.35 3.69c-.38.222-1 .222-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z" fill="#ccd7dc"/><path d="m1310.73 303.189c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.37.006z" fill="#ccd7dc"/><path d="m1322.3 309.887c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223.99-.217 1.38.006z" fill="#ccd7dc"/><path d="m1333.92 316.585c.39.223.4.575.02.798l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.222-.39-.582-.01-.804l6.35-3.691c.39-.222 1-.216 1.38.007z" fill="#ccd7dc"/><path d="m1352.31 327.379-6.35 3.689c-.39.223-1.01.223-1.38 0l-5.68-3.278-.72-.411-5.71-3.302c-.38-.223-.38-.575-.01-.799l6.36-3.689c.37-.223.99-.223 1.37 0l5.71 3.302.72.411 5.67 3.278c.39.223.4.575.02.799z" fill="#587e8c"/><g fill="#ccd7dc"><path d="m1172.39 248.719c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.37.006z"/><path d="m1183.21 255.417c.39.223.4.576.02.799l-6.35 3.69c-.38.222-1 .222-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1194.33 262.114c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.216 1.38.006z"/><path d="m1205.57 268.812c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1216.99 275.51c.38.223.39.575.01.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.222-.39-.582 0-.804l6.35-3.69c.38-.223.99-.217 1.37.006z"/><path d="m1228.75 282.207c.39.223.4.576.01.799l-6.34 3.69c-.39.223-1.01.223-1.39 0l-6.4-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1240.73 288.905c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1252.31 295.603c.38.222.4.575.01.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.38.007z"/><path d="m1263.93 302.3c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1275.3 308.998c.38.223.39.576.01.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.222-.39-.581 0-.804l6.35-3.69c.38-.223.99-.217 1.37.006z"/><path d="m1287.28 315.695c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1298.85 322.393c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1310.47 329.091c.39.222.4.575.02.798l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.216 1.38.007z"/><path d="m1328.86 339.884-6.35 3.689c-.39.224-1.01.224-1.38 0l-5.68-3.277-.72-.412-5.71-3.301c-.38-.223-.38-.576-.01-.799l6.36-3.689c.38-.223.99-.223 1.37 0l5.71 3.302.72.411 5.67 3.277c.39.224.4.576.02.799z"/><path d="m1184.02 242.204c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1196.04 249.332c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1208.06 256.03c.39.222.4.575.02.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.216 1.38.007z"/><path d="m1220.09 263.18c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.37.006z"/><path d="m1232.11 270.138c.38.223.4.576.01.798l-6.35 3.691c-.38.222-1 .222-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1244.13 276.628c.39.222.4.575.02.798l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.38-.223.99-.216 1.38.007z"/><path d="m1256.15 283.689c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.222-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1268.18 290.511c.38.223.39.576.01.798l-6.35 3.691c-.38.222-1 .222-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.37.006z"/><path d="m1280.2 297.604c.38.223.4.576.01.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.222-.39-.582 0-.804l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1292.22 304.731c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.4-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1304.24 311.772c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1316.26 319.083c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1328.29 326.302c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.38.006z"/><path d="m1340.31 333.094c.39.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.38 0l-6.4-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1159.97 254.71c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1172 261.838c.38.223.39.576.01.798l-6.35 3.691c-.38.222-1 .222-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1184.02 268.535c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.38.006z"/><path d="m1196.04 275.686c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1208.06 282.644c.39.223.4.575.02.798l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.804l6.35-3.691c.39-.222 1-.216 1.38.007z"/><path d="m1220.09 289.133c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.216 1.37.006z"/><path d="m1232.11 296.195c.38.223.4.576.01.798l-6.35 3.691c-.38.222-1 .222-1.39-.001l-6.39-3.69c-.38-.222-.39-.581 0-.804l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1244.13 303.017c.39.223.4.575.02.798l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.804l6.35-3.691c.38-.222.99-.216 1.38.007z"/><path d="m1256.15 310.11c.39.223.4.575.02.798l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.804l6.35-3.691c.39-.222 1-.216 1.38.007z"/><path d="m1268.18 317.237c.38.223.39.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.37.006z"/><path d="m1280.2 324.278c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1292.22 331.589c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.4-3.69c-.38-.223-.38-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z"/><path d="m1304.24 338.808c.39.223.4.576.02.799l-6.35 3.69c-.39.223-1.01.223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/><path d="m1316.26 345.6c.39.223.4.576.02.798l-6.35 3.691c-.38.222-1 .222-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z"/></g><path d="m1211.83 226.344c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z" fill="#5e2ad7"/><path d="m1370.06 316.904c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z" fill="#5e2ad7"/><path d="m1211.83 226.344c.38.223.4.576.01.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.38-.223-.39-.582 0-.805l6.35-3.69c.38-.223.99-.217 1.38.006z" fill="url(#T)"/><path d="m1370.06 316.904c.39.223.4.576.02.799l-6.35 3.69c-.38.223-1 .223-1.39 0l-6.39-3.69c-.39-.223-.39-.582-.01-.805l6.35-3.69c.39-.223 1-.217 1.38.006z" fill="url(#U)"/><path d="m1390.48 178.134-.38 133.467c-.01.904-.33 1.551-.84 1.859l-5.88 3.411c-.44.421-1.12.503-1.89.185l.26.143c.81.473 1.2 1.089 1.2 1.706v.051c0 .031-.01.072-.01.103.01-.021.01-.041.01-.062l-.02 8.342c0 .606-.4 1.202-1.18 1.654l-115.4 67.062c-1.58.935-4.18.935-5.78 0l-174.54-100.778c-.8-.452-1.2-1.058-1.21-1.644v-.031l.03-8.434c-.01-.606.38-1.222 1.18-1.685l115.4-67.062c1.44-.832 3.7-.904 5.31-.226l-.22-.123c-1.59-.925-2.89-3.164-2.89-4.993l.38-133.4667c.01-.976.37-1.6437.96-1.9108.09-.0411.19-.072.31-.1028-.09.0103-.18.0411-.26.072l6.26-3.6367c.48-.1438 1.1-.0514 1.75.3287l174.55 100.7783c1.61.925 2.9 3.154 2.9 4.993z" fill="url(#V)" opacity=".7"/><g opacity=".4"><path d="m1382.93 319.051c.01-.02.01-.041.01-.061v-.041c0 .03-.01.072-.01.102z" fill="url(#X)"/><path d="m1390.47 178.126-.38 133.467c-.01.904-.33 1.551-.84 1.86l-5.88 3.41c-.44.421-1.12.504-1.89.185l.26.144c.81.472 1.2 1.089 1.2 1.705v.052c0 .03-.01.072-.01.102.01-.02.01-.041.01-.061l-.02 8.341c0 .607-.4 1.202-1.18 1.654l-115.4 67.063c-1.58.934-4.18.934-5.78 0l-174.54-100.779c-.8-.452-1.21-1.058-1.22-1.643v-.031l.04-8.434c-.01-.606.38-1.223 1.18-1.685l115.39-67.062c1.45-.832 3.71-.904 5.31-.226l-.21-.124c-1.59-.924-2.89-3.164-2.89-4.992l.38-133.4673c.01-.9759.37-1.6437.96-1.9108.09-.0411.19-.0719.31-.1027-.1.0103-.18.0411-.26.0719l6.26-3.6367c.48-.1438 1.09-.0513 1.75.3288l174.55 100.7778c1.6.925 2.9 3.154 2.9 4.993z" fill="url(#Y)"/><path d="m1384.12 180.304c-.1-.37-.26-.729-.43-1.079.18.35.33.709.43 1.079z" fill="url(#Z)"/></g><g filter="url(#o)"><path d="m826.722 245.641v32.145c-2.251.007-4.51-.46-6.234-1.406l-96.364-52.804c-1.721-.946-2.585-2.188-2.581-3.427l.096-32.133c0 .923.486 1.85 1.454 2.655.159.133.334.263.523.389s.389.249.604.367l96.364 52.805c1.699.934 3.916 1.402 6.138 1.409z" fill="#cdd8dd"/><path d="m931.222 188.242c-.004.067-.011.133-.022.2-.052.334-.167.668-.341.99-.037.063-.074.13-.115.193-.037.056-.074.115-.115.171-.034.048-.067.092-.1.137-.011.015-.019.026-.03.037-.037.048-.078.096-.119.141-.044.055-.096.107-.144.159-.134.141-.278.275-.434.405 0 .003-.004.003-.004.003-.063.052-.13.104-.196.156-.049.037-.101.074-.152.115-.015.011-.034.026-.052.037-.037.026-.075.052-.115.078-.093.063-.186.126-.286.185-.1.06-.2.119-.308.178l-95.733 52.805c-1.717.949-3.979 1.417-6.234 1.409-2.222-.007-4.439-.475-6.138-1.409l-96.364-52.805c-.215-.118-.415-.241-.604-.367s-.364-.256-.523-.389c-.968-.805-1.454-1.732-1.454-2.655 0-1.228.849-2.452 2.544-3.39l95.734-52.805c3.408-1.88 8.945-1.88 12.371 0l96.364 52.805c1.81.994 2.67 2.314 2.57 3.616z" fill="#fff"/><path d="m931.222 188.264c-.004.067-.011.134-.022.201-.052.333-.167.667-.341.99-.037.063-.074.13-.115.193-.037.055-.074.115-.115.17-.034.049-.067.093-.1.138-.011.014-.019.025-.03.037-.037.048-.078.096-.119.14-.044.056-.096.108-.144.16-.134.141-.278.274-.434.404 0 .004-.004.004-.004.004-.063.052-.13.104-.196.156-.049.037-.101.074-.152.115-.015.011-.034.026-.052.037-.037.026-.075.052-.115.078-.093.063-.186.126-.286.185s-.2.119-.308.178l-95.733 52.805c-1.717.949-3.979 1.416-6.234 1.409-2.222-.008-4.439-.475-6.138-1.409l-96.364-52.805c-.215-.119-.415-.241-.604-.367s-.364-.256-.523-.39c-.968-.804-1.454-1.731-1.454-2.655 0-1.227.849-2.451 2.544-3.389l95.734-52.805c3.408-1.88 8.945-1.88 12.371 0l96.364 52.805c1.81.994 2.67 2.314 2.57 3.615z" fill="url(#aa)" opacity=".6"/><path d="m914.508 188.231c-.004.055-.007.111-.018.167-.041.281-.141.563-.286.834-.03.052-.063.107-.096.163-.034.045-.063.096-.097.141-.029.041-.055.078-.085.115-.007.015-.015.022-.026.033-.03.041-.063.082-.1.119-.037.045-.078.089-.119.134-.115.118-.233.229-.367.341h-.004c-.011.007-.018.015-.029.026-.267-.219-.579-.431-.931-.623l-81.041-44.409c-2.881-1.58-7.535-1.58-10.402 0l-80.507 44.409c-.341.189-.641.389-.901.604-.004-.004-.011-.007-.015-.011-.816-.679-1.224-1.457-1.224-2.232 0-1.035.712-2.062 2.14-2.852l80.507-44.405c2.867-1.584 7.521-1.584 10.402 0l81.041 44.405c1.52.834 2.243 1.947 2.158 3.041z" fill="#651fff"/><path d="m913.281 190.304c-.041.033-.089.07-.134.107-.041.03-.085.063-.13.097-.011.007-.026.022-.04.029-.034.023-.063.045-.097.067-.081.052-.159.104-.241.156-.085.048-.17.1-.259.148l-80.507 44.409c-1.447.797-3.349 1.19-5.244 1.183-1.869-.008-3.731-.401-5.162-1.183l-81.037-44.409c-.182-.1-.349-.2-.508-.308-.152-.103-.293-.207-.423-.315.26-.215.56-.415.901-.604l80.507-44.409c2.867-1.58 7.521-1.58 10.402 0l81.041 44.409c.352.193.664.404.931.623z" fill="#cdd8dd"/><path d="m913.279 190.314c-.041.033-.089.07-.134.107-.041.03-.085.063-.13.097-.011.007-.026.022-.041.029-.033.023-.063.045-.096.067-.082.052-.159.104-.241.156-.085.048-.171.1-.26.148l-80.506 44.409c-1.447.797-3.349 1.19-5.244 1.183-1.869-.007-3.731-.401-5.162-1.183l-81.037-44.409c-.182-.1-.349-.2-.508-.307-.152-.104-.293-.208-.423-.316.259-.215.56-.415.901-.604l80.507-44.409c2.866-1.58 7.52-1.58 10.402 0l81.041 44.409c.352.193.664.404.931.623z" fill="url(#ac)"/><path d="m931.233 188.049-.096 32.145c-.004 1.224-.853 2.447-2.544 3.378l-95.734 52.805c-1.694.934-3.912 1.402-6.137 1.409v-32.145c2.255.008 4.517-.46 6.234-1.409l95.733-52.805c.108-.059.208-.118.308-.178.1-.059.193-.122.286-.185.04-.026.078-.052.115-.078.018-.011.037-.026.052-.037.051-.037.103-.074.152-.115.066-.052.133-.104.196-.156 0 0 .004 0 .004-.003.156-.13.3-.264.434-.405.048-.052.1-.104.144-.159.045-.048.082-.093.119-.141.011-.011.019-.022.03-.037.037-.045.07-.093.1-.137.041-.056.078-.115.115-.171.041-.063.078-.13.115-.193.181-.322.296-.656.341-.99.015-.067.022-.133.022-.2.008-.063.011-.13.011-.193z" fill="#cdd8dd"/><path d="m931.233 188.082-.096 32.145c-.004 1.224-.853 2.448-2.544 3.379l-95.734 52.804c-1.694.935-3.912 1.402-6.137 1.409-2.251.008-4.51-.46-6.234-1.405l-96.364-52.805c-1.721-.945-2.585-2.188-2.581-3.426l.096-32.134c0 .923.486 1.85 1.454 2.655.159.134.334.263.523.39.189.126.389.248.604.367l96.364 52.804c1.699.935 3.916 1.402 6.138 1.409 2.255.008 4.517-.459 6.234-1.409l95.733-52.804c.108-.06.208-.119.308-.178.1-.06.193-.123.286-.186.04-.026.078-.052.115-.078.018-.011.037-.026.052-.037.051-.037.103-.074.152-.115.066-.052.133-.104.196-.155 0 0 .004 0 .004-.004.156-.13.3-.263.434-.404.048-.052.1-.104.144-.16.045-.048.082-.093.119-.141.011-.011.019-.022.03-.037.037-.044.07-.093.1-.137.041-.056.078-.115.115-.171.041-.063.078-.129.115-.192.181-.323.296-.657.341-.991.015-.066.022-.133.022-.2.008-.063.011-.13.011-.193z" fill="url(#ad)" opacity=".8"/><path d="m931.233 188.092-.096 32.144c-.004 1.224-.853 2.448-2.544 3.379l-95.734 52.804c-1.695.935-3.912 1.402-6.137 1.41-2.252.007-4.51-.46-6.234-1.406l-96.364-52.805c-1.721-.945-2.585-2.188-2.582-3.426l.097-32.134c0 .924.486 1.851 1.454 2.655.159.134.333.264.522.39.19.126.39.248.605.367l96.364 52.805c1.698.934 3.916 1.401 6.138 1.409 2.254.007 4.516-.46 6.233-1.409l95.734-52.805c.108-.059.208-.119.308-.178s.193-.122.285-.185c.041-.026.078-.052.115-.078.019-.012.037-.026.052-.037.052-.038.104-.075.152-.115.067-.052.134-.104.197-.156 0 0 .004 0 .004-.004.155-.13.3-.263.433-.404.049-.052.101-.104.145-.16.045-.048.082-.092.119-.141.011-.011.018-.022.029-.037.037-.044.071-.092.101-.137.04-.055.077-.115.114-.17.041-.063.078-.13.115-.193.182-.323.297-.657.342-.99.014-.067.022-.134.022-.201.007-.063.011-.129.011-.192z" fill="url(#ae)"/><g fill="#fff"><path d="m919.68 207.193c2.698-1.515 4.914-.285 4.923 2.732.009 3.019-2.193 6.728-4.891 8.243l-81.434 45.734c-2.701 1.516-4.917.288-4.926-2.731-.009-3.016 2.193-6.728 4.894-8.245z" opacity=".3"/><path d="m850.299 248.685c1.664-.91 3.018-.18 3.024 1.631.005 1.811-1.34 4.017-3.004 4.926-1.665.91-3.021.181-3.027-1.63-.005-1.81 1.342-4.017 3.007-4.927z" opacity=".5"/><path d="m881.553 231.186c1.664-.91 3.018-.179 3.023 1.631.006 1.811-1.339 4.017-3.004 4.926-1.664.91-3.021.181-3.026-1.63-.006-1.81 1.342-4.017 3.007-4.927z" opacity=".9"/><path d="m911.951 213.825c1.664-.909 3.018-.179 3.024 1.632.005 1.81-1.34 4.016-3.004 4.926-1.665.91-3.021.181-3.027-1.63-.005-1.811 1.342-4.018 3.007-4.928z" opacity=".5"/></g><path d="m826.722 197.445v32.145c-2.251.007-4.51-.46-6.234-1.406l-96.364-52.804c-1.721-.946-2.585-2.188-2.581-3.427l.096-32.134c0 .924.486 1.851 1.454 2.655.159.134.334.264.523.39s.389.248.604.367l96.364 52.805c1.699.934 3.916 1.401 6.138 1.409z" fill="#cdd8dd"/><path d="m931.222 140.045c-.004.067-.011.134-.022.201-.052.333-.167.667-.341.99-.037.063-.074.13-.115.193-.037.055-.074.115-.115.17-.034.048-.067.093-.1.137-.011.015-.019.026-.03.038-.037.048-.078.096-.119.14-.044.056-.096.108-.144.16-.134.141-.278.274-.434.404 0 .004-.004.004-.004.004-.063.052-.13.104-.196.156-.049.037-.101.074-.152.115-.015.011-.034.026-.052.037-.037.026-.075.052-.115.078-.093.063-.186.126-.286.185s-.2.119-.308.178l-95.733 52.805c-1.717.949-3.979 1.416-6.234 1.409-2.222-.008-4.439-.475-6.138-1.409l-96.364-52.805c-.215-.119-.415-.241-.604-.367s-.364-.256-.523-.39c-.968-.804-1.454-1.731-1.454-2.655 0-1.227.849-2.451 2.544-3.389l95.734-52.8049c3.408-1.8802 8.945-1.8802 12.371 0l96.364 52.8049c1.81.994 2.67 2.314 2.57 3.615z" fill="#fff"/><path d="m931.222 140.068c-.004.067-.011.134-.022.2-.052.334-.167.668-.341.991-.037.063-.074.129-.115.192-.037.056-.074.115-.115.171-.034.048-.067.093-.1.137-.011.015-.019.026-.03.037-.037.048-.078.097-.119.141-.044.056-.096.108-.144.16-.134.141-.278.274-.434.404 0 .004-.004.004-.004.004-.063.051-.13.103-.196.155-.049.037-.101.074-.152.115-.015.011-.034.026-.052.037-.037.026-.075.052-.115.078-.093.063-.186.126-.286.186-.1.059-.2.118-.308.178l-95.733 52.804c-1.717.95-3.979 1.417-6.234 1.409-2.222-.007-4.439-.474-6.138-1.409l-96.364-52.804c-.215-.119-.415-.241-.604-.367-.189-.127-.364-.256-.523-.39-.968-.805-1.454-1.732-1.454-2.655 0-1.228.849-2.451 2.544-3.39l95.734-52.8043c3.408-1.8801 8.945-1.8801 12.371 0l96.364 52.8043c1.81.994 2.67 2.314 2.57 3.616z" fill="url(#af)" opacity=".6"/><path d="m914.508 140.034c-.004.056-.007.112-.018.167-.041.282-.141.564-.286.835-.03.052-.063.107-.096.163-.034.044-.063.096-.097.141-.029.04-.055.078-.085.115-.007.014-.015.022-.026.033-.03.041-.063.082-.1.119-.037.044-.078.089-.119.133-.115.119-.233.23-.367.341h-.004c-.011.008-.018.015-.029.026-.267-.218-.579-.43-.931-.623l-81.041-44.4084c-2.881-1.5798-7.535-1.5798-10.402 0l-80.507 44.4084c-.341.189-.641.39-.901.605-.004-.004-.011-.008-.015-.011-.816-.679-1.224-1.458-1.224-2.233 0-1.034.712-2.062 2.14-2.852l80.507-44.4046c2.867-1.5835 7.521-1.5835 10.402 0l81.041 44.4046c1.52.835 2.243 1.947 2.158 3.041z" fill="#651fff"/><path d="m913.281 142.107c-.041.034-.089.071-.134.108-.041.03-.085.063-.13.096-.011.008-.026.023-.04.03-.034.022-.063.044-.097.067-.081.052-.159.104-.241.155-.085.049-.17.101-.259.149l-80.507 44.408c-1.447.798-3.349 1.191-5.244 1.183-1.869-.007-3.731-.4-5.162-1.183l-81.037-44.408c-.182-.1-.349-.2-.508-.308-.152-.104-.293-.208-.423-.315.26-.215.56-.416.901-.605l80.507-44.4084c2.867-1.5798 7.521-1.5798 10.402 0l81.041 44.4084c.352.193.664.405.931.623z" fill="#cdd8dd"/><path d="m913.279 142.117c-.041.034-.089.071-.134.108-.041.03-.085.063-.13.096-.011.008-.026.023-.041.03-.033.022-.063.045-.096.067-.082.052-.159.104-.241.156-.085.048-.171.1-.26.148l-80.506 44.409c-1.447.797-3.349 1.19-5.244 1.183-1.869-.008-3.731-.401-5.162-1.183l-81.037-44.409c-.182-.1-.349-.2-.508-.308-.152-.104-.293-.208-.423-.315.259-.215.56-.415.901-.605l80.507-44.4082c2.866-1.5798 7.52-1.5798 10.402 0l81.041 44.4082c.352.193.664.405.931.623z" fill="url(#ag)"/><path d="m931.233 139.853-.096 32.144c-.004 1.224-.853 2.448-2.544 3.379l-95.734 52.804c-1.694.935-3.912 1.402-6.137 1.41v-32.145c2.255.007 4.517-.46 6.234-1.409l95.733-52.805c.108-.059.208-.119.308-.178s.193-.122.286-.185c.04-.026.078-.052.115-.078.018-.011.037-.026.052-.037.051-.037.103-.075.152-.115.066-.052.133-.104.196-.156 0 0 .004 0 .004-.004.156-.13.3-.263.434-.404.048-.052.1-.104.144-.16.045-.048.082-.092.119-.14.011-.012.019-.023.03-.038.037-.044.07-.092.1-.137.041-.055.078-.115.115-.17.041-.063.078-.13.115-.193.181-.323.296-.657.341-.99.015-.067.022-.134.022-.201.008-.063.011-.129.011-.192z" fill="#cdd8dd"/><path d="m931.233 139.886-.096 32.145c-.004 1.224-.853 2.447-2.544 3.378l-95.734 52.805c-1.694.934-3.912 1.402-6.137 1.409-2.251.007-4.51-.46-6.234-1.405l-96.364-52.805c-1.721-.946-2.585-2.188-2.581-3.427l.096-32.133c0 .923.486 1.85 1.454 2.655.159.133.334.263.523.389s.389.249.604.367l96.364 52.805c1.699.935 3.916 1.402 6.138 1.409 2.255.008 4.517-.46 6.234-1.409l95.733-52.805c.108-.059.208-.118.308-.178.1-.059.193-.122.286-.185.04-.026.078-.052.115-.078.018-.011.037-.026.052-.037.051-.037.103-.074.152-.115.066-.052.133-.104.196-.156 0 0 .004 0 .004-.003.156-.13.3-.264.434-.405.048-.052.1-.104.144-.159.045-.048.082-.093.119-.141.011-.011.019-.022.03-.037.037-.045.07-.093.1-.137.041-.056.078-.115.115-.171.041-.063.078-.13.115-.193.181-.322.296-.656.341-.99.015-.067.022-.133.022-.2.008-.063.011-.13.011-.193z" fill="url(#ah)" opacity=".8"/><path d="m931.233 139.895-.096 32.145c-.004 1.224-.853 2.448-2.544 3.378l-95.734 52.805c-1.695.935-3.912 1.402-6.137 1.409-2.252.008-4.51-.46-6.234-1.405l-96.364-52.805c-1.721-.946-2.585-2.188-2.582-3.426l.097-32.134c0 .923.486 1.85 1.454 2.655.159.134.333.263.522.389.19.127.39.249.605.368l96.364 52.804c1.698.935 3.916 1.402 6.138 1.409 2.254.008 4.516-.459 6.233-1.409l95.734-52.804c.108-.06.208-.119.308-.178.1-.06.193-.123.285-.186.041-.026.078-.052.115-.078.019-.011.037-.026.052-.037.052-.037.104-.074.152-.115.067-.052.134-.104.197-.156 0 0 .004 0 .004-.003.155-.13.3-.264.433-.404.049-.052.101-.104.145-.16.045-.048.082-.093.119-.141.011-.011.018-.022.029-.037.037-.044.071-.093.101-.137.04-.056.077-.115.114-.171.041-.063.078-.13.115-.193.182-.322.297-.656.342-.99.014-.066.022-.133.022-.2.007-.063.011-.13.011-.193z" fill="url(#ai)"/><path d="m919.68 158.997c2.698-1.516 4.914-.285 4.923 2.731.009 3.019-2.193 6.729-4.891 8.244l-81.434 45.733c-2.701 1.517-4.917.289-4.926-2.73-.009-3.017 2.193-6.728 4.894-8.245z" fill="#fff" opacity=".4"/><path d="m850.299 200.488c1.664-.909 3.018-.179 3.024 1.632.005 1.81-1.34 4.016-3.004 4.926-1.665.91-3.021.181-3.027-1.63-.005-1.811 1.342-4.018 3.007-4.928z" fill="#fff" opacity=".5"/><path d="m881.553 182.99c1.664-.91 3.018-.18 3.023 1.631.006 1.811-1.339 4.016-3.004 4.926-1.664.91-3.021.181-3.026-1.63-.006-1.811 1.342-4.018 3.007-4.927z" fill="#fff" opacity=".9"/><path d="m911.951 165.629c1.664-.91 3.018-.179 3.024 1.631.005 1.811-1.34 4.017-3.004 4.927-1.665.909-3.021.18-3.027-1.63-.005-1.811 1.342-4.018 3.007-4.928z" fill="#fff" opacity=".5"/><path d="m826.722 149.248v32.145c-2.251.008-4.51-.46-6.234-1.405l-96.364-52.805c-1.721-.945-2.585-2.188-2.581-3.426l.096-32.1341c0 .9234.486 1.8505 1.454 2.6552.159.1335.334.2633.523.3894s.389.2485.604.3672l96.364 52.8043c1.699.935 3.916 1.402 6.138 1.409z" fill="#cdd8dd"/><path d="m931.222 91.8491c-.004.0668-.011.1335-.022.2003-.052.3337-.167.6675-.341.9901-.037.0631-.074.1298-.115.1929-.037.0556-.074.1149-.115.1705-.034.0483-.067.0928-.1.1373-.011.0148-.019.0259-.03.037-.037.0482-.078.0965-.119.141-.044.0556-.096.1075-.144.1594-.134.1409-.278.2745-.434.4043 0 .0037-.004.0037-.004.0037-.063.0519-.13.1038-.196.1557-.049.0371-.101.0742-.152.115-.015.0111-.034.0259-.052.0371-.037.0259-.075.0519-.115.0778-.093.0631-.186.1261-.286.1855-.1.0593-.2.1186-.308.178l-95.733 52.8043c-1.717.95-3.979 1.417-6.234 1.409-2.222-.007-4.439-.474-6.138-1.409l-96.364-52.8043c-.215-.1187-.415-.2411-.604-.3672s-.364-.2559-.523-.3894c-.968-.8047-1.454-1.7318-1.454-2.6552 0-1.2275.849-2.4513 2.544-3.3895l95.734-52.8046c3.408-1.8802 8.945-1.8802 12.371 0l96.364 52.8046c1.81.9938 2.67 2.314 2.57 3.6157z" fill="#fff"/><path d="m931.222 91.8718c-.004.0667-.011.1334-.022.2002-.052.3338-.167.6675-.341.9902-.037.063-.074.1298-.115.1928-.037.0556-.074.115-.115.1706-.034.0482-.067.0927-.1.1372-.011.0148-.019.026-.03.0371-.037.0482-.078.0964-.119.1409-.044.0556-.096.1076-.144.1595-.134.1409-.278.2744-.434.4042 0 .0037-.004.0037-.004.0037-.063.0519-.13.1038-.196.1558-.049.0371-.101.0741-.152.1149-.015.0112-.034.026-.052.0371-.037.0259-.075.0519-.115.0779-.093.063-.186.1261-.286.1854s-.2.1187-.308.178l-95.733 52.8047c-1.717.949-3.979 1.417-6.234 1.409-2.222-.007-4.439-.475-6.138-1.409l-96.364-52.8047c-.215-.1187-.415-.241-.604-.3671s-.364-.2559-.523-.3894c-.968-.8047-1.454-1.7319-1.454-2.6553 0-1.2275.849-2.4512 2.544-3.3895l95.734-52.8046c3.408-1.8802 8.945-1.8802 12.371 0l96.364 52.8046c1.81.9939 2.67 2.3141 2.57 3.6158z" fill="url(#aj)" opacity=".6"/><path d="m914.508 91.838c-.004.0556-.007.1113-.018.1669-.041.2818-.141.5637-.286.8344-.03.0519-.063.1075-.096.1631-.034.0445-.063.0965-.097.141-.029.0408-.055.0779-.085.1149-.007.0149-.015.0223-.026.0334-.03.0408-.063.0816-.1.1187-.037.0445-.078.089-.119.1335-.115.1187-.233.2299-.367.3412h-.004c-.011.0074-.018.0148-.029.0259-.267-.2188-.579-.4302-.931-.623l-81.041-44.4087c-2.881-1.5798-7.535-1.5798-10.402 0l-80.507 44.4087c-.341.1891-.641.3894-.901.6045-.004-.0037-.011-.0074-.015-.0112-.816-.6786-1.224-1.4574-1.224-2.2324 0-1.0347.712-2.0619 2.14-2.8518l80.507-44.405c2.867-1.5835 7.521-1.5835 10.402 0l81.041 44.405c1.52.8344 2.243 1.9469 2.158 3.0409z" fill="#651fff"/><path d="m913.281 93.911c-.041.0334-.089.0705-.134.1075-.041.0297-.085.0631-.13.0965-.011.0074-.026.0222-.04.0296-.034.0223-.063.0445-.097.0668-.081.0519-.159.1038-.241.1557-.085.0482-.17.1002-.259.1484l-80.507 44.4085c-1.447.797-3.349 1.191-5.244 1.183-1.869-.007-3.731-.4-5.162-1.183l-81.037-44.4085c-.182-.1002-.349-.2003-.508-.3078-.152-.1039-.293-.2077-.423-.3152.26-.2151.56-.4154.901-.6045l80.507-44.4087c2.867-1.5798 7.521-1.5798 10.402 0l81.041 44.4087c.352.1928.664.4042.931.623z" fill="#cdd8dd"/><path d="m913.279 93.9211c-.041.0334-.089.0705-.134.1076-.041.0296-.085.063-.13.0964-.011.0074-.026.0222-.041.0297-.033.0222-.063.0445-.096.0667-.082.0519-.159.1039-.241.1558-.085.0482-.171.1001-.26.1483l-80.506 44.4084c-1.447.798-3.349 1.191-5.244 1.183-1.869-.007-3.731-.4-5.162-1.183l-81.037-44.4084c-.182-.1001-.349-.2002-.508-.3078-.152-.1038-.293-.2077-.423-.3152.259-.2151.56-.4153.901-.6045l80.507-44.4087c2.866-1.5798 7.52-1.5798 10.402 0l81.041 44.4087c.352.1929.664.4042.931.623z" fill="url(#ak)"/><path d="m931.233 91.6562-.096 32.1448c-.004 1.224-.853 2.448-2.544 3.379l-95.734 52.804c-1.694.935-3.912 1.402-6.137 1.409v-32.145c2.255.008 4.517-.459 6.234-1.409l95.733-52.8043c.108-.0594.208-.1187.308-.1781.1-.0593.193-.1223.286-.1854.04-.0259.078-.0519.115-.0778.018-.0112.037-.026.052-.0371.051-.0371.103-.0742.152-.115.066-.0519.133-.1038.196-.1557 0 0 .004 0 .004-.0038.156-.1297.3-.2633.434-.4042.048-.0519.1-.1038.144-.1595.045-.0482.082-.0927.119-.1409.011-.0111.019-.0222.03-.037.037-.0445.07-.0928.1-.1373.041-.0556.078-.1149.115-.1706.041-.063.078-.1297.115-.1928.181-.3226.296-.6564.341-.9902.015-.0667.022-.1335.022-.2002.008-.063.011-.1298.011-.1929z" fill="#cdd8dd"/><path d="m931.233 91.6896-.096 32.1444c-.004 1.224-.853 2.448-2.544 3.379l-95.734 52.804c-1.694.935-3.912 1.402-6.137 1.41-2.251.007-4.51-.46-6.234-1.406l-96.364-52.804c-1.721-.946-2.585-2.188-2.581-3.427l.096-32.1338c0 .9235.486 1.8506 1.454 2.6553.159.1335.334.2633.523.3894s.389.2484.604.3671l96.364 52.805c1.699.934 3.916 1.401 6.138 1.409 2.255.007 4.517-.46 6.234-1.409l95.733-52.805c.108-.0593.208-.1187.308-.178s.193-.1224.286-.1854c.04-.026.078-.0519.115-.0779.018-.0111.037-.0259.052-.0371.051-.037.103-.0741.152-.1149.066-.052.133-.1039.196-.1558 0 0 .004 0 .004-.0037.156-.1298.3-.2633.434-.4042.048-.0519.1-.1039.144-.1595.045-.0482.082-.0927.119-.1409.011-.0111.019-.0223.03-.0371.037-.0445.07-.0927.1-.1372.041-.0556.078-.115.115-.1706.041-.063.078-.1298.115-.1928.181-.3227.296-.6564.341-.9902.015-.0667.022-.1335.022-.2002.008-.0631.011-.1298.011-.1929z" fill="url(#al)" opacity=".8"/><path d="m931.233 91.6989-.096 32.1451c-.004 1.223-.853 2.447-2.544 3.378l-95.734 52.805c-1.695.934-3.912 1.401-6.137 1.409-2.252.007-4.51-.46-6.234-1.406l-96.364-52.804c-1.721-.946-2.585-2.188-2.582-3.427l.097-32.1335c0 .9234.486 1.8505 1.454 2.6552.159.1335.333.2633.522.3894.19.1261.39.2485.605.3671l96.364 52.8048c1.698.934 3.916 1.402 6.138 1.409 2.254.007 4.516-.46 6.233-1.409l95.734-52.8048c.108-.0593.208-.1186.308-.1779.1-.0594.193-.1224.285-.1855.041-.0259.078-.0519.115-.0779.019-.0111.037-.0259.052-.037.052-.0371.104-.0742.152-.115.067-.0519.134-.1038.197-.1557 0 0 .004 0 .004-.0038.155-.1298.3-.2633.433-.4042.049-.0519.101-.1038.145-.1595.045-.0482.082-.0927.119-.1409.011-.0111.018-.0222.029-.037.037-.0445.071-.0928.101-.1373.04-.0556.077-.1149.114-.1706.041-.063.078-.1297.115-.1928.182-.3226.297-.6564.342-.9902.014-.0667.022-.1334.022-.2002.007-.063.011-.1298.011-.1928z" fill="url(#am)"/><path d="m919.68 110.801c2.698-1.516 4.914-.285 4.923 2.731.009 3.019-2.193 6.728-4.891 8.244l-81.434 45.733c-2.701 1.517-4.917.288-4.926-2.73-.009-3.017 2.193-6.728 4.894-8.245z" fill="#fff" opacity=".8"/><path d="m850.299 152.292c1.664-.91 3.018-.179 3.024 1.631.005 1.811-1.34 4.017-3.004 4.927-1.665.909-3.021.18-3.027-1.63-.005-1.811 1.342-4.018 3.007-4.928z" fill="#651fff" opacity=".5"/><path d="m881.553 134.793c1.664-.91 3.018-.179 3.023 1.632.006 1.81-1.339 4.016-3.004 4.926-1.664.91-3.021.18-3.026-1.63-.006-1.811 1.342-4.018 3.007-4.928z" fill="#651fff" opacity=".9"/><path d="m911.951 117.433c1.664-.91 3.018-.18 3.024 1.631.005 1.811-1.34 4.017-3.004 4.926-1.665.91-3.021.181-3.027-1.63-.005-1.81 1.342-4.017 3.007-4.927z" fill="#651fff" opacity=".5"/><path d="m864.363 73.0835c.684.3839 1.375.8666 1.717 1.4436l13.71 21.7145c.6 1.1069.527 2.3102-.407 3.3206l-21.331 19.4048c-1.278.916-3.067 1.54-5.117 1.731l-40.303 2.409c-1.997.173-3.928-.159-5.294-.927-.155-.086-.302-.179-.442-.277l-28.794-16.175c-1.372-.869-2.151-2.073-2.154-3.229l4.139-22.7247c.335-1.154 1.437-2.1643 3.142-2.84l34.443-12.2271c1.793-.6264 3.84-.7251 5.722-.3389l38.656 7.6083c.855.2875 1.626.7208 2.313 1.1069z" fill="#651fff"/><path d="m864.379 73.0835c.684.3839 1.376.8666 1.718 1.4436l13.709 21.7145c.6 1.1069.527 2.3102-.407 3.3206l-21.331 19.4048c-1.277.916-3.066 1.54-5.117 1.731l-40.303 2.409c-1.996.173-3.927-.159-5.294-.927-.155-.086-.302-.179-.441-.277l-28.795-16.175c-1.372-.869-2.151-2.073-2.154-3.229l4.139-22.7247c.336-1.154 1.437-2.1643 3.142-2.84l34.443-12.2271c1.793-.6264 3.84-.7251 5.722-.3389l38.656 7.6083c.855.2875 1.626.7208 2.313 1.1069z" fill="url(#an)"/><path d="m849.24 113.002c.6.53.605 1.303-.248 1.88-.935.24-2.135.143-2.906-.29-.172-.097-.256-.144-.34-.29-.001-.063-.03-.11-.089-.143-.171-.097-.168-.193-.256-.243-.26-.24-.345-.48-.518-.77-.168-.094-.257-.238-.341-.384-.606-.72-1.291-1.396-2.063-2.023-.344-.193-.687-.287-1.03-.287l-.771-.433c-6.395 1.877-13.822 2.31-20.834 1.347l-.427.53c-.594.047-.935.24-1.109.433-.506.674-.928 1.394-1.091 2.167-.174.287-.173.386-.26.529.006.29-.077.53-.25.818.004.096.001.193-.082.24-.253.435-.678.676-1.194.869-.509.193-1.19.191-1.705.094-.343-.094-.598-.144-.854-.287-.687-.386-.862-.963-.61-1.493-.001-.193.082-.241.085-.337.083-.24.34-.481.594-.723l.336-.384c.769-.723 1.191-1.444 1.613-2.169.086-.238-.003-.48-.175-.671l.255-.626c-1.113-.339-2.398-.676-3.512-1.109-1.967-.627-3.681-1.397-5.223-2.263-2.57-1.444-4.631-3.081-6.092-4.958l-1.027.193c-.514-.096-.94-.143-1.366-.096-1.278.24-2.563.48-3.756.867l-.68.19c-.425.146-.851.194-1.281.337-.171.002-.338.002-.426.052-1.11.141-2.135.045-2.818-.339-.172-.097-.348-.29-.429-.433-.35-.676.331-1.444 1.612-1.687.342 0 .426-.047.593-.047.601-.047 1.115-.143 1.453-.146.343 0 .514.003.769-.047 1.369-.193 2.73-.386 3.924-.673.346-.097.687-.2899.769-.5302l1.023-.1909c-.43-.725-.606-1.3964-.781-2.1665-.788-3.3249.304-6.6455 2.932-9.5821l-.855-.3861c-.001-.2874-.17-.4805-.43-.6263-1.285-.5299-2.395-.8666-3.679-1.2034-.256-.1437-.515-.1909-.771-.2403-.343-.0943-.853-.193-1.284-.3367-.056-.0315-.152-.1287-.235-.1754-.535-.0648-.623-.1142-.791-.2086-.888-.4888-1.075-1.145-.524-1.6367.766-.6264 2.219-.7722 3.333-.3389.111 0 .196.0165.255.0494.172.0965.343.0943.427.1415.344.1931.771.3389 1.114.532.256.0493.428.1459.596.2402 1.118.5298 2.232.9632 3.429 1.3492.427.0472.853.0944 1.195.0001l1.029.2874c4.081-3.1769 10.132-5.3456 16.962-6.2122.255-.0451.426-.0472.685-.0944l-.007-.559c.282-.1167.424-.3734.427-.5479-.005-.7722-.352-1.5401-.699-2.3123-.088-.1437-.173-.2896-.257-.4312-.173-.2896-.346-.5792-.431-.8194-.088-.0494-.089-.2328-.089-.2424-.093-.8173.76-1.493 2.042-1.6367.68-.0966 1.283.0493 1.794.3368.432.2423.689.5791.774.9138.002.193.089.2423.086.3389.006.2896-.081.5277-.079.8194.001.0944.085.2402.002.3861-.079.7208.009 1.5402.185 2.3102.088.1437.173.2896.341.384.172.0965.347.0965.431.1437l.258.5299c5.811-.0966 11.624.77 16.502 2.5525 1.198.4805 2.312.9138 3.339 1.3964l.771-.3367c.597-.0494.935-.1459 1.277-.2403 1.024-.5792 1.961-1.109 2.726-1.7354.255-.1437.425-.2402.508-.3861.254-.2381.511-.4783.853-.6714l.425-.2402c.425-.2403 1.021-.3883 1.702-.3862.748-.0018 1.429.109 1.877.3609.066.0368.126.0767.181.1196.769.5299.606 1.3965-.335 1.8298l-.509.2874c-.425.1459-.766.339-1.192.4848-.171.0965-.429.1437-.596.2381-1.28.5299-2.217 1.0597-3.154 1.5895-.166.1931-.34.3861-.255.6264l-.508.3861c3.604 2.5033 6.012 5.5836 6.715 8.7626.005.7679.093 1.5873.098 2.3596l1.112.1415c.085.1459.256.2424.34.2896.172.0966.431.1437.687.193 1.283.1438 2.733.1931 4.016.1438.171.0021.43.0493.685 0 .426-.0472.936-.0472 1.454-.0472.084.0471.255.0493.426.0472.765.0493 1.364.193 1.795.4354.428.2402.689.6735.604 1.0103-.167.7701-1.359 1.2506-2.726 1.1541-.342.0987-.43.0493-.598.0493-.514-.0965-.941-.1437-1.455-.2402-.255-.0494-.514-.0966-.77-.1459-1.367-.1909-2.647-.3367-4.101-.3839-.343 0-.768.1458-1.022.2896l-1.111.0471c-.758 1.9739-2.117 3.8999-3.987 5.6329-1.954 1.686-4.335 3.226-7.149 4.43l.517.482c-.17.191-.169.479.004.674.689.673 1.545 1.347 2.405 1.924.169.193.34.29.512.386.344.193.688.386.944.624.172.097.344.193.256.243-.083.047.005.096.089.143zm-17.285-4.813c1.621-.146 3.244-.483 4.863-.916l-7.119-5.633c-.26-.146-.603-.24-.943-.337-.857-.191-1.88 0-2.391.483l-4.663 6.403c3.336.433 6.922.433 10.253 0zm-17.414-12.7588c.426-.0472.768-.2402.934-.4333.599-.4333.336-1.0597-.347-1.4436l-9.93-3.9491c-2.208 2.5999-2.792 5.633-1.748 8.4259zm6.501-13.145c-5.039.7229-9.555 2.3124-12.877 4.479l10.699 3.3205c.427.1459.687.193 1.113.1459 1.111-.0473 1.876-.5792 1.785-1.2034zm-6.951 24.2198c.771.24 1.37.479 1.969.721l3.296-6.5c-.005-.289-.007-.482-.092-.723-.091-.1872-.258-.3447-.477-.4677-.399-.2243-.972-.3337-1.579-.3019l-11.776 1.9246c1.203 1.252 2.747 2.505 4.546 3.515 1.287.723 2.656 1.3 4.113 1.832zm24.898-22.5832c-3.68-1.2978-7.954-1.9713-12.312-2.0206l2.091 6.8363c.172.1909.256.3368.516.4827.771.4333 2.051.4805 2.817.0472l8.944-4.5755zm2.603 21.6202c1.963-.916 3.662-1.976 5.024-3.228 1.36-1.251 2.376-2.6002 2.965-3.9966l-12.215-.3368c-.343 0-.598.0494-.943.1459-.939.3368-1.277 1.0103-.673 1.5423zm8.568-10.4487c-.013-2.8894-1.742-5.6823-5.086-8.0397l-8.088 5.1503c-.254.1438-.337.2896-.336.4827-.103.3549.149.6912.576.9314.268.1503.604.263.965.3191zm-22.137-2.0699-3.675.2403-1.866 1.7311 1.206 1.9262 3.422.6735 3.069-1.0554.414-2.0721z" fill="#fff"/><path d="m821.019 78.3383.084-.0472v.018c-.027.011-.055.0208-.084.0292z" fill="#fff"/></g><path d="m576.622 477.809c1.976-7.207 1.47-13.628-1.129-14.34-2.599-.713-6.308 4.552-8.284 11.76-1.976 7.207-1.471 13.627 1.129 14.34 2.599.712 6.308-4.553 8.284-11.76z" fill="#5e2ad7"/><path d="m951.063 489.569c2.599-.713 3.105-7.133 1.129-14.34-1.976-7.208-5.685-12.473-8.284-11.76-2.6.712-3.105 7.133-1.129 14.34s5.685 12.472 8.284 11.76z" fill="#5e2ad7"/><path d="m568.544 491.317c.37-1.815.863-3.647 1.427-5.461z" fill="#dbdbdb"/><path d="m928.338 452.05c-5.532 14.181-16.454 27.799-32.784 39.725-4.052 2.995-8.456 5.866-13.195 8.614-67.294 39.108-176.778 39.108-244.531 0-5.038-2.906-9.706-5.954-14.004-9.125-16.313-11.997-27.235-25.649-32.767-39.865-4.598-11.803-5.478-23.976-2.624-35.92 4.95-20.752 21.139-40.764 48.603-56.724 67.311-39.108 176.779-39.108 244.531 0 29.63 17.105 46.348 38.861 50.188 61.198 1.832 10.711.705 21.563-3.417 32.097z" fill="#c8d6dc"/><path d="m945.267 536.414-.106.212c-1.11 2.29-2.36 4.563-3.734 6.817l-.036.053c-2.554 4.175-5.566 8.297-9.019 12.296-8.967 10.447-20.946 20.241-35.937 28.961-75.028 43.601-197.073 43.601-272.576 0-15.397-8.896-27.675-18.902-36.818-29.595-5.179-6.025-9.337-12.278-12.508-18.673-.053-.106-.105-.212-.158-.317-7.188-14.604-9.143-29.895-5.831-44.851l1.427-5.461 18.462-70.377c-2.854 11.944-1.974 24.117 2.624 35.92 5.532 14.216 16.454 27.868 32.766 39.865 4.299 3.171 8.967 6.219 14.005 9.125 67.753 39.108 177.237 39.108 244.531 0 4.739-2.748 9.143-5.619 13.195-8.614 16.33-11.926 27.252-25.544 32.784-39.725 4.122-10.534 5.249-21.386 3.417-32.097l16.595 63.348c6.324 17.564 5.302 35.814-3.083 53.113z" fill="#eef0f2"/><path d="m945.161 536.626-15.907 36.131-.018.053c-6.289 18.778-21.95 36.694-47 51.245-67.241 39.073-176.603 39.073-244.267 0-25.138-14.516-40.993-32.396-47.511-51.122l-.035-.088-15.89-36.36c3.171 6.395 7.329 12.648 12.508 18.673 9.143 10.693 21.421 20.699 36.818 29.595 75.503 43.601 197.548 43.601 272.576 0 14.991-8.72 26.97-18.514 35.937-28.961 3.453-3.999 6.465-8.121 9.019-12.296l.036-.053c1.374-2.254 2.624-4.527 3.734-6.817z" fill="#5e2ad7"/><path d="m882.104 438.217c-4.01 10.28-11.928 20.153-23.767 28.799-2.938 2.171-6.13 4.253-9.566 6.245-48.786 28.352-128.159 28.352-177.277 0-3.653-2.107-7.037-4.317-10.153-6.616-11.826-8.697-19.744-18.594-23.755-28.901-3.333-8.557-3.971-17.382-1.902-26.04 3.588-15.045 15.325-29.553 35.235-41.124 48.799-28.352 128.159-28.352 177.277 0 21.482 12.401 33.601 28.174 36.386 44.368 1.328 7.764.51 15.631-2.478 23.269z" fill="#fff"/><path d="m945.261 536.415-.106.211c-1.11 2.29-2.36 4.562-3.734 6.817l-.036.053c-2.554 4.175-5.566 8.297-9.019 12.296-8.967 10.447-20.946 20.241-35.937 28.961-75.028 43.6-197.073 43.6-272.576 0-15.397-8.896-27.675-18.902-36.818-29.595-5.179-6.025-9.337-12.278-12.508-18.673-.052-.106-.105-.212-.158-.317-7.188-14.604-9.143-29.895-5.831-44.851l1.427-5.461 18.462-70.377c4.95-20.752 21.139-40.764 48.603-56.724 67.311-39.108 176.779-39.108 244.531 0 29.63 17.105 46.348 38.861 50.188 61.198l16.595 63.348c6.324 17.564 5.302 35.814-3.083 53.114z" fill="url(#ao)" opacity=".8"/><path d="m924.807 535.677c2.657-.453 3.792-6.793 2.535-14.16-1.257-7.366-4.429-12.971-7.086-12.518-2.657.454-3.792 6.793-2.535 14.16s4.429 12.971 7.086 12.518z" fill="#5e2ad7"/><path d="m605.821 523.159c1.257-7.367.122-13.706-2.535-14.16-2.657-.453-5.829 5.152-7.086 12.518-1.257 7.367-.122 13.707 2.535 14.16 2.656.453 5.829-5.151 7.086-12.518z" fill="#5e2ad7"/><path d="m654.262 550.388c.825-7.427-.678-13.69-3.357-13.987-2.678-.298-5.519 5.482-6.344 12.91-.825 7.427.678 13.69 3.356 13.987 2.679.298 5.52-5.482 6.345-12.91z" fill="#5e2ad7"/><path d="m713.974 570.894c.825-7.427-.678-13.69-3.356-13.987-2.679-.298-5.52 5.482-6.345 12.91-.825 7.427.678 13.69 3.357 13.987 2.678.298 5.519-5.482 6.344-12.91z" fill="#5e2ad7"/><path d="m820.635 583.804c2.679-.297 4.181-6.56 3.356-13.987-.825-7.428-3.665-13.208-6.344-12.91-2.679.297-4.182 6.56-3.356 13.987.825 7.428 3.665 13.208 6.344 12.91z" fill="#5e2ad7"/><path d="m767.57 590.3c2.696 0 4.881-6.058 4.881-13.531s-2.185-13.532-4.881-13.532c-2.695 0-4.88 6.059-4.88 13.532s2.185 13.531 4.88 13.531z" fill="#5e2ad7"/><path d="m880.347 563.298c2.679-.298 4.182-6.56 3.357-13.988-.826-7.427-3.666-13.207-6.345-12.909-2.679.297-4.181 6.56-3.356 13.987.825 7.428 3.665 13.208 6.344 12.91z" fill="#5e2ad7"/><path d="m945.408 536.415-.106.211c-1.11 2.29-2.36 4.562-3.735 6.817l-.035.053c-2.554 4.175-5.566 8.297-9.019 12.296-8.967 10.447-20.946 20.241-35.937 28.961-75.028 43.6-197.073 43.6-272.576 0-15.397-8.896-27.675-18.902-36.818-29.595-5.179-6.025-9.337-12.278-12.508-18.673-.053-.106-.105-.212-.158-.317-7.188-14.604-9.143-29.895-5.831-44.851l1.427-5.461 18.461-70.377c4.951-20.752 21.14-40.764 48.604-56.724 67.311-39.108 176.779-39.108 244.531 0 29.63 17.105 46.348 38.861 50.188 61.198l16.595 63.348c6.324 17.564 5.302 35.814-3.083 53.114z" fill="url(#ap)"/><path d="m896.45 441.948c-4.48 11.488-13.328 22.518-26.556 32.179-3.282 2.426-6.849 4.752-10.688 6.978-54.511 31.679-143.198 31.679-198.08 0-4.081-2.354-7.863-4.823-11.345-7.392-13.213-9.717-22.061-20.777-26.541-32.292-3.725-9.561-4.438-19.422-2.127-29.097 4.01-16.81 17.124-33.02 39.371-45.949 54.525-31.679 143.198-31.679 198.08 0 24.002 13.856 37.544 31.48 40.655 49.574 1.484 8.676.57 17.466-2.769 25.999z" opacity=".8" stroke="#fff" stroke-miterlimit="10" stroke-width=".72991"/><path d="m816.784 388.744c31.738 18.325 31.911 48.029.379 66.354-31.527 18.321-82.815 18.321-114.553-.003-31.733-18.321-31.9-48.029-.374-66.35 31.533-18.325 82.815-18.322 114.548-.001z" fill="#6626e1" opacity=".5"/><path clip-rule="evenodd" d="m740.066 412.349c9.15-6.215 25.316-6.942 36.037-1.622 10.719 5.321 11.997 14.707 2.848 20.921-9.15 6.214-25.316 6.941-36.036 1.62-10.721-5.32-11.999-14.705-2.849-20.919zm8.004 3.972c-5.377 3.652-4.62 9.17 1.687 12.3 6.307 3.131 15.812 2.706 21.189-.946 5.378-3.652 4.62-9.171-1.688-12.302-6.305-3.129-15.81-2.704-21.188.948z" fill="#fff" fill-rule="evenodd"/><path d="m790.412 454.229c.201.619-.412 1.234-1.422 1.457-7.164 2.062-15.385 3.219-23.471 3.447-.804.027-1.528-.119-2.036-.412-.219-.126-.398-.28-.525-.459l-7.445-8.646c-4.942-.328-9.812-1.118-14.43-2.323l-13.376 5.194c-.828.329-2.118.333-2.975-.057-3.427-1.371-6.633-2.871-9.618-4.594-2.993-1.728-5.593-3.58-7.971-5.561-.677-.495-.664-1.237-.108-1.723l8.932-7.76c-2.095-2.671-3.574-5.546-4.058-8.35l-14.959-4.29c-.309-.073-.575-.176-.794-.302-.508-.293-.761-.713-.718-1.178.376-4.68 2.338-9.451 5.882-13.602.375-.59 1.441-.943 2.511-.828l16.278.828c1.333-1.147 3.028-2.238 4.773-3.252s3.622-1.999 5.598-2.775l-1.483-9.427c-.201-.618.396-1.233 1.414-1.452 7.164-2.071 15.392-3.223 23.47-3.456.805-.027 1.526.121 2.035.415.218.126.397.279.526.456l7.454 8.65c4.843.272 9.812 1.119 14.43 2.324l13.359-5.194c.845-.329 2.135-.343 2.984.052 3.468 1.347 6.696 2.884 9.642 4.585 2.946 1.7 5.609 3.565 7.947 5.57.684.49.672 1.242.1 1.728l-8.924 7.755c2.095 2.671 3.483 5.494 4.066 8.355l14.95 4.285c.31.073.576.176.795.302.508.293.761.713.718 1.179-.377 4.679-2.347 9.445-5.882 13.611-.383.585-1.434.937-2.502.823l-16.287-.833c-1.342 1.143-3.037 2.233-4.782 3.247s-3.621 1.999-5.59 2.78zm-56.808-17.148c14.76 8.522 38.423 8.641 52.833.267 14.419-8.379 14.128-22.081-.632-30.603-14.76-8.521-38.399-8.635-52.817-.256-14.41 8.374-14.144 22.071.616 30.592z" fill="#fff"/><path d="m869.061 192.307v227.697c.085 16.207-10.493 32.415-31.791 44.793-42.553 24.73-111.806 24.73-154.643-.014-21.426-12.364-32.188-28.572-32.287-44.779v-227.697c-.099-16.222 10.493-32.429 31.776-44.794 42.568-24.743 111.807-24.743 154.658 0 21.425 12.365 32.202 28.586 32.287 44.794z" fill="url(#aq)"/></svg>
\ No newline at end of file
diff --git a/web/packages/teleport/src/Navigation/ResourcesSection.test.tsx b/web/packages/teleport/src/Navigation/ResourcesSection.test.tsx
new file mode 100644
index 0000000000000..f816e10eabbda
--- /dev/null
+++ b/web/packages/teleport/src/Navigation/ResourcesSection.test.tsx
@@ -0,0 +1,54 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { getResourcesSection } from 'teleport/Navigation/ResourcesSection';
+import { makeDefaultUserPreferences } from 'teleport/services/userPreferences/userPreferences';
+
+describe('getResourcesSection', () => {
+  test('titles for subsections by kind are sorted', () => {
+    const navSections = getResourcesSection({
+      clusterId: 'cluster',
+      preferences: makeDefaultUserPreferences(),
+      updatePreferences: async () => {},
+      searchParams: new URLSearchParams(),
+    });
+
+    const titles = navSections.subsections.map(s => s.title);
+
+    // First two sections are fixed.
+    const fixed = ['All Resources', 'Pinned Resources'];
+
+    // Kind filters that should be sorted alphabetically.
+    const kindFilters = [
+      'Applications',
+      'Databases',
+      'Desktops',
+      'Git Servers',
+      'Kubernetes Clusters',
+      'MCP Servers',
+      'SSH Resources',
+    ];
+
+    const expected = [
+      ...fixed,
+      ...kindFilters.toSorted((a, b) => a.localeCompare(b)),
+    ];
+
+    expect(titles).toEqual(expected);
+  });
+});
diff --git a/web/packages/teleport/src/Navigation/ResourcesSection.tsx b/web/packages/teleport/src/Navigation/ResourcesSection.tsx
index 334cb9d88faa5..f0da25f25b4a6 100644
--- a/web/packages/teleport/src/Navigation/ResourcesSection.tsx
+++ b/web/packages/teleport/src/Navigation/ResourcesSection.tsx
@@ -23,11 +23,14 @@ import { Box, Flex, Text } from 'design';
 import * as Icons from 'design/Icon';
 import { DefaultTab } from 'gen-proto-ts/teleport/userpreferences/v1/unified_resource_preferences_pb';
 import { UserPreferences } from 'gen-proto-ts/teleport/userpreferences/v1/userpreferences_pb';
+import {
+  getFilterKindName,
+  ResourceFilterKind,
+} from 'shared/components/UnifiedResources';
 
 import { encodeUrlQueryParams } from 'teleport/components/hooks/useUrlFiltering';
 import { EncodeUrlQueryParamsProps } from 'teleport/components/hooks/useUrlFiltering/encodeUrlQueryParams';
 import cfg from 'teleport/config';
-import { ResourceIdKind } from 'teleport/services/agents';
 import { useUser } from 'teleport/User/UserContext';
 import useStickyClusterId from 'teleport/useStickyClusterId';
 
@@ -68,7 +71,7 @@ type GetSubsectionProps = {
 
 function encodeUrlQueryParamsWithTypedKinds(
   params: Omit<EncodeUrlQueryParamsProps, 'kinds'> & {
-    kinds?: ResourceIdKind[];
+    kinds?: ResourceFilterKind[];
   }
 ) {
   return encodeUrlQueryParams(params);
@@ -114,7 +117,7 @@ function getResourcesSubsections({
     preferences?.unifiedResourcePreferences?.defaultTab === DefaultTab.PINNED;
 
   // isKindActive returns true if we are currently filtering for only the provided kind of resource.
-  const isKindActive = (kind: ResourceIdKind) => {
+  const isKindActive = (kind: ResourceFilterKind) => {
     // This subsection for this kind should only be marked active when it is the only kind being filtered for,
     // if there are multiple kinds then the "All Resources" button should be active.
     return currentKinds.length === 1 && currentKinds[0] === kind;
@@ -158,6 +161,11 @@ function getResourcesSubsections({
     kinds: ['git_server'],
     pinnedOnly: false,
   });
+  const mcpOnlyRoute = encodeUrlQueryParamsWithTypedKinds({
+    pathname: baseRoute,
+    kinds: ['mcp'],
+    pinnedOnly: false,
+  });
 
   return [
     {
@@ -193,7 +201,7 @@ function getResourcesSubsections({
       onClick: () => setPinnedUserPreference(true),
     },
     {
-      title: 'Applications',
+      title: getFilterKindName('app'),
       icon: Icons.Application,
       route: applicationsOnlyRoute,
       searchableTags: ['resources', 'apps', 'applications'],
@@ -204,7 +212,7 @@ function getResourcesSubsections({
       subCategory: CustomNavigationSubcategory.FilteredViews,
     },
     {
-      title: 'Databases',
+      title: getFilterKindName('db'),
       icon: Icons.Database,
       route: databasesOnlyRoute,
       searchableTags: ['resources', 'dbs', 'databases'],
@@ -215,7 +223,7 @@ function getResourcesSubsections({
       subCategory: CustomNavigationSubcategory.FilteredViews,
     },
     {
-      title: 'Desktops',
+      title: getFilterKindName('windows_desktop'),
       icon: Icons.Desktop,
       route: desktopsOnlyRoute,
       searchableTags: ['resources', 'desktops', 'rdp', 'windows'],
@@ -226,7 +234,7 @@ function getResourcesSubsections({
       subCategory: CustomNavigationSubcategory.FilteredViews,
     },
     {
-      title: 'Git Servers',
+      title: getFilterKindName('git_server'),
       icon: Icons.GitHub,
       route: gitOnlyRoute,
       searchableTags: ['resources', 'git', 'github', 'git servers'],
@@ -237,7 +245,7 @@ function getResourcesSubsections({
       subCategory: CustomNavigationSubcategory.FilteredViews,
     },
     {
-      title: 'Kubernetes',
+      title: getFilterKindName('kube_cluster'),
       icon: Icons.Kubernetes,
       route: kubesOnlyRoute,
       searchableTags: ['resources', 'k8s', 'kubes', 'kubernetes'],
@@ -248,7 +256,18 @@ function getResourcesSubsections({
       subCategory: CustomNavigationSubcategory.FilteredViews,
     },
     {
-      title: 'SSH Resources',
+      title: getFilterKindName('mcp'),
+      icon: Icons.ModelContextProtocol,
+      route: mcpOnlyRoute,
+      searchableTags: ['resources', 'mcp', 'mcp servers'],
+      category: NavigationCategory.Resources,
+      exact: false,
+      customRouteMatchFn: () => isKindActive('mcp'),
+      onClick: () => setPinnedUserPreference(false),
+      subCategory: CustomNavigationSubcategory.FilteredViews,
+    },
+    {
+      title: getFilterKindName('node'),
       icon: Icons.Server,
       route: nodesOnlyRoute,
       searchableTags: ['resources', 'servers', 'nodes', 'ssh resources'],
diff --git a/web/packages/teleport/src/Navigation/Search.tsx b/web/packages/teleport/src/Navigation/Search.tsx
index 0f660163407ff..48d6182ed82f5 100644
--- a/web/packages/teleport/src/Navigation/Search.tsx
+++ b/web/packages/teleport/src/Navigation/Search.tsx
@@ -132,7 +132,10 @@ function SearchContent({
       subsection.searchableTags?.some(
         tag =>
           searchInput.length > 0 &&
-          tag.toLowerCase().includes(searchInput.toLocaleLowerCase())
+          (tag.toLowerCase().includes(searchInput.toLocaleLowerCase()) ||
+            subsection?.title
+              ?.toLowerCase()
+              .includes(searchInput.toLocaleLowerCase()))
       )
     )
   );
@@ -241,7 +244,7 @@ const SearchInput = styled.input`
   box-sizing: border-box;
   font-size: ${props => props.theme.fontSizes[2]}px;
   height: 32px;
-  width: 192px;
+  width: 232px;
   ${color}
   ${space}
   ${height}
diff --git a/web/packages/teleport/src/Navigation/Section.tsx b/web/packages/teleport/src/Navigation/Section.tsx
index dd0c7f02da7d7..f3b72956d846d 100644
--- a/web/packages/teleport/src/Navigation/Section.tsx
+++ b/web/packages/teleport/src/Navigation/Section.tsx
@@ -26,17 +26,16 @@ import React, {
 import { NavLink } from 'react-router-dom';
 import styled, { css, useTheme } from 'styled-components';
 
-import { Box, ButtonIcon, Flex, Image, P2, Text } from 'design';
+import { Box, ButtonIcon, Flex, P2, Text } from 'design';
 import { ArrowLineLeft, ArrowSquareIn } from 'design/Icon';
 import { Theme } from 'design/theme';
 import { HoverTooltip, IconTooltip } from 'design/Tooltip';
 
+import { PoweredByTeleportLogo } from 'teleport/components/PoweredByTeleportLogo';
 import { SlidingSidePanel } from 'teleport/components/SlidingSidePanel';
 import cfg from 'teleport/config';
 
 import { CategoryIcon } from './CategoryIcon';
-import logoPoweredByDark from './logoPoweredByDark.svg';
-import logoPoweredByLight from './logoPoweredByLight.svg';
 import {
   NavigationSection,
   NavigationSubsection,
@@ -387,6 +386,7 @@ export function SubsectionItem({
       exact={exact}
       tabIndex={0}
       onClick={onClick}
+      data-testid={to}
     >
       {children}
     </StyledSubsectionItem>
@@ -526,23 +526,6 @@ function LicenseFooter({
   );
 }
 
-function PoweredByTeleportLogo() {
-  const theme = useTheme();
-  const src = theme.type === 'dark' ? logoPoweredByDark : logoPoweredByLight;
-  return (
-    <StyledFooterBox
-      py={3}
-      px={4}
-      pb={4}
-      css={`
-        border: none;
-      `}
-    >
-      <Image src={src} maxWidth="100%" alt="powered by teleport" />
-    </StyledFooterBox>
-  );
-}
-
 export function SectionFooter({
   showPoweredByLogo = false,
   edition,
diff --git a/web/packages/teleport/src/Navigation/zIndexMap.ts b/web/packages/teleport/src/Navigation/zIndexMap.ts
index aa682cc2133bc..f163c738e21ec 100644
--- a/web/packages/teleport/src/Navigation/zIndexMap.ts
+++ b/web/packages/teleport/src/Navigation/zIndexMap.ts
@@ -17,6 +17,11 @@
  */
 
 export const zIndexMap = {
+  // "checkoutSidePanel" z-index must be a higher value than "topBar" z-index.
+  // checkoutSidePanel encompasses entire height of the browser and
+  // the high z-index prevents navigational bits from rendering over
+  // the panel.
+  checkoutSidePanel: 100,
   topBar: 19,
   sideNavButtons: 18,
   sideNavContainer: 17,
diff --git a/web/packages/teleport/src/Player/Player.story.tsx b/web/packages/teleport/src/Player/Player.story.tsx
deleted file mode 100644
index 1d4018a89de1e..0000000000000
--- a/web/packages/teleport/src/Player/Player.story.tsx
+++ /dev/null
@@ -1,121 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { Meta } from '@storybook/react';
-import { createMemoryHistory } from 'history';
-
-import { Flex } from 'design';
-
-import { ContextProvider } from 'teleport';
-import { Route, Router } from 'teleport/components/Router';
-import { createTeleportContext } from 'teleport/mocks/contexts';
-
-import { Player } from './Player';
-
-const meta: Meta = {
-  title: 'Teleport/Player',
-  decorators: Story => {
-    const ctx = createTeleportContext();
-
-    return (
-      <ContextProvider ctx={ctx}>
-        <Story />
-      </ContextProvider>
-    );
-  },
-};
-export default meta;
-
-export const SSH = () => {
-  const history = createMemoryHistory({
-    initialEntries: [
-      '/web/cluster/localhost/session/123?recordingType=ssh&durationMs=1234',
-    ],
-    initialIndex: 0,
-  });
-
-  return (
-    <Router history={history}>
-      <Flex m={-3}>
-        <Route path="/web/cluster/:clusterId/session/:sid">
-          <Player />
-        </Route>
-      </Flex>
-    </Router>
-  );
-};
-
-// SSH player attempts to write to a web socket, and currently, there's no
-// official support for web sockets in MSW (see
-// https://github.com/mswjs/msw/issues/156).
-SSH.tags = ['skip-test'];
-
-export const Desktop = () => {
-  const history = createMemoryHistory({
-    initialEntries: [
-      '/web/cluster/localhost/session/123?recordingType=desktop&durationMs=1234',
-    ],
-    initialIndex: 0,
-  });
-
-  return (
-    <Router history={history}>
-      <Flex m={-3}>
-        <Route path="/web/cluster/:clusterId/session/:sid">
-          <Player />
-        </Route>
-      </Flex>
-    </Router>
-  );
-};
-
-export const RecordingTypeError = () => {
-  const history = createMemoryHistory({
-    initialEntries: ['/web/cluster/localhost/session/123?recordingType=bla'],
-    initialIndex: 0,
-  });
-
-  return (
-    <Router history={history}>
-      <Flex m={-3}>
-        <Route path="/web/cluster/:clusterId/session/:sid">
-          <Player />
-        </Route>
-      </Flex>
-    </Router>
-  );
-};
-
-export const DurationMsError = () => {
-  const history = createMemoryHistory({
-    initialEntries: [
-      '/web/cluster/localhost/session/123?recordingType=desktop&durationMs=blabla',
-    ],
-    initialIndex: 0,
-  });
-
-  return (
-    <Router history={history}>
-      <Flex m={-3}>
-        <Route path="/web/cluster/:clusterId/session/:sid">
-          <Player />
-        </Route>
-      </Flex>
-    </Router>
-  );
-};
diff --git a/web/packages/teleport/src/Player/Player.tsx b/web/packages/teleport/src/Player/Player.tsx
deleted file mode 100644
index 608abef2d33cf..0000000000000
--- a/web/packages/teleport/src/Player/Player.tsx
+++ /dev/null
@@ -1,165 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useCallback, useEffect } from 'react';
-import styled from 'styled-components';
-
-import { Box, Flex, Indicator } from 'design';
-import { Danger } from 'design/Alert';
-import { makeSuccessAttempt, useAsync } from 'shared/hooks/useAsync';
-
-import { useLocation, useParams } from 'teleport/components/Router';
-import { UrlPlayerParams } from 'teleport/config';
-import { getUrlParameter } from 'teleport/services/history';
-import { RecordingType } from 'teleport/services/recordings';
-import session from 'teleport/services/websession';
-import useTeleport from 'teleport/useTeleport';
-
-import ActionBar from './ActionBar';
-import { DesktopPlayer } from './DesktopPlayer';
-import Tabs, { TabItem } from './PlayerTabs';
-import SshPlayer from './SshPlayer';
-
-const validRecordingTypes = ['ssh', 'k8s', 'desktop', 'database'];
-
-export function Player() {
-  const ctx = useTeleport();
-  const { sid, clusterId } = useParams<UrlPlayerParams>();
-  const { search } = useLocation();
-
-  useEffect(() => {
-    document.title = `Play ${sid} • ${clusterId}`;
-  }, [sid, clusterId]);
-
-  const recordingType = getUrlParameter(
-    'recordingType',
-    search
-  ) as RecordingType;
-
-  // In order to render the progress bar, we need to know the length of the session.
-  // All in-product links to the session player should include the session duration in the URL.
-  // Some users manually build the URL based on the session ID and don't specify the session duration.
-  // For those cases, we make a separate API call to get the duration.
-  const [fetchDurationAttempt, fetchDuration] = useAsync(
-    useCallback(
-      () => ctx.recordingsService.fetchRecordingDuration(clusterId, sid),
-      [ctx.recordingsService, clusterId, sid]
-    )
-  );
-
-  const validRecordingType = validRecordingTypes.includes(recordingType);
-  const durationMs = Number(getUrlParameter('durationMs', search));
-  const shouldFetchSessionDuration =
-    validRecordingType && (!Number.isInteger(durationMs) || durationMs <= 0);
-
-  useEffect(() => {
-    if (shouldFetchSessionDuration) {
-      fetchDuration();
-    }
-  }, [fetchDuration, shouldFetchSessionDuration]);
-
-  const combinedAttempt = shouldFetchSessionDuration
-    ? fetchDurationAttempt
-    : makeSuccessAttempt({ durationMs });
-
-  function onLogout() {
-    session.logout();
-  }
-
-  if (!validRecordingType) {
-    return (
-      <StyledPlayer>
-        <Box textAlign="center" mx={10} mt={5}>
-          <Danger mb={0}>
-            Invalid query parameter recordingType: {recordingType}, should be
-            one of {validRecordingTypes.join(', ')}.
-          </Danger>
-        </Box>
-      </StyledPlayer>
-    );
-  }
-
-  if (
-    combinedAttempt.status === '' ||
-    combinedAttempt.status === 'processing'
-  ) {
-    return (
-      <StyledPlayer>
-        <Box textAlign="center" mx={10} mt={5}>
-          <Indicator />
-        </Box>
-      </StyledPlayer>
-    );
-  }
-  if (combinedAttempt.status === 'error') {
-    return (
-      <StyledPlayer>
-        <Box textAlign="center" mx={10} mt={5}>
-          <Danger mb={0}>
-            Unable to determine the length of this session. The session
-            recording may be incomplete or corrupted.
-          </Danger>
-        </Box>
-      </StyledPlayer>
-    );
-  }
-
-  return (
-    <StyledPlayer>
-      <Flex bg="levels.surface" height="38px">
-        <Tabs flex="1 0">
-          <TabItem title="Session Player" />
-        </Tabs>
-        <ActionBar onLogout={onLogout} />
-      </Flex>
-      <Flex
-        flex="1"
-        style={{
-          overflow: 'auto',
-          position: 'relative',
-        }}
-      >
-        {recordingType === 'desktop' ? (
-          <DesktopPlayer
-            sid={sid}
-            clusterId={clusterId}
-            durationMs={combinedAttempt.data.durationMs}
-          />
-        ) : (
-          <SshPlayer
-            sid={sid}
-            clusterId={clusterId}
-            durationMs={combinedAttempt.data.durationMs}
-          />
-        )}
-      </Flex>
-    </StyledPlayer>
-  );
-}
-
-const StyledPlayer = styled.div`
-  display: flex;
-  height: 100%;
-  width: 100%;
-  position: absolute;
-  flex-direction: column;
-
-  .terminal .xterm-viewport {
-    overflow-y: hidden !important;
-  }
-`;
diff --git a/web/packages/teleport/src/Player/SshPlayer.tsx b/web/packages/teleport/src/Player/SshPlayer.tsx
deleted file mode 100644
index 9163890118e77..0000000000000
--- a/web/packages/teleport/src/Player/SshPlayer.tsx
+++ /dev/null
@@ -1,128 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useEffect, useMemo, useState } from 'react';
-import styled from 'styled-components';
-
-import { Box, Flex, Indicator } from 'design';
-import { Danger } from 'design/Alert';
-
-import cfg from 'teleport/config';
-import { formatDisplayTime, StatusEnum } from 'teleport/lib/player';
-import TtyPlayer from 'teleport/lib/term/ttyPlayer';
-import { getAccessToken, getHostName } from 'teleport/services/api';
-
-import ProgressBar from './ProgressBar';
-import Xterm from './Xterm';
-
-export default function Player({ sid, clusterId, durationMs }) {
-  const { tty, playerStatus, statusText, time } = useStreamingSshPlayer(
-    clusterId,
-    sid
-  );
-
-  // statusText is currently only set when an error happens, so for now we can assume
-  // if it is not empty, an error occured (even if the player is in COMPLETE state, which gets
-  // set on close)
-  const isError = playerStatus === StatusEnum.ERROR || statusText !== '';
-  const isLoading = playerStatus === StatusEnum.LOADING;
-  const isPlaying = playerStatus === StatusEnum.PLAYING;
-  const isComplete = isError || playerStatus === StatusEnum.COMPLETE;
-
-  if (isError) {
-    return (
-      <StatusBox>
-        <Danger m={10}>{statusText || 'Error'}</Danger>
-      </StatusBox>
-    );
-  }
-
-  if (isLoading) {
-    return (
-      <StatusBox>
-        <Indicator />
-      </StatusBox>
-    );
-  }
-
-  return (
-    <StyledPlayer>
-      <Flex flex="1" flexDirection="column" overflow="auto">
-        <Xterm tty={tty} />
-      </Flex>
-      <ProgressBar
-        min={0}
-        max={durationMs}
-        current={time}
-        disabled={isComplete}
-        isPlaying={isPlaying}
-        time={formatDisplayTime(time)}
-        onRestart={() => window.location.reload()}
-        onStartMove={() => tty.suspendTimeUpdates()}
-        move={pos => {
-          tty.resumeTimeUpdates();
-          tty.move(pos);
-        }}
-        toggle={() => {
-          isPlaying ? tty.stop() : tty.play();
-        }}
-      />
-    </StyledPlayer>
-  );
-}
-
-const StatusBox = props => (
-  <Box width="100%" textAlign="center" p={3} {...props} />
-);
-
-const StyledPlayer = styled.div`
-  display: flex;
-  height: 100%;
-  width: 100%;
-  position: absolute;
-  flex-direction: column;
-  flex: 1;
-  justify-content: space-between;
-`;
-
-function useStreamingSshPlayer(clusterId: string, sid: string) {
-  const [playerStatus, setPlayerStatus] = useState(StatusEnum.LOADING);
-  const [statusText, setStatusText] = useState('');
-  const [time, setTime] = useState(0);
-
-  const tty = useMemo(() => {
-    const url = cfg.api.ttyPlaybackWsAddr
-      .replace(':fqdn', getHostName())
-      .replace(':clusterId', clusterId)
-      .replace(':sid', sid)
-      .replace(':token', getAccessToken());
-    return new TtyPlayer({ url, setPlayerStatus, setStatusText, setTime });
-  }, [clusterId, sid, setPlayerStatus, setStatusText, setTime]);
-
-  useEffect(() => {
-    tty.connect();
-    tty.play();
-
-    return () => {
-      tty.stop();
-      tty.removeAllListeners();
-    };
-  }, [tty]);
-
-  return { tty, playerStatus, statusText, time };
-}
diff --git a/web/packages/teleport/src/Player/index.ts b/web/packages/teleport/src/Player/index.ts
deleted file mode 100644
index cb1de670a073f..0000000000000
--- a/web/packages/teleport/src/Player/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-export { Player } from './Player';
diff --git a/web/packages/teleport/src/Recordings/RecordingsList.tsx b/web/packages/teleport/src/Recordings/RecordingsList.tsx
index 2950ffb3bf977..b5358c4032101 100644
--- a/web/packages/teleport/src/Recordings/RecordingsList.tsx
+++ b/web/packages/teleport/src/Recordings/RecordingsList.tsx
@@ -109,6 +109,8 @@ const renderIconCell = (type: RecordingType) => {
     Icon = Icons.Kubernetes;
   } else if (type === 'database') {
     Icon = Icons.Database;
+  } else if (type === 'app') {
+    Icon = Icons.Application;
   }
 
   return (
diff --git a/web/packages/teleport/src/Roles/PolicyPlaceholder.tsx b/web/packages/teleport/src/Roles/PolicyPlaceholder.tsx
index c81eab159bf97..b1e4e1b05cbc3 100644
--- a/web/packages/teleport/src/Roles/PolicyPlaceholder.tsx
+++ b/web/packages/teleport/src/Roles/PolicyPlaceholder.tsx
@@ -57,13 +57,15 @@ export function PolicyPlaceholder({
   roleDiffProps?: RoleDiffProps;
 }) {
   const theme = useTheme();
+  const waitingForSync =
+    roleDiffProps?.roleDiffState === RoleDiffState.WaitingForSync;
   const loading =
     roleDiffProps?.roleDiffState === RoleDiffState.LoadingSettings ||
-    roleDiffProps?.roleDiffState === RoleDiffState.WaitingForSync;
+    waitingForSync;
 
   return (
     <Box maxWidth={promoImageWidth + 2 * 2} minWidth={300}>
-      {roleDiffProps?.roleDiffErrorMessage && (
+      {roleDiffProps?.roleDiffErrorMessage && !waitingForSync && (
         <Alert>{roleDiffProps.roleDiffErrorMessage}</Alert>
       )}
       <H1 mb={2}>{FeatureName.IdentitySecurity} saves you from mistakes.</H1>
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.story.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.story.tsx
index 34ee4a3ca2dc7..6dd989bb81df1 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.story.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { StoryObj } from '@storybook/react';
+import { StoryObj } from '@storybook/react-vite';
 import { delay, http, HttpResponse } from 'msw';
 import { useEffect, useState } from 'react';
 
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.test.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.test.tsx
index 137681eac07f2..61cba46b720ac 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.test.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.test.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { fireEvent, within } from '@testing-library/react';
+import { fireEvent, waitFor, within } from '@testing-library/react';
 import { UserEvent } from '@testing-library/user-event';
 
 import { render, screen, userEvent } from 'design/utils/testing';
@@ -172,7 +172,8 @@ test('rendering and switching tabs for a non-standard role', async () => {
   expect(screen.getByRole('button', { name: 'Save Changes' })).toBeDisabled();
 
   await user.clear(await findTextEditor());
-  await user.type(await findTextEditor(), '{{"asdf":"qwer"}');
+  await user.click(await findTextEditor());
+  await user.paste('{"asdf":"qwer"}');
   await user.click(screen.getByRole('button', { name: 'Save Changes' }));
 
   expect(onSave).toHaveBeenCalledWith({
@@ -195,7 +196,8 @@ it('calls onRoleUpdate on each modification in the standard editor', async () =>
   expect(onRoleUpdate).toHaveBeenLastCalledWith(
     withDefaults({ metadata: { name: 'new_role_name' } })
   );
-  await user.type(screen.getByLabelText('Description'), 'some-description');
+  await user.click(screen.getByLabelText('Description'));
+  await user.paste('some-description');
   expect(onRoleUpdate).toHaveBeenLastCalledWith(
     withDefaults({
       metadata: { name: 'new_role_name', description: 'some-description' },
@@ -203,6 +205,27 @@ it('calls onRoleUpdate on each modification in the standard editor', async () =>
   );
 });
 
+it('calls onRoleUpdate after the first rendering of a non-standard role', async () => {
+  cfg.isPolicyEnabled = true;
+  const onRoleUpdate = jest.fn();
+  const nonStandardRole = withDefaults({
+    unsupportedField: true,
+  } as any as Role);
+  render(
+    <TestRoleEditor
+      demoMode
+      onRoleUpdate={onRoleUpdate}
+      originalRole={newRoleWithYaml(nonStandardRole)}
+    />
+  );
+  await waitFor(() => {
+    expect(onRoleUpdate).toHaveBeenCalledTimes(1);
+  });
+  expect(onRoleUpdate).toHaveBeenLastCalledWith(
+    withDefaults({ unsupportedField: true } as any as Role)
+  );
+});
+
 test('switching tabs triggers validation', async () => {
   // Triggering validation is necessary, because server-side yamlification
   // sometimes will reject the data anyway.
@@ -245,18 +268,15 @@ test('no double conversions when clicking already active tabs', async () => {
   render(<TestRoleEditor />);
   await user.click(getYamlEditorTab());
   await user.click(getStandardEditorTab());
-  await user.type(screen.getByLabelText('Role Name *'), '_2');
+  await user.click(screen.getByLabelText('Role Name *'));
+  await user.paste('_2');
   await user.click(getStandardEditorTab());
   expect(screen.getByLabelText('Role Name *')).toHaveValue('new_role_name_2');
 
   await user.click(getYamlEditorTab());
   await user.clear(await findTextEditor());
-  await user.type(
-    await findTextEditor(),
-    // Note: this is actually correct JSON syntax; the testing library uses
-    // braces for special keys, so we need to use double opening braces.
-    '{{"kind":"role", metadata:{{"name":"new_role_name_3"}}'
-  );
+  await user.click(await findTextEditor());
+  await user.paste('{"kind":"role", metadata:{"name":"new_role_name_3"}}');
   await user.click(getYamlEditorTab());
   expect(await getTextEditorContents()).toBe(
     '{"kind":"role", metadata:{"name":"new_role_name_3"}}'
@@ -321,7 +341,8 @@ describe('closing the editor', () => {
 
   test('standard editor, modified existing resource', async () => {
     const onCancel = setup({ originalRole: newRoleWithYaml(newRole()) });
-    await user.type(screen.getByLabelText('Description'), 'foo');
+    await user.click(screen.getByLabelText('Description'));
+    await user.paste('foo');
     await closeWithConfirmation(onCancel);
   });
 
@@ -349,7 +370,8 @@ describe('closing the editor', () => {
   test('YAML editor, modified existing resource', async () => {
     const onCancel = setup({ originalRole: newRoleWithYaml(newRole()) });
     await user.click(getYamlEditorTab());
-    await user.type(await findTextEditor(), '{{"foo":"bar"}');
+    await user.click(await findTextEditor());
+    await user.paste('{"foo":"bar"}');
     await closeWithConfirmation(onCancel);
   });
 });
@@ -359,12 +381,11 @@ test('saving a new role', async () => {
   render(<TestRoleEditor onSave={onSave} />);
 
   await user.clear(screen.getByLabelText('Role Name *'));
-  await user.type(screen.getByLabelText('Role Name *'), 'great-old-one');
+  await user.click(screen.getByLabelText('Role Name *'));
+  await user.paste('great-old-one');
   await user.clear(screen.getByLabelText('Description'));
-  await user.type(
-    screen.getByLabelText('Description'),
-    'That is not dead which can eternal lie.'
-  );
+  await user.click(screen.getByLabelText('Description'));
+  await user.paste('That is not dead which can eternal lie.');
   await forwardToTab('Resources');
   await forwardToTab('Admin Rules');
   await forwardToTab('Options');
@@ -402,7 +423,8 @@ describe('saving a new role after editing as YAML', () => {
 
     await user.click(getYamlEditorTab());
     await user.clear(await findTextEditor());
-    await user.type(await findTextEditor(), '{{"foo":"bar"}');
+    await user.click(await findTextEditor());
+    await user.paste('{"foo":"bar"}');
     await user.click(screen.getByRole('button', { name: 'Create Role' }));
 
     expect(onSave).toHaveBeenCalledWith({
@@ -432,10 +454,8 @@ describe('saving a new role after editing as YAML', () => {
     await user.clear(await findTextEditor());
 
     onRoleUpdate.mockReset();
-    await user.type(
-      await findTextEditor(),
-      '{{"metadata":{{"description":"foo"}}'
-    );
+    await user.click(await findTextEditor());
+    await user.paste('{"metadata":{"description":"foo"}}');
     expect(onRoleUpdate).not.toHaveBeenCalled();
     await user.click(screen.getByRole('button', { name: 'Preview' }));
     expect(onRoleUpdate).toHaveBeenCalledTimes(1);
@@ -520,7 +540,8 @@ test('YAML editor is usable even if the standard one throws', async () => {
     })
   );
   await user.clear(await findTextEditor());
-  await user.type(await findTextEditor(), '{{"modified":1}');
+  await user.click(await findTextEditor());
+  await user.paste('{"modified":1}');
   await user.click(screen.getByRole('button', { name: 'Create Role' }));
 
   expect(onSave).toHaveBeenCalledWith({
@@ -559,7 +580,8 @@ it('YAML editor usable even if the initial conversion throws', async () => {
 
   expect(fromFauxYaml(await getTextEditorContents())).toEqual(originalRole);
   await user.clear(await findTextEditor());
-  await user.type(await findTextEditor(), '{{"modified":1}');
+  await user.click(await findTextEditor());
+  await user.paste('{"modified":1}');
   await user.click(screen.getByRole('button', { name: 'Save Changes' }));
 
   expect(onSave).toHaveBeenCalledWith({
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.tsx
index ba0c3433a9eb3..0f53efc5743d5 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditor.tsx
@@ -103,7 +103,12 @@ export const RoleEditor = ({
 
   useEffect(() => {
     const { roleModel, validationResult } = standardModel;
-    if (roleTesterEnabled && roleModel && validationResult?.isValid) {
+    if (
+      roleTesterEnabled &&
+      roleModel &&
+      !roleModel.requiresReset &&
+      validationResult?.isValid
+    ) {
       onRoleUpdate?.(roleEditorModelToRole(roleModel));
     }
   }, [standardModel, onRoleUpdate, roleTesterEnabled, demoMode]);
@@ -161,6 +166,16 @@ export const RoleEditor = ({
     }, [onRoleUpdate, yamlModel])
   );
 
+  useEffect(() => {
+    const { roleModel } = standardModel;
+    if (
+      roleTesterEnabled &&
+      (roleModel === undefined || roleModel.requiresReset)
+    ) {
+      handleYamlPreview();
+    }
+  }, []);
+
   // Converts standard editor model to a YAML representation.
   const [yamlifyAttempt, yamlifyRole] = useAsync(
     async () =>
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorAdapter.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorAdapter.tsx
index ad92862135f1a..d024d210b5f5b 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorAdapter.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorAdapter.tsx
@@ -47,10 +47,12 @@ export function RoleEditorAdapter({
   onSave,
   onCancel,
   roleDiffProps,
+  forceProcessingStatus = false,
 }: {
   resources: ResourcesState;
   onSave: (role: Partial<RoleWithYaml>) => Promise<void>;
   onCancel: () => void;
+  forceProcessingStatus?: boolean;
 } & RolesProps) {
   const showRoleDiff = roleDiffProps && shouldShowRoleDiff(roleDiffProps);
   const theme = useTheme();
@@ -94,7 +96,7 @@ export function RoleEditorAdapter({
         minWidth="494px"
         maxWidth="672px"
       >
-        {convertAttempt.status === 'processing' && (
+        {(convertAttempt.status === 'processing' || forceProcessingStatus) && (
           <Flex
             flexDirection="column"
             alignItems="center"
@@ -108,7 +110,7 @@ export function RoleEditorAdapter({
           <Danger>{convertAttempt.statusText}</Danger>
         )}
 
-        {convertAttempt.status === 'success' && (
+        {convertAttempt.status === 'success' && !forceProcessingStatus && (
           <RoleEditor
             originalRole={convertAttempt.data}
             roleDiffAttempt={roleDiffProps?.roleDiffAttempt}
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorDialog.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorDialog.tsx
index 7e357b7586a79..8b797d09cb0d0 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorDialog.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorDialog.tsx
@@ -42,11 +42,21 @@ export function RoleEditorDialog({
   resources,
   onSave,
   roleDiffProps,
+  forceProcessingStatus = false,
 }: {
   open: boolean;
   onClose(): void;
   resources: ResourcesState;
   onSave(role: Partial<RoleWithYaml>): Promise<void>;
+  /**
+   * Forces this dialog to remain in the processing state while
+   * whatever required processing outside of this dialog finishes.
+   *
+   * eg: Clicking on a role label triggers rendering this dialog
+   * and fetching the role resource at the same time. The fetching
+   * can still be in progress.
+   */
+  forceProcessingStatus?: boolean;
 } & RolesProps) {
   const transitionRef = useRef<HTMLDivElement>(null);
   return (
@@ -63,6 +73,7 @@ export function RoleEditorDialog({
         resources={resources}
         onSave={onSave}
         roleDiffProps={roleDiffProps}
+        forceProcessingStatus={forceProcessingStatus}
       />
     </CSSTransition>
   );
@@ -74,26 +85,39 @@ const DialogInternal = forwardRef<
     onClose(): void;
     resources: ResourcesState;
     onSave(role: Partial<RoleWithYaml>): Promise<void>;
+    forceProcessingStatus?: boolean;
   } & RolesProps
->(({ onClose, resources, onSave, roleDiffProps }, ref) => {
-  return (
-    <Dialog
-      modalCss={() => modalCss}
-      disableEscapeKeyDown={false}
-      open={true}
-      modalRef={ref}
-      BackdropProps={{ className: 'backdrop' }}
-      className="dialog"
-    >
-      <RoleEditorAdapter
-        resources={resources}
-        onSave={onSave}
-        onCancel={onClose}
-        roleDiffProps={roleDiffProps}
-      />
-    </Dialog>
-  );
-});
+>(
+  (
+    {
+      onClose,
+      resources,
+      onSave,
+      roleDiffProps,
+      forceProcessingStatus = false,
+    },
+    ref
+  ) => {
+    return (
+      <Dialog
+        modalCss={() => modalCss}
+        disableEscapeKeyDown={false}
+        open={true}
+        modalRef={ref}
+        BackdropProps={{ className: 'backdrop' }}
+        className="dialog"
+      >
+        <RoleEditorAdapter
+          resources={resources}
+          onSave={onSave}
+          onCancel={onClose}
+          roleDiffProps={roleDiffProps}
+          forceProcessingStatus={forceProcessingStatus}
+        />
+      </Dialog>
+    );
+  }
+);
 
 const modalCss = css`
   & .dialog {
diff --git a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorVisualizer.tsx b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorVisualizer.tsx
index 11733323a8ee6..59f71f64d8902 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/RoleEditorVisualizer.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/RoleEditorVisualizer.tsx
@@ -93,7 +93,7 @@ export function RoleEditorVisualizer({
   }
 
   return (
-    <Flex flex="1" alignItems="center" justifyContent="center" m={3}>
+    <Flex flex="1" justifyContent="center" margin="auto">
       <PolicyPlaceholder
         canUpdateAccessGraphSettings={canUpdateAccessGraphSettings}
         roleDiffProps={roleDiffProps}
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
index 8146e26fbaaea..d6cbf9062ccf2 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
@@ -47,7 +47,7 @@ export const Options = memo(function Options({
   value,
   isProcessing,
   onChange,
-}: SectionProps<OptionsModel, never>) {
+}: SectionProps<OptionsModel, never, never>) {
   const theme = useTheme();
   const id = useId();
   const maxSessionTTLId = `${id}-max-session-ttl`;
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.story.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.story.tsx
new file mode 100644
index 0000000000000..6f3529fb6ab3f
--- /dev/null
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.story.tsx
@@ -0,0 +1,152 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta } from '@storybook/react-vite';
+
+import Box from 'design/Box';
+
+import {
+  AppAccessSection,
+  DatabaseAccessSection,
+  GitHubOrganizationAccessSection,
+  KubernetesAccessSection,
+  ServerAccessSection,
+  WindowsDesktopAccessSection,
+} from './Resources';
+import {
+  defaultRoleVersion,
+  newResourceAccess,
+  ResourceAccessKind,
+} from './standardmodel';
+import { StatefulSection } from './StatefulSection';
+import {
+  ResourceAccessValidationResult,
+  validateResourceAccess,
+} from './validation';
+
+type StoryProps = {
+  resourceKind: ResourceAccessKind;
+  readOnly: boolean;
+};
+
+const meta: Meta<StoryProps> = {
+  title: 'Teleport/Roles',
+  argTypes: {
+    resourceKind: {
+      control: { type: 'select' },
+      options: [
+        'node',
+        'kube_cluster',
+        'app',
+        'db',
+        'windows_desktop',
+        'git_server',
+      ],
+    },
+    readOnly: {
+      control: { type: 'boolean' },
+    },
+  },
+  // default
+  args: {
+    readOnly: false,
+    resourceKind: 'node',
+  },
+};
+export default meta;
+
+export function ResourceSection(props: StoryProps) {
+  const { component, defaultValue } = getResourceSectionStates(
+    props.resourceKind
+  );
+
+  return (
+    <Box
+      p={3}
+      width="550px"
+      borderRadius={3}
+      border="1px solid"
+      borderColor="text.disabled"
+    >
+      <StatefulSection<any, ResourceAccessValidationResult, any>
+        component={component}
+        defaultValue={defaultValue}
+        onChange={() => null}
+        validatorRef={() => null}
+        validate={validateResourceAccess}
+        readOnly={props.readOnly}
+        key={crypto.randomUUID()}
+      />
+    </Box>
+  );
+}
+
+function getResourceSectionStates(kind: ResourceAccessKind) {
+  switch (kind) {
+    case 'app':
+      return {
+        component: AppAccessSection,
+        defaultValue: newResourceAccess('app', defaultRoleVersion),
+      };
+
+    case 'db':
+      return {
+        component: DatabaseAccessSection,
+        defaultValue: newResourceAccess('db', defaultRoleVersion),
+      };
+
+    case 'git_server':
+      return {
+        component: GitHubOrganizationAccessSection,
+        defaultValue: newResourceAccess('git_server', defaultRoleVersion),
+      };
+
+    case 'kube_cluster':
+      return {
+        component: KubernetesAccessSection,
+        defaultValue: {
+          ...newResourceAccess('kube_cluster', defaultRoleVersion),
+          resources: [
+            {
+              id: '12',
+              kind: [{ value: 'hello', label: 'hello' }],
+              name: 'kube',
+              namespace: 'namespace',
+              verbs: [{ value: 'read', label: 'read' }],
+              roleVersion: defaultRoleVersion,
+            },
+          ],
+        },
+      };
+
+    case 'node':
+      return {
+        component: ServerAccessSection,
+        defaultValue: newResourceAccess('node', defaultRoleVersion),
+      };
+
+    case 'windows_desktop':
+      return {
+        component: WindowsDesktopAccessSection,
+        defaultValue: newResourceAccess('windows_desktop', defaultRoleVersion),
+      };
+
+    default:
+      kind satisfies never;
+  }
+}
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.test.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.test.tsx
index 9c4dfdc5c927a..a6ce7a589069e 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.test.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.test.tsx
@@ -34,13 +34,19 @@ import {
 } from './Resources';
 import {
   AppAccess,
+  AppAccessInputFields,
   DatabaseAccess,
+  DatabaseAccessInputFields,
   defaultRoleVersion,
   GitHubOrganizationAccess,
+  GitHubOrganizationAccessInputFields,
   KubernetesAccess,
+  KubernetesAccessInputFields,
   newResourceAccess,
   ServerAccess,
+  ServerAccessInputFields,
   WindowsDesktopAccess,
+  WindowsDesktopAccessInputFields,
 } from './standardmodel';
 import { StatefulSection } from './StatefulSection';
 import {
@@ -49,11 +55,15 @@ import {
 } from './validation';
 
 describe('ServerAccessSection', () => {
-  const setup = () => {
+  const setup = (visibleInputFields?: ServerAccessInputFields) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<ServerAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        ServerAccess,
+        ResourceAccessValidationResult,
+        ServerAccessInputFields
+      >
         component={ServerAccessSection}
         defaultValue={newResourceAccess('node', defaultRoleVersion)}
         onChange={onChange}
@@ -61,6 +71,7 @@ describe('ServerAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -106,14 +117,37 @@ describe('ServerAccessSection', () => {
       screen.getByText('Wildcard is not allowed in logins')
     ).toBeInTheDocument();
   });
+
+  test('hide all input fields', async () => {
+    setup({ labels: false, logins: false });
+    expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
+    expect(
+      screen.queryByPlaceholderText('label value')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/logins/i)).not.toBeInTheDocument();
+  });
+
+  test('hide one input field', async () => {
+    setup({ labels: true, logins: false });
+    expect(screen.getByPlaceholderText('label key')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('label value')).toBeInTheDocument();
+    expect(screen.queryByLabelText(/logins/i)).not.toBeInTheDocument();
+  });
 });
 
 describe('KubernetesAccessSection', () => {
-  const setup = (roleVersion: RoleVersion = defaultRoleVersion) => {
+  const setup = (
+    roleVersion: RoleVersion = defaultRoleVersion,
+    visibleInputFields?: KubernetesAccessInputFields
+  ) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<KubernetesAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        KubernetesAccess,
+        ResourceAccessValidationResult,
+        KubernetesAccessInputFields
+      >
         component={KubernetesAccessSection}
         defaultValue={{
           ...newResourceAccess('kube_cluster', defaultRoleVersion),
@@ -124,6 +158,7 @@ describe('KubernetesAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -289,14 +324,55 @@ describe('KubernetesAccessSection', () => {
       screen.getByText('Mixing "All verbs" with other options is not allowed')
     ).toBeVisible();
   });
+
+  test('hide all input fields', async () => {
+    setup(defaultRoleVersion, {
+      labels: false,
+      resources: false,
+      users: false,
+      groups: false,
+    });
+    expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
+    expect(
+      screen.queryByPlaceholderText('label value')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/groups/i)).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/users/i)).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Add a Kubernetes Resource' })
+    ).not.toBeInTheDocument();
+  });
+
+  test('hide a few input fields', async () => {
+    setup(defaultRoleVersion, {
+      labels: true,
+      resources: true,
+      users: false,
+      groups: false,
+    });
+    expect(screen.getByPlaceholderText('label key')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('label value')).toBeInTheDocument();
+    expect(screen.queryByLabelText(/groups/i)).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/users/i)).not.toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Add a Kubernetes Resource' })
+    ).toBeInTheDocument();
+  });
 });
 
 describe('AppAccessSection', () => {
-  const setup = (model: Partial<AppAccess> = {}) => {
+  const setup = (
+    model: Partial<AppAccess> = {},
+    visibleInputFields?: AppAccessInputFields
+  ) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<AppAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        AppAccess,
+        ResourceAccessValidationResult,
+        AppAccessInputFields
+      >
         component={AppAccessSection}
         defaultValue={{
           ...newResourceAccess('app', defaultRoleVersion),
@@ -307,6 +383,7 @@ describe('AppAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -324,6 +401,8 @@ describe('AppAccessSection', () => {
     screen.getByRole('group', { name: 'GCP Service Accounts' });
   const gcpServiceAccountTextBoxes = () =>
     within(gcpServiceAccounts()).getAllByRole('textbox');
+  const mcpTools = () => screen.getByRole('group', { name: 'MCP Tools' });
+  const mcpToolsTextBoxes = () => within(mcpTools()).getAllByRole('textbox');
 
   test('editing', async () => {
     const { user, onChange } = setup();
@@ -350,6 +429,11 @@ describe('AppAccessSection', () => {
     );
     await user.click(gcpServiceAccountTextBoxes()[1]);
     await user.paste('admin@some-project.iam.gserviceaccount.com');
+    await user.click(
+      within(mcpTools()).getByRole('button', { name: 'Add More' })
+    );
+    await user.click(mcpToolsTextBoxes()[1]);
+    await user.paste('allow_tools_with_prefix_*');
 
     expect(onChange).toHaveBeenLastCalledWith({
       kind: 'app',
@@ -366,6 +450,7 @@ describe('AppAccessSection', () => {
         '{{internal.gcp_service_accounts}}',
         'admin@some-project.iam.gserviceaccount.com',
       ],
+      mcpTools: ['{{internal.mcp_tools}}', 'allow_tools_with_prefix_*'],
       hideValidationErrors: true,
     } as AppAccess);
   });
@@ -399,14 +484,61 @@ describe('AppAccessSection', () => {
       'Wildcard is not allowed in GCP service accounts'
     );
   });
+
+  test('hide all input fields', async () => {
+    setup(
+      {},
+      {
+        labels: false,
+        awsRoleARNs: false,
+        azureIdentities: false,
+        gcpServiceAccounts: false,
+        mcpTools: false,
+      }
+    );
+    expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
+    expect(screen.queryByText(/aws role arns/i)).not.toBeInTheDocument();
+    expect(screen.queryByText(/azure identities/i)).not.toBeInTheDocument();
+    expect(screen.queryByText(/gcp service accounts/i)).not.toBeInTheDocument();
+    expect(screen.queryByText(/mcp tools/i)).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Add More' })
+    ).not.toBeInTheDocument();
+  });
+
+  test('hide a few input fields', async () => {
+    setup(
+      {},
+      {
+        labels: true,
+        awsRoleARNs: false,
+        azureIdentities: false,
+        gcpServiceAccounts: true,
+        mcpTools: true,
+      }
+    );
+    expect(screen.getByPlaceholderText('label key')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('label value')).toBeInTheDocument();
+    expect(screen.queryByText(/aws role arns/i)).not.toBeInTheDocument();
+    expect(screen.queryByText(/azure identities/i)).not.toBeInTheDocument();
+    expect(screen.getByText(/gcp service accounts/i)).toBeInTheDocument();
+    expect(screen.getByText(/mcp tools/i)).toBeInTheDocument();
+    expect(screen.queryAllByRole('button', { name: 'Add More' })).toHaveLength(
+      2
+    );
+  });
 });
 
 describe('DatabaseAccessSection', () => {
-  const setup = () => {
+  const setup = (visibleInputFields?: DatabaseAccessInputFields) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<DatabaseAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        DatabaseAccess,
+        ResourceAccessValidationResult,
+        DatabaseAccessInputFields
+      >
         component={DatabaseAccessSection}
         defaultValue={newResourceAccess('db', defaultRoleVersion)}
         onChange={onChange}
@@ -414,6 +546,7 @@ describe('DatabaseAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -487,14 +620,53 @@ describe('DatabaseAccessSection', () => {
       screen.getByText('Wildcard is not allowed in database roles')
     ).toBeInTheDocument();
   });
+
+  test('hide all input fields', async () => {
+    setup({
+      labels: false,
+      names: false,
+      users: false,
+      roles: false,
+      dbServiceLabels: false,
+    });
+    expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
+    expect(
+      screen.queryByPlaceholderText('label value')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/Database Names/i)).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/Database Users/i)).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/Database Roles/i)).not.toBeInTheDocument();
+  });
+
+  test('hide a few input fields', async () => {
+    setup({
+      labels: true,
+      names: false,
+      users: true,
+      roles: false,
+      dbServiceLabels: false,
+    });
+    expect(screen.getByPlaceholderText('label key')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('label value')).toBeInTheDocument();
+    expect(
+      screen.queryByLabelText('Database Service Labels')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/database names/i)).not.toBeInTheDocument();
+    expect(screen.getByLabelText(/database users/i)).toBeInTheDocument();
+    expect(screen.queryByLabelText(/database roles/i)).not.toBeInTheDocument();
+  });
 });
 
 describe('WindowsDesktopAccessSection', () => {
-  const setup = () => {
+  const setup = (visibleInputFields?: WindowsDesktopAccessInputFields) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<WindowsDesktopAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        WindowsDesktopAccess,
+        ResourceAccessValidationResult,
+        WindowsDesktopAccessInputFields
+      >
         component={WindowsDesktopAccessSection}
         defaultValue={newResourceAccess('windows_desktop', defaultRoleVersion)}
         onChange={onChange}
@@ -502,6 +674,7 @@ describe('WindowsDesktopAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -533,14 +706,34 @@ describe('WindowsDesktopAccessSection', () => {
       screen.getByPlaceholderText('label key')
     ).toHaveAccessibleDescription('required');
   });
+
+  test('hide all input fields', async () => {
+    setup({ labels: false, logins: false });
+    expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
+    expect(
+      screen.queryByPlaceholderText('label value')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByLabelText(/logins/i)).not.toBeInTheDocument();
+  });
+
+  test('hide one input field', async () => {
+    setup({ labels: true, logins: false });
+    expect(screen.getByPlaceholderText('label key')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('label value')).toBeInTheDocument();
+    expect(screen.queryByLabelText(/logins/i)).not.toBeInTheDocument();
+  });
 });
 
 describe('GitHubOrganizationAccessSection', () => {
-  const setup = () => {
+  const setup = (visibleInputFields?: GitHubOrganizationAccessInputFields) => {
     const onChange = jest.fn();
     let validator: Validator;
     render(
-      <StatefulSection<GitHubOrganizationAccess, ResourceAccessValidationResult>
+      <StatefulSection<
+        GitHubOrganizationAccess,
+        ResourceAccessValidationResult,
+        GitHubOrganizationAccessInputFields
+      >
         component={GitHubOrganizationAccessSection}
         defaultValue={newResourceAccess('git_server', defaultRoleVersion)}
         onChange={onChange}
@@ -548,6 +741,7 @@ describe('GitHubOrganizationAccessSection', () => {
           validator = v;
         }}
         validate={validateResourceAccess}
+        visibleInputFields={visibleInputFields}
       />
     );
     return { user: userEvent.setup(), onChange, validator };
@@ -571,6 +765,13 @@ describe('GitHubOrganizationAccessSection', () => {
       hideValidationErrors: true,
     } as GitHubOrganizationAccess);
   });
+
+  test('hide all input fields', async () => {
+    setup({ organizations: false });
+    expect(
+      screen.queryByLabelText(/organization names/i)
+    ).not.toBeInTheDocument();
+  });
 });
 
 const reactSelectValueContainer = (input: HTMLInputElement) =>
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.tsx
index 2b8049c4e73c5..61c24995e08da 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Resources.tsx
@@ -32,6 +32,7 @@ import {
   FieldSelect,
   FieldSelectCreatable,
 } from 'shared/components/FieldSelect';
+import { defaultRule } from 'shared/components/FieldSelect/shared';
 import { MenuButton, MenuItem } from 'shared/components/MenuAction';
 import { useRule } from 'shared/components/Validation';
 import { precomputed } from 'shared/components/Validation/rules';
@@ -48,9 +49,13 @@ import {
 } from './sections';
 import {
   AppAccess,
+  AppAccessInputFields,
   DatabaseAccess,
+  DatabaseAccessInputFields,
   GitHubOrganizationAccess,
+  GitHubOrganizationAccessInputFields,
   KubernetesAccess,
+  KubernetesAccessInputFields,
   kubernetesResourceKindOptionsV7,
   kubernetesResourceKindOptionsV8,
   KubernetesResourceModel,
@@ -59,8 +64,10 @@ import {
   ResourceAccess,
   ResourceAccessKind,
   ServerAccess,
+  ServerAccessInputFields,
   supportsKubernetesCustomResources,
   WindowsDesktopAccess,
+  WindowsDesktopAccessInputFields,
 } from './standardmodel';
 import { ActionType } from './useStandardModel';
 import {
@@ -84,10 +91,16 @@ export const ResourcesTab = memo(function ResourcesTab({
   isProcessing,
   validation,
   dispatch,
+  customDescription,
 }: SectionPropsWithDispatch<
   ResourceAccess[],
   ResourceAccessValidationResult[]
->) {
+> & {
+  /**
+   * Custom description describing this section.
+   */
+  customDescription?: React.ReactNode;
+}) {
   /** All resource access kinds except those that are already in the role. */
   const allowedResourceAccessKinds = allResourceAccessKinds.filter(k =>
     value.every(as => as.kind !== k)
@@ -98,9 +111,13 @@ export const ResourcesTab = memo(function ResourcesTab({
 
   return (
     <Flex flexDirection="column" gap={3}>
-      <SectionPadding>
-        Rules that allow connecting to resources controlled by Teleport
-      </SectionPadding>
+      {customDescription ? (
+        <>{customDescription}</>
+      ) : (
+        <SectionPadding>
+          Rules that allow connecting to resources controlled by Teleport
+        </SectionPadding>
+      )}
       {value.map((res, i) => {
         return (
           <ResourceAccessSection
@@ -165,7 +182,7 @@ export const resourceAccessSections: Record<
   ResourceAccessKind,
   {
     title: string;
-    component: React.ComponentType<SectionProps<unknown, unknown>>;
+    component: React.ComponentType<SectionProps<unknown, unknown, unknown>>;
   }
 > = {
   kube_cluster: {
@@ -245,34 +262,60 @@ export function ServerAccessSection({
   isProcessing,
   validation,
   onChange,
-}: SectionProps<ServerAccess, ServerAccessValidationResult>) {
+  readOnly = false,
+  visibleInputFields,
+}: SectionProps<
+  ServerAccess,
+  ServerAccessValidationResult,
+  ServerAccessInputFields
+>) {
+  // Flags to conditionally render input fields.
+  let show: ServerAccessInputFields = visibleInputFields ?? {
+    labels: true,
+    logins: true,
+  };
+
   return (
     <>
-      <LabelsInput
-        atLeastOneRow
-        legend="Labels"
-        disableBtns={isProcessing}
-        labels={value.labels}
-        setLabels={labels => onChange?.({ ...value, labels })}
-        rule={precomputed(validation.fields.labels)}
-      />
-      <FieldSelectCreatable
-        isMulti
-        label="Logins"
-        placeholder="Type a login and press Enter"
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Login: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.logins}
-        onChange={logins => onChange?.({ ...value, logins })}
-        rule={precomputed(validation.fields.logins)}
-        mt={3}
-        mb={0}
-        menuPosition="fixed"
-      />
+      {show.labels && (
+        <LabelsInput
+          atLeastOneRow
+          legend="Labels"
+          disableBtns={isProcessing}
+          labels={value.labels}
+          setLabels={labels => onChange?.({ ...value, labels })}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.labels)}
+        />
+      )}
+      {show.logins && (
+        <FieldSelectCreatable
+          isMulti
+          label="Logins"
+          placeholder="Type a login and press Enter"
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Login: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.logins}
+          onChange={logins => onChange?.({ ...value, logins })}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.logins)}
+          mt={3}
+          mb={0}
+          menuPosition="fixed"
+          toolTipContent={
+            <>
+              System usernames that can be used to log in to servers, e.g.{' '}
+              <MarkInverse>ec2-user</MarkInverse>,{' '}
+              <MarkInverse>ubuntu</MarkInverse>,{' '}
+              <MarkInverse>centos</MarkInverse>.
+            </>
+          }
+        />
+      )}
     </>
   );
 }
@@ -282,102 +325,132 @@ export function KubernetesAccessSection({
   isProcessing,
   validation,
   onChange,
-}: SectionProps<KubernetesAccess, KubernetesAccessValidationResult>) {
+  readOnly = false,
+  visibleInputFields,
+}: SectionProps<
+  KubernetesAccess,
+  KubernetesAccessValidationResult,
+  KubernetesAccessInputFields
+>) {
+  // Flags to conditionally render input fields.
+  let show: KubernetesAccessInputFields = visibleInputFields ?? {
+    labels: true,
+    groups: true,
+    users: true,
+    resources: true,
+  };
+
   const resourcesValidationResult = useRule(
-    precomputed(validation.fields.resources)(value.resources)
+    readOnly
+      ? defaultRule()
+      : precomputed(validation.fields.resources)(value.resources)
   );
   return (
     <>
-      <FieldSelectCreatable
-        isMulti
-        label="Groups"
-        placeholder="Type a group name and press Enter"
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Group: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.groups}
-        onChange={groups => onChange?.({ ...value, groups })}
-        menuPosition="fixed"
-        rule={precomputed(validation.fields.groups)}
-      />
+      {show.groups && (
+        <FieldSelectCreatable
+          isMulti
+          label="Groups"
+          placeholder="Type a group name and press Enter"
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Group: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.groups}
+          onChange={groups => onChange?.({ ...value, groups })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.groups)}
+        />
+      )}
 
-      <FieldSelectCreatable
-        isMulti
-        label="Users"
-        placeholder="Type a user name and press Enter"
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `User: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.users}
-        onChange={users => onChange?.({ ...value, users })}
-        menuPosition="fixed"
-        rule={precomputed(validation.fields.users)}
-      />
+      {show.users && (
+        <FieldSelectCreatable
+          isMulti
+          label="Users"
+          placeholder="Type a user name and press Enter"
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `User: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.users}
+          onChange={users => onChange?.({ ...value, users })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.users)}
+        />
+      )}
 
-      <LabelsInput
-        atLeastOneRow
-        legend="Labels"
-        disableBtns={isProcessing}
-        labels={value.labels}
-        rule={precomputed(validation.fields.labels)}
-        setLabels={labels => onChange?.({ ...value, labels })}
-      />
+      {show.labels && (
+        <LabelsInput
+          atLeastOneRow
+          legend="Labels"
+          disableBtns={isProcessing}
+          labels={value.labels}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.labels)}
+          setLabels={labels => onChange?.({ ...value, labels })}
+        />
+      )}
 
-      <Flex flexDirection="column" gap={3} mt={3}>
-        {value.resources.map((resource, index) => (
-          <KubernetesResourceView
-            key={resource.id}
-            value={resource}
-            validation={validation.fields.resources.results[index]}
-            isProcessing={isProcessing}
-            onChange={newRes =>
-              onChange?.({
-                ...value,
-                resources: value.resources.map((res, i) =>
-                  i === index ? newRes : res
-                ),
-              })
-            }
-            onRemove={() =>
-              onChange?.({
-                ...value,
-                resources: value.resources.toSpliced(index, 1),
-              })
-            }
-          />
-        ))}
+      {show.resources && (
+        <Flex flexDirection="column" gap={3} mt={3}>
+          {value.resources.map((resource, index) => (
+            <KubernetesResourceView
+              readOnly={readOnly}
+              key={resource.id}
+              value={resource}
+              validation={validation.fields.resources.results[index]}
+              isProcessing={isProcessing}
+              onChange={newRes =>
+                onChange?.({
+                  ...value,
+                  resources: value.resources.map((res, i) =>
+                    i === index ? newRes : res
+                  ),
+                })
+              }
+              onRemove={() =>
+                onChange?.({
+                  ...value,
+                  resources: value.resources.toSpliced(index, 1),
+                })
+              }
+            />
+          ))}
 
-        <Box>
-          <Button
-            fill={resourcesValidationResult.valid ? 'filled' : 'border'}
-            intent={resourcesValidationResult.valid ? 'neutral' : 'danger'}
-            disabled={isProcessing}
-            gap={1}
-            onClick={() =>
-              onChange?.({
-                ...value,
-                resources: [
-                  ...value.resources,
-                  newKubernetesResourceModel(value.roleVersion),
-                ],
-              })
-            }
-            size="small"
-            inputAlignment
-          >
-            <Add disabled={isProcessing} size="small" />
-            {value.resources.length > 0
-              ? 'Add Another Kubernetes Resource'
-              : 'Add a Kubernetes Resource'}
-          </Button>
-        </Box>
-      </Flex>
+          {!readOnly && (
+            <Box>
+              <Button
+                fill={resourcesValidationResult.valid ? 'filled' : 'border'}
+                intent={resourcesValidationResult.valid ? 'neutral' : 'danger'}
+                disabled={isProcessing}
+                gap={1}
+                onClick={() =>
+                  onChange?.({
+                    ...value,
+                    resources: [
+                      ...value.resources,
+                      newKubernetesResourceModel(value.roleVersion),
+                    ],
+                  })
+                }
+                size="small"
+                $inputAlignment
+              >
+                <Add disabled={isProcessing} size="small" />
+                {value.resources.length > 0
+                  ? 'Add Another Kubernetes Resource'
+                  : 'Add a Kubernetes Resource'}
+              </Button>
+            </Box>
+          )}
+        </Flex>
+      )}
     </>
   );
 }
@@ -388,12 +461,14 @@ function KubernetesResourceKindView({
   isProcessing,
   onChange,
   roleVersion,
+  readOnly = false,
 }: {
   value: KubernetesResourceModel;
   validation: KubernetesResourceValidationResult['kind'];
   isProcessing: boolean;
   onChange?(m: KubernetesResourceModel): void;
   roleVersion: RoleVersion;
+  readOnly?: boolean;
 }) {
   if (!supportsKubernetesCustomResources(roleVersion)) {
     return (
@@ -404,7 +479,8 @@ function KubernetesResourceKindView({
           elem => roleVersion == 'v7' || elem.value == 'pod' // In v7, we have the fill list, in v6 and earlier, only pod.
         )}
         value={value.kind}
-        rule={precomputed(validation)}
+        readOnly={readOnly}
+        rule={readOnly ? undefined : precomputed(validation)}
         onChange={k => onChange?.({ ...value, kind: k })}
       />
     );
@@ -425,7 +501,8 @@ function KubernetesResourceKindView({
       value={value.kind}
       onChange={kind => onChange?.({ ...value, kind })}
       menuPosition="fixed"
-      rule={precomputed(validation)}
+      readOnly={readOnly}
+      rule={readOnly ? undefined : precomputed(validation)}
       options={kubernetesResourceKindOptionsV8}
       components={{
         DropdownIndicator: null,
@@ -440,12 +517,14 @@ function KubernetesResourceView({
   isProcessing,
   onChange,
   onRemove,
+  readOnly = false,
 }: {
   value: KubernetesResourceModel;
   validation: KubernetesResourceValidationResult;
   isProcessing: boolean;
   onChange(m: KubernetesResourceModel): void;
   onRemove(): void;
+  readOnly?: boolean;
 }) {
   const { kind, name, namespace, verbs, apiGroup } = value;
   const theme = useTheme();
@@ -461,16 +540,18 @@ function KubernetesResourceView({
         <Box flex="1">
           <H4 mb={3}>Kubernetes Resource</H4>
         </Box>
-        <ButtonIcon
-          aria-label="Remove Kubernetes resource"
-          disabled={isProcessing}
-          onClick={onRemove}
-        >
-          <Trash
-            size="small"
-            color={theme.colors.interactive.solid.danger.default}
-          />
-        </ButtonIcon>
+        {!readOnly && (
+          <ButtonIcon
+            aria-label="Remove Kubernetes resource"
+            disabled={isProcessing}
+            onClick={onRemove}
+          >
+            <Trash
+              size="small"
+              color={theme.colors.interactive.solid.danger.default}
+            />
+          </ButtonIcon>
+        )}
       </Flex>
       <KubernetesResourceKindView
         value={value}
@@ -478,11 +559,12 @@ function KubernetesResourceView({
         isProcessing={isProcessing}
         onChange={k => onChange?.({ ...value, ...k })}
         roleVersion={value.roleVersion}
+        readOnly={readOnly}
       />
       {(supportsCrds || apiGroup) && (
         <FieldInput
           label="API Group"
-          required
+          required={!readOnly}
           toolTipContent={
             <>
               Resource API Group. Special value <MarkInverse>*</MarkInverse>{' '}
@@ -491,13 +573,14 @@ function KubernetesResourceView({
           }
           disabled={isProcessing}
           value={apiGroup}
-          rule={precomputed(validation.apiGroup)}
+          readonly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.apiGroup)}
           onChange={e => onChange?.({ ...value, apiGroup: e.target.value })}
         />
       )}
       <FieldInput
         label="Name"
-        required
+        required={!readOnly}
         toolTipContent={
           <>
             Name of the resource. Special value <MarkInverse>*</MarkInverse>{' '}
@@ -506,12 +589,16 @@ function KubernetesResourceView({
         }
         disabled={isProcessing}
         value={name}
-        rule={precomputed(validation.name)}
+        readonly={readOnly}
+        rule={readOnly ? undefined : precomputed(validation.name)}
         onChange={e => onChange?.({ ...value, name: e.target.value })}
       />
       <FieldInput
         label="Namespace"
-        required={!v7kubernetesClusterWideResourceKinds.includes(kind.value)}
+        required={
+          !readOnly &&
+          !v7kubernetesClusterWideResourceKinds.includes(kind.value)
+        }
         toolTipContent={
           <>
             Namespace that contains the resource. Special value{' '}
@@ -520,7 +607,8 @@ function KubernetesResourceView({
         }
         disabled={isProcessing}
         value={namespace}
-        rule={precomputed(validation.namespace)}
+        readonly={readOnly}
+        rule={readOnly ? undefined : precomputed(validation.namespace)}
         onChange={e => onChange?.({ ...value, namespace: e.target.value })}
       />
       <FieldSelect
@@ -529,7 +617,8 @@ function KubernetesResourceView({
         isDisabled={isProcessing}
         options={kubernetesVerbOptions}
         value={verbs}
-        rule={precomputed(validation.verbs)}
+        readOnly={readOnly}
+        rule={readOnly ? undefined : precomputed(validation.verbs)}
         onChange={v => onChange?.({ ...value, verbs: v })}
         mb={0}
         menuPosition="fixed"
@@ -543,38 +632,120 @@ export function AppAccessSection({
   validation,
   isProcessing,
   onChange,
-}: SectionProps<AppAccess, AppAccessValidationResult>) {
+  readOnly = false,
+  visibleInputFields,
+}: SectionProps<AppAccess, AppAccessValidationResult, AppAccessInputFields>) {
+  // Flags to conditionally render input fields.
+  let show: AppAccessInputFields = visibleInputFields ?? {
+    labels: true,
+    awsRoleARNs: true,
+    azureIdentities: true,
+    gcpServiceAccounts: true,
+    mcpTools: true,
+  };
+
   return (
     <Flex flexDirection="column" gap={3}>
-      <LabelsInput
-        atLeastOneRow
-        legend="Labels"
-        disableBtns={isProcessing}
-        labels={value.labels}
-        setLabels={labels => onChange?.({ ...value, labels })}
-        rule={precomputed(validation.fields.labels)}
-      />
-      <FieldMultiInput
-        label="AWS Role ARNs"
-        disabled={isProcessing}
-        value={value.awsRoleARNs}
-        onChange={arns => onChange?.({ ...value, awsRoleARNs: arns })}
-        rule={precomputed(validation.fields.awsRoleARNs)}
-      />
-      <FieldMultiInput
-        label="Azure Identities"
-        disabled={isProcessing}
-        value={value.azureIdentities}
-        onChange={ids => onChange?.({ ...value, azureIdentities: ids })}
-        rule={precomputed(validation.fields.azureIdentities)}
-      />
-      <FieldMultiInput
-        label="GCP Service Accounts"
-        disabled={isProcessing}
-        value={value.gcpServiceAccounts}
-        onChange={accts => onChange?.({ ...value, gcpServiceAccounts: accts })}
-        rule={precomputed(validation.fields.gcpServiceAccounts)}
-      />
+      {show.labels && (
+        <LabelsInput
+          atLeastOneRow
+          legend="Labels"
+          disableBtns={isProcessing}
+          labels={value.labels}
+          setLabels={labels => onChange?.({ ...value, labels })}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.labels)}
+        />
+      )}
+      {show.awsRoleARNs && (
+        <FieldMultiInput
+          label="AWS Role ARNs"
+          disabled={isProcessing}
+          value={value.awsRoleARNs}
+          onChange={arns => onChange?.({ ...value, awsRoleARNs: arns })}
+          readOnly={readOnly}
+          rule={
+            readOnly ? undefined : precomputed(validation.fields.awsRoleARNs)
+          }
+          tooltipContent={
+            <>
+              List of AWS roles allowed to assume when accessing AWS console.
+              Example format:{' '}
+              <MarkInverse>
+                arn:aws:iam::&lt;AWS_ACCOUNT&gt;:role/&lt;IAM_ROLE_NAME&gt;
+              </MarkInverse>
+            </>
+          }
+        />
+      )}
+      {show.azureIdentities && (
+        <FieldMultiInput
+          label="Azure Identities"
+          disabled={isProcessing}
+          value={value.azureIdentities}
+          onChange={ids => onChange?.({ ...value, azureIdentities: ids })}
+          readOnly={readOnly}
+          rule={
+            readOnly
+              ? undefined
+              : precomputed(validation.fields.azureIdentities)
+          }
+          tooltipContent={
+            <>
+              List of Azure managed identities allowed to assume when accessing
+              Azure CLIs and APIs. Example format:
+              <MarkInverse>
+                /subscriptions/00000000-0000-0000-0000-000000000000{''}
+                /resourceGroups/RESOURCE_GROUP_NAME /providers{''}
+                /Microsoft.ManagedIdentity /userAssignedIdentities/IDENTITY_NAME
+              </MarkInverse>
+            </>
+          }
+        />
+      )}
+      {show.gcpServiceAccounts && (
+        <FieldMultiInput
+          label="GCP Service Accounts"
+          disabled={isProcessing}
+          value={value.gcpServiceAccounts}
+          onChange={accts =>
+            onChange?.({ ...value, gcpServiceAccounts: accts })
+          }
+          readOnly={readOnly}
+          rule={
+            readOnly
+              ? undefined
+              : precomputed(validation.fields.gcpServiceAccounts)
+          }
+          tooltipContent={
+            <>
+              List of Google Cloud Platform service accounts allowed to assume
+              when accessing Google Cloud APIs.
+            </>
+          }
+        />
+      )}
+      {show.mcpTools && (
+        <FieldMultiInput
+          label="MCP Tools"
+          disabled={isProcessing}
+          value={value.mcpTools}
+          onChange={mcpTools => onChange?.({ ...value, mcpTools: mcpTools })}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.mcpTools)}
+          tooltipContent={
+            <>
+              List of MCP (Modern Content Protocol) tools allowed to access.
+              Each entry can be a literal string (e.g.{' '}
+              <MarkInverse>search-files</MarkInverse>
+              ), a glob pattern (e.g. <MarkInverse>slack_*</MarkInverse>), or a
+              regular expression that must start with &apos;^&apos; and end with
+              &apos;$&apos; (e.g. <MarkInverse>^(get|list).*$</MarkInverse>).
+              Special value <MarkInverse>*</MarkInverse> allows all tools.
+            </>
+          }
+        />
+      )}
     </Flex>
   );
 }
@@ -584,87 +755,123 @@ export function DatabaseAccessSection({
   isProcessing,
   validation,
   onChange,
-}: SectionProps<DatabaseAccess, DatabaseAccessValidationResult>) {
+  readOnly = false,
+  visibleInputFields,
+}: SectionProps<
+  DatabaseAccess,
+  DatabaseAccessValidationResult,
+  DatabaseAccessInputFields
+>) {
+  // Flags to conditionally render input fields.
+  let show: DatabaseAccessInputFields = visibleInputFields ?? {
+    labels: true,
+    names: true,
+    users: true,
+    roles: true,
+    dbServiceLabels: true,
+  };
+
   return (
     <>
-      <Box mb={3}>
+      {show.labels && (
+        <Box mb={3}>
+          <LabelsInput
+            atLeastOneRow
+            legend="Labels"
+            tooltipContent="Access to databases with these labels will be affected by this role."
+            disableBtns={isProcessing}
+            labels={value.labels}
+            setLabels={labels => onChange?.({ ...value, labels })}
+            readOnly={readOnly}
+            rule={readOnly ? undefined : precomputed(validation.fields.labels)}
+          />
+        </Box>
+      )}
+      {show.names && (
+        <FieldSelectCreatable
+          isMulti
+          label="Database Names"
+          placeholder="Type a database name and press Enter"
+          toolTipContent={
+            <>
+              Database names allowed to connect to. Special value{' '}
+              <MarkInverse>*</MarkInverse> means any name.
+            </>
+          }
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Database Name: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.names}
+          onChange={names => onChange?.({ ...value, names })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.names)}
+        />
+      )}
+      {show.users && (
+        <FieldSelectCreatable
+          isMulti
+          label="Database Users"
+          placeholder="Type a user name and press Enter"
+          toolTipContent={
+            <>
+              Database account names allowed to connect as. Special value{' '}
+              <MarkInverse>*</MarkInverse> means any user.
+            </>
+          }
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Database User: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.users}
+          onChange={users => onChange?.({ ...value, users })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.users)}
+        />
+      )}
+      {show.roles && (
+        <FieldSelectCreatable
+          isMulti
+          label="Database Roles"
+          placeholder="Type a role name and press Enter"
+          toolTipContent="If automatic user provisioning is available, this is the list of database roles that will be assigned to the database user after it's created."
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Database Role: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.roles}
+          onChange={roles => onChange?.({ ...value, roles })}
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.roles)}
+          menuPosition="fixed"
+        />
+      )}
+      {show.dbServiceLabels && (
         <LabelsInput
           atLeastOneRow
-          legend="Labels"
-          tooltipContent="Access to databases with these labels will be affected by this role"
+          legend="Database Service Labels"
+          tooltipContent="The database service labels control which Database Services (Teleport Agents) are visible to the user, which is required when adding Databases in the Enroll New Resource wizard. Access to Databases themselves is controlled by the Database Labels field."
           disableBtns={isProcessing}
-          labels={value.labels}
-          setLabels={labels => onChange?.({ ...value, labels })}
-          rule={precomputed(validation.fields.labels)}
+          labels={value.dbServiceLabels}
+          setLabels={dbServiceLabels =>
+            onChange?.({ ...value, dbServiceLabels })
+          }
+          readOnly={readOnly}
+          rule={
+            readOnly
+              ? undefined
+              : precomputed(validation.fields.dbServiceLabels)
+          }
         />
-      </Box>
-      <FieldSelectCreatable
-        isMulti
-        label="Database Names"
-        placeholder="Type a database name and press Enter"
-        toolTipContent={
-          <>
-            List of database names that this role is allowed to connect to.
-            Special value <MarkInverse>*</MarkInverse> means any name.
-          </>
-        }
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Database Name: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.names}
-        onChange={names => onChange?.({ ...value, names })}
-        menuPosition="fixed"
-        rule={precomputed(validation.fields.names)}
-      />
-      <FieldSelectCreatable
-        isMulti
-        label="Database Users"
-        placeholder="Type a user name and press Enter"
-        toolTipContent={
-          <>
-            List of database users that this role is allowed to connect as.
-            Special value <MarkInverse>*</MarkInverse> means any user.
-          </>
-        }
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Database User: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.users}
-        onChange={users => onChange?.({ ...value, users })}
-        menuPosition="fixed"
-        rule={precomputed(validation.fields.users)}
-      />
-      <FieldSelectCreatable
-        isMulti
-        label="Database Roles"
-        placeholder="Type a role name and press Enter"
-        toolTipContent="If automatic user provisioning is available, this is the list of database roles that will be assigned to the database user after it's created"
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Database Role: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.roles}
-        onChange={roles => onChange?.({ ...value, roles })}
-        rule={precomputed(validation.fields.roles)}
-        menuPosition="fixed"
-      />
-      <LabelsInput
-        atLeastOneRow
-        legend="Database Service Labels"
-        tooltipContent="The database service labels control which Database Services (Teleport Agents) are visible to the user, which is required when adding Databases in the Enroll New Resource wizard. Access to Databases themselves is controlled by the Database Labels field."
-        disableBtns={isProcessing}
-        labels={value.dbServiceLabels}
-        setLabels={dbServiceLabels => onChange?.({ ...value, dbServiceLabels })}
-        rule={precomputed(validation.fields.dbServiceLabels)}
-      />
+      )}
     </>
   );
 }
@@ -674,35 +881,53 @@ export function WindowsDesktopAccessSection({
   isProcessing,
   validation,
   onChange,
-}: SectionProps<WindowsDesktopAccess, WindowsDesktopAccessValidationResult>) {
+  readOnly = false,
+  visibleInputFields,
+}: SectionProps<
+  WindowsDesktopAccess,
+  WindowsDesktopAccessValidationResult,
+  WindowsDesktopAccessInputFields
+>) {
+  // Flags to conditionally render input fields.
+  const show: WindowsDesktopAccessInputFields = visibleInputFields ?? {
+    labels: true,
+    logins: true,
+  };
+
   return (
     <>
-      <Box mb={3}>
-        <LabelsInput
-          atLeastOneRow
-          legend="Labels"
-          disableBtns={isProcessing}
-          labels={value.labels}
-          setLabels={labels => onChange?.({ ...value, labels })}
-          rule={precomputed(validation.fields.labels)}
+      {show.labels && (
+        <Box mb={3}>
+          <LabelsInput
+            atLeastOneRow
+            legend="Labels"
+            disableBtns={isProcessing}
+            labels={value.labels}
+            setLabels={labels => onChange?.({ ...value, labels })}
+            readOnly={readOnly}
+            rule={readOnly ? undefined : precomputed(validation.fields.labels)}
+          />
+        </Box>
+      )}
+      {show.logins && (
+        <FieldSelectCreatable
+          isMulti
+          label="Logins"
+          placeholder="Type a login and press Enter"
+          toolTipContent="List of Windows logins allowed to use for desktop sessions."
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Login: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.logins}
+          onChange={logins => onChange?.({ ...value, logins })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={readOnly ? undefined : precomputed(validation.fields.logins)}
         />
-      </Box>
-      <FieldSelectCreatable
-        isMulti
-        label="Logins"
-        placeholder="Type a login and press Enter"
-        toolTipContent="List of desktop logins that this role is allowed to use"
-        isDisabled={isProcessing}
-        formatCreateLabel={label => `Login: ${label}`}
-        components={{
-          DropdownIndicator: null,
-        }}
-        openMenuOnClick={false}
-        value={value.logins}
-        onChange={logins => onChange?.({ ...value, logins })}
-        menuPosition="fixed"
-        rule={precomputed(validation.fields.logins)}
-      />
+      )}
     </>
   );
 }
@@ -712,28 +937,43 @@ export function GitHubOrganizationAccessSection({
   isProcessing,
   validation,
   onChange,
+  readOnly = false,
+  visibleInputFields,
 }: SectionProps<
   GitHubOrganizationAccess,
-  GitHubOrganizationAccessValidationResult
+  GitHubOrganizationAccessValidationResult,
+  GitHubOrganizationAccessInputFields
 >) {
+  // Flags to conditionally render input fields.
+  const show: GitHubOrganizationAccessInputFields = visibleInputFields ?? {
+    organizations: true,
+  };
+
   return (
-    <FieldSelectCreatable
-      isMulti
-      label="Organization Names"
-      toolTipContent="A list of GitHub organization names that this role is allowed to use"
-      placeholder="Type an organization name and press Enter"
-      isDisabled={isProcessing}
-      formatCreateLabel={label => `Organization: ${label}`}
-      components={{
-        DropdownIndicator: null,
-      }}
-      openMenuOnClick={false}
-      value={value.organizations}
-      onChange={organizations => onChange?.({ ...value, organizations })}
-      menuPosition="fixed"
-      rule={precomputed(validation.fields.organizations)}
-      mb={0}
-    />
+    <>
+      {show.organizations && (
+        <FieldSelectCreatable
+          isMulti
+          label="Organization Names"
+          toolTipContent="A list of GitHub organization names allowed access to."
+          placeholder="Type an organization name and press Enter"
+          isDisabled={isProcessing}
+          formatCreateLabel={label => `Organization: ${label}`}
+          components={{
+            DropdownIndicator: null,
+          }}
+          openMenuOnClick={false}
+          value={value.organizations}
+          onChange={organizations => onChange?.({ ...value, organizations })}
+          menuPosition="fixed"
+          readOnly={readOnly}
+          rule={
+            readOnly ? undefined : precomputed(validation.fields.organizations)
+          }
+          mb={0}
+        />
+      )}
+    </>
   );
 }
 
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/StatefulSection.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/StatefulSection.tsx
index e4dd6f2220882..65f06fc33b382 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/StatefulSection.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/StatefulSection.tsx
@@ -26,15 +26,17 @@ import { StandardModelDispatcher, useStandardModel } from './useStandardModel';
 import { withDefaults } from './withDefaults';
 
 /** A helper for testing editor section components. */
-export function StatefulSection<Model, ValidationResult>({
+export function StatefulSection<Model, ValidationResult, InputFields>({
   defaultValue,
   component: Component,
   onChange,
   validatorRef,
   validate,
+  visibleInputFields,
+  readOnly = false,
 }: {
   defaultValue: Model;
-  component: React.ComponentType<SectionProps<Model, any>>;
+  component: React.ComponentType<SectionProps<Model, any, any>>;
   onChange(model: Model): void;
   validatorRef?(v: Validator): void;
   validate(
@@ -42,6 +44,8 @@ export function StatefulSection<Model, ValidationResult>({
     previousModel: Model,
     previousResult: ValidationResult
   ): ValidationResult;
+  visibleInputFields?: InputFields;
+  readOnly?: boolean;
 }) {
   const [{ model, validationResult }, dispatch] = useReducer(
     (
@@ -69,6 +73,8 @@ export function StatefulSection<Model, ValidationResult>({
               dispatch(newModel);
               onChange(newModel);
             }}
+            visibleInputFields={visibleInputFields}
+            readOnly={readOnly}
           />
         );
       }}
@@ -76,7 +82,7 @@ export function StatefulSection<Model, ValidationResult>({
   );
 }
 
-const minimalRole = withDefaults({
+export const minimalRole = withDefaults({
   metadata: { name: 'foobar' },
   version: defaultRoleVersion,
 });
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/sections.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/sections.tsx
index 45088e50089ff..bb21c80339a48 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/sections.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/sections.tsx
@@ -33,11 +33,22 @@ import { ValidationResult } from 'shared/components/Validation/rules';
 import { StandardModelDispatcher } from './useStandardModel';
 
 /** Properties of a section that uses plain callbacks to change the model. */
-export type SectionProps<Model, ValidationResult> = {
+export type SectionProps<Model, ValidationResult, VisibleInputFields> = {
   value: Model;
   isProcessing: boolean;
   validation?: ValidationResult;
   onChange(value: Model): void;
+  /**
+   * If true, input fields are not editable, control buttons
+   * (e.g. trash, add/delete) are hidden, and input validations
+   * are disabled.
+   */
+  readOnly?: boolean;
+  /**
+   * Defaults to showing all fields.
+   * When specified, only fields with `true` value are shown.
+   */
+  visibleInputFields?: VisibleInputFields;
 };
 
 /** Properties of a section that uses a dispatcher to change the model. */
@@ -83,6 +94,7 @@ export const SectionBox = ({
   removable,
   isProcessing = false,
   validation,
+  onExpand,
   onRemove,
   initiallyCollapsed = false,
 }: React.PropsWithChildren<{
@@ -91,6 +103,7 @@ export const SectionBox = ({
   removable?: boolean;
   isProcessing?: boolean;
   validation?: ValidationResult;
+  onExpand?(): void;
   onRemove?(): void;
   initiallyCollapsed?: boolean;
 }>) => {
@@ -129,6 +142,8 @@ export const SectionBox = ({
         ? ExpansionState.Collapsing
         : ExpansionState.Measuring
     );
+
+    onExpand?.();
   };
 
   // Triggered when the collapse animation is finished and we can finally make
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
index e0fb2bc520dc6..840c6c5d99c7a 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
@@ -23,6 +23,7 @@ import {
   GitHubPermission,
   KubernetesResource,
   Labels,
+  MCPPermissions,
   RequireMFAType,
   ResourceKind,
   Role,
@@ -51,6 +52,7 @@ import {
   kubernetesVerbOptionsMap,
   labelsModelToLabels,
   labelsToModel,
+  mcpToolsToModel,
   portForwardingOptionsToModel,
   requireMFATypeOptionsMap,
   resourceKindOptionsMap,
@@ -226,6 +228,7 @@ describe.each<{ name: string; role: Role; model: RoleEditorModel }>([
             'account1@some-project.iam.gserviceaccount.com',
             'account2@some-project.iam.gserviceaccount.com',
           ],
+          mcpTools: [],
           hideValidationErrors: false,
         },
       ],
@@ -616,6 +619,44 @@ test.each<{
   ).toEqual(expected);
 });
 
+test.each<{
+  name: string;
+  permissions: MCPPermissions;
+  expected: ReturnType<typeof mcpToolsToModel>;
+}>([
+  {
+    name: 'empty permissions',
+    permissions: {},
+    expected: { model: [], conversionErrors: [] },
+  },
+  {
+    name: 'empty tools',
+    permissions: { tools: [] },
+    expected: { model: [], conversionErrors: [] },
+  },
+  {
+    name: 'some tools',
+    permissions: { tools: ['foo1', 'foo2'] },
+    expected: {
+      model: ['foo1', 'foo2'],
+      conversionErrors: [],
+    },
+  },
+  {
+    name: 'invalid fields',
+    permissions: { tools: ['foo'], unknownField: 123 } as MCPPermissions,
+    expected: {
+      model: ['foo'],
+      conversionErrors: simpleConversionErrors(
+        ConversionErrorType.UnsupportedField,
+        ['spec.allow.mcp.unknownField']
+      ),
+    },
+  },
+])('mcpToolsToModel(): $name', ({ permissions, expected }) => {
+  expect(mcpToolsToModel(permissions, 'spec.allow.mcp')).toEqual(expected);
+});
+
 describe('roleToRoleEditorModel', () => {
   const minRole = minimalRole();
   const minRoleModel = minimalRoleModel();
@@ -1082,6 +1123,7 @@ describe('roleToRoleEditorModel', () => {
           awsRoleARNs: [],
           azureIdentities: [],
           gcpServiceAccounts: [],
+          mcpTools: [],
           hideValidationErrors: false,
         },
       ],
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
index 8910508ba23d2..6f8007f0c26d6 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
@@ -23,6 +23,7 @@ import { Label as UILabel } from 'teleport/components/LabelsInput/LabelsInput';
 import {
   KubernetesResource,
   Labels,
+  MCPPermissions,
   Role,
   RoleConditions,
 } from 'teleport/services/resources';
@@ -53,6 +54,11 @@ import {
 import { RoleEditorModelValidationResult } from './validation';
 import { defaultOptions } from './withDefaults';
 
+// Converts all field types in T to a boolean type.
+type FieldTypesToBoolean<T> = {
+  [P in keyof T]: boolean;
+};
+
 export enum StandardEditorTab {
   Overview,
   Resources,
@@ -161,13 +167,17 @@ export type ResourceAccessKind =
   | 'windows_desktop'
   | 'git_server';
 
-/** Model for the Kubernetes resource section. */
-export type KubernetesAccess = ResourceAccessBase<'kube_cluster'> & {
-  groups: readonly Option[];
+/*
+ * Models for the kubernetes resource access section.
+ */
+type KubernetesAccessFields = {
   labels: UILabel[];
+  groups: readonly Option[];
   resources: KubernetesResourceModel[];
   users: readonly Option[];
+};
 
+type KubernetesRoleVersion = {
   /**
    * Version of the role that owns this section. Required to propagate it to
    * {@link KubernetesResourceModel}. It's the responsibility of
@@ -177,6 +187,13 @@ export type KubernetesAccess = ResourceAccessBase<'kube_cluster'> & {
   roleVersion: RoleVersion;
 };
 
+export type KubernetesAccessInputFields =
+  FieldTypesToBoolean<KubernetesAccessFields>;
+
+export type KubernetesAccess = ResourceAccessBase<'kube_cluster'> &
+  KubernetesAccessFields &
+  KubernetesRoleVersion;
+
 export type KubernetesResourceModel = {
   /** Autogenerated ID to be used with the `key` property. */
   id: string;
@@ -388,20 +405,37 @@ export const verbOptions: VerbOption[] = (
 ).map(stringToOption);
 export const verbOptionsMap = optionsToMap(verbOptions);
 
-/** Model for the server resource access section. */
-export type ServerAccess = ResourceAccessBase<'node'> & {
+/*
+ * Models for the server resource access section.
+ */
+type ServerAccessFields = {
   labels: UILabel[];
   logins: readonly Option[];
 };
 
-export type AppAccess = ResourceAccessBase<'app'> & {
+export type ServerAccessInputFields = FieldTypesToBoolean<ServerAccessFields>;
+
+export type ServerAccess = ResourceAccessBase<'node'> & ServerAccessFields;
+
+/*
+ * Models for the app resource access section.
+ */
+type AppAccessFields = {
   labels: UILabel[];
   awsRoleARNs: string[];
   azureIdentities: string[];
   gcpServiceAccounts: string[];
+  mcpTools: string[];
 };
 
-export type DatabaseAccess = ResourceAccessBase<'db'> & {
+export type AppAccessInputFields = FieldTypesToBoolean<AppAccessFields>;
+
+export type AppAccess = ResourceAccessBase<'app'> & AppAccessFields;
+
+/*
+ * Models for the database resource access section.
+ */
+type DatabaseAccessFields = {
   labels: UILabel[];
   names: readonly Option[];
   users: readonly Option[];
@@ -409,15 +443,38 @@ export type DatabaseAccess = ResourceAccessBase<'db'> & {
   dbServiceLabels: UILabel[];
 };
 
-export type WindowsDesktopAccess = ResourceAccessBase<'windows_desktop'> & {
+export type DatabaseAccessInputFields =
+  FieldTypesToBoolean<DatabaseAccessFields>;
+
+export type DatabaseAccess = ResourceAccessBase<'db'> & DatabaseAccessFields;
+
+/*
+ * Models for the windows desktop resource access section.
+ */
+type WindowsDesktopAccessFields = {
   labels: UILabel[];
   logins: readonly Option[];
 };
 
-export type GitHubOrganizationAccess = ResourceAccessBase<'git_server'> & {
+export type WindowsDesktopAccessInputFields =
+  FieldTypesToBoolean<WindowsDesktopAccessFields>;
+
+export type WindowsDesktopAccess = ResourceAccessBase<'windows_desktop'> &
+  WindowsDesktopAccessFields;
+
+/*
+ * Models for the git server resource access section.
+ */
+type GitHubOrganizationAccessFields = {
   organizations: readonly Option[];
 };
 
+export type GitHubOrganizationAccessInputFields =
+  FieldTypesToBoolean<GitHubOrganizationAccessFields>;
+
+export type GitHubOrganizationAccess = ResourceAccessBase<'git_server'> &
+  GitHubOrganizationAccessFields;
+
 export type RuleModel = {
   /** Autogenerated ID to be used with the `key` property. */
   id: string;
@@ -632,6 +689,7 @@ export function newResourceAccess(
         awsRoleARNs: ['{{internal.aws_role_arns}}'],
         azureIdentities: ['{{internal.azure_identities}}'],
         gcpServiceAccounts: ['{{internal.gcp_service_accounts}}'],
+        mcpTools: ['{{internal.mcp_tools}}'],
         hideValidationErrors: true,
       };
     case 'db':
@@ -816,6 +874,9 @@ function roleConditionsToModel(
     // Admin rules
     rules,
 
+    // MCP permissions
+    mcp,
+
     ...unsupported
   } = conditions;
   conversionErrors.push(
@@ -871,12 +932,16 @@ function roleConditionsToModel(
   const awsRoleARNsModel = aws_role_arns ?? [];
   const azureIdentitiesModel = azure_identities ?? [];
   const gcpServiceAccountsModel = gcp_service_accounts ?? [];
+  const { model: mcpToolsModel, conversionErrors: mcpToolsConversionErrors } =
+    mcpToolsToModel(mcp || {}, `${pathPrefix}.mcp`);
+  conversionErrors.push(...mcpToolsConversionErrors);
   if (
     someNonEmpty(
       appLabelsModel,
       awsRoleARNsModel,
       azureIdentitiesModel,
-      gcpServiceAccountsModel
+      gcpServiceAccountsModel,
+      mcpToolsModel
     )
   ) {
     resources.push({
@@ -885,6 +950,7 @@ function roleConditionsToModel(
       awsRoleARNs: awsRoleARNsModel,
       azureIdentities: azureIdentitiesModel,
       gcpServiceAccounts: gcpServiceAccountsModel,
+      mcpTools: mcpToolsModel,
       hideValidationErrors: false,
     });
   }
@@ -1076,6 +1142,20 @@ function kubernetesResourceToModel(
   };
 }
 
+export function mcpToolsToModel(
+  mcpPermissions: MCPPermissions,
+  pathPrefix: string
+): {
+  model: string[];
+  conversionErrors: ConversionError[];
+} {
+  const { tools, ...unsupported } = mcpPermissions;
+  return {
+    model: tools || [],
+    conversionErrors: unsupportedFieldErrorsFromObject(pathPrefix, unsupported),
+  };
+}
+
 /**
  * Converts a {@link GitHubPermission} array to a list of organizations.
  * Technically, there can be more than one `GitHubPermission` object, but we
@@ -1526,6 +1606,12 @@ export function roleEditorModelToRole(roleModel: RoleEditorModel): Role {
         role.spec.allow.aws_role_arns = res.awsRoleARNs;
         role.spec.allow.azure_identities = res.azureIdentities;
         role.spec.allow.gcp_service_accounts = res.gcpServiceAccounts;
+        if (res.mcpTools.length > 0) {
+          if (role.spec.allow.mcp === undefined) {
+            role.spec.allow.mcp = {};
+          }
+          role.spec.allow.mcp.tools = res.mcpTools;
+        }
         break;
 
       case 'db':
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/useStandardModel.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/useStandardModel.ts
index 87b80cdaac123..eeaab1eec6d84 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/useStandardModel.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/useStandardModel.ts
@@ -47,6 +47,8 @@ const logger = new Logger('useStandardModel');
 // Enable support for the Set type in Immer. We use it for `disabledTabs`.
 enableMapSet();
 
+export type RoleStandardModel = [StandardEditorModel, StandardModelDispatcher];
+
 /**
  * Creates a standard model state and returns an array composed of the state
  * and an action dispatcher that can be used to change it. Since the conversion
@@ -54,9 +56,7 @@ enableMapSet();
  * here: if an error is thrown, the {@link StandardEditorModel.roleModel} and
  * {@link StandardEditorModel.validationResult} will be set to `undefined`.
  */
-export const useStandardModel = (
-  originalRole?: Role
-): [StandardEditorModel, StandardModelDispatcher] =>
+export const useStandardModel = (originalRole?: Role): RoleStandardModel =>
   useImmerReducer(reduce, originalRole, initializeState);
 
 const initializeState = (originalRole?: Role): StandardEditorModel => {
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.test.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.test.ts
index 0a759e588e1c9..43ddc6cb85010 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.test.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.test.ts
@@ -93,6 +93,7 @@ describe('validateRoleEditorModel', () => {
         awsRoleARNs: ['some-arn'],
         azureIdentities: ['some-azure-id'],
         gcpServiceAccounts: ['some-gcp-acct'],
+        mcpTools: ['some-mcp-tools'],
         hideValidationErrors: false,
       },
       {
@@ -205,6 +206,7 @@ describe('validateRoleEditorModel', () => {
         awsRoleARNs: [],
         azureIdentities: [],
         gcpServiceAccounts: [],
+        mcpTools: [],
         hideValidationErrors: false,
       },
       {
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.ts
index 1e4c20f718a52..e93fb1085755e 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/validation.ts
@@ -466,15 +466,17 @@ const validateAppAccess = (a: AppAccess): AppAccessValidationResult => {
     a.labels.length === 0 &&
     a.awsRoleARNs.length === 0 &&
     a.azureIdentities.length === 0 &&
-    a.gcpServiceAccounts.length === 0
+    a.gcpServiceAccounts.length === 0 &&
+    a.mcpTools.length === 0
   ) {
     result.valid = false;
     result.message =
-      'At least one label, AWS role ARN, Azure identity, or GCP service account required';
+      'At least one label, AWS role ARN, Azure identity, GCP service account, or MCP tools required';
     result.fields.labels.valid = false;
     result.fields.awsRoleARNs.valid = false;
     result.fields.azureIdentities.valid = false;
     result.fields.gcpServiceAccounts.valid = false;
+    result.fields.mcpTools.valid = false;
   }
   return result;
 };
@@ -488,6 +490,7 @@ const appAccessValidationRules = {
   gcpServiceAccounts: arrayOf(
     noWildcard('Wildcard is not allowed in GCP service accounts')
   ),
+  mcpTools: alwaysValid,
 };
 export type AppAccessValidationResult = RuleSetValidationResult<
   typeof appAccessValidationRules
diff --git a/web/packages/teleport/src/Roles/Roles.test.tsx b/web/packages/teleport/src/Roles/Roles.test.tsx
index ad5d1cb4fcf89..34dea15702af6 100644
--- a/web/packages/teleport/src/Roles/Roles.test.tsx
+++ b/web/packages/teleport/src/Roles/Roles.test.tsx
@@ -20,6 +20,7 @@ import { MemoryRouter } from 'react-router';
 
 import { fireEvent, render, screen, waitFor } from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+import { ToastNotificationProvider } from 'shared/components/ToastNotification';
 
 import { ContextProvider } from 'teleport';
 import { createTeleportContext } from 'teleport/mocks/contexts';
@@ -67,11 +68,13 @@ describe('Roles list', () => {
     const ctx = createTeleportContext();
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...defaultState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...defaultState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -92,11 +95,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...testState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...testState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -110,11 +115,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...defaultState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...defaultState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -141,11 +148,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...testState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...testState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -178,11 +187,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...testState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...testState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -215,11 +226,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...testState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...testState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -246,11 +259,13 @@ describe('Roles list', () => {
 
     render(
       <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Roles {...testState} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
+        <ToastNotificationProvider>
+          <InfoGuidePanelProvider>
+            <ContextProvider ctx={ctx}>
+              <Roles {...testState} />
+            </ContextProvider>
+          </InfoGuidePanelProvider>
+        </ToastNotificationProvider>
       </MemoryRouter>
     );
 
@@ -296,24 +311,26 @@ test('renders the role diff component', async () => {
 
   render(
     <MemoryRouter>
-      <InfoGuidePanelProvider>
-        <ContextProvider ctx={ctx}>
-          <Roles
-            {...defaultState()}
-            roleDiffProps={{
-              roleDiffElement,
-              roleDiffState: RoleDiffState.PolicyEnabled,
-              updateRoleDiff: () => null,
-              roleDiffAttempt: {
-                status: 'error',
-                statusText: 'there is an error here',
-                data: null,
-                error: null,
-              },
-            }}
-          />
-        </ContextProvider>
-      </InfoGuidePanelProvider>
+      <ToastNotificationProvider>
+        <InfoGuidePanelProvider>
+          <ContextProvider ctx={ctx}>
+            <Roles
+              {...defaultState()}
+              roleDiffProps={{
+                roleDiffElement,
+                roleDiffState: RoleDiffState.PolicyEnabled,
+                updateRoleDiff: () => null,
+                roleDiffAttempt: {
+                  status: 'error',
+                  statusText: 'there is an error here',
+                  data: null,
+                  error: null,
+                },
+              }}
+            />
+          </ContextProvider>
+        </InfoGuidePanelProvider>
+      </ToastNotificationProvider>
     </MemoryRouter>
   );
   await openEditor();
diff --git a/web/packages/teleport/src/Roles/Roles.tsx b/web/packages/teleport/src/Roles/Roles.tsx
index 9b4092f0e4d2b..942634f5808fd 100644
--- a/web/packages/teleport/src/Roles/Roles.tsx
+++ b/web/packages/teleport/src/Roles/Roles.tsx
@@ -17,22 +17,17 @@
  */
 
 import { useEffect, useState } from 'react';
-import styled from 'styled-components';
 
 import { Alert, Box, Button, Flex, Link } from 'design';
 import { HoverTooltip } from 'design/Tooltip';
 import { MissingPermissionsTooltip } from 'shared/components/MissingPermissionsTooltip';
-import {
-  Notification,
-  NotificationItem,
-  NotificationSeverity,
-} from 'shared/components/Notification';
 import {
   InfoExternalTextLink,
   InfoGuideButton,
   InfoParagraph,
   ReferenceLinks,
 } from 'shared/components/SlidingSidePanel/InfoGuide';
+import { useToastNotifications } from 'shared/components/ToastNotification';
 import { Attempt } from 'shared/hooks/useAsync';
 
 import { useServerSidePagination } from 'teleport/components/hooks';
@@ -96,18 +91,7 @@ const useNewRoleEditor = storageService.getUseNewRoleEditor();
 export function Roles(props: State & RolesProps) {
   const { remove, create, update, fetch, rolesAcl } = props;
   const [search, setSearch] = useState('');
-  const [notifications, setNotifications] = useState<NotificationItem[]>([]);
-
-  function addNotification(content: string, severity: NotificationSeverity) {
-    setNotifications(notifications => [
-      ...notifications,
-      { id: crypto.randomUUID(), content, severity },
-    ]);
-  }
-
-  function removeNotification(id: string) {
-    setNotifications(n => n.filter(item => item.id !== id));
-  }
+  const toastNotification = useToastNotifications();
 
   const serverSidePagination = useServerSidePagination<RoleResource>({
     pageSize: 20,
@@ -132,12 +116,13 @@ export function Roles(props: State & RolesProps) {
       ? create(role)
       : update(resources.item.name, role));
 
-    addNotification(
-      resources.status === 'creating'
-        ? `Role ${response.name} has been created`
-        : `Role ${response.name} has been updated`,
-      'success'
-    );
+    toastNotification.add({
+      severity: 'success',
+      content:
+        resources.status === 'creating'
+          ? `Role ${response.name} has been created`
+          : `Role ${response.name} has been updated`,
+    });
 
     if (useNewRoleEditor) {
       // We don't really disregard anything, since we already saved the role;
@@ -289,17 +274,6 @@ export function Roles(props: State & RolesProps) {
           onDelete={handleDelete}
         />
       )}
-
-      <NotificationContainer>
-        {notifications.map(item => (
-          <Notification
-            mb={3}
-            key={item.id}
-            item={item}
-            onRemove={() => removeNotification(item.id)}
-          />
-        ))}
-      </NotificationContainer>
     </FeatureBox>
   );
 }
@@ -356,9 +330,3 @@ function InfoGuide() {
     </Box>
   );
 }
-
-const NotificationContainer = styled.div`
-  position: absolute;
-  bottom: ${props => props.theme.space[2]}px;
-  right: ${props => props.theme.space[5]}px;
-`;
diff --git a/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.story.tsx b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.story.tsx
new file mode 100644
index 0000000000000..4f9f6c39a0860
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.story.tsx
@@ -0,0 +1,121 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { StoryObj } from '@storybook/react-vite';
+import { delay, http, HttpResponse } from 'msw';
+import { MemoryRouter } from 'react-router';
+
+import Box from 'design/Box';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { ListSessionRecordingsRoute } from 'teleport/SessionRecordings/list/ListSessionRecordingsRoute';
+import {
+  withMockCluster,
+  withMockEvents,
+  withMockThumbnails,
+} from 'teleport/SessionRecordings/mock';
+
+export default {
+  title: 'Teleport/SessionRecordings',
+};
+
+export const List: StoryObj = {
+  parameters: {
+    layout: 'fullscreen',
+    msw: {
+      handlers: [withMockCluster(), withMockEvents(), withMockThumbnails()],
+    },
+  },
+  render,
+};
+
+export const ListError: StoryObj = {
+  name: 'List with error fetching recordings',
+  parameters: {
+    layout: 'fullscreen',
+    msw: {
+      handlers: [
+        withMockCluster(),
+        http.get(cfg.api.clusterEventsRecordingsPath, () => {
+          return HttpResponse.json(
+            {
+              error: {
+                message: 'Internal Server Error',
+              },
+            },
+            { status: 500 }
+          );
+        }),
+      ],
+    },
+  },
+  render,
+};
+
+export const ListClusterError: StoryObj = {
+  name: 'List with error fetching clusters',
+  parameters: {
+    layout: 'fullscreen',
+    msw: {
+      handlers: [
+        http.get(cfg.api.clustersPath, () => {
+          return HttpResponse.json(
+            {
+              error: {
+                message: 'Failed to fetch clusters',
+              },
+            },
+            { status: 500 }
+          );
+        }),
+        withMockEvents(),
+      ],
+    },
+  },
+  render,
+};
+
+export const ListLoading: StoryObj = {
+  name: 'List loading state',
+  parameters: {
+    layout: 'fullscreen',
+    msw: {
+      handlers: [
+        withMockCluster(),
+        http.get(cfg.api.clusterEventsRecordingsPath, () => delay('infinite')),
+      ],
+    },
+  },
+  render,
+};
+
+function render() {
+  const ctx = createTeleportContext();
+
+  return (
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <Box height="100vh">
+          <ListSessionRecordingsRoute />
+        </Box>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.test.tsx b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.test.tsx
new file mode 100644
index 0000000000000..71ab082ec5461
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.test.tsx
@@ -0,0 +1,186 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+import { generatePath, MemoryRouter } from 'react-router';
+
+import {
+  createDeferredResponse,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+} from 'design/utils/testing';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+
+import { ListSessionRecordingsRoute } from './ListSessionRecordingsRoute';
+import { getThumbnail, MOCK_EVENTS, MOCK_THUMBNAIL } from './mock';
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+beforeEach(() => {
+  server.use(
+    getThumbnail(MOCK_THUMBNAIL),
+    http.get(cfg.api.clustersPath, () => {
+      return HttpResponse.json([
+        {
+          name: 'teleport',
+          lastConnected: '2025-08-14T14:36:07.976470934Z',
+          status: 'online',
+          publicURL: '',
+          authVersion: '',
+          proxyVersion: '',
+        },
+      ]);
+    })
+  );
+});
+afterEach(async () => {
+  server.resetHandlers();
+
+  testQueryClient.clear();
+});
+afterAll(() => server.close());
+
+const listRecordingsUrl = generatePath(cfg.api.clusterEventsRecordingsPath, {
+  clusterId: 'localhost',
+});
+
+function setupTest() {
+  const ctx = createTeleportContext();
+
+  return render(
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <ListSessionRecordingsRoute />
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
+
+test('displays loading indicator while fetching data', async () => {
+  const deferred = createDeferredResponse({
+    events: MOCK_EVENTS,
+    startKey: '',
+  });
+
+  server.use(http.get(listRecordingsUrl, deferred.handler));
+
+  setupTest();
+
+  expect(await screen.findByTestId('indicator')).toBeInTheDocument();
+
+  deferred.resolve();
+
+  await waitFor(() => {
+    expect(screen.queryByTestId('indicator')).not.toBeInTheDocument();
+  });
+
+  expect(screen.getByText('server-01')).toBeInTheDocument();
+});
+
+test('displays error message when request fails', async () => {
+  jest.spyOn(console, 'error').mockImplementation();
+
+  const errorMessage = 'Failed to fetch recordings';
+
+  server.use(
+    http.get(listRecordingsUrl, () => {
+      return HttpResponse.json(
+        { error: { message: errorMessage } },
+        { status: 400 }
+      );
+    })
+  );
+
+  setupTest();
+
+  expect(
+    await screen.findByText(/Failed to fetch recordings/i)
+  ).toBeInTheDocument();
+
+  expect(screen.queryByText('server-01')).not.toBeInTheDocument();
+
+  expect(screen.getByRole('button', { name: 'Retry' })).toBeInTheDocument();
+});
+
+test('retries the request on retry button click', async () => {
+  jest.spyOn(console, 'error').mockImplementation();
+
+  const errorMessage = 'Failed to fetch recordings';
+
+  server.use(
+    http.get(listRecordingsUrl, () => {
+      return HttpResponse.json(
+        { error: { message: errorMessage } },
+        { status: 400 }
+      );
+    })
+  );
+
+  setupTest();
+
+  expect(
+    await screen.findByText(/Failed to fetch recordings/i)
+  ).toBeInTheDocument();
+
+  expect(screen.queryByText('server-01')).not.toBeInTheDocument();
+
+  server.use(
+    http.get(listRecordingsUrl, () => {
+      return HttpResponse.json({
+        events: MOCK_EVENTS,
+      });
+    })
+  );
+
+  const retryButton = screen.getByRole('button', { name: 'Retry' });
+
+  expect(retryButton).toBeInTheDocument();
+
+  await userEvent.click(retryButton);
+
+  expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+  expect(
+    screen.queryByText(/Failed to fetch recordings/i)
+  ).not.toBeInTheDocument();
+  expect(
+    screen.queryByRole('button', { name: 'Retry' })
+  ).not.toBeInTheDocument();
+});
+
+test('displays an error message on connection failure', async () => {
+  jest.spyOn(console, 'error').mockImplementation();
+
+  server.use(
+    http.get(listRecordingsUrl, () => {
+      return HttpResponse.error();
+    })
+  );
+
+  setupTest();
+
+  expect(await screen.findByText(/Failed to fetch/i)).toBeInTheDocument();
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.tsx b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.tsx
new file mode 100644
index 0000000000000..7b996fc910974
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/ListSessionRecordingsRoute.tsx
@@ -0,0 +1,199 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo, useState, type ReactNode } from 'react';
+import { type FallbackProps } from 'react-error-boundary';
+
+import { Danger } from 'design/Alert';
+import Box from 'design/Box';
+import Flex, { Stack } from 'design/Flex';
+import { Indicator } from 'design/Indicator';
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+import { ErrorSuspenseWrapper } from 'shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper';
+import { getErrorMessage } from 'shared/utils/error';
+
+import { ClusterDropdown } from 'teleport/components/ClusterDropdown/ClusterDropdown';
+import RangePicker, {
+  EventRange,
+  getRangeOptions,
+} from 'teleport/components/EventRangePicker';
+import { ExternalAuditStorageCta } from 'teleport/components/ExternalAuditStorageCta';
+import {
+  FeatureBox,
+  FeatureHeader,
+  FeatureHeaderTitle,
+} from 'teleport/components/Layout';
+import { SessionSummariesCta } from 'teleport/SessionRecordings/list/SessionSummariesCta';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+import useTeleport from 'teleport/useTeleport';
+
+import type { ActionSlot } from './RecordingItem';
+import { RecordingsList } from './RecordingsList';
+import { useRecordingsListState, type RecordingsListFilterKey } from './state';
+
+interface ListSessionRecordingsRouteProps {
+  actionSlot?: ActionSlot;
+  headerSlot?: ReactNode;
+}
+
+export function ListSessionRecordingsRoute() {
+  return (
+    <ListSessionRecordings
+      actionSlot={null}
+      headerSlot={<SessionSummariesCta />}
+    />
+  );
+}
+
+export function ListSessionRecordings({
+  actionSlot,
+  headerSlot,
+}: ListSessionRecordingsRouteProps) {
+  const ranges = useMemo(() => getRangeOptions(), []);
+
+  const [state, setState] = useRecordingsListState(ranges);
+
+  const handleSetRange = useCallback(
+    (range: EventRange) => setState(prev => ({ ...prev, range })),
+    [setState]
+  );
+
+  const handleFilterChange = useCallback(
+    (key: RecordingsListFilterKey, value: string[] | boolean) =>
+      setState(prev => ({
+        ...prev,
+        page: 0,
+        filters: {
+          ...prev.filters,
+          [key]: value,
+        },
+      })),
+    [setState]
+  );
+
+  const handleSortChange = useCallback(
+    (key: string, direction: SortOrder) =>
+      setState(prev => ({
+        ...prev,
+        sortKey: key,
+        sortDirection: direction,
+      })),
+    [setState]
+  );
+
+  const handlePageChange = useCallback(
+    (page: number) => setState(prev => ({ ...prev, page })),
+    [setState]
+  );
+
+  const handleSearchChange = useCallback(
+    (search: string) => setState(prev => ({ ...prev, search })),
+    [setState]
+  );
+
+  return (
+    <FeatureBox minHeight={0} padding={0} hideBottomSpacing={true}>
+      <FeatureHeader
+        alignItems="center"
+        mx={0}
+        mb={1}
+        justifyContent="space-between"
+      >
+        <FeatureHeaderTitle mr="8">Session Recordings</FeatureHeaderTitle>
+
+        <Flex alignItems="center" gap={3}>
+          {headerSlot}
+
+          <RangePicker
+            ml="auto"
+            range={state.range}
+            ranges={ranges}
+            onChangeRange={handleSetRange}
+          />
+        </Flex>
+      </FeatureHeader>
+
+      <ExternalAuditStorageCta />
+
+      <Flex flex={1} minHeight={0} overflow="hidden" width="100%">
+        <ErrorSuspenseWrapper
+          errorComponent={RecordingsListError}
+          loadingComponent={RecordingsListLoading}
+        >
+          <RecordingsList
+            actionSlot={actionSlot}
+            onFilterChange={handleFilterChange}
+            onPageChange={handlePageChange}
+            onSearchChange={handleSearchChange}
+            onSortChange={handleSortChange}
+            state={state}
+          />
+        </ErrorSuspenseWrapper>
+      </Flex>
+    </FeatureBox>
+  );
+}
+
+function RecordingsListLoading() {
+  return (
+    <Box textAlign="center" m={10} width="100%">
+      <Indicator />
+    </Box>
+  );
+}
+
+function RecordingsListError({ error, resetErrorBoundary }: FallbackProps) {
+  const ctx = useTeleport();
+
+  const { clusterId } = useStickyClusterId();
+
+  const [errorMessage, setErrorMessage] = useState('');
+
+  return (
+    <Stack
+      alignItems="stretch"
+      gap={3}
+      minHeight={0}
+      flex={1}
+      width="100%"
+      overflow="hidden"
+    >
+      <Flex px={6} width="100%" justifyContent="stretch">
+        {errorMessage ? (
+          <Danger width="100%">{errorMessage}</Danger>
+        ) : (
+          <ClusterDropdown
+            clusterLoader={ctx.clusterService}
+            clusterId={clusterId}
+            onError={setErrorMessage}
+          />
+        )}
+      </Flex>
+      <Box px={6}>
+        <Danger
+          primaryAction={{
+            content: 'Retry',
+            onClick: resetErrorBoundary,
+          }}
+        >
+          {getErrorMessage(error)}
+        </Danger>
+      </Box>
+    </Stack>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingFilters.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingFilters.tsx
new file mode 100644
index 0000000000000..5666d47640857
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingFilters.tsx
@@ -0,0 +1,200 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useState, type MouseEvent } from 'react';
+
+import Box from 'design/Box';
+import { ButtonSecondary } from 'design/Button';
+import Flex from 'design/Flex';
+import { ChevronDown } from 'design/Icon';
+import Menu from 'design/Menu';
+import Text from 'design/Text';
+import { Toggle } from 'design/Toggle';
+import { HoverTooltip } from 'design/Tooltip';
+import {
+  FiltersExistIndicator,
+  MultiselectMenu,
+} from 'shared/components/Controls/MultiselectMenu';
+
+import type { RecordingType } from 'teleport/services/recordings';
+
+import type { RecordingsListFilterKey, RecordingsListFilters } from './state';
+
+interface RecordingFilterOption {
+  label: string;
+  value: string;
+}
+
+export type RecordingFilterOptions = {
+  [key in Exclude<
+    RecordingsListFilterKey,
+    'types' | 'hideNonInteractive'
+  >]: RecordingFilterOption[];
+};
+
+interface RecordingFiltersProps {
+  disabled: boolean;
+  filters: RecordingsListFilters;
+  options: RecordingFilterOptions;
+  onFilterChange: (
+    key: RecordingsListFilterKey,
+    value: string[] | boolean
+  ) => void;
+}
+
+interface TypeOption {
+  label: string;
+  value: RecordingType;
+}
+
+const typeOptions: TypeOption[] = [
+  {
+    label: 'SSH',
+    value: 'ssh',
+  },
+  {
+    label: 'Kubernetes',
+    value: 'k8s',
+  },
+  {
+    label: 'Desktop',
+    value: 'desktop',
+  },
+  {
+    label: 'Database',
+    value: 'database',
+  },
+];
+
+export function RecordingFilters({
+  disabled,
+  onFilterChange,
+  options,
+  filters,
+}: RecordingFiltersProps) {
+  const createHandleChange = useCallback(
+    (key: RecordingsListFilterKey) => (value: string[]) =>
+      onFilterChange(key, value),
+    [onFilterChange]
+  );
+
+  const handleToggleNonInteractive = useCallback(
+    (value: boolean) => onFilterChange('hideNonInteractive', value),
+    [onFilterChange]
+  );
+
+  return (
+    <>
+      <MultiselectMenu
+        options={typeOptions}
+        selected={filters.types}
+        onChange={createHandleChange('types')}
+        label="Types"
+        tooltip="Filter by session recording type"
+        buffered
+      />
+
+      <MultiselectMenu
+        options={options.users}
+        selected={filters.users}
+        onChange={createHandleChange('users')}
+        label="Users"
+        tooltip={disabled ? 'No results' : 'Filter by user'}
+        buffered
+        disabled={disabled}
+      />
+
+      <MultiselectMenu
+        options={options.resources}
+        selected={filters.resources}
+        onChange={createHandleChange('resources')}
+        label="Resources"
+        tooltip={disabled ? 'No results' : 'Filter by resource'}
+        buffered
+        disabled={disabled}
+      />
+
+      <HideNonInteractive
+        toggled={filters.hideNonInteractive}
+        onToggle={handleToggleNonInteractive}
+      />
+    </>
+  );
+}
+
+interface HideNonInteractiveProps {
+  toggled: boolean;
+  onToggle: (value: boolean) => void;
+}
+
+function HideNonInteractive({ toggled, onToggle }: HideNonInteractiveProps) {
+  const [anchorEl, setAnchorEl] = useState<HTMLElement | null>(null);
+
+  const handleOpen = useCallback((event: MouseEvent<HTMLElement>) => {
+    setAnchorEl(event.currentTarget);
+  }, []);
+
+  const handleClose = useCallback(() => {
+    setAnchorEl(null);
+  }, []);
+
+  const handleToggle = useCallback(() => {
+    onToggle(!toggled);
+    handleClose();
+  }, [onToggle, toggled, handleClose]);
+
+  return (
+    <Flex textAlign="center" alignItems="center">
+      <HoverTooltip tipContent={'Filter by interactive sessions'}>
+        <ButtonSecondary
+          px={2}
+          textTransform="none"
+          size="small"
+          onClick={handleOpen}
+        >
+          Interactivity
+          <ChevronDown ml={2} size="small" color="text.slightlyMuted" />
+          {toggled && <FiltersExistIndicator />}
+        </ButtonSecondary>
+      </HoverTooltip>
+      <Menu
+        popoverCss={() => `
+          // TODO (avatus): fix popover component to calculate correct height/anchor (copied from FilterPanel)
+          margin-top: 36px;
+        `}
+        transformOrigin={{
+          vertical: 'top',
+          horizontal: 'left',
+        }}
+        anchorOrigin={{
+          vertical: 'bottom',
+          horizontal: 'left',
+        }}
+        anchorEl={anchorEl}
+        open={Boolean(anchorEl)}
+        onClose={handleClose}
+      >
+        <Box px={3} py={2}>
+          <Toggle isToggled={toggled} onToggle={handleToggle}>
+            <Text ml={2}>Hide non-interactive sessions</Text>
+          </Toggle>
+        </Box>
+      </Menu>
+    </Flex>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingItem.test.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingItem.test.tsx
new file mode 100644
index 0000000000000..e3ba627d62f83
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingItem.test.tsx
@@ -0,0 +1,272 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { format } from 'date-fns';
+import { setupServer } from 'msw/node';
+import { act } from 'react';
+import { MemoryRouter } from 'react-router';
+
+import { render, screen, testQueryClient, tick } from 'design/utils/testing';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import type { Recording } from 'teleport/services/recordings';
+
+import { getThumbnail, MOCK_THUMBNAIL, thumbnailError } from './mock';
+import { RecordingItem, type RecordingItemProps } from './RecordingItem';
+import { Density, ViewMode } from './ViewSwitcher';
+
+const mockRecording: Recording = {
+  sid: 'test-session',
+  user: 'alice',
+  hostname: 'server-01',
+  duration: 125000, // 2m 5s
+  createdDate: new Date('2025-01-15T10:30:00Z'),
+  recordingType: 'ssh',
+  playable: true,
+  description: '',
+  durationText: '',
+  users: 'alice',
+};
+
+async function setupTest({
+  recording = mockRecording,
+  viewMode = ViewMode.List,
+  density = Density.Comfortable,
+  actionSlot,
+}: Partial<RecordingItemProps>) {
+  const ctx = createTeleportContext();
+
+  const view = render(
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <RecordingItem
+          actionSlot={actionSlot}
+          recording={recording}
+          viewMode={viewMode}
+          density={density}
+          thumbnailStyles=""
+        />
+      </ContextProvider>
+    </MemoryRouter>
+  );
+
+  // Wait for thumbnail to load
+  await act(tick);
+
+  return view;
+}
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+
+beforeEach(() => {
+  server.use(getThumbnail(MOCK_THUMBNAIL));
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  testQueryClient.clear();
+});
+
+afterAll(() => server.close());
+
+test('renders recording item with basic information', async () => {
+  await setupTest({});
+
+  expect(screen.getByTestId('recording-item')).toBeInTheDocument();
+  expect(screen.getByText('SSH Session')).toBeInTheDocument();
+  expect(screen.getByText('alice')).toBeInTheDocument();
+  expect(screen.getByText('server-01')).toBeInTheDocument();
+  expect(screen.getByText('test-session')).toBeInTheDocument();
+  expect(screen.getByText('2m 5s')).toBeInTheDocument();
+  expect(
+    screen.getByText(format(mockRecording.createdDate, 'MMM dd, yyyy HH:mm'))
+  ).toBeInTheDocument();
+});
+
+test('renders with compact density', async () => {
+  await setupTest({
+    recording: mockRecording,
+    viewMode: ViewMode.List,
+    density: Density.Compact,
+  });
+
+  expect(screen.getByTestId('recording-item')).toBeInTheDocument();
+  expect(screen.getByText('SSH Session')).toBeInTheDocument();
+});
+
+test('renders with comfortable density', async () => {
+  await setupTest({
+    recording: mockRecording,
+    viewMode: ViewMode.List,
+    density: Density.Comfortable,
+  });
+
+  expect(screen.getByTestId('recording-item')).toBeInTheDocument();
+  expect(screen.getByText('SSH Session')).toBeInTheDocument();
+});
+
+test('renders SSH recording type correctly', async () => {
+  await setupTest({ recording: { ...mockRecording, recordingType: 'ssh' } });
+
+  expect(screen.getByText('SSH Session')).toBeInTheDocument();
+});
+
+test('renders Desktop recording type correctly', async () => {
+  await setupTest({
+    recording: { ...mockRecording, recordingType: 'desktop' },
+  });
+
+  expect(screen.getByText('Desktop Session')).toBeInTheDocument();
+});
+
+test('renders Database recording type correctly', async () => {
+  await setupTest({
+    recording: { ...mockRecording, recordingType: 'database' },
+  });
+
+  expect(screen.getByText('Database Session')).toBeInTheDocument();
+});
+
+test('renders Kubernetes recording type correctly', async () => {
+  await setupTest({ recording: { ...mockRecording, recordingType: 'k8s' } });
+
+  expect(screen.getByText('Kubernetes Session')).toBeInTheDocument();
+});
+
+test('formats duration correctly for seconds only', async () => {
+  await setupTest({ recording: { ...mockRecording, duration: 45000 } }); // 45s
+
+  expect(screen.getByText('45s')).toBeInTheDocument();
+});
+
+test('formats duration correctly for minutes and seconds', async () => {
+  await setupTest({ recording: { ...mockRecording, duration: 125000 } }); // 2m 5s
+
+  expect(screen.getByText('2m 5s')).toBeInTheDocument();
+});
+
+test('formats duration correctly for hours', async () => {
+  await setupTest({ recording: { ...mockRecording, duration: 7265000 } }); // 2h 1m 5s
+
+  expect(screen.getByText('2h 1m 5s')).toBeInTheDocument();
+});
+
+test('formats duration correctly for days', async () => {
+  await setupTest({ recording: { ...mockRecording, duration: 93665000 } }); // 1d 2h 1m 5s
+
+  expect(screen.getByText('1d 2h 1m 5s')).toBeInTheDocument();
+});
+
+test('formats duration as 0s for zero duration', async () => {
+  await setupTest({ recording: { ...mockRecording, duration: 0 } });
+
+  expect(screen.getByText('0s')).toBeInTheDocument();
+});
+
+test('generates correct link URL', async () => {
+  await setupTest({});
+
+  const link = screen.getByTestId('recording-item');
+  const expectedUrl = cfg.getPlayerRoute(
+    { clusterId: 'localhost', sid: mockRecording.sid },
+    {
+      recordingType: mockRecording.recordingType,
+      durationMs: mockRecording.duration,
+    }
+  );
+
+  expect(link).toHaveAttribute('href', expectedUrl);
+  expect(link).toHaveAttribute('target', '_blank');
+});
+
+test('renders all view modes with all densities', async () => {
+  const viewModes = [ViewMode.List, ViewMode.Card];
+  const densities = [Density.Compact, Density.Comfortable];
+
+  for (const viewMode of viewModes) {
+    for (const density of densities) {
+      const { unmount } = await setupTest({
+        recording: mockRecording,
+        viewMode,
+        density,
+      });
+
+      expect(screen.getByTestId('recording-item')).toBeInTheDocument();
+      expect(screen.getByText('SSH Session')).toBeInTheDocument();
+      expect(screen.getByText('alice')).toBeInTheDocument();
+
+      unmount();
+    }
+  }
+});
+
+test('shows thumbnail not available if it fails to load', async () => {
+  jest.spyOn(console, 'error').mockImplementation();
+
+  server.use(thumbnailError());
+
+  await setupTest({});
+
+  expect(
+    await screen.findByText('Thumbnail not available')
+  ).toBeInTheDocument();
+  expect(screen.queryByTestId('recording-thumbnail')).not.toBeInTheDocument();
+});
+
+test('shows non-interactive session message for non-playable recordings', async () => {
+  const nonPlayableRecording: Recording = {
+    ...mockRecording,
+    playable: false,
+    recordingType: 'desktop',
+  };
+
+  await setupTest({ recording: nonPlayableRecording });
+
+  expect(
+    screen.getByText('Non-interactive session, no playback available')
+  ).toBeInTheDocument();
+  expect(screen.queryByTestId('recording-thumbnail')).not.toBeInTheDocument();
+});
+
+test('allows custom action slot', async () => {
+  const actionSlot = jest
+    .fn()
+    .mockReturnValue(
+      <button data-testid="custom-action">Custom Action</button>
+    );
+
+  await setupTest({
+    recording: mockRecording,
+    viewMode: ViewMode.List,
+    density: Density.Comfortable,
+    actionSlot,
+  });
+
+  const item = screen.getByTestId('recording-item');
+  expect(item).toBeInTheDocument();
+
+  const customAction = screen.getByTestId('custom-action');
+
+  expect(customAction).toBeInTheDocument();
+  expect(actionSlot).toHaveBeenCalledWith(mockRecording.sid, 'ssh');
+  expect(customAction).toHaveTextContent('Custom Action');
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingItem.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingItem.tsx
new file mode 100644
index 0000000000000..5966b9a4bf73c
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingItem.tsx
@@ -0,0 +1,398 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { format } from 'date-fns';
+import {
+  Suspense,
+  useMemo,
+  type ComponentType,
+  type PropsWithChildren,
+  type ReactNode,
+} from 'react';
+import { ErrorBoundary } from 'react-error-boundary';
+import { Link } from 'react-router-dom';
+import styled, { css } from 'styled-components';
+
+import Box from 'design/Box';
+import Flex from 'design/Flex';
+import {
+  Application,
+  ArrowRight,
+  Database,
+  Desktop,
+  Kubernetes,
+  Server,
+  Spinner,
+  User,
+} from 'design/Icon';
+import { IconProps } from 'design/Icon/Icon';
+import { rotate360 } from 'design/keyframes';
+import Text from 'design/Text';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
+
+import cfg from 'teleport/config';
+import {
+  type Recording,
+  type RecordingType,
+} from 'teleport/services/recordings';
+import { RECORDING_TYPES_WITH_THUMBNAILS } from 'teleport/services/recordings/recordings';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+
+import { RecordingThumbnail } from './RecordingThumbnail';
+import { Density, ViewMode } from './ViewSwitcher';
+
+// ActionSlot is a function that takes a sessionId and the type of the recording,
+// and returns a ReactNode, for placing a button on each session recording.
+export type ActionSlot = (sessionId: string, type: RecordingType) => ReactNode;
+
+export interface RecordingItemProps {
+  actionSlot?: ActionSlot;
+  density: Density;
+  recording: Recording;
+  thumbnailStyles: string;
+  viewMode: ViewMode;
+}
+
+export function RecordingItem({
+  actionSlot,
+  density,
+  recording,
+  thumbnailStyles,
+  viewMode,
+}: RecordingItemProps) {
+  const { clusterId } = useStickyClusterId();
+
+  const { icon: Icon, label } = useMemo(
+    () => getRecordingTypeInfo(recording.recordingType),
+    [recording.recordingType]
+  );
+
+  const duration = useMemo(
+    () => formatSessionRecordingDuration(recording.duration),
+    [recording.duration]
+  );
+
+  const url = cfg.getPlayerRoute(
+    { clusterId, sid: recording.sid },
+    {
+      recordingType: recording.recordingType,
+      durationMs: recording.duration,
+    }
+  );
+
+  const actions = useMemo(
+    () => actionSlot?.(recording.sid, recording.recordingType),
+    [actionSlot, recording.sid, recording.recordingType]
+  );
+
+  const hasThumbnail = RECORDING_TYPES_WITH_THUMBNAILS.includes(
+    recording.recordingType
+  );
+
+  const handleClick: React.MouseEventHandler<HTMLAnchorElement> = e => {
+    if (!recording.playable) {
+      e.preventDefault();
+    }
+  };
+
+  return (
+    <RecordingItemContainer
+      data-testid="recording-item"
+      to={recording.playable ? url : '#'}
+      target="_blank"
+      playable={recording.playable}
+      density={density}
+      viewMode={viewMode}
+      onClick={handleClick}
+    >
+      <ThumbnailContainer density={density} viewMode={viewMode}>
+        {recording.playable ? (
+          hasThumbnail ? (
+            <ErrorBoundary
+              fallback={
+                <ThumbnailError>Thumbnail not available</ThumbnailError>
+              }
+            >
+              <Suspense fallback={<ThumbnailLoading />}>
+                <RecordingThumbnail
+                  clusterId={clusterId}
+                  sessionId={recording.sid}
+                  styles={thumbnailStyles}
+                />
+              </Suspense>
+            </ErrorBoundary>
+          ) : (
+            <ThumbnailError>Thumbnail not available</ThumbnailError>
+          )
+        ) : (
+          <ThumbnailError>
+            Non-interactive session, no playback available
+          </ThumbnailError>
+        )}
+
+        <Duration viewMode={viewMode}>{duration}</Duration>
+      </ThumbnailContainer>
+
+      <Flex width="100%">
+        <RecordingDetails density={density} viewMode={viewMode}>
+          <Flex gap={2} width="100%">
+            <Icon size="small" />
+
+            <Text fontWeight="500">{label}</Text>
+
+            <Box flex={1} justifySelf="stretch" alignSelf="stretch" />
+
+            <Text color="text.slightlyMuted" fontSize="small" pr={1}>
+              {format(recording.createdDate, 'MMM dd, yyyy HH:mm')}
+            </Text>
+          </Flex>
+          <Flex alignItems="center" gap={2}>
+            <ItemSpan>
+              <User size="small" color="sessionRecording.user" />
+
+              <Text>{recording.user}</Text>
+            </ItemSpan>
+
+            <ArrowRight size="small" color="text.slightlyMuted" />
+
+            <ItemSpan>
+              <Icon size="small" color="sessionRecording.resource" />
+
+              <Text>{recording.hostname}</Text>
+            </ItemSpan>
+          </Flex>
+          <Box flex={1} justifySelf="stretch" alignSelf="stretch" />
+          <Flex alignItems="flex-end" justifyContent="space-between">
+            <Text color="text.slightlyMuted" fontSize="12px" fontFamily="mono">
+              {recording.sid}
+            </Text>
+            <Box flex="1">
+              <CopyButton value={recording.sid} ml={2} />
+            </Box>
+            {recording.playable && actions}
+          </Flex>
+        </RecordingDetails>
+      </Flex>
+    </RecordingItemContainer>
+  );
+}
+
+const RecordingItemContainer = styled(Link).withConfig({
+  // We need to specify this when wrapping non-styled components
+  shouldForwardProp: prop =>
+    !['viewMode', 'density', 'playable'].includes(prop),
+})<Pick<RecordingItemProps, 'viewMode' | 'density'> & { playable: boolean }>(
+  p => css`
+    border: ${p.theme.borders[2]} ${p.theme.colors.interactive.tonal.neutral[0]};
+    border-radius: ${p.theme.radii[3]}px;
+    overflow: hidden; // Needed to keep the rectangular contents from bleeding out of the round corners.
+    display: flex;
+    flex-grow: 0;
+    cursor: ${p.playable ? 'pointer' : 'default'};
+    text-decoration: none;
+    color: ${p.theme.colors.text.main};
+
+    &:hover {
+      background: ${p.theme.colors.levels.surface};
+      border-color: transparent;
+      box-shadow: ${props => props.theme.boxShadow[3]};
+    }
+
+    ${p.viewMode === ViewMode.List
+      ? css`
+          padding: ${p.density === Density.Compact
+            ? `${p.theme.space[2]}px`
+            : `calc(${p.theme.space[2]}px + 2px) ${p.theme.space[2]}px`};
+          gap: ${p.theme.space[3]}px;
+        `
+      : css`
+          flex-direction: column;
+        `}
+    transition: background-color 150ms, border-color 150ms, box-shadow 150ms;
+  `
+);
+
+const ThumbnailContainer = styled.div<
+  Pick<RecordingItemProps, 'viewMode' | 'density'>
+>(
+  p => css`
+    flex-shrink: 0;
+    position: relative;
+    overflow: hidden;
+
+    ${p.viewMode === ViewMode.List
+      ? css`
+          border: 1px solid ${p.theme.colors.interactive.tonal.neutral[0]};
+          border-radius: ${p.theme.radii[2]}px;
+          height: 100%;
+          width: ${p.density === Density.Compact ? '256px' : '320px'};
+        `
+      : css`
+          border-bottom: 1px solid
+            ${p.theme.colors.interactive.tonal.neutral[0]};
+          flex: 1;
+          height: ${p.density === Density.Compact ? '90px' : '120px'};
+          width: 100%;
+        `}
+
+    ${RecordingItemContainer}:hover & {
+      border-color: transparent;
+      transition: border-color 150ms;
+    }
+  `
+);
+
+const RecordingDetails = styled.div<
+  Pick<RecordingItemProps, 'viewMode' | 'density'>
+>(
+  p => css`
+    display: flex;
+    flex-direction: column;
+    flex: 1;
+    flex-shrink: 0;
+    font-size: ${p.density === Density.Compact ? '13px' : '15px'};
+
+    ${p.viewMode === ViewMode.List
+      ? css`
+          gap: ${p.density === Density.Compact
+            ? p.theme.space[1]
+            : p.theme.space[2]}px;
+          padding-top: ${p.density === Density.Compact
+            ? p.theme.space[0]
+            : p.theme.space[2]}px;
+          padding-right: ${p.theme.space[1]}px;
+        `
+      : css`
+          padding: ${p.theme.space[3]}px ${p.theme.space[2]}px
+            ${p.theme.space[2]}px ${p.theme.space[3]}px;
+          gap: ${p.theme.space[1]}px;
+        `}
+  `
+);
+
+const Duration = styled.div<Pick<RecordingItemProps, 'viewMode'>>(
+  p => css`
+    background: rgba(0, 0, 0, 0.5);
+    border-radius: ${p.theme.radii[3]}px;
+    color: white;
+    font-weight: bold;
+    position: absolute;
+    line-height: 1;
+    padding: ${p.theme.space[1]}px ${p.theme.space[2]}px;
+    right: ${p.theme.space[2]}px;
+
+    ${p.viewMode === ViewMode.List
+      ? css`
+          bottom: ${p.theme.space[2]}px;
+        `
+      : css`
+          top: ${p.theme.space[2]}px;
+        `}
+  `
+);
+
+const ItemSpan = styled.span`
+  background: ${p => p.theme.colors.spotBackground[0]};
+  line-height: 1;
+  padding: ${p => p.theme.space[1]}px ${p => p.theme.space[1]}px;
+  border-radius: ${p => p.theme.radii[3]}px;
+  display: inline-flex;
+  align-items: center;
+  font-size: 13px;
+  gap: ${p => p.theme.space[1]}px;
+`;
+
+const Spin = styled(Box)`
+  line-height: 12px;
+  font-size: 24px;
+  animation: ${rotate360} 2s linear infinite;
+`;
+
+function ThumbnailLoading() {
+  return (
+    <Flex alignItems="center" justifyContent="center" height="100%">
+      <Spin>
+        <Spinner />
+      </Spin>
+    </Flex>
+  );
+}
+
+function ThumbnailError({ children }: PropsWithChildren) {
+  return (
+    <Flex alignItems="center" justifyContent="center" height="100%">
+      <Text color="text.slightlyMuted" fontSize="14px">
+        {children}
+      </Text>
+    </Flex>
+  );
+}
+
+export function getRecordingTypeInfo(type: RecordingType): {
+  icon: ComponentType<IconProps>;
+  label: string;
+} {
+  switch (type) {
+    case 'ssh':
+      return {
+        icon: Server,
+        label: 'SSH Session',
+      };
+
+    case 'database':
+      return {
+        icon: Database,
+        label: 'Database Session',
+      };
+
+    case 'k8s':
+      return {
+        icon: Kubernetes,
+        label: 'Kubernetes Session',
+      };
+
+    case 'desktop':
+      return {
+        icon: Desktop,
+        label: 'Desktop Session',
+      };
+
+    case 'app':
+      return {
+        icon: Application,
+        label: 'Application Session Chunk',
+      };
+  }
+}
+
+export function formatSessionRecordingDuration(ms: number): string {
+  const roundedMs = Math.round(ms / 1000) * 1000;
+
+  const units = [
+    { label: 'd', value: Math.floor(roundedMs / 86400000) },
+    { label: 'h', value: Math.floor(roundedMs / 3600000) % 24 },
+    { label: 'm', value: Math.floor(roundedMs / 60000) % 60 },
+    { label: 's', value: Math.floor(roundedMs / 1000) % 60 },
+  ];
+
+  const parts = units
+    .filter(({ value }) => value > 0)
+    .map(({ label, value }) => `${value}${label}`);
+
+  return parts.length > 0 ? parts.join(' ') : '0s';
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.test.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.test.tsx
new file mode 100644
index 0000000000000..a9e0ee22504c1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.test.tsx
@@ -0,0 +1,144 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { setupServer } from 'msw/node';
+
+import { render, screen, testQueryClient } from 'design/utils/testing';
+
+import { getThumbnail, MOCK_THUMBNAIL } from './mock';
+import { RecordingThumbnail } from './RecordingThumbnail';
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+
+afterEach(async () => {
+  server.resetHandlers();
+  testQueryClient.clear();
+});
+
+afterAll(() => server.close());
+
+function setupTest(clusterId = 'localhost', sessionId = 'test-session') {
+  return render(
+    <RecordingThumbnail clusterId={clusterId} sessionId={sessionId} styles="" />
+  );
+}
+
+test('renders thumbnail with correct background position for centered cursor', async () => {
+  server.use(getThumbnail(MOCK_THUMBNAIL));
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '25% 25%',
+    backgroundSize: '200%',
+  });
+});
+
+test('renders thumbnail with correct background position for top-left cursor', async () => {
+  server.use(
+    getThumbnail({
+      ...MOCK_THUMBNAIL,
+      cursorX: 0,
+      cursorY: 0,
+    })
+  );
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '0% 0%',
+    backgroundSize: '200%',
+  });
+});
+
+test('renders thumbnail with correct background position for bottom-right cursor', async () => {
+  server.use(
+    getThumbnail({
+      ...MOCK_THUMBNAIL,
+      cursorX: 100,
+      cursorY: 100,
+    })
+  );
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '75% 75%',
+    backgroundSize: '200%',
+  });
+});
+
+test('renders thumbnail with different aspect ratio', async () => {
+  server.use(
+    getThumbnail({
+      ...MOCK_THUMBNAIL,
+      cols: 200,
+      rows: 50,
+      cursorX: 100,
+      cursorY: 25,
+    })
+  );
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '25% 25%',
+    backgroundSize: '200%',
+  });
+});
+
+test('clamps background position when cursor is near edges', async () => {
+  server.use(
+    getThumbnail({
+      ...MOCK_THUMBNAIL,
+      cursorX: 95,
+      cursorY: 5,
+    })
+  );
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '70% 0%',
+    backgroundSize: '200%',
+  });
+});
+
+test('centers the thumbnail when cursor is not visible', async () => {
+  server.use(
+    getThumbnail({
+      ...MOCK_THUMBNAIL,
+      cursorVisible: false,
+    })
+  );
+  setupTest();
+
+  const thumbnail = await screen.findByTestId('recording-thumbnail');
+
+  expect(thumbnail).toHaveStyle({
+    backgroundPosition: '50% 50%',
+    backgroundSize: '200%',
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.tsx
new file mode 100644
index 0000000000000..480f9b8a1db30
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingThumbnail.tsx
@@ -0,0 +1,87 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMemo } from 'react';
+
+import Box from 'design/Box';
+
+import { useSuspenseGetRecordingThumbnail } from 'teleport/services/recordings/hooks';
+import { useThumbnailSvg } from 'teleport/SessionRecordings/svg';
+
+interface RecordingThumbnailProps {
+  clusterId: string;
+  sessionId: string;
+  styles: string;
+}
+
+// zoomLevel determines how far the thumbnail is zoomed in.
+// A higher zoom level means the thumbnail is more zoomed in, showing a smaller area of the recording.
+const zoomLevel = 2;
+
+export function RecordingThumbnail({
+  clusterId,
+  sessionId,
+  styles,
+}: RecordingThumbnailProps) {
+  const { data } = useSuspenseGetRecordingThumbnail(
+    {
+      clusterId,
+      sessionId,
+    },
+    {
+      staleTime: 1000 * 60 * 5, // 5 minutes
+      gcTime: 1000 * 60 * 5, // 5 minutes
+    }
+  );
+
+  // calculate the background position based on the cursor position and zoom level
+  const { bgPosX, bgPosY } = useMemo(() => {
+    if (!data.cursorVisible) {
+      return { bgPosX: 50, bgPosY: 50 };
+    }
+
+    const cursorXPercent = (data.cursorX / data.cols) * 100;
+    const cursorYPercent = (data.cursorY / data.rows) * 100;
+
+    const viewportPercent = (1 / zoomLevel) * 100;
+
+    const bgPosX = Math.max(
+      0,
+      Math.min(100, cursorXPercent - viewportPercent / 2)
+    );
+    const bgPosY = Math.max(
+      0,
+      Math.min(100, cursorYPercent - viewportPercent / 2)
+    );
+
+    return { bgPosX, bgPosY };
+  }, [data.cols, data.cursorX, data.cursorY, data.rows, data.cursorVisible]);
+
+  const dataUri = useThumbnailSvg(data.svg, styles);
+
+  return (
+    <Box
+      data-testid="recording-thumbnail"
+      background={`url("${dataUri}")`}
+      backgroundPosition={`${bgPosX}% ${bgPosY}%`}
+      backgroundSize={`${zoomLevel * 100}%`}
+      height="100%"
+      width="100%"
+    />
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingsList.test.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingsList.test.tsx
new file mode 100644
index 0000000000000..097deac811b55
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingsList.test.tsx
@@ -0,0 +1,713 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+import { generatePath, MemoryRouter } from 'react-router';
+
+import {
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+} from 'design/utils/testing';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import type { RecordingType } from 'teleport/services/recordings';
+import { KeysEnum } from 'teleport/services/storageService';
+
+import {
+  createMockSessionEndEvent,
+  getThumbnail,
+  MOCK_EVENTS,
+  MOCK_THUMBNAIL,
+} from './mock';
+import { RecordingsList } from './RecordingsList';
+import type { RecordingsListState } from './state';
+import { Density, ViewMode } from './ViewSwitcher';
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+beforeEach(() => {
+  server.use(
+    getThumbnail(MOCK_THUMBNAIL),
+    http.get(cfg.api.clustersPath, () => {
+      return HttpResponse.json([
+        {
+          name: 'teleport',
+          lastConnected: '2025-08-14T14:36:07.976470934Z',
+          status: 'online',
+          publicURL: '',
+          authVersion: '',
+          proxyVersion: '',
+        },
+      ]);
+    })
+  );
+});
+afterEach(async () => {
+  server.resetHandlers();
+
+  testQueryClient.clear();
+});
+afterAll(() => server.close());
+
+const defaultState: RecordingsListState = {
+  filters: {
+    hideNonInteractive: false,
+    resources: [],
+    types: [],
+    users: [],
+  },
+  page: 0,
+  range: {
+    from: new Date('2025-01-15T00:00:00Z'),
+    to: new Date('2025-01-16T00:00:00Z'),
+    isCustom: false,
+  },
+  search: '',
+  sortKey: 'date',
+  sortDirection: 'DESC',
+};
+
+const mockHandlers = {
+  onFilterChange: jest.fn(),
+  onPageChange: jest.fn(),
+  onSearchChange: jest.fn(),
+  onSortChange: jest.fn(),
+};
+
+const listRecordingsUrl = generatePath(cfg.api.clusterEventsRecordingsPath, {
+  clusterId: 'localhost',
+});
+
+function withListRecordings(events = MOCK_EVENTS) {
+  server.use(
+    http.get(listRecordingsUrl, () => {
+      return HttpResponse.json({
+        events,
+        startKey: '',
+      });
+    })
+  );
+}
+
+function setupTest(state: RecordingsListState = defaultState) {
+  const ctx = createTeleportContext();
+
+  mockHandlers.onFilterChange.mockClear();
+  mockHandlers.onPageChange.mockClear();
+  mockHandlers.onSearchChange.mockClear();
+  mockHandlers.onSortChange.mockClear();
+
+  return render(
+    <MemoryRouter>
+      <ContextProvider ctx={ctx}>
+        <RecordingsList
+          state={state}
+          onFilterChange={mockHandlers.onFilterChange}
+          onPageChange={mockHandlers.onPageChange}
+          onSearchChange={mockHandlers.onSearchChange}
+          onSortChange={mockHandlers.onSortChange}
+        />
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
+
+describe('rendering', () => {
+  it('renders recordings list with all items', async () => {
+    withListRecordings();
+    setupTest();
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.getByText('desktop-02')).toBeInTheDocument();
+    expect(screen.getByText('database-01')).toBeInTheDocument();
+    expect(screen.getByText('k8s-cluster//')).toBeInTheDocument();
+    expect(screen.getByText('server-03')).toBeInTheDocument();
+  });
+
+  it('renders empty state when no recordings', async () => {
+    withListRecordings([]);
+    setupTest(defaultState);
+
+    expect(await screen.findByText('No Recordings Found')).toBeInTheDocument();
+  });
+
+  it('displays cluster dropdown when there is more than 1 cluster', async () => {
+    server.use(
+      http.get(cfg.api.clustersPath, () => {
+        return HttpResponse.json([
+          {
+            name: 'teleport',
+            lastConnected: '2025-08-14T14:36:07.976470934Z',
+            status: 'online',
+            publicURL: '',
+            authVersion: '',
+            proxyVersion: '',
+          },
+          {
+            name: 'other-cluster',
+            lastConnected: '2025-08-14T14:36:07.976470934Z',
+            status: 'online',
+            publicURL: '',
+            authVersion: '',
+            proxyVersion: '',
+          },
+        ]);
+      })
+    );
+
+    withListRecordings();
+    setupTest();
+
+    expect(await screen.findByText('Cluster: localhost')).toBeInTheDocument();
+  });
+
+  it('displays sort menu with correct default', async () => {
+    withListRecordings();
+    setupTest();
+
+    const sortButton = await screen.findByRole('button', { name: 'Sort by' });
+
+    expect(sortButton).toBeInTheDocument();
+  });
+});
+
+describe('filtering', () => {
+  it('filters by recording type', async () => {
+    const stateWithTypeFilter: RecordingsListState = {
+      ...defaultState,
+      filters: {
+        ...defaultState.filters,
+        types: ['ssh' as RecordingType],
+      },
+    };
+
+    withListRecordings();
+    setupTest(stateWithTypeFilter);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.getByText('server-03')).toBeInTheDocument();
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('k8s-cluster')).not.toBeInTheDocument();
+  });
+
+  it('filters by user', async () => {
+    const stateWithUserFilter: RecordingsListState = {
+      ...defaultState,
+      filters: {
+        ...defaultState.filters,
+        users: ['alice'],
+      },
+    };
+
+    withListRecordings();
+    setupTest(stateWithUserFilter);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.getByText('k8s-cluster//')).toBeInTheDocument();
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('server-03')).not.toBeInTheDocument();
+  });
+
+  it('filters by resource/hostname', async () => {
+    const stateWithResourceFilter: RecordingsListState = {
+      ...defaultState,
+      filters: {
+        ...defaultState.filters,
+        resources: ['server-01', 'server-03'],
+      },
+    };
+
+    withListRecordings();
+    setupTest(stateWithResourceFilter);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.getByText('server-03')).toBeInTheDocument();
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('k8s-cluster')).not.toBeInTheDocument();
+  });
+
+  it('applies multiple filters simultaneously', async () => {
+    const stateWithMultipleFilters: RecordingsListState = {
+      ...defaultState,
+      filters: {
+        hideNonInteractive: false,
+        types: ['ssh' as RecordingType],
+        users: ['alice'],
+        resources: [],
+      },
+    };
+
+    withListRecordings();
+    setupTest(stateWithMultipleFilters);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('k8s-cluster')).not.toBeInTheDocument();
+    expect(screen.queryByText('server-03')).not.toBeInTheDocument();
+  });
+
+  it('calls onFilterChange when filter is changed', async () => {
+    withListRecordings();
+    setupTest();
+
+    const typesButton = await screen.findByRole('button', { name: /Types/i });
+    await userEvent.click(typesButton);
+
+    const sshOption = await screen.findByText('SSH');
+    await userEvent.click(sshOption);
+
+    const applyFiltersButton = screen.getByRole('button', {
+      name: /Apply filters/i,
+    });
+    await userEvent.click(applyFiltersButton);
+
+    expect(mockHandlers.onFilterChange).toHaveBeenCalledWith('types', ['ssh']);
+  });
+});
+
+describe('sorting', () => {
+  it('sorts by date descending by default', async () => {
+    withListRecordings();
+    setupTest();
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    const firstItemInGrid = screen.getAllByTestId('recording-item')[0];
+
+    expect(firstItemInGrid).toHaveTextContent('server-01');
+  });
+
+  it('sorts by type when specified', async () => {
+    const stateWithTypeSort: RecordingsListState = {
+      ...defaultState,
+      sortKey: 'type',
+      sortDirection: 'ASC',
+    };
+
+    withListRecordings();
+    setupTest(stateWithTypeSort);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    const firstItemInGrid = screen.getAllByTestId('recording-item')[0];
+
+    expect(firstItemInGrid).toHaveTextContent('database-01');
+  });
+
+  it('calls onSortChange when sort is changed', async () => {
+    withListRecordings();
+    setupTest();
+
+    const sortButton = await screen.findByRole('button', { name: 'Sort by' });
+    await userEvent.click(sortButton);
+
+    const typeOption = await screen.findByText('Type');
+    await userEvent.click(typeOption);
+
+    expect(mockHandlers.onSortChange).toHaveBeenCalledWith('type', 'ASC');
+
+    await userEvent.click(sortButton);
+    const sortAscending = await screen.findByText('Oldest');
+    await userEvent.click(sortAscending);
+
+    // The sort direction is still the default (Date, DESC), so we expect
+    // the direction change to be called with Date, ASC.
+    expect(mockHandlers.onSortChange).toHaveBeenCalledWith('date', 'ASC');
+  });
+});
+
+describe('pagination', () => {
+  it('displays pagination controls', async () => {
+    const manyRecordings = Array.from({ length: 60 }, (_, i) =>
+      createMockSessionEndEvent({
+        sid: `session-${i.toString().padStart(3, '0')}`,
+        server_hostname: `server-${i.toString().padStart(2, '0')}`,
+      })
+    );
+
+    withListRecordings(manyRecordings);
+    setupTest(defaultState);
+
+    const paginationIndicator = await screen.findByTestId(
+      'recordings-pagination-indicator'
+    );
+
+    expect(paginationIndicator).toHaveTextContent('Showing 1 - 50 of 60');
+  });
+
+  it('fetches more data when there are more results', async () => {
+    server.use(
+      http.get(listRecordingsUrl, ({ request }) => {
+        const url = new URL(request.url);
+        const startKey = url.searchParams.get('startKey');
+
+        if (startKey === 'next-page-key') {
+          const events = Array.from({ length: 10 }, (_, i) =>
+            createMockSessionEndEvent({
+              sid: `session-page2-${i.toString().padStart(2, '0')}`,
+              server_hostname: `server-page2-${i.toString().padStart(2, '0')}`,
+            })
+          );
+
+          return HttpResponse.json({
+            events,
+            startKey: '',
+          });
+        }
+
+        const events = Array.from({ length: 20 }, (_, i) =>
+          createMockSessionEndEvent({
+            sid: `session-page1-${i.toString().padStart(2, '0')}`,
+            server_hostname: `server-page1-${i.toString().padStart(2, '0')}`,
+          })
+        );
+
+        return HttpResponse.json({
+          events,
+          startKey: 'next-page-key',
+        });
+      })
+    );
+
+    setupTest(defaultState);
+
+    await screen.findByText('server-page1-00');
+
+    const paginationIndicator = screen.getByTestId(
+      'recordings-pagination-indicator'
+    );
+
+    expect(paginationIndicator).toHaveTextContent('Showing 1 - 20 of 20');
+
+    const nextPageButton = screen.getByRole('button', {
+      name: 'Next page',
+    });
+
+    expect(nextPageButton).toBeDisabled();
+
+    const fetchMoreButton = await screen.findByRole('button', {
+      name: 'Fetch More',
+    });
+
+    expect(fetchMoreButton).toBeInTheDocument();
+    expect(fetchMoreButton).toBeEnabled();
+
+    await userEvent.click(fetchMoreButton);
+
+    expect(paginationIndicator).toHaveTextContent('Showing 1 - 30 of 30');
+
+    expect(
+      screen.queryByRole('button', { name: 'Fetch More' })
+    ).not.toBeInTheDocument();
+  });
+
+  it('shows an error correctly if fetching more results fails', async () => {
+    server.use(
+      http.get(listRecordingsUrl, ({ request }) => {
+        const url = new URL(request.url);
+        const startKey = url.searchParams.get('startKey');
+
+        if (startKey === 'next-page-key') {
+          return HttpResponse.json(
+            { error: { message: 'Failed to fetch more results' } },
+            { status: 500 }
+          );
+        }
+
+        return HttpResponse.json({
+          events: MOCK_EVENTS,
+          startKey: 'next-page-key',
+        });
+      })
+    );
+
+    setupTest(defaultState);
+
+    await screen.findByText('server-01');
+
+    const paginationIndicator = screen.getByTestId(
+      'recordings-pagination-indicator'
+    );
+
+    expect(paginationIndicator).toHaveTextContent('Showing 1 - 5 of 5');
+
+    const fetchMoreButton = await screen.findByRole('button', {
+      name: 'Fetch More',
+    });
+
+    expect(fetchMoreButton).toBeInTheDocument();
+    expect(fetchMoreButton).toBeEnabled();
+
+    await userEvent.click(fetchMoreButton);
+
+    expect(paginationIndicator).toHaveTextContent('An error occurred');
+
+    expect(screen.getByRole('button', { name: 'Retry' })).toBeInTheDocument();
+  });
+
+  it('navigates to next page', async () => {
+    const manyRecordings = Array.from({ length: 60 }, (_, i) =>
+      createMockSessionEndEvent({
+        sid: `session-${i.toString().padStart(3, '0')}`,
+        server_hostname: `server-${i.toString().padStart(2, '0')}`,
+      })
+    );
+
+    withListRecordings(manyRecordings);
+    setupTest(defaultState);
+
+    const nextButton = await screen.findByRole('button', {
+      name: 'Next page',
+    });
+    await userEvent.click(nextButton);
+
+    expect(mockHandlers.onPageChange).toHaveBeenCalledWith(1);
+  });
+
+  it('displays correct range on page 2', async () => {
+    const manyRecordings = Array.from({ length: 60 }, (_, i) =>
+      createMockSessionEndEvent({
+        sid: `session-${i.toString().padStart(3, '0')}`,
+        server_hostname: `server-${i.toString().padStart(2, '0')}`,
+      })
+    );
+
+    const stateOnPage2: RecordingsListState = {
+      ...defaultState,
+      page: 1,
+    };
+
+    withListRecordings(manyRecordings);
+    setupTest(stateOnPage2);
+
+    await screen.findByTestId('recordings-pagination-indicator');
+
+    const paginationIndicator = screen.getByTestId(
+      'recordings-pagination-indicator'
+    );
+
+    expect(paginationIndicator).toHaveTextContent('Showing 51 - 60 of 60');
+  });
+
+  it('disables next button on last page', async () => {
+    const stateOnLastPage: RecordingsListState = {
+      ...defaultState,
+      page: 0,
+    };
+
+    withListRecordings();
+    setupTest(stateOnLastPage);
+
+    const nextButton = await screen.findByRole('button', {
+      name: 'Next page',
+    });
+
+    expect(nextButton).toBeDisabled();
+  });
+
+  it('disables previous button on first page', async () => {
+    withListRecordings();
+    setupTest();
+
+    const prevButton = await screen.findByRole('button', {
+      name: 'Previous page',
+    });
+
+    expect(prevButton).toBeDisabled();
+  });
+});
+
+describe('search', () => {
+  it('displays search input field', async () => {
+    withListRecordings();
+    setupTest();
+
+    const searchInput = await screen.findByPlaceholderText('Search...');
+
+    expect(searchInput).toBeInTheDocument();
+  });
+
+  it('filters recordings based on search', async () => {
+    const stateWithSearch: RecordingsListState = {
+      ...defaultState,
+      search: 'server-01',
+    };
+
+    withListRecordings();
+    setupTest(stateWithSearch);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('k8s-cluster')).not.toBeInTheDocument();
+    expect(screen.queryByText('server-03')).not.toBeInTheDocument();
+  });
+
+  it('calls onSearchChange when enter is pressed', async () => {
+    withListRecordings();
+    setupTest();
+
+    const searchInput = await screen.findByPlaceholderText('Search...');
+
+    await userEvent.clear(searchInput);
+    await userEvent.type(searchInput, 'test search');
+    await userEvent.keyboard('{Enter}');
+
+    expect(mockHandlers.onSearchChange).toHaveBeenCalled();
+    expect(mockHandlers.onSearchChange).toHaveBeenLastCalledWith('test search');
+  });
+
+  it('shows correct search value in input', async () => {
+    const stateWithSearch: RecordingsListState = {
+      ...defaultState,
+      search: 'existing search',
+    };
+
+    withListRecordings();
+    setupTest(stateWithSearch);
+
+    const searchInput = await screen.findByPlaceholderText('Search...');
+
+    expect(searchInput).toHaveValue('existing search');
+  });
+
+  it('applies search with other filters simultaneously', async () => {
+    const stateWithSearchAndFilters: RecordingsListState = {
+      ...defaultState,
+      filters: {
+        ...defaultState.filters,
+        types: ['ssh' as RecordingType],
+      },
+      search: '03',
+    };
+
+    withListRecordings();
+    setupTest(stateWithSearchAndFilters);
+
+    expect(await screen.findByText('server-03')).toBeInTheDocument();
+
+    expect(screen.queryByText('server-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('desktop-02')).not.toBeInTheDocument();
+    expect(screen.queryByText('database-01')).not.toBeInTheDocument();
+    expect(screen.queryByText('k8s-cluster')).not.toBeInTheDocument();
+  });
+
+  it('handles empty search value', async () => {
+    const stateWithEmptySearch: RecordingsListState = {
+      ...defaultState,
+      search: '',
+    };
+
+    withListRecordings();
+    setupTest(stateWithEmptySearch);
+
+    expect(await screen.findByText('server-01')).toBeInTheDocument();
+
+    expect(screen.getByText('desktop-02')).toBeInTheDocument();
+    expect(screen.getByText('database-01')).toBeInTheDocument();
+    expect(screen.getByText('k8s-cluster//')).toBeInTheDocument();
+    expect(screen.getByText('server-03')).toBeInTheDocument();
+  });
+
+  it('clears search when user clears the input', async () => {
+    const stateWithSearch: RecordingsListState = {
+      ...defaultState,
+      search: 'some search',
+    };
+
+    withListRecordings();
+    setupTest(stateWithSearch);
+
+    const searchInput = await screen.findByPlaceholderText('Search...');
+
+    await userEvent.clear(searchInput);
+    await userEvent.type(searchInput, '{Enter}');
+
+    expect(mockHandlers.onSearchChange).toHaveBeenCalledWith('');
+  });
+});
+
+describe('view modes', () => {
+  it('switches between card and list view', async () => {
+    withListRecordings();
+    setupTest();
+
+    expect(
+      await screen.findByLabelText('View Mode Switch')
+    ).toBeInTheDocument();
+
+    const cardOption = screen.getByRole('radio', {
+      name: 'Card View',
+    });
+    await userEvent.click(cardOption);
+
+    expect(localStorage.getItem(KeysEnum.SESSION_RECORDINGS_VIEW_MODE)).toBe(
+      JSON.stringify(ViewMode.Card)
+    );
+
+    const listOption = screen.getByRole('radio', {
+      name: 'List View',
+    });
+    await userEvent.click(listOption);
+
+    expect(localStorage.getItem(KeysEnum.SESSION_RECORDINGS_VIEW_MODE)).toBe(
+      JSON.stringify(ViewMode.List)
+    );
+  });
+
+  it('switches between comfortable and compact density', async () => {
+    withListRecordings();
+    setupTest();
+
+    expect(await screen.findByLabelText('Density Switch')).toBeInTheDocument();
+
+    const compactOption = screen.getByRole('radio', {
+      name: 'Compact View',
+    });
+    await userEvent.click(compactOption);
+
+    expect(localStorage.getItem(KeysEnum.SESSION_RECORDINGS_DENSITY)).toBe(
+      JSON.stringify(Density.Compact)
+    );
+
+    const comfortableOption = screen.getByRole('radio', {
+      name: 'Comfortable View',
+    });
+    await userEvent.click(comfortableOption);
+
+    expect(localStorage.getItem(KeysEnum.SESSION_RECORDINGS_DENSITY)).toBe(
+      JSON.stringify(Density.Comfortable)
+    );
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingsList.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingsList.tsx
new file mode 100644
index 0000000000000..0b65a9c2540a5
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingsList.tsx
@@ -0,0 +1,480 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useMemo,
+  useRef,
+  useState,
+  type CSSProperties,
+} from 'react';
+import styled, { useTheme } from 'styled-components';
+
+import { Danger } from 'design/Alert';
+import Box from 'design/Box';
+import InputSearch from 'design/DataTable/InputSearch';
+import Flex, { Stack } from 'design/Flex';
+import Text from 'design/Text';
+import {
+  SortItem,
+  SortMenu,
+  SortOrder,
+} from 'shared/components/Controls/SortMenuV2';
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
+import { ClusterDropdown } from 'teleport/components/ClusterDropdown/ClusterDropdown';
+import type { Recording } from 'teleport/services/recordings';
+import { useSuspenseInfiniteListRecordings } from 'teleport/services/recordings/hooks';
+import { KeysEnum } from 'teleport/services/storageService';
+import { generateTerminalSVGStyleTag } from 'teleport/SessionRecordings/svg';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+import useTeleport from 'teleport/useTeleport';
+
+import {
+  RecordingFilters,
+  type RecordingFilterOptions,
+} from './RecordingFilters';
+import { RecordingItem, type ActionSlot } from './RecordingItem';
+import { RecordingsPagination } from './RecordingsPagination';
+import type {
+  RecordingsListFilterKey,
+  RecordingsListFilters,
+  RecordingsListState,
+} from './state';
+import { Density, ViewMode, ViewSwitcher } from './ViewSwitcher';
+
+interface RecordingsListProps {
+  actionSlot?: ActionSlot;
+  onFilterChange: (
+    key: RecordingsListFilterKey,
+    value: string[] | boolean
+  ) => void;
+  onPageChange: (page: number) => void;
+  onSearchChange: (search: string) => void;
+  onSortChange: (key: string, dir: SortOrder) => void;
+  state: RecordingsListState;
+}
+
+interface RecordingsGridProps {
+  viewMode: ViewMode;
+  density: Density;
+}
+
+const sortFieldOptions: SortItem[] = [
+  {
+    label: 'Type',
+    key: 'type',
+    ascendingLabel: 'Type, A - Z',
+    descendingLabel: 'Type, Z - A',
+    ascendingOptionLabel: 'Alphabetical, A - Z',
+    descendingOptionLabel: 'Alphabetical, Z - A',
+    defaultOrder: 'ASC',
+  },
+  {
+    label: 'Date',
+    key: 'date',
+    ascendingLabel: 'Oldest',
+    descendingLabel: 'Newest',
+    ascendingOptionLabel: 'Oldest',
+    descendingOptionLabel: 'Newest',
+    defaultOrder: 'DESC',
+  },
+];
+
+const RecordingsGrid = styled.div<RecordingsGridProps>(p => {
+  const base: CSSProperties = {
+    display: 'grid',
+    minHeight: 0,
+    gap: `${p.theme.space[3]}px`,
+  };
+
+  if (p.viewMode === ViewMode.List) {
+    return {
+      ...base,
+      gridAutoRows: p.density === Density.Comfortable ? '200px' : '120px',
+      gridTemplateColumns: '1fr',
+    };
+  }
+
+  return {
+    ...base,
+    gridAutoRows: p.density === Density.Comfortable ? '300px' : '250px',
+    gridTemplateColumns:
+      p.density === Density.Comfortable
+        ? 'repeat(auto-fill, minmax(500px, 1fr))'
+        : 'repeat(auto-fill, minmax(320px, 1fr))',
+  };
+});
+
+const pageSize = 50;
+
+const ScrollContainer = styled.div`
+  flex: 1 1 0;
+  overflow-y: auto;
+  min-height: 0;
+  width: 100%;
+  box-sizing: border-box;
+  border-top: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  padding: ${p => p.theme.space[4]}px ${p => p.theme.space[6]}px;
+`;
+
+export function RecordingsList({
+  actionSlot,
+  onFilterChange,
+  onPageChange,
+  onSearchChange,
+  onSortChange,
+  state,
+}: RecordingsListProps) {
+  const ctx = useTeleport();
+  const theme = useTheme();
+
+  const { clusterId } = useStickyClusterId();
+
+  const scrollRef = useRef<HTMLDivElement>(null);
+
+  const [clusterErrorMessage, setClusterErrorMessage] = useState('');
+
+  const [viewMode, setViewMode] = useLocalStorage(
+    KeysEnum.SESSION_RECORDINGS_VIEW_MODE,
+    ViewMode.Card
+  );
+  const [density, setDensity] = useLocalStorage(
+    KeysEnum.SESSION_RECORDINGS_DENSITY,
+    Density.Comfortable
+  );
+
+  const { data, isFetchNextPageError, fetchNextPage, hasNextPage, isFetching } =
+    useSuspenseInfiniteListRecordings(
+      {
+        clusterId,
+        params: {
+          from: state.range.from,
+          to: state.range.to,
+        },
+      },
+      {
+        getNextPageParam: lastPage =>
+          // empty strings will indicate more pages, so we use undefined to indicate no more pages
+          lastPage.startKey ? lastPage.startKey : undefined,
+        initialPageParam: '',
+      }
+    );
+
+  const allRecordings = useMemo(
+    () => data.pages.flatMap(page => page.recordings),
+    [data]
+  );
+
+  const filterOptions = useMemo(
+    () => createFilterOptions(allRecordings),
+    [allRecordings]
+  );
+
+  const recordings = useMemo(
+    () =>
+      filterRecordings(allRecordings, state.filters, state.search).toSorted(
+        createRecordingsSortFunction(state.sortKey, state.sortDirection)
+      ),
+    [
+      allRecordings,
+      state.filters,
+      state.search,
+      state.sortKey,
+      state.sortDirection,
+    ]
+  );
+
+  const startIndex = state.page * pageSize;
+  const endIndex = Math.min(startIndex + pageSize, recordings.length);
+
+  const handleSortChange = useCallback(
+    (field: string, order: SortOrder) => {
+      onSortChange(field, order);
+
+      scrollRef.current?.scrollTo({ top: 0 });
+    },
+    [onSortChange]
+  );
+
+  const handleFilterChange = useCallback(
+    (key: RecordingsListFilterKey, value: string[] | boolean) => {
+      onFilterChange(key, value);
+
+      scrollRef.current?.scrollTo({ top: 0 });
+    },
+    [onFilterChange]
+  );
+
+  const handlePageChange = useCallback(
+    (page: number) => {
+      onPageChange(page);
+
+      scrollRef.current?.scrollTo({ top: 0 });
+    },
+    [onPageChange]
+  );
+
+  const thumbnailStyles = useMemo(
+    () => generateTerminalSVGStyleTag(theme),
+    [theme]
+  );
+
+  const items = useMemo(
+    () =>
+      recordings
+        .slice(startIndex, endIndex)
+        .map(recording => (
+          <RecordingItem
+            actionSlot={actionSlot}
+            key={recording.sid}
+            recording={recording}
+            thumbnailStyles={thumbnailStyles}
+            viewMode={viewMode}
+            density={density}
+          />
+        )),
+    [
+      actionSlot,
+      recordings,
+      viewMode,
+      density,
+      startIndex,
+      endIndex,
+      thumbnailStyles,
+    ]
+  );
+
+  const filtersDisabled = allRecordings.length === 0;
+
+  return (
+    <Stack
+      alignItems="stretch"
+      gap={3}
+      minHeight={0}
+      flex={1}
+      width="100%"
+      overflow="hidden"
+    >
+      {clusterErrorMessage && (
+        <Box px={6}>
+          <Danger width="100%">{clusterErrorMessage}</Danger>
+        </Box>
+      )}
+
+      <Box px={6}>
+        <InputSearch
+          searchValue={state.search}
+          setSearchValue={onSearchChange}
+        />
+      </Box>
+
+      <Flex justifyContent="space-between" px={6}>
+        <Flex gap={2}>
+          {!clusterErrorMessage && (
+            <ClusterDropdown
+              clusterLoader={ctx.clusterService}
+              clusterId={clusterId}
+              onError={setClusterErrorMessage}
+            />
+          )}
+
+          <RecordingFilters
+            disabled={filtersDisabled}
+            filters={state.filters}
+            options={filterOptions}
+            onFilterChange={handleFilterChange}
+          />
+        </Flex>
+
+        <Flex gap={2} alignItems="center">
+          <ViewSwitcher
+            viewMode={viewMode}
+            setViewMode={setViewMode}
+            density={density}
+            setDensity={setDensity}
+          />
+
+          <SortMenu
+            selectedKey={state.sortKey}
+            selectedOrder={state.sortDirection}
+            items={sortFieldOptions}
+            onChange={handleSortChange}
+          />
+
+          <RecordingsPagination
+            count={recordings.length}
+            fetchMoreAvailable={hasNextPage}
+            fetchMoreDisabled={isFetching}
+            fetchMoreError={isFetchNextPageError}
+            from={startIndex}
+            onFetchMore={fetchNextPage}
+            onPageChange={handlePageChange}
+            page={state.page}
+            pageSize={pageSize}
+            to={endIndex - 1}
+          />
+        </Flex>
+      </Flex>
+
+      <ScrollContainer data-scrollbar="default" ref={scrollRef}>
+        {items.length === 0 ? (
+          <Flex
+            alignItems="center"
+            justifyContent="center"
+            height="100%"
+            width="100%"
+            minHeight={0}
+          >
+            <Text fontSize="large" color="text.secondary">
+              No Recordings Found
+            </Text>
+          </Flex>
+        ) : (
+          <RecordingsGrid viewMode={viewMode} density={density}>
+            {items}
+          </RecordingsGrid>
+        )}
+      </ScrollContainer>
+    </Stack>
+  );
+}
+
+const searchableFields: (keyof Recording)[] = [
+  'recordingType',
+  'hostname',
+  'description',
+  'createdDate',
+  'sid',
+  'users',
+  'durationText',
+];
+
+function searchMatcher(search: string, recording: Recording): boolean {
+  if (!search) {
+    return true;
+  }
+
+  const lowerSearch = search.toLowerCase().trim();
+
+  return searchableFields.some(field => {
+    const value = recording[field];
+
+    if (typeof value === 'string') {
+      return value.toLowerCase().includes(lowerSearch);
+    }
+
+    if (value instanceof Date) {
+      return value.toISOString().toLowerCase().includes(lowerSearch);
+    }
+
+    return false;
+  });
+}
+
+function filterRecordings(
+  recordings: Recording[],
+  filters: RecordingsListFilters,
+  search: string
+): Recording[] {
+  return recordings.filter(recording => {
+    if (
+      filters.resources.length &&
+      !filters.resources.includes(recording.hostname)
+    ) {
+      return false;
+    }
+
+    if (
+      filters.types.length &&
+      !filters.types.includes(recording.recordingType)
+    ) {
+      return false;
+    }
+
+    if (filters.users.length && !filters.users.includes(recording.user)) {
+      return false;
+    }
+
+    if (filters.hideNonInteractive && !recording.playable) {
+      return false;
+    }
+
+    return searchMatcher(search, recording);
+  });
+}
+
+function createRecordingsSortFunction(
+  key: string,
+  direction: SortOrder
+): (a: Recording, b: Recording) => number {
+  return (a, b) => {
+    let valueA: string | number;
+    let valueB: string | number;
+
+    switch (key) {
+      case 'type':
+        valueA = a.recordingType;
+        valueB = b.recordingType;
+        break;
+
+      case 'date':
+        valueA = a.createdDate.getTime();
+        valueB = b.createdDate.getTime();
+        break;
+    }
+
+    if (valueA < valueB) {
+      return direction === 'ASC' ? -1 : 1;
+    }
+
+    if (valueA > valueB) {
+      return direction === 'ASC' ? 1 : -1;
+    }
+
+    if (key === 'type') {
+      // If types are equal, sort by date
+      return direction === 'ASC'
+        ? a.createdDate.getTime() - b.createdDate.getTime()
+        : b.createdDate.getTime() - a.createdDate.getTime();
+    }
+
+    return 0;
+  };
+}
+
+function createFilterOptions(recordings: Recording[]): RecordingFilterOptions {
+  const users = new Set<string>();
+  const resources = new Set<string>();
+
+  for (const recording of recordings) {
+    resources.add(recording.hostname);
+    users.add(recording.user);
+  }
+
+  return {
+    resources: Array.from(resources).map(resource => ({
+      label: resource,
+      value: resource,
+    })),
+    users: Array.from(users).map(user => ({
+      label: user,
+      value: user,
+    })),
+  };
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.test.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.test.tsx
new file mode 100644
index 0000000000000..4fd90438b0ceb
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.test.tsx
@@ -0,0 +1,322 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, userEvent } from 'design/utils/testing';
+
+import {
+  RecordingsPagination,
+  type RecordingsPaginationProps,
+} from './RecordingsPagination';
+
+const defaultProps: RecordingsPaginationProps = {
+  count: 100,
+  from: 0,
+  to: 9,
+  page: 0,
+  pageSize: 10,
+  onPageChange: jest.fn(),
+};
+
+function setupTest(props: Partial<RecordingsPaginationProps> = {}) {
+  return render(<RecordingsPagination {...defaultProps} {...props} />);
+}
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+function getPaginationIndicator() {
+  return screen.getByTestId('recordings-pagination-indicator');
+}
+
+test('renders pagination with basic information', async () => {
+  setupTest();
+
+  expect(getPaginationIndicator()).toBeInTheDocument();
+  expect(getPaginationIndicator()).toHaveTextContent('1 - 10 of 100');
+  expect(screen.getByTitle('Previous page')).toBeInTheDocument();
+  expect(screen.getByTitle('Next page')).toBeInTheDocument();
+});
+
+test('disables previous button on first page', async () => {
+  setupTest({
+    page: 0,
+    from: 0,
+    to: 9,
+  });
+
+  const prevButton = screen.getByTitle('Previous page');
+
+  expect(prevButton).toBeDisabled();
+});
+
+test('disables next button on last page', async () => {
+  setupTest({
+    page: 9,
+    from: 90,
+    to: 99,
+    count: 100,
+  });
+
+  const nextButton = screen.getByTitle('Next page');
+
+  expect(nextButton).toBeDisabled();
+});
+
+test('enables both buttons on middle page', async () => {
+  setupTest({
+    page: 5,
+    from: 50,
+    to: 59,
+  });
+
+  const prevButton = screen.getByTitle('Previous page');
+  const nextButton = screen.getByTitle('Next page');
+
+  expect(prevButton).toBeEnabled();
+  expect(nextButton).toBeEnabled();
+});
+
+test('calls onPageChange with previous page when clicking previous', async () => {
+  const onPageChange = jest.fn();
+
+  setupTest({
+    page: 5,
+    from: 50,
+    to: 59,
+    onPageChange,
+  });
+
+  const prevButton = screen.getByTitle('Previous page');
+  await userEvent.click(prevButton);
+
+  expect(onPageChange).toHaveBeenCalledWith(4);
+});
+
+test('calls onPageChange with next page when clicking next', async () => {
+  const onPageChange = jest.fn();
+
+  setupTest({
+    page: 5,
+    from: 50,
+    to: 59,
+    onPageChange,
+  });
+
+  const nextButton = screen.getByTitle('Next page');
+  await userEvent.click(nextButton);
+
+  expect(onPageChange).toHaveBeenCalledWith(6);
+});
+
+test('does not call onPageChange when clicking disabled previous button', async () => {
+  const onPageChange = jest.fn();
+
+  setupTest({
+    page: 0,
+    from: 0,
+    to: 9,
+  });
+
+  const prevButton = screen.getByTitle('Previous page');
+  await userEvent.click(prevButton);
+
+  expect(onPageChange).not.toHaveBeenCalled();
+});
+
+test('does not call onPageChange when clicking disabled next button', async () => {
+  const onPageChange = jest.fn();
+
+  setupTest({
+    page: 9,
+    from: 90,
+    to: 99,
+    count: 100,
+  });
+
+  const nextButton = screen.getByTitle('Next page');
+  await userEvent.click(nextButton);
+
+  expect(onPageChange).not.toHaveBeenCalled();
+});
+
+test('shows fetch more button when fetchMoreAvailable is true', async () => {
+  setupTest({
+    fetchMoreAvailable: true,
+    onFetchMore: jest.fn(),
+  });
+
+  expect(screen.getByText('Fetch More')).toBeInTheDocument();
+});
+
+test('does not show fetch more button when fetchMoreAvailable is false', async () => {
+  setupTest({
+    fetchMoreAvailable: false,
+    onFetchMore: jest.fn(),
+  });
+
+  expect(screen.queryByText('Fetch More')).not.toBeInTheDocument();
+});
+
+test('does not show fetch more button when onFetchMore is not provided', async () => {
+  setupTest({
+    fetchMoreAvailable: true,
+  });
+
+  expect(screen.queryByText('Fetch More')).not.toBeInTheDocument();
+});
+
+test('calls onFetchMore when clicking fetch more button', async () => {
+  const onFetchMore = jest.fn();
+
+  setupTest({
+    fetchMoreAvailable: true,
+    onFetchMore,
+  });
+
+  const fetchMoreButton = screen.getByText('Fetch More');
+  await userEvent.click(fetchMoreButton);
+
+  expect(onFetchMore).toHaveBeenCalled();
+});
+
+test('disables fetch more button when fetchMoreDisabled is true', async () => {
+  setupTest({
+    fetchMoreAvailable: true,
+    fetchMoreDisabled: true,
+    onFetchMore: jest.fn(),
+  });
+
+  const fetchMoreButton = screen.getByText('Fetch More');
+
+  expect(fetchMoreButton).toBeDisabled();
+});
+
+test('shows error message when fetchMoreError is true', async () => {
+  setupTest({
+    fetchMoreError: true,
+  });
+
+  expect(screen.getByText('An error occurred')).toBeInTheDocument();
+});
+
+test('shows retry button instead of fetch more when error occurs', async () => {
+  const onFetchMore = jest.fn();
+
+  setupTest({
+    fetchMoreAvailable: true,
+    fetchMoreError: true,
+    onFetchMore,
+  });
+
+  expect(screen.getByText('Retry')).toBeInTheDocument();
+  expect(screen.queryByText('Fetch More')).not.toBeInTheDocument();
+});
+
+test('calls onFetchMore when clicking retry button', async () => {
+  const onFetchMore = jest.fn();
+
+  setupTest({
+    fetchMoreAvailable: true,
+    fetchMoreError: true,
+    onFetchMore,
+  });
+
+  const retryButton = screen.getByText('Retry');
+  await userEvent.click(retryButton);
+
+  expect(onFetchMore).toHaveBeenCalled();
+});
+
+test('displays correct page indicator for different pages', async () => {
+  const { rerender } = setupTest({
+    page: 0,
+    from: 0,
+    to: 9,
+    count: 100,
+  });
+
+  expect(getPaginationIndicator()).toHaveTextContent('1 - 10 of 100');
+
+  rerender(
+    <RecordingsPagination
+      {...defaultProps}
+      onPageChange={jest.fn()}
+      page={5}
+      from={50}
+      to={59}
+      count={100}
+    />
+  );
+
+  expect(getPaginationIndicator()).toHaveTextContent('51 - 60 of 100');
+
+  rerender(
+    <RecordingsPagination
+      {...defaultProps}
+      onPageChange={jest.fn()}
+      page={9}
+      from={90}
+      to={99}
+      count={100}
+    />
+  );
+
+  expect(getPaginationIndicator()).toHaveTextContent('91 - 100 of 100');
+});
+
+test('handles partial last page correctly', async () => {
+  setupTest({
+    page: 10,
+    from: 100,
+    to: 104,
+    count: 105,
+    pageSize: 10,
+  });
+
+  expect(getPaginationIndicator()).toHaveTextContent('101 - 105 of 105');
+  expect(screen.getByTitle('Next page')).toBeDisabled();
+});
+
+test('handles single page correctly', async () => {
+  setupTest({
+    page: 0,
+    from: 0,
+    to: 4,
+    count: 5,
+    pageSize: 10,
+  });
+
+  expect(getPaginationIndicator()).toHaveTextContent('1 - 5 of 5');
+  expect(screen.getByTitle('Previous page')).toBeDisabled();
+  expect(screen.getByTitle('Next page')).toBeDisabled();
+});
+
+test('does not show page indicator text when there are no results', async () => {
+  setupTest({
+    page: 0,
+    from: 0,
+    to: 0,
+    count: 0,
+    pageSize: 10,
+  });
+
+  expect(screen.queryByText('Showing')).not.toBeInTheDocument();
+  expect(screen.getByTitle('Previous page')).toBeDisabled();
+  expect(screen.getByTitle('Next page')).toBeDisabled();
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.tsx b/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.tsx
new file mode 100644
index 0000000000000..14ca9bf61174a
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/RecordingsPagination.tsx
@@ -0,0 +1,123 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback } from 'react';
+
+import { PageIndicatorText } from 'design/DataTable/Pager/PageIndicatorText';
+import {
+  StyledArrowBtn,
+  StyledFetchMoreBtn,
+} from 'design/DataTable/Pager/StyledPager';
+import Flex from 'design/Flex';
+import { CircleArrowLeft, CircleArrowRight, Warning } from 'design/Icon';
+import Text from 'design/Text';
+
+export interface RecordingsPaginationProps {
+  count: number;
+  fetchMoreAvailable?: boolean;
+  fetchMoreDisabled?: boolean;
+  fetchMoreError?: boolean;
+  from: number;
+  onFetchMore?: () => void;
+  onPageChange: (page: number) => void;
+  page: number;
+  pageSize: number;
+  to: number;
+}
+
+export function RecordingsPagination({
+  count,
+  fetchMoreAvailable,
+  fetchMoreDisabled,
+  fetchMoreError,
+  from,
+  onFetchMore,
+  onPageChange,
+  page,
+  pageSize,
+  to,
+}: RecordingsPaginationProps) {
+  const handlePrevious = useCallback(() => {
+    if (page === 0) {
+      return;
+    }
+
+    onPageChange(page - 1);
+  }, [page, onPageChange]);
+
+  const maxPage = Math.ceil(count / pageSize) - 1;
+
+  const handleNext = useCallback(() => {
+    if (page >= maxPage) {
+      return;
+    }
+
+    onPageChange(page + 1);
+  }, [page, maxPage, onPageChange]);
+
+  const isPrevDisabled = from === 0;
+  const isNextDisabled = to >= count - 1;
+
+  const showFetchMore = Boolean(fetchMoreAvailable && onFetchMore);
+
+  return (
+    <>
+      <Flex
+        alignItems="center"
+        ml={3}
+        data-testid="recordings-pagination-indicator"
+      >
+        <PageIndicatorText from={from + 1} to={to + 1} count={count} />
+
+        {fetchMoreError && (
+          <Flex alignItems="center" ml={2}>
+            <Warning mr={2} color="error.main" size="small" />
+            <Text color="error.main">An error occurred</Text>
+          </Flex>
+        )}
+
+        {showFetchMore && (
+          <StyledFetchMoreBtn
+            disabled={fetchMoreDisabled}
+            onClick={onFetchMore}
+          >
+            {fetchMoreError ? 'Retry' : 'Fetch More'}
+          </StyledFetchMoreBtn>
+        )}
+      </Flex>
+      <Flex>
+        <StyledArrowBtn
+          onClick={handlePrevious}
+          title="Previous page"
+          disabled={isPrevDisabled}
+          mx={0}
+        >
+          <CircleArrowLeft />
+        </StyledArrowBtn>
+        <StyledArrowBtn
+          ml={0}
+          onClick={handleNext}
+          title="Next page"
+          disabled={isNextDisabled}
+        >
+          <CircleArrowRight />
+        </StyledArrowBtn>
+      </Flex>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/SessionSummariesCta.tsx b/web/packages/teleport/src/SessionRecordings/list/SessionSummariesCta.tsx
new file mode 100644
index 0000000000000..7a07a1e35cf9d
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/SessionSummariesCta.tsx
@@ -0,0 +1,97 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, type MouseEvent } from 'react';
+import styled from 'styled-components';
+
+import { ChatCircleSparkle, Cross } from 'design/Icon';
+import Text from 'design/Text';
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
+import { KeysEnum } from 'teleport/services/storageService';
+
+export const CtaLink = styled.a`
+  border: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  border-radius: ${p => p.theme.radii[3]}px;
+  padding: ${p =>
+    `${p.theme.space[1]}px ${p.theme.space[1]}px ${p.theme.space[1]}px calc(${p.theme.space[2]}px + ${p.theme.space[1]}px)`};
+  display: flex;
+  gap: ${p => p.theme.space[2]}px;
+  align-items: center;
+  cursor: pointer;
+  color: ${p => p.theme.colors.text.main};
+  text-decoration: none;
+
+  &:hover {
+    background: ${p => p.theme.colors.spotBackground[0]};
+  }
+`;
+
+export const DismissButton = styled.button`
+  background: transparent;
+  border: none;
+  border-radius: ${p => p.theme.radii[3]}px;
+  padding: ${p => p.theme.space[1]}px;
+  margin-left: auto;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  opacity: 0.6;
+
+  &:hover {
+    opacity: 1;
+    background: ${p => p.theme.colors.spotBackground[0]};
+  }
+`;
+
+export function SessionSummariesCta() {
+  const [dismissed, setDismissed] = useLocalStorage(
+    KeysEnum.SESSION_RECORDINGS_DISMISSED_CTA,
+    false
+  );
+
+  const handleDismiss = useCallback(
+    (event: MouseEvent) => {
+      event.preventDefault();
+      event.stopPropagation();
+
+      setDismissed(true);
+    },
+    [setDismissed]
+  );
+
+  if (dismissed) {
+    return null;
+  }
+
+  return (
+    <CtaLink
+      href="https://goteleport.com/docs/identity-security/session-summaries/"
+      target="_blank"
+    >
+      <ChatCircleSparkle size="small" />
+
+      <Text>Summarize session recordings with AI</Text>
+
+      <DismissButton onClick={handleDismiss} aria-label="Dismiss">
+        <Cross size="small" />
+      </DismissButton>
+    </CtaLink>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/ViewSwitcher.tsx b/web/packages/teleport/src/SessionRecordings/list/ViewSwitcher.tsx
new file mode 100644
index 0000000000000..e0cd369a7c866
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/ViewSwitcher.tsx
@@ -0,0 +1,129 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  GridFour,
+  GridNine,
+  Rows,
+  RowsComfortable,
+  RowsDense,
+  SquaresFour,
+} from 'design/Icon';
+import { HoverTooltip } from 'design/Tooltip';
+import {
+  ViewModeSwitchButton,
+  ViewModeSwitchContainer,
+} from 'shared/components/Controls/ViewModeSwitch';
+
+export enum ViewMode {
+  Card,
+  List,
+}
+
+export enum Density {
+  Comfortable,
+  Compact,
+}
+
+interface ViewSwitcherProps {
+  viewMode: ViewMode;
+  setViewMode: (viewMode: ViewMode) => void;
+  density: Density;
+  setDensity: (density: Density) => void;
+}
+
+export function ViewSwitcher({
+  viewMode,
+  setViewMode,
+  density,
+  setDensity,
+}: ViewSwitcherProps) {
+  return (
+    <>
+      <ViewModeSwitchContainer
+        aria-label="View Mode Switch"
+        aria-orientation="horizontal"
+        role="radiogroup"
+      >
+        <HoverTooltip tipContent="Card View">
+          <ViewModeSwitchButton
+            className={viewMode === ViewMode.Card ? 'selected' : ''}
+            onClick={() => setViewMode(ViewMode.Card)}
+            role="radio"
+            aria-label="Card View"
+            aria-checked={viewMode === ViewMode.Card}
+            first
+          >
+            <SquaresFour size="small" color="text.main" />
+          </ViewModeSwitchButton>
+        </HoverTooltip>
+        <HoverTooltip tipContent="List View">
+          <ViewModeSwitchButton
+            className={viewMode === ViewMode.List ? 'selected' : ''}
+            onClick={() => setViewMode(ViewMode.List)}
+            role="radio"
+            aria-label="List View"
+            aria-checked={viewMode === ViewMode.List}
+            last
+          >
+            <Rows size="small" color="text.main" />
+          </ViewModeSwitchButton>
+        </HoverTooltip>
+      </ViewModeSwitchContainer>
+
+      <ViewModeSwitchContainer
+        aria-label="Density Switch"
+        aria-orientation="horizontal"
+        role="radiogroup"
+      >
+        <HoverTooltip tipContent="Compact View">
+          <ViewModeSwitchButton
+            className={density === Density.Compact ? 'selected' : ''}
+            onClick={() => setDensity(Density.Compact)}
+            role="radio"
+            aria-label="Compact View"
+            aria-checked={density === Density.Compact}
+            first
+          >
+            {viewMode === ViewMode.Card ? (
+              <GridNine size="small" color="text.main" />
+            ) : (
+              <RowsDense size="small" color="text.main" />
+            )}
+          </ViewModeSwitchButton>
+        </HoverTooltip>
+        <HoverTooltip tipContent="Comfortable View">
+          <ViewModeSwitchButton
+            className={density === Density.Comfortable ? 'selected' : ''}
+            onClick={() => setDensity(Density.Comfortable)}
+            role="radio"
+            aria-label="Comfortable View"
+            aria-checked={density === Density.Comfortable}
+            last
+          >
+            {viewMode === ViewMode.Card ? (
+              <GridFour size="small" color="text.main" />
+            ) : (
+              <RowsComfortable size="small" color="text.main" />
+            )}
+          </ViewModeSwitchButton>
+        </HoverTooltip>
+      </ViewModeSwitchContainer>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/list/mock.ts b/web/packages/teleport/src/SessionRecordings/list/mock.ts
new file mode 100644
index 0000000000000..406fb491f4cd1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/mock.ts
@@ -0,0 +1,173 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { eventCodes } from 'teleport/services/audit';
+import type { SessionRecordingThumbnail } from 'teleport/services/recordings';
+
+export function createMockSessionEndEvent(overrides?: Record<string, string>) {
+  return {
+    'addr.remote': '100.119.121.67:55655',
+    cluster_name: 'teleport',
+    code: eventCodes.SESSION_END,
+    ei: 41,
+    enhanced_recording: false,
+    event: 'session.end',
+    interactive: true,
+    login: 'root',
+    namespace: 'default',
+    participants: ['admin'],
+    private_key_policy: 'none',
+    proto: 'ssh',
+    server_hostname: 'server-1',
+    server_id: 'dc247eee-742d-445b-bb30-04bfc4604061',
+    server_labels: {
+      hostname: 'instance-1',
+    },
+    server_version: '19.0.0-dev',
+    session_recording: 'node',
+    session_start: '2025-08-13T12:42:23.099789612Z',
+    session_stop: '2025-08-13T12:42:41.151765713Z',
+    sid: 'ed794e43-57a3-461c-a4a6-1a375a5bbbba',
+    time: '2025-08-13T12:42:41.152Z',
+    uid: '4a0fdcfb-fa14-4446-9c06-52c18797fdbe',
+    user: 'admin',
+    user_kind: 1,
+    ...overrides,
+  };
+}
+
+export const MOCK_EVENTS = [
+  createMockSessionEndEvent({
+    sid: 'session-001',
+    user: 'alice',
+    server_hostname: 'server-01',
+    proto: 'ssh',
+  }),
+  createMockSessionEndEvent({
+    sid: 'session-002',
+    user: 'bob',
+    desktop_name: 'desktop-02',
+    code: eventCodes.DESKTOP_SESSION_ENDED,
+    proto: 'desktop',
+    time: '2025-01-15T11:00:00Z',
+  }),
+  createMockSessionEndEvent({
+    sid: 'session-003',
+    user: 'charlie',
+    db_service: 'database-01',
+    code: eventCodes.DATABASE_SESSION_ENDED,
+    proto: 'database',
+    time: '2025-01-15T12:00:00Z',
+  }),
+  createMockSessionEndEvent({
+    sid: 'session-004',
+    user: 'alice',
+    kubernetes_cluster: 'k8s-cluster',
+    proto: 'kube',
+    time: '2025-01-15T13:00:00Z',
+  }),
+  createMockSessionEndEvent({
+    sid: 'session-005',
+    user: 'david',
+    server_hostname: 'server-03',
+    proto: 'ssh',
+    time: '2025-01-15T14:00:00Z',
+  }),
+];
+
+export const MOCK_THUMBNAIL: SessionRecordingThumbnail = {
+  svg: '<svg><rect width="100" height="100" fill="blue"/></svg>',
+  cursorX: 50,
+  cursorY: 50,
+  cursorVisible: true,
+  cols: 100,
+  rows: 100,
+  startOffset: 0,
+  endOffset: 0,
+};
+
+export function getThumbnail(thumbnail: SessionRecordingThumbnail) {
+  return http.get(cfg.api.sessionRecording.thumbnail, () => {
+    return HttpResponse.json(thumbnail);
+  });
+}
+
+export function thumbnailError() {
+  return http.get(cfg.api.sessionRecording.thumbnail, () => {
+    return HttpResponse.json(
+      { error: { message: 'Thumbnail not found' } },
+      { status: 404 }
+    );
+  });
+}
+
+export const MOCK_THUMBNAILS: SessionRecordingThumbnail[] = [
+  {
+    svg: '\u003csvg xmlns="http://www.w3.org/2000/svg" width="1812" height="1461" font-size="14" class="terminal"\u003e\u003crect width="100%" height="100%" class="bg-default"/\u003e\u003csvg x="8.4" y="8.4"\u003e\u003cg shape-rendering="crispEdges"\u003e\u003crect x="0.0" y="0.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="16.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="33.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="50.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="67.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="84.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="100.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="117.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="134.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="151.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="168.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="184.8" width="1230.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="1230.5" y="184.8" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1247.3" y="184.8" width="84.3" height="16.8" style="fill:#000033"/\u003e\u003crect x="1331.6" y="184.8" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1348.5" y="184.8" width="438.3" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="201.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="218.4" width="1247.3" height="16.8" style="fill:#000033"/\u003e\u003crect x="1247.3" y="218.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1264.2" y="218.4" width="50.6" height="16.8" style="fill:#000033"/\u003e\u003crect x="1314.8" y="218.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1331.6" y="218.4" width="455.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="235.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="252.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="268.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="285.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="302.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="319.2" width="421.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="421.4" y="319.2" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="438.3" y="319.2" width="1348.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="336.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="352.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="369.6" width="505.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="505.7" y="369.6" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="522.5" y="369.6" width="1264.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="386.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="403.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="420.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="436.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="453.6" width="809.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="809.1" y="453.6" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="825.9" y="453.6" width="960.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="470.4" width="809.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="809.1" y="470.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="825.9" y="470.4" width="960.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="487.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="504.0" width="758.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="758.5" y="504.0" width="33.7" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="792.2" y="504.0" width="16.9" height="16.8" style="fill:#000033"/\u003e\u003crect x="809.1" y="504.0" width="50.6" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="859.7" y="504.0" width="927.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="520.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="537.6" width="809.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="809.1" y="537.6" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="825.9" y="537.6" width="960.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="554.4" width="809.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="809.1" y="554.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="825.9" y="554.4" width="960.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="571.2" width="134.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="134.8" y="571.2" width="134.8" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="269.7" y="571.2" width="118.0" height="16.8" style="fill:#000033"/\u003e\u003crect x="387.7" y="571.2" width="134.8" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="522.5" y="571.2" width="134.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="657.4" y="571.2" width="118.0" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="775.4" y="571.2" width="252.8" height="16.8" style="fill:#000000"/\u003e\u003crect x="1028.2" y="571.2" width="758.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="588.0" width="758.5" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="758.5" y="588.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="775.4" y="588.0" width="252.8" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1028.2" y="588.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1045.1" y="588.0" width="741.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="604.8" width="134.8" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="134.8" y="604.8" width="134.8" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="269.7" y="604.8" width="118.0" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="387.7" y="604.8" width="134.8" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="522.5" y="604.8" width="134.8" height="16.8" style="fill:#ff0000"/\u003e\u003crect x="657.4" y="604.8" width="84.3" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="741.7" y="604.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="604.8" width="50.6" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="809.1" y="604.8" width="185.4" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="994.5" y="604.8" width="50.6" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1045.1" y="604.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="604.8" width="724.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="621.6" width="741.7" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="741.7" y="621.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="621.6" width="33.7" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="792.2" y="621.6" width="84.3" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="876.5" y="621.6" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="893.4" y="621.6" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="621.6" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="943.9" y="621.6" width="67.4" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="1011.4" y="621.6" width="33.7" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1045.1" y="621.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="621.6" width="724.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="638.4" width="741.7" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="741.7" y="638.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="638.4" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="638.4" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="809.1" y="638.4" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="825.9" y="638.4" width="118.0" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="943.9" y="638.4" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="977.6" y="638.4" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="994.5" y="638.4" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="1028.2" y="638.4" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1045.1" y="638.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="638.4" width="33.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="1095.6" y="638.4" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="1129.4" y="638.4" width="657.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="655.2" width="134.8" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="134.8" y="655.2" width="134.8" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="269.7" y="655.2" width="118.0" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="387.7" y="655.2" width="134.8" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="522.5" y="655.2" width="134.8" height="16.8" style="fill:#ff9900"/\u003e\u003crect x="657.4" y="655.2" width="84.3" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="741.7" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="655.2" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="655.2" width="151.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="943.9" y="655.2" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="977.6" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="994.5" y="655.2" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="1028.2" y="655.2" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1045.1" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="655.2" width="16.9" height="16.8" style="fill:#000033"/\u003e\u003crect x="1078.8" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1095.6" y="655.2" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1129.4" y="655.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1146.2" y="655.2" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="672.0" width="741.7" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="741.7" y="672.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="672.0" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="672.0" width="84.3" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="859.7" y="672.0" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="876.5" y="672.0" width="50.6" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="672.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="943.9" y="672.0" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="994.5" y="672.0" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="1028.2" y="672.0" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="1045.1" y="672.0" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="1078.8" y="672.0" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="1129.4" y="672.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1146.2" y="672.0" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="688.8" width="741.7" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="741.7" y="688.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="688.8" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="688.8" width="151.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="688.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="943.9" y="688.8" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="994.5" y="688.8" width="67.4" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="688.8" width="67.4" height="16.8" style="fill:#585858"/\u003e\u003crect x="1129.4" y="688.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1146.2" y="688.8" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="705.6" width="134.8" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="134.8" y="705.6" width="134.8" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="269.7" y="705.6" width="118.0" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="387.7" y="705.6" width="134.8" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="522.5" y="705.6" width="134.8" height="16.8" style="fill:#ffff00"/\u003e\u003crect x="657.4" y="705.6" width="84.3" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="741.7" y="705.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="705.6" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="705.6" width="151.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="705.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="943.9" y="705.6" width="185.4" height="16.8" style="fill:#585858"/\u003e\u003crect x="1129.4" y="705.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1146.2" y="705.6" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="722.4" width="724.8" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="724.8" y="722.4" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="722.4" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="722.4" width="101.1" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="876.5" y="722.4" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="893.4" y="722.4" width="16.9" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="910.2" y="722.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="927.1" y="722.4" width="219.1" height="16.8" style="fill:#585858"/\u003e\u003crect x="1146.2" y="722.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1163.1" y="722.4" width="623.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="739.2" width="674.2" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="674.2" y="739.2" width="84.3" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="739.2" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="739.2" width="16.9" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="792.2" y="739.2" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="809.1" y="739.2" width="101.1" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="910.2" y="739.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="927.1" y="739.2" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="977.6" y="739.2" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="994.5" y="739.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1011.4" y="739.2" width="67.4" height="16.8" style="fill:#585858"/\u003e\u003crect x="1078.8" y="739.2" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1095.6" y="739.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1112.5" y="739.2" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1146.2" y="739.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1163.1" y="739.2" width="623.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="756.0" width="134.8" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="134.8" y="756.0" width="134.8" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="269.7" y="756.0" width="118.0" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="387.7" y="756.0" width="134.8" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="522.5" y="756.0" width="134.8" height="16.8" style="fill:#66ff00"/\u003e\u003crect x="657.4" y="756.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="674.2" y="756.0" width="67.4" height="16.8" style="fill:#585858"/\u003e\u003crect x="741.7" y="756.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="756.0" width="16.9" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="775.4" y="756.0" width="134.8" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="910.2" y="756.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="927.1" y="756.0" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="977.6" y="756.0" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="1011.4" y="756.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1045.1" y="756.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="756.0" width="16.9" height="16.8" style="fill:#585858"/\u003e\u003crect x="1078.8" y="756.0" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="1112.5" y="756.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1146.2" y="756.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1163.1" y="756.0" width="623.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="772.8" width="674.2" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="674.2" y="772.8" width="50.6" height="16.8" style="fill:#000000"/\u003e\u003crect x="724.8" y="772.8" width="16.9" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="741.7" y="772.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="772.8" width="33.7" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="792.2" y="772.8" width="50.6" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="842.8" y="772.8" width="16.9" height="16.8" style="fill:#cc0066"/\u003e\u003crect x="859.7" y="772.8" width="50.6" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="910.2" y="772.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="927.1" y="772.8" width="16.9" height="16.8" style="fill:#585858"/\u003e\u003crect x="943.9" y="772.8" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="977.6" y="772.8" width="134.8" height="16.8" style="fill:#585858"/\u003e\u003crect x="1112.5" y="772.8" width="33.7" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="1146.2" y="772.8" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1163.1" y="772.8" width="623.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="789.6" width="134.8" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="134.8" y="789.6" width="134.8" height="16.8" style="fill:#000099"/\u003e\u003crect x="269.7" y="789.6" width="118.0" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="387.7" y="789.6" width="134.8" height="16.8" style="fill:#000099"/\u003e\u003crect x="522.5" y="789.6" width="134.8" height="16.8" style="fill:#0066ff"/\u003e\u003crect x="657.4" y="789.6" width="84.3" height="16.8" style="fill:#000099"/\u003e\u003crect x="741.7" y="789.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="789.6" width="50.6" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="809.1" y="789.6" width="118.0" height="16.8" style="fill:#cc6699"/\u003e\u003crect x="927.1" y="789.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="943.9" y="789.6" width="50.6" height="16.8" style="fill:#585858"/\u003e\u003crect x="994.5" y="789.6" width="101.1" height="16.8" style="fill:#000000"/\u003e\u003crect x="1095.6" y="789.6" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1129.4" y="789.6" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1146.2" y="789.6" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="806.4" width="741.7" height="16.8" style="fill:#000099"/\u003e\u003crect x="741.7" y="806.4" width="33.7" height="16.8" style="fill:#000000"/\u003e\u003crect x="775.4" y="806.4" width="168.6" height="16.8" style="fill:#ffffcc"/\u003e\u003crect x="943.9" y="806.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="960.8" y="806.4" width="151.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1112.5" y="806.4" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1129.4" y="806.4" width="657.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="823.2" width="741.7" height="16.8" style="fill:#000099"/\u003e\u003crect x="741.7" y="823.2" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="823.2" width="16.9" height="16.8" style="fill:#585858"/\u003e\u003crect x="775.4" y="823.2" width="337.1" height="16.8" style="fill:#000000"/\u003e\u003crect x="1112.5" y="823.2" width="674.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="840.0" width="134.8" height="16.8" style="fill:#000099"/\u003e\u003crect x="134.8" y="840.0" width="134.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="269.7" y="840.0" width="118.0" height="16.8" style="fill:#000099"/\u003e\u003crect x="387.7" y="840.0" width="134.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="522.5" y="840.0" width="134.8" height="16.8" style="fill:#000099"/\u003e\u003crect x="657.4" y="840.0" width="84.3" height="16.8" style="fill:#000033"/\u003e\u003crect x="741.7" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="758.5" y="840.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="792.2" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="809.1" y="840.0" width="16.9" height="16.8" style="fill:#000033"/\u003e\u003crect x="825.9" y="840.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="859.7" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="876.5" y="840.0" width="101.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="977.6" y="840.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1011.4" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1028.2" y="840.0" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1045.1" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1061.9" y="840.0" width="33.7" height="16.8" style="fill:#585858"/\u003e\u003crect x="1095.6" y="840.0" width="16.9" height="16.8" style="fill:#000000"/\u003e\u003crect x="1112.5" y="840.0" width="674.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="856.8" width="741.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="741.7" y="856.8" width="50.6" height="16.8" style="fill:#000000"/\u003e\u003crect x="792.2" y="856.8" width="33.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="825.9" y="856.8" width="50.6" height="16.8" style="fill:#000000"/\u003e\u003crect x="876.5" y="856.8" width="101.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="977.6" y="856.8" width="50.6" height="16.8" style="fill:#000000"/\u003e\u003crect x="1028.2" y="856.8" width="33.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="1061.9" y="856.8" width="50.6" height="16.8" style="fill:#000000"/\u003e\u003crect x="1112.5" y="856.8" width="674.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="873.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="890.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="907.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="924.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="940.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="957.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="974.4" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="640.5" y="974.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="657.4" y="974.4" width="1129.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="991.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1008.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1024.8" width="590.0" height="16.8" style="fill:#000033"/\u003e\u003crect x="590.0" y="1024.8" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="606.8" y="1024.8" width="67.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="674.2" y="1024.8" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="691.1" y="1024.8" width="1095.6" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1041.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1058.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1075.2" width="640.5" height="16.8" style="fill:#000033"/\u003e\u003crect x="640.5" y="1075.2" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="657.4" y="1075.2" width="1129.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1092.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1108.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1125.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1142.4" width="1314.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="1314.8" y="1142.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1331.6" y="1142.4" width="455.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1159.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1176.0" width="1264.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="1264.2" y="1176.0" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1281.1" y="1176.0" width="505.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1192.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1209.6" width="1281.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="1281.1" y="1209.6" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1297.9" y="1209.6" width="50.6" height="16.8" style="fill:#000033"/\u003e\u003crect x="1348.5" y="1209.6" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1365.3" y="1209.6" width="421.4" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1226.4" width="1314.8" height="16.8" style="fill:#000033"/\u003e\u003crect x="1314.8" y="1226.4" width="16.9" height="16.8" style="fill:#ffffff"/\u003e\u003crect x="1331.6" y="1226.4" width="455.1" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1243.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1260.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1276.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1293.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1310.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1327.2" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1344.0" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1360.8" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1377.6" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1394.4" width="1786.7" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1411.2" width="1795.2" height="16.8" style="fill:#000033"/\u003e\u003crect x="0.0" y="1428.0" width="1795.2" height="16.8" style="fill:#000033"/\u003e\u003c/g\u003e\u003ctext\u003e\u003ctspan y="1411.2" dy="1em"\u003e\u003ctspan x="766.9" class="fg-15 b"\u003eYou\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-15 b"\u003ehave\u003c/tspan\u003e\u003ctspan x="842.8" class="fg-15 b"\u003enyaned\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-15 b"\u003efor\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-15 b"\u003e1\u003c/tspan\u003e\u003ctspan x="952.4" class="fg-15 b"\u003eseconds!\u003c/tspan\u003e\u003c/tspan\u003e\u003c/text\u003e\u003c/svg\u003e\u003c/svg\u003e',
+    cols: 213,
+    rows: 86,
+    cursorX: 0,
+    cursorY: 20,
+    cursorVisible: false,
+    startOffset: 7267,
+    endOffset: 8266,
+  },
+  {
+    svg: '\u003csvg xmlns="http://www.w3.org/2000/svg" width="2149" height="2066" font-size="14" class="terminal"\u003e\u003crect width="100%" height="100%" class="bg-default"/\u003e\u003csvg x="8.4" y="8.4"\u003e\u003cg shape-rendering="crispEdges"\u003e\u003crect x="143.3" y="504.0" width="8.4" height="16.8" class="bg-6"/\u003e\u003crect x="143.3" y="520.8" width="8.4" height="16.8" class="bg-6"/\u003e\u003crect x="59.0" y="924.0" width="101.1" height="16.8" class="bg-6"/\u003e\u003crect x="126.4" y="940.8" width="8.4" height="16.8" class="bg-7"/\u003e\u003c/g\u003e\u003ctext\u003e\u003ctspan y="0.0" dy="1em"\u003e\u003ctspan x="0.0"\u003eroot@node2:~#\u003c/tspan\u003e\u003ctspan x="118.0"\u003eping\u003c/tspan\u003e\u003ctspan x="160.1"\u003egoogle.com\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="16.8" dy="1em"\u003e\u003ctspan x="0.0"\u003ePING\u003c/tspan\u003e\u003ctspan x="42.1"\u003egoogle.com\u003c/tspan\u003e\u003ctspan x="134.8"\u003e(142.250.179.174)\u003c/tspan\u003e\u003ctspan x="286.6"\u003e56(84)\u003c/tspan\u003e\u003ctspan x="345.5"\u003ebytes\u003c/tspan\u003e\u003ctspan x="396.1"\u003eof\u003c/tspan\u003e\u003ctspan x="421.4"\u003edata.\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="33.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=1\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.82\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="50.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=2\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.83\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="67.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=3\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.88\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="84.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=4\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.85\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="100.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=5\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.70\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="117.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e^C\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="134.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e---\u003c/tspan\u003e\u003ctspan x="33.7"\u003egoogle.com\u003c/tspan\u003e\u003ctspan x="126.4"\u003eping\u003c/tspan\u003e\u003ctspan x="168.6"\u003estatistics\u003c/tspan\u003e\u003ctspan x="261.3"\u003e---\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="151.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e5\u003c/tspan\u003e\u003ctspan x="16.9"\u003epackets\u003c/tspan\u003e\u003ctspan x="84.3"\u003etransmitted,\u003c/tspan\u003e\u003ctspan x="193.8"\u003e5\u003c/tspan\u003e\u003ctspan x="210.7"\u003ereceived,\u003c/tspan\u003e\u003ctspan x="295.0"\u003e0%\u003c/tspan\u003e\u003ctspan x="320.3"\u003epacket\u003c/tspan\u003e\u003ctspan x="379.3"\u003eloss,\u003c/tspan\u003e\u003ctspan x="429.8"\u003etime\u003c/tspan\u003e\u003ctspan x="472.0"\u003e4005ms\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="168.0" dy="1em"\u003e\u003ctspan x="0.0"\u003ertt\u003c/tspan\u003e\u003ctspan x="33.7"\u003emin/avg/max/mdev\u003c/tspan\u003e\u003ctspan x="177.0"\u003e=\u003c/tspan\u003e\u003ctspan x="193.8"\u003e3.704/3.815/3.877/0.059\u003c/tspan\u003e\u003ctspan x="396.1"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="184.8" dy="1em"\u003e\u003ctspan x="0.0"\u003eroot@node2:~#\u003c/tspan\u003e\u003ctspan x="118.0"\u003ecurl\u003c/tspan\u003e\u003ctspan x="160.1"\u003ev2.wttr.in\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="201.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e┌┤\u003c/tspan\u003e\u003ctspan x="33.7"\u003eWeather\u003c/tspan\u003e\u003ctspan x="101.1"\u003ereport\u003c/tspan\u003e\u003ctspan x="160.1"\u003efor:\u003c/tspan\u003e\u003ctspan x="202.3"\u003eArnhem,\u003c/tspan\u003e\u003ctspan x="269.7"\u003eNetherlands\u003c/tspan\u003e\u003ctspan x="379.3"\u003e├───────────────────────────┐\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="218.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="235.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="252.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="67.4"\u003eTue\u003c/tspan\u003e\u003ctspan x="101.1"\u003e02\u003c/tspan\u003e\u003ctspan x="126.4"\u003eSep\u003c/tspan\u003e\u003ctspan x="269.7"\u003eWed\u003c/tspan\u003e\u003ctspan x="303.4"\u003e03\u003c/tspan\u003e\u003ctspan x="328.7"\u003eSep\u003c/tspan\u003e\u003ctspan x="472.0"\u003eThu\u003c/tspan\u003e\u003ctspan x="505.7"\u003e04\u003c/tspan\u003e\u003ctspan x="531.0"\u003eSep\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="268.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="202.3"\u003e╷\u003c/tspan\u003e\u003ctspan x="404.5"\u003e╷\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="285.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="302.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="319.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="8.4" class="b"\u003e+24\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-9 b"\u003e⡠⠢⡀\u003c/tspan\u003e\u003ctspan x="311.8" class="fg-9 b"\u003e⢀⠔⠉⠑⠢⢄⡀\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-9 b"\u003e⢀⠤⡄\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="336.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="109.6" class="fg-3"\u003e⢀⠎\u003c/tspan\u003e\u003ctspan x="143.3" class="fg-3"\u003e⠑⡄\u003c/tspan\u003e\u003ctspan x="311.8" class="fg-3"\u003e⡜\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-3"\u003e⠈⢆\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-3"\u003e⡰⠁\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-3"\u003e⠈⡆\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="352.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="109.6" class="fg-11 b"\u003e⡎\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-11 b"\u003e⠘⡄\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-11 b"\u003e⢰⠁\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-11 b"\u003e⢣\u003c/tspan\u003e\u003ctspan x="522.5" class="fg-11 b"\u003e⡰⠁\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-11 b"\u003e⠨⡀\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="369.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-11 b"\u003e⡸\u003c/tspan\u003e\u003ctspan x="160.1" class="fg-11 b"\u003e⠰⡀\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-11 b"\u003e⡎\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-11 b"\u003e⢣\u003c/tspan\u003e\u003ctspan x="514.1" class="fg-11 b"\u003e⡰⠁\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-11 b"\u003e⢣\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="386.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="92.7" class="fg-10 b"\u003e⢠⠃\u003c/tspan\u003e\u003ctspan x="168.6" class="fg-10 b"\u003e⠱⠄\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-10 b"\u003e⢰⠁\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-10 b"\u003e⠑⠤⣀\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-10 b"\u003e⢠⠃\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-10 b"\u003e⠈⡆\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="403.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="92.7" class="fg-2"\u003e⡎\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-2"\u003e⠑⡄\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-2"\u003e⡇\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-2"\u003e⠉⠢⡀\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-2"\u003e⢀⠇\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-2"\u003e⠸⡀\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="420.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="84.3" class="fg-2"\u003e⡸\u003c/tspan\u003e\u003ctspan x="185.4" class="fg-2"\u003e⠈⢆\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-2"\u003e⡜\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-2"\u003e⠑⡄\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-2"\u003e⡎\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-2"\u003e⢣\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="436.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-6"\u003e⢠⠃\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-6"\u003e⠑⢄⡀\u003c/tspan\u003e\u003ctspan x="236.0" class="fg-6"\u003e⣀⣀⣀⣀⣀⠔⠁\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003e⠈⢆\u003c/tspan\u003e\u003ctspan x="488.8" class="fg-6"\u003e⡜\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-6"\u003e⠣⡀\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="453.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="8.4" class="fg-14 b"\u003e⣀\u003c/tspan\u003e\u003ctspan x="67.4" class="fg-14 b"\u003e⠠⠃\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-14 b"\u003e⠈⠉\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-14 b"\u003e⠢⡠⠎\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="470.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="8.4" class="b"\u003e+13\u003c/tspan\u003e\u003ctspan x="33.7" class="fg-14 b"\u003e⢄⣀⢁⡠⠃\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="487.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="504.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│─────┴─────┼────\u003c/tspan\u003e\u003ctspan x="143.3"\u003e─\u003c/tspan\u003e\u003ctspan x="151.7"\u003e┴─────╂─────┴─────┼─────┴─────╂─────┴─────┼─────┴─────╂│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="520.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="50.6"\u003e6\u003c/tspan\u003e\u003ctspan x="92.7"\u003e12\u003c/tspan\u003e\u003ctspan x="143.3"\u003e1\u003c/tspan\u003e\u003ctspan x="151.7"\u003e8\u003c/tspan\u003e\u003ctspan x="252.8"\u003e6\u003c/tspan\u003e\u003ctspan x="295.0"\u003e12\u003c/tspan\u003e\u003ctspan x="345.5"\u003e18\u003c/tspan\u003e\u003ctspan x="455.1"\u003e6\u003c/tspan\u003e\u003ctspan x="497.3"\u003e12\u003c/tspan\u003e\u003ctspan x="547.8"\u003e18\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="537.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="554.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="463.5" style="fill:#0066ff"\u003e0.39mm|97%\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="571.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="497.3" style="fill:#0000ff"\u003e▅█\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="588.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="396.1" style="fill:#0000ff"\u003e▅▃\u003c/tspan\u003e\u003ctspan x="497.3" style="fill:#0000ff"\u003e██▃\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="604.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="387.7" style="fill:#0000ff"\u003e▅██\u003c/tspan\u003e\u003ctspan x="488.8" style="fill:#0000ff"\u003e▇███\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="621.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="236.0" style="fill:#0000ff"\u003e_▁\u003c/tspan\u003e\u003ctspan x="387.7" style="fill:#0000ff"\u003e████\u003c/tspan\u003e\u003ctspan x="488.8" style="fill:#0000ff"\u003e████\u003c/tspan\u003e\u003ctspan x="522.5" style="fill:#000066"\u003e▁\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="638.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="219.1" style="fill:#000000"\u003e_\u003c/tspan\u003e\u003ctspan x="227.6" style="fill:#0000cc"\u003e▄\u003c/tspan\u003e\u003ctspan x="236.0" style="fill:#0000ff"\u003e███\u003c/tspan\u003e\u003ctspan x="261.3" style="fill:#000099"\u003e▂\u003c/tspan\u003e\u003ctspan x="337.1" style="fill:#0000ff"\u003e_\u003c/tspan\u003e\u003ctspan x="379.3" style="fill:#000033"\u003e█\u003c/tspan\u003e\u003ctspan x="387.7" style="fill:#0000ff"\u003e████\u003c/tspan\u003e\u003ctspan x="421.4" style="fill:#000033"\u003e▂\u003c/tspan\u003e\u003ctspan x="480.4" style="fill:#000033"\u003e▅\u003c/tspan\u003e\u003ctspan x="488.8" style="fill:#0000ff"\u003e████\u003c/tspan\u003e\u003ctspan x="522.5" style="fill:#000066"\u003e█\u003c/tspan\u003e\u003ctspan x="564.7" style="fill:#000000"\u003e▁_\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="655.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="672.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="688.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="16.9"\u003e☀️\u003c/tspan\u003e\u003ctspan x="50.6"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="75.9"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="101.1"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="126.4"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="151.7"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="177.0"\u003e☁️\u003c/tspan\u003e\u003ctspan x="210.7"\u003e🌦\u003c/tspan\u003e\u003ctspan x="236.0"\u003e☁️\u003c/tspan\u003e\u003ctspan x="269.7"\u003e🌦\u003c/tspan\u003e\u003ctspan x="295.0"\u003e☁️\u003c/tspan\u003e\u003ctspan x="328.7"\u003e☁️\u003c/tspan\u003e\u003ctspan x="362.4"\u003e☁️\u003c/tspan\u003e\u003ctspan x="396.1"\u003e🌦\u003c/tspan\u003e\u003ctspan x="421.4"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="446.7"\u003e🌦\u003c/tspan\u003e\u003ctspan x="472.0"\u003e☁️\u003c/tspan\u003e\u003ctspan x="505.7"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="531.0"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="556.2"\u003e🌦\u003c/tspan\u003e\u003ctspan x="581.5"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="606.8"\u003e☁️\u003c/tspan\u003e\u003ctspan x="640.5"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="665.8"\u003e⛅️│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="705.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="16.9" style="fill:#bcbcbc"\u003e↑\u003c/tspan\u003e\u003ctspan x="42.1" style="fill:#949494"\u003e↗\u003c/tspan\u003e\u003ctspan x="67.4" style="fill:#949494"\u003e↗\u003c/tspan\u003e\u003ctspan x="92.7" style="fill:#ff9900"\u003e↗\u003c/tspan\u003e\u003ctspan x="118.0" style="fill:#ff9900"\u003e↗\u003c/tspan\u003e\u003ctspan x="143.3" style="fill:#ff9900"\u003e↗\u003c/tspan\u003e\u003ctspan x="168.6" style="fill:#dadada"\u003e↑\u003c/tspan\u003e\u003ctspan x="193.8" style="fill:#dadada"\u003e↗\u003c/tspan\u003e\u003ctspan x="219.1" style="fill:#ff9900"\u003e↑\u003c/tspan\u003e\u003ctspan x="244.4" style="fill:#ff9900"\u003e↑\u003c/tspan\u003e\u003ctspan x="269.7" style="fill:#ff9900"\u003e↑\u003c/tspan\u003e\u003ctspan x="295.0" style="fill:#ff6600"\u003e↑\u003c/tspan\u003e\u003ctspan x="320.3" style="fill:#ff3300"\u003e↑\u003c/tspan\u003e\u003ctspan x="345.5" style="fill:#ff3300"\u003e↗\u003c/tspan\u003e\u003ctspan x="370.8" style="fill:#ff3300"\u003e↑\u003c/tspan\u003e\u003ctspan x="396.1" style="fill:#ff6600"\u003e↗\u003c/tspan\u003e\u003ctspan x="421.4" style="fill:#ff9900"\u003e↗\u003c/tspan\u003e\u003ctspan x="446.7" style="fill:#dadada"\u003e↗\u003c/tspan\u003e\u003ctspan x="472.0" style="fill:#bcbcbc"\u003e↑\u003c/tspan\u003e\u003ctspan x="497.3" style="fill:#dadada"\u003e↑\u003c/tspan\u003e\u003ctspan x="522.5" style="fill:#ff6600"\u003e↗\u003c/tspan\u003e\u003ctspan x="547.8" style="fill:#ff6600"\u003e↗\u003c/tspan\u003e\u003ctspan x="573.1" style="fill:#dadada"\u003e→\u003c/tspan\u003e\u003ctspan x="598.4" style="fill:#6c6c6c"\u003e↗\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="722.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="16.9" style="fill:#bcbcbc"\u003e13\u003c/tspan\u003e\u003ctspan x="42.1" style="fill:#949494"\u003e11\u003c/tspan\u003e\u003ctspan x="67.4" style="fill:#949494"\u003e12\u003c/tspan\u003e\u003ctspan x="92.7" style="fill:#ff9900"\u003e20\u003c/tspan\u003e\u003ctspan x="118.0" style="fill:#ff9900"\u003e22\u003c/tspan\u003e\u003ctspan x="143.3" style="fill:#ff9900"\u003e20\u003c/tspan\u003e\u003ctspan x="168.6" style="fill:#dadada"\u003e18\u003c/tspan\u003e\u003ctspan x="193.8" style="fill:#dadada"\u003e19\u003c/tspan\u003e\u003ctspan x="219.1" style="fill:#ff9900"\u003e20\u003c/tspan\u003e\u003ctspan x="244.4" style="fill:#ff9900"\u003e22\u003c/tspan\u003e\u003ctspan x="269.7" style="fill:#ff9900"\u003e22\u003c/tspan\u003e\u003ctspan x="295.0" style="fill:#ff6600"\u003e27\u003c/tspan\u003e\u003ctspan x="320.3" style="fill:#ff3300"\u003e31\u003c/tspan\u003e\u003ctspan x="345.5" style="fill:#ff3300"\u003e31\u003c/tspan\u003e\u003ctspan x="370.8" style="fill:#ff3300"\u003e31\u003c/tspan\u003e\u003ctspan x="396.1" style="fill:#ff6600"\u003e24\u003c/tspan\u003e\u003ctspan x="421.4" style="fill:#ff9900"\u003e21\u003c/tspan\u003e\u003ctspan x="446.7" style="fill:#dadada"\u003e16\u003c/tspan\u003e\u003ctspan x="472.0" style="fill:#bcbcbc"\u003e13\u003c/tspan\u003e\u003ctspan x="497.3" style="fill:#dadada"\u003e18\u003c/tspan\u003e\u003ctspan x="522.5" style="fill:#ff6600"\u003e24\u003c/tspan\u003e\u003ctspan x="547.8" style="fill:#ff6600"\u003e25\u003c/tspan\u003e\u003ctspan x="573.1" style="fill:#dadada"\u003e18\u003c/tspan\u003e\u003ctspan x="598.4" style="fill:#6c6c6c"\u003e6\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="739.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="756.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e│🌔\u003c/tspan\u003e\u003ctspan x="193.8"\u003e🌔\u003c/tspan\u003e\u003ctspan x="387.7"\u003e🌔\u003c/tspan\u003e\u003ctspan x="573.1"\u003e🌔│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="772.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="50.6"\u003e─━━━━━━━━━━━━━─\u003c/tspan\u003e\u003ctspan x="252.8"\u003e─━━━━━━━━━━━━━─\u003c/tspan\u003e\u003ctspan x="455.1"\u003e─━━━━━━━━━━━━━─\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="789.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="806.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e│\u003c/tspan\u003e\u003ctspan x="615.2"\u003e│\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="823.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e└────────────────────────────────────────────────────────────────────────┘\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="840.0" dy="1em"\u003e\u003ctspan x="0.0"\u003eWeather:\u003c/tspan\u003e\u003ctspan x="75.9"\u003e⛅️\u003c/tspan\u003e\u003ctspan x="109.6"\u003ePartly\u003c/tspan\u003e\u003ctspan x="168.6"\u003ecloudy,\u003c/tspan\u003e\u003ctspan x="236.0"\u003e+21°C,\u003c/tspan\u003e\u003ctspan x="295.0"\u003e46%,\u003c/tspan\u003e\u003ctspan x="337.1"\u003e↗19km/h,\u003c/tspan\u003e\u003ctspan x="413.0"\u003e1007hPa\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="856.8" dy="1em"\u003e\u003ctspan x="0.0"\u003eTimezone:\u003c/tspan\u003e\u003ctspan x="84.3"\u003eEurope/Amsterdam\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="873.6" dy="1em"\u003e\u003ctspan x="16.9"\u003eNow:\u003c/tspan\u003e\u003ctspan x="84.3"\u003e16:48:42+0200\u003c/tspan\u003e\u003ctspan x="202.3"\u003e|\u003c/tspan\u003e\u003ctspan x="219.1"\u003eDawn:\u003c/tspan\u003e\u003ctspan x="295.0"\u003e06:14:29\u003c/tspan\u003e\u003ctspan x="379.3"\u003e|\u003c/tspan\u003e\u003ctspan x="396.1"\u003eSunrise:\u003c/tspan\u003e\u003ctspan x="472.0"\u003e06:50:25\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="890.4" dy="1em"\u003e\u003ctspan x="16.9"\u003eZenith:\u003c/tspan\u003e\u003ctspan x="84.3"\u003e13:36:16\u003c/tspan\u003e\u003ctspan x="202.3"\u003e|\u003c/tspan\u003e\u003ctspan x="219.1"\u003eSunset:\u003c/tspan\u003e\u003ctspan x="295.0"\u003e20:20:43\u003c/tspan\u003e\u003ctspan x="379.3"\u003e|\u003c/tspan\u003e\u003ctspan x="396.1"\u003eDusk:\u003c/tspan\u003e\u003ctspan x="472.0"\u003e20:56:28\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="924.0" dy="1em"\u003e\u003ctspan x="0.0"\u003eFollow\u003c/tspan\u003e\u003ctspan x="59.0" class="fg-0"\u003e@igor_chubin\u003c/tspan\u003e\u003ctspan x="168.6"\u003efor\u003c/tspan\u003e\u003ctspan x="202.3"\u003ewttr.in\u003c/tspan\u003e\u003ctspan x="269.7"\u003eupdates\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="940.8" dy="1em"\u003e\u003ctspan x="0.0"\u003eroot@node2:~#\u003c/tspan\u003e\u003ctspan x="118.0"\u003ev\u003c/tspan\u003e\u003c/tspan\u003e\u003c/text\u003e\u003c/svg\u003e\u003c/svg\u003e',
+    cols: 253,
+    rows: 122,
+    cursorX: 15,
+    cursorY: 56,
+    cursorVisible: true,
+    startOffset: 17730,
+    endOffset: 18729,
+  },
+  {
+    svg: '\u003csvg xmlns="http://www.w3.org/2000/svg" width="1955" height="1545" font-size="14" class="terminal"\u003e\u003crect width="100%" height="100%" class="bg-default"/\u003e\u003csvg x="8.4" y="8.4"\u003e\u003cg shape-rendering="crispEdges"\u003e\u003crect x="126.4" y="201.6" width="8.4" height="16.8" class="bg-7"/\u003e\u003c/g\u003e\u003ctext\u003e\u003ctspan y="0.0" dy="1em"\u003e\u003ctspan x="0.0"\u003eroot@node2:~#\u003c/tspan\u003e\u003ctspan x="118.0"\u003eping\u003c/tspan\u003e\u003ctspan x="160.1"\u003egoogle.com\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="16.8" dy="1em"\u003e\u003ctspan x="0.0"\u003ePING\u003c/tspan\u003e\u003ctspan x="42.1"\u003egoogle.com\u003c/tspan\u003e\u003ctspan x="134.8"\u003e(142.250.179.174)\u003c/tspan\u003e\u003ctspan x="286.6"\u003e56(84)\u003c/tspan\u003e\u003ctspan x="345.5"\u003ebytes\u003c/tspan\u003e\u003ctspan x="396.1"\u003eof\u003c/tspan\u003e\u003ctspan x="421.4"\u003edata.\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="33.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=1\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.86\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="50.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=2\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.90\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="67.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=3\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.84\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="84.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=4\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.91\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="100.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=5\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.76\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="117.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e64\u003c/tspan\u003e\u003ctspan x="25.3"\u003ebytes\u003c/tspan\u003e\u003ctspan x="75.9"\u003efrom\u003c/tspan\u003e\u003ctspan x="118.0"\u003eams15s41-in-f14.1e100.net\u003c/tspan\u003e\u003ctspan x="337.1"\u003e(142.250.179.174):\u003c/tspan\u003e\u003ctspan x="497.3"\u003eicmp_seq=6\u003c/tspan\u003e\u003ctspan x="590.0"\u003ettl=118\u003c/tspan\u003e\u003ctspan x="657.4"\u003etime=3.76\u003c/tspan\u003e\u003ctspan x="741.7"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="134.4" dy="1em"\u003e\u003ctspan x="0.0"\u003e^C\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="151.2" dy="1em"\u003e\u003ctspan x="0.0"\u003e---\u003c/tspan\u003e\u003ctspan x="33.7"\u003egoogle.com\u003c/tspan\u003e\u003ctspan x="126.4"\u003eping\u003c/tspan\u003e\u003ctspan x="168.6"\u003estatistics\u003c/tspan\u003e\u003ctspan x="261.3"\u003e---\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="168.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e6\u003c/tspan\u003e\u003ctspan x="16.9"\u003epackets\u003c/tspan\u003e\u003ctspan x="84.3"\u003etransmitted,\u003c/tspan\u003e\u003ctspan x="193.8"\u003e6\u003c/tspan\u003e\u003ctspan x="210.7"\u003ereceived,\u003c/tspan\u003e\u003ctspan x="295.0"\u003e0%\u003c/tspan\u003e\u003ctspan x="320.3"\u003epacket\u003c/tspan\u003e\u003ctspan x="379.3"\u003eloss,\u003c/tspan\u003e\u003ctspan x="429.8"\u003etime\u003c/tspan\u003e\u003ctspan x="472.0"\u003e5007ms\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="184.8" dy="1em"\u003e\u003ctspan x="0.0"\u003ertt\u003c/tspan\u003e\u003ctspan x="33.7"\u003emin/avg/max/mdev\u003c/tspan\u003e\u003ctspan x="177.0"\u003e=\u003c/tspan\u003e\u003ctspan x="193.8"\u003e3.756/3.837/3.905/0.061\u003c/tspan\u003e\u003ctspan x="396.1"\u003ems\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="201.6" dy="1em"\u003e\u003ctspan x="0.0"\u003eroot@node2:~#\u003c/tspan\u003e\u003ctspan x="118.0"\u003ev\u003c/tspan\u003e\u003c/tspan\u003e\u003c/text\u003e\u003c/svg\u003e\u003c/svg\u003e',
+    cols: 230,
+    rows: 91,
+    cursorX: 15,
+    cursorY: 12,
+    cursorVisible: true,
+    startOffset: 9199,
+    endOffset: 10198,
+  },
+  {
+    svg: '\u003csvg xmlns="http://www.w3.org/2000/svg" width="2149" height="2066" font-size="14" class="terminal"\u003e\u003crect width="100%" height="100%" class="bg-default"/\u003e\u003csvg x="8.4" y="8.4"\u003e\u003cg shape-rendering="crispEdges"\u003e\u003crect x="118.0" y="117.6" width="8.4" height="16.8" class="bg-7"/\u003e\u003c/g\u003e\u003ctext\u003e\u003ctspan y="0.0" dy="1em"\u003e\u003ctspan x="0.0"\u003e127.0.0.1\u003c/tspan\u003e\u003ctspan x="134.8"\u003elocalhost\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="16.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e::1\u003c/tspan\u003e\u003ctspan x="67.4"\u003elocalhost\u003c/tspan\u003e\u003ctspan x="151.7"\u003eip6-localhost\u003c/tspan\u003e\u003ctspan x="269.7"\u003eip6-loopback\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="33.6" dy="1em"\u003e\u003ctspan x="0.0"\u003efe00::\u003c/tspan\u003e\u003ctspan x="67.4"\u003eip6-localnet\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="50.4" dy="1em"\u003e\u003ctspan x="0.0"\u003eff00::\u003c/tspan\u003e\u003ctspan x="67.4"\u003eip6-mcastprefix\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="67.2" dy="1em"\u003e\u003ctspan x="0.0"\u003eff02::1\u003c/tspan\u003e\u003ctspan x="67.4"\u003eip6-allnodes\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="84.0" dy="1em"\u003e\u003ctspan x="0.0"\u003eff02::2\u003c/tspan\u003e\u003ctspan x="67.4"\u003eip6-allrouters\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="100.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e172.18.0.5\u003c/tspan\u003e\u003ctspan x="134.8"\u003enode2\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="117.6" dy="1em"\u003e\u003ctspan x="0.0"\u003e0.0.0.0\u003c/tspan\u003e\u003ctspan x="67.4"\u003etestin\u003c/tspan\u003e\u003ctspan x="118.0" class="fg-0"\u003eg\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="134.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="151.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="168.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="184.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="201.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="218.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="235.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="252.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="268.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="285.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="302.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="319.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="336.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="352.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="369.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="386.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="403.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="420.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="436.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="453.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="470.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="487.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="504.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="520.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="537.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="554.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="571.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="588.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="604.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="621.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="638.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="655.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="672.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="688.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="705.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="722.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="739.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="756.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="772.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="789.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="806.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="823.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="840.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="856.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="873.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="890.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="907.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="924.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="940.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="957.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="974.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="991.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1008.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1024.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1041.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1058.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1075.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1092.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1108.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1125.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1142.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1159.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1176.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1192.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1209.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1226.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1243.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1260.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1276.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1293.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1310.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1327.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1344.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1360.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1377.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1394.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1411.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1428.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1444.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1461.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1478.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1495.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1512.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1528.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1545.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1562.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1579.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1596.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1612.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1629.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1646.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1663.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1680.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1696.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1713.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1730.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1747.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1764.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1780.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1797.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1814.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1831.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1848.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1864.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1881.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1898.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1915.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1932.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1948.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1965.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1982.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="1999.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="2016.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-12 b"\u003e~\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="2032.8" dy="1em"\u003e\u003ctspan x="0.0"\u003e\u0026quot;/etc/hosts\u0026quot;\u003c/tspan\u003e\u003ctspan x="109.6"\u003e8L,\u003c/tspan\u003e\u003ctspan x="143.3"\u003e181B\u003c/tspan\u003e\u003ctspan x="1896.3"\u003ed\u003c/tspan\u003e\u003ctspan x="1980.6"\u003e8,15\u003c/tspan\u003e\u003ctspan x="2098.6"\u003eAll\u003c/tspan\u003e\u003c/tspan\u003e\u003c/text\u003e\u003c/svg\u003e\u003c/svg\u003e',
+    cols: 253,
+    rows: 122,
+    cursorX: 14,
+    cursorY: 7,
+    cursorVisible: true,
+    startOffset: 4141,
+    endOffset: 5140,
+  },
+  {
+    svg: '\u003csvg xmlns="http://www.w3.org/2000/svg" width="2149" height="2066" font-size="14" class="terminal"\u003e\u003crect width="100%" height="100%" class="bg-default"/\u003e\u003csvg x="8.4" y="8.4"\u003e\u003cg shape-rendering="crispEdges"\u003e\u003crect x="0.0" y="0.0" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="59.0" y="0.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="75.9" y="0.0" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="126.4" y="0.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="134.8" y="0.0" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="193.8" y="0.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="210.7" y="0.0" width="185.4" height="16.8" class="bg-0"/\u003e\u003crect x="396.1" y="0.0" width="33.7" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="0.0" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="438.3" y="0.0" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="446.7" y="0.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="455.1" y="0.0" width="126.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="581.5" y="0.0" width="33.7" height="16.8" style="fill:#303030"/\u003e\u003crect x="615.2" y="0.0" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="649.0" y="0.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="657.4" y="0.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="0.0" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="699.5" y="0.0" width="16.9" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="716.4" y="0.0" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="741.7" y="0.0" width="118.0" height="16.8" style="fill:#003333"/\u003e\u003crect x="859.7" y="0.0" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="884.9" y="0.0" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="901.8" y="0.0" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="0.0" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="986.1" y="0.0" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="16.8" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="59.0" y="16.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="75.9" y="16.8" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="126.4" y="16.8" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="151.7" y="16.8" width="42.1" height="16.8" class="bg-0"/\u003e\u003crect x="193.8" y="16.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="210.7" y="16.8" width="185.4" height="16.8" class="bg-0"/\u003e\u003crect x="396.1" y="16.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="404.5" y="16.8" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="413.0" y="16.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="16.8" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="438.3" y="16.8" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="446.7" y="16.8" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="455.1" y="16.8" width="126.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="581.5" y="16.8" width="42.1" height="16.8" style="fill:#303030"/\u003e\u003crect x="623.7" y="16.8" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="649.0" y="16.8" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="657.4" y="16.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="16.8" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="682.7" y="16.8" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="724.8" y="16.8" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="750.1" y="16.8" width="126.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="876.5" y="16.8" width="8.4" height="16.8" style="fill:#333333"/\u003e\u003crect x="884.9" y="16.8" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="910.2" y="16.8" width="67.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="977.6" y="16.8" width="33.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="33.6" width="168.6" height="16.8" class="bg-0"/\u003e\u003crect x="168.6" y="33.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="177.0" y="33.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="193.8" y="33.6" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="219.1" y="33.6" width="168.6" height="16.8" class="bg-0"/\u003e\u003crect x="387.7" y="33.6" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="404.5" y="33.6" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="413.0" y="33.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="421.4" y="33.6" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="429.8" y="33.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="438.3" y="33.6" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="455.1" y="33.6" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="463.5" y="33.6" width="126.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="590.0" y="33.6" width="42.1" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="33.6" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="649.0" y="33.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="657.4" y="33.6" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="33.6" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="699.5" y="33.6" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="733.2" y="33.6" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="750.1" y="33.6" width="126.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="876.5" y="33.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="901.8" y="33.6" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="910.2" y="33.6" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="986.1" y="33.6" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="1002.9" y="33.6" width="8.4" height="16.8" style="fill:#006666"/\u003e\u003crect x="0.0" y="50.4" width="202.3" height="16.8" class="bg-0"/\u003e\u003crect x="202.3" y="50.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="219.1" y="50.4" width="177.0" height="16.8" class="bg-0"/\u003e\u003crect x="396.1" y="50.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="404.5" y="50.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="421.4" y="50.4" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="438.3" y="50.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="446.7" y="50.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="455.1" y="50.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="463.5" y="50.4" width="84.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="547.8" y="50.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="556.2" y="50.4" width="50.6" height="16.8" style="fill:#262626"/\u003e\u003crect x="606.8" y="50.4" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="50.4" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="657.4" y="50.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="665.8" y="50.4" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="691.1" y="50.4" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="699.5" y="50.4" width="50.6" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="750.1" y="50.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="50.4" width="126.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="50.4" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="50.4" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="50.4" width="67.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="1002.9" y="50.4" width="8.4" height="16.8" style="fill:#006666"/\u003e\u003crect x="0.0" y="67.2" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="92.7" y="67.2" width="33.7" height="16.8" style="fill:#080808"/\u003e\u003crect x="126.4" y="67.2" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="219.1" y="67.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="227.6" y="67.2" width="160.1" height="16.8" class="bg-0"/\u003e\u003crect x="387.7" y="67.2" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="404.5" y="67.2" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="429.8" y="67.2" width="33.7" height="16.8" style="fill:#080808"/\u003e\u003crect x="463.5" y="67.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="472.0" y="67.2" width="84.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="556.2" y="67.2" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="581.5" y="67.2" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="606.8" y="67.2" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="67.2" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="665.8" y="67.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="674.2" y="67.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="691.1" y="67.2" width="33.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="724.8" y="67.2" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="758.5" y="67.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="775.4" y="67.2" width="118.0" height="16.8" style="fill:#003333"/\u003e\u003crect x="893.4" y="67.2" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="67.2" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="927.1" y="67.2" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="1002.9" y="67.2" width="8.4" height="16.8" style="fill:#006666"/\u003e\u003crect x="0.0" y="84.0" width="118.0" height="16.8" class="bg-0"/\u003e\u003crect x="118.0" y="84.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="134.8" y="84.0" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="227.6" y="84.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="236.0" y="84.0" width="151.7" height="16.8" class="bg-0"/\u003e\u003crect x="387.7" y="84.0" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="413.0" y="84.0" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="438.3" y="84.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="455.1" y="84.0" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="463.5" y="84.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="480.4" y="84.0" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="497.3" y="84.0" width="75.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="573.1" y="84.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="581.5" y="84.0" width="42.1" height="16.8" style="fill:#262626"/\u003e\u003crect x="623.7" y="84.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="84.0" width="50.6" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="84.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="699.5" y="84.0" width="33.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="733.2" y="84.0" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="775.4" y="84.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="84.0" width="101.1" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="84.0" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="84.0" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="84.0" width="67.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="1002.9" y="84.0" width="8.4" height="16.8" style="fill:#006666"/\u003e\u003crect x="0.0" y="100.8" width="67.4" height="16.8" class="bg-0"/\u003e\u003crect x="67.4" y="100.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="75.9" y="100.8" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="126.4" y="100.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="134.8" y="100.8" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="227.6" y="100.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="236.0" y="100.8" width="143.3" height="16.8" class="bg-0"/\u003e\u003crect x="379.3" y="100.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="387.7" y="100.8" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="413.0" y="100.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="100.8" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="438.3" y="100.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="446.7" y="100.8" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="455.1" y="100.8" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="463.5" y="100.8" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="472.0" y="100.8" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="480.4" y="100.8" width="25.3" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="505.7" y="100.8" width="75.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="581.5" y="100.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="598.4" y="100.8" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="623.7" y="100.8" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="649.0" y="100.8" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="100.8" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="691.1" y="100.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="708.0" y="100.8" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="716.4" y="100.8" width="16.9" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="733.2" y="100.8" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="741.7" y="100.8" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="100.8" width="101.1" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="100.8" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="100.8" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="927.1" y="100.8" width="59.0" height="16.8" style="fill:#003366"/\u003e\u003crect x="986.1" y="100.8" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="117.6" width="67.4" height="16.8" class="bg-0"/\u003e\u003crect x="67.4" y="117.6" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="84.3" y="117.6" width="33.7" height="16.8" class="bg-0"/\u003e\u003crect x="118.0" y="117.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="126.4" y="117.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="143.3" y="117.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="151.7" y="117.6" width="75.9" height="16.8" class="bg-0"/\u003e\u003crect x="227.6" y="117.6" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="244.4" y="117.6" width="126.4" height="16.8" class="bg-0"/\u003e\u003crect x="370.8" y="117.6" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="387.7" y="117.6" width="33.7" height="16.8" class="bg-0"/\u003e\u003crect x="421.4" y="117.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="117.6" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="438.3" y="117.6" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="446.7" y="117.6" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="480.4" y="117.6" width="25.3" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="505.7" y="117.6" width="75.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="581.5" y="117.6" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="606.8" y="117.6" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="632.1" y="117.6" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="657.4" y="117.6" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="117.6" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="699.5" y="117.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="708.0" y="117.6" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="724.8" y="117.6" width="50.6" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="775.4" y="117.6" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="117.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="117.6" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="927.1" y="117.6" width="59.0" height="16.8" style="fill:#003366"/\u003e\u003crect x="986.1" y="117.6" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="134.4" width="151.7" height="16.8" class="bg-0"/\u003e\u003crect x="151.7" y="134.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="160.1" y="134.4" width="84.3" height="16.8" class="bg-0"/\u003e\u003crect x="244.4" y="134.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="252.8" y="134.4" width="109.6" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="134.4" width="33.7" height="16.8" style="fill:#080808"/\u003e\u003crect x="396.1" y="134.4" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="413.0" y="134.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="134.4" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="446.7" y="134.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="455.1" y="134.4" width="59.0" height="16.8" style="fill:#262626"/\u003e\u003crect x="514.1" y="134.4" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="531.0" y="134.4" width="67.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="598.4" y="134.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="606.8" y="134.4" width="42.1" height="16.8" style="fill:#262626"/\u003e\u003crect x="649.0" y="134.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="657.4" y="134.4" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="134.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="699.5" y="134.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="716.4" y="134.4" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="724.8" y="134.4" width="50.6" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="775.4" y="134.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="792.2" y="134.4" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="134.4" width="8.4" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="134.4" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="134.4" width="67.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="1002.9" y="134.4" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="151.2" width="370.8" height="16.8" class="bg-0"/\u003e\u003crect x="370.8" y="151.2" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="396.1" y="151.2" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="404.5" y="151.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="413.0" y="151.2" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="421.4" y="151.2" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="429.8" y="151.2" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="438.3" y="151.2" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="446.7" y="151.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="455.1" y="151.2" width="50.6" height="16.8" style="fill:#262626"/\u003e\u003crect x="505.7" y="151.2" width="25.3" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="531.0" y="151.2" width="75.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="606.8" y="151.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="623.7" y="151.2" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="151.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="665.8" y="151.2" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="151.2" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="151.2" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="733.2" y="151.2" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="758.5" y="151.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="766.9" y="151.2" width="16.9" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="151.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="151.2" width="101.1" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="151.2" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="151.2" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="151.2" width="67.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="1002.9" y="151.2" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="0.0" y="168.0" width="244.4" height="16.8" class="bg-0"/\u003e\u003crect x="244.4" y="168.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="261.3" y="168.0" width="109.6" height="16.8" class="bg-0"/\u003e\u003crect x="370.8" y="168.0" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="396.1" y="168.0" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="404.5" y="168.0" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="168.0" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="438.3" y="168.0" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="446.7" y="168.0" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="463.5" y="168.0" width="84.3" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="547.8" y="168.0" width="109.6" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="168.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="674.2" y="168.0" width="8.4" height="16.8" style="fill:#444444"/\u003e\u003crect x="682.7" y="168.0" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="168.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="724.8" y="168.0" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="741.7" y="168.0" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="168.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="792.2" y="168.0" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="168.0" width="8.4" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="168.0" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="168.0" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="184.8" width="252.8" height="16.8" class="bg-0"/\u003e\u003crect x="252.8" y="184.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="269.7" y="184.8" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="184.8" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="387.7" y="184.8" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="404.5" y="184.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="413.0" y="184.8" width="92.7" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="505.7" y="184.8" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="531.0" y="184.8" width="25.3" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="556.2" y="184.8" width="67.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="623.7" y="184.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="632.1" y="184.8" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="184.8" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="682.7" y="184.8" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="699.5" y="184.8" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="716.4" y="184.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="724.8" y="184.8" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="741.7" y="184.8" width="50.6" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="184.8" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="184.8" width="8.4" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="184.8" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="184.8" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="201.6" width="244.4" height="16.8" class="bg-0"/\u003e\u003crect x="244.4" y="201.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="252.8" y="201.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="269.7" y="201.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="278.1" y="201.6" width="75.9" height="16.8" class="bg-0"/\u003e\u003crect x="354.0" y="201.6" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="379.3" y="201.6" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="396.1" y="201.6" width="42.1" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="438.3" y="201.6" width="42.1" height="16.8" style="fill:#303030"/\u003e\u003crect x="480.4" y="201.6" width="75.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="556.2" y="201.6" width="75.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="632.1" y="201.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="640.5" y="201.6" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="201.6" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="682.7" y="201.6" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="708.0" y="201.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="716.4" y="201.6" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="733.2" y="201.6" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="750.1" y="201.6" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="775.4" y="201.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="201.6" width="8.4" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="201.6" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="201.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="201.6" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="201.6" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="218.4" width="193.8" height="16.8" class="bg-0"/\u003e\u003crect x="193.8" y="218.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="202.3" y="218.4" width="42.1" height="16.8" class="bg-0"/\u003e\u003crect x="244.4" y="218.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="252.8" y="218.4" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="269.7" y="218.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="286.6" y="218.4" width="67.4" height="16.8" class="bg-0"/\u003e\u003crect x="354.0" y="218.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="362.4" y="218.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="370.8" y="218.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="379.3" y="218.4" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="404.5" y="218.4" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="421.4" y="218.4" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="438.3" y="218.4" width="33.7" height="16.8" style="fill:#303030"/\u003e\u003crect x="472.0" y="218.4" width="92.7" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="564.7" y="218.4" width="67.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="632.1" y="218.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="649.0" y="218.4" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="218.4" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="682.7" y="218.4" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="708.0" y="218.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="218.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="733.2" y="218.4" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="750.1" y="218.4" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="218.4" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="218.4" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="918.7" y="218.4" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="218.4" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="235.2" width="193.8" height="16.8" class="bg-0"/\u003e\u003crect x="193.8" y="235.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="202.3" y="235.2" width="75.9" height="16.8" class="bg-0"/\u003e\u003crect x="278.1" y="235.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="286.6" y="235.2" width="67.4" height="16.8" class="bg-0"/\u003e\u003crect x="354.0" y="235.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="362.4" y="235.2" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="370.8" y="235.2" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="396.1" y="235.2" width="236.0" height="16.8" style="fill:#262626"/\u003e\u003crect x="632.1" y="235.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="649.0" y="235.2" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="665.8" y="235.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="682.7" y="235.2" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="708.0" y="235.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="235.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="733.2" y="235.2" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="758.5" y="235.2" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="235.2" width="92.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="235.2" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="235.2" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="235.2" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="252.0" width="295.0" height="16.8" class="bg-0"/\u003e\u003crect x="295.0" y="252.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="303.4" y="252.0" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="252.0" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="370.8" y="252.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="379.3" y="252.0" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="396.1" y="252.0" width="59.0" height="16.8" style="fill:#262626"/\u003e\u003crect x="455.1" y="252.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="463.5" y="252.0" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="472.0" y="252.0" width="75.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="547.8" y="252.0" width="84.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="632.1" y="252.0" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="657.4" y="252.0" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="674.2" y="252.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="682.7" y="252.0" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="716.4" y="252.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="252.0" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="750.1" y="252.0" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="758.5" y="252.0" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="252.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="252.0" width="92.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="893.4" y="252.0" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="252.0" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="927.1" y="252.0" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="252.0" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="268.8" width="295.0" height="16.8" class="bg-0"/\u003e\u003crect x="295.0" y="268.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="303.4" y="268.8" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="268.8" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="370.8" y="268.8" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="387.7" y="268.8" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="396.1" y="268.8" width="50.6" height="16.8" style="fill:#262626"/\u003e\u003crect x="446.7" y="268.8" width="126.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="573.1" y="268.8" width="67.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="640.5" y="268.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="649.0" y="268.8" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="674.2" y="268.8" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="691.1" y="268.8" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="724.8" y="268.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="741.7" y="268.8" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="758.5" y="268.8" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="268.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="268.8" width="92.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="893.4" y="268.8" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="268.8" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="927.1" y="268.8" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="268.8" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="285.6" width="362.4" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="285.6" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="370.8" y="285.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="379.3" y="285.6" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="413.0" y="285.6" width="42.1" height="16.8" style="fill:#303030"/\u003e\u003crect x="455.1" y="285.6" width="84.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="539.4" y="285.6" width="50.6" height="16.8" style="fill:#303030"/\u003e\u003crect x="590.0" y="285.6" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="598.4" y="285.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="606.8" y="285.6" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="640.5" y="285.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="649.0" y="285.6" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="285.6" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="716.4" y="285.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="285.6" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="750.1" y="285.6" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="758.5" y="285.6" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="285.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="792.2" y="285.6" width="92.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="285.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="910.2" y="285.6" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="927.1" y="285.6" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="285.6" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="302.4" width="320.3" height="16.8" class="bg-0"/\u003e\u003crect x="320.3" y="302.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="337.1" y="302.4" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="302.4" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="379.3" y="302.4" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="396.1" y="302.4" width="33.7" height="16.8" style="fill:#303030"/\u003e\u003crect x="429.8" y="302.4" width="33.7" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="463.5" y="302.4" width="8.4" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="472.0" y="302.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="480.4" y="302.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="488.8" y="302.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="497.3" y="302.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="505.7" y="302.4" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="531.0" y="302.4" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="539.4" y="302.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="547.8" y="302.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="556.2" y="302.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="564.7" y="302.4" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="573.1" y="302.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="581.5" y="302.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="590.0" y="302.4" width="92.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="302.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="699.5" y="302.4" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="716.4" y="302.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="733.2" y="302.4" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="302.4" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="302.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="302.4" width="84.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="302.4" width="33.7" height="16.8" style="fill:#333333"/\u003e\u003crect x="918.7" y="302.4" width="16.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="302.4" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="319.2" width="320.3" height="16.8" class="bg-0"/\u003e\u003crect x="320.3" y="319.2" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="337.1" y="319.2" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="319.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="370.8" y="319.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="379.3" y="319.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="387.7" y="319.2" width="33.7" height="16.8" style="fill:#303030"/\u003e\u003crect x="421.4" y="319.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="429.8" y="319.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="438.3" y="319.2" width="8.4" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="446.7" y="319.2" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="455.1" y="319.2" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="463.5" y="319.2" width="92.7" height="16.8" class="bg-0"/\u003e\u003crect x="556.2" y="319.2" width="33.7" height="16.8" style="fill:#080808"/\u003e\u003crect x="590.0" y="319.2" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="598.4" y="319.2" width="8.4" height="16.8" style="fill:#444444"/\u003e\u003crect x="606.8" y="319.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="615.2" y="319.2" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="640.5" y="319.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="657.4" y="319.2" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="319.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="699.5" y="319.2" width="8.4" height="16.8" style="fill:#444444"/\u003e\u003crect x="708.0" y="319.2" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="733.2" y="319.2" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="319.2" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="783.8" y="319.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="319.2" width="92.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="893.4" y="319.2" width="33.7" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="319.2" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="935.5" y="319.2" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="336.0" width="269.7" height="16.8" class="bg-0"/\u003e\u003crect x="269.7" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="278.1" y="336.0" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="328.7" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="337.1" y="336.0" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="345.5" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="354.0" y="336.0" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="370.8" y="336.0" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="379.3" y="336.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="387.7" y="336.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="404.5" y="336.0" width="8.4" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="413.0" y="336.0" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="421.4" y="336.0" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="429.8" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="438.3" y="336.0" width="118.0" height="16.8" class="bg-0"/\u003e\u003crect x="556.2" y="336.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="573.1" y="336.0" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="581.5" y="336.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="590.0" y="336.0" width="16.9" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="606.8" y="336.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="615.2" y="336.0" width="67.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="336.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="699.5" y="336.0" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="336.0" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="336.0" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="336.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="800.7" y="336.0" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="336.0" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="336.0" width="33.7" height="16.8" style="fill:#626262"/\u003e\u003crect x="960.8" y="336.0" width="50.6" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="352.8" width="278.1" height="16.8" class="bg-0"/\u003e\u003crect x="278.1" y="352.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="286.6" y="352.8" width="59.0" height="16.8" class="bg-0"/\u003e\u003crect x="345.5" y="352.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="362.4" y="352.8" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="379.3" y="352.8" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="396.1" y="352.8" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="404.5" y="352.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="413.0" y="352.8" width="177.0" height="16.8" class="bg-0"/\u003e\u003crect x="590.0" y="352.8" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="606.8" y="352.8" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="623.7" y="352.8" width="59.0" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="352.8" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="352.8" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="352.8" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="352.8" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="352.8" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="352.8" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="918.7" y="352.8" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="935.5" y="352.8" width="33.7" height="16.8" style="fill:#626262"/\u003e\u003crect x="969.2" y="352.8" width="42.1" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="369.6" width="295.0" height="16.8" class="bg-0"/\u003e\u003crect x="295.0" y="369.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="303.4" y="369.6" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="354.0" y="369.6" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="379.3" y="369.6" width="160.1" height="16.8" class="bg-0"/\u003e\u003crect x="539.4" y="369.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="547.8" y="369.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="564.7" y="369.6" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="581.5" y="369.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="598.4" y="369.6" width="16.9" height="16.8" style="fill:#121212"/\u003e\u003crect x="615.2" y="369.6" width="8.4" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="623.7" y="369.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="369.6" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="649.0" y="369.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="657.4" y="369.6" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="369.6" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="369.6" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="369.6" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="369.6" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="800.7" y="369.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="369.6" width="118.0" height="16.8" style="fill:#003333"/\u003e\u003crect x="927.1" y="369.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="952.4" y="369.6" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="960.8" y="369.6" width="50.6" height="16.8" style="fill:#003366"/\u003e\u003crect x="0.0" y="386.4" width="362.4" height="16.8" class="bg-0"/\u003e\u003crect x="362.4" y="386.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="379.3" y="386.4" width="160.1" height="16.8" class="bg-0"/\u003e\u003crect x="539.4" y="386.4" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="556.2" y="386.4" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="606.8" y="386.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="615.2" y="386.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="632.1" y="386.4" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="640.5" y="386.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="649.0" y="386.4" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="386.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="386.4" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="386.4" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="386.4" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="386.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="386.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="386.4" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="800.7" y="386.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="386.4" width="118.0" height="16.8" style="fill:#003333"/\u003e\u003crect x="927.1" y="386.4" width="8.4" height="16.8" style="fill:#333333"/\u003e\u003crect x="935.5" y="386.4" width="42.1" height="16.8" style="fill:#626262"/\u003e\u003crect x="977.6" y="386.4" width="33.7" height="16.8" class="bg-8"/\u003e\u003crect x="0.0" y="403.2" width="320.3" height="16.8" class="bg-0"/\u003e\u003crect x="320.3" y="403.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="328.7" y="403.2" width="50.6" height="16.8" class="bg-0"/\u003e\u003crect x="379.3" y="403.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="387.7" y="403.2" width="219.1" height="16.8" class="bg-0"/\u003e\u003crect x="606.8" y="403.2" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="623.7" y="403.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="632.1" y="403.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="640.5" y="403.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="657.4" y="403.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="665.8" y="403.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="403.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="682.7" y="403.2" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="403.2" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="403.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="403.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="403.2" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="766.9" y="403.2" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="800.7" y="403.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="403.2" width="109.6" height="16.8" style="fill:#003333"/\u003e\u003crect x="918.7" y="403.2" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="935.5" y="403.2" width="75.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="0.0" y="420.0" width="379.3" height="16.8" class="bg-0"/\u003e\u003crect x="379.3" y="420.0" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="396.1" y="420.0" width="236.0" height="16.8" class="bg-0"/\u003e\u003crect x="632.1" y="420.0" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="640.5" y="420.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="649.0" y="420.0" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="657.4" y="420.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="420.0" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="699.5" y="420.0" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="708.0" y="420.0" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="733.2" y="420.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="420.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="420.0" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="766.9" y="420.0" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="792.2" y="420.0" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="420.0" width="101.1" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="420.0" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="420.0" width="50.6" height="16.8" style="fill:#626262"/\u003e\u003crect x="977.6" y="420.0" width="8.4" height="16.8" class="bg-8"/\u003e\u003crect x="986.1" y="420.0" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="0.0" y="436.8" width="337.1" height="16.8" class="bg-0"/\u003e\u003crect x="337.1" y="436.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="354.0" y="436.8" width="33.7" height="16.8" class="bg-0"/\u003e\u003crect x="387.7" y="436.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="404.5" y="436.8" width="202.3" height="16.8" class="bg-0"/\u003e\u003crect x="606.8" y="436.8" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="615.2" y="436.8" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="623.7" y="436.8" width="33.7" height="16.8" style="fill:#121212"/\u003e\u003crect x="657.4" y="436.8" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="665.8" y="436.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="674.2" y="436.8" width="33.7" height="16.8" style="fill:#262626"/\u003e\u003crect x="708.0" y="436.8" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="716.4" y="436.8" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="750.1" y="436.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="758.5" y="436.8" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="775.4" y="436.8" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="800.7" y="436.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="809.1" y="436.8" width="101.1" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="436.8" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="436.8" width="84.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="0.0" y="453.6" width="615.2" height="16.8" class="bg-0"/\u003e\u003crect x="615.2" y="453.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="623.7" y="453.6" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="632.1" y="453.6" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="657.4" y="453.6" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="665.8" y="453.6" width="42.1" height="16.8" style="fill:#262626"/\u003e\u003crect x="708.0" y="453.6" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="453.6" width="33.7" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="453.6" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="766.9" y="453.6" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="783.8" y="453.6" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="809.1" y="453.6" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="825.9" y="453.6" width="84.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="453.6" width="25.3" height="16.8" style="fill:#333333"/\u003e\u003crect x="935.5" y="453.6" width="75.9" height="16.8" style="fill:#626262"/\u003e\u003crect x="0.0" y="470.4" width="649.0" height="16.8" class="bg-0"/\u003e\u003crect x="649.0" y="470.4" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="657.4" y="470.4" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="665.8" y="470.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="674.2" y="470.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="682.7" y="470.4" width="25.3" height="16.8" style="fill:#262626"/\u003e\u003crect x="708.0" y="470.4" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="733.2" y="470.4" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="470.4" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="470.4" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="809.1" y="470.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="825.9" y="470.4" width="84.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="470.4" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="470.4" width="84.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="0.0" y="487.2" width="649.0" height="16.8" class="bg-0"/\u003e\u003crect x="649.0" y="487.2" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="674.2" y="487.2" width="8.4" height="16.8" class="bg-0"/\u003e\u003crect x="682.7" y="487.2" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="691.1" y="487.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="699.5" y="487.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="708.0" y="487.2" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="716.4" y="487.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="733.2" y="487.2" width="25.3" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="487.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="487.2" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="792.2" y="487.2" width="33.7" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="825.9" y="487.2" width="84.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="487.2" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="927.1" y="487.2" width="25.3" height="16.8" style="fill:#626262"/\u003e\u003crect x="952.4" y="487.2" width="59.0" height="16.8" class="bg-8"/\u003e\u003crect x="0.0" y="504.0" width="396.1" height="16.8" class="bg-0"/\u003e\u003crect x="396.1" y="504.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="404.5" y="504.0" width="42.1" height="16.8" class="bg-0"/\u003e\u003crect x="446.7" y="504.0" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="455.1" y="504.0" width="202.3" height="16.8" class="bg-0"/\u003e\u003crect x="657.4" y="504.0" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="682.7" y="504.0" width="25.3" height="16.8" style="fill:#121212"/\u003e\u003crect x="708.0" y="504.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="716.4" y="504.0" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="724.8" y="504.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="741.7" y="504.0" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="504.0" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="504.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="504.0" width="42.1" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="825.9" y="504.0" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="834.4" y="504.0" width="75.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="910.2" y="504.0" width="33.7" height="16.8" style="fill:#626262"/\u003e\u003crect x="943.9" y="504.0" width="16.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="960.8" y="504.0" width="50.6" height="16.8" class="bg-8"/\u003e\u003crect x="0.0" y="520.8" width="404.5" height="16.8" class="bg-0"/\u003e\u003crect x="404.5" y="520.8" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="421.4" y="520.8" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="446.7" y="520.8" width="126.4" height="16.8" class="bg-15"/\u003e\u003crect x="573.1" y="520.8" width="109.6" height="16.8" class="bg-0"/\u003e\u003crect x="682.7" y="520.8" width="25.3" height="16.8" style="fill:#080808"/\u003e\u003crect x="708.0" y="520.8" width="8.4" height="16.8" style="fill:#121212"/\u003e\u003crect x="716.4" y="520.8" width="8.4" height="16.8" style="fill:#262626"/\u003e\u003crect x="724.8" y="520.8" width="25.3" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="520.8" width="8.4" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="520.8" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="520.8" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="520.8" width="50.6" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="834.4" y="520.8" width="33.7" height="16.8" style="fill:#003333"/\u003e\u003crect x="868.1" y="520.8" width="8.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="876.5" y="520.8" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="901.8" y="520.8" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="910.2" y="520.8" width="50.6" height="16.8" style="fill:#003366"/\u003e\u003crect x="960.8" y="520.8" width="42.1" height="16.8" class="bg-8"/\u003e\u003crect x="1002.9" y="520.8" width="8.4" height="16.8" style="fill:#6c6c6c"/\u003e\u003crect x="0.0" y="537.6" width="421.4" height="16.8" class="bg-0"/\u003e\u003crect x="421.4" y="537.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="429.8" y="537.6" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="446.7" y="537.6" width="126.4" height="16.8" class="bg-15"/\u003e\u003crect x="573.1" y="537.6" width="101.1" height="16.8" class="bg-0"/\u003e\u003crect x="674.2" y="537.6" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="682.7" y="537.6" width="25.3" height="16.8" class="bg-0"/\u003e\u003crect x="708.0" y="537.6" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="716.4" y="537.6" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="724.8" y="537.6" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="733.2" y="537.6" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="537.6" width="8.4" height="16.8" style="fill:#444444"/\u003e\u003crect x="758.5" y="537.6" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="537.6" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="792.2" y="537.6" width="16.9" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="809.1" y="537.6" width="25.3" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="834.4" y="537.6" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="859.7" y="537.6" width="8.4" height="16.8" style="fill:#003366"/\u003e\u003crect x="868.1" y="537.6" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="537.6" width="16.9" height="16.8" style="fill:#333333"/\u003e\u003crect x="901.8" y="537.6" width="8.4" height="16.8" style="fill:#626262"/\u003e\u003crect x="910.2" y="537.6" width="25.3" height="16.8" style="fill:#003366"/\u003e\u003crect x="935.5" y="537.6" width="75.9" height="16.8" style="fill:#6c6c6c"/\u003e\u003crect x="0.0" y="554.4" width="446.7" height="16.8" class="bg-0"/\u003e\u003crect x="446.7" y="554.4" width="126.4" height="16.8" class="bg-15"/\u003e\u003crect x="573.1" y="554.4" width="134.8" height="16.8" class="bg-0"/\u003e\u003crect x="708.0" y="554.4" width="8.4" height="16.8" style="fill:#1c1c1c"/\u003e\u003crect x="716.4" y="554.4" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="733.2" y="554.4" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="554.4" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="766.9" y="554.4" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="554.4" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="554.4" width="8.4" height="16.8" style="fill:#003333"/\u003e\u003crect x="792.2" y="554.4" width="16.9" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="809.1" y="554.4" width="16.9" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="825.9" y="554.4" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="851.2" y="554.4" width="16.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="868.1" y="554.4" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="884.9" y="554.4" width="33.7" height="16.8" style="fill:#003366"/\u003e\u003crect x="918.7" y="554.4" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="935.5" y="554.4" width="16.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="952.4" y="554.4" width="25.3" height="16.8" style="fill:#336633"/\u003e\u003crect x="977.6" y="554.4" width="25.3" height="16.8" style="fill:#333366"/\u003e\u003crect x="1002.9" y="554.4" width="8.4" height="16.8" style="fill:#336699"/\u003e\u003crect x="0.0" y="571.2" width="531.0" height="16.8" class="bg-0"/\u003e\u003crect x="531.0" y="571.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="539.4" y="571.2" width="16.9" height="16.8" class="bg-0"/\u003e\u003crect x="556.2" y="571.2" width="8.4" height="16.8" style="fill:#080808"/\u003e\u003crect x="564.7" y="571.2" width="134.8" height="16.8" class="bg-0"/\u003e\u003crect x="699.5" y="571.2" width="16.9" height="16.8" style="fill:#080808"/\u003e\u003crect x="716.4" y="571.2" width="16.9" height="16.8" style="fill:#262626"/\u003e\u003crect x="733.2" y="571.2" width="16.9" height="16.8" style="fill:#303030"/\u003e\u003crect x="750.1" y="571.2" width="16.9" height="16.8" style="fill:#444444"/\u003e\u003crect x="766.9" y="571.2" width="8.4" height="16.8" style="fill:#303030"/\u003e\u003crect x="775.4" y="571.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="783.8" y="571.2" width="25.3" height="16.8" style="fill:#4e4e4e"/\u003e\u003crect x="809.1" y="571.2" width="8.4" height="16.8" style="fill:#3a3a3a"/\u003e\u003crect x="817.5" y="571.2" width="16.9" height="16.8" style="fill:#003333"/\u003e\u003crect x="834.4" y="571.2" width="16.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="851.2" y="571.2" width="25.3" height="16.8" style="fill:#003333"/\u003e\u003crect x="876.5" y="571.2" width="75.9" height="16.8" style="fill:#003366"/\u003e\u003crect x="952.4" y="571.2" width="16.9" height="16.8" style="fill:#336699"/\u003e\u003crect x="969.2" y="571.2" width="42.1" height="16.8" style="fill:#003366"/\u003e\u003crect x="1011.4" y="571.2" width="8.4" height="16.8" class="bg-7"/\u003e\u003c/g\u003e\u003ctext\u003e\u003ctspan y="0.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="50.6" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="59.0" class="fg-0"\u003ePP\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-1"\u003e|||\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="134.8" class="fg-1"\u003e|||(th$\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="210.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003e`|(\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e`htt\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-0"\u003eT\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-0"\u003et\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eThhPPP$$$$DD8@@\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-6"\u003ehXXX\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-4"\u003eXtPP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-1"\u003ehtt\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003ePD\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-5"\u003e``\\\\TtttPPDD@@\u003c/tspan\u003e\u003ctspan x="859.7" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-3"\u003ettPDDDDDD\u003c/tspan\u003e\u003ctspan x="986.1" class="fg-7"\u003ePP$\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="16.8" dy="1em"\u003e\u003ctspan x="0.0" class="fg-4"\u003e,,,,,,,\u003c/tspan\u003e\u003ctspan x="59.0" class="fg-0"\u003e$$\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-1"\u003e((t|\u003c/tspan\u003e\u003ctspan x="109.6" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-0"\u003e$$$\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-1"\u003e||TtP\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-1"\u003e`,\u003c/tspan\u003e\u003ctspan x="210.7" class="fg-1"\u003e(`\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e```|t\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003el\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003et(\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-0"\u003e0\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003etthhhh$$$$$D88@\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-6"\u003ehhPXX\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-4"\u003eXPP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003e88DDD\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-5"\u003e`\\\\\\TTtPPPDD@@@\u003c/tspan\u003e\u003ctspan x="876.5" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-3"\u003etttDDDDD\u003c/tspan\u003e\u003ctspan x="977.6" class="fg-7"\u003ePPP$\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="33.6" dy="1em"\u003e\u003ctspan x="0.0" class="fg-4"\u003e,,,,,,,,,\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-1"\u003e|Ttt|\u003c/tspan\u003e\u003ctspan x="118.0" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="168.6" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003eTt\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-1"\u003e|T,\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-3"\u003e|\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003e$\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eD\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-6"\u003eTttthhhhX$D888@\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-6"\u003ehhPPX\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003eXP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-1"\u003ehhh\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003e8DDD\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-5"\u003e```\\TTTtttPDD@@\u003c/tspan\u003e\u003ctspan x="876.5" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003ctspan x="986.1" class="fg-7"\u003ePP\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-1"\u003eD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="50.4" dy="1em"\u003e\u003ctspan x="0.0" class="fg-4"\u003e,,,,,\u003c/tspan\u003e\u003ctspan x="42.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="50.6" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="84.3" class="fg-1"\u003e||tt(\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e||t\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003e|t\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003e,|t\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003et|\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003ett\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-6"\u003eTltttthh$$\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-6"\u003eDD88@@\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="691.1" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003e888DDD\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-5"\u003e```\\TTTtttPP@@@\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-7"\u003eTTT\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettDDDDDD\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-1"\u003eD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="67.2" dy="1em"\u003e\u003ctspan x="0.0" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="25.3" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="42.1" class="fg-1"\u003e||||\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="92.7" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003e(||\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e||(P$\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003e,``\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003e`T\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003ett(\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e,th\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-4"\u003e|\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-6"\u003eTttthhh$$$\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-4"\u003ettt\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-6"\u003e88@\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003ehXP\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003eXXPP\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="691.1" class="fg-1"\u003ehhtt\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-4"\u003ePDDD\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-5"\u003e`\\\\TTTttPPDDD@\u003c/tspan\u003e\u003ctspan x="893.4" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-7"\u003eTT\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-1"\u003eD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="84.0" dy="1em"\u003e\u003ctspan x="0.0" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="25.3" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="50.6" class="fg-1"\u003e|||||\u003c/tspan\u003e\u003ctspan x="92.7" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-1"\u003eTt\u003c/tspan\u003e\u003ctspan x="118.0" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="134.8" class="fg-1"\u003eT|\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e|||TP$\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="236.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e,,,t\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003e`,`\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003etth\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-1"\u003e,t\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-0"\u003eT\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-6"\u003e88\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-6"\u003ethhhhhX$$\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-6"\u003e888@@\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003eXXXPPP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-1"\u003ehttt\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-4"\u003eDDDDD\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-5"\u003e`\\\\TT(ttPPDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettPDDDDD\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-1"\u003eD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="100.8" dy="1em"\u003e\u003ctspan x="16.9" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="33.7" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="50.6" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="67.4" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-1"\u003e||||TT\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="134.8" class="fg-1"\u003etT\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="185.4" class="fg-1"\u003e||\\Tt\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="236.0" class="fg-1"\u003et`\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003ett|\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003e`|\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-0"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-3"\u003e|\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-7"\u003e(\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003e|\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-4"\u003e|\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-6"\u003e888\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-6"\u003etthhPPP$$\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-4"\u003ePt\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-4"\u003eXXPP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="691.1" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-4"\u003ePPDDD\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-5"\u003e``\\\\\\TtttPPD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-3"\u003etttPDDD\u003c/tspan\u003e\u003ctspan x="986.1" class="fg-7"\u003ePPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="117.6" dy="1em"\u003e\u003ctspan x="25.3" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="50.6" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="67.4" class="fg-0"\u003e$P\u003c/tspan\u003e\u003ctspan x="84.3" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="118.0" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003ett\u003c/tspan\u003e\u003ctspan x="143.3" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003e|(t\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003e,|\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003et||t\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-7"\u003et\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003e|lTT\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-6"\u003e888\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-6"\u003ettthhPXP$\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-4"\u003etPt\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003ehhP\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-4"\u003e888DDD\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-5"\u003e```\\\\\\TtthDDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-3"\u003etttDDDD\u003c/tspan\u003e\u003ctspan x="986.1" class="fg-7"\u003ePP$\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="134.4" dy="1em"\u003e\u003ctspan x="25.3" class="fg-1"\u003e`````\u003c/tspan\u003e\u003ctspan x="67.4" class="fg-4"\u003e,,,,,,,\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003e|Tt\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="160.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="168.6" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003e|||P$\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e|(\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003e`|\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-6"\u003e\u0026lt;\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eTTTTTTt\u003c/tspan\u003e\u003ctspan x="514.1" class="fg-6"\u003e88\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-6"\u003etthhPP$$\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003e888@@\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-4"\u003e888DDD\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e``\\\\TttPDDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettPDDDDD\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-7"\u003eP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="151.2" dy="1em"\u003e\u003ctspan x="42.1" class="fg-1"\u003e````\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003e||Tt(|```\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-1"\u003e|tP$\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-3"\u003e|\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e|`\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e(\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-3"\u003e,\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-7"\u003e|\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-3"\u003e,\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-7"\u003eh\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-6"\u003el\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003eTTTTTT\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-6"\u003e888\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-6"\u003ettthhhP$$\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-4"\u003ePP\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003e8@@@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-4"\u003eXX\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003ehhX\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\(tttPDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttDDDDD\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-7"\u003eP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="168.0" dy="1em"\u003e\u003ctspan x="50.6" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="75.9" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-1"\u003e||||((\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003eTt\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-1"\u003e`t\u003c/tspan\u003e\u003ctspan x="261.3" class="fg-1"\u003e(`\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e(\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003e`hl\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-3"\u003e`\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003eT\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003e|T\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-6"\u003eD8DDD88888\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-6"\u003ethhPPPP$$888@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003eXP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-4"\u003eX\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-4"\u003e88DDD\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e``\\\\TtttDDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="184.8" dy="1em"\u003e\u003ctspan x="75.9" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="92.7" class="fg-4"\u003e,,,,,,,,\u003c/tspan\u003e\u003ctspan x="160.1" class="fg-1"\u003e|T(|\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-1"\u003e|(t\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-1"\u003eT|\u003c/tspan\u003e\u003ctspan x="269.7" class="fg-1"\u003e(\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e`(\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`|\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003e|\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-7"\u003e\\\\\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-7"\u003el\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-6"\u003e,,|lP888888\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-4"\u003ePPP\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-6"\u003e888\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-6"\u003etthhhP$$\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003eXXP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003ePP\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-4"\u003e88DDDD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e```\\TtttDDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-7"\u003eTTT\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttPPDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="201.6" dy="1em"\u003e\u003ctspan x="75.9" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="160.1" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e(((\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-4"\u003e,,,,,\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-1"\u003eh$\u003c/tspan\u003e\u003ctspan x="269.7" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="278.1" class="fg-1"\u003e,`\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-7"\u003e|\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003eD@\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003eXDDDD\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e((hhh\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-6"\u003e888888888\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-6"\u003ettthhX$$$\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-6"\u003e88\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003e8DD\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e``\\\\TtttPDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="218.4" dy="1em"\u003e\u003ctspan x="84.3" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="101.1" class="fg-4"\u003e,,,,,,,,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e|T\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="210.7" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="236.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-1"\u003e|t\u003c/tspan\u003e\u003ctspan x="269.7" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-1"\u003e|,\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003ellt\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-6"\u003e88\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-6"\u003eTT\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003etttt\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-6"\u003e88888DD8888\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-6"\u003etthhPP$$\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003ePP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003e88DDD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e``\\\\TtttPDD@@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="918.7" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttPPDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="235.2" dy="1em"\u003e\u003ctspan x="101.1" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="185.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003eT||\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-1"\u003e|Tt\u003c/tspan\u003e\u003ctspan x="278.1" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-1"\u003et\\\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-0"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003e|(t\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003etTTTltthP$$DD$$$$XXhhhhhhXX$\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003ePP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e8@\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003eXPP\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-1"\u003ehhh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88DD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e``\\\\TttPPDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e888\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettPPPPDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="252.0" dy="1em"\u003e\u003ctspan x="118.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="126.4" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="151.7" class="fg-1"\u003e`````\u003c/tspan\u003e\u003ctspan x="193.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="202.3" class="fg-1"\u003e||T\u003c/tspan\u003e\u003ctspan x="227.6" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="269.7" class="fg-1"\u003e|th\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-1"\u003e```t\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003eh\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003eD8\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003eTlttP$$\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003et\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-6"\u003ehhhPPPPhh\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-6"\u003e@8D$XXhXX$\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-4"\u003ePPP\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003eXXPP\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88D\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\TtttPDD@\u003c/tspan\u003e\u003ctspan x="893.4" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="268.8" dy="1em"\u003e\u003ctspan x="126.4" class="fg-1"\u003e``````\u003c/tspan\u003e\u003ctspan x="177.0" class="fg-4"\u003e,,,,,\u003c/tspan\u003e\u003ctspan x="219.1" class="fg-1"\u003e|(|\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="278.1" class="fg-1"\u003eT$\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-1"\u003eh(\u003c/tspan\u003e\u003ctspan x="320.3" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003eX\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-0"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-6"\u003etl\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003etX$D@@\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-6"\u003ehXDPDDDDDDDDDXh\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-6"\u003e@D$X$$$$\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="691.1" class="fg-4"\u003eXXPP\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003ehh\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\TttXDD@@\u003c/tspan\u003e\u003ctspan x="893.4" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettPPPDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="285.6" dy="1em"\u003e\u003ctspan x="151.7" class="fg-1"\u003e``````\u003c/tspan\u003e\u003ctspan x="210.7" class="fg-1"\u003e``||T\u003c/tspan\u003e\u003ctspan x="252.8" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-1"\u003e|t$ht((|P\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003ehhPD\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-6"\u003ethPDD\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-6"\u003e(((TTT\\\\\\T\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-6"\u003eDDDPPh\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-6"\u003et\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003e$XX$\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e888@\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-4"\u003eXXPP\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88D\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-5"\u003e```\\TttPDDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003ettPDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="302.4" dy="1em"\u003e\u003ctspan x="227.6" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="236.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="244.4" class="fg-1"\u003e|(|``\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-1"\u003e|tP\u003c/tspan\u003e\u003ctspan x="320.3" class="fg-1"\u003e,,\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-1"\u003et|h\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003etP\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003e\\thP\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-6"\u003e(TTt\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-0"\u003eh\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-0"\u003ep\u003c/tspan\u003e\u003ctspan x="488.8" class="fg-3"\u003eT\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-0"\u003ep\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-6"\u003e```\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-5"\u003eT\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-6"\u003e@@@8D$$88@@\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003eXP\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003eXP\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehhX\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88DD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\TtttPDD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDDDD\u003c/tspan\u003e\u003ctspan x="918.7" class="fg-4"\u003e88\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="319.2" dy="1em"\u003e\u003ctspan x="227.6" class="fg-1"\u003e```||\\``\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-1"\u003e|t\u003c/tspan\u003e\u003ctspan x="320.3" class="fg-1"\u003e`|\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-1"\u003ehtt\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-0"\u003e\u0026lt;\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-6"\u003e\u0026lt;ThP\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-6"\u003e(\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-7"\u003eP\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-1"\u003e```||(\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003ellP\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-0"\u003e|\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-6"\u003e@8D\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003ett\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003eX\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehhX\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88D\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\\\TTtPPD@\u003c/tspan\u003e\u003ctspan x="893.4" class="fg-4"\u003eDDDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-3"\u003etttPPPPPD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="336.0" dy="1em"\u003e\u003ctspan x="227.6" class="fg-1"\u003e````\u003c/tspan\u003e\u003ctspan x="261.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="269.7" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="278.1" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="320.3" class="fg-1"\u003eT\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-1"\u003e$\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-7"\u003eT\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-0"\u003ex\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-6"\u003e(t\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-0"\u003e8\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e`\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-1"\u003e`````````\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-1"\u003e|T\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-2"\u003e`\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-1"\u003eD\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-6"\u003e@8D$$88@\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003eXPPP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e888D\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-5"\u003e`\\\\TTTtPPPD@@\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8888\u003c/tspan\u003e\u003ctspan x="960.8" class="fg-3"\u003etttPPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="352.8" dy="1em"\u003e\u003ctspan x="261.3" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="278.1" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-1"\u003eTt\u003c/tspan\u003e\u003ctspan x="345.5" class="fg-1"\u003e,,\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003eht\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="522.5" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e\\h(D\u003c/tspan\u003e\u003ctspan x="590.0" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003eth\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003e@D$$888\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehPX\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88DD\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e`\\TTTtPPPDD@@\u003c/tspan\u003e\u003ctspan x="918.7" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-4"\u003e8888\u003c/tspan\u003e\u003ctspan x="969.2" class="fg-3"\u003ettPPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="369.6" dy="1em"\u003e\u003ctspan x="278.1" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="286.6" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="295.0" class="fg-0"\u003e(\u003c/tspan\u003e\u003ctspan x="303.4" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="311.8" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-1"\u003e|T\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e||(\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003eT||\u003c/tspan\u003e\u003ctspan x="522.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e(\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-1"\u003eT|\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-1"\u003eTt\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-3"\u003e\\\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003eDD\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003e88@\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehhh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e88DDD\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e`\\TTTtPPPDD@@@\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="952.4" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="960.8" class="fg-3"\u003ettPPPD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="386.4" dy="1em"\u003e\u003ctspan x="278.1" class="fg-1"\u003e```T||\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003eT\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`|\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003et|||\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="514.1" class="fg-1"\u003e``|\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e|||T\\\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-5"\u003eT\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003eD\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-4"\u003ePP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehhX\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003eXPP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-4"\u003e888DD\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e``\\TTtttPDDD@@\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-4"\u003e88XXX\u003c/tspan\u003e\u003ctspan x="977.6" class="fg-4"\u003eDDD$\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="403.2" dy="1em"\u003e\u003ctspan x="303.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="311.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="320.3" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-4"\u003e,,,,,\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003eT\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003et(``\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="573.1" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-1"\u003e\\\\|\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-5"\u003e`\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-0"\u003eh\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003ett\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003e$\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003ehhX\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-4"\u003e88DD\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e``\\TTTttPPDD@\u003c/tspan\u003e\u003ctspan x="918.7" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-4"\u003e88XXXXXXX\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="420.0" dy="1em"\u003e\u003ctspan x="303.4" class="fg-1"\u003e```|\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-1"\u003e,`\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003e,```\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="514.1" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="522.5" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-4"\u003e,,,,,\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-1"\u003e|||t\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-4"\u003etP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-4"\u003e88D\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e``\\TTTtttPPD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8XXXXP\u003c/tspan\u003e\u003ctspan x="977.6" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="986.1" class="fg-4"\u003ePPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="436.8" dy="1em"\u003e\u003ctspan x="303.4" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="328.7" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="337.1" class="fg-0"\u003e$$\u003c/tspan\u003e\u003ctspan x="354.0" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003e,`\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003et|\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="505.7" class="fg-1"\u003e|||,,,```\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="598.4" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-1"\u003e@\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-1"\u003et\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-0"\u003e@,\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-6"\u003e`\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-6"\u003eP\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-6"\u003e8@@@\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003eX\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-4"\u003eXPPP\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-4"\u003e8DD\u003c/tspan\u003e\u003ctspan x="800.7" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-5"\u003e```TTTtttPPD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e888XPPXXPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="453.6" dy="1em"\u003e\u003ctspan x="328.7" class="fg-1"\u003e```|||``\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003et(|`,\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-1"\u003e````\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e||||tTD\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-1"\u003eP\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-1"\u003elt|\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-0"\u003e@\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-6"\u003eT8888\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003eXX\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-4"\u003eXPPP\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-1"\u003ehh\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003e8DD\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="825.9" class="fg-5"\u003e`\\\\\\tttPPD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDDD\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-4"\u003e888XXXXDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="470.4" dy="1em"\u003e\u003ctspan x="354.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="362.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="370.8" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="379.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-1"\u003e|t(\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="547.8" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-1"\u003e||Thtth$\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-0"\u003e,\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-4"\u003e`\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-6"\u003e8@@\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003ehXX\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-4"\u003ePPP\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003ehhP\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003ePPP\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="825.9" class="fg-5"\u003e```\\TTTtPD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8DDDPPPPPP\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="487.2" dy="1em"\u003e\u003ctspan x="354.0" class="fg-1"\u003e```|||,\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003et(\\\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-1"\u003e,\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-1"\u003e|TttP\u003c/tspan\u003e\u003ctspan x="649.0" class="fg-1"\u003e,lP\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-7"\u003et\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="691.1" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-4"\u003eT\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-4"\u003eXXP\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-4"\u003e8DDD\u003c/tspan\u003e\u003ctspan x="825.9" class="fg-5"\u003e`\\\\\\\\TTPD@\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="927.1" class="fg-4"\u003e8PX\u003c/tspan\u003e\u003ctspan x="952.4" class="fg-4"\u003eD$DDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="504.0" dy="1em"\u003e\u003ctspan x="379.3" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="387.7" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="396.1" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="455.1" class="fg-1"\u003e((\\\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="488.8" class="fg-1"\u003e,,\u003c/tspan\u003e\u003ctspan x="581.5" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-4"\u003e,,,\u003c/tspan\u003e\u003ctspan x="632.1" class="fg-1"\u003e||T\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-1"\u003e`|T\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-0"\u003e,(\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-7"\u003e`\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-4"\u003et\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003ehP\u003c/tspan\u003e\u003ctspan x="741.7" class="fg-4"\u003eXP\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003e88DDD\u003c/tspan\u003e\u003ctspan x="825.9" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="834.4" class="fg-5"\u003e`\\\\TtTtD@\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-4"\u003e888X\u003c/tspan\u003e\u003ctspan x="943.9" class="fg-3"\u003ePP\u003c/tspan\u003e\u003ctspan x="960.8" class="fg-4"\u003eDDDDDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="520.8" dy="1em"\u003e\u003ctspan x="387.7" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="404.5" class="fg-0"\u003e$P\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-1"\u003e|`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-1"\u003e||T\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-1"\u003e``,\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003eT\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e8\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-6"\u003ehhP\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003eP\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003e888DDD\u003c/tspan\u003e\u003ctspan x="834.4" class="fg-5"\u003e``\\T\u003c/tspan\u003e\u003ctspan x="868.1" class="fg-1"\u003eP\u003c/tspan\u003e\u003ctspan x="876.5" class="fg-5"\u003ePD@\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-3"\u003ettPDDD\u003c/tspan\u003e\u003ctspan x="960.8" class="fg-4"\u003eDDDtt\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-4"\u003e8\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="537.6" dy="1em"\u003e\u003ctspan x="404.5" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="413.0" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="421.4" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="429.8" class="fg-1"\u003e(\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-0"\u003e(screaming)\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-1"\u003e````\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-1"\u003e||\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-0"\u003e(\u003c/tspan\u003e\u003ctspan x="682.7" class="fg-1"\u003e(((\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-0"\u003e(\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003et\u003c/tspan\u003e\u003ctspan x="724.8" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003eD\u003c/tspan\u003e\u003ctspan x="758.5" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-4"\u003e8D\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-6"\u003e@@@\u003c/tspan\u003e\u003ctspan x="834.4" class="fg-5"\u003e,\\\\\u003c/tspan\u003e\u003ctspan x="859.7" class="fg-1"\u003eP\u003c/tspan\u003e\u003ctspan x="868.1" class="fg-5"\u003ePD\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-4"\u003eDD\u003c/tspan\u003e\u003ctspan x="901.8" class="fg-4"\u003e8\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-3"\u003ePPD\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-4"\u003e@@@888DDD\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="554.4" dy="1em"\u003e\u003ctspan x="404.5" class="fg-1"\u003e```T|\u003c/tspan\u003e\u003ctspan x="606.8" class="fg-1"\u003e```\u003c/tspan\u003e\u003ctspan x="640.5" class="fg-1"\u003e``\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-1"\u003e|||(\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-0"\u003eP\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e$@\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003eXP\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-1"\u003eh\u003c/tspan\u003e\u003ctspan x="792.2" class="fg-4"\u003e8D\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-6"\u003e@@\u003c/tspan\u003e\u003ctspan x="825.9" class="fg-5"\u003e`TT\u003c/tspan\u003e\u003ctspan x="851.2" class="fg-1"\u003ePt\u003c/tspan\u003e\u003ctspan x="868.1" class="fg-5"\u003eD@\u003c/tspan\u003e\u003ctspan x="884.9" class="fg-3"\u003e\u0026lt;\u0026lt;tD\u003c/tspan\u003e\u003ctspan x="918.7" class="fg-7"\u003ePP\u003c/tspan\u003e\u003ctspan x="935.5" class="fg-7"\u003e((\u003c/tspan\u003e\u003ctspan x="952.4" class="fg-4"\u003e@@@\u003c/tspan\u003e\u003ctspan x="977.6" class="fg-4"\u003e\\\\\\\u003c/tspan\u003e\u003ctspan x="1002.9" class="fg-0"\u003e@\u003c/tspan\u003e\u003c/tspan\u003e\u003ctspan y="571.2" dy="1em"\u003e\u003ctspan x="429.8" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="438.3" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="446.7" class="fg-1"\u003e|(\u003c/tspan\u003e\u003ctspan x="463.5" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="472.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="480.4" class="fg-4"\u003e,,\u003c/tspan\u003e\u003ctspan x="497.3" class="fg-1"\u003eT((T\u003c/tspan\u003e\u003ctspan x="531.0" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="539.4" class="fg-1"\u003et\\\u003c/tspan\u003e\u003ctspan x="556.2" class="fg-0"\u003e$\u003c/tspan\u003e\u003ctspan x="564.7" class="fg-4"\u003e,,,,,,\u003c/tspan\u003e\u003ctspan x="615.2" class="fg-1"\u003e`\u003c/tspan\u003e\u003ctspan x="623.7" class="fg-4"\u003e,,,,\u003c/tspan\u003e\u003ctspan x="657.4" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="665.8" class="fg-4"\u003e,\u003c/tspan\u003e\u003ctspan x="674.2" class="fg-1"\u003e|||\u003c/tspan\u003e\u003ctspan x="699.5" class="fg-1"\u003e|\u003c/tspan\u003e\u003ctspan x="708.0" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="716.4" class="fg-6"\u003e$8\u003c/tspan\u003e\u003ctspan x="733.2" class="fg-6"\u003ehX\u003c/tspan\u003e\u003ctspan x="750.1" class="fg-4"\u003eXP\u003c/tspan\u003e\u003ctspan x="766.9" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="775.4" class="fg-6"\u003eh\u003c/tspan\u003e\u003ctspan x="783.8" class="fg-4"\u003e88D\u003c/tspan\u003e\u003ctspan x="809.1" class="fg-6"\u003e@\u003c/tspan\u003e\u003ctspan x="817.5" class="fg-5"\u003e`\\\u003c/tspan\u003e\u003ctspan x="834.4" class="fg-1"\u003ePt\u003c/tspan\u003e\u003ctspan x="851.2" class="fg-5"\u003eD@@\u003c/tspan\u003e\u003ctspan x="876.5" class="fg-3"\u003e\u0026lt;thD\u003c/tspan\u003e\u003ctspan x="910.2" class="fg-7"\u003e||(tt\u003c/tspan\u003e\u003ctspan x="952.4" class="fg-0"\u003e@@\u003c/tspan\u003e\u003ctspan x="969.2" class="fg-7"\u003ehhhhh\u003c/tspan\u003e\u003c/tspan\u003e\u003c/text\u003e\u003c/svg\u003e\u003c/svg\u003e',
+    cols: 253,
+    rows: 122,
+    cursorX: 120,
+    cursorY: 34,
+    cursorVisible: true,
+    startOffset: 17505,
+    endOffset: 18504,
+  },
+];
diff --git a/web/packages/teleport/src/SessionRecordings/list/state.test.tsx b/web/packages/teleport/src/SessionRecordings/list/state.test.tsx
new file mode 100644
index 0000000000000..02490771f5857
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/state.test.tsx
@@ -0,0 +1,890 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook } from '@testing-library/react';
+import { createMemoryHistory } from 'history';
+import type { PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import { EventRange } from 'teleport/components/EventRangePicker';
+
+import {
+  searchParamsToState,
+  statesAreEqual,
+  stateToSearchParams,
+  useRecordingsListState,
+  type RecordingsListState,
+} from './state';
+
+describe('searchParamsToState', () => {
+  const mockRanges: EventRange[] = [
+    {
+      from: new Date('2025-01-01'),
+      to: new Date('2025-01-31'),
+      name: 'Last 30 days',
+    },
+    {
+      from: new Date('2025-01-15'),
+      to: new Date('2025-01-31'),
+      name: 'Last 14 days',
+    },
+    {
+      from: new Date('2025-01-24'),
+      to: new Date('2025-01-31'),
+      name: 'Last 7 days',
+    },
+  ];
+
+  it('returns default state when no params provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state).toEqual({
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    });
+  });
+
+  it('parses timeframe parameter correctly', () => {
+    const params = new URLSearchParams('?timeframe=2');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.range).toBe(mockRanges[2]);
+  });
+
+  it('parses custom date range correctly', () => {
+    const from = '2025-01-10T00:00:00.000Z';
+    const to = '2025-01-20T00:00:00.000Z';
+
+    const params = new URLSearchParams(`?from=${from}&to=${to}`);
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.range).toEqual({
+      from: new Date(from),
+      to: new Date(to),
+      isCustom: true,
+    });
+  });
+
+  it('ignores invalid timeframe values', () => {
+    const params = new URLSearchParams('?timeframe=invalid');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.range).toBe(mockRanges[0]);
+  });
+
+  it('ignores out of bounds timeframe values', () => {
+    const params = new URLSearchParams('?timeframe=100');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.range).toBe(mockRanges[0]);
+  });
+
+  it('parses filters correctly', () => {
+    const params = new URLSearchParams();
+
+    params.append('resources', 'server-01');
+    params.append('resources', 'server-02');
+    params.append('types', 'ssh');
+    params.append('types', 'desktop');
+    params.append('users', 'alice');
+    params.append('users', 'bob');
+
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters).toEqual({
+      resources: ['server-01', 'server-02'],
+      types: ['ssh', 'desktop'],
+      users: ['alice', 'bob'],
+      hideNonInteractive: false,
+    });
+  });
+
+  it('filters out invalid recording types', () => {
+    const params = new URLSearchParams();
+
+    params.append('types', 'ssh');
+    params.append('types', 'invalid-type');
+    params.append('types', 'desktop');
+
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters.types).toEqual(['ssh', 'desktop']);
+  });
+
+  it('parses sort parameters correctly', () => {
+    const params = new URLSearchParams('?sort=type&direction=ASC');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.sortKey).toBe('type');
+    expect(state.sortDirection).toBe('ASC');
+  });
+
+  it('ignores invalid sort key', () => {
+    const params = new URLSearchParams('?sort=invalid');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.sortKey).toBe('date');
+  });
+
+  it('ignores invalid sort direction', () => {
+    const params = new URLSearchParams('?direction=INVALID');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.sortDirection).toBe('DESC');
+  });
+
+  it('parses page parameter correctly', () => {
+    const params = new URLSearchParams('?page=5');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.page).toBe(5);
+  });
+
+  it('ignores invalid page values', () => {
+    const params = new URLSearchParams('?page=invalid');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.page).toBe(0);
+  });
+
+  it('ignores negative page values', () => {
+    const params = new URLSearchParams('?page=-1');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.page).toBe(0);
+  });
+
+  it('parses hideNonInteractive parameter when true', () => {
+    const params = new URLSearchParams('?hide_non_interactive=true');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters.hideNonInteractive).toBe(true);
+  });
+
+  it('defaults hideNonInteractive to false when not provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters.hideNonInteractive).toBe(false);
+  });
+
+  it('ignores invalid hideNonInteractive values', () => {
+    const params = new URLSearchParams('?hide_non_interactive=invalid');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters.hideNonInteractive).toBe(false);
+  });
+
+  it('ignores hideNonInteractive when set to false', () => {
+    const params = new URLSearchParams('?hide_non_interactive=false');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.filters.hideNonInteractive).toBe(false);
+  });
+
+  it('parses search parameter correctly', () => {
+    const params = new URLSearchParams('?search=test%20query');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.search).toBe('test query');
+  });
+
+  it('defaults search to empty string when not provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.search).toBe('');
+  });
+
+  it('handles empty search parameter', () => {
+    const params = new URLSearchParams('?search=');
+    const state = searchParamsToState(mockRanges, params);
+
+    expect(state.search).toBe('');
+  });
+});
+
+describe('stateToSearchParams', () => {
+  const mockRanges: EventRange[] = [
+    {
+      from: new Date('2025-01-01'),
+      to: new Date('2025-01-31'),
+      name: 'Last 30 days',
+    },
+    {
+      from: new Date('2025-01-15'),
+      to: new Date('2025-01-31'),
+      name: 'Last 14 days',
+    },
+  ];
+
+  it('returns empty params for default state', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+
+    expect(params).toBe('');
+  });
+
+  it('includes custom date range', () => {
+    const from = new Date('2025-01-10T00:00:00.000Z');
+    const to = new Date('2025-01-20T00:00:00.000Z');
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: { from, to, isCustom: true },
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('from')).toBe(from.toISOString());
+    expect(urlParams.get('to')).toBe(to.toISOString());
+  });
+
+  it('includes all filters', () => {
+    const state: RecordingsListState = {
+      filters: {
+        resources: ['server-01', 'server-02'],
+        types: ['ssh', 'desktop'],
+        users: ['alice', 'bob'],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.getAll('resources')).toEqual(['server-01', 'server-02']);
+    expect(urlParams.getAll('types')).toEqual(['ssh', 'desktop']);
+    expect(urlParams.getAll('users')).toEqual(['alice', 'bob']);
+  });
+
+  it('includes non-default sort parameters', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'type',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('sort')).toBe('type');
+    expect(urlParams.get('direction')).toBe('ASC');
+  });
+
+  it('includes non-zero page', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 3,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    expect(params).toBe('page=3');
+  });
+
+  it('combines all parameters correctly', () => {
+    const state: RecordingsListState = {
+      filters: {
+        resources: ['server-01'],
+        types: ['ssh'],
+        users: ['alice'],
+        hideNonInteractive: false,
+      },
+      page: 2,
+      range: {
+        from: new Date('2025-01-10T00:00:00.000Z'),
+        to: new Date('2025-01-20T00:00:00.000Z'),
+        isCustom: true,
+      },
+      search: '',
+      sortKey: 'type',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('from')).toBeTruthy();
+    expect(urlParams.get('to')).toBeTruthy();
+    expect(urlParams.getAll('resources')).toEqual(['server-01']);
+    expect(urlParams.getAll('types')).toEqual(['ssh']);
+    expect(urlParams.getAll('users')).toEqual(['alice']);
+    expect(urlParams.get('sort')).toBe('type');
+    expect(urlParams.get('direction')).toBe('ASC');
+    expect(urlParams.get('page')).toBe('2');
+  });
+
+  it('includes hideNonInteractive when true', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: true,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('hide_non_interactive')).toBe('true');
+  });
+
+  it('omits hideNonInteractive when false', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.has('hide_non_interactive')).toBe(false);
+  });
+
+  it('includes hideNonInteractive with other filters', () => {
+    const state: RecordingsListState = {
+      filters: {
+        resources: ['server-01'],
+        types: ['ssh'],
+        users: ['alice'],
+        hideNonInteractive: true,
+      },
+      page: 1,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'type',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('hide_non_interactive')).toBe('true');
+    expect(urlParams.getAll('resources')).toEqual(['server-01']);
+    expect(urlParams.getAll('types')).toEqual(['ssh']);
+    expect(urlParams.getAll('users')).toEqual(['alice']);
+    expect(urlParams.get('page')).toBe('1');
+    expect(urlParams.get('sort')).toBe('type');
+    expect(urlParams.get('direction')).toBe('ASC');
+  });
+
+  it('includes search when not empty', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: 'test query',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('search')).toBe('test query');
+  });
+
+  it('omits search when empty', () => {
+    const state: RecordingsListState = {
+      filters: {
+        types: [],
+        resources: [],
+        users: [],
+        hideNonInteractive: false,
+      },
+      page: 0,
+      range: mockRanges[0],
+      search: '',
+      sortKey: 'date',
+      sortDirection: 'DESC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.has('search')).toBe(false);
+  });
+
+  it('includes search with other parameters', () => {
+    const state: RecordingsListState = {
+      filters: {
+        resources: ['server-01'],
+        types: ['ssh'],
+        users: ['alice'],
+        hideNonInteractive: true,
+      },
+      page: 1,
+      range: mockRanges[0],
+      search: 'important session',
+      sortKey: 'type',
+      sortDirection: 'ASC',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('search')).toBe('important session');
+    expect(urlParams.getAll('resources')).toEqual(['server-01']);
+    expect(urlParams.getAll('types')).toEqual(['ssh']);
+    expect(urlParams.getAll('users')).toEqual(['alice']);
+    expect(urlParams.get('hide_non_interactive')).toBe('true');
+    expect(urlParams.get('page')).toBe('1');
+    expect(urlParams.get('sort')).toBe('type');
+    expect(urlParams.get('direction')).toBe('ASC');
+  });
+});
+
+describe('statesAreEqual', () => {
+  const baseState: RecordingsListState = {
+    filters: {
+      types: ['ssh'],
+      resources: ['server-01'],
+      users: ['alice'],
+      hideNonInteractive: false,
+    },
+    page: 1,
+    range: {
+      from: new Date('2025-01-01'),
+      to: new Date('2025-01-31'),
+      isCustom: false,
+    },
+    search: 'test',
+    sortKey: 'date',
+    sortDirection: 'DESC',
+  };
+
+  it('returns true for identical states', () => {
+    const state1 = { ...baseState };
+    const state2 = { ...baseState };
+
+    expect(statesAreEqual(state1, state2)).toBe(true);
+  });
+
+  it('returns false when ranges differ', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      range: {
+        from: new Date('2025-01-10'),
+        to: new Date('2025-01-31'),
+        isCustom: false,
+      },
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns false when isCustom differs', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      range: { ...baseState.range, isCustom: true },
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns false when filters differ', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      filters: {
+        ...baseState.filters,
+        users: ['alice', 'bob'],
+      },
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns false when sort parameters differ', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      sortKey: 'type' as const,
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns false when page differs', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      page: 2,
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns true when filter arrays have same values in same order', () => {
+    const state1 = { ...baseState };
+    const state2 = { ...baseState };
+
+    expect(statesAreEqual(state1, state2)).toBe(true);
+  });
+
+  it('returns false when hideNonInteractive differs', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      filters: {
+        ...baseState.filters,
+        hideNonInteractive: true,
+      },
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns true when hideNonInteractive is the same', () => {
+    const state1 = {
+      ...baseState,
+      filters: {
+        ...baseState.filters,
+        hideNonInteractive: true,
+      },
+    };
+    const state2 = {
+      ...baseState,
+      filters: {
+        ...baseState.filters,
+        hideNonInteractive: true,
+      },
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(true);
+  });
+
+  it('returns false when search differs', () => {
+    const state1 = { ...baseState };
+    const state2 = {
+      ...baseState,
+      search: 'different search',
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(false);
+  });
+
+  it('returns true when search is the same', () => {
+    const state1 = {
+      ...baseState,
+      search: 'same query',
+    };
+    const state2 = {
+      ...baseState,
+      search: 'same query',
+    };
+
+    expect(statesAreEqual(state1, state2)).toBe(true);
+  });
+});
+
+describe('useRecordingsListState', () => {
+  const mockRanges: EventRange[] = [
+    {
+      from: new Date('2025-01-01'),
+      to: new Date('2025-01-31'),
+      name: 'Last 30 days',
+    },
+  ];
+
+  it('initializes state from URL search params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/session-recordings?page=2&sort=type'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [state] = result.current;
+
+    expect(state.page).toBe(2);
+    expect(state.sortKey).toBe('type');
+  });
+
+  it('updates URL when state changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        page: 3,
+        sortKey: 'type',
+      }));
+    });
+
+    expect(history.location.search).toContain('page=3');
+    expect(history.location.search).toContain('sort=type');
+  });
+
+  it('responds to browser navigation', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    act(() => {
+      history.push('?page=5&sort=type');
+    });
+
+    const [state] = result.current;
+
+    expect(state.page).toBe(5);
+    expect(state.sortKey).toBe('type');
+  });
+
+  it('prevents unnecessary state updates', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [initialState, setState] = result.current;
+
+    act(() => {
+      setState(initialState);
+    });
+
+    const [newState] = result.current;
+
+    expect(newState).toBe(initialState);
+  });
+
+  it('handles functional updates', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        page: prev.page + 1,
+      }));
+    });
+
+    const [state] = result.current;
+
+    expect(state.page).toBe(1);
+  });
+
+  it('does not update URL for default empty search params', () => {
+    const history = createMemoryHistory();
+    const replaceSpy = jest.spyOn(history, 'replace');
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    renderHook(() => useRecordingsListState(mockRanges), { wrapper });
+
+    expect(replaceSpy).not.toHaveBeenCalled();
+  });
+
+  it('handles hideNonInteractive filter in URL params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/session-recordings?hide_non_interactive=true'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [state] = result.current;
+
+    expect(state.filters.hideNonInteractive).toBe(true);
+  });
+
+  it('updates URL when hideNonInteractive filter changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        filters: {
+          ...prev.filters,
+          hideNonInteractive: true,
+        },
+      }));
+    });
+
+    expect(history.location.search).toContain('hide_non_interactive=true');
+  });
+
+  it('handles search parameter in URL params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/session-recordings?search=test%20query'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [state] = result.current;
+
+    expect(state.search).toBe('test query');
+  });
+
+  it('updates URL when search changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useRecordingsListState(mockRanges), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState(prev => ({
+        ...prev,
+        search: 'new search term',
+      }));
+    });
+
+    expect(history.location.search).toContain('search=new+search+term');
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/list/state.ts b/web/packages/teleport/src/SessionRecordings/list/state.ts
new file mode 100644
index 0000000000000..3d94c3c30214c
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/list/state.ts
@@ -0,0 +1,322 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  startTransition,
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+  type Dispatch,
+  type SetStateAction,
+} from 'react';
+import { useHistory } from 'react-router';
+
+import { SortOrder } from 'shared/components/Controls/SortMenuV2';
+
+import {
+  EventRange,
+  getRangeOptions,
+} from 'teleport/components/EventRangePicker';
+import {
+  validateRecordingType,
+  type RecordingType,
+} from 'teleport/services/recordings';
+
+export interface RecordingsListFilters {
+  hideNonInteractive: boolean;
+  resources: string[];
+  types: RecordingType[];
+  users: string[];
+}
+
+export interface RecordingsListState {
+  filters: RecordingsListFilters;
+  page: number;
+  range: EventRange;
+  search: string;
+  sortKey: string;
+  sortDirection: SortOrder;
+}
+
+export type RecordingsListFilterKey = keyof RecordingsListFilters;
+
+export function searchParamsToState(
+  ranges: EventRange[],
+  params: URLSearchParams
+) {
+  const state: RecordingsListState = {
+    filters: {
+      hideNonInteractive: false,
+      types: [],
+      resources: [],
+      users: [],
+    },
+    page: 0,
+    range: ranges[0],
+    search: '',
+    sortKey: 'date',
+    sortDirection: 'DESC',
+  };
+
+  // if the user is using a predefined range, we grab it from the URL params
+  // otherwise we use the custom range defined by the user
+  const timeframe = params.get('timeframe');
+
+  if (timeframe) {
+    const timeframeNumber = parseInt(timeframe, 10);
+
+    if (!isNaN(timeframeNumber) && timeframeNumber > 0) {
+      const range = ranges[timeframeNumber];
+
+      if (range) {
+        state.range = range;
+      }
+    }
+  } else {
+    const from = params.get('from');
+    const to = params.get('to');
+
+    if (from && to) {
+      const fromDate = new Date(from);
+      const toDate = new Date(to);
+
+      if (!isNaN(fromDate.getTime()) && !isNaN(toDate.getTime())) {
+        state.range = {
+          from: fromDate,
+          to: toDate,
+          isCustom: true,
+        };
+      }
+    }
+  }
+
+  const resources = params.getAll('resources');
+  if (resources.length > 0) {
+    state.filters.resources = resources;
+  }
+
+  const types = params.getAll('types');
+  if (types.length > 0) {
+    state.filters.types = types.filter(validateRecordingType);
+  }
+
+  const users = params.getAll('users');
+  if (users.length > 0) {
+    state.filters.users = users;
+  }
+
+  const hideNonInteractive = params.get('hide_non_interactive');
+  if (hideNonInteractive === 'true') {
+    state.filters.hideNonInteractive = true;
+  }
+
+  const sortKey = params.get('sort');
+  if (sortKey && ['date', 'type'].includes(sortKey)) {
+    state.sortKey = sortKey;
+  }
+
+  const direction = params.get('direction');
+  if (direction === 'ASC' || direction === 'DESC') {
+    state.sortDirection = direction;
+  }
+
+  const page = params.get('page');
+  if (page) {
+    const pageNumber = parseInt(page, 10);
+
+    if (!isNaN(pageNumber) && pageNumber >= 0) {
+      state.page = pageNumber;
+    }
+  }
+
+  const search = params.get('search');
+  if (search) {
+    state.search = search;
+  }
+
+  return state;
+}
+
+export function stateToSearchParams(state: RecordingsListState) {
+  const urlParams = new URLSearchParams();
+
+  if (state.range.isCustom) {
+    urlParams.set('from', state.range.from.toISOString());
+    urlParams.set('to', state.range.to.toISOString());
+  } else {
+    const index = getRangeOptions().findIndex(r => r.name === state.range.name);
+
+    // avoid setting timeframe for the default range
+    if (index > 0) {
+      urlParams.set('timeframe', index.toString());
+    }
+  }
+
+  if (state.filters.resources.length > 0) {
+    for (const resource of state.filters.resources) {
+      urlParams.append('resources', resource);
+    }
+  }
+
+  if (state.filters.types.length > 0) {
+    for (const type of state.filters.types) {
+      urlParams.append('types', type);
+    }
+  }
+
+  if (state.filters.users.length > 0) {
+    for (const user of state.filters.users) {
+      urlParams.append('users', user);
+    }
+  }
+
+  if (state.sortKey !== 'date') {
+    urlParams.set('sort', state.sortKey);
+  }
+
+  if (state.sortDirection !== 'DESC') {
+    urlParams.set('direction', state.sortDirection);
+  }
+
+  if (state.page > 0) {
+    urlParams.set('page', state.page.toString());
+  }
+
+  if (state.filters.hideNonInteractive) {
+    urlParams.set('hide_non_interactive', 'true');
+  }
+
+  if (state.search) {
+    urlParams.set('search', state.search);
+  }
+
+  return urlParams.toString();
+}
+
+function sortArray(array: string[]) {
+  return array.toSorted((a, b) => a.localeCompare(b));
+}
+
+function arraysAreEqual(a: string[], b: string[]) {
+  if (a.length !== b.length) {
+    return false;
+  }
+
+  return JSON.stringify(sortArray(a)) === JSON.stringify(sortArray(b));
+}
+
+function filtersAreEqual(a: RecordingsListFilters, b: RecordingsListFilters) {
+  return (
+    a.hideNonInteractive === b.hideNonInteractive &&
+    arraysAreEqual(a.types, b.types) &&
+    arraysAreEqual(a.users, b.users) &&
+    arraysAreEqual(a.resources, b.resources)
+  );
+}
+
+export function statesAreEqual(a: RecordingsListState, b: RecordingsListState) {
+  return (
+    a.range.from.getTime() === b.range.from.getTime() &&
+    a.range.to.getTime() === b.range.to.getTime() &&
+    a.range.isCustom === b.range.isCustom &&
+    filtersAreEqual(a.filters, b.filters) &&
+    a.sortKey === b.sortKey &&
+    a.sortDirection === b.sortDirection &&
+    a.page === b.page &&
+    a.search === b.search
+  );
+}
+
+// useRecordingsListState is a custom hook that manages the state of the recordings list,
+// syncing it with the URL search parameters.
+// It allows for state updates and ensures that the URL reflects the current state.
+// It also listens for changes in the URL to update the state accordingly.
+// (Provides a faster user experience vs. deriving the state directly from the URL)
+export function useRecordingsListState(
+  ranges: EventRange[]
+): [RecordingsListState, Dispatch<SetStateAction<RecordingsListState>>] {
+  const history = useHistory();
+
+  const [state, _setState] = useState<RecordingsListState>(() =>
+    searchParamsToState(ranges, new URLSearchParams(history.location.search))
+  );
+
+  const setState = useCallback(
+    (action: SetStateAction<RecordingsListState>) => {
+      startTransition(() => {
+        _setState(prev => {
+          let next: RecordingsListState;
+
+          if (typeof action === 'function') {
+            next = action(prev);
+
+            if (statesAreEqual(prev, next)) {
+              next = prev;
+            }
+          } else if (statesAreEqual(prev, action)) {
+            next = prev;
+          } else {
+            next = action;
+          }
+
+          return next;
+        });
+      });
+    },
+    []
+  );
+
+  const currentSearch = useRef<string>(history.location.search);
+
+  useEffect(() => {
+    const params = stateToSearchParams(state);
+
+    currentSearch.current = `?${params.toString()}`;
+
+    if (
+      history.location.search.length === 0 &&
+      currentSearch.current.length === 1 // empty, i.e. just '?'
+    ) {
+      // the current search is empty, and the state is also empty,
+      // so we don't need to update the URL
+      return;
+    }
+
+    if (history.location.search !== currentSearch.current) {
+      history.replace({
+        hash: history.location.hash,
+        search: currentSearch.current,
+      });
+    }
+  }, [history, state]);
+
+  useEffect(() => {
+    return history.listen(next => {
+      if (next.search !== currentSearch.current) {
+        _setState(
+          searchParamsToState(ranges, new URLSearchParams(next.search))
+        );
+
+        currentSearch.current = next.search;
+      }
+    });
+  }, [history, ranges]);
+
+  return [state, setState] as const;
+}
diff --git a/web/packages/teleport/src/SessionRecordings/mock.ts b/web/packages/teleport/src/SessionRecordings/mock.ts
new file mode 100644
index 0000000000000..84830c69b38ef
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/mock.ts
@@ -0,0 +1,60 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import {
+  MOCK_EVENTS,
+  MOCK_THUMBNAILS,
+} from 'teleport/SessionRecordings/list/mock';
+
+export function withMockThumbnails() {
+  return http.get(cfg.api.sessionRecording.thumbnail, ({ params }) => {
+    const index = MOCK_EVENTS.findIndex(e => e.sid === params.sessionId);
+
+    if (index === -1) {
+      return HttpResponse.json({ message: 'not found' }, { status: 404 });
+    }
+
+    return HttpResponse.json(MOCK_THUMBNAILS[index]);
+  });
+}
+
+export function withMockCluster() {
+  return http.get(cfg.api.clustersPath, () =>
+    HttpResponse.json([
+      {
+        name: 'teleport',
+        lastConnected: '2025-08-14T14:36:07.976470934Z',
+        status: 'online',
+        publicURL: '',
+        authVersion: '',
+        proxyVersion: '',
+      },
+    ])
+  );
+}
+
+export function withMockEvents() {
+  return http.get(cfg.api.clusterEventsRecordingsPath, () => {
+    return HttpResponse.json({
+      events: MOCK_EVENTS,
+    });
+  });
+}
diff --git a/web/packages/teleport/src/SessionRecordings/svg.ts b/web/packages/teleport/src/SessionRecordings/svg.ts
new file mode 100644
index 0000000000000..0e02ea40799e4
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/svg.ts
@@ -0,0 +1,82 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMemo } from 'react';
+import { type DefaultTheme } from 'styled-components';
+
+export function useThumbnailSvg(svg: string, styles: string) {
+  return useMemo(
+    () => svgToDataURIBase64(injectSVGStyles(svg, styles)),
+    [svg, styles]
+  );
+}
+
+export function injectSVGStyles(svg: string, styles: string) {
+  if (svg.includes('<style>')) {
+    return svg.replace(/<style>/, `<style>${styles}\n`);
+  }
+
+  const styleTag = `<style>${styles}</style>`;
+
+  return svg.replace(/<svg[^>]*>/, match => `${match}${styleTag}`);
+}
+
+export function generateTerminalSVGStyleTag(theme: DefaultTheme): string {
+  const colorMap = [
+    theme.colors.terminal.black,
+    theme.colors.terminal.red,
+    theme.colors.terminal.green,
+    theme.colors.terminal.yellow,
+    theme.colors.terminal.blue,
+    theme.colors.terminal.magenta,
+    theme.colors.terminal.cyan,
+    theme.colors.terminal.white,
+    theme.colors.terminal.brightBlack,
+    theme.colors.terminal.brightRed,
+    theme.colors.terminal.brightGreen,
+    theme.colors.terminal.brightYellow,
+    theme.colors.terminal.brightBlue,
+    theme.colors.terminal.brightMagenta,
+    theme.colors.terminal.brightCyan,
+    theme.colors.terminal.brightWhite,
+  ];
+
+  const rules: string[] = [
+    '.i { font-style: italic; }',
+    '.b { font-weight: bold; }',
+    '.u { text-decoration: underline; }',
+    `* { font-family: ${theme.fonts.mono} }`,
+    `.terminal { fill: ${theme.colors.terminal.foreground}; }`,
+    `.bg-default { fill: ${theme.colors.terminal.background}; }`,
+  ];
+
+  for (let i = 0; i < colorMap.length; i++) {
+    rules.push(`.fg-${i} { fill: ${colorMap[i]}; }`);
+    rules.push(`.bg-${i} { fill: ${colorMap[i]}; }`);
+  }
+
+  return rules.join('\n');
+}
+
+// svgToDataURIBase64 converts an SVG string to a Base64-encoded data URI, providing
+// a way to load SVG images in the code.
+export function svgToDataURIBase64(svg: string) {
+  const encoded = encodeURIComponent(svg.replace('<?xml version="1.0"?>', ''));
+
+  return `data:image/svg+xml;charset=utf-8,${encoded}`;
+}
diff --git a/web/packages/teleport/src/Player/ActionBar/ActionBar.tsx b/web/packages/teleport/src/SessionRecordings/view/ActionBar/ActionBar.tsx
similarity index 100%
rename from web/packages/teleport/src/Player/ActionBar/ActionBar.tsx
rename to web/packages/teleport/src/SessionRecordings/view/ActionBar/ActionBar.tsx
diff --git a/web/packages/teleport/src/Player/ActionBar/index.ts b/web/packages/teleport/src/SessionRecordings/view/ActionBar/index.ts
similarity index 100%
rename from web/packages/teleport/src/Player/ActionBar/index.ts
rename to web/packages/teleport/src/SessionRecordings/view/ActionBar/index.ts
diff --git a/web/packages/teleport/src/SessionRecordings/view/CurrentEventInfo.tsx b/web/packages/teleport/src/SessionRecordings/view/CurrentEventInfo.tsx
new file mode 100644
index 0000000000000..d5267bf1510aa
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/CurrentEventInfo.tsx
@@ -0,0 +1,134 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useImperativeHandle,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+  type Ref,
+} from 'react';
+import styled from 'styled-components';
+
+import { ButtonPrimary } from 'design/Button';
+import { FastForward } from 'design/Icon';
+
+import {
+  SessionRecordingEventType,
+  type SessionRecordingEvent,
+} from 'teleport/services/recordings';
+import { formatSessionRecordingDuration } from 'teleport/SessionRecordings/list/RecordingItem';
+
+export interface CurrentEventInfoHandle {
+  setTime: (time: number) => void;
+}
+
+interface CurrentEventInfoProps {
+  events: SessionRecordingEvent[];
+  onSeek: (time: number) => void;
+  ref?: Ref<CurrentEventInfoHandle>;
+}
+
+const EventsList = styled.div`
+  display: flex;
+  flex-direction: column;
+  gap: ${props => props.theme.space[2]}px;
+  position: absolute;
+  top: ${props => props.theme.space[4]}px;
+  right: ${props => props.theme.space[4]}px;
+  z-index: 2;
+`;
+
+export function CurrentEventInfo({
+  events,
+  onSeek,
+  ref,
+}: CurrentEventInfoProps) {
+  const [currentEvents, setCurrentEvents] = useState<SessionRecordingEvent[]>(
+    []
+  );
+  const currentEventsRef = useRef<SessionRecordingEvent[]>([]);
+
+  useImperativeHandle(ref, () => ({
+    setTime(time: number) {
+      const eventsInTimePeriod = events.filter(
+        e => e.startTime <= time && e.endTime >= time
+      );
+
+      const hasChanged =
+        eventsInTimePeriod.length !== currentEventsRef.current.length ||
+        eventsInTimePeriod.some(
+          (event, index) => event !== currentEventsRef.current[index]
+        );
+
+      if (hasChanged) {
+        currentEventsRef.current = eventsInTimePeriod;
+        setCurrentEvents(eventsInTimePeriod);
+      }
+    },
+  }));
+
+  const handleSkipToEnd = useCallback(
+    (time: number) => {
+      onSeek(time + 1);
+    },
+    [onSeek]
+  );
+
+  const items = useMemo(() => {
+    if (currentEvents.length === 0) {
+      return null;
+    }
+
+    const items: ReactNode[] = [];
+
+    for (const [index, event] of currentEvents.entries()) {
+      if (event.type !== SessionRecordingEventType.Inactivity) {
+        continue;
+      }
+
+      items.push(
+        <ButtonPrimary
+          key={`event-${index}-${event.type}`}
+          onClick={() => {
+            handleSkipToEnd(event.endTime);
+          }}
+          px={2}
+        >
+          Skip {formatSessionRecordingDuration(event.endTime - event.startTime)}{' '}
+          of inactivity
+          <FastForward size="small" ml={2} />
+        </ButtonPrimary>
+      );
+    }
+
+    if (items.length === 0) {
+      return null;
+    }
+
+    return items;
+  }, [currentEvents, handleSkipToEnd]);
+
+  if (currentEvents.length === 0) {
+    return null;
+  }
+
+  return <EventsList>{items}</EventsList>;
+}
diff --git a/web/packages/teleport/src/Player/DesktopPlayer.tsx b/web/packages/teleport/src/SessionRecordings/view/DesktopPlayer.tsx
similarity index 100%
rename from web/packages/teleport/src/Player/DesktopPlayer.tsx
rename to web/packages/teleport/src/SessionRecordings/view/DesktopPlayer.tsx
diff --git a/web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx b/web/packages/teleport/src/SessionRecordings/view/PlayerTabs/PlayerTabs.tsx
similarity index 100%
rename from web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx
rename to web/packages/teleport/src/SessionRecordings/view/PlayerTabs/PlayerTabs.tsx
diff --git a/web/packages/teleport/src/Player/PlayerTabs/index.ts b/web/packages/teleport/src/SessionRecordings/view/PlayerTabs/index.ts
similarity index 100%
rename from web/packages/teleport/src/Player/PlayerTabs/index.ts
rename to web/packages/teleport/src/SessionRecordings/view/PlayerTabs/index.ts
diff --git a/web/packages/teleport/src/Player/ProgressBar/ProgressBar.story.tsx b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/ProgressBar.story.tsx
similarity index 100%
rename from web/packages/teleport/src/Player/ProgressBar/ProgressBar.story.tsx
rename to web/packages/teleport/src/SessionRecordings/view/ProgressBar/ProgressBar.story.tsx
diff --git a/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/ProgressBar.tsx
similarity index 77%
rename from web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx
rename to web/packages/teleport/src/SessionRecordings/view/ProgressBar/ProgressBar.tsx
index c005fc5d50027..454a3452cf59b 100644
--- a/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx
+++ b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/ProgressBar.tsx
@@ -16,24 +16,64 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import React, { memo } from 'react';
+import React, { memo, useCallback, useEffect, useRef } from 'react';
 import styled from 'styled-components';
 
+import Flex from 'design/Flex';
 import * as Icons from 'design/Icon';
+import { Layout } from 'design/Icon';
+import { HoverTooltip } from 'design/Tooltip';
+import { useResizeObserver } from 'design/utils/useResizeObserver';
 
 import Slider from './Slider';
 
+interface SliderHandle {
+  _handleResize: () => void;
+}
+
 export default function ProgressBar(props: ProgressBarProps) {
   const Icon = props.isPlaying ? Icons.CirclePause : Icons.CirclePlay;
+  const sliderRef = useRef<SliderHandle>(null);
+
+  const containerRef = useResizeObserver(
+    useCallback(() => {
+      if (!sliderRef.current) {
+        return;
+      }
+
+      sliderRef.current._handleResize();
+    }, [])
+  );
+
+  const { onToggleTimeline } = props;
+
+  useEffect(() => {
+    if (!sliderRef.current) {
+      return;
+    }
+
+    sliderRef.current._handleResize();
+  }, [onToggleTimeline]);
+
   return (
     <StyledProgessBar
       style={props.style}
       id={props.id}
       disabled={props.disabled}
+      ref={containerRef}
     >
-      <ActionButton onClick={props.toggle} disabled={props.disabled}>
-        <Icon />
-      </ActionButton>
+      <Flex gap={3}>
+        {props.onToggleSidebar && (
+          <HoverTooltip tipContent="Toggle Sidebar">
+            <ActionButton onClick={props.onToggleSidebar}>
+              <Layout />
+            </ActionButton>
+          </HoverTooltip>
+        )}
+        <ActionButton onClick={props.toggle} disabled={props.disabled}>
+          <Icon />
+        </ActionButton>
+      </Flex>
       <PlaySpeedSelector
         onChange={props.onPlaySpeedChange}
         disabled={props.disabled}
@@ -41,6 +81,7 @@ export default function ProgressBar(props: ProgressBarProps) {
       <TimeText>{props.time}</TimeText>
       <SliderContainer>
         <Slider
+          ref={sliderRef}
           min={props.min}
           max={props.max}
           value={props.current}
@@ -53,6 +94,18 @@ export default function ProgressBar(props: ProgressBarProps) {
         />
       </SliderContainer>
       <Restart onRestart={props.onRestart} />
+      {onToggleTimeline && (
+        <HoverTooltip tipContent="Toggle Timeline">
+          <ActionButton
+            style={{
+              marginLeft: '16px',
+            }}
+            onClick={onToggleTimeline}
+          >
+            <Icons.FilmStrip />
+          </ActionButton>
+        </HoverTooltip>
+      )}
     </StyledProgessBar>
   );
 }
@@ -88,6 +141,8 @@ export type ProgressBarProps = {
   onStartMove?: () => void;
   onPlaySpeedChange?: (newSpeed: number) => void;
   onRestart?: () => void;
+  onToggleSidebar?: () => void;
+  onToggleTimeline?: () => void;
 };
 
 const PlaySpeedSelector = memo(
diff --git a/web/packages/teleport/src/Player/ProgressBar/Slider/Slider.jsx b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/Slider/Slider.jsx
similarity index 98%
rename from web/packages/teleport/src/Player/ProgressBar/Slider/Slider.jsx
rename to web/packages/teleport/src/SessionRecordings/view/ProgressBar/Slider/Slider.jsx
index 31cbe4f2b5d67..6d44af945265a 100644
--- a/web/packages/teleport/src/Player/ProgressBar/Slider/Slider.jsx
+++ b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/Slider/Slider.jsx
@@ -251,9 +251,13 @@ const ReactSlider = createReactClass({
     this.tempArray = value.slice();
 
     for (var i = 0; i < value.length; i++) {
+      // Disabling since this is legacy code copied from some other library.
+      // eslint-disable-next-line react/no-direct-mutation-state
       this.state.value[i] = this._trimAlignValue(value[i], newProps);
     }
     if (this.state.value.length > value.length)
+      // Disabling since this is legacy code copied from some other library.
+      // eslint-disable-next-line react/no-direct-mutation-state
       this.state.value.length = value.length;
 
     // If an upperBound has not yet been determined (due to the component being hidden
diff --git a/web/packages/teleport/src/Player/ProgressBar/Slider/index.js b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/Slider/index.js
similarity index 100%
rename from web/packages/teleport/src/Player/ProgressBar/Slider/index.js
rename to web/packages/teleport/src/SessionRecordings/view/ProgressBar/Slider/index.js
diff --git a/web/packages/teleport/src/Player/ProgressBar/index.tsx b/web/packages/teleport/src/SessionRecordings/view/ProgressBar/index.tsx
similarity index 100%
rename from web/packages/teleport/src/Player/ProgressBar/index.tsx
rename to web/packages/teleport/src/SessionRecordings/view/ProgressBar/index.tsx
diff --git a/web/packages/teleport/src/SessionRecordings/view/RecordingPlayer.tsx b/web/packages/teleport/src/SessionRecordings/view/RecordingPlayer.tsx
new file mode 100644
index 0000000000000..4939127872dc3
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/RecordingPlayer.tsx
@@ -0,0 +1,144 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Suspense, type RefObject } from 'react';
+import { ErrorBoundary } from 'react-error-boundary';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import Indicator from 'design/Indicator';
+
+import type {
+  RecordingType,
+  SessionRecordingEvent,
+} from 'teleport/services/recordings';
+import { RECORDING_TYPES_WITH_METADATA } from 'teleport/services/recordings/recordings';
+import { DesktopPlayer } from 'teleport/SessionRecordings/view/DesktopPlayer';
+import { TtyRecordingPlayer } from 'teleport/SessionRecordings/view/player/tty/TtyRecordingPlayer';
+import SshPlayer, {
+  type PlayerHandle,
+} from 'teleport/SessionRecordings/view/SshPlayer';
+
+interface RecordingPlayerProps {
+  clusterId: string;
+  durationMs: number;
+  onTimeChange?: (time: number) => void;
+  recordingType: RecordingType;
+  sessionId: string;
+  onToggleSidebar?: () => void;
+  onToggleTimeline?: () => void;
+  onToggleFullscreen?: () => void;
+  fullscreen?: boolean;
+  initialCols?: number;
+  initialRows?: number;
+  events?: SessionRecordingEvent[];
+  ref?: RefObject<PlayerHandle>;
+}
+
+const Container = styled.div`
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+`;
+
+/**
+ * RecordingPlayer is a wrapper component that chooses between different types of recording players
+ * (e.g., DesktopPlayer, TtyRecordingPlayer) based on the recording type.
+ *
+ * It will fall back to the legacy SshPlayer if TtyRecordingPlayer fails to load (e.g. the WebSocket
+ * fails to open due to a proxy mismatch).
+ *
+ * TODO(ryan): DELETE in v20
+ */
+export function RecordingPlayer({
+  clusterId,
+  sessionId,
+  durationMs,
+  fullscreen,
+  onTimeChange,
+  onToggleFullscreen,
+  onToggleSidebar,
+  onToggleTimeline,
+  recordingType,
+  initialCols,
+  initialRows,
+  events,
+  ref,
+}: RecordingPlayerProps) {
+  if (recordingType === 'desktop') {
+    return (
+      <Container>
+        <DesktopPlayer
+          sid={sessionId}
+          clusterId={clusterId}
+          durationMs={durationMs}
+        />
+      </Container>
+    );
+  }
+
+  const sshPlayer = (
+    <SshPlayer
+      ref={ref}
+      onTimeChange={onTimeChange}
+      onToggleSidebar={onToggleSidebar}
+      sid={sessionId}
+      clusterId={clusterId}
+      durationMs={durationMs}
+      onToggleTimeline={onToggleTimeline}
+    />
+  );
+
+  if (!RECORDING_TYPES_WITH_METADATA.includes(recordingType)) {
+    // For recording types without metadata (e.g., database), render the legacy SshPlayer directly.
+    return <Container>{sshPlayer}</Container>;
+  }
+
+  return (
+    <Container>
+      <ErrorBoundary fallback={sshPlayer}>
+        <Suspense fallback={<RecordingPlayerLoading />}>
+          <TtyRecordingPlayer
+            clusterId={clusterId}
+            sessionId={sessionId}
+            duration={durationMs}
+            fullscreen={fullscreen}
+            onToggleFullscreen={onToggleFullscreen}
+            onTimeChange={onTimeChange}
+            onToggleSidebar={onToggleSidebar}
+            onToggleTimeline={onToggleTimeline}
+            initialCols={initialCols}
+            initialRows={initialRows}
+            events={events}
+            ref={ref}
+          />
+        </Suspense>
+      </ErrorBoundary>
+    </Container>
+  );
+}
+
+function RecordingPlayerLoading() {
+  return (
+    <Flex alignItems="center" justifyContent="center" height="100%">
+      <Indicator />
+    </Flex>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/RecordingWithMetadata.tsx b/web/packages/teleport/src/SessionRecordings/view/RecordingWithMetadata.tsx
new file mode 100644
index 0000000000000..3a0052c6212e2
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/RecordingWithMetadata.tsx
@@ -0,0 +1,290 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { format } from 'date-fns';
+import { useCallback, useEffect, useMemo, useRef, type ReactNode } from 'react';
+import { Link } from 'react-router-dom';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import { ChevronLeft } from 'design/Icon';
+import { H3 } from 'design/Text';
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
+import { useFullscreen } from 'teleport/components/hooks/useFullscreen';
+import cfg from 'teleport/config';
+import { type RecordingType } from 'teleport/services/recordings';
+import { useSuspenseGetRecordingMetadata } from 'teleport/services/recordings/hooks';
+import { KeysEnum } from 'teleport/services/storageService';
+import {
+  formatSessionRecordingDuration,
+  getRecordingTypeInfo,
+} from 'teleport/SessionRecordings/list/RecordingItem';
+import { RecordingPlayer } from 'teleport/SessionRecordings/view/RecordingPlayer';
+import type { PlayerHandle } from 'teleport/SessionRecordings/view/SshPlayer';
+import {
+  RecordingTimeline,
+  type RecordingTimelineHandle,
+} from 'teleport/SessionRecordings/view/Timeline/RecordingTimeline';
+
+export type SummarySlot = (sessionId: string, type: RecordingType) => ReactNode;
+
+interface RecordingWithMetadataProps {
+  clusterId: string;
+  sessionId: string;
+  summarySlot?: SummarySlot;
+}
+
+export function RecordingWithMetadata({
+  clusterId,
+  sessionId,
+  summarySlot,
+}: RecordingWithMetadataProps) {
+  const { data } = useSuspenseGetRecordingMetadata({
+    clusterId,
+    sessionId,
+  });
+
+  const currentTimeRef = useRef(0);
+  const containerRef = useRef<HTMLDivElement>(null);
+  const playerRef = useRef<PlayerHandle>(null);
+  const timelineRef = useRef<RecordingTimelineHandle>(null);
+
+  const fullscreen = useFullscreen(containerRef);
+
+  const [timelineHidden, setTimelineHidden] = useLocalStorage(
+    KeysEnum.SESSION_RECORDING_TIMELINE_HIDDEN,
+    false
+  );
+  const [sidebarHidden, setSidebarHidden] = useLocalStorage(
+    KeysEnum.SESSION_RECORDING_SIDEBAR_HIDDEN,
+    false
+  );
+
+  // handle a time change from the player (update the timeline)
+  const handleTimeChange = useCallback((time: number) => {
+    if (!timelineRef.current) {
+      return;
+    }
+
+    currentTimeRef.current = time;
+    timelineRef.current.moveToTime(time);
+  }, []);
+
+  // handle a time change (user click) from the timeline (update the player and timeline)
+  const handleTimelineTimeChange = useCallback((time: number) => {
+    if (!playerRef.current || !timelineRef.current) {
+      return;
+    }
+
+    currentTimeRef.current = time;
+    playerRef.current.moveToTime(time);
+    timelineRef.current.moveToTime(time);
+  }, []);
+
+  const toggleSidebar = useCallback(() => {
+    // setSidebarHidden(prev => !prev) does not work with useLocalStorage, it stops working after the first toggle
+    setSidebarHidden(!sidebarHidden);
+  }, [sidebarHidden, setSidebarHidden]);
+
+  const toggleTimeline = useCallback(() => {
+    setTimelineHidden(!timelineHidden);
+  }, [timelineHidden, setTimelineHidden]);
+
+  const handleToggleFullscreen = useCallback(() => {
+    if (fullscreen.active) {
+      void fullscreen.exit();
+    } else {
+      void fullscreen.enter();
+    }
+  }, [fullscreen]);
+
+  const summary = useMemo(
+    () => summarySlot?.(sessionId, data.metadata.type),
+    [summarySlot, sessionId, data.metadata.type]
+  );
+
+  const startTime = new Date(data.metadata.startTime * 1000);
+  const endTime = new Date(data.metadata.endTime * 1000);
+
+  const { icon: Icon, label } = getRecordingTypeInfo(data.metadata.type);
+
+  useEffect(() => {
+    if (!timelineRef.current || timelineHidden) {
+      return;
+    }
+
+    timelineRef.current.moveToTime(currentTimeRef.current);
+  }, [timelineHidden]);
+
+  return (
+    <Grid sidebarHidden={sidebarHidden} ref={containerRef}>
+      <Player>
+        <RecordingPlayer
+          clusterId={clusterId}
+          sessionId={sessionId}
+          durationMs={data.metadata.duration}
+          recordingType={data.metadata.type}
+          onToggleFullscreen={handleToggleFullscreen}
+          fullscreen={fullscreen.active}
+          onToggleSidebar={toggleSidebar}
+          onToggleTimeline={toggleTimeline}
+          onTimeChange={handleTimeChange}
+          initialCols={data.metadata.startCols}
+          initialRows={data.metadata.startRows}
+          events={data.metadata.events}
+          ref={playerRef}
+        />
+      </Player>
+
+      {!sidebarHidden && (
+        <Sidebar>
+          <Flex
+            flexDirection="column"
+            gap={4}
+            pt={3}
+            minHeight={0}
+            height="100%"
+          >
+            <Flex pl={3} pr={2} justifyContent="space-between">
+              <BackLink to={cfg.getRecordingsRoute(clusterId)}>
+                <ChevronLeft size="small" />
+                Back to Session Recordings
+              </BackLink>
+            </Flex>
+
+            <Flex alignItems="center" gap={3} px={3}>
+              <Icon size="small" />
+
+              <H3>{label}</H3>
+            </Flex>
+
+            <InfoGrid>
+              <InfoGridLabel>User</InfoGridLabel>
+
+              <div>{data.metadata.user}</div>
+
+              <InfoGridLabel>Resource</InfoGridLabel>
+
+              <div>{data.metadata.resourceName}</div>
+
+              <InfoGridLabel>Duration</InfoGridLabel>
+
+              <div>
+                {formatSessionRecordingDuration(data.metadata.duration)}
+              </div>
+
+              <InfoGridLabel>Cluster</InfoGridLabel>
+
+              <div>{data.metadata.clusterName}</div>
+
+              <InfoGridLabel>Start Time</InfoGridLabel>
+
+              <div>{format(startTime, 'MMM dd, yyyy HH:mm')}</div>
+
+              <InfoGridLabel>End Time</InfoGridLabel>
+
+              <div>{format(endTime, 'MMM dd, yyyy HH:mm')}</div>
+            </InfoGrid>
+
+            {summary && <Summary>{summary}</Summary>}
+          </Flex>
+        </Sidebar>
+      )}
+
+      {data.frames.length > 0 && !timelineHidden && (
+        <TimelineContainer>
+          <RecordingTimeline
+            frames={data.frames}
+            metadata={data.metadata}
+            onTimeChange={handleTimelineTimeChange}
+            ref={timelineRef}
+            showAbsoluteTime={false} // TODO(ryan): add with the keyboard shortcuts PR
+          />
+        </TimelineContainer>
+      )}
+    </Grid>
+  );
+}
+
+const Grid = styled.div<{ sidebarHidden: boolean }>`
+  background: ${p => p.theme.colors.levels.sunken};
+  display: grid;
+  grid-template-areas: ${p =>
+    p.sidebarHidden
+      ? `'recording recording' 'timeline timeline'`
+      : `'sidebar recording' 'timeline timeline'`};
+  grid-template-columns: 1fr 4fr;
+  grid-template-rows: 1fr auto;
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+`;
+
+const InfoGrid = styled.div`
+  display: grid;
+  column-gap: ${p => p.theme.space[3]}px;
+  row-gap: ${p => p.theme.space[2]}px;
+  grid-template-columns: 80px 1fr;
+  padding: 0 ${p => p.theme.space[3]}px;
+`;
+
+const Player = styled.div`
+  grid-area: recording;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  position: relative;
+`;
+
+const Sidebar = styled.div`
+  grid-area: sidebar;
+  border-right: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  overflow: hidden;
+  display: flex;
+  flex-direction: column;
+`;
+
+const Summary = styled.div`
+  border-top: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  overflow-y: auto;
+  height: 100%;
+  flex: 1;
+  min-height: 0;
+  padding: ${p => p.theme.space[3]}px ${p => p.theme.space[3]}px 0;
+`;
+
+const InfoGridLabel = styled.div`
+  font-weight: bold;
+  color: ${p => p.theme.colors.text.slightlyMuted};
+`;
+
+const BackLink = styled(Link)`
+  color: ${p => p.theme.colors.text.slightlyMuted};
+  text-decoration: none;
+  font-weight: 500;
+  display: flex;
+  align-items: center;
+  gap: ${p => p.theme.space[2]}px;
+`;
+
+const TimelineContainer = styled.div`
+  grid-area: timeline;
+`;
diff --git a/web/packages/teleport/src/SessionRecordings/view/RecordingWithSummary.tsx b/web/packages/teleport/src/SessionRecordings/view/RecordingWithSummary.tsx
new file mode 100644
index 0000000000000..5b581722875bc
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/RecordingWithSummary.tsx
@@ -0,0 +1,188 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo } from 'react';
+import { Link } from 'react-router-dom';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import { ChevronLeft } from 'design/Icon';
+import { H3 } from 'design/Text';
+import { ErrorSuspenseWrapper } from 'shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper';
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
+import cfg from 'teleport/config';
+import { type RecordingType } from 'teleport/services/recordings';
+import { VALID_RECORDING_TYPES } from 'teleport/services/recordings/recordings';
+import { KeysEnum } from 'teleport/services/storageService';
+import { getRecordingTypeInfo } from 'teleport/SessionRecordings/list/RecordingItem';
+import { RecordingPlayer } from 'teleport/SessionRecordings/view/RecordingPlayer';
+import type { SummarySlot } from 'teleport/SessionRecordings/view/RecordingWithMetadata';
+import {
+  RecordingPlayerError,
+  RecordingPlayerLoading,
+  RecordingPlayerWithLoadDuration,
+} from 'teleport/SessionRecordings/view/ViewSessionRecordingRoute';
+
+interface RecordingWithSummaryProps {
+  clusterId: string;
+  durationMs: number;
+  sessionId: string;
+  recordingType: RecordingType;
+  summarySlot: SummarySlot;
+}
+
+export function RecordingWithSummary({
+  clusterId,
+  durationMs,
+  recordingType,
+  sessionId,
+  summarySlot,
+}: RecordingWithSummaryProps) {
+  const [sidebarHidden, setSidebarHidden] = useLocalStorage(
+    KeysEnum.SESSION_RECORDING_SIDEBAR_HIDDEN,
+    false
+  );
+
+  const summary = useMemo(
+    () => summarySlot(sessionId, recordingType),
+    [summarySlot, sessionId, recordingType]
+  );
+
+  const toggleSidebar = useCallback(() => {
+    // setSidebarHidden(prev => !prev) does not work with useLocalStorage, it stops working after the first toggle
+    setSidebarHidden(!sidebarHidden);
+  }, [sidebarHidden, setSidebarHidden]);
+
+  const { icon: Icon, label } = getRecordingTypeInfo(recordingType);
+
+  const validRecordingType = VALID_RECORDING_TYPES.includes(recordingType);
+  const validDuration = Number.isInteger(durationMs) && durationMs > 0;
+
+  const shouldFetchSessionDuration = !validRecordingType || !validDuration;
+
+  let player = (
+    <RecordingPlayer
+      clusterId={clusterId}
+      sessionId={sessionId}
+      durationMs={durationMs}
+      recordingType={recordingType}
+      onToggleSidebar={toggleSidebar}
+    />
+  );
+
+  if (shouldFetchSessionDuration) {
+    player = (
+      <ErrorSuspenseWrapper
+        errorComponent={RecordingPlayerError}
+        loadingComponent={RecordingPlayerLoading}
+      >
+        <RecordingPlayerWithLoadDuration
+          clusterId={clusterId}
+          sessionId={sessionId}
+          onToggleSidebar={toggleSidebar}
+        />
+      </ErrorSuspenseWrapper>
+    );
+  }
+
+  if (!summary) {
+    return player;
+  }
+
+  return (
+    <Grid sidebarHidden={sidebarHidden}>
+      <Player>{player}</Player>
+
+      {!sidebarHidden && (
+        <Sidebar>
+          <Flex
+            flexDirection="column"
+            gap={4}
+            pt={3}
+            minHeight={0}
+            height="100%"
+          >
+            <Flex pl={3} pr={2} justifyContent="space-between">
+              <BackLink to={cfg.getRecordingsRoute(clusterId)}>
+                <ChevronLeft size="small" />
+                Back to Session Recordings
+              </BackLink>
+            </Flex>
+
+            <Flex alignItems="center" gap={3} px={3}>
+              <Icon size="small" />
+
+              <H3>{label}</H3>
+            </Flex>
+
+            <Summary>{summary}</Summary>
+          </Flex>
+        </Sidebar>
+      )}
+    </Grid>
+  );
+}
+
+const Grid = styled.div<{ sidebarHidden: boolean }>`
+  background: ${p => p.theme.colors.levels.sunken};
+  display: grid;
+  grid-template-areas: ${p =>
+    p.sidebarHidden ? `'recording recording'` : `'sidebar recording'`};
+  grid-template-columns: 1fr 4fr;
+  grid-template-rows: 1fr auto;
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+`;
+
+const Player = styled.div`
+  grid-area: recording;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  position: relative;
+`;
+
+const Sidebar = styled.div`
+  grid-area: sidebar;
+  border-right: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  overflow: hidden;
+  display: flex;
+  flex-direction: column;
+`;
+
+const Summary = styled.div`
+  border-top: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  overflow-y: auto;
+  height: 100%;
+  flex: 1;
+  min-height: 0;
+  padding: ${p => p.theme.space[3]}px ${p => p.theme.space[3]}px 0;
+`;
+
+const BackLink = styled(Link)`
+  color: ${p => p.theme.colors.text.slightlyMuted};
+  text-decoration: none;
+  font-weight: 500;
+  display: flex;
+  align-items: center;
+  gap: ${p => p.theme.space[2]}px;
+`;
diff --git a/web/packages/teleport/src/SessionRecordings/view/SshPlayer.tsx b/web/packages/teleport/src/SessionRecordings/view/SshPlayer.tsx
new file mode 100644
index 0000000000000..ec5aa60988755
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/SshPlayer.tsx
@@ -0,0 +1,183 @@
+/**
+ * Teleport
+ * Copyright (C) 2023  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useMemo,
+  useState,
+  type RefObject,
+} from 'react';
+import styled from 'styled-components';
+
+import { Box, Flex, Indicator } from 'design';
+import { Danger } from 'design/Alert';
+
+import cfg from 'teleport/config';
+import { formatDisplayTime, StatusEnum } from 'teleport/lib/player';
+import TtyPlayer from 'teleport/lib/term/ttyPlayer';
+import { getAccessToken, getHostName } from 'teleport/services/api';
+
+import ProgressBar from './ProgressBar';
+import Xterm from './Xterm';
+
+interface PlayerProps {
+  sid: string;
+  clusterId: string;
+  durationMs: number;
+  onTimeChange?: (time: number) => void;
+  onToggleTimeline?: () => void;
+  onToggleSidebar?: () => void;
+  ref?: RefObject<PlayerHandle>;
+}
+
+export interface PlayerHandle {
+  moveToTime: (time: number) => void;
+}
+
+function Player({
+  sid,
+  clusterId,
+  durationMs,
+  onTimeChange,
+  onToggleSidebar,
+  onToggleTimeline,
+  ref,
+}: PlayerProps) {
+  const { tty, playerStatus, statusText, time } = useStreamingSshPlayer(
+    clusterId,
+    sid,
+    onTimeChange
+  );
+
+  // statusText is currently only set when an error happens, so for now we can assume
+  // if it is not empty, an error occured (even if the player is in COMPLETE state, which gets
+  // set on close)
+  const isError = playerStatus === StatusEnum.ERROR || statusText !== '';
+  const isLoading = playerStatus === StatusEnum.LOADING;
+  const isPlaying = playerStatus === StatusEnum.PLAYING;
+  const isComplete = isError || playerStatus === StatusEnum.COMPLETE;
+
+  const moveToTime = useCallback(
+    (newTime: number) => {
+      tty.move(newTime);
+    },
+    [tty]
+  );
+
+  // expose a moveToTime method through the ref so we can update the time from the outside
+  // without having to pass it in as a prop and cause a re-render.
+  useImperativeHandle(ref, () => ({
+    moveToTime,
+  }));
+
+  if (isError) {
+    return (
+      <StatusBox>
+        <Danger m={10}>{statusText || 'Error'}</Danger>
+      </StatusBox>
+    );
+  }
+
+  if (isLoading) {
+    return (
+      <StatusBox>
+        <Indicator />
+      </StatusBox>
+    );
+  }
+
+  return (
+    <StyledPlayer>
+      <Flex height="calc(100% - 56px)" flexDirection="column" px={2} py={1}>
+        <Xterm tty={tty} />
+      </Flex>
+      <ProgressBar
+        min={0}
+        max={durationMs}
+        current={time}
+        disabled={isComplete}
+        isPlaying={isPlaying}
+        time={formatDisplayTime(time)}
+        onRestart={() => window.location.reload()}
+        onStartMove={() => tty.suspendTimeUpdates()}
+        move={pos => {
+          tty.resumeTimeUpdates();
+          tty.move(pos);
+        }}
+        toggle={() => {
+          isPlaying ? tty.stop() : tty.play();
+        }}
+        onToggleSidebar={onToggleSidebar}
+        onToggleTimeline={onToggleTimeline}
+      />
+    </StyledPlayer>
+  );
+}
+
+export { Player as default };
+
+const StatusBox = props => (
+  <Box width="100%" textAlign="center" p={3} {...props} />
+);
+
+const StyledPlayer = styled.div`
+  display: flex;
+  flex-direction: column;
+  width: 100%;
+  height: 100%;
+  justify-content: space-between;
+`;
+
+function useStreamingSshPlayer(
+  clusterId: string,
+  sid: string,
+  onTimeChange?: (time: number) => void
+) {
+  const [playerStatus, setPlayerStatus] = useState(StatusEnum.LOADING);
+  const [statusText, setStatusText] = useState('');
+  const [time, setTime] = useState(0);
+
+  const tty = useMemo(() => {
+    const url = cfg.api.ttyPlaybackWsAddr
+      .replace(':fqdn', getHostName())
+      .replace(':clusterId', clusterId)
+      .replace(':sid', sid)
+      .replace(':token', getAccessToken());
+    return new TtyPlayer({
+      url,
+      onTimeChange,
+      setPlayerStatus,
+      setStatusText,
+      setTime,
+    });
+  }, [clusterId, sid, setPlayerStatus, setStatusText, onTimeChange]);
+
+  useEffect(() => {
+    tty.connect();
+    tty.play();
+
+    return () => {
+      tty.stop();
+      tty.removeAllListeners();
+    };
+  }, [tty]);
+
+  return { tty, playerStatus, statusText, time };
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/RecordingTimeline.tsx b/web/packages/teleport/src/SessionRecordings/view/Timeline/RecordingTimeline.tsx
new file mode 100644
index 0000000000000..63588e91dbd66
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/RecordingTimeline.tsx
@@ -0,0 +1,427 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useRef,
+  type MouseEvent,
+  type RefObject,
+} from 'react';
+import styled, { useTheme } from 'styled-components';
+import { useDebounceCallback } from 'usehooks-ts';
+
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
+import type {
+  SessionRecordingMetadata,
+  SessionRecordingThumbnail,
+} from 'teleport/services/recordings';
+import { KeysEnum } from 'teleport/services/storageService';
+
+import { TimelineRenderer } from './renderers/TimelineRenderer';
+import { ResizeHandle } from './ResizeHandle';
+import { useCursor } from './useCursor';
+import {
+  calculateAutoScrollOffset,
+  calculateNextUserControlled,
+  shouldAutoScroll,
+} from './utils';
+
+interface RecordingTimelineProps {
+  frames: SessionRecordingThumbnail[];
+  metadata: SessionRecordingMetadata;
+  onTimeChange: (time: number) => void;
+  showAbsoluteTime: boolean;
+  ref: RefObject<RecordingTimelineHandle>;
+}
+
+const Container = styled.div`
+  position: relative;
+  width: 100%;
+  overflow: hidden;
+`;
+
+const Canvas = styled.canvas`
+  background: ${p => p.theme.colors.sessionRecordingTimeline.background};
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  width: 100%;
+  will-change: transform;
+  transform: translateZ(0); // force the browser to use the GPU for rendering
+`;
+
+const Cursor = styled.div`
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  width: 1px;
+  background: ${p => p.theme.colors.sessionRecordingTimeline.cursor};
+  z-index: 1;
+  pointer-events: none;
+  will-change: transform;
+  display: none;
+`;
+
+export interface RecordingTimelineHandle {
+  moveToTime: (time: number, force?: boolean) => void;
+}
+
+const defaultHeight = 235;
+const minHeight = 200;
+const maxHeight = 500;
+
+function scaleCanvas(
+  canvas: HTMLCanvasElement,
+  width: number,
+  height: number,
+  options?: CanvasRenderingContext2DSettings
+) {
+  const dpr = window.devicePixelRatio || 1;
+
+  canvas.width = width * dpr;
+  canvas.height = height * dpr;
+
+  canvas.style.width = `${width}px`;
+  canvas.style.height = `${height}px`;
+
+  const ctx = canvas.getContext('2d', options);
+
+  if (!ctx) {
+    throw new Error('Failed to get canvas context');
+  }
+
+  ctx.scale(dpr, dpr);
+
+  return ctx;
+}
+
+export function RecordingTimeline({
+  frames,
+  metadata,
+  onTimeChange,
+  showAbsoluteTime,
+  ref,
+}: RecordingTimelineProps) {
+  const theme = useTheme();
+
+  const [height, setHeight] = useLocalStorage(
+    KeysEnum.SESSION_RECORDING_TIMELINE_HEIGHT,
+    defaultHeight
+  );
+
+  const timeRef = useRef(0);
+
+  const canvasRef = useRef<HTMLCanvasElement | null>(null);
+  const containerRef = useRef<HTMLDivElement | null>(null);
+  const cursorRef = useRef<HTMLDivElement | null>(null);
+  const ctxRef = useRef<CanvasRenderingContext2D | null>(null);
+  const rendererRef = useRef<TimelineRenderer | null>(null);
+
+  useEffect(() => {
+    if (!containerRef.current || !canvasRef.current) {
+      return;
+    }
+
+    const { clientWidth: containerWidth, clientHeight: containerHeight } =
+      containerRef.current;
+
+    if (rendererRef.current) {
+      rendererRef.current.destroy();
+      rendererRef.current = null;
+    }
+
+    ctxRef.current = scaleCanvas(
+      canvasRef.current,
+      containerWidth,
+      containerHeight,
+      {
+        alpha: false,
+        desynchronized: true,
+        willReadFrequently: true,
+      }
+    );
+
+    ctxRef.current.imageSmoothingEnabled = false;
+    ctxRef.current.textRendering = 'optimizeLegibility';
+
+    ctxRef.current.fillStyle = theme.colors.sessionRecordingTimeline.background;
+    ctxRef.current.fillRect(0, 0, containerWidth, containerHeight);
+
+    rendererRef.current = new TimelineRenderer(
+      ctxRef.current,
+      metadata,
+      frames,
+      theme,
+      containerWidth,
+      containerHeight
+    );
+  }, [frames, metadata, theme]);
+
+  useEffect(() => {
+    if (!rendererRef.current) {
+      return;
+    }
+
+    rendererRef.current.setShowAbsoluteTime(showAbsoluteTime);
+  }, [showAbsoluteTime]);
+
+  useEffect(() => {
+    if (!canvasRef.current) {
+      return;
+    }
+
+    function handleWheel(event: WheelEvent) {
+      if (!rendererRef.current) {
+        return;
+      }
+
+      event.preventDefault();
+
+      const renderer = rendererRef.current;
+
+      if (event.metaKey || event.ctrlKey) {
+        const ZOOM_SENSITIVITY = 0.002;
+        const deltaZoom = -event.deltaY * ZOOM_SENSITIVITY;
+
+        renderer.accumulateZoom(event.clientX, deltaZoom);
+      } else if (event.deltaX !== 0) {
+        renderer.accumulatePan(event.deltaX);
+      } else if (event.shiftKey && event.deltaY !== 0) {
+        renderer.accumulatePan(event.deltaY);
+      }
+    }
+
+    const container = canvasRef.current;
+
+    container.addEventListener('wheel', handleWheel, { passive: false });
+
+    return () => {
+      container.removeEventListener('wheel', handleWheel);
+    };
+  }, []);
+
+  const updateImages = useCallback(() => {
+    if (!rendererRef.current) {
+      return;
+    }
+
+    rendererRef.current.recreateImages();
+    rendererRef.current.render();
+  }, []);
+
+  const debouncedUpdateImages = useDebounceCallback(updateImages);
+
+  const handleHeightChange = useCallback(
+    (newHeight: number) => {
+      if (!canvasRef.current || !ctxRef.current || !rendererRef.current) {
+        return;
+      }
+
+      setHeight(newHeight);
+
+      const dpr = window.devicePixelRatio || 1;
+
+      canvasRef.current.height = newHeight * dpr;
+
+      canvasRef.current.style.height = `${newHeight}px`;
+
+      ctxRef.current.scale(dpr, dpr);
+
+      rendererRef.current.setHeight(newHeight);
+
+      // the thumbnails need to be recreated on height change (as they are already rendered at
+      // the previous height on an offscreen canvas), so we need to call recreateVisibleImages so
+      // that we don't recreate all of them at once and hang the UI
+      rendererRef.current.recreateVisibleImages();
+
+      // debounce updating the rest of the images to avoid hanging the UI
+      // when resizing the timeline to a larger height
+      debouncedUpdateImages();
+    },
+    [debouncedUpdateImages, setHeight]
+  );
+
+  const {
+    handleMouseEnter,
+    handleMouseLeave,
+    handleMouseMove,
+    isInteractingRef,
+  } = useCursor({
+    containerRef,
+    cursorRef,
+  });
+
+  const handleClick = useCallback(
+    (event: MouseEvent<HTMLCanvasElement>) => {
+      if (!canvasRef.current || !rendererRef.current) {
+        return;
+      }
+
+      const time = rendererRef.current.getTimeAtX(
+        event.clientX - canvasRef.current.getBoundingClientRect().left
+      );
+
+      onTimeChange(time);
+    },
+    [onTimeChange]
+  );
+
+  const moveToTime = useCallback(
+    (time: number, force?: boolean) => {
+      if (!rendererRef.current || !containerRef.current) {
+        return;
+      }
+
+      timeRef.current = time;
+
+      const renderer = rendererRef.current;
+      const containerWidth = containerRef.current.offsetWidth;
+
+      // Calculate timeline width based on duration and zoom
+      const pixelsPerMs = 0.1;
+      const baseTimelineWidth = metadata.duration * pixelsPerMs;
+      const timelineWidth = baseTimelineWidth * renderer.getZoom();
+
+      // Calculate time position on the timeline
+      const timePosition = (time / metadata.duration) * timelineWidth;
+      const relativePosition = timePosition + renderer.getOffset();
+
+      // Check if we should auto-scroll
+      const isUserControlled = renderer.getIsUserControlled();
+      const newUserControlled = calculateNextUserControlled(
+        relativePosition,
+        containerWidth,
+        isInteractingRef.current,
+        isUserControlled
+      );
+
+      if (newUserControlled !== isUserControlled) {
+        renderer.setIsUserControlled(newUserControlled);
+      }
+
+      if (
+        force ||
+        shouldAutoScroll(
+          relativePosition,
+          containerWidth,
+          isInteractingRef.current,
+          newUserControlled
+        )
+      ) {
+        const newOffset = calculateAutoScrollOffset(
+          timePosition,
+          relativePosition,
+          containerWidth,
+          timelineWidth,
+          force
+        );
+
+        renderer.setOffset(newOffset);
+      }
+
+      renderer.setCurrentTime(time);
+    },
+    [metadata.duration, isInteractingRef]
+  );
+
+  useImperativeHandle(ref, () => ({
+    moveToTime,
+  }));
+
+  const previousContainerWidth = useRef(0);
+
+  useEffect(() => {
+    if (!containerRef.current) {
+      return;
+    }
+
+    // not using useResizeObserver here as it returns a RefCallback instead of a RefObject
+    const observer = new ResizeObserver(([box]) => {
+      if (!canvasRef.current || !rendererRef.current) {
+        return;
+      }
+
+      const { blockSize: height, inlineSize: width } = box.contentBoxSize[0];
+
+      const canvas = canvasRef.current;
+      if (!ctxRef.current) {
+        return;
+      }
+
+      const imageData = ctxRef.current.getImageData(
+        0,
+        0,
+        canvas.width,
+        canvas.height
+      );
+
+      const dpr = window.devicePixelRatio || 1;
+
+      canvas.width = width * dpr;
+      canvas.height = height * dpr;
+
+      canvas.style.width = `${width}px`;
+      canvas.style.height = `${height}px`;
+
+      ctxRef.current.scale(dpr, dpr);
+      ctxRef.current.putImageData(imageData, 0, 0);
+
+      const sameWidth = width === previousContainerWidth.current;
+
+      if (!sameWidth) {
+        previousContainerWidth.current = width;
+
+        rendererRef.current.setWidth(width);
+      }
+    });
+
+    observer.observe(containerRef.current);
+
+    return () => {
+      observer.disconnect();
+    };
+  }, []);
+
+  return (
+    <Container style={{ height: `${height}px` }} ref={containerRef}>
+      <ResizeHandle
+        onChange={handleHeightChange}
+        height={height}
+        defaultHeight={defaultHeight}
+        minHeight={minHeight}
+        maxHeight={maxHeight}
+      />
+
+      <Cursor ref={cursorRef} />
+
+      <Canvas
+        onClick={handleClick}
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+        onMouseMove={handleMouseMove}
+        width="100%"
+        ref={canvasRef}
+      />
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/ResizeHandle.tsx b/web/packages/teleport/src/SessionRecordings/view/Timeline/ResizeHandle.tsx
new file mode 100644
index 0000000000000..83b06bb6b7735
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/ResizeHandle.tsx
@@ -0,0 +1,150 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useEffect,
+  useRef,
+  type MouseEvent as ReactMouseEvent,
+} from 'react';
+import styled from 'styled-components';
+
+import { useStateRef } from 'shared/hooks';
+
+const ResizeHandleLine = styled.div<{ active: boolean }>`
+  position: absolute;
+  height: ${p => (p.active ? 2 : 1)}px;
+  background: ${p =>
+    p.active
+      ? p.theme.colors.sessionRecordingTimeline.border.hover
+      : p.theme.colors.sessionRecordingTimeline.border.default};
+  top: 50%;
+  left: 0;
+  right: 0;
+  z-index: 1;
+`;
+
+const Container = styled.div`
+  --height: 14px;
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  cursor: ns-resize;
+  height: var(--height);
+  user-select: none;
+  z-index: 2;
+
+  &:hover ${ResizeHandleLine} {
+    background: ${p => p.theme.colors.sessionRecordingTimeline.border.hover};
+    height: 2px;
+  }
+`;
+
+interface ResizeHandleProps {
+  onChange: (newHeight: number) => void;
+  height: number;
+  defaultHeight: number;
+  minHeight: number;
+  maxHeight: number;
+}
+
+export function ResizeHandle({
+  onChange,
+  height,
+  defaultHeight,
+  minHeight,
+  maxHeight,
+}: ResizeHandleProps) {
+  const [isResizing, isResizingRef, setIsResizing] = useStateRef(false);
+
+  const heightRef = useRef(defaultHeight);
+  const initialMouseY = useRef<number>(0);
+
+  const handleMouseDown = useCallback(
+    (e: ReactMouseEvent<HTMLDivElement>) => {
+      document.body.style.cursor = 'ns-resize';
+
+      e.preventDefault();
+      e.stopPropagation();
+
+      setIsResizing(true);
+
+      heightRef.current = height;
+      initialMouseY.current = e.clientY;
+    },
+    [height, setIsResizing]
+  );
+
+  const handleDoubleClick = useCallback(() => {
+    document.body.style.cursor = 'default';
+
+    onChange(defaultHeight);
+  }, [onChange, defaultHeight]);
+
+  useEffect(() => {
+    function handleMouseMove(event: MouseEvent) {
+      if (!isResizingRef.current) {
+        return;
+      }
+
+      const deltaY = initialMouseY.current - event.clientY;
+      const newHeight = heightRef.current + deltaY;
+
+      const clampedHeight = Math.max(minHeight, Math.min(maxHeight, newHeight));
+
+      onChange(clampedHeight);
+    }
+
+    function handleMouseUp() {
+      if (!isResizingRef.current) {
+        return;
+      }
+
+      document.body.style.cursor = 'default';
+
+      window.setTimeout(() => {
+        setIsResizing(false);
+      }, 100);
+    }
+
+    window.addEventListener('mousemove', handleMouseMove);
+    window.addEventListener('mouseup', handleMouseUp);
+
+    return () => {
+      document.body.style.cursor = 'default';
+
+      window.removeEventListener('mousemove', handleMouseMove);
+      window.removeEventListener('mouseup', handleMouseUp);
+
+      setIsResizing(false);
+    };
+  }, [isResizingRef, maxHeight, minHeight, onChange, setIsResizing]);
+
+  return (
+    <Container
+      onMouseDown={handleMouseDown}
+      onDoubleClick={handleDoubleClick}
+      style={{
+        transform: `translateY(calc(${height * -1}px + var(--height) / 2))`,
+      }}
+    >
+      <ResizeHandleLine active={isResizing} />
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/constants.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/constants.ts
new file mode 100644
index 0000000000000..c54eda572f74e
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/constants.ts
@@ -0,0 +1,31 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { font } from 'design/theme/fonts';
+
+export const LEFT_PADDING = 24; // the left padding of the timeline from the edge of the screen
+export const EVENT_ROW_HEIGHT = 28; // height of each row of events
+export const EVENT_SECTION_PADDING = 8; // padding between the ruler, events section and the frames section
+export const RULER_HEIGHT = 35; // height of the time ruler at the top of the timeline
+
+export const BASE_FRAME_WIDTH = 240; // base width of the frame, used to calculate the scale ratio of the frame
+
+export const DEFAULT_FRAME_HEIGHT = 250; // default height of a frame
+export const DEFAULT_MAX_FRAME_WIDTH = 250; // the maximum width a frame can be
+
+export const CANVAS_FONT = font.replace(/;$/, ''); // remove the semicolon at the end
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.test.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.test.ts
new file mode 100644
index 0000000000000..5b8f6da84ac87
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.test.ts
@@ -0,0 +1,495 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import 'jest-canvas-mock';
+
+import { darkTheme } from 'design/theme';
+
+import {
+  SessionRecordingEventType,
+  SessionRecordingMetadata,
+} from 'teleport/services/recordings';
+import type { TimelineRenderContext } from 'teleport/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer';
+
+import {
+  EVENT_ROW_HEIGHT,
+  EVENT_SECTION_PADDING,
+  LEFT_PADDING,
+  RULER_HEIGHT,
+} from '../constants';
+import { EventsRenderer } from './EventsRenderer';
+
+const mockMetadata: SessionRecordingMetadata = {
+  startTime: 1609459200, // Jan 1, 2021
+  endTime: 1609462800, // Jan 1, 2021
+  duration: 3600000, // 1 hour in milliseconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
+
+function createRenderer(metadata?: Partial<SessionRecordingMetadata>) {
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d')!;
+
+  const renderer = new EventsRenderer(ctx, darkTheme, {
+    ...mockMetadata,
+    ...metadata,
+  });
+
+  return { ctx, renderer };
+}
+
+describe('EventsRenderer', () => {
+  describe('event row creation', () => {
+    it('should place non-overlapping events in the same row', () => {
+      const { renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 1000,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 1500,
+            endTime: 2500,
+            user: 'bob',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 3000,
+            endTime: 4000,
+            user: 'charlie',
+          },
+        ],
+      });
+
+      expect(renderer.getHeight()).toBe(
+        EVENT_ROW_HEIGHT + EVENT_SECTION_PADDING
+      );
+    });
+
+    it('should create multiple rows for overlapping events', () => {
+      const { renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 2000,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 1000,
+            endTime: 3000,
+            user: 'bob',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 1500,
+            endTime: 3500,
+            user: 'charlie',
+          },
+        ],
+      });
+
+      expect(renderer.getHeight()).toBe(
+        3 * EVENT_ROW_HEIGHT + EVENT_SECTION_PADDING
+      );
+    });
+
+    it('should filter out resize events', () => {
+      const { renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Resize,
+            startTime: 0,
+            endTime: 1000,
+            cols: 100,
+            rows: 30,
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 500,
+            endTime: 1500,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Resize,
+            startTime: 2000,
+            endTime: 3000,
+            cols: 120,
+            rows: 40,
+          },
+        ],
+      });
+
+      expect(renderer.getHeight()).toBe(
+        EVENT_ROW_HEIGHT + EVENT_SECTION_PADDING
+      );
+    });
+  });
+
+  describe('position calculation', () => {
+    it('should calculate correct positions for events', () => {
+      const { renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 2500,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 5000,
+            endTime: 7500,
+            user: 'bob',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const rowsWithPositions = renderer.getRowsWithPositions();
+
+      expect(rowsWithPositions).toHaveLength(1);
+      expect(rowsWithPositions[0]).toHaveLength(2);
+
+      expect(rowsWithPositions[0][0].startPosition).toBe(LEFT_PADDING);
+      expect(rowsWithPositions[0][0].endPosition).toBe(LEFT_PADDING + 250);
+
+      expect(rowsWithPositions[0][1].startPosition).toBe(LEFT_PADDING + 500);
+      expect(rowsWithPositions[0][1].endPosition).toBe(LEFT_PADDING + 750);
+    });
+
+    it('should measure the text of each event', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Inactivity,
+            startTime: 0,
+            endTime: 3000,
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 4000,
+            endTime: 5000,
+            user: 'verylongusername',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const events = ctx.__getEvents();
+      const measureTextEvents = events.filter(
+        call => call.type === 'measureText'
+      );
+
+      expect(measureTextEvents[0].props.text).toBe('Inactivity for 3s');
+      expect(measureTextEvents[1].props.text).toBe('verylongusername joined');
+    });
+  });
+
+  describe('visibility', () => {
+    it('should only render visible events', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 20000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 1000,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 10000,
+            endTime: 11000,
+            user: 'bob',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 19000,
+            endTime: 20000,
+            user: 'charlie',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(2000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 100,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const drawCalls = ctx.__getDrawCalls();
+      const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+      expect(fillTextCalls).toHaveLength(1);
+      expect(fillTextCalls[0].props.text).toBe('alice joined');
+    });
+
+    it('should include events partially visible in viewport', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 20000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 1000,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 10000,
+            endTime: 11000,
+            user: 'bob',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 19000,
+            endTime: 20000,
+            user: 'charlie',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 550,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const drawCalls = ctx.__getDrawCalls();
+      const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+      expect(fillTextCalls).toHaveLength(2);
+      expect(fillTextCalls[0].props.text).toBe('alice joined');
+      expect(fillTextCalls[1].props.text).toBe('bob joined');
+    });
+  });
+
+  describe('event rendering', () => {
+    it('should render inactivity events with duration text', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Inactivity,
+            startTime: 1000,
+            endTime: 6000,
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 1200,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const drawCalls = ctx.__getDrawCalls();
+      const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+      expect(fillTextCalls).toHaveLength(1);
+      expect(fillTextCalls[0].props.text).toBe('Inactivity for 5s');
+    });
+
+    it('should constrain text within event bounds', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 1000,
+            endTime: 1100,
+            user: 'verylongusernamethatoverflows',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 1200,
+        offset: -100,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const drawCalls = ctx.__getDrawCalls();
+      const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+      expect(fillTextCalls).toHaveLength(1);
+
+      // text should be rendered within event bounds
+      // event starts at 1000ms which is 10% of 1000px
+      // so event starts at 100px + LEFT_PADDING
+      // text should not start before that
+
+      const textX = fillTextCalls[0].props.x;
+      const eventStartX = LEFT_PADDING + (1000 / 10000) * 1000;
+
+      expect(textX).toBeGreaterThanOrEqual(eventStartX);
+    });
+
+    it('should position events at correct Y coordinate for each row', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 2000,
+            user: 'alice',
+          },
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 1000,
+            endTime: 3000,
+            user: 'bob',
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 1200,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const events = ctx.__getEvents();
+      const roundRectEvents = events.filter(e => e.type === 'roundRect');
+
+      expect(roundRectEvents).toHaveLength(2);
+
+      // first event should be in first row
+      expect(roundRectEvents[0].props.y).toBe(
+        EVENT_SECTION_PADDING + RULER_HEIGHT
+      );
+      // second event should be in second row
+      expect(roundRectEvents[1].props.y).toBe(
+        EVENT_SECTION_PADDING + EVENT_ROW_HEIGHT + RULER_HEIGHT
+      );
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle empty events array', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [],
+      });
+
+      expect(renderer.getHeight()).toBe(EVENT_SECTION_PADDING);
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 1200,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const drawCalls = ctx.__getDrawCalls();
+
+      expect(drawCalls).toHaveLength(0);
+    });
+
+    it('should handle very long event titles', () => {
+      const { ctx, renderer } = createRenderer({
+        duration: 10000,
+        events: [
+          {
+            type: SessionRecordingEventType.Join,
+            startTime: 0,
+            endTime: 100,
+            user: 'a'.repeat(100),
+          },
+        ],
+      });
+
+      renderer.setTimelineWidth(1000);
+      renderer.calculate();
+
+      const renderContext: TimelineRenderContext = {
+        containerWidth: 1200,
+        offset: 0,
+        containerHeight: 200,
+        eventsHeight: renderer.getHeight(),
+      };
+
+      renderer._render(renderContext);
+
+      const events = ctx.__getEvents();
+
+      const roundRectCalls = events.filter(call => call.type === 'roundRect');
+
+      expect(roundRectCalls).toHaveLength(1);
+
+      // the event should be the width of the text plus padding
+      const textMetrics = ctx.measureText('a'.repeat(100) + ' joined');
+      const eventWidth = textMetrics.width + 16; // 8px padding on each side
+
+      expect(roundRectCalls[0].props.width).toBeLessThanOrEqual(eventWidth);
+    });
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.ts
new file mode 100644
index 0000000000000..a393ee61e09a1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/EventsRenderer.ts
@@ -0,0 +1,276 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { DefaultTheme } from 'styled-components';
+
+import {
+  SessionRecordingEventType,
+  type SessionRecordingEvent,
+  type SessionRecordingMetadata,
+} from 'teleport/services/recordings';
+import { formatSessionRecordingDuration } from 'teleport/SessionRecordings/list/RecordingItem';
+
+import {
+  CANVAS_FONT,
+  EVENT_ROW_HEIGHT,
+  EVENT_SECTION_PADDING,
+  LEFT_PADDING,
+  RULER_HEIGHT,
+} from '../constants';
+import {
+  TimelineCanvasRenderer,
+  type TimelineRenderContext,
+} from './TimelineCanvasRenderer';
+
+export type EventRow = TimelineEventMeasured[];
+
+export type EventRowWithPositions = TimelineEventPositioned[];
+
+type TimelineEventMeasured = SessionRecordingEvent & {
+  title: string;
+  textMetrics: TextMetrics;
+};
+
+type TimelineEventPositioned = TimelineEventMeasured & {
+  endPosition: number;
+  startPosition: number;
+};
+
+function getEventStyles(theme: DefaultTheme, type: SessionRecordingEventType) {
+  switch (type) {
+    case SessionRecordingEventType.Inactivity:
+      return theme.colors.sessionRecordingTimeline.events.inactivity;
+    case SessionRecordingEventType.Resize:
+      return theme.colors.sessionRecordingTimeline.events.resize;
+    case SessionRecordingEventType.Join:
+      return theme.colors.sessionRecordingTimeline.events.join;
+    default:
+      return theme.colors.sessionRecordingTimeline.events.default;
+  }
+}
+
+function getEventTitle(event: SessionRecordingEvent) {
+  switch (event.type) {
+    case SessionRecordingEventType.Inactivity:
+      return `Inactivity for ${formatSessionRecordingDuration(event.endTime - event.startTime)}`;
+    case SessionRecordingEventType.Join:
+      return `${event.user} joined`;
+    default:
+      return 'Event';
+  }
+}
+
+const EVENT_RADIUS = 8;
+const TEXT_PADDING = 8;
+const EVENT_HEIGHT = 24;
+
+/**
+ * EventsRenderer renders each "event" that happens in a session recording, i.e. inactivity,
+ * or if a user has joined. It does not render resize events, that is handled by a different renderer.
+ *
+ * Events are shown between the start time and end time of the event. The text in the event
+ * scrolls along with the timeline, but is constrained to the event box.
+ */
+export class EventsRenderer extends TimelineCanvasRenderer {
+  private height = 0;
+  // rows are computed on creation, containing information such as text width to avoid
+  // measuring text during render.
+  private rows: EventRow[] = [];
+  // rowsWithPositions are computed after calculate() is called, containing the position
+  // of each event in the timeline, along with text metrics to avoid measuring text during render
+  private rowsWithPositions: EventRowWithPositions[] = [];
+
+  constructor(
+    ctx: CanvasRenderingContext2D,
+    theme: DefaultTheme,
+    metadata: SessionRecordingMetadata
+  ) {
+    super(ctx, theme, metadata.duration);
+
+    this.createEventRows(metadata.events);
+  }
+
+  _render({ containerWidth, offset }: TimelineRenderContext) {
+    const eventRows = this.getVisibleEvents(offset, containerWidth);
+
+    for (const [index, row] of eventRows.entries()) {
+      for (const event of row) {
+        const startX = event.startPosition;
+        const endX = event.endPosition;
+        this.ctx.save();
+
+        const x = startX;
+
+        const y =
+          EVENT_SECTION_PADDING + index * EVENT_ROW_HEIGHT + RULER_HEIGHT;
+
+        // calculate the minimum width of the event box from the text width + padding
+        const textWidth = event.textMetrics.width;
+        const minWidth = textWidth + 2 * TEXT_PADDING;
+
+        const width = Math.max(endX - startX, minWidth);
+
+        const styles = getEventStyles(this.theme, event.type);
+
+        this.ctx.fillStyle = styles.background;
+        this.ctx.beginPath();
+
+        this.ctx.roundRect(x, y, width, EVENT_HEIGHT, EVENT_RADIUS);
+        this.ctx.fill();
+
+        this.ctx.fillStyle = styles.text;
+
+        this.ctx.font = `bold 12px ${CANVAS_FONT}`;
+
+        // Calculate text position and constrain it within the event box.
+        const textHeight =
+          event.textMetrics.actualBoundingBoxAscent +
+          event.textMetrics.actualBoundingBoxDescent;
+
+        const textPadding = 8;
+        const visibleStart = Math.max(startX, -offset);
+        const defaultTextOffset = Math.max(
+          visibleStart - startX + textPadding,
+          textPadding
+        );
+
+        let textOffset = defaultTextOffset;
+
+        if (textWidth > 0) {
+          // Ensure the text does not overflow the event box.
+          const maxTextOffset = Math.max(
+            textPadding,
+            width - textWidth - textPadding
+          );
+          textOffset = Math.min(defaultTextOffset, maxTextOffset);
+        }
+
+        const textY =
+          y +
+          (EVENT_HEIGHT - textHeight) / 2 +
+          event.textMetrics.actualBoundingBoxAscent;
+
+        this.ctx.fillText(event.title, x + textOffset, textY + 1);
+
+        this.ctx.restore();
+      }
+    }
+  }
+
+  // calculate calculates the positions of each event in the timeline, along with the
+  // text metrics for each event title (to avoid measuring text during render).
+  calculate() {
+    const eventRowsWithPositions: EventRowWithPositions[] = [];
+
+    for (let i = 0; i < this.rows.length; i++) {
+      const row = this.rows[i];
+      const positionedRow: EventRowWithPositions = [];
+
+      for (const event of row) {
+        const startPosition =
+          LEFT_PADDING + (event.startTime / this.duration) * this.timelineWidth;
+        const endPosition =
+          LEFT_PADDING + (event.endTime / this.duration) * this.timelineWidth;
+
+        positionedRow.push({
+          ...event,
+          endPosition,
+          startPosition,
+        });
+      }
+
+      eventRowsWithPositions.push(positionedRow);
+    }
+
+    this.rowsWithPositions = eventRowsWithPositions;
+  }
+
+  getHeight() {
+    return this.height;
+  }
+
+  getRowsWithPositions() {
+    return this.rowsWithPositions;
+  }
+
+  private createEventRows(events: SessionRecordingEvent[]) {
+    const sortedEvents = [...events].sort((a, b) => a.startTime - b.startTime);
+    const rows: EventRow[] = [];
+
+    for (const event of sortedEvents) {
+      if (event.type === SessionRecordingEventType.Resize) {
+        continue;
+      }
+
+      let placed = false;
+
+      const title = getEventTitle(event);
+
+      for (const row of rows) {
+        const lastEventInRow = row[row.length - 1];
+
+        if (lastEventInRow.endTime <= event.startTime) {
+          const textMetrics = this.ctx.measureText(title);
+
+          row.push({ ...event, textMetrics, title });
+
+          placed = true;
+          break;
+        }
+      }
+
+      if (!placed) {
+        const textMetrics = this.ctx.measureText(title);
+
+        rows.push([{ ...event, textMetrics, title }]);
+      }
+    }
+
+    this.rows = rows;
+    this.height = this.rows.length * EVENT_ROW_HEIGHT + EVENT_SECTION_PADDING;
+  }
+
+  private getVisibleEvents(
+    offset: number,
+    containerWidth: number
+  ): EventRowWithPositions[] {
+    const visibleStart = -offset - 100;
+    const visibleEnd = -offset + containerWidth + 100;
+
+    const visibleRows: EventRowWithPositions[] = [];
+
+    for (const row of this.rowsWithPositions) {
+      const visibleRow: EventRowWithPositions = [];
+
+      for (const event of row) {
+        if (
+          event.startPosition <= visibleEnd &&
+          event.endPosition >= visibleStart
+        ) {
+          visibleRow.push(event);
+        }
+      }
+
+      if (visibleRow.length > 0) {
+        visibleRows.push(visibleRow);
+      }
+    }
+
+    return visibleRows;
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.test.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.test.ts
new file mode 100644
index 0000000000000..b6886678b3a59
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.test.ts
@@ -0,0 +1,188 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import 'jest-canvas-mock';
+
+import { darkTheme } from 'design/theme';
+
+import { SessionRecordingThumbnail } from 'teleport/services/recordings';
+import type { TimelineRenderContext } from 'teleport/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer';
+
+import { FramesRenderer, type LoadedImageResult } from './FramesRenderer';
+
+// Mock the SVG utilities
+jest.mock('teleport/SessionRecordings/svg', () => ({
+  generateTerminalSVGStyleTag: jest.fn(() => '<style></style>'),
+  injectSVGStyles: jest.fn(svg => svg),
+  svgToDataURIBase64: jest.fn(svg => `data:image/svg+xml;base64,${svg}`),
+}));
+
+beforeEach(() => {
+  Object.defineProperty(window, 'devicePixelRatio', {
+    writable: true,
+    configurable: true,
+    value: 1,
+  });
+
+  global.OffscreenCanvas = jest.fn().mockImplementation((width, height) => {
+    const canvas = document.createElement('canvas');
+
+    canvas.width = width;
+    canvas.height = height;
+
+    return canvas;
+  });
+});
+
+afterEach(() => {
+  global.OffscreenCanvas = undefined;
+});
+
+function createThumbnail(
+  svg: string,
+  cols: number,
+  rows: number,
+  startOffset: number,
+  cursorX = 0,
+  cursorY = 0
+): SessionRecordingThumbnail {
+  return {
+    svg,
+    startOffset,
+    endOffset: startOffset + 1000,
+    cols,
+    rows,
+    cursorX,
+    cursorY,
+    cursorVisible: true,
+  };
+}
+
+const mockFrames: SessionRecordingThumbnail[] = [
+  createThumbnail('<svg>frame1</svg>', 80, 24, 0),
+  createThumbnail('<svg>frame2</svg>', 100, 30, 1000),
+  createThumbnail('<svg>frame3</svg>', 120, 40, 2000),
+  createThumbnail('<svg>frame4</svg>', 80, 24, 3000),
+];
+
+async function createRenderer(
+  frames: SessionRecordingThumbnail[] = mockFrames,
+  timelineWidth = 1000,
+  duration = 5000,
+  initialHeight = 200,
+  eventsHeight = 50,
+  frameWidth = 200,
+  frameHeight = 50
+) {
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d')!;
+
+  function imageLoader(): Promise<LoadedImageResult> {
+    const canvas = new OffscreenCanvas(frameWidth, frameHeight);
+    const img = new Image();
+
+    return Promise.resolve({ canvas, img });
+  }
+
+  const renderer = new FramesRenderer(
+    ctx,
+    darkTheme,
+    duration,
+    frames,
+    initialHeight,
+    eventsHeight,
+    imageLoader
+  );
+
+  renderer.setTimelineWidth(timelineWidth);
+  renderer.calculate();
+
+  await renderer.loadVisibleFrames(0, timelineWidth);
+
+  const renderContext: TimelineRenderContext = {
+    containerWidth: timelineWidth,
+    offset: 0,
+    containerHeight: initialHeight,
+    eventsHeight: eventsHeight,
+  };
+
+  renderer._render(renderContext);
+
+  return { ctx, renderer };
+}
+
+function getDrawImageCalls(ctx: CanvasRenderingContext2D) {
+  return ctx.__getDrawCalls().filter(call => call.type === 'drawImage');
+}
+
+test('should calculate frame positions correctly', async () => {
+  const { ctx } = await createRenderer();
+
+  const drawImageCalls = getDrawImageCalls(ctx);
+
+  expect(drawImageCalls).toHaveLength(4);
+
+  expect(drawImageCalls[0].props.dx).toBe(24); // left padding
+  expect(drawImageCalls[1].props.dx).toBe(224); // 24 + 200
+  expect(drawImageCalls[2].props.dx).toBe(424); // 224 + 200
+  expect(drawImageCalls[3].props.dx).toBe(624); // last frame positioned next to previous
+});
+
+test('should skip frames that would overlap at current zoom', async () => {
+  const closeFrames: SessionRecordingThumbnail[] = [
+    createThumbnail('<svg>1</svg>', 80, 24, 0),
+    createThumbnail('<svg>2</svg>', 80, 24, 500),
+    createThumbnail('<svg>3</svg>', 80, 24, 1000),
+    createThumbnail('<svg>4</svg>', 80, 24, 1500),
+    createThumbnail('<svg>5</svg>', 80, 24, 2000),
+  ];
+
+  const { ctx } = await createRenderer(closeFrames, 1000);
+
+  const drawImageCalls = getDrawImageCalls(ctx);
+
+  expect(drawImageCalls).toHaveLength(3);
+
+  expect(drawImageCalls[0].props.dx).toBe(24); // first frame, should be drawn at left padding
+  expect(drawImageCalls[1].props.dx).toBe(224); // fourth frame
+});
+
+test('should only render visible frames', async () => {
+  const { ctx } = await createRenderer(mockFrames, 500);
+
+  const drawImageCalls = getDrawImageCalls(ctx);
+
+  expect(drawImageCalls).toHaveLength(2);
+
+  expect(drawImageCalls[0].props.dx).toBe(24); // left padding
+  expect(drawImageCalls[1].props.dx).toBe(224); // 24 + 200
+});
+
+test('should calculate the frames at the current zoom level', async () => {
+  const { renderer } = await createRenderer();
+
+  const framesAtCurrentZoom = renderer.getFramesAtCurrentZoom();
+
+  expect(framesAtCurrentZoom).toHaveLength(4);
+
+  renderer.setTimelineWidth(400);
+
+  const framesAtNewZoom = renderer.getFramesAtCurrentZoom();
+
+  expect(framesAtNewZoom).toHaveLength(2);
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.ts
new file mode 100644
index 0000000000000..35a8fefa86997
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/FramesRenderer.ts
@@ -0,0 +1,422 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { DefaultTheme } from 'styled-components';
+
+import type { SessionRecordingThumbnail } from 'teleport/services/recordings';
+import {
+  generateTerminalSVGStyleTag,
+  injectSVGStyles,
+  svgToDataURIBase64,
+} from 'teleport/SessionRecordings/svg';
+import { calculateThumbnailViewport } from 'teleport/SessionRecordings/view/Timeline/utils';
+
+import {
+  DEFAULT_FRAME_HEIGHT,
+  DEFAULT_MAX_FRAME_WIDTH,
+  EVENT_SECTION_PADDING,
+  LEFT_PADDING,
+  RULER_HEIGHT,
+} from '../constants';
+import {
+  TimelineCanvasRenderer,
+  type TimelineRenderContext,
+} from './TimelineCanvasRenderer';
+
+export interface ThumbnailWithId extends SessionRecordingThumbnail {
+  id: string;
+}
+
+interface ThumbnailWithPosition extends ThumbnailWithId {
+  index: number;
+  position: number;
+  width: number;
+  isEnd: boolean;
+}
+
+/**
+ * FramesRenderer renders every frame it can at the current zoom level.
+ * It skips frames that would overlap with the previous frame to avoid clutter.
+ * It always renders the last frame to ensure the end of the recording is visible.
+ *
+ * It renders frames onto offscreen canvases to avoid doing expensive image processing
+ * on the main canvas during every render cycle. It only processes images when they
+ * are loaded or when the theme changes.
+ *
+ * It uses binary search to quickly find the first frame that is visible in the current
+ * viewport, then iterates from there to find all visible frames.
+ */
+export class FramesRenderer extends TimelineCanvasRenderer {
+  private readonly frames: ThumbnailWithId[] = [];
+  private framesAtCurrentZoom: ThumbnailWithPosition[] = [];
+
+  private frameHeight = 0;
+  private maxFrameWidth = 0;
+
+  private loadedImageElements = new Map<string, HTMLImageElement>();
+  private loadedImages = new Map<string, OffscreenCanvas>();
+
+  constructor(
+    ctx: CanvasRenderingContext2D,
+    theme: DefaultTheme,
+    duration: number,
+    frames: SessionRecordingThumbnail[],
+    initialHeight: number,
+    eventsHeight: number,
+    private imageLoader: (frame: ThumbnailWithId) => Promise<{
+      canvas: OffscreenCanvas;
+      img: HTMLImageElement;
+    }> = defaultImageLoader
+  ) {
+    super(ctx, theme, duration);
+
+    const svgTheme = generateTerminalSVGStyleTag(theme);
+
+    this.frameHeight =
+      initialHeight - eventsHeight - RULER_HEIGHT - EVENT_SECTION_PADDING * 2;
+
+    this.maxFrameWidth =
+      (DEFAULT_MAX_FRAME_WIDTH / DEFAULT_FRAME_HEIGHT) * initialHeight;
+
+    this.frames = frames.map((frame, index) => ({
+      ...frame,
+      id: `frame-${index}`,
+      svg: svgToDataURIBase64(injectSVGStyles(frame.svg, svgTheme)),
+    }));
+
+    this.setHeight(initialHeight, eventsHeight);
+  }
+
+  _render({ containerWidth, eventsHeight, offset }: TimelineRenderContext) {
+    const framesToRender = this.getVisibleFrames(offset, containerWidth);
+
+    for (let i = 0; i < framesToRender.length; i++) {
+      const frame = framesToRender[i];
+      const img = this.loadedImages.get(frame.id);
+
+      if (img) {
+        this.ctx.drawImage(
+          img,
+          frame.position,
+          eventsHeight + EVENT_SECTION_PADDING + RULER_HEIGHT,
+          frame.width,
+          this.frameHeight
+        );
+      }
+    }
+  }
+
+  // calculate determines which frames to show at the current zoom level,
+  // and their positions.
+  calculate() {
+    const framesWithPositions: ThumbnailWithPosition[] = [];
+
+    for (let i = 0; i < this.frames.length; i++) {
+      const frame = this.frames[i];
+      const frameAspectRatio = frame.cols / frame.rows;
+
+      const calculatedWidth = Math.ceil(this.frameHeight * frameAspectRatio);
+      const frameWidth = Math.min(calculatedWidth, this.maxFrameWidth);
+
+      let position =
+        (frame.startOffset / this.duration) * this.timelineWidth + LEFT_PADDING;
+
+      const isLast = i === this.frames.length - 1;
+      if (isLast && i > 0) {
+        const lastFrameWithPosition =
+          framesWithPositions[framesWithPositions.length - 1];
+        // If the last frame has space to fit, shift it left so it's fully visible.
+        if (
+          lastFrameWithPosition.position + lastFrameWithPosition.width <
+          position
+        ) {
+          position = position - frameWidth + LEFT_PADDING / 2;
+        }
+      }
+
+      framesWithPositions.push({
+        ...frame,
+        index: i,
+        isEnd: i === this.frames.length - 1,
+        position,
+        width: frameWidth,
+      });
+    }
+
+    const framesAtZoom: ThumbnailWithPosition[] = [];
+
+    for (const [index, frame] of framesWithPositions.entries()) {
+      if (index === 0) {
+        framesAtZoom.push(frame);
+        continue;
+      }
+
+      const lastFrame = framesAtZoom[framesAtZoom.length - 1];
+      const lastFrameEnd = lastFrame.position + lastFrame.width;
+
+      if (frame.position >= lastFrameEnd - 1) {
+        framesAtZoom.push(frame);
+      }
+    }
+
+    this.framesAtCurrentZoom = framesAtZoom;
+  }
+
+  getFramesAtCurrentZoom() {
+    return this.framesAtCurrentZoom;
+  }
+
+  destroy() {
+    this.framesAtCurrentZoom = [];
+    this.loadedImageElements.clear();
+  }
+
+  // loadNonVisibleFrames loads all frames that are not currently visible.
+  // This is useful for preloading frames in the background.
+  loadNonVisibleFrames() {
+    const nonVisibleFrames = this.frames.filter(
+      frame => !this.loadedImages.has(frame.id)
+    );
+
+    return Promise.all(nonVisibleFrames.map(frame => this.loadImage(frame)));
+  }
+
+  // loadVisibleFrames loads only the frames that are currently visible in the viewport.
+  loadVisibleFrames(offset: number, containerWidth: number) {
+    const visibleFrames = this.getVisibleFrames(offset, containerWidth);
+
+    return Promise.all(visibleFrames.map(frame => this.loadImage(frame)));
+  }
+
+  // recreateImages redraws all loaded images, useful for when the height changes (as the
+  // height/width and zoom of the thumbnail changes).
+  recreateImages(render: () => void) {
+    for (const frame of this.frames) {
+      const img = this.loadedImageElements.get(frame.id);
+      const existingCanvas = this.loadedImages.get(frame.id);
+
+      if (img && existingCanvas) {
+        const newCanvas = new OffscreenCanvas(img.width, img.height);
+
+        this.drawFrame(frame, newCanvas, img);
+
+        render();
+      }
+    }
+  }
+
+  // recreateVisibleImages redraws only the loaded images that are currently visible.
+  recreateVisibleImages(
+    offset: number,
+    containerWidth: number,
+    render: () => void
+  ) {
+    const visibleFrames = this.getVisibleFrames(offset, containerWidth);
+
+    for (const frame of visibleFrames) {
+      const img = this.loadedImageElements.get(frame.id);
+      const canvas = this.loadedImages.get(frame.id);
+
+      if (img && canvas) {
+        this.drawFrame(frame, canvas, img);
+
+        render();
+      }
+    }
+  }
+
+  setHeight(height: number, eventsHeight: number) {
+    this.frameHeight =
+      height - eventsHeight - RULER_HEIGHT - EVENT_SECTION_PADDING * 2;
+
+    this.maxFrameWidth =
+      (DEFAULT_MAX_FRAME_WIDTH / DEFAULT_FRAME_HEIGHT) * height;
+  }
+
+  private binarySearchFrameIndex(position: number): number {
+    let left = 0;
+    let right = this.framesAtCurrentZoom.length - 1;
+    let result = 0;
+
+    while (left <= right) {
+      const mid = Math.floor((left + right) / 2);
+      const frame = this.framesAtCurrentZoom[mid];
+
+      if (frame.position <= position) {
+        result = mid;
+        left = mid + 1;
+      } else {
+        right = mid - 1;
+      }
+    }
+
+    return Math.max(0, result - 1);
+  }
+
+  private getVisibleFrames(
+    offset: number,
+    containerWidth: number
+  ): ThumbnailWithPosition[] {
+    const visibleStart = -offset;
+    const visibleEnd = -offset + containerWidth;
+
+    const frames: ThumbnailWithPosition[] = [];
+    const startIndex = this.binarySearchFrameIndex(visibleStart);
+
+    for (let i = startIndex; i < this.framesAtCurrentZoom.length; i++) {
+      const frame = this.framesAtCurrentZoom[i];
+
+      if (frame.position > visibleEnd) {
+        break;
+      }
+
+      const frameEnd = frame.position + frame.width;
+
+      if (frameEnd >= visibleStart) {
+        frames.push(frame);
+      }
+    }
+
+    return frames;
+  }
+
+  // drawFrame draws a single frame onto an offscreen canvas, scaling and cropping
+  // the image to fit the desired dimensions while maintaining aspect ratio.
+  private drawFrame(
+    frame: ThumbnailWithId,
+    canvas: OffscreenCanvas,
+    image: HTMLImageElement
+  ) {
+    const frameAspectRatio = frame.cols / frame.rows;
+    const calculatedWidth = Math.ceil(this.frameHeight * frameAspectRatio);
+    const width = Math.min(calculatedWidth, this.maxFrameWidth);
+    const height = this.frameHeight;
+
+    const dpr = window.devicePixelRatio || 1;
+
+    canvas.width = width * dpr;
+    canvas.height = height * dpr;
+
+    const ctx = canvas.getContext('2d');
+
+    if (!ctx) {
+      throw new Error('Failed to get offscreen canvas context');
+    }
+
+    ctx.scale(dpr, dpr);
+
+    ctx.save();
+
+    // Calculate viewport position
+    const viewport = calculateThumbnailViewport(
+      frame,
+      image.width,
+      image.height
+    );
+
+    // Calculate source dimensions maintaining aspect ratio
+    const imageAspect = image.width / image.height;
+    const canvasAspect = width / height;
+
+    let adjustedSourceWidth = viewport.sourceWidth;
+    let adjustedSourceHeight = viewport.sourceHeight;
+
+    // Adjust source dimensions to match canvas aspect ratio
+    if (imageAspect > canvasAspect) {
+      // Image is wider - adjust width
+      const adjustedFullWidth = image.height * canvasAspect;
+      adjustedSourceWidth = adjustedFullWidth / viewport.zoomLevel;
+    } else {
+      // Image is taller - adjust height
+      const adjustedFullHeight = image.width / canvasAspect;
+      adjustedSourceHeight = adjustedFullHeight / viewport.zoomLevel;
+    }
+
+    const borderRadius = 12;
+
+    // Create clipping path for rounded corners
+    ctx.beginPath();
+    ctx.roundRect(0, 0, width, height, borderRadius);
+    ctx.clip();
+
+    // Draw the image
+    ctx.drawImage(
+      image,
+      viewport.sourceX,
+      viewport.sourceY,
+      adjustedSourceWidth,
+      adjustedSourceHeight,
+      0,
+      0,
+      width,
+      height
+    );
+
+    ctx.restore();
+
+    // Draw border
+    ctx.save();
+    ctx.strokeStyle = this.theme.colors.sessionRecordingTimeline.frameBorder;
+    ctx.lineWidth = 1;
+
+    ctx.beginPath();
+
+    // Adjust border position by 0.5px to ensure it's fully visible
+    ctx.roundRect(0.5, 0.5, width - 1, height - 1, borderRadius);
+    ctx.stroke();
+
+    ctx.restore();
+
+    this.loadedImages.set(frame.id, canvas);
+  }
+
+  // loadImage loads a data URI SVG through the provided image loader and draws the result onto an offscreen canvas.
+  private async loadImage(frame: ThumbnailWithId) {
+    const { canvas, img } = await this.imageLoader(frame);
+
+    this.drawFrame(frame, canvas, img);
+    this.loadedImageElements.set(frame.id, img);
+  }
+}
+
+export interface LoadedImageResult {
+  canvas: OffscreenCanvas;
+  img: HTMLImageElement;
+}
+
+function defaultImageLoader(frame: ThumbnailWithId) {
+  return new Promise<LoadedImageResult>((resolve, reject) => {
+    const img = new Image();
+
+    img.onload = () => {
+      try {
+        const canvas = new OffscreenCanvas(img.width, img.height);
+
+        resolve({ canvas, img });
+      } catch {
+        reject(new Error(`Failed to process image for frame ${frame.id}`));
+      }
+    };
+
+    img.onerror = () => {
+      reject(new Error(`Failed to load image for frame ${frame.id}`));
+    };
+
+    img.src = frame.svg;
+  });
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.test.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.test.ts
new file mode 100644
index 0000000000000..81ab482f99bc9
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.test.ts
@@ -0,0 +1,109 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import 'jest-canvas-mock';
+
+import { darkTheme } from 'design/theme';
+
+import { SessionRecordingMetadata } from 'teleport/services/recordings';
+import { ProgressLineRenderer } from 'teleport/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer';
+import type { TimelineRenderContext } from 'teleport/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer';
+
+import { LEFT_PADDING } from '../constants';
+
+const mockMetadata: SessionRecordingMetadata = {
+  startTime: 1609459200, // Jan 1, 2021
+  endTime: 1609462800, // Jan 1, 2021
+  duration: 3600000, // 1 hour in milliseconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
+
+function createRenderer(duration: number) {
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d')!;
+
+  const renderer = new ProgressLineRenderer(ctx, darkTheme, duration);
+
+  return { ctx, renderer };
+}
+
+test('should calculate position correctly', () => {
+  const { ctx, renderer } = createRenderer(mockMetadata.duration);
+
+  renderer.setTimelineWidth(1000);
+  renderer.setCurrentTime(mockMetadata.duration / 2);
+
+  const renderContext: TimelineRenderContext = {
+    containerHeight: 100,
+    containerWidth: 1000,
+    eventsHeight: 50,
+    offset: 0,
+  };
+
+  renderer.render(renderContext);
+
+  const expectedPosition = 500 + LEFT_PADDING; // Half of 1000 + LEFT_PADDING
+
+  const path = ctx.__getPath();
+
+  expect(path[0].type).toBe('beginPath');
+  expect(path[1].type).toBe('moveTo');
+  expect(path[1].props.x).toBe(expectedPosition);
+  expect(path[1].props.y).toBe(0);
+  expect(path[2].type).toBe('lineTo');
+  expect(path[2].props.x).toBe(expectedPosition);
+  expect(path[2].props.y).toBe(100);
+
+  ctx.__clearPath();
+
+  renderer.setCurrentTime(mockMetadata.duration); // Move to end
+  renderer.render(renderContext);
+
+  const endPosition = 1000 + LEFT_PADDING; // End of timeline + LEFT_PADDING
+  const newPath = ctx.__getPath();
+
+  expect(newPath[0].type).toBe('beginPath');
+  expect(newPath[1].type).toBe('moveTo');
+  expect(newPath[1].props.x).toBe(endPosition);
+  expect(newPath[1].props.y).toBe(0);
+  expect(newPath[2].type).toBe('lineTo');
+  expect(newPath[2].props.x).toBe(endPosition);
+  expect(newPath[2].props.y).toBe(100);
+
+  ctx.__clearPath();
+
+  renderer.setCurrentTime(0); // Move to start
+  renderer.render(renderContext);
+
+  const startPosition = LEFT_PADDING; // Start of timeline (LEFT_PADDING)
+  const startPath = ctx.__getPath();
+
+  expect(startPath[0].type).toBe('beginPath');
+  expect(startPath[1].type).toBe('moveTo');
+  expect(startPath[1].props.x).toBe(startPosition);
+  expect(startPath[1].props.y).toBe(0);
+  expect(startPath[2].type).toBe('lineTo');
+  expect(startPath[2].props.x).toBe(startPosition);
+  expect(startPath[2].props.y).toBe(100);
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.ts
new file mode 100644
index 0000000000000..5e0ac95056348
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/ProgressLineRenderer.ts
@@ -0,0 +1,49 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { LEFT_PADDING } from '../constants';
+import {
+  TimelineCanvasRenderer,
+  type TimelineRenderContext,
+} from './TimelineCanvasRenderer';
+
+export class ProgressLineRenderer extends TimelineCanvasRenderer {
+  private currentTime = 0;
+  private position = 0;
+
+  _render({ containerHeight }: TimelineRenderContext) {
+    this.ctx.strokeStyle =
+      this.theme.colors.sessionRecordingTimeline.progressLine;
+    this.ctx.lineWidth = 2;
+
+    this.ctx.beginPath();
+    this.ctx.moveTo(this.position, 0);
+    this.ctx.lineTo(this.position, containerHeight);
+    this.ctx.stroke();
+  }
+
+  calculate() {
+    this.position =
+      (this.currentTime / this.duration) * this.timelineWidth + LEFT_PADDING;
+  }
+
+  setCurrentTime(currentTime: number) {
+    this.currentTime = currentTime;
+    this.calculate();
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.test.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.test.ts
new file mode 100644
index 0000000000000..9e6ce47157b68
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.test.ts
@@ -0,0 +1,444 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import 'jest-canvas-mock';
+
+import { darkTheme } from 'design/theme';
+
+import { SessionRecordingMetadata } from 'teleport/services/recordings';
+import type { TimelineRenderContext } from 'teleport/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer';
+
+import { TimeMarkersRenderer } from './TimeMarksRenderer';
+
+const mockMetadata: SessionRecordingMetadata = {
+  startTime: 1609459200000, // Jan 1, 2021 12:00:00 AM UTC
+  endTime: 1609462800000, // Jan 1, 2021 1:00:00 AM UTC
+  duration: 3600000, // 1 hour in milliseconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
+
+function createRenderer(metadata?: Partial<SessionRecordingMetadata>) {
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d')!;
+
+  const renderer = new TimeMarkersRenderer(ctx, darkTheme, {
+    ...mockMetadata,
+    ...metadata,
+  });
+
+  return { ctx, renderer };
+}
+
+describe('time marker intervals', () => {
+  it('should render 10 second intervals at low zoom', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 60 * 1000, // 1 minute
+    });
+
+    renderer.setTimelineWidth(500); // low zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 600,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // At low zoom, should show 10 second intervals: 0:00, 0:10, 0:20, 0:30, 0:40, 0:50, 1:00
+    expect(fillTextCalls).toHaveLength(7);
+    expect(fillTextCalls[0].props.text).toBe('0:00');
+    expect(fillTextCalls[1].props.text).toBe('0:10');
+    expect(fillTextCalls[2].props.text).toBe('0:20');
+    expect(fillTextCalls[3].props.text).toBe('0:30');
+    expect(fillTextCalls[4].props.text).toBe('0:40');
+    expect(fillTextCalls[5].props.text).toBe('0:50');
+    expect(fillTextCalls[6].props.text).toBe('1:00');
+  });
+
+  it('should render 5 second intervals at medium zoom', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 60 * 1000, // 1 minute
+    });
+
+    renderer.setTimelineWidth(2000); // medium zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 2100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // At medium zoom, should show 5 second intervals
+    expect(fillTextCalls).toHaveLength(13);
+    expect(fillTextCalls[0].props.text).toBe('0:00');
+    expect(fillTextCalls[1].props.text).toBe('0:05');
+    expect(fillTextCalls[2].props.text).toBe('0:10');
+    expect(fillTextCalls[6].props.text).toBe('0:30');
+    expect(fillTextCalls[12].props.text).toBe('1:00');
+  });
+
+  it('should render 1 second intervals at high zoom', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 10000, // 10 seconds
+    });
+
+    renderer.setTimelineWidth(2500); // high zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 2600,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // At high zoom, should show 1-second intervals
+    expect(fillTextCalls).toHaveLength(11);
+
+    expect(fillTextCalls[0].props.text).toBe('0:00');
+    expect(fillTextCalls[1].props.text).toBe('0:01');
+    expect(fillTextCalls[2].props.text).toBe('0:02');
+    expect(fillTextCalls[5].props.text).toBe('0:05');
+    expect(fillTextCalls[10].props.text).toBe('0:10');
+  });
+});
+
+describe('absolute time display', () => {
+  it('should show absolute time for minute markers when enabled', () => {
+    const { ctx, renderer } = createRenderer({
+      startTime: 1609459200000, // Jan 1, 2021 12:00:00 AM UTC
+      duration: 3 * 60 * 1000, // 3 minutes
+    });
+
+    renderer.setTimelineWidth(2000);
+    renderer.setShowAbsoluteTime(true);
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 2100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // Should show absolute time for minute markers (0:00, 1:00, 2:00, 3:00)
+    // and relative time for 5 second intervals between them
+    const minuteMarkers = fillTextCalls.filter(
+      (call, index) => index % 12 === 0 // Every 12th marker is a minute marker (60s / 5s interval)
+    );
+
+    // The absolute time should be shown in 12-hour format
+    // Starting at midnight UTC
+    expect(minuteMarkers[0].props.text).toBe('12:00am');
+    expect(minuteMarkers[1].props.text).toBe('12:01am');
+    expect(minuteMarkers[2].props.text).toBe('12:02am');
+    expect(minuteMarkers[3].props.text).toBe('12:03am');
+
+    const nonMinuteMarkers = fillTextCalls.filter(
+      (call, index) => index % 12 !== 0
+    );
+
+    // Non-minute markers should show relative time
+    expect(nonMinuteMarkers[0].props.text).toBe('0:05');
+    expect(nonMinuteMarkers[1].props.text).toBe('0:10');
+    expect(nonMinuteMarkers[2].props.text).toBe('0:15');
+    expect(nonMinuteMarkers[3].props.text).toBe('0:20');
+  });
+
+  it('should show relative time when absolute time is disabled', () => {
+    const { ctx, renderer } = createRenderer({
+      startTime: new Date('2021-01-01T00:00:00Z').getTime(),
+      duration: 3 * 60 * 1000, // 3 minutes
+    });
+
+    renderer.setTimelineWidth(2000);
+    renderer.setShowAbsoluteTime(false);
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 2100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // All markers should show relative time
+    expect(fillTextCalls[0].props.text).toBe('0:00');
+    expect(fillTextCalls[12].props.text).toBe('1:00');
+    expect(fillTextCalls[24].props.text).toBe('2:00');
+    expect(fillTextCalls[36].props.text).toBe('3:00');
+  });
+
+  it('should handle PM times correctly', () => {
+    const { ctx, renderer } = createRenderer({
+      startTime: new Date('2021-01-01T12:00:00Z').getTime(),
+      duration: 2 * 60 * 1000, // 2 minutes
+    });
+
+    renderer.setTimelineWidth(2000);
+    renderer.setShowAbsoluteTime(true);
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 2100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    const minuteMarkers = fillTextCalls.filter(
+      (call, index) => index % 12 === 0
+    );
+
+    expect(minuteMarkers[0].props.text).toBe('12:00pm');
+    expect(minuteMarkers[1].props.text).toBe('12:01pm');
+    expect(minuteMarkers[2].props.text).toBe('12:02pm');
+  });
+});
+
+describe('visibility', () => {
+  it('should only render visible time markers', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 60 * 1000, // 1 minute
+    });
+
+    renderer.setTimelineWidth(6000); // very high zoom
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 500,
+      offset: -1000, // scrolled to show markers around 10 seconds
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // Should only render markers visible in the viewport (with 100px buffer)
+    // At this zoom and offset, should see markers starting from 9 seconds
+    expect(fillTextCalls.length).toBe(8); // 9s, 10s, 11s, 12s, 13s, 14s, 15s, 16s
+
+    // Check that we're seeing markers in the expected range
+    const visibleTexts = fillTextCalls.map(call => call.props.text);
+
+    expect(visibleTexts[0]).toBe('0:09');
+    expect(visibleTexts[visibleTexts.length - 1]).toBe('0:16');
+  });
+});
+
+describe('sub-tick rendering', () => {
+  it('should render sub-ticks between main markers at high zoom', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 10 * 1000, // 10 seconds
+    });
+
+    renderer.setTimelineWidth(3000); // high zoom to get many sub-ticks
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 3100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+
+    // Count fillRect calls that are sub-ticks (height 4 or 6)
+    const subTickCalls = drawCalls.filter(
+      call =>
+        call.type === 'fillRect' &&
+        (call.props.height === 4 || call.props.height === 6)
+    );
+
+    // At high zoom with 1-second intervals, should have 7 sub-ticks per interval
+    // 10 intervals × 7 sub-ticks = 70 sub-ticks total
+    expect(subTickCalls.length).toBe(70);
+  });
+});
+
+describe('label spacing', () => {
+  it('should skip labels when markers are too close at very low zoom', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 10 * 60 * 1000, // 10 minutes
+    });
+
+    renderer.setTimelineWidth(200); // very low zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 300,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+    const fillRectCalls = drawCalls.filter(
+      call => call.type === 'fillRect' && call.props.height === 10
+    );
+
+    // At very low zoom, should show 60-second intervals with label skipping
+    // Should render 11 tick marks (one every 60s for 10 minutes)
+    expect(fillRectCalls.length).toBe(11);
+    // Should show only 4 labels due to label skipping
+    expect(fillTextCalls.length).toBe(4);
+
+    expect(fillTextCalls[0].props.text).toBe('0:00');
+    expect(fillTextCalls[1].props.text).toBe('3:00');
+    expect(fillTextCalls[2].props.text).toBe('6:00');
+    expect(fillTextCalls[3].props.text).toBe('9:00');
+  });
+
+  it('should show all labels when markers are well-spaced', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 30 * 1000, // 30 seconds
+    });
+
+    renderer.setTimelineWidth(3000); // high zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 3100,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+    const fillRectCalls = drawCalls.filter(
+      call => call.type === 'fillRect' && call.props.height === 10
+    );
+
+    // When markers are well-spaced, should show all labels
+    expect(fillTextCalls.length).toBe(fillRectCalls.length);
+  });
+
+  it('should render tick marks even when labels are hidden', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 5 * 60 * 1000, // 5 minutes
+    });
+
+    renderer.setTimelineWidth(100); // extremely low zoom
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 150,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillRectCalls = drawCalls.filter(
+      call => call.type === 'fillRect' && call.props.height === 10
+    );
+
+    // Should render 6 tick marks (one every 60s for 5 minutes)
+    expect(fillRectCalls.length).toBe(6);
+  });
+
+  it('should use 30-second intervals when very zoomed out', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 30 * 60 * 1000, // 30 minutes
+    });
+
+    renderer.setTimelineWidth(300); // very low zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 400,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // Should use 30-second intervals when pixelsPerSecond < 5
+    // With label skipping (every 10th marker), should show 7 labels
+    expect(fillTextCalls.length).toBe(7);
+  });
+
+  it('should use 60-second intervals when extremely zoomed out', () => {
+    const { ctx, renderer } = createRenderer({
+      duration: 60 * 60 * 1000, // 1 hour
+    });
+
+    renderer.setTimelineWidth(100); // extremely low zoom level
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: 150,
+      offset: 0,
+      containerHeight: 200,
+      eventsHeight: 100,
+    };
+
+    renderer._render(renderContext);
+
+    const drawCalls = ctx.__getDrawCalls();
+    const fillTextCalls = drawCalls.filter(call => call.type === 'fillText');
+
+    // Should use 60-second intervals when pixelsPerSecond < 2
+    // With label skipping (every 10th marker), should show 7 labels
+    expect(fillTextCalls.length).toBe(7);
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.ts
new file mode 100644
index 0000000000000..7383fb3f3cef9
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimeMarksRenderer.ts
@@ -0,0 +1,222 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { DefaultTheme } from 'styled-components';
+
+import type { SessionRecordingMetadata } from 'teleport/services/recordings';
+
+import { CANVAS_FONT, LEFT_PADDING } from '../constants';
+import {
+  TimelineCanvasRenderer,
+  type TimelineRenderContext,
+} from './TimelineCanvasRenderer';
+
+interface SubTick {
+  height: number;
+  position: number;
+}
+
+interface TimeMarker {
+  absolute: boolean;
+  label: string;
+  position: number;
+  time: number;
+  showLabel: boolean;
+}
+
+export class TimeMarkersRenderer extends TimelineCanvasRenderer {
+  private subTicks: SubTick[] = [];
+  private timeMarkers: TimeMarker[] = [];
+  private showAbsoluteTime = false;
+
+  private readonly startTime: number;
+
+  constructor(
+    ctx: CanvasRenderingContext2D,
+    theme: DefaultTheme,
+    metadata: SessionRecordingMetadata
+  ) {
+    super(ctx, theme, metadata.duration);
+    this.startTime = metadata.startTime;
+  }
+
+  _render({ containerWidth, offset }: TimelineRenderContext) {
+    const { markers, subTicks } = this.getVisibleTimeMarkers(
+      offset,
+      containerWidth
+    );
+
+    this.ctx.font = `10px ${CANVAS_FONT}`;
+
+    for (const marker of markers) {
+      const textWidth = this.ctx.measureText(marker.label).width;
+      const x = marker.position + LEFT_PADDING;
+
+      // Always draw the tick mark
+      this.ctx.fillStyle =
+        this.theme.colors.sessionRecordingTimeline.timeMarks.primary;
+      this.ctx.fillRect(x, 0, 1, 10);
+
+      // Only draw label if it's marked to show
+      if (marker.showLabel) {
+        if (marker.absolute) {
+          this.ctx.font = `bold 10px ${CANVAS_FONT}`;
+        }
+
+        this.ctx.fillStyle = marker.absolute
+          ? this.theme.colors.sessionRecordingTimeline.timeMarks.absolute
+          : this.theme.colors.sessionRecordingTimeline.timeMarks.text;
+
+        this.ctx.fillText(marker.label, x - textWidth / 2, 24);
+
+        if (marker.absolute) {
+          this.ctx.font = `10px ${CANVAS_FONT}`;
+        }
+      }
+    }
+
+    this.ctx.fillStyle =
+      this.theme.colors.sessionRecordingTimeline.timeMarks.secondary;
+
+    for (const tick of subTicks) {
+      this.ctx.fillRect(tick.position + LEFT_PADDING, 0, 1, tick.height);
+    }
+  }
+
+  calculate() {
+    const markers: TimeMarker[] = [];
+
+    let interval = 1000;
+    let pixelsPerSecond = (this.timelineWidth / this.duration) * 1000;
+
+    // Adjust tick interval more aggressively when zoomed out
+    if (pixelsPerSecond < 2) interval = 60000;
+    else if (pixelsPerSecond < 5) interval = 30000;
+    else if (pixelsPerSecond < 10) interval = 10000;
+    else if (pixelsPerSecond < 50) interval = 5000;
+
+    // Calculate label display interval based on spacing
+    const minLabelSpacing = 50;
+    const markerSpacing = (interval / this.duration) * this.timelineWidth;
+
+    // Determine how many markers to skip for labels
+    let labelInterval = 1;
+    if (markerSpacing < minLabelSpacing) {
+      labelInterval = Math.ceil(minLabelSpacing / markerSpacing);
+
+      if (labelInterval > 10) labelInterval = 10;
+      else if (labelInterval > 5) labelInterval = 10;
+      else if (labelInterval > 4) labelInterval = 5;
+      else if (labelInterval > 2) labelInterval = Math.min(4, labelInterval);
+    }
+
+    let markerIndex = 0;
+    for (let time = 0; time < this.duration + interval; time += interval) {
+      // if show absolute time is enabled, change the 0:00, 1:00, etc, labels to absolute time
+      const absolute = this.showAbsoluteTime && (time / 1000) % 60 === 0;
+      const label = absolute
+        ? formatAbsoluteTime(this.startTime + time)
+        : formatRelativeTime(time / 1000);
+
+      markers.push({
+        absolute,
+        label,
+        position: (time / this.duration) * this.timelineWidth,
+        time,
+        showLabel: markerIndex % labelInterval === 0,
+      });
+      markerIndex++;
+    }
+
+    const subTicks: SubTick[] = [];
+
+    let numSubticks = 0;
+    if (markerSpacing > 300) numSubticks = 9;
+    else if (markerSpacing > 200) numSubticks = 7;
+    else if (markerSpacing > 150) numSubticks = 4;
+    else if (markerSpacing > 100) numSubticks = 3;
+    else if (markerSpacing > 50) numSubticks = 1;
+
+    for (let i = 0; i < markers.length - 1; i++) {
+      const currentMarker = markers[i];
+
+      for (let j = 1; j <= numSubticks; j++) {
+        const fraction = j / (numSubticks + 1);
+        const position = currentMarker.position + markerSpacing * fraction;
+
+        let height = 4;
+        if (numSubticks % 2 === 1) {
+          height = j === Math.ceil(numSubticks / 2) ? 6 : 4;
+        } else {
+          const mid1 = numSubticks / 2;
+          const mid2 = mid1 + 1;
+          height = j === mid1 || j === mid2 ? 6 : 4;
+        }
+
+        subTicks.push({ height, position });
+      }
+    }
+
+    this.timeMarkers = markers;
+    this.subTicks = subTicks;
+  }
+
+  setShowAbsoluteTime(show: boolean) {
+    this.showAbsoluteTime = show;
+
+    this.calculate();
+  }
+
+  private getVisibleTimeMarkers(offset: number, containerWidth: number) {
+    const visibleStart = -offset - 100;
+    const visibleEnd = -offset + containerWidth + 100;
+
+    const visibleMarkers: TimeMarker[] = [];
+    const visibleSubTicks: SubTick[] = [];
+
+    for (const marker of this.timeMarkers) {
+      if (marker.position >= visibleStart && marker.position <= visibleEnd) {
+        visibleMarkers.push(marker);
+      }
+    }
+
+    for (const subTick of this.subTicks) {
+      if (subTick.position >= visibleStart && subTick.position <= visibleEnd) {
+        visibleSubTicks.push(subTick);
+      }
+    }
+
+    return { markers: visibleMarkers, subTicks: visibleSubTicks };
+  }
+}
+
+function formatRelativeTime(seconds: number) {
+  const mins = Math.floor(seconds / 60);
+  const secs = Math.floor(seconds % 60);
+
+  return `${mins}:${secs.toString().padStart(2, '0')}`;
+}
+
+function formatAbsoluteTime(timestamp: number) {
+  const date = new Date(timestamp);
+
+  return date
+    .toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
+    .replace(' AM', 'am')
+    .replace(' PM', 'pm');
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer.ts
new file mode 100644
index 0000000000000..315592111b964
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineCanvasRenderer.ts
@@ -0,0 +1,54 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { DefaultTheme } from 'styled-components';
+
+export interface TimelineRenderContext {
+  containerHeight: number;
+  containerWidth: number;
+  eventsHeight: number;
+  offset: number;
+}
+
+export abstract class TimelineCanvasRenderer {
+  protected timelineWidth = 0;
+
+  constructor(
+    protected ctx: CanvasRenderingContext2D,
+    protected theme: DefaultTheme,
+    protected duration: number
+  ) {}
+
+  abstract _render(context: TimelineRenderContext): void;
+
+  abstract calculate(): void;
+
+  render(context: TimelineRenderContext) {
+    this.ctx.save();
+
+    this._render(context);
+
+    this.ctx.restore();
+  }
+
+  setTimelineWidth(timelineWidth: number) {
+    this.timelineWidth = timelineWidth;
+
+    this.calculate();
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.test.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.test.ts
new file mode 100644
index 0000000000000..8c80fd7517ce5
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.test.ts
@@ -0,0 +1,421 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import 'jest-canvas-mock';
+
+import { darkTheme } from 'design/theme';
+
+import {
+  SessionRecordingEventType,
+  SessionRecordingMetadata,
+  SessionRecordingThumbnail,
+} from 'teleport/services/recordings';
+
+import { LEFT_PADDING } from '../constants';
+import { TimelineRenderer } from './TimelineRenderer';
+
+const mockMetadata: SessionRecordingMetadata = {
+  startTime: new Date('2021-01-01T00:00:00Z').getTime(),
+  endTime: new Date('2021-01-01T01:00:00Z').getTime(),
+  duration: 20 * 1000, // 20 seconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [
+    {
+      type: SessionRecordingEventType.Join,
+      startTime: 0,
+      endTime: 1000,
+      user: 'alice',
+    },
+    {
+      type: SessionRecordingEventType.Resize,
+      startTime: 2000,
+      endTime: 2000,
+      cols: 100,
+      rows: 30,
+    },
+  ],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
+
+function createThumbnail(
+  svg: string,
+  cols: number,
+  rows: number,
+  startOffset: number,
+  cursorX = 0,
+  cursorY = 0
+): SessionRecordingThumbnail {
+  return {
+    svg,
+    startOffset,
+    endOffset: startOffset + 1000,
+    cols,
+    rows,
+    cursorX,
+    cursorY,
+    cursorVisible: true,
+  };
+}
+
+const mockFrames: SessionRecordingThumbnail[] = [
+  createThumbnail('<svg>frame1</svg>', 80, 24, 0),
+  createThumbnail('<svg>frame2</svg>', 100, 30, 1000),
+  createThumbnail('<svg>frame3</svg>', 120, 40, 2000),
+  createThumbnail('<svg>frame4</svg>', 80, 24, 3000),
+  createThumbnail('<svg>frame5</svg>', 80, 24, 4000),
+  createThumbnail('<svg>frame6</svg>', 80, 24, 5000),
+  createThumbnail('<svg>frame7</svg>', 80, 24, 6000),
+  createThumbnail('<svg>frame8</svg>', 80, 24, 7000),
+  createThumbnail('<svg>frame9</svg>', 80, 24, 8000),
+  createThumbnail('<svg>frame10</svg>', 80, 24, 9000),
+  createThumbnail('<svg>frame11</svg>', 80, 24, 10000),
+  createThumbnail('<svg>frame12</svg>', 80, 24, 11000),
+  createThumbnail('<svg>frame13</svg>', 80, 24, 12000),
+  createThumbnail('<svg>frame14</svg>', 80, 24, 13000),
+  createThumbnail('<svg>frame15</svg>', 80, 24, 14000),
+  createThumbnail('<svg>frame16</svg>', 80, 24, 15000),
+  createThumbnail('<svg>frame17</svg>', 80, 24, 16000),
+  createThumbnail('<svg>frame18</svg>', 80, 24, 17000),
+  createThumbnail('<svg>frame19</svg>', 80, 24, 18000),
+  createThumbnail('<svg>frame20</svg>', 80, 24, 19000),
+  createThumbnail('<svg>frame21</svg>', 80, 24, 20000),
+];
+
+function createRenderer(
+  metadata: SessionRecordingMetadata = mockMetadata,
+  frames: SessionRecordingThumbnail[] = mockFrames,
+  containerWidth = 1000,
+  containerHeight = 200
+) {
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d')!;
+
+  const renderer = new TimelineRenderer(
+    ctx,
+    metadata,
+    frames,
+    darkTheme,
+    containerWidth,
+    containerHeight
+  );
+
+  return {
+    renderer,
+    ctx,
+  };
+}
+
+let animationFrameCallback: FrameRequestCallback | null = null;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+
+  // Mock requestAnimationFrame to capture the callback
+  global.requestAnimationFrame = jest.fn(callback => {
+    animationFrameCallback = callback;
+    return 1;
+  });
+
+  global.cancelAnimationFrame = jest.fn();
+
+  // Mock performance.now
+  jest.spyOn(performance, 'now').mockReturnValue(0);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  animationFrameCallback = null;
+});
+
+describe('constructor and initialization', () => {
+  it('should initialize with correct default values', () => {
+    const { renderer } = createRenderer();
+
+    expect(renderer.getZoom()).toBe(0.5);
+    expect(renderer.getOffset()).toBe(0);
+    expect(renderer.getIsUserControlled()).toBe(false);
+  });
+
+  it('should calculate minimum zoom based on container width', () => {
+    const { renderer } = createRenderer();
+
+    // With duration 20000ms and 0.1 pixels per ms, base timeline width is 2000px
+    // Container width is 1000px - 2*LEFT_PADDING
+    // Min zoom should ensure timeline fits in container
+
+    const baseTimelineWidth = 20000 * 0.1; // 2000px
+    const availableWidth = 1000 - 2 * LEFT_PADDING;
+    const expectedMinZoom = Math.max(
+      availableWidth / baseTimelineWidth,
+      0.00001
+    );
+
+    expect(renderer.getZoom()).toBeGreaterThanOrEqual(expectedMinZoom);
+  });
+
+  it('should start the render loop', () => {
+    createRenderer();
+
+    expect(global.requestAnimationFrame).toHaveBeenCalled();
+  });
+});
+
+describe('pan accumulation', () => {
+  it('should set user controlled flag when panning', () => {
+    const { renderer } = createRenderer();
+
+    expect(renderer.getIsUserControlled()).toBe(false);
+
+    renderer.accumulatePan(10);
+
+    expect(renderer.getIsUserControlled()).toBe(true);
+  });
+
+  it('should apply pan smoothly in render loop', () => {
+    const { renderer } = createRenderer();
+
+    renderer.accumulatePan(100);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    // Pan should be applied with easing
+    const newOffset = renderer.getOffset();
+    expect(newOffset).not.toBe(0);
+
+    expect(Math.abs(newOffset)).toBeLessThan(100); // Due to easing factor
+  });
+
+  it('should respect pan bounds', () => {
+    const { renderer } = createRenderer();
+
+    // Try to pan beyond the right boundary
+    renderer.accumulatePan(-20000);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    expect(renderer.getOffset()).toBe(0);
+
+    // Try to pan beyond the left boundary
+    renderer.accumulatePan(20000);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    const timelineWidth = 20000 * 0.1 * renderer.getZoom();
+    const minOffset = Math.min(0, 1000 - timelineWidth - LEFT_PADDING * 2);
+
+    expect(renderer.getOffset()).toBe(minOffset);
+  });
+});
+
+describe('zoom accumulation', () => {
+  it('should accumulate zoom delta', () => {
+    const { renderer } = createRenderer();
+    const initialZoom = renderer.getZoom();
+
+    renderer.accumulateZoom(500, 0.1);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    expect(renderer.getZoom()).not.toBe(initialZoom);
+  });
+
+  it('should respect zoom bounds', () => {
+    const { renderer } = createRenderer();
+
+    // Try to zoom out beyond minimum
+    renderer.accumulateZoom(500, -10);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    expect(renderer.getZoom()).toBeGreaterThanOrEqual(0.00001);
+
+    // Try to zoom in beyond maximum
+    renderer.accumulateZoom(500, 10);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    expect(renderer.getZoom()).toBeLessThanOrEqual(2.5);
+  });
+
+  it('should keep point under mouse fixed when zooming', () => {
+    const { renderer } = createRenderer();
+    const mouseX = 500;
+
+    // Get initial time under mouse
+    const initialTime = renderer.getTimeAtX(mouseX);
+
+    // Zoom in
+    renderer.accumulateZoom(mouseX, 0.5);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    // Time under mouse should remain approximately the same
+    const newTime = renderer.getTimeAtX(mouseX);
+    expect(Math.abs(newTime - initialTime)).toBeLessThan(1);
+  });
+});
+
+describe('getTimeAtX', () => {
+  it('should convert x coordinate to time correctly', () => {
+    const { renderer } = createRenderer();
+
+    // At left padding with no offset
+    const timeAtLeftPadding = renderer.getTimeAtX(LEFT_PADDING);
+
+    expect(timeAtLeftPadding).toBe(0);
+
+    // At middle of timeline (assuming zoom 0.5, timeline width is 1000px)
+    const timelineWidth = 20000 * 0.1 * 0.5; // 1000px
+    const middleX = LEFT_PADDING + timelineWidth / 2;
+    const timeAtMiddle = renderer.getTimeAtX(middleX);
+
+    expect(timeAtMiddle).toBe(10000);
+
+    // At end of timeline
+    const endX = LEFT_PADDING + timelineWidth;
+    const timeAtEnd = renderer.getTimeAtX(endX);
+
+    expect(timeAtEnd).toBe(20000);
+  });
+
+  it('should handle offset correctly', () => {
+    const { renderer } = createRenderer();
+
+    renderer.setOffset(-100);
+
+    const timeAtLeftPadding = renderer.getTimeAtX(LEFT_PADDING);
+
+    // With offset -100, the timeline is shifted left by 100px
+    // So LEFT_PADDING now points to 2 seconds
+    expect(timeAtLeftPadding).toBe(2000);
+  });
+
+  it('should clamp time to 0 minimum', () => {
+    const { renderer } = createRenderer();
+
+    renderer.setOffset(100);
+
+    const timeBeforeStart = renderer.getTimeAtX(0);
+
+    expect(timeBeforeStart).toBe(0);
+  });
+});
+
+describe('setWidth', () => {
+  it('should recalculate minimum zoom when width changes', () => {
+    const { renderer } = createRenderer();
+
+    const initialZoom = renderer.getZoom();
+
+    renderer.setWidth(2000);
+
+    // With wider container, minimum zoom could be different
+    expect(renderer.getZoom()).not.toBe(initialZoom);
+  });
+
+  it('should adjust zoom if below new minimum', () => {
+    const { renderer } = createRenderer();
+
+    // Set a very small zoom
+    renderer.accumulateZoom(500, -10);
+
+    if (animationFrameCallback) {
+      animationFrameCallback(0);
+    }
+
+    const smallZoom = renderer.getZoom();
+
+    renderer.setWidth(200); // change to be narrow
+
+    // Zoom should be adjusted to at least fit the container
+    expect(renderer.getZoom()).toBeGreaterThanOrEqual(smallZoom);
+  });
+});
+
+describe('wheel accumulation cleanup', () => {
+  it('should clean up small pan values', () => {
+    const { renderer } = createRenderer();
+
+    renderer.accumulatePan(0.001);
+
+    // Run multiple render frames to apply easing
+    for (let i = 0; i < 10; i++) {
+      if (animationFrameCallback) {
+        animationFrameCallback(0);
+      }
+    }
+
+    // Small values should be cleaned up
+    expect(renderer.getOffset()).toBeCloseTo(0, 2);
+  });
+
+  it('should clean up small zoom values', () => {
+    const { renderer } = createRenderer();
+    const initialZoom = renderer.getZoom();
+
+    renderer.accumulateZoom(500, 0.0001);
+
+    // Run multiple render frames to apply easing
+    for (let i = 0; i < 10; i++) {
+      if (animationFrameCallback) {
+        animationFrameCallback(0);
+      }
+    }
+
+    // Zoom should remain essentially unchanged
+    expect(Math.abs(renderer.getZoom() - initialZoom)).toBeLessThan(0.01);
+  });
+
+  it('should handle large accumulated pan values', () => {
+    const { renderer } = createRenderer();
+
+    const initialOffset = renderer.getOffset();
+
+    renderer.accumulatePan(50);
+
+    // Simulate time passing
+    jest.spyOn(performance, 'now').mockReturnValue(50);
+
+    for (let i = 0; i < 50; i++) {
+      if (animationFrameCallback) {
+        animationFrameCallback(0);
+      }
+    }
+
+    // Pan should be applied
+    expect(initialOffset - renderer.getOffset()).toBeGreaterThan(0);
+  });
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.ts
new file mode 100644
index 0000000000000..b5cd0282d4a99
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/renderers/TimelineRenderer.ts
@@ -0,0 +1,481 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { DefaultTheme } from 'styled-components';
+
+import type {
+  SessionRecordingMetadata,
+  SessionRecordingThumbnail,
+} from 'teleport/services/recordings';
+
+import { LEFT_PADDING } from '../constants';
+import { EventsRenderer } from './EventsRenderer';
+import { FramesRenderer } from './FramesRenderer';
+import { ProgressLineRenderer } from './ProgressLineRenderer';
+import type {
+  TimelineCanvasRenderer,
+  TimelineRenderContext,
+} from './TimelineCanvasRenderer';
+import { TimeMarkersRenderer } from './TimeMarksRenderer';
+
+interface WheelAccumulation {
+  deltaX: number;
+  zoomDelta: number;
+  zoomX: number;
+  isActive: boolean;
+  lastEventTime: number;
+}
+
+/**
+ * TimelineRenderer is responsible for rendering the entire timeline,
+ * including frames, events, time markers, and the progress line.
+ *
+ * It manages the state of the timeline, including zoom level and offset,
+ * and handles user interactions such as panning and zooming.
+ *
+ * It uses a render loop to efficiently update the canvas only when needed
+ * (instead of continuously), and accumulates wheel events for smooth panning
+ * and zooming (allowing for 60fps+ interactions).
+ */
+export class TimelineRenderer {
+  private animationFrameId: null | number = null;
+  private needsRender = false;
+
+  // whether or not the user is controlling the timeline (panning/zooming), so we can avoid
+  // moving the timeline automatically as the session is playing
+  private isUserControlled = false;
+  private offset = 0;
+
+  private minZoom = 0.1;
+  private maxZoom = 2.5;
+  private zoom = 0.5;
+
+  private readonly backgroundColor: string;
+
+  private readonly eventsRenderer: EventsRenderer;
+  private readonly framesRenderer: FramesRenderer;
+  private readonly progressLineRenderer: ProgressLineRenderer;
+  private readonly timeMarkersRenderer: TimeMarkersRenderer;
+  private readonly renderers: TimelineCanvasRenderer[];
+
+  // Enhanced wheel accumulation matching GraphRenderer
+  private wheelAccumulation: WheelAccumulation = {
+    deltaX: 0,
+    zoomDelta: 0,
+    zoomX: 0,
+    isActive: false,
+    lastEventTime: 0,
+  };
+
+  constructor(
+    private ctx: CanvasRenderingContext2D,
+    private metadata: SessionRecordingMetadata,
+    private frames: SessionRecordingThumbnail[],
+    private theme: DefaultTheme,
+    private containerWidth: number,
+    private containerHeight: number
+  ) {
+    this.backgroundColor =
+      this.theme.colors.sessionRecordingTimeline.background;
+
+    this.progressLineRenderer = new ProgressLineRenderer(
+      this.ctx,
+      this.theme,
+      this.metadata.duration
+    );
+
+    this.eventsRenderer = new EventsRenderer(
+      this.ctx,
+      this.theme,
+      this.metadata
+    );
+
+    this.framesRenderer = new FramesRenderer(
+      this.ctx,
+      this.theme,
+      this.metadata.duration,
+      this.frames,
+      this.containerHeight,
+      this.eventsRenderer.getHeight()
+    );
+
+    this.timeMarkersRenderer = new TimeMarkersRenderer(
+      this.ctx,
+      this.theme,
+      this.metadata
+    );
+
+    this.renderers = [
+      this.framesRenderer,
+      this.timeMarkersRenderer,
+      this.eventsRenderer,
+      this.progressLineRenderer,
+    ];
+
+    this.calculateMinZoom();
+
+    if (this.zoom < this.minZoom) {
+      this.zoom = this.minZoom;
+    }
+
+    this.setRenderersTimelineWidth();
+
+    // load the visible frames first, then render, then load the rest of the frames
+    // when the browser is idle
+    this.framesRenderer
+      .loadVisibleFrames(this.offset, this.containerWidth)
+      .then(() => {
+        this.render();
+
+        requestIdleCallback(() => {
+          void this.framesRenderer.loadNonVisibleFrames();
+        });
+      })
+      .catch((error: unknown) => {
+        if (error instanceof Error) {
+          // eslint-disable-next-line no-console
+          console.error('Failed to load frames:', error.message);
+
+          return;
+        }
+
+        // eslint-disable-next-line no-console
+        console.error('Failed to load frames:', error);
+      });
+
+    this.startRenderLoop();
+  }
+
+  destroy() {
+    if (this.animationFrameId !== null) {
+      cancelAnimationFrame(this.animationFrameId);
+      this.animationFrameId = null;
+    }
+  }
+
+  // accumulatePan accumulates horizontal panning delta from wheel events.
+  // Positive delta pans right, negative delta pans left.
+  // The actual panning is smoothed and applied in the render loop.
+  accumulatePan(delta: number) {
+    this.wheelAccumulation.deltaX += delta;
+    this.wheelAccumulation.isActive = true;
+    this.wheelAccumulation.lastEventTime = performance.now();
+    this.needsRender = true;
+
+    if (!this.isUserControlled) {
+      this.isUserControlled = true;
+    }
+  }
+
+  // accumulateZoom accumulates zoom delta from wheel events.
+  // Positive delta zooms in, negative delta zooms out.
+  // The actual zooming is smoothed and applied in the render loop.
+  accumulateZoom(x: number, delta: number) {
+    this.wheelAccumulation.zoomDelta += delta;
+    this.wheelAccumulation.zoomX = x;
+    this.wheelAccumulation.isActive = true;
+    this.wheelAccumulation.lastEventTime = performance.now();
+    this.needsRender = true;
+  }
+
+  getTimeAtX(x: number) {
+    const absoluteX = x - LEFT_PADDING - this.offset;
+    const timelineWidth = this.calculateTimelineWidth();
+    const timeRatio = absoluteX / timelineWidth;
+
+    // round the zoom time to avoid floating point precision issues
+    // causing the timeline to move around the mouse when zooming in
+    return Math.max(
+      0,
+      Math.round(timeRatio * this.metadata.duration * 10) / 10
+    );
+  }
+
+  getIsUserControlled() {
+    return this.isUserControlled;
+  }
+
+  getOffset() {
+    return this.offset;
+  }
+
+  getZoom() {
+    return this.zoom;
+  }
+
+  // Force recreate all images, useful when the height of the timeline changes
+  recreateImages() {
+    this.framesRenderer.recreateImages(this.render.bind(this));
+  }
+
+  // Recreate only the images that are currently visible in the viewport
+  recreateVisibleImages() {
+    this.framesRenderer.recreateVisibleImages(
+      this.offset,
+      this.containerWidth,
+      this.render.bind(this)
+    );
+  }
+
+  render() {
+    this.needsRender = true;
+  }
+
+  setCurrentTime(currentTime: number) {
+    this.progressLineRenderer.setCurrentTime(currentTime);
+
+    this.render();
+  }
+
+  setShowAbsoluteTime(showAbsoluteTime: boolean) {
+    this.timeMarkersRenderer.setShowAbsoluteTime(showAbsoluteTime);
+
+    this.render();
+  }
+
+  setIsUserControlled(isUserControlled: boolean) {
+    this.isUserControlled = isUserControlled;
+  }
+
+  setHeight(height: number) {
+    // When changing the height, we want to keep the center of the timeline
+    // at the same position in time, so we need to adjust the offset accordingly
+    // This is done by calculating the time ratio of the center position before
+    // the height change, then applying that ratio to the new timeline width
+    // to get the new center position, and finally adjusting the offset to keep
+    // the center position consistent.
+
+    const centerX = this.containerWidth / 2;
+    const oldTimelineWidth = this.calculateTimelineWidth();
+    const absoluteCenterPosition = centerX - this.offset - LEFT_PADDING;
+    const timeRatio = absoluteCenterPosition / oldTimelineWidth;
+
+    this.containerHeight = height;
+
+    this.framesRenderer.setHeight(height, this.eventsRenderer.getHeight());
+
+    this.setRenderersTimelineWidth();
+
+    const newTimelineWidth = this.calculateTimelineWidth();
+    const newAbsoluteCenterPosition = timeRatio * newTimelineWidth;
+    const newOffset = centerX - newAbsoluteCenterPosition - LEFT_PADDING;
+
+    const maxOffset = 0;
+    const minOffset = Math.min(
+      0,
+      this.containerWidth - newTimelineWidth - LEFT_PADDING * 2
+    );
+
+    this.offset = Math.max(minOffset, Math.min(maxOffset, newOffset));
+
+    this.calculateMinZoom();
+    if (this.zoom < this.minZoom) {
+      this.zoom = this.minZoom;
+    }
+
+    this.render();
+  }
+
+  setOffset(offset: number) {
+    this.offset = offset;
+
+    this.render();
+  }
+
+  setWidth(width: number) {
+    this.containerWidth = width;
+
+    this.calculateMinZoom();
+
+    if (this.zoom < this.minZoom) {
+      this.zoom = this.minZoom;
+    }
+
+    this.setRenderersTimelineWidth();
+
+    this.render();
+  }
+
+  private calculateMinZoom() {
+    const baseTimelineWidth = this.getBaseTimelineWidth();
+
+    const availableWidth = this.containerWidth - 2 * LEFT_PADDING;
+
+    this.minZoom = 1;
+
+    if (baseTimelineWidth > 0) {
+      const calculatedMinZoom = availableWidth / baseTimelineWidth;
+
+      this.minZoom = Math.max(calculatedMinZoom, 0.00001);
+    }
+  }
+
+  private getBaseTimelineWidth() {
+    const pixelsPerMs = 0.1;
+
+    return this.metadata.duration * pixelsPerMs;
+  }
+
+  private calculateTimelineWidth() {
+    return this.getBaseTimelineWidth() * this.zoom;
+  }
+
+  private setRenderersTimelineWidth() {
+    const timelineWidth = this.calculateTimelineWidth();
+
+    for (const renderer of this.renderers) {
+      renderer.setTimelineWidth(timelineWidth);
+    }
+  }
+
+  private _render() {
+    this.ctx.fillStyle = this.backgroundColor;
+    this.ctx.fillRect(0, 0, this.containerWidth, this.containerHeight);
+
+    this.ctx.save();
+    this.ctx.translate(this.offset, 0);
+
+    const renderContext: TimelineRenderContext = {
+      containerWidth: this.containerWidth,
+      containerHeight: this.containerHeight,
+      eventsHeight: this.eventsRenderer.getHeight(),
+      offset: this.offset,
+    };
+
+    for (const renderer of this.renderers) {
+      renderer.render(renderContext);
+    }
+
+    this.ctx.restore();
+  }
+
+  private startRenderLoop() {
+    const loop = () => {
+      if (this.wheelAccumulation.isActive) {
+        // Handle wheel event accumulation for smooth panning and zooming
+        this.applyWheelAccumulation();
+      }
+
+      if (this.needsRender) {
+        this._render();
+        this.needsRender = false;
+      }
+
+      this.animationFrameId = requestAnimationFrame(loop);
+    };
+
+    loop();
+  }
+
+  // Apply accumulated wheel events for smooth panning and zooming
+  private applyWheelAccumulation() {
+    const timeSinceLastEvent =
+      performance.now() - this.wheelAccumulation.lastEventTime;
+
+    // Apply accumulated pan
+    if (this.wheelAccumulation.deltaX !== 0) {
+      // Smooth out the pan with an easing factor
+      const easingFactor = 0.4;
+      const appliedDeltaX = this.wheelAccumulation.deltaX * easingFactor;
+
+      // Calculate new offset with bounds checking
+      const filmstripWidth = this.calculateTimelineWidth() + LEFT_PADDING * 2;
+
+      const maxOffset = 0;
+      const minOffset = Math.min(0, this.containerWidth - filmstripWidth);
+      const newOffset = this.offset - appliedDeltaX;
+
+      this.offset = Math.max(minOffset, Math.min(maxOffset, newOffset));
+
+      // Reduce accumulated value
+      this.wheelAccumulation.deltaX -= appliedDeltaX;
+
+      // Clean up small values
+      if (Math.abs(this.wheelAccumulation.deltaX) < 0.01) {
+        this.wheelAccumulation.deltaX = 0;
+      }
+
+      this.needsRender = true;
+    }
+
+    // Apply accumulated zoom
+    if (this.wheelAccumulation.zoomDelta !== 0) {
+      const easingFactor = 0.4;
+      const appliedZoomDelta = this.wheelAccumulation.zoomDelta * easingFactor;
+
+      const oldZoom = this.zoom;
+      const newZoom = Math.max(
+        this.minZoom,
+        Math.min(this.maxZoom, this.zoom * Math.exp(appliedZoomDelta))
+      );
+
+      if (newZoom !== oldZoom) {
+        // Calculate new offset to keep the point under the mouse cursor fixed
+        // when zooming in or out
+        const newTimelineWidth = this.getBaseTimelineWidth() * newZoom;
+        const newFilmstripWidth = newTimelineWidth + LEFT_PADDING * 2;
+
+        if (newFilmstripWidth <= this.containerWidth) {
+          // Timeline fits in container, center it
+          this.offset = 0;
+          this.zoom = newZoom;
+        } else {
+          // Keep the point under the mouse cursor fixed
+
+          const currentTimelineWidth = this.calculateTimelineWidth();
+          const adjustedMouseX = this.wheelAccumulation.zoomX - LEFT_PADDING;
+          const absoluteMousePosition = adjustedMouseX - this.offset;
+          const timeRatio = absoluteMousePosition / currentTimelineWidth;
+          const timeUnderMouse = timeRatio * this.metadata.duration;
+
+          const newAbsolutePosition =
+            (timeUnderMouse / this.metadata.duration) * newTimelineWidth;
+
+          const maxOffset = 0;
+          const minOffset = this.containerWidth - newFilmstripWidth;
+          const newOffset = adjustedMouseX - newAbsolutePosition;
+
+          this.offset = Math.max(minOffset, Math.min(maxOffset, newOffset));
+          this.zoom = newZoom;
+        }
+
+        this.setRenderersTimelineWidth();
+      }
+
+      // Reduce accumulated zoom
+      this.wheelAccumulation.zoomDelta -= appliedZoomDelta;
+
+      if (Math.abs(this.wheelAccumulation.zoomDelta) < 0.001) {
+        this.wheelAccumulation.zoomDelta = 0;
+      }
+
+      this.needsRender = true;
+    }
+
+    // Check if we should stop the wheel animation
+    if (
+      timeSinceLastEvent > 100 &&
+      Math.abs(this.wheelAccumulation.deltaX) < 0.01 &&
+      Math.abs(this.wheelAccumulation.zoomDelta) < 0.001
+    ) {
+      this.wheelAccumulation.isActive = false;
+      this.wheelAccumulation.deltaX = 0;
+      this.wheelAccumulation.zoomDelta = 0;
+    }
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/useCursor.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/useCursor.ts
new file mode 100644
index 0000000000000..da18b6bb15fb0
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/useCursor.ts
@@ -0,0 +1,99 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useRef, type MouseEvent, type RefObject } from 'react';
+
+interface UseCursorOptions {
+  containerRef: RefObject<HTMLElement>;
+  cursorRef: RefObject<HTMLElement>;
+}
+
+const INTERACTION_TIMEOUT = 300;
+
+/**
+ * useCursor is a hook that provides mouse event handlers to manage a custom cursor element within a container.
+ * It tracks whether the user is interacting with the container and updates the cursor's position accordingly.
+ * It returns a ref for accessing the interaction state.
+ */
+export function useCursor({ containerRef, cursorRef }: UseCursorOptions) {
+  const isInteractingRef = useRef(false);
+  const interactionTimeoutRef = useRef<null | number>(null);
+
+  const handleInteractionStart = useCallback(() => {
+    isInteractingRef.current = true;
+
+    if (interactionTimeoutRef.current) {
+      window.clearTimeout(interactionTimeoutRef.current);
+    }
+  }, []);
+
+  const handleInteractionEnd = useCallback(() => {
+    interactionTimeoutRef.current = window.setTimeout(() => {
+      isInteractingRef.current = false;
+    }, INTERACTION_TIMEOUT);
+  }, []);
+
+  const handleMouseEnter = useCallback(
+    (event: MouseEvent) => {
+      if (!cursorRef.current || !containerRef.current) {
+        return;
+      }
+
+      handleInteractionStart();
+
+      const x =
+        event.clientX - containerRef.current.getBoundingClientRect().left;
+
+      cursorRef.current.style.display = 'block';
+      cursorRef.current.style.transform = `translateX(${x}px) translateZ(0)`;
+    },
+    [handleInteractionStart, containerRef, cursorRef]
+  );
+
+  const handleMouseLeave = useCallback(() => {
+    if (!cursorRef.current) {
+      return;
+    }
+
+    handleInteractionEnd();
+
+    cursorRef.current.style.display = 'none';
+  }, [cursorRef, handleInteractionEnd]);
+
+  const handleMouseMove = useCallback(
+    (e: MouseEvent) => {
+      if (!cursorRef.current || !containerRef.current) {
+        return;
+      }
+
+      handleInteractionStart();
+
+      const x = e.clientX - containerRef.current.getBoundingClientRect().left;
+
+      cursorRef.current.style.transform = `translateX(${x}px) translateZ(0)`;
+    },
+    [containerRef, cursorRef, handleInteractionStart]
+  );
+
+  return {
+    handleMouseEnter,
+    handleMouseLeave,
+    handleMouseMove,
+    isInteractingRef,
+  };
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/Timeline/utils.ts b/web/packages/teleport/src/SessionRecordings/view/Timeline/utils.ts
new file mode 100644
index 0000000000000..be6bda541b7b1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/Timeline/utils.ts
@@ -0,0 +1,236 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+import type { SessionRecordingThumbnail } from 'teleport/services/recordings';
+
+import { LEFT_PADDING } from './constants';
+
+const zoomLevelWithCursor = 2;
+const zoomLevelWithoutCursor = 1;
+
+/**
+ * calculateThumbnailViewport calculates the portion of the thumbnail image to display
+ * based on the cursor position and whether the cursor is visible.
+ * It returns the source coordinates and dimensions to be used in drawing the image,
+ * as well as the zoom level applied.
+ */
+export function calculateThumbnailViewport(
+  thumbnail: SessionRecordingThumbnail,
+  width: number,
+  height: number
+) {
+  // Use different zoom levels based on cursor visibility
+  const zoomLevel = thumbnail.cursorVisible
+    ? zoomLevelWithCursor
+    : zoomLevelWithoutCursor;
+
+  const visibleWidthPercent = 100 / zoomLevel;
+  const visibleHeightPercent = 100 / zoomLevel;
+
+  let bgPosX: number;
+  let bgPosY: number;
+
+  if (thumbnail.cursorVisible) {
+    // Calculate cursor position as percentage
+    const cursorPercentX = (thumbnail.cursorX / thumbnail.cols) * 100;
+    const cursorPercentY = (thumbnail.cursorY / thumbnail.rows) * 100;
+
+    // Calculate the top-left position percentage to center on cursor
+    bgPosX = Math.max(
+      0,
+      Math.min(
+        100 - visibleWidthPercent,
+        cursorPercentX - visibleWidthPercent / 2
+      )
+    );
+    bgPosY = Math.max(
+      0,
+      Math.min(
+        100 - visibleHeightPercent,
+        cursorPercentY - visibleHeightPercent / 2
+      )
+    );
+  } else {
+    // Center the viewport when cursor is not visible
+    bgPosX = (100 - visibleWidthPercent) / 2;
+    bgPosY = (100 - visibleHeightPercent) / 2;
+  }
+
+  // Calculate source dimensions
+  const sourceWidth = width / zoomLevel;
+  const sourceHeight = height / zoomLevel;
+
+  // Convert percentages to pixel coordinates on the source image
+  const maxSourceX = width - sourceWidth;
+  const maxSourceY = height - sourceHeight;
+
+  const sourceX = (bgPosX / (100 - visibleWidthPercent)) * maxSourceX || 0;
+  const sourceY = (bgPosY / (100 - visibleHeightPercent)) * maxSourceY || 0;
+
+  return {
+    sourceX,
+    sourceY,
+    sourceWidth,
+    sourceHeight,
+    zoomLevel,
+  };
+}
+
+// Edge threshold in pixels to determine when the time indicator is near the edge
+// of the container and should trigger auto-scrolling behavior.
+const EDGE_THRESHOLD = 100;
+// Visibility buffer in pixels to determine when the time indicator is considered
+// fully visible within the container.
+const VISIBILITY_BUFFER = 50;
+
+/**
+ * calculateNextUserControlled determines whether the user is currently controlling
+ * the timeline's scroll position based on the position of the time indicator,
+ * the container width, and whether the user is actively interacting with the timeline.
+ *
+ * It returns a boolean indicating if the user is in control of the scroll position.
+ *
+ * @param relativePosition - The current position of the time indicator relative to the container.
+ * @param containerWidth - The width of the timeline container.
+ * @param isInteracting - Whether the user is currently interacting with the timeline (e.g., dragging).
+ * @param currentUserControlled - The current state of user control over the timeline.
+ * @returns boolean - True if the user is controlling the timeline, false otherwise.
+ */
+export function calculateNextUserControlled(
+  relativePosition: number,
+  containerWidth: number,
+  isInteracting: boolean,
+  currentUserControlled: boolean
+) {
+  if (isInteracting) {
+    return currentUserControlled;
+  }
+
+  const isIndicatorFullyVisible =
+    relativePosition >= VISIBILITY_BUFFER &&
+    relativePosition <= containerWidth - VISIBILITY_BUFFER;
+
+  const isIndicatorPartiallyVisible =
+    relativePosition >= -EDGE_THRESHOLD &&
+    relativePosition <= containerWidth + EDGE_THRESHOLD;
+
+  const isApproachingRightEdge =
+    relativePosition > containerWidth - EDGE_THRESHOLD &&
+    relativePosition <= containerWidth;
+
+  const isApproachingLeftEdge =
+    relativePosition < EDGE_THRESHOLD && relativePosition >= 0;
+
+  // User manually scrolled away from the progress line
+  if (!isIndicatorPartiallyVisible) {
+    return true;
+  }
+
+  // Progress line is fully visible, user control can be disabled
+  if (isIndicatorFullyVisible) {
+    return false;
+  }
+
+  // If user was controlling and line is approaching edge, give back control to auto-scroll
+  if (
+    currentUserControlled &&
+    (isApproachingRightEdge || isApproachingLeftEdge)
+  ) {
+    return false;
+  }
+
+  return currentUserControlled;
+}
+
+/**
+ * shouldAutoScroll determines whether the timeline should auto-scroll
+ * based on the position of the time indicator, the container width,
+ * and whether the user is interacting with the timeline or has manual control.
+ *
+ * @param relativePosition - The current position of the time indicator relative to the container.
+ * @param containerWidth - The width of the timeline container.
+ * @param isInteracting - Whether the user is currently interacting with the timeline (e.g., dragging).
+ * @param isUserControlled - Whether the user has manual control over the timeline's scroll position.
+ */
+export function shouldAutoScroll(
+  relativePosition: number,
+  containerWidth: number,
+  isInteracting: boolean,
+  isUserControlled: boolean
+) {
+  if (isInteracting || isUserControlled) {
+    return false;
+  }
+
+  const shouldJumpForward = relativePosition > containerWidth - EDGE_THRESHOLD;
+  const shouldJumpBackward = relativePosition < 0;
+
+  return shouldJumpForward || shouldJumpBackward;
+}
+
+/**
+ * calculateAutoScrollOffset computes the new offset needed to auto-scroll the timeline
+ * to keep the time indicator within the visible area of the container.
+ * It takes into account the current position of the time indicator,
+ * the container width, the total timeline width, and whether to force the scroll.
+ *
+ * @param timePosition - The current position of the time indicator in pixels.
+ * @param relativePosition - The position of the time indicator relative to the container.
+ * @param containerWidth - The width of the timeline container in pixels.
+ * @param timelineWidth - The total width of the timeline in pixels.
+ * @param force - Whether to force the scroll regardless of the current position.
+ *
+ * @returns number - The new offset to apply to the timeline for auto-scrolling.
+ */
+export function calculateAutoScrollOffset(
+  timePosition: number,
+  relativePosition: number,
+  containerWidth: number,
+  timelineWidth: number,
+  force?: boolean
+) {
+  const totalWidth = timelineWidth + LEFT_PADDING;
+  const maxOffset = 0;
+  const minOffset = Math.min(0, containerWidth - totalWidth);
+
+  if (force) {
+    const targetRelativePosition = LEFT_PADDING + VISIBILITY_BUFFER;
+    const newOffset = targetRelativePosition - timePosition;
+
+    return Math.max(minOffset, Math.min(maxOffset, newOffset));
+  }
+
+  if (relativePosition > containerWidth - EDGE_THRESHOLD) {
+    const targetRelativePosition = LEFT_PADDING + VISIBILITY_BUFFER;
+    const newOffset = targetRelativePosition - timePosition;
+
+    if (newOffset < minOffset) {
+      return minOffset;
+    }
+
+    return Math.max(minOffset, Math.min(maxOffset, newOffset));
+  }
+
+  if (relativePosition < 0) {
+    const targetRelativePosition = containerWidth - VISIBILITY_BUFFER;
+    const newOffset = targetRelativePosition - timePosition;
+
+    return Math.max(minOffset, Math.min(maxOffset, newOffset));
+  }
+
+  return 0;
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.story.tsx b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.story.tsx
new file mode 100644
index 0000000000000..02e1033bfbacc
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.story.tsx
@@ -0,0 +1,86 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { Meta, StoryObj } from '@storybook/react-vite';
+import { MemoryRouter } from 'react-router';
+import { Route } from 'react-router-dom';
+import { mocked } from 'storybook/test';
+
+import Box from 'design/Box';
+
+import cfg from 'teleport/config';
+import { ContextProvider } from 'teleport/index';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { fetchSessionRecordingMetadata } from 'teleport/services/recordings/metadata';
+import { MOCK_THUMBNAILS } from 'teleport/SessionRecordings/list/mock';
+import { MOCK_METADATA } from 'teleport/SessionRecordings/view/mock';
+import { ViewSessionRecordingRoute } from 'teleport/SessionRecordings/view/ViewSessionRecordingRoute';
+
+const meta = {
+  title: 'Teleport/SessionRecordings',
+} satisfies Meta<typeof ViewSessionRecordingRoute>;
+
+export default meta;
+
+export const ViewWithMetadata: StoryObj = {
+  name: 'View with metadata',
+  beforeEach: async () => {
+    mocked(fetchSessionRecordingMetadata).mockReturnValue(
+      Promise.resolve({ metadata: MOCK_METADATA, frames: MOCK_THUMBNAILS })
+    );
+  },
+  parameters: {
+    layout: 'fullscreen',
+  },
+  render: () =>
+    render(
+      '/web/cluster/teleport/session/session-id?recordingType=ssh&durationMs=20000'
+    ),
+};
+
+export const ViewWithoutMetadata: StoryObj = {
+  name: 'View without metadata (fallback to player)',
+  beforeEach: async () => {
+    mocked(fetchSessionRecordingMetadata).mockReturnValue(
+      Promise.reject(new Error('Failed to fetch metadata'))
+    );
+  },
+  parameters: {
+    layout: 'fullscreen',
+  },
+  render: () =>
+    render(
+      '/web/cluster/teleport/session/session-id?recordingType=ssh&durationMs=20000'
+    ),
+};
+
+function render(initialEntry: string) {
+  const ctx = createTeleportContext();
+
+  return (
+    <MemoryRouter initialEntries={[initialEntry]}>
+      <Route path={cfg.routes.player}>
+        <ContextProvider ctx={ctx}>
+          <Box height="100vh">
+            <ViewSessionRecordingRoute />
+          </Box>
+        </ContextProvider>
+      </Route>
+    </MemoryRouter>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.test.tsx b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.test.tsx
new file mode 100644
index 0000000000000..8871049b5af77
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.test.tsx
@@ -0,0 +1,300 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { screen } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+import { MemoryRouter, Route } from 'react-router-dom';
+
+import { render, testQueryClient } from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport';
+import cfg from 'teleport/config';
+import { MockAuthenticatedWebSocket } from 'teleport/lib/AuthenticatedWebSocket.mock';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import {
+  type RecordingType,
+  type SessionRecordingMetadata,
+} from 'teleport/services/recordings';
+
+import { createMetadataHandler } from './mock';
+import { ViewSessionRecordingRoute } from './ViewSessionRecordingRoute';
+
+jest.spyOn(cfg, 'getSessionRecordingMetadataUrl').mockImplementation(() => {
+  return 'ws://localhost/v1/webapi/sites/:clusterId/sessionrecording/:sessionId/metadata/ws';
+});
+
+jest.mock('teleport/lib/AuthenticatedWebSocket', () => ({
+  AuthenticatedWebSocket: MockAuthenticatedWebSocket,
+}));
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(() => {
+  server.resetHandlers();
+  testQueryClient.clear();
+  jest.clearAllMocks();
+});
+
+afterAll(() => {
+  server.close();
+});
+
+const mockMetadata: SessionRecordingMetadata = {
+  startTime: 1609459200, // Jan 1, 2021
+  endTime: 1609462800, // Jan 1, 2021
+  duration: 3600000, // 1 hour in milliseconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
+
+// mock the RecordingPlayer component
+jest.mock('./RecordingPlayer', () => ({
+  RecordingPlayer: ({ clusterId, sessionId, durationMs, recordingType }) => (
+    <div data-testid="recording-player">
+      RecordingPlayer: {clusterId}/{sessionId}/{durationMs}/{recordingType}
+    </div>
+  ),
+}));
+
+function setupTest(initialEntry?: string) {
+  const ctx = createTeleportContext();
+
+  return render(
+    <MemoryRouter initialEntries={initialEntry ? [initialEntry] : undefined}>
+      <ContextProvider ctx={ctx}>
+        <Route path={cfg.routes.player}>
+          <ViewSessionRecordingRoute />
+        </Route>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
+
+function withSessionDuration(durationMs: number, recordingType: RecordingType) {
+  server.use(
+    http.get(cfg.api.sessionDurationPath, () =>
+      HttpResponse.json({
+        durationMs,
+        recordingType,
+      })
+    )
+  );
+}
+
+test('renders metadata correctly if recordingType is in the URL', async () => {
+  server.use(createMetadataHandler(mockMetadata, []));
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'ssh',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(await screen.findByText('test-server')).toBeInTheDocument();
+});
+
+test('renders the duration correctly', async () => {
+  server.use(createMetadataHandler(mockMetadata, []));
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'ssh',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(await screen.findByText('1h')).toBeInTheDocument();
+});
+
+test('renders non-SSH recordings correctly', async () => {
+  server.use(createMetadataHandler({ ...mockMetadata, type: 'desktop' }, []));
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'desktop',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(
+    await screen.findByText(
+      'RecordingPlayer: test-cluster/test-session/3600000/desktop'
+    )
+  ).toBeInTheDocument();
+});
+
+test('displays the username', async () => {
+  server.use(createMetadataHandler(mockMetadata, []));
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'ssh',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(await screen.findByText('testuser')).toBeInTheDocument();
+});
+
+test('shows the start/end time', async () => {
+  server.use(createMetadataHandler(mockMetadata, []));
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'ssh',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(await screen.findByText('Jan 01, 2021 00:00')).toBeInTheDocument();
+  expect(await screen.findByText('Jan 01, 2021 01:00')).toBeInTheDocument();
+});
+
+test('falls back to loading the duration if metadata is not available and no URL params', async () => {
+  server.use(
+    createMetadataHandler(mockMetadata, [], {
+      shouldError: true,
+      errorMessage: 'Metadata not available',
+    })
+  );
+
+  withSessionDuration(3600000, 'ssh');
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: undefined,
+        durationMs: undefined,
+      }
+    )
+  );
+
+  expect(await screen.findByTestId('recording-player')).toBeInTheDocument();
+});
+
+test('falls back to the session player if metadata is not available', async () => {
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+
+  server.use(
+    createMetadataHandler(mockMetadata, [], {
+      shouldError: true,
+      errorMessage: 'Metadata not available',
+    })
+  );
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: 'ssh',
+        durationMs: 3600000,
+      }
+    )
+  );
+
+  expect(await screen.findByTestId('recording-player')).toBeInTheDocument();
+});
+
+test('shows error if metadata and duration are not available', async () => {
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+
+  server.use(
+    createMetadataHandler(mockMetadata, [], {
+      shouldError: true,
+      errorMessage: 'Metadata not available',
+    }),
+    http.get(cfg.api.sessionDurationPath, () =>
+      HttpResponse.json(
+        {
+          durationMs: null,
+          recordingType: null,
+        },
+        {
+          status: 404,
+        }
+      )
+    )
+  );
+
+  setupTest(
+    cfg.getPlayerRoute(
+      {
+        clusterId: 'test-cluster',
+        sid: 'test-session',
+      },
+      {
+        recordingType: undefined,
+        durationMs: undefined,
+      }
+    )
+  );
+
+  expect(
+    await screen.findByText('Unable to determine the length of this session', {
+      exact: false,
+    })
+  ).toBeInTheDocument();
+});
diff --git a/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.tsx b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.tsx
new file mode 100644
index 0000000000000..f583e655104bc
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/ViewSessionRecordingRoute.tsx
@@ -0,0 +1,177 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Suspense, useEffect } from 'react';
+import { ErrorBoundary } from 'react-error-boundary';
+
+import { Danger } from 'design/Alert';
+import Box from 'design/Box';
+import Flex from 'design/Flex';
+import { Indicator } from 'design/Indicator';
+import { ErrorSuspenseWrapper } from 'shared/components/ErrorSuspenseWrapper/ErrorSuspenseWrapper';
+
+import { useLocation, useParams } from 'teleport/components/Router';
+import { UrlPlayerParams } from 'teleport/config';
+import { getUrlParameter } from 'teleport/services/history';
+import { RecordingType } from 'teleport/services/recordings';
+import { useSuspenseGetRecordingDuration } from 'teleport/services/recordings/hooks';
+import {
+  RECORDING_TYPES_WITH_METADATA,
+  VALID_RECORDING_TYPES,
+} from 'teleport/services/recordings/recordings';
+
+import { RecordingPlayer } from './RecordingPlayer';
+import {
+  RecordingWithMetadata,
+  type SummarySlot,
+} from './RecordingWithMetadata';
+import { RecordingWithSummary } from './RecordingWithSummary';
+
+interface ViewSessionRecordingRouteProps {
+  summarySlot?: SummarySlot;
+}
+
+export function ViewSessionRecordingRoute({
+  summarySlot,
+}: ViewSessionRecordingRouteProps) {
+  const { sid, clusterId } = useParams<UrlPlayerParams>();
+  const { search } = useLocation();
+
+  const recordingType = getUrlParameter(
+    'recordingType',
+    search
+  ) as RecordingType;
+
+  useEffect(() => {
+    document.title = `Play ${sid} • ${clusterId}`;
+  }, [sid, clusterId]);
+
+  const validRecordingType = VALID_RECORDING_TYPES.includes(recordingType);
+  const durationMs = Number(getUrlParameter('durationMs', search));
+  const validDuration = Number.isInteger(durationMs) && durationMs > 0;
+
+  const shouldFetchSessionDuration = !validRecordingType || !validDuration;
+
+  let player = (
+    <RecordingPlayer
+      clusterId={clusterId}
+      sessionId={sid}
+      durationMs={durationMs}
+      recordingType={recordingType}
+    />
+  );
+
+  if (shouldFetchSessionDuration) {
+    player = (
+      <ErrorSuspenseWrapper
+        errorComponent={RecordingPlayerError}
+        loadingComponent={RecordingPlayerLoading}
+      >
+        <RecordingPlayerWithLoadDuration
+          clusterId={clusterId}
+          sessionId={sid}
+        />
+      </ErrorSuspenseWrapper>
+    );
+  }
+
+  if (RECORDING_TYPES_WITH_METADATA.includes(recordingType)) {
+    // If the recording type is SSH, try to load the session metadata (ViewTerminalRecording)
+    // and render the SSH player with the session metadata/summary.
+    // If that errors (such as during a proxy upgrade), we fall back to the
+    // RecordingPlayerWrapper which will fetch the session duration and render the player.
+    // This is to ensure that the player can still be rendered even if the session metadata
+    // cannot be fetched, allowing users to still view the recording.
+
+    return (
+      <Suspense fallback={<RecordingPlayerLoading />}>
+        <ErrorBoundary fallback={player}>
+          <RecordingWithMetadata
+            clusterId={clusterId}
+            sessionId={sid}
+            summarySlot={summarySlot}
+          />
+        </ErrorBoundary>
+      </Suspense>
+    );
+  }
+
+  if (summarySlot) {
+    return (
+      <RecordingWithSummary
+        clusterId={clusterId}
+        sessionId={sid}
+        durationMs={durationMs}
+        recordingType={recordingType}
+        summarySlot={summarySlot}
+      />
+    );
+  }
+
+  return player;
+}
+
+export function RecordingPlayerLoading() {
+  return (
+    <Flex width="100%" height="100%" flexDirection="column">
+      <Box textAlign="center" mx={10} mt={5}>
+        <Indicator />
+      </Box>
+    </Flex>
+  );
+}
+
+export function RecordingPlayerError() {
+  return (
+    <Flex width="100%" height="100%" flexDirection="column">
+      <Box textAlign="center" mx={10} mt={5}>
+        <Danger mb={0}>
+          Unable to determine the length of this session. The session recording
+          may be incomplete or corrupted.
+        </Danger>
+      </Box>
+    </Flex>
+  );
+}
+
+interface RecordingPlayerWithLoadDurationProps {
+  clusterId: string;
+  sessionId: string;
+  onToggleSidebar?: () => void;
+}
+
+export function RecordingPlayerWithLoadDuration({
+  clusterId,
+  sessionId,
+  onToggleSidebar,
+}: RecordingPlayerWithLoadDurationProps) {
+  const { data } = useSuspenseGetRecordingDuration({
+    clusterId,
+    sessionId,
+  });
+
+  return (
+    <RecordingPlayer
+      clusterId={clusterId}
+      sessionId={sessionId}
+      durationMs={data.durationMs}
+      recordingType={data.recordingType}
+      onToggleSidebar={onToggleSidebar}
+    />
+  );
+}
diff --git a/web/packages/teleport/src/Player/Xterm/Xterm.tsx b/web/packages/teleport/src/SessionRecordings/view/Xterm/Xterm.tsx
similarity index 87%
rename from web/packages/teleport/src/Player/Xterm/Xterm.tsx
rename to web/packages/teleport/src/SessionRecordings/view/Xterm/Xterm.tsx
index 911f250fff677..7dc256c5870d3 100644
--- a/web/packages/teleport/src/Player/Xterm/Xterm.tsx
+++ b/web/packages/teleport/src/SessionRecordings/view/Xterm/Xterm.tsx
@@ -27,6 +27,10 @@ import { TermEvent } from 'teleport/lib/term/enums';
 import Terminal from 'teleport/lib/term/terminal';
 import Tty from 'teleport/lib/term/tty';
 
+// These keys are used for keyboard shortcuts in the session timeline,
+// so we need to make sure that xterm.js doesn't trap the keyboard events.
+const doNotBlockKeys = ['?', 't', 'h', 's', 'Escape'];
+
 export default function Xterm({ tty }: { tty: Tty }) {
   const refContainer = useRef<HTMLDivElement>(null);
   const theme = useTheme();
@@ -46,6 +50,10 @@ export default function Xterm({ tty }: { tty: Tty }) {
   }, []);
 
   useEffect(() => {
+    if (!refContainer.current) {
+      return;
+    }
+
     const term = new TerminalPlayer(tty, {
       el: refContainer.current,
       fontFamily: theme.fonts.mono,
@@ -57,6 +65,10 @@ export default function Xterm({ tty }: { tty: Tty }) {
     term.open();
     term.term.focus();
 
+    term.registerCustomKeyEventHandler(
+      (e: KeyboardEvent) => !doNotBlockKeys.includes(e.key)
+    );
+
     term.tty.on(TermEvent.DATA, () => {
       // Keeps the cursor in view.
       term.term.textarea.scrollIntoView(false);
@@ -66,13 +78,15 @@ export default function Xterm({ tty }: { tty: Tty }) {
       e.stopPropagation();
     }
 
+    const container = refContainer.current;
+
     // Stop wheel event from reaching the terminal
     // to allow parent container of xterm to scroll instead.
-    window.addEventListener('wheel', stopPropagating, true);
+    container.addEventListener('wheel', stopPropagating, { passive: true });
 
     function cleanup() {
       term.destroy();
-      window.removeEventListener('wheel', stopPropagating, true);
+      container.removeEventListener('wheel', stopPropagating);
     }
 
     return cleanup;
diff --git a/web/packages/teleport/src/Player/Xterm/index.ts b/web/packages/teleport/src/SessionRecordings/view/Xterm/index.ts
similarity index 100%
rename from web/packages/teleport/src/Player/Xterm/index.ts
rename to web/packages/teleport/src/SessionRecordings/view/Xterm/index.ts
diff --git a/web/packages/teleport/src/SessionRecordings/view/mock.ts b/web/packages/teleport/src/SessionRecordings/view/mock.ts
new file mode 100644
index 0000000000000..866b0c5670844
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/mock.ts
@@ -0,0 +1,86 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ws } from 'msw';
+
+import {
+  SessionRecordingMessageType,
+  type SessionRecordingMessage,
+  type SessionRecordingMetadata,
+  type SessionRecordingThumbnail,
+} from 'teleport/services/recordings';
+
+interface MetadataHandlerOptions {
+  shouldError?: boolean;
+  errorMessage?: string;
+}
+
+export function createMetadataHandler(
+  metadata: SessionRecordingMetadata,
+  frames: SessionRecordingThumbnail[],
+  options?: MetadataHandlerOptions
+) {
+  return ws
+    .link(
+      'ws://localhost/v1/webapi/sites/:clusterId/sessionrecording/:sessionId/metadata/ws'
+    )
+    .addEventListener('connection', ({ client }) => {
+      function sendMessage(message: SessionRecordingMessage) {
+        client.send(JSON.stringify(message));
+      }
+
+      // Send messages immediately after connection
+      if (options?.shouldError) {
+        sendMessage({
+          type: SessionRecordingMessageType.Error,
+          data: { message: options?.errorMessage },
+        });
+        client.close();
+        return;
+      }
+
+      sendMessage({
+        type: SessionRecordingMessageType.Metadata,
+        data: metadata,
+      });
+
+      for (const frame of frames) {
+        sendMessage({
+          type: SessionRecordingMessageType.Thumbnail,
+          data: frame,
+        });
+      }
+
+      setTimeout(() => {
+        client.close();
+      }, 100);
+    });
+}
+
+export const MOCK_METADATA: SessionRecordingMetadata = {
+  startTime: 1609459200, // Jan 1, 2021
+  endTime: 1609462800, // Jan 1, 2021
+  duration: 3600000, // 1 hour in milliseconds
+  user: 'testuser',
+  resourceName: 'test-server',
+  clusterName: 'test-cluster',
+  events: [],
+  startCols: 80,
+  startRows: 24,
+  type: 'ssh',
+};
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/Player.ts b/web/packages/teleport/src/SessionRecordings/view/player/Player.ts
new file mode 100644
index 0000000000000..15325f1c3adcb
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/Player.ts
@@ -0,0 +1,64 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { BaseEvent } from '../stream/types';
+
+export abstract class Player<
+  TEvent extends BaseEvent<TEventType>,
+  TEventType extends number = number,
+> {
+  abstract init(element: HTMLElement): void;
+  abstract destroy(): void;
+
+  /**
+   * clear is called to clear the current state of the player. This is called when seeking to a time before the
+   * current time, to reset the state of the player before receiving the state of the screen.
+   */
+  abstract clear(): void;
+
+  /**
+   * applyEvent is called to apply a single event to the player, at the correct moment in time.
+   * This is typically used for events that change the state of the player, such as print or resize.
+   *
+   * @param event The event to apply.
+   *
+   * @returns void
+   */
+  abstract applyEvent(event: TEvent): void;
+
+  /**
+   * handleEvent is called to handle an event that needs to be handled as soon as it is received from
+   * the stream, regardless of the current playback time. Typically this would be for receiving the
+   * full state of the screen.
+   *
+   * @param event The event to handle.
+   *
+   * @returns true if the event was handled (and therefore should not be added to the stream buffer), false otherwise.
+   */
+  abstract handleEvent(event: TEvent): boolean;
+
+  // fit is called to resize the player to fit its container. This is typically player specific.
+  fit(): void {}
+
+  // Event hooks for subclasses to optionally implement.
+  onPlay(): void {}
+  onPause(): void {}
+  // eslint-disable-next-line unused-imports/no-unused-vars
+  onSeek(time: number): void {}
+  onStop(): void {}
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/PlayerControls.tsx b/web/packages/teleport/src/SessionRecordings/view/player/PlayerControls.tsx
new file mode 100644
index 0000000000000..1d02360b654dd
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/PlayerControls.tsx
@@ -0,0 +1,374 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useImperativeHandle,
+  useRef,
+  type MouseEvent,
+  type RefObject,
+} from 'react';
+import styled from 'styled-components';
+
+import Box from 'design/Box';
+import Flex from 'design/Flex';
+import {
+  CirclePause,
+  CirclePlay,
+  CornersIn,
+  CornersOut,
+  FilmStrip,
+  Layout,
+  Refresh,
+} from 'design/Icon';
+import { Indicator } from 'design/Indicator';
+import { HoverTooltip } from 'design/Tooltip';
+
+import { PlayerState } from 'teleport/SessionRecordings/view/stream/SessionStream';
+
+import { PlayerSpeed } from './PlayerSpeed';
+
+export interface PlayerControlsHandle {
+  setTime: (time: number) => void;
+}
+
+interface PlayerControlsProps {
+  duration: number;
+  onPlay: () => void;
+  onPause: () => void;
+  onSeek: (time: number) => void;
+  speed: number;
+  onSpeedChange: (speed: number) => void;
+  state: PlayerState;
+  ref: RefObject<PlayerControlsHandle>;
+  onToggleFullscreen?: () => void;
+  fullscreen?: boolean;
+  onToggleTimeline?: () => void;
+  onToggleSidebar?: () => void;
+}
+
+export const CONTROLS_HEIGHT = 42;
+
+export function PlayerControls({
+  duration,
+  onPlay,
+  onPause,
+  onSeek,
+  speed,
+  onSpeedChange,
+  fullscreen,
+  onToggleFullscreen,
+  onToggleTimeline,
+  onToggleSidebar,
+  state,
+  ref,
+}: PlayerControlsProps) {
+  const buttonDisabled = state === PlayerState.Loading;
+
+  const containerRef = useRef<HTMLDivElement>(null);
+  const durationRef = useRef<HTMLDivElement>(null);
+  const progressBarRef = useRef<HTMLDivElement>(null);
+  const progressBarContainerRef = useRef<HTMLDivElement>(null);
+  const seekingRef = useRef<HTMLDivElement>(null);
+
+  const setTime = useCallback(
+    (time: number) => {
+      if (
+        !durationRef.current ||
+        !progressBarRef.current ||
+        !progressBarContainerRef.current
+      ) {
+        return;
+      }
+
+      const containerWidth = progressBarContainerRef.current.clientWidth;
+      const progressBarWidth = (time / duration) * containerWidth;
+
+      progressBarRef.current.style.width = `${Math.min(progressBarWidth, containerWidth)}px`;
+
+      durationRef.current.textContent = formatDuration(time);
+    },
+    [duration]
+  );
+
+  useImperativeHandle(ref, () => ({
+    setTime,
+  }));
+
+  const handleProgressBarClick = useCallback(
+    (e: MouseEvent<HTMLDivElement>) => {
+      if (!progressBarContainerRef.current || !onSeek) {
+        return;
+      }
+
+      const containerRect =
+        progressBarContainerRef.current.getBoundingClientRect();
+      const relativeX = e.clientX - containerRect.left;
+      const percentage = Math.min(
+        Math.max(relativeX / containerRect.width, 0),
+        1
+      );
+      const time = percentage * duration;
+
+      onSeek(Math.floor(time));
+    },
+    [duration, onSeek]
+  );
+
+  const handleProgressBarMouseMove = useCallback(
+    (e: MouseEvent<HTMLDivElement>) => {
+      if (!progressBarContainerRef.current || !seekingRef.current) {
+        return;
+      }
+
+      const progressBarContainerRect =
+        progressBarContainerRef.current.getBoundingClientRect();
+      const relativeX = e.clientX - progressBarContainerRect.left;
+      const percentage = Math.min(
+        Math.max(relativeX / progressBarContainerRect.width, 0),
+        1
+      );
+      const time = percentage * duration;
+
+      seekingRef.current.style.width = `${relativeX}px`;
+      seekingRef.current.style.opacity = '1';
+      seekingRef.current.textContent = formatDuration(time);
+    },
+    [duration]
+  );
+
+  const handleProgressBarMouseLeave = useCallback(() => {
+    if (!seekingRef.current) {
+      return;
+    }
+
+    seekingRef.current.style.opacity = '0';
+  }, []);
+
+  const handlePlayerButtonClick = useCallback(() => {
+    if (state === PlayerState.Playing) {
+      onPause();
+    } else if (state === PlayerState.Paused) {
+      onPlay();
+    } else if (state === PlayerState.Stopped) {
+      onSeek(0);
+      onPlay();
+    }
+  }, [state, onPause, onPlay, onSeek]);
+
+  return (
+    <Flex
+      alignItems="center"
+      bg="levels.surface"
+      borderTop="1px solid"
+      borderColor="spotBackground.0"
+      height={CONTROLS_HEIGHT}
+      px={2}
+      flexShrink={0}
+      ref={containerRef}
+    >
+      {onToggleSidebar && (
+        <HoverTooltip
+          tipContent="Toggle Sidebar"
+          portalRoot={containerRef.current}
+        >
+          <PlayerButton onClick={onToggleSidebar}>
+            <Layout size="small" />
+          </PlayerButton>
+        </HoverTooltip>
+      )}
+
+      <PlayButton
+        disabled={buttonDisabled}
+        onClick={handlePlayerButtonClick}
+        state={state}
+        containerRef={containerRef}
+      />
+
+      <Box
+        fontFamily="mono"
+        fontSize="small"
+        pl={2}
+        pr={4}
+        ref={durationRef}
+        width="70px"
+      >
+        0:00
+      </Box>
+
+      <ProgressBarArea
+        onClick={handleProgressBarClick}
+        onMouseLeave={handleProgressBarMouseLeave}
+        onMouseMove={handleProgressBarMouseMove}
+      >
+        <ProgressBarContainer ref={progressBarContainerRef}>
+          <SeekingBar ref={seekingRef} />
+          <ProgressBar ref={progressBarRef} />
+        </ProgressBarContainer>
+      </ProgressBarArea>
+
+      <PlayerSpeed
+        speed={speed}
+        onSpeedChange={onSpeedChange}
+        portalRoot={containerRef.current}
+      />
+
+      {onToggleTimeline && (
+        <HoverTooltip
+          tipContent="Toggle Timeline"
+          portalRoot={containerRef.current}
+        >
+          <PlayerButton onClick={onToggleTimeline}>
+            <FilmStrip size="small" />
+          </PlayerButton>
+        </HoverTooltip>
+      )}
+
+      {onToggleFullscreen && (
+        <HoverTooltip
+          tipContent={fullscreen ? 'Exit Full Screen' : 'Full Screen'}
+          portalRoot={containerRef.current}
+        >
+          <PlayerButton onClick={onToggleFullscreen}>
+            {fullscreen ? (
+              <CornersIn size="small" />
+            ) : (
+              <CornersOut size="small" />
+            )}
+          </PlayerButton>
+        </HoverTooltip>
+      )}
+    </Flex>
+  );
+}
+
+interface PlayButtonProps {
+  disabled: boolean;
+  onClick: () => void;
+  state: PlayerState;
+  containerRef: RefObject<HTMLDivElement>;
+}
+
+function PlayButton({
+  disabled,
+  onClick,
+  state,
+  containerRef,
+}: PlayButtonProps) {
+  const { icon: Icon, text } = getIconAndText(state);
+
+  return (
+    <HoverTooltip tipContent={text} portalRoot={containerRef.current}>
+      <PlayerButton disabled={disabled} onClick={onClick}>
+        <Icon size="small" color="text.main" />
+      </PlayerButton>
+    </HoverTooltip>
+  );
+}
+
+const AdjustedIndicator = styled(Indicator)`
+  position: relative;
+  top: 1px; // the indicator is just so slightly off center vertically with the rest of the icons
+`;
+
+function getIconAndText(state: PlayerState) {
+  switch (state) {
+    case PlayerState.Playing:
+      return { icon: CirclePause, text: 'Pause' };
+    case PlayerState.Paused:
+      return { icon: CirclePlay, text: 'Play' };
+    case PlayerState.Stopped:
+      return { icon: Refresh, text: 'Replay' };
+    case PlayerState.Loading:
+      return { icon: AdjustedIndicator };
+  }
+}
+
+const SeekingBar = styled.div`
+  background: ${p =>
+    p.theme.colors.sessionRecording.player.progressBar.seeking};
+  height: 6px;
+  left: 0;
+  position: absolute;
+  top: 0;
+  width: 0;
+  z-index: 3;
+`;
+
+const ProgressBar = styled.div`
+  background: ${p =>
+    p.theme.colors.sessionRecording.player.progressBar.progress};
+  height: 6px;
+  left: 0;
+  position: absolute;
+  top: 0;
+  width: 0;
+  z-index: 3;
+`;
+
+const ProgressBarArea = styled.div`
+  height: 100%;
+  flex: 1;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  margin-right: ${p => p.theme.space[3]}px;
+`;
+
+const ProgressBarContainer = styled.div`
+  background: ${p =>
+    p.theme.colors.sessionRecording.player.progressBar.background};
+  border-radius: 3px;
+  height: 6px;
+  overflow: hidden;
+  position: relative;
+  width: 100%;
+`;
+
+const PlayerButton = styled.button<{ disabled?: boolean }>`
+  background: transparent;
+  border: none;
+  color: ${p => p.theme.colors.text.main};
+  width: ${p => p.theme.space[5]}px;
+  height: ${p => p.theme.space[5]}px;
+  border-radius: ${p => p.theme.radii[3]}px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  pointer-events: ${p => (p.disabled ? 'none' : 'auto')};
+
+  &:hover {
+    background-color: ${p =>
+      p.disabled ? 'none' : p.theme.colors.spotBackground[1]};
+  }
+`;
+
+function formatDuration(ms: number): string {
+  const hours = Math.floor(ms / 3600000);
+  const minutes = Math.floor(ms / 60000);
+  const secs = Math.floor((ms % 60000) / 1000);
+
+  if (hours > 0) {
+    return `${hours}:${minutes.toString().padStart(2, '0')}:${secs
+      .toString()
+      .padStart(2, '0')}`;
+  }
+
+  return `${minutes}:${secs.toString().padStart(2, '0')}`;
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/PlayerSpeed.tsx b/web/packages/teleport/src/SessionRecordings/view/player/PlayerSpeed.tsx
new file mode 100644
index 0000000000000..e4910156739a1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/PlayerSpeed.tsx
@@ -0,0 +1,120 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useRef, useState } from 'react';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex';
+import { Check } from 'design/Icon';
+import Menu, { MenuItem } from 'design/Menu';
+import { HoverTooltip } from 'design/Tooltip';
+
+interface PlayerSpeedProps {
+  speed: number;
+  portalRoot: HTMLElement;
+  onSpeedChange: (speed: number) => void;
+}
+
+const SpeedButton = styled.button`
+  background: transparent;
+  border: none;
+  color: ${p => p.theme.colors.text.main};
+  cursor: pointer;
+  height: 32px;
+  font-size: ${p => p.theme.fontSizes[2]}px;
+  padding: ${p => p.theme.space[1]}px
+    ${p => p.theme.space[2] + p.theme.space[1]}px;
+  line-height: 1;
+  border-radius: ${p => p.theme.radii[3]}px;
+
+  &:hover {
+    background: ${p => p.theme.colors.spotBackground[1]};
+  }
+`;
+
+const StyledMenu = styled(Menu)`
+  width: 150px;
+`;
+
+const StyledMenuItem = styled(MenuItem)`
+  font-size: ${p => p.theme.fontSizes[2]}px;
+  display: flex;
+  align-items: center;
+`;
+
+const AVAILABLE_SPEEDS = [0.25, 0.5, 1, 1.5, 2, 3, 4];
+
+export function PlayerSpeed({
+  onSpeedChange,
+  portalRoot,
+  speed,
+}: PlayerSpeedProps) {
+  const [isOpen, setIsOpen] = useState(false);
+
+  const ref = useRef<HTMLButtonElement>(null);
+
+  const items = useMemo(() => {
+    return AVAILABLE_SPEEDS.map(s => (
+      <StyledMenuItem
+        key={s}
+        onClick={() => {
+          onSpeedChange(s);
+        }}
+      >
+        <Flex height="24px" width="24px">
+          {s === speed && <Check size="small" />}
+        </Flex>
+        {s}x
+      </StyledMenuItem>
+    ));
+  }, [onSpeedChange, speed]);
+
+  return (
+    <>
+      <HoverTooltip tipContent="Playback Speed" portalRoot={portalRoot}>
+        <SpeedButton
+          onClick={() => {
+            setIsOpen(true);
+          }}
+          ref={ref}
+        >
+          {speed}x
+        </SpeedButton>
+      </HoverTooltip>
+
+      <StyledMenu
+        anchorEl={ref.current}
+        open={isOpen}
+        onClose={() => setIsOpen(false)}
+        // hack to properly position the menu
+        getContentAnchorEl={null}
+        anchorOrigin={{
+          vertical: 'top',
+          horizontal: 'right',
+        }}
+        transformOrigin={{
+          vertical: 'bottom',
+          horizontal: 'right',
+        }}
+        menuListProps={{ onClick: () => setIsOpen(false) }}
+      >
+        {items}
+      </StyledMenu>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/RecordingPlayer.tsx b/web/packages/teleport/src/SessionRecordings/view/player/RecordingPlayer.tsx
new file mode 100644
index 0000000000000..6da6c35e23bc9
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/RecordingPlayer.tsx
@@ -0,0 +1,353 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useMemo,
+  useRef,
+  useState,
+  type RefObject,
+} from 'react';
+import styled, { keyframes } from 'styled-components';
+import { useEventListener } from 'usehooks-ts';
+import Box from 'web/packages/design/src/Box';
+import Flex from 'web/packages/design/src/Flex';
+import { Pause, Play } from 'web/packages/design/src/Icon';
+
+import type { SessionRecordingEvent } from 'teleport/services/recordings';
+import {
+  CurrentEventInfo,
+  type CurrentEventInfoHandle,
+} from 'teleport/SessionRecordings/view/CurrentEventInfo';
+import type { Player } from 'teleport/SessionRecordings/view/player/Player';
+import {
+  PlayerControls,
+  type PlayerControlsHandle,
+} from 'teleport/SessionRecordings/view/player/PlayerControls';
+import type { PlayerHandle } from 'teleport/SessionRecordings/view/SshPlayer';
+import {
+  PlayerState,
+  SessionStream,
+} from 'teleport/SessionRecordings/view/stream/SessionStream';
+import type { BaseEvent } from 'teleport/SessionRecordings/view/stream/types';
+
+export interface RecordingPlayerProps<
+  TEvent extends BaseEvent<TEventType>,
+  TEventType extends number = number,
+  TEndEventType extends TEventType = TEventType,
+> {
+  duration: number;
+  onTimeChange?: (time: number) => void;
+  onToggleSidebar?: () => void;
+  onToggleTimeline?: () => void;
+  onToggleFullscreen?: () => void;
+  fullscreen?: boolean;
+  player: Player<TEvent>;
+  endEventType: TEndEventType;
+  decodeEvent: (buffer: ArrayBuffer) => TEvent;
+  ref: RefObject<PlayerHandle>;
+  events?: SessionRecordingEvent[];
+  ws: WebSocket;
+}
+
+export function RecordingPlayer<
+  TEvent extends BaseEvent<TEventType>,
+  TEventType extends number = number,
+>({
+  duration,
+  onTimeChange,
+  player,
+  endEventType,
+  fullscreen,
+  decodeEvent,
+  onToggleFullscreen,
+  onToggleSidebar,
+  onToggleTimeline,
+  events,
+  ref,
+  ws,
+}: RecordingPlayerProps<TEvent>) {
+  const [playerState, setPlayerState] = useState(PlayerState.Loading);
+  const [speed, setSpeed] = useState(1);
+
+  const [showPlayButton, setShowPlayButton] = useState(true);
+
+  const eventInfoRef = useRef<CurrentEventInfoHandle>(null);
+  const controlsRef = useRef<PlayerControlsHandle>(null);
+  const playerRef = useRef<HTMLDivElement>(null);
+
+  const stream = useMemo(
+    () => new SessionStream(ws, player, decodeEvent, endEventType, duration),
+    [ws, player, decodeEvent, endEventType, duration]
+  );
+
+  useEffect(() => {
+    stream.on('state', next => {
+      setPlayerState(next);
+    });
+
+    stream.on('time', time => {
+      if (controlsRef.current) {
+        controlsRef.current.setTime(time);
+      }
+      onTimeChange?.(time);
+      if (eventInfoRef.current) {
+        eventInfoRef.current.setTime(time);
+      }
+    });
+
+    stream.loadInitial();
+
+    return () => {
+      stream.destroy();
+    };
+  }, [stream, onTimeChange]);
+
+  useEffect(() => {
+    stream.setSpeed(speed);
+  }, [speed, stream]);
+
+  useEffect(() => {
+    if (!playerRef.current) {
+      return;
+    }
+
+    player.init(playerRef.current);
+
+    const observer = new ResizeObserver(() => {
+      player.fit();
+    });
+
+    observer.observe(playerRef.current);
+
+    return () => {
+      observer.disconnect();
+    };
+  }, [player]);
+
+  const handlePlay = useCallback(() => {
+    setShowPlayButton(false);
+
+    stream.play();
+  }, [stream]);
+
+  const handlePause = useCallback(() => {
+    stream.pause();
+  }, [stream]);
+
+  const handleSeek = useCallback(
+    (time: number) => {
+      setShowPlayButton(false);
+
+      stream.seek(time);
+    },
+    [stream]
+  );
+
+  useImperativeHandle(ref, () => ({
+    moveToTime: handleSeek,
+  }));
+
+  return (
+    <Box height="100%" flex={1} p={3}>
+      <Flex
+        alignItems="stretch"
+        flexDirection="column"
+        border="1px solid"
+        height="100%"
+        borderColor="spotBackground.1"
+        borderRadius={4}
+        overflow="hidden"
+        position="relative"
+      >
+        {events && (
+          <CurrentEventInfo
+            events={events}
+            onSeek={handleSeek}
+            ref={eventInfoRef}
+          />
+        )}
+
+        {showPlayButton && (
+          <PlayButton onClick={handlePlay}>
+            <AdjustedPlay size="extra-large" />
+          </PlayButton>
+        )}
+
+        <PlayPauseKeyboardShortcuts
+          onPlay={handlePlay}
+          onPause={handlePause}
+          state={playerState}
+        />
+
+        <PlayerBox ref={playerRef} />
+
+        <PlayerControls
+          fullscreen={fullscreen}
+          onToggleFullscreen={onToggleFullscreen}
+          onToggleSidebar={onToggleSidebar}
+          onToggleTimeline={onToggleTimeline}
+          duration={duration}
+          onPlay={handlePlay}
+          onPause={handlePause}
+          onSeek={handleSeek}
+          onSpeedChange={setSpeed}
+          speed={speed}
+          state={playerState}
+          ref={controlsRef}
+        />
+      </Flex>
+    </Box>
+  );
+}
+
+const PlayButton = styled.button`
+  border: none;
+  background: none;
+  color: white;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  background: rgba(0, 0, 0, 0.6);
+  border-radius: 50%;
+  padding: ${p => p.theme.space[3]}px;
+  z-index: 10;
+  cursor: pointer;
+
+  &:hover {
+    background: rgba(0, 0, 0, 0.4);
+  }
+`;
+
+interface PlayPauseKeyboardShortcutsProps {
+  onPlay: () => void;
+  onPause: () => void;
+  state: PlayerState;
+}
+
+function PlayPauseKeyboardShortcuts({
+  onPlay,
+  onPause,
+  state,
+}: PlayPauseKeyboardShortcutsProps) {
+  const [visibleState, setVisibleState] = useState<
+    PlayerState.Paused | PlayerState.Playing | null
+  >(null);
+
+  const timeoutRef = useRef<number | null>(null);
+
+  useEffect(() => {
+    if (!visibleState) {
+      return;
+    }
+
+    if (timeoutRef.current) {
+      window.clearTimeout(timeoutRef.current);
+    }
+
+    timeoutRef.current = window.setTimeout(() => {
+      setVisibleState(null);
+    }, 1000);
+
+    return () => {
+      if (timeoutRef.current) {
+        window.clearTimeout(timeoutRef.current);
+      }
+    };
+  }, [visibleState]);
+
+  useEventListener('keydown', e => {
+    if (e.code !== 'Space') {
+      return;
+    }
+
+    e.preventDefault();
+
+    if (timeoutRef.current) {
+      window.clearTimeout(timeoutRef.current);
+    }
+
+    const next =
+      state === PlayerState.Playing ? PlayerState.Paused : PlayerState.Playing;
+
+    if (next === PlayerState.Playing) {
+      onPlay();
+    } else {
+      onPause();
+    }
+
+    setVisibleState(next);
+  });
+
+  if (!visibleState) {
+    return null;
+  }
+
+  return (
+    <AnimatedState key={visibleState}>
+      {visibleState === PlayerState.Playing && (
+        <AdjustedPlay size="extra-large" />
+      )}
+      {visibleState === PlayerState.Paused && <Pause size="extra-large" />}
+    </AnimatedState>
+  );
+}
+
+const appear = keyframes`
+  to {
+    transform: translate(-50%, 50%) scale(2);
+    opacity: 0;
+  }
+`;
+
+// The play icon is slightly off center
+const AdjustedPlay = styled(Play)`
+  position: relative;
+  left: -2px;
+`;
+
+const AnimatedState = styled.div`
+  background: rgba(0, 0, 0, 0.8);
+  border-radius: 50%;
+  padding: ${p => p.theme.space[2]}px;
+  bottom: 50%;
+  color: white;
+  display: flex;
+  justify-content: center;
+  left: 50%;
+  position: absolute;
+  transform: translate(-50%, 50%);
+  z-index: 1;
+  animation: ${appear} 0.8s linear forwards;
+`;
+
+const PlayerBox = styled.div`
+  background: black; // black bars on the sides of the terminal
+  flex: 1;
+  position: relative;
+
+  .xterm-viewport {
+    overflow: hidden;
+  }
+`;
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/tty/AspectFitRatio.ts b/web/packages/teleport/src/SessionRecordings/view/player/tty/AspectFitRatio.ts
new file mode 100644
index 0000000000000..4c8755ab9f206
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/tty/AspectFitRatio.ts
@@ -0,0 +1,110 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { ITerminalAddon, Terminal } from '@xterm/xterm';
+import type { IRenderDimensions } from '@xterm/xterm/src/browser/renderer/shared/Types';
+
+import type { TerminalSize } from 'teleport/SessionRecordings/view/player/tty/types';
+
+/**
+ * AspectFitAddon is a xterm.js addon that resizes the terminal to fit within its parent element
+ * while maintaining the specified aspect ratio defined by cols and rows.
+ * It uses the same approach as xterm's fit addon (accessing the _renderService and its dimensions).
+ * It applies CSS transforms to scale and center the terminal within its parent element.
+ */
+export class AspectFitAddon implements ITerminalAddon {
+  private terminal: Terminal | undefined;
+  private currentScale: number = 1;
+  private horizontalOffset: number = 0;
+  private verticalOffset: number = 0;
+
+  public activate(terminal: Terminal): void {
+    this.terminal = terminal;
+  }
+
+  public dispose(): void {}
+
+  public getScale(): number {
+    return this.currentScale;
+  }
+
+  public getOffsets(): { x: number; y: number } {
+    return { x: this.horizontalOffset, y: this.verticalOffset };
+  }
+
+  public fitWithAspectRatio({ cols, rows }: TerminalSize): void {
+    if (!this.terminal?.element?.parentElement) {
+      return;
+    }
+
+    // accessing the internals of xterm, this is how the fit addon does it
+    const core = (this.terminal as any)._core;
+    const dims: IRenderDimensions = core._renderService.dimensions;
+
+    if (dims.css.cell.width === 0 || dims.css.cell.height === 0) {
+      return;
+    }
+
+    const parentElementStyle = window.getComputedStyle(
+      this.terminal.element.parentElement
+    );
+    const parentElementHeight = parseInt(
+      parentElementStyle.getPropertyValue('height')
+    );
+    const parentElementWidth = Math.max(
+      0,
+      parseInt(parentElementStyle.getPropertyValue('width'))
+    );
+
+    const availableHeight = parentElementHeight;
+    const availableWidth = parentElementWidth;
+
+    if (this.terminal.rows !== rows || this.terminal.cols !== cols) {
+      core._renderService.clear();
+      this.terminal.resize(cols, rows);
+    }
+
+    const requiredWidth = cols * dims.css.cell.width;
+    const requiredHeight = rows * dims.css.cell.height;
+
+    const scaleX = availableWidth / requiredWidth;
+    const scaleY = availableHeight / requiredHeight;
+    const scale = Math.min(scaleX, scaleY);
+
+    const scaledWidth = requiredWidth * scale;
+    const scaledHeight = requiredHeight * scale;
+
+    const horizontalOffset = (availableWidth - scaledWidth) / 2;
+    const verticalOffset = (availableHeight - scaledHeight) / 2;
+
+    // Store the current scale and offsets for mouse event transformation
+    this.currentScale = scale;
+    this.horizontalOffset = horizontalOffset;
+    this.verticalOffset = verticalOffset;
+
+    const terminalElement = this.terminal.element;
+
+    terminalElement.style.width = `${requiredWidth}px`;
+    terminalElement.style.height = `${requiredHeight}px`;
+    terminalElement.style.position = 'absolute';
+    terminalElement.style.left = '0';
+    terminalElement.style.top = '0';
+    terminalElement.style.transform = `translate(${horizontalOffset}px, ${verticalOffset}px) scale(${scale})`;
+    terminalElement.style.transformOrigin = 'top left';
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyPlayer.ts b/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyPlayer.ts
new file mode 100644
index 0000000000000..28e1fdcc26a61
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyPlayer.ts
@@ -0,0 +1,294 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { CanvasAddon } from '@xterm/addon-canvas';
+import { ImageAddon } from '@xterm/addon-image';
+import { WebLinksAddon } from '@xterm/addon-web-links';
+import { WebglAddon } from '@xterm/addon-webgl';
+import { ITerminalAddon, Terminal } from '@xterm/xterm';
+import type { DefaultTheme } from 'styled-components';
+
+import { Logger } from 'design/logger';
+import { getPlatform, Platform } from 'design/platform';
+
+import { Player } from '../Player';
+import { AspectFitAddon } from './AspectFitRatio';
+import { EventType, type TerminalSize, type TtyEvent } from './types';
+
+/**
+ * TtyPlayer is a player that connects a stream of TtyEvents to an xterm.js terminal.
+ *
+ * It handles rendering the terminal, applying events, and managing terminal addons.
+ *
+ * It supports resizing, clearing the terminal, and focusing the terminal on play/seek.
+ * It also handles terminal themes and font settings.
+ */
+export class TtyPlayer extends Player<TtyEvent> {
+  private addons: ITerminalAddon[] = [];
+  private aspectFitAddon = new AspectFitAddon();
+  private terminal: Terminal | null = null;
+  private playing = false;
+  private logger = new Logger('TtyPlayer');
+  private size: TerminalSize;
+
+  constructor(
+    private theme: DefaultTheme,
+    size: TerminalSize
+  ) {
+    super();
+
+    this.size = {
+      cols: size.cols ?? 80,
+      rows: size.rows ?? 24,
+    };
+  }
+
+  override init(element: HTMLElement) {
+    this.terminal = new Terminal({
+      fontSize: getPlatform() === Platform.macOS ? 12 : 14,
+      fontFamily: this.theme.fonts.mono,
+      cols: this.size.cols,
+      rows: this.size.rows,
+      theme: this.theme.colors.terminal,
+    });
+
+    const linksAddon = new WebLinksAddon();
+    const imageAddon = new ImageAddon();
+
+    this.addons.push(this.aspectFitAddon, linksAddon, imageAddon);
+
+    this.aspectFitAddon.activate(this.terminal);
+
+    for (const addon of this.addons) {
+      this.terminal.loadAddon(addon);
+    }
+
+    const createCanvasAddon = () => {
+      const canvasAddon = new CanvasAddon();
+
+      this.addons.push(canvasAddon);
+      this.terminal.loadAddon(canvasAddon);
+    };
+
+    try {
+      const webglAddon = new WebglAddon();
+
+      webglAddon.onContextLoss(() => {
+        createCanvasAddon();
+      });
+
+      this.terminal.loadAddon(webglAddon);
+      this.addons.push(webglAddon);
+    } catch {
+      createCanvasAddon();
+    }
+
+    this.terminal.open(element);
+
+    this.aspectFitAddon.fitWithAspectRatio(this.size);
+
+    // Set up mouse event interceptor to scale coordinates
+    this.setupMouseEventScaling();
+  }
+
+  override applyEvent(event: TtyEvent) {
+    if (!this.terminal) {
+      throw new Error('Terminal is not initialized');
+    }
+
+    switch (event.type) {
+      case EventType.Resize:
+        this.size = event.terminalSize;
+
+        this.aspectFitAddon.fitWithAspectRatio(this.size);
+
+        break;
+
+      case EventType.SessionPrint:
+        this.terminal.write(event.data);
+
+        break;
+    }
+  }
+
+  override clear() {
+    if (!this.terminal) {
+      throw new Error('Terminal is not initialized');
+    }
+
+    this.terminal.reset();
+    this.fit();
+  }
+
+  fit() {
+    this.aspectFitAddon.fitWithAspectRatio(this.size);
+
+    if (this.playing) {
+      this.terminal?.focus();
+    }
+  }
+
+  override handleEvent(event: TtyEvent) {
+    if (!this.terminal) {
+      throw new Error('Terminal is not initialized');
+    }
+
+    if (event.type === EventType.Screen) {
+      this.size.cols = event.screen.cols;
+      this.size.rows = event.screen.rows;
+
+      this.clear();
+
+      this.terminal.write(event.screen.data);
+
+      return true;
+    }
+
+    return false;
+  }
+
+  override destroy() {
+    for (const addon of this.addons) {
+      try {
+        addon.dispose();
+      } catch {
+        this.logger.warn('Failed to dispose terminal addon', addon);
+      }
+    }
+
+    this.addons = [];
+
+    if (this.terminal) {
+      this.terminal.dispose();
+      this.terminal = null;
+    }
+  }
+
+  onPlay() {
+    if (!this.terminal) {
+      throw new Error('Terminal is not initialized');
+    }
+
+    this.terminal.focus();
+
+    this.playing = true;
+  }
+
+  onSeek() {
+    if (!this.terminal) {
+      throw new Error('Terminal is not initialized');
+    }
+
+    this.terminal.focus();
+  }
+
+  onPause() {
+    this.playing = false;
+  }
+
+  onStop() {
+    this.playing = false;
+  }
+
+  /**
+   * The aspect fit addon scales the terminal using CSS transforms. This breaks the text
+   * selection and mouse events as the mouse coordinates are not scaled. This method patches
+   * xterm's mouse event handling to adjust the mouse coordinates based on the current scale
+   * and offsets applied by the aspect fit addon.
+   */
+  private setupMouseEventScaling() {
+    if (!this.terminal) {
+      return;
+    }
+
+    const terminalElement = this.terminal.element;
+    if (!terminalElement) {
+      return;
+    }
+
+    const core = (this.terminal as any)._core;
+
+    if (!core) {
+      return;
+    }
+
+    if (core._selectionService) {
+      const selectionService = core._selectionService;
+
+      const mouseService = selectionService._mouseService;
+      const originalGetCoords = mouseService.getCoords;
+
+      mouseService.getCoords = (
+        event: MouseEvent,
+        element: HTMLElement,
+        colCount: number,
+        rowCount: number,
+        isSelection?: boolean
+      ): [number, number] | undefined => {
+        const scale = this.aspectFitAddon.getScale();
+        const offsets = this.aspectFitAddon.getOffsets();
+
+        const parentRect =
+          terminalElement.parentElement?.getBoundingClientRect();
+        if (!parentRect) {
+          return originalGetCoords.call(
+            mouseService,
+            event,
+            element,
+            colCount,
+            rowCount,
+            isSelection
+          );
+        }
+
+        // Calculate mouse position relative to the parent container
+        const mouseX = event.clientX - parentRect.left;
+        const mouseY = event.clientY - parentRect.top;
+
+        // Adjust for the terminal's offset and scale
+        const adjustedX = (mouseX - offsets.x) / scale;
+        const adjustedY = (mouseY - offsets.y) / scale;
+
+        // Get cell dimensions
+        const cellWidth = core._renderService?.dimensions?.css?.cell?.width;
+        const cellHeight = core._renderService?.dimensions?.css?.cell?.height;
+
+        if (!cellWidth || !cellHeight) {
+          return originalGetCoords.call(
+            mouseService,
+            event,
+            element,
+            colCount,
+            rowCount,
+            isSelection
+          );
+        }
+
+        // Calculate column and row (0-based indexing)
+        const col = Math.floor(adjustedX / cellWidth) + 1;
+        const row = Math.floor(adjustedY / cellHeight) + 1;
+
+        // Clamp to terminal bounds
+        const clampedCol = Math.max(0, Math.min(col, colCount - 1));
+        const clampedRow = Math.max(0, Math.min(row, rowCount - 1));
+
+        return [clampedCol, clampedRow];
+      };
+    }
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyRecordingPlayer.tsx b/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyRecordingPlayer.tsx
new file mode 100644
index 0000000000000..eb946925cd5e5
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/tty/TtyRecordingPlayer.tsx
@@ -0,0 +1,95 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useSuspenseQuery } from '@tanstack/react-query';
+import { useTheme } from 'styled-components';
+
+import cfg from 'teleport/config';
+import { AuthenticatedWebSocket } from 'teleport/lib/AuthenticatedWebSocket';
+import { TtyPlayer } from 'teleport/SessionRecordings/view/player/tty/TtyPlayer';
+
+import { RecordingPlayer, type RecordingPlayerProps } from '../RecordingPlayer';
+import { decodeTtyEvent } from './decoding';
+import { EventType, type TtyEvent } from './types';
+
+interface TtyRecordingPlayerProps extends Omit<
+  RecordingPlayerProps<TtyEvent>,
+  'decodeEvent' | 'endEventType' | 'player' | 'ws'
+> {
+  clusterId: string;
+  sessionId: string;
+  initialCols: number;
+  initialRows: number;
+}
+
+export function TtyRecordingPlayer({
+  clusterId,
+  sessionId,
+  initialCols,
+  initialRows,
+  ...rest
+}: TtyRecordingPlayerProps) {
+  const theme = useTheme();
+
+  const {
+    data: { player, ws },
+  } = useSuspenseQuery({
+    queryKey: ['ttyRecordingPlayer', clusterId, 'sessionId', sessionId],
+    queryFn: async () => {
+      const ws = await createWebSocket(clusterId, sessionId);
+
+      const player = new TtyPlayer(theme, {
+        cols: initialCols,
+        rows: initialRows,
+      });
+
+      return {
+        ws,
+        player,
+      };
+    },
+  });
+
+  return (
+    <RecordingPlayer
+      {...rest}
+      decodeEvent={decodeTtyEvent}
+      endEventType={EventType.SessionEnd}
+      player={player}
+      ws={ws}
+    />
+  );
+}
+
+function createWebSocket(clusterId: string, sessionId: string) {
+  return new Promise<WebSocket>((resolve, reject) => {
+    const url = cfg.getSessionRecordingPlaybackUrl(clusterId, sessionId);
+
+    const ws = new AuthenticatedWebSocket(url);
+
+    ws.binaryType = 'arraybuffer';
+
+    ws.onopen = () => {
+      resolve(ws);
+    };
+
+    ws.onerror = () => {
+      reject(new Error('Could not connect to the recording'));
+    };
+  });
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/tty/decoding.ts b/web/packages/teleport/src/SessionRecordings/view/player/tty/decoding.ts
new file mode 100644
index 0000000000000..e096ea7f26ff1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/tty/decoding.ts
@@ -0,0 +1,127 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  EventType,
+  type SerializedTerminal,
+  type TerminalSize,
+  type TtyEvent,
+} from './types';
+
+const responseHeaderSize = 17;
+
+export function decodeTtyEvent(buffer: ArrayBuffer): TtyEvent {
+  if (buffer.byteLength < responseHeaderSize) {
+    throw new Error('Event too short');
+  }
+
+  const view = new DataView(buffer);
+  const eventType = view.getUint8(0);
+  const timestamp = Number(view.getBigInt64(1));
+  const dataLength = view.getUint32(9);
+
+  if (buffer.byteLength < responseHeaderSize + dataLength) {
+    throw new Error('Incomplete event data');
+  }
+
+  const data = new Uint8Array(buffer, responseHeaderSize, dataLength);
+
+  const requestId = view.getUint32(13);
+
+  switch (eventType) {
+    case EventType.Resize:
+      return {
+        requestId,
+        terminalSize: decodeTerminalSize(data),
+        timestamp,
+        type: eventType,
+      };
+
+    case EventType.Screen:
+      return {
+        requestId,
+        screen: decodeSerializedTerminal(data),
+        timestamp,
+        type: eventType,
+      };
+
+    case EventType.SessionEnd:
+      return { requestId, timestamp, type: eventType };
+
+    case EventType.SessionPrint:
+      return {
+        data,
+        requestId,
+        timestamp,
+        type: eventType,
+      };
+
+    case EventType.SessionStart:
+      return {
+        requestId,
+        terminalSize: decodeTerminalSize(data),
+        timestamp,
+        type: eventType,
+      };
+  }
+}
+
+function decodeSerializedTerminal(data: Uint8Array): SerializedTerminal {
+  if (data.length < responseHeaderSize) {
+    throw new Error('Serialized terminal data too short');
+  }
+
+  const view = new DataView(
+    data.buffer,
+    data.byteOffset + 1,
+    data.byteLength - 1
+  );
+
+  const cols = view.getUint32(0, false);
+  const rows = view.getUint32(4, false);
+  const cursorX = view.getUint32(8, false);
+  const cursorY = view.getUint32(12, false);
+  const dataLength = view.getUint32(16, false);
+
+  const totalLength = responseHeaderSize + dataLength;
+
+  if (data.length < totalLength) {
+    throw new Error('Incomplete serialized terminal data');
+  }
+
+  return {
+    cols,
+    cursorX,
+    cursorY,
+    data: data.subarray(responseHeaderSize, totalLength),
+    rows,
+  };
+}
+
+function decodeTerminalSize(data: Uint8Array): TerminalSize {
+  const decoder = new TextDecoder();
+
+  const size = decoder.decode(data);
+  const [cols, rows] = size.split(':').map(Number);
+
+  if (isNaN(cols) || isNaN(rows)) {
+    throw new Error('Invalid terminal size format');
+  }
+
+  return { cols, rows };
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/player/tty/types.ts b/web/packages/teleport/src/SessionRecordings/view/player/tty/types.ts
new file mode 100644
index 0000000000000..691bf5dc36e3f
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/player/tty/types.ts
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type { BaseEvent } from '../../stream/types';
+
+export enum EventType {
+  SessionStart = 4,
+  SessionPrint = 5,
+  SessionEnd = 6,
+  Resize = 7,
+  Screen = 8,
+}
+
+export interface ResizeEvent extends BaseEvent<EventType.Resize> {
+  terminalSize: TerminalSize;
+}
+
+export interface ScreenEvent extends BaseEvent<EventType.Screen> {
+  screen: SerializedTerminal;
+}
+
+export interface SerializedTerminal {
+  cols: number;
+  cursorX: number;
+  cursorY: number;
+  data: Uint8Array;
+  rows: number;
+}
+
+export interface SessionEndEvent extends BaseEvent<EventType.SessionEnd> {}
+
+export interface SessionPrintEvent extends BaseEvent<EventType.SessionPrint> {
+  data: Uint8Array;
+}
+
+export interface SessionStartEvent extends BaseEvent<EventType.SessionStart> {
+  terminalSize: TerminalSize;
+}
+
+export interface TerminalSize {
+  cols: number;
+  rows: number;
+}
+
+export type TtyEvent =
+  | ResizeEvent
+  | ScreenEvent
+  | SessionEndEvent
+  | SessionPrintEvent
+  | SessionStartEvent;
diff --git a/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.test.ts b/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.test.ts
new file mode 100644
index 0000000000000..a564c77f489bd
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.test.ts
@@ -0,0 +1,474 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { EventEmitter } from 'events';
+
+import {
+  PlayerState,
+  SessionStream,
+} from 'teleport/SessionRecordings/view/stream/SessionStream';
+import {
+  ResponseType,
+  type BaseEvent,
+} from 'teleport/SessionRecordings/view/stream/types';
+
+import { Player } from '../player/Player';
+
+function setup() {
+  const ws = new MockWebSocket();
+  const player = new MockPlayer();
+  const stream = new SessionStream(
+    ws,
+    player,
+    decodeMockEvent,
+    MockEventType.End,
+    25000
+  );
+
+  return { stream, player, ws };
+}
+
+describe('play', () => {
+  it('should not transition to playing whilst loading', () => {
+    const { stream } = setup();
+
+    const stateListener = jest.fn();
+    stream.on('state', stateListener);
+
+    stream.play();
+
+    expect(stateListener).not.toHaveBeenCalled();
+  });
+
+  it('should transition from loading to paused once the initial events are loaded', async () => {
+    const { stream, ws } = setup();
+
+    const statePromise = new Promise<PlayerState>(resolve => {
+      stream.once('state', resolve);
+    });
+
+    stream.loadInitial();
+
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    expect(await statePromise).toBe(PlayerState.Paused);
+  });
+
+  it('should resume to playing state after initial load if wasPlayingBeforeSeek', async () => {
+    const { stream, ws } = setup();
+
+    const pausedPromise = new Promise<PlayerState>(resolve => {
+      stream.once('state', resolve);
+    });
+
+    stream.loadInitial();
+
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 20000));
+
+    expect(await pausedPromise).toBe(PlayerState.Paused);
+
+    const playPromise = new Promise<PlayerState>(resolve => {
+      stream.once('state', resolve);
+    });
+
+    stream.play();
+    stream.seek(22000);
+
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 22500)], 2)
+    );
+
+    expect(await playPromise).toBe(PlayerState.Playing);
+  });
+
+  it('should call player.onPlay when transitioning to playing', () => {
+    const { stream, player, ws } = setup();
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.play();
+
+    expect(player.onPlay).toHaveBeenCalled();
+  });
+});
+
+describe('pause', () => {
+  it('should transition from playing to paused', () => {
+    const { stream, ws } = setup();
+
+    const stateListener = jest.fn();
+    stream.on('state', stateListener);
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.play();
+
+    expect(stateListener).toHaveBeenCalledWith(PlayerState.Playing);
+
+    stream.pause();
+
+    expect(stateListener).toHaveBeenCalledWith(PlayerState.Paused);
+  });
+
+  it('should call player.onPause when pausing', () => {
+    const { stream, player, ws } = setup();
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.play();
+    stream.pause();
+
+    expect(player.onPause).toHaveBeenCalled();
+  });
+
+  it('should not do anything if already paused', () => {
+    const { stream, ws } = setup();
+
+    const stateListener = jest.fn();
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.on('state', stateListener);
+    stream.pause();
+
+    expect(stateListener).not.toHaveBeenCalled();
+  });
+});
+
+describe('seek', () => {
+  it('should emit time event when seeking', () => {
+    const { stream, ws } = setup();
+
+    const timeListener = jest.fn();
+    stream.on('time', timeListener);
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.seek(750);
+
+    expect(timeListener).toHaveBeenCalledWith(750);
+  });
+
+  it('should call player.onSeek when seeking', () => {
+    const { stream, player, ws } = setup();
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.seek(750);
+
+    expect(player.onSeek).toHaveBeenCalledWith(750);
+  });
+
+  it('should clear player when seeking backwards', () => {
+    const { stream, ws, player } = setup();
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([
+        createMockEvent(MockEventType.Print, 500),
+        createMockEvent(MockEventType.Print, 1000),
+      ])
+    );
+    ws.receiveMessage(createStopEvent(0, 2000));
+
+    stream.seek(1500);
+    player.cleared = false;
+    stream.seek(250);
+
+    expect(player.cleared).toBe(true);
+  });
+});
+
+describe('event handling', () => {
+  it('should ignore messages with wrong requestId', () => {
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    const { stream, ws, player } = setup();
+
+    stream.loadInitial();
+
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 100)], 999)
+    );
+
+    expect(player.events).toHaveLength(0);
+  });
+
+  it('should stop when an end event is encountered', () => {
+    const { stream, ws } = setup();
+
+    const stateListener = jest.fn();
+
+    stream.loadInitial();
+
+    ws.receiveMessage(
+      createBatchEvent([
+        createMockEvent(MockEventType.Print, 100),
+        createMockEvent(MockEventType.Print, 200),
+        createMockEvent(MockEventType.End, 300),
+      ])
+    );
+
+    jest.spyOn(performance, 'now').mockReturnValueOnce(0);
+    jest.spyOn(performance, 'now').mockReturnValueOnce(400);
+
+    stream.on('state', stateListener);
+    stream.play();
+
+    expect(stateListener).toHaveBeenCalledWith(PlayerState.Stopped);
+  });
+});
+
+describe('time events', () => {
+  it('should emit time events during playback', () => {
+    const { stream, ws } = setup();
+
+    const timeListener = jest.fn();
+    stream.on('time', timeListener);
+
+    stream.loadInitial();
+    ws.receiveMessage(
+      createBatchEvent([createMockEvent(MockEventType.Print, 500)])
+    );
+    ws.receiveMessage(createStopEvent(0, 1000));
+
+    stream.play();
+
+    expect(timeListener).toHaveBeenCalled();
+  });
+});
+
+function createStopEvent(startTime: number, endTime: number, requestId = 1) {
+  const buffer = new ArrayBuffer(33);
+  const view = new DataView(buffer);
+  view.setUint8(0, ResponseType.Stop);
+  view.setBigInt64(1, BigInt(0));
+  view.setUint32(9, 0);
+  view.setUint32(13, requestId);
+  view.setBigInt64(17, BigInt(startTime));
+  view.setBigInt64(25, BigInt(endTime));
+  return buffer;
+}
+
+function createBatchEvent(events: ArrayBuffer[], requestId = 1) {
+  const totalLength = events.reduce((sum, event) => sum + event.byteLength, 0);
+  const buffer = new ArrayBuffer(17 + totalLength);
+  const view = new DataView(buffer);
+
+  view.setUint8(0, ResponseType.Batch);
+  view.setUint32(1, events.length);
+  view.setUint32(5, requestId);
+  view.setUint32(9, totalLength);
+
+  let offset = 17;
+  for (const event of events) {
+    new Uint8Array(buffer, offset, event.byteLength).set(new Uint8Array(event));
+    offset += event.byteLength;
+  }
+
+  return buffer;
+}
+
+function createMockEvent(
+  type: MockEventType,
+  timestamp: number,
+  requestId = 1
+): ArrayBuffer {
+  const buffer = new ArrayBuffer(17);
+  const view = new DataView(buffer);
+  view.setUint8(0, type);
+  view.setBigInt64(1, BigInt(timestamp));
+  view.setUint32(9, 0);
+  view.setUint32(13, requestId);
+  return buffer;
+}
+
+function decodeMockEvent(buffer: ArrayBuffer): MockEvent {
+  const view = new DataView(buffer);
+  const type = view.getUint8(0) as MockEventType;
+  const timestamp = Number(view.getBigInt64(1));
+  const requestId = view.getUint32(13);
+
+  return {
+    type,
+    timestamp,
+    requestId,
+  } as MockEvent;
+}
+
+enum MockEventType {
+  Print,
+  Resize,
+  End,
+}
+
+interface MockEventPrint extends BaseEvent<MockEventType.Print> {
+  content: string;
+}
+
+interface MockEventResize extends BaseEvent<MockEventType.Resize> {
+  cols: number;
+  rows: number;
+}
+
+interface MockEventEnd extends BaseEvent<MockEventType.End> {}
+
+type MockEvent = MockEventPrint | MockEventResize | MockEventEnd;
+
+class MockPlayer extends Player<MockEvent> {
+  events: MockEvent[] = [];
+  cleared = false;
+  destroyed = false;
+  handleCalled = false;
+
+  init(): void {}
+
+  destroy(): void {
+    this.destroyed = true;
+  }
+
+  applyEvent(event: MockEvent): void {
+    this.events.push(event);
+  }
+
+  handleEvent(event: MockEvent): boolean {
+    this.handleCalled = true;
+
+    return event.type === MockEventType.End;
+  }
+
+  clear(): void {
+    this.cleared = true;
+    this.events = [];
+  }
+
+  onPlay = jest.fn();
+  onPause = jest.fn();
+  onSeek = jest.fn();
+  onStop = jest.fn();
+}
+
+interface WebSocketEventMap {
+  close: [CloseEvent];
+  error: [Event];
+  message: [MessageEvent];
+  open: [Event];
+}
+
+class MockWebSocket
+  extends EventEmitter<WebSocketEventMap>
+  implements WebSocket
+{
+  sentMessages: ArrayBuffer[] = [];
+  closed = false;
+  binaryType = 'arraybuffer' as const;
+  bufferedAmount = 0;
+  extensions = '';
+  protocol = '';
+  readyState = WebSocket.OPEN;
+  url = 'ws://localhost';
+
+  send(data: ArrayBuffer): void {
+    this.sentMessages.push(data);
+  }
+
+  close(): void {
+    this.closed = true;
+  }
+
+  // Helper to simulate receiving a message
+  receiveMessage(data: ArrayBuffer): void {
+    const event = new MessageEvent('message', { data });
+    if (this.onmessage) {
+      this.onmessage(event);
+    }
+  }
+
+  onmessage: ((event: MessageEvent) => void) | null = null;
+  onopen: (() => void) | null = null;
+  onclose: (() => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+
+  dispatchEvent(event: Event): boolean {
+    return this.emit(event.type as keyof WebSocketEventMap, event as any);
+  }
+
+  readonly CLOSED: 3;
+  readonly CLOSING: 2;
+  readonly CONNECTING: 0;
+  readonly OPEN: 1;
+
+  addEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | AddEventListenerOptions
+  ): void;
+  addEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    // eslint-disable-next-line unused-imports/no-unused-vars
+    options?: boolean | AddEventListenerOptions
+  ): void {
+    this.on(type as keyof WebSocketEventMap, listener as any);
+  }
+
+  removeEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | EventListenerOptions
+  ): void;
+  removeEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    // eslint-disable-next-line unused-imports/no-unused-vars
+    options?: boolean | EventListenerOptions
+  ): void {
+    this.off(type as keyof WebSocketEventMap, listener as any);
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.ts b/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.ts
new file mode 100644
index 0000000000000..5eb85556d3ac1
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/stream/SessionStream.ts
@@ -0,0 +1,503 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { EventEmitter } from 'events';
+
+import { parseArrayBuffer } from 'teleport/SessionRecordings/view/stream/decoding';
+import {
+  isBatchEvent,
+  isErrorEvent,
+  isStartEvent,
+  isStopEvent,
+  type BaseEvent,
+} from 'teleport/SessionRecordings/view/stream/types';
+
+import { type Player } from '../player/Player';
+import { encodeFetchRequest } from './encoding';
+
+export enum PlayerState {
+  Loading,
+  Paused,
+  Playing,
+  Stopped,
+}
+
+interface SessionStreamEvents {
+  state: [PlayerState];
+  time: [number];
+}
+
+interface Range {
+  end: number;
+  start: number;
+}
+
+const BASE_LOAD_THRESHOLD_MS = 5 * 1000; // 5 seconds
+const BASE_LOAD_CHUNK_MS = 20 * 1000; // 20 seconds
+
+/**
+ * SessionStream manages the loading and buffering of events from a WebSocket connection.
+ *
+ * It handles play, pause, and seek operations, ensuring that events are loaded and played back
+ * in a smooth manner. The class uses an internal buffer to store events and manages the state of playback.
+ *
+ * It passes the events to a Player instance for rendering, so it can be used with different types of
+ * session recordings.
+ */
+export class SessionStream<
+  TEvent extends BaseEvent<TEventType>,
+  TEventType extends number = number,
+  TEndEventType extends TEventType = TEventType,
+> extends EventEmitter<SessionStreamEvents> {
+  private buffer: TEvent[] = [];
+  private currentBufferIndex = 0;
+  private maxBufferSize = 2000;
+
+  private loadedRange: Range = {
+    end: 0,
+    start: 0,
+  };
+  private loadingRange: Range | null = null;
+
+  private animationFrameId: number | null = null;
+  private currentTime = 0;
+  private pausedTime = 0;
+  private startTime = 0;
+
+  private atEnd = false;
+  // we track loading separately from the loading state as we can still play and load at the same time
+  private loading = true;
+  private requestId = 0;
+  private state: PlayerState = PlayerState.Loading;
+  private wasPlayingBeforeSeek = false;
+  private playbackSpeed = 1;
+
+  constructor(
+    private ws: WebSocket,
+    private player: Player<TEvent>,
+    private decodeEvent: (data: ArrayBuffer) => TEvent,
+    private endEventType: TEndEventType,
+    private duration: number
+  ) {
+    super();
+
+    ws.onmessage = this.handleMessage.bind(this);
+  }
+
+  destroy() {
+    this.removeAllListeners();
+    this.ws.close();
+
+    if (this.animationFrameId) {
+      cancelAnimationFrame(this.animationFrameId);
+      this.animationFrameId = null;
+    }
+
+    this.player.destroy();
+  }
+
+  loadInitial() {
+    this.load(0, this.getLoadChunkMs(), false);
+  }
+
+  play() {
+    if (this.loading || this.state === PlayerState.Playing) {
+      return;
+    }
+
+    if (this.state === PlayerState.Stopped) {
+      this.seek(0);
+    }
+
+    this.setState(PlayerState.Playing);
+
+    if (this.pausedTime > 0) {
+      this.startTime = performance.now() - this.pausedTime / this.playbackSpeed;
+      this.pausedTime = 0;
+    } else if (!this.startTime) {
+      this.startTime = performance.now();
+      this.currentBufferIndex = 0;
+    }
+
+    this.playEvents();
+    this.player.onPlay();
+  }
+
+  seek(time: number) {
+    if (time > this.duration) {
+      return;
+    }
+
+    this.wasPlayingBeforeSeek = this.state === PlayerState.Playing;
+
+    this.emit('time', time);
+    this.player.onSeek(time);
+
+    if (this.state === PlayerState.Stopped) {
+      this.setState(PlayerState.Paused);
+    }
+
+    const isTimeLoaded =
+      time >= this.loadedRange.start && time <= this.loadedRange.end;
+
+    if (!isTimeLoaded) {
+      // we do not have the requested time loaded in the buffer, so clear the buffer
+      // and request the state of the screen at the requested time, and continue playback
+      // from there
+      this.clearBuffer();
+
+      if (this.animationFrameId !== null) {
+        cancelAnimationFrame(this.animationFrameId);
+        this.animationFrameId = null;
+      }
+
+      this.startTime = performance.now() - time / this.playbackSpeed;
+      this.currentTime = time;
+
+      if (
+        this.state === PlayerState.Paused ||
+        this.state === PlayerState.Stopped
+      ) {
+        this.pausedTime = time;
+      }
+
+      this.setState(PlayerState.Loading);
+
+      this.load(time, time + this.getLoadChunkMs(), true);
+
+      return;
+    }
+
+    if (time < this.currentTime) {
+      // we are seeking backwards, so we cannot just apply the events from the current buffer index
+      // we need to reset the player state and re-apply all events from the start of the buffer
+      this.currentTime = 0;
+      this.currentBufferIndex = 0;
+
+      this.player.clear();
+    }
+
+    this.startTime = performance.now() - time / this.playbackSpeed;
+
+    // play all events up until the requested time
+    this.playEventsUpUntil(time);
+
+    if (
+      this.state === PlayerState.Paused ||
+      this.state === PlayerState.Stopped
+    ) {
+      // if we are paused or stopped, we need to update the paused time to the requested time
+      this.pausedTime = time;
+    }
+  }
+
+  pause() {
+    if (this.state === PlayerState.Paused) {
+      return;
+    }
+
+    this.setState(PlayerState.Paused);
+
+    if (this.animationFrameId !== null) {
+      cancelAnimationFrame(this.animationFrameId);
+      this.animationFrameId = null;
+    }
+
+    this.pausedTime = (performance.now() - this.startTime) * this.playbackSpeed;
+    this.currentTime = this.pausedTime;
+    this.wasPlayingBeforeSeek = false;
+
+    this.player.onPause();
+  }
+
+  setSpeed(speed: number) {
+    if (speed <= 0) {
+      return;
+    }
+
+    const wasPlaying = this.state === PlayerState.Playing;
+
+    if (wasPlaying) {
+      this.pause();
+    }
+
+    this.playbackSpeed = speed;
+
+    if (wasPlaying) {
+      this.play();
+    }
+  }
+
+  private getLoadThresholdMs(): number {
+    // For higher speeds, we need more buffer time to avoid stuttering
+    // At 2x speed, we want at least 10 seconds of buffer
+    // At 4x speed, we want at least 20 seconds of buffer
+    return BASE_LOAD_THRESHOLD_MS * Math.max(1, this.playbackSpeed);
+  }
+
+  private getLoadChunkMs(): number {
+    // Load bigger chunks at higher speeds
+    // At 2x speed, load 40 seconds
+    // At 4x speed, load 80 seconds
+    return BASE_LOAD_CHUNK_MS * Math.max(1, this.playbackSpeed);
+  }
+
+  private playEvents = () => {
+    if (this.state !== PlayerState.Playing) {
+      return;
+    }
+
+    const currentTime =
+      (performance.now() - this.startTime) * this.playbackSpeed;
+
+    this.currentTime = currentTime;
+
+    this.emit('time', currentTime);
+
+    while (
+      this.currentBufferIndex < this.buffer.length &&
+      this.buffer[this.currentBufferIndex].timestamp <= currentTime
+    ) {
+      const event = this.buffer[this.currentBufferIndex];
+
+      this.currentBufferIndex++;
+
+      if (event.type === this.endEventType) {
+        this.setState(PlayerState.Stopped);
+        this.player.onStop();
+
+        return;
+      }
+
+      this.player.applyEvent(event);
+    }
+
+    this.checkBufferStatus(currentTime);
+
+    this.animationFrameId = requestAnimationFrame(this.playEvents);
+  };
+
+  private playEventsUpUntil(time: number) {
+    while (
+      this.currentBufferIndex < this.buffer.length &&
+      this.buffer[this.currentBufferIndex].timestamp <= time
+    ) {
+      const event = this.buffer[this.currentBufferIndex];
+
+      this.currentBufferIndex++;
+
+      this.player.applyEvent(event);
+    }
+
+    this.currentTime = time;
+
+    this.checkBufferStatus(time);
+  }
+
+  private checkBufferStatus(currentTime: number) {
+    if (this.loadingRange) {
+      return;
+    }
+
+    const loadThreshold = this.getLoadThresholdMs();
+    const isWithinLoadedRange =
+      currentTime >= this.loadedRange.start &&
+      currentTime + loadThreshold <= this.loadedRange.end;
+
+    if (isWithinLoadedRange) {
+      return;
+    }
+
+    const lastEventTime =
+      this.buffer.length > 0
+        ? this.buffer[this.buffer.length - 1].timestamp
+        : currentTime;
+
+    const remainingBufferTime = lastEventTime - currentTime;
+
+    if (!this.atEnd && !this.loading && remainingBufferTime < loadThreshold) {
+      const newStartTime = this.loadedRange.end;
+      const newEndTime = newStartTime + this.getLoadChunkMs();
+
+      this.load(newStartTime, newEndTime);
+    }
+  }
+
+  private setState(state: PlayerState) {
+    this.state = state;
+    this.emit('state', state);
+  }
+
+  private handleMessage(event: MessageEvent) {
+    if (!(event.data instanceof ArrayBuffer)) {
+      return;
+    }
+
+    const parsed = parseArrayBuffer(event.data, this.decodeEvent);
+
+    if (parsed.requestId !== this.requestId) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `Ignoring event with requestId ${parsed.requestId}, current requestId is ${this.requestId}`
+      );
+
+      return;
+    }
+
+    if (isBatchEvent(parsed)) {
+      // mark loading as false as soon as we get any batch event so we can start playing again
+      this.loading = false;
+
+      this.pushBatchToBuffer(parsed.events);
+
+      if (this.state === PlayerState.Loading) {
+        if (this.wasPlayingBeforeSeek) {
+          this.play();
+        } else {
+          this.setState(PlayerState.Paused);
+        }
+      }
+
+      const hasEnd =
+        parsed.events[parsed.events.length - 1].type === this.endEventType;
+
+      if (hasEnd) {
+        this.end();
+      }
+
+      return;
+    }
+
+    if (isStartEvent(parsed)) {
+      return;
+    }
+
+    if (isStopEvent(parsed)) {
+      this.loading = false;
+      this.loadingRange = null;
+
+      this.updateLoadedTimes(parsed.startTime, parsed.endTime);
+
+      if (this.state === PlayerState.Loading) {
+        if (this.wasPlayingBeforeSeek) {
+          this.play();
+        } else {
+          this.setState(PlayerState.Paused);
+        }
+      }
+
+      return;
+    }
+
+    if (isErrorEvent(parsed)) {
+      return;
+    }
+
+    // if handleEvent returns true, it means the event has been handled and does not need to be added to the buffer
+    if (this.player.handleEvent(parsed)) {
+      return;
+    }
+
+    this.pushToBuffer(parsed);
+  }
+
+  private end() {
+    this.atEnd = true;
+  }
+
+  private load(
+    startTime: number,
+    endTime: number,
+    requestCurrentScreen = false
+  ) {
+    if (this.atEnd) {
+      return;
+    }
+
+    const isAlreadyLoading =
+      this.loadingRange &&
+      this.loadingRange.start <= startTime &&
+      this.loadingRange.end >= endTime;
+
+    if (isAlreadyLoading) {
+      return;
+    }
+
+    this.requestId += 1;
+
+    this.loading = true;
+
+    this.loadingRange = { end: endTime, start: startTime };
+
+    this.ws.send(
+      encodeFetchRequest({
+        endTime,
+        requestCurrentScreen,
+        requestId: this.requestId,
+        startTime,
+      })
+    );
+  }
+
+  private pushBatchToBuffer(events: TEvent[]) {
+    this.buffer = this.buffer.concat(events);
+    this.trimBuffer();
+  }
+
+  private pushToBuffer(event: TEvent) {
+    this.buffer.push(event);
+    this.trimBuffer();
+  }
+
+  private trimBuffer() {
+    if (this.buffer.length - this.currentBufferIndex > this.maxBufferSize) {
+      this.buffer = this.buffer.slice(this.currentBufferIndex);
+      this.currentBufferIndex = 0;
+      this.updateLoadedTimes(
+        this.buffer[0]?.timestamp ?? 0,
+        this.buffer[this.buffer.length - 1]?.timestamp ?? 0
+      );
+    }
+  }
+
+  private clearBuffer() {
+    this.buffer = [];
+    this.currentBufferIndex = 0;
+    this.startTime = 0;
+    this.pausedTime = 0;
+    this.loadedRange = {
+      end: 0,
+      start: 0,
+    };
+    this.atEnd = false;
+    this.loadingRange = null;
+  }
+
+  private updateLoadedTimes(start: number, end: number) {
+    if (this.loadedRange.start === 0 && this.loadedRange.end === 0) {
+      this.loadedRange = { start, end };
+
+      return;
+    }
+
+    this.loadedRange = {
+      start: Math.min(this.loadedRange.start, start),
+      end: Math.max(this.loadedRange.end, end),
+    };
+  }
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/stream/decoding.ts b/web/packages/teleport/src/SessionRecordings/view/stream/decoding.ts
new file mode 100644
index 0000000000000..704f733c63fb8
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/stream/decoding.ts
@@ -0,0 +1,131 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  ResponseType,
+  type BaseEvent,
+  type BatchEvent,
+  type StreamEvent,
+} from './types';
+
+const responseHeaderSize = 17;
+
+export function parseArrayBuffer<
+  T extends BaseEvent<TType>,
+  TType extends number = number,
+>(
+  buffer: ArrayBuffer,
+  decodeEvent: (buffer: ArrayBuffer) => T
+): StreamEvent<T> | T {
+  if (buffer.byteLength < responseHeaderSize) {
+    throw new Error('Event too short');
+  }
+
+  const view = new DataView(buffer);
+  const responseType = view.getUint8(0) as ResponseType;
+  const timestamp = Number(view.getBigInt64(1));
+  const dataLength = view.getUint32(9);
+
+  if (buffer.byteLength < responseHeaderSize + dataLength) {
+    throw new Error('Incomplete event data');
+  }
+
+  const data = new Uint8Array(buffer, responseHeaderSize, dataLength);
+
+  const requestId = view.getUint32(13);
+
+  switch (responseType) {
+    case ResponseType.Batch:
+      return parseBatchEvent(buffer, decodeEvent);
+
+    case ResponseType.Error:
+      return {
+        error: new TextDecoder().decode(data),
+
+        requestId,
+        timestamp,
+        type: responseType,
+      };
+
+    case ResponseType.Start:
+      return { requestId, timestamp, type: responseType };
+
+    case ResponseType.Stop:
+      const startTime = Number(view.getBigInt64(responseHeaderSize));
+      const endTime = Number(view.getBigInt64(25));
+
+      return {
+        endTime,
+        requestId,
+        startTime,
+        timestamp,
+        type: responseType,
+      };
+
+    default:
+      return decodeEvent(buffer);
+  }
+}
+
+function parseBatchEvent<T>(
+  buffer: ArrayBuffer,
+  decodeEvent: (buffer: ArrayBuffer) => T
+): BatchEvent<T> {
+  if (buffer.byteLength < responseHeaderSize) {
+    throw new Error('Batch event header too short');
+  }
+
+  const headerView = new DataView(buffer);
+  const batchCount = headerView.getUint32(1);
+  const requestId = headerView.getUint32(5);
+
+  const events: T[] = [];
+
+  let offset = responseHeaderSize;
+
+  for (let i = 0; i < batchCount; i++) {
+    if (offset + responseHeaderSize > buffer.byteLength) {
+      throw new Error(`Incomplete batch event at index ${i}`);
+    }
+
+    const eventView = new DataView(buffer, offset);
+    const dataLength = eventView.getUint32(9);
+
+    if (offset + responseHeaderSize + dataLength > buffer.byteLength) {
+      throw new Error(`Incomplete event data at index ${i}`);
+    }
+
+    const eventBuffer = new ArrayBuffer(responseHeaderSize + dataLength);
+    const eventBytes = new Uint8Array(eventBuffer);
+    eventBytes.set(
+      new Uint8Array(buffer, offset, responseHeaderSize + dataLength)
+    );
+
+    const parsedEvent = decodeEvent(eventBuffer);
+    events.push(parsedEvent);
+
+    offset += responseHeaderSize + dataLength;
+  }
+
+  return {
+    events,
+    requestId,
+    timestamp: 0,
+    type: ResponseType.Batch,
+  };
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/stream/encoding.ts b/web/packages/teleport/src/SessionRecordings/view/stream/encoding.ts
new file mode 100644
index 0000000000000..d5cc8f528a28f
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/stream/encoding.ts
@@ -0,0 +1,37 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { RequestType, type FetchRequest } from './types';
+
+const requestHeaderSize = 21;
+
+export function encodeFetchRequest(request: FetchRequest): ArrayBuffer {
+  const buffer = new ArrayBuffer(22);
+  const view = new DataView(buffer);
+
+  view.setUint8(0, RequestType.Fetch);
+  view.setBigInt64(1, BigInt(Math.floor(request.startTime)));
+  view.setBigInt64(9, BigInt(Math.floor(request.endTime)));
+  view.setUint32(17, request.requestId);
+
+  if (request.requestCurrentScreen !== undefined) {
+    view.setUint8(requestHeaderSize, request.requestCurrentScreen ? 1 : 0);
+  }
+
+  return buffer;
+}
diff --git a/web/packages/teleport/src/SessionRecordings/view/stream/types.ts b/web/packages/teleport/src/SessionRecordings/view/stream/types.ts
new file mode 100644
index 0000000000000..d23b8fba05114
--- /dev/null
+++ b/web/packages/teleport/src/SessionRecordings/view/stream/types.ts
@@ -0,0 +1,93 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export enum RequestType {
+  Fetch = 1,
+}
+
+export enum ResponseType {
+  Start = 1,
+  Stop = 2,
+  Error = 3,
+  Batch = 9,
+}
+
+export interface FetchRequest {
+  endTime: number;
+  // requestCurrentScreen is used to request the stream to send the full state of the recording at the requested start time.
+  // This is so the correct state of the recording can be rendered without having to return all the events up until
+  // the requested start time.
+  requestCurrentScreen?: boolean;
+  requestId: number;
+  startTime: number;
+}
+
+export interface BaseEvent<TType extends number = number> {
+  requestId: number;
+  timestamp: number;
+  type: TType;
+}
+
+export interface BatchEvent<T> extends BaseEvent<ResponseType.Batch> {
+  events: T[];
+}
+
+export interface ErrorEvent extends BaseEvent<ResponseType.Error> {
+  error: string;
+}
+
+export interface StartEvent extends BaseEvent<ResponseType.Start> {}
+
+export interface StopEvent extends BaseEvent<ResponseType.Stop> {
+  endTime: number;
+  startTime: number;
+}
+
+export type StreamEvent<T> =
+  | StartEvent
+  | StopEvent
+  | ErrorEvent
+  | BatchEvent<T>;
+
+export function isBatchEvent<
+  TEvent extends BaseEvent<TType>,
+  TType extends number = number,
+>(event: TEvent | StreamEvent<TEvent>): event is BatchEvent<TEvent> {
+  return event.type === ResponseType.Batch;
+}
+
+export function isErrorEvent<
+  TEvent extends BaseEvent<TType>,
+  TType extends number = number,
+>(event: TEvent | StreamEvent<TEvent>): event is ErrorEvent {
+  return event.type === ResponseType.Error;
+}
+
+export function isStartEvent<
+  TEvent extends BaseEvent<TType>,
+  TType extends number = number,
+>(event: TEvent | StreamEvent<TEvent>): event is StartEvent {
+  return event.type === ResponseType.Start;
+}
+
+export function isStopEvent<
+  TEvent extends BaseEvent<TType>,
+  TType extends number = number,
+>(event: TEvent | StreamEvent<TEvent>): event is StopEvent {
+  return event.type === ResponseType.Stop;
+}
diff --git a/web/packages/teleport/src/Support/Support.story.tsx b/web/packages/teleport/src/Support/Support.story.tsx
index 4a583063a2163..68c2f67591961 100644
--- a/web/packages/teleport/src/Support/Support.story.tsx
+++ b/web/packages/teleport/src/Support/Support.story.tsx
@@ -48,25 +48,7 @@ export const SupportOSS = () => (
 
 export const SupportOSSWithCTA = () => (
   <Provider>
-    <Support {...props} showPremiumSupportCTA={true} />
-  </Provider>
-);
-
-export const SupportCloud = () => (
-  <Provider>
-    <Support {...props} isCloud={true} />
-  </Provider>
-);
-
-export const SupportEnterprise = () => (
-  <Provider>
-    <Support {...props} isEnterprise={true} />
-  </Provider>
-);
-
-export const SupportEnterpriseWithCTA = () => (
-  <Provider>
-    <Support {...props} isEnterprise={true} showPremiumSupportCTA={true} />
+    <Support {...props} showPremiumSupportCta={true} />
   </Provider>
 );
 
@@ -85,6 +67,6 @@ const props: Props = {
   isEnterprise: false,
   isCloud: false,
   tunnelPublicAddress: null,
-  showPremiumSupportCTA: false,
+  showPremiumSupportCta: false,
   licenseExpiryDateText: '2027-05-09 06:52:58',
 };
diff --git a/web/packages/teleport/src/Support/Support.tsx b/web/packages/teleport/src/Support/Support.tsx
index 53d1271a697ac..0efa8b4cd463f 100644
--- a/web/packages/teleport/src/Support/Support.tsx
+++ b/web/packages/teleport/src/Support/Support.tsx
@@ -20,9 +20,9 @@ import React from 'react';
 import { Link } from 'react-router-dom';
 import styled from 'styled-components';
 
-import { Box, Flex, H2, H3, Text } from 'design';
+import { Box, Card, Flex, H2, H3, Text } from 'design';
 import * as Icons from 'design/Icon';
-import { MultiRowBox, Row } from 'design/MultiRowBox';
+import { P } from 'design/Text/Text';
 
 import { ButtonLockedFeature } from 'teleport/components/ButtonLockedFeature';
 import {
@@ -39,8 +39,8 @@ export function SupportContainer({ children }: { children?: React.ReactNode }) {
   const ctx = useTeleport();
   const cluster = ctx.storeUser.state.cluster;
 
-  // showCTA returns the premium support value for enterprise customers and true for OSS users
-  const showCTA = cfg.isEnterprise ? !cfg.premiumSupport : true;
+  // showCta returns the premium support value for enterprise customers and true for OSS users
+  const showCta = cfg.edition === 'ent' ? !cfg.premiumSupport : true;
 
   return (
     <Support
@@ -48,9 +48,11 @@ export function SupportContainer({ children }: { children?: React.ReactNode }) {
       isEnterprise={cfg.isEnterprise}
       tunnelPublicAddress={cfg.tunnelPublicAddress}
       isCloud={cfg.isCloud}
-      showPremiumSupportCTA={showCTA}
-      children={children}
-    />
+      showPremiumSupportCta={showCta}
+      authVersion={cluster.authVersion}
+    >
+      {children}
+    </Support>
   );
 }
 
@@ -63,47 +65,32 @@ export const Support = ({
   tunnelPublicAddress,
   isCloud,
   children,
-  showPremiumSupportCTA,
+  showPremiumSupportCta,
 }: Props) => {
   useNoMinWidth();
   const docs = getDocUrls(authVersion, isEnterprise);
 
   return (
-    <FeatureBox maxWidth="2000px">
+    <FeatureBox maxWidth="2000px" p={{ _: 2, small: 6 }}>
       <FeatureHeader>
         <FeatureHeaderTitle>Help & Support</FeatureHeaderTitle>
       </FeatureHeader>
-      <StyledMultiRowBox mb={3}>
-        <StyledRow>
-          <Flex alignItems="center" justifyContent="start">
-            <IconBox>
-              <Icons.Cluster />
-            </IconBox>
-            <H2>Cluster Information</H2>
-          </Flex>
-        </StyledRow>
-        <StyledRow
+      <SupportSectionsWrapper isCloud={isCloud}>
+        <SupportSectionCard
           css={`
-            padding-left: ${props => props.theme.space[6]}px;
+            grid-column: auto;
+            @media screen and (min-width: ${props =>
+                props.theme.breakpoints.small}) {
+              grid-column: span 2;
+            }
           `}
         >
-          <DataItem title="Cluster Name" data={clusterId} />
-          <DataItem title="Teleport Version" data={authVersion} />
-          <DataItem title="Public Address" data={publicURL} />
-          {tunnelPublicAddress && (
-            <DataItem title="Public SSH Tunnel" data={tunnelPublicAddress} />
-          )}
-          {isEnterprise && !cfg.isCloud && licenseExpiryDateText && (
-            <DataItem title="License Expiry" data={licenseExpiryDateText} />
-          )}
-        </StyledRow>
-      </StyledMultiRowBox>
-      <MobileSeparator />
-      <StyledMultiRowBox mb={3}>
-        <StyledRow>
-          <SupportContentFlex
-            alignItems="center"
+          <Flex
+            alignItems={{ _: 'flex-start', small: 'center' }}
             justifyContent="space-between"
+            flexDirection={{ _: 'column', small: 'row' }}
+            mb={3}
+            gap={2}
           >
             <Flex alignItems="center">
               <IconBox>
@@ -112,25 +99,19 @@ export const Support = ({
               <H2>Support and Resource Pages</H2>
             </Flex>
             <SupportButtonBox>
-              {showPremiumSupportCTA && (
+              {showPremiumSupportCta && (
                 <ButtonLockedFeature event={CtaEvent.CTA_PREMIUM_SUPPORT}>
-                  Unlock Premium Support w/Enterprise
+                  Unlock Premium Support with&nbsp;Enterprise
                 </ButtonLockedFeature>
               )}
             </SupportButtonBox>
-          </SupportContentFlex>
-        </StyledRow>
-        <StyledRow
-          css={`
-            padding-left: ${props => props.theme.space[6]}px;
-          `}
-        >
+          </Flex>
           <SupportLinksFlex>
-            <Box>
+            <SupportLinkCategory>
               <H3 ml={2} mb={1}>
-                Support
+                Contact Support
               </H3>
-              {isEnterprise && !showPremiumSupportCTA && (
+              {isEnterprise && !showPremiumSupportCta && (
                 <ExternalSupportLink
                   title="Create a Support Ticket"
                   url="https://support.goteleport.com"
@@ -148,8 +129,8 @@ export const Support = ({
                 title="Send Product Feedback"
                 url="mailto:support@goteleport.com"
               />
-            </Box>
-            <Box>
+            </SupportLinkCategory>
+            <SupportLinkCategory>
               <H3 ml={2} mb={1}>
                 Resources
               </H3>
@@ -165,8 +146,8 @@ export const Support = ({
               />
               <DownloadLink isCloud={isCloud} isEnterprise={isEnterprise} />
               <ExternalSupportLink title="FAQ" url={docs.faq} />
-            </Box>
-            <Box>
+            </SupportLinkCategory>
+            <SupportLinkCategory>
               <H3 ml={2} mb={1}>
                 Updates
               </H3>
@@ -178,35 +159,64 @@ export const Support = ({
                 title="Teleport Blog"
                 url="https://goteleport.com/blog/"
               />
-            </Box>
+            </SupportLinkCategory>
           </SupportLinksFlex>
-        </StyledRow>
-      </StyledMultiRowBox>
-      {children}
+        </SupportSectionCard>
+        <SupportSectionCard
+          css={
+            !isCloud &&
+            `
+            grid-column: span 2;
+            @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
+              grid-column: auto;
+            }
+          `
+          }
+        >
+          <Flex alignItems="center" justifyContent="start" mb={3}>
+            <IconBox>
+              <Icons.Cluster />
+            </IconBox>
+            <H2>Cluster Information</H2>
+          </Flex>
+          <Flex flexDirection="column" justifyContent="center">
+            <P>Cluster Name: {clusterId}</P>
+            <P>Teleport Version: {authVersion}</P>
+            <P>Public Address: {publicURL}</P>
+            {tunnelPublicAddress && (
+              <P>Public SSH Tunnel: {tunnelPublicAddress}</P>
+            )}
+            {isEnterprise && !cfg.isCloud && !!licenseExpiryDateText && (
+              <P>License Expiry: {licenseExpiryDateText}</P>
+            )}
+          </Flex>
+        </SupportSectionCard>
+
+        {children}
+      </SupportSectionsWrapper>
     </FeatureBox>
   );
 };
 
-export const StyledMultiRowBox = styled(MultiRowBox)`
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
-    border: none;
-  }
-`;
+const SupportSectionsWrapper = styled(Box)<{ isCloud?: boolean }>`
+  display: grid;
+  gap: ${props => props.theme.space[3]}px;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  grid-auto-rows: auto;
+  width: 100%;
 
-export const StyledRow = styled(Row)`
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
-    border: none !important;
-    padding-left: 0;
-    padding-bottom: 0;
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
+    grid-template-columns: 1fr !important;
+    gap: ${props => props.theme.space[2]}px;
   }
 `;
 
-export const MobileSeparator = styled.div`
-  width: 100vw;
-  margin-left: -${props => props.theme.space[6]}px;
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
-    border-bottom: ${props =>
-      `${props.theme.borders[1]} ${props.theme.colors.interactive.tonal.neutral[2]}`};
+export const SupportSectionCard = styled(Card)`
+  padding: ${props => props.theme.space[4]}px;
+  box-shadow: ${props => props.theme.boxShadow[0]};
+
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
+    padding: ${props => props.theme.space[3]}px;
   }
 `;
 
@@ -216,25 +226,28 @@ export const IconBox = styled(Box)`
   border-radius: ${props => props.theme.radii[3]}px;
   margin-right: ${props => props.theme.space[3]}px;
   background: ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  border: ${props => props.theme.borders[1]};
+  border-color: ${props => props.theme.colors.interactive.tonal.neutral[2]};
+
+  .icon {
+    height: 16px;
+    width: 16px;
+  }
 
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
     background: transparent;
     margin-right: ${props => props.theme.space[1]}px;
   }
 `;
 
-const SupportContentFlex = styled(Flex)`
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
-    flex-direction: column;
-    align-items: flex-start;
-  }
+const SupportLinkCategory = styled(Flex)`
+  flex-direction: column;
+  gap: ${props => props.theme.space[1]}px;
 `;
 
 const SupportButtonBox = styled(Box)`
-  width: 320px;
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
-    margin-left: ${props => props.theme.space[6]}px;
-    margin-top: ${props => props.theme.space[2]}px;
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
+    width: 100%;
   }
 `;
 
@@ -242,10 +255,10 @@ const SupportLinksFlex = styled(Flex)`
   justify-content: space-between;
   flex-wrap: wrap;
   max-width: 70%;
-  @media screen and (max-width: ${props => props.theme.breakpoints.tablet}) {
+  @media screen and (max-width: ${props => props.theme.breakpoints.medium}) {
     max-width: 100%;
   }
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
     flex-direction: column;
     gap: ${props => props.theme.space[3]}px;
     margin-bottom: ${props => props.theme.space[3]}px;
@@ -254,7 +267,7 @@ const SupportLinksFlex = styled(Flex)`
 
 const DataItemFlex = styled(Flex)`
   margin-bottom: ${props => props.theme.space[3]}px;
-  @media screen and (max-width: ${props => props.theme.breakpoints.mobile}) {
+  @media screen and (max-width: ${props => props.theme.breakpoints.small}) {
     flex-direction: column;
     padding-left: ${props => props.theme.space[2]}px;
   }
@@ -340,7 +353,6 @@ const StyledSupportLink = styled.a.attrs({
   color: ${props => props.theme.colors.text.main};
   border-radius: 4px;
   text-decoration: none;
-  margin-bottom: 8px;
   padding: 4px 8px;
   transition: all 0.3s;
 
@@ -368,5 +380,5 @@ export type Props = {
   isCloud: boolean;
   tunnelPublicAddress?: string;
   children?: React.ReactNode;
-  showPremiumSupportCTA: boolean;
+  showPremiumSupportCta: boolean;
 };
diff --git a/web/packages/teleport/src/Teleport.tsx b/web/packages/teleport/src/Teleport.tsx
index 572f3034ebaaf..00c7ae63e284d 100644
--- a/web/packages/teleport/src/Teleport.tsx
+++ b/web/packages/teleport/src/Teleport.tsx
@@ -20,11 +20,14 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { History } from 'history';
 import React, { Suspense, useEffect } from 'react';
 
+import { ToastNotificationProvider } from 'shared/components/ToastNotification';
+
 import Authenticated from 'teleport/components/Authenticated';
 import { CatchError } from 'teleport/components/CatchError';
 import { Route, Router, Switch } from 'teleport/components/Router';
 import { getOSSFeatures } from 'teleport/features';
 import { LayoutContextProvider } from 'teleport/Main/LayoutContext';
+import { ViewSessionRecordingRoute } from 'teleport/SessionRecordings/view/ViewSessionRecordingRoute';
 import { ThemeProvider, updateFavicon } from 'teleport/ThemeProvider';
 import { UserContextProvider } from 'teleport/User';
 import { NewCredentials } from 'teleport/Welcome/NewCredentials';
@@ -40,7 +43,6 @@ import { LoginFailedComponent as LoginFailed } from './Login/LoginFailed';
 import { LoginSuccess } from './Login/LoginSuccess';
 import { LoginTerminalRedirect } from './Login/LoginTerminalRedirect';
 import { Main } from './Main';
-import { Player } from './Player';
 import { SingleLogoutFailed } from './SingleLogoutFailed';
 import TeleportContext from './teleportContext';
 import TeleportContextProvider from './TeleportContextProvider';
@@ -101,15 +103,17 @@ const Teleport: React.FC<Props> = props => {
                   <Route path={cfg.routes.root}>
                     <Authenticated>
                       <UserContextProvider>
-                        <TeleportContextProvider ctx={ctx}>
-                          <Switch>
-                            <Route
-                              path={cfg.routes.appLauncher}
-                              component={AppLauncher}
-                            />
-                            <Route>{createPrivateRoutes()}</Route>
-                          </Switch>
-                        </TeleportContextProvider>
+                        <ToastNotificationProvider>
+                          <TeleportContextProvider ctx={ctx}>
+                            <Switch>
+                              <Route
+                                path={cfg.routes.appLauncher}
+                                component={AppLauncher}
+                              />
+                              <Route>{createPrivateRoutes()}</Route>
+                            </Switch>
+                          </TeleportContextProvider>
+                        </ToastNotificationProvider>
                       </UserContextProvider>
                     </Authenticated>
                   </Route>
@@ -192,6 +196,11 @@ function privateOSSRoutes() {
   return (
     <Switch>
       {getSharedPrivateRoutes()}
+      <Route
+        key="player"
+        path={cfg.routes.player}
+        component={ViewSessionRecordingRoute}
+      />
       <Route
         path={cfg.routes.root}
         render={() => <Main features={getOSSFeatures()} />}
@@ -208,7 +217,6 @@ export function getSharedPrivateRoutes() {
       component={DesktopSession}
     />,
     <Route key="console" path={cfg.routes.console} component={Console} />,
-    <Route key="player" path={cfg.routes.player} component={Player} />,
     <Route
       key="headlessSSO"
       path={cfg.routes.headlessSso}
diff --git a/web/packages/teleport/src/ThemeProvider.tsx b/web/packages/teleport/src/ThemeProvider.tsx
index b5825e407cef9..e0a1caff41bff 100644
--- a/web/packages/teleport/src/ThemeProvider.tsx
+++ b/web/packages/teleport/src/ThemeProvider.tsx
@@ -27,6 +27,8 @@ import { KeysEnum, storageService } from 'teleport/services/storageService';
 
 const customThemes = {
   bblp: bblpTheme,
+  // Lock mc to light theme, and flag it as a custom theme to disable the theme switcher.
+  mc: { ...lightTheme, isCustomTheme: true },
 };
 
 export const ThemeProvider = (props: { children?: ReactNode }) => {
diff --git a/web/packages/teleport/src/TopBar/DeviceTrustStatus.tsx b/web/packages/teleport/src/TopBar/DeviceTrustStatus.tsx
index a16834e65ad6c..2749308e4361d 100644
--- a/web/packages/teleport/src/TopBar/DeviceTrustStatus.tsx
+++ b/web/packages/teleport/src/TopBar/DeviceTrustStatus.tsx
@@ -30,7 +30,7 @@ const DeviceTrustText = ({ kind }: { kind: DeviceTrustStatusKind }) => {
   if (kind === 'authorized') {
     return (
       <StatusText color="success.active">
-        Session authorized with device trust.
+        Session authorized with Device Trust.
       </StatusText>
     );
   }
diff --git a/web/packages/teleport/src/UnifiedResources/ResourceActionButton.story.tsx b/web/packages/teleport/src/UnifiedResources/ResourceActionButton.story.tsx
index a91f5b6621664..56727be5cd706 100644
--- a/web/packages/teleport/src/UnifiedResources/ResourceActionButton.story.tsx
+++ b/web/packages/teleport/src/UnifiedResources/ResourceActionButton.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { MemoryRouter } from 'react-router';
 
 import { Flex, Stack, Text } from 'design';
@@ -26,6 +26,7 @@ import {
   awsConsoleApp,
   awsIamIcAccountApp,
   gcpCloudApp,
+  mcpApp,
 } from 'teleport/Apps/fixtures';
 import { databases } from 'teleport/Databases/fixtures';
 import { desktops } from 'teleport/Desktops/fixtures';
@@ -124,6 +125,11 @@ export function ResourceActionButton() {
             })}
           />
         </Stack>
+
+        <Stack>
+          <Text>MCP app</Text>
+          <Component resource={mcpApp} />
+        </Stack>
       </Stack>
 
       <Stack>
diff --git a/web/packages/teleport/src/UnifiedResources/ResourceActionButton.tsx b/web/packages/teleport/src/UnifiedResources/ResourceActionButton.tsx
index 6898c43c6501e..dc8c771a2b48a 100644
--- a/web/packages/teleport/src/UnifiedResources/ResourceActionButton.tsx
+++ b/web/packages/teleport/src/UnifiedResources/ResourceActionButton.tsx
@@ -27,8 +27,10 @@ import {
   MenuLogin,
 } from 'shared/components/MenuLogin';
 import { MenuLoginWithActionMenu } from 'shared/components/MenuLoginWithActionMenu';
+import { AppSubKind } from 'shared/services';
 import { AwsRole } from 'shared/services/apps';
 
+import { MCPAppConnectDialog } from 'teleport/Apps/MCPAppConnectDialog';
 import { TcpAppConnectDialog } from 'teleport/Apps/TcpAppConnectDialog';
 import cfg from 'teleport/config';
 import DbConnectDialog from 'teleport/Databases/ConnectDialog';
@@ -39,7 +41,7 @@ import KubeConnectDialog from 'teleport/Kubes/ConnectDialog';
 import { openNewTab } from 'teleport/lib/util';
 import { useSamlAppAction } from 'teleport/SamlApplications/useSamlAppActions';
 import { UnifiedResource } from 'teleport/services/agents';
-import { App, AppSubKind, SamlAppLaunchUrl } from 'teleport/services/apps';
+import { App, SamlAppLaunchUrl } from 'teleport/services/apps';
 import { Database } from 'teleport/services/databases';
 import { Desktop } from 'teleport/services/desktops';
 import { Kube } from 'teleport/services/kube';
@@ -226,6 +228,9 @@ const AppLaunch = ({ app }: AppLaunchProps) => {
       </ButtonBorder>
     );
   }
+  if (subKind === AppSubKind.MCP) {
+    return <MCPAppConnect app={app} />;
+  }
   if (isTcp) {
     return <TcpAppConnect app={app} />;
   }
@@ -410,6 +415,28 @@ function TcpAppConnect({ app }: { app: App }) {
   );
 }
 
+/**
+ * MCPAppConnect is the button on an MCP app resource that opens the MCP connect
+ * dialog.
+ */
+function MCPAppConnect({ app }: { app: App }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <ButtonBorder
+        textTransform="none"
+        width="123px"
+        size="small"
+        onClick={() => setOpen(true)}
+      >
+        Connect
+      </ButtonBorder>
+      {open && <MCPAppConnectDialog app={app} onClose={() => setOpen(false)} />}
+    </>
+  );
+}
+
 const makeNodeOptions = (clusterId: string, node: Node | undefined) => {
   const nodeLogins = node?.sshLogins || [];
   const logins = sortNodeLogins(nodeLogins);
@@ -471,7 +498,7 @@ function makeSamlAppLoginWithMenuButton(
       return (
         <MenuLoginWithActionMenu
           getLoginItems={() => makeSamlAppLoginOptions(launchUrls)}
-          width="100px"
+          menuWidth="100px"
           onSelect={() => {}} // login item rendered as <a> link for saml apps.
           buttonText="Log In"
           size="small"
@@ -488,7 +515,7 @@ function makeSamlAppLoginWithMenuButton(
   return (
     <ButtonWithMenu
       text="Log In"
-      width="100px"
+      buttonWidth="100px"
       size="small"
       target="_blank"
       href={ssoUrl}
diff --git a/web/packages/teleport/src/UnifiedResources/StatusInfo.tsx b/web/packages/teleport/src/UnifiedResources/StatusInfo.tsx
index df90e9cf021fb..859b2a7b66bda 100644
--- a/web/packages/teleport/src/UnifiedResources/StatusInfo.tsx
+++ b/web/packages/teleport/src/UnifiedResources/StatusInfo.tsx
@@ -18,6 +18,7 @@
 
 import {
   DatabaseServer,
+  KubeServer,
   SharedResourceServer,
   UnifiedResourceDefinition,
   useResourceServersFetch,
@@ -25,6 +26,7 @@ import {
 import { UnhealthyStatusInfo } from 'shared/components/UnifiedResources/shared/StatusInfo';
 
 import { fetchDatabaseServers } from 'teleport/services/databases/databases';
+import { fetchKubeServers } from 'teleport/services/kube/kube';
 
 export function StatusInfo({
   resource,
@@ -42,24 +44,45 @@ export function StatusInfo({
     attempt: fetchResourceServersAttempt,
   } = useResourceServersFetch<SharedResourceServer>({
     fetchFunc: async (params, signal) => {
-      if (resource.kind === 'db') {
-        const response = await fetchDatabaseServers({
-          clusterId,
-          params: {
-            ...params,
-            query: `name == "${resource.name}"`,
-            searchAsRoles: resource.requiresRequest ? 'yes' : '',
-          },
-          signal,
-        });
-        const servers: DatabaseServer[] = response.agents.map(d => ({
-          kind: 'db_server',
-          ...d,
-        }));
-        return {
-          agents: servers,
-          startKey: response.startKey,
-        };
+      switch (resource.kind) {
+        case 'db': {
+          const response = await fetchDatabaseServers({
+            clusterId,
+            params: {
+              ...params,
+              query: `name == "${resource.name}"`,
+              searchAsRoles: resource.requiresRequest ? 'yes' : '',
+            },
+            signal,
+          });
+          const servers: DatabaseServer[] = response.agents.map(d => ({
+            kind: 'db_server',
+            ...d,
+          }));
+          return {
+            agents: servers,
+            startKey: response.startKey,
+          };
+        }
+        case 'kube_cluster': {
+          const response = await fetchKubeServers({
+            clusterId,
+            params: {
+              ...params,
+              query: `name == "${resource.name}"`,
+              searchAsRoles: resource.requiresRequest ? 'yes' : '',
+            },
+            signal,
+          });
+          const servers: KubeServer[] = response.agents.map(d => ({
+            kind: 'kube_server',
+            ...d,
+          }));
+          return {
+            agents: servers,
+            startKey: response.startKey,
+          };
+        }
       }
     },
   });
diff --git a/web/packages/teleport/src/UnifiedResources/UnifiedResources.tsx b/web/packages/teleport/src/UnifiedResources/UnifiedResources.tsx
index 7f8e2cbcc99c6..7002fc2cb91d4 100644
--- a/web/packages/teleport/src/UnifiedResources/UnifiedResources.tsx
+++ b/web/packages/teleport/src/UnifiedResources/UnifiedResources.tsx
@@ -33,6 +33,7 @@ import {
   UnifiedResourcesPinning,
   useUnifiedResourcesFetch,
 } from 'shared/components/UnifiedResources';
+import { buildPredicateExpression } from 'shared/components/UnifiedResources/shared/predicateExpression';
 import {
   getResourceId,
   openStatusInfoPanel,
@@ -82,7 +83,7 @@ export function UnifiedResources() {
   );
 }
 
-const ResizingResourceWrapper = styled(Box)`
+export const ResizingResourceWrapper = styled(Box)`
   width: 100%;
   padding-right: ${props => props.theme.space[3]}px;
 `;
@@ -113,6 +114,10 @@ const getAvailableKindsWithAccess = (flags: FeatureFlags): FilterKind[] => {
       kind: 'git_server',
       disabled: !flags.gitServers,
     },
+    {
+      kind: 'mcp',
+      disabled: !flags.applications,
+    },
   ];
 };
 
@@ -187,7 +192,7 @@ export function ClusterResources({
           clusterId,
           {
             search: params.search,
-            query: params.query,
+            query: buildPredicateExpression(params.statuses, params.query),
             pinnedOnly: params.pinnedOnly,
             sort: params.sort,
             kinds: params.kinds,
@@ -213,6 +218,7 @@ export function ClusterResources({
         params.search,
         params.sort,
         params.includedResourceMode,
+        params.statuses,
         teleCtx.resourceService,
       ]
     ),
diff --git a/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.story.tsx b/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.story.tsx
index a994cc5d304b8..fb4fd7200e76c 100644
--- a/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.story.tsx
+++ b/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-vite';
 import { delay } from 'msw';
 
 import type { TraitsOption } from 'shared/components/TraitsEditor';
@@ -40,6 +40,7 @@ export const Create: StoryObj = {
       isNew: true,
       name: '',
       fetchRoles: async () => [],
+      modifyFetchedData: () => null,
       selectedRoles: [],
       user: {
         name: '',
@@ -125,6 +126,7 @@ const props = {
     name: 'lester',
     roles: ['editor'],
   },
+  modifyFetchedData: () => null,
   isNew: false,
   onChangeName() {},
   onChangeRoles() {},
diff --git a/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.tsx b/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.tsx
index 76fa588e6dd75..e35c6ae74e3d5 100644
--- a/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.tsx
+++ b/web/packages/teleport/src/Users/UserAddEdit/UserAddEdit.tsx
@@ -38,6 +38,7 @@ import Validation from 'shared/components/Validation';
 import { requiredField } from 'shared/components/Validation/rules';
 
 import { useTeleport } from 'teleport';
+import { ResourcesResponse } from 'teleport/services/agents';
 import auth from 'teleport/services/auth';
 import userService, {
   ExcludeUserField,
@@ -53,9 +54,17 @@ interface UserAddEditProps {
   user: User;
   isNew: boolean;
   onClose: () => void;
+  modifyFetchedData: React.Dispatch<
+    React.SetStateAction<ResourcesResponse<User>>
+  >;
 }
 
-export function UserAddEdit({ onClose, isNew, user }: UserAddEditProps) {
+export function UserAddEdit({
+  onClose,
+  isNew,
+  user,
+  modifyFetchedData,
+}: UserAddEditProps) {
   const ctx = useTeleport();
 
   const queryClient = useQueryClient();
@@ -140,17 +149,40 @@ export function UserAddEdit({ onClose, isNew, user }: UserAddEditProps) {
     };
 
     if (isNew) {
-      await createUser.mutateAsync({
+      const createdUser = (await createUser.mutateAsync({
         user: u,
         excludeUserField: ExcludeUserField.Traits,
+      })) as { user: User; token: ResetToken };
+
+      // We have to update the user list on the clientside for the change to be visible immediately
+      // without needing to refresh.
+      modifyFetchedData(p => {
+        return {
+          ...p,
+          agents: [createdUser.user, ...p.agents],
+        };
       });
 
       return;
     }
 
-    await updateUser.mutateAsync({
+    const updatedUser = (await updateUser.mutateAsync({
       user: u,
       excludeUserField: ExcludeUserField.Traits,
+    })) as User;
+
+    // We have to update the user on the clientside for the change to be visible immediately
+    // without needing to refresh.
+    modifyFetchedData(p => {
+      const index = p.agents.findIndex(a => a.name === updatedUser.name);
+      if (index >= 0) {
+        const newUsers = [...p.agents];
+        newUsers[index] = updatedUser;
+        return {
+          ...p,
+          agents: newUsers,
+        };
+      }
     });
 
     onClose();
@@ -209,6 +241,7 @@ export function UserAddEdit({ onClose, isNew, user }: UserAddEditProps) {
                 value={name}
                 onChange={e => onChangeName(e.target.value)}
                 readonly={!isNew}
+                disabled={isLoading}
               />
               <FieldSelectAsync
                 mr={2}
@@ -227,6 +260,7 @@ export function UserAddEdit({ onClose, isNew, user }: UserAddEditProps) {
                   return roles.map(r => ({ value: r, label: r }));
                 }}
                 elevated={true}
+                isDisabled={isLoading}
               />
               <TraitsEditor
                 isLoading={isLoading}
diff --git a/web/packages/teleport/src/Users/UserDelete/UserDelete.story.tsx b/web/packages/teleport/src/Users/UserDelete/UserDelete.story.tsx
index d304e0d123834..63dafa8ff7e3f 100644
--- a/web/packages/teleport/src/Users/UserDelete/UserDelete.story.tsx
+++ b/web/packages/teleport/src/Users/UserDelete/UserDelete.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-vite';
 import { delay } from 'msw';
 
 import { TeleportProviderBasic } from 'teleport/mocks/providers';
@@ -77,4 +77,5 @@ const props = {
   username: 'somename',
   onDelete: () => null,
   onClose: () => null,
+  modifyFetchedData: () => null,
 };
diff --git a/web/packages/teleport/src/Users/UserDelete/UserDelete.tsx b/web/packages/teleport/src/Users/UserDelete/UserDelete.tsx
index 7314c4cd31785..e5996d1c2b411 100644
--- a/web/packages/teleport/src/Users/UserDelete/UserDelete.tsx
+++ b/web/packages/teleport/src/Users/UserDelete/UserDelete.tsx
@@ -26,15 +26,23 @@ import Dialog, {
   DialogTitle,
 } from 'design/Dialog';
 
-import userService from 'teleport/services/user';
+import { ResourcesResponse } from 'teleport/services/agents';
+import userService, { User } from 'teleport/services/user';
 import { GetUsersQueryKey } from 'teleport/services/user/hooks';
 
 interface UserDeleteProps {
   username: string;
   onClose(): void;
+  modifyFetchedData: React.Dispatch<
+    React.SetStateAction<ResourcesResponse<User>>
+  >;
 }
 
-export function UserDelete({ username, onClose }: UserDeleteProps) {
+export function UserDelete({
+  username,
+  onClose,
+  modifyFetchedData,
+}: UserDeleteProps) {
   const queryClient = useQueryClient();
 
   const deleteUser = useMutation({
@@ -53,6 +61,11 @@ export function UserDelete({ username, onClose }: UserDeleteProps) {
   async function handleDelete() {
     await deleteUser.mutateAsync(username);
 
+    modifyFetchedData(p => {
+      p.agents = p.agents.filter(user => user.name !== username);
+      return p;
+    });
+
     onClose();
   }
 
diff --git a/web/packages/teleport/src/Users/UserDetails/UserDetails.story.tsx b/web/packages/teleport/src/Users/UserDetails/UserDetails.story.tsx
new file mode 100644
index 0000000000000..fe5f487e5d2d2
--- /dev/null
+++ b/web/packages/teleport/src/Users/UserDetails/UserDetails.story.tsx
@@ -0,0 +1,272 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { http, HttpResponse } from 'msw';
+
+import { SlidingSidePanel } from 'shared/components/SlidingSidePanel';
+import { InfoGuideContainer } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { ContextProvider } from 'teleport';
+import cfg from 'teleport/config';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { User } from 'teleport/services/user';
+
+import {
+  UserDetails,
+  UserDetailsAuthType,
+  UserDetailsTitle,
+} from './UserDetails';
+
+export type UserDetailsStoryProps = {
+  userType: UserDetailsAuthType;
+  isBot: boolean;
+  userName: string;
+  rolesCount: number;
+  traitsCount: number;
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+const meta: Meta<UserDetailsStoryProps> = {
+  title: 'Teleport/Users/UserDetails',
+  component: Story,
+  excludeStories: ['createMockUser'],
+  beforeEach: () => {
+    queryClient.clear();
+  },
+  decorators: [
+    Story => {
+      const ctx = createTeleportContext();
+      cfg.proxyCluster = 'localhost';
+
+      return (
+        <QueryClientProvider client={queryClient}>
+          <ContextProvider ctx={ctx}>
+            <Story />
+          </ContextProvider>
+        </QueryClientProvider>
+      );
+    },
+  ],
+  argTypes: {
+    userType: {
+      control: { type: 'select' },
+      options: ['local', 'github', 'saml', 'oidc', 'okta', 'scim'],
+    },
+    isBot: {
+      control: { type: 'boolean' },
+    },
+    userName: {
+      control: { type: 'text' },
+    },
+    rolesCount: {
+      control: { type: 'select' },
+      options: [0, 5, 16, 128],
+    },
+    traitsCount: {
+      control: { type: 'select' },
+      options: [0, 5, 16, 128],
+    },
+  },
+  args: {
+    userType: 'local' as const,
+    isBot: false,
+    userName: 'john.the.user',
+    rolesCount: 16,
+    traitsCount: 5,
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<UserDetailsStoryProps>;
+
+function generateRoles(count: number) {
+  if (!count || count < 0) return [];
+
+  const adjectives = [
+    'readonly',
+    'enterprise',
+    'dev',
+    'jit',
+    'admin',
+    'system',
+    'remote',
+    'staging',
+    'prod',
+    'temp',
+  ];
+  const roleNouns = [
+    'auditor',
+    'editor',
+    'operator',
+    'viewer',
+    'manager',
+    'analyst',
+    'developer',
+    'security',
+    'support',
+    'backup',
+  ];
+  const baseRoles = ['access', 'auditor', 'editor'];
+
+  const generateRole = (index: number) => {
+    const adjIndex = index % adjectives.length;
+    const nounIndex = index % roleNouns.length;
+    return `${adjectives[adjIndex]}-${roleNouns[nounIndex]}`;
+  };
+
+  return [
+    ...baseRoles.slice(0, Math.min(count, baseRoles.length)),
+    ...Array.from({ length: Math.max(0, count - baseRoles.length) }, (_, i) =>
+      generateRole(i)
+    ),
+  ];
+}
+
+function generateTraits(count: number) {
+  if (!count || count < 0) return undefined;
+
+  const traitKeys = [
+    'logins',
+    'databaseUsers',
+    'databaseNames',
+    'kubeUsers',
+    'kubeGroups',
+    'windowsLogins',
+    'awsRoleArns',
+  ];
+
+  const traits: Record<string, string[]> = {};
+  const selectedKeys = traitKeys.slice(0, Math.min(count, traitKeys.length));
+
+  selectedKeys.forEach(key => {
+    const valueCount = 1 + Math.floor(Math.random() * 3);
+    traits[key] = Array.from(
+      { length: valueCount },
+      (_, i) => `${key}-${i + 1}`
+    );
+  });
+
+  return traits;
+}
+
+function getUserConfig(userType: UserDetailsAuthType | 'local') {
+  switch (userType) {
+    case 'local':
+      return {
+        authType: 'local',
+        origin: undefined,
+        isLocal: true,
+      };
+    case 'github':
+      return {
+        authType: 'github',
+        origin: undefined,
+        isLocal: false,
+      };
+    case 'saml':
+      return {
+        authType: 'saml',
+        origin: undefined,
+        isLocal: false,
+      };
+    case 'oidc':
+      return {
+        authType: 'oidc',
+        origin: undefined,
+        isLocal: false,
+      };
+    case 'okta':
+      return {
+        authType: 'saml',
+        origin: 'okta' as const,
+        isLocal: false,
+      };
+    case 'scim':
+      return {
+        authType: 'saml',
+        origin: 'scim' as const,
+        isLocal: false,
+      };
+    default:
+      return {
+        authType: 'local',
+        origin: undefined,
+        isLocal: true,
+      };
+  }
+}
+
+export function createMockUser(props: UserDetailsStoryProps): User {
+  const config = getUserConfig(props.userType);
+
+  return {
+    name: props.userName,
+    authType: config.authType,
+    origin: config.origin,
+    isBot: props.isBot,
+    isLocal: config.isLocal,
+    roles: generateRoles(props.rolesCount),
+    allTraits: generateTraits(props.traitsCount),
+  };
+}
+
+function Story(props: UserDetailsStoryProps) {
+  const user = createMockUser(props);
+
+  return (
+    <SlidingSidePanel
+      panelWidth={480}
+      isVisible={true}
+      slideFrom="right"
+      zIndex={1}
+      skipAnimation={false}
+    >
+      <InfoGuideContainer
+        onClose={() => null}
+        title={<UserDetailsTitle user={user} />}
+      >
+        <UserDetails user={user} />
+      </InfoGuideContainer>
+    </SlidingSidePanel>
+  );
+}
+
+export const BasicUser: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get('/v2/webapi/sites/:clusterId/locks', () => {
+          return HttpResponse.json({
+            items: [],
+          });
+        }),
+      ],
+    },
+  },
+};
diff --git a/web/packages/teleport/src/Users/UserDetails/UserDetails.tsx b/web/packages/teleport/src/Users/UserDetails/UserDetails.tsx
new file mode 100644
index 0000000000000..41dd6ed2f8302
--- /dev/null
+++ b/web/packages/teleport/src/Users/UserDetails/UserDetails.tsx
@@ -0,0 +1,313 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Link } from 'react-router-dom';
+import styled from 'styled-components';
+
+import { Box, Button, Flex, Label, Text } from 'design';
+import * as Icons from 'design/Icon';
+import { MoreVert } from 'design/Icon';
+import { ResourceIcon, ResourceIconName } from 'design/ResourceIcon';
+import { MenuIcon, MenuItem } from 'shared/components/MenuAction';
+import {
+  InfoParagraph,
+  InfoTitle,
+} from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import cfg from 'teleport/config';
+import { useResourceLock } from 'teleport/lib/locks/useResourceLock';
+import { User } from 'teleport/services/user';
+
+import { UserRoles } from './UserRoles';
+import { UserTraits } from './UserTraits';
+
+type AuthTypeInfo = {
+  text: string;
+  icon: ResourceIconName;
+};
+
+const authTypeMap: Record<string, AuthTypeInfo> = {
+  github: { text: 'GitHub', icon: 'github' },
+  oidc: { text: 'OIDC', icon: 'openid' },
+  okta: { text: 'Okta', icon: 'okta' },
+  scim: { text: 'SCIM', icon: 'scim' },
+  saml: { text: 'SAML', icon: 'application' },
+};
+
+export type UserDetailsAuthType = keyof typeof authTypeMap;
+
+export interface UserDetailsSectionProps {
+  user: User;
+  onEdit?: () => void;
+}
+
+export interface UserDetailsProps {
+  user: User;
+  sections?: React.ComponentType<UserDetailsSectionProps>[];
+  onEdit?: () => void;
+}
+
+export function UserDetails({
+  user,
+  sections = [UserRoles, UserTraits],
+  onEdit,
+}: UserDetailsProps) {
+  if (!user) return null;
+
+  const { isLocked, isLoading: isLoadingLocks } = useResourceLock({
+    targetKind: 'user',
+    targetName: user.name,
+  });
+
+  return (
+    <Box>
+      <UserDetailsSection>
+        <InfoTitle>User details</InfoTitle>
+        <InfoParagraph>
+          <UserDetailsGrid>
+            <UserDetailField>
+              <Text fontWeight="medium">Username</Text>
+              <Text color="text.muted">{user.name}</Text>
+            </UserDetailField>
+            <UserDetailField>
+              <Text fontWeight="medium">Auth Type</Text>
+              <Text color="text.muted" style={{ textTransform: 'capitalize' }}>
+                {renderAuthType(user).text}
+              </Text>
+            </UserDetailField>
+            <UserDetailField>
+              <Text fontWeight="medium">Status</Text>
+              <Flex flexDirection="column" alignItems="flex-start" gap={1}>
+                <Flex alignItems="center" gap={2}>
+                  <Box
+                    width="8px"
+                    height="8px"
+                    borderRadius="50%"
+                    backgroundColor={
+                      isLoadingLocks
+                        ? 'text.muted'
+                        : isLocked
+                          ? 'error.main'
+                          : 'success.main'
+                    }
+                  />
+                  <Text color="text.muted">
+                    {isLoadingLocks
+                      ? 'Unknown'
+                      : isLocked
+                        ? 'Locked'
+                        : 'Active'}
+                  </Text>
+                </Flex>
+                {isLocked && (
+                  <Button
+                    as={Link}
+                    to={cfg.routes.locks}
+                    size="small"
+                    intent="neutral"
+                    gap={1}
+                  >
+                    <Text color="text.muted">View Locks</Text>
+                    <Icons.ArrowRight color="text.muted" size="small" />
+                  </Button>
+                )}
+              </Flex>
+            </UserDetailField>
+          </UserDetailsGrid>
+        </InfoParagraph>
+      </UserDetailsSection>
+
+      {sections.map((SectionComponent, index) => (
+        <UserDetailsSection key={index}>
+          <SectionComponent user={user} onEdit={onEdit} />
+        </UserDetailsSection>
+      ))}
+    </Box>
+  );
+}
+
+const UserDetailsActions = ({
+  user,
+  onEdit,
+  onReset,
+  onDelete,
+}: {
+  user: User;
+  onEdit?: () => void;
+  onReset?: () => void;
+  onDelete?: () => void;
+}) => {
+  if (!(onEdit || onDelete)) {
+    return null;
+  }
+
+  if (user.isBot || !user.isLocal) {
+    return null;
+  }
+
+  return (
+    <MenuIcon
+      Icon={MoreVert}
+      menuProps={{
+        anchorOrigin: {
+          vertical: 'bottom',
+          horizontal: 'right',
+        },
+        transformOrigin: {
+          vertical: 'top',
+          horizontal: 'right',
+        },
+      }}
+    >
+      {onEdit && <MenuItem onClick={onEdit}>Edit</MenuItem>}
+      {onReset && <MenuItem onClick={onReset}>Reset Authentication</MenuItem>}
+      {onDelete && <MenuItem onClick={onDelete}>Delete</MenuItem>}
+    </MenuIcon>
+  );
+};
+
+export interface UserDetailsTitleProps {
+  user: User;
+  onEdit?: () => void;
+  onReset?: () => void;
+  onDelete?: () => void;
+  panelWidth?: number;
+}
+
+export function UserDetailsTitle({
+  user,
+  onEdit,
+  onReset,
+  onDelete,
+  panelWidth = 480,
+}: UserDetailsTitleProps) {
+  const { text: authType, icon } = renderAuthType(user);
+
+  // needed to fill InfoGuidePanel for UserDetailsActions
+  const containerWidth = panelWidth - 80;
+  const userIconSize = 48;
+
+  return (
+    <Flex
+      alignItems="center"
+      justifyContent="space-between"
+      minWidth={`${containerWidth}px`}
+    >
+      <Flex alignItems="center" gap={3}>
+        {user.isBot ? (
+          <Icons.Bots size={userIconSize} />
+        ) : (
+          <Icons.User size={userIconSize} />
+        )}
+        <Box maxWidth={containerWidth - 96}>
+          <Text fontSize={3} fontWeight="bold" title={user.name}>
+            {user.name}
+          </Text>
+          <Flex alignItems="center" gap={2}>
+            <ResourceIcon name={icon} width="16px" height="16px" />
+            <Text
+              fontSize={2}
+              color="text.muted"
+              fontWeight="normal"
+              style={{ textTransform: 'capitalize' }}
+            >
+              {authType}
+              {user.isBot ? ' (Bot)' : ''}
+            </Text>
+          </Flex>
+        </Box>
+      </Flex>
+      <UserDetailsActions
+        user={user}
+        onEdit={onEdit}
+        onReset={onReset}
+        onDelete={onDelete}
+      />
+    </Flex>
+  );
+}
+
+function renderAuthType(user: User): AuthTypeInfo {
+  const key =
+    user.authType === 'saml' && user.origin ? user.origin : user.authType;
+  return authTypeMap[key] || { text: user.authType, icon: 'server' };
+}
+
+export const SectionTitle = styled(InfoTitle)`
+  min-height: ${props => props.theme.space[4]}px;
+`;
+
+export const SectionParagraph = InfoParagraph;
+
+export const UserDetailsSection = styled(Box)`
+  border-bottom: 1px solid
+    ${props => props.theme.colors.interactive.tonal.neutral[0]};
+  margin: -${props => props.theme.space[3]}px;
+  padding: ${props => props.theme.space[3]}px;
+  min-height: 116px;
+
+  &:last-child {
+    border-bottom: none;
+    padding-bottom: 0;
+  }
+`;
+
+export const UserDetailsGrid = styled.div`
+  display: grid;
+  grid-template-columns: 3fr 2fr;
+  gap: 12px;
+`;
+
+export const UserDetailField = styled.div`
+  display: flex;
+  flex-direction: column;
+  gap: ${props => props.theme.space[1]}px;
+`;
+
+export const StyledInfoParagraph = styled(InfoParagraph)`
+  border-bottom: 1px solid ${props => props.theme.colors.levels.sunken};
+
+  margin: -${props => props.theme.space[3]}px;
+  padding: ${props => props.theme.space[3]}px;
+
+  &:last-child {
+    border-bottom: none;
+    padding-bottom: 0;
+  }
+`;
+
+export const ClickableLabel = styled(Label)`
+  cursor: pointer;
+  background: ${props => props.theme.colors.interactive.tonal.informational[0]};
+  color: ${props => props.theme.colors.text.slightlyMuted};
+
+  &:hover {
+    background: ${props =>
+      props.theme.colors.interactive.tonal.informational[1]};
+    color: ${props => props.theme.colors.text.main};
+  }
+`;
+
+export const ExpandableContainer = styled.div<{ isExpanded: boolean }>`
+  ${props =>
+    props.isExpanded &&
+    `
+    max-height: 200px;
+    overflow-y: auto;
+  `}
+`;
diff --git a/web/packages/teleport/src/Users/UserDetails/UserRoles.tsx b/web/packages/teleport/src/Users/UserDetails/UserRoles.tsx
new file mode 100644
index 0000000000000..0a0aeb3235864
--- /dev/null
+++ b/web/packages/teleport/src/Users/UserDetails/UserRoles.tsx
@@ -0,0 +1,99 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import { Button, Flex, Label, Text } from 'design';
+import * as Icons from 'design/Icon';
+
+import {
+  ClickableLabel,
+  ExpandableContainer,
+  SectionParagraph,
+  SectionTitle,
+  type UserDetailsSectionProps,
+} from './UserDetails';
+
+export function UserRoles({ user, onEdit }: UserDetailsSectionProps) {
+  const [isExpanded, setIsExpanded] = useState(false);
+
+  const roles = user.roles || [];
+  const initialItemCount = 7;
+  const rolesToShow = isExpanded ? roles : roles.slice(0, initialItemCount);
+  const hasMoreRoles = roles.length > initialItemCount;
+
+  return (
+    <>
+      <SectionTitle>
+        <Flex justifyContent="space-between">
+          <span>Roles ({roles.length})</span>
+          {onEdit && (
+            <Button
+              fill="minimal"
+              intent="neutral"
+              onClick={onEdit}
+              size="small"
+              gap={1}
+            >
+              <Icons.Edit size="small" />
+              Edit
+            </Button>
+          )}
+        </Flex>
+      </SectionTitle>
+      <SectionParagraph>
+        {roles.length === 0 ? (
+          <Text color="text.muted">No roles assigned.</Text>
+        ) : (
+          <>
+            <ExpandableContainer isExpanded={isExpanded}>
+              <Flex rowGap={1} columnGap={2} flexWrap="wrap">
+                {rolesToShow.map(role => (
+                  <Label key={role} kind="secondary">
+                    <Flex gap={1}>
+                      <Icons.UserIdBadge size={16} />
+                      {role}
+                    </Flex>
+                  </Label>
+                ))}
+                {hasMoreRoles && !isExpanded && (
+                  <ClickableLabel
+                    kind="secondary"
+                    onClick={() => setIsExpanded(!isExpanded)}
+                  >
+                    + {roles.length - initialItemCount} more
+                  </ClickableLabel>
+                )}
+              </Flex>
+            </ExpandableContainer>
+            {hasMoreRoles && isExpanded && (
+              <Flex mt={2}>
+                <ClickableLabel
+                  kind="secondary"
+                  onClick={() => setIsExpanded(!isExpanded)}
+                >
+                  Show less
+                </ClickableLabel>
+              </Flex>
+            )}
+          </>
+        )}
+      </SectionParagraph>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/Users/UserDetails/UserTraits.tsx b/web/packages/teleport/src/Users/UserDetails/UserTraits.tsx
new file mode 100644
index 0000000000000..bf74088224d9d
--- /dev/null
+++ b/web/packages/teleport/src/Users/UserDetails/UserTraits.tsx
@@ -0,0 +1,78 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled from 'styled-components';
+
+import { Button, Flex, Label, Text } from 'design';
+import * as Icons from 'design/Icon';
+
+import {
+  SectionParagraph,
+  SectionTitle,
+  type UserDetailsSectionProps,
+} from './UserDetails';
+
+export function UserTraits({ user, onEdit }: UserDetailsSectionProps) {
+  const allTraits = user.allTraits || [];
+  const traitsWithValues = Object.keys(allTraits).filter(
+    key =>
+      user.allTraits[key].length > 0 &&
+      user.allTraits[key].some(value => value.trim() !== '')
+  );
+
+  return (
+    <>
+      <SectionTitle>
+        <Flex justifyContent="space-between">
+          <span>Traits</span>
+          {onEdit && (
+            <Button
+              size="small"
+              fill="minimal"
+              intent="neutral"
+              onClick={onEdit}
+              gap={1}
+            >
+              <Icons.Edit size="small" />
+              Edit
+            </Button>
+          )}
+        </Flex>
+      </SectionTitle>
+      <SectionParagraph>
+        {traitsWithValues.length === 0 ? (
+          <Text color="text.muted">No traits assigned.</Text>
+        ) : (
+          <Flex flexWrap="wrap" gap={2}>
+            {traitsWithValues.map(key => (
+              <StyledLabel key={key} kind="secondary">
+                {key}: {user.allTraits[key].join(', ')}
+              </StyledLabel>
+            ))}
+          </Flex>
+        )}
+      </SectionParagraph>
+    </>
+  );
+}
+
+// border-radius matches label height (10px font-size + 2px margin)
+// otherwise, a label with many traits will look like an egg
+const StyledLabel = styled(Label)`
+  border-radius: 12px;
+`;
diff --git a/web/packages/teleport/src/Users/UserDetails/index.ts b/web/packages/teleport/src/Users/UserDetails/index.ts
new file mode 100644
index 0000000000000..be757986b4f91
--- /dev/null
+++ b/web/packages/teleport/src/Users/UserDetails/index.ts
@@ -0,0 +1,27 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export {
+  UserDetails,
+  type UserDetailsProps,
+  UserDetailsTitle,
+  type UserDetailsSectionProps,
+} from './UserDetails';
+
+export { UserRoles } from './UserRoles';
+export { UserTraits } from './UserTraits';
diff --git a/web/packages/teleport/src/Users/UserList/UserList.tsx b/web/packages/teleport/src/Users/UserList/UserList.tsx
index 507df4e3e9ab8..6fcfbd246e5df 100644
--- a/web/packages/teleport/src/Users/UserList/UserList.tsx
+++ b/web/packages/teleport/src/Users/UserList/UserList.tsx
@@ -16,52 +16,75 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Cell, LabelCell } from 'design/DataTable';
+import { useTheme } from 'styled-components';
+
+import Table, { Cell, LabelCell } from 'design/DataTable';
 import { MenuButton, MenuItem } from 'shared/components/MenuAction';
+import { SearchPanel } from 'shared/components/Search';
 
-import { ClientSearcheableTableWithQueryParamSupport } from 'teleport/components/ClientSearcheableTableWithQueryParamSupport';
+import { SeversidePagination } from 'teleport/components/hooks/useServersidePagination';
 import { Access, User, UserOrigin } from 'teleport/services/user';
 
 export default function UserList({
-  users = [],
-  pageSize = 20,
   onEdit,
   onDelete,
   onReset,
+  onUserClick,
+  onSearchChange,
+  search,
+  serversidePagination,
   usersAcl,
+  selectedUser,
 }: Props) {
+  const theme = useTheme();
+  const canEdit = usersAcl.edit;
+  const canDelete = usersAcl.remove;
+
   return (
-    <ClientSearcheableTableWithQueryParamSupport
-      data={users}
+    <Table
+      data={serversidePagination.fetchedData.agents}
+      fetching={{
+        fetchStatus: serversidePagination.fetchStatus,
+        onFetchNext: serversidePagination.fetchNext,
+        onFetchPrev: serversidePagination.fetchPrev,
+      }}
+      serversideProps={{
+        sort: undefined,
+        setSort: () => undefined,
+        serversideSearchPanel: (
+          <SearchPanel
+            updateSearch={onSearchChange}
+            updateQuery={null}
+            hideAdvancedSearch={true}
+            filter={{ search }}
+            disableSearch={serversidePagination.fetchStatus === 'loading'}
+          />
+        ),
+      }}
+      row={{
+        onClick: onUserClick,
+        getStyle: (user: User) => {
+          if (selectedUser?.name === user.name) {
+            return {
+              backgroundColor: theme.colors.interactive.tonal.primary[0],
+            };
+          }
+          return { cursor: 'pointer' };
+        },
+      }}
       columns={[
         {
           key: 'name',
           headerText: 'Name',
-          isSortable: true,
         },
         {
           key: 'roles',
           headerText: 'Roles',
-          isSortable: true,
-          onSort: (a, b) => {
-            const aStr = a.roles.toString();
-            const bStr = b.roles.toString();
-
-            if (aStr < bStr) {
-              return -1;
-            }
-            if (aStr > bStr) {
-              return 1;
-            }
-
-            return 0;
-          },
           render: ({ roles }) => <LabelCell data={roles} />,
         },
         {
           key: 'authType',
           headerText: 'Type',
-          isSortable: true,
           render: ({ authType, origin, isBot }) => (
             <Cell style={{ textTransform: 'capitalize' }}>
               {renderAuthType(authType, origin, isBot)}
@@ -70,19 +93,20 @@ export default function UserList({
         },
         {
           altKey: 'options-btn',
-          render: user => (
+          render: (user: User) => (
             <ActionCell
-              acl={usersAcl}
               user={user}
-              onEdit={onEdit}
-              onReset={onReset}
-              onDelete={onDelete}
+              canEdit={canEdit}
+              canDelete={canDelete}
+              onEdit={() => onEdit(user)}
+              onReset={() => onReset(user)}
+              onDelete={() => onDelete(user)}
             />
           ),
         },
       ]}
       emptyText="No Users Found"
-      pagination={{ pageSize }}
+      isSearchable
     />
   );
 
@@ -116,20 +140,19 @@ export default function UserList({
 
 const ActionCell = ({
   user,
+  canEdit,
+  canDelete,
   onEdit,
   onReset,
   onDelete,
-  acl,
 }: {
   user: User;
-  onEdit: (user: User) => void;
-  onReset: (user: User) => void;
-  onDelete: (user: User) => void;
-  acl: Access;
+  canEdit: boolean;
+  canDelete: boolean;
+  onEdit: () => void;
+  onReset: () => void;
+  onDelete: () => void;
 }) => {
-  const canEdit = acl.edit;
-  const canDelete = acl.remove;
-
   if (!(canEdit || canDelete)) {
     return <Cell align="right" />;
   }
@@ -141,27 +164,24 @@ const ActionCell = ({
   return (
     <Cell align="right">
       <MenuButton>
-        {canEdit && <MenuItem onClick={() => onEdit(user)}>Edit...</MenuItem>}
+        {canEdit && <MenuItem onClick={onEdit}>Edit...</MenuItem>}
         {canEdit && (
-          <MenuItem onClick={() => onReset(user)}>
-            Reset Authentication...
-          </MenuItem>
-        )}
-        {canDelete && (
-          <MenuItem onClick={() => onDelete(user)}>Delete...</MenuItem>
+          <MenuItem onClick={onReset}>Reset Authentication...</MenuItem>
         )}
+        {canDelete && <MenuItem onClick={onDelete}>Delete...</MenuItem>}
       </MenuButton>
     </Cell>
   );
 };
 
 type Props = {
-  users: User[];
-  pageSize?: number;
   onEdit(user: User): void;
   onDelete(user: User): void;
   onReset(user: User): void;
-  // determines if the viewer is able to edit/delete users. This is used
-  // to conditionally render the edit/delete buttons in the ActionCell
+  onUserClick(user: User): void;
+  onSearchChange(search: string): void;
+  search: string;
+  serversidePagination: SeversidePagination<User>;
   usersAcl: Access;
+  selectedUser?: User | null;
 };
diff --git a/web/packages/teleport/src/Users/UserReset/UserReset.story.tsx b/web/packages/teleport/src/Users/UserReset/UserReset.story.tsx
index 87674790e78ba..c35e845136988 100644
--- a/web/packages/teleport/src/Users/UserReset/UserReset.story.tsx
+++ b/web/packages/teleport/src/Users/UserReset/UserReset.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { useEffect, useState } from 'react';
 
 import { Attempt } from 'shared/hooks/useAttemptNext';
diff --git a/web/packages/teleport/src/Users/Users.story.tsx b/web/packages/teleport/src/Users/Users.story.tsx
index f4ad22bbdd64b..e12be8bdfd8de 100644
--- a/web/packages/teleport/src/Users/Users.story.tsx
+++ b/web/packages/teleport/src/Users/Users.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-vite';
 import { delay } from 'msw';
 
 import { TeleportProviderBasic } from 'teleport/mocks/providers';
@@ -138,8 +138,6 @@ export const Failed: StoryObj = {
   },
 };
 
-const roles = ['admin', 'testrole'];
-
 const sample = {
   attempt: {
     isProcessing: false,
@@ -148,7 +146,11 @@ const sample = {
     message: '',
   },
   users: users,
-  fetchRoles: async (input: string) => roles.filter(r => r.includes(input)),
+  fetch: async () =>
+    Promise.resolve({
+      items: users,
+      startKey: '',
+    }),
   operation: {
     type: 'none',
     user: null,
@@ -170,6 +172,7 @@ const sample = {
   InviteCollaborators: null,
   onEmailPasswordResetClose: () => null,
   EmailPasswordReset: null,
+  UserDetails: null,
   showMauInfo: false,
   onDismissUsersMauNotice: () => null,
   canEditUsers: true,
diff --git a/web/packages/teleport/src/Users/Users.test.tsx b/web/packages/teleport/src/Users/Users.test.tsx
index c34bf03c82270..0774fc1c0c513 100644
--- a/web/packages/teleport/src/Users/Users.test.tsx
+++ b/web/packages/teleport/src/Users/Users.test.tsx
@@ -25,13 +25,16 @@ import {
   screen,
   testQueryClient,
   userEvent,
+  waitFor,
 } from 'design/utils/testing';
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
 
 import { ContextProvider } from 'teleport';
+import { InfoGuideSidePanel } from 'teleport/components/SlidingSidePanel/InfoGuideSidePanel';
+import * as Main from 'teleport/Main/Main';
 import { createTeleportContext } from 'teleport/mocks/contexts';
 import { Access } from 'teleport/services/user';
-import { successGetUsers } from 'teleport/test/helpers/users';
+import { successGetUsersV2 } from 'teleport/test/helpers/users';
 
 import { Users } from './Users';
 import { State } from './useUsers';
@@ -59,9 +62,11 @@ describe('invite collaborators integration', () => {
 
   let props: State;
   beforeEach(() => {
+    jest.spyOn(Main, 'useNoMinWidth').mockReturnValue();
+
     props = {
       operation: { type: 'invite-collaborators' },
-
+      fetch: ctx.userService.fetchUsersV2,
       onStartCreate: () => undefined,
       onStartDelete: () => undefined,
       onStartEdit: () => undefined,
@@ -74,6 +79,7 @@ describe('invite collaborators integration', () => {
       inviteCollaboratorsOpen: false,
       onEmailPasswordResetClose: () => undefined,
       EmailPasswordReset: null,
+      UserDetails: null,
       showMauInfo: false,
       onDismissUsersMauNotice: () => null,
       usersAcl: defaultAcl,
@@ -81,7 +87,7 @@ describe('invite collaborators integration', () => {
   });
 
   test('displays the Create New User button when not configured', async () => {
-    server.use(successGetUsers([]));
+    server.use(successGetUsersV2([]));
 
     render(
       <MemoryRouter>
@@ -94,13 +100,14 @@ describe('invite collaborators integration', () => {
     );
 
     await screen.findByPlaceholderText('Search...');
-
-    expect(screen.getByText('Create New User')).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByText('Create New User')).toBeInTheDocument();
+    });
     expect(screen.queryByText('Enroll Users')).not.toBeInTheDocument();
   });
 
   test('displays the Enroll Users button when configured', async () => {
-    server.use(successGetUsers([]));
+    server.use(successGetUsersV2([]));
 
     const startMock = jest.fn();
     props = {
@@ -123,28 +130,37 @@ describe('invite collaborators integration', () => {
 
     await screen.findByPlaceholderText('Search...');
 
-    const enrollButton = screen.getByText('Enroll Users');
+    const enrollButton = await screen.findByText('Enroll Users');
     expect(enrollButton).toBeInTheDocument();
     expect(screen.queryByText('Create New User')).not.toBeInTheDocument();
 
-    enrollButton.click();
+    const user = userEvent.setup();
+    await user.click(enrollButton);
     expect(startMock.mock.calls).toHaveLength(1);
 
-    // This will display regardless since the dialog display is managed by the
-    // dialog itself, and our mock above is trivial, but we can make sure it
-    // renders.
+    // Ensure the passed in component for InviteCollaborators renders.
+    render(
+      <MemoryRouter>
+        <InfoGuidePanelProvider>
+          <ContextProvider ctx={ctx}>
+            <Users {...props} inviteCollaboratorsOpen={true} />
+          </ContextProvider>
+        </InfoGuidePanelProvider>
+      </MemoryRouter>
+    );
     expect(screen.getByTestId('invite-collaborators')).toBeInTheDocument();
   });
 });
 
 test('Users not equal to MAU Notice', async () => {
-  server.use(successGetUsers([]));
+  server.use(successGetUsersV2([]));
 
   const ctx = createTeleportContext();
   let props: State;
 
   props = {
     operation: { type: 'invite-collaborators' },
+    fetch: ctx.userService.fetchUsersV2,
     onStartCreate: () => undefined,
     onStartDelete: () => undefined,
     onStartEdit: () => undefined,
@@ -157,6 +173,7 @@ test('Users not equal to MAU Notice', async () => {
     inviteCollaboratorsOpen: false,
     onEmailPasswordResetClose: () => undefined,
     EmailPasswordReset: null,
+    UserDetails: null,
     showMauInfo: true,
     onDismissUsersMauNotice: jest.fn(),
     usersAcl: defaultAcl,
@@ -176,8 +193,11 @@ test('Users not equal to MAU Notice', async () => {
 
   await screen.findByPlaceholderText('Search...');
 
-  expect(screen.getByTestId('users-not-mau-alert')).toBeInTheDocument();
+  const alert = await screen.findByTestId('users-not-mau-alert');
+  expect(alert).toBeInTheDocument();
+
   await user.click(screen.getByRole('button', { name: 'Dismiss' }));
+
   expect(props.onDismissUsersMauNotice).toHaveBeenCalled();
   expect(screen.queryByTestId('users-not-mau-alert')).not.toBeInTheDocument();
 });
@@ -187,14 +207,14 @@ describe('email password reset integration', () => {
 
   let props: State;
   beforeEach(() => {
-    server.use(successGetUsers([]));
+    server.use(successGetUsersV2([]));
 
     props = {
       operation: {
         type: 'reset',
         user: { name: 'alice@example.com', roles: ['foo'] },
       },
-
+      fetch: ctx.userService.fetchUsersV2,
       onStartCreate: () => undefined,
       onStartDelete: () => undefined,
       onStartEdit: () => undefined,
@@ -207,6 +227,7 @@ describe('email password reset integration', () => {
       inviteCollaboratorsOpen: false,
       onEmailPasswordResetClose: () => undefined,
       EmailPasswordReset: null,
+      UserDetails: null,
       showMauInfo: false,
       onDismissUsersMauNotice: () => null,
       usersAcl: defaultAcl,
@@ -227,32 +248,6 @@ describe('email password reset integration', () => {
     expect(screen.getByText('Reset User Authentication?')).toBeInTheDocument();
     expect(screen.queryByText('New Reset UI')).not.toBeInTheDocument();
   });
-
-  test('displays the email-based UI when configured', async () => {
-    props = {
-      ...props,
-      InviteCollaborators: () => (
-        <div data-testid="new-reset-ui">New Reset UI</div>
-      ),
-    };
-
-    render(
-      <MemoryRouter>
-        <InfoGuidePanelProvider>
-          <ContextProvider ctx={ctx}>
-            <Users {...props} />
-          </ContextProvider>
-        </InfoGuidePanelProvider>
-      </MemoryRouter>
-    );
-
-    expect(screen.getByText('New Reset UI')).toBeInTheDocument();
-
-    // This will display regardless since the dialog display is managed by the
-    // dialog itself, and our mock above is trivial, but we can make sure it
-    // renders.
-    expect(screen.getByTestId('new-reset-ui')).toBeInTheDocument();
-  });
 });
 
 describe('permission handling', () => {
@@ -261,7 +256,7 @@ describe('permission handling', () => {
   let props: State;
   beforeEach(() => {
     server.use(
-      successGetUsers([
+      successGetUsersV2([
         {
           name: 'tester',
           roles: [],
@@ -275,7 +270,7 @@ describe('permission handling', () => {
         type: 'reset',
         user: { name: 'alice@example.com', roles: ['foo'] },
       },
-
+      fetch: ctx.userService.fetchUsersV2,
       onStartCreate: () => undefined,
       onStartDelete: () => undefined,
       onStartEdit: () => undefined,
@@ -288,6 +283,7 @@ describe('permission handling', () => {
       inviteCollaboratorsOpen: false,
       onEmailPasswordResetClose: () => undefined,
       EmailPasswordReset: null,
+      UserDetails: null,
       showMauInfo: false,
       onDismissUsersMauNotice: () => null,
       usersAcl: defaultAcl,
@@ -417,4 +413,46 @@ describe('permission handling', () => {
       menuItems.every(item => item.textContent.includes('Delete'))
     ).not.toBe(true);
   });
+
+  test('users detail panel opens when clicking on a row', async () => {
+    const testProps = {
+      ...props,
+      usersAcl: {
+        read: true,
+        list: true,
+        edit: true,
+        create: true,
+        remove: false,
+      },
+      UserDetails: ({ user }) => (
+        <div data-testid="user-details-panel">
+          <div>Test Details: {user.name}</div>
+        </div>
+      ),
+    };
+
+    render(
+      <MemoryRouter>
+        <InfoGuidePanelProvider>
+          <ContextProvider ctx={ctx}>
+            <Users {...testProps} />
+            <InfoGuideSidePanel />
+          </ContextProvider>
+        </InfoGuidePanelProvider>
+      </MemoryRouter>
+    );
+
+    await screen.findByPlaceholderText('Search...');
+    const userRow = screen.getByText('tester');
+    expect(userRow).toBeInTheDocument();
+    expect(screen.queryByTestId('user-details-panel')).not.toBeInTheDocument();
+
+    const user = userEvent.setup();
+    await user.click(userRow);
+
+    await waitFor(() => {
+      expect(screen.getByTestId('user-details-panel')).toBeInTheDocument();
+    });
+    expect(screen.getByText('Test Details: tester')).toBeInTheDocument();
+  });
 });
diff --git a/web/packages/teleport/src/Users/Users.tsx b/web/packages/teleport/src/Users/Users.tsx
index e580ead279594..d65f623081a4a 100644
--- a/web/packages/teleport/src/Users/Users.tsx
+++ b/web/packages/teleport/src/Users/Users.tsx
@@ -16,18 +16,10 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import React from 'react';
+import React, { useEffect, useMemo, useRef } from 'react';
 import { Link as InternalLink } from 'react-router-dom';
 
-import {
-  Alert,
-  Box,
-  Button,
-  Link as ExternalLink,
-  Flex,
-  Indicator,
-  Text,
-} from 'design';
+import { Alert, Box, Button, Link as ExternalLink, Flex, Text } from 'design';
 import { HoverTooltip } from 'design/Tooltip';
 import {
   InfoExternalTextLink,
@@ -35,18 +27,24 @@ import {
   InfoParagraph,
   InfoUl,
   ReferenceLinks,
+  useInfoGuide,
 } from 'shared/components/SlidingSidePanel/InfoGuide';
+import { useEscape } from 'shared/hooks/useEscape';
 
+import { useServerSidePagination } from 'teleport/components/hooks';
 import {
   FeatureBox,
   FeatureHeader,
   FeatureHeaderTitle,
 } from 'teleport/components/Layout';
 import cfg from 'teleport/config';
-import { useGetUsers } from 'teleport/services/user/hooks';
+import { useNoMinWidth } from 'teleport/Main';
+import { User } from 'teleport/services/user';
 
+import { useUrlParams } from './state';
 import { UserAddEdit } from './UserAddEdit';
 import { UserDelete } from './UserDelete';
+import { UserDetailsTitle } from './UserDetails';
 import UserList from './UserList';
 import UserReset from './UserReset';
 import useUsers, { State, UsersContainerProps } from './useUsers';
@@ -73,10 +71,109 @@ export function Users(props: State) {
     inviteCollaboratorsOpen,
     InviteCollaborators,
     EmailPasswordReset,
+    UserDetails,
     onEmailPasswordResetClose,
+    fetch,
   } = props;
 
-  const users = useGetUsers();
+  const [params, setParams] = useUrlParams();
+  const abortControllerRef = useRef<AbortController | null>(null);
+  const { setInfoGuideConfig, infoGuideConfig } = useInfoGuide();
+  const detailsPanelWidth = 480;
+
+  const serverSidePagination = useServerSidePagination<User>({
+    pageSize: 20,
+    fetchFunc: async (_, params) => {
+      const { items, startKey } = await fetch(
+        params,
+        abortControllerRef.current?.signal
+      );
+      return { agents: items || [], startKey };
+    },
+    clusterId: '',
+    params: { search: params.search },
+  });
+
+  useNoMinWidth();
+
+  useEffect(() => {
+    // Cancel previous request and create new controller
+    abortControllerRef.current?.abort();
+    abortControllerRef.current = new AbortController();
+
+    serverSidePagination.fetch();
+  }, [params.search]);
+
+  // Cleanup controller on unmount
+  useEffect(() => {
+    return () => {
+      abortControllerRef.current?.abort();
+    };
+  }, []);
+
+  const isSuccess = serverSidePagination.attempt.status === 'success';
+  const userData = serverSidePagination.fetchedData.agents;
+
+  // fetch user from username
+  const user = useMemo(() => {
+    if (isSuccess && params.user) {
+      return userData?.find(u => u.name === params.user) || null;
+    }
+  }, [params.user, userData, isSuccess]);
+
+  // this effect will open the user details panel if the selected user is found
+  // in the pagination results, otherwise it will close the panel and clear the
+  // user URL param
+  useEffect(() => {
+    if (params.user && user) {
+      const botOrExternal = user.isBot || !user.isLocal;
+
+      const onEdit =
+        usersAcl.edit && !botOrExternal ? () => onStartEdit(user) : undefined;
+
+      const onReset = usersAcl.edit ? () => onStartReset(user) : undefined;
+
+      const onDelete = usersAcl.remove ? () => onStartDelete(user) : undefined;
+
+      setInfoGuideConfig({
+        id: user.name,
+        guide: <UserDetails user={user} onEdit={onEdit} />,
+        title: (
+          <UserDetailsTitle
+            user={user}
+            onEdit={onEdit}
+            onReset={onReset}
+            onDelete={onDelete}
+            panelWidth={detailsPanelWidth}
+          />
+        ),
+        panelWidth: detailsPanelWidth,
+      });
+    } else {
+      const userNotFound = params.user && isSuccess && !user;
+
+      if (userNotFound) {
+        setCurrentUser(null);
+      }
+      setInfoGuideConfig(null);
+    }
+  }, [user]);
+
+  // detect if panel was closed by user interaction (i.e. clicking x)
+  // and clear current user
+  useEffect(() => {
+    if (!infoGuideConfig && user && params.user) {
+      setCurrentUser(null);
+    }
+  }, [infoGuideConfig]);
+
+  useEscape(() => {
+    setCurrentUser(null);
+  });
+
+  const setCurrentUser = (user: User | null) => {
+    setParams({ ...params, user: user?.name || null });
+  };
 
   const requiredPermissions = Object.entries(usersAcl)
     .map(([key, value]) => {
@@ -95,7 +192,7 @@ export function Users(props: State) {
     <FeatureBox>
       <FeatureHeader justifyContent="space-between">
         <FeatureHeaderTitle>Users</FeatureHeaderTitle>
-        {users.isSuccess && (
+        {serverSidePagination.attempt.status === 'success' && (
           <Flex gap={2}>
             {!InviteCollaborators && (
               <HoverTooltip
@@ -159,12 +256,10 @@ export function Users(props: State) {
           </Flex>
         )}
       </FeatureHeader>
-      {users.isFetching && (
-        <Box textAlign="center" m={10}>
-          <Indicator />
-        </Box>
+      {serverSidePagination.attempt.status === 'failed' && (
+        <Alert>{serverSidePagination.attempt.statusText}</Alert>
       )}
-      {showMauInfo && !users.isFetching && (
+      {showMauInfo && serverSidePagination.attempt.status !== 'processing' && (
         <Alert
           data-testid="users-not-mau-alert"
           dismissible
@@ -198,25 +293,31 @@ export function Users(props: State) {
           .
         </Alert>
       )}
-      {users.isError && <Alert kind="danger" children={users.error.message} />}
-      {users.isSuccess && !users.isFetching && (
-        <UserList
-          usersAcl={usersAcl}
-          users={users.data}
-          onEdit={onStartEdit}
-          onDelete={onStartDelete}
-          onReset={onStartReset}
-        />
-      )}
+      <UserList
+        serversidePagination={serverSidePagination}
+        onSearchChange={search => setParams({ ...params, search: search })}
+        search={params.search}
+        onEdit={onStartEdit}
+        onDelete={onStartDelete}
+        onReset={onStartReset}
+        onUserClick={setCurrentUser}
+        usersAcl={usersAcl}
+        selectedUser={user}
+      />
       {(operation.type === 'create' || operation.type === 'edit') && (
         <UserAddEdit
           isNew={operation.type === 'create'}
           onClose={onClose}
           user={operation.user}
+          modifyFetchedData={serverSidePagination.modifyFetchedData}
         />
       )}
       {operation.type === 'delete' && (
-        <UserDelete onClose={onClose} username={operation.user.name} />
+        <UserDelete
+          onClose={onClose}
+          username={operation.user.name}
+          modifyFetchedData={serverSidePagination.modifyFetchedData}
+        />
       )}
       {operation.type === 'reset' && !EmailPasswordReset && (
         <UserReset
@@ -231,11 +332,8 @@ export function Users(props: State) {
           username={operation.user.name}
         />
       )}
-      {InviteCollaborators && (
-        <InviteCollaborators
-          open={inviteCollaboratorsOpen}
-          onClose={onInviteCollaboratorsClose}
-        />
+      {InviteCollaborators && inviteCollaboratorsOpen && (
+        <InviteCollaborators onClose={onInviteCollaboratorsClose} />
       )}
     </FeatureBox>
   );
diff --git a/web/packages/teleport/src/Users/state.test.tsx b/web/packages/teleport/src/Users/state.test.tsx
new file mode 100644
index 0000000000000..b2577d5c37645
--- /dev/null
+++ b/web/packages/teleport/src/Users/state.test.tsx
@@ -0,0 +1,119 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook } from '@testing-library/react';
+import { createMemoryHistory } from 'history';
+import type { PropsWithChildren } from 'react';
+import { Router } from 'react-router';
+
+import {
+  searchParamsToState,
+  stateToSearchParams,
+  useUrlParams,
+  type UsersUrlState,
+} from './state';
+
+describe('searchParamsToState', () => {
+  it('returns default state when no params provided', () => {
+    const params = new URLSearchParams();
+    const state = searchParamsToState(params);
+
+    expect(state).toEqual({
+      search: '',
+      user: null,
+    });
+  });
+
+  it('parses parameters', () => {
+    const params = new URLSearchParams('?search=admin&user=bob');
+    const state = searchParamsToState(params);
+
+    expect(state.search).toBe('admin');
+    expect(state.user).toBe('bob');
+  });
+});
+
+describe('stateToSearchParams', () => {
+  it('returns empty params for default state', () => {
+    const state: UsersUrlState = {
+      search: '',
+      user: null,
+    };
+
+    const params = stateToSearchParams(state);
+    expect(params).toBe('');
+  });
+
+  it('combines all parameters correctly', () => {
+    const state: UsersUrlState = {
+      search: 'test',
+      user: 'alice@company.com',
+    };
+
+    const params = stateToSearchParams(state);
+    const urlParams = new URLSearchParams(params);
+
+    expect(urlParams.get('search')).toBe('test');
+    expect(urlParams.get('user')).toBe('alice@company.com');
+  });
+});
+
+describe('useUrlParams', () => {
+  it('initializes params from URL search params', () => {
+    const history = createMemoryHistory({
+      initialEntries: ['/users?search=test&user=alice@company.com'],
+    });
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useUrlParams(), {
+      wrapper,
+    });
+
+    const [params] = result.current;
+
+    expect(params.search).toBe('test');
+    expect(params.user).toBe('alice@company.com');
+  });
+
+  it('updates URL when state changes', () => {
+    const history = createMemoryHistory();
+
+    function wrapper({ children }: PropsWithChildren) {
+      return <Router history={history}>{children}</Router>;
+    }
+
+    const { result } = renderHook(() => useUrlParams(), {
+      wrapper,
+    });
+
+    const [, setState] = result.current;
+
+    act(() => {
+      setState({
+        search: 'new search',
+        user: 'selected-user',
+      });
+    });
+
+    expect(history.location.search).toContain('search=new+search');
+    expect(history.location.search).toContain('user=selected-user');
+  });
+});
diff --git a/web/packages/teleport/src/Users/state.ts b/web/packages/teleport/src/Users/state.ts
new file mode 100644
index 0000000000000..711b5aaa11afa
--- /dev/null
+++ b/web/packages/teleport/src/Users/state.ts
@@ -0,0 +1,78 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo } from 'react';
+import { useHistory, useLocation } from 'react-router';
+
+export interface UsersUrlState {
+  search: string;
+  user: string | null;
+}
+
+export function searchParamsToState(params: URLSearchParams): UsersUrlState {
+  const state: UsersUrlState = {
+    search: params.get('search') ?? '',
+    user: params.get('user') ?? null,
+  };
+
+  return state;
+}
+
+export function stateToSearchParams(state: UsersUrlState): string {
+  const urlParams = new URLSearchParams();
+
+  if (state.search) {
+    urlParams.set('search', state.search);
+  }
+
+  if (state.user) {
+    urlParams.set('user', state.user);
+  }
+
+  return urlParams.toString();
+}
+
+export function useUrlParams(): [
+  UsersUrlState,
+  (newState: Partial<UsersUrlState>) => void,
+] {
+  const history = useHistory();
+  const location = useLocation();
+
+  const params = useMemo(() => {
+    return searchParamsToState(new URLSearchParams(location.search));
+  }, [location.search]);
+
+  const setParams = useCallback(
+    (next: UsersUrlState) => {
+      const current = searchParamsToState(new URLSearchParams(location.search));
+
+      const hasChanged =
+        current.search !== next.search || current.user !== next.user;
+
+      if (hasChanged) {
+        const nextParams = stateToSearchParams(next);
+        const nextSearch = nextParams ? `?${nextParams}` : '';
+        history.push({ search: nextSearch });
+      }
+    },
+    [location.search, history]
+  );
+
+  return [params, setParams];
+}
diff --git a/web/packages/teleport/src/Users/useUsers.ts b/web/packages/teleport/src/Users/useUsers.ts
index 108485b6a57cb..2c4157cf7b0ed 100644
--- a/web/packages/teleport/src/Users/useUsers.ts
+++ b/web/packages/teleport/src/Users/useUsers.ts
@@ -18,14 +18,20 @@
 
 import { ReactElement, useState } from 'react';
 
-import cfg from 'teleport/config';
+import cfg, { UrlListUsersParams } from 'teleport/config';
 import { storageService } from 'teleport/services/storageService';
 import { User } from 'teleport/services/user';
 import useTeleport from 'teleport/useTeleport';
 
+import {
+  UserDetails as DefaultUserDetails,
+  UserDetailsProps,
+} from './UserDetails/UserDetails';
+
 export default function useUsers({
   InviteCollaborators,
   EmailPasswordReset,
+  UserDetails = DefaultUserDetails,
 }: UsersContainerProps) {
   const ctx = useTeleport();
   const [operation, setOperation] = useState({
@@ -89,6 +95,10 @@ export default function useUsers({
 
   const usersAcl = ctx.storeUser.getUserAccess();
 
+  function fetch(params?: UrlListUsersParams, signal?: AbortSignal) {
+    return ctx.userService.fetchUsersV2(params, signal);
+  }
+
   return {
     usersAcl,
     operation,
@@ -104,8 +114,10 @@ export default function useUsers({
     inviteCollaboratorsOpen,
     onEmailPasswordResetClose,
     EmailPasswordReset,
+    UserDetails,
     showMauInfo,
     onDismissUsersMauNotice,
+    fetch,
   };
 }
 
@@ -122,7 +134,6 @@ type Operation = {
 
 export interface InviteCollaboratorsDialogProps {
   onClose: (users?: User[]) => void;
-  open: boolean;
 }
 
 export interface EmailPasswordResetDialogProps {
@@ -136,10 +147,12 @@ type InviteCollaboratorsElement = (
 type EmailPasswordResetElement = (
   props: EmailPasswordResetDialogProps
 ) => ReactElement;
+type UserDetailsElement = (props: UserDetailsProps) => ReactElement;
 
 export type UsersContainerProps = {
   InviteCollaborators?: InviteCollaboratorsElement;
   EmailPasswordReset?: EmailPasswordResetElement;
+  UserDetails?: UserDetailsElement;
 };
 
 export type State = ReturnType<typeof useUsers>;
diff --git a/web/packages/teleport/src/WorkloadIdentity/List/WorkloadIdentitiesList.tsx b/web/packages/teleport/src/WorkloadIdentity/List/WorkloadIdentitiesList.tsx
new file mode 100644
index 0000000000000..10ba56d440447
--- /dev/null
+++ b/web/packages/teleport/src/WorkloadIdentity/List/WorkloadIdentitiesList.tsx
@@ -0,0 +1,134 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ReactElement } from 'react';
+
+import { Cell, LabelCell } from 'design/DataTable/Cells';
+import Table from 'design/DataTable/Table';
+import { FetchingConfig, SortType } from 'design/DataTable/types';
+import Flex from 'design/Flex';
+import Text from 'design/Text';
+import { CopyButton } from 'shared/components/CopyButton/CopyButton';
+import { SearchPanel } from 'shared/components/Search/SearchPanel';
+
+import { WorkloadIdentity } from 'teleport/services/workloadIdentity/types';
+
+export function WorkloadIdetitiesList({
+  data,
+  fetchStatus,
+  onFetchNext,
+  onFetchPrev,
+  sortType,
+  onSortChanged,
+  searchTerm,
+  onSearchChange,
+}: {
+  data: WorkloadIdentity[];
+  sortType: SortType;
+  onSortChanged: (sortType: SortType) => void;
+  searchTerm: string;
+  onSearchChange: (term: string) => void;
+} & Omit<FetchingConfig, 'onFetchMore'>) {
+  const tableData = data.map(d => ({
+    ...d,
+    spiffe_hint: valueOrEmpty(d.spiffe_hint),
+  }));
+
+  return (
+    <Table<(typeof tableData)[number]>
+      data={tableData}
+      fetching={{
+        fetchStatus,
+        onFetchNext,
+        onFetchPrev,
+        disableLoadingIndicator: true,
+      }}
+      serversideProps={{
+        sort: sortType,
+        setSort: onSortChanged,
+        serversideSearchPanel: (
+          <SearchPanel
+            updateSearch={onSearchChange}
+            hideAdvancedSearch={true}
+            filter={{ search: searchTerm }}
+            disableSearch={fetchStatus !== ''}
+          />
+        ),
+      }}
+      columns={[
+        {
+          key: 'name',
+          headerText: 'Name',
+          isSortable: true,
+        },
+        {
+          key: 'spiffe_id',
+          headerText: 'SPIFFE ID',
+          isSortable: true,
+          render: ({ spiffe_id }) => {
+            return spiffe_id ? (
+              <Cell>
+                <Flex inline alignItems={'center'} gap={1} mr={0}>
+                  <Text>
+                    {spiffe_id
+                      .split('/')
+                      .reduce<(ReactElement | string)[]>((acc, cur, i) => {
+                        if (i === 0) {
+                          acc.push(cur);
+                        } else {
+                          // Add break opportunities after each slash
+                          acc.push('/', <wbr key={cur} />, cur);
+                        }
+                        return acc;
+                      }, [])}
+                  </Text>
+                  <CopyButton value={spiffe_id} />
+                </Flex>
+              </Cell>
+            ) : (
+              <Cell>{valueOrEmpty(spiffe_id)}</Cell>
+            );
+          },
+        },
+        {
+          key: 'labels',
+          headerText: 'Labels',
+          isSortable: false,
+          render: ({ labels: labelsMap }) => {
+            const labels = labelsMap ? Object.entries(labelsMap) : undefined;
+            return labels?.length ? (
+              <LabelCell data={labels.map(([k, v]) => `${k}: ${v || '-'}`)} />
+            ) : (
+              <Cell>{valueOrEmpty('')}</Cell>
+            );
+          },
+        },
+        {
+          key: 'spiffe_hint',
+          headerText: 'Hint',
+          isSortable: false,
+        },
+      ]}
+      emptyText="No workload identities found"
+    />
+  );
+}
+
+function valueOrEmpty(value: string | null | undefined, empty = '-') {
+  return value || empty;
+}
diff --git a/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.story.tsx b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.story.tsx
new file mode 100644
index 0000000000000..257c75d4dfd45
--- /dev/null
+++ b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.story.tsx
@@ -0,0 +1,167 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryHistory } from 'history';
+import { MemoryRouter, Route, Router } from 'react-router';
+
+import cfg from 'teleport/config';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  listWorkloadIdentitiesError,
+  listWorkloadIdentitiesForever,
+  listWorkloadIdentitiesSuccess,
+} from 'teleport/test/helpers/workloadIdentities';
+
+import { WorkloadIdentities } from './WorkloadIdentities';
+
+const meta = {
+  title: 'Teleport/WorkloadIdentity',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const Happy: Story = {
+  parameters: {
+    msw: {
+      handlers: [listWorkloadIdentitiesSuccess()],
+    },
+  },
+};
+
+export const Empty: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        listWorkloadIdentitiesSuccess({
+          items: [],
+          next_page_token: null,
+        }),
+      ],
+    },
+  },
+};
+
+export const NoListPermission: Story = {
+  args: { hasListPermission: false },
+  parameters: {
+    msw: {
+      handlers: [
+        /* should never make a call */
+      ],
+    },
+  },
+};
+
+export const Error: Story = {
+  parameters: {
+    msw: {
+      handlers: [listWorkloadIdentitiesError(500, 'something went wrong')],
+    },
+  },
+};
+
+export const OutdatedProxy: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        listWorkloadIdentitiesError(404, 'path not found', {
+          proxyVersion: {
+            major: 18,
+            minor: 0,
+            patch: 0,
+            preRelease: '',
+            string: '18.0.0',
+          },
+        }),
+      ],
+    },
+  },
+};
+
+export const UnsupportedSort: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        listWorkloadIdentitiesError(
+          400,
+          'unsupported sort, with some more info'
+        ),
+      ],
+    },
+  },
+};
+
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [listWorkloadIdentitiesForever()],
+    },
+  },
+};
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
+function Wrapper(props?: { hasListPermission?: boolean }) {
+  const { hasListPermission = true } = props ?? {};
+
+  const history = createMemoryHistory({
+    initialEntries: [cfg.routes.workloadIdentities],
+  });
+
+  const customAcl = makeAcl({
+    workloadIdentity: {
+      ...defaultAccess,
+      list: hasListPermission,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>
+        <TeleportProviderBasic teleportCtx={ctx}>
+          <Router history={history}>
+            <Route path={cfg.routes.workloadIdentities}>
+              <WorkloadIdentities />
+            </Route>
+          </Router>
+        </TeleportProviderBasic>
+      </MemoryRouter>
+    </QueryClientProvider>
+  );
+}
diff --git a/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.test.tsx b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.test.tsx
new file mode 100644
index 0000000000000..48a9e788c76c1
--- /dev/null
+++ b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.test.tsx
@@ -0,0 +1,409 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+import { MemoryRouter } from 'react-router';
+
+import { darkTheme } from 'design/theme';
+import { ConfiguredThemeProvider } from 'design/ThemeProvider';
+import {
+  fireEvent,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+  waitForElementToBeRemoved,
+} from 'design/utils/testing';
+import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { listWorkloadIdentities } from 'teleport/services/workloadIdentity/workloadIdentity';
+import {
+  listWorkloadIdentitiesError,
+  listWorkloadIdentitiesSuccess,
+} from 'teleport/test/helpers/workloadIdentities';
+
+import { ContextProvider } from '..';
+import { WorkloadIdentities } from './WorkloadIdentities';
+
+jest.mock('teleport/services/workloadIdentity/workloadIdentity', () => {
+  const actual = jest.requireActual(
+    'teleport/services/workloadIdentity/workloadIdentity'
+  );
+  return {
+    listWorkloadIdentities: jest.fn((...all) => {
+      return actual.listWorkloadIdentities(...all);
+    }),
+  };
+});
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('WorkloadIdentities', () => {
+  it('Shows an empty state', async () => {
+    server.use(
+      listWorkloadIdentitiesSuccess({
+        items: [],
+        next_page_token: '',
+      })
+    );
+
+    render(<WorkloadIdentities />, { wrapper: makeWrapper() });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(screen.getByText('What is Workload Identity')).toBeInTheDocument();
+  });
+
+  it('Shows an error state', async () => {
+    server.use(listWorkloadIdentitiesError(500, 'server error'));
+
+    render(<WorkloadIdentities />, { wrapper: makeWrapper() });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(screen.getByText('server error')).toBeInTheDocument();
+  });
+
+  it('Shows an unsupported sort error state', async () => {
+    server.use(listWorkloadIdentitiesSuccess());
+
+    render(<WorkloadIdentities />, {
+      wrapper: makeWrapper(),
+    });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    const testErrorMessage =
+      'unsupported sort, only name:asc is supported, but got "blah" (desc = true)';
+    server.use(listWorkloadIdentitiesError(400, testErrorMessage));
+
+    fireEvent.click(screen.getByText('SPIFFE ID'));
+
+    await waitFor(() => {
+      expect(screen.getByText(testErrorMessage)).toBeInTheDocument();
+    });
+
+    server.use(listWorkloadIdentitiesSuccess());
+
+    const resetButton = screen.getByText('Reset sort');
+    expect(resetButton).toBeInTheDocument();
+    fireEvent.click(resetButton);
+
+    await waitFor(() => {
+      expect(screen.queryByText(testErrorMessage)).not.toBeInTheDocument();
+    });
+  });
+
+  it('Shows an unauthorised error state', async () => {
+    render(<WorkloadIdentities />, {
+      wrapper: makeWrapper(
+        makeAcl({
+          workloadIdentity: {
+            ...defaultAccess,
+            list: false,
+          },
+        })
+      ),
+    });
+
+    expect(
+      screen.getByText(
+        'You do not have permission to access Workload Identities. Missing role permissions:',
+        { exact: false }
+      )
+    ).toBeInTheDocument();
+
+    expect(screen.getByText('workload_identity.list')).toBeInTheDocument();
+  });
+
+  it('Shows a list', async () => {
+    server.use(listWorkloadIdentitiesSuccess());
+
+    render(<WorkloadIdentities />, {
+      wrapper: makeWrapper(),
+    });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(screen.getByText('test-workload-identity-1')).toBeInTheDocument();
+    expect(
+      screen.getByText('/test/spiffe/abb53fc8-eba6-40a9-8801-221db41f3c21')
+    ).toBeInTheDocument();
+    expect(screen.getByText('test-label-1: test-value-1')).toBeInTheDocument();
+    expect(screen.getByText('test-label-2: test-value-2')).toBeInTheDocument();
+    expect(screen.getByText('test-label-3: test-value-3')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('Allows paging', async () => {
+    jest.mocked(listWorkloadIdentities).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            items: [
+              {
+                name: 'test-workload-identity-1',
+                spiffe_id: '/test/spiffe/abb53fc8-eba6-40a9-8801-221db41f3c21',
+                spiffe_hint:
+                  'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.',
+                labels: {
+                  'test-label-1': 'test-value-1',
+                  'test-label-2': 'test-value-2',
+                  'test-label-3': 'test-value-3',
+                },
+              },
+            ],
+            next_page_token: pageToken + '.next',
+          });
+        })
+    );
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(0);
+
+    render(<WorkloadIdentities />, { wrapper: makeWrapper() });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    const [nextButton] = screen.getAllByTitle('Next page');
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(1);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    await waitFor(() => expect(nextButton).toBeEnabled());
+    fireEvent.click(nextButton);
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(2);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '.next',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    await waitFor(() => expect(nextButton).toBeEnabled());
+    fireEvent.click(nextButton);
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(3);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '.next.next',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    const [prevButton] = screen.getAllByTitle('Previous page');
+
+    await waitFor(() => expect(prevButton).toBeEnabled());
+    fireEvent.click(prevButton);
+
+    // This page's data will have been cached
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(3);
+
+    await waitFor(() => expect(prevButton).toBeEnabled());
+    fireEvent.click(prevButton);
+
+    // This page's data will have been cached
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(3);
+  });
+
+  it('Allows filtering (search)', async () => {
+    jest.mocked(listWorkloadIdentities).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            items: [
+              {
+                name: 'test-workload-identity-1',
+                spiffe_id: '/test/spiffe/abb53fc8-eba6-40a9-8801-221db41f3c21',
+                spiffe_hint:
+                  'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.',
+                labels: {
+                  'test-label-1': 'test-value-1',
+                  'test-label-2': 'test-value-2',
+                  'test-label-3': 'test-value-3',
+                },
+              },
+            ],
+            next_page_token: pageToken + '.next',
+          });
+        })
+    );
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(0);
+
+    render(<WorkloadIdentities />, { wrapper: makeWrapper() });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(1);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    const [nextButton] = screen.getAllByTitle('Next page');
+    await waitFor(() => expect(nextButton).toBeEnabled());
+    fireEvent.click(nextButton);
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(2);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '.next',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    const search = screen.getByPlaceholderText('Search...');
+    await waitFor(() => expect(search).toBeEnabled());
+    await userEvent.type(search, 'test-search-term');
+    await userEvent.type(search, '{enter}');
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(3);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '', // Search should reset to the first page
+      searchTerm: 'test-search-term',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+  });
+
+  it('Allows sorting', async () => {
+    jest.mocked(listWorkloadIdentities).mockImplementation(
+      ({ pageToken }) =>
+        new Promise(resolve => {
+          resolve({
+            items: [
+              {
+                name: 'test-workload-identity-1',
+                spiffe_id: '/test/spiffe/abb53fc8-eba6-40a9-8801-221db41f3c21',
+                spiffe_hint:
+                  'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.',
+                labels: {
+                  'test-label-1': 'test-value-1',
+                  'test-label-2': 'test-value-2',
+                  'test-label-3': 'test-value-3',
+                },
+              },
+            ],
+            next_page_token: pageToken,
+          });
+        })
+    );
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(0);
+
+    render(<WorkloadIdentities />, { wrapper: makeWrapper() });
+
+    await waitForElementToBeRemoved(() => screen.queryByTestId('loading'));
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(1);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'ASC',
+    });
+
+    fireEvent.click(screen.getByText('Name'));
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(2);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '',
+      searchTerm: '',
+      sortField: 'name',
+      sortDir: 'DESC',
+    });
+
+    fireEvent.click(screen.getByText('SPIFFE ID'));
+
+    expect(listWorkloadIdentities).toHaveBeenCalledTimes(3);
+    expect(listWorkloadIdentities).toHaveBeenLastCalledWith({
+      pageSize: 20,
+      pageToken: '',
+      searchTerm: '',
+      sortField: 'spiffe_id',
+      sortDir: 'ASC',
+    });
+  });
+});
+
+function makeWrapper(
+  customAcl: ReturnType<typeof makeAcl> = makeAcl({
+    workloadIdentity: {
+      list: true,
+      create: true,
+      edit: true,
+      remove: true,
+      read: true,
+    },
+  })
+) {
+  return ({ children }: PropsWithChildren) => {
+    const ctx = createTeleportContext({
+      customAcl,
+    });
+    return (
+      <MemoryRouter>
+        <QueryClientProvider client={testQueryClient}>
+          <ConfiguredThemeProvider theme={darkTheme}>
+            <InfoGuidePanelProvider data-testid="blah">
+              <ContextProvider ctx={ctx}>{children}</ContextProvider>
+            </InfoGuidePanelProvider>
+          </ConfiguredThemeProvider>
+        </QueryClientProvider>
+      </MemoryRouter>
+    );
+  };
+}
diff --git a/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.tsx b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.tsx
new file mode 100644
index 0000000000000..abb177a7590ec
--- /dev/null
+++ b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentities.tsx
@@ -0,0 +1,277 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { keepPreviousData, useQuery } from '@tanstack/react-query';
+import { useCallback } from 'react';
+import { useHistory, useLocation } from 'react-router';
+
+import { Alert } from 'design/Alert/Alert';
+import Box from 'design/Box/Box';
+import { SortType } from 'design/DataTable/types';
+import { Indicator } from 'design/Indicator/Indicator';
+import {
+  InfoExternalTextLink,
+  InfoGuideButton,
+  InfoParagraph,
+  ReferenceLinks,
+} from 'shared/components/SlidingSidePanel/InfoGuide/InfoGuide';
+
+import {
+  FeatureBox,
+  FeatureHeader,
+  FeatureHeaderTitle,
+} from 'teleport/components/Layout/Layout';
+import { listWorkloadIdentities } from 'teleport/services/workloadIdentity/workloadIdentity';
+import useTeleport from 'teleport/useTeleport';
+
+import { EmptyState } from './EmptyState/EmptyState';
+import { WorkloadIdetitiesList } from './List/WorkloadIdentitiesList';
+
+export function WorkloadIdentities() {
+  const history = useHistory();
+  const location = useLocation<{ prevPageTokens?: readonly string[] }>();
+  const queryParams = new URLSearchParams(location.search);
+  const pageToken = queryParams.get('page') ?? '';
+  const sortField = queryParams.get('sort_field') || 'name';
+  const sortDir = queryParams.get('sort_dir') || 'ASC';
+  const searchTerm = queryParams.get('search') ?? '';
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const canList = flags.listWorkloadIdentities;
+
+  const { isPending, isFetching, isSuccess, isError, error, data } = useQuery({
+    enabled: canList,
+    queryKey: [
+      'workload_identities',
+      'list',
+      pageToken,
+      sortField,
+      sortDir,
+      searchTerm,
+    ],
+    queryFn: () =>
+      listWorkloadIdentities({
+        pageSize: 20,
+        pageToken,
+        sortField,
+        sortDir,
+        searchTerm,
+      }),
+    placeholderData: keepPreviousData,
+    staleTime: 30_000, // Cached pages are valid for 30 seconds
+  });
+
+  const { prevPageTokens = [] } = location.state ?? {};
+  const hasNextPage = !!data?.next_page_token;
+  const hasPrevPage = !!pageToken;
+
+  const handleFetchNext = useCallback(() => {
+    const search = new URLSearchParams(location.search);
+    search.set('page', data?.next_page_token ?? '');
+
+    history.replace(
+      {
+        pathname: location.pathname,
+        search: search.toString(),
+      },
+      {
+        prevPageTokens: [...prevPageTokens, pageToken],
+      }
+    );
+  }, [
+    data?.next_page_token,
+    history,
+    location.pathname,
+    location.search,
+    pageToken,
+    prevPageTokens,
+  ]);
+
+  const handleFetchPrev = useCallback(() => {
+    const prevTokens = [...prevPageTokens];
+    const nextToken = prevTokens.pop();
+
+    const search = new URLSearchParams(location.search);
+    search.set('page', nextToken ?? '');
+
+    history.replace(
+      {
+        pathname: location.pathname,
+        search: search.toString(),
+      },
+      {
+        prevPageTokens: prevTokens,
+      }
+    );
+  }, [history, location.pathname, location.search, prevPageTokens]);
+
+  const sortType: SortType = {
+    fieldName: sortField,
+    dir: sortDir.toLowerCase() === 'desc' ? 'DESC' : 'ASC',
+  };
+
+  const handleSortChanged = useCallback(
+    (sortType: SortType) => {
+      const search = new URLSearchParams(location.search);
+      search.set('sort_field', sortType.fieldName);
+      search.set('sort_dir', sortType.dir);
+      search.set('page', '');
+
+      history.replace({
+        pathname: location.pathname,
+        search: search.toString(),
+      });
+    },
+    [history, location.pathname, location.search]
+  );
+
+  const handleSearchChange = useCallback(
+    (term: string) => {
+      const search = new URLSearchParams(location.search);
+      search.set('search', term);
+      search.set('page', '');
+
+      history.replace({
+        pathname: `${location.pathname}`,
+        search: search.toString(),
+      });
+    },
+    [history, location.pathname, location.search]
+  );
+
+  const hasUnsupportedSortError = isError && isUnsupportedSortError(error);
+
+  if (!canList) {
+    return (
+      <FeatureBox>
+        <Alert kind="info" mt={4}>
+          You do not have permission to access Workload Identities. Missing role
+          permissions: <code>workload_identity.list</code>
+        </Alert>
+        <EmptyState />
+      </FeatureBox>
+    );
+  }
+
+  const isFiltering = !!queryParams.get('search');
+
+  if (isSuccess && !data.items?.length && !isFiltering) {
+    return (
+      <FeatureBox>
+        <EmptyState />
+      </FeatureBox>
+    );
+  }
+
+  return (
+    <FeatureBox>
+      <FeatureHeader justifyContent="space-between">
+        <FeatureHeaderTitle>Workload Identities</FeatureHeaderTitle>
+        <InfoGuideButton config={{ guide: <InfoGuide /> }} />
+      </FeatureHeader>
+
+      {isPending ? (
+        <Box data-testid="loading" textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      ) : undefined}
+
+      {isError && hasUnsupportedSortError ? (
+        <Alert
+          kind="warning"
+          primaryAction={{
+            content: 'Reset sort',
+            onClick: () => {
+              handleSortChanged({ fieldName: 'name', dir: 'ASC' });
+            },
+          }}
+        >
+          {error.message}
+        </Alert>
+      ) : undefined}
+
+      {isError && !hasUnsupportedSortError ? (
+        <Alert kind="danger">{error.message}</Alert>
+      ) : undefined}
+
+      {isSuccess ? (
+        <WorkloadIdetitiesList
+          data={data.items ?? []}
+          fetchStatus={isFetching ? 'loading' : ''}
+          onFetchNext={hasNextPage ? handleFetchNext : undefined}
+          onFetchPrev={hasPrevPage ? handleFetchPrev : undefined}
+          sortType={sortType}
+          onSortChanged={handleSortChanged}
+          onSearchChange={handleSearchChange}
+          searchTerm={searchTerm}
+        />
+      ) : undefined}
+    </FeatureBox>
+  );
+}
+
+const InfoGuide = () => (
+  <Box>
+    <InfoParagraph>
+      Teleport{' '}
+      <InfoExternalTextLink
+        target="_blank"
+        href={InfoGuideReferenceLinks.WorkloadIdentity.href}
+      >
+        Workload Identity
+      </InfoExternalTextLink>{' '}
+      securely issues short-lived cryptographic identities to workloads. It is a
+      flexible foundation for workload identity across your infrastructure,
+      creating a uniform way for your workloads to authenticate regardless of
+      where they are running.
+    </InfoParagraph>
+    <InfoParagraph>
+      Teleport Workload Identity is compatible with the open-source{' '}
+      <InfoExternalTextLink
+        target="_blank"
+        href={InfoGuideReferenceLinks.WorkloadIdentity.href}
+      >
+        Secure Production Identity Framework For Everyone (SPIFFE)
+      </InfoExternalTextLink>{' '}
+      standard. This enables interoperability between workload identity
+      implementations and also provides a wealth of off-the-shelf tools and SDKs
+      to simplify integration with your workloads.
+    </InfoParagraph>
+    <ReferenceLinks links={Object.values(InfoGuideReferenceLinks)} />
+  </Box>
+);
+
+const InfoGuideReferenceLinks = {
+  WorkloadIdentity: {
+    title: 'Workload Identity',
+    href: 'https://goteleport.com/docs/machine-workload-identity/workload-identity',
+  },
+  Spiffe: {
+    title: 'Introduction to SPIFFE',
+    href: 'https://goteleport.com/docs/machine-workload-identity/workload-identity/spiffe/',
+  },
+  GettingStarted: {
+    title: 'Getting Started with Workload Identity',
+    href: 'https://goteleport.com/docs/machine-workload-identity/workload-identity/getting-started/',
+  },
+};
+
+const isUnsupportedSortError = (error: Error) => {
+  return !!error?.message && error.message.includes('unsupported sort');
+};
diff --git a/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentity.story.tsx b/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentity.story.tsx
deleted file mode 100644
index ecbfd9d732f75..0000000000000
--- a/web/packages/teleport/src/WorkloadIdentity/WorkloadIdentity.story.tsx
+++ /dev/null
@@ -1,27 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2025 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { EmptyState } from './EmptyState/EmptyState';
-
-export default {
-  title: 'Teleport/WorkloadIdentity',
-};
-
-export const Empty = () => {
-  return <EmptyState />;
-};
diff --git a/web/packages/teleport/src/components/ExternalAuditStorageCta/ExternalAuditStorageCta.tsx b/web/packages/teleport/src/components/ExternalAuditStorageCta/ExternalAuditStorageCta.tsx
index 3aaa036d199a9..2b6ab4491b91c 100644
--- a/web/packages/teleport/src/components/ExternalAuditStorageCta/ExternalAuditStorageCta.tsx
+++ b/web/packages/teleport/src/components/ExternalAuditStorageCta/ExternalAuditStorageCta.tsx
@@ -59,7 +59,15 @@ export const ExternalAuditStorageCta = () => {
   }
 
   return (
-    <CtaContainer mb={3}>
+    <CtaContainer
+      css={`
+        grid-column: span 2;
+        @media screen and (max-width: ${props =>
+            props.theme.breakpoints.mobile}) {
+          grid-column: auto;
+        }
+      `}
+    >
       <Flex
         justifyContent="space-between"
         css={`
diff --git a/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.test.tsx b/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.test.tsx
new file mode 100644
index 0000000000000..f8a71ec97596a
--- /dev/null
+++ b/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.test.tsx
@@ -0,0 +1,117 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+
+import { render, screen, userEvent, waitFor } from 'design/utils/testing';
+
+import { storageService } from 'teleport/services/storageService';
+
+import { FormIdentifierFirst } from './FormIdentifierFirst';
+
+const server = setupServer();
+
+beforeAll(() => server.listen());
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
+
+test('no user remembered in localstorage renders username input form', () => {
+  storageService.setRememberedSsoUsername('');
+
+  render(
+    <FormIdentifierFirst
+      onLoginWithSso={jest.fn()}
+      onUseLocalLogin={jest.fn()}
+      isLocalAuthEnabled={true}
+      title={'Sign in to Teleport'}
+      ssoTitle={'Sign in to Teleport with SSO'}
+    />
+  );
+
+  expect(
+    screen.getByPlaceholderText('Username or email address')
+  ).toBeVisible();
+});
+
+test('user remembered in localstorage shows welcome screen with connectors', async () => {
+  storageService.setRememberedSsoUsername('joe@example.com');
+
+  server.use(
+    http.post('/v1/webapi/authconnectors', () =>
+      HttpResponse.json(connectorsResp)
+    )
+  );
+
+  render(
+    <FormIdentifierFirst
+      onLoginWithSso={jest.fn()}
+      onUseLocalLogin={jest.fn()}
+      isLocalAuthEnabled={true}
+      title={'Sign in to Teleport'}
+      ssoTitle={'Sign in to Teleport with SSO'}
+    />
+  );
+
+  await expect(screen.getByText('Welcome, joe@example.com')).toBeVisible();
+  await waitFor(() => {
+    expect(screen.getByText(/Okta SSO/i)).toBeVisible();
+  });
+});
+
+test('if there is only one connector returned after submitting username, the user is taken there immediately', async () => {
+  storageService.setRememberedSsoUsername('');
+  server.use(
+    http.post('/v1/webapi/authconnectors', () =>
+      HttpResponse.json(connectorsResp)
+    )
+  );
+
+  const mockOnLoginWithSso = jest.fn();
+
+  const user = userEvent.setup();
+
+  render(
+    <FormIdentifierFirst
+      onLoginWithSso={mockOnLoginWithSso}
+      onUseLocalLogin={jest.fn()}
+      isLocalAuthEnabled={true}
+      title={'Sign in to Teleport'}
+      ssoTitle={'Sign in to Teleport with SSO'}
+    />
+  );
+
+  const input = screen.getByPlaceholderText('Username or email address');
+  await user.type(input, 'joe@example.com');
+  await user.click(screen.getByRole('button', { name: 'Next' }));
+
+  await waitFor(() => {
+    expect(mockOnLoginWithSso).toHaveBeenCalled();
+  });
+});
+
+const connectorsResp = {
+  connectors: [
+    {
+      name: 'Okta',
+      type: 'saml',
+      displayName: 'Okta SSO',
+      url: 'http://localhost/okta/login/web?redirect_url=http:%2F%2Flocalhost%2Fwebconnector_id=okta',
+    },
+  ],
+};
diff --git a/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.tsx b/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.tsx
new file mode 100644
index 0000000000000..c8ff572105b09
--- /dev/null
+++ b/web/packages/teleport/src/components/FormLogin/FormIdentifierFirst.tsx
@@ -0,0 +1,308 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useEffect, useState } from 'react';
+import styled from 'styled-components';
+
+import {
+  Box,
+  ButtonPrimary,
+  ButtonText,
+  Card,
+  Flex,
+  Indicator,
+  Input,
+  LabelInput,
+  Text,
+} from 'design';
+import * as Alerts from 'design/Alert';
+import ButtonSso, { guessProviderType } from 'shared/components/ButtonSso';
+import { useRefAutoFocus } from 'shared/hooks';
+import { Attempt, useAsync } from 'shared/hooks/useAsync';
+import { AuthProvider } from 'shared/services';
+
+import ResourceService from 'teleport/services/resources';
+import { storageService } from 'teleport/services/storageService';
+
+type Props = {
+  onLoginWithSso(provider: AuthProvider, loginHint?: string): void;
+  /**
+   * onUseLocalLogin is called to switch the view to the local login form.
+   */
+  onUseLocalLogin(): void;
+  /**
+   * isLocalAuthEnabled is whether local auth is enabled. If not, the identifier first login screen should be the only possible screen.
+   */
+  isLocalAuthEnabled: boolean;
+  /**
+   * title is the title of the form.
+   */
+  title: string;
+  ssoTitle: string;
+};
+
+/**
+ * FormIdentifierFirst is the login form for identifier-first login.
+ */
+export function FormIdentifierFirst({
+  onLoginWithSso,
+  onUseLocalLogin,
+  isLocalAuthEnabled,
+  title,
+  ssoTitle,
+}: Props) {
+  const [resourceService] = useState(() => new ResourceService());
+
+  const [rememberedUsername, setRememberedUsername] = useState<string>(
+    storageService.getRememberedSsoUsername().trim()
+  );
+  const [username, setUsername] = useState<string>(rememberedUsername);
+  const [connectors, setConnectors] = useState<AuthProvider[]>([]);
+
+  useEffect(() => {
+    if (rememberedUsername) {
+      fetchMatchingConnectors(rememberedUsername);
+    }
+  }, [rememberedUsername]);
+
+  const [fetchAttempt, fetchMatchingConnectors] = useAsync(
+    useCallback(
+      async (username: string) => {
+        const matchedConnectors =
+          await resourceService.getUserMatchedAuthConnectors(username);
+        if (matchedConnectors.length === 0) {
+          if (rememberedUsername) {
+            // If we have a remembered username but no connectors, we clear the remembered username.
+            storageService.clearRememberedSsoUsername();
+            setRememberedUsername('');
+            setUsername('');
+            return;
+          }
+          throw new Error(`No SSO connectors found for user: ${username}`);
+        }
+        // If there isn't a remembered username, and there is only one matching connector, we take them straight to the IdP.
+        if (matchedConnectors.length === 1 && !rememberedUsername) {
+          onLoginWithSso(matchedConnectors[0], username);
+          storageService.setRememberedSsoUsername(username);
+          setRememberedUsername(username);
+          return;
+        }
+        setConnectors(matchedConnectors);
+        setRememberedUsername(username);
+        storageService.setRememberedSsoUsername(username);
+        return;
+      },
+      [username]
+    )
+  );
+
+  const onSubmitUsername = () => {
+    fetchMatchingConnectors(username);
+  };
+
+  const onNotYou = () => {
+    storageService.clearRememberedSsoUsername();
+    setUsername('');
+    setRememberedUsername('');
+    setConnectors([]);
+  };
+
+  return (
+    <Card my="5" mx="auto" width={650} p={4}>
+      <Flex flexDirection="column" alignItems="center">
+        <Text typography="h1" textAlign="center">
+          {rememberedUsername ? title : ssoTitle}
+        </Text>
+        {fetchAttempt.status === 'error' && (
+          <Alerts.Danger mt={3}>{fetchAttempt.statusText}</Alerts.Danger>
+        )}
+        <Flex flexDirection="column" alignItems="center" width="100%">
+          {rememberedUsername ? (
+            <Text typography="h2" textAlign="center" mt={1}>
+              Welcome, {username}
+            </Text>
+          ) : (
+            <>
+              <UsernamePrompt
+                onSubmitUsername={onSubmitUsername}
+                username={username}
+                setUsername={setUsername}
+                fetchAttempt={fetchAttempt}
+              />
+              {isLocalAuthEnabled && (
+                <ViewSwitchButton
+                  onClick={onUseLocalLogin}
+                  disabled={fetchAttempt.status === 'processing'}
+                >
+                  Other Sign-in Options
+                </ViewSwitchButton>
+              )}
+            </>
+          )}
+          {fetchAttempt.status === 'processing' && !!rememberedUsername && (
+            <Box textAlign="center" m={4}>
+              <Indicator delay="none" />
+            </Box>
+          )}
+          {fetchAttempt.status === 'success' && connectors.length > 0 && (
+            <ConnectorList
+              providers={connectors}
+              onLoginWithSso={onLoginWithSso}
+              loginHint={username}
+              onNotYou={onNotYou}
+            />
+          )}
+        </Flex>
+      </Flex>
+    </Card>
+  );
+}
+
+function UsernamePrompt({
+  onSubmitUsername,
+  username,
+  setUsername,
+  fetchAttempt,
+}: {
+  onSubmitUsername(): void;
+  username: string;
+  setUsername: (username: string) => void;
+  fetchAttempt: Attempt<void>;
+}) {
+  const inputRef = useRefAutoFocus<HTMLInputElement>({
+    shouldFocus: true,
+  });
+
+  return (
+    <Flex
+      as="form"
+      alignItems="center"
+      justifyContent="center"
+      flexDirection="column"
+      onSubmit={e => {
+        e.preventDefault();
+        onSubmitUsername();
+      }}
+      width="100%"
+      gap={3}
+      mb={3}
+      mt={5}
+    >
+      <Flex flexDirection="column" alignItems="flex-start" width="100%">
+        <LabelInput>Username</LabelInput>
+        <Input
+          ref={inputRef}
+          value={username}
+          onChange={e => setUsername(e.target.value?.trim())}
+          placeholder="Username or email address"
+          width="100%"
+          autoFocus={true}
+        />
+      </Flex>
+      <ButtonPrimary
+        type="submit"
+        size="extra-large"
+        disabled={fetchAttempt.status === 'processing' || !username}
+        width="100%"
+      >
+        Next
+      </ButtonPrimary>
+    </Flex>
+  );
+}
+
+function ConnectorList({
+  providers,
+  onLoginWithSso,
+  onNotYou,
+  loginHint,
+}: {
+  providers: AuthProvider[];
+  onLoginWithSso(provider: AuthProvider, loginHint?: string): void;
+  onNotYou(): void;
+  loginHint: string;
+}) {
+  const $btns = providers.map((item, index) => {
+    let { name, type, displayName } = item;
+    const title = displayName || name;
+    const ssoType = guessProviderType(title, type);
+    return (
+      <StyledButtonSso
+        px={5}
+        size="extra-large"
+        key={index}
+        title={`Sign in with ${title}`}
+        ssoType={ssoType}
+        onClick={e => {
+          e.preventDefault();
+          onLoginWithSso(item, loginHint);
+        }}
+      />
+    );
+  });
+
+  return (
+    <Flex flexDirection="column" gap={2} mt={5} width="100%">
+      <Text textAlign="start" typography="subtitle1" color="text.muted">
+        Select an identity provider to continue:
+      </Text>
+      {$btns}
+      <Flex justifyContent="center" mt={3}>
+        <ViewSwitchButton onClick={onNotYou} disabled={false}>
+          Sign in with a different account
+        </ViewSwitchButton>
+      </Flex>
+    </Flex>
+  );
+}
+
+/**
+ * ViewSwitch button is the button used to switch between login form views.
+ */
+export function ViewSwitchButton({
+  onClick,
+  disabled,
+  children,
+}: {
+  onClick(): void;
+  disabled: boolean;
+} & React.PropsWithChildren) {
+  return (
+    <ButtonText
+      size="large"
+      onClick={onClick}
+      disabled={disabled}
+      css={`
+        color: ${props => props.theme.colors.text.muted};
+        background: transparent;
+        &:hover {
+          background: transparent;
+        }
+      `}
+    >
+      {children}
+    </ButtonText>
+  );
+}
+
+const StyledButtonSso = styled(ButtonSso)`
+  width: 100%;
+  justify-content: flex-start;
+  padding-top: 12px;
+  padding-bottom: 12px;
+`;
diff --git a/web/packages/teleport/src/components/FormLogin/FormLogin.story.tsx b/web/packages/teleport/src/components/FormLogin/FormLogin.story.tsx
index 0ff5d1ba98ba2..32b18feef5a57 100644
--- a/web/packages/teleport/src/components/FormLogin/FormLogin.story.tsx
+++ b/web/packages/teleport/src/components/FormLogin/FormLogin.story.tsx
@@ -16,6 +16,12 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { delay, http, HttpResponse } from 'msw';
+import { useEffect, useState } from 'react';
+
+import cfg from 'teleport/config';
+import { storageService } from 'teleport/services/storageService';
+
 import FormLogin, { Props } from './FormLogin';
 
 const props: Props = {
@@ -225,3 +231,73 @@ export const PrimaryPwdlessWithNoSso = () => {
     />
   );
 };
+
+export const IdentifierFirst = () => {
+  const ssoProviders = [
+    { name: 'github', type: 'oidc', url: '' } as const,
+    { name: 'google', type: 'oidc', url: '' } as const,
+  ];
+  const [key, setKey] = useState(0);
+
+  useEffect(() => {
+    const defaultIdentifierFirst = cfg.auth.identifierFirstLoginEnabled;
+    cfg.auth.identifierFirstLoginEnabled = true;
+    setKey(prev => prev + 1); // Force remount the component with new cfg state.
+
+    return () => {
+      cfg.auth.identifierFirstLoginEnabled = defaultIdentifierFirst;
+    };
+  }, []);
+
+  return <FormLogin {...props} authProviders={ssoProviders} key={key} />;
+};
+
+export const IdentifierFirstRememberedUser = () => {
+  const [key, setKey] = useState(0);
+  const ssoProviders = [
+    { name: 'github', type: 'oidc', url: '' } as const,
+    { name: 'google', type: 'oidc', url: '' } as const,
+  ];
+
+  useEffect(() => {
+    storageService.setRememberedSsoUsername('joe@goteleport.com');
+    const defaultIdentifierFirst = cfg.auth.identifierFirstLoginEnabled;
+    cfg.auth.identifierFirstLoginEnabled = true;
+    setKey(prev => prev + 1); // Force remount the component with new cfg state.
+
+    return () => {
+      cfg.auth.identifierFirstLoginEnabled = defaultIdentifierFirst;
+      storageService.clearRememberedSsoUsername();
+    };
+  }, []);
+
+  return <FormLogin {...props} authProviders={ssoProviders} key={key} />;
+};
+
+IdentifierFirstRememberedUser.parameters = {
+  msw: {
+    handlers: [
+      http.post(cfg.api.authConnectorsPath, async () => {
+        await delay(600); // Simulate loading state
+        return HttpResponse.json([connectorsResp]);
+      }),
+    ],
+  },
+};
+
+const connectorsResp = {
+  connectors: [
+    {
+      name: 'Okta',
+      type: 'saml',
+      displayName: 'Okta',
+      url: 'http://localhost/okta/login/web?redirect_url=http:%2F%2Flocalhost%2Fwebconnector_id=okta',
+    },
+    {
+      name: 'Entra',
+      type: 'saml',
+      displayName: 'Entra',
+      url: 'http://localhost/okta/login/web?redirect_url=http:%2F%2Flocalhost%2Fwebconnector_id=okta',
+    },
+  ],
+};
diff --git a/web/packages/teleport/src/components/FormLogin/FormLogin.tsx b/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
index a5ef6bd00563b..c9d02792cfa89 100644
--- a/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
+++ b/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
@@ -49,10 +49,12 @@ import {
 } from 'shared/services';
 import createMfaOptions, { MfaOption } from 'shared/utils/createMfaOptions';
 
+import cfg from 'teleport/config';
 import { UserCredentials } from 'teleport/services/auth';
 import history from 'teleport/services/history';
 
 import { PasskeyIcons } from '../Passkeys';
+import { FormIdentifierFirst, ViewSwitchButton } from './FormIdentifierFirst';
 import SSOButtonList from './SsoButtons';
 
 const allAuthTypes: PrimaryAuthType[] = ['passwordless', 'sso', 'local'];
@@ -64,8 +66,14 @@ export default function LoginForm(props: Props) {
     isPasswordlessEnabled,
     authProviders = [],
     primaryAuthType,
+    title = 'Sign in to Teleport',
+    ssoTitle = 'Sign in to Teleport with SSO',
   } = props;
 
+  const [showIdentifierFirstLogin, setShowIdentifierFirstLogin] = useState(
+    cfg?.auth?.identifierFirstLoginEnabled
+  );
+
   const ssoEnabled = authProviders?.length > 0;
 
   // If local auth was not enabled, disregard any primary auth type config
@@ -89,11 +97,23 @@ export default function LoginForm(props: Props) {
 
   const showAccessChangedMessage = history.hasAccessChangedParam();
 
+  if (ssoEnabled && showIdentifierFirstLogin) {
+    return (
+      <FormIdentifierFirst
+        onLoginWithSso={props.onLoginWithSso}
+        onUseLocalLogin={() => setShowIdentifierFirstLogin(false)}
+        isLocalAuthEnabled={isLocalAuthEnabled}
+        title={title}
+        ssoTitle={ssoTitle}
+      />
+    );
+  }
+
   // Everything below requires local auth to be enabled.
   return (
     <Card my="5" mx="auto" maxWidth={500} minWidth={300} py={4}>
       <Text typography="h1" mb={4} textAlign="center">
-        Sign in to Teleport
+        {title}
       </Text>
       {errorMessage && <Alerts.Danger m={4}>{errorMessage}</Alerts.Danger>}
       {showAccessChangedMessage && (
@@ -107,6 +127,7 @@ export default function LoginForm(props: Props) {
           currFlow={'default'}
           otherAuthTypes={otherAuthTypes}
           {...props}
+          setShowIdentifierFirstLogin={setShowIdentifierFirstLogin}
           primaryAuthType={actualPrimaryType}
         />
       ) : (
@@ -125,11 +146,24 @@ const SsoList = ({
   onLoginWithSso,
   autoFocus = false,
   hasTransitionEnded,
+  setShowIdentifierFirstLogin,
 }: Props & { hasTransitionEnded?: boolean }) => {
   const ref = useRefAutoFocus<HTMLButtonElement>({
     shouldFocus: hasTransitionEnded && autoFocus,
   });
   const { isProcessing } = attempt;
+
+  if (cfg?.auth?.identifierFirstLoginEnabled) {
+    return (
+      <ViewSwitchButton
+        onClick={() => setShowIdentifierFirstLogin(true)}
+        disabled={isProcessing}
+      >
+        Sign in using SSO
+      </ViewSwitchButton>
+    );
+  }
+
   return (
     <SSOButtonList
       isDisabled={isProcessing}
@@ -342,12 +376,14 @@ const LoginOptions = ({
   next,
   refCallback,
   otherAuthTypes,
+  setShowIdentifierFirstLogin,
   ...otherProps
 }: { otherAuthTypes: PrimaryAuthType[] } & Props & StepComponentProps) => {
   return (
     <Flex flexDirection="column" px={4} gap={3} ref={refCallback}>
       <AuthMethod
         {...otherProps}
+        setShowIdentifierFirstLogin={setShowIdentifierFirstLogin}
         next={next}
         refCallback={refCallback}
         authType={otherProps.primaryAuthType}
@@ -359,6 +395,7 @@ const LoginOptions = ({
         <AuthMethod
           key={authType}
           {...otherProps}
+          setShowIdentifierFirstLogin={setShowIdentifierFirstLogin}
           next={next}
           refCallback={refCallback}
           authType={authType}
@@ -455,6 +492,10 @@ const loginViews = { default: [LoginOptions, LocalLogin] };
 export type Props = {
   // Deprecated. TODO(bl-nero): Remove after e/ is updated.
   title?: string;
+  /**
+   * ssoTitle is the login form title for the identifier-first login view.
+   */
+  ssoTitle?: string;
   isLocalAuthEnabled?: boolean;
   isPasswordlessEnabled: boolean;
   authProviders?: AuthProvider[];
@@ -465,10 +506,11 @@ export type Props = {
   isRecoveryEnabled?: boolean;
   onRecover?: (isRecoverPassword: boolean) => void;
   clearAttempt?: () => void;
-  onLoginWithSso(provider: AuthProvider): void;
+  onLoginWithSso(provider: AuthProvider, loginHint?: string): void;
   onLoginWithWebauthn(creds?: UserCredentials): void;
   onLogin(username: string, password: string, token: string): void;
   autoFocus?: boolean;
+  setShowIdentifierFirstLogin?: (value: boolean) => void;
 };
 
 type AttemptState = ReturnType<typeof useAttempt>[0];
diff --git a/web/packages/teleport/src/components/HeadlessRequestDialog/HeadlessRequestDialog.tsx b/web/packages/teleport/src/components/HeadlessRequestDialog/HeadlessRequestDialog.tsx
index f13dfbbd505e8..0bbdf6fea879c 100644
--- a/web/packages/teleport/src/components/HeadlessRequestDialog/HeadlessRequestDialog.tsx
+++ b/web/packages/teleport/src/components/HeadlessRequestDialog/HeadlessRequestDialog.tsx
@@ -59,7 +59,9 @@ export default function HeadlessRequestDialog({
               you, click Reject and contact your administrator.
               <br />
               <br />
-              If it was you, please use your hardware key to approve.
+              If it was you, approve the request to continue. You will be
+              prompted to verify your identity in order to complete the
+              approval.
             </>
           )}
         </Text>
diff --git a/web/packages/teleport/src/components/LabelsInput/LabelsInput.control.story.tsx b/web/packages/teleport/src/components/LabelsInput/LabelsInput.control.story.tsx
new file mode 100644
index 0000000000000..d429c8ae1463a
--- /dev/null
+++ b/web/packages/teleport/src/components/LabelsInput/LabelsInput.control.story.tsx
@@ -0,0 +1,59 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta } from '@storybook/react-vite';
+import { useState } from 'react';
+
+import Validation from 'shared/components/Validation';
+
+import { Label, LabelsInput } from './LabelsInput';
+
+type StoryProps = {
+  readOnly?: boolean;
+  disableBtns?: boolean;
+};
+
+const meta: Meta<StoryProps> = {
+  title: 'Teleport/LabelsInput/AtLeastOneRowVisible',
+  component: Controls,
+  argTypes: {
+    readOnly: {
+      control: { type: 'boolean' },
+    },
+    disableBtns: {
+      control: { type: 'boolean' },
+    },
+  },
+};
+export default meta;
+
+export function Controls(props: StoryProps) {
+  const [labels, setLabels] = useState<Label[]>([]);
+  return (
+    <Validation>
+      <LabelsInput
+        legend="Labels"
+        labels={labels}
+        setLabels={setLabels}
+        atLeastOneRow
+        readOnly={props.readOnly}
+        disableBtns={props.disableBtns}
+      />
+    </Validation>
+  );
+}
diff --git a/web/packages/teleport/src/components/LabelsInput/LabelsInput.story.tsx b/web/packages/teleport/src/components/LabelsInput/LabelsInput.story.tsx
index 080cb51147d2c..5ac9f7f2a74a1 100644
--- a/web/packages/teleport/src/components/LabelsInput/LabelsInput.story.tsx
+++ b/web/packages/teleport/src/components/LabelsInput/LabelsInput.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { useState } from 'react';
 
 import Box from 'design/Box';
@@ -95,38 +95,35 @@ export const Disabled = () => {
   );
 };
 
-export const AutoFocus = () => {
-  const [labels, setLabels] = useState<Label[]>([{ name: '', value: '' }]);
+export const ReadOnly = () => {
+  const [labels, setLabels] = useState<Label[]>([
+    { name: 'some-name', value: 'some-value' },
+  ]);
   return (
     <Validation>
-      <LabelsInput labels={labels} setLabels={setLabels} autoFocus={true} />
+      <LabelsInput labels={labels} setLabels={setLabels} readOnly />
     </Validation>
   );
 };
 
-export const AtLeastOneRequired = () => {
+export const AutoFocus = () => {
   const [labels, setLabels] = useState<Label[]>([{ name: '', value: '' }]);
   return (
     <Validation>
-      <LabelsInput
-        legend="Labels"
-        labels={labels}
-        setLabels={setLabels}
-        required={true}
-      />
+      <LabelsInput labels={labels} setLabels={setLabels} autoFocus={true} />
     </Validation>
   );
 };
 
-export const AtLeastOneRowVisible = () => {
-  const [labels, setLabels] = useState<Label[]>([]);
+export const AtLeastOneRequired = () => {
+  const [labels, setLabels] = useState<Label[]>([{ name: '', value: '' }]);
   return (
     <Validation>
       <LabelsInput
         legend="Labels"
         labels={labels}
         setLabels={setLabels}
-        atLeastOneRow
+        required={true}
       />
     </Validation>
   );
diff --git a/web/packages/teleport/src/components/LabelsInput/LabelsInput.test.tsx b/web/packages/teleport/src/components/LabelsInput/LabelsInput.test.tsx
index 9b05548794965..00517aae65e49 100644
--- a/web/packages/teleport/src/components/LabelsInput/LabelsInput.test.tsx
+++ b/web/packages/teleport/src/components/LabelsInput/LabelsInput.test.tsx
@@ -48,7 +48,7 @@ test('defaults, with empty labels', async () => {
   expect(screen.queryByPlaceholderText('label key')).not.toBeInTheDocument();
   expect(screen.queryByPlaceholderText('label value')).not.toBeInTheDocument();
 
-  fireEvent.click(screen.getByText(/add a label/i));
+  fireEvent.click(screen.getByText(/add label/i));
 
   expect(screen.getByText(/key/i)).toBeInTheDocument();
   expect(screen.getByText(/value/i)).toBeInTheDocument();
@@ -67,7 +67,7 @@ test('defaults, with empty labels', async () => {
 test('with custom texts', async () => {
   render(<Custom />);
 
-  fireEvent.click(screen.getByText(/add a custom adjective/i));
+  fireEvent.click(screen.getByText(/add custom adjective/i));
 
   expect(screen.getByText(/custom key name/i)).toBeInTheDocument();
   expect(screen.getByText(/custom value/i)).toBeInTheDocument();
@@ -86,7 +86,7 @@ test('with custom texts', async () => {
   // Delete the only row.
   fireEvent.click(screen.getByTitle(/remove custom adjective/i));
   expect(
-    screen.getByRole('button', { name: 'Add a Custom Adjective' })
+    screen.getByRole('button', { name: 'Add Custom Adjective' })
   ).toBeInTheDocument();
   expect(
     screen.queryByPlaceholderText('custom key placeholder')
diff --git a/web/packages/teleport/src/components/LabelsInput/LabelsInput.tsx b/web/packages/teleport/src/components/LabelsInput/LabelsInput.tsx
index fe85cedfc2f68..031e0ee32f936 100644
--- a/web/packages/teleport/src/components/LabelsInput/LabelsInput.tsx
+++ b/web/packages/teleport/src/components/LabelsInput/LabelsInput.tsx
@@ -23,6 +23,7 @@ import { buttonSizes } from 'design/ButtonIcon';
 import * as Icons from 'design/Icon';
 import { inputGeometry } from 'design/Input/Input';
 import { LabelContent } from 'design/LabelInput/LabelInput';
+import { ButtonWithAddIcon } from 'shared/components/ButtonWithAddIcon';
 import FieldInput from 'shared/components/FieldInput';
 import {
   useRule,
@@ -93,6 +94,11 @@ export type LabelsInputProps = {
    * with empty key and value.
    */
   atLeastOneRow?: boolean;
+  /**
+   * Disables inputs and hides controls
+   * but does not mute values.
+   */
+  readOnly?: boolean;
 };
 
 export function LabelsInput({
@@ -109,6 +115,7 @@ export function LabelsInput({
   labelVal = { fieldName: 'Value', placeholder: 'label value' },
   rule = defaultRule,
   atLeastOneRow = false,
+  readOnly = false,
 }: LabelsInputProps) {
   const validator = useValidation() as Validator;
   const validationResult: LabelListValidationResult = useRule(rule(labels));
@@ -190,21 +197,25 @@ export function LabelsInput({
           </LabelContent>
         </Legend>
       )}
-      <LabelTable>
+      <LabelTable readOnly={readOnly}>
         <colgroup>
           {/* Column elements (for styling purposes, see LabelTable styles) */}
           <col />
           <col />
-          <col />
+          {!readOnly && <col />}
         </colgroup>
         {labels.length > 0 && (
           <thead>
             <tr>
               <th scope="col">
-                <LabelContent required>{labelKey.fieldName}</LabelContent>
+                <LabelContent required={!readOnly}>
+                  {labelKey.fieldName}
+                </LabelContent>
               </th>
               <th scope="col">
-                <LabelContent required>{labelVal.fieldName}</LabelContent>
+                <LabelContent required={!readOnly}>
+                  {labelVal.fieldName}
+                </LabelContent>
               </th>
             </tr>
           </thead>
@@ -241,7 +252,8 @@ export function LabelsInput({
                     placeholder={labelKey.placeholder}
                     mb={0}
                     onChange={e => handleChange(e, index, 'name')}
-                    readonly={disableBtns}
+                    disabled={disableBtns}
+                    readonly={readOnly}
                   />
                 </td>
                 <td>
@@ -256,50 +268,57 @@ export function LabelsInput({
                     placeholder={labelVal.placeholder}
                     mb={0}
                     onChange={e => handleChange(e, index, 'value')}
-                    readonly={disableBtns}
+                    disabled={disableBtns}
+                    readonly={readOnly}
                   />
                 </td>
-                <td>
-                  {/* Force the trash button container to be the same height as an
+                {!readOnly && (
+                  <td>
+                    {/* Force the trash button container to be the same height as an
                       input. We can't just set center-align the cell, because the
                       field can expand when showing a validation error. */}
-                  <Flex
-                    alignItems="center"
-                    height={inputGeometry[inputSize].height}
-                  >
-                    <ButtonIcon
-                      size={buttonIconSize}
-                      title={`Remove ${adjective}`}
-                      onClick={() => removeLabel(index)}
-                      css={`
-                        &:disabled {
-                          opacity: 0.65;
-                        }
-                      `}
-                      disabled={disableBtns || singleEmptyRow}
+                    <Flex
+                      alignItems="center"
+                      height={inputGeometry[inputSize].height}
                     >
-                      <Icons.Cross color="text.muted" size="small" />
-                    </ButtonIcon>
-                  </Flex>
-                </td>
+                      <ButtonIcon
+                        size={buttonIconSize}
+                        title={`Remove ${adjective}`}
+                        onClick={() => removeLabel(index)}
+                        css={`
+                          &:disabled {
+                            opacity: 0.65;
+                          }
+                        `}
+                        disabled={disableBtns || singleEmptyRow}
+                      >
+                        <Icons.Cross color="text.muted" size="small" />
+                      </ButtonIcon>
+                    </Flex>
+                  </td>
+                )}
               </tr>
             );
           })}
         </tbody>
       </LabelTable>
-      <ButtonSecondary
-        onClick={e => {
-          e.preventDefault();
-          addLabel();
-        }}
-        disabled={disableBtns}
-        gap={1}
-        size="small"
-        inputAlignment
-      >
-        <Icons.Add className="icon-add" disabled={disableBtns} size="small" />
-        {labels.length > 0 ? `Add another ${adjective}` : `Add a ${adjective}`}
-      </ButtonSecondary>
+      {!readOnly && (
+        <ButtonWithAddIcon
+          Button={ButtonSecondary}
+          label={
+            labels.length > 0 ? `Add another ${adjective}` : `Add ${adjective}`
+          }
+          onClick={e => {
+            e.preventDefault();
+            addLabel();
+          }}
+          disabled={disableBtns}
+          size="small"
+          pr={3}
+          compact={false}
+          $inputAlignment
+        />
+      )}
     </Fieldset>
   );
 }
@@ -337,7 +356,7 @@ const Legend = styled.legend`
   ${props => props.theme.typography.body3}
 `;
 
-const LabelTable = styled.table`
+const LabelTable = styled.table<{ readOnly: boolean }>`
   width: 100%;
   border-collapse: collapse;
   /*
@@ -367,9 +386,11 @@ const LabelTable = styled.table`
     vertical-align: top;
     padding-bottom: ${props => props.theme.space[2]}px;
 
-    &:nth-child(1),
-    &:nth-child(2) {
+    &:nth-child(1) {
       padding-right: ${props => props.theme.space[2]}px;
     }
+    &:nth-child(2) {
+      padding-right: ${p => (p.readOnly ? 0 : p.theme.space[2])}px;
+    }
   }
 `;
diff --git a/web/packages/teleport/src/components/Layout/Layout.tsx b/web/packages/teleport/src/components/Layout/Layout.tsx
index 050195a5d7373..11607ebd9c181 100644
--- a/web/packages/teleport/src/components/Layout/Layout.tsx
+++ b/web/packages/teleport/src/components/Layout/Layout.tsx
@@ -48,7 +48,7 @@ const FeatureHeaderTitle = styled(H1)`
 /**
  * Feature Box (container)
  */
-const FeatureBox = styled(Flex)`
+const FeatureBox = styled(Flex)<{ hideBottomSpacing?: boolean }>`
   width: 100%;
   height: 100%;
   flex-direction: column;
@@ -60,10 +60,14 @@ const FeatureBox = styled(Flex)`
     Directly assigning margin-bottom impacts the scrollbar area by pushing it up as well.
     It works in all major browsers.
   */
-  &::after {
-    content: ' ';
-    padding-bottom: 24px;
-  }
+  ${props =>
+    !props.hideBottomSpacing &&
+    `
+    &::after {
+      content: ' ';
+      padding-bottom: 24px;
+    }
+  `}
 
   /* Allow overriding padding settings. */
   ${space}
diff --git a/web/packages/teleport/src/components/LogoHero/LogoHero.tsx b/web/packages/teleport/src/components/LogoHero/LogoHero.tsx
index 2083a2febb131..39a0cdeeca442 100644
--- a/web/packages/teleport/src/components/LogoHero/LogoHero.tsx
+++ b/web/packages/teleport/src/components/LogoHero/LogoHero.tsx
@@ -48,9 +48,15 @@ export const logos: Record<TeleportEdition, LogoMap> = {
   },
 };
 
-export const LogoHero = ({ my = '48px' }: { my?: string }) => {
+export const LogoHero = ({
+  my = '48px',
+  customSrc,
+}: {
+  my?: string;
+  customSrc?: string;
+}) => {
   const theme = useTheme();
-  const src = logos[cfg.edition][theme.type];
+  const src = customSrc || logos[cfg.edition][theme.type];
   return (
     <Image src={src} maxHeight="120px" maxWidth="200px" my={my} mx="auto" />
   );
diff --git a/web/packages/teleport/src/components/PoweredByTeleportLogo/PoweredByTeleportLogo.tsx b/web/packages/teleport/src/components/PoweredByTeleportLogo/PoweredByTeleportLogo.tsx
new file mode 100644
index 0000000000000..977f205cbacd5
--- /dev/null
+++ b/web/packages/teleport/src/components/PoweredByTeleportLogo/PoweredByTeleportLogo.tsx
@@ -0,0 +1,48 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import styled, { useTheme } from 'styled-components';
+
+import Box from 'design/Box';
+import Image from 'design/Image';
+
+import logoPoweredByDark from './logoPoweredByDark.svg';
+import logoPoweredByLight from './logoPoweredByLight.svg';
+
+export function PoweredByTeleportLogo() {
+  const theme = useTheme();
+  const src = theme.type === 'dark' ? logoPoweredByDark : logoPoweredByLight;
+  return (
+    <StyledBox
+      py={3}
+      px={4}
+      pb={4}
+      css={`
+        border: none;
+      `}
+    >
+      <Image src={src} maxWidth="100%" alt="powered by teleport" />
+    </StyledBox>
+  );
+}
+
+const StyledBox = styled(Box)`
+  line-height: 20px;
+  border-top: ${props => props.theme.borders[1]}
+    ${props => props.theme.colors.spotBackground[0]};
+`;
diff --git a/web/packages/teleport/src/components/PoweredByTeleportLogo/index.ts b/web/packages/teleport/src/components/PoweredByTeleportLogo/index.ts
new file mode 100644
index 0000000000000..602703124904c
--- /dev/null
+++ b/web/packages/teleport/src/components/PoweredByTeleportLogo/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export { PoweredByTeleportLogo } from './PoweredByTeleportLogo';
diff --git a/web/packages/teleport/src/Navigation/logoPoweredByDark.svg b/web/packages/teleport/src/components/PoweredByTeleportLogo/logoPoweredByDark.svg
similarity index 100%
rename from web/packages/teleport/src/Navigation/logoPoweredByDark.svg
rename to web/packages/teleport/src/components/PoweredByTeleportLogo/logoPoweredByDark.svg
diff --git a/web/packages/teleport/src/Navigation/logoPoweredByLight.svg b/web/packages/teleport/src/components/PoweredByTeleportLogo/logoPoweredByLight.svg
similarity index 100%
rename from web/packages/teleport/src/Navigation/logoPoweredByLight.svg
rename to web/packages/teleport/src/components/PoweredByTeleportLogo/logoPoweredByLight.svg
diff --git a/web/packages/teleport/src/components/SelectFilters/SelectFilters.tsx b/web/packages/teleport/src/components/SelectFilters/SelectFilters.tsx
index 3a0a911686daa..b91ab2a3bee79 100644
--- a/web/packages/teleport/src/components/SelectFilters/SelectFilters.tsx
+++ b/web/packages/teleport/src/components/SelectFilters/SelectFilters.tsx
@@ -21,13 +21,13 @@ import { components } from 'react-select';
 import styled from 'styled-components';
 
 import { Box, ButtonBorder, ButtonIcon, Flex, Text } from 'design';
+import { makeLabelTag } from 'design/formatters';
 import { Add, Cross } from 'design/Icon';
 import Select, {
   ActionMeta,
   Option as BaseOption,
 } from 'shared/components/Select';
 
-import { makeLabelTag } from 'teleport/components/formatters';
 import { Filter } from 'teleport/types';
 
 import Pager from './Pager';
diff --git a/web/packages/teleport/src/components/hooks/useFullscreen.ts b/web/packages/teleport/src/components/hooks/useFullscreen.ts
new file mode 100644
index 0000000000000..0c2f2adad2168
--- /dev/null
+++ b/web/packages/teleport/src/components/hooks/useFullscreen.ts
@@ -0,0 +1,61 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+  type RefObject,
+} from 'react';
+
+export function useFullscreen(ref: RefObject<HTMLElement>) {
+  const [active, setActive] = useState<boolean>(false);
+
+  useEffect(() => {
+    function handleFullscreenChange() {
+      setActive(document.fullscreenElement === ref.current);
+    }
+
+    document.addEventListener('fullscreenchange', handleFullscreenChange);
+
+    return () => {
+      document.removeEventListener('fullscreenchange', handleFullscreenChange);
+    };
+  }, [ref]);
+
+  const enter = useCallback(async () => {
+    if (document.fullscreenElement) {
+      await document.exitFullscreen();
+    }
+
+    if (ref.current) {
+      return ref.current.requestFullscreen();
+    }
+  }, [ref]);
+
+  const exit = useCallback(() => {
+    if (document.fullscreenElement === ref.current) {
+      return document.exitFullscreen();
+    }
+
+    return Promise.resolve();
+  }, [ref]);
+
+  return useMemo(() => ({ active, enter, exit }), [active, enter, exit]);
+}
diff --git a/web/packages/teleport/src/components/hooks/useServersidePagination.ts b/web/packages/teleport/src/components/hooks/useServersidePagination.ts
index ae05efe0bfe72..1deb13168595f 100644
--- a/web/packages/teleport/src/components/hooks/useServersidePagination.ts
+++ b/web/packages/teleport/src/components/hooks/useServersidePagination.ts
@@ -140,9 +140,17 @@ export function useServerSidePagination<T>({
 
 type Props<T> = {
   fetchFunc: (
+    /** @deprecated This field is not needed by `useServerSidePagination` and will be removed.
+     * Pass the cluster directly in the fetch function.
+     * */
+    // TODO(rudream): Remove this field
     clusterId: string,
     params: UrlResourcesParams
   ) => Promise<ResourcesResponse<T>>;
+  /** @deprecated This field is not needed by `useServerSidePagination` and will be removed.
+   * Pass the cluster directly in the fetch function.
+   * */
+  // TODO(rudream): Remove this field
   clusterId: string;
   params: ResourceFilter;
   pageSize?: number;
diff --git a/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.test.ts b/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.test.ts
index 56ac3f40c6358..43a83a76e9b3e 100644
--- a/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.test.ts
+++ b/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.test.ts
@@ -68,15 +68,16 @@ const testCases: {
     expected: '/test?sort=name%3Aasc&pinnedOnly=false',
   },
   {
-    title: 'Search, sort, and filter by kind',
+    title: 'Search, sort, filter by kind, and filter by statuses',
     args: {
       pathname: '/test',
       searchString: 'foo',
       sort: { fieldName: 'name', dir: 'DESC' },
       kinds: ['db', 'node'],
+      statuses: ['healthy', 'unhealthy'],
     },
     expected:
-      '/test?search=foo&sort=name%3Adesc&pinnedOnly=false&kinds=db&kinds=node',
+      '/test?search=foo&sort=name%3Adesc&pinnedOnly=false&kinds=db&kinds=node&status=healthy&status=unhealthy',
   },
 ];
 
diff --git a/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.ts b/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.ts
index fbcbf0217f917..c105be8459571 100644
--- a/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.ts
+++ b/web/packages/teleport/src/components/hooks/useUrlFiltering/encodeUrlQueryParams.ts
@@ -16,13 +16,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { formatSortType } from 'design/DataTable/sort';
 import { SortType } from 'design/DataTable/types';
+import { ResourceHealthStatus } from 'shared/components/UnifiedResources';
 
 export type EncodeUrlQueryParamsProps = {
   pathname: string;
   searchString?: string;
   sort?: SortType | null;
   kinds?: string[] | null;
+  statuses?: ResourceHealthStatus[] | null;
   isAdvancedSearch?: boolean;
   pinnedOnly?: boolean;
 };
@@ -34,6 +37,7 @@ export function encodeUrlQueryParams({
   kinds,
   isAdvancedSearch = false,
   pinnedOnly = false,
+  statuses,
 }: EncodeUrlQueryParamsProps) {
   const urlParams = new URLSearchParams();
 
@@ -42,7 +46,7 @@ export function encodeUrlQueryParams({
   }
 
   if (sort) {
-    urlParams.append('sort', `${sort.fieldName}:${sort.dir.toLowerCase()}`);
+    urlParams.append('sort', formatSortType(sort));
   }
 
   if (pinnedOnly !== undefined) {
@@ -55,6 +59,12 @@ export function encodeUrlQueryParams({
     }
   }
 
+  if (statuses) {
+    for (const status of statuses) {
+      urlParams.append('status', status);
+    }
+  }
+
   const encodedParams = urlParams.toString();
 
   return encodedParams ? `${pathname}?${encodedParams}` : pathname;
diff --git a/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.test.tsx b/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.test.tsx
index 114bcf96a5fb3..866f30fc17458 100644
--- a/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.test.tsx
+++ b/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.test.tsx
@@ -34,6 +34,7 @@ test('extracting params from URL with simple search and sort params', () => {
     },
     query: null,
     kinds: null,
+    statuses: undefined,
   };
 
   const history = createMemoryHistory({ initialEntries: [url] });
@@ -59,6 +60,7 @@ test('extracting params from URL with advanced search and sort params', () => {
     },
     search: null,
     kinds: null,
+    statuses: undefined,
   };
 
   const history = createMemoryHistory({ initialEntries: [url] });
@@ -80,6 +82,7 @@ test('extracting params from URL with simple search param but no sort param', ()
     sort: initialSort,
     query: null,
     kinds: null,
+    statuses: undefined,
   };
 
   const history = createMemoryHistory({ initialEntries: [url] });
@@ -100,6 +103,7 @@ test('extracting params from URL with no search param and with sort param with u
     search: null,
     query: null,
     kinds: null,
+    statuses: undefined,
   };
 
   const history = createMemoryHistory({ initialEntries: [url] });
@@ -113,13 +117,15 @@ test('extracting params from URL with no search param and with sort param with u
   expect(result.current.params).toEqual(expected);
 });
 
-test('extracting params from URL with resource kinds', () => {
-  const url = '/test?kinds=node&kinds=db';
+test('extracting params from URL with resource kinds and statuses', () => {
+  const url =
+    '/test?kinds=node&status=unknown&kinds=db&status=healthy&status=random-word';
   const expected = {
     kinds: ['node', 'db'],
     search: null,
     sort: initialSort,
     query: null,
+    statuses: ['unknown', 'healthy'],
   };
 
   const history = createMemoryHistory({ initialEntries: [url] });
diff --git a/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.ts b/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.ts
index d305cbd7d54fb..4cda96af4391b 100644
--- a/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.ts
+++ b/web/packages/teleport/src/components/hooks/useUrlFiltering/useUrlFiltering.ts
@@ -19,8 +19,12 @@
 import { useMemo, useState } from 'react';
 import { useLocation } from 'react-router';
 
+import { parseSortType } from 'design/DataTable/sort';
 import { SortType } from 'design/DataTable/types';
-import { IncludedResourceMode } from 'shared/components/UnifiedResources';
+import {
+  IncludedResourceMode,
+  isResourceHealthStatus,
+} from 'shared/components/UnifiedResources';
 import { makeAdvancedSearchQueryForLabel } from 'shared/utils/advancedSearchLabelQuery';
 
 import { ResourceFilter, ResourceLabel } from 'teleport/services/agents';
@@ -39,7 +43,7 @@ export interface UrlFilteringState {
   search: string;
 }
 
-type URLResourceFilter = Omit<ResourceFilter, 'includedResourceMode'>;
+export type URLResourceFilter = Omit<ResourceFilter, 'includedResourceMode'>;
 
 export function useUrlFiltering(
   initialParams: URLResourceFilter,
@@ -87,6 +91,7 @@ export function useUrlFiltering(
         kinds: newParams.kinds,
         isAdvancedSearch: !!newParams.query,
         pinnedOnly: newParams.pinnedOnly,
+        statuses: newParams.statuses,
       })
     );
   }
@@ -129,21 +134,17 @@ export default function getResourceUrlQueryParams(
   const pinnedOnly = searchParams.get('pinnedOnly');
   const sort = searchParams.get('sort');
   const kinds = searchParams.has('kinds') ? searchParams.getAll('kinds') : null;
+  const statuses = searchParams.has('status')
+    ? searchParams.getAll('status').filter(isResourceHealthStatus)
+    : undefined;
 
-  const sortParam = sort ? sort.split(':') : null;
-
-  // Converts the "fieldname:dir" format into {fieldName: "", dir: ""}
-  const processedSortParam = sortParam
-    ? ({
-        fieldName: sortParam[0],
-        dir: sortParam[1]?.toUpperCase() || 'ASC',
-      } as SortType)
-    : null;
+  const processedSortParam = parseSortType(sort);
 
   return {
     query,
     search,
     kinds,
+    statuses,
     // Conditionally adds the sort field based on whether it exists or not
     ...(!!processedSortParam && { sort: processedSortParam }),
     // Conditionally adds the pinnedResources field based on whether its true or not
diff --git a/web/packages/teleport/src/components/useResources.ts b/web/packages/teleport/src/components/useResources.ts
index d3c24e87beff0..b0f88591223f7 100644
--- a/web/packages/teleport/src/components/useResources.ts
+++ b/web/packages/teleport/src/components/useResources.ts
@@ -20,13 +20,18 @@ import { useState } from 'react';
 
 import { Kind, Resource } from 'teleport/services/resources';
 
+type StateItem<T extends Kind> = {
+  status: EditingStatus;
+  item: Resource<T>;
+};
+
 export default function useResources<T extends Kind>(
   resources: Resource<T>[],
   templates: Templates<T>
 ) {
-  const [state, setState] = useState({
-    status: 'reading' as EditingStatus,
-    item: null as Resource<T>,
+  const [state, setState] = useState<StateItem<T>>({
+    status: 'empty',
+    item: null,
   });
 
   const create = (kind: T) => {
@@ -65,7 +70,7 @@ export default function useResources<T extends Kind>(
     });
   };
 
-  return { ...state, create, edit, disregard, remove };
+  return { ...state, create, edit, disregard, remove, setState };
 }
 
 export type State = ReturnType<typeof useResources>;
diff --git a/web/packages/teleport/src/config.test.ts b/web/packages/teleport/src/config.test.ts
index 593a0ba0b8163..39cccf5e4a3c4 100644
--- a/web/packages/teleport/src/config.test.ts
+++ b/web/packages/teleport/src/config.test.ts
@@ -23,8 +23,9 @@ import cfg, {
   UrlAwsOidcConfigureIdp,
   UrlDeployServiceIamConfigureScriptParams,
 } from './config';
+import { IntegrationTag } from './Integrations/Enroll/Shared';
 
-test('getDeployServiceIamConfigureScriptPath formatting', async () => {
+test('getDeployServiceIamConfigureScriptPath formatting', () => {
   const params: UrlDeployServiceIamConfigureScriptParams = {
     integrationName: 'int-name',
     region: 'us-east-1',
@@ -40,7 +41,7 @@ test('getDeployServiceIamConfigureScriptPath formatting', async () => {
   );
 });
 
-test('getAwsOidcConfigureIdpScriptUrl formatting, without s3 fields', async () => {
+test('getAwsOidcConfigureIdpScriptUrl formatting, without s3 fields', () => {
   const params: UrlAwsOidcConfigureIdp = {
     integrationName: 'int-name',
     roleName: 'role-arn',
@@ -54,7 +55,7 @@ test('getAwsOidcConfigureIdpScriptUrl formatting, without s3 fields', async () =
   );
 });
 
-test('getAwsIamConfigureScriptAppAccessUrl formatting', async () => {
+test('getAwsIamConfigureScriptAppAccessUrl formatting', () => {
   const params: Omit<UrlAwsConfigureIamScriptParams, 'region'> = {
     iamRoleName: 'role-arn',
     accountID: '123456789012',
@@ -66,3 +67,40 @@ test('getAwsIamConfigureScriptAppAccessUrl formatting', async () => {
     `${base}${expected}`
   );
 });
+
+test('getIntegrationsEnroll appends tags', () => {
+  const tags: IntegrationTag[] = ['devicetrust', 'idp'];
+  const url = new URL(
+    'https://example.com' + cfg.getIntegrationsEnrollRoute({ tags })
+  );
+  expect(url.searchParams.getAll('tags')).toEqual(tags);
+});
+
+test('getIntegrationsEnroll without extra params', () => {
+  expect(cfg.getIntegrationsEnrollRoute()).toEqual('/web/integrations/new');
+});
+
+test('getSsoUrl', () => {
+  const providerUrl =
+    '/v1/webapi/oidc/login/web?connector_id=:providerName&login_hint=:loginHint?&redirect_url=:redirect';
+  expect(
+    cfg.getSsoUrl(providerUrl, 'keycloak', 'example.com', undefined)
+  ).toEqual(
+    'http://localhost/v1/webapi/oidc/login/web?connector_id=keycloak&redirect_url=example.com'
+  );
+  expect(
+    cfg.getSsoUrl(providerUrl, 'keycloak', 'example.com', 'user@example.com')
+  ).toEqual(
+    'http://localhost/v1/webapi/oidc/login/web?connector_id=keycloak&login_hint=user@example.com&redirect_url=example.com'
+  );
+  expect(
+    cfg.getSsoUrl(
+      providerUrl,
+      'keycloak',
+      'example.com?a=b&c=d',
+      'user@example.com'
+    )
+  ).toEqual(
+    'http://localhost/v1/webapi/oidc/login/web?connector_id=keycloak&login_hint=user@example.com&redirect_url=example.com%3Fa=b&c=d'
+  );
+});
diff --git a/web/packages/teleport/src/config.ts b/web/packages/teleport/src/config.ts
index d68d0e5d3d61e..b55a8954f5d41 100644
--- a/web/packages/teleport/src/config.ts
+++ b/web/packages/teleport/src/config.ts
@@ -28,7 +28,7 @@ import type {
 } from 'shared/services';
 import { mergeDeep } from 'shared/utils/highbar';
 
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { TaskState } from 'teleport/Integrations/status/AwsOidc/Tasks/constants';
 import type { SortType } from 'teleport/services/agents';
 import {
@@ -45,6 +45,7 @@ import type { YamlSupportedResourceKind } from 'teleport/services/yaml/types';
 
 import { defaultEntitlements } from './entitlement';
 import generateResourcePath from './generateResourcePath';
+import { IntegrationTag } from './Integrations/Enroll/Shared';
 import type { MfaChallengeResponse } from './services/mfa';
 import { KindAuthConnectors } from './services/resources';
 
@@ -95,6 +96,9 @@ const cfg = {
   // isPolicyEnabled refers to the Teleport Policy product
   isPolicyEnabled: false,
 
+  // sessionSummarizerEnabled refers to the AI session summary feature
+  sessionSummarizerEnabled: false,
+
   configDir: '$HOME/.config/teleport',
 
   baseUrl: window.location.origin,
@@ -138,6 +142,7 @@ const cfg = {
     preferredLocalMfa: '' as PreferredMfaType,
     // motd is the message of the day, displayed to users before login.
     motd: '',
+    identifierFirstLoginEnabled: false,
   },
 
   proxyCluster: 'localhost',
@@ -166,11 +171,9 @@ const cfg = {
     joinTokens: '/web/tokens',
     deviceTrust: `/web/devices`,
     deviceTrustAuthorize: '/web/device/authorize/:id?/:token?',
-    workloadIdentity: `/web/workloadidentity`,
     sso: '/web/sso',
     cluster: '/web/cluster/:clusterId/',
     clusters: '/web/clusters',
-    manageCluster: '/web/clusters/:clusterId/manage',
 
     trustedClusters: '/web/trust',
     audit: '/web/cluster/:clusterId/audit',
@@ -183,9 +186,10 @@ const cfg = {
     desktop: '/web/cluster/:clusterId/desktops/:desktopName/:username',
     users: '/web/users',
     bots: '/web/bots',
+    bot: '/web/bot/:botName',
     botInstances: '/web/bots/instances',
-    botInstance: '/web/bot/:botName/instance/:instanceId',
     botsNew: '/web/bots/new/:type?',
+    workloadIdentities: '/web/workloadidentities',
     console: '/web/cluster/:clusterId/console',
     consoleNodes: '/web/cluster/:clusterId/console/nodes',
     consoleConnect: '/web/cluster/:clusterId/console/node/:serverId/:login',
@@ -255,7 +259,7 @@ const cfg = {
     clusterInfoPath: '/v1/webapi/sites/:clusterId/info',
     clusterAlertsPath: '/v1/webapi/sites/:clusterId/alerts',
     clusterEventsPath: `/v1/webapi/sites/:clusterId/events/search?from=:start?&to=:end?&limit=:limit?&startKey=:startKey?&include=:include?`,
-    clusterEventsRecordingsPath: `/v1/webapi/sites/:clusterId/events/search/sessions?from=:start?&to=:end?&limit=:limit?&startKey=:startKey?`,
+    clusterEventsRecordingsPath: `/v1/webapi/sites/:clusterId/events/search/sessions`,
 
     connectionDiagnostic: `/v1/webapi/sites/:clusterId/diagnostics/connections`,
 
@@ -298,7 +302,8 @@ const cfg = {
       'wss://:fqdn/v1/webapi/sites/:clusterId/connect/ws?params=:params&traceparent=:traceparent',
     ttyKubeExecWsAddr:
       'wss://:fqdn/v1/webapi/sites/:clusterId/kube/exec/ws?params=:params&traceparent=:traceparent',
-    ttyDbWsAddr: 'wss://:fqdn/v1/webapi/sites/:clusterId/db/exec/ws',
+    ttyDbWsAddr:
+      'wss://:fqdn/v1/webapi/sites/:clusterId/db/exec/ws?params=:params',
     ttyPlaybackWsAddr:
       'wss://:fqdn/v1/webapi/sites/:clusterId/ttyplayback/:sid?access_token=:token', // TODO(zmb3): get token out of URL
     activeAndPendingSessionsPath: '/v1/webapi/sites/:clusterId/sessions',
@@ -308,15 +313,32 @@ const cfg = {
       '/v1/webapi/sites/:clusterId/kubernetes?searchAsRoles=:searchAsRoles?&limit=:limit?&startKey=:startKey?&query=:query?&search=:search?&sort=:sort?',
     kubernetesResourcesPath:
       '/v1/webapi/sites/:clusterId/kubernetes/resources?searchAsRoles=:searchAsRoles?&limit=:limit?&startKey=:startKey?&query=:query?&search=:search?&sort=:sort?&kubeCluster=:kubeCluster?&kubeNamespace=:kubeNamespace?&kind=:kind?',
+    kubernetesServer: {
+      list: `/v1/webapi/sites/:clusterId/kubernetesservers?searchAsRoles=:searchAsRoles?&limit=:limit?&startKey=:startKey?&query=:query?`,
+    },
 
+    // TODO(rudream): DELETE IN V21.0.0
     usersPath: '/v1/webapi/users',
+    usersPathV2:
+      '/v2/webapi/users?startKey=:startKey?&search=:search?&limit=:limit?',
     userWithUsernamePath: '/v1/webapi/users/:username',
     createPrivilegeTokenPath: '/v1/webapi/users/privilege/token',
 
-    listRolesPath:
-      '/v1/webapi/roles?startKey=:startKey?&search=:search?&limit=:limit?',
-    rolePath: '/v1/webapi/roles/:name?',
+    role: {
+      create: '/v1/webapi/roles',
+      get: '/v1/webapi/roles/:name',
+      delete: '/v1/webapi/roles/:name',
+      update: '/v1/webapi/roles/:name',
+      // TODO(kimlisa): DELETE IN 20.0 along with its backend endpoint in `apiserver.go`
+      list: '/v1/webapi/roles?startKey=:startKey?&search=:search?&limit=:limit?',
+      listV2:
+        '/v2/webapi/roles?startKey=:startKey?&search=:search?&limit=:limit?&includeSystemRoles=:includeSystemRoles?&includeObject=:includeObject?',
+      listWithoutQueryParam: '/v1/webapi/roles',
+    },
+
     presetRolesPath: '/v1/webapi/presetroles',
+    listRequestableRolesPath:
+      '/v1/webapi/requestableroles?startKey=:startKey?&search=:search?&limit=:limit?',
     githubConnectorsPath: '/v1/webapi/github/:name?',
     githubConnectorPath: '/v1/webapi/github/connector/:name',
     trustedClustersPath: '/v1/webapi/trustedcluster/:name?',
@@ -328,7 +350,14 @@ const cfg = {
       createV2: '/v2/webapi/token',
     },
     joinTokenYamlPath: '/v1/webapi/tokens/yaml',
-    joinTokensPath: '/v1/webapi/tokens',
+
+    joinToken: {
+      create: '/v1/webapi/tokens',
+      update: '/v1/webapi/tokens',
+      list: '/v1/webapi/tokens',
+      listV2: '/v2/webapi/tokens',
+    },
+
     dbScriptPath: '/scripts/:token/install-database.sh',
     nodeScriptPath: '/scripts/:token/install-node.sh',
     appNodeScriptPath: '/scripts/:token/install-app.sh?name=:name&uri=:uri',
@@ -353,8 +382,13 @@ const cfg = {
     mfaDevicesPath: '/v1/webapi/mfa/devices',
     mfaDevicePath: '/v1/webapi/mfa/token/:tokenId/devices/:deviceName',
 
-    locksPath: '/v1/webapi/sites/:clusterId/locks',
-    locksPathWithUuid: '/v1/webapi/sites/:clusterId/locks/:uuid',
+    locks: {
+      create: '/v1/webapi/sites/:clusterId/locks',
+      delete: '/v1/webapi/sites/:clusterId/locks/:uuid',
+      read: '/v1/webapi/sites/:clusterId/locks/:uuid',
+      update: '/v1/webapi/sites/:clusterId/locks/:uuid',
+      listV2: '/v2/webapi/sites/:clusterId/locks',
+    },
 
     dbSign: 'v1/webapi/sites/:clusterId/sign/db',
 
@@ -387,6 +421,16 @@ const cfg = {
     userTaskPath: '/v1/webapi/sites/:clusterId/usertask/:name',
     resolveUserTaskPath: '/v1/webapi/sites/:clusterId/usertask/:name/state',
 
+    awsRolesAnywhere: {
+      validate:
+        '/v1/webapi/sites/:clusterId/integrations/aws-ra/:integrationName/validate',
+      generate:
+        '/v1/webapi/scripts/integrations/configure/awsra-trust-anchor.sh?integrationName=:integrationName?&trustAnchor=:trustAnchor?&syncRole=:syncRole?&syncProfile=:syncProfile',
+      ping: '/v1/webapi/sites/:clusterId/integrations/aws-ra/:integrationName/ping',
+      profiles:
+        '/v1/webapi/sites/:clusterId/integrations/aws-ra/:integrationName/listprofiles',
+    },
+
     thumbprintPath: '/v1/webapi/thumbprint',
     pingAwsOidcIntegrationPath:
       '/v1/webapi/sites/:clusterId/integrations/aws-oidc/:name/ping',
@@ -449,11 +493,28 @@ const cfg = {
 
     accessGraphFeatures: '/v1/enterprise/accessgraph/static/features.json',
 
-    botsPath: '/v1/webapi/sites/:clusterId/machine-id/bot/:name?',
     botsTokenPath: '/v1/webapi/sites/:clusterId/machine-id/token',
-    botInstancePath:
-      '/v1/webapi/sites/:clusterId/machine-id/bot/:botName/bot-instance/:instanceId',
-    botInstancesPath: '/v1/webapi/sites/:clusterId/machine-id/bot-instance',
+    bot: {
+      read: '/v1/webapi/sites/:clusterId/machine-id/bot/:botName',
+      list: '/v1/webapi/sites/:clusterId/machine-id/bot',
+      create: '/v1/webapi/sites/:clusterId/machine-id/bot',
+      update: '/v1/webapi/sites/:clusterId/machine-id/bot/:botName',
+      updateV2: '/v2/webapi/sites/:clusterId/machine-id/bot/:botName',
+      updateV3: '/v3/webapi/sites/:clusterId/machine-id/bot/:botName',
+      delete: '/v1/webapi/sites/:clusterId/machine-id/bot/:botName',
+      genWizardCiCd: '/v1/webapi/sites/:clusterId/machine-id/wizards/ci-cd',
+    },
+
+    botInstance: {
+      read: '/v1/webapi/sites/:clusterId/machine-id/bot/:botName/bot-instance/:instanceId',
+      list: '/v1/webapi/sites/:clusterId/machine-id/bot-instance',
+      listV2: '/v2/webapi/sites/:clusterId/machine-id/bot-instance',
+      metrics: '/v1/webapi/sites/:clusterId/machine-id/bot-instance/metrics',
+    },
+
+    workloadIdentity: {
+      list: '/v1/webapi/sites/:clusterId/workload-identity',
+    },
 
     gcpWorkforceConfigurePath:
       '/v1/webapi/scripts/integrations/configure/gcp-workforce-saml.sh?orgId=:orgId&poolName=:poolName&poolProviderName=:poolProviderName',
@@ -469,10 +530,20 @@ const cfg = {
 
     defaultConnectorPath: '/v1/webapi/authconnector/default',
 
+    authConnectorsPath: '/v1/webapi/authconnectors',
+
     yaml: {
       parse: '/v1/webapi/yaml/parse/:kind',
       stringify: '/v1/webapi/yaml/stringify/:kind',
     },
+
+    sessionRecording: {
+      metadata:
+        '/v1/webapi/sites/:clusterId/sessionrecording/:sessionId/metadata/ws',
+      playback:
+        '/v1/webapi/sites/:clusterId/sessionrecording/:sessionId/playback/ws',
+      thumbnail: '/v1/webapi/sites/:clusterId/sessionthumbnail/:sessionId',
+    },
   },
 
   playable_db_protocols: [],
@@ -527,10 +598,32 @@ const cfg = {
     clusterId: string,
     params: UrlSessionRecordingsParams
   ) {
-    return generatePath(cfg.api.clusterEventsRecordingsPath, {
+    const searchParams = new URLSearchParams();
+
+    if (params.start) {
+      searchParams.append('from', params.start);
+    }
+
+    if (params.end) {
+      searchParams.append('to', params.end);
+    }
+
+    if (params.limit) {
+      searchParams.append('limit', params.limit.toString());
+    }
+
+    if (params.startKey) {
+      searchParams.append('startKey', params.startKey);
+    }
+
+    const paramsString = searchParams.toString();
+    const queryString = paramsString ? `?${paramsString}` : '';
+
+    const path = generatePath(cfg.api.clusterEventsRecordingsPath, {
       clusterId,
-      ...params,
     });
+
+    return `${path}${queryString}`;
   },
 
   getAuthProviders() {
@@ -595,14 +688,47 @@ const cfg = {
     return searchString ? `${path}?${searchString}` : path;
   },
 
-  getSsoUrl(providerUrl, providerName, redirect) {
-    return cfg.baseUrl + generatePath(providerUrl, { redirect, providerName });
+  getSsoUrl(providerUrl, providerName, redirect, loginHint) {
+    loginHint = loginHint === '' ? undefined : loginHint;
+    let basePath =
+      cfg.baseUrl +
+      generatePath(providerUrl, { redirect, providerName, loginHint });
+
+    if (!loginHint) {
+      const url = new URL(basePath);
+      url.searchParams.delete('login_hint', '');
+      basePath = url.toString();
+    }
+    return basePath;
   },
 
   getAuditRoute(clusterId: string) {
     return generatePath(cfg.routes.audit, { clusterId });
   },
 
+  /**
+   * getIntegrationsEnrollRoute returns a path to the page which lists all integrations.
+   */
+  getIntegrationsEnrollRoute({
+    tags = [],
+    searchFilter = '',
+  }: {
+    tags?: IntegrationTag[];
+    searchFilter?: string;
+  } = {}) {
+    const searchParams = new URLSearchParams();
+    tags.forEach(tag => {
+      searchParams.append('tags', tag);
+    });
+    if (searchFilter) {
+      searchParams.set('search', searchFilter);
+    }
+    const queryString = searchParams.toString();
+    const path = generatePath(cfg.routes.integrationEnroll);
+
+    return queryString ? `${path}?${queryString}` : path;
+  },
+
   /**
    * Generates a route for an Integration's enrolment page
    *
@@ -654,10 +780,6 @@ const cfg = {
     return generatePath(cfg.routes.nodes, { clusterId });
   },
 
-  getManageClusterRoute(clusterId: string) {
-    return generatePath(cfg.routes.manageCluster, { clusterId });
-  },
-
   getUnifiedResourcesRoute(clusterId: string) {
     return generatePath(cfg.routes.unifiedResources, { clusterId });
   },
@@ -674,8 +796,20 @@ const cfg = {
     return cfg.routes.joinTokens;
   },
 
-  getJoinTokensUrl() {
-    return cfg.api.joinTokensPath;
+  getJoinTokenUrl(req: { action: 'list' | 'listV2' | 'create' | 'update' }) {
+    switch (req.action) {
+      case 'create':
+        return generatePath(cfg.api.joinToken.create);
+      case 'update':
+        return generatePath(cfg.api.joinToken.update);
+      case 'list':
+        return generatePath(cfg.api.joinToken.list);
+      case 'listV2':
+        return generatePath(cfg.api.joinToken.listV2);
+      default:
+        req.action satisfies never;
+        return '';
+    }
   },
 
   getJoinTokenYamlUrl() {
@@ -722,12 +856,44 @@ const cfg = {
     return generatePath(cfg.routes.bots);
   },
 
-  getBotInstancesRoute() {
-    return generatePath(cfg.routes.botInstances);
+  getBotDetailsRoute(botName: string) {
+    return generatePath(cfg.routes.bot, { botName });
+  },
+
+  getBotInstancesRoute(
+    options?: Partial<{
+      query: string;
+      isAdvancedQuery: boolean;
+      sortField: string;
+      sortDir: 'ASC' | 'DESC';
+      selectedItemId: string;
+      activeTab: 'info' | 'health' | 'yaml';
+    }>
+  ) {
+    const search = new URLSearchParams(location.search);
+    if (options?.query) {
+      search.set('query', options.query);
+    }
+    if (options?.isAdvancedQuery) {
+      search.set('is_advanced', '1');
+    }
+    if (options?.sortField) {
+      search.set('sort_field', options.sortField);
+    }
+    if (options?.sortDir) {
+      search.set('sort_dir', options.sortDir);
+    }
+    if (options?.selectedItemId) {
+      search.set('selected', options.selectedItemId);
+    }
+    if (options?.activeTab) {
+      search.set('tab', options.activeTab);
+    }
+    return generatePath(`${cfg.routes.botInstances}?${search.toString()}`);
   },
 
-  getBotInstanceDetailsRoute(params: { botName: string; instanceId: string }) {
-    return generatePath(cfg.routes.botInstance, params);
+  getWorkloadIdentitiesRoute() {
+    return generatePath(cfg.routes.workloadIdentities);
   },
 
   getBotsNewRoute(type?: string) {
@@ -832,6 +998,32 @@ const cfg = {
     return route;
   },
 
+  getSessionRecordingMetadataUrl(
+    clusterId: string,
+    sessionId: string,
+    fqdn: string
+  ) {
+    return generatePath(cfg.api.sessionRecording.metadata, {
+      clusterId,
+      sessionId,
+      fqdn,
+    });
+  },
+
+  getSessionRecordingPlaybackUrl(clusterId: string, sessionId: string) {
+    return generatePath(cfg.api.sessionRecording.playback, {
+      clusterId,
+      sessionId,
+    });
+  },
+
+  getSessionRecordingThumbnailUrl(clusterId: string, sessionId: string) {
+    return generatePath(cfg.api.sessionRecording.thumbnail, {
+      clusterId,
+      sessionId,
+    });
+  },
+
   getConnectionDiagnosticUrl() {
     const clusterId = cfg.proxyCluster;
     return generatePath(cfg.api.connectionDiagnostic, { clusterId });
@@ -885,10 +1077,19 @@ const cfg = {
     return generatePath(cfg.routes.ssoConnector.create, { connectorType });
   },
 
+  // TODO(rudream): DELETE IN V21.0.0
   getUsersUrl() {
     return cfg.api.usersPath;
   },
 
+  getUsersUrlV2(params?: UrlListUsersParams) {
+    return generatePath(cfg.api.usersPathV2, {
+      search: params?.search || undefined,
+      startKey: params?.startKey || undefined,
+      limit: params?.limit || undefined,
+    });
+  },
+
   getUserWithUsernameUrl(username: string) {
     return generatePath(cfg.api.userWithUsernamePath, { username });
   },
@@ -983,16 +1184,41 @@ const cfg = {
     return cfg.routes.newLock;
   },
 
-  getLocksUrl() {
-    // Currently only support get/create locks in root cluster.
-    const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.locksPath, { clusterId });
-  },
-
-  getLocksUrlWithUuid(uuid: string) {
-    // Currently only support delete/lookup locks in root cluster.
-    const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.locksPathWithUuid, { clusterId, uuid });
+  getLockUrl(
+    req: (
+      | { action: 'list-v2' | 'create' }
+      | { action: 'read' | 'delete' | 'update'; uuid: string }
+    ) & { clusterId?: string }
+  ) {
+    const { clusterId = cfg.proxyCluster } = req;
+    switch (req.action) {
+      case 'list-v2':
+        return generatePath(cfg.api.locks.listV2, {
+          clusterId,
+        });
+      case 'read':
+        return generatePath(cfg.api.locks.read, {
+          clusterId,
+          uuid: req.uuid,
+        });
+      case 'create':
+        return generatePath(cfg.api.locks.create, {
+          clusterId,
+        });
+      case 'update':
+        return generatePath(cfg.api.locks.update, {
+          clusterId,
+          uuid: req.uuid,
+        });
+      case 'delete':
+        return generatePath(cfg.api.locks.delete, {
+          clusterId,
+          uuid: req.uuid,
+        });
+      default:
+        req satisfies never;
+        return '';
+    }
   },
 
   getDatabaseSignUrl(clusterId: string) {
@@ -1063,18 +1289,53 @@ const cfg = {
     return generatePath(cfg.api.trustedClustersPath, { name });
   },
 
-  getListRolesUrl(params?: UrlListRolesParams) {
-    return generatePath(cfg.api.listRolesPath, {
+  getRoleUrl(
+    req:
+      | {
+          action: 'get' | 'delete' | 'update';
+          name: string;
+        }
+      | { action: 'list' | 'listv2'; params?: UrlListRolesParams }
+  ) {
+    const action = req.action;
+    switch (action) {
+      case 'get':
+        return generatePath(cfg.api.role.get, { name: req.name });
+      case 'delete':
+        return generatePath(cfg.api.role.delete, { name: req.name });
+      case 'update':
+        return generatePath(cfg.api.role.update, { name: req.name });
+      case 'list': {
+        const params = req.params;
+        return generatePath(cfg.api.role.list, {
+          search: params?.search || undefined,
+          startKey: params?.startKey || undefined,
+          limit: params?.limit || undefined,
+        });
+      }
+      case 'listv2': {
+        const params = req.params;
+        return generatePath(cfg.api.role.listV2, {
+          search: params?.search || undefined,
+          startKey: params?.startKey || undefined,
+          limit: params?.limit || undefined,
+          includeSystemRoles: params?.includeSystemRoles || undefined,
+          includeObject: params?.includeObject || undefined,
+        });
+      }
+      default:
+        action satisfies never;
+    }
+  },
+
+  getListRequestableRolesUrl(params?: UrlListRolesParams) {
+    return generatePath(cfg.api.listRequestableRolesPath, {
       search: params?.search || undefined,
       startKey: params?.startKey || undefined,
       limit: params?.limit || undefined,
     });
   },
 
-  getRoleUrl(name?: string) {
-    return generatePath(cfg.api.rolePath, { name });
-  },
-
   getDiscoveryConfigUrl(clusterId: string) {
     return generatePath(cfg.api.discoveryConfigPath, { clusterId });
   },
@@ -1101,6 +1362,13 @@ const cfg = {
     });
   },
 
+  getKubernetesServerUrl(clusterId: string, params?: UrlResourcesParams) {
+    return generateResourcePath(cfg.api.kubernetesServer.list, {
+      clusterId,
+      ...params,
+    });
+  },
+
   getAuthnChallengeWithTokenUrl(tokenId: string) {
     return generatePath(cfg.api.mfaAuthnChallengeWithTokenPath, {
       tokenId,
@@ -1212,6 +1480,14 @@ const cfg = {
     });
   },
 
+  getValidateAWSRolesAnywhereIntegrationUrl(integrationName: string) {
+    const clusterId = cfg.proxyCluster;
+    return generatePath(cfg.api.awsRolesAnywhere.validate, {
+      clusterId,
+      integrationName,
+    });
+  },
+
   getPingAwsOidcIntegrationUrl({
     integrationName,
     clusterId,
@@ -1394,33 +1670,160 @@ const cfg = {
     );
   },
 
-  getBotTokenUrl() {
-    const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.botsTokenPath, { clusterId });
+  getAwsRolesAnywhereGenerateUrl(
+    integrationName: string,
+    trustAnchor: string,
+    syncRole: string,
+    syncProfile: string
+  ) {
+    const path = cfg.api.awsRolesAnywhere.generate;
+    return (
+      cfg.baseUrl +
+      generatePath(path, {
+        integrationName,
+        trustAnchor,
+        syncRole,
+        syncProfile,
+      })
+    );
   },
 
-  getBotsUrl() {
+  getAwsRolesAnywherePingUrl(integrationName: string) {
+    const path = cfg.api.awsRolesAnywhere.ping;
     const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.botsPath, { clusterId });
+    return generatePath(path, {
+      clusterId,
+      integrationName,
+    });
   },
 
-  getBotUrlWithName(name: string) {
+  getAwsRolesAnywhereProfilesUrl(integrationName: string) {
+    const path = cfg.api.awsRolesAnywhere.profiles;
     const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.botsPath, { clusterId, name });
+    return generatePath(path, {
+      clusterId,
+      integrationName,
+    });
   },
 
-  listBotInstancesUrl() {
+  getBotTokenUrl() {
     const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.botInstancesPath, { clusterId });
+    return generatePath(cfg.api.botsTokenPath, { clusterId });
   },
 
-  getBotInstanceUrl(botName: string, instanceId: string) {
-    const clusterId = cfg.proxyCluster;
-    return generatePath(cfg.api.botInstancePath, {
-      clusterId,
-      botName,
-      instanceId,
-    });
+  getBotUrl(
+    req: (
+      | { action: 'list' | 'create' | 'gen-wizard-cicd' }
+      | {
+          action: 'read' | 'update' | 'update-v2' | 'update-v3' | 'delete';
+          botName: string;
+        }
+    ) & { clusterId?: string }
+  ) {
+    const { clusterId = cfg.proxyCluster } = req;
+    switch (req.action) {
+      case 'list':
+        return generatePath(cfg.api.bot.list, {
+          clusterId,
+        });
+      case 'read':
+        return generatePath(cfg.api.bot.read, {
+          clusterId,
+          botName: req.botName,
+        });
+      case 'create':
+        return generatePath(cfg.api.bot.create, {
+          clusterId,
+        });
+      case 'update':
+        return generatePath(cfg.api.bot.update, {
+          clusterId,
+          botName: req.botName,
+        });
+      case 'update-v2':
+        return generatePath(cfg.api.bot.updateV2, {
+          clusterId,
+          botName: req.botName,
+        });
+      case 'update-v3':
+        return generatePath(cfg.api.bot.updateV3, {
+          clusterId,
+          botName: req.botName,
+        });
+      case 'delete':
+        return generatePath(cfg.api.bot.delete, {
+          clusterId,
+          botName: req.botName,
+        });
+      case 'gen-wizard-cicd':
+        return generatePath(cfg.api.bot.genWizardCiCd, {
+          clusterId,
+        });
+      default:
+        req satisfies never;
+        return '';
+    }
+  },
+
+  getBotInstanceUrl(
+    req: (
+      | {
+          action: 'list';
+        }
+      | {
+          action: 'listV2';
+        }
+      | {
+          action: 'read';
+          botName: string;
+          instanceId: string;
+        }
+      | {
+          action: 'metrics';
+        }
+    ) & { clusterId?: string }
+  ) {
+    const { clusterId = cfg.proxyCluster } = req;
+    switch (req.action) {
+      case 'list':
+        return generatePath(cfg.api.botInstance.list, {
+          clusterId,
+        });
+      case 'listV2':
+        return generatePath(cfg.api.botInstance.listV2, {
+          clusterId,
+        });
+      case 'read':
+        return generatePath(cfg.api.botInstance.read, {
+          clusterId,
+          botName: req.botName,
+          instanceId: req.instanceId,
+        });
+      case 'metrics':
+        return generatePath(cfg.api.botInstance.metrics, {
+          clusterId,
+        });
+      default:
+        req satisfies never;
+        return '';
+    }
+  },
+
+  getWorkloadIdentityUrl(
+    req: {
+      action: 'list';
+    } & { clusterId?: string }
+  ) {
+    const { clusterId = cfg.proxyCluster } = req;
+    switch (req.action) {
+      case 'list':
+        return generatePath(cfg.api.workloadIdentity.list, {
+          clusterId,
+        });
+      default:
+        req.action satisfies never;
+        return '';
+    }
   },
 
   getGcpWorkforceConfigScriptUrl(p: UrlGcpWorkforceConfigParam) {
@@ -1547,6 +1950,24 @@ export interface UrlListRolesParams {
   search?: string;
   limit?: number;
   startKey?: string;
+  /**
+   * default is without system roles.
+   * Only supported with v2 endpoint.
+   */
+  includeSystemRoles?: 'yes' | '';
+  /**
+   * default is without the object.
+   * (only a string content of the resource for yaml purposes)
+   *
+   * Only supported with v2 endpoint and role resource.
+   */
+  includeObject?: 'yes' | '';
+}
+
+export interface UrlListUsersParams {
+  search?: string;
+  limit?: number;
+  startKey?: string;
 }
 
 export interface UrlResourcesParams {
diff --git a/web/packages/teleport/src/entitlement.ts b/web/packages/teleport/src/entitlement.ts
index a1631726bf9f0..e860312219cdd 100644
--- a/web/packages/teleport/src/entitlement.ts
+++ b/web/packages/teleport/src/entitlement.ts
@@ -42,7 +42,8 @@ type entitlement =
   | 'SessionLocks'
   | 'UnrestrictedManagedUpdates'
   | 'UpsellAlert'
-  | 'UsageReporting';
+  | 'UsageReporting'
+  | 'ClientIPRestrictions';
 
 export const defaultEntitlements: Record<
   entitlement,
@@ -73,4 +74,5 @@ export const defaultEntitlements: Record<
   UnrestrictedManagedUpdates: { enabled: false, limit: 0 },
   UpsellAlert: { enabled: false, limit: 0 },
   UsageReporting: { enabled: false, limit: 0 },
+  ClientIPRestrictions: { enabled: false, limit: 0 },
 };
diff --git a/web/packages/teleport/src/features.tsx b/web/packages/teleport/src/features.tsx
index 67343baf8899f..6fe3589688cd4 100644
--- a/web/packages/teleport/src/features.tsx
+++ b/web/packages/teleport/src/features.tsx
@@ -46,15 +46,16 @@ import {
   NavigationCategory,
   NavigationCategory as SideNavigationCategory,
 } from 'teleport/Navigation/categories';
+import { ListSessionRecordingsRoute } from 'teleport/SessionRecordings/list/ListSessionRecordingsRoute';
 
 import { LockedAccessRequests } from './AccessRequests';
 import { AccountPage } from './Account';
 import { AuditContainer as Audit } from './Audit';
 import { AuthConnectorsContainer as AuthConnectors } from './AuthConnectors';
 import { BotInstances } from './BotInstances/BotInstances';
-import { BotInstanceDetails } from './BotInstances/Details/BotInstanceDetails';
 import { Bots } from './Bots';
 import { AddBots } from './Bots/Add';
+import { BotDetails } from './Bots/Details/BotDetails';
 import { Clusters } from './Clusters';
 import { DeviceTrustLocked } from './DeviceTrust';
 import { Discover } from './Discover';
@@ -62,7 +63,6 @@ import { Integrations } from './Integrations';
 import { JoinTokens } from './JoinTokens/JoinTokens';
 import { Locks } from './LocksV2/Locks';
 import { NewLockView } from './LocksV2/NewLock';
-import { RecordingsContainer as Recordings } from './Recordings';
 import { RolesContainer as Roles } from './Roles';
 import { SessionsContainer as Sessions } from './Sessions';
 import { Support } from './Support';
@@ -70,7 +70,7 @@ import { TrustedClusters } from './TrustedClusters';
 import { NavTitle, type FeatureFlags, type TeleportFeature } from './types';
 import { UnifiedResources } from './UnifiedResources';
 import { Users } from './Users';
-import { EmptyState as WorkloadIdentityEmptyState } from './WorkloadIdentity/EmptyState/EmptyState';
+import { WorkloadIdentities } from './WorkloadIdentity/WorkloadIdentities';
 
 // to promote feature discoverability, most features should be visible in the navigation even if a user doesnt have access.
 // However, there are some cases where hiding the feature is explicitly requested. Use this as a backdoor to hide the features that
@@ -80,8 +80,7 @@ export function shouldHideFromNavigation(cfg: Cfg) {
 }
 
 class AccessRequests implements TeleportFeature {
-  category = NavigationCategory.Resources;
-  sideNavCategory = SideNavigationCategory.Resources;
+  category = NavigationCategory.IdentityGovernance;
 
   route = {
     title: 'Access Requests',
@@ -103,8 +102,6 @@ class AccessRequests implements TeleportFeature {
     },
     searchableTags: ['access requests'],
   };
-
-  topMenuItem = this.navigationItem;
 }
 
 export class FeatureJoinTokens implements TeleportFeature {
@@ -128,7 +125,7 @@ export class FeatureJoinTokens implements TeleportFeature {
   };
 
   hasAccess(flags: FeatureFlags): boolean {
-    return flags.tokens;
+    return flags.listTokens;
   }
 }
 
@@ -198,7 +195,6 @@ export class FeatureSessions implements TeleportFeature {
     },
     searchableTags: ['active sessions', 'active', 'sessions'],
   };
-  topMenuItem = this.navigationItem;
 }
 
 // ****************************
@@ -306,13 +302,22 @@ export class FeatureBotInstances implements TeleportFeature {
   }
 }
 
+// TODO(nicholasmarais1158) Remove this feature stub when teleport.e no longer
+// uses it.
 export class FeatureBotInstanceDetails implements TeleportFeature {
-  parent = FeatureBotInstances;
+  hasAccess() {
+    return false;
+  }
+}
+
+export class FeatureBotDetails implements TeleportFeature {
+  parent = FeatureBots;
 
   route = {
-    title: 'Bot instance details',
-    path: cfg.routes.botInstance,
-    component: BotInstanceDetails,
+    title: 'Bot details',
+    path: cfg.routes.bot,
+    exact: true,
+    component: BotDetails,
   };
 
   hasAccess() {
@@ -340,6 +345,8 @@ export class FeatureAddBotsShortcut implements TeleportFeature {
 
 export class FeatureAddBots implements TeleportFeature {
   category = NavigationCategory.AddNew;
+  // botsNew redirects to Integrations page
+  isHyperLink = true;
 
   route = {
     title: 'Bot',
@@ -462,7 +469,7 @@ export class FeatureNewLock implements TeleportFeature {
   };
 
   hasAccess(flags: FeatureFlags) {
-    return flags.newLocks;
+    return flags.addLocks;
   }
 
   // getRoute allows child class extending this
@@ -490,7 +497,38 @@ export class FeatureDiscover implements TeleportFeature {
     getLink() {
       return cfg.routes.discover;
     },
-    searchableTags: ['new', 'add', 'enroll', 'resources'],
+    searchableTags: [
+      'new',
+      'add',
+      'enroll',
+      'resources',
+      'discover',
+      'saml',
+      'idp',
+      'grafana',
+      'entra',
+      'aws',
+      'kubernetes',
+      'node',
+      'ssh',
+      'linux',
+      'ubuntu',
+      'centos',
+      'debian',
+      'windows',
+      'desktop',
+      'ec2',
+      'eks',
+      'rds',
+      'mysql',
+      'postgresql',
+      'mariadb',
+      'dynamodb',
+      'cassandra',
+      'azure',
+      'cockroachdb',
+      'mongodb',
+    ],
   };
 
   hasAccess(flags: FeatureFlags) {
@@ -578,7 +616,7 @@ export class FeatureRecordings implements TeleportFeature {
     title: 'Session Recordings',
     path: cfg.routes.recordings,
     exact: true,
-    component: Recordings,
+    component: ListSessionRecordingsRoute,
   };
 
   hasAccess(flags: FeatureFlags) {
@@ -632,7 +670,7 @@ export class FeatureClusters implements TeleportFeature {
   };
 
   hasAccess(flags: FeatureFlags) {
-    return cfg.isDashboard || flags.trustedClusters;
+    return flags.trustedClusters && !cfg.isCloud && !cfg.isDashboard;
   }
 
   showInDashboard = true;
@@ -680,17 +718,17 @@ export class FeatureTrust implements TeleportFeature {
 export class FeatureWorkloadIdentity implements TeleportFeature {
   category = NavigationCategory.MachineWorkloadId;
   route = {
-    title: 'Workload Identity',
-    path: cfg.routes.workloadIdentity,
+    title: 'Workload Identities',
+    path: cfg.routes.workloadIdentities,
     exact: true,
-    component: WorkloadIdentityEmptyState,
+    component: WorkloadIdentities,
   };
 
-  // for now, workload identity page is just a placeholder so everyone has
-  // access, unless feature hiding is off
-  hasAccess(): boolean {
+  hasAccess(flags: FeatureFlags): boolean {
+    // if feature hiding is enabled, only show
+    // if the user has access
     if (shouldHideFromNavigation(cfg)) {
-      return false;
+      return flags.listWorkloadIdentities;
     }
     return true;
   }
@@ -698,7 +736,7 @@ export class FeatureWorkloadIdentity implements TeleportFeature {
     title: NavTitle.WorkloadIdentity,
     icon: License,
     getLink() {
-      return cfg.routes.workloadIdentity;
+      return cfg.routes.workloadIdentities;
     },
     searchableTags: ['workload identity', 'workload', 'identity'],
   };
@@ -795,7 +833,14 @@ export class FeatureHelpAndSupport implements TeleportFeature {
     getLink() {
       return cfg.routes.support;
     },
-    searchableTags: ['help', 'support', NavTitle.HelpAndSupport],
+    searchableTags: [
+      'help',
+      'support',
+      'contacts',
+      'security',
+      'business',
+      'version',
+    ],
   };
 }
 
@@ -812,8 +857,8 @@ export function getOSSFeatures(): TeleportFeature[] {
     // - Access
     new FeatureUsers(),
     new FeatureBots(),
+    new FeatureBotDetails(),
     new FeatureBotInstances(),
-    new FeatureBotInstanceDetails(),
     new FeatureAddBotsShortcut(),
     new FeatureJoinTokens(),
     new FeatureRoles(),
diff --git a/web/packages/teleport/src/generateResourcePath.ts b/web/packages/teleport/src/generateResourcePath.ts
index d3245b2dea653..a999390fec9df 100644
--- a/web/packages/teleport/src/generateResourcePath.ts
+++ b/web/packages/teleport/src/generateResourcePath.ts
@@ -34,8 +34,14 @@ export default function generateResourcePath(
       ].dir.toLowerCase()}`;
     } else if (param === 'kinds') {
       processedParams[param] = (params[param] ?? []).join('&kinds=');
+    } else if (param === 'statuses') {
+      processedParams[param] = (params[param] ?? []).join('&status=');
     } else if (param === 'regions') {
       processedParams[param] = (params[param] ?? []).join('&regions=');
+    } else if (param === 'owners') {
+      processedParams[param] = (params[param] ?? []).join('&owners=');
+    } else if (param === 'roles') {
+      processedParams[param] = (params[param] ?? []).join('&roles=');
     } else
       processedParams[param] = params[param]
         ? encodeURIComponent(params[param])
@@ -57,6 +63,7 @@ export default function generateResourcePath(
     // param
     .replace(':kind?', processedParams.kind || '')
     .replace(':kinds?', processedParams.kinds || '')
+    .replace(':status?', processedParams.statuses || '')
     .replace(':kubeCluster?', processedParams.kubeCluster || '')
     .replace(':kubeNamespace?', processedParams.kubeNamespace || '')
     .replace(':limit?', params.limit || '')
@@ -68,6 +75,8 @@ export default function generateResourcePath(
     .replace(':sort?', processedParams.sort || '')
     .replace(':startKey?', params.startKey || '')
     .replace(':regions?', processedParams.regions || '')
+    .replace(':owners?', processedParams.owners || '')
+    .replace(':roles?', processedParams.roles || '')
     .replace(
       ':includedResourceMode?',
       processedParams.includedResourceMode || ''
diff --git a/web/packages/teleport/src/lib/AuthenticatedWebSocket.mock.ts b/web/packages/teleport/src/lib/AuthenticatedWebSocket.mock.ts
new file mode 100644
index 0000000000000..4ad1070c11f49
--- /dev/null
+++ b/web/packages/teleport/src/lib/AuthenticatedWebSocket.mock.ts
@@ -0,0 +1,118 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+// MockAuthenticatedWebSocket is a mock implementation of the AuthenticatedWebSocket class
+// that simulates a WebSocket connection for testing purposes.
+export class MockAuthenticatedWebSocket {
+  private _ws: WebSocket;
+
+  send: (data: string) => void;
+  close: (code?: number, reason?: string) => void;
+  onopen: ((event: Event) => void) | null;
+  onmessage: ((event: MessageEvent) => void) | null;
+  onerror: ((event: Event) => void) | null;
+  onclose: ((event: CloseEvent) => void) | null;
+  addEventListener: (
+    type: string,
+    listener: EventListenerOrEventListenerObject
+  ) => void;
+  removeEventListener: (
+    type: string,
+    listener: EventListenerOrEventListenerObject
+  ) => void;
+  dispatchEvent: (event: Event) => boolean;
+
+  constructor(url: string) {
+    // Convert relative URL to absolute WebSocket URL for testing
+    const wsUrl = url.startsWith('/') ? `ws://localhost${url}` : url;
+
+    const ws = new WebSocket(wsUrl);
+
+    // Store the underlying WebSocket
+    this._ws = ws;
+
+    // Initialize properties
+    this.onopen = null;
+    this.onmessage = null;
+    this.onerror = null;
+    this.onclose = null;
+
+    // Set up event handlers
+    ws.onopen = event => {
+      if (this.onopen) {
+        this.onopen(event);
+      }
+    };
+
+    ws.onmessage = event => {
+      if (this.onmessage) {
+        this.onmessage(event);
+      }
+    };
+
+    ws.onerror = event => {
+      if (this.onerror) {
+        this.onerror(event);
+      }
+    };
+
+    ws.onclose = event => {
+      if (this.onclose) {
+        this.onclose(event);
+      }
+    };
+
+    // Bind methods
+    this.send = data => {
+      ws.send(data);
+    };
+
+    this.close = (code, reason) => {
+      ws.close(code, reason);
+    };
+
+    this.addEventListener = (type, listener) =>
+      ws.addEventListener(type, listener);
+    this.removeEventListener = (type, listener) =>
+      ws.removeEventListener(type, listener);
+    this.dispatchEvent = event => ws.dispatchEvent(event);
+  }
+
+  // Getters for WebSocket properties
+  get readyState() {
+    return this._ws.readyState;
+  }
+  get url() {
+    return this._ws.url;
+  }
+  get protocol() {
+    return this._ws.protocol;
+  }
+  get extensions() {
+    return this._ws.extensions;
+  }
+  get bufferedAmount() {
+    return this._ws.bufferedAmount;
+  }
+  get binaryType() {
+    return this._ws.binaryType;
+  }
+  set binaryType(value) {
+    this._ws.binaryType = value;
+  }
+}
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockAndUnlock.story.tsx b/web/packages/teleport/src/lib/locks/ResourceLockAndUnlock.story.tsx
new file mode 100644
index 0000000000000..a84bcee08f6ec
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockAndUnlock.story.tsx
@@ -0,0 +1,208 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { useEffect, useState } from 'react';
+
+import { ButtonPrimary } from 'design/Button';
+import Flex from 'design/Flex';
+import { LockKey } from 'design/Icon/Icons/LockKey';
+import { Unlock } from 'design/Icon/Icons/Unlock';
+
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  createLockSuccess,
+  listV2LocksSuccess,
+  removeLockSuccess,
+} from 'teleport/test/helpers/locks';
+
+import { ResourceLockDialog } from './ResourceLockDialog';
+import { ResourceLockIndicator } from './ResourceLockIndicator';
+import { ResourceUnlockDialog } from './ResourceUnlockDialog';
+import { useResourceLock } from './useResourceLock';
+
+const meta = {
+  title: 'Teleport/lib/Locks',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const LockingDialogs: Story = {
+  args: {
+    targetKind: 'user',
+    targetName: 'example-user',
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listV2LocksSuccess({
+          locks: [],
+        }),
+        removeLockSuccess(),
+        createLockSuccess(),
+      ],
+    },
+  },
+};
+
+export const UnlockNotSupported: Story = {
+  args: {
+    targetKind: 'user',
+    targetName: 'example-user',
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listV2LocksSuccess({
+          locks: [
+            {
+              name: '785d167d-cb2b-4de4-8268-efb6d8932dde',
+              message: 'Locking bots until security alert is resolved.',
+              expires: '2023-01-01T00:00:00Z',
+              createdAt: '2023-01-01T00:00:00Z',
+              targets: {
+                user: 'example-user',
+              },
+            },
+            {
+              name: '0ef9909f-4980-40f7-bc85-ad9ef72bc059',
+              expires: '2023-01-01T00:00:00Z',
+              targets: {
+                user: 'example-user',
+              },
+            },
+            {
+              name: '0e07e3f6-55bc-421d-ab24-1b521a0b6452',
+              message:
+                'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.',
+              createdAt: '2023-01-01T00:00:00Z',
+              targets: {
+                user: 'example-user',
+              },
+            },
+          ],
+        }),
+      ],
+    },
+  },
+};
+
+type Props = {
+  targetKind: LockResourceKind;
+  targetName: string;
+};
+
+function Wrapper(props: Props) {
+  const customAcl = makeAcl({
+    lock: {
+      ...defaultAccess,
+      list: true,
+      remove: true,
+      create: true,
+      edit: true,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <Inner {...props} />
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
+
+function Inner(props: Props) {
+  const { targetKind, targetName } = props;
+
+  const [showDialog, setShowDialog] = useState<'none' | 'lock' | 'unlock'>(
+    'none'
+  );
+  const [message, setMessage] = useState('');
+
+  useEffect(() => {
+    const id = setTimeout(() => setMessage(''), 3000);
+    return () => clearTimeout(id);
+  }, [message]);
+
+  const { isLocked } = useResourceLock({ targetKind, targetName });
+
+  return (
+    <Flex flexDirection={'column'} alignItems={'center'} gap={3}>
+      <ResourceLockIndicator targetKind={targetKind} targetName={targetName} />
+      <ButtonPrimary
+        onClick={() => setShowDialog(isLocked ? 'unlock' : 'lock')}
+        gap={2}
+      >
+        {isLocked ? <Unlock size={'medium'} /> : <LockKey size={'medium'} />}
+        {isLocked ? 'Unlock' : 'Lock'} {targetName}
+      </ButtonPrimary>
+      {message}
+      {showDialog === 'unlock' ? (
+        <ResourceUnlockDialog
+          targetKind={targetKind}
+          targetName={targetName}
+          onCancel={() => {
+            setMessage('Unlock was cancelled');
+            setShowDialog('none');
+          }}
+          onComplete={() => {
+            setMessage('Unlock was completed');
+            setShowDialog('none');
+          }}
+        />
+      ) : undefined}
+      {showDialog === 'lock' ? (
+        <ResourceLockDialog
+          targetKind={targetKind}
+          targetName={targetName}
+          onCancel={() => {
+            setMessage('Lock was cancelled');
+            setShowDialog('none');
+          }}
+          onComplete={() => {
+            setMessage('Lock was completed');
+            setShowDialog('none');
+          }}
+        />
+      ) : undefined}
+    </Flex>
+  );
+}
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockDialog.test.tsx b/web/packages/teleport/src/lib/locks/ResourceLockDialog.test.tsx
new file mode 100644
index 0000000000000..c5482bea3c6cc
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockDialog.test.tsx
@@ -0,0 +1,169 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { UserEvent } from '@testing-library/user-event';
+import { setupServer } from 'msw/node';
+import { ComponentPropsWithoutRef, PropsWithChildren } from 'react';
+
+import {
+  Providers,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+} from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import {
+  createLockSuccess,
+  listV2LocksSuccess,
+} from 'teleport/test/helpers/locks';
+
+import { ResourceLockDialog } from './ResourceLockDialog';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('ResourceLockDialog', () => {
+  it('should cancel', async () => {
+    withListLocksSuccess();
+
+    const onCancel = jest.fn();
+
+    const { user } = renderComponent({ onCancel });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeEnabled();
+    });
+
+    expect(screen.getByText('Lock test-user?')).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+  });
+
+  it('should submit', async () => {
+    withListLocksSuccess();
+
+    const onComplete = jest.fn();
+
+    const { user } = renderComponent({ onComplete });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeEnabled();
+    });
+
+    await inputMessage(user, 'This is a test message');
+    await inputTtl(user, '24h');
+
+    withLockSuccess();
+    await user.click(screen.getByRole('button', { name: 'Create Lock' }));
+
+    await waitFor(() => {
+      expect(onComplete).toHaveBeenCalledTimes(1);
+    });
+
+    expect(onComplete).toHaveBeenCalledWith({
+      createdAt: expect.anything(),
+      createdBy: expect.anything(),
+      expires: expect.anything(),
+      message: 'This is a test message',
+      name: expect.anything(),
+      targetLookup: {
+        user: 'test-user',
+      },
+      targets: [
+        {
+          kind: 'user',
+          name: 'test-user',
+        },
+      ],
+    });
+  });
+});
+
+function renderComponent(
+  params?: Pick<
+    Partial<ComponentPropsWithoutRef<typeof ResourceLockDialog>>,
+    'onCancel' | 'onComplete'
+  >
+) {
+  const { onCancel = jest.fn(), onComplete = jest.fn() } = params ?? {};
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <ResourceLockDialog
+        targetKind="user"
+        targetName="test-user"
+        onCancel={onCancel}
+        onComplete={onComplete}
+      />,
+      { wrapper: makeWrapper() }
+    ),
+    user,
+  };
+}
+
+function makeWrapper() {
+  const ctx = createTeleportContext();
+  return (props: PropsWithChildren) => (
+    <Providers>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        {props.children}
+      </TeleportProviderBasic>
+    </Providers>
+  );
+}
+
+async function inputMessage(user: UserEvent, value: string) {
+  const input = screen.getByLabelText('Reason');
+  await user.type(input, value);
+}
+
+async function inputTtl(user: UserEvent, value: string) {
+  const input = screen.getByLabelText('Expiry');
+  await user.type(input, value);
+}
+
+function withListLocksSuccess(
+  ...params: Parameters<typeof listV2LocksSuccess>
+) {
+  server.use(
+    listV2LocksSuccess({
+      locks: params[0]?.locks ?? [],
+    })
+  );
+}
+
+function withLockSuccess() {
+  server.use(createLockSuccess());
+}
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockDialog.tsx b/web/packages/teleport/src/lib/locks/ResourceLockDialog.tsx
new file mode 100644
index 0000000000000..3606c1d90fca4
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockDialog.tsx
@@ -0,0 +1,161 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+
+import { Alert } from 'design/Alert/Alert';
+import { ButtonSecondary, ButtonWarning } from 'design/Button/Button';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from 'design/DialogConfirmation';
+import Flex from 'design/Flex/Flex';
+import Text from 'design/Text/Text';
+import FieldInput from 'shared/components/FieldInput/FieldInput';
+import { FieldTextArea } from 'shared/components/FieldTextArea/FieldTextArea';
+import { Validation } from 'shared/components/Validation/Validation';
+
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+import { Lock } from 'teleport/services/locks';
+
+import { useResourceLock } from './useResourceLock';
+
+/**
+ * A confirmation dialog component for locking a resource. It uses
+ * `useResourceLock` internally to load existing lock state, check permissions
+ * and perform the lock operation. An optional message and/or TTL is captured.
+ * Conditional rendering is used to show and hide the dialog.
+ *
+ * Example usage:
+ * ```tsx
+ * const [showLockDialog, setShowLockDialog] = useState(false);
+ * {showLockDialog ? (
+ *  <ResourceLockDialog
+ *    targetKind={'user'}
+ *    targetName={'example-user'}
+ *    onCancel={() => setShowLockDialog(false)}
+ *    onComplete={() => setShowLockDialog(false)}
+ *  />
+ * ) : undefined}
+ * ```
+ *
+ * @param props
+ * @returns
+ */
+export function ResourceLockDialog(props: {
+  /** The kind of resource to lock. */
+  targetKind: LockResourceKind;
+  /** The name of the resource to lock. */
+  targetName: string;
+  /**
+   * Called when the user cancels the lock operation.
+   */
+  onCancel: () => void;
+  /**
+   * Called when the user completes the lock operation.
+   * @param newLock the newly created lock
+   */
+  onComplete: (newLock: Lock) => void;
+}) {
+  const { targetKind, targetName, onCancel, onComplete } = props;
+
+  const [message, setMessage] = useState('');
+  const [ttl, setTtl] = useState('');
+
+  const { isLoading, canLock, lock, lockPending, lockError } = useResourceLock({
+    targetKind,
+    targetName,
+  });
+
+  const handleLock = async () => {
+    let newLock: Lock | undefined = undefined;
+    try {
+      newLock = await lock(message, ttl);
+    } catch {
+      // Swallow this error - it's handled as `lockError` above
+      return;
+    }
+    onComplete(newLock);
+  };
+
+  return (
+    <Dialog onClose={onCancel} open={true}>
+      <DialogHeader>
+        <DialogTitle>Lock {targetName}?</DialogTitle>
+      </DialogHeader>
+      <Validation>
+        {({ validator }) => (
+          <form
+            onSubmit={e => {
+              e.preventDefault();
+              if (validator.validate()) {
+                handleLock();
+              }
+            }}
+          >
+            <DialogContent maxWidth="650px">
+              <Text mb={3}>
+                Locking a resource will terminate all of its connections and
+                reject any new API requests.
+              </Text>
+              <FieldTextArea
+                label="Reason"
+                placeholder="Going down for maintenance"
+                value={message}
+                readonly={isLoading || lockPending}
+                onChange={e => setMessage(e.target.value)}
+              />
+              <FieldInput
+                label="Expiry"
+                value={ttl}
+                readonly={isLoading || lockPending}
+                onChange={e => setTtl(e.target.value)}
+                helperText={
+                  'A duration string such as 12h, 2h 45m, 43200s. Valid time units are h, m and s.'
+                }
+              />
+              {lockError ? (
+                <Alert kind="danger" details={lockError.message} mt={3} mb={0}>
+                  Failed to lock <code>{targetName}</code>
+                </Alert>
+              ) : undefined}
+            </DialogContent>
+          </form>
+        )}
+      </Validation>
+      <DialogFooter>
+        <Flex gap={3}>
+          <ButtonWarning
+            onClick={handleLock}
+            disabled={isLoading || !canLock || lockPending}
+          >
+            Create Lock
+          </ButtonWarning>
+          <ButtonSecondary
+            disabled={isLoading || lockPending}
+            onClick={onCancel}
+          >
+            Cancel
+          </ButtonSecondary>
+        </Flex>
+      </DialogFooter>
+    </Dialog>
+  );
+}
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockIndicator.story.tsx b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.story.tsx
new file mode 100644
index 0000000000000..bedfe903c6643
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.story.tsx
@@ -0,0 +1,148 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+import Flex from 'design/Flex';
+
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import { listV2LocksSuccess } from 'teleport/test/helpers/locks';
+
+import { ResourceLockIndicator } from './ResourceLockIndicator';
+
+const meta = {
+  title: 'Teleport/lib/Locks/ResourceLockIndicator',
+  component: Wrapper,
+  beforeEach: () => {
+    queryClient.clear(); // Prevent cached data sharing between stories
+  },
+} satisfies Meta<typeof Wrapper>;
+
+type Story = StoryObj<typeof meta>;
+
+export default meta;
+
+export const LockedSingle: Story = {
+  args: {
+    targetKind: 'user',
+    targetName: 'example-user',
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listV2LocksSuccess({
+          locks: [
+            {
+              name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+              message: 'This is a test message',
+              expires: '2023-12-31T23:59:59Z',
+              targets: {
+                user: 'example-user',
+              },
+              createdAt: '2023-01-01T00:00:00Z',
+              createdBy: 'admin',
+            },
+          ],
+        }),
+      ],
+    },
+  },
+};
+
+export const LockedMultiple: Story = {
+  args: {
+    targetKind: 'user',
+    targetName: 'example-user',
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        listV2LocksSuccess({
+          locks: [
+            {
+              name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+              message: 'This is a test message',
+              expires: '2023-12-31T23:59:59Z',
+              targets: {
+                user: 'example-user',
+              },
+              createdAt: '2023-01-01T00:00:00Z',
+              createdBy: 'admin',
+            },
+            {
+              name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+              message: 'This is a test message',
+              expires: '2023-12-31T23:59:59Z',
+              targets: {
+                user: 'example-user',
+              },
+              createdAt: '2023-01-01T00:00:00Z',
+              createdBy: 'admin',
+            },
+          ],
+        }),
+      ],
+    },
+  },
+};
+
+type Props = {
+  targetKind: LockResourceKind;
+  targetName: string;
+};
+
+function Wrapper(props: Props) {
+  const customAcl = makeAcl({
+    lock: {
+      ...defaultAccess,
+      list: true,
+      remove: true,
+      create: true,
+      edit: true,
+    },
+  });
+
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+  return (
+    <QueryClientProvider client={queryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <Flex alignItems={'center'}>
+          <ResourceLockIndicator
+            targetKind={props.targetKind}
+            targetName={props.targetName}
+          />
+        </Flex>
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockIndicator.test.tsx b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.test.tsx
new file mode 100644
index 0000000000000..d6de0e48f4b4f
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.test.tsx
@@ -0,0 +1,146 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+
+import {
+  Providers,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+} from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { listV2LocksSuccess } from 'teleport/test/helpers/locks';
+
+import { ResourceLockIndicator } from './ResourceLockIndicator';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('ResourceUnlockDialog', () => {
+  it('show a tooltip with details of a single lock', async () => {
+    const user = userEvent.setup();
+
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '2e76fda0-a698-46c1-977d-cf95ad2df7fc',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: { user: 'test-user' },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    render(<ResourceLockIndicator targetKind="user" targetName="test-user" />, {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByText('Locked')).toBeInTheDocument();
+    });
+
+    await user.hover(screen.getByText('Locked'));
+    expect(
+      screen.getByText('Message: This is a test message', { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText('Expires: Dec 31, 2023, 11:59 PM GMT+0', {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+  });
+
+  it('show a tooltip when multiple locks exist', async () => {
+    const user = userEvent.setup();
+
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '2e76fda0-a698-46c1-977d-cf95ad2df7fc',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: { user: 'test-user' },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+        {
+          name: 'b8f312c9-f8b7-4ef2-b3b1-97c07a750bff',
+          message: 'This is a another test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: { user: 'test-user' },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    render(<ResourceLockIndicator targetKind="user" targetName="test-user" />, {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByText('Locked')).toBeInTheDocument();
+    });
+
+    await user.hover(screen.getByText('Locked'));
+    expect(
+      screen.getByText('Multiple locks in-force', { exact: false })
+    ).toBeInTheDocument();
+  });
+});
+
+function makeWrapper() {
+  const ctx = createTeleportContext();
+  return (props: PropsWithChildren) => (
+    <Providers>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        {props.children}
+      </TeleportProviderBasic>
+    </Providers>
+  );
+}
+
+function withListLocksSuccess(
+  ...params: Parameters<typeof listV2LocksSuccess>
+) {
+  server.use(
+    listV2LocksSuccess({
+      locks: params[0]?.locks ?? [],
+    })
+  );
+}
diff --git a/web/packages/teleport/src/lib/locks/ResourceLockIndicator.tsx b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.tsx
new file mode 100644
index 0000000000000..95145ccab0b8e
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceLockIndicator.tsx
@@ -0,0 +1,101 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import format from 'date-fns/format';
+import parseISO from 'date-fns/parseISO';
+import styled from 'styled-components';
+
+import Flex from 'design/Flex/Flex';
+import { LockKey } from 'design/Icon/Icons/LockKey';
+import Text from 'design/Text/Text';
+import { fontWeights } from 'design/theme/typography';
+import { HoverTooltip } from 'design/Tooltip/HoverTooltip';
+
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+
+import { useResourceLock } from './useResourceLock';
+
+/**
+ * `ResourceLockIndicator` is a component to show the lock status of a resource.
+ * It uses `useResourceLock` internally. If not locked, this component renders
+ * nothing.
+ *
+ * @param props
+ * @returns
+ */
+export function ResourceLockIndicator(props: {
+  /** The kind of resource to display. */
+  targetKind: LockResourceKind;
+  /** The name of the resource to display. */
+  targetName: string;
+}) {
+  const { targetKind, targetName } = props;
+
+  const { locks } = useResourceLock({
+    targetKind,
+    targetName,
+  });
+
+  if (!locks || locks.length === 0) {
+    return undefined;
+  }
+
+  const [{ expires, message }] = locks;
+
+  return (
+    <HoverTooltip
+      placement="bottom"
+      tipContent={
+        locks.length > 1 ? (
+          <>
+            Multiple locks in-force. See{' '}
+            <b>Identity Governance &gt; Session &amp; Identity Locks</b> for
+            more details.
+          </>
+        ) : (
+          <>
+            {message ? `Message: ${message}` : 'Message: none'}
+            <br />
+            {expires
+              ? `Expires: ${format(parseISO(expires), 'PP, p z')}`
+              : 'Expires: never'}
+          </>
+        )
+      }
+    >
+      <LockedIndicatorContainer>
+        <LockKey size="medium" />
+        <Text typography="body2" fontWeight={fontWeights.bold}>
+          Locked
+        </Text>
+      </LockedIndicatorContainer>
+    </HoverTooltip>
+  );
+}
+
+const LockedIndicatorContainer = styled(Flex)`
+  height: 32px;
+  align-items: center;
+  gap: ${({ theme }) => theme.space[2]}px;
+  padding-left: ${({ theme }) => theme.space[3]}px;
+  padding-right: ${({ theme }) => theme.space[3]}px;
+  background-color: ${({ theme }) => theme.colors.interactive.tonal.danger[0]};
+  border: 1px solid ${({ theme }) => theme.colors.interactive.tonal.danger[2]};
+  border-radius: 16px;
+  color: ${({ theme }) => theme.colors.text.slightlyMuted};
+`;
diff --git a/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.test.tsx b/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.test.tsx
new file mode 100644
index 0000000000000..3fdaf9a0936b9
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.test.tsx
@@ -0,0 +1,248 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { createMemoryHistory } from 'history';
+import { setupServer } from 'msw/node';
+import {
+  ComponentPropsWithoutRef,
+  MouseEventHandler,
+  PropsWithChildren,
+} from 'react';
+import { Router } from 'react-router';
+
+import {
+  Providers,
+  render,
+  screen,
+  testQueryClient,
+  userEvent,
+  waitFor,
+  within,
+} from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import {
+  listV2LocksSuccess,
+  removeLockSuccess,
+} from 'teleport/test/helpers/locks';
+
+import { ResourceUnlockDialog } from './ResourceUnlockDialog';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('ResourceUnlockDialog', () => {
+  it('should cancel', async () => {
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-01-01T00:00:00Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '2023-12-31T23:59:59Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    const onCancel = jest.fn();
+
+    const { user } = renderComponent({ onCancel });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeEnabled();
+    });
+
+    expect(screen.getByText('Unlock test-user?')).toBeInTheDocument();
+    expect(
+      screen.getByText('This is a test message', { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      within(screen.getByText('Expires').closest('div')!).getByText(
+        'Jan 1, 2023, 12:00 AM GMT+0',
+        { exact: false }
+      )
+    ).toBeInTheDocument();
+    expect(
+      within(screen.getByText('Locked on').closest('div')!).getByText(
+        'Dec 31, 2023, 11:59 PM GMT+0',
+        { exact: false }
+      )
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+  });
+
+  it('should submit', async () => {
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    const onComplete = jest.fn();
+
+    const { user } = renderComponent({ onComplete });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeEnabled();
+    });
+
+    withUnlockSuccess();
+    await user.click(screen.getByRole('button', { name: 'Remove Lock' }));
+
+    await waitFor(() => {
+      expect(onComplete).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it('should handle multiple locks', async () => {
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'message 1',
+          expires: '1790-01-01T00:00:01Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '1790-01-01T00:00:02Z',
+          createdBy: 'admin',
+        },
+        {
+          name: 'de64fc0c-7169-4bee-95a0-5458bc42447f',
+          message: 'message 2',
+          expires: '1790-01-01T00:00:03Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '1790-01-01T00:00:04Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    const onCancel = jest.fn();
+    const onGoToLocksForTesting = jest.fn((event => {
+      // Prevent errors related to window.location not being implemented.
+      event.preventDefault();
+    }) satisfies MouseEventHandler<HTMLAnchorElement>);
+
+    const { user } = renderComponent({ onCancel, onGoToLocksForTesting });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeEnabled();
+    });
+
+    expect(screen.getByText('Unlock test-user?')).toBeInTheDocument();
+    expect(
+      screen.getByText('Multiple locks exist', { exact: false })
+    ).toBeInTheDocument();
+    expect(screen.getByText('message 1', { exact: false })).toBeInTheDocument();
+    expect(screen.getByText('message 2', { exact: false })).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+
+    await user.click(
+      screen.getByRole('link', { name: 'Go to Session and Identity Locks' })
+    );
+    expect(onGoToLocksForTesting).toHaveBeenCalledTimes(1);
+  });
+});
+
+function renderComponent(
+  options?: { history?: ReturnType<typeof createMemoryHistory> } & Pick<
+    Partial<ComponentPropsWithoutRef<typeof ResourceUnlockDialog>>,
+    'onCancel' | 'onComplete' | 'onGoToLocksForTesting'
+  >
+) {
+  const {
+    onCancel = jest.fn(),
+    onComplete = jest.fn(),
+    onGoToLocksForTesting,
+  } = options ?? {};
+  const user = userEvent.setup();
+  return {
+    ...render(
+      <ResourceUnlockDialog
+        targetKind="user"
+        targetName="test-user"
+        onCancel={onCancel}
+        onComplete={onComplete}
+        onGoToLocksForTesting={onGoToLocksForTesting}
+      />,
+      { wrapper: makeWrapper(options) }
+    ),
+    user,
+  };
+}
+
+function makeWrapper(options?: {
+  history?: ReturnType<typeof createMemoryHistory>;
+}) {
+  const { history = createMemoryHistory() } = options ?? {};
+  const ctx = createTeleportContext();
+  return (props: PropsWithChildren) => (
+    <Providers>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        <Router history={history}>{props.children}</Router>
+      </TeleportProviderBasic>
+    </Providers>
+  );
+}
+
+function withListLocksSuccess(
+  ...params: Parameters<typeof listV2LocksSuccess>
+) {
+  server.use(
+    listV2LocksSuccess({
+      locks: params[0]?.locks ?? [],
+    })
+  );
+}
+
+function withUnlockSuccess() {
+  server.use(removeLockSuccess());
+}
diff --git a/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.tsx b/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.tsx
new file mode 100644
index 0000000000000..4f9923bd07399
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/ResourceUnlockDialog.tsx
@@ -0,0 +1,219 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import format from 'date-fns/format';
+import parseISO from 'date-fns/parseISO';
+import { MouseEventHandler } from 'react';
+import { Link } from 'react-router-dom';
+import styled from 'styled-components';
+
+import { Alert } from 'design/Alert/Alert';
+import {
+  ButtonPrimaryBorder,
+  ButtonSecondary,
+  ButtonWarning,
+} from 'design/Button/Button';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from 'design/DialogConfirmation';
+import Flex from 'design/Flex';
+import Text from 'design/Text';
+
+import cfg from 'teleport/config';
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+
+import { useResourceLock } from './useResourceLock';
+
+/**
+ * A confirmation dialog component for unlocking a resource. It uses
+ * `useResourceLock` internally to load existing lock state, check permissions
+ * and perform the unlock operation. Conditional rendering is used to show and
+ * hide the dialog.
+ *
+ * Example usage:
+ * ```tsx
+ * const [showUnlockDialog, setShowUnlockDialog] = useState(false);
+ * {showUnlockDialog ? (
+ *  <ResourceUnlockDialog
+ *    targetKind={'user'}
+ *    targetName={'example-user'}
+ *    onCancel={() => setShowUnlockDialog(false)}
+ *    onComplete={() => setShowUnlockDialog(false)}
+ *  />
+ * ) : undefined}
+ * ```
+ *
+ * @param props
+ * @returns
+ */
+export function ResourceUnlockDialog(props: {
+  /** The kind of resource to unlock. */
+  targetKind: LockResourceKind;
+  /** The name of the resource to unlock. */
+  targetName: string;
+  /**
+   * Called when the user cancels the unlock operation.
+   */
+  onCancel: () => void;
+  /**
+   * Called when the user completes the unlock operation.
+   */
+  onComplete: () => void;
+  /**
+   * For testing only: called when the user wants to go to locks.
+   */
+  onGoToLocksForTesting?: MouseEventHandler<HTMLAnchorElement>;
+}) {
+  const {
+    targetKind,
+    targetName,
+    onCancel,
+    onComplete,
+    onGoToLocksForTesting,
+  } = props;
+
+  const { isLoading, locks, canUnlock, unlock, unlockPending, unlockError } =
+    useResourceLock({
+      targetKind,
+      targetName,
+    });
+
+  const handleUnlock = async () => {
+    try {
+      await unlock();
+    } catch {
+      // Swallow this error - it's handled as `unlockError` above
+      return;
+    }
+    onComplete();
+  };
+
+  const multipleLocksExist = locks && locks.length > 1;
+
+  return (
+    <Dialog onClose={onCancel} open={true}>
+      <DialogHeader>
+        <DialogTitle>Unlock {targetName}?</DialogTitle>
+      </DialogHeader>
+      <DialogContent maxWidth="650px">
+        {multipleLocksExist ? (
+          <div>
+            Multiple locks exist on <strong>{targetName}</strong> and they can
+            only be removed from the{' '}
+            <Link to={cfg.getLocksRoute()} onClick={onGoToLocksForTesting}>
+              Session and Identity Locks
+            </Link>{' '}
+            page.
+          </div>
+        ) : (
+          <div>
+            This will remove the restrictions placed on{' '}
+            <code>{targetName}</code> and resume its activity.
+          </div>
+        )}
+
+        {locks ? (
+          <>
+            <LocksTitle>Lock details:</LocksTitle>
+
+            <LocksContainer>
+              {locks.map(lock => (
+                <LockItem key={lock.name}>
+                  <Text>
+                    <strong>Reason</strong>: {lock.message || 'none'}
+                  </Text>
+                  <Text>
+                    <strong>Locked on</strong>:{' '}
+                    {lock.createdAt
+                      ? format(parseISO(lock.createdAt), 'PP, p z')
+                      : 'unknown'}
+                  </Text>
+                  <Text>
+                    <strong>Expires</strong>:{' '}
+                    {lock.expires
+                      ? format(parseISO(lock.expires), 'PP, p z')
+                      : 'never'}
+                  </Text>
+                </LockItem>
+              ))}
+            </LocksContainer>
+          </>
+        ) : undefined}
+
+        {unlockError ? (
+          <Alert kind="danger" details={unlockError.message} mt={3} mb={0}>
+            Failed to unlock <code>{targetName}</code>
+          </Alert>
+        ) : undefined}
+      </DialogContent>
+      <DialogFooter>
+        <Flex gap={3}>
+          {multipleLocksExist ? (
+            <ButtonPrimaryBorder
+              as="a"
+              href={cfg.getLocksRoute()}
+              onClick={onGoToLocksForTesting}
+            >
+              Go to Session and Identity Locks
+            </ButtonPrimaryBorder>
+          ) : (
+            <ButtonWarning
+              onClick={handleUnlock}
+              disabled={isLoading || !canUnlock || unlockPending}
+            >
+              Remove Lock
+            </ButtonWarning>
+          )}
+          <ButtonSecondary
+            disabled={isLoading || unlockPending}
+            onClick={onCancel}
+          >
+            Cancel
+          </ButtonSecondary>
+        </Flex>
+      </DialogFooter>
+    </Dialog>
+  );
+}
+
+const LocksTitle = styled(Text)`
+  font-weight: bold;
+  padding: ${({ theme }) => theme.space[3]}px 0;
+`;
+
+const LocksContainer = styled(Flex)`
+  flex-direction: column;
+  gap: ${props => props.theme.space[3]}px;
+`;
+
+const LockItem = styled(Flex)`
+  flex-direction: column;
+  gap: ${props => props.theme.space[2]}px;
+  padding: ${({ theme }) => theme.space[2]}px;
+  background-color: ${({ theme }) => theme.colors.interactive.tonal.neutral[0]};
+  border-left: 4px solid
+    ${({ theme }) => theme.colors.interactive.tonal.neutral[2]};
+  color: ${({ theme }) => theme.colors.text.slightlyMuted};
+
+  & strong {
+    font-weight: bold;
+  }
+`;
diff --git a/web/packages/teleport/src/lib/locks/useResourceLock.test.tsx b/web/packages/teleport/src/lib/locks/useResourceLock.test.tsx
new file mode 100644
index 0000000000000..9b4824de7a0b4
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/useResourceLock.test.tsx
@@ -0,0 +1,375 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { renderHook, waitFor } from '@testing-library/react';
+import { setupServer } from 'msw/node';
+import { PropsWithChildren } from 'react';
+
+import { testQueryClient } from 'design/utils/testing';
+
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import { TeleportProviderBasic } from 'teleport/mocks/providers';
+import { defaultAccess, makeAcl } from 'teleport/services/user/makeAcl';
+import {
+  createLockSuccess,
+  listV2LocksError,
+  listV2LocksSuccess,
+  removeLockSuccess,
+} from 'teleport/test/helpers/locks';
+
+import { useResourceLock } from './useResourceLock';
+
+const server = setupServer();
+
+beforeAll(() => {
+  server.listen();
+});
+
+afterEach(async () => {
+  server.resetHandlers();
+  await testQueryClient.resetQueries();
+
+  jest.clearAllMocks();
+});
+
+afterAll(() => server.close());
+
+describe('useResourceLock', () => {
+  it('returns locks (empty)', async () => {
+    withListLocksSuccess({ locks: [] });
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.error).toBeNull();
+    expect(result.current.locks).toHaveLength(0);
+    expect(result.current.isLocked).toBe(false);
+    expect(result.current.canUnlock).toBe(false);
+  });
+
+  it('returns locks (single)', async () => {
+    withListLocksSuccess();
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.error).toBeNull();
+    expect(result.current.locks).toHaveLength(1);
+    expect(result.current.isLocked).toBe(true);
+    expect(result.current.canUnlock).toBe(true);
+  });
+
+  it('returns locks (multiple)', async () => {
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+        {
+          name: '2e76fda0-a698-46c1-977d-cf95ad2df7fc',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.error).toBeNull();
+    expect(result.current.locks).toHaveLength(2);
+    expect(result.current.isLocked).toBe(true);
+    expect(result.current.canUnlock).toBe(true);
+  });
+
+  it('handles lock with other targets', async () => {
+    withListLocksSuccess({
+      locks: [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'test-user',
+            role: 'test-role', // This target means the lock cannot be removed.
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    });
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.error).toBeNull();
+    expect(result.current.locks).toHaveLength(1);
+    expect(result.current.isLocked).toBe(true);
+    expect(result.current.canUnlock).toBe(false);
+  });
+
+  it('returns list error', async () => {
+    withListLocksError(500, 'an error occurred');
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.error).not.toBeNull();
+    expect(result.current.error?.message).toBe('an error occurred');
+  });
+
+  it('can lock and unlock the resource', async () => {
+    withListLocksSuccess();
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    withUnlockSuccess();
+    await result.current.unlock();
+
+    await waitFor(() => {
+      expect(result.current.unlockPending).toBe(false);
+    });
+
+    expect(result.current.locks).toHaveLength(0);
+
+    withLockSuccess();
+    await result.current.lock('', '');
+
+    await waitFor(() => {
+      expect(result.current.lockPending).toBe(false);
+    });
+
+    expect(result.current.locks).toHaveLength(1);
+  });
+
+  it('cant unlock without permission', async () => {
+    withListLocksSuccess();
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper({
+          customAcl: makeAcl({
+            lock: {
+              ...defaultAccess,
+              list: true,
+              remove: false, // remove is required to unlock
+              create: true,
+              edit: true,
+            },
+          }),
+        }),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.canUnlock).toBe(false);
+
+    await expect(result.current.unlock).rejects.toEqual(
+      new Error('missing permission to remove locks')
+    );
+
+    expect(result.current.locks).toHaveLength(1);
+  });
+
+  it('cant lock without permission', async () => {
+    withListLocksSuccess({ locks: [] });
+
+    const { result } = renderHook(
+      () =>
+        useResourceLock({
+          targetKind: 'user',
+          targetName: 'test-user',
+        }),
+      {
+        wrapper: makeWrapper({
+          customAcl: makeAcl({
+            lock: {
+              ...defaultAccess,
+              list: true,
+              remove: true,
+              create: false, // both create and edit are required to lock
+              edit: false, // both create and edit are required to lock
+            },
+          }),
+        }),
+      }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(result.current.canLock).toBe(false);
+    await expect(() => result.current.lock('', '')).rejects.toEqual(
+      new Error('missing permission to create locks')
+    );
+
+    expect(result.current.locks).toHaveLength(0);
+  });
+});
+
+function makeWrapper(params?: { customAcl?: ReturnType<typeof makeAcl> }) {
+  const {
+    customAcl = makeAcl({
+      lock: {
+        ...defaultAccess,
+        list: true,
+        remove: true,
+        create: true,
+        edit: true,
+      },
+    }),
+  } = params ?? {};
+  const ctx = createTeleportContext({
+    customAcl,
+  });
+  return (props: PropsWithChildren) => (
+    <QueryClientProvider client={testQueryClient}>
+      <TeleportProviderBasic teleportCtx={ctx}>
+        {props.children}
+      </TeleportProviderBasic>
+    </QueryClientProvider>
+  );
+}
+
+function withListLocksSuccess(
+  ...params: Parameters<typeof listV2LocksSuccess>
+) {
+  server.use(
+    listV2LocksSuccess({
+      locks: params[0]?.locks ?? [
+        {
+          name: '76bc5cc7-b9bf-4a03-935f-8018c0a2bc05',
+          message: 'This is a test message',
+          expires: '2023-12-31T23:59:59Z',
+          targets: {
+            user: 'test-user',
+          },
+          createdAt: '2023-01-01T00:00:00Z',
+          createdBy: 'admin',
+        },
+      ],
+    })
+  );
+}
+
+function withListLocksError(...params: Parameters<typeof listV2LocksError>) {
+  server.use(listV2LocksError(...params));
+}
+
+function withUnlockSuccess() {
+  server.use(removeLockSuccess());
+}
+
+function withLockSuccess() {
+  server.use(createLockSuccess());
+}
diff --git a/web/packages/teleport/src/lib/locks/useResourceLock.ts b/web/packages/teleport/src/lib/locks/useResourceLock.ts
new file mode 100644
index 0000000000000..745ff775e2ee7
--- /dev/null
+++ b/web/packages/teleport/src/lib/locks/useResourceLock.ts
@@ -0,0 +1,144 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { useCallback } from 'react';
+
+import { LockResourceKind } from 'teleport/LocksV2/NewLock/common';
+import {
+  createLockMutationFn,
+  deleteLockMutationFn,
+  listLocks,
+} from 'teleport/services/locks/locks';
+import { createQueryHook } from 'teleport/services/queryHelpers';
+import useTeleport from 'teleport/useTeleport';
+
+/**
+ * `useResourceLock` provides the lock state for an individual resource. Lock
+ * and unlock operations are provided, and permission are handled internally.
+ *
+ * Consider using this hook in combination with `ResourceLockDialog`,
+ * `ResourceUnlockDialog` and `ResourceLockIndicator`.
+ *
+ * @param opts
+ * @returns lock state and operations
+ */
+export function useResourceLock(opts: {
+  /** The kind of resource to lock/unlock */
+  targetKind: LockResourceKind;
+  /** The name of the resource to lock/unlock */
+  targetName: string;
+  /** The stale time to pass to tanstack query */
+  staleTime?: number;
+}) {
+  const { targetKind, targetName, staleTime = 30_000 } = opts;
+
+  const ctx = useTeleport();
+  const flags = ctx.getFeatureFlags();
+  const hasListPermission = flags.locks;
+  const hasAddPermission = flags.addLocks;
+  const hasRemovePermission = flags.removeLocks;
+  const queryClient = useQueryClient();
+
+  const queryVars = {
+    inForceOnly: true,
+    targets: [{ kind: targetKind, name: targetName }],
+  };
+
+  const { isSuccess, data, error, isLoading } = useListLocks(queryVars, {
+    enabled: hasListPermission,
+    staleTime,
+  });
+
+  const {
+    mutateAsync: removeLock,
+    isPending: unlockPending,
+    error: unlockError,
+  } = useMutation({
+    mutationFn: deleteLockMutationFn,
+    onSuccess: (_, vars) => {
+      queryClient.setQueryData(listLocksQueryKey(queryVars), existingLocks => {
+        return existingLocks?.filter(lock => lock.name !== vars.uuid);
+      });
+    },
+  });
+
+  const {
+    mutateAsync: addLock,
+    isPending: lockPending,
+    error: lockError,
+  } = useMutation({
+    mutationFn: createLockMutationFn,
+    onSuccess: newLock => {
+      queryClient.setQueryData(listLocksQueryKey(queryVars), existingLocks => {
+        return existingLocks ? [...existingLocks, newLock] : [newLock];
+      });
+    },
+  });
+
+  // The lock/s can be removed if they all target the given resource, other
+  // locks may affect other resources
+  const canUnlock =
+    hasRemovePermission &&
+    !!data &&
+    data.length > 0 &&
+    data.reduce(
+      (acc, lock) =>
+        acc &&
+        lock.targets.every(t => t.kind === targetKind && t.name === targetName),
+      true
+    );
+
+  const unlock = useCallback(async () => {
+    if (!canUnlock) throw new Error('missing permission to remove locks');
+    return removeLock({ uuid: data[0].name });
+  }, [canUnlock, data, removeLock]);
+
+  const canLock = hasAddPermission;
+
+  const lock = useCallback(
+    async (message: string, ttl: string) => {
+      if (!canLock) throw new Error('missing permission to create locks');
+      return addLock({
+        message,
+        ttl,
+        targets: { [targetKind]: targetName },
+      });
+    },
+    [canLock, addLock, targetKind, targetName]
+  );
+
+  return {
+    isLoading,
+    isLocked: isSuccess && data.length > 0,
+    locks: isSuccess ? data : null,
+    error,
+    canUnlock,
+    /** Removes the lock. If there are multiple locks, only the first one is removed */
+    unlock,
+    unlockPending,
+    unlockError,
+    canLock,
+    lock,
+    lockPending,
+    lockError,
+  };
+}
+
+const { createQueryKey: listLocksQueryKey, useQuery: useListLocks } =
+  createQueryHook(['locks', 'list'], listLocks);
diff --git a/web/packages/teleport/src/lib/tdp/playerClient.ts b/web/packages/teleport/src/lib/tdp/playerClient.ts
index f22b4deb94dae..8741ac573bac6 100644
--- a/web/packages/teleport/src/lib/tdp/playerClient.ts
+++ b/web/packages/teleport/src/lib/tdp/playerClient.ts
@@ -16,7 +16,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { BrowserFileSystem, TdpClient, TdpClientEvent } from 'shared/libs/tdp';
+import {
+  selectDirectoryInBrowser,
+  TdpClient,
+  TdpClientEvent,
+} from 'shared/libs/tdp';
 import { base64ToArrayBuffer } from 'shared/utils/base64';
 import { throttle } from 'shared/utils/highbar';
 
@@ -57,7 +61,7 @@ export class PlayerClient extends TdpClient {
     super(
       signal =>
         adaptWebSocketToTdpTransport(new AuthenticatedWebSocket(url), signal),
-      new BrowserFileSystem()
+      selectDirectoryInBrowser
     );
     this.setPlayerStatus = setPlayerStatus;
     this.setStatusText = setStatusText;
@@ -208,7 +212,7 @@ export class PlayerClient extends TdpClient {
   // RDP response PDUs to the server during playback, which is unnecessary
   // and breaks the playback system.
   // eslint-disable-next-line unused-imports/no-unused-vars
-  sendRdpResponsePDU(responseFrame: ArrayBuffer) {
+  sendRdpResponsePdu(responseFrame: ArrayBuffer) {
     return;
   }
 
diff --git a/web/packages/teleport/src/lib/term/ttyPlayer.js b/web/packages/teleport/src/lib/term/ttyPlayer.js
index 3d3629f54e95c..36f7dd7629f22 100644
--- a/web/packages/teleport/src/lib/term/ttyPlayer.js
+++ b/web/packages/teleport/src/lib/term/ttyPlayer.js
@@ -41,13 +41,15 @@ const actionPause = 1;
 const PROGRESS_UPDATE_INTERVAL_MS = 50;
 
 export default class TtyPlayer extends Tty {
-  constructor({ url, setPlayerStatus, setStatusText, setTime }) {
+  constructor({ url, onTimeChange, setPlayerStatus, setStatusText, setTime }) {
     super({});
 
     this._url = url;
     this._setPlayerStatus = setPlayerStatus;
     this._setStatusText = setStatusText;
 
+    this._onTimeChange = onTimeChange;
+
     this._paused = false;
     this._lastPlayedTimestamp = 0;
     this._skipTimeUpdatesUntil = null;
@@ -57,6 +59,10 @@ export default class TtyPlayer extends Tty {
     this._lastUpdateTime = 0;
     this._lastTimestamp = 0;
     this._timeout = null;
+
+    // Add animation frame tracking
+    this._animationFrameId = null;
+    this._isAnimating = false;
   }
 
   // Override the base class connection, which uses the envelope-based
@@ -106,6 +112,7 @@ export default class TtyPlayer extends Tty {
 
   disconnect(closeCode = WebsocketCloseCode.NORMAL) {
     this.cancelTimeUpdate();
+    this.stopAnimationLoop();
     if (this.webSocket !== null) {
       this.webSocket.close(closeCode);
     }
@@ -128,6 +135,7 @@ export default class TtyPlayer extends Tty {
       clearTimeout(this._timeout);
       this._timeout = null;
     }
+    this.stopAnimationLoop();
   }
 
   onMessage(m) {
@@ -171,6 +179,7 @@ export default class TtyPlayer extends Tty {
           // as quickly as possible
           if (!this._paused && !this.isSeekingForward()) {
             this.scheduleNextUpdate(delay);
+            this.startAnimationLoop();
           }
           break;
 
@@ -207,6 +216,8 @@ export default class TtyPlayer extends Tty {
 
   move(newPos) {
     this.cancelTimeUpdate();
+    this.stopAnimationLoop();
+
     try {
       const buffer = new ArrayBuffer(11);
       const dv = new DataView(buffer);
@@ -219,6 +230,9 @@ export default class TtyPlayer extends Tty {
     }
 
     this._setTime(newPos);
+    if (this._onTimeChange) {
+      this._onTimeChange(newPos);
+    }
     this._lastUpdateTime = Date.now();
     this._skipTimeUpdatesUntil = newPos;
 
@@ -227,6 +241,7 @@ export default class TtyPlayer extends Tty {
     } else {
       if (!this._paused) {
         this.scheduleNextUpdate(newPos);
+        this.startAnimationLoop();
       }
     }
   }
@@ -241,6 +256,7 @@ export default class TtyPlayer extends Tty {
   stop() {
     this._paused = true;
     this.cancelTimeUpdate();
+    this.stopAnimationLoop();
     this._setPlayerStatus(StatusEnum.PAUSED);
 
     if (this.webSocket.readyState !== WebSocket.OPEN) {
@@ -268,6 +284,8 @@ export default class TtyPlayer extends Tty {
       this.scheduleNextUpdate(this._lastTimestamp);
     }
 
+    this.startAnimationLoop();
+
     // the very first play call happens before we've even
     // connected - we only need to send the websocket message
     // for subsequent calls
@@ -282,4 +300,42 @@ export default class TtyPlayer extends Tty {
     dv.setUint8(3, actionPlay);
     this.webSocket.send(dv);
   }
+
+  startAnimationLoop() {
+    if (this._isAnimating) {
+      return;
+    }
+
+    this._isAnimating = true;
+
+    const animate = () => {
+      if (!this._isAnimating) {
+        return;
+      }
+
+      // Calculate current time based on elapsed time since last update
+      if (!this._paused) {
+        const delta = Date.now() - this._lastUpdateTime;
+        const currentTime = this._lastTimestamp + delta;
+
+        // Call onTimeChange smoothly every frame
+        if (this._onTimeChange && this._sendTimeUpdates) {
+          this._onTimeChange(currentTime);
+        }
+      }
+
+      this._animationFrameId = requestAnimationFrame(animate);
+    };
+
+    this._animationFrameId = requestAnimationFrame(animate);
+  }
+
+  stopAnimationLoop() {
+    this._isAnimating = false;
+
+    if (this._animationFrameId) {
+      cancelAnimationFrame(this._animationFrameId);
+      this._animationFrameId = null;
+    }
+  }
 }
diff --git a/web/packages/teleport/src/mocks/contexts.ts b/web/packages/teleport/src/mocks/contexts.ts
index eea39f5e93df7..1f65a0fbab07e 100644
--- a/web/packages/teleport/src/mocks/contexts.ts
+++ b/web/packages/teleport/src/mocks/contexts.ts
@@ -79,6 +79,8 @@ export const allAccessAcl: Acl = {
   gitServers: fullAccess,
   accessGraphSettings: fullAccess,
   botInstances: fullAccess,
+  workloadIdentity: fullAccess,
+  clientIpRestriction: fullAccess,
 };
 
 export function getAcl(cfg?: { noAccess: boolean }) {
diff --git a/web/packages/teleport/src/mocks/providers.tsx b/web/packages/teleport/src/mocks/providers.tsx
index 289a5ee08361a..180093d5e8466 100644
--- a/web/packages/teleport/src/mocks/providers.tsx
+++ b/web/packages/teleport/src/mocks/providers.tsx
@@ -21,6 +21,7 @@ import { PropsWithChildren } from 'react';
 import { MemoryRouter } from 'react-router';
 
 import { InfoGuidePanelProvider } from 'shared/components/SlidingSidePanel/InfoGuide';
+import { ToastNotificationProvider } from 'shared/components/ToastNotification';
 
 import { getOSSFeatures } from 'teleport/features';
 import { FeaturesContextProvider } from 'teleport/FeaturesContext';
@@ -38,13 +39,15 @@ export const TeleportProviderBasic: React.FC<
 
   return (
     <MemoryRouter initialEntries={initialEntries}>
-      <InfoGuidePanelProvider>
-        <ContextProvider ctx={ctx}>
-          <FeaturesContextProvider value={getOSSFeatures()}>
-            {children}
-          </FeaturesContextProvider>
-        </ContextProvider>
-      </InfoGuidePanelProvider>
+      <ToastNotificationProvider>
+        <InfoGuidePanelProvider>
+          <ContextProvider ctx={ctx}>
+            <FeaturesContextProvider value={getOSSFeatures()}>
+              {children}
+            </FeaturesContextProvider>
+          </ContextProvider>
+        </InfoGuidePanelProvider>
+      </ToastNotificationProvider>
     </MemoryRouter>
   );
 };
diff --git a/web/packages/teleport/src/services/agents/types.ts b/web/packages/teleport/src/services/agents/types.ts
index 4fcfcac74b168..0417433c7db57 100644
--- a/web/packages/teleport/src/services/agents/types.ts
+++ b/web/packages/teleport/src/services/agents/types.ts
@@ -19,7 +19,10 @@
 import { GitServer } from 'web/packages/teleport/src/services/gitServers';
 
 import type { Platform } from 'design/platform';
-import { IncludedResourceMode } from 'shared/components/UnifiedResources';
+import {
+  IncludedResourceMode,
+  ResourceHealthStatus,
+} from 'shared/components/UnifiedResources';
 
 import { App } from 'teleport/services/apps';
 import { Database } from 'teleport/services/databases';
@@ -64,6 +67,7 @@ export type ResourceFilter = {
   pinnedOnly?: boolean;
   searchAsRoles?: '' | 'yes';
   includedResourceMode?: IncludedResourceMode;
+  statuses?: ResourceHealthStatus[];
   // TODO(bl-nero): Remove this once filters are expressed as advanced search.
   kinds?: string[];
 };
diff --git a/web/packages/teleport/src/services/api/api.test.ts b/web/packages/teleport/src/services/api/api.test.ts
index cf4197b5a30d8..985a639952d97 100644
--- a/web/packages/teleport/src/services/api/api.test.ts
+++ b/web/packages/teleport/src/services/api/api.test.ts
@@ -21,7 +21,7 @@ import websession from '../websession';
 import api, {
   defaultRequestOptions,
   getAuthHeaders,
-  isRoleNotFoundError,
+  isUserSessionRoleNotFoundError,
   MFA_HEADER,
 } from './api';
 import { ApiError } from './parseError';
@@ -205,31 +205,45 @@ test('fetchJsonWithMfaAuthnRetry does not return any', () => {
   expect(true).toBe(true);
 });
 
-test('isRoleNotFoundError correctly identifies role not found errors', () => {
-  const errorMessage1 = 'role admin is not found';
-  expect(isRoleNotFoundError(errorMessage1)).toBe(true);
+test('isUserSessionRoleNotFoundError correctly identifies user session role not found errors', () => {
+  const userSessionRoleError = {
+    error: 'role admin is not found',
+    messages: ['user session role not found'],
+  };
+  expect(isUserSessionRoleNotFoundError(userSessionRoleError)).toBe(true);
 
-  const errorMessage2 = '    role test-role is not found ';
-  expect(isRoleNotFoundError(errorMessage2)).toBe(true);
+  const regularRoleError = { error: 'role admin is not found' };
+  expect(isUserSessionRoleNotFoundError(regularRoleError)).toBe(false);
 
-  const errorMessage3 = 'failed to list access lists';
-  expect(isRoleNotFoundError(errorMessage3)).toBe(false);
-});
+  const regularRoleWithIrrelevantMessages = {
+    error: 'role admin is not found',
+    messages: ['some_other_message'],
+  };
+  expect(
+    isUserSessionRoleNotFoundError(regularRoleWithIrrelevantMessages)
+  ).toBe(false);
 
-describe('api.get handling of role not found errors', () => {
-  beforeEach(() => {
-    jest.spyOn(global, 'fetch').mockResolvedValue({
-      json: async () => ({ error: { message: 'role foo is not found' } }),
-      ok: false,
-      status: 404,
-    } as Response); // we don't care about response
-  });
+  const nonRoleError = { error: 'failed to list access lists' };
+  expect(isUserSessionRoleNotFoundError(nonRoleError)).toBe(false);
+});
 
+describe('handling of role not found errors', () => {
   afterEach(() => {
     jest.resetAllMocks();
   });
 
-  test('sign out on error', async () => {
+  test('sign out on user session role not found error', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue({
+      json: async () => ({
+        error: {
+          message: 'role foo is not found',
+        },
+        messages: ['user session role not found'],
+      }),
+      ok: false,
+      status: 404,
+    } as Response);
+
     await api.get('/foobar');
     expect(mockedWebsession.logoutWithoutSlo).toHaveBeenCalledWith({
       rememberLocation: false,
@@ -237,10 +251,14 @@ describe('api.get handling of role not found errors', () => {
     });
   });
 
-  test("don't sign out on error", async () => {
-    await expect(
-      api.get('/foobar', null, null, { allowRoleNotFound: true })
-    ).rejects.toThrow(ApiError);
+  test("don't sign out on regular role not found error", async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue({
+      json: async () => ({ error: { message: 'role foo is not found' } }),
+      ok: false,
+      status: 404,
+    } as Response);
+
+    await expect(api.get('/foobar')).rejects.toThrow(ApiError);
     expect(mockedWebsession.logoutWithoutSlo).not.toHaveBeenCalled();
   });
 });
diff --git a/web/packages/teleport/src/services/api/api.ts b/web/packages/teleport/src/services/api/api.ts
index f22f536b73585..b683402ca9f5d 100644
--- a/web/packages/teleport/src/services/api/api.ts
+++ b/web/packages/teleport/src/services/api/api.ts
@@ -29,13 +29,10 @@ export const MFA_HEADER = 'Teleport-Mfa-Response';
 
 type RequestOptions = {
   /**
-   * Usually, an HTTP/404 with a "role not found" message means that the user
-   * can't be authorized and needs to sign in again. In such case the API
-   * service immediately signs the user out. Setting this flag to `true`
-   * overrides this behavior and allows a "role not found" error to be
-   * propagated up the call stack.
+   * If set to `true`, the API service will not attempt to retry after an MFA
+   * challenge.
    */
-  allowRoleNotFound?: boolean;
+  skipAuthnRetry?: boolean;
 };
 
 const api = {
@@ -88,41 +85,62 @@ const api = {
     throw new Error('data for body is not a type of FormData');
   },
 
-  delete(url, data?, mfaResponse?: MfaChallengeResponse) {
-    return api.fetchJsonWithMfaAuthnRetry(
-      url,
-      {
-        body: JSON.stringify(data),
-        method: 'DELETE',
-      },
-      mfaResponse
-    );
+  /** @deprecated Use `deleteWithOptions` instead. */
+  delete(url: string, data?: unknown, mfaResponse?: MfaChallengeResponse) {
+    return api.deleteWithOptions(url, {
+      data,
+      mfaResponse,
+    });
   },
 
+  /** @deprecated Use `deleteWithOptions` instead. */
   deleteWithHeaders(
-    url,
+    url: string,
     headers?: Record<string, string>,
-    signal?,
+    signal?: AbortSignal,
     mfaResponse?: MfaChallengeResponse
   ) {
+    return api.deleteWithOptions(url, {
+      headers,
+      signal,
+      mfaResponse,
+    });
+  },
+
+  deleteWithOptions(
+    url: string,
+    options?: Partial<{
+      headers: Record<string, string>;
+      data: unknown;
+      mfaResponse: MfaChallengeResponse;
+      signal: AbortSignal;
+    }>
+  ) {
+    const { headers, data, signal, mfaResponse } = options ?? {};
     return api.fetchJsonWithMfaAuthnRetry(
       url,
       {
         method: 'DELETE',
         headers,
+        body: JSON.stringify(data),
         signal,
       },
       mfaResponse
     );
   },
 
-  // TODO (avatus) add abort signal to this
-  put(url, data, mfaResponse?: MfaChallengeResponse) {
+  put(
+    url: string,
+    data: any,
+    abortSignal?: AbortSignal,
+    mfaResponse?: MfaChallengeResponse
+  ) {
     return api.fetchJsonWithMfaAuthnRetry(
       url,
       {
         body: JSON.stringify(data),
         method: 'PUT',
+        signal: abortSignal,
       },
       mfaResponse
     );
@@ -152,11 +170,37 @@ const api = {
    * It returns the JSON data if it is a valid JSON and
    * there were no response errors.
    *
-   * If a response had an error and it contained a MFA authn
-   * required message, then a retry is attempted after a user
-   * successfully re-authenticates with an MFA device.
+   * The field "mfaResponse" accepts a pre-made response to an MFA challenge
+   * for an admin action with allowReuse set to true.
+   *
+   * The cluster requires the user to re-authenticate before performing certain
+   * admin actions (e.g., creating join tokens or deleting users) when
+   * second_factor is set to webauthn.
+   *
+   * Generally, mfaResponse is not needed because this func will first attempt
+   * a fetch without it and if the response had an error and it contained a MFA
+   * authn required message, then this func will fetch a challenge and prompt
+   * the user to re-authn. After successfully re-authenticating, a retry fetch
+   * with the original URL is attempted.
    *
-   * All other errors will be thrown.
+   * There are a few cases where providing a mfaResponse is required and it
+   * starts by creating a MFA challenge with `allowReuse` set to true
+   * (see services/auth/auth.ts > getMfaChallengeResponseForAdminAction).
+   *
+   * This allow users to require re-authenticating ONCE for the following:
+   *   - In the web app, we can be calling multiple endpoints back to back,
+   *     and some or all endpoints require re-authenticating. If a non reusable
+   *     mfaResponse was provided, or mfaResponse wasn't provided then each
+   *     fetch will ask the user to re-authenticate.
+   *   - We can make a single fetch without a mfaResponse, re-authenticate
+   *     successfully as required, but the retry attempt still fails with a
+   *     vague "access denied" error. This is because there are some endpoints
+   *     where it's in the backend that are calling multiple endpoints that
+   *     require re-authenticating. Providing a reusable mfaResponse resolves
+   *     this issue.
+   *
+   * The mfaResponse lasts for WebauthnChallengeTimeout defined in:
+   * https://github.com/gravitational/teleport/blob/b8a65486844b4125ea1cf1f08ae17e2fc5a4db5a/lib/defaults/defaults.go#L598
    */
   async fetchJsonWithMfaAuthnRetry(
     url: string,
@@ -166,21 +210,24 @@ const api = {
   ): Promise<any> {
     try {
       const response = await api.fetch(url, customOptions, mfaResponse);
-      return await api.getJsonFromFetchResponse(response, options);
+      return await api.getJsonFromFetchResponse(response);
     } catch (err) {
       // Retry with MFA if we get an admin action MFA error.
-      if (!mfaResponse && isAdminActionRequiresMfaError(err)) {
+      if (
+        !mfaResponse &&
+        !options.skipAuthnRetry &&
+        isAdminActionRequiresMfaError(err)
+      ) {
         mfaResponse = await api.getAdminActionMfaResponse();
         const response = await api.fetch(url, customOptions, mfaResponse);
-        return await api.getJsonFromFetchResponse(response, options);
+        return await api.getJsonFromFetchResponse(response);
       } else {
         throw err;
       }
     }
   },
 
-  async getJsonFromFetchResponse(response: Response, options: RequestOptions) {
-    const { allowRoleNotFound = false } = options;
+  async getJsonFromFetchResponse(response: Response) {
     let json;
     try {
       json = await response.json();
@@ -197,9 +244,8 @@ const api = {
     }
 
     /** This error can occur in the edge case where a role in the user's certificate was deleted during their session. */
-    const isRoleNotFoundErr =
-      !allowRoleNotFound && isRoleNotFoundError(parseError(json));
-    if (isRoleNotFoundErr) {
+    const isUserSessionRoleNotFoundErr = isUserSessionRoleNotFoundError(json);
+    if (isUserSessionRoleNotFoundErr) {
       websession.logoutWithoutSlo({
         /* Don't remember location after login, since they may no longer have access to the page they were on. */
         rememberLocation: false,
@@ -347,16 +393,18 @@ export function getHostName() {
   return location.hostname + (location.port ? ':' + location.port : '');
 }
 
-function isAdminActionRequiresMfaError(err: Error) {
+export function isAdminActionRequiresMfaError(err: Error) {
   return err.message.includes(
     'admin-level API request requires MFA verification'
   );
 }
 
-/** isRoleNotFoundError returns true if the error message is due to a role not being found. */
-export function isRoleNotFoundError(errMessage: string): boolean {
-  // This error message format should be kept in sync with the NotFound error message returned in lib/services/local/access.GetRole
-  return /role \S+ is not found/.test(errMessage);
+/** isUserSessionRoleNotFoundError returns true if the error is a role not found error encountered durings user session role validation */
+export function isUserSessionRoleNotFoundError(json: any): boolean {
+  // Keep in sync with lib/services/role.go(UserSessionRoleNotFoundError)
+  return (
+    !!json.error && !!json?.messages?.includes('user session role not found')
+  );
 }
 
 export default api;
diff --git a/web/packages/teleport/src/services/apps/apps.test.ts b/web/packages/teleport/src/services/apps/apps.test.ts
index 47f97c05bf5d0..aa923fe1a142f 100644
--- a/web/packages/teleport/src/services/apps/apps.test.ts
+++ b/web/packages/teleport/src/services/apps/apps.test.ts
@@ -18,7 +18,7 @@
 
 import cfg from 'teleport/config';
 import api from 'teleport/services/api';
-import apps from 'teleport/services/apps';
+import apps, { CloudInstance } from 'teleport/services/apps';
 
 test('correct formatting of apps fetch response', async () => {
   jest.spyOn(api, 'get').mockResolvedValue(mockResponse);
@@ -55,8 +55,8 @@ test('correct formatting of apps fetch response', async () => {
       },
       {
         kind: 'app',
-        id: 'cluster-id-cloud-app-cloud://some-addr',
-        name: 'cloud-app',
+        id: 'cluster-id-cloud-app-unidentified-cloud://some-addr',
+        name: 'cloud-app-unidentified',
         description: '',
         uri: 'cloud://some-addr',
         publicAddr: '',
@@ -76,6 +76,82 @@ test('correct formatting of apps fetch response', async () => {
         samlAppSsoUrl: '',
         integration: '',
         permissionSets: [],
+        cloudInstance: undefined,
+      },
+      {
+        kind: 'app',
+        id: 'cluster-id-cloud-app-azure-cloud://Azure',
+        name: 'cloud-app-azure',
+        description: '',
+        uri: 'cloud://Azure',
+        publicAddr: '',
+        labels: [],
+        clusterId: 'cluster-id',
+        fqdn: '',
+        useAnyProxyPublicAddr: false,
+        friendlyName: '',
+        launchUrl: '',
+        awsRoles: [],
+        awsConsole: false,
+        isCloud: true,
+        isTcp: false,
+        addrWithProtocol: 'cloud://Azure',
+        userGroups: [],
+        samlApp: false,
+        samlAppSsoUrl: '',
+        integration: '',
+        permissionSets: [],
+        cloudInstance: CloudInstance.Azure,
+      },
+      {
+        kind: 'app',
+        id: 'cluster-id-cloud-app-gcp-localhost:3000',
+        name: 'cloud-app-gcp',
+        description: '',
+        uri: 'cloud://GCP',
+        publicAddr: 'localhost:3000',
+        labels: [],
+        clusterId: 'cluster-id',
+        fqdn: '',
+        useAnyProxyPublicAddr: false,
+        friendlyName: '',
+        launchUrl: '',
+        awsRoles: [],
+        awsConsole: false,
+        isCloud: true,
+        isTcp: false,
+        addrWithProtocol: 'cloud://localhost:3000',
+        userGroups: [],
+        samlApp: false,
+        samlAppSsoUrl: '',
+        integration: '',
+        permissionSets: [],
+        cloudInstance: CloudInstance.Gcp,
+      },
+      {
+        kind: 'app',
+        id: 'cluster-id-cloud-app-aws-localhost:3000',
+        name: 'cloud-app-aws',
+        description: '',
+        uri: 'cloud://AWS',
+        publicAddr: 'localhost:3000',
+        labels: [],
+        clusterId: 'cluster-id',
+        fqdn: '',
+        useAnyProxyPublicAddr: false,
+        friendlyName: '',
+        launchUrl: '',
+        awsRoles: [],
+        awsConsole: false,
+        isCloud: true,
+        isTcp: false,
+        addrWithProtocol: 'cloud://localhost:3000',
+        userGroups: [],
+        samlApp: false,
+        samlAppSsoUrl: '',
+        integration: '',
+        permissionSets: [],
+        cloudInstance: CloudInstance.Aws,
       },
       {
         kind: 'app',
@@ -151,6 +227,59 @@ test('correct formatting of apps fetch response', async () => {
         integration: '',
         permissionSets: [],
       },
+      {
+        kind: 'app',
+        id: 'cluster-id-mcp-app-mcp-app.example.com',
+        name: 'mcp-app',
+        useAnyProxyPublicAddr: false,
+        description: 'Some MCP app',
+        uri: 'mcp+stdio://',
+        publicAddr: 'mcp-app.example.com',
+        labels: [],
+        clusterId: 'cluster-id',
+        fqdn: '',
+        friendlyName: '',
+        launchUrl: '',
+        awsRoles: [],
+        awsConsole: false,
+        isCloud: false,
+        isTcp: false,
+        addrWithProtocol: 'mcp+stdio://mcp-app.example.com',
+        userGroups: [],
+        samlApp: false,
+        samlAppSsoUrl: '',
+        integration: '',
+        permissionSets: [],
+        mcp: {
+          command: 'npx',
+          args: ['-y', '@modelcontextprotocol/server-everything'],
+          runAsHostUser: 'hostuser',
+        },
+      },
+      {
+        kind: 'app',
+        id: 'cluster-id-mcp-http-app-mcp-http-app.example.com',
+        name: 'mcp-http-app',
+        useAnyProxyPublicAddr: false,
+        description: 'Some MCP HTTP app',
+        uri: 'mcp+http://localhost:12345/mcp',
+        publicAddr: 'mcp-http-app.example.com',
+        labels: [],
+        clusterId: 'cluster-id',
+        fqdn: '',
+        friendlyName: '',
+        launchUrl: '',
+        awsRoles: [],
+        awsConsole: false,
+        isCloud: false,
+        isTcp: false,
+        addrWithProtocol: 'mcp+http://mcp-http-app.example.com',
+        userGroups: [],
+        samlApp: false,
+        samlAppSsoUrl: '',
+        integration: '',
+        permissionSets: [],
+      },
     ],
     startKey: mockResponse.startKey,
     totalCount: mockResponse.totalCount,
@@ -219,9 +348,26 @@ const mockResponse = {
     },
     {
       clusterId: 'cluster-id',
-      name: 'cloud-app',
+      name: 'cloud-app-unidentified',
       uri: 'cloud://some-addr',
     },
+    {
+      clusterId: 'cluster-id',
+      name: 'cloud-app-azure',
+      uri: 'cloud://Azure',
+    },
+    {
+      clusterId: 'cluster-id',
+      name: 'cloud-app-gcp',
+      uri: 'cloud://GCP',
+      publicAddr: 'localhost:3000',
+    },
+    {
+      clusterId: 'cluster-id',
+      name: 'cloud-app-aws',
+      uri: 'cloud://AWS',
+      publicAddr: 'localhost:3000',
+    },
     {
       clusterId: 'cluster-id',
       name: 'tcp-app',
@@ -244,6 +390,25 @@ const mockResponse = {
       useAnyProxyPublicAddr: true,
       uri: 'http://localhost:3001',
     },
+    {
+      clusterId: 'cluster-id',
+      name: 'mcp-app',
+      publicAddr: 'mcp-app.example.com',
+      description: 'Some MCP app',
+      uri: 'mcp+stdio://',
+      mcp: {
+        command: 'npx',
+        args: ['-y', '@modelcontextprotocol/server-everything'],
+        runAsHostUser: 'hostuser',
+      },
+    },
+    {
+      clusterId: 'cluster-id',
+      name: 'mcp-http-app',
+      publicAddr: 'mcp-http-app.example.com',
+      description: 'Some MCP HTTP app',
+      uri: 'mcp+http://localhost:12345/mcp',
+    },
   ],
   startKey: 'mockKey',
   totalCount: 100,
diff --git a/web/packages/teleport/src/services/apps/makeApps.ts b/web/packages/teleport/src/services/apps/makeApps.ts
index c6d1b0bb2b3b4..db4f2507f2bac 100644
--- a/web/packages/teleport/src/services/apps/makeApps.ts
+++ b/web/packages/teleport/src/services/apps/makeApps.ts
@@ -16,11 +16,14 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { AwsRole } from 'shared/services/apps';
+import { AppSubKind } from 'shared/services';
+import { AwsRole, getAppUriScheme } from 'shared/services/apps';
 
 import cfg from 'teleport/config';
 
-import { App, AppSubKind, PermissionSet } from './types';
+import { App, CloudInstance, PermissionSet } from './types';
+
+const cloudProtocol = 'cloud://';
 
 function getLaunchUrl({
   fqdn,
@@ -64,6 +67,7 @@ export default function makeApp(json: any): App {
     samlAppPreset,
     subKind,
     samlAppLaunchUrls,
+    mcp,
   } = json;
 
   const launchUrl = getLaunchUrl({
@@ -78,15 +82,20 @@ export default function makeApp(json: any): App {
   const userGroups = json.userGroups || [];
   const permissionSets: PermissionSet[] = json.permissionSets || [];
 
-  const isTcp = !!uri && uri.startsWith('tcp://');
-  const isCloud = !!uri && uri.startsWith('cloud://');
+  const scheme = getAppUriScheme(uri);
+  const isTcp = scheme === 'tcp';
+  const isCloud = scheme === 'cloud';
+  const isMcp = scheme.startsWith('mcp+');
 
   let addrWithProtocol = uri;
   if (publicAddr) {
     if (isCloud) {
-      addrWithProtocol = `cloud://${publicAddr}`;
+      addrWithProtocol = `${cloudProtocol}${publicAddr}`;
     } else if (isTcp) {
       addrWithProtocol = `tcp://${publicAddr}`;
+    } else if (isMcp) {
+      // Not used anywhere yet.
+      addrWithProtocol = `${scheme}://${publicAddr}`;
     } else if (subKind === AppSubKind.AwsIcAccount) {
       /** publicAddr for Identity Center account app is a URL with scheme. */
       addrWithProtocol = publicAddr;
@@ -94,6 +103,7 @@ export default function makeApp(json: any): App {
       addrWithProtocol = `https://${publicAddr}`;
     }
   }
+
   if (useAnyProxyPublicAddr) {
     addrWithProtocol = `https://${fqdn}`;
   }
@@ -102,6 +112,22 @@ export default function makeApp(json: any): App {
     samlAppSsoUrl = `${cfg.baseUrl}/enterprise/saml-idp/login/${name}`;
   }
 
+  let cloudInstance: CloudInstance;
+  if (isCloud) {
+    // Cloud instance app URI format is "cloud://<cloud>"
+    // eg: "cloud://GCP"
+    const splittedUri = uri.split(cloudProtocol);
+    if (splittedUri.length > 1) {
+      const gotCloudInstance = splittedUri[1];
+      for (const cloudEnumVal of Object.values(CloudInstance)) {
+        if (cloudEnumVal === gotCloudInstance) {
+          cloudInstance = gotCloudInstance;
+          break;
+        }
+      }
+    }
+  }
+
   return {
     kind: 'app',
     subKind,
@@ -129,5 +155,7 @@ export default function makeApp(json: any): App {
     integration,
     permissionSets,
     samlAppLaunchUrls,
+    mcp,
+    cloudInstance,
   };
 }
diff --git a/web/packages/teleport/src/services/apps/types.ts b/web/packages/teleport/src/services/apps/types.ts
index 65c7bf09e6f9d..d26bb68eaa4a5 100644
--- a/web/packages/teleport/src/services/apps/types.ts
+++ b/web/packages/teleport/src/services/apps/types.ts
@@ -16,11 +16,24 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { AppSubKind } from 'shared/services';
 import { AwsRole } from 'shared/services/apps';
 
 import { ResourceLabel } from 'teleport/services/agents';
 import type { SamlServiceProviderPreset } from 'teleport/services/samlidp/types';
 
+/**
+ * Describes what cloud instance the app was discovered from.
+ *
+ * Values are same consts used in backend and letter casing matters:
+ * https://github.com/gravitational/teleport/blob/095e8e7b12d7be546c34eb15e4e562693cc81338/api/types/constants.go#L947
+ */
+export enum CloudInstance {
+  Azure = 'Azure',
+  Gcp = 'GCP',
+  Aws = 'AWS',
+}
+
 export interface App {
   kind: 'app';
   id: string;
@@ -37,6 +50,11 @@ export interface App {
   awsConsole: boolean;
   requiresRequest?: boolean;
   isTcp?: boolean;
+  /**
+   * This field is equivalent to `isCloud` field but this field
+   * specifies what cloud instance is used.
+   */
+  cloudInstance?: CloudInstance;
   isCloud?: boolean;
   // addrWithProtocol can either be a public address or
   // if public address wasn't defined, fallback to uri
@@ -61,10 +79,14 @@ export interface App {
    */
   permissionSets?: PermissionSet[];
   /**
-   * SamlAppLaunchUrl contains service provider specific authentication
+   * samlAppLaunchUrl contains service provider specific authentication
    * endpoints where user should be launched to start SAML authentication.
    */
   samlAppLaunchUrls?: SamlAppLaunchUrl[];
+  /**
+   * mcp contains MCP server specific configurations.
+   */
+  mcp?: AppMCP;
 }
 
 export type UserGroupAndDescription = {
@@ -73,20 +95,33 @@ export type UserGroupAndDescription = {
 };
 
 /** AppSubKind defines names of SubKind for App resource. */
-export enum AppSubKind {
-  AwsIcAccount = 'aws_ic_account',
-}
+export {
+  /*
+   * @deprecated Import AppSubKind from 'shared/services' instead.
+   */
+  AppSubKind,
+} from 'shared/services';
 
 /**
  * PermissionSet defines an AWS IAM Identity Center permission set that
  * is available to an App.
  */
 export type PermissionSet = {
-  /** name is a permission set name */
+  /*
+   * name is a friendly permission set name
+   * eg: AdministratorAccess
+   */
   name: string;
-  /** arn is a permission set ARN */
+  /*
+   * arn is a permission set ARN
+   * starts with "arn:aws:sso:::"
+   */
   arn: string;
-  /** assignmentId is an account assignment ID. */
+  /*
+   * assignmentId is an account assignment ID.
+   * It is found in the format <awsAccountID>--<friendly-name>
+   * eg: 1234--AdministratorAccess
+   */
   assignmentId: string;
 };
 
@@ -100,3 +135,18 @@ export type SamlAppLaunchUrl = {
   /* friendly name of the URL. */
   friendlyName?: string;
 };
+
+/**
+ * AppMCP contains MCP server specific configurations.
+ */
+export type AppMCP = {
+  /** Command to launch stdio-based MCP servers. */
+  command: string;
+  /** Args to execute with the command. */
+  args?: string[];
+  /**
+   * The host user account under which the command will be
+   * executed. Required for stdio-based MCP servers.
+   */
+  runAsHostUser: string;
+};
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/.gitignore b/web/packages/teleport/src/services/audit/gen-event-reference/.gitignore
new file mode 100644
index 0000000000000..9b1c8b133c966
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/.gitignore
@@ -0,0 +1 @@
+/dist
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/README.md b/web/packages/teleport/src/services/audit/gen-event-reference/README.md
new file mode 100644
index 0000000000000..9012507578c2a
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/README.md
@@ -0,0 +1,14 @@
+# Audit event reference generator
+
+Audit event reference generator imports events from `web/packages/teleport/src/Audit/fixtures` and
+formatters from `web/packages/teleport/src/services/audit/makeEvent.ts`. This way the reference
+generator and the codebase always stay in sync when it comes to the underlying types.
+
+To generate the reference:
+
+```
+pnpm --filter @gravitational/teleport event-reference
+```
+
+This command first runs the generator code through Vite to strip TypeScript types and then runs the
+built code with Node.js to generate the reference.
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.test.ts b/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.test.ts
new file mode 100644
index 0000000000000..b9b394bdb5bf4
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.test.ts
@@ -0,0 +1,650 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  createEventSection,
+  createReferencePage,
+  eventsWithoutExamples,
+  ReferencePageEventData,
+  removeUnknowns,
+} from './gen-event-reference';
+import { Event, Formatters } from './types';
+
+describe('eventsWithoutExamples', () => {
+  interface testCase {
+    description: string;
+    events: Event[];
+    formatters: Formatters;
+    expected: ReferencePageEventData[];
+  }
+
+  const testCases: testCase[] = [
+    {
+      description: 'formatters with no fixture',
+      events: [
+        {
+          id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+          codeDesc: 'App created',
+          code: 'ABC123',
+          time: new Date('2021-03-18T16:28:51.219Z'),
+          message: 'User [root] has created an app',
+          user: 'root',
+          raw: {
+            event: 'app.create',
+            code: 'ABC123',
+            time: '2020-06-05T16:24:05Z',
+            uid: '00000000-0000-0000-0000-000000000000',
+          },
+        },
+      ],
+      formatters: {
+        ABC456: {
+          type: 'billing.create_card',
+          desc: 'Card created',
+          format: (json): string => JSON.stringify(json),
+        },
+      },
+      expected: [
+        {
+          codeDesc: 'Card created',
+          code: 'ABC456',
+          raw: {
+            event: 'billing.create_card',
+            code: 'ABC456',
+            time: '2020-06-05T16:24:05Z',
+            uid: '68a83a99-73ce-4bd7-bbf7-99103c2ba6a0',
+          },
+        },
+      ],
+    },
+    {
+      description: 'formatter desc is a function, no event',
+      formatters: {
+        ABC123: {
+          type: 'port',
+          desc: ({ code }) => {
+            const eventName = 'Port Forwarding';
+
+            switch (code) {
+              case 'ABC123':
+                return `${eventName} Start`;
+              case 'DEF123':
+                return `${eventName} Stop`;
+              case 'GHI123':
+                return `${eventName} Failure`;
+            }
+          },
+          format: (json): string => JSON.stringify(json),
+        },
+      },
+      events: [],
+      expected: [
+        {
+          codeDesc: 'Port Forwarding Start',
+          code: 'ABC123',
+          raw: {
+            event: 'port',
+            code: 'ABC123',
+            time: '2020-06-05T16:24:05Z',
+            uid: '68a83a99-73ce-4bd7-bbf7-99103c2ba6a0',
+          },
+        },
+      ],
+    },
+  ];
+
+  test.each(testCases)('$description', testCase => {
+    expect(eventsWithoutExamples(testCase.events, testCase.formatters)).toEqual(
+      testCase.expected
+    );
+  });
+});
+
+describe('removeUnknowns', () => {
+  const testCases = [
+    {
+      description: 'event code not present in the formatters array',
+      events: [
+        {
+          id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+          time: new Date('2021-03-18T16:28:51.219Z'),
+          user: 'root',
+          message: 'User [root] has deleted a card',
+          codeDesc: 'Unknown',
+          code: 'ABC123',
+          raw: {
+            event: 'billing.delete_card',
+            time: '2020-06-05T16:24:05Z',
+            uid: '68a83a99-73ce-4bd7-bbf7-99103c2ba6a0',
+            code: 'ABC123',
+          },
+        },
+      ],
+      formatters: {
+        ABC456: {
+          type: 'billing.create_card',
+          desc: 'Card created',
+          format: () => {
+            return 'Card created';
+          },
+        },
+      },
+      expected: [],
+    },
+  ];
+
+  test.each(testCases)('$description', testCase => {
+    expect(removeUnknowns(testCase.events, testCase.formatters)).toEqual(
+      testCase.expected
+    );
+  });
+});
+
+describe('createEventSection', () => {
+  const testCases = [
+    {
+      description: 'Example event with full information',
+      event: {
+        codeDesc: 'Credit Card Deleted',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        code: 'TBL01I',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: {
+          cluster_name: 'some-name',
+          code: 'TBL01I',
+          ei: 0,
+          event: 'billing.delete_card',
+          time: '2021-03-18T16:28:51.219Z',
+          uid: '056517e0-f7e1-4286-b437-c75f3a865af4',
+          user: 'root',
+        },
+      },
+      expected: `## billing.delete_card
+
+Credit Card Deleted
+
+Example:
+
+\`\`\`json
+{
+  "cluster_name": "some-name",
+  "code": "TBL01I",
+  "ei": 0,
+  "event": "billing.delete_card",
+  "time": "2021-03-18T16:28:51.219Z",
+  "uid": "056517e0-f7e1-4286-b437-c75f3a865af4",
+  "user": "root"
+}
+\`\`\`
+`,
+    },
+  ];
+
+  test.each(testCases)('$description', testCase => {
+    expect(createEventSection(testCase.event)).toEqual(testCase.expected);
+  });
+});
+
+describe('createReferencePage', () => {
+  const introParagraph = 'This is an intro paragraph.';
+
+  test('formats a list of events as expected', () => {
+    const events = [
+      {
+        codeDesc: 'Kubernetes Created',
+        message:
+          'User [05ff66c9-a948-42f4-af0e-a1b6ba62561e.root] created Kubernetes cluster [kube-local]',
+        id: '9d37514f-aef5-426f-9fda-31fd35d070f5',
+        code: 'T3010I',
+        user: '05ff66c9-a948-42f4-af0e-a1b6ba62561e.root',
+        time: new Date('2022-09-08T15:42:36.005Z'),
+        raw: {
+          cluster_name: 'root',
+          code: 'T3010I',
+          kube_labels: [Object],
+          ei: 0,
+          event: 'kube.create',
+          expires: '0001-01-01T00:00:00Z',
+          name: 'kube-local',
+          time: '2022-09-08T15:42:36.005Z',
+          uid: '9d37514f-aef5-426f-9fda-31fd35d070f5',
+          user: '05ff66c9-a948-42f4-af0e-a1b6ba62561e.root',
+        },
+      },
+      {
+        codeDesc: 'Kubernetes Updated',
+        message:
+          'User [05ff66c9-a948-42f4-af0e-a1b6ba62561e.root] updated Kubernetes cluster [kube-local]',
+        id: 'fe631a5a-6418-49d6-99e7-5280654663ec',
+        code: 'T3011I',
+        user: '05ff66c9-a948-42f4-af0e-a1b6ba62561e.root',
+        time: new Date('2022-09-08T15:42:36.005Z'),
+        raw: {
+          cluster_name: 'root',
+          code: 'T3011I',
+          kube_labels: [Object],
+          ei: 0,
+          event: 'kube.update',
+          expires: '0001-01-01T00:00:00Z',
+          name: 'kube-local',
+          time: '2022-09-08T15:42:36.005Z',
+          uid: 'fe631a5a-6418-49d6-99e7-5280654663ec',
+          user: '05ff66c9-a948-42f4-af0e-a1b6ba62561e.root',
+        },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## kube.create
+
+Kubernetes Created
+
+Example:
+
+\`\`\`json
+{
+  "cluster_name": "root",
+  "code": "T3010I",
+  "kube_labels": [
+    null
+  ],
+  "ei": 0,
+  "event": "kube.create",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "kube-local",
+  "time": "2022-09-08T15:42:36.005Z",
+  "uid": "9d37514f-aef5-426f-9fda-31fd35d070f5",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+\`\`\`
+
+## kube.update
+
+Kubernetes Updated
+
+Example:
+
+\`\`\`json
+{
+  "cluster_name": "root",
+  "code": "T3011I",
+  "kube_labels": [
+    null
+  ],
+  "ei": 0,
+  "event": "kube.update",
+  "expires": "0001-01-01T00:00:00Z",
+  "name": "kube-local",
+  "time": "2022-09-08T15:42:36.005Z",
+  "uid": "fe631a5a-6418-49d6-99e7-5280654663ec",
+  "user": "05ff66c9-a948-42f4-af0e-a1b6ba62561e.root"
+}
+\`\`\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+
+  test('orders event sections by H2', () => {
+    const events = [
+      {
+        codeDesc: 'Event C',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        time: new Date('2025-01-01'),
+        user: 'root',
+        message: '123abc',
+        code: 'GHI123',
+        raw: {
+          event: 'event.c',
+          code: 'GHI123',
+        },
+      },
+      {
+        codeDesc: 'Event A',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        time: new Date('2025-01-01'),
+        user: 'root',
+        message: '123abc',
+        code: 'ABC123',
+        raw: {
+          event: 'event.a',
+          code: 'ABC123',
+        },
+      },
+      {
+        codeDesc: 'Event B',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        time: new Date('2025-01-01'),
+        user: 'root',
+        message: '123abc',
+        code: 'DEF123',
+        raw: {
+          event: 'event.b',
+          code: 'DEF123',
+        },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## event.a
+
+Event A
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.a",
+  "code": "ABC123"
+}
+\`\`\`
+
+## event.b
+
+Event B
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.b",
+  "code": "DEF123"
+}
+\`\`\`
+
+## event.c
+
+Event C
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.c",
+  "code": "GHI123"
+}
+\`\`\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+
+  test('includes H3 sections for event codes if there are duplicate types', () => {
+    const events = [
+      {
+        codeDesc: 'Event A',
+        code: 'ABC123',
+        raw: {
+          event: 'event.a',
+          code: 'ABC123',
+        },
+      },
+      {
+        codeDesc: 'Event A failed',
+        code: 'ABC456',
+        raw: {
+          event: 'event.a',
+          code: 'ABC456',
+        },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## event.a
+
+There are multiple events with the \`event.a\` type.
+
+### ABC123
+
+Event A
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.a",
+  "code": "ABC123"
+}
+\`\`\`
+
+### ABC456
+
+Event A failed
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.a",
+  "code": "ABC456"
+}
+\`\`\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+
+  test('deduplicates event codes', () => {
+    const events = [
+      {
+        codeDesc: 'Event A',
+        code: 'ABC123',
+        raw: {
+          event: 'event.a',
+          code: 'ABC123',
+        },
+      },
+      {
+        codeDesc: 'Event A',
+        code: 'ABC123',
+        raw: {
+          event: 'event.a',
+          code: 'ABC123',
+        },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## event.a
+
+Event A
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.a",
+  "code": "ABC123"
+}
+\`\`\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+
+  test('displays multiple events with only one raw field', () => {
+    const events = [
+      {
+        codeDesc: 'Access Request Reviewed',
+        code: 'T5002I',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: { event: 'access_request.review' },
+      },
+      {
+        codeDesc: 'Stable UNIX user created',
+        code: 'TSUU001I',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: { event: 'stable_unix_user.create' },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## access_request.review
+
+Access Request Reviewed
+
+Code: \`T5002I\`
+
+Event: \`access_request.review\`
+
+## stable_unix_user.create
+
+Stable UNIX user created
+
+Code: \`TSUU001I\`
+
+Event: \`stable_unix_user.create\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+
+  test('includes H3 sections for event codes with duplicate types and partial fields', () => {
+    const events = [
+      {
+        codeDesc: 'Event A',
+        code: 'ABC123',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: {
+          event: 'event.a',
+        },
+      },
+      {
+        codeDesc: 'Event A failed',
+        code: 'ABC456',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: {
+          event: 'event.a',
+          code: 'ABC456',
+          user: 'myuser',
+        },
+      },
+      {
+        codeDesc: 'Event A starting',
+        code: 'ABC789',
+        message: 'User [root] has deleted a credit card',
+        id: '056517e0-f7e1-4286-b437-c75f3a865af4',
+        user: 'root',
+        time: new Date('2021-03-18T16:28:51.219Z'),
+        raw: {
+          event: 'event.a',
+        },
+      },
+    ];
+
+    const expected = `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+This is an intro paragraph.
+
+## event.a
+
+There are multiple events with the \`event.a\` type.
+
+### ABC123
+
+Event A
+
+Code: \`ABC123\`
+
+Event: \`event.a\`
+
+### ABC456
+
+Event A failed
+
+Example:
+
+\`\`\`json
+{
+  "event": "event.a",
+  "code": "ABC456",
+  "user": "myuser"
+}
+\`\`\`
+
+### ABC789
+
+Event A starting
+
+Code: \`ABC789\`
+
+Event: \`event.a\`
+`;
+    const actual = createReferencePage(events, introParagraph);
+    expect(actual).toEqual(expected);
+  });
+});
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.ts b/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.ts
new file mode 100644
index 0000000000000..ab9ce4ffccbf3
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/gen-event-reference.ts
@@ -0,0 +1,184 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Event, Formatters } from './types';
+
+// eventsWithoutExamples returns an array of event objects based on the
+// elements in formatters that do not have corresponding examples in fixtures.
+export function eventsWithoutExamples(
+  fixtures: Event[],
+  formatters: Formatters
+): ReferencePageEventData[] {
+  const fixtureCodes = new Set(fixtures.map(fixture => fixture.code));
+  return Object.keys(formatters).reduce((accum, current) => {
+    if (fixtureCodes.has(current)) {
+      return accum;
+    }
+    const raw = {
+      code: current,
+      event: formatters[current].type,
+      // Use fixed values for time and UID, consistent with what fixtures
+      // use.
+      time: '2020-06-05T16:24:05Z',
+      uid: '68a83a99-73ce-4bd7-bbf7-99103c2ba6a0',
+    };
+    accum.push({
+      codeDesc:
+        typeof formatters[current].desc == 'string'
+          ? formatters[current].desc
+          : formatters[current].desc(raw),
+      code: current,
+      raw: raw,
+    });
+    return accum;
+  }, [] as ReferencePageEventData[]);
+}
+
+// removeUnknowns removes any event fixtures in the fixtures array that do not
+// have a formatter.
+export function removeUnknowns(
+  fixtures: Event[],
+  formatters: Formatters
+): ReferencePageEventData[] {
+  return fixtures.filter(r => r.code in formatters);
+}
+
+// exampleOrAttributes returns a string to include in a reference entry for an
+// audit event that describes the event's attributes.
+//
+// The generator expects all event objects to include a raw.event attribute, and
+// events with full examples include additional fields in the raw object. If
+// there is an example available for the event, we include the example,
+// formatted as JSON. Otherwise, we print only the event code and type.
+export function exampleOrAttributes(event: ReferencePageEventData): string {
+  if (Object.keys(event.raw).length > 1) {
+    return `Example:
+
+\`\`\`json
+${JSON.stringify(event.raw, null, 2)}
+\`\`\``;
+  }
+  return `Code: \`${event.code}\`
+
+Event: \`${event.raw.event}\``;
+}
+
+// createEventSection takes a JSON document that defines an audit event test
+// fixture and returns a string that contains an H2-level section to describe
+// the event.
+export function createEventSection(event: ReferencePageEventData): string {
+  return `## ${event.raw.event}
+
+${event.codeDesc + '\n'}
+${exampleOrAttributes(event)}
+`;
+}
+
+// createMultipleEventsSection takes an array of JSON documents that define an
+// audit event test fixture and returns a string that contains an H2-level
+// section to describe the event. It includes a separate H3 section for each
+// event code.
+//
+// See web/packages/teleport/src/Audit/fixtures/index.ts for the structure of an
+// audit event test fixture.
+export function createMultipleEventsSection(
+  events: ReferencePageEventData[]
+): string {
+  return events.reduce(
+    (accum, event) => {
+      return (
+        accum +
+        '\n' +
+        `### ${event.code}
+
+${event.codeDesc + '\n'}
+${exampleOrAttributes(event)}
+`
+      );
+    },
+    `## ${events[0].raw.event}
+
+There are multiple events with the \`${events[0].raw.event}\` type.
+`
+  );
+}
+
+export interface ReferencePageEventData {
+  code: string;
+  [propName: string]: any;
+  raw: {
+    [propName: string]: any;
+    event: string;
+  };
+}
+
+// createReferencePage takes an array of JSON documents that define an audit
+// event test fixture and returns a string that contains the text of an audit
+// event reference guide.
+//
+// introParagraph contains the text of the introductory paragraph to include in
+// the guide.
+//
+// See web/packages/teleport/src/Audit/fixtures/index.ts for the structure of an
+// audit event test fixture.
+export function createReferencePage(
+  jsonEvents: ReferencePageEventData[],
+  introParagraph: string
+): string {
+  const codeSet = new Set();
+  let result = jsonEvents;
+  result.sort((a, b) => {
+    if (a.raw.event < b.raw.event) {
+      return -1;
+    } else {
+      return 1;
+    }
+  });
+  const events = new Map<string, ReferencePageEventData[]>();
+  result.forEach(e => {
+    if (codeSet.has(e.code)) {
+      return;
+    }
+    const codeData = events.get(e.raw.event);
+    codeSet.add(e.code);
+    if (!codeData) {
+      events.set(e.raw.event, [e]);
+      return;
+    }
+    codeData.push(e);
+  });
+
+  return events.keys().reduce(
+    (accum, current) => {
+      const codes = events.get(current);
+      if (codes.length == 1) {
+        return accum + '\n' + createEventSection(codes[0]);
+      }
+      return accum + '\n' + createMultipleEventsSection(codes);
+    },
+    `---
+title: "Audit Event Reference"
+description: "Provides a comprehensive list of Teleport audit events and their fields."
+---
+{/* Generated file. Do not edit. */}
+{/* To regenerate, navigate to docs/gen-event-reference and run pnpm gen-docs */}
+
+${introParagraph}
+`
+  );
+}
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/index.ts b/web/packages/teleport/src/services/audit/gen-event-reference/index.ts
new file mode 100644
index 0000000000000..f9c0fd2918f16
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/index.ts
@@ -0,0 +1,80 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import fs from 'node:fs';
+
+import { events } from 'teleport/Audit/fixtures';
+
+import { formatters } from '../makeEvent';
+import {
+  createReferencePage,
+  eventsWithoutExamples,
+  removeUnknowns,
+} from './gen-event-reference.js';
+
+const introParagraph = `{/*cSpell:disable*/}
+
+{/* Formatted event examples sometimes include different capitalization than
+what we standardize on in the docs*/}
+{/* vale messaging.capitalization = NO */}
+
+Teleport components emit audit events to record activity within the cluster. 
+
+Audit event payloads have an \`event\` field that describes the event, which is
+often an operation performed against a dynamic resource (e.g.,
+\`access_list.create\` for the creation of an Access List) or some other user
+behavior, such as a local user login (\`user.login\`). The \`code\` field
+includes a string with pattern \`[A-Z0-9]{6}\` that is unique to an audit event,
+such as \`TAP03I\` for the creation of an application resource.
+
+In some cases, an audit event describes both a success state and a failure
+state, while the \`event\` field is the same for both states. In this case, the
+\`code\` field differs between states. For example, \`access_list.create\`
+describes both successful and failed Access List creations, while the success
+event has code \`TAL001I\` and the failure has code \`TAL001E\`. For other
+events, like \`db.session.query.failed\` and \`db.session.query\`, the event
+type describes only the success or failure state.
+
+You can set up Teleport to export audit events to third-party services for
+storage, visualization, and analysis. For more information, read [Exporting
+Teleport Audit Events](
+../zero-trust-access/export-audit-events/export-audit-events.mdx).`;
+
+if (process.argv.length !== 3) {
+  console.error(
+    'The argument of the script must be the path of the audit event reference page.'
+  );
+  process.exit(1);
+}
+
+console.log('Writing an audit event reference page to ', process.argv[2]);
+
+const noExampleEvents = eventsWithoutExamples(events, formatters);
+noExampleEvents.forEach(e => {
+  console.error(
+    `Warning: adding an entry for ${e.code} (${e.raw.event}) with no example. Add a test fixture to web/packages/teleport/src/Audit/fixtures/index.ts`
+  );
+});
+
+fs.writeFileSync(
+  process.argv[2],
+  createReferencePage(
+    removeUnknowns(events, formatters).concat(noExampleEvents),
+    introParagraph
+  )
+);
diff --git a/web/packages/teleport/src/services/audit/gen-event-reference/types.ts b/web/packages/teleport/src/services/audit/gen-event-reference/types.ts
new file mode 100644
index 0000000000000..d18592684fe84
--- /dev/null
+++ b/web/packages/teleport/src/services/audit/gen-event-reference/types.ts
@@ -0,0 +1,49 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * These are more generalized version of types from services/audit/types.ts.
+ * gen-event-reference doesn't care about exact codes. We just need to make sure that the object
+ * shapes stay in sync between audit and gen-event-reference.
+ */
+
+export type Event = {
+  id: string;
+  time: Date;
+  user: string;
+  message: string;
+  code: string;
+  codeDesc: string;
+  raw: RawEvent;
+};
+
+export type Formatters = {
+  [key in string]: {
+    type: string;
+    desc: string | ((json: RawEvent) => string);
+    format: (json: RawEvent) => string;
+  };
+};
+
+type RawEvent = {
+  code: string;
+  user?: string;
+  time: string;
+  uid: string;
+  event: string;
+};
diff --git a/web/packages/teleport/src/services/audit/makeEvent.ts b/web/packages/teleport/src/services/audit/makeEvent.ts
index 90989ed5e4e16..d1db0b3fceff0 100644
--- a/web/packages/teleport/src/services/audit/makeEvent.ts
+++ b/web/packages/teleport/src/services/audit/makeEvent.ts
@@ -236,26 +236,26 @@ export const formatters: Formatters = {
     type: 'exec',
     desc: 'Command Execution',
     format: event => {
-      const { proto, kubernetes_cluster, user = '' } = event;
+      const { proto, kubernetes_cluster, user = '', sid } = event;
       if (proto === 'kube') {
         if (!kubernetes_cluster) {
-          return `User [${user}] executed a Kubernetes command`;
+          return `User [${user}] executed a Kubernetes command within session [${sid}]`;
         }
-        return `User [${user}] executed a command on Kubernetes cluster [${kubernetes_cluster}]`;
+        return `User [${user}] executed a command on Kubernetes cluster [${kubernetes_cluster}] within session [${sid}]`;
       }
 
       return `User [${user}] executed a command on node ${
         event['server_hostname'] || event['addr.local']
-      }`;
+      } within session [${sid}]`;
     },
   },
   [eventCodes.EXEC_FAILURE]: {
     type: 'exec',
     desc: 'Command Execution Failed',
-    format: ({ user, exitError, ...rest }) =>
+    format: ({ user, exitError, sid, ...rest }) =>
       `User [${user}] command execution on node ${
         rest['server_hostname'] || rest['addr.local']
-      } failed [${exitError}]`,
+      } failed [${exitError}] within session [${sid}]`,
   },
   [eventCodes.GITHUB_CONNECTOR_CREATED]: {
     type: 'github.created',
@@ -1244,50 +1244,94 @@ export const formatters: Formatters = {
   [eventCodes.DESKTOP_CLIPBOARD_RECEIVE]: {
     type: 'desktop.clipboard.receive',
     desc: 'Clipboard Data Received',
-    format: ({ user, desktop_addr, length }) =>
-      `User [${user}] received ${length} bytes of clipboard data from desktop [${desktop_addr}]`,
+    format: ({ user, desktop_addr, length, desktop_name }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] received ${length} bytes of clipboard data from desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_CLIPBOARD_SEND]: {
     type: 'desktop.clipboard.send',
     desc: 'Clipboard Data Sent',
-    format: ({ user, desktop_addr, length }) =>
-      `User [${user}] sent ${length} bytes of clipboard data to desktop [${desktop_addr}]`,
+    format: ({ user, desktop_addr, length, desktop_name }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] sent ${length} bytes of clipboard data to desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_START]: {
     type: 'desktop.directory.share',
     desc: 'Directory Sharing Started',
-    format: ({ user, desktop_addr, directory_name }) =>
-      `User [${user}] started sharing directory [${directory_name}] to desktop [${desktop_addr}]`,
+    format: ({ user, desktop_addr, directory_name, desktop_name }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] started sharing directory [${directory_name}] to desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_START_FAILURE]: {
     type: 'desktop.directory.share',
     desc: 'Directory Sharing Start Failed',
-    format: ({ user, desktop_addr, directory_name }) =>
-      `User [${user}] failed to start sharing directory [${directory_name}] to desktop [${desktop_addr}]`,
+    format: ({ user, desktop_addr, directory_name, desktop_name }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] failed to start sharing directory [${directory_name}] to desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_READ]: {
     type: 'desktop.directory.read',
     desc: 'Directory Sharing Read',
-    format: ({ user, desktop_addr, directory_name, file_path, length }) =>
-      `User [${user}] read [${length}] bytes from file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop_addr}]`,
+    format: ({
+      user,
+      desktop_addr,
+      directory_name,
+      file_path,
+      length,
+      desktop_name,
+    }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] read [${length}] bytes from file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_READ_FAILURE]: {
     type: 'desktop.directory.read',
     desc: 'Directory Sharing Read Failed',
-    format: ({ user, desktop_addr, directory_name, file_path, length }) =>
-      `User [${user}] failed to read [${length}] bytes from file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop_addr}]`,
+    format: ({
+      user,
+      desktop_addr,
+      directory_name,
+      file_path,
+      length,
+      desktop_name,
+    }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] failed to read [${length}] bytes from file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_WRITE]: {
     type: 'desktop.directory.write',
     desc: 'Directory Sharing Write',
-    format: ({ user, desktop_addr, directory_name, file_path, length }) =>
-      `User [${user}] wrote [${length}] bytes to file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop_addr}]`,
+    format: ({
+      user,
+      desktop_addr,
+      directory_name,
+      file_path,
+      length,
+      desktop_name,
+    }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] wrote [${length}] bytes to file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop}]`;
+    },
   },
   [eventCodes.DESKTOP_SHARED_DIRECTORY_WRITE_FAILURE]: {
     type: 'desktop.directory.write',
     desc: 'Directory Sharing Write Failed',
-    format: ({ user, desktop_addr, directory_name, file_path, length }) =>
-      `User [${user}] failed to write [${length}] bytes to file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop_addr}]`,
+    format: ({
+      user,
+      desktop_addr,
+      directory_name,
+      file_path,
+      length,
+      desktop_name,
+    }) => {
+      const desktop = desktop_name ? desktop_name : desktop_addr;
+      return `User [${user}] failed to write [${length}] bytes to file [${file_path}] in shared directory [${directory_name}] on desktop [${desktop}]`;
+    },
   },
   [eventCodes.DEVICE_CREATE]: {
     type: 'device.create',
@@ -1381,8 +1425,11 @@ export const formatters: Formatters = {
   [eventCodes.CERTIFICATE_CREATED]: {
     type: 'cert.create',
     desc: 'Certificate Issued',
-    format: ({ cert_type, identity: { user } }) => {
+    format: ({ cert_type, identity: { user, usage } }) => {
       if (cert_type === 'user') {
+        if (usage?.includes('usage:windows_desktop')) {
+          return `Windows desktop certificate issued for user [${user}]`;
+        }
         return `User certificate issued for [${user}]`;
       }
       return `Certificate of type [${cert_type}] issued for [${user}]`;
@@ -2190,6 +2237,199 @@ export const formatters: Formatters = {
       return `User ${user} rolled back the autoupdate rollout groups ${groups}`;
     },
   },
+  [eventCodes.MCP_SESSION_START]: {
+    type: 'mcp.session.start',
+    desc: 'MCP Session Started',
+    format: event => {
+      const { user, app_name } = event;
+      return `User [${user}] has connected to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_END]: {
+    type: 'mcp.session.end',
+    desc: 'MCP Session Ended',
+    format: event => {
+      const { user, app_name } = event;
+      return `User [${user}] has disconnected from MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_END_FAILURE]: {
+    type: 'mcp.session.end',
+    desc: 'MCP Session End Failure',
+    format: event => {
+      const { user, app_name } = event;
+      return `User [${user}] failed to disconnect from MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_REQUEST]: {
+    type: 'mcp.session.request',
+    desc: 'MCP Session Request',
+    format: ({ user, app_name, message }) => {
+      if (message.params?.name) {
+        return `User [${user}] sent an MCP request [${message.method}] for [${message.params.name}] to MCP server [${app_name}]`;
+      }
+      return `User [${user}] sent an MCP request [${message.method}] to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_REQUEST_FAILURE]: {
+    type: 'mcp.session.request',
+    desc: 'MCP Session Request Failure',
+    format: ({ user, app_name, message }) => {
+      if (message.params?.name) {
+        return `User [${user}] failed to send an MCP request [${message.method}] for [${message.params.name}] to MCP server [${app_name}]`;
+      }
+      return `User [${user}] failed to send an MCP request [${message.method}] to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_NOTIFICATION]: {
+    type: 'mcp.session.notification',
+    desc: 'MCP Session Notification',
+    format: ({ user, app_name, message }) => {
+      return `User [${user}] sent an MCP notification [${message.method}] to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_NOTIFICATION_FAILURE]: {
+    type: 'mcp.session.notification',
+    desc: 'MCP Session Notification Failure',
+    format: ({ user, app_name, message }) => {
+      return `User [${user}] failed to send an MCP notification [${message.method}] to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM]: {
+    type: 'mcp.session.listen_sse_stream',
+    desc: 'MCP Session Listen',
+    format: ({ user, app_name }) => {
+      return `User [${user}] has started listening events from MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM_FAILURE]: {
+    type: 'mcp.session.listen_sse_stream',
+    desc: 'MCP Session Listen Failure',
+    format: ({ user, app_name }) => {
+      return `User [${user}] failed to listen events from MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.MCP_SESSION_INVALID_HTTP_REQUEST]: {
+    type: 'mcp.session.invalid_http_request',
+    desc: 'MCP Session Invalid Request',
+    format: ({ user, app_name }) => {
+      return `User [${user}] attempted to send an invalid request to MCP server [${app_name}]`;
+    },
+  },
+  [eventCodes.BOUND_KEYPAIR_RECOVERY]: {
+    type: 'join_token.bound_keypair.recovery',
+    desc: 'Bound Keypair Recovery',
+    format: ({ token_name, success, error, recovery_count }) => {
+      return success
+        ? `Bound Keypair token [${token_name}] was successfully used in a recovery attempt. New counter value: ${recovery_count}`
+        : `Bound Keypair token [${token_name}] was used to attempt a recovery and failed: ${error}`;
+    },
+  },
+  [eventCodes.BOUND_KEYPAIR_ROTATION]: {
+    type: 'join_token.bound_keypair.rotation',
+    desc: 'Bound Keypair Rotation',
+    format: ({ token_name, success, error }) => {
+      return success
+        ? `Bound Keypair token [${token_name}] successfully rotated its public key during a join attempt`
+        : `Bound Keypair token [${token_name}] failed to rotate its public key during a join attempt: ${error}`;
+    },
+  },
+  [eventCodes.BOUND_KEYPAIR_JOIN_STATE_VERIFICATION_FAILED]: {
+    type: 'join_token.bound_keypair.join_state_verification_failed',
+    desc: 'Bound Keypair Join Verification Failed',
+    format: ({ token_name, error }) => {
+      return `Bound keypair token [${token_name}] failed to verify a join attempt: ${error}`;
+    },
+  },
+  [eventCodes.SCIM_RESOURCE_LIST]: {
+    type: 'scim.list',
+    desc: 'SCIM Resource Listing Succeeded',
+    format: ({ integration, resource_type }) =>
+      `[${integration}] [${resource_type}] listing succeeded`,
+  },
+  [eventCodes.SCIM_RESOURCE_LIST_FAILURE]: {
+    type: 'scim.list',
+    desc: 'SCIM Resource Listing Failed',
+    format: ({ integration, resource_type }) =>
+      `[${integration}] [${resource_type}] listing failed`,
+  },
+  [eventCodes.SCIM_RESOURCE_GET]: {
+    type: 'scim.get',
+    desc: 'SCIM Resource Fetch Succeeded',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Fetching Teleport [${resource_type}] [${teleport_id}] for [${integration}] [${resource_type}] [${external_id}] succeeded`,
+  },
+  [eventCodes.SCIM_RESOURCE_GET_FAILURE]: {
+    type: 'scim.get',
+    desc: 'SCIM Resource Fetch Failed',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Fetching Teleport [${resource_type}] [${teleport_id}] for [${integration}] [${resource_type}] [${external_id}] failed`,
+  },
+  [eventCodes.SCIM_RESOURCE_CREATE]: {
+    type: 'scim.create',
+    desc: 'SCIM Resource Creation Succeeded',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Creating Teleport [${resource_type}] [${teleport_id}] for [${integration}] [${resource_type}] [${external_id}] succeeded`,
+  },
+  [eventCodes.SCIM_RESOURCE_CREATE_FAILURE]: {
+    type: 'scim.create',
+    desc: 'SCIM Resource Creation Failed',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Creating Teleport [${resource_type}] [${teleport_id}] for [${integration}] [${resource_type}] [${external_id}] failed`,
+  },
+  [eventCodes.SCIM_RESOURCE_UPDATE]: {
+    type: 'scim.update',
+    desc: 'SCIM Update Succeeded',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Updating Teleport [${resource_type}] [${teleport_id}] from [${integration}][${resource_type}] [${external_id}] succeeded`,
+  },
+  [eventCodes.SCIM_RESOURCE_UPDATE_FAILURE]: {
+    type: 'scim.update',
+    desc: 'SCIM Update Failed',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Updating Teleport [${resource_type}] [${teleport_id}] from [${integration}][${resource_type}] [${external_id}] failed`,
+  },
+  [eventCodes.SCIM_RESOURCE_DELETE]: {
+    type: 'scim.delete',
+    desc: 'SCIM Delete Succeeded',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Deleting [${integration}] [${resource_type}] [${external_id}] / [${teleport_id}] succeeded`,
+  },
+  [eventCodes.SCIM_RESOURCE_DELETE_FAILURE]: {
+    type: 'scim.delete',
+    desc: 'SCIM Delete Failed',
+    format: ({ integration, resource_type, teleport_id, external_id }) =>
+      `Deleting [${integration}] [${resource_type}] [${external_id}] / [${teleport_id}] failed`,
+  },
+  [eventCodes.CLIENT_IP_RESTRICTIONS_UPDATE]: {
+    type: 'cir.update',
+    desc: 'Client IP Restrictions update',
+    format: ({ user, client_ip_restrictions, success }) =>
+      success
+        ? `User [${user}] updated the Client IP Restrictions allowlist to [${client_ip_restrictions}].`
+        : `User [${user}] has failed to update  Client IP Restrictions.`,
+  },
+  [eventCodes.VNET_CONFIG_CREATE]: {
+    type: 'vnet.config.create',
+    desc: 'VNet config created',
+    format: ({ user }) => {
+      return `User [${user}] created the VNet config`;
+    },
+  },
+  [eventCodes.VNET_CONFIG_UPDATE]: {
+    type: 'vnet.config.update',
+    desc: 'VNet config updated',
+    format: ({ user }) => {
+      return `User [${user}] updated the VNet config`;
+    },
+  },
+  [eventCodes.VNET_CONFIG_DELETE]: {
+    type: 'vnet.config.delete',
+    desc: 'VNet config deleted',
+    format: ({ user }) => {
+      return `User [${user}] deleted the VNet config`;
+    },
+  },
 };
 
 const unknownFormatter = {
diff --git a/web/packages/teleport/src/services/audit/types.ts b/web/packages/teleport/src/services/audit/types.ts
index 996238a0680c5..c8df2664c8952 100644
--- a/web/packages/teleport/src/services/audit/types.ts
+++ b/web/packages/teleport/src/services/audit/types.ts
@@ -333,6 +333,33 @@ export const eventCodes = {
   AUTOUPDATE_AGENT_ROLLOUT_TRIGGER: 'AUAR001I',
   AUTOUPDATE_AGENT_ROLLOUT_FORCE_DONE: 'AUAR002I',
   AUTOUPDATE_AGENT_ROLLOUT_ROLLBACK: 'AUAR003I',
+  MCP_SESSION_START: 'TMCP001I',
+  MCP_SESSION_END: 'TMCP002I',
+  MCP_SESSION_END_FAILURE: 'TMCP002E',
+  MCP_SESSION_REQUEST: 'TMCP003I',
+  MCP_SESSION_REQUEST_FAILURE: 'TMCP003E',
+  MCP_SESSION_NOTIFICATION: 'TMCP004I',
+  MCP_SESSION_NOTIFICATION_FAILURE: 'TMCP004E',
+  MCP_SESSION_LISTEN_SSE_STREAM: 'TMCP005I',
+  MCP_SESSION_LISTEN_SSE_STREAM_FAILURE: 'TMCP005E',
+  MCP_SESSION_INVALID_HTTP_REQUEST: 'TMCP006E',
+  BOUND_KEYPAIR_RECOVERY: 'TBK001I',
+  BOUND_KEYPAIR_ROTATION: 'TBK002I',
+  BOUND_KEYPAIR_JOIN_STATE_VERIFICATION_FAILED: 'TBK003W',
+  SCIM_RESOURCE_CREATE: 'TSCIM001I',
+  SCIM_RESOURCE_CREATE_FAILURE: 'TSCIM001E',
+  SCIM_RESOURCE_UPDATE: 'TSCIM002I',
+  SCIM_RESOURCE_UPDATE_FAILURE: 'TSCIM002E',
+  SCIM_RESOURCE_DELETE: 'TSCIM003I',
+  SCIM_RESOURCE_DELETE_FAILURE: 'TSCIM003E',
+  SCIM_RESOURCE_GET: 'TSCIM004I',
+  SCIM_RESOURCE_GET_FAILURE: 'TSCIM004E',
+  SCIM_RESOURCE_LIST: 'TSCIM005I',
+  SCIM_RESOURCE_LIST_FAILURE: 'TSCIM005IE',
+  CLIENT_IP_RESTRICTIONS_UPDATE: 'CIR001I',
+  VNET_CONFIG_CREATE: 'TVNET001I',
+  VNET_CONFIG_UPDATE: 'TVNET002I',
+  VNET_CONFIG_DELETE: 'TVNET003I',
 } as const;
 
 /**
@@ -388,11 +415,15 @@ export type RawEvents = {
     {
       proto: 'kube';
       kubernetes_cluster: string;
+      sid: string;
     }
   >;
   [eventCodes.EXEC_FAILURE]: RawEvent<
     typeof eventCodes.EXEC_FAILURE,
-    { exitError: string }
+    {
+      exitError: string;
+      sid: string;
+    }
   >;
   [eventCodes.BILLING_CARD_CREATE]: RawEvent<
     typeof eventCodes.BILLING_CARD_CREATE
@@ -1179,6 +1210,7 @@ export type RawEvents = {
       desktop_addr: string;
       length: number;
       windows_domain: string;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_CLIPBOARD_SEND]: RawEvent<
@@ -1187,6 +1219,7 @@ export type RawEvents = {
       desktop_addr: string;
       length: number;
       windows_domain: string;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_START]: RawEvent<
@@ -1195,6 +1228,7 @@ export type RawEvents = {
       desktop_addr: string;
       directory_name: string;
       windows_domain: string;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_START_FAILURE]: RawEvent<
@@ -1203,6 +1237,7 @@ export type RawEvents = {
       desktop_addr: string;
       directory_name: string;
       windows_domain: string;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_READ]: RawEvent<
@@ -1213,6 +1248,7 @@ export type RawEvents = {
       windows_domain: string;
       file_path: string;
       length: number;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_READ_FAILURE]: RawEvent<
@@ -1223,6 +1259,7 @@ export type RawEvents = {
       windows_domain: string;
       file_path: string;
       length: number;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_WRITE]: RawEvent<
@@ -1233,6 +1270,7 @@ export type RawEvents = {
       windows_domain: string;
       file_path: string;
       length: number;
+      desktop_name: string;
     }
   >;
   [eventCodes.DESKTOP_SHARED_DIRECTORY_WRITE_FAILURE]: RawEvent<
@@ -1243,6 +1281,7 @@ export type RawEvents = {
       windows_domain: string;
       file_path: string;
       length: number;
+      desktop_name: string;
     }
   >;
   [eventCodes.DEVICE_CREATE]: RawDeviceEvent<typeof eventCodes.DEVICE_CREATE>;
@@ -1284,7 +1323,7 @@ export type RawEvents = {
     typeof eventCodes.CERTIFICATE_CREATED,
     {
       cert_type: 'user';
-      identity: { user: string };
+      identity: { user: string; usage?: string[] };
     }
   >;
   [eventCodes.UPGRADE_WINDOW_UPDATED]: RawEvent<
@@ -1926,6 +1965,163 @@ export type RawEvents = {
       groups: string[];
     }
   >;
+  [eventCodes.MCP_SESSION_START]: RawEvent<
+    typeof eventCodes.MCP_SESSION_START,
+    {
+      sid: string;
+      app_name: string;
+    }
+  >;
+  [eventCodes.MCP_SESSION_END]: RawEvent<
+    typeof eventCodes.MCP_SESSION_END,
+    {
+      sid: string;
+      app_name: string;
+    }
+  >;
+  [eventCodes.MCP_SESSION_END_FAILURE]: RawEvent<
+    typeof eventCodes.MCP_SESSION_END_FAILURE,
+    {
+      app_name: string;
+    }
+  >;
+  [eventCodes.MCP_SESSION_REQUEST]: RawEvent<
+    typeof eventCodes.MCP_SESSION_REQUEST,
+    {
+      app_name: string;
+      message: {
+        method: string;
+        params?: {
+          name?: string;
+        };
+      };
+    }
+  >;
+  [eventCodes.MCP_SESSION_REQUEST_FAILURE]: RawEvent<
+    typeof eventCodes.MCP_SESSION_REQUEST_FAILURE,
+    {
+      app_name: string;
+      message: {
+        method: string;
+        params?: {
+          name?: string;
+        };
+      };
+    }
+  >;
+  [eventCodes.MCP_SESSION_NOTIFICATION]: RawEvent<
+    typeof eventCodes.MCP_SESSION_NOTIFICATION,
+    {
+      app_name: string;
+      message: {
+        method: string;
+      };
+    }
+  >;
+  [eventCodes.MCP_SESSION_NOTIFICATION_FAILURE]: RawEvent<
+    typeof eventCodes.MCP_SESSION_NOTIFICATION_FAILURE,
+    {
+      app_name: string;
+      message: {
+        method: string;
+      };
+    }
+  >;
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM]: RawEvent<
+    typeof eventCodes.MCP_SESSION_LISTEN_SSE_STREAM,
+    {
+      app_name: string;
+    }
+  >;
+  [eventCodes.MCP_SESSION_LISTEN_SSE_STREAM_FAILURE]: RawEvent<
+    typeof eventCodes.MCP_SESSION_LISTEN_SSE_STREAM_FAILURE,
+    {
+      app_name: string;
+    }
+  >;
+  [eventCodes.MCP_SESSION_INVALID_HTTP_REQUEST]: RawEvent<
+    typeof eventCodes.MCP_SESSION_INVALID_HTTP_REQUEST,
+    {
+      app_name: string;
+    }
+  >;
+  [eventCodes.BOUND_KEYPAIR_RECOVERY]: RawEvent<
+    typeof eventCodes.BOUND_KEYPAIR_RECOVERY,
+    {
+      token_name: string;
+      bot_name: string;
+      success: boolean;
+      error: string;
+      recovery_count: number;
+    }
+  >;
+  [eventCodes.BOUND_KEYPAIR_ROTATION]: RawEvent<
+    typeof eventCodes.BOUND_KEYPAIR_ROTATION,
+    {
+      token_name: string;
+      bot_name: string;
+      success: boolean;
+      error: string;
+    }
+  >;
+  [eventCodes.BOUND_KEYPAIR_JOIN_STATE_VERIFICATION_FAILED]: RawEvent<
+    typeof eventCodes.BOUND_KEYPAIR_JOIN_STATE_VERIFICATION_FAILED,
+    {
+      token_name: string;
+      bot_name: string;
+      success: boolean;
+      error: string;
+    }
+  >;
+  [eventCodes.SCIM_RESOURCE_LIST]: RawSCIMListingEvent<
+    typeof eventCodes.SCIM_RESOURCE_LIST
+  >;
+  [eventCodes.SCIM_RESOURCE_LIST_FAILURE]: RawSCIMListingEvent<
+    typeof eventCodes.SCIM_RESOURCE_LIST_FAILURE
+  >;
+  [eventCodes.SCIM_RESOURCE_GET]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_GET
+  >;
+  [eventCodes.SCIM_RESOURCE_GET_FAILURE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_GET_FAILURE
+  >;
+  [eventCodes.SCIM_RESOURCE_CREATE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_CREATE
+  >;
+  [eventCodes.SCIM_RESOURCE_CREATE_FAILURE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_CREATE_FAILURE
+  >;
+  [eventCodes.SCIM_RESOURCE_UPDATE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_UPDATE
+  >;
+  [eventCodes.SCIM_RESOURCE_UPDATE_FAILURE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_UPDATE_FAILURE
+  >;
+  [eventCodes.SCIM_RESOURCE_DELETE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_DELETE
+  >;
+  [eventCodes.SCIM_RESOURCE_DELETE_FAILURE]: RawSCIMResourceEvent<
+    typeof eventCodes.SCIM_RESOURCE_DELETE_FAILURE
+  >;
+  [eventCodes.CLIENT_IP_RESTRICTIONS_UPDATE]: RawEvent<
+    typeof eventCodes.CLIENT_IP_RESTRICTIONS_UPDATE,
+    {
+      client_ip_restrictions: string[];
+      success: boolean;
+    }
+  >;
+  [eventCodes.VNET_CONFIG_CREATE]: RawEvent<
+    typeof eventCodes.VNET_CONFIG_CREATE,
+    HasName
+  >;
+  [eventCodes.VNET_CONFIG_UPDATE]: RawEvent<
+    typeof eventCodes.VNET_CONFIG_UPDATE,
+    HasName
+  >;
+  [eventCodes.VNET_CONFIG_DELETE]: RawEvent<
+    typeof eventCodes.VNET_CONFIG_DELETE,
+    HasName
+  >;
 };
 
 /**
@@ -2144,6 +2340,25 @@ type RawEventAwsIcResourceSync<T extends EventCode> = RawEvent<
   }
 >;
 
+type RawSCIMListingEvent<T extends EventCode> = RawEvent<
+  T,
+  {
+    resource_type: string;
+    integration: string;
+  }
+>;
+
+type RawSCIMResourceEvent<T extends EventCode> = RawEvent<
+  T,
+  {
+    resource_type: string;
+    teleport_id: string;
+    external_id: string;
+    integration: string;
+    display: string;
+  }
+>;
+
 /**
  * A map of event formatters that provide short and long description
  */
diff --git a/web/packages/teleport/src/services/auth/auth.test.ts b/web/packages/teleport/src/services/auth/auth.test.ts
index d2d2e3def1924..4baa524a43560 100644
--- a/web/packages/teleport/src/services/auth/auth.test.ts
+++ b/web/packages/teleport/src/services/auth/auth.test.ts
@@ -20,8 +20,6 @@ import cfg from 'teleport/config';
 import api from 'teleport/services/api';
 import auth from 'teleport/services/auth';
 
-/* eslint-disable jest/no-conditional-expect */
-
 describe('services/auth', () => {
   afterEach(() => {
     jest.clearAllMocks();
diff --git a/web/packages/teleport/src/services/auth/auth.ts b/web/packages/teleport/src/services/auth/auth.ts
index eb0e9d864a797..59bdeeebfd710 100644
--- a/web/packages/teleport/src/services/auth/auth.ts
+++ b/web/packages/teleport/src/services/auth/auth.ts
@@ -17,6 +17,7 @@
  */
 
 import cfg from 'teleport/config';
+import { MfaState } from 'teleport/lib/useMfa';
 import api from 'teleport/services/api';
 import {
   DeviceType,
@@ -228,20 +229,17 @@ const auth = {
     });
   },
 
-  headlessSsoAccept(transactionId: string) {
-    return auth
-      .getMfaChallenge({ scope: MfaChallengeScope.HEADLESS_LOGIN })
-      .then(challenge => auth.getMfaChallengeResponse(challenge))
-      .then(res => {
-        const request = {
-          action: 'accept',
-          mfaResponse: res,
-          // TODO(Joerger): DELETE IN v19.0.0, new clients send mfaResponse.
-          webauthnAssertionResponse: res.webauthn_response,
-        };
+  headlessSsoAccept(mfa: MfaState, transactionId: string) {
+    return mfa.getChallengeResponse().then((res: MfaChallengeResponse) => {
+      const request = {
+        action: 'accept',
+        mfaResponse: res,
+        // TODO(Joerger): DELETE IN v19.0.0, new clients send mfaResponse.
+        webauthnAssertionResponse: res.webauthn_response,
+      };
 
-        return api.put(cfg.getHeadlessSsoPath(transactionId), request);
-      });
+      return api.put(cfg.getHeadlessSsoPath(transactionId), request);
+    });
   },
 
   headlessSSOReject(transactionId: string) {
@@ -358,8 +356,8 @@ const auth = {
     abortController?: AbortController
   ) {
     // try to center the screen
-    const width = 1045;
-    const height = 550;
+    const width = 1024;
+    const height = 768;
     const left = (screen.width - width) / 2;
     const top = (screen.height - height) / 2;
 
diff --git a/web/packages/teleport/src/services/bot/bot.ts b/web/packages/teleport/src/services/bot/bot.ts
index e5a308eca923f..9e3fe4a08d3f4 100644
--- a/web/packages/teleport/src/services/bot/bot.ts
+++ b/web/packages/teleport/src/services/bot/bot.ts
@@ -16,19 +16,26 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { MutationFunction } from '@tanstack/react-query';
+
 import cfg from 'teleport/config';
 import api from 'teleport/services/api';
 import {
+  canUseV1Edit,
+  canUseV2Edit,
   makeBot,
-  parseGetBotInstanceResponse,
-  parseListBotInstancesResponse,
   toApiGitHubTokenSpec,
+  validateGetBotInstanceMetricsResponse,
+  validateGetBotInstanceResponse,
+  validateListBotInstancesResponse,
 } from 'teleport/services/bot/consts';
 import ResourceService, { RoleResource } from 'teleport/services/resources';
 import { FeatureFlags } from 'teleport/types';
 
+import { validateListJoinTokensResponse } from '../joinToken/consts';
+import { MfaChallengeResponse } from '../mfa';
+import { withGenericUnsupportedError } from '../version/unsupported';
 import {
-  BotList,
   BotResponse,
   CreateBotJoinTokenRequest,
   CreateBotRequest,
@@ -36,13 +43,28 @@ import {
   FlatBot,
 } from './types';
 
-export function createBot(config: CreateBotRequest): Promise<void> {
-  return api.post(cfg.getBotsUrl(), config);
+export function createBot(
+  config: CreateBotRequest,
+  mfaResponse?: MfaChallengeResponse
+): Promise<void> {
+  return api.post(
+    cfg.getBotUrl({ action: 'create' }),
+    config,
+    undefined /* abort signal */,
+    mfaResponse
+  );
 }
 
-export async function getBot(name: string): Promise<FlatBot | null> {
+export async function getBot(
+  variables: {
+    botName: string;
+  },
+  signal?: AbortSignal
+): Promise<FlatBot | null> {
   try {
-    return await api.get(cfg.getBotUrlWithName(name)).then(makeBot);
+    return await api
+      .get(cfg.getBotUrl({ action: 'read', ...variables }), signal)
+      .then(makeBot);
   } catch (err) {
     // capture the not found error response and return null instead of throwing
     if (err?.response?.status === 404) {
@@ -52,61 +74,113 @@ export async function getBot(name: string): Promise<FlatBot | null> {
   }
 }
 
-export function createBotToken(req: CreateBotJoinTokenRequest) {
-  return api.post(cfg.getBotTokenUrl(), {
-    integrationName: req.integrationName,
-    joinMethod: req.joinMethod,
-    webFlowLabel: req.webFlowLabel,
-    gitHub: toApiGitHubTokenSpec(req.gitHub),
-  });
+export function createBotToken(
+  req: CreateBotJoinTokenRequest,
+  mfaResponse?: MfaChallengeResponse
+) {
+  return api.post(
+    cfg.getBotTokenUrl(),
+    {
+      integrationName: req.integrationName,
+      joinMethod: req.joinMethod,
+      webFlowLabel: req.webFlowLabel,
+      gitHub: toApiGitHubTokenSpec(req.gitHub),
+    },
+    undefined /* abort signal */,
+    mfaResponse
+  );
 }
 
-export function fetchBots(
-  signal: AbortSignal,
-  flags: FeatureFlags
-): Promise<BotList> {
+export async function listBotTokens(
+  variables: { botName: string; skipAuthnRetry: boolean },
+  signal: AbortSignal
+) {
+  const path = cfg.getJoinTokenUrl({ action: 'listV2' });
+  const qs = new URLSearchParams();
+  qs.set('bot_name', variables.botName);
+  qs.set('role', 'bot');
+
+  try {
+    const data = await api.get(`${path}?${qs.toString()}`, signal, undefined, {
+      skipAuthnRetry: variables.skipAuthnRetry,
+    });
+
+    if (!validateListJoinTokensResponse(data)) {
+      throw new Error('failed to validate list join tokens response');
+    }
+
+    return data;
+  } catch (err) {
+    // TODO(nicholasmarais1158) DELETE IN v20.0.0
+    withGenericUnsupportedError(err, '18.1.0');
+  }
+}
+
+export async function fetchBots(signal: AbortSignal, flags: FeatureFlags) {
   if (!flags.listBots) {
-    return;
+    throw new Error('cannot fetch bots: bots.list permission required');
   }
 
-  return api.get(cfg.getBotsUrl(), signal).then((json: BotResponse) => {
-    const items = json?.items || [];
-    return { bots: items.map(makeBot) };
-  });
+  return api
+    .get(cfg.getBotUrl({ action: 'list' }), signal)
+    .then((json: BotResponse) => {
+      const items = json?.items || [];
+      return { bots: items.map(makeBot) };
+    });
 }
 
 export async function fetchRoles(
-  search: string,
-  flags: FeatureFlags
+  variables: { search: string; flags: FeatureFlags },
+  signal?: AbortSignal
 ): Promise<{ startKey: string; items: RoleResource[] }> {
-  if (!flags.roles) {
+  if (!variables.flags.roles) {
     return { startKey: '', items: [] };
   }
 
   const resourceSvc = new ResourceService();
-  return resourceSvc.fetchRoles({ limit: 50, search });
+  return resourceSvc.fetchRoles(
+    { limit: 50, search: variables.search },
+    signal
+  );
 }
 
-export function editBot(
-  flags: FeatureFlags,
-  name: string,
-  req: EditBotRequest
-): Promise<FlatBot> {
-  if (!flags.editBots || !flags.roles) {
-    return;
-  }
+export const editBotMutationFunction: MutationFunction<
+  FlatBot,
+  { botName: string; req: EditBotRequest }
+> = vars => editBot(vars);
 
-  return api.put(cfg.getBotUrlWithName(name), req).then(res => {
-    return makeBot(res);
+export async function editBot(
+  variables: { botName: string; req: EditBotRequest },
+  signal?: AbortSignal
+) {
+  // TODO(nicholasmarais1158) DELETE IN v20.0.0
+  const useV1 = canUseV1Edit(variables.req);
+  // TODO(nicholasmarais1158) DELETE IN v20.0.0
+  const useV2 = canUseV2Edit(variables.req);
+  const path = cfg.getBotUrl({
+    action: useV1 ? 'update' : useV2 ? 'update-v2' : 'update-v3',
+    botName: variables.botName,
   });
-}
 
-export function deleteBot(flags: FeatureFlags, name: string) {
-  if (!flags.removeBots) {
-    return;
+  try {
+    const res = await api.put(path, variables.req, signal);
+    return makeBot(res);
+  } catch (err: unknown) {
+    // TODO(nicholasmarais1158) DELETE IN v20.0.0
+    withGenericUnsupportedError(err, '18.1.0');
   }
+}
 
-  return api.delete(cfg.getBotUrlWithName(name));
+export async function deleteBot(
+  variables: { botName: string },
+  signal?: AbortSignal
+) {
+  return api.deleteWithOptions(
+    cfg.getBotUrl({ action: 'delete', botName: variables.botName }),
+    {
+      signal,
+    }
+  );
 }
 
 export async function listBotInstances(
@@ -114,13 +188,29 @@ export async function listBotInstances(
     pageToken: string;
     pageSize: number;
     searchTerm?: string;
+    sortField?: string;
+    sortDir?: string;
     botName?: string;
+    query?: string;
   },
   signal?: AbortSignal
 ) {
-  const { pageToken, pageSize, searchTerm, botName } = variables;
+  const {
+    pageToken,
+    pageSize,
+    searchTerm,
+    sortField,
+    sortDir,
+    botName,
+    query,
+  } = variables;
+
+  // TODO(nicholasmarais1158) DELETE IN v20.0.0
+  const useV1Endpoint = !query;
 
-  const path = cfg.listBotInstancesUrl();
+  const path = cfg.getBotInstanceUrl({
+    action: useV1Endpoint ? 'list' : 'listV2',
+  });
   const qs = new URLSearchParams();
 
   qs.set('page_size', pageSize.toFixed());
@@ -132,10 +222,27 @@ export async function listBotInstances(
     qs.set('bot_name', botName);
   }
 
+  if (useV1Endpoint) {
+    const sort = `${sortField || 'name'}:${sortDir || 'asc'}`;
+    if (sort) {
+      qs.set('sort', sort);
+    }
+  } else {
+    if (sortField) {
+      qs.set('sort_field', sortField);
+    }
+    if (sortDir) {
+      qs.set('sort_dir', sortDir);
+    }
+    if (query) {
+      qs.set('query', query);
+    }
+  }
+
   const data = await api.get(`${path}?${qs.toString()}`, signal);
 
-  if (!parseListBotInstancesResponse(data)) {
-    throw new Error('failed to parse list bot instances response');
+  if (!validateListBotInstancesResponse(data)) {
+    throw new Error('failed to validate list bot instances response');
   }
 
   return data;
@@ -148,13 +255,82 @@ export async function getBotInstance(
   },
   signal?: AbortSignal
 ) {
-  const path = cfg.getBotInstanceUrl(variables.botName, variables.instanceId);
+  const path = cfg.getBotInstanceUrl({ action: 'read', ...variables });
 
   const data = await api.get(path, signal);
 
-  if (!parseGetBotInstanceResponse(data)) {
-    throw new Error('failed to parse get bot instance response');
+  if (!validateGetBotInstanceResponse(data)) {
+    throw new Error('failed to validate get bot instance response');
   }
 
   return data;
 }
+
+export async function getBotInstanceMetrics(
+  variables: null,
+  signal?: AbortSignal
+) {
+  const path = cfg.getBotInstanceUrl({ action: 'metrics' });
+
+  try {
+    const data = await api.get(path, signal);
+
+    if (!validateGetBotInstanceMetricsResponse(data)) {
+      throw new Error('failed to validate get bot instance metrics response');
+    }
+
+    return data;
+  } catch (err: unknown) {
+    // TODO(nicholasmarais1158) DELETE IN v20.0.0
+    withGenericUnsupportedError(err, '18.4.0');
+  }
+}
+
+export async function generateGhaK8sTemplates(
+  variables: {
+    github: {
+      allow: {
+        repository?: string;
+        owner?: string;
+        workflow?: string;
+        environment?: string;
+        actor?: string;
+        ref?: string;
+        ref_type?: string;
+      }[];
+      enterprise_server_host?: string;
+      enterprise_slug?: string;
+      static_jwks?: string;
+    };
+    kubernetes?: {
+      labels?: Record<string, string[]>;
+      groups?: string[];
+      users?: string[];
+      resources?: {
+        kind: string;
+        namespace: string;
+        name: string;
+        verbs: string[];
+        api_group: string;
+      }[];
+    };
+  },
+  signal?: AbortSignal
+) {
+  const resp = await api.post(
+    cfg.getBotUrl({
+      action: 'gen-wizard-cicd',
+    }),
+    {
+      source_type: 'github',
+      destination_type: 'kubernetes',
+      github: variables.github,
+      kubernetes: variables.kubernetes,
+    },
+    signal
+  );
+
+  return resp as {
+    terraform: string;
+  };
+}
diff --git a/web/packages/teleport/src/services/bot/consts.test.ts b/web/packages/teleport/src/services/bot/consts.test.ts
index 781ec21fb26a3..4cd4d4279f189 100644
--- a/web/packages/teleport/src/services/bot/consts.test.ts
+++ b/web/packages/teleport/src/services/bot/consts.test.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { getBotType } from './consts';
+import { canUseV1Edit, getBotType } from './consts';
 import { BotUiFlow } from './types';
 
 describe('getBotType', () => {
@@ -45,3 +45,16 @@ describe('getBotType', () => {
     expect(getBotType(labels)).toBeNull();
   });
 });
+
+describe('canUseV1Edit', () => {
+  it.each`
+    name                                   | req                                               | expected
+    ${'empty'}                             | ${{}}                                             | ${true}
+    ${'only roles'}                        | ${{ roles: [] }}                                  | ${true}
+    ${'only traits'}                       | ${{ traits: [] }}                                 | ${false}
+    ${'only max_session_ttl'}              | ${{ max_session_ttl: '' }}                        | ${false}
+    ${'roles, traits and max_session_ttl'} | ${{ roles: [], traits: [], max_session_ttl: '' }} | ${false}
+  `('$name', ({ req, expected }) => {
+    expect(canUseV1Edit(req)).toBe(expected);
+  });
+});
diff --git a/web/packages/teleport/src/services/bot/consts.ts b/web/packages/teleport/src/services/bot/consts.ts
index 80472313d7edb..f6f3dcb7cbbe5 100644
--- a/web/packages/teleport/src/services/bot/consts.ts
+++ b/web/packages/teleport/src/services/bot/consts.ts
@@ -20,7 +20,9 @@ import {
   ApiBot,
   BotType,
   BotUiFlow,
+  EditBotRequest,
   FlatBot,
+  GetBotInstanceMetricsResponse,
   GetBotInstanceResponse,
   GitHubRepoRule,
   ListBotInstancesResponse,
@@ -95,10 +97,12 @@ export function makeBot(bot: ApiBot): FlatBot {
 
     roles: bot?.spec?.roles || [],
     traits: bot?.spec?.traits || [],
+
+    max_session_ttl: bot?.spec?.max_session_ttl,
   };
 }
 
-export function parseListBotInstancesResponse(
+export function validateListBotInstancesResponse(
   data: unknown
 ): data is ListBotInstancesResponse {
   if (typeof data !== 'object' || data === null) {
@@ -116,7 +120,7 @@ export function parseListBotInstancesResponse(
   return data.bot_instances.every(x => typeof x === 'object' || x !== null);
 }
 
-export function parseGetBotInstanceResponse(
+export function validateGetBotInstanceResponse(
   data: unknown
 ): data is GetBotInstanceResponse {
   if (typeof data !== 'object' || data === null) {
@@ -134,6 +138,24 @@ export function parseGetBotInstanceResponse(
   return true;
 }
 
+export function validateGetBotInstanceMetricsResponse(
+  data: unknown
+): data is GetBotInstanceMetricsResponse {
+  if (typeof data !== 'object' || data === null) {
+    return false;
+  }
+
+  if (!('upgrade_statuses' in data)) {
+    return false;
+  }
+
+  if (typeof data.upgrade_statuses !== 'object') {
+    return false;
+  }
+
+  return true;
+}
+
 export function getBotType(labels: Map<string, string>): BotType {
   if (!labels) {
     return null;
@@ -151,3 +173,21 @@ export function getBotType(labels: Map<string, string>): BotType {
 }
 
 export const GITHUB_ACTIONS_LABEL_KEY = 'teleport.internal/ui-flow';
+
+export function canUseV1Edit(req: EditBotRequest) {
+  return Object.entries(req).every(([key, value]) => {
+    if (key !== 'roles') {
+      return value === null || value === undefined;
+    }
+    return true;
+  });
+}
+
+export function canUseV2Edit(req: EditBotRequest) {
+  return Object.entries(req).every(([key, value]) => {
+    if (!['roles', 'traits', 'max_session_ttl'].includes(key)) {
+      return value === null || value === undefined;
+    }
+    return true;
+  });
+}
diff --git a/web/packages/teleport/src/services/bot/types.ts b/web/packages/teleport/src/services/bot/types.ts
index acd34124a2320..6dea8400a811f 100644
--- a/web/packages/teleport/src/services/bot/types.ts
+++ b/web/packages/teleport/src/services/bot/types.ts
@@ -37,6 +37,11 @@ export type ApiBotMetadata = {
 export type ApiBotSpec = {
   roles: string[];
   traits: ApiBotTrait[];
+  max_session_ttl:
+    | {
+        seconds: number;
+      }
+    | undefined;
 };
 
 export type ApiBotTrait = {
@@ -65,17 +70,137 @@ export type BotInstanceSummary = {
   host_name_latest?: string;
   version_latest?: string;
   active_at_latest?: string;
+  os_latest?: string;
 };
 
 export type GetBotInstanceResponse = {
   bot_instance?: {
     spec?: {
       instance_id?: string;
+      bot_name?: string;
     } | null;
+    status?: {
+      latest_heartbeats?:
+        | {
+            uptime?: {
+              seconds?: number;
+            } | null;
+            version?: string;
+            os?: string;
+            hostname?: string;
+            kind?: BotInstanceKind;
+          }[]
+        | null;
+      latest_authentications?:
+        | {
+            join_attrs?: GetBotInstanceResponseJoinAttrs | null;
+          }[]
+        | null;
+      service_health?:
+        | {
+            service?: {
+              type?: string;
+              name?: string;
+            } | null;
+            status?: BotInstanceServiceHealthStatus;
+            reason?: string;
+            updated_at?: { seconds: number } | null;
+          }[]
+        | null;
+    };
   } | null;
   yaml?: string;
 };
 
+export enum BotInstanceServiceHealthStatus {
+  BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED = 0,
+  BOT_INSTANCE_HEALTH_STATUS_INITIALIZING = 1,
+  BOT_INSTANCE_HEALTH_STATUS_HEALTHY = 2,
+  BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY = 3,
+}
+
+export enum BotInstanceKind {
+  BOT_KIND_UNSPECIFIED = 0,
+  BOT_KIND_TBOT = 1,
+  BOT_KIND_TERRAFORM_PROVIDER = 2,
+  BOT_KIND_KUBERNETES_OPERATOR = 3,
+  BOT_KIND_TCTL = 4,
+}
+
+export type GetBotInstanceResponseJoinAttrs = {
+  meta?: {
+    join_token_name?: string;
+    join_method?: string;
+  } | null;
+  gitlab?: {
+    sub?: string;
+    project_path?: string;
+  } | null;
+  github?: {
+    sub?: string;
+    repository?: string;
+  } | null;
+  iam?: {
+    account?: string;
+    arn?: string;
+  } | null;
+  tpm?: {
+    ek_pub_hash?: string;
+  } | null;
+  azure?: {
+    subscription?: string;
+    resource_group?: string;
+  } | null;
+  circleci?: {
+    sub?: string;
+    project_id?: string;
+  } | null;
+  bitbucket?: {
+    sub?: string;
+    repository_uuid?: string;
+  } | null;
+  terraform_cloud?: {
+    sub?: string;
+    full_workspace?: string;
+  } | null;
+  spacelift?: {
+    sub?: string;
+    space_id?: string;
+  } | null;
+  gcp?: {
+    service_account?: string;
+  } | null;
+  kubernetes?: {
+    subject?: string;
+  } | null;
+  oracle?: {
+    tenancy_id?: string;
+    compartment_id?: string;
+  } | null;
+  azure_devops?: {
+    pipeline?: {
+      sub?: string;
+      repository_id?: string;
+    } | null;
+  } | null;
+};
+
+export type GetBotInstanceMetricsResponse = {
+  upgrade_statuses?: {
+    unsupported?: BotInstanceMetric | null;
+    patch_available?: BotInstanceMetric | null;
+    requires_upgrade?: BotInstanceMetric | null;
+    up_to_date?: BotInstanceMetric | null;
+    updated_at?: string;
+  } | null;
+  refresh_after_seconds: number;
+};
+
+type BotInstanceMetric = {
+  count?: number;
+  filter?: string;
+};
+
 export type BotList = {
   bots: FlatBot[];
 };
@@ -120,5 +245,11 @@ export enum BotUiFlow {
 }
 export type EditBotRequest = {
   // roles is the list of roles to assign to the bot
-  roles: string[];
+  roles?: string[] | null;
+  // traits is the list of traits to assign to the bot
+  traits?: ApiBotTrait[] | null;
+  // max_session_ttl is the maximum session TTL
+  max_session_ttl?: string | null;
+  // description is the bot's metadata description
+  description?: string | null;
 };
diff --git a/web/packages/teleport/src/services/databases/databases.test.ts b/web/packages/teleport/src/services/databases/databases.test.ts
index bb11e6d97f353..9f44fb5482aca 100644
--- a/web/packages/teleport/src/services/databases/databases.test.ts
+++ b/web/packages/teleport/src/services/databases/databases.test.ts
@@ -95,29 +95,30 @@ test('null response from database fetch', async () => {
 
 describe('correct formatting of all type and protocol combos', () => {
   test.each`
-    type                     | protocol                 | combined
-    ${'self-hosted'}         | ${'mysql'}               | ${'Self-hosted MySQL/MariaDB'}
-    ${'rds'}                 | ${'mysql'}               | ${'Amazon RDS MySQL/MariaDB'}
-    ${'self-hosted'}         | ${'postgres'}            | ${'Self-hosted PostgreSQL'}
-    ${'rds'}                 | ${'postgres'}            | ${'Amazon RDS PostgreSQL'}
-    ${'rdsproxy'}            | ${'sqlserver'}           | ${'Amazon RDS Proxy SQL Server'}
-    ${'gcp'}                 | ${'postgres'}            | ${'Cloud SQL PostgreSQL'}
-    ${'redshift'}            | ${'postgres'}            | ${'Amazon Redshift'}
-    ${'redshift-serverless'} | ${'postgres'}            | ${'Amazon Redshift Serverless'}
-    ${'dynamodb'}            | ${'dynamodb'}            | ${'Amazon DynamoDB'}
-    ${'elasticache'}         | ${'redis'}               | ${'Amazon ElastiCache'}
-    ${'memorydb'}            | ${'redis'}               | ${'Amazon MemoryDB'}
-    ${'opensearch'}          | ${'opensearch'}          | ${'Amazon OpenSearch'}
-    ${'keyspace'}            | ${'cassandra'}           | ${'Amazon Keyspaces'}
-    ${'self-hosted'}         | ${'sqlserver'}           | ${'Self-hosted SQL Server'}
-    ${'self-hosted'}         | ${'redis'}               | ${'Self-hosted Redis'}
-    ${'self-hosted'}         | ${'mongodb'}             | ${'Self-hosted MongoDB'}
-    ${'self-hosted'}         | ${'cassandra'}           | ${'Self-hosted Cassandra'}
-    ${'self-hosted'}         | ${'cockroachdb'}         | ${'Self-hosted CockroachDB'}
-    ${'self-hosted'}         | ${'oracle'}              | ${'Self-hosted Oracle'}
-    ${'self-hosted'}         | ${'snowflake'}           | ${'Snowflake'}
-    ${'self-hosted'}         | ${'elasticsearch'}       | ${'Self-hosted Elasticsearch'}
-    ${'some other type'}     | ${'some other protocol'} | ${'some other type some other protocol'}
+    type                        | protocol                 | combined
+    ${'self-hosted'}            | ${'mysql'}               | ${'Self-hosted MySQL/MariaDB'}
+    ${'rds'}                    | ${'mysql'}               | ${'Amazon RDS MySQL/MariaDB'}
+    ${'self-hosted'}            | ${'postgres'}            | ${'Self-hosted PostgreSQL'}
+    ${'rds'}                    | ${'postgres'}            | ${'Amazon RDS PostgreSQL'}
+    ${'rdsproxy'}               | ${'sqlserver'}           | ${'Amazon RDS Proxy SQL Server'}
+    ${'gcp'}                    | ${'postgres'}            | ${'Cloud SQL PostgreSQL'}
+    ${'redshift'}               | ${'postgres'}            | ${'Amazon Redshift'}
+    ${'redshift-serverless'}    | ${'postgres'}            | ${'Amazon Redshift Serverless'}
+    ${'dynamodb'}               | ${'dynamodb'}            | ${'Amazon DynamoDB'}
+    ${'elasticache'}            | ${'redis'}               | ${'Amazon ElastiCache'}
+    ${'elasticache-serverless'} | ${'redis'}               | ${'Amazon ElastiCache Serverless'}
+    ${'memorydb'}               | ${'redis'}               | ${'Amazon MemoryDB'}
+    ${'opensearch'}             | ${'opensearch'}          | ${'Amazon OpenSearch'}
+    ${'keyspace'}               | ${'cassandra'}           | ${'Amazon Keyspaces'}
+    ${'self-hosted'}            | ${'sqlserver'}           | ${'Self-hosted SQL Server'}
+    ${'self-hosted'}            | ${'redis'}               | ${'Self-hosted Redis'}
+    ${'self-hosted'}            | ${'mongodb'}             | ${'Self-hosted MongoDB'}
+    ${'self-hosted'}            | ${'cassandra'}           | ${'Self-hosted Cassandra'}
+    ${'self-hosted'}            | ${'cockroachdb'}         | ${'Self-hosted CockroachDB'}
+    ${'self-hosted'}            | ${'oracle'}              | ${'Self-hosted Oracle'}
+    ${'self-hosted'}            | ${'snowflake'}           | ${'Snowflake'}
+    ${'self-hosted'}            | ${'elasticsearch'}       | ${'Self-hosted Elasticsearch'}
+    ${'some other type'}        | ${'some other protocol'} | ${'some other type some other protocol'}
   `(
     'should combine type: $type and protocol: $protocol correctly',
     async ({ type, protocol, combined }) => {
diff --git a/web/packages/teleport/src/services/databases/makeDatabase.ts b/web/packages/teleport/src/services/databases/makeDatabase.ts
index 848405579a658..f88c792e46ccb 100644
--- a/web/packages/teleport/src/services/databases/makeDatabase.ts
+++ b/web/packages/teleport/src/services/databases/makeDatabase.ts
@@ -61,6 +61,7 @@ export function makeDatabase(json: any): Database {
     targetHealth: targetHealth && {
       status: targetHealth.status,
       error: targetHealth.transition_error,
+      message: targetHealth.message,
     },
   };
 }
@@ -109,6 +110,7 @@ export function makeDatabaseServer(json: any): DatabaseServer {
     targetHealth: status &&
       status.target_health && {
         status: status.target_health.status,
+        message: status.target_health.message,
         error: status.target_health.transition_error,
       },
   };
diff --git a/web/packages/teleport/src/services/integrations/integrations.test.ts b/web/packages/teleport/src/services/integrations/integrations.test.ts
index 959559080f7ec..c6202f1bca54b 100644
--- a/web/packages/teleport/src/services/integrations/integrations.test.ts
+++ b/web/packages/teleport/src/services/integrations/integrations.test.ts
@@ -17,7 +17,7 @@
  */
 
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { TaskState } from 'teleport/Integrations/status/AwsOidc/Tasks/constants';
 import api from 'teleport/services/api';
 
diff --git a/web/packages/teleport/src/services/integrations/integrations.ts b/web/packages/teleport/src/services/integrations/integrations.ts
index a33acb11b0331..0843d1436fdbd 100644
--- a/web/packages/teleport/src/services/integrations/integrations.ts
+++ b/web/packages/teleport/src/services/integrations/integrations.ts
@@ -17,7 +17,8 @@
  */
 
 import cfg from 'teleport/config';
-import { AwsResource } from 'teleport/Integrations/status/AwsOidc/StatCard';
+import { ProfilesFilterOption } from 'teleport/Integrations/Enroll/AwsConsole/Access/ProfilesFilter';
+import { AwsResource } from 'teleport/Integrations/status/AwsOidc/Cards/StatCard';
 import { TaskState } from 'teleport/Integrations/status/AwsOidc/Tasks/constants';
 import api from 'teleport/services/api';
 
@@ -38,6 +39,7 @@ import {
   AwsOidcPingRequest,
   AwsOidcPingResponse,
   AwsRdsDatabase,
+  AwsRolesAnywherePingResponse,
   CreateAwsAppAccessRequest,
   EnrollEksClustersRequest,
   EnrollEksClustersResponse,
@@ -61,8 +63,10 @@ import {
   ListAwsSubnetsResponse,
   ListEksClustersRequest,
   ListEksClustersResponse,
+  ListRolesAnywhereProfilesResponse,
   RdsEngineIdentifier,
   Regions,
+  RolesAnywhereProfile,
   SecurityGroup,
   SecurityGroupRule,
   Subnet,
@@ -103,6 +107,12 @@ export const integrationService = {
       .then(resp => makeIntegration(resp) as IntegrationCreateResult<T>);
   },
 
+  validateAWSRolesAnywhereIntegration<T>(integrationName: string): Promise<T> {
+    return api.post(
+      cfg.getValidateAWSRolesAnywhereIntegrationUrl(integrationName)
+    );
+  },
+
   pingAwsOidcIntegration(
     urlParams: {
       integrationName: string;
@@ -514,13 +524,13 @@ export const integrationService = {
           installer_script: resp.discoverEc2?.installer_script,
         },
         discoverEks: {
-          clusters: resp.discoverEks?.instances,
+          clusters: resp.discoverEks?.clusters,
           account_id: resp.discoverEks?.account_id,
           region: resp.discoverEks?.region,
           app_auto_discover: resp.discoverEks?.app_auto_discover,
         },
         discoverRds: {
-          databases: resp.discoverRds?.instances,
+          databases: resp.discoverRds?.databases,
           account_id: resp.discoverRds?.account_id,
           region: resp.discoverRds?.region,
         },
@@ -545,6 +555,56 @@ export const integrationService = {
         };
       });
   },
+
+  awsRolesAnywherePing({
+    integrationName,
+    trustAnchorArn,
+    syncRoleArn,
+    syncProfileArn,
+  }: {
+    integrationName: string;
+    trustAnchorArn: string;
+    syncRoleArn: string;
+    syncProfileArn: string;
+  }): Promise<AwsRolesAnywherePingResponse> {
+    return api
+      .post(cfg.getAwsRolesAnywherePingUrl(integrationName), {
+        trustAnchorArn,
+        syncRoleArn,
+        syncProfileArn,
+      })
+      .then(json => {
+        return {
+          profileCount: json?.profileCount,
+          accountId: json?.accountID,
+          arn: json?.arn,
+          userId: json?.userId,
+        };
+      });
+  },
+
+  awsRolesAnywhereProfiles(
+    variables: {
+      integrationName: string;
+      filters?: ProfilesFilterOption[];
+    },
+    signal?: AbortSignal
+  ): Promise<ListRolesAnywhereProfilesResponse> {
+    const { integrationName, filters } = variables;
+    const path = cfg.getAwsRolesAnywhereProfilesUrl(integrationName);
+
+    return api
+      .post(
+        path,
+        {
+          filters: filters?.length > 0 ? filters.map(f => f.value) : ['*'],
+        },
+        signal
+      )
+      .then(data => ({
+        profiles: data?.profiles?.map(profile => makeProfile(profile)) ?? [],
+      }));
+  },
 };
 
 function makeDatabaseServices(json: any): AWSOIDCDeployedDatabaseService[] {
@@ -566,7 +626,7 @@ export function makeIntegrations(json: any): Integration[] {
 
 function makeIntegration(json: any): Integration {
   json = json || {};
-  const { name, subKind, awsoidc, github } = json;
+  const { name, subKind, awsoidc, github, awsra } = json;
 
   const commonFields = {
     name,
@@ -594,6 +654,23 @@ function makeIntegration(json: any): Integration {
     };
   }
 
+  if (subKind === IntegrationKind.AwsRa) {
+    return {
+      ...commonFields,
+      resourceType: 'integration',
+      details: 'Sync AWS IAM Roles Anywhere Profiles with Teleport',
+      spec: {
+        trustAnchorARN: awsra?.trustAnchorARN,
+        profileSyncConfig: {
+          enabled: awsra.profileSyncConfig.enabled,
+          profileArn: awsra.profileSyncConfig.profileArn,
+          roleArn: awsra.profileSyncConfig.roleArn,
+          filters: awsra.profileSyncConfig.filters,
+        },
+      },
+    };
+  }
+
   if (subKind === IntegrationKind.GitHub) {
     return {
       ...commonFields,
@@ -669,3 +746,25 @@ function makeAwsSubnets(json: any): Subnet {
     availabilityZone: availability_zone,
   };
 }
+
+function makeProfile(json: any): RolesAnywhereProfile {
+  json = json ?? {};
+
+  const { arn, enabled, name, acceptRoleSessionName, tags, roles } = json;
+
+  let arr: string[] = [];
+  if (tags != undefined) {
+    new Map(Object.entries(tags)).forEach((v, k) => {
+      arr.push(`${k}:${v}`);
+    });
+  }
+
+  return {
+    arn,
+    enabled,
+    name,
+    acceptRoleSessionName,
+    tags: arr,
+    roles,
+  };
+}
diff --git a/web/packages/teleport/src/services/integrations/types.ts b/web/packages/teleport/src/services/integrations/types.ts
index 2fd420f634117..31ef698b01b1c 100644
--- a/web/packages/teleport/src/services/integrations/types.ts
+++ b/web/packages/teleport/src/services/integrations/types.ts
@@ -34,7 +34,8 @@ export type IntegrationUpdateResult<T extends IntegrationUpdateRequest> =
 export type Integration =
   | IntegrationGitHub
   | IntegrationAwsOidc
-  | IntegrationAzureOidc;
+  | IntegrationAzureOidc
+  | IntegrationAwsRa;
 
 /**
  * type Integration v. type Plugin:
@@ -70,12 +71,15 @@ export type IntegrationTemplate<
   details?: string;
   statusCode: IntegrationStatusCode;
   status?: SD;
+  credentials?: PluginCredentials;
 };
 // IntegrationKind string values should be in sync
 // with the backend value for defining the integration
 // resource's subKind field.
 export enum IntegrationKind {
   AwsOidc = 'aws-oidc',
+  /* AWS Roles Anywhere */
+  AwsRa = 'aws-ra',
   AzureOidc = 'azure-oidc',
   ExternalAuditStorage = 'external-audit-storage',
   GitHub = 'github',
@@ -107,6 +111,36 @@ export enum IntegrationAudience {
   AwsIdentityCenter = 'aws-identity-center',
 }
 
+/**
+ * RolesAnywhereProfileSync contains the summary for the AWS Roles Anywhere Profile Sync.
+ */
+export type RolesAnywhereProfileSync = {
+  /**
+   * enabled indicates whether the profile sync is enabled.
+   */
+  enabled: boolean;
+  /**
+   * status is the string representation of the profile sync status, either ERROR or SUCCESS.
+   */
+  status: string;
+  /**
+   * errorMessage is the error message from the last sync when the Status is ERROR.
+   */
+  errorMessage: string;
+  /**
+   * syncedProfiles is the number of profiles that were imported into Teleport.
+   */
+  syncedProfiles: number;
+  /**
+   * syncStartTime is the time when the profile sync started.
+   */
+  syncStartTime: number;
+  /**
+   * syncEndTime is the time when the profile/sync ended.
+   */
+  syncEndTime: number;
+};
+
 export type IntegrationSpecAwsOidc = {
   roleArn: string;
   issuerS3Prefix?: string;
@@ -118,12 +152,58 @@ export type IntegrationSpecAwsOidc = {
   audience?: IntegrationAudience;
 };
 
+// IntegrationSpecAwsRa contain the specific fields for the `aws-ra` subkind integration. [go struct ui.IntegrationAWSRASpec]
+export type IntegrationSpecAwsRa = {
+  trustAnchorARN: string; // ARN per API json tag
+  profileSyncConfig: AwsRolesAnywhereProfileSyncConfig;
+};
+/**
+ * AwsRolesAnywhereProfileSyncConfig contains the configuration for the AWS Roles Anywhere Profile sync.
+ * This is used to sync AWS Roles Anywhere profiles as application servers.
+ */
+type AwsRolesAnywhereProfileSyncConfig = {
+  /**
+   * Enabled is set to true if this integration should sync profiles as application servers.
+   */
+  enabled: boolean;
+  /**
+   * ProfileARN is the ARN of the Roles Anywhere Profile used to generate credentials to access the AWS APIs.
+   */
+  profileArn: string;
+  /**
+   * RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs.
+   */
+  roleArn: string;
+  /**
+   * ProfileNameFilters is a list of filters applied to the profile name.
+   * Only matching profiles will be synchronized as application servers.
+   * If empty, no filtering is applied.
+   *
+   * Filters can be globs, for example,
+   *
+   *	profile*
+   *	*name*
+   *
+   * Or regexes if they're prefixed and suffixed with ^ and $, for example:
+   *
+   *	^profile.*$
+   *	^.*name.*$
+   */
+  filters: string[];
+};
+
 export type IntegrationAwsOidc = IntegrationTemplate<
   'integration',
   IntegrationKind.AwsOidc,
   IntegrationSpecAwsOidc
 >;
 
+export type IntegrationAwsRa = IntegrationTemplate<
+  'integration',
+  IntegrationKind.AwsRa,
+  IntegrationSpecAwsRa
+>;
+
 export type AwsOidcPingRequest = {
   // Define roleArn if the ping request should
   // use this potentially new roleArn to test the
@@ -228,6 +308,26 @@ export type PluginStatus<D = any> = {
    * contains provider-specific status information
    */
   details?: D;
+  /**
+   * credentials contains information about the plugin's credentials,
+   * if applicable, only on creation.
+   */
+  credentials?: PluginCredentials;
+};
+
+export type PluginCredentials = {
+  OAuthCredentials?: PluginOAuthCredentials;
+};
+
+type PluginOAuthCredentials = {
+  /**
+   * clientId is the OAuth client ID
+   */
+  clientId: string;
+  /**
+   * clientSecret is the OAuth client secret
+   */
+  clientSecret: string;
 };
 
 /**
@@ -270,6 +370,7 @@ export type PluginKind =
   | 'okta'
   | 'servicenow'
   | 'jamf'
+  | 'intune'
   | 'entra-id'
   | 'datadog'
   | 'aws-identity-center'
@@ -374,9 +475,16 @@ type IntegrationCreateAwsOidcRequest = {
   awsoidc: IntegrationSpecAwsOidc;
 };
 
+type IntegrationCreateAwsRaRequest = {
+  name: string;
+  subKind: IntegrationKind.AwsRa;
+  awsRa: IntegrationSpecAwsRa;
+};
+
 export type IntegrationCreateRequest =
   | IntegrationCreateAwsOidcRequest
-  | IntegrationCreateGitHubRequest;
+  | IntegrationCreateGitHubRequest
+  | IntegrationCreateAwsRaRequest;
 
 export type IntegrationListResponse = {
   items: Integration[];
@@ -389,6 +497,8 @@ export type IntegrationWithSummary = {
   subKind: string;
   // unresolvedUserTasks contains the count of unresolved user tasks related to this integration.
   unresolvedUserTasks: number;
+  // awsra contains the fields for `aws-ra` subkind integration.
+  awsra: IntegrationSpecAwsRa;
   // awsoidc contains the fields for `aws-oidc` subkind integration.
   awsoidc: IntegrationSpecAwsOidc;
   // awsec2 contains the summary for the AWS EC2 resources for this integration.
@@ -397,6 +507,8 @@ export type IntegrationWithSummary = {
   awsrds: ResourceTypeSummary;
   // awseks contains the summary for the AWS EKS resources for this integration.
   awseks: ResourceTypeSummary;
+  // rolesAnywhereProfileSync contains the summary for the AWS Roles Anywhere Profile Sync.
+  rolesAnywhereProfileSync: RolesAnywhereProfileSync;
 };
 
 // IntegrationDiscoveryRules contains the list of discovery rules for a given Integration.
@@ -611,6 +723,70 @@ export type AWSOIDCDeployedDatabaseService = {
   matchingLabels: Label[];
 };
 
+/**
+ * AwsRolesAnywherePingResponse contains the result of the Ping request.
+ * This response contains meta information about the current state of the Integration.
+ */
+export type AwsRolesAnywherePingResponse = {
+  /**
+   * profileCount is the number of IAM Roles Anywhere Profiles that can be accessed by the Integration.
+   * Profiles that are disabled or don't have any IAM Role associated with them are not counted.
+   */
+  profileCount: number;
+  /**
+   * accountId number of the account that owns or contains the calling entity.
+   */
+  accountId: string;
+  /**
+   * arn associated with the calling entity.
+   */
+  arn: string;
+  /**
+   * userID is the unique identifier of the calling entity.
+   */
+  userId: string;
+};
+
+/**
+ * ListRolesAnywhereProfilesResponse contains the response for the ListRolesAnywhereProfiles operation.
+ */
+export type ListRolesAnywhereProfilesResponse = {
+  /**
+   * Profiles is a list of AWS Roles Anywhere Profiles.
+   */
+  profiles: RolesAnywhereProfile[];
+};
+
+/**
+ * RolesAnywhereProfile represents an AWS Roles Anywhere Profile.
+ */
+export type RolesAnywhereProfile = {
+  /**
+   * The AWS Roles Anywhere Profile ARN.
+   */
+  arn: string;
+  /**
+   * Whether the AWS Roles Anywhere Profile is enabled.
+   */
+  enabled: boolean;
+  /**
+   * The name of the AWS Roles Anywhere Profile.
+   */
+  name: string;
+  /**
+   * Whether the profile accepts role session names.
+   */
+  acceptRoleSessionName: boolean;
+  /**
+   * The tags associated with the AWS Roles Anywhere Profile.
+   */
+  tags: string[];
+  /**
+   * The roles accessible from this AWS Roles Anywhere Profile.
+   */
+  roles: string[];
+};
+
 // awsRegionMap maps the AWS regions to it's region name
 // as defined in (omitted gov cloud regions):
 // https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html
@@ -742,6 +918,11 @@ export type UpdateIntegrationAwsOidc = {
   };
 };
 
+export type UpdateIntegrationAwsRa = {
+  kind: IntegrationKind.AwsRa;
+  awsRa: IntegrationSpecAwsRa;
+};
+
 export type UpdateIntegrationGithub = {
   kind: IntegrationKind.GitHub;
   oauth: IntegrationOAuthCredentials;
@@ -750,6 +931,7 @@ export type UpdateIntegrationGithub = {
 
 export type IntegrationUpdateRequest =
   | UpdateIntegrationAwsOidc
+  | UpdateIntegrationAwsRa
   | UpdateIntegrationGithub;
 
 export type AwsOidcDeployServiceRequest = {
diff --git a/web/packages/teleport/src/services/joinToken/consts.ts b/web/packages/teleport/src/services/joinToken/consts.ts
new file mode 100644
index 0000000000000..3fe96cdc0e8f0
--- /dev/null
+++ b/web/packages/teleport/src/services/joinToken/consts.ts
@@ -0,0 +1,41 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ListJoinTokensResponse } from './types';
+
+export function validateListJoinTokensResponse(
+  data: unknown
+): data is ListJoinTokensResponse {
+  if (typeof data !== 'object' || data === null) {
+    return false;
+  }
+
+  if (!('items' in data)) {
+    return false;
+  }
+
+  if (!data.items) {
+    return true;
+  }
+
+  if (!Array.isArray(data.items)) {
+    return false;
+  }
+
+  return data.items.every(x => typeof x === 'object' || x !== null);
+}
diff --git a/web/packages/teleport/src/services/joinToken/joinToken.test.ts b/web/packages/teleport/src/services/joinToken/joinToken.test.ts
index 5a00fbc191864..de1667119de6c 100644
--- a/web/packages/teleport/src/services/joinToken/joinToken.test.ts
+++ b/web/packages/teleport/src/services/joinToken/joinToken.test.ts
@@ -41,7 +41,8 @@ test('fetchJoinToken with an empty request properly sets defaults', () => {
       suggested_agent_matcher_labels: {},
       suggested_labels: {},
     },
-    null
+    undefined,
+    undefined
   );
 });
 
@@ -65,6 +66,7 @@ test('fetchJoinToken request fields are set as requested', () => {
       suggested_agent_matcher_labels: { env: ['dev'] },
       suggested_labels: {},
     },
-    null
+    undefined,
+    undefined
   );
 });
diff --git a/web/packages/teleport/src/services/joinToken/joinToken.ts b/web/packages/teleport/src/services/joinToken/joinToken.ts
index a841553dd6117..80b88d372a773 100644
--- a/web/packages/teleport/src/services/joinToken/joinToken.ts
+++ b/web/packages/teleport/src/services/joinToken/joinToken.ts
@@ -20,6 +20,8 @@ import cfg from 'teleport/config';
 import api from 'teleport/services/api';
 
 import { makeLabelMapOfStrArrs } from '../agents/make';
+import auth from '../auth/auth';
+import { MfaChallengeResponse } from '../mfa';
 import { withUnsupportedLabelFeatureErrorConversion } from '../version/unsupported';
 import makeJoinToken from './makeJoinToken';
 import {
@@ -35,7 +37,8 @@ class JoinTokenService {
   // TODO (avatus) refactor this code to eventually use `createJoinToken`
   fetchJoinTokenV2(
     req: JoinTokenRequest,
-    signal: AbortSignal = null
+    signal?: AbortSignal,
+    mfaResponse?: MfaChallengeResponse
   ): Promise<JoinToken> {
     return (
       api
@@ -50,7 +53,8 @@ class JoinTokenService {
             ),
             suggested_labels: makeLabelMapOfStrArrs(req.suggestedLabels),
           },
-          signal
+          signal,
+          mfaResponse
         )
         .then(makeJoinToken)
         // TODO(kimlisa): DELETE IN 19.0
@@ -62,7 +66,8 @@ class JoinTokenService {
   // replaced by fetchJoinTokenV2 that accepts labels.
   fetchJoinToken(
     req: Omit<JoinTokenRequest, 'suggestedLabels'>,
-    signal: AbortSignal = null
+    signal?: AbortSignal,
+    mfaResponse?: MfaChallengeResponse
   ): Promise<JoinToken> {
     return api
       .post(
@@ -75,7 +80,8 @@ class JoinTokenService {
             req.suggestedAgentMatcherLabels
           ),
         },
-        signal
+        signal,
+        mfaResponse
       )
       .then(makeJoinToken);
   }
@@ -98,26 +104,53 @@ class JoinTokenService {
       .then(makeJoinToken);
   }
 
-  async createJoinToken(req: CreateJoinTokenRequest) {
-    return api.post(cfg.getJoinTokensUrl(), req).then(makeJoinToken);
+  async createJoinToken(
+    req: CreateJoinTokenRequest,
+    mfaResponse?: MfaChallengeResponse
+  ) {
+    return api
+      .post(
+        cfg.getJoinTokenUrl({ action: 'create' }),
+        req,
+        null /* abortSignal */,
+        mfaResponse
+      )
+      .then(makeJoinToken);
   }
 
-  async editJoinToken(req: CreateJoinTokenRequest) {
-    const json = await api.put(cfg.getJoinTokensUrl(), req);
+  async editJoinToken(
+    req: CreateJoinTokenRequest,
+    mfaResponse?: MfaChallengeResponse,
+    abortSignal?: AbortSignal
+  ) {
+    const json = await api.put(
+      cfg.getJoinTokenUrl({ action: 'update' }),
+      req,
+      abortSignal,
+      mfaResponse
+    );
     return makeJoinToken(json);
   }
 
-  fetchJoinTokens(signal: AbortSignal = null): Promise<{ items: JoinToken[] }> {
-    return api.get(cfg.getJoinTokensUrl(), signal).then(resp => {
-      return {
-        items: resp.items?.map(makeJoinToken) || [],
-      };
-    });
+  async fetchJoinTokens(signal?: AbortSignal) {
+    // Fetching all join tokens calls multiple RPCs internally, so we need a
+    // reusable mfa response.
+    const mfaResponse = await auth.getMfaChallengeResponseForAdminAction(
+      true /* allow re-use */
+    );
+
+    return api
+      .get(cfg.getJoinTokenUrl({ action: 'list' }), signal, mfaResponse)
+      .then(resp => {
+        return {
+          items: resp.items?.map(makeJoinToken) || [],
+        };
+      });
   }
 
-  deleteJoinToken(id: string, signal: AbortSignal = null) {
+  deleteJoinToken(id: string, signal?: AbortSignal) {
     return api.deleteWithHeaders(
-      cfg.getJoinTokensUrl(),
+      cfg.getJoinTokenUrl({ action: 'list' }),
       { [TeleportTokenNameHeader]: id },
       signal
     );
diff --git a/web/packages/teleport/src/services/joinToken/makeJoinToken.ts b/web/packages/teleport/src/services/joinToken/makeJoinToken.ts
index a4da7b2a47a62..d7032ed6ec3cf 100644
--- a/web/packages/teleport/src/services/joinToken/makeJoinToken.ts
+++ b/web/packages/teleport/src/services/joinToken/makeJoinToken.ts
@@ -28,9 +28,11 @@ export default function makeToken(json: any): JoinToken {
     id,
     roles,
     isStatic,
+    isCloudSystem,
     allow,
     gcp,
     github,
+    gitlab,
     bot_name,
     expiry,
     method,
@@ -44,12 +46,14 @@ export default function makeToken(json: any): JoinToken {
   return {
     id,
     isStatic,
+    isCloudSystem,
     safeName,
     bot_name,
     method,
     allow,
     gcp,
     github,
+    gitlab,
     roles: roles?.sort((a, b) => a.localeCompare(b)) || [],
     suggestedLabels: labels,
     internalResourceId: extractInternalResourceId(labels),
diff --git a/web/packages/teleport/src/services/joinToken/types.ts b/web/packages/teleport/src/services/joinToken/types.ts
index 3ddb86200f82c..514221b745131 100644
--- a/web/packages/teleport/src/services/joinToken/types.ts
+++ b/web/packages/teleport/src/services/joinToken/types.ts
@@ -27,6 +27,8 @@ export type JoinToken = {
   // bot_name is present on tokens with Bot in their join roles
   bot_name?: string;
   isStatic: boolean;
+  // the token is managed by the Teleport Cloud system and should not be edited by end users
+  isCloudSystem?: boolean;
   // the join method of the token
   method: string;
   // Roles are the roles granted to the token
@@ -51,6 +53,7 @@ export type JoinToken = {
     allow: OracleRules[];
   };
   github?: GithubConfig;
+  gitlab?: GitlabConfig;
 };
 
 // JoinRole defines built-in system roles and are roles associated with
@@ -117,32 +120,54 @@ export type OracleRules = {
 
 type GithubConfig = {
   /** enterprise_server_host allows joining from GitHub Actions workflows in a GitHub Enterprise Server instance. For normal situations, where you are using github.com, this option should be omitted. If you are using GHES, this value should be configured to the hostname of your GHES instance. */
-  enterprise_server_host: string | null;
+  enterprise_server_host?: string | null;
   /** static_jwks allows the JSON Web Key Set (JWKS) used to verify the token issued by GitHub Actions to be overridden. This can be used in scenarios where the Teleport Auth Service is unable to reach a GHES server. */
-  static_jwks: string | null;
+  static_jwks?: string | null;
   /** enterprise_slug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the include_enterprise_slug option in GHE. */
-  enterprise_slug: string | null;
+  enterprise_slug?: string | null;
   /** allow is an array of rule configurations for which GitHub Actions workflows should be allowed to join */
-  allow: GithubRules[];
+  allow?: GithubRule[] | null;
 };
 
-export type GithubRules = {
+export type GithubRule = {
   /** repository is a fully qualified (e.g. including the owner) name of a GitHub repository. */
-  repository: string | null;
+  repository?: string | null;
   /** repository_owner is the name of an organization or user that a repository belongs to. */
-  repository_owner: string | null;
+  repository_owner?: string | null;
   /** workflow is the exact name of a workflow as configured in the GitHub Action workflow YAML file. */
-  workflow: string | null;
+  workflow?: string | null;
   /** environment is the environment associated with the GitHub Actions run. If no environment is configured for the GitHub Actions run, this will be empty. */
-  environment: string | null;
+  environment?: string | null;
   /** actor is the GitHub username that caused the GitHub Actions run, whether by committing or by directly despatching the workflow. */
-  actor: string | null;
+  actor?: string | null;
   /** ref is the git ref that triggered the action run. */
-  ref: string | null;
+  ref?: string | null;
   /** ref_type is the type of the git ref that triggered the action run. */
-  ref_type: string | null;
+  ref_type?: string | null;
   /** sub is a concatenated string of various attributes of the workflow run. GitHub explains the format of this string at: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims */
-  sub: string | null;
+  sub?: string | null;
+};
+
+type GitlabConfig = {
+  /** domain should be the domain of your GitLab instance. If you are using GitLab's cloud hosted offering, omit this field entirely. */
+  domain?: string | null;
+  /** static_jwks allows the JSON Web Key Set (JWKS) used to verify the token issued by GitLab to be overridden. */
+  static_jwks?: string | null;
+  /** allow is an array of rule configurations for what GitLab CI jobs should be allowed to join. */
+  allow?: GitlabRule[] | null;
+};
+
+export type GitlabRule = {
+  /** project_path restricts joins to jobs that originate within the specified project. */
+  project_path?: string | null;
+  /** namespace_path restricts joins to any run within project that exists within the specified namespace. */
+  namespace_path?: string | null;
+  /** environment restricts joins to jobs that are associated with the specified environment */
+  environment?: string | null;
+  /** ref is the git ref that triggered the action run. */
+  ref?: string | null;
+  /** ref_type is the type of the git ref that triggered the action run. */
+  ref_type?: string | null;
 };
 
 export type JoinTokenRulesObject = AWSRules | GCPRules;
@@ -166,6 +191,7 @@ export type CreateJoinTokenRequest = {
     allow: OracleRules[];
   };
   github?: GithubConfig;
+  gitlab?: GitlabConfig;
 };
 
 export type JoinTokenRequest = {
@@ -193,3 +219,8 @@ export type JoinTokenRequest = {
    */
   suggestedLabels?: ResourceLabel[];
 };
+
+export type ListJoinTokensResponse = {
+  items?: JoinToken[] | null;
+  next_page_token?: string;
+};
diff --git a/web/packages/teleport/src/services/kube/kube.ts b/web/packages/teleport/src/services/kube/kube.ts
index 737a10ed3cb21..ce5300947365f 100644
--- a/web/packages/teleport/src/services/kube/kube.ts
+++ b/web/packages/teleport/src/services/kube/kube.ts
@@ -23,8 +23,9 @@ import cfg, {
 import { ResourcesResponse } from 'teleport/services/agents';
 import api from 'teleport/services/api';
 
-import { makeKube, makeKubeResource } from './makeKube';
-import { Kube, KubeResourceResponse } from './types';
+import { withGenericUnsupportedError } from '../version/unsupported';
+import { makeKube, makeKubeResource, makeKubeServer } from './makeKube';
+import { Kube, KubeResourceResponse, KubeServer } from './types';
 
 class KubeService {
   fetchKubernetes(
@@ -65,3 +66,28 @@ class KubeService {
 }
 
 export default KubeService;
+
+export function fetchKubeServers({
+  clusterId,
+  params,
+  signal,
+}: {
+  clusterId: string;
+  params: UrlResourcesParams;
+  signal?: AbortSignal;
+}): Promise<ResourcesResponse<KubeServer>> {
+  return (
+    api
+      .get(cfg.getKubernetesServerUrl(clusterId, params), signal)
+      .then(json => {
+        const items = json?.items || [];
+
+        return {
+          agents: items.map(makeKubeServer),
+          startKey: json?.startKey,
+        };
+      })
+      // TODO(rana): DELETE IN v20.0
+      .catch(err => withGenericUnsupportedError(err, 'v20.0.0'))
+  );
+}
diff --git a/web/packages/teleport/src/services/kube/makeKube.ts b/web/packages/teleport/src/services/kube/makeKube.ts
index 49c1957fe696d..d81a9677b7218 100644
--- a/web/packages/teleport/src/services/kube/makeKube.ts
+++ b/web/packages/teleport/src/services/kube/makeKube.ts
@@ -16,10 +16,10 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Kube, KubeResource } from './types';
+import { Kube, KubeResource, KubeServer } from './types';
 
 export function makeKube(json): Kube {
-  const { name, requiresRequest } = json;
+  const { name, requiresRequest, targetHealth } = json;
   const labels = json.labels || [];
 
   return {
@@ -29,6 +29,11 @@ export function makeKube(json): Kube {
     users: json.kubernetes_users || [],
     groups: json.kubernetes_groups || [],
     requiresRequest,
+    targetHealth: targetHealth && {
+      status: targetHealth.status,
+      error: targetHealth.transition_error,
+      message: targetHealth.message,
+    },
   };
 }
 
@@ -44,3 +49,18 @@ export function makeKubeResource(json): KubeResource {
     cluster,
   };
 }
+
+export function makeKubeServer(json: any): KubeServer {
+  const { spec, status } = json;
+
+  return {
+    hostname: spec?.hostname,
+    hostId: spec?.host_id,
+    targetHealth: status &&
+      status.target_health && {
+        status: status.target_health.status,
+        message: status.target_health.message,
+        error: status.target_health.transition_error,
+      },
+  };
+}
diff --git a/web/packages/teleport/src/services/kube/types.ts b/web/packages/teleport/src/services/kube/types.ts
index db922c38f6127..198a787e66db0 100644
--- a/web/packages/teleport/src/services/kube/types.ts
+++ b/web/packages/teleport/src/services/kube/types.ts
@@ -16,6 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { ResourceTargetHealth } from 'shared/components/UnifiedResources';
+
 import { ResourceLabel } from 'teleport/services/agents';
 
 export interface Kube {
@@ -25,6 +27,18 @@ export interface Kube {
   users?: string[];
   groups?: string[];
   requiresRequest?: boolean;
+  /**
+   * targetHealth describes the health status of a Kubernetes cluster
+   * reported from an agent (kubernetes_service) that is proxying this
+   * Kubernetes cluster.
+   *
+   * This field will be empty if the Kubernetes cluster was not extracted from
+   * a kube_server resource. The following endpoints will set this field
+   * since these endpoints query for kube_server under the hood and then
+   * extract kube from it:
+   * - webapi/sites/:site/resources (unified resources)
+   */
+  targetHealth?: ResourceTargetHealth;
 }
 
 /**
@@ -58,3 +72,9 @@ export interface KubeResourceResponse {
   startKey?: string;
   totalCount?: number;
 }
+
+export type KubeServer = {
+  hostname: string;
+  hostId: string;
+  targetHealth?: ResourceTargetHealth;
+};
diff --git a/web/packages/teleport/src/services/locks/locks.ts b/web/packages/teleport/src/services/locks/locks.ts
index 4dda74a631a4b..d739ec953d76b 100644
--- a/web/packages/teleport/src/services/locks/locks.ts
+++ b/web/packages/teleport/src/services/locks/locks.ts
@@ -16,32 +16,101 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { MutationFunction } from '@tanstack/react-query';
+
 import cfg from 'teleport/config';
 import api from 'teleport/services/api';
 
-import { CreateLockRequest, Lock } from './types';
+import { withGenericUnsupportedError } from '../version/unsupported';
+import { ApiLock, CreateLockRequest, Lock, LockKind } from './types';
 
 export const lockService = {
-  fetchLocks(): Promise<Lock[]> {
-    return api.get(cfg.getLocksUrl()).then(makeLocks);
+  async fetchLocks() {
+    return api.get(cfg.getLockUrl({ action: 'list-v2' })).then(makeLocks);
   },
 
-  createLock(req: CreateLockRequest): Promise<Lock> {
-    return api.put(cfg.getLocksUrl(), req).then(makeLock);
+  async createLock(req: CreateLockRequest) {
+    return api.put(cfg.getLockUrl({ action: 'create' }), req).then(makeLock);
   },
 
-  deleteLock(id: string): Promise<void> {
-    return api.delete(cfg.getLocksUrlWithUuid(id));
+  async deleteLock(id: string) {
+    return api.delete(cfg.getLockUrl({ action: 'delete', uuid: id }));
   },
 };
 
-export function makeLocks(json: any): Lock[] {
-  json = json || [];
-  return json.map(makeLock);
+export async function listLocks(
+  variables: {
+    inForceOnly?: boolean;
+    targets?: { kind: string; name: string }[];
+  },
+  signal?: AbortSignal
+): Promise<readonly Lock[]> {
+  const path = cfg.getLockUrl({ action: 'list-v2' });
+
+  const qs = new URLSearchParams();
+  if (variables.targets) {
+    for (const target of variables.targets) {
+      qs.append('target', `${target.kind}|${target.name}`);
+    }
+  }
+
+  if (variables.inForceOnly !== undefined) {
+    qs.set('in_force_only', variables.inForceOnly ? 'true' : 'false');
+  }
+
+  try {
+    const json = await api.get(`${path}?${qs.toString()}`, signal);
+    return makeLocks(json);
+  } catch (err) {
+    // TODO(nicholasmarais1158) DELETE IN v20.0.0
+    withGenericUnsupportedError(err, '19.0.0');
+  }
+}
+
+export const createLockMutationFn: MutationFunction<
+  Lock,
+  CreateLockRequest
+> = vars => {
+  return createLock(vars);
+};
+
+export async function createLock(
+  variables: CreateLockRequest,
+  signal?: AbortSignal
+) {
+  const json = await api.put(
+    cfg.getLockUrl({ action: 'create' }),
+    variables,
+    signal
+  );
+  return makeLock(json);
+}
+
+export const deleteLockMutationFn: MutationFunction<
+  unknown,
+  { uuid: string }
+> = vars => {
+  return deleteLock(vars);
+};
+
+export async function deleteLock(
+  variables: { uuid: string },
+  signal?: AbortSignal
+) {
+  return api.deleteWithOptions(
+    cfg.getLockUrl({ action: 'delete', uuid: variables.uuid }),
+    {
+      signal,
+    }
+  );
+}
+
+export function makeLocks(json: { items: ApiLock[] }): Lock[] {
+  const { items = [] } = json ?? {};
+  return items.map(makeLock);
 }
 
-function makeLock(json: any): Lock {
-  json = json || {};
+function makeLock(json: ApiLock): Lock {
   const {
     name,
     message,
@@ -51,10 +120,10 @@ function makeLock(json: any): Lock {
     targets: targetLookup,
   } = json;
 
-  let targets = [];
-  if (targets) {
-    targets = Object.entries(targetLookup).map(([key, value]) => ({
-      kind: key,
+  let targets: Lock['targets'] = [];
+  if (targetLookup) {
+    targets = Object.entries<string>(targetLookup).map(([key, value]) => ({
+      kind: key as LockKind,
       name: value,
     }));
   }
diff --git a/web/packages/teleport/src/services/locks/types.ts b/web/packages/teleport/src/services/locks/types.ts
index 2a409765c47b9..d644b6d574d28 100644
--- a/web/packages/teleport/src/services/locks/types.ts
+++ b/web/packages/teleport/src/services/locks/types.ts
@@ -48,3 +48,21 @@ export type CreateLockRequest = {
   message: string;
   ttl: string;
 };
+
+export type ApiLock = {
+  name: string;
+  message?: string;
+  expires?: string;
+  createdAt?: string;
+  createdBy?: string;
+  targets: Partial<{
+    user: string;
+    role: string;
+    login: string;
+    node: string;
+    mfa_device: string;
+    windows_desktop: string;
+    device: string;
+    access_request: string;
+  }>;
+};
diff --git a/web/packages/teleport/src/services/queryHelpers.ts b/web/packages/teleport/src/services/queryHelpers.ts
index 86a175fe1c915..ec359b1f1a8c3 100644
--- a/web/packages/teleport/src/services/queryHelpers.ts
+++ b/web/packages/teleport/src/services/queryHelpers.ts
@@ -20,9 +20,16 @@ import * as reactQuery from '@tanstack/react-query';
 import {
   type DataTag,
   type DefaultError,
+  type InfiniteData,
   type QueryFunction,
+  type UseInfiniteQueryOptions,
+  type UseInfiniteQueryResult,
   type UseQueryOptions,
   type UseQueryResult,
+  type UseSuspenseInfiniteQueryOptions,
+  type UseSuspenseInfiniteQueryResult,
+  type UseSuspenseQueryOptions,
+  type UseSuspenseQueryResult,
 } from '@tanstack/react-query';
 
 export type QueryHook<
@@ -34,10 +41,58 @@ export type QueryHook<
   options?: Omit<UseQueryOptions<TData, TError>, 'queryKey' | 'queryFn'>
 ) => UseQueryResult<TData, TError>;
 
+export type SuspenseQueryHook<
+  TData = unknown,
+  TVariables = void,
+  TError = DefaultError,
+> = (
+  variables?: TVariables,
+  options?: Omit<UseSuspenseQueryOptions<TData, TError>, 'queryKey' | 'queryFn'>
+) => UseSuspenseQueryResult<TData, TError>;
+
+export type InfiniteQueryHook<
+  TData = unknown,
+  TVariables = void,
+  TError = DefaultError,
+  TPageParam = string,
+> = (
+  variables: TVariables,
+  options: Omit<
+    UseInfiniteQueryOptions<
+      TData,
+      TError,
+      InfiniteData<TData, TPageParam>,
+      DataTag<string[], TData, TError>,
+      TPageParam
+    >,
+    'queryKey' | 'queryFn'
+  >
+) => UseInfiniteQueryResult<InfiniteData<TData, TPageParam>, TError>;
+
+export type SuspenseInfiniteQueryHook<
+  TData = unknown,
+  TVariables = void,
+  TError = DefaultError,
+  TPageParam = string,
+> = (
+  variables: TVariables,
+  options: Omit<
+    UseSuspenseInfiniteQueryOptions<
+      TData,
+      TError,
+      InfiniteData<TData, TPageParam>,
+      DataTag<string[], TData, TError>,
+      TPageParam
+    >,
+    'queryKey' | 'queryFn'
+  >
+) => UseSuspenseInfiniteQueryResult<InfiniteData<TData, TPageParam>, TError>;
+
 export interface WrappedQuery<
   TData = unknown,
   TVariables = void,
   TError = DefaultError,
+  TPageParam = string,
 > {
   createQueryKey: (variables?: TVariables) => DataTag<string[], TData, TError>;
   queryKey: DataTag<string[], TData, TError>;
@@ -47,6 +102,14 @@ export interface WrappedQuery<
     queryKey: DataTag<string[], TData, TError>;
     queryFn: QueryFunction<TData>;
   };
+  useSuspenseQuery: SuspenseQueryHook<TData, TVariables, TError>;
+  useInfiniteQuery: InfiniteQueryHook<TData, TVariables, TError, TPageParam>;
+  useSuspenseInfiniteQuery: SuspenseInfiniteQueryHook<
+    TData,
+    TVariables,
+    TError,
+    TPageParam
+  >;
 }
 
 type SignalOnlyQueryFn<TData> = (signal: AbortSignal) => Promise<TData>;
@@ -223,11 +286,16 @@ export function createQueryHook<
   TData = unknown,
   TVariables = void,
   TError = DefaultError,
+  TPageParam = string,
 >(
   queryKey: string[],
-  queryFn: QueryFn<TData, TVariables>
-): WrappedQuery<TData, TVariables, TError> {
-  const wrapped: WrappedQuery<TData, TVariables, TError> = {
+  queryFn: QueryFn<TData, TVariables>,
+  addPageParamToVariables?: (
+    pageParam: TPageParam,
+    variables: TVariables
+  ) => TVariables
+): WrappedQuery<TData, TVariables, TError, TPageParam> {
+  const wrapped: WrappedQuery<TData, TVariables, TError, TPageParam> = {
     queryKey: queryKey as DataTag<string[], TData, TError>,
     createQueryKey(variables?: TVariables) {
       const key = [...queryKey];
@@ -252,17 +320,84 @@ export function createQueryHook<
       variables?: TVariables,
       options?: Omit<UseQueryOptions<TData, TError>, 'queryKey' | 'queryFn'>
     ) {
-      const key = [...queryKey];
-
-      if (variables) {
-        key.push(JSON.stringify(variables));
-      }
-
       return reactQuery.useQuery({
         ...wrapped.createQuery(variables),
         ...options,
       });
     },
+    useSuspenseQuery: function wrappedSuspenseQuery(
+      variables?: TVariables,
+      options?: Omit<UseQueryOptions<TData, TError>, 'queryKey' | 'queryFn'>
+    ) {
+      return reactQuery.useSuspenseQuery({
+        ...wrapped.createQuery(variables),
+        ...options,
+      });
+    },
+    useInfiniteQuery: function wrappedInfiniteQuery(
+      variables: TVariables,
+      options: Omit<
+        UseInfiniteQueryOptions<
+          TData,
+          TError,
+          InfiniteData<TData, TPageParam>,
+          DataTag<string[], TData, TError>,
+          TPageParam
+        >,
+        'queryKey' | 'queryFn'
+      >
+    ) {
+      return reactQuery.useInfiniteQuery<
+        TData,
+        TError,
+        InfiniteData<TData, TPageParam>,
+        DataTag<string[], TData, TError>,
+        TPageParam
+      >({
+        ...options,
+        queryKey: wrapped.createQueryKey(variables),
+        queryFn: ({ pageParam, signal }) =>
+          callQueryFn(
+            queryFn,
+            addPageParamToVariables
+              ? addPageParamToVariables(pageParam as TPageParam, variables)
+              : variables,
+            signal
+          ),
+      });
+    },
+    useSuspenseInfiniteQuery: function wrappedSuspenseInfiniteQuery(
+      variables: TVariables,
+      options: Omit<
+        UseSuspenseInfiniteQueryOptions<
+          TData,
+          TError,
+          InfiniteData<TData, TPageParam>,
+          DataTag<string[], TData, TError>,
+          TPageParam
+        >,
+        'queryKey' | 'queryFn'
+      >
+    ) {
+      return reactQuery.useSuspenseInfiniteQuery<
+        TData,
+        TError,
+        InfiniteData<TData, TPageParam>,
+        DataTag<string[], TData, TError>,
+        TPageParam
+      >({
+        ...options,
+        queryKey: wrapped.createQueryKey(variables),
+        queryFn: ({ pageParam, signal }) =>
+          callQueryFn(
+            queryFn,
+            addPageParamToVariables
+              ? addPageParamToVariables(pageParam as TPageParam, variables)
+              : variables,
+            signal
+          ),
+      });
+    },
   };
 
   return wrapped;
diff --git a/web/packages/teleport/src/services/recordings/hooks.ts b/web/packages/teleport/src/services/recordings/hooks.ts
new file mode 100644
index 0000000000000..370acd4f432e4
--- /dev/null
+++ b/web/packages/teleport/src/services/recordings/hooks.ts
@@ -0,0 +1,45 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { createQueryHook } from 'teleport/services/queryHelpers';
+
+import { fetchSessionRecordingMetadata } from './metadata';
+import {
+  fetchRecordings,
+  fetchRecordingThumbnail,
+  fetchSessionRecordingDuration,
+} from './recordings';
+
+export const { useSuspenseInfiniteQuery: useSuspenseInfiniteListRecordings } =
+  createQueryHook(
+    ['recordings', 'list'],
+    fetchRecordings,
+    (startKey, variables) => ({
+      ...variables,
+      params: { ...variables.params, startKey },
+    })
+  );
+
+export const { useSuspenseQuery: useSuspenseGetRecordingMetadata } =
+  createQueryHook(['recording', 'metadata'], fetchSessionRecordingMetadata);
+
+export const { useSuspenseQuery: useSuspenseGetRecordingThumbnail } =
+  createQueryHook(['recording', 'thumbnail'], fetchRecordingThumbnail);
+
+export const { useSuspenseQuery: useSuspenseGetRecordingDuration } =
+  createQueryHook(['recording', 'duration'], fetchSessionRecordingDuration);
diff --git a/web/packages/teleport/src/services/recordings/makeRecording.ts b/web/packages/teleport/src/services/recordings/makeRecording.ts
index 789d8bf3ee472..6c88a473c247c 100644
--- a/web/packages/teleport/src/services/recordings/makeRecording.ts
+++ b/web/packages/teleport/src/services/recordings/makeRecording.ts
@@ -29,11 +29,35 @@ export function makeRecording(event: any): Recording {
     return makeDesktopRecording(event);
   } else if (event.code === eventCodes.DATABASE_SESSION_ENDED) {
     return makeDatabaseRecording(event);
+  } else if (event.code === eventCodes.APP_SESSION_CHUNK) {
+    return makeAppRecording(event);
   } else {
     return makeSshOrKubeRecording(event);
   }
 }
 
+function makeAppRecording(event: {
+  time: string;
+  user: string;
+  session_chunk_id: string;
+  app_name: string;
+}): Recording {
+  const { time, user, session_chunk_id, app_name } = event;
+
+  return {
+    duration: 0,
+    durationText: '-',
+    sid: session_chunk_id,
+    createdDate: new Date(time),
+    users: user,
+    hostname: app_name,
+    description: `HTTP access to app ${app_name}`,
+    recordingType: 'app',
+    playable: false,
+    user,
+  } as Recording;
+}
+
 function makeDesktopRecording({
   time,
   session_start,
@@ -60,6 +84,7 @@ function makeDesktopRecording({
     description,
     recordingType: 'desktop',
     playable: recorded,
+    user,
   } as Recording;
 }
 
@@ -110,6 +135,7 @@ function makeSshOrKubeRecording({
     description,
     recordingType: kubernetes_cluster ? 'k8s' : 'ssh',
     playable,
+    user,
   } as Recording;
 }
 
@@ -161,6 +187,7 @@ function makeDatabaseRecording({
     description,
     recordingType: 'database',
     playable: description === 'play',
+    user,
   } as Recording;
 }
 
diff --git a/web/packages/teleport/src/services/recordings/metadata.ts b/web/packages/teleport/src/services/recordings/metadata.ts
new file mode 100644
index 0000000000000..180b9caa6da64
--- /dev/null
+++ b/web/packages/teleport/src/services/recordings/metadata.ts
@@ -0,0 +1,113 @@
+/**
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import cfg from 'teleport/config';
+import { AuthenticatedWebSocket } from 'teleport/lib/AuthenticatedWebSocket';
+import { getHostName } from 'teleport/services/api';
+
+import {
+  SessionRecordingMessageType,
+  type SessionRecordingMessage,
+  type SessionRecordingMetadata,
+  type SessionRecordingThumbnail,
+} from './types';
+
+export interface SessionRecordingMetadataWithFrames {
+  metadata: SessionRecordingMetadata;
+  frames: SessionRecordingThumbnail[];
+}
+
+interface FetchSessionRecordingMetadataVariables {
+  clusterId: string;
+  sessionId: string;
+}
+
+// fetchSessionRecordingMetadata fetches metadata and thumbnails for a session recording
+// using a WebSocket connection, to avoid gRPC maximum message size limits.
+// It returns a promise that resolves with the metadata and an array of thumbnails.
+export function fetchSessionRecordingMetadata(
+  { clusterId, sessionId }: FetchSessionRecordingMetadataVariables,
+  signal?: AbortSignal
+) {
+  return new Promise<SessionRecordingMetadataWithFrames>((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new DOMException('Aborted', 'AbortError'));
+      return;
+    }
+
+    const ws = new AuthenticatedWebSocket(
+      cfg.getSessionRecordingMetadataUrl(clusterId, sessionId, getHostName())
+    );
+
+    let metadata: SessionRecordingMetadata | null = null;
+
+    const frames: SessionRecordingThumbnail[] = [];
+
+    function handleAbort() {
+      ws.close();
+      reject(new DOMException('Aborted', 'AbortError'));
+    }
+
+    signal?.addEventListener('abort', handleAbort);
+
+    ws.onmessage = event => {
+      const decoded = JSON.parse(event.data) as SessionRecordingMessage;
+
+      switch (decoded.type) {
+        case SessionRecordingMessageType.Thumbnail:
+          frames.push(decoded.data);
+
+          break;
+
+        case SessionRecordingMessageType.Metadata:
+          metadata = decoded.data;
+
+          break;
+
+        case SessionRecordingMessageType.Error:
+          signal?.removeEventListener('abort', handleAbort);
+          reject(new Error(decoded.data.message));
+
+          return;
+      }
+    };
+
+    ws.onerror = () => {
+      signal?.removeEventListener('abort', handleAbort);
+      reject(new Error('WebSocket connection failed'));
+    };
+
+    ws.onclose = () => {
+      signal?.removeEventListener('abort', handleAbort);
+
+      if (signal?.aborted) {
+        return;
+      }
+
+      if (!metadata) {
+        reject(new Error('No metadata received'));
+        return;
+      }
+
+      resolve({
+        metadata,
+        frames,
+      });
+    };
+  });
+}
diff --git a/web/packages/teleport/src/services/recordings/recordings.test.ts b/web/packages/teleport/src/services/recordings/recordings.test.ts
index 507828e3a9490..a45e0133ff8f5 100644
--- a/web/packages/teleport/src/services/recordings/recordings.test.ts
+++ b/web/packages/teleport/src/services/recordings/recordings.test.ts
@@ -40,6 +40,7 @@ test('fetch session recordings, response formatting', async () => {
         playable: true,
         recordingType: 'ssh',
         sid: 'c21c6c34-c282-51ae-9e29-4e642d8c70ae',
+        user: 'fuwa@obiki.ve',
         users: 'fuwa@obiki.ve, ha@fokveh.mc',
       },
       {
@@ -51,6 +52,7 @@ test('fetch session recordings, response formatting', async () => {
         playable: false,
         recordingType: 'k8s',
         sid: '456b933c-4ec4-59f1-862c-90ca9f7648b1',
+        user: 'onuweeme@wiuke.mh',
         users: 'onuweeme@wiuke.mh',
       },
     ],
diff --git a/web/packages/teleport/src/services/recordings/recordings.ts b/web/packages/teleport/src/services/recordings/recordings.ts
index ff4779c334dd3..6461d2adbdf1d 100644
--- a/web/packages/teleport/src/services/recordings/recordings.ts
+++ b/web/packages/teleport/src/services/recordings/recordings.ts
@@ -20,36 +20,115 @@ import cfg from 'teleport/config';
 import api from 'teleport/services/api';
 
 import { makeRecording } from './makeRecording';
-import { RecordingsQuery, RecordingsResponse } from './types';
+import type {
+  RecordingsQuery,
+  RecordingsResponse,
+  RecordingType,
+  SessionRecordingThumbnail,
+} from './types';
 
-export default class RecordingsService {
-  maxFetchLimit = 5000;
+const maxFetchLimit = 5000;
 
+export default class RecordingsService {
+  /**
+   * @deprecated Use standalone `fetchRecordings` function defined below this class instead.
+   */
   fetchRecordings(
     clusterId: string,
     params: RecordingsQuery
   ): Promise<RecordingsResponse> {
-    const start = params.from.toISOString();
-    const end = params.to.toISOString();
-
-    const url = cfg.getClusterEventsRecordingsUrl(clusterId, {
-      start,
-      end,
-      limit: this.maxFetchLimit,
-      startKey: params.startKey || undefined,
-    });
-
-    return api.get(url).then(json => {
-      const events = json.events || [];
-
-      return { recordings: events.map(makeRecording), startKey: json.startKey };
-    });
+    return fetchRecordings({ clusterId, params });
   }
 
+  /**
+   * @deprecated Use `fetchSessionRecordingDuration` instead.
+   */
   fetchRecordingDuration(
     clusterId: string,
     sessionId: string
-  ): Promise<{ durationMs: number }> {
-    return api.get(cfg.getSessionDurationUrl(clusterId, sessionId));
+  ): Promise<{ durationMs: number; recordingType: string }> {
+    return fetchSessionRecordingDuration({
+      clusterId,
+      sessionId,
+    });
   }
 }
+
+interface FetchSessionRecordingDurationVariables {
+  clusterId: string;
+  sessionId: string;
+}
+
+interface FetchSessionRecordingDurationResponse {
+  durationMs: number;
+  recordingType: RecordingType;
+}
+
+export async function fetchSessionRecordingDuration({
+  clusterId,
+  sessionId,
+}: FetchSessionRecordingDurationVariables): Promise<FetchSessionRecordingDurationResponse> {
+  const url = cfg.getSessionDurationUrl(clusterId, sessionId);
+  const response = await api.get(url);
+
+  if (!response) {
+    throw new Error('Failed to fetch session recording duration');
+  }
+
+  return response;
+}
+
+interface FetchRecordingsVariables {
+  clusterId: string;
+  params: RecordingsQuery;
+}
+
+export async function fetchRecordings(
+  { clusterId, params }: FetchRecordingsVariables,
+  signal?: AbortSignal
+): Promise<RecordingsResponse> {
+  const start = params.from.toISOString();
+  const end = params.to.toISOString();
+
+  const url = cfg.getClusterEventsRecordingsUrl(clusterId, {
+    start,
+    end,
+    limit: maxFetchLimit,
+    startKey: params.startKey || undefined,
+  });
+
+  const json = await api.get(url, signal);
+
+  const events = json.events || [];
+
+  return { recordings: events.map(makeRecording), startKey: json.startKey };
+}
+
+interface FetchRecordingThumbnailVariables {
+  clusterId: string;
+  sessionId: string;
+}
+
+export async function fetchRecordingThumbnail(
+  { clusterId, sessionId }: FetchRecordingThumbnailVariables,
+  signal?: AbortSignal
+): Promise<SessionRecordingThumbnail> {
+  const url = cfg.getSessionRecordingThumbnailUrl(clusterId, sessionId);
+  const response = await api.get(url, signal);
+
+  if (!response) {
+    throw new Error('Failed to fetch recording thumbnail');
+  }
+
+  return response as SessionRecordingThumbnail;
+}
+
+export const RECORDING_TYPES_WITH_THUMBNAILS: RecordingType[] = ['ssh', 'k8s'];
+export const RECORDING_TYPES_WITH_METADATA: RecordingType[] = ['ssh', 'k8s'];
+
+export const VALID_RECORDING_TYPES: RecordingType[] = [
+  'ssh',
+  'k8s',
+  'desktop',
+  'database',
+];
diff --git a/web/packages/teleport/src/services/recordings/types.ts b/web/packages/teleport/src/services/recordings/types.ts
index 81ddf938da07a..526762a016dae 100644
--- a/web/packages/teleport/src/services/recordings/types.ts
+++ b/web/packages/teleport/src/services/recordings/types.ts
@@ -28,7 +28,19 @@ export type RecordingsResponse = {
   startKey: string;
 };
 
-export type RecordingType = 'ssh' | 'desktop' | 'k8s' | 'database';
+export type RecordingType = 'ssh' | 'desktop' | 'k8s' | 'database' | 'app';
+
+export function validateRecordingType(
+  value: RecordingType | string
+): value is RecordingType {
+  return (
+    value === 'ssh' ||
+    value === 'database' ||
+    value === 'desktop' ||
+    value === 'k8s' ||
+    value === 'app'
+  );
+}
 
 export type Recording = {
   duration: number;
@@ -40,4 +52,87 @@ export type Recording = {
   description: string;
   recordingType: RecordingType;
   playable: boolean;
+  user: string;
 };
+
+export enum SessionRecordingMessageType {
+  Thumbnail = 'thumbnail',
+  Metadata = 'metadata',
+  Error = 'error',
+}
+
+export enum SessionRecordingEventType {
+  Inactivity = 'inactivity',
+  Join = 'join',
+  Resize = 'resize',
+}
+
+export interface SessionRecordingThumbnail {
+  svg: string;
+  cols: number;
+  rows: number;
+  cursorX: number;
+  cursorY: number;
+  cursorVisible: boolean;
+  startOffset: number;
+  endOffset: number;
+}
+
+export interface SessionRecordingMetadata {
+  duration: number;
+  events: SessionRecordingEvent[];
+  startCols: number;
+  startRows: number;
+  startTime: number;
+  endTime: number;
+  clusterName: string;
+  user: string;
+  resourceName: string;
+  type: RecordingType;
+}
+
+export interface SessionRecordingError {
+  message: string;
+}
+
+// This is a wrapper type to match the structure of messages sent over the WebSocket.
+type WrappedMessage<TType extends SessionRecordingMessageType, TData> = {
+  type: TType;
+  data: TData;
+};
+
+export type SessionRecordingMessage =
+  | WrappedMessage<
+      SessionRecordingMessageType.Thumbnail,
+      SessionRecordingThumbnail
+    >
+  | WrappedMessage<
+      SessionRecordingMessageType.Metadata,
+      SessionRecordingMetadata
+    >
+  | WrappedMessage<SessionRecordingMessageType.Error, SessionRecordingError>;
+
+interface BaseSessionRecordingEvent {
+  startTime: number;
+  endTime: number;
+}
+
+interface SessionRecordingInactivityEvent extends BaseSessionRecordingEvent {
+  type: SessionRecordingEventType.Inactivity;
+}
+
+interface SessionRecordingJoinEvent extends BaseSessionRecordingEvent {
+  type: SessionRecordingEventType.Join;
+  user: string;
+}
+
+export interface SessionRecordingResizeEvent extends BaseSessionRecordingEvent {
+  type: SessionRecordingEventType.Resize;
+  cols: number;
+  rows: number;
+}
+
+export type SessionRecordingEvent =
+  | SessionRecordingJoinEvent
+  | SessionRecordingResizeEvent
+  | SessionRecordingInactivityEvent;
diff --git a/web/packages/teleport/src/services/resources/resource.ts b/web/packages/teleport/src/services/resources/resource.ts
index 48a1d7ef0812d..89a9c9480ca10 100644
--- a/web/packages/teleport/src/services/resources/resource.ts
+++ b/web/packages/teleport/src/services/resources/resource.ts
@@ -16,18 +16,29 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { AuthProvider } from 'shared/services';
+
 import cfg, { UrlListRolesParams, UrlResourcesParams } from 'teleport/config';
 import api from 'teleport/services/api';
 
 import { ResourcesResponse, UnifiedResource } from '../agents';
 import auth, { MfaChallengeScope } from '../auth/auth';
+import { MfaChallengeResponse } from '../mfa';
+import {
+  isPathNotFoundError,
+  withGenericUnsupportedError,
+} from '../version/unsupported';
+import { yamlService } from '../yaml';
+import { YamlSupportedResourceKind } from '../yaml/types';
 import {
   CreateOrOverwriteGitServer,
   DefaultAuthConnector,
   GitServer,
   makeResource,
   makeResourceList,
+  RequestableRole,
   Resource,
+  Role,
   RoleResource,
 } from './';
 import { makeUnifiedResource } from './makeUnifiedResource';
@@ -90,7 +101,10 @@ class ResourceService {
       }));
   }
 
-  async setDefaultAuthConnector(req: DefaultAuthConnector | { type: 'local' }) {
+  async setDefaultAuthConnector(
+    req: DefaultAuthConnector | { type: 'local' },
+    abortSignal?: AbortSignal
+  ) {
     // This is an admin action that needs an mfa challenge with reuse allowed.
     const challenge = await auth.getMfaChallenge({
       scope: MfaChallengeScope.ADMIN_ACTION,
@@ -102,14 +116,68 @@ class ResourceService {
 
     const challengeResponse = await auth.getMfaChallengeResponse(challenge);
 
-    return api.put(cfg.api.defaultConnectorPath, req, challengeResponse);
+    return api.put(
+      cfg.api.defaultConnectorPath,
+      req,
+      abortSignal,
+      challengeResponse
+    );
+  }
+
+  async getUserMatchedAuthConnectors(
+    username: string
+  ): Promise<AuthProvider[]> {
+    return api
+      .post(cfg.api.authConnectorsPath, { username })
+      .then(res => res.connectors || []);
   }
 
-  async fetchRoles(params?: UrlListRolesParams): Promise<{
+  async fetchRoles(
+    params?: Omit<UrlListRolesParams, 'includeSystemRoles' | 'includeObject'>,
+    signal?: AbortSignal
+  ): Promise<{
     items: RoleResource[];
     startKey: string;
   }> {
-    return await api.get(cfg.getListRolesUrl(params));
+    return await api.get(cfg.getRoleUrl({ action: 'list', params }), signal);
+  }
+
+  async fetchRolesV2(
+    params?: UrlListRolesParams,
+    signal?: AbortSignal
+  ): Promise<{
+    items: RoleResource[];
+    startKey: string;
+  }> {
+    try {
+      return await api.get(
+        cfg.getRoleUrl({ action: 'listv2', params }),
+        signal
+      );
+    } catch (err) {
+      withGenericUnsupportedError(err, '18.4.2');
+    }
+  }
+
+  async fetchRequestableRoles(
+    params: UrlListRolesParams,
+    // TODO(rudream): DELETE IN v21.0. This is here now to maintain backwards compatibility with an older auth version
+    // that may not have the requestable roles endpoint.
+    allRequestableRoles: string[]
+  ): Promise<{
+    items: RequestableRole[];
+    startKey: string;
+  }> {
+    return await api.get(cfg.getListRequestableRolesUrl(params)).catch(err => {
+      // If the endpoint isn't found due to it being in an older version than the client, fallback to using the full list of requestable roles
+      // to maintain compatibility with the paginated table component which expects a paginated response.
+      // TODO(rudream): DELETE IN v21.0
+      if (isPathNotFoundError(err)) {
+        return makeRequestableRolesPageLocally(params, allRequestableRoles);
+      } else {
+        throw err;
+      }
+    });
   }
 
   fetchPresetRoles() {
@@ -118,11 +186,16 @@ class ResourceService {
       .then(res => makeResourceList<'role'>(res));
   }
 
+  /**
+   * @deprecated use standalone fetchRole function defined below this class
+   */
   async fetchRole(name: string): Promise<RoleResource> {
     return makeResource<'role'>(
-      await api.get(cfg.getRoleUrl(name), undefined, undefined, {
-        allowRoleNotFound: true,
-      })
+      await api.get(
+        cfg.getRoleUrl({ action: 'get', name }),
+        undefined,
+        undefined
+      )
     );
   }
 
@@ -132,9 +205,14 @@ class ResourceService {
       .then(res => makeResource<'trusted_cluster'>(res));
   }
 
-  createRole(content: string) {
+  createRole(content: string, mfaResponse?: MfaChallengeResponse) {
     return api
-      .post(cfg.getRoleUrl(), { content })
+      .post(
+        cfg.api.role.create,
+        { content },
+        undefined /* abort signal */,
+        mfaResponse
+      )
       .then(res => makeResource<'role'>(res));
   }
 
@@ -150,9 +228,12 @@ class ResourceService {
       .then(res => makeResource<'trusted_cluster'>(res));
   }
 
+  /**
+   * @deprecated use standalone updateRole function defined below this class
+   */
   updateRole(name: string, content: string) {
     return api
-      .put(cfg.getRoleUrl(name), { content })
+      .put(cfg.getRoleUrl({ action: 'update', name }), { content })
       .then(res => makeResource<'role'>(res));
   }
 
@@ -173,7 +254,7 @@ class ResourceService {
   }
 
   deleteRole(name: string) {
-    return api.delete(cfg.getRoleUrl(name));
+    return api.delete(cfg.getRoleUrl({ action: 'delete', name }));
   }
 
   deleteGithubConnector(name: string) {
@@ -182,3 +263,79 @@ class ResourceService {
 }
 
 export default ResourceService;
+
+export async function fetchRole(
+  name: string,
+  signal?: AbortSignal
+): Promise<RoleResource> {
+  return makeResource<'role'>(
+    await api.get(cfg.getRoleUrl({ action: 'get', name }), signal, undefined)
+  );
+}
+
+export async function fetchRoleWithYamlParse(name: string): Promise<Role> {
+  const { content } = await fetchRole(name);
+  return yamlService.parse<Role>(YamlSupportedResourceKind.Role, {
+    yaml: content,
+  });
+}
+
+export async function updateRoleWithYamlConversion({
+  name,
+  role,
+}: {
+  name: string;
+  role: Role;
+}) {
+  const content = await yamlService.stringify(YamlSupportedResourceKind.Role, {
+    resource: role,
+  });
+  return updateRole({ name, content });
+}
+
+export async function updateRole({
+  name,
+  content,
+}: {
+  name: string;
+  content: string;
+}): Promise<RoleResource> {
+  return api
+    .put(cfg.getRoleUrl({ action: 'update', name }), { content })
+    .then(res => makeResource<'role'>(res));
+}
+
+/**
+ * makeRequestableRolesPageLocally mocks a paginated response for requestable roles so that a list of all requestable roles
+ * can be handled by the serverside paginated table component.
+ */
+// TODO(rudream): DELETE IN v21.0
+function makeRequestableRolesPageLocally(
+  params: UrlListRolesParams,
+  allRequestableRoles: string[]
+): {
+  items: RequestableRole[];
+  startKey: string;
+} {
+  if (params.search) {
+    allRequestableRoles = allRequestableRoles.filter(r =>
+      r.toLowerCase().includes(params.search.toLowerCase())
+    );
+  }
+
+  if (params.startKey) {
+    const startIndex = allRequestableRoles.findIndex(
+      r => r === params.startKey
+    );
+    allRequestableRoles = allRequestableRoles.slice(startIndex);
+  }
+
+  const limit = params.limit || 200;
+  const nextKey = allRequestableRoles.at(limit) || '';
+  allRequestableRoles = allRequestableRoles.slice(0, limit);
+
+  return {
+    items: allRequestableRoles.map(r => ({ name: r, description: '' })),
+    startKey: nextKey,
+  };
+}
diff --git a/web/packages/teleport/src/services/resources/types.ts b/web/packages/teleport/src/services/resources/types.ts
index 0546ee0f4ea11..d48fd1c88d0b2 100644
--- a/web/packages/teleport/src/services/resources/types.ts
+++ b/web/packages/teleport/src/services/resources/types.ts
@@ -40,7 +40,18 @@ export type Kind =
   | KindJoinToken;
 
 /** Teleport role in a resource format. */
-export type RoleResource = Resource<KindRole>;
+export type RoleResource = Resource<KindRole> & {
+  /**
+   * Only defined if querying roles were requested with "includeObject".
+   */
+  object?: Role;
+};
+
+/** Teleport role with only the role name and description, used for displaying requestable roles. */
+export type RequestableRole = {
+  name: string;
+  description?: string;
+};
 
 /**
  * Teleport role in full format, as returned from Teleport API.
@@ -56,11 +67,13 @@ export type Role = {
     expires?: string;
     revision?: string;
   };
-  spec: {
-    allow: RoleConditions;
-    deny: RoleConditions;
-    options: RoleOptions;
-  };
+  spec: RoleSpec;
+};
+
+export type RoleSpec = {
+  allow: RoleConditions;
+  deny: RoleConditions;
+  options: RoleOptions;
 };
 
 export enum RoleVersion {
@@ -88,36 +101,88 @@ export function isLegacySamlIdpRbac(roleVersion: RoleVersion): boolean {
 }
 
 /**
- * A set of conditions that must be matched to allow or deny access. Fields
- * follow the snake case convention to match the wire format.
+ * Defines the identity to access an AWS IC application.
  */
-export type RoleConditions = {
-  node_labels?: Labels;
-  logins?: string[];
-
-  kubernetes_groups?: string[];
-  kubernetes_labels?: Labels;
-  kubernetes_resources?: KubernetesResource[];
-  kubernetes_users?: string[];
+export type AccountAssignment = {
+  /* the AWS Account ID */
+  account?: string;
+  /* the ARN that starts with "arn:aws:sso:::" */
+  permission_set?: string;
+};
 
+/**
+ * Fields related to application access.
+ */
+export type ApplicationResourceAccess = {
   app_labels?: Labels;
+
   aws_role_arns?: string[];
   azure_identities?: string[];
   gcp_service_accounts?: string[];
+  mcp?: MCPPermissions;
+  account_assignments?: AccountAssignment[];
+};
 
+/**
+ * Fields related to database access.
+ */
+export type DatabaseResourceAccess = {
   db_labels?: Labels;
+  db_service_labels?: Labels;
+
   db_names?: string[];
   db_users?: string[];
   db_roles?: string[];
-  db_service_labels?: Labels;
+};
+
+/**
+ * Fields related to git server access.
+ */
+export type GitHubResourceAccess = {
+  github_permissions?: GitHubPermission[];
+};
 
+/**
+ * Fields related to kube cluster access.
+ */
+export type KubernetesResourceAccess = {
+  kubernetes_labels?: Labels;
+
+  kubernetes_groups?: string[];
+  kubernetes_resources?: KubernetesResource[];
+  kubernetes_users?: string[];
+};
+
+/**
+ * Fields related to server access.
+ */
+export type ServerResourceAccess = {
+  node_labels?: Labels;
+
+  logins?: string[];
+};
+
+/**
+ * Fields related to windows desktop access.
+ */
+export type WindowsDesktopResourceAccess = {
   windows_desktop_labels?: Labels;
-  windows_desktop_logins?: string[];
 
-  github_permissions?: GitHubPermission[];
+  windows_desktop_logins?: string[];
+};
 
+/**
+ * A set of conditions that must be matched to allow or deny access. Fields
+ * follow the snake case convention to match the wire format.
+ */
+export type RoleConditions = {
   rules?: Rule[];
-};
+} & ApplicationResourceAccess &
+  DatabaseResourceAccess &
+  GitHubResourceAccess &
+  KubernetesResourceAccess &
+  ServerResourceAccess &
+  WindowsDesktopResourceAccess;
 
 export type Labels = Record<string, string | string[]>;
 
@@ -296,6 +361,7 @@ export enum ResourceKind {
   WebToken = 'web_token',
   WindowsDesktop = 'windows_desktop',
   WindowsDesktopService = 'windows_desktop_service',
+  WorkloadIdentity = 'workload_identity',
 
   // Resources that have no actual data representation, but serve for checking
   // access to various features.
@@ -343,6 +409,10 @@ export type GitHubPermission = {
   orgs?: string[];
 };
 
+export type MCPPermissions = {
+  tools?: string[];
+};
+
 /**
  * Teleport role options in full format, as returned from Teleport API. Note
  * that its fields follow the snake case convention to match the wire format.
diff --git a/web/packages/teleport/src/services/storageService/storageService.ts b/web/packages/teleport/src/services/storageService/storageService.ts
index 01034612de47c..125d35287c358 100644
--- a/web/packages/teleport/src/services/storageService/storageService.ts
+++ b/web/packages/teleport/src/services/storageService/storageService.ts
@@ -43,6 +43,10 @@ const KEEP_LOCALSTORAGE_KEYS_ON_LOGOUT = [
   KeysEnum.USERS_NOT_EQUAL_TO_MAU_ACKNOWLEDGED,
   KeysEnum.USE_NEW_ROLE_EDITOR,
   KeysEnum.RECENT_HISTORY,
+  KeysEnum.REMEMBERED_SSO_USERNAME,
+  KeysEnum.SESSION_RECORDINGS_VIEW_MODE,
+  KeysEnum.SESSION_RECORDINGS_DENSITY,
+  KeysEnum.SESSION_RECORDINGS_DISMISSED_CTA,
 ];
 
 const RECENT_HISTORY_MAX_LENGTH = 10;
@@ -334,4 +338,16 @@ export const storageService = {
 
     return newHistory;
   },
+
+  setRememberedSsoUsername(username: string) {
+    window.localStorage.setItem(KeysEnum.REMEMBERED_SSO_USERNAME, username);
+  },
+
+  getRememberedSsoUsername(): string {
+    return window.localStorage.getItem(KeysEnum.REMEMBERED_SSO_USERNAME) || '';
+  },
+
+  clearRememberedSsoUsername() {
+    window.localStorage.removeItem(KeysEnum.REMEMBERED_SSO_USERNAME);
+  },
 };
diff --git a/web/packages/teleport/src/services/storageService/types.ts b/web/packages/teleport/src/services/storageService/types.ts
index 87c643e7b0cdf..3fb1c2a086645 100644
--- a/web/packages/teleport/src/services/storageService/types.ts
+++ b/web/packages/teleport/src/services/storageService/types.ts
@@ -41,6 +41,21 @@ export const KeysEnum = {
   LOCAL_NOTIFICATION_STATES: 'grv_teleport_notification_states',
   RECENT_HISTORY: 'grv_teleport_sidenav_recent_history',
   LOGIN_TIME: 'grv_teleport_login_time',
+  REMEMBERED_SSO_USERNAME: 'grv_teleport_remembered_sso_username',
+  SESSION_RECORDINGS_VIEW_MODE: 'grv_teleport_session_recordings_view_mode',
+  SESSION_RECORDINGS_DENSITY: 'grv_teleport_session_recordings_density',
+  SESSION_RECORDINGS_DISMISSED_CTA:
+    'grv_teleport_session_recordings_dismissed_cta',
+  SESSION_RECORDINGS_DISMISSED_SETUP:
+    'grv_teleport_session_recordings_dismissed_setup',
+  SESSION_RECORDING_SIDEBAR_HIDDEN:
+    'grv_teleport_session_recording_sidebar_hidden',
+  SESSION_RECORDING_TIMELINE_HEIGHT:
+    'grv_teleport_session_recording_timeline_height',
+  SESSION_RECORDING_TIMELINE_HIDDEN:
+    'grv_teleport_session_recording_timeline_hidden',
+  SESSION_RECORDING_TIMELINE_SHOW_ABSOLUTE_TIME:
+    'grv_teleport_session_recording_timeline_show_absolute_time',
 
   // TODO(bl-nero): Remove once the new role editor is in acceptable state.
   USE_NEW_ROLE_EDITOR: 'grv_teleport_use_new_role_editor',
diff --git a/web/packages/teleport/src/services/user/makeAcl.ts b/web/packages/teleport/src/services/user/makeAcl.ts
index 03863cf1bb45d..501d1ae617dfc 100644
--- a/web/packages/teleport/src/services/user/makeAcl.ts
+++ b/web/packages/teleport/src/services/user/makeAcl.ts
@@ -86,6 +86,10 @@ export function makeAcl(json): Acl {
 
   const botInstances = json.botInstances || defaultAccess;
 
+  const workloadIdentity = json.workloadIdentity || defaultAccess;
+
+  const clientIpRestriction = json.clientIpRestriction || defaultAccess;
+
   return {
     accessList,
     authConnectors,
@@ -128,6 +132,8 @@ export function makeAcl(json): Acl {
     gitServers,
     accessGraphSettings,
     botInstances,
+    workloadIdentity,
+    clientIpRestriction,
   };
 }
 
diff --git a/web/packages/teleport/src/services/user/types.ts b/web/packages/teleport/src/services/user/types.ts
index 145209cb29688..12ef46be89256 100644
--- a/web/packages/teleport/src/services/user/types.ts
+++ b/web/packages/teleport/src/services/user/types.ts
@@ -113,6 +113,8 @@ export interface Acl {
   gitServers: Access;
   accessGraphSettings: Access;
   botInstances: Access;
+  workloadIdentity: Access;
+  clientIpRestriction: Access;
 }
 
 // AllTraits represent all the traits defined for a user.
diff --git a/web/packages/teleport/src/services/user/user.test.ts b/web/packages/teleport/src/services/user/user.test.ts
index 50269b6975dc7..6ec02a67402d7 100644
--- a/web/packages/teleport/src/services/user/user.test.ts
+++ b/web/packages/teleport/src/services/user/user.test.ts
@@ -310,6 +310,20 @@ test('undefined values in context response gives proper default values', async (
       create: false,
       remove: false,
     },
+    workloadIdentity: {
+      list: false,
+      read: false,
+      edit: false,
+      create: false,
+      remove: false,
+    },
+    clientIpRestriction: {
+      list: false,
+      read: false,
+      edit: false,
+      create: false,
+      remove: false,
+    },
   };
 
   expect(response).toEqual({
diff --git a/web/packages/teleport/src/services/user/user.ts b/web/packages/teleport/src/services/user/user.ts
index fd2a62b987021..91c9b5f7fc515 100644
--- a/web/packages/teleport/src/services/user/user.ts
+++ b/web/packages/teleport/src/services/user/user.ts
@@ -16,11 +16,12 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import cfg from 'teleport/config';
+import cfg, { UrlListUsersParams } from 'teleport/config';
 import api from 'teleport/services/api';
 import session from 'teleport/services/websession';
 
 import { MfaChallengeResponse } from '../mfa';
+import { isPathNotFoundError } from '../version/unsupported';
 import { makeResetToken } from './makeResetToken';
 import makeUser, { makeUsers } from './makeUser';
 import makeUserContext from './makeUserContext';
@@ -60,10 +61,40 @@ const service = {
     return api.get(cfg.getUserWithUsernameUrl(username)).then(makeUser);
   },
 
+  // TODO(rudream): DELETE IN v21.0
   fetchUsers(signal?: AbortSignal) {
     return api.get(cfg.getUsersUrl(), signal).then(makeUsers);
   },
 
+  async fetchUsersV2(
+    params?: UrlListUsersParams,
+    signal?: AbortSignal
+  ): Promise<{
+    items: User[];
+    startKey: string;
+  }> {
+    return await api
+      .get(cfg.getUsersUrlV2(params), signal)
+      .then(res => {
+        return {
+          items: makeUsers(res.items),
+          startKey: res.startKey,
+        };
+      })
+      .catch(err => {
+        // If this v2 paginated endpoint isn't found, fallback to the v1 endpoint but paginate locally in order to
+        // maintain compatibility with the paginated table component which expects a paginated response.
+        // TODO(rudream): DELETE IN v21.0
+        if (isPathNotFoundError(err)) {
+          return this.fetchUsers().then(users =>
+            makeUsersPageLocally(params, users)
+          );
+        } else {
+          throw err;
+        }
+      });
+  },
+
   /**
    * Update user.
    * use allTraits to create new or replace entire user traits.
@@ -162,4 +193,34 @@ function withExcludedField(user: User, excludeUserField: ExcludeUserField) {
   return userReq;
 }
 
+/**
+ * makeUsersPageLocally mocks a paginated response for users so that a list of all users
+ * can be handled by a serverside paginated table component.
+ */
+// TODO(rudream): DELETE IN v21.0
+function makeUsersPageLocally(
+  params: UrlListUsersParams,
+  allUsers: User[]
+): {
+  items: User[];
+  startKey: string;
+} {
+  if (params.search) {
+    allUsers = allUsers.filter(u =>
+      u.name.toLowerCase().includes(params.search.toLowerCase())
+    );
+  }
+
+  if (params.startKey) {
+    const startIndex = allUsers.findIndex(p => p.name === params.startKey);
+    allUsers = allUsers.slice(startIndex);
+  }
+
+  const limit = params.limit || 200;
+  const nextKey = allUsers.at(limit)?.name;
+  allUsers = allUsers.slice(0, limit);
+
+  return { items: allUsers, startKey: nextKey };
+}
+
 export default service;
diff --git a/web/packages/teleport/src/services/userEvent/types.ts b/web/packages/teleport/src/services/userEvent/types.ts
index edaac5921d125..781c2c770a919 100644
--- a/web/packages/teleport/src/services/userEvent/types.ts
+++ b/web/packages/teleport/src/services/userEvent/types.ts
@@ -48,6 +48,10 @@ export enum IntegrationEnrollEvent {
   Started = 'tp.ui.integrationEnroll.start',
   Complete = 'tp.ui.integrationEnroll.complete',
   Step = 'tp.ui.integrationEnroll.step',
+  SectionOpen = 'tp.ui.integrationEnroll.sectionOpen',
+  FieldComplete = 'tp.ui.integrationEnroll.fieldComplete',
+  CodeCopy = 'tp.ui.integrationEnroll.codeCopy',
+  LinkClick = 'tp.ui.integrationEnroll.linkClick',
 }
 
 // IntegrationEnrollKind represents a integration type.
@@ -67,6 +71,7 @@ export enum IntegrationEnrollKind {
   ServiceNow = 'INTEGRATION_ENROLL_KIND_SERVICENOW',
   MachineID = 'INTEGRATION_ENROLL_KIND_MACHINE_ID',
   MachineIDGitHubActions = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS',
+  MachineIDGitHubActionsKubernetes = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITHUB_ACTIONS_KUBERNETES',
   MachineIDCircleCI = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_CIRCLECI',
   MachineIDGitLab = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_GITLAB',
   MachineIDJenkins = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_JENKINS',
@@ -76,6 +81,7 @@ export enum IntegrationEnrollKind {
   MachineIDAzure = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_AZURE',
   MachineIDSpacelift = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_SPACELIFT',
   MachineIDKubernetes = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_KUBERNETES',
+  MachineIDArgoCD = 'INTEGRATION_ENROLL_KIND_MACHINE_ID_ARGOCD',
   EntraId = 'INTEGRATION_ENROLL_KIND_ENTRA_ID',
   DatadogIncidentManagement = 'INTEGRATION_ENROLL_KIND_DATADOG_INCIDENT_MANAGEMENT',
   AwsIdentityCenter = 'INTEGRATION_ENROLL_KIND_AWS_IDENTITY_CENTER',
@@ -102,6 +108,14 @@ export enum IntegrationEnrollStep {
   GitHubRaCreateGitServer = 'INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_GIT_SERVER',
   GitHubRaConfigureSshCert = 'INTEGRATION_ENROLL_STEP_GITHUBRA_CONFIGURE_SSH_CERT',
   GitHubRaCreateRole = 'INTEGRATION_ENROLL_STEP_GITHUBRA_CREATE_ROLE',
+
+  /**
+   * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+   */
+  MWIGHAK8SWelcome = 'INTEGRATION_ENROLL_STEP_MWIGHAK8S_WELCOME',
+  MWIGHAK8SConnectGitHub = 'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONNECT_GITHUB',
+  MWIGHAK8SConfigureAccess = 'INTEGRATION_ENROLL_STEP_MWIGHAK8S_CONFIGURE_ACCESS',
+  MWIGHAK8SSetupWorkflow = 'INTEGRATION_ENROLL_STEP_MWIGHAK8S_SETUP_WORKFLOW',
 }
 
 /**
@@ -116,6 +130,52 @@ export enum IntegrationEnrollStatusCode {
   Aborted = 'INTEGRATION_ENROLL_STATUS_CODE_ABORTED',
 }
 
+/**
+ * IntegrationEnrollSection identifies a section the user opened or expanded in
+ * an integration setup wizard. Value matches with proto enums defined in the
+ * backend.
+ */
+export enum IntegrationEnrollSection {
+  /**
+   * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+   */
+  MWIGHAK8SGitHubAdvancedOptions = 'INTEGRATION_ENROLL_SECTION_MWIGHAK8S_GITHUB_ADVANCED_OPTIONS',
+  MWIGHAK8SKubernetesLabelPicker = 'INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_LABEL_PICKER',
+  MWIGHAK8SKubernetesAdvancedOptions = 'INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_ADVANCED_OPTIONS',
+  MWIGHAK8SKubernetesResourceRulePicker = 'INTEGRATION_ENROLL_SECTION_MWIGHAK8S_KUBERNETES_RESOURCE_RULE_PICKER',
+}
+
+/**
+ * IntegrationEnrollField identifies a field the user completed in an integration
+ * setup wizard. Value matches with proto enums defined in the backend.
+ */
+export enum IntegrationEnrollField {
+  /**
+   * MWIGHAK8S denotes the MWI GitHub Actions + Kubernetes wizard.
+   */
+  MWIGHAK8SGitHubRepositoryURL = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REPOSITORY_URL',
+  MWIGHAK8SGitHubBranch = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_BRANCH',
+  MWIGHAK8SGitHubWorkflow = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_WORKFLOW',
+  MWIGHAK8SGitHubEnvironment = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENVIRONMENT',
+  MWIGHAK8SGitHubRef = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_REF',
+  MWIGHAK8SGitHubEnterpriseSlug = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_SLUG',
+  MWIGHAK8SGitHubEnterpriseStaticJWKS = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_GITHUB_ENTERPRISE_STATIC_JWKS',
+  MWIGHAK8SKubernetesLabels = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_LABELS',
+  MWIGHAK8SKubernetesGroups = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_GROUPS',
+  MWIGHAK8SKubernetesUsers = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_USERS',
+  MWIGHAK8SKubernetesResourceRules = 'INTEGRATION_ENROLL_FIELD_MWIGHAK8S_KUBERNETES_RESOURCE_RULES',
+}
+
+/**
+ * IntegrationEnrollCodeType identifies the type of code that was copied in an
+ * integration setup wizard. Value matches with proto enums defined in the
+ * backend.
+ */
+export enum IntegrationEnrollCodeType {
+  Terraform = 'INTEGRATION_ENROLL_CODE_TYPE_TERRAFORM',
+  GitHubActionsYAML = 'INTEGRATION_ENROLL_CODE_TYPE_GITHUB_ACTIONS_YAML',
+}
+
 /**
  * IntegrationEnrollStepStatus defines fields for reporting
  * integration configuration step event.
@@ -141,6 +201,10 @@ export type IntegrationEnrollEventData = {
   kind: IntegrationEnrollKind;
   step?: IntegrationEnrollStep;
   status?: IntegrationEnrollStepStatus;
+  section?: IntegrationEnrollSection;
+  field?: IntegrationEnrollField;
+  codeType?: IntegrationEnrollCodeType;
+  link?: string;
 };
 
 /**
@@ -202,6 +266,7 @@ export enum DiscoverEventResource {
   DatabaseCassandraSelfHosted = 'DISCOVER_RESOURCE_DATABASE_CASSANDRA_SELF_HOSTED',
   DatabaseElasticSearchSelfHosted = 'DISCOVER_RESOURCE_DATABASE_ELASTICSEARCH_SELF_HOSTED',
   DatabaseRedisElasticache = 'DISCOVER_RESOURCE_DATABASE_REDIS_ELASTICACHE',
+  DatabaseRedisElastiCacheServerless = 'DISCOVER_RESOURCE_DATABASE_REDIS_ELASTICACHE_SERVERLESS',
   DatabaseRedisMemoryDb = 'DISCOVER_RESOURCE_DATABASE_REDIS_MEMORYDB',
   DatabaseRedisAzureCache = 'DISCOVER_RESOURCE_DATABASE_REDIS_AZURE_CACHE',
   DatabaseRedisClusterSelfHosted = 'DISCOVER_RESOURCE_DATABASE_REDIS_CLUSTER_SELF_HOSTED',
@@ -226,6 +291,10 @@ export enum DiscoverEventResource {
   Ec2Instance = 'DISCOVER_RESOURCE_EC2_INSTANCE',
 
   SamlApplication = 'DISCOVER_RESOURCE_SAML_APPLICATION',
+
+  MCPStdio = 'DISCOVER_RESOURCE_MCP_STDIO',
+  MCPSSE = 'DISCOVER_RESOURCE_MCP_SSE',
+  MCPStreamableHTTP = 'DISCOVER_RESOURCE_MCP_STREAMABLE_HTTP',
 }
 
 export enum DiscoverEventStatus {
diff --git a/web/packages/teleport/src/services/userPreferences/discoverPreference.ts b/web/packages/teleport/src/services/userPreferences/discoverPreference.ts
index 0442bc97b6146..d3820b568f58b 100644
--- a/web/packages/teleport/src/services/userPreferences/discoverPreference.ts
+++ b/web/packages/teleport/src/services/userPreferences/discoverPreference.ts
@@ -38,12 +38,18 @@ export enum DiscoverGuideId {
 
   // Applications:
   ApplicationWebHttpProxy = 'application-web-http-proxy',
-  ApplicationAwsCliConsole = 'application-aws-cli-console',
+  ApplicationAwsCliConsole = 'application-aws-cli-console', // AWS OIDC IdP
+  ApplicationAwsRolesAnywhere = 'application-aws-iam-roles-anywhere',
   ApplicationSamlGeneric = 'application-saml-generic',
   ApplicationSamlGrafana = 'application-saml-grafana',
   ApplicationSamlWorkforceIdentityFederation = 'application-saml-workforce-identity-federation',
   ApplicationSamlMicrosoftEntraId = 'application-saml-microsoft-entra-id',
 
+  // MCP Servers:
+  MCPServerStdioTransport = 'mcp-stdio',
+  MCPServerSSETransport = 'mcp-sse',
+  MCPServerStreamableHTTPTransport = 'mcp-streamable-http',
+
   // Windows Desktops:
   WindowsDesktopsActiveDirectory = 'windows-desktops-active-directory',
   WindowsDesktopsLocal = 'windows-desktops-local',
@@ -55,6 +61,7 @@ export enum DiscoverGuideId {
   // Databases:
   DatabaseAwsDynamoDb = 'database-aws-dynamo-db',
   DatabaseAwsElastiCacheMemoryDb = 'database-aws-elasticache-memorydb',
+  DatabaseAwsElastiCacheServerless = 'database-aws-elasticache-serverless',
   DatabaseAwsCassandraKeyspaces = 'database-aws-cassandra-keyspaces',
   DatabaseAwsRedshiftServerless = 'database-aws-redshift-serverless',
   DatabaseAwsSqlServerAd = 'database-aws-sql-server-ad',
diff --git a/web/packages/teleport/src/services/version/unsupported.test.ts b/web/packages/teleport/src/services/version/unsupported.test.ts
index 485c47444df08..799d677dfcabf 100644
--- a/web/packages/teleport/src/services/version/unsupported.test.ts
+++ b/web/packages/teleport/src/services/version/unsupported.test.ts
@@ -94,16 +94,16 @@ describe('withGenericUnsupportedError', () => {
         minor: 2,
         patch: 3,
         preRelease: 'dev',
-        string: 'v1.2.3-dev',
+        string: '1.2.3-dev',
       },
     });
 
     expect(() =>
-      withGenericUnsupportedError(pathNotFoundError, 'v2.0.0')
+      withGenericUnsupportedError(pathNotFoundError, '2.0.0')
     ).toThrow('Your proxy (v1.2.3-dev) may be behind');
 
     expect(() =>
-      withGenericUnsupportedError(pathNotFoundError, 'v2.0.0')
+      withGenericUnsupportedError(pathNotFoundError, '2.0.0')
     ).toThrow('minimum required version (v2.0.0)');
   });
 
diff --git a/web/packages/teleport/src/services/version/unsupported.ts b/web/packages/teleport/src/services/version/unsupported.ts
index 49e3e2993b919..f62b8a2df2176 100644
--- a/web/packages/teleport/src/services/version/unsupported.ts
+++ b/web/packages/teleport/src/services/version/unsupported.ts
@@ -36,7 +36,7 @@ export const ProxyRequiresUpgrade = 'Ensure all proxies are upgraded';
  * Determines if error 404 is a result of an endpoint path not found
  * (not resource not found).
  */
-export function isPathNotFoundError(err: unknown) {
+export function isPathNotFoundError(err: unknown): err is ApiError {
   if (err instanceof ApiError && err.response.status === 404) {
     if (err.proxyVersion) {
       return true;
@@ -60,36 +60,52 @@ export function isPathNotFoundError(err: unknown) {
  * Else, rethrows the same error.
  *
  * @param supportedVersion the minimum version required for this
- * request to succeed eg: v17.3.0
+ * request to succeed eg: 17.3.0
  */
 export function withGenericUnsupportedError(
   err: unknown,
   supportedVersion: string
 ): never {
-  if (err instanceof ApiError && err.response.status === 404) {
+  if (isPathNotFoundError(err)) {
     if (err.proxyVersion) {
-      throw new Error(
-        'We could not complete your request. ' +
-          `Your proxy (${err.proxyVersion.string}) may be behind the ` +
-          `minimum required version (${supportedVersion}) to support ` +
-          `this request. ${ProxyRequiresUpgrade} and try again.`
-      );
+      throw new Error(makeUnsupportedErrorMessage(err, supportedVersion));
     }
     // DELETE IN 19.0
     // pre v17 this is the legacy error message crafted as a result
     // of no path found.
     if (err.message == `${err.response.status} - ${err.response.url}`) {
-      throw new Error(
-        'We could not complete your request. ' +
-          'Your proxy may be behind the minimum required version ' +
-          `(${supportedVersion}) to support this request. ` +
-          `${ProxyRequiresUpgrade} and try again.`
-      );
+      throw new Error(makeUnsupportedErrorMessage(err, supportedVersion));
     }
   }
   throw err;
 }
 
+/**
+ * `makeUnsupportedErrorMessage` creates a message to the user to explain a
+ * version mismatch.
+ *
+ * @param err the ApiError received
+ * @param supportedVersion the minimum version required for this request to
+ * succeed eg: 17.3.0
+ * @returns the error message to display to the user
+ */
+export function makeUnsupportedErrorMessage(
+  err: ApiError,
+  supportedVersion?: string
+) {
+  const formattedProxyVersion = err.proxyVersion
+    ? `(v${err.proxyVersion.string}) `
+    : '';
+  const formattedSupportedVersion = supportedVersion
+    ? `(v${supportedVersion}) `
+    : '';
+  return (
+    `We could not complete your request. Your proxy ${formattedProxyVersion}` +
+    `may be behind the minimum required version ${formattedSupportedVersion}` +
+    `to support this request. ${ProxyRequiresUpgrade} and try again.`
+  );
+}
+
 export function withUnsupportedLabelFeatureErrorConversion(
   err: unknown
 ): never {
diff --git a/web/packages/teleport/src/services/websession/websession.test.ts b/web/packages/teleport/src/services/websession/websession.test.ts
new file mode 100644
index 0000000000000..9a13dadc6d515
--- /dev/null
+++ b/web/packages/teleport/src/services/websession/websession.test.ts
@@ -0,0 +1,35 @@
+/**
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { waitFor } from '@testing-library/react';
+
+import history from 'teleport/services/history';
+
+import websession from '.';
+import api from '../api';
+
+test('user should be redirected to login even if session delete call fails', async () => {
+  jest.spyOn(console, 'error').mockImplementation();
+  jest.spyOn(api, 'delete').mockRejectedValue(new Error('some error'));
+  const goToLoginSpy = jest.spyOn(history, 'goToLogin').mockImplementation();
+  jest.spyOn(websession, 'clear').mockImplementation();
+
+  websession.logout();
+
+  await waitFor(() => expect(goToLoginSpy).toHaveBeenCalled());
+});
diff --git a/web/packages/teleport/src/services/websession/websession.ts b/web/packages/teleport/src/services/websession/websession.ts
index bea98b37ed9f2..45aeeed928cf1 100644
--- a/web/packages/teleport/src/services/websession/websession.ts
+++ b/web/packages/teleport/src/services/websession/websession.ts
@@ -35,15 +35,33 @@ const logger = Logger.create('services/session');
 let sesstionCheckerTimerId = null;
 
 const session = {
+  _isRenewing: false,
+  _isDeviceTrustRequired: false,
+  _isDeviceTrusted: false,
+
   logout(rememberLocation = false) {
-    api.delete(cfg.api.webSessionPath).then(response => {
-      this.clear();
-      if (response.samlSloUrl) {
-        window.open(response.samlSloUrl, '_self');
-      } else {
-        history.goToLogin({ rememberLocation });
-      }
-    });
+    let samlSloUrl = '';
+
+    api
+      .delete(cfg.api.webSessionPath)
+      .then(response => {
+        samlSloUrl = response?.samlSloUrl;
+      })
+      .catch(err => {
+        // This request can fail if the session is already expired, which isn't an issue, but we should still catch the error.
+        logger.error(
+          'Failed to delete session. This can happen if the session has already expired.',
+          err
+        );
+      })
+      .finally(() => {
+        this.clear();
+        if (samlSloUrl) {
+          window.open(samlSloUrl, '_self');
+        } else {
+          history.goToLogin({ rememberLocation });
+        }
+      });
   },
 
   logoutWithoutSlo({
@@ -190,17 +208,17 @@ const session = {
       });
   },
 
-  _setAndBroadcastIsRenewing(value) {
+  _setAndBroadcastIsRenewing(value: boolean) {
     this._setIsRenewing(value);
     storageService.broadcast(KeysEnum.TOKEN_RENEW, value);
   },
 
-  _setIsRenewing(value) {
+  _setIsRenewing(value: boolean) {
     this._isRenewing = value;
   },
 
   _getIsRenewing() {
-    return !!this._isRenewing;
+    return this._isRenewing;
   },
 
   setDeviceTrustRequired() {
@@ -208,11 +226,11 @@ const session = {
   },
 
   getDeviceTrustRequired() {
-    return !!this._isDeviceTrustRequired;
+    return this._isDeviceTrustRequired;
   },
 
   getIsDeviceTrusted() {
-    return !!this._isDeviceTrusted;
+    return this._isDeviceTrusted;
   },
 
   // a session will never be "downgraded" so we can just set to true
diff --git a/web/packages/teleport/src/services/workloadIdentity/consts.ts b/web/packages/teleport/src/services/workloadIdentity/consts.ts
new file mode 100644
index 0000000000000..a4393c0871193
--- /dev/null
+++ b/web/packages/teleport/src/services/workloadIdentity/consts.ts
@@ -0,0 +1,37 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ListWorkloadIdentitiesResponse } from './types';
+
+export function validateListWorkloadIdentitiesResponse(
+  data: unknown
+): data is ListWorkloadIdentitiesResponse {
+  if (typeof data !== 'object' || data === null) {
+    return false;
+  }
+
+  if (!('items' in data)) {
+    return false;
+  }
+
+  if (!Array.isArray(data.items)) {
+    return false;
+  }
+
+  return data.items.every(x => typeof x === 'object' || x !== null);
+}
diff --git a/web/packages/teleport/src/services/workloadIdentity/types.ts b/web/packages/teleport/src/services/workloadIdentity/types.ts
new file mode 100644
index 0000000000000..6f07b65559215
--- /dev/null
+++ b/web/packages/teleport/src/services/workloadIdentity/types.ts
@@ -0,0 +1,29 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export type ListWorkloadIdentitiesResponse = {
+  items: WorkloadIdentity[] | null;
+  next_page_token: string | null | undefined;
+};
+
+export type WorkloadIdentity = {
+  name: string;
+  spiffe_id: string | null | undefined;
+  labels: Record<string, string> | null | undefined;
+  spiffe_hint: string | null | undefined;
+};
diff --git a/web/packages/teleport/src/services/workloadIdentity/workloadIdentity.ts b/web/packages/teleport/src/services/workloadIdentity/workloadIdentity.ts
new file mode 100644
index 0000000000000..850d5ca8e6832
--- /dev/null
+++ b/web/packages/teleport/src/services/workloadIdentity/workloadIdentity.ts
@@ -0,0 +1,64 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import cfg from 'teleport/config';
+
+import api from '../api/api';
+import { withGenericUnsupportedError } from '../version/unsupported';
+import { validateListWorkloadIdentitiesResponse } from './consts';
+
+export async function listWorkloadIdentities(
+  variables: {
+    pageToken: string;
+    pageSize: number;
+    sortField: string;
+    sortDir: string;
+    searchTerm?: string;
+  },
+  signal?: AbortSignal
+) {
+  const { pageToken, pageSize, sortField, sortDir, searchTerm } = variables;
+
+  const path = cfg.getWorkloadIdentityUrl({ action: 'list' });
+  const qs = new URLSearchParams();
+
+  qs.set('page_size', pageSize.toFixed());
+  qs.set('page_token', pageToken);
+  if (sortField) {
+    qs.set('sort_field', sortField);
+  }
+  if (sortDir) {
+    qs.set('sort_dir', sortDir);
+  }
+  if (searchTerm) {
+    qs.set('search', searchTerm);
+  }
+
+  try {
+    const data = await api.get(`${path}?${qs.toString()}`, signal);
+
+    if (!validateListWorkloadIdentitiesResponse(data)) {
+      throw new Error('failed to validate list workload identities response');
+    }
+
+    return data;
+  } catch (err) {
+    // TODO(nicholasmarais1158) DELETE IN v20.0.0
+    withGenericUnsupportedError(err, '19.0.0');
+  }
+}
diff --git a/web/packages/teleport/src/stores/storeUserContext.ts b/web/packages/teleport/src/stores/storeUserContext.ts
index bdaf4ce93f576..f29f02fe7f768 100644
--- a/web/packages/teleport/src/stores/storeUserContext.ts
+++ b/web/packages/teleport/src/stores/storeUserContext.ts
@@ -40,6 +40,10 @@ export default class StoreUserContext extends Store<UserContext> {
     return this.state.cluster.clusterId;
   }
 
+  getClusterAuthVersion() {
+    return this.state.cluster.authVersion;
+  }
+
   getEventAccess() {
     return this.state.acl.events;
   }
@@ -266,4 +270,12 @@ export default class StoreUserContext extends Store<UserContext> {
   getGitServersAccess() {
     return this.state.acl.gitServers;
   }
+
+  getWorkloadIdentityAccess() {
+    return this.state.acl.workloadIdentity;
+  }
+
+  geClientIpRestrictionAccess() {
+    return this.state.acl.clientIpRestriction;
+  }
 }
diff --git a/web/packages/teleport/src/teleportContext.tsx b/web/packages/teleport/src/teleportContext.tsx
index 80cf7e17652a8..341193f93f241 100644
--- a/web/packages/teleport/src/teleportContext.tsx
+++ b/web/packages/teleport/src/teleportContext.tsx
@@ -206,21 +206,26 @@ class TeleportContext implements types.Context {
         userContext.getExternalAuditStorageAccess().create,
       deviceTrust: userContext.getDeviceTrustAccess().list,
       locks: userContext.getLockAccess().list,
-      newLocks:
-        userContext.getLockAccess().create && userContext.getLockAccess().edit,
+      addLocks:
+        userContext.getLockAccess().create && userContext.getLockAccess().edit, // Presumably because this is an upsert operation so needs both create and edit permissions
+      removeLocks: userContext.getLockAccess().remove,
       accessMonitoring: hasAccessMonitoringAccess(),
       accessGraph: userContext.getAccessGraphAccess().list,
       accessGraphIntegrations: hasAccessGraphIntegrationsAccess(),
-      tokens: userContext.getTokenAccess().create,
+      createTokens: userContext.getTokenAccess().create,
+      listTokens: userContext.getTokenAccess().list,
       externalAuditStorage: userContext.getExternalAuditStorageAccess().list,
       listBots: userContext.getBotsAccess().list,
+      readBots: userContext.getBotsAccess().read,
       addBots: userContext.getBotsAccess().create,
       editBots: userContext.getBotsAccess().edit,
       removeBots: userContext.getBotsAccess().remove,
       gitServers:
         userContext.getGitServersAccess().list &&
         userContext.getGitServersAccess().read,
+      readBotInstances: userContext.getBotInstancesAccess().read,
       listBotInstances: userContext.getBotInstancesAccess().list,
+      listWorkloadIdentities: userContext.getWorkloadIdentityAccess().list,
     };
   }
 }
@@ -240,7 +245,8 @@ export const disabledFeatureFlags: types.FeatureFlags = {
   trustedClusters: false,
   users: false,
   newAccessRequest: false,
-  tokens: false,
+  createTokens: false,
+  listTokens: false,
   accessRequests: false,
   downloadCenter: false,
   supportLink: false,
@@ -251,17 +257,21 @@ export const disabledFeatureFlags: types.FeatureFlags = {
   enrollIntegrationsOrPlugins: false,
   enrollIntegrations: false,
   locks: false,
-  newLocks: false,
+  addLocks: false,
+  removeLocks: false,
   accessMonitoring: false,
   accessGraph: false,
   accessGraphIntegrations: false,
   externalAuditStorage: false,
   addBots: false,
   listBots: false,
+  readBots: false,
   editBots: false,
   removeBots: false,
   gitServers: false,
+  readBotInstances: false,
   listBotInstances: false,
+  listWorkloadIdentities: false,
 };
 
 export default TeleportContext;
diff --git a/web/packages/teleport/src/test/helpers/botInstances.ts b/web/packages/teleport/src/test/helpers/botInstances.ts
index 13034b2a8936d..d177ec97bef61 100644
--- a/web/packages/teleport/src/test/helpers/botInstances.ts
+++ b/web/packages/teleport/src/test/helpers/botInstances.ts
@@ -18,33 +18,205 @@
 
 import { http, HttpResponse } from 'msw';
 
+import cfg from 'teleport/config';
 import {
+  BotInstanceKind,
+  BotInstanceServiceHealthStatus,
+  GetBotInstanceMetricsResponse,
   GetBotInstanceResponse,
   ListBotInstancesResponse,
 } from 'teleport/services/bot/types';
 
-const listBotInstancesPath =
-  '/v1/webapi/sites/:cluster_id/machine-id/bot-instance';
+export const listBotInstancesSuccess = (
+  mock: ListBotInstancesResponse,
+  version: ListBotInstancesApiVersion = 'v2'
+) =>
+  http.get(
+    version == 'v1' ? cfg.api.botInstance.list : cfg.api.botInstance.listV2,
+    () => {
+      return HttpResponse.json(mock);
+    }
+  );
 
-const getBotInstancePath =
-  '/v1/webapi/sites/:cluster_id/machine-id/bot/:bot_name/bot-instance/:id';
+export const listBotInstancesForever = (
+  version: ListBotInstancesApiVersion = 'v1'
+) =>
+  http.get(
+    version == 'v1' ? cfg.api.botInstance.list : cfg.api.botInstance.listV2,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
 
-export const listBotInstancesSuccess = (mock: ListBotInstancesResponse) =>
-  http.get(listBotInstancesPath, () => {
-    return HttpResponse.json(mock);
+export const listBotInstancesError = (
+  status: number,
+  error: string | null = null,
+  version: ListBotInstancesApiVersion = 'v1'
+) =>
+  http.get(
+    version == 'v1' ? cfg.api.botInstance.list : cfg.api.botInstance.listV2,
+    () => {
+      return HttpResponse.json({ error: { message: error } }, { status });
+    }
+  );
+
+export const getBotInstanceSuccess = (mock?: GetBotInstanceResponse) =>
+  http.get(cfg.api.botInstance.read, () => {
+    return HttpResponse.json(mock ?? mockGetBotInstanceResponse);
   });
 
-export const listBotInstancesError = (status: number) =>
-  http.get(listBotInstancesPath, () => {
-    return new HttpResponse(null, { status });
+export const getBotInstanceError = (
+  status: number,
+  error: string | null = null
+) =>
+  http.get(cfg.api.botInstance.read, () => {
+    return HttpResponse.json({ error: { message: error } }, { status });
   });
 
-export const getBotInstanceSuccess = (mock: GetBotInstanceResponse) =>
-  http.get(getBotInstancePath, () => {
-    return HttpResponse.json(mock);
+export const getBotInstanceForever = () =>
+  http.get(
+    cfg.api.botInstance.read,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+export const mockGetBotInstanceResponse = {
+  bot_instance: {
+    spec: {
+      instance_id: 'a55259e8-9b17-466f-9d37-ab390ca4024e',
+      bot_name: 'test-bot-name',
+    },
+    status: {
+      latest_heartbeats: [
+        {
+          uptime: {
+            seconds: 43200 + 60,
+          },
+          version: '18.4.0',
+          hostname: 'test-hostname',
+          os: 'linux',
+          kind: BotInstanceKind.BOT_KIND_TCTL,
+        },
+      ],
+      latest_authentications: [
+        {
+          join_attrs: {
+            meta: {
+              join_method: 'github',
+              join_token_name: 'test-token-name',
+            },
+            github: {
+              sub: 'test-github-sub',
+              repository: 'gravitational/teleport',
+            },
+          },
+        },
+      ],
+      service_health: [
+        {
+          service: {
+            name: 'application-tunnel-1',
+            type: 'application-tunnel',
+          },
+          status:
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
+          updated_at: {
+            seconds: new Date('2025-10-10T10:45:00Z').getTime() / 1_000,
+          },
+        },
+        {
+          service: {
+            name: 'db-eu-lon-1',
+            type: 'database-tunnel',
+          },
+          status:
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
+          updated_at: {
+            seconds: new Date('2025-10-10T10:46:00Z').getTime() / 1_000,
+          },
+          reason:
+            'rendering OpenSSH config\n\twriting known_hosts to destination\n\t\treading "/opt/teleport/identity/known_hosts"\n\t\t\topen /opt/teleport/identity/known_hosts: permission denied',
+        },
+        {
+          service: {
+            name: 'workload-identity-aws-roles-anywhere-1',
+            type: 'workload-identity-aws-roles-anywhere',
+          },
+          status:
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_INITIALIZING,
+          updated_at: {
+            seconds: new Date('2025-10-10T10:47:00Z').getTime() / 1_000,
+          },
+        },
+        {
+          service: {
+            name: 'application-tunnel-2',
+            type: 'application-tunnel',
+          },
+          status:
+            BotInstanceServiceHealthStatus.BOT_INSTANCE_HEALTH_STATUS_UNSPECIFIED,
+          updated_at: {
+            seconds: new Date('2025-10-10T10:48:00Z').getTime() / 1_000,
+          },
+        },
+      ],
+    },
+  },
+  yaml: 'kind: bot_instance\nversion: v1\n',
+};
+
+export const getBotInstanceMetricsSuccess = (
+  mock?: GetBotInstanceMetricsResponse
+) =>
+  http.get(cfg.api.botInstance.metrics, () => {
+    return HttpResponse.json(
+      mock ?? {
+        upgrade_statuses: {
+          updated_at: new Date().toISOString(),
+          up_to_date: {
+            count: randBetween(0, 2000),
+            filter: 'up to date filter goes here',
+          },
+          patch_available: {
+            count: randBetween(0, 2000),
+            filter: 'patch filter goes here',
+          },
+          requires_upgrade: {
+            count: randBetween(0, 2000),
+            filter: 'upgrade filter goes here',
+          },
+          unsupported: {
+            count: randBetween(0, 2000),
+            filter: 'unsupported filter goes here',
+          },
+        },
+      }
+    );
   });
 
-export const getBotInstanceError = (status: number) =>
-  http.get(getBotInstancePath, () => {
-    return new HttpResponse(null, { status });
+export const getBotInstanceMetricsForever = () =>
+  http.get(
+    cfg.api.botInstance.metrics,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+export const getBotInstanceMetricsError = (
+  status: number,
+  error: string | null = null
+) =>
+  http.get(cfg.api.botInstance.metrics, () => {
+    return HttpResponse.json({ error: { message: error } }, { status });
   });
+
+function randBetween(low: number, high: number) {
+  if (low > high) [low, high] = [high, low];
+  return Math.floor(Math.random() * (high - low + 1)) + low;
+}
+
+export type ListBotInstancesApiVersion = 'v1' | 'v2';
diff --git a/web/packages/teleport/src/test/helpers/bots.ts b/web/packages/teleport/src/test/helpers/bots.ts
new file mode 100644
index 0000000000000..adf7577ba8929
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/bots.ts
@@ -0,0 +1,234 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { generateGhaK8sTemplates } from 'teleport/services/bot/bot';
+import { ApiBot, EditBotRequest } from 'teleport/services/bot/types';
+import { JsonObject } from 'teleport/types';
+
+export const getBotSuccess = (overrides?: {
+  name?: ApiBot['metadata']['name'];
+  description?: ApiBot['metadata']['description'];
+  roles?: ApiBot['spec']['roles'];
+  traits?: ApiBot['spec']['traits'];
+  max_session_ttl?: ApiBot['spec']['max_session_ttl'];
+}) => {
+  const {
+    name = 'test-bot-name',
+    description = "This is the bot's description.",
+    roles = ['admin', 'user'],
+    traits = [
+      {
+        name: 'trait-1',
+        values: ['value-1', 'value-2', 'value-3'],
+      },
+    ],
+    max_session_ttl = {
+      seconds: 43200,
+    },
+  } = overrides ?? {};
+
+  return http.get(cfg.api.bot.read, () => {
+    return HttpResponse.json({
+      status: 'active',
+      kind: 'bot',
+      subKind: '',
+      version: 'v1',
+      metadata: {
+        name,
+        description,
+        labels: new Map(),
+        namespace: '',
+        revision: '',
+      },
+      spec: {
+        roles,
+        traits,
+        max_session_ttl,
+      },
+    });
+  });
+};
+
+/**
+ * `editBotSuccess` returns a handler that captures the request and uses its values
+ * to construct a new bot object. `overrides` can be used to replace values in the request.
+ *
+ * @param overrides values to use instead of the values from the captured request
+ * @returns http handler to use in SetupServerApi.use()
+ */
+export const editBotSuccess = (
+  version: EditBotApiVersion = 'v3',
+  overrides?: Partial<EditBotRequest>
+) =>
+  http.put<{ botName: string }>(
+    version === 'v1'
+      ? cfg.api.bot.update
+      : version === 'v2'
+        ? cfg.api.bot.updateV2
+        : cfg.api.bot.updateV3,
+    async ({ request, params }) => {
+      const req = (await request.clone().json()) as EditBotRequest;
+      const {
+        roles = req.roles,
+        traits = req.traits,
+        max_session_ttl = req.max_session_ttl,
+        description = req.description,
+      } = overrides ?? {};
+
+      const maxSessionTtlSeconds =
+        max_session_ttl === '12h30m' ? 43200 + 30 * 60 : 43200;
+
+      return HttpResponse.json({
+        status: 'active',
+        kind: 'bot',
+        subKind: '',
+        version: 'v1',
+        metadata: {
+          name: params.botName,
+          description,
+          labels: new Map(),
+          namespace: '',
+          revision: '',
+        },
+        spec: {
+          roles: roles ?? ['admin', 'user'],
+          traits: traits ?? [
+            {
+              name: 'trait-1',
+              values: ['value-1', 'value-2', 'value-3'],
+            },
+          ],
+          max_session_ttl: {
+            seconds: maxSessionTtlSeconds,
+          },
+        },
+      });
+    }
+  );
+
+export const deleteBotSuccess = () =>
+  http.delete(cfg.api.bot.delete, () => {
+    return HttpResponse.json({});
+  });
+
+export const deleteBotError = (status: number, error: string | null = null) =>
+  http.delete(cfg.api.bot.delete, () => {
+    return HttpResponse.json({ error: { message: error } }, { status });
+  });
+
+export const getBotError = (status: number, error: string | null = null) =>
+  http.get(cfg.api.bot.read, () => {
+    return HttpResponse.json({ error: { message: error } }, { status });
+  });
+
+export const editBotError = (
+  version: EditBotApiVersion = 'v3',
+  status: number,
+  error: string | null = null,
+  fields: JsonObject = {}
+) =>
+  http.put(
+    version === 'v1'
+      ? cfg.api.bot.update
+      : version === 'v2'
+        ? cfg.api.bot.updateV2
+        : cfg.api.bot.updateV3,
+    () => {
+      return HttpResponse.json(
+        { error: { message: error }, fields },
+        { status }
+      );
+    }
+  );
+
+export const getBotForever = () =>
+  http.get(
+    cfg.api.bot.read,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+export const editBotForever = () =>
+  http.put(
+    cfg.api.bot.updateV2,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+export const genWizardCiCdSuccess = (options?: {
+  response?: Awaited<ReturnType<typeof generateGhaK8sTemplates>>;
+}) => {
+  return http.post(cfg.api.bot.genWizardCiCd, async ({ request }) => {
+    const {
+      response = {
+        terraform: TERRAFORM_MOCK.replaceAll(
+          ':body',
+          await request.clone().text()
+        ),
+      },
+    } = options ?? {};
+    return HttpResponse.json(response);
+  });
+};
+
+export const genWizardCiCdError = (
+  status: number,
+  error: string | null = null,
+  extras: JsonObject = {}
+) =>
+  http.post(cfg.api.bot.genWizardCiCd, () => {
+    return HttpResponse.json(
+      { error: { message: `${status} - ${error}` }, extras },
+      { status }
+    );
+  });
+
+export const genWizardCiCdForever = () =>
+  http.post(
+    cfg.api.bot.genWizardCiCd,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+const TERRAFORM_MOCK = `# POST ${cfg.api.bot.genWizardCiCd}
+# :body
+
+# This is a mocked Terraform template
+resource "teleport_bot" "bot_name" {
+  version = "v1"
+
+  metadata = {
+    name = "bot_name"
+  }
+
+  spec = {
+    roles = ["access"]
+  }
+}
+`;
+
+export type EditBotApiVersion = 'v1' | 'v2' | 'v3';
diff --git a/web/packages/teleport/src/test/helpers/locks.ts b/web/packages/teleport/src/test/helpers/locks.ts
new file mode 100644
index 0000000000000..cfd2c681e4246
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/locks.ts
@@ -0,0 +1,75 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { ApiLock, CreateLockRequest } from 'teleport/services/locks/types';
+
+export const listV2LocksSuccess = (options?: { locks?: ApiLock[] }) => {
+  const { locks = [] } = options ?? {};
+  return http.get(cfg.api.locks.listV2, () => {
+    return HttpResponse.json(
+      {
+        items: locks,
+      },
+      { status: 200 }
+    );
+  });
+};
+
+export const listV2LocksError = (status: number, error: string | null = null) =>
+  http.get(cfg.api.locks.listV2, () => {
+    return HttpResponse.json({ error: { message: error } }, { status });
+  });
+
+export const removeLockSuccess = () => {
+  return http.delete(cfg.api.locks.delete, () => {
+    return HttpResponse.json('', { status: 200 });
+  });
+};
+
+export const createLockSuccess = (overrides?: Partial<CreateLockRequest>) => {
+  return http.put(cfg.api.locks.create, async ({ request }) => {
+    const req = (await request.clone().json()) as CreateLockRequest;
+    const {
+      targets = req.targets,
+      message = req.message,
+      ttl = req.ttl,
+    } = overrides ?? {};
+
+    const now = new Date();
+    const expires = !ttl
+      ? undefined
+      : ttl === '12h'
+        ? new Date(now.getTime() + 43200 * 1000)
+        : now;
+
+    return HttpResponse.json(
+      {
+        name: '0aac8a56-5ce0-427a-90ad-5a6973c1216e',
+        message,
+        expires: expires?.toISOString(),
+        targets,
+        createdAt: now.toISOString(),
+        createdBy: 'admin',
+      },
+      { status: 200 }
+    );
+  });
+};
diff --git a/web/packages/teleport/src/test/helpers/mfa.ts b/web/packages/teleport/src/test/helpers/mfa.ts
new file mode 100644
index 0000000000000..e10c345d47557
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/mfa.ts
@@ -0,0 +1,31 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+
+export const mfaAuthnChallengeSuccess = () =>
+  http.post(cfg.api.mfaAuthnChallengePath, () => {
+    return HttpResponse.json(
+      {
+        totp_challenge: true,
+      },
+      { status: 200 }
+    );
+  });
diff --git a/web/packages/teleport/src/test/helpers/resources.ts b/web/packages/teleport/src/test/helpers/resources.ts
new file mode 100644
index 0000000000000..64a7c647065e9
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/resources.ts
@@ -0,0 +1,120 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import {
+  ResourcesResponse,
+  UnifiedResource,
+} from 'teleport/services/agents/types';
+import { JsonObject } from 'teleport/types';
+
+// Using the path without query string params included
+const path = '/v1/webapi/sites/:clusterId/resources';
+
+export const fetchUnifiedResourcesSuccess = (opts?: {
+  response?: ResourcesResponse<UnifiedResource>;
+}) => {
+  const {
+    response = {
+      startKey: 'next',
+      totalCount: 12,
+      items: [
+        {
+          kind: 'kube_cluster',
+          name: 'kube-lon-dev-01.example.com',
+          labels: [
+            {
+              name: 'env',
+              value: 'dev',
+            },
+            {
+              name: 'region',
+              value: 'eu-west-1',
+            },
+            {
+              name: 'foo',
+              value: 'bar',
+            },
+            {
+              name: 'hello',
+              value: 'world',
+            },
+          ],
+        },
+        {
+          kind: 'kube_cluster',
+          name: 'kube-lon-prod-01.example.com',
+          labels: [
+            {
+              name: 'env',
+              value: 'prod',
+            },
+            {
+              name: 'region',
+              value: 'eu-west-1',
+            },
+          ],
+        },
+        {
+          kind: 'kube_cluster',
+          name: 'kube-lon-staging-01.example.com',
+          labels: [
+            {
+              name: 'env',
+              value: 'staging',
+            },
+            {
+              name: 'region',
+              value: 'eu-west-1',
+            },
+          ],
+        },
+        {
+          kind: 'kube_cluster',
+          name: 'kube-temp-01.example.com',
+        },
+      ],
+    },
+  } = opts ?? {};
+
+  return http.get(path, () => {
+    return HttpResponse.json(response);
+  });
+};
+
+export const fetchUnifiedResourcesError = (
+  status: number,
+  error: string | null = null,
+  extras: JsonObject = {}
+) =>
+  http.get(path, () => {
+    return HttpResponse.json(
+      { error: { message: `${status} - ${error}` }, extras },
+      { status }
+    );
+  });
+
+export const fetchUnifiedResourcesForever = () =>
+  http.get(
+    path,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
diff --git a/web/packages/teleport/src/test/helpers/tokens.ts b/web/packages/teleport/src/test/helpers/tokens.ts
new file mode 100644
index 0000000000000..69820da484600
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/tokens.ts
@@ -0,0 +1,83 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { JsonObject } from 'teleport/types';
+
+export const listV2TokensMfaError = () =>
+  http.get(cfg.api.joinToken.listV2, () => {
+    return HttpResponse.json(
+      {
+        error: { message: 'admin-level API request requires MFA verification' },
+      },
+      { status: 403 }
+    );
+  });
+
+export const listV2TokensError = (
+  status: number,
+  error: string | null = null,
+  fields: JsonObject = {}
+) =>
+  http.get(cfg.api.joinToken.listV2, () => {
+    return HttpResponse.json({ error: { message: error }, fields }, { status });
+  });
+
+export const listV2TokensSuccess = (options?: {
+  hasNextPage?: boolean;
+  tokens?: string[] | null;
+}) => {
+  const { hasNextPage = false, tokens } = options ?? {};
+  return http.get(cfg.api.joinToken.listV2, () => {
+    return HttpResponse.json(
+      {
+        items:
+          tokens === null
+            ? null
+            : (
+                tokens ?? [
+                  'token',
+                  'ec2',
+                  'iam',
+                  'github',
+                  'circleci',
+                  'kubernetes',
+                  'azure',
+                  'gitlab',
+                  'gcp',
+                  'spacelift',
+                  'tpm',
+                  'terraform_cloud',
+                  'bitbucket',
+                  'oracle',
+                  'azure_devops',
+                  'bound_keypair',
+                ]
+              ).map(method => ({
+                id: `token-${method}`,
+                safeName: method,
+                method: method,
+              })),
+        next_page_token: hasNextPage ? 'yes' : undefined,
+      },
+      { status: 200 }
+    );
+  });
+};
diff --git a/web/packages/teleport/src/test/helpers/userEvents.ts b/web/packages/teleport/src/test/helpers/userEvents.ts
new file mode 100644
index 0000000000000..525a8c97c9be3
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/userEvents.ts
@@ -0,0 +1,49 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { JsonObject } from 'teleport/types';
+
+export const userEventCaptureSuccess = () => {
+  return http.post(cfg.api.captureUserEventPath, async () => {
+    return HttpResponse.json();
+  });
+};
+
+export const userEventCaptureError = (
+  status: number,
+  error: string | null = null,
+  extras: JsonObject = {}
+) =>
+  http.post(cfg.api.captureUserEventPath, () => {
+    return HttpResponse.json(
+      { error: { message: `${status} - ${error}` }, extras },
+      { status }
+    );
+  });
+
+export const userEventCaptureForever = () =>
+  http.post(
+    cfg.api.captureUserEventPath,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
diff --git a/web/packages/teleport/src/test/helpers/users.ts b/web/packages/teleport/src/test/helpers/users.ts
index 338ca6af02248..2a6917355ed92 100644
--- a/web/packages/teleport/src/test/helpers/users.ts
+++ b/web/packages/teleport/src/test/helpers/users.ts
@@ -26,7 +26,13 @@ interface BadRequest {
   };
 }
 
+interface UsersV2Response {
+  items: User[];
+  startKey?: string;
+}
+
 const usersPath = '/v1/webapi/users';
+const usersPathV2 = '/v2/webapi/users';
 
 export function handleGetUsers(
   resolver: HttpResponseResolver<never, never, User[] | BadRequest>
@@ -34,6 +40,12 @@ export function handleGetUsers(
   return http.get(usersPath, resolver);
 }
 
+export function handleGetUsersV2(
+  resolver: HttpResponseResolver<never, never, UsersV2Response | BadRequest>
+) {
+  return http.get(usersPathV2, resolver);
+}
+
 export function handleUpdateUser(
   resolver: HttpResponseResolver<never, never, User | BadRequest>
 ) {
@@ -49,6 +61,9 @@ export function handleDeleteUser(
 export const successGetUsers = (users: User[]) =>
   handleGetUsers(() => HttpResponse.json(users));
 
+export const successGetUsersV2 = (users: User[], startKey?: string) =>
+  handleGetUsersV2(() => HttpResponse.json({ items: users, startKey }));
+
 export const errorGetUsers = (message: string) =>
   handleGetUsers(() =>
     HttpResponse.json(
diff --git a/web/packages/teleport/src/test/helpers/workloadIdentities.ts b/web/packages/teleport/src/test/helpers/workloadIdentities.ts
new file mode 100644
index 0000000000000..0c241f2358fb4
--- /dev/null
+++ b/web/packages/teleport/src/test/helpers/workloadIdentities.ts
@@ -0,0 +1,75 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+
+import cfg from 'teleport/config';
+import { ListWorkloadIdentitiesResponse } from 'teleport/services/workloadIdentity/types';
+import { JsonObject } from 'teleport/types';
+
+export const listWorkloadIdentitiesSuccess = (
+  mock: ListWorkloadIdentitiesResponse = {
+    items: [
+      {
+        name: 'test-workload-identity-1',
+        spiffe_id: '/test/spiffe/abb53fc8-eba6-40a9-8801-221db41f3c21',
+        spiffe_hint:
+          'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.',
+        labels: {
+          'test-label-1': 'test-value-1',
+          'test-label-2': 'test-value-2',
+          'test-label-3': 'test-value-3',
+        },
+      },
+      {
+        name: 'test-workload-identity-2',
+        spiffe_id: '',
+        spiffe_hint: 'This is a hint',
+        labels: {},
+      },
+      {
+        name: 'test-workload-identity-3',
+        spiffe_id: '/test/spiffe/6bfd8c2d-83eb-4a6f-97ba-f8b187f08339',
+        spiffe_hint: '',
+        labels: { 'test-label-4': 'test-value-4' },
+      },
+    ],
+    next_page_token: 'page-token-1',
+  }
+) =>
+  http.get(cfg.api.workloadIdentity.list, () => {
+    return HttpResponse.json(mock);
+  });
+
+export const listWorkloadIdentitiesForever = () =>
+  http.get(
+    cfg.api.workloadIdentity.list,
+    () =>
+      new Promise(() => {
+        /* never resolved */
+      })
+  );
+
+export const listWorkloadIdentitiesError = (
+  status: number,
+  error: string | null = null,
+  fields: JsonObject = {}
+) =>
+  http.get(cfg.api.workloadIdentity.list, () => {
+    return HttpResponse.json({ error: { message: error }, fields }, { status });
+  });
diff --git a/web/packages/teleport/src/types.ts b/web/packages/teleport/src/types.ts
index 64803537a6f71..55e80acd4e1a4 100644
--- a/web/packages/teleport/src/types.ts
+++ b/web/packages/teleport/src/types.ts
@@ -76,6 +76,7 @@ export enum NavTitle {
   TrustedDevices = 'Trusted Devices',
   AccessMonitoring = 'Access Monitoring',
   WorkloadIdentity = 'Workload Identity',
+  AccessAutomations = 'Access Automations',
 
   // Resources Requests
   NewRequest = 'New Request',
@@ -197,18 +198,23 @@ export interface FeatureFlags {
   enrollIntegrations: boolean;
   deviceTrust: boolean;
   locks: boolean;
-  newLocks: boolean;
-  tokens: boolean;
+  addLocks: boolean;
+  removeLocks: boolean;
+  createTokens: boolean;
+  listTokens: boolean;
   accessMonitoring: boolean;
   accessGraph: boolean;
   accessGraphIntegrations: boolean;
   externalAuditStorage: boolean;
   listBots: boolean;
+  readBots: boolean;
+  readBotInstances: boolean;
   listBotInstances: boolean;
   addBots: boolean;
   editBots: boolean;
   removeBots: boolean;
   gitServers: boolean;
+  listWorkloadIdentities: boolean;
 }
 
 // LockedFeatures are used for determining which features are disabled in the user's cluster.
@@ -235,3 +241,9 @@ export type WebsocketStatus = {
   status: string;
   message?: string;
 };
+
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonArray = JsonPrimitive[];
+export type JsonObject = {
+  [key: string]: JsonPrimitive | JsonArray | JsonObject;
+};
diff --git a/web/packages/teleport/src/useClusterVersion.test.tsx b/web/packages/teleport/src/useClusterVersion.test.tsx
new file mode 100644
index 0000000000000..b26a0740d902b
--- /dev/null
+++ b/web/packages/teleport/src/useClusterVersion.test.tsx
@@ -0,0 +1,62 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { renderHook } from '@testing-library/react';
+import { PropsWithChildren } from 'react';
+
+import { TeleportProviderBasic } from './mocks/providers';
+import { useClusterVersion } from './useClusterVersion';
+
+describe('useClusterVersion', () => {
+  it('should return the cluster version (auth)', () => {
+    const { result } = renderHook(() => useClusterVersion(), {
+      wrapper: Wrapper,
+    });
+    expect(result.current.clusterVersion).toBe('4.4.0-dev');
+  });
+
+  it.each`
+    clientVersion  | compatibility
+    ${'4.4.0-dev'} | ${{ isCompatible: true, reason: 'match' }}
+    ${'4.4.0'}     | ${{ isCompatible: false, reason: 'too-new' }}
+    ${'4.4.1'}     | ${{ isCompatible: false, reason: 'too-new' }}
+    ${'4.3.999'}   | ${{ isCompatible: true, reason: 'upgrade-minor' }}
+    ${'4.3.0'}     | ${{ isCompatible: true, reason: 'upgrade-minor' }}
+    ${'5.0.0'}     | ${{ isCompatible: false, reason: 'too-new' }}
+    ${'3.0.0'}     | ${{ isCompatible: true, reason: 'upgrade-major' }}
+    ${'2.0.0'}     | ${{ isCompatible: false, reason: 'too-old' }}
+  `(
+    'diff("$clientVersion") should be "$compatibility"',
+    ({ clientVersion, compatibility }) => {
+      const { result } = renderHook(() => useClusterVersion(), {
+        wrapper: Wrapper,
+      });
+      expect(result.current.checkCompatibility(clientVersion)).toStrictEqual(
+        compatibility
+      );
+    }
+  );
+});
+
+function Wrapper(props: PropsWithChildren) {
+  return (
+    <TeleportProviderBasic>
+      <div>{props.children}</div>
+    </TeleportProviderBasic>
+  );
+}
diff --git a/web/packages/teleport/src/useClusterVersion.ts b/web/packages/teleport/src/useClusterVersion.ts
new file mode 100644
index 0000000000000..e05f6acd6e1d7
--- /dev/null
+++ b/web/packages/teleport/src/useClusterVersion.ts
@@ -0,0 +1,104 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { parse } from 'shared/utils/semVer';
+
+import useTeleport from 'teleport/useTeleport';
+
+/**
+ * **useClusterVersion** returns the cluster (auth) version and a comparison
+ * utility (`checkCompatibility`). The check utility can be used to compare the
+ * providedclient version to the cluster/control-plane version. An indication
+ * of cluster compatibility is returned.
+ *
+ * @returns the cluster (auth) version and a comparison utility (diff)
+ */
+export function useClusterVersion(): {
+  clusterVersion: string;
+  /**
+   * **checkCompatibility** compares the provided client version to the cluster/
+   * control-plane version. An indication of cluster compatibility is returned.
+   * @param version the compare version as string.
+   * @returns an indication of cluster compatibility
+   */
+  checkCompatibility: (
+    clientVersion: string | undefined
+  ) => ClientCompatibility | null;
+} {
+  const ctx = useTeleport();
+  const clusterVersion = ctx.storeUser.getClusterAuthVersion();
+  return {
+    clusterVersion,
+    checkCompatibility: (clientVersion?: string) =>
+      checkClientCompatibility(clientVersion, clusterVersion),
+  };
+}
+
+export type ClientCompatibility =
+  | {
+      isCompatible: false;
+      reason: 'too-new' | 'too-old';
+    }
+  | {
+      isCompatible: true;
+      /**
+       * match - versions are the same.
+       * upgrade-major - the client is one version behind.
+       * upgrade-minor - the major version is the same, but older on minor or
+       * patch.
+       */
+      reason: 'match' | 'upgrade-major' | 'upgrade-minor';
+    }
+  | null;
+
+export function checkClientCompatibility(
+  clientVersion: string | undefined,
+  clusterVersion: string
+): ClientCompatibility {
+  const client = parse(clientVersion);
+  const cluster = parse(clusterVersion);
+  if (!client || !cluster) return null;
+  if (client.compare(cluster) === 0) {
+    return {
+      isCompatible: true,
+      reason: 'match',
+    };
+  }
+  if (client.compare(cluster) === 1) {
+    return {
+      isCompatible: false,
+      reason: 'too-new',
+    };
+  }
+  if (client.major === cluster.major) {
+    return {
+      isCompatible: true,
+      reason: 'upgrade-minor',
+    };
+  }
+  if (client.major === cluster.major - 1) {
+    return {
+      isCompatible: true,
+      reason: 'upgrade-major',
+    };
+  }
+  return {
+    isCompatible: false,
+    reason: 'too-old',
+  };
+}
diff --git a/web/packages/teleterm/README.md b/web/packages/teleterm/README.md
index 372cf63fd75eb..1296942d6b800 100644
--- a/web/packages/teleterm/README.md
+++ b/web/packages/teleterm/README.md
@@ -7,6 +7,16 @@ Teleport Connect (previously Teleport Terminal, package name `teleterm`) is a de
 Please refer to [the _Using Teleport Connect_ page from our
 docs](https://goteleport.com/docs/connect-your-client/teleport-connect/).
 
+### Limitations of the OSS version
+
+Client tools updates are disabled in this version as they are licensed under AGPL. 
+To use Community Edition builds or custom binaries, set the `TELEPORT_CDN_BASE_URL` environment variable.
+
+To use Community Edition builds, start Teleport Connect with:
+```bash
+TELEPORT_CDN_BASE_URL=https://cdn.teleport.dev
+```
+
 ## Building and packaging
 
 Teleport Connect consists of two main components: the `tsh` tool and the Electron app.
@@ -43,11 +53,8 @@ pnpm install && make build/tsh
 
 The app depends on Rust WASM code. To compile it, the following tools have to be installed:
 * `Rust` and `Cargo`. The required version is specified by `RUST_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11).
-* [`wasm-pack`](https://github.com/rustwasm/wasm-pack). The required version is specified by `WASM_PACK_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12).
-* [`binaryen`](https://github.com/WebAssembly/binaryen) which contains `wasm-opt`. This is required on on linux aarch64 (64-bit ARM).
-  You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
-To automatically install `wasm-pack`, run the following command:
+To automatically install `wasm-bindgen-cli` and `wasm-opt`, run the following command:
 ```shell
 make ensure-wasm-deps
 ```
@@ -115,9 +122,8 @@ Resulting files can be found in `sharedProcess/api/protogen`.
 On all platforms, with the exception of production builds on macOS, the `CONNECT_TSH_BIN_PATH` env
 var is used to provide the path to the tsh binary that will be included in the package.
 
-See [Teleport Connect build
-process](https://gravitational.slab.com/posts/teleport-connect-build-process-fu6da5ld) on Slab for
-bulid process documentation that is specific to Gravitational.
+See [Teleport Connect build process](https://www.notion.so/goteleport/Teleport-Connect-build-process)
+on Notion for build process documentation that is specific to Gravitational.
 
 ### Native dependencies
 
@@ -214,9 +220,8 @@ variable.
 
 Signing & notarizing is required if the application is supposed to be ran on devices other than the
 one that packaged it. See [electron-builder's docs](https://www.electron.build/code-signing) for a
-general overview and [Teleport Connect build
-process](https://gravitational.slab.com/posts/teleport-connect-build-process-fu6da5ld) Slab page for
-Gravitational-specific nuances.
+general overview and [Teleport Connect build process](https://www.notion.so/goteleport/Teleport-Connect-build-process)
+Notion page for Gravitational-specific nuances.
 
 For the most part, the device that's doing the signing & notarizing needs to have access to an Apple
 Developer ID (certificate + private key). electron-builder should automatically discover it if
@@ -229,7 +234,7 @@ be set to the account email address associated with the developer ID. `APPLE_PAS
 app-specific password](https://support.apple.com/en-us/HT204397), not the account password.
 
 The Team ID needed as an input for notarization must be provided via the `TEAMID` environment
-variable. The top-level `Makefile` exports this when `yarm package-term` is called from `make
+variable. The top-level `Makefile` exports this when `pnpm package-term` is called from `make
 release-connect` with either the developer or production Team ID depending on the `ENVIRONMENT_NAME`
 environment variable. See the top-level `darwin-signing.mk` for details.
 
diff --git a/web/packages/teleterm/build_resources/electron-publisher-custom.js b/web/packages/teleterm/build_resources/electron-publisher-custom.js
new file mode 100644
index 0000000000000..ac3e305471874
--- /dev/null
+++ b/web/packages/teleterm/build_resources/electron-publisher-custom.js
@@ -0,0 +1,7 @@
+/**
+ * A publisher class is required by `electron-updater` even when using a custom provider.
+ * Although we don't use `electron-updater` to publish updates,
+ * this config allows generating `app-update.yml` file at build time (kept in
+ * app resources), which is required at runtime by `electron-updater` to work.
+ */
+export default class Noop {}
diff --git a/web/packages/teleterm/build_resources/icon-linux/tray.png b/web/packages/teleterm/build_resources/icon-linux/tray.png
new file mode 100644
index 0000000000000..cb7eafa415379
Binary files /dev/null and b/web/packages/teleterm/build_resources/icon-linux/tray.png differ
diff --git a/web/packages/teleterm/build_resources/icon-macTemplate@2x.png b/web/packages/teleterm/build_resources/icon-macTemplate@2x.png
new file mode 100644
index 0000000000000..a889deef41536
Binary files /dev/null and b/web/packages/teleterm/build_resources/icon-macTemplate@2x.png differ
diff --git a/web/packages/teleterm/build_resources/installer.nsh b/web/packages/teleterm/build_resources/installer.nsh
index 2f3a554769166..7a1c33e159365 100644
--- a/web/packages/teleterm/build_resources/installer.nsh
+++ b/web/packages/teleterm/build_resources/installer.nsh
@@ -10,8 +10,8 @@
 # https://nsis.sourceforge.io/EnVar_plug-in
 
 !macro customInstall
-    # Make EnVar define user env vars instead of system env vars.
-    EnVar::SetHKCU
+    # Make EnVar define system env vars since Connect is installed per-machine.
+    EnVar::SetHKLM
     EnVar::AddValue "Path" $INSTDIR\resources\bin
 
     nsExec::ExecToStack '"$INSTDIR\resources\bin\tsh.exe" vnet-install-service'
@@ -25,7 +25,7 @@
 !macroend
 
 !macro customUnInstall
-    EnVar::SetHKCU
+    EnVar::SetHKLM
     # Inside the uninstaller, $INSTDIR is the directory where the uninstaller lies.
     # Fortunately, electron-builder puts the uninstaller directly into the actual installation dir.
     # https://nsis.sourceforge.io/Docs/Chapter4.html#varother
diff --git a/web/packages/teleterm/dev-app-update.yml b/web/packages/teleterm/dev-app-update.yml
new file mode 100644
index 0000000000000..38ac0d43eebf9
--- /dev/null
+++ b/web/packages/teleterm/dev-app-update.yml
@@ -0,0 +1,4 @@
+provider: custom
+# Downloads updates to <system cache dir>/teleport-connect-dev-updater directory.
+# E.g. ~/Library/Caches/teleport-connect-dev-updater on macOS.
+updaterCacheDirName: teleport-connect-dev-updater
diff --git a/web/packages/teleterm/electron-builder-config.js b/web/packages/teleterm/electron-builder-config.js
index 0281bd7876715..8c3c14721c849 100644
--- a/web/packages/teleterm/electron-builder-config.js
+++ b/web/packages/teleterm/electron-builder-config.js
@@ -1,6 +1,6 @@
 const { env, platform } = require('process');
 const fs = require('fs');
-const { spawnSync } = require('child_process');
+const { spawn } = require('child_process');
 const isMac = platform === 'darwin';
 const isWindows = platform === 'win32';
 
@@ -41,16 +41,26 @@ let tshAppPlist;
 // protocols.name below.
 const appId = 'gravitational.teleport.connect';
 
+// Remap Teleport env vars to electron-builder equivalents if they are set.
+// TEAMID is provided automatically by `make release-connect`.
+if (process.env.APPLE_USERNAME) {
+  process.env.APPLE_ID = process.env.APPLE_USERNAME;
+}
+if (process.env.APPLE_PASSWORD) {
+  process.env.APPLE_APP_SPECIFIC_PASSWORD = process.env.APPLE_PASSWORD;
+}
+if (process.env.TEAMID) {
+  process.env.APPLE_TEAM_ID = process.env.TEAMID;
+}
+
 /**
  * @type { import('electron-builder').Configuration }
  */
 module.exports = {
   appId,
   asar: true,
+  publish: [{ provider: 'custom' }],
   asarUnpack: '**\\*.{node,dll}',
-  // TODO(ravicious): Migrate from custom notarize.js script to using the notarize field of the
-  // mac target.
-  afterSign: 'notarize.js',
   afterPack: packed => {
     // @electron-universal adds the `ElectronAsarIntegrity` key to every .plist
     // file it finds, causing signature verification to fail for tsh.app that gets
@@ -99,14 +109,16 @@ module.exports = {
     },
   ],
   mac: {
-    target: 'dmg',
+    // ZIP target is used only for app updates.
+    target: ['zip', 'dmg'],
     category: 'public.app-category.developer-tools',
     type: 'distribution',
-    // TODO(ravicious): Migrate from custom notarize.js script to using the notarize field of the
-    // mac target.
-    notarize: false,
+    notarize: true,
     hardenedRuntime: true,
     gatekeeperAssess: false,
+    // Use the same entitlements for Electron subprocesses (e.g., renderer, GPU)
+    // as those defined for the main app.
+    entitlementsInherit: 'build_resources/entitlements.mac.plist',
     // If CONNECT_TSH_APP_PATH is provided, we assume that tsh.app is already signed.
     signIgnore: env.CONNECT_TSH_APP_PATH && ['tsh.app'],
     icon: 'build_resources/icon-mac.png',
@@ -132,6 +144,8 @@ module.exports = {
       },
     ].filter(Boolean),
   },
+  // Copy the tray icon to resources.
+  extraResources: ['build_resources/icon-macTemplate@2x.png'],
   dmg: {
     artifactName: '${productName}-${version}-${arch}.${ext}',
     // Turn off blockmaps since we don't support automatic updates.
@@ -156,13 +170,13 @@ module.exports = {
       // The algorithm passed here is not used, it only prevents the signing function from being called twice for each file.
       // https://github.com/electron-userland/electron-builder/issues/3995#issuecomment-505725704
       signingHashAlgorithms: ['sha256'],
-      sign: customSign => {
+      sign: async customSign => {
         if (process.env.CI !== 'true') {
           console.warn('Not running in CI pipeline: signing will be skipped');
           return;
         }
 
-        spawnSync(
+        await promisifiedSpawn(
           'powershell',
           [
             '-noprofile',
@@ -194,6 +208,8 @@ module.exports = {
         from: env.CONNECT_MSGFILE_DLL_PATH,
         to: './bin/msgfile.dll',
       },
+      // Copy the tray icon to resources.
+      'build_resources/icon-win.ico',
     ].filter(Boolean),
   },
   nsis: {
@@ -233,6 +249,8 @@ module.exports = {
         from: 'build_resources/linux/apparmor-profile',
         to: './apparmor-profile',
       },
+      // Copy the tray icon to resources.
+      'build_resources/icon-linux/tray.png',
     ].filter(Boolean),
   },
   directories: {
@@ -240,3 +258,26 @@ module.exports = {
     output: 'build/release',
   },
 };
+
+function promisifiedSpawn(cmd, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, options);
+
+    child.on('error', reject);
+
+    child.on('exit', (code, signal) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        const codeOrSignal = [
+          // code can be 0, so we cannot just check it the same way as the signal.
+          code != null && `code ${code}`,
+          signal && `signal ${signal}`,
+        ]
+          .filter(Boolean)
+          .join(' ');
+        reject(new Error(`Exited with ${codeOrSignal}`));
+      }
+    });
+  });
+}
diff --git a/web/packages/teleterm/notarize.js b/web/packages/teleterm/notarize.js
deleted file mode 100644
index dad6cfd9d9be2..0000000000000
--- a/web/packages/teleterm/notarize.js
+++ /dev/null
@@ -1,36 +0,0 @@
-const { notarize } = require('@electron/notarize');
-
-exports.default = async function notarizing(context) {
-  const { electronPlatformName, appOutDir } = context;
-  if (electronPlatformName !== 'darwin') {
-    return;
-  }
-
-  if (!process.env.APPLE_USERNAME || !process.env.APPLE_PASSWORD) {
-    console.warn(
-      'missing $APPLE_USERNAME and/or $APPLE_PASSWORD: notarization will be skipped'
-    );
-    return;
-  }
-
-  if (!process.env.TEAMID) {
-    console.warn(
-      'missing $TEAMID: notarization will be skipped. Run `make release-connect` instead'
-    );
-    return;
-  }
-
-  const appName = context.packager.appInfo.productFilename;
-  const appBundleId = context.packager.appInfo.macBundleIdentifier;
-
-  console.log('notarize.js: Notarizing in progress.');
-
-  return await notarize({
-    appBundleId,
-    appPath: `${appOutDir}/${appName}.app`,
-    appleId: process.env.APPLE_USERNAME,
-    appleIdPassword: process.env.APPLE_PASSWORD,
-    tool: 'notarytool',
-    teamId: process.env.TEAMID,
-  });
-};
diff --git a/web/packages/teleterm/package.json b/web/packages/teleterm/package.json
index f3aafa70d7cdf..991f625bb3514 100644
--- a/web/packages/teleterm/package.json
+++ b/web/packages/teleterm/package.json
@@ -26,17 +26,16 @@
   "dependencies": {
     "@grpc/grpc-js": "1.13.3",
     "@types/which": "^3.0.4",
-    "node-forge": "^1.3.1",
+    "node-forge": "^1.3.2",
     "node-pty": "1.1.0-beta34",
     "ring-buffer-ts": "^1.2.0",
     "split2": "4.2.0",
     "strip-ansi": "^7.1.0",
-    "tar-fs": "^3.0.8",
+    "tar-fs": "^3.1.1",
     "which": "^5.0.0",
     "winston": "^3.17.0"
   },
   "devDependencies": {
-    "@electron/notarize": "^3.0.1",
     "@gravitational/build": "workspace:*",
     "@gravitational/design": "workspace:*",
     "@gravitational/shared": "workspace:*",
@@ -46,16 +45,15 @@
     "@types/whatwg-url": "^13.0.0",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/xterm": "^5.5.0",
-    "electron": "36.1.0",
+    "electron": "37.6.0",
     "electron-builder": "^26.0.12",
-    "electron-vite": "^3.1.0",
+    "electron-updater": "^6.6.8",
+    "electron-vite": "^4.0.0",
     "events": "3.3.0",
-    "jest-canvas-mock": "^2.5.2",
     "react-dnd": "^14.0.4",
     "react-dnd-html5-backend": "^14.0.2",
     "whatwg-url": "^14.2.0",
-    "zod": "^3.24.4",
-    "zod-to-json-schema": "^3.24.5"
+    "zod": "^4.1.5"
   },
   "productName": "Teleport Connect"
 }
diff --git a/web/packages/teleterm/src/helpers.ts b/web/packages/teleterm/src/helpers.ts
index 207bd43271f28..f21ec32989aad 100644
--- a/web/packages/teleterm/src/helpers.ts
+++ b/web/packages/teleterm/src/helpers.ts
@@ -26,6 +26,7 @@ import { WindowsDesktop } from 'gen-proto-ts/teleport/lib/teleterm/v1/windows_de
 import {
   CheckReport,
   RouteConflictReport,
+  SSHConfigurationReport,
 } from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
 
 import {
@@ -194,3 +195,12 @@ export function reportOneOfIsRouteConflictReport(
 } {
   return report.oneofKind === 'routeConflictReport';
 }
+
+export function reportOneOfIsSSHConfigurationReport(
+  report: CheckReport['report']
+): report is {
+  oneofKind: 'sshConfigurationReport';
+  sshConfigurationReport: SSHConfigurationReport;
+} {
+  return report.oneofKind === 'sshConfigurationReport';
+}
diff --git a/web/packages/teleterm/src/main.ts b/web/packages/teleterm/src/main.ts
index a30390b31180d..8fc2912cc041b 100644
--- a/web/packages/teleterm/src/main.ts
+++ b/web/packages/teleterm/src/main.ts
@@ -16,27 +16,31 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
-import { app, dialog, globalShortcut, nativeTheme, shell } from 'electron';
+import { app, dialog, nativeTheme } from 'electron';
 
 import { CUSTOM_PROTOCOL } from 'shared/deepLinks';
+import { ensureError } from 'shared/utils/error';
 
 import { parseDeepLink } from 'teleterm/deepLinks';
 import Logger from 'teleterm/logger';
 import MainProcess from 'teleterm/mainProcess';
+import { registerNavigationHandlers } from 'teleterm/mainProcess/navigationHandler';
 import { enableWebHandlersProtection } from 'teleterm/mainProcess/protocolHandler';
-import { manageRootClusterProxyHostAllowList } from 'teleterm/mainProcess/rootClusterProxyHostAllowList';
 import { getRuntimeSettings } from 'teleterm/mainProcess/runtimeSettings';
 import { WindowsManager } from 'teleterm/mainProcess/windowsManager';
 import { createConfigService } from 'teleterm/services/config';
-import { createFileStorage } from 'teleterm/services/fileStorage';
+import { createFileStorage, FileStorage } from 'teleterm/services/fileStorage';
 import { createFileLoggerService, LoggerColor } from 'teleterm/services/logger';
 import * as types from 'teleterm/types';
+import type { StatePersistenceState } from 'teleterm/ui/services/statePersistence';
 import { assertUnreachable } from 'teleterm/ui/utils';
 
+import { setTray } from './tray';
+
 if (!app.isPackaged) {
   // Sets app name and data directories to Electron.
   // Allows running packaged and non-packaged Connect at the same time.
@@ -48,8 +52,14 @@ if (!process.defaultApp) {
   app.setAsDefaultProtocolClient(CUSTOM_PROTOCOL);
 }
 
+// Fix a bug introduced in Electron 36.
+// https://github.com/electron/electron/issues/46538#issuecomment-2808806722
+app.commandLine.appendSwitch('gtk-version', '3');
+
 if (app.requestSingleInstanceLock()) {
-  initializeApp();
+  initializeApp().catch(error =>
+    showDialogWithError('Could not initialize the app', error)
+  );
 } else {
   console.log('Attempted to open a second instance of the app, exiting.');
   // All windows will be closed immediately without asking the user,
@@ -59,10 +69,17 @@ if (app.requestSingleInstanceLock()) {
 
 async function initializeApp(): Promise<void> {
   updateSessionDataPath();
-  let devRelaunchScheduled = false;
   const settings = await getRuntimeSettings();
   const logger = initMainLogger(settings);
+
+  process.on('uncaughtException', (error, origin) => {
+    logger.error('Uncaught exception', origin, error);
+    showDialogWithError(`Uncaught exception (${origin} origin)`, error);
+    app.exit(1);
+  });
+
   logger.info(`Starting ${app.getName()} version ${app.getVersion()}`);
+
   const {
     appStateFileStorage,
     configFileStorage,
@@ -76,41 +93,65 @@ async function initializeApp(): Promise<void> {
   });
 
   nativeTheme.themeSource = configService.get('theme').value;
-  const windowsManager = new WindowsManager(appStateFileStorage, settings);
+  const windowsManager = new WindowsManager(
+    appStateFileStorage,
+    settings,
+    configService
+  );
 
-  process.on('uncaughtException', (error, origin) => {
-    logger.error(origin, error);
-    app.quit();
+  // On Windows/Linux: Re-launching the app while it's already running
+  // triggers 'second-instance' (because of app.requestSingleInstanceLock()).
+  //
+  // On macOS: Re-launching the app (from places like Finder, Spotlight, or Dock)
+  // does not trigger 'second-instance'. Instead, the system emits 'activate'.
+  // However, launching the app outside the desktop manager (e.g., from the command
+  // line) does trigger 'second-instance'.
+  app.on('second-instance', () => {
+    windowsManager.focusWindow();
+  });
+  app.on('activate', () => {
+    windowsManager.focusWindow();
   });
 
-  // init main process
-  const mainProcess = MainProcess.create({
-    settings,
-    logger,
-    configService,
-    appStateFileStorage,
-    configFileStorage,
-    windowsManager,
+  // Since setUpDeepLinks adds another listener for second-instance, it's important to call it after
+  // the listener which calls windowsManager.focusWindow. This way the focus will be brought to the
+  // window before processing the listener for deep links.
+  //
+  // This must be called as early as possible, before an async code.
+  // Otherwise, if the app is launched via a macOS deep link, the 'open-url' event may be emitted
+  // before a handler is registered, causing the link to be lost.
+  setUpDeepLinks(logger, windowsManager, settings);
+
+  const tshHome = configService.get('tshHome').value;
+  // Ensure the tsh directory exist.
+  await fs.mkdir(tshHome, {
+    recursive: true,
   });
 
-  //TODO(gzdunek): Make sure this is not needed after migrating to Vite.
-  app.on(
-    'certificate-error',
-    (event, webContents, url, error, certificate, callback) => {
-      // allow certs errors for localhost:8080
-      if (
-        settings.dev &&
-        new URL(url).host === 'localhost:8080' &&
-        error === 'net::ERR_CERT_AUTHORITY_INVALID'
-      ) {
-        event.preventDefault();
-        callback(true);
-      } else {
-        callback(false);
-        console.error(error);
-      }
-    }
-  );
+  // TODO(gzdunek): DELETE IN 20.0.0. Users should already migrate to the new location.
+  // Also remove TshHomeMigrationBanner component, relevant properties from app_state.json,
+  // and address the TODO in teleport-connect.mdx > ##Troubleshooting.
+  await migrateOldTshHomeOnce(logger, tshHome, appStateFileStorage);
+
+  let mainProcess: MainProcess;
+  try {
+    mainProcess = new MainProcess({
+      settings,
+      logger,
+      configService,
+      appStateFileStorage,
+      configFileStorage,
+      windowsManager,
+    });
+  } catch (error) {
+    const message = 'Could not initialize the main process';
+    logger.error(message, error);
+    showDialogWithError(message, error);
+    // app.exit(1) isn't equivalent to throwing an error, use an explicit return to stop further
+    // execution. See https://github.com/gravitational/teleport/issues/56272.
+    app.exit(1);
+    return;
+  }
 
   app.on('will-quit', async event => {
     event.preventDefault();
@@ -122,142 +163,36 @@ async function initializeApp(): Promise<void> {
       }
     };
 
-    globalShortcut.unregisterAll();
     await Promise.all([appStateFileStorage.write(), disposeMainProcess()]); // none of them can throw
     app.exit();
   });
 
-  app.on('quit', () => {
-    if (devRelaunchScheduled) {
-      const [bin, ...args] = process.argv;
-      const child = spawn(bin, args, {
-        env: process.env,
-        detached: true,
-        stdio: 'inherit',
-      });
-      child.unref();
-    }
-  });
-
-  app.on('second-instance', () => {
-    windowsManager.focusWindow();
-  });
-
-  // Since setUpDeepLinks adds another listener for second-instance, it's important to call it after
-  // the listener which calls windowsManager.focusWindow. This way the focus will be brought to the
-  // window before processing the listener for deep links.
-  setUpDeepLinks(logger, windowsManager, settings);
-
-  const rootClusterProxyHostAllowList = new Set<string>();
-
-  (async () => {
-    const tshdClient = await mainProcess.getTshdClient();
-
-    manageRootClusterProxyHostAllowList({
-      tshdClient,
-      logger,
-      allowList: rootClusterProxyHostAllowList,
-    });
-  })().catch(error => {
-    const message =
-      'Could not initialize tsh daemon client in the main process';
-    logger.error(message, error);
-    dialog.showErrorBox(
-      'Error during main process startup',
-      `${message}: ${error}`
+  app.on('web-contents-created', (_, webContents) => {
+    registerNavigationHandlers(
+      webContents,
+      settings,
+      mainProcess.clusterStore,
+      logger
     );
-    app.quit();
   });
 
   app
     .whenReady()
     .then(() => {
-      if (mainProcess.settings.dev) {
-        // allow restarts on F6
-        globalShortcut.register('F6', () => {
-          devRelaunchScheduled = true;
-          app.quit();
-        });
-      }
-
       enableWebHandlersProtection();
 
       windowsManager.createWindow();
+
+      if (configService.get('runInBackground').value) {
+        setTray(settings, { show: () => windowsManager.showWindow() });
+      }
     })
     .catch(error => {
-      const message = 'Could not initialize the app';
+      const message = 'Could not create the main app window';
       logger.error(message, error);
-      dialog.showErrorBox(
-        'Error during app initialization',
-        `${message}: ${error}`
-      );
-      app.quit();
-    });
-
-  // Limit navigation capabilities to reduce the attack surface.
-  // See TEL-Q122-19 from "Teleport Core Testing Q1 2022" security audit.
-  //
-  // See also points 12, 13 and 14 from the Electron's security tutorial.
-  // https://github.com/electron/electron/blob/v17.2.0/docs/tutorial/security.md#12-verify-webview-options-before-creation
-  app.on('web-contents-created', (_, contents) => {
-    contents.on('will-navigate', (event, navigationUrl) => {
-      // Allow reloading the renderer app in dev mode.
-      if (settings.dev && new URL(navigationUrl).host === 'localhost:8080') {
-        return;
-      }
-      logger.warn(`Navigation to ${navigationUrl} blocked by 'will-navigate'`);
-      event.preventDefault();
-    });
-
-    // The usage of webview is blocked by default, but let's include the handler just in case.
-    // https://github.com/electron/electron/blob/v17.2.0/docs/api/webview-tag.md#enabling
-    contents.on('will-attach-webview', (event, _, params) => {
-      logger.warn(
-        `Opening a webview to ${params.src} blocked by 'will-attach-webview'`
-      );
-      event.preventDefault();
-    });
-
-    contents.setWindowOpenHandler(details => {
-      const url = new URL(details.url);
-
-      function isUrlSafe(): boolean {
-        if (url.protocol !== 'https:') {
-          return false;
-        }
-        if (url.host === 'goteleport.com') {
-          return true;
-        }
-        if (
-          url.host === 'github.com' &&
-          url.pathname.startsWith('/gravitational/')
-        ) {
-          return true;
-        }
-
-        // Allow opening links to the Web UIs of root clusters currently added in the app.
-        if (rootClusterProxyHostAllowList.has(url.host)) {
-          return true;
-        }
-      }
-
-      // Open links to documentation and GitHub issues in the external browser.
-      // They need to have `target` set to `_blank`.
-      if (isUrlSafe()) {
-        shell.openExternal(url.toString());
-      } else {
-        logger.warn(
-          `Opening a new window to ${url} blocked by 'setWindowOpenHandler'`
-        );
-        dialog.showErrorBox(
-          'Cannot open this link',
-          'The domain does not match any of the allowed domains. Check main.log for more details.'
-        );
-      }
-
-      return { action: 'deny' };
+      showDialogWithError(message, error);
+      app.exit(1);
     });
-  });
 }
 
 /**
@@ -414,3 +349,91 @@ function launchDeepLink(
   // Otherwise the app would receive focus but nothing would be visible in the UI.
   windowsManager.launchDeepLink(result);
 }
+
+function showDialogWithError(title: string, unknownError: unknown) {
+  const error = ensureError(unknownError);
+  // V8 includes the error message in the stack, so there's no need to append stack to message.
+  const content = error.stack || error.message;
+  dialog.showErrorBox(title, content);
+}
+
+/**
+ * Migrates the old "Teleport Connect/tsh" directory to the new location
+ * ("~/.tsh" by default) by copying all files recursively.
+ * Any failure in the migration process causes an early exit and marks it as processed.
+ * Retrying on the next launch could be harmful, since the user likely already
+ * re-added their profiles.
+ */
+async function migrateOldTshHomeOnce(
+  logger: Logger,
+  tshHome: string,
+  appStorage: FileStorage
+): Promise<void> {
+  const oldTshHome = path.resolve(app.getPath('userData'), 'tsh');
+  const tshHomeMigrationKey = 'tshHomeMigration';
+  const tshMigration: TshHomeMigration =
+    appStorage.get()?.[tshHomeMigrationKey];
+  if (tshMigration?.processed) {
+    return;
+  }
+
+  const markMigrationAsProcessed = (opts?: { noOldTshHome?: boolean }) => {
+    const migrationProcessed: TshHomeMigration = { processed: true };
+    // The properties are separated, because `tshHomeMigration` should only
+    // be updated from the main process.
+    // The renderer can only update properties in the `state` key.
+    appStorage.put(tshHomeMigrationKey, migrationProcessed);
+    // Do not promote the shared tsh directory if there was nothing to migrate.
+    if (!opts?.noOldTshHome) {
+      // TODO(gzdunek): We need a better way to manage the app state.
+      const appState = (appStorage.get('state') || {}) as StatePersistenceState;
+      appState.showTshHomeMigrationBanner = true;
+      appStorage.put('state', appState);
+    }
+  };
+
+  // Check if the old directory exists.
+  try {
+    await fs.stat(oldTshHome);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      logger.info(
+        'Old tsh directory does not exist, marking migration as processed'
+      );
+      markMigrationAsProcessed({ noOldTshHome: true });
+      return;
+    }
+    logger.error('Failed to read old tsh directory', err);
+    markMigrationAsProcessed();
+    return;
+  }
+
+  // Perform the migration.
+  // The dereference option allows the source and the target to be symlinks.
+  //
+  // It may happen that the user already symlinked the global tsh home to the
+  // Electron's the home.
+  // In that case, the copy will fail with ERR_FS_CP_EINVAL error.
+  try {
+    await fs.cp(oldTshHome, tshHome, {
+      recursive: true,
+      force: true,
+      dereference: true,
+    });
+    logger.info(
+      `Successfully copied tsh home directory from ${oldTshHome} to ${tshHome}`
+    );
+  } catch (err) {
+    logger.error('Failed to copy tsh directory', err);
+  } finally {
+    markMigrationAsProcessed();
+  }
+}
+
+interface TshHomeMigration {
+  /**
+   * Indicates whether the old `tsh` directory has been migrated to the new location.
+   * `true` means the migration was attempted (successfully or not) and should not be retried.
+   */
+  processed?: boolean;
+}
diff --git a/web/packages/teleterm/src/mainProcess/agentDownloader/agentDownloader.test.ts b/web/packages/teleterm/src/mainProcess/agentDownloader/agentDownloader.test.ts
index fe333275f7a0f..5c5c47fecb737 100644
--- a/web/packages/teleterm/src/mainProcess/agentDownloader/agentDownloader.test.ts
+++ b/web/packages/teleterm/src/mainProcess/agentDownloader/agentDownloader.test.ts
@@ -63,7 +63,6 @@ const LATEST_TELEPORT_VERSIONS_MOCK = [
 beforeAll(() => {
   Logger.init(new NullService());
   // (Cannot spy the fetch property because it is not a function; undefined given instead)
-  // eslint-disable-next-line jest/prefer-spy-on
   global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       ok: true,
diff --git a/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.test.ts b/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.test.ts
new file mode 100644
index 0000000000000..5c28bc621396e
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.test.ts
@@ -0,0 +1,101 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { EventEmitter } from 'events';
+
+import Logger, { NullService } from 'teleterm/logger';
+
+import {
+  AwaitableSender,
+  MessageAcknowledgementError,
+} from './awaitableSender';
+
+beforeAll(() => {
+  Logger.init(new NullService());
+});
+
+test('starts port and add event listeners in constructor', () => {
+  const port = new MockMessagePortMain();
+  new AwaitableSender(port);
+  expect(port.listeners('message')).toHaveLength(1);
+  expect(port.listeners('close')).toHaveLength(1);
+});
+
+test('send posts message and returns a promise that resolves on ack', async () => {
+  const port = new MockMessagePortMain();
+  const sender = new AwaitableSender(port);
+
+  const payload = { foo: 'bar' };
+  const promise = sender.send(payload);
+
+  expect(port.postMessage).toHaveBeenCalledWith({
+    type: 'data',
+    id: expect.any(String),
+    payload,
+  });
+
+  // The other side responds: first emit ack for other id and then an empty message.
+  port.emitMessage({ id: 'wrong-id', type: 'ack' });
+  port.emitMessage(undefined);
+  // Wait a short time and make sure the promise hasn't resolved.
+  const result = await Promise.race([
+    promise.then(() => 'resolved'),
+    new Promise(resolve => setTimeout(() => resolve('pending'), 50)),
+  ]);
+
+  expect(result).toBe('pending');
+
+  // The other side responds again: now emit ack for our send request.
+  const correctId = port.postMessage.mock.calls[0][0].id;
+  port.emitMessage({ id: correctId, type: 'ack' });
+
+  await expect(promise).resolves.toBeUndefined();
+});
+
+test('dispose removes listeners, resolves pending messages, clears map, and resolves disposeSignal', async () => {
+  const port = new MockMessagePortMain();
+  const sender = new AwaitableSender(port);
+  let sendPromise = sender.send(undefined);
+
+  port.close();
+  expect(port.listeners('message')).toHaveLength(0);
+  expect(port.listeners('close')).toHaveLength(0);
+
+  const disposedPromise = sender.whenDisposed();
+
+  // The pending send promise should resolve after dispose
+  await expect(sendPromise).rejects.toThrow(MessageAcknowledgementError);
+  await expect(disposedPromise).resolves.toBeUndefined();
+});
+
+class MockMessagePortMain extends EventEmitter {
+  public postMessage = jest.fn();
+  public start = jest.fn();
+
+  constructor() {
+    super();
+  }
+
+  emitMessage(data: unknown): void {
+    this.emit('message', { data });
+  }
+
+  close(): void {
+    this.emit('close');
+  }
+}
diff --git a/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.ts b/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.ts
new file mode 100644
index 0000000000000..089534fd162f3
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/awaitableSender/awaitableSender.ts
@@ -0,0 +1,160 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { MessageEvent, MessagePortMain } from 'electron';
+
+export type Message = MessageData | MessageAck;
+
+export interface MessageData {
+  id: string;
+  type: 'data';
+  payload: unknown;
+}
+
+export interface MessageAck {
+  id: string;
+  type: 'ack';
+  /**
+   * Optional error.
+   * Present when the renderer received the message, but failed to process it.
+   */
+  error?: unknown;
+}
+
+function isMessageAck(v: unknown): v is MessageAck {
+  return typeof v === 'object' && 'type' in v && v.type === 'ack';
+}
+
+export interface IAwaitableSender<T> {
+  send(payload: T, options?: { signal?: AbortSignal }): Promise<void>;
+  whenDisposed(): Promise<void>;
+}
+
+/**
+ * Enables sending messages from the main process to the renderer
+ * and awaiting delivery confirmation.
+ *
+ * Unlike the standard `webContents.send()` API, which is push-based,
+ * `AwaitableSender` is pull-based — the renderer must explicitly subscribe
+ * to receive messages.
+ */
+export class AwaitableSender<T> implements IAwaitableSender<T> {
+  private messages = new Map<
+    string,
+    { resolve(): void; reject(reason: unknown): void }
+  >();
+  private disposeSignal = Promise.withResolvers<void>();
+
+  constructor(private port: MessagePortMain) {
+    this.port.start();
+    this.port.on('message', this.processMessage);
+    this.port.on('close', this.dispose);
+  }
+
+  /**
+   * Sends a message and awaits delivery confirmation from the receiver.
+   *
+   * This method returns a promise that resolves once the other side
+   * acknowledges receiving and processing the message.
+   * If the acknowledgment is not received within the specified timeout
+   * (default 10 seconds), the promise rejects with a `MessageAcknowledgementError`.
+   *
+   * If the renderer received the message, but failed to process it, the promise
+   * is also rejected.
+   */
+  send(
+    payload: T,
+    { signal = AbortSignal.timeout(10_000) }: { signal?: AbortSignal } = {}
+  ): Promise<void> {
+    const id = crypto.randomUUID();
+
+    return new Promise((resolve, reject) => {
+      const cleanup = () => {
+        this.messages.delete(id);
+        signal.removeEventListener('abort', abort);
+      };
+
+      const abort = () => {
+        cleanup();
+        reject(new MessageAcknowledgementError(signal.reason));
+      };
+
+      if (signal.aborted) {
+        return abort();
+      }
+
+      signal.addEventListener('abort', abort, { once: true });
+
+      this.messages.set(id, {
+        resolve: () => {
+          cleanup();
+          resolve();
+        },
+        reject: reason => {
+          cleanup();
+          reject(reason);
+        },
+      });
+
+      const message: MessageData = { type: 'data', id, payload };
+      this.port.postMessage(message);
+    });
+  }
+
+  /** Returns a promise that resolves when the sender is disposed. */
+  whenDisposed(): Promise<void> {
+    return this.disposeSignal.promise;
+  }
+
+  private processMessage = (event: MessageEvent): void => {
+    const message = event.data;
+    // Only to satisfy TypeScript.
+    // We don't expect non-ack messages to be received on this port.
+    if (!isMessageAck(message)) {
+      return;
+    }
+    const item = this.messages.get(message.id);
+    if (!item) {
+      return;
+    }
+    if (message.error) {
+      item.reject(message.error);
+      return;
+    }
+    item.resolve();
+  };
+
+  private dispose = (): void => {
+    this.port.off('message', this.processMessage);
+    this.port.off('close', this.dispose);
+
+    for (const { reject } of this.messages.values()) {
+      reject(new MessageAcknowledgementError(new Error('Sender was disposed')));
+    }
+    this.disposeSignal.resolve();
+  };
+}
+
+/** Error thrown when waiting for message acknowledgement confirmation was abandoned. */
+export class MessageAcknowledgementError extends Error {
+  constructor(cause?: unknown) {
+    super('Failed to receive message acknowledgement from the renderer', {
+      cause,
+    });
+  }
+}
diff --git a/web/packages/teleterm/src/mainProcess/awaitableSender/index.ts b/web/packages/teleterm/src/mainProcess/awaitableSender/index.ts
new file mode 100644
index 0000000000000..53610a590dc63
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/awaitableSender/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './awaitableSender';
diff --git a/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.test.ts b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.test.ts
new file mode 100644
index 0000000000000..fe6036c2a03f6
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.test.ts
@@ -0,0 +1,352 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { enablePatches } from 'immer';
+
+import Logger, { NullService } from 'teleterm/logger';
+import { IAwaitableSender } from 'teleterm/mainProcess/awaitableSender';
+import { ClusterStore } from 'teleterm/mainProcess/clusterStore';
+import { ProfileChangeSet } from 'teleterm/mainProcess/profileWatcher';
+import { RendererIpc } from 'teleterm/mainProcess/types';
+import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
+import { MockTshClient } from 'teleterm/services/tshd/fixtures/mocks';
+import {
+  makeLoggedInUser,
+  makeRootCluster,
+} from 'teleterm/services/tshd/testHelpers';
+
+import {
+  ClusterLifecycleEvent,
+  ClusterLifecycleManager,
+} from './clusterLifecycleManager';
+
+beforeAll(() => {
+  Logger.init(new NullService());
+});
+
+enablePatches();
+
+const cluster = makeRootCluster();
+
+const tests: {
+  name: string;
+  setup(opts: { tshdClient: MockTshClient }): Promise<{
+    profileWatcher: () => AsyncGenerator<ProfileChangeSet, void, void>;
+    throwInRendererHandler?: boolean;
+  }>;
+  expect(opts: {
+    clusterStore: ClusterStore;
+    tshdClient: MockTshClient;
+    rendererHandler: IAwaitableSender<ClusterLifecycleEvent>;
+    globalErrorHandler: jest.Mock;
+  }): void;
+}[] = [
+  {
+    name: 'when cluster is added, it updates state and notifies renderer',
+    setup: async () => {
+      return {
+        profileWatcher: makeWatcher([{ op: 'added', cluster }]),
+      };
+    },
+    expect: ({ clusterStore, rendererHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri)).toBeDefined();
+      expect(rendererHandler.send).toHaveBeenCalledWith({
+        op: 'did-add-cluster',
+        uri: cluster.uri,
+      });
+    },
+  },
+  {
+    name: 'when cluster is added and renderer fails, it updates state and reports an error',
+    setup: async () => {
+      return {
+        throwInRendererHandler: true,
+        profileWatcher: makeWatcher([{ op: 'added', cluster }]),
+      };
+    },
+    expect: ({ clusterStore, globalErrorHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri)).toBeDefined();
+      expect(globalErrorHandler).toHaveBeenCalledWith(
+        RendererIpc.ProfileWatcherError,
+        {
+          error: new Error('Error in renderer'),
+          reason: 'processing-error',
+        }
+      );
+    },
+  },
+  {
+    name: 'when cluster is removed, it updates state and notifies renderer',
+    setup: async ({ tshdClient }) => {
+      jest.spyOn(tshdClient, 'logout');
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      return {
+        profileWatcher: makeWatcher([{ op: 'removed', cluster }]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, rendererHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri)).toBeUndefined();
+      expect(tshdClient.logout).toHaveBeenCalledWith({
+        clusterUri: cluster.uri,
+        removeProfile: true,
+      });
+      expect(rendererHandler.send).toHaveBeenCalledWith({
+        op: 'will-logout-and-remove',
+        uri: cluster.uri,
+      });
+    },
+  },
+  {
+    name: 'when cluster is removed and renderer fails, it keeps the cluster and reports an error',
+    setup: async ({ tshdClient }) => {
+      jest.spyOn(tshdClient, 'logout');
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      return {
+        throwInRendererHandler: true,
+        profileWatcher: makeWatcher([{ op: 'removed', cluster }]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, globalErrorHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri)).toBeDefined();
+      expect(tshdClient.logout).not.toHaveBeenCalled();
+      expect(globalErrorHandler).toHaveBeenCalledWith(
+        RendererIpc.ProfileWatcherError,
+        {
+          error: new Error('Error in renderer'),
+          reason: 'processing-error',
+        }
+      );
+    },
+  },
+  {
+    name: 'when cluster becomes logged-out, it updates state and notifies renderer',
+    setup: async ({ tshdClient }) => {
+      const next = makeRootCluster({
+        connected: false,
+        loggedInUser: makeLoggedInUser({ name: '' }),
+      });
+      jest.spyOn(tshdClient, 'logout');
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      return {
+        profileWatcher: makeWatcher([
+          { op: 'changed', next, previous: cluster },
+        ]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, rendererHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri).loggedInUser.name).toBe(
+        ''
+      );
+      expect(tshdClient.logout).toHaveBeenCalledWith({
+        clusterUri: cluster.uri,
+        removeProfile: false,
+      });
+      expect(rendererHandler.send).toHaveBeenCalledWith({
+        op: 'will-logout',
+        uri: cluster.uri,
+      });
+    },
+  },
+  {
+    name: 'when cluster becomes logged-out and renderer fails, it keeps logged-in state and reports an error',
+    setup: async ({ tshdClient }) => {
+      const next = makeRootCluster({
+        connected: false,
+        loggedInUser: makeLoggedInUser({ name: '' }),
+      });
+      jest.spyOn(tshdClient, 'logout');
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      return {
+        throwInRendererHandler: true,
+        profileWatcher: makeWatcher([
+          { op: 'changed', next, previous: cluster },
+        ]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, globalErrorHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri).loggedInUser.name).toBe(
+        cluster.loggedInUser.name
+      );
+      expect(tshdClient.logout).not.toHaveBeenCalled();
+      expect(globalErrorHandler).toHaveBeenCalledWith(
+        RendererIpc.ProfileWatcherError,
+        {
+          error: new Error('Error in renderer'),
+          reason: 'processing-error',
+        }
+      );
+    },
+  },
+  {
+    name: 'when cluster changes, it updates state and clears stale clients',
+    setup: async ({ tshdClient }) => {
+      const next = makeRootCluster({
+        connected: false,
+      });
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      jest.spyOn(tshdClient, 'clearStaleClusterClients');
+      return {
+        profileWatcher: makeWatcher([
+          { op: 'changed', next, previous: cluster },
+        ]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, rendererHandler }) => {
+      expect(clusterStore.getState().get(cluster.uri).connected).toBe(false);
+      expect(tshdClient.clearStaleClusterClients).toHaveBeenCalledWith({
+        rootClusterUri: cluster.uri,
+      });
+      expect(rendererHandler.send).not.toHaveBeenCalled();
+    },
+  },
+  {
+    name: 'when access of logged in user changes, it updates state, clears stale clients, and notifies renderer',
+    setup: async ({ tshdClient }) => {
+      const next = makeRootCluster({
+        loggedInUser: makeLoggedInUser({ activeRequests: ['abcd'] }),
+      });
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      jest.spyOn(tshdClient, 'clearStaleClusterClients');
+      return {
+        profileWatcher: makeWatcher([
+          { op: 'changed', next, previous: cluster },
+        ]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, rendererHandler }) => {
+      expect(
+        clusterStore.getState().get(cluster.uri).loggedInUser.activeRequests
+      ).toEqual(['abcd']);
+      expect(tshdClient.clearStaleClusterClients).toHaveBeenCalledWith({
+        rootClusterUri: cluster.uri,
+      });
+      expect(rendererHandler.send).toHaveBeenCalledWith({
+        op: 'did-change-access',
+        uri: cluster.uri,
+      });
+    },
+  },
+  {
+    name: 'when access of logged in user changes and renderer fails, it updates state, clears stale clients and reports error',
+    setup: async ({ tshdClient }) => {
+      const next = makeRootCluster({
+        loggedInUser: makeLoggedInUser({ activeRequests: ['abcd'] }),
+      });
+      jest
+        .spyOn(tshdClient, 'listRootClusters')
+        .mockResolvedValue(new MockedUnaryCall({ clusters: [cluster] }));
+      jest.spyOn(tshdClient, 'clearStaleClusterClients');
+      return {
+        throwInRendererHandler: true,
+        profileWatcher: makeWatcher([
+          { op: 'changed', next, previous: cluster },
+        ]),
+      };
+    },
+    expect: ({ clusterStore, tshdClient, globalErrorHandler }) => {
+      expect(
+        clusterStore.getState().get(cluster.uri).loggedInUser.activeRequests
+      ).toEqual(['abcd']);
+      expect(tshdClient.clearStaleClusterClients).toHaveBeenCalledWith({
+        rootClusterUri: cluster.uri,
+      });
+      expect(globalErrorHandler).toHaveBeenCalledWith(
+        RendererIpc.ProfileWatcherError,
+        {
+          error: new Error('Error in renderer'),
+          reason: 'processing-error',
+        }
+      );
+    },
+  },
+];
+
+// eslint-disable-next-line jest/expect-expect
+test.each(tests)('$name', async ({ setup, expect: testExpect }) => {
+  const mockTshdClient = new MockTshClient();
+  const mockAppUpdater = {
+    maybeRemoveManagingCluster: jest.fn().mockResolvedValue(undefined),
+  };
+  const clusterStore = new ClusterStore(async () => mockTshdClient, {
+    crashWindow: async () => {},
+  });
+  const globalErrorHandler = jest.fn();
+  const windowsManager = {
+    getWindow: () => ({
+      webContents: {
+        send: globalErrorHandler,
+      },
+    }),
+  };
+  const { profileWatcher, throwInRendererHandler } = await setup({
+    tshdClient: mockTshdClient,
+  });
+
+  const done = Promise.withResolvers<void>();
+  const consumer = (async function* () {
+    try {
+      for await (const value of profileWatcher()) {
+        yield value;
+      }
+    } finally {
+      done.resolve();
+    }
+  })();
+
+  const manager = new ClusterLifecycleManager(
+    clusterStore,
+    async () => mockTshdClient,
+    mockAppUpdater,
+    windowsManager,
+    consumer
+  );
+  const mockRendererHandler = {
+    send: throwInRendererHandler
+      ? jest.fn().mockRejectedValue(new Error('Error in renderer'))
+      : jest.fn().mockResolvedValue(undefined),
+    whenDisposed: () => new Promise<void>(() => {}),
+  };
+  manager.setRendererEventHandler(mockRendererHandler);
+  await manager.syncRootClustersAndStartProfileWatcher();
+  await done.promise;
+
+  testExpect({
+    globalErrorHandler,
+    clusterStore,
+    tshdClient: mockTshdClient,
+    rendererHandler: mockRendererHandler,
+  });
+});
+
+function makeWatcher(...events: ProfileChangeSet[]) {
+  return async function* () {
+    yield* events;
+  };
+}
diff --git a/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.ts b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.ts
new file mode 100644
index 0000000000000..e08d75d53dfa4
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/clusterLifecycleManager.ts
@@ -0,0 +1,319 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  Cluster,
+  LoggedInUser,
+} from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+
+import Logger from 'teleterm/logger';
+import type { IAwaitableSender } from 'teleterm/mainProcess/awaitableSender';
+import { RendererIpc } from 'teleterm/mainProcess/types';
+import { AppUpdater } from 'teleterm/services/appUpdater';
+import { isTshdRpcError, TshdClient } from 'teleterm/services/tshd';
+import { mergeClusterProfileWithDetails } from 'teleterm/services/tshd/cluster';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+import { ClusterStore } from '../clusterStore';
+import { ProfileChangeSet } from '../profileWatcher';
+
+/** Describes a lifecycle event related to a cluster. */
+export interface ClusterLifecycleEvent {
+  uri: RootClusterUri;
+  /**
+   * The lifecycle operation type.
+   *
+   * Operations prefixed with `will-` occur before the corresponding action
+   * in the main process and can interrupt it when they return an error.
+   *
+   * Operations prefixed with `did-` occur after the action has already happened
+   * in the main process, so they cannot prevent it.
+   *
+   * Operation meanings:
+   * * did-add-cluster - A cluster has been successfully added.
+   * * did-change-access - The logged-in user has changed, or their roles,
+   * or access requests have been updated.
+   * * will-logout - The user is about to be logged out.
+   * * will-logout-and-remove - The user is about to be logged out
+   * and their profile (cluster) will be removed.
+   */
+  op:
+    | 'did-add-cluster'
+    | 'did-change-access'
+    | 'will-logout'
+    | 'will-logout-and-remove';
+}
+
+export interface ProfileWatcherError {
+  error: unknown;
+  reason: 'processing-error' | 'exited';
+}
+
+interface WindowsManager {
+  getWindow(): {
+    webContents: { send(channel: string, ...args: any[]): void };
+  };
+}
+
+/**
+ * Manages the lifecycle of clusters by handling both UI actions that update them
+ * (e.g., adding a cluster, logging out) and profile watcher events.
+ *
+ * When handling an action or event requires additional work on the renderer side
+ * (for example, cleaning up before logging out), a handler registered
+ * in `rendererEventHandler` is invoked.
+ * Then, the cluster store is updated (the exact order of these steps depends
+ * on the specific case).
+ *
+ * It is important to always call a method of `ClusterLifecycleManager` rather
+ * than interacting directly with `ClusterStore` whenever the action involves
+ * additional work on the renderer side.
+ */
+export class ClusterLifecycleManager {
+  private readonly logger = new Logger('ClusterLifecycleManager');
+  private rendererEventHandler:
+    | IAwaitableSender<ClusterLifecycleEvent>
+    | undefined;
+  private watcherStarted = false;
+
+  constructor(
+    private readonly clusterStore: ClusterStore,
+    private readonly getTshdClient: () => Promise<TshdClient>,
+    private readonly appUpdater: Pick<AppUpdater, 'maybeRemoveManagingCluster'>,
+    private readonly windowsManager: WindowsManager,
+    private readonly profileWatcher: AsyncIterable<ProfileChangeSet>
+  ) {}
+
+  setRendererEventHandler(
+    handler: IAwaitableSender<ClusterLifecycleEvent>
+  ): void {
+    if (this.rendererEventHandler) {
+      this.logger.error(
+        'Only one renderer lifecycle event handler can be registered at a time'
+      );
+      return;
+    }
+
+    this.logger.info('Renderer lifecycle event handler registered');
+    this.rendererEventHandler = handler;
+    this.rendererEventHandler.whenDisposed().then(() => {
+      this.logger.info('Renderer lifecycle event handler unregistered');
+      this.rendererEventHandler = undefined;
+    });
+  }
+
+  async addCluster(proxyAddress: string): Promise<Cluster> {
+    const cluster = await this.clusterStore.add(proxyAddress);
+    await this.rendererEventHandler.send({
+      op: 'did-add-cluster',
+      uri: cluster.uri,
+    });
+    return cluster;
+  }
+
+  async logoutAndRemoveCluster(uri: RootClusterUri): Promise<void> {
+    await this.rendererEventHandler.send({ op: 'will-logout-and-remove', uri });
+    this.onBeforeRemove(uri);
+    await this.clusterStore.logoutAndRemove(uri);
+  }
+
+  async syncCluster(uri: RootClusterUri): Promise<void> {
+    const { previous, next } = await this.clusterStore.sync(uri);
+    if (!hasAccessChanged(previous.loggedInUser, next.loggedInUser)) {
+      return;
+    }
+
+    await this.rendererEventHandler.send({
+      op: 'did-change-access',
+      uri: next.uri,
+    });
+  }
+
+  async syncRootClustersAndStartProfileWatcher(): Promise<void> {
+    await this.clusterStore.syncRootClusters();
+    if (!this.watcherStarted) {
+      this.watcherStarted = true;
+      void this.watchProfileChanges();
+    }
+  }
+
+  private onBeforeRemove(uri: RootClusterUri): void {
+    // Do not wait for this promise to finish as we don't want to block logout
+    // on checking app updates.
+    this.appUpdater.maybeRemoveManagingCluster(uri).catch(error => {
+      this.logger.error('Failed to remove managing cluster', error);
+    });
+  }
+
+  /**
+   * If the cluster is connected, try to sync it to get the full profile with details.
+   * Otherwise, update the cluster with the profile read from disk.
+   */
+  private async syncOrUpdateCluster(cluster: Cluster): Promise<void> {
+    if (cluster.connected) {
+      try {
+        await this.clusterStore.sync(cluster.uri);
+      } catch (e) {
+        // Theoretically, the cert could just expire and result in an error
+        // resolvable with relogin when trying to sync the cluster.
+        // In that case, only update the store.
+        if (!(isTshdRpcError(e) && e.isResolvableWithRelogin)) {
+          throw e;
+        }
+      }
+    }
+    const existing = this.clusterStore.getState().get(cluster.uri);
+    await this.clusterStore.set(
+      mergeClusterProfileWithDetails({
+        profile: cluster,
+        details: existing || Cluster.create(),
+      })
+    );
+  }
+
+  /**
+   * Watches for changes in the `tsh` directory.
+   *
+   * Some file system events require notifying the renderer (e.g., to
+   * remove a workspace before a cluster store update is sent).
+   */
+  private async watchProfileChanges(): Promise<void> {
+    try {
+      for await (const changes of this.profileWatcher) {
+        this.logger.info('Detected profile changes', changes);
+
+        for (const change of changes) {
+          try {
+            switch (change.op) {
+              case 'added':
+                await this.handleClusterAdded(change.cluster);
+                break;
+              case 'changed':
+                await this.handleClusterChanged(change.previous, change.next);
+                break;
+              case 'removed':
+                await this.handleClusterRemoved(change.cluster);
+                break;
+            }
+          } catch (error) {
+            this.logger.error('Error while processing cluster event', error);
+            this.handleWatcherError({ error, reason: 'processing-error' });
+          }
+        }
+      }
+    } catch (error) {
+      this.logger.error('Profile watcher exited with error', error);
+      this.handleWatcherError({ error, reason: 'exited' });
+    }
+  }
+
+  private async handleClusterAdded(cluster: Cluster): Promise<void> {
+    await this.syncOrUpdateCluster(cluster);
+    await this.rendererEventHandler.send({
+      op: 'did-add-cluster',
+      uri: cluster.uri,
+    });
+  }
+
+  private async handleClusterChanged(
+    previous: Cluster,
+    next: Cluster
+  ): Promise<void> {
+    const wasLoggedIn = previous.loggedInUser?.name;
+    const isLoggedIn = next.loggedInUser?.name;
+    const hasLoggedOut = wasLoggedIn && !isLoggedIn;
+
+    if (hasLoggedOut) {
+      await this.handleClusterLogout(next);
+      return;
+    }
+
+    const client = await this.getTshdClient();
+    // Only clear clients with outdated certificates.
+    // The watcher 'changed' event may be emitted right after the user logs in
+    // or assumes a role via Connect (which already closes all clients
+    // for the profile), so we avoid closing them again if they're already up to date.
+    //
+    // This needs to be done before the check for changed access. It handles a scenario where the
+    // user logged in again via tsh and the auth server has disconnect_expired_cert enabled.
+    await client.clearStaleClusterClients({ rootClusterUri: next.uri });
+    await this.syncOrUpdateCluster(next);
+
+    if (!hasAccessChanged(previous.loggedInUser, next.loggedInUser)) {
+      return;
+    }
+    await this.rendererEventHandler.send({
+      op: 'did-change-access',
+      uri: next.uri,
+    });
+  }
+
+  private async handleClusterRemoved(cluster: Cluster): Promise<void> {
+    await this.rendererEventHandler.send({
+      op: 'will-logout-and-remove',
+      uri: cluster.uri,
+    });
+    this.onBeforeRemove(cluster.uri);
+    await this.clusterStore.logoutAndRemove(cluster.uri);
+  }
+
+  private async handleClusterLogout(cluster: Cluster): Promise<void> {
+    await this.rendererEventHandler.send({
+      op: 'will-logout',
+      uri: cluster.uri,
+    });
+    const client = await this.getTshdClient();
+    await client.logout({ clusterUri: cluster.uri, removeProfile: false });
+    await this.syncOrUpdateCluster(cluster);
+  }
+
+  private handleWatcherError(error: ProfileWatcherError): void {
+    this.windowsManager
+      .getWindow()
+      .webContents.send(RendererIpc.ProfileWatcherError, error);
+  }
+}
+
+/**
+ * Checks if the username, roles or active requests changed.
+ * If yes, then probably the user has access to different resources.
+ */
+function hasAccessChanged(
+  previousUser: LoggedInUser | undefined,
+  nextUser: LoggedInUser | undefined
+): boolean {
+  // No user, we don't know if access changed.
+  if (!(previousUser?.name && nextUser?.name)) {
+    return false;
+  }
+
+  const hasChangedUsername = previousUser.name !== nextUser.name;
+  const hasChangedRoles = !areArraysEqual(previousUser.roles, nextUser.roles);
+  const hasChangedActiveRequests = !areArraysEqual(
+    previousUser.activeRequests,
+    nextUser.activeRequests
+  );
+
+  return hasChangedUsername || hasChangedRoles || hasChangedActiveRequests;
+}
+
+function areArraysEqual(a: string[], b: string[]): boolean {
+  const aSet = new Set(a);
+  const bSet = new Set(b);
+  return aSet.size === bSet.size && aSet.isSubsetOf(bSet);
+}
diff --git a/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/index.ts b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/index.ts
new file mode 100644
index 0000000000000..a1e42e6988ce1
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterLifecycleManager/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './clusterLifecycleManager';
diff --git a/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.test.ts b/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.test.ts
new file mode 100644
index 0000000000000..642a3dccf2ba8
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.test.ts
@@ -0,0 +1,118 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { enableMapSet, enablePatches } from 'immer';
+
+import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
+import { MockTshClient } from 'teleterm/services/tshd/fixtures/mocks';
+import {
+  makeLeafCluster,
+  makeRootCluster,
+} from 'teleterm/services/tshd/testHelpers';
+
+import { ClusterStore } from './clusterStore';
+
+enablePatches();
+enableMapSet();
+
+const cluster = makeRootCluster({ connected: false });
+const clusterWithDetails = makeRootCluster({
+  ...cluster,
+  connected: true,
+  features: {
+    advancedAccessWorkflows: true,
+    isUsageBasedBilling: true,
+  },
+});
+const leafCluster = makeLeafCluster();
+const mockWindowsManager = {
+  crashWindow: async () => undefined,
+};
+
+test('adds cluster', async () => {
+  const mockClient = new MockTshClient();
+  mockClient.addCluster = () => new MockedUnaryCall(cluster);
+  const clusterStore = new ClusterStore(
+    () => Promise.resolve(mockClient),
+    mockWindowsManager
+  );
+
+  await clusterStore.add(cluster.uri);
+
+  const state = clusterStore.getState();
+  expect(state.get(cluster.uri)).toEqual(cluster);
+});
+
+test('adding a cluster does not overwrite an existing one', async () => {
+  const mockClient = new MockTshClient();
+  mockClient.addCluster = () => new MockedUnaryCall(cluster);
+  mockClient.getCluster = () => new MockedUnaryCall(clusterWithDetails);
+  const clusterStore = new ClusterStore(
+    () => Promise.resolve(mockClient),
+    mockWindowsManager
+  );
+
+  await clusterStore.sync(cluster.uri);
+  // addCluster call returns fewer details than getCluster,
+  // so clusterStore.add shouldn't overwrite details already acquired
+  // by clusterStore.sync.
+  await clusterStore.add(cluster.uri);
+
+  const state = clusterStore.getState();
+  expect(state.get(cluster.uri)).toEqual(clusterWithDetails);
+});
+
+test('syncs cluster', async () => {
+  const mockClient = new MockTshClient();
+  mockClient.getCluster = () => new MockedUnaryCall(clusterWithDetails);
+  mockClient.listLeafClusters = () =>
+    new MockedUnaryCall({ clusters: [leafCluster] });
+  const clusterStore = new ClusterStore(
+    () => Promise.resolve(mockClient),
+    mockWindowsManager
+  );
+
+  await clusterStore.sync(cluster.uri);
+
+  const state = clusterStore.getState();
+  expect(state.get(clusterWithDetails.uri)).toStrictEqual(clusterWithDetails);
+  expect(state.get(leafCluster.uri)).toStrictEqual(leafCluster);
+});
+
+test('logs out of cluster', async () => {
+  const mockClient = new MockTshClient();
+  mockClient.getCluster = () => new MockedUnaryCall(clusterWithDetails);
+  mockClient.listLeafClusters = () =>
+    new MockedUnaryCall({ clusters: [leafCluster] });
+  const logoutMock = jest.spyOn(mockClient, 'logout');
+  const clusterStore = new ClusterStore(
+    () => Promise.resolve(mockClient),
+    mockWindowsManager
+  );
+  await clusterStore.sync(cluster.uri);
+
+  await clusterStore.logoutAndRemove(cluster.uri);
+
+  expect(logoutMock).toHaveBeenCalledWith({
+    clusterUri: cluster.uri,
+    removeProfile: true,
+  });
+  const state = clusterStore.getState();
+  expect(state.get(clusterWithDetails.uri)).toBeUndefined();
+  expect(state.get(leafCluster.uri)).toBeUndefined();
+});
diff --git a/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.ts b/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.ts
new file mode 100644
index 0000000000000..83d5ef65c5ccf
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterStore/clusterStore.ts
@@ -0,0 +1,234 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Patch, Producer, produceWithPatches } from 'immer';
+
+import {
+  Cluster,
+  ShowResources,
+} from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+
+import Logger from 'teleterm/logger';
+import { TshdClient } from 'teleterm/services/tshd';
+import { ClusterUri, RootClusterUri, routing } from 'teleterm/ui/uri';
+
+import { AwaitableSender } from '../awaitableSender';
+import type { WindowsManager } from '../windowsManager';
+
+export type State = ReadonlyMap<ClusterUri, Cluster>;
+
+export type ClusterStoreUpdate =
+  /**
+   * Patches allow the other side to keep reference stability
+   * so that not the whole state is recreated.
+   */
+  | { kind: 'patches'; value: Patch[] }
+  /** The full state, useful to get the initial state on the other side. */
+  | { kind: 'state'; value: State };
+
+export class ClusterStore {
+  private senders = new Set<AwaitableSender<ClusterStoreUpdate>>();
+  private state: State = new Map();
+  private logger = new Logger('ClusterStore');
+
+  constructor(
+    private readonly getTshdClient: () => Promise<TshdClient>,
+    private readonly windowsManager: Pick<WindowsManager, 'crashWindow'>
+  ) {}
+
+  /**
+   * Adds a cluster.
+   * Should only be called via ClusterLifecycleManager.
+   */
+  async add(proxyAddress: string): Promise<Cluster> {
+    const client = await this.getTshdClient();
+    const { response } = await client.addCluster({
+      name: proxyAddress,
+    });
+
+    await this.update(draft => {
+      // Do not overwrite the existing cluster;
+      // otherwise we may lose properties fetched from the auth server.
+      // Consider separating properties read from profile and those
+      // fetched from the auth server at the RPC message level.
+      if (draft.has(response.uri)) {
+        return;
+      }
+      draft.set(response.uri, response);
+    });
+
+    return response;
+  }
+
+  /**
+   * Logs out of the cluster and removes its profile.
+   * Should only be called via ClusterLifecycleManager.
+   */
+  async logoutAndRemove(uri: RootClusterUri): Promise<void> {
+    const client = await this.getTshdClient();
+    await client.logout({ clusterUri: uri, removeProfile: true });
+    await this.update(draft => {
+      for (let d of draft.values()) {
+        if (routing.belongsToProfile(uri, d.uri)) {
+          draft.delete(d.uri);
+        }
+      }
+    });
+  }
+
+  /**
+   * Synchronizes the root clusters.
+   * Does not make a network call, only reads profiles from the disk.
+   */
+  async syncRootClusters(): Promise<void> {
+    const client = await this.getTshdClient();
+    const { response } = await client.listRootClusters({});
+    await this.update(draft => {
+      draft.clear();
+      response.clusters.forEach(cluster => {
+        draft.set(cluster.uri, cluster);
+      });
+    });
+  }
+
+  /**
+   * Synchronizes the root cluster and returns its state before and after the update.
+   * Makes network calls to get cluster details and its leaf clusters.
+   * Should only be called via ClusterLifecycleManager.
+   */
+  async sync(
+    uri: RootClusterUri
+  ): Promise<{ previous: Cluster | undefined; next: Cluster }> {
+    let cluster: Cluster;
+    let leafs: Cluster[];
+    const client = await this.getTshdClient();
+    try {
+      const clusterAndLeafs = await getClusterAndLeafs(client, uri);
+      cluster = clusterAndLeafs.cluster;
+      leafs = clusterAndLeafs.leafs;
+    } catch (error) {
+      await this.update(draft => {
+        const cluster = draft.get(uri);
+        if (cluster) {
+          // TODO(gzdunek): We should rather store the cluster synchronization status,
+          // so the callsites could check it before reading the field.
+          // The workaround is to update the field in case of a failure,
+          // so the places that wait for showResources !== UNSPECIFIED don't get stuck indefinitely.
+          cluster.showResources = ShowResources.ACCESSIBLE_ONLY;
+        }
+      });
+      throw error;
+    }
+
+    const previous = this.state.get(uri);
+    await this.update(draft => {
+      draft.set(cluster.uri, cluster);
+      leafs.forEach(leaf => {
+        draft.set(leaf.uri, leaf);
+      });
+    });
+    return { previous, next: cluster };
+  }
+
+  async set(cluster: Cluster): Promise<void> {
+    await this.update(draft => {
+      draft.set(cluster.uri, cluster);
+    });
+  }
+
+  getRootClusters(): Cluster[] {
+    return this.state
+      .values()
+      .toArray()
+      .filter(c => !c.leaf);
+  }
+
+  getState(): State {
+    return this.state;
+  }
+
+  /**
+   * Registers an `AwaitableSender` to send updates and automatically unregisters
+   * it when disposed.
+   *
+   * Upon registration, the current state is sent immediately as the initial
+   * message to the sender.
+   */
+  registerSender(sender: AwaitableSender<ClusterStoreUpdate>): void {
+    this.logger.info('Sender registered');
+    this.senders.add(sender);
+    const send = this.withErrorHandling(update => sender.send(update));
+    void send({
+      kind: 'state',
+      value: this.state,
+    });
+    sender.whenDisposed().then(() => {
+      this.senders.delete(sender);
+      this.logger.info('Sender unregistered');
+    });
+  }
+
+  private async update(producer: Producer<State>): Promise<void> {
+    const [state, patches] = produceWithPatches(this.state, producer);
+    this.state = state;
+    await Promise.all(
+      this.senders.values().map(sender => {
+        const send = this.withErrorHandling(update => sender.send(update));
+        return send({
+          kind: 'patches',
+          value: patches,
+        });
+      })
+    );
+  }
+
+  /**
+   * Wraps a cluster store update sender function with error handling.
+   *
+   * Any error indicates that the renderer state may be out of sync with the cluster store.
+   * Applying further updates may fail.
+   * Prompt the user to reload the window or quit the app.
+   */
+  private withErrorHandling(
+    sender: (update: ClusterStoreUpdate) => Promise<void>
+  ): (update: ClusterStoreUpdate) => Promise<void> {
+    return async update => {
+      try {
+        await sender(update);
+      } catch (e) {
+        await this.windowsManager.crashWindow(e);
+      }
+    };
+  }
+}
+
+async function getClusterAndLeafs(tshdClient: TshdClient, uri: RootClusterUri) {
+  const resolved = await Promise.all([
+    tshdClient.getCluster({
+      clusterUri: uri,
+    }),
+    tshdClient.listLeafClusters({
+      clusterUri: uri,
+    }),
+  ]);
+
+  return {
+    cluster: resolved[0].response,
+    leafs: resolved[1].response.clusters,
+  };
+}
diff --git a/web/packages/teleterm/src/mainProcess/clusterStore/index.ts b/web/packages/teleterm/src/mainProcess/clusterStore/index.ts
new file mode 100644
index 0000000000000..820d317cdd8b7
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/clusterStore/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './clusterStore';
diff --git a/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts b/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
index c4f5c0b07db7e..2e5290ea59b56 100644
--- a/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
@@ -25,6 +25,8 @@ import { AgentProcessState } from 'teleterm/mainProcess/types';
 // Importing electron breaks the fixtures if that's done from within storybook.
 import { createConfigService } from 'teleterm/services/config/configService';
 import { createMockFileStorage } from 'teleterm/services/fileStorage/fixtures/mocks';
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { Cluster } from 'teleterm/services/tshd/types';
 import { MainProcessClient, RuntimeSettings } from 'teleterm/types';
 
 export class MockMainProcessClient implements MainProcessClient {
@@ -105,10 +107,6 @@ export class MockMainProcessClient implements MainProcessClient {
 
   fileStorage = createMockFileStorage();
 
-  removeKubeConfig(): Promise<void> {
-    return Promise.resolve(undefined);
-  }
-
   async forceFocusWindow() {}
 
   async symlinkTshMacOs() {
@@ -172,11 +170,57 @@ export class MockMainProcessClient implements MainProcessClient {
     return this.frontendAppInit.promise;
   }
 
-  refreshClusterList() {}
-
   async selectDirectoryForDesktopSession() {
     return '';
   }
+
+  supportsAppUpdates() {
+    return true;
+  }
+  async changeAppUpdatesManagingCluster() {}
+  async checkForAppUpdates() {}
+  async downloadAppUpdate() {}
+  async cancelAppUpdateDownload() {}
+  async quitAndInstallAppUpdate() {}
+  subscribeToAppUpdateEvents(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
+  subscribeToOpenAppUpdateDialog(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
+  subscribeToIsInBackgroundMode(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
+
+  subscribeToClusterStore(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
+  async logout(): Promise<void> {}
+  async syncCluster(): Promise<void> {}
+  async addCluster(): Promise<Cluster> {
+    return makeRootCluster();
+  }
+  async syncRootClusters(): Promise<Cluster[]> {
+    return [];
+  }
+  registerClusterLifecycleHandler(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
+  subscribeToProfileWatcherErrors(): {
+    cleanup: () => void;
+  } {
+    return { cleanup: () => undefined };
+  }
 }
 
 export const makeRuntimeSettings = (
@@ -188,6 +232,7 @@ export const makeRuntimeSettings = (
   insecure: true,
   userDataDir: '',
   sessionDataDir: '',
+  homeDir: '',
   tempDataDir: '',
   agentBinaryPath: '',
   binDir: '',
@@ -201,7 +246,7 @@ export const makeRuntimeSettings = (
   tshd: {
     requestedNetworkAddress: '',
     binaryPath: '',
-    homeDir: '',
+    defaultHomeDir: '',
   },
   sharedProcess: {
     requestedNetworkAddress: '',
diff --git a/web/packages/teleterm/src/mainProcess/ipcSerializer.test.ts b/web/packages/teleterm/src/mainProcess/ipcSerializer.test.ts
new file mode 100644
index 0000000000000..5b3ab156b29c5
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/ipcSerializer.test.ts
@@ -0,0 +1,68 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { TshdRpcError } from 'teleterm/services/tshd/cloneableClient';
+
+import { deserializeError, serializeError } from './ipcSerializer';
+
+test('serializes and deserializes regular error', () => {
+  const err = new Error('Boom');
+  err.name = 'CustomError';
+
+  const serialized = serializeError(err);
+  expect(serialized instanceof Error).toBe(false);
+  expect(serialized.message).toBe('Boom');
+  expect(serialized.name).toBe('CustomError');
+  expect(serialized.stack).toBe(err.stack);
+  expect(serialized.cause).toBe(err.cause);
+
+  const cloned = structuredClone(serialized);
+  const deserialized = deserializeError(cloned);
+  expect(deserialized instanceof Error).toBe(true);
+  expect(deserialized.message).toBe('Boom');
+  expect(deserialized.name).toBe('CustomError');
+  expect(deserialized.stack).toBe(err.stack);
+  expect(deserialized.cause).toBe(err.cause);
+});
+
+test('serializes and deserializes tshd error', () => {
+  const err: TshdRpcError = {
+    name: 'TshdRpcError',
+    message: 'Could not found',
+    toString: () => 'Could not found',
+    cause: '',
+    stack: '',
+    code: 'NOT_FOUND',
+    isResolvableWithRelogin: false,
+  };
+
+  const serialized = serializeError(err);
+  expect(serialized instanceof Error).toBe(false);
+  expect(serialized.message).toBe('Could not found');
+  expect(serialized.name).toBe('TshdRpcError');
+  expect(serialized['isResolvableWithRelogin']).toBe(false);
+  expect(serialized['code']).toBe('NOT_FOUND');
+
+  const cloned = structuredClone(serialized);
+  const deserialized = deserializeError(cloned);
+  expect(deserialized instanceof Error).toBe(true);
+  expect(deserialized.message).toBe('Could not found');
+  expect(deserialized.name).toBe('TshdRpcError');
+  expect(deserialized['isResolvableWithRelogin']).toBe(false);
+  expect(deserialized['code']).toBe('NOT_FOUND');
+});
diff --git a/web/packages/teleterm/src/mainProcess/ipcSerializer.ts b/web/packages/teleterm/src/mainProcess/ipcSerializer.ts
new file mode 100644
index 0000000000000..7011f6b5b47e8
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/ipcSerializer.ts
@@ -0,0 +1,61 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export type SerializedError = {
+  name: string;
+  message: string;
+  stack?: string;
+  cause?: unknown;
+  toStringResult?: string;
+};
+
+/** Serializes an Error into a plain object for transport through Electron IPC. */
+export function serializeError(error: Error): SerializedError {
+  const {
+    name,
+    cause,
+    stack,
+    message,
+    // functions must be skipped, otherwise structuredClone will fail to clone the object
+    // eslint-disable-next-line unused-imports/no-unused-vars
+    toString,
+    ...enumerableFields
+  } = error;
+  return {
+    name,
+    message,
+    cause,
+    stack,
+    // Calling the destructured function directly could result in the following error:
+    // Method Error.prototype.toString called on incompatible receiver undefined
+    toStringResult: error.toString?.(),
+    ...enumerableFields,
+  };
+}
+
+/** Deserializes a plain object back into an Error instance. */
+export function deserializeError(serialized: SerializedError): Error {
+  const { name, cause, stack, message, toStringResult, ...rest } = serialized;
+  const error = new Error(message);
+  error.name = name;
+  error.cause = cause;
+  error.stack = stack;
+  error.toString = () => toStringResult;
+  Object.assign(error, rest);
+  return error;
+}
diff --git a/web/packages/teleterm/src/mainProcess/mainProcess.ts b/web/packages/teleterm/src/mainProcess/mainProcess.ts
index 917dab6c478a9..21cd4177e1e41 100644
--- a/web/packages/teleterm/src/mainProcess/mainProcess.ts
+++ b/web/packages/teleterm/src/mainProcess/mainProcess.ts
@@ -27,13 +27,19 @@ import {
   app,
   dialog,
   ipcMain,
+  IpcMainInvokeEvent,
   Menu,
   MenuItemConstructorOptions,
   nativeTheme,
   shell,
 } from 'electron';
+import { enableMapSet, enablePatches } from 'immer';
+
+import { AbortError } from 'shared/utils/error';
 
 import Logger from 'teleterm/logger';
+import { ClusterLifecycleManager } from 'teleterm/mainProcess/clusterLifecycleManager';
+import { watchProfiles } from 'teleterm/mainProcess/profileWatcher';
 import { getAssetPath } from 'teleterm/mainProcess/runtimeSettings';
 import {
   ChildProcessAddresses,
@@ -46,6 +52,11 @@ import {
   TSH_AUTOUPDATE_ENV_VAR,
   TSH_AUTOUPDATE_OFF,
 } from 'teleterm/node/tshAutoupdate';
+import {
+  AppUpdater,
+  AppUpdaterStorage,
+  TELEPORT_TOOLS_VERSION_ENV_VAR,
+} from 'teleterm/services/appUpdater';
 import { subscribeToFileStorageEvents } from 'teleterm/services/fileStorage';
 import * as grpcCreds from 'teleterm/services/grpcCredentials';
 import {
@@ -53,7 +64,12 @@ import {
   KeepLastChunks,
   LoggerColor,
 } from 'teleterm/services/logger';
-import { createTshdClient, TshdClient } from 'teleterm/services/tshd';
+import {
+  AutoUpdateClient,
+  createAutoUpdateClient,
+  createTshdClient,
+  TshdClient,
+} from 'teleterm/services/tshd';
 import { loggingInterceptor } from 'teleterm/services/tshd/interceptors';
 import { staticConfig } from 'teleterm/staticConfig';
 import { FileStorage, RuntimeSettings } from 'teleterm/types';
@@ -65,6 +81,8 @@ import {
 } from '../services/config';
 import { downloadAgent, FileDownloader, verifyAgent } from './agentDownloader';
 import { AgentRunner } from './agentRunner';
+import { AwaitableSender } from './awaitableSender';
+import { ClusterStore } from './clusterStore';
 import { subscribeToTabContextMenuEvent } from './contextMenus/tabContextMenu';
 import { subscribeToTerminalContextMenuEvent } from './contextMenus/terminalContextMenu';
 import {
@@ -75,6 +93,7 @@ import {
   removeAgentDirectory,
   type CreateAgentConfigFileArgs,
 } from './createAgentConfigFile';
+import { serializeError } from './ipcSerializer';
 import { ResolveError, resolveNetworkAddress } from './resolveNetworkAddress';
 import { terminateWithTimeout } from './terminateWithTimeout';
 import { WindowsManager } from './windowsManager';
@@ -98,6 +117,16 @@ export default class MainProcess {
   private sharedProcessLastLogs: KeepLastChunks<string>;
   private appStateFileStorage: FileStorage;
   private configFileStorage: FileStorage;
+  /**
+   * Promise holding the resolution of child process addresses.
+   *
+   * Both the internal tshd client (in the main process) and the one in
+   * the renderer depend on this promise.
+   *
+   * If the promise rejects, the error will propagate to the renderer via the IPC
+   * handler (causing the renderer to stop initialization and show the error)
+   * and also surface when attempting to access the tshdClients property.
+   */
   private resolvedChildProcessAddresses: Promise<ChildProcessAddresses>;
   private windowsManager: WindowsManager;
   // this function can be safely called concurrently
@@ -109,9 +138,32 @@ export default class MainProcess {
     )
   );
   private readonly agentRunner: AgentRunner;
-  private tshdClient: Promise<TshdClient>;
+  /**
+   * A promise responsible for initializing clients for tshd gRPC services once the addresses of
+   * child processes are resolved. Set in the constructor.
+   *
+   * If the client setup fails, the resulting error will propagate to callsites which use
+   * tshdClients, including preload of the frontend app, causing its initialization to stop.
+   */
+  private tshdClients: Promise<{
+    terminalService: TshdClient;
+    autoUpdateService: AutoUpdateClient;
+  }>;
+  private readonly appUpdater: AppUpdater;
+  public readonly clusterStore: ClusterStore;
+  private clusterLifecycleManager: ClusterLifecycleManager;
+  private disposeAbortController = new AbortController();
 
-  private constructor(opts: Options) {
+  /**
+   * Starts necessary child processes such as tsh daemon and the shared process. It also sets
+   * up IPC handlers and resolves the network addresses under which the child processes set up gRPC
+   * servers.
+   *
+   * Might throw an error if spawning a child process fails, see initTshd for more details.
+   */
+  constructor(opts: Options) {
+    enablePatches();
+    enableMapSet();
     this.settings = opts.settings;
     this.logger = opts.logger;
     this.configService = opts.configService;
@@ -133,17 +185,70 @@ export default class MainProcess {
         );
       }
     );
-  }
 
-  static create(opts: Options) {
-    const instance = new MainProcess(opts);
-    instance.init();
-    return instance;
+    this.updateAboutPanelIfNeeded();
+    this.setAppMenu();
+    this.initTshd();
+    this.initSharedProcess();
+    this.initResolvingChildProcessAddressesAndTshdClients();
+    this.initIpc();
+
+    const getClusterVersions = async () => {
+      const { autoUpdateService } = await this.tshdClients;
+      const { response } = await autoUpdateService.getClusterVersions({});
+      return response;
+    };
+    const getDownloadBaseUrl = async () => {
+      const { autoUpdateService } = await this.tshdClients;
+      const {
+        response: { baseUrl },
+      } = await autoUpdateService.getDownloadBaseUrl({});
+      return baseUrl;
+    };
+    this.appUpdater = new AppUpdater(
+      makeAppUpdaterStorage(this.appStateFileStorage),
+      getClusterVersions,
+      getDownloadBaseUrl,
+      event => {
+        if (event.kind === 'error') {
+          event.error = serializeError(event.error);
+        }
+        this.windowsManager
+          .getWindow()
+          .webContents.send(RendererIpc.AppUpdateEvent, event);
+      },
+      process.env[TELEPORT_TOOLS_VERSION_ENV_VAR]
+    );
+    this.clusterStore = new ClusterStore(
+      () => this.tshdClients.then(c => c.terminalService),
+      this.windowsManager
+    );
+    const watcher = watchProfiles({
+      tshDirectory: this.configService.get('tshHome').value,
+      tshClient: {
+        listRootClusters: async () => {
+          const { terminalService } = await this.tshdClients;
+          const { response } = await terminalService.listRootClusters({});
+          return response.clusters;
+        },
+      },
+      clusterStore: this.clusterStore,
+      signal: this.disposeAbortController.signal,
+    });
+    this.clusterLifecycleManager = new ClusterLifecycleManager(
+      this.clusterStore,
+      () => this.tshdClients.then(c => c.terminalService),
+      this.appUpdater,
+      this.windowsManager,
+      watcher
+    );
   }
 
   async dispose(): Promise<void> {
+    this.disposeAbortController.abort();
     this.windowsManager.dispose();
     await Promise.all([
+      this.appUpdater.dispose(),
       // sending usage events on tshd shutdown has 10-seconds timeout
       terminateWithTimeout(this.tshdProcess, 10_000, () => {
         this.gracefullyKillTshdProcess();
@@ -157,38 +262,19 @@ export default class MainProcess {
     ]);
   }
 
-  private init() {
-    this.updateAboutPanelIfNeeded();
-    this.setAppMenu();
-    try {
-      this.initTshd();
-      this.initSharedProcess();
-      this.initResolvingChildProcessAddresses();
-      this.initIpc();
-    } catch (err) {
-      this.logger.error('Failed to start main process: ', err.message);
-      app.exit(1);
-    }
-  }
-
-  async getTshdClient(): Promise<TshdClient> {
-    if (!this.tshdClient) {
-      this.tshdClient = this.resolvedChildProcessAddresses.then(
-        ({ tsh: tshdAddress }) =>
-          setUpTshdClient({
-            runtimeSettings: this.settings,
-            tshdAddress,
-          })
-      );
-    }
-
-    return this.tshdClient;
-  }
-
   private initTshd() {
-    const { binaryPath, homeDir } = this.settings.tshd;
+    const { binaryPath } = this.settings.tshd;
     this.logger.info(`Starting tsh daemon from ${binaryPath}`);
 
+    // spawn might either fail immediately by throwing an error or cause the error event to be emitted
+    // on the process value returned by spawn.
+    //
+    // Some spawn failures result in an error being thrown immediately such as EPERM on Windows [1].
+    // This might be related to the fact that in Node.js, an error event causes an error to be
+    // thrown if there are no listeners for the error event itself [2].
+    //
+    // [1] https://stackoverflow.com/a/42262771
+    // [2] https://nodejs.org/docs/latest-v22.x/api/errors.html#error-propagation-and-interception
     this.tshdProcess = spawn(
       binaryPath,
       ['daemon', 'start', ...this.getTshdFlags()],
@@ -197,7 +283,7 @@ export default class MainProcess {
         windowsHide: true,
         env: {
           ...process.env,
-          TELEPORT_HOME: homeDir,
+          TELEPORT_HOME: this.configService.get('tshHome').value,
           [TSH_AUTOUPDATE_ENV_VAR]: TSH_AUTOUPDATE_OFF,
         },
       }
@@ -275,7 +361,11 @@ export default class MainProcess {
     );
   }
 
-  private initResolvingChildProcessAddresses(): void {
+  /**
+   * Initializes the resolution of child process addresses and sets up tshd clients.
+   * On Windows, the setup of tshd clients also initialized the main process cert for mTLS.
+   */
+  private initResolvingChildProcessAddressesAndTshdClients(): void {
     this.resolvedChildProcessAddresses = Promise.all([
       resolveNetworkAddress(
         this.settings.tshd.requestedNetworkAddress,
@@ -302,6 +392,19 @@ export default class MainProcess {
         )
       ),
     ]).then(([tsh, shared]) => ({ tsh, shared }));
+
+    this.tshdClients = this.resolvedChildProcessAddresses.then(
+      ({ tsh: tshdAddress }) =>
+        setUpTshdClients({
+          runtimeSettings: this.settings,
+          tshdAddress,
+        })
+    );
+    // Log the error just to avoid unhandled promise rejection if setUpTshdClients fails before
+    // anything reads tshdClients.
+    this.tshdClients.catch(error => {
+      this.logger.error('Could not initialize tshd clients', error);
+    });
   }
 
   private initIpc() {
@@ -313,44 +416,17 @@ export default class MainProcess {
       event.returnValue = nativeTheme.shouldUseDarkColors;
     });
 
-    ipcMain.handle('main-process-get-resolved-child-process-addresses', () => {
+    ipcHandle('main-process-get-resolved-child-process-addresses', () => {
       return this.resolvedChildProcessAddresses;
     });
 
-    // the handler can remove a single kube config file or entire directory for given cluster
-    ipcMain.handle(
-      'main-process-remove-kube-config',
-      (
-        _,
-        options: {
-          relativePath: string;
-          isDirectory?: boolean;
-        }
-      ) => {
-        const { kubeConfigsDir } = this.settings;
-        const filePath = path.join(kubeConfigsDir, options.relativePath);
-        const isOutOfRoot = filePath.indexOf(kubeConfigsDir) !== 0;
-
-        if (isOutOfRoot) {
-          return Promise.reject('Invalid path');
-        }
-        return fs
-          .rm(filePath, { recursive: !!options.isDirectory })
-          .catch(error => {
-            if (error.code !== 'ENOENT') {
-              throw error;
-            }
-          });
-      }
-    );
-
-    ipcMain.handle('main-process-show-file-save-dialog', (_, filePath) =>
+    ipcHandle('main-process-show-file-save-dialog', (_, filePath) =>
       dialog.showSaveDialog({
         defaultPath: path.basename(filePath),
       })
     );
 
-    ipcMain.handle(
+    ipcHandle(
       MainProcessIpc.SaveTextToFile,
       async (
         _,
@@ -389,7 +465,7 @@ export default class MainProcess {
       }
     );
 
-    ipcMain.handle(
+    ipcHandle(
       MainProcessIpc.ForceFocusWindow,
       async (
         _,
@@ -410,7 +486,7 @@ export default class MainProcess {
     // Used in the `tsh install` command on macOS to make the bundled tsh available in PATH.
     // Returns true if tsh got successfully installed, false if the user closed the osascript
     // prompt. Throws an error when osascript fails.
-    ipcMain.handle('main-process-symlink-tsh-macos', async () => {
+    ipcHandle('main-process-symlink-tsh-macos', async () => {
       const source = this.settings.tshd.binaryPath;
       const target = '/usr/local/bin/tsh';
       const prompt =
@@ -432,7 +508,7 @@ export default class MainProcess {
       }
     });
 
-    ipcMain.handle('main-process-remove-tsh-symlink-macos', async () => {
+    ipcHandle('main-process-remove-tsh-symlink-macos', async () => {
       const target = '/usr/local/bin/tsh';
       const prompt =
         'Teleport Connect wants to remove a symlink for tsh from /usr/local/bin.';
@@ -453,21 +529,21 @@ export default class MainProcess {
       }
     });
 
-    ipcMain.handle('main-process-open-config-file', async () => {
+    ipcHandle('main-process-open-config-file', async () => {
       const path = this.configFileStorage.getFilePath();
       await shell.openPath(path);
       return path;
     });
 
-    ipcMain.handle(MainProcessIpc.DownloadConnectMyComputerAgent, () =>
+    ipcHandle(MainProcessIpc.DownloadConnectMyComputerAgent, () =>
       this.downloadAgentShared()
     );
 
-    ipcMain.handle(MainProcessIpc.VerifyConnectMyComputerAgent, async () => {
+    ipcHandle(MainProcessIpc.VerifyConnectMyComputerAgent, async () => {
       await verifyAgent(this.settings.agentBinaryPath);
     });
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-connect-my-computer-create-agent-config-file',
       (_, args: CreateAgentConfigFileArgs) =>
         createAgentConfigFile(this.settings, {
@@ -478,7 +554,7 @@ export default class MainProcess {
         })
     );
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-connect-my-computer-is-agent-config-file-created',
       async (
         _,
@@ -488,7 +564,7 @@ export default class MainProcess {
       ) => isAgentConfigFileCreated(this.settings, args.rootClusterUri)
     );
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-connect-my-computer-kill-agent',
       async (
         _,
@@ -500,7 +576,7 @@ export default class MainProcess {
       }
     );
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-connect-my-computer-remove-agent-directory',
       (
         _,
@@ -510,11 +586,11 @@ export default class MainProcess {
       ) => removeAgentDirectory(this.settings, args.rootClusterUri)
     );
 
-    ipcMain.handle(MainProcessIpc.TryRemoveConnectMyComputerAgentBinary, () =>
+    ipcHandle(MainProcessIpc.TryRemoveConnectMyComputerAgentBinary, () =>
       this.agentRunner.tryRemoveAgentBinary()
     );
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-connect-my-computer-run-agent',
       async (
         _,
@@ -550,7 +626,7 @@ export default class MainProcess {
       }
     );
 
-    ipcMain.handle(
+    ipcHandle(
       'main-process-open-agent-logs-directory',
       async (
         _,
@@ -569,22 +645,22 @@ export default class MainProcess {
       }
     );
 
-    ipcMain.handle(
+    ipcHandle(
       MainProcessIpc.SelectDirectoryForDesktopSession,
       async (_, args: { desktopUri: string; login: string }) => {
         const value = await dialog.showOpenDialog({
           properties: ['openDirectory'],
         });
         if (value.canceled) {
-          throw new Error('Selecting directory canceled.');
+          throw new AbortError();
         }
         if (value.filePaths.length !== 1) {
           throw new Error('No directory selected.');
         }
 
         const [dirPath] = value.filePaths;
-        const tshClient = await this.getTshdClient();
-        await tshClient.setSharedDirectoryForDesktopSession({
+        const { terminalService } = await this.tshdClients;
+        await terminalService.setSharedDirectoryForDesktopSession({
           desktopUri: args.desktopUri,
           login: args.login,
           path: dirPath,
@@ -594,6 +670,66 @@ export default class MainProcess {
       }
     );
 
+    ipcMain.on(MainProcessIpc.SupportsAppUpdates, event => {
+      event.returnValue = this.appUpdater.supportsUpdates();
+    });
+
+    ipcHandle(MainProcessIpc.CheckForAppUpdates, () =>
+      this.appUpdater.checkForUpdates()
+    );
+
+    ipcHandle(
+      MainProcessIpc.ChangeAppUpdatesManagingCluster,
+      (
+        event,
+        args: {
+          clusterUri: RootClusterUri | undefined;
+        }
+      ) => this.appUpdater.changeManagingCluster(args.clusterUri)
+    );
+
+    ipcHandle(MainProcessIpc.DownloadAppUpdate, () =>
+      this.appUpdater.download()
+    );
+
+    ipcHandle(MainProcessIpc.CancelAppUpdateDownload, () =>
+      this.appUpdater.cancelDownload()
+    );
+
+    ipcHandle(MainProcessIpc.QuiteAndInstallAppUpdate, () =>
+      this.appUpdater.quitAndInstall()
+    );
+
+    ipcHandle(MainProcessIpc.AddCluster, (ev, proxyAddress) =>
+      this.clusterLifecycleManager.addCluster(proxyAddress)
+    );
+
+    ipcHandle(MainProcessIpc.SyncRootClusters, () =>
+      this.clusterLifecycleManager.syncRootClustersAndStartProfileWatcher()
+    );
+
+    ipcHandle(MainProcessIpc.SyncCluster, (_, args) =>
+      this.clusterLifecycleManager.syncCluster(args.clusterUri)
+    );
+
+    ipcHandle(MainProcessIpc.Logout, async (_, args) => {
+      await this.clusterLifecycleManager.logoutAndRemoveCluster(
+        args.clusterUri
+      );
+    });
+
+    ipcMain.on(MainProcessIpc.InitClusterStoreSubscription, ev => {
+      const port = ev.ports[0];
+      this.clusterStore.registerSender(new AwaitableSender(port));
+    });
+
+    ipcMain.on(MainProcessIpc.RegisterClusterLifecycleHandler, ev => {
+      const port = ev.ports[0];
+      this.clusterLifecycleManager.setRendererEventHandler(
+        new AwaitableSender(port)
+      );
+    });
+
     subscribeToTerminalContextMenuEvent(this.configService);
     subscribeToTabContextMenuEvent(
       this.settings.availableShells,
@@ -628,7 +764,28 @@ export default class MainProcess {
         };
 
     const macTemplate: MenuItemConstructorOptions[] = [
-      { role: 'appMenu' },
+      {
+        role: 'appMenu',
+        submenu: [
+          { role: 'about' },
+          {
+            label: 'Check for Updates…',
+            click: () => {
+              this.windowsManager
+                .getWindow()
+                .webContents.send(RendererIpc.OpenAppUpdateDialog);
+            },
+          },
+          { type: 'separator' },
+          { role: 'services' },
+          { type: 'separator' },
+          { role: 'hide' },
+          { role: 'hideOthers' },
+          { role: 'unhide' },
+          { type: 'separator' },
+          { role: 'quit' },
+        ],
+      },
       { role: 'editMenu' },
       viewMenuTemplate,
       {
@@ -693,13 +850,17 @@ export default class MainProcess {
       {
         windowsHide: true,
         timeout: 2_000,
+        env: {
+          ...process.env,
+          [TSH_AUTOUPDATE_ENV_VAR]: TSH_AUTOUPDATE_OFF,
+        },
       }
     );
     daemonStop.on('error', error => {
       logger.error('daemon stop process failed to start', error);
     });
     daemonStop.stderr.setEncoding('utf-8');
-    daemonStop.stderr.on('data', logger.error);
+    daemonStop.stderr.on('data', data => logger.error(data));
   }
 
   private logProcessExitAndError(
@@ -753,22 +914,28 @@ function sharePromise<T>(promiseFn: () => Promise<T>): () => Promise<T> {
 }
 
 /**
- * Sets up the gRPC client for tsh daemon used in the main process.
+ * Sets up the gRPC clients for tsh daemon used in the main process.
  */
-async function setUpTshdClient({
+async function setUpTshdClients({
   runtimeSettings,
   tshdAddress,
 }: {
   runtimeSettings: RuntimeSettings;
   tshdAddress: string;
-}): Promise<TshdClient> {
+}): Promise<{
+  terminalService: TshdClient;
+  autoUpdateService: AutoUpdateClient;
+}> {
   const creds = await createGrpcCredentials(runtimeSettings);
   const transport = new GrpcTransport({
     host: tshdAddress,
     channelCredentials: creds,
     interceptors: [loggingInterceptor(new Logger('tshd'))],
   });
-  return createTshdClient(transport);
+  return {
+    terminalService: createTshdClient(transport),
+    autoUpdateService: createAutoUpdateClient(transport),
+  };
 }
 
 async function createGrpcCredentials(
@@ -830,3 +997,37 @@ function rewrapResolveError(
     );
   };
 }
+
+const APP_UPDATER_STATE_KEY = 'appUpdater';
+function makeAppUpdaterStorage(fs: FileStorage): AppUpdaterStorage {
+  return {
+    get: () => {
+      const state = fs.get(APP_UPDATER_STATE_KEY) as object;
+      return { managingClusterUri: '', ...state };
+    },
+    put: value => {
+      const state = fs.get(APP_UPDATER_STATE_KEY) as object;
+      fs.put(APP_UPDATER_STATE_KEY, { ...state, ...value });
+    },
+  };
+}
+
+/**
+ * Handles requests sent via `ipcInvoke`.
+ * The renderer must send requests using `ipcInvoke` (not `ipcRenderer.invoke`).
+ *
+ * Use this instead of `ipcMain.handle`. It ensures full error serialization
+ * and prevents Electron from adding the generic message "Error invoking remote method".
+ */
+function ipcHandle(
+  channel: string,
+  listener: (event: IpcMainInvokeEvent, ...args: any[]) => Promise<any> | any
+): void {
+  ipcMain.handle(channel, async (...args) => {
+    try {
+      return { result: await Promise.try(listener, ...args) };
+    } catch (e) {
+      return { error: serializeError(e) };
+    }
+  });
+}
diff --git a/web/packages/teleterm/src/mainProcess/mainProcessClient.ts b/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
index 67b21fd49507e..44eb7726442ce 100644
--- a/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
+++ b/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
@@ -18,7 +18,11 @@
 
 import { ipcRenderer } from 'electron';
 
+import Logger from 'teleterm/logger';
+import type { Message, MessageAck } from 'teleterm/mainProcess/awaitableSender';
 import { CreateAgentConfigFileArgs } from 'teleterm/mainProcess/createAgentConfigFile';
+import { deserializeError } from 'teleterm/mainProcess/ipcSerializer';
+import { AppUpdateEvent } from 'teleterm/services/appUpdater';
 import { createFileStorageClient } from 'teleterm/services/fileStorage';
 import { RootClusterUri } from 'teleterm/ui/uri';
 
@@ -34,6 +38,8 @@ import {
   WindowsManagerIpc,
 } from './types';
 
+const logger = new Logger('MainProcessClient');
+
 export default function createMainProcessClient(): MainProcessClient {
   return {
     /*
@@ -96,81 +102,68 @@ export default function createMainProcessClient(): MainProcessClient {
     // TODO(ravicious): Convert the rest of IPC channels to use enums defined in types.ts such as
     // MainProcessIpc rather than hardcoded strings.
     getResolvedChildProcessAddresses(): Promise<ChildProcessAddresses> {
-      return ipcRenderer.invoke(
-        'main-process-get-resolved-child-process-addresses'
-      );
+      return ipcInvoke('main-process-get-resolved-child-process-addresses');
     },
     showFileSaveDialog(filePath: string) {
-      return ipcRenderer.invoke('main-process-show-file-save-dialog', filePath);
+      return ipcInvoke('main-process-show-file-save-dialog', filePath);
     },
     saveTextToFile(args) {
-      return ipcRenderer.invoke(MainProcessIpc.SaveTextToFile, args);
+      return ipcInvoke(MainProcessIpc.SaveTextToFile, args);
     },
     openTerminalContextMenu,
     openTabContextMenu,
     configService: createConfigServiceClient(),
     fileStorage: createFileStorageClient(),
-    removeKubeConfig(options) {
-      return ipcRenderer.invoke('main-process-remove-kube-config', options);
-    },
     forceFocusWindow(args) {
-      return ipcRenderer.invoke(MainProcessIpc.ForceFocusWindow, args);
+      return ipcInvoke(MainProcessIpc.ForceFocusWindow, args);
     },
     symlinkTshMacOs() {
-      return ipcRenderer.invoke('main-process-symlink-tsh-macos');
+      return ipcInvoke('main-process-symlink-tsh-macos');
     },
     removeTshSymlinkMacOs() {
-      return ipcRenderer.invoke('main-process-remove-tsh-symlink-macos');
+      return ipcInvoke('main-process-remove-tsh-symlink-macos');
     },
     openConfigFile() {
-      return ipcRenderer.invoke('main-process-open-config-file');
+      return ipcInvoke('main-process-open-config-file');
     },
     shouldUseDarkColors() {
       return ipcRenderer.sendSync('main-process-should-use-dark-colors');
     },
     downloadAgent() {
-      return ipcRenderer.invoke(MainProcessIpc.DownloadConnectMyComputerAgent);
+      return ipcInvoke(MainProcessIpc.DownloadConnectMyComputerAgent);
     },
     verifyAgent() {
-      return ipcRenderer.invoke(MainProcessIpc.VerifyConnectMyComputerAgent);
+      return ipcInvoke(MainProcessIpc.VerifyConnectMyComputerAgent);
     },
     createAgentConfigFile(args: CreateAgentConfigFileArgs) {
-      return ipcRenderer.invoke(
+      return ipcInvoke(
         'main-process-connect-my-computer-create-agent-config-file',
         args
       );
     },
     isAgentConfigFileCreated(args: { rootClusterUri: RootClusterUri }) {
-      return ipcRenderer.invoke(
+      return ipcInvoke(
         'main-process-connect-my-computer-is-agent-config-file-created',
         args
       );
     },
     removeAgentDirectory(args: { rootClusterUri: RootClusterUri }) {
-      return ipcRenderer.invoke(
+      return ipcInvoke(
         'main-process-connect-my-computer-remove-agent-directory',
         args
       );
     },
     tryRemoveConnectMyComputerAgentBinary() {
-      return ipcRenderer.invoke(
-        MainProcessIpc.TryRemoveConnectMyComputerAgentBinary
-      );
+      return ipcInvoke(MainProcessIpc.TryRemoveConnectMyComputerAgentBinary);
     },
     openAgentLogsDirectory(args: { rootClusterUri: RootClusterUri }) {
-      return ipcRenderer.invoke('main-process-open-agent-logs-directory', args);
+      return ipcInvoke('main-process-open-agent-logs-directory', args);
     },
     killAgent(args: { rootClusterUri: RootClusterUri }) {
-      return ipcRenderer.invoke(
-        'main-process-connect-my-computer-kill-agent',
-        args
-      );
+      return ipcInvoke('main-process-connect-my-computer-kill-agent', args);
     },
     runAgent(args: { rootClusterUri: RootClusterUri }) {
-      return ipcRenderer.invoke(
-        'main-process-connect-my-computer-run-agent',
-        args
-      );
+      return ipcInvoke('main-process-connect-my-computer-run-agent', args);
     },
     getAgentState(args: { rootClusterUri: RootClusterUri }) {
       return ipcRenderer.sendSync(
@@ -187,17 +180,168 @@ export default function createMainProcessClient(): MainProcessClient {
     signalUserInterfaceReadiness(args: { success: boolean }) {
       ipcRenderer.send(WindowsManagerIpc.SignalUserInterfaceReadiness, args);
     },
-    refreshClusterList() {
-      ipcRenderer.send(MainProcessIpc.RefreshClusterList);
-    },
     selectDirectoryForDesktopSession(args: {
       desktopUri: string;
       login: string;
     }) {
-      return ipcRenderer.invoke(
-        MainProcessIpc.SelectDirectoryForDesktopSession,
-        args
+      return ipcInvoke(MainProcessIpc.SelectDirectoryForDesktopSession, args);
+    },
+    supportsAppUpdates() {
+      return ipcRenderer.sendSync(MainProcessIpc.SupportsAppUpdates);
+    },
+    checkForAppUpdates() {
+      return ipcInvoke(MainProcessIpc.CheckForAppUpdates);
+    },
+    downloadAppUpdate() {
+      return ipcInvoke(MainProcessIpc.DownloadAppUpdate);
+    },
+    cancelAppUpdateDownload() {
+      return ipcInvoke(MainProcessIpc.CancelAppUpdateDownload);
+    },
+    quitAndInstallAppUpdate() {
+      return ipcInvoke(MainProcessIpc.QuiteAndInstallAppUpdate);
+    },
+    changeAppUpdatesManagingCluster(clusterUri) {
+      return ipcInvoke(MainProcessIpc.ChangeAppUpdatesManagingCluster, {
+        clusterUri,
+      });
+    },
+    subscribeToAppUpdateEvents: listener => {
+      const ipcListener = (_, updateEvent: AppUpdateEvent) => {
+        listener(updateEvent);
+      };
+
+      ipcRenderer.addListener(RendererIpc.AppUpdateEvent, ipcListener);
+      return {
+        cleanup: () =>
+          ipcRenderer.removeListener(RendererIpc.AppUpdateEvent, ipcListener),
+      };
+    },
+    subscribeToOpenAppUpdateDialog: listener => {
+      ipcRenderer.addListener(RendererIpc.OpenAppUpdateDialog, listener);
+      return {
+        cleanup: () =>
+          ipcRenderer.removeListener(RendererIpc.OpenAppUpdateDialog, listener),
+      };
+    },
+    subscribeToIsInBackgroundMode: listener => {
+      const ipcListener = (_, { isInBackgroundMode }) => {
+        listener({ isInBackgroundMode });
+      };
+
+      ipcRenderer.addListener(RendererIpc.IsInBackgroundMode, ipcListener);
+      return {
+        cleanup: () =>
+          ipcRenderer.removeListener(
+            RendererIpc.IsInBackgroundMode,
+            ipcListener
+          ),
+      };
+    },
+    subscribeToClusterStore: listener => {
+      const { close } = startAwaitableSenderListener(
+        MainProcessIpc.InitClusterStoreSubscription,
+        listener
+      );
+
+      return {
+        cleanup: close,
+      };
+    },
+    addCluster: async (proxyAddress: string) => {
+      return await ipcInvoke(MainProcessIpc.AddCluster, proxyAddress);
+    },
+    syncRootClusters: async () => {
+      return await ipcInvoke(MainProcessIpc.SyncRootClusters);
+    },
+    syncCluster: (clusterUri: RootClusterUri) => {
+      return ipcInvoke(MainProcessIpc.SyncCluster, { clusterUri });
+    },
+    logout: (clusterUri: RootClusterUri) => {
+      return ipcInvoke(MainProcessIpc.Logout, { clusterUri });
+    },
+    registerClusterLifecycleHandler(listener): {
+      cleanup: () => void;
+    } {
+      const { close } = startAwaitableSenderListener(
+        MainProcessIpc.RegisterClusterLifecycleHandler,
+        listener
       );
+
+      return { cleanup: close };
+    },
+    subscribeToProfileWatcherErrors: listener => {
+      const ipcListener = (_, error) => {
+        listener(error);
+      };
+
+      ipcRenderer.addListener(RendererIpc.ProfileWatcherError, ipcListener);
+      return {
+        cleanup: () =>
+          ipcRenderer.removeListener(
+            RendererIpc.ProfileWatcherError,
+            ipcListener
+          ),
+      };
+    },
+  };
+}
+
+/**
+ * Sets up a `MessagePort` listener in the renderer process and transfers
+ * the port to the main process via the specified IPC `channel`.
+ *
+ * The main process is expected to create an `AwaitableSender` using the received port,
+ * enabling it to send messages that require acknowledgments from the renderer.
+ */
+function startAwaitableSenderListener<T>(
+  channel: string,
+  listener: (value: T) => void | Promise<void>
+): {
+  close: () => void;
+} {
+  const { port1: localPort, port2: transferablePort } = new MessageChannel();
+
+  localPort.onmessage = async (event: MessageEvent<Message>) => {
+    const msg = event.data;
+    if (msg.type !== 'data') {
+      return;
+    }
+    const ack: MessageAck = { type: 'ack', id: msg.id };
+
+    try {
+      await listener(msg.payload as T);
+    } catch (e) {
+      ack.error = e;
+    }
+
+    localPort.postMessage(ack);
+  };
+
+  localPort.start();
+  ipcRenderer.postMessage(channel, undefined, [transferablePort]);
+
+  return {
+    close: () => {
+      localPort.onmessage = undefined;
+      localPort.close();
+      transferablePort.close();
     },
   };
 }
+
+/**
+ * Resolves with the response from the main process.
+ * The main process must register the handler using `ipcHandle` (not `ipcMain.handle`).
+ *
+ * Use this instead of `ipcRenderer.invoke`.
+ */
+async function ipcInvoke(channel: string, ...args: any[]): Promise<any> {
+  const { error, result } = await ipcRenderer.invoke(channel, ...args);
+  if (error) {
+    const deserialized = deserializeError(error);
+    logger.error(`Error invoking remote method ${channel}`, deserialized);
+    throw deserialized;
+  }
+  return result;
+}
diff --git a/web/packages/teleterm/src/mainProcess/navigationHandler.test.ts b/web/packages/teleterm/src/mainProcess/navigationHandler.test.ts
new file mode 100644
index 0000000000000..61498b898962a
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/navigationHandler.test.ts
@@ -0,0 +1,120 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { dialog, shell, WebContents } from 'electron';
+
+import Logger, { NullService } from 'teleterm/logger';
+import { makeRuntimeSettings } from 'teleterm/mainProcess/fixtures/mocks';
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+
+import { registerNavigationHandlers } from './navigationHandler';
+
+beforeAll(() => {
+  Logger.init(new NullService());
+});
+
+beforeEach(() => {
+  jest.resetAllMocks();
+});
+
+jest.mock('electron', () => ({
+  dialog: {
+    showErrorBox: jest.fn(),
+  },
+  shell: {
+    openExternal: jest.fn(),
+  },
+}));
+
+const cluster = makeRootCluster();
+
+describe('opening links to', () => {
+  test.each([
+    {
+      name: 'Teleport',
+      url: 'https://goteleport.com/',
+      allowed: true,
+    },
+    {
+      name: 'Gravitational GitHub',
+      url: 'https://github.com/gravitational/',
+      allowed: true,
+    },
+    {
+      name: 'cluster SSO host',
+      // comes from makeRootCluster
+      url: 'https://example.auth0.com/some-path',
+      allowed: true,
+    },
+    {
+      name: 'cluster proxy host',
+      // comes from makeRootCluster
+      url: 'https://teleport-local.com:3080/some-path',
+      allowed: true,
+    },
+    {
+      name: 'non-HTTPS URLs',
+      url: 'http://goteleport.com',
+      allowed: false,
+    },
+    {
+      name: 'non-Gravitational GitHub',
+      url: 'https://github.com/abc',
+      allowed: false,
+    },
+    {
+      name: 'arbitrary URLs',
+      url: 'https://google.com',
+      allowed: false,
+    },
+  ])('$name', test => {
+    let handler: Parameters<WebContents['setWindowOpenHandler']>[0];
+    registerNavigationHandlers(
+      {
+        setWindowOpenHandler: d => {
+          handler = d;
+        },
+        on: jest.fn(),
+      },
+      makeRuntimeSettings(),
+      { getRootClusters: () => [cluster] },
+      new Logger()
+    );
+
+    const result = handler({
+      url: test.url,
+      frameName: '',
+      features: '',
+      disposition: 'default',
+      referrer: undefined,
+    });
+
+    expect(result).toEqual({ action: 'deny' });
+    /* eslint-disable jest/no-conditional-expect */
+    if (test.allowed) {
+      expect(shell.openExternal).toHaveBeenCalledWith(test.url);
+      expect(dialog.showErrorBox).not.toHaveBeenCalled();
+    } else {
+      expect(shell.openExternal).not.toHaveBeenCalled();
+      expect(dialog.showErrorBox).toHaveBeenCalledWith(
+        'Cannot open this link',
+        'The domain does not match any of the allowed domains. Check main.log for more details.'
+      );
+    }
+  });
+});
diff --git a/web/packages/teleterm/src/mainProcess/navigationHandler.ts b/web/packages/teleterm/src/mainProcess/navigationHandler.ts
new file mode 100644
index 0000000000000..eb200c6328059
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/navigationHandler.ts
@@ -0,0 +1,147 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { dialog, shell, WebContents } from 'electron';
+
+import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+
+import { proxyHostToBrowserProxyHost } from 'teleterm/services/tshd/cluster';
+import { Logger, RuntimeSettings } from 'teleterm/types';
+
+import { ClusterStore } from './clusterStore';
+
+/**
+ * Limits navigation capabilities to reduce the attack surface.
+ * See TEL-Q122-19 from "Teleport Core Testing Q1 2022" security audit.
+ *
+ * See also points 12, 13 and 14 from the Electron's security tutorial.
+ * https://github.com/electron/electron/blob/v17.2.0/docs/tutorial/security.md#12-verify-webview-options-before-creation
+ */
+export function registerNavigationHandlers(
+  webContents: Pick<WebContents, 'setWindowOpenHandler' | 'on'>,
+  settings: Pick<RuntimeSettings, 'dev'>,
+  clusterStore: Pick<ClusterStore, 'getRootClusters'>,
+  logger: Logger
+): void {
+  webContents.on('will-navigate', (event, navigationUrl) => {
+    // Allow reloading the renderer app in dev mode.
+    if (settings.dev && new URL(navigationUrl).host === 'localhost:8080') {
+      return;
+    }
+    logger.warn(`Navigation to ${navigationUrl} blocked by 'will-navigate'`);
+    event.preventDefault();
+  });
+
+  // The usage of webview is blocked by default, but let's include the handler just in case.
+  // https://github.com/electron/electron/blob/v17.2.0/docs/api/webview-tag.md#enabling
+  webContents.on('will-attach-webview', (event, _, params) => {
+    logger.warn(
+      `Opening a webview to ${params.src} blocked by 'will-attach-webview'`
+    );
+    event.preventDefault();
+  });
+
+  // Open links in the browser.
+  webContents.setWindowOpenHandler(details => {
+    const url = new URL(details.url);
+
+    if (isUrlSafe(url, clusterStore, logger)) {
+      shell.openExternal(url.toString());
+    } else {
+      logger.warn(
+        `Opening a new window to ${url} blocked by 'setWindowOpenHandler'`
+      );
+      dialog.showErrorBox(
+        'Cannot open this link',
+        'The domain does not match any of the allowed domains. Check main.log for more details.'
+      );
+    }
+
+    return { action: 'deny' };
+  });
+}
+
+function isUrlSafe(
+  url: URL,
+  clusterStore: Pick<ClusterStore, 'getRootClusters'>,
+  logger: Logger
+): boolean {
+  if (url.protocol !== 'https:') {
+    return false;
+  }
+  if (url.host === 'goteleport.com') {
+    return true;
+  }
+  if (url.host === 'github.com' && url.pathname.startsWith('/gravitational/')) {
+    return true;
+  }
+
+  const rootClusterProxyHostAllowList = makeRootClusterProxyHostAllowList(
+    clusterStore.getRootClusters(),
+    logger
+  );
+
+  // Allow opening links to the Web UIs of root clusters currently added in the app.
+  if (rootClusterProxyHostAllowList.has(url.host)) {
+    return true;
+  }
+}
+
+/**
+ * Produces a list of proxy and SSO hosts of root clusters. This enables us to
+ * open links to Web UIs of clusters from within Connect.
+ *
+ * The port part of a proxy host is dropped if the port is 443. See `proxyHostToBrowserProxyHost` for
+ * more details.
+ */
+function makeRootClusterProxyHostAllowList(
+  clusters: Cluster[],
+  logger: Logger
+): Set<string> {
+  return new Set(
+    clusters
+      .flatMap(c => {
+        let browserProxyHost: string;
+        if (c.proxyHost) {
+          try {
+            browserProxyHost = proxyHostToBrowserProxyHost(c.proxyHost);
+          } catch (error) {
+            logger.error(
+              'Ran into an error when converting proxy host to browser proxy host',
+              error
+            );
+          }
+        }
+
+        // Allow the SSO host for SSO login/mfa redirects.
+        let browserSsoHost: string;
+        if (c.ssoHost) {
+          try {
+            browserSsoHost = proxyHostToBrowserProxyHost(c.ssoHost);
+          } catch (error) {
+            logger.error(
+              'Ran into an error when converting sso host to browser sso host',
+              error
+            );
+          }
+        }
+        return [browserProxyHost, browserSsoHost];
+      })
+      .filter(Boolean)
+  );
+}
diff --git a/web/packages/teleterm/src/mainProcess/profileWatcher/index.ts b/web/packages/teleterm/src/mainProcess/profileWatcher/index.ts
new file mode 100644
index 0000000000000..db5e0897a9dc7
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/profileWatcher/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './profileWatcher';
diff --git a/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.test.ts b/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.test.ts
new file mode 100644
index 0000000000000..404d875fcbbc5
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.test.ts
@@ -0,0 +1,369 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+import { wait } from 'shared/utils/wait';
+
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
+
+import { watchProfiles } from './profileWatcher';
+
+let tempDir: string;
+
+beforeAll(async () => {
+  tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'profile-watcher-test'));
+});
+
+afterAll(async () => {
+  if (tempDir) {
+    await fs.rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+// Ensure the watcher is stopped when a test fails.
+let abortController: AbortController;
+beforeEach(() => {
+  abortController = new AbortController();
+});
+afterEach(() => {
+  abortController.abort();
+});
+
+function makePerTestDir() {
+  return fs.mkdtemp(path.join(tempDir, 'test'));
+}
+
+const testDebounceMs = 10;
+
+async function mockTshClient(tshDir: string, initial: { clusters: Cluster[] }) {
+  const listRootClusters = async () => {
+    let paths: string[] = [];
+    try {
+      paths = await fs.readdir(tshDir);
+    } catch (err) {
+      if (err.code === 'ENOENT') {
+        throw {
+          name: 'TshdRpcError',
+          code: 'NOT_FOUND',
+        };
+      }
+      throw err;
+    }
+    return Promise.all(
+      paths.map(async singlePath => {
+        const file = await fs.readFile(
+          path.join(tshDir, singlePath, 'cluster.json'),
+          {
+            encoding: 'utf-8',
+          }
+        );
+        return Cluster.fromJsonString(file);
+      })
+    );
+  };
+
+  const insertOrUpdateCluster = async (cluster: Cluster) => {
+    const profileDir = path.join(tshDir, routing.parseClusterName(cluster.uri));
+
+    await fs.mkdir(profileDir, { recursive: true });
+    await fs.writeFile(
+      path.join(profileDir, 'cluster.json'),
+      Cluster.toJsonString(cluster),
+      { encoding: 'utf-8' }
+    );
+  };
+
+  const removeCluster = async (uri: RootClusterUri) => {
+    const profileDir = path.join(tshDir, routing.parseClusterName(uri));
+
+    await fs.rm(profileDir, {
+      recursive: true,
+    });
+  };
+
+  // Set initial state.
+  await Promise.all(
+    initial.clusters.map(cluster => insertOrUpdateCluster(cluster))
+  );
+
+  return {
+    listRootClusters,
+    insertOrUpdateCluster,
+    removeCluster,
+  };
+}
+
+function mockClusterStore(initial: { clusters: Cluster[] }) {
+  return {
+    getRootClusters: () => initial.clusters,
+    clearAll: () => {
+      initial.clusters = [];
+    },
+  };
+}
+
+test('yields an "added" change when new cluster appears', async () => {
+  const tshDir = await makePerTestDir();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  const cluster = makeRootCluster();
+  await tshClientMock.insertOrUpdateCluster(cluster);
+
+  const { value } = await watcher.next();
+  expect(value).toEqual([{ op: 'added', cluster }]);
+
+  await watcher.return(undefined);
+});
+
+test('yields a "removed" change when cluster disappears', async () => {
+  const tshDir = await makePerTestDir();
+  const cluster = makeRootCluster();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [cluster] });
+  const clusterStoreMock = mockClusterStore({ clusters: [cluster] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  void tshClientMock.removeCluster(cluster.uri);
+
+  const { value } = await watcher.next();
+  expect(value).toEqual([{ op: 'removed', cluster }]);
+
+  await watcher.return(undefined);
+});
+
+test('yields a "changed" change when cluster properties differ', async () => {
+  const tshDir = await makePerTestDir();
+  const oldCluster = makeRootCluster();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [oldCluster] });
+  const clusterStoreMock = mockClusterStore({ clusters: [oldCluster] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  const newCluster: Cluster = { ...oldCluster, connected: false };
+  void tshClientMock.insertOrUpdateCluster(newCluster);
+
+  const { value } = await watcher.next();
+  expect(value).toEqual([
+    { op: 'changed', previous: oldCluster, next: newCluster },
+  ]);
+
+  await watcher.return(undefined);
+});
+
+test('does not yield when no cluster changes detected', async () => {
+  const tshDir = await makePerTestDir();
+  const cluster = makeRootCluster();
+  const tshClientMock = await mockTshClient(tshDir, {
+    clusters: [
+      // Extend the cluster with properties loaded from the proxy to verify
+      // if they are properly ignored when detecting changes.
+      { ...cluster, authClusterId: 'some-id' },
+    ],
+  });
+  const clusterStoreMock = mockClusterStore({ clusters: [cluster] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  // Overwrite the cluster (profile properties are unchanged).
+  void tshClientMock.insertOrUpdateCluster(cluster);
+
+  const race = Promise.race([
+    watcher.next(),
+    // Wait a little longer than the debounce value.
+    wait(testDebounceMs + testDebounceMs / 2).then(() => 'timeout'),
+  ]);
+
+  expect(await race).toBe('timeout');
+  // Cancel the watcher with the abort signal, it's blocked on `watcher.next()`.
+  abortController.abort();
+});
+
+test('file system events are debounced', async () => {
+  const tshDir = await makePerTestDir();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [] });
+  const handler = jest.fn().mockImplementation(() => Promise.resolve());
+  const testDebounceMs = 100;
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  void (async () => {
+    for await (let e of watcher) {
+      await handler(e);
+    }
+  })();
+
+  const cluster = makeRootCluster();
+
+  // Insert two rapid events within debounce interval.
+  await tshClientMock.insertOrUpdateCluster(cluster);
+  await tshClientMock.insertOrUpdateCluster(cluster);
+  // Wait slightly longer than debounce interval to ensure a single handler is called.
+  await wait(2 * testDebounceMs);
+  expect(handler).toHaveBeenCalledTimes(1);
+});
+
+test('no events are lost when handler is slow', async () => {
+  const tshDir = await makePerTestDir();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [] });
+  const handler = jest.fn().mockImplementation(() => wait(2 * testDebounceMs));
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  const cluster = makeRootCluster();
+
+  void (async () => {
+    for await (let e of watcher) {
+      const handle = handler(e);
+      // Insert the second event while the first event is still processed.
+      void tshClientMock.insertOrUpdateCluster(cluster);
+      await handle;
+    }
+  })();
+
+  await tshClientMock.insertOrUpdateCluster(cluster);
+  await expect(() => {
+    return handler.mock.calls.length === 2;
+  }).toEventuallyBeTrue({ waitFor: 1000, tick: 10 });
+});
+
+test('watcher stops when consumer throws', async () => {
+  const tshDir = await makePerTestDir();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  await expect(watcher.throw(new Error('Consumer failure'))).rejects.toThrow(
+    'Consumer failure'
+  );
+
+  await tshClientMock.insertOrUpdateCluster(makeRootCluster());
+
+  const race = await Promise.race([
+    watcher.next(),
+    wait(300).then(() => 'timeout'),
+  ]);
+
+  expect(race).toStrictEqual({ done: true, value: undefined });
+});
+
+test('removing tsh directory does not break watcher', async () => {
+  const tshDir = await makePerTestDir();
+  const cluster = makeRootCluster();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [cluster] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: testDebounceMs,
+  });
+
+  // Start the watcher by pulling the first value.
+  const firstEvent = watcher.next();
+  await fs.rm(tshDir, { recursive: true });
+  expect((await firstEvent).value).toEqual([{ op: 'removed', cluster }]);
+  // Clean up the store, so that we can detect a change.
+  clusterStoreMock.clearAll();
+
+  await fs.mkdir(tshDir);
+  await tshClientMock.insertOrUpdateCluster(cluster);
+  // The second event needs to wait for the dir to be detected.
+  jest.useFakeTimers();
+  const secondEvent = watcher.next();
+  // Polling uses 1 second interval.
+  jest.advanceTimersByTime(1000);
+  jest.useRealTimers();
+  expect((await secondEvent).value).toEqual([{ op: 'added', cluster }]);
+});
+
+test('max file system events count is restricted', async () => {
+  const tshDir = await makePerTestDir();
+  const cluster = makeRootCluster();
+  const tshClientMock = await mockTshClient(tshDir, { clusters: [] });
+  const clusterStoreMock = mockClusterStore({ clusters: [] });
+  const watcher = watchProfiles({
+    tshDirectory: tshDir,
+    tshClient: tshClientMock,
+    clusterStore: clusterStoreMock,
+    signal: abortController.signal,
+    debounceMs: 100,
+    maxFileSystemEvents: 1,
+  });
+
+  const promises = await Promise.allSettled([
+    // Start the watcher by pulling the first value.
+    watcher.next(),
+    // Makes two updates.
+    tshClientMock.insertOrUpdateCluster(cluster),
+  ]);
+
+  expect(promises[0]).toEqual({
+    status: 'rejected',
+    reason: expect.objectContaining({
+      message:
+        'Exceeded file system event limit: more than 1 events detected within 100 ms',
+    }),
+  });
+});
diff --git a/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.ts b/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.ts
new file mode 100644
index 0000000000000..8b09588521c7a
--- /dev/null
+++ b/web/packages/teleterm/src/mainProcess/profileWatcher/profileWatcher.ts
@@ -0,0 +1,282 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { watch } from 'node:fs';
+import { access } from 'node:fs/promises';
+
+import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+import { debounce } from 'shared/utils/highbar';
+import { wait } from 'shared/utils/wait';
+
+import { isTshdRpcError } from 'teleterm/services/tshd';
+import { mergeClusterProfileWithDetails } from 'teleterm/services/tshd/cluster';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+interface TshClient {
+  listRootClusters(): Promise<Cluster[]>;
+}
+
+interface ClusterStore {
+  getRootClusters(): Cluster[];
+}
+
+/**
+ * Watches the specified `tshDirectory` for profile changes.
+ * File system events are debounced with a default 200 ms delay.
+ * The watcher should be started only after the initial cluster store sync completes,
+ * to prevent unnecessary profile change events.
+ *
+ * When the watched directory is removed, the watcher emits a profile change
+ * and enters polling mode (with 1 second interval) until the directory reappears.
+ */
+export async function* watchProfiles({
+  tshDirectory,
+  tshClient,
+  clusterStore,
+  debounceMs = 200,
+  maxFileSystemEvents = 4096,
+  signal,
+}: {
+  tshDirectory: string;
+  tshClient: TshClient;
+  clusterStore: ClusterStore;
+  debounceMs?: number;
+  /**
+   * Maximum number of file system events that can accumulate while debouncing.
+   *
+   * Note: On Windows, removing a watched directory can trigger an infinite stream
+   * of events. Setting this limit helps mitigate that issue.
+   *
+   * Default 4096.
+   * */
+  maxFileSystemEvents?: number;
+  signal?: AbortSignal;
+}): AsyncGenerator<ProfileChangeSet, void, void> {
+  while (!signal?.aborted) {
+    try {
+      // eslint-disable-next-line unused-imports/no-unused-vars
+      for await (const _ of debounceWatch(
+        tshDirectory,
+        debounceMs,
+        maxFileSystemEvents,
+        signal
+      )) {
+        const clusters = await tshClient.listRootClusters();
+        const newClusters = new Map(clusters.map(c => [c.uri, c]));
+        const oldClusters = new Map(
+          clusterStore.getRootClusters().map(c => [c.uri, c])
+        );
+
+        const changes = detectChanges(oldClusters, newClusters);
+        if (changes.length > 0) {
+          yield changes;
+        }
+      }
+    } catch (error) {
+      // Check if the error is caused by removing the watched directory.
+      // Removing that directory emits different events, depending on a platform:
+      // - On macOS/Linux, it emits a 'rename' event.
+      // - On Windows, it may throw an EPERM error, or emit thousands of events
+      // (so that we check FileSystemEventsOverflowError).
+      // To reliably detect removal on macOS/Linux, we expect tshClient.listRootClusters()
+      // to fail with a filesystem-related error, allowing us to catch all relevant cases here.
+      if (
+        isTshdRpcError(error, 'NOT_FOUND') ||
+        error instanceof FileSystemEventsOverflowError ||
+        error?.code === 'EPERM'
+      ) {
+        const ok = await pathExists(tshDirectory);
+        if (!ok) {
+          yield clusterStore
+            .getRootClusters()
+            .map(cluster => ({ op: 'removed', cluster }));
+          await waitForPath(tshDirectory, signal);
+          continue;
+        }
+      }
+      throw error;
+    }
+  }
+}
+
+class FileSystemEventsOverflowError extends Error {
+  constructor(maxCount: number, debounceMs: number) {
+    super(
+      `Exceeded file system event limit: more than ${maxCount} events detected within ${debounceMs} ms`
+    );
+  }
+}
+
+async function pathExists(dirPath: string): Promise<boolean> {
+  try {
+    await access(dirPath);
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/** Waits for path to exists, polling at intervals (1 second). */
+async function waitForPath(
+  dirPath: string,
+  signal?: AbortSignal
+): Promise<void> {
+  if (signal?.aborted) {
+    return;
+  }
+
+  while (!signal?.aborted) {
+    // Start from waiting, pathExists() was invoked earlier to check the path.
+    await wait(1000, signal);
+    const exist = await pathExists(dirPath);
+    if (exist) {
+      return;
+    }
+  }
+}
+
+export type ProfileChange =
+  | {
+      /** A cluster has been added. */
+      op: 'added';
+      cluster: Cluster;
+    }
+  | {
+      /** A cluster has been removed. */
+      op: 'removed';
+      cluster: Cluster;
+    }
+  | {
+      /**
+       * A cluster's properties have changed.
+       * Only the properties present locally in the profile are compared.
+       * (`listRootClusters` doesn't return cluster details from the proxy).
+       */
+      op: 'changed';
+      previous: Cluster;
+      next: Cluster;
+    };
+
+export type ProfileChangeSet = ProfileChange[];
+
+async function* debounceWatch(
+  path: string,
+  debounceMs: number,
+  maxFileSystemEvents: number,
+  abortSignal: AbortSignal | undefined
+): AsyncGenerator<void> {
+  let signal = Promise.withResolvers<void>();
+  let closed = false;
+  let eventsToDebounce = 0;
+  const scheduleYield = debounce(() => {
+    eventsToDebounce = 0;
+    signal.resolve();
+  }, debounceMs);
+  const onEvent = () => {
+    ++eventsToDebounce;
+    if (eventsToDebounce > maxFileSystemEvents) {
+      signal.reject(
+        new FileSystemEventsOverflowError(maxFileSystemEvents, debounceMs)
+      );
+      return;
+    }
+    scheduleYield();
+  };
+
+  const watcher = watch(
+    path,
+    { signal: abortSignal, recursive: true },
+    onEvent
+  );
+
+  const closeHandler = () => {
+    closed = true;
+    signal.resolve();
+  };
+  const errorHandler = (e: Error) => signal.reject(e);
+  watcher.on('close', closeHandler);
+  watcher.on('error', errorHandler);
+
+  // The watcher might be restarted if the path disappears and then reappears.
+  // Begin by checking for any changes immediately.
+  onEvent();
+
+  try {
+    while (true) {
+      await signal.promise;
+      if (closed) {
+        break;
+      }
+
+      // Recreate the signal so any events occurring while yielding will resolve the next promise.
+      signal = Promise.withResolvers();
+
+      yield;
+    }
+  } finally {
+    scheduleYield.cancel();
+    watcher.close();
+    watcher.off('close', closeHandler);
+    watcher.off('error', errorHandler);
+  }
+}
+
+function detectChanges(
+  previousClusters: Map<RootClusterUri, Cluster>,
+  nextClusters: Map<RootClusterUri, Cluster>
+): ProfileChange[] {
+  const changes: ProfileChange[] = [];
+  const allUris = new Set([...previousClusters.keys(), ...nextClusters.keys()]);
+
+  for (const uri of allUris) {
+    const previous = previousClusters.get(uri);
+    const next = nextClusters.get(uri);
+
+    if (!nextClusters.has(uri)) {
+      changes.push({
+        op: 'removed',
+        cluster: previous,
+      });
+    } else if (!previousClusters.has(uri)) {
+      changes.push({ op: 'added', cluster: next });
+    } else if (
+      // Ensure we are comparing only profile properties.
+      !Cluster.equals(
+        mergeClusterProfileWithDetails({
+          profile: previous,
+          details: Cluster.create(),
+        }),
+        mergeClusterProfileWithDetails({
+          profile: next,
+          details: Cluster.create(),
+        })
+      )
+    ) {
+      changes.push({
+        op: 'changed',
+        previous: previous,
+        next: next,
+      });
+    }
+  }
+
+  return changes;
+}
diff --git a/web/packages/teleterm/src/mainProcess/resolveNetworkAddress.ts b/web/packages/teleterm/src/mainProcess/resolveNetworkAddress.ts
index ef039840f3ac4..ab3d62fc07bb0 100644
--- a/web/packages/teleterm/src/mainProcess/resolveNetworkAddress.ts
+++ b/web/packages/teleterm/src/mainProcess/resolveNetworkAddress.ts
@@ -73,7 +73,7 @@ function waitForMatchInStdout(
     let chunks = '';
 
     const timeout = setTimeout(() => {
-      rejectOnError(
+      rejectWithCleanup(
         new ResolveError(requestedAddress, process, 'the operation timed out')
       );
     }, timeoutMs);
@@ -94,11 +94,23 @@ function waitForMatchInStdout(
       }
     };
 
-    const rejectOnError = (error: Error) => {
+    const rejectWithCleanup = (error: Error) => {
       reject(error);
       removeListeners();
     };
 
+    const rejectOnError = (error: Error) => {
+      const errorToReport = error.message.includes(process.spawnfile)
+        ? error
+        : // Attach spawnfile so that the process can be identified without looking at the stacktrace.
+          // resolveNetworkAddress is the only function that ends up surfacing to the UI the error
+          // event of a process.
+          new Error(`${process.spawnfile}: ${error.message}`, {
+            cause: error,
+          });
+      rejectWithCleanup(errorToReport);
+    };
+
     const rejectOnClose = (code: number, signal: NodeJS.Signals) => {
       const codeOrSignal = [
         // code can be 0, so we cannot just check it the same way as the signal.
@@ -108,7 +120,7 @@ function waitForMatchInStdout(
         .filter(Boolean)
         .join(' ');
       const details = codeOrSignal ? ` with ${codeOrSignal}` : '';
-      rejectOnError(
+      rejectWithCleanup(
         new ResolveError(
           requestedAddress,
           process,
diff --git a/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts b/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts
deleted file mode 100644
index 9551237e0bbdb..0000000000000
--- a/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { ipcMain } from 'electron';
-
-import { isAbortError } from 'shared/utils/abortError';
-
-import { MainProcessIpc } from 'teleterm/mainProcess/types';
-import { TshdClient } from 'teleterm/services/tshd';
-import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
-import { proxyHostToBrowserProxyHost } from 'teleterm/services/tshd/cluster';
-import * as tshd from 'teleterm/services/tshd/types';
-import { Logger } from 'teleterm/types';
-
-export type RootClusterProxyHostAllowList = Set<string>;
-
-/**
- * Refreshes the allow list whenever the renderer process notifies the main process that the list of
- * clusters in ClustersService got updated.
- *
- * The allow list includes proxy hosts of root clusters. This enables us to open links to Web UIs of
- * clusters from within Connect.
- *
- * The port part of a proxy host is dropped if the port is 443. See proxyHostToBrowserProxyHost for
- * more details.
- */
-export function manageRootClusterProxyHostAllowList({
-  tshdClient,
-  logger,
-  allowList,
-}: {
-  tshdClient: TshdClient;
-  logger: Logger;
-  allowList: RootClusterProxyHostAllowList;
-}) {
-  let abortController: AbortController;
-
-  const refreshAllowList = async () => {
-    // Allow only one call to be in progress. This ensures that on subsequent calls to
-    // refreshAllowList, we always store only the most recent version of the list.
-    abortController?.abort();
-    abortController = new AbortController();
-
-    let rootClusters: tshd.Cluster[];
-    try {
-      const { response } = await tshdClient.listRootClusters(
-        {},
-        { abort: cloneAbortSignal(abortController.signal) }
-      );
-      rootClusters = response.clusters;
-    } catch (error) {
-      if (isAbortError(error)) {
-        // Ignore abort errors. They will be logged by the gRPC client middleware.
-        return;
-      }
-
-      logger.error('Could not fetch root clusters', error);
-      // Return instead of throwing as there's nothing else we can do with the error at this place
-      // in the program.
-      return;
-    }
-
-    allowList.clear();
-    for (const rootCluster of rootClusters) {
-      if (rootCluster.proxyHost) {
-        let browserProxyHost: string;
-        try {
-          browserProxyHost = proxyHostToBrowserProxyHost(rootCluster.proxyHost);
-          allowList.add(browserProxyHost);
-        } catch (error) {
-          logger.error(
-            'Ran into an error when converting proxy host to browser proxy host',
-            error
-          );
-        }
-      }
-
-      // Allow the SSO host for SSO login/mfa redirects.
-      if (rootCluster.ssoHost) {
-        let browserSsoHost: string;
-        try {
-          browserSsoHost = proxyHostToBrowserProxyHost(rootCluster.ssoHost);
-          allowList.add(browserSsoHost);
-        } catch (error) {
-          logger.error(
-            'Ran into an error when converting sso host to browser sso host',
-            error
-          );
-        }
-      }
-    }
-  };
-
-  refreshAllowList();
-
-  ipcMain.on(MainProcessIpc.RefreshClusterList, () => {
-    refreshAllowList();
-  });
-}
diff --git a/web/packages/teleterm/src/mainProcess/runtimeSettings.ts b/web/packages/teleterm/src/mainProcess/runtimeSettings.ts
index 588c79e5e5e84..4a8980e612cb3 100644
--- a/web/packages/teleterm/src/mainProcess/runtimeSettings.ts
+++ b/web/packages/teleterm/src/mainProcess/runtimeSettings.ts
@@ -30,7 +30,7 @@ const { argv, env } = process;
 
 const RESOURCES_PATH = app.isPackaged
   ? process.resourcesPath
-  : path.join(__dirname, '../../../../');
+  : path.join(__dirname, '../../..');
 
 const TSH_BIN_ENV_VAR = 'CONNECT_TSH_BIN_PATH';
 // __dirname of this file in dev mode is teleport/web/packages/teleterm/build/app/main
@@ -57,6 +57,7 @@ const insecure =
   (dev && !!env.CONNECT_INSECURE);
 
 export async function getRuntimeSettings(): Promise<RuntimeSettings> {
+  const homeDir = app.getPath('home');
   const userDataDir = app.getPath('userData');
   const sessionDataDir = app.getPath('sessionData');
   const tempDataDir = app.getPath('temp');
@@ -64,7 +65,7 @@ export async function getRuntimeSettings(): Promise<RuntimeSettings> {
     tsh: tshAddress,
     shared: sharedAddress,
     tshdEvents: tshdEventsAddress,
-  } = requestGrpcServerAddresses();
+  } = await requestGrpcServerAddresses();
   const { binDir, tshBinPath } = getBinaryPaths();
   const { username } = os.userInfo();
   const hostname = os.hostname();
@@ -79,7 +80,7 @@ export async function getRuntimeSettings(): Promise<RuntimeSettings> {
 
   const tshd = {
     binaryPath: tshBinPath,
-    homeDir: getTshHomeDir(),
+    defaultHomeDir: path.resolve(app.getPath('home'), '.tsh'),
     requestedNetworkAddress: tshAddress,
   };
   const sharedProcess = {
@@ -106,6 +107,7 @@ export async function getRuntimeSettings(): Promise<RuntimeSettings> {
     tshd,
     sharedProcess,
     tshdEvents,
+    homeDir,
     userDataDir,
     sessionDataDir,
     tempDataDir,
@@ -147,14 +149,6 @@ function getKubeConfigsDir(): string {
   return kubeConfigsPath;
 }
 
-function getTshHomeDir() {
-  const tshPath = path.resolve(app.getPath('userData'), 'tsh');
-  if (!fs.existsSync(tshPath)) {
-    fs.mkdirSync(tshPath);
-  }
-  return tshPath;
-}
-
 // binDir is used in the packaged version to add tsh to PATH.
 // tshBinPath is used by Connect to call tsh directly.
 function getBinaryPaths(): { binDir?: string; tshBinPath: string } {
@@ -201,13 +195,13 @@ function getBinaryPaths(): { binDir?: string; tshBinPath: string } {
 }
 
 export function getAssetPath(...paths: string[]): string {
-  return path.join(RESOURCES_PATH, 'assets', ...paths);
+  return path.join(RESOURCES_PATH, 'build_resources', ...paths);
 }
 
 /**
  * Describes what addresses the gRPC servers should attempt to obtain on app startup.
  */
-function requestGrpcServerAddresses(): GrpcServerAddresses {
+async function requestGrpcServerAddresses(): Promise<GrpcServerAddresses> {
   switch (process.platform) {
     case 'win32': {
       return {
@@ -218,21 +212,33 @@ function requestGrpcServerAddresses(): GrpcServerAddresses {
     }
     case 'linux':
     case 'darwin':
+      // Sockets are created in a temporary directory to avoid exceeding the
+      // maximum allowed path length for Unix domain sockets.
+      // Limits: macOS - 104 characters, Linux - 108 characters.
+      const tempDir = await getUnixUserTempDir();
       return {
-        tsh: getUnixSocketNetworkAddress('tsh.socket'),
-        shared: getUnixSocketNetworkAddress('shared.socket'),
-        tshdEvents: getUnixSocketNetworkAddress('tshd_events.socket'),
+        tsh: getUnixSocketPath(tempDir, 'tsh.sock'),
+        shared: getUnixSocketPath(tempDir, 'shared.sock'),
+        tshdEvents: getUnixSocketPath(tempDir, 'tshde.sock'),
       };
   }
 }
 
-function getUnixSocketNetworkAddress(socketName: string) {
-  const unixSocketPath = path.resolve(app.getPath('userData'), socketName);
-
-  // try to cleanup after previous process that unexpectedly crashed
-  if (fs.existsSync(unixSocketPath)) {
-    fs.unlinkSync(unixSocketPath);
-  }
+function getUnixSocketPath(tempDir: string, socketName: string): string {
+  const socketPath = path.join(tempDir, socketName);
+  return `unix://${socketPath}`;
+}
 
-  return `unix://${path.resolve(app.getPath('userData'), socketName)}`;
+async function getUnixUserTempDir(): Promise<string> {
+  // On macOS, the 'temp' dir is like /var/folders/y5/yqg8xz555_v7xfsr0wn6b4q80000gn/T/.
+  // That dir is per-user and secure by default.
+  // On Linux the temp dir is like /tmp, and it's accessible by anyone.
+  const tempDir = app.getPath('temp');
+  const appName = app.getName();
+  // `mkdtemp` creates a temporary directory with mode 0o700,
+  // ensuring that only the current user can access it (important on Linux).
+  // TODO(gzdunek): Node.js 24 introduced mkdtempDisposable().
+  // Create a global DisposableStack to track all disposable resources
+  // and automatically clean them up when the app exits.
+  return fs.promises.mkdtemp(path.join(tempDir, `${appName}-`));
 }
diff --git a/web/packages/teleterm/src/mainProcess/types.ts b/web/packages/teleterm/src/mainProcess/types.ts
index 6ce4613069fad..abddc9aad3e2a 100644
--- a/web/packages/teleterm/src/mainProcess/types.ts
+++ b/web/packages/teleterm/src/mainProcess/types.ts
@@ -16,8 +16,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+
 import { DeepLinkParseResult } from 'teleterm/deepLinks';
+import type {
+  ClusterLifecycleEvent,
+  ProfileWatcherError,
+} from 'teleterm/mainProcess/clusterLifecycleManager';
+import type { ClusterStoreUpdate } from 'teleterm/mainProcess/clusterStore';
 import { CreateAgentConfigFileArgs } from 'teleterm/mainProcess/createAgentConfigFile';
+import { AppUpdateEvent } from 'teleterm/services/appUpdater';
 import { FileStorage } from 'teleterm/services/fileStorage';
 import { Document } from 'teleterm/ui/services/workspacesService';
 import { RootClusterUri } from 'teleterm/ui/uri';
@@ -49,6 +57,8 @@ export type RuntimeSettings = {
    * - Starting the app in dev mode with the CONNECT_INSECURE env var.
    */
   insecure: boolean;
+  /** User's home directory. */
+  homeDir: string;
   userDataDir: string;
   sessionDataDir: string;
   tempDataDir: string;
@@ -68,7 +78,7 @@ export type RuntimeSettings = {
   tshd: {
     requestedNetworkAddress: string;
     binaryPath: string;
-    homeDir: string;
+    defaultHomeDir: string;
   };
   sharedProcess: {
     requestedNetworkAddress: string;
@@ -138,18 +148,14 @@ export type MainProcessClient = {
   }>;
   configService: ConfigService;
   fileStorage: FileStorage;
-  removeKubeConfig(options: {
-    relativePath: string;
-    isDirectory?: boolean;
-  }): Promise<void>;
   /**
    * Tells the OS to focus the window. If wait is true, polls periodically for window status and
    * resolves when it's focused or after a short timeout.
    *
-   * Most of the time wait shouldn't be used, it's there for use cases where it's important for the
-   * app to be focused (e.g., the business logic needs to use the clipboard API). Even in that case,
-   * the logic must handle a scenario where focus wasn't received as focus cannot be guaranteed.
-   * Any app can steal focus at any time.
+   * Most of the time wait shouldn't be used. It's for use cases where the app must be focused
+   * before carrying out the rest of the logic (e.g., the clipboard API requires focus). Even in
+   * those cases, the logic must handle a scenario where focus wasn't received as focus cannot be
+   * guaranteed. Any app can steal focus at any time.
    */
   forceFocusWindow(
     args?: { wait?: false } | { wait: true; signal?: AbortSignal }
@@ -194,7 +200,6 @@ export type MainProcessClient = {
    * interacted with the relevant modals during startup and is free to use the app.
    */
   signalUserInterfaceReadiness(args: { success: boolean }): void;
-  refreshClusterList(): void;
   /**
    * Opens the Electron directory picker and sends the selected path to tshd through SetSharedDirectoryForDesktopSession.
    * tshd then verifies whether there is an active session for the specified desktop user and attempts to open the directory.
@@ -206,6 +211,42 @@ export type MainProcessClient = {
     desktopUri: string;
     login: string;
   }): Promise<string>;
+  changeAppUpdatesManagingCluster(
+    clusterUri: RootClusterUri | undefined
+  ): Promise<void>;
+  supportsAppUpdates(): boolean;
+  checkForAppUpdates(): Promise<void>;
+  downloadAppUpdate(): Promise<void>;
+  cancelAppUpdateDownload(): Promise<void>;
+  quitAndInstallAppUpdate(): Promise<void>;
+  subscribeToAppUpdateEvents(listener: (args: AppUpdateEvent) => void): {
+    cleanup: () => void;
+  };
+  subscribeToOpenAppUpdateDialog(listener: () => void): {
+    cleanup: () => void;
+  };
+  subscribeToIsInBackgroundMode(
+    listener: (opts: { isInBackgroundMode: boolean }) => void
+  ): {
+    cleanup: () => void;
+  };
+  addCluster(proxyAddress: string): Promise<Cluster>;
+  syncCluster(clusterUri: RootClusterUri): Promise<void>;
+  syncRootClusters(): Promise<Cluster[]>;
+  logout(clusterUri: RootClusterUri): Promise<void>;
+  subscribeToClusterStore(listener: (value: ClusterStoreUpdate) => void): {
+    cleanup: () => void;
+  };
+  registerClusterLifecycleHandler(
+    listener: (event: ClusterLifecycleEvent) => Promise<void>
+  ): {
+    cleanup: () => void;
+  };
+  subscribeToProfileWatcherErrors(
+    listener: (args: ProfileWatcherError) => void
+  ): {
+    cleanup: () => void;
+  };
 };
 
 export type ChildProcessAddresses = {
@@ -311,17 +352,32 @@ export enum RendererIpc {
   NativeThemeUpdate = 'renderer-native-theme-update',
   ConnectMyComputerAgentUpdate = 'renderer-connect-my-computer-agent-update',
   DeepLinkLaunch = 'renderer-deep-link-launch',
+  OpenAppUpdateDialog = 'renderer-open-app-update-dialog',
+  AppUpdateEvent = 'renderer-app-update-event',
+  IsInBackgroundMode = 'renderer-is-in-background-mode',
+  ProfileWatcherError = 'renderer-profile-watcher-error',
 }
 
 export enum MainProcessIpc {
   GetRuntimeSettings = 'main-process-get-runtime-settings',
   TryRemoveConnectMyComputerAgentBinary = 'main-process-try-remove-connect-my-computer-agent-binary',
-  RefreshClusterList = 'main-process-refresh-cluster-list',
   DownloadConnectMyComputerAgent = 'main-process-connect-my-computer-download-agent',
   VerifyConnectMyComputerAgent = 'main-process-connect-my-computer-verify-agent',
   SaveTextToFile = 'main-process-save-text-to-file',
   ForceFocusWindow = 'main-process-force-focus-window',
   SelectDirectoryForDesktopSession = 'main-process-select-directory-for-desktop-session',
+  CheckForAppUpdates = 'main-process-check-for-app-updates',
+  DownloadAppUpdate = 'main-process-download-app-update',
+  CancelAppUpdateDownload = 'main-process-cancel-app-update-download',
+  QuiteAndInstallAppUpdate = 'main-process-quit-and-install-app-update',
+  ChangeAppUpdatesManagingCluster = 'main-process-change-app-updates-managing-cluster',
+  SupportsAppUpdates = 'main-process-supports-app-updates',
+  InitClusterStoreSubscription = 'main-process-init-cluster-store-subscription',
+  SyncCluster = 'main-process-sync-cluster',
+  AddCluster = 'main-process-add-cluster',
+  SyncRootClusters = 'main-process-sync-root-clusters',
+  Logout = 'main-process-logout',
+  RegisterClusterLifecycleHandler = 'main-process-register-cluster-lifecycle-handler',
 }
 
 export enum WindowsManagerIpc {
diff --git a/web/packages/teleterm/src/mainProcess/windowsManager.test.ts b/web/packages/teleterm/src/mainProcess/windowsManager.test.ts
index 49aef45f6a009..5db7d497b0ebb 100644
--- a/web/packages/teleterm/src/mainProcess/windowsManager.test.ts
+++ b/web/packages/teleterm/src/mainProcess/windowsManager.test.ts
@@ -21,6 +21,7 @@
 
 import { BrowserWindow } from 'electron';
 
+import { createMockConfigService } from 'teleterm/services/config/fixtures/mocks';
 import { createMockFileStorage } from 'teleterm/services/fileStorage/fixtures/mocks';
 
 import { makeRuntimeSettings } from './fixtures/mocks';
@@ -73,7 +74,8 @@ describe('waitForWindowFocus', () => {
 const makeWindowsManager = () => {
   const windowsManager = new WindowsManager(
     createMockFileStorage(),
-    makeRuntimeSettings()
+    makeRuntimeSettings(),
+    createMockConfigService({})
   );
 
   let isFocused = false;
@@ -84,6 +86,8 @@ const makeWindowsManager = () => {
     }),
     isFocused: jest.fn().mockImplementation(() => isFocused),
     isMinimized: jest.fn().mockReturnValue(false),
+    isVisible: jest.fn().mockReturnValue(true),
+    isDestroyed: jest.fn().mockReturnValue(false),
   } as Partial<BrowserWindow>;
 
   windowsManager['window'] = mockWindow as BrowserWindow;
diff --git a/web/packages/teleterm/src/mainProcess/windowsManager.ts b/web/packages/teleterm/src/mainProcess/windowsManager.ts
index cc8ad80be9554..9d5d335e0cb4b 100644
--- a/web/packages/teleterm/src/mainProcess/windowsManager.ts
+++ b/web/packages/teleterm/src/mainProcess/windowsManager.ts
@@ -21,7 +21,9 @@ import * as url from 'node:url';
 
 import {
   app,
+  autoUpdater,
   BrowserWindow,
+  dialog,
   ipcMain,
   Menu,
   nativeTheme,
@@ -29,6 +31,8 @@ import {
   screen,
 } from 'electron';
 
+import { ensureError } from 'shared/utils/error';
+
 import { DeepLinkParseResult } from 'teleterm/deepLinks';
 import Logger from 'teleterm/logger';
 import {
@@ -36,11 +40,16 @@ import {
   RuntimeSettings,
   WindowsManagerIpc,
 } from 'teleterm/mainProcess/types';
+import { ConfigService } from 'teleterm/services/config';
 import { FileStorage } from 'teleterm/services/fileStorage';
 import { darkTheme, lightTheme } from 'teleterm/ui/ThemeProvider/theme';
 
 type WindowState = Rectangle;
 
+interface RunInBackgroundState {
+  notified?: boolean;
+}
+
 export class WindowsManager {
   private storageKey = 'windowState';
   private logger = new Logger('WindowsManager');
@@ -57,10 +66,17 @@ export class WindowsManager {
     reject: (error: Error) => void;
   };
   private readonly windowUrl: string;
+  /**
+   * Tracks if the window was hidden via `enterBackgroundMode()` rather than
+   * by the OS (e.g. Command+H).
+   */
+  private isInBackgroundMode: boolean;
+  private crashWindowPromise: Promise<void>;
 
   constructor(
     private fileStorage: FileStorage,
-    private settings: RuntimeSettings
+    private settings: RuntimeSettings,
+    private configService: ConfigService
   ) {
     this.selectionContextMenu = Menu.buildFromTemplate([{ role: 'copy' }]);
     this.frontendAppInit = {
@@ -125,11 +141,45 @@ export class WindowsManager {
       },
     });
 
-    window.once('close', () => {
+    // Flag to track if the app tries to quit.
+    // When true, the window should close rather than enter the background mode,
+    // as that would block the quit process.
+    let isAppQuitting = false;
+    // Fired when the app initiates shutdown explicitly, via app.quit().
+    app.on('before-quit', () => {
+      isAppQuitting = true;
+    });
+    // Fired when the app initiates shutdown due to an update.
+    //
+    // When using electron-updater's quitAndInstall, the windows close first,
+    // and then 'before-quit' is emitted. This sequence differs from the normal
+    // quit flow.
+    //
+    // Note: Although we use electron-updater (not Electron's native autoUpdater),
+    // this event is available because electron-updater emulates it.
+    autoUpdater.on('before-quit-for-update', () => {
+      isAppQuitting = true;
+    });
+
+    window.on('close', async e => {
       this.saveWindowState(window);
-      this.frontendAppInit.reject(
-        new Error('Window was closed before frontend app got initialized')
-      );
+
+      if (isAppQuitting || !this.configService.get('runInBackground').value) {
+        this.frontendAppInit.reject(
+          new Error('Window was closed before frontend app got initialized')
+        );
+        return;
+      }
+
+      e.preventDefault();
+
+      const shouldRun = await this.confirmIfShouldRunInBackgroundOnce();
+      if (shouldRun) {
+        this.enterBackgroundMode();
+        return;
+      }
+      // Retry closing.
+      window.close();
     });
 
     // shows the window when the DOM is ready, so we don't have a brief flash of a blank screen
@@ -198,20 +248,69 @@ export class WindowsManager {
     );
   }
 
+  /** Shows the window when it's hidden or minimized. */
+  showWindow(): void {
+    if (!this.isWindowUsable()) {
+      return;
+    }
+
+    if (this.window.isMinimized()) {
+      this.window.restore();
+    }
+
+    if (this.window.isVisible()) {
+      this.window.focus();
+      return;
+    }
+
+    this.window.show();
+    if (this.isInBackgroundMode) {
+      this.window.webContents.send(RendererIpc.IsInBackgroundMode, {
+        isInBackgroundMode: false,
+      });
+      void app.dock?.show();
+      this.isInBackgroundMode = false;
+    }
+  }
+
+  /**
+   * Hides the window if it's visible.
+   * On macOS, it also hides the dock icon.
+   */
+  enterBackgroundMode(): void {
+    if (!this.isWindowUsable()) {
+      return;
+    }
+
+    if (!this.window.isVisible()) {
+      return;
+    }
+
+    this.window.hide();
+    this.window.webContents.send(RendererIpc.IsInBackgroundMode, {
+      isInBackgroundMode: true,
+    });
+    // One side effect to be aware of:
+    // If you close the app window in one macOS space, switch to another space,
+    // and then show the app again, macOS will return you to the original space.
+    // If you close the window again, macOS automatically switches back
+    // to the space where you requested showing the window.
+    // This behavior can feel a bit awkward.
+    app.dock?.hide();
+    this.isInBackgroundMode = true;
+  }
+
   /**
    * focusWindow is for situations where the app has privileges to do so, for example in a scenario
    * where the user attempts to launch a second instance of the app – the same process that the user
    * interacted with asks for its window to receive focus.
    */
   focusWindow(): void {
-    if (!this.window) {
+    if (!this.isWindowUsable()) {
       return;
     }
 
-    if (this.window.isMinimized()) {
-      this.window.restore();
-    }
-
+    this.showWindow();
     this.window.focus();
   }
 
@@ -223,7 +322,7 @@ export class WindowsManager {
    * expired, Connect should receive focus and show an appropriate message to the user.
    */
   forceFocusWindow(): void {
-    if (!this.window) {
+    if (!this.isWindowUsable()) {
       return;
     }
 
@@ -263,12 +362,10 @@ export class WindowsManager {
     // https://github.com/electron/electron/issues/2867#issuecomment-142480964
     // https://github.com/electron/electron/issues/2867#issuecomment-142511956
 
+    this.showWindow();
+
     app.dock?.bounce('informational');
 
-    // app.focus() alone doesn't un-minimize the window if the window is minimized.
-    if (this.window.isMinimized()) {
-      this.window.restore();
-    }
     app.focus({ steal: true });
   }
 
@@ -385,6 +482,79 @@ export class WindowsManager {
       ...getPositionAndSize(),
     };
   }
+
+  private async confirmIfShouldRunInBackgroundOnce(): Promise<boolean> {
+    const runInBackgroundState = this.fileStorage.get(
+      'runInBackground'
+    ) as RunInBackgroundState;
+    if (
+      runInBackgroundState?.notified ||
+      // If the value is set in the config file, do not notify too.
+      this.configService.get('runInBackground').metadata.isStored
+    ) {
+      return true;
+    }
+
+    const isMac = this.settings.platform === 'darwin';
+
+    const { response } = await dialog.showMessageBox(this.window, {
+      type: 'question',
+      message: isMac
+        ? 'Keep Teleport Connect running in the menu bar?'
+        : 'Keep Teleport Connect running in the system tray?',
+      detail:
+        'VNet and connections to databases, Kubernetes clusters, and apps will remain active.',
+      buttons: ['Keep Running', 'Quit'],
+      noLink: true,
+      defaultId: 0,
+    });
+
+    const state: RunInBackgroundState = { notified: true };
+    this.fileStorage.put('runInBackground', state);
+
+    const keepRunning = response === 0;
+    if (!keepRunning) {
+      this.configService.set('runInBackground', false);
+    }
+    return keepRunning;
+  }
+
+  /**
+   * Displays an error in a system dialog and offers reloading the window
+   * or quitting the app.
+   */
+  async crashWindow(error: unknown): Promise<void> {
+    if (this.crashWindowPromise) {
+      return this.crashWindowPromise;
+    }
+    this.crashWindowPromise = this.doCrashWindow(error);
+    try {
+      await this.crashWindowPromise;
+    } finally {
+      this.crashWindowPromise = undefined;
+    }
+  }
+
+  private async doCrashWindow(error: unknown): Promise<void> {
+    this.logger.error('Window crashed', error);
+    const { response } = await dialog.showMessageBox(this.window, {
+      type: 'error',
+      message: 'Teleport Connect has crashed',
+      detail: ensureError(error).message,
+      buttons: ['Reload Window', 'Quit'],
+      defaultId: 0,
+      noLink: true,
+    });
+    if (response === 0) {
+      this.window.reload();
+    } else {
+      app.quit();
+    }
+  }
+
+  private isWindowUsable(): boolean {
+    return this.window && !this.window.isDestroyed();
+  }
 }
 
 /**
diff --git a/web/packages/teleterm/src/services/appUpdater/appUpdater.test.ts b/web/packages/teleterm/src/services/appUpdater/appUpdater.test.ts
new file mode 100644
index 0000000000000..0c88bd45cbb55
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/appUpdater.test.ts
@@ -0,0 +1,402 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { createHash } from 'node:crypto';
+
+import { MacUpdater } from 'electron-updater';
+
+import type { GetClusterVersionsResponse } from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+import { wait } from 'shared/utils/wait';
+
+import Logger, { NullService } from 'teleterm/logger';
+
+import { AppUpdateEvent, AppUpdater, AppUpdaterStorage } from './appUpdater';
+
+const mockedAppVersion = '17.8.0';
+
+jest.mock('electron', () => ({
+  app: {
+    // Should be false to avoid removing real Squirrel directory in `dispose`.
+    isPackaged: false,
+    getVersion: () => mockedAppVersion,
+  },
+  autoUpdater: { on: () => {} },
+}));
+
+beforeAll(() => {
+  Logger.init(new NullService());
+
+  // Mock fetching checksum.
+  // Creates hash from the passed URL.
+  global.fetch = jest.fn(async url => ({
+    ok: true,
+    text: async () =>
+      `${createHash('sha-512').update(url).digest('hex')}  Teleport Connect-17.5.4-mac.zip`,
+  })) as jest.Mock;
+});
+
+afterAll(() => {
+  jest.restoreAllMocks();
+});
+
+function makeUpdaterStorage(
+  initialValue: { managingClusterUri?: string } = {}
+): AppUpdaterStorage {
+  return {
+    get: () => initialValue,
+    put: newValue => (initialValue = newValue),
+  };
+}
+
+// MacUpdater with mocked download and install features.
+class MockedMacUpdater extends MacUpdater {
+  constructor() {
+    super(undefined, {
+      appUpdateConfigPath: __dirname,
+      baseCachePath: __dirname,
+      isPackaged: false,
+      userDataPath: '',
+      onQuit(): void {},
+      quit(): void {},
+      relaunch(): void {},
+      version: mockedAppVersion,
+      whenReady: () => Promise.resolve(),
+      name: 'Teleport Connect',
+    });
+    // Prevents electron-updater from creating .updaterId file.
+    this.stagingUserIdPromise.value = Promise.resolve(
+      '153432a8-93de-577c-a76a-3a042f1d7580'
+    );
+  }
+
+  protected override async doDownloadUpdate(): Promise<string[]> {
+    // Simulate download.
+    await wait(10);
+    this.dispatchUpdateDownloaded({
+      ...this.updateInfoAndProvider.info,
+      downloadedFile: 'some-update',
+    });
+    return ['some-update'];
+  }
+
+  override quitAndInstall() {}
+}
+
+function setUpAppUpdater(options: {
+  clusters: GetClusterVersionsResponse;
+  storage?: AppUpdaterStorage;
+  processEnvVar?: string;
+}) {
+  const clusterGetter = async () => {
+    return options.clusters;
+  };
+
+  const nativeUpdater = new MockedMacUpdater();
+
+  const checkForUpdatesSpy = jest.spyOn(nativeUpdater, 'checkForUpdates');
+  const downloadUpdateSpy = jest.spyOn(nativeUpdater, 'downloadUpdate');
+  let lastEvent: { value?: AppUpdateEvent } = {};
+  const appUpdater = new AppUpdater(
+    options.storage || makeUpdaterStorage(),
+    clusterGetter,
+    async () => 'https://cdn.teleport.dev',
+    event => {
+      lastEvent.value = event;
+    },
+    options.processEnvVar,
+    nativeUpdater
+  );
+
+  return {
+    appUpdater,
+    nativeUpdater,
+    checkForUpdatesSpy,
+    downloadUpdateSpy,
+    lastEvent,
+  };
+}
+
+test('auto-downloads update when all clusters are reachable', async () => {
+  const setup = setUpAppUpdater({
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '19.0.0',
+          minToolsVersion: '18.0.0-aa',
+        },
+      ],
+      unreachableClusters: [],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-available',
+      autoDownload: true,
+    })
+  );
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(1);
+
+  await setup.downloadUpdateSpy.mock.results[0].value;
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-downloaded',
+    })
+  );
+});
+
+test('does not auto-download update when there are unreachable clusters', async () => {
+  const setup = setUpAppUpdater({
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '19.0.0',
+          minToolsVersion: '18.0.0-aa',
+        },
+      ],
+      unreachableClusters: [
+        {
+          clusterUri: '/clusters/bar',
+          errorMessage: 'Network issue',
+        },
+      ],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-available',
+      autoDownload: false,
+    })
+  );
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(0);
+});
+
+test('does not auto-download update when env var is set to off', async () => {
+  const setup = setUpAppUpdater({
+    processEnvVar: 'off',
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '19.0.0',
+          minToolsVersion: '18.0.0-aa',
+        },
+      ],
+      unreachableClusters: [],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates({ noAutoDownload: true });
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-not-available',
+      autoUpdatesStatus: expect.objectContaining({
+        reason: 'disabled-by-env-var',
+      }),
+    })
+  );
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(0);
+});
+
+test('does not auto-download update when all clusters are reachable and noAutoDownload is set', async () => {
+  const setup = setUpAppUpdater({
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '19.0.0',
+          minToolsVersion: '18.0.0-aa',
+        },
+      ],
+      unreachableClusters: [],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates({ noAutoDownload: true });
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-available',
+      autoDownload: false,
+    })
+  );
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(0);
+});
+
+test('discards previous update if a new one is found that should not auto-download', async () => {
+  const clusters = {
+    reachableClusters: [
+      {
+        clusterUri: '/clusters/foo',
+        toolsAutoUpdate: true,
+        toolsVersion: '19.0.0',
+        minToolsVersion: '18.0.0-aa',
+      },
+    ],
+    unreachableClusters: [],
+  };
+
+  const setup = setUpAppUpdater({
+    clusters,
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(1);
+  await setup.downloadUpdateSpy.mock.results[0].value;
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-downloaded',
+      update: expect.objectContaining({
+        version: '19.0.0',
+      }),
+    })
+  );
+
+  clusters.reachableClusters = [
+    {
+      clusterUri: '/clusters/foo',
+      toolsAutoUpdate: true,
+      toolsVersion: '19.0.0',
+      minToolsVersion: '18.0.0-aa',
+    },
+
+    // This cluster is on newer version, so it will be providing updates.
+    {
+      clusterUri: '/clusters/bar',
+      toolsAutoUpdate: true,
+      toolsVersion: '19.0.1',
+      minToolsVersion: '18.0.0-aa',
+    },
+  ];
+  await setup.appUpdater.checkForUpdates({ noAutoDownload: true });
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(1);
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      autoDownload: false,
+      kind: 'update-available',
+      update: expect.objectContaining({
+        version: '19.0.1',
+      }),
+    })
+  );
+  await setup.appUpdater.dispose();
+  // Check if the app is set to discard the first downloaded update on close.
+  expect(setup.nativeUpdater.autoInstallOnAppQuit).toBeFalsy();
+});
+
+test('discards previous update if the latest check returns no update', async () => {
+  const clusters = {
+    reachableClusters: [
+      {
+        clusterUri: '/clusters/foo',
+        toolsAutoUpdate: true,
+        toolsVersion: '19.0.0',
+        minToolsVersion: '18.0.0-aa',
+      },
+    ],
+    unreachableClusters: [],
+  };
+
+  const setup = setUpAppUpdater({
+    clusters,
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(1);
+  await setup.downloadUpdateSpy.mock.results[0].value;
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-downloaded',
+      update: expect.objectContaining({
+        version: '19.0.0',
+      }),
+    })
+  );
+
+  clusters.reachableClusters = [];
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.downloadUpdateSpy).toHaveBeenCalledTimes(1);
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-not-available',
+    })
+  );
+  await setup.appUpdater.dispose();
+  // Check if the app is set to discard the first downloaded update on close.
+  expect(setup.nativeUpdater.autoInstallOnAppQuit).toBeFalsy();
+});
+
+test('when the update is older than app updateKind equals downgrade', async () => {
+  const setup = setUpAppUpdater({
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '17.7.5',
+          minToolsVersion: '16.0.0-aa',
+        },
+      ],
+      unreachableClusters: [],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-available',
+      update: expect.objectContaining({
+        updateKind: 'downgrade',
+      }),
+    })
+  );
+});
+
+test('when the update is newer than app updateKind equals upgrade', async () => {
+  const setup = setUpAppUpdater({
+    clusters: {
+      reachableClusters: [
+        {
+          clusterUri: '/clusters/foo',
+          toolsAutoUpdate: true,
+          toolsVersion: '19.7.5',
+          minToolsVersion: '16.0.0-aa',
+        },
+      ],
+      unreachableClusters: [],
+    },
+  });
+
+  await setup.appUpdater.checkForUpdates();
+  expect(setup.lastEvent.value).toEqual(
+    expect.objectContaining({
+      kind: 'update-available',
+      update: expect.objectContaining({
+        updateKind: 'upgrade',
+      }),
+    })
+  );
+});
diff --git a/web/packages/teleterm/src/services/appUpdater/appUpdater.ts b/web/packages/teleterm/src/services/appUpdater/appUpdater.ts
new file mode 100644
index 0000000000000..3962861483c4a
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/appUpdater.ts
@@ -0,0 +1,536 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { app } from 'electron';
+import {
+  autoUpdater,
+  DebUpdater,
+  UpdateInfo as ElectronUpdateInfo,
+  MacUpdater,
+  AppUpdater as NativeUpdater,
+  NsisUpdater,
+  ProgressInfo,
+  RpmUpdater,
+  UpdateCheckResult,
+} from 'electron-updater';
+import { ProviderRuntimeOptions } from 'electron-updater/out/providers/Provider';
+
+import type { GetClusterVersionsResponse } from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+import { AbortError } from 'shared/utils/error';
+import { compare } from 'shared/utils/semVer';
+
+import Logger from 'teleterm/logger';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+import {
+  AutoUpdatesEnabled,
+  AutoUpdatesStatus,
+  resolveAutoUpdatesStatus,
+  shouldAutoDownload,
+} from './autoUpdatesStatus';
+import {
+  ClientToolsUpdateProvider,
+  ClientToolsVersionGetter,
+} from './clientToolsUpdateProvider';
+
+export const TELEPORT_TOOLS_VERSION_ENV_VAR = 'TELEPORT_TOOLS_VERSION';
+
+export class AppUpdater {
+  private readonly logger = new Logger('AppUpdater');
+  private readonly unregisterEventHandlers: () => void;
+  private autoUpdatesStatus: AutoUpdatesStatus | undefined;
+  private updateCheckResult: UpdateCheckResult | undefined;
+  private checkForUpdatesPromise: Promise<void> | undefined;
+  private downloadPromise: Promise<string[]> | undefined;
+  private isUpdateDownloaded = false;
+  private forceNoAutoDownload = false;
+
+  constructor(
+    private readonly storage: AppUpdaterStorage,
+    private readonly getClusterVersions: () => Promise<GetClusterVersionsResponse>,
+    readonly getDownloadBaseUrl: () => Promise<string>,
+    private readonly emit: (event: AppUpdateEvent) => void,
+    private versionEnvVar: string,
+    /** Allows overring autoUpdater in tests. */
+    private nativeUpdater: NativeUpdater = autoUpdater
+  ) {
+    const getClientToolsVersion: ClientToolsVersionGetter = async () => {
+      await this.refreshAutoUpdatesStatus();
+
+      if (this.autoUpdatesStatus.enabled) {
+        return {
+          version: this.autoUpdatesStatus.version,
+          baseUrl: await getDownloadBaseUrl(),
+        };
+      }
+    };
+
+    this.nativeUpdater.setFeedURL({
+      provider: 'custom',
+      // Wraps ClientToolsUpdateProvider to allow passing getClientToolsVersion.
+      updateProvider: class extends ClientToolsUpdateProvider {
+        constructor(
+          options: unknown,
+          updater: NativeUpdater,
+          runtimeOptions: ProviderRuntimeOptions
+        ) {
+          super(getClientToolsVersion, updater, runtimeOptions);
+        }
+      },
+    });
+
+    this.nativeUpdater.logger = this.logger;
+    this.nativeUpdater.allowDowngrade = true;
+    this.nativeUpdater.autoDownload = false;
+    // Must be set to true before any download starts.
+    // electron-updater registers a listener to install the update when
+    // the app quits, after the download has completed.
+    // It can be then set to false, it the update shouldn't be installed
+    // (except macOS).
+    this.nativeUpdater.autoInstallOnAppQuit = true;
+    // Enables checking for updates and downloading them in dev mode.
+    // It makes testing this feature easier.
+    // Only installing updates requires the packaged app.
+    // Downloads are saved to the path specified in dev-app-update.yml.
+    this.nativeUpdater.forceDevUpdateConfig = true;
+
+    this.unregisterEventHandlers = registerEventHandlers(
+      this.nativeUpdater,
+      this.emit,
+      () => this.autoUpdatesStatus,
+      () => this.shouldAutoDownload()
+    );
+  }
+
+  /** Must be called before `quit` event is emitted. */
+  async dispose(): Promise<void> {
+    this.unregisterEventHandlers();
+    await this.preventInstallingOutdatedUpdates();
+  }
+
+  /**
+   * Determines whether updates are supported for the current distribution.
+   * Note: Updating `.tar.gz` archives is not supported, but `electron-updater`
+   * incorrectly treats them as AppImage packages.
+   */
+  supportsUpdates(): boolean {
+    return (
+      this.nativeUpdater instanceof MacUpdater ||
+      this.nativeUpdater instanceof NsisUpdater ||
+      this.nativeUpdater instanceof DebUpdater ||
+      this.nativeUpdater instanceof RpmUpdater
+    );
+  }
+
+  /**
+   * Checks for app updates.
+   *
+   * This method enhances the standard autoUpdater.checkForUpdates() by adding
+   * the following behaviors:
+   * - It allows update checks during an ongoing download process.
+   * If a new update is found (or no update is available), the current download
+   * is canceled.
+   * - If downloading the update requires user confirmation, but the update has
+   * already been downloaded, checking for updates will transition the updater
+   * to the `update-downloaded` state (instead of staying in `update-available`
+   * state).
+   */
+  async checkForUpdates(
+    options: { noAutoDownload?: boolean } = {}
+  ): Promise<void> {
+    if (this.checkForUpdatesPromise) {
+      this.logger.info('Check for updates already in progress.');
+      return this.checkForUpdatesPromise;
+    }
+
+    this.checkForUpdatesPromise = this.doCheckForUpdates(options);
+    try {
+      await this.checkForUpdatesPromise;
+    } catch (error) {
+      // The error from autoUpdater.checkForUpdates is surfaced to the UI through error event.
+      this.logger.error('Failed to check for updates.', error);
+    } finally {
+      this.checkForUpdatesPromise = undefined;
+    }
+  }
+
+  /** Not safe for concurrent use. */
+  private async doCheckForUpdates(
+    opts: {
+      noAutoDownload?: boolean;
+      /**
+       * Whether this is a retry attempt.
+       * Used as a guard to prevent infinite loops.
+       */
+      hasRetried?: boolean;
+    } = {}
+  ): Promise<void> {
+    if (!this.supportsUpdates()) {
+      return;
+    }
+
+    this.forceNoAutoDownload = opts.noAutoDownload;
+
+    const result = await this.nativeUpdater.checkForUpdates();
+
+    const newSha = result.updateInfo?.files[0]?.sha512;
+    const oldSha = this.updateCheckResult?.updateInfo.files[0]?.sha512;
+    const isSameUpdate = newSha && oldSha && newSha === oldSha;
+
+    this.updateCheckResult = result;
+
+    const updateUnavailable = !result.isUpdateAvailable;
+    const updateChanged = !isSameUpdate;
+
+    let downloadCanceled = false;
+    if (updateUnavailable || updateChanged) {
+      downloadCanceled = await this.cancelDownload();
+    }
+
+    if (
+      result.isUpdateAvailable &&
+      (this.shouldAutoDownload() ||
+        // This can occur if the user manually downloads an update
+        // and then triggers another check for updates.
+        // Since the update is already downloaded, the updater should transition
+        // to the `update-downloaded` state automatically.
+        // The update file will be read from the local cache.
+        this.isUpdateDownloaded)
+    ) {
+      void this.download();
+      return;
+    }
+
+    // Retry to refresh the state so that the UI won't be showing
+    // a cancellation error.
+    if (downloadCanceled && !opts.hasRetried) {
+      await this.doCheckForUpdates({ ...opts, hasRetried: true });
+    }
+  }
+
+  /** Starts download. */
+  async download(): Promise<string[]> {
+    if (this.downloadPromise) {
+      this.logger.info('Download already in progress.');
+      return this.downloadPromise;
+    }
+
+    this.downloadPromise = this.nativeUpdater.downloadUpdate();
+    try {
+      await this.downloadPromise;
+      this.isUpdateDownloaded = true;
+    } catch (error) {
+      // The error from autoUpdater.download is surfaced to the UI through error event.
+      this.logger.error('Failed to download update.', error);
+    } finally {
+      this.downloadPromise = undefined;
+    }
+  }
+
+  /** Cancels download. Returns true if aborted the network request. */
+  async cancelDownload(): Promise<boolean> {
+    if (!this.downloadPromise) {
+      this.isUpdateDownloaded = false;
+      return false;
+    }
+
+    // Due to a bug in electron-updater, we can't cancel downloads using cancellation
+    // token passed to autoUpdater.download().
+    // Repeatedly starting and canceling downloads causes the updater to go
+    // into a broken state where it becomes unresponsive.
+    // To avoid this, we instead close the network connections to abort
+    // the current download.
+    await this.nativeUpdater.netSession.closeAllConnections();
+    try {
+      await this.downloadPromise;
+      return false;
+    } catch {
+      return true;
+    } finally {
+      this.isUpdateDownloaded = false;
+    }
+  }
+
+  /**
+   * Sets given cluster as managing app version.
+   * When `undefined` is passed, the managing cluster is cleared.
+   *
+   * Immediately cancels an in-progress download and then checks for updates.
+   */
+  async changeManagingCluster(
+    clusterUri: RootClusterUri | undefined
+  ): Promise<void> {
+    this.storage.put({ managingClusterUri: clusterUri });
+    await this.cancelDownload();
+    await this.checkForUpdates();
+  }
+
+  /**
+   * Removes the managing cluster if it matches the given cluster URI.
+   * Cancels any in-progress update that was triggered by this cluster.
+   */
+  async maybeRemoveManagingCluster(clusterUri: RootClusterUri): Promise<void> {
+    const { managingClusterUri } = this.storage.get();
+    if (managingClusterUri === clusterUri) {
+      this.storage.put({ managingClusterUri: undefined });
+    }
+
+    // checkForUpdates will discard any update triggered by the removed managing
+    // cluster. If a different update is found, do not download it automatically.
+    // Currently, updates aren't checked in the background, and on Windows and Linux,
+    // users may be surprised by an admin prompt when there is an update to install
+    // after quitting the app.
+    // We may revisit this behavior in the future. For example, if we introduce
+    // a UI notification indicating that there's an update to be installed.
+    await this.checkForUpdates({ noAutoDownload: true });
+  }
+
+  /**
+   * Restarts the app and installs the update after it has been downloaded.
+   * It should only be called after update-downloaded has been emitted.
+   */
+  quitAndInstall(): void {
+    try {
+      this.nativeUpdater.quitAndInstall();
+    } catch (error) {
+      this.logger.error('Failed to quit and install update', error);
+    }
+  }
+
+  private shouldAutoDownload(): boolean {
+    return (
+      !this.forceNoAutoDownload &&
+      this.autoUpdatesStatus?.enabled &&
+      shouldAutoDownload(this.autoUpdatesStatus)
+    );
+  }
+
+  private async refreshAutoUpdatesStatus(): Promise<void> {
+    const { managingClusterUri } = this.storage.get();
+
+    this.autoUpdatesStatus = await resolveAutoUpdatesStatus({
+      versionEnvVar: this.versionEnvVar,
+      managingClusterUri,
+      getClusterVersions: this.getClusterVersions,
+    });
+    this.logger.info('Resolved auto updates status', this.autoUpdatesStatus);
+  }
+
+  /**
+   * Workaround to prevent installing outdated updates.
+   * electron-updater lacks support for this: once an update is downloaded,
+   * it will be installed on quit—even if subsequent update checks report
+   * no new updates.
+   */
+  private async preventInstallingOutdatedUpdates(): Promise<void> {
+    if (this.isUpdateDownloaded) {
+      return;
+    }
+
+    // Workaround for Windows and Linux.
+    this.nativeUpdater.autoInstallOnAppQuit = false;
+
+    // macOS-specific workaround:
+    // On macOS, electron-updater downloads the update file and, if
+    // `autoUpdater.autoInstallOnAppQuit` is true, passes it to the native Electron
+    // autoUpdater via a local server. The update is then handed off to the Squirrel
+    // framework for installation (either on demand or after quitting the app).
+    // Unfortunately, once Squirrel gets the update, it is always installed
+    // on quit, regardless of the `autoInstallOnAppQuit` value.
+    // The only workaround I've found is to manually delete the ShipItState.plist
+    // file so Squirrel cannot apply the update.
+    // The downloaded update will be overwritten with the next update.
+    if (this.nativeUpdater instanceof MacUpdater && app.isPackaged) {
+      const squirrelPlistFilePath = path.join(
+        os.homedir(),
+        'Library',
+        'Caches',
+        'gravitational.teleport.connect.ShipIt',
+        'ShipItState.plist'
+      );
+      try {
+        await rm(squirrelPlistFilePath, {
+          force: true,
+        });
+      } catch (error) {
+        this.logger.error(error);
+      }
+    }
+  }
+}
+
+export interface UpdateInfo extends ElectronUpdateInfo {
+  /** Indicates whether the update version is newer or older than the current app version. */
+  updateKind: 'upgrade' | 'downgrade';
+}
+
+export interface AppUpdaterStorage<
+  T = {
+    /** User-selected cluster managing updates. */
+    managingClusterUri?: string;
+  },
+> {
+  get(): T;
+  put(value: Partial<T>): void;
+}
+
+function registerEventHandlers(
+  nativeUpdater: NativeUpdater,
+  emit: (event: AppUpdateEvent) => void,
+  getAutoUpdatesStatus: () => AutoUpdatesStatus,
+  getAutoDownload: () => boolean
+): () => void {
+  // updateInfo becomes defined when an update is available (see onUpdateAvailable).
+  // It is later attached to other events, like 'download-progress' or 'error'.
+  let updateInfo: UpdateInfo | undefined;
+
+  const onCheckingForUpdate = () => {
+    emit({
+      kind: 'checking-for-update',
+      autoUpdatesStatus: getAutoUpdatesStatus(),
+    });
+  };
+  const onUpdateAvailable = (update: ElectronUpdateInfo) => {
+    updateInfo = {
+      ...update,
+      updateKind:
+        compare(update.version, app.getVersion()) === 1
+          ? 'upgrade'
+          : 'downgrade',
+    };
+    emit({
+      kind: 'update-available',
+      update: updateInfo,
+      autoDownload: getAutoDownload(),
+      autoUpdatesStatus: getAutoUpdatesStatus() as AutoUpdatesEnabled,
+    });
+  };
+  const onUpdateNotAvailable = () => {
+    updateInfo = undefined;
+    emit({
+      kind: 'update-not-available',
+      autoUpdatesStatus: getAutoUpdatesStatus(),
+    });
+  };
+  const onError = (error: Error) => {
+    if (error.message.includes('net::ERR_ABORTED')) {
+      error = new AbortError('Update download was canceled');
+    }
+    emit({
+      kind: 'error',
+      error,
+      update: updateInfo,
+      autoUpdatesStatus: getAutoUpdatesStatus() as AutoUpdatesEnabled,
+    });
+  };
+  const onDownloadProgress = (progress: ProgressInfo) =>
+    emit({
+      kind: 'download-progress',
+      progress,
+      update: updateInfo,
+      autoUpdatesStatus: getAutoUpdatesStatus() as AutoUpdatesEnabled,
+    });
+  const onUpdateDownloaded = () =>
+    emit({
+      kind: 'update-downloaded',
+      update: updateInfo,
+      autoUpdatesStatus: getAutoUpdatesStatus() as AutoUpdatesEnabled,
+    });
+
+  nativeUpdater.on('checking-for-update', onCheckingForUpdate);
+  nativeUpdater.on('update-available', onUpdateAvailable);
+  nativeUpdater.on('update-not-available', onUpdateNotAvailable);
+  nativeUpdater.on('error', onError);
+  nativeUpdater.on('download-progress', onDownloadProgress);
+  nativeUpdater.on('update-downloaded', onUpdateDownloaded);
+
+  return () => {
+    nativeUpdater.off('checking-for-update', onCheckingForUpdate);
+    nativeUpdater.off('update-available', onUpdateAvailable);
+    nativeUpdater.off('update-not-available', onUpdateNotAvailable);
+    nativeUpdater.off('error', onError);
+    nativeUpdater.off('download-progress', onDownloadProgress);
+    nativeUpdater.off('update-downloaded', onUpdateDownloaded);
+  };
+}
+
+/** Represents the various events during the app update process. */
+export type AppUpdateEvent =
+  | {
+      /** Checking for an available update has started. */
+      kind: 'checking-for-update';
+      /**
+       * Status of auto updates.
+       * Empty if checking updates for the first time.
+       */
+      autoUpdatesStatus?: AutoUpdatesStatus;
+    }
+  | {
+      /** An update is available. The update is downloaded automatically. */
+      kind: 'update-available';
+      /** Information about the available update. */
+      update: UpdateInfo;
+      /** Whether updates are downloaded automatically. */
+      autoDownload: boolean;
+      /** Status of enabled auto updates. */
+      autoUpdatesStatus: AutoUpdatesEnabled;
+    }
+  | {
+      /**  No update is available. */
+      kind: 'update-not-available';
+      /** Auto updates status, can be enabled or disabled. */
+      autoUpdatesStatus: AutoUpdatesStatus;
+    }
+  | {
+      /**  Error while checking for updates, downloading or installing. */
+      kind: 'error';
+      /** The error encountered during the update process. */
+      error: Error;
+      /**
+       * Information about the update.
+       * May be empty if an error happened when checking for updates.
+       */
+      update?: UpdateInfo;
+      /**
+       * Status of enabled auto updates.
+       * May be empty if an error happened when checking for updates.
+       */
+      autoUpdatesStatus?: AutoUpdatesEnabled;
+    }
+  | {
+      /** Indicates download progress of the update. */
+      kind: 'download-progress';
+      /** Information about the update being downloaded. */
+      update: UpdateInfo;
+      /** Download progress. */
+      progress: ProgressInfo;
+      /** Status of enabled auto updates. */
+      autoUpdatesStatus: AutoUpdatesEnabled;
+    }
+  | {
+      /** The update has been successfully downloaded. */
+      kind: 'update-downloaded';
+      /** Information about the downloaded update. */
+      update: UpdateInfo;
+      /** Status of enabled auto updates. */
+      autoUpdatesStatus: AutoUpdatesEnabled;
+    };
diff --git a/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.test.ts b/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.test.ts
new file mode 100644
index 0000000000000..300b2c9f316ca
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.test.ts
@@ -0,0 +1,552 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { GetClusterVersionsResponse } from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+
+import Logger, { NullService } from 'teleterm/logger';
+
+import {
+  AutoUpdatesStatus,
+  resolveAutoUpdatesStatus,
+  shouldAutoDownload,
+} from './autoUpdatesStatus';
+
+beforeAll(() => {
+  Logger.init(new NullService());
+});
+
+test.each<{
+  title: string;
+  input: {
+    versionEnvVar: string;
+    managingClusterUri: string;
+    getClusterVersions: () => Promise<GetClusterVersionsResponse>;
+  };
+  expected: AutoUpdatesStatus;
+}>([
+  {
+    title: 'disabled when env var is "off"',
+    input: {
+      versionEnvVar: 'off',
+      managingClusterUri: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [],
+        unreachableClusters: [],
+      }),
+    },
+    expected: {
+      enabled: false,
+      reason: 'disabled-by-env-var',
+      options: {
+        managingClusterUri: '',
+        highestCompatibleVersion: '',
+        unreachableClusters: [],
+        clusters: [],
+      },
+    },
+  },
+  {
+    title: 'resolving with env var when set to version',
+    input: {
+      versionEnvVar: '14.0.0',
+      managingClusterUri: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [],
+        unreachableClusters: [],
+      }),
+    },
+    expected: {
+      enabled: true,
+      version: '14.0.0',
+      source: 'env-var',
+      options: {
+        managingClusterUri: '',
+        highestCompatibleVersion: '',
+        unreachableClusters: [],
+        clusters: [],
+      },
+    },
+  },
+  {
+    title: 'disabled when no versions with auto-update enabled',
+    input: {
+      versionEnvVar: '',
+      managingClusterUri: undefined,
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: false,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+    },
+    expected: {
+      enabled: false,
+      reason: 'no-cluster-with-auto-update',
+      options: {
+        managingClusterUri: undefined,
+        highestCompatibleVersion: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: false,
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title: 'resolving with managing cluster if specified',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '/clusters/cluster-a',
+    },
+    expected: {
+      enabled: true,
+      version: '14.0.0',
+      source: 'managing-cluster',
+      options: {
+        highestCompatibleVersion: '14.0.0',
+        managingClusterUri: '/clusters/cluster-a',
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: true,
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title:
+      'resolving using most compatible version when clusters are on the same version',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '/clusters/missing-cluster',
+    },
+    expected: {
+      enabled: true,
+      version: '14.0.0',
+      source: 'highest-compatible',
+      options: {
+        highestCompatibleVersion: '14.0.0',
+        managingClusterUri: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: true,
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-b'],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '14.0.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-a'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title:
+      'resolving using most compatible version when clusters are on the same major version',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '14.1.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '14.2.0',
+            minToolsVersion: '13.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '/clusters/missing-cluster',
+    },
+    expected: {
+      enabled: true,
+      version: '14.2.0', // the newer version should be taken
+      source: 'highest-compatible',
+      options: {
+        highestCompatibleVersion: '14.2.0',
+        managingClusterUri: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: true,
+            toolsVersion: '14.1.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-b'],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '14.2.0',
+            minToolsVersion: '13.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-a'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title:
+      'resolving to stable version when both stable and pre-release are available',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '18.2.0-beta.1',
+            minToolsVersion: '18.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '18.2.0',
+            minToolsVersion: '18.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '',
+    },
+    expected: {
+      enabled: true,
+      version: '18.2.0', // From semver spec: pre-releases have lower precedence than a normal version.
+      source: 'highest-compatible',
+      options: {
+        highestCompatibleVersion: '18.2.0',
+        managingClusterUri: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: true,
+            toolsVersion: '18.2.0-beta.1',
+            minToolsVersion: '18.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-b'],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '18.2.0',
+            minToolsVersion: '18.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-a'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title:
+      'resolving using most compatible version when clusters are on different major version',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '/clusters/missing-cluster',
+    },
+    expected: {
+      enabled: true,
+      version: '15.0.0',
+      source: 'highest-compatible',
+      options: {
+        highestCompatibleVersion: '15.0.0',
+        managingClusterUri: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: true,
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-a'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title:
+      'disabled when cluster managing updates no longer has `toolsAutoUpdate` set to true',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            toolsAutoUpdate: false,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            toolsAutoUpdate: false,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '/clusters/cluster-a',
+    },
+    expected: {
+      enabled: false,
+      reason: 'managing-cluster-unable-to-manage',
+      options: {
+        highestCompatibleVersion: undefined,
+        managingClusterUri: '/clusters/cluster-a',
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: false,
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: false,
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-a'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+  {
+    title: 'disabled when cluster managing updates is unreachable',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            errorMessage: 'Something went wrong',
+          },
+        ],
+      }),
+      managingClusterUri: '/clusters/cluster-a',
+    },
+    expected: {
+      enabled: false,
+      reason: 'managing-cluster-unable-to-manage',
+      options: {
+        highestCompatibleVersion: '15.0.0',
+        managingClusterUri: '/clusters/cluster-a',
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '15.0.0',
+            minToolsVersion: '14.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+        ],
+        unreachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            errorMessage: 'Something went wrong',
+          },
+        ],
+      },
+    },
+  },
+  {
+    title:
+      'resolving with no compatible version when clusters are on incompatibles versions',
+    input: {
+      versionEnvVar: '',
+      getClusterVersions: async () => ({
+        reachableClusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsVersion: '18.0.0',
+            minToolsVersion: '17.0.0-aa',
+            toolsAutoUpdate: false,
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+          {
+            clusterUri: '/clusters/cluster-c',
+            toolsVersion: '16.1.0',
+            minToolsVersion: '15.0.0-aa',
+            toolsAutoUpdate: true,
+          },
+        ],
+        unreachableClusters: [],
+      }),
+      managingClusterUri: '',
+    },
+    expected: {
+      enabled: false,
+      reason: 'no-compatible-version',
+      options: {
+        highestCompatibleVersion: undefined,
+        managingClusterUri: undefined,
+        clusters: [
+          {
+            clusterUri: '/clusters/cluster-a',
+            toolsAutoUpdate: false,
+            toolsVersion: '18.0.0',
+            minToolsVersion: '17.0.0-aa',
+            otherCompatibleClusters: [],
+          },
+          {
+            clusterUri: '/clusters/cluster-b',
+            toolsAutoUpdate: true,
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-c'],
+          },
+          {
+            clusterUri: '/clusters/cluster-c',
+            toolsAutoUpdate: true,
+            toolsVersion: '16.1.0',
+            minToolsVersion: '15.0.0-aa',
+            otherCompatibleClusters: ['/clusters/cluster-b'],
+          },
+        ],
+        unreachableClusters: [],
+      },
+    },
+  },
+])('$title', async ({ input, expected }) => {
+  const result = await resolveAutoUpdatesStatus(input);
+  expect(result).toEqual(expected);
+});
+
+test('should not auto download when there is unreachable cluster in highest-compatible resolution', () => {
+  const result = shouldAutoDownload({
+    enabled: true,
+    version: '16.1.0',
+    source: 'highest-compatible',
+    options: {
+      highestCompatibleVersion: '16.1.0',
+      managingClusterUri: '',
+      clusters: [
+        {
+          clusterUri: '/clusters/cluster-b',
+          minToolsVersion: '15.0.0-aa',
+          otherCompatibleClusters: [],
+          toolsAutoUpdate: true,
+          toolsVersion: '16.1.0',
+        },
+      ],
+      unreachableClusters: [
+        {
+          clusterUri: '/clusters/cluster-a',
+          errorMessage: 'Something went wrong',
+        },
+      ],
+    },
+  });
+  expect(result).toBeFalsy();
+});
diff --git a/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.ts b/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.ts
new file mode 100644
index 0000000000000..f315d95cf044b
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/autoUpdatesStatus.ts
@@ -0,0 +1,302 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import type {
+  ClusterVersionInfo,
+  GetClusterVersionsResponse,
+  UnreachableCluster,
+} from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+import { compare, major } from 'shared/utils/semVer';
+
+import Logger from 'teleterm/logger';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+const logger = new Logger('resolveAutoUpdatesStatus');
+
+/**
+ * Determines the auto-update status based on all connected clusters.
+ * Updates can be either enabled or disabled, depending on the passed sources.
+ * The version is selected using the following precedence:
+ * 1. `TELEPORT_TOOLS_VERSION` env var, if defined.
+ * 2. `tools_version` from the cluster manually selected to manage updates, if selected.
+ * 3. Highest compatible version, if found.
+ * 4. If there's no version at this point, stop auto updates.
+ */
+export async function resolveAutoUpdatesStatus(sources: {
+  versionEnvVar: string;
+  managingClusterUri: string | undefined;
+  getClusterVersions(): Promise<GetClusterVersionsResponse>;
+}): Promise<AutoUpdatesStatus> {
+  if (sources.versionEnvVar === 'off') {
+    return {
+      enabled: false,
+      reason: 'disabled-by-env-var',
+      options: {
+        clusters: [],
+        unreachableClusters: [],
+        highestCompatibleVersion: '',
+        managingClusterUri: '',
+      },
+    };
+  }
+  if (sources.versionEnvVar) {
+    return {
+      enabled: true,
+      version: sources.versionEnvVar,
+      source: 'env-var',
+      options: {
+        clusters: [],
+        unreachableClusters: [],
+        highestCompatibleVersion: '',
+        managingClusterUri: '',
+      },
+    };
+  }
+
+  const clusterVersions = await sources.getClusterVersions();
+  const options = createAutoUpdateOptions({
+    managingClusterUri: sources.managingClusterUri,
+    clusterVersions,
+  });
+  return findVersionFromClusters(options);
+}
+
+function createAutoUpdateOptions(sources: {
+  managingClusterUri: string | undefined;
+  clusterVersions: GetClusterVersionsResponse;
+}): AutoUpdatesOptions {
+  const { reachableClusters, unreachableClusters } = sources.clusterVersions;
+  const clusters = makeClusters(reachableClusters);
+  const highestCompatibleVersion = findMostCompatibleToolsVersion(clusters);
+  // If the managing cluster URI doesn't exist within connected clusters, ignore it completely.
+  // The client version cannot be determined in this case.
+  // Additionally, a cluster not listed in the connected clusters should not attempt
+  // to manage versions for them.
+  const managingClusterExists =
+    clusters.some(c => c.clusterUri === sources.managingClusterUri) ||
+    unreachableClusters.some(c => c.clusterUri === sources.managingClusterUri);
+
+  return {
+    clusters,
+    unreachableClusters,
+    highestCompatibleVersion,
+    managingClusterUri: managingClusterExists
+      ? sources.managingClusterUri
+      : undefined,
+  };
+}
+
+/**
+ * Attempts to find tools version from a user-selected cluster or connected
+ * clusters.
+ */
+function findVersionFromClusters(
+  options: AutoUpdatesOptions
+): AutoUpdatesStatus {
+  const { managingClusterUri, clusters, highestCompatibleVersion } = options;
+
+  if (managingClusterUri) {
+    const managingCluster = clusters.find(
+      c => c.clusterUri === managingClusterUri
+    );
+
+    if (managingCluster?.toolsAutoUpdate) {
+      return {
+        options,
+        enabled: true,
+        version: managingCluster.toolsVersion,
+        source: 'managing-cluster',
+      };
+    }
+
+    logger.warn(
+      `Cluster ${managingClusterUri} managing updates is unreachable or not managing updates.`
+    );
+    return {
+      options,
+      enabled: false,
+      reason: 'managing-cluster-unable-to-manage',
+    };
+  }
+
+  const autoUpdateCandidateClusters = clusters.filter(c => c.toolsAutoUpdate);
+  if (!autoUpdateCandidateClusters.length) {
+    return {
+      options,
+      enabled: false,
+      reason: 'no-cluster-with-auto-update',
+    };
+  }
+
+  if (highestCompatibleVersion) {
+    return {
+      options,
+      enabled: true,
+      version: highestCompatibleVersion,
+      source: 'highest-compatible',
+    };
+  }
+
+  return {
+    options,
+    enabled: false,
+    reason: 'no-compatible-version',
+  };
+}
+
+/** When `false` is returned, the user will need to click 'Download' manually. */
+export function shouldAutoDownload(updatesStatus: AutoUpdatesEnabled): boolean {
+  const { source } = updatesStatus;
+  switch (source) {
+    case 'env-var':
+    case 'managing-cluster':
+      return true;
+    case 'highest-compatible':
+      return (
+        // Prevent auto-downloading in cases where the highest-compatible approach had
+        // to ignore some unreachable clusters.
+        // Since compatibility can't be verified against those clusters,
+        // the selected version might be incompatible with them.
+        // If the clusters are temporarily unavailable, a future update check may
+        // revert to a previously compatible version.
+        // To avoid these version switches, the decision whether to install the
+        // update is left to the user.
+        updatesStatus.options.unreachableClusters.length === 0
+      );
+    default:
+      source satisfies never;
+  }
+}
+
+/** Assigns each cluster a compatibility with client tools from other clusters. */
+function makeClusters(versions: ClusterVersionInfo[]): Cluster[] {
+  return versions.map(version => {
+    const majorToolsVersion = major(version.toolsVersion);
+
+    const otherCompatibleClusters = versions
+      .filter(v => {
+        // The list should only contain other clusters.
+        if (v.clusterUri === version.clusterUri) {
+          return false;
+        }
+
+        const minMajor = major(v.minToolsVersion);
+        const maxMajor = major(v.toolsVersion);
+
+        // Check compatibility: cluster's major version must be within [minMajor, maxMajor].
+        return majorToolsVersion >= minMajor && majorToolsVersion <= maxMajor;
+      })
+      .map(v => v.clusterUri);
+
+    return {
+      ...version,
+      otherCompatibleClusters,
+    };
+  });
+}
+
+/** Finds the highest version of client tools that is compatible with all clusters. */
+function findMostCompatibleToolsVersion(
+  clusters: Cluster[]
+): string | undefined {
+  // Get the highest version first.
+  const sortedAutoUpdateCandidates = clusters
+    .filter(c => c.toolsAutoUpdate)
+    .toSorted((a, b) => compare(b.toolsVersion, a.toolsVersion));
+
+  const allClusters = new Set(clusters.map(c => c.clusterUri));
+
+  for (const candidate of sortedAutoUpdateCandidates) {
+    // The candidate is compatible with itself and `otherCompatibleClusters`.
+    const compatibleClusters = new Set([
+      candidate.clusterUri,
+      ...candidate.otherCompatibleClusters,
+    ]);
+    // Check if candidate is compatible with all required clusters.
+    if (compatibleClusters.isSupersetOf(allClusters)) {
+      return candidate.toolsVersion;
+    }
+  }
+}
+
+export interface AutoUpdatesEnabled {
+  enabled: true;
+  version: string;
+  /**
+   * Source of the update:
+   * - `env-var` - TELEPORT_TOOLS_VERSION configures app version.
+   * - `managing-cluster` - updates are managed by a manually configured cluster.
+   * - `highest-compatible` - updates are determined by the highest compatible version available.
+   */
+  source: 'env-var' | 'managing-cluster' | 'highest-compatible';
+  /**
+   * Represents the options considered during the auto-update version resolution process.
+   * If updates are configured via the environment variable, all fields will be empty or undefined.
+   */
+  options: AutoUpdatesOptions;
+}
+
+export interface AutoUpdatesDisabled {
+  enabled: false;
+  /**
+   * Reason the updates are disabled:
+   * `disabled-by-env-var` - `TELEPORT_TOOLS_VERSION` is 'off'.
+   * `managing-cluster-unable-to-manage` - the manually selected managing cluster is either
+   * unreachable or it has since disabled autoupdates.
+   * `no-cluster-with-auto-update` - there is no cluster that could manage updates.
+   * `no-compatible-version` - there are clusters that could manage updates, but
+   * they specify incompatible client tools versions.
+   */
+  reason:
+    | 'disabled-by-env-var'
+    | 'managing-cluster-unable-to-manage'
+    | 'no-cluster-with-auto-update'
+    | 'no-compatible-version';
+  /**
+   * Represents the options considered during the auto-update version resolution process.
+   * If updates are disabled via the environment variable, all fields will be empty or undefined.
+   */
+  options: AutoUpdatesOptions;
+}
+
+export interface AutoUpdatesOptions {
+  /** The highest version that is compatible with all other clusters. */
+  highestCompatibleVersion: string | undefined;
+  /** URI of a manually selected cluster to manage updates. */
+  managingClusterUri: string | undefined;
+  /** Clusters considered during version resolution. */
+  clusters: Cluster[];
+  /** Clusters from which version information could not be retrieved. */
+  unreachableClusters: UnreachableCluster[];
+}
+
+export type AutoUpdatesStatus = AutoUpdatesEnabled | AutoUpdatesDisabled;
+
+/** Represents a cluster that could manage updates. */
+export interface Cluster {
+  /** URI of the cluster. */
+  clusterUri: RootClusterUri;
+  /** Whether the client should automatically update the tools version. */
+  toolsAutoUpdate: boolean;
+  /** Tools version required by this cluster. */
+  toolsVersion: string;
+  /** Minimum tools version allowed by this cluster. */
+  minToolsVersion: string;
+  /** URIs of clusters whose client tools are compatible with this cluster's client tools. */
+  otherCompatibleClusters: RootClusterUri[];
+}
diff --git a/web/packages/teleterm/src/services/appUpdater/clientToolsUpdateProvider.ts b/web/packages/teleterm/src/services/appUpdater/clientToolsUpdateProvider.ts
new file mode 100644
index 0000000000000..247ac117c06b7
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/clientToolsUpdateProvider.ts
@@ -0,0 +1,182 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { app } from 'electron';
+import {
+  AppUpdater,
+  DebUpdater,
+  MacUpdater,
+  NsisUpdater,
+  Provider,
+  ResolvedUpdateFileInfo,
+  RpmUpdater,
+  UpdateInfo,
+} from 'electron-updater';
+import { ProviderRuntimeOptions } from 'electron-updater/out/providers/Provider';
+
+import { compare, major } from 'shared/utils/semVer';
+
+import { UnsupportedVersionError } from './errors';
+
+const CHECKSUM_FETCH_TIMEOUT = 5_000;
+// Example: 99a2fe26681073de56de4229dd9cd6655fef22759579b7b9bc359e018ea1007099a2fe26681073de56de4229dd9cd6655fef22759579b7b9bc359e018ea10070  Teleport Connect-17.5.4-mac.zip
+const CHECKSUM_FORMAT = /^.+\s+.+$/;
+
+/**
+ * Implements electron-updater's `Provider` with client tools updates.
+ * The official docs does not provide examples for creating custom providers.
+ * This implementation is inspired by existing built-in providers, such as `GenericProvider`.
+ * https://github.com/electron-userland/electron-builder/blob/065c6a456e34e7f8c13cba483d433502b9325168/packages/electron-updater/src/providers/GenericProvider.ts
+ * */
+export class ClientToolsUpdateProvider extends Provider<UpdateInfo> {
+  constructor(
+    private getClientToolsVersion: ClientToolsVersionGetter,
+    private nativeUpdater: AppUpdater,
+    runtimeOptions: ProviderRuntimeOptions
+  ) {
+    super(runtimeOptions);
+  }
+
+  /**
+   * Fetches metadata about the latest available update.
+   * This method is called during the check for updates.
+   */
+  override async getLatestVersion(): Promise<UpdateInfo> {
+    const clientTools = await this.getClientToolsVersion();
+
+    // If no client tools version is specified, return the current version
+    // to simulate an up-to-date state.
+    if (!clientTools) {
+      return {
+        version: app.getVersion(),
+        releaseDate: '',
+        path: '',
+        sha512: '',
+        files: [],
+      };
+    }
+
+    const { baseUrl, version } = clientTools;
+    const updatesSupport = areManagedUpdatesSupportedInConnect(version);
+    if (updatesSupport.supported === false) {
+      throw new UnsupportedVersionError(version, updatesSupport.minVersion);
+    }
+
+    const fileUrl = `${baseUrl}/${makeDownloadFilename(this.nativeUpdater, version)}`;
+    const sha512 = await fetchChecksum(fileUrl);
+
+    return {
+      version,
+      releaseDate: '',
+      path: '',
+      sha512: '',
+      files: [
+        {
+          // Effective only on Windows.
+          isAdminRightsRequired: true,
+          url: fileUrl,
+          sha512,
+        },
+      ],
+    };
+  }
+
+  /**
+   * Resolves file information before downloading.
+   * Since full URLs are already constructed in `getLatestVersion`,
+   * the files are returned without modification.
+   */
+  override resolveFiles(updateInfo: UpdateInfo): ResolvedUpdateFileInfo[] {
+    return updateInfo.files.map(fileInfo => ({
+      url: new URL(fileInfo.url),
+      info: fileInfo,
+    }));
+  }
+}
+
+/** Should return undefined when client tools version is not available. */
+export type ClientToolsVersionGetter = () => Promise<
+  | {
+      /** Base URL for downloading Teleport packages. e.g. cdn.teleport.dev. */
+      baseUrl: string;
+      /** Version to download. */
+      version: string;
+    }
+  | undefined
+>;
+
+function makeDownloadFilename(updater: AppUpdater, version: string): string {
+  if (updater instanceof MacUpdater) {
+    return `Teleport Connect-${version}-mac.zip`;
+  }
+  if (updater instanceof NsisUpdater) {
+    return `Teleport Connect Setup-${version}.exe`;
+  }
+  if (updater instanceof RpmUpdater) {
+    return `teleport-connect-${version}.x86_64.rpm`;
+  }
+  if (updater instanceof DebUpdater) {
+    return `teleport-connect_${version}_amd64.deb`;
+  }
+
+  throw new Error(`Unsupported app updater: ${updater?.constructor?.name}`);
+}
+
+async function fetchChecksum(fileUrl: string): Promise<string> {
+  const checksumUrl = `${fileUrl}.sha512`;
+  const response = await fetch(checksumUrl, {
+    signal: AbortSignal.timeout(CHECKSUM_FETCH_TIMEOUT),
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Could not retrieve checksum from "${response.url}" (${response.status} ${response.statusText}).`
+    );
+  }
+  // Trim the response which ends with a new line.
+  const checksumText = (await response.text()).trim();
+  if (!CHECKSUM_FORMAT.test(checksumText)) {
+    throw new Error(`Invalid checksum format ${checksumText}`);
+  }
+
+  return checksumText.split(' ').at(0);
+}
+
+// TODO(gzdunek) DELETE IN v20.0.0
+function areManagedUpdatesSupportedInConnect(
+  version: string
+): { supported: true } | { supported: false; minVersion: string } {
+  const thresholds = {
+    18: '18.2.0',
+    17: '17.7.3',
+  };
+
+  const majorVersion = major(version);
+  if (majorVersion >= 19) {
+    return { supported: true };
+  }
+
+  const minVersion = thresholds[majorVersion];
+  if (!minVersion) {
+    // For any lower version show v17 as the min supported version.
+    return { supported: false, minVersion: thresholds['17'] };
+  }
+
+  return compare(version, minVersion) >= 0
+    ? { supported: true }
+    : { supported: false, minVersion };
+}
diff --git a/web/packages/teleterm/src/services/appUpdater/errors.ts b/web/packages/teleterm/src/services/appUpdater/errors.ts
new file mode 100644
index 0000000000000..2d50e05348f42
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/errors.ts
@@ -0,0 +1,31 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Thrown when the app cannot be updated to unsupported version.
+ *
+ * Kept in a separate file to allow importing in the renderer process.
+ */
+export class UnsupportedVersionError extends Error {
+  constructor(wantedVersion: string, minVersion: string) {
+    super(
+      `Teleport Connect cannot update to version ${wantedVersion}. Managed updates are supported in version ${minVersion} and later.`
+    );
+    this.name = 'UnsupportedVersionError';
+  }
+}
diff --git a/web/packages/teleterm/src/services/appUpdater/index.ts b/web/packages/teleterm/src/services/appUpdater/index.ts
new file mode 100644
index 0000000000000..b444f39de0a91
--- /dev/null
+++ b/web/packages/teleterm/src/services/appUpdater/index.ts
@@ -0,0 +1,25 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './appUpdater';
+export type {
+  AutoUpdatesStatus,
+  AutoUpdatesEnabled,
+  AutoUpdatesDisabled,
+  Cluster,
+} from './autoUpdatesStatus';
diff --git a/web/packages/teleterm/src/services/config/appConfigSchema.ts b/web/packages/teleterm/src/services/config/appConfigSchema.ts
index 2c63bf352f44a..1f5489cd2f958 100644
--- a/web/packages/teleterm/src/services/config/appConfigSchema.ts
+++ b/web/packages/teleterm/src/services/config/appConfigSchema.ts
@@ -17,6 +17,7 @@
  */
 
 import { z } from 'zod';
+import { en } from 'zod/locales';
 
 import { Platform, RuntimeSettings } from 'teleterm/mainProcess/types';
 
@@ -49,6 +50,7 @@ export const createAppConfigSchema = (settings: RuntimeSettings) => {
     CUSTOM_SHELL_ID,
   ];
 
+  const pathSchema = tildeExpandingPathSchema(settings.homeDir);
   const shortcutSchema = createKeyboardShortcutSchema(settings.platform);
 
   // `keymap.` prefix is used in `initUi.ts` in a predicate function.
@@ -63,6 +65,16 @@ export const createAppConfigSchema = (settings: RuntimeSettings) => {
       .describe(
         'Skips the version check and hides the version compatibility warning when logging in to a cluster.'
       ),
+    runInBackground: z
+      .boolean()
+      .default(settings.platform === 'darwin' || settings.platform === 'win32')
+      .describe(
+        'Keeps the app running in the menu bar/system tray even when the main window is closed. On Linux, displaying the system tray icon may require installing shell extensions.'
+      ),
+    tshHome: pathSchema({
+      defaultPath: settings.tshd.defaultHomeDir,
+      description: 'Home location for tsh configuration and data.',
+    }),
     /**
      * This value can be provided by the user and is unsanitized. This means that it cannot be directly interpolated
      * in a styled component or used in CSS, as it may inject malicious CSS code.
@@ -74,7 +86,6 @@ export const createAppConfigSchema = (settings: RuntimeSettings) => {
       .default(defaultTerminalFont)
       .describe('Font family for the terminal.'),
     'terminal.fontSize': z
-      .number()
       .int()
       .min(1)
       .max(256)
@@ -97,16 +108,16 @@ export const createAppConfigSchema = (settings: RuntimeSettings) => {
           availableShellIdsWithCustom.some(
             shellId => shellId === configuredShell
           ),
-        configuredShell => ({
-          message: `Cannot find the shell "${configuredShell}". Available options are: ${availableShellIdsWithCustom.join(', ')}. Using platform default.`,
-        })
-      ),
-    'terminal.customShell': z
-      .string()
-      .default('')
-      .describe(
-        'Path to the custom shell that is used when `terminal.shell` is set to `custom`. It is best to configure it through UI (right click on a terminal tab > Custom Shell…).'
+        {
+          error: iss =>
+            `Cannot find the shell "${iss.input}". Available options are: ${availableShellIdsWithCustom.join(', ')}. Using platform default.`,
+        }
       ),
+    'terminal.customShell': pathSchema({
+      defaultPath: '',
+      description:
+        'Path to the custom shell that is used when `terminal.shell` is set to `custom`. It is best to configure it through UI (right click on a terminal tab > Custom Shell…).',
+    }),
     'terminal.rightClick': z
       .enum(['paste', 'copyPaste', 'menu'])
       .default(settings.platform === 'win32' ? 'copyPaste' : 'menu')
@@ -219,6 +230,10 @@ export const createAppConfigSchema = (settings: RuntimeSettings) => {
       .boolean()
       .default(!settings.dev)
       .describe('Controls whether the hardware key agent will be started.'),
+    'debug.searchResultsScore': z
+      .boolean()
+      .default(false)
+      .describe('Enables display of scores for search results.'),
   });
 };
 
@@ -338,3 +353,44 @@ function getDefaultTerminalFont(platform: Platform) {
 function getShortcutDesc(actionDesc: string): string {
   return `Shortcut to ${actionDesc}. A valid shortcut contains at least one modifier and a single key code, for example "Shift+Tab". Function keys do not require a modifier.`;
 }
+
+// Explicitly load the English locale to avoid being tree-shaken by Vite
+// https://github.com/colinhacks/zod/issues/4891
+z.config(en());
+
+const optionsFormatter = new Intl.ListFormat('en', {
+  style: 'long',
+  type: 'disjunction',
+});
+
+z.config({
+  customError: iss => {
+    switch (iss.code) {
+      case 'invalid_type':
+        return `Expected ${iss.expected}, received ${typeof iss.input}`;
+      case 'invalid_value':
+        return `Expected ${optionsFormatter.format(iss.values.map(v => `"${String(v)}"`))}, received "${iss.input}"`;
+      default:
+        return undefined;
+    }
+  },
+});
+
+/**
+ * Creates a Zod string schema for filesystem paths that automatically expand
+ * leading "~" to the provided home directory.
+ */
+function tildeExpandingPathSchema(homeDir: string) {
+  return ({
+    defaultPath,
+    description,
+  }: {
+    defaultPath: string;
+    description: string;
+  }) =>
+    z
+      .string()
+      .default(defaultPath)
+      .describe(description)
+      .transform(p => p.replace(/^~/, homeDir));
+}
diff --git a/web/packages/teleterm/src/services/config/configService.test.ts b/web/packages/teleterm/src/services/config/configService.test.ts
index ef5a718757369..10a2f67392ef4 100644
--- a/web/packages/teleterm/src/services/config/configService.test.ts
+++ b/web/packages/teleterm/src/services/config/configService.test.ts
@@ -20,7 +20,7 @@ import Logger, { NullService } from 'teleterm/logger';
 import { makeRuntimeSettings } from 'teleterm/mainProcess/fixtures/mocks';
 import { createMockFileStorage } from 'teleterm/services/fileStorage/fixtures/mocks';
 
-import { createConfigService } from './configService';
+import { createConfigService, ValidationError } from './configService';
 
 beforeAll(() => {
   Logger.init(new NullService());
@@ -61,7 +61,7 @@ test('in case of invalid value a default one is returned', () => {
       {
         code: 'invalid_type',
         expected: 'boolean',
-        received: 'string',
+        input: 'abcde',
         message: 'Expected boolean, received string',
         path: ['usageReporting.enabled'],
       },
@@ -126,3 +126,69 @@ test('field linking to the json schema and the json schema itself are updated',
   expect(configFile.get('$schema')).toBe('config_schema.json');
   expect(jsonSchemaFile.replace).toHaveBeenCalledTimes(1);
 });
+
+test('terminal.shell validation', () => {
+  const configFile = createMockFileStorage();
+  configFile.replace({
+    'terminal.shell': 'quux',
+  });
+  const configService = createConfigService({
+    configFile,
+    jsonSchemaFile: createMockFileStorage(),
+    settings: makeRuntimeSettings({
+      defaultOsShellId: 'foobar',
+      availableShells: [
+        {
+          binName: 'foobar',
+          id: 'foobar',
+          binPath: '/dev/null',
+          friendlyName: 'Foo bar',
+        },
+      ],
+    }),
+  });
+
+  const configError = configService.getConfigError() as ValidationError;
+  expect(configError.source).toEqual('validation');
+  expect(configError.errors).toHaveLength(1);
+  const zodError = configError.errors[0];
+  expect(zodError).toMatchObject({
+    message: `Cannot find the shell "quux". Available options are: foobar, custom. Using platform default.`,
+    path: expect.arrayContaining(['terminal.shell']),
+  });
+});
+
+test(`enum validation`, () => {
+  const configFile = createMockFileStorage();
+  configFile.replace({
+    theme: 'foobar',
+  });
+  const configService = createConfigService({
+    configFile,
+    jsonSchemaFile: createMockFileStorage(),
+    settings: makeRuntimeSettings(),
+  });
+  const configError = configService.getConfigError() as ValidationError;
+  expect(configError.source).toEqual('validation');
+  expect(configError.errors).toHaveLength(1);
+  const zodError = configError.errors[0];
+  expect(zodError).toMatchObject({
+    message: `Expected "light", "dark", or "system", received "foobar"`,
+    path: expect.arrayContaining(['theme']),
+  });
+});
+
+test('tilde expanding in path schema', () => {
+  const configFile = createMockFileStorage();
+  configFile.replace({
+    tshHome: '~/.~tsh-dev',
+  });
+  const configService = createConfigService({
+    configFile,
+    jsonSchemaFile: createMockFileStorage(),
+    settings: makeRuntimeSettings({ homeDir: '/Users/testuser' }),
+  });
+  expect(configService.get('tshHome')).toMatchObject({
+    value: '/Users/testuser/.~tsh-dev',
+  });
+});
diff --git a/web/packages/teleterm/src/services/config/configService.ts b/web/packages/teleterm/src/services/config/configService.ts
index 6def57378dfd3..ea097e8824747 100644
--- a/web/packages/teleterm/src/services/config/configService.ts
+++ b/web/packages/teleterm/src/services/config/configService.ts
@@ -16,8 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { z, ZodIssue } from 'zod';
-import zodToJsonSchema from 'zod-to-json-schema';
+import { z } from 'zod';
+import { $ZodIssue } from 'zod/v4/core';
 
 import Logger from 'teleterm/logger';
 import { RuntimeSettings } from 'teleterm/mainProcess/types';
@@ -31,17 +31,17 @@ import {
 
 const logger = new Logger('ConfigService');
 
-type FileLoadingError = {
+export type FileLoadingError = {
   source: 'file-loading';
   error: Error;
 };
 
-type ValidationError = {
+export type ValidationError = {
   source: 'validation';
-  errors: ZodIssue[];
+  errors: $ZodIssue[];
 };
 
-type ConfigError = FileLoadingError | ValidationError;
+export type ConfigError = FileLoadingError | ValidationError;
 
 export interface ConfigService {
   get<K extends keyof AppConfig>(
@@ -120,11 +120,13 @@ function updateJsonSchema({
   configFile: FileStorage;
   jsonSchemaFile: FileStorage;
 }): void {
-  const jsonSchema = zodToJsonSchema(
-    // Add $schema field to prevent marking it as a not allowed property.
-    schema.extend({ $schema: z.string() }),
-    { $refStrategy: 'none' }
-  );
+  const jsonSchema = z.toJSONSchema(schema, {
+    // Generate schema from the input definition (before any transformations).
+    io: 'input',
+    // The default draft 2020-12 appears to generate invalid defaults
+    // (only boolean or object allowed).
+    target: 'draft-7',
+  });
   const jsonSchemaFileName = jsonSchemaFile.getFileName();
   const jsonSchemaFileNameInConfig = configFile.get('$schema');
 
@@ -141,9 +143,10 @@ function validateStoredConfig(
 ): {
   storedConfig: Partial<AppConfig>;
   configWithDefaults: AppConfig;
-  errors: ZodIssue[] | undefined;
+  errors: $ZodIssue[] | undefined;
 } {
-  const parse = (data: Partial<AppConfig>) => schema.safeParse(data);
+  const parse = (data: Partial<AppConfig>) =>
+    schema.safeParse(data, { reportInput: true });
 
   const storedConfig = configFile.get() as Partial<AppConfig>;
   const parsed = parse(storedConfig);
diff --git a/web/packages/teleterm/src/services/config/fixtures/mocks.ts b/web/packages/teleterm/src/services/config/fixtures/mocks.ts
index 238347061341d..7094dd77234d9 100644
--- a/web/packages/teleterm/src/services/config/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/services/config/fixtures/mocks.ts
@@ -16,12 +16,15 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { makeRuntimeSettings } from 'teleterm/mainProcess/fixtures/mocks';
 import { AppConfig, ConfigService } from 'teleterm/services/config';
+import { createAppConfigSchema } from 'teleterm/services/config/appConfigSchema';
 
 export function createMockConfigService(
-  providedValues: AppConfig
+  providedValues: Partial<AppConfig>
 ): ConfigService {
-  const values = { ...providedValues };
+  const schema = createAppConfigSchema(makeRuntimeSettings());
+  const values = schema.parse(providedValues);
   return {
     get(key) {
       return { value: values[key], metadata: { isStored: false } };
diff --git a/web/packages/teleterm/src/services/config/keyboardShortcutSchema.test.ts b/web/packages/teleterm/src/services/config/keyboardShortcutSchema.test.ts
index 16254ee2f7db0..848d1cc258268 100644
--- a/web/packages/teleterm/src/services/config/keyboardShortcutSchema.test.ts
+++ b/web/packages/teleterm/src/services/config/keyboardShortcutSchema.test.ts
@@ -30,10 +30,11 @@ const schema = z.object({
   'keymap.tab1': createKeyboardShortcutSchema('darwin'),
 });
 
-function getZodError(...issues: any[]): z.ZodError {
+function getZodError(...issues: string[]): z.ZodError {
   return new ZodError(
     issues.map(issue => ({
-      ...issue,
+      message: issue,
+      code: 'custom',
       path: ['keymap.tab1'],
     }))
   );
diff --git a/web/packages/teleterm/src/services/config/keyboardShortcutSchema.ts b/web/packages/teleterm/src/services/config/keyboardShortcutSchema.ts
index 2d941fc4e854a..e2806e8d1a91c 100644
--- a/web/packages/teleterm/src/services/config/keyboardShortcutSchema.ts
+++ b/web/packages/teleterm/src/services/config/keyboardShortcutSchema.ts
@@ -20,41 +20,29 @@ import { z } from 'zod';
 
 import { Platform } from 'teleterm/mainProcess/types';
 
-export function invalidKeyCodeIssue(wrongKeyCode: string): z.IssueData {
-  return {
-    code: z.ZodIssueCode.custom,
-    message: `"${wrongKeyCode}" cannot be used as a key code.`,
-  };
+export function invalidKeyCodeIssue(wrongKeyCode: string): string {
+  return `"${wrongKeyCode}" cannot be used as a key code.`;
 }
 
 export function invalidModifierIssue(
   wrongModifiers: string[],
   validModifiers: string[]
-): z.IssueData {
+): string {
   const formatList = (items: string[]) =>
     `${items.map(m => `"${m}"`).join(', ')}`;
-  return {
-    code: z.ZodIssueCode.custom,
-    message: `${formatList(
-      wrongModifiers
-    )} cannot be used as a modifier. Valid modifiers are: ${formatList(
-      validModifiers
-    )}.`,
-  };
+  return `${formatList(
+    wrongModifiers
+  )} cannot be used as a modifier. Valid modifiers are: ${formatList(
+    validModifiers
+  )}.`;
 }
 
-export function duplicateModifierIssue(): z.IssueData {
-  return {
-    code: z.ZodIssueCode.custom,
-    message: `Duplicate modifier found.`,
-  };
+export function duplicateModifierIssue(): string {
+  return `Duplicate modifier found.`;
 }
 
-export function missingModifierIssue(keyCode: string): z.IssueData {
-  return {
-    code: z.ZodIssueCode.custom,
-    message: `"${keyCode}" must be used together with a modifier.`,
-  };
+export function missingModifierIssue(keyCode: string): string {
+  return `"${keyCode}" must be used together with a modifier.`;
 }
 
 export function createKeyboardShortcutSchema(platform: Platform) {
diff --git a/web/packages/teleterm/src/services/fileStorage/fileStorageClient.ts b/web/packages/teleterm/src/services/fileStorage/fileStorageClient.ts
index c9820a6cb4bbc..c39f15808c75e 100644
--- a/web/packages/teleterm/src/services/fileStorage/fileStorageClient.ts
+++ b/web/packages/teleterm/src/services/fileStorage/fileStorageClient.ts
@@ -24,6 +24,8 @@ import {
 } from '../../mainProcess/types';
 import { FileStorage } from './fileStorage';
 
+const APP_STATE_FIELDS_MODIFIABLE_FROM_RENDERER = ['state'];
+
 // TODO(ravicious): The main process should not expose the whole interface of FileStorage to the
 // renderer, only what's absolutely needed by the renderer. FileStorage at the moment includes a
 // bunch of functions that are used only in the main process (and should be used only there).
@@ -36,11 +38,18 @@ export function subscribeToFileStorageEvents(configService: FileStorage): void {
         case FileStorageEventType.Get:
           return (event.returnValue = configService.get(item.key));
         case FileStorageEventType.Put:
+          if (!APP_STATE_FIELDS_MODIFIABLE_FROM_RENDERER.includes(item.key)) {
+            throw new Error(
+              `Could not update "${item.key}". This field is readonly in the renderer process.`
+            );
+          }
           return configService.put(item.key, item.json);
         case FileStorageEventType.Write:
           return configService.write();
         case FileStorageEventType.Replace:
-          return configService.replace(item.json);
+          throw new Error(
+            'Replacing state is not allowed in the renderer process.'
+          );
         case FileStorageEventType.GetFilePath:
           return configService.getFilePath();
         case FileStorageEventType.GetFileName:
diff --git a/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.test.ts b/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.test.ts
index 4dbab055667d2..a58d1b37c9af9 100644
--- a/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.test.ts
+++ b/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.test.ts
@@ -67,6 +67,7 @@ describe('getPtyProcessOptions', () => {
           customShellPath: '',
           ssh: makeSshOptions(),
           windowsPty: { useConpty: true },
+          tshHome: '',
         },
         cmd: cmd,
         env: processEnv,
@@ -102,6 +103,7 @@ describe('getPtyProcessOptions', () => {
           customShellPath: '',
           ssh: makeSshOptions(),
           windowsPty: { useConpty: true },
+          tshHome: '',
         },
         cmd: cmd,
         env: processEnv,
@@ -134,6 +136,7 @@ describe('getPtyProcessOptions', () => {
           customShellPath: '',
           ssh: makeSshOptions({ noResume: true }),
           windowsPty: { useConpty: true },
+          tshHome: '',
         },
         cmd: cmd,
         env: processEnv,
@@ -164,6 +167,7 @@ describe('getPtyProcessOptions', () => {
           customShellPath: '',
           ssh: makeSshOptions({ forwardAgent: true }),
           windowsPty: { useConpty: true },
+          tshHome: '',
         },
         cmd: cmd,
         env: processEnv,
@@ -194,6 +198,7 @@ describe('getPtyProcessOptions', () => {
           customShellPath: '',
           ssh: makeSshOptions({ forwardAgent: false }),
           windowsPty: { useConpty: true },
+          tshHome: '',
         },
         cmd: cmd,
         env: processEnv,
@@ -229,6 +234,7 @@ describe('buildPtyOptions', () => {
         customShellPath: '',
         ssh: makeSshOptions(),
         windowsPty: { useConpty: true },
+        tshHome: '',
       },
       cmd,
     });
@@ -256,6 +262,7 @@ describe('buildPtyOptions', () => {
         customShellPath: '/custom/shell/path/better-shell',
         ssh: makeSshOptions(),
         windowsPty: { useConpty: true },
+        tshHome: '',
       },
       cmd,
     });
@@ -283,6 +290,7 @@ describe('buildPtyOptions', () => {
         customShellPath: '',
         ssh: makeSshOptions(),
         windowsPty: { useConpty: true },
+        tshHome: '',
       },
       cmd,
     });
@@ -320,6 +328,7 @@ describe('buildPtyOptions', () => {
         customShellPath: '',
         ssh: makeSshOptions(),
         windowsPty: { useConpty: true },
+        tshHome: '',
       },
       cmd,
       processEnv: {
diff --git a/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.ts b/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.ts
index 90077b8359727..a8d71a5444b7d 100644
--- a/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.ts
+++ b/web/packages/teleterm/src/services/pty/ptyHost/buildPtyOptions.ts
@@ -44,6 +44,7 @@ type PtyOptions = {
   ssh: SshOptions;
   windowsPty: Pick<WindowsPty, 'useConpty'>;
   customShellPath: string;
+  tshHome: string;
 };
 
 const WSLENV_VAR = 'WSLENV';
@@ -101,7 +102,7 @@ export async function buildPtyOptions({
         ...shellEnv,
         TERM_PROGRAM: 'Teleport_Connect',
         TERM_PROGRAM_VERSION: settings.appVersion,
-        TELEPORT_HOME: settings.tshd.homeDir,
+        TELEPORT_HOME: options.tshHome,
         TELEPORT_CLUSTER: cmd.clusterName,
         TELEPORT_PROXY: cmd.proxyHost,
         [TSH_AUTOUPDATE_ENV_VAR]: TSH_AUTOUPDATE_OFF,
diff --git a/web/packages/teleterm/src/services/pty/ptyHost/ptyEventsStreamHandler.ts b/web/packages/teleterm/src/services/pty/ptyHost/ptyEventsStreamHandler.ts
index e82b09938969a..6dc3cffffa296 100644
--- a/web/packages/teleterm/src/services/pty/ptyHost/ptyEventsStreamHandler.ts
+++ b/web/packages/teleterm/src/services/pty/ptyHost/ptyEventsStreamHandler.ts
@@ -113,7 +113,11 @@ export class PtyEventsStreamHandler {
   }
 
   onExit(
-    callback: (reason: { exitCode: number; signal?: number }) => void
+    callback: (reason: {
+      exitCode: number;
+      signal?: number;
+      lastInput: string;
+    }) => void
   ): RemoveListenerFunction {
     return this.addDataListenerAndReturnRemovalFunction(
       (event: PtyServerEvent) => {
diff --git a/web/packages/teleterm/src/services/pty/ptyHost/ptyProcess.ts b/web/packages/teleterm/src/services/pty/ptyHost/ptyProcess.ts
index cec0ba3d246f3..00df31a222765 100644
--- a/web/packages/teleterm/src/services/pty/ptyHost/ptyProcess.ts
+++ b/web/packages/teleterm/src/services/pty/ptyHost/ptyProcess.ts
@@ -63,7 +63,13 @@ export function createPtyProcess(
       return exchangeEventsStream.onOpen(callback);
     },
 
-    onExit(callback: (reason: { exitCode: number; signal?: number }) => void) {
+    onExit(
+      callback: (reason: {
+        exitCode: number;
+        signal?: number;
+        lastInput: string;
+      }) => void
+    ) {
       return exchangeEventsStream.onExit(callback);
     },
 
diff --git a/web/packages/teleterm/src/services/pty/ptyHost/resolveShellEnv.ts b/web/packages/teleterm/src/services/pty/ptyHost/resolveShellEnv.ts
index 36ce0ecd64177..0929ce7a494d5 100644
--- a/web/packages/teleterm/src/services/pty/ptyHost/resolveShellEnv.ts
+++ b/web/packages/teleterm/src/services/pty/ptyHost/resolveShellEnv.ts
@@ -44,15 +44,19 @@
 
 import { spawn } from 'child_process';
 
-import { memoize } from 'shared/utils/highbar';
-
 import Logger from 'teleterm/logger';
 import { unique } from 'teleterm/ui/utils/uid';
 
-const logger = new Logger('resolveShellEnv()');
+const logger = new Logger('resolveShellEnv');
 const resolveShellMaxTime = 10_000; // 10s
 
-export const resolveShellEnvCached = memoize(resolveShellEnv);
+const cache = new Map<string, Promise<typeof process.env | undefined>>();
+export function resolveShellEnvCached(shell: string) {
+  if (!cache.has(shell)) {
+    cache.set(shell, resolveShellEnv(shell));
+  }
+  return cache.get(shell);
+}
 
 export class ResolveShellEnvTimeoutError extends Error {}
 
diff --git a/web/packages/teleterm/src/services/pty/ptyService.ts b/web/packages/teleterm/src/services/pty/ptyService.ts
index 6fadcfe1fe305..1e25c31d584d2 100644
--- a/web/packages/teleterm/src/services/pty/ptyService.ts
+++ b/web/packages/teleterm/src/services/pty/ptyService.ts
@@ -48,6 +48,7 @@ export function createPtyService(
             forwardAgent: configService.get('ssh.forwardAgent').value,
           },
           customShellPath: configService.get('terminal.customShell').value,
+          tshHome: configService.get('tshHome').value,
           windowsPty,
         },
         cmd: command,
diff --git a/web/packages/teleterm/src/services/tshd/app.ts b/web/packages/teleterm/src/services/tshd/app.ts
index 18b7690a6acc5..ff02a63041e89 100644
--- a/web/packages/teleterm/src/services/tshd/app.ts
+++ b/web/packages/teleterm/src/services/tshd/app.ts
@@ -22,6 +22,7 @@ import {
   RouteToApp,
 } from 'gen-proto-ts/teleport/lib/teleterm/v1/app_pb';
 import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+import { getAppUriScheme } from 'shared/services/apps';
 
 /** Returns a URL that opens the web app in the browser. */
 export function getWebAppLaunchUrl({
@@ -89,6 +90,22 @@ export function isWebApp(app: App): boolean {
   );
 }
 
+export function isMcp(app: App): boolean {
+  return app.endpointUri.startsWith('mcp+');
+}
+
+/**
+ * doesMcpAppSupportGateway returns true for MCP servers that supports local
+ * proxy gateway. Currently only MCP servers with streamable HTTP transport
+ * support the gateway.
+ */
+export function doesMcpAppSupportGateway(app: App): boolean {
+  return (
+    app.endpointUri.startsWith('mcp+http://') ||
+    app.endpointUri.startsWith('mcp+https://')
+  );
+}
+
 /**
  * Returns address with protocol which is an app protocol + a public address.
  * If the public address is empty, it falls back to the endpoint URI.
@@ -98,16 +115,23 @@ export function isWebApp(app: App): boolean {
 export function getAppAddrWithProtocol(source: App): string {
   const { publicAddr, endpointUri } = source;
 
+  const scheme = getAppUriScheme(endpointUri);
   const isTcp = endpointUri && endpointUri.startsWith('tcp://');
   const isCloud = endpointUri && endpointUri.startsWith('cloud://');
+  const isMcp = scheme.startsWith('mcp+');
   let addrWithProtocol = endpointUri;
   if (publicAddr) {
     if (isCloud) {
       addrWithProtocol = `cloud://${publicAddr}`;
     } else if (isTcp) {
       addrWithProtocol = `tcp://${publicAddr}`;
+    } else if (isMcp) {
+      addrWithProtocol = `${scheme}://${publicAddr}`;
     } else {
-      addrWithProtocol = `https://${publicAddr}`;
+      // publicAddr for Identity Center account app is a URL with scheme.
+      addrWithProtocol = publicAddr.startsWith('https://')
+        ? publicAddr
+        : `https://${publicAddr}`;
     }
   }
 
diff --git a/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts b/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts
index e1cd6001a253b..338baddb40b01 100644
--- a/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts
+++ b/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts
@@ -52,9 +52,9 @@ const tshdRpcErrorObjectMatcher: TshdRpcError = expect.objectContaining({
   cause: undefined,
 });
 
-class MockServiceMethod<T extends (...args: any[]) => any>
-  implements ServiceInfo
-{
+class MockServiceMethod<
+  T extends (...args: any[]) => any,
+> implements ServiceInfo {
   public methods: MethodInfo[];
   public options = {};
   public typeName = '';
diff --git a/web/packages/teleterm/src/services/tshd/cloneableClient.ts b/web/packages/teleterm/src/services/tshd/cloneableClient.ts
index 01a4109e787a0..9709e12437e62 100644
--- a/web/packages/teleterm/src/services/tshd/cloneableClient.ts
+++ b/web/packages/teleterm/src/services/tshd/cloneableClient.ts
@@ -393,9 +393,9 @@ function cloneThenRejection<TResult>(
  * Alternatively, we could change cloneableClient to merely return the response property, plus maybe
  * some other fields that we need.
  */
-export class MockedUnaryCall<Response extends object>
-  implements CloneableUnaryCall<any, Response>
-{
+export class MockedUnaryCall<
+  Response extends object,
+> implements CloneableUnaryCall<any, Response> {
   constructor(
     public response: Response,
     private error?: any
diff --git a/web/packages/teleterm/src/services/tshd/cluster.ts b/web/packages/teleterm/src/services/tshd/cluster.ts
index 4ca67b44565e6..0a78c04011603 100644
--- a/web/packages/teleterm/src/services/tshd/cluster.ts
+++ b/web/packages/teleterm/src/services/tshd/cluster.ts
@@ -18,6 +18,12 @@
 
 import * as whatwg from 'whatwg-url';
 
+import { TrustedDeviceRequirement } from 'gen-proto-ts/teleport/legacy/types/trusted_device_requirement_pb';
+import {
+  Cluster,
+  LoggedInUser_UserType,
+} from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+
 /**
  * Accepts a proxy host in the form of "cluster-address.example.com:3090" and returns the host as
  * understood by browsers.
@@ -65,3 +71,47 @@ export function proxyHostname(proxyHost: string) {
 
   return whatwgURL.hostname;
 }
+
+/**
+ * Creates a cluster by merging properties that can be read from
+ * the profile from disk with properties from details.
+ *
+ * Listing all fields ensures TypeScript will force us to handle new fields
+ * by specifying whether they come from the profile or the details.
+ */
+export function mergeClusterProfileWithDetails({
+  profile,
+  details,
+}: {
+  profile: Cluster;
+  details: Cluster;
+}): Cluster {
+  return {
+    uri: profile.uri,
+    connected: profile.connected,
+    leaf: profile.leaf,
+    profileStatusError: profile.profileStatusError,
+    proxyHost: profile.proxyHost,
+    ssoHost: profile.ssoHost,
+    name: details.name,
+    showResources: details.showResources,
+    features: details.features,
+    authClusterId: details.authClusterId,
+    proxyVersion: details.proxyVersion,
+    loggedInUser: profile.loggedInUser && {
+      name: profile.loggedInUser.name,
+      activeRequests: profile.loggedInUser.activeRequests,
+      roles: profile.loggedInUser.roles,
+      isDeviceTrusted: profile.loggedInUser.isDeviceTrusted,
+      validUntil: profile.loggedInUser.validUntil,
+      userType:
+        details.loggedInUser?.userType || LoggedInUser_UserType.UNSPECIFIED,
+      trustedDeviceRequirement:
+        details.loggedInUser?.trustedDeviceRequirement ||
+        TrustedDeviceRequirement.UNSPECIFIED,
+      requestableRoles: details.loggedInUser?.requestableRoles || [],
+      suggestedReviewers: details.loggedInUser?.suggestedReviewers || [],
+      acl: details.loggedInUser?.acl || undefined,
+    },
+  };
+}
diff --git a/web/packages/teleterm/src/services/tshd/createClient.ts b/web/packages/teleterm/src/services/tshd/createClient.ts
index 23b16517eed93..77a5660941e8e 100644
--- a/web/packages/teleterm/src/services/tshd/createClient.ts
+++ b/web/packages/teleterm/src/services/tshd/createClient.ts
@@ -18,6 +18,10 @@
 
 import { GrpcTransport } from '@protobuf-ts/grpc-transport';
 
+import {
+  AutoUpdateServiceClient,
+  IAutoUpdateServiceClient,
+} from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb.client';
 import {
   ITerminalServiceClient,
   TerminalServiceClient,
@@ -35,6 +39,8 @@ export type TshdClient = CloneableClient<ITerminalServiceClient>;
 
 export type VnetClient = CloneableClient<IVnetServiceClient>;
 
+export type AutoUpdateClient = CloneableClient<IAutoUpdateServiceClient>;
+
 export function createTshdClient(transport: GrpcTransport): TshdClient {
   return cloneClient(new TerminalServiceClient(transport));
 }
@@ -42,3 +48,8 @@ export function createTshdClient(transport: GrpcTransport): TshdClient {
 export function createVnetClient(transport: GrpcTransport): VnetClient {
   return cloneClient(new VnetServiceClient(transport));
 }
+export function createAutoUpdateClient(
+  transport: GrpcTransport
+): AutoUpdateClient {
+  return cloneClient(new AutoUpdateServiceClient(transport));
+}
diff --git a/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts b/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
index a53701d1bf292..382f7bb109d2a 100644
--- a/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
@@ -27,7 +27,7 @@ import {
 import { getDefaultUnifiedResourcePreferences } from 'teleterm/ui/services/workspacesService';
 
 import { MockedUnaryCall } from '../cloneableClient';
-import { TshdClient, VnetClient } from '../createClient';
+import { AutoUpdateClient, TshdClient, VnetClient } from '../createClient';
 
 export class MockTshClient implements TshdClient {
   listRootClusters = () => new MockedUnaryCall({ clusters: [] });
@@ -71,10 +71,10 @@ export class MockTshClient implements TshdClient {
       localConnectorName: '',
       clientVersionStatus: ClientVersionStatus.OK,
     });
-  removeCluster = () => new MockedUnaryCall({});
   login = () => new MockedUnaryCall({});
   loginPasswordless = undefined;
   logout = () => new MockedUnaryCall({});
+  clearStaleClusterClients = () => new MockedUnaryCall({});
   transferFile = undefined;
   reportUsageEvent = () => new MockedUnaryCall({});
   createConnectMyComputerRole = () =>
@@ -89,6 +89,8 @@ export class MockTshClient implements TshdClient {
     new MockedUnaryCall({ resources: [], nextKey: '' });
   listKubernetesResources = () =>
     new MockedUnaryCall({ resources: [], nextKey: '' });
+  listKubernetesServers = () =>
+    new MockedUnaryCall({ resources: [], nextPageToken: '' });
   listDatabaseServers = () =>
     new MockedUnaryCall({ resources: [], nextKey: '' });
   getUserPreferences = () =>
@@ -118,9 +120,15 @@ export class MockTshClient implements TshdClient {
 export class MockVnetClient implements VnetClient {
   start = () => new MockedUnaryCall({});
   stop = () => new MockedUnaryCall({});
-  listDNSZones = () => new MockedUnaryCall({ dnsZones: [] });
+  getServiceInfo = () =>
+    new MockedUnaryCall({
+      appDnsZones: [],
+      clusters: [],
+      sshConfigured: false,
+      vnetSshConfigPath:
+        '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
+    });
   getBackgroundItemStatus = () => new MockedUnaryCall({ status: 0 });
-
   runDiagnostics() {
     return new MockedUnaryCall({
       report: {
@@ -129,4 +137,14 @@ export class MockVnetClient implements VnetClient {
       },
     });
   }
+  autoConfigureSSH = () => new MockedUnaryCall({});
+}
+
+export class MockAutoUpdateClient implements AutoUpdateClient {
+  getClusterVersions = () =>
+    new MockedUnaryCall({
+      reachableClusters: [],
+      unreachableClusters: [],
+    });
+  getDownloadBaseUrl = () => new MockedUnaryCall({ baseUrl: '' });
 }
diff --git a/web/packages/teleterm/src/services/tshd/gateway.ts b/web/packages/teleterm/src/services/tshd/gateway.ts
index de2b8239694c0..1c0861a3322a9 100644
--- a/web/packages/teleterm/src/services/tshd/gateway.ts
+++ b/web/packages/teleterm/src/services/tshd/gateway.ts
@@ -102,3 +102,17 @@ export function getGatewayTargetUriKind(
   // However, at the moment that field is essentially of type string, so there's not much we can do
   // with regards to type safety.
 }
+
+/**
+ * Available types are listed here:
+ * https://github.com/gravitational/teleport/blob/v9.0.3/lib/defaults/defaults.go#L513-L530
+ *
+ * The list below can get out of sync with what tsh actually implements.
+ */
+export type GatewayProtocol =
+  | 'postgres'
+  | 'mysql'
+  | 'mongodb'
+  | 'cockroachdb'
+  | 'redis'
+  | 'sqlserver';
diff --git a/web/packages/teleterm/src/services/tshd/testHelpers.ts b/web/packages/teleterm/src/services/tshd/testHelpers.ts
index 9ff030edc670e..9cfb2fe025e2e 100644
--- a/web/packages/teleterm/src/services/tshd/testHelpers.ts
+++ b/web/packages/teleterm/src/services/tshd/testHelpers.ts
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Timestamp } from 'gen-proto-ts/google/protobuf/timestamp_pb';
 import { TrustedDeviceRequirement } from 'gen-proto-ts/teleport/legacy/types/trusted_device_requirement_pb';
 import { App } from 'gen-proto-ts/teleport/lib/teleterm/v1/app_pb';
 import {
@@ -24,6 +25,7 @@ import {
 } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
 import {
   ACL,
+  LoggedInUser_UserType,
   ShowResources,
 } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
 import { WindowsDesktop } from 'gen-proto-ts/teleport/lib/teleterm/v1/windows_desktop_pb';
@@ -42,6 +44,7 @@ export const makeServer = (props: Partial<tsh.Server> = {}): tsh.Server => ({
   addr: '127.0.0.1:3022',
   labels: [],
   subKind: 'teleport',
+  logins: ['ec2-user'],
   ...props,
 });
 
@@ -61,6 +64,7 @@ export const makeDatabase = (
   hostname: '',
   addr: '',
   labels: [],
+  gcpProjectId: '',
   ...props,
 });
 
@@ -254,11 +258,11 @@ export const makeLoggedInUser = (
   isDeviceTrusted: false,
   trustedDeviceRequirement: TrustedDeviceRequirement.NOT_REQUIRED,
   acl: makeAcl(),
-  sshLogins: [],
   roles: [],
   requestableRoles: [],
   suggestedReviewers: [],
-  userType: tsh.LoggedInUser_UserType.LOCAL,
+  userType: LoggedInUser_UserType.LOCAL,
+  validUntil: Timestamp.fromDate(new Date()),
   ...props,
 });
 
@@ -341,14 +345,6 @@ export const makeAccessRequest = (
   reviews: [],
   suggestedReviewers: ['admin', 'reviewer'],
   thresholdNames: ['default'],
-  resourceIds: [
-    {
-      kind: 'kube_cluster',
-      name: 'minikube',
-      clusterName: 'main',
-      subResourceName: '',
-    },
-  ],
   resources: [
     {
       id: {
@@ -366,6 +362,8 @@ export const makeAccessRequest = (
   maxDuration: { seconds: 1729026573n, nanos: 0 },
   requestTtl: { seconds: 1729026573n, nanos: 0 },
   sessionTtl: { seconds: 1729026573n, nanos: 0 },
+  reasonMode: 'optional',
+  reasonPrompts: [],
   ...props,
 });
 
diff --git a/web/packages/teleterm/src/services/tshd/types.ts b/web/packages/teleterm/src/services/tshd/types.ts
index bd9a702a8ab78..5cd9cffebd804 100644
--- a/web/packages/teleterm/src/services/tshd/types.ts
+++ b/web/packages/teleterm/src/services/tshd/types.ts
@@ -16,10 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { SortType } from 'design/DataTable/types';
-
-import type * as uri from 'teleterm/ui/uri';
-
 /*
  *
  * Do not add new imports to this file, we're trying to get rid of types.ts files.
@@ -74,12 +70,6 @@ export {
    */
   Label,
 } from 'gen-proto-ts/teleport/lib/teleterm/v1/label_pb';
-export {
-  /**
-   * @deprecated Import directly from gen-proto-ts instead.
-   */
-  AuthProvider,
-} from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
 export {
   /**
    * @deprecated Import directly from gen-proto-ts instead.
@@ -99,35 +89,3 @@ export {
  * @deprecated Import directly from gen-proto-ts instead.
  */
 export * from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
-
-/**
- * Available types are listed here:
- * https://github.com/gravitational/teleport/blob/v9.0.3/lib/defaults/defaults.go#L513-L530
- *
- * The list below can get out of sync with what tsh actually implements.
- *
- * @deprecated Move to a better suited file.
- */
-export type GatewayProtocol =
-  | 'postgres'
-  | 'mysql'
-  | 'mongodb'
-  | 'cockroachdb'
-  | 'redis'
-  | 'sqlserver';
-
-/** @deprecated Move to a better suited file. */
-export type GetResourcesParams = {
-  clusterUri: uri.ClusterUri;
-  // sort is a required field because it has direct implications on performance of ListResources.
-  sort: SortType | null;
-  // limit cannot be omitted and must be greater than zero, otherwise ListResources is going to
-  // return an error.
-  limit: number;
-  // search is used for regular search.
-  search?: string;
-  searchAsRoles?: string;
-  startKey?: string;
-  // query is used for advanced search.
-  query?: string;
-};
diff --git a/web/packages/teleterm/src/services/tshdEvents/index.ts b/web/packages/teleterm/src/services/tshdEvents/index.ts
index ea48956ce8ac3..b101fcd16222c 100644
--- a/web/packages/teleterm/src/services/tshdEvents/index.ts
+++ b/web/packages/teleterm/src/services/tshdEvents/index.ts
@@ -64,7 +64,9 @@ export async function createTshdEventsServer(
   const { service, setupTshdEventContextBridgeService } = createService(logger);
 
   server.addService(apiService.tshdEventsServiceDefinition, service);
-
+  window.addEventListener('unload', () => {
+    server.forceShutdown();
+  });
   return { resolvedAddress, setupTshdEventContextBridgeService };
 }
 
diff --git a/web/packages/teleterm/src/services/vnet/__snapshots__/diag.test.ts.snap b/web/packages/teleterm/src/services/vnet/__snapshots__/diag.test.ts.snap
index 77776b66d752a..4d55bb3866f8a 100644
--- a/web/packages/teleterm/src/services/vnet/__snapshots__/diag.test.ts.snap
+++ b/web/packages/teleterm/src/services/vnet/__snapshots__/diag.test.ts.snap
@@ -33,5 +33,21 @@ default            link#25            UCSIg               utun4
 100.100.100.100    link#25            UHWIi               utun4       
 
 \`\`\`
+
+---
+⚠️ VNet SSH is not configured.
+
+  The user's default SSH configuration file does not include VNet's
+  generated configuration file and connections to VNet SSH hosts will
+  not work by default.
+
+| File description         | Path |
+| ------------------------ | ---- |
+| User OpenSSH config file | ~/.ssh/config  |
+| VNet SSH config file     | /Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config  |
+
+~/.ssh/config does not exist
+
+
 "
 `;
diff --git a/web/packages/teleterm/src/services/vnet/diag.test.ts b/web/packages/teleterm/src/services/vnet/diag.test.ts
index 5d7d12ad1d3b8..937632b0386ac 100644
--- a/web/packages/teleterm/src/services/vnet/diag.test.ts
+++ b/web/packages/teleterm/src/services/vnet/diag.test.ts
@@ -29,10 +29,10 @@ import {
 
 describe('reportToText', () => {
   it('converts report correctly', () => {
-    const checkReport = makeCheckReport({
+    const routeConflictReport = makeCheckReport({
       status: diag.CheckReportStatus.ISSUES_FOUND,
     });
-    checkReport.report = {
+    routeConflictReport.report = {
       oneofKind: 'routeConflictReport',
       routeConflictReport: {
         routeConflicts: [
@@ -51,12 +51,29 @@ describe('reportToText', () => {
         ],
       },
     };
+    const sshConfigReport = makeCheckReport({
+      status: diag.CheckReportStatus.OK,
+    });
+    sshConfigReport.report = {
+      oneofKind: 'sshConfigurationReport',
+      sshConfigurationReport: {
+        userOpensshConfigPath: '~/.ssh/config',
+        vnetSshConfigPath:
+          '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
+        userOpensshConfigIncludesVnetSshConfig: false,
+        userOpensshConfigExists: false,
+        userOpensshConfigContents: '',
+      },
+    };
     const report = makeReport({
       checks: [
         makeCheckAttempt({
-          checkReport,
+          checkReport: routeConflictReport,
           commands: [makeCommandAttempt()],
         }),
+        makeCheckAttempt({
+          checkReport: sshConfigReport,
+        }),
       ],
     });
 
diff --git a/web/packages/teleterm/src/services/vnet/diag.ts b/web/packages/teleterm/src/services/vnet/diag.ts
index 6313c556c895f..98043f7293ecb 100644
--- a/web/packages/teleterm/src/services/vnet/diag.ts
+++ b/web/packages/teleterm/src/services/vnet/diag.ts
@@ -20,7 +20,10 @@ import { displayDateTime } from 'design/datetime';
 import { Timestamp } from 'gen-proto-ts/google/protobuf/timestamp_pb';
 import * as diag from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
 
-import { reportOneOfIsRouteConflictReport } from 'teleterm/helpers';
+import {
+  reportOneOfIsRouteConflictReport,
+  reportOneOfIsSSHConfigurationReport,
+} from 'teleterm/helpers';
 
 export const hasReportFoundIssues = (report: diag.Report): boolean =>
   report.checks.some(
@@ -122,6 +125,10 @@ const reportOneofToDisplayDetails: Record<
     errorTitle: 'inspect network routes',
     reportToText: routeConflictReportToText,
   },
+  sshConfigurationReport: {
+    errorTitle: 'inspect SSH configuration',
+    reportToText: sshConfigurationReportToText,
+  },
 };
 
 function routeConflictReportToText({
@@ -149,3 +156,43 @@ function routeConflictReportToText({
 | ---------------- | ----------------------- | --------- | --------- |
 ${tableRows}`;
 }
+
+function sshConfigurationReportToText({ report }: diag.CheckReport): string {
+  if (!reportOneOfIsSSHConfigurationReport(report)) {
+    return null;
+  }
+  const {
+    userOpensshConfigPath,
+    vnetSshConfigPath,
+    userOpensshConfigIncludesVnetSshConfig,
+    userOpensshConfigExists,
+    userOpensshConfigContents,
+  } = report.sshConfigurationReport;
+
+  const status = userOpensshConfigIncludesVnetSshConfig
+    ? '✅ VNet SSH is configured correctly.'
+    : `⚠️ VNet SSH is not configured.
+
+  The user's default SSH configuration file does not include VNet's
+  generated configuration file and connections to VNet SSH hosts will
+  not work by default.`;
+
+  const pathsTable = `
+| File description         | Path |
+| ------------------------ | ---- |
+| User OpenSSH config file | ${userOpensshConfigPath}  |
+| VNet SSH config file     | ${vnetSshConfigPath}  |`;
+
+  const currentContents = userOpensshConfigExists
+    ? `Current contents of ${userOpensshConfigPath}:
+
+\`\`\`
+${userOpensshConfigContents}
+\`\`\``
+    : `${userOpensshConfigPath} does not exist`;
+
+  return `${status}
+${pathsTable}
+
+${currentContents}`;
+}
diff --git a/web/packages/teleterm/src/sharedProcess/api/proto/ptyHostService.proto b/web/packages/teleterm/src/sharedProcess/api/proto/ptyHostService.proto
index 15722d0df9a78..438fddd2fa0be 100644
--- a/web/packages/teleterm/src/sharedProcess/api/proto/ptyHostService.proto
+++ b/web/packages/teleterm/src/sharedProcess/api/proto/ptyHostService.proto
@@ -81,6 +81,7 @@ message PtyEventOpen {}
 message PtyEventExit {
   uint32 exit_code = 1;
   optional uint32 signal = 2;
+  string last_input = 3;
 }
 
 message PtyEventStartError {
diff --git a/web/packages/teleterm/src/sharedProcess/api/protogen/ptyHostService_pb.ts b/web/packages/teleterm/src/sharedProcess/api/protogen/ptyHostService_pb.ts
index 35f043a2d4624..6497af4c9e483 100644
--- a/web/packages/teleterm/src/sharedProcess/api/protogen/ptyHostService_pb.ts
+++ b/web/packages/teleterm/src/sharedProcess/api/protogen/ptyHostService_pb.ts
@@ -196,6 +196,10 @@ export interface PtyEventExit {
      * @generated from protobuf field: optional uint32 signal = 2;
      */
     signal?: number;
+    /**
+     * @generated from protobuf field: string last_input = 3;
+     */
+    lastInput: string;
 }
 /**
  * @generated from protobuf message PtyEventStartError
@@ -695,12 +699,14 @@ class PtyEventExit$Type extends MessageType<PtyEventExit> {
     constructor() {
         super("PtyEventExit", [
             { no: 1, name: "exit_code", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
-            { no: 2, name: "signal", kind: "scalar", opt: true, T: 13 /*ScalarType.UINT32*/ }
+            { no: 2, name: "signal", kind: "scalar", opt: true, T: 13 /*ScalarType.UINT32*/ },
+            { no: 3, name: "last_input", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<PtyEventExit>): PtyEventExit {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.exitCode = 0;
+        message.lastInput = "";
         if (value !== undefined)
             reflectionMergePartial<PtyEventExit>(this, message, value);
         return message;
@@ -716,6 +722,9 @@ class PtyEventExit$Type extends MessageType<PtyEventExit> {
                 case /* optional uint32 signal */ 2:
                     message.signal = reader.uint32();
                     break;
+                case /* string last_input */ 3:
+                    message.lastInput = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -734,6 +743,9 @@ class PtyEventExit$Type extends MessageType<PtyEventExit> {
         /* optional uint32 signal = 2; */
         if (message.signal !== undefined)
             writer.tag(2, WireType.Varint).uint32(message.signal);
+        /* string last_input = 3; */
+        if (message.lastInput !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.lastInput);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
diff --git a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyEventsStreamHandler.ts b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyEventsStreamHandler.ts
index 8b8639fd6fe94..573eb1c25bea0 100644
--- a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyEventsStreamHandler.ts
+++ b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyEventsStreamHandler.ts
@@ -90,12 +90,12 @@ export class PtyEventsStreamHandler {
         })
       )
     );
-    this.ptyProcess.onExit(({ exitCode, signal }) =>
+    this.ptyProcess.onExit(payload =>
       this.stream.write(
         PtyServerEvent.create({
           event: {
             oneofKind: 'exit',
-            exit: PtyEventExit.create({ exitCode, signal }),
+            exit: PtyEventExit.create(payload),
           },
         })
       )
diff --git a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.test.ts b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.test.ts
index 77d8a7dddad68..43c2065fc26d7 100644
--- a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.test.ts
+++ b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.test.ts
@@ -52,4 +52,29 @@ describe('PtyProcess', () => {
       );
     });
   });
+
+  if (process.platform !== 'win32') {
+    test('including the last input in the exit event', async () => {
+      const pty = new PtyProcess({
+        path: 'sh',
+        env: {},
+        args: [],
+        useConpty: true,
+        ptyId: '1234',
+      });
+      await pty.start(80, 24);
+      const listener = jest.fn();
+      pty.onExit(listener);
+
+      pty.write('\x04');
+
+      await expect(() => listener.mock.calls.length > 0).toEventuallyBeTrue({
+        waitFor: 2000,
+        tick: 10,
+      });
+      expect(listener).toHaveBeenCalledWith(
+        expect.objectContaining({ lastInput: '\x04' })
+      );
+    });
+  }
 });
diff --git a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.ts b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.ts
index 771065ded6a67..5f2835aa5ef8c 100644
--- a/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.ts
+++ b/web/packages/teleterm/src/sharedProcess/ptyHost/ptyProcess.ts
@@ -42,6 +42,7 @@ export class PtyProcess extends EventEmitter implements IPtyProcess {
   private _logger: Logger;
   private _status: Status = 'not_initialized';
   private _disposed = false;
+  private _lastInput = '';
 
   constructor(private options: PtyProcessOptions & { ptyId: string }) {
     super();
@@ -115,6 +116,7 @@ export class PtyProcess extends EventEmitter implements IPtyProcess {
       return;
     }
 
+    this._lastInput = data;
     this._process.write(data);
   }
 
@@ -184,7 +186,9 @@ export class PtyProcess extends EventEmitter implements IPtyProcess {
     return this.addListenerAndReturnRemovalFunction(TermEventEnum.Open, cb);
   }
 
-  onExit(cb: (ev: { exitCode: number; signal?: number }) => void) {
+  onExit(
+    cb: (ev: { exitCode: number; signal?: number; lastInput: string }) => void
+  ) {
     return this.addListenerAndReturnRemovalFunction(TermEventEnum.Exit, cb);
   }
 
@@ -229,7 +233,7 @@ export class PtyProcess extends EventEmitter implements IPtyProcess {
   }
 
   private _handleExit(e: { exitCode: number; signal?: number }) {
-    this.emit(TermEventEnum.Exit, e);
+    this.emit(TermEventEnum.Exit, { ...e, lastInput: this._lastInput });
     this._logger.info(`pty has been terminated with exit code: ${e.exitCode}`);
     this._setStatus('terminated');
   }
diff --git a/web/packages/teleterm/src/sharedProcess/ptyHost/types.ts b/web/packages/teleterm/src/sharedProcess/ptyHost/types.ts
index cd0f4b8bce4c6..1f73897fe6991 100644
--- a/web/packages/teleterm/src/sharedProcess/ptyHost/types.ts
+++ b/web/packages/teleterm/src/sharedProcess/ptyHost/types.ts
@@ -41,7 +41,7 @@ export type IPtyProcess = {
   onOpen(cb: () => void): RemoveListenerFunction;
   onStartError(cb: (message: string) => void): RemoveListenerFunction;
   onExit(
-    cb: (ev: { exitCode: number; signal?: number }) => void
+    cb: (ev: { exitCode: number; signal?: number; lastInput: string }) => void
   ): RemoveListenerFunction;
 };
 
diff --git a/web/packages/teleterm/src/tray.ts b/web/packages/teleterm/src/tray.ts
new file mode 100644
index 0000000000000..9cda8ceb2d613
--- /dev/null
+++ b/web/packages/teleterm/src/tray.ts
@@ -0,0 +1,67 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { app, Menu, nativeImage, NativeImage, Tray } from 'electron';
+
+import { getAssetPath } from 'teleterm/mainProcess/runtimeSettings';
+import { RuntimeSettings } from 'teleterm/mainProcess/types';
+
+export function setTray(
+  runtimeSettings: RuntimeSettings,
+  window: { show(): void }
+): void {
+  const tray = new Tray(
+    getIcon(runtimeSettings),
+    // Random GUIDs that allows the icon to retain its position between relaunches.
+    runtimeSettings.dev
+      ? 'b3f163ae-bba3-4513-9593-ce186a3c3eb7'
+      : 'acf0cb59-0f9e-412a-8973-9ee803bc39f6'
+  );
+
+  // On Windows, the app tray menu is displayed on the right mouse click.
+  // The left mouse click should open the window.
+  if (runtimeSettings.platform === 'win32') {
+    tray.on('click', () => window.show());
+  }
+
+  const contextMenu = Menu.buildFromTemplate([
+    {
+      label: `Open ${app.name}`,
+      click: () => window.show(),
+    },
+    { type: 'separator' },
+    { label: 'Quit', role: 'quit' },
+  ]);
+  tray.setContextMenu(contextMenu);
+  tray.setToolTip(app.name);
+}
+
+function getIcon(runtimeSettings: RuntimeSettings): string | NativeImage {
+  switch (runtimeSettings.platform) {
+    case 'darwin':
+      const image = nativeImage.createFromPath(
+        getAssetPath('icon-macTemplate@2x.png')
+      );
+      image.setTemplateImage(true);
+      return image;
+    case 'win32':
+      return getAssetPath('icon-win.ico');
+    case 'linux':
+      return getAssetPath('icon-linux/tray.png');
+  }
+}
diff --git a/web/packages/teleterm/src/ui/AccessRequestCheckout/AccessRequestCheckout.tsx b/web/packages/teleterm/src/ui/AccessRequestCheckout/AccessRequestCheckout.tsx
index bbc6d2e47a048..05bb1a9ee47ab 100644
--- a/web/packages/teleterm/src/ui/AccessRequestCheckout/AccessRequestCheckout.tsx
+++ b/web/packages/teleterm/src/ui/AccessRequestCheckout/AccessRequestCheckout.tsx
@@ -102,6 +102,7 @@ export function AccessRequestCheckout() {
     onStartTimeChange,
     fetchKubeNamespaces,
     updateNamespacesForKubeCluster,
+    reasonMode,
     reasonPrompts,
   } = useAccessRequestCheckout();
 
@@ -269,7 +270,6 @@ export function AccessRequestCheckout() {
             clearAttempt={clearCreateAttempt}
             selectedReviewers={selectedReviewers}
             setSelectedReviewers={setSelectedReviewers}
-            requireReason={false}
             numRequestedResources={requestedCount}
             isResourceRequest={!isRoleRequest}
             fetchStatus={'loaded'}
@@ -284,6 +284,7 @@ export function AccessRequestCheckout() {
             onStartTimeChange={onStartTimeChange}
             fetchKubeNamespaces={fetchKubeNamespaces}
             updateNamespacesForKubeCluster={updateNamespacesForKubeCluster}
+            requireReason={reasonMode === 'required'}
             reasonPrompts={reasonPrompts}
           />
         )}
diff --git a/web/packages/teleterm/src/ui/AccessRequests/AccessRequestsContext.tsx b/web/packages/teleterm/src/ui/AccessRequests/AccessRequestsContext.tsx
index 2ce2257e6de00..a4c0d9c25c571 100644
--- a/web/packages/teleterm/src/ui/AccessRequests/AccessRequestsContext.tsx
+++ b/web/packages/teleterm/src/ui/AccessRequests/AccessRequestsContext.tsx
@@ -16,21 +16,21 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { UseQueryResult } from '@tanstack/react-query';
 import {
   createContext,
   FC,
   PropsWithChildren,
   useCallback,
   useContext,
-  useMemo,
 } from 'react';
 
 import { AccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
 import { Attempt, useAsync } from 'shared/hooks/useAsync';
 
+import { useAssumedRequests } from 'teleterm/ui/AccessRequests/useAssumedRequests';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
-import { getAssumedRequests } from 'teleterm/ui/services/clusters';
 import { RootClusterUri } from 'teleterm/ui/uri';
 import { retryWithRelogin } from 'teleterm/ui/utils';
 
@@ -42,7 +42,7 @@ export interface AccessRequestsContext {
   fetchRequestsAttempt: Attempt<AccessRequest[]>;
   fetchRequests(): Promise<[AccessRequest[], Error]>;
   /** Maps access request ID to the corresponding request object. */
-  assumed: Map<string, AccessRequest>;
+  assumed: Map<string, UseQueryResult<AccessRequest>>;
 }
 
 const AccessRequestsContext = createContext<AccessRequestsContext>(null);
@@ -59,17 +59,7 @@ export const AccessRequestsContextProvider: FC<
     useCallback(state => state.clusters.get(rootClusterUri), [rootClusterUri])
   );
 
-  const assumedObject = useStoreSelector(
-    'clustersService',
-    useCallback(
-      state => getAssumedRequests(state, rootClusterUri),
-      [rootClusterUri]
-    )
-  );
-  const assumed = useMemo(
-    () => new Map(Object.entries(assumedObject)),
-    [assumedObject]
-  );
+  const assumed = useAssumedRequests(rootClusterUri);
 
   const canUse = !!rootCluster?.features?.advancedAccessWorkflows;
 
diff --git a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.story.tsx b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.story.tsx
index edbf23b089c0f..a5f326b0455df 100644
--- a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.story.tsx
+++ b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.story.tsx
@@ -18,15 +18,13 @@
 
 import { useEffect, useLayoutEffect, useRef } from 'react';
 
-import {
-  AccessRequest,
-  ResourceID,
-} from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
+import { ResourceID } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
 import { wait, waitForever } from 'shared/utils/wait';
 
 import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
 import {
   makeAccessRequest,
+  makeLoggedInUser,
   makeRootCluster,
 } from 'teleterm/services/tshd/testHelpers';
 import { ResourcesContextProvider } from 'teleterm/ui/DocumentCluster/resourcesContext';
@@ -85,7 +83,6 @@ const resourceIds: ResourceID[] = [
 const smallAccessRequest = makeAccessRequest();
 const mediumAccessRequest = makeAccessRequest({
   id: '11929070-6886-77eb-90aa-c7223dd735',
-  resourceIds: resourceIds.slice(0, 4),
   resources: resourceIds.slice(0, 4).map(id => ({
     id,
     details: { friendlyName: '', hostname: '' },
@@ -93,7 +90,6 @@ const mediumAccessRequest = makeAccessRequest({
 });
 const largeAccessRequest = makeAccessRequest({
   id: '11929070-6886-77eb-90aa-c7223dd735',
-  resourceIds,
   resources: resourceIds.map(id => ({
     id,
     details: { friendlyName: '', hostname: '' },
@@ -161,7 +157,10 @@ export function ResourceRequestAlreadyAssumed() {
     });
 
   return (
-    <ShowState appContext={appContext} assumedRequests={[smallAccessRequest]} />
+    <ShowState
+      appContext={appContext}
+      activeRequests={[smallAccessRequest.id]}
+    />
   );
 }
 
@@ -177,14 +176,36 @@ export function RequestWithManyResources() {
   return <ShowState appContext={appContext} />;
 }
 
+export function AssumedRequestWithNoDetails() {
+  const appContext = new MockAppContext();
+  appContext.tshd.getAccessRequests = () =>
+    new MockedUnaryCall({
+      totalCount: 0,
+      startKey: '',
+      requests: [],
+    });
+
+  return (
+    <ShowState
+      appContext={appContext}
+      activeRequests={['34488748-0c91-463e-ac93-a5dd21eeec8a']}
+    />
+  );
+}
+
 function ShowState({
-  assumedRequests = [],
+  activeRequests = [],
   appContext,
 }: {
-  assumedRequests?: AccessRequest[];
+  activeRequests?: string[];
   appContext: MockAppContext;
 }) {
-  appContext.addRootCluster(rootCluster);
+  appContext.addRootCluster({
+    ...rootCluster,
+    loggedInUser: makeLoggedInUser({
+      activeRequests: activeRequests,
+    }),
+  });
   appContext.clustersService.assumeRoles = async () => {
     await wait(1000);
     throw new Error(
@@ -197,13 +218,17 @@ function ShowState({
       'connection error: desc = "transport: Error while dialing: failed to dial: unable to establish proxy stream\\n\\trpc error: code = Unavailable desc'
     );
   };
-  appContext.clustersService.setState(draftState => {
-    draftState.clusters.get(rootCluster.uri).loggedInUser.assumedRequests =
-      assumedRequests.reduce((requestsMap, request) => {
-        requestsMap[request.id] = request;
-        return requestsMap;
-      }, {});
-  });
+  appContext.tshd.getAccessRequest = async input => {
+    const allRequests = await appContext.tshd.getAccessRequests({
+      clusterUri: rootCluster.uri,
+    });
+    const request = allRequests.response.requests.find(
+      a => a.id === input.accessRequestId
+    );
+    return new MockedUnaryCall({
+      request,
+    });
+  };
 
   useLayoutEffect(() => {
     (
diff --git a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.test.tsx b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.test.tsx
index 8962c096c6dd3..1af297ba33312 100644
--- a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.test.tsx
+++ b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.test.tsx
@@ -18,50 +18,56 @@
 
 import { screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
-import { useEffect } from 'react';
 
 import { render } from 'design/utils/testing';
 
+import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
 import {
   makeAccessRequest,
+  makeLoggedInUser,
   makeRootCluster,
 } from 'teleterm/services/tshd/testHelpers';
 import { SelectorMenu } from 'teleterm/ui/AccessRequests/SelectorMenu';
-import {
-  ResourcesContextProvider,
-  useResourcesContext,
-} from 'teleterm/ui/DocumentCluster/resourcesContext';
+import { ResourcesContextProvider } from 'teleterm/ui/DocumentCluster/resourcesContext';
 import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
 import { MockWorkspaceContextProvider } from 'teleterm/ui/fixtures/MockWorkspaceContextProvider';
-import { RootClusterUri } from 'teleterm/ui/uri';
 
 import { AccessRequestsContextProvider } from './AccessRequestsContext';
 
-test('assuming or dropping a request refreshes resources', async () => {
+test('assuming or dropping a request calls API', async () => {
   const appContext = new MockAppContext();
+  const accessRequest = makeAccessRequest();
   const cluster = makeRootCluster({
     features: { advancedAccessWorkflows: true, isUsageBasedBilling: false },
   });
   appContext.addRootCluster(cluster);
   jest.spyOn(appContext.clustersService, 'dropRoles');
-  const refreshListener = jest.fn();
-  const accessRequest = makeAccessRequest();
-  appContext.clustersService.setState(draftState => {
-    draftState.clusters.get(cluster.uri).loggedInUser.assumedRequests = {
-      [accessRequest.id]: accessRequest,
-    };
-  });
+  jest
+    .spyOn(appContext.clustersService, 'assumeRoles')
+    .mockImplementation(async () => {
+      appContext.clustersService.setState(state => {
+        state.clusters.get(cluster.uri).loggedInUser.activeRequests = [
+          accessRequest.id,
+        ];
+      });
+    });
+  appContext.tshd.getAccessRequests = () => {
+    return new MockedUnaryCall({
+      requests: [accessRequest],
+    });
+  };
+  appContext.tshd.getAccessRequest = () => {
+    return new MockedUnaryCall({
+      request: accessRequest,
+    });
+  };
 
   render(
     <MockAppContextProvider appContext={appContext}>
       <ResourcesContextProvider>
         <MockWorkspaceContextProvider rootClusterUri={cluster.uri}>
           <AccessRequestsContextProvider rootClusterUri={cluster.uri}>
-            <RequestRefreshSubscriber
-              rootClusterUri={cluster.uri}
-              onResourcesRefreshRequest={refreshListener}
-            />
             <SelectorMenu />
           </AccessRequestsContextProvider>
         </MockWorkspaceContextProvider>
@@ -74,24 +80,71 @@ test('assuming or dropping a request refreshes resources', async () => {
 
   const item = await screen.findByText(accessRequest.resources.at(0).id.name);
   await userEvent.click(item);
+  expect(appContext.clustersService.assumeRoles).toHaveBeenCalledTimes(1);
+  expect(appContext.clustersService.assumeRoles).toHaveBeenCalledWith(
+    cluster.uri,
+    [accessRequest.id]
+  );
+  expect(await screen.findByText(/access assumed/i)).toBeInTheDocument();
+  await userEvent.click(item);
   expect(appContext.clustersService.dropRoles).toHaveBeenCalledTimes(1);
   expect(appContext.clustersService.dropRoles).toHaveBeenCalledWith(
     cluster.uri,
     [accessRequest.id]
   );
-  expect(refreshListener).toHaveBeenCalledTimes(1);
 });
 
-function RequestRefreshSubscriber(props: {
-  rootClusterUri: RootClusterUri;
-  onResourcesRefreshRequest: () => void;
-}) {
-  const { onResourcesRefreshRequest } = useResourcesContext(
-    props.rootClusterUri
+test('assumed request are always visible, even if getAccessRequests no longer returns them', async () => {
+  const requestA = makeAccessRequest({
+    id: '67bea2b6-9390-43a5-af47-c391561dbfba',
+    resources: [],
+    roles: ['access-a'],
+  });
+  const requestB = makeAccessRequest({
+    id: '34488748-0c91-463e-ac93-a5dd21eeec8a',
+    resources: [],
+    roles: ['access-b'],
+  });
+  const appContext = new MockAppContext();
+  const cluster = makeRootCluster({
+    features: { advancedAccessWorkflows: true, isUsageBasedBilling: false },
+    loggedInUser: makeLoggedInUser({
+      activeRequests: [requestB.id, 'request-with-details-not-available'],
+    }),
+  });
+  appContext.addRootCluster(cluster);
+
+  appContext.tshd.getAccessRequests = () => {
+    return new MockedUnaryCall({ requests: [requestA] });
+  };
+  appContext.tshd.getAccessRequest = ({ accessRequestId }) => {
+    if (accessRequestId !== requestB.id) {
+      throw new Error(`Request ${accessRequestId} not found`);
+    }
+    return new MockedUnaryCall({ request: requestB });
+  };
+
+  render(
+    <MockAppContextProvider appContext={appContext}>
+      <ResourcesContextProvider>
+        <MockWorkspaceContextProvider rootClusterUri={cluster.uri}>
+          <AccessRequestsContextProvider rootClusterUri={cluster.uri}>
+            <SelectorMenu />
+          </AccessRequestsContextProvider>
+        </MockWorkspaceContextProvider>
+      </ResourcesContextProvider>
+    </MockAppContextProvider>
   );
-  useEffect(() => {
-    onResourcesRefreshRequest(props.onResourcesRefreshRequest);
-  }, [onResourcesRefreshRequest, props.onResourcesRefreshRequest]);
 
-  return null;
-}
+  const accessRequestsMenu = await screen.findByTitle('Access Requests');
+  await userEvent.click(accessRequestsMenu);
+
+  // Even though getAccessRequests only returned requestA, the UI always displays the assumed requests:
+  // - requestB, which details exists in the useAssumedRequests cache
+  // - request-with-details-not-available, which is shown using only its ID (details missing)
+  expect(await screen.findByText('access-a')).toBeInTheDocument();
+  expect(await screen.findByText('access-b')).toBeInTheDocument();
+  expect(
+    await screen.findByText('request-with-details-not-available')
+  ).toBeInTheDocument();
+});
diff --git a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.tsx b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.tsx
index d145c368bbf2e..96d4a2b55246e 100644
--- a/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.tsx
+++ b/web/packages/teleterm/src/ui/AccessRequests/SelectorMenu.tsx
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { UseQueryResult } from '@tanstack/react-query';
 import { formatDistanceToNow, isPast } from 'date-fns';
 import { ComponentType, useEffect, useMemo, useRef, useState } from 'react';
 import styled, { css, useTheme } from 'styled-components';
@@ -25,7 +26,7 @@ import * as Icon from 'design/Icon';
 import { IconProps } from 'design/Icon/Icon';
 import { MenuItemSectionLabel } from 'design/Menu/MenuItem';
 import { Timestamp } from 'gen-proto-ts/google/protobuf/timestamp_pb';
-import { AccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
+import { AccessRequest as GenAccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
 import { RequestableResourceKind } from 'shared/components/AccessRequests/NewRequest';
 import { getResourcesOrRolesFromRequest } from 'shared/components/AccessRequests/Shared/Shared';
 import {
@@ -43,7 +44,6 @@ import {
   MenuListItem,
   Separator,
 } from 'teleterm/ui/components/Menu';
-import { useResourcesContext } from 'teleterm/ui/DocumentCluster/resourcesContext';
 import { useWorkspaceContext } from 'teleterm/ui/Documents';
 import { useLoggedInUser } from 'teleterm/ui/hooks/useLoggedInUser';
 import { TopBarButton } from 'teleterm/ui/TopBar/TopBarButton';
@@ -55,6 +55,11 @@ import {
 } from '../TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator';
 import { useAccessRequestsContext } from './AccessRequestsContext';
 
+type AccessRequest = Pick<
+  GenAccessRequest,
+  'expires' | 'id' | 'resources' | 'roles' | 'state' | 'user'
+>;
+
 export function SelectorMenu() {
   const [open, setOpen] = useState(false);
   // Captures a snapshot of the assumed request when the menu opens.
@@ -62,7 +67,7 @@ export function SelectorMenu() {
   // Prevents requests from shifting when they are assumed or dropped
   // while the menu is open.
   const [assumedSnapshot, setAssumedSnapshot] = useState<
-    Map<string, AccessRequest>
+    Map<string, UseQueryResult<AccessRequest>>
   >(() => new Map());
   const {
     canUse,
@@ -77,7 +82,6 @@ export function SelectorMenu() {
   const ctx = useAppContext();
   const { clustersService } = ctx;
   const selectorRef = useRef<HTMLButtonElement>(null);
-  const { requestResourcesRefresh } = useResourcesContext(rootClusterUri);
   const loggedInUser = useLoggedInUser();
   const username = loggedInUser?.name;
 
@@ -92,21 +96,24 @@ export function SelectorMenu() {
     [fetchRequestsAttempt, username]
   );
 
-  // Ensure that the assumed requests are always displayed in the menu.
-  // It's possible that the user assumed a request that was later deleted.
-  // If they refreshed the list after that, the request would be gone there, but
-  // still displayed in the status bar.
-  // The same thing would happen if the API call to fetch requests failed.
-  // We need to make sure that the assumed roles are always visible.
+  // Ensure assumed requests are always shown.
+  // If a request was deleted after being assumed, or if the API call to fetch
+  // requests fails, add the cached assumed requests to the list
+  // (or at least their request IDs if full details aren’t available).
   const assumedAndAssumableRequests = useMemo(() => {
-    const allRequests = [...(assumableRequests.data || [])];
-    assumed.forEach(assumedRequest => {
-      if (
-        !allRequests.find(
-          fetchedRequest => fetchedRequest.id === assumedRequest.id
-        )
-      ) {
-        allRequests.push(assumedRequest);
+    const allRequests: AccessRequest[] = [...(assumableRequests.data || [])];
+    Array.from(assumed).forEach(([assumedRequestId, assumedRequestQuery]) => {
+      const exists = allRequests.some(r => r.id === assumedRequestId);
+
+      if (!exists) {
+        const fallbackRequest = {
+          id: assumedRequestId,
+          resources: [],
+          roles: [],
+          state: '',
+          user: '',
+        };
+        allRequests.push(assumedRequestQuery.data || fallbackRequest);
       }
     });
     return allRequests;
@@ -201,7 +208,6 @@ export function SelectorMenu() {
         await clustersService.assumeRoles(rootClusterUri, [requestId]);
       }
     });
-    requestResourcesRefresh();
   }
 
   const isResourceRequestAssumed = sortedRequests
@@ -339,6 +345,18 @@ function RequestItem(props: {
     assumeOrDropAttempt.status === 'processing' ||
     !canAssumeResourceRequest;
 
+  const clippedRequestItems = clipRequestItems(items).map((i, index, array) => {
+    const { Icon, name } = i;
+    const isLast = index === array.length - 1;
+    return (
+      <Flex key={`name-${index}`} gap={1}>
+        {Icon && <Icon size="small" />}
+        {name}
+        {!isLast && ','}
+      </Flex>
+    );
+  });
+
   return (
     <StyledMenuItemContainer
       assumed={props.isAssumed}
@@ -363,17 +381,10 @@ function RequestItem(props: {
           `}
         >
           <Flex gap={1} flexWrap="wrap">
-            {clipRequestItems(items).map((i, index, array) => {
-              const { Icon, name } = i;
-              const isLast = index === array.length - 1;
-              return (
-                <Flex key={`name-${index}`} gap={1}>
-                  {Icon && <Icon size="small" />}
-                  {name}
-                  {!isLast && ','}
-                </Flex>
-              );
-            })}
+            {/*Only fallback requests have no roles/resources.*/}
+            {clippedRequestItems.length
+              ? clippedRequestItems
+              : props.request.id}
           </Flex>
           <P3
             css={`
@@ -448,14 +459,17 @@ function getAccessRequestIconStatus(
 
 function getAccessRequestStatusText(args: {
   attempt: Attempt<unknown>;
-  expires: Timestamp;
+  expires: Timestamp | undefined;
   isAssumed: boolean;
   canAssumeResourceRequest: boolean;
 }) {
-  const expirationDate = Timestamp.toDate(args.expires);
-  const expiresIn = isPast(expirationDate)
-    ? 'Expired'
-    : `Expires in ${formatDistanceToNow(Timestamp.toDate(args.expires))}`;
+  const expirationDate = args.expires && Timestamp.toDate(args.expires);
+
+  const expiresIn = !expirationDate
+    ? 'Unknown expiration'
+    : isPast(expirationDate)
+      ? 'Expired'
+      : `Expires in ${formatDistanceToNow(expirationDate)}`;
 
   if (args.attempt.status === 'error') {
     return `Could not update access: ${args.attempt.statusText}`;
diff --git a/web/packages/teleterm/src/ui/AccessRequests/index.ts b/web/packages/teleterm/src/ui/AccessRequests/index.ts
index dc615faba17c2..afe4af274dc5f 100644
--- a/web/packages/teleterm/src/ui/AccessRequests/index.ts
+++ b/web/packages/teleterm/src/ui/AccessRequests/index.ts
@@ -18,3 +18,4 @@
 
 export * from './AccessRequestsContext';
 export { SelectorMenu as AccessRequestsMenu } from './SelectorMenu';
+export * from './useAssumedRequests';
diff --git a/web/packages/teleterm/src/ui/AccessRequests/useAssumedRequests.ts b/web/packages/teleterm/src/ui/AccessRequests/useAssumedRequests.ts
new file mode 100644
index 0000000000000..2f847604d6bae
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AccessRequests/useAssumedRequests.ts
@@ -0,0 +1,68 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useQueries, UseQueryResult } from '@tanstack/react-query';
+import { useCallback } from 'react';
+
+import { AccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
+
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+/**
+ * Keeps request details for assumed request IDs.
+ * Once loaded from the server, the details are cached indefinitely.
+ */
+export const useAssumedRequests = (
+  uri: RootClusterUri
+): Map<string, UseQueryResult<AccessRequest>> => {
+  const appContext = useAppContext();
+  const cluster = useStoreSelector(
+    'clustersService',
+    useCallback(state => state.clusters.get(uri), [uri])
+  );
+
+  const activeRequests = cluster?.loggedInUser.activeRequests || [];
+
+  return useQueries({
+    queries: activeRequests.map(id => ({
+      // Only run this background query when the cluster is connected.
+      enabled: cluster?.connected,
+      queryKey: ['assumedAccessRequests', uri, id],
+      // Fetch once and always use cached value.
+      staleTime: Infinity,
+      queryFn: async () => {
+        const { response } = await appContext.tshd.getAccessRequest({
+          clusterUri: uri,
+          accessRequestId: id,
+        });
+        return response.request;
+      },
+      // Attach ID for the map below.
+      meta: { id },
+    })),
+    combine: results => {
+      return results.reduce((map, data, index) => {
+        const id = activeRequests[index];
+        map.set(id, data);
+        return map;
+      }, new Map<string, UseQueryResult<AccessRequest>>());
+    },
+  });
+};
diff --git a/web/packages/teleterm/src/ui/App.test.tsx b/web/packages/teleterm/src/ui/App.test.tsx
index 017d6ff898bc6..e97512b8f6984 100644
--- a/web/packages/teleterm/src/ui/App.test.tsx
+++ b/web/packages/teleterm/src/ui/App.test.tsx
@@ -25,7 +25,6 @@ import { mockIntersectionObserver } from 'jsdom-testing-mocks';
 import { render } from 'design/utils/testing';
 
 import Logger, { NullService } from 'teleterm/logger';
-import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
 import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
 import { App } from 'teleterm/ui/App';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
@@ -67,6 +66,9 @@ test('activating a workspace via deep link overrides the previously active works
     connected: false,
   });
   const appContext = new MockAppContext();
+  appContext.addRootCluster(deepLinkCluster);
+  appContext.addRootCluster(previouslyActiveCluster);
+
   jest
     .spyOn(appContext.statePersistenceService, 'getWorkspacesState')
     .mockReturnValue({
@@ -88,11 +90,6 @@ test('activating a workspace via deep link overrides the previously active works
     'usageReporting.enabled',
     false
   );
-  jest.spyOn(appContext.tshd, 'listRootClusters').mockReturnValue(
-    new MockedUnaryCall({
-      clusters: [deepLinkCluster, previouslyActiveCluster],
-    })
-  );
 
   render(<App ctx={appContext} />);
 
@@ -198,17 +195,13 @@ test.each<{
     'usageReporting.enabled',
     false
   );
-  jest.spyOn(appContext.tshd, 'listRootClusters').mockReturnValue(
-    new MockedUnaryCall({
-      clusters: [rootCluster],
-    })
-  );
+  appContext.addRootCluster(rootCluster);
 
   render(<App ctx={appContext} />);
 
   expect(
     await screen.findByText(
-      'Do you want to reopen tabs from the previous session?'
+      /Do you want to reopen tabs from the previous session/
     )
   ).toBeInTheDocument();
 
diff --git a/web/packages/teleterm/src/ui/App.tsx b/web/packages/teleterm/src/ui/App.tsx
index ba05e9cf37950..2c266df7f71fd 100644
--- a/web/packages/teleterm/src/ui/App.tsx
+++ b/web/packages/teleterm/src/ui/App.tsx
@@ -16,11 +16,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import React, { ComponentPropsWithoutRef } from 'react';
 import { DndProvider } from 'react-dnd';
 import { HTML5Backend } from 'react-dnd-html5-backend';
 
 import { AppInitializer } from 'teleterm/ui/AppInitializer';
+import { AppUpdaterContextProvider } from 'teleterm/ui/AppUpdater';
 
 import AppContext from './appContext';
 import AppContextProvider from './appContextProvider';
@@ -32,6 +34,15 @@ import { ThemeProvider } from './ThemeProvider';
 import { ConnectionsContextProvider } from './TopBar/Connections/connectionsContext';
 import { VnetContextProvider } from './Vnet/vnetContext';
 
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: false,
+    },
+  },
+});
+
 export const App: React.FC<{
   ctx: AppContext;
   launchDeepLink?: ComponentPropsWithoutRef<typeof DeepLinks>['launchDeepLink'];
@@ -41,17 +52,21 @@ export const App: React.FC<{
       <StyledApp>
         <DndProvider backend={HTML5Backend}>
           <AppContextProvider value={ctx}>
-            <ResourcesContextProvider>
-              <ConnectionsContextProvider>
-                <VnetContextProvider>
-                  <ThemeProvider>
-                    <DeepLinks launchDeepLink={launchDeepLink} />
+            <QueryClientProvider client={queryClient}>
+              <AppUpdaterContextProvider>
+                <ResourcesContextProvider>
+                  <ConnectionsContextProvider>
+                    <VnetContextProvider>
+                      <ThemeProvider>
+                        <DeepLinks launchDeepLink={launchDeepLink} />
 
-                    <AppInitializer />
-                  </ThemeProvider>
-                </VnetContextProvider>
-              </ConnectionsContextProvider>
-            </ResourcesContextProvider>
+                        <AppInitializer />
+                      </ThemeProvider>
+                    </VnetContextProvider>
+                  </ConnectionsContextProvider>
+                </ResourcesContextProvider>
+              </AppUpdaterContextProvider>
+            </QueryClientProvider>
           </AppContextProvider>
         </DndProvider>
       </StyledApp>
diff --git a/web/packages/teleterm/src/ui/AppUpdater/AppUpdater.story.tsx b/web/packages/teleterm/src/ui/AppUpdater/AppUpdater.story.tsx
new file mode 100644
index 0000000000000..f0a2909adc167
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/AppUpdater.story.tsx
@@ -0,0 +1,430 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Meta, StoryObj } from '@storybook/react-vite';
+import { useEffect, useState } from 'react';
+
+import { Flex, H3, P2, Stack } from 'design';
+import {
+  ClusterVersionInfo,
+  UnreachableCluster,
+} from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+
+import { Platform } from 'teleterm/mainProcess/types';
+import { AppUpdateEvent } from 'teleterm/services/appUpdater';
+import { resolveAutoUpdatesStatus } from 'teleterm/services/appUpdater/autoUpdatesStatus';
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+
+import { DetailsView } from './DetailsView';
+import {
+  makeCheckingForUpdateEvent,
+  makeDownloadProgressEvent,
+  makeErrorEvent,
+  makeUpdateAvailableEvent,
+  makeUpdateDownloadedEvent,
+  makeUpdateInfo,
+  makeUpdateNotAvailableEvent,
+} from './testHelpers';
+import { WidgetView } from './WidgetView';
+
+export interface StoryProps {
+  step:
+    | 'Update not available'
+    | 'Checking for update'
+    | 'Update available'
+    | 'Download progress'
+    | 'Error'
+    | 'Update downloaded';
+  updateSource: string;
+  envVar: 'Set to "off"' | 'Set to version - v15' | 'Unset';
+  platform: Platform;
+  clusterFoo:
+    | 'Does not exist'
+    | 'Unreachable'
+    | 'Enabled client updates - v18 cluster'
+    | 'Enabled client updates - v17 cluster'
+    | 'Disabled client updates - v18 cluster';
+  clusterBar:
+    | 'Does not exist'
+    | 'Unreachable'
+    | 'Enabled client updates - v17 cluster'
+    | 'Enabled client updates - v16 cluster'
+    | 'Disabled client updates - v17 cluster';
+  clusterBarSetToManageUpdates: boolean;
+  updateKind: 'Upgrade' | 'Downgrade';
+  nonTeleportCdn: boolean;
+}
+
+const meta: Meta<StoryProps> = {
+  title: 'Teleterm/AppUpdater',
+  component: WidgetAndDetails,
+  argTypes: {
+    envVar: {
+      control: { type: 'radio' },
+      options: ['Off', 'Set to version - v15', 'Unset'],
+      description: '`TELEPORT_TOOLS_VERSION` value',
+    },
+    clusterFoo: {
+      control: { type: 'select' },
+      description: 'State of cluster "foo"',
+      options: [
+        'Does not exist',
+        'Enabled client updates - v18 cluster',
+        'Enabled client updates - v17 cluster',
+        'Disabled client updates - v18 cluster',
+        'Unreachable',
+      ],
+    },
+    clusterBar: {
+      description: 'State of cluster "bar"',
+      control: { type: 'select' },
+      options: [
+        'Does not exist',
+        'Enabled client updates - v17 cluster',
+        'Enabled client updates - v16 cluster',
+        'Disabled client updates - v17 cluster',
+        'Unreachable',
+      ],
+    },
+    clusterBarSetToManageUpdates: {
+      control: { type: 'boolean' },
+      description: 'Whether cluster "bar" is manually set to control updates',
+    },
+    updateKind: {
+      control: { type: 'radio' },
+      options: ['Upgrade', 'Downgrade'],
+      description:
+        'Indicates whether the update version is newer or older than the current application version.',
+    },
+    step: {
+      control: { type: 'radio' },
+      options: [
+        'Update not available',
+        'Checking for update',
+        'Update available',
+        'Download progress',
+        'Error',
+        'Update downloaded',
+      ],
+      description: 'Updating process step',
+    },
+    platform: {
+      control: { type: 'radio' },
+      options: ['win32', 'darwin', 'linux'],
+      description: 'Operating system',
+    },
+    nonTeleportCdn: {
+      control: { type: 'boolean' },
+      description:
+        'Whether `TELEPORT_CDN_BASE_URL` is set to non-Teleport CDN URL',
+    },
+  },
+  args: {
+    envVar: 'Unset',
+    clusterFoo: 'Enabled client updates - v18 cluster',
+    clusterBar: 'Does not exist',
+    clusterBarSetToManageUpdates: false,
+    updateKind: 'Upgrade',
+    step: 'Update available',
+    platform: 'darwin',
+    nonTeleportCdn: false,
+  },
+};
+
+export default meta;
+
+const context = new MockAppContext();
+context.addRootCluster(makeRootCluster({ uri: '/clusters/foo', name: 'foo' }));
+context.addRootCluster(makeRootCluster({ uri: '/clusters/bar', name: 'bar' }));
+
+async function resolveEvent(storyProps: StoryProps): Promise<AppUpdateEvent> {
+  const status = await resolveAutoUpdatesStatus({
+    versionEnvVar:
+      storyProps.envVar === 'Set to version - v15'
+        ? '15.0.0'
+        : storyProps.envVar === 'Unset'
+          ? undefined
+          : 'off',
+    managingClusterUri: storyProps.clusterBarSetToManageUpdates
+      ? '/clusters/bar'
+      : undefined,
+    getClusterVersions: async () => {
+      const reachableClusters: ClusterVersionInfo[] = [];
+      const unreachableClusters: UnreachableCluster[] = [];
+
+      switch (storyProps.clusterFoo) {
+        case 'Does not exist':
+          break;
+        case 'Enabled client updates - v18 cluster':
+          reachableClusters.push({
+            toolsVersion: '18.0.0',
+            minToolsVersion: '17.0.0-aa',
+            clusterUri: '/clusters/foo',
+            toolsAutoUpdate: true,
+          });
+          break;
+        case 'Enabled client updates - v17 cluster':
+          reachableClusters.push({
+            toolsVersion: '17.0.0',
+            minToolsVersion: '16.0.0-aa',
+            clusterUri: '/clusters/foo',
+            toolsAutoUpdate: true,
+          });
+          break;
+        case 'Disabled client updates - v18 cluster':
+          reachableClusters.push({
+            toolsVersion: '18.0.0',
+            minToolsVersion: '17.0.0-aa',
+            clusterUri: '/clusters/foo',
+            toolsAutoUpdate: false,
+          });
+          break;
+        case 'Unreachable':
+          unreachableClusters.push({
+            clusterUri: '/clusters/foo',
+            errorMessage:
+              'transport: Error while dialing: failed to dial: dial tcp\n' +
+              '192.168.100.39:3080: connect: connection refused',
+          });
+      }
+      switch (storyProps.clusterBar) {
+        case 'Does not exist':
+          break;
+        case 'Enabled client updates - v17 cluster':
+          reachableClusters.push({
+            toolsVersion: '17.0.0',
+            minToolsVersion: '16.0.0-aa',
+            clusterUri: '/clusters/bar',
+            toolsAutoUpdate: true,
+          });
+          break;
+        case 'Enabled client updates - v16 cluster':
+          reachableClusters.push({
+            toolsVersion: '16.0.0',
+            minToolsVersion: '15.0.0-aa',
+            clusterUri: '/clusters/bar',
+            toolsAutoUpdate: true,
+          });
+          break;
+        case 'Disabled client updates - v17 cluster':
+          reachableClusters.push({
+            toolsVersion: '17.0.0',
+            minToolsVersion: '16.0.0-aa',
+            clusterUri: '/clusters/bar',
+            toolsAutoUpdate: false,
+          });
+          break;
+        case 'Unreachable':
+          unreachableClusters.push({
+            clusterUri: '/clusters/bar',
+            errorMessage:
+              'transport: Error while dialing: failed to dial: dial tcp\n' +
+              '192.168.100.39:3080: connect: connection refused',
+          });
+      }
+      return { reachableClusters, unreachableClusters };
+    },
+  });
+
+  const updateInfo = makeUpdateInfo(
+    storyProps.nonTeleportCdn,
+    status.enabled ? status.version : '',
+    storyProps.updateKind === 'Upgrade' ? 'upgrade' : 'downgrade'
+  );
+
+  switch (storyProps.step) {
+    case 'Checking for update':
+      return makeCheckingForUpdateEvent(status);
+    case 'Update not available':
+      return makeUpdateNotAvailableEvent(status);
+    case 'Update available':
+      if (status.enabled) {
+        return makeUpdateAvailableEvent(updateInfo, status);
+      }
+      return;
+    case 'Download progress':
+      if (status.enabled) {
+        return makeDownloadProgressEvent(updateInfo, status);
+      }
+      return;
+    case 'Update downloaded':
+      if (status.enabled) {
+        return makeUpdateDownloadedEvent(updateInfo, status);
+      }
+      return;
+    case 'Error':
+      if (status.enabled) {
+        return makeErrorEvent(updateInfo, status);
+      }
+      return;
+  }
+}
+
+function WidgetAndDetails(storyProps: StoryProps) {
+  const [state, setState] = useState<AppUpdateEvent>();
+  useEffect(() => {
+    resolveEvent(storyProps).then(setState);
+  }, [storyProps]);
+
+  if (!state) {
+    return (
+      <p>
+        This step is only available when controls values allow resolving a
+        client tools version.
+        <br />
+        Storybook does not support showing or hiding controls based on exact
+        values of other controls.
+      </p>
+    );
+  }
+
+  // The two stacks with text should have the same height so that the widget view and the details
+  // view both start at the same point when they're next to each other.
+  const textHeight = '100px';
+
+  return (
+    <Flex rowGap={7} columnGap={10} flexWrap="wrap">
+      <Stack gap={4} maxWidth="432px" alignItems="stretch">
+        <Stack height={textHeight}>
+          <H3>Widget View</H3>
+          <P2>The component is rendered in the login form.</P2>
+          <P2 mt={0}>
+            If nothing is rendered, the widget is hidden in the state described
+            by the story controls.
+          </P2>
+        </Stack>
+        <WidgetView
+          platform={storyProps.platform}
+          updateEvent={state}
+          onMore={() => {}}
+          onDownload={() => {}}
+          onInstall={() => {}}
+        />
+      </Stack>
+      <Stack gap={4} maxWidth="432px">
+        <Stack height={textHeight}>
+          <H3>Details View</H3>
+          <P2>
+            The details can be accessed through the widget if the widget is
+            shown. Otherwise the user can access them through "Check for
+            updates" in the additional actions menu.
+          </P2>
+        </Stack>
+        <DetailsView
+          platform={storyProps.platform}
+          updateEvent={state}
+          changeManagingCluster={() => {}}
+          onCheckForUpdates={() => {}}
+          onDownload={() => {}}
+          onCancelDownload={() => {}}
+          onInstall={() => {}}
+        />
+      </Stack>
+    </Flex>
+  );
+}
+
+export const EnabledWithEnvVar: StoryObj<StoryProps> = {
+  args: {
+    envVar: 'Set to version - v15',
+  },
+};
+
+export const EnabledWithSingleCluster: StoryObj<StoryProps> = {
+  args: {
+    clusterFoo: 'Enabled client updates - v18 cluster',
+  },
+};
+
+export const EnabledWithHighestCompatible: StoryObj<StoryProps> = {
+  args: {
+    clusterFoo: 'Enabled client updates - v17 cluster',
+    clusterBar: 'Enabled client updates - v16 cluster',
+  },
+};
+
+export const EnabledWithManagingCluster: StoryObj<StoryProps> = {
+  args: {
+    clusterFoo: 'Enabled client updates - v17 cluster',
+    clusterBar: 'Enabled client updates - v16 cluster',
+    clusterBarSetToManageUpdates: true,
+  },
+};
+
+export const EnabledWithManagingClusterAndSomeUnreachable: StoryObj<StoryProps> =
+  {
+    args: {
+      clusterFoo: 'Unreachable',
+      clusterBar: 'Enabled client updates - v16 cluster',
+      clusterBarSetToManageUpdates: true,
+    },
+  };
+
+export const DisabledBecauseSingleClusterUnreachable: StoryObj<StoryProps> = {
+  args: {
+    clusterFoo: 'Unreachable',
+    clusterBar: 'Does not exist',
+    step: 'Update not available',
+  },
+};
+export const DisabledBecauseSingleClusterHasNoAutoupdates: StoryObj<StoryProps> =
+  {
+    args: {
+      clusterFoo: 'Disabled client updates - v18 cluster',
+      clusterBar: 'Does not exist',
+      step: 'Update not available',
+    },
+  };
+
+export const DisabledBecauseManagingClusterIsUnreachable: StoryObj<StoryProps> =
+  {
+    args: {
+      clusterFoo: 'Enabled client updates - v17 cluster',
+      clusterBar: 'Unreachable',
+      clusterBarSetToManageUpdates: true,
+      step: 'Update not available',
+    },
+  };
+
+export const DisabledBecauseManagingClusterHasNoAutoupdates: StoryObj<StoryProps> =
+  {
+    args: {
+      clusterFoo: 'Enabled client updates - v17 cluster',
+      clusterBar: 'Disabled client updates - v17 cluster',
+      clusterBarSetToManageUpdates: true,
+      step: 'Update not available',
+    },
+  };
+
+export const DisableBecauseNoClusterManagingUpdates: StoryObj<StoryProps> = {
+  args: {
+    clusterFoo: 'Disabled client updates - v18 cluster',
+    clusterBar: 'Disabled client updates - v17 cluster',
+    step: 'Update not available',
+  },
+};
+
+export const DisabledBecauseClustersRequireIncompatibleVersions: StoryObj<StoryProps> =
+  {
+    args: {
+      clusterFoo: 'Enabled client updates - v18 cluster',
+      clusterBar: 'Enabled client updates - v16 cluster',
+      step: 'Update not available',
+    },
+  };
diff --git a/web/packages/teleterm/src/ui/AppUpdater/AppUpdaterContext.tsx b/web/packages/teleterm/src/ui/AppUpdater/AppUpdaterContext.tsx
new file mode 100644
index 0000000000000..afdf56fe91220
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/AppUpdaterContext.tsx
@@ -0,0 +1,92 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  createContext,
+  PropsWithChildren,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+} from 'react';
+
+import { deserializeError } from 'teleterm/mainProcess/ipcSerializer';
+import { type AppUpdateEvent } from 'teleterm/services/appUpdater';
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+
+interface AppUpdaterContext {
+  updateEvent: AppUpdateEvent;
+  openDialog(): void;
+}
+
+const AppUpdaterContext = createContext<AppUpdaterContext>(null);
+
+export function AppUpdaterContextProvider(props: PropsWithChildren) {
+  const appContext = useAppContext();
+  const [updateEvent, setUpdateEvent] = useState<AppUpdateEvent>({
+    kind: 'checking-for-update',
+  });
+
+  const openDialog = useCallback(() => {
+    appContext.modalsService.openRegularDialog({ kind: 'app-updates' });
+  }, [appContext]);
+
+  useEffect(() => {
+    const { cleanup: cleanUpEvents } =
+      appContext.mainProcessClient.subscribeToAppUpdateEvents(event => {
+        if (event.kind === 'error') {
+          event.error = deserializeError(event.error);
+        }
+        setUpdateEvent(event);
+      });
+    const { cleanup: cleanUpDialog } =
+      appContext.mainProcessClient.subscribeToOpenAppUpdateDialog(openDialog);
+
+    return () => {
+      cleanUpEvents();
+      cleanUpDialog();
+    };
+  }, [appContext, openDialog]);
+
+  const value = useMemo(
+    () => ({
+      updateEvent,
+      openDialog,
+    }),
+    [updateEvent, openDialog]
+  );
+
+  return (
+    <AppUpdaterContext.Provider value={value}>
+      {props.children}
+    </AppUpdaterContext.Provider>
+  );
+}
+
+export const useAppUpdaterContext = () => {
+  const context = useContext(AppUpdaterContext);
+
+  if (!context) {
+    throw new Error(
+      'useAppUpdaterContext must be used within an AppUpdaterContext'
+    );
+  }
+
+  return context;
+};
diff --git a/web/packages/teleterm/src/ui/AppUpdater/AutoUpdatesManagement.tsx b/web/packages/teleterm/src/ui/AppUpdater/AutoUpdatesManagement.tsx
new file mode 100644
index 0000000000000..e5d8fa0e76c5a
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/AutoUpdatesManagement.tsx
@@ -0,0 +1,371 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ReactNode, useState } from 'react';
+
+import { Alert } from 'design/Alert';
+import Flex, { Stack } from 'design/Flex';
+import { Cog } from 'design/Icon';
+import Link from 'design/Link';
+import { RadioGroup } from 'design/RadioGroup';
+import { H3, P3 } from 'design/Text';
+import { pluralize } from 'shared/utils/text';
+
+import {
+  AppUpdateEvent,
+  AutoUpdatesDisabled,
+  AutoUpdatesEnabled,
+  AutoUpdatesStatus,
+} from 'teleterm/services/appUpdater';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
+
+const listFormatter = new Intl.ListFormat('en', {
+  style: 'long',
+  type: 'conjunction',
+});
+
+export function AutoUpdatesManagement(props: {
+  status: AutoUpdatesStatus;
+  updateEventKind: AppUpdateEvent['kind'];
+  changeManagingCluster(clusterUri: RootClusterUri | undefined): void;
+  onCheckForUpdates(): void;
+}) {
+  const { status } = props;
+
+  const content =
+    status.enabled === true
+      ? makeContentForEnabledAutoUpdates(status)
+      : makeContentForDisabledAutoUpdates(status);
+  const retryButton = {
+    content: 'Retry',
+    onClick: props.onCheckForUpdates,
+    disabled: props.updateEventKind === 'download-progress',
+  };
+
+  return (
+    <>
+      {content && (
+        <Alert
+          width="100%"
+          mb={0}
+          icon={content.kind === 'neutral' ? Cog : undefined}
+          kind={content.kind}
+          details={content.description}
+          primaryAction={content.showRetry && retryButton}
+        >
+          {'title' in content ? content.title : ''}
+        </Alert>
+      )}
+      <ManagingClusterSelector
+        autoUpdatesStatus={status}
+        changeManagingCluster={props.changeManagingCluster}
+        isCheckingForUpdates={props.updateEventKind === 'checking-for-update'}
+        onRetry={props.onCheckForUpdates}
+        // Resets localIsAutoManaged checkbox.
+        key={JSON.stringify(status)}
+      />
+    </>
+  );
+}
+
+function ManagingClusterSelector({
+  autoUpdatesStatus,
+  isCheckingForUpdates,
+  changeManagingCluster,
+  onRetry,
+}: {
+  autoUpdatesStatus: AutoUpdatesStatus;
+  isCheckingForUpdates: boolean;
+  changeManagingCluster(clusterUri: RootClusterUri | undefined): void;
+  onRetry(): void;
+}) {
+  // Allows optimistic UI updates without waiting for autoUpdatesStatus.
+  const [optimisticManagingCluster, setOptimisticManagingCluster] = useState<
+    '' | RootClusterUri
+  >(autoUpdatesStatus.options.managingClusterUri || '');
+
+  const options = makeOptions({
+    status: autoUpdatesStatus,
+    disabled: isCheckingForUpdates,
+    highestCompatibleVersion:
+      autoUpdatesStatus.options.highestCompatibleVersion,
+    onRetry,
+  });
+
+  return (
+    <>
+      {/* Two because there is always 'Use highest compatible version' option */}
+      {(options.length > 2 || autoUpdatesStatus.options.managingClusterUri) && (
+        <Stack
+          width="100%"
+          gap={2}
+          p={3}
+          borderRadius={2}
+          css={`
+            background-color: ${p =>
+              p.theme.colors.interactive.tonal.neutral[0]};
+          `}
+        >
+          <Stack gap={0}>
+            <H3>Updates source</H3>
+            <P3>Choose which cluster to follow for updates.</P3>
+          </Stack>
+          <RadioGroup
+            gap={2}
+            name="managingCluster"
+            size="small"
+            value={optimisticManagingCluster}
+            onChange={clusterUri => {
+              setOptimisticManagingCluster(clusterUri);
+              changeManagingCluster(clusterUri || undefined);
+            }}
+            options={options}
+          />
+        </Stack>
+      )}
+    </>
+  );
+}
+
+function makeOptions({
+  status,
+  highestCompatibleVersion,
+  disabled,
+  onRetry,
+}: {
+  status: AutoUpdatesStatus;
+  disabled: boolean;
+  highestCompatibleVersion: string;
+  onRetry(): void;
+}) {
+  const highestCompatible = {
+    label: 'Use the highest compatible version from your clusters',
+    helperText: !highestCompatibleVersion ? (
+      <TextWithWarning text="No cluster provides a version compatible with all other clusters." />
+    ) : (
+      `Teleport Connect ${highestCompatibleVersion} · Compatible with all clusters.`
+    ),
+    disabled: disabled,
+    value: '',
+  };
+
+  const getProfileName = (uri: RootClusterUri) => routing.parseClusterName(uri);
+
+  const candidateClusters = status.options.clusters
+    .filter(c => c.toolsAutoUpdate)
+    .map(c => {
+      const otherCompatibleClusters = c.otherCompatibleClusters.map(c =>
+        getProfileName(c)
+      );
+      const compatibility = otherCompatibleClusters.length
+        ? `Also compatible with ${pluralize(otherCompatibleClusters.length, 'cluster')} ${listFormatter.format(otherCompatibleClusters.toSorted())}.`
+        : '';
+
+      return {
+        disabled,
+        label: getProfileName(c.clusterUri),
+        helperText: [`Teleport Connect ${c.toolsVersion}`, compatibility]
+          .filter(Boolean)
+          .join(' · '),
+        value: c.clusterUri,
+      };
+    });
+
+  const nonCandidateClusters = status.options.clusters
+    .filter(c => !c.toolsAutoUpdate)
+    .map(c => {
+      return {
+        disabled,
+        label: getProfileName(c.clusterUri),
+        helperText: (
+          <>
+            Teleport Connect {c.toolsVersion}
+            <br />
+            <TextWithWarning text="Automatic client tools updates are disabled on this cluster." />
+          </>
+        ),
+        value: c.clusterUri,
+      };
+    });
+
+  const unreachableClusters = status.options.unreachableClusters.map(
+    cluster => ({
+      disabled,
+      label: getProfileName(cluster.clusterUri),
+      helperText: (
+        <UnreachableClusterHelper
+          onRetry={onRetry}
+          error={cluster.errorMessage}
+        />
+      ),
+      value: cluster.clusterUri,
+    })
+  );
+
+  return [
+    highestCompatible,
+    ...candidateClusters,
+    ...nonCandidateClusters,
+    ...unreachableClusters,
+  ];
+}
+
+function TextWithWarning(props: { text: string }) {
+  return (
+    <span>
+      <span
+        css={`
+          color: ${props => props.theme.colors.error.main};
+        `}
+      >
+        ⚠︎︎
+      </span>{' '}
+      {props.text}
+    </span>
+  );
+}
+
+function UnreachableClusterHelper(props: { error: string; onRetry(): void }) {
+  const [showsMore, setShowsMore] = useState(false);
+
+  return (
+    <Stack
+      alignItems="start"
+      justifyContent="space-between"
+      width="100%"
+      gap={0}
+    >
+      <TextWithWarning text="Version unavailable · Cluster is unreachable." />
+      {showsMore ? <span>{props.error}</span> : ''}
+      <Flex gap={1}>
+        {/* These buttons unfortunately trigger hover of the entire radio option */}
+        {/* because they are inside the label element.*/}
+        <Link
+          onClick={e => {
+            e.stopPropagation();
+            e.preventDefault();
+            setShowsMore(v => !v);
+          }}
+        >
+          {showsMore ? 'Show Less' : 'Show More'}
+        </Link>
+        <Link
+          onClick={e => {
+            e.stopPropagation();
+            e.preventDefault();
+            props.onRetry();
+          }}
+        >
+          Retry
+        </Link>
+      </Flex>
+    </Stack>
+  );
+}
+
+function makeContentForEnabledAutoUpdates(status: AutoUpdatesEnabled): {
+  description: string;
+  kind: 'neutral' | 'warning';
+  showRetry?: boolean;
+} {
+  switch (status.source) {
+    case 'env-var':
+      return {
+        kind: 'neutral',
+        description: `The app is set to stay on version ${status.version} by your device settings.`,
+      };
+    case 'managing-cluster':
+      return;
+    case 'highest-compatible':
+      const providingClusters = status.options.clusters
+        .filter(c => c.toolsAutoUpdate && c.toolsVersion === status.version)
+        .map(c => routing.parseClusterName(c.clusterUri));
+      // Show info if there's only one cluster.
+      if (
+        status.options.clusters.length === 1 &&
+        status.options.unreachableClusters.length === 0
+      ) {
+        return {
+          kind: 'neutral',
+          description: `App updates are managed by the cluster ${providingClusters}, which requires client version ${status.version}.`,
+        };
+      }
+  }
+}
+
+function makeContentForDisabledAutoUpdates(updateSource: AutoUpdatesDisabled): {
+  title?: string;
+  description?: ReactNode;
+  kind: 'danger' | 'neutral';
+  showRetry?: boolean;
+} {
+  switch (updateSource.reason) {
+    case 'disabled-by-env-var':
+      return {
+        kind: 'neutral',
+        description: 'App updates are disabled by your device settings.',
+      };
+    case 'no-cluster-with-auto-update':
+      // There's only one cluster and it's unreachable, show error inline.
+      if (
+        updateSource.options.unreachableClusters.length === 1 &&
+        updateSource.options.clusters.length === 0
+      ) {
+        return {
+          kind: 'danger',
+          title: 'App updates are disabled, the cluster is unreachable',
+          description:
+            updateSource.options.unreachableClusters.at(0).errorMessage,
+          showRetry: true,
+        };
+      }
+      // There is no cluster with updates enabled and some clusters cannot be reached.
+      if (updateSource.options.unreachableClusters.length > 1) {
+        return {
+          kind: 'danger',
+          title: 'App updates are disabled.',
+        };
+      }
+      // All clusters have updates disabled.
+      return {
+        kind: 'neutral',
+        title: 'App updates are disabled',
+        description: (
+          <>
+            The cluster needs to{' '}
+            <Link href="https://goteleport.com/docs/upgrading/automatic-updates">
+              enroll in automatic updates
+            </Link>{' '}
+            to keep Teleport Connect updated.
+          </>
+        ),
+      };
+    case 'managing-cluster-unable-to-manage':
+      return {
+        kind: 'danger',
+        title: 'App updates are disabled.',
+      };
+    case 'no-compatible-version':
+      return {
+        kind: 'danger',
+        title: 'App updates are disabled',
+        description:
+          'Your clusters require incompatible client versions. To enable app updates, select which cluster should manage them.',
+      };
+  }
+}
diff --git a/web/packages/teleterm/src/ui/AppUpdater/DetailsView.test.tsx b/web/packages/teleterm/src/ui/AppUpdater/DetailsView.test.tsx
new file mode 100644
index 0000000000000..7463166dcdf8d
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/DetailsView.test.tsx
@@ -0,0 +1,132 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, userEvent } from 'design/utils/testing';
+
+import { DetailsView } from './DetailsView';
+import {
+  makeUpdateAvailableEvent,
+  makeUpdateInfo,
+  makeUpdateNotAvailableEvent,
+} from './testHelpers';
+
+test('download button is available when autoDownload is false', async () => {
+  render(
+    <DetailsView
+      updateEvent={makeUpdateAvailableEvent(
+        makeUpdateInfo(false, '18.0.0', 'upgrade'),
+        {
+          enabled: true,
+          version: '18.0.0',
+          source: 'highest-compatible',
+          options: {
+            highestCompatibleVersion: '18.0.0',
+            managingClusterUri: undefined,
+            clusters: [
+              {
+                clusterUri: '/cluster/bar',
+                toolsAutoUpdate: true,
+                toolsVersion: '18.0.0',
+                minToolsVersion: '17.0.0-aa',
+                otherCompatibleClusters: [],
+              },
+            ],
+            unreachableClusters: [
+              { clusterUri: '/clusters/foo', errorMessage: 'NET_ERR' },
+            ],
+          },
+        }
+      )}
+      platform="darwin"
+      onCheckForUpdates={() => {}}
+      onDownload={() => {}}
+      onCancelDownload={() => {}}
+      onInstall={() => {}}
+      changeManagingCluster={() => {}}
+    />
+  );
+  expect(
+    await screen.findByRole('button', { name: 'Download' })
+  ).toBeInTheDocument();
+});
+
+test('when there are multiple clusters available, managing cluster can be selected', async () => {
+  const changeManagingClusterSpy = jest.fn();
+  render(
+    <DetailsView
+      updateEvent={makeUpdateNotAvailableEvent({
+        enabled: false,
+        reason: 'no-compatible-version',
+        options: {
+          highestCompatibleVersion: undefined,
+          managingClusterUri: undefined,
+          clusters: [
+            {
+              clusterUri: '/clusters/foo',
+              toolsAutoUpdate: true,
+              toolsVersion: '16.0.0',
+              minToolsVersion: '15.0.0-aa',
+              otherCompatibleClusters: [],
+            },
+            {
+              clusterUri: '/clusters/bar',
+              toolsAutoUpdate: false,
+              toolsVersion: '18.0.0',
+              minToolsVersion: '17.0.0-aa',
+              otherCompatibleClusters: [],
+            },
+          ],
+          unreachableClusters: [
+            { clusterUri: '/clusters/baz', errorMessage: 'NET_ERR' },
+          ],
+        },
+      })}
+      platform="darwin"
+      onCheckForUpdates={() => {}}
+      onDownload={() => {}}
+      onCancelDownload={() => {}}
+      onInstall={() => {}}
+      changeManagingCluster={changeManagingClusterSpy}
+    />
+  );
+  expect(
+    await screen.findByText(
+      'Your clusters require incompatible client versions. To enable app updates, select which cluster should manage them.'
+    )
+  ).toBeInTheDocument();
+
+  const radioOptions = await screen.findAllByRole('radio');
+  expect(radioOptions).toHaveLength(4);
+
+  expect(radioOptions.at(0).closest('label')).toHaveTextContent(
+    // The cluster name and the helper text are normally in separate lines.
+    'Use the highest compatible version from your clusters⚠︎︎ No cluster provides a version compatible with all other clusters.'
+  );
+  expect(radioOptions.at(1).closest('label')).toHaveTextContent(
+    'fooTeleport Connect 16.0.0'
+  );
+  expect(radioOptions.at(2).closest('label')).toHaveTextContent(
+    'barTeleport Connect 18.0.0⚠︎︎ Automatic client tools updates are disabled on this cluster.'
+  );
+  expect(radioOptions.at(3).closest('label')).toHaveTextContent(
+    'baz⚠︎︎ Version unavailable · Cluster is unreachable.Show MoreRetry'
+  );
+
+  await userEvent.click(radioOptions.at(1));
+  expect(changeManagingClusterSpy).toHaveBeenCalledWith('/clusters/foo');
+});
diff --git a/web/packages/teleterm/src/ui/AppUpdater/DetailsView.tsx b/web/packages/teleterm/src/ui/AppUpdater/DetailsView.tsx
new file mode 100644
index 0000000000000..5ec25193f894e
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/DetailsView.tsx
@@ -0,0 +1,282 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useId, useState } from 'react';
+
+import {
+  Alert,
+  ButtonPrimary,
+  ButtonSecondary,
+  Flex,
+  Indicator,
+  Link,
+  P2,
+  P3,
+  Stack,
+  Text,
+} from 'design';
+import { Checks, Info } from 'design/Icon';
+
+import { Platform } from 'teleterm/mainProcess/types';
+import { AppUpdateEvent, UpdateInfo } from 'teleterm/services/appUpdater';
+import { UnsupportedVersionError } from 'teleterm/services/appUpdater/errors';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+import { AutoUpdatesManagement } from './AutoUpdatesManagement';
+import {
+  formatMB,
+  iconMac,
+  iconWinLinux,
+  isTeleportDownloadHost,
+} from './common';
+
+/**
+ * Detailed updates view.
+ * The details can be accessed through the widget if the widget is
+ * shown.
+ * Otherwise, the user can access them through "Check for
+ * updates" in the additional actions menu.
+ */
+export function DetailsView({
+  changeManagingCluster,
+  updateEvent,
+  platform,
+  onCheckForUpdates,
+  onDownload,
+  onCancelDownload,
+  onInstall,
+}: {
+  updateEvent: AppUpdateEvent;
+  platform: Platform;
+  onCheckForUpdates(): void;
+  onInstall(): void;
+  onDownload(): void;
+  onCancelDownload(): void;
+  changeManagingCluster(clusterUri: RootClusterUri | undefined): void;
+}) {
+  return (
+    <Stack gap={3} width="100%">
+      {updateEvent.autoUpdatesStatus && (
+        <AutoUpdatesManagement
+          status={updateEvent.autoUpdatesStatus}
+          updateEventKind={updateEvent.kind}
+          onCheckForUpdates={onCheckForUpdates}
+          changeManagingCluster={changeManagingCluster}
+        />
+      )}
+      <UpdaterState
+        event={updateEvent}
+        platform={platform}
+        onCheckForAppUpdates={onCheckForUpdates}
+        onDownload={onDownload}
+        onCancelDownload={onCancelDownload}
+        onInstall={onInstall}
+        key={JSON.stringify(updateEvent)}
+      />
+    </Stack>
+  );
+}
+
+function UpdaterState({
+  event,
+  platform,
+  onCheckForAppUpdates,
+  onDownload,
+  onCancelDownload,
+  onInstall,
+}: {
+  event: AppUpdateEvent;
+  platform: Platform;
+  onCheckForAppUpdates(): void;
+  onDownload(): void;
+  onCancelDownload(): void;
+  onInstall(): void;
+}) {
+  const [downloadStarted, setDownloadStarted] = useState(false);
+  switch (event.kind) {
+    case 'checking-for-update':
+      return (
+        <Stack gap={3} width="100%">
+          <Flex gap={1} alignItems="center">
+            <Indicator mb={-1} size="medium" delay="none" />
+            <P2>Checking for updates…</P2>
+          </Flex>
+          <ButtonPrimary block disabled onClick={() => onCheckForAppUpdates()}>
+            Check For Updates
+          </ButtonPrimary>
+        </Stack>
+      );
+    case 'update-available':
+      return (
+        <Stack gap={3} width="100%">
+          <AvailableUpdate update={event.update} platform={platform} />
+          {event.autoDownload || downloadStarted ? (
+            <ButtonSecondary disabled block>
+              Starting Download…
+            </ButtonSecondary>
+          ) : (
+            <ButtonSecondary
+              block
+              onClick={() => {
+                setDownloadStarted(true);
+                onDownload();
+              }}
+            >
+              Download
+            </ButtonSecondary>
+          )}
+        </Stack>
+      );
+    case 'update-not-available':
+      return (
+        <Stack gap={3} width="100%">
+          {event.autoUpdatesStatus.enabled && (
+            <Flex gap={1}>
+              <Checks color="success.main" size="medium" />
+              <P2>Teleport Connect is up to date.</P2>
+            </Flex>
+          )}
+          <ButtonSecondary
+            block
+            disabled={!event.autoUpdatesStatus.enabled}
+            onClick={() => {
+              onCheckForAppUpdates();
+            }}
+          >
+            Check For Updates
+          </ButtonSecondary>
+        </Stack>
+      );
+    case 'error':
+      return (
+        <Stack gap={3} width="100%">
+          {event.update && (
+            <AvailableUpdate update={event.update} platform={platform} />
+          )}
+          <Alert mb={1} details={event.error.message} width="100%">
+            {event.update
+              ? 'Update failed'
+              : event.error.name === UnsupportedVersionError.name
+                ? 'Incompatible managed update version'
+                : 'Unable to check for app updates'}
+          </Alert>
+          <ButtonSecondary block onClick={onCheckForAppUpdates}>
+            Try Again
+          </ButtonSecondary>
+        </Stack>
+      );
+    case 'download-progress':
+      return (
+        <Stack gap={3} width="100%">
+          <Stack width="100%">
+            <AvailableUpdate update={event.update} platform={platform} />
+            <Progress
+              progressPercent={event.progress.percent}
+              label={`Downloaded ${formatMB(event.progress.transferred)} of ${formatMB(event.progress.total)}`}
+            />
+          </Stack>
+          <ButtonSecondary block onClick={onCancelDownload}>
+            Cancel
+          </ButtonSecondary>
+        </Stack>
+      );
+    case 'update-downloaded':
+      const label =
+        platform === 'darwin'
+          ? 'Ready to install'
+          : 'Ready to install. Admin permissions may be required.';
+      return (
+        <Stack gap={3} width="100%">
+          <Stack width="100%">
+            <AvailableUpdate update={event.update} platform={platform} />
+            <Progress progressPercent={100} label={label} />
+          </Stack>
+          <ButtonPrimary block onClick={onInstall}>
+            Restart
+          </ButtonPrimary>
+        </Stack>
+      );
+  }
+}
+
+function AvailableUpdate(props: { update: UpdateInfo; platform: Platform }) {
+  const downloadHost = new URL(props.update.files.at(0).url).host;
+  const isOfficialServer = isTeleportDownloadHost(downloadHost);
+
+  return (
+    <Stack>
+      <Text>
+        {props.update.updateKind === 'upgrade'
+          ? 'A new version is available.'
+          : 'The app needs to be downgraded to match the required version.'}
+      </Text>
+      <Flex gap={1} alignItems="center">
+        {props.platform === 'darwin' ? (
+          <img alt="App icon" height="50px" src={iconMac} />
+        ) : (
+          <img
+            alt="App icon"
+            height="43px"
+            style={{ marginRight: '4px' }}
+            src={iconWinLinux}
+          />
+        )}
+        <Stack gap={0}>
+          <Text bold>Teleport Connect {props.update.version}</Text>
+          <P3 color="text.slightlyMuted">
+            <Link
+              target="_blank"
+              href={`https://github.com/gravitational/teleport/releases/tag/v${props.update.version}`}
+              css={`
+                display: inline-flex;
+                gap: 3px;
+              `}
+            >
+              Release notes
+            </Link>
+          </P3>
+        </Stack>
+      </Flex>
+      <P3 m={0} color="text.slightlyMuted">
+        {!isOfficialServer && (
+          <Flex gap={1} mt={1}>
+            <Info size="small" />
+            Using {downloadHost} as the update server.
+          </Flex>
+        )}
+      </P3>
+    </Stack>
+  );
+}
+
+function Progress(props: { progressPercent: number; label: string }) {
+  const labelId = useId();
+  return (
+    <Stack gap={0} width="100%">
+      <progress
+        style={{ width: '100%' }}
+        aria-labelledby={labelId}
+        value={props.progressPercent}
+        max="100"
+      />
+      <P3 id={labelId} color="text.slightlyMuted">
+        {props.label}
+      </P3>
+    </Stack>
+  );
+}
diff --git a/web/packages/teleterm/src/ui/AppUpdater/WidgetView.test.tsx b/web/packages/teleterm/src/ui/AppUpdater/WidgetView.test.tsx
new file mode 100644
index 0000000000000..eea2388d72a2c
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/WidgetView.test.tsx
@@ -0,0 +1,112 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { render, screen } from 'design/utils/testing';
+
+import {
+  makeUpdateAvailableEvent,
+  makeUpdateInfo,
+  makeUpdateNotAvailableEvent,
+} from './testHelpers';
+import { WidgetView } from './WidgetView';
+
+test('download button is available when autoDownload is false', async () => {
+  render(
+    <WidgetView
+      updateEvent={makeUpdateAvailableEvent(
+        makeUpdateInfo(false, '18.0.0', 'upgrade'),
+        {
+          enabled: true,
+          version: '18.0.0',
+          source: 'highest-compatible',
+          options: {
+            highestCompatibleVersion: '18.0.0',
+            managingClusterUri: undefined,
+            clusters: [
+              {
+                clusterUri: '/cluster/bar',
+                toolsAutoUpdate: true,
+                toolsVersion: '18.0.0',
+                minToolsVersion: '17.0.0-aa',
+                otherCompatibleClusters: [],
+              },
+            ],
+            unreachableClusters: [
+              { clusterUri: '/clusters/foo', errorMessage: 'NET_ERR' },
+            ],
+          },
+        }
+      )}
+      platform="darwin"
+      onDownload={() => {}}
+      onMore={() => {}}
+      onInstall={() => {}}
+    />
+  );
+
+  expect(
+    await screen.findByRole('button', { name: 'Download' })
+  ).toBeInTheDocument();
+});
+
+test('error is displayed when cluster specify incompatible versions', async () => {
+  render(
+    <WidgetView
+      updateEvent={makeUpdateNotAvailableEvent({
+        enabled: false,
+        reason: 'no-compatible-version',
+        options: {
+          highestCompatibleVersion: undefined,
+          managingClusterUri: undefined,
+          clusters: [
+            {
+              clusterUri: '/cluster/foo',
+              toolsAutoUpdate: true,
+              toolsVersion: '16.0.0',
+              minToolsVersion: '15.0.0-aa',
+              otherCompatibleClusters: [],
+            },
+            {
+              clusterUri: '/cluster/bar',
+              toolsAutoUpdate: true,
+              toolsVersion: '18.0.0',
+              minToolsVersion: '17.0.0-aa',
+              otherCompatibleClusters: [],
+            },
+          ],
+          unreachableClusters: [],
+        },
+      })}
+      platform="darwin"
+      onDownload={() => {}}
+      onMore={() => {}}
+      onInstall={() => {}}
+    />
+  );
+  expect(
+    await screen.findByText('App updates are disabled')
+  ).toBeInTheDocument();
+  expect(
+    await screen.findByText(
+      'Your clusters require incompatible client versions. Choose one to enable app updates.'
+    )
+  ).toBeInTheDocument();
+  expect(
+    await screen.findByRole('button', { name: 'Resolve' })
+  ).toBeInTheDocument();
+});
diff --git a/web/packages/teleterm/src/ui/AppUpdater/WidgetView.tsx b/web/packages/teleterm/src/ui/AppUpdater/WidgetView.tsx
new file mode 100644
index 0000000000000..ab5db79d2555a
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/WidgetView.tsx
@@ -0,0 +1,337 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ComponentType } from 'react';
+
+import {
+  ButtonBorder,
+  ButtonPrimary,
+  ButtonSecondary,
+  Flex,
+  P3,
+  Stack,
+  Text,
+} from 'design';
+import { Alert } from 'design/Alert';
+import { Info } from 'design/Icon';
+import { IconProps } from 'design/Icon/Icon';
+import { SpaceProps } from 'design/system';
+import { UnreachableCluster } from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+
+import { Platform } from 'teleterm/mainProcess/types';
+import {
+  AppUpdateEvent,
+  AutoUpdatesStatus,
+} from 'teleterm/services/appUpdater';
+import { UnsupportedVersionError } from 'teleterm/services/appUpdater/errors';
+import { routing } from 'teleterm/ui/uri';
+
+import {
+  formatMB,
+  getDownloadHost,
+  iconMac,
+  iconWinLinux,
+  isTeleportDownloadHost,
+  makeUnreachableClusterText,
+} from './common';
+
+/**
+ * App updates widget.
+ * The component is rendered in the login form.
+ *
+ * Hidden for `update-not-available` and `checking-for-update` events,
+ * unless there's an issue that prevents autoupdates from working.
+ */
+export function WidgetView({
+  onDownload,
+  onInstall,
+  onMore,
+  platform,
+  updateEvent,
+  ...rest
+}: {
+  updateEvent: AppUpdateEvent;
+  platform: Platform;
+  onMore(): void;
+  onDownload(): void;
+  onInstall(): void;
+} & SpaceProps) {
+  const { autoUpdatesStatus } = updateEvent;
+
+  const issueRequiringAttention =
+    autoUpdatesStatus &&
+    findAutoUpdatesIssuesRequiringAttention(autoUpdatesStatus);
+
+  if (issueRequiringAttention) {
+    return (
+      <Alert
+        kind="danger"
+        mb={0}
+        {...rest}
+        details={
+          <Stack gap={2}>
+            {issueRequiringAttention}
+            {/*TODO(gzdunek): Allow Alert to show buttons at the bottom. */}
+            <ButtonBorder onClick={onMore}>Resolve</ButtonBorder>
+          </Stack>
+        }
+      >
+        App updates are disabled
+      </Alert>
+    );
+  }
+
+  // If an error occurred when there was no update info, return early.
+  if (updateEvent.kind === 'error' && !updateEvent.update) {
+    return (
+      <Alert
+        kind="danger"
+        mb={0}
+        {...rest}
+        details={
+          <Stack gap={2}>
+            {updateEvent.error.message}
+            {/*TODO(gzdunek): Allow Alert to show buttons at the bottom. */}
+            <ButtonBorder onClick={onMore}>More</ButtonBorder>
+          </Stack>
+        }
+      >
+        {updateEvent.error.name === UnsupportedVersionError.name
+          ? 'Incompatible managed update version'
+          : 'Unable to check for app updates'}
+      </Alert>
+    );
+  }
+
+  if (
+    updateEvent.kind === 'checking-for-update' ||
+    updateEvent.kind === 'update-not-available'
+  ) {
+    return;
+  }
+
+  const { description, button } = makeUpdaterContent({
+    updateEvent,
+    onDownload,
+    onInstall,
+  });
+
+  const unreachableClusters =
+    // It's important only when the highest compatible version was found.
+    updateEvent.autoUpdatesStatus.source === 'highest-compatible'
+      ? updateEvent.autoUpdatesStatus.options.unreachableClusters
+      : [];
+  const downloadBaseUrl = getDownloadHost(updateEvent);
+
+  return (
+    <AvailableUpdate
+      version={updateEvent.update.version}
+      platform={platform}
+      description={description}
+      unreachableClusters={unreachableClusters}
+      downloadHost={downloadBaseUrl}
+      onMore={onMore}
+      primaryButton={
+        button ? { name: button.name, onClick: button.action } : undefined
+      }
+      {...rest}
+    />
+  );
+}
+
+function AvailableUpdate({
+  description,
+  downloadHost,
+  onMore,
+  platform,
+  primaryButton,
+  unreachableClusters,
+  version,
+  ...rest
+}: {
+  version: string;
+  description: string;
+  unreachableClusters: UnreachableCluster[];
+  downloadHost: string;
+  platform: Platform;
+  onMore(): void;
+  primaryButton?: {
+    name: string;
+    onClick(): void;
+  };
+} & SpaceProps) {
+  const hasUnreachableClusters = !!unreachableClusters.length;
+  const isNonTeleportServer =
+    downloadHost && !isTeleportDownloadHost(downloadHost);
+
+  return (
+    // Mimics a neutral alert.
+    <Stack
+      justifyContent="space-between"
+      gap={1}
+      css={`
+        border: 1px solid ${props => props.theme.colors.text.disabled};
+        background: ${props => props.theme.colors.interactive.tonal.neutral[0]};
+      `}
+      borderRadius={3}
+      px={3}
+      py="12px"
+      {...rest}
+    >
+      <Flex width="100%" alignItems="center" justifyContent="space-between">
+        <Flex gap={1} alignItems="center" width="100%">
+          {platform === 'darwin' ? (
+            <img alt="App icon" height="50px" src={iconMac} />
+          ) : (
+            <img
+              alt="App icon"
+              height="43px"
+              style={{ marginRight: '4px' }}
+              src={iconWinLinux}
+            />
+          )}
+          <Stack gap={0}>
+            <Text bold>Teleport Connect {version}</Text>
+            <P3>{description}</P3>
+          </Stack>
+        </Flex>
+        <Flex gap={2}>
+          {primaryButton && (
+            <ButtonPrimary size="small" onClick={primaryButton.onClick}>
+              {primaryButton.name}
+            </ButtonPrimary>
+          )}
+          <ButtonSecondary size="small" onClick={onMore}>
+            More
+          </ButtonSecondary>
+        </Flex>
+      </Flex>
+      {(hasUnreachableClusters || isNonTeleportServer) && (
+        <Stack ml={1}>
+          {hasUnreachableClusters && (
+            <IconAndText
+              Icon={Info}
+              text="Unable to retrieve accepted client versions from some clusters."
+            />
+          )}
+          {isNonTeleportServer && (
+            <IconAndText
+              Icon={Info}
+              text={`Using ${downloadHost} as the update server.`}
+            />
+          )}
+        </Stack>
+      )}
+    </Stack>
+  );
+}
+
+function IconAndText(props: { Icon: ComponentType<IconProps>; text: string }) {
+  return (
+    <Flex gap={1} color="text.slightlyMuted" alignItems="start">
+      <props.Icon size="small" />
+      <P3
+        css={`
+          line-height: normal;
+        `}
+      >
+        {props.text}
+      </P3>
+    </Flex>
+  );
+}
+
+function makeUpdaterContent({
+  updateEvent,
+  onInstall,
+  onDownload,
+}: {
+  updateEvent: AppUpdateEvent;
+  onDownload(): void;
+  onInstall(): void;
+}): {
+  description: string;
+  button?: {
+    name: string;
+    action(): void;
+  };
+} {
+  switch (updateEvent.kind) {
+    case 'download-progress':
+      return {
+        description: `Downloaded ${formatMB(updateEvent.progress.transferred)} of ${formatMB(updateEvent.progress.total)}`,
+      };
+    case 'update-available':
+      const { updateKind } = updateEvent.update;
+      if (updateEvent.autoDownload) {
+        return {
+          description:
+            updateKind === 'upgrade'
+              ? 'Update available. Starting download…'
+              : 'Downloading required version…',
+        };
+      }
+
+      return {
+        description:
+          updateKind === 'upgrade'
+            ? 'Update available'
+            : 'Downgrade to required version',
+        button: {
+          name: 'Download',
+          action: onDownload,
+        },
+      };
+    case 'update-downloaded':
+      return {
+        description: 'Ready to install',
+        button: {
+          name: 'Restart',
+          action: onInstall,
+        },
+      };
+    case 'error':
+      return {
+        description: 'Update failed',
+      };
+  }
+}
+
+/** Returns issues that need to be resolved to make autoupdates work. */
+function findAutoUpdatesIssuesRequiringAttention(
+  status: AutoUpdatesStatus
+): string | undefined {
+  if (status.enabled === false && status.reason === 'no-compatible-version') {
+    return 'Your clusters require incompatible client versions. Choose one to enable app updates.';
+  }
+
+  if (
+    status.enabled === false &&
+    status.reason === 'managing-cluster-unable-to-manage'
+  ) {
+    return `The cluster ${routing.parseClusterName(status.options.managingClusterUri)} was chosen to manage updates but is not able to provide them.`;
+  }
+
+  if (
+    status.enabled === false &&
+    status.reason === 'no-cluster-with-auto-update' &&
+    status.options.unreachableClusters.length
+  ) {
+    return makeUnreachableClusterText(status.options.unreachableClusters);
+  }
+}
diff --git a/web/packages/teleterm/src/ui/AppUpdater/common.ts b/web/packages/teleterm/src/ui/AppUpdater/common.ts
new file mode 100644
index 0000000000000..0d0291cccfc50
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/common.ts
@@ -0,0 +1,65 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { UnreachableCluster } from 'gen-proto-ts/teleport/lib/teleterm/auto_update/v1/auto_update_service_pb';
+import { pluralize } from 'shared/utils/text';
+
+import { AppUpdateEvent } from 'teleterm/services/appUpdater';
+import { routing } from 'teleterm/ui/uri';
+
+import iconWinLinux from '../../../build_resources/icon-linux/512x512.png';
+import iconMac from '../../../build_resources/icon-mac.png';
+
+export { iconMac, iconWinLinux };
+
+export function formatMB(bytes: number): string {
+  const mb = bytes / (1024 * 1024);
+  return `${mb.toFixed(2)} MB`;
+}
+
+export function getDownloadHost(event: AppUpdateEvent): string {
+  switch (event.kind) {
+    case 'update-available':
+    case 'download-progress':
+    case 'update-downloaded':
+    case 'error':
+      const url = event.update?.files?.at(0)?.url;
+      return url && new URL(url).host;
+    default:
+      return '';
+  }
+}
+
+export function isTeleportDownloadHost(host: string): boolean {
+  return host === 'cdn.teleport.dev';
+}
+
+const listFormatter = new Intl.ListFormat('en', {
+  style: 'long',
+  type: 'conjunction',
+});
+
+export function makeUnreachableClusterText(
+  unreachableClusters: UnreachableCluster[]
+) {
+  return (
+    `Unable to retrieve accepted client versions` +
+    ` from the ${pluralize(unreachableClusters.length, 'cluster')}` +
+    ` ${listFormatter.format(unreachableClusters.map(c => routing.parseClusterName(c.clusterUri)))}.`
+  );
+}
diff --git a/web/packages/teleterm/src/ui/AppUpdater/index.ts b/web/packages/teleterm/src/ui/AppUpdater/index.ts
new file mode 100644
index 0000000000000..25b472fb51672
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/index.ts
@@ -0,0 +1,21 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+export * from './DetailsView';
+export * from './WidgetView';
+export * from './AppUpdaterContext';
diff --git a/web/packages/teleterm/src/ui/AppUpdater/testHelpers.ts b/web/packages/teleterm/src/ui/AppUpdater/testHelpers.ts
new file mode 100644
index 0000000000000..69f7e67b1b3fc
--- /dev/null
+++ b/web/packages/teleterm/src/ui/AppUpdater/testHelpers.ts
@@ -0,0 +1,119 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  AppUpdateEvent,
+  AutoUpdatesEnabled,
+  AutoUpdatesStatus,
+  UpdateInfo,
+} from 'teleterm/services/appUpdater';
+import { shouldAutoDownload } from 'teleterm/services/appUpdater/autoUpdatesStatus';
+
+export function makeUpdateInfo(
+  nonTeleportCdn: boolean,
+  version: string,
+  updateKind: 'upgrade' | 'downgrade'
+): UpdateInfo {
+  return {
+    files: [
+      {
+        url: nonTeleportCdn
+          ? 'https://custom-hosting.local/Teleport%20Connect-mac.zip'
+          : 'https://cdn.teleport.dev/Teleport%20Connect-mac.zip',
+        sha512: '',
+        size: 123214312,
+      },
+    ],
+    releaseDate: '',
+    updateKind,
+    version,
+    path: '',
+    sha512: '',
+  };
+}
+
+export function makeUpdateNotAvailableEvent(
+  status: AutoUpdatesStatus
+): AppUpdateEvent {
+  return {
+    kind: 'update-not-available',
+    autoUpdatesStatus: status,
+  };
+}
+
+export function makeCheckingForUpdateEvent(
+  status?: AutoUpdatesStatus
+): AppUpdateEvent {
+  return {
+    kind: 'checking-for-update',
+    autoUpdatesStatus: status,
+  };
+}
+
+export function makeUpdateAvailableEvent(
+  updateInfo: UpdateInfo,
+  status: AutoUpdatesEnabled
+): AppUpdateEvent {
+  return {
+    kind: 'update-available',
+    update: updateInfo,
+    autoDownload: shouldAutoDownload(status),
+    autoUpdatesStatus: status,
+  };
+}
+
+export function makeDownloadProgressEvent(
+  updateInfo: UpdateInfo,
+  status: AutoUpdatesEnabled
+): AppUpdateEvent {
+  return {
+    kind: 'download-progress',
+    progress: {
+      total: 123214312,
+      transferred: 4322432,
+      percent: 12,
+      delta: 1,
+      bytesPerSecond: 12333,
+    },
+    update: updateInfo,
+    autoUpdatesStatus: status,
+  };
+}
+
+export function makeErrorEvent(
+  updateInfo: UpdateInfo,
+  status: AutoUpdatesEnabled
+): AppUpdateEvent {
+  return {
+    kind: 'error',
+    error: new Error('No permissions'),
+    update: updateInfo,
+    autoUpdatesStatus: status,
+  };
+}
+
+export function makeUpdateDownloadedEvent(
+  updateInfo: UpdateInfo,
+  status: AutoUpdatesEnabled
+): AppUpdateEvent {
+  return {
+    kind: 'update-downloaded',
+    update: updateInfo,
+    autoUpdatesStatus: status,
+  };
+}
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.story.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.story.tsx
index d1b0d6a5d379f..a4b1563b20eca 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.story.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.story.tsx
@@ -85,7 +85,7 @@ function getMockAppContext(
   } = {}
 ) {
   const appContext = new MockAppContext();
-  appContext.clustersService.addRootCluster =
+  appContext.mockMainProcessClient.addCluster =
     args.addRootCluster || (() => Promise.resolve(makeRootCluster()));
   return appContext;
 }
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.tsx
index e2d6303bb7313..7c62b012a0b52 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterAdd/ClusterAdd.tsx
@@ -35,12 +35,11 @@ export function ClusterAdd(props: {
   onSuccess(clusterUri: string): void;
   prefill: { clusterAddress: string };
 }) {
-  const { clustersService, workspacesService } = useAppContext();
+  const { mainProcessClient } = useAppContext();
   const [{ status, statusText }, addCluster] = useAsync(
     async (addr: string) => {
       const proxyAddr = parseClusterProxyWebAddr(addr);
-      const cluster = await clustersService.addRootCluster(proxyAddr);
-      workspacesService.addWorkspace(cluster.uri);
+      const cluster = await mainProcessClient.addCluster(proxyAddr);
       return props.onSuccess(cluster.uri);
     }
   );
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.story.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.story.tsx
index b6c44d7472128..e29d668944984 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.story.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.story.tsx
@@ -15,7 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { makeErrorAttempt, makeProcessingAttempt } from 'shared/hooks/useAsync';
 
@@ -32,6 +32,7 @@ const meta: Meta<StoryProps> = {
   argTypes: compatibilityArgType,
   args: {
     compatibility: 'compatible',
+    showUpdate: true,
   },
 };
 export default meta;
@@ -130,7 +131,18 @@ export const SsoOnly = (storyProps: StoryProps) => {
 export const SsoPrompt = (storyProps: StoryProps) => {
   const props = makeProps(storyProps);
   props.loginAttempt.status = 'processing';
-  props.shouldPromptSsoStatus = true;
+  props.ssoPrompt = 'follow-browser-steps';
+  return (
+    <TestContainer>
+      <ClusterLoginPresentation {...props} />
+    </TestContainer>
+  );
+};
+
+export const SsoPromptWaitForSync = (storyProps: StoryProps) => {
+  const props = makeProps(storyProps);
+  props.loginAttempt.status = 'processing';
+  props.ssoPrompt = 'wait-for-sync';
   return (
     <TestContainer>
       <ClusterLoginPresentation {...props} />
@@ -154,15 +166,19 @@ export const SsoError = (storyProps: StoryProps) => {
 };
 
 export const LocalWithPasswordless = (storyProps: StoryProps) => {
+  const props = makeProps(storyProps);
+  props.initAttempt.data.allowPasswordless = true;
+
   return (
     <TestContainer>
-      <ClusterLoginPresentation {...makeProps(storyProps)} />
+      <ClusterLoginPresentation {...props} />
     </TestContainer>
   );
 };
 
 export const LocalLoggedInUserWithPasswordless = (storyProps: StoryProps) => {
   const props = makeProps(storyProps);
+  props.initAttempt.data.allowPasswordless = true;
   props.loggedInUserName = 'llama';
 
   return (
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.test.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.test.tsx
new file mode 100644
index 0000000000000..1d773d5706f95
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.test.tsx
@@ -0,0 +1,210 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import userEvent from '@testing-library/user-event';
+import { act } from 'react';
+
+import { render, screen } from 'design/utils/testing';
+import { ClientVersionStatus } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
+
+import { TshdClient } from 'teleterm/services/tshd';
+import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
+import {
+  makeAuthSettings,
+  makeRootCluster,
+} from 'teleterm/services/tshd/testHelpers';
+import { AppUpdaterContextProvider } from 'teleterm/ui/AppUpdater';
+import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
+import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+
+import { ClusterLogin } from './ClusterLogin';
+
+it('keeps the focus on the password field on submission error', async () => {
+  const user = userEvent.setup();
+  const cluster = makeRootCluster();
+  const appContext = new MockAppContext();
+  appContext.addRootCluster(cluster);
+
+  jest
+    .spyOn(appContext.tshd, 'login')
+    .mockResolvedValue(
+      new MockedUnaryCall(undefined, new Error('whoops something went wrong'))
+    );
+
+  render(
+    <MockAppContextProvider appContext={appContext}>
+      <AppUpdaterContextProvider>
+        <ClusterLogin
+          clusterUri={cluster.uri}
+          onCancel={() => {}}
+          prefill={{ username: 'alice' }}
+          reason={undefined}
+        />
+      </AppUpdaterContextProvider>
+    </MockAppContextProvider>
+  );
+
+  const passwordField = await screen.findByLabelText('Password');
+  expect(passwordField).toHaveFocus();
+
+  await user.type(passwordField, 'foo');
+  await user.click(screen.getByText('Sign In'));
+
+  await screen.findByText('whoops something went wrong');
+  expect(passwordField).toHaveFocus();
+});
+
+it('shows go to updates button in compatibility warning if there are clusters providing updates', async () => {
+  const clusterFoo = makeRootCluster({ uri: '/clusters/foo' });
+  const clusterBar = makeRootCluster({ uri: '/clusters/bar' });
+  const appContext = new MockAppContext();
+  appContext.addRootCluster(clusterFoo);
+  appContext.addRootCluster(clusterBar);
+
+  jest.spyOn(appContext.tshd, 'getAuthSettings').mockResolvedValue(
+    new MockedUnaryCall({
+      localAuthEnabled: true,
+      authProviders: [],
+      hasMessageOfTheDay: false,
+      authType: 'local',
+      allowPasswordless: false,
+      localConnectorName: '',
+      clientVersionStatus: ClientVersionStatus.TOO_NEW,
+      versions: {
+        minClient: '16.0.0-aa',
+        client: '17.0.0',
+        server: '17.0.0',
+      },
+    })
+  );
+
+  jest
+    .spyOn(appContext.mainProcessClient, 'subscribeToAppUpdateEvents')
+    .mockImplementation(callback => {
+      callback({
+        kind: 'update-not-available',
+        autoUpdatesStatus: {
+          enabled: true,
+          source: 'managing-cluster',
+          version: '19.0.0',
+          options: {
+            highestCompatibleVersion: '',
+            managingClusterUri: clusterBar.uri,
+            unreachableClusters: [],
+            clusters: [
+              {
+                clusterUri: clusterFoo.uri,
+                toolsAutoUpdate: true,
+                toolsVersion: '19.0.0',
+                minToolsVersion: '18.0.0-aa',
+                otherCompatibleClusters: [],
+              },
+              {
+                clusterUri: clusterBar.uri,
+                toolsAutoUpdate: true,
+                toolsVersion: '17.0.0',
+                minToolsVersion: '16.0.0-aa',
+                otherCompatibleClusters: [],
+              },
+            ],
+          },
+        },
+      });
+      return { cleanup: () => {} };
+    });
+
+  render(
+    <MockAppContextProvider appContext={appContext}>
+      <AppUpdaterContextProvider>
+        <ClusterLogin
+          clusterUri={clusterFoo.uri}
+          onCancel={() => {}}
+          prefill={{ username: 'alice' }}
+          reason={undefined}
+        />
+      </AppUpdaterContextProvider>
+    </MockAppContextProvider>
+  );
+
+  expect(
+    await screen.findByText('Detected potentially incompatible version')
+  ).toBeVisible();
+  expect(
+    await screen.findByRole('button', { name: 'Go to Auto Updates' })
+  ).toBeVisible();
+});
+
+it('shows two separate prompt texts during SSO login', async () => {
+  const user = userEvent.setup();
+  const cluster = makeRootCluster();
+  const appContext = new MockAppContext();
+  appContext.addRootCluster(cluster);
+
+  jest.spyOn(appContext.tshd, 'getAuthSettings').mockReturnValue(
+    new MockedUnaryCall(
+      makeAuthSettings({
+        authType: 'github',
+        authProviders: [
+          { displayName: 'GitHub', name: 'github', type: 'github' },
+        ],
+      })
+    )
+  );
+
+  const { resolve: resolveLoginPromise, promise: loginPromise } =
+    Promise.withResolvers<ReturnType<TshdClient['login']>>();
+  jest
+    .spyOn(appContext.tshd, 'login')
+    .mockImplementation(async () => loginPromise);
+
+  const { resolve: resolveSyncClusterPromise, promise: syncClusterPromise } =
+    Promise.withResolvers<void>();
+  jest
+    .spyOn(appContext.mainProcessClient, 'syncCluster')
+    .mockImplementation(async () => syncClusterPromise);
+
+  render(
+    <MockAppContextProvider appContext={appContext}>
+      <AppUpdaterContextProvider>
+        <ClusterLogin
+          clusterUri={cluster.uri}
+          onCancel={() => {}}
+          prefill={{ username: 'alice' }}
+          reason={undefined}
+        />
+      </AppUpdaterContextProvider>
+    </MockAppContextProvider>
+  );
+
+  await user.click(await screen.findByText('GitHub'));
+
+  expect(
+    screen.getByText(/follow the steps in the browser/)
+  ).toBeInTheDocument();
+
+  await act(async () => {
+    resolveLoginPromise(new MockedUnaryCall({}));
+  });
+
+  expect(screen.getByText(/Login successful/)).toBeInTheDocument();
+
+  await act(async () => {
+    // Resolve the promise to avoid leaving a hanging promise around.
+    resolveSyncClusterPromise();
+  });
+});
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.tsx
index 1dcc9ec99d0ea..3737c5c900e2c 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLogin.tsx
@@ -25,21 +25,25 @@ import {
   Flex,
   H2,
   Indicator,
+  StepSlider,
   Text,
 } from 'design';
 import * as Alerts from 'design/Alert';
 import { DialogContent, DialogHeader } from 'design/Dialog';
 import * as Icons from 'design/Icon';
+import { ArrowBack } from 'design/Icon';
+import type { StepComponentProps } from 'design/StepSlider';
 import { AuthSettings } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
 import { PrimaryAuthType } from 'shared/services';
 
 import { publicAddrWithTargetPort } from 'teleterm/services/tshd/app';
 import { getTargetNameFromUri } from 'teleterm/services/tshd/gateway';
+import { DetailsView } from 'teleterm/ui/AppUpdater';
 import { ClusterConnectReason } from 'teleterm/ui/services/modals';
 
 import { outermostPadding } from '../spacing';
 import LoginForm from './FormLogin';
-import useClusterLogin, { Props, State } from './useClusterLogin';
+import { Props, State, useClusterLogin } from './useClusterLogin';
 
 export function ClusterLogin(props: Props & { reason: ClusterConnectReason }) {
   const { reason, ...otherProps } = props;
@@ -47,11 +51,28 @@ export function ClusterLogin(props: Props & { reason: ClusterConnectReason }) {
   return <ClusterLoginPresentation {...state} reason={reason} />;
 }
 
+export const ClusterLoginPresentation = (
+  props: ClusterLoginPresentationProps
+) => {
+  return (
+    <StepSlider
+      flows={loginViews}
+      currFlow="default"
+      css={`
+        // Prevents displaying a scrollbar by the slider.
+        // Instead, the entire dialog should be scrollable.
+        flex-shrink: 0;
+      `}
+      {...props}
+    />
+  );
+};
+
 export type ClusterLoginPresentationProps = State & {
   reason: ClusterConnectReason;
 };
 
-export function ClusterLoginPresentation({
+function ClusterLoginForm({
   title,
   initAttempt,
   init,
@@ -63,15 +84,23 @@ export function ClusterLoginPresentation({
   onCloseDialog,
   onAbort,
   loggedInUserName,
-  shouldPromptSsoStatus,
+  ssoPrompt,
   passwordlessLoginState,
   reason,
   shouldSkipVersionCheck,
   disableVersionCheck,
   platform,
-}: ClusterLoginPresentationProps) {
+  next,
+  refCallback,
+  changeAppUpdatesManagingCluster,
+  appUpdateEvent,
+  cancelAppUpdateDownload,
+  quitAndInstallAppUpdate,
+  downloadAppUpdate,
+  checkForAppUpdates,
+}: ClusterLoginPresentationProps & StepComponentProps) {
   return (
-    <>
+    <Flex ref={refCallback} flexDirection="column">
       <DialogHeader px={outermostPadding}>
         <H2>
           Log in to <b>{title}</b>
@@ -120,18 +149,69 @@ export function ClusterLoginPresentation({
             onAbort={onAbort}
             loginAttempt={loginAttempt}
             clearLoginAttempt={clearLoginAttempt}
-            shouldPromptSsoStatus={shouldPromptSsoStatus}
+            ssoPrompt={ssoPrompt}
             passwordlessLoginState={passwordlessLoginState}
             shouldSkipVersionCheck={shouldSkipVersionCheck}
             disableVersionCheck={disableVersionCheck}
             platform={platform}
+            checkForAppUpdates={checkForAppUpdates}
+            changeAppUpdatesManagingCluster={changeAppUpdatesManagingCluster}
+            appUpdateEvent={appUpdateEvent}
+            cancelAppUpdateDownload={cancelAppUpdateDownload}
+            downloadAppUpdate={downloadAppUpdate}
+            quitAndInstallAppUpdate={quitAndInstallAppUpdate}
+            switchToAppUpdateDetails={next}
           />
         )}
       </DialogContent>
-    </>
+    </Flex>
   );
 }
 
+const AppUpdateDetails = ({
+  refCallback,
+  platform,
+  downloadAppUpdate,
+  checkForAppUpdates,
+  cancelAppUpdateDownload,
+  quitAndInstallAppUpdate,
+  changeAppUpdatesManagingCluster,
+  appUpdateEvent,
+  onCloseDialog,
+  prev,
+}: ClusterLoginPresentationProps & StepComponentProps) => {
+  return (
+    <Flex ref={refCallback} flexDirection="column">
+      <DialogHeader px={outermostPadding}>
+        <Flex alignItems="center" gap={1}>
+          <ButtonIcon title="Go Back" onClick={prev}>
+            <ArrowBack />
+          </ButtonIcon>
+          <H2>App Updates</H2>
+        </Flex>
+        <ButtonIcon ml="auto" p={3} onClick={onCloseDialog} aria-label="Close">
+          <Icons.Cross size="medium" />
+        </ButtonIcon>
+      </DialogHeader>
+      <Flex px={4}>
+        <DetailsView
+          onInstall={() => quitAndInstallAppUpdate()}
+          platform={platform}
+          changeManagingCluster={clusterUri =>
+            changeAppUpdatesManagingCluster(clusterUri)
+          }
+          updateEvent={appUpdateEvent}
+          onDownload={() => downloadAppUpdate()}
+          onCancelDownload={() => cancelAppUpdateDownload()}
+          onCheckForUpdates={() => checkForAppUpdates()}
+        />
+      </Flex>
+    </Flex>
+  );
+};
+
+const loginViews = { default: [ClusterLoginForm, AppUpdateDetails] };
+
 function getPrimaryAuthType(auth: AuthSettings): PrimaryAuthType {
   if (auth.localConnectorName === 'passwordless') {
     return 'passwordless';
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLoginReason.story.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLoginReason.story.tsx
index 2b7a64864f542..aeadc80de1cdc 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLoginReason.story.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/ClusterLoginReason.story.tsx
@@ -15,7 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import {
   makeApp,
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/CompatibilityWarning.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/CompatibilityWarning.tsx
index 8fe44bae929d2..862fd40b18190 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/CompatibilityWarning.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/CompatibilityWarning.tsx
@@ -27,10 +27,12 @@ import {
 import { Platform } from 'teleterm/mainProcess/types';
 
 export function CompatibilityWarning(props: {
+  isAnyClusterProvidingUpdates: boolean;
   authSettings: AuthSettings;
   platform: Platform;
   shouldSkipVersionCheck: boolean;
   disableVersionCheck(): void;
+  onSwitchToAppUpdateDetails(): void;
   mx?: number;
 }) {
   if (props.shouldSkipVersionCheck) {
@@ -56,15 +58,22 @@ export function CompatibilityWarning(props: {
               fill="border"
               intent="neutral"
               inputAlignment
-              action={{
-                content: (
-                  <>
-                    Download in Browser
-                    <NewTab size="small" ml={1} />
-                  </>
-                ),
-                href: buildDownloadUrl(props.platform),
-              }}
+              action={
+                props.isAnyClusterProvidingUpdates
+                  ? {
+                      content: 'Go to Auto Updates',
+                      onClick: props.onSwitchToAppUpdateDetails,
+                    }
+                  : {
+                      content: (
+                        <>
+                          Download in Browser
+                          <NewTab size="small" ml={1} />
+                        </>
+                      ),
+                      href: buildDownloadUrl(props.platform),
+                    }
+              }
             />
             <ActionButton
               fill="minimal"
@@ -117,7 +126,7 @@ function buildDownloadUrl(platform: Platform): string {
   let os: string;
   switch (platform) {
     case 'darwin':
-      os = 'mac';
+      os = 'darwin';
       break;
     case 'linux':
       os = 'linux';
@@ -127,7 +136,7 @@ function buildDownloadUrl(platform: Platform): string {
       break;
   }
 
-  return `https://goteleport.com/download/?product=connect&os=${os}`;
+  return `https://goteleport.com/download/client-tools/?os=${os}`;
 }
 
 function getMajorVersion(version: string): string {
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLocal/FormLocal.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLocal/FormLocal.tsx
index ec729af33853d..7c8fc24707e72 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLocal/FormLocal.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLocal/FormLocal.tsx
@@ -38,11 +38,18 @@ export const FormLocal = ({
   const [pass, setPass] = useState('');
   const [user, setUser] = useState(loggedInUserName || '');
 
+  // loginAttempt.status needs to be checked here so that auto focus is automatically managed when
+  // the form reverts from a processing state to an error state.
+  const isAutoFocusAllowed =
+    autoFocus && hasTransitionEnded && loginAttempt.status !== 'processing';
+  // useRefAutoFocus is used instead of just plain autoFocus because of some weird focus issues
+  // stemming from, most probably, using <StepSlider> within a modal. autoFocus generally works
+  // within modals. We've never documented why we use this hook so that knowledge is lost in time.
   const usernameInputRef = useRefAutoFocus<HTMLInputElement>({
-    shouldFocus: hasTransitionEnded && autoFocus && !loggedInUserName,
+    shouldFocus: isAutoFocusAllowed && !loggedInUserName,
   });
   const passwordInputRef = useRefAutoFocus<HTMLInputElement>({
-    shouldFocus: hasTransitionEnded && autoFocus && !!loggedInUserName,
+    shouldFocus: isAutoFocusAllowed && !!loggedInUserName,
   });
 
   function onLoginClick(
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLogin.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLogin.tsx
index c6cb36a03a2a8..6d94e64cb022c 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLogin.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormLogin.tsx
@@ -22,15 +22,20 @@ import styled from 'styled-components';
 import { Box, ButtonText, Flex } from 'design';
 import * as Alerts from 'design/Alert';
 import { StepSlider, type StepComponentProps } from 'design/StepSlider';
-import { AuthSettings } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
+import {
+  AuthProvider,
+  AuthSettings,
+} from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
 import { Attempt } from 'shared/hooks/useAsync';
 import type { PrimaryAuthType } from 'shared/services';
 
 import { Platform } from 'teleterm/mainProcess/types';
-import * as types from 'teleterm/ui/services/clusters/types';
+import { AppUpdateEvent } from 'teleterm/services/appUpdater';
+import { WidgetView } from 'teleterm/ui/AppUpdater';
+import { RootClusterUri } from 'teleterm/ui/uri';
 
 import { outermostPadding } from '../../spacing';
-import type { PasswordlessLoginState } from '../useClusterLogin';
+import type { PasswordlessLoginState, SsoPrompt } from '../useClusterLogin';
 import { CompatibilityWarning } from './CompatibilityWarning';
 import { FormLocal } from './FormLocal';
 import { FormPasswordless } from './FormPasswordless';
@@ -43,7 +48,7 @@ export default function LoginForm(props: Props) {
     loginAttempt,
     onAbort,
     authSettings: { authProviders, localAuthEnabled = true },
-    shouldPromptSsoStatus,
+    ssoPrompt,
     passwordlessLoginState,
   } = props;
 
@@ -55,10 +60,10 @@ export default function LoginForm(props: Props) {
     );
   }
 
-  if (shouldPromptSsoStatus) {
+  if (ssoPrompt !== 'no-prompt') {
     return (
       <OutermostPadding>
-        <PromptSsoStatus onCancel={onAbort} />
+        <PromptSsoStatus ssoPrompt={ssoPrompt} onCancel={onAbort} />
       </OutermostPadding>
     );
   }
@@ -68,6 +73,18 @@ export default function LoginForm(props: Props) {
     shouldSkipVersionCheck: props.shouldSkipVersionCheck,
     disableVersionCheck: props.disableVersionCheck,
     platform: props.platform,
+    isAnyClusterProvidingUpdates:
+      props.appUpdateEvent.autoUpdatesStatus?.options.clusters.some(
+        c => c.toolsAutoUpdate
+      ),
+    onSwitchToAppUpdateDetails: props.switchToAppUpdateDetails,
+  };
+  const appUpdateWidgetViewProps = {
+    updateEvent: props.appUpdateEvent,
+    onDownload: () => props.downloadAppUpdate(),
+    onInstall: () => props.quitAndInstallAppUpdate(),
+    platform: props.platform,
+    onMore: () => props.switchToAppUpdateDetails(),
   };
   const ssoEnabled = authProviders?.length > 0;
 
@@ -82,6 +99,7 @@ export default function LoginForm(props: Props) {
           </Alerts.Danger>
         )}
         <CompatibilityWarning {...compatibilityWarningProps} />
+        <WidgetView {...appUpdateWidgetViewProps} />
         <FormSso {...props} />
       </FlexBordered>
     );
@@ -97,6 +115,7 @@ export default function LoginForm(props: Props) {
           Login has not been enabled
         </Alerts.Danger>
         <CompatibilityWarning {...compatibilityWarningProps} />
+        <WidgetView {...appUpdateWidgetViewProps} />
       </FlexBordered>
     );
   }
@@ -120,6 +139,7 @@ export default function LoginForm(props: Props) {
         mx={outermostPadding}
         {...compatibilityWarningProps}
       />
+      <WidgetView mx={outermostPadding} {...appUpdateWidgetViewProps} />
       <StepSlider<typeof loginViews>
         flows={loginViews}
         currFlow={'default'}
@@ -307,20 +327,27 @@ type LoginAttempt = Attempt<void>;
 
 export type Props = {
   authSettings: AuthSettings;
-  shouldPromptSsoStatus: boolean;
+  ssoPrompt: SsoPrompt;
   passwordlessLoginState: PasswordlessLoginState;
   loginAttempt: LoginAttempt;
   clearLoginAttempt(): void;
   primaryAuthType: PrimaryAuthType;
   loggedInUserName?: string;
   onAbort(): void;
-  onLoginWithSso(provider: types.AuthProvider): void;
+  onLoginWithSso(provider: AuthProvider): void;
   onLoginWithPasswordless(): void;
   onLogin(username: string, password: string): void;
   autoFocus?: boolean;
   shouldSkipVersionCheck: boolean;
   disableVersionCheck(): void;
   platform: Platform;
+  switchToAppUpdateDetails(): void;
+  appUpdateEvent: AppUpdateEvent;
+  downloadAppUpdate(): Promise<void>;
+  cancelAppUpdateDownload(): Promise<void>;
+  checkForAppUpdates(): Promise<void>;
+  quitAndInstallAppUpdate(): void;
+  changeAppUpdatesManagingCluster(clusterUri: RootClusterUri): Promise<void>;
 };
 
 const OutermostPadding = styled(Box).attrs({ px: outermostPadding })``;
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormSso/SsoButtons.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormSso/SsoButtons.tsx
index db8887f8fffd2..50063aee5442c 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormSso/SsoButtons.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/FormSso/SsoButtons.tsx
@@ -17,9 +17,9 @@
  */
 
 import { Flex, Text } from 'design';
+import { AuthProvider } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
 import ButtonSso, { guessProviderType } from 'shared/components/ButtonSso';
-
-import * as types from 'teleterm/ui/services/clusters/types';
+import { AuthProviderType } from 'shared/services';
 
 const SSOBtnList = ({
   providers,
@@ -31,7 +31,7 @@ const SSOBtnList = ({
   const $btns = providers.map((item, index) => {
     let { name, type, displayName } = item;
     const title = displayName || `${prefixText} ${name}`;
-    const ssoType = guessProviderType(title, type as types.AuthProviderType);
+    const ssoType = guessProviderType(title, type as AuthProviderType);
     return (
       <ButtonSso
         key={index}
@@ -61,8 +61,8 @@ const SSOBtnList = ({
 type Props = {
   prefixText: string;
   isDisabled: boolean;
-  onClick(provider: types.AuthProvider): void;
-  providers: types.AuthProvider[];
+  onClick(provider: AuthProvider): void;
+  providers: AuthProvider[];
   // autoFocus focuses on the first button in list.
   autoFocus?: boolean;
 };
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
index 7036156d8351a..c44608120f0d2 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
@@ -20,22 +20,30 @@ import { Box, ButtonSecondary, Flex, Text } from 'design';
 
 import { LinearProgress } from 'teleterm/ui/components/LinearProgress';
 
-export default function PromptSsoStatus(props: Props) {
+import { SsoPrompt } from '../../useClusterLogin';
+
+export default function PromptSsoStatus(props: {
+  onCancel?(): void;
+  ssoPrompt: Exclude<SsoPrompt, 'no-prompt'>;
+}) {
+  const { onCancel, ssoPrompt } = props;
   return (
     <Flex gap={4} flexDirection="column" alignItems="flex-start">
-      <Box style={{ position: 'relative' }}>
+      <Box width="100%" style={{ position: 'relative' }}>
         <Text bold mb={2} textAlign="center">
-          Please follow the steps in the new browser window to authenticate.
+          {ssoPrompt === 'follow-browser-steps' && (
+            <>Please follow the steps in the browser to&nbsp;authenticate.</>
+          )}
+
+          {ssoPrompt === 'wait-for-sync' && (
+            <>Login successful, connecting to the cluster…</>
+          )}
         </Text>
         <LinearProgress />
       </Box>
-      {props.onCancel && (
-        <ButtonSecondary onClick={props.onCancel}>Cancel</ButtonSecondary>
+      {ssoPrompt === 'follow-browser-steps' && onCancel && (
+        <ButtonSecondary onClick={onCancel}>Cancel</ButtonSecondary>
       )}
     </Flex>
   );
 }
-
-export type Props = {
-  onCancel?(): void;
-};
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/storyHelpers.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/storyHelpers.tsx
index 183ef1baa07ce..d2d44ca05e103 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/storyHelpers.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/storyHelpers.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { ArgTypes } from '@storybook/react';
+import { ArgTypes } from '@storybook/react-vite';
 import { FC, PropsWithChildren } from 'react';
 
 import Dialog from 'design/Dialog';
@@ -35,6 +35,7 @@ export const TestContainer: FC<PropsWithChildren> = ({ children }) => (
 
 export interface StoryProps {
   compatibility: 'compatible' | 'client-too-old' | 'client-too-new';
+  showUpdate: boolean;
 }
 
 export const compatibilityArgType: ArgTypes<StoryProps> = {
@@ -43,13 +44,17 @@ export const compatibilityArgType: ArgTypes<StoryProps> = {
     options: ['compatible', 'client-too-old', 'client-too-new'],
     description: 'Client compatibility',
   },
+  showUpdate: {
+    type: 'boolean',
+    description: 'Show app update',
+  },
 };
 
 export function makeProps(
   storyProps: StoryProps
 ): ClusterLoginPresentationProps {
   const props: ClusterLoginPresentationProps = {
-    shouldPromptSsoStatus: false,
+    ssoPrompt: 'no-prompt',
     title: 'localhost',
     loginAttempt: {
       status: '',
@@ -75,6 +80,24 @@ export function makeProps(
     shouldSkipVersionCheck: false,
     disableVersionCheck: () => {},
     platform: 'darwin',
+    changeAppUpdatesManagingCluster: async () => {},
+    checkForAppUpdates: async () => {},
+    downloadAppUpdate: async () => {},
+    quitAndInstallAppUpdate: async () => {},
+    cancelAppUpdateDownload: async () => {},
+    appUpdateEvent: {
+      kind: 'update-not-available',
+      autoUpdatesStatus: {
+        enabled: false,
+        reason: 'no-cluster-with-auto-update',
+        options: {
+          unreachableClusters: [],
+          clusters: [],
+          highestCompatibleVersion: '',
+          managingClusterUri: '',
+        },
+      },
+    },
   };
 
   switch (storyProps.compatibility) {
@@ -99,5 +122,44 @@ export function makeProps(
     }
   }
 
+  if (storyProps.showUpdate) {
+    props.appUpdateEvent = {
+      kind: 'update-available',
+      update: {
+        updateKind: 'upgrade',
+        version: '19.0.0',
+        files: [
+          {
+            url: 'https://cdn.teleport.dev/connect-update',
+            sha512: '',
+          },
+        ],
+        path: '',
+        releaseDate: '',
+        sha512: '',
+      },
+      autoDownload: true,
+      autoUpdatesStatus: {
+        enabled: true,
+        source: 'highest-compatible',
+        version: '19.0.0',
+        options: {
+          unreachableClusters: [],
+          managingClusterUri: '',
+          clusters: [
+            {
+              clusterUri: '/clusters/foo',
+              toolsAutoUpdate: true,
+              minToolsVersion: '18.0.0',
+              toolsVersion: '19.0.0',
+              otherCompatibleClusters: [],
+            },
+          ],
+          highestCompatibleVersion: '19.0.0',
+        },
+      },
+    };
+  }
+
   return props;
 }
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.test.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.test.tsx
new file mode 100644
index 0000000000000..5d5a0c4db23db
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.test.tsx
@@ -0,0 +1,80 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { act } from 'react';
+
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { AppUpdaterContextProvider } from 'teleterm/ui/AppUpdater';
+import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
+import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+
+import { Props, useClusterLogin } from './useClusterLogin';
+
+test('login into cluster and sync cluster', async () => {
+  const appContext = new MockAppContext();
+  const rootCluster = makeRootCluster();
+  appContext.addRootCluster(rootCluster);
+
+  jest.spyOn(appContext.tshd, 'login');
+
+  const { result } = renderHook((props: Props) => useClusterLogin(props), {
+    initialProps: {
+      clusterUri: rootCluster.uri,
+      prefill: { username: '' },
+      onCancel: () => {},
+      onSuccess: () => {},
+    },
+    wrapper: ({ children }) => (
+      <MockAppContextProvider appContext={appContext}>
+        <AppUpdaterContextProvider>{children}</AppUpdaterContextProvider>
+      </MockAppContextProvider>
+    ),
+  });
+
+  await waitFor(() => {
+    expect(result.current.initAttempt.status).toEqual('success');
+  });
+
+  await act(async () => {
+    result.current.onLoginWithLocal('user', 'password');
+  });
+
+  await waitFor(() => {
+    expect(result.current.loginAttempt.status).toEqual('success');
+  });
+
+  expect(appContext.tshd.login).toHaveBeenCalledWith(
+    {
+      clusterUri: rootCluster.uri,
+      params: {
+        oneofKind: 'local',
+        local: {
+          user: 'user',
+          password: 'password',
+        },
+      },
+    },
+    {
+      abort: expect.objectContaining({ canBePassedThroughContextBridge: true }),
+    }
+  );
+  const foundCluster = appContext.clustersService.findCluster(rootCluster.uri);
+  expect(foundCluster).not.toBeUndefined();
+  expect(foundCluster.connected).toBe(true);
+});
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
index b19bbaa50648c..55f8999924873 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
@@ -18,54 +18,74 @@
 
 import { useEffect, useRef, useState } from 'react';
 
+import { AuthProvider } from 'gen-proto-ts/teleport/lib/teleterm/v1/auth_settings_pb';
+import {
+  CredentialInfo,
+  PasswordlessPrompt,
+} from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
 import { useAsync } from 'shared/hooks/useAsync';
 
-import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
+import {
+  CloneableAbortSignal,
+  cloneAbortSignal,
+} from 'teleterm/services/tshd/cloneableClient';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
-import type * as types from 'teleterm/ui/services/clusters/types';
-import { RootClusterUri } from 'teleterm/ui/uri';
-import { assertUnreachable } from 'teleterm/ui/utils';
+import { useAppUpdaterContext } from 'teleterm/ui/AppUpdater';
+import { IAppContext } from 'teleterm/ui/types';
+import * as uri from 'teleterm/ui/uri';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
 
-export default function useClusterLogin(props: Props) {
+export type SsoPrompt =
+  /**
+   * No prompt, SSO login not in use.
+   */
+  | 'no-prompt'
+  /**
+   * The user is asked to follow the steps in the browser (the browser automatically opens).
+   */
+  | 'follow-browser-steps'
+  /**
+   * After the user followed the steps in the browser and the login RPC returned but before the
+   * cluster sync RPC started.
+   */
+  | 'wait-for-sync';
+
+export function useClusterLogin(props: Props) {
   const { onSuccess, clusterUri } = props;
-  const { clustersService, tshd, configService, mainProcessClient } =
-    useAppContext();
+  const ctx = useAppContext();
+  const { clustersService, tshd, configService, mainProcessClient } = ctx;
+  const appUpdaterContext = useAppUpdaterContext();
   const cluster = clustersService.findCluster(clusterUri);
   const refAbortCtrl = useRef<AbortController>(null);
   const loggedInUserName =
     props.prefill.username || cluster.loggedInUser?.name || null;
-  const [shouldPromptSsoStatus, promptSsoStatus] = useState(false);
+  const [ssoPrompt, setSsoPrompt] = useState<SsoPrompt>('no-prompt');
   const [passwordlessLoginState, setPasswordlessLoginState] =
     useState<PasswordlessLoginState>();
 
-  const [initAttempt, init] = useAsync(() =>
-    tshd.getAuthSettings({ clusterUri }).then(({ response }) => response)
-  );
+  const [initAttempt, init] = useAsync(() => {
+    return Promise.all([
+      tshd.getAuthSettings({ clusterUri }).then(({ response }) => response),
+      // checkForAppUpdates doesn't return a rejected promise, errors are
+      // surfaced in app updates widget and details view.
+      mainProcessClient.checkForAppUpdates(),
+    ]).then(([authSettings]) => authSettings);
+  });
 
-  const [loginAttempt, login, setAttempt] = useAsync(
-    (params: types.LoginParams) => {
-      refAbortCtrl.current = new AbortController();
-      switch (params.kind) {
-        case 'local':
-          return clustersService.loginLocal(
-            params,
-            cloneAbortSignal(refAbortCtrl.current.signal)
-          );
-        case 'passwordless':
-          return clustersService.loginPasswordless(
-            params,
-            cloneAbortSignal(refAbortCtrl.current.signal)
-          );
-        case 'sso':
-          return clustersService.loginSso(
-            params,
-            cloneAbortSignal(refAbortCtrl.current.signal)
-          );
-        default:
-          assertUnreachable(params);
-      }
+  const [loginAttempt, login, setAttempt] = useAsync((params: LoginParams) => {
+    refAbortCtrl.current = new AbortController();
+    const signal = cloneAbortSignal(refAbortCtrl.current.signal);
+    switch (params.kind) {
+      case 'local':
+        return loginLocal(ctx, params, signal);
+      case 'passwordless':
+        return loginPasswordless(ctx, params, signal);
+      case 'sso':
+        return loginSso(ctx, params, setSsoPrompt, signal);
+      default:
+        params satisfies never;
     }
-  );
+  });
 
   const onLoginWithLocal = (username: string, password: string) => {
     login({
@@ -80,7 +100,7 @@ export default function useClusterLogin(props: Props) {
     login({
       kind: 'passwordless',
       clusterUri,
-      onPromptCallback: (prompt: types.PasswordlessLoginPrompt) => {
+      onPromptCallback: (prompt: PasswordlessLoginPrompt) => {
         const newState: PasswordlessLoginState = {
           prompt: prompt.type,
           processing: false,
@@ -116,8 +136,8 @@ export default function useClusterLogin(props: Props) {
     });
   };
 
-  const onLoginWithSso = (provider: types.AuthProvider) => {
-    promptSsoStatus(true);
+  const onLoginWithSso = (provider: AuthProvider) => {
+    setSsoPrompt('follow-browser-steps');
     login({
       kind: 'sso',
       clusterUri,
@@ -148,7 +168,7 @@ export default function useClusterLogin(props: Props) {
   useEffect(() => {
     if (loginAttempt.status !== 'processing') {
       setPasswordlessLoginState(null);
-      promptSsoStatus(false);
+      setSsoPrompt('no-prompt');
     }
 
     if (loginAttempt.status === 'success') {
@@ -168,9 +188,9 @@ export default function useClusterLogin(props: Props) {
   const { platform } = mainProcessClient.getRuntimeSettings();
 
   return {
-    shouldPromptSsoStatus,
+    ssoPrompt,
     passwordlessLoginState,
-    title: cluster?.name,
+    title: routing.parseClusterName(clusterUri),
     loggedInUserName,
     onLoginWithLocal,
     onLoginWithPasswordless,
@@ -184,6 +204,13 @@ export default function useClusterLogin(props: Props) {
     shouldSkipVersionCheck,
     disableVersionCheck,
     platform,
+    appUpdateEvent: appUpdaterContext.updateEvent,
+    downloadAppUpdate: mainProcessClient.downloadAppUpdate,
+    cancelAppUpdateDownload: mainProcessClient.cancelAppUpdateDownload,
+    checkForAppUpdates: mainProcessClient.checkForAppUpdates,
+    quitAndInstallAppUpdate: mainProcessClient.quitAndInstallAppUpdate,
+    changeAppUpdatesManagingCluster:
+      mainProcessClient.changeAppUpdatesManagingCluster,
   };
 }
 
@@ -200,8 +227,201 @@ export type PasswordlessLoginState = {
   /**
    * prompt describes the current step, or prompt, shown to the user during the passwordless login.
    */
-  prompt: types.PasswordlessLoginPrompt['type'];
+  prompt: PasswordlessLoginPrompt['type'];
   processing?: boolean;
   loginUsernames?: string[];
   onUserResponse?(val: number | string): void;
 };
+
+/*
+ * Login functions
+ */
+
+export type LoginParams =
+  | LoginLocalParams
+  | LoginPasswordlessParams
+  | LoginSsoParams;
+
+export interface LoginLocalParams {
+  kind: 'local';
+  clusterUri: uri.RootClusterUri;
+  username: string;
+  password: string;
+  token?: string;
+}
+
+async function loginLocal(
+  { tshd, clustersService, usageService }: IAppContext,
+  params: LoginLocalParams,
+  abortSignal: CloneableAbortSignal
+) {
+  await tshd.login(
+    {
+      clusterUri: params.clusterUri,
+      params: {
+        oneofKind: 'local',
+        local: {
+          user: params.username,
+          password: params.password,
+          token: params.token,
+        },
+      },
+    },
+    { abort: abortSignal }
+  );
+  // We explicitly use the `andCatchErrors` variant here. If loginLocal succeeds but syncing the
+  // cluster fails, we don't want to stop the user on the failed modal – we want to open the
+  // workspace and show an error state within the workspace.
+  await clustersService.syncAndWatchRootClusterWithErrorHandling(
+    params.clusterUri
+  );
+  usageService.captureUserLogin(params.clusterUri, 'local');
+}
+
+export interface LoginSsoParams {
+  kind: 'sso';
+  clusterUri: uri.RootClusterUri;
+  providerType: string;
+  providerName: string;
+}
+
+async function loginSso(
+  { tshd, clustersService, usageService, mainProcessClient }: IAppContext,
+  params: LoginSsoParams,
+  setSsoPrompt: (prompt: SsoPrompt) => void,
+  abortSignal: CloneableAbortSignal
+) {
+  await tshd.login(
+    {
+      clusterUri: params.clusterUri,
+      params: {
+        oneofKind: 'sso',
+        sso: {
+          providerType: params.providerType,
+          providerName: params.providerName,
+        },
+      },
+    },
+    { abort: abortSignal }
+  );
+  setSsoPrompt('wait-for-sync');
+
+  // Force once login finishes but before we await the cluster sync. This way the focus will go back
+  // to the app ASAP. The login modal will be shown until the cluster sync finishes.
+  void mainProcessClient.forceFocusWindow();
+
+  await clustersService.syncAndWatchRootClusterWithErrorHandling(
+    params.clusterUri
+  );
+  usageService.captureUserLogin(params.clusterUri, params.providerType);
+}
+
+export interface LoginPasswordlessParams {
+  kind: 'passwordless';
+  clusterUri: uri.RootClusterUri;
+  onPromptCallback(res: PasswordlessLoginPrompt): void;
+}
+
+export type PasswordlessLoginPrompt =
+  | { type: 'tap' }
+  | { type: 'retap' }
+  | { type: 'pin'; onUserResponse(pin: string): void }
+  | {
+      type: 'credential';
+      data: { credentials: CredentialInfo[] };
+      onUserResponse(index: number): void;
+    };
+
+async function loginPasswordless(
+  { tshd, clustersService, usageService }: IAppContext,
+  params: LoginPasswordlessParams,
+  abortSignal: CloneableAbortSignal
+) {
+  await new Promise<void>((resolve, reject) => {
+    const stream = tshd.loginPasswordless({
+      abort: abortSignal,
+    });
+
+    let hasDeviceBeenTapped = false;
+
+    // Init the stream.
+    stream.requests.send({
+      request: {
+        oneofKind: 'init',
+        init: {
+          clusterUri: params.clusterUri,
+        },
+      },
+    });
+
+    stream.responses.onMessage(function (response) {
+      switch (response.prompt) {
+        case PasswordlessPrompt.PIN:
+          const pinResponse = (pin: string) => {
+            stream.requests.send({
+              request: {
+                oneofKind: 'pin',
+                pin: { pin },
+              },
+            });
+          };
+
+          params.onPromptCallback({
+            type: 'pin',
+            onUserResponse: pinResponse,
+          });
+          return;
+
+        case PasswordlessPrompt.CREDENTIAL:
+          const credResponse = (index: number) => {
+            stream.requests.send({
+              request: {
+                oneofKind: 'credential',
+                credential: { index: BigInt(index) },
+              },
+            });
+          };
+
+          params.onPromptCallback({
+            type: 'credential',
+            onUserResponse: credResponse,
+            data: { credentials: response.credentials || [] },
+          });
+          return;
+
+        case PasswordlessPrompt.TAP:
+          if (hasDeviceBeenTapped) {
+            params.onPromptCallback({ type: 'retap' });
+          } else {
+            hasDeviceBeenTapped = true;
+            params.onPromptCallback({ type: 'tap' });
+          }
+          return;
+
+        // Following cases should never happen but just in case?
+        case PasswordlessPrompt.UNSPECIFIED:
+          stream.requests.complete();
+          return reject(new Error('no passwordless prompt was specified'));
+
+        default:
+          stream.requests.complete();
+          return reject(
+            new Error(`passwordless prompt '${response.prompt}' not supported`)
+          );
+      }
+    });
+
+    stream.responses.onComplete(function () {
+      resolve();
+    });
+
+    stream.responses.onError(function (err: Error) {
+      reject(err);
+    });
+  });
+
+  await clustersService.syncAndWatchRootClusterWithErrorHandling(
+    params.clusterUri
+  );
+  usageService.captureUserLogin(params.clusterUri, 'passwordless');
+}
diff --git a/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.story.tsx b/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.story.tsx
index d4eb46914cb49..0bfaef49c95ab 100644
--- a/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.story.tsx
+++ b/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.story.tsx
@@ -27,11 +27,7 @@ export default {
 export const Story = () => {
   return (
     <MockAppContextProvider>
-      <ClusterLogout
-        onClose={() => {}}
-        clusterUri="/clusters/foo"
-        clusterTitle="foo"
-      />
+      <ClusterLogout onClose={() => {}} clusterUri="/clusters/foo" />
     </MockAppContextProvider>
   );
 };
diff --git a/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.tsx b/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.tsx
index 8bb36f1ab90d2..9326f1276dbb3 100644
--- a/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.tsx
+++ b/web/packages/teleterm/src/ui/ClusterLogout/ClusterLogout.tsx
@@ -25,25 +25,24 @@ import DialogConfirmation, {
 } from 'design/DialogConfirmation';
 import { Cross } from 'design/Icon';
 import { P } from 'design/Text/Text';
+import { useAsync } from 'shared/hooks/useAsync';
 
-import { RootClusterUri } from 'teleterm/ui/uri';
-
-import { useClusterLogout } from './useClusterLogout';
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
 
 export function ClusterLogout({
   clusterUri,
   onClose,
-  clusterTitle,
   hidden,
 }: {
-  clusterTitle: string;
   clusterUri: RootClusterUri;
   hidden?: boolean;
   onClose(): void;
 }) {
-  const { removeCluster, status, statusText } = useClusterLogout({
-    clusterUri,
-  });
+  const ctx = useAppContext();
+  const [{ status, statusText }, removeCluster] = useAsync(() =>
+    ctx.mainProcessClient.logout(clusterUri)
+  );
 
   async function removeClusterAndClose(): Promise<void> {
     const [, err] = await removeCluster();
@@ -52,6 +51,8 @@ export function ClusterLogout({
     }
   }
 
+  const profileName = routing.parseClusterName(clusterUri);
+
   return (
     <DialogConfirmation
       open={!hidden}
@@ -65,13 +66,11 @@ export function ClusterLogout({
       <form
         onSubmit={e => {
           e.preventDefault();
-          removeClusterAndClose();
+          void removeClusterAndClose();
         }}
       >
-        <DialogHeader justifyContent="space-between" mb={4}>
-          <H2 style={{ whiteSpace: 'nowrap' }}>
-            Log out from cluster {clusterTitle}
-          </H2>
+        <DialogHeader justifyContent="space-between">
+          <H2 style={{ whiteSpace: 'nowrap' }}>Log out from {profileName}</H2>
           <ButtonIcon
             type="button"
             disabled={status === 'processing'}
@@ -81,10 +80,10 @@ export function ClusterLogout({
             <Cross size="medium" />
           </ButtonIcon>
         </DialogHeader>
-        <DialogContent mb={4}>
-          <P color="text.slightlyMuted">Are you sure you want to log out?</P>
+        <DialogContent mb={4} gap={2}>
+          <P>Are you sure you want to log out?</P>
           {status === 'error' && (
-            <Alerts.Danger mb={5} details={statusText}>
+            <Alerts.Danger mb={0} details={statusText}>
               Could not log out
             </Alerts.Danger>
           )}
diff --git a/web/packages/teleterm/src/ui/ClusterLogout/cleanUpBeforeLogout.ts b/web/packages/teleterm/src/ui/ClusterLogout/cleanUpBeforeLogout.ts
new file mode 100644
index 0000000000000..b84c196d7b914
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ClusterLogout/cleanUpBeforeLogout.ts
@@ -0,0 +1,54 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { IAppContext } from 'teleterm/ui/types';
+import { RootClusterUri } from 'teleterm/ui/uri';
+
+/** Disposes cluster-related resources. */
+export async function cleanUpBeforeLogout(
+  ctx: IAppContext,
+  clusterUri: RootClusterUri,
+  opts: { removeWorkspace: boolean }
+): Promise<void> {
+  if (ctx.workspacesService.getRootClusterUri() === clusterUri) {
+    const [firstConnectedWorkspace] = ctx.workspacesService
+      .getConnectedWorkspacesClustersUri()
+      .filter(c => c !== clusterUri);
+    if (firstConnectedWorkspace) {
+      await ctx.workspacesService.setActiveWorkspace(firstConnectedWorkspace);
+    } else {
+      await ctx.workspacesService.setActiveWorkspace(null);
+    }
+  }
+
+  // Remove connections first, they depend both on the cluster and the workspace.
+  ctx.connectionTracker.removeItemsBelongingToRootCluster(clusterUri);
+  // Remove the workspace next, because it depends on the cluster.
+  if (opts.removeWorkspace) {
+    ctx.workspacesService.removeWorkspace(clusterUri);
+  } else {
+    ctx.workspacesService.clearWorkspace(clusterUri);
+  }
+
+  // If there are active ssh connections to the agent, killing it will take a few seconds. To work
+  // around this, kill the agent only after removing the workspace. Removing the workspace closes
+  // ssh tabs, so it should terminate connections to the cluster from the app.
+  await ctx.connectMyComputerService.killAgentAndRemoveData(clusterUri);
+
+  await ctx.clustersService.removeClusterGateways(clusterUri);
+}
diff --git a/web/packages/teleterm/src/ui/ClusterLogout/useClusterLogout.ts b/web/packages/teleterm/src/ui/ClusterLogout/useClusterLogout.ts
deleted file mode 100644
index 560cd93dc563b..0000000000000
--- a/web/packages/teleterm/src/ui/ClusterLogout/useClusterLogout.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useAsync } from 'shared/hooks/useAsync';
-
-import { RootClusterUri } from 'teleterm/ui/uri';
-
-import { useAppContext } from '../appContextProvider';
-
-export function useClusterLogout({
-  clusterUri,
-}: {
-  clusterUri: RootClusterUri;
-}) {
-  const ctx = useAppContext();
-  const [{ status, statusText }, removeCluster] = useAsync(async () => {
-    await ctx.clustersService.logout(clusterUri);
-
-    if (ctx.workspacesService.getRootClusterUri() === clusterUri) {
-      const [firstConnectedWorkspace] =
-        ctx.workspacesService.getConnectedWorkspacesClustersUri();
-      if (firstConnectedWorkspace) {
-        await ctx.workspacesService.setActiveWorkspace(firstConnectedWorkspace);
-      } else {
-        await ctx.workspacesService.setActiveWorkspace(null);
-      }
-    }
-
-    // Remove connections first, they depend both on the cluster and the workspace.
-    ctx.connectionTracker.removeItemsBelongingToRootCluster(clusterUri);
-
-    // Remove the workspace next, because it depends on the cluster.
-    ctx.workspacesService.removeWorkspace(clusterUri);
-
-    // If there are active ssh connections to the agent, killing it will take a few seconds. To work
-    // around this, kill the agent only after removing the workspace. Removing the workspace closes
-    // ssh tabs, so it should terminate connections to the cluster from the app.
-    //
-    // If ClustersService.logout above fails, the user should still be able to manage the agent.
-    await ctx.connectMyComputerService.killAgentAndRemoveData(clusterUri);
-
-    // Remove the cluster, it does not depend on anything.
-    await ctx.clustersService.removeClusterAndResources(clusterUri);
-  });
-
-  return {
-    status,
-    statusText,
-    removeCluster,
-  };
-}
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Status.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Status.tsx
index 00a4bcb45fe80..1a6e38ddd6c07 100644
--- a/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Status.tsx
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Status.tsx
@@ -31,12 +31,12 @@ import {
   MenuItem,
   Text,
 } from 'design';
+import { makeLabelTag } from 'design/formatters';
 import * as icons from 'design/Icon';
 import type { IconProps } from 'design/Icon/Icon';
 import Indicator from 'design/Indicator';
 import { MenuIcon } from 'shared/components/MenuAction';
 
-import { makeLabelTag } from 'teleport/components/formatters';
 import type * as tsh from 'teleterm/services/tshd/types';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import {
diff --git a/web/packages/teleterm/src/ui/Document/Document.tsx b/web/packages/teleterm/src/ui/Document/Document.tsx
index cae91f31adcef..0bda8e040a9ad 100644
--- a/web/packages/teleterm/src/ui/Document/Document.tsx
+++ b/web/packages/teleterm/src/ui/Document/Document.tsx
@@ -16,11 +16,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import React from 'react';
+import React, { ReactNode, useState } from 'react';
 
 import { Flex } from 'design';
 import { useRefAutoFocus } from 'shared/hooks';
 
+import { useIsInBackgroundMode } from 'teleterm/ui/hooks/useIsInBackgroundMode';
+
 const Document: React.FC<{
   visible: boolean;
   autoFocusDisabled?: boolean;
@@ -53,3 +55,51 @@ const Document: React.FC<{
 };
 
 export default Document;
+
+/**
+ * Wrapper for sessions that should end when the app is in background mode.
+ *
+ * When `connected` and the window goes into the background, this component
+ * unmounts its children, terminating any session tied to the document
+ * (e.g. desktop or SSH). The children are restored when the window
+ * becomes visible again and `visible` is true.
+ */
+export function ForegroundSession({
+  connected,
+  visible,
+  children,
+}: {
+  /** When `true`, children are unmounted if the app is in the background. */
+  connected: boolean;
+  /** When `true`, children are mounted. */
+  visible: boolean;
+  children: ReactNode;
+}) {
+  const isInBackgroundMode = useIsInBackgroundMode();
+  if (isInBackgroundMode && connected) {
+    return;
+  }
+
+  return (
+    <MountWhenVisible visible={!isInBackgroundMode && visible}>
+      {children}
+    </MountWhenVisible>
+  );
+}
+
+/** Defers mounting the children until they are visible. */
+function MountWhenVisible({
+  visible,
+  children,
+}: {
+  visible: boolean;
+  children: ReactNode;
+}) {
+  const [showChildren, setShowChildren] = useState(visible);
+
+  if (!showChildren && visible) {
+    setShowChildren(true);
+  }
+
+  return showChildren ? children : undefined;
+}
diff --git a/web/packages/teleterm/src/ui/Document/index.ts b/web/packages/teleterm/src/ui/Document/index.ts
index 16c6ec99d3f61..9294e420735f5 100644
--- a/web/packages/teleterm/src/ui/Document/index.ts
+++ b/web/packages/teleterm/src/ui/Document/index.ts
@@ -19,3 +19,4 @@
 import Document from './Document';
 
 export default Document;
+export { ForegroundSession } from './Document';
diff --git a/web/packages/teleterm/src/ui/DocumentAccessRequests/DocumentAccessRequests.story.tsx b/web/packages/teleterm/src/ui/DocumentAccessRequests/DocumentAccessRequests.story.tsx
index bd1d7fcfa989e..b09b10d9f24dc 100644
--- a/web/packages/teleterm/src/ui/DocumentAccessRequests/DocumentAccessRequests.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentAccessRequests/DocumentAccessRequests.story.tsx
@@ -54,14 +54,6 @@ const mockedAccessRequest: AccessRequest = {
   reviews: [],
   suggestedReviewers: ['admin', 'reviewer'],
   thresholdNames: ['default'],
-  resourceIds: [
-    {
-      kind: 'kube_cluster',
-      name: 'minikube',
-      clusterName: 'main',
-      subResourceName: '',
-    },
-  ],
   resources: [
     {
       id: {
@@ -79,6 +71,8 @@ const mockedAccessRequest: AccessRequest = {
   maxDuration: { seconds: 1729026573n, nanos: 0 },
   requestTtl: { seconds: 1729026573n, nanos: 0 },
   sessionTtl: { seconds: 1729026573n, nanos: 0 },
+  reasonMode: 'optional',
+  reasonPrompts: [],
 };
 
 export function Browsing() {
diff --git a/web/packages/teleterm/src/ui/DocumentAccessRequests/ReviewAccessRequest/useReviewAccessRequest.ts b/web/packages/teleterm/src/ui/DocumentAccessRequests/ReviewAccessRequest/useReviewAccessRequest.ts
index 0ba9185f8d9ee..915a5aefd8257 100644
--- a/web/packages/teleterm/src/ui/DocumentAccessRequests/ReviewAccessRequest/useReviewAccessRequest.ts
+++ b/web/packages/teleterm/src/ui/DocumentAccessRequests/ReviewAccessRequest/useReviewAccessRequest.ts
@@ -47,7 +47,6 @@ export function useReviewAccessRequest({
 
   const { localClusterUri: clusterUri, rootClusterUri } = useWorkspaceContext();
   const loggedInUser = useWorkspaceLoggedInUser();
-  const assumed = ctx.clustersService.getAssumedRequests(rootClusterUri);
 
   const retry = useCallback(
     <T>(action: () => Promise<T>) => retryWithRelogin(ctx, clusterUri, action),
@@ -58,13 +57,13 @@ export function useReviewAccessRequest({
     useCallback(
       () =>
         retry(async () => {
-          const request = await ctx.clustersService.getAccessRequest(
-            rootClusterUri,
-            requestId
-          );
-          return makeUiAccessRequest(request);
+          const { response } = await ctx.tshd.getAccessRequest({
+            clusterUri: rootClusterUri,
+            accessRequestId: requestId,
+          });
+          return makeUiAccessRequest(response.request);
         }),
-      [ctx.clustersService, requestId, retry, rootClusterUri]
+      [ctx.tshd, requestId, retry, rootClusterUri]
     )
   );
   const [deleteRequestAttempt, runDeleteRequest] = useAsync(() =>
@@ -119,7 +118,7 @@ export function useReviewAccessRequest({
 
   function getFlags(request: AccessRequest): RequestFlags {
     if (loggedInUser) {
-      return getRequestFlags(request, loggedInUser, assumed);
+      return getRequestFlags(request, loggedInUser);
     }
     return undefined;
   }
@@ -164,12 +163,11 @@ export function useReviewAccessRequest({
 
 function getRequestFlags(
   request: AccessRequest,
-  user: tsh.LoggedInUser,
-  assumedMap: Record<string, tsh.AccessRequest>
+  user: tsh.LoggedInUser
 ): RequestFlags {
   const ownRequest = request.user === user.name;
   const canAssume = ownRequest && request.state === 'APPROVED';
-  const isAssumed = !!assumedMap[request.id];
+  const isAssumed = !!user.activeRequests.includes(request.id);
   const canDelete = true;
 
   const reviewed = request.reviews.find(r => r.author === user.name);
diff --git a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.test.tsx b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.test.tsx
index 957aced6725ad..04a3463dab68f 100644
--- a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.test.tsx
+++ b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.test.tsx
@@ -17,7 +17,7 @@
  */
 
 import { AccessRequest as TshdAccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
-import { AccessRequest } from 'shared/services/accessRequests';
+import { AccessRequest, RequestKind } from 'shared/services/accessRequests';
 
 import { makeUiAccessRequest } from './useAccessRequests';
 
@@ -44,7 +44,6 @@ test('makeUiAccessRequest', async () => {
     ],
     suggestedReviewers: ['sugested-reviewer-1'],
     thresholdNames: ['default'],
-    resourceIds: [],
     resources: [
       {
         id: {
@@ -89,6 +88,8 @@ test('makeUiAccessRequest', async () => {
       seconds: 1709853650n,
       nanos: 520000000,
     },
+    reasonMode: 'optional',
+    reasonPrompts: [],
   };
 
   const processedRequest: AccessRequest = {
@@ -157,6 +158,8 @@ test('makeUiAccessRequest', async () => {
     assumeStartTimeDuration: 'now',
     reasonMode: 'optional',
     reasonPrompts: [],
+    requestKind: RequestKind.Undefined,
+    longTermResourceGrouping: undefined,
   };
 
   expect(makeUiAccessRequest(request)).toStrictEqual(processedRequest);
diff --git a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.tsx b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.tsx
index afbf104c8419b..b081b7165fdcc 100644
--- a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.tsx
+++ b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAccessRequests.tsx
@@ -41,7 +41,6 @@ export default function useAccessRequests(doc: types.DocumentAccessRequests) {
   const { rootClusterUri, documentsService } = useWorkspaceContext();
   const { fetchRequestsAttempt, fetchRequests } = useAccessRequestsContext();
 
-  const assumed = ctx.clustersService.getAssumedRequests(rootClusterUri);
   const loggedInUser = useWorkspaceLoggedInUser();
 
   function goBack() {
@@ -79,7 +78,7 @@ export default function useAccessRequests(doc: types.DocumentAccessRequests) {
     doc,
     getRequests: fetchRequests,
     getFlags: (accessRequest: AccessRequest) =>
-      makeFlags(accessRequest, assumed, loggedInUser),
+      makeFlags(accessRequest, loggedInUser),
     goBack,
   };
 }
@@ -104,6 +103,8 @@ export function makeUiAccessRequest(request: TshdAccessRequest) {
     suggestedReviewers: request.suggestedReviewers,
     thresholdNames: request.thresholdNames,
     resources: request.resources,
+    reasonMode: request.reasonMode || 'optional',
+    reasonPrompts: request.reasonPrompts,
   });
 }
 
@@ -112,12 +113,11 @@ export function makeUiAccessRequest(request: TshdAccessRequest) {
 // TODO(gzdunek): Replace with a function from `DocumentAccessRequests/useReviewAccessRequest`.
 export function makeFlags(
   request: AccessRequest,
-  assumed: Record<string, TshdAccessRequest>,
   loggedInUser: LoggedInUser
 ): RequestFlags {
   const ownRequest = request.user === loggedInUser?.name;
   const canAssume = ownRequest && request.state === 'APPROVED';
-  const isAssumed = !!assumed[request.id];
+  const isAssumed = loggedInUser?.activeRequests.includes(request.id);
 
   const isPromoted =
     request.state === 'PROMOTED' && !!request.promotedAccessListTitle;
diff --git a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAssumeAccess.ts b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAssumeAccess.ts
index ed4742889ada8..63639d475b3b7 100644
--- a/web/packages/teleterm/src/ui/DocumentAccessRequests/useAssumeAccess.ts
+++ b/web/packages/teleterm/src/ui/DocumentAccessRequests/useAssumeAccess.ts
@@ -35,8 +35,6 @@ export function useAssumeAccess() {
   const [assumeRoleAttempt, runAssumeRole] = useAsync((requestId: string) =>
     retryWithRelogin(ctx, clusterUri, async () => {
       await ctx.clustersService.assumeRoles(rootClusterUri, [requestId]);
-      // Refresh the current resource tabs in the workspace.
-      requestResourcesRefresh();
     })
   );
 
diff --git a/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.story.tsx b/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.story.tsx
index 4c5cb5d4f267f..aea9e16799c5c 100644
--- a/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { wait } from 'shared/utils/wait';
 
diff --git a/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.tsx b/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.tsx
index da23ed37a4e0c..c527af05bd42b 100644
--- a/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.tsx
+++ b/web/packages/teleterm/src/ui/DocumentAuthorizeWebSession/DocumentAuthorizeWebSession.tsx
@@ -149,7 +149,7 @@ export function DocumentAuthorizeWebSession(props: {
             </Alert>
           )}
           <Text>
-            Would you like to authorize a device trust web session for{' '}
+            Would you like to authorize a Device Trust web session for{' '}
             <b>{clusterName}</b>?
             <br />
             The session will automatically open in a new browser tab.
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.story.tsx b/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.story.tsx
index 6e8de628a80a5..8b15c37273f00 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { Box, Flex, Text } from 'design';
 import { HoverTooltip } from 'design/Tooltip';
@@ -46,6 +46,7 @@ import {
 type StoryProps = {
   vnet: boolean;
   lotsOfMenuItems: boolean;
+  singleColumn: boolean;
 };
 
 const meta: Meta<StoryProps> = {
@@ -53,6 +54,7 @@ const meta: Meta<StoryProps> = {
   component: Buttons,
   argTypes: {
     vnet: { control: { type: 'boolean' } },
+    singleColumn: { control: { type: 'boolean' } },
     lotsOfMenuItems: {
       control: { type: 'boolean' },
       description:
@@ -63,13 +65,14 @@ const meta: Meta<StoryProps> = {
   args: {
     vnet: true,
     lotsOfMenuItems: false,
+    singleColumn: false,
   },
 };
 
 export default meta;
 
 export function Story(props: StoryProps) {
-  const platform = props.vnet ? 'darwin' : 'win32';
+  const platform = props.vnet ? 'darwin' : 'linux';
   const appContext = new MockAppContext({ platform });
   prepareAppContext(appContext);
 
@@ -86,7 +89,11 @@ export function Story(props: StoryProps) {
 
 function Buttons(props: StoryProps) {
   return (
-    <Flex gap={4} flexWrap="wrap">
+    <Flex
+      gap={4}
+      flexWrap="wrap"
+      flexDirection={props.singleColumn ? 'column' : 'row'}
+    >
       <Flex gap={3} flexDirection="column">
         <Box>
           <Text>TCP app</Text>
@@ -114,6 +121,16 @@ function Buttons(props: StoryProps) {
           <Text>SAML app</Text>
           <SamlApp />
         </Box>
+        <HoverTooltip tipContent="Connect doesn't support MCP apps properly yet but it renders a div with consintent width.">
+          <Box>
+            <Text>MCP (Stdio)</Text>
+            <Mcp scheme={'mcp+stdio'} />
+          </Box>
+        </HoverTooltip>
+        <Box>
+          <Text>MCP (Streamable HTTP)</Text>
+          <Mcp scheme={'mcp+http'} />
+        </Box>
       </Flex>
       <Box>
         <Text>Server</Text>
@@ -150,7 +167,6 @@ function Buttons(props: StoryProps) {
 }
 
 const testCluster = makeRootCluster();
-testCluster.loggedInUser.sshLogins = ['ec2-user'];
 
 function prepareAppContext(appContext: MockAppContext): void {
   appContext.workspacesService.setState(d => {
@@ -254,6 +270,17 @@ function SamlApp() {
   );
 }
 
+function Mcp(props: { scheme: string }) {
+  return (
+    <ConnectAppActionButton
+      app={makeApp({
+        endpointUri: `${props.scheme}://localhost:3000`,
+        uri: `${testCluster.uri}/apps/bar`,
+      })}
+    />
+  );
+}
+
 function Server() {
   return (
     <ConnectServerActionButton
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.tsx b/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.tsx
index 2e34a07ba7c2b..a532a9ccf2b70 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/ActionButtons.tsx
@@ -18,7 +18,14 @@
 
 import React from 'react';
 
-import { ButtonBorder, ButtonPrimary, ButtonWithMenu, MenuItem } from 'design';
+import {
+  Box,
+  ButtonBorder,
+  ButtonPrimary,
+  ButtonWithMenu,
+  Flex,
+  MenuItem,
+} from 'design';
 import {
   MenuItemSectionLabel,
   MenuItemSectionSeparator,
@@ -35,15 +42,19 @@ import {
   MenuLogin,
   MenuLoginProps,
 } from 'shared/components/MenuLogin';
+import { MenuLoginWithActionMenu } from 'shared/components/MenuLoginWithActionMenu';
+import { getAppProtocol } from 'shared/services/apps';
 
 import {
+  doesMcpAppSupportGateway,
   formatPortRange,
   getAwsAppLaunchUrl,
   getSamlAppSsoUrl,
   getWebAppLaunchUrl,
+  isMcp,
   isWebApp,
 } from 'teleterm/services/tshd/app';
-import { GatewayProtocol } from 'teleterm/services/tshd/types';
+import { GatewayProtocol } from 'teleterm/services/tshd/gateway';
 import { appToAddrToCopy } from 'teleterm/services/vnet/app';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import {
@@ -57,16 +68,32 @@ import {
 import { IAppContext } from 'teleterm/ui/types';
 import { DatabaseUri, routing } from 'teleterm/ui/uri';
 import { retryWithRelogin } from 'teleterm/ui/utils';
-import { useVnetAppLauncher, useVnetContext } from 'teleterm/ui/Vnet';
+import { useVnetContext, useVnetLauncher } from 'teleterm/ui/Vnet';
+
+/**
+ * Width that should be consistent across all displayed buttons.
+ *
+ * The list view of unified resources is not an actual table but a flexbox, so it depends on widths
+ * of elements to be consistent across rows so that they line up.
+ */
+const buttonWidth = 124;
 
 export function ConnectServerActionButton(props: {
   server: Server;
 }): React.JSX.Element {
   const ctx = useAppContext();
+  const { isSupported: isVnetSupported } = useVnetContext();
+  const { launchVnet } = useVnetLauncher();
 
-  function getSshLogins(): string[] {
+  function connectWithVnet(): void {
+    const hostname = props.server.hostname;
     const cluster = ctx.clustersService.findClusterByResource(props.server.uri);
-    return cluster?.loggedInUser?.sshLogins || [];
+    const clusterName = cluster?.name || '<cluster>';
+    const addr = `${hostname}.${clusterName}`;
+    launchVnet({
+      addrToCopy: addr,
+      resourceUri: props.server.uri,
+    });
   }
 
   function connect(login: string): void {
@@ -80,21 +107,30 @@ export function ConnectServerActionButton(props: {
     );
   }
 
+  const commonProps = {
+    inputType: MenuInputType.FILTER,
+    textTransform: 'none',
+    getLoginItems: () => props.server.logins.map(login => ({ login, url: '' })),
+    onSelect: (e, login) => connect(login),
+    transformOrigin: {
+      vertical: 'top',
+      horizontal: 'right',
+    },
+    anchorOrigin: {
+      vertical: 'bottom',
+      horizontal: 'right',
+    },
+  };
+
+  if (!isVnetSupported) {
+    return (
+      <MenuLogin {...commonProps} width={buttonWidth} alignButtonWidthToMenu />
+    );
+  }
   return (
-    <MenuLogin
-      inputType={MenuInputType.FILTER}
-      textTransform="none"
-      getLoginItems={() => getSshLogins().map(login => ({ login, url: '' }))}
-      onSelect={(e, login) => connect(login)}
-      transformOrigin={{
-        vertical: 'top',
-        horizontal: 'right',
-      }}
-      anchorOrigin={{
-        vertical: 'bottom',
-        horizontal: 'right',
-      }}
-    />
+    <MenuLoginWithActionMenu size="small" {...commonProps} width={buttonWidth}>
+      <MenuItem onClick={connectWithVnet}>Connect with VNet</MenuItem>
+    </MenuLoginWithActionMenu>
   );
 }
 
@@ -112,7 +148,12 @@ export function ConnectKubeActionButton(props: {
   }
 
   return (
-    <ButtonBorder textTransform="none" size="small" onClick={connect}>
+    <ButtonBorder
+      textTransform="none"
+      size="small"
+      onClick={connect}
+      width={buttonWidth}
+    >
       Connect
     </ButtonBorder>
   );
@@ -121,13 +162,13 @@ export function ConnectKubeActionButton(props: {
 export function ConnectAppActionButton(props: { app: App }): React.JSX.Element {
   const appContext = useAppContext();
   const { isSupported: isVnetSupported } = useVnetContext();
-  const { launchVnet } = useVnetAppLauncher();
+  const { launchVnet } = useVnetLauncher();
 
   function connectWithVnet(targetPort?: number): void {
     void launchVnet({
       addrToCopy: appToAddrToCopy(props.app, targetPort),
       resourceUri: props.app.uri,
-      isMultiPort: !!props.app.tcpPorts.length,
+      isMultiPortApp: !!props.app.tcpPorts.length,
     });
   }
 
@@ -139,6 +180,7 @@ export function ConnectAppActionButton(props: { app: App }): React.JSX.Element {
     setUpAppGateway(appContext, props.app.uri, {
       telemetry: { origin: 'resource_table' },
       targetPort,
+      targetProtocol: getAppProtocol(props.app.endpointUri),
     });
   }
 
@@ -172,10 +214,11 @@ export function ConnectDatabaseActionButton(props: {
   const appContext = useAppContext();
 
   function connect(dbUser: string): void {
-    const { uri, name, protocol } = props.database;
+    const { uri, name, protocol, gcpProjectId } = props.database;
+
     connectToDatabase(
       appContext,
-      { uri, name, protocol, dbUser },
+      { uri, name, protocol, dbUser, gcpProjectId },
       { origin: 'resource_table' }
     );
   }
@@ -187,6 +230,7 @@ export function ConnectDatabaseActionButton(props: {
       )}
       textTransform="none"
       width="195px"
+      buttonWidth={buttonWidth}
       getLoginItems={() => getDatabaseUsers(appContext, props.database.uri)}
       onSelect={(_, user) => {
         connect(user);
@@ -249,6 +293,7 @@ function AppButton(props: {
   if (props.app.awsConsole) {
     return (
       <AwsLaunchButton
+        width={buttonWidth}
         awsRoles={props.app.awsRoles}
         getLaunchUrl={arn =>
           getAwsAppLaunchUrl({
@@ -276,12 +321,33 @@ function AppButton(props: {
           rootCluster: props.rootCluster,
         })}
         target="_blank"
+        width={buttonWidth}
       >
         Log In
       </ButtonBorder>
     );
   }
 
+  if (isMcp(props.app)) {
+    // Streamable HTTP MCP servers support local proxy gateway.
+    if (doesMcpAppSupportGateway(props.app)) {
+      return (
+        <ButtonBorder
+          size="small"
+          onClick={() => props.setUpGateway()}
+          textTransform="none"
+          width={buttonWidth}
+        >
+          Connect
+        </ButtonBorder>
+      );
+    }
+    // TODO(greedy52) decide what to do with MCP servers that don't support gateway.
+    // In the meantime, display a box of specific width to make the other columns line up for MCP
+    // apps in the list view of unified resources.
+    return <Box width={buttonWidth} />;
+  }
+
   if (isWebApp(props.app)) {
     return (
       <ButtonWithMenu
@@ -297,6 +363,7 @@ function AppButton(props: {
         onClick={props.onLaunchUrl}
         target="_blank"
         title="Launch the app in the browser"
+        width={buttonWidth}
       >
         <MenuItem onClick={() => props.setUpGateway()}>
           Set up connection
@@ -313,6 +380,7 @@ function AppButton(props: {
         textTransform="none"
         size="small"
         onClick={() => props.connectWithVnet()}
+        width={buttonWidth}
       >
         <MenuItem onClick={() => props.setUpGateway()}>
           Connect without VNet
@@ -338,6 +406,7 @@ function AppButton(props: {
         textTransform="none"
         size="small"
         onClick={() => props.setUpGateway()}
+        width={buttonWidth}
       >
         <AvailableTargetPorts
           tcpPorts={props.app.tcpPorts}
@@ -353,6 +422,7 @@ function AppButton(props: {
       size="small"
       onClick={() => props.setUpGateway()}
       textTransform="none"
+      width={buttonWidth}
     >
       Connect
     </ButtonBorder>
@@ -390,7 +460,7 @@ export function AccessRequestButton(props: {
   return props.isResourceAdded ? (
     <ButtonPrimary
       textTransform="none"
-      width="124px"
+      width={buttonWidth}
       size="small"
       onClick={props.onClick}
     >
@@ -399,7 +469,7 @@ export function AccessRequestButton(props: {
   ) : (
     <ButtonBorder
       textTransform="none"
-      width="124px"
+      width={buttonWidth}
       size="small"
       onClick={props.onClick}
     >
@@ -423,23 +493,26 @@ export function ConnectWindowsDesktopActionButton(props: {
   }
 
   return (
-    <MenuLogin
-      textTransform="none"
-      width="195px"
-      getLoginItems={() =>
-        props.windowsDesktop.logins.map(l => ({ login: l, url: '' }))
-      }
-      onSelect={(_, user) => {
-        connect(user);
-      }}
-      transformOrigin={{
-        vertical: 'top',
-        horizontal: 'right',
-      }}
-      anchorOrigin={{
-        vertical: 'bottom',
-        horizontal: 'right',
-      }}
-    />
+    <Flex width={buttonWidth}>
+      <MenuLogin
+        textTransform="none"
+        width="195px"
+        buttonWidth={buttonWidth}
+        getLoginItems={() =>
+          props.windowsDesktop.logins.map(l => ({ login: l, url: '' }))
+        }
+        onSelect={(_, user) => {
+          connect(user);
+        }}
+        transformOrigin={{
+          vertical: 'top',
+          horizontal: 'right',
+        }}
+        anchorOrigin={{
+          vertical: 'bottom',
+          horizontal: 'right',
+        }}
+      />
+    </Flex>
   );
 }
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.story.tsx b/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.story.tsx
index b48fa9225e7af..5be7992f4e2ba 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.story.tsx
@@ -94,6 +94,7 @@ export const OnlineLoadedResources = () => {
               targetHealth: {
                 status: 'unhealthy',
                 error: 'some unhealthy error message',
+                message: 'some message',
               },
             }),
             requiresRequest: false,
@@ -323,15 +324,20 @@ function renderState({
           hostname: 'some-hostname-1',
           hostId: 'some-host-id-1',
           uri: 'some-uri-1',
-          targetHealth: { status: 'unhealthy', error: 'some unhealthy error' },
+          targetHealth: {
+            status: 'unhealthy',
+            error: 'some unhealthy error',
+            message: '',
+          },
         },
         {
           hostname: 'some-hostname-2',
           hostId: 'some-host-id-2',
           uri: 'some-uri-2',
           targetHealth: {
-            status: 'unhealthy',
-            error: 'some other unhealthy error',
+            status: 'unknown',
+            message: 'some unknown related message',
+            error: 'some other unknown error',
           },
         },
       ],
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/StatusInfo.tsx b/web/packages/teleterm/src/ui/DocumentCluster/StatusInfo.tsx
index ae20a6fa158bb..f65614d2172b0 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/StatusInfo.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/StatusInfo.tsx
@@ -18,7 +18,8 @@
 
 import {
   DatabaseServer,
-  ResourceStatus,
+  KubeServer,
+  makeTargetHealth,
   SharedResourceServer,
   UnifiedResourceDefinition,
   useResourceServersFetch,
@@ -45,31 +46,55 @@ export function StatusInfo({
     attempt: fetchResourceServersAttempt,
   } = useResourceServersFetch<SharedResourceServer>({
     fetchFunc: async (params, signal) => {
-      if (resource.kind === 'db') {
-        const { response } = await ctx.tshd.listDatabaseServers(
-          {
-            clusterUri,
-            params: {
-              ...params,
-              useSearchAsRoles: resource.requiresRequest ? true : false,
-              predicateExpression: `name == "${resource.name}"`,
+      switch (resource.kind) {
+        case 'db': {
+          const { response } = await ctx.tshd.listDatabaseServers(
+            {
+              clusterUri,
+              params: {
+                ...params,
+                useSearchAsRoles: resource.requiresRequest ? true : false,
+                predicateExpression: `name == "${resource.name}"`,
+              },
             },
-          },
-          { abort: cloneAbortSignal(signal) }
-        );
-        const servers: DatabaseServer[] = response.resources.map(d => ({
-          kind: 'db_server',
-          hostname: d.hostname,
-          hostId: d.hostId,
-          targetHealth: d.targetHealth && {
-            status: d.targetHealth.status as ResourceStatus,
-            error: d.targetHealth.error,
-          },
-        }));
-        return {
-          agents: servers,
-          startKey: response.nextKey,
-        };
+            { abort: cloneAbortSignal(signal) }
+          );
+          const servers: DatabaseServer[] = response.resources.map(d => ({
+            kind: 'db_server',
+            hostname: d.hostname,
+            hostId: d.hostId,
+            targetHealth: makeTargetHealth(d.targetHealth),
+          }));
+          return {
+            agents: servers,
+            startKey: response.nextKey,
+          };
+        }
+        case 'kube_cluster': {
+          const { response } = await ctx.tshd.listKubernetesServers(
+            {
+              clusterUri,
+              pageSize: params.limit,
+              pageToken: params.startKey,
+              params: {
+                ...params,
+                useSearchAsRoles: resource.requiresRequest ? true : false,
+                predicateExpression: `name == "${resource.name}"`,
+              },
+            },
+            { abort: cloneAbortSignal(signal) }
+          );
+          const servers: KubeServer[] = response.resources.map(d => ({
+            kind: 'kube_server',
+            hostname: d.hostname,
+            hostId: d.hostId,
+            targetHealth: makeTargetHealth(d.targetHealth),
+          }));
+          return {
+            agents: servers,
+            startKey: response.nextPageToken,
+          };
+        }
       }
     },
   });
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.test.tsx b/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.test.tsx
index d2d9dab4483dd..2da3ec26a9d90 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.test.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.test.tsx
@@ -18,9 +18,16 @@
 
 import { act } from '@testing-library/react';
 import { mockIntersectionObserver } from 'jsdom-testing-mocks';
-import { createRef, forwardRef, useImperativeHandle } from 'react';
+import {
+  createRef,
+  FC,
+  forwardRef,
+  Profiler,
+  PropsWithChildren,
+  useImperativeHandle,
+} from 'react';
 
-import { render, screen } from 'design/utils/testing';
+import { Providers, render, screen } from 'design/utils/testing';
 import { ShowResources } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
 import {
   AvailableResourceMode,
@@ -45,7 +52,9 @@ import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvi
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
 import { MockWorkspaceContextProvider } from 'teleterm/ui/fixtures/MockWorkspaceContextProvider';
 import { makeDocumentCluster } from 'teleterm/ui/services/workspacesService/documentsService/testHelpers';
+import { ConnectionsContextProvider } from 'teleterm/ui/TopBar/Connections/connectionsContext';
 import * as uri from 'teleterm/ui/uri';
+import { VnetContextProvider } from 'teleterm/ui/Vnet';
 
 const mio = mockIntersectionObserver();
 
@@ -311,12 +320,16 @@ test.each([
       <MockWorkspaceContextProvider>
         <ResourcesContextProvider>
           <ConnectMyComputerContextProvider rootClusterUri={rootCluster.uri}>
-            <Refresher ref={ref} rootClusterUri={rootCluster.uri} />
-            <UnifiedResources
-              clusterUri={doc.clusterUri}
-              docUri={doc.uri}
-              queryParams={doc.queryParams}
-            />
+            <ConnectionsContextProvider>
+              <VnetContextProvider>
+                <Refresher ref={ref} rootClusterUri={rootCluster.uri} />
+                <UnifiedResources
+                  clusterUri={doc.clusterUri}
+                  docUri={doc.uri}
+                  queryParams={doc.queryParams}
+                />
+              </VnetContextProvider>
+            </ConnectionsContextProvider>
           </ConnectMyComputerContextProvider>
         </ResourcesContextProvider>
       </MockWorkspaceContextProvider>
@@ -359,3 +372,76 @@ const Refresher = forwardRef<
   }));
   return null;
 });
+
+it('passes props with stable identity to <Resources>', async () => {
+  const rootCluster = makeRootCluster();
+  const doc = makeDocumentCluster({
+    clusterUri: rootCluster.uri,
+  });
+  const serverResource = makeServer();
+  const appContext = new MockAppContext();
+  appContext.addRootClusterWithDoc(rootCluster, doc);
+
+  jest
+    .spyOn(appContext.resourcesService, 'listUnifiedResources')
+    .mockResolvedValue({
+      resources: [
+        {
+          kind: 'server',
+          resource: serverResource,
+          requiresRequest: false,
+        },
+      ],
+      nextKey: '',
+    });
+
+  let renderCount = 0;
+  const onRender = () => (renderCount += 1);
+
+  const Wrapper: FC<PropsWithChildren> = ({ children }) => (
+    <Providers>
+      <MockAppContextProvider appContext={appContext}>
+        <MockWorkspaceContextProvider>
+          <ResourcesContextProvider>
+            <ConnectMyComputerContextProvider rootClusterUri={doc.clusterUri}>
+              <ConnectionsContextProvider>
+                <VnetContextProvider>{children}</VnetContextProvider>
+              </ConnectionsContextProvider>
+            </ConnectMyComputerContextProvider>
+          </ResourcesContextProvider>
+        </MockWorkspaceContextProvider>
+      </MockAppContextProvider>
+    </Providers>
+  );
+
+  const Component = () => (
+    <Profiler id="unifiedResources" onRender={onRender}>
+      <UnifiedResources
+        clusterUri={doc.clusterUri}
+        docUri={doc.uri}
+        queryParams={doc.queryParams}
+      />
+    </Profiler>
+  );
+
+  const { rerender } = render(<Component />, { wrapper: Wrapper });
+  act(mio.enterAll);
+  // Wait for resources to render.
+  await expect(
+    screen.findByText(serverResource.hostname)
+  ).resolves.toBeInTheDocument();
+  // Disabled because of a false positive.
+  // eslint-disable-next-line testing-library/render-result-naming-convention
+  const renderCountBeforeRerender = renderCount;
+
+  rerender(<Component />);
+  await expect(
+    screen.findByText(serverResource.hostname)
+  ).resolves.toBeInTheDocument();
+  const renderCountDelta = renderCount - renderCountBeforeRerender;
+
+  // When <Resources> is properly memoized and all params passed to it have stable identity,
+  // rerendering the outer <UnifiedResources> with no prop changes should cause only one render
+  // within the tree.
+  expect(renderCountDelta).toEqual(1);
+});
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.tsx b/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.tsx
index 41ebc4ec979f4..70cd7a008da54 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/UnifiedResources.tsx
@@ -36,8 +36,8 @@ import {
 } from 'shared/components/SlidingSidePanel/InfoGuide/const';
 import {
   getResourceAvailabilityFilter,
+  makeTargetHealth,
   ResourceAvailabilityFilter,
-  ResourceStatus,
   SharedUnifiedResource,
   UnifiedResources as SharedUnifiedResources,
   UnifiedResourceDefinition,
@@ -45,12 +45,13 @@ import {
   UnifiedResourcesQueryParams,
   useUnifiedResourcesFetch,
 } from 'shared/components/UnifiedResources';
+import { buildPredicateExpression } from 'shared/components/UnifiedResources/shared/predicateExpression';
 import {
   getResourceId,
   openStatusInfoPanel,
 } from 'shared/components/UnifiedResources/shared/StatusInfo';
 import { Attempt } from 'shared/hooks/useAsync';
-import { NodeSubKind } from 'shared/services';
+import { AppSubKind, NodeSubKind } from 'shared/services';
 import {
   DbProtocol,
   DbType,
@@ -58,7 +59,7 @@ import {
 } from 'shared/services/databases';
 import { waitForever } from 'shared/utils/wait';
 
-import { getAppAddrWithProtocol } from 'teleterm/services/tshd/app';
+import { getAppAddrWithProtocol, isMcp } from 'teleterm/services/tshd/app';
 import { getWindowsDesktopAddrWithoutDefaultPort } from 'teleterm/services/tshd/windowsDesktop';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { useConnectMyComputerContext } from 'teleterm/ui/ConnectMyComputer';
@@ -128,12 +129,14 @@ export function UnifiedResources(props: {
       query: props.queryParams.advancedSearchEnabled
         ? props.queryParams.search
         : '',
+      statuses: props.queryParams.statuses,
     }),
     [
       props.queryParams.advancedSearchEnabled,
       props.queryParams.resourceKinds,
       props.queryParams.search,
       props.queryParams.sort,
+      props.queryParams.statuses,
       unifiedResourcePreferences.defaultTab,
     ]
   );
@@ -190,6 +193,7 @@ export function UnifiedResources(props: {
           newParams.kinds as DocumentClusterResourceKind[];
         queryParams.search = newParams.search || newParams.query;
         queryParams.advancedSearchEnabled = !!newParams.query;
+        queryParams.statuses = newParams.statuses;
       });
     },
     [documentsService, props.docUri]
@@ -308,7 +312,10 @@ const Resources = memo(
                   },
                   search: props.queryParams.search,
                   kinds: props.queryParams.kinds,
-                  query: props.queryParams.query,
+                  query: buildPredicateExpression(
+                    props.queryParams.statuses,
+                    props.queryParams.query
+                  ),
                   pinnedOnly: props.queryParams.pinnedOnly,
                   startKey: paginationParams.startKey,
                   limit: paginationParams.limit,
@@ -332,6 +339,7 @@ const Resources = memo(
           props.queryParams.search,
           props.queryParams.sort.dir,
           props.queryParams.sort.fieldName,
+          props.queryParams.statuses,
           props.clusterUri,
           props.integratedAccessRequests,
         ]
@@ -486,6 +494,10 @@ const Resources = memo(
               kind: 'windows_desktop',
               disabled: false,
             },
+            {
+              kind: 'mcp',
+              disabled: false,
+            },
           ]}
           NoResources={
             <NoResources
@@ -538,10 +550,7 @@ const mapToSharedResource = (
           ).title,
           protocol: database.protocol as DbProtocol,
           requiresRequest: resource.requiresRequest,
-          targetHealth: database.targetHealth && {
-            status: database.targetHealth.status as ResourceStatus,
-            error: database.targetHealth.error,
-          },
+          targetHealth: makeTargetHealth(database.targetHealth),
         },
         ui: {
           ActionButton: <ConnectDatabaseActionButton database={database} />,
@@ -550,13 +559,13 @@ const mapToSharedResource = (
     }
     case 'kube': {
       const { resource: kube } = resource;
-
       return {
         resource: {
           kind: 'kube_cluster' as const,
           labels: kube.labels,
           name: kube.name,
           requiresRequest: resource.requiresRequest,
+          targetHealth: makeTargetHealth(kube.targetHealth),
         },
         ui: {
           ActionButton: <ConnectKubeActionButton kube={kube} />,
@@ -565,6 +574,7 @@ const mapToSharedResource = (
     }
     case 'app': {
       const { resource: app } = resource;
+      const addrWithProtocol = getAppAddrWithProtocol(app);
 
       return {
         resource: {
@@ -572,12 +582,13 @@ const mapToSharedResource = (
           labels: app.labels,
           name: app.name,
           id: app.name,
-          addrWithProtocol: getAppAddrWithProtocol(app),
+          addrWithProtocol: addrWithProtocol,
           awsConsole: app.awsConsole,
           description: app.desc,
           friendlyName: app.friendlyName,
           samlApp: app.samlApp,
           requiresRequest: resource.requiresRequest,
+          subKind: isMcp(app) ? AppSubKind.MCP : undefined,
         },
         ui: {
           ActionButton: <ConnectAppActionButton app={app} />,
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.test.tsx b/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.test.tsx
index 12c220e43632b..3c653eb549f15 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.test.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.test.tsx
@@ -19,6 +19,7 @@
 import { renderHook } from '@testing-library/react';
 
 import { rootClusterUri } from 'teleterm/services/tshd/testHelpers';
+import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
 
 import {
   ResourcesContextProvider,
@@ -28,7 +29,9 @@ import {
 describe('requestResourcesRefresh', () => {
   it('calls listener registered with onResourcesRefreshRequest', () => {
     const wrapper = ({ children }) => (
-      <ResourcesContextProvider>{children}</ResourcesContextProvider>
+      <MockAppContextProvider>
+        <ResourcesContextProvider>{children}</ResourcesContextProvider>
+      </MockAppContextProvider>
     );
     const { result } = renderHook(
       () => ({
@@ -58,7 +61,9 @@ describe('requestResourcesRefresh', () => {
 describe('onResourcesRefreshRequest cleanup function', () => {
   it('removes the listener', () => {
     const wrapper = ({ children }) => (
-      <ResourcesContextProvider>{children}</ResourcesContextProvider>
+      <MockAppContextProvider>
+        <ResourcesContextProvider>{children}</ResourcesContextProvider>
+      </MockAppContextProvider>
     );
     const { result } = renderHook(() => useResourcesContext(rootClusterUri), {
       wrapper,
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.tsx b/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.tsx
index 13c8964127ea8..e5bb664dc8ac5 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/resourcesContext.tsx
@@ -24,9 +24,11 @@ import {
   PropsWithChildren,
   useCallback,
   useContext,
+  useEffect,
   useRef,
 } from 'react';
 
+import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { RootClusterUri } from 'teleterm/ui/uri';
 
 export interface ResourcesContext {
@@ -54,6 +56,7 @@ export interface ResourcesContext {
 const ResourcesContext = createContext<ResourcesContext>(null);
 
 export const ResourcesContextProvider: FC<PropsWithChildren> = props => {
+  const appCtx = useAppContext();
   const emitterRef = useRef<EventEmitter>(undefined);
   if (!emitterRef.current) {
     emitterRef.current = new EventEmitter();
@@ -86,6 +89,12 @@ export const ResourcesContextProvider: FC<PropsWithChildren> = props => {
     []
   );
 
+  useEffect(() => {
+    return appCtx.addResourceRefreshListener(uri => {
+      requestResourcesRefresh(uri);
+    });
+  }, [appCtx, requestResourcesRefresh]);
+
   return (
     <ResourcesContext.Provider
       value={{ requestResourcesRefresh, onResourcesRefreshRequest }}
diff --git a/web/packages/teleterm/src/ui/DocumentDesktopSession/DocumentDesktopSession.tsx b/web/packages/teleterm/src/ui/DocumentDesktopSession/DocumentDesktopSession.tsx
index 9cd24ee1e92f0..29402e81a72f1 100644
--- a/web/packages/teleterm/src/ui/DocumentDesktopSession/DocumentDesktopSession.tsx
+++ b/web/packages/teleterm/src/ui/DocumentDesktopSession/DocumentDesktopSession.tsx
@@ -33,7 +33,7 @@ import Logger from 'teleterm/logger';
 import { MainProcessClient } from 'teleterm/mainProcess/types';
 import { cloneAbortSignal, TshdClient } from 'teleterm/services/tshd';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
-import Document from 'teleterm/ui/Document';
+import Document, { ForegroundSession } from 'teleterm/ui/Document';
 import { useWorkspaceContext } from 'teleterm/ui/Documents';
 import { useWorkspaceLoggedInUser } from 'teleterm/ui/hooks/useLoggedInUser';
 import { useLogger } from 'teleterm/ui/hooks/useLogger';
@@ -51,6 +51,20 @@ const noOtherSession = () => Promise.resolve(false);
 export function DocumentDesktopSession(props: {
   visible: boolean;
   doc: types.DocumentDesktopSession;
+}) {
+  return (
+    <ForegroundSession
+      visible={props.visible}
+      connected={props.doc.status === 'connected'}
+    >
+      <DesktopSessionComponent visible={props.visible} doc={props.doc} />
+    </ForegroundSession>
+  );
+}
+
+function DesktopSessionComponent(props: {
+  visible: boolean;
+  doc: types.DocumentDesktopSession;
 }) {
   const logger = useLogger('DocumentDesktopSession');
   const { desktopUri, login, origin, uri } = props.doc;
@@ -83,10 +97,11 @@ export function DocumentDesktopSession(props: {
             logger
           );
         },
-        makeTshdFileSystem(appCtx.mainProcessClient, {
-          desktopUri,
-          login,
-        })
+        () =>
+          shareDirectoryInTshd(appCtx.mainProcessClient, {
+            desktopUri,
+            login,
+          })
       )
   );
 
@@ -130,6 +145,7 @@ export function DocumentDesktopSession(props: {
         client={client}
         username={login}
         aclAttempt={acl}
+        browserSupportsSharing
       />
     );
   }
@@ -176,7 +192,7 @@ async function adaptGRPCStreamToTdpTransport(
 }
 
 /**
- * The tshd daemon is responsible for handling directory sharing.
+ * Opens a directory picker and then shares the selected directory using tsh daemon.
  *
  * The process begins when the Electron main process opens a directory picker.
  * Once a path is selected, it is passed to tshd via the SetSharedDirectoryForDesktopSession API.
@@ -188,19 +204,16 @@ async function adaptGRPCStreamToTdpTransport(
  * This message is safe to send from the renderer because it only provides
  * a display name for the mounted drive on the remote machine and has no effect on local file system operations.
  */
-function makeTshdFileSystem(
+async function shareDirectoryInTshd(
   mainProcessClient: MainProcessClient,
   target: {
     desktopUri: string;
     login: string;
   }
-): SharedDirectoryAccess {
-  let directoryName = '';
+): Promise<SharedDirectoryAccess> {
+  const directoryName =
+    await mainProcessClient.selectDirectoryForDesktopSession(target);
   return {
-    selectDirectory: async () => {
-      directoryName =
-        await mainProcessClient.selectDirectoryForDesktopSession(target);
-    },
     getDirectoryName: () => directoryName,
     // These functions are unimplemented because all file system operations
     // are handled exclusively by the tsh daemon.
diff --git a/web/packages/teleterm/src/ui/DocumentGateway/DocumentGateway.story.tsx b/web/packages/teleterm/src/ui/DocumentGateway/DocumentGateway.story.tsx
index 6be35eb892d13..703cc51374b9e 100644
--- a/web/packages/teleterm/src/ui/DocumentGateway/DocumentGateway.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentGateway/DocumentGateway.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { ComponentProps } from 'react';
 
 import {
diff --git a/web/packages/teleterm/src/ui/DocumentGatewayApp/AppGateway.tsx b/web/packages/teleterm/src/ui/DocumentGatewayApp/AppGateway.tsx
index f8b75e7576642..3ab35e08ce73d 100644
--- a/web/packages/teleterm/src/ui/DocumentGatewayApp/AppGateway.tsx
+++ b/web/packages/teleterm/src/ui/DocumentGatewayApp/AppGateway.tsx
@@ -87,8 +87,10 @@ export function AppGateway(props: {
   const handleTargetPortChange =
     useDebouncedPortChangeHandler(changeTargetPort);
 
+  const isMcp = gateway.protocol === 'MCP';
+  const isHttpWebApp = gateway.protocol === 'HTTP';
   let address = `${gateway.localAddress}:${gateway.localPort}`;
-  if (gateway.protocol === 'HTTP') {
+  if (isHttpWebApp || isMcp) {
     address = `http://${address}`;
   }
 
@@ -147,6 +149,7 @@ export function AppGateway(props: {
     setUpAppGateway(ctx, targetUri, {
       telemetry: { origin: 'resource_table' },
       targetPort,
+      targetProtocol: gateway.protocol,
     });
   };
 
@@ -162,7 +165,7 @@ export function AppGateway(props: {
     >
       <Flex flexDirection="column" gap={2}>
         <Flex justifyContent="space-between" mb="2" flexWrap="wrap" gap={2}>
-          <H1>App Connection</H1>
+          <H1>{isMcp ? 'MCP Server Connection' : 'App Connection'}</H1>
           <Flex gap={2}>
             {isMultiPort && (
               <MenuLogin
@@ -219,7 +222,11 @@ export function AppGateway(props: {
 
       <Flex flexDirection="column" gap={2}>
         <div>
-          <Text>Access the app at:</Text>
+          <Text>
+            {isMcp
+              ? 'Access the MCP server with a streamable-HTTP-compatible client like "mcp-remote" at:'
+              : 'Access the app at:'}
+          </Text>
           <TextSelectCopy mt={1} text={address} bash={false} />
         </div>
 
diff --git a/web/packages/teleterm/src/ui/DocumentGatewayApp/DocumentGatewayApp.story.tsx b/web/packages/teleterm/src/ui/DocumentGatewayApp/DocumentGatewayApp.story.tsx
index 47144e12f1011..0d1ad3c152fae 100644
--- a/web/packages/teleterm/src/ui/DocumentGatewayApp/DocumentGatewayApp.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentGatewayApp/DocumentGatewayApp.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { Flex } from 'design';
 import { usePromiseRejectedOnUnmount, wait } from 'shared/utils/wait';
@@ -34,7 +34,7 @@ import { MockWorkspaceContextProvider } from 'teleterm/ui/fixtures/MockWorkspace
 import * as types from 'teleterm/ui/services/workspacesService';
 
 type StoryProps = {
-  appType: 'web' | 'tcp' | 'tcp-multi-port';
+  appType: 'web' | 'tcp' | 'tcp-multi-port' | 'mcp';
   online: boolean;
   changeLocalPort: 'succeed' | 'throw-error';
   changeTargetPort: 'succeed' | 'throw-error';
@@ -48,7 +48,7 @@ const meta: Meta<StoryProps> = {
   argTypes: {
     appType: {
       control: { type: 'radio' },
-      options: ['web', 'tcp', 'tcp-multi-port'],
+      options: ['web', 'tcp', 'tcp-multi-port', 'mcp'],
     },
     changeLocalPort: {
       if: { arg: 'online' },
@@ -93,6 +93,9 @@ export function Story(props: StoryProps) {
     gateway.protocol = 'TCP';
     gateway.targetSubresourceName = '4242';
   }
+  if (props.appType === 'mcp') {
+    gateway.protocol = 'MCP';
+  }
   const documentGateway: types.DocumentGateway = {
     kind: 'doc.gateway',
     targetUri: '/clusters/bar/apps/quux',
diff --git a/web/packages/teleterm/src/ui/DocumentGatewayCliClient/DocumentGatewayCliClient.tsx b/web/packages/teleterm/src/ui/DocumentGatewayCliClient/DocumentGatewayCliClient.tsx
index 61d018b54a67c..0eb001bdb97a3 100644
--- a/web/packages/teleterm/src/ui/DocumentGatewayCliClient/DocumentGatewayCliClient.tsx
+++ b/web/packages/teleterm/src/ui/DocumentGatewayCliClient/DocumentGatewayCliClient.tsx
@@ -109,6 +109,8 @@ const WaitingForGateway = (props: {
         name: doc.targetName,
         protocol: doc.targetProtocol,
         dbUser: doc.targetUser,
+        // We don't pass gcpProjectId as target so the target user will not be adjusted,
+        // but it doesn't matter because it was already adjusted when this doc was created.
       },
       { origin: 'reopened_session' }
     );
diff --git a/web/packages/teleterm/src/ui/DocumentTerminal/DocumentTerminal.tsx b/web/packages/teleterm/src/ui/DocumentTerminal/DocumentTerminal.tsx
index 18dddd754a483..5b64e67d5cd35 100644
--- a/web/packages/teleterm/src/ui/DocumentTerminal/DocumentTerminal.tsx
+++ b/web/packages/teleterm/src/ui/DocumentTerminal/DocumentTerminal.tsx
@@ -26,7 +26,7 @@ import {
 import { TerminalSearch } from 'shared/components/TerminalSearch';
 
 import { useAppContext } from 'teleterm/ui/appContextProvider';
-import Document from 'teleterm/ui/Document';
+import Document, { ForegroundSession } from 'teleterm/ui/Document';
 import type * as types from 'teleterm/ui/services/workspacesService';
 
 import { Reconnect } from './Reconnect';
@@ -37,6 +37,22 @@ import { useTshFileTransferHandlers } from './useTshFileTransferHandlers';
 export function DocumentTerminal(props: {
   doc: types.DocumentTerminal;
   visible: boolean;
+}) {
+  return (
+    <ForegroundSession
+      visible={props.visible}
+      // Treat the terminal document as connected, so they will always be
+      // unmounted when the window is the background.
+      connected
+    >
+      <TerminalComponent visible={props.visible} doc={props.doc} />
+    </ForegroundSession>
+  );
+}
+
+function TerminalComponent(props: {
+  doc: types.DocumentTerminal;
+  visible: boolean;
 }) {
   const ctx = useAppContext();
   const { configService } = ctx.mainProcessClient;
diff --git a/web/packages/teleterm/src/ui/DocumentTerminal/useDocumentTerminal.ts b/web/packages/teleterm/src/ui/DocumentTerminal/useDocumentTerminal.ts
index 2940ec4fb65b6..3dbe545a1c7e1 100644
--- a/web/packages/teleterm/src/ui/DocumentTerminal/useDocumentTerminal.ts
+++ b/web/packages/teleterm/src/ui/DocumentTerminal/useDocumentTerminal.ts
@@ -184,9 +184,6 @@ async function setUpPtyProcess(
     refreshTitle();
   });
 
-  // TODO(ravicious): Refactor runOnce to not use the `n` variable. Otherwise runOnce subtracts 1
-  // from n each time the resulting function is executed, which in this context means each time data
-  // is transferred from PTY.
   const markDocumentAsConnectedOnce = runOnce(() => {
     if ('status' in doc) {
       documentsService.update(doc.uri, { status: 'connected' });
@@ -204,15 +201,12 @@ async function setUpPtyProcess(
 
   ptyProcess.onExit(event => {
     // Not closing the tab on non-zero exit code lets us show the error to the user if, for example,
-    // tsh ssh cannot connect to the given node.
+    // tsh ssh couldn't connect to the given node.
     //
-    // The downside of this is that if you open a local shell, then execute a command that fails
-    // (for example, `cd` to a nonexistent directory), and then try to execute `exit` or press
-    // Ctrl + D, the tab won't automatically close, because the last exit code is not zero.
-    //
-    // We can look up how the terminal in vscode handles this problem, since in the scenario
-    // described above they do close the tab correctly.
-    if (event.exitCode === 0) {
+    // We also have to account for Ctrl+D, as executing it makes the shell exit with the last
+    // reported exit code. If we depended on the exit code alone, it'd mean that the terminal tab
+    // wouldn't close if Ctrl+D followed a command that failed, say cd to a nonexistent directory.
+    if (event.exitCode === 0 || event.lastInput === /* Ctrl+D */ '\x04') {
       documentsService.close(doc.uri);
     }
   });
diff --git a/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.story.tsx b/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.story.tsx
index 126f8703e7ffa..c69d425178936 100644
--- a/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.story.tsx
+++ b/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.story.tsx
@@ -16,8 +16,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
-
 import { DocumentsReopen } from './DocumentsReopen';
 
 export default {
@@ -26,55 +24,47 @@ export default {
 
 export const Story = () => {
   return (
-    <MockAppContextProvider>
-      <DocumentsReopen
-        rootClusterUri="/clusters/foo.cloud.gravitational.io"
-        numberOfDocuments={8}
-        onConfirm={() => {}}
-        onDiscard={() => {}}
-      />
-    </MockAppContextProvider>
+    <DocumentsReopen
+      rootClusterUri="/clusters/foo.cloud.gravitational.io"
+      numberOfDocuments={8}
+      onConfirm={() => {}}
+      onDiscard={() => {}}
+    />
   );
 };
 
 export const OneTab = () => {
   return (
-    <MockAppContextProvider>
-      <DocumentsReopen
-        rootClusterUri="/clusters/foo.cloud.gravitational.io"
-        numberOfDocuments={1}
-        onConfirm={() => {}}
-        onDiscard={() => {}}
-      />
-    </MockAppContextProvider>
+    <DocumentsReopen
+      rootClusterUri="/clusters/foo.cloud.gravitational.io"
+      numberOfDocuments={1}
+      onConfirm={() => {}}
+      onDiscard={() => {}}
+    />
   );
 };
 
 export const LongClusterName = () => {
   return (
-    <MockAppContextProvider>
-      <DocumentsReopen
-        rootClusterUri="/clusters/foo.bar.baz.quux.cloud.gravitational.io"
-        numberOfDocuments={42}
-        onConfirm={() => {}}
-        onDiscard={() => {}}
-      />
-    </MockAppContextProvider>
+    <DocumentsReopen
+      rootClusterUri="/clusters/foo.bar.baz.quux.cloud.gravitational.io"
+      numberOfDocuments={42}
+      onConfirm={() => {}}
+      onDiscard={() => {}}
+    />
   );
 };
 
 export const LongContinuousClusterName = () => {
   return (
-    <MockAppContextProvider>
-      <DocumentsReopen
-        rootClusterUri={`/clusters/${Array(10)
-          .fill(['foo', 'bar', 'baz', 'quux'], 0)
-          .flat()
-          .join('')}`}
-        numberOfDocuments={680}
-        onConfirm={() => {}}
-        onDiscard={() => {}}
-      />
-    </MockAppContextProvider>
+    <DocumentsReopen
+      rootClusterUri={`/clusters/${Array(10)
+        .fill(['foo', 'bar', 'baz', 'quux'], 0)
+        .flat()
+        .join('')}`}
+      numberOfDocuments={680}
+      onConfirm={() => {}}
+      onDiscard={() => {}}
+    />
   );
 };
diff --git a/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.tsx b/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.tsx
index 477a35d95b665..348af0fc0eb75 100644
--- a/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.tsx
+++ b/web/packages/teleterm/src/ui/DocumentsReopen/DocumentsReopen.tsx
@@ -26,7 +26,6 @@ import { Cross } from 'design/Icon';
 import { P } from 'design/Text/Text';
 import { pluralize } from 'shared/utils/text';
 
-import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { RootClusterUri, routing } from 'teleterm/ui/uri';
 
 export function DocumentsReopen(props: {
@@ -37,12 +36,7 @@ export function DocumentsReopen(props: {
   hidden?: boolean;
 }) {
   const { rootClusterUri } = props;
-  const { clustersService } = useAppContext();
-  // TODO(ravicious): Use a profile name here from the URI and remove the dependency on
-  // clustersService. https://github.com/gravitational/teleport/issues/33733
-  const clusterName =
-    clustersService.findCluster(rootClusterUri)?.name ||
-    routing.parseClusterName(rootClusterUri);
+  const clusterName = routing.parseClusterName(rootClusterUri);
 
   return (
     <DialogConfirmation
@@ -60,12 +54,8 @@ export function DocumentsReopen(props: {
           props.onConfirm();
         }}
       >
-        <DialogHeader
-          justifyContent="space-between"
-          mb={0}
-          alignItems="baseline"
-        >
-          <H2 mb={4}>Reopen previous session</H2>
+        <DialogHeader justifyContent="space-between" alignItems="baseline">
+          <H2>Reopen previous session</H2>
           <ButtonIcon
             type="button"
             onClick={props.onDiscard}
@@ -76,16 +66,14 @@ export function DocumentsReopen(props: {
           </ButtonIcon>
         </DialogHeader>
         <DialogContent mb={4}>
-          <P color="text.slightlyMuted">
-            Do you want to reopen tabs from the previous session?
-          </P>
           <P
-            color="text.slightlyMuted"
             // Split long continuous cluster names into separate lines.
             css={`
               word-wrap: break-word;
             `}
           >
+            Do you want to reopen tabs from the previous session?
+            <br />
             {/*
               We show this mostly because we needed to show the cluster name somewhere during UI
               initialization. When you open the app and have some tabs to restore, the UI will show
diff --git a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
index addefcffb6480..6580784b5922f 100644
--- a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
+++ b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
@@ -22,6 +22,7 @@ import { HeadlessAuthenticationState } from 'gen-proto-ts/teleport/lib/teleterm/
 import { useAsync } from 'shared/hooks/useAsync';
 
 import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
+import { rootClusterUri } from 'teleterm/services/tshd/testHelpers';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { RootClusterUri } from 'teleterm/ui/uri';
 
@@ -38,9 +39,8 @@ interface HeadlessAuthenticationProps {
 }
 
 export function HeadlessAuthentication(props: HeadlessAuthenticationProps) {
-  const { headlessAuthenticationService, clustersService } = useAppContext();
+  const { headlessAuthenticationService } = useAppContext();
   const refAbortCtrl = useRef(new AbortController());
-  const cluster = clustersService.findCluster(props.rootClusterUri);
 
   const [updateHeadlessStateAttempt, updateHeadlessState] = useAsync(
     (state: HeadlessAuthenticationState) =>
@@ -81,7 +81,7 @@ export function HeadlessAuthentication(props: HeadlessAuthenticationProps) {
   return (
     <HeadlessPrompt
       hidden={props.hidden}
-      cluster={cluster}
+      rootClusterUri={rootClusterUri}
       clientIp={props.clientIp}
       skipConfirm={props.skipConfirm}
       onApprove={handleHeadlessApprove}
diff --git a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.story.tsx b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.story.tsx
index c212389989fe2..3bbe7804efc16 100644
--- a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.story.tsx
+++ b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.story.tsx
@@ -18,7 +18,7 @@
 
 import { makeEmptyAttempt } from 'shared/hooks/useAsync';
 
-import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { rootClusterUri } from 'teleterm/services/tshd/testHelpers';
 
 import { HeadlessPrompt } from './HeadlessPrompt';
 
@@ -28,7 +28,7 @@ export default {
 
 export const Story = () => (
   <HeadlessPrompt
-    cluster={makeRootCluster()}
+    rootClusterUri={rootClusterUri}
     clientIp="localhost"
     skipConfirm={false}
     onApprove={async () => {}}
diff --git a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.tsx b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.tsx
index 29a3732033ec3..824440e2ca463 100644
--- a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.tsx
+++ b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessPrompt/HeadlessPrompt.tsx
@@ -37,12 +37,12 @@ import * as Icons from 'design/Icon';
 import { P, P3 } from 'design/Text/Text';
 import { Attempt } from 'shared/hooks/useAsync';
 
-import type * as tsh from 'teleterm/services/tshd/types';
 import svgHardwareKey from 'teleterm/ui/ClusterConnect/ClusterLogin/FormLogin/PromptPasswordless/hardware.svg';
 import { LinearProgress } from 'teleterm/ui/components/LinearProgress';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
 
 export type HeadlessPromptProps = {
-  cluster: tsh.Cluster;
+  rootClusterUri: RootClusterUri;
   clientIp: string;
   skipConfirm: boolean;
   onApprove(): Promise<void>;
@@ -62,7 +62,7 @@ export type HeadlessPromptProps = {
 };
 
 export function HeadlessPrompt({
-  cluster,
+  rootClusterUri,
   clientIp,
   skipConfirm,
   onApprove,
@@ -88,7 +88,7 @@ export function HeadlessPrompt({
     >
       <DialogHeader justifyContent="space-between" mb={0} alignItems="baseline">
         <H2 mb={4}>
-          Headless command on <b>{cluster.name}</b>
+          Headless command on <b>{routing.parseClusterName(rootClusterUri)}</b>
         </H2>
         <ButtonIcon
           type="button"
@@ -107,17 +107,17 @@ export function HeadlessPrompt({
         </Alerts.Danger>
       )}
       <DialogContent>
-        <P color="text.slightlyMuted">
+        <P>
           Someone initiated a headless command from <b>{clientIp}</b>.
         </P>
         <P>If it was not you, click Reject and contact your administrator.</P>
-        <P3 color="text.muted">Request ID: {headlessAuthenticationId}</P3>
+        <P3 color="text.slightlyMuted">
+          Request ID: {headlessAuthenticationId}
+        </P3>
       </DialogContent>
       {waitForMfa && (
         <DialogContent mb={2}>
-          <Text color="text.slightlyMuted">
-            Complete MFA verification to approve the Headless Login.
-          </Text>
+          <P>Complete MFA verification to approve the Headless Login.</P>
 
           <Image mt={4} mb={4} width="200px" src={svgHardwareKey} mx="auto" />
           <Box textAlign="center" style={{ position: 'relative' }}>
diff --git a/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx b/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
index e5fd1b58b97ef..005724559aa0a 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
@@ -27,6 +27,8 @@ import { Dialog } from 'teleterm/ui/services/modals';
 import { ClusterLogout } from '../ClusterLogout';
 import { ResourceSearchErrors } from '../Search/ResourceSearchErrors';
 import { assertUnreachable } from '../utils';
+import { ConfigureSSHClients } from '../Vnet/ConfigureSSHClients';
+import { AppUpdates } from './modals/AppUpdates';
 import { ChangeAccessRequestKind } from './modals/ChangeAccessRequestKind';
 import { AskPin, ChangePin, OverwriteSlot, Touch } from './modals/HardwareKeys';
 import { ReAuthenticate } from './modals/ReAuthenticate';
@@ -106,7 +108,6 @@ function renderDialog({
         <ClusterLogout
           hidden={hidden}
           clusterUri={dialog.clusterUri}
-          clusterTitle={dialog.clusterTitle}
           onClose={handleClose}
         />
       );
@@ -281,6 +282,20 @@ function renderDialog({
         />
       );
     }
+    case 'configure-ssh-clients': {
+      return (
+        <ConfigureSSHClients
+          hidden={hidden}
+          onConfirm={dialog.onConfirm}
+          onClose={handleClose}
+          vnetSSHConfigPath={dialog.vnetSSHConfigPath}
+          host={dialog.host}
+        />
+      );
+    }
+    case 'app-updates': {
+      return <AppUpdates hidden={hidden} onClose={() => handleClose()} />;
+    }
 
     default: {
       return assertUnreachable(dialog);
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/AppUpdates.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/AppUpdates.tsx
new file mode 100644
index 0000000000000..ad44154bab917
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/AppUpdates.tsx
@@ -0,0 +1,87 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo } from 'react';
+
+import { ButtonIcon, H2 } from 'design';
+import DialogConfirmation, {
+  DialogContent,
+  DialogHeader,
+} from 'design/DialogConfirmation';
+import { Cross } from 'design/Icon';
+
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { DetailsView, useAppUpdaterContext } from 'teleterm/ui/AppUpdater';
+
+export function AppUpdates(props: { hidden?: boolean; onClose(): void }) {
+  const appContext = useAppContext();
+  const { updateEvent } = useAppUpdaterContext();
+
+  const {
+    checkForAppUpdates,
+    downloadAppUpdate,
+    cancelAppUpdateDownload,
+    quitAndInstallAppUpdate,
+    changeAppUpdatesManagingCluster,
+  } = appContext.mainProcessClient;
+
+  useEffect(() => {
+    void checkForAppUpdates();
+  }, [checkForAppUpdates]);
+
+  const platform = useMemo(() => {
+    return appContext.mainProcessClient.getRuntimeSettings().platform;
+  }, [appContext.mainProcessClient]);
+
+  return (
+    <DialogConfirmation
+      open={!props.hidden}
+      keepInDOMAfterClose
+      onClose={props.onClose}
+      dialogCss={() => ({
+        maxWidth: '420px',
+        width: '100%',
+      })}
+    >
+      <DialogHeader justifyContent="space-between" mb={3} alignItems="baseline">
+        <H2>App Updates</H2>
+        <ButtonIcon
+          type="button"
+          onClick={props.onClose}
+          color="text.slightlyMuted"
+        >
+          <Cross size="medium" />
+        </ButtonIcon>
+      </DialogHeader>
+
+      <DialogContent mb={0}>
+        <DetailsView
+          platform={platform}
+          updateEvent={updateEvent}
+          onCancelDownload={() => void cancelAppUpdateDownload()}
+          onDownload={() => void downloadAppUpdate()}
+          onCheckForUpdates={() => void checkForAppUpdates()}
+          onInstall={() => void quitAndInstallAppUpdate()}
+          changeManagingCluster={clusterUri =>
+            void changeAppUpdatesManagingCluster(clusterUri)
+          }
+        />
+      </DialogContent>
+    </DialogConfirmation>
+  );
+}
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/ChangeAccessRequestKind/ChangeAccessRequestKind.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/ChangeAccessRequestKind/ChangeAccessRequestKind.tsx
index d899c1030a843..bd218e26be53d 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/ChangeAccessRequestKind/ChangeAccessRequestKind.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/ChangeAccessRequestKind/ChangeAccessRequestKind.tsx
@@ -50,7 +50,7 @@ export function ChangeAccessRequestKind({
           <Cross size="small" />
         </ButtonIcon>
       </DialogHeader>
-      <DialogContent mb={4} color="text.slightlyMuted">
+      <DialogContent mb={4}>
         <P>
           Resource Access Request cannot be combined with Role Access Request.
           The current items will be cleared.
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/ChangePin.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/ChangePin.tsx
index efd87cb6f9a5e..a5173ff2dcfe9 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/ChangePin.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/ChangePin.tsx
@@ -83,11 +83,11 @@ export function ChangePin(props: {
 
             <DialogContent mb={4}>
               <Flex flexDirection="column" gap={4} alignItems="flex-start">
-                <P2 color="text.slightlyMuted">
+                <P2>
                   The default PIV PIN is not allowed.
                   <br />
                   Please set a new PIV PIN for your hardware key before
-                  proceeding. Both the PIN and PUK must be 4-6 characters long.
+                  proceeding. Both the PIN and PUK must be 6–8 characters long.
                 </P2>
 
                 <FieldInput
@@ -100,7 +100,7 @@ export function ChangePin(props: {
                   rule={requiredAll(
                     requiredField('New PIV PIN is required'),
                     notDefaultPin(),
-                    correctLength('PIV PIN must be 4-6 characters long')
+                    correctLength('PIV PIN must be 6–8 characters long')
                   )}
                 />
                 <FieldInput
@@ -115,11 +115,11 @@ export function ChangePin(props: {
                       doesNotMatch: 'PIV PIN does not match',
                     }),
                     notDefaultPin(),
-                    correctLength('PIV PIN must be 4-6 characters long')
+                    correctLength('PIV PIN must be 6–8 characters long')
                   )}
                 />
 
-                <P2 color="text.slightlyMuted">
+                <P2>
                   To change the PIN, please provide your PUK code.
                   <br />
                   For security purposes, the default PUK ({DEFAULT_PUK}) cannot
@@ -145,7 +145,7 @@ export function ChangePin(props: {
                     rule={requiredAll(
                       requiredField('PUK is required'),
                       notDefaultPuk(),
-                      correctLength('PUK must be 4-6 characters long')
+                      correctLength('PUK must be 6–8 characters long')
                     )}
                   />
                 ) : (
@@ -159,7 +159,7 @@ export function ChangePin(props: {
                       rule={requiredAll(
                         requiredField('New PUK is required'),
                         notDefaultPuk(),
-                        correctLength('PUK must be 4-6 characters long')
+                        correctLength('PUK must be 6–8 characters long')
                       )}
                     />
                     <FieldInput
@@ -169,12 +169,12 @@ export function ChangePin(props: {
                       onChange={e => setConfirmNewPuk(e.target.value)}
                       mb={0}
                       rule={requiredAll(
-                        requiredConfirmed(pin, {
+                        requiredConfirmed(newPuk, {
                           confirm: 'Confirm New PUK is required',
                           doesNotMatch: 'PUK does not match',
                         }),
                         notDefaultPuk(),
-                        correctLength('PUK must be 4-6 characters long')
+                        correctLength('PUK must be 6–8 characters long')
                       )}
                     />
                   </>
@@ -221,7 +221,7 @@ const correctLength =
   value =>
   () => {
     const valid =
-      typeof value === 'string' && value.length >= 4 && value.length <= 6;
+      typeof value === 'string' && value.length >= 6 && value.length <= 8;
     return {
       valid,
       message: !valid ? message : '',
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/OverwriteSlot.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/OverwriteSlot.tsx
index 9fae47d0a8def..71253a7d60194 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/OverwriteSlot.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/OverwriteSlot.tsx
@@ -53,7 +53,7 @@ export function OverwriteSlot(props: {
         />
 
         <DialogContent mb={4}>
-          <P2 color="text.slightlyMuted">{props.req.message}</P2>
+          <P2>{props.req.message}</P2>
         </DialogContent>
 
         <DialogFooter>
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/index.story.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/index.story.tsx
index 485746c5b9648..1c8594d8772b1 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/index.story.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/HardwareKeys/index.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
 
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
index 796217499f969..e976ad25187d8 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
@@ -77,22 +77,17 @@ export const ReAuthenticate: FC<{
 
   const { clusterUri } = req;
   const { clustersService } = useAppContext();
-  // TODO(ravicious): Use a profile name here from the URI and remove the dependency on
-  // clustersService. https://github.com/gravitational/teleport/issues/33733
   const rootClusterUri = routing.ensureRootClusterUri(clusterUri);
   const rootCluster = clustersService.findRootClusterByResource(rootClusterUri);
-  const rootClusterName =
-    rootCluster?.name || routing.parseClusterName(rootClusterUri);
+  const rootClusterName = routing.parseClusterName(rootClusterUri);
   const rootClusterProxyHost =
     // As a fallback, we read the proxy hostname from the URI. One small issue is that URIs don't
     // include the port number, so if the actual proxy host has a port number other than 443,
     // rootClusterProxyHost will not point to the proxy service.
     // In practice though we should not end up in a situation where this modal is shown but the
     // cluster does not exist in the app.
-    rootCluster?.proxyHost || routing.parseClusterName(rootClusterUri);
-  const clusterName =
-    clustersService.findCluster(clusterUri)?.name ||
-    routing.parseClusterName(clusterUri);
+    rootCluster?.proxyHost || rootClusterName;
+  const clusterName = routing.parseClusterName(clusterUri);
   const isLeafCluster = routing.isLeafCluster(clusterUri);
 
   let $totpPrompt = (
@@ -170,7 +165,7 @@ export const ReAuthenticate: FC<{
 
             <DialogContent mb={4}>
               <Flex flexDirection="column" gap={4} alignItems="flex-start">
-                <Text color="text.slightlyMuted">
+                <Text>
                   {req.reason}
                   {isLeafCluster && ` from trusted cluster "${clusterName}"`}
                 </Text>
@@ -209,7 +204,9 @@ export const ReAuthenticate: FC<{
                   </>
                 )}
 
-                {selectedMfaType.value === 'sso' && <PromptSsoStatus />}
+                {selectedMfaType.value === 'sso' && (
+                  <PromptSsoStatus ssoPrompt="follow-browser-steps" />
+                )}
               </Flex>
             </DialogContent>
 
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/UsageData/UsageData.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/UsageData/UsageData.tsx
index f3f708c818195..cb6f67949eb70 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/UsageData/UsageData.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/UsageData/UsageData.tsx
@@ -62,11 +62,11 @@ export function UsageData(props: {
           </ButtonIcon>
         </DialogHeader>
         <DialogContent mb={4}>
-          <P color="text.slightlyMuted">
+          <P>
             Do you agree to Teleport Connect collecting anonymized usage data?
             This will help us improve the product.
           </P>
-          <P color="text.slightlyMuted">
+          <P>
             To learn more, see{' '}
             <Link
               href="https://goteleport.com/docs/faq/#teleport-connect"
diff --git a/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx b/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
index b7d7c4dcdb428..ed57077fdb8b4 100644
--- a/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
+++ b/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
@@ -26,6 +26,7 @@ import {
   makeRetryableError,
   makeRootCluster,
 } from 'teleterm/services/tshd/testHelpers';
+import { AppUpdaterContextProvider } from 'teleterm/ui/AppUpdater';
 import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
 import ModalsHost from 'teleterm/ui/ModalsHost';
@@ -321,12 +322,14 @@ it('shows a login modal when a request to a cluster from the current workspace f
 
   render(
     <MockAppContextProvider appContext={appContext}>
-      <ConnectionsContextProvider>
-        <VnetContextProvider>
-          <SearchBarConnected />
-          <ModalsHost />
-        </VnetContextProvider>
-      </ConnectionsContextProvider>
+      <AppUpdaterContextProvider>
+        <ConnectionsContextProvider>
+          <VnetContextProvider>
+            <SearchBarConnected />
+            <ModalsHost />
+          </VnetContextProvider>
+        </ConnectionsContextProvider>
+      </AppUpdaterContextProvider>
     </MockAppContextProvider>
   );
 
diff --git a/web/packages/teleterm/src/ui/Search/SearchContext.test.tsx b/web/packages/teleterm/src/ui/Search/SearchContext.test.tsx
index ef30cd17b26c7..a05dadb0d322a 100644
--- a/web/packages/teleterm/src/ui/Search/SearchContext.test.tsx
+++ b/web/packages/teleterm/src/ui/Search/SearchContext.test.tsx
@@ -260,6 +260,7 @@ test('search bar state is adjusted to the active document', () => {
         resourceKinds: ['db'],
         sort: { dir: 'ASC', fieldName: 'name' },
         advancedSearchEnabled: true,
+        statuses: ['healthy'],
       },
     });
     docService.add(clusterDoc);
@@ -281,6 +282,7 @@ test('search bar state is adjusted to the active document', () => {
         resourceKinds: ['kube_cluster'],
         sort: { dir: 'ASC', fieldName: 'name' },
         advancedSearchEnabled: false,
+        statuses: [],
       },
     });
     docService.add(clusterDoc);
@@ -316,6 +318,7 @@ test('search bar state is adjusted to the active document', () => {
         resourceKinds: ['kube_cluster'],
         sort: { dir: 'ASC', fieldName: 'name' },
         advancedSearchEnabled: false,
+        statuses: [],
       },
     });
     docService.add(clusterDoc);
diff --git a/web/packages/teleterm/src/ui/Search/actions.tsx b/web/packages/teleterm/src/ui/Search/actions.tsx
index 559aa71b28f47..56957617559b2 100644
--- a/web/packages/teleterm/src/ui/Search/actions.tsx
+++ b/web/packages/teleterm/src/ui/Search/actions.tsx
@@ -31,7 +31,7 @@ import { ResourceRequest } from 'teleterm/ui/services/workspacesService/accessRe
 import { IAppContext } from 'teleterm/ui/types';
 import { routing } from 'teleterm/ui/uri';
 import { assertUnreachable, retryWithRelogin } from 'teleterm/ui/utils';
-import { VnetAppLauncher } from 'teleterm/ui/Vnet';
+import { VnetLauncher } from 'teleterm/ui/Vnet';
 
 export interface SimpleAction {
   type: 'simple-action';
@@ -73,7 +73,7 @@ export type SearchAction = SimpleAction | ParametrizedAction;
 
 export function mapToAction(
   ctx: IAppContext,
-  launchVnet: VnetAppLauncher,
+  launchVnet: VnetLauncher,
   searchContext: SearchContext,
   result: SearchResult
 ): SearchAction {
@@ -91,15 +91,11 @@ export function mapToAction(
         type: 'parametrized-action',
         searchResult: result,
         parameter: {
-          getSuggestions: async () => {
-            const sshLogins = ctx.clustersService.findClusterByResource(
-              result.resource.uri
-            )?.loggedInUser?.sshLogins;
-            return sshLogins?.map(login => ({
+          getSuggestions: async () =>
+            result.resource.logins.map(login => ({
               value: login,
               displayText: login,
-            }));
-          },
+            })),
           placeholder: 'Provide login',
         },
         perform: login => {
@@ -208,13 +204,14 @@ export function mapToAction(
           placeholder: 'Provide db username',
         },
         perform: dbUser => {
-          const { uri, name, protocol } = result.resource;
+          const { uri, name, protocol, gcpProjectId } = result.resource;
           return connectToDatabase(
             ctx,
             {
               uri,
               name,
               protocol,
+              gcpProjectId,
               dbUser: dbUser.value,
             },
             {
diff --git a/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.tsx b/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.tsx
index ece5225033a59..dc75ff79f331e 100644
--- a/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.tsx
+++ b/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.tsx
@@ -20,6 +20,7 @@ import React, { ReactElement, useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 
 import { Box, ButtonBorder, Label as DesignLabel, Flex, Text } from 'design';
+import { makeLabelTag } from 'design/formatters';
 import * as icons from 'design/Icon';
 import { Cross as CloseIcon } from 'design/Icon';
 import { App } from 'gen-proto-ts/teleport/lib/teleterm/v1/app_pb';
@@ -68,7 +69,7 @@ import { useActionAttempts } from './useActionAttempts';
 
 export function ActionPicker(props: { input: ReactElement }) {
   const ctx = useAppContext();
-  const { clustersService, modalsService } = ctx;
+  const { clustersService, modalsService, mainProcessClient } = ctx;
   ctx.clustersService.useState();
 
   const {
@@ -92,12 +93,19 @@ export function ActionPicker(props: { input: ReactElement }) {
   const { isSupported: isVnetSupported } = useVnetContext();
   const totalCountOfClusters = clustersService.getClusters().length;
 
+  // Use memo because this value never changes during app's lifetime but the call to get it goes
+  // through the context bridge.
+  const isScoreDebugEnabled = useMemo(
+    () => mainProcessClient.configService.get('debug.searchResultsScore').value,
+    [mainProcessClient.configService]
+  );
+
   const getClusterName = useCallback(
     (resourceUri: uri.ClusterOrResourceUri) => {
       const clusterUri = uri.routing.ensureClusterUri(resourceUri);
       const cluster = clustersService.findCluster(clusterUri);
-
-      return cluster ? cluster.name : uri.routing.parseClusterName(resourceUri);
+      // Name is empty if the user hasn't logged into that cluster yet.
+      return cluster?.name || uri.routing.parseClusterName(resourceUri);
     },
     [clustersService]
   );
@@ -212,11 +220,17 @@ export function ActionPicker(props: { input: ReactElement }) {
           return {
             key: getKey(item.searchResult),
             Component: (
-              <Component
-                searchResult={item.searchResult}
-                getOptionalClusterName={getOptionalClusterName}
-                isVnetSupported={isVnetSupported}
-              />
+              <>
+                {isScoreDebugEnabled &&
+                item.searchResult.kind !== 'display-results'
+                  ? item.searchResult.score
+                  : undefined}
+                <Component
+                  searchResult={item.searchResult}
+                  getOptionalClusterName={getOptionalClusterName}
+                  isVnetSupported={isVnetSupported}
+                />
+              </>
             ),
           };
         }}
@@ -1125,11 +1139,7 @@ function Label(props: {
     .map(match => match.searchTerm);
 
   return (
-    <DesignLabel
-      key={label.name}
-      kind="secondary"
-      title={`${label.name}: ${label.value}`}
-    >
+    <DesignLabel key={label.name} kind="secondary" title={makeLabelTag(label)}>
       <Highlight text={label.name} keywords={nameMatches} />:{' '}
       <Highlight text={label.value} keywords={valueMatches} />
     </DesignLabel>
diff --git a/web/packages/teleterm/src/ui/Search/pickers/useActionAttempts.ts b/web/packages/teleterm/src/ui/Search/pickers/useActionAttempts.ts
index 0b31754da7115..d94527ad833df 100644
--- a/web/packages/teleterm/src/ui/Search/pickers/useActionAttempts.ts
+++ b/web/packages/teleterm/src/ui/Search/pickers/useActionAttempts.ts
@@ -28,6 +28,7 @@ import { makeEmptyAttempt, mapAttempt, useAsync } from 'shared/hooks/useAsync';
 import { debounce } from 'shared/utils/highbar';
 
 import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
 import { mapToAction } from 'teleterm/ui/Search/actions';
 import { useSearchContext } from 'teleterm/ui/Search/SearchContext';
 import { SearchFilter } from 'teleterm/ui/Search/searchResult';
@@ -38,7 +39,7 @@ import {
 } from 'teleterm/ui/Search/useSearch';
 import { routing } from 'teleterm/ui/uri';
 import { isRetryable } from 'teleterm/ui/utils/retryWithRelogin';
-import { useVnetAppLauncher, useVnetContext } from 'teleterm/ui/Vnet';
+import { useVnetContext, useVnetLauncher } from 'teleterm/ui/Vnet';
 
 import { useDisplayResults } from './useDisplayResults';
 
@@ -48,8 +49,19 @@ export function useActionAttempts() {
   const searchContext = useSearchContext();
   const { inputValue, filters, pauseUserInteraction } = searchContext;
   const { isSupported: isVnetSupported } = useVnetContext();
-  const vnetLauncher = useVnetAppLauncher();
+  const vnetLauncher = useVnetLauncher();
   const launchVnet = isVnetSupported ? vnetLauncher.launchVnet : undefined;
+  const workspaceUri = useStoreSelector(
+    'workspacesService',
+    useCallback(state => state.rootClusterUri, [])
+  );
+  const localClusterUri = useStoreSelector(
+    'workspacesService',
+    useCallback(
+      state => state.workspaces[state.rootClusterUri]?.localClusterUri,
+      []
+    )
+  );
 
   const [resourceSearchAttempt, runResourceSearch, setResourceSearchAttempt] =
     useAsync(useResourceSearch());
@@ -127,11 +139,18 @@ export function useActionAttempts() {
   const resourceActionsAttempt = useMemo(
     () =>
       mapAttempt(resourceSearchAttempt, ({ results, search }) =>
-        rankResults(results, search).map(result =>
-          mapToAction(ctx, launchVnet, searchContext, result)
+        rankResults(results, search, { workspaceUri, localClusterUri }).map(
+          result => mapToAction(ctx, launchVnet, searchContext, result)
         )
       ),
-    [ctx, resourceSearchAttempt, searchContext, launchVnet]
+    [
+      ctx,
+      resourceSearchAttempt,
+      searchContext,
+      launchVnet,
+      workspaceUri,
+      localClusterUri,
+    ]
   );
 
   const runFilterSearch = useFilterSearch();
diff --git a/web/packages/teleterm/src/ui/Search/useSearch.test.tsx b/web/packages/teleterm/src/ui/Search/useSearch.test.tsx
index 9c32610705483..5a10b03f43968 100644
--- a/web/packages/teleterm/src/ui/Search/useSearch.test.tsx
+++ b/web/packages/teleterm/src/ui/Search/useSearch.test.tsx
@@ -20,16 +20,19 @@ import { renderHook } from '@testing-library/react';
 
 import { ShowResources } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
 
+import { getAppAddrWithProtocol } from 'teleterm/services/tshd/app';
 import {
+  makeApp,
   makeKube,
   makeLabelsList,
   makeLeafCluster,
   makeRootCluster,
   makeServer,
+  rootClusterUri,
 } from 'teleterm/services/tshd/testHelpers';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
-import { SearchResult } from 'teleterm/ui/services/resources';
-import { ServerUri } from 'teleterm/ui/uri';
+import { SearchResult, SearchResultApp } from 'teleterm/ui/services/resources';
+import { routing, ServerUri, Params as UriParams } from 'teleterm/ui/uri';
 
 import { MockAppContextProvider } from '../fixtures/MockAppContextProvider';
 import { makeResourceResult } from './testHelpers';
@@ -39,6 +42,11 @@ beforeEach(() => {
   jest.restoreAllMocks();
 });
 
+const currentWorkspace = {
+  workspaceUri: rootClusterUri,
+  localClusterUri: rootClusterUri,
+};
+
 describe('rankResults', () => {
   it('uses the displayed resource name as the tie breaker if the scores are equal', () => {
     const server = makeResourceResult({
@@ -49,10 +57,10 @@ describe('rankResults', () => {
       kind: 'kube',
       resource: makeKube({ name: 'a' }),
     });
-    const sortedResults = rankResults([server, kube], '');
+    const sortedResults = rankResults([server, kube], '', currentWorkspace);
 
-    expect(sortedResults[0]).toEqual(kube);
-    expect(sortedResults[1]).toEqual(server);
+    expect(sortedResults[0].resource.uri).toEqual(kube.resource.uri);
+    expect(sortedResults[1].resource.uri).toEqual(server.resource.uri);
   });
 
   it('prefers accessible resources over requestable ones', () => {
@@ -74,7 +82,8 @@ describe('rankResults', () => {
     });
     const sortedResults = rankResults(
       [labelMatch, serverRequestable, serverAccessible],
-      'sales'
+      'sales',
+      currentWorkspace
     );
 
     expect(sortedResults[0].resource).toEqual(serverAccessible.resource);
@@ -90,7 +99,11 @@ describe('rankResults', () => {
       }),
     });
 
-    const { labelMatches } = rankResults([server], 'foo bar')[0];
+    const { labelMatches } = rankResults(
+      [server],
+      'foo bar',
+      currentWorkspace
+    )[0];
 
     labelMatches.forEach(match => {
       expect(match.score).toBeGreaterThan(0);
@@ -144,7 +157,7 @@ describe('rankResults', () => {
       })
     );
 
-    const sorted = rankResults(servers, 'bar');
+    const sorted = rankResults(servers, 'bar', currentWorkspace);
 
     expect(sorted).toHaveLength(10);
     // the item with the highest score is the first one
@@ -154,6 +167,131 @@ describe('rankResults', () => {
       sorted.find(s => s.resource.uri === lowestScoreServerUri)
     ).toBeFalsy();
   });
+
+  describe('prioritizing current workspace and cluster', () => {
+    const rootClusterParams: UriParams = {
+      rootClusterId: 'teleport-local.dev',
+    };
+    const leafClusterParams: UriParams = {
+      rootClusterId: 'teleport-local.dev',
+      leafClusterId: 'teleport-local-leaf',
+    };
+    const otherClusterParams: UriParams = {
+      rootClusterId: 'enterprise-local',
+    };
+    const rootClusterUri = routing.getClusterUri(rootClusterParams);
+    const workspace = {
+      workspaceUri: rootClusterUri,
+      localClusterUri: rootClusterUri,
+    };
+    // This test creates five apps with the following names:
+    //
+    // 1. example in the current cluster
+    // 2. example in the current workspace but other cluster
+    // 3. example outside of the current workspace
+    // 4. example1 in the current cluster
+    // 5. example2 in the current cluster
+    // 6. example1 outside of the current workspace
+    //
+    // and then simulates a search for "example" and verifies that the apps are sorted according to
+    // the order specified above.
+    //
+    // We want to avoid a situation in which an item that scores less in a name match (4) is higher
+    // than an item with a more direct match but from outside of the current workspace (3).
+    //
+    // This test operates on apps as they have the unique trait where a match on the app name is
+    // likely also a partial match on app's public address.
+    it('ranks higher the results from the current workspace and cluster', () => {
+      const exactMatchFromCurrentCluster = makeAppResourceResult(
+        routing.getAppUri({ ...rootClusterParams, appId: 'example' })
+      );
+      const exactMatchFromCurrentWorkspaceButDiffCluster =
+        makeAppResourceResult(
+          routing.getAppUri({ ...leafClusterParams, appId: 'example' })
+        );
+      const exactMatchFromOtherWorkspace = makeAppResourceResult(
+        routing.getAppUri({ ...otherClusterParams, appId: 'example' })
+      );
+      const partialMatchFromCurrentCluster1 = makeAppResourceResult(
+        routing.getAppUri({ ...rootClusterParams, appId: 'example1' })
+      );
+      const partialMatchFromCurrentCluster2 = makeAppResourceResult(
+        routing.getAppUri({ ...rootClusterParams, appId: 'example2' })
+      );
+      const partialMatchFromOtherWorkspace = makeAppResourceResult(
+        routing.getAppUri({ ...otherClusterParams, appId: 'example1' })
+      );
+
+      const searchResults = [
+        exactMatchFromCurrentWorkspaceButDiffCluster,
+        partialMatchFromOtherWorkspace,
+        partialMatchFromCurrentCluster1,
+        exactMatchFromCurrentCluster,
+        partialMatchFromCurrentCluster2,
+        exactMatchFromOtherWorkspace,
+      ];
+      const actual = rankResults(searchResults, 'example', workspace).map(
+        v => v.resource.uri
+      );
+      const expected = [
+        exactMatchFromCurrentCluster,
+        exactMatchFromCurrentWorkspaceButDiffCluster,
+        // exactMatchFromOtherWorkspace is expected to be above example1 and example2 from the current
+        // cluster since it has an exact match on the name.
+        exactMatchFromOtherWorkspace,
+        partialMatchFromCurrentCluster1,
+        partialMatchFromCurrentCluster2,
+        partialMatchFromOtherWorkspace,
+      ].map(v => v.resource.uri);
+
+      expect(actual).toEqual(expected);
+    });
+
+    it('ranks higher partial matches from current cluster than partial matches from other workspaces', () => {
+      // This is a closer match in terms of a name match, but it does not belong to the current
+      // workspace.
+      const partialMatchFromOtherWorkspace1 = makeAppResourceResult(
+        routing.getAppUri({ ...otherClusterParams, appId: 'grafana-dev' })
+      );
+      const partialMatchFromOtherWorkspace2 = makeAppResourceResult(
+        routing.getAppUri({ ...otherClusterParams, appId: 'grafana-dev-1' })
+      );
+      const partialMatchFromCurrentCluster1 = makeAppResourceResult(
+        routing.getAppUri({ ...rootClusterParams, appId: 'grafana-dev-1' })
+      );
+      const partialMatchFromCurrentCluster2 = makeAppResourceResult(
+        routing.getAppUri({ ...rootClusterParams, appId: 'grafana-dev-2' })
+      );
+      // This is a match from the current cluster, but it has a much weaker match on the name than
+      // other results.
+      const partialMatchFromCurrentCluster3 = makeAppResourceResult(
+        routing.getAppUri({
+          ...rootClusterParams,
+          appId: 'grafana-staging-testing',
+        })
+      );
+
+      const searchResults = [
+        partialMatchFromOtherWorkspace2,
+        partialMatchFromCurrentCluster3,
+        partialMatchFromCurrentCluster1,
+        partialMatchFromOtherWorkspace1,
+        partialMatchFromCurrentCluster2,
+      ];
+      const actual = rankResults(searchResults, 'grafana', workspace).map(
+        v => v.resource.uri
+      );
+      const expected = [
+        partialMatchFromCurrentCluster1,
+        partialMatchFromCurrentCluster2,
+        partialMatchFromOtherWorkspace1,
+        partialMatchFromOtherWorkspace2,
+        partialMatchFromCurrentCluster3,
+      ].map(v => v.resource.uri);
+
+      expect(actual).toEqual(expected);
+    });
+  });
 });
 
 describe('useResourceSearch', () => {
@@ -392,3 +530,26 @@ describe('useFiltersSearch', () => {
     expect(clusterFilters[0].resource).toEqual(clusterA);
   });
 });
+
+/**
+ * Constructs an app search result. Extracts root and leaf cluster ID from the URI and uses it to
+ * assemble publicAddr of the app in the form of <appId>.<leafClusterId || rootClusterId>.
+ */
+const makeAppResourceResult = (appUri: string): SearchResultApp => {
+  const { appId, rootClusterId, leafClusterId } =
+    routing.parseAppUri(appUri).params;
+  const publicAddr = `${appId}.${leafClusterId || rootClusterId}`;
+  const app = makeApp({
+    name: appId,
+    endpointUri: 'http://localhost:3000',
+    publicAddr,
+    fqdn: publicAddr,
+    uri: appUri,
+  });
+  const addrWithProtocol = getAppAddrWithProtocol(app);
+
+  return makeResourceResult({
+    kind: 'app',
+    resource: { ...app, addrWithProtocol },
+  }) as SearchResultApp;
+};
diff --git a/web/packages/teleterm/src/ui/Search/useSearch.ts b/web/packages/teleterm/src/ui/Search/useSearch.ts
index 7a9d4a4873df4..47008a618459c 100644
--- a/web/packages/teleterm/src/ui/Search/useSearch.ts
+++ b/web/packages/teleterm/src/ui/Search/useSearch.ts
@@ -22,6 +22,7 @@ import { ShowResources } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb'
 
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import type * as resourcesServiceTypes from 'teleterm/ui/services/resources';
+import { routing } from 'teleterm/ui/uri';
 import { assertUnreachable } from 'teleterm/ui/utils';
 
 import {
@@ -173,6 +174,11 @@ export function useFilterSearch() {
         if (clusters.length === 1) {
           return [];
         }
+        clusters = clusters.map(c => ({
+          ...c,
+          // Name is empty if the user hasn't logged into that cluster yet.
+          name: c.name || routing.parseClusterName(c.uri),
+        }));
         if (search) {
           clusters = clusters.filter(cluster =>
             cluster.name
@@ -239,7 +245,8 @@ export function useFilterSearch() {
 /** Sorts and then returns top 10 results. */
 export function rankResults(
   searchResults: resourcesServiceTypes.SearchResult[],
-  search: string
+  search: string,
+  currentWorkspace: CurrentWorkspace
 ): ResourceSearchResult[] {
   const terms = search
     .split(' ')
@@ -264,7 +271,9 @@ export function rankResults(
   const collator = new Intl.Collator();
 
   return searchResults
-    .map(searchResult => calculateScore(populateMatches(searchResult, terms)))
+    .map(searchResult =>
+      calculateScore(populateMatches(searchResult, terms), currentWorkspace)
+    )
     .sort(
       (a, b) =>
         // Highest score first.
@@ -325,10 +334,13 @@ function populateMatches(
   return { ...searchResult, labelMatches, resourceMatches, score: 0 };
 }
 
+type CurrentWorkspace = { workspaceUri: string; localClusterUri: string };
+
 // TODO(ravicious): Extract the scoring logic to a function to better illustrate different weight
 // for different matches.
 function calculateScore(
-  searchResult: ResourceSearchResult
+  searchResult: ResourceSearchResult,
+  currentWorkspace: CurrentWorkspace
 ): ResourceSearchResult {
   let searchResultScore = 0;
 
@@ -362,12 +374,36 @@ function calculateScore(
     const { searchTerm } = match;
     const field = searchResult.resource[match.field];
     const isMainField = mainResourceField[searchResult.kind] === match.field;
-    const weight = isMainField ? 4 : 2;
-
-    const resourceMatchScore = getLengthScore(searchTerm, field) * weight;
+    const lengthScore = getLengthScore(searchTerm, field);
+    const isExactMatch = lengthScore === 100;
+    const mainFieldBoost = isMainField ? 5 : 2;
+    // Boost exact matches on the main field.
+    // Let's say there's two databases, "postgres" with no labels and "postgres-dev" with a
+    // engine:postgres label. If the user searches for "postgres", we want to show the "postgres"
+    // database first. Without this bonus multiplier, "postgres-dev" could end up being first as the
+    // search term "postgres" also matches the label.
+    const exactMainMatchBoost = isMainField && isExactMatch ? 1.25 : 1;
+
+    const resourceMatchScore =
+      lengthScore * mainFieldBoost * exactMainMatchBoost;
     searchResultScore += resourceMatchScore;
   }
 
+  // Extra points for belonging to the current workspace and the currently selected cluster.
+  const belongsToCurrentWorkspace = routing.belongsToProfile(
+    currentWorkspace.workspaceUri,
+    searchResult.resource.uri
+  );
+  const belongsToCurrentCluster =
+    currentWorkspace.localClusterUri ==
+    routing.ensureClusterUri(searchResult.resource.uri);
+  if (belongsToCurrentWorkspace) {
+    searchResultScore *= 1.1;
+  }
+  if (belongsToCurrentCluster) {
+    searchResultScore *= 1.1;
+  }
+
   // Show resources that require access lower in the results.
   if (searchResult.requiresRequest) {
     searchResultScore *= 0.95;
diff --git a/web/packages/teleterm/src/ui/StatusBar/StatusBar.tsx b/web/packages/teleterm/src/ui/StatusBar/StatusBar.tsx
index 4c1eb0f7213dd..a1d8576b4b704 100644
--- a/web/packages/teleterm/src/ui/StatusBar/StatusBar.tsx
+++ b/web/packages/teleterm/src/ui/StatusBar/StatusBar.tsx
@@ -16,14 +16,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { UseQueryResult } from '@tanstack/react-query';
 import { Fragment, useCallback } from 'react';
 import { useTheme } from 'styled-components';
 
 import { ButtonPrimary, Flex, Text } from 'design';
 import { ChevronRight } from 'design/Icon';
+import { AccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
 
+import { useAssumedRequests } from 'teleterm/ui/AccessRequests';
 import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
-import { getAssumedRequests } from 'teleterm/ui/services/clusters';
 import { ConnectionStatusIndicator } from 'teleterm/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator';
 
 import { AccessRequestCheckoutButton } from './AccessRequestCheckoutButton';
@@ -38,16 +40,9 @@ export function StatusBar(props: { onAssumedRolesClick(): void }) {
     'workspacesService',
     useCallback(store => store.rootClusterUri, [])
   );
-  const assumedRoles = Object.values(
-    useStoreSelector(
-      'clustersService',
-      useCallback(
-        state => getAssumedRequests(state, rootClusterUri),
-        [rootClusterUri]
-      )
-    )
-  );
-  const assumedRolesText = assumedRoles.flatMap(r => r.roles).join(', ');
+
+  const assumed = useAssumedRequests(rootClusterUri);
+  const assumedRolesText = getAssumedRoles(assumed);
 
   return (
     <Flex
@@ -108,7 +103,7 @@ export function StatusBar(props: { onAssumedRolesClick(): void }) {
           min-width: 0;
         `}
       >
-        {!!assumedRoles.length && (
+        {!!assumedRolesText && (
           <ButtonPrimary
             css={`
               min-width: 40px;
@@ -137,3 +132,24 @@ export function StatusBar(props: { onAssumedRolesClick(): void }) {
     </Flex>
   );
 }
+
+function getAssumedRoles(
+  queries: Map<string, UseQueryResult<AccessRequest>>
+): string {
+  return Array.from(queries)
+    .map(([requestId, query]) => {
+      if (query.isLoading) {
+        return '';
+      }
+
+      if (query.isSuccess) {
+        return query.data.roles.join(', ');
+      }
+
+      // If failed to load details or the query is disabled,
+      // only show the request id.
+      return requestId;
+    })
+    .filter(Boolean)
+    .join(', ');
+}
diff --git a/web/packages/teleterm/src/ui/StatusBar/useActiveDocumentClusterBreadcrumbs.ts b/web/packages/teleterm/src/ui/StatusBar/useActiveDocumentClusterBreadcrumbs.ts
index 9d82b6dce151e..fc5bb7e2b9ee3 100644
--- a/web/packages/teleterm/src/ui/StatusBar/useActiveDocumentClusterBreadcrumbs.ts
+++ b/web/packages/teleterm/src/ui/StatusBar/useActiveDocumentClusterBreadcrumbs.ts
@@ -62,8 +62,10 @@ export function useActiveDocumentClusterBreadcrumbs(): Breadcrumb[] {
   }
 
   return [
-    { name: rootCluster.name },
-    clusterUri !== rootClusterUri && { name: cluster.name },
+    { name: `${routing.parseClusterName(rootClusterUri)}` },
+    clusterUri !== rootClusterUri && {
+      name: routing.parseClusterName(clusterUri),
+    },
     {
       name: staticNameAndIcon.name,
       Icon: staticNameAndIcon.Icon,
diff --git a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.story.tsx b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.story.tsx
index 8a4d827e6e4b0..29b62365e72c5 100644
--- a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.story.tsx
+++ b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.story.tsx
@@ -36,7 +36,6 @@ const clusterOrange = makeRootCluster({
   loggedInUser: makeLoggedInUser({
     name: 'bob',
     roles: ['access', 'editor'],
-    sshLogins: ['root'],
   }),
   uri: '/clusters/orange',
 });
@@ -58,10 +57,14 @@ export const WithClusters = () => {
   const ctx = new MockAppContext();
   ctx.addRootCluster(clusterOrange);
   ctx.addRootCluster(clusterViolet);
+  ctx.statePersistenceService.putState({
+    ...ctx.statePersistenceService.getState(),
+    showTshHomeMigrationBanner: true,
+  });
 
   return (
     <MockAppContextProvider appContext={ctx}>
-      <ClusterConnectPanel />;
+      <ClusterConnectPanel />
     </MockAppContextProvider>
   );
 };
@@ -75,9 +78,13 @@ export const WithErrors = () => {
     })
   );
   ctx.addRootCluster(clusterViolet);
+  ctx.statePersistenceService.putState({
+    ...ctx.statePersistenceService.getState(),
+    showTshHomeMigrationBanner: true,
+  });
   return (
     <MockAppContextProvider appContext={ctx}>
-      <ClusterConnectPanel />;
+      <ClusterConnectPanel />
     </MockAppContextProvider>
   );
 };
diff --git a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.tsx b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.tsx
index 9890f52be0355..3654ee2715efb 100644
--- a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.tsx
+++ b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/ClusterConnectPanel.tsx
@@ -33,6 +33,7 @@ import {
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { NullKeyboardArrowsNavigation } from 'teleterm/ui/components/KeyboardArrowsNavigation/KeyboardArrowsNavigation';
 import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
+import { TshHomeMigrationBanner } from 'teleterm/ui/TopBar/Identity';
 import { ClusterList } from 'teleterm/ui/TopBar/Identity/IdentityList/IdentityList';
 import { RootClusterUri } from 'teleterm/ui/uri';
 
@@ -77,6 +78,14 @@ export function ClusterConnectPanel() {
               <P2 color="text.slightlyMuted" mb={2}>
                 Log in to a cluster to use Teleport Connect.
               </P2>
+              {/* Apply the same styling as used for the cluster items below. */}
+              <TshHomeMigrationBanner
+                css={`
+                  margin-bottom: ${p => p.theme.space[1]}px;
+                  border-radius: ${p => p.theme.radii[2]}px;
+                  padding: ${p => p.theme.space[2]}px;
+                `}
+              />
               {/*Disable arrows navigation, it doesn't work well here,*/}
               {/*since it requires the container to be focused.*/}
               {/*The user can navigate with Tab.*/}
diff --git a/web/packages/teleterm/src/ui/TabHost/TabHost.story.tsx b/web/packages/teleterm/src/ui/TabHost/TabHost.story.tsx
index 3ab32e7f9ffa7..65be5c4dbfbdc 100644
--- a/web/packages/teleterm/src/ui/TabHost/TabHost.story.tsx
+++ b/web/packages/teleterm/src/ui/TabHost/TabHost.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { createRef } from 'react';
 
 import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
diff --git a/web/packages/teleterm/src/ui/ThemeProvider/globals.ts b/web/packages/teleterm/src/ui/ThemeProvider/globals.ts
index 772dbd9beb3d1..108960ce21252 100644
--- a/web/packages/teleterm/src/ui/ThemeProvider/globals.ts
+++ b/web/packages/teleterm/src/ui/ThemeProvider/globals.ts
@@ -18,7 +18,7 @@
 
 import { createGlobalStyle, css } from 'styled-components';
 
-import { getPlatformType } from 'design/platform';
+import { getPlatform, Platform } from 'design/platform';
 
 const GlobalStyle = createGlobalStyle`
 
@@ -51,7 +51,17 @@ const GlobalStyle = createGlobalStyle`
     }
   }
 
-  ${() => !getPlatformType().isMac && customScrollbar}
+  b, strong {
+    // Overrides the default font-weight: bolder which results in the bold font not being bold
+    // enough. That's because if the regular font-weight is set to 300, "bolder" means it'll go to
+    // just 400.
+    // https://developer.mozilla.org/en-US/docs/Web/CSS/font-weight#meaning_of_relative_weights
+    //
+    // The Web UI uses <Text bold> to render bold text, whereas Connect mostly uses <strong>.
+    font-weight: ${props => props.theme.fontWeights.bold};
+  }
+
+  ${() => getPlatform() !== Platform.macOS && customScrollbar}
 `;
 
 const customScrollbar = css`
diff --git a/web/packages/teleterm/src/ui/TopBar/AdditionalActions.tsx b/web/packages/teleterm/src/ui/TopBar/AdditionalActions.tsx
index 62e72c1235347..f4b8f090739d0 100644
--- a/web/packages/teleterm/src/ui/TopBar/AdditionalActions.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/AdditionalActions.tsx
@@ -16,12 +16,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { useRef, useState } from 'react';
+import { useMemo, useRef, useState } from 'react';
 
 import { Popover } from 'design';
 import * as icons from 'design/Icon';
 
 import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { useAppUpdaterContext } from 'teleterm/ui/AppUpdater';
 import { useWorkspaceServiceState } from 'teleterm/ui/services/workspacesService';
 import { useNewTabOpener } from 'teleterm/ui/TabHost';
 import { TopBarButton } from 'teleterm/ui/TopBar/TopBarButton';
@@ -30,6 +31,7 @@ import { Menu, MenuItem, MenuListItem } from '../components/Menu';
 
 function useMenuItems(): MenuItem[] {
   const ctx = useAppContext();
+  const appUpdaterContext = useAppUpdaterContext();
   const { workspacesService, mainProcessClient, notificationsService } = ctx;
   useWorkspaceServiceState();
   const documentsService =
@@ -44,6 +46,10 @@ function useMenuItems(): MenuItem[] {
   const { platform } = mainProcessClient.getRuntimeSettings();
   const isDarwin = platform === 'darwin';
 
+  const supportsAppUpdates = useMemo(() => {
+    return mainProcessClient.supportsAppUpdates();
+  }, [mainProcessClient]);
+
   const menuItems: (MenuItem & { isVisible: boolean })[] = [
     {
       title: 'Open new terminal',
@@ -80,6 +86,14 @@ function useMenuItems(): MenuItem[] {
         ctx.commandLauncher.executeCommand('tsh-uninstall', undefined);
       },
     },
+    {
+      title: 'Check for updates…',
+      isVisible: supportsAppUpdates,
+      Icon: icons.Application,
+      onNavigate: () => {
+        appUpdaterContext.openDialog();
+      },
+    },
   ];
 
   return menuItems.filter(i => i.isVisible);
diff --git a/web/packages/teleterm/src/ui/TopBar/Clusters/ClustersFilterableList/ClustersFilterableList.tsx b/web/packages/teleterm/src/ui/TopBar/Clusters/ClustersFilterableList/ClustersFilterableList.tsx
index 59f397fae16c4..842ec0835b4db 100644
--- a/web/packages/teleterm/src/ui/TopBar/Clusters/ClustersFilterableList/ClustersFilterableList.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Clusters/ClustersFilterableList/ClustersFilterableList.tsx
@@ -42,7 +42,7 @@ export function ClustersFilterableList(props: ClustersFilterableListProps) {
           onFilterChange={value =>
             value.length ? setActiveIndex(0) : setActiveIndex(-1)
           }
-          placeholder="Search Leaf Cluster"
+          placeholder="Search leaf clusters"
           Node={({ item, index }) => (
             <ClusterItem
               item={item}
diff --git a/web/packages/teleterm/src/ui/TopBar/Connections/Connections.story.tsx b/web/packages/teleterm/src/ui/TopBar/Connections/Connections.story.tsx
index a1d7241c07013..8a34aec7bca6e 100644
--- a/web/packages/teleterm/src/ui/TopBar/Connections/Connections.story.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Connections/Connections.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { useLayoutEffect } from 'react';
 
 import { Flex, Text } from 'design';
@@ -281,6 +281,30 @@ const makeConnections = (index = 0) => {
       login: 'casey',
       clusterName: 'teleport.example.sh',
     },
+    {
+      connected: true,
+      kind: 'connection.gateway' as const,
+      title: 'some-web-app' + suffix,
+      targetName: 'some-web-app',
+      id: '11111' + suffix,
+      targetUri: '/clusters/foo/apps/some-web-app' + suffix,
+      port: '11111',
+      gatewayUri: '/gateways/some-web-app',
+      clusterName: 'teleport.example.sh',
+      targetProtocol: 'HTTP',
+    },
+    {
+      connected: true,
+      kind: 'connection.gateway' as const,
+      title: 'some-mcp-server' + suffix,
+      targetName: 'some-mcp-server',
+      id: '22222' + suffix,
+      targetUri: '/clusters/foo/apps/some-mcp-server' + suffix,
+      port: '22222',
+      gatewayUri: '/gateways/some-mcp-server',
+      clusterName: 'teleport.example.sh',
+      targetProtocol: 'MCP',
+    },
   ];
 };
 
diff --git a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionItem.tsx b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionItem.tsx
index 99d9a6ec9322e..1183a4faec518 100644
--- a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionItem.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionItem.tsx
@@ -21,6 +21,7 @@ import styled from 'styled-components';
 
 import { ButtonIcon, Flex, Text } from 'design';
 import { Trash, Unlink } from 'design/Icon';
+import { typography, TypographyProps } from 'design/system';
 
 import { useKeyboardArrowsNavigation } from 'teleterm/ui/components/KeyboardArrowsNavigation';
 import { ListItem } from 'teleterm/ui/components/ListItem';
@@ -98,18 +99,9 @@ export function ConnectionItem(props: {
               line-height: 16px;
             `}
           >
-            <span
-              css={`
-                font-size: 10px;
-                background: ${props => props.theme.colors.spotBackground[2]};
-                opacity: 0.85;
-                padding: 1px 2px;
-                margin-right: 4px;
-                border-radius: 4px;
-              `}
-            >
+            <ConnectionKindIndicator>
               {getKindName(props.item)}
-            </span>
+            </ConnectionKindIndicator>
             <span
               css={`
                 vertical-align: middle;
@@ -152,10 +144,23 @@ const ConnectionListItem = styled(ListItem)<{ $showClusterName?: boolean }>`
   height: unset;
 `;
 
+export const ConnectionKindIndicator = styled.span<TypographyProps>`
+  font-size: 10px;
+  background: ${props => props.theme.colors.spotBackground[2]};
+  opacity: 0.85;
+  padding: 1px 2px;
+  margin-right: 4px;
+  border-radius: 4px;
+  ${typography}
+`;
+
 function getKindName(connection: ExtendedTrackedConnection): string {
   switch (connection.kind) {
     case 'connection.gateway':
       if (isAppUri(connection.targetUri)) {
+        if (connection.targetProtocol === 'MCP') {
+          return 'MCP';
+        }
         return 'APP';
       }
       if (isDatabaseUri(connection.targetUri)) {
diff --git a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator.tsx b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator.tsx
index 25eb8297975bc..f55e5831889a1 100644
--- a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator.tsx
@@ -109,6 +109,15 @@ const StyledStatus = styled(Box)<{
           &:after {
             content: '⚠';
             font-size: 12px;
+            ${props.$inline &&
+            `
+            // This cuts out a little portion of the icon on the left. This is most clearly visible
+            // on Windows. But at least it better aligns with the other statuses.
+            //
+            // TODO(ravicious): Rewrite this to not use weird characters to represent different
+            // statuses so that all statuses properly align together.
+            margin: -1px;
+            `}
 
             ${!props.$inline &&
             `
diff --git a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionsFilterableList.tsx b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionsFilterableList.tsx
index 8ced7e7b1267f..c3e83b4d96a48 100644
--- a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionsFilterableList.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionsFilterableList.tsx
@@ -64,7 +64,7 @@ export function ConnectionsFilterableList(props: {
     <FilterableList<ExtendedTrackedConnection | VnetConnection>
       items={items}
       filterBy="title"
-      placeholder="Search Connections"
+      placeholder="Search connections"
       onFilterChange={value =>
         value.length ? setActiveIndex(0) : setActiveIndex(-1)
       }
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.story.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.story.tsx
index 43eb4967ef282..e2d88090d4d10 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.story.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.story.tsx
@@ -16,9 +16,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { Meta, StoryObj } from '@storybook/react-vite';
 import { useLayoutEffect } from 'react';
 
 import Flex from 'design/Flex';
+import { Timestamp } from 'gen-proto-ts/google/protobuf/timestamp_pb';
 import { TrustedDeviceRequirement } from 'gen-proto-ts/teleport/legacy/types/trusted_device_requirement_pb';
 import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
 
@@ -32,22 +34,122 @@ import { RootClusterUri } from 'teleterm/ui/uri';
 
 import { IdentityContainer } from './Identity';
 
-export default {
+interface StoryProps {
+  clusters: ('violet' | 'orange' | 'green')[];
+  activeCluster: boolean;
+  activeClusterExpired: boolean;
+  deviceTrust: 'enrolled' | 'required-not-enrolled' | 'not-enrolled';
+  showProfileErrors: boolean;
+}
+
+const meta: Meta<StoryProps> = {
   title: 'Teleterm/Identity',
+  component: props => {
+    const hasOrange = props.clusters.includes('orange');
+    const hasViolet = props.clusters.includes('violet');
+    const hasGreen = props.clusters.includes('green');
+    const clusters = [
+      hasOrange &&
+        makeRootCluster({
+          ...clusterOrange,
+          profileStatusError: props.showProfileErrors ? profileStatusError : '',
+        }),
+      hasViolet &&
+        makeRootCluster({
+          ...clusterViolet,
+          profileStatusError: props.showProfileErrors ? profileStatusError : '',
+        }),
+      hasGreen &&
+        makeRootCluster({
+          ...clusterGreen,
+          profileStatusError: props.showProfileErrors ? profileStatusError : '',
+        }),
+    ].filter(Boolean);
+
+    const hasClusterWithLoggedInUser =
+      props.activeCluster && (hasOrange || hasViolet);
+    if (hasClusterWithLoggedInUser) {
+      clusters[0].loggedInUser = makeLoggedInUser({
+        ...clusters[0].loggedInUser,
+        validUntil: Timestamp.fromDate(
+          props.activeClusterExpired
+            ? new Date()
+            : new Date(Date.now() + 24 * 60 * 60 * 1000)
+        ),
+        isDeviceTrusted: props.deviceTrust === 'enrolled',
+        trustedDeviceRequirement:
+          props.deviceTrust === 'required-not-enrolled'
+            ? TrustedDeviceRequirement.REQUIRED
+            : TrustedDeviceRequirement.NOT_REQUIRED,
+      });
+    }
+
+    return (
+      <OpenIdentityPopover
+        clusters={clusters}
+        activeClusterUri={hasClusterWithLoggedInUser && clusters[0]?.uri}
+      />
+    );
+  },
+  argTypes: {
+    clusters: {
+      control: { type: 'check' },
+      options: ['violet', 'orange', 'green'],
+      description: 'List of clusters to show.',
+    },
+    activeCluster: {
+      control: { type: 'boolean' },
+      description: 'Makes "violet" or "orange" an active cluster.',
+    },
+    deviceTrust: {
+      control: { type: 'radio' },
+      options: ['enrolled', 'required-not-enrolled', 'not-enrolled'],
+      description: 'Controls device trust requirement.',
+    },
+    activeClusterExpired: {
+      control: { type: 'boolean' },
+      description: 'Whether the active cluster has expired cert.',
+    },
+    showProfileErrors: {
+      control: { type: 'boolean' },
+      description: 'Shows profile errors for all clusters.',
+    },
+  },
+  args: {
+    clusters: ['violet', 'orange', 'green'],
+    activeCluster: true,
+    deviceTrust: 'not-enrolled',
+    activeClusterExpired: false,
+    showProfileErrors: false,
+  },
 };
 
+export default meta;
+
 const clusterOrange = makeRootCluster({
-  name: 'orange',
+  name: 'orange-psv-eindhoven-eredivisie-production-lorem-ipsum',
   loggedInUser: makeLoggedInUser({
-    name: 'bob',
-    roles: ['access', 'editor'],
-    sshLogins: ['root'],
+    name: 'ruud-van-nistelrooy-van-der-sar',
+    roles: [
+      'circle-mark-app-access',
+      'grafana-lite-app-access',
+      'grafana-gold-app-access',
+      'release-lion-app-access',
+      'release-fox-app-access',
+      'sales-center-lorem-app-access',
+      'sales-center-ipsum-db-access',
+      'sales-center-shop-app-access',
+      'sales-center-floor-db-access',
+    ],
   }),
   uri: '/clusters/orange',
 });
 const clusterViolet = makeRootCluster({
   name: 'violet',
-  loggedInUser: makeLoggedInUser({ name: 'sammy' }),
+  loggedInUser: makeLoggedInUser({
+    name: 'sammy',
+    roles: ['access', 'editor'],
+  }),
   uri: '/clusters/violet',
 });
 const clusterGreen = makeRootCluster({
@@ -64,11 +166,21 @@ const OpenIdentityPopover = (props: {
   activeClusterUri: RootClusterUri | undefined;
 }) => {
   const ctx = new MockAppContext();
+  ctx.statePersistenceService.putState({
+    ...ctx.statePersistenceService.getState(),
+    showTshHomeMigrationBanner: true,
+  });
   props.clusters.forEach(c => {
     ctx.addRootCluster(c);
   });
+  ctx.workspacesService.addWorkspace(clusterGreen.uri);
+  ctx.workspacesService.addWorkspace(clusterViolet.uri);
+  ctx.workspacesService.addWorkspace(clusterOrange.uri);
   ctx.workspacesService.setState(draftState => {
     draftState.rootClusterUri = props.activeClusterUri;
+    draftState.workspaces[clusterGreen.uri].color = 'green';
+    draftState.workspaces[clusterViolet.uri].color = 'purple';
+    draftState.workspaces[clusterOrange.uri].color = 'yellow';
   });
   useOpenPopover();
 
@@ -99,128 +211,60 @@ const useOpenPopover = () => {
   }, []);
 };
 
-export function NoRootClusters() {
-  return <OpenIdentityPopover clusters={[]} activeClusterUri={undefined} />;
-}
-
-export function OneClusterWithNoActiveCluster() {
-  return (
-    <OpenIdentityPopover
-      activeClusterUri={undefined}
-      clusters={[makeRootCluster({ loggedInUser: undefined })]}
-    />
-  );
-}
+export const NoRootClusters: StoryObj<StoryProps> = {
+  args: {
+    clusters: [],
+  },
+};
 
-export function OneClusterWithActiveCluster() {
-  const cluster = makeRootCluster({
-    loggedInUser: makeLoggedInUser({
-      name: 'alice',
-      roles: ['access', 'editor'],
-      sshLogins: ['root'],
-    }),
-  });
+export const OneClusterWithNoActiveCluster: StoryObj<StoryProps> = {
+  args: {
+    clusters: ['orange'],
+    activeCluster: false,
+  },
+};
 
-  return (
-    <OpenIdentityPopover clusters={[cluster]} activeClusterUri={cluster.uri} />
-  );
-}
+export const OneClusterWithActiveCluster: StoryObj<StoryProps> = {
+  args: {
+    clusters: ['violet'],
+  },
+};
 
-export function ManyClustersWithNoActiveCluster() {
-  return (
-    <OpenIdentityPopover
-      clusters={[clusterOrange, clusterViolet, clusterGreen]}
-      activeClusterUri={undefined}
-    />
-  );
-}
+export const ManyClustersWithNoActiveCluster: StoryObj<StoryProps> = {
+  args: {
+    clusters: ['orange', 'green', 'violet'],
+    activeCluster: false,
+  },
+};
 
-export function ManyClustersWithActiveCluster() {
-  return (
-    <OpenIdentityPopover
-      clusters={[clusterOrange, clusterViolet, clusterGreen]}
-      activeClusterUri={clusterOrange.uri}
-    />
-  );
-}
+export const ManyClustersWithActiveCluster: StoryObj<StoryProps> = {
+  args: {
+    clusters: ['orange', 'green', 'violet'],
+  },
+};
 
-export function ManyClustersWithProfileErrorsAndActiveCluster() {
-  return (
-    <OpenIdentityPopover
-      clusters={[
-        makeRootCluster({ ...clusterOrange, profileStatusError }),
-        makeRootCluster({ ...clusterViolet, profileStatusError }),
-        makeRootCluster({ ...clusterGreen, profileStatusError }),
-      ]}
-      activeClusterUri={clusterOrange.uri}
-    />
-  );
-}
+export const ManyClustersWithProfileErrorsAndActiveCluster: StoryObj<StoryProps> =
+  {
+    args: {
+      clusters: ['orange', 'green', 'violet'],
+      showProfileErrors: true,
+    },
+  };
 
-export function LongNamesWithManyRoles() {
-  return (
-    <OpenIdentityPopover
-      clusters={[
-        clusterOrange,
-        makeRootCluster({
-          ...clusterViolet,
-          name: 'psv-eindhoven-eredivisie-production-lorem-ipsum',
-          loggedInUser: makeLoggedInUser({
-            roles: [
-              'circle-mark-app-access',
-              'grafana-lite-app-access',
-              'grafana-gold-app-access',
-              'release-lion-app-access',
-              'release-fox-app-access',
-              'sales-center-lorem-app-access',
-              'sales-center-ipsum-db-access',
-              'sales-center-shop-app-access',
-              'sales-center-floor-db-access',
-            ],
-            name: 'ruud-van-nistelrooy-van-der-sar',
-          }),
-        }),
-        clusterGreen,
-      ]}
-      activeClusterUri={clusterViolet.uri}
-    />
-  );
-}
+export const TrustedDeviceEnrolled: StoryObj<StoryProps> = {
+  args: {
+    deviceTrust: 'enrolled',
+  },
+};
 
-export function TrustedDeviceEnrolled() {
-  return (
-    <OpenIdentityPopover
-      clusters={[
-        clusterOrange,
-        makeRootCluster({
-          ...clusterViolet,
-          loggedInUser: makeLoggedInUser({
-            isDeviceTrusted: true,
-            roles: ['circle-mark-app-access', 'grafana-lite-app-access'],
-            sshLogins: ['root'],
-          }),
-        }),
-      ]}
-      activeClusterUri={clusterViolet.uri}
-    />
-  );
-}
+export const TrustedDeviceRequiredButNotEnrolled: StoryObj<StoryProps> = {
+  args: {
+    deviceTrust: 'required-not-enrolled',
+  },
+};
 
-export function TrustedDeviceRequiredButNotEnrolled() {
-  return (
-    <OpenIdentityPopover
-      clusters={[
-        clusterOrange,
-        makeRootCluster({
-          ...clusterViolet,
-          loggedInUser: makeLoggedInUser({
-            trustedDeviceRequirement: TrustedDeviceRequirement.REQUIRED,
-            roles: ['circle-mark-app-access', 'grafana-lite-app-access'],
-            sshLogins: ['root'],
-          }),
-        }),
-      ]}
-      activeClusterUri={clusterViolet.uri}
-    />
-  );
-}
+export const ActiveClusterExpired: StoryObj<StoryProps> = {
+  args: {
+    activeClusterExpired: true,
+  },
+};
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.test.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.test.tsx
index d9ae5e88962b9..3a0b979b4df1a 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.test.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.test.tsx
@@ -39,7 +39,7 @@ test.each([
     }),
     expect: async () => {
       expect(
-        await screen.findByText(/Access secured with device trust/)
+        await screen.findByText(/access secured with device trust/i)
       ).toBeVisible();
     },
   },
@@ -63,7 +63,7 @@ test.each([
     }),
     expect: async () => {
       expect(
-        screen.queryByText(/Access secured with device trust/)
+        screen.queryByText(/access secured with device trust/i)
       ).not.toBeInTheDocument();
       expect(
         screen.queryByText(/Full access requires a trusted device/)
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.tsx
index 2cd6d874bd43a..2a49f42af6dc5 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/Identity.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/Identity.tsx
@@ -19,12 +19,14 @@
 import { useCallback, useMemo, useRef, useState } from 'react';
 import styled from 'styled-components';
 
-import { Box } from 'design';
+import { Box, ButtonText, Flex, Link, P3 } from 'design';
+import { Cross, Stars } from 'design/Icon';
 import Popover from 'design/Popover';
 import { TrustedDeviceRequirement } from 'gen-proto-ts/teleport/legacy/types/trusted_device_requirement_pb';
 
 import * as tshd from 'teleterm/services/tshd/types';
 import { KeyboardArrowsNavigation } from 'teleterm/ui/components/KeyboardArrowsNavigation';
+import { usePersistedState } from 'teleterm/ui/hooks/usePersistedState';
 import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
 import {
   useKeyboardShortcutFormatters,
@@ -119,6 +121,7 @@ export function IdentityContainer() {
               deviceTrustStatus={deviceTrustStatus}
             />
           )}
+          <TshHomeMigrationBanner />
           <KeyboardArrowsNavigation>
             {focusGrabber}
             <ClusterList
@@ -173,3 +176,62 @@ const focusGrabber = (
     autoFocus={true}
   />
 );
+
+export function TshHomeMigrationBanner(props: { className?: string }) {
+  const [state, setState] = usePersistedState(
+    'showTshHomeMigrationBanner',
+    false
+  );
+  if (!state) {
+    return;
+  }
+
+  return (
+    <Flex
+      className={props.className}
+      alignItems="center"
+      gap={2}
+      px={3}
+      py={2}
+      backgroundColor="interactive.tonal.informational.1"
+    >
+      <Stars size="medium" mx={1} />
+      <Flex
+        justifyContent="space-between"
+        alignItems="center"
+        width="100%"
+        gap={2}
+      >
+        {/*This max width value prevents the banner from being too wide in ClusterConnectPanel. */}
+        <Flex maxWidth="280px">
+          {/*Matches the look of a subtitle in TitleAndSubtitle. */}
+          <P3
+            color="text.slightlyMuted"
+            css={`
+              line-height: 1.3;
+            `}
+          >
+            Profiles are now{' '}
+            <Link
+              target="_blank"
+              href={
+                'https://goteleport.com/docs/connect-your-client/teleport-connect/#using-tsh-outside-of-teleport-connect'
+              }
+            >
+              automatically synced
+            </Link>{' '}
+            between Teleport Connect and the tsh command-line tool.
+          </P3>
+        </Flex>
+        <ButtonText
+          size="small"
+          p={1}
+          title="Close"
+          onClick={() => setState(false)}
+        >
+          <Cross size="small" />
+        </ButtonText>
+      </Flex>
+    </Flex>
+  );
+}
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityList.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityList.tsx
index 86158707c1200..5e52acd2965b1 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityList.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityList.tsx
@@ -16,23 +16,31 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { formatDistanceToNowStrict, isPast } from 'date-fns';
 import { JSX } from 'react';
 import styled from 'styled-components';
 
-import { ButtonText, Flex, Label, P3 } from 'design';
-import { Logout, Refresh, ShieldCheck, ShieldWarning } from 'design/Icon';
+import { ButtonText, Flex, Label, P3, Stack } from 'design';
+import {
+  Clock,
+  Logout,
+  Refresh,
+  ShieldCheck,
+  ShieldWarning,
+} from 'design/Icon';
 import Link from 'design/Link';
+import { Timestamp } from 'gen-proto-ts/google/protobuf/timestamp_pb';
 import { Cluster } from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
 
 import { ProfileStatusError } from 'teleterm/ui/components/ProfileStatusError';
 import { WorkspaceColor } from 'teleterm/ui/services/workspacesService';
 import { DeviceTrustStatus } from 'teleterm/ui/TopBar/Identity/Identity';
-import { RootClusterUri } from 'teleterm/ui/uri';
+import { RootClusterUri, routing } from 'teleterm/ui/uri';
 
 import { ColorPicker } from './ColorPicker';
 import {
   AddClusterItem,
-  getClusterLetter,
+  getProfileNameLetter,
   IdentityListItem,
   TitleAndSubtitle,
 } from './IdentityListItem';
@@ -45,32 +53,37 @@ export function ActiveCluster(props: {
   onRefresh(): void;
   onLogout(): void;
 }) {
+  const clusterName = routing.parseClusterName(props.activeCluster.uri);
+  const validUntil =
+    props.activeCluster.loggedInUser?.validUntil &&
+    Timestamp.toDate(props.activeCluster.loggedInUser.validUntil);
+
   return (
     <>
       <Flex p={3} pb={2} flexWrap="nowrap" gap={2} flexDirection="column">
         <Flex gap={4} justifyContent="space-between">
           <Flex alignItems="center" flex={1} minWidth="0" gap={2}>
             <ColorPicker
-              letter={getClusterLetter(props.activeCluster)}
+              letter={getProfileNameLetter(props.activeCluster)}
               color={props.activeColor}
               setColor={props.onChangeColor}
             />
             <TitleAndSubtitle
-              title={props.activeCluster.name}
+              title={clusterName}
               subtitle={props.activeCluster.loggedInUser?.name}
             />
           </Flex>
 
           <Flex flexDirection="row" alignItems="flex-start" gap={1}>
             <ButtonText
-              title={`Refresh session in ${props.activeCluster.name}`}
+              title={`Refresh session in ${clusterName}`}
               size="small"
               onClick={() => props.onRefresh()}
             >
               <Refresh size="small" />
             </ButtonText>
             <ButtonText
-              title={`Log out from ${props.activeCluster.name}`}
+              title={`Log out from ${clusterName}`}
               onClick={() => props.onLogout()}
               intent="danger"
               size="small"
@@ -102,7 +115,35 @@ export function ActiveCluster(props: {
             </Label>
           ))}
         </Flex>
-        <DeviceTrustMessage status={props.deviceTrustStatus} />
+        <Stack gap={0}>
+          {validUntil && (
+            <Flex gap={1} color="text.slightlyMuted">
+              <Clock size="small" />
+              <P3>
+                {isPast(validUntil) ? (
+                  'Session expired.'
+                ) : (
+                  <>
+                    Session expires{' '}
+                    <span
+                      title={validUntil.toLocaleString()}
+                      css={`
+                        text-decoration: underline;
+                        text-decoration-style: dotted;
+                      `}
+                    >
+                      {formatDistanceToNowStrict(validUntil, {
+                        addSuffix: true,
+                      })}
+                      .
+                    </span>
+                  </>
+                )}
+              </P3>
+            </Flex>
+          )}
+          <DeviceTrustMessage status={props.deviceTrustStatus} />
+        </Stack>
       </Flex>
       <Separator />
     </>
@@ -140,7 +181,7 @@ function DeviceTrustMessage(props: { status: DeviceTrustStatus }) {
       message = (
         <>
           <ShieldCheck color="success.main" size="small" mb="2px" />
-          <P3>Access secured with device trust.</P3>
+          <P3>Access secured with Device Trust.</P3>
         </>
       );
       break;
@@ -149,13 +190,14 @@ function DeviceTrustMessage(props: { status: DeviceTrustStatus }) {
         <>
           <ShieldWarning color="warning.main" size="small" mb="2px" />
           <P3>
-            Full access requires a trusted device.{' '}
+            Full access requires a trusted device. Learn how to{' '}
             <Link
-              href="https://goteleport.com/docs/admin-guides/access-controls/device-trust/guide/#step-22-enroll-device"
+              href="https://goteleport.com/docs/identity-governance/device-trust/device-management/#create-a-device-enrollment-token"
               target="_blank"
             >
-              Learn how to enroll your device.
+              enroll your device
             </Link>
+            .
           </P3>
         </>
       );
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityListItem.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityListItem.tsx
index 6693912f75533..66a5b26800e6c 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityListItem.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/IdentityList/IdentityListItem.tsx
@@ -27,6 +27,7 @@ import { ListItem } from 'teleterm/ui/components/ListItem';
 import { ProfileStatusError } from 'teleterm/ui/components/ProfileStatusError';
 import { useStoreSelector } from 'teleterm/ui/hooks/useStoreSelector';
 import { WorkspaceColor } from 'teleterm/ui/services/workspacesService';
+import { routing } from 'teleterm/ui/uri';
 
 import { UserIcon } from '../IdentitySelector/UserIcon';
 
@@ -49,6 +50,8 @@ export function IdentityListItem(props: {
     )
   );
 
+  const profileName = routing.parseClusterName(props.cluster.uri);
+
   return (
     <StyledListItem
       onClick={props.onSelect}
@@ -56,13 +59,13 @@ export function IdentityListItem(props: {
         (e.key === 'Enter' || e.key === 'Space') && props.onSelect()
       }
       isActive={isActive}
-      title={`Switch to ${props.cluster.name}`}
+      title={`Switch to ${profileName}`}
     >
       <Flex width="100%" justifyContent="space-between">
         <WithIconItem
-          letter={getClusterLetter(props.cluster)}
+          letter={getProfileNameLetter(props.cluster)}
           color={workspaceColor}
-          title={props.cluster.name}
+          title={profileName}
           subtitle={props.cluster.loggedInUser?.name}
         />
         {props.onLogout && (
@@ -76,7 +79,7 @@ export function IdentityListItem(props: {
             `}
             p={1}
             ml={4}
-            title={`Log out from ${props.cluster.name}`}
+            title={`Log out from ${profileName}`}
             onClick={e => {
               e.stopPropagation();
               props.onLogout();
@@ -166,6 +169,6 @@ export function TitleAndSubtitle(props: { title: string; subtitle?: string }) {
   );
 }
 
-export function getClusterLetter(cluster: Cluster): string {
-  return cluster.name.at(0);
+export function getProfileNameLetter(cluster: Cluster): string {
+  return routing.parseClusterName(cluster.uri).at(0);
 }
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/IdentitySelector/IdentitySelector.tsx b/web/packages/teleterm/src/ui/TopBar/Identity/IdentitySelector/IdentitySelector.tsx
index df1d83ac0d7ee..ce5c167af946d 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/IdentitySelector/IdentitySelector.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/IdentitySelector/IdentitySelector.tsx
@@ -25,9 +25,10 @@ import { WorkspaceColor } from 'teleterm/ui/services/workspacesService';
 import { ConnectionStatusIndicator } from 'teleterm/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator';
 import { DeviceTrustStatus } from 'teleterm/ui/TopBar/Identity/Identity';
 import { TopBarButton } from 'teleterm/ui/TopBar/TopBarButton';
+import { routing } from 'teleterm/ui/uri';
 import { getUserWithClusterName } from 'teleterm/ui/utils';
 
-import { getClusterLetter } from '../IdentityList/IdentityListItem';
+import { getProfileNameLetter } from '../IdentityList/IdentityListItem';
 import { UserIcon } from './UserIcon';
 
 export const IdentitySelector = forwardRef<
@@ -44,7 +45,7 @@ export const IdentitySelector = forwardRef<
   const selectorText =
     props.activeCluster &&
     getUserWithClusterName({
-      clusterName: props.activeCluster.name,
+      clusterName: routing.parseClusterName(props.activeCluster.uri),
       userName: props.activeCluster.loggedInUser?.name,
     });
   const title = props.makeTitle(selectorText);
@@ -63,7 +64,7 @@ export const IdentitySelector = forwardRef<
         <Box>
           <UserIcon
             color={props.activeColor}
-            letter={getClusterLetter(props.activeCluster)}
+            letter={getProfileNameLetter(props.activeCluster)}
           />
           {props.deviceTrustStatus === 'requires-enrollment' && (
             <ConnectionStatusIndicator
diff --git a/web/packages/teleterm/src/ui/TopBar/Identity/index.ts b/web/packages/teleterm/src/ui/TopBar/Identity/index.ts
index 3297d80580132..0814cfe2f9f32 100644
--- a/web/packages/teleterm/src/ui/TopBar/Identity/index.ts
+++ b/web/packages/teleterm/src/ui/TopBar/Identity/index.ts
@@ -16,4 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-export { IdentityContainer as Identity } from './Identity';
+export {
+  IdentityContainer as Identity,
+  TshHomeMigrationBanner,
+} from './Identity';
diff --git a/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.story.tsx b/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.story.tsx
new file mode 100644
index 0000000000000..6ebb469d4feea
--- /dev/null
+++ b/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.story.tsx
@@ -0,0 +1,51 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { ConfigureSSHClients } from './ConfigureSSHClients';
+
+export default {
+  title: 'Teleterm/Vnet/ConfigureSSHClients',
+  argTypes: {
+    simulateError: {
+      name: 'simulate error',
+      control: 'boolean',
+      defaultValue: false,
+    },
+    host: {
+      name: 'set specific SSH host',
+      control: 'text',
+    },
+  },
+};
+
+export const Story = ({ simulateError, host }) => (
+  <ConfigureSSHClients
+    onClose={() => console.log('closed')}
+    onConfirm={() =>
+      new Promise<void>((resolve, reject) => {
+        setTimeout(
+          () =>
+            simulateError ? reject(new Error('test error')) : resolve(null),
+          1000
+        );
+      })
+    }
+    host={host}
+    vnetSSHConfigPath="/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config"
+  />
+);
diff --git a/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.tsx b/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.tsx
new file mode 100644
index 0000000000000..b11cbf2cbed13
--- /dev/null
+++ b/web/packages/teleterm/src/ui/Vnet/ConfigureSSHClients.tsx
@@ -0,0 +1,97 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { Alert, ButtonIcon, ButtonPrimary, Flex, H2, Text } from 'design';
+import Dialog, {
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+} from 'design/Dialog';
+import { Cross } from 'design/Icon';
+import { TextSelectCopy } from 'shared/components/TextSelectCopy';
+import { useAsync } from 'shared/hooks/useAsync';
+
+export function ConfigureSSHClients(props: {
+  onClose: () => void;
+  onConfirm: () => Promise<void>;
+  vnetSSHConfigPath: string;
+  host?: string;
+  hidden?: boolean;
+}) {
+  const [confirmAttempt, onConfirm] = useAsync(props.onConfirm);
+  const host = props.host || '<hostname>.<cluster>';
+  return (
+    <Dialog
+      open={!props.hidden}
+      dialogCss={() => ({
+        maxWidth: '800px',
+        width: '100%',
+      })}
+    >
+      <DialogHeader justifyContent="space-between" alignItems="baseline">
+        <H2>Configure SSH clients for VNet</H2>
+        <ButtonIcon
+          type="button"
+          onClick={props.onClose}
+          color="text.slightlyMuted"
+        >
+          <Cross size="medium" />
+        </ButtonIcon>
+      </DialogHeader>
+      <DialogContent mb={4}>
+        <Text typography="body2">
+          Compatible SSH clients can connect to SSH servers with Teleport
+          features like per-session MFA without complex configuration. Teleport
+          VNet will handle the connection and manage SSH certificates
+          automatically, simply connect with:
+        </Text>
+        <TextSelectCopy text={`ssh <username>@${host}`} mt={1} />
+        <Text typography="body2" mt={2}>
+          To enable this for any OpenSSH-compatible client that reads
+          configuration from <code>~/.ssh/config</code>, add the following line
+          at the top of the file, or click the button below to add it
+          automatically.
+        </Text>
+        <TextSelectCopy
+          text={`Include "${props.vnetSSHConfigPath}"`}
+          bash={false}
+          mt={1}
+        />
+      </DialogContent>
+      <DialogFooter>
+        <Flex>
+          <ButtonPrimary
+            ml="auto"
+            mr={1}
+            onClick={() =>
+              onConfirm().then(([, err]) => !err && props.onClose())
+            }
+            disabled={confirmAttempt.status === 'processing'}
+          >
+            Configure Automatically
+          </ButtonPrimary>
+        </Flex>
+        {confirmAttempt.status === 'error' && (
+          <Alert mt={4} mb={0} dismissible>
+            {confirmAttempt.statusText}
+          </Alert>
+        )}
+      </DialogFooter>
+    </Dialog>
+  );
+}
diff --git a/web/packages/teleterm/src/ui/Vnet/DiagnosticsAlert.tsx b/web/packages/teleterm/src/ui/Vnet/DiagnosticsAlert.tsx
index ac8dbec9091e8..47e8dca121b19 100644
--- a/web/packages/teleterm/src/ui/Vnet/DiagnosticsAlert.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/DiagnosticsAlert.tsx
@@ -109,7 +109,7 @@ export const DiagnosticsAlert = (props: {
         </Flex>
 
         <ActionButton
-          fill="minimal"
+          fill="filled"
           intent="neutral"
           inputAlignment
           action={{
@@ -142,7 +142,7 @@ export const DiagnosticsAlert = (props: {
       buttons={
         <>
           <ActionButton
-            fill="border"
+            fill="filled"
             intent="neutral"
             inputAlignment
             action={{
diff --git a/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.story.tsx b/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.story.tsx
index 3edf82f6683ff..67857b2ac789e 100644
--- a/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.story.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 import { PropsWithChildren, useEffect } from 'react';
 
 import { Box } from 'design';
@@ -26,6 +26,7 @@ import {
   CommandAttemptStatus,
   RouteConflict,
   RouteConflictReport,
+  SSHConfigurationReport,
 } from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
 import { usePromiseRejectedOnUnmount } from 'shared/utils/wait';
 
@@ -48,6 +49,12 @@ import { ConnectionsContextProvider } from 'teleterm/ui/TopBar/Connections/conne
 import { DocumentVnetDiagReport as Component } from './DocumentVnetDiagReport';
 import { useVnetContext, VnetContextProvider } from './vnetContext';
 
+const defaultUserSSHConfigContents = `Include "/Users/User/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config"
+
+Host github.com
+  IdentityFile ~/.ssh/id_ed25519
+`;
+
 type StoryProps = {
   asText: boolean;
   networkStackAttempt: 'ok' | 'error';
@@ -56,6 +63,10 @@ type StoryProps = {
   routeConflictAttempt: 'ok' | 'issues-found' | 'error';
   routeConflicts: RouteConflict[];
   routeConflictCommandAttempt: 'ok' | 'error';
+  sshConfigAttempt: 'ok' | 'error';
+  sshConfigured: boolean;
+  userOpenSSHConfigExists: boolean;
+  userOpenSSHConfigContents: string;
   displayUnsupportedCheckAttempt: boolean;
   vnetRunning: boolean;
   reRunDiagnostics: 'success' | 'error' | 'processing';
@@ -91,6 +102,15 @@ const meta: Meta<StoryProps> = {
       control: { type: 'inline-radio' },
       options: ['ok', 'error'],
     },
+    sshConfigAttempt: {
+      control: { type: 'inline-radio' },
+      options: ['ok', 'error'],
+    },
+    userOpenSSHConfigExists: {},
+    userOpenSSHConfigContents: {},
+    sshConfigured: {
+      control: { type: 'boolean' },
+    },
     displayUnsupportedCheckAttempt: {
       description:
         "Simulate the component receiving a report with a check attempt that's not supported in the current version",
@@ -121,6 +141,10 @@ const meta: Meta<StoryProps> = {
       }),
     ],
     routeConflictCommandAttempt: 'ok',
+    sshConfigAttempt: 'ok',
+    sshConfigured: false,
+    userOpenSSHConfigExists: true,
+    userOpenSSHConfigContents: defaultUserSSHConfigContents,
     displayUnsupportedCheckAttempt: false,
     vnetRunning: true,
     reRunDiagnostics: 'success',
@@ -208,6 +232,31 @@ export function DocumentVnetDiagReport(props: StoryProps) {
   }
   report.checks.push(routeConflictCheckAttempt);
 
+  const sshConfigReport: SSHConfigurationReport = {
+    userOpensshConfigIncludesVnetSshConfig: props.sshConfigured,
+    userOpensshConfigPath: '/Users/User/.ssh/config',
+    vnetSshConfigPath:
+      '/Users/User/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
+    userOpensshConfigExists: props.userOpenSSHConfigExists,
+    userOpensshConfigContents: props.userOpenSSHConfigContents,
+  };
+  const sshConfigCheckAttempt = makeCheckAttempt({
+    status:
+      props.sshConfigAttempt === 'ok'
+        ? CheckAttemptStatus.OK
+        : CheckAttemptStatus.ERROR,
+    error:
+      props.sshConfigAttempt === 'error' ? 'something went wrong' : undefined,
+    checkReport: makeCheckReport({
+      status: CheckReportStatus.OK,
+      report: {
+        oneofKind: 'sshConfigurationReport',
+        sshConfigurationReport: sshConfigReport,
+      },
+    }),
+  });
+  report.checks.push(sshConfigCheckAttempt);
+
   if (props.displayUnsupportedCheckAttempt) {
     report.checks.push({
       status: CheckAttemptStatus.OK,
diff --git a/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.tsx b/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.tsx
index a74ed7feeb4c4..5afcac23aafff 100644
--- a/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/DocumentVnetDiagReport.tsx
@@ -21,7 +21,7 @@ import styled from 'styled-components';
 
 import { Button, Alert as DesignAlert, Flex, H1, Link, Stack } from 'design';
 import { AlertProps } from 'design/Alert/Alert';
-import Table, { TextCell } from 'design/DataTable';
+import Table, { Cell, TextCell } from 'design/DataTable';
 import { displayDateTime } from 'design/datetime';
 import {
   Copy,
@@ -38,7 +38,10 @@ import * as diag from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
 import { CanceledError, useAsync } from 'shared/hooks/useAsync';
 import { pluralize } from 'shared/utils/text';
 
-import { reportOneOfIsRouteConflictReport } from 'teleterm/helpers';
+import {
+  reportOneOfIsRouteConflictReport,
+  reportOneOfIsSSHConfigurationReport,
+} from 'teleterm/helpers';
 import { getReportFilename, reportToText } from 'teleterm/services/vnet/diag';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import Document from 'teleterm/ui/Document';
@@ -297,6 +300,10 @@ const reportOneofDisplayDetails: Record<
     errorTitle: 'inspect network routes',
     Component: CheckReportRouteConflict,
   },
+  sshConfigurationReport: {
+    errorTitle: 'inspect SSH configuration',
+    Component: CheckReportSSHConfiguration,
+  },
 };
 
 /**
@@ -367,6 +374,99 @@ function CheckReportRouteConflict({
   );
 }
 
+function CheckReportSSHConfiguration({
+  checkReport: { report },
+}: {
+  checkReport: diag.CheckReport;
+}) {
+  const { openSSHConfigurationModal } = useVnetContext();
+  if (!reportOneOfIsSSHConfigurationReport(report)) {
+    return null;
+  }
+  const {
+    userOpensshConfigPath,
+    vnetSshConfigPath,
+    userOpensshConfigIncludesVnetSshConfig,
+    userOpensshConfigExists,
+    userOpensshConfigContents,
+  } = report.sshConfigurationReport;
+  const pathsTable = (
+    <Table
+      emptyText=""
+      data={[
+        {
+          desc: 'User OpenSSH config file',
+          path: userOpensshConfigPath,
+        },
+        {
+          desc: 'VNet SSH config file',
+          path: vnetSshConfigPath,
+        },
+      ]}
+      columns={[
+        { key: 'desc', headerText: 'File description' },
+        {
+          key: 'path',
+          headerText: 'Path',
+          render: row => (
+            <Cell>
+              <code>{row.path}</code>
+            </Cell>
+          ),
+        },
+      ]}
+    />
+  );
+  if (userOpensshConfigIncludesVnetSshConfig) {
+    return (
+      <>
+        <Stack>
+          <P1>
+            <Success /> VNet SSH is configured correctly.
+          </P1>
+          <P2>
+            The user's default SSH configuration file correctly includes VNet's
+            generated configuration file.
+          </P2>
+        </Stack>
+        {pathsTable}
+      </>
+    );
+  }
+  return (
+    <>
+      <Stack>
+        <P1>
+          <Warning /> VNet SSH is not configured.
+        </P1>
+        <P2 m={0}>
+          The user's default SSH configuration file does not include VNet's
+          generated SSH configuration file. SSH clients will not be able to make
+          connections to VNet SSH addresses by default.{' '}
+        </P2>
+        <Button
+          intent="neutral"
+          onClick={() =>
+            openSSHConfigurationModal({
+              vnetSSHConfigPath: vnetSshConfigPath,
+            })
+          }
+        >
+          Resolve
+        </Button>
+      </Stack>
+      {userOpensshConfigExists ? (
+        <details>
+          <Summary>
+            Current contents of <code>{userOpensshConfigPath}</code>
+          </Summary>
+          <Pre>{userOpensshConfigContents}</Pre>
+        </details>
+      ) : null}
+    </>
+  );
+}
+
 const Summary = styled.summary`
   cursor: pointer;
 `;
diff --git a/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.story.tsx b/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.story.tsx
index e58e80f0e2364..9068eea6e232d 100644
--- a/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.story.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.story.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { Meta } from '@storybook/react';
+import { Meta } from '@storybook/react-vite';
 
 import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
 import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
diff --git a/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.tsx b/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.tsx
index eb6bd8ecc0db7..95481bd6aeaa0 100644
--- a/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/DocumentVnetInfo.tsx
@@ -31,7 +31,7 @@ import type * as docTypes from 'teleterm/ui/services/workspacesService';
 import { routing } from 'teleterm/ui/uri';
 
 import appAccessPng from './app-access.png';
-import { useVnetAppLauncher } from './useVnetAppLauncher';
+import { useVnetLauncher } from './useVnetLauncher';
 import { useVnetContext } from './vnetContext';
 
 export function DocumentVnetInfo(props: {
@@ -39,29 +39,28 @@ export function DocumentVnetInfo(props: {
   doc: docTypes.DocumentVnetInfo;
 }) {
   const { doc } = props;
-  const { mainProcessClient } = useAppContext();
+  const { mainProcessClient, clustersService } = useAppContext();
   const {
     startAttempt,
     stop: stopVnet,
     stopAttempt,
     status,
   } = useVnetContext();
-  const { launchVnetWithoutFirstTimeCheck } = useVnetAppLauncher();
-  const userAtHost = useMemo(() => {
-    const { hostname, username } = mainProcessClient.getRuntimeSettings();
-    return `${username}@${hostname}`;
+  const { launchVnetWithoutFirstTimeCheck } = useVnetLauncher();
+  const { username, hostname } = useMemo(() => {
+    const { username, hostname } = mainProcessClient.getRuntimeSettings();
+    return { username, hostname };
   }, [mainProcessClient]);
+  const userAtHost = `${username}@${hostname}`;
   const { rootClusterUri, documentsService } = useWorkspaceContext();
   const proxyHostname = routing.parseClusterName(rootClusterUri);
+  const clusterName = clustersService.findCluster(rootClusterUri).name;
 
   const startVnet = async () => {
-    await launchVnetWithoutFirstTimeCheck({
-      addrToCopy: doc.app?.targetAddress,
-      isMultiPort: doc.app?.isMultiPort,
-    });
-    // Remove targetAddress so that subsequent launches of VNet from this specific doc won't copy
-    // the stale app address to the clipboard.
-    documentsService.update(doc.uri, { app: undefined });
+    await launchVnetWithoutFirstTimeCheck(doc.launcherArgs);
+    // Remove launcherArgs so that subsequent launches of VNet from this
+    // specific doc won't copy the stale address to the clipboard.
+    documentsService.update(doc.uri, { launcherArgs: undefined });
   };
 
   return (
@@ -232,6 +231,61 @@ export function DocumentVnetInfo(props: {
             </DemoPart>
           </ComparisonOption>
         </UseCaseSection>
+
+        {/* VNet SSH */}
+        <UseCaseSection>
+          <TitleAndLearnMoreContainer>
+            <H2>SSH Servers With 3rd-Party SSH Clients</H2>
+            <LearnMoreButton href="https://goteleport.com/docs/connect-your-client/vnet/#step-33-connect-to-an-ssh-server">
+              Learn More
+            </LearnMoreButton>
+          </TitleAndLearnMoreContainer>
+
+          <ComparisonOption>
+            <TextPart>
+              <H3>With VNet</H3>
+              <P2>
+                Connect directly to Teleport SSH servers with any
+                OpenSSH-compatible client or your preferred editor's remote SSH
+                extension. VNet will intercept the connection to authenticate
+                with your SSH certificate and handle Teleport features like
+                hardware keys and per-session MFA with prompts displayed in
+                Connect.
+              </P2>
+            </TextPart>
+
+            <DemoTerminal
+              flex={demoFlex}
+              title={userAtHost}
+              text={sshWithVNet(username, clusterName)}
+              width="100%"
+              boxShadow={2}
+            />
+          </ComparisonOption>
+
+          <ComparisonOption>
+            <TextPart>
+              <H3>Without VNet</H3>
+              <P2>
+                You can still connect to Teleport SSH servers with many
+                OpenSSH-compatible clients, but you'll need to configure the
+                client to use your Teleport user SSH certificate and use a
+                ProxyCommand to make the connection, and Teleport features like
+                hardware keys and per-session MFA are not supported.
+              </P2>
+            </TextPart>
+
+            <Stack flex={demoFlex} gap={2} fullWidth>
+              <DemoTerminal
+                flex={demoFlex}
+                title={userAtHost}
+                text={sshWithoutVNet(username, clusterName)}
+                width="100%"
+                boxShadow={2}
+              />
+            </Stack>
+          </ComparisonOption>
+        </UseCaseSection>
       </Stack>
     </Document>
   );
@@ -301,3 +355,16 @@ const curlWithoutVnet = `$ curl http://127.0.0.1:61397
   "body": ""
 }
 `;
+
+const sshWithVNet = (
+  username: string,
+  clusterName: string
+) => `$ ssh ${username}@server.${clusterName}
+${username}@server:~$ `;
+
+const sshWithoutVNet = (
+  username: string,
+  clusterName: string
+) => `$ tsh config > teleport_ssh_config
+$ ssh -F ./teleport_ssh_config ${username}@server.${clusterName}
+${username}@server:~$ `;
diff --git a/web/packages/teleterm/src/ui/Vnet/VnetConnectionItem.tsx b/web/packages/teleterm/src/ui/Vnet/VnetConnectionItem.tsx
index 9ef08eceffc83..9b59d2a654d4f 100644
--- a/web/packages/teleterm/src/ui/Vnet/VnetConnectionItem.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/VnetConnectionItem.tsx
@@ -114,7 +114,6 @@ const VnetConnectionItemBase = forwardRef<
     diagnosticsAttempt,
     getDisabledDiagnosticsReason,
     showDiagWarningIndicator,
-    isDiagSupported,
   } = useVnetContext();
   const { close: closeConnectionsPanel } = useConnectionsContext();
   const rootClusterUri = useStoreSelector(
@@ -259,18 +258,16 @@ const VnetConnectionItemBase = forwardRef<
                 </ButtonIcon>
               )}
 
-              {isDiagSupported && (
-                <ButtonIcon
-                  title={disabledDiagnosticsReason || 'Run diagnostics'}
-                  disabled={!!disabledDiagnosticsReason}
-                  onClick={e => {
-                    e.stopPropagation();
-                    props.runDiagnosticsFromVnetPanel();
-                  }}
-                >
-                  <icons.ListMagnifyingGlass size={18} />
-                </ButtonIcon>
-              )}
+              <ButtonIcon
+                title={disabledDiagnosticsReason || 'Run diagnostics'}
+                disabled={!!disabledDiagnosticsReason}
+                onClick={e => {
+                  e.stopPropagation();
+                  props.runDiagnosticsFromVnetPanel();
+                }}
+              >
+                <icons.ListMagnifyingGlass size={18} />
+              </ButtonIcon>
             </>
           )}
 
@@ -291,7 +288,7 @@ const VnetConnectionItemBase = forwardRef<
                 width={toggleVnetButtonWidth}
                 size="small"
                 intent="neutral"
-                fill="minimal"
+                fill="filled"
                 title=""
                 onClick={e => {
                   e.stopPropagation();
@@ -332,7 +329,7 @@ const VnetConnectionItemBase = forwardRef<
             (props.showExtraRightButtons ? (
               <Button
                 intent="neutral"
-                fill="minimal"
+                fill="filled"
                 key={toggleVnetButtonKey}
                 size="small"
                 width={toggleVnetButtonWidth}
diff --git a/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.story.tsx b/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.story.tsx
index cab7d7a71e2fd..fa6abef75c780 100644
--- a/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.story.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.story.tsx
@@ -15,7 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-import { Meta } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-vite';
 import { useEffect } from 'react';
 
 import { Box } from 'design';
@@ -38,19 +38,33 @@ import { VnetSliderStep as Component } from './VnetSliderStep';
 type StoryProps = {
   startVnet: 'success' | 'error' | 'processing';
   autoStart: boolean;
-  dnsZones: string[];
-  listDnsZones:
+  appDnsZones: string[];
+  clusters: string[];
+  sshConfigured: boolean;
+  fetchStatus:
     | 'success'
     | 'error'
     | 'processing'
     | 'processing-with-previous-results';
-  vnetDiag: boolean;
   runDiagnostics: 'success' | 'error' | 'processing';
   diagReport: 'ok' | 'issues-found' | 'failed-checks';
   isWorkspacePresent: boolean;
   unexpectedShutdown: boolean;
 };
 
+const defaultArgs: StoryProps = {
+  startVnet: 'success',
+  autoStart: true,
+  appDnsZones: ['teleport.example.com', 'company.test'],
+  clusters: ['teleport.example.com'],
+  sshConfigured: false,
+  fetchStatus: 'success',
+  runDiagnostics: 'success',
+  diagReport: 'ok',
+  isWorkspacePresent: true,
+  unexpectedShutdown: false,
+};
+
 const meta: Meta<StoryProps> = {
   title: 'Teleterm/Vnet/VnetSliderStep',
   component: VnetSliderStep,
@@ -68,10 +82,13 @@ const meta: Meta<StoryProps> = {
       control: { type: 'inline-radio' },
       options: ['success', 'error', 'processing'],
     },
-    dnsZones: {
+    appDnsZones: {
+      control: { type: 'object' },
+    },
+    clusters: {
       control: { type: 'object' },
     },
-    listDnsZones: {
+    fetchStatus: {
       control: { type: 'inline-radio' },
       options: [
         'success',
@@ -93,24 +110,12 @@ const meta: Meta<StoryProps> = {
         "If there's no workspace, the button to open the diag report is disabled.",
     },
   },
-  args: {
-    startVnet: 'success',
-    autoStart: true,
-    dnsZones: ['teleport.example.com', 'company.test'],
-    listDnsZones: 'success',
-    vnetDiag: true,
-    runDiagnostics: 'success',
-    diagReport: 'ok',
-    isWorkspacePresent: true,
-    unexpectedShutdown: false,
-  },
+  render: props => <VnetSliderStep {...props} />,
 };
 export default meta;
 
-export function VnetSliderStep(props: StoryProps) {
-  const appContext = new MockAppContext({
-    platform: props.vnetDiag ? 'darwin' : 'win32',
-  });
+function VnetSliderStep(props: StoryProps) {
+  const appContext = new MockAppContext();
 
   if (props.isWorkspacePresent) {
     appContext.addRootCluster(makeRootCluster());
@@ -148,22 +153,34 @@ export function VnetSliderStep(props: StoryProps) {
     };
   }
 
-  if (props.listDnsZones === 'processing') {
-    appContext.vnet.listDNSZones = () => pendingPromise;
+  if (props.fetchStatus === 'processing') {
+    appContext.vnet.getServiceInfo = () => pendingPromise;
   } else {
     let firstCall = true;
-    appContext.vnet.listDNSZones = () => {
-      if (props.listDnsZones === 'processing-with-previous-results') {
+    appContext.vnet.getServiceInfo = () => {
+      if (props.fetchStatus === 'processing-with-previous-results') {
         if (firstCall) {
           firstCall = false;
-          return new MockedUnaryCall({ dnsZones: props.dnsZones });
+          return new MockedUnaryCall({
+            appDnsZones: props.appDnsZones,
+            clusters: props.clusters,
+            sshConfigured: props.sshConfigured,
+            vnetSshConfigPath:
+              '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
+          });
         }
         return pendingPromise;
       }
 
       return new MockedUnaryCall(
-        { dnsZones: props.dnsZones },
-        props.listDnsZones === 'error'
+        {
+          appDnsZones: props.appDnsZones,
+          clusters: props.clusters,
+          sshConfigured: props.sshConfigured,
+          vnetSshConfigPath:
+            '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
+        },
+        props.fetchStatus === 'error'
           ? new Error('something went wrong')
           : undefined
       );
@@ -204,8 +221,8 @@ export function VnetSliderStep(props: StoryProps) {
     >
       <ConnectionsContextProvider>
         <VnetContextProvider>
-          {props.listDnsZones === 'processing-with-previous-results' && (
-            <RerequestDNSZones />
+          {props.fetchStatus === 'processing-with-previous-results' && (
+            <RerequestServiceInfo />
           )}
           <Component
             refCallback={noop}
@@ -221,16 +238,73 @@ export function VnetSliderStep(props: StoryProps) {
   );
 }
 
-const RerequestDNSZones = () => {
-  const { listDNSZones, listDNSZonesAttempt } = useVnetContext();
+const RerequestServiceInfo = () => {
+  const { serviceInfoAttempt, refreshServiceInfoAttempt } = useVnetContext();
 
   useEffect(() => {
-    if (listDNSZonesAttempt.status === 'success') {
-      listDNSZones();
+    if (serviceInfoAttempt.status === 'success') {
+      refreshServiceInfoAttempt();
     }
-  }, [listDNSZonesAttempt, listDNSZones]);
+  }, [serviceInfoAttempt, refreshServiceInfoAttempt]);
 
   return null;
 };
 
 const noop = () => {};
+
+export const CloudCustomer: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: ['example.teleport.sh'],
+    clusters: ['example.teleport.sh'],
+  },
+};
+
+export const SelfHostedWithDifferentClusterName: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: ['teleport.example.com'],
+    clusters: ['teleport-example'],
+  },
+};
+
+export const SelfHostedWithEqualNameAndLeaf: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: ['teleport.example.com', 'leaf.example.com'],
+    clusters: ['teleport.example.com', 'leaf.example.com'],
+  },
+};
+
+export const SelfHostedWithEqualNameAndDifferentLeaf: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: ['teleport.example.com', 'leaf.example.com'],
+    clusters: ['teleport.example.com', 'teleport-leaf'],
+  },
+};
+
+export const SelfHostedWithEqualNameAndCustomDNSZones: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: ['teleport.example.com', 'company.com', 'apps.company'],
+    clusters: ['teleport.example.com'],
+  },
+};
+
+export const SelfHostedWithManyLeavesAndZones: StoryObj<StoryProps> = {
+  args: {
+    ...defaultArgs,
+    appDnsZones: [
+      'teleport.example.com',
+      'leaf.example.com',
+      'second-leaf.example.com',
+      'company.com',
+    ],
+    clusters: [
+      'teleport.example.com',
+      'teleport-leaf',
+      'second-leaf.example.com',
+    ],
+  },
+};
diff --git a/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.tsx b/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.tsx
index 89fe7bde6cec1..49e4afd0a75ba 100644
--- a/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/VnetSliderStep.tsx
@@ -19,11 +19,13 @@
 import { PropsWithChildren, useCallback, useEffect, useRef } from 'react';
 
 import { Box, ButtonSecondary, Flex, Text } from 'design';
+import { ActionButton } from 'design/Alert';
 import { StepComponentProps } from 'design/StepSlider';
 import { useRefAutoFocus } from 'shared/hooks';
 import { useDelayedRepeatedAttempt } from 'shared/hooks/useAsync';
 import { mergeRefs } from 'shared/libs/mergeRefs';
 
+import { ConnectionKindIndicator } from 'teleterm/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionItem';
 import { ConnectionStatusIndicator } from 'teleterm/ui/TopBar/Connections/ConnectionsFilterableList/ConnectionStatusIndicator';
 
 import { DiagnosticsAlert } from './DiagnosticsAlert';
@@ -104,18 +106,19 @@ export const VnetSliderStep = (props: StepComponentProps) => {
           ) : (
             <Flex flexDirection="column" gap={1}>
               <Text>
-                VNet enables any program to connect to TCP apps protected by
-                Teleport.
+                VNet enables any program to connect to TCP apps or SSH servers
+                protected by Teleport.
               </Text>
               <Text>
-                Start VNet and connect to any TCP app over its public address –
-                VNet authenticates the connection for you under the hood.
+                Start VNet and connect to any TCP app or SSH server at its own
+                DNS address – VNet authenticates the connection for you under
+                the hood.
               </Text>
             </Flex>
           ))}
       </Flex>
 
-      {status.value === 'running' && <DnsZones />}
+      {status.value === 'running' && <VnetStatus />}
 
       <DiagnosticsAlert
         runDiagnosticsFromVnetPanel={runDiagnosticsFromVnetPanel}
@@ -132,41 +135,42 @@ const ErrorText = (props: PropsWithChildren) => (
 );
 
 /**
- * DnsZones displays the list of currently proxied DNS zones, as understood by the VNet admin
- * process. The list is cached in the context and updated when the VNet panel gets opened.
+ * VnetStatus displays the status of the running VNet service. The list is cached in the context and
+ * updated when the VNet panel gets opened.
  *
  * As for 95% of users the list will never change during the lifespan of VNet, the VNet panel always
  * optimistically displays previously fetched results while fetching new list.
  */
-const DnsZones = () => {
-  const { listDNSZones, listDNSZonesAttempt: eagerListDNSZonesAttempt } =
-    useVnetContext();
-  const listDNSZonesAttempt = useDelayedRepeatedAttempt(
-    eagerListDNSZonesAttempt
-  );
-  const dnsZonesRefreshRequestedRef = useRef(false);
+const VnetStatus = () => {
+  const {
+    refreshServiceInfoAttempt,
+    serviceInfoAttempt: eagerServiceInfoAttempt,
+    openSSHConfigurationModal,
+  } = useVnetContext();
+  const serviceInfoAttempt = useDelayedRepeatedAttempt(eagerServiceInfoAttempt);
+  const serviceInfoRefreshRequestedRef = useRef(false);
 
   useEffect(
     function refreshListOnOpen() {
-      if (!dnsZonesRefreshRequestedRef.current) {
-        dnsZonesRefreshRequestedRef.current = true;
-        listDNSZones();
+      if (!serviceInfoRefreshRequestedRef.current) {
+        serviceInfoRefreshRequestedRef.current = true;
+        refreshServiceInfoAttempt();
       }
     },
-    [listDNSZones]
+    [refreshServiceInfoAttempt]
   );
 
-  if (listDNSZonesAttempt.status === 'error') {
+  if (serviceInfoAttempt.status === 'error') {
     return (
       <Text p={textSpacing}>
         <ConnectionStatusIndicator status="warning" inline mr={2} />
-        VNet is working, but Teleport Connect could not fetch DNS zones:{' '}
-        {listDNSZonesAttempt.statusText}
+        VNet is running, but Teleport Connect could not fetch its status:{' '}
+        {serviceInfoAttempt.statusText}
         <ButtonSecondary
           ml={2}
           size="small"
           type="button"
-          onClick={listDNSZones}
+          onClick={refreshServiceInfoAttempt}
         >
           Retry
         </ButtonSecondary>
@@ -175,36 +179,115 @@ const DnsZones = () => {
   }
 
   if (
-    listDNSZonesAttempt.status === '' ||
-    (listDNSZonesAttempt.status === 'processing' && !listDNSZonesAttempt.data)
+    serviceInfoAttempt.status === '' ||
+    (serviceInfoAttempt.status === 'processing' && !serviceInfoAttempt.data)
   ) {
     return (
       <Text p={textSpacing}>
         <ConnectionStatusIndicator status="processing" inline mr={2} />
-        Updating the list of DNS zones…
+        Updating VNet status…
       </Text>
     );
   }
 
-  const dnsZones = listDNSZonesAttempt.data;
+  const statusIndicator = (
+    <ConnectionStatusIndicator
+      status={serviceInfoAttempt.status === 'success' ? 'on' : 'processing'}
+      title={
+        serviceInfoAttempt.status === 'processing'
+          ? 'Updating VNet status…'
+          : undefined
+      }
+      inline
+      mr={2}
+      mt={2}
+    />
+  );
 
-  return (
-    <Text p={textSpacing}>
-      <ConnectionStatusIndicator
-        status={listDNSZonesAttempt.status === 'success' ? 'on' : 'processing'}
-        title={
-          listDNSZonesAttempt.status === 'processing'
-            ? 'Updating the list of DNS zones…'
-            : undefined
-        }
-        inline
-        mr={2}
+  const serviceInfo = serviceInfoAttempt.data;
+
+  const sshConfiguredIndicator = serviceInfo.sshConfigured ? null : (
+    <Flex justifyContent="space-between" alignItems="center">
+      <Flex>
+        <ConnectionStatusIndicator status={'warning'} inline mr={2} />
+        <Text>SSH clients are not configured to use VNet</Text>
+      </Flex>
+
+      <ActionButton
+        fill="filled"
+        intent="neutral"
+        inputAlignment
+        action={{
+          onClick: () =>
+            openSSHConfigurationModal({
+              vnetSSHConfigPath: serviceInfo.vnetSshConfigPath,
+            }),
+          content: 'Resolve',
+        }}
       />
-      {dnsZones.length === 0 ? (
-        <>No clusters connected yet, VNet is not proxying any connections.</>
-      ) : (
-        <>Proxying TCP connections to {dnsZones.join(', ')}</>
-      )}
-    </Text>
+    </Flex>
+  );
+
+  if (serviceInfo.appDnsZones.length == 0 && serviceInfo.clusters.length == 0) {
+    return (
+      <Flex p={textSpacing}>
+        {statusIndicator}
+        No clusters connected yet, VNet is not proxying any connections.
+      </Flex>
+    );
+  }
+
+  const appDNSZones = new Set(serviceInfo.appDnsZones);
+  const sshClusters = new Set(serviceInfo.clusters);
+  const appAndSshAreEqual =
+    appDNSZones.size == sshClusters.size && appDNSZones.isSubsetOf(sshClusters);
+
+  if (appAndSshAreEqual) {
+    return (
+      <Text p={textSpacing}>
+        <Flex>
+          {statusIndicator}
+          Proxying TCP and SSH connections to {[...appDNSZones].join(', ')}
+        </Flex>
+        {sshConfiguredIndicator}
+      </Text>
+    );
+  }
+
+  const both = [...appDNSZones.intersection(sshClusters)].sort();
+  const justTCP = [...appDNSZones.difference(sshClusters)].sort();
+  const justSSH = [...sshClusters.difference(appDNSZones)].sort();
+
+  return (
+    <Box p={textSpacing}>
+      <Flex>
+        {statusIndicator}
+        <Box>
+          Proxying TCP and SSH connections to:
+          <Text typography="body2">
+            {both.length ? (
+              <Box>
+                <ConnectionKindIndicator bold>TCP</ConnectionKindIndicator>
+                <ConnectionKindIndicator bold>SSH</ConnectionKindIndicator>
+                {both.join(', ')}
+              </Box>
+            ) : null}
+            {justTCP.length ? (
+              <Box>
+                <ConnectionKindIndicator bold>TCP</ConnectionKindIndicator>
+                {justTCP.join(', ')}
+              </Box>
+            ) : null}
+            {justSSH.length ? (
+              <Box>
+                <ConnectionKindIndicator bold>SSH</ConnectionKindIndicator>
+                {justSSH.join(', ')}
+              </Box>
+            ) : null}
+          </Text>
+        </Box>
+      </Flex>
+      {sshConfiguredIndicator}
+    </Box>
   );
 };
diff --git a/web/packages/teleterm/src/ui/Vnet/index.ts b/web/packages/teleterm/src/ui/Vnet/index.ts
index 84e6538a4bc67..0199a9148e28a 100644
--- a/web/packages/teleterm/src/ui/Vnet/index.ts
+++ b/web/packages/teleterm/src/ui/Vnet/index.ts
@@ -19,4 +19,4 @@
 export * from './VnetSliderStep';
 export * from './vnetContext';
 export { VnetConnectionItem } from './VnetConnectionItem';
-export * from './useVnetAppLauncher';
+export * from './useVnetLauncher';
diff --git a/web/packages/teleterm/src/ui/Vnet/integration.test.tsx b/web/packages/teleterm/src/ui/Vnet/integration.test.tsx
index 275b7e41c8fdd..054bcd675fd75 100644
--- a/web/packages/teleterm/src/ui/Vnet/integration.test.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/integration.test.tsx
@@ -29,6 +29,7 @@ import { proxyHostname } from 'teleterm/services/tshd/cluster';
 import { makeApp, makeRootCluster } from 'teleterm/services/tshd/testHelpers';
 import { App } from 'teleterm/ui/App';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+import { routing } from 'teleterm/ui/uri';
 
 beforeAll(() => {
   Logger.init(new NullService());
@@ -70,6 +71,7 @@ test.each(tests)(
     const user = userEvent.setup();
     const ctx = new MockAppContext();
     const rootCluster = makeRootCluster();
+    ctx.addRootCluster(rootCluster, { noActivate: true });
     ctx.configService.set('usageReporting.enabled', false);
 
     jest.spyOn(ctx.tshd, 'listUnifiedResources').mockReturnValue(
@@ -83,20 +85,21 @@ test.each(tests)(
         ],
       })
     );
-    jest.spyOn(ctx.tshd, 'listRootClusters').mockReturnValue(
+    jest.spyOn(ctx.vnet, 'getServiceInfo').mockReturnValue(
       new MockedUnaryCall({
-        clusters: [rootCluster],
-      })
-    );
-    jest.spyOn(ctx.vnet, 'listDNSZones').mockReturnValue(
-      new MockedUnaryCall({
-        dnsZones: [proxyHostname(rootCluster.proxyHost)],
+        appDnsZones: [proxyHostname(rootCluster.proxyHost)],
+        clusters: [rootCluster.name],
+        sshConfigured: true,
+        vnetSshConfigPath:
+          '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
       })
     );
 
     render(<App ctx={ctx} />);
 
-    await user.click(await screen.findByText(rootCluster.name));
+    await user.click(
+      await screen.findByText(routing.parseClusterName(rootCluster.uri))
+    );
     act(mio.enterAll);
 
     expect(
@@ -120,7 +123,7 @@ test.each(tests)(
     ).toBeInTheDocument();
     await user.click(within(docVnetInfo).getByText('Start VNet'));
     expect(
-      await screen.findByText(/Proxying TCP connections/)
+      await screen.findByText(/Proxying TCP and SSH connections/)
     ).toBeInTheDocument();
 
     // Verify that a notification is shown and that the address is in the clipboard.
@@ -141,7 +144,7 @@ test.each(tests)(
     await user.click(within(docVnetInfo).getByText('Stop VNet'));
     await user.click(await within(docVnetInfo).findByText('Start VNet'));
     expect(
-      await screen.findByText(/Proxying TCP connections/)
+      await screen.findByText(/Proxying TCP and SSH connections/)
     ).toBeInTheDocument();
 
     // Verify that the address was not copied to the clipboard after the second start from the "Start
@@ -160,6 +163,7 @@ test.each(tests)(
     const user = userEvent.setup();
     const ctx = new MockAppContext();
     const rootCluster = makeRootCluster();
+    ctx.addRootCluster(rootCluster, { noActivate: true });
     ctx.configService.set('usageReporting.enabled', false);
     ctx.statePersistenceService.putState({
       ...ctx.statePersistenceService.getState(),
@@ -177,20 +181,21 @@ test.each(tests)(
         ],
       })
     );
-    jest.spyOn(ctx.tshd, 'listRootClusters').mockReturnValue(
-      new MockedUnaryCall({
-        clusters: [rootCluster],
-      })
-    );
-    jest.spyOn(ctx.vnet, 'listDNSZones').mockReturnValue(
+    jest.spyOn(ctx.vnet, 'getServiceInfo').mockReturnValue(
       new MockedUnaryCall({
-        dnsZones: [proxyHostname(rootCluster.proxyHost)],
+        appDnsZones: [proxyHostname(rootCluster.proxyHost)],
+        clusters: [rootCluster.name],
+        sshConfigured: true,
+        vnetSshConfigPath:
+          '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
       })
     );
 
     render(<App ctx={ctx} />);
 
-    await user.click(await screen.findByText(rootCluster.name));
+    await user.click(
+      await screen.findByText(routing.parseClusterName(rootCluster.uri))
+    );
     act(mio.enterAll);
 
     expect(
@@ -209,7 +214,7 @@ test.each(tests)(
 
     // Verify that VNet is running and that the public address was copied to the clipboard.
     expect(
-      await screen.findByText(/Proxying TCP connections/)
+      await screen.findByText(/Proxying TCP and SSH connections/)
     ).toBeInTheDocument();
     expect(
       await screen.findByText(
@@ -234,22 +239,24 @@ test('launching VNet for the first time from the connections panel does not open
   const user = userEvent.setup();
   const ctx = new MockAppContext();
   const rootCluster = makeRootCluster();
+  ctx.addRootCluster(rootCluster, { noActivate: true });
   ctx.configService.set('usageReporting.enabled', false);
 
-  jest.spyOn(ctx.tshd, 'listRootClusters').mockReturnValue(
-    new MockedUnaryCall({
-      clusters: [rootCluster],
-    })
-  );
-  jest.spyOn(ctx.vnet, 'listDNSZones').mockReturnValue(
+  jest.spyOn(ctx.vnet, 'getServiceInfo').mockReturnValue(
     new MockedUnaryCall({
-      dnsZones: [proxyHostname(rootCluster.proxyHost)],
+      appDnsZones: [proxyHostname(rootCluster.proxyHost)],
+      clusters: [rootCluster.name],
+      sshConfigured: true,
+      vnetSshConfigPath:
+        '/Users/user/Library/Application Support/Teleport Connect/tsh/vnet_ssh_config',
     })
   );
 
   render(<App ctx={ctx} />);
 
-  await user.click(await screen.findByText(rootCluster.name));
+  await user.click(
+    await screen.findByText(routing.parseClusterName(rootCluster.uri))
+  );
   act(mio.enterAll);
 
   // Start VNet.
diff --git a/web/packages/teleterm/src/ui/Vnet/useVnetAppLauncher.tsx b/web/packages/teleterm/src/ui/Vnet/useVnetAppLauncher.tsx
deleted file mode 100644
index dd18aaeeddecc..0000000000000
--- a/web/packages/teleterm/src/ui/Vnet/useVnetAppLauncher.tsx
+++ /dev/null
@@ -1,177 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2024 Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { useCallback, useMemo } from 'react';
-
-import { useAppContext } from 'teleterm/ui/appContextProvider';
-import { useConnectionsContext } from 'teleterm/ui/TopBar/Connections/connectionsContext';
-import { ResourceUri, routing } from 'teleterm/ui/uri';
-
-import { useVnetContext } from './vnetContext';
-
-export type VnetAppLauncher = (args: VnetAppLauncherArgs) => Promise<void>;
-
-// NOTE: Almost every field added to VnetAppLauncherArgs will need to be added to DocumentVnetInfo.
-//
-// This is because during the first launch of VNet through useVnetAppLauncher, the act of launching
-// VNet is split into two parts. When a user clicks the "Connect" button next to a TCP app or opens
-// one from the search bar, a DocumentVnetInfo is opened first. Then the user can start VNet from
-// there, which should carry out the launch of that particular app. Hence the need to copy some
-// arguments from the app to the doc.
-type VnetAppLauncherArgs = {
-  addrToCopy: string | undefined;
-  /**
-   * resourceUri lets the VNet launcher establish which workspace to open the info doc in if
-   * there's a need to do it.
-   */
-  resourceUri: ResourceUri;
-  isMultiPort: boolean;
-};
-
-export const useVnetAppLauncher = (): {
-  /**
-   * launchVnet is a function that manages VNet start when:
-   *
-   * - The user clicks "Connect" next to a TCP app or selects one of the ports from the menu.
-   * - The user selects a TCP app through the search bar.
-   *
-   * If the user is yet to start VNet, it opens the info doc. If they already started it in the past,
-   * it starts VNet and then copies the address of the app to the clipboard.
-   */
-  launchVnet: VnetAppLauncher;
-  /**
-   * launchVnetWithoutFirstTimeCheck never opens the info doc, it starts VNet and then copies the
-   * address of the app to the clipboard.
-   */
-  launchVnetWithoutFirstTimeCheck: (
-    args: Pick<VnetAppLauncherArgs, 'addrToCopy' | 'isMultiPort'>
-  ) => Promise<void>;
-} => {
-  const { notificationsService, workspacesService } = useAppContext();
-  const { start, status, startAttempt, hasEverStarted } = useVnetContext();
-  const { open } = useConnectionsContext();
-
-  const launchVnet: () => Promise<boolean> = useCallback(async () => {
-    if (status.value === 'running' || startAttempt.status === 'processing') {
-      return true;
-    }
-
-    open('vnet');
-
-    const [, error] = await start();
-    if (error) {
-      // The error is going to be shown in the VNet panel that was just opened.
-      return false;
-    }
-    return true;
-  }, [status.value, startAttempt.status, open, start]);
-
-  const openInfoDoc = useCallback(
-    async ({ addrToCopy, resourceUri, isMultiPort }: VnetAppLauncherArgs) => {
-      const rootClusterUri = routing.ensureRootClusterUri(resourceUri);
-      // Since VNet app launcher might be called from the search bar, we have to account for the
-      // user being in a different workspace than the selected app.
-      const { isAtDesiredWorkspace } =
-        await workspacesService.setActiveWorkspace(rootClusterUri);
-
-      if (!isAtDesiredWorkspace) {
-        return;
-      }
-
-      const docsService =
-        workspacesService.getWorkspaceDocumentService(rootClusterUri);
-      const docUri = docsService.openExistingOrAddNew(
-        d => d.kind === 'doc.vnet_info',
-        () =>
-          docsService.createVnetInfoDocument({
-            rootClusterUri,
-          })
-      );
-      // Update targetAddress so that clicking "Start VNet" from the info doc is going to copy that
-      // address to clipboard.
-      docsService.update(docUri, {
-        app: { targetAddress: addrToCopy, isMultiPort },
-      });
-    },
-    [workspacesService]
-  );
-
-  const launchVnetAndCopyAddr = useCallback(
-    async ({
-      addrToCopy,
-      isMultiPort,
-    }: Pick<VnetAppLauncherArgs, 'addrToCopy' | 'isMultiPort'>) => {
-      if (!(await launchVnet())) {
-        return;
-      }
-
-      if (!addrToCopy) {
-        return;
-      }
-
-      const copiedToClipboard = copyAddrToClipboard(addrToCopy);
-      notificationsService.notifyInfo(
-        [
-          `Connect via VNet by using ${addrToCopy}`,
-          copiedToClipboard && '(copied to clipboard)',
-          !isMultiPort && 'and any port',
-        ]
-          .filter(Boolean)
-          .join(' ') + '.'
-      );
-    },
-    [launchVnet, notificationsService]
-  );
-
-  return useMemo(
-    () => ({
-      launchVnet: async args => {
-        if (!hasEverStarted) {
-          openInfoDoc(args);
-          return;
-        }
-
-        await launchVnetAndCopyAddr(args);
-      },
-      launchVnetWithoutFirstTimeCheck: launchVnetAndCopyAddr,
-    }),
-    [hasEverStarted, openInfoDoc, launchVnetAndCopyAddr]
-  );
-};
-
-/**
- * Returns true if address was copied to clipboard.
- */
-const copyAddrToClipboard = async (addrToCopy: string): Promise<boolean> => {
-  try {
-    await navigator.clipboard.writeText(addrToCopy);
-  } catch (error) {
-    // On macOS, if the user starts VNet for the first time, the app does not have focus after
-    // approving the background item. Chromium has strict rules regarding when JS can access the
-    // clipboard, so it'll throw an error. https://github.com/gravitational/teleport/issues/53290
-    //
-    // Similarly, in dev mode if the user uses the mouse rather than the keyboard to proceed with
-    // the osascript prompt, there will also be a problem with focus.
-    if (error['name'] === 'NotAllowedError') {
-      console.error(error);
-      return false;
-    }
-    throw error;
-  }
-  return true;
-};
diff --git a/web/packages/teleterm/src/ui/Vnet/useVnetLauncher.tsx b/web/packages/teleterm/src/ui/Vnet/useVnetLauncher.tsx
new file mode 100644
index 0000000000000..96fa09bb30ea4
--- /dev/null
+++ b/web/packages/teleterm/src/ui/Vnet/useVnetLauncher.tsx
@@ -0,0 +1,204 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo } from 'react';
+
+import { GetServiceInfoResponse } from 'gen-proto-ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb';
+import { ensureError } from 'shared/utils/error';
+
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { VnetLauncherArgs } from 'teleterm/ui/services/workspacesService/documentsService/types';
+import { useConnectionsContext } from 'teleterm/ui/TopBar/Connections/connectionsContext';
+import { routing } from 'teleterm/ui/uri';
+
+import { useVnetContext } from './vnetContext';
+
+export type VnetLauncher = (args: VnetLauncherArgs) => Promise<void>;
+
+export const useVnetLauncher = (): {
+  /**
+   * launchVnet is a function that manages VNet start when:
+   *
+   * - The user clicks "Connect" next to a TCP app or selects one of the ports from the menu.
+   * - The user selects a TCP app through the search bar.
+   * - The user clicks "Connect with VNet" on an SSH server.
+   *
+   * If the user is yet to start VNet, it opens the info doc. If they already started it in the past,
+   * it starts VNet and then copies the address of the resource to the clipboard.
+   */
+  launchVnet: VnetLauncher;
+  /**
+   * launchVnetWithoutFirstTimeCheck never opens the info doc, it starts VNet and then copies the
+   * address of the resource to the clipboard.
+   */
+  launchVnetWithoutFirstTimeCheck: (args?: VnetLauncherArgs) => Promise<void>;
+} => {
+  const { notificationsService, workspacesService } = useAppContext();
+  const {
+    start,
+    status,
+    startAttempt,
+    hasEverStarted,
+    currentServiceInfo,
+    openSSHConfigurationModal,
+  } = useVnetContext();
+  const { open } = useConnectionsContext();
+
+  const launchVnet: () => Promise<boolean> = useCallback(async () => {
+    if (status.value === 'running' || startAttempt.status === 'processing') {
+      return true;
+    }
+
+    open('vnet');
+
+    const [, error] = await start();
+    if (error) {
+      // The error is going to be shown in the VNet panel that was just opened.
+      return false;
+    }
+    return true;
+  }, [status.value, startAttempt.status, open, start]);
+
+  const openInfoDoc = useCallback(
+    async (args: VnetLauncherArgs) => {
+      const rootClusterUri = routing.ensureRootClusterUri(args.resourceUri);
+      // Since VNet app launcher might be called from the search bar, we have to account for the
+      // user being in a different workspace than the selected app.
+      const { isAtDesiredWorkspace } =
+        await workspacesService.setActiveWorkspace(rootClusterUri);
+
+      if (!isAtDesiredWorkspace) {
+        return;
+      }
+
+      const docsService =
+        workspacesService.getWorkspaceDocumentService(rootClusterUri);
+      const docUri = docsService.openExistingOrAddNew(
+        d => d.kind === 'doc.vnet_info',
+        () =>
+          docsService.createVnetInfoDocument({
+            rootClusterUri,
+          })
+      );
+      // Update targetAddress so that clicking "Start VNet" from the info doc is going to copy that
+      // address to clipboard.
+      docsService.update(docUri, {
+        launcherArgs: args,
+      });
+    },
+    [workspacesService]
+  );
+
+  const launchVnetAndCopyAddr = useCallback(
+    async (args?: VnetLauncherArgs) => {
+      if (!(await launchVnet())) {
+        return;
+      }
+      if (!args) {
+        // args are optional, if unset don't copy anything to the clipboard.
+        return;
+      }
+      const { addrToCopy, isMultiPortApp, resourceUri } = args;
+      const isApp = !!routing.parseAppUri(resourceUri)?.params?.appId;
+      const isServer = !!routing.parseServerUri(resourceUri)?.params?.serverId;
+
+      let msgParts = [];
+      if (isApp) {
+        msgParts.push(`Connect via VNet by using ${addrToCopy}`);
+      } else if (isServer) {
+        msgParts.push(`Connect with any SSH client to ${addrToCopy}`);
+      } else {
+        msgParts.push(`Connect via VNet to ${addrToCopy}`);
+      }
+      if (copyAddrToClipboard(addrToCopy)) {
+        msgParts.push('(copied to clipboard)');
+      }
+      if (isApp && !isMultiPortApp) {
+        msgParts.push('and any port');
+      }
+      const msg = msgParts.join(' ') + '.';
+
+      if (isServer) {
+        let serviceInfo: GetServiceInfoResponse;
+        try {
+          serviceInfo = await currentServiceInfo();
+        } catch (err) {
+          notificationsService.notifyError({
+            title:
+              'Could not establish whether SSH clients are configured for VNet',
+            description: ensureError(err).message,
+          });
+          return;
+        }
+        if (!serviceInfo.sshConfigured) {
+          openSSHConfigurationModal({
+            vnetSSHConfigPath: serviceInfo.vnetSshConfigPath,
+            host: addrToCopy,
+            onSuccess: () => notificationsService.notifyInfo(msg),
+          });
+          return;
+        }
+      }
+
+      notificationsService.notifyInfo(msg);
+    },
+    [
+      launchVnet,
+      notificationsService,
+      currentServiceInfo,
+      openSSHConfigurationModal,
+    ]
+  );
+
+  return useMemo(
+    () => ({
+      launchVnet: async args => {
+        if (!hasEverStarted) {
+          openInfoDoc(args);
+          return;
+        }
+
+        await launchVnetAndCopyAddr(args);
+      },
+      launchVnetWithoutFirstTimeCheck: launchVnetAndCopyAddr,
+    }),
+    [hasEverStarted, openInfoDoc, launchVnetAndCopyAddr]
+  );
+};
+
+/**
+ * Returns true if address was copied to clipboard.
+ */
+const copyAddrToClipboard = async (addrToCopy: string): Promise<boolean> => {
+  try {
+    await navigator.clipboard.writeText(addrToCopy);
+  } catch (error) {
+    // On macOS, if the user starts VNet for the first time, the app does not have focus after
+    // approving the background item. Chromium has strict rules regarding when JS can access the
+    // clipboard, so it'll throw an error. https://github.com/gravitational/teleport/issues/53290
+    //
+    // Similarly, in dev mode if the user uses the mouse rather than the keyboard to proceed with
+    // the osascript prompt, there will also be a problem with focus.
+    if (error['name'] === 'NotAllowedError') {
+      console.error(error);
+      return false;
+    }
+    throw error;
+  }
+  return true;
+};
diff --git a/web/packages/teleterm/src/ui/Vnet/vnetContext.test.tsx b/web/packages/teleterm/src/ui/Vnet/vnetContext.test.tsx
index 3bb407ef92671..e08aecf3a2b21 100644
--- a/web/packages/teleterm/src/ui/Vnet/vnetContext.test.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/vnetContext.test.tsx
@@ -20,8 +20,8 @@ import { act, renderHook, waitFor } from '@testing-library/react';
 import {
   ComponentType,
   createRef,
-  MutableRefObject,
   PropsWithChildren,
+  RefObject,
   useEffect,
   useImperativeHandle,
 } from 'react';
@@ -218,16 +218,16 @@ describe('diag notification', () => {
   const tests: Array<{
     it: string;
     /** Ref for opening/closing the connections panel. If provided, the panel will be open by default. */
-    controlConnectionsRef?: MutableRefObject<ControlConnections>;
+    controlConnectionsRef?: RefObject<ControlConnections>;
     mockAppContext: (appContext: MockAppContext) => void;
     verify: (
       appContext: MockAppContext,
       result: { current: VnetContext },
-      controlConnectionsRef?: MutableRefObject<ControlConnections>
+      controlConnectionsRef?: RefObject<ControlConnections>
     ) => Promise<void>;
   }> = [
     {
-      it: 'is shown when the report cycles from issues found to no issues and back to issues found',
+      it: 'is shown, closed, then shown again when the report cycles from issues found to no issues and back to issues found',
       mockAppContext: appContext => {
         jest
           .spyOn(appContext.vnet, 'runDiagnostics')
@@ -253,7 +253,12 @@ describe('diag notification', () => {
         );
 
         expect(notificationsService.notifyWarning).toHaveBeenCalledTimes(2);
-        expect(notificationsService.getNotifications()).toHaveLength(1);
+        const notifications = notificationsService.getNotifications();
+        expect(notifications).toHaveLength(1);
+        expect(notifications[0].content).toMatchObject({
+          description: undefined,
+          action: expect.objectContaining({ content: 'Open Diag Report' }),
+        });
       },
     },
     {
@@ -407,6 +412,32 @@ describe('diag notification', () => {
         expect(notificationsService.getNotifications()).toHaveLength(1);
       },
     },
+    {
+      it: 'does not show a button to open the diag report if there is no workspace',
+      mockAppContext: appContext => {
+        jest
+          .spyOn(appContext.vnet, 'runDiagnostics')
+          .mockResolvedValue(
+            new MockedUnaryCall({ report: issuesFoundReport })
+          );
+        appContext.workspacesService.setState(draft => {
+          draft.rootClusterUri = undefined;
+        });
+      },
+      verify: async ({ notificationsService }, result) => {
+        await waitFor(
+          () =>
+            expect(result.current.diagnosticsAttempt.status).toEqual('success'),
+          { interval }
+        );
+        const notifications = notificationsService.getNotifications();
+        expect(notifications).toHaveLength(1);
+        expect(notifications[0].content).toMatchObject({
+          description: expect.stringContaining('Log in to a cluster'),
+          action: undefined,
+        });
+      },
+    },
   ];
 
   // eslint-disable-next-line jest/expect-expect
@@ -445,7 +476,7 @@ describe('diag notification', () => {
 const Wrapper = (
   props: PropsWithChildren<{
     appContext: IAppContext;
-    controlConnectionsRef?: MutableRefObject<ControlConnections>;
+    controlConnectionsRef?: RefObject<ControlConnections>;
   }>
 ) => {
   return (
@@ -480,7 +511,7 @@ function createWrapper<Props>(
 }
 
 const OpenConnections = (props: {
-  controlConnectionsRef: MutableRefObject<ControlConnections>;
+  controlConnectionsRef: RefObject<ControlConnections>;
 }) => {
   const { open, close } = useConnectionsContext();
   useImperativeHandle(props.controlConnectionsRef, () => ({ open, close }));
diff --git a/web/packages/teleterm/src/ui/Vnet/vnetContext.tsx b/web/packages/teleterm/src/ui/Vnet/vnetContext.tsx
index 4deba14e0d802..d0130ddd155e8 100644
--- a/web/packages/teleterm/src/ui/Vnet/vnetContext.tsx
+++ b/web/packages/teleterm/src/ui/Vnet/vnetContext.tsx
@@ -28,7 +28,11 @@ import {
   useState,
 } from 'react';
 
-import { BackgroundItemStatus } from 'gen-proto-ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb';
+import { Action } from 'design/Alert';
+import {
+  BackgroundItemStatus,
+  GetServiceInfoResponse,
+} from 'gen-proto-ts/teleport/lib/teleterm/vnet/v1/vnet_service_pb';
 import { Report } from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
 import { useStateRef } from 'shared/hooks';
 import { Attempt, makeEmptyAttempt, useAsync } from 'shared/hooks/useAsync';
@@ -51,17 +55,23 @@ export type VnetContext = {
    * Describes whether the given OS can run VNet.
    */
   isSupported: boolean;
-  /**
-   * Describes whether the given OS can run VNet diagnostics.
-   */
-  isDiagSupported: boolean;
   status: VnetStatus;
   start: () => Promise<[void, Error]>;
   startAttempt: Attempt<void>;
   stop: () => Promise<[void, Error]>;
   stopAttempt: Attempt<void>;
-  listDNSZones: () => Promise<[string[], Error]>;
-  listDNSZonesAttempt: Attempt<string[]>;
+  /**
+   * Always returns the current VNet service info by making a gRPC call to the service.
+   */
+  currentServiceInfo: () => Promise<GetServiceInfoResponse>;
+  /**
+   * The current attempt to get the VNet service info.
+   */
+  serviceInfoAttempt: Attempt<GetServiceInfoResponse>;
+  /**
+   * Refreshes serviceInfoAttempt by making a new gRPC call to the service.
+   */
+  refreshServiceInfoAttempt: () => Promise<[GetServiceInfoResponse, Error]>;
   runDiagnostics: () => Promise<[Report, Error]>;
   diagnosticsAttempt: Attempt<Report>;
   /**
@@ -106,6 +116,18 @@ export type VnetContext = {
    * Whether VNet has started successfully at least once.
    */
   hasEverStarted: boolean;
+  /**
+   * Opens a modal that handles SSH client configuration.
+   */
+  openSSHConfigurationModal: (params: {
+    /** The path to the user's generated VNet SSH config, available in the
+     * service info and diagnostic report. */
+    vnetSSHConfigPath: string;
+    /** Optional host address that will be used for example text. */
+    host?: string;
+    /** Optional callback that will be invoked after SSH clients are configured. */
+    onSuccess?: () => void;
+  }) => void;
 };
 
 export type VnetStatus =
@@ -146,7 +168,6 @@ export const VnetContextProvider: FC<
     [mainProcessClient]
   );
   const isSupported = platform === 'darwin' || platform === 'win32';
-  const isDiagSupported = platform === 'darwin';
 
   const [startAttempt, start] = useAsync(
     useCallback(async () => {
@@ -234,12 +255,12 @@ export const VnetContextProvider: FC<
     ])
   );
 
-  const [listDNSZonesAttempt, listDNSZones] = useAsync(
-    useCallback(
-      () => vnet.listDNSZones({}).then(({ response }) => response.dnsZones),
-      [vnet]
-    )
+  const currentServiceInfo = useCallback(
+    () => vnet.getServiceInfo({}).then(({ response }) => response),
+    [vnet]
   );
+  const [serviceInfoAttempt, refreshServiceInfoAttempt] =
+    useAsync(currentServiceInfo);
 
   /**
    * Calculates whether the button for running diagnostics should be disabled. If it should be
@@ -258,13 +279,14 @@ export const VnetContextProvider: FC<
     [status.value]
   );
 
-  const rootClusterUri = useStoreSelector(
+  const isWorkspaceSelected = useStoreSelector(
     'workspacesService',
-    useCallback(state => state.rootClusterUri, [])
+    useCallback(state => !!state.rootClusterUri, [])
   );
 
   const openReport = useCallback(
     (report: Report) => {
+      const rootClusterUri = workspacesService.getRootClusterUri();
       if (!rootClusterUri) {
         return;
       }
@@ -296,7 +318,7 @@ export const VnetContextProvider: FC<
       // upon on the next run of runDiagnosticsAndShowNotification.
       notificationsService.removeNotification(diagNotificationIdRef.current);
     },
-    [rootClusterUri, workspacesService, notificationsService]
+    [workspacesService, notificationsService]
   );
 
   const showDiagWarningIndicator: boolean = useMemo(
@@ -398,10 +420,10 @@ export const VnetContextProvider: FC<
         return;
       }
 
-      diagNotificationIdRef.current = notificationsService.notifyWarning({
-        isAutoRemovable: false,
-        title: 'Other software on your device might interfere with VNet.',
-        action: {
+      let action: Action;
+      let description: string;
+      if (workspacesService.getRootClusterUri()) {
+        action = {
           content: 'Open Diag Report',
           onClick: () => {
             openReport(report);
@@ -411,7 +433,17 @@ export const VnetContextProvider: FC<
               diagNotificationIdRef.current
             );
           },
-        },
+        };
+      } else {
+        description =
+          'Log in to a cluster to open the diag report from the VNet panel.';
+      }
+
+      diagNotificationIdRef.current = notificationsService.notifyWarning({
+        isAutoRemovable: false,
+        title: 'Other software on your device might interfere with VNet.',
+        description,
+        action,
       });
     },
     [
@@ -421,15 +453,12 @@ export const VnetContextProvider: FC<
       hasDismissedDiagnosticsAlertRef,
       resetHasActedOnPreviousNotification,
       isConnectionsPanelOpenRef,
+      workspacesService,
     ]
   );
 
   useEffect(
     function periodicallyRunDiagnostics() {
-      if (!isDiagSupported) {
-        return;
-      }
-
       if (status.value !== 'running') {
         return;
       }
@@ -451,7 +480,6 @@ export const VnetContextProvider: FC<
       };
     },
     [
-      isDiagSupported,
       diagnosticsIntervalMs,
       runDiagnosticsAndShowNotification,
       status.value,
@@ -459,27 +487,52 @@ export const VnetContextProvider: FC<
     ]
   );
 
+  const autoConfigureSSH = useCallback(async (): Promise<void> => {
+    await vnet.autoConfigureSSH({});
+    // Refresh the service info and diagnostic attempts because SSH is now configured.
+    refreshServiceInfoAttempt();
+    runDiagnostics();
+  }, [vnet, refreshServiceInfoAttempt]);
+  const openSSHConfigurationModal: VnetContext['openSSHConfigurationModal'] =
+    useCallback(
+      ({ vnetSSHConfigPath, host, onSuccess }) => {
+        appCtx.modalsService.openRegularDialog({
+          kind: 'configure-ssh-clients',
+          onConfirm: async () => {
+            await autoConfigureSSH();
+            if (onSuccess) {
+              onSuccess();
+            }
+          },
+          vnetSSHConfigPath,
+          host,
+        });
+      },
+      [appCtx.modalsService, autoConfigureSSH]
+    );
+
   return (
     <VnetContext.Provider
       value={{
         isSupported,
-        isDiagSupported,
         status,
         start,
         startAttempt,
         stop,
         stopAttempt,
-        listDNSZones,
-        listDNSZonesAttempt,
+        currentServiceInfo,
+        serviceInfoAttempt,
+        refreshServiceInfoAttempt,
         runDiagnostics,
         diagnosticsAttempt,
         getDisabledDiagnosticsReason,
         dismissDiagnosticsAlert,
         hasDismissedDiagnosticsAlert,
         reinstateDiagnosticsAlert,
-        openReport: rootClusterUri ? openReport : undefined,
+        openReport: isWorkspaceSelected ? openReport : undefined,
         showDiagWarningIndicator,
         hasEverStarted,
+        openSSHConfigurationModal,
       }}
     >
       {children}
diff --git a/web/packages/teleterm/src/ui/appContext.ts b/web/packages/teleterm/src/ui/appContext.ts
index f766cdec331ef..240925877ff93 100644
--- a/web/packages/teleterm/src/ui/appContext.ts
+++ b/web/packages/teleterm/src/ui/appContext.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { debounce } from 'shared/utils/highbar';
+import { getErrorMessage } from 'shared/utils/error';
 
 import { ConfigService } from 'teleterm/services/config';
 import { TshdClient, VnetClient } from 'teleterm/services/tshd/createClient';
@@ -25,6 +25,7 @@ import {
   MainProcessClient,
   TshdEventContextBridgeService,
 } from 'teleterm/types';
+import { cleanUpBeforeLogout } from 'teleterm/ui/ClusterLogout/cleanUpBeforeLogout';
 import { ClustersService } from 'teleterm/ui/services/clusters';
 import { ConnectionTrackerService } from 'teleterm/ui/services/connectionTracker';
 import { ConnectMyComputerService } from 'teleterm/ui/services/connectMyComputer';
@@ -40,7 +41,11 @@ import { TerminalsService } from 'teleterm/ui/services/terminals';
 import { TshdNotificationsService } from 'teleterm/ui/services/tshdNotifications/tshdNotificationService';
 import { UsageService } from 'teleterm/ui/services/usage';
 import { WorkspacesService } from 'teleterm/ui/services/workspacesService/workspacesService';
-import { IAppContext, UnexpectedVnetShutdownListener } from 'teleterm/ui/types';
+import {
+  IAppContext,
+  ResourceRefreshListener,
+  UnexpectedVnetShutdownListener,
+} from 'teleterm/ui/types';
 
 import { CommandLauncher } from './commandLauncher';
 import { createTshdEventsContextBridgeService } from './tshdEvents';
@@ -81,6 +86,7 @@ export default class AppContext implements IAppContext {
   private _unexpectedVnetShutdownListener:
     | UnexpectedVnetShutdownListener
     | undefined;
+  private _resourceRefreshListener: ResourceRefreshListener | undefined;
 
   constructor(config: ElectronGlobals) {
     const { tshClient, ptyServiceClient, mainProcessClient } = config;
@@ -154,6 +160,9 @@ export default class AppContext implements IAppContext {
       tshClient,
       this.configService
     );
+
+    this.registerClusterLifecycleHandler();
+    this.subscribeToProfileWatcherErrors();
   }
 
   async pullInitialState(): Promise<void> {
@@ -161,7 +170,6 @@ export default class AppContext implements IAppContext {
       createTshdEventsContextBridgeService(this)
     );
 
-    this.notifyMainProcessAboutClusterListChanges();
     void this.clustersService.syncGatewaysAndCatchErrors();
     await this.clustersService.syncRootClustersAndCatchErrors();
     this.workspacesService.restorePersistedState();
@@ -198,22 +206,77 @@ export default class AppContext implements IAppContext {
     return this._unexpectedVnetShutdownListener;
   }
 
-  private notifyMainProcessAboutClusterListChanges() {
-    // Debounce the notifications sent to the main process so that we don't unnecessarily send more
-    // than one notification per frame. The main process doesn't need to be notified absolutely
-    // immediately after a change in the cluster list.
-    //
-    // The clusters map in ClustersService gets updated a bunch of times during the start of the
-    // app. After each update, the renderer tells the main process to refresh the list. The main
-    // process sends a request to list root clusters and cancels any pending ones. Debouncing here
-    // helps to minimize those cancellations.
-    const refreshClusterList = debounce(
-      this.mainProcessClient.refreshClusterList,
-      16
-    );
-    this.clustersService.subscribeWithSelector(
-      state => state.clusters,
-      refreshClusterList
+  /** Sets the listener and returns a cleanup function which removes the listener. */
+  addResourceRefreshListener(listener: ResourceRefreshListener): () => void {
+    this._resourceRefreshListener = listener;
+
+    return () => {
+      this._resourceRefreshListener = undefined;
+    };
+  }
+
+  /** Gets called when `ClusterLifecycleManager` requests resource refresh. */
+  get resourceRefreshListener(): ResourceRefreshListener {
+    return this._resourceRefreshListener;
+  }
+
+  private registerClusterLifecycleHandler(): void {
+    // Queue chain ensures sequential processing.
+    let processingQueue = Promise.resolve();
+
+    this.mainProcessClient.registerClusterLifecycleHandler(({ uri, op }) => {
+      // Chain onto the queue and catch errors so it keeps processing
+      const task = processingQueue.then(async () => {
+        switch (op) {
+          case 'did-add-cluster':
+            return this.workspacesService.addWorkspace(uri);
+          case 'did-change-access':
+            if (!this.clustersService.findCluster(uri).connected) {
+              // Only refresh resources when the cluster is connected.
+              return;
+            }
+            return this.resourceRefreshListener(uri);
+          case 'will-logout':
+            return cleanUpBeforeLogout(this, uri, { removeWorkspace: false });
+          case 'will-logout-and-remove':
+            return cleanUpBeforeLogout(this, uri, { removeWorkspace: true });
+          default:
+            op satisfies never;
+        }
+      });
+
+      // Update the queue so the next event waits for this one.
+      // Catch errors, they will be returned below.
+      processingQueue = task.catch(() => {});
+
+      return task;
+    });
+  }
+
+  private subscribeToProfileWatcherErrors(): void {
+    let notificationId: string | undefined;
+    this.mainProcessClient.subscribeToProfileWatcherErrors(
+      ({ error, reason }) => {
+        let title: string;
+        switch (reason) {
+          case 'processing-error':
+            title =
+              'Failed to process the detected profile update. Changes made through tsh may not be reflected in the app.';
+            break;
+          case 'exited':
+            title =
+              "Stopped monitoring profiles. Changes made through tsh won't be reflected in the app.";
+            break;
+        }
+
+        if (notificationId) {
+          this.notificationsService.removeNotification(notificationId);
+        }
+        notificationId = this.notificationsService.notifyError({
+          title,
+          description: getErrorMessage(error),
+        });
+      }
     );
   }
 }
diff --git a/web/packages/teleterm/src/ui/commandLauncher.ts b/web/packages/teleterm/src/ui/commandLauncher.ts
index 60bf8364f6521..dc9009de4b8d2 100644
--- a/web/packages/teleterm/src/ui/commandLauncher.ts
+++ b/web/packages/teleterm/src/ui/commandLauncher.ts
@@ -90,11 +90,9 @@ const commands = {
     displayName: '',
     description: '',
     run(ctx: IAppContext, args: { clusterUri: RootClusterUri }) {
-      const cluster = ctx.clustersService.findCluster(args.clusterUri);
       ctx.modalsService.openRegularDialog({
         kind: 'cluster-logout',
-        clusterUri: cluster.uri,
-        clusterTitle: cluster.name,
+        clusterUri: args.clusterUri,
       });
     },
   },
diff --git a/web/packages/teleterm/src/ui/components/FilterableList/FilterableList.test.tsx b/web/packages/teleterm/src/ui/components/FilterableList/FilterableList.test.tsx
index a28cae9809331..6162a2ec7e7b8 100644
--- a/web/packages/teleterm/src/ui/components/FilterableList/FilterableList.test.tsx
+++ b/web/packages/teleterm/src/ui/components/FilterableList/FilterableList.test.tsx
@@ -84,7 +84,7 @@ test('render empty list when search does not match any item', () => {
 });
 
 test('render provided placeholder in the search box', () => {
-  const placeholder = 'Search Connections';
+  const placeholder = 'Search connections';
   render(
     <FilterableList<TestItem>
       items={[]}
diff --git a/web/packages/teleterm/src/ui/components/Notifcations/Notifications.story.tsx b/web/packages/teleterm/src/ui/components/Notifcations/Notifications.story.tsx
index 1f5ae12f23b4d..2b0216fcf1e9e 100644
--- a/web/packages/teleterm/src/ui/components/Notifcations/Notifications.story.tsx
+++ b/web/packages/teleterm/src/ui/components/Notifcations/Notifications.story.tsx
@@ -18,11 +18,11 @@
 
 import { useState } from 'react';
 
-import type {
-  NotificationItem,
-  NotificationSeverity,
-} from '@gravitational/shared/components/Notification';
 import { ButtonPrimary, Flex } from 'design';
+import type {
+  ToastNotificationItem,
+  ToastNotificationSeverity,
+} from 'shared/components/ToastNotification';
 
 import { unique } from 'teleterm/ui/utils/uid';
 
@@ -32,8 +32,8 @@ export default {
   title: 'Teleterm/components/Notifications',
 };
 
-function useNotifications() {
-  const [items, setItems] = useState<NotificationItem[]>([]);
+function useToastNotifications() {
+  const [items, setItems] = useState<ToastNotificationItem[]>([]);
 
   function removeItem(id: string) {
     setItems(prevItems => prevItems.filter(item => item.id !== id));
@@ -43,9 +43,9 @@ function useNotifications() {
 }
 
 export const TitleAndDescriptionContent = () => {
-  const { setItems, removeItem, items } = useNotifications();
+  const { setItems, removeItem, items } = useToastNotifications();
 
-  function notify(severity: NotificationSeverity) {
+  function notify(severity: ToastNotificationSeverity) {
     setItems(prevItems => [
       ...prevItems,
       {
@@ -77,9 +77,9 @@ export const TitleAndDescriptionContent = () => {
 };
 
 export const StringContent = () => {
-  const { setItems, removeItem, items } = useNotifications();
+  const { setItems, removeItem, items } = useToastNotifications();
 
-  function notify(severity: NotificationSeverity) {
+  function notify(severity: ToastNotificationSeverity) {
     setItems(prevItems => [
       ...prevItems,
       {
diff --git a/web/packages/teleterm/src/ui/components/Notifcations/Notifications.tsx b/web/packages/teleterm/src/ui/components/Notifcations/Notifications.tsx
index 7308877085b48..c96fbad876c07 100644
--- a/web/packages/teleterm/src/ui/components/Notifcations/Notifications.tsx
+++ b/web/packages/teleterm/src/ui/components/Notifcations/Notifications.tsx
@@ -19,12 +19,12 @@
 import styled from 'styled-components';
 
 import {
-  Notification,
-  type NotificationItem,
-} from 'shared/components/Notification';
+  ToastNotification,
+  type ToastNotificationItem,
+} from 'shared/components/ToastNotification';
 
 interface NotificationsProps {
-  items: NotificationItem[];
+  items: ToastNotificationItem[];
 
   onRemoveItem(id: string): void;
 }
@@ -33,7 +33,7 @@ export function Notifications(props: NotificationsProps) {
   return (
     <Container>
       {props.items.map(item => (
-        <Notification
+        <ToastNotification
           mb={3}
           key={item.id}
           item={item}
diff --git a/web/packages/teleterm/src/ui/fixtures/mocks.ts b/web/packages/teleterm/src/ui/fixtures/mocks.ts
index 87075e10862f9..c7a7f69e7c16d 100644
--- a/web/packages/teleterm/src/ui/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/ui/fixtures/mocks.ts
@@ -55,7 +55,8 @@ export class MockAppContext extends AppContext {
 
   addRootClusterWithDoc(
     cluster: Cluster,
-    doc: Document[] | Document | undefined
+    doc: Document[] | Document | undefined,
+    options?: AddRootClusterOptions
   ) {
     this.clustersService.setState(draftState => {
       draftState.clusters.set(cluster.uri, cluster);
@@ -63,13 +64,20 @@ export class MockAppContext extends AppContext {
     const docs = Array.isArray(doc) ? doc : [doc];
     this.workspacesService.addWorkspace(cluster.uri);
     this.workspacesService.setState(draftState => {
-      draftState.rootClusterUri = cluster.uri;
+      if (!options?.noActivate) {
+        draftState.rootClusterUri = cluster.uri;
+      }
       draftState.workspaces[cluster.uri].documents = docs.filter(Boolean);
       draftState.workspaces[cluster.uri].location = docs[0]?.uri;
     });
   }
 
-  addRootCluster(cluster: Cluster) {
-    this.addRootClusterWithDoc(cluster, undefined);
+  addRootCluster(cluster: Cluster, options?: AddRootClusterOptions) {
+    this.addRootClusterWithDoc(cluster, undefined, options);
   }
 }
+
+interface AddRootClusterOptions {
+  /** Does not set the cluster as active in workspaces service. */
+  noActivate?: boolean;
+}
diff --git a/web/packages/teleterm/src/ui/hooks/useIsInBackgroundMode.ts b/web/packages/teleterm/src/ui/hooks/useIsInBackgroundMode.ts
new file mode 100644
index 0000000000000..3838f0d3540c5
--- /dev/null
+++ b/web/packages/teleterm/src/ui/hooks/useIsInBackgroundMode.ts
@@ -0,0 +1,41 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useState } from 'react';
+
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+
+/** Returns whether the window is in the background. */
+export function useIsInBackgroundMode() {
+  const ctx = useAppContext();
+  // We assume that the window is visible when the app starts.
+  // This may change in the future.
+  const [isInBackground, setIsInBackground] = useState(false);
+
+  useEffect(() => {
+    const { cleanup } = ctx.mainProcessClient.subscribeToIsInBackgroundMode(
+      ({ isInBackgroundMode }) => {
+        setIsInBackground(isInBackgroundMode);
+      }
+    );
+
+    return cleanup;
+  }, [ctx.mainProcessClient]);
+
+  return isInBackground;
+}
diff --git a/web/packages/teleterm/src/ui/services/clusters/clustersService.test.ts b/web/packages/teleterm/src/ui/services/clusters/clustersService.test.ts
index 2088207b78781..1ff01a388b48b 100644
--- a/web/packages/teleterm/src/ui/services/clusters/clustersService.test.ts
+++ b/web/packages/teleterm/src/ui/services/clusters/clustersService.test.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { MainProcessClient } from 'teleterm/mainProcess/types';
+import { MockMainProcessClient } from 'teleterm/mainProcess/fixtures/mocks';
 import type { TshdClient } from 'teleterm/services/tshd';
 import { MockedUnaryCall } from 'teleterm/services/tshd/cloneableClient';
 import {
@@ -60,9 +60,7 @@ const UsageServiceMock = UsageService as jest.MockedClass<typeof UsageService>;
 function createService(client: Partial<TshdClient>): ClustersService {
   return new ClustersService(
     client as TshdClient,
-    {
-      removeKubeConfig: jest.fn().mockResolvedValueOnce(undefined),
-    } as unknown as MainProcessClient,
+    new MockMainProcessClient(),
     new NotificationsServiceMock(),
     new UsageServiceMock(undefined, undefined, undefined, undefined, undefined)
   );
@@ -73,7 +71,6 @@ function getClientMocks(): Partial<TshdClient> {
     login: jest.fn().mockReturnValueOnce(new MockedUnaryCall({})),
     logout: jest.fn().mockReturnValueOnce(new MockedUnaryCall({})),
     addCluster: jest.fn().mockReturnValueOnce(new MockedUnaryCall(clusterMock)),
-    removeCluster: jest.fn().mockReturnValueOnce(new MockedUnaryCall({})),
     getCluster: jest.fn().mockReturnValueOnce(new MockedUnaryCall(clusterMock)),
     listLeafClusters: jest
       .fn()
@@ -93,50 +90,7 @@ function getClientMocks(): Partial<TshdClient> {
   };
 }
 
-test('add cluster', async () => {
-  const { addCluster } = getClientMocks();
-  const service = createService({
-    addCluster,
-  });
-
-  await service.addRootCluster(clusterUri);
-
-  expect(addCluster).toHaveBeenCalledWith({ name: clusterUri });
-  expect(service.state.clusters).toStrictEqual(
-    new Map([[clusterUri, clusterMock]])
-  );
-});
-
-test('add cluster does not overwrite the existing cluster', async () => {
-  const { addCluster } = getClientMocks();
-  const service = createService({
-    addCluster,
-  });
-  service.state.clusters.set(clusterUri, {
-    ...clusterMock,
-    features: { advancedAccessWorkflows: true, isUsageBasedBilling: true },
-  });
-
-  await service.addRootCluster(clusterUri);
-
-  expect(addCluster).toHaveBeenCalledWith({ name: clusterUri });
-  expect(service.state.clusters).toStrictEqual(
-    new Map([
-      [
-        clusterUri,
-        {
-          ...clusterMock,
-          features: {
-            advancedAccessWorkflows: true,
-            isUsageBasedBilling: true,
-          },
-        },
-      ],
-    ])
-  );
-});
-
-test('remove cluster', async () => {
+test('remove gateways', async () => {
   const { removeGateway } = getClientMocks();
   const service = createService({ removeGateway });
   const gatewayFromRootCluster = makeDatabaseGateway({
@@ -153,10 +107,6 @@ test('remove cluster', async () => {
   });
 
   service.setState(draftState => {
-    draftState.clusters = new Map([
-      [clusterMock.uri, clusterMock],
-      [leafClusterMock.uri, leafClusterMock],
-    ]);
     draftState.gateways = new Map([
       [gatewayFromRootCluster.uri, gatewayFromRootCluster],
       [gatewayFromLeafCluster.uri, gatewayFromLeafCluster],
@@ -164,14 +114,11 @@ test('remove cluster', async () => {
     ]);
   });
 
-  await service.removeClusterAndResources(clusterUri);
+  await service.removeClusterGateways(clusterUri);
 
-  expect(service.findCluster(clusterUri)).toBeUndefined();
-  expect(service.findCluster(leafClusterMock.uri)).toBeUndefined();
   expect(service.state.gateways).toEqual(
     new Map([[gatewayFromOtherCluster.uri, gatewayFromOtherCluster]])
   );
-
   expect(removeGateway).toHaveBeenCalledWith({
     gatewayUri: gatewayFromRootCluster.uri,
   });
@@ -183,85 +130,6 @@ test('remove cluster', async () => {
   });
 });
 
-test('sync root cluster', async () => {
-  const { getCluster, listLeafClusters, startHeadlessWatcher } =
-    getClientMocks();
-  const service = createService({
-    getCluster,
-    listLeafClusters,
-    startHeadlessWatcher,
-  });
-
-  await service.syncAndWatchRootClusterWithErrorHandling(clusterUri);
-
-  const clusterMockWithRequests = {
-    ...clusterMock,
-    loggedInUser: { ...clusterMock.loggedInUser, assumedRequests: {} },
-  };
-  expect(service.findCluster(clusterUri)).toStrictEqual(
-    clusterMockWithRequests
-  );
-  expect(service.findCluster(leafClusterMock.uri)).toStrictEqual(
-    leafClusterMock
-  );
-  expect(listLeafClusters).toHaveBeenCalledWith({ clusterUri });
-  expect(startHeadlessWatcher).toHaveBeenCalledWith({
-    rootClusterUri: clusterUri,
-  });
-});
-
-test('login into cluster and sync cluster', async () => {
-  const client = getClientMocks();
-  const service = createService(client);
-  const loginParams = {
-    kind: 'local' as const,
-    clusterUri,
-    username: 'admin',
-    password: 'admin',
-    token: '1234',
-  };
-
-  await service.loginLocal(loginParams, undefined);
-
-  expect(client.login).toHaveBeenCalledWith(
-    {
-      clusterUri: loginParams.clusterUri,
-      params: {
-        oneofKind: 'local',
-        local: {
-          password: loginParams.password,
-          user: loginParams.username,
-          token: loginParams.token,
-        },
-      },
-    },
-    { abort: undefined }
-  );
-  expect(service.findCluster(clusterUri).connected).toBe(true);
-});
-
-test('logout from cluster', async () => {
-  const { logout, removeCluster } = getClientMocks();
-  const service = createService({
-    logout,
-    removeCluster,
-    getCluster: () => new MockedUnaryCall({ ...clusterMock, connected: false }),
-  });
-  service.setState(draftState => {
-    draftState.clusters = new Map([
-      [clusterMock.uri, clusterMock],
-      [leafClusterMock.uri, leafClusterMock],
-    ]);
-  });
-
-  await service.logout(clusterUri);
-
-  expect(logout).toHaveBeenCalledWith({ clusterUri });
-  expect(removeCluster).toHaveBeenCalledWith({ clusterUri });
-  expect(service.findCluster(clusterMock.uri).connected).toBe(false);
-  expect(service.findCluster(leafClusterMock.uri).connected).toBe(false);
-});
-
 test('create a gateway', async () => {
   const { createGateway } = getClientMocks();
   const service = createService({
diff --git a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
index 1e35b6f55e299..19806324102a3 100644
--- a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
+++ b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
@@ -16,48 +16,51 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { AccessRequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
-import {
-  Cluster,
-  ShowResources,
-} from 'gen-proto-ts/teleport/lib/teleterm/v1/cluster_pb';
+import { applyPatches, castDraft, enablePatches } from 'immer';
+
 import { Gateway } from 'gen-proto-ts/teleport/lib/teleterm/v1/gateway_pb';
 import {
   CreateAccessRequestRequest,
   CreateGatewayRequest,
-  PasswordlessPrompt,
   PromoteAccessRequestRequest,
   ReviewAccessRequestRequest,
 } from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
 import { useStore } from 'shared/libs/stores';
-import { isAbortError } from 'shared/utils/abortError';
-import { pipe } from 'shared/utils/pipe';
+import { AbortError, isAbortError } from 'shared/utils/error';
 
+import type { State as ClustersState } from 'teleterm/mainProcess/clusterStore';
 import { MainProcessClient } from 'teleterm/mainProcess/types';
-import {
-  CloneableAbortSignal,
-  cloneAbortSignal,
-  TshdClient,
-} from 'teleterm/services/tshd';
+import { TshdClient } from 'teleterm/services/tshd';
 import { getGatewayTargetUriKind } from 'teleterm/services/tshd/gateway';
 import { NotificationsService } from 'teleterm/ui/services/notifications';
 import { UsageService } from 'teleterm/ui/services/usage';
 import * as uri from 'teleterm/ui/uri';
 
 import { ImmutableStore } from '../immutableStore';
-import type * as types from './types';
 
 const { routing } = uri;
 
-export function createClusterServiceState(): types.ClustersServiceState {
+type ClustersServiceState = {
+  /**
+   * `clusters` is a local mirror of the `ClusterStore` state from the main process.
+   * This state is read-only and must not be updated manually — it is managed exclusively
+   * through `subscribeToClusterStore`.
+   */
+  clusters: ClustersState;
+  gateways: Map<uri.GatewayUri, Gateway>;
+};
+
+enablePatches();
+
+export function createClusterServiceState(): ClustersServiceState {
   return {
     clusters: new Map(),
     gateways: new Map(),
   };
 }
 
-export class ClustersService extends ImmutableStore<types.ClustersServiceState> {
-  state: types.ClustersServiceState = createClusterServiceState();
+export class ClustersService extends ImmutableStore<ClustersServiceState> {
+  state: ClustersServiceState = createClusterServiceState();
 
   constructor(
     public client: TshdClient,
@@ -66,93 +69,7 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     private usageService: UsageService
   ) {
     super();
-  }
-
-  async addRootCluster(addr: string) {
-    const { response: cluster } = await this.client.addCluster({ name: addr });
-    // Do not overwrite the existing cluster;
-    // otherwise we may lose properties fetched from the auth server.
-    // Consider separating properties read from profile and those
-    // fetched from the auth server at the RPC message level.
-    if (!this.state.clusters.has(cluster.uri)) {
-      this.setState(draft => {
-        draft.clusters.set(
-          cluster.uri,
-          this.removeInternalLoginsFromCluster(cluster)
-        );
-      });
-    }
-
-    return cluster;
-  }
-
-  /**
-   * Logs out of the cluster and removes the profile.
-   * Does not remove the cluster from the state, but sets the cluster and its leafs as disconnected.
-   * It needs to be done, because some code can operate on the cluster the intermediate period between logout
-   * and actually removing it from the state.
-   * A code that operates on that intermediate state is in `useClusterLogout.tsx`.
-   * After invoking `logout()`, it looks for the next workspace to switch to. If we hadn't marked the cluster as disconnected,
-   * the method might have returned us the same cluster we wanted to log out of.
-   */
-  async logout(clusterUri: uri.RootClusterUri) {
-    // TODO(gzdunek): logout and removeCluster should be combined into a single acton in tshd
-    await this.client.logout({ clusterUri });
-    await this.client.removeCluster({ clusterUri });
-
-    this.setState(draft => {
-      draft.clusters.forEach(cluster => {
-        if (routing.belongsToProfile(clusterUri, cluster.uri)) {
-          cluster.connected = false;
-        }
-      });
-    });
-  }
-
-  async loginLocal(
-    params: types.LoginLocalParams,
-    abortSignal: CloneableAbortSignal
-  ) {
-    await this.client.login(
-      {
-        clusterUri: params.clusterUri,
-        params: {
-          oneofKind: 'local',
-          local: {
-            user: params.username,
-            password: params.password,
-            token: params.token,
-          },
-        },
-      },
-      { abort: abortSignal }
-    );
-    // We explicitly use the `andCatchErrors` variant here. If loginLocal succeeds but syncing the
-    // cluster fails, we don't want to stop the user on the failed modal – we want to open the
-    // workspace and show an error state within the workspace.
-    await this.syncAndWatchRootClusterWithErrorHandling(params.clusterUri);
-    this.usageService.captureUserLogin(params.clusterUri, 'local');
-  }
-
-  async loginSso(
-    params: types.LoginSsoParams,
-    abortSignal: CloneableAbortSignal
-  ) {
-    await this.client.login(
-      {
-        clusterUri: params.clusterUri,
-        params: {
-          oneofKind: 'sso',
-          sso: {
-            providerType: params.providerType,
-            providerName: params.providerName,
-          },
-        },
-      },
-      { abort: abortSignal }
-    );
-    await this.syncAndWatchRootClusterWithErrorHandling(params.clusterUri);
-    this.usageService.captureUserLogin(params.clusterUri, params.providerType);
+    this.subscribeToClusterStore();
   }
 
   async authenticateWebDevice(
@@ -180,99 +97,6 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     });
   }
 
-  async loginPasswordless(
-    params: types.LoginPasswordlessParams,
-    abortSignal: CloneableAbortSignal
-  ) {
-    await new Promise<void>((resolve, reject) => {
-      const stream = this.client.loginPasswordless({
-        abort: abortSignal,
-      });
-
-      let hasDeviceBeenTapped = false;
-
-      // Init the stream.
-      stream.requests.send({
-        request: {
-          oneofKind: 'init',
-          init: {
-            clusterUri: params.clusterUri,
-          },
-        },
-      });
-
-      stream.responses.onMessage(function (response) {
-        switch (response.prompt) {
-          case PasswordlessPrompt.PIN:
-            const pinResponse = (pin: string) => {
-              stream.requests.send({
-                request: {
-                  oneofKind: 'pin',
-                  pin: { pin },
-                },
-              });
-            };
-
-            params.onPromptCallback({
-              type: 'pin',
-              onUserResponse: pinResponse,
-            });
-            return;
-
-          case PasswordlessPrompt.CREDENTIAL:
-            const credResponse = (index: number) => {
-              stream.requests.send({
-                request: {
-                  oneofKind: 'credential',
-                  credential: { index: BigInt(index) },
-                },
-              });
-            };
-
-            params.onPromptCallback({
-              type: 'credential',
-              onUserResponse: credResponse,
-              data: { credentials: response.credentials || [] },
-            });
-            return;
-
-          case PasswordlessPrompt.TAP:
-            if (hasDeviceBeenTapped) {
-              params.onPromptCallback({ type: 'retap' });
-            } else {
-              hasDeviceBeenTapped = true;
-              params.onPromptCallback({ type: 'tap' });
-            }
-            return;
-
-          // Following cases should never happen but just in case?
-          case PasswordlessPrompt.UNSPECIFIED:
-            stream.requests.complete();
-            return reject(new Error('no passwordless prompt was specified'));
-
-          default:
-            stream.requests.complete();
-            return reject(
-              new Error(
-                `passwordless prompt '${response.prompt}' not supported`
-              )
-            );
-        }
-      });
-
-      stream.responses.onComplete(function () {
-        resolve();
-      });
-
-      stream.responses.onError(function (err: Error) {
-        reject(err);
-      });
-    });
-
-    await this.syncAndWatchRootClusterWithErrorHandling(params.clusterUri);
-    this.usageService.captureUserLogin(params.clusterUri, 'passwordless');
-  }
-
   /**
    * Synchronizes the cluster state and starts a headless watcher for it.
    * It shows errors as notifications.
@@ -281,7 +105,7 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     clusterUri: uri.RootClusterUri
   ) {
     try {
-      await this.syncRootCluster(clusterUri);
+      await this.mainProcessClient.syncCluster(clusterUri);
     } catch (e) {
       const cluster = this.findCluster(clusterUri);
       const clusterName =
@@ -331,21 +155,35 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
    * errors up.
    */
   async syncRootCluster(clusterUri: uri.RootClusterUri) {
-    await Promise.all([
-      this.syncClusterInfo(clusterUri),
-      this.syncLeafClustersList(clusterUri),
-    ]);
+    await this.mainProcessClient.syncCluster(clusterUri);
   }
 
+  /**
+   * Synchronizes root clusters.
+   *
+   * This should only be called before creating workspaces.
+   * If called afterward, a cluster might be removed without first removing
+   * its associated workspace, resulting in an invalid state.
+   */
   async syncRootClustersAndCatchErrors(abortSignal?: AbortSignal) {
-    let clusters: Cluster[];
-
+    //TODO(gzdunek): Implement passing abort signals over IPC.
+    // In this particular case it's fine to discard waiting for the result.
+    const abortPromise =
+      abortSignal &&
+      new Promise<never>((_, reject) => {
+        if (abortSignal.aborted) {
+          reject(new AbortError());
+          return;
+        }
+        abortSignal.addEventListener('abort', () => reject(new AbortError()), {
+          once: true,
+        });
+      });
     try {
-      const { response } = await this.client.listRootClusters(
-        {},
-        { abortSignal: abortSignal && cloneAbortSignal(abortSignal) }
-      );
-      clusters = response.clusters;
+      await Promise.race([
+        abortPromise,
+        await this.mainProcessClient.syncRootClusters(),
+      ]);
     } catch (error) {
       if (isAbortError(error)) {
         this.logger.info('Listing root clusters aborted');
@@ -365,14 +203,8 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
       return;
     }
 
-    this.setState(draft => {
-      draft.clusters = new Map(
-        clusters.map(c => [c.uri, this.removeInternalLoginsFromCluster(c)])
-      );
-    });
-
     // Sync root clusters and resume headless watchers for any active login sessions.
-    clusters
+    this.getRootClusters()
       .filter(c => c.connected)
       .forEach(c => this.syncAndWatchRootClusterWithErrorHandling(c.uri));
   }
@@ -398,31 +230,11 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     }
   }
 
-  private async syncLeafClustersList(clusterUri: uri.RootClusterUri) {
-    const { response } = await this.client.listLeafClusters({
-      clusterUri,
-    });
-
-    this.setState(draft => {
-      for (const leaf of response.clusters) {
-        draft.clusters.set(
-          leaf.uri,
-          this.removeInternalLoginsFromCluster(leaf)
-        );
-      }
-    });
-
-    return response.clusters;
-  }
-
-  /** @deprecated Use getAssumedRequests function instead of the method on ClustersService. */
-  getAssumedRequests(
-    rootClusterUri: uri.RootClusterUri
-  ): Record<string, AccessRequest> {
-    return getAssumedRequests(this.state, rootClusterUri);
-  }
-
-  /** Assumes roles for the given requests. */
+  /**
+   * Assumes roles for the given requests.
+   * After it's done, resources refresh is requested in
+   * ClusterLifecycleManager.syncCluster.
+   */
   async assumeRoles(
     rootClusterUri: uri.RootClusterUri,
     requestIds: string[]
@@ -436,7 +248,11 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     await this.syncRootCluster(rootClusterUri);
   }
 
-  /** Drops roles for the given requests. */
+  /**
+   * Drops roles for the given requests.
+   * After it's done, resources refresh is requested in
+   * ClusterLifecycleManager.syncCluster.
+   */
   async dropRoles(
     rootClusterUri: uri.RootClusterUri,
     requestIds: string[]
@@ -449,18 +265,6 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     await this.syncRootCluster(rootClusterUri);
   }
 
-  async getAccessRequest(
-    rootClusterUri: uri.RootClusterUri,
-    requestId: string
-  ) {
-    const { response } = await this.client.getAccessRequest({
-      clusterUri: rootClusterUri,
-      accessRequestId: requestId,
-    });
-
-    return response.request;
-  }
-
   async reviewAccessRequest(params: ReviewAccessRequestRequest) {
     const { response } = await this.client.reviewAccessRequest(params);
     this.usageService.captureAccessRequestReview(params.rootClusterUri);
@@ -484,22 +288,9 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     return response;
   }
 
-  /** Removes cluster, its leafs and other resources. */
-  async removeClusterAndResources(clusterUri: uri.RootClusterUri) {
-    this.setState(draft => {
-      draft.clusters.forEach(cluster => {
-        if (routing.belongsToProfile(clusterUri, cluster.uri)) {
-          draft.clusters.delete(cluster.uri);
-        }
-      });
-    });
-    await this.removeClusterKubeConfigs(clusterUri);
-    await this.removeClusterGateways(clusterUri);
-  }
-
   // TODO(ravicious): Create a single RPC for this rather than sending a separate request for each
   // gateway.
-  private async removeClusterGateways(clusterUri: uri.RootClusterUri) {
+  async removeClusterGateways(clusterUri: uri.RootClusterUri) {
     for (const [, gateway] of this.state.gateways) {
       if (routing.belongsToProfile(clusterUri, gateway.targetUri)) {
         try {
@@ -681,109 +472,19 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
     return this.getClusters().filter(c => !c.leaf);
   }
 
-  async removeClusterKubeConfigs(clusterUri: string): Promise<void> {
-    const {
-      params: { rootClusterId },
-    } = routing.parseClusterUri(clusterUri);
-    return this.mainProcessClient.removeKubeConfig({
-      relativePath: rootClusterId,
-      isDirectory: true,
-    });
-  }
-
-  async removeKubeConfig(kubeConfigRelativePath: string): Promise<void> {
-    return this.mainProcessClient.removeKubeConfig({
-      relativePath: kubeConfigRelativePath,
-    });
-  }
-
   useState() {
     return useStore(this).state;
   }
 
-  private async syncClusterInfo(clusterUri: uri.RootClusterUri) {
-    try {
-      const { response: cluster } = await this.client.getCluster({
-        clusterUri,
-      });
-      // TODO: this information should eventually be gathered by getCluster
-      const assumedRequests = cluster.loggedInUser
-        ? await this.fetchClusterAssumedRequests(
-            cluster.loggedInUser.activeRequests,
-            clusterUri
-          )
-        : undefined;
-      const mergeAssumedRequests = (cluster: Cluster) => ({
-        ...cluster,
-        loggedInUser: cluster.loggedInUser && {
-          ...cluster.loggedInUser,
-          assumedRequests,
-        },
-      });
-      const processCluster = pipe(
-        this.removeInternalLoginsFromCluster,
-        mergeAssumedRequests
-      );
-
-      this.setState(draft => {
-        draft.clusters.set(clusterUri, processCluster(cluster));
-      });
-    } catch (error) {
-      this.setState(draft => {
-        const cluster = draft.clusters.get(clusterUri);
-        if (cluster) {
-          // TODO(gzdunek): We should rather store the cluster synchronization status,
-          // so the callsites could check it before reading the field.
-          // The workaround is to update the field in case of a failure,
-          // so the places that wait for showResources !== UNSPECIFIED don't get stuck indefinitely.
-          cluster.showResources = ShowResources.ACCESSIBLE_ONLY;
+  private subscribeToClusterStore(): void {
+    this.mainProcessClient.subscribeToClusterStore(e => {
+      this.setState(c => {
+        if (e.kind === 'state') {
+          c.clusters = castDraft(e.value);
+          return;
         }
+        applyPatches(c.clusters, e.value);
       });
-
-      throw error;
-    }
-  }
-
-  private async fetchClusterAssumedRequests(
-    activeRequestsList: string[],
-    clusterUri: uri.RootClusterUri
-  ) {
-    return (
-      await Promise.all(
-        activeRequestsList.map(requestId =>
-          this.getAccessRequest(clusterUri, requestId)
-        )
-      )
-    ).reduce((requestsMap, request) => {
-      requestsMap[request.id] = request;
-      return requestsMap;
-    }, {});
-  }
-
-  // temporary fix for https://github.com/gravitational/webapps.e/issues/294
-  // remove when it will get fixed in `tsh`
-  // alternatively, show only valid logins basing on RBAC check
-  private removeInternalLoginsFromCluster(cluster: Cluster): Cluster {
-    return {
-      ...cluster,
-      loggedInUser: cluster.loggedInUser && {
-        ...cluster.loggedInUser,
-        sshLogins: cluster.loggedInUser.sshLogins.filter(
-          login => !login.startsWith('-')
-        ),
-      },
-    };
+    });
   }
 }
-
-// A workaround to always return the same object so useEffect that relies on it
-// doesn't go into an endless loop.
-const EMPTY_ASSUMED_REQUESTS = {};
-
-export function getAssumedRequests(
-  state: types.ClustersServiceState,
-  rootClusterUri: uri.RootClusterUri
-): Record<string, AccessRequest> {
-  const cluster = state.clusters.get(rootClusterUri);
-  return cluster?.loggedInUser?.assumedRequests || EMPTY_ASSUMED_REQUESTS;
-}
diff --git a/web/packages/teleterm/src/ui/services/clusters/index.ts b/web/packages/teleterm/src/ui/services/clusters/index.ts
index dd39fb04e436a..fe661d1c823c9 100644
--- a/web/packages/teleterm/src/ui/services/clusters/index.ts
+++ b/web/packages/teleterm/src/ui/services/clusters/index.ts
@@ -17,4 +17,3 @@
  */
 
 export * from './clustersService';
-export * from './types';
diff --git a/web/packages/teleterm/src/ui/services/clusters/types.ts b/web/packages/teleterm/src/ui/services/clusters/types.ts
deleted file mode 100644
index c1faecd060c8b..0000000000000
--- a/web/packages/teleterm/src/ui/services/clusters/types.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import * as shared from 'shared/services/types';
-
-import * as tsh from 'teleterm/services/tshd/types';
-import * as uri from 'teleterm/ui/uri';
-
-export type AuthProviderType = shared.AuthProviderType;
-
-export type AuthProvider = tsh.AuthProvider;
-
-export interface LoginLocalParams {
-  kind: 'local';
-  clusterUri: uri.RootClusterUri;
-  username: string;
-  password: string;
-  token?: string;
-}
-
-export interface LoginSsoParams {
-  kind: 'sso';
-  clusterUri: uri.RootClusterUri;
-  providerType: string;
-  providerName: string;
-}
-
-export interface LoginPasswordlessParams {
-  kind: 'passwordless';
-  clusterUri: uri.RootClusterUri;
-  onPromptCallback(res: PasswordlessLoginPrompt): void;
-}
-
-export type LoginParams =
-  | LoginLocalParams
-  | LoginPasswordlessParams
-  | LoginSsoParams;
-
-export type PasswordlessLoginPrompt =
-  | { type: 'tap' }
-  | { type: 'retap' }
-  | { type: 'pin'; onUserResponse(pin: string): void }
-  | {
-      type: 'credential';
-      data: { credentials: tsh.CredentialInfo[] };
-      onUserResponse(index: number): void;
-    };
-
-export type ClustersServiceState = {
-  clusters: Map<
-    uri.ClusterUri,
-    tsh.Cluster & {
-      // TODO(gzdunek): Remove assumedRequests from loggedInUser.
-      // The AssumedRequest objects are needed only in AssumedRolesBar.
-      // We should be able to move fetching them there.
-      loggedInUser?: tsh.LoggedInUser & {
-        assumedRequests?: Record<string, tsh.AccessRequest>;
-      };
-    }
-  >;
-  gateways: Map<uri.GatewayUri, tsh.Gateway>;
-};
diff --git a/web/packages/teleterm/src/ui/services/connectionTracker/trackedConnectionUtils.ts b/web/packages/teleterm/src/ui/services/connectionTracker/trackedConnectionUtils.ts
index 10aecd311154d..86cd3161cecc7 100644
--- a/web/packages/teleterm/src/ui/services/connectionTracker/trackedConnectionUtils.ts
+++ b/web/packages/teleterm/src/ui/services/connectionTracker/trackedConnectionUtils.ts
@@ -183,6 +183,7 @@ export function createGatewayConnection(
     targetUser: document.targetUser,
     targetName: document.targetName,
     targetSubresourceName: document.targetSubresourceName,
+    targetProtocol: document.targetProtocol,
   };
 }
 
diff --git a/web/packages/teleterm/src/ui/services/connectionTracker/types.ts b/web/packages/teleterm/src/ui/services/connectionTracker/types.ts
index 013781d42ffb1..c9f5ddfcb2c48 100644
--- a/web/packages/teleterm/src/ui/services/connectionTracker/types.ts
+++ b/web/packages/teleterm/src/ui/services/connectionTracker/types.ts
@@ -44,6 +44,7 @@ export interface TrackedGatewayConnection extends TrackedConnectionBase {
   targetUser?: string;
   port?: string;
   targetSubresourceName?: string;
+  targetProtocol?: string;
 }
 
 export interface TrackedKubeConnection extends TrackedConnectionBase {
diff --git a/web/packages/teleterm/src/ui/services/immutableStore/immutableStore.ts b/web/packages/teleterm/src/ui/services/immutableStore/immutableStore.ts
index 65979a1c04712..ae466e0fefc09 100644
--- a/web/packages/teleterm/src/ui/services/immutableStore/immutableStore.ts
+++ b/web/packages/teleterm/src/ui/services/immutableStore/immutableStore.ts
@@ -18,7 +18,7 @@
 
 /* eslint-disable @typescript-eslint/ban-ts-comment*/
 
-import { enableMapSet, produce } from 'immer';
+import { enableMapSet, produce, Producer } from 'immer';
 
 import stateLogger from 'shared/libs/stores/logger';
 import Store from 'shared/libs/stores/store';
@@ -31,7 +31,7 @@ export class ImmutableStore<T> extends Store<T> {
   protected logger = new Logger(this.constructor.name);
 
   // @ts-ignore
-  setState(nextState: (draftState: T) => T | void): void {
+  setState(nextState: Producer<T>): void {
     const prevState = this.state;
     this.state = produce(this.state, nextState);
     stateLogger.logState(this.constructor.name, prevState, 'with', this.state);
diff --git a/web/packages/teleterm/src/ui/services/modals/modalsService.ts b/web/packages/teleterm/src/ui/services/modals/modalsService.ts
index 93642c22c7257..9ec419b86109e 100644
--- a/web/packages/teleterm/src/ui/services/modals/modalsService.ts
+++ b/web/packages/teleterm/src/ui/services/modals/modalsService.ts
@@ -214,7 +214,6 @@ export type ClusterConnectReason =
 export interface DialogClusterLogout {
   kind: 'cluster-logout';
   clusterUri: RootClusterUri;
-  clusterTitle: string;
 }
 
 export interface DialogDocumentsReopen {
@@ -298,9 +297,26 @@ export interface DialogHardwareKeySlotOverwrite {
   onCancel(): void;
 }
 
+export interface DialogConfigureSSHClients {
+  kind: 'configure-ssh-clients';
+  /**
+   * onConfirm will be called when the user clicks the button to confirm automatic configuration
+   * for SSH clients. Any errors thrown by onConfirm will be captured and shown in the modal, the
+   * modal will only close if the promise resolves successfully.
+   */
+  onConfirm(): Promise<void>;
+  vnetSSHConfigPath: string;
+  host?: string;
+}
+
+export interface DialogAppUpdate {
+  kind: 'app-updates';
+}
+
 export type Dialog =
   | DialogClusterConnect
   | DialogClusterLogout
+  | DialogConfigureSSHClients
   | DialogDocumentsReopen
   | DialogUsageData
   | DialogUserJobRole
@@ -311,4 +327,5 @@ export type Dialog =
   | DialogHardwareKeyPin
   | DialogHardwareKeyTouch
   | DialogHardwareKeyPinChange
-  | DialogHardwareKeySlotOverwrite;
+  | DialogHardwareKeySlotOverwrite
+  | DialogAppUpdate;
diff --git a/web/packages/teleterm/src/ui/services/notifications/notificationsService.ts b/web/packages/teleterm/src/ui/services/notifications/notificationsService.ts
index 6e014e81dbf1c..c5d1c8906638f 100644
--- a/web/packages/teleterm/src/ui/services/notifications/notificationsService.ts
+++ b/web/packages/teleterm/src/ui/services/notifications/notificationsService.ts
@@ -17,26 +17,28 @@
  */
 
 import type {
-  NotificationItem,
-  NotificationItemContent,
-} from 'shared/components/Notification';
+  ToastNotificationItem,
+  ToastNotificationItemContent,
+} from 'shared/components/ToastNotification';
 import { useStore } from 'shared/libs/stores';
 
 import { ImmutableStore } from 'teleterm/ui/services/immutableStore';
 import { unique } from 'teleterm/ui/utils/uid';
 
-export class NotificationsService extends ImmutableStore<NotificationItem[]> {
-  state: NotificationItem[] = [];
+export class NotificationsService extends ImmutableStore<
+  ToastNotificationItem[]
+> {
+  state: ToastNotificationItem[] = [];
 
-  notifyError(content: NotificationItemContent): string {
+  notifyError(content: ToastNotificationItemContent): string {
     return this.notify({ severity: 'error', content });
   }
 
-  notifyWarning(content: NotificationItemContent): string {
+  notifyWarning(content: ToastNotificationItemContent): string {
     return this.notify({ severity: 'warn', content });
   }
 
-  notifyInfo(content: NotificationItemContent): string {
+  notifyInfo(content: ToastNotificationItemContent): string {
     return this.notify({ severity: 'info', content });
   }
 
@@ -54,7 +56,7 @@ export class NotificationsService extends ImmutableStore<NotificationItem[]> {
     );
   }
 
-  getNotifications(): NotificationItem[] {
+  getNotifications(): ToastNotificationItem[] {
     return this.state;
   }
 
@@ -62,11 +64,11 @@ export class NotificationsService extends ImmutableStore<NotificationItem[]> {
     return !!this.state.find(n => n.id === id);
   }
 
-  useState(): NotificationItem[] {
+  useState(): ToastNotificationItem[] {
     return useStore(this).state;
   }
 
-  private notify(options: Omit<NotificationItem, 'id'>): string {
+  private notify(options: Omit<ToastNotificationItem, 'id'>): string {
     const id = unique();
 
     this.setState(draftState => {
diff --git a/web/packages/teleterm/src/ui/services/statePersistence/statePersistenceService.ts b/web/packages/teleterm/src/ui/services/statePersistence/statePersistenceService.ts
index 2828ffc4c93b9..6c59b2c387946 100644
--- a/web/packages/teleterm/src/ui/services/statePersistence/statePersistenceService.ts
+++ b/web/packages/teleterm/src/ui/services/statePersistence/statePersistenceService.ts
@@ -64,6 +64,8 @@ export interface StatePersistenceState {
      */
     hasEverStarted: boolean;
   };
+  /** Shows a banner above the cluster list to notify that a new tsh home dir is used. */
+  showTshHomeMigrationBanner: boolean;
 }
 
 // Before adding new methods to this service, consider using usePersistedState instead.
diff --git a/web/packages/teleterm/src/ui/services/tshdNotifications/tshdNotificationService.ts b/web/packages/teleterm/src/ui/services/tshdNotifications/tshdNotificationService.ts
index c9bffb91d3eda..a304a6936290e 100644
--- a/web/packages/teleterm/src/ui/services/tshdNotifications/tshdNotificationService.ts
+++ b/web/packages/teleterm/src/ui/services/tshdNotifications/tshdNotificationService.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { NotificationItemContent } from 'shared/components/Notification';
+import { ToastNotificationItemContent } from 'shared/components/ToastNotification';
 
 import {
   cannotProxyVnetConnectionReasonIsCertReissueError,
@@ -47,7 +47,7 @@ export class TshdNotificationsService {
 
   private getNotificationContent(
     request: SendNotificationRequest
-  ): NotificationItemContent {
+  ): ToastNotificationItemContent {
     const { subject } = request;
     // switch followed by a type guard is awkward, but it helps with ensuring that we get type
     // errors whenever a new request reason is added.
@@ -148,6 +148,6 @@ export class TshdNotificationsService {
     const clusterUri = routing.ensureClusterUri(uri);
     const cluster = this.clustersService.findCluster(clusterUri);
 
-    return cluster ? cluster.name : routing.parseClusterName(clusterUri);
+    return cluster?.name || routing.parseClusterName(clusterUri);
   }
 }
diff --git a/web/packages/teleterm/src/ui/services/usage/usageService.ts b/web/packages/teleterm/src/ui/services/usage/usageService.ts
index 5dbdb334704c1..339a25e915bae 100644
--- a/web/packages/teleterm/src/ui/services/usage/usageService.ts
+++ b/web/packages/teleterm/src/ui/services/usage/usageService.ts
@@ -63,6 +63,11 @@ export class UsageService {
     private runtimeSettings: RuntimeSettings
   ) {}
 
+  /**
+   * Should be called only after a successful cluster sync.
+   * Otherwise, details of the root cluster (`authClusterId` and `name`)
+   * will be empty and this event won't be captured.
+   */
   captureUserLogin(uri: ClusterOrResourceUri, connectorType: string): void {
     const clusterProperties = this.getClusterProperties(uri);
     if (!clusterProperties) {
@@ -308,7 +313,14 @@ export class UsageService {
   private getClusterProperties(uri: ClusterOrResourceUri) {
     const rootClusterUri = routing.ensureRootClusterUri(uri);
     const cluster = this.findCluster(rootClusterUri);
-    if (!(cluster && cluster.loggedInUser && cluster.authClusterId)) {
+    if (
+      !(
+        cluster &&
+        cluster.loggedInUser &&
+        cluster.authClusterId &&
+        cluster.name
+      )
+    ) {
       return;
     }
 
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.test.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.test.ts
index 95e843367609e..b0c4569ff67c3 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.test.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.test.ts
@@ -16,6 +16,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+import { getAppProtocol } from 'shared/services/apps';
+
 import { makeApp, makeRootCluster } from 'teleterm/services/tshd/testHelpers';
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
 import {
@@ -113,6 +115,7 @@ describe('connectToApp', () => {
       targetUser: '',
       title: 'foo',
       uri: expect.any(String),
+      targetProtocol: 'TCP',
     });
   });
 });
@@ -147,6 +150,7 @@ describe('setUpAppGateway', () => {
     await setUpAppGateway(appContext, app.uri, {
       telemetry: { origin: 'resource_table' },
       targetPort,
+      targetProtocol: getAppProtocol(app.endpointUri),
     });
     const documents = appContext.workspacesService
       .getActiveWorkspaceDocumentService()
@@ -164,6 +168,7 @@ describe('setUpAppGateway', () => {
       targetUser: '',
       title: expectedTitle || 'foo',
       uri: expect.any(String),
+      targetProtocol: getAppProtocol(app.endpointUri),
     });
   });
 });
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.ts
index 2602b80b0763b..3102f5ca77f07 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToApp.ts
@@ -17,6 +17,7 @@
  */
 
 import { App } from 'gen-proto-ts/teleport/lib/teleterm/v1/app_pb';
+import { getAppProtocol } from 'shared/services/apps';
 
 import {
   getAwsAppLaunchUrl,
@@ -27,7 +28,7 @@ import {
 import { appToAddrToCopy } from 'teleterm/services/vnet/app';
 import { IAppContext } from 'teleterm/ui/types';
 import { AppUri, routing } from 'teleterm/ui/uri';
-import { VnetAppLauncher } from 'teleterm/ui/Vnet';
+import { VnetLauncher } from 'teleterm/ui/Vnet';
 
 import { DocumentOrigin } from './types';
 
@@ -46,7 +47,7 @@ export async function connectToApp(
    * launchVnet is supposed to be provided if VNet is supported. If so, connectToApp is going to use
    * this function when targeting a TCP app. Otherwise it'll create an app gateway.
    */
-  launchVnet: null | VnetAppLauncher,
+  launchVnet: null | VnetLauncher,
   target: App,
   telemetry: { origin: DocumentOrigin },
   options?: {
@@ -111,7 +112,7 @@ export async function connectToApp(
     await launchVnet({
       addrToCopy: appToAddrToCopy(target),
       resourceUri: target.uri,
-      isMultiPort: !!target.tcpPorts.length,
+      isMultiPortApp: !!target.tcpPorts.length,
     });
     return;
   }
@@ -121,7 +122,12 @@ export async function connectToApp(
     targetPort = target.tcpPorts[0].port;
   }
 
-  await setUpAppGateway(ctx, target.uri, { telemetry, targetPort });
+  const targetProtocol = getAppProtocol(target.endpointUri);
+  await setUpAppGateway(ctx, target.uri, {
+    telemetry,
+    targetPort,
+    targetProtocol,
+  });
 }
 
 export async function setUpAppGateway(
@@ -134,6 +140,10 @@ export async function setUpAppGateway(
      * only for multi-port TCP apps.
      */
     targetPort?: number;
+    /**
+     * targetProtocol is the protocol of the resource proxied by the gateway.
+     */
+    targetProtocol?: string;
   }
 ) {
   const rootClusterUri = routing.ensureRootClusterUri(targetUri);
@@ -146,6 +156,7 @@ export async function setUpAppGateway(
     targetName: routing.parseAppUri(targetUri).params.appId,
     targetUser: '',
     targetSubresourceName: options.targetPort?.toString(),
+    targetProtocol: options.targetProtocol,
   });
 
   const connectionToReuse = ctx.connectionTracker.findConnectionByDocument(doc);
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToDatabase.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToDatabase.ts
index 20238815acc3b..177c3a28fbf9f 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToDatabase.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToDatabase.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { GatewayProtocol } from 'teleterm/services/tshd/types';
+import { GatewayProtocol } from 'teleterm/services/tshd/gateway';
 import { IAppContext } from 'teleterm/ui/types';
 import { DatabaseUri, routing } from 'teleterm/ui/uri';
 
@@ -29,6 +29,7 @@ export async function connectToDatabase(
     name: string;
     protocol: string;
     dbUser: string;
+    gcpProjectId?: string;
   },
   telemetry: {
     origin: DocumentOrigin;
@@ -45,7 +46,8 @@ export async function connectToDatabase(
     targetName: target.name,
     targetUser: getTargetUser(
       target.protocol as GatewayProtocol,
-      target.dbUser
+      target.dbUser,
+      target.gcpProjectId
     ),
     origin: telemetry.origin,
   });
@@ -65,7 +67,8 @@ export async function connectToDatabase(
 
 function getTargetUser(
   protocol: GatewayProtocol,
-  providedDbUser: string
+  providedDbUser: string,
+  gcpProjectId?: string
 ): string {
   // we are replicating tsh behavior (user can be omitted for Redis)
   // https://github.com/gravitational/teleport/blob/796e37bdbc1cb6e0a93b07115ffefa0e6922c529/tool/tsh/db.go#L240-L244
@@ -74,5 +77,13 @@ function getTargetUser(
     return providedDbUser || 'default';
   }
 
+  // GCP Postgres databases require domain as part of the username
+  // this is often the `@<project-id>.iam` suffix, although in principle any domain can be used
+  // provide the suffix if we can do so sensibly, just like tsh does.
+  const user = providedDbUser.trim();
+  if (protocol === 'postgres' && gcpProjectId && user && !user.includes('@')) {
+    return `${user}@${gcpProjectId}.iam`;
+  }
+
   return providedDbUser;
 }
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.test.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.test.ts
new file mode 100644
index 0000000000000..16cf05b642f5f
--- /dev/null
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.test.ts
@@ -0,0 +1,42 @@
+/**
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+import { connectToWindowsDesktop } from 'teleterm/ui/services/workspacesService';
+
+test('updates active workspace to match target desktop', async () => {
+  const appContext = new MockAppContext();
+  const clusterFoo = makeRootCluster({ uri: '/clusters/foo' });
+  const clusterBar = makeRootCluster({ uri: '/clusters/bar' });
+  appContext.addRootCluster(clusterFoo);
+  // Sets "bar" as the active workspace.
+  appContext.addRootCluster(clusterBar);
+  expect(appContext.workspacesService.getRootClusterUri()).toBe(clusterBar.uri);
+
+  await connectToWindowsDesktop(
+    appContext,
+    {
+      uri: `${clusterFoo.uri}/windows_desktops/win`,
+      login: 'admin',
+    },
+    { origin: 'connection_list' }
+  );
+
+  expect(appContext.workspacesService.getRootClusterUri()).toBe(clusterFoo.uri);
+});
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.ts
index 13b0b2c63691c..59df222324b0e 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/connectToWindowsDesktop.ts
@@ -32,8 +32,10 @@ export async function connectToWindowsDesktop(
     origin: DocumentOrigin;
   }
 ): Promise<void> {
+  const rootClusterUri = routing.ensureRootClusterUri(target.uri);
+  await ctx.workspacesService.setActiveWorkspace(rootClusterUri);
   ctx.workspacesService
-    .getWorkspaceDocumentService(routing.ensureRootClusterUri(target.uri))
+    .getWorkspaceDocumentService(rootClusterUri)
     .openExistingOrAddNew(
       doc => {
         return (
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
index e974727d40926..54c2d3da69fd4 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
@@ -51,6 +51,7 @@ import {
   DocumentTshNode,
   DocumentVnetDiagReport,
   DocumentVnetInfo,
+  VnetLauncherArgs,
   WebSessionRequest,
 } from './types';
 
@@ -141,6 +142,7 @@ export class DocumentsService {
       port,
       gatewayUri,
       origin,
+      targetProtocol,
     } = opts;
     const uri = routing.getDocUri({ docId: unique() });
 
@@ -156,6 +158,7 @@ export class DocumentsService {
       port,
       origin,
       status: '',
+      targetProtocol,
     };
     doc.title = getDocumentGatewayTitle(doc);
     return doc;
@@ -243,10 +246,7 @@ export class DocumentsService {
 
   createVnetInfoDocument(opts: {
     rootClusterUri: RootClusterUri;
-    app?: {
-      targetAddress: string;
-      isMultiPort: boolean;
-    };
+    launcherArgs?: VnetLauncherArgs;
   }): DocumentVnetInfo {
     const uri = routing.getDocUri({ docId: unique() });
 
@@ -255,7 +255,7 @@ export class DocumentsService {
       kind: 'doc.vnet_info',
       title: 'VNet',
       rootClusterUri: opts.rootClusterUri,
-      app: opts.app,
+      launcherArgs: opts.launcherArgs,
     };
   }
 
@@ -584,5 +584,6 @@ export function getDefaultDocumentClusterQueryParams(): DocumentClusterQueryPara
     search: '',
     sort: { fieldName: 'name', dir: 'ASC' },
     advancedSearchEnabled: false,
+    statuses: [],
   };
 }
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/testHelpers.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/testHelpers.ts
index 90f3f72cd77ac..a0ae1bc3412c9 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/testHelpers.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/testHelpers.ts
@@ -44,6 +44,7 @@ export function makeDocumentCluster(
       resourceKinds: [],
       search: '',
       advancedSearchEnabled: false,
+      statuses: [],
     },
     ...props,
   };
@@ -221,7 +222,7 @@ export function makeDocumentVnetInfo(
     uri: '/docs/vnet-info',
     title: 'VNet',
     rootClusterUri,
-    app: undefined,
+    launcherArgs: undefined,
     ...props,
   };
 }
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
index cf702cab71fe8..279dce8aaf786 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
@@ -17,7 +17,10 @@
  */
 
 import { Report } from 'gen-proto-ts/teleport/lib/vnet/diag/v1/diag_pb';
-import { SharedUnifiedResource } from 'shared/components/UnifiedResources';
+import {
+  ResourceHealthStatus,
+  SharedUnifiedResource,
+} from 'shared/components/UnifiedResources';
 
 import type * as tsh from 'teleterm/services/tshd/types';
 import * as uri from 'teleterm/ui/uri';
@@ -104,6 +107,10 @@ export interface DocumentGateway extends DocumentBase {
    */
   port?: string;
   origin: DocumentOrigin;
+  /**
+   * targetProtocol is the protocol of the resource proxied by the gateway.
+   */
+  targetProtocol?: string;
 }
 
 /**
@@ -173,6 +180,7 @@ export interface DocumentClusterQueryParams {
     fieldName: string;
     dir: 'ASC' | 'DESC';
   };
+  statuses: ResourceHealthStatus[];
 }
 
 // Any changes done to this type must be backwards compatible as
@@ -227,30 +235,35 @@ export interface DocumentVnetInfo extends DocumentBase {
   // the document fields, hence why rootClusterUri is defined here.
   rootClusterUri: uri.RootClusterUri;
   /**
-   * Details of the app if the doc was opened by selecting a specific TCP app.
+   * Details of the resource if the doc was opened by selecting a specific resource.
    *
    * This field is needed to facilitate a scenario where a first-time user clicks "Connect" next to
-   * a TCP app, which opens this doc. Once the user clicks "Start VNet" in the doc, Connect should
-   * continue the regular flow of connecting to a TCP app through VNet, which means it should copy
-   * the address of the app to the clipboard, hence this field.
+   * a TCP app or SSH server, which opens this doc. Once the user clicks "Start VNet" in the doc,
+   * Connect should continue the regular flow of connecting to a TCP app through VNet, which means
+   * it should copy the address of the resource to the clipboard, hence this field.
    *
-   * app is removed when restoring persisted state. Let's say the user opens the doc through the
-   * "Connect" button of a specific app. If they close the app and then reopen the docs, we don't
+   * launcherArgs is removed when restoring persisted state. Let's say the user opens the doc through
+   * the "Connect" button of a specific app. If they close the app and then reopen the doc, we don't
    * want the "Start VNet" button to copy the address of the app from the prev session.
    */
-  app:
-    | {
-        /**
-         * The address that's going to be copied to the clipboard after user starts VNet for the
-         * first time through this document.
-         *
-         */
-        targetAddress: string | undefined;
-        isMultiPort: boolean;
-      }
-    | undefined;
+  launcherArgs: VnetLauncherArgs | undefined;
 }
 
+/**
+ * Details about a user-selected resource that prompted the VNet launch, so
+ * that addrToCopy can be copied to the clipboard after VNet launches with a
+ * helpful message displayed in a notification.
+ */
+export type VnetLauncherArgs = {
+  // The address that's going to be copied to the clipboard.
+  addrToCopy: string;
+  // The URI of the resource the user clicked.
+  resourceUri: uri.ResourceUri;
+  // True if the user clicked a multi-port TCP app, used to render a slightly
+  // different message in the (copied to clipboard) notification.
+  isMultiPortApp?: boolean;
+};
+
 /**
  * Document to authorize a web session with device trust.
  * Unlike other documents, it is not persisted on disk.
@@ -317,6 +330,7 @@ export type CreateGatewayDocumentOpts = {
   title?: string;
   port?: string;
   origin: DocumentOrigin;
+  targetProtocol?: string;
 };
 
 export type CreateAccessRequestDocumentOpts = {
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.test.ts b/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.test.ts
index 3f1c67beaf7c4..3f80718dd3a7f 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.test.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.test.ts
@@ -154,52 +154,25 @@ describe('restoring workspace', () => {
     };
     const clusterBar = makeRootCluster({ uri: '/clusters/bar' });
     const workspaceBar: PersistedWorkspace = {
+      color: 'purple',
       localClusterUri: clusterBar.uri,
       documents: [],
       location: undefined,
     };
     const clusterBaz = makeRootCluster({ uri: '/clusters/baz' });
-    const workspaceBaz: PersistedWorkspace = {
-      localClusterUri: clusterBaz.uri,
-      documents: [],
-      location: undefined,
-    };
     const clusterQux = makeRootCluster({ uri: '/clusters/qux' });
-    const workspaceQux: PersistedWorkspace = {
-      localClusterUri: clusterQux.uri,
-      documents: [],
-      location: undefined,
-    };
     const clusterWaldo = makeRootCluster({ uri: '/clusters/waldo' });
-    const workspaceWaldo: PersistedWorkspace = {
-      localClusterUri: clusterWaldo.uri,
-      documents: [],
-      location: undefined,
-    };
     const clusterFred = makeRootCluster({ uri: '/clusters/fred' });
-    const workspaceFred: PersistedWorkspace = {
-      localClusterUri: clusterFred.uri,
-      documents: [],
-      location: undefined,
-    };
     const clusterGrault = makeRootCluster({ uri: '/clusters/grault' });
-    const workspaceGrault: PersistedWorkspace = {
-      localClusterUri: clusterGrault.uri,
-      documents: [],
-      location: undefined,
-    };
     const clusterPlugh = makeRootCluster({ uri: '/clusters/plugh' });
-    const workspacePlugh: PersistedWorkspace = {
-      localClusterUri: clusterPlugh.uri,
-      documents: [],
-      location: undefined,
-    };
 
     const { workspacesService } = getTestSetup({
       cluster: [
         clusterFoo,
-        clusterBar,
+        // The workspace for clusterBaz has no assigned color, but clusterBar's workspace does.
+        // Return clusterBaz first to verify that it receives a new, unused color.
         clusterBaz,
+        clusterBar,
         clusterQux,
         clusterWaldo,
         clusterFred,
@@ -209,20 +182,14 @@ describe('restoring workspace', () => {
       persistedWorkspaces: {
         [clusterFoo.uri]: workspaceFoo,
         [clusterBar.uri]: workspaceBar,
-        [clusterBaz.uri]: workspaceBaz,
-        [clusterQux.uri]: workspaceQux,
-        [clusterWaldo.uri]: workspaceWaldo,
-        [clusterFred.uri]: workspaceFred,
-        [clusterGrault.uri]: workspaceGrault,
-        [clusterPlugh.uri]: workspacePlugh,
       },
     });
 
     workspacesService.restorePersistedState();
 
     expect(workspacesService.getWorkspace(clusterFoo.uri).color).toBe('blue'); // read from disk
-    expect(workspacesService.getWorkspace(clusterBar.uri).color).toBe('purple'); // the first unused color
-    expect(workspacesService.getWorkspace(clusterBaz.uri).color).toBe('green');
+    expect(workspacesService.getWorkspace(clusterBar.uri).color).toBe('purple'); // read from disk
+    expect(workspacesService.getWorkspace(clusterBaz.uri).color).toBe('green'); // the first unused color
     expect(workspacesService.getWorkspace(clusterQux.uri).color).toBe('yellow');
     expect(workspacesService.getWorkspace(clusterWaldo.uri).color).toBe('red');
     expect(workspacesService.getWorkspace(clusterFred.uri).color).toBe('cyan');
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.ts b/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.ts
index 1f2874502cad6..636dc7f69aaa9 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/workspacesService.ts
@@ -352,6 +352,7 @@ export class WorkspacesService extends ImmutableStore<WorkspacesState> {
     }
 
     if (cluster.profileStatusError) {
+      // TODO(gzdunek): We should only sync the target cluster, not all of them.
       await this.clustersService.syncRootClustersAndCatchErrors(abortSignal);
       // Update the cluster.
       cluster = this.clustersService.findCluster(clusterUri);
@@ -465,6 +466,18 @@ export class WorkspacesService extends ImmutableStore<WorkspacesState> {
     });
   }
 
+  clearWorkspace(clusterUri: RootClusterUri): void {
+    this.setState(draftState => {
+      draftState.workspaces[clusterUri] = getWorkspaceDefaultState(
+        clusterUri,
+        draftState.workspaces
+      );
+    });
+    this.restoredState = produce(this.restoredState, draftState => {
+      delete draftState.workspaces[clusterUri];
+    });
+  }
+
   getConnectedWorkspacesClustersUri() {
     return (Object.keys(this.state.workspaces) as RootClusterUri[]).filter(
       clusterUri => this.clustersService.findCluster(clusterUri)?.connected
@@ -513,6 +526,14 @@ export class WorkspacesService extends ImmutableStore<WorkspacesState> {
     this.restoredState = produce(restoredState, () => {});
     const restoredWorkspaces = this.clustersService
       .getRootClusters()
+      // Start restoring clusters from the ones that already have a workspace.
+      // The algorithm that assigns a color in getWorkspaceDefaultState needs
+      // to know all used colors.
+      .toSorted((a, b) => {
+        const hasA = !!this.restoredState.workspaces[a.uri];
+        const hasB = !!this.restoredState.workspaces[b.uri];
+        return hasB === hasA ? 0 : hasA ? -1 : 1;
+      })
       .reduce((workspaces, cluster) => {
         const restoredWorkspace = this.restoredState.workspaces[cluster.uri];
         workspaces[cluster.uri] = getWorkspaceDefaultState(
@@ -579,6 +600,9 @@ export class WorkspacesService extends ImmutableStore<WorkspacesState> {
                 ...defaultParams.sort,
                 ...d.queryParams?.sort,
               },
+              statuses: d.queryParams?.statuses
+                ? [...d.queryParams.statuses] // makes the array mutable
+                : defaultParams.statuses,
               resourceKinds: d.queryParams?.resourceKinds
                 ? [...d.queryParams.resourceKinds] // makes the array mutable
                 : defaultParams.resourceKinds,
@@ -590,7 +614,7 @@ export class WorkspacesService extends ImmutableStore<WorkspacesState> {
         if (d.kind === 'doc.vnet_info') {
           const documentVnetInfo: DocumentVnetInfo = {
             ...d,
-            app: undefined,
+            launcherArgs: undefined,
           };
           return documentVnetInfo;
         }
@@ -647,20 +671,20 @@ export function getDefaultUnifiedResourcePreferences(): UnifiedResourcePreferenc
 const unifiedResourcePreferencesSchema = z
   .object({
     defaultTab: z
-      .nativeEnum(DefaultTab)
+      .enum(DefaultTab)
       .default(getDefaultUnifiedResourcePreferences().defaultTab),
     viewMode: z
-      .nativeEnum(ViewMode)
+      .enum(ViewMode)
       .default(getDefaultUnifiedResourcePreferences().viewMode),
     labelsViewMode: z
-      .nativeEnum(LabelsViewMode)
+      .enum(LabelsViewMode)
       .default(getDefaultUnifiedResourcePreferences().labelsViewMode),
     availableResourceMode: z
-      .nativeEnum(AvailableResourceMode)
+      .enum(AvailableResourceMode)
       .default(getDefaultUnifiedResourcePreferences().availableResourceMode),
   })
   // Assign the default values if undefined is passed.
-  .default({});
+  .prefault({});
 
 // Because we don't have `strictNullChecks` enabled, zod infers
 // all properties as optional.
diff --git a/web/packages/teleterm/src/ui/types.ts b/web/packages/teleterm/src/ui/types.ts
index ed00bfb246c14..09ec13cfc14f5 100644
--- a/web/packages/teleterm/src/ui/types.ts
+++ b/web/packages/teleterm/src/ui/types.ts
@@ -39,6 +39,7 @@ import { TerminalsService } from 'teleterm/ui/services/terminals';
 import { TshdNotificationsService } from 'teleterm/ui/services/tshdNotifications/tshdNotificationService';
 import { UsageService } from 'teleterm/ui/services/usage';
 import { WorkspacesService } from 'teleterm/ui/services/workspacesService';
+import { RootClusterUri } from 'teleterm/ui/uri';
 
 export interface IAppContext {
   clustersService: ClustersService;
@@ -83,8 +84,15 @@ export interface IAppContext {
    * process (renderer).
    */
   unexpectedVnetShutdownListener: UnexpectedVnetShutdownListener | undefined;
+
+  /** Sets the listener and returns a cleanup function which removes the listener. */
+  addResourceRefreshListener: (listener: ResourceRefreshListener) => () => void;
+  /** Gets called when `ClusterLifecycleManager` requests resource refresh. */
+  resourceRefreshListener: ResourceRefreshListener | undefined;
 }
 
 export type UnexpectedVnetShutdownListener = (
   request: tshdEventsApi.ReportUnexpectedVnetShutdownRequest
 ) => void;
+
+export type ResourceRefreshListener = (uri: RootClusterUri) => void;
diff --git a/web/packages/teleterm/src/ui/uri.test.ts b/web/packages/teleterm/src/ui/uri.test.ts
index 27af64558940b..421b5e0d5ff05 100644
--- a/web/packages/teleterm/src/ui/uri.test.ts
+++ b/web/packages/teleterm/src/ui/uri.test.ts
@@ -89,9 +89,7 @@ describe('getKubeResourceNamespaceUri', () => {
     },
   ];
 
-  /* eslint-disable jest/no-conditional-expect */
   test.each(tests)('$name', ({ input, output }) => {
     expect(routing.getKubeResourceNamespaceUri(input)).toEqual(output);
   });
-  /* eslint-enable jest/no-conditional-expect */
 });
diff --git a/web/packages/teleterm/src/ui/uri.ts b/web/packages/teleterm/src/ui/uri.ts
index 2001ea31313cf..9ac7a3d3e4eeb 100644
--- a/web/packages/teleterm/src/ui/uri.ts
+++ b/web/packages/teleterm/src/ui/uri.ts
@@ -178,11 +178,13 @@ export const routing = {
   },
 
   /**
-   * parseClusterName should be used only when getting the cluster object from ClustersService is
-   * not possible.
+   * Returns the profile name for root clusters and the cluster name for leaf clusters.
    *
-   * rootClusterId in the URI is not the name of the cluster but rather just the hostname of the
-   * proxy. These two might be different.
+   * In the URI, `rootClusterId` may not be the root cluster's name but the hostname
+   * of its proxy (these may differ).
+   * `leafClusterId`, on the other hand, always matches the leaf cluster's name.
+   *
+   * TODO(gzdunek): Split this function into `parseProfileName` and `parseLeafClusterName`.
    */
   parseClusterName(clusterUri: string) {
     const parsed = routing.parseClusterUri(clusterUri);
diff --git a/web/patches/jest-canvas-mock@2.5.2.patch b/web/patches/jest-canvas-mock@2.5.2.patch
new file mode 100644
index 0000000000000..f006395d8d500
--- /dev/null
+++ b/web/patches/jest-canvas-mock@2.5.2.patch
@@ -0,0 +1,54 @@
+diff --git a/lib/classes/CanvasRenderingContext2D.js b/lib/classes/CanvasRenderingContext2D.js
+index e1e4b8fe31826baadbdce3f48ee2a68455de8910..46dad56798ddc7fa094f911a7a7e0c97fb2a3770 100644
+--- a/lib/classes/CanvasRenderingContext2D.js
++++ b/lib/classes/CanvasRenderingContext2D.js
+@@ -15,7 +15,7 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
+ function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+ function _toPropertyKey(arg) { var key = _toPrimitive(arg, "string"); return typeof key === "symbol" ? key : String(key); }
+ function _toPrimitive(input, hint) { if (typeof input !== "object" || input === null) return input; var prim = input[Symbol.toPrimitive]; if (prim !== undefined) { var res = prim.call(input, hint || "default"); if (typeof res !== "object") return res; throw new TypeError("@@toPrimitive must return a primitive value."); } return (hint === "string" ? String : Number)(input); }
+-const testFuncs = ['setLineDash', 'getLineDash', 'setTransform', 'getTransform', 'getImageData', 'save', 'restore', 'createPattern', 'createRadialGradient', 'addHitRegion', 'arc', 'arcTo', 'beginPath', 'clip', 'closePath', 'scale', 'stroke', 'clearHitRegions', 'clearRect', 'fillRect', 'strokeRect', 'rect', 'resetTransform', 'translate', 'moveTo', 'lineTo', 'bezierCurveTo', 'createLinearGradient', 'ellipse', 'measureText', 'rotate', 'drawImage', 'drawFocusIfNeeded', 'isPointInPath', 'isPointInStroke', 'putImageData', 'strokeText', 'fillText', 'quadraticCurveTo', 'removeHitRegion', 'fill', 'transform', 'scrollPathIntoView', 'createImageData'];
++const testFuncs = ['setLineDash', 'getLineDash', 'setTransform', 'getTransform', 'getImageData', 'save', 'restore', 'createPattern', 'createRadialGradient', 'addHitRegion', 'arc', 'arcTo', 'beginPath', 'clip', 'closePath', 'scale', 'stroke', 'clearHitRegions', 'clearRect', 'fillRect', 'strokeRect', 'rect', 'roundRect', 'resetTransform', 'translate', 'moveTo', 'lineTo', 'bezierCurveTo', 'createLinearGradient', 'ellipse', 'measureText', 'rotate', 'drawImage', 'drawFocusIfNeeded', 'isPointInPath', 'isPointInStroke', 'putImageData', 'strokeText', 'fillText', 'quadraticCurveTo', 'removeHitRegion', 'fill', 'transform', 'scrollPathIntoView', 'createImageData'];
+ const compositeOperations = ['source-over', 'source-in', 'source-out', 'source-atop', 'destination-over', 'destination-in', 'destination-out', 'destination-atop', 'lighter', 'copy', 'xor', 'multiply', 'screen', 'overlay', 'darken', 'lighten', 'color-dodge', 'color-burn', 'hard-light', 'soft-light', 'difference', 'exclusion', 'hue', 'saturation', 'color', 'luminosity'];
+ function getTransformSlice(ctx) {
+   return ctx._transformStack[ctx._stackIndex].slice();
+@@ -909,6 +909,40 @@ class CanvasRenderingContext2D {
+     const event = (0, _createCanvasEvent.default)('restore', getTransformSlice(this), {});
+     this._events.push(event);
+   }
++  roundRect(x, y, width, height, radii) {
++    if (arguments.length < 4)
++      throw new TypeError(
++        "Failed to execute 'roundRect' on '" +
++        this.constructor.name +
++        "': 4 arguments required, but only " +
++        arguments.length +
++        ' present.'
++      );
++    if (radii.constructor === Array && (radii.length === 0 || radii.length > 4))
++      throw new TypeError(
++        "Failed to execute 'roundRect' on '" +
++        this.constructor.name +
++        "': " +
++        radii.length +
++        ' radii provided. Between one and four radii are necessary.'
++      );
++    if (!Number.isFinite(x + y + width + height)) return;
++
++    const xResult = Number(x);
++    const yResult = Number(y);
++    const widthResult = Number(width);
++    const heightResult = Number(height);
++    const event = (0, _createCanvasEvent.default)('roundRect', getTransformSlice(this), {
++      x: xResult,
++      y: yResult,
++      width: widthResult,
++      height: heightResult,
++      radii: radii,
++    });
++
++    this._events.push(event);
++    this._path.push(event);
++  }
+   rotate(angle) {
+     if (arguments.length < 1) throw new TypeError("Failed to execute 'rotate' on '" + this.constructor.name + "': 1 argument required, but only 0 present.");
+     angle = Number(angle);
diff --git a/web/scripts/list-installed-versions.sh b/web/scripts/list-installed-versions.sh
new file mode 100755
index 0000000000000..905e8031a8b32
--- /dev/null
+++ b/web/scripts/list-installed-versions.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 <package-name>" >&2
+  exit 1
+fi
+
+pnpm why -r "$1" --json | grep "\"$1\"" -A 3 | grep version | tr -s ' ' | cut -d ' ' -f 3 | sort | uniq